diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.068-069.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.068-069.patch deleted file mode 100644 index 781cb1f236..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.068-069.patch +++ /dev/null @@ -1,3750 +0,0 @@ -diff --git a/Makefile b/Makefile -index d57bf1b75593d8..ec4d9d1d9b7ae7 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 68 -+SUBLEVEL = 69 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/loongarch/include/asm/inst.h b/arch/loongarch/include/asm/inst.h -index 71e1ed4165c80d..4fa53ad82efb32 100644 ---- a/arch/loongarch/include/asm/inst.h -+++ b/arch/loongarch/include/asm/inst.h -@@ -655,7 +655,17 @@ DEF_EMIT_REG2I16_FORMAT(blt, blt_op) - DEF_EMIT_REG2I16_FORMAT(bge, bge_op) - DEF_EMIT_REG2I16_FORMAT(bltu, bltu_op) - DEF_EMIT_REG2I16_FORMAT(bgeu, bgeu_op) --DEF_EMIT_REG2I16_FORMAT(jirl, jirl_op) -+ -+static inline void emit_jirl(union loongarch_instruction *insn, -+ enum loongarch_gpr rd, -+ enum loongarch_gpr rj, -+ int offset) -+{ -+ insn->reg2i16_format.opcode = jirl_op; -+ insn->reg2i16_format.immediate = offset; -+ insn->reg2i16_format.rd = rd; -+ insn->reg2i16_format.rj = rj; -+} - - #define DEF_EMIT_REG2BSTRD_FORMAT(NAME, OP) \ - static inline void emit_##NAME(union loongarch_instruction *insn, \ -diff --git a/arch/loongarch/kernel/efi.c b/arch/loongarch/kernel/efi.c -index de4f3def4af0b9..4ae77e9300d580 100644 ---- a/arch/loongarch/kernel/efi.c -+++ b/arch/loongarch/kernel/efi.c -@@ -90,7 +90,7 @@ static void __init init_screen_info(void) - memset(si, 0, sizeof(*si)); - early_memunmap(si, sizeof(*si)); - -- memblock_reserve(screen_info.lfb_base, screen_info.lfb_size); -+ memblock_reserve(__screen_info_lfb_base(&screen_info), screen_info.lfb_size); - } - - void __init efi_init(void) -diff --git a/arch/loongarch/kernel/inst.c b/arch/loongarch/kernel/inst.c -index 3050329556d118..14d7d700bcb98f 100644 ---- a/arch/loongarch/kernel/inst.c -+++ b/arch/loongarch/kernel/inst.c -@@ -332,7 +332,7 @@ u32 larch_insn_gen_jirl(enum loongarch_gpr rd, enum loongarch_gpr rj, int imm) - return INSN_BREAK; - } - -- emit_jirl(&insn, rj, rd, imm >> 2); -+ emit_jirl(&insn, rd, rj, imm >> 2); - - return insn.word; - } -diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c -index 497f8b0a5f1efb..6595e992fda852 100644 ---- a/arch/loongarch/net/bpf_jit.c -+++ b/arch/loongarch/net/bpf_jit.c -@@ -181,13 +181,13 @@ static void __build_epilogue(struct jit_ctx *ctx, bool is_tail_call) - /* Set return value */ - emit_insn(ctx, addiw, LOONGARCH_GPR_A0, regmap[BPF_REG_0], 0); - /* Return to the caller */ -- emit_insn(ctx, jirl, LOONGARCH_GPR_RA, LOONGARCH_GPR_ZERO, 0); -+ emit_insn(ctx, jirl, LOONGARCH_GPR_ZERO, LOONGARCH_GPR_RA, 0); - } else { - /* - * Call the next bpf prog and skip the first instruction - * of TCC initialization. - */ -- emit_insn(ctx, jirl, LOONGARCH_GPR_T3, LOONGARCH_GPR_ZERO, 1); -+ emit_insn(ctx, jirl, LOONGARCH_GPR_ZERO, LOONGARCH_GPR_T3, 1); - } - } - -@@ -841,7 +841,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext - return ret; - - move_addr(ctx, t1, func_addr); -- emit_insn(ctx, jirl, t1, LOONGARCH_GPR_RA, 0); -+ emit_insn(ctx, jirl, LOONGARCH_GPR_RA, t1, 0); - move_reg(ctx, regmap[BPF_REG_0], LOONGARCH_GPR_A0); - break; - -diff --git a/arch/mips/Makefile b/arch/mips/Makefile -index f49807e1f19bc5..0888074f4dfef0 100644 ---- a/arch/mips/Makefile -+++ b/arch/mips/Makefile -@@ -299,7 +299,7 @@ drivers-$(CONFIG_PCI) += arch/mips/pci/ - ifdef CONFIG_64BIT - ifndef KBUILD_SYM32 - ifeq ($(shell expr $(load-y) \< 0xffffffff80000000), 0) -- KBUILD_SYM32 = y -+ KBUILD_SYM32 = $(call cc-option-yn, -msym32) - endif - endif - -diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h -index 2d53704d9f2461..e959a6b1a325ca 100644 ---- a/arch/mips/include/asm/mipsregs.h -+++ b/arch/mips/include/asm/mipsregs.h -@@ -2078,7 +2078,14 @@ do { \ - _ASM_INSN_IF_MIPS(0x4200000c) \ - _ASM_INSN32_IF_MM(0x0000517c) - #else /* !TOOLCHAIN_SUPPORTS_VIRT */ --#define _ASM_SET_VIRT ".set\tvirt\n\t" -+#if MIPS_ISA_REV >= 5 -+#define _ASM_SET_VIRT_ISA -+#elif defined(CONFIG_64BIT) -+#define _ASM_SET_VIRT_ISA ".set\tmips64r5\n\t" -+#else -+#define _ASM_SET_VIRT_ISA ".set\tmips32r5\n\t" -+#endif -+#define _ASM_SET_VIRT _ASM_SET_VIRT_ISA ".set\tvirt\n\t" - #define _ASM_SET_MFGC0 _ASM_SET_VIRT - #define _ASM_SET_DMFGC0 _ASM_SET_VIRT - #define _ASM_SET_MTGC0 _ASM_SET_VIRT -@@ -2099,7 +2106,6 @@ do { \ - ({ int __res; \ - __asm__ __volatile__( \ - ".set\tpush\n\t" \ -- ".set\tmips32r5\n\t" \ - _ASM_SET_MFGC0 \ - "mfgc0\t%0, " #source ", %1\n\t" \ - _ASM_UNSET_MFGC0 \ -@@ -2113,7 +2119,6 @@ do { \ - ({ unsigned long long __res; \ - __asm__ __volatile__( \ - ".set\tpush\n\t" \ -- ".set\tmips64r5\n\t" \ - _ASM_SET_DMFGC0 \ - "dmfgc0\t%0, " #source ", %1\n\t" \ - _ASM_UNSET_DMFGC0 \ -@@ -2127,7 +2132,6 @@ do { \ - do { \ - __asm__ __volatile__( \ - ".set\tpush\n\t" \ -- ".set\tmips32r5\n\t" \ - _ASM_SET_MTGC0 \ - "mtgc0\t%z0, " #register ", %1\n\t" \ - _ASM_UNSET_MTGC0 \ -@@ -2140,7 +2144,6 @@ do { \ - do { \ - __asm__ __volatile__( \ - ".set\tpush\n\t" \ -- ".set\tmips64r5\n\t" \ - _ASM_SET_DMTGC0 \ - "dmtgc0\t%z0, " #register ", %1\n\t" \ - _ASM_UNSET_DMTGC0 \ -diff --git a/arch/powerpc/platforms/book3s/vas-api.c b/arch/powerpc/platforms/book3s/vas-api.c -index f381b177ea06ad..0b6365d85d1171 100644 ---- a/arch/powerpc/platforms/book3s/vas-api.c -+++ b/arch/powerpc/platforms/book3s/vas-api.c -@@ -464,7 +464,43 @@ static vm_fault_t vas_mmap_fault(struct vm_fault *vmf) - return VM_FAULT_SIGBUS; - } - -+/* -+ * During mmap() paste address, mapping VMA is saved in VAS window -+ * struct which is used to unmap during migration if the window is -+ * still open. But the user space can remove this mapping with -+ * munmap() before closing the window and the VMA address will -+ * be invalid. Set VAS window VMA to NULL in this function which -+ * is called before VMA free. -+ */ -+static void vas_mmap_close(struct vm_area_struct *vma) -+{ -+ struct file *fp = vma->vm_file; -+ struct coproc_instance *cp_inst = fp->private_data; -+ struct vas_window *txwin; -+ -+ /* Should not happen */ -+ if (!cp_inst || !cp_inst->txwin) { -+ pr_err("No attached VAS window for the paste address mmap\n"); -+ return; -+ } -+ -+ txwin = cp_inst->txwin; -+ /* -+ * task_ref.vma is set in coproc_mmap() during mmap paste -+ * address. So it has to be the same VMA that is getting freed. -+ */ -+ if (WARN_ON(txwin->task_ref.vma != vma)) { -+ pr_err("Invalid paste address mmaping\n"); -+ return; -+ } -+ -+ mutex_lock(&txwin->task_ref.mmap_mutex); -+ txwin->task_ref.vma = NULL; -+ mutex_unlock(&txwin->task_ref.mmap_mutex); -+} -+ - static const struct vm_operations_struct vas_vm_ops = { -+ .close = vas_mmap_close, - .fault = vas_mmap_fault, - }; - -diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h -index 197316121f04e1..f81a851c46dca5 100644 ---- a/arch/x86/include/asm/intel-family.h -+++ b/arch/x86/include/asm/intel-family.h -@@ -40,134 +40,221 @@ - * their own names :-( - */ - -+#define IFM(_fam, _model) VFM_MAKE(X86_VENDOR_INTEL, _fam, _model) -+ - /* Wildcard match for FAM6 so X86_MATCH_INTEL_FAM6_MODEL(ANY) works */ - #define INTEL_FAM6_ANY X86_MODEL_ANY -+/* Wildcard match for FAM6 so X86_MATCH_VFM(ANY) works */ -+#define INTEL_ANY IFM(X86_FAMILY_ANY, X86_MODEL_ANY) - - #define INTEL_FAM6_CORE_YONAH 0x0E -+#define INTEL_CORE_YONAH IFM(6, 0x0E) - - #define INTEL_FAM6_CORE2_MEROM 0x0F -+#define INTEL_CORE2_MEROM IFM(6, 0x0F) - #define INTEL_FAM6_CORE2_MEROM_L 0x16 -+#define INTEL_CORE2_MEROM_L IFM(6, 0x16) - #define INTEL_FAM6_CORE2_PENRYN 0x17 -+#define INTEL_CORE2_PENRYN IFM(6, 0x17) - #define INTEL_FAM6_CORE2_DUNNINGTON 0x1D -+#define INTEL_CORE2_DUNNINGTON IFM(6, 0x1D) - - #define INTEL_FAM6_NEHALEM 0x1E -+#define INTEL_NEHALEM IFM(6, 0x1E) - #define INTEL_FAM6_NEHALEM_G 0x1F /* Auburndale / Havendale */ -+#define INTEL_NEHALEM_G IFM(6, 0x1F) /* Auburndale / Havendale */ - #define INTEL_FAM6_NEHALEM_EP 0x1A -+#define INTEL_NEHALEM_EP IFM(6, 0x1A) - #define INTEL_FAM6_NEHALEM_EX 0x2E -+#define INTEL_NEHALEM_EX IFM(6, 0x2E) - - #define INTEL_FAM6_WESTMERE 0x25 -+#define INTEL_WESTMERE IFM(6, 0x25) - #define INTEL_FAM6_WESTMERE_EP 0x2C -+#define INTEL_WESTMERE_EP IFM(6, 0x2C) - #define INTEL_FAM6_WESTMERE_EX 0x2F -+#define INTEL_WESTMERE_EX IFM(6, 0x2F) - - #define INTEL_FAM6_SANDYBRIDGE 0x2A -+#define INTEL_SANDYBRIDGE IFM(6, 0x2A) - #define INTEL_FAM6_SANDYBRIDGE_X 0x2D -+#define INTEL_SANDYBRIDGE_X IFM(6, 0x2D) - #define INTEL_FAM6_IVYBRIDGE 0x3A -+#define INTEL_IVYBRIDGE IFM(6, 0x3A) - #define INTEL_FAM6_IVYBRIDGE_X 0x3E -+#define INTEL_IVYBRIDGE_X IFM(6, 0x3E) - - #define INTEL_FAM6_HASWELL 0x3C -+#define INTEL_HASWELL IFM(6, 0x3C) - #define INTEL_FAM6_HASWELL_X 0x3F -+#define INTEL_HASWELL_X IFM(6, 0x3F) - #define INTEL_FAM6_HASWELL_L 0x45 -+#define INTEL_HASWELL_L IFM(6, 0x45) - #define INTEL_FAM6_HASWELL_G 0x46 -+#define INTEL_HASWELL_G IFM(6, 0x46) - - #define INTEL_FAM6_BROADWELL 0x3D -+#define INTEL_BROADWELL IFM(6, 0x3D) - #define INTEL_FAM6_BROADWELL_G 0x47 -+#define INTEL_BROADWELL_G IFM(6, 0x47) - #define INTEL_FAM6_BROADWELL_X 0x4F -+#define INTEL_BROADWELL_X IFM(6, 0x4F) - #define INTEL_FAM6_BROADWELL_D 0x56 -+#define INTEL_BROADWELL_D IFM(6, 0x56) - - #define INTEL_FAM6_SKYLAKE_L 0x4E /* Sky Lake */ -+#define INTEL_SKYLAKE_L IFM(6, 0x4E) /* Sky Lake */ - #define INTEL_FAM6_SKYLAKE 0x5E /* Sky Lake */ -+#define INTEL_SKYLAKE IFM(6, 0x5E) /* Sky Lake */ - #define INTEL_FAM6_SKYLAKE_X 0x55 /* Sky Lake */ -+#define INTEL_SKYLAKE_X IFM(6, 0x55) /* Sky Lake */ - /* CASCADELAKE_X 0x55 Sky Lake -- s: 7 */ - /* COOPERLAKE_X 0x55 Sky Lake -- s: 11 */ - - #define INTEL_FAM6_KABYLAKE_L 0x8E /* Sky Lake */ -+#define INTEL_KABYLAKE_L IFM(6, 0x8E) /* Sky Lake */ - /* AMBERLAKE_L 0x8E Sky Lake -- s: 9 */ - /* COFFEELAKE_L 0x8E Sky Lake -- s: 10 */ - /* WHISKEYLAKE_L 0x8E Sky Lake -- s: 11,12 */ - - #define INTEL_FAM6_KABYLAKE 0x9E /* Sky Lake */ -+#define INTEL_KABYLAKE IFM(6, 0x9E) /* Sky Lake */ - /* COFFEELAKE 0x9E Sky Lake -- s: 10-13 */ - - #define INTEL_FAM6_COMETLAKE 0xA5 /* Sky Lake */ -+#define INTEL_COMETLAKE IFM(6, 0xA5) /* Sky Lake */ - #define INTEL_FAM6_COMETLAKE_L 0xA6 /* Sky Lake */ -+#define INTEL_COMETLAKE_L IFM(6, 0xA6) /* Sky Lake */ - - #define INTEL_FAM6_CANNONLAKE_L 0x66 /* Palm Cove */ -+#define INTEL_CANNONLAKE_L IFM(6, 0x66) /* Palm Cove */ - - #define INTEL_FAM6_ICELAKE_X 0x6A /* Sunny Cove */ -+#define INTEL_ICELAKE_X IFM(6, 0x6A) /* Sunny Cove */ - #define INTEL_FAM6_ICELAKE_D 0x6C /* Sunny Cove */ -+#define INTEL_ICELAKE_D IFM(6, 0x6C) /* Sunny Cove */ - #define INTEL_FAM6_ICELAKE 0x7D /* Sunny Cove */ -+#define INTEL_ICELAKE IFM(6, 0x7D) /* Sunny Cove */ - #define INTEL_FAM6_ICELAKE_L 0x7E /* Sunny Cove */ -+#define INTEL_ICELAKE_L IFM(6, 0x7E) /* Sunny Cove */ - #define INTEL_FAM6_ICELAKE_NNPI 0x9D /* Sunny Cove */ -+#define INTEL_ICELAKE_NNPI IFM(6, 0x9D) /* Sunny Cove */ - - #define INTEL_FAM6_ROCKETLAKE 0xA7 /* Cypress Cove */ -+#define INTEL_ROCKETLAKE IFM(6, 0xA7) /* Cypress Cove */ - - #define INTEL_FAM6_TIGERLAKE_L 0x8C /* Willow Cove */ -+#define INTEL_TIGERLAKE_L IFM(6, 0x8C) /* Willow Cove */ - #define INTEL_FAM6_TIGERLAKE 0x8D /* Willow Cove */ -+#define INTEL_TIGERLAKE IFM(6, 0x8D) /* Willow Cove */ - - #define INTEL_FAM6_SAPPHIRERAPIDS_X 0x8F /* Golden Cove */ -+#define INTEL_SAPPHIRERAPIDS_X IFM(6, 0x8F) /* Golden Cove */ - - #define INTEL_FAM6_EMERALDRAPIDS_X 0xCF -+#define INTEL_EMERALDRAPIDS_X IFM(6, 0xCF) - - #define INTEL_FAM6_GRANITERAPIDS_X 0xAD -+#define INTEL_GRANITERAPIDS_X IFM(6, 0xAD) - #define INTEL_FAM6_GRANITERAPIDS_D 0xAE -+#define INTEL_GRANITERAPIDS_D IFM(6, 0xAE) - - /* "Hybrid" Processors (P-Core/E-Core) */ - - #define INTEL_FAM6_LAKEFIELD 0x8A /* Sunny Cove / Tremont */ -+#define INTEL_LAKEFIELD IFM(6, 0x8A) /* Sunny Cove / Tremont */ - - #define INTEL_FAM6_ALDERLAKE 0x97 /* Golden Cove / Gracemont */ -+#define INTEL_ALDERLAKE IFM(6, 0x97) /* Golden Cove / Gracemont */ - #define INTEL_FAM6_ALDERLAKE_L 0x9A /* Golden Cove / Gracemont */ -+#define INTEL_ALDERLAKE_L IFM(6, 0x9A) /* Golden Cove / Gracemont */ - - #define INTEL_FAM6_RAPTORLAKE 0xB7 /* Raptor Cove / Enhanced Gracemont */ -+#define INTEL_RAPTORLAKE IFM(6, 0xB7) /* Raptor Cove / Enhanced Gracemont */ - #define INTEL_FAM6_RAPTORLAKE_P 0xBA -+#define INTEL_RAPTORLAKE_P IFM(6, 0xBA) - #define INTEL_FAM6_RAPTORLAKE_S 0xBF -+#define INTEL_RAPTORLAKE_S IFM(6, 0xBF) - - #define INTEL_FAM6_METEORLAKE 0xAC -+#define INTEL_METEORLAKE IFM(6, 0xAC) - #define INTEL_FAM6_METEORLAKE_L 0xAA -+#define INTEL_METEORLAKE_L IFM(6, 0xAA) - - #define INTEL_FAM6_ARROWLAKE_H 0xC5 -+#define INTEL_ARROWLAKE_H IFM(6, 0xC5) - #define INTEL_FAM6_ARROWLAKE 0xC6 -+#define INTEL_ARROWLAKE IFM(6, 0xC6) -+#define INTEL_FAM6_ARROWLAKE_U 0xB5 -+#define INTEL_ARROWLAKE_U IFM(6, 0xB5) - - #define INTEL_FAM6_LUNARLAKE_M 0xBD -+#define INTEL_LUNARLAKE_M IFM(6, 0xBD) - - /* "Small Core" Processors (Atom/E-Core) */ - - #define INTEL_FAM6_ATOM_BONNELL 0x1C /* Diamondville, Pineview */ -+#define INTEL_ATOM_BONNELL IFM(6, 0x1C) /* Diamondville, Pineview */ - #define INTEL_FAM6_ATOM_BONNELL_MID 0x26 /* Silverthorne, Lincroft */ -+#define INTEL_ATOM_BONNELL_MID IFM(6, 0x26) /* Silverthorne, Lincroft */ - - #define INTEL_FAM6_ATOM_SALTWELL 0x36 /* Cedarview */ -+#define INTEL_ATOM_SALTWELL IFM(6, 0x36) /* Cedarview */ - #define INTEL_FAM6_ATOM_SALTWELL_MID 0x27 /* Penwell */ -+#define INTEL_ATOM_SALTWELL_MID IFM(6, 0x27) /* Penwell */ - #define INTEL_FAM6_ATOM_SALTWELL_TABLET 0x35 /* Cloverview */ -+#define INTEL_ATOM_SALTWELL_TABLET IFM(6, 0x35) /* Cloverview */ - - #define INTEL_FAM6_ATOM_SILVERMONT 0x37 /* Bay Trail, Valleyview */ -+#define INTEL_ATOM_SILVERMONT IFM(6, 0x37) /* Bay Trail, Valleyview */ - #define INTEL_FAM6_ATOM_SILVERMONT_D 0x4D /* Avaton, Rangely */ -+#define INTEL_ATOM_SILVERMONT_D IFM(6, 0x4D) /* Avaton, Rangely */ - #define INTEL_FAM6_ATOM_SILVERMONT_MID 0x4A /* Merriefield */ -+#define INTEL_ATOM_SILVERMONT_MID IFM(6, 0x4A) /* Merriefield */ - - #define INTEL_FAM6_ATOM_AIRMONT 0x4C /* Cherry Trail, Braswell */ -+#define INTEL_ATOM_AIRMONT IFM(6, 0x4C) /* Cherry Trail, Braswell */ - #define INTEL_FAM6_ATOM_AIRMONT_MID 0x5A /* Moorefield */ -+#define INTEL_ATOM_AIRMONT_MID IFM(6, 0x5A) /* Moorefield */ - #define INTEL_FAM6_ATOM_AIRMONT_NP 0x75 /* Lightning Mountain */ -+#define INTEL_ATOM_AIRMONT_NP IFM(6, 0x75) /* Lightning Mountain */ - - #define INTEL_FAM6_ATOM_GOLDMONT 0x5C /* Apollo Lake */ -+#define INTEL_ATOM_GOLDMONT IFM(6, 0x5C) /* Apollo Lake */ - #define INTEL_FAM6_ATOM_GOLDMONT_D 0x5F /* Denverton */ -+#define INTEL_ATOM_GOLDMONT_D IFM(6, 0x5F) /* Denverton */ - - /* Note: the micro-architecture is "Goldmont Plus" */ - #define INTEL_FAM6_ATOM_GOLDMONT_PLUS 0x7A /* Gemini Lake */ -+#define INTEL_ATOM_GOLDMONT_PLUS IFM(6, 0x7A) /* Gemini Lake */ - - #define INTEL_FAM6_ATOM_TREMONT_D 0x86 /* Jacobsville */ -+#define INTEL_ATOM_TREMONT_D IFM(6, 0x86) /* Jacobsville */ - #define INTEL_FAM6_ATOM_TREMONT 0x96 /* Elkhart Lake */ -+#define INTEL_ATOM_TREMONT IFM(6, 0x96) /* Elkhart Lake */ - #define INTEL_FAM6_ATOM_TREMONT_L 0x9C /* Jasper Lake */ -+#define INTEL_ATOM_TREMONT_L IFM(6, 0x9C) /* Jasper Lake */ - - #define INTEL_FAM6_ATOM_GRACEMONT 0xBE /* Alderlake N */ -+#define INTEL_ATOM_GRACEMONT IFM(6, 0xBE) /* Alderlake N */ - - #define INTEL_FAM6_ATOM_CRESTMONT_X 0xAF /* Sierra Forest */ -+#define INTEL_ATOM_CRESTMONT_X IFM(6, 0xAF) /* Sierra Forest */ - #define INTEL_FAM6_ATOM_CRESTMONT 0xB6 /* Grand Ridge */ -+#define INTEL_ATOM_CRESTMONT IFM(6, 0xB6) /* Grand Ridge */ -+ -+#define INTEL_FAM6_ATOM_DARKMONT_X 0xDD /* Clearwater Forest */ -+#define INTEL_ATOM_DARKMONT_X IFM(6, 0xDD) /* Clearwater Forest */ - - /* Xeon Phi */ - - #define INTEL_FAM6_XEON_PHI_KNL 0x57 /* Knights Landing */ -+#define INTEL_XEON_PHI_KNL IFM(6, 0x57) /* Knights Landing */ - #define INTEL_FAM6_XEON_PHI_KNM 0x85 /* Knights Mill */ -+#define INTEL_XEON_PHI_KNM IFM(6, 0x85) /* Knights Mill */ - - /* Family 5 */ - #define INTEL_FAM5_QUARK_X1000 0x09 /* Quark X1000 SoC */ -+#define INTEL_QUARK_X1000 IFM(5, 0x09) /* Quark X1000 SoC */ - - #endif /* _ASM_X86_INTEL_FAMILY_H */ -diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h -index 6e775303d687dd..428348e7f06c3a 100644 ---- a/arch/x86/include/asm/processor.h -+++ b/arch/x86/include/asm/processor.h -@@ -81,9 +81,23 @@ extern u16 __read_mostly tlb_lld_1g[NR_INFO]; - */ - - struct cpuinfo_x86 { -- __u8 x86; /* CPU family */ -- __u8 x86_vendor; /* CPU vendor */ -- __u8 x86_model; -+ union { -+ /* -+ * The particular ordering (low-to-high) of (vendor, -+ * family, model) is done in case range of models, like -+ * it is usually done on AMD, need to be compared. -+ */ -+ struct { -+ __u8 x86_model; -+ /* CPU family */ -+ __u8 x86; -+ /* CPU vendor */ -+ __u8 x86_vendor; -+ __u8 x86_reserved; -+ }; -+ /* combined vendor, family, model */ -+ __u32 x86_vfm; -+ }; - __u8 x86_stepping; - #ifdef CONFIG_X86_64 - /* Number of 4K pages in DTLB/ITLB combined(in pages): */ -diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c -index aa3e7ed0eb3d7f..4752a9f17ef615 100644 ---- a/arch/x86/kernel/cpu/intel.c -+++ b/arch/x86/kernel/cpu/intel.c -@@ -72,19 +72,19 @@ static bool cpu_model_supports_sld __ro_after_init; - */ - static void check_memory_type_self_snoop_errata(struct cpuinfo_x86 *c) - { -- switch (c->x86_model) { -- case INTEL_FAM6_CORE_YONAH: -- case INTEL_FAM6_CORE2_MEROM: -- case INTEL_FAM6_CORE2_MEROM_L: -- case INTEL_FAM6_CORE2_PENRYN: -- case INTEL_FAM6_CORE2_DUNNINGTON: -- case INTEL_FAM6_NEHALEM: -- case INTEL_FAM6_NEHALEM_G: -- case INTEL_FAM6_NEHALEM_EP: -- case INTEL_FAM6_NEHALEM_EX: -- case INTEL_FAM6_WESTMERE: -- case INTEL_FAM6_WESTMERE_EP: -- case INTEL_FAM6_SANDYBRIDGE: -+ switch (c->x86_vfm) { -+ case INTEL_CORE_YONAH: -+ case INTEL_CORE2_MEROM: -+ case INTEL_CORE2_MEROM_L: -+ case INTEL_CORE2_PENRYN: -+ case INTEL_CORE2_DUNNINGTON: -+ case INTEL_NEHALEM: -+ case INTEL_NEHALEM_G: -+ case INTEL_NEHALEM_EP: -+ case INTEL_NEHALEM_EX: -+ case INTEL_WESTMERE: -+ case INTEL_WESTMERE_EP: -+ case INTEL_SANDYBRIDGE: - setup_clear_cpu_cap(X86_FEATURE_SELFSNOOP); - } - } -@@ -106,9 +106,9 @@ static void probe_xeon_phi_r3mwait(struct cpuinfo_x86 *c) - */ - if (c->x86 != 6) - return; -- switch (c->x86_model) { -- case INTEL_FAM6_XEON_PHI_KNL: -- case INTEL_FAM6_XEON_PHI_KNM: -+ switch (c->x86_vfm) { -+ case INTEL_XEON_PHI_KNL: -+ case INTEL_XEON_PHI_KNM: - break; - default: - return; -@@ -134,32 +134,32 @@ static void probe_xeon_phi_r3mwait(struct cpuinfo_x86 *c) - * - Release note from 20180108 microcode release - */ - struct sku_microcode { -- u8 model; -+ u32 vfm; - u8 stepping; - u32 microcode; - }; - static const struct sku_microcode spectre_bad_microcodes[] = { -- { INTEL_FAM6_KABYLAKE, 0x0B, 0x80 }, -- { INTEL_FAM6_KABYLAKE, 0x0A, 0x80 }, -- { INTEL_FAM6_KABYLAKE, 0x09, 0x80 }, -- { INTEL_FAM6_KABYLAKE_L, 0x0A, 0x80 }, -- { INTEL_FAM6_KABYLAKE_L, 0x09, 0x80 }, -- { INTEL_FAM6_SKYLAKE_X, 0x03, 0x0100013e }, -- { INTEL_FAM6_SKYLAKE_X, 0x04, 0x0200003c }, -- { INTEL_FAM6_BROADWELL, 0x04, 0x28 }, -- { INTEL_FAM6_BROADWELL_G, 0x01, 0x1b }, -- { INTEL_FAM6_BROADWELL_D, 0x02, 0x14 }, -- { INTEL_FAM6_BROADWELL_D, 0x03, 0x07000011 }, -- { INTEL_FAM6_BROADWELL_X, 0x01, 0x0b000025 }, -- { INTEL_FAM6_HASWELL_L, 0x01, 0x21 }, -- { INTEL_FAM6_HASWELL_G, 0x01, 0x18 }, -- { INTEL_FAM6_HASWELL, 0x03, 0x23 }, -- { INTEL_FAM6_HASWELL_X, 0x02, 0x3b }, -- { INTEL_FAM6_HASWELL_X, 0x04, 0x10 }, -- { INTEL_FAM6_IVYBRIDGE_X, 0x04, 0x42a }, -+ { INTEL_KABYLAKE, 0x0B, 0x80 }, -+ { INTEL_KABYLAKE, 0x0A, 0x80 }, -+ { INTEL_KABYLAKE, 0x09, 0x80 }, -+ { INTEL_KABYLAKE_L, 0x0A, 0x80 }, -+ { INTEL_KABYLAKE_L, 0x09, 0x80 }, -+ { INTEL_SKYLAKE_X, 0x03, 0x0100013e }, -+ { INTEL_SKYLAKE_X, 0x04, 0x0200003c }, -+ { INTEL_BROADWELL, 0x04, 0x28 }, -+ { INTEL_BROADWELL_G, 0x01, 0x1b }, -+ { INTEL_BROADWELL_D, 0x02, 0x14 }, -+ { INTEL_BROADWELL_D, 0x03, 0x07000011 }, -+ { INTEL_BROADWELL_X, 0x01, 0x0b000025 }, -+ { INTEL_HASWELL_L, 0x01, 0x21 }, -+ { INTEL_HASWELL_G, 0x01, 0x18 }, -+ { INTEL_HASWELL, 0x03, 0x23 }, -+ { INTEL_HASWELL_X, 0x02, 0x3b }, -+ { INTEL_HASWELL_X, 0x04, 0x10 }, -+ { INTEL_IVYBRIDGE_X, 0x04, 0x42a }, - /* Observed in the wild */ -- { INTEL_FAM6_SANDYBRIDGE_X, 0x06, 0x61b }, -- { INTEL_FAM6_SANDYBRIDGE_X, 0x07, 0x712 }, -+ { INTEL_SANDYBRIDGE_X, 0x06, 0x61b }, -+ { INTEL_SANDYBRIDGE_X, 0x07, 0x712 }, - }; - - static bool bad_spectre_microcode(struct cpuinfo_x86 *c) -@@ -173,11 +173,8 @@ static bool bad_spectre_microcode(struct cpuinfo_x86 *c) - if (cpu_has(c, X86_FEATURE_HYPERVISOR)) - return false; - -- if (c->x86 != 6) -- return false; -- - for (i = 0; i < ARRAY_SIZE(spectre_bad_microcodes); i++) { -- if (c->x86_model == spectre_bad_microcodes[i].model && -+ if (c->x86_vfm == spectre_bad_microcodes[i].vfm && - c->x86_stepping == spectre_bad_microcodes[i].stepping) - return (c->microcode <= spectre_bad_microcodes[i].microcode); - } -@@ -312,7 +309,7 @@ static void early_init_intel(struct cpuinfo_x86 *c) - * need the microcode to have already been loaded... so if it is - * not, recommend a BIOS update and disable large pages. - */ -- if (c->x86 == 6 && c->x86_model == 0x1c && c->x86_stepping <= 2 && -+ if (c->x86_vfm == INTEL_ATOM_BONNELL && c->x86_stepping <= 2 && - c->microcode < 0x20e) { - pr_warn("Atom PSE erratum detected, BIOS microcode update recommended\n"); - clear_cpu_cap(c, X86_FEATURE_PSE); -@@ -344,17 +341,13 @@ static void early_init_intel(struct cpuinfo_x86 *c) - } - - /* Penwell and Cloverview have the TSC which doesn't sleep on S3 */ -- if (c->x86 == 6) { -- switch (c->x86_model) { -- case INTEL_FAM6_ATOM_SALTWELL_MID: -- case INTEL_FAM6_ATOM_SALTWELL_TABLET: -- case INTEL_FAM6_ATOM_SILVERMONT_MID: -- case INTEL_FAM6_ATOM_AIRMONT_NP: -- set_cpu_cap(c, X86_FEATURE_NONSTOP_TSC_S3); -- break; -- default: -- break; -- } -+ switch (c->x86_vfm) { -+ case INTEL_ATOM_SALTWELL_MID: -+ case INTEL_ATOM_SALTWELL_TABLET: -+ case INTEL_ATOM_SILVERMONT_MID: -+ case INTEL_ATOM_AIRMONT_NP: -+ set_cpu_cap(c, X86_FEATURE_NONSTOP_TSC_S3); -+ break; - } - - /* -@@ -393,7 +386,7 @@ static void early_init_intel(struct cpuinfo_x86 *c) - * should be false so that __flush_tlb_all() causes CR3 instead of CR4.PGE - * to be modified. - */ -- if (c->x86 == 5 && c->x86_model == 9) { -+ if (c->x86_vfm == INTEL_QUARK_X1000) { - pr_info("Disabling PGE capability bit\n"); - setup_clear_cpu_cap(X86_FEATURE_PGE); - } -@@ -663,12 +656,15 @@ static void init_intel(struct cpuinfo_x86 *c) - set_cpu_cap(c, X86_FEATURE_PEBS); - } - -- if (c->x86 == 6 && boot_cpu_has(X86_FEATURE_CLFLUSH) && -- (c->x86_model == 29 || c->x86_model == 46 || c->x86_model == 47)) -+ if (boot_cpu_has(X86_FEATURE_CLFLUSH) && -+ (c->x86_vfm == INTEL_CORE2_DUNNINGTON || -+ c->x86_vfm == INTEL_NEHALEM_EX || -+ c->x86_vfm == INTEL_WESTMERE_EX)) - set_cpu_bug(c, X86_BUG_CLFLUSH_MONITOR); - -- if (c->x86 == 6 && boot_cpu_has(X86_FEATURE_MWAIT) && -- ((c->x86_model == INTEL_FAM6_ATOM_GOLDMONT))) -+ if (boot_cpu_has(X86_FEATURE_MWAIT) && -+ (c->x86_vfm == INTEL_ATOM_GOLDMONT || -+ c->x86_vfm == INTEL_LUNARLAKE_M)) - set_cpu_bug(c, X86_BUG_MONITOR); - - #ifdef CONFIG_X86_64 -@@ -1285,9 +1281,9 @@ void handle_bus_lock(struct pt_regs *regs) - * feature even though they do not enumerate IA32_CORE_CAPABILITIES. - */ - static const struct x86_cpu_id split_lock_cpu_ids[] __initconst = { -- X86_MATCH_INTEL_FAM6_MODEL(ICELAKE_X, 0), -- X86_MATCH_INTEL_FAM6_MODEL(ICELAKE_L, 0), -- X86_MATCH_INTEL_FAM6_MODEL(ICELAKE_D, 0), -+ X86_MATCH_VFM(INTEL_ICELAKE_X, 0), -+ X86_MATCH_VFM(INTEL_ICELAKE_L, 0), -+ X86_MATCH_VFM(INTEL_ICELAKE_D, 0), - {} - }; - -diff --git a/arch/x86/kernel/cpu/match.c b/arch/x86/kernel/cpu/match.c -index ae71b8ef909c9a..978a3094e8ff73 100644 ---- a/arch/x86/kernel/cpu/match.c -+++ b/arch/x86/kernel/cpu/match.c -@@ -17,8 +17,7 @@ - * - * A typical table entry would be to match a specific CPU - * -- * X86_MATCH_VENDOR_FAM_MODEL_FEATURE(INTEL, 6, INTEL_FAM6_BROADWELL, -- * X86_FEATURE_ANY, NULL); -+ * X86_MATCH_VFM_FEATURE(INTEL_BROADWELL, X86_FEATURE_ANY, NULL); - * - * Fields can be wildcarded with %X86_VENDOR_ANY, %X86_FAMILY_ANY, - * %X86_MODEL_ANY, %X86_FEATURE_ANY (except for vendor) -diff --git a/block/blk-mq.c b/block/blk-mq.c -index 6c71add013bfc2..5da948b07058b4 100644 ---- a/block/blk-mq.c -+++ b/block/blk-mq.c -@@ -43,6 +43,7 @@ - - static DEFINE_PER_CPU(struct llist_head, blk_cpu_done); - static DEFINE_PER_CPU(call_single_data_t, blk_cpu_csd); -+static DEFINE_MUTEX(blk_mq_cpuhp_lock); - - static void blk_mq_insert_request(struct request *rq, blk_insert_t flags); - static void blk_mq_request_bypass_insert(struct request *rq, -@@ -3623,13 +3624,91 @@ static int blk_mq_hctx_notify_dead(unsigned int cpu, struct hlist_node *node) - return 0; - } - --static void blk_mq_remove_cpuhp(struct blk_mq_hw_ctx *hctx) -+static void __blk_mq_remove_cpuhp(struct blk_mq_hw_ctx *hctx) - { -- if (!(hctx->flags & BLK_MQ_F_STACKING)) -+ lockdep_assert_held(&blk_mq_cpuhp_lock); -+ -+ if (!(hctx->flags & BLK_MQ_F_STACKING) && -+ !hlist_unhashed(&hctx->cpuhp_online)) { - cpuhp_state_remove_instance_nocalls(CPUHP_AP_BLK_MQ_ONLINE, - &hctx->cpuhp_online); -- cpuhp_state_remove_instance_nocalls(CPUHP_BLK_MQ_DEAD, -- &hctx->cpuhp_dead); -+ INIT_HLIST_NODE(&hctx->cpuhp_online); -+ } -+ -+ if (!hlist_unhashed(&hctx->cpuhp_dead)) { -+ cpuhp_state_remove_instance_nocalls(CPUHP_BLK_MQ_DEAD, -+ &hctx->cpuhp_dead); -+ INIT_HLIST_NODE(&hctx->cpuhp_dead); -+ } -+} -+ -+static void blk_mq_remove_cpuhp(struct blk_mq_hw_ctx *hctx) -+{ -+ mutex_lock(&blk_mq_cpuhp_lock); -+ __blk_mq_remove_cpuhp(hctx); -+ mutex_unlock(&blk_mq_cpuhp_lock); -+} -+ -+static void __blk_mq_add_cpuhp(struct blk_mq_hw_ctx *hctx) -+{ -+ lockdep_assert_held(&blk_mq_cpuhp_lock); -+ -+ if (!(hctx->flags & BLK_MQ_F_STACKING) && -+ hlist_unhashed(&hctx->cpuhp_online)) -+ cpuhp_state_add_instance_nocalls(CPUHP_AP_BLK_MQ_ONLINE, -+ &hctx->cpuhp_online); -+ -+ if (hlist_unhashed(&hctx->cpuhp_dead)) -+ cpuhp_state_add_instance_nocalls(CPUHP_BLK_MQ_DEAD, -+ &hctx->cpuhp_dead); -+} -+ -+static void __blk_mq_remove_cpuhp_list(struct list_head *head) -+{ -+ struct blk_mq_hw_ctx *hctx; -+ -+ lockdep_assert_held(&blk_mq_cpuhp_lock); -+ -+ list_for_each_entry(hctx, head, hctx_list) -+ __blk_mq_remove_cpuhp(hctx); -+} -+ -+/* -+ * Unregister cpuhp callbacks from exited hw queues -+ * -+ * Safe to call if this `request_queue` is live -+ */ -+static void blk_mq_remove_hw_queues_cpuhp(struct request_queue *q) -+{ -+ LIST_HEAD(hctx_list); -+ -+ spin_lock(&q->unused_hctx_lock); -+ list_splice_init(&q->unused_hctx_list, &hctx_list); -+ spin_unlock(&q->unused_hctx_lock); -+ -+ mutex_lock(&blk_mq_cpuhp_lock); -+ __blk_mq_remove_cpuhp_list(&hctx_list); -+ mutex_unlock(&blk_mq_cpuhp_lock); -+ -+ spin_lock(&q->unused_hctx_lock); -+ list_splice(&hctx_list, &q->unused_hctx_list); -+ spin_unlock(&q->unused_hctx_lock); -+} -+ -+/* -+ * Register cpuhp callbacks from all hw queues -+ * -+ * Safe to call if this `request_queue` is live -+ */ -+static void blk_mq_add_hw_queues_cpuhp(struct request_queue *q) -+{ -+ struct blk_mq_hw_ctx *hctx; -+ unsigned long i; -+ -+ mutex_lock(&blk_mq_cpuhp_lock); -+ queue_for_each_hw_ctx(q, hctx, i) -+ __blk_mq_add_cpuhp(hctx); -+ mutex_unlock(&blk_mq_cpuhp_lock); - } - - /* -@@ -3680,8 +3759,6 @@ static void blk_mq_exit_hctx(struct request_queue *q, - if (set->ops->exit_hctx) - set->ops->exit_hctx(hctx, hctx_idx); - -- blk_mq_remove_cpuhp(hctx); -- - xa_erase(&q->hctx_table, hctx_idx); - - spin_lock(&q->unused_hctx_lock); -@@ -3698,6 +3775,7 @@ static void blk_mq_exit_hw_queues(struct request_queue *q, - queue_for_each_hw_ctx(q, hctx, i) { - if (i == nr_queue) - break; -+ blk_mq_remove_cpuhp(hctx); - blk_mq_exit_hctx(q, set, hctx, i); - } - } -@@ -3708,16 +3786,11 @@ static int blk_mq_init_hctx(struct request_queue *q, - { - hctx->queue_num = hctx_idx; - -- if (!(hctx->flags & BLK_MQ_F_STACKING)) -- cpuhp_state_add_instance_nocalls(CPUHP_AP_BLK_MQ_ONLINE, -- &hctx->cpuhp_online); -- cpuhp_state_add_instance_nocalls(CPUHP_BLK_MQ_DEAD, &hctx->cpuhp_dead); -- - hctx->tags = set->tags[hctx_idx]; - - if (set->ops->init_hctx && - set->ops->init_hctx(hctx, set->driver_data, hctx_idx)) -- goto unregister_cpu_notifier; -+ goto fail; - - if (blk_mq_init_request(set, hctx->fq->flush_rq, hctx_idx, - hctx->numa_node)) -@@ -3734,8 +3807,7 @@ static int blk_mq_init_hctx(struct request_queue *q, - exit_hctx: - if (set->ops->exit_hctx) - set->ops->exit_hctx(hctx, hctx_idx); -- unregister_cpu_notifier: -- blk_mq_remove_cpuhp(hctx); -+ fail: - return -1; - } - -@@ -3761,6 +3833,8 @@ blk_mq_alloc_hctx(struct request_queue *q, struct blk_mq_tag_set *set, - INIT_DELAYED_WORK(&hctx->run_work, blk_mq_run_work_fn); - spin_lock_init(&hctx->lock); - INIT_LIST_HEAD(&hctx->dispatch); -+ INIT_HLIST_NODE(&hctx->cpuhp_dead); -+ INIT_HLIST_NODE(&hctx->cpuhp_online); - hctx->queue = q; - hctx->flags = set->flags & ~BLK_MQ_F_TAG_QUEUE_SHARED; - -@@ -4204,6 +4278,15 @@ struct gendisk *blk_mq_alloc_disk_for_queue(struct request_queue *q, - } - EXPORT_SYMBOL(blk_mq_alloc_disk_for_queue); - -+/* -+ * Only hctx removed from cpuhp list can be reused -+ */ -+static bool blk_mq_hctx_is_reusable(struct blk_mq_hw_ctx *hctx) -+{ -+ return hlist_unhashed(&hctx->cpuhp_online) && -+ hlist_unhashed(&hctx->cpuhp_dead); -+} -+ - static struct blk_mq_hw_ctx *blk_mq_alloc_and_init_hctx( - struct blk_mq_tag_set *set, struct request_queue *q, - int hctx_idx, int node) -@@ -4213,7 +4296,7 @@ static struct blk_mq_hw_ctx *blk_mq_alloc_and_init_hctx( - /* reuse dead hctx first */ - spin_lock(&q->unused_hctx_lock); - list_for_each_entry(tmp, &q->unused_hctx_list, hctx_list) { -- if (tmp->numa_node == node) { -+ if (tmp->numa_node == node && blk_mq_hctx_is_reusable(tmp)) { - hctx = tmp; - break; - } -@@ -4279,6 +4362,12 @@ static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set, - xa_for_each_start(&q->hctx_table, j, hctx, j) - blk_mq_exit_hctx(q, set, hctx, j); - mutex_unlock(&q->sysfs_lock); -+ -+ /* unregister cpuhp callbacks for exited hctxs */ -+ blk_mq_remove_hw_queues_cpuhp(q); -+ -+ /* register cpuhp for new initialized hctxs */ -+ blk_mq_add_hw_queues_cpuhp(q); - } - - static void blk_mq_update_poll_flag(struct request_queue *q) -diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c -index 582564f8dde6f9..d9d339b8b57108 100644 ---- a/drivers/base/power/domain.c -+++ b/drivers/base/power/domain.c -@@ -2021,6 +2021,7 @@ static int genpd_alloc_data(struct generic_pm_domain *genpd) - - static void genpd_free_data(struct generic_pm_domain *genpd) - { -+ put_device(&genpd->dev); - if (genpd_is_cpu_domain(genpd)) - free_cpumask_var(genpd->cpus); - if (genpd->free_states) -diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c -index 1db04886def610..3011f7f9381b7f 100644 ---- a/drivers/base/regmap/regmap.c -+++ b/drivers/base/regmap/regmap.c -@@ -1062,13 +1062,13 @@ struct regmap *__regmap_init(struct device *dev, - - /* Sanity check */ - if (range_cfg->range_max < range_cfg->range_min) { -- dev_err(map->dev, "Invalid range %d: %d < %d\n", i, -+ dev_err(map->dev, "Invalid range %d: %u < %u\n", i, - range_cfg->range_max, range_cfg->range_min); - goto err_range; - } - - if (range_cfg->range_max > map->max_register) { -- dev_err(map->dev, "Invalid range %d: %d > %d\n", i, -+ dev_err(map->dev, "Invalid range %d: %u > %u\n", i, - range_cfg->range_max, map->max_register); - goto err_range; - } -diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c -index 997106fe73e49f..65a1f1576e55fb 100644 ---- a/drivers/block/virtio_blk.c -+++ b/drivers/block/virtio_blk.c -@@ -1624,9 +1624,12 @@ static void virtblk_remove(struct virtio_device *vdev) - static int virtblk_freeze(struct virtio_device *vdev) - { - struct virtio_blk *vblk = vdev->priv; -+ struct request_queue *q = vblk->disk->queue; - - /* Ensure no requests in virtqueues before deleting vqs. */ -- blk_mq_freeze_queue(vblk->disk->queue); -+ blk_mq_freeze_queue(q); -+ blk_mq_quiesce_queue_nowait(q); -+ blk_mq_unfreeze_queue(q); - - /* Ensure we don't receive any more interrupts */ - virtio_reset_device(vdev); -@@ -1650,8 +1653,8 @@ static int virtblk_restore(struct virtio_device *vdev) - return ret; - - virtio_device_ready(vdev); -+ blk_mq_unquiesce_queue(vblk->disk->queue); - -- blk_mq_unfreeze_queue(vblk->disk->queue); - return 0; - } - #endif -diff --git a/drivers/dma/apple-admac.c b/drivers/dma/apple-admac.c -index 356298e4dd22b3..5b1457f6e3bfc4 100644 ---- a/drivers/dma/apple-admac.c -+++ b/drivers/dma/apple-admac.c -@@ -153,6 +153,8 @@ static int admac_alloc_sram_carveout(struct admac_data *ad, - { - struct admac_sram *sram; - int i, ret = 0, nblocks; -+ ad->txcache.size = readl_relaxed(ad->base + REG_TX_SRAM_SIZE); -+ ad->rxcache.size = readl_relaxed(ad->base + REG_RX_SRAM_SIZE); - - if (dir == DMA_MEM_TO_DEV) - sram = &ad->txcache; -@@ -912,12 +914,7 @@ static int admac_probe(struct platform_device *pdev) - goto free_irq; - } - -- ad->txcache.size = readl_relaxed(ad->base + REG_TX_SRAM_SIZE); -- ad->rxcache.size = readl_relaxed(ad->base + REG_RX_SRAM_SIZE); -- - dev_info(&pdev->dev, "Audio DMA Controller\n"); -- dev_info(&pdev->dev, "imprint %x TX cache %u RX cache %u\n", -- readl_relaxed(ad->base + REG_IMPRINT), ad->txcache.size, ad->rxcache.size); - - return 0; - -diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c -index c3b37168b21f16..2d1ee284998ecd 100644 ---- a/drivers/dma/at_xdmac.c -+++ b/drivers/dma/at_xdmac.c -@@ -1363,6 +1363,8 @@ at_xdmac_prep_dma_memset(struct dma_chan *chan, dma_addr_t dest, int value, - return NULL; - - desc = at_xdmac_memset_create_desc(chan, atchan, dest, len, value); -+ if (!desc) -+ return NULL; - list_add_tail(&desc->desc_node, &desc->descs_list); - - desc->tx_dma_desc.cookie = -EBUSY; -diff --git a/drivers/dma/dw/acpi.c b/drivers/dma/dw/acpi.c -index c510c109d2c3ad..b6452fffa657ad 100644 ---- a/drivers/dma/dw/acpi.c -+++ b/drivers/dma/dw/acpi.c -@@ -8,13 +8,15 @@ - - static bool dw_dma_acpi_filter(struct dma_chan *chan, void *param) - { -+ struct dw_dma *dw = to_dw_dma(chan->device); -+ struct dw_dma_chip_pdata *data = dev_get_drvdata(dw->dma.dev); - struct acpi_dma_spec *dma_spec = param; - struct dw_dma_slave slave = { - .dma_dev = dma_spec->dev, - .src_id = dma_spec->slave_id, - .dst_id = dma_spec->slave_id, -- .m_master = 0, -- .p_master = 1, -+ .m_master = data->m_master, -+ .p_master = data->p_master, - }; - - return dw_dma_filter(chan, &slave); -diff --git a/drivers/dma/dw/internal.h b/drivers/dma/dw/internal.h -index 563ce73488db32..f1bd06a20cd611 100644 ---- a/drivers/dma/dw/internal.h -+++ b/drivers/dma/dw/internal.h -@@ -51,11 +51,15 @@ struct dw_dma_chip_pdata { - int (*probe)(struct dw_dma_chip *chip); - int (*remove)(struct dw_dma_chip *chip); - struct dw_dma_chip *chip; -+ u8 m_master; -+ u8 p_master; - }; - - static __maybe_unused const struct dw_dma_chip_pdata dw_dma_chip_pdata = { - .probe = dw_dma_probe, - .remove = dw_dma_remove, -+ .m_master = 0, -+ .p_master = 1, - }; - - static const struct dw_dma_platform_data idma32_pdata = { -@@ -72,6 +76,8 @@ static __maybe_unused const struct dw_dma_chip_pdata idma32_chip_pdata = { - .pdata = &idma32_pdata, - .probe = idma32_dma_probe, - .remove = idma32_dma_remove, -+ .m_master = 0, -+ .p_master = 0, - }; - - static const struct dw_dma_platform_data xbar_pdata = { -@@ -88,6 +94,8 @@ static __maybe_unused const struct dw_dma_chip_pdata xbar_chip_pdata = { - .pdata = &xbar_pdata, - .probe = idma32_dma_probe, - .remove = idma32_dma_remove, -+ .m_master = 0, -+ .p_master = 0, - }; - - #endif /* _DMA_DW_INTERNAL_H */ -diff --git a/drivers/dma/dw/pci.c b/drivers/dma/dw/pci.c -index ad2d4d012cf729..e8a0eb81726a56 100644 ---- a/drivers/dma/dw/pci.c -+++ b/drivers/dma/dw/pci.c -@@ -56,10 +56,10 @@ static int dw_pci_probe(struct pci_dev *pdev, const struct pci_device_id *pid) - if (ret) - return ret; - -- dw_dma_acpi_controller_register(chip->dw); -- - pci_set_drvdata(pdev, data); - -+ dw_dma_acpi_controller_register(chip->dw); -+ - return 0; - } - -diff --git a/drivers/dma/fsl-edma-common.h b/drivers/dma/fsl-edma-common.h -index 6028389de408b0..8d4ef6eed3adbb 100644 ---- a/drivers/dma/fsl-edma-common.h -+++ b/drivers/dma/fsl-edma-common.h -@@ -151,6 +151,7 @@ struct fsl_edma_chan { - struct work_struct issue_worker; - struct platform_device *pdev; - struct device *pd_dev; -+ struct device_link *pd_dev_link; - u32 srcid; - struct clk *clk; - int priority; -diff --git a/drivers/dma/fsl-edma-main.c b/drivers/dma/fsl-edma-main.c -index 8a0ae90548997c..cd394eae47d179 100644 ---- a/drivers/dma/fsl-edma-main.c -+++ b/drivers/dma/fsl-edma-main.c -@@ -384,10 +384,33 @@ static const struct of_device_id fsl_edma_dt_ids[] = { - }; - MODULE_DEVICE_TABLE(of, fsl_edma_dt_ids); - -+static void fsl_edma3_detach_pd(struct fsl_edma_engine *fsl_edma) -+{ -+ struct fsl_edma_chan *fsl_chan; -+ int i; -+ -+ for (i = 0; i < fsl_edma->n_chans; i++) { -+ if (fsl_edma->chan_masked & BIT(i)) -+ continue; -+ fsl_chan = &fsl_edma->chans[i]; -+ if (fsl_chan->pd_dev_link) -+ device_link_del(fsl_chan->pd_dev_link); -+ if (fsl_chan->pd_dev) { -+ dev_pm_domain_detach(fsl_chan->pd_dev, false); -+ pm_runtime_dont_use_autosuspend(fsl_chan->pd_dev); -+ pm_runtime_set_suspended(fsl_chan->pd_dev); -+ } -+ } -+} -+ -+static void devm_fsl_edma3_detach_pd(void *data) -+{ -+ fsl_edma3_detach_pd(data); -+} -+ - static int fsl_edma3_attach_pd(struct platform_device *pdev, struct fsl_edma_engine *fsl_edma) - { - struct fsl_edma_chan *fsl_chan; -- struct device_link *link; - struct device *pd_chan; - struct device *dev; - int i; -@@ -403,15 +426,16 @@ static int fsl_edma3_attach_pd(struct platform_device *pdev, struct fsl_edma_eng - pd_chan = dev_pm_domain_attach_by_id(dev, i); - if (IS_ERR_OR_NULL(pd_chan)) { - dev_err(dev, "Failed attach pd %d\n", i); -- return -EINVAL; -+ goto detach; - } - -- link = device_link_add(dev, pd_chan, DL_FLAG_STATELESS | -+ fsl_chan->pd_dev_link = device_link_add(dev, pd_chan, DL_FLAG_STATELESS | - DL_FLAG_PM_RUNTIME | - DL_FLAG_RPM_ACTIVE); -- if (!link) { -+ if (!fsl_chan->pd_dev_link) { - dev_err(dev, "Failed to add device_link to %d\n", i); -- return -EINVAL; -+ dev_pm_domain_detach(pd_chan, false); -+ goto detach; - } - - fsl_chan->pd_dev = pd_chan; -@@ -422,6 +446,10 @@ static int fsl_edma3_attach_pd(struct platform_device *pdev, struct fsl_edma_eng - } - - return 0; -+ -+detach: -+ fsl_edma3_detach_pd(fsl_edma); -+ return -EINVAL; - } - - static int fsl_edma_probe(struct platform_device *pdev) -@@ -522,6 +550,9 @@ static int fsl_edma_probe(struct platform_device *pdev) - ret = fsl_edma3_attach_pd(pdev, fsl_edma); - if (ret) - return ret; -+ ret = devm_add_action_or_reset(&pdev->dev, devm_fsl_edma3_detach_pd, fsl_edma); -+ if (ret) -+ return ret; - } - - INIT_LIST_HEAD(&fsl_edma->dma_dev.channels); -diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c -index 23b232b5751844..ea48661e87ea70 100644 ---- a/drivers/dma/mv_xor.c -+++ b/drivers/dma/mv_xor.c -@@ -1393,6 +1393,7 @@ static int mv_xor_probe(struct platform_device *pdev) - irq = irq_of_parse_and_map(np, 0); - if (!irq) { - ret = -ENODEV; -+ of_node_put(np); - goto err_channel_add; - } - -@@ -1401,6 +1402,7 @@ static int mv_xor_probe(struct platform_device *pdev) - if (IS_ERR(chan)) { - ret = PTR_ERR(chan); - irq_dispose_mapping(irq); -+ of_node_put(np); - goto err_channel_add; - } - -diff --git a/drivers/dma/tegra186-gpc-dma.c b/drivers/dma/tegra186-gpc-dma.c -index 674cf630528383..029f45f7e37f4e 100644 ---- a/drivers/dma/tegra186-gpc-dma.c -+++ b/drivers/dma/tegra186-gpc-dma.c -@@ -231,6 +231,7 @@ struct tegra_dma_channel { - bool config_init; - char name[30]; - enum dma_transfer_direction sid_dir; -+ enum dma_status status; - int id; - int irq; - int slave_id; -@@ -393,6 +394,8 @@ static int tegra_dma_pause(struct tegra_dma_channel *tdc) - tegra_dma_dump_chan_regs(tdc); - } - -+ tdc->status = DMA_PAUSED; -+ - return ret; - } - -@@ -419,6 +422,8 @@ static void tegra_dma_resume(struct tegra_dma_channel *tdc) - val = tdc_read(tdc, TEGRA_GPCDMA_CHAN_CSRE); - val &= ~TEGRA_GPCDMA_CHAN_CSRE_PAUSE; - tdc_write(tdc, TEGRA_GPCDMA_CHAN_CSRE, val); -+ -+ tdc->status = DMA_IN_PROGRESS; - } - - static int tegra_dma_device_resume(struct dma_chan *dc) -@@ -544,6 +549,7 @@ static void tegra_dma_xfer_complete(struct tegra_dma_channel *tdc) - - tegra_dma_sid_free(tdc); - tdc->dma_desc = NULL; -+ tdc->status = DMA_COMPLETE; - } - - static void tegra_dma_chan_decode_error(struct tegra_dma_channel *tdc, -@@ -716,6 +722,7 @@ static int tegra_dma_terminate_all(struct dma_chan *dc) - tdc->dma_desc = NULL; - } - -+ tdc->status = DMA_COMPLETE; - tegra_dma_sid_free(tdc); - vchan_get_all_descriptors(&tdc->vc, &head); - spin_unlock_irqrestore(&tdc->vc.lock, flags); -@@ -769,6 +776,9 @@ static enum dma_status tegra_dma_tx_status(struct dma_chan *dc, - if (ret == DMA_COMPLETE) - return ret; - -+ if (tdc->status == DMA_PAUSED) -+ ret = DMA_PAUSED; -+ - spin_lock_irqsave(&tdc->vc.lock, flags); - vd = vchan_find_desc(&tdc->vc, cookie); - if (vd) { -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c -index af6c6d89e63afb..fbee10927bfb64 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c -@@ -467,28 +467,6 @@ uint32_t amdgpu_amdkfd_get_max_engine_clock_in_mhz(struct amdgpu_device *adev) - return 100; - } - --void amdgpu_amdkfd_get_cu_info(struct amdgpu_device *adev, struct kfd_cu_info *cu_info) --{ -- struct amdgpu_cu_info acu_info = adev->gfx.cu_info; -- -- memset(cu_info, 0, sizeof(*cu_info)); -- if (sizeof(cu_info->cu_bitmap) != sizeof(acu_info.bitmap)) -- return; -- -- cu_info->cu_active_number = acu_info.number; -- cu_info->cu_ao_mask = acu_info.ao_cu_mask; -- memcpy(&cu_info->cu_bitmap[0], &acu_info.bitmap[0], -- sizeof(cu_info->cu_bitmap)); -- cu_info->num_shader_engines = adev->gfx.config.max_shader_engines; -- cu_info->num_shader_arrays_per_engine = adev->gfx.config.max_sh_per_se; -- cu_info->num_cu_per_sh = adev->gfx.config.max_cu_per_sh; -- cu_info->simd_per_cu = acu_info.simd_per_cu; -- cu_info->max_waves_per_simd = acu_info.max_waves_per_simd; -- cu_info->wave_front_size = acu_info.wave_front_size; -- cu_info->max_scratch_slots_per_cu = acu_info.max_scratch_slots_per_cu; -- cu_info->lds_size = acu_info.lds_size; --} -- - int amdgpu_amdkfd_get_dmabuf_info(struct amdgpu_device *adev, int dma_buf_fd, - struct amdgpu_device **dmabuf_adev, - uint64_t *bo_size, void *metadata_buffer, -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h -index 3134e6ad81d1d4..ff2b8ace438b62 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h -@@ -235,8 +235,6 @@ void amdgpu_amdkfd_get_local_mem_info(struct amdgpu_device *adev, - uint64_t amdgpu_amdkfd_get_gpu_clock_counter(struct amdgpu_device *adev); - - uint32_t amdgpu_amdkfd_get_max_engine_clock_in_mhz(struct amdgpu_device *adev); --void amdgpu_amdkfd_get_cu_info(struct amdgpu_device *adev, -- struct kfd_cu_info *cu_info); - int amdgpu_amdkfd_get_dmabuf_info(struct amdgpu_device *adev, int dma_buf_fd, - struct amdgpu_device **dmabuf_adev, - uint64_t *bo_size, void *metadata_buffer, -diff --git a/drivers/gpu/drm/amd/amdgpu/hdp_v4_0.c b/drivers/gpu/drm/amd/amdgpu/hdp_v4_0.c -index 71d1a2e3bac916..30210613dc5c47 100644 ---- a/drivers/gpu/drm/amd/amdgpu/hdp_v4_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/hdp_v4_0.c -@@ -40,10 +40,12 @@ - static void hdp_v4_0_flush_hdp(struct amdgpu_device *adev, - struct amdgpu_ring *ring) - { -- if (!ring || !ring->funcs->emit_wreg) -- WREG32_NO_KIQ((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0); -- else -+ if (!ring || !ring->funcs->emit_wreg) { -+ WREG32((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0); -+ RREG32((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2); -+ } else { - amdgpu_ring_emit_wreg(ring, (adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0); -+ } - } - - static void hdp_v4_0_invalidate_hdp(struct amdgpu_device *adev, -@@ -53,11 +55,13 @@ static void hdp_v4_0_invalidate_hdp(struct amdgpu_device *adev, - adev->ip_versions[HDP_HWIP][0] == IP_VERSION(4, 4, 2)) - return; - -- if (!ring || !ring->funcs->emit_wreg) -+ if (!ring || !ring->funcs->emit_wreg) { - WREG32_SOC15_NO_KIQ(HDP, 0, mmHDP_READ_CACHE_INVALIDATE, 1); -- else -+ RREG32_SOC15_NO_KIQ(HDP, 0, mmHDP_READ_CACHE_INVALIDATE); -+ } else { - amdgpu_ring_emit_wreg(ring, SOC15_REG_OFFSET( - HDP, 0, mmHDP_READ_CACHE_INVALIDATE), 1); -+ } - } - - static void hdp_v4_0_query_ras_error_count(struct amdgpu_device *adev, -diff --git a/drivers/gpu/drm/amd/amdgpu/hdp_v5_0.c b/drivers/gpu/drm/amd/amdgpu/hdp_v5_0.c -index a9ea23fa0def7f..d3962d46908811 100644 ---- a/drivers/gpu/drm/amd/amdgpu/hdp_v5_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/hdp_v5_0.c -@@ -31,10 +31,12 @@ - static void hdp_v5_0_flush_hdp(struct amdgpu_device *adev, - struct amdgpu_ring *ring) - { -- if (!ring || !ring->funcs->emit_wreg) -- WREG32_NO_KIQ((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0); -- else -+ if (!ring || !ring->funcs->emit_wreg) { -+ WREG32((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0); -+ RREG32((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2); -+ } else { - amdgpu_ring_emit_wreg(ring, (adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0); -+ } - } - - static void hdp_v5_0_invalidate_hdp(struct amdgpu_device *adev, -@@ -42,6 +44,7 @@ static void hdp_v5_0_invalidate_hdp(struct amdgpu_device *adev, - { - if (!ring || !ring->funcs->emit_wreg) { - WREG32_SOC15_NO_KIQ(HDP, 0, mmHDP_READ_CACHE_INVALIDATE, 1); -+ RREG32_SOC15_NO_KIQ(HDP, 0, mmHDP_READ_CACHE_INVALIDATE); - } else { - amdgpu_ring_emit_wreg(ring, SOC15_REG_OFFSET( - HDP, 0, mmHDP_READ_CACHE_INVALIDATE), 1); -diff --git a/drivers/gpu/drm/amd/amdgpu/hdp_v6_0.c b/drivers/gpu/drm/amd/amdgpu/hdp_v6_0.c -index 063eba619f2f6c..b6d71ec1debf9a 100644 ---- a/drivers/gpu/drm/amd/amdgpu/hdp_v6_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/hdp_v6_0.c -@@ -31,10 +31,12 @@ - static void hdp_v6_0_flush_hdp(struct amdgpu_device *adev, - struct amdgpu_ring *ring) - { -- if (!ring || !ring->funcs->emit_wreg) -- WREG32_NO_KIQ((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0); -- else -+ if (!ring || !ring->funcs->emit_wreg) { -+ WREG32((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0); -+ RREG32((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2); -+ } else { - amdgpu_ring_emit_wreg(ring, (adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0); -+ } - } - - static void hdp_v6_0_update_clock_gating(struct amdgpu_device *adev, -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c -index f76b7aee5c0a12..29a02c1752289c 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c -@@ -2037,11 +2037,12 @@ static int kfd_create_vcrat_image_gpu(void *pcrat_image, - uint32_t proximity_domain) - { - struct crat_header *crat_table = (struct crat_header *)pcrat_image; -+ struct amdgpu_gfx_config *gfx_info = &kdev->adev->gfx.config; -+ struct amdgpu_cu_info *cu_info = &kdev->adev->gfx.cu_info; - struct crat_subtype_generic *sub_type_hdr; - struct kfd_local_mem_info local_mem_info; - struct kfd_topology_device *peer_dev; - struct crat_subtype_computeunit *cu; -- struct kfd_cu_info cu_info; - int avail_size = *size; - uint32_t total_num_of_cu; - uint32_t nid = 0; -@@ -2085,21 +2086,20 @@ static int kfd_create_vcrat_image_gpu(void *pcrat_image, - cu->flags |= CRAT_CU_FLAGS_GPU_PRESENT; - cu->proximity_domain = proximity_domain; - -- amdgpu_amdkfd_get_cu_info(kdev->adev, &cu_info); -- cu->num_simd_per_cu = cu_info.simd_per_cu; -- cu->num_simd_cores = cu_info.simd_per_cu * -- (cu_info.cu_active_number / kdev->kfd->num_nodes); -- cu->max_waves_simd = cu_info.max_waves_per_simd; -+ cu->num_simd_per_cu = cu_info->simd_per_cu; -+ cu->num_simd_cores = cu_info->simd_per_cu * -+ (cu_info->number / kdev->kfd->num_nodes); -+ cu->max_waves_simd = cu_info->max_waves_per_simd; - -- cu->wave_front_size = cu_info.wave_front_size; -- cu->array_count = cu_info.num_shader_arrays_per_engine * -- cu_info.num_shader_engines; -- total_num_of_cu = (cu->array_count * cu_info.num_cu_per_sh); -+ cu->wave_front_size = cu_info->wave_front_size; -+ cu->array_count = gfx_info->max_sh_per_se * -+ gfx_info->max_shader_engines; -+ total_num_of_cu = (cu->array_count * gfx_info->max_cu_per_sh); - cu->processor_id_low = get_and_inc_gpu_processor_id(total_num_of_cu); -- cu->num_cu_per_array = cu_info.num_cu_per_sh; -- cu->max_slots_scatch_cu = cu_info.max_scratch_slots_per_cu; -- cu->num_banks = cu_info.num_shader_engines; -- cu->lds_size_in_kb = cu_info.lds_size; -+ cu->num_cu_per_array = gfx_info->max_cu_per_sh; -+ cu->max_slots_scatch_cu = cu_info->max_scratch_slots_per_cu; -+ cu->num_banks = gfx_info->max_shader_engines; -+ cu->lds_size_in_kb = cu_info->lds_size; - - cu->hsa_capability = 0; - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c -index 4d9a406925e189..43fa260ddbcea0 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c -@@ -197,6 +197,21 @@ static int add_queue_mes(struct device_queue_manager *dqm, struct queue *q, - if (dqm->is_hws_hang) - return -EIO; - -+ if (!pdd->proc_ctx_cpu_ptr) { -+ r = amdgpu_amdkfd_alloc_gtt_mem(adev, -+ AMDGPU_MES_PROC_CTX_SIZE, -+ &pdd->proc_ctx_bo, -+ &pdd->proc_ctx_gpu_addr, -+ &pdd->proc_ctx_cpu_ptr, -+ false); -+ if (r) { -+ dev_err(adev->dev, -+ "failed to allocate process context bo\n"); -+ return r; -+ } -+ memset(pdd->proc_ctx_cpu_ptr, 0, AMDGPU_MES_PROC_CTX_SIZE); -+ } -+ - memset(&queue_input, 0x0, sizeof(struct mes_add_queue_input)); - queue_input.process_id = qpd->pqm->process->pasid; - queue_input.page_table_base_addr = qpd->page_table_base; -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c b/drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c -index 6604a3f99c5ecf..b22a036523b7e4 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c -@@ -373,7 +373,8 @@ int kfd_init_apertures(struct kfd_process *process) - - pdd = kfd_create_process_device_data(dev, process); - if (!pdd) { -- pr_err("Failed to create process device data\n"); -+ dev_err(dev->adev->dev, -+ "Failed to create process device data\n"); - return -ENOMEM; - } - /* -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c -index 68d13c4fac8f4f..2c529339ff6572 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c -@@ -68,7 +68,7 @@ static bool kq_initialize(struct kernel_queue *kq, struct kfd_node *dev, - kq->mqd_mgr = dev->dqm->mqd_mgrs[KFD_MQD_TYPE_HIQ]; - break; - default: -- pr_err("Invalid queue type %d\n", type); -+ dev_err(dev->adev->dev, "Invalid queue type %d\n", type); - return false; - } - -@@ -78,13 +78,14 @@ static bool kq_initialize(struct kernel_queue *kq, struct kfd_node *dev, - prop.doorbell_ptr = kfd_get_kernel_doorbell(dev->kfd, &prop.doorbell_off); - - if (!prop.doorbell_ptr) { -- pr_err("Failed to initialize doorbell"); -+ dev_err(dev->adev->dev, "Failed to initialize doorbell"); - goto err_get_kernel_doorbell; - } - - retval = kfd_gtt_sa_allocate(dev, queue_size, &kq->pq); - if (retval != 0) { -- pr_err("Failed to init pq queues size %d\n", queue_size); -+ dev_err(dev->adev->dev, "Failed to init pq queues size %d\n", -+ queue_size); - goto err_pq_allocate_vidmem; - } - -@@ -332,7 +333,7 @@ struct kernel_queue *kernel_queue_init(struct kfd_node *dev, - if (kq_initialize(kq, dev, type, KFD_KERNEL_QUEUE_SIZE)) - return kq; - -- pr_err("Failed to init kernel queue\n"); -+ dev_err(dev->adev->dev, "Failed to init kernel queue\n"); - - kfree(kq); - return NULL; -@@ -351,26 +352,26 @@ static __attribute__((unused)) void test_kq(struct kfd_node *dev) - uint32_t *buffer, i; - int retval; - -- pr_err("Starting kernel queue test\n"); -+ dev_err(dev->adev->dev, "Starting kernel queue test\n"); - - kq = kernel_queue_init(dev, KFD_QUEUE_TYPE_HIQ); - if (unlikely(!kq)) { -- pr_err(" Failed to initialize HIQ\n"); -- pr_err("Kernel queue test failed\n"); -+ dev_err(dev->adev->dev, " Failed to initialize HIQ\n"); -+ dev_err(dev->adev->dev, "Kernel queue test failed\n"); - return; - } - - retval = kq_acquire_packet_buffer(kq, 5, &buffer); - if (unlikely(retval != 0)) { -- pr_err(" Failed to acquire packet buffer\n"); -- pr_err("Kernel queue test failed\n"); -+ dev_err(dev->adev->dev, " Failed to acquire packet buffer\n"); -+ dev_err(dev->adev->dev, "Kernel queue test failed\n"); - return; - } - for (i = 0; i < 5; i++) - buffer[i] = kq->nop_packet; - kq_submit_packet(kq); - -- pr_err("Ending kernel queue test\n"); -+ dev_err(dev->adev->dev, "Ending kernel queue test\n"); - } - - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c -index 4c3f379803117e..0edae9ded68a99 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c -@@ -99,7 +99,8 @@ void mqd_symmetrically_map_cu_mask(struct mqd_manager *mm, - const uint32_t *cu_mask, uint32_t cu_mask_count, - uint32_t *se_mask, uint32_t inst) - { -- struct kfd_cu_info cu_info; -+ struct amdgpu_cu_info *cu_info = &mm->dev->adev->gfx.cu_info; -+ struct amdgpu_gfx_config *gfx_info = &mm->dev->adev->gfx.config; - uint32_t cu_per_sh[KFD_MAX_NUM_SE][KFD_MAX_NUM_SH_PER_SE] = {0}; - bool wgp_mode_req = KFD_GC_VERSION(mm->dev) >= IP_VERSION(10, 0, 0); - uint32_t en_mask = wgp_mode_req ? 0x3 : 0x1; -@@ -108,9 +109,7 @@ void mqd_symmetrically_map_cu_mask(struct mqd_manager *mm, - int inc = cu_inc * NUM_XCC(mm->dev->xcc_mask); - int xcc_inst = inst + ffs(mm->dev->xcc_mask) - 1; - -- amdgpu_amdkfd_get_cu_info(mm->dev->adev, &cu_info); -- -- cu_active_per_node = cu_info.cu_active_number / mm->dev->kfd->num_nodes; -+ cu_active_per_node = cu_info->number / mm->dev->kfd->num_nodes; - if (cu_mask_count > cu_active_per_node) - cu_mask_count = cu_active_per_node; - -@@ -118,13 +117,16 @@ void mqd_symmetrically_map_cu_mask(struct mqd_manager *mm, - * Returning with no CU's enabled will hang the queue, which should be - * attention grabbing. - */ -- if (cu_info.num_shader_engines > KFD_MAX_NUM_SE) { -- pr_err("Exceeded KFD_MAX_NUM_SE, chip reports %d\n", cu_info.num_shader_engines); -+ if (gfx_info->max_shader_engines > KFD_MAX_NUM_SE) { -+ dev_err(mm->dev->adev->dev, -+ "Exceeded KFD_MAX_NUM_SE, chip reports %d\n", -+ gfx_info->max_shader_engines); - return; - } -- if (cu_info.num_shader_arrays_per_engine > KFD_MAX_NUM_SH_PER_SE) { -- pr_err("Exceeded KFD_MAX_NUM_SH, chip reports %d\n", -- cu_info.num_shader_arrays_per_engine * cu_info.num_shader_engines); -+ if (gfx_info->max_sh_per_se > KFD_MAX_NUM_SH_PER_SE) { -+ dev_err(mm->dev->adev->dev, -+ "Exceeded KFD_MAX_NUM_SH, chip reports %d\n", -+ gfx_info->max_sh_per_se * gfx_info->max_shader_engines); - return; - } - -@@ -142,10 +144,10 @@ void mqd_symmetrically_map_cu_mask(struct mqd_manager *mm, - * See note on Arcturus cu_bitmap layout in gfx_v9_0_get_cu_info. - * See note on GFX11 cu_bitmap layout in gfx_v11_0_get_cu_info. - */ -- for (se = 0; se < cu_info.num_shader_engines; se++) -- for (sh = 0; sh < cu_info.num_shader_arrays_per_engine; sh++) -+ for (se = 0; se < gfx_info->max_shader_engines; se++) -+ for (sh = 0; sh < gfx_info->max_sh_per_se; sh++) - cu_per_sh[se][sh] = hweight32( -- cu_info.cu_bitmap[xcc_inst][se % 4][sh + (se / 4) * -+ cu_info->bitmap[xcc_inst][se % 4][sh + (se / 4) * - cu_bitmap_sh_mul]); - - /* Symmetrically map cu_mask to all SEs & SHs: -@@ -184,13 +186,13 @@ void mqd_symmetrically_map_cu_mask(struct mqd_manager *mm, - * - * First ensure all CUs are disabled, then enable user specified CUs. - */ -- for (i = 0; i < cu_info.num_shader_engines; i++) -+ for (i = 0; i < gfx_info->max_shader_engines; i++) - se_mask[i] = 0; - - i = inst; - for (cu = 0; cu < 16; cu += cu_inc) { -- for (sh = 0; sh < cu_info.num_shader_arrays_per_engine; sh++) { -- for (se = 0; se < cu_info.num_shader_engines; se++) { -+ for (sh = 0; sh < gfx_info->max_sh_per_se; sh++) { -+ for (se = 0; se < gfx_info->max_shader_engines; se++) { - if (cu_per_sh[se][sh] > cu) { - if (cu_mask[i / 32] & (en_mask << (i % 32))) - se_mask[se] |= en_mask << (cu + sh * 16); -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c -index 401096c103b2f1..ecb38a6e8013cd 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c -@@ -45,7 +45,8 @@ static void pm_calc_rlib_size(struct packet_manager *pm, - unsigned int process_count, queue_count, compute_queue_count, gws_queue_count; - unsigned int map_queue_size; - unsigned int max_proc_per_quantum = 1; -- struct kfd_node *dev = pm->dqm->dev; -+ struct kfd_node *node = pm->dqm->dev; -+ struct device *dev = node->adev->dev; - - process_count = pm->dqm->processes_count; - queue_count = pm->dqm->active_queue_count; -@@ -59,14 +60,14 @@ static void pm_calc_rlib_size(struct packet_manager *pm, - */ - *over_subscription = false; - -- if (dev->max_proc_per_quantum > 1) -- max_proc_per_quantum = dev->max_proc_per_quantum; -+ if (node->max_proc_per_quantum > 1) -+ max_proc_per_quantum = node->max_proc_per_quantum; - - if ((process_count > max_proc_per_quantum) || - compute_queue_count > get_cp_queues_num(pm->dqm) || - gws_queue_count > 1) { - *over_subscription = true; -- pr_debug("Over subscribed runlist\n"); -+ dev_dbg(dev, "Over subscribed runlist\n"); - } - - map_queue_size = pm->pmf->map_queues_size; -@@ -81,7 +82,7 @@ static void pm_calc_rlib_size(struct packet_manager *pm, - if (*over_subscription) - *rlib_size += pm->pmf->runlist_size; - -- pr_debug("runlist ib size %d\n", *rlib_size); -+ dev_dbg(dev, "runlist ib size %d\n", *rlib_size); - } - - static int pm_allocate_runlist_ib(struct packet_manager *pm, -@@ -90,6 +91,8 @@ static int pm_allocate_runlist_ib(struct packet_manager *pm, - unsigned int *rl_buffer_size, - bool *is_over_subscription) - { -+ struct kfd_node *node = pm->dqm->dev; -+ struct device *dev = node->adev->dev; - int retval; - - if (WARN_ON(pm->allocated)) -@@ -99,11 +102,10 @@ static int pm_allocate_runlist_ib(struct packet_manager *pm, - - mutex_lock(&pm->lock); - -- retval = kfd_gtt_sa_allocate(pm->dqm->dev, *rl_buffer_size, -- &pm->ib_buffer_obj); -+ retval = kfd_gtt_sa_allocate(node, *rl_buffer_size, &pm->ib_buffer_obj); - - if (retval) { -- pr_err("Failed to allocate runlist IB\n"); -+ dev_err(dev, "Failed to allocate runlist IB\n"); - goto out; - } - -@@ -125,6 +127,8 @@ static int pm_create_runlist_ib(struct packet_manager *pm, - { - unsigned int alloc_size_bytes; - unsigned int *rl_buffer, rl_wptr, i; -+ struct kfd_node *node = pm->dqm->dev; -+ struct device *dev = node->adev->dev; - int retval, processes_mapped; - struct device_process_node *cur; - struct qcm_process_device *qpd; -@@ -142,7 +146,7 @@ static int pm_create_runlist_ib(struct packet_manager *pm, - *rl_size_bytes = alloc_size_bytes; - pm->ib_size_bytes = alloc_size_bytes; - -- pr_debug("Building runlist ib process count: %d queues count %d\n", -+ dev_dbg(dev, "Building runlist ib process count: %d queues count %d\n", - pm->dqm->processes_count, pm->dqm->active_queue_count); - - /* build the run list ib packet */ -@@ -150,7 +154,7 @@ static int pm_create_runlist_ib(struct packet_manager *pm, - qpd = cur->qpd; - /* build map process packet */ - if (processes_mapped >= pm->dqm->processes_count) { -- pr_debug("Not enough space left in runlist IB\n"); -+ dev_dbg(dev, "Not enough space left in runlist IB\n"); - pm_release_ib(pm); - return -ENOMEM; - } -@@ -167,7 +171,8 @@ static int pm_create_runlist_ib(struct packet_manager *pm, - if (!kq->queue->properties.is_active) - continue; - -- pr_debug("static_queue, mapping kernel q %d, is debug status %d\n", -+ dev_dbg(dev, -+ "static_queue, mapping kernel q %d, is debug status %d\n", - kq->queue->queue, qpd->is_debug); - - retval = pm->pmf->map_queues(pm, -@@ -186,7 +191,8 @@ static int pm_create_runlist_ib(struct packet_manager *pm, - if (!q->properties.is_active) - continue; - -- pr_debug("static_queue, mapping user queue %d, is debug status %d\n", -+ dev_dbg(dev, -+ "static_queue, mapping user queue %d, is debug status %d\n", - q->queue, qpd->is_debug); - - retval = pm->pmf->map_queues(pm, -@@ -203,11 +209,13 @@ static int pm_create_runlist_ib(struct packet_manager *pm, - } - } - -- pr_debug("Finished map process and queues to runlist\n"); -+ dev_dbg(dev, "Finished map process and queues to runlist\n"); - - if (is_over_subscription) { - if (!pm->is_over_subscription) -- pr_warn("Runlist is getting oversubscribed. Expect reduced ROCm performance.\n"); -+ dev_warn( -+ dev, -+ "Runlist is getting oversubscribed. Expect reduced ROCm performance.\n"); - retval = pm->pmf->runlist(pm, &rl_buffer[rl_wptr], - *rl_gpu_addr, - alloc_size_bytes / sizeof(uint32_t), -@@ -272,6 +280,8 @@ void pm_uninit(struct packet_manager *pm, bool hanging) - int pm_send_set_resources(struct packet_manager *pm, - struct scheduling_resources *res) - { -+ struct kfd_node *node = pm->dqm->dev; -+ struct device *dev = node->adev->dev; - uint32_t *buffer, size; - int retval = 0; - -@@ -281,7 +291,7 @@ int pm_send_set_resources(struct packet_manager *pm, - size / sizeof(uint32_t), - (unsigned int **)&buffer); - if (!buffer) { -- pr_err("Failed to allocate buffer on kernel queue\n"); -+ dev_err(dev, "Failed to allocate buffer on kernel queue\n"); - retval = -ENOMEM; - goto out; - } -@@ -343,6 +353,8 @@ int pm_send_runlist(struct packet_manager *pm, struct list_head *dqm_queues) - int pm_send_query_status(struct packet_manager *pm, uint64_t fence_address, - uint64_t fence_value) - { -+ struct kfd_node *node = pm->dqm->dev; -+ struct device *dev = node->adev->dev; - uint32_t *buffer, size; - int retval = 0; - -@@ -354,7 +366,7 @@ int pm_send_query_status(struct packet_manager *pm, uint64_t fence_address, - kq_acquire_packet_buffer(pm->priv_queue, - size / sizeof(uint32_t), (unsigned int **)&buffer); - if (!buffer) { -- pr_err("Failed to allocate buffer on kernel queue\n"); -+ dev_err(dev, "Failed to allocate buffer on kernel queue\n"); - retval = -ENOMEM; - goto out; - } -@@ -372,6 +384,8 @@ int pm_send_query_status(struct packet_manager *pm, uint64_t fence_address, - - int pm_update_grace_period(struct packet_manager *pm, uint32_t grace_period) - { -+ struct kfd_node *node = pm->dqm->dev; -+ struct device *dev = node->adev->dev; - int retval = 0; - uint32_t *buffer, size; - -@@ -385,7 +399,8 @@ int pm_update_grace_period(struct packet_manager *pm, uint32_t grace_period) - (unsigned int **)&buffer); - - if (!buffer) { -- pr_err("Failed to allocate buffer on kernel queue\n"); -+ dev_err(dev, -+ "Failed to allocate buffer on kernel queue\n"); - retval = -ENOMEM; - goto out; - } -@@ -406,6 +421,8 @@ int pm_send_unmap_queue(struct packet_manager *pm, - enum kfd_unmap_queues_filter filter, - uint32_t filter_param, bool reset) - { -+ struct kfd_node *node = pm->dqm->dev; -+ struct device *dev = node->adev->dev; - uint32_t *buffer, size; - int retval = 0; - -@@ -414,7 +431,7 @@ int pm_send_unmap_queue(struct packet_manager *pm, - kq_acquire_packet_buffer(pm->priv_queue, - size / sizeof(uint32_t), (unsigned int **)&buffer); - if (!buffer) { -- pr_err("Failed to allocate buffer on kernel queue\n"); -+ dev_err(dev, "Failed to allocate buffer on kernel queue\n"); - retval = -ENOMEM; - goto out; - } -@@ -463,6 +480,8 @@ int pm_debugfs_runlist(struct seq_file *m, void *data) - - int pm_debugfs_hang_hws(struct packet_manager *pm) - { -+ struct kfd_node *node = pm->dqm->dev; -+ struct device *dev = node->adev->dev; - uint32_t *buffer, size; - int r = 0; - -@@ -474,16 +493,16 @@ int pm_debugfs_hang_hws(struct packet_manager *pm) - kq_acquire_packet_buffer(pm->priv_queue, - size / sizeof(uint32_t), (unsigned int **)&buffer); - if (!buffer) { -- pr_err("Failed to allocate buffer on kernel queue\n"); -+ dev_err(dev, "Failed to allocate buffer on kernel queue\n"); - r = -ENOMEM; - goto out; - } - memset(buffer, 0x55, size); - kq_submit_packet(pm->priv_queue); - -- pr_info("Submitting %x %x %x %x %x %x %x to HIQ to hang the HWS.", -- buffer[0], buffer[1], buffer[2], buffer[3], -- buffer[4], buffer[5], buffer[6]); -+ dev_info(dev, "Submitting %x %x %x %x %x %x %x to HIQ to hang the HWS.", -+ buffer[0], buffer[1], buffer[2], buffer[3], buffer[4], -+ buffer[5], buffer[6]); - out: - mutex_unlock(&pm->lock); - return r; -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c -index fd640a061c96a8..64346c71c62a30 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c -@@ -1046,7 +1046,8 @@ static void kfd_process_destroy_pdds(struct kfd_process *p) - - kfd_free_process_doorbells(pdd->dev->kfd, pdd); - -- if (pdd->dev->kfd->shared_resources.enable_mes) -+ if (pdd->dev->kfd->shared_resources.enable_mes && -+ pdd->proc_ctx_cpu_ptr) - amdgpu_amdkfd_free_gtt_mem(pdd->dev->adev, - &pdd->proc_ctx_bo); - /* -@@ -1308,7 +1309,8 @@ int kfd_process_init_cwsr_apu(struct kfd_process *p, struct file *filep) - if (IS_ERR_VALUE(qpd->tba_addr)) { - int err = qpd->tba_addr; - -- pr_err("Failure to set tba address. error %d.\n", err); -+ dev_err(dev->adev->dev, -+ "Failure to set tba address. error %d.\n", err); - qpd->tba_addr = 0; - qpd->cwsr_kaddr = NULL; - return err; -@@ -1571,7 +1573,6 @@ struct kfd_process_device *kfd_create_process_device_data(struct kfd_node *dev, - struct kfd_process *p) - { - struct kfd_process_device *pdd = NULL; -- int retval = 0; - - if (WARN_ON_ONCE(p->n_pdds >= MAX_GPU_INSTANCE)) - return NULL; -@@ -1595,20 +1596,6 @@ struct kfd_process_device *kfd_create_process_device_data(struct kfd_node *dev, - pdd->user_gpu_id = dev->id; - atomic64_set(&pdd->evict_duration_counter, 0); - -- if (dev->kfd->shared_resources.enable_mes) { -- retval = amdgpu_amdkfd_alloc_gtt_mem(dev->adev, -- AMDGPU_MES_PROC_CTX_SIZE, -- &pdd->proc_ctx_bo, -- &pdd->proc_ctx_gpu_addr, -- &pdd->proc_ctx_cpu_ptr, -- false); -- if (retval) { -- pr_err("failed to allocate process context bo\n"); -- goto err_free_pdd; -- } -- memset(pdd->proc_ctx_cpu_ptr, 0, AMDGPU_MES_PROC_CTX_SIZE); -- } -- - p->pdds[p->n_pdds++] = pdd; - if (kfd_dbg_is_per_vmid_supported(pdd->dev)) - pdd->spi_dbg_override = pdd->dev->kfd2kgd->disable_debug_trap( -@@ -1620,10 +1607,6 @@ struct kfd_process_device *kfd_create_process_device_data(struct kfd_node *dev, - idr_init(&pdd->alloc_idr); - - return pdd; -- --err_free_pdd: -- kfree(pdd); -- return NULL; - } - - /** -@@ -1667,7 +1650,7 @@ int kfd_process_device_init_vm(struct kfd_process_device *pdd, - &p->kgd_process_info, - &p->ef); - if (ret) { -- pr_err("Failed to create process VM object\n"); -+ dev_err(dev->adev->dev, "Failed to create process VM object\n"); - return ret; - } - pdd->drm_priv = drm_file->private_data; -@@ -1714,7 +1697,7 @@ struct kfd_process_device *kfd_bind_process_to_device(struct kfd_node *dev, - - pdd = kfd_get_process_device_data(dev, p); - if (!pdd) { -- pr_err("Process device data doesn't exist\n"); -+ dev_err(dev->adev->dev, "Process device data doesn't exist\n"); - return ERR_PTR(-ENOMEM); - } - -@@ -1824,6 +1807,7 @@ int kfd_process_evict_queues(struct kfd_process *p, uint32_t trigger) - - for (i = 0; i < p->n_pdds; i++) { - struct kfd_process_device *pdd = p->pdds[i]; -+ struct device *dev = pdd->dev->adev->dev; - - kfd_smi_event_queue_eviction(pdd->dev, p->lead_thread->pid, - trigger); -@@ -1835,7 +1819,7 @@ int kfd_process_evict_queues(struct kfd_process *p, uint32_t trigger) - * them been add back since they actually not be saved right now. - */ - if (r && r != -EIO) { -- pr_err("Failed to evict process queues\n"); -+ dev_err(dev, "Failed to evict process queues\n"); - goto fail; - } - n_evicted++; -@@ -1857,7 +1841,8 @@ int kfd_process_evict_queues(struct kfd_process *p, uint32_t trigger) - - if (pdd->dev->dqm->ops.restore_process_queues(pdd->dev->dqm, - &pdd->qpd)) -- pr_err("Failed to restore queues\n"); -+ dev_err(pdd->dev->adev->dev, -+ "Failed to restore queues\n"); - - n_evicted--; - } -@@ -1873,13 +1858,14 @@ int kfd_process_restore_queues(struct kfd_process *p) - - for (i = 0; i < p->n_pdds; i++) { - struct kfd_process_device *pdd = p->pdds[i]; -+ struct device *dev = pdd->dev->adev->dev; - - kfd_smi_event_queue_restore(pdd->dev, p->lead_thread->pid); - - r = pdd->dev->dqm->ops.restore_process_queues(pdd->dev->dqm, - &pdd->qpd); - if (r) { -- pr_err("Failed to restore process queues\n"); -+ dev_err(dev, "Failed to restore process queues\n"); - if (!ret) - ret = r; - } -@@ -2039,7 +2025,7 @@ int kfd_reserved_mem_mmap(struct kfd_node *dev, struct kfd_process *process, - struct qcm_process_device *qpd; - - if ((vma->vm_end - vma->vm_start) != KFD_CWSR_TBA_TMA_SIZE) { -- pr_err("Incorrect CWSR mapping size.\n"); -+ dev_err(dev->adev->dev, "Incorrect CWSR mapping size.\n"); - return -EINVAL; - } - -@@ -2051,7 +2037,8 @@ int kfd_reserved_mem_mmap(struct kfd_node *dev, struct kfd_process *process, - qpd->cwsr_kaddr = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, - get_order(KFD_CWSR_TBA_TMA_SIZE)); - if (!qpd->cwsr_kaddr) { -- pr_err("Error allocating per process CWSR buffer.\n"); -+ dev_err(dev->adev->dev, -+ "Error allocating per process CWSR buffer.\n"); - return -ENOMEM; - } - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c -index 8362a71ab70752..3885bb53f0191e 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c -@@ -1537,7 +1537,6 @@ static int kfd_dev_create_p2p_links(void) - /* Helper function. See kfd_fill_gpu_cache_info for parameter description */ - static int fill_in_l1_pcache(struct kfd_cache_properties **props_ext, - struct kfd_gpu_cache_info *pcache_info, -- struct kfd_cu_info *cu_info, - int cu_bitmask, - int cache_type, unsigned int cu_processor_id, - int cu_block) -@@ -1599,7 +1598,8 @@ static int fill_in_l1_pcache(struct kfd_cache_properties **props_ext, - /* Helper function. See kfd_fill_gpu_cache_info for parameter description */ - static int fill_in_l2_l3_pcache(struct kfd_cache_properties **props_ext, - struct kfd_gpu_cache_info *pcache_info, -- struct kfd_cu_info *cu_info, -+ struct amdgpu_cu_info *cu_info, -+ struct amdgpu_gfx_config *gfx_info, - int cache_type, unsigned int cu_processor_id, - struct kfd_node *knode) - { -@@ -1610,7 +1610,7 @@ static int fill_in_l2_l3_pcache(struct kfd_cache_properties **props_ext, - - start = ffs(knode->xcc_mask) - 1; - end = start + NUM_XCC(knode->xcc_mask); -- cu_sibling_map_mask = cu_info->cu_bitmap[start][0][0]; -+ cu_sibling_map_mask = cu_info->bitmap[start][0][0]; - cu_sibling_map_mask &= - ((1 << pcache_info[cache_type].num_cu_shared) - 1); - first_active_cu = ffs(cu_sibling_map_mask); -@@ -1646,15 +1646,15 @@ static int fill_in_l2_l3_pcache(struct kfd_cache_properties **props_ext, - k = 0; - - for (xcc = start; xcc < end; xcc++) { -- for (i = 0; i < cu_info->num_shader_engines; i++) { -- for (j = 0; j < cu_info->num_shader_arrays_per_engine; j++) { -+ for (i = 0; i < gfx_info->max_shader_engines; i++) { -+ for (j = 0; j < gfx_info->max_sh_per_se; j++) { - pcache->sibling_map[k] = (uint8_t)(cu_sibling_map_mask & 0xFF); - pcache->sibling_map[k+1] = (uint8_t)((cu_sibling_map_mask >> 8) & 0xFF); - pcache->sibling_map[k+2] = (uint8_t)((cu_sibling_map_mask >> 16) & 0xFF); - pcache->sibling_map[k+3] = (uint8_t)((cu_sibling_map_mask >> 24) & 0xFF); - k += 4; - -- cu_sibling_map_mask = cu_info->cu_bitmap[xcc][i % 4][j + i / 4]; -+ cu_sibling_map_mask = cu_info->bitmap[xcc][i % 4][j + i / 4]; - cu_sibling_map_mask &= ((1 << pcache_info[cache_type].num_cu_shared) - 1); - } - } -@@ -1679,16 +1679,14 @@ static void kfd_fill_cache_non_crat_info(struct kfd_topology_device *dev, struct - unsigned int cu_processor_id; - int ret; - unsigned int num_cu_shared; -- struct kfd_cu_info cu_info; -- struct kfd_cu_info *pcu_info; -+ struct amdgpu_cu_info *cu_info = &kdev->adev->gfx.cu_info; -+ struct amdgpu_gfx_config *gfx_info = &kdev->adev->gfx.config; - int gpu_processor_id; - struct kfd_cache_properties *props_ext; - int num_of_entries = 0; - int num_of_cache_types = 0; - struct kfd_gpu_cache_info cache_info[KFD_MAX_CACHE_TYPES]; - -- amdgpu_amdkfd_get_cu_info(kdev->adev, &cu_info); -- pcu_info = &cu_info; - - gpu_processor_id = dev->node_props.simd_id_base; - -@@ -1715,12 +1713,12 @@ static void kfd_fill_cache_non_crat_info(struct kfd_topology_device *dev, struct - cu_processor_id = gpu_processor_id; - if (pcache_info[ct].cache_level == 1) { - for (xcc = start; xcc < end; xcc++) { -- for (i = 0; i < pcu_info->num_shader_engines; i++) { -- for (j = 0; j < pcu_info->num_shader_arrays_per_engine; j++) { -- for (k = 0; k < pcu_info->num_cu_per_sh; k += pcache_info[ct].num_cu_shared) { -+ for (i = 0; i < gfx_info->max_shader_engines; i++) { -+ for (j = 0; j < gfx_info->max_sh_per_se; j++) { -+ for (k = 0; k < gfx_info->max_cu_per_sh; k += pcache_info[ct].num_cu_shared) { - -- ret = fill_in_l1_pcache(&props_ext, pcache_info, pcu_info, -- pcu_info->cu_bitmap[xcc][i % 4][j + i / 4], ct, -+ ret = fill_in_l1_pcache(&props_ext, pcache_info, -+ cu_info->bitmap[xcc][i % 4][j + i / 4], ct, - cu_processor_id, k); - - if (ret < 0) -@@ -1733,9 +1731,9 @@ static void kfd_fill_cache_non_crat_info(struct kfd_topology_device *dev, struct - - /* Move to next CU block */ - num_cu_shared = ((k + pcache_info[ct].num_cu_shared) <= -- pcu_info->num_cu_per_sh) ? -+ gfx_info->max_cu_per_sh) ? - pcache_info[ct].num_cu_shared : -- (pcu_info->num_cu_per_sh - k); -+ (gfx_info->max_cu_per_sh - k); - cu_processor_id += num_cu_shared; - } - } -@@ -1743,7 +1741,7 @@ static void kfd_fill_cache_non_crat_info(struct kfd_topology_device *dev, struct - } - } else { - ret = fill_in_l2_l3_pcache(&props_ext, pcache_info, -- pcu_info, ct, cu_processor_id, kdev); -+ cu_info, gfx_info, ct, cu_processor_id, kdev); - - if (ret < 0) - break; -@@ -1922,10 +1920,11 @@ int kfd_topology_add_device(struct kfd_node *gpu) - { - uint32_t gpu_id; - struct kfd_topology_device *dev; -- struct kfd_cu_info cu_info; - int res = 0; - int i; - const char *asic_name = amdgpu_asic_name[gpu->adev->asic_type]; -+ struct amdgpu_gfx_config *gfx_info = &gpu->adev->gfx.config; -+ struct amdgpu_cu_info *cu_info = &gpu->adev->gfx.cu_info; - - gpu_id = kfd_generate_gpu_id(gpu); - if (gpu->xcp && !gpu->xcp->ddev) { -@@ -1963,9 +1962,6 @@ int kfd_topology_add_device(struct kfd_node *gpu) - /* Fill-in additional information that is not available in CRAT but - * needed for the topology - */ -- -- amdgpu_amdkfd_get_cu_info(dev->gpu->adev, &cu_info); -- - for (i = 0; i < KFD_TOPOLOGY_PUBLIC_NAME_SIZE-1; i++) { - dev->node_props.name[i] = __tolower(asic_name[i]); - if (asic_name[i] == '\0') -@@ -1974,7 +1970,7 @@ int kfd_topology_add_device(struct kfd_node *gpu) - dev->node_props.name[i] = '\0'; - - dev->node_props.simd_arrays_per_engine = -- cu_info.num_shader_arrays_per_engine; -+ gfx_info->max_sh_per_se; - - dev->node_props.gfx_target_version = - gpu->kfd->device_info.gfx_target_version; -@@ -2055,7 +2051,7 @@ int kfd_topology_add_device(struct kfd_node *gpu) - */ - if (dev->gpu->adev->asic_type == CHIP_CARRIZO) { - dev->node_props.simd_count = -- cu_info.simd_per_cu * cu_info.cu_active_number; -+ cu_info->simd_per_cu * cu_info->number; - dev->node_props.max_waves_per_simd = 10; - } - -diff --git a/drivers/gpu/drm/amd/include/kgd_kfd_interface.h b/drivers/gpu/drm/amd/include/kgd_kfd_interface.h -index 3b5a56585c4b72..c653a7f4d5e55b 100644 ---- a/drivers/gpu/drm/amd/include/kgd_kfd_interface.h -+++ b/drivers/gpu/drm/amd/include/kgd_kfd_interface.h -@@ -57,20 +57,6 @@ struct kfd_vm_fault_info { - bool prot_exec; - }; - --struct kfd_cu_info { -- uint32_t num_shader_engines; -- uint32_t num_shader_arrays_per_engine; -- uint32_t num_cu_per_sh; -- uint32_t cu_active_number; -- uint32_t cu_ao_mask; -- uint32_t simd_per_cu; -- uint32_t max_waves_per_simd; -- uint32_t wave_front_size; -- uint32_t max_scratch_slots_per_cu; -- uint32_t lds_size; -- uint32_t cu_bitmap[AMDGPU_MAX_GC_INSTANCES][4][4]; --}; -- - /* For getting GPU local memory information from KGD */ - struct kfd_local_mem_info { - uint64_t local_mem_size_private; -diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c -index 90bfb1e988fb31..d6c5de190c2742 100644 ---- a/drivers/gpu/drm/display/drm_dp_mst_topology.c -+++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c -@@ -4033,9 +4033,10 @@ static void drm_dp_mst_up_req_work(struct work_struct *work) - static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) - { - struct drm_dp_pending_up_req *up_req; -+ struct drm_dp_mst_branch *mst_primary; - - if (!drm_dp_get_one_sb_msg(mgr, true, NULL)) -- goto out; -+ goto out_clear_reply; - - if (!mgr->up_req_recv.have_eomt) - return 0; -@@ -4053,10 +4054,19 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) - drm_dbg_kms(mgr->dev, "Received unknown up req type, ignoring: %x\n", - up_req->msg.req_type); - kfree(up_req); -- goto out; -+ goto out_clear_reply; -+ } -+ -+ mutex_lock(&mgr->lock); -+ mst_primary = mgr->mst_primary; -+ if (!mst_primary || !drm_dp_mst_topology_try_get_mstb(mst_primary)) { -+ mutex_unlock(&mgr->lock); -+ kfree(up_req); -+ goto out_clear_reply; - } -+ mutex_unlock(&mgr->lock); - -- drm_dp_send_up_ack_reply(mgr, mgr->mst_primary, up_req->msg.req_type, -+ drm_dp_send_up_ack_reply(mgr, mst_primary, up_req->msg.req_type, - false); - - if (up_req->msg.req_type == DP_CONNECTION_STATUS_NOTIFY) { -@@ -4073,13 +4083,13 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) - conn_stat->peer_device_type); - - mutex_lock(&mgr->probe_lock); -- handle_csn = mgr->mst_primary->link_address_sent; -+ handle_csn = mst_primary->link_address_sent; - mutex_unlock(&mgr->probe_lock); - - if (!handle_csn) { - drm_dbg_kms(mgr->dev, "Got CSN before finish topology probing. Skip it."); - kfree(up_req); -- goto out; -+ goto out_put_primary; - } - } else if (up_req->msg.req_type == DP_RESOURCE_STATUS_NOTIFY) { - const struct drm_dp_resource_status_notify *res_stat = -@@ -4096,7 +4106,9 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) - mutex_unlock(&mgr->up_req_lock); - queue_work(system_long_wq, &mgr->up_req_work); - --out: -+out_put_primary: -+ drm_dp_mst_topology_put_mstb(mst_primary); -+out_clear_reply: - memset(&mgr->up_req_recv, 0, sizeof(struct drm_dp_sideband_msg_rx)); - return 0; - } -diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c -index 0951bfdc89cfa5..913823a063c9ae 100644 ---- a/drivers/i2c/busses/i2c-imx.c -+++ b/drivers/i2c/busses/i2c-imx.c -@@ -286,6 +286,7 @@ static const struct of_device_id i2c_imx_dt_ids[] = { - { .compatible = "fsl,imx6sll-i2c", .data = &imx6_i2c_hwdata, }, - { .compatible = "fsl,imx6sx-i2c", .data = &imx6_i2c_hwdata, }, - { .compatible = "fsl,imx6ul-i2c", .data = &imx6_i2c_hwdata, }, -+ { .compatible = "fsl,imx7d-i2c", .data = &imx6_i2c_hwdata, }, - { .compatible = "fsl,imx7s-i2c", .data = &imx6_i2c_hwdata, }, - { .compatible = "fsl,imx8mm-i2c", .data = &imx6_i2c_hwdata, }, - { .compatible = "fsl,imx8mn-i2c", .data = &imx6_i2c_hwdata, }, -diff --git a/drivers/i2c/busses/i2c-microchip-corei2c.c b/drivers/i2c/busses/i2c-microchip-corei2c.c -index 0b0a1c4d17caef..b0a51695138ad0 100644 ---- a/drivers/i2c/busses/i2c-microchip-corei2c.c -+++ b/drivers/i2c/busses/i2c-microchip-corei2c.c -@@ -93,27 +93,35 @@ - * @base: pointer to register struct - * @dev: device reference - * @i2c_clk: clock reference for i2c input clock -+ * @msg_queue: pointer to the messages requiring sending - * @buf: pointer to msg buffer for easier use - * @msg_complete: xfer completion object - * @adapter: core i2c abstraction - * @msg_err: error code for completed message - * @bus_clk_rate: current i2c bus clock rate - * @isr_status: cached copy of local ISR status -+ * @total_num: total number of messages to be sent/received -+ * @current_num: index of the current message being sent/received - * @msg_len: number of bytes transferred in msg - * @addr: address of the current slave -+ * @restart_needed: whether or not a repeated start is required after current message - */ - struct mchp_corei2c_dev { - void __iomem *base; - struct device *dev; - struct clk *i2c_clk; -+ struct i2c_msg *msg_queue; - u8 *buf; - struct completion msg_complete; - struct i2c_adapter adapter; - int msg_err; -+ int total_num; -+ int current_num; - u32 bus_clk_rate; - u32 isr_status; - u16 msg_len; - u8 addr; -+ bool restart_needed; - }; - - static void mchp_corei2c_core_disable(struct mchp_corei2c_dev *idev) -@@ -222,6 +230,47 @@ static int mchp_corei2c_fill_tx(struct mchp_corei2c_dev *idev) - return 0; - } - -+static void mchp_corei2c_next_msg(struct mchp_corei2c_dev *idev) -+{ -+ struct i2c_msg *this_msg; -+ u8 ctrl; -+ -+ if (idev->current_num >= idev->total_num) { -+ complete(&idev->msg_complete); -+ return; -+ } -+ -+ /* -+ * If there's been an error, the isr needs to return control -+ * to the "main" part of the driver, so as not to keep sending -+ * messages once it completes and clears the SI bit. -+ */ -+ if (idev->msg_err) { -+ complete(&idev->msg_complete); -+ return; -+ } -+ -+ this_msg = idev->msg_queue++; -+ -+ if (idev->current_num < (idev->total_num - 1)) { -+ struct i2c_msg *next_msg = idev->msg_queue; -+ -+ idev->restart_needed = next_msg->flags & I2C_M_RD; -+ } else { -+ idev->restart_needed = false; -+ } -+ -+ idev->addr = i2c_8bit_addr_from_msg(this_msg); -+ idev->msg_len = this_msg->len; -+ idev->buf = this_msg->buf; -+ -+ ctrl = readb(idev->base + CORE_I2C_CTRL); -+ ctrl |= CTRL_STA; -+ writeb(ctrl, idev->base + CORE_I2C_CTRL); -+ -+ idev->current_num++; -+} -+ - static irqreturn_t mchp_corei2c_handle_isr(struct mchp_corei2c_dev *idev) - { - u32 status = idev->isr_status; -@@ -238,8 +287,6 @@ static irqreturn_t mchp_corei2c_handle_isr(struct mchp_corei2c_dev *idev) - ctrl &= ~CTRL_STA; - writeb(idev->addr, idev->base + CORE_I2C_DATA); - writeb(ctrl, idev->base + CORE_I2C_CTRL); -- if (idev->msg_len == 0) -- finished = true; - break; - case STATUS_M_ARB_LOST: - idev->msg_err = -EAGAIN; -@@ -247,10 +294,14 @@ static irqreturn_t mchp_corei2c_handle_isr(struct mchp_corei2c_dev *idev) - break; - case STATUS_M_SLAW_ACK: - case STATUS_M_TX_DATA_ACK: -- if (idev->msg_len > 0) -+ if (idev->msg_len > 0) { - mchp_corei2c_fill_tx(idev); -- else -- last_byte = true; -+ } else { -+ if (idev->restart_needed) -+ finished = true; -+ else -+ last_byte = true; -+ } - break; - case STATUS_M_TX_DATA_NACK: - case STATUS_M_SLAR_NACK: -@@ -287,7 +338,7 @@ static irqreturn_t mchp_corei2c_handle_isr(struct mchp_corei2c_dev *idev) - mchp_corei2c_stop(idev); - - if (last_byte || finished) -- complete(&idev->msg_complete); -+ mchp_corei2c_next_msg(idev); - - return IRQ_HANDLED; - } -@@ -311,21 +362,48 @@ static irqreturn_t mchp_corei2c_isr(int irq, void *_dev) - return ret; - } - --static int mchp_corei2c_xfer_msg(struct mchp_corei2c_dev *idev, -- struct i2c_msg *msg) -+static int mchp_corei2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, -+ int num) - { -- u8 ctrl; -+ struct mchp_corei2c_dev *idev = i2c_get_adapdata(adap); -+ struct i2c_msg *this_msg = msgs; - unsigned long time_left; -+ u8 ctrl; -+ -+ mchp_corei2c_core_enable(idev); -+ -+ /* -+ * The isr controls the flow of a transfer, this info needs to be saved -+ * to a location that it can access the queue information from. -+ */ -+ idev->restart_needed = false; -+ idev->msg_queue = msgs; -+ idev->total_num = num; -+ idev->current_num = 0; - -- idev->addr = i2c_8bit_addr_from_msg(msg); -- idev->msg_len = msg->len; -- idev->buf = msg->buf; -+ /* -+ * But the first entry to the isr is triggered by the start in this -+ * function, so the first message needs to be "dequeued". -+ */ -+ idev->addr = i2c_8bit_addr_from_msg(this_msg); -+ idev->msg_len = this_msg->len; -+ idev->buf = this_msg->buf; - idev->msg_err = 0; - -- reinit_completion(&idev->msg_complete); -+ if (idev->total_num > 1) { -+ struct i2c_msg *next_msg = msgs + 1; - -- mchp_corei2c_core_enable(idev); -+ idev->restart_needed = next_msg->flags & I2C_M_RD; -+ } - -+ idev->current_num++; -+ idev->msg_queue++; -+ -+ reinit_completion(&idev->msg_complete); -+ -+ /* -+ * Send the first start to pass control to the isr -+ */ - ctrl = readb(idev->base + CORE_I2C_CTRL); - ctrl |= CTRL_STA; - writeb(ctrl, idev->base + CORE_I2C_CTRL); -@@ -335,20 +413,8 @@ static int mchp_corei2c_xfer_msg(struct mchp_corei2c_dev *idev, - if (!time_left) - return -ETIMEDOUT; - -- return idev->msg_err; --} -- --static int mchp_corei2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, -- int num) --{ -- struct mchp_corei2c_dev *idev = i2c_get_adapdata(adap); -- int i, ret; -- -- for (i = 0; i < num; i++) { -- ret = mchp_corei2c_xfer_msg(idev, msgs++); -- if (ret) -- return ret; -- } -+ if (idev->msg_err) -+ return idev->msg_err; - - return num; - } -diff --git a/drivers/media/dvb-frontends/dib3000mb.c b/drivers/media/dvb-frontends/dib3000mb.c -index c598b2a6332565..7c452ddd9e40fa 100644 ---- a/drivers/media/dvb-frontends/dib3000mb.c -+++ b/drivers/media/dvb-frontends/dib3000mb.c -@@ -51,7 +51,7 @@ MODULE_PARM_DESC(debug, "set debugging level (1=info,2=xfer,4=setfe,8=getfe (|-a - static int dib3000_read_reg(struct dib3000_state *state, u16 reg) - { - u8 wb[] = { ((reg >> 8) | 0x80) & 0xff, reg & 0xff }; -- u8 rb[2]; -+ u8 rb[2] = {}; - struct i2c_msg msg[] = { - { .addr = state->config.demod_address, .flags = 0, .buf = wb, .len = 2 }, - { .addr = state->config.demod_address, .flags = I2C_M_RD, .buf = rb, .len = 2 }, -diff --git a/drivers/mtd/nand/raw/arasan-nand-controller.c b/drivers/mtd/nand/raw/arasan-nand-controller.c -index a492051c46f596..bde396b359c321 100644 ---- a/drivers/mtd/nand/raw/arasan-nand-controller.c -+++ b/drivers/mtd/nand/raw/arasan-nand-controller.c -@@ -1410,8 +1410,8 @@ static int anfc_parse_cs(struct arasan_nfc *nfc) - * case, the "not" chosen CS is assigned to nfc->spare_cs and selected - * whenever a GPIO CS must be asserted. - */ -- if (nfc->cs_array && nfc->ncs > 2) { -- if (!nfc->cs_array[0] && !nfc->cs_array[1]) { -+ if (nfc->cs_array) { -+ if (nfc->ncs > 2 && !nfc->cs_array[0] && !nfc->cs_array[1]) { - dev_err(nfc->dev, - "Assign a single native CS when using GPIOs\n"); - return -EINVAL; -@@ -1479,8 +1479,15 @@ static int anfc_probe(struct platform_device *pdev) - - static void anfc_remove(struct platform_device *pdev) - { -+ int i; - struct arasan_nfc *nfc = platform_get_drvdata(pdev); - -+ for (i = 0; i < nfc->ncs; i++) { -+ if (nfc->cs_array[i]) { -+ gpiod_put(nfc->cs_array[i]); -+ } -+ } -+ - anfc_chips_cleanup(nfc); - } - -diff --git a/drivers/mtd/nand/raw/atmel/pmecc.c b/drivers/mtd/nand/raw/atmel/pmecc.c -index a22aab4ed4e8ab..3c7dee1be21df1 100644 ---- a/drivers/mtd/nand/raw/atmel/pmecc.c -+++ b/drivers/mtd/nand/raw/atmel/pmecc.c -@@ -380,10 +380,8 @@ atmel_pmecc_create_user(struct atmel_pmecc *pmecc, - user->delta = user->dmu + req->ecc.strength + 1; - - gf_tables = atmel_pmecc_get_gf_tables(req); -- if (IS_ERR(gf_tables)) { -- kfree(user); -+ if (IS_ERR(gf_tables)) - return ERR_CAST(gf_tables); -- } - - user->gf_tables = gf_tables; - -diff --git a/drivers/mtd/nand/raw/diskonchip.c b/drivers/mtd/nand/raw/diskonchip.c -index 2068025d56396a..594e13a852c497 100644 ---- a/drivers/mtd/nand/raw/diskonchip.c -+++ b/drivers/mtd/nand/raw/diskonchip.c -@@ -1098,7 +1098,7 @@ static inline int __init inftl_partscan(struct mtd_info *mtd, struct mtd_partiti - (i == 0) && (ip->firstUnit > 0)) { - parts[0].name = " DiskOnChip IPL / Media Header partition"; - parts[0].offset = 0; -- parts[0].size = mtd->erasesize * ip->firstUnit; -+ parts[0].size = (uint64_t)mtd->erasesize * ip->firstUnit; - numparts = 1; - } - -diff --git a/drivers/pci/msi/irqdomain.c b/drivers/pci/msi/irqdomain.c -index cfd84a899c82d8..dfc15e7507f9b9 100644 ---- a/drivers/pci/msi/irqdomain.c -+++ b/drivers/pci/msi/irqdomain.c -@@ -330,8 +330,11 @@ bool pci_msi_domain_supports(struct pci_dev *pdev, unsigned int feature_mask, - - domain = dev_get_msi_domain(&pdev->dev); - -- if (!domain || !irq_domain_is_hierarchy(domain)) -- return mode == ALLOW_LEGACY; -+ if (!domain || !irq_domain_is_hierarchy(domain)) { -+ if (IS_ENABLED(CONFIG_PCI_MSI_ARCH_FALLBACKS)) -+ return mode == ALLOW_LEGACY; -+ return false; -+ } - - if (!irq_domain_is_msi_parent(domain)) { - /* -diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c -index 2d117cb74832be..053bb9fac6e3e1 100644 ---- a/drivers/pci/msi/msi.c -+++ b/drivers/pci/msi/msi.c -@@ -429,6 +429,10 @@ int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec, - if (WARN_ON_ONCE(dev->msi_enabled)) - return -EINVAL; - -+ /* Test for the availability of MSI support */ -+ if (!pci_msi_domain_supports(dev, 0, ALLOW_LEGACY)) -+ return -ENOTSUPP; -+ - nvec = pci_msi_vec_count(dev); - if (nvec < 0) - return nvec; -diff --git a/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c b/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c -index 4c10cafded4e93..530b571607c013 100644 ---- a/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c -+++ b/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c -@@ -323,6 +323,12 @@ static void usb_init_common_7216(struct brcm_usb_init_params *params) - void __iomem *ctrl = params->regs[BRCM_REGS_CTRL]; - - USB_CTRL_UNSET(ctrl, USB_PM, XHC_S2_CLK_SWITCH_EN); -+ -+ /* -+ * The PHY might be in a bad state if it is already powered -+ * up. Toggle the power just in case. -+ */ -+ USB_CTRL_SET(ctrl, USB_PM, USB_PWRDN); - USB_CTRL_UNSET(ctrl, USB_PM, USB_PWRDN); - - /* 1 millisecond - for USB clocks to settle down */ -diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c -index 96a0b1e111f349..a892e1d7e2d024 100644 ---- a/drivers/phy/phy-core.c -+++ b/drivers/phy/phy-core.c -@@ -140,8 +140,10 @@ static struct phy_provider *of_phy_provider_lookup(struct device_node *node) - return phy_provider; - - for_each_child_of_node(phy_provider->children, child) -- if (child == node) -+ if (child == node) { -+ of_node_put(child); - return phy_provider; -+ } - } - - return ERR_PTR(-EPROBE_DEFER); -@@ -577,8 +579,10 @@ static struct phy *_of_phy_get(struct device_node *np, int index) - return ERR_PTR(-ENODEV); - - /* This phy type handled by the usb-phy subsystem for now */ -- if (of_device_is_compatible(args.np, "usb-nop-xceiv")) -- return ERR_PTR(-ENODEV); -+ if (of_device_is_compatible(args.np, "usb-nop-xceiv")) { -+ phy = ERR_PTR(-ENODEV); -+ goto out_put_node; -+ } - - mutex_lock(&phy_provider_mutex); - phy_provider = of_phy_provider_lookup(args.np); -@@ -600,6 +604,7 @@ static struct phy *_of_phy_get(struct device_node *np, int index) - - out_unlock: - mutex_unlock(&phy_provider_mutex); -+out_put_node: - of_node_put(args.np); - - return phy; -@@ -685,7 +690,7 @@ void devm_phy_put(struct device *dev, struct phy *phy) - if (!phy) - return; - -- r = devres_destroy(dev, devm_phy_release, devm_phy_match, phy); -+ r = devres_release(dev, devm_phy_release, devm_phy_match, phy); - dev_WARN_ONCE(dev, r, "couldn't find PHY resource\n"); - } - EXPORT_SYMBOL_GPL(devm_phy_put); -@@ -1069,7 +1074,7 @@ void devm_phy_destroy(struct device *dev, struct phy *phy) - { - int r; - -- r = devres_destroy(dev, devm_phy_consume, devm_phy_match, phy); -+ r = devres_release(dev, devm_phy_consume, devm_phy_match, phy); - dev_WARN_ONCE(dev, r, "couldn't find PHY resource\n"); - } - EXPORT_SYMBOL_GPL(devm_phy_destroy); -@@ -1207,12 +1212,12 @@ EXPORT_SYMBOL_GPL(of_phy_provider_unregister); - * of_phy_provider_unregister to unregister the phy provider. - */ - void devm_of_phy_provider_unregister(struct device *dev, -- struct phy_provider *phy_provider) -+ struct phy_provider *phy_provider) - { - int r; - -- r = devres_destroy(dev, devm_phy_provider_release, devm_phy_match, -- phy_provider); -+ r = devres_release(dev, devm_phy_provider_release, devm_phy_match, -+ phy_provider); - dev_WARN_ONCE(dev, r, "couldn't find PHY provider device resource\n"); - } - EXPORT_SYMBOL_GPL(devm_of_phy_provider_unregister); -diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-usb.c b/drivers/phy/qualcomm/phy-qcom-qmp-usb.c -index d5a726c13e39d1..c697d01b2a2a1e 100644 ---- a/drivers/phy/qualcomm/phy-qcom-qmp-usb.c -+++ b/drivers/phy/qualcomm/phy-qcom-qmp-usb.c -@@ -1088,7 +1088,7 @@ static const struct qmp_phy_init_tbl sc8280xp_usb3_uniphy_rx_tbl[] = { - QMP_PHY_INIT_CFG(QSERDES_V5_RX_UCDR_FASTLOCK_FO_GAIN, 0x2f), - QMP_PHY_INIT_CFG(QSERDES_V5_RX_UCDR_FASTLOCK_COUNT_LOW, 0xff), - QMP_PHY_INIT_CFG(QSERDES_V5_RX_UCDR_FASTLOCK_COUNT_HIGH, 0x0f), -- QMP_PHY_INIT_CFG(QSERDES_V5_RX_UCDR_SO_GAIN, 0x0a), -+ QMP_PHY_INIT_CFG(QSERDES_V5_RX_UCDR_FO_GAIN, 0x0a), - QMP_PHY_INIT_CFG(QSERDES_V5_RX_VGA_CAL_CNTRL1, 0x54), - QMP_PHY_INIT_CFG(QSERDES_V5_RX_VGA_CAL_CNTRL2, 0x0f), - QMP_PHY_INIT_CFG(QSERDES_V5_RX_RX_EQU_ADAPTOR_CNTRL2, 0x0f), -diff --git a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c -index 26b157f53f3da0..9c231094ba3594 100644 ---- a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c -+++ b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c -@@ -309,7 +309,7 @@ static int rockchip_combphy_parse_dt(struct device *dev, struct rockchip_combphy - - priv->ext_refclk = device_property_present(dev, "rockchip,ext-refclk"); - -- priv->phy_rst = devm_reset_control_array_get_exclusive(dev); -+ priv->phy_rst = devm_reset_control_get(dev, "phy"); - if (IS_ERR(priv->phy_rst)) - return dev_err_probe(dev, PTR_ERR(priv->phy_rst), "failed to get phy reset\n"); - -diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c -index af3da303e2b15a..cba515ce3444df 100644 ---- a/drivers/platform/x86/asus-nb-wmi.c -+++ b/drivers/platform/x86/asus-nb-wmi.c -@@ -590,6 +590,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = { - { KE_KEY, 0xC4, { KEY_KBDILLUMUP } }, - { KE_KEY, 0xC5, { KEY_KBDILLUMDOWN } }, - { KE_IGNORE, 0xC6, }, /* Ambient Light Sensor notification */ -+ { KE_IGNORE, 0xCF, }, /* AC mode */ - { KE_KEY, 0xFA, { KEY_PROG2 } }, /* Lid flip action */ - { KE_KEY, 0xBD, { KEY_PROG2 } }, /* Lid flip action on ROG xflow laptops */ - { KE_END, 0}, -diff --git a/drivers/power/supply/gpio-charger.c b/drivers/power/supply/gpio-charger.c -index 68212b39785bea..6139f736ecbe4f 100644 ---- a/drivers/power/supply/gpio-charger.c -+++ b/drivers/power/supply/gpio-charger.c -@@ -67,6 +67,14 @@ static int set_charge_current_limit(struct gpio_charger *gpio_charger, int val) - if (gpio_charger->current_limit_map[i].limit_ua <= val) - break; - } -+ -+ /* -+ * If a valid charge current limit isn't found, default to smallest -+ * current limitation for safety reasons. -+ */ -+ if (i >= gpio_charger->current_limit_map_size) -+ i = gpio_charger->current_limit_map_size - 1; -+ - mapping = gpio_charger->current_limit_map[i]; - - for (i = 0; i < ndescs; i++) { -diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c -index 3d4f13da1ae873..4cc93cb79b8b0a 100644 ---- a/drivers/scsi/megaraid/megaraid_sas_base.c -+++ b/drivers/scsi/megaraid/megaraid_sas_base.c -@@ -8904,8 +8904,11 @@ megasas_aen_polling(struct work_struct *work) - (ld_target_id / MEGASAS_MAX_DEV_PER_CHANNEL), - (ld_target_id % MEGASAS_MAX_DEV_PER_CHANNEL), - 0); -- if (sdev1) -+ if (sdev1) { -+ mutex_unlock(&instance->reset_mutex); - megasas_remove_scsi_device(sdev1); -+ mutex_lock(&instance->reset_mutex); -+ } - - event_type = SCAN_VD_CHANNEL; - break; -diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c -index 8acf586dc8b2ed..a5d12b95fbd09f 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_base.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c -@@ -7050,11 +7050,12 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, - int i; - u8 failed; - __le32 *mfp; -+ int ret_val; - - /* make sure doorbell is not in use */ - if ((ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { - ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__); -- return -EFAULT; -+ goto doorbell_diag_reset; - } - - /* clear pending doorbell interrupts from previous state changes */ -@@ -7144,6 +7145,10 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, - le32_to_cpu(mfp[i])); - } - return 0; -+ -+doorbell_diag_reset: -+ ret_val = _base_diag_reset(ioc); -+ return ret_val; - } - - /** -diff --git a/drivers/scsi/qla1280.h b/drivers/scsi/qla1280.h -index d309e2ca14deb3..dea2290b37d4d7 100644 ---- a/drivers/scsi/qla1280.h -+++ b/drivers/scsi/qla1280.h -@@ -116,12 +116,12 @@ struct device_reg { - uint16_t id_h; /* ID high */ - uint16_t cfg_0; /* Configuration 0 */ - #define ISP_CFG0_HWMSK 0x000f /* Hardware revision mask */ --#define ISP_CFG0_1020 BIT_0 /* ISP1020 */ --#define ISP_CFG0_1020A BIT_1 /* ISP1020A */ --#define ISP_CFG0_1040 BIT_2 /* ISP1040 */ --#define ISP_CFG0_1040A BIT_3 /* ISP1040A */ --#define ISP_CFG0_1040B BIT_4 /* ISP1040B */ --#define ISP_CFG0_1040C BIT_5 /* ISP1040C */ -+#define ISP_CFG0_1020 1 /* ISP1020 */ -+#define ISP_CFG0_1020A 2 /* ISP1020A */ -+#define ISP_CFG0_1040 3 /* ISP1040 */ -+#define ISP_CFG0_1040A 4 /* ISP1040A */ -+#define ISP_CFG0_1040B 5 /* ISP1040B */ -+#define ISP_CFG0_1040C 6 /* ISP1040C */ - uint16_t cfg_1; /* Configuration 1 */ - #define ISP_CFG1_F128 BIT_6 /* 128-byte FIFO threshold */ - #define ISP_CFG1_F64 BIT_4|BIT_5 /* 128-byte FIFO threshold */ -diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c -index 7ceb982040a5df..d0b55c1fa908a5 100644 ---- a/drivers/scsi/storvsc_drv.c -+++ b/drivers/scsi/storvsc_drv.c -@@ -149,6 +149,8 @@ struct hv_fc_wwn_packet { - */ - static int vmstor_proto_version; - -+static bool hv_dev_is_fc(struct hv_device *hv_dev); -+ - #define STORVSC_LOGGING_NONE 0 - #define STORVSC_LOGGING_ERROR 1 - #define STORVSC_LOGGING_WARN 2 -@@ -1138,6 +1140,7 @@ static void storvsc_on_io_completion(struct storvsc_device *stor_device, - * not correctly handle: - * INQUIRY command with page code parameter set to 0x80 - * MODE_SENSE command with cmd[2] == 0x1c -+ * MAINTENANCE_IN is not supported by HyperV FC passthrough - * - * Setup srb and scsi status so this won't be fatal. - * We do this so we can distinguish truly fatal failues -@@ -1145,7 +1148,9 @@ static void storvsc_on_io_completion(struct storvsc_device *stor_device, - */ - - if ((stor_pkt->vm_srb.cdb[0] == INQUIRY) || -- (stor_pkt->vm_srb.cdb[0] == MODE_SENSE)) { -+ (stor_pkt->vm_srb.cdb[0] == MODE_SENSE) || -+ (stor_pkt->vm_srb.cdb[0] == MAINTENANCE_IN && -+ hv_dev_is_fc(device))) { - vstor_packet->vm_srb.scsi_status = 0; - vstor_packet->vm_srb.srb_status = SRB_STATUS_SUCCESS; - } -diff --git a/drivers/spi/spi-intel-pci.c b/drivers/spi/spi-intel-pci.c -index 4337ca51d7aa21..5c0dec90eec1df 100644 ---- a/drivers/spi/spi-intel-pci.c -+++ b/drivers/spi/spi-intel-pci.c -@@ -86,6 +86,8 @@ static const struct pci_device_id intel_spi_pci_ids[] = { - { PCI_VDEVICE(INTEL, 0xa324), (unsigned long)&cnl_info }, - { PCI_VDEVICE(INTEL, 0xa3a4), (unsigned long)&cnl_info }, - { PCI_VDEVICE(INTEL, 0xa823), (unsigned long)&cnl_info }, -+ { PCI_VDEVICE(INTEL, 0xe323), (unsigned long)&cnl_info }, -+ { PCI_VDEVICE(INTEL, 0xe423), (unsigned long)&cnl_info }, - { }, - }; - MODULE_DEVICE_TABLE(pci, intel_spi_pci_ids); -diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c -index ddf1c684bcc7d8..3cfd262c1abc25 100644 ---- a/drivers/spi/spi-omap2-mcspi.c -+++ b/drivers/spi/spi-omap2-mcspi.c -@@ -1521,10 +1521,10 @@ static int omap2_mcspi_probe(struct platform_device *pdev) - } - - mcspi->ref_clk = devm_clk_get_optional_enabled(&pdev->dev, NULL); -- if (mcspi->ref_clk) -- mcspi->ref_clk_hz = clk_get_rate(mcspi->ref_clk); -- else -+ if (IS_ERR(mcspi->ref_clk)) - mcspi->ref_clk_hz = OMAP2_MCSPI_MAX_FREQ; -+ else -+ mcspi->ref_clk_hz = clk_get_rate(mcspi->ref_clk); - ctlr->max_speed_hz = mcspi->ref_clk_hz; - ctlr->min_speed_hz = mcspi->ref_clk_hz >> 15; - -diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c -index 843f9f8e391776..239947df613db1 100644 ---- a/drivers/watchdog/it87_wdt.c -+++ b/drivers/watchdog/it87_wdt.c -@@ -20,6 +20,8 @@ - - #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt - -+#include -+#include - #include - #include - #include -@@ -40,6 +42,7 @@ - #define VAL 0x2f - - /* Logical device Numbers LDN */ -+#define EC 0x04 - #define GPIO 0x07 - - /* Configuration Registers and Functions */ -@@ -71,6 +74,12 @@ - #define IT8784_ID 0x8784 - #define IT8786_ID 0x8786 - -+/* Environment Controller Configuration Registers LDN=0x04 */ -+#define SCR1 0xfa -+ -+/* Environment Controller Bits SCR1 */ -+#define WDT_PWRGD 0x20 -+ - /* GPIO Configuration Registers LDN=0x07 */ - #define WDTCTRL 0x71 - #define WDTCFG 0x72 -@@ -233,6 +242,21 @@ static int wdt_set_timeout(struct watchdog_device *wdd, unsigned int t) - return ret; - } - -+enum { -+ IT87_WDT_OUTPUT_THROUGH_PWRGD = BIT(0), -+}; -+ -+static const struct dmi_system_id it87_quirks[] = { -+ { -+ /* Qotom Q30900P (IT8786) */ -+ .matches = { -+ DMI_EXACT_MATCH(DMI_BOARD_NAME, "QCML04"), -+ }, -+ .driver_data = (void *)IT87_WDT_OUTPUT_THROUGH_PWRGD, -+ }, -+ {} -+}; -+ - static const struct watchdog_info ident = { - .options = WDIOF_SETTIMEOUT | WDIOF_MAGICCLOSE | WDIOF_KEEPALIVEPING, - .firmware_version = 1, -@@ -254,8 +278,10 @@ static struct watchdog_device wdt_dev = { - - static int __init it87_wdt_init(void) - { -+ const struct dmi_system_id *dmi_id; - u8 chip_rev; - u8 ctrl; -+ int quirks = 0; - int rc; - - rc = superio_enter(); -@@ -266,6 +292,10 @@ static int __init it87_wdt_init(void) - chip_rev = superio_inb(CHIPREV) & 0x0f; - superio_exit(); - -+ dmi_id = dmi_first_match(it87_quirks); -+ if (dmi_id) -+ quirks = (long)dmi_id->driver_data; -+ - switch (chip_type) { - case IT8702_ID: - max_units = 255; -@@ -326,6 +356,15 @@ static int __init it87_wdt_init(void) - superio_outb(0x00, WDTCTRL); - } - -+ if (quirks & IT87_WDT_OUTPUT_THROUGH_PWRGD) { -+ superio_select(EC); -+ ctrl = superio_inb(SCR1); -+ if (!(ctrl & WDT_PWRGD)) { -+ ctrl |= WDT_PWRGD; -+ superio_outb(ctrl, SCR1); -+ } -+ } -+ - superio_exit(); - - if (timeout < 1 || timeout > max_units * 60) { -diff --git a/drivers/watchdog/mtk_wdt.c b/drivers/watchdog/mtk_wdt.c -index 0559d9f2d97b36..66bb68ceb14cf6 100644 ---- a/drivers/watchdog/mtk_wdt.c -+++ b/drivers/watchdog/mtk_wdt.c -@@ -10,6 +10,7 @@ - */ - - #include -+#include - #include - #include - #include -@@ -81,6 +82,10 @@ static const struct mtk_wdt_data mt2712_data = { - .toprgu_sw_rst_num = MT2712_TOPRGU_SW_RST_NUM, - }; - -+static const struct mtk_wdt_data mt6735_data = { -+ .toprgu_sw_rst_num = MT6735_TOPRGU_RST_NUM, -+}; -+ - static const struct mtk_wdt_data mt6795_data = { - .toprgu_sw_rst_num = MT6795_TOPRGU_SW_RST_NUM, - }; -@@ -448,6 +453,7 @@ static int mtk_wdt_resume(struct device *dev) - static const struct of_device_id mtk_wdt_dt_ids[] = { - { .compatible = "mediatek,mt2712-wdt", .data = &mt2712_data }, - { .compatible = "mediatek,mt6589-wdt" }, -+ { .compatible = "mediatek,mt6735-wdt", .data = &mt6735_data }, - { .compatible = "mediatek,mt6795-wdt", .data = &mt6795_data }, - { .compatible = "mediatek,mt7986-wdt", .data = &mt7986_data }, - { .compatible = "mediatek,mt8183-wdt", .data = &mt8183_data }, -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 035815c4394985..d6767f728c079d 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -7153,6 +7153,8 @@ noinline int can_nocow_extent(struct inode *inode, u64 offset, u64 *len, - ret = -EAGAIN; - goto out; - } -+ -+ cond_resched(); - } - - if (orig_start) -diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c -index c9198723e4cb73..512d4cbac1ca0b 100644 ---- a/fs/btrfs/sysfs.c -+++ b/fs/btrfs/sysfs.c -@@ -1022,7 +1022,7 @@ static ssize_t btrfs_nodesize_show(struct kobject *kobj, - { - struct btrfs_fs_info *fs_info = to_fs_info(kobj); - -- return sysfs_emit(buf, "%u\n", fs_info->super_copy->nodesize); -+ return sysfs_emit(buf, "%u\n", fs_info->nodesize); - } - - BTRFS_ATTR(, nodesize, btrfs_nodesize_show); -@@ -1032,7 +1032,7 @@ static ssize_t btrfs_sectorsize_show(struct kobject *kobj, - { - struct btrfs_fs_info *fs_info = to_fs_info(kobj); - -- return sysfs_emit(buf, "%u\n", fs_info->super_copy->sectorsize); -+ return sysfs_emit(buf, "%u\n", fs_info->sectorsize); - } - - BTRFS_ATTR(, sectorsize, btrfs_sectorsize_show); -@@ -1084,7 +1084,7 @@ static ssize_t btrfs_clone_alignment_show(struct kobject *kobj, - { - struct btrfs_fs_info *fs_info = to_fs_info(kobj); - -- return sysfs_emit(buf, "%u\n", fs_info->super_copy->sectorsize); -+ return sysfs_emit(buf, "%u\n", fs_info->sectorsize); - } - - BTRFS_ATTR(, clone_alignment, btrfs_clone_alignment_show); -diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c -index 1a2776025e9861..2c92de964c5a2e 100644 ---- a/fs/ceph/addr.c -+++ b/fs/ceph/addr.c -@@ -355,6 +355,7 @@ static void ceph_netfs_issue_read(struct netfs_io_subrequest *subreq) - u64 len = subreq->len; - bool sparse = IS_ENCRYPTED(inode) || ceph_test_mount_opt(fsc, SPARSEREAD); - u64 off = subreq->start; -+ int extent_cnt; - - if (ceph_inode_is_shutdown(inode)) { - err = -EIO; -@@ -377,7 +378,8 @@ static void ceph_netfs_issue_read(struct netfs_io_subrequest *subreq) - } - - if (sparse) { -- err = ceph_alloc_sparse_ext_map(&req->r_ops[0]); -+ extent_cnt = __ceph_sparse_read_ext_count(inode, len); -+ err = ceph_alloc_sparse_ext_map(&req->r_ops[0], extent_cnt); - if (err) - goto out; - } -diff --git a/fs/ceph/file.c b/fs/ceph/file.c -index 813974244a9d37..a03b11cf788721 100644 ---- a/fs/ceph/file.c -+++ b/fs/ceph/file.c -@@ -1001,6 +1001,7 @@ ssize_t __ceph_sync_read(struct inode *inode, loff_t *ki_pos, - struct ceph_osd_req_op *op; - u64 read_off = off; - u64 read_len = len; -+ int extent_cnt; - - /* determine new offset/length if encrypted */ - ceph_fscrypt_adjust_off_and_len(inode, &read_off, &read_len); -@@ -1025,6 +1026,16 @@ ssize_t __ceph_sync_read(struct inode *inode, loff_t *ki_pos, - len = read_off + read_len - off; - more = len < iov_iter_count(to); - -+ op = &req->r_ops[0]; -+ if (sparse) { -+ extent_cnt = __ceph_sparse_read_ext_count(inode, read_len); -+ ret = ceph_alloc_sparse_ext_map(op, extent_cnt); -+ if (ret) { -+ ceph_osdc_put_request(req); -+ break; -+ } -+ } -+ - num_pages = calc_pages_for(read_off, read_len); - page_off = offset_in_page(off); - pages = ceph_alloc_page_vector(num_pages, GFP_KERNEL); -@@ -1038,15 +1049,6 @@ ssize_t __ceph_sync_read(struct inode *inode, loff_t *ki_pos, - offset_in_page(read_off), - false, true); - -- op = &req->r_ops[0]; -- if (sparse) { -- ret = ceph_alloc_sparse_ext_map(op); -- if (ret) { -- ceph_osdc_put_request(req); -- break; -- } -- } -- - ceph_osdc_start_request(osdc, req); - ret = ceph_osdc_wait_request(osdc, req); - -@@ -1431,6 +1433,7 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter, - ssize_t len; - struct ceph_osd_req_op *op; - int readop = sparse ? CEPH_OSD_OP_SPARSE_READ : CEPH_OSD_OP_READ; -+ int extent_cnt; - - if (write) - size = min_t(u64, size, fsc->mount_options->wsize); -@@ -1451,6 +1454,16 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter, - break; - } - -+ op = &req->r_ops[0]; -+ if (!write && sparse) { -+ extent_cnt = __ceph_sparse_read_ext_count(inode, size); -+ ret = ceph_alloc_sparse_ext_map(op, extent_cnt); -+ if (ret) { -+ ceph_osdc_put_request(req); -+ break; -+ } -+ } -+ - len = iter_get_bvecs_alloc(iter, size, &bvecs, &num_pages); - if (len < 0) { - ceph_osdc_put_request(req); -@@ -1460,6 +1473,8 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter, - if (len != size) - osd_req_op_extent_update(req, 0, len); - -+ osd_req_op_extent_osd_data_bvecs(req, 0, bvecs, num_pages, len); -+ - /* - * To simplify error handling, allow AIO when IO within i_size - * or IO can be satisfied by single OSD request. -@@ -1491,16 +1506,6 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter, - req->r_mtime = mtime; - } - -- osd_req_op_extent_osd_data_bvecs(req, 0, bvecs, num_pages, len); -- op = &req->r_ops[0]; -- if (sparse) { -- ret = ceph_alloc_sparse_ext_map(op); -- if (ret) { -- ceph_osdc_put_request(req); -- break; -- } -- } -- - if (aio_req) { - aio_req->total_len += len; - aio_req->num_reqs++; -diff --git a/fs/ceph/super.h b/fs/ceph/super.h -index 8efd4ba6077448..5903e3fb6d7506 100644 ---- a/fs/ceph/super.h -+++ b/fs/ceph/super.h -@@ -3,6 +3,7 @@ - #define _FS_CEPH_SUPER_H - - #include -+#include - - #include - #include -@@ -1401,6 +1402,19 @@ static inline void __ceph_update_quota(struct ceph_inode_info *ci, - ceph_adjust_quota_realms_count(&ci->netfs.inode, has_quota); - } - -+static inline int __ceph_sparse_read_ext_count(struct inode *inode, u64 len) -+{ -+ int cnt = 0; -+ -+ if (IS_ENCRYPTED(inode)) { -+ cnt = len >> CEPH_FSCRYPT_BLOCK_SHIFT; -+ if (cnt > CEPH_SPARSE_EXT_ARRAY_INITIAL) -+ cnt = 0; -+ } -+ -+ return cnt; -+} -+ - extern void ceph_handle_quota(struct ceph_mds_client *mdsc, - struct ceph_mds_session *session, - struct ceph_msg *msg); -diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c -index d4d3ec58047e82..4b5d998cbc2f44 100644 ---- a/fs/nfsd/export.c -+++ b/fs/nfsd/export.c -@@ -40,24 +40,15 @@ - #define EXPKEY_HASHMAX (1 << EXPKEY_HASHBITS) - #define EXPKEY_HASHMASK (EXPKEY_HASHMAX -1) - --static void expkey_put_work(struct work_struct *work) -+static void expkey_put(struct kref *ref) - { -- struct svc_expkey *key = -- container_of(to_rcu_work(work), struct svc_expkey, ek_rcu_work); -+ struct svc_expkey *key = container_of(ref, struct svc_expkey, h.ref); - - if (test_bit(CACHE_VALID, &key->h.flags) && - !test_bit(CACHE_NEGATIVE, &key->h.flags)) - path_put(&key->ek_path); - auth_domain_put(key->ek_client); -- kfree(key); --} -- --static void expkey_put(struct kref *ref) --{ -- struct svc_expkey *key = container_of(ref, struct svc_expkey, h.ref); -- -- INIT_RCU_WORK(&key->ek_rcu_work, expkey_put_work); -- queue_rcu_work(system_wq, &key->ek_rcu_work); -+ kfree_rcu(key, ek_rcu); - } - - static int expkey_upcall(struct cache_detail *cd, struct cache_head *h) -@@ -360,26 +351,16 @@ static void export_stats_destroy(struct export_stats *stats) - EXP_STATS_COUNTERS_NUM); - } - --static void svc_export_put_work(struct work_struct *work) -+static void svc_export_put(struct kref *ref) - { -- struct svc_export *exp = -- container_of(to_rcu_work(work), struct svc_export, ex_rcu_work); -- -+ struct svc_export *exp = container_of(ref, struct svc_export, h.ref); - path_put(&exp->ex_path); - auth_domain_put(exp->ex_client); - nfsd4_fslocs_free(&exp->ex_fslocs); - export_stats_destroy(exp->ex_stats); - kfree(exp->ex_stats); - kfree(exp->ex_uuid); -- kfree(exp); --} -- --static void svc_export_put(struct kref *ref) --{ -- struct svc_export *exp = container_of(ref, struct svc_export, h.ref); -- -- INIT_RCU_WORK(&exp->ex_rcu_work, svc_export_put_work); -- queue_rcu_work(system_wq, &exp->ex_rcu_work); -+ kfree_rcu(exp, ex_rcu); - } - - static int svc_export_upcall(struct cache_detail *cd, struct cache_head *h) -diff --git a/fs/nfsd/export.h b/fs/nfsd/export.h -index 9d895570ceba05..ca9dc230ae3d0b 100644 ---- a/fs/nfsd/export.h -+++ b/fs/nfsd/export.h -@@ -75,7 +75,7 @@ struct svc_export { - u32 ex_layout_types; - struct nfsd4_deviceid_map *ex_devid_map; - struct cache_detail *cd; -- struct rcu_work ex_rcu_work; -+ struct rcu_head ex_rcu; - unsigned long ex_xprtsec_modes; - struct export_stats *ex_stats; - }; -@@ -92,7 +92,7 @@ struct svc_expkey { - u32 ek_fsid[6]; - - struct path ek_path; -- struct rcu_work ek_rcu_work; -+ struct rcu_head ek_rcu; - }; - - #define EX_ISSYNC(exp) (!((exp)->ex_flags & NFSEXP_ASYNC)) -diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c -index 49a49529c6b8fb..54ffadf02e034f 100644 ---- a/fs/nfsd/nfs4callback.c -+++ b/fs/nfsd/nfs4callback.c -@@ -986,7 +986,7 @@ static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *c - args.authflavor = clp->cl_cred.cr_flavor; - clp->cl_cb_ident = conn->cb_ident; - } else { -- if (!conn->cb_xprt) -+ if (!conn->cb_xprt || !ses) - return -EINVAL; - clp->cl_cb_session = ses; - args.bc_xprt = conn->cb_xprt; -@@ -1379,8 +1379,6 @@ static void nfsd4_process_cb_update(struct nfsd4_callback *cb) - ses = c->cn_session; - } - spin_unlock(&clp->cl_lock); -- if (!c) -- return; - - err = setup_callback_client(clp, &conn, ses); - if (err) { -diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c -index 663b014b9d1886..23537e1b346858 100644 ---- a/fs/smb/server/smb_common.c -+++ b/fs/smb/server/smb_common.c -@@ -18,8 +18,8 @@ - #include "mgmt/share_config.h" - - /*for shortname implementation */ --static const char basechars[43] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-!@#$%"; --#define MANGLE_BASE (sizeof(basechars) / sizeof(char) - 1) -+static const char *basechars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-!@#$%"; -+#define MANGLE_BASE (strlen(basechars) - 1) - #define MAGIC_CHAR '~' - #define PERIOD '.' - #define mangle(V) ((char)(basechars[(V) % MANGLE_BASE])) -diff --git a/fs/udf/namei.c b/fs/udf/namei.c -index 605f182da42cbb..b3f57ad2b869ff 100644 ---- a/fs/udf/namei.c -+++ b/fs/udf/namei.c -@@ -521,7 +521,11 @@ static int udf_rmdir(struct inode *dir, struct dentry *dentry) - inode->i_nlink); - clear_nlink(inode); - inode->i_size = 0; -- inode_dec_link_count(dir); -+ if (dir->i_nlink >= 3) -+ inode_dec_link_count(dir); -+ else -+ udf_warn(inode->i_sb, "parent dir link count too low (%u)\n", -+ dir->i_nlink); - udf_add_fid_counter(dir->i_sb, true, -1); - dir->i_mtime = inode_set_ctime_to_ts(dir, - inode_set_ctime_current(inode)); -diff --git a/include/linux/ceph/osd_client.h b/include/linux/ceph/osd_client.h -index f703fb8030de26..50e409e8446659 100644 ---- a/include/linux/ceph/osd_client.h -+++ b/include/linux/ceph/osd_client.h -@@ -573,9 +573,12 @@ int __ceph_alloc_sparse_ext_map(struct ceph_osd_req_op *op, int cnt); - */ - #define CEPH_SPARSE_EXT_ARRAY_INITIAL 16 - --static inline int ceph_alloc_sparse_ext_map(struct ceph_osd_req_op *op) -+static inline int ceph_alloc_sparse_ext_map(struct ceph_osd_req_op *op, int cnt) - { -- return __ceph_alloc_sparse_ext_map(op, CEPH_SPARSE_EXT_ARRAY_INITIAL); -+ if (!cnt) -+ cnt = CEPH_SPARSE_EXT_ARRAY_INITIAL; -+ -+ return __ceph_alloc_sparse_ext_map(op, cnt); - } - - extern void ceph_osdc_get_request(struct ceph_osd_request *req); -diff --git a/include/linux/sched.h b/include/linux/sched.h -index 4809f27b520172..d4f9d82c69e0b0 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -1683,8 +1683,9 @@ static inline unsigned int __task_state_index(unsigned int tsk_state, - * We're lying here, but rather than expose a completely new task state - * to userspace, we can make this appear as if the task has gone through - * a regular rt_mutex_lock() call. -+ * Report frozen tasks as uninterruptible. - */ -- if (tsk_state & TASK_RTLOCK_WAIT) -+ if ((tsk_state & TASK_RTLOCK_WAIT) || (tsk_state & TASK_FROZEN)) - state = TASK_UNINTERRUPTIBLE; - - return fls(state); -diff --git a/include/linux/sched/task_stack.h b/include/linux/sched/task_stack.h -index f158b025c17509..d2117e1c8fa581 100644 ---- a/include/linux/sched/task_stack.h -+++ b/include/linux/sched/task_stack.h -@@ -8,6 +8,7 @@ - - #include - #include -+#include - - #ifdef CONFIG_THREAD_INFO_IN_TASK - -@@ -88,6 +89,7 @@ static inline int object_is_on_stack(const void *obj) - { - void *stack = task_stack_page(current); - -+ obj = kasan_reset_tag(obj); - return (obj >= stack) && (obj < (stack + THREAD_SIZE)); - } - -diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h -index 062fe440f5d095..6ccfd9236387c6 100644 ---- a/include/linux/skmsg.h -+++ b/include/linux/skmsg.h -@@ -308,17 +308,22 @@ static inline void sock_drop(struct sock *sk, struct sk_buff *skb) - kfree_skb(skb); - } - --static inline void sk_psock_queue_msg(struct sk_psock *psock, -+static inline bool sk_psock_queue_msg(struct sk_psock *psock, - struct sk_msg *msg) - { -+ bool ret; -+ - spin_lock_bh(&psock->ingress_lock); -- if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) -+ if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) { - list_add_tail(&msg->list, &psock->ingress_msg); -- else { -+ ret = true; -+ } else { - sk_msg_free(psock->sk, msg); - kfree(msg); -+ ret = false; - } - spin_unlock_bh(&psock->ingress_lock); -+ return ret; - } - - static inline struct sk_msg *sk_psock_dequeue_msg(struct sk_psock *psock) -diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h -index 9d799777c333c0..9df2524fff33ae 100644 ---- a/include/linux/trace_events.h -+++ b/include/linux/trace_events.h -@@ -369,7 +369,7 @@ struct trace_event_call { - struct list_head list; - struct trace_event_class *class; - union { -- char *name; -+ const char *name; - /* Set TRACE_EVENT_FL_TRACEPOINT flag when using "tp" */ - struct tracepoint *tp; - }; -diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h -index fed855bae6d8e8..3219b368db79cc 100644 ---- a/include/linux/vmstat.h -+++ b/include/linux/vmstat.h -@@ -519,7 +519,7 @@ static inline const char *node_stat_name(enum node_stat_item item) - - static inline const char *lru_list_name(enum lru_list lru) - { -- return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" -+ return node_stat_name(NR_LRU_BASE + (enum node_stat_item)lru) + 3; // skip "nr_" - } - - static inline const char *writeback_stat_name(enum writeback_stat_item item) -diff --git a/include/net/sock.h b/include/net/sock.h -index a6b795ec7c9cb6..dc625f94ee37b7 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -1635,7 +1635,7 @@ static inline bool sk_wmem_schedule(struct sock *sk, int size) - } - - static inline bool --sk_rmem_schedule(struct sock *sk, struct sk_buff *skb, int size) -+__sk_rmem_schedule(struct sock *sk, int size, bool pfmemalloc) - { - int delta; - -@@ -1643,7 +1643,13 @@ sk_rmem_schedule(struct sock *sk, struct sk_buff *skb, int size) - return true; - delta = size - sk->sk_forward_alloc; - return delta <= 0 || __sk_mem_schedule(sk, delta, SK_MEM_RECV) || -- skb_pfmemalloc(skb); -+ pfmemalloc; -+} -+ -+static inline bool -+sk_rmem_schedule(struct sock *sk, struct sk_buff *skb, int size) -+{ -+ return __sk_rmem_schedule(sk, size, skb_pfmemalloc(skb)); - } - - static inline int sk_unused_reserved_mem(const struct sock *sk) -diff --git a/include/uapi/linux/stddef.h b/include/uapi/linux/stddef.h -index 2ec6f35cda32e9..473ad86706d837 100644 ---- a/include/uapi/linux/stddef.h -+++ b/include/uapi/linux/stddef.h -@@ -8,6 +8,13 @@ - #define __always_inline inline - #endif - -+/* Not all C++ standards support type declarations inside an anonymous union */ -+#ifndef __cplusplus -+#define __struct_group_tag(TAG) TAG -+#else -+#define __struct_group_tag(TAG) -+#endif -+ - /** - * __struct_group() - Create a mirrored named and anonyomous struct - * -@@ -20,13 +27,13 @@ - * and size: one anonymous and one named. The former's members can be used - * normally without sub-struct naming, and the latter can be used to - * reason about the start, end, and size of the group of struct members. -- * The named struct can also be explicitly tagged for layer reuse, as well -- * as both having struct attributes appended. -+ * The named struct can also be explicitly tagged for layer reuse (C only), -+ * as well as both having struct attributes appended. - */ - #define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \ - union { \ - struct { MEMBERS } ATTRS; \ -- struct TAG { MEMBERS } ATTRS NAME; \ -+ struct __struct_group_tag(TAG) { MEMBERS } ATTRS NAME; \ - } ATTRS - - #ifdef __cplusplus -diff --git a/io_uring/sqpoll.c b/io_uring/sqpoll.c -index cdf8b567cb9443..489e66647e0795 100644 ---- a/io_uring/sqpoll.c -+++ b/io_uring/sqpoll.c -@@ -352,6 +352,7 @@ void io_sqpoll_wait_sq(struct io_ring_ctx *ctx) - __cold int io_sq_offload_create(struct io_ring_ctx *ctx, - struct io_uring_params *p) - { -+ struct task_struct *task_to_put = NULL; - int ret; - - /* Retain compatibility with failing for an invalid attach attempt */ -@@ -432,6 +433,7 @@ __cold int io_sq_offload_create(struct io_ring_ctx *ctx, - } - - sqd->thread = tsk; -+ task_to_put = get_task_struct(tsk); - ret = io_uring_alloc_task_context(tsk, ctx); - wake_up_new_task(tsk); - if (ret) -@@ -442,11 +444,15 @@ __cold int io_sq_offload_create(struct io_ring_ctx *ctx, - goto err; - } - -+ if (task_to_put) -+ put_task_struct(task_to_put); - return 0; - err_sqpoll: - complete(&ctx->sq_data->exited); - err: - io_sq_thread_finish(ctx); -+ if (task_to_put) -+ put_task_struct(task_to_put); - return ret; - } - -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index ecd869ed27670c..220903117c5139 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -5331,6 +5331,9 @@ tracing_cpumask_write(struct file *filp, const char __user *ubuf, - cpumask_var_t tracing_cpumask_new; - int err; - -+ if (count == 0 || count > KMALLOC_MAX_SIZE) -+ return -EINVAL; -+ - if (!zalloc_cpumask_var(&tracing_cpumask_new, GFP_KERNEL)) - return -ENOMEM; - -diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c -index 94cb09d44115ae..508c10414a9343 100644 ---- a/kernel/trace/trace_kprobe.c -+++ b/kernel/trace/trace_kprobe.c -@@ -702,7 +702,7 @@ static int trace_kprobe_module_callback(struct notifier_block *nb, - - static struct notifier_block trace_kprobe_module_nb = { - .notifier_call = trace_kprobe_module_callback, -- .priority = 1 /* Invoked after kprobe module callback */ -+ .priority = 2 /* Invoked after kprobe and jump_label module callback */ - }; - - static int count_symbols(void *data, unsigned long unused) -diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c -index 3babcd5e65e16d..0b6a8bb0642f25 100644 ---- a/net/ceph/osd_client.c -+++ b/net/ceph/osd_client.c -@@ -1173,6 +1173,8 @@ EXPORT_SYMBOL(ceph_osdc_new_request); - - int __ceph_alloc_sparse_ext_map(struct ceph_osd_req_op *op, int cnt) - { -+ WARN_ON(op->op != CEPH_OSD_OP_SPARSE_READ); -+ - op->extent.sparse_ext_cnt = cnt; - op->extent.sparse_ext = kmalloc_array(cnt, - sizeof(*op->extent.sparse_ext), -diff --git a/net/core/filter.c b/net/core/filter.c -index bc52ab3374f3ac..34320ce70096ac 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -3731,13 +3731,22 @@ static const struct bpf_func_proto bpf_skb_adjust_room_proto = { - - static u32 __bpf_skb_min_len(const struct sk_buff *skb) - { -- u32 min_len = skb_network_offset(skb); -+ int offset = skb_network_offset(skb); -+ u32 min_len = 0; - -- if (skb_transport_header_was_set(skb)) -- min_len = skb_transport_offset(skb); -- if (skb->ip_summed == CHECKSUM_PARTIAL) -- min_len = skb_checksum_start_offset(skb) + -- skb->csum_offset + sizeof(__sum16); -+ if (offset > 0) -+ min_len = offset; -+ if (skb_transport_header_was_set(skb)) { -+ offset = skb_transport_offset(skb); -+ if (offset > 0) -+ min_len = offset; -+ } -+ if (skb->ip_summed == CHECKSUM_PARTIAL) { -+ offset = skb_checksum_start_offset(skb) + -+ skb->csum_offset + sizeof(__sum16); -+ if (offset > 0) -+ min_len = offset; -+ } - return min_len; - } - -diff --git a/net/core/skmsg.c b/net/core/skmsg.c -index 846fd672f0e529..902098e221b396 100644 ---- a/net/core/skmsg.c -+++ b/net/core/skmsg.c -@@ -445,8 +445,10 @@ int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg, - if (likely(!peek)) { - sge->offset += copy; - sge->length -= copy; -- if (!msg_rx->skb) -+ if (!msg_rx->skb) { - sk_mem_uncharge(sk, copy); -+ atomic_sub(copy, &sk->sk_rmem_alloc); -+ } - msg_rx->sg.size -= copy; - - if (!sge->length) { -@@ -772,6 +774,8 @@ static void __sk_psock_purge_ingress_msg(struct sk_psock *psock) - - list_for_each_entry_safe(msg, tmp, &psock->ingress_msg, list) { - list_del(&msg->list); -+ if (!msg->skb) -+ atomic_sub(msg->sg.size, &psock->sk->sk_rmem_alloc); - sk_msg_free(psock->sk, msg); - kfree(msg); - } -diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c -index 0a42d73c0850e0..f882054fae5ee1 100644 ---- a/net/ipv4/tcp_bpf.c -+++ b/net/ipv4/tcp_bpf.c -@@ -49,13 +49,14 @@ static int bpf_tcp_ingress(struct sock *sk, struct sk_psock *psock, - sge = sk_msg_elem(msg, i); - size = (apply && apply_bytes < sge->length) ? - apply_bytes : sge->length; -- if (!sk_wmem_schedule(sk, size)) { -+ if (!__sk_rmem_schedule(sk, size, false)) { - if (!copied) - ret = -ENOMEM; - break; - } - - sk_mem_charge(sk, size); -+ atomic_add(size, &sk->sk_rmem_alloc); - sk_msg_xfer(tmp, msg, i, size); - copied += size; - if (sge->length) -@@ -74,7 +75,8 @@ static int bpf_tcp_ingress(struct sock *sk, struct sk_psock *psock, - - if (!ret) { - msg->sg.start = i; -- sk_psock_queue_msg(psock, tmp); -+ if (!sk_psock_queue_msg(psock, tmp)) -+ atomic_sub(copied, &sk->sk_rmem_alloc); - sk_psock_data_ready(sk, psock); - } else { - sk_msg_free(sk, tmp); -diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c -index b3208b068dd809..989ce0fb62919f 100644 ---- a/sound/pci/hda/patch_conexant.c -+++ b/sound/pci/hda/patch_conexant.c -@@ -311,6 +311,7 @@ enum { - CXT_FIXUP_HP_MIC_NO_PRESENCE, - CXT_PINCFG_SWS_JS201D, - CXT_PINCFG_TOP_SPEAKER, -+ CXT_FIXUP_HP_A_U, - }; - - /* for hda_fixup_thinkpad_acpi() */ -@@ -778,6 +779,18 @@ static void cxt_setup_mute_led(struct hda_codec *codec, - } - } - -+static void cxt_setup_gpio_unmute(struct hda_codec *codec, -+ unsigned int gpio_mute_mask) -+{ -+ if (gpio_mute_mask) { -+ // set gpio data to 0. -+ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA, 0); -+ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_MASK, gpio_mute_mask); -+ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DIRECTION, gpio_mute_mask); -+ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_STICKY_MASK, 0); -+ } -+} -+ - static void cxt_fixup_mute_led_gpio(struct hda_codec *codec, - const struct hda_fixup *fix, int action) - { -@@ -792,6 +805,15 @@ static void cxt_fixup_hp_zbook_mute_led(struct hda_codec *codec, - cxt_setup_mute_led(codec, 0x10, 0x20); - } - -+static void cxt_fixup_hp_a_u(struct hda_codec *codec, -+ const struct hda_fixup *fix, int action) -+{ -+ // Init vers in BIOS mute the spk/hp by set gpio high to avoid pop noise, -+ // so need to unmute once by clearing the gpio data when runs into the system. -+ if (action == HDA_FIXUP_ACT_INIT) -+ cxt_setup_gpio_unmute(codec, 0x2); -+} -+ - /* ThinkPad X200 & co with cxt5051 */ - static const struct hda_pintbl cxt_pincfg_lenovo_x200[] = { - { 0x16, 0x042140ff }, /* HP (seq# overridden) */ -@@ -1002,6 +1024,10 @@ static const struct hda_fixup cxt_fixups[] = { - { } - }, - }, -+ [CXT_FIXUP_HP_A_U] = { -+ .type = HDA_FIXUP_FUNC, -+ .v.func = cxt_fixup_hp_a_u, -+ }, - }; - - static const struct hda_quirk cxt5045_fixups[] = { -@@ -1076,6 +1102,7 @@ static const struct hda_quirk cxt5066_fixups[] = { - SND_PCI_QUIRK(0x103c, 0x8457, "HP Z2 G4 mini", CXT_FIXUP_HP_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x103c, 0x8458, "HP Z2 G4 mini premium", CXT_FIXUP_HP_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN), -+ SND_PCI_QUIRK(0x14f1, 0x0252, "MBX-Z60MR100", CXT_FIXUP_HP_A_U), - SND_PCI_QUIRK(0x14f1, 0x0265, "SWS JS201D", CXT_PINCFG_SWS_JS201D), - SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO), - SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410), -@@ -1121,6 +1148,7 @@ static const struct hda_model_fixup cxt5066_fixup_models[] = { - { .id = CXT_PINCFG_LENOVO_NOTEBOOK, .name = "lenovo-20149" }, - { .id = CXT_PINCFG_SWS_JS201D, .name = "sws-js201d" }, - { .id = CXT_PINCFG_TOP_SPEAKER, .name = "sirius-top-speaker" }, -+ { .id = CXT_FIXUP_HP_A_U, .name = "HP-U-support" }, - {} - }; - -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index d61c317b49ead1..29d7eb8c6bec3e 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -10054,6 +10054,13 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x8ca4, "HP ZBook Fury", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x8ca7, "HP ZBook Fury", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x8cf5, "HP ZBook Studio 16", ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED), -+ SND_PCI_QUIRK(0x103c, 0x8d01, "HP ZBook Power 14 G12", ALC285_FIXUP_HP_GPIO_LED), -+ SND_PCI_QUIRK(0x103c, 0x8d84, "HP EliteBook X G1i", ALC285_FIXUP_HP_GPIO_LED), -+ SND_PCI_QUIRK(0x103c, 0x8d91, "HP ZBook Firefly 14 G12", ALC285_FIXUP_HP_GPIO_LED), -+ SND_PCI_QUIRK(0x103c, 0x8d92, "HP ZBook Firefly 16 G12", ALC285_FIXUP_HP_GPIO_LED), -+ SND_PCI_QUIRK(0x103c, 0x8e18, "HP ZBook Firefly 14 G12A", ALC285_FIXUP_HP_GPIO_LED), -+ SND_PCI_QUIRK(0x103c, 0x8e19, "HP ZBook Firefly 14 G12A", ALC285_FIXUP_HP_GPIO_LED), -+ SND_PCI_QUIRK(0x103c, 0x8e1a, "HP ZBook Firefly 14 G12A", ALC285_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), - SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), - SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), -diff --git a/sound/sh/sh_dac_audio.c b/sound/sh/sh_dac_audio.c -index 95ba3abd4e47eb..13fe6a76005ec4 100644 ---- a/sound/sh/sh_dac_audio.c -+++ b/sound/sh/sh_dac_audio.c -@@ -163,7 +163,7 @@ static int snd_sh_dac_pcm_copy(struct snd_pcm_substream *substream, - /* channel is not used (interleaved data) */ - struct snd_sh_dac *chip = snd_pcm_substream_chip(substream); - -- if (copy_from_iter_toio(chip->data_buffer + pos, src, count)) -+ if (copy_from_iter(chip->data_buffer + pos, count, src) != count) - return -EFAULT; - chip->buffer_end = chip->data_buffer + pos + count; - -@@ -182,7 +182,7 @@ static int snd_sh_dac_pcm_silence(struct snd_pcm_substream *substream, - /* channel is not used (interleaved data) */ - struct snd_sh_dac *chip = snd_pcm_substream_chip(substream); - -- memset_io(chip->data_buffer + pos, 0, count); -+ memset(chip->data_buffer + pos, 0, count); - chip->buffer_end = chip->data_buffer + pos + count; - - if (chip->empty) { -@@ -211,7 +211,6 @@ static const struct snd_pcm_ops snd_sh_dac_pcm_ops = { - .pointer = snd_sh_dac_pcm_pointer, - .copy = snd_sh_dac_pcm_copy, - .fill_silence = snd_sh_dac_pcm_silence, -- .mmap = snd_pcm_lib_mmap_iomem, - }; - - static int snd_sh_dac_pcm(struct snd_sh_dac *chip, int device) -diff --git a/tools/include/uapi/linux/stddef.h b/tools/include/uapi/linux/stddef.h -index bb6ea517efb511..c53cde425406b7 100644 ---- a/tools/include/uapi/linux/stddef.h -+++ b/tools/include/uapi/linux/stddef.h -@@ -8,6 +8,13 @@ - #define __always_inline __inline__ - #endif - -+/* Not all C++ standards support type declarations inside an anonymous union */ -+#ifndef __cplusplus -+#define __struct_group_tag(TAG) TAG -+#else -+#define __struct_group_tag(TAG) -+#endif -+ - /** - * __struct_group() - Create a mirrored named and anonyomous struct - * -@@ -20,14 +27,14 @@ - * and size: one anonymous and one named. The former's members can be used - * normally without sub-struct naming, and the latter can be used to - * reason about the start, end, and size of the group of struct members. -- * The named struct can also be explicitly tagged for layer reuse, as well -- * as both having struct attributes appended. -+ * The named struct can also be explicitly tagged for layer reuse (C only), -+ * as well as both having struct attributes appended. - */ - #define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \ - union { \ - struct { MEMBERS } ATTRS; \ -- struct TAG { MEMBERS } ATTRS NAME; \ -- } -+ struct __struct_group_tag(TAG) { MEMBERS } ATTRS NAME; \ -+ } ATTRS - - /** - * __DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.069-070.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.069-070.patch deleted file mode 100644 index 0ccd04cd7a..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.069-070.patch +++ /dev/null @@ -1,12214 +0,0 @@ -diff --git a/Documentation/admin-guide/media/building.rst b/Documentation/admin-guide/media/building.rst -index a0647342991637..7a413ba07f93bb 100644 ---- a/Documentation/admin-guide/media/building.rst -+++ b/Documentation/admin-guide/media/building.rst -@@ -15,7 +15,7 @@ Please notice, however, that, if: - - you should use the main media development tree ``master`` branch: - -- https://git.linuxtv.org/media_tree.git/ -+ https://git.linuxtv.org/media.git/ - - In this case, you may find some useful information at the - `LinuxTv wiki pages `_: -diff --git a/Documentation/admin-guide/media/saa7134.rst b/Documentation/admin-guide/media/saa7134.rst -index 51eae7eb5ab7f4..18d7cbc897db4b 100644 ---- a/Documentation/admin-guide/media/saa7134.rst -+++ b/Documentation/admin-guide/media/saa7134.rst -@@ -67,7 +67,7 @@ Changes / Fixes - Please mail to linux-media AT vger.kernel.org unified diffs against - the linux media git tree: - -- https://git.linuxtv.org/media_tree.git/ -+ https://git.linuxtv.org/media.git/ - - This is done by committing a patch at a clone of the git tree and - submitting the patch using ``git send-email``. Don't forget to -diff --git a/Documentation/arch/arm64/silicon-errata.rst b/Documentation/arch/arm64/silicon-errata.rst -index 3cf806733083c7..8209c7a7c3970e 100644 ---- a/Documentation/arch/arm64/silicon-errata.rst -+++ b/Documentation/arch/arm64/silicon-errata.rst -@@ -244,8 +244,9 @@ stable kernels. - +----------------+-----------------+-----------------+-----------------------------+ - | Hisilicon | Hip08 SMMU PMCG | #162001800 | N/A | - +----------------+-----------------+-----------------+-----------------------------+ --| Hisilicon | Hip08 SMMU PMCG | #162001900 | N/A | --| | Hip09 SMMU PMCG | | | -+| Hisilicon | Hip{08,09,09A,10| #162001900 | N/A | -+| | ,10C,11} | | | -+| | SMMU PMCG | | | - +----------------+-----------------+-----------------+-----------------------------+ - +----------------+-----------------+-----------------+-----------------------------+ - | Qualcomm Tech. | Kryo/Falkor v1 | E1003 | QCOM_FALKOR_ERRATUM_1003 | -diff --git a/Documentation/devicetree/bindings/display/bridge/adi,adv7533.yaml b/Documentation/devicetree/bindings/display/bridge/adi,adv7533.yaml -index 987aa83c264943..e956f524e379dc 100644 ---- a/Documentation/devicetree/bindings/display/bridge/adi,adv7533.yaml -+++ b/Documentation/devicetree/bindings/display/bridge/adi,adv7533.yaml -@@ -87,7 +87,7 @@ properties: - adi,dsi-lanes: - description: Number of DSI data lanes connected to the DSI host. - $ref: /schemas/types.yaml#/definitions/uint32 -- enum: [ 1, 2, 3, 4 ] -+ enum: [ 2, 3, 4 ] - - ports: - description: -diff --git a/Documentation/i2c/busses/i2c-i801.rst b/Documentation/i2c/busses/i2c-i801.rst -index 10eced6c2e4625..47e8ac5b7099f7 100644 ---- a/Documentation/i2c/busses/i2c-i801.rst -+++ b/Documentation/i2c/busses/i2c-i801.rst -@@ -48,6 +48,8 @@ Supported adapters: - * Intel Raptor Lake (PCH) - * Intel Meteor Lake (SOC and PCH) - * Intel Birch Stream (SOC) -+ * Intel Arrow Lake (SOC) -+ * Intel Panther Lake (SOC) - - Datasheets: Publicly available at the Intel website - -diff --git a/Makefile b/Makefile -index ec4d9d1d9b7ae7..4c0dd62e02e465 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 69 -+SUBLEVEL = 70 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arc/Makefile b/arch/arc/Makefile -index 2390dd042e3636..fb98478ed1ab09 100644 ---- a/arch/arc/Makefile -+++ b/arch/arc/Makefile -@@ -6,7 +6,7 @@ - KBUILD_DEFCONFIG := haps_hs_smp_defconfig - - ifeq ($(CROSS_COMPILE),) --CROSS_COMPILE := $(call cc-cross-prefix, arc-linux- arceb-linux-) -+CROSS_COMPILE := $(call cc-cross-prefix, arc-linux- arceb-linux- arc-linux-gnu-) - endif - - cflags-y += -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__ -diff --git a/arch/loongarch/kernel/numa.c b/arch/loongarch/kernel/numa.c -index 6e65ff12d5c7dc..8fe21f868f72d4 100644 ---- a/arch/loongarch/kernel/numa.c -+++ b/arch/loongarch/kernel/numa.c -@@ -226,32 +226,6 @@ static void __init node_mem_init(unsigned int node) - - #ifdef CONFIG_ACPI_NUMA - --/* -- * Sanity check to catch more bad NUMA configurations (they are amazingly -- * common). Make sure the nodes cover all memory. -- */ --static bool __init numa_meminfo_cover_memory(const struct numa_meminfo *mi) --{ -- int i; -- u64 numaram, biosram; -- -- numaram = 0; -- for (i = 0; i < mi->nr_blks; i++) { -- u64 s = mi->blk[i].start >> PAGE_SHIFT; -- u64 e = mi->blk[i].end >> PAGE_SHIFT; -- -- numaram += e - s; -- numaram -= __absent_pages_in_range(mi->blk[i].nid, s, e); -- if ((s64)numaram < 0) -- numaram = 0; -- } -- max_pfn = max_low_pfn; -- biosram = max_pfn - absent_pages_in_range(0, max_pfn); -- -- BUG_ON((s64)(biosram - numaram) >= (1 << (20 - PAGE_SHIFT))); -- return true; --} -- - static void __init add_node_intersection(u32 node, u64 start, u64 size, u32 type) - { - static unsigned long num_physpages; -@@ -396,7 +370,7 @@ int __init init_numa_memory(void) - return -EINVAL; - - init_node_memblock(); -- if (numa_meminfo_cover_memory(&numa_meminfo) == false) -+ if (!memblock_validate_numa_coverage(SZ_1M)) - return -EINVAL; - - for_each_node_mask(node, node_possible_map) { -diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c -index d43db8150767be..dddf4f31c219ac 100644 ---- a/arch/powerpc/kernel/setup-common.c -+++ b/arch/powerpc/kernel/setup-common.c -@@ -601,7 +601,6 @@ struct seq_buf ppc_hw_desc __initdata = { - .buffer = ppc_hw_desc_buf, - .size = sizeof(ppc_hw_desc_buf), - .len = 0, -- .readpos = 0, - }; - - static __init void probe_machine(void) -diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c -index 1245000a8792fd..2fb7d53cf3338d 100644 ---- a/arch/x86/entry/vsyscall/vsyscall_64.c -+++ b/arch/x86/entry/vsyscall/vsyscall_64.c -@@ -76,7 +76,7 @@ static void warn_bad_vsyscall(const char *level, struct pt_regs *regs, - if (!show_unhandled_signals) - return; - -- printk_ratelimited("%s%s[%d] %s ip:%lx cs:%lx sp:%lx ax:%lx si:%lx di:%lx\n", -+ printk_ratelimited("%s%s[%d] %s ip:%lx cs:%x sp:%lx ax:%lx si:%lx di:%lx\n", - level, current->comm, task_pid_nr(current), - message, regs->ip, regs->cs, - regs->sp, regs->ax, regs->si, regs->di); -diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h -index f4db78b09c8f0b..5a83fbd9bc0b44 100644 ---- a/arch/x86/include/asm/ptrace.h -+++ b/arch/x86/include/asm/ptrace.h -@@ -56,18 +56,64 @@ struct pt_regs { - - #else /* __i386__ */ - -+struct fred_cs { -+ /* CS selector */ -+ u64 cs : 16, -+ /* Stack level at event time */ -+ sl : 2, -+ /* IBT in WAIT_FOR_ENDBRANCH state */ -+ wfe : 1, -+ : 45; -+}; -+ -+struct fred_ss { -+ /* SS selector */ -+ u64 ss : 16, -+ /* STI state */ -+ sti : 1, -+ /* Set if syscall, sysenter or INT n */ -+ swevent : 1, -+ /* Event is NMI type */ -+ nmi : 1, -+ : 13, -+ /* Event vector */ -+ vector : 8, -+ : 8, -+ /* Event type */ -+ type : 4, -+ : 4, -+ /* Event was incident to enclave execution */ -+ enclave : 1, -+ /* CPU was in long mode */ -+ lm : 1, -+ /* -+ * Nested exception during FRED delivery, not set -+ * for #DF. -+ */ -+ nested : 1, -+ : 1, -+ /* -+ * The length of the instruction causing the event. -+ * Only set for INTO, INT1, INT3, INT n, SYSCALL -+ * and SYSENTER. 0 otherwise. -+ */ -+ insnlen : 4; -+}; -+ - struct pt_regs { --/* -- * C ABI says these regs are callee-preserved. They aren't saved on kernel entry -- * unless syscall needs a complete, fully filled "struct pt_regs". -- */ -+ /* -+ * C ABI says these regs are callee-preserved. They aren't saved on -+ * kernel entry unless syscall needs a complete, fully filled -+ * "struct pt_regs". -+ */ - unsigned long r15; - unsigned long r14; - unsigned long r13; - unsigned long r12; - unsigned long bp; - unsigned long bx; --/* These regs are callee-clobbered. Always saved on kernel entry. */ -+ -+ /* These regs are callee-clobbered. Always saved on kernel entry. */ - unsigned long r11; - unsigned long r10; - unsigned long r9; -@@ -77,18 +123,50 @@ struct pt_regs { - unsigned long dx; - unsigned long si; - unsigned long di; --/* -- * On syscall entry, this is syscall#. On CPU exception, this is error code. -- * On hw interrupt, it's IRQ number: -- */ -+ -+ /* -+ * orig_ax is used on entry for: -+ * - the syscall number (syscall, sysenter, int80) -+ * - error_code stored by the CPU on traps and exceptions -+ * - the interrupt number for device interrupts -+ * -+ * A FRED stack frame starts here: -+ * 1) It _always_ includes an error code; -+ * -+ * 2) The return frame for ERET[US] starts here, but -+ * the content of orig_ax is ignored. -+ */ - unsigned long orig_ax; --/* Return frame for iretq */ -+ -+ /* The IRETQ return frame starts here */ - unsigned long ip; -- unsigned long cs; -+ -+ union { -+ /* CS selector */ -+ u16 cs; -+ /* The extended 64-bit data slot containing CS */ -+ u64 csx; -+ /* The FRED CS extension */ -+ struct fred_cs fred_cs; -+ }; -+ - unsigned long flags; - unsigned long sp; -- unsigned long ss; --/* top of stack page */ -+ -+ union { -+ /* SS selector */ -+ u16 ss; -+ /* The extended 64-bit data slot containing SS */ -+ u64 ssx; -+ /* The FRED SS extension */ -+ struct fred_ss fred_ss; -+ }; -+ -+ /* -+ * Top of stack on IDT systems, while FRED systems have extra fields -+ * defined above for storing exception related information, e.g. CR2 or -+ * DR6. -+ */ - }; - - #endif /* !__i386__ */ -diff --git a/arch/x86/include/asm/tlb.h b/arch/x86/include/asm/tlb.h -index 580636cdc257b7..4d3c9d00d6b6b2 100644 ---- a/arch/x86/include/asm/tlb.h -+++ b/arch/x86/include/asm/tlb.h -@@ -34,4 +34,8 @@ static inline void __tlb_remove_table(void *table) - free_page_and_swap_cache(table); - } - -+static inline void invlpg(unsigned long addr) -+{ -+ asm volatile("invlpg (%0)" ::"r" (addr) : "memory"); -+} - #endif /* _ASM_X86_TLB_H */ -diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile -index 3269a0e23d3ab8..15fc9fc3dcf052 100644 ---- a/arch/x86/kernel/Makefile -+++ b/arch/x86/kernel/Makefile -@@ -99,9 +99,9 @@ obj-$(CONFIG_TRACING) += trace.o - obj-$(CONFIG_RETHOOK) += rethook.o - obj-$(CONFIG_CRASH_CORE) += crash_core_$(BITS).o - obj-$(CONFIG_KEXEC_CORE) += machine_kexec_$(BITS).o --obj-$(CONFIG_KEXEC_CORE) += relocate_kernel_$(BITS).o crash.o -+obj-$(CONFIG_KEXEC_CORE) += relocate_kernel_$(BITS).o - obj-$(CONFIG_KEXEC_FILE) += kexec-bzimage64.o --obj-$(CONFIG_CRASH_DUMP) += crash_dump_$(BITS).o -+obj-$(CONFIG_CRASH_DUMP) += crash_dump_$(BITS).o crash.o - obj-y += kprobes/ - obj-$(CONFIG_MODULES) += module.o - obj-$(CONFIG_X86_32) += doublefault_32.o -diff --git a/arch/x86/kernel/cet.c b/arch/x86/kernel/cet.c -index d2c732a34e5d90..303bf74d175b30 100644 ---- a/arch/x86/kernel/cet.c -+++ b/arch/x86/kernel/cet.c -@@ -81,6 +81,34 @@ static void do_user_cp_fault(struct pt_regs *regs, unsigned long error_code) - - static __ro_after_init bool ibt_fatal = true; - -+/* -+ * By definition, all missing-ENDBRANCH #CPs are a result of WFE && !ENDBR. -+ * -+ * For the kernel IBT no ENDBR selftest where #CPs are deliberately triggered, -+ * the WFE state of the interrupted context needs to be cleared to let execution -+ * continue. Otherwise when the CPU resumes from the instruction that just -+ * caused the previous #CP, another missing-ENDBRANCH #CP is raised and the CPU -+ * enters a dead loop. -+ * -+ * This is not a problem with IDT because it doesn't preserve WFE and IRET doesn't -+ * set WFE. But FRED provides space on the entry stack (in an expanded CS area) -+ * to save and restore the WFE state, thus the WFE state is no longer clobbered, -+ * so software must clear it. -+ */ -+static void ibt_clear_fred_wfe(struct pt_regs *regs) -+{ -+ /* -+ * No need to do any FRED checks. -+ * -+ * For IDT event delivery, the high-order 48 bits of CS are pushed -+ * as 0s into the stack, and later IRET ignores these bits. -+ * -+ * For FRED, a test to check if fred_cs.wfe is set would be dropped -+ * by compilers. -+ */ -+ regs->fred_cs.wfe = 0; -+} -+ - static void do_kernel_cp_fault(struct pt_regs *regs, unsigned long error_code) - { - if ((error_code & CP_EC) != CP_ENDBR) { -@@ -90,6 +118,7 @@ static void do_kernel_cp_fault(struct pt_regs *regs, unsigned long error_code) - - if (unlikely(regs->ip == (unsigned long)&ibt_selftest_noendbr)) { - regs->ax = 0; -+ ibt_clear_fred_wfe(regs); - return; - } - -@@ -97,6 +126,7 @@ static void do_kernel_cp_fault(struct pt_regs *regs, unsigned long error_code) - if (!ibt_fatal) { - printk(KERN_DEFAULT CUT_HERE); - __warn(__FILE__, __LINE__, (void *)regs->ip, TAINT_WARN, regs, NULL); -+ ibt_clear_fred_wfe(regs); - return; - } - BUG(); -diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c -index bcb2d640a0cd85..6328cf56e59be2 100644 ---- a/arch/x86/kernel/cpu/mshyperv.c -+++ b/arch/x86/kernel/cpu/mshyperv.c -@@ -209,7 +209,9 @@ static void hv_machine_shutdown(void) - if (kexec_in_progress) - hyperv_cleanup(); - } -+#endif /* CONFIG_KEXEC_CORE */ - -+#ifdef CONFIG_CRASH_DUMP - static void hv_machine_crash_shutdown(struct pt_regs *regs) - { - if (hv_crash_handler) -@@ -221,7 +223,64 @@ static void hv_machine_crash_shutdown(struct pt_regs *regs) - /* Disable the hypercall page when there is only 1 active CPU. */ - hyperv_cleanup(); - } --#endif /* CONFIG_KEXEC_CORE */ -+#endif /* CONFIG_CRASH_DUMP */ -+ -+static u64 hv_ref_counter_at_suspend; -+static void (*old_save_sched_clock_state)(void); -+static void (*old_restore_sched_clock_state)(void); -+ -+/* -+ * Hyper-V clock counter resets during hibernation. Save and restore clock -+ * offset during suspend/resume, while also considering the time passed -+ * before suspend. This is to make sure that sched_clock using hv tsc page -+ * based clocksource, proceeds from where it left off during suspend and -+ * it shows correct time for the timestamps of kernel messages after resume. -+ */ -+static void save_hv_clock_tsc_state(void) -+{ -+ hv_ref_counter_at_suspend = hv_read_reference_counter(); -+} -+ -+static void restore_hv_clock_tsc_state(void) -+{ -+ /* -+ * Adjust the offsets used by hv tsc clocksource to -+ * account for the time spent before hibernation. -+ * adjusted value = reference counter (time) at suspend -+ * - reference counter (time) now. -+ */ -+ hv_adj_sched_clock_offset(hv_ref_counter_at_suspend - hv_read_reference_counter()); -+} -+ -+/* -+ * Functions to override save_sched_clock_state and restore_sched_clock_state -+ * functions of x86_platform. The Hyper-V clock counter is reset during -+ * suspend-resume and the offset used to measure time needs to be -+ * corrected, post resume. -+ */ -+static void hv_save_sched_clock_state(void) -+{ -+ old_save_sched_clock_state(); -+ save_hv_clock_tsc_state(); -+} -+ -+static void hv_restore_sched_clock_state(void) -+{ -+ restore_hv_clock_tsc_state(); -+ old_restore_sched_clock_state(); -+} -+ -+static void __init x86_setup_ops_for_tsc_pg_clock(void) -+{ -+ if (!(ms_hyperv.features & HV_MSR_REFERENCE_TSC_AVAILABLE)) -+ return; -+ -+ old_save_sched_clock_state = x86_platform.save_sched_clock_state; -+ x86_platform.save_sched_clock_state = hv_save_sched_clock_state; -+ -+ old_restore_sched_clock_state = x86_platform.restore_sched_clock_state; -+ x86_platform.restore_sched_clock_state = hv_restore_sched_clock_state; -+} - #endif /* CONFIG_HYPERV */ - - static uint32_t __init ms_hyperv_platform(void) -@@ -493,9 +552,13 @@ static void __init ms_hyperv_init_platform(void) - no_timer_check = 1; - #endif - --#if IS_ENABLED(CONFIG_HYPERV) && defined(CONFIG_KEXEC_CORE) -+#if IS_ENABLED(CONFIG_HYPERV) -+#if defined(CONFIG_KEXEC_CORE) - machine_ops.shutdown = hv_machine_shutdown; -+#endif -+#if defined(CONFIG_CRASH_DUMP) - machine_ops.crash_shutdown = hv_machine_crash_shutdown; -+#endif - #endif - if (ms_hyperv.features & HV_ACCESS_TSC_INVARIANT) { - /* -@@ -572,6 +635,7 @@ static void __init ms_hyperv_init_platform(void) - - /* Register Hyper-V specific clocksource */ - hv_init_clocksource(); -+ x86_setup_ops_for_tsc_pg_clock(); - hv_vtl_init_platform(); - #endif - /* -diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c -index a61c12c0127097..0de509c02d18b9 100644 ---- a/arch/x86/kernel/kexec-bzimage64.c -+++ b/arch/x86/kernel/kexec-bzimage64.c -@@ -263,11 +263,13 @@ setup_boot_parameters(struct kimage *image, struct boot_params *params, - memset(¶ms->hd0_info, 0, sizeof(params->hd0_info)); - memset(¶ms->hd1_info, 0, sizeof(params->hd1_info)); - -+#ifdef CONFIG_CRASH_DUMP - if (image->type == KEXEC_TYPE_CRASH) { - ret = crash_setup_memmap_entries(image, params); - if (ret) - return ret; - } else -+#endif - setup_e820_entries(params); - - nr_e820_entries = params->e820_entries; -@@ -428,12 +430,14 @@ static void *bzImage64_load(struct kimage *image, char *kernel, - return ERR_PTR(-EINVAL); - } - -+#ifdef CONFIG_CRASH_DUMP - /* Allocate and load backup region */ - if (image->type == KEXEC_TYPE_CRASH) { - ret = crash_load_segments(image); - if (ret) - return ERR_PTR(ret); - } -+#endif - - /* - * Load purgatory. For 64bit entry point, purgatory code can be -diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c -index b8ab9ee5896c19..38d88c8b56ec07 100644 ---- a/arch/x86/kernel/kvm.c -+++ b/arch/x86/kernel/kvm.c -@@ -769,7 +769,7 @@ static struct notifier_block kvm_pv_reboot_nb = { - * won't be valid. In cases like kexec, in which you install a new kernel, this - * means a random memory location will be kept being written. - */ --#ifdef CONFIG_KEXEC_CORE -+#ifdef CONFIG_CRASH_DUMP - static void kvm_crash_shutdown(struct pt_regs *regs) - { - kvm_guest_cpu_offline(true); -@@ -852,7 +852,7 @@ static void __init kvm_guest_init(void) - kvm_guest_cpu_init(); - #endif - --#ifdef CONFIG_KEXEC_CORE -+#ifdef CONFIG_CRASH_DUMP - machine_ops.crash_shutdown = kvm_crash_shutdown; - #endif - -diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c -index 2fa12d1dc67602..aaeac2deb85dc6 100644 ---- a/arch/x86/kernel/machine_kexec_64.c -+++ b/arch/x86/kernel/machine_kexec_64.c -@@ -545,6 +545,8 @@ int arch_kimage_file_post_load_cleanup(struct kimage *image) - } - #endif /* CONFIG_KEXEC_FILE */ - -+#ifdef CONFIG_CRASH_DUMP -+ - static int - kexec_mark_range(unsigned long start, unsigned long end, bool protect) - { -@@ -589,6 +591,7 @@ void arch_kexec_unprotect_crashkres(void) - { - kexec_mark_crashkres(false); - } -+#endif - - /* - * During a traditional boot under SME, SME will encrypt the kernel, -diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c -index d595ef7c1de05e..dd19a4db741afd 100644 ---- a/arch/x86/kernel/process_64.c -+++ b/arch/x86/kernel/process_64.c -@@ -117,7 +117,7 @@ void __show_regs(struct pt_regs *regs, enum show_regs_mode mode, - - printk("%sFS: %016lx(%04x) GS:%016lx(%04x) knlGS:%016lx\n", - log_lvl, fs, fsindex, gs, gsindex, shadowgs); -- printk("%sCS: %04lx DS: %04x ES: %04x CR0: %016lx\n", -+ printk("%sCS: %04x DS: %04x ES: %04x CR0: %016lx\n", - log_lvl, regs->cs, ds, es, cr0); - printk("%sCR2: %016lx CR3: %016lx CR4: %016lx\n", - log_lvl, cr2, cr3, cr4); -diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c -index 830425e6d38e2f..f3130f762784a1 100644 ---- a/arch/x86/kernel/reboot.c -+++ b/arch/x86/kernel/reboot.c -@@ -796,7 +796,7 @@ struct machine_ops machine_ops __ro_after_init = { - .emergency_restart = native_machine_emergency_restart, - .restart = native_machine_restart, - .halt = native_machine_halt, --#ifdef CONFIG_KEXEC_CORE -+#ifdef CONFIG_CRASH_DUMP - .crash_shutdown = native_machine_crash_shutdown, - #endif - }; -@@ -826,7 +826,7 @@ void machine_halt(void) - machine_ops.halt(); - } - --#ifdef CONFIG_KEXEC_CORE -+#ifdef CONFIG_CRASH_DUMP - void machine_crash_shutdown(struct pt_regs *regs) - { - machine_ops.crash_shutdown(regs); -diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index eb129277dcdd64..8bcecabd475bdf 100644 ---- a/arch/x86/kernel/setup.c -+++ b/arch/x86/kernel/setup.c -@@ -547,7 +547,7 @@ static void __init reserve_crashkernel(void) - bool high = false; - int ret; - -- if (!IS_ENABLED(CONFIG_KEXEC_CORE)) -+ if (!IS_ENABLED(CONFIG_CRASH_RESERVE)) - return; - - total_mem = memblock_phys_mem_size(); -diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c -index 96a771f9f930a6..52c3823b721191 100644 ---- a/arch/x86/kernel/smp.c -+++ b/arch/x86/kernel/smp.c -@@ -282,7 +282,7 @@ struct smp_ops smp_ops = { - .smp_cpus_done = native_smp_cpus_done, - - .stop_other_cpus = native_stop_other_cpus, --#if defined(CONFIG_KEXEC_CORE) -+#if defined(CONFIG_CRASH_DUMP) - .crash_stop_other_cpus = kdump_nmi_shootdown_cpus, - #endif - .smp_send_reschedule = native_smp_send_reschedule, -diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c -index c7fa5396c0f05c..2c67bfc3cf3204 100644 ---- a/arch/x86/mm/numa.c -+++ b/arch/x86/mm/numa.c -@@ -448,37 +448,6 @@ int __node_distance(int from, int to) - } - EXPORT_SYMBOL(__node_distance); - --/* -- * Sanity check to catch more bad NUMA configurations (they are amazingly -- * common). Make sure the nodes cover all memory. -- */ --static bool __init numa_meminfo_cover_memory(const struct numa_meminfo *mi) --{ -- u64 numaram, e820ram; -- int i; -- -- numaram = 0; -- for (i = 0; i < mi->nr_blks; i++) { -- u64 s = mi->blk[i].start >> PAGE_SHIFT; -- u64 e = mi->blk[i].end >> PAGE_SHIFT; -- numaram += e - s; -- numaram -= __absent_pages_in_range(mi->blk[i].nid, s, e); -- if ((s64)numaram < 0) -- numaram = 0; -- } -- -- e820ram = max_pfn - absent_pages_in_range(0, max_pfn); -- -- /* We seem to lose 3 pages somewhere. Allow 1M of slack. */ -- if ((s64)(e820ram - numaram) >= (1 << (20 - PAGE_SHIFT))) { -- printk(KERN_ERR "NUMA: nodes only cover %LuMB of your %LuMB e820 RAM. Not used.\n", -- (numaram << PAGE_SHIFT) >> 20, -- (e820ram << PAGE_SHIFT) >> 20); -- return false; -- } -- return true; --} -- - /* - * Mark all currently memblock-reserved physical memory (which covers the - * kernel's own memory ranges) as hot-unswappable. -@@ -584,7 +553,8 @@ static int __init numa_register_memblks(struct numa_meminfo *mi) - return -EINVAL; - } - } -- if (!numa_meminfo_cover_memory(mi)) -+ -+ if (!memblock_validate_numa_coverage(SZ_1M)) - return -EINVAL; - - /* Finally register nodes. */ -diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c -index 2fbae48f0b470a..64f594826a2822 100644 ---- a/arch/x86/mm/tlb.c -+++ b/arch/x86/mm/tlb.c -@@ -19,6 +19,7 @@ - #include - #include - #include -+#include - - #include "mm_internal.h" - -@@ -1145,7 +1146,7 @@ STATIC_NOPV void native_flush_tlb_one_user(unsigned long addr) - bool cpu_pcide; - - /* Flush 'addr' from the kernel PCID: */ -- asm volatile("invlpg (%0)" ::"r" (addr) : "memory"); -+ invlpg(addr); - - /* If PTI is off there is no user PCID and nothing to flush. */ - if (!static_cpu_has(X86_FEATURE_PTI)) -diff --git a/arch/x86/xen/enlighten_hvm.c b/arch/x86/xen/enlighten_hvm.c -index 70be57e8f51caa..ade22feee7aeb1 100644 ---- a/arch/x86/xen/enlighten_hvm.c -+++ b/arch/x86/xen/enlighten_hvm.c -@@ -141,7 +141,9 @@ static void xen_hvm_shutdown(void) - if (kexec_in_progress) - xen_reboot(SHUTDOWN_soft_reset); - } -+#endif - -+#ifdef CONFIG_CRASH_DUMP - static void xen_hvm_crash_shutdown(struct pt_regs *regs) - { - native_machine_crash_shutdown(regs); -@@ -229,6 +231,8 @@ static void __init xen_hvm_guest_init(void) - - #ifdef CONFIG_KEXEC_CORE - machine_ops.shutdown = xen_hvm_shutdown; -+#endif -+#ifdef CONFIG_CRASH_DUMP - machine_ops.crash_shutdown = xen_hvm_crash_shutdown; - #endif - } -diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c -index 6b201e64d8abc8..bfd57d07f4b5ee 100644 ---- a/arch/x86/xen/mmu_pv.c -+++ b/arch/x86/xen/mmu_pv.c -@@ -2517,7 +2517,7 @@ int xen_remap_pfn(struct vm_area_struct *vma, unsigned long addr, - } - EXPORT_SYMBOL_GPL(xen_remap_pfn); - --#ifdef CONFIG_KEXEC_CORE -+#ifdef CONFIG_VMCORE_INFO - phys_addr_t paddr_vmcoreinfo_note(void) - { - if (xen_pv_domain()) -diff --git a/crypto/ecc.c b/crypto/ecc.c -index f53fb4d6af992b..21504280aca2e5 100644 ---- a/crypto/ecc.c -+++ b/crypto/ecc.c -@@ -66,6 +66,28 @@ const struct ecc_curve *ecc_get_curve(unsigned int curve_id) - } - EXPORT_SYMBOL(ecc_get_curve); - -+void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes, -+ u64 *out, unsigned int ndigits) -+{ -+ int diff = ndigits - DIV_ROUND_UP(nbytes, sizeof(u64)); -+ unsigned int o = nbytes & 7; -+ __be64 msd = 0; -+ -+ /* diff > 0: not enough input bytes: set most significant digits to 0 */ -+ if (diff > 0) { -+ ndigits -= diff; -+ memset(&out[ndigits - 1], 0, diff * sizeof(u64)); -+ } -+ -+ if (o) { -+ memcpy((u8 *)&msd + sizeof(msd) - o, in, o); -+ out[--ndigits] = be64_to_cpu(msd); -+ in += o; -+ } -+ ecc_swap_digits(in, out, ndigits); -+} -+EXPORT_SYMBOL(ecc_digits_from_bytes); -+ - static u64 *ecc_alloc_digits_space(unsigned int ndigits) - { - size_t len = ndigits * sizeof(u64); -diff --git a/crypto/ecdsa.c b/crypto/ecdsa.c -index 3f9ec273a121fd..da04df3c8ecf4d 100644 ---- a/crypto/ecdsa.c -+++ b/crypto/ecdsa.c -@@ -35,40 +35,27 @@ struct ecdsa_signature_ctx { - static int ecdsa_get_signature_rs(u64 *dest, size_t hdrlen, unsigned char tag, - const void *value, size_t vlen, unsigned int ndigits) - { -- size_t keylen = ndigits * sizeof(u64); -- ssize_t diff = vlen - keylen; -+ size_t bufsize = ndigits * sizeof(u64); - const char *d = value; -- u8 rs[ECC_MAX_BYTES]; - -- if (!value || !vlen) -+ if (!value || !vlen || vlen > bufsize + 1) - return -EINVAL; - -- /* diff = 0: 'value' has exacly the right size -- * diff > 0: 'value' has too many bytes; one leading zero is allowed that -- * makes the value a positive integer; error on more -- * diff < 0: 'value' is missing leading zeros, which we add -+ /* -+ * vlen may be 1 byte larger than bufsize due to a leading zero byte -+ * (necessary if the most significant bit of the integer is set). - */ -- if (diff > 0) { -+ if (vlen > bufsize) { - /* skip over leading zeros that make 'value' a positive int */ - if (*d == 0) { - vlen -= 1; -- diff--; - d++; -- } -- if (diff) -+ } else { - return -EINVAL; -+ } - } -- if (-diff >= keylen) -- return -EINVAL; -- -- if (diff) { -- /* leading zeros not given in 'value' */ -- memset(rs, 0, -diff); -- } -- -- memcpy(&rs[-diff], d, vlen); - -- ecc_swap_digits((u64 *)rs, dest, ndigits); -+ ecc_digits_from_bytes(d, vlen, dest, ndigits); - - return 0; - } -@@ -138,7 +125,7 @@ static int ecdsa_verify(struct akcipher_request *req) - { - struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req); - struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm); -- size_t keylen = ctx->curve->g.ndigits * sizeof(u64); -+ size_t bufsize = ctx->curve->g.ndigits * sizeof(u64); - struct ecdsa_signature_ctx sig_ctx = { - .curve = ctx->curve, - }; -@@ -165,14 +152,14 @@ static int ecdsa_verify(struct akcipher_request *req) - goto error; - - /* if the hash is shorter then we will add leading zeros to fit to ndigits */ -- diff = keylen - req->dst_len; -+ diff = bufsize - req->dst_len; - if (diff >= 0) { - if (diff) - memset(rawhash, 0, diff); - memcpy(&rawhash[diff], buffer + req->src_len, req->dst_len); - } else if (diff < 0) { - /* given hash is longer, we take the left-most bytes */ -- memcpy(&rawhash, buffer + req->src_len, keylen); -+ memcpy(&rawhash, buffer + req->src_len, bufsize); - } - - ecc_swap_digits((u64 *)rawhash, hash, ctx->curve->g.ndigits); -@@ -222,9 +209,8 @@ static int ecdsa_ecc_ctx_reset(struct ecc_ctx *ctx) - static int ecdsa_set_pub_key(struct crypto_akcipher *tfm, const void *key, unsigned int keylen) - { - struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm); -+ unsigned int digitlen, ndigits; - const unsigned char *d = key; -- const u64 *digits = (const u64 *)&d[1]; -- unsigned int ndigits; - int ret; - - ret = ecdsa_ecc_ctx_reset(ctx); -@@ -238,12 +224,17 @@ static int ecdsa_set_pub_key(struct crypto_akcipher *tfm, const void *key, unsig - return -EINVAL; - - keylen--; -- ndigits = (keylen >> 1) / sizeof(u64); -+ digitlen = keylen >> 1; -+ -+ ndigits = DIV_ROUND_UP(digitlen, sizeof(u64)); - if (ndigits != ctx->curve->g.ndigits) - return -EINVAL; - -- ecc_swap_digits(digits, ctx->pub_key.x, ndigits); -- ecc_swap_digits(&digits[ndigits], ctx->pub_key.y, ndigits); -+ d++; -+ -+ ecc_digits_from_bytes(d, digitlen, ctx->pub_key.x, ndigits); -+ ecc_digits_from_bytes(&d[digitlen], digitlen, ctx->pub_key.y, ndigits); -+ - ret = ecc_is_pubkey_valid_full(ctx->curve, &ctx->pub_key); - - ctx->pub_key_set = ret == 0; -diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c -index 6496ff5a6ba20d..1a31106a14e446 100644 ---- a/drivers/acpi/arm64/iort.c -+++ b/drivers/acpi/arm64/iort.c -@@ -1712,6 +1712,15 @@ static struct acpi_platform_list pmcg_plat_info[] __initdata = { - /* HiSilicon Hip09 Platform */ - {"HISI ", "HIP09 ", 0, ACPI_SIG_IORT, greater_than_or_equal, - "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, -+ {"HISI ", "HIP09A ", 0, ACPI_SIG_IORT, greater_than_or_equal, -+ "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, -+ /* HiSilicon Hip10/11 Platform uses the same SMMU IP with Hip09 */ -+ {"HISI ", "HIP10 ", 0, ACPI_SIG_IORT, greater_than_or_equal, -+ "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, -+ {"HISI ", "HIP10C ", 0, ACPI_SIG_IORT, greater_than_or_equal, -+ "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, -+ {"HISI ", "HIP11 ", 0, ACPI_SIG_IORT, greater_than_or_equal, -+ "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, - { } - }; - -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index fe5e30662017de..c80b5aa7628ae9 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -620,6 +620,9 @@ static const struct usb_device_id quirks_table[] = { - { USB_DEVICE(0x0e8d, 0x0608), .driver_info = BTUSB_MEDIATEK | - BTUSB_WIDEBAND_SPEECH | - BTUSB_VALID_LE_STATES }, -+ { USB_DEVICE(0x13d3, 0x3606), .driver_info = BTUSB_MEDIATEK | -+ BTUSB_WIDEBAND_SPEECH | -+ BTUSB_VALID_LE_STATES }, - - /* MediaTek MT7922A Bluetooth devices */ - { USB_DEVICE(0x0489, 0xe0d8), .driver_info = BTUSB_MEDIATEK | -@@ -658,6 +661,37 @@ static const struct usb_device_id quirks_table[] = { - { USB_DEVICE(0x04ca, 0x3804), .driver_info = BTUSB_MEDIATEK | - BTUSB_WIDEBAND_SPEECH | - BTUSB_VALID_LE_STATES }, -+ { USB_DEVICE(0x35f5, 0x7922), .driver_info = BTUSB_MEDIATEK | -+ BTUSB_WIDEBAND_SPEECH | -+ BTUSB_VALID_LE_STATES }, -+ { USB_DEVICE(0x13d3, 0x3614), .driver_info = BTUSB_MEDIATEK | -+ BTUSB_WIDEBAND_SPEECH | -+ BTUSB_VALID_LE_STATES }, -+ { USB_DEVICE(0x13d3, 0x3615), .driver_info = BTUSB_MEDIATEK | -+ BTUSB_WIDEBAND_SPEECH | -+ BTUSB_VALID_LE_STATES }, -+ { USB_DEVICE(0x04ca, 0x38e4), .driver_info = BTUSB_MEDIATEK | -+ BTUSB_WIDEBAND_SPEECH | -+ BTUSB_VALID_LE_STATES }, -+ { USB_DEVICE(0x13d3, 0x3605), .driver_info = BTUSB_MEDIATEK | -+ BTUSB_WIDEBAND_SPEECH | -+ BTUSB_VALID_LE_STATES }, -+ { USB_DEVICE(0x13d3, 0x3607), .driver_info = BTUSB_MEDIATEK | -+ BTUSB_WIDEBAND_SPEECH | -+ BTUSB_VALID_LE_STATES }, -+ -+ /* Additional MediaTek MT7925 Bluetooth devices */ -+ { USB_DEVICE(0x0489, 0xe111), .driver_info = BTUSB_MEDIATEK | -+ BTUSB_WIDEBAND_SPEECH }, -+ { USB_DEVICE(0x0489, 0xe113), .driver_info = BTUSB_MEDIATEK | -+ BTUSB_WIDEBAND_SPEECH | -+ BTUSB_VALID_LE_STATES }, -+ { USB_DEVICE(0x13d3, 0x3602), .driver_info = BTUSB_MEDIATEK | -+ BTUSB_WIDEBAND_SPEECH | -+ BTUSB_VALID_LE_STATES }, -+ { USB_DEVICE(0x13d3, 0x3603), .driver_info = BTUSB_MEDIATEK | -+ BTUSB_WIDEBAND_SPEECH | -+ BTUSB_VALID_LE_STATES }, - - /* Additional Realtek 8723AE Bluetooth devices */ - { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK }, -@@ -858,6 +892,10 @@ struct btusb_data { - - int (*setup_on_usb)(struct hci_dev *hdev); - -+ int (*suspend)(struct hci_dev *hdev); -+ int (*resume)(struct hci_dev *hdev); -+ int (*disconnect)(struct hci_dev *hdev); -+ - int oob_wake_irq; /* irq for out-of-band wake-on-bt */ - unsigned cmd_timeout_cnt; - -@@ -4609,6 +4647,9 @@ static void btusb_disconnect(struct usb_interface *intf) - if (data->diag) - usb_set_intfdata(data->diag, NULL); - -+ if (data->disconnect) -+ data->disconnect(hdev); -+ - hci_unregister_dev(hdev); - - if (intf == data->intf) { -@@ -4657,6 +4698,9 @@ static int btusb_suspend(struct usb_interface *intf, pm_message_t message) - - cancel_work_sync(&data->work); - -+ if (data->suspend) -+ data->suspend(data->hdev); -+ - btusb_stop_traffic(data); - usb_kill_anchored_urbs(&data->tx_anchor); - -@@ -4760,6 +4804,9 @@ static int btusb_resume(struct usb_interface *intf) - btusb_submit_isoc_urb(hdev, GFP_NOIO); - } - -+ if (data->resume) -+ data->resume(hdev); -+ - spin_lock_irq(&data->txlock); - play_deferred(data); - clear_bit(BTUSB_SUSPENDING, &data->flags); -diff --git a/drivers/clk/qcom/clk-alpha-pll.c b/drivers/clk/qcom/clk-alpha-pll.c -index 8b3e5f84e89a77..ce44dbfd47e275 100644 ---- a/drivers/clk/qcom/clk-alpha-pll.c -+++ b/drivers/clk/qcom/clk-alpha-pll.c -@@ -52,6 +52,7 @@ - #define PLL_CONFIG_CTL(p) ((p)->offset + (p)->regs[PLL_OFF_CONFIG_CTL]) - #define PLL_CONFIG_CTL_U(p) ((p)->offset + (p)->regs[PLL_OFF_CONFIG_CTL_U]) - #define PLL_CONFIG_CTL_U1(p) ((p)->offset + (p)->regs[PLL_OFF_CONFIG_CTL_U1]) -+#define PLL_CONFIG_CTL_U2(p) ((p)->offset + (p)->regs[PLL_OFF_CONFIG_CTL_U2]) - #define PLL_TEST_CTL(p) ((p)->offset + (p)->regs[PLL_OFF_TEST_CTL]) - #define PLL_TEST_CTL_U(p) ((p)->offset + (p)->regs[PLL_OFF_TEST_CTL_U]) - #define PLL_TEST_CTL_U1(p) ((p)->offset + (p)->regs[PLL_OFF_TEST_CTL_U1]) -@@ -227,6 +228,32 @@ const u8 clk_alpha_pll_regs[][PLL_OFF_MAX_REGS] = { - [PLL_OFF_ALPHA_VAL] = 0x24, - [PLL_OFF_ALPHA_VAL_U] = 0x28, - }, -+ [CLK_ALPHA_PLL_TYPE_ZONDA_OLE] = { -+ [PLL_OFF_L_VAL] = 0x04, -+ [PLL_OFF_ALPHA_VAL] = 0x08, -+ [PLL_OFF_USER_CTL] = 0x0c, -+ [PLL_OFF_USER_CTL_U] = 0x10, -+ [PLL_OFF_CONFIG_CTL] = 0x14, -+ [PLL_OFF_CONFIG_CTL_U] = 0x18, -+ [PLL_OFF_CONFIG_CTL_U1] = 0x1c, -+ [PLL_OFF_CONFIG_CTL_U2] = 0x20, -+ [PLL_OFF_TEST_CTL] = 0x24, -+ [PLL_OFF_TEST_CTL_U] = 0x28, -+ [PLL_OFF_TEST_CTL_U1] = 0x2c, -+ [PLL_OFF_OPMODE] = 0x30, -+ [PLL_OFF_STATUS] = 0x3c, -+ }, -+ [CLK_ALPHA_PLL_TYPE_NSS_HUAYRA] = { -+ [PLL_OFF_L_VAL] = 0x04, -+ [PLL_OFF_ALPHA_VAL] = 0x08, -+ [PLL_OFF_TEST_CTL] = 0x0c, -+ [PLL_OFF_TEST_CTL_U] = 0x10, -+ [PLL_OFF_USER_CTL] = 0x14, -+ [PLL_OFF_CONFIG_CTL] = 0x18, -+ [PLL_OFF_CONFIG_CTL_U] = 0x1c, -+ [PLL_OFF_STATUS] = 0x20, -+ }, -+ - }; - EXPORT_SYMBOL_GPL(clk_alpha_pll_regs); - -diff --git a/drivers/clk/qcom/clk-alpha-pll.h b/drivers/clk/qcom/clk-alpha-pll.h -index 3fd0ef41c72c89..52dc5b9b546a15 100644 ---- a/drivers/clk/qcom/clk-alpha-pll.h -+++ b/drivers/clk/qcom/clk-alpha-pll.h -@@ -21,6 +21,7 @@ enum { - CLK_ALPHA_PLL_TYPE_LUCID = CLK_ALPHA_PLL_TYPE_TRION, - CLK_ALPHA_PLL_TYPE_AGERA, - CLK_ALPHA_PLL_TYPE_ZONDA, -+ CLK_ALPHA_PLL_TYPE_ZONDA_OLE, - CLK_ALPHA_PLL_TYPE_LUCID_EVO, - CLK_ALPHA_PLL_TYPE_LUCID_OLE, - CLK_ALPHA_PLL_TYPE_RIVIAN_EVO, -@@ -28,6 +29,7 @@ enum { - CLK_ALPHA_PLL_TYPE_BRAMMO_EVO, - CLK_ALPHA_PLL_TYPE_STROMER, - CLK_ALPHA_PLL_TYPE_STROMER_PLUS, -+ CLK_ALPHA_PLL_TYPE_NSS_HUAYRA, - CLK_ALPHA_PLL_TYPE_MAX, - }; - -@@ -42,6 +44,7 @@ enum { - PLL_OFF_CONFIG_CTL, - PLL_OFF_CONFIG_CTL_U, - PLL_OFF_CONFIG_CTL_U1, -+ PLL_OFF_CONFIG_CTL_U2, - PLL_OFF_TEST_CTL, - PLL_OFF_TEST_CTL_U, - PLL_OFF_TEST_CTL_U1, -@@ -119,6 +122,7 @@ struct alpha_pll_config { - u32 config_ctl_val; - u32 config_ctl_hi_val; - u32 config_ctl_hi1_val; -+ u32 config_ctl_hi2_val; - u32 user_ctl_val; - u32 user_ctl_hi_val; - u32 user_ctl_hi1_val; -@@ -173,6 +177,7 @@ extern const struct clk_ops clk_alpha_pll_postdiv_lucid_5lpe_ops; - - extern const struct clk_ops clk_alpha_pll_zonda_ops; - #define clk_alpha_pll_postdiv_zonda_ops clk_alpha_pll_postdiv_fabia_ops -+#define clk_alpha_pll_zonda_ole_ops clk_alpha_pll_zonda_ops - - extern const struct clk_ops clk_alpha_pll_lucid_evo_ops; - extern const struct clk_ops clk_alpha_pll_reset_lucid_evo_ops; -diff --git a/drivers/clocksource/hyperv_timer.c b/drivers/clocksource/hyperv_timer.c -index 8ff7cd4e20bb11..5eec1457e13967 100644 ---- a/drivers/clocksource/hyperv_timer.c -+++ b/drivers/clocksource/hyperv_timer.c -@@ -27,7 +27,8 @@ - #include - - static struct clock_event_device __percpu *hv_clock_event; --static u64 hv_sched_clock_offset __ro_after_init; -+/* Note: offset can hold negative values after hibernation. */ -+static u64 hv_sched_clock_offset __read_mostly; - - /* - * If false, we're using the old mechanism for stimer0 interrupts -@@ -456,6 +457,17 @@ static void resume_hv_clock_tsc(struct clocksource *arg) - hv_set_register(HV_REGISTER_REFERENCE_TSC, tsc_msr.as_uint64); - } - -+/* -+ * Called during resume from hibernation, from overridden -+ * x86_platform.restore_sched_clock_state routine. This is to adjust offsets -+ * used to calculate time for hv tsc page based sched_clock, to account for -+ * time spent before hibernation. -+ */ -+void hv_adj_sched_clock_offset(u64 offset) -+{ -+ hv_sched_clock_offset -= offset; -+} -+ - #ifdef HAVE_VDSO_CLOCKMODE_HVCLOCK - static int hv_cs_enable(struct clocksource *cs) - { -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c -index 3263b5fa182d20..f99e3b812ee44b 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c -@@ -319,7 +319,7 @@ svm_migrate_copy_to_vram(struct kfd_node *node, struct svm_range *prange, - spage = migrate_pfn_to_page(migrate->src[i]); - if (spage && !is_zone_device_page(spage)) { - src[i] = dma_map_page(dev, spage, 0, PAGE_SIZE, -- DMA_TO_DEVICE); -+ DMA_BIDIRECTIONAL); - r = dma_mapping_error(dev, src[i]); - if (r) { - dev_err(dev, "%s: fail %d dma_map_page\n", -@@ -634,7 +634,7 @@ svm_migrate_copy_to_ram(struct amdgpu_device *adev, struct svm_range *prange, - goto out_oom; - } - -- dst[i] = dma_map_page(dev, dpage, 0, PAGE_SIZE, DMA_FROM_DEVICE); -+ dst[i] = dma_map_page(dev, dpage, 0, PAGE_SIZE, DMA_BIDIRECTIONAL); - r = dma_mapping_error(dev, dst[i]); - if (r) { - dev_err(adev->dev, "%s: fail %d dma_map_page\n", __func__, r); -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -index 9ec9792f115a8a..385a5a75fdf873 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -@@ -1219,10 +1219,6 @@ static bool is_dsc_need_re_compute( - if (dc_link->type != dc_connection_mst_branch) - return false; - -- if (!(dc_link->dpcd_caps.dsc_caps.dsc_basic_caps.fields.dsc_support.DSC_SUPPORT || -- dc_link->dpcd_caps.dsc_caps.dsc_basic_caps.fields.dsc_support.DSC_PASSTHROUGH_SUPPORT)) -- return false; -- - for (i = 0; i < MAX_PIPES; i++) - stream_on_link[i] = NULL; - -@@ -1243,6 +1239,18 @@ static bool is_dsc_need_re_compute( - if (!aconnector) - continue; - -+ /* -+ * Check if cached virtual MST DSC caps are available and DSC is supported -+ * this change takes care of newer MST DSC capable devices that report their -+ * DPCD caps as per specifications in their Virtual DPCD registers. -+ -+ * TODO: implement the check for older MST DSC devices that do not conform to -+ * specifications. -+ */ -+ if (!(aconnector->dc_sink->dsc_caps.dsc_dec_caps.is_dsc_supported || -+ aconnector->dc_link->dpcd_caps.dsc_caps.dsc_basic_caps.fields.dsc_support.DSC_PASSTHROUGH_SUPPORT)) -+ continue; -+ - stream_on_link[new_stream_on_link_num] = aconnector; - new_stream_on_link_num++; - -diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c b/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c -index 61f4a38e7d2bf6..8f786592143b6c 100644 ---- a/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c -+++ b/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c -@@ -153,7 +153,16 @@ static int adv7511_hdmi_hw_params(struct device *dev, void *data, - ADV7511_AUDIO_CFG3_LEN_MASK, len); - regmap_update_bits(adv7511->regmap, ADV7511_REG_I2C_FREQ_ID_CFG, - ADV7511_I2C_FREQ_ID_CFG_RATE_MASK, rate << 4); -- regmap_write(adv7511->regmap, 0x73, 0x1); -+ -+ /* send current Audio infoframe values while updating */ -+ regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE, -+ BIT(5), BIT(5)); -+ -+ regmap_write(adv7511->regmap, ADV7511_REG_AUDIO_INFOFRAME(0), 0x1); -+ -+ /* use Audio infoframe updated info */ -+ regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE, -+ BIT(5), 0); - - return 0; - } -@@ -184,8 +193,9 @@ static int audio_startup(struct device *dev, void *data) - regmap_update_bits(adv7511->regmap, ADV7511_REG_GC(0), - BIT(7) | BIT(6), BIT(7)); - /* use Audio infoframe updated info */ -- regmap_update_bits(adv7511->regmap, ADV7511_REG_GC(1), -+ regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE, - BIT(5), 0); -+ - /* enable SPDIF receiver */ - if (adv7511->audio_source == ADV7511_AUDIO_SOURCE_SPDIF) - regmap_update_bits(adv7511->regmap, ADV7511_REG_AUDIO_CONFIG, -diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c -index ef2b6ce544d0a8..1aa4153b40e0c1 100644 ---- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c -+++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c -@@ -1225,8 +1225,10 @@ static int adv7511_probe(struct i2c_client *i2c) - return ret; - - ret = adv7511_init_regulators(adv7511); -- if (ret) -- return dev_err_probe(dev, ret, "failed to init regulators\n"); -+ if (ret) { -+ dev_err_probe(dev, ret, "failed to init regulators\n"); -+ goto err_of_node_put; -+ } - - /* - * The power down GPIO is optional. If present, toggle it from active to -@@ -1346,6 +1348,8 @@ static int adv7511_probe(struct i2c_client *i2c) - i2c_unregister_device(adv7511->i2c_edid); - uninit_regulators: - adv7511_uninit_regulators(adv7511); -+err_of_node_put: -+ of_node_put(adv7511->host_node); - - return ret; - } -@@ -1354,6 +1358,8 @@ static void adv7511_remove(struct i2c_client *i2c) - { - struct adv7511 *adv7511 = i2c_get_clientdata(i2c); - -+ of_node_put(adv7511->host_node); -+ - adv7511_uninit_regulators(adv7511); - - drm_bridge_remove(&adv7511->bridge); -diff --git a/drivers/gpu/drm/bridge/adv7511/adv7533.c b/drivers/gpu/drm/bridge/adv7511/adv7533.c -index 7e3e56441aedc5..6a4733c7082700 100644 ---- a/drivers/gpu/drm/bridge/adv7511/adv7533.c -+++ b/drivers/gpu/drm/bridge/adv7511/adv7533.c -@@ -175,7 +175,7 @@ int adv7533_parse_dt(struct device_node *np, struct adv7511 *adv) - - of_property_read_u32(np, "adi,dsi-lanes", &num_lanes); - -- if (num_lanes < 1 || num_lanes > 4) -+ if (num_lanes < 2 || num_lanes > 4) - return -EINVAL; - - adv->num_dsi_lanes = num_lanes; -@@ -184,8 +184,6 @@ int adv7533_parse_dt(struct device_node *np, struct adv7511 *adv) - if (!adv->host_node) - return -ENODEV; - -- of_node_put(adv->host_node); -- - adv->use_timing_gen = !of_property_read_bool(np, - "adi,disable-timing-generator"); - -diff --git a/drivers/gpu/drm/i915/gt/intel_rc6.c b/drivers/gpu/drm/i915/gt/intel_rc6.c -index 9e113e9473260a..6e8c182b2559e7 100644 ---- a/drivers/gpu/drm/i915/gt/intel_rc6.c -+++ b/drivers/gpu/drm/i915/gt/intel_rc6.c -@@ -133,7 +133,7 @@ static void gen11_rc6_enable(struct intel_rc6 *rc6) - GEN9_MEDIA_PG_ENABLE | - GEN11_MEDIA_SAMPLER_PG_ENABLE; - -- if (GRAPHICS_VER(gt->i915) >= 12) { -+ if (GRAPHICS_VER(gt->i915) >= 12 && !IS_DG1(gt->i915)) { - for (i = 0; i < I915_MAX_VCS; i++) - if (HAS_ENGINE(gt, _VCS(i))) - pg_enable |= (VDN_HCP_POWERGATE_ENABLE(i) | -diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig -index 97d27e01a6ee27..982007a112c2a0 100644 ---- a/drivers/i2c/busses/Kconfig -+++ b/drivers/i2c/busses/Kconfig -@@ -159,6 +159,8 @@ config I2C_I801 - Raptor Lake (PCH) - Meteor Lake (SOC and PCH) - Birch Stream (SOC) -+ Arrow Lake (SOC) -+ Panther Lake (SOC) - - This driver can also be built as a module. If so, the module - will be called i2c-i801. -diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c -index 2b8bcd121ffa5d..18c04f5e41d9c5 100644 ---- a/drivers/i2c/busses/i2c-i801.c -+++ b/drivers/i2c/busses/i2c-i801.c -@@ -80,6 +80,9 @@ - * Meteor Lake SoC-S (SOC) 0xae22 32 hard yes yes yes - * Meteor Lake PCH-S (PCH) 0x7f23 32 hard yes yes yes - * Birch Stream (SOC) 0x5796 32 hard yes yes yes -+ * Arrow Lake-H (SOC) 0x7722 32 hard yes yes yes -+ * Panther Lake-H (SOC) 0xe322 32 hard yes yes yes -+ * Panther Lake-P (SOC) 0xe422 32 hard yes yes yes - * - * Features supported by this driver: - * Software PEC no -@@ -234,6 +237,7 @@ - #define PCI_DEVICE_ID_INTEL_ALDER_LAKE_M_SMBUS 0x54a3 - #define PCI_DEVICE_ID_INTEL_BIRCH_STREAM_SMBUS 0x5796 - #define PCI_DEVICE_ID_INTEL_BROXTON_SMBUS 0x5ad4 -+#define PCI_DEVICE_ID_INTEL_ARROW_LAKE_H_SMBUS 0x7722 - #define PCI_DEVICE_ID_INTEL_RAPTOR_LAKE_S_SMBUS 0x7a23 - #define PCI_DEVICE_ID_INTEL_ALDER_LAKE_S_SMBUS 0x7aa3 - #define PCI_DEVICE_ID_INTEL_METEOR_LAKE_P_SMBUS 0x7e22 -@@ -256,6 +260,8 @@ - #define PCI_DEVICE_ID_INTEL_CANNONLAKE_H_SMBUS 0xa323 - #define PCI_DEVICE_ID_INTEL_COMETLAKE_V_SMBUS 0xa3a3 - #define PCI_DEVICE_ID_INTEL_METEOR_LAKE_SOC_S_SMBUS 0xae22 -+#define PCI_DEVICE_ID_INTEL_PANTHER_LAKE_H_SMBUS 0xe322 -+#define PCI_DEVICE_ID_INTEL_PANTHER_LAKE_P_SMBUS 0xe422 - - struct i801_mux_config { - char *gpio_chip; -@@ -1046,6 +1052,9 @@ static const struct pci_device_id i801_ids[] = { - { PCI_DEVICE_DATA(INTEL, METEOR_LAKE_SOC_S_SMBUS, FEATURES_ICH5 | FEATURE_TCO_CNL) }, - { PCI_DEVICE_DATA(INTEL, METEOR_LAKE_PCH_S_SMBUS, FEATURES_ICH5 | FEATURE_TCO_CNL) }, - { PCI_DEVICE_DATA(INTEL, BIRCH_STREAM_SMBUS, FEATURES_ICH5 | FEATURE_TCO_CNL) }, -+ { PCI_DEVICE_DATA(INTEL, ARROW_LAKE_H_SMBUS, FEATURES_ICH5 | FEATURE_TCO_CNL) }, -+ { PCI_DEVICE_DATA(INTEL, PANTHER_LAKE_H_SMBUS, FEATURES_ICH5 | FEATURE_TCO_CNL) }, -+ { PCI_DEVICE_DATA(INTEL, PANTHER_LAKE_P_SMBUS, FEATURES_ICH5 | FEATURE_TCO_CNL) }, - { 0, } - }; - -diff --git a/drivers/i2c/busses/i2c-xgene-slimpro.c b/drivers/i2c/busses/i2c-xgene-slimpro.c -index fbc1ffbd2fa7d6..658396c9eeabf9 100644 ---- a/drivers/i2c/busses/i2c-xgene-slimpro.c -+++ b/drivers/i2c/busses/i2c-xgene-slimpro.c -@@ -91,14 +91,6 @@ - - #define SLIMPRO_IIC_MSG_DWORD_COUNT 3 - --/* PCC related defines */ --#define PCC_SIGNATURE 0x50424300 --#define PCC_STS_CMD_COMPLETE BIT(0) --#define PCC_STS_SCI_DOORBELL BIT(1) --#define PCC_STS_ERR BIT(2) --#define PCC_STS_PLAT_NOTIFY BIT(3) --#define PCC_CMD_GENERATE_DB_INT BIT(15) -- - struct slimpro_i2c_dev { - struct i2c_adapter adapter; - struct device *dev; -@@ -160,11 +152,11 @@ static void slimpro_i2c_pcc_rx_cb(struct mbox_client *cl, void *msg) - - /* Check if platform sends interrupt */ - if (!xgene_word_tst_and_clr(&generic_comm_base->status, -- PCC_STS_SCI_DOORBELL)) -+ PCC_STATUS_SCI_DOORBELL)) - return; - - if (xgene_word_tst_and_clr(&generic_comm_base->status, -- PCC_STS_CMD_COMPLETE)) { -+ PCC_STATUS_CMD_COMPLETE)) { - msg = generic_comm_base + 1; - - /* Response message msg[1] contains the return value. */ -@@ -186,10 +178,10 @@ static void slimpro_i2c_pcc_tx_prepare(struct slimpro_i2c_dev *ctx, u32 *msg) - cpu_to_le32(PCC_SIGNATURE | ctx->mbox_idx)); - - WRITE_ONCE(generic_comm_base->command, -- cpu_to_le16(SLIMPRO_MSG_TYPE(msg[0]) | PCC_CMD_GENERATE_DB_INT)); -+ cpu_to_le16(SLIMPRO_MSG_TYPE(msg[0]) | PCC_CMD_GENERATE_DB_INTR)); - - status = le16_to_cpu(READ_ONCE(generic_comm_base->status)); -- status &= ~PCC_STS_CMD_COMPLETE; -+ status &= ~PCC_STATUS_CMD_COMPLETE; - WRITE_ONCE(generic_comm_base->status, cpu_to_le16(status)); - - /* Copy the message to the PCC comm space */ -diff --git a/drivers/iio/adc/ad7192.c b/drivers/iio/adc/ad7192.c -index b64fd365f83fb8..fa6810aa6a4a7a 100644 ---- a/drivers/iio/adc/ad7192.c -+++ b/drivers/iio/adc/ad7192.c -@@ -16,7 +16,9 @@ - #include - #include - #include --#include -+#include -+#include -+#include - - #include - #include -@@ -360,19 +362,19 @@ static inline bool ad7192_valid_external_frequency(u32 freq) - freq <= AD7192_EXT_FREQ_MHZ_MAX); - } - --static int ad7192_of_clock_select(struct ad7192_state *st) -+static int ad7192_clock_select(struct ad7192_state *st) - { -- struct device_node *np = st->sd.spi->dev.of_node; -+ struct device *dev = &st->sd.spi->dev; - unsigned int clock_sel; - - clock_sel = AD7192_CLK_INT; - - /* use internal clock */ - if (!st->mclk) { -- if (of_property_read_bool(np, "adi,int-clock-output-enable")) -+ if (device_property_read_bool(dev, "adi,int-clock-output-enable")) - clock_sel = AD7192_CLK_INT_CO; - } else { -- if (of_property_read_bool(np, "adi,clock-xtal")) -+ if (device_property_read_bool(dev, "adi,clock-xtal")) - clock_sel = AD7192_CLK_EXT_MCLK1_2; - else - clock_sel = AD7192_CLK_EXT_MCLK2; -@@ -381,7 +383,7 @@ static int ad7192_of_clock_select(struct ad7192_state *st) - return clock_sel; - } - --static int ad7192_setup(struct iio_dev *indio_dev, struct device_node *np) -+static int ad7192_setup(struct iio_dev *indio_dev, struct device *dev) - { - struct ad7192_state *st = iio_priv(indio_dev); - bool rej60_en, refin2_en; -@@ -403,7 +405,7 @@ static int ad7192_setup(struct iio_dev *indio_dev, struct device_node *np) - id &= AD7192_ID_MASK; - - if (id != st->chip_info->chip_id) -- dev_warn(&st->sd.spi->dev, "device ID query failed (0x%X != 0x%X)\n", -+ dev_warn(dev, "device ID query failed (0x%X != 0x%X)\n", - id, st->chip_info->chip_id); - - st->mode = AD7192_MODE_SEL(AD7192_MODE_IDLE) | -@@ -412,31 +414,31 @@ static int ad7192_setup(struct iio_dev *indio_dev, struct device_node *np) - - st->conf = AD7192_CONF_GAIN(0); - -- rej60_en = of_property_read_bool(np, "adi,rejection-60-Hz-enable"); -+ rej60_en = device_property_read_bool(dev, "adi,rejection-60-Hz-enable"); - if (rej60_en) - st->mode |= AD7192_MODE_REJ60; - -- refin2_en = of_property_read_bool(np, "adi,refin2-pins-enable"); -+ refin2_en = device_property_read_bool(dev, "adi,refin2-pins-enable"); - if (refin2_en && st->chip_info->chip_id != CHIPID_AD7195) - st->conf |= AD7192_CONF_REFSEL; - - st->conf &= ~AD7192_CONF_CHOP; - st->f_order = AD7192_NO_SYNC_FILTER; - -- buf_en = of_property_read_bool(np, "adi,buffer-enable"); -+ buf_en = device_property_read_bool(dev, "adi,buffer-enable"); - if (buf_en) - st->conf |= AD7192_CONF_BUF; - -- bipolar = of_property_read_bool(np, "bipolar"); -+ bipolar = device_property_read_bool(dev, "bipolar"); - if (!bipolar) - st->conf |= AD7192_CONF_UNIPOLAR; - -- burnout_curr_en = of_property_read_bool(np, -- "adi,burnout-currents-enable"); -+ burnout_curr_en = device_property_read_bool(dev, -+ "adi,burnout-currents-enable"); - if (burnout_curr_en && buf_en) { - st->conf |= AD7192_CONF_BURN; - } else if (burnout_curr_en) { -- dev_warn(&st->sd.spi->dev, -+ dev_warn(dev, - "Can't enable burnout currents: see CHOP or buffer\n"); - } - -@@ -1036,9 +1038,10 @@ static int ad7192_probe(struct spi_device *spi) - } - st->int_vref_mv = ret / 1000; - -- st->chip_info = of_device_get_match_data(&spi->dev); -+ st->chip_info = spi_get_device_match_data(spi); - if (!st->chip_info) -- st->chip_info = (void *)spi_get_device_id(spi)->driver_data; -+ return -ENODEV; -+ - indio_dev->name = st->chip_info->name; - indio_dev->modes = INDIO_DIRECT_MODE; - -@@ -1065,7 +1068,7 @@ static int ad7192_probe(struct spi_device *spi) - if (IS_ERR(st->mclk)) - return PTR_ERR(st->mclk); - -- st->clock_sel = ad7192_of_clock_select(st); -+ st->clock_sel = ad7192_clock_select(st); - - if (st->clock_sel == AD7192_CLK_EXT_MCLK1_2 || - st->clock_sel == AD7192_CLK_EXT_MCLK2) { -@@ -1077,7 +1080,7 @@ static int ad7192_probe(struct spi_device *spi) - } - } - -- ret = ad7192_setup(indio_dev, spi->dev.of_node); -+ ret = ad7192_setup(indio_dev, &spi->dev); - if (ret) - return ret; - -diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c -index e836c9c477f675..c6053e82ecf6f3 100644 ---- a/drivers/infiniband/core/uverbs_cmd.c -+++ b/drivers/infiniband/core/uverbs_cmd.c -@@ -161,7 +161,7 @@ static const void __user *uverbs_request_next_ptr(struct uverbs_req_iter *iter, - { - const void __user *res = iter->cur; - -- if (iter->cur + len > iter->end) -+ if (len > iter->end - iter->cur) - return (void __force __user *)ERR_PTR(-ENOSPC); - iter->cur += len; - return res; -@@ -2009,11 +2009,13 @@ static int ib_uverbs_post_send(struct uverbs_attr_bundle *attrs) - ret = uverbs_request_start(attrs, &iter, &cmd, sizeof(cmd)); - if (ret) - return ret; -- wqes = uverbs_request_next_ptr(&iter, cmd.wqe_size * cmd.wr_count); -+ wqes = uverbs_request_next_ptr(&iter, size_mul(cmd.wqe_size, -+ cmd.wr_count)); - if (IS_ERR(wqes)) - return PTR_ERR(wqes); -- sgls = uverbs_request_next_ptr( -- &iter, cmd.sge_count * sizeof(struct ib_uverbs_sge)); -+ sgls = uverbs_request_next_ptr(&iter, -+ size_mul(cmd.sge_count, -+ sizeof(struct ib_uverbs_sge))); - if (IS_ERR(sgls)) - return PTR_ERR(sgls); - ret = uverbs_request_finish(&iter); -@@ -2199,11 +2201,11 @@ ib_uverbs_unmarshall_recv(struct uverbs_req_iter *iter, u32 wr_count, - if (wqe_size < sizeof(struct ib_uverbs_recv_wr)) - return ERR_PTR(-EINVAL); - -- wqes = uverbs_request_next_ptr(iter, wqe_size * wr_count); -+ wqes = uverbs_request_next_ptr(iter, size_mul(wqe_size, wr_count)); - if (IS_ERR(wqes)) - return ERR_CAST(wqes); -- sgls = uverbs_request_next_ptr( -- iter, sge_count * sizeof(struct ib_uverbs_sge)); -+ sgls = uverbs_request_next_ptr(iter, size_mul(sge_count, -+ sizeof(struct ib_uverbs_sge))); - if (IS_ERR(sgls)) - return ERR_CAST(sgls); - ret = uverbs_request_finish(iter); -diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c -index df589726060144..13c65ec5825687 100644 ---- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c -+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c -@@ -147,7 +147,7 @@ int bnxt_re_query_device(struct ib_device *ibdev, - - ib_attr->vendor_id = rdev->en_dev->pdev->vendor; - ib_attr->vendor_part_id = rdev->en_dev->pdev->device; -- ib_attr->hw_ver = rdev->en_dev->pdev->subsystem_device; -+ ib_attr->hw_ver = rdev->en_dev->pdev->revision; - ib_attr->max_qp = dev_attr->max_qp; - ib_attr->max_qp_wr = dev_attr->max_qp_wqes; - ib_attr->device_cap_flags = -@@ -992,23 +992,22 @@ static int bnxt_re_setup_swqe_size(struct bnxt_re_qp *qp, - align = sizeof(struct sq_send_hdr); - ilsize = ALIGN(init_attr->cap.max_inline_data, align); - -- sq->wqe_size = bnxt_re_get_wqe_size(ilsize, sq->max_sge); -- if (sq->wqe_size > bnxt_re_get_swqe_size(dev_attr->max_qp_sges)) -- return -EINVAL; -- /* For gen p4 and gen p5 backward compatibility mode -- * wqe size is fixed to 128 bytes -+ /* For gen p4 and gen p5 fixed wqe compatibility mode -+ * wqe size is fixed to 128 bytes - ie 6 SGEs - */ -- if (sq->wqe_size < bnxt_re_get_swqe_size(dev_attr->max_qp_sges) && -- qplqp->wqe_mode == BNXT_QPLIB_WQE_MODE_STATIC) -- sq->wqe_size = bnxt_re_get_swqe_size(dev_attr->max_qp_sges); -+ if (qplqp->wqe_mode == BNXT_QPLIB_WQE_MODE_STATIC) { -+ sq->wqe_size = bnxt_re_get_swqe_size(BNXT_STATIC_MAX_SGE); -+ sq->max_sge = BNXT_STATIC_MAX_SGE; -+ } else { -+ sq->wqe_size = bnxt_re_get_wqe_size(ilsize, sq->max_sge); -+ if (sq->wqe_size > bnxt_re_get_swqe_size(dev_attr->max_qp_sges)) -+ return -EINVAL; -+ } - - if (init_attr->cap.max_inline_data) { - qplqp->max_inline_data = sq->wqe_size - - sizeof(struct sq_send_hdr); - init_attr->cap.max_inline_data = qplqp->max_inline_data; -- if (qplqp->wqe_mode == BNXT_QPLIB_WQE_MODE_STATIC) -- sq->max_sge = qplqp->max_inline_data / -- sizeof(struct sq_sge); - } - - return 0; -@@ -1154,6 +1153,7 @@ static struct bnxt_re_qp *bnxt_re_create_shadow_qp - /* Shadow QP SQ depth should be same as QP1 RQ depth */ - qp->qplib_qp.sq.wqe_size = bnxt_re_get_wqe_size(0, 6); - qp->qplib_qp.sq.max_wqe = qp1_qp->rq.max_wqe; -+ qp->qplib_qp.sq.max_sw_wqe = qp1_qp->rq.max_wqe; - qp->qplib_qp.sq.max_sge = 2; - /* Q full delta can be 1 since it is internal QP */ - qp->qplib_qp.sq.q_full_delta = 1; -@@ -1165,6 +1165,7 @@ static struct bnxt_re_qp *bnxt_re_create_shadow_qp - - qp->qplib_qp.rq.wqe_size = bnxt_re_get_rwqe_size(6); - qp->qplib_qp.rq.max_wqe = qp1_qp->rq.max_wqe; -+ qp->qplib_qp.rq.max_sw_wqe = qp1_qp->rq.max_wqe; - qp->qplib_qp.rq.max_sge = qp1_qp->rq.max_sge; - /* Q full delta can be 1 since it is internal QP */ - qp->qplib_qp.rq.q_full_delta = 1; -@@ -1226,6 +1227,7 @@ static int bnxt_re_init_rq_attr(struct bnxt_re_qp *qp, - */ - entries = bnxt_re_init_depth(init_attr->cap.max_recv_wr + 1, uctx); - rq->max_wqe = min_t(u32, entries, dev_attr->max_qp_wqes + 1); -+ rq->max_sw_wqe = rq->max_wqe; - rq->q_full_delta = 0; - rq->sg_info.pgsize = PAGE_SIZE; - rq->sg_info.pgshft = PAGE_SHIFT; -@@ -1285,6 +1287,7 @@ static int bnxt_re_init_sq_attr(struct bnxt_re_qp *qp, - 0 : BNXT_QPLIB_RESERVED_QP_WRS; - entries = bnxt_re_init_depth(entries + diff + 1, uctx); - sq->max_wqe = min_t(u32, entries, dev_attr->max_qp_wqes + diff + 1); -+ sq->max_sw_wqe = bnxt_qplib_get_depth(sq, qplqp->wqe_mode, true); - sq->q_full_delta = diff + 1; - /* - * Reserving one slot for Phantom WQE. Application can -@@ -2055,18 +2058,20 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr, - } - } - -- if (qp_attr_mask & IB_QP_PATH_MTU) { -- qp->qplib_qp.modify_flags |= -- CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU; -- qp->qplib_qp.path_mtu = __from_ib_mtu(qp_attr->path_mtu); -- qp->qplib_qp.mtu = ib_mtu_enum_to_int(qp_attr->path_mtu); -- } else if (qp_attr->qp_state == IB_QPS_RTR) { -- qp->qplib_qp.modify_flags |= -- CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU; -- qp->qplib_qp.path_mtu = -- __from_ib_mtu(iboe_get_mtu(rdev->netdev->mtu)); -- qp->qplib_qp.mtu = -- ib_mtu_enum_to_int(iboe_get_mtu(rdev->netdev->mtu)); -+ if (qp_attr->qp_state == IB_QPS_RTR) { -+ enum ib_mtu qpmtu; -+ -+ qpmtu = iboe_get_mtu(rdev->netdev->mtu); -+ if (qp_attr_mask & IB_QP_PATH_MTU) { -+ if (ib_mtu_enum_to_int(qp_attr->path_mtu) > -+ ib_mtu_enum_to_int(qpmtu)) -+ return -EINVAL; -+ qpmtu = qp_attr->path_mtu; -+ } -+ -+ qp->qplib_qp.modify_flags |= CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU; -+ qp->qplib_qp.path_mtu = __from_ib_mtu(qpmtu); -+ qp->qplib_qp.mtu = ib_mtu_enum_to_int(qpmtu); - } - - if (qp_attr_mask & IB_QP_TIMEOUT) { -@@ -2153,6 +2158,7 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr, - entries = bnxt_re_init_depth(qp_attr->cap.max_recv_wr, uctx); - qp->qplib_qp.rq.max_wqe = - min_t(u32, entries, dev_attr->max_qp_wqes + 1); -+ qp->qplib_qp.rq.max_sw_wqe = qp->qplib_qp.rq.max_wqe; - qp->qplib_qp.rq.q_full_delta = qp->qplib_qp.rq.max_wqe - - qp_attr->cap.max_recv_wr; - qp->qplib_qp.rq.max_sge = qp_attr->cap.max_recv_sge; -@@ -2710,7 +2716,8 @@ static int bnxt_re_post_send_shadow_qp(struct bnxt_re_dev *rdev, - wr = wr->next; - } - bnxt_qplib_post_send_db(&qp->qplib_qp); -- bnxt_ud_qp_hw_stall_workaround(qp); -+ if (!bnxt_qplib_is_chip_gen_p5_p7(qp->rdev->chip_ctx)) -+ bnxt_ud_qp_hw_stall_workaround(qp); - spin_unlock_irqrestore(&qp->sq_lock, flags); - return rc; - } -@@ -2822,7 +2829,8 @@ int bnxt_re_post_send(struct ib_qp *ib_qp, const struct ib_send_wr *wr, - wr = wr->next; - } - bnxt_qplib_post_send_db(&qp->qplib_qp); -- bnxt_ud_qp_hw_stall_workaround(qp); -+ if (!bnxt_qplib_is_chip_gen_p5_p7(qp->rdev->chip_ctx)) -+ bnxt_ud_qp_hw_stall_workaround(qp); - spin_unlock_irqrestore(&qp->sq_lock, flags); - - return rc; -@@ -4167,9 +4175,6 @@ int bnxt_re_alloc_ucontext(struct ib_ucontext *ctx, struct ib_udata *udata) - resp.cqe_sz = sizeof(struct cq_base); - resp.max_cqd = dev_attr->max_cq_wqes; - -- resp.comp_mask |= BNXT_RE_UCNTX_CMASK_HAVE_MODE; -- resp.mode = rdev->chip_ctx->modes.wqe_mode; -- - if (rdev->chip_ctx->modes.db_push) - resp.comp_mask |= BNXT_RE_UCNTX_CMASK_WC_DPI_ENABLED; - -diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c -index 0373d0e9db6329..c7e51cc2ea2687 100644 ---- a/drivers/infiniband/hw/bnxt_re/main.c -+++ b/drivers/infiniband/hw/bnxt_re/main.c -@@ -128,13 +128,13 @@ static void bnxt_re_set_db_offset(struct bnxt_re_dev *rdev) - } - } - --static void bnxt_re_set_drv_mode(struct bnxt_re_dev *rdev, u8 mode) -+static void bnxt_re_set_drv_mode(struct bnxt_re_dev *rdev) - { - struct bnxt_qplib_chip_ctx *cctx; - - cctx = rdev->chip_ctx; -- cctx->modes.wqe_mode = bnxt_qplib_is_chip_gen_p5_p7(rdev->chip_ctx) ? -- mode : BNXT_QPLIB_WQE_MODE_STATIC; -+ cctx->modes.wqe_mode = bnxt_qplib_is_chip_gen_p7(rdev->chip_ctx) ? -+ BNXT_QPLIB_WQE_MODE_VARIABLE : BNXT_QPLIB_WQE_MODE_STATIC; - if (bnxt_re_hwrm_qcaps(rdev)) - dev_err(rdev_to_dev(rdev), - "Failed to query hwrm qcaps\n"); -@@ -155,7 +155,7 @@ static void bnxt_re_destroy_chip_ctx(struct bnxt_re_dev *rdev) - kfree(chip_ctx); - } - --static int bnxt_re_setup_chip_ctx(struct bnxt_re_dev *rdev, u8 wqe_mode) -+static int bnxt_re_setup_chip_ctx(struct bnxt_re_dev *rdev) - { - struct bnxt_qplib_chip_ctx *chip_ctx; - struct bnxt_en_dev *en_dev; -@@ -177,7 +177,7 @@ static int bnxt_re_setup_chip_ctx(struct bnxt_re_dev *rdev, u8 wqe_mode) - rdev->qplib_res.dattr = &rdev->dev_attr; - rdev->qplib_res.is_vf = BNXT_EN_VF(en_dev); - -- bnxt_re_set_drv_mode(rdev, wqe_mode); -+ bnxt_re_set_drv_mode(rdev); - - bnxt_re_set_db_offset(rdev); - rc = bnxt_qplib_map_db_bar(&rdev->qplib_res); -@@ -1440,7 +1440,7 @@ static void bnxt_re_worker(struct work_struct *work) - schedule_delayed_work(&rdev->worker, msecs_to_jiffies(30000)); - } - --static int bnxt_re_dev_init(struct bnxt_re_dev *rdev, u8 wqe_mode) -+static int bnxt_re_dev_init(struct bnxt_re_dev *rdev) - { - struct bnxt_re_ring_attr rattr = {}; - struct bnxt_qplib_creq_ctx *creq; -@@ -1458,7 +1458,7 @@ static int bnxt_re_dev_init(struct bnxt_re_dev *rdev, u8 wqe_mode) - } - set_bit(BNXT_RE_FLAG_NETDEV_REGISTERED, &rdev->flags); - -- rc = bnxt_re_setup_chip_ctx(rdev, wqe_mode); -+ rc = bnxt_re_setup_chip_ctx(rdev); - if (rc) { - bnxt_unregister_dev(rdev->en_dev); - clear_bit(BNXT_RE_FLAG_NETDEV_REGISTERED, &rdev->flags); -@@ -1609,7 +1609,7 @@ static int bnxt_re_dev_init(struct bnxt_re_dev *rdev, u8 wqe_mode) - return rc; - } - --static int bnxt_re_add_device(struct auxiliary_device *adev, u8 wqe_mode) -+static int bnxt_re_add_device(struct auxiliary_device *adev) - { - struct bnxt_aux_priv *aux_priv = - container_of(adev, struct bnxt_aux_priv, aux_dev); -@@ -1626,7 +1626,7 @@ static int bnxt_re_add_device(struct auxiliary_device *adev, u8 wqe_mode) - goto exit; - } - -- rc = bnxt_re_dev_init(rdev, wqe_mode); -+ rc = bnxt_re_dev_init(rdev); - if (rc) - goto re_dev_dealloc; - -@@ -1756,7 +1756,8 @@ static int bnxt_re_probe(struct auxiliary_device *adev, - int rc; - - mutex_lock(&bnxt_re_mutex); -- rc = bnxt_re_add_device(adev, BNXT_QPLIB_WQE_MODE_STATIC); -+ -+ rc = bnxt_re_add_device(adev); - if (rc) { - mutex_unlock(&bnxt_re_mutex); - return rc; -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c -index b624c255eee6fa..871a49315c880f 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c -+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c -@@ -639,13 +639,6 @@ int bnxt_qplib_create_srq(struct bnxt_qplib_res *res, - rc = bnxt_qplib_alloc_init_hwq(&srq->hwq, &hwq_attr); - if (rc) - return rc; -- -- srq->swq = kcalloc(srq->hwq.max_elements, sizeof(*srq->swq), -- GFP_KERNEL); -- if (!srq->swq) { -- rc = -ENOMEM; -- goto fail; -- } - srq->dbinfo.flags = 0; - bnxt_qplib_rcfw_cmd_prep((struct cmdq_base *)&req, - CMDQ_BASE_OPCODE_CREATE_SRQ, -@@ -674,9 +667,17 @@ int bnxt_qplib_create_srq(struct bnxt_qplib_res *res, - spin_lock_init(&srq->lock); - srq->start_idx = 0; - srq->last_idx = srq->hwq.max_elements - 1; -- for (idx = 0; idx < srq->hwq.max_elements; idx++) -- srq->swq[idx].next_idx = idx + 1; -- srq->swq[srq->last_idx].next_idx = -1; -+ if (!srq->hwq.is_user) { -+ srq->swq = kcalloc(srq->hwq.max_elements, sizeof(*srq->swq), -+ GFP_KERNEL); -+ if (!srq->swq) { -+ rc = -ENOMEM; -+ goto fail; -+ } -+ for (idx = 0; idx < srq->hwq.max_elements; idx++) -+ srq->swq[idx].next_idx = idx + 1; -+ srq->swq[srq->last_idx].next_idx = -1; -+ } - - srq->id = le32_to_cpu(resp.xid); - srq->dbinfo.hwq = &srq->hwq; -@@ -806,13 +807,13 @@ static int bnxt_qplib_alloc_init_swq(struct bnxt_qplib_q *que) - { - int indx; - -- que->swq = kcalloc(que->max_wqe, sizeof(*que->swq), GFP_KERNEL); -+ que->swq = kcalloc(que->max_sw_wqe, sizeof(*que->swq), GFP_KERNEL); - if (!que->swq) - return -ENOMEM; - - que->swq_start = 0; -- que->swq_last = que->max_wqe - 1; -- for (indx = 0; indx < que->max_wqe; indx++) -+ que->swq_last = que->max_sw_wqe - 1; -+ for (indx = 0; indx < que->max_sw_wqe; indx++) - que->swq[indx].next_idx = indx + 1; - que->swq[que->swq_last].next_idx = 0; /* Make it circular */ - que->swq_last = 0; -@@ -848,7 +849,7 @@ int bnxt_qplib_create_qp1(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) - hwq_attr.res = res; - hwq_attr.sginfo = &sq->sg_info; - hwq_attr.stride = sizeof(struct sq_sge); -- hwq_attr.depth = bnxt_qplib_get_depth(sq); -+ hwq_attr.depth = bnxt_qplib_get_depth(sq, qp->wqe_mode, false); - hwq_attr.type = HWQ_TYPE_QUEUE; - rc = bnxt_qplib_alloc_init_hwq(&sq->hwq, &hwq_attr); - if (rc) -@@ -876,7 +877,7 @@ int bnxt_qplib_create_qp1(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) - hwq_attr.res = res; - hwq_attr.sginfo = &rq->sg_info; - hwq_attr.stride = sizeof(struct sq_sge); -- hwq_attr.depth = bnxt_qplib_get_depth(rq); -+ hwq_attr.depth = bnxt_qplib_get_depth(rq, qp->wqe_mode, false); - hwq_attr.type = HWQ_TYPE_QUEUE; - rc = bnxt_qplib_alloc_init_hwq(&rq->hwq, &hwq_attr); - if (rc) -@@ -980,9 +981,7 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) - u32 tbl_indx; - u16 nsge; - -- if (res->dattr) -- qp->dev_cap_flags = res->dattr->dev_cap_flags; -- -+ qp->is_host_msn_tbl = _is_host_msn_table(res->dattr->dev_cap_flags2); - sq->dbinfo.flags = 0; - bnxt_qplib_rcfw_cmd_prep((struct cmdq_base *)&req, - CMDQ_BASE_OPCODE_CREATE_QP, -@@ -999,7 +998,7 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) - sizeof(struct sq_psn_search_ext) : - sizeof(struct sq_psn_search); - -- if (BNXT_RE_HW_RETX(qp->dev_cap_flags)) { -+ if (qp->is_host_msn_tbl) { - psn_sz = sizeof(struct sq_msn_search); - qp->msn = 0; - } -@@ -1008,13 +1007,18 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) - hwq_attr.res = res; - hwq_attr.sginfo = &sq->sg_info; - hwq_attr.stride = sizeof(struct sq_sge); -- hwq_attr.depth = bnxt_qplib_get_depth(sq); -+ hwq_attr.depth = bnxt_qplib_get_depth(sq, qp->wqe_mode, true); - hwq_attr.aux_stride = psn_sz; - hwq_attr.aux_depth = psn_sz ? bnxt_qplib_set_sq_size(sq, qp->wqe_mode) - : 0; - /* Update msn tbl size */ -- if (BNXT_RE_HW_RETX(qp->dev_cap_flags) && psn_sz) { -- hwq_attr.aux_depth = roundup_pow_of_two(bnxt_qplib_set_sq_size(sq, qp->wqe_mode)); -+ if (qp->is_host_msn_tbl && psn_sz) { -+ if (qp->wqe_mode == BNXT_QPLIB_WQE_MODE_STATIC) -+ hwq_attr.aux_depth = -+ roundup_pow_of_two(bnxt_qplib_set_sq_size(sq, qp->wqe_mode)); -+ else -+ hwq_attr.aux_depth = -+ roundup_pow_of_two(bnxt_qplib_set_sq_size(sq, qp->wqe_mode)) / 2; - qp->msn_tbl_sz = hwq_attr.aux_depth; - qp->msn = 0; - } -@@ -1024,13 +1028,14 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) - if (rc) - return rc; - -- rc = bnxt_qplib_alloc_init_swq(sq); -- if (rc) -- goto fail_sq; -- -- if (psn_sz) -- bnxt_qplib_init_psn_ptr(qp, psn_sz); -+ if (!sq->hwq.is_user) { -+ rc = bnxt_qplib_alloc_init_swq(sq); -+ if (rc) -+ goto fail_sq; - -+ if (psn_sz) -+ bnxt_qplib_init_psn_ptr(qp, psn_sz); -+ } - req.sq_size = cpu_to_le32(bnxt_qplib_set_sq_size(sq, qp->wqe_mode)); - pbl = &sq->hwq.pbl[PBL_LVL_0]; - req.sq_pbl = cpu_to_le64(pbl->pg_map_arr[0]); -@@ -1049,16 +1054,18 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) - hwq_attr.res = res; - hwq_attr.sginfo = &rq->sg_info; - hwq_attr.stride = sizeof(struct sq_sge); -- hwq_attr.depth = bnxt_qplib_get_depth(rq); -+ hwq_attr.depth = bnxt_qplib_get_depth(rq, qp->wqe_mode, false); - hwq_attr.aux_stride = 0; - hwq_attr.aux_depth = 0; - hwq_attr.type = HWQ_TYPE_QUEUE; - rc = bnxt_qplib_alloc_init_hwq(&rq->hwq, &hwq_attr); - if (rc) - goto sq_swq; -- rc = bnxt_qplib_alloc_init_swq(rq); -- if (rc) -- goto fail_rq; -+ if (!rq->hwq.is_user) { -+ rc = bnxt_qplib_alloc_init_swq(rq); -+ if (rc) -+ goto fail_rq; -+ } - - req.rq_size = cpu_to_le32(rq->max_wqe); - pbl = &rq->hwq.pbl[PBL_LVL_0]; -@@ -1154,9 +1161,11 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) - rq->dbinfo.db = qp->dpi->dbr; - rq->dbinfo.max_slot = bnxt_qplib_set_rq_max_slot(rq->wqe_size); - } -+ spin_lock_bh(&rcfw->tbl_lock); - tbl_indx = map_qp_id_to_tbl_indx(qp->id, rcfw); - rcfw->qp_tbl[tbl_indx].qp_id = qp->id; - rcfw->qp_tbl[tbl_indx].qp_handle = (void *)qp; -+ spin_unlock_bh(&rcfw->tbl_lock); - - return 0; - fail: -@@ -1638,7 +1647,7 @@ static void bnxt_qplib_fill_psn_search(struct bnxt_qplib_qp *qp, - if (!swq->psn_search) - return; - /* Handle MSN differently on cap flags */ -- if (BNXT_RE_HW_RETX(qp->dev_cap_flags)) { -+ if (qp->is_host_msn_tbl) { - bnxt_qplib_fill_msn_search(qp, wqe, swq); - return; - } -@@ -1820,7 +1829,7 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp, - } - - swq = bnxt_qplib_get_swqe(sq, &wqe_idx); -- bnxt_qplib_pull_psn_buff(qp, sq, swq, BNXT_RE_HW_RETX(qp->dev_cap_flags)); -+ bnxt_qplib_pull_psn_buff(qp, sq, swq, qp->is_host_msn_tbl); - - idx = 0; - swq->slot_idx = hwq->prod; -@@ -2010,7 +2019,7 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp, - rc = -EINVAL; - goto done; - } -- if (!BNXT_RE_HW_RETX(qp->dev_cap_flags) || msn_update) { -+ if (!qp->is_host_msn_tbl || msn_update) { - swq->next_psn = sq->psn & BTH_PSN_MASK; - bnxt_qplib_fill_psn_search(qp, wqe, swq); - } -@@ -2491,7 +2500,7 @@ static int bnxt_qplib_cq_process_req(struct bnxt_qplib_cq *cq, - } - sq = &qp->sq; - -- cqe_sq_cons = le16_to_cpu(hwcqe->sq_cons_idx) % sq->max_wqe; -+ cqe_sq_cons = le16_to_cpu(hwcqe->sq_cons_idx) % sq->max_sw_wqe; - if (qp->sq.flushed) { - dev_dbg(&cq->hwq.pdev->dev, - "%s: QP in Flush QP = %p\n", __func__, qp); -@@ -2534,10 +2543,12 @@ static int bnxt_qplib_cq_process_req(struct bnxt_qplib_cq *cq, - bnxt_qplib_add_flush_qp(qp); - } else { - /* Before we complete, do WA 9060 */ -- if (do_wa9060(qp, cq, cq_cons, sq->swq_last, -- cqe_sq_cons)) { -- *lib_qp = qp; -- goto out; -+ if (!bnxt_qplib_is_chip_gen_p5_p7(qp->cctx)) { -+ if (do_wa9060(qp, cq, cq_cons, sq->swq_last, -+ cqe_sq_cons)) { -+ *lib_qp = qp; -+ goto out; -+ } - } - if (swq->flags & SQ_SEND_FLAGS_SIGNAL_COMP) { - cqe->status = CQ_REQ_STATUS_OK; -@@ -2881,7 +2892,7 @@ static int bnxt_qplib_cq_process_terminal(struct bnxt_qplib_cq *cq, - cqe_cons = le16_to_cpu(hwcqe->sq_cons_idx); - if (cqe_cons == 0xFFFF) - goto do_rq; -- cqe_cons %= sq->max_wqe; -+ cqe_cons %= sq->max_sw_wqe; - - if (qp->sq.flushed) { - dev_dbg(&cq->hwq.pdev->dev, -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h -index 5d4c49089a20f4..b5c53e864fbb39 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h -+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h -@@ -113,7 +113,6 @@ struct bnxt_qplib_sge { - u32 size; - }; - --#define BNXT_QPLIB_QP_MAX_SGL 6 - struct bnxt_qplib_swq { - u64 wr_id; - int next_idx; -@@ -153,7 +152,7 @@ struct bnxt_qplib_swqe { - #define BNXT_QPLIB_SWQE_FLAGS_UC_FENCE BIT(2) - #define BNXT_QPLIB_SWQE_FLAGS_SOLICIT_EVENT BIT(3) - #define BNXT_QPLIB_SWQE_FLAGS_INLINE BIT(4) -- struct bnxt_qplib_sge sg_list[BNXT_QPLIB_QP_MAX_SGL]; -+ struct bnxt_qplib_sge sg_list[BNXT_VAR_MAX_SGE]; - int num_sge; - /* Max inline data is 96 bytes */ - u32 inline_len; -@@ -251,6 +250,7 @@ struct bnxt_qplib_q { - struct bnxt_qplib_db_info dbinfo; - struct bnxt_qplib_sg_info sg_info; - u32 max_wqe; -+ u32 max_sw_wqe; - u16 wqe_size; - u16 q_full_delta; - u16 max_sge; -@@ -340,7 +340,7 @@ struct bnxt_qplib_qp { - struct list_head rq_flush; - u32 msn; - u32 msn_tbl_sz; -- u16 dev_cap_flags; -+ bool is_host_msn_tbl; - }; - - #define BNXT_QPLIB_MAX_CQE_ENTRY_SIZE sizeof(struct cq_base) -@@ -585,15 +585,22 @@ static inline void bnxt_qplib_swq_mod_start(struct bnxt_qplib_q *que, u32 idx) - que->swq_start = que->swq[idx].next_idx; - } - --static inline u32 bnxt_qplib_get_depth(struct bnxt_qplib_q *que) -+static inline u32 bnxt_qplib_get_depth(struct bnxt_qplib_q *que, u8 wqe_mode, bool is_sq) - { -- return (que->wqe_size * que->max_wqe) / sizeof(struct sq_sge); -+ u32 slots; -+ -+ /* Queue depth is the number of slots. */ -+ slots = (que->wqe_size * que->max_wqe) / sizeof(struct sq_sge); -+ /* For variable WQE mode, need to align the slots to 256 */ -+ if (wqe_mode == BNXT_QPLIB_WQE_MODE_VARIABLE && is_sq) -+ slots = ALIGN(slots, BNXT_VAR_MAX_SLOT_ALIGN); -+ return slots; - } - - static inline u32 bnxt_qplib_set_sq_size(struct bnxt_qplib_q *que, u8 wqe_mode) - { - return (wqe_mode == BNXT_QPLIB_WQE_MODE_STATIC) ? -- que->max_wqe : bnxt_qplib_get_depth(que); -+ que->max_wqe : bnxt_qplib_get_depth(que, wqe_mode, true); - } - - static inline u32 bnxt_qplib_set_sq_max_slot(u8 wqe_mode) -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.h b/drivers/infiniband/hw/bnxt_re/qplib_res.h -index f9e7aa3757cfb2..c2152122a4329d 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_res.h -+++ b/drivers/infiniband/hw/bnxt_re/qplib_res.h -@@ -523,6 +523,12 @@ static inline bool _is_hw_retx_supported(u16 dev_cap_flags) - - #define BNXT_RE_HW_RETX(a) _is_hw_retx_supported((a)) - -+static inline bool _is_host_msn_table(u16 dev_cap_ext_flags2) -+{ -+ return (dev_cap_ext_flags2 & CREQ_QUERY_FUNC_RESP_SB_REQ_RETRANSMISSION_SUPPORT_MASK) == -+ CREQ_QUERY_FUNC_RESP_SB_REQ_RETRANSMISSION_SUPPORT_HOST_MSN_TABLE; -+} -+ - static inline u8 bnxt_qplib_dbr_pacing_en(struct bnxt_qplib_chip_ctx *cctx) - { - return cctx->modes.dbr_pacing; -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c -index 0b98577cd7082e..74c3f6b26c4d3a 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c -+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c -@@ -95,11 +95,13 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw, - struct bnxt_qplib_cmdqmsg msg = {}; - struct creq_query_func_resp_sb *sb; - struct bnxt_qplib_rcfw_sbuf sbuf; -+ struct bnxt_qplib_chip_ctx *cctx; - struct cmdq_query_func req = {}; - u8 *tqm_alloc; - int i, rc; - u32 temp; - -+ cctx = rcfw->res->cctx; - bnxt_qplib_rcfw_cmd_prep((struct cmdq_base *)&req, - CMDQ_BASE_OPCODE_QUERY_FUNC, - sizeof(req)); -@@ -127,14 +129,21 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw, - attr->max_qp_init_rd_atom = - sb->max_qp_init_rd_atom > BNXT_QPLIB_MAX_OUT_RD_ATOM ? - BNXT_QPLIB_MAX_OUT_RD_ATOM : sb->max_qp_init_rd_atom; -- attr->max_qp_wqes = le16_to_cpu(sb->max_qp_wr); -- /* -- * 128 WQEs needs to be reserved for the HW (8916). Prevent -- * reporting the max number -- */ -- attr->max_qp_wqes -= BNXT_QPLIB_RESERVED_QP_WRS + 1; -- attr->max_qp_sges = bnxt_qplib_is_chip_gen_p5_p7(rcfw->res->cctx) ? -- 6 : sb->max_sge; -+ attr->max_qp_wqes = le16_to_cpu(sb->max_qp_wr) - 1; -+ if (!bnxt_qplib_is_chip_gen_p5_p7(rcfw->res->cctx)) { -+ /* -+ * 128 WQEs needs to be reserved for the HW (8916). Prevent -+ * reporting the max number on legacy devices -+ */ -+ attr->max_qp_wqes -= BNXT_QPLIB_RESERVED_QP_WRS + 1; -+ } -+ -+ /* Adjust for max_qp_wqes for variable wqe */ -+ if (cctx->modes.wqe_mode == BNXT_QPLIB_WQE_MODE_VARIABLE) -+ attr->max_qp_wqes = BNXT_VAR_MAX_WQE - 1; -+ -+ attr->max_qp_sges = cctx->modes.wqe_mode == BNXT_QPLIB_WQE_MODE_VARIABLE ? -+ min_t(u32, sb->max_sge_var_wqe, BNXT_VAR_MAX_SGE) : 6; - attr->max_cq = le32_to_cpu(sb->max_cq); - attr->max_cq_wqes = le32_to_cpu(sb->max_cqe); - if (!bnxt_qplib_is_chip_gen_p7(rcfw->res->cctx)) -@@ -165,6 +174,7 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw, - attr->max_sgid = le32_to_cpu(sb->max_gid); - attr->max_sgid = min_t(u32, BNXT_QPLIB_NUM_GIDS_SUPPORTED, 2 * attr->max_sgid); - attr->dev_cap_flags = le16_to_cpu(sb->dev_cap_flags); -+ attr->dev_cap_flags2 = le16_to_cpu(sb->dev_cap_ext_flags_2); - - bnxt_qplib_query_version(rcfw, attr->fw_ver); - -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.h b/drivers/infiniband/hw/bnxt_re/qplib_sp.h -index 755765e68eaab2..aeacd0a9a92cc4 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_sp.h -+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.h -@@ -40,6 +40,7 @@ - #ifndef __BNXT_QPLIB_SP_H__ - #define __BNXT_QPLIB_SP_H__ - -+#include - #define BNXT_QPLIB_RESERVED_QP_WRS 128 - - struct bnxt_qplib_dev_attr { -@@ -73,6 +74,7 @@ struct bnxt_qplib_dev_attr { - u8 tqm_alloc_reqs[MAX_TQM_ALLOC_REQ]; - bool is_atomic; - u16 dev_cap_flags; -+ u16 dev_cap_flags2; - u32 max_dpi; - }; - -@@ -351,4 +353,11 @@ int bnxt_qplib_qext_stat(struct bnxt_qplib_rcfw *rcfw, u32 fid, - int bnxt_qplib_modify_cc(struct bnxt_qplib_res *res, - struct bnxt_qplib_cc_param *cc_param); - -+#define BNXT_VAR_MAX_WQE 4352 -+#define BNXT_VAR_MAX_SLOT_ALIGN 256 -+#define BNXT_VAR_MAX_SGE 13 -+#define BNXT_RE_MAX_RQ_WQES 65536 -+ -+#define BNXT_STATIC_MAX_SGE 6 -+ - #endif /* __BNXT_QPLIB_SP_H__*/ -diff --git a/drivers/infiniband/hw/bnxt_re/roce_hsi.h b/drivers/infiniband/hw/bnxt_re/roce_hsi.h -index 2909608f4b5de4..cb4e7e19fbaf08 100644 ---- a/drivers/infiniband/hw/bnxt_re/roce_hsi.h -+++ b/drivers/infiniband/hw/bnxt_re/roce_hsi.h -@@ -2157,8 +2157,36 @@ struct creq_query_func_resp_sb { - __le32 tqm_alloc_reqs[12]; - __le32 max_dpi; - u8 max_sge_var_wqe; -- u8 reserved_8; -+ u8 dev_cap_ext_flags; -+ #define CREQ_QUERY_FUNC_RESP_SB_ATOMIC_OPS_NOT_SUPPORTED 0x1UL -+ #define CREQ_QUERY_FUNC_RESP_SB_DRV_VERSION_RGTR_SUPPORTED 0x2UL -+ #define CREQ_QUERY_FUNC_RESP_SB_CREATE_QP_BATCH_SUPPORTED 0x4UL -+ #define CREQ_QUERY_FUNC_RESP_SB_DESTROY_QP_BATCH_SUPPORTED 0x8UL -+ #define CREQ_QUERY_FUNC_RESP_SB_ROCE_STATS_EXT_CTX_SUPPORTED 0x10UL -+ #define CREQ_QUERY_FUNC_RESP_SB_CREATE_SRQ_SGE_SUPPORTED 0x20UL -+ #define CREQ_QUERY_FUNC_RESP_SB_FIXED_SIZE_WQE_DISABLED 0x40UL -+ #define CREQ_QUERY_FUNC_RESP_SB_DCN_SUPPORTED 0x80UL - __le16 max_inline_data_var_wqe; -+ __le32 start_qid; -+ u8 max_msn_table_size; -+ u8 reserved8_1; -+ __le16 dev_cap_ext_flags_2; -+ #define CREQ_QUERY_FUNC_RESP_SB_OPTIMIZE_MODIFY_QP_SUPPORTED 0x1UL -+ #define CREQ_QUERY_FUNC_RESP_SB_CHANGE_UDP_SRC_PORT_WQE_SUPPORTED 0x2UL -+ #define CREQ_QUERY_FUNC_RESP_SB_CQ_COALESCING_SUPPORTED 0x4UL -+ #define CREQ_QUERY_FUNC_RESP_SB_MEMORY_REGION_RO_SUPPORTED 0x8UL -+ #define CREQ_QUERY_FUNC_RESP_SB_REQ_RETRANSMISSION_SUPPORT_MASK 0x30UL -+ #define CREQ_QUERY_FUNC_RESP_SB_REQ_RETRANSMISSION_SUPPORT_SFT 4 -+ #define CREQ_QUERY_FUNC_RESP_SB_REQ_RETRANSMISSION_SUPPORT_HOST_PSN_TABLE (0x0UL << 4) -+ #define CREQ_QUERY_FUNC_RESP_SB_REQ_RETRANSMISSION_SUPPORT_HOST_MSN_TABLE (0x1UL << 4) -+ #define CREQ_QUERY_FUNC_RESP_SB_REQ_RETRANSMISSION_SUPPORT_IQM_MSN_TABLE (0x2UL << 4) -+ #define CREQ_QUERY_FUNC_RESP_SB_REQ_RETRANSMISSION_SUPPORT_LAST \ -+ CREQ_QUERY_FUNC_RESP_SB_REQ_RETRANSMISSION_SUPPORT_IQM_MSN_TABLE -+ __le16 max_xp_qp_size; -+ __le16 create_qp_batch_size; -+ __le16 destroy_qp_batch_size; -+ __le16 reserved16; -+ __le64 reserved64; - }; - - /* cmdq_set_func_resources (size:448b/56B) */ -diff --git a/drivers/infiniband/hw/hns/hns_roce_alloc.c b/drivers/infiniband/hw/hns/hns_roce_alloc.c -index 11a78ceae56891..950c133d4220e7 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_alloc.c -+++ b/drivers/infiniband/hw/hns/hns_roce_alloc.c -@@ -153,8 +153,7 @@ int hns_roce_get_kmem_bufs(struct hns_roce_dev *hr_dev, dma_addr_t *bufs, - return total; - } - --int hns_roce_get_umem_bufs(struct hns_roce_dev *hr_dev, dma_addr_t *bufs, -- int buf_cnt, struct ib_umem *umem, -+int hns_roce_get_umem_bufs(dma_addr_t *bufs, int buf_cnt, struct ib_umem *umem, - unsigned int page_shift) - { - struct ib_block_iter biter; -diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c -index 9b91731a620795..5e0d78f4e54548 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_cq.c -+++ b/drivers/infiniband/hw/hns/hns_roce_cq.c -@@ -133,14 +133,12 @@ static int alloc_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) - struct hns_roce_cq_table *cq_table = &hr_dev->cq_table; - struct ib_device *ibdev = &hr_dev->ib_dev; - u64 mtts[MTT_MIN_COUNT] = {}; -- dma_addr_t dma_handle; - int ret; - -- ret = hns_roce_mtr_find(hr_dev, &hr_cq->mtr, 0, mtts, ARRAY_SIZE(mtts), -- &dma_handle); -- if (!ret) { -+ ret = hns_roce_mtr_find(hr_dev, &hr_cq->mtr, 0, mtts, ARRAY_SIZE(mtts)); -+ if (ret) { - ibdev_err(ibdev, "failed to find CQ mtr, ret = %d.\n", ret); -- return -EINVAL; -+ return ret; - } - - /* Get CQC memory HEM(Hardware Entry Memory) table */ -@@ -157,7 +155,8 @@ static int alloc_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) - goto err_put; - } - -- ret = hns_roce_create_cqc(hr_dev, hr_cq, mtts, dma_handle); -+ ret = hns_roce_create_cqc(hr_dev, hr_cq, mtts, -+ hns_roce_get_mtr_ba(&hr_cq->mtr)); - if (ret) - goto err_xa; - -diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h -index 21ef00fdb65631..03b6546f63cdc6 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_device.h -+++ b/drivers/infiniband/hw/hns/hns_roce_device.h -@@ -892,8 +892,7 @@ struct hns_roce_hw { - int (*rereg_write_mtpt)(struct hns_roce_dev *hr_dev, - struct hns_roce_mr *mr, int flags, - void *mb_buf); -- int (*frmr_write_mtpt)(struct hns_roce_dev *hr_dev, void *mb_buf, -- struct hns_roce_mr *mr); -+ int (*frmr_write_mtpt)(void *mb_buf, struct hns_roce_mr *mr); - int (*mw_write_mtpt)(void *mb_buf, struct hns_roce_mw *mw); - void (*write_cqc)(struct hns_roce_dev *hr_dev, - struct hns_roce_cq *hr_cq, void *mb_buf, u64 *mtts, -@@ -1129,8 +1128,13 @@ void hns_roce_cmd_use_polling(struct hns_roce_dev *hr_dev); - - /* hns roce hw need current block and next block addr from mtt */ - #define MTT_MIN_COUNT 2 -+static inline dma_addr_t hns_roce_get_mtr_ba(struct hns_roce_mtr *mtr) -+{ -+ return mtr->hem_cfg.root_ba; -+} -+ - int hns_roce_mtr_find(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, -- u32 offset, u64 *mtt_buf, int mtt_max, u64 *base_addr); -+ u32 offset, u64 *mtt_buf, int mtt_max); - int hns_roce_mtr_create(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, - struct hns_roce_buf_attr *buf_attr, - unsigned int page_shift, struct ib_udata *udata, -@@ -1188,7 +1192,7 @@ struct hns_roce_buf *hns_roce_buf_alloc(struct hns_roce_dev *hr_dev, u32 size, - int hns_roce_get_kmem_bufs(struct hns_roce_dev *hr_dev, dma_addr_t *bufs, - int buf_cnt, struct hns_roce_buf *buf, - unsigned int page_shift); --int hns_roce_get_umem_bufs(struct hns_roce_dev *hr_dev, dma_addr_t *bufs, -+int hns_roce_get_umem_bufs(dma_addr_t *bufs, - int buf_cnt, struct ib_umem *umem, - unsigned int page_shift); - -diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c -index 0ab514c49d5e6e..51ab6041ca91bc 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_hem.c -+++ b/drivers/infiniband/hw/hns/hns_roce_hem.c -@@ -986,6 +986,7 @@ struct hns_roce_hem_item { - size_t count; /* max ba numbers */ - int start; /* start buf offset in this hem */ - int end; /* end buf offset in this hem */ -+ bool exist_bt; - }; - - /* All HEM items are linked in a tree structure */ -@@ -1014,6 +1015,7 @@ hem_list_alloc_item(struct hns_roce_dev *hr_dev, int start, int end, int count, - } - } - -+ hem->exist_bt = exist_bt; - hem->count = count; - hem->start = start; - hem->end = end; -@@ -1024,34 +1026,32 @@ hem_list_alloc_item(struct hns_roce_dev *hr_dev, int start, int end, int count, - } - - static void hem_list_free_item(struct hns_roce_dev *hr_dev, -- struct hns_roce_hem_item *hem, bool exist_bt) -+ struct hns_roce_hem_item *hem) - { -- if (exist_bt) -+ if (hem->exist_bt) - dma_free_coherent(hr_dev->dev, hem->count * BA_BYTE_LEN, - hem->addr, hem->dma_addr); - kfree(hem); - } - - static void hem_list_free_all(struct hns_roce_dev *hr_dev, -- struct list_head *head, bool exist_bt) -+ struct list_head *head) - { - struct hns_roce_hem_item *hem, *temp_hem; - - list_for_each_entry_safe(hem, temp_hem, head, list) { - list_del(&hem->list); -- hem_list_free_item(hr_dev, hem, exist_bt); -+ hem_list_free_item(hr_dev, hem); - } - } - --static void hem_list_link_bt(struct hns_roce_dev *hr_dev, void *base_addr, -- u64 table_addr) -+static void hem_list_link_bt(void *base_addr, u64 table_addr) - { - *(u64 *)(base_addr) = table_addr; - } - - /* assign L0 table address to hem from root bt */ --static void hem_list_assign_bt(struct hns_roce_dev *hr_dev, -- struct hns_roce_hem_item *hem, void *cpu_addr, -+static void hem_list_assign_bt(struct hns_roce_hem_item *hem, void *cpu_addr, - u64 phy_addr) - { - hem->addr = cpu_addr; -@@ -1141,6 +1141,10 @@ int hns_roce_hem_list_calc_root_ba(const struct hns_roce_buf_region *regions, - - for (i = 0; i < region_cnt; i++) { - r = (struct hns_roce_buf_region *)®ions[i]; -+ /* when r->hopnum = 0, the region should not occupy root_ba. */ -+ if (!r->hopnum) -+ continue; -+ - if (r->hopnum > 1) { - step = hem_list_calc_ba_range(r->hopnum, 1, unit); - if (step > 0) -@@ -1222,8 +1226,7 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev, - if (level > 1) { - pre = hem_ptrs[level - 1]; - step = (cur->start - pre->start) / step * BA_BYTE_LEN; -- hem_list_link_bt(hr_dev, pre->addr + step, -- cur->dma_addr); -+ hem_list_link_bt(pre->addr + step, cur->dma_addr); - } - } - -@@ -1235,7 +1238,7 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev, - - err_exit: - for (level = 1; level < hopnum; level++) -- hem_list_free_all(hr_dev, &temp_list[level], true); -+ hem_list_free_all(hr_dev, &temp_list[level]); - - return ret; - } -@@ -1276,16 +1279,26 @@ static int alloc_fake_root_bt(struct hns_roce_dev *hr_dev, void *cpu_base, - { - struct hns_roce_hem_item *hem; - -+ /* This is on the has_mtt branch, if r->hopnum -+ * is 0, there is no root_ba to reuse for the -+ * region's fake hem, so a dma_alloc request is -+ * necessary here. -+ */ - hem = hem_list_alloc_item(hr_dev, r->offset, r->offset + r->count - 1, -- r->count, false); -+ r->count, !r->hopnum); - if (!hem) - return -ENOMEM; - -- hem_list_assign_bt(hr_dev, hem, cpu_base, phy_base); -+ /* The root_ba can be reused only when r->hopnum > 0. */ -+ if (r->hopnum) -+ hem_list_assign_bt(hem, cpu_base, phy_base); - list_add(&hem->list, branch_head); - list_add(&hem->sibling, leaf_head); - -- return r->count; -+ /* If r->hopnum == 0, 0 is returned, -+ * so that the root_bt entry is not occupied. -+ */ -+ return r->hopnum ? r->count : 0; - } - - static int setup_middle_bt(struct hns_roce_dev *hr_dev, void *cpu_base, -@@ -1304,7 +1317,7 @@ static int setup_middle_bt(struct hns_roce_dev *hr_dev, void *cpu_base, - /* if exist mid bt, link L1 to L0 */ - list_for_each_entry_safe(hem, temp_hem, branch_head, list) { - offset = (hem->start - r->offset) / step * BA_BYTE_LEN; -- hem_list_link_bt(hr_dev, cpu_base + offset, hem->dma_addr); -+ hem_list_link_bt(cpu_base + offset, hem->dma_addr); - total++; - } - -@@ -1329,7 +1342,7 @@ setup_root_hem(struct hns_roce_dev *hr_dev, struct hns_roce_hem_list *hem_list, - return -ENOMEM; - - total = 0; -- for (i = 0; i < region_cnt && total < max_ba_num; i++) { -+ for (i = 0; i < region_cnt && total <= max_ba_num; i++) { - r = ®ions[i]; - if (!r->count) - continue; -@@ -1395,9 +1408,9 @@ static int hem_list_alloc_root_bt(struct hns_roce_dev *hr_dev, - region_cnt); - if (ret) { - for (i = 0; i < region_cnt; i++) -- hem_list_free_all(hr_dev, &head.branch[i], false); -+ hem_list_free_all(hr_dev, &head.branch[i]); - -- hem_list_free_all(hr_dev, &head.root, true); -+ hem_list_free_all(hr_dev, &head.root); - } - - return ret; -@@ -1460,10 +1473,9 @@ void hns_roce_hem_list_release(struct hns_roce_dev *hr_dev, - - for (i = 0; i < HNS_ROCE_MAX_BT_REGION; i++) - for (j = 0; j < HNS_ROCE_MAX_BT_LEVEL; j++) -- hem_list_free_all(hr_dev, &hem_list->mid_bt[i][j], -- j != 0); -+ hem_list_free_all(hr_dev, &hem_list->mid_bt[i][j]); - -- hem_list_free_all(hr_dev, &hem_list->root_bt, true); -+ hem_list_free_all(hr_dev, &hem_list->root_bt); - INIT_LIST_HEAD(&hem_list->btm_bt); - hem_list->root_ba = 0; - } -diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -index 2824d390ec3161..aded0a7f42838d 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -@@ -471,7 +471,7 @@ static inline int set_ud_wqe(struct hns_roce_qp *qp, - valid_num_sge = calc_wr_sge_num(wr, &msg_len); - - ret = set_ud_opcode(ud_sq_wqe, wr); -- if (WARN_ON(ret)) -+ if (WARN_ON_ONCE(ret)) - return ret; - - ud_sq_wqe->msg_len = cpu_to_le32(msg_len); -@@ -575,7 +575,7 @@ static inline int set_rc_wqe(struct hns_roce_qp *qp, - rc_sq_wqe->msg_len = cpu_to_le32(msg_len); - - ret = set_rc_opcode(hr_dev, rc_sq_wqe, wr); -- if (WARN_ON(ret)) -+ if (WARN_ON_ONCE(ret)) - return ret; - - hr_reg_write(rc_sq_wqe, RC_SEND_WQE_SO, -@@ -673,6 +673,10 @@ static void write_dwqe(struct hns_roce_dev *hr_dev, struct hns_roce_qp *qp, - #define HNS_ROCE_SL_SHIFT 2 - struct hns_roce_v2_rc_send_wqe *rc_sq_wqe = wqe; - -+ if (unlikely(qp->state == IB_QPS_ERR)) { -+ flush_cqe(hr_dev, qp); -+ return; -+ } - /* All kinds of DirectWQE have the same header field layout */ - hr_reg_enable(rc_sq_wqe, RC_SEND_WQE_FLAG); - hr_reg_write(rc_sq_wqe, RC_SEND_WQE_DB_SL_L, qp->sl); -@@ -3181,21 +3185,22 @@ static int set_mtpt_pbl(struct hns_roce_dev *hr_dev, - u64 pages[HNS_ROCE_V2_MAX_INNER_MTPT_NUM] = { 0 }; - struct ib_device *ibdev = &hr_dev->ib_dev; - dma_addr_t pbl_ba; -- int i, count; -+ int ret; -+ int i; - -- count = hns_roce_mtr_find(hr_dev, &mr->pbl_mtr, 0, pages, -- min_t(int, ARRAY_SIZE(pages), mr->npages), -- &pbl_ba); -- if (count < 1) { -- ibdev_err(ibdev, "failed to find PBL mtr, count = %d.\n", -- count); -- return -ENOBUFS; -+ ret = hns_roce_mtr_find(hr_dev, &mr->pbl_mtr, 0, pages, -+ min_t(int, ARRAY_SIZE(pages), mr->npages)); -+ if (ret) { -+ ibdev_err(ibdev, "failed to find PBL mtr, ret = %d.\n", ret); -+ return ret; - } - - /* Aligned to the hardware address access unit */ -- for (i = 0; i < count; i++) -+ for (i = 0; i < ARRAY_SIZE(pages); i++) - pages[i] >>= 6; - -+ pbl_ba = hns_roce_get_mtr_ba(&mr->pbl_mtr); -+ - mpt_entry->pbl_size = cpu_to_le32(mr->npages); - mpt_entry->pbl_ba_l = cpu_to_le32(pbl_ba >> 3); - hr_reg_write(mpt_entry, MPT_PBL_BA_H, upper_32_bits(pbl_ba >> 3)); -@@ -3291,21 +3296,14 @@ static int hns_roce_v2_rereg_write_mtpt(struct hns_roce_dev *hr_dev, - return ret; - } - --static int hns_roce_v2_frmr_write_mtpt(struct hns_roce_dev *hr_dev, -- void *mb_buf, struct hns_roce_mr *mr) -+static int hns_roce_v2_frmr_write_mtpt(void *mb_buf, struct hns_roce_mr *mr) - { -- struct ib_device *ibdev = &hr_dev->ib_dev; -+ dma_addr_t pbl_ba = hns_roce_get_mtr_ba(&mr->pbl_mtr); - struct hns_roce_v2_mpt_entry *mpt_entry; -- dma_addr_t pbl_ba = 0; - - mpt_entry = mb_buf; - memset(mpt_entry, 0, sizeof(*mpt_entry)); - -- if (hns_roce_mtr_find(hr_dev, &mr->pbl_mtr, 0, NULL, 0, &pbl_ba) < 0) { -- ibdev_err(ibdev, "failed to find frmr mtr.\n"); -- return -ENOBUFS; -- } -- - hr_reg_write(mpt_entry, MPT_ST, V2_MPT_ST_FREE); - hr_reg_write(mpt_entry, MPT_PD, mr->pd); - -@@ -4213,8 +4211,7 @@ static void set_access_flags(struct hns_roce_qp *hr_qp, - } - - static void set_qpc_wqe_cnt(struct hns_roce_qp *hr_qp, -- struct hns_roce_v2_qp_context *context, -- struct hns_roce_v2_qp_context *qpc_mask) -+ struct hns_roce_v2_qp_context *context) - { - hr_reg_write(context, QPC_SGE_SHIFT, - to_hr_hem_entries_shift(hr_qp->sge.sge_cnt, -@@ -4236,7 +4233,6 @@ static inline int get_pdn(struct ib_pd *ib_pd) - } - - static void modify_qp_reset_to_init(struct ib_qp *ibqp, -- const struct ib_qp_attr *attr, - struct hns_roce_v2_qp_context *context, - struct hns_roce_v2_qp_context *qpc_mask) - { -@@ -4255,7 +4251,7 @@ static void modify_qp_reset_to_init(struct ib_qp *ibqp, - - hr_reg_write(context, QPC_RQWS, ilog2(hr_qp->rq.max_gs)); - -- set_qpc_wqe_cnt(hr_qp, context, qpc_mask); -+ set_qpc_wqe_cnt(hr_qp, context); - - /* No VLAN need to set 0xFFF */ - hr_reg_write(context, QPC_VLAN_ID, 0xfff); -@@ -4296,7 +4292,6 @@ static void modify_qp_reset_to_init(struct ib_qp *ibqp, - } - - static void modify_qp_init_to_init(struct ib_qp *ibqp, -- const struct ib_qp_attr *attr, - struct hns_roce_v2_qp_context *context, - struct hns_roce_v2_qp_context *qpc_mask) - { -@@ -4333,17 +4328,20 @@ static int config_qp_rq_buf(struct hns_roce_dev *hr_dev, - { - u64 mtts[MTT_MIN_COUNT] = { 0 }; - u64 wqe_sge_ba; -- int count; -+ int ret; - - /* Search qp buf's mtts */ -- count = hns_roce_mtr_find(hr_dev, &hr_qp->mtr, hr_qp->rq.offset, mtts, -- MTT_MIN_COUNT, &wqe_sge_ba); -- if (hr_qp->rq.wqe_cnt && count < 1) { -+ ret = hns_roce_mtr_find(hr_dev, &hr_qp->mtr, hr_qp->rq.offset, mtts, -+ MTT_MIN_COUNT); -+ if (hr_qp->rq.wqe_cnt && ret) { - ibdev_err(&hr_dev->ib_dev, -- "failed to find RQ WQE, QPN = 0x%lx.\n", hr_qp->qpn); -- return -EINVAL; -+ "failed to find QP(0x%lx) RQ WQE buf, ret = %d.\n", -+ hr_qp->qpn, ret); -+ return ret; - } - -+ wqe_sge_ba = hns_roce_get_mtr_ba(&hr_qp->mtr); -+ - context->wqe_sge_ba = cpu_to_le32(wqe_sge_ba >> 3); - qpc_mask->wqe_sge_ba = 0; - -@@ -4407,23 +4405,23 @@ static int config_qp_sq_buf(struct hns_roce_dev *hr_dev, - struct ib_device *ibdev = &hr_dev->ib_dev; - u64 sge_cur_blk = 0; - u64 sq_cur_blk = 0; -- int count; -+ int ret; - - /* search qp buf's mtts */ -- count = hns_roce_mtr_find(hr_dev, &hr_qp->mtr, 0, &sq_cur_blk, 1, NULL); -- if (count < 1) { -- ibdev_err(ibdev, "failed to find QP(0x%lx) SQ buf.\n", -- hr_qp->qpn); -- return -EINVAL; -+ ret = hns_roce_mtr_find(hr_dev, &hr_qp->mtr, hr_qp->sq.offset, -+ &sq_cur_blk, 1); -+ if (ret) { -+ ibdev_err(ibdev, "failed to find QP(0x%lx) SQ WQE buf, ret = %d.\n", -+ hr_qp->qpn, ret); -+ return ret; - } - if (hr_qp->sge.sge_cnt > 0) { -- count = hns_roce_mtr_find(hr_dev, &hr_qp->mtr, -- hr_qp->sge.offset, -- &sge_cur_blk, 1, NULL); -- if (count < 1) { -- ibdev_err(ibdev, "failed to find QP(0x%lx) SGE buf.\n", -- hr_qp->qpn); -- return -EINVAL; -+ ret = hns_roce_mtr_find(hr_dev, &hr_qp->mtr, -+ hr_qp->sge.offset, &sge_cur_blk, 1); -+ if (ret) { -+ ibdev_err(ibdev, "failed to find QP(0x%lx) SGE buf, ret = %d.\n", -+ hr_qp->qpn, ret); -+ return ret; - } - } - -@@ -4614,8 +4612,7 @@ static int modify_qp_init_to_rtr(struct ib_qp *ibqp, - return 0; - } - --static int modify_qp_rtr_to_rts(struct ib_qp *ibqp, -- const struct ib_qp_attr *attr, int attr_mask, -+static int modify_qp_rtr_to_rts(struct ib_qp *ibqp, int attr_mask, - struct hns_roce_v2_qp_context *context, - struct hns_roce_v2_qp_context *qpc_mask) - { -@@ -4984,15 +4981,14 @@ static int hns_roce_v2_set_abs_fields(struct ib_qp *ibqp, - - if (cur_state == IB_QPS_RESET && new_state == IB_QPS_INIT) { - memset(qpc_mask, 0, hr_dev->caps.qpc_sz); -- modify_qp_reset_to_init(ibqp, attr, context, qpc_mask); -+ modify_qp_reset_to_init(ibqp, context, qpc_mask); - } else if (cur_state == IB_QPS_INIT && new_state == IB_QPS_INIT) { -- modify_qp_init_to_init(ibqp, attr, context, qpc_mask); -+ modify_qp_init_to_init(ibqp, context, qpc_mask); - } else if (cur_state == IB_QPS_INIT && new_state == IB_QPS_RTR) { - ret = modify_qp_init_to_rtr(ibqp, attr, attr_mask, context, - qpc_mask, udata); - } else if (cur_state == IB_QPS_RTR && new_state == IB_QPS_RTS) { -- ret = modify_qp_rtr_to_rts(ibqp, attr, attr_mask, context, -- qpc_mask); -+ ret = modify_qp_rtr_to_rts(ibqp, attr_mask, context, qpc_mask); - } - - return ret; -@@ -5550,18 +5546,20 @@ static int hns_roce_v2_write_srqc_index_queue(struct hns_roce_srq *srq, - struct ib_device *ibdev = srq->ibsrq.device; - struct hns_roce_dev *hr_dev = to_hr_dev(ibdev); - u64 mtts_idx[MTT_MIN_COUNT] = {}; -- dma_addr_t dma_handle_idx = 0; -+ dma_addr_t dma_handle_idx; - int ret; - - /* Get physical address of idx que buf */ - ret = hns_roce_mtr_find(hr_dev, &idx_que->mtr, 0, mtts_idx, -- ARRAY_SIZE(mtts_idx), &dma_handle_idx); -- if (ret < 1) { -+ ARRAY_SIZE(mtts_idx)); -+ if (ret) { - ibdev_err(ibdev, "failed to find mtr for SRQ idx, ret = %d.\n", - ret); -- return -ENOBUFS; -+ return ret; - } - -+ dma_handle_idx = hns_roce_get_mtr_ba(&idx_que->mtr); -+ - hr_reg_write(ctx, SRQC_IDX_HOP_NUM, - to_hr_hem_hopnum(hr_dev->caps.idx_hop_num, srq->wqe_cnt)); - -@@ -5593,20 +5591,22 @@ static int hns_roce_v2_write_srqc(struct hns_roce_srq *srq, void *mb_buf) - struct hns_roce_dev *hr_dev = to_hr_dev(ibdev); - struct hns_roce_srq_context *ctx = mb_buf; - u64 mtts_wqe[MTT_MIN_COUNT] = {}; -- dma_addr_t dma_handle_wqe = 0; -+ dma_addr_t dma_handle_wqe; - int ret; - - memset(ctx, 0, sizeof(*ctx)); - - /* Get the physical address of srq buf */ - ret = hns_roce_mtr_find(hr_dev, &srq->buf_mtr, 0, mtts_wqe, -- ARRAY_SIZE(mtts_wqe), &dma_handle_wqe); -- if (ret < 1) { -+ ARRAY_SIZE(mtts_wqe)); -+ if (ret) { - ibdev_err(ibdev, "failed to find mtr for SRQ WQE, ret = %d.\n", - ret); -- return -ENOBUFS; -+ return ret; - } - -+ dma_handle_wqe = hns_roce_get_mtr_ba(&srq->buf_mtr); -+ - hr_reg_write(ctx, SRQC_SRQ_ST, 1); - hr_reg_write_bool(ctx, SRQC_SRQ_TYPE, - srq->ibsrq.srq_type == IB_SRQT_XRC); -@@ -6327,7 +6327,7 @@ static int config_eqc(struct hns_roce_dev *hr_dev, struct hns_roce_eq *eq, - u64 eqe_ba[MTT_MIN_COUNT] = { 0 }; - struct hns_roce_eq_context *eqc; - u64 bt_ba = 0; -- int count; -+ int ret; - - eqc = mb_buf; - memset(eqc, 0, sizeof(struct hns_roce_eq_context)); -@@ -6335,13 +6335,15 @@ static int config_eqc(struct hns_roce_dev *hr_dev, struct hns_roce_eq *eq, - init_eq_config(hr_dev, eq); - - /* if not multi-hop, eqe buffer only use one trunk */ -- count = hns_roce_mtr_find(hr_dev, &eq->mtr, 0, eqe_ba, MTT_MIN_COUNT, -- &bt_ba); -- if (count < 1) { -- dev_err(hr_dev->dev, "failed to find EQE mtr\n"); -- return -ENOBUFS; -+ ret = hns_roce_mtr_find(hr_dev, &eq->mtr, 0, eqe_ba, -+ ARRAY_SIZE(eqe_ba)); -+ if (ret) { -+ dev_err(hr_dev->dev, "failed to find EQE mtr, ret = %d\n", ret); -+ return ret; - } - -+ bt_ba = hns_roce_get_mtr_ba(&eq->mtr); -+ - hr_reg_write(eqc, EQC_EQ_ST, HNS_ROCE_V2_EQ_STATE_VALID); - hr_reg_write(eqc, EQC_EQE_HOP_NUM, eq->hop_num); - hr_reg_write(eqc, EQC_OVER_IGNORE, eq->over_ignore); -diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c -index 7f29a55d378f02..408ef2a9614927 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_mr.c -+++ b/drivers/infiniband/hw/hns/hns_roce_mr.c -@@ -154,7 +154,7 @@ static int hns_roce_mr_enable(struct hns_roce_dev *hr_dev, - if (mr->type != MR_TYPE_FRMR) - ret = hr_dev->hw->write_mtpt(hr_dev, mailbox->buf, mr); - else -- ret = hr_dev->hw->frmr_write_mtpt(hr_dev, mailbox->buf, mr); -+ ret = hr_dev->hw->frmr_write_mtpt(mailbox->buf, mr); - if (ret) { - dev_err(dev, "failed to write mtpt, ret = %d.\n", ret); - goto err_page; -@@ -714,7 +714,7 @@ static int mtr_map_bufs(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, - return -ENOMEM; - - if (mtr->umem) -- npage = hns_roce_get_umem_bufs(hr_dev, pages, page_count, -+ npage = hns_roce_get_umem_bufs(pages, page_count, - mtr->umem, page_shift); - else - npage = hns_roce_get_kmem_bufs(hr_dev, pages, page_count, -@@ -767,11 +767,6 @@ int hns_roce_mtr_map(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, - for (i = 0, mapped_cnt = 0; i < mtr->hem_cfg.region_count && - mapped_cnt < page_cnt; i++) { - r = &mtr->hem_cfg.region[i]; -- /* if hopnum is 0, no need to map pages in this region */ -- if (!r->hopnum) { -- mapped_cnt += r->count; -- continue; -- } - - if (r->offset + r->count > page_cnt) { - ret = -EINVAL; -@@ -802,47 +797,53 @@ int hns_roce_mtr_map(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, - return ret; - } - --int hns_roce_mtr_find(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, -- u32 offset, u64 *mtt_buf, int mtt_max, u64 *base_addr) -+static int hns_roce_get_direct_addr_mtt(struct hns_roce_hem_cfg *cfg, -+ u32 start_index, u64 *mtt_buf, -+ int mtt_cnt) - { -- struct hns_roce_hem_cfg *cfg = &mtr->hem_cfg; -- int mtt_count, left; -- u32 start_index; -+ int mtt_count; - int total = 0; -- __le64 *mtts; - u32 npage; - u64 addr; - -- if (!mtt_buf || mtt_max < 1) -- goto done; -- -- /* no mtt memory in direct mode, so just return the buffer address */ -- if (cfg->is_direct) { -- start_index = offset >> HNS_HW_PAGE_SHIFT; -- for (mtt_count = 0; mtt_count < cfg->region_count && -- total < mtt_max; mtt_count++) { -- npage = cfg->region[mtt_count].offset; -- if (npage < start_index) -- continue; -+ if (mtt_cnt > cfg->region_count) -+ return -EINVAL; - -- addr = cfg->root_ba + (npage << HNS_HW_PAGE_SHIFT); -- mtt_buf[total] = addr; -+ for (mtt_count = 0; mtt_count < cfg->region_count && total < mtt_cnt; -+ mtt_count++) { -+ npage = cfg->region[mtt_count].offset; -+ if (npage < start_index) -+ continue; - -- total++; -- } -+ addr = cfg->root_ba + (npage << HNS_HW_PAGE_SHIFT); -+ mtt_buf[total] = addr; - -- goto done; -+ total++; - } - -- start_index = offset >> cfg->buf_pg_shift; -- left = mtt_max; -+ if (!total) -+ return -ENOENT; -+ -+ return 0; -+} -+ -+static int hns_roce_get_mhop_mtt(struct hns_roce_dev *hr_dev, -+ struct hns_roce_mtr *mtr, u32 start_index, -+ u64 *mtt_buf, int mtt_cnt) -+{ -+ int left = mtt_cnt; -+ int total = 0; -+ int mtt_count; -+ __le64 *mtts; -+ u32 npage; -+ - while (left > 0) { - mtt_count = 0; - mtts = hns_roce_hem_list_find_mtt(hr_dev, &mtr->hem_list, - start_index + total, - &mtt_count); - if (!mtts || !mtt_count) -- goto done; -+ break; - - npage = min(mtt_count, left); - left -= npage; -@@ -850,11 +851,33 @@ int hns_roce_mtr_find(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, - mtt_buf[total++] = le64_to_cpu(mtts[mtt_count]); - } - --done: -- if (base_addr) -- *base_addr = cfg->root_ba; -+ if (!total) -+ return -ENOENT; -+ -+ return 0; -+} - -- return total; -+int hns_roce_mtr_find(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, -+ u32 offset, u64 *mtt_buf, int mtt_max) -+{ -+ struct hns_roce_hem_cfg *cfg = &mtr->hem_cfg; -+ u32 start_index; -+ int ret; -+ -+ if (!mtt_buf || mtt_max < 1) -+ return -EINVAL; -+ -+ /* no mtt memory in direct mode, so just return the buffer address */ -+ if (cfg->is_direct) { -+ start_index = offset >> HNS_HW_PAGE_SHIFT; -+ ret = hns_roce_get_direct_addr_mtt(cfg, start_index, -+ mtt_buf, mtt_max); -+ } else { -+ start_index = offset >> cfg->buf_pg_shift; -+ ret = hns_roce_get_mhop_mtt(hr_dev, mtr, start_index, -+ mtt_buf, mtt_max); -+ } -+ return ret; - } - - static int mtr_init_buf_cfg(struct hns_roce_dev *hr_dev, -diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c -index 88a4777d29f8b8..97d79c8d5cd069 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_qp.c -+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c -@@ -1075,7 +1075,6 @@ static int set_qp_param(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp, - } - - static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev, -- struct ib_pd *ib_pd, - struct ib_qp_init_attr *init_attr, - struct ib_udata *udata, - struct hns_roce_qp *hr_qp) -@@ -1229,7 +1228,6 @@ int hns_roce_create_qp(struct ib_qp *qp, struct ib_qp_init_attr *init_attr, - struct ib_device *ibdev = qp->device; - struct hns_roce_dev *hr_dev = to_hr_dev(ibdev); - struct hns_roce_qp *hr_qp = to_hr_qp(qp); -- struct ib_pd *pd = qp->pd; - int ret; - - ret = check_qp_type(hr_dev, init_attr->qp_type, !!udata); -@@ -1244,7 +1242,7 @@ int hns_roce_create_qp(struct ib_qp *qp, struct ib_qp_init_attr *init_attr, - hr_qp->phy_port = hr_dev->iboe.phy_port[hr_qp->port]; - } - -- ret = hns_roce_create_qp_common(hr_dev, pd, init_attr, udata, hr_qp); -+ ret = hns_roce_create_qp_common(hr_dev, init_attr, udata, hr_qp); - if (ret) - ibdev_err(ibdev, "create QP type 0x%x failed(%d)\n", - init_attr->qp_type, ret); -diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c -index 652508b660a060..80fcb1b0e8fdcf 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_srq.c -+++ b/drivers/infiniband/hw/hns/hns_roce_srq.c -@@ -249,7 +249,7 @@ static void free_srq_wqe_buf(struct hns_roce_dev *hr_dev, - hns_roce_mtr_destroy(hr_dev, &srq->buf_mtr); - } - --static int alloc_srq_wrid(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq) -+static int alloc_srq_wrid(struct hns_roce_srq *srq) - { - srq->wrid = kvmalloc_array(srq->wqe_cnt, sizeof(u64), GFP_KERNEL); - if (!srq->wrid) -@@ -365,7 +365,7 @@ static int alloc_srq_buf(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq, - goto err_idx; - - if (!udata) { -- ret = alloc_srq_wrid(hr_dev, srq); -+ ret = alloc_srq_wrid(srq); - if (ret) - goto err_wqe_buf; - } -diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c -index c510484e024b1a..ada7dbf8eb1cf5 100644 ---- a/drivers/infiniband/hw/mlx5/main.c -+++ b/drivers/infiniband/hw/mlx5/main.c -@@ -3372,7 +3372,8 @@ static int mlx5_ib_init_multiport_master(struct mlx5_ib_dev *dev) - list_for_each_entry(mpi, &mlx5_ib_unaffiliated_port_list, - list) { - if (dev->sys_image_guid == mpi->sys_image_guid && -- (mlx5_core_native_port_num(mpi->mdev) - 1) == i) { -+ (mlx5_core_native_port_num(mpi->mdev) - 1) == i && -+ mlx5_core_same_coredev_type(dev->mdev, mpi->mdev)) { - bound = mlx5_ib_bind_slave_port(dev, mpi); - } - -@@ -4406,7 +4407,8 @@ static int mlx5r_mp_probe(struct auxiliary_device *adev, - - mutex_lock(&mlx5_ib_multiport_mutex); - list_for_each_entry(dev, &mlx5_ib_dev_list, ib_dev_list) { -- if (dev->sys_image_guid == mpi->sys_image_guid) -+ if (dev->sys_image_guid == mpi->sys_image_guid && -+ mlx5_core_same_coredev_type(dev->mdev, mpi->mdev)) - bound = mlx5_ib_bind_slave_port(dev, mpi); - - if (bound) { -diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c -index 758a3d9c2844d1..84d1654148d764 100644 ---- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c -+++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c -@@ -346,6 +346,7 @@ static int send_io_resp_imm(struct rtrs_srv_con *con, struct rtrs_srv_op *id, - struct rtrs_srv_mr *srv_mr; - bool need_inval = false; - enum ib_send_flags flags; -+ struct ib_sge list; - u32 imm; - int err; - -@@ -398,7 +399,6 @@ static int send_io_resp_imm(struct rtrs_srv_con *con, struct rtrs_srv_op *id, - imm = rtrs_to_io_rsp_imm(id->msg_id, errno, need_inval); - imm_wr.wr.next = NULL; - if (always_invalidate) { -- struct ib_sge list; - struct rtrs_msg_rkey_rsp *msg; - - srv_mr = &srv_path->mrs[id->msg_id]; -diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c -index 412196a7dad587..2c6c50348afd19 100644 ---- a/drivers/irqchip/irq-gic.c -+++ b/drivers/irqchip/irq-gic.c -@@ -64,7 +64,7 @@ static void gic_check_cpu_features(void) - - union gic_base { - void __iomem *common_base; -- void __percpu * __iomem *percpu_base; -+ void __iomem * __percpu *percpu_base; - }; - - struct gic_chip_data { -diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c -index a44d4b3e5beb22..82102a4c5d6883 100644 ---- a/drivers/mailbox/pcc.c -+++ b/drivers/mailbox/pcc.c -@@ -91,6 +91,14 @@ struct pcc_chan_reg { - * @cmd_update: PCC register bundle for the command complete update register - * @error: PCC register bundle for the error status register - * @plat_irq: platform interrupt -+ * @type: PCC subspace type -+ * @plat_irq_flags: platform interrupt flags -+ * @chan_in_use: this flag is used just to check if the interrupt needs -+ * handling when it is shared. Since only one transfer can occur -+ * at a time and mailbox takes care of locking, this flag can be -+ * accessed without a lock. Note: the type only support the -+ * communication from OSPM to Platform, like type3, use it, and -+ * other types completely ignore it. - */ - struct pcc_chan_info { - struct pcc_mbox_chan chan; -@@ -100,12 +108,17 @@ struct pcc_chan_info { - struct pcc_chan_reg cmd_update; - struct pcc_chan_reg error; - int plat_irq; -+ u8 type; -+ unsigned int plat_irq_flags; -+ bool chan_in_use; - }; - - #define to_pcc_chan_info(c) container_of(c, struct pcc_chan_info, chan) - static struct pcc_chan_info *chan_info; - static int pcc_chan_count; - -+static int pcc_send_data(struct mbox_chan *chan, void *data); -+ - /* - * PCC can be used with perf critical drivers such as CPPC - * So it makes sense to locally cache the virtual address and -@@ -221,6 +234,70 @@ static int pcc_map_interrupt(u32 interrupt, u32 flags) - return acpi_register_gsi(NULL, interrupt, trigger, polarity); - } - -+static bool pcc_chan_plat_irq_can_be_shared(struct pcc_chan_info *pchan) -+{ -+ return (pchan->plat_irq_flags & ACPI_PCCT_INTERRUPT_MODE) == -+ ACPI_LEVEL_SENSITIVE; -+} -+ -+static bool pcc_mbox_cmd_complete_check(struct pcc_chan_info *pchan) -+{ -+ u64 val; -+ int ret; -+ -+ ret = pcc_chan_reg_read(&pchan->cmd_complete, &val); -+ if (ret) -+ return false; -+ -+ if (!pchan->cmd_complete.gas) -+ return true; -+ -+ /* -+ * Judge if the channel respond the interrupt based on the value of -+ * command complete. -+ */ -+ val &= pchan->cmd_complete.status_mask; -+ -+ /* -+ * If this is PCC slave subspace channel, and the command complete -+ * bit 0 indicates that Platform is sending a notification and OSPM -+ * needs to respond this interrupt to process this command. -+ */ -+ if (pchan->type == ACPI_PCCT_TYPE_EXT_PCC_SLAVE_SUBSPACE) -+ return !val; -+ -+ return !!val; -+} -+ -+static void check_and_ack(struct pcc_chan_info *pchan, struct mbox_chan *chan) -+{ -+ struct acpi_pcct_ext_pcc_shared_memory pcc_hdr; -+ -+ if (pchan->type != ACPI_PCCT_TYPE_EXT_PCC_SLAVE_SUBSPACE) -+ return; -+ /* If the memory region has not been mapped, we cannot -+ * determine if we need to send the message, but we still -+ * need to set the cmd_update flag before returning. -+ */ -+ if (pchan->chan.shmem == NULL) { -+ pcc_chan_reg_read_modify_write(&pchan->cmd_update); -+ return; -+ } -+ memcpy_fromio(&pcc_hdr, pchan->chan.shmem, -+ sizeof(struct acpi_pcct_ext_pcc_shared_memory)); -+ /* -+ * The PCC slave subspace channel needs to set the command complete bit -+ * after processing message. If the PCC_ACK_FLAG is set, it should also -+ * ring the doorbell. -+ * -+ * The PCC master subspace channel clears chan_in_use to free channel. -+ */ -+ if (le32_to_cpup(&pcc_hdr.flags) & PCC_ACK_FLAG_MASK) -+ pcc_send_data(chan, NULL); -+ else -+ pcc_chan_reg_read_modify_write(&pchan->cmd_update); -+} -+ - /** - * pcc_mbox_irq - PCC mailbox interrupt handler - * @irq: interrupt number -@@ -236,16 +313,12 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p) - int ret; - - pchan = chan->con_priv; -- -- ret = pcc_chan_reg_read(&pchan->cmd_complete, &val); -- if (ret) -+ if (pchan->type == ACPI_PCCT_TYPE_EXT_PCC_MASTER_SUBSPACE && -+ !pchan->chan_in_use) - return IRQ_NONE; - -- if (val) { /* Ensure GAS exists and value is non-zero */ -- val &= pchan->cmd_complete.status_mask; -- if (!val) -- return IRQ_NONE; -- } -+ if (!pcc_mbox_cmd_complete_check(pchan)) -+ return IRQ_NONE; - - ret = pcc_chan_reg_read(&pchan->error, &val); - if (ret) -@@ -262,6 +335,9 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p) - - mbox_chan_received_data(chan, NULL); - -+ check_and_ack(pchan, chan); -+ pchan->chan_in_use = false; -+ - return IRQ_HANDLED; - } - -@@ -311,14 +387,37 @@ EXPORT_SYMBOL_GPL(pcc_mbox_request_channel); - void pcc_mbox_free_channel(struct pcc_mbox_chan *pchan) - { - struct mbox_chan *chan = pchan->mchan; -+ struct pcc_chan_info *pchan_info; -+ struct pcc_mbox_chan *pcc_mbox_chan; - - if (!chan || !chan->cl) - return; -+ pchan_info = chan->con_priv; -+ pcc_mbox_chan = &pchan_info->chan; -+ if (pcc_mbox_chan->shmem) { -+ iounmap(pcc_mbox_chan->shmem); -+ pcc_mbox_chan->shmem = NULL; -+ } - - mbox_free_channel(chan); - } - EXPORT_SYMBOL_GPL(pcc_mbox_free_channel); - -+int pcc_mbox_ioremap(struct mbox_chan *chan) -+{ -+ struct pcc_chan_info *pchan_info; -+ struct pcc_mbox_chan *pcc_mbox_chan; -+ -+ if (!chan || !chan->cl) -+ return -1; -+ pchan_info = chan->con_priv; -+ pcc_mbox_chan = &pchan_info->chan; -+ pcc_mbox_chan->shmem = ioremap(pcc_mbox_chan->shmem_base_addr, -+ pcc_mbox_chan->shmem_size); -+ return 0; -+} -+EXPORT_SYMBOL_GPL(pcc_mbox_ioremap); -+ - /** - * pcc_send_data - Called from Mailbox Controller code. Used - * here only to ring the channel doorbell. The PCC client -@@ -340,7 +439,11 @@ static int pcc_send_data(struct mbox_chan *chan, void *data) - if (ret) - return ret; - -- return pcc_chan_reg_read_modify_write(&pchan->db); -+ ret = pcc_chan_reg_read_modify_write(&pchan->db); -+ if (!ret && pchan->plat_irq > 0) -+ pchan->chan_in_use = true; -+ -+ return ret; - } - - /** -@@ -353,11 +456,14 @@ static int pcc_send_data(struct mbox_chan *chan, void *data) - static int pcc_startup(struct mbox_chan *chan) - { - struct pcc_chan_info *pchan = chan->con_priv; -+ unsigned long irqflags; - int rc; - - if (pchan->plat_irq > 0) { -- rc = devm_request_irq(chan->mbox->dev, pchan->plat_irq, pcc_mbox_irq, 0, -- MBOX_IRQ_NAME, chan); -+ irqflags = pcc_chan_plat_irq_can_be_shared(pchan) ? -+ IRQF_SHARED | IRQF_ONESHOT : 0; -+ rc = devm_request_irq(chan->mbox->dev, pchan->plat_irq, pcc_mbox_irq, -+ irqflags, MBOX_IRQ_NAME, chan); - if (unlikely(rc)) { - dev_err(chan->mbox->dev, "failed to register PCC interrupt %d\n", - pchan->plat_irq); -@@ -463,6 +569,7 @@ static int pcc_parse_subspace_irq(struct pcc_chan_info *pchan, - pcct_ss->platform_interrupt); - return -EINVAL; - } -+ pchan->plat_irq_flags = pcct_ss->flags; - - if (pcct_ss->header.type == ACPI_PCCT_TYPE_HW_REDUCED_SUBSPACE_TYPE2) { - struct acpi_pcct_hw_reduced_type2 *pcct2_ss = (void *)pcct_ss; -@@ -484,6 +591,12 @@ static int pcc_parse_subspace_irq(struct pcc_chan_info *pchan, - "PLAT IRQ ACK"); - } - -+ if (pcc_chan_plat_irq_can_be_shared(pchan) && -+ !pchan->plat_irq_ack.gas) { -+ pr_err("PCC subspace has level IRQ with no ACK register\n"); -+ return -EINVAL; -+ } -+ - return ret; - } - -@@ -698,6 +811,7 @@ static int pcc_mbox_probe(struct platform_device *pdev) - - pcc_parse_subspace_shmem(pchan, pcct_entry); - -+ pchan->type = pcct_entry->type; - pcct_entry = (struct acpi_subtable_header *) - ((unsigned long) pcct_entry + pcct_entry->length); - } -diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c -index 5a3e933df63352..1b05890f99f4f4 100644 ---- a/drivers/media/usb/uvc/uvc_driver.c -+++ b/drivers/media/usb/uvc/uvc_driver.c -@@ -2519,6 +2519,28 @@ static const struct usb_device_id uvc_ids[] = { - .bInterfaceSubClass = 1, - .bInterfaceProtocol = UVC_PC_PROTOCOL_15, - .driver_info = (kernel_ulong_t)&uvc_ctrl_power_line_limited }, -+ /* Quanta ACER HD User Facing */ -+ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE -+ | USB_DEVICE_ID_MATCH_INT_INFO, -+ .idVendor = 0x0408, -+ .idProduct = 0x4033, -+ .bInterfaceClass = USB_CLASS_VIDEO, -+ .bInterfaceSubClass = 1, -+ .bInterfaceProtocol = UVC_PC_PROTOCOL_15, -+ .driver_info = (kernel_ulong_t)&(const struct uvc_device_info){ -+ .uvc_version = 0x010a, -+ } }, -+ /* Quanta ACER HD User Facing */ -+ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE -+ | USB_DEVICE_ID_MATCH_INT_INFO, -+ .idVendor = 0x0408, -+ .idProduct = 0x4035, -+ .bInterfaceClass = USB_CLASS_VIDEO, -+ .bInterfaceSubClass = 1, -+ .bInterfaceProtocol = UVC_PC_PROTOCOL_15, -+ .driver_info = (kernel_ulong_t)&(const struct uvc_device_info){ -+ .uvc_version = 0x010a, -+ } }, - /* LogiLink Wireless Webcam */ - { .match_flags = USB_DEVICE_ID_MATCH_DEVICE - | USB_DEVICE_ID_MATCH_INT_INFO, -diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c -index e113b99a3eab59..8716004fcf6c90 100644 ---- a/drivers/mmc/host/sdhci-msm.c -+++ b/drivers/mmc/host/sdhci-msm.c -@@ -1867,20 +1867,20 @@ static int sdhci_msm_program_key(struct cqhci_host *cq_host, - struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host); - union cqhci_crypto_cap_entry cap; - -+ if (!(cfg->config_enable & CQHCI_CRYPTO_CONFIGURATION_ENABLE)) -+ return qcom_ice_evict_key(msm_host->ice, slot); -+ - /* Only AES-256-XTS has been tested so far. */ - cap = cq_host->crypto_cap_array[cfg->crypto_cap_idx]; - if (cap.algorithm_id != CQHCI_CRYPTO_ALG_AES_XTS || - cap.key_size != CQHCI_CRYPTO_KEY_SIZE_256) - return -EINVAL; - -- if (cfg->config_enable & CQHCI_CRYPTO_CONFIGURATION_ENABLE) -- return qcom_ice_program_key(msm_host->ice, -- QCOM_ICE_CRYPTO_ALG_AES_XTS, -- QCOM_ICE_CRYPTO_KEY_SIZE_256, -- cfg->crypto_key, -- cfg->data_unit_size, slot); -- else -- return qcom_ice_evict_key(msm_host->ice, slot); -+ return qcom_ice_program_key(msm_host->ice, -+ QCOM_ICE_CRYPTO_ALG_AES_XTS, -+ QCOM_ICE_CRYPTO_KEY_SIZE_256, -+ cfg->crypto_key, -+ cfg->data_unit_size, slot); - } - - #else /* CONFIG_MMC_CRYPTO */ -diff --git a/drivers/net/dsa/microchip/ksz9477.c b/drivers/net/dsa/microchip/ksz9477.c -index a7e8fcdf25768b..59134d117846d1 100644 ---- a/drivers/net/dsa/microchip/ksz9477.c -+++ b/drivers/net/dsa/microchip/ksz9477.c -@@ -2,7 +2,7 @@ - /* - * Microchip KSZ9477 switch driver main logic - * -- * Copyright (C) 2017-2019 Microchip Technology Inc. -+ * Copyright (C) 2017-2024 Microchip Technology Inc. - */ - - #include -@@ -916,26 +916,51 @@ void ksz9477_get_caps(struct ksz_device *dev, int port, - int ksz9477_set_ageing_time(struct ksz_device *dev, unsigned int msecs) - { - u32 secs = msecs / 1000; -- u8 value; -- u8 data; -+ u8 data, mult, value; -+ u32 max_val; - int ret; - -- value = FIELD_GET(SW_AGE_PERIOD_7_0_M, secs); -+#define MAX_TIMER_VAL ((1 << 8) - 1) - -- ret = ksz_write8(dev, REG_SW_LUE_CTRL_3, value); -- if (ret < 0) -- return ret; -+ /* The aging timer comprises a 3-bit multiplier and an 8-bit second -+ * value. Either of them cannot be zero. The maximum timer is then -+ * 7 * 255 = 1785 seconds. -+ */ -+ if (!secs) -+ secs = 1; - -- data = FIELD_GET(SW_AGE_PERIOD_10_8_M, secs); -+ /* Return error if too large. */ -+ else if (secs > 7 * MAX_TIMER_VAL) -+ return -EINVAL; - - ret = ksz_read8(dev, REG_SW_LUE_CTRL_0, &value); - if (ret < 0) - return ret; - -- value &= ~SW_AGE_CNT_M; -- value |= FIELD_PREP(SW_AGE_CNT_M, data); -+ /* Check whether there is need to update the multiplier. */ -+ mult = FIELD_GET(SW_AGE_CNT_M, value); -+ max_val = MAX_TIMER_VAL; -+ if (mult > 0) { -+ /* Try to use the same multiplier already in the register as -+ * the hardware default uses multiplier 4 and 75 seconds for -+ * 300 seconds. -+ */ -+ max_val = DIV_ROUND_UP(secs, mult); -+ if (max_val > MAX_TIMER_VAL || max_val * mult != secs) -+ max_val = MAX_TIMER_VAL; -+ } -+ -+ data = DIV_ROUND_UP(secs, max_val); -+ if (mult != data) { -+ value &= ~SW_AGE_CNT_M; -+ value |= FIELD_PREP(SW_AGE_CNT_M, data); -+ ret = ksz_write8(dev, REG_SW_LUE_CTRL_0, value); -+ if (ret < 0) -+ return ret; -+ } - -- return ksz_write8(dev, REG_SW_LUE_CTRL_0, value); -+ value = DIV_ROUND_UP(secs, data); -+ return ksz_write8(dev, REG_SW_LUE_CTRL_3, value); - } - - void ksz9477_port_queue_split(struct ksz_device *dev, int port) -diff --git a/drivers/net/dsa/microchip/ksz9477_reg.h b/drivers/net/dsa/microchip/ksz9477_reg.h -index a2ef4b18349c41..d0886ed984c578 100644 ---- a/drivers/net/dsa/microchip/ksz9477_reg.h -+++ b/drivers/net/dsa/microchip/ksz9477_reg.h -@@ -2,7 +2,7 @@ - /* - * Microchip KSZ9477 register definitions - * -- * Copyright (C) 2017-2018 Microchip Technology Inc. -+ * Copyright (C) 2017-2024 Microchip Technology Inc. - */ - - #ifndef __KSZ9477_REGS_H -@@ -190,8 +190,6 @@ - #define SW_VLAN_ENABLE BIT(7) - #define SW_DROP_INVALID_VID BIT(6) - #define SW_AGE_CNT_M GENMASK(5, 3) --#define SW_AGE_CNT_S 3 --#define SW_AGE_PERIOD_10_8_M GENMASK(10, 8) - #define SW_RESV_MCAST_ENABLE BIT(2) - #define SW_HASH_OPTION_M 0x03 - #define SW_HASH_OPTION_CRC 1 -diff --git a/drivers/net/dsa/microchip/lan937x_main.c b/drivers/net/dsa/microchip/lan937x_main.c -index b479a628b1ae56..dde37e61faa359 100644 ---- a/drivers/net/dsa/microchip/lan937x_main.c -+++ b/drivers/net/dsa/microchip/lan937x_main.c -@@ -1,6 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0 - /* Microchip LAN937X switch driver main logic -- * Copyright (C) 2019-2022 Microchip Technology Inc. -+ * Copyright (C) 2019-2024 Microchip Technology Inc. - */ - #include - #include -@@ -257,10 +257,66 @@ int lan937x_change_mtu(struct ksz_device *dev, int port, int new_mtu) - - int lan937x_set_ageing_time(struct ksz_device *dev, unsigned int msecs) - { -- u32 secs = msecs / 1000; -- u32 value; -+ u8 data, mult, value8; -+ bool in_msec = false; -+ u32 max_val, value; -+ u32 secs = msecs; - int ret; - -+#define MAX_TIMER_VAL ((1 << 20) - 1) -+ -+ /* The aging timer comprises a 3-bit multiplier and a 20-bit second -+ * value. Either of them cannot be zero. The maximum timer is then -+ * 7 * 1048575 = 7340025 seconds. As this value is too large for -+ * practical use it can be interpreted as microseconds, making the -+ * maximum timer 7340 seconds with finer control. This allows for -+ * maximum 122 minutes compared to 29 minutes in KSZ9477 switch. -+ */ -+ if (msecs % 1000) -+ in_msec = true; -+ else -+ secs /= 1000; -+ if (!secs) -+ secs = 1; -+ -+ /* Return error if too large. */ -+ else if (secs > 7 * MAX_TIMER_VAL) -+ return -EINVAL; -+ -+ /* Configure how to interpret the number value. */ -+ ret = ksz_rmw8(dev, REG_SW_LUE_CTRL_2, SW_AGE_CNT_IN_MICROSEC, -+ in_msec ? SW_AGE_CNT_IN_MICROSEC : 0); -+ if (ret < 0) -+ return ret; -+ -+ ret = ksz_read8(dev, REG_SW_LUE_CTRL_0, &value8); -+ if (ret < 0) -+ return ret; -+ -+ /* Check whether there is need to update the multiplier. */ -+ mult = FIELD_GET(SW_AGE_CNT_M, value8); -+ max_val = MAX_TIMER_VAL; -+ if (mult > 0) { -+ /* Try to use the same multiplier already in the register as -+ * the hardware default uses multiplier 4 and 75 seconds for -+ * 300 seconds. -+ */ -+ max_val = DIV_ROUND_UP(secs, mult); -+ if (max_val > MAX_TIMER_VAL || max_val * mult != secs) -+ max_val = MAX_TIMER_VAL; -+ } -+ -+ data = DIV_ROUND_UP(secs, max_val); -+ if (mult != data) { -+ value8 &= ~SW_AGE_CNT_M; -+ value8 |= FIELD_PREP(SW_AGE_CNT_M, data); -+ ret = ksz_write8(dev, REG_SW_LUE_CTRL_0, value8); -+ if (ret < 0) -+ return ret; -+ } -+ -+ secs = DIV_ROUND_UP(secs, data); -+ - value = FIELD_GET(SW_AGE_PERIOD_7_0_M, secs); - - ret = ksz_write8(dev, REG_SW_AGE_PERIOD__1, value); -diff --git a/drivers/net/dsa/microchip/lan937x_reg.h b/drivers/net/dsa/microchip/lan937x_reg.h -index 45b606b6429f65..b3e536e7c68694 100644 ---- a/drivers/net/dsa/microchip/lan937x_reg.h -+++ b/drivers/net/dsa/microchip/lan937x_reg.h -@@ -1,6 +1,6 @@ - /* SPDX-License-Identifier: GPL-2.0 */ - /* Microchip LAN937X switch register definitions -- * Copyright (C) 2019-2021 Microchip Technology Inc. -+ * Copyright (C) 2019-2024 Microchip Technology Inc. - */ - #ifndef __LAN937X_REG_H - #define __LAN937X_REG_H -@@ -48,8 +48,7 @@ - - #define SW_VLAN_ENABLE BIT(7) - #define SW_DROP_INVALID_VID BIT(6) --#define SW_AGE_CNT_M 0x7 --#define SW_AGE_CNT_S 3 -+#define SW_AGE_CNT_M GENMASK(5, 3) - #define SW_RESV_MCAST_ENABLE BIT(2) - - #define REG_SW_LUE_CTRL_1 0x0311 -@@ -62,6 +61,10 @@ - #define SW_FAST_AGING BIT(1) - #define SW_LINK_AUTO_AGING BIT(0) - -+#define REG_SW_LUE_CTRL_2 0x0312 -+ -+#define SW_AGE_CNT_IN_MICROSEC BIT(7) -+ - #define REG_SW_AGE_PERIOD__1 0x0313 - #define SW_AGE_PERIOD_7_0_M GENMASK(7, 0) - -diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c -index 49e890a7e04a37..23cc2d85994e42 100644 ---- a/drivers/net/ethernet/broadcom/bcmsysport.c -+++ b/drivers/net/ethernet/broadcom/bcmsysport.c -@@ -1967,7 +1967,11 @@ static int bcm_sysport_open(struct net_device *dev) - unsigned int i; - int ret; - -- clk_prepare_enable(priv->clk); -+ ret = clk_prepare_enable(priv->clk); -+ if (ret) { -+ netdev_err(dev, "could not enable priv clock\n"); -+ return ret; -+ } - - /* Reset UniMAC */ - umac_reset(priv); -@@ -2625,7 +2629,11 @@ static int bcm_sysport_probe(struct platform_device *pdev) - goto err_deregister_notifier; - } - -- clk_prepare_enable(priv->clk); -+ ret = clk_prepare_enable(priv->clk); -+ if (ret) { -+ dev_err(&pdev->dev, "could not enable priv clock\n"); -+ goto err_deregister_netdev; -+ } - - priv->rev = topctrl_readl(priv, REV_CNTL) & REV_MASK; - dev_info(&pdev->dev, -@@ -2639,6 +2647,8 @@ static int bcm_sysport_probe(struct platform_device *pdev) - - return 0; - -+err_deregister_netdev: -+ unregister_netdev(dev); - err_deregister_notifier: - unregister_netdevice_notifier(&priv->netdev_notifier); - err_deregister_fixed_link: -@@ -2810,7 +2820,12 @@ static int __maybe_unused bcm_sysport_resume(struct device *d) - if (!netif_running(dev)) - return 0; - -- clk_prepare_enable(priv->clk); -+ ret = clk_prepare_enable(priv->clk); -+ if (ret) { -+ netdev_err(dev, "could not enable priv clock\n"); -+ return ret; -+ } -+ - if (priv->wolopts) - clk_disable_unprepare(priv->wol_clk); - -diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c -index 5703240474e5b2..d70305654e7d07 100644 ---- a/drivers/net/ethernet/google/gve/gve_main.c -+++ b/drivers/net/ethernet/google/gve/gve_main.c -@@ -1528,8 +1528,8 @@ static int gve_xsk_pool_enable(struct net_device *dev, - if (err) - return err; - -- /* If XDP prog is not installed, return */ -- if (!priv->xdp_prog) -+ /* If XDP prog is not installed or interface is down, return. */ -+ if (!priv->xdp_prog || !netif_running(dev)) - return 0; - - rx = &priv->rx[qid]; -@@ -1574,21 +1574,16 @@ static int gve_xsk_pool_disable(struct net_device *dev, - if (qid >= priv->rx_cfg.num_queues) - return -EINVAL; - -- /* If XDP prog is not installed, unmap DMA and return */ -- if (!priv->xdp_prog) -- goto done; -- -- tx_qid = gve_xdp_tx_queue_id(priv, qid); -- if (!netif_running(dev)) { -- priv->rx[qid].xsk_pool = NULL; -- xdp_rxq_info_unreg(&priv->rx[qid].xsk_rxq); -- priv->tx[tx_qid].xsk_pool = NULL; -+ /* If XDP prog is not installed or interface is down, unmap DMA and -+ * return. -+ */ -+ if (!priv->xdp_prog || !netif_running(dev)) - goto done; -- } - - napi_rx = &priv->ntfy_blocks[priv->rx[qid].ntfy_id].napi; - napi_disable(napi_rx); /* make sure current rx poll is done */ - -+ tx_qid = gve_xdp_tx_queue_id(priv, qid); - napi_tx = &priv->ntfy_blocks[priv->tx[tx_qid].ntfy_id].napi; - napi_disable(napi_tx); /* make sure current tx poll is done */ - -@@ -1616,6 +1611,9 @@ static int gve_xsk_wakeup(struct net_device *dev, u32 queue_id, u32 flags) - struct gve_priv *priv = netdev_priv(dev); - int tx_queue_id = gve_xdp_tx_queue_id(priv, queue_id); - -+ if (!gve_get_napi_enabled(priv)) -+ return -ENETDOWN; -+ - if (queue_id >= priv->rx_cfg.num_queues || !priv->xdp_prog) - return -EINVAL; - -@@ -1757,6 +1755,9 @@ static void gve_turndown(struct gve_priv *priv) - - gve_clear_napi_enabled(priv); - gve_clear_report_stats(priv); -+ -+ /* Make sure that all traffic is finished processing. */ -+ synchronize_net(); - } - - static void gve_turnup(struct gve_priv *priv) -diff --git a/drivers/net/ethernet/google/gve/gve_tx.c b/drivers/net/ethernet/google/gve/gve_tx.c -index 2ae891a62875c7..29987624791a68 100644 ---- a/drivers/net/ethernet/google/gve/gve_tx.c -+++ b/drivers/net/ethernet/google/gve/gve_tx.c -@@ -777,9 +777,12 @@ int gve_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames, - struct gve_tx_ring *tx; - int i, err = 0, qid; - -- if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) -+ if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK) || !priv->xdp_prog) - return -EINVAL; - -+ if (!gve_get_napi_enabled(priv)) -+ return -ENETDOWN; -+ - qid = gve_xdp_tx_queue_id(priv, - smp_processor_id() % priv->num_xdp_queues); - -diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c -index 3b129a1c338152..07e5051171a48a 100644 ---- a/drivers/net/ethernet/marvell/mv643xx_eth.c -+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c -@@ -2708,9 +2708,15 @@ static struct platform_device *port_platdev[3]; - - static void mv643xx_eth_shared_of_remove(void) - { -+ struct mv643xx_eth_platform_data *pd; - int n; - - for (n = 0; n < 3; n++) { -+ if (!port_platdev[n]) -+ continue; -+ pd = dev_get_platdata(&port_platdev[n]->dev); -+ if (pd) -+ of_node_put(pd->phy_node); - platform_device_del(port_platdev[n]); - port_platdev[n] = NULL; - } -@@ -2773,8 +2779,10 @@ static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev, - } - - ppdev = platform_device_alloc(MV643XX_ETH_NAME, dev_num); -- if (!ppdev) -- return -ENOMEM; -+ if (!ppdev) { -+ ret = -ENOMEM; -+ goto put_err; -+ } - ppdev->dev.coherent_dma_mask = DMA_BIT_MASK(32); - ppdev->dev.of_node = pnp; - -@@ -2796,6 +2804,8 @@ static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev, - - port_err: - platform_device_put(ppdev); -+put_err: -+ of_node_put(ppd.phy_node); - return ret; - } - -diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c -index 07720841a8d700..dd3d93720358bd 100644 ---- a/drivers/net/ethernet/marvell/sky2.c -+++ b/drivers/net/ethernet/marvell/sky2.c -@@ -129,6 +129,7 @@ static const struct pci_device_id sky2_id_table[] = { - { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x436C) }, /* 88E8072 */ - { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x436D) }, /* 88E8055 */ - { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4370) }, /* 88E8075 */ -+ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4373) }, /* 88E8075 */ - { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4380) }, /* 88E8057 */ - { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4381) }, /* 88E8059 */ - { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4382) }, /* 88E8079 */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c -index cc9bcc42003242..6ab02f3fc29123 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c -@@ -339,9 +339,13 @@ static int mlx5e_macsec_init_sa_fs(struct macsec_context *ctx, - { - struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev); - struct mlx5_macsec_fs *macsec_fs = priv->mdev->macsec_fs; -+ const struct macsec_tx_sc *tx_sc = &ctx->secy->tx_sc; - struct mlx5_macsec_rule_attrs rule_attrs; - union mlx5_macsec_rule *macsec_rule; - -+ if (is_tx && tx_sc->encoding_sa != sa->assoc_num) -+ return 0; -+ - rule_attrs.macsec_obj_id = sa->macsec_obj_id; - rule_attrs.sci = sa->sci; - rule_attrs.assoc_num = sa->assoc_num; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c -index 13b5916b64e224..eed8fcde261384 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c -@@ -150,11 +150,11 @@ void mlx5_esw_ipsec_restore_dest_uplink(struct mlx5_core_dev *mdev) - unsigned long i; - int err; - -- xa_for_each(&esw->offloads.vport_reps, i, rep) { -- rpriv = rep->rep_data[REP_ETH].priv; -- if (!rpriv || !rpriv->netdev) -+ mlx5_esw_for_each_rep(esw, i, rep) { -+ if (atomic_read(&rep->rep_data[REP_ETH].state) != REP_LOADED) - continue; - -+ rpriv = rep->rep_data[REP_ETH].priv; - rhashtable_walk_enter(&rpriv->tc_ht, &iter); - rhashtable_walk_start(&iter); - while ((flow = rhashtable_walk_next(&iter)) != NULL) { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -index 9b771b572593b5..3e58e731b5697c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -@@ -713,6 +713,9 @@ void mlx5e_tc_clean_fdb_peer_flows(struct mlx5_eswitch *esw); - MLX5_CAP_GEN_2((esw->dev), ec_vf_vport_base) +\ - (last) - 1) - -+#define mlx5_esw_for_each_rep(esw, i, rep) \ -+ xa_for_each(&((esw)->offloads.vport_reps), i, rep) -+ - struct mlx5_eswitch *__must_check - mlx5_devlink_eswitch_get(struct devlink *devlink); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -index 58529d1a98b37b..7eba3a5bb97cae 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -@@ -52,9 +52,6 @@ - #include "lag/lag.h" - #include "en/tc/post_meter.h" - --#define mlx5_esw_for_each_rep(esw, i, rep) \ -- xa_for_each(&((esw)->offloads.vport_reps), i, rep) -- - /* There are two match-all miss flows, one for unicast dst mac and - * one for multicast. - */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -index 991250f44c2ed1..474e63d02ba492 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -@@ -3478,6 +3478,7 @@ void mlx5_fs_core_free(struct mlx5_core_dev *dev) - int mlx5_fs_core_alloc(struct mlx5_core_dev *dev) - { - struct mlx5_flow_steering *steering; -+ char name[80]; - int err = 0; - - err = mlx5_init_fc_stats(dev); -@@ -3502,10 +3503,12 @@ int mlx5_fs_core_alloc(struct mlx5_core_dev *dev) - else - steering->mode = MLX5_FLOW_STEERING_MODE_DMFS; - -- steering->fgs_cache = kmem_cache_create("mlx5_fs_fgs", -+ snprintf(name, sizeof(name), "%s-mlx5_fs_fgs", dev_name(dev->device)); -+ steering->fgs_cache = kmem_cache_create(name, - sizeof(struct mlx5_flow_group), 0, - 0, NULL); -- steering->ftes_cache = kmem_cache_create("mlx5_fs_ftes", sizeof(struct fs_fte), 0, -+ snprintf(name, sizeof(name), "%s-mlx5_fs_ftes", dev_name(dev->device)); -+ steering->ftes_cache = kmem_cache_create(name, sizeof(struct fs_fte), 0, - 0, NULL); - if (!steering->ftes_cache || !steering->fgs_cache) { - err = -ENOMEM; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c -index 6fa06ba2d34653..f57c84e5128bc7 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c -@@ -1067,7 +1067,6 @@ static struct mlx5dr_cq *dr_create_cq(struct mlx5_core_dev *mdev, - int inlen, err, eqn; - void *cqc, *in; - __be64 *pas; -- int vector; - u32 i; - - cq = kzalloc(sizeof(*cq), GFP_KERNEL); -@@ -1096,8 +1095,7 @@ static struct mlx5dr_cq *dr_create_cq(struct mlx5_core_dev *mdev, - if (!in) - goto err_cqwq; - -- vector = raw_smp_processor_id() % mlx5_comp_vectors_max(mdev); -- err = mlx5_comp_eqn_get(mdev, vector, &eqn); -+ err = mlx5_comp_eqn_get(mdev, 0, &eqn); - if (err) { - kvfree(in); - goto err_cqwq; -diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c -index dcd198104141f1..fa3fef2b74db0d 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c -@@ -423,8 +423,7 @@ mlxsw_sp_span_gretap4_route(const struct net_device *to_dev, - - parms = mlxsw_sp_ipip_netdev_parms4(to_dev); - ip_tunnel_init_flow(&fl4, parms.iph.protocol, *daddrp, *saddrp, -- 0, 0, dev_net(to_dev), parms.link, tun->fwmark, 0, -- 0); -+ 0, 0, tun->net, parms.link, tun->fwmark, 0, 0); - - rt = ip_route_output_key(tun->net, &fl4); - if (IS_ERR(rt)) -diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c -index 54aa56c841334c..2f483531d95cb7 100644 ---- a/drivers/net/ethernet/renesas/rswitch.c -+++ b/drivers/net/ethernet/renesas/rswitch.c -@@ -1632,8 +1632,9 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd - if (dma_mapping_error(ndev->dev.parent, dma_addr_orig)) - goto err_kfree; - -- gq->skbs[gq->cur] = skb; -- gq->unmap_addrs[gq->cur] = dma_addr_orig; -+ /* Stored the skb at the last descriptor to avoid skb free before hardware completes send */ -+ gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] = skb; -+ gq->unmap_addrs[(gq->cur + nr_desc - 1) % gq->ring_size] = dma_addr_orig; - - dma_wmb(); - -diff --git a/drivers/net/ethernet/sfc/tc_conntrack.c b/drivers/net/ethernet/sfc/tc_conntrack.c -index 44bb57670340da..109d2aa34ae332 100644 ---- a/drivers/net/ethernet/sfc/tc_conntrack.c -+++ b/drivers/net/ethernet/sfc/tc_conntrack.c -@@ -16,7 +16,7 @@ static int efx_tc_flow_block(enum tc_setup_type type, void *type_data, - void *cb_priv); - - static const struct rhashtable_params efx_tc_ct_zone_ht_params = { -- .key_len = offsetof(struct efx_tc_ct_zone, linkage), -+ .key_len = sizeof_field(struct efx_tc_ct_zone, zone), - .key_offset = 0, - .head_offset = offsetof(struct efx_tc_ct_zone, linkage), - }; -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c -index b4fdd40be63cb4..4d570efd9d4bbe 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c -@@ -296,62 +296,80 @@ static int stmmac_mtl_setup(struct platform_device *pdev, - } - - /** -- * stmmac_dt_phy - parse device-tree driver parameters to allocate PHY resources -- * @plat: driver data platform structure -- * @np: device tree node -- * @dev: device pointer -- * Description: -- * The mdio bus will be allocated in case of a phy transceiver is on board; -- * it will be NULL if the fixed-link is configured. -- * If there is the "snps,dwmac-mdio" sub-node the mdio will be allocated -- * in any case (for DSA, mdio must be registered even if fixed-link). -- * The table below sums the supported configurations: -- * ------------------------------- -- * snps,phy-addr | Y -- * ------------------------------- -- * phy-handle | Y -- * ------------------------------- -- * fixed-link | N -- * ------------------------------- -- * snps,dwmac-mdio | -- * even if | Y -- * fixed-link | -- * ------------------------------- -+ * stmmac_of_get_mdio() - Gets the MDIO bus from the devicetree. -+ * @np: devicetree node -+ * -+ * The MDIO bus will be searched for in the following ways: -+ * 1. The compatible is "snps,dwc-qos-ethernet-4.10" && a "mdio" named -+ * child node exists -+ * 2. A child node with the "snps,dwmac-mdio" compatible is present - * -- * It returns 0 in case of success otherwise -ENODEV. -+ * Return: The MDIO node if present otherwise NULL - */ --static int stmmac_dt_phy(struct plat_stmmacenet_data *plat, -- struct device_node *np, struct device *dev) -+static struct device_node *stmmac_of_get_mdio(struct device_node *np) - { -- bool mdio = !of_phy_is_fixed_link(np); - static const struct of_device_id need_mdio_ids[] = { - { .compatible = "snps,dwc-qos-ethernet-4.10" }, - {}, - }; -+ struct device_node *mdio_node = NULL; - - if (of_match_node(need_mdio_ids, np)) { -- plat->mdio_node = of_get_child_by_name(np, "mdio"); -+ mdio_node = of_get_child_by_name(np, "mdio"); - } else { - /** - * If snps,dwmac-mdio is passed from DT, always register - * the MDIO - */ -- for_each_child_of_node(np, plat->mdio_node) { -- if (of_device_is_compatible(plat->mdio_node, -+ for_each_child_of_node(np, mdio_node) { -+ if (of_device_is_compatible(mdio_node, - "snps,dwmac-mdio")) - break; - } - } - -- if (plat->mdio_node) { -+ return mdio_node; -+} -+ -+/** -+ * stmmac_mdio_setup() - Populate platform related MDIO structures. -+ * @plat: driver data platform structure -+ * @np: devicetree node -+ * @dev: device pointer -+ * -+ * This searches for MDIO information from the devicetree. -+ * If an MDIO node is found, it's assigned to plat->mdio_node and -+ * plat->mdio_bus_data is allocated. -+ * If no connection can be determined, just plat->mdio_bus_data is allocated -+ * to indicate a bus should be created and scanned for a phy. -+ * If it's determined there's no MDIO bus needed, both are left NULL. -+ * -+ * This expects that plat->phy_node has already been searched for. -+ * -+ * Return: 0 on success, errno otherwise. -+ */ -+static int stmmac_mdio_setup(struct plat_stmmacenet_data *plat, -+ struct device_node *np, struct device *dev) -+{ -+ bool legacy_mdio; -+ -+ plat->mdio_node = stmmac_of_get_mdio(np); -+ if (plat->mdio_node) - dev_dbg(dev, "Found MDIO subnode\n"); -- mdio = true; -- } - -- if (mdio) { -- plat->mdio_bus_data = -- devm_kzalloc(dev, sizeof(struct stmmac_mdio_bus_data), -- GFP_KERNEL); -+ /* Legacy devicetrees allowed for no MDIO bus description and expect -+ * the bus to be scanned for devices. If there's no phy or fixed-link -+ * described assume this is the case since there must be something -+ * connected to the MAC. -+ */ -+ legacy_mdio = !of_phy_is_fixed_link(np) && !plat->phy_node; -+ if (legacy_mdio) -+ dev_info(dev, "Deprecated MDIO bus assumption used\n"); -+ -+ if (plat->mdio_node || legacy_mdio) { -+ plat->mdio_bus_data = devm_kzalloc(dev, -+ sizeof(*plat->mdio_bus_data), -+ GFP_KERNEL); - if (!plat->mdio_bus_data) - return -ENOMEM; - -@@ -455,10 +473,11 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) - if (of_property_read_u32(np, "snps,phy-addr", &plat->phy_addr) == 0) - dev_warn(&pdev->dev, "snps,phy-addr property is deprecated\n"); - -- /* To Configure PHY by using all device-tree supported properties */ -- rc = stmmac_dt_phy(plat, np, &pdev->dev); -- if (rc) -- return ERR_PTR(rc); -+ rc = stmmac_mdio_setup(plat, np, &pdev->dev); -+ if (rc) { -+ ret = ERR_PTR(rc); -+ goto error_put_phy; -+ } - - of_property_read_u32(np, "tx-fifo-depth", &plat->tx_fifo_size); - -@@ -547,8 +566,8 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) - dma_cfg = devm_kzalloc(&pdev->dev, sizeof(*dma_cfg), - GFP_KERNEL); - if (!dma_cfg) { -- stmmac_remove_config_dt(pdev, plat); -- return ERR_PTR(-ENOMEM); -+ ret = ERR_PTR(-ENOMEM); -+ goto error_put_mdio; - } - plat->dma_cfg = dma_cfg; - -@@ -576,8 +595,8 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) - - rc = stmmac_mtl_setup(pdev, plat); - if (rc) { -- stmmac_remove_config_dt(pdev, plat); -- return ERR_PTR(rc); -+ ret = ERR_PTR(rc); -+ goto error_put_mdio; - } - - /* clock setup */ -@@ -629,6 +648,10 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) - clk_disable_unprepare(plat->pclk); - error_pclk_get: - clk_disable_unprepare(plat->stmmac_clk); -+error_put_mdio: -+ of_node_put(plat->mdio_node); -+error_put_phy: -+ of_node_put(plat->phy_node); - - return ret; - } -@@ -637,16 +660,17 @@ static void devm_stmmac_remove_config_dt(void *data) - { - struct plat_stmmacenet_data *plat = data; - -- /* Platform data argument is unused */ -- stmmac_remove_config_dt(NULL, plat); -+ clk_disable_unprepare(plat->stmmac_clk); -+ clk_disable_unprepare(plat->pclk); -+ of_node_put(plat->mdio_node); -+ of_node_put(plat->phy_node); - } - - /** - * devm_stmmac_probe_config_dt - * @pdev: platform_device structure - * @mac: MAC address to use -- * Description: Devres variant of stmmac_probe_config_dt(). Does not require -- * the user to call stmmac_remove_config_dt() at driver detach. -+ * Description: Devres variant of stmmac_probe_config_dt(). - */ - struct plat_stmmacenet_data * - devm_stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) -diff --git a/drivers/net/ethernet/ti/icssg/icss_iep.c b/drivers/net/ethernet/ti/icssg/icss_iep.c -index 3025e9c189702b..f06cdec14ed7a1 100644 ---- a/drivers/net/ethernet/ti/icssg/icss_iep.c -+++ b/drivers/net/ethernet/ti/icssg/icss_iep.c -@@ -290,6 +290,9 @@ static void icss_iep_enable_shadow_mode(struct icss_iep *iep) - for (cmp = IEP_MIN_CMP; cmp < IEP_MAX_CMP; cmp++) { - regmap_update_bits(iep->map, ICSS_IEP_CMP_STAT_REG, - IEP_CMP_STATUS(cmp), IEP_CMP_STATUS(cmp)); -+ -+ regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG, -+ IEP_CMP_CFG_CMP_EN(cmp), 0); - } - - /* enable reset counter on CMP0 event */ -@@ -808,6 +811,11 @@ int icss_iep_exit(struct icss_iep *iep) - } - icss_iep_disable(iep); - -+ if (iep->pps_enabled) -+ icss_iep_pps_enable(iep, false); -+ else if (iep->perout_enabled) -+ icss_iep_perout_enable(iep, NULL, false); -+ - return 0; - } - EXPORT_SYMBOL_GPL(icss_iep_exit); -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index 89775b6d0699a0..8e30df676ededb 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -1373,6 +1373,9 @@ static const struct usb_device_id products[] = { - {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a0, 0)}, /* Telit FN920C04 */ - {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a4, 0)}, /* Telit FN920C04 */ - {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a9, 0)}, /* Telit FN920C04 */ -+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c0, 0)}, /* Telit FE910C04 */ -+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c4, 0)}, /* Telit FE910C04 */ -+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c8, 0)}, /* Telit FE910C04 */ - {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ - {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ - {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ -diff --git a/drivers/net/wireless/ath/ath10k/bmi.c b/drivers/net/wireless/ath/ath10k/bmi.c -index af6546572df26b..9a4f8e815412cb 100644 ---- a/drivers/net/wireless/ath/ath10k/bmi.c -+++ b/drivers/net/wireless/ath/ath10k/bmi.c -@@ -2,6 +2,7 @@ - /* - * Copyright (c) 2005-2011 Atheros Communications Inc. - * Copyright (c) 2011-2014,2016-2017 Qualcomm Atheros, Inc. -+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include "bmi.h" -diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c -index c27b8204718a6d..afae4a8027f833 100644 ---- a/drivers/net/wireless/ath/ath10k/ce.c -+++ b/drivers/net/wireless/ath/ath10k/ce.c -@@ -3,6 +3,7 @@ - * Copyright (c) 2005-2011 Atheros Communications Inc. - * Copyright (c) 2011-2017 Qualcomm Atheros, Inc. - * Copyright (c) 2018 The Linux Foundation. All rights reserved. -+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include "hif.h" -diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c -index 81058be3598f15..c3a8b3496be2a5 100644 ---- a/drivers/net/wireless/ath/ath10k/core.c -+++ b/drivers/net/wireless/ath/ath10k/core.c -@@ -3,6 +3,7 @@ - * Copyright (c) 2005-2011 Atheros Communications Inc. - * Copyright (c) 2011-2017 Qualcomm Atheros, Inc. - * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved. -+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include -diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h -index 4b5239de401840..cb2359d2ee0b04 100644 ---- a/drivers/net/wireless/ath/ath10k/core.h -+++ b/drivers/net/wireless/ath/ath10k/core.h -@@ -3,6 +3,7 @@ - * Copyright (c) 2005-2011 Atheros Communications Inc. - * Copyright (c) 2011-2017 Qualcomm Atheros, Inc. - * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved. -+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #ifndef _CORE_H_ -diff --git a/drivers/net/wireless/ath/ath10k/coredump.c b/drivers/net/wireless/ath/ath10k/coredump.c -index 2d1634a890dde3..bb3a276b7ed584 100644 ---- a/drivers/net/wireless/ath/ath10k/coredump.c -+++ b/drivers/net/wireless/ath/ath10k/coredump.c -@@ -2,6 +2,7 @@ - /* - * Copyright (c) 2011-2017 Qualcomm Atheros, Inc. - * Copyright (c) 2018, The Linux Foundation. All rights reserved. -+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include "coredump.h" -diff --git a/drivers/net/wireless/ath/ath10k/coredump.h b/drivers/net/wireless/ath/ath10k/coredump.h -index 437b9759f05d3d..e5ef0352e319c7 100644 ---- a/drivers/net/wireless/ath/ath10k/coredump.h -+++ b/drivers/net/wireless/ath/ath10k/coredump.h -@@ -1,6 +1,7 @@ - /* SPDX-License-Identifier: ISC */ - /* - * Copyright (c) 2011-2017 Qualcomm Atheros, Inc. -+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #ifndef _COREDUMP_H_ -diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c -index fe89bc61e5317d..92ad0a04bcc738 100644 ---- a/drivers/net/wireless/ath/ath10k/debug.c -+++ b/drivers/net/wireless/ath/ath10k/debug.c -@@ -3,6 +3,7 @@ - * Copyright (c) 2005-2011 Atheros Communications Inc. - * Copyright (c) 2011-2017 Qualcomm Atheros, Inc. - * Copyright (c) 2018, The Linux Foundation. All rights reserved. -+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include -diff --git a/drivers/net/wireless/ath/ath10k/debugfs_sta.c b/drivers/net/wireless/ath/ath10k/debugfs_sta.c -index 5598cf706daabc..0f6de862c3a9ba 100644 ---- a/drivers/net/wireless/ath/ath10k/debugfs_sta.c -+++ b/drivers/net/wireless/ath/ath10k/debugfs_sta.c -@@ -2,6 +2,7 @@ - /* - * Copyright (c) 2014-2017 Qualcomm Atheros, Inc. - * Copyright (c) 2018, The Linux Foundation. All rights reserved. -+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include "core.h" -diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c -index 5bfeecb95fca23..a6e21ce90bad64 100644 ---- a/drivers/net/wireless/ath/ath10k/htc.c -+++ b/drivers/net/wireless/ath/ath10k/htc.c -@@ -2,6 +2,7 @@ - /* - * Copyright (c) 2005-2011 Atheros Communications Inc. - * Copyright (c) 2011-2017 Qualcomm Atheros, Inc. -+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include "core.h" -diff --git a/drivers/net/wireless/ath/ath10k/htt.h b/drivers/net/wireless/ath/ath10k/htt.h -index 7b24297146e72a..52f6dc6b81c5ee 100644 ---- a/drivers/net/wireless/ath/ath10k/htt.h -+++ b/drivers/net/wireless/ath/ath10k/htt.h -@@ -3,6 +3,7 @@ - * Copyright (c) 2005-2011 Atheros Communications Inc. - * Copyright (c) 2011-2017 Qualcomm Atheros, Inc. - * Copyright (c) 2018, The Linux Foundation. All rights reserved. -+ * Copyright (c) 2021, 2023 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #ifndef _HTT_H_ -diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c -index 438b0caaceb79e..51855f23ea2664 100644 ---- a/drivers/net/wireless/ath/ath10k/htt_rx.c -+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c -@@ -3,6 +3,7 @@ - * Copyright (c) 2005-2011 Atheros Communications Inc. - * Copyright (c) 2011-2017 Qualcomm Atheros, Inc. - * Copyright (c) 2018, The Linux Foundation. All rights reserved. -+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include "core.h" -diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c -index bd603feb795314..60425d22d70790 100644 ---- a/drivers/net/wireless/ath/ath10k/htt_tx.c -+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c -@@ -2,6 +2,7 @@ - /* - * Copyright (c) 2005-2011 Atheros Communications Inc. - * Copyright (c) 2011-2017 Qualcomm Atheros, Inc. -+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include -diff --git a/drivers/net/wireless/ath/ath10k/hw.c b/drivers/net/wireless/ath/ath10k/hw.c -index 6d32b43a4da65e..8fafe096adff53 100644 ---- a/drivers/net/wireless/ath/ath10k/hw.c -+++ b/drivers/net/wireless/ath/ath10k/hw.c -@@ -1,6 +1,7 @@ - // SPDX-License-Identifier: ISC - /* - * Copyright (c) 2014-2017 Qualcomm Atheros, Inc. -+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include -diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h -index 7ecdd0011cfa48..afd336282615c6 100644 ---- a/drivers/net/wireless/ath/ath10k/hw.h -+++ b/drivers/net/wireless/ath/ath10k/hw.h -@@ -3,6 +3,7 @@ - * Copyright (c) 2005-2011 Atheros Communications Inc. - * Copyright (c) 2011-2017 Qualcomm Atheros, Inc. - * Copyright (c) 2018 The Linux Foundation. All rights reserved. -+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #ifndef _HW_H_ -diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c -index d5e6e11f630b95..655fb5cdf01f86 100644 ---- a/drivers/net/wireless/ath/ath10k/mac.c -+++ b/drivers/net/wireless/ath/ath10k/mac.c -@@ -3,6 +3,7 @@ - * Copyright (c) 2005-2011 Atheros Communications Inc. - * Copyright (c) 2011-2017 Qualcomm Atheros, Inc. - * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved. -+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include "mac.h" -diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c -index 23f36622193908..aaa240f3c08a9f 100644 ---- a/drivers/net/wireless/ath/ath10k/pci.c -+++ b/drivers/net/wireless/ath/ath10k/pci.c -@@ -2,6 +2,7 @@ - /* - * Copyright (c) 2005-2011 Atheros Communications Inc. - * Copyright (c) 2011-2017 Qualcomm Atheros, Inc. -+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include -diff --git a/drivers/net/wireless/ath/ath10k/pci.h b/drivers/net/wireless/ath/ath10k/pci.h -index 480cd97ab739de..27bb4cf2dfea93 100644 ---- a/drivers/net/wireless/ath/ath10k/pci.h -+++ b/drivers/net/wireless/ath/ath10k/pci.h -@@ -2,6 +2,7 @@ - /* - * Copyright (c) 2005-2011 Atheros Communications Inc. - * Copyright (c) 2011-2017 Qualcomm Atheros, Inc. -+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #ifndef _PCI_H_ -diff --git a/drivers/net/wireless/ath/ath10k/qmi.c b/drivers/net/wireless/ath/ath10k/qmi.c -index 52c1a3de8da60a..38e939f572a9ed 100644 ---- a/drivers/net/wireless/ath/ath10k/qmi.c -+++ b/drivers/net/wireless/ath/ath10k/qmi.c -@@ -1,6 +1,7 @@ - // SPDX-License-Identifier: ISC - /* - * Copyright (c) 2018 The Linux Foundation. All rights reserved. -+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include -diff --git a/drivers/net/wireless/ath/ath10k/qmi_wlfw_v01.c b/drivers/net/wireless/ath/ath10k/qmi_wlfw_v01.c -index 1c81e454f943fd..0e85c75d227836 100644 ---- a/drivers/net/wireless/ath/ath10k/qmi_wlfw_v01.c -+++ b/drivers/net/wireless/ath/ath10k/qmi_wlfw_v01.c -@@ -1,6 +1,7 @@ - // SPDX-License-Identifier: ISC - /* - * Copyright (c) 2018 The Linux Foundation. All rights reserved. -+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include -diff --git a/drivers/net/wireless/ath/ath10k/qmi_wlfw_v01.h b/drivers/net/wireless/ath/ath10k/qmi_wlfw_v01.h -index f0db991408dc26..9f311f3bc9e7f9 100644 ---- a/drivers/net/wireless/ath/ath10k/qmi_wlfw_v01.h -+++ b/drivers/net/wireless/ath/ath10k/qmi_wlfw_v01.h -@@ -1,6 +1,7 @@ - /* SPDX-License-Identifier: ISC */ - /* - * Copyright (c) 2018 The Linux Foundation. All rights reserved. -+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #ifndef WCN3990_QMI_SVC_V01_H -diff --git a/drivers/net/wireless/ath/ath10k/rx_desc.h b/drivers/net/wireless/ath/ath10k/rx_desc.h -index 777e53aa69dc86..564293df1e9acf 100644 ---- a/drivers/net/wireless/ath/ath10k/rx_desc.h -+++ b/drivers/net/wireless/ath/ath10k/rx_desc.h -@@ -2,6 +2,7 @@ - /* - * Copyright (c) 2005-2011 Atheros Communications Inc. - * Copyright (c) 2011-2017 Qualcomm Atheros, Inc. -+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #ifndef _RX_DESC_H_ -diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c -index 56fbcfb80bf886..850d999615a2c3 100644 ---- a/drivers/net/wireless/ath/ath10k/sdio.c -+++ b/drivers/net/wireless/ath/ath10k/sdio.c -@@ -3,6 +3,7 @@ - * Copyright (c) 2004-2011 Atheros Communications Inc. - * Copyright (c) 2011-2012,2017 Qualcomm Atheros, Inc. - * Copyright (c) 2016-2017 Erik Stromdahl -+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include -@@ -2647,9 +2648,9 @@ static void ath10k_sdio_remove(struct sdio_func *func) - - netif_napi_del(&ar->napi); - -- ath10k_core_destroy(ar); -- - destroy_workqueue(ar_sdio->workqueue); -+ -+ ath10k_core_destroy(ar); - } - - static const struct sdio_device_id ath10k_sdio_devices[] = { -diff --git a/drivers/net/wireless/ath/ath10k/thermal.c b/drivers/net/wireless/ath/ath10k/thermal.c -index cefd97323dfe50..31c8d7fbb0955b 100644 ---- a/drivers/net/wireless/ath/ath10k/thermal.c -+++ b/drivers/net/wireless/ath/ath10k/thermal.c -@@ -1,6 +1,7 @@ - // SPDX-License-Identifier: ISC - /* - * Copyright (c) 2014-2015 Qualcomm Atheros, Inc. -+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include -diff --git a/drivers/net/wireless/ath/ath10k/usb.h b/drivers/net/wireless/ath/ath10k/usb.h -index 48e066ba816249..7e4cfbb673c9a8 100644 ---- a/drivers/net/wireless/ath/ath10k/usb.h -+++ b/drivers/net/wireless/ath/ath10k/usb.h -@@ -3,6 +3,7 @@ - * Copyright (c) 2004-2011 Atheros Communications Inc. - * Copyright (c) 2011-2012 Qualcomm Atheros, Inc. - * Copyright (c) 2016-2017 Erik Stromdahl -+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #ifndef _USB_H_ -diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.h b/drivers/net/wireless/ath/ath10k/wmi-tlv.h -index dbb48d70f2e93e..83a8f07a687f73 100644 ---- a/drivers/net/wireless/ath/ath10k/wmi-tlv.h -+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.h -@@ -3,6 +3,7 @@ - * Copyright (c) 2005-2011 Atheros Communications Inc. - * Copyright (c) 2011-2017 Qualcomm Atheros, Inc. - * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved. -+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. - */ - #ifndef _WMI_TLV_H - #define _WMI_TLV_H -diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c -index 1c21dbde77b84e..818aea99f85eb3 100644 ---- a/drivers/net/wireless/ath/ath10k/wmi.c -+++ b/drivers/net/wireless/ath/ath10k/wmi.c -@@ -3,6 +3,7 @@ - * Copyright (c) 2005-2011 Atheros Communications Inc. - * Copyright (c) 2011-2017 Qualcomm Atheros, Inc. - * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved. -+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include -diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h -index b112e88260931c..9146df98fceeee 100644 ---- a/drivers/net/wireless/ath/ath10k/wmi.h -+++ b/drivers/net/wireless/ath/ath10k/wmi.h -@@ -3,6 +3,7 @@ - * Copyright (c) 2005-2011 Atheros Communications Inc. - * Copyright (c) 2011-2017 Qualcomm Atheros, Inc. - * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved. -+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #ifndef _WMI_H_ -diff --git a/drivers/net/wireless/ath/ath10k/wow.c b/drivers/net/wireless/ath/ath10k/wow.c -index 20b9aa8ddf7d52..aa7b2e703f3d4b 100644 ---- a/drivers/net/wireless/ath/ath10k/wow.c -+++ b/drivers/net/wireless/ath/ath10k/wow.c -@@ -2,6 +2,7 @@ - /* - * Copyright (c) 2015-2017 Qualcomm Atheros, Inc. - * Copyright (c) 2018, The Linux Foundation. All rights reserved. -+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include "mac.h" -diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c -index f90191a290c26a..713899735ccc5e 100644 ---- a/drivers/net/wireless/ath/ath12k/mac.c -+++ b/drivers/net/wireless/ath/ath12k/mac.c -@@ -4945,7 +4945,7 @@ static void ath12k_mac_op_tx(struct ieee80211_hw *hw, - if (ret) { - ath12k_warn(ar->ab, "failed to queue management frame %d\n", - ret); -- ieee80211_free_txskb(ar->hw, skb); -+ ieee80211_free_txskb(hw, skb); - } - return; - } -@@ -4953,7 +4953,7 @@ static void ath12k_mac_op_tx(struct ieee80211_hw *hw, - ret = ath12k_dp_tx(ar, arvif, skb); - if (ret) { - ath12k_warn(ar->ab, "failed to transmit frame %d\n", ret); -- ieee80211_free_txskb(ar->hw, skb); -+ ieee80211_free_txskb(hw, skb); - } - } - -@@ -5496,7 +5496,7 @@ static int ath12k_mac_op_add_interface(struct ieee80211_hw *hw, - goto err_peer_del; - - param_id = WMI_VDEV_PARAM_RTS_THRESHOLD; -- param_value = ar->hw->wiphy->rts_threshold; -+ param_value = hw->wiphy->rts_threshold; - ret = ath12k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id, - param_id, param_value); - if (ret) { -@@ -6676,9 +6676,9 @@ ath12k_mac_op_set_bitrate_mask(struct ieee80211_hw *hw, - arvif->vdev_id, ret); - return ret; - } -- ieee80211_iterate_stations_atomic(ar->hw, -- ath12k_mac_disable_peer_fixed_rate, -- arvif); -+ ieee80211_iterate_stations_mtx(hw, -+ ath12k_mac_disable_peer_fixed_rate, -+ arvif); - } else if (ath12k_mac_bitrate_mask_get_single_nss(ar, band, mask, - &single_nss)) { - rate = WMI_FIXED_RATE_NONE; -@@ -6722,16 +6722,16 @@ ath12k_mac_op_set_bitrate_mask(struct ieee80211_hw *hw, - return -EINVAL; - } - -- ieee80211_iterate_stations_atomic(ar->hw, -- ath12k_mac_disable_peer_fixed_rate, -- arvif); -+ ieee80211_iterate_stations_mtx(hw, -+ ath12k_mac_disable_peer_fixed_rate, -+ arvif); - - mutex_lock(&ar->conf_mutex); - - arvif->bitrate_mask = *mask; -- ieee80211_iterate_stations_atomic(ar->hw, -- ath12k_mac_set_bitrate_mask_iter, -- arvif); -+ ieee80211_iterate_stations_mtx(hw, -+ ath12k_mac_set_bitrate_mask_iter, -+ arvif); - - mutex_unlock(&ar->conf_mutex); - } -@@ -6767,7 +6767,7 @@ ath12k_mac_op_reconfig_complete(struct ieee80211_hw *hw, - ath12k_warn(ar->ab, "pdev %d successfully recovered\n", - ar->pdev->pdev_id); - ar->state = ATH12K_STATE_ON; -- ieee80211_wake_queues(ar->hw); -+ ieee80211_wake_queues(hw); - - if (ab->is_reset) { - recovery_count = atomic_inc_return(&ab->recovery_count); -diff --git a/drivers/net/wireless/ath/ath12k/reg.c b/drivers/net/wireless/ath/ath12k/reg.c -index 32bdefeccc2453..837a3e1ec3a49c 100644 ---- a/drivers/net/wireless/ath/ath12k/reg.c -+++ b/drivers/net/wireless/ath/ath12k/reg.c -@@ -28,11 +28,11 @@ static const struct ieee80211_regdomain ath12k_world_regd = { - } - }; - --static bool ath12k_regdom_changes(struct ath12k *ar, char *alpha2) -+static bool ath12k_regdom_changes(struct ieee80211_hw *hw, char *alpha2) - { - const struct ieee80211_regdomain *regd; - -- regd = rcu_dereference_rtnl(ar->hw->wiphy->regd); -+ regd = rcu_dereference_rtnl(hw->wiphy->regd); - /* This can happen during wiphy registration where the previous - * user request is received before we update the regd received - * from firmware. -@@ -71,7 +71,7 @@ ath12k_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request) - return; - } - -- if (!ath12k_regdom_changes(ar, request->alpha2)) { -+ if (!ath12k_regdom_changes(hw, request->alpha2)) { - ath12k_dbg(ar->ab, ATH12K_DBG_REG, "Country is already set\n"); - return; - } -diff --git a/drivers/net/wireless/realtek/rtw88/sdio.c b/drivers/net/wireless/realtek/rtw88/sdio.c -index 0cae5746f540fa..5bd1ee81210d1d 100644 ---- a/drivers/net/wireless/realtek/rtw88/sdio.c -+++ b/drivers/net/wireless/realtek/rtw88/sdio.c -@@ -1295,12 +1295,12 @@ static void rtw_sdio_deinit_tx(struct rtw_dev *rtwdev) - struct rtw_sdio *rtwsdio = (struct rtw_sdio *)rtwdev->priv; - int i; - -- for (i = 0; i < RTK_MAX_TX_QUEUE_NUM; i++) -- skb_queue_purge(&rtwsdio->tx_queue[i]); -- - flush_workqueue(rtwsdio->txwq); - destroy_workqueue(rtwsdio->txwq); - kfree(rtwsdio->tx_handler_data); -+ -+ for (i = 0; i < RTK_MAX_TX_QUEUE_NUM; i++) -+ ieee80211_purge_tx_queue(rtwdev->hw, &rtwsdio->tx_queue[i]); - } - - int rtw_sdio_probe(struct sdio_func *sdio_func, -diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c -index 04a64afcbf8a2d..8f1d653282b7ec 100644 ---- a/drivers/net/wireless/realtek/rtw88/usb.c -+++ b/drivers/net/wireless/realtek/rtw88/usb.c -@@ -416,10 +416,11 @@ static void rtw_usb_tx_handler(struct work_struct *work) - - static void rtw_usb_tx_queue_purge(struct rtw_usb *rtwusb) - { -+ struct rtw_dev *rtwdev = rtwusb->rtwdev; - int i; - - for (i = 0; i < ARRAY_SIZE(rtwusb->tx_queue); i++) -- skb_queue_purge(&rtwusb->tx_queue[i]); -+ ieee80211_purge_tx_queue(rtwdev->hw, &rtwusb->tx_queue[i]); - } - - static void rtw_usb_write_port_complete(struct urb *urb) -@@ -801,9 +802,9 @@ static void rtw_usb_deinit_tx(struct rtw_dev *rtwdev) - { - struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev); - -- rtw_usb_tx_queue_purge(rtwusb); - flush_workqueue(rtwusb->txwq); - destroy_workqueue(rtwusb->txwq); -+ rtw_usb_tx_queue_purge(rtwusb); - } - - static int rtw_usb_intf_init(struct rtw_dev *rtwdev, -diff --git a/drivers/net/wwan/iosm/iosm_ipc_mmio.c b/drivers/net/wwan/iosm/iosm_ipc_mmio.c -index 63eb08c43c0517..6764c13530b9bd 100644 ---- a/drivers/net/wwan/iosm/iosm_ipc_mmio.c -+++ b/drivers/net/wwan/iosm/iosm_ipc_mmio.c -@@ -104,7 +104,7 @@ struct iosm_mmio *ipc_mmio_init(void __iomem *mmio, struct device *dev) - break; - - msleep(20); -- } while (retries-- > 0); -+ } while (--retries > 0); - - if (!retries) { - dev_err(ipc_mmio->dev, "invalid exec stage %X", stage); -diff --git a/drivers/net/wwan/t7xx/t7xx_state_monitor.c b/drivers/net/wwan/t7xx/t7xx_state_monitor.c -index 80edb8e75a6ad7..64868df3640d13 100644 ---- a/drivers/net/wwan/t7xx/t7xx_state_monitor.c -+++ b/drivers/net/wwan/t7xx/t7xx_state_monitor.c -@@ -97,14 +97,21 @@ void t7xx_fsm_broadcast_state(struct t7xx_fsm_ctl *ctl, enum md_state state) - fsm_state_notify(ctl->md, state); - } - -+static void fsm_release_command(struct kref *ref) -+{ -+ struct t7xx_fsm_command *cmd = container_of(ref, typeof(*cmd), refcnt); -+ -+ kfree(cmd); -+} -+ - static void fsm_finish_command(struct t7xx_fsm_ctl *ctl, struct t7xx_fsm_command *cmd, int result) - { - if (cmd->flag & FSM_CMD_FLAG_WAIT_FOR_COMPLETION) { -- *cmd->ret = result; -- complete_all(cmd->done); -+ cmd->result = result; -+ complete_all(&cmd->done); - } - -- kfree(cmd); -+ kref_put(&cmd->refcnt, fsm_release_command); - } - - static void fsm_del_kf_event(struct t7xx_fsm_event *event) -@@ -396,7 +403,6 @@ static int fsm_main_thread(void *data) - - int t7xx_fsm_append_cmd(struct t7xx_fsm_ctl *ctl, enum t7xx_fsm_cmd_state cmd_id, unsigned int flag) - { -- DECLARE_COMPLETION_ONSTACK(done); - struct t7xx_fsm_command *cmd; - unsigned long flags; - int ret; -@@ -408,11 +414,13 @@ int t7xx_fsm_append_cmd(struct t7xx_fsm_ctl *ctl, enum t7xx_fsm_cmd_state cmd_id - INIT_LIST_HEAD(&cmd->entry); - cmd->cmd_id = cmd_id; - cmd->flag = flag; -+ kref_init(&cmd->refcnt); - if (flag & FSM_CMD_FLAG_WAIT_FOR_COMPLETION) { -- cmd->done = &done; -- cmd->ret = &ret; -+ init_completion(&cmd->done); -+ kref_get(&cmd->refcnt); - } - -+ kref_get(&cmd->refcnt); - spin_lock_irqsave(&ctl->command_lock, flags); - list_add_tail(&cmd->entry, &ctl->command_queue); - spin_unlock_irqrestore(&ctl->command_lock, flags); -@@ -422,11 +430,11 @@ int t7xx_fsm_append_cmd(struct t7xx_fsm_ctl *ctl, enum t7xx_fsm_cmd_state cmd_id - if (flag & FSM_CMD_FLAG_WAIT_FOR_COMPLETION) { - unsigned long wait_ret; - -- wait_ret = wait_for_completion_timeout(&done, -+ wait_ret = wait_for_completion_timeout(&cmd->done, - msecs_to_jiffies(FSM_CMD_TIMEOUT_MS)); -- if (!wait_ret) -- return -ETIMEDOUT; - -+ ret = wait_ret ? cmd->result : -ETIMEDOUT; -+ kref_put(&cmd->refcnt, fsm_release_command); - return ret; - } - -diff --git a/drivers/net/wwan/t7xx/t7xx_state_monitor.h b/drivers/net/wwan/t7xx/t7xx_state_monitor.h -index b6e76f3903c892..74f96fd2605e8e 100644 ---- a/drivers/net/wwan/t7xx/t7xx_state_monitor.h -+++ b/drivers/net/wwan/t7xx/t7xx_state_monitor.h -@@ -109,8 +109,9 @@ struct t7xx_fsm_command { - struct list_head entry; - enum t7xx_fsm_cmd_state cmd_id; - unsigned int flag; -- struct completion *done; -- int *ret; -+ struct completion done; -+ int result; -+ struct kref refcnt; - }; - - struct t7xx_fsm_notifier { -diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c -index 5b6a6bd4e6e800..4aad16390d4790 100644 ---- a/drivers/nvme/host/core.c -+++ b/drivers/nvme/host/core.c -@@ -1178,13 +1178,13 @@ static void nvme_queue_keep_alive_work(struct nvme_ctrl *ctrl) - nvme_keep_alive_work_period(ctrl)); - } - --static void nvme_keep_alive_finish(struct request *rq, -- blk_status_t status, struct nvme_ctrl *ctrl) -+static enum rq_end_io_ret nvme_keep_alive_end_io(struct request *rq, -+ blk_status_t status) - { -- unsigned long flags; -- bool startka = false; -+ struct nvme_ctrl *ctrl = rq->end_io_data; - unsigned long rtt = jiffies - (rq->deadline - rq->timeout); - unsigned long delay = nvme_keep_alive_work_period(ctrl); -+ enum nvme_ctrl_state state = nvme_ctrl_state(ctrl); - - /* - * Subtract off the keepalive RTT so nvme_keep_alive_work runs -@@ -1198,22 +1198,20 @@ static void nvme_keep_alive_finish(struct request *rq, - delay = 0; - } - -+ blk_mq_free_request(rq); -+ - if (status) { - dev_err(ctrl->device, - "failed nvme_keep_alive_end_io error=%d\n", - status); -- return; -+ return RQ_END_IO_NONE; - } - - ctrl->ka_last_check_time = jiffies; - ctrl->comp_seen = false; -- spin_lock_irqsave(&ctrl->lock, flags); -- if (ctrl->state == NVME_CTRL_LIVE || -- ctrl->state == NVME_CTRL_CONNECTING) -- startka = true; -- spin_unlock_irqrestore(&ctrl->lock, flags); -- if (startka) -+ if (state == NVME_CTRL_LIVE || state == NVME_CTRL_CONNECTING) - queue_delayed_work(nvme_wq, &ctrl->ka_work, delay); -+ return RQ_END_IO_NONE; - } - - static void nvme_keep_alive_work(struct work_struct *work) -@@ -1222,7 +1220,6 @@ static void nvme_keep_alive_work(struct work_struct *work) - struct nvme_ctrl, ka_work); - bool comp_seen = ctrl->comp_seen; - struct request *rq; -- blk_status_t status; - - ctrl->ka_last_check_time = jiffies; - -@@ -1245,9 +1242,9 @@ static void nvme_keep_alive_work(struct work_struct *work) - nvme_init_request(rq, &ctrl->ka_cmd); - - rq->timeout = ctrl->kato * HZ; -- status = blk_execute_rq(rq, false); -- nvme_keep_alive_finish(rq, status, ctrl); -- blk_mq_free_request(rq); -+ rq->end_io = nvme_keep_alive_end_io; -+ rq->end_io_data = ctrl; -+ blk_execute_rq_nowait(rq, false); - } - - static void nvme_start_keep_alive(struct nvme_ctrl *ctrl) -diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h -index bddc068d58c7ea..e867ac859a878e 100644 ---- a/drivers/nvme/host/nvme.h -+++ b/drivers/nvme/host/nvme.h -@@ -172,6 +172,11 @@ enum nvme_quirks { - * MSI (but not MSI-X) interrupts are broken and never fire. - */ - NVME_QUIRK_BROKEN_MSI = (1 << 21), -+ -+ /* -+ * Align dma pool segment size to 512 bytes -+ */ -+ NVME_QUIRK_DMAPOOL_ALIGN_512 = (1 << 22), - }; - - /* -diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c -index d525fa1229d791..52c8fd3d5c4796 100644 ---- a/drivers/nvme/host/pci.c -+++ b/drivers/nvme/host/pci.c -@@ -2653,15 +2653,20 @@ static int nvme_disable_prepare_reset(struct nvme_dev *dev, bool shutdown) - - static int nvme_setup_prp_pools(struct nvme_dev *dev) - { -+ size_t small_align = 256; -+ - dev->prp_page_pool = dma_pool_create("prp list page", dev->dev, - NVME_CTRL_PAGE_SIZE, - NVME_CTRL_PAGE_SIZE, 0); - if (!dev->prp_page_pool) - return -ENOMEM; - -+ if (dev->ctrl.quirks & NVME_QUIRK_DMAPOOL_ALIGN_512) -+ small_align = 512; -+ - /* Optimisation for I/Os between 4k and 128k */ - dev->prp_small_pool = dma_pool_create("prp list 256", dev->dev, -- 256, 256, 0); -+ 256, small_align, 0); - if (!dev->prp_small_pool) { - dma_pool_destroy(dev->prp_page_pool); - return -ENOMEM; -@@ -3403,7 +3408,7 @@ static const struct pci_device_id nvme_id_table[] = { - { PCI_VDEVICE(REDHAT, 0x0010), /* Qemu emulated controller */ - .driver_data = NVME_QUIRK_BOGUS_NID, }, - { PCI_DEVICE(0x1217, 0x8760), /* O2 Micro 64GB Steam Deck */ -- .driver_data = NVME_QUIRK_QDEPTH_ONE }, -+ .driver_data = NVME_QUIRK_DMAPOOL_ALIGN_512, }, - { PCI_DEVICE(0x126f, 0x2262), /* Silicon Motion generic */ - .driver_data = NVME_QUIRK_NO_DEEPEST_PS | - NVME_QUIRK_BOGUS_NID, }, -diff --git a/drivers/of/address.c b/drivers/of/address.c -index dfd05cb2b2fcfa..34d880a1be0a5e 100644 ---- a/drivers/of/address.c -+++ b/drivers/of/address.c -@@ -46,7 +46,7 @@ struct of_bus { - u64 (*map)(__be32 *addr, const __be32 *range, - int na, int ns, int pna); - int (*translate)(__be32 *addr, u64 offset, int na); -- bool has_flags; -+ int flag_cells; - unsigned int (*get_flags)(const __be32 *addr); - }; - -@@ -217,10 +217,6 @@ static u64 of_bus_pci_map(__be32 *addr, const __be32 *range, int na, int ns, - return da - cp; - } - --static int of_bus_pci_translate(__be32 *addr, u64 offset, int na) --{ -- return of_bus_default_translate(addr + 1, offset, na - 1); --} - #endif /* CONFIG_PCI */ - - /* -@@ -344,11 +340,6 @@ static u64 of_bus_isa_map(__be32 *addr, const __be32 *range, int na, int ns, - return da - cp; - } - --static int of_bus_isa_translate(__be32 *addr, u64 offset, int na) --{ -- return of_bus_default_translate(addr + 1, offset, na - 1); --} -- - static unsigned int of_bus_isa_get_flags(const __be32 *addr) - { - unsigned int flags = 0; -@@ -379,8 +370,8 @@ static struct of_bus of_busses[] = { - .match = of_bus_pci_match, - .count_cells = of_bus_pci_count_cells, - .map = of_bus_pci_map, -- .translate = of_bus_pci_translate, -- .has_flags = true, -+ .translate = of_bus_default_flags_translate, -+ .flag_cells = 1, - .get_flags = of_bus_pci_get_flags, - }, - #endif /* CONFIG_PCI */ -@@ -391,8 +382,8 @@ static struct of_bus of_busses[] = { - .match = of_bus_isa_match, - .count_cells = of_bus_isa_count_cells, - .map = of_bus_isa_map, -- .translate = of_bus_isa_translate, -- .has_flags = true, -+ .translate = of_bus_default_flags_translate, -+ .flag_cells = 1, - .get_flags = of_bus_isa_get_flags, - }, - /* Default with flags cell */ -@@ -403,7 +394,7 @@ static struct of_bus of_busses[] = { - .count_cells = of_bus_default_count_cells, - .map = of_bus_default_flags_map, - .translate = of_bus_default_flags_translate, -- .has_flags = true, -+ .flag_cells = 1, - .get_flags = of_bus_default_flags_get_flags, - }, - /* Default */ -@@ -485,7 +476,8 @@ static int of_translate_one(struct device_node *parent, struct of_bus *bus, - } - if (ranges == NULL || rlen == 0) { - offset = of_read_number(addr, na); -- memset(addr, 0, pna * 4); -+ /* set address to zero, pass flags through */ -+ memset(addr + pbus->flag_cells, 0, (pna - pbus->flag_cells) * 4); - pr_debug("empty ranges; 1:1 translation\n"); - goto finish; - } -@@ -836,7 +828,7 @@ struct of_pci_range *of_pci_range_parser_one(struct of_pci_range_parser *parser, - int na = parser->na; - int ns = parser->ns; - int np = parser->pna + na + ns; -- int busflag_na = 0; -+ int busflag_na = parser->bus->flag_cells; - - if (!range) - return NULL; -@@ -846,10 +838,6 @@ struct of_pci_range *of_pci_range_parser_one(struct of_pci_range_parser *parser, - - range->flags = parser->bus->get_flags(parser->range); - -- /* A extra cell for resource flags */ -- if (parser->bus->has_flags) -- busflag_na = 1; -- - range->bus_addr = of_read_number(parser->range + busflag_na, na - busflag_na); - - if (parser->dma) -diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c -index 4551575e4e7d7d..fd97b6ee2a8d11 100644 ---- a/drivers/pinctrl/pinctrl-mcp23s08.c -+++ b/drivers/pinctrl/pinctrl-mcp23s08.c -@@ -86,6 +86,7 @@ const struct regmap_config mcp23x08_regmap = { - .num_reg_defaults = ARRAY_SIZE(mcp23x08_defaults), - .cache_type = REGCACHE_FLAT, - .max_register = MCP_OLAT, -+ .disable_locking = true, /* mcp->lock protects the regmap */ - }; - EXPORT_SYMBOL_GPL(mcp23x08_regmap); - -@@ -132,6 +133,7 @@ const struct regmap_config mcp23x17_regmap = { - .num_reg_defaults = ARRAY_SIZE(mcp23x17_defaults), - .cache_type = REGCACHE_FLAT, - .val_format_endian = REGMAP_ENDIAN_LITTLE, -+ .disable_locking = true, /* mcp->lock protects the regmap */ - }; - EXPORT_SYMBOL_GPL(mcp23x17_regmap); - -@@ -228,7 +230,9 @@ static int mcp_pinconf_get(struct pinctrl_dev *pctldev, unsigned int pin, - - switch (param) { - case PIN_CONFIG_BIAS_PULL_UP: -+ mutex_lock(&mcp->lock); - ret = mcp_read(mcp, MCP_GPPU, &data); -+ mutex_unlock(&mcp->lock); - if (ret < 0) - return ret; - status = (data & BIT(pin)) ? 1 : 0; -@@ -257,7 +261,9 @@ static int mcp_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin, - - switch (param) { - case PIN_CONFIG_BIAS_PULL_UP: -+ mutex_lock(&mcp->lock); - ret = mcp_set_bit(mcp, MCP_GPPU, pin, arg); -+ mutex_unlock(&mcp->lock); - break; - default: - dev_dbg(mcp->dev, "Invalid config param %04x\n", param); -diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c -index a2ffe4157df10c..b8d77adc9ea145 100644 ---- a/drivers/platform/x86/mlx-platform.c -+++ b/drivers/platform/x86/mlx-platform.c -@@ -6237,6 +6237,7 @@ mlxplat_pci_fpga_device_init(unsigned int device, const char *res_name, struct p - fail_pci_request_regions: - pci_disable_device(pci_dev); - fail_pci_enable_device: -+ pci_dev_put(pci_dev); - return err; - } - -@@ -6247,6 +6248,7 @@ mlxplat_pci_fpga_device_exit(struct pci_dev *pci_bridge, - iounmap(pci_bridge_addr); - pci_release_regions(pci_bridge); - pci_disable_device(pci_bridge); -+ pci_dev_put(pci_bridge); - } - - static int -diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c -index 6235721f2c1aec..fd6bf9e77afcb8 100644 ---- a/drivers/remoteproc/qcom_q6v5_pas.c -+++ b/drivers/remoteproc/qcom_q6v5_pas.c -@@ -786,6 +786,23 @@ static const struct adsp_data adsp_resource_init = { - .ssctl_id = 0x14, - }; - -+static const struct adsp_data sa8775p_adsp_resource = { -+ .crash_reason_smem = 423, -+ .firmware_name = "adsp.mbn", -+ .pas_id = 1, -+ .minidump_id = 5, -+ .auto_boot = true, -+ .proxy_pd_names = (char*[]){ -+ "lcx", -+ "lmx", -+ NULL -+ }, -+ .load_state = "adsp", -+ .ssr_name = "lpass", -+ .sysmon_name = "adsp", -+ .ssctl_id = 0x14, -+}; -+ - static const struct adsp_data sdm845_adsp_resource_init = { - .crash_reason_smem = 423, - .firmware_name = "adsp.mdt", -@@ -885,6 +902,42 @@ static const struct adsp_data cdsp_resource_init = { - .ssctl_id = 0x17, - }; - -+static const struct adsp_data sa8775p_cdsp0_resource = { -+ .crash_reason_smem = 601, -+ .firmware_name = "cdsp0.mbn", -+ .pas_id = 18, -+ .minidump_id = 7, -+ .auto_boot = true, -+ .proxy_pd_names = (char*[]){ -+ "cx", -+ "mxc", -+ "nsp", -+ NULL -+ }, -+ .load_state = "cdsp", -+ .ssr_name = "cdsp", -+ .sysmon_name = "cdsp", -+ .ssctl_id = 0x17, -+}; -+ -+static const struct adsp_data sa8775p_cdsp1_resource = { -+ .crash_reason_smem = 633, -+ .firmware_name = "cdsp1.mbn", -+ .pas_id = 30, -+ .minidump_id = 20, -+ .auto_boot = true, -+ .proxy_pd_names = (char*[]){ -+ "cx", -+ "mxc", -+ "nsp", -+ NULL -+ }, -+ .load_state = "nsp", -+ .ssr_name = "cdsp1", -+ .sysmon_name = "cdsp1", -+ .ssctl_id = 0x20, -+}; -+ - static const struct adsp_data sdm845_cdsp_resource_init = { - .crash_reason_smem = 601, - .firmware_name = "cdsp.mdt", -@@ -987,6 +1040,40 @@ static const struct adsp_data sm8350_cdsp_resource = { - .ssctl_id = 0x17, - }; - -+static const struct adsp_data sa8775p_gpdsp0_resource = { -+ .crash_reason_smem = 640, -+ .firmware_name = "gpdsp0.mbn", -+ .pas_id = 39, -+ .minidump_id = 21, -+ .auto_boot = true, -+ .proxy_pd_names = (char*[]){ -+ "cx", -+ "mxc", -+ NULL -+ }, -+ .load_state = "gpdsp0", -+ .ssr_name = "gpdsp0", -+ .sysmon_name = "gpdsp0", -+ .ssctl_id = 0x21, -+}; -+ -+static const struct adsp_data sa8775p_gpdsp1_resource = { -+ .crash_reason_smem = 641, -+ .firmware_name = "gpdsp1.mbn", -+ .pas_id = 40, -+ .minidump_id = 22, -+ .auto_boot = true, -+ .proxy_pd_names = (char*[]){ -+ "cx", -+ "mxc", -+ NULL -+ }, -+ .load_state = "gpdsp1", -+ .ssr_name = "gpdsp1", -+ .sysmon_name = "gpdsp1", -+ .ssctl_id = 0x22, -+}; -+ - static const struct adsp_data mpss_resource_init = { - .crash_reason_smem = 421, - .firmware_name = "modem.mdt", -@@ -1163,6 +1250,13 @@ static const struct of_device_id adsp_of_match[] = { - { .compatible = "qcom,qcs404-adsp-pas", .data = &adsp_resource_init }, - { .compatible = "qcom,qcs404-cdsp-pas", .data = &cdsp_resource_init }, - { .compatible = "qcom,qcs404-wcss-pas", .data = &wcss_resource_init }, -+ { .compatible = "qcom,sa8775p-adsp-pas", .data = &sa8775p_adsp_resource}, -+ { .compatible = "qcom,sa8775p-cdsp0-pas", .data = &sa8775p_cdsp0_resource}, -+ { .compatible = "qcom,sa8775p-cdsp1-pas", .data = &sa8775p_cdsp1_resource}, -+ { .compatible = "qcom,sa8775p-gpdsp0-pas", .data = &sa8775p_gpdsp0_resource}, -+ { .compatible = "qcom,sa8775p-gpdsp1-pas", .data = &sa8775p_gpdsp1_resource}, -+ { .compatible = "qcom,sar2130p-adsp-pas", .data = &sm8350_adsp_resource}, -+ { .compatible = "qcom,sc7180-adsp-pas", .data = &sm8250_adsp_resource}, - { .compatible = "qcom,sc7180-mpss-pas", .data = &mpss_resource_init}, - { .compatible = "qcom,sc7280-mpss-pas", .data = &mpss_resource_init}, - { .compatible = "qcom,sc8180x-adsp-pas", .data = &sm8150_adsp_resource}, -diff --git a/drivers/scsi/hisi_sas/hisi_sas.h b/drivers/scsi/hisi_sas/hisi_sas.h -index 9e73e9cbbcfc6c..1e4550156b735d 100644 ---- a/drivers/scsi/hisi_sas/hisi_sas.h -+++ b/drivers/scsi/hisi_sas/hisi_sas.h -@@ -343,7 +343,7 @@ struct hisi_sas_hw { - u8 reg_index, u8 reg_count, u8 *write_data); - void (*wait_cmds_complete_timeout)(struct hisi_hba *hisi_hba, - int delay_ms, int timeout_ms); -- void (*debugfs_snapshot_regs)(struct hisi_hba *hisi_hba); -+ int (*debugfs_snapshot_regs)(struct hisi_hba *hisi_hba); - int complete_hdr_size; - const struct scsi_host_template *sht; - }; -@@ -451,7 +451,6 @@ struct hisi_hba { - const struct hisi_sas_hw *hw; /* Low level hw interface */ - unsigned long sata_dev_bitmap[BITS_TO_LONGS(HISI_SAS_MAX_DEVICES)]; - struct work_struct rst_work; -- struct work_struct debugfs_work; - u32 phy_state; - u32 intr_coal_ticks; /* Time of interrupt coalesce in us */ - u32 intr_coal_count; /* Interrupt count to coalesce */ -diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c -index db9ae206974c21..f78c5f8a49ffac 100644 ---- a/drivers/scsi/hisi_sas/hisi_sas_main.c -+++ b/drivers/scsi/hisi_sas/hisi_sas_main.c -@@ -1579,7 +1579,7 @@ static int hisi_sas_controller_prereset(struct hisi_hba *hisi_hba) - return -EPERM; - } - -- if (hisi_sas_debugfs_enable && hisi_hba->debugfs_itct[0].itct) -+ if (hisi_sas_debugfs_enable) - hisi_hba->hw->debugfs_snapshot_regs(hisi_hba); - - return 0; -@@ -1967,8 +1967,19 @@ static bool hisi_sas_internal_abort_timeout(struct sas_task *task, - struct hisi_hba *hisi_hba = dev_to_hisi_hba(device); - struct hisi_sas_internal_abort_data *timeout = data; - -- if (hisi_sas_debugfs_enable && hisi_hba->debugfs_itct[0].itct) -- queue_work(hisi_hba->wq, &hisi_hba->debugfs_work); -+ if (hisi_sas_debugfs_enable) { -+ /* -+ * If timeout occurs in device gone scenario, to avoid -+ * circular dependency like: -+ * hisi_sas_dev_gone() -> down() -> ... -> -+ * hisi_sas_internal_abort_timeout() -> down(). -+ */ -+ if (!timeout->rst_ha_timeout) -+ down(&hisi_hba->sem); -+ hisi_hba->hw->debugfs_snapshot_regs(hisi_hba); -+ if (!timeout->rst_ha_timeout) -+ up(&hisi_hba->sem); -+ } - - if (task->task_state_flags & SAS_TASK_STATE_DONE) { - pr_err("Internal abort: timeout %016llx\n", -diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -index 4054659d48f74c..ff5f86867dbf06 100644 ---- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -@@ -558,8 +558,7 @@ static int experimental_iopoll_q_cnt; - module_param(experimental_iopoll_q_cnt, int, 0444); - MODULE_PARM_DESC(experimental_iopoll_q_cnt, "number of queues to be used as poll mode, def=0"); - --static void debugfs_work_handler_v3_hw(struct work_struct *work); --static void debugfs_snapshot_regs_v3_hw(struct hisi_hba *hisi_hba); -+static int debugfs_snapshot_regs_v3_hw(struct hisi_hba *hisi_hba); - - static u32 hisi_sas_read32(struct hisi_hba *hisi_hba, u32 off) - { -@@ -3397,7 +3396,6 @@ hisi_sas_shost_alloc_pci(struct pci_dev *pdev) - hisi_hba = shost_priv(shost); - - INIT_WORK(&hisi_hba->rst_work, hisi_sas_rst_work_handler); -- INIT_WORK(&hisi_hba->debugfs_work, debugfs_work_handler_v3_hw); - hisi_hba->hw = &hisi_sas_v3_hw; - hisi_hba->pci_dev = pdev; - hisi_hba->dev = dev; -@@ -3562,6 +3560,11 @@ debugfs_to_reg_name_v3_hw(int off, int base_off, - return NULL; - } - -+static bool debugfs_dump_is_generated_v3_hw(void *p) -+{ -+ return p ? true : false; -+} -+ - static void debugfs_print_reg_v3_hw(u32 *regs_val, struct seq_file *s, - const struct hisi_sas_debugfs_reg *reg) - { -@@ -3587,6 +3590,9 @@ static int debugfs_global_v3_hw_show(struct seq_file *s, void *p) - { - struct hisi_sas_debugfs_regs *global = s->private; - -+ if (!debugfs_dump_is_generated_v3_hw(global->data)) -+ return -EPERM; -+ - debugfs_print_reg_v3_hw(global->data, s, - &debugfs_global_reg); - -@@ -3598,6 +3604,9 @@ static int debugfs_axi_v3_hw_show(struct seq_file *s, void *p) - { - struct hisi_sas_debugfs_regs *axi = s->private; - -+ if (!debugfs_dump_is_generated_v3_hw(axi->data)) -+ return -EPERM; -+ - debugfs_print_reg_v3_hw(axi->data, s, - &debugfs_axi_reg); - -@@ -3609,6 +3618,9 @@ static int debugfs_ras_v3_hw_show(struct seq_file *s, void *p) - { - struct hisi_sas_debugfs_regs *ras = s->private; - -+ if (!debugfs_dump_is_generated_v3_hw(ras->data)) -+ return -EPERM; -+ - debugfs_print_reg_v3_hw(ras->data, s, - &debugfs_ras_reg); - -@@ -3621,6 +3633,9 @@ static int debugfs_port_v3_hw_show(struct seq_file *s, void *p) - struct hisi_sas_debugfs_port *port = s->private; - const struct hisi_sas_debugfs_reg *reg_port = &debugfs_port_reg; - -+ if (!debugfs_dump_is_generated_v3_hw(port->data)) -+ return -EPERM; -+ - debugfs_print_reg_v3_hw(port->data, s, reg_port); - - return 0; -@@ -3676,6 +3691,9 @@ static int debugfs_cq_v3_hw_show(struct seq_file *s, void *p) - struct hisi_sas_debugfs_cq *debugfs_cq = s->private; - int slot; - -+ if (!debugfs_dump_is_generated_v3_hw(debugfs_cq->complete_hdr)) -+ return -EPERM; -+ - for (slot = 0; slot < HISI_SAS_QUEUE_SLOTS; slot++) - debugfs_cq_show_slot_v3_hw(s, slot, debugfs_cq); - -@@ -3697,8 +3715,12 @@ static void debugfs_dq_show_slot_v3_hw(struct seq_file *s, int slot, - - static int debugfs_dq_v3_hw_show(struct seq_file *s, void *p) - { -+ struct hisi_sas_debugfs_dq *debugfs_dq = s->private; - int slot; - -+ if (!debugfs_dump_is_generated_v3_hw(debugfs_dq->hdr)) -+ return -EPERM; -+ - for (slot = 0; slot < HISI_SAS_QUEUE_SLOTS; slot++) - debugfs_dq_show_slot_v3_hw(s, slot, s->private); - -@@ -3712,6 +3734,9 @@ static int debugfs_iost_v3_hw_show(struct seq_file *s, void *p) - struct hisi_sas_iost *iost = debugfs_iost->iost; - int i, max_command_entries = HISI_SAS_MAX_COMMANDS; - -+ if (!debugfs_dump_is_generated_v3_hw(iost)) -+ return -EPERM; -+ - for (i = 0; i < max_command_entries; i++, iost++) { - __le64 *data = &iost->qw0; - -@@ -3731,6 +3756,9 @@ static int debugfs_iost_cache_v3_hw_show(struct seq_file *s, void *p) - int i, tab_idx; - __le64 *iost; - -+ if (!debugfs_dump_is_generated_v3_hw(iost_cache)) -+ return -EPERM; -+ - for (i = 0; i < HISI_SAS_IOST_ITCT_CACHE_NUM; i++, iost_cache++) { - /* - * Data struct of IOST cache: -@@ -3754,6 +3782,9 @@ static int debugfs_itct_v3_hw_show(struct seq_file *s, void *p) - struct hisi_sas_debugfs_itct *debugfs_itct = s->private; - struct hisi_sas_itct *itct = debugfs_itct->itct; - -+ if (!debugfs_dump_is_generated_v3_hw(itct)) -+ return -EPERM; -+ - for (i = 0; i < HISI_SAS_MAX_ITCT_ENTRIES; i++, itct++) { - __le64 *data = &itct->qw0; - -@@ -3773,6 +3804,9 @@ static int debugfs_itct_cache_v3_hw_show(struct seq_file *s, void *p) - int i, tab_idx; - __le64 *itct; - -+ if (!debugfs_dump_is_generated_v3_hw(itct_cache)) -+ return -EPERM; -+ - for (i = 0; i < HISI_SAS_IOST_ITCT_CACHE_NUM; i++, itct_cache++) { - /* - * Data struct of ITCT cache: -@@ -3790,10 +3824,9 @@ static int debugfs_itct_cache_v3_hw_show(struct seq_file *s, void *p) - } - DEFINE_SHOW_ATTRIBUTE(debugfs_itct_cache_v3_hw); - --static void debugfs_create_files_v3_hw(struct hisi_hba *hisi_hba) -+static void debugfs_create_files_v3_hw(struct hisi_hba *hisi_hba, int index) - { - u64 *debugfs_timestamp; -- int dump_index = hisi_hba->debugfs_dump_index; - struct dentry *dump_dentry; - struct dentry *dentry; - char name[256]; -@@ -3801,17 +3834,17 @@ static void debugfs_create_files_v3_hw(struct hisi_hba *hisi_hba) - int c; - int d; - -- snprintf(name, 256, "%d", dump_index); -+ snprintf(name, 256, "%d", index); - - dump_dentry = debugfs_create_dir(name, hisi_hba->debugfs_dump_dentry); - -- debugfs_timestamp = &hisi_hba->debugfs_timestamp[dump_index]; -+ debugfs_timestamp = &hisi_hba->debugfs_timestamp[index]; - - debugfs_create_u64("timestamp", 0400, dump_dentry, - debugfs_timestamp); - - debugfs_create_file("global", 0400, dump_dentry, -- &hisi_hba->debugfs_regs[dump_index][DEBUGFS_GLOBAL], -+ &hisi_hba->debugfs_regs[index][DEBUGFS_GLOBAL], - &debugfs_global_v3_hw_fops); - - /* Create port dir and files */ -@@ -3820,7 +3853,7 @@ static void debugfs_create_files_v3_hw(struct hisi_hba *hisi_hba) - snprintf(name, 256, "%d", p); - - debugfs_create_file(name, 0400, dentry, -- &hisi_hba->debugfs_port_reg[dump_index][p], -+ &hisi_hba->debugfs_port_reg[index][p], - &debugfs_port_v3_hw_fops); - } - -@@ -3830,7 +3863,7 @@ static void debugfs_create_files_v3_hw(struct hisi_hba *hisi_hba) - snprintf(name, 256, "%d", c); - - debugfs_create_file(name, 0400, dentry, -- &hisi_hba->debugfs_cq[dump_index][c], -+ &hisi_hba->debugfs_cq[index][c], - &debugfs_cq_v3_hw_fops); - } - -@@ -3840,66 +3873,35 @@ static void debugfs_create_files_v3_hw(struct hisi_hba *hisi_hba) - snprintf(name, 256, "%d", d); - - debugfs_create_file(name, 0400, dentry, -- &hisi_hba->debugfs_dq[dump_index][d], -+ &hisi_hba->debugfs_dq[index][d], - &debugfs_dq_v3_hw_fops); - } - - debugfs_create_file("iost", 0400, dump_dentry, -- &hisi_hba->debugfs_iost[dump_index], -+ &hisi_hba->debugfs_iost[index], - &debugfs_iost_v3_hw_fops); - - debugfs_create_file("iost_cache", 0400, dump_dentry, -- &hisi_hba->debugfs_iost_cache[dump_index], -+ &hisi_hba->debugfs_iost_cache[index], - &debugfs_iost_cache_v3_hw_fops); - - debugfs_create_file("itct", 0400, dump_dentry, -- &hisi_hba->debugfs_itct[dump_index], -+ &hisi_hba->debugfs_itct[index], - &debugfs_itct_v3_hw_fops); - - debugfs_create_file("itct_cache", 0400, dump_dentry, -- &hisi_hba->debugfs_itct_cache[dump_index], -+ &hisi_hba->debugfs_itct_cache[index], - &debugfs_itct_cache_v3_hw_fops); - - debugfs_create_file("axi", 0400, dump_dentry, -- &hisi_hba->debugfs_regs[dump_index][DEBUGFS_AXI], -+ &hisi_hba->debugfs_regs[index][DEBUGFS_AXI], - &debugfs_axi_v3_hw_fops); - - debugfs_create_file("ras", 0400, dump_dentry, -- &hisi_hba->debugfs_regs[dump_index][DEBUGFS_RAS], -+ &hisi_hba->debugfs_regs[index][DEBUGFS_RAS], - &debugfs_ras_v3_hw_fops); - } - --static void debugfs_snapshot_regs_v3_hw(struct hisi_hba *hisi_hba) --{ -- int debugfs_dump_index = hisi_hba->debugfs_dump_index; -- struct device *dev = hisi_hba->dev; -- u64 timestamp = local_clock(); -- -- if (debugfs_dump_index >= hisi_sas_debugfs_dump_count) { -- dev_warn(dev, "dump count exceeded!\n"); -- return; -- } -- -- do_div(timestamp, NSEC_PER_MSEC); -- hisi_hba->debugfs_timestamp[debugfs_dump_index] = timestamp; -- -- debugfs_snapshot_prepare_v3_hw(hisi_hba); -- -- debugfs_snapshot_global_reg_v3_hw(hisi_hba); -- debugfs_snapshot_port_reg_v3_hw(hisi_hba); -- debugfs_snapshot_axi_reg_v3_hw(hisi_hba); -- debugfs_snapshot_ras_reg_v3_hw(hisi_hba); -- debugfs_snapshot_cq_reg_v3_hw(hisi_hba); -- debugfs_snapshot_dq_reg_v3_hw(hisi_hba); -- debugfs_snapshot_itct_reg_v3_hw(hisi_hba); -- debugfs_snapshot_iost_reg_v3_hw(hisi_hba); -- -- debugfs_create_files_v3_hw(hisi_hba); -- -- debugfs_snapshot_restore_v3_hw(hisi_hba); -- hisi_hba->debugfs_dump_index++; --} -- - static ssize_t debugfs_trigger_dump_v3_hw_write(struct file *file, - const char __user *user_buf, - size_t count, loff_t *ppos) -@@ -3907,9 +3909,6 @@ static ssize_t debugfs_trigger_dump_v3_hw_write(struct file *file, - struct hisi_hba *hisi_hba = file->f_inode->i_private; - char buf[8]; - -- if (hisi_hba->debugfs_dump_index >= hisi_sas_debugfs_dump_count) -- return -EFAULT; -- - if (count > 8) - return -EFAULT; - -@@ -3919,7 +3918,12 @@ static ssize_t debugfs_trigger_dump_v3_hw_write(struct file *file, - if (buf[0] != '1') - return -EFAULT; - -- queue_work(hisi_hba->wq, &hisi_hba->debugfs_work); -+ down(&hisi_hba->sem); -+ if (debugfs_snapshot_regs_v3_hw(hisi_hba)) { -+ up(&hisi_hba->sem); -+ return -EFAULT; -+ } -+ up(&hisi_hba->sem); - - return count; - } -@@ -4670,36 +4674,40 @@ static void debugfs_fifo_init_v3_hw(struct hisi_hba *hisi_hba) - } - } - --static void debugfs_work_handler_v3_hw(struct work_struct *work) --{ -- struct hisi_hba *hisi_hba = -- container_of(work, struct hisi_hba, debugfs_work); -- -- debugfs_snapshot_regs_v3_hw(hisi_hba); --} -- - static void debugfs_release_v3_hw(struct hisi_hba *hisi_hba, int dump_index) - { - struct device *dev = hisi_hba->dev; - int i; - - devm_kfree(dev, hisi_hba->debugfs_iost_cache[dump_index].cache); -+ hisi_hba->debugfs_iost_cache[dump_index].cache = NULL; - devm_kfree(dev, hisi_hba->debugfs_itct_cache[dump_index].cache); -+ hisi_hba->debugfs_itct_cache[dump_index].cache = NULL; - devm_kfree(dev, hisi_hba->debugfs_iost[dump_index].iost); -+ hisi_hba->debugfs_iost[dump_index].iost = NULL; - devm_kfree(dev, hisi_hba->debugfs_itct[dump_index].itct); -+ hisi_hba->debugfs_itct[dump_index].itct = NULL; - -- for (i = 0; i < hisi_hba->queue_count; i++) -+ for (i = 0; i < hisi_hba->queue_count; i++) { - devm_kfree(dev, hisi_hba->debugfs_dq[dump_index][i].hdr); -+ hisi_hba->debugfs_dq[dump_index][i].hdr = NULL; -+ } - -- for (i = 0; i < hisi_hba->queue_count; i++) -+ for (i = 0; i < hisi_hba->queue_count; i++) { - devm_kfree(dev, - hisi_hba->debugfs_cq[dump_index][i].complete_hdr); -+ hisi_hba->debugfs_cq[dump_index][i].complete_hdr = NULL; -+ } - -- for (i = 0; i < DEBUGFS_REGS_NUM; i++) -+ for (i = 0; i < DEBUGFS_REGS_NUM; i++) { - devm_kfree(dev, hisi_hba->debugfs_regs[dump_index][i].data); -+ hisi_hba->debugfs_regs[dump_index][i].data = NULL; -+ } - -- for (i = 0; i < hisi_hba->n_phy; i++) -+ for (i = 0; i < hisi_hba->n_phy; i++) { - devm_kfree(dev, hisi_hba->debugfs_port_reg[dump_index][i].data); -+ hisi_hba->debugfs_port_reg[dump_index][i].data = NULL; -+ } - } - - static const struct hisi_sas_debugfs_reg *debugfs_reg_array_v3_hw[DEBUGFS_REGS_NUM] = { -@@ -4712,7 +4720,7 @@ static int debugfs_alloc_v3_hw(struct hisi_hba *hisi_hba, int dump_index) - { - const struct hisi_sas_hw *hw = hisi_hba->hw; - struct device *dev = hisi_hba->dev; -- int p, c, d, r, i; -+ int p, c, d, r; - size_t sz; - - for (r = 0; r < DEBUGFS_REGS_NUM; r++) { -@@ -4792,11 +4800,46 @@ static int debugfs_alloc_v3_hw(struct hisi_hba *hisi_hba, int dump_index) - - return 0; - fail: -- for (i = 0; i < hisi_sas_debugfs_dump_count; i++) -- debugfs_release_v3_hw(hisi_hba, i); -+ debugfs_release_v3_hw(hisi_hba, dump_index); - return -ENOMEM; - } - -+static int debugfs_snapshot_regs_v3_hw(struct hisi_hba *hisi_hba) -+{ -+ int debugfs_dump_index = hisi_hba->debugfs_dump_index; -+ struct device *dev = hisi_hba->dev; -+ u64 timestamp = local_clock(); -+ -+ if (debugfs_dump_index >= hisi_sas_debugfs_dump_count) { -+ dev_warn(dev, "dump count exceeded!\n"); -+ return -EINVAL; -+ } -+ -+ if (debugfs_alloc_v3_hw(hisi_hba, debugfs_dump_index)) { -+ dev_warn(dev, "failed to alloc memory\n"); -+ return -ENOMEM; -+ } -+ -+ do_div(timestamp, NSEC_PER_MSEC); -+ hisi_hba->debugfs_timestamp[debugfs_dump_index] = timestamp; -+ -+ debugfs_snapshot_prepare_v3_hw(hisi_hba); -+ -+ debugfs_snapshot_global_reg_v3_hw(hisi_hba); -+ debugfs_snapshot_port_reg_v3_hw(hisi_hba); -+ debugfs_snapshot_axi_reg_v3_hw(hisi_hba); -+ debugfs_snapshot_ras_reg_v3_hw(hisi_hba); -+ debugfs_snapshot_cq_reg_v3_hw(hisi_hba); -+ debugfs_snapshot_dq_reg_v3_hw(hisi_hba); -+ debugfs_snapshot_itct_reg_v3_hw(hisi_hba); -+ debugfs_snapshot_iost_reg_v3_hw(hisi_hba); -+ -+ debugfs_snapshot_restore_v3_hw(hisi_hba); -+ hisi_hba->debugfs_dump_index++; -+ -+ return 0; -+} -+ - static void debugfs_phy_down_cnt_init_v3_hw(struct hisi_hba *hisi_hba) - { - struct dentry *dir = debugfs_create_dir("phy_down_cnt", -@@ -4874,6 +4917,17 @@ static void debugfs_bist_init_v3_hw(struct hisi_hba *hisi_hba) - hisi_hba->debugfs_bist_linkrate = SAS_LINK_RATE_1_5_GBPS; - } - -+static void debugfs_dump_init_v3_hw(struct hisi_hba *hisi_hba) -+{ -+ int i; -+ -+ hisi_hba->debugfs_dump_dentry = -+ debugfs_create_dir("dump", hisi_hba->debugfs_dir); -+ -+ for (i = 0; i < hisi_sas_debugfs_dump_count; i++) -+ debugfs_create_files_v3_hw(hisi_hba, i); -+} -+ - static void debugfs_exit_v3_hw(struct hisi_hba *hisi_hba) - { - debugfs_remove_recursive(hisi_hba->debugfs_dir); -@@ -4883,7 +4937,6 @@ static void debugfs_exit_v3_hw(struct hisi_hba *hisi_hba) - static void debugfs_init_v3_hw(struct hisi_hba *hisi_hba) - { - struct device *dev = hisi_hba->dev; -- int i; - - hisi_hba->debugfs_dir = debugfs_create_dir(dev_name(dev), - hisi_sas_debugfs_dir); -@@ -4895,19 +4948,10 @@ static void debugfs_init_v3_hw(struct hisi_hba *hisi_hba) - /* create bist structures */ - debugfs_bist_init_v3_hw(hisi_hba); - -- hisi_hba->debugfs_dump_dentry = -- debugfs_create_dir("dump", hisi_hba->debugfs_dir); -+ debugfs_dump_init_v3_hw(hisi_hba); - - debugfs_phy_down_cnt_init_v3_hw(hisi_hba); - debugfs_fifo_init_v3_hw(hisi_hba); -- -- for (i = 0; i < hisi_sas_debugfs_dump_count; i++) { -- if (debugfs_alloc_v3_hw(hisi_hba, i)) { -- debugfs_exit_v3_hw(hisi_hba); -- dev_dbg(dev, "failed to init debugfs!\n"); -- break; -- } -- } - } - - static int -diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c -index 7f32619234696f..7880675a68dba6 100644 ---- a/drivers/scsi/mpi3mr/mpi3mr_os.c -+++ b/drivers/scsi/mpi3mr/mpi3mr_os.c -@@ -8,11 +8,12 @@ - */ - - #include "mpi3mr.h" -+#include - - /* global driver scop variables */ - LIST_HEAD(mrioc_list); - DEFINE_SPINLOCK(mrioc_list_lock); --static int mrioc_ids; -+static DEFINE_IDA(mrioc_ida); - static int warn_non_secure_ctlr; - atomic64_t event_counter; - -@@ -5065,7 +5066,10 @@ mpi3mr_probe(struct pci_dev *pdev, const struct pci_device_id *id) - } - - mrioc = shost_priv(shost); -- mrioc->id = mrioc_ids++; -+ retval = ida_alloc_range(&mrioc_ida, 0, U8_MAX, GFP_KERNEL); -+ if (retval < 0) -+ goto id_alloc_failed; -+ mrioc->id = (u8)retval; - sprintf(mrioc->driver_name, "%s", MPI3MR_DRIVER_NAME); - sprintf(mrioc->name, "%s%d", mrioc->driver_name, mrioc->id); - INIT_LIST_HEAD(&mrioc->list); -@@ -5215,9 +5219,11 @@ mpi3mr_probe(struct pci_dev *pdev, const struct pci_device_id *id) - resource_alloc_failed: - destroy_workqueue(mrioc->fwevt_worker_thread); - fwevtthread_failed: -+ ida_free(&mrioc_ida, mrioc->id); - spin_lock(&mrioc_list_lock); - list_del(&mrioc->list); - spin_unlock(&mrioc_list_lock); -+id_alloc_failed: - scsi_host_put(shost); - shost_failed: - return retval; -@@ -5303,6 +5309,7 @@ static void mpi3mr_remove(struct pci_dev *pdev) - mrioc->sas_hba.num_phys = 0; - } - -+ ida_free(&mrioc_ida, mrioc->id); - spin_lock(&mrioc_list_lock); - list_del(&mrioc->list); - spin_unlock(&mrioc_list_lock); -@@ -5518,6 +5525,7 @@ static void __exit mpi3mr_exit(void) - &driver_attr_event_counter); - pci_unregister_driver(&mpi3mr_pci_driver); - sas_release_transport(mpi3mr_transport_template); -+ ida_destroy(&mrioc_ida); - } - - module_init(mpi3mr_init); -diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c -index 1ec6f9c82aef06..79f2bf5df19a6c 100644 ---- a/drivers/thunderbolt/nhi.c -+++ b/drivers/thunderbolt/nhi.c -@@ -1524,6 +1524,18 @@ static struct pci_device_id nhi_ids[] = { - .driver_data = (kernel_ulong_t)&icl_nhi_ops }, - { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTL_P_NHI1), - .driver_data = (kernel_ulong_t)&icl_nhi_ops }, -+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_LNL_NHI0), -+ .driver_data = (kernel_ulong_t)&icl_nhi_ops }, -+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_LNL_NHI1), -+ .driver_data = (kernel_ulong_t)&icl_nhi_ops }, -+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_M_NHI0), -+ .driver_data = (kernel_ulong_t)&icl_nhi_ops }, -+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_M_NHI1), -+ .driver_data = (kernel_ulong_t)&icl_nhi_ops }, -+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_P_NHI0), -+ .driver_data = (kernel_ulong_t)&icl_nhi_ops }, -+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_P_NHI1), -+ .driver_data = (kernel_ulong_t)&icl_nhi_ops }, - { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI) }, - { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI) }, - -diff --git a/drivers/thunderbolt/nhi.h b/drivers/thunderbolt/nhi.h -index 0f029ce758825e..16744f25a9a069 100644 ---- a/drivers/thunderbolt/nhi.h -+++ b/drivers/thunderbolt/nhi.h -@@ -90,6 +90,12 @@ extern const struct tb_nhi_ops icl_nhi_ops; - #define PCI_DEVICE_ID_INTEL_TGL_H_NHI1 0x9a21 - #define PCI_DEVICE_ID_INTEL_RPL_NHI0 0xa73e - #define PCI_DEVICE_ID_INTEL_RPL_NHI1 0xa76d -+#define PCI_DEVICE_ID_INTEL_LNL_NHI0 0xa833 -+#define PCI_DEVICE_ID_INTEL_LNL_NHI1 0xa834 -+#define PCI_DEVICE_ID_INTEL_PTL_M_NHI0 0xe333 -+#define PCI_DEVICE_ID_INTEL_PTL_M_NHI1 0xe334 -+#define PCI_DEVICE_ID_INTEL_PTL_P_NHI0 0xe433 -+#define PCI_DEVICE_ID_INTEL_PTL_P_NHI1 0xe434 - - #define PCI_CLASS_SERIAL_USB_USB4 0x0c0340 - -diff --git a/drivers/thunderbolt/retimer.c b/drivers/thunderbolt/retimer.c -index 47becb363adacb..2ee8c5ebca7c3c 100644 ---- a/drivers/thunderbolt/retimer.c -+++ b/drivers/thunderbolt/retimer.c -@@ -98,6 +98,7 @@ static int tb_retimer_nvm_add(struct tb_retimer *rt) - - err_nvm: - dev_dbg(&rt->dev, "NVM upgrade disabled\n"); -+ rt->no_nvm_upgrade = true; - if (!IS_ERR(nvm)) - tb_nvm_free(nvm); - -@@ -177,8 +178,6 @@ static ssize_t nvm_authenticate_show(struct device *dev, - - if (!rt->nvm) - ret = -EAGAIN; -- else if (rt->no_nvm_upgrade) -- ret = -EOPNOTSUPP; - else - ret = sysfs_emit(buf, "%#x\n", rt->auth_status); - -@@ -331,6 +330,19 @@ static ssize_t vendor_show(struct device *dev, struct device_attribute *attr, - } - static DEVICE_ATTR_RO(vendor); - -+static umode_t retimer_is_visible(struct kobject *kobj, struct attribute *attr, -+ int n) -+{ -+ struct device *dev = kobj_to_dev(kobj); -+ struct tb_retimer *rt = tb_to_retimer(dev); -+ -+ if (attr == &dev_attr_nvm_authenticate.attr || -+ attr == &dev_attr_nvm_version.attr) -+ return rt->no_nvm_upgrade ? 0 : attr->mode; -+ -+ return attr->mode; -+} -+ - static struct attribute *retimer_attrs[] = { - &dev_attr_device.attr, - &dev_attr_nvm_authenticate.attr, -@@ -340,6 +352,7 @@ static struct attribute *retimer_attrs[] = { - }; - - static const struct attribute_group retimer_group = { -+ .is_visible = retimer_is_visible, - .attrs = retimer_attrs, - }; - -diff --git a/drivers/usb/chipidea/ci.h b/drivers/usb/chipidea/ci.h -index 2a38e1eb65466c..97437de52ef681 100644 ---- a/drivers/usb/chipidea/ci.h -+++ b/drivers/usb/chipidea/ci.h -@@ -25,6 +25,7 @@ - #define TD_PAGE_COUNT 5 - #define CI_HDRC_PAGE_SIZE 4096ul /* page size for TD's */ - #define ENDPT_MAX 32 -+#define CI_MAX_REQ_SIZE (4 * CI_HDRC_PAGE_SIZE) - #define CI_MAX_BUF_SIZE (TD_PAGE_COUNT * CI_HDRC_PAGE_SIZE) - - /****************************************************************************** -@@ -260,6 +261,7 @@ struct ci_hdrc { - bool b_sess_valid_event; - bool imx28_write_fix; - bool has_portsc_pec_bug; -+ bool has_short_pkt_limit; - bool supports_runtime_pm; - bool in_lpm; - bool wakeup_int; -diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c -index e28bb2f2612dc6..477af457c1a1f0 100644 ---- a/drivers/usb/chipidea/ci_hdrc_imx.c -+++ b/drivers/usb/chipidea/ci_hdrc_imx.c -@@ -334,6 +334,7 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) - struct ci_hdrc_platform_data pdata = { - .name = dev_name(&pdev->dev), - .capoffset = DEF_CAPOFFSET, -+ .flags = CI_HDRC_HAS_SHORT_PKT_LIMIT, - .notify_event = ci_hdrc_imx_notify_event, - }; - int ret; -diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c -index ca71df4f32e4cc..c161a4ee529064 100644 ---- a/drivers/usb/chipidea/core.c -+++ b/drivers/usb/chipidea/core.c -@@ -1076,6 +1076,8 @@ static int ci_hdrc_probe(struct platform_device *pdev) - CI_HDRC_SUPPORTS_RUNTIME_PM); - ci->has_portsc_pec_bug = !!(ci->platdata->flags & - CI_HDRC_HAS_PORTSC_PEC_MISSED); -+ ci->has_short_pkt_limit = !!(ci->platdata->flags & -+ CI_HDRC_HAS_SHORT_PKT_LIMIT); - platform_set_drvdata(pdev, ci); - - ret = hw_device_init(ci, base); -diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c -index f5490f2a5b6bca..647e98f4e35110 100644 ---- a/drivers/usb/chipidea/otg.c -+++ b/drivers/usb/chipidea/otg.c -@@ -130,8 +130,11 @@ enum ci_role ci_otg_role(struct ci_hdrc *ci) - - void ci_handle_vbus_change(struct ci_hdrc *ci) - { -- if (!ci->is_otg) -+ if (!ci->is_otg) { -+ if (ci->platdata->flags & CI_HDRC_FORCE_VBUS_ACTIVE_ALWAYS) -+ usb_gadget_vbus_connect(&ci->gadget); - return; -+ } - - if (hw_read_otgsc(ci, OTGSC_BSV) && !ci->vbus_active) - usb_gadget_vbus_connect(&ci->gadget); -diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c -index 9f7d003e467b54..f2ae5f4c58283a 100644 ---- a/drivers/usb/chipidea/udc.c -+++ b/drivers/usb/chipidea/udc.c -@@ -959,6 +959,12 @@ static int _ep_queue(struct usb_ep *ep, struct usb_request *req, - return -EMSGSIZE; - } - -+ if (ci->has_short_pkt_limit && -+ hwreq->req.length > CI_MAX_REQ_SIZE) { -+ dev_err(hwep->ci->dev, "request length too big (max 16KB)\n"); -+ return -EMSGSIZE; -+ } -+ - /* first nuke then test link, e.g. previous status has not sent */ - if (!list_empty(&hwreq->queue)) { - dev_err(hwep->ci->dev, "request already in queue\n"); -diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h -index b118f4aab18984..d00bf714a7ccfb 100644 ---- a/drivers/usb/dwc3/core.h -+++ b/drivers/usb/dwc3/core.h -@@ -899,6 +899,7 @@ struct dwc3_hwparams { - #define DWC3_MODE(n) ((n) & 0x7) - - /* HWPARAMS1 */ -+#define DWC3_SPRAM_TYPE(n) (((n) >> 23) & 1) - #define DWC3_NUM_INT(n) (((n) & (0x3f << 15)) >> 15) - - /* HWPARAMS3 */ -@@ -909,6 +910,9 @@ struct dwc3_hwparams { - #define DWC3_NUM_IN_EPS(p) (((p)->hwparams3 & \ - (DWC3_NUM_IN_EPS_MASK)) >> 18) - -+/* HWPARAMS6 */ -+#define DWC3_RAM0_DEPTH(n) (((n) & (0xffff0000)) >> 16) -+ - /* HWPARAMS7 */ - #define DWC3_RAM1_DEPTH(n) ((n) & 0xffff) - -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index b560996bd4218a..656460c0c1dd7e 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -687,6 +687,44 @@ static int dwc3_gadget_calc_tx_fifo_size(struct dwc3 *dwc, int mult) - return fifo_size; - } - -+/** -+ * dwc3_gadget_calc_ram_depth - calculates the ram depth for txfifo -+ * @dwc: pointer to the DWC3 context -+ */ -+static int dwc3_gadget_calc_ram_depth(struct dwc3 *dwc) -+{ -+ int ram_depth; -+ int fifo_0_start; -+ bool is_single_port_ram; -+ -+ /* Check supporting RAM type by HW */ -+ is_single_port_ram = DWC3_SPRAM_TYPE(dwc->hwparams.hwparams1); -+ -+ /* -+ * If a single port RAM is utilized, then allocate TxFIFOs from -+ * RAM0. otherwise, allocate them from RAM1. -+ */ -+ ram_depth = is_single_port_ram ? DWC3_RAM0_DEPTH(dwc->hwparams.hwparams6) : -+ DWC3_RAM1_DEPTH(dwc->hwparams.hwparams7); -+ -+ /* -+ * In a single port RAM configuration, the available RAM is shared -+ * between the RX and TX FIFOs. This means that the txfifo can begin -+ * at a non-zero address. -+ */ -+ if (is_single_port_ram) { -+ u32 reg; -+ -+ /* Check if TXFIFOs start at non-zero addr */ -+ reg = dwc3_readl(dwc->regs, DWC3_GTXFIFOSIZ(0)); -+ fifo_0_start = DWC3_GTXFIFOSIZ_TXFSTADDR(reg); -+ -+ ram_depth -= (fifo_0_start >> 16); -+ } -+ -+ return ram_depth; -+} -+ - /** - * dwc3_gadget_clear_tx_fifos - Clears txfifo allocation - * @dwc: pointer to the DWC3 context -@@ -753,7 +791,7 @@ static int dwc3_gadget_resize_tx_fifos(struct dwc3_ep *dep) - { - struct dwc3 *dwc = dep->dwc; - int fifo_0_start; -- int ram1_depth; -+ int ram_depth; - int fifo_size; - int min_depth; - int num_in_ep; -@@ -773,7 +811,7 @@ static int dwc3_gadget_resize_tx_fifos(struct dwc3_ep *dep) - if (dep->flags & DWC3_EP_TXFIFO_RESIZED) - return 0; - -- ram1_depth = DWC3_RAM1_DEPTH(dwc->hwparams.hwparams7); -+ ram_depth = dwc3_gadget_calc_ram_depth(dwc); - - if ((dep->endpoint.maxburst > 1 && - usb_endpoint_xfer_bulk(dep->endpoint.desc)) || -@@ -794,7 +832,7 @@ static int dwc3_gadget_resize_tx_fifos(struct dwc3_ep *dep) - - /* Reserve at least one FIFO for the number of IN EPs */ - min_depth = num_in_ep * (fifo + 1); -- remaining = ram1_depth - min_depth - dwc->last_fifo_depth; -+ remaining = ram_depth - min_depth - dwc->last_fifo_depth; - remaining = max_t(int, 0, remaining); - /* - * We've already reserved 1 FIFO per EP, so check what we can fit in -@@ -820,9 +858,9 @@ static int dwc3_gadget_resize_tx_fifos(struct dwc3_ep *dep) - dwc->last_fifo_depth += DWC31_GTXFIFOSIZ_TXFDEP(fifo_size); - - /* Check fifo size allocation doesn't exceed available RAM size. */ -- if (dwc->last_fifo_depth >= ram1_depth) { -+ if (dwc->last_fifo_depth >= ram_depth) { - dev_err(dwc->dev, "Fifosize(%d) > RAM size(%d) %s depth:%d\n", -- dwc->last_fifo_depth, ram1_depth, -+ dwc->last_fifo_depth, ram_depth, - dep->endpoint.name, fifo_size); - if (DWC3_IP_IS(DWC3)) - fifo_size = DWC3_GTXFIFOSIZ_TXFDEP(fifo_size); -@@ -3078,7 +3116,7 @@ static int dwc3_gadget_check_config(struct usb_gadget *g) - struct dwc3 *dwc = gadget_to_dwc(g); - struct usb_ep *ep; - int fifo_size = 0; -- int ram1_depth; -+ int ram_depth; - int ep_num = 0; - - if (!dwc->do_fifo_resize) -@@ -3101,8 +3139,8 @@ static int dwc3_gadget_check_config(struct usb_gadget *g) - fifo_size += dwc->max_cfg_eps; - - /* Check if we can fit a single fifo per endpoint */ -- ram1_depth = DWC3_RAM1_DEPTH(dwc->hwparams.hwparams7); -- if (fifo_size > ram1_depth) -+ ram_depth = dwc3_gadget_calc_ram_depth(dwc); -+ if (fifo_size > ram_depth) - return -ENOMEM; - - return 0; -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index 50f58801140045..0d628af5c3ba50 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -52,6 +52,7 @@ - * endpoint rings; it generates events on the event ring for these. - */ - -+#include - #include - #include - #include -@@ -1091,6 +1092,19 @@ static int xhci_invalidate_cancelled_tds(struct xhci_virt_ep *ep) - return 0; - } - -+/* -+ * Erase queued TDs from transfer ring(s) and give back those the xHC didn't -+ * stop on. If necessary, queue commands to move the xHC off cancelled TDs it -+ * stopped on. Those will be given back later when the commands complete. -+ * -+ * Call under xhci->lock on a stopped endpoint. -+ */ -+void xhci_process_cancelled_tds(struct xhci_virt_ep *ep) -+{ -+ xhci_invalidate_cancelled_tds(ep); -+ xhci_giveback_invalidated_tds(ep); -+} -+ - /* - * Returns the TD the endpoint ring halted on. - * Only call for non-running rings without streams. -@@ -1180,9 +1194,35 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id, - break; - ep->ep_state &= ~EP_STOP_CMD_PENDING; - return; -+ case EP_STATE_STOPPED: -+ /* -+ * Per xHCI 4.6.9, Stop Endpoint command on a Stopped -+ * EP is a Context State Error, and EP stays Stopped. -+ * -+ * But maybe it failed on Halted, and somebody ran Reset -+ * Endpoint later. EP state is now Stopped and EP_HALTED -+ * still set because Reset EP handler will run after us. -+ */ -+ if (ep->ep_state & EP_HALTED) -+ break; -+ /* -+ * On some HCs EP state remains Stopped for some tens of -+ * us to a few ms or more after a doorbell ring, and any -+ * new Stop Endpoint fails without aborting the restart. -+ * This handler may run quickly enough to still see this -+ * Stopped state, but it will soon change to Running. -+ * -+ * Assume this bug on unexpected Stop Endpoint failures. -+ * Keep retrying until the EP starts and stops again, on -+ * chips where this is known to help. Wait for 100ms. -+ */ -+ if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100))) -+ break; -+ fallthrough; - case EP_STATE_RUNNING: - /* Race, HW handled stop ep cmd before ep was running */ -- xhci_dbg(xhci, "Stop ep completion ctx error, ep is running\n"); -+ xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n", -+ GET_EP_CTX_STATE(ep_ctx)); - - command = xhci_alloc_command(xhci, false, GFP_ATOMIC); - if (!command) { -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index 3bd70e6ad64baf..70e6c240a5409f 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -8,6 +8,7 @@ - * Some code borrowed from the Linux EHCI driver. - */ - -+#include - #include - #include - #include -@@ -1737,15 +1738,27 @@ static int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) - } - } - -- /* Queue a stop endpoint command, but only if this is -- * the first cancellation to be handled. -- */ -- if (!(ep->ep_state & EP_STOP_CMD_PENDING)) { -+ /* These completion handlers will sort out cancelled TDs for us */ -+ if (ep->ep_state & (EP_STOP_CMD_PENDING | EP_HALTED | SET_DEQ_PENDING)) { -+ xhci_dbg(xhci, "Not queuing Stop Endpoint on slot %d ep %d in state 0x%x\n", -+ urb->dev->slot_id, ep_index, ep->ep_state); -+ goto done; -+ } -+ -+ /* In this case no commands are pending but the endpoint is stopped */ -+ if (ep->ep_state & EP_CLEARING_TT) { -+ /* and cancelled TDs can be given back right away */ -+ xhci_dbg(xhci, "Invalidating TDs instantly on slot %d ep %d in state 0x%x\n", -+ urb->dev->slot_id, ep_index, ep->ep_state); -+ xhci_process_cancelled_tds(ep); -+ } else { -+ /* Otherwise, queue a new Stop Endpoint command */ - command = xhci_alloc_command(xhci, false, GFP_ATOMIC); - if (!command) { - ret = -ENOMEM; - goto done; - } -+ ep->stop_time = jiffies; - ep->ep_state |= EP_STOP_CMD_PENDING; - xhci_queue_stop_endpoint(xhci, command, urb->dev->slot_id, - ep_index, 0); -diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h -index 4bbd12db7239ab..fddb3a90dae3df 100644 ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -717,6 +717,7 @@ struct xhci_virt_ep { - /* Bandwidth checking storage */ - struct xhci_bw_info bw_info; - struct list_head bw_endpoint_list; -+ unsigned long stop_time; - /* Isoch Frame ID checking storage */ - int next_frame_id; - /* Use new Isoch TRB layout needed for extended TBC support */ -@@ -1951,6 +1952,7 @@ void xhci_ring_doorbell_for_active_rings(struct xhci_hcd *xhci, - void xhci_cleanup_command_queue(struct xhci_hcd *xhci); - void inc_deq(struct xhci_hcd *xhci, struct xhci_ring *ring); - unsigned int count_trbs(u64 addr, u64 len); -+void xhci_process_cancelled_tds(struct xhci_virt_ep *ep); - - /* xHCI roothub code */ - void xhci_set_link_state(struct xhci_hcd *xhci, struct xhci_port *port, -diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c -index f6fb5575d4f0ac..d6a3fd00c3a5c4 100644 ---- a/drivers/usb/typec/ucsi/ucsi.c -+++ b/drivers/usb/typec/ucsi/ucsi.c -@@ -903,6 +903,9 @@ static void ucsi_handle_connector_change(struct work_struct *work) - - trace_ucsi_connector_change(con->num, &con->status); - -+ if (ucsi->ops->connector_status) -+ ucsi->ops->connector_status(con); -+ - role = !!(con->status.flags & UCSI_CONSTAT_PWR_DIR); - - if (con->status.change & UCSI_CONSTAT_POWER_DIR_CHANGE) { -@@ -1258,6 +1261,9 @@ static int ucsi_register_port(struct ucsi *ucsi, struct ucsi_connector *con) - cap->driver_data = con; - cap->ops = &ucsi_ops; - -+ if (ucsi->ops->update_connector) -+ ucsi->ops->update_connector(con); -+ - ret = ucsi_register_port_psy(con); - if (ret) - goto out; -@@ -1322,6 +1328,9 @@ static int ucsi_register_port(struct ucsi *ucsi, struct ucsi_connector *con) - } - ret = 0; /* ucsi_send_command() returns length on success */ - -+ if (ucsi->ops->connector_status) -+ ucsi->ops->connector_status(con); -+ - switch (UCSI_CONSTAT_PARTNER_TYPE(con->status.flags)) { - case UCSI_CONSTAT_PARTNER_TYPE_UFP: - case UCSI_CONSTAT_PARTNER_TYPE_CABLE_AND_UFP: -diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h -index 42c60eba5fb6ee..921ef0e115cffc 100644 ---- a/drivers/usb/typec/ucsi/ucsi.h -+++ b/drivers/usb/typec/ucsi/ucsi.h -@@ -15,6 +15,7 @@ - - struct ucsi; - struct ucsi_altmode; -+struct ucsi_connector; - struct dentry; - - /* UCSI offsets (Bytes) */ -@@ -52,6 +53,8 @@ struct dentry; - * @sync_write: Blocking write operation - * @async_write: Non-blocking write operation - * @update_altmodes: Squashes duplicate DP altmodes -+ * @update_connector: Update connector capabilities before registering -+ * @connector_status: Updates connector status, called holding connector lock - * - * Read and write routines for UCSI interface. @sync_write must wait for the - * Command Completion Event from the PPM before returning, and @async_write must -@@ -66,6 +69,8 @@ struct ucsi_operations { - const void *val, size_t val_len); - bool (*update_altmodes)(struct ucsi *ucsi, struct ucsi_altmode *orig, - struct ucsi_altmode *updated); -+ void (*update_connector)(struct ucsi_connector *con); -+ void (*connector_status)(struct ucsi_connector *con); - }; - - struct ucsi *ucsi_create(struct device *dev, const struct ucsi_operations *ops); -diff --git a/drivers/usb/typec/ucsi/ucsi_glink.c b/drivers/usb/typec/ucsi/ucsi_glink.c -index 94f2df02f06eeb..82a1081d44f1f0 100644 ---- a/drivers/usb/typec/ucsi/ucsi_glink.c -+++ b/drivers/usb/typec/ucsi/ucsi_glink.c -@@ -186,10 +186,40 @@ static int pmic_glink_ucsi_sync_write(struct ucsi *__ucsi, unsigned int offset, - return ret; - } - -+static void pmic_glink_ucsi_update_connector(struct ucsi_connector *con) -+{ -+ struct pmic_glink_ucsi *ucsi = ucsi_get_drvdata(con->ucsi); -+ -+ if (con->num > PMIC_GLINK_MAX_PORTS || -+ !ucsi->port_orientation[con->num - 1]) -+ return; -+ -+ con->typec_cap.orientation_aware = true; -+} -+ -+static void pmic_glink_ucsi_connector_status(struct ucsi_connector *con) -+{ -+ struct pmic_glink_ucsi *ucsi = ucsi_get_drvdata(con->ucsi); -+ int orientation; -+ -+ if (con->num > PMIC_GLINK_MAX_PORTS || -+ !ucsi->port_orientation[con->num - 1]) -+ return; -+ -+ orientation = gpiod_get_value(ucsi->port_orientation[con->num - 1]); -+ if (orientation >= 0) { -+ typec_switch_set(ucsi->port_switch[con->num - 1], -+ orientation ? TYPEC_ORIENTATION_REVERSE -+ : TYPEC_ORIENTATION_NORMAL); -+ } -+} -+ - static const struct ucsi_operations pmic_glink_ucsi_ops = { - .read = pmic_glink_ucsi_read, - .sync_write = pmic_glink_ucsi_sync_write, -- .async_write = pmic_glink_ucsi_async_write -+ .async_write = pmic_glink_ucsi_async_write, -+ .update_connector = pmic_glink_ucsi_update_connector, -+ .connector_status = pmic_glink_ucsi_connector_status, - }; - - static void pmic_glink_ucsi_read_ack(struct pmic_glink_ucsi *ucsi, const void *data, int len) -@@ -228,20 +258,8 @@ static void pmic_glink_ucsi_notify(struct work_struct *work) - } - - con_num = UCSI_CCI_CONNECTOR(cci); -- if (con_num) { -- if (con_num <= PMIC_GLINK_MAX_PORTS && -- ucsi->port_orientation[con_num - 1]) { -- int orientation = gpiod_get_value(ucsi->port_orientation[con_num - 1]); -- -- if (orientation >= 0) { -- typec_switch_set(ucsi->port_switch[con_num - 1], -- orientation ? TYPEC_ORIENTATION_REVERSE -- : TYPEC_ORIENTATION_NORMAL); -- } -- } -- -+ if (con_num) - ucsi_connector_change(ucsi->ucsi, con_num); -- } - - if (ucsi->sync_pending && - (cci & (UCSI_CCI_ACK_COMPLETE | UCSI_CCI_COMMAND_COMPLETE))) { -@@ -252,20 +270,6 @@ static void pmic_glink_ucsi_notify(struct work_struct *work) - static void pmic_glink_ucsi_register(struct work_struct *work) - { - struct pmic_glink_ucsi *ucsi = container_of(work, struct pmic_glink_ucsi, register_work); -- int orientation; -- int i; -- -- for (i = 0; i < PMIC_GLINK_MAX_PORTS; i++) { -- if (!ucsi->port_orientation[i]) -- continue; -- orientation = gpiod_get_value(ucsi->port_orientation[i]); -- -- if (orientation >= 0) { -- typec_switch_set(ucsi->port_switch[i], -- orientation ? TYPEC_ORIENTATION_REVERSE -- : TYPEC_ORIENTATION_NORMAL); -- } -- } - - ucsi_register(ucsi->ucsi); - } -diff --git a/drivers/watchdog/rzg2l_wdt.c b/drivers/watchdog/rzg2l_wdt.c -index 7bce093316c4d7..525a72d8d746e3 100644 ---- a/drivers/watchdog/rzg2l_wdt.c -+++ b/drivers/watchdog/rzg2l_wdt.c -@@ -8,11 +8,11 @@ - #include - #include - #include --#include - #include - #include - #include - #include -+#include - #include - #include - #include -@@ -54,35 +54,11 @@ struct rzg2l_wdt_priv { - struct reset_control *rstc; - unsigned long osc_clk_rate; - unsigned long delay; -- unsigned long minimum_assertion_period; - struct clk *pclk; - struct clk *osc_clk; - enum rz_wdt_type devtype; - }; - --static int rzg2l_wdt_reset(struct rzg2l_wdt_priv *priv) --{ -- int err, status; -- -- if (priv->devtype == WDT_RZV2M) { -- /* WDT needs TYPE-B reset control */ -- err = reset_control_assert(priv->rstc); -- if (err) -- return err; -- ndelay(priv->minimum_assertion_period); -- err = reset_control_deassert(priv->rstc); -- if (err) -- return err; -- err = read_poll_timeout(reset_control_status, status, -- status != 1, 0, 1000, false, -- priv->rstc); -- } else { -- err = reset_control_reset(priv->rstc); -- } -- -- return err; --} -- - static void rzg2l_wdt_wait_delay(struct rzg2l_wdt_priv *priv) - { - /* delay timer when change the setting register */ -@@ -129,6 +105,12 @@ static int rzg2l_wdt_start(struct watchdog_device *wdev) - if (ret) - return ret; - -+ ret = reset_control_deassert(priv->rstc); -+ if (ret) { -+ pm_runtime_put(wdev->parent); -+ return ret; -+ } -+ - /* Initialize time out */ - rzg2l_wdt_init_timeout(wdev); - -@@ -146,7 +128,9 @@ static int rzg2l_wdt_stop(struct watchdog_device *wdev) - struct rzg2l_wdt_priv *priv = watchdog_get_drvdata(wdev); - int ret; - -- rzg2l_wdt_reset(priv); -+ ret = reset_control_assert(priv->rstc); -+ if (ret) -+ return ret; - - ret = pm_runtime_put(wdev->parent); - if (ret < 0) -@@ -181,11 +165,30 @@ static int rzg2l_wdt_restart(struct watchdog_device *wdev, - unsigned long action, void *data) - { - struct rzg2l_wdt_priv *priv = watchdog_get_drvdata(wdev); -+ int ret; - -- clk_prepare_enable(priv->pclk); -- clk_prepare_enable(priv->osc_clk); -+ /* -+ * In case of RZ/G3S the watchdog device may be part of an IRQ safe power -+ * domain that is currently powered off. In this case we need to power -+ * it on before accessing registers. Along with this the clocks will be -+ * enabled. We don't undo the pm_runtime_resume_and_get() as the device -+ * need to be on for the reboot to happen. -+ * -+ * For the rest of SoCs not registering a watchdog IRQ safe power -+ * domain it is safe to call pm_runtime_resume_and_get() as the -+ * irq_safe_dev_in_sleep_domain() call in genpd_runtime_resume() -+ * returns non zero value and the genpd_lock() is avoided, thus, there -+ * will be no invalid wait context reported by lockdep. -+ */ -+ ret = pm_runtime_resume_and_get(wdev->parent); -+ if (ret) -+ return ret; - - if (priv->devtype == WDT_RZG2L) { -+ ret = reset_control_deassert(priv->rstc); -+ if (ret) -+ return ret; -+ - /* Generate Reset (WDTRSTB) Signal on parity error */ - rzg2l_wdt_write(priv, 0, PECR); - -@@ -193,7 +196,9 @@ static int rzg2l_wdt_restart(struct watchdog_device *wdev, - rzg2l_wdt_write(priv, PEEN_FORCE, PEEN); - } else { - /* RZ/V2M doesn't have parity error registers */ -- rzg2l_wdt_reset(priv); -+ ret = reset_control_reset(priv->rstc); -+ if (ret) -+ return ret; - - wdev->timeout = 0; - -@@ -236,13 +241,11 @@ static const struct watchdog_ops rzg2l_wdt_ops = { - .restart = rzg2l_wdt_restart, - }; - --static void rzg2l_wdt_reset_assert_pm_disable(void *data) -+static void rzg2l_wdt_pm_disable(void *data) - { - struct watchdog_device *wdev = data; -- struct rzg2l_wdt_priv *priv = watchdog_get_drvdata(wdev); - - pm_runtime_disable(wdev->parent); -- reset_control_assert(priv->rstc); - } - - static int rzg2l_wdt_probe(struct platform_device *pdev) -@@ -285,19 +288,9 @@ static int rzg2l_wdt_probe(struct platform_device *pdev) - return dev_err_probe(&pdev->dev, PTR_ERR(priv->rstc), - "failed to get cpg reset"); - -- ret = reset_control_deassert(priv->rstc); -- if (ret) -- return dev_err_probe(dev, ret, "failed to deassert"); -- - priv->devtype = (uintptr_t)of_device_get_match_data(dev); - -- if (priv->devtype == WDT_RZV2M) { -- priv->minimum_assertion_period = RZV2M_A_NSEC + -- 3 * F2CYCLE_NSEC(pclk_rate) + 5 * -- max(F2CYCLE_NSEC(priv->osc_clk_rate), -- F2CYCLE_NSEC(pclk_rate)); -- } -- -+ pm_runtime_irq_safe(&pdev->dev); - pm_runtime_enable(&pdev->dev); - - priv->wdev.info = &rzg2l_wdt_ident; -@@ -309,9 +302,7 @@ static int rzg2l_wdt_probe(struct platform_device *pdev) - priv->wdev.timeout = WDT_DEFAULT_TIMEOUT; - - watchdog_set_drvdata(&priv->wdev, priv); -- ret = devm_add_action_or_reset(&pdev->dev, -- rzg2l_wdt_reset_assert_pm_disable, -- &priv->wdev); -+ ret = devm_add_action_or_reset(&pdev->dev, rzg2l_wdt_pm_disable, &priv->wdev); - if (ret < 0) - return ret; - -diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c -index 25c902e7556d57..4b21ca49b6665d 100644 ---- a/fs/btrfs/ctree.c -+++ b/fs/btrfs/ctree.c -@@ -526,13 +526,13 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans, - * bytes the allocator should try to find free next to the block it returns. - * This is just a hint and may be ignored by the allocator. - */ --static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans, -- struct btrfs_root *root, -- struct extent_buffer *buf, -- struct extent_buffer *parent, int parent_slot, -- struct extent_buffer **cow_ret, -- u64 search_start, u64 empty_size, -- enum btrfs_lock_nesting nest) -+int btrfs_force_cow_block(struct btrfs_trans_handle *trans, -+ struct btrfs_root *root, -+ struct extent_buffer *buf, -+ struct extent_buffer *parent, int parent_slot, -+ struct extent_buffer **cow_ret, -+ u64 search_start, u64 empty_size, -+ enum btrfs_lock_nesting nest) - { - struct btrfs_fs_info *fs_info = root->fs_info; - struct btrfs_disk_key disk_key; -@@ -660,6 +660,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans, - return ret; - } - } -+ -+ trace_btrfs_cow_block(root, buf, cow); - if (unlock_orig) - btrfs_tree_unlock(buf); - free_extent_buffer_stale(buf); -@@ -699,7 +701,7 @@ static inline int should_cow_block(struct btrfs_trans_handle *trans, - } - - /* -- * cows a single block, see __btrfs_cow_block for the real work. -+ * COWs a single block, see btrfs_force_cow_block() for the real work. - * This version of it has extra checks so that a block isn't COWed more than - * once per transaction, as long as it hasn't been written yet - */ -@@ -711,7 +713,6 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans, - { - struct btrfs_fs_info *fs_info = root->fs_info; - u64 search_start; -- int ret; - - if (unlikely(test_bit(BTRFS_ROOT_DELETING, &root->state))) { - btrfs_abort_transaction(trans, -EUCLEAN); -@@ -752,12 +753,8 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans, - * Also We don't care about the error, as it's handled internally. - */ - btrfs_qgroup_trace_subtree_after_cow(trans, root, buf); -- ret = __btrfs_cow_block(trans, root, buf, parent, -- parent_slot, cow_ret, search_start, 0, nest); -- -- trace_btrfs_cow_block(root, buf, *cow_ret); -- -- return ret; -+ return btrfs_force_cow_block(trans, root, buf, parent, parent_slot, -+ cow_ret, search_start, 0, nest); - } - ALLOW_ERROR_INJECTION(btrfs_cow_block, ERRNO); - -@@ -904,11 +901,11 @@ int btrfs_realloc_node(struct btrfs_trans_handle *trans, - search_start = last_block; - - btrfs_tree_lock(cur); -- err = __btrfs_cow_block(trans, root, cur, parent, i, -- &cur, search_start, -- min(16 * blocksize, -- (end_slot - i) * blocksize), -- BTRFS_NESTING_COW); -+ err = btrfs_force_cow_block(trans, root, cur, parent, i, -+ &cur, search_start, -+ min(16 * blocksize, -+ (end_slot - i) * blocksize), -+ BTRFS_NESTING_COW); - if (err) { - btrfs_tree_unlock(cur); - free_extent_buffer(cur); -diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h -index f7bb4c34b984b3..7df3ed2945b049 100644 ---- a/fs/btrfs/ctree.h -+++ b/fs/btrfs/ctree.h -@@ -538,6 +538,13 @@ int btrfs_cow_block(struct btrfs_trans_handle *trans, - struct extent_buffer *parent, int parent_slot, - struct extent_buffer **cow_ret, - enum btrfs_lock_nesting nest); -+int btrfs_force_cow_block(struct btrfs_trans_handle *trans, -+ struct btrfs_root *root, -+ struct extent_buffer *buf, -+ struct extent_buffer *parent, int parent_slot, -+ struct extent_buffer **cow_ret, -+ u64 search_start, u64 empty_size, -+ enum btrfs_lock_nesting nest); - int btrfs_copy_root(struct btrfs_trans_handle *trans, - struct btrfs_root *root, - struct extent_buffer *buf, -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index 8ec411eb9c9b0c..967c6b5dd0a434 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -4323,6 +4323,15 @@ void __cold close_ctree(struct btrfs_fs_info *fs_info) - * already the cleaner, but below we run all pending delayed iputs. - */ - btrfs_flush_workqueue(fs_info->fixup_workers); -+ /* -+ * Similar case here, we have to wait for delalloc workers before we -+ * proceed below and stop the cleaner kthread, otherwise we trigger a -+ * use-after-tree on the cleaner kthread task_struct when a delalloc -+ * worker running submit_compressed_extents() adds a delayed iput, which -+ * does a wake up on the cleaner kthread, which was already freed below -+ * when we call kthread_stop(). -+ */ -+ btrfs_flush_workqueue(fs_info->delalloc_workers); - - /* - * After we parked the cleaner kthread, ordered extents may have -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index d6767f728c079d..eb9319d856f2d8 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -9972,7 +9972,7 @@ static void btrfs_encoded_read_endio(struct btrfs_bio *bbio) - */ - WRITE_ONCE(priv->status, bbio->bio.bi_status); - } -- if (!atomic_dec_return(&priv->pending)) -+ if (atomic_dec_and_test(&priv->pending)) - wake_up(&priv->wait); - bio_put(&bbio->bio); - } -diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c -index 11289ce8a8cc81..dfa1b3c82b53ac 100644 ---- a/fs/ceph/mds_client.c -+++ b/fs/ceph/mds_client.c -@@ -2713,12 +2713,11 @@ char *ceph_mdsc_build_path(struct ceph_mds_client *mdsc, struct dentry *dentry, - - if (pos < 0) { - /* -- * A rename didn't occur, but somehow we didn't end up where -- * we thought we would. Throw a warning and try again. -+ * The path is longer than PATH_MAX and this function -+ * cannot ever succeed. Creating paths that long is -+ * possible with Ceph, but Linux cannot use them. - */ -- pr_warn("build_path did not end path lookup where expected (pos = %d)\n", -- pos); -- goto retry; -+ return ERR_PTR(-ENAMETOOLONG); - } - - *pbase = base; -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index 3db01b933c3e8b..60455c84a93742 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -891,10 +891,13 @@ do { \ - (raw_inode)->xtime = cpu_to_le32(clamp_t(int32_t, (ts).tv_sec, S32_MIN, S32_MAX)); \ - } while (0) - --#define EXT4_INODE_SET_XTIME(xtime, inode, raw_inode) \ -- EXT4_INODE_SET_XTIME_VAL(xtime, inode, raw_inode, (inode)->xtime) -+#define EXT4_INODE_SET_ATIME(inode, raw_inode) \ -+ EXT4_INODE_SET_XTIME_VAL(i_atime, inode, raw_inode, inode_get_atime(inode)) - --#define EXT4_INODE_SET_CTIME(inode, raw_inode) \ -+#define EXT4_INODE_SET_MTIME(inode, raw_inode) \ -+ EXT4_INODE_SET_XTIME_VAL(i_mtime, inode, raw_inode, inode_get_mtime(inode)) -+ -+#define EXT4_INODE_SET_CTIME(inode, raw_inode) \ - EXT4_INODE_SET_XTIME_VAL(i_ctime, inode, raw_inode, inode_get_ctime(inode)) - - #define EXT4_EINODE_SET_XTIME(xtime, einode, raw_inode) \ -@@ -910,9 +913,16 @@ do { \ - .tv_sec = (signed)le32_to_cpu((raw_inode)->xtime) \ - }) - --#define EXT4_INODE_GET_XTIME(xtime, inode, raw_inode) \ -+#define EXT4_INODE_GET_ATIME(inode, raw_inode) \ -+do { \ -+ inode_set_atime_to_ts(inode, \ -+ EXT4_INODE_GET_XTIME_VAL(i_atime, inode, raw_inode)); \ -+} while (0) -+ -+#define EXT4_INODE_GET_MTIME(inode, raw_inode) \ - do { \ -- (inode)->xtime = EXT4_INODE_GET_XTIME_VAL(xtime, inode, raw_inode); \ -+ inode_set_mtime_to_ts(inode, \ -+ EXT4_INODE_GET_XTIME_VAL(i_mtime, inode, raw_inode)); \ - } while (0) - - #define EXT4_INODE_GET_CTIME(inode, raw_inode) \ -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index 5ea75af6ca2239..32218ac7f50fe2 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -4475,7 +4475,7 @@ static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset, - int depth = 0; - struct ext4_map_blocks map; - unsigned int credits; -- loff_t epos; -+ loff_t epos, old_size = i_size_read(inode); - - BUG_ON(!ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)); - map.m_lblk = offset; -@@ -4532,7 +4532,13 @@ static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset, - if (epos > new_size) - epos = new_size; - if (ext4_update_inode_size(inode, epos) & 0x1) -- inode->i_mtime = inode_get_ctime(inode); -+ inode_set_mtime_to_ts(inode, -+ inode_get_ctime(inode)); -+ if (epos > old_size) { -+ pagecache_isize_extended(inode, old_size, epos); -+ ext4_zero_partial_blocks(handle, inode, -+ old_size, epos - old_size); -+ } - } - ret2 = ext4_mark_inode_dirty(handle, inode); - ext4_update_inode_fsync_trans(handle, inode, 1); -@@ -4670,7 +4676,7 @@ static long ext4_zero_range(struct file *file, loff_t offset, - - /* Now release the pages and zero block aligned part of pages */ - truncate_pagecache_range(inode, start, end - 1); -- inode->i_mtime = inode_set_ctime_current(inode); -+ inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode)); - - ret = ext4_alloc_file_blocks(file, lblk, max_blocks, new_size, - flags); -@@ -4695,7 +4701,7 @@ static long ext4_zero_range(struct file *file, loff_t offset, - goto out_mutex; - } - -- inode->i_mtime = inode_set_ctime_current(inode); -+ inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode)); - if (new_size) - ext4_update_inode_size(inode, new_size); - ret = ext4_mark_inode_dirty(handle, inode); -@@ -5431,7 +5437,7 @@ static int ext4_collapse_range(struct file *file, loff_t offset, loff_t len) - up_write(&EXT4_I(inode)->i_data_sem); - if (IS_SYNC(inode)) - ext4_handle_sync(handle); -- inode->i_mtime = inode_set_ctime_current(inode); -+ inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode)); - ret = ext4_mark_inode_dirty(handle, inode); - ext4_update_inode_fsync_trans(handle, inode, 1); - -@@ -5541,7 +5547,7 @@ static int ext4_insert_range(struct file *file, loff_t offset, loff_t len) - /* Expand file to avoid data loss if there is error while shifting */ - inode->i_size += len; - EXT4_I(inode)->i_disksize += len; -- inode->i_mtime = inode_set_ctime_current(inode); -+ inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode)); - ret = ext4_mark_inode_dirty(handle, inode); - if (ret) - goto out_stop; -diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c -index d4d0ad689d3c1c..52f2959d29e6e0 100644 ---- a/fs/ext4/ialloc.c -+++ b/fs/ext4/ialloc.c -@@ -1255,8 +1255,8 @@ struct inode *__ext4_new_inode(struct mnt_idmap *idmap, - inode->i_ino = ino + group * EXT4_INODES_PER_GROUP(sb); - /* This is the optimal IO size (for stat), not the fs block size */ - inode->i_blocks = 0; -- inode->i_mtime = inode->i_atime = inode_set_ctime_current(inode); -- ei->i_crtime = inode->i_mtime; -+ simple_inode_init_ts(inode); -+ ei->i_crtime = inode_get_mtime(inode); - - memset(ei->i_data, 0, sizeof(ei->i_data)); - ei->i_dir_start_lookup = 0; -diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c -index cb65052ee3dec6..3f363276ddd360 100644 ---- a/fs/ext4/inline.c -+++ b/fs/ext4/inline.c -@@ -1037,7 +1037,7 @@ static int ext4_add_dirent_to_inline(handle_t *handle, - * happen is that the times are slightly out of date - * and/or different from the directory change time. - */ -- dir->i_mtime = inode_set_ctime_current(dir); -+ inode_set_mtime_to_ts(dir, inode_set_ctime_current(dir)); - ext4_update_dx_flag(dir); - inode_inc_iversion(dir); - return 1; -@@ -2010,7 +2010,7 @@ int ext4_inline_data_truncate(struct inode *inode, int *has_inline) - ext4_orphan_del(handle, inode); - - if (err == 0) { -- inode->i_mtime = inode_set_ctime_current(inode); -+ inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode)); - err = ext4_mark_inode_dirty(handle, inode); - if (IS_SYNC(inode)) - ext4_handle_sync(handle); -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 18ec9106c5b09f..19d7bcf16ebb88 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -1328,8 +1328,10 @@ static int ext4_write_end(struct file *file, - folio_unlock(folio); - folio_put(folio); - -- if (old_size < pos && !verity) -+ if (old_size < pos && !verity) { - pagecache_isize_extended(inode, old_size, pos); -+ ext4_zero_partial_blocks(handle, inode, old_size, pos - old_size); -+ } - /* - * Don't mark the inode dirty under folio lock. First, it unnecessarily - * makes the holding time of folio lock longer. Second, it forces lock -@@ -1445,8 +1447,10 @@ static int ext4_journalled_write_end(struct file *file, - folio_unlock(folio); - folio_put(folio); - -- if (old_size < pos && !verity) -+ if (old_size < pos && !verity) { - pagecache_isize_extended(inode, old_size, pos); -+ ext4_zero_partial_blocks(handle, inode, old_size, pos - old_size); -+ } - - if (size_changed) { - ret2 = ext4_mark_inode_dirty(handle, inode); -@@ -2971,7 +2975,8 @@ static int ext4_da_do_write_end(struct address_space *mapping, - struct inode *inode = mapping->host; - loff_t old_size = inode->i_size; - bool disksize_changed = false; -- loff_t new_i_size; -+ loff_t new_i_size, zero_len = 0; -+ handle_t *handle; - - if (unlikely(!folio_buffers(folio))) { - folio_unlock(folio); -@@ -3015,18 +3020,21 @@ static int ext4_da_do_write_end(struct address_space *mapping, - folio_unlock(folio); - folio_put(folio); - -- if (old_size < pos) -+ if (pos > old_size) { - pagecache_isize_extended(inode, old_size, pos); -+ zero_len = pos - old_size; -+ } - -- if (disksize_changed) { -- handle_t *handle; -+ if (!disksize_changed && !zero_len) -+ return copied; - -- handle = ext4_journal_start(inode, EXT4_HT_INODE, 2); -- if (IS_ERR(handle)) -- return PTR_ERR(handle); -- ext4_mark_inode_dirty(handle, inode); -- ext4_journal_stop(handle); -- } -+ handle = ext4_journal_start(inode, EXT4_HT_INODE, 2); -+ if (IS_ERR(handle)) -+ return PTR_ERR(handle); -+ if (zero_len) -+ ext4_zero_partial_blocks(handle, inode, old_size, zero_len); -+ ext4_mark_inode_dirty(handle, inode); -+ ext4_journal_stop(handle); - - return copied; - } -@@ -4055,7 +4063,7 @@ int ext4_punch_hole(struct file *file, loff_t offset, loff_t length) - if (IS_SYNC(inode)) - ext4_handle_sync(handle); - -- inode->i_mtime = inode_set_ctime_current(inode); -+ inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode)); - ret2 = ext4_mark_inode_dirty(handle, inode); - if (unlikely(ret2)) - ret = ret2; -@@ -4215,7 +4223,7 @@ int ext4_truncate(struct inode *inode) - if (inode->i_nlink) - ext4_orphan_del(handle, inode); - -- inode->i_mtime = inode_set_ctime_current(inode); -+ inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode)); - err2 = ext4_mark_inode_dirty(handle, inode); - if (unlikely(err2 && !err)) - err = err2; -@@ -4319,8 +4327,8 @@ static int ext4_fill_raw_inode(struct inode *inode, struct ext4_inode *raw_inode - raw_inode->i_links_count = cpu_to_le16(inode->i_nlink); - - EXT4_INODE_SET_CTIME(inode, raw_inode); -- EXT4_INODE_SET_XTIME(i_mtime, inode, raw_inode); -- EXT4_INODE_SET_XTIME(i_atime, inode, raw_inode); -+ EXT4_INODE_SET_MTIME(inode, raw_inode); -+ EXT4_INODE_SET_ATIME(inode, raw_inode); - EXT4_EINODE_SET_XTIME(i_crtime, ei, raw_inode); - - raw_inode->i_dtime = cpu_to_le32(ei->i_dtime); -@@ -4928,8 +4936,8 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, - } - - EXT4_INODE_GET_CTIME(inode, raw_inode); -- EXT4_INODE_GET_XTIME(i_mtime, inode, raw_inode); -- EXT4_INODE_GET_XTIME(i_atime, inode, raw_inode); -+ EXT4_INODE_GET_ATIME(inode, raw_inode); -+ EXT4_INODE_GET_MTIME(inode, raw_inode); - EXT4_EINODE_GET_XTIME(i_crtime, ei, raw_inode); - - if (likely(!test_opt2(inode->i_sb, HURD_COMPAT))) { -@@ -5054,8 +5062,8 @@ static void __ext4_update_other_inode_time(struct super_block *sb, - - spin_lock(&ei->i_raw_lock); - EXT4_INODE_SET_CTIME(inode, raw_inode); -- EXT4_INODE_SET_XTIME(i_mtime, inode, raw_inode); -- EXT4_INODE_SET_XTIME(i_atime, inode, raw_inode); -+ EXT4_INODE_SET_MTIME(inode, raw_inode); -+ EXT4_INODE_SET_ATIME(inode, raw_inode); - ext4_inode_csum_set(inode, raw_inode, ei); - spin_unlock(&ei->i_raw_lock); - trace_ext4_other_inode_update_time(inode, orig_ino); -@@ -5437,6 +5445,14 @@ int ext4_setattr(struct mnt_idmap *idmap, struct dentry *dentry, - } - - if (attr->ia_size != inode->i_size) { -+ /* attach jbd2 jinode for EOF folio tail zeroing */ -+ if (attr->ia_size & (inode->i_sb->s_blocksize - 1) || -+ oldsize & (inode->i_sb->s_blocksize - 1)) { -+ error = ext4_inode_attach_jinode(inode); -+ if (error) -+ goto err_out; -+ } -+ - handle = ext4_journal_start(inode, EXT4_HT_INODE, 3); - if (IS_ERR(handle)) { - error = PTR_ERR(handle); -@@ -5447,11 +5463,17 @@ int ext4_setattr(struct mnt_idmap *idmap, struct dentry *dentry, - orphan = 1; - } - /* -- * Update c/mtime on truncate up, ext4_truncate() will -- * update c/mtime in shrink case below -+ * Update c/mtime and tail zero the EOF folio on -+ * truncate up. ext4_truncate() handles the shrink case -+ * below. - */ -- if (!shrink) -- inode->i_mtime = inode_set_ctime_current(inode); -+ if (!shrink) { -+ inode_set_mtime_to_ts(inode, -+ inode_set_ctime_current(inode)); -+ if (oldsize & (inode->i_sb->s_blocksize - 1)) -+ ext4_block_truncate_page(handle, -+ inode->i_mapping, oldsize); -+ } - - if (shrink) - ext4_fc_track_range(handle, inode, -diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c -index 0bfe2ce589e224..4f931f80cb3489 100644 ---- a/fs/ext4/ioctl.c -+++ b/fs/ext4/ioctl.c -@@ -312,13 +312,22 @@ static void swap_inode_data(struct inode *inode1, struct inode *inode2) - struct ext4_inode_info *ei1; - struct ext4_inode_info *ei2; - unsigned long tmp; -+ struct timespec64 ts1, ts2; - - ei1 = EXT4_I(inode1); - ei2 = EXT4_I(inode2); - - swap(inode1->i_version, inode2->i_version); -- swap(inode1->i_atime, inode2->i_atime); -- swap(inode1->i_mtime, inode2->i_mtime); -+ -+ ts1 = inode_get_atime(inode1); -+ ts2 = inode_get_atime(inode2); -+ inode_set_atime_to_ts(inode1, ts2); -+ inode_set_atime_to_ts(inode2, ts1); -+ -+ ts1 = inode_get_mtime(inode1); -+ ts2 = inode_get_mtime(inode2); -+ inode_set_mtime_to_ts(inode1, ts2); -+ inode_set_mtime_to_ts(inode2, ts1); - - memswap(ei1->i_data, ei2->i_data, sizeof(ei1->i_data)); - tmp = ei1->i_flags & EXT4_FL_SHOULD_SWAP; -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index 4de1f61bba76b3..96a048d3f51bf5 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -2210,7 +2210,7 @@ static int add_dirent_to_buf(handle_t *handle, struct ext4_filename *fname, - * happen is that the times are slightly out of date - * and/or different from the directory change time. - */ -- dir->i_mtime = inode_set_ctime_current(dir); -+ inode_set_mtime_to_ts(dir, inode_set_ctime_current(dir)); - ext4_update_dx_flag(dir); - inode_inc_iversion(dir); - err2 = ext4_mark_inode_dirty(handle, dir); -@@ -3248,7 +3248,7 @@ static int ext4_rmdir(struct inode *dir, struct dentry *dentry) - * recovery. */ - inode->i_size = 0; - ext4_orphan_add(handle, inode); -- dir->i_mtime = inode_set_ctime_current(dir); -+ inode_set_mtime_to_ts(dir, inode_set_ctime_current(dir)); - inode_set_ctime_current(inode); - retval = ext4_mark_inode_dirty(handle, inode); - if (retval) -@@ -3323,7 +3323,7 @@ int __ext4_unlink(struct inode *dir, const struct qstr *d_name, - retval = ext4_delete_entry(handle, dir, de, bh); - if (retval) - goto out_handle; -- dir->i_mtime = inode_set_ctime_current(dir); -+ inode_set_mtime_to_ts(dir, inode_set_ctime_current(dir)); - ext4_update_dx_flag(dir); - retval = ext4_mark_inode_dirty(handle, dir); - if (retval) -@@ -3691,7 +3691,7 @@ static int ext4_setent(handle_t *handle, struct ext4_renament *ent, - if (ext4_has_feature_filetype(ent->dir->i_sb)) - ent->de->file_type = file_type; - inode_inc_iversion(ent->dir); -- ent->dir->i_mtime = inode_set_ctime_current(ent->dir); -+ inode_set_mtime_to_ts(ent->dir, inode_set_ctime_current(ent->dir)); - retval = ext4_mark_inode_dirty(handle, ent->dir); - BUFFER_TRACE(ent->bh, "call ext4_handle_dirty_metadata"); - if (!ent->inlined) { -@@ -4006,7 +4006,7 @@ static int ext4_rename(struct mnt_idmap *idmap, struct inode *old_dir, - ext4_dec_count(new.inode); - inode_set_ctime_current(new.inode); - } -- old.dir->i_mtime = inode_set_ctime_current(old.dir); -+ inode_set_mtime_to_ts(old.dir, inode_set_ctime_current(old.dir)); - ext4_update_dx_flag(old.dir); - if (old.dir_bh) { - retval = ext4_rename_dir_finish(handle, &old, new.dir->i_ino); -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 2346ef071b2421..71ced0ada9a2e5 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -7180,7 +7180,7 @@ static int ext4_quota_off(struct super_block *sb, int type) - } - EXT4_I(inode)->i_flags &= ~(EXT4_NOATIME_FL | EXT4_IMMUTABLE_FL); - inode_set_flags(inode, 0, S_NOATIME | S_IMMUTABLE); -- inode->i_mtime = inode_set_ctime_current(inode); -+ inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode)); - err = ext4_mark_inode_dirty(handle, inode); - ext4_journal_stop(handle); - out_unlock: -diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c -index f40785bc4e5549..df5ab1a75fc482 100644 ---- a/fs/ext4/xattr.c -+++ b/fs/ext4/xattr.c -@@ -356,7 +356,7 @@ ext4_xattr_inode_hash(struct ext4_sb_info *sbi, const void *buffer, size_t size) - - static u64 ext4_xattr_inode_get_ref(struct inode *ea_inode) - { -- return ((u64) inode_get_ctime(ea_inode).tv_sec << 32) | -+ return ((u64) inode_get_ctime_sec(ea_inode) << 32) | - (u32) inode_peek_iversion_raw(ea_inode); - } - -@@ -368,12 +368,12 @@ static void ext4_xattr_inode_set_ref(struct inode *ea_inode, u64 ref_count) - - static u32 ext4_xattr_inode_get_hash(struct inode *ea_inode) - { -- return (u32)ea_inode->i_atime.tv_sec; -+ return (u32) inode_get_atime_sec(ea_inode); - } - - static void ext4_xattr_inode_set_hash(struct inode *ea_inode, u32 hash) - { -- ea_inode->i_atime.tv_sec = hash; -+ inode_set_atime(ea_inode, hash, 0); - } - - /* -@@ -418,7 +418,7 @@ static int ext4_xattr_inode_read(struct inode *ea_inode, void *buf, size_t size) - return ret; - } - --#define EXT4_XATTR_INODE_GET_PARENT(inode) ((__u32)(inode)->i_mtime.tv_sec) -+#define EXT4_XATTR_INODE_GET_PARENT(inode) ((__u32)(inode_get_mtime_sec(inode))) - - static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_ino, - u32 ea_inode_hash, struct inode **ea_inode) -diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c -index 196755a34833d2..ae129044c52f42 100644 ---- a/fs/f2fs/file.c -+++ b/fs/f2fs/file.c -@@ -1037,6 +1037,13 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, - return err; - } - -+ /* -+ * wait for inflight dio, blocks should be removed after -+ * IO completion. -+ */ -+ if (attr->ia_size < old_size) -+ inode_dio_wait(inode); -+ - f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); - filemap_invalidate_lock(inode->i_mapping); - -@@ -1873,6 +1880,12 @@ static long f2fs_fallocate(struct file *file, int mode, - if (ret) - goto out; - -+ /* -+ * wait for inflight dio, blocks should be removed after IO -+ * completion. -+ */ -+ inode_dio_wait(inode); -+ - if (mode & FALLOC_FL_PUNCH_HOLE) { - if (offset >= inode->i_size) - goto out; -diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c -index fc6cea60044edf..e25989dd2c6bba 100644 ---- a/fs/ntfs3/attrib.c -+++ b/fs/ntfs3/attrib.c -@@ -977,15 +977,17 @@ int attr_data_get_block(struct ntfs_inode *ni, CLST vcn, CLST clen, CLST *lcn, - goto out; - - /* Check for compressed frame. */ -- err = attr_is_frame_compressed(ni, attr, vcn >> NTFS_LZNT_CUNIT, &hint); -+ err = attr_is_frame_compressed(ni, attr_b, vcn >> NTFS_LZNT_CUNIT, -+ &hint, run); - if (err) - goto out; - - if (hint) { - /* if frame is compressed - don't touch it. */ - *lcn = COMPRESSED_LCN; -- *len = hint; -- err = -EOPNOTSUPP; -+ /* length to the end of frame. */ -+ *len = NTFS_LZNT_CLUSTERS - (vcn & (NTFS_LZNT_CLUSTERS - 1)); -+ err = 0; - goto out; - } - -@@ -1028,16 +1030,16 @@ int attr_data_get_block(struct ntfs_inode *ni, CLST vcn, CLST clen, CLST *lcn, - - /* Check if 'vcn' and 'vcn0' in different attribute segments. */ - if (vcn < svcn || evcn1 <= vcn) { -- /* Load attribute for truncated vcn. */ -- attr = ni_find_attr(ni, attr_b, &le, ATTR_DATA, NULL, 0, -- &vcn, &mi); -- if (!attr) { -+ struct ATTRIB *attr2; -+ /* Load runs for truncated vcn. */ -+ attr2 = ni_find_attr(ni, attr_b, &le_b, ATTR_DATA, NULL, -+ 0, &vcn, &mi); -+ if (!attr2) { - err = -EINVAL; - goto out; - } -- svcn = le64_to_cpu(attr->nres.svcn); -- evcn1 = le64_to_cpu(attr->nres.evcn) + 1; -- err = attr_load_runs(attr, ni, run, NULL); -+ evcn1 = le64_to_cpu(attr2->nres.evcn) + 1; -+ err = attr_load_runs(attr2, ni, run, NULL); - if (err) - goto out; - } -@@ -1530,15 +1532,18 @@ int attr_wof_frame_info(struct ntfs_inode *ni, struct ATTRIB *attr, - - /* - * attr_is_frame_compressed - Used to detect compressed frame. -+ * -+ * attr - base (primary) attribute segment. -+ * run - run to use, usually == &ni->file.run. -+ * Only base segments contains valid 'attr->nres.c_unit' - */ - int attr_is_frame_compressed(struct ntfs_inode *ni, struct ATTRIB *attr, -- CLST frame, CLST *clst_data) -+ CLST frame, CLST *clst_data, struct runs_tree *run) - { - int err; - u32 clst_frame; - CLST clen, lcn, vcn, alen, slen, vcn_next; - size_t idx; -- struct runs_tree *run; - - *clst_data = 0; - -@@ -1550,7 +1555,6 @@ int attr_is_frame_compressed(struct ntfs_inode *ni, struct ATTRIB *attr, - - clst_frame = 1u << attr->nres.c_unit; - vcn = frame * clst_frame; -- run = &ni->file.run; - - if (!run_lookup_entry(run, vcn, &lcn, &clen, &idx)) { - err = attr_load_runs_vcn(ni, attr->type, attr_name(attr), -@@ -1686,7 +1690,7 @@ int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size, - if (err) - goto out; - -- err = attr_is_frame_compressed(ni, attr_b, frame, &clst_data); -+ err = attr_is_frame_compressed(ni, attr_b, frame, &clst_data, run); - if (err) - goto out; - -diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c -index 12e03feb3074a0..3c876c468c2c47 100644 ---- a/fs/ntfs3/frecord.c -+++ b/fs/ntfs3/frecord.c -@@ -1900,46 +1900,6 @@ enum REPARSE_SIGN ni_parse_reparse(struct ntfs_inode *ni, struct ATTRIB *attr, - return REPARSE_LINK; - } - --/* -- * fiemap_fill_next_extent_k - a copy of fiemap_fill_next_extent -- * but it uses 'fe_k' instead of fieinfo->fi_extents_start -- */ --static int fiemap_fill_next_extent_k(struct fiemap_extent_info *fieinfo, -- struct fiemap_extent *fe_k, u64 logical, -- u64 phys, u64 len, u32 flags) --{ -- struct fiemap_extent extent; -- -- /* only count the extents */ -- if (fieinfo->fi_extents_max == 0) { -- fieinfo->fi_extents_mapped++; -- return (flags & FIEMAP_EXTENT_LAST) ? 1 : 0; -- } -- -- if (fieinfo->fi_extents_mapped >= fieinfo->fi_extents_max) -- return 1; -- -- if (flags & FIEMAP_EXTENT_DELALLOC) -- flags |= FIEMAP_EXTENT_UNKNOWN; -- if (flags & FIEMAP_EXTENT_DATA_ENCRYPTED) -- flags |= FIEMAP_EXTENT_ENCODED; -- if (flags & (FIEMAP_EXTENT_DATA_TAIL | FIEMAP_EXTENT_DATA_INLINE)) -- flags |= FIEMAP_EXTENT_NOT_ALIGNED; -- -- memset(&extent, 0, sizeof(extent)); -- extent.fe_logical = logical; -- extent.fe_physical = phys; -- extent.fe_length = len; -- extent.fe_flags = flags; -- -- memcpy(fe_k + fieinfo->fi_extents_mapped, &extent, sizeof(extent)); -- -- fieinfo->fi_extents_mapped++; -- if (fieinfo->fi_extents_mapped == fieinfo->fi_extents_max) -- return 1; -- return (flags & FIEMAP_EXTENT_LAST) ? 1 : 0; --} -- - /* - * ni_fiemap - Helper for file_fiemap(). - * -@@ -1950,11 +1910,9 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, - __u64 vbo, __u64 len) - { - int err = 0; -- struct fiemap_extent *fe_k = NULL; - struct ntfs_sb_info *sbi = ni->mi.sbi; - u8 cluster_bits = sbi->cluster_bits; -- struct runs_tree *run; -- struct rw_semaphore *run_lock; -+ struct runs_tree run; - struct ATTRIB *attr; - CLST vcn = vbo >> cluster_bits; - CLST lcn, clen; -@@ -1965,13 +1923,11 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, - u32 flags; - bool ok; - -+ run_init(&run); - if (S_ISDIR(ni->vfs_inode.i_mode)) { -- run = &ni->dir.alloc_run; - attr = ni_find_attr(ni, NULL, NULL, ATTR_ALLOC, I30_NAME, - ARRAY_SIZE(I30_NAME), NULL, NULL); -- run_lock = &ni->dir.run_lock; - } else { -- run = &ni->file.run; - attr = ni_find_attr(ni, NULL, NULL, ATTR_DATA, NULL, 0, NULL, - NULL); - if (!attr) { -@@ -1986,7 +1942,6 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, - "fiemap is not supported for compressed file (cp -r)"); - goto out; - } -- run_lock = &ni->file.run_lock; - } - - if (!attr || !attr->non_res) { -@@ -1998,51 +1953,33 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, - goto out; - } - -- /* -- * To avoid lock problems replace pointer to user memory by pointer to kernel memory. -- */ -- fe_k = kmalloc_array(fieinfo->fi_extents_max, -- sizeof(struct fiemap_extent), -- GFP_NOFS | __GFP_ZERO); -- if (!fe_k) { -- err = -ENOMEM; -- goto out; -- } -- - end = vbo + len; - alloc_size = le64_to_cpu(attr->nres.alloc_size); - if (end > alloc_size) - end = alloc_size; - -- down_read(run_lock); - - while (vbo < end) { - if (idx == -1) { -- ok = run_lookup_entry(run, vcn, &lcn, &clen, &idx); -+ ok = run_lookup_entry(&run, vcn, &lcn, &clen, &idx); - } else { - CLST vcn_next = vcn; - -- ok = run_get_entry(run, ++idx, &vcn, &lcn, &clen) && -+ ok = run_get_entry(&run, ++idx, &vcn, &lcn, &clen) && - vcn == vcn_next; - if (!ok) - vcn = vcn_next; - } - - if (!ok) { -- up_read(run_lock); -- down_write(run_lock); -- - err = attr_load_runs_vcn(ni, attr->type, - attr_name(attr), -- attr->name_len, run, vcn); -- -- up_write(run_lock); -- down_read(run_lock); -+ attr->name_len, &run, vcn); - - if (err) - break; - -- ok = run_lookup_entry(run, vcn, &lcn, &clen, &idx); -+ ok = run_lookup_entry(&run, vcn, &lcn, &clen, &idx); - - if (!ok) { - err = -EINVAL; -@@ -2067,8 +2004,9 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, - } else if (is_attr_compressed(attr)) { - CLST clst_data; - -- err = attr_is_frame_compressed( -- ni, attr, vcn >> attr->nres.c_unit, &clst_data); -+ err = attr_is_frame_compressed(ni, attr, -+ vcn >> attr->nres.c_unit, -+ &clst_data, &run); - if (err) - break; - if (clst_data < NTFS_LZNT_CLUSTERS) -@@ -2097,8 +2035,8 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, - if (vbo + dlen >= end) - flags |= FIEMAP_EXTENT_LAST; - -- err = fiemap_fill_next_extent_k(fieinfo, fe_k, vbo, lbo, -- dlen, flags); -+ err = fiemap_fill_next_extent(fieinfo, vbo, lbo, dlen, -+ flags); - - if (err < 0) - break; -@@ -2119,8 +2057,7 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, - if (vbo + bytes >= end) - flags |= FIEMAP_EXTENT_LAST; - -- err = fiemap_fill_next_extent_k(fieinfo, fe_k, vbo, lbo, bytes, -- flags); -+ err = fiemap_fill_next_extent(fieinfo, vbo, lbo, bytes, flags); - if (err < 0) - break; - if (err == 1) { -@@ -2131,19 +2068,8 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, - vbo += bytes; - } - -- up_read(run_lock); -- -- /* -- * Copy to user memory out of lock -- */ -- if (copy_to_user(fieinfo->fi_extents_start, fe_k, -- fieinfo->fi_extents_max * -- sizeof(struct fiemap_extent))) { -- err = -EFAULT; -- } -- - out: -- kfree(fe_k); -+ run_close(&run); - return err; - } - -@@ -2674,7 +2600,8 @@ int ni_read_frame(struct ntfs_inode *ni, u64 frame_vbo, struct page **pages, - down_write(&ni->file.run_lock); - run_truncate_around(run, le64_to_cpu(attr->nres.svcn)); - frame = frame_vbo >> (cluster_bits + NTFS_LZNT_CUNIT); -- err = attr_is_frame_compressed(ni, attr, frame, &clst_data); -+ err = attr_is_frame_compressed(ni, attr, frame, &clst_data, -+ run); - up_write(&ni->file.run_lock); - if (err) - goto out1; -diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c -index 52b80fd1591478..af7c0cbba74e3d 100644 ---- a/fs/ntfs3/inode.c -+++ b/fs/ntfs3/inode.c -@@ -604,7 +604,8 @@ static noinline int ntfs_get_block_vbo(struct inode *inode, u64 vbo, - - bytes = ((u64)len << cluster_bits) - off; - -- if (lcn == SPARSE_LCN) { -+ if (lcn >= sbi->used.bitmap.nbits) { -+ /* This case includes resident/compressed/sparse. */ - if (!create) { - if (bh->b_size > bytes) - bh->b_size = bytes; -diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h -index cfe9d3bf07f910..c98e6868bfbadb 100644 ---- a/fs/ntfs3/ntfs_fs.h -+++ b/fs/ntfs3/ntfs_fs.h -@@ -446,7 +446,8 @@ int attr_wof_frame_info(struct ntfs_inode *ni, struct ATTRIB *attr, - struct runs_tree *run, u64 frame, u64 frames, - u8 frame_bits, u32 *ondisk_size, u64 *vbo_data); - int attr_is_frame_compressed(struct ntfs_inode *ni, struct ATTRIB *attr, -- CLST frame, CLST *clst_data); -+ CLST frame, CLST *clst_data, -+ struct runs_tree *run); - int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size, - u64 new_valid); - int attr_collapse_range(struct ntfs_inode *ni, u64 vbo, u64 bytes); -diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c -index dc9f76ab7e13c3..0dffd6a44d39dc 100644 ---- a/fs/ocfs2/quota_global.c -+++ b/fs/ocfs2/quota_global.c -@@ -881,7 +881,7 @@ static int ocfs2_get_next_id(struct super_block *sb, struct kqid *qid) - int status = 0; - - trace_ocfs2_get_next_id(from_kqid(&init_user_ns, *qid), type); -- if (!sb_has_quota_loaded(sb, type)) { -+ if (!sb_has_quota_active(sb, type)) { - status = -ESRCH; - goto out; - } -diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c -index 257f13cdd14c1f..4b4fa58cd32ff0 100644 ---- a/fs/ocfs2/quota_local.c -+++ b/fs/ocfs2/quota_local.c -@@ -864,6 +864,7 @@ static int ocfs2_local_free_info(struct super_block *sb, int type) - brelse(oinfo->dqi_libh); - brelse(oinfo->dqi_lqi_bh); - kfree(oinfo); -+ info->dqi_priv = NULL; - return status; - } - -diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c -index 59571737e16771..b8640f36ebf8ab 100644 ---- a/fs/proc/task_mmu.c -+++ b/fs/proc/task_mmu.c -@@ -1516,7 +1516,7 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end, - flags |= PM_FILE; - - for (; addr != end; addr += PAGE_SIZE, idx++) { -- unsigned long cur_flags = flags; -+ u64 cur_flags = flags; - pagemap_entry_t pme; - - if (page && (flags & PM_PRESENT) && -diff --git a/fs/smb/client/cifsacl.c b/fs/smb/client/cifsacl.c -index f5b6df82e8570a..bff8d0dd74fe7d 100644 ---- a/fs/smb/client/cifsacl.c -+++ b/fs/smb/client/cifsacl.c -@@ -27,18 +27,18 @@ - #include "cifs_unicode.h" - - /* security id for everyone/world system group */ --static const struct cifs_sid sid_everyone = { -+static const struct smb_sid sid_everyone = { - 1, 1, {0, 0, 0, 0, 0, 1}, {0} }; - /* security id for Authenticated Users system group */ --static const struct cifs_sid sid_authusers = { -+static const struct smb_sid sid_authusers = { - 1, 1, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(11)} }; - - /* S-1-22-1 Unmapped Unix users */ --static const struct cifs_sid sid_unix_users = {1, 1, {0, 0, 0, 0, 0, 22}, -+static const struct smb_sid sid_unix_users = {1, 1, {0, 0, 0, 0, 0, 22}, - {cpu_to_le32(1), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} }; - - /* S-1-22-2 Unmapped Unix groups */ --static const struct cifs_sid sid_unix_groups = { 1, 1, {0, 0, 0, 0, 0, 22}, -+static const struct smb_sid sid_unix_groups = { 1, 1, {0, 0, 0, 0, 0, 22}, - {cpu_to_le32(2), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} }; - - /* -@@ -48,17 +48,17 @@ static const struct cifs_sid sid_unix_groups = { 1, 1, {0, 0, 0, 0, 0, 22}, - /* S-1-5-88 MS NFS and Apple style UID/GID/mode */ - - /* S-1-5-88-1 Unix uid */ --static const struct cifs_sid sid_unix_NFS_users = { 1, 2, {0, 0, 0, 0, 0, 5}, -+static const struct smb_sid sid_unix_NFS_users = { 1, 2, {0, 0, 0, 0, 0, 5}, - {cpu_to_le32(88), - cpu_to_le32(1), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} }; - - /* S-1-5-88-2 Unix gid */ --static const struct cifs_sid sid_unix_NFS_groups = { 1, 2, {0, 0, 0, 0, 0, 5}, -+static const struct smb_sid sid_unix_NFS_groups = { 1, 2, {0, 0, 0, 0, 0, 5}, - {cpu_to_le32(88), - cpu_to_le32(2), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} }; - - /* S-1-5-88-3 Unix mode */ --static const struct cifs_sid sid_unix_NFS_mode = { 1, 2, {0, 0, 0, 0, 0, 5}, -+static const struct smb_sid sid_unix_NFS_mode = { 1, 2, {0, 0, 0, 0, 0, 5}, - {cpu_to_le32(88), - cpu_to_le32(3), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} }; - -@@ -106,7 +106,7 @@ static struct key_type cifs_idmap_key_type = { - }; - - static char * --sid_to_key_str(struct cifs_sid *sidptr, unsigned int type) -+sid_to_key_str(struct smb_sid *sidptr, unsigned int type) - { - int i, len; - unsigned int saval; -@@ -158,7 +158,7 @@ sid_to_key_str(struct cifs_sid *sidptr, unsigned int type) - * the same returns zero, if they do not match returns non-zero. - */ - static int --compare_sids(const struct cifs_sid *ctsid, const struct cifs_sid *cwsid) -+compare_sids(const struct smb_sid *ctsid, const struct smb_sid *cwsid) - { - int i; - int num_subauth, num_sat, num_saw; -@@ -204,11 +204,11 @@ compare_sids(const struct cifs_sid *ctsid, const struct cifs_sid *cwsid) - } - - static bool --is_well_known_sid(const struct cifs_sid *psid, uint32_t *puid, bool is_group) -+is_well_known_sid(const struct smb_sid *psid, uint32_t *puid, bool is_group) - { - int i; - int num_subauth; -- const struct cifs_sid *pwell_known_sid; -+ const struct smb_sid *pwell_known_sid; - - if (!psid || (puid == NULL)) - return false; -@@ -260,7 +260,7 @@ is_well_known_sid(const struct cifs_sid *psid, uint32_t *puid, bool is_group) - } - - static __u16 --cifs_copy_sid(struct cifs_sid *dst, const struct cifs_sid *src) -+cifs_copy_sid(struct smb_sid *dst, const struct smb_sid *src) - { - int i; - __u16 size = 1 + 1 + 6; -@@ -277,11 +277,11 @@ cifs_copy_sid(struct cifs_sid *dst, const struct cifs_sid *src) - } - - static int --id_to_sid(unsigned int cid, uint sidtype, struct cifs_sid *ssid) -+id_to_sid(unsigned int cid, uint sidtype, struct smb_sid *ssid) - { - int rc; - struct key *sidkey; -- struct cifs_sid *ksid; -+ struct smb_sid *ksid; - unsigned int ksid_size; - char desc[3 + 10 + 1]; /* 3 byte prefix + 10 bytes for value + NULL */ - const struct cred *saved_cred; -@@ -312,8 +312,8 @@ id_to_sid(unsigned int cid, uint sidtype, struct cifs_sid *ssid) - * it could be. - */ - ksid = sidkey->datalen <= sizeof(sidkey->payload) ? -- (struct cifs_sid *)&sidkey->payload : -- (struct cifs_sid *)sidkey->payload.data[0]; -+ (struct smb_sid *)&sidkey->payload : -+ (struct smb_sid *)sidkey->payload.data[0]; - - ksid_size = CIFS_SID_BASE_SIZE + (ksid->num_subauth * sizeof(__le32)); - if (ksid_size > sidkey->datalen) { -@@ -336,7 +336,7 @@ id_to_sid(unsigned int cid, uint sidtype, struct cifs_sid *ssid) - } - - int --sid_to_id(struct cifs_sb_info *cifs_sb, struct cifs_sid *psid, -+sid_to_id(struct cifs_sb_info *cifs_sb, struct smb_sid *psid, - struct cifs_fattr *fattr, uint sidtype) - { - int rc = 0; -@@ -515,43 +515,43 @@ exit_cifs_idmap(void) - } - - /* copy ntsd, owner sid, and group sid from a security descriptor to another */ --static __u32 copy_sec_desc(const struct cifs_ntsd *pntsd, -- struct cifs_ntsd *pnntsd, -+static __u32 copy_sec_desc(const struct smb_ntsd *pntsd, -+ struct smb_ntsd *pnntsd, - __u32 sidsoffset, -- struct cifs_sid *pownersid, -- struct cifs_sid *pgrpsid) -+ struct smb_sid *pownersid, -+ struct smb_sid *pgrpsid) - { -- struct cifs_sid *owner_sid_ptr, *group_sid_ptr; -- struct cifs_sid *nowner_sid_ptr, *ngroup_sid_ptr; -+ struct smb_sid *owner_sid_ptr, *group_sid_ptr; -+ struct smb_sid *nowner_sid_ptr, *ngroup_sid_ptr; - - /* copy security descriptor control portion */ - pnntsd->revision = pntsd->revision; - pnntsd->type = pntsd->type; -- pnntsd->dacloffset = cpu_to_le32(sizeof(struct cifs_ntsd)); -+ pnntsd->dacloffset = cpu_to_le32(sizeof(struct smb_ntsd)); - pnntsd->sacloffset = 0; - pnntsd->osidoffset = cpu_to_le32(sidsoffset); -- pnntsd->gsidoffset = cpu_to_le32(sidsoffset + sizeof(struct cifs_sid)); -+ pnntsd->gsidoffset = cpu_to_le32(sidsoffset + sizeof(struct smb_sid)); - - /* copy owner sid */ - if (pownersid) - owner_sid_ptr = pownersid; - else -- owner_sid_ptr = (struct cifs_sid *)((char *)pntsd + -+ owner_sid_ptr = (struct smb_sid *)((char *)pntsd + - le32_to_cpu(pntsd->osidoffset)); -- nowner_sid_ptr = (struct cifs_sid *)((char *)pnntsd + sidsoffset); -+ nowner_sid_ptr = (struct smb_sid *)((char *)pnntsd + sidsoffset); - cifs_copy_sid(nowner_sid_ptr, owner_sid_ptr); - - /* copy group sid */ - if (pgrpsid) - group_sid_ptr = pgrpsid; - else -- group_sid_ptr = (struct cifs_sid *)((char *)pntsd + -+ group_sid_ptr = (struct smb_sid *)((char *)pntsd + - le32_to_cpu(pntsd->gsidoffset)); -- ngroup_sid_ptr = (struct cifs_sid *)((char *)pnntsd + sidsoffset + -- sizeof(struct cifs_sid)); -+ ngroup_sid_ptr = (struct smb_sid *)((char *)pnntsd + sidsoffset + -+ sizeof(struct smb_sid)); - cifs_copy_sid(ngroup_sid_ptr, group_sid_ptr); - -- return sidsoffset + (2 * sizeof(struct cifs_sid)); -+ return sidsoffset + (2 * sizeof(struct smb_sid)); - } - - -@@ -666,7 +666,7 @@ static void mode_to_access_flags(umode_t mode, umode_t bits_to_use, - return; - } - --static __u16 cifs_copy_ace(struct cifs_ace *dst, struct cifs_ace *src, struct cifs_sid *psid) -+static __u16 cifs_copy_ace(struct smb_ace *dst, struct smb_ace *src, struct smb_sid *psid) - { - __u16 size = 1 + 1 + 2 + 4; - -@@ -685,8 +685,8 @@ static __u16 cifs_copy_ace(struct cifs_ace *dst, struct cifs_ace *src, struct ci - return size; - } - --static __u16 fill_ace_for_sid(struct cifs_ace *pntace, -- const struct cifs_sid *psid, __u64 nmode, -+static __u16 fill_ace_for_sid(struct smb_ace *pntace, -+ const struct smb_sid *psid, __u64 nmode, - umode_t bits, __u8 access_type, - bool allow_delete_child) - { -@@ -723,7 +723,7 @@ static __u16 fill_ace_for_sid(struct cifs_ace *pntace, - - - #ifdef CONFIG_CIFS_DEBUG2 --static void dump_ace(struct cifs_ace *pace, char *end_of_acl) -+static void dump_ace(struct smb_ace *pace, char *end_of_acl) - { - int num_subauth; - -@@ -758,15 +758,15 @@ static void dump_ace(struct cifs_ace *pace, char *end_of_acl) - } - #endif - --static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl, -- struct cifs_sid *pownersid, struct cifs_sid *pgrpsid, -+static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, -+ struct smb_sid *pownersid, struct smb_sid *pgrpsid, - struct cifs_fattr *fattr, bool mode_from_special_sid) - { - int i; - int num_aces = 0; - int acl_size; - char *acl_base; -- struct cifs_ace **ppace; -+ struct smb_ace **ppace; - - /* BB need to add parm so we can store the SID BB */ - -@@ -793,21 +793,21 @@ static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl, - fattr->cf_mode &= ~(0777); - - acl_base = (char *)pdacl; -- acl_size = sizeof(struct cifs_acl); -+ acl_size = sizeof(struct smb_acl); - - num_aces = le32_to_cpu(pdacl->num_aces); - if (num_aces > 0) { - umode_t denied_mode = 0; - -- if (num_aces > ULONG_MAX / sizeof(struct cifs_ace *)) -+ if (num_aces > ULONG_MAX / sizeof(struct smb_ace *)) - return; -- ppace = kmalloc_array(num_aces, sizeof(struct cifs_ace *), -+ ppace = kmalloc_array(num_aces, sizeof(struct smb_ace *), - GFP_KERNEL); - if (!ppace) - return; - - for (i = 0; i < num_aces; ++i) { -- ppace[i] = (struct cifs_ace *) (acl_base + acl_size); -+ ppace[i] = (struct smb_ace *) (acl_base + acl_size); - #ifdef CONFIG_CIFS_DEBUG2 - dump_ace(ppace[i], end_of_acl); - #endif -@@ -849,7 +849,7 @@ static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl, - - /* memcpy((void *)(&(cifscred->aces[i])), - (void *)ppace[i], -- sizeof(struct cifs_ace)); */ -+ sizeof(struct smb_ace)); */ - - acl_base = (char *)ppace[i]; - acl_size = le16_to_cpu(ppace[i]->size); -@@ -861,7 +861,7 @@ static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl, - return; - } - --unsigned int setup_authusers_ACE(struct cifs_ace *pntace) -+unsigned int setup_authusers_ACE(struct smb_ace *pntace) - { - int i; - unsigned int ace_size = 20; -@@ -885,12 +885,17 @@ unsigned int setup_authusers_ACE(struct cifs_ace *pntace) - * Fill in the special SID based on the mode. See - * https://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx - */ --unsigned int setup_special_mode_ACE(struct cifs_ace *pntace, __u64 nmode) -+unsigned int setup_special_mode_ACE(struct smb_ace *pntace, -+ bool posix, -+ __u64 nmode) - { - int i; - unsigned int ace_size = 28; - -- pntace->type = ACCESS_DENIED_ACE_TYPE; -+ if (posix) -+ pntace->type = ACCESS_ALLOWED_ACE_TYPE; -+ else -+ pntace->type = ACCESS_DENIED_ACE_TYPE; - pntace->flags = 0x0; - pntace->access_req = 0; - pntace->sid.num_subauth = 3; -@@ -907,7 +912,7 @@ unsigned int setup_special_mode_ACE(struct cifs_ace *pntace, __u64 nmode) - return ace_size; - } - --unsigned int setup_special_user_owner_ACE(struct cifs_ace *pntace) -+unsigned int setup_special_user_owner_ACE(struct smb_ace *pntace) - { - int i; - unsigned int ace_size = 28; -@@ -930,10 +935,11 @@ unsigned int setup_special_user_owner_ACE(struct cifs_ace *pntace) - } - - static void populate_new_aces(char *nacl_base, -- struct cifs_sid *pownersid, -- struct cifs_sid *pgrpsid, -+ struct smb_sid *pownersid, -+ struct smb_sid *pgrpsid, - __u64 *pnmode, u32 *pnum_aces, u16 *pnsize, -- bool modefromsid) -+ bool modefromsid, -+ bool posix) - { - __u64 nmode; - u32 num_aces = 0; -@@ -944,19 +950,21 @@ static void populate_new_aces(char *nacl_base, - __u64 deny_user_mode = 0; - __u64 deny_group_mode = 0; - bool sticky_set = false; -- struct cifs_ace *pnntace = NULL; -+ struct smb_ace *pnntace = NULL; - - nmode = *pnmode; - num_aces = *pnum_aces; - nsize = *pnsize; - -- if (modefromsid) { -- pnntace = (struct cifs_ace *) (nacl_base + nsize); -- nsize += setup_special_mode_ACE(pnntace, nmode); -- num_aces++; -- pnntace = (struct cifs_ace *) (nacl_base + nsize); -- nsize += setup_authusers_ACE(pnntace); -+ if (modefromsid || posix) { -+ pnntace = (struct smb_ace *) (nacl_base + nsize); -+ nsize += setup_special_mode_ACE(pnntace, posix, nmode); - num_aces++; -+ if (modefromsid) { -+ pnntace = (struct smb_ace *) (nacl_base + nsize); -+ nsize += setup_authusers_ACE(pnntace); -+ num_aces++; -+ } - goto set_size; - } - -@@ -967,7 +975,7 @@ static void populate_new_aces(char *nacl_base, - * updated in the inode. - */ - -- if (!memcmp(pownersid, pgrpsid, sizeof(struct cifs_sid))) { -+ if (!memcmp(pownersid, pgrpsid, sizeof(struct smb_sid))) { - /* - * Case when owner and group SIDs are the same. - * Set the more restrictive of the two modes. -@@ -992,7 +1000,7 @@ static void populate_new_aces(char *nacl_base, - sticky_set = true; - - if (deny_user_mode) { -- pnntace = (struct cifs_ace *) (nacl_base + nsize); -+ pnntace = (struct smb_ace *) (nacl_base + nsize); - nsize += fill_ace_for_sid(pnntace, pownersid, deny_user_mode, - 0700, ACCESS_DENIED, false); - num_aces++; -@@ -1000,31 +1008,31 @@ static void populate_new_aces(char *nacl_base, - - /* Group DENY ACE does not conflict with owner ALLOW ACE. Keep in preferred order*/ - if (deny_group_mode && !(deny_group_mode & (user_mode >> 3))) { -- pnntace = (struct cifs_ace *) (nacl_base + nsize); -+ pnntace = (struct smb_ace *) (nacl_base + nsize); - nsize += fill_ace_for_sid(pnntace, pgrpsid, deny_group_mode, - 0070, ACCESS_DENIED, false); - num_aces++; - } - -- pnntace = (struct cifs_ace *) (nacl_base + nsize); -+ pnntace = (struct smb_ace *) (nacl_base + nsize); - nsize += fill_ace_for_sid(pnntace, pownersid, user_mode, - 0700, ACCESS_ALLOWED, true); - num_aces++; - - /* Group DENY ACE conflicts with owner ALLOW ACE. So keep it after. */ - if (deny_group_mode && (deny_group_mode & (user_mode >> 3))) { -- pnntace = (struct cifs_ace *) (nacl_base + nsize); -+ pnntace = (struct smb_ace *) (nacl_base + nsize); - nsize += fill_ace_for_sid(pnntace, pgrpsid, deny_group_mode, - 0070, ACCESS_DENIED, false); - num_aces++; - } - -- pnntace = (struct cifs_ace *) (nacl_base + nsize); -+ pnntace = (struct smb_ace *) (nacl_base + nsize); - nsize += fill_ace_for_sid(pnntace, pgrpsid, group_mode, - 0070, ACCESS_ALLOWED, !sticky_set); - num_aces++; - -- pnntace = (struct cifs_ace *) (nacl_base + nsize); -+ pnntace = (struct smb_ace *) (nacl_base + nsize); - nsize += fill_ace_for_sid(pnntace, &sid_everyone, other_mode, - 0007, ACCESS_ALLOWED, !sticky_set); - num_aces++; -@@ -1034,31 +1042,31 @@ static void populate_new_aces(char *nacl_base, - *pnsize = nsize; - } - --static __u16 replace_sids_and_copy_aces(struct cifs_acl *pdacl, struct cifs_acl *pndacl, -- struct cifs_sid *pownersid, struct cifs_sid *pgrpsid, -- struct cifs_sid *pnownersid, struct cifs_sid *pngrpsid) -+static __u16 replace_sids_and_copy_aces(struct smb_acl *pdacl, struct smb_acl *pndacl, -+ struct smb_sid *pownersid, struct smb_sid *pgrpsid, -+ struct smb_sid *pnownersid, struct smb_sid *pngrpsid) - { - int i; - u16 size = 0; -- struct cifs_ace *pntace = NULL; -+ struct smb_ace *pntace = NULL; - char *acl_base = NULL; - u32 src_num_aces = 0; - u16 nsize = 0; -- struct cifs_ace *pnntace = NULL; -+ struct smb_ace *pnntace = NULL; - char *nacl_base = NULL; - u16 ace_size = 0; - - acl_base = (char *)pdacl; -- size = sizeof(struct cifs_acl); -+ size = sizeof(struct smb_acl); - src_num_aces = le32_to_cpu(pdacl->num_aces); - - nacl_base = (char *)pndacl; -- nsize = sizeof(struct cifs_acl); -+ nsize = sizeof(struct smb_acl); - - /* Go through all the ACEs */ - for (i = 0; i < src_num_aces; ++i) { -- pntace = (struct cifs_ace *) (acl_base + size); -- pnntace = (struct cifs_ace *) (nacl_base + nsize); -+ pntace = (struct smb_ace *) (acl_base + size); -+ pnntace = (struct smb_ace *) (nacl_base + nsize); - - if (pnownersid && compare_sids(&pntace->sid, pownersid) == 0) - ace_size = cifs_copy_ace(pnntace, pntace, pnownersid); -@@ -1074,48 +1082,48 @@ static __u16 replace_sids_and_copy_aces(struct cifs_acl *pdacl, struct cifs_acl - return nsize; - } - --static int set_chmod_dacl(struct cifs_acl *pdacl, struct cifs_acl *pndacl, -- struct cifs_sid *pownersid, struct cifs_sid *pgrpsid, -- __u64 *pnmode, bool mode_from_sid) -+static int set_chmod_dacl(struct smb_acl *pdacl, struct smb_acl *pndacl, -+ struct smb_sid *pownersid, struct smb_sid *pgrpsid, -+ __u64 *pnmode, bool mode_from_sid, bool posix) - { - int i; - u16 size = 0; -- struct cifs_ace *pntace = NULL; -+ struct smb_ace *pntace = NULL; - char *acl_base = NULL; - u32 src_num_aces = 0; - u16 nsize = 0; -- struct cifs_ace *pnntace = NULL; -+ struct smb_ace *pnntace = NULL; - char *nacl_base = NULL; - u32 num_aces = 0; - bool new_aces_set = false; - - /* Assuming that pndacl and pnmode are never NULL */ - nacl_base = (char *)pndacl; -- nsize = sizeof(struct cifs_acl); -+ nsize = sizeof(struct smb_acl); - - /* If pdacl is NULL, we don't have a src. Simply populate new ACL. */ -- if (!pdacl) { -+ if (!pdacl || posix) { - populate_new_aces(nacl_base, - pownersid, pgrpsid, - pnmode, &num_aces, &nsize, -- mode_from_sid); -+ mode_from_sid, posix); - goto finalize_dacl; - } - - acl_base = (char *)pdacl; -- size = sizeof(struct cifs_acl); -+ size = sizeof(struct smb_acl); - src_num_aces = le32_to_cpu(pdacl->num_aces); - - /* Retain old ACEs which we can retain */ - for (i = 0; i < src_num_aces; ++i) { -- pntace = (struct cifs_ace *) (acl_base + size); -+ pntace = (struct smb_ace *) (acl_base + size); - - if (!new_aces_set && (pntace->flags & INHERITED_ACE)) { - /* Place the new ACEs in between existing explicit and inherited */ - populate_new_aces(nacl_base, - pownersid, pgrpsid, - pnmode, &num_aces, &nsize, -- mode_from_sid); -+ mode_from_sid, posix); - - new_aces_set = true; - } -@@ -1130,7 +1138,7 @@ static int set_chmod_dacl(struct cifs_acl *pdacl, struct cifs_acl *pndacl, - } - - /* update the pointer to the next ACE to populate*/ -- pnntace = (struct cifs_ace *) (nacl_base + nsize); -+ pnntace = (struct smb_ace *) (nacl_base + nsize); - - nsize += cifs_copy_ace(pnntace, pntace, NULL); - num_aces++; -@@ -1144,7 +1152,7 @@ static int set_chmod_dacl(struct cifs_acl *pdacl, struct cifs_acl *pndacl, - populate_new_aces(nacl_base, - pownersid, pgrpsid, - pnmode, &num_aces, &nsize, -- mode_from_sid); -+ mode_from_sid, posix); - - new_aces_set = true; - } -@@ -1156,7 +1164,7 @@ static int set_chmod_dacl(struct cifs_acl *pdacl, struct cifs_acl *pndacl, - return 0; - } - --static int parse_sid(struct cifs_sid *psid, char *end_of_acl) -+static int parse_sid(struct smb_sid *psid, char *end_of_acl) - { - /* BB need to add parm so we can store the SID BB */ - -@@ -1191,24 +1199,24 @@ static int parse_sid(struct cifs_sid *psid, char *end_of_acl) - - /* Convert CIFS ACL to POSIX form */ - static int parse_sec_desc(struct cifs_sb_info *cifs_sb, -- struct cifs_ntsd *pntsd, int acl_len, struct cifs_fattr *fattr, -+ struct smb_ntsd *pntsd, int acl_len, struct cifs_fattr *fattr, - bool get_mode_from_special_sid) - { - int rc = 0; -- struct cifs_sid *owner_sid_ptr, *group_sid_ptr; -- struct cifs_acl *dacl_ptr; /* no need for SACL ptr */ -+ struct smb_sid *owner_sid_ptr, *group_sid_ptr; -+ struct smb_acl *dacl_ptr; /* no need for SACL ptr */ - char *end_of_acl = ((char *)pntsd) + acl_len; - __u32 dacloffset; - - if (pntsd == NULL) - return -EIO; - -- owner_sid_ptr = (struct cifs_sid *)((char *)pntsd + -+ owner_sid_ptr = (struct smb_sid *)((char *)pntsd + - le32_to_cpu(pntsd->osidoffset)); -- group_sid_ptr = (struct cifs_sid *)((char *)pntsd + -+ group_sid_ptr = (struct smb_sid *)((char *)pntsd + - le32_to_cpu(pntsd->gsidoffset)); - dacloffset = le32_to_cpu(pntsd->dacloffset); -- dacl_ptr = (struct cifs_acl *)((char *)pntsd + dacloffset); -+ dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset); - cifs_dbg(NOISY, "revision %d type 0x%x ooffset 0x%x goffset 0x%x sacloffset 0x%x dacloffset 0x%x\n", - pntsd->revision, pntsd->type, le32_to_cpu(pntsd->osidoffset), - le32_to_cpu(pntsd->gsidoffset), -@@ -1249,38 +1257,38 @@ static int parse_sec_desc(struct cifs_sb_info *cifs_sb, - } - - /* Convert permission bits from mode to equivalent CIFS ACL */ --static int build_sec_desc(struct cifs_ntsd *pntsd, struct cifs_ntsd *pnntsd, -+static int build_sec_desc(struct smb_ntsd *pntsd, struct smb_ntsd *pnntsd, - __u32 secdesclen, __u32 *pnsecdesclen, __u64 *pnmode, kuid_t uid, kgid_t gid, -- bool mode_from_sid, bool id_from_sid, int *aclflag) -+ bool mode_from_sid, bool id_from_sid, bool posix, int *aclflag) - { - int rc = 0; - __u32 dacloffset; - __u32 ndacloffset; - __u32 sidsoffset; -- struct cifs_sid *owner_sid_ptr, *group_sid_ptr; -- struct cifs_sid *nowner_sid_ptr = NULL, *ngroup_sid_ptr = NULL; -- struct cifs_acl *dacl_ptr = NULL; /* no need for SACL ptr */ -- struct cifs_acl *ndacl_ptr = NULL; /* no need for SACL ptr */ -+ struct smb_sid *owner_sid_ptr, *group_sid_ptr; -+ struct smb_sid *nowner_sid_ptr = NULL, *ngroup_sid_ptr = NULL; -+ struct smb_acl *dacl_ptr = NULL; /* no need for SACL ptr */ -+ struct smb_acl *ndacl_ptr = NULL; /* no need for SACL ptr */ - char *end_of_acl = ((char *)pntsd) + secdesclen; - u16 size = 0; - - dacloffset = le32_to_cpu(pntsd->dacloffset); - if (dacloffset) { -- dacl_ptr = (struct cifs_acl *)((char *)pntsd + dacloffset); -+ dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset); - if (end_of_acl < (char *)dacl_ptr + le16_to_cpu(dacl_ptr->size)) { - cifs_dbg(VFS, "Server returned illegal ACL size\n"); - return -EINVAL; - } - } - -- owner_sid_ptr = (struct cifs_sid *)((char *)pntsd + -+ owner_sid_ptr = (struct smb_sid *)((char *)pntsd + - le32_to_cpu(pntsd->osidoffset)); -- group_sid_ptr = (struct cifs_sid *)((char *)pntsd + -+ group_sid_ptr = (struct smb_sid *)((char *)pntsd + - le32_to_cpu(pntsd->gsidoffset)); - - if (pnmode && *pnmode != NO_CHANGE_64) { /* chmod */ -- ndacloffset = sizeof(struct cifs_ntsd); -- ndacl_ptr = (struct cifs_acl *)((char *)pnntsd + ndacloffset); -+ ndacloffset = sizeof(struct smb_ntsd); -+ ndacl_ptr = (struct smb_acl *)((char *)pnntsd + ndacloffset); - ndacl_ptr->revision = - dacloffset ? dacl_ptr->revision : cpu_to_le16(ACL_REVISION); - -@@ -1288,7 +1296,7 @@ static int build_sec_desc(struct cifs_ntsd *pntsd, struct cifs_ntsd *pnntsd, - ndacl_ptr->num_aces = cpu_to_le32(0); - - rc = set_chmod_dacl(dacl_ptr, ndacl_ptr, owner_sid_ptr, group_sid_ptr, -- pnmode, mode_from_sid); -+ pnmode, mode_from_sid, posix); - - sidsoffset = ndacloffset + le16_to_cpu(ndacl_ptr->size); - /* copy the non-dacl portion of secdesc */ -@@ -1297,15 +1305,15 @@ static int build_sec_desc(struct cifs_ntsd *pntsd, struct cifs_ntsd *pnntsd, - - *aclflag |= CIFS_ACL_DACL; - } else { -- ndacloffset = sizeof(struct cifs_ntsd); -- ndacl_ptr = (struct cifs_acl *)((char *)pnntsd + ndacloffset); -+ ndacloffset = sizeof(struct smb_ntsd); -+ ndacl_ptr = (struct smb_acl *)((char *)pnntsd + ndacloffset); - ndacl_ptr->revision = - dacloffset ? dacl_ptr->revision : cpu_to_le16(ACL_REVISION); - ndacl_ptr->num_aces = dacl_ptr ? dacl_ptr->num_aces : 0; - - if (uid_valid(uid)) { /* chown */ - uid_t id; -- nowner_sid_ptr = kzalloc(sizeof(struct cifs_sid), -+ nowner_sid_ptr = kzalloc(sizeof(struct smb_sid), - GFP_KERNEL); - if (!nowner_sid_ptr) { - rc = -ENOMEM; -@@ -1334,7 +1342,7 @@ static int build_sec_desc(struct cifs_ntsd *pntsd, struct cifs_ntsd *pnntsd, - } - if (gid_valid(gid)) { /* chgrp */ - gid_t id; -- ngroup_sid_ptr = kzalloc(sizeof(struct cifs_sid), -+ ngroup_sid_ptr = kzalloc(sizeof(struct smb_sid), - GFP_KERNEL); - if (!ngroup_sid_ptr) { - rc = -ENOMEM; -@@ -1385,11 +1393,11 @@ static int build_sec_desc(struct cifs_ntsd *pntsd, struct cifs_ntsd *pnntsd, - } - - #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY --struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb, -+struct smb_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb, - const struct cifs_fid *cifsfid, u32 *pacllen, - u32 __maybe_unused unused) - { -- struct cifs_ntsd *pntsd = NULL; -+ struct smb_ntsd *pntsd = NULL; - unsigned int xid; - int rc; - struct tcon_link *tlink = cifs_sb_tlink(cifs_sb); -@@ -1410,10 +1418,10 @@ struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb, - return pntsd; - } - --static struct cifs_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb, -+static struct smb_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb, - const char *path, u32 *pacllen) - { -- struct cifs_ntsd *pntsd = NULL; -+ struct smb_ntsd *pntsd = NULL; - int oplock = 0; - unsigned int xid; - int rc; -@@ -1454,11 +1462,11 @@ static struct cifs_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb, - } - - /* Retrieve an ACL from the server */ --struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb, -+struct smb_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb, - struct inode *inode, const char *path, - u32 *pacllen, u32 info) - { -- struct cifs_ntsd *pntsd = NULL; -+ struct smb_ntsd *pntsd = NULL; - struct cifsFileInfo *open_file = NULL; - - if (inode) -@@ -1472,7 +1480,7 @@ struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb, - } - - /* Set an ACL on the server */ --int set_cifs_acl(struct cifs_ntsd *pnntsd, __u32 acllen, -+int set_cifs_acl(struct smb_ntsd *pnntsd, __u32 acllen, - struct inode *inode, const char *path, int aclflag) - { - int oplock = 0; -@@ -1528,7 +1536,7 @@ cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr, - struct inode *inode, bool mode_from_special_sid, - const char *path, const struct cifs_fid *pfid) - { -- struct cifs_ntsd *pntsd = NULL; -+ struct smb_ntsd *pntsd = NULL; - u32 acllen = 0; - int rc = 0; - struct tcon_link *tlink = cifs_sb_tlink(cifs_sb); -@@ -1580,13 +1588,14 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode, - __u32 secdesclen = 0; - __u32 nsecdesclen = 0; - __u32 dacloffset = 0; -- struct cifs_acl *dacl_ptr = NULL; -- struct cifs_ntsd *pntsd = NULL; /* acl obtained from server */ -- struct cifs_ntsd *pnntsd = NULL; /* modified acl to be sent to server */ -+ struct smb_acl *dacl_ptr = NULL; -+ struct smb_ntsd *pntsd = NULL; /* acl obtained from server */ -+ struct smb_ntsd *pnntsd = NULL; /* modified acl to be sent to server */ - struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb); - struct tcon_link *tlink = cifs_sb_tlink(cifs_sb); - struct smb_version_operations *ops; - bool mode_from_sid, id_from_sid; -+ bool posix = tlink_tcon(tlink)->posix_extensions; - const u32 info = 0; - - if (IS_ERR(tlink)) -@@ -1622,21 +1631,22 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode, - id_from_sid = false; - - /* Potentially, five new ACEs can be added to the ACL for U,G,O mapping */ -- nsecdesclen = secdesclen; - if (pnmode && *pnmode != NO_CHANGE_64) { /* chmod */ -- if (mode_from_sid) -- nsecdesclen += 2 * sizeof(struct cifs_ace); -+ if (posix) -+ nsecdesclen = 1 * sizeof(struct smb_ace); -+ else if (mode_from_sid) -+ nsecdesclen = secdesclen + (2 * sizeof(struct smb_ace)); - else /* cifsacl */ -- nsecdesclen += 5 * sizeof(struct cifs_ace); -+ nsecdesclen = secdesclen + (5 * sizeof(struct smb_ace)); - } else { /* chown */ - /* When ownership changes, changes new owner sid length could be different */ -- nsecdesclen = sizeof(struct cifs_ntsd) + (sizeof(struct cifs_sid) * 2); -+ nsecdesclen = sizeof(struct smb_ntsd) + (sizeof(struct smb_sid) * 2); - dacloffset = le32_to_cpu(pntsd->dacloffset); - if (dacloffset) { -- dacl_ptr = (struct cifs_acl *)((char *)pntsd + dacloffset); -+ dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset); - if (mode_from_sid) - nsecdesclen += -- le32_to_cpu(dacl_ptr->num_aces) * sizeof(struct cifs_ace); -+ le32_to_cpu(dacl_ptr->num_aces) * sizeof(struct smb_ace); - else /* cifsacl */ - nsecdesclen += le16_to_cpu(dacl_ptr->size); - } -@@ -1657,7 +1667,7 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode, - } - - rc = build_sec_desc(pntsd, pnntsd, secdesclen, &nsecdesclen, pnmode, uid, gid, -- mode_from_sid, id_from_sid, &aclflag); -+ mode_from_sid, id_from_sid, posix, &aclflag); - - cifs_dbg(NOISY, "build_sec_desc rc: %d\n", rc); - -diff --git a/fs/smb/client/cifsacl.h b/fs/smb/client/cifsacl.h -index ccbfc754bd3c7f..cbaed8038e3654 100644 ---- a/fs/smb/client/cifsacl.h -+++ b/fs/smb/client/cifsacl.h -@@ -33,9 +33,9 @@ - * Security Descriptor length containing DACL with 3 ACEs (one each for - * owner, group and world). - */ --#define DEFAULT_SEC_DESC_LEN (sizeof(struct cifs_ntsd) + \ -- sizeof(struct cifs_acl) + \ -- (sizeof(struct cifs_ace) * 4)) -+#define DEFAULT_SEC_DESC_LEN (sizeof(struct smb_ntsd) + \ -+ sizeof(struct smb_acl) + \ -+ (sizeof(struct smb_ace) * 4)) - - /* - * Maximum size of a string representation of a SID: -@@ -55,7 +55,7 @@ - #define SID_STRING_BASE_SIZE (2 + 3 + 15 + 1) - #define SID_STRING_SUBAUTH_SIZE (11) /* size of a single subauth string */ - --struct cifs_ntsd { -+struct smb_ntsd { - __le16 revision; /* revision level */ - __le16 type; - __le32 osidoffset; -@@ -64,17 +64,17 @@ struct cifs_ntsd { - __le32 dacloffset; - } __attribute__((packed)); - --struct cifs_sid { -+struct smb_sid { - __u8 revision; /* revision level */ - __u8 num_subauth; - __u8 authority[NUM_AUTHS]; - __le32 sub_auth[SID_MAX_SUB_AUTHORITIES]; /* sub_auth[num_subauth] */ - } __attribute__((packed)); - --/* size of a struct cifs_sid, sans sub_auth array */ -+/* size of a struct smb_sid, sans sub_auth array */ - #define CIFS_SID_BASE_SIZE (1 + 1 + NUM_AUTHS) - --struct cifs_acl { -+struct smb_acl { - __le16 revision; /* revision level */ - __le16 size; - __le32 num_aces; -@@ -111,12 +111,12 @@ struct cifs_acl { - #define SUCCESSFUL_ACCESS_ACE_FLAG 0x40 - #define FAILED_ACCESS_ACE_FLAG 0x80 - --struct cifs_ace { -+struct smb_ace { - __u8 type; /* see above and MS-DTYP 2.4.4.1 */ - __u8 flags; - __le16 size; - __le32 access_req; -- struct cifs_sid sid; /* ie UUID of user or group who gets these perms */ -+ struct smb_sid sid; /* ie UUID of user or group who gets these perms */ - } __attribute__((packed)); - - /* -@@ -194,6 +194,6 @@ struct owner_group_sids { - * Minimum security descriptor can be one without any SACL and DACL and can - * consist of revision, type, and two sids of minimum size for owner and group - */ --#define MIN_SEC_DESC_LEN (sizeof(struct cifs_ntsd) + (2 * MIN_SID_LEN)) -+#define MIN_SEC_DESC_LEN (sizeof(struct smb_ntsd) + (2 * MIN_SID_LEN)) - - #endif /* _CIFSACL_H */ -diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c -index 6ed0f2548232f9..bbb0ef18d7b8c8 100644 ---- a/fs/smb/client/cifsfs.c -+++ b/fs/smb/client/cifsfs.c -@@ -2015,6 +2015,7 @@ exit_cifs(void) - destroy_workqueue(decrypt_wq); - destroy_workqueue(fileinfo_put_wq); - destroy_workqueue(serverclose_wq); -+ destroy_workqueue(cfid_put_wq); - destroy_workqueue(cifsiod_wq); - cifs_proc_clean(); - } -diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h -index 6b57b167a49d80..43b42eca6780cf 100644 ---- a/fs/smb/client/cifsglob.h -+++ b/fs/smb/client/cifsglob.h -@@ -202,10 +202,10 @@ struct cifs_cred { - int gid; - int mode; - int cecount; -- struct cifs_sid osid; -- struct cifs_sid gsid; -+ struct smb_sid osid; -+ struct smb_sid gsid; - struct cifs_ntace *ntaces; -- struct cifs_ace *aces; -+ struct smb_ace *aces; - }; - - struct cifs_open_info_data { -@@ -231,8 +231,8 @@ struct cifs_open_info_data { - unsigned int eas_len; - } wsl; - char *symlink_target; -- struct cifs_sid posix_owner; -- struct cifs_sid posix_group; -+ struct smb_sid posix_owner; -+ struct smb_sid posix_group; - union { - struct smb2_file_all_info fi; - struct smb311_posix_qinfo posix_fi; -@@ -539,12 +539,12 @@ struct smb_version_operations { - int (*set_EA)(const unsigned int, struct cifs_tcon *, const char *, - const char *, const void *, const __u16, - const struct nls_table *, struct cifs_sb_info *); -- struct cifs_ntsd * (*get_acl)(struct cifs_sb_info *, struct inode *, -- const char *, u32 *, u32); -- struct cifs_ntsd * (*get_acl_by_fid)(struct cifs_sb_info *, -- const struct cifs_fid *, u32 *, u32); -- int (*set_acl)(struct cifs_ntsd *, __u32, struct inode *, const char *, -- int); -+ struct smb_ntsd * (*get_acl)(struct cifs_sb_info *cifssb, struct inode *ino, -+ const char *patch, u32 *plen, u32 info); -+ struct smb_ntsd * (*get_acl_by_fid)(struct cifs_sb_info *cifssmb, -+ const struct cifs_fid *pfid, u32 *plen, u32 info); -+ int (*set_acl)(struct smb_ntsd *pntsd, __u32 len, struct inode *ino, const char *path, -+ int flag); - /* writepages retry size */ - unsigned int (*wp_retry_size)(struct inode *); - /* get mtu credits */ -diff --git a/fs/smb/client/cifsproto.h b/fs/smb/client/cifsproto.h -index 83692bf60007a0..a151ffffc6f38e 100644 ---- a/fs/smb/client/cifsproto.h -+++ b/fs/smb/client/cifsproto.h -@@ -223,7 +223,7 @@ extern int cifs_set_file_info(struct inode *inode, struct iattr *attrs, - extern int cifs_rename_pending_delete(const char *full_path, - struct dentry *dentry, - const unsigned int xid); --extern int sid_to_id(struct cifs_sb_info *cifs_sb, struct cifs_sid *psid, -+extern int sid_to_id(struct cifs_sb_info *cifs_sb, struct smb_sid *psid, - struct cifs_fattr *fattr, uint sidtype); - extern int cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, - struct cifs_fattr *fattr, struct inode *inode, -@@ -231,19 +231,21 @@ extern int cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, - const char *path, const struct cifs_fid *pfid); - extern int id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode, - kuid_t uid, kgid_t gid); --extern struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *, struct inode *, -- const char *, u32 *, u32); --extern struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *, -- const struct cifs_fid *, u32 *, u32); -+extern struct smb_ntsd *get_cifs_acl(struct cifs_sb_info *cifssmb, struct inode *ino, -+ const char *path, u32 *plen, u32 info); -+extern struct smb_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifssb, -+ const struct cifs_fid *pfid, u32 *plen, u32 info); - extern struct posix_acl *cifs_get_acl(struct mnt_idmap *idmap, - struct dentry *dentry, int type); - extern int cifs_set_acl(struct mnt_idmap *idmap, - struct dentry *dentry, struct posix_acl *acl, int type); --extern int set_cifs_acl(struct cifs_ntsd *, __u32, struct inode *, -- const char *, int); --extern unsigned int setup_authusers_ACE(struct cifs_ace *pace); --extern unsigned int setup_special_mode_ACE(struct cifs_ace *pace, __u64 nmode); --extern unsigned int setup_special_user_owner_ACE(struct cifs_ace *pace); -+extern int set_cifs_acl(struct smb_ntsd *pntsd, __u32 len, struct inode *ino, -+ const char *path, int flag); -+extern unsigned int setup_authusers_ACE(struct smb_ace *pace); -+extern unsigned int setup_special_mode_ACE(struct smb_ace *pace, -+ bool posix, -+ __u64 nmode); -+extern unsigned int setup_special_user_owner_ACE(struct smb_ace *pace); - - extern void dequeue_mid(struct mid_q_entry *mid, bool malformed); - extern int cifs_read_from_socket(struct TCP_Server_Info *server, char *buf, -@@ -568,9 +570,9 @@ extern int CIFSSMBSetEA(const unsigned int xid, struct cifs_tcon *tcon, - const struct nls_table *nls_codepage, - struct cifs_sb_info *cifs_sb); - extern int CIFSSMBGetCIFSACL(const unsigned int xid, struct cifs_tcon *tcon, -- __u16 fid, struct cifs_ntsd **acl_inf, __u32 *buflen); -+ __u16 fid, struct smb_ntsd **acl_inf, __u32 *buflen); - extern int CIFSSMBSetCIFSACL(const unsigned int, struct cifs_tcon *, __u16, -- struct cifs_ntsd *, __u32, int); -+ struct smb_ntsd *pntsd, __u32 len, int aclflag); - extern int cifs_do_get_acl(const unsigned int xid, struct cifs_tcon *tcon, - const unsigned char *searchName, - struct posix_acl **acl, const int acl_type, -diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c -index a34db419e46f7f..2f8745736dbb02 100644 ---- a/fs/smb/client/cifssmb.c -+++ b/fs/smb/client/cifssmb.c -@@ -3385,7 +3385,7 @@ validate_ntransact(char *buf, char **ppparm, char **ppdata, - /* Get Security Descriptor (by handle) from remote server for a file or dir */ - int - CIFSSMBGetCIFSACL(const unsigned int xid, struct cifs_tcon *tcon, __u16 fid, -- struct cifs_ntsd **acl_inf, __u32 *pbuflen) -+ struct smb_ntsd **acl_inf, __u32 *pbuflen) - { - int rc = 0; - int buf_type = 0; -@@ -3455,7 +3455,7 @@ CIFSSMBGetCIFSACL(const unsigned int xid, struct cifs_tcon *tcon, __u16 fid, - - /* check if buffer is big enough for the acl - header followed by the smallest SID */ -- if ((*pbuflen < sizeof(struct cifs_ntsd) + 8) || -+ if ((*pbuflen < sizeof(struct smb_ntsd) + 8) || - (*pbuflen >= 64 * 1024)) { - cifs_dbg(VFS, "bad acl length %d\n", *pbuflen); - rc = -EINVAL; -@@ -3475,7 +3475,7 @@ CIFSSMBGetCIFSACL(const unsigned int xid, struct cifs_tcon *tcon, __u16 fid, - - int - CIFSSMBSetCIFSACL(const unsigned int xid, struct cifs_tcon *tcon, __u16 fid, -- struct cifs_ntsd *pntsd, __u32 acllen, int aclflag) -+ struct smb_ntsd *pntsd, __u32 acllen, int aclflag) - { - __u16 byte_count, param_count, data_count, param_offset, data_offset; - int rc = 0; -diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c -index ce7e0aed8f7d2b..b3e59a7c71205f 100644 ---- a/fs/smb/client/inode.c -+++ b/fs/smb/client/inode.c -@@ -3087,6 +3087,7 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs) - int rc = -EACCES; - __u32 dosattr = 0; - __u64 mode = NO_CHANGE_64; -+ bool posix = cifs_sb_master_tcon(cifs_sb)->posix_extensions; - - xid = get_xid(); - -@@ -3177,7 +3178,8 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs) - mode = attrs->ia_mode; - rc = 0; - if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) || -- (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MODE_FROM_SID)) { -+ (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MODE_FROM_SID) || -+ posix) { - rc = id_mode_to_cifs_acl(inode, full_path, &mode, - INVALID_UID, INVALID_GID); - if (rc) { -diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c -index 2a292736c89a2a..e695df1dbb23b2 100644 ---- a/fs/smb/client/smb2inode.c -+++ b/fs/smb/client/smb2inode.c -@@ -315,7 +315,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - SMB2_O_INFO_FILE, 0, - sizeof(struct smb311_posix_qinfo *) + - (PATH_MAX * 2) + -- (sizeof(struct cifs_sid) * 2), 0, NULL); -+ (sizeof(struct smb_sid) * 2), 0, NULL); - } else { - rc = SMB2_query_info_init(tcon, server, - &rqst[num_rqst], -@@ -325,7 +325,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - SMB2_O_INFO_FILE, 0, - sizeof(struct smb311_posix_qinfo *) + - (PATH_MAX * 2) + -- (sizeof(struct cifs_sid) * 2), 0, NULL); -+ (sizeof(struct smb_sid) * 2), 0, NULL); - } - if (!rc && (!cfile || num_rqst > 1)) { - smb2_set_next_command(tcon, &rqst[num_rqst]); -diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c -index 6645f147d57c29..fc6d00344c50ea 100644 ---- a/fs/smb/client/smb2ops.c -+++ b/fs/smb/client/smb2ops.c -@@ -3001,11 +3001,11 @@ smb2_get_dfs_refer(const unsigned int xid, struct cifs_ses *ses, - return rc; - } - --static struct cifs_ntsd * -+static struct smb_ntsd * - get_smb2_acl_by_fid(struct cifs_sb_info *cifs_sb, - const struct cifs_fid *cifsfid, u32 *pacllen, u32 info) - { -- struct cifs_ntsd *pntsd = NULL; -+ struct smb_ntsd *pntsd = NULL; - unsigned int xid; - int rc = -EOPNOTSUPP; - struct tcon_link *tlink = cifs_sb_tlink(cifs_sb); -@@ -3030,11 +3030,11 @@ get_smb2_acl_by_fid(struct cifs_sb_info *cifs_sb, - - } - --static struct cifs_ntsd * -+static struct smb_ntsd * - get_smb2_acl_by_path(struct cifs_sb_info *cifs_sb, - const char *path, u32 *pacllen, u32 info) - { -- struct cifs_ntsd *pntsd = NULL; -+ struct smb_ntsd *pntsd = NULL; - u8 oplock = SMB2_OPLOCK_LEVEL_NONE; - unsigned int xid; - int rc; -@@ -3097,7 +3097,7 @@ get_smb2_acl_by_path(struct cifs_sb_info *cifs_sb, - } - - static int --set_smb2_acl(struct cifs_ntsd *pnntsd, __u32 acllen, -+set_smb2_acl(struct smb_ntsd *pnntsd, __u32 acllen, - struct inode *inode, const char *path, int aclflag) - { - u8 oplock = SMB2_OPLOCK_LEVEL_NONE; -@@ -3155,12 +3155,12 @@ set_smb2_acl(struct cifs_ntsd *pnntsd, __u32 acllen, - } - - /* Retrieve an ACL from the server */ --static struct cifs_ntsd * -+static struct smb_ntsd * - get_smb2_acl(struct cifs_sb_info *cifs_sb, - struct inode *inode, const char *path, - u32 *pacllen, u32 info) - { -- struct cifs_ntsd *pntsd = NULL; -+ struct smb_ntsd *pntsd = NULL; - struct cifsFileInfo *open_file = NULL; - - if (inode && !(info & SACL_SECINFO)) -diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c -index 38b26468eb0c53..c012fbc2638ed5 100644 ---- a/fs/smb/client/smb2pdu.c -+++ b/fs/smb/client/smb2pdu.c -@@ -2623,7 +2623,7 @@ create_sd_buf(umode_t mode, bool set_owner, unsigned int *len) - unsigned int group_offset = 0; - struct smb3_acl acl = {}; - -- *len = round_up(sizeof(struct crt_sd_ctxt) + (sizeof(struct cifs_ace) * 4), 8); -+ *len = round_up(sizeof(struct crt_sd_ctxt) + (sizeof(struct smb_ace) * 4), 8); - - if (set_owner) { - /* sizeof(struct owner_group_sids) is already multiple of 8 so no need to round */ -@@ -2672,21 +2672,21 @@ create_sd_buf(umode_t mode, bool set_owner, unsigned int *len) - ptr += sizeof(struct smb3_acl); - - /* create one ACE to hold the mode embedded in reserved special SID */ -- acelen = setup_special_mode_ACE((struct cifs_ace *)ptr, (__u64)mode); -+ acelen = setup_special_mode_ACE((struct smb_ace *)ptr, false, (__u64)mode); - ptr += acelen; - acl_size = acelen + sizeof(struct smb3_acl); - ace_count = 1; - - if (set_owner) { - /* we do not need to reallocate buffer to add the two more ACEs. plenty of space */ -- acelen = setup_special_user_owner_ACE((struct cifs_ace *)ptr); -+ acelen = setup_special_user_owner_ACE((struct smb_ace *)ptr); - ptr += acelen; - acl_size += acelen; - ace_count += 1; - } - - /* and one more ACE to allow access for authenticated users */ -- acelen = setup_authusers_ACE((struct cifs_ace *)ptr); -+ acelen = setup_authusers_ACE((struct smb_ace *)ptr); - ptr += acelen; - acl_size += acelen; - ace_count += 1; -@@ -3915,7 +3915,7 @@ SMB311_posix_query_info(const unsigned int xid, struct cifs_tcon *tcon, - u64 persistent_fid, u64 volatile_fid, struct smb311_posix_qinfo *data, u32 *plen) - { - size_t output_len = sizeof(struct smb311_posix_qinfo *) + -- (sizeof(struct cifs_sid) * 2) + (PATH_MAX * 2); -+ (sizeof(struct smb_sid) * 2) + (PATH_MAX * 2); - *plen = 0; - - return query_info(xid, tcon, persistent_fid, volatile_fid, -@@ -5626,7 +5626,7 @@ SMB2_set_eof(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, - int - SMB2_set_acl(const unsigned int xid, struct cifs_tcon *tcon, - u64 persistent_fid, u64 volatile_fid, -- struct cifs_ntsd *pnntsd, int pacllen, int aclflag) -+ struct smb_ntsd *pnntsd, int pacllen, int aclflag) - { - return send_set_info(xid, tcon, persistent_fid, volatile_fid, - current->tgid, 0, SMB2_O_INFO_SECURITY, aclflag, -diff --git a/fs/smb/client/smb2pdu.h b/fs/smb/client/smb2pdu.h -index 5c458ab3b05a44..076d9e83e1a044 100644 ---- a/fs/smb/client/smb2pdu.h -+++ b/fs/smb/client/smb2pdu.h -@@ -364,8 +364,8 @@ struct create_posix_rsp { - u32 nlink; - u32 reparse_tag; - u32 mode; -- struct cifs_sid owner; /* var-sized on the wire */ -- struct cifs_sid group; /* var-sized on the wire */ -+ struct smb_sid owner; /* var-sized on the wire */ -+ struct smb_sid group; /* var-sized on the wire */ - } __packed; - - #define SMB2_QUERY_DIRECTORY_IOV_SIZE 2 -@@ -408,8 +408,8 @@ struct smb2_posix_info { - struct smb2_posix_info_parsed { - const struct smb2_posix_info *base; - size_t size; -- struct cifs_sid owner; -- struct cifs_sid group; -+ struct smb_sid owner; -+ struct smb_sid group; - int name_len; - const u8 *name; - }; -diff --git a/fs/smb/client/smb2proto.h b/fs/smb/client/smb2proto.h -index 613667b46c5802..750e4e397b1393 100644 ---- a/fs/smb/client/smb2proto.h -+++ b/fs/smb/client/smb2proto.h -@@ -37,8 +37,6 @@ extern struct mid_q_entry *smb2_setup_request(struct cifs_ses *ses, - struct smb_rqst *rqst); - extern struct mid_q_entry *smb2_setup_async_request( - struct TCP_Server_Info *server, struct smb_rqst *rqst); --extern struct cifs_ses *smb2_find_smb_ses(struct TCP_Server_Info *server, -- __u64 ses_id); - extern struct cifs_tcon *smb2_find_smb_tcon(struct TCP_Server_Info *server, - __u64 ses_id, __u32 tid); - extern int smb2_calc_signature(struct smb_rqst *rqst, -@@ -247,7 +245,7 @@ extern int SMB2_set_info_init(struct cifs_tcon *tcon, - extern void SMB2_set_info_free(struct smb_rqst *rqst); - extern int SMB2_set_acl(const unsigned int xid, struct cifs_tcon *tcon, - u64 persistent_fid, u64 volatile_fid, -- struct cifs_ntsd *pnntsd, int pacllen, int aclflag); -+ struct smb_ntsd *pnntsd, int pacllen, int aclflag); - extern int SMB2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, - u64 persistent_fid, u64 volatile_fid, - struct smb2_file_full_ea_info *buf, int len); -diff --git a/fs/smb/client/smb2transport.c b/fs/smb/client/smb2transport.c -index 4ca04e62a993cf..4a43802375b3a3 100644 ---- a/fs/smb/client/smb2transport.c -+++ b/fs/smb/client/smb2transport.c -@@ -74,7 +74,7 @@ smb311_crypto_shash_allocate(struct TCP_Server_Info *server) - - - static --int smb2_get_sign_key(__u64 ses_id, struct TCP_Server_Info *server, u8 *key) -+int smb3_get_sign_key(__u64 ses_id, struct TCP_Server_Info *server, u8 *key) - { - struct cifs_chan *chan; - struct TCP_Server_Info *pserver; -@@ -168,16 +168,41 @@ smb2_find_smb_ses_unlocked(struct TCP_Server_Info *server, __u64 ses_id) - return NULL; - } - --struct cifs_ses * --smb2_find_smb_ses(struct TCP_Server_Info *server, __u64 ses_id) -+static int smb2_get_sign_key(struct TCP_Server_Info *server, -+ __u64 ses_id, u8 *key) - { - struct cifs_ses *ses; -+ int rc = -ENOENT; -+ -+ if (SERVER_IS_CHAN(server)) -+ server = server->primary_server; - - spin_lock(&cifs_tcp_ses_lock); -- ses = smb2_find_smb_ses_unlocked(server, ses_id); -- spin_unlock(&cifs_tcp_ses_lock); -+ list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) { -+ if (ses->Suid != ses_id) -+ continue; - -- return ses; -+ rc = 0; -+ spin_lock(&ses->ses_lock); -+ switch (ses->ses_status) { -+ case SES_EXITING: /* SMB2_LOGOFF */ -+ case SES_GOOD: -+ if (likely(ses->auth_key.response)) { -+ memcpy(key, ses->auth_key.response, -+ SMB2_NTLMV2_SESSKEY_SIZE); -+ } else { -+ rc = -EIO; -+ } -+ break; -+ default: -+ rc = -EAGAIN; -+ break; -+ } -+ spin_unlock(&ses->ses_lock); -+ break; -+ } -+ spin_unlock(&cifs_tcp_ses_lock); -+ return rc; - } - - static struct cifs_tcon * -@@ -236,14 +261,16 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server, - unsigned char *sigptr = smb2_signature; - struct kvec *iov = rqst->rq_iov; - struct smb2_hdr *shdr = (struct smb2_hdr *)iov[0].iov_base; -- struct cifs_ses *ses; - struct shash_desc *shash = NULL; - struct smb_rqst drqst; -+ __u64 sid = le64_to_cpu(shdr->SessionId); -+ u8 key[SMB2_NTLMV2_SESSKEY_SIZE]; - -- ses = smb2_find_smb_ses(server, le64_to_cpu(shdr->SessionId)); -- if (unlikely(!ses)) { -- cifs_server_dbg(VFS, "%s: Could not find session\n", __func__); -- return -ENOENT; -+ rc = smb2_get_sign_key(server, sid, key); -+ if (unlikely(rc)) { -+ cifs_server_dbg(FYI, "%s: [sesid=0x%llx] couldn't find signing key: %d\n", -+ __func__, sid, rc); -+ return rc; - } - - memset(smb2_signature, 0x0, SMB2_HMACSHA256_SIZE); -@@ -260,8 +287,7 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server, - shash = server->secmech.hmacsha256; - } - -- rc = crypto_shash_setkey(shash->tfm, ses->auth_key.response, -- SMB2_NTLMV2_SESSKEY_SIZE); -+ rc = crypto_shash_setkey(shash->tfm, key, sizeof(key)); - if (rc) { - cifs_server_dbg(VFS, - "%s: Could not update with response\n", -@@ -303,8 +329,6 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server, - out: - if (allocate_crypto) - cifs_free_hash(&shash); -- if (ses) -- cifs_put_smb_ses(ses); - return rc; - } - -@@ -570,7 +594,7 @@ smb3_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server, - struct smb_rqst drqst; - u8 key[SMB3_SIGN_KEY_SIZE]; - -- rc = smb2_get_sign_key(le64_to_cpu(shdr->SessionId), server, key); -+ rc = smb3_get_sign_key(le64_to_cpu(shdr->SessionId), server, key); - if (unlikely(rc)) { - cifs_server_dbg(FYI, "%s: Could not get signing key\n", __func__); - return rc; -diff --git a/fs/smb/client/xattr.c b/fs/smb/client/xattr.c -index c2bf829310bee2..e8696ad4da994e 100644 ---- a/fs/smb/client/xattr.c -+++ b/fs/smb/client/xattr.c -@@ -162,7 +162,7 @@ static int cifs_xattr_set(const struct xattr_handler *handler, - case XATTR_CIFS_ACL: - case XATTR_CIFS_NTSD: - case XATTR_CIFS_NTSD_FULL: { -- struct cifs_ntsd *pacl; -+ struct smb_ntsd *pacl; - - if (!value) - goto out; -@@ -315,7 +315,7 @@ static int cifs_xattr_get(const struct xattr_handler *handler, - * fetch owner and DACL otherwise - */ - u32 acllen, extra_info; -- struct cifs_ntsd *pacl; -+ struct smb_ntsd *pacl; - - if (pTcon->ses->server->ops->get_acl == NULL) - goto out; /* rc already EOPNOTSUPP */ -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index cd530b9a00caa3..2884ebdc0eda02 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -4225,6 +4225,7 @@ static bool __query_dir(struct dir_context *ctx, const char *name, int namlen, - /* dot and dotdot entries are already reserved */ - if (!strcmp(".", name) || !strcmp("..", name)) - return true; -+ d_info->num_scan++; - if (ksmbd_share_veto_filename(priv->work->tcon->share_conf, name)) - return true; - if (!match_pattern(name, namlen, priv->search_pattern)) -@@ -4385,8 +4386,17 @@ int smb2_query_dir(struct ksmbd_work *work) - query_dir_private.info_level = req->FileInformationClass; - dir_fp->readdir_data.private = &query_dir_private; - set_ctx_actor(&dir_fp->readdir_data.ctx, __query_dir); -- -+again: -+ d_info.num_scan = 0; - rc = iterate_dir(dir_fp->filp, &dir_fp->readdir_data.ctx); -+ /* -+ * num_entry can be 0 if the directory iteration stops before reaching -+ * the end of the directory and no file is matched with the search -+ * pattern. -+ */ -+ if (rc >= 0 && !d_info.num_entry && d_info.num_scan && -+ d_info.out_buf_len > 0) -+ goto again; - /* - * req->OutputBufferLength is too small to contain even one entry. - * In this case, it immediately returns OutputBufferLength 0 to client. -@@ -6007,15 +6017,13 @@ static int set_file_basic_info(struct ksmbd_file *fp, - attrs.ia_valid |= (ATTR_ATIME | ATTR_ATIME_SET); - } - -- attrs.ia_valid |= ATTR_CTIME; - if (file_info->ChangeTime) -- attrs.ia_ctime = ksmbd_NTtimeToUnix(file_info->ChangeTime); -- else -- attrs.ia_ctime = inode_get_ctime(inode); -+ inode_set_ctime_to_ts(inode, -+ ksmbd_NTtimeToUnix(file_info->ChangeTime)); - - if (file_info->LastWriteTime) { - attrs.ia_mtime = ksmbd_NTtimeToUnix(file_info->LastWriteTime); -- attrs.ia_valid |= (ATTR_MTIME | ATTR_MTIME_SET); -+ attrs.ia_valid |= (ATTR_MTIME | ATTR_MTIME_SET | ATTR_CTIME); - } - - if (file_info->Attributes) { -@@ -6057,8 +6065,6 @@ static int set_file_basic_info(struct ksmbd_file *fp, - return -EACCES; - - inode_lock(inode); -- inode_set_ctime_to_ts(inode, attrs.ia_ctime); -- attrs.ia_valid &= ~ATTR_CTIME; - rc = notify_change(idmap, dentry, &attrs, NULL); - inode_unlock(inode); - } -diff --git a/fs/smb/server/vfs.h b/fs/smb/server/vfs.h -index cb76f4b5bafe8c..06903024a2d88b 100644 ---- a/fs/smb/server/vfs.h -+++ b/fs/smb/server/vfs.h -@@ -43,6 +43,7 @@ struct ksmbd_dir_info { - char *rptr; - int name_len; - int out_buf_len; -+ int num_scan; - int num_entry; - int data_count; - int last_entry_offset; -diff --git a/fs/udf/namei.c b/fs/udf/namei.c -index b3f57ad2b869ff..8ac73f41d6ebe6 100644 ---- a/fs/udf/namei.c -+++ b/fs/udf/namei.c -@@ -770,7 +770,7 @@ static int udf_rename(struct mnt_idmap *idmap, struct inode *old_dir, - struct inode *old_inode = d_inode(old_dentry); - struct inode *new_inode = d_inode(new_dentry); - struct udf_fileident_iter oiter, niter, diriter; -- bool has_diriter = false; -+ bool has_diriter = false, is_dir = false; - int retval; - struct kernel_lb_addr tloc; - -@@ -792,7 +792,20 @@ static int udf_rename(struct mnt_idmap *idmap, struct inode *old_dir, - retval = -ENOTEMPTY; - if (!empty_dir(new_inode)) - goto out_oiter; -+ retval = -EFSCORRUPTED; -+ if (new_inode->i_nlink != 2) -+ goto out_oiter; - } -+ retval = -EFSCORRUPTED; -+ if (old_dir->i_nlink < 3) -+ goto out_oiter; -+ is_dir = true; -+ } else if (new_inode) { -+ retval = -EFSCORRUPTED; -+ if (new_inode->i_nlink < 1) -+ goto out_oiter; -+ } -+ if (is_dir && old_dir != new_dir) { - retval = udf_fiiter_find_entry(old_inode, &dotdot_name, - &diriter); - if (retval == -ENOENT) { -@@ -880,7 +893,9 @@ static int udf_rename(struct mnt_idmap *idmap, struct inode *old_dir, - cpu_to_lelb(UDF_I(new_dir)->i_location); - udf_fiiter_write_fi(&diriter, NULL); - udf_fiiter_release(&diriter); -+ } - -+ if (is_dir) { - inode_dec_link_count(old_dir); - if (new_inode) - inode_dec_link_count(new_inode); -diff --git a/include/acpi/pcc.h b/include/acpi/pcc.h -index 73e806fe7ce707..699c1a37b8e784 100644 ---- a/include/acpi/pcc.h -+++ b/include/acpi/pcc.h -@@ -12,17 +12,33 @@ - struct pcc_mbox_chan { - struct mbox_chan *mchan; - u64 shmem_base_addr; -+ void __iomem *shmem; - u64 shmem_size; - u32 latency; - u32 max_access_rate; - u16 min_turnaround_time; - }; - -+/* Generic Communications Channel Shared Memory Region */ -+#define PCC_SIGNATURE 0x50434300 -+/* Generic Communications Channel Command Field */ -+#define PCC_CMD_GENERATE_DB_INTR BIT(15) -+/* Generic Communications Channel Status Field */ -+#define PCC_STATUS_CMD_COMPLETE BIT(0) -+#define PCC_STATUS_SCI_DOORBELL BIT(1) -+#define PCC_STATUS_ERROR BIT(2) -+#define PCC_STATUS_PLATFORM_NOTIFY BIT(3) -+/* Initiator Responder Communications Channel Flags */ -+#define PCC_CMD_COMPLETION_NOTIFY BIT(0) -+ - #define MAX_PCC_SUBSPACES 256 -+#define PCC_ACK_FLAG_MASK 0x1 -+ - #ifdef CONFIG_PCC - extern struct pcc_mbox_chan * - pcc_mbox_request_channel(struct mbox_client *cl, int subspace_id); - extern void pcc_mbox_free_channel(struct pcc_mbox_chan *chan); -+extern int pcc_mbox_ioremap(struct mbox_chan *chan); - #else - static inline struct pcc_mbox_chan * - pcc_mbox_request_channel(struct mbox_client *cl, int subspace_id) -@@ -30,6 +46,10 @@ pcc_mbox_request_channel(struct mbox_client *cl, int subspace_id) - return ERR_PTR(-ENODEV); - } - static inline void pcc_mbox_free_channel(struct pcc_mbox_chan *chan) { } -+static inline int pcc_mbox_ioremap(struct mbox_chan *chan) -+{ -+ return 0; -+}; - #endif - - #endif /* _PCC_H */ -diff --git a/include/clocksource/hyperv_timer.h b/include/clocksource/hyperv_timer.h -index 6cdc873ac907f5..aa5233b1eba970 100644 ---- a/include/clocksource/hyperv_timer.h -+++ b/include/clocksource/hyperv_timer.h -@@ -38,6 +38,8 @@ extern void hv_remap_tsc_clocksource(void); - extern unsigned long hv_get_tsc_pfn(void); - extern struct ms_hyperv_tsc_page *hv_get_tsc_page(void); - -+extern void hv_adj_sched_clock_offset(u64 offset); -+ - static __always_inline bool - hv_read_tsc_page_tsc(const struct ms_hyperv_tsc_page *tsc_pg, - u64 *cur_tsc, u64 *time) -diff --git a/include/crypto/internal/ecc.h b/include/crypto/internal/ecc.h -index 4f6c1a68882fa1..c0b8be63cbde7c 100644 ---- a/include/crypto/internal/ecc.h -+++ b/include/crypto/internal/ecc.h -@@ -56,6 +56,16 @@ static inline void ecc_swap_digits(const void *in, u64 *out, unsigned int ndigit - out[i] = get_unaligned_be64(&src[ndigits - 1 - i]); - } - -+/** -+ * ecc_digits_from_bytes() - Create ndigits-sized digits array from byte array -+ * @in: Input byte array -+ * @nbytes Size of input byte array -+ * @out Output digits array -+ * @ndigits: Number of digits to create from byte array -+ */ -+void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes, -+ u64 *out, unsigned int ndigits); -+ - /** - * ecc_is_key_valid() - Validate a given ECDH private key - * -diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h -index cb8e97665eaa59..92919d52f7e1b2 100644 ---- a/include/linux/bpf_verifier.h -+++ b/include/linux/bpf_verifier.h -@@ -319,34 +319,12 @@ struct bpf_func_state { - struct bpf_stack_state *stack; - }; - --#define MAX_CALL_FRAMES 8 -- --/* instruction history flags, used in bpf_jmp_history_entry.flags field */ --enum { -- /* instruction references stack slot through PTR_TO_STACK register; -- * we also store stack's frame number in lower 3 bits (MAX_CALL_FRAMES is 8) -- * and accessed stack slot's index in next 6 bits (MAX_BPF_STACK is 512, -- * 8 bytes per slot, so slot index (spi) is [0, 63]) -- */ -- INSN_F_FRAMENO_MASK = 0x7, /* 3 bits */ -- -- INSN_F_SPI_MASK = 0x3f, /* 6 bits */ -- INSN_F_SPI_SHIFT = 3, /* shifted 3 bits to the left */ -- -- INSN_F_STACK_ACCESS = BIT(9), /* we need 10 bits total */ --}; -- --static_assert(INSN_F_FRAMENO_MASK + 1 >= MAX_CALL_FRAMES); --static_assert(INSN_F_SPI_MASK + 1 >= MAX_BPF_STACK / 8); -- --struct bpf_jmp_history_entry { -+struct bpf_idx_pair { -+ u32 prev_idx; - u32 idx; -- /* insn idx can't be bigger than 1 million */ -- u32 prev_idx : 22; -- /* special flags, e.g., whether insn is doing register stack spill/load */ -- u32 flags : 10; - }; - -+#define MAX_CALL_FRAMES 8 - /* Maximum number of register states that can exist at once */ - #define BPF_ID_MAP_SIZE ((MAX_BPF_REG + MAX_BPF_STACK / BPF_REG_SIZE) * MAX_CALL_FRAMES) - struct bpf_verifier_state { -@@ -429,7 +407,7 @@ struct bpf_verifier_state { - * For most states jmp_history_cnt is [0-3]. - * For loops can go up to ~40. - */ -- struct bpf_jmp_history_entry *jmp_history; -+ struct bpf_idx_pair *jmp_history; - u32 jmp_history_cnt; - u32 dfs_depth; - u32 callback_unroll_depth; -@@ -662,7 +640,6 @@ struct bpf_verifier_env { - int cur_stack; - } cfg; - struct backtrack_state bt; -- struct bpf_jmp_history_entry *cur_hist_ent; - u32 pass_cnt; /* number of times do_check() was called */ - u32 subprog_cnt; - /* number of instructions analyzed by the verifier */ -diff --git a/include/linux/cleanup.h b/include/linux/cleanup.h -index 53f1a7a932b08c..64b8600eb8c0e4 100644 ---- a/include/linux/cleanup.h -+++ b/include/linux/cleanup.h -@@ -92,26 +92,85 @@ static inline class_##_name##_t class_##_name##ext##_constructor(_init_args) \ - * trivial wrapper around DEFINE_CLASS() above specifically - * for locks. - * -+ * DEFINE_GUARD_COND(name, ext, condlock) -+ * wrapper around EXTEND_CLASS above to add conditional lock -+ * variants to a base class, eg. mutex_trylock() or -+ * mutex_lock_interruptible(). -+ * - * guard(name): -- * an anonymous instance of the (guard) class -+ * an anonymous instance of the (guard) class, not recommended for -+ * conditional locks. - * - * scoped_guard (name, args...) { }: - * similar to CLASS(name, scope)(args), except the variable (with the - * explicit name 'scope') is declard in a for-loop such that its scope is - * bound to the next (compound) statement. - * -+ * for conditional locks the loop body is skipped when the lock is not -+ * acquired. -+ * -+ * scoped_cond_guard (name, fail, args...) { }: -+ * similar to scoped_guard(), except it does fail when the lock -+ * acquire fails. -+ * -+ * Only for conditional locks. - */ - -+#define __DEFINE_CLASS_IS_CONDITIONAL(_name, _is_cond) \ -+static __maybe_unused const bool class_##_name##_is_conditional = _is_cond -+ - #define DEFINE_GUARD(_name, _type, _lock, _unlock) \ -- DEFINE_CLASS(_name, _type, _unlock, ({ _lock; _T; }), _type _T) -+ __DEFINE_CLASS_IS_CONDITIONAL(_name, false); \ -+ DEFINE_CLASS(_name, _type, if (_T) { _unlock; }, ({ _lock; _T; }), _type _T); \ -+ static inline void * class_##_name##_lock_ptr(class_##_name##_t *_T) \ -+ { return (void *)(__force unsigned long)*_T; } -+ -+#define DEFINE_GUARD_COND(_name, _ext, _condlock) \ -+ __DEFINE_CLASS_IS_CONDITIONAL(_name##_ext, true); \ -+ EXTEND_CLASS(_name, _ext, \ -+ ({ void *_t = _T; if (_T && !(_condlock)) _t = NULL; _t; }), \ -+ class_##_name##_t _T) \ -+ static inline void * class_##_name##_ext##_lock_ptr(class_##_name##_t *_T) \ -+ { return class_##_name##_lock_ptr(_T); } - - #define guard(_name) \ - CLASS(_name, __UNIQUE_ID(guard)) - --#define scoped_guard(_name, args...) \ -- for (CLASS(_name, scope)(args), \ -- *done = NULL; !done; done = (void *)1) -+#define __guard_ptr(_name) class_##_name##_lock_ptr -+#define __is_cond_ptr(_name) class_##_name##_is_conditional - -+/* -+ * Helper macro for scoped_guard(). -+ * -+ * Note that the "!__is_cond_ptr(_name)" part of the condition ensures that -+ * compiler would be sure that for the unconditional locks the body of the -+ * loop (caller-provided code glued to the else clause) could not be skipped. -+ * It is needed because the other part - "__guard_ptr(_name)(&scope)" - is too -+ * hard to deduce (even if could be proven true for unconditional locks). -+ */ -+#define __scoped_guard(_name, _label, args...) \ -+ for (CLASS(_name, scope)(args); \ -+ __guard_ptr(_name)(&scope) || !__is_cond_ptr(_name); \ -+ ({ goto _label; })) \ -+ if (0) { \ -+_label: \ -+ break; \ -+ } else -+ -+#define scoped_guard(_name, args...) \ -+ __scoped_guard(_name, __UNIQUE_ID(label), args) -+ -+#define __scoped_cond_guard(_name, _fail, _label, args...) \ -+ for (CLASS(_name, scope)(args); true; ({ goto _label; })) \ -+ if (!__guard_ptr(_name)(&scope)) { \ -+ BUILD_BUG_ON(!__is_cond_ptr(_name)); \ -+ _fail; \ -+_label: \ -+ break; \ -+ } else -+ -+#define scoped_cond_guard(_name, _fail, args...) \ -+ __scoped_cond_guard(_name, _fail, __UNIQUE_ID(label), args) - /* - * Additional helper macros for generating lock guards with types, either for - * locks that don't have a native type (eg. RCU, preempt) or those that need a -@@ -119,6 +178,7 @@ static inline class_##_name##_t class_##_name##ext##_constructor(_init_args) \ - * - * DEFINE_LOCK_GUARD_0(name, lock, unlock, ...) - * DEFINE_LOCK_GUARD_1(name, type, lock, unlock, ...) -+ * DEFINE_LOCK_GUARD_1_COND(name, ext, condlock) - * - * will result in the following type: - * -@@ -140,6 +200,11 @@ typedef struct { \ - static inline void class_##_name##_destructor(class_##_name##_t *_T) \ - { \ - if (_T->lock) { _unlock; } \ -+} \ -+ \ -+static inline void *class_##_name##_lock_ptr(class_##_name##_t *_T) \ -+{ \ -+ return (void *)(__force unsigned long)_T->lock; \ - } - - -@@ -161,11 +226,24 @@ static inline class_##_name##_t class_##_name##_constructor(void) \ - } - - #define DEFINE_LOCK_GUARD_1(_name, _type, _lock, _unlock, ...) \ -+__DEFINE_CLASS_IS_CONDITIONAL(_name, false); \ - __DEFINE_UNLOCK_GUARD(_name, _type, _unlock, __VA_ARGS__) \ - __DEFINE_LOCK_GUARD_1(_name, _type, _lock) - - #define DEFINE_LOCK_GUARD_0(_name, _lock, _unlock, ...) \ -+__DEFINE_CLASS_IS_CONDITIONAL(_name, false); \ - __DEFINE_UNLOCK_GUARD(_name, void, _unlock, __VA_ARGS__) \ - __DEFINE_LOCK_GUARD_0(_name, _lock) - -+#define DEFINE_LOCK_GUARD_1_COND(_name, _ext, _condlock) \ -+ __DEFINE_CLASS_IS_CONDITIONAL(_name##_ext, true); \ -+ EXTEND_CLASS(_name, _ext, \ -+ ({ class_##_name##_t _t = { .lock = l }, *_T = &_t;\ -+ if (_T->lock && !(_condlock)) _T->lock = NULL; \ -+ _t; }), \ -+ typeof_member(class_##_name##_t, lock) l) \ -+ static inline void * class_##_name##_ext##_lock_ptr(class_##_name##_t *_T) \ -+ { return class_##_name##_lock_ptr(_T); } -+ -+ - #endif /* __LINUX_GUARDS_H */ -diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h -index 3028af87716e29..430749a0f362aa 100644 ---- a/include/linux/if_vlan.h -+++ b/include/linux/if_vlan.h -@@ -585,13 +585,16 @@ static inline int vlan_get_tag(const struct sk_buff *skb, u16 *vlan_tci) - * vlan_get_protocol - get protocol EtherType. - * @skb: skbuff to query - * @type: first vlan protocol -+ * @mac_offset: MAC offset - * @depth: buffer to store length of eth and vlan tags in bytes - * - * Returns the EtherType of the packet, regardless of whether it is - * vlan encapsulated (normal or hardware accelerated) or not. - */ --static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 type, -- int *depth) -+static inline __be16 __vlan_get_protocol_offset(const struct sk_buff *skb, -+ __be16 type, -+ int mac_offset, -+ int *depth) - { - unsigned int vlan_depth = skb->mac_len, parse_depth = VLAN_MAX_DEPTH; - -@@ -610,7 +613,8 @@ static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 type, - do { - struct vlan_hdr vhdr, *vh; - -- vh = skb_header_pointer(skb, vlan_depth, sizeof(vhdr), &vhdr); -+ vh = skb_header_pointer(skb, mac_offset + vlan_depth, -+ sizeof(vhdr), &vhdr); - if (unlikely(!vh || !--parse_depth)) - return 0; - -@@ -625,6 +629,12 @@ static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 type, - return type; - } - -+static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 type, -+ int *depth) -+{ -+ return __vlan_get_protocol_offset(skb, type, 0, depth); -+} -+ - /** - * vlan_get_protocol - get protocol EtherType. - * @skb: skbuff to query -diff --git a/include/linux/memblock.h b/include/linux/memblock.h -index ed57c23f80ac2b..ed64240041e857 100644 ---- a/include/linux/memblock.h -+++ b/include/linux/memblock.h -@@ -122,6 +122,7 @@ unsigned long memblock_addrs_overlap(phys_addr_t base1, phys_addr_t size1, - phys_addr_t base2, phys_addr_t size2); - bool memblock_overlaps_region(struct memblock_type *type, - phys_addr_t base, phys_addr_t size); -+bool memblock_validate_numa_coverage(unsigned long threshold_bytes); - int memblock_mark_hotplug(phys_addr_t base, phys_addr_t size); - int memblock_clear_hotplug(phys_addr_t base, phys_addr_t size); - int memblock_mark_mirror(phys_addr_t base, phys_addr_t size); -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index ffb98bc43b2db2..38a8ff9c685cb8 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -1225,6 +1225,12 @@ static inline bool mlx5_core_is_vf(const struct mlx5_core_dev *dev) - return dev->coredev_type == MLX5_COREDEV_VF; - } - -+static inline bool mlx5_core_same_coredev_type(const struct mlx5_core_dev *dev1, -+ const struct mlx5_core_dev *dev2) -+{ -+ return dev1->coredev_type == dev2->coredev_type; -+} -+ - static inline bool mlx5_core_is_ecpf(const struct mlx5_core_dev *dev) - { - return dev->caps.embedded_cpu; -diff --git a/include/linux/mutex.h b/include/linux/mutex.h -index 5b5630e58407a5..e1c323c7d75ba9 100644 ---- a/include/linux/mutex.h -+++ b/include/linux/mutex.h -@@ -248,6 +248,7 @@ extern void mutex_unlock(struct mutex *lock); - extern int atomic_dec_and_mutex_lock(atomic_t *cnt, struct mutex *lock); - - DEFINE_GUARD(mutex, struct mutex *, mutex_lock(_T), mutex_unlock(_T)) --DEFINE_FREE(mutex, struct mutex *, if (_T) mutex_unlock(_T)) -+DEFINE_GUARD_COND(mutex, _try, mutex_trylock(_T)) -+DEFINE_GUARD_COND(mutex, _intr, mutex_lock_interruptible(_T) == 0) - - #endif /* __LINUX_MUTEX_H */ -diff --git a/include/linux/rwsem.h b/include/linux/rwsem.h -index 1dd530ce8b45b9..9c29689ff505e0 100644 ---- a/include/linux/rwsem.h -+++ b/include/linux/rwsem.h -@@ -203,11 +203,11 @@ extern void up_read(struct rw_semaphore *sem); - extern void up_write(struct rw_semaphore *sem); - - DEFINE_GUARD(rwsem_read, struct rw_semaphore *, down_read(_T), up_read(_T)) --DEFINE_GUARD(rwsem_write, struct rw_semaphore *, down_write(_T), up_write(_T)) -- --DEFINE_FREE(up_read, struct rw_semaphore *, if (_T) up_read(_T)) --DEFINE_FREE(up_write, struct rw_semaphore *, if (_T) up_write(_T)) -+DEFINE_GUARD_COND(rwsem_read, _try, down_read_trylock(_T)) -+DEFINE_GUARD_COND(rwsem_read, _intr, down_read_interruptible(_T) == 0) - -+DEFINE_GUARD(rwsem_write, struct rw_semaphore *, down_write(_T), up_write(_T)) -+DEFINE_GUARD_COND(rwsem_write, _try, down_write_trylock(_T)) - - /* - * downgrade write lock to read lock -diff --git a/include/linux/seq_buf.h b/include/linux/seq_buf.h -index 515d7fcb9634b5..468d8c5eef4a08 100644 ---- a/include/linux/seq_buf.h -+++ b/include/linux/seq_buf.h -@@ -14,19 +14,24 @@ - * @buffer: pointer to the buffer - * @size: size of the buffer - * @len: the amount of data inside the buffer -- * @readpos: The next position to read in the buffer. - */ - struct seq_buf { - char *buffer; - size_t size; - size_t len; -- loff_t readpos; - }; - -+#define DECLARE_SEQ_BUF(NAME, SIZE) \ -+ struct seq_buf NAME = { \ -+ .buffer = (char[SIZE]) { 0 }, \ -+ .size = SIZE, \ -+ } -+ - static inline void seq_buf_clear(struct seq_buf *s) - { - s->len = 0; -- s->readpos = 0; -+ if (s->size) -+ s->buffer[0] = '\0'; - } - - static inline void -@@ -72,8 +77,8 @@ static inline unsigned int seq_buf_used(struct seq_buf *s) - } - - /** -- * seq_buf_terminate - Make sure buffer is nul terminated -- * @s: the seq_buf descriptor to terminate. -+ * seq_buf_str - get %NUL-terminated C string from seq_buf -+ * @s: the seq_buf handle - * - * This makes sure that the buffer in @s is nul terminated and - * safe to read as a string. -@@ -84,16 +89,20 @@ static inline unsigned int seq_buf_used(struct seq_buf *s) - * - * After this function is called, s->buffer is safe to use - * in string operations. -+ * -+ * Returns @s->buf after making sure it is terminated. - */ --static inline void seq_buf_terminate(struct seq_buf *s) -+static inline const char *seq_buf_str(struct seq_buf *s) - { - if (WARN_ON(s->size == 0)) -- return; -+ return ""; - - if (seq_buf_buffer_left(s)) - s->buffer[s->len] = 0; - else - s->buffer[s->size - 1] = 0; -+ -+ return s->buffer; - } - - /** -@@ -143,7 +152,7 @@ extern __printf(2, 0) - int seq_buf_vprintf(struct seq_buf *s, const char *fmt, va_list args); - extern int seq_buf_print_seq(struct seq_file *m, struct seq_buf *s); - extern int seq_buf_to_user(struct seq_buf *s, char __user *ubuf, -- int cnt); -+ size_t start, int cnt); - extern int seq_buf_puts(struct seq_buf *s, const char *str); - extern int seq_buf_putc(struct seq_buf *s, unsigned char c); - extern int seq_buf_putmem(struct seq_buf *s, const void *mem, unsigned int len); -diff --git a/include/linux/spinlock.h b/include/linux/spinlock.h -index 31d3d747a9db78..ceb56b39c70f77 100644 ---- a/include/linux/spinlock.h -+++ b/include/linux/spinlock.h -@@ -507,6 +507,8 @@ DEFINE_LOCK_GUARD_1(raw_spinlock, raw_spinlock_t, - raw_spin_lock(_T->lock), - raw_spin_unlock(_T->lock)) - -+DEFINE_LOCK_GUARD_1_COND(raw_spinlock, _try, raw_spin_trylock(_T->lock)) -+ - DEFINE_LOCK_GUARD_1(raw_spinlock_nested, raw_spinlock_t, - raw_spin_lock_nested(_T->lock, SINGLE_DEPTH_NESTING), - raw_spin_unlock(_T->lock)) -@@ -515,23 +517,36 @@ DEFINE_LOCK_GUARD_1(raw_spinlock_irq, raw_spinlock_t, - raw_spin_lock_irq(_T->lock), - raw_spin_unlock_irq(_T->lock)) - -+DEFINE_LOCK_GUARD_1_COND(raw_spinlock_irq, _try, raw_spin_trylock_irq(_T->lock)) -+ - DEFINE_LOCK_GUARD_1(raw_spinlock_irqsave, raw_spinlock_t, - raw_spin_lock_irqsave(_T->lock, _T->flags), - raw_spin_unlock_irqrestore(_T->lock, _T->flags), - unsigned long flags) - -+DEFINE_LOCK_GUARD_1_COND(raw_spinlock_irqsave, _try, -+ raw_spin_trylock_irqsave(_T->lock, _T->flags)) -+ - DEFINE_LOCK_GUARD_1(spinlock, spinlock_t, - spin_lock(_T->lock), - spin_unlock(_T->lock)) - -+DEFINE_LOCK_GUARD_1_COND(spinlock, _try, spin_trylock(_T->lock)) -+ - DEFINE_LOCK_GUARD_1(spinlock_irq, spinlock_t, - spin_lock_irq(_T->lock), - spin_unlock_irq(_T->lock)) - -+DEFINE_LOCK_GUARD_1_COND(spinlock_irq, _try, -+ spin_trylock_irq(_T->lock)) -+ - DEFINE_LOCK_GUARD_1(spinlock_irqsave, spinlock_t, - spin_lock_irqsave(_T->lock, _T->flags), - spin_unlock_irqrestore(_T->lock, _T->flags), - unsigned long flags) - -+DEFINE_LOCK_GUARD_1_COND(spinlock_irqsave, _try, -+ spin_trylock_irqsave(_T->lock, _T->flags)) -+ - #undef __LINUX_INSIDE_SPINLOCK_H - #endif /* __LINUX_SPINLOCK_H */ -diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h -index 9df2524fff33ae..aa1bc417266208 100644 ---- a/include/linux/trace_events.h -+++ b/include/linux/trace_events.h -@@ -279,7 +279,8 @@ struct trace_event_fields { - const char *name; - const int size; - const int align; -- const int is_signed; -+ const unsigned int is_signed:1; -+ unsigned int needs_test:1; - const int filter_type; - const int len; - }; -@@ -331,6 +332,7 @@ enum { - TRACE_EVENT_FL_EPROBE_BIT, - TRACE_EVENT_FL_FPROBE_BIT, - TRACE_EVENT_FL_CUSTOM_BIT, -+ TRACE_EVENT_FL_TEST_STR_BIT, - }; - - /* -@@ -348,6 +350,7 @@ enum { - * CUSTOM - Event is a custom event (to be attached to an exsiting tracepoint) - * This is set when the custom event has not been attached - * to a tracepoint yet, then it is cleared when it is. -+ * TEST_STR - The event has a "%s" that points to a string outside the event - */ - enum { - TRACE_EVENT_FL_FILTERED = (1 << TRACE_EVENT_FL_FILTERED_BIT), -@@ -361,6 +364,7 @@ enum { - TRACE_EVENT_FL_EPROBE = (1 << TRACE_EVENT_FL_EPROBE_BIT), - TRACE_EVENT_FL_FPROBE = (1 << TRACE_EVENT_FL_FPROBE_BIT), - TRACE_EVENT_FL_CUSTOM = (1 << TRACE_EVENT_FL_CUSTOM_BIT), -+ TRACE_EVENT_FL_TEST_STR = (1 << TRACE_EVENT_FL_TEST_STR_BIT), - }; - - #define TRACE_EVENT_FL_UKPROBE (TRACE_EVENT_FL_KPROBE | TRACE_EVENT_FL_UPROBE) -diff --git a/include/linux/trace_seq.h b/include/linux/trace_seq.h -index 6be92bf559fe7c..3691e0e76a1a20 100644 ---- a/include/linux/trace_seq.h -+++ b/include/linux/trace_seq.h -@@ -14,6 +14,7 @@ - struct trace_seq { - char buffer[PAGE_SIZE]; - struct seq_buf seq; -+ size_t readpos; - int full; - }; - -@@ -22,6 +23,7 @@ trace_seq_init(struct trace_seq *s) - { - seq_buf_init(&s->seq, s->buffer, PAGE_SIZE); - s->full = 0; -+ s->readpos = 0; - } - - /** -diff --git a/include/linux/usb/chipidea.h b/include/linux/usb/chipidea.h -index 0b4f2d5faa080d..ebdfef124b2bc0 100644 ---- a/include/linux/usb/chipidea.h -+++ b/include/linux/usb/chipidea.h -@@ -64,6 +64,8 @@ struct ci_hdrc_platform_data { - #define CI_HDRC_PMQOS BIT(15) - #define CI_HDRC_PHY_VBUS_CONTROL BIT(16) - #define CI_HDRC_HAS_PORTSC_PEC_MISSED BIT(17) -+#define CI_HDRC_FORCE_VBUS_ACTIVE_ALWAYS BIT(18) -+#define CI_HDRC_HAS_SHORT_PKT_LIMIT BIT(19) - enum usb_dr_mode dr_mode; - #define CI_HDRC_CONTROLLER_RESET_EVENT 0 - #define CI_HDRC_CONTROLLER_STOPPED_EVENT 1 -diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h -index e9214ccfde2d72..4fcee6b734b74c 100644 ---- a/include/net/bluetooth/hci_core.h -+++ b/include/net/bluetooth/hci_core.h -@@ -800,7 +800,6 @@ struct hci_conn_params { - extern struct list_head hci_dev_list; - extern struct list_head hci_cb_list; - extern rwlock_t hci_dev_list_lock; --extern struct mutex hci_cb_list_lock; - - #define hci_dev_set_flag(hdev, nr) set_bit((nr), (hdev)->dev_flags) - #define hci_dev_clear_flag(hdev, nr) clear_bit((nr), (hdev)->dev_flags) -@@ -1949,24 +1948,47 @@ struct hci_cb { - - char *name; - -+ bool (*match) (struct hci_conn *conn); - void (*connect_cfm) (struct hci_conn *conn, __u8 status); - void (*disconn_cfm) (struct hci_conn *conn, __u8 status); - void (*security_cfm) (struct hci_conn *conn, __u8 status, -- __u8 encrypt); -+ __u8 encrypt); - void (*key_change_cfm) (struct hci_conn *conn, __u8 status); - void (*role_switch_cfm) (struct hci_conn *conn, __u8 status, __u8 role); - }; - -+static inline void hci_cb_lookup(struct hci_conn *conn, struct list_head *list) -+{ -+ struct hci_cb *cb, *cpy; -+ -+ rcu_read_lock(); -+ list_for_each_entry_rcu(cb, &hci_cb_list, list) { -+ if (cb->match && cb->match(conn)) { -+ cpy = kmalloc(sizeof(*cpy), GFP_ATOMIC); -+ if (!cpy) -+ break; -+ -+ *cpy = *cb; -+ INIT_LIST_HEAD(&cpy->list); -+ list_add_rcu(&cpy->list, list); -+ } -+ } -+ rcu_read_unlock(); -+} -+ - static inline void hci_connect_cfm(struct hci_conn *conn, __u8 status) - { -- struct hci_cb *cb; -+ struct list_head list; -+ struct hci_cb *cb, *tmp; -+ -+ INIT_LIST_HEAD(&list); -+ hci_cb_lookup(conn, &list); - -- mutex_lock(&hci_cb_list_lock); -- list_for_each_entry(cb, &hci_cb_list, list) { -+ list_for_each_entry_safe(cb, tmp, &list, list) { - if (cb->connect_cfm) - cb->connect_cfm(conn, status); -+ kfree(cb); - } -- mutex_unlock(&hci_cb_list_lock); - - if (conn->connect_cfm_cb) - conn->connect_cfm_cb(conn, status); -@@ -1974,43 +1996,55 @@ static inline void hci_connect_cfm(struct hci_conn *conn, __u8 status) - - static inline void hci_disconn_cfm(struct hci_conn *conn, __u8 reason) - { -- struct hci_cb *cb; -+ struct list_head list; -+ struct hci_cb *cb, *tmp; -+ -+ INIT_LIST_HEAD(&list); -+ hci_cb_lookup(conn, &list); - -- mutex_lock(&hci_cb_list_lock); -- list_for_each_entry(cb, &hci_cb_list, list) { -+ list_for_each_entry_safe(cb, tmp, &list, list) { - if (cb->disconn_cfm) - cb->disconn_cfm(conn, reason); -+ kfree(cb); - } -- mutex_unlock(&hci_cb_list_lock); - - if (conn->disconn_cfm_cb) - conn->disconn_cfm_cb(conn, reason); - } - --static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status) -+static inline void hci_security_cfm(struct hci_conn *conn, __u8 status, -+ __u8 encrypt) - { -- struct hci_cb *cb; -- __u8 encrypt; -- -- if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) -- return; -+ struct list_head list; -+ struct hci_cb *cb, *tmp; - -- encrypt = test_bit(HCI_CONN_ENCRYPT, &conn->flags) ? 0x01 : 0x00; -+ INIT_LIST_HEAD(&list); -+ hci_cb_lookup(conn, &list); - -- mutex_lock(&hci_cb_list_lock); -- list_for_each_entry(cb, &hci_cb_list, list) { -+ list_for_each_entry_safe(cb, tmp, &list, list) { - if (cb->security_cfm) - cb->security_cfm(conn, status, encrypt); -+ kfree(cb); - } -- mutex_unlock(&hci_cb_list_lock); - - if (conn->security_cfm_cb) - conn->security_cfm_cb(conn, status); - } - -+static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status) -+{ -+ __u8 encrypt; -+ -+ if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) -+ return; -+ -+ encrypt = test_bit(HCI_CONN_ENCRYPT, &conn->flags) ? 0x01 : 0x00; -+ -+ hci_security_cfm(conn, status, encrypt); -+} -+ - static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status) - { -- struct hci_cb *cb; - __u8 encrypt; - - if (conn->state == BT_CONFIG) { -@@ -2037,40 +2071,38 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status) - conn->sec_level = conn->pending_sec_level; - } - -- mutex_lock(&hci_cb_list_lock); -- list_for_each_entry(cb, &hci_cb_list, list) { -- if (cb->security_cfm) -- cb->security_cfm(conn, status, encrypt); -- } -- mutex_unlock(&hci_cb_list_lock); -- -- if (conn->security_cfm_cb) -- conn->security_cfm_cb(conn, status); -+ hci_security_cfm(conn, status, encrypt); - } - - static inline void hci_key_change_cfm(struct hci_conn *conn, __u8 status) - { -- struct hci_cb *cb; -+ struct list_head list; -+ struct hci_cb *cb, *tmp; -+ -+ INIT_LIST_HEAD(&list); -+ hci_cb_lookup(conn, &list); - -- mutex_lock(&hci_cb_list_lock); -- list_for_each_entry(cb, &hci_cb_list, list) { -+ list_for_each_entry_safe(cb, tmp, &list, list) { - if (cb->key_change_cfm) - cb->key_change_cfm(conn, status); -+ kfree(cb); - } -- mutex_unlock(&hci_cb_list_lock); - } - - static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status, - __u8 role) - { -- struct hci_cb *cb; -+ struct list_head list; -+ struct hci_cb *cb, *tmp; -+ -+ INIT_LIST_HEAD(&list); -+ hci_cb_lookup(conn, &list); - -- mutex_lock(&hci_cb_list_lock); -- list_for_each_entry(cb, &hci_cb_list, list) { -+ list_for_each_entry_safe(cb, tmp, &list, list) { - if (cb->role_switch_cfm) - cb->role_switch_cfm(conn, status, role); -+ kfree(cb); - } -- mutex_unlock(&hci_cb_list_lock); - } - - static inline bool hci_bdaddr_is_rpa(bdaddr_t *bdaddr, u8 addr_type) -diff --git a/include/net/mac80211.h b/include/net/mac80211.h -index 47ade676565dbc..835a58ce9ca57c 100644 ---- a/include/net/mac80211.h -+++ b/include/net/mac80211.h -@@ -3039,6 +3039,19 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw, - */ - void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb); - -+/** -+ * ieee80211_purge_tx_queue - purge TX skb queue -+ * @hw: the hardware -+ * @skbs: the skbs -+ * -+ * Free a set of transmit skbs. Use this function when device is going to stop -+ * but some transmit skbs without TX status are still queued. -+ * This function does not take the list lock and the caller must hold the -+ * relevant locks to use it. -+ */ -+void ieee80211_purge_tx_queue(struct ieee80211_hw *hw, -+ struct sk_buff_head *skbs); -+ - /** - * DOC: Hardware crypto acceleration - * -@@ -6067,6 +6080,24 @@ void ieee80211_iterate_stations_atomic(struct ieee80211_hw *hw, - void (*iterator)(void *data, - struct ieee80211_sta *sta), - void *data); -+ -+/** -+ * ieee80211_iterate_stations_mtx - iterate stations -+ * -+ * This function iterates over all stations associated with a given -+ * hardware that are currently uploaded to the driver and calls the callback -+ * function for them. This version can only be used while holding the wiphy -+ * mutex. -+ * -+ * @hw: the hardware struct of which the interfaces should be iterated over -+ * @iterator: the iterator function to call -+ * @data: first argument of the iterator function -+ */ -+void ieee80211_iterate_stations_mtx(struct ieee80211_hw *hw, -+ void (*iterator)(void *data, -+ struct ieee80211_sta *sta), -+ void *data); -+ - /** - * ieee80211_queue_work - add work onto the mac80211 workqueue - * -diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h -index b5f9ee5810a347..8321915dddb284 100644 ---- a/include/net/netfilter/nf_tables.h -+++ b/include/net/netfilter/nf_tables.h -@@ -721,15 +721,18 @@ struct nft_set_ext_tmpl { - /** - * struct nft_set_ext - set extensions - * -- * @genmask: generation mask -+ * @genmask: generation mask, but also flags (see NFT_SET_ELEM_DEAD_BIT) - * @offset: offsets of individual extension types - * @data: beginning of extension data -+ * -+ * This structure must be aligned to word size, otherwise atomic bitops -+ * on genmask field can cause alignment failure on some archs. - */ - struct nft_set_ext { - u8 genmask; - u8 offset[NFT_SET_EXT_NUM]; - char data[]; --}; -+} __aligned(BITS_PER_LONG / 8); - - static inline void nft_set_ext_prepare(struct nft_set_ext_tmpl *tmpl) - { -diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c -index 58ee17f429a33a..02f327f05fd619 100644 ---- a/kernel/bpf/core.c -+++ b/kernel/bpf/core.c -@@ -529,6 +529,8 @@ struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off, - - int bpf_remove_insns(struct bpf_prog *prog, u32 off, u32 cnt) - { -+ int err; -+ - /* Branch offsets can't overflow when program is shrinking, no need - * to call bpf_adj_branches(..., true) here - */ -@@ -536,7 +538,9 @@ int bpf_remove_insns(struct bpf_prog *prog, u32 off, u32 cnt) - sizeof(struct bpf_insn) * (prog->len - off - cnt)); - prog->len -= cnt; - -- return WARN_ON_ONCE(bpf_adj_branches(prog, off, off + cnt, off, false)); -+ err = bpf_adj_branches(prog, off, off + cnt, off, false); -+ WARN_ON_ONCE(err); -+ return err; - } - - static void bpf_prog_kallsyms_del_subprogs(struct bpf_prog *fp) -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index a3c3c66ca04759..d6a4102312fadd 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -1762,8 +1762,8 @@ static int copy_verifier_state(struct bpf_verifier_state *dst_state, - int i, err; - - dst_state->jmp_history = copy_array(dst_state->jmp_history, src->jmp_history, -- src->jmp_history_cnt, sizeof(*dst_state->jmp_history), -- GFP_USER); -+ src->jmp_history_cnt, sizeof(struct bpf_idx_pair), -+ GFP_USER); - if (!dst_state->jmp_history) - return -ENOMEM; - dst_state->jmp_history_cnt = src->jmp_history_cnt; -@@ -3397,21 +3397,6 @@ static int check_reg_arg(struct bpf_verifier_env *env, u32 regno, - return __check_reg_arg(env, state->regs, regno, t); - } - --static int insn_stack_access_flags(int frameno, int spi) --{ -- return INSN_F_STACK_ACCESS | (spi << INSN_F_SPI_SHIFT) | frameno; --} -- --static int insn_stack_access_spi(int insn_flags) --{ -- return (insn_flags >> INSN_F_SPI_SHIFT) & INSN_F_SPI_MASK; --} -- --static int insn_stack_access_frameno(int insn_flags) --{ -- return insn_flags & INSN_F_FRAMENO_MASK; --} -- - static void mark_jmp_point(struct bpf_verifier_env *env, int idx) - { - env->insn_aux_data[idx].jmp_point = true; -@@ -3423,51 +3408,28 @@ static bool is_jmp_point(struct bpf_verifier_env *env, int insn_idx) - } - - /* for any branch, call, exit record the history of jmps in the given state */ --static int push_jmp_history(struct bpf_verifier_env *env, struct bpf_verifier_state *cur, -- int insn_flags) -+static int push_jmp_history(struct bpf_verifier_env *env, -+ struct bpf_verifier_state *cur) - { - u32 cnt = cur->jmp_history_cnt; -- struct bpf_jmp_history_entry *p; -+ struct bpf_idx_pair *p; - size_t alloc_size; - -- /* combine instruction flags if we already recorded this instruction */ -- if (env->cur_hist_ent) { -- /* atomic instructions push insn_flags twice, for READ and -- * WRITE sides, but they should agree on stack slot -- */ -- WARN_ONCE((env->cur_hist_ent->flags & insn_flags) && -- (env->cur_hist_ent->flags & insn_flags) != insn_flags, -- "verifier insn history bug: insn_idx %d cur flags %x new flags %x\n", -- env->insn_idx, env->cur_hist_ent->flags, insn_flags); -- env->cur_hist_ent->flags |= insn_flags; -+ if (!is_jmp_point(env, env->insn_idx)) - return 0; -- } - - cnt++; - alloc_size = kmalloc_size_roundup(size_mul(cnt, sizeof(*p))); - p = krealloc(cur->jmp_history, alloc_size, GFP_USER); - if (!p) - return -ENOMEM; -+ p[cnt - 1].idx = env->insn_idx; -+ p[cnt - 1].prev_idx = env->prev_insn_idx; - cur->jmp_history = p; -- -- p = &cur->jmp_history[cnt - 1]; -- p->idx = env->insn_idx; -- p->prev_idx = env->prev_insn_idx; -- p->flags = insn_flags; - cur->jmp_history_cnt = cnt; -- env->cur_hist_ent = p; -- - return 0; - } - --static struct bpf_jmp_history_entry *get_jmp_hist_entry(struct bpf_verifier_state *st, -- u32 hist_end, int insn_idx) --{ -- if (hist_end > 0 && st->jmp_history[hist_end - 1].idx == insn_idx) -- return &st->jmp_history[hist_end - 1]; -- return NULL; --} -- - /* Backtrack one insn at a time. If idx is not at the top of recorded - * history then previous instruction came from straight line execution. - * Return -ENOENT if we exhausted all instructions within given state. -@@ -3629,14 +3591,9 @@ static inline bool bt_is_reg_set(struct backtrack_state *bt, u32 reg) - return bt->reg_masks[bt->frame] & (1 << reg); - } - --static inline bool bt_is_frame_slot_set(struct backtrack_state *bt, u32 frame, u32 slot) --{ -- return bt->stack_masks[frame] & (1ull << slot); --} -- - static inline bool bt_is_slot_set(struct backtrack_state *bt, u32 slot) - { -- return bt_is_frame_slot_set(bt, bt->frame, slot); -+ return bt->stack_masks[bt->frame] & (1ull << slot); - } - - /* format registers bitmask, e.g., "r0,r2,r4" for 0x15 mask */ -@@ -3690,7 +3647,7 @@ static bool calls_callback(struct bpf_verifier_env *env, int insn_idx); - * - *was* processed previously during backtracking. - */ - static int backtrack_insn(struct bpf_verifier_env *env, int idx, int subseq_idx, -- struct bpf_jmp_history_entry *hist, struct backtrack_state *bt) -+ struct backtrack_state *bt) - { - const struct bpf_insn_cbs cbs = { - .cb_call = disasm_kfunc_name, -@@ -3703,7 +3660,7 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx, int subseq_idx, - u8 mode = BPF_MODE(insn->code); - u32 dreg = insn->dst_reg; - u32 sreg = insn->src_reg; -- u32 spi, i, fr; -+ u32 spi, i; - - if (insn->code == 0) - return 0; -@@ -3766,15 +3723,20 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx, int subseq_idx, - * by 'precise' mark in corresponding register of this state. - * No further tracking necessary. - */ -- if (!hist || !(hist->flags & INSN_F_STACK_ACCESS)) -+ if (insn->src_reg != BPF_REG_FP) - return 0; -+ - /* dreg = *(u64 *)[fp - off] was a fill from the stack. - * that [fp - off] slot contains scalar that needs to be - * tracked with precision - */ -- spi = insn_stack_access_spi(hist->flags); -- fr = insn_stack_access_frameno(hist->flags); -- bt_set_frame_slot(bt, fr, spi); -+ spi = (-insn->off - 1) / BPF_REG_SIZE; -+ if (spi >= 64) { -+ verbose(env, "BUG spi %d\n", spi); -+ WARN_ONCE(1, "verifier backtracking bug"); -+ return -EFAULT; -+ } -+ bt_set_slot(bt, spi); - } else if (class == BPF_STX || class == BPF_ST) { - if (bt_is_reg_set(bt, dreg)) - /* stx & st shouldn't be using _scalar_ dst_reg -@@ -3783,13 +3745,17 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx, int subseq_idx, - */ - return -ENOTSUPP; - /* scalars can only be spilled into stack */ -- if (!hist || !(hist->flags & INSN_F_STACK_ACCESS)) -+ if (insn->dst_reg != BPF_REG_FP) - return 0; -- spi = insn_stack_access_spi(hist->flags); -- fr = insn_stack_access_frameno(hist->flags); -- if (!bt_is_frame_slot_set(bt, fr, spi)) -+ spi = (-insn->off - 1) / BPF_REG_SIZE; -+ if (spi >= 64) { -+ verbose(env, "BUG spi %d\n", spi); -+ WARN_ONCE(1, "verifier backtracking bug"); -+ return -EFAULT; -+ } -+ if (!bt_is_slot_set(bt, spi)) - return 0; -- bt_clear_frame_slot(bt, fr, spi); -+ bt_clear_slot(bt, spi); - if (class == BPF_STX) - bt_set_reg(bt, sreg); - } else if (class == BPF_JMP || class == BPF_JMP32) { -@@ -3833,14 +3799,10 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx, int subseq_idx, - WARN_ONCE(1, "verifier backtracking bug"); - return -EFAULT; - } -- /* we are now tracking register spills correctly, -- * so any instance of leftover slots is a bug -- */ -- if (bt_stack_mask(bt) != 0) { -- verbose(env, "BUG stack slots %llx\n", bt_stack_mask(bt)); -- WARN_ONCE(1, "verifier backtracking bug (subprog leftover stack slots)"); -- return -EFAULT; -- } -+ /* we don't track register spills perfectly, -+ * so fallback to force-precise instead of failing */ -+ if (bt_stack_mask(bt) != 0) -+ return -ENOTSUPP; - /* propagate r1-r5 to the caller */ - for (i = BPF_REG_1; i <= BPF_REG_5; i++) { - if (bt_is_reg_set(bt, i)) { -@@ -3865,11 +3827,8 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx, int subseq_idx, - WARN_ONCE(1, "verifier backtracking bug"); - return -EFAULT; - } -- if (bt_stack_mask(bt) != 0) { -- verbose(env, "BUG stack slots %llx\n", bt_stack_mask(bt)); -- WARN_ONCE(1, "verifier backtracking bug (callback leftover stack slots)"); -- return -EFAULT; -- } -+ if (bt_stack_mask(bt) != 0) -+ return -ENOTSUPP; - /* clear r1-r5 in callback subprog's mask */ - for (i = BPF_REG_1; i <= BPF_REG_5; i++) - bt_clear_reg(bt, i); -@@ -4306,7 +4265,6 @@ static int __mark_chain_precision(struct bpf_verifier_env *env, int regno) - for (;;) { - DECLARE_BITMAP(mask, 64); - u32 history = st->jmp_history_cnt; -- struct bpf_jmp_history_entry *hist; - - if (env->log.level & BPF_LOG_LEVEL2) { - verbose(env, "mark_precise: frame%d: last_idx %d first_idx %d subseq_idx %d \n", -@@ -4370,8 +4328,7 @@ static int __mark_chain_precision(struct bpf_verifier_env *env, int regno) - err = 0; - skip_first = false; - } else { -- hist = get_jmp_hist_entry(st, history, i); -- err = backtrack_insn(env, i, subseq_idx, hist, bt); -+ err = backtrack_insn(env, i, subseq_idx, bt); - } - if (err == -ENOTSUPP) { - mark_all_scalars_precise(env, env->cur_state); -@@ -4424,10 +4381,22 @@ static int __mark_chain_precision(struct bpf_verifier_env *env, int regno) - bitmap_from_u64(mask, bt_frame_stack_mask(bt, fr)); - for_each_set_bit(i, mask, 64) { - if (i >= func->allocated_stack / BPF_REG_SIZE) { -- verbose(env, "BUG backtracking (stack slot %d, total slots %d)\n", -- i, func->allocated_stack / BPF_REG_SIZE); -- WARN_ONCE(1, "verifier backtracking bug (stack slot out of bounds)"); -- return -EFAULT; -+ /* the sequence of instructions: -+ * 2: (bf) r3 = r10 -+ * 3: (7b) *(u64 *)(r3 -8) = r0 -+ * 4: (79) r4 = *(u64 *)(r10 -8) -+ * doesn't contain jmps. It's backtracked -+ * as a single block. -+ * During backtracking insn 3 is not recognized as -+ * stack access, so at the end of backtracking -+ * stack slot fp-8 is still marked in stack_mask. -+ * However the parent state may not have accessed -+ * fp-8 and it's "unallocated" stack space. -+ * In such case fallback to conservative. -+ */ -+ mark_all_scalars_precise(env, env->cur_state); -+ bt_reset(bt); -+ return 0; - } - - if (!is_spilled_scalar_reg(&func->stack[i])) { -@@ -4592,7 +4561,7 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env, - int i, slot = -off - 1, spi = slot / BPF_REG_SIZE, err; - struct bpf_insn *insn = &env->prog->insnsi[insn_idx]; - struct bpf_reg_state *reg = NULL; -- int insn_flags = insn_stack_access_flags(state->frameno, spi); -+ u32 dst_reg = insn->dst_reg; - - /* caller checked that off % size == 0 and -MAX_BPF_STACK <= off < 0, - * so it's aligned access and [off, off + size) are within stack limits -@@ -4631,6 +4600,17 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env, - mark_stack_slot_scratched(env, spi); - if (reg && !(off % BPF_REG_SIZE) && register_is_bounded(reg) && - !register_is_null(reg) && env->bpf_capable) { -+ if (dst_reg != BPF_REG_FP) { -+ /* The backtracking logic can only recognize explicit -+ * stack slot address like [fp - 8]. Other spill of -+ * scalar via different register has to be conservative. -+ * Backtrack from here and mark all registers as precise -+ * that contributed into 'reg' being a constant. -+ */ -+ err = mark_chain_precision(env, value_regno); -+ if (err) -+ return err; -+ } - save_register_state(state, spi, reg, size); - /* Break the relation on a narrowing spill. */ - if (fls64(reg->umax_value) > BITS_PER_BYTE * size) -@@ -4642,7 +4622,6 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env, - __mark_reg_known(&fake_reg, insn->imm); - fake_reg.type = SCALAR_VALUE; - save_register_state(state, spi, &fake_reg, size); -- insn_flags = 0; /* not a register spill */ - } else if (reg && is_spillable_regtype(reg->type)) { - /* register containing pointer is being spilled into stack */ - if (size != BPF_REG_SIZE) { -@@ -4688,12 +4667,9 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env, - - /* Mark slots affected by this stack write. */ - for (i = 0; i < size; i++) -- state->stack[spi].slot_type[(slot - i) % BPF_REG_SIZE] = type; -- insn_flags = 0; /* not a register spill */ -+ state->stack[spi].slot_type[(slot - i) % BPF_REG_SIZE] = -+ type; - } -- -- if (insn_flags) -- return push_jmp_history(env, env->cur_state, insn_flags); - return 0; - } - -@@ -4882,7 +4858,6 @@ static int check_stack_read_fixed_off(struct bpf_verifier_env *env, - int i, slot = -off - 1, spi = slot / BPF_REG_SIZE; - struct bpf_reg_state *reg; - u8 *stype, type; -- int insn_flags = insn_stack_access_flags(reg_state->frameno, spi); - - stype = reg_state->stack[spi].slot_type; - reg = ®_state->stack[spi].spilled_ptr; -@@ -4928,10 +4903,12 @@ static int check_stack_read_fixed_off(struct bpf_verifier_env *env, - return -EACCES; - } - mark_reg_unknown(env, state->regs, dst_regno); -- insn_flags = 0; /* not restoring original register state */ - } - state->regs[dst_regno].live |= REG_LIVE_WRITTEN; -- } else if (dst_regno >= 0) { -+ return 0; -+ } -+ -+ if (dst_regno >= 0) { - /* restore register state from stack */ - copy_register_state(&state->regs[dst_regno], reg); - /* mark reg as written since spilled pointer state likely -@@ -4967,10 +4944,7 @@ static int check_stack_read_fixed_off(struct bpf_verifier_env *env, - mark_reg_read(env, reg, reg->parent, REG_LIVE_READ64); - if (dst_regno >= 0) - mark_reg_stack_read(env, reg_state, off, off + size, dst_regno); -- insn_flags = 0; /* we are not restoring spilled register */ - } -- if (insn_flags) -- return push_jmp_history(env, env->cur_state, insn_flags); - return 0; - } - -@@ -7054,6 +7028,7 @@ static int check_atomic(struct bpf_verifier_env *env, int insn_idx, struct bpf_i - BPF_SIZE(insn->code), BPF_WRITE, -1, true, false); - if (err) - return err; -+ - return 0; - } - -@@ -16802,8 +16777,7 @@ static int is_state_visited(struct bpf_verifier_env *env, int insn_idx) - * the precision needs to be propagated back in - * the current state. - */ -- if (is_jmp_point(env, env->insn_idx)) -- err = err ? : push_jmp_history(env, cur, 0); -+ err = err ? : push_jmp_history(env, cur); - err = err ? : propagate_precision(env, &sl->state); - if (err) - return err; -@@ -17027,9 +17001,6 @@ static int do_check(struct bpf_verifier_env *env) - u8 class; - int err; - -- /* reset current history entry on each new instruction */ -- env->cur_hist_ent = NULL; -- - env->prev_insn_idx = prev_insn_idx; - if (env->insn_idx >= insn_cnt) { - verbose(env, "invalid insn idx %d insn_cnt %d\n", -@@ -17069,7 +17040,7 @@ static int do_check(struct bpf_verifier_env *env) - } - - if (is_jmp_point(env, env->insn_idx)) { -- err = push_jmp_history(env, state, 0); -+ err = push_jmp_history(env, state); - if (err) - return err; - } -diff --git a/kernel/kcov.c b/kernel/kcov.c -index 72d9aa6fb50c3e..097c8afa675578 100644 ---- a/kernel/kcov.c -+++ b/kernel/kcov.c -@@ -165,7 +165,7 @@ static void kcov_remote_area_put(struct kcov_remote_area *area, - * Unlike in_serving_softirq(), this function returns false when called during - * a hardirq or an NMI that happened in the softirq context. - */ --static inline bool in_softirq_really(void) -+static __always_inline bool in_softirq_really(void) - { - return in_serving_softirq() && !in_hardirq() && !in_nmi(); - } -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 228f7c07da7284..86606fb9e6bc6c 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -4488,7 +4488,8 @@ int wake_up_state(struct task_struct *p, unsigned int state) - * Perform scheduler related setup for a newly forked process p. - * p is forked by current. - * -- * __sched_fork() is basic setup used by init_idle() too: -+ * __sched_fork() is basic setup which is also used by sched_init() to -+ * initialize the boot CPU's idle task. - */ - static void __sched_fork(unsigned long clone_flags, struct task_struct *p) - { -@@ -9257,8 +9258,6 @@ void __init init_idle(struct task_struct *idle, int cpu) - struct rq *rq = cpu_rq(cpu); - unsigned long flags; - -- __sched_fork(0, idle); -- - raw_spin_lock_irqsave(&idle->pi_lock, flags); - raw_spin_rq_lock(rq); - -@@ -9273,10 +9272,8 @@ void __init init_idle(struct task_struct *idle, int cpu) - - #ifdef CONFIG_SMP - /* -- * It's possible that init_idle() gets called multiple times on a task, -- * in that case do_set_cpus_allowed() will not do the right thing. -- * -- * And since this is boot we can forgo the serialization. -+ * No validation and serialization required at boot time and for -+ * setting up the idle tasks of not yet online CPUs. - */ - set_cpus_allowed_common(idle, &ac); - #endif -@@ -10105,6 +10102,7 @@ void __init sched_init(void) - * but because we are the idle thread, we just pick up running again - * when this runqueue becomes "idle". - */ -+ __sched_fork(0, current); - init_idle(current, smp_processor_id()); - - calc_load_update = jiffies + LOAD_FREQ; -diff --git a/kernel/softirq.c b/kernel/softirq.c -index bd9716d7bb6383..f24d80cf20bd35 100644 ---- a/kernel/softirq.c -+++ b/kernel/softirq.c -@@ -279,17 +279,24 @@ static inline void invoke_softirq(void) - wakeup_softirqd(); - } - -+#define SCHED_SOFTIRQ_MASK BIT(SCHED_SOFTIRQ) -+ - /* - * flush_smp_call_function_queue() can raise a soft interrupt in a function -- * call. On RT kernels this is undesired and the only known functionality -- * in the block layer which does this is disabled on RT. If soft interrupts -- * get raised which haven't been raised before the flush, warn so it can be -+ * call. On RT kernels this is undesired and the only known functionalities -+ * are in the block layer which is disabled on RT, and in the scheduler for -+ * idle load balancing. If soft interrupts get raised which haven't been -+ * raised before the flush, warn if it is not a SCHED_SOFTIRQ so it can be - * investigated. - */ - void do_softirq_post_smp_call_flush(unsigned int was_pending) - { -- if (WARN_ON_ONCE(was_pending != local_softirq_pending())) -+ unsigned int is_pending = local_softirq_pending(); -+ -+ if (unlikely(was_pending != is_pending)) { -+ WARN_ON_ONCE(was_pending != (is_pending & ~SCHED_SOFTIRQ_MASK)); - invoke_softirq(); -+ } - } - - #else /* CONFIG_PREEMPT_RT */ -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 220903117c5139..9d9af60b238e27 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -1731,15 +1731,15 @@ static ssize_t trace_seq_to_buffer(struct trace_seq *s, void *buf, size_t cnt) - { - int len; - -- if (trace_seq_used(s) <= s->seq.readpos) -+ if (trace_seq_used(s) <= s->readpos) - return -EBUSY; - -- len = trace_seq_used(s) - s->seq.readpos; -+ len = trace_seq_used(s) - s->readpos; - if (cnt > len) - cnt = len; -- memcpy(buf, s->buffer + s->seq.readpos, cnt); -+ memcpy(buf, s->buffer + s->readpos, cnt); - -- s->seq.readpos += cnt; -+ s->readpos += cnt; - return cnt; - } - -@@ -3760,17 +3760,12 @@ char *trace_iter_expand_format(struct trace_iterator *iter) - } - - /* Returns true if the string is safe to dereference from an event */ --static bool trace_safe_str(struct trace_iterator *iter, const char *str, -- bool star, int len) -+static bool trace_safe_str(struct trace_iterator *iter, const char *str) - { - unsigned long addr = (unsigned long)str; - struct trace_event *trace_event; - struct trace_event_call *event; - -- /* Ignore strings with no length */ -- if (star && !len) -- return true; -- - /* OK if part of the event data */ - if ((addr >= (unsigned long)iter->ent) && - (addr < (unsigned long)iter->ent + iter->ent_size)) -@@ -3810,142 +3805,69 @@ static bool trace_safe_str(struct trace_iterator *iter, const char *str, - return false; - } - --static const char *show_buffer(struct trace_seq *s) --{ -- struct seq_buf *seq = &s->seq; -- -- seq_buf_terminate(seq); -- -- return seq->buffer; --} -- --static DEFINE_STATIC_KEY_FALSE(trace_no_verify); -- --static int test_can_verify_check(const char *fmt, ...) --{ -- char buf[16]; -- va_list ap; -- int ret; -- -- /* -- * The verifier is dependent on vsnprintf() modifies the va_list -- * passed to it, where it is sent as a reference. Some architectures -- * (like x86_32) passes it by value, which means that vsnprintf() -- * does not modify the va_list passed to it, and the verifier -- * would then need to be able to understand all the values that -- * vsnprintf can use. If it is passed by value, then the verifier -- * is disabled. -- */ -- va_start(ap, fmt); -- vsnprintf(buf, 16, "%d", ap); -- ret = va_arg(ap, int); -- va_end(ap); -- -- return ret; --} -- --static void test_can_verify(void) --{ -- if (!test_can_verify_check("%d %d", 0, 1)) { -- pr_info("trace event string verifier disabled\n"); -- static_branch_inc(&trace_no_verify); -- } --} -- - /** -- * trace_check_vprintf - Check dereferenced strings while writing to the seq buffer -+ * ignore_event - Check dereferenced fields while writing to the seq buffer - * @iter: The iterator that holds the seq buffer and the event being printed -- * @fmt: The format used to print the event -- * @ap: The va_list holding the data to print from @fmt. - * -- * This writes the data into the @iter->seq buffer using the data from -- * @fmt and @ap. If the format has a %s, then the source of the string -- * is examined to make sure it is safe to print, otherwise it will -- * warn and print "[UNSAFE MEMORY]" in place of the dereferenced string -- * pointer. -+ * At boot up, test_event_printk() will flag any event that dereferences -+ * a string with "%s" that does exist in the ring buffer. It may still -+ * be valid, as the string may point to a static string in the kernel -+ * rodata that never gets freed. But if the string pointer is pointing -+ * to something that was allocated, there's a chance that it can be freed -+ * by the time the user reads the trace. This would cause a bad memory -+ * access by the kernel and possibly crash the system. -+ * -+ * This function will check if the event has any fields flagged as needing -+ * to be checked at runtime and perform those checks. -+ * -+ * If it is found that a field is unsafe, it will write into the @iter->seq -+ * a message stating what was found to be unsafe. -+ * -+ * @return: true if the event is unsafe and should be ignored, -+ * false otherwise. - */ --void trace_check_vprintf(struct trace_iterator *iter, const char *fmt, -- va_list ap) -+bool ignore_event(struct trace_iterator *iter) - { -- const char *p = fmt; -- const char *str; -- int i, j; -+ struct ftrace_event_field *field; -+ struct trace_event *trace_event; -+ struct trace_event_call *event; -+ struct list_head *head; -+ struct trace_seq *seq; -+ const void *ptr; - -- if (WARN_ON_ONCE(!fmt)) -- return; -+ trace_event = ftrace_find_event(iter->ent->type); - -- if (static_branch_unlikely(&trace_no_verify)) -- goto print; -+ seq = &iter->seq; - -- /* Don't bother checking when doing a ftrace_dump() */ -- if (iter->fmt == static_fmt_buf) -- goto print; -+ if (!trace_event) { -+ trace_seq_printf(seq, "EVENT ID %d NOT FOUND?\n", iter->ent->type); -+ return true; -+ } - -- while (*p) { -- bool star = false; -- int len = 0; -- -- j = 0; -- -- /* We only care about %s and variants */ -- for (i = 0; p[i]; i++) { -- if (i + 1 >= iter->fmt_size) { -- /* -- * If we can't expand the copy buffer, -- * just print it. -- */ -- if (!trace_iter_expand_format(iter)) -- goto print; -- } -+ event = container_of(trace_event, struct trace_event_call, event); -+ if (!(event->flags & TRACE_EVENT_FL_TEST_STR)) -+ return false; - -- if (p[i] == '\\' && p[i+1]) { -- i++; -- continue; -- } -- if (p[i] == '%') { -- /* Need to test cases like %08.*s */ -- for (j = 1; p[i+j]; j++) { -- if (isdigit(p[i+j]) || -- p[i+j] == '.') -- continue; -- if (p[i+j] == '*') { -- star = true; -- continue; -- } -- break; -- } -- if (p[i+j] == 's') -- break; -- star = false; -- } -- j = 0; -- } -- /* If no %s found then just print normally */ -- if (!p[i]) -- break; -+ head = trace_get_fields(event); -+ if (!head) { -+ trace_seq_printf(seq, "FIELDS FOR EVENT '%s' NOT FOUND?\n", -+ trace_event_name(event)); -+ return true; -+ } - -- /* Copy up to the %s, and print that */ -- strncpy(iter->fmt, p, i); -- iter->fmt[i] = '\0'; -- trace_seq_vprintf(&iter->seq, iter->fmt, ap); -+ /* Offsets are from the iter->ent that points to the raw event */ -+ ptr = iter->ent; - -- /* -- * If iter->seq is full, the above call no longer guarantees -- * that ap is in sync with fmt processing, and further calls -- * to va_arg() can return wrong positional arguments. -- * -- * Ensure that ap is no longer used in this case. -- */ -- if (iter->seq.full) { -- p = ""; -- break; -- } -+ list_for_each_entry(field, head, link) { -+ const char *str; -+ bool good; -+ -+ if (!field->needs_test) -+ continue; - -- if (star) -- len = va_arg(ap, int); -+ str = *(const char **)(ptr + field->offset); - -- /* The ap now points to the string data of the %s */ -- str = va_arg(ap, const char *); -+ good = trace_safe_str(iter, str); - - /* - * If you hit this warning, it is likely that the -@@ -3956,45 +3878,14 @@ void trace_check_vprintf(struct trace_iterator *iter, const char *fmt, - * instead. See samples/trace_events/trace-events-sample.h - * for reference. - */ -- if (WARN_ONCE(!trace_safe_str(iter, str, star, len), -- "fmt: '%s' current_buffer: '%s'", -- fmt, show_buffer(&iter->seq))) { -- int ret; -- -- /* Try to safely read the string */ -- if (star) { -- if (len + 1 > iter->fmt_size) -- len = iter->fmt_size - 1; -- if (len < 0) -- len = 0; -- ret = copy_from_kernel_nofault(iter->fmt, str, len); -- iter->fmt[len] = 0; -- star = false; -- } else { -- ret = strncpy_from_kernel_nofault(iter->fmt, str, -- iter->fmt_size); -- } -- if (ret < 0) -- trace_seq_printf(&iter->seq, "(0x%px)", str); -- else -- trace_seq_printf(&iter->seq, "(0x%px:%s)", -- str, iter->fmt); -- str = "[UNSAFE-MEMORY]"; -- strcpy(iter->fmt, "%s"); -- } else { -- strncpy(iter->fmt, p + i, j + 1); -- iter->fmt[j+1] = '\0'; -+ if (WARN_ONCE(!good, "event '%s' has unsafe pointer field '%s'", -+ trace_event_name(event), field->name)) { -+ trace_seq_printf(seq, "EVENT %s: HAS UNSAFE POINTER FIELD '%s'\n", -+ trace_event_name(event), field->name); -+ return true; - } -- if (star) -- trace_seq_printf(&iter->seq, iter->fmt, len, str); -- else -- trace_seq_printf(&iter->seq, iter->fmt, str); -- -- p += i + j + 1; - } -- print: -- if (*p) -- trace_seq_vprintf(&iter->seq, p, ap); -+ return false; - } - - const char *trace_event_format(struct trace_iterator *iter, const char *fmt) -@@ -7011,7 +6902,7 @@ tracing_read_pipe(struct file *filp, char __user *ubuf, - - /* Now copy what we have to the user */ - sret = trace_seq_to_user(&iter->seq, ubuf, cnt); -- if (iter->seq.seq.readpos >= trace_seq_used(&iter->seq)) -+ if (iter->seq.readpos >= trace_seq_used(&iter->seq)) - trace_seq_init(&iter->seq); - - /* -@@ -10539,8 +10430,6 @@ __init static int tracer_alloc_buffers(void) - - register_snapshot_cmd(); - -- test_can_verify(); -- - return 0; - - out_free_pipe_cpumask: -diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h -index 3db42bae73f8e0..e45756f1ac2b12 100644 ---- a/kernel/trace/trace.h -+++ b/kernel/trace/trace.h -@@ -644,9 +644,8 @@ void trace_buffer_unlock_commit_nostack(struct trace_buffer *buffer, - - bool trace_is_tracepoint_string(const char *str); - const char *trace_event_format(struct trace_iterator *iter, const char *fmt); --void trace_check_vprintf(struct trace_iterator *iter, const char *fmt, -- va_list ap) __printf(2, 0); - char *trace_iter_expand_format(struct trace_iterator *iter); -+bool ignore_event(struct trace_iterator *iter); - - int trace_empty(struct trace_iterator *iter); - -@@ -1323,7 +1322,8 @@ struct ftrace_event_field { - int filter_type; - int offset; - int size; -- int is_signed; -+ unsigned int is_signed:1; -+ unsigned int needs_test:1; - int len; - }; - -diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c -index 64cd856308e77c..9d22745cdea5aa 100644 ---- a/kernel/trace/trace_events.c -+++ b/kernel/trace/trace_events.c -@@ -82,7 +82,7 @@ static int system_refcount_dec(struct event_subsystem *system) - } - - static struct ftrace_event_field * --__find_event_field(struct list_head *head, char *name) -+__find_event_field(struct list_head *head, const char *name) - { - struct ftrace_event_field *field; - -@@ -114,7 +114,8 @@ trace_find_event_field(struct trace_event_call *call, char *name) - - static int __trace_define_field(struct list_head *head, const char *type, - const char *name, int offset, int size, -- int is_signed, int filter_type, int len) -+ int is_signed, int filter_type, int len, -+ int need_test) - { - struct ftrace_event_field *field; - -@@ -133,6 +134,7 @@ static int __trace_define_field(struct list_head *head, const char *type, - field->offset = offset; - field->size = size; - field->is_signed = is_signed; -+ field->needs_test = need_test; - field->len = len; - - list_add(&field->link, head); -@@ -151,13 +153,13 @@ int trace_define_field(struct trace_event_call *call, const char *type, - - head = trace_get_fields(call); - return __trace_define_field(head, type, name, offset, size, -- is_signed, filter_type, 0); -+ is_signed, filter_type, 0, 0); - } - EXPORT_SYMBOL_GPL(trace_define_field); - - static int trace_define_field_ext(struct trace_event_call *call, const char *type, - const char *name, int offset, int size, int is_signed, -- int filter_type, int len) -+ int filter_type, int len, int need_test) - { - struct list_head *head; - -@@ -166,13 +168,13 @@ static int trace_define_field_ext(struct trace_event_call *call, const char *typ - - head = trace_get_fields(call); - return __trace_define_field(head, type, name, offset, size, -- is_signed, filter_type, len); -+ is_signed, filter_type, len, need_test); - } - - #define __generic_field(type, item, filter_type) \ - ret = __trace_define_field(&ftrace_generic_fields, #type, \ - #item, 0, 0, is_signed_type(type), \ -- filter_type, 0); \ -+ filter_type, 0, 0); \ - if (ret) \ - return ret; - -@@ -181,7 +183,8 @@ static int trace_define_field_ext(struct trace_event_call *call, const char *typ - "common_" #item, \ - offsetof(typeof(ent), item), \ - sizeof(ent.item), \ -- is_signed_type(type), FILTER_OTHER, 0); \ -+ is_signed_type(type), FILTER_OTHER, \ -+ 0, 0); \ - if (ret) \ - return ret; - -@@ -332,6 +335,7 @@ static bool process_pointer(const char *fmt, int len, struct trace_event_call *c - /* Return true if the string is safe */ - static bool process_string(const char *fmt, int len, struct trace_event_call *call) - { -+ struct trace_event_fields *field; - const char *r, *e, *s; - - e = fmt + len; -@@ -360,6 +364,18 @@ static bool process_string(const char *fmt, int len, struct trace_event_call *ca - s = r + 1; - } while (s < e); - -+ /* -+ * Check for arrays. If the argument has: foo[REC->val] -+ * then it is very likely that foo is an array of strings -+ * that are safe to use. -+ */ -+ r = strstr(s, "["); -+ if (r && r < e) { -+ r = strstr(r, "REC->"); -+ if (r && r < e) -+ return true; -+ } -+ - /* - * If there's any strings in the argument consider this arg OK as it - * could be: REC->field ? "foo" : "bar" and we don't want to get into -@@ -372,8 +388,16 @@ static bool process_string(const char *fmt, int len, struct trace_event_call *ca - if (process_pointer(fmt, len, call)) - return true; - -- /* Make sure the field is found, and consider it OK for now if it is */ -- return find_event_field(fmt, call) != NULL; -+ /* Make sure the field is found */ -+ field = find_event_field(fmt, call); -+ if (!field) -+ return false; -+ -+ /* Test this field's string before printing the event */ -+ call->flags |= TRACE_EVENT_FL_TEST_STR; -+ field->needs_test = 1; -+ -+ return true; - } - - /* -@@ -2552,7 +2576,7 @@ event_define_fields(struct trace_event_call *call) - ret = trace_define_field_ext(call, field->type, field->name, - offset, field->size, - field->is_signed, field->filter_type, -- field->len); -+ field->len, field->needs_test); - if (WARN_ON_ONCE(ret)) { - pr_err("error code is %d\n", ret); - break; -diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c -index db575094c49825..2b948d35fb59ea 100644 ---- a/kernel/trace/trace_output.c -+++ b/kernel/trace/trace_output.c -@@ -317,10 +317,14 @@ EXPORT_SYMBOL(trace_raw_output_prep); - - void trace_event_printf(struct trace_iterator *iter, const char *fmt, ...) - { -+ struct trace_seq *s = &iter->seq; - va_list ap; - -+ if (ignore_event(iter)) -+ return; -+ - va_start(ap, fmt); -- trace_check_vprintf(iter, trace_event_format(iter, fmt), ap); -+ trace_seq_vprintf(s, trace_event_format(iter, fmt), ap); - va_end(ap); - } - EXPORT_SYMBOL(trace_event_printf); -diff --git a/kernel/trace/trace_seq.c b/kernel/trace/trace_seq.c -index bac06ee3b98b81..7be97229ddf860 100644 ---- a/kernel/trace/trace_seq.c -+++ b/kernel/trace/trace_seq.c -@@ -370,8 +370,12 @@ EXPORT_SYMBOL_GPL(trace_seq_path); - */ - int trace_seq_to_user(struct trace_seq *s, char __user *ubuf, int cnt) - { -+ int ret; - __trace_seq_init(s); -- return seq_buf_to_user(&s->seq, ubuf, cnt); -+ ret = seq_buf_to_user(&s->seq, ubuf, s->readpos, cnt); -+ if (ret > 0) -+ s->readpos += ret; -+ return ret; - } - EXPORT_SYMBOL_GPL(trace_seq_to_user); - -diff --git a/lib/seq_buf.c b/lib/seq_buf.c -index 45c450f423fa87..23518f77ea9c53 100644 ---- a/lib/seq_buf.c -+++ b/lib/seq_buf.c -@@ -109,9 +109,7 @@ void seq_buf_do_printk(struct seq_buf *s, const char *lvl) - if (s->size == 0 || s->len == 0) - return; - -- seq_buf_terminate(s); -- -- start = s->buffer; -+ start = seq_buf_str(s); - while ((lf = strchr(start, '\n'))) { - int len = lf - start + 1; - -@@ -324,23 +322,24 @@ int seq_buf_path(struct seq_buf *s, const struct path *path, const char *esc) - * seq_buf_to_user - copy the sequence buffer to user space - * @s: seq_buf descriptor - * @ubuf: The userspace memory location to copy to -+ * @start: The first byte in the buffer to copy - * @cnt: The amount to copy - * - * Copies the sequence buffer into the userspace memory pointed to -- * by @ubuf. It starts from the last read position (@s->readpos) -- * and writes up to @cnt characters or till it reaches the end of -- * the content in the buffer (@s->len), which ever comes first. -+ * by @ubuf. It starts from @start and writes up to @cnt characters -+ * or until it reaches the end of the content in the buffer (@s->len), -+ * whichever comes first. - * - * On success, it returns a positive number of the number of bytes - * it copied. - * - * On failure it returns -EBUSY if all of the content in the - * sequence has been already read, which includes nothing in the -- * sequence (@s->len == @s->readpos). -+ * sequence (@s->len == @start). - * - * Returns -EFAULT if the copy to userspace fails. - */ --int seq_buf_to_user(struct seq_buf *s, char __user *ubuf, int cnt) -+int seq_buf_to_user(struct seq_buf *s, char __user *ubuf, size_t start, int cnt) - { - int len; - int ret; -@@ -350,20 +349,17 @@ int seq_buf_to_user(struct seq_buf *s, char __user *ubuf, int cnt) - - len = seq_buf_used(s); - -- if (len <= s->readpos) -+ if (len <= start) - return -EBUSY; - -- len -= s->readpos; -+ len -= start; - if (cnt > len) - cnt = len; -- ret = copy_to_user(ubuf, s->buffer + s->readpos, cnt); -+ ret = copy_to_user(ubuf, s->buffer + start, cnt); - if (ret == cnt) - return -EFAULT; - -- cnt -= ret; -- -- s->readpos += cnt; -- return cnt; -+ return cnt - ret; - } - - /** -diff --git a/mm/kmemleak.c b/mm/kmemleak.c -index 54c2c90d3abc9d..5811a11cc53a6d 100644 ---- a/mm/kmemleak.c -+++ b/mm/kmemleak.c -@@ -368,7 +368,7 @@ static void print_unreferenced(struct seq_file *seq, - - for (i = 0; i < nr_entries; i++) { - void *ptr = (void *)entries[i]; -- warn_or_seq_printf(seq, " [<%pK>] %pS\n", ptr, ptr); -+ warn_or_seq_printf(seq, " %pS\n", ptr); - } - } - -diff --git a/mm/memblock.c b/mm/memblock.c -index d630f5c2bdb90e..87a2b4340ce4ea 100644 ---- a/mm/memblock.c -+++ b/mm/memblock.c -@@ -735,6 +735,40 @@ int __init_memblock memblock_add(phys_addr_t base, phys_addr_t size) - return memblock_add_range(&memblock.memory, base, size, MAX_NUMNODES, 0); - } - -+/** -+ * memblock_validate_numa_coverage - check if amount of memory with -+ * no node ID assigned is less than a threshold -+ * @threshold_bytes: maximal memory size that can have unassigned node -+ * ID (in bytes). -+ * -+ * A buggy firmware may report memory that does not belong to any node. -+ * Check if amount of such memory is below @threshold_bytes. -+ * -+ * Return: true on success, false on failure. -+ */ -+bool __init_memblock memblock_validate_numa_coverage(unsigned long threshold_bytes) -+{ -+ unsigned long nr_pages = 0; -+ unsigned long start_pfn, end_pfn, mem_size_mb; -+ int nid, i; -+ -+ /* calculate lose page */ -+ for_each_mem_pfn_range(i, MAX_NUMNODES, &start_pfn, &end_pfn, &nid) { -+ if (nid == NUMA_NO_NODE) -+ nr_pages += end_pfn - start_pfn; -+ } -+ -+ if ((nr_pages << PAGE_SHIFT) > threshold_bytes) { -+ mem_size_mb = memblock_phys_mem_size() >> 20; -+ pr_err("NUMA: no nodes coverage for %luMB of %luMB RAM\n", -+ (nr_pages << PAGE_SHIFT) >> 20, mem_size_mb); -+ return false; -+ } -+ -+ return true; -+} -+ -+ - /** - * memblock_isolate_range - isolate given range into disjoint memblocks - * @type: memblock type to isolate range for -diff --git a/mm/readahead.c b/mm/readahead.c -index e9b11d928b0c48..f1595c032ce7e3 100644 ---- a/mm/readahead.c -+++ b/mm/readahead.c -@@ -580,7 +580,11 @@ static void ondemand_readahead(struct readahead_control *ractl, - 1UL << order); - if (index == expected || index == (ra->start + ra->size)) { - ra->start += ra->size; -- ra->size = get_next_ra_size(ra, max_pages); -+ /* -+ * In the case of MADV_HUGEPAGE, the actual size might exceed -+ * the readahead window. -+ */ -+ ra->size = max(ra->size, get_next_ra_size(ra, max_pages)); - ra->async_size = ra->size; - goto readit; - } -diff --git a/mm/vmscan.c b/mm/vmscan.c -index 3c91b86d59e935..49456b72575529 100644 ---- a/mm/vmscan.c -+++ b/mm/vmscan.c -@@ -641,7 +641,14 @@ unsigned long zone_reclaimable_pages(struct zone *zone) - if (can_reclaim_anon_pages(NULL, zone_to_nid(zone), NULL)) - nr += zone_page_state_snapshot(zone, NR_ZONE_INACTIVE_ANON) + - zone_page_state_snapshot(zone, NR_ZONE_ACTIVE_ANON); -- -+ /* -+ * If there are no reclaimable file-backed or anonymous pages, -+ * ensure zones with sufficient free pages are not skipped. -+ * This prevents zones like DMA32 from being ignored in reclaim -+ * scenarios where they can still help alleviate memory pressure. -+ */ -+ if (nr == 0) -+ nr = zone_page_state_snapshot(zone, NR_FREE_PAGES); - return nr; - } - -diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c -index 6178ae8feafc0f..549ee9e87d6366 100644 ---- a/net/bluetooth/hci_conn.c -+++ b/net/bluetooth/hci_conn.c -@@ -2178,13 +2178,9 @@ struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst, - conn->iso_qos.bcast.big); - if (parent && parent != conn) { - link = hci_conn_link(parent, conn); -- if (!link) { -- hci_conn_drop(conn); -- return ERR_PTR(-ENOLINK); -- } -- -- /* Link takes the refcount */ - hci_conn_drop(conn); -+ if (!link) -+ return ERR_PTR(-ENOLINK); - } - - return conn; -@@ -2274,15 +2270,12 @@ struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst, - } - - link = hci_conn_link(le, cis); -+ hci_conn_drop(cis); - if (!link) { - hci_conn_drop(le); -- hci_conn_drop(cis); - return ERR_PTR(-ENOLINK); - } - -- /* Link takes the refcount */ -- hci_conn_drop(cis); -- - cis->state = BT_CONNECT; - - hci_le_create_cis_pending(hdev); -diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c -index 30519d47e8a695..f29fd326440115 100644 ---- a/net/bluetooth/hci_core.c -+++ b/net/bluetooth/hci_core.c -@@ -58,7 +58,6 @@ DEFINE_RWLOCK(hci_dev_list_lock); - - /* HCI callback list */ - LIST_HEAD(hci_cb_list); --DEFINE_MUTEX(hci_cb_list_lock); - - /* HCI ID Numbering */ - static DEFINE_IDA(hci_index_ida); -@@ -2957,9 +2956,7 @@ int hci_register_cb(struct hci_cb *cb) - { - BT_DBG("%p name %s", cb, cb->name); - -- mutex_lock(&hci_cb_list_lock); -- list_add_tail(&cb->list, &hci_cb_list); -- mutex_unlock(&hci_cb_list_lock); -+ list_add_tail_rcu(&cb->list, &hci_cb_list); - - return 0; - } -@@ -2969,9 +2966,8 @@ int hci_unregister_cb(struct hci_cb *cb) - { - BT_DBG("%p name %s", cb, cb->name); - -- mutex_lock(&hci_cb_list_lock); -- list_del(&cb->list); -- mutex_unlock(&hci_cb_list_lock); -+ list_del_rcu(&cb->list); -+ synchronize_rcu(); - - return 0; - } -diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c -index b94d202bf3745c..f165cafa3aa98b 100644 ---- a/net/bluetooth/iso.c -+++ b/net/bluetooth/iso.c -@@ -1929,6 +1929,11 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags) - return lm; - } - -+static bool iso_match(struct hci_conn *hcon) -+{ -+ return hcon->type == ISO_LINK || hcon->type == LE_LINK; -+} -+ - static void iso_connect_cfm(struct hci_conn *hcon, __u8 status) - { - if (hcon->type != ISO_LINK) { -@@ -2110,6 +2115,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) - - static struct hci_cb iso_cb = { - .name = "ISO", -+ .match = iso_match, - .connect_cfm = iso_connect_cfm, - .disconn_cfm = iso_disconn_cfm, - }; -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index 93651c421767a0..acb148759bd049 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -7223,6 +7223,11 @@ static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c, - return NULL; - } - -+static bool l2cap_match(struct hci_conn *hcon) -+{ -+ return hcon->type == ACL_LINK || hcon->type == LE_LINK; -+} -+ - static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status) - { - struct hci_dev *hdev = hcon->hdev; -@@ -7230,9 +7235,6 @@ static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status) - struct l2cap_chan *pchan; - u8 dst_type; - -- if (hcon->type != ACL_LINK && hcon->type != LE_LINK) -- return; -- - BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status); - - if (status) { -@@ -7297,9 +7299,6 @@ int l2cap_disconn_ind(struct hci_conn *hcon) - - static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason) - { -- if (hcon->type != ACL_LINK && hcon->type != LE_LINK) -- return; -- - BT_DBG("hcon %p reason %d", hcon, reason); - - l2cap_conn_del(hcon, bt_to_errno(reason)); -@@ -7578,6 +7577,7 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) - - static struct hci_cb l2cap_cb = { - .name = "L2CAP", -+ .match = l2cap_match, - .connect_cfm = l2cap_connect_cfm, - .disconn_cfm = l2cap_disconn_cfm, - .security_cfm = l2cap_security_cfm, -diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c -index 1d34d849703329..9d46afb24caf07 100644 ---- a/net/bluetooth/rfcomm/core.c -+++ b/net/bluetooth/rfcomm/core.c -@@ -2134,6 +2134,11 @@ static int rfcomm_run(void *unused) - return 0; - } - -+static bool rfcomm_match(struct hci_conn *hcon) -+{ -+ return hcon->type == ACL_LINK; -+} -+ - static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt) - { - struct rfcomm_session *s; -@@ -2180,6 +2185,7 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt) - - static struct hci_cb rfcomm_cb = { - .name = "RFCOMM", -+ .match = rfcomm_match, - .security_cfm = rfcomm_security_cfm - }; - -diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c -index 64d4d57c7033a3..c4c36ff25fb202 100644 ---- a/net/bluetooth/sco.c -+++ b/net/bluetooth/sco.c -@@ -1353,11 +1353,13 @@ int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags) - return lm; - } - --static void sco_connect_cfm(struct hci_conn *hcon, __u8 status) -+static bool sco_match(struct hci_conn *hcon) - { -- if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK) -- return; -+ return hcon->type == SCO_LINK || hcon->type == ESCO_LINK; -+} - -+static void sco_connect_cfm(struct hci_conn *hcon, __u8 status) -+{ - BT_DBG("hcon %p bdaddr %pMR status %u", hcon, &hcon->dst, status); - - if (!status) { -@@ -1372,9 +1374,6 @@ static void sco_connect_cfm(struct hci_conn *hcon, __u8 status) - - static void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason) - { -- if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK) -- return; -- - BT_DBG("hcon %p reason %d", hcon, reason); - - sco_conn_del(hcon, bt_to_errno(reason)); -@@ -1400,6 +1399,7 @@ void sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb) - - static struct hci_cb sco_cb = { - .name = "SCO", -+ .match = sco_match, - .connect_cfm = sco_connect_cfm, - .disconn_cfm = sco_disconn_cfm, - }; -diff --git a/net/core/dev.c b/net/core/dev.c -index 4beb9acf2c1839..69da7b009f8b98 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -3628,8 +3628,10 @@ int skb_csum_hwoffload_help(struct sk_buff *skb, - - if (features & (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM)) { - if (vlan_get_protocol(skb) == htons(ETH_P_IPV6) && -- skb_network_header_len(skb) != sizeof(struct ipv6hdr)) -+ skb_network_header_len(skb) != sizeof(struct ipv6hdr) && -+ !ipv6_has_hopopt_jumbo(skb)) - goto sw_checksum; -+ - switch (skb->csum_offset) { - case offsetof(struct tcphdr, check): - case offsetof(struct udphdr, check): -diff --git a/net/core/sock.c b/net/core/sock.c -index bc2a4e38dcea8e..84ba3f67bca97b 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -1133,7 +1133,10 @@ int sk_setsockopt(struct sock *sk, int level, int optname, - sk->sk_reuse = (valbool ? SK_CAN_REUSE : SK_NO_REUSE); - break; - case SO_REUSEPORT: -- sk->sk_reuseport = valbool; -+ if (valbool && !sk_is_inet(sk)) -+ ret = -EOPNOTSUPP; -+ else -+ sk->sk_reuseport = valbool; - break; - case SO_TYPE: - case SO_PROTOCOL: -diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c -index 72b2d68ef4da5f..dd1803bf9c5c63 100644 ---- a/net/ipv4/ip_tunnel.c -+++ b/net/ipv4/ip_tunnel.c -@@ -43,6 +43,7 @@ - #include - #include - #include -+#include - - #if IS_ENABLED(CONFIG_IPV6) - #include -@@ -102,10 +103,9 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn, - if (!ip_tunnel_key_match(&t->parms, flags, key)) - continue; - -- if (t->parms.link == link) -+ if (READ_ONCE(t->parms.link) == link) - return t; -- else -- cand = t; -+ cand = t; - } - - hlist_for_each_entry_rcu(t, head, hash_node) { -@@ -117,9 +117,9 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn, - if (!ip_tunnel_key_match(&t->parms, flags, key)) - continue; - -- if (t->parms.link == link) -+ if (READ_ONCE(t->parms.link) == link) - return t; -- else if (!cand) -+ if (!cand) - cand = t; - } - -@@ -137,9 +137,9 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn, - if (!ip_tunnel_key_match(&t->parms, flags, key)) - continue; - -- if (t->parms.link == link) -+ if (READ_ONCE(t->parms.link) == link) - return t; -- else if (!cand) -+ if (!cand) - cand = t; - } - -@@ -150,9 +150,9 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn, - !(t->dev->flags & IFF_UP)) - continue; - -- if (t->parms.link == link) -+ if (READ_ONCE(t->parms.link) == link) - return t; -- else if (!cand) -+ if (!cand) - cand = t; - } - -@@ -221,7 +221,7 @@ static struct ip_tunnel *ip_tunnel_find(struct ip_tunnel_net *itn, - hlist_for_each_entry_rcu(t, head, hash_node) { - if (local == t->parms.iph.saddr && - remote == t->parms.iph.daddr && -- link == t->parms.link && -+ link == READ_ONCE(t->parms.link) && - type == t->dev->type && - ip_tunnel_key_match(&t->parms, flags, key)) - break; -@@ -294,7 +294,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev) - - ip_tunnel_init_flow(&fl4, iph->protocol, iph->daddr, - iph->saddr, tunnel->parms.o_key, -- RT_TOS(iph->tos), dev_net(dev), -+ iph->tos & INET_DSCP_MASK, tunnel->net, - tunnel->parms.link, tunnel->fwmark, 0, 0); - rt = ip_route_output_key(tunnel->net, &fl4); - -@@ -610,9 +610,9 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, - tos = ipv6_get_dsfield((const struct ipv6hdr *)inner_iph); - } - ip_tunnel_init_flow(&fl4, proto, key->u.ipv4.dst, key->u.ipv4.src, -- tunnel_id_to_key32(key->tun_id), RT_TOS(tos), -- dev_net(dev), 0, skb->mark, skb_get_hash(skb), -- key->flow_flags); -+ tunnel_id_to_key32(key->tun_id), -+ tos & INET_DSCP_MASK, tunnel->net, 0, skb->mark, -+ skb_get_hash(skb), key->flow_flags); - - if (!tunnel_hlen) - tunnel_hlen = ip_encap_hlen(&tun_info->encap); -@@ -773,8 +773,8 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, - } - - ip_tunnel_init_flow(&fl4, protocol, dst, tnl_params->saddr, -- tunnel->parms.o_key, RT_TOS(tos), -- dev_net(dev), tunnel->parms.link, -+ tunnel->parms.o_key, tos & INET_DSCP_MASK, -+ tunnel->net, READ_ONCE(tunnel->parms.link), - tunnel->fwmark, skb_get_hash(skb), 0); - - if (ip_tunnel_encap(skb, &tunnel->encap, &protocol, &fl4) < 0) -@@ -894,7 +894,7 @@ static void ip_tunnel_update(struct ip_tunnel_net *itn, - if (t->parms.link != p->link || t->fwmark != fwmark) { - int mtu; - -- t->parms.link = p->link; -+ WRITE_ONCE(t->parms.link, p->link); - t->fwmark = fwmark; - mtu = ip_tunnel_bind_dev(dev); - if (set_mtu) -@@ -1084,9 +1084,9 @@ EXPORT_SYMBOL(ip_tunnel_get_link_net); - - int ip_tunnel_get_iflink(const struct net_device *dev) - { -- struct ip_tunnel *tunnel = netdev_priv(dev); -+ const struct ip_tunnel *tunnel = netdev_priv(dev); - -- return tunnel->parms.link; -+ return READ_ONCE(tunnel->parms.link); - } - EXPORT_SYMBOL(ip_tunnel_get_iflink); - -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index fb053942dba2a1..f6a213bae5cccb 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -7192,6 +7192,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, - if (unlikely(!inet_csk_reqsk_queue_hash_add(sk, req, - req->timeout))) { - reqsk_free(req); -+ dst_release(dst); - return 0; - } - -diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c -index 534a4498e280d7..fff09f5a796a75 100644 ---- a/net/ipv6/ila/ila_xlat.c -+++ b/net/ipv6/ila/ila_xlat.c -@@ -200,6 +200,8 @@ static const struct nf_hook_ops ila_nf_hook_ops[] = { - }, - }; - -+static DEFINE_MUTEX(ila_mutex); -+ - static int ila_add_mapping(struct net *net, struct ila_xlat_params *xp) - { - struct ila_net *ilan = net_generic(net, ila_net_id); -@@ -207,16 +209,20 @@ static int ila_add_mapping(struct net *net, struct ila_xlat_params *xp) - spinlock_t *lock = ila_get_lock(ilan, xp->ip.locator_match); - int err = 0, order; - -- if (!ilan->xlat.hooks_registered) { -+ if (!READ_ONCE(ilan->xlat.hooks_registered)) { - /* We defer registering net hooks in the namespace until the - * first mapping is added. - */ -- err = nf_register_net_hooks(net, ila_nf_hook_ops, -- ARRAY_SIZE(ila_nf_hook_ops)); -+ mutex_lock(&ila_mutex); -+ if (!ilan->xlat.hooks_registered) { -+ err = nf_register_net_hooks(net, ila_nf_hook_ops, -+ ARRAY_SIZE(ila_nf_hook_ops)); -+ if (!err) -+ WRITE_ONCE(ilan->xlat.hooks_registered, true); -+ } -+ mutex_unlock(&ila_mutex); - if (err) - return err; -- -- ilan->xlat.hooks_registered = true; - } - - ila = kzalloc(sizeof(*ila), GFP_KERNEL); -diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c -index 51bccfb00a9cd9..61b0159b2fbee6 100644 ---- a/net/llc/llc_input.c -+++ b/net/llc/llc_input.c -@@ -124,8 +124,8 @@ static inline int llc_fixup_skb(struct sk_buff *skb) - if (unlikely(!pskb_may_pull(skb, llc_len))) - return 0; - -- skb->transport_header += llc_len; - skb_pull(skb, llc_len); -+ skb_reset_transport_header(skb); - if (skb->protocol == htons(ETH_P_802_2)) { - __be16 pdulen; - s32 data_size; -diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h -index daea061d0fc136..04c876d78d3bf0 100644 ---- a/net/mac80211/ieee80211_i.h -+++ b/net/mac80211/ieee80211_i.h -@@ -2057,8 +2057,6 @@ void __ieee80211_subif_start_xmit(struct sk_buff *skb, - u32 info_flags, - u32 ctrl_flags, - u64 *cookie); --void ieee80211_purge_tx_queue(struct ieee80211_hw *hw, -- struct sk_buff_head *skbs); - struct sk_buff * - ieee80211_build_data_template(struct ieee80211_sub_if_data *sdata, - struct sk_buff *skb, u32 info_flags); -diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c -index 25223184d6e5b0..a5e7edd2f2d137 100644 ---- a/net/mac80211/mesh.c -+++ b/net/mac80211/mesh.c -@@ -1173,14 +1173,14 @@ void ieee80211_mbss_info_change_notify(struct ieee80211_sub_if_data *sdata, - u64 changed) - { - struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; -- unsigned long bits = changed; -+ unsigned long bits[] = { BITMAP_FROM_U64(changed) }; - u32 bit; - -- if (!bits) -+ if (!changed) - return; - - /* if we race with running work, worst case this work becomes a noop */ -- for_each_set_bit(bit, &bits, sizeof(changed) * BITS_PER_BYTE) -+ for_each_set_bit(bit, bits, sizeof(changed) * BITS_PER_BYTE) - set_bit(bit, ifmsh->mbss_changed); - set_bit(MESH_WORK_MBSS_CHANGED, &ifmsh->wrkq_flags); - wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work); -diff --git a/net/mac80211/status.c b/net/mac80211/status.c -index 44d83da60aee44..9676ed15efecc8 100644 ---- a/net/mac80211/status.c -+++ b/net/mac80211/status.c -@@ -1270,3 +1270,4 @@ void ieee80211_purge_tx_queue(struct ieee80211_hw *hw, - while ((skb = __skb_dequeue(skbs))) - ieee80211_free_txskb(hw, skb); - } -+EXPORT_SYMBOL(ieee80211_purge_tx_queue); -diff --git a/net/mac80211/util.c b/net/mac80211/util.c -index d682c32821a110..154b41af4157d0 100644 ---- a/net/mac80211/util.c -+++ b/net/mac80211/util.c -@@ -827,7 +827,8 @@ static void __iterate_stations(struct ieee80211_local *local, - { - struct sta_info *sta; - -- list_for_each_entry_rcu(sta, &local->sta_list, list) { -+ list_for_each_entry_rcu(sta, &local->sta_list, list, -+ lockdep_is_held(&local->hw.wiphy->mtx)) { - if (!sta->uploaded) - continue; - -@@ -848,6 +849,19 @@ void ieee80211_iterate_stations_atomic(struct ieee80211_hw *hw, - } - EXPORT_SYMBOL_GPL(ieee80211_iterate_stations_atomic); - -+void ieee80211_iterate_stations_mtx(struct ieee80211_hw *hw, -+ void (*iterator)(void *data, -+ struct ieee80211_sta *sta), -+ void *data) -+{ -+ struct ieee80211_local *local = hw_to_local(hw); -+ -+ lockdep_assert_wiphy(local->hw.wiphy); -+ -+ __iterate_stations(local, iterator, data); -+} -+EXPORT_SYMBOL_GPL(ieee80211_iterate_stations_mtx); -+ - struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev) - { - struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev); -@@ -2572,6 +2586,9 @@ int ieee80211_reconfig(struct ieee80211_local *local) - WARN(1, "Hardware became unavailable upon resume. This could be a software issue prior to suspend or a hardware issue.\n"); - else - WARN(1, "Hardware became unavailable during restart.\n"); -+ ieee80211_wake_queues_by_reason(hw, IEEE80211_MAX_QUEUE_MAP, -+ IEEE80211_QUEUE_STOP_REASON_SUSPEND, -+ false); - ieee80211_handle_reconfig_failure(local); - return res; - } -diff --git a/net/mctp/route.c b/net/mctp/route.c -index c6a815df9d358c..d3c1f54386efc1 100644 ---- a/net/mctp/route.c -+++ b/net/mctp/route.c -@@ -334,8 +334,13 @@ static int mctp_route_input(struct mctp_route *route, struct sk_buff *skb) - msk = NULL; - rc = -EINVAL; - -- /* we may be receiving a locally-routed packet; drop source sk -- * accounting -+ /* We may be receiving a locally-routed packet; drop source sk -+ * accounting. -+ * -+ * From here, we will either queue the skb - either to a frag_queue, or -+ * to a receiving socket. When that succeeds, we clear the skb pointer; -+ * a non-NULL skb on exit will be otherwise unowned, and hence -+ * kfree_skb()-ed. - */ - skb_orphan(skb); - -@@ -389,7 +394,9 @@ static int mctp_route_input(struct mctp_route *route, struct sk_buff *skb) - * pending key. - */ - if (flags & MCTP_HDR_FLAG_EOM) { -- sock_queue_rcv_skb(&msk->sk, skb); -+ rc = sock_queue_rcv_skb(&msk->sk, skb); -+ if (!rc) -+ skb = NULL; - if (key) { - /* we've hit a pending reassembly; not much we - * can do but drop it -@@ -398,7 +405,6 @@ static int mctp_route_input(struct mctp_route *route, struct sk_buff *skb) - MCTP_TRACE_KEY_REPLIED); - key = NULL; - } -- rc = 0; - goto out_unlock; - } - -@@ -425,8 +431,10 @@ static int mctp_route_input(struct mctp_route *route, struct sk_buff *skb) - * this function. - */ - rc = mctp_key_add(key, msk); -- if (!rc) -+ if (!rc) { - trace_mctp_key_acquire(key); -+ skb = NULL; -+ } - - /* we don't need to release key->lock on exit, so - * clean up here and suppress the unlock via -@@ -444,6 +452,8 @@ static int mctp_route_input(struct mctp_route *route, struct sk_buff *skb) - key = NULL; - } else { - rc = mctp_frag_queue(key, skb); -+ if (!rc) -+ skb = NULL; - } - } - -@@ -458,12 +468,19 @@ static int mctp_route_input(struct mctp_route *route, struct sk_buff *skb) - else - rc = mctp_frag_queue(key, skb); - -+ if (rc) -+ goto out_unlock; -+ -+ /* we've queued; the queue owns the skb now */ -+ skb = NULL; -+ - /* end of message? deliver to socket, and we're done with - * the reassembly/response key - */ -- if (!rc && flags & MCTP_HDR_FLAG_EOM) { -- sock_queue_rcv_skb(key->sk, key->reasm_head); -- key->reasm_head = NULL; -+ if (flags & MCTP_HDR_FLAG_EOM) { -+ rc = sock_queue_rcv_skb(key->sk, key->reasm_head); -+ if (!rc) -+ key->reasm_head = NULL; - __mctp_key_done_in(key, net, f, MCTP_TRACE_KEY_REPLIED); - key = NULL; - } -@@ -482,8 +499,7 @@ static int mctp_route_input(struct mctp_route *route, struct sk_buff *skb) - if (any_key) - mctp_key_unref(any_key); - out: -- if (rc) -- kfree_skb(skb); -+ kfree_skb(skb); - return rc; - } - -diff --git a/net/mptcp/options.c b/net/mptcp/options.c -index 2ad9006a157aef..2e1539027e6d33 100644 ---- a/net/mptcp/options.c -+++ b/net/mptcp/options.c -@@ -667,8 +667,15 @@ static bool mptcp_established_options_add_addr(struct sock *sk, struct sk_buff * - &echo, &drop_other_suboptions)) - return false; - -+ /* -+ * Later on, mptcp_write_options() will enforce mutually exclusion with -+ * DSS, bail out if such option is set and we can't drop it. -+ */ - if (drop_other_suboptions) - remaining += opt_size; -+ else if (opts->suboptions & OPTION_MPTCP_DSS) -+ return false; -+ - len = mptcp_add_addr_len(opts->addr.family, echo, !!opts->addr.port); - if (remaining < len) - return false; -diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c -index 01f6ce970918c5..07f3a9703312e5 100644 ---- a/net/mptcp/protocol.c -+++ b/net/mptcp/protocol.c -@@ -528,13 +528,13 @@ static void mptcp_send_ack(struct mptcp_sock *msk) - mptcp_subflow_send_ack(mptcp_subflow_tcp_sock(subflow)); - } - --static void mptcp_subflow_cleanup_rbuf(struct sock *ssk) -+static void mptcp_subflow_cleanup_rbuf(struct sock *ssk, int copied) - { - bool slow; - - slow = lock_sock_fast(ssk); - if (tcp_can_send_ack(ssk)) -- tcp_cleanup_rbuf(ssk, 1); -+ tcp_cleanup_rbuf(ssk, copied); - unlock_sock_fast(ssk, slow); - } - -@@ -551,7 +551,7 @@ static bool mptcp_subflow_could_cleanup(const struct sock *ssk, bool rx_empty) - (ICSK_ACK_PUSHED2 | ICSK_ACK_PUSHED))); - } - --static void mptcp_cleanup_rbuf(struct mptcp_sock *msk) -+static void mptcp_cleanup_rbuf(struct mptcp_sock *msk, int copied) - { - int old_space = READ_ONCE(msk->old_wspace); - struct mptcp_subflow_context *subflow; -@@ -559,14 +559,14 @@ static void mptcp_cleanup_rbuf(struct mptcp_sock *msk) - int space = __mptcp_space(sk); - bool cleanup, rx_empty; - -- cleanup = (space > 0) && (space >= (old_space << 1)); -- rx_empty = !__mptcp_rmem(sk); -+ cleanup = (space > 0) && (space >= (old_space << 1)) && copied; -+ rx_empty = !__mptcp_rmem(sk) && copied; - - mptcp_for_each_subflow(msk, subflow) { - struct sock *ssk = mptcp_subflow_tcp_sock(subflow); - - if (cleanup || mptcp_subflow_could_cleanup(ssk, rx_empty)) -- mptcp_subflow_cleanup_rbuf(ssk); -+ mptcp_subflow_cleanup_rbuf(ssk, copied); - } - } - -@@ -1902,6 +1902,8 @@ static int mptcp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) - goto out; - } - -+static void mptcp_rcv_space_adjust(struct mptcp_sock *msk, int copied); -+ - static int __mptcp_recvmsg_mskq(struct mptcp_sock *msk, - struct msghdr *msg, - size_t len, int flags, -@@ -1955,6 +1957,7 @@ static int __mptcp_recvmsg_mskq(struct mptcp_sock *msk, - break; - } - -+ mptcp_rcv_space_adjust(msk, copied); - return copied; - } - -@@ -2180,9 +2183,6 @@ static int mptcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, - - copied += bytes_read; - -- /* be sure to advertise window change */ -- mptcp_cleanup_rbuf(msk); -- - if (skb_queue_empty(&msk->receive_queue) && __mptcp_move_skbs(msk)) - continue; - -@@ -2231,7 +2231,7 @@ static int mptcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, - } - - pr_debug("block timeout %ld\n", timeo); -- mptcp_rcv_space_adjust(msk, copied); -+ mptcp_cleanup_rbuf(msk, copied); - err = sk_wait_data(sk, &timeo, NULL); - if (err < 0) { - err = copied ? : err; -@@ -2239,7 +2239,7 @@ static int mptcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, - } - } - -- mptcp_rcv_space_adjust(msk, copied); -+ mptcp_cleanup_rbuf(msk, copied); - - out_err: - if (cmsg_flags && copied >= 0) { -diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c -index bd2b17b219ae90..0b270893ee14c5 100644 ---- a/net/netrom/nr_route.c -+++ b/net/netrom/nr_route.c -@@ -754,6 +754,12 @@ int nr_route_frame(struct sk_buff *skb, ax25_cb *ax25) - int ret; - struct sk_buff *skbn; - -+ /* -+ * Reject malformed packets early. Check that it contains at least 2 -+ * addresses and 1 byte more for Time-To-Live -+ */ -+ if (skb->len < 2 * sizeof(ax25_address) + 1) -+ return 0; - - nr_src = (ax25_address *)(skb->data + 0); - nr_dest = (ax25_address *)(skb->data + 7); -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 56e3ae3b6be93f..4abf7e9ac4f2f7 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -538,10 +538,8 @@ static void *packet_current_frame(struct packet_sock *po, - return packet_lookup_frame(po, rb, rb->head, status); - } - --static u16 vlan_get_tci(struct sk_buff *skb, struct net_device *dev) -+static u16 vlan_get_tci(const struct sk_buff *skb, struct net_device *dev) - { -- u8 *skb_orig_data = skb->data; -- int skb_orig_len = skb->len; - struct vlan_hdr vhdr, *vh; - unsigned int header_len; - -@@ -562,33 +560,21 @@ static u16 vlan_get_tci(struct sk_buff *skb, struct net_device *dev) - else - return 0; - -- skb_push(skb, skb->data - skb_mac_header(skb)); -- vh = skb_header_pointer(skb, header_len, sizeof(vhdr), &vhdr); -- if (skb_orig_data != skb->data) { -- skb->data = skb_orig_data; -- skb->len = skb_orig_len; -- } -+ vh = skb_header_pointer(skb, skb_mac_offset(skb) + header_len, -+ sizeof(vhdr), &vhdr); - if (unlikely(!vh)) - return 0; - - return ntohs(vh->h_vlan_TCI); - } - --static __be16 vlan_get_protocol_dgram(struct sk_buff *skb) -+static __be16 vlan_get_protocol_dgram(const struct sk_buff *skb) - { - __be16 proto = skb->protocol; - -- if (unlikely(eth_type_vlan(proto))) { -- u8 *skb_orig_data = skb->data; -- int skb_orig_len = skb->len; -- -- skb_push(skb, skb->data - skb_mac_header(skb)); -- proto = __vlan_get_protocol(skb, proto, NULL); -- if (skb_orig_data != skb->data) { -- skb->data = skb_orig_data; -- skb->len = skb_orig_len; -- } -- } -+ if (unlikely(eth_type_vlan(proto))) -+ proto = __vlan_get_protocol_offset(skb, proto, -+ skb_mac_offset(skb), NULL); - - return proto; - } -diff --git a/net/sctp/associola.c b/net/sctp/associola.c -index c45c192b787873..0b0794f164cf2e 100644 ---- a/net/sctp/associola.c -+++ b/net/sctp/associola.c -@@ -137,7 +137,8 @@ static struct sctp_association *sctp_association_init( - = 5 * asoc->rto_max; - - asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK] = asoc->sackdelay; -- asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] = sp->autoclose * HZ; -+ asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] = -+ (unsigned long)sp->autoclose * HZ; - - /* Initializes the timers */ - for (i = SCTP_EVENT_TIMEOUT_NONE; i < SCTP_NUM_TIMEOUT_TYPES; ++i) -diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c -index efbb4836ec668f..ea498eff1f2ae5 100644 ---- a/scripts/mod/file2alias.c -+++ b/scripts/mod/file2alias.c -@@ -742,8 +742,8 @@ static void do_input(char *alias, - - for (i = min / BITS_PER_LONG; i < max / BITS_PER_LONG + 1; i++) - arr[i] = TO_NATIVE(arr[i]); -- for (i = min; i < max; i++) -- if (arr[i / BITS_PER_LONG] & (1L << (i%BITS_PER_LONG))) -+ for (i = min; i <= max; i++) -+ if (arr[i / BITS_PER_LONG] & (1ULL << (i%BITS_PER_LONG))) - sprintf(alias + strlen(alias), "%X,*", i); - } - -diff --git a/scripts/sorttable.h b/scripts/sorttable.h -index 7bd0184380d3b9..a7c5445baf0027 100644 ---- a/scripts/sorttable.h -+++ b/scripts/sorttable.h -@@ -110,7 +110,7 @@ static inline unsigned long orc_ip(const int *ip) - - static int orc_sort_cmp(const void *_a, const void *_b) - { -- struct orc_entry *orc_a; -+ struct orc_entry *orc_a, *orc_b; - const int *a = g_orc_ip_table + *(int *)_a; - const int *b = g_orc_ip_table + *(int *)_b; - unsigned long a_val = orc_ip(a); -@@ -128,6 +128,9 @@ static int orc_sort_cmp(const void *_a, const void *_b) - * whitelisted .o files which didn't get objtool generation. - */ - orc_a = g_orc_table + (a - g_orc_ip_table); -+ orc_b = g_orc_table + (b - g_orc_ip_table); -+ if (orc_a->type == ORC_TYPE_UNDEFINED && orc_b->type == ORC_TYPE_UNDEFINED) -+ return 0; - return orc_a->type == ORC_TYPE_UNDEFINED ? -1 : 1; - } - -diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c -index 379ac7b5c7098c..f5eead8af2e210 100644 ---- a/security/selinux/ss/services.c -+++ b/security/selinux/ss/services.c -@@ -956,7 +956,10 @@ void services_compute_xperms_decision(struct extended_perms_decision *xpermd, - xpermd->driver)) - return; - } else { -- BUG(); -+ pr_warn_once( -+ "SELinux: unknown extended permission (%u) will be ignored\n", -+ node->datum.u.xperms->specified); -+ return; - } - - if (node->key.specified == AVTAB_XPERMS_ALLOWED) { -@@ -993,7 +996,8 @@ void services_compute_xperms_decision(struct extended_perms_decision *xpermd, - node->datum.u.xperms->perms.p[i]; - } - } else { -- BUG(); -+ pr_warn_once("SELinux: unknown specified key (%u)\n", -+ node->key.specified); - } - } - -diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c -index e3394919daa09a..51ee4c00a84310 100644 ---- a/sound/core/seq/oss/seq_oss_synth.c -+++ b/sound/core/seq/oss/seq_oss_synth.c -@@ -66,6 +66,7 @@ static struct seq_oss_synth midi_synth_dev = { - }; - - static DEFINE_SPINLOCK(register_lock); -+static DEFINE_MUTEX(sysex_mutex); - - /* - * prototypes -@@ -497,6 +498,7 @@ snd_seq_oss_synth_sysex(struct seq_oss_devinfo *dp, int dev, unsigned char *buf, - if (!info) - return -ENXIO; - -+ guard(mutex)(&sysex_mutex); - sysex = info->sysex; - if (sysex == NULL) { - sysex = kzalloc(sizeof(*sysex), GFP_KERNEL); -diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c -index e115fe18363495..8b7dfbc8e82075 100644 ---- a/sound/core/seq/seq_clientmgr.c -+++ b/sound/core/seq/seq_clientmgr.c -@@ -1280,10 +1280,16 @@ static int snd_seq_ioctl_set_client_info(struct snd_seq_client *client, - if (client->type != client_info->type) - return -EINVAL; - -- /* check validity of midi_version field */ -- if (client->user_pversion >= SNDRV_PROTOCOL_VERSION(1, 0, 3) && -- client_info->midi_version > SNDRV_SEQ_CLIENT_UMP_MIDI_2_0) -- return -EINVAL; -+ if (client->user_pversion >= SNDRV_PROTOCOL_VERSION(1, 0, 3)) { -+ /* check validity of midi_version field */ -+ if (client_info->midi_version > SNDRV_SEQ_CLIENT_UMP_MIDI_2_0) -+ return -EINVAL; -+ -+ /* check if UMP is supported in kernel */ -+ if (!IS_ENABLED(CONFIG_SND_SEQ_UMP) && -+ client_info->midi_version > 0) -+ return -EINVAL; -+ } - - /* fill the info fields */ - if (client_info->name[0]) -diff --git a/sound/core/ump.c b/sound/core/ump.c -index 83856b2f88b89f..32d27e58416aa3 100644 ---- a/sound/core/ump.c -+++ b/sound/core/ump.c -@@ -37,6 +37,7 @@ static int process_legacy_output(struct snd_ump_endpoint *ump, - u32 *buffer, int count); - static void process_legacy_input(struct snd_ump_endpoint *ump, const u32 *src, - int words); -+static void update_legacy_names(struct snd_ump_endpoint *ump); - #else - static inline int process_legacy_output(struct snd_ump_endpoint *ump, - u32 *buffer, int count) -@@ -47,6 +48,9 @@ static inline void process_legacy_input(struct snd_ump_endpoint *ump, - const u32 *src, int words) - { - } -+static inline void update_legacy_names(struct snd_ump_endpoint *ump) -+{ -+} - #endif - - static const struct snd_rawmidi_global_ops snd_ump_rawmidi_ops = { -@@ -850,6 +854,7 @@ static int ump_handle_fb_info_msg(struct snd_ump_endpoint *ump, - fill_fb_info(ump, &fb->info, buf); - if (ump->parsed) { - snd_ump_update_group_attrs(ump); -+ update_legacy_names(ump); - seq_notify_fb_change(ump, fb); - } - } -@@ -882,6 +887,7 @@ static int ump_handle_fb_name_msg(struct snd_ump_endpoint *ump, - /* notify the FB name update to sequencer, too */ - if (ret > 0 && ump->parsed) { - snd_ump_update_group_attrs(ump); -+ update_legacy_names(ump); - seq_notify_fb_change(ump, fb); - } - return ret; -@@ -1076,13 +1082,13 @@ static int snd_ump_legacy_open(struct snd_rawmidi_substream *substream) - struct snd_ump_endpoint *ump = substream->rmidi->private_data; - int dir = substream->stream; - int group = ump->legacy_mapping[substream->number]; -- int err = 0; -+ int err; - -- mutex_lock(&ump->open_mutex); -- if (ump->legacy_substreams[dir][group]) { -- err = -EBUSY; -- goto unlock; -- } -+ guard(mutex)(&ump->open_mutex); -+ if (ump->legacy_substreams[dir][group]) -+ return -EBUSY; -+ if (!ump->groups[group].active) -+ return -ENODEV; - if (dir == SNDRV_RAWMIDI_STREAM_OUTPUT) { - if (!ump->legacy_out_opens) { - err = snd_rawmidi_kernel_open(&ump->core, 0, -@@ -1090,17 +1096,14 @@ static int snd_ump_legacy_open(struct snd_rawmidi_substream *substream) - SNDRV_RAWMIDI_LFLG_APPEND, - &ump->legacy_out_rfile); - if (err < 0) -- goto unlock; -+ return err; - } - ump->legacy_out_opens++; - snd_ump_convert_reset(&ump->out_cvts[group]); - } -- spin_lock_irq(&ump->legacy_locks[dir]); -+ guard(spinlock_irq)(&ump->legacy_locks[dir]); - ump->legacy_substreams[dir][group] = substream; -- spin_unlock_irq(&ump->legacy_locks[dir]); -- unlock: -- mutex_unlock(&ump->open_mutex); -- return err; -+ return 0; - } - - static int snd_ump_legacy_close(struct snd_rawmidi_substream *substream) -@@ -1109,15 +1112,13 @@ static int snd_ump_legacy_close(struct snd_rawmidi_substream *substream) - int dir = substream->stream; - int group = ump->legacy_mapping[substream->number]; - -- mutex_lock(&ump->open_mutex); -- spin_lock_irq(&ump->legacy_locks[dir]); -- ump->legacy_substreams[dir][group] = NULL; -- spin_unlock_irq(&ump->legacy_locks[dir]); -+ guard(mutex)(&ump->open_mutex); -+ scoped_guard(spinlock_irq, &ump->legacy_locks[dir]) -+ ump->legacy_substreams[dir][group] = NULL; - if (dir == SNDRV_RAWMIDI_STREAM_OUTPUT) { - if (!--ump->legacy_out_opens) - snd_rawmidi_kernel_release(&ump->legacy_out_rfile); - } -- mutex_unlock(&ump->open_mutex); - return 0; - } - -@@ -1169,12 +1170,11 @@ static int process_legacy_output(struct snd_ump_endpoint *ump, - const int dir = SNDRV_RAWMIDI_STREAM_OUTPUT; - unsigned char c; - int group, size = 0; -- unsigned long flags; - - if (!ump->out_cvts || !ump->legacy_out_opens) - return 0; - -- spin_lock_irqsave(&ump->legacy_locks[dir], flags); -+ guard(spinlock_irqsave)(&ump->legacy_locks[dir]); - for (group = 0; group < SNDRV_UMP_MAX_GROUPS; group++) { - substream = ump->legacy_substreams[dir][group]; - if (!substream) -@@ -1190,7 +1190,6 @@ static int process_legacy_output(struct snd_ump_endpoint *ump, - break; - } - } -- spin_unlock_irqrestore(&ump->legacy_locks[dir], flags); - return size; - } - -@@ -1200,18 +1199,16 @@ static void process_legacy_input(struct snd_ump_endpoint *ump, const u32 *src, - struct snd_rawmidi_substream *substream; - unsigned char buf[16]; - unsigned char group; -- unsigned long flags; - const int dir = SNDRV_RAWMIDI_STREAM_INPUT; - int size; - - size = snd_ump_convert_from_ump(src, buf, &group); - if (size <= 0) - return; -- spin_lock_irqsave(&ump->legacy_locks[dir], flags); -+ guard(spinlock_irqsave)(&ump->legacy_locks[dir]); - substream = ump->legacy_substreams[dir][group]; - if (substream) - snd_rawmidi_receive(substream, buf, size); -- spin_unlock_irqrestore(&ump->legacy_locks[dir], flags); - } - - /* Fill ump->legacy_mapping[] for groups to be used for legacy rawmidi */ -@@ -1254,11 +1251,20 @@ static void fill_substream_names(struct snd_ump_endpoint *ump, - name = ump->groups[idx].name; - if (!*name) - name = ump->info.name; -- snprintf(s->name, sizeof(s->name), "Group %d (%.16s)", -- idx + 1, name); -+ scnprintf(s->name, sizeof(s->name), "Group %d (%.16s)%s", -+ idx + 1, name, -+ ump->groups[idx].active ? "" : " [Inactive]"); - } - } - -+static void update_legacy_names(struct snd_ump_endpoint *ump) -+{ -+ struct snd_rawmidi *rmidi = ump->legacy_rmidi; -+ -+ fill_substream_names(ump, rmidi, SNDRV_RAWMIDI_STREAM_INPUT); -+ fill_substream_names(ump, rmidi, SNDRV_RAWMIDI_STREAM_OUTPUT); -+} -+ - int snd_ump_attach_legacy_rawmidi(struct snd_ump_endpoint *ump, - char *id, int device) - { -@@ -1295,10 +1301,7 @@ int snd_ump_attach_legacy_rawmidi(struct snd_ump_endpoint *ump, - rmidi->ops = &snd_ump_legacy_ops; - rmidi->private_data = ump; - ump->legacy_rmidi = rmidi; -- if (input) -- fill_substream_names(ump, rmidi, SNDRV_RAWMIDI_STREAM_INPUT); -- if (output) -- fill_substream_names(ump, rmidi, SNDRV_RAWMIDI_STREAM_OUTPUT); -+ update_legacy_names(ump); - - ump_dbg(ump, "Created a legacy rawmidi #%d (%s)\n", device, id); - return 0; -diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c -index 748a3c40966e97..27e48fdbbf3aa0 100644 ---- a/sound/pci/hda/patch_ca0132.c -+++ b/sound/pci/hda/patch_ca0132.c -@@ -1134,7 +1134,6 @@ struct ca0132_spec { - - struct hda_codec *codec; - struct delayed_work unsol_hp_work; -- int quirk; - - #ifdef ENABLE_TUNING_CONTROLS - long cur_ctl_vals[TUNING_CTLS_COUNT]; -@@ -1166,7 +1165,6 @@ struct ca0132_spec { - * CA0132 quirks table - */ - enum { -- QUIRK_NONE, - QUIRK_ALIENWARE, - QUIRK_ALIENWARE_M17XR4, - QUIRK_SBZ, -@@ -1176,10 +1174,11 @@ enum { - QUIRK_R3D, - QUIRK_AE5, - QUIRK_AE7, -+ QUIRK_NONE = HDA_FIXUP_ID_NOT_SET, - }; - - #ifdef CONFIG_PCI --#define ca0132_quirk(spec) ((spec)->quirk) -+#define ca0132_quirk(spec) ((spec)->codec->fixup_id) - #define ca0132_use_pci_mmio(spec) ((spec)->use_pci_mmio) - #define ca0132_use_alt_functions(spec) ((spec)->use_alt_functions) - #define ca0132_use_alt_controls(spec) ((spec)->use_alt_controls) -@@ -1293,7 +1292,7 @@ static const struct hda_pintbl ae7_pincfgs[] = { - {} - }; - --static const struct snd_pci_quirk ca0132_quirks[] = { -+static const struct hda_quirk ca0132_quirks[] = { - SND_PCI_QUIRK(0x1028, 0x057b, "Alienware M17x R4", QUIRK_ALIENWARE_M17XR4), - SND_PCI_QUIRK(0x1028, 0x0685, "Alienware 15 2015", QUIRK_ALIENWARE), - SND_PCI_QUIRK(0x1028, 0x0688, "Alienware 17 2015", QUIRK_ALIENWARE), -@@ -1316,6 +1315,19 @@ static const struct snd_pci_quirk ca0132_quirks[] = { - {} - }; - -+static const struct hda_model_fixup ca0132_quirk_models[] = { -+ { .id = QUIRK_ALIENWARE, .name = "alienware" }, -+ { .id = QUIRK_ALIENWARE_M17XR4, .name = "alienware-m17xr4" }, -+ { .id = QUIRK_SBZ, .name = "sbz" }, -+ { .id = QUIRK_ZXR, .name = "zxr" }, -+ { .id = QUIRK_ZXR_DBPRO, .name = "zxr-dbpro" }, -+ { .id = QUIRK_R3DI, .name = "r3di" }, -+ { .id = QUIRK_R3D, .name = "r3d" }, -+ { .id = QUIRK_AE5, .name = "ae5" }, -+ { .id = QUIRK_AE7, .name = "ae7" }, -+ {} -+}; -+ - /* Output selection quirk info structures. */ - #define MAX_QUIRK_MMIO_GPIO_SET_VALS 3 - #define MAX_QUIRK_SCP_SET_VALS 2 -@@ -9962,17 +9974,15 @@ static int ca0132_prepare_verbs(struct hda_codec *codec) - */ - static void sbz_detect_quirk(struct hda_codec *codec) - { -- struct ca0132_spec *spec = codec->spec; -- - switch (codec->core.subsystem_id) { - case 0x11020033: -- spec->quirk = QUIRK_ZXR; -+ codec->fixup_id = QUIRK_ZXR; - break; - case 0x1102003f: -- spec->quirk = QUIRK_ZXR_DBPRO; -+ codec->fixup_id = QUIRK_ZXR_DBPRO; - break; - default: -- spec->quirk = QUIRK_SBZ; -+ codec->fixup_id = QUIRK_SBZ; - break; - } - } -@@ -9981,7 +9991,6 @@ static int patch_ca0132(struct hda_codec *codec) - { - struct ca0132_spec *spec; - int err; -- const struct snd_pci_quirk *quirk; - - codec_dbg(codec, "patch_ca0132\n"); - -@@ -9992,11 +10001,7 @@ static int patch_ca0132(struct hda_codec *codec) - spec->codec = codec; - - /* Detect codec quirk */ -- quirk = snd_pci_quirk_lookup(codec->bus->pci, ca0132_quirks); -- if (quirk) -- spec->quirk = quirk->value; -- else -- spec->quirk = QUIRK_NONE; -+ snd_hda_pick_fixup(codec, ca0132_quirk_models, ca0132_quirks, NULL); - if (ca0132_quirk(spec) == QUIRK_SBZ) - sbz_detect_quirk(codec); - -@@ -10073,7 +10078,7 @@ static int patch_ca0132(struct hda_codec *codec) - spec->mem_base = pci_iomap(codec->bus->pci, 2, 0xC20); - if (spec->mem_base == NULL) { - codec_warn(codec, "pci_iomap failed! Setting quirk to QUIRK_NONE."); -- spec->quirk = QUIRK_NONE; -+ codec->fixup_id = QUIRK_NONE; - } - } - #endif -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 29d7eb8c6bec3e..fc93af80f0bffe 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -10443,6 +10443,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0xf111, 0x0001, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0xf111, 0x0006, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0xf111, 0x0009, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE), -+ SND_PCI_QUIRK(0xf111, 0x000c, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE), - - #if 0 - /* Below is a quirk table taken from the old code. -@@ -10631,6 +10632,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { - {.id = ALC255_FIXUP_ACER_HEADPHONE_AND_MIC, .name = "alc255-acer-headphone-and-mic"}, - {.id = ALC285_FIXUP_HP_GPIO_AMP_INIT, .name = "alc285-hp-amp-init"}, - {.id = ALC236_FIXUP_LENOVO_INV_DMIC, .name = "alc236-fixup-lenovo-inv-mic"}, -+ {.id = ALC2XX_FIXUP_HEADSET_MIC, .name = "alc2xx-fixup-headset-mic"}, - {} - }; - #define ALC225_STANDARD_PINS \ -diff --git a/sound/usb/format.c b/sound/usb/format.c -index 3b45d0ee769389..3b3a5ea6fcbfc0 100644 ---- a/sound/usb/format.c -+++ b/sound/usb/format.c -@@ -60,6 +60,8 @@ static u64 parse_audio_format_i_type(struct snd_usb_audio *chip, - pcm_formats |= SNDRV_PCM_FMTBIT_SPECIAL; - /* flag potentially raw DSD capable altsettings */ - fp->dsd_raw = true; -+ /* clear special format bit to avoid "unsupported format" msg below */ -+ format &= ~UAC2_FORMAT_TYPE_I_RAW_DATA; - } - - format <<= 1; -@@ -71,8 +73,11 @@ static u64 parse_audio_format_i_type(struct snd_usb_audio *chip, - sample_width = as->bBitResolution; - sample_bytes = as->bSubslotSize; - -- if (format & UAC3_FORMAT_TYPE_I_RAW_DATA) -+ if (format & UAC3_FORMAT_TYPE_I_RAW_DATA) { - pcm_formats |= SNDRV_PCM_FMTBIT_SPECIAL; -+ /* clear special format bit to avoid "unsupported format" msg below */ -+ format &= ~UAC3_FORMAT_TYPE_I_RAW_DATA; -+ } - - format <<= 1; - break; -diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c -index 6eb7d93b358d99..20ac32635f1f50 100644 ---- a/sound/usb/mixer_us16x08.c -+++ b/sound/usb/mixer_us16x08.c -@@ -687,7 +687,7 @@ static int snd_us16x08_meter_get(struct snd_kcontrol *kcontrol, - struct usb_mixer_elem_info *elem = kcontrol->private_data; - struct snd_usb_audio *chip = elem->head.mixer->chip; - struct snd_us16x08_meter_store *store = elem->private_data; -- u8 meter_urb[64]; -+ u8 meter_urb[64] = {0}; - - switch (kcontrol->private_value) { - case 0: { -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index 8eed8d9742fda9..ec81b47c41c9ea 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -2225,6 +2225,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { - QUIRK_FLAG_DSD_RAW), - DEVICE_FLG(0x2522, 0x0007, /* LH Labs Geek Out HD Audio 1V5 */ - QUIRK_FLAG_SET_IFACE_FIRST), -+ DEVICE_FLG(0x262a, 0x9302, /* ddHiFi TC44C */ -+ QUIRK_FLAG_DSD_RAW), - DEVICE_FLG(0x2708, 0x0002, /* Audient iD14 */ - QUIRK_FLAG_IGNORE_CTL_ERROR), - DEVICE_FLG(0x2912, 0x30c8, /* Audioengine D1 */ -diff --git a/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c b/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c -index f87365f7599bf7..f61d623b1ce8df 100644 ---- a/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c -+++ b/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c -@@ -541,24 +541,11 @@ static __u64 subprog_spill_reg_precise(void) - - SEC("?raw_tp") - __success __log_level(2) --__msg("10: (0f) r1 += r7") --__msg("mark_precise: frame0: last_idx 10 first_idx 7 subseq_idx -1") --__msg("mark_precise: frame0: regs=r7 stack= before 9: (bf) r1 = r8") --__msg("mark_precise: frame0: regs=r7 stack= before 8: (27) r7 *= 4") --__msg("mark_precise: frame0: regs=r7 stack= before 7: (79) r7 = *(u64 *)(r10 -8)") --__msg("mark_precise: frame0: parent state regs= stack=-8: R0_w=2 R6_w=1 R8_rw=map_value(map=.data.vals,ks=4,vs=16) R10=fp0 fp-8_rw=P1") --__msg("mark_precise: frame0: last_idx 18 first_idx 0 subseq_idx 7") --__msg("mark_precise: frame0: regs= stack=-8 before 18: (95) exit") --__msg("mark_precise: frame1: regs= stack= before 17: (0f) r0 += r2") --__msg("mark_precise: frame1: regs= stack= before 16: (79) r2 = *(u64 *)(r1 +0)") --__msg("mark_precise: frame1: regs= stack= before 15: (79) r0 = *(u64 *)(r10 -16)") --__msg("mark_precise: frame1: regs= stack= before 14: (7b) *(u64 *)(r10 -16) = r2") --__msg("mark_precise: frame1: regs= stack= before 13: (7b) *(u64 *)(r1 +0) = r2") --__msg("mark_precise: frame1: regs=r2 stack= before 6: (85) call pc+6") --__msg("mark_precise: frame0: regs=r2 stack= before 5: (bf) r2 = r6") --__msg("mark_precise: frame0: regs=r6 stack= before 4: (07) r1 += -8") --__msg("mark_precise: frame0: regs=r6 stack= before 3: (bf) r1 = r10") --__msg("mark_precise: frame0: regs=r6 stack= before 2: (b7) r6 = 1") -+/* precision backtracking can't currently handle stack access not through r10, -+ * so we won't be able to mark stack slot fp-8 as precise, and so will -+ * fallback to forcing all as precise -+ */ -+__msg("mark_precise: frame0: falling back to forcing all scalars precise") - __naked int subprog_spill_into_parent_stack_slot_precise(void) - { - asm volatile ( -diff --git a/tools/testing/selftests/bpf/verifier/precise.c b/tools/testing/selftests/bpf/verifier/precise.c -index 8a2ff81d835088..0d84dd1f38b6b0 100644 ---- a/tools/testing/selftests/bpf/verifier/precise.c -+++ b/tools/testing/selftests/bpf/verifier/precise.c -@@ -140,11 +140,10 @@ - .result = REJECT, - }, - { -- "precise: ST zero to stack insn is supported", -+ "precise: ST insn causing spi > allocated_stack", - .insns = { - BPF_MOV64_REG(BPF_REG_3, BPF_REG_10), - BPF_JMP_IMM(BPF_JNE, BPF_REG_3, 123, 0), -- /* not a register spill, so we stop precision propagation for R4 here */ - BPF_ST_MEM(BPF_DW, BPF_REG_3, -8, 0), - BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8), - BPF_MOV64_IMM(BPF_REG_0, -1), -@@ -158,11 +157,11 @@ - mark_precise: frame0: last_idx 4 first_idx 2\ - mark_precise: frame0: regs=r4 stack= before 4\ - mark_precise: frame0: regs=r4 stack= before 3\ -+ mark_precise: frame0: regs= stack=-8 before 2\ -+ mark_precise: frame0: falling back to forcing all scalars precise\ -+ force_precise: frame0: forcing r0 to be precise\ - mark_precise: frame0: last_idx 5 first_idx 5\ -- mark_precise: frame0: parent state regs=r0 stack=:\ -- mark_precise: frame0: last_idx 4 first_idx 2\ -- mark_precise: frame0: regs=r0 stack= before 4\ -- 5: R0=-1 R4=0", -+ mark_precise: frame0: parent state regs= stack=:", - .result = VERBOSE_ACCEPT, - .retval = -1, - }, -@@ -170,8 +169,6 @@ - "precise: STX insn causing spi > allocated_stack", - .insns = { - BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32), -- /* make later reg spill more interesting by having somewhat known scalar */ -- BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xff), - BPF_MOV64_REG(BPF_REG_3, BPF_REG_10), - BPF_JMP_IMM(BPF_JNE, BPF_REG_3, 123, 0), - BPF_STX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, -8), -@@ -182,21 +179,18 @@ - }, - .prog_type = BPF_PROG_TYPE_XDP, - .flags = BPF_F_TEST_STATE_FREQ, -- .errstr = "mark_precise: frame0: last_idx 7 first_idx 7\ -+ .errstr = "mark_precise: frame0: last_idx 6 first_idx 6\ - mark_precise: frame0: parent state regs=r4 stack=:\ -- mark_precise: frame0: last_idx 6 first_idx 4\ -- mark_precise: frame0: regs=r4 stack= before 6: (b7) r0 = -1\ -- mark_precise: frame0: regs=r4 stack= before 5: (79) r4 = *(u64 *)(r10 -8)\ -- mark_precise: frame0: regs= stack=-8 before 4: (7b) *(u64 *)(r3 -8) = r0\ -- mark_precise: frame0: parent state regs=r0 stack=:\ -- mark_precise: frame0: last_idx 3 first_idx 3\ -- mark_precise: frame0: regs=r0 stack= before 3: (55) if r3 != 0x7b goto pc+0\ -- mark_precise: frame0: regs=r0 stack= before 2: (bf) r3 = r10\ -- mark_precise: frame0: regs=r0 stack= before 1: (57) r0 &= 255\ -- mark_precise: frame0: parent state regs=r0 stack=:\ -- mark_precise: frame0: last_idx 0 first_idx 0\ -- mark_precise: frame0: regs=r0 stack= before 0: (85) call bpf_get_prandom_u32#7\ -- mark_precise: frame0: last_idx 7 first_idx 7\ -+ mark_precise: frame0: last_idx 5 first_idx 3\ -+ mark_precise: frame0: regs=r4 stack= before 5\ -+ mark_precise: frame0: regs=r4 stack= before 4\ -+ mark_precise: frame0: regs= stack=-8 before 3\ -+ mark_precise: frame0: falling back to forcing all scalars precise\ -+ force_precise: frame0: forcing r0 to be precise\ -+ force_precise: frame0: forcing r0 to be precise\ -+ force_precise: frame0: forcing r0 to be precise\ -+ force_precise: frame0: forcing r0 to be precise\ -+ mark_precise: frame0: last_idx 6 first_idx 6\ - mark_precise: frame0: parent state regs= stack=:", - .result = VERBOSE_ACCEPT, - .retval = -1, diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.070-071.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.070-071.patch deleted file mode 100644 index 9e3ccd9c83..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.070-071.patch +++ /dev/null @@ -1,227 +0,0 @@ -diff --git a/Makefile b/Makefile -index 4c0dd62e02e465..9476e4502bbb0b 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 70 -+SUBLEVEL = 71 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile -index 15fc9fc3dcf052..3269a0e23d3ab8 100644 ---- a/arch/x86/kernel/Makefile -+++ b/arch/x86/kernel/Makefile -@@ -99,9 +99,9 @@ obj-$(CONFIG_TRACING) += trace.o - obj-$(CONFIG_RETHOOK) += rethook.o - obj-$(CONFIG_CRASH_CORE) += crash_core_$(BITS).o - obj-$(CONFIG_KEXEC_CORE) += machine_kexec_$(BITS).o --obj-$(CONFIG_KEXEC_CORE) += relocate_kernel_$(BITS).o -+obj-$(CONFIG_KEXEC_CORE) += relocate_kernel_$(BITS).o crash.o - obj-$(CONFIG_KEXEC_FILE) += kexec-bzimage64.o --obj-$(CONFIG_CRASH_DUMP) += crash_dump_$(BITS).o crash.o -+obj-$(CONFIG_CRASH_DUMP) += crash_dump_$(BITS).o - obj-y += kprobes/ - obj-$(CONFIG_MODULES) += module.o - obj-$(CONFIG_X86_32) += doublefault_32.o -diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c -index 6328cf56e59be2..5ae77d966cafea 100644 ---- a/arch/x86/kernel/cpu/mshyperv.c -+++ b/arch/x86/kernel/cpu/mshyperv.c -@@ -209,9 +209,7 @@ static void hv_machine_shutdown(void) - if (kexec_in_progress) - hyperv_cleanup(); - } --#endif /* CONFIG_KEXEC_CORE */ - --#ifdef CONFIG_CRASH_DUMP - static void hv_machine_crash_shutdown(struct pt_regs *regs) - { - if (hv_crash_handler) -@@ -223,7 +221,7 @@ static void hv_machine_crash_shutdown(struct pt_regs *regs) - /* Disable the hypercall page when there is only 1 active CPU. */ - hyperv_cleanup(); - } --#endif /* CONFIG_CRASH_DUMP */ -+#endif /* CONFIG_KEXEC_CORE */ - - static u64 hv_ref_counter_at_suspend; - static void (*old_save_sched_clock_state)(void); -@@ -552,13 +550,9 @@ static void __init ms_hyperv_init_platform(void) - no_timer_check = 1; - #endif - --#if IS_ENABLED(CONFIG_HYPERV) --#if defined(CONFIG_KEXEC_CORE) -+#if IS_ENABLED(CONFIG_HYPERV) && defined(CONFIG_KEXEC_CORE) - machine_ops.shutdown = hv_machine_shutdown; --#endif --#if defined(CONFIG_CRASH_DUMP) - machine_ops.crash_shutdown = hv_machine_crash_shutdown; --#endif - #endif - if (ms_hyperv.features & HV_ACCESS_TSC_INVARIANT) { - /* -diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c -index 0de509c02d18b9..a61c12c0127097 100644 ---- a/arch/x86/kernel/kexec-bzimage64.c -+++ b/arch/x86/kernel/kexec-bzimage64.c -@@ -263,13 +263,11 @@ setup_boot_parameters(struct kimage *image, struct boot_params *params, - memset(¶ms->hd0_info, 0, sizeof(params->hd0_info)); - memset(¶ms->hd1_info, 0, sizeof(params->hd1_info)); - --#ifdef CONFIG_CRASH_DUMP - if (image->type == KEXEC_TYPE_CRASH) { - ret = crash_setup_memmap_entries(image, params); - if (ret) - return ret; - } else --#endif - setup_e820_entries(params); - - nr_e820_entries = params->e820_entries; -@@ -430,14 +428,12 @@ static void *bzImage64_load(struct kimage *image, char *kernel, - return ERR_PTR(-EINVAL); - } - --#ifdef CONFIG_CRASH_DUMP - /* Allocate and load backup region */ - if (image->type == KEXEC_TYPE_CRASH) { - ret = crash_load_segments(image); - if (ret) - return ERR_PTR(ret); - } --#endif - - /* - * Load purgatory. For 64bit entry point, purgatory code can be -diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c -index 38d88c8b56ec07..b8ab9ee5896c19 100644 ---- a/arch/x86/kernel/kvm.c -+++ b/arch/x86/kernel/kvm.c -@@ -769,7 +769,7 @@ static struct notifier_block kvm_pv_reboot_nb = { - * won't be valid. In cases like kexec, in which you install a new kernel, this - * means a random memory location will be kept being written. - */ --#ifdef CONFIG_CRASH_DUMP -+#ifdef CONFIG_KEXEC_CORE - static void kvm_crash_shutdown(struct pt_regs *regs) - { - kvm_guest_cpu_offline(true); -@@ -852,7 +852,7 @@ static void __init kvm_guest_init(void) - kvm_guest_cpu_init(); - #endif - --#ifdef CONFIG_CRASH_DUMP -+#ifdef CONFIG_KEXEC_CORE - machine_ops.crash_shutdown = kvm_crash_shutdown; - #endif - -diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c -index aaeac2deb85dc6..2fa12d1dc67602 100644 ---- a/arch/x86/kernel/machine_kexec_64.c -+++ b/arch/x86/kernel/machine_kexec_64.c -@@ -545,8 +545,6 @@ int arch_kimage_file_post_load_cleanup(struct kimage *image) - } - #endif /* CONFIG_KEXEC_FILE */ - --#ifdef CONFIG_CRASH_DUMP -- - static int - kexec_mark_range(unsigned long start, unsigned long end, bool protect) - { -@@ -591,7 +589,6 @@ void arch_kexec_unprotect_crashkres(void) - { - kexec_mark_crashkres(false); - } --#endif - - /* - * During a traditional boot under SME, SME will encrypt the kernel, -diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c -index f3130f762784a1..830425e6d38e2f 100644 ---- a/arch/x86/kernel/reboot.c -+++ b/arch/x86/kernel/reboot.c -@@ -796,7 +796,7 @@ struct machine_ops machine_ops __ro_after_init = { - .emergency_restart = native_machine_emergency_restart, - .restart = native_machine_restart, - .halt = native_machine_halt, --#ifdef CONFIG_CRASH_DUMP -+#ifdef CONFIG_KEXEC_CORE - .crash_shutdown = native_machine_crash_shutdown, - #endif - }; -@@ -826,7 +826,7 @@ void machine_halt(void) - machine_ops.halt(); - } - --#ifdef CONFIG_CRASH_DUMP -+#ifdef CONFIG_KEXEC_CORE - void machine_crash_shutdown(struct pt_regs *regs) - { - machine_ops.crash_shutdown(regs); -diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 8bcecabd475bdf..eb129277dcdd64 100644 ---- a/arch/x86/kernel/setup.c -+++ b/arch/x86/kernel/setup.c -@@ -547,7 +547,7 @@ static void __init reserve_crashkernel(void) - bool high = false; - int ret; - -- if (!IS_ENABLED(CONFIG_CRASH_RESERVE)) -+ if (!IS_ENABLED(CONFIG_KEXEC_CORE)) - return; - - total_mem = memblock_phys_mem_size(); -diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c -index 52c3823b721191..96a771f9f930a6 100644 ---- a/arch/x86/kernel/smp.c -+++ b/arch/x86/kernel/smp.c -@@ -282,7 +282,7 @@ struct smp_ops smp_ops = { - .smp_cpus_done = native_smp_cpus_done, - - .stop_other_cpus = native_stop_other_cpus, --#if defined(CONFIG_CRASH_DUMP) -+#if defined(CONFIG_KEXEC_CORE) - .crash_stop_other_cpus = kdump_nmi_shootdown_cpus, - #endif - .smp_send_reschedule = native_smp_send_reschedule, -diff --git a/arch/x86/xen/enlighten_hvm.c b/arch/x86/xen/enlighten_hvm.c -index ade22feee7aeb1..70be57e8f51caa 100644 ---- a/arch/x86/xen/enlighten_hvm.c -+++ b/arch/x86/xen/enlighten_hvm.c -@@ -141,9 +141,7 @@ static void xen_hvm_shutdown(void) - if (kexec_in_progress) - xen_reboot(SHUTDOWN_soft_reset); - } --#endif - --#ifdef CONFIG_CRASH_DUMP - static void xen_hvm_crash_shutdown(struct pt_regs *regs) - { - native_machine_crash_shutdown(regs); -@@ -231,8 +229,6 @@ static void __init xen_hvm_guest_init(void) - - #ifdef CONFIG_KEXEC_CORE - machine_ops.shutdown = xen_hvm_shutdown; --#endif --#ifdef CONFIG_CRASH_DUMP - machine_ops.crash_shutdown = xen_hvm_crash_shutdown; - #endif - } -diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c -index bfd57d07f4b5ee..6b201e64d8abc8 100644 ---- a/arch/x86/xen/mmu_pv.c -+++ b/arch/x86/xen/mmu_pv.c -@@ -2517,7 +2517,7 @@ int xen_remap_pfn(struct vm_area_struct *vma, unsigned long addr, - } - EXPORT_SYMBOL_GPL(xen_remap_pfn); - --#ifdef CONFIG_VMCORE_INFO -+#ifdef CONFIG_KEXEC_CORE - phys_addr_t paddr_vmcoreinfo_note(void) - { - if (xen_pv_domain()) diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.071-072.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.071-072.patch deleted file mode 100644 index 891def085e..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.071-072.patch +++ /dev/null @@ -1,4467 +0,0 @@ -diff --git a/Makefile b/Makefile -index 9476e4502bbb0b..fb4949cac6ffbf 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 71 -+SUBLEVEL = 72 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm/boot/dts/nxp/imx/imxrt1050.dtsi b/arch/arm/boot/dts/nxp/imx/imxrt1050.dtsi -index dd714d235d5f6a..b0bad0d1ba36f4 100644 ---- a/arch/arm/boot/dts/nxp/imx/imxrt1050.dtsi -+++ b/arch/arm/boot/dts/nxp/imx/imxrt1050.dtsi -@@ -87,7 +87,7 @@ usdhc1: mmc@402c0000 { - reg = <0x402c0000 0x4000>; - interrupts = <110>; - clocks = <&clks IMXRT1050_CLK_IPG_PDOF>, -- <&clks IMXRT1050_CLK_OSC>, -+ <&clks IMXRT1050_CLK_AHB_PODF>, - <&clks IMXRT1050_CLK_USDHC1>; - clock-names = "ipg", "ahb", "per"; - bus-width = <4>; -diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi -index 5d47acbf4a2497..82eb7c49e825e4 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi -+++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi -@@ -304,6 +304,7 @@ power: power-controller { - - power-domain@RK3328_PD_HEVC { - reg = ; -+ clocks = <&cru SCLK_VENC_CORE>; - #power-domain-cells = <0>; - }; - power-domain@RK3328_PD_VIDEO { -diff --git a/arch/riscv/include/asm/cacheflush.h b/arch/riscv/include/asm/cacheflush.h -index a129dac4521d35..3f65acd0ef7560 100644 ---- a/arch/riscv/include/asm/cacheflush.h -+++ b/arch/riscv/include/asm/cacheflush.h -@@ -13,6 +13,12 @@ static inline void local_flush_icache_all(void) - asm volatile ("fence.i" ::: "memory"); - } - -+static inline void local_flush_icache_range(unsigned long start, -+ unsigned long end) -+{ -+ local_flush_icache_all(); -+} -+ - #define PG_dcache_clean PG_arch_1 - - static inline void flush_dcache_folio(struct folio *folio) -diff --git a/arch/riscv/include/asm/page.h b/arch/riscv/include/asm/page.h -index 94b3d6930fc370..4d1f58848129e8 100644 ---- a/arch/riscv/include/asm/page.h -+++ b/arch/riscv/include/asm/page.h -@@ -122,6 +122,7 @@ struct kernel_mapping { - - extern struct kernel_mapping kernel_map; - extern phys_addr_t phys_ram_base; -+extern unsigned long vmemmap_start_pfn; - - #define is_kernel_mapping(x) \ - ((x) >= kernel_map.virt_addr && (x) < (kernel_map.virt_addr + kernel_map.size)) -diff --git a/arch/riscv/include/asm/patch.h b/arch/riscv/include/asm/patch.h -index e88b52d39eac76..9f5d6e14c40553 100644 ---- a/arch/riscv/include/asm/patch.h -+++ b/arch/riscv/include/asm/patch.h -@@ -6,6 +6,7 @@ - #ifndef _ASM_RISCV_PATCH_H - #define _ASM_RISCV_PATCH_H - -+int patch_insn_write(void *addr, const void *insn, size_t len); - int patch_text_nosync(void *addr, const void *insns, size_t len); - int patch_text_set_nosync(void *addr, u8 c, size_t len); - int patch_text(void *addr, u32 *insns, int ninsns); -diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h -index 37829dab4a0a48..f540b2625714d0 100644 ---- a/arch/riscv/include/asm/pgtable.h -+++ b/arch/riscv/include/asm/pgtable.h -@@ -84,7 +84,7 @@ - * Define vmemmap for pfn_to_page & page_to_pfn calls. Needed if kernel - * is configured with CONFIG_SPARSEMEM_VMEMMAP enabled. - */ --#define vmemmap ((struct page *)VMEMMAP_START - (phys_ram_base >> PAGE_SHIFT)) -+#define vmemmap ((struct page *)VMEMMAP_START - vmemmap_start_pfn) - - #define PCI_IO_SIZE SZ_16M - #define PCI_IO_END VMEMMAP_START -diff --git a/arch/riscv/kernel/ftrace.c b/arch/riscv/kernel/ftrace.c -index 03a6434a8cdd00..4c58c2f8098401 100644 ---- a/arch/riscv/kernel/ftrace.c -+++ b/arch/riscv/kernel/ftrace.c -@@ -8,6 +8,7 @@ - #include - #include - #include -+#include - #include - #include - -@@ -75,8 +76,7 @@ static int __ftrace_modify_call(unsigned long hook_pos, unsigned long target, - make_call_t0(hook_pos, target, call); - - /* Replace the auipc-jalr pair at once. Return -EPERM on write error. */ -- if (patch_text_nosync -- ((void *)hook_pos, enable ? call : nops, MCOUNT_INSN_SIZE)) -+ if (patch_insn_write((void *)hook_pos, enable ? call : nops, MCOUNT_INSN_SIZE)) - return -EPERM; - - return 0; -@@ -88,7 +88,7 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr) - - make_call_t0(rec->ip, addr, call); - -- if (patch_text_nosync((void *)rec->ip, call, MCOUNT_INSN_SIZE)) -+ if (patch_insn_write((void *)rec->ip, call, MCOUNT_INSN_SIZE)) - return -EPERM; - - return 0; -@@ -99,7 +99,7 @@ int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec, - { - unsigned int nops[2] = {NOP4, NOP4}; - -- if (patch_text_nosync((void *)rec->ip, nops, MCOUNT_INSN_SIZE)) -+ if (patch_insn_write((void *)rec->ip, nops, MCOUNT_INSN_SIZE)) - return -EPERM; - - return 0; -@@ -120,6 +120,9 @@ int ftrace_init_nop(struct module *mod, struct dyn_ftrace *rec) - out = ftrace_make_nop(mod, rec, MCOUNT_ADDR); - mutex_unlock(&text_mutex); - -+ if (!mod) -+ local_flush_icache_range(rec->ip, rec->ip + MCOUNT_INSN_SIZE); -+ - return out; - } - -@@ -134,6 +137,42 @@ int ftrace_update_ftrace_func(ftrace_func_t func) - - return ret; - } -+ -+struct ftrace_modify_param { -+ int command; -+ atomic_t cpu_count; -+}; -+ -+static int __ftrace_modify_code(void *data) -+{ -+ struct ftrace_modify_param *param = data; -+ -+ if (atomic_inc_return(¶m->cpu_count) == num_online_cpus()) { -+ ftrace_modify_all_code(param->command); -+ /* -+ * Make sure the patching store is effective *before* we -+ * increment the counter which releases all waiting CPUs -+ * by using the release variant of atomic increment. The -+ * release pairs with the call to local_flush_icache_all() -+ * on the waiting CPU. -+ */ -+ atomic_inc_return_release(¶m->cpu_count); -+ } else { -+ while (atomic_read(¶m->cpu_count) <= num_online_cpus()) -+ cpu_relax(); -+ } -+ -+ local_flush_icache_all(); -+ -+ return 0; -+} -+ -+void arch_ftrace_update_code(int command) -+{ -+ struct ftrace_modify_param param = { command, ATOMIC_INIT(0) }; -+ -+ stop_machine(__ftrace_modify_code, ¶m, cpu_online_mask); -+} - #endif - - #ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS -diff --git a/arch/riscv/kernel/patch.c b/arch/riscv/kernel/patch.c -index 30e12b310cab73..78387d843aa56b 100644 ---- a/arch/riscv/kernel/patch.c -+++ b/arch/riscv/kernel/patch.c -@@ -196,7 +196,7 @@ int patch_text_set_nosync(void *addr, u8 c, size_t len) - } - NOKPROBE_SYMBOL(patch_text_set_nosync); - --static int patch_insn_write(void *addr, const void *insn, size_t len) -+int patch_insn_write(void *addr, const void *insn, size_t len) - { - size_t patched = 0; - size_t size; -@@ -240,16 +240,24 @@ static int patch_text_cb(void *data) - if (atomic_inc_return(&patch->cpu_count) == num_online_cpus()) { - for (i = 0; ret == 0 && i < patch->ninsns; i++) { - len = GET_INSN_LENGTH(patch->insns[i]); -- ret = patch_text_nosync(patch->addr + i * len, -- &patch->insns[i], len); -+ ret = patch_insn_write(patch->addr + i * len, &patch->insns[i], len); - } -- atomic_inc(&patch->cpu_count); -+ /* -+ * Make sure the patching store is effective *before* we -+ * increment the counter which releases all waiting CPUs -+ * by using the release variant of atomic increment. The -+ * release pairs with the call to local_flush_icache_all() -+ * on the waiting CPU. -+ */ -+ atomic_inc_return_release(&patch->cpu_count); - } else { - while (atomic_read(&patch->cpu_count) <= num_online_cpus()) - cpu_relax(); - smp_mb(); - } - -+ local_flush_icache_all(); -+ - return ret; - } - NOKPROBE_SYMBOL(patch_text_cb); -diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c -index fecbbcf40ac3fe..4fbc70e823f0fa 100644 ---- a/arch/riscv/kernel/probes/kprobes.c -+++ b/arch/riscv/kernel/probes/kprobes.c -@@ -29,7 +29,7 @@ static void __kprobes arch_prepare_ss_slot(struct kprobe *p) - p->ainsn.api.restore = (unsigned long)p->addr + offset; - - patch_text_nosync(p->ainsn.api.insn, &p->opcode, 1); -- patch_text_nosync(p->ainsn.api.insn + offset, &insn, 1); -+ patch_text_nosync((void *)p->ainsn.api.insn + offset, &insn, 1); - } - - static void __kprobes arch_prepare_simulate(struct kprobe *p) -diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c -index 2158b7a65d74f7..53c7de4878c227 100644 ---- a/arch/riscv/kernel/traps.c -+++ b/arch/riscv/kernel/traps.c -@@ -34,7 +34,7 @@ - - int show_unhandled_signals = 1; - --static DEFINE_SPINLOCK(die_lock); -+static DEFINE_RAW_SPINLOCK(die_lock); - - static void dump_kernel_instr(const char *loglvl, struct pt_regs *regs) - { -@@ -66,7 +66,7 @@ void die(struct pt_regs *regs, const char *str) - - oops_enter(); - -- spin_lock_irqsave(&die_lock, flags); -+ raw_spin_lock_irqsave(&die_lock, flags); - console_verbose(); - bust_spinlocks(1); - -@@ -85,7 +85,7 @@ void die(struct pt_regs *regs, const char *str) - - bust_spinlocks(0); - add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE); -- spin_unlock_irqrestore(&die_lock, flags); -+ raw_spin_unlock_irqrestore(&die_lock, flags); - oops_exit(); - - if (in_interrupt()) -diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c -index 3245bb525212e3..bdf8ac6c7e309d 100644 ---- a/arch/riscv/mm/init.c -+++ b/arch/riscv/mm/init.c -@@ -32,6 +32,7 @@ - #include - #include - #include -+#include - #include - - #include "../kernel/head.h" -@@ -57,6 +58,13 @@ EXPORT_SYMBOL(pgtable_l5_enabled); - phys_addr_t phys_ram_base __ro_after_init; - EXPORT_SYMBOL(phys_ram_base); - -+#ifdef CONFIG_SPARSEMEM_VMEMMAP -+#define VMEMMAP_ADDR_ALIGN (1ULL << SECTION_SIZE_BITS) -+ -+unsigned long vmemmap_start_pfn __ro_after_init; -+EXPORT_SYMBOL(vmemmap_start_pfn); -+#endif -+ - unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)] - __page_aligned_bss; - EXPORT_SYMBOL(empty_zero_page); -@@ -221,8 +229,12 @@ static void __init setup_bootmem(void) - * Make sure we align the start of the memory on a PMD boundary so that - * at worst, we map the linear mapping with PMD mappings. - */ -- if (!IS_ENABLED(CONFIG_XIP_KERNEL)) -+ if (!IS_ENABLED(CONFIG_XIP_KERNEL)) { - phys_ram_base = memblock_start_of_DRAM() & PMD_MASK; -+#ifdef CONFIG_SPARSEMEM_VMEMMAP -+ vmemmap_start_pfn = round_down(phys_ram_base, VMEMMAP_ADDR_ALIGN) >> PAGE_SHIFT; -+#endif -+ } - - /* - * In 64-bit, any use of __va/__pa before this point is wrong as we -@@ -1080,6 +1092,9 @@ asmlinkage void __init setup_vm(uintptr_t dtb_pa) - kernel_map.xiprom_sz = (uintptr_t)(&_exiprom) - (uintptr_t)(&_xiprom); - - phys_ram_base = CONFIG_PHYS_RAM_BASE; -+#ifdef CONFIG_SPARSEMEM_VMEMMAP -+ vmemmap_start_pfn = round_down(phys_ram_base, VMEMMAP_ADDR_ALIGN) >> PAGE_SHIFT; -+#endif - kernel_map.phys_addr = (uintptr_t)CONFIG_PHYS_RAM_BASE; - kernel_map.size = (uintptr_t)(&_end) - (uintptr_t)(&_start); - -diff --git a/arch/x86/kernel/fpu/regset.c b/arch/x86/kernel/fpu/regset.c -index 6bc1eb2a21bd92..887b0b8e21e364 100644 ---- a/arch/x86/kernel/fpu/regset.c -+++ b/arch/x86/kernel/fpu/regset.c -@@ -190,7 +190,8 @@ int ssp_get(struct task_struct *target, const struct user_regset *regset, - struct fpu *fpu = &target->thread.fpu; - struct cet_user_state *cetregs; - -- if (!cpu_feature_enabled(X86_FEATURE_USER_SHSTK)) -+ if (!cpu_feature_enabled(X86_FEATURE_USER_SHSTK) || -+ !ssp_active(target, regset)) - return -ENODEV; - - sync_fpstate(fpu); -diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c -index 2c67bfc3cf3204..8b374c6919e604 100644 ---- a/arch/x86/mm/numa.c -+++ b/arch/x86/mm/numa.c -@@ -492,7 +492,7 @@ static void __init numa_clear_kernel_node_hotplug(void) - for_each_reserved_mem_region(mb_region) { - int nid = memblock_get_region_node(mb_region); - -- if (nid != MAX_NUMNODES) -+ if (nid != NUMA_NO_NODE) - node_set(nid, reserved_nodemask); - } - -@@ -613,9 +613,9 @@ static int __init numa_init(int (*init_func)(void)) - nodes_clear(node_online_map); - memset(&numa_meminfo, 0, sizeof(numa_meminfo)); - WARN_ON(memblock_set_node(0, ULLONG_MAX, &memblock.memory, -- MAX_NUMNODES)); -+ NUMA_NO_NODE)); - WARN_ON(memblock_set_node(0, ULLONG_MAX, &memblock.reserved, -- MAX_NUMNODES)); -+ NUMA_NO_NODE)); - /* In case that parsing SRAT failed. */ - WARN_ON(memblock_clear_hotplug(0, ULLONG_MAX)); - numa_reset_distance(); -diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c -index dd8ca3f7ba60a1..617d6802b8a0c7 100644 ---- a/block/bfq-iosched.c -+++ b/block/bfq-iosched.c -@@ -6843,16 +6843,24 @@ static struct bfq_queue *bfq_waker_bfqq(struct bfq_queue *bfqq) - if (new_bfqq == waker_bfqq) { - /* - * If waker_bfqq is in the merge chain, and current -- * is the only procress. -+ * is the only process, waker_bfqq can be freed. - */ - if (bfqq_process_refs(waker_bfqq) == 1) - return NULL; -- break; -+ -+ return waker_bfqq; - } - - new_bfqq = new_bfqq->new_bfqq; - } - -+ /* -+ * If waker_bfqq is not in the merge chain, and it's procress reference -+ * is 0, waker_bfqq can be freed. -+ */ -+ if (bfqq_process_refs(waker_bfqq) == 0) -+ return NULL; -+ - return waker_bfqq; - } - -diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c -index df598de0cb184f..c82b255f82bc41 100644 ---- a/drivers/acpi/resource.c -+++ b/drivers/acpi/resource.c -@@ -439,6 +439,13 @@ static const struct dmi_system_id asus_laptop[] = { - DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"), - }, - }, -+ { -+ /* Asus Vivobook X1504VAP */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), -+ DMI_MATCH(DMI_BOARD_NAME, "X1504VAP"), -+ }, -+ }, - { - /* Asus Vivobook X1704VAP */ - .matches = { -@@ -633,6 +640,17 @@ static const struct dmi_system_id lg_laptop[] = { - DMI_MATCH(DMI_BOARD_NAME, "GMxHGxx"), - }, - }, -+ { -+ /* -+ * TongFang GM5HG0A in case of the SKIKK Vanaheim relabel the -+ * board-name is changed, so check OEM strings instead. Note -+ * OEM string matches are always exact matches. -+ * https://bugzilla.kernel.org/show_bug.cgi?id=219614 -+ */ -+ .matches = { -+ DMI_EXACT_MATCH(DMI_OEM_STRING, "GM5HG0A"), -+ }, -+ }, - { } - }; - -diff --git a/drivers/base/topology.c b/drivers/base/topology.c -index 89f98be5c5b991..d293cbd253e4f9 100644 ---- a/drivers/base/topology.c -+++ b/drivers/base/topology.c -@@ -27,9 +27,17 @@ static ssize_t name##_read(struct file *file, struct kobject *kobj, \ - loff_t off, size_t count) \ - { \ - struct device *dev = kobj_to_dev(kobj); \ -+ cpumask_var_t mask; \ -+ ssize_t n; \ - \ -- return cpumap_print_bitmask_to_buf(buf, topology_##mask(dev->id), \ -- off, count); \ -+ if (!alloc_cpumask_var(&mask, GFP_KERNEL)) \ -+ return -ENOMEM; \ -+ \ -+ cpumask_copy(mask, topology_##mask(dev->id)); \ -+ n = cpumap_print_bitmask_to_buf(buf, mask, off, count); \ -+ free_cpumask_var(mask); \ -+ \ -+ return n; \ - } \ - \ - static ssize_t name##_list_read(struct file *file, struct kobject *kobj, \ -@@ -37,9 +45,17 @@ static ssize_t name##_list_read(struct file *file, struct kobject *kobj, \ - loff_t off, size_t count) \ - { \ - struct device *dev = kobj_to_dev(kobj); \ -+ cpumask_var_t mask; \ -+ ssize_t n; \ -+ \ -+ if (!alloc_cpumask_var(&mask, GFP_KERNEL)) \ -+ return -ENOMEM; \ -+ \ -+ cpumask_copy(mask, topology_##mask(dev->id)); \ -+ n = cpumap_print_list_to_buf(buf, mask, off, count); \ -+ free_cpumask_var(mask); \ - \ -- return cpumap_print_list_to_buf(buf, topology_##mask(dev->id), \ -- off, count); \ -+ return n; \ - } - - define_id_show_func(physical_package_id, "%d"); -diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c -index 5ee9a8b8dcfdb8..e809bb2dbe5e07 100644 ---- a/drivers/bluetooth/btnxpuart.c -+++ b/drivers/bluetooth/btnxpuart.c -@@ -1280,6 +1280,7 @@ static void btnxpuart_tx_work(struct work_struct *work) - - while ((skb = nxp_dequeue(nxpdev))) { - len = serdev_device_write_buf(serdev, skb->data, skb->len); -+ serdev_device_wait_until_sent(serdev, 0); - hdev->stat.byte_tx += len; - - skb_pull(skb, len); -diff --git a/drivers/cpuidle/cpuidle-riscv-sbi.c b/drivers/cpuidle/cpuidle-riscv-sbi.c -index c0fe92409175a4..71d433bb0ce694 100644 ---- a/drivers/cpuidle/cpuidle-riscv-sbi.c -+++ b/drivers/cpuidle/cpuidle-riscv-sbi.c -@@ -534,12 +534,12 @@ static int sbi_cpuidle_probe(struct platform_device *pdev) - int cpu, ret; - struct cpuidle_driver *drv; - struct cpuidle_device *dev; -- struct device_node *np, *pds_node; -+ struct device_node *pds_node; - - /* Detect OSI support based on CPU DT nodes */ - sbi_cpuidle_use_osi = true; - for_each_possible_cpu(cpu) { -- np = of_cpu_device_node_get(cpu); -+ struct device_node *np __free(device_node) = of_cpu_device_node_get(cpu); - if (np && - of_property_present(np, "power-domains") && - of_property_present(np, "power-domain-names")) { -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_debug.c b/drivers/gpu/drm/amd/amdkfd/kfd_debug.c -index 94aaf2fc556ca1..9c32c64c407fa9 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_debug.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_debug.c -@@ -349,10 +349,27 @@ int kfd_dbg_set_mes_debug_mode(struct kfd_process_device *pdd, bool sq_trap_en) - { - uint32_t spi_dbg_cntl = pdd->spi_dbg_override | pdd->spi_dbg_launch_mode; - uint32_t flags = pdd->process->dbg_flags; -+ struct amdgpu_device *adev = pdd->dev->adev; -+ int r; - - if (!kfd_dbg_is_per_vmid_supported(pdd->dev)) - return 0; - -+ if (!pdd->proc_ctx_cpu_ptr) { -+ r = amdgpu_amdkfd_alloc_gtt_mem(adev, -+ AMDGPU_MES_PROC_CTX_SIZE, -+ &pdd->proc_ctx_bo, -+ &pdd->proc_ctx_gpu_addr, -+ &pdd->proc_ctx_cpu_ptr, -+ false); -+ if (r) { -+ dev_err(adev->dev, -+ "failed to allocate process context bo\n"); -+ return r; -+ } -+ memset(pdd->proc_ctx_cpu_ptr, 0, AMDGPU_MES_PROC_CTX_SIZE); -+ } -+ - return amdgpu_mes_set_shader_debugger(pdd->dev->adev, pdd->proc_ctx_gpu_addr, spi_dbg_cntl, - pdd->watch_points, flags, sq_trap_en); - } -diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h -index 5f2eac868b7472..cc5e01df151356 100644 ---- a/drivers/gpu/drm/amd/display/dc/dc.h -+++ b/drivers/gpu/drm/amd/display/dc/dc.h -@@ -49,7 +49,7 @@ struct dmub_notification; - - #define DC_VER "3.2.247" - --#define MAX_SURFACES 3 -+#define MAX_SURFACES 4 - #define MAX_PLANES 6 - #define MAX_STREAMS 6 - #define MIN_VIEWPORT_SIZE 12 -diff --git a/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h b/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h -index 072bd053960594..6b2ab4ec2b5ffe 100644 ---- a/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h -+++ b/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h -@@ -66,11 +66,15 @@ static inline double dml_max5(double a, double b, double c, double d, double e) - - static inline double dml_ceil(double a, double granularity) - { -+ if (granularity == 0) -+ return 0; - return (double) dcn_bw_ceil2(a, granularity); - } - - static inline double dml_floor(double a, double granularity) - { -+ if (granularity == 0) -+ return 0; - return (double) dcn_bw_floor2(a, granularity); - } - -@@ -114,11 +118,15 @@ static inline double dml_ceil_2(double f) - - static inline double dml_ceil_ex(double x, double granularity) - { -+ if (granularity == 0) -+ return 0; - return (double) dcn_bw_ceil2(x, granularity); - } - - static inline double dml_floor_ex(double x, double granularity) - { -+ if (granularity == 0) -+ return 0; - return (double) dcn_bw_floor2(x, granularity); - } - -diff --git a/drivers/gpu/drm/mediatek/Kconfig b/drivers/gpu/drm/mediatek/Kconfig -index 76cab28e010c51..d2652751d1904c 100644 ---- a/drivers/gpu/drm/mediatek/Kconfig -+++ b/drivers/gpu/drm/mediatek/Kconfig -@@ -10,9 +10,6 @@ config DRM_MEDIATEK - select DRM_KMS_HELPER - select DRM_MIPI_DSI - select DRM_PANEL -- select MEMORY -- select MTK_SMI -- select PHY_MTK_MIPI_DSI - select VIDEOMODE_HELPERS - help - Choose this option if you have a Mediatek SoCs. -@@ -23,7 +20,6 @@ config DRM_MEDIATEK - config DRM_MEDIATEK_DP - tristate "DRM DPTX Support for MediaTek SoCs" - depends on DRM_MEDIATEK -- select PHY_MTK_DP - select DRM_DISPLAY_HELPER - select DRM_DISPLAY_DP_HELPER - select DRM_DP_AUX_BUS -@@ -34,6 +30,5 @@ config DRM_MEDIATEK_HDMI - tristate "DRM HDMI Support for Mediatek SoCs" - depends on DRM_MEDIATEK - select SND_SOC_HDMI_CODEC if SND_SOC -- select PHY_MTK_HDMI - help - DRM/KMS HDMI driver for Mediatek SoCs -diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c -index 6f15069da8b020..ce0f441e3f136c 100644 ---- a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c -+++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c -@@ -403,6 +403,29 @@ static unsigned int ovl_fmt_convert(struct mtk_disp_ovl *ovl, unsigned int fmt) - } - } - -+static void mtk_ovl_afbc_layer_config(struct mtk_disp_ovl *ovl, -+ unsigned int idx, -+ struct mtk_plane_pending_state *pending, -+ struct cmdq_pkt *cmdq_pkt) -+{ -+ unsigned int pitch_msb = pending->pitch >> 16; -+ unsigned int hdr_pitch = pending->hdr_pitch; -+ unsigned int hdr_addr = pending->hdr_addr; -+ -+ if (pending->modifier != DRM_FORMAT_MOD_LINEAR) { -+ mtk_ddp_write_relaxed(cmdq_pkt, hdr_addr, &ovl->cmdq_reg, ovl->regs, -+ DISP_REG_OVL_HDR_ADDR(ovl, idx)); -+ mtk_ddp_write_relaxed(cmdq_pkt, -+ OVL_PITCH_MSB_2ND_SUBBUF | pitch_msb, -+ &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH_MSB(idx)); -+ mtk_ddp_write_relaxed(cmdq_pkt, hdr_pitch, &ovl->cmdq_reg, ovl->regs, -+ DISP_REG_OVL_HDR_PITCH(ovl, idx)); -+ } else { -+ mtk_ddp_write_relaxed(cmdq_pkt, pitch_msb, -+ &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH_MSB(idx)); -+ } -+} -+ - void mtk_ovl_layer_config(struct device *dev, unsigned int idx, - struct mtk_plane_state *state, - struct cmdq_pkt *cmdq_pkt) -@@ -410,24 +433,12 @@ void mtk_ovl_layer_config(struct device *dev, unsigned int idx, - struct mtk_disp_ovl *ovl = dev_get_drvdata(dev); - struct mtk_plane_pending_state *pending = &state->pending; - unsigned int addr = pending->addr; -- unsigned int hdr_addr = pending->hdr_addr; -- unsigned int pitch = pending->pitch; -- unsigned int hdr_pitch = pending->hdr_pitch; -+ unsigned int pitch_lsb = pending->pitch & GENMASK(15, 0); - unsigned int fmt = pending->format; - unsigned int offset = (pending->y << 16) | pending->x; - unsigned int src_size = (pending->height << 16) | pending->width; - unsigned int ignore_pixel_alpha = 0; - unsigned int con; -- bool is_afbc = pending->modifier != DRM_FORMAT_MOD_LINEAR; -- union overlay_pitch { -- struct split_pitch { -- u16 lsb; -- u16 msb; -- } split_pitch; -- u32 pitch; -- } overlay_pitch; -- -- overlay_pitch.pitch = pitch; - - if (!pending->enable) { - mtk_ovl_layer_off(dev, idx, cmdq_pkt); -@@ -457,11 +468,12 @@ void mtk_ovl_layer_config(struct device *dev, unsigned int idx, - } - - if (ovl->data->supports_afbc) -- mtk_ovl_set_afbc(ovl, cmdq_pkt, idx, is_afbc); -+ mtk_ovl_set_afbc(ovl, cmdq_pkt, idx, -+ pending->modifier != DRM_FORMAT_MOD_LINEAR); - - mtk_ddp_write_relaxed(cmdq_pkt, con, &ovl->cmdq_reg, ovl->regs, - DISP_REG_OVL_CON(idx)); -- mtk_ddp_write_relaxed(cmdq_pkt, overlay_pitch.split_pitch.lsb | ignore_pixel_alpha, -+ mtk_ddp_write_relaxed(cmdq_pkt, pitch_lsb | ignore_pixel_alpha, - &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH(idx)); - mtk_ddp_write_relaxed(cmdq_pkt, src_size, &ovl->cmdq_reg, ovl->regs, - DISP_REG_OVL_SRC_SIZE(idx)); -@@ -470,19 +482,8 @@ void mtk_ovl_layer_config(struct device *dev, unsigned int idx, - mtk_ddp_write_relaxed(cmdq_pkt, addr, &ovl->cmdq_reg, ovl->regs, - DISP_REG_OVL_ADDR(ovl, idx)); - -- if (is_afbc) { -- mtk_ddp_write_relaxed(cmdq_pkt, hdr_addr, &ovl->cmdq_reg, ovl->regs, -- DISP_REG_OVL_HDR_ADDR(ovl, idx)); -- mtk_ddp_write_relaxed(cmdq_pkt, -- OVL_PITCH_MSB_2ND_SUBBUF | overlay_pitch.split_pitch.msb, -- &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH_MSB(idx)); -- mtk_ddp_write_relaxed(cmdq_pkt, hdr_pitch, &ovl->cmdq_reg, ovl->regs, -- DISP_REG_OVL_HDR_PITCH(ovl, idx)); -- } else { -- mtk_ddp_write_relaxed(cmdq_pkt, -- overlay_pitch.split_pitch.msb, -- &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH_MSB(idx)); -- } -+ if (ovl->data->supports_afbc) -+ mtk_ovl_afbc_layer_config(ovl, idx, pending, cmdq_pkt); - - mtk_ovl_set_bit_depth(dev, idx, fmt, cmdq_pkt); - mtk_ovl_layer_on(dev, idx, cmdq_pkt); -diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c -index 48a4defbc66cc8..be4de26c77f917 100644 ---- a/drivers/gpu/drm/mediatek/mtk_dp.c -+++ b/drivers/gpu/drm/mediatek/mtk_dp.c -@@ -458,18 +458,16 @@ static int mtk_dp_set_color_format(struct mtk_dp *mtk_dp, - enum dp_pixelformat color_format) - { - u32 val; -- -- /* update MISC0 */ -- mtk_dp_update_bits(mtk_dp, MTK_DP_ENC0_P0_3034, -- color_format << DP_TEST_COLOR_FORMAT_SHIFT, -- DP_TEST_COLOR_FORMAT_MASK); -+ u32 misc0_color; - - switch (color_format) { - case DP_PIXELFORMAT_YUV422: - val = PIXEL_ENCODE_FORMAT_DP_ENC0_P0_YCBCR422; -+ misc0_color = DP_COLOR_FORMAT_YCbCr422; - break; - case DP_PIXELFORMAT_RGB: - val = PIXEL_ENCODE_FORMAT_DP_ENC0_P0_RGB; -+ misc0_color = DP_COLOR_FORMAT_RGB; - break; - default: - drm_warn(mtk_dp->drm_dev, "Unsupported color format: %d\n", -@@ -477,6 +475,11 @@ static int mtk_dp_set_color_format(struct mtk_dp *mtk_dp, - return -EINVAL; - } - -+ /* update MISC0 */ -+ mtk_dp_update_bits(mtk_dp, MTK_DP_ENC0_P0_3034, -+ misc0_color, -+ DP_TEST_COLOR_FORMAT_MASK); -+ - mtk_dp_update_bits(mtk_dp, MTK_DP_ENC0_P0_303C, - val, PIXEL_ENCODE_FORMAT_DP_ENC0_P0_MASK); - return 0; -@@ -2002,7 +2005,6 @@ static enum drm_connector_status mtk_dp_bdg_detect(struct drm_bridge *bridge) - struct mtk_dp *mtk_dp = mtk_dp_from_bridge(bridge); - enum drm_connector_status ret = connector_status_disconnected; - bool enabled = mtk_dp->enabled; -- u8 sink_count = 0; - - if (!mtk_dp->train_info.cable_plugged_in) - return ret; -@@ -2017,8 +2019,8 @@ static enum drm_connector_status mtk_dp_bdg_detect(struct drm_bridge *bridge) - * function, we just need to check the HPD connection to check - * whether we connect to a sink device. - */ -- drm_dp_dpcd_readb(&mtk_dp->aux, DP_SINK_COUNT, &sink_count); -- if (DP_GET_SINK_COUNT(sink_count)) -+ -+ if (drm_dp_read_sink_count(&mtk_dp->aux) > 0) - ret = connector_status_connected; - - if (!enabled) -@@ -2310,12 +2312,19 @@ mtk_dp_bridge_mode_valid(struct drm_bridge *bridge, - { - struct mtk_dp *mtk_dp = mtk_dp_from_bridge(bridge); - u32 bpp = info->color_formats & DRM_COLOR_FORMAT_YCBCR422 ? 16 : 24; -- u32 rate = min_t(u32, drm_dp_max_link_rate(mtk_dp->rx_cap) * -- drm_dp_max_lane_count(mtk_dp->rx_cap), -- drm_dp_bw_code_to_link_rate(mtk_dp->max_linkrate) * -- mtk_dp->max_lanes); -+ u32 lane_count_min = mtk_dp->train_info.lane_count; -+ u32 rate = drm_dp_bw_code_to_link_rate(mtk_dp->train_info.link_rate) * -+ lane_count_min; - -- if (rate < mode->clock * bpp / 8) -+ /* -+ *FEC overhead is approximately 2.4% from DP 1.4a spec 2.2.1.4.2. -+ *The down-spread amplitude shall either be disabled (0.0%) or up -+ *to 0.5% from 1.4a 3.5.2.6. Add up to approximately 3% total overhead. -+ * -+ *Because rate is already divided by 10, -+ *mode->clock does not need to be multiplied by 10 -+ */ -+ if ((rate * 97 / 100) < (mode->clock * bpp / 8)) - return MODE_CLOCK_HIGH; - - return MODE_OK; -@@ -2356,10 +2365,9 @@ static u32 *mtk_dp_bridge_atomic_get_input_bus_fmts(struct drm_bridge *bridge, - struct drm_display_mode *mode = &crtc_state->adjusted_mode; - struct drm_display_info *display_info = - &conn_state->connector->display_info; -- u32 rate = min_t(u32, drm_dp_max_link_rate(mtk_dp->rx_cap) * -- drm_dp_max_lane_count(mtk_dp->rx_cap), -- drm_dp_bw_code_to_link_rate(mtk_dp->max_linkrate) * -- mtk_dp->max_lanes); -+ u32 lane_count_min = mtk_dp->train_info.lane_count; -+ u32 rate = drm_dp_bw_code_to_link_rate(mtk_dp->train_info.link_rate) * -+ lane_count_min; - - *num_input_fmts = 0; - -@@ -2368,8 +2376,8 @@ static u32 *mtk_dp_bridge_atomic_get_input_bus_fmts(struct drm_bridge *bridge, - * datarate of YUV422 and sink device supports YUV422, we output YUV422 - * format. Use this condition, we can support more resolution. - */ -- if ((rate < (mode->clock * 24 / 8)) && -- (rate > (mode->clock * 16 / 8)) && -+ if (((rate * 97 / 100) < (mode->clock * 24 / 8)) && -+ ((rate * 97 / 100) > (mode->clock * 16 / 8)) && - (display_info->color_formats & DRM_COLOR_FORMAT_YCBCR422)) { - input_fmts = kcalloc(1, sizeof(*input_fmts), GFP_KERNEL); - if (!input_fmts) -diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c -index 600f4ccc90d378..8b41a07c3641f5 100644 ---- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c -+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c -@@ -633,6 +633,8 @@ static int mtk_drm_bind(struct device *dev) - err_free: - private->drm = NULL; - drm_dev_put(drm); -+ for (i = 0; i < private->data->mmsys_dev_num; i++) -+ private->all_drm_private[i]->drm = NULL; - return ret; - } - -diff --git a/drivers/hwmon/drivetemp.c b/drivers/hwmon/drivetemp.c -index 6bdd21aa005ab8..2a4ec55ddb47ed 100644 ---- a/drivers/hwmon/drivetemp.c -+++ b/drivers/hwmon/drivetemp.c -@@ -165,6 +165,7 @@ static int drivetemp_scsi_command(struct drivetemp_data *st, - { - u8 scsi_cmd[MAX_COMMAND_SIZE]; - enum req_op op; -+ int err; - - memset(scsi_cmd, 0, sizeof(scsi_cmd)); - scsi_cmd[0] = ATA_16; -@@ -192,8 +193,11 @@ static int drivetemp_scsi_command(struct drivetemp_data *st, - scsi_cmd[12] = lba_high; - scsi_cmd[14] = ata_command; - -- return scsi_execute_cmd(st->sdev, scsi_cmd, op, st->smartdata, -- ATA_SECT_SIZE, HZ, 5, NULL); -+ err = scsi_execute_cmd(st->sdev, scsi_cmd, op, st->smartdata, -+ ATA_SECT_SIZE, HZ, 5, NULL); -+ if (err > 0) -+ err = -EIO; -+ return err; - } - - static int drivetemp_ata_command(struct drivetemp_data *st, u8 feature, -diff --git a/drivers/iio/adc/ad7124.c b/drivers/iio/adc/ad7124.c -index 34e06e2e51d625..d2060d394c8d27 100644 ---- a/drivers/iio/adc/ad7124.c -+++ b/drivers/iio/adc/ad7124.c -@@ -923,6 +923,9 @@ static int ad7124_setup(struct ad7124_state *st) - * set all channels to this default value. - */ - ad7124_set_channel_odr(st, i, 10); -+ -+ /* Disable all channels to prevent unintended conversions. */ -+ ad_sd_write_reg(&st->sd, AD7124_CHANNEL(i), 2, 0); - } - - return ret; -diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c -index de6650f9c4b1c2..55f0c1afe505e7 100644 ---- a/drivers/iio/adc/at91_adc.c -+++ b/drivers/iio/adc/at91_adc.c -@@ -984,7 +984,7 @@ static int at91_ts_register(struct iio_dev *idev, - return ret; - - err: -- input_free_device(st->ts_input); -+ input_free_device(input); - return ret; - } - -diff --git a/drivers/iio/adc/rockchip_saradc.c b/drivers/iio/adc/rockchip_saradc.c -index 1c0042fbbb5481..929cba215d99ab 100644 ---- a/drivers/iio/adc/rockchip_saradc.c -+++ b/drivers/iio/adc/rockchip_saradc.c -@@ -368,6 +368,8 @@ static irqreturn_t rockchip_saradc_trigger_handler(int irq, void *p) - int ret; - int i, j = 0; - -+ memset(&data, 0, sizeof(data)); -+ - mutex_lock(&info->lock); - - for_each_set_bit(i, i_dev->active_scan_mask, i_dev->masklength) { -diff --git a/drivers/iio/adc/ti-ads124s08.c b/drivers/iio/adc/ti-ads124s08.c -index 4ca62121f0d176..c6004f2b5d3d1c 100644 ---- a/drivers/iio/adc/ti-ads124s08.c -+++ b/drivers/iio/adc/ti-ads124s08.c -@@ -183,9 +183,9 @@ static int ads124s_reset(struct iio_dev *indio_dev) - struct ads124s_private *priv = iio_priv(indio_dev); - - if (priv->reset_gpio) { -- gpiod_set_value(priv->reset_gpio, 0); -+ gpiod_set_value_cansleep(priv->reset_gpio, 0); - udelay(200); -- gpiod_set_value(priv->reset_gpio, 1); -+ gpiod_set_value_cansleep(priv->reset_gpio, 1); - } else { - return ads124s_write_cmd(indio_dev, ADS124S08_CMD_RESET); - } -diff --git a/drivers/iio/adc/ti-ads8688.c b/drivers/iio/adc/ti-ads8688.c -index ef06a897421ac4..66a3b67019b8d9 100644 ---- a/drivers/iio/adc/ti-ads8688.c -+++ b/drivers/iio/adc/ti-ads8688.c -@@ -382,7 +382,7 @@ static irqreturn_t ads8688_trigger_handler(int irq, void *p) - struct iio_poll_func *pf = p; - struct iio_dev *indio_dev = pf->indio_dev; - /* Ensure naturally aligned timestamp */ -- u16 buffer[ADS8688_MAX_CHANNELS + sizeof(s64)/sizeof(u16)] __aligned(8); -+ u16 buffer[ADS8688_MAX_CHANNELS + sizeof(s64)/sizeof(u16)] __aligned(8) = { }; - int i, j = 0; - - for (i = 0; i < indio_dev->masklength; i++) { -diff --git a/drivers/iio/dummy/iio_simple_dummy_buffer.c b/drivers/iio/dummy/iio_simple_dummy_buffer.c -index 9b2f99449a8292..bc85fe6610c138 100644 ---- a/drivers/iio/dummy/iio_simple_dummy_buffer.c -+++ b/drivers/iio/dummy/iio_simple_dummy_buffer.c -@@ -48,7 +48,7 @@ static irqreturn_t iio_simple_dummy_trigger_h(int irq, void *p) - int i = 0, j; - u16 *data; - -- data = kmalloc(indio_dev->scan_bytes, GFP_KERNEL); -+ data = kzalloc(indio_dev->scan_bytes, GFP_KERNEL); - if (!data) - goto done; - -diff --git a/drivers/iio/gyro/fxas21002c_core.c b/drivers/iio/gyro/fxas21002c_core.c -index c28d17ca6f5ee0..aabc5e2d788d15 100644 ---- a/drivers/iio/gyro/fxas21002c_core.c -+++ b/drivers/iio/gyro/fxas21002c_core.c -@@ -730,14 +730,21 @@ static irqreturn_t fxas21002c_trigger_handler(int irq, void *p) - int ret; - - mutex_lock(&data->lock); -+ ret = fxas21002c_pm_get(data); -+ if (ret < 0) -+ goto out_unlock; -+ - ret = regmap_bulk_read(data->regmap, FXAS21002C_REG_OUT_X_MSB, - data->buffer, CHANNEL_SCAN_MAX * sizeof(s16)); - if (ret < 0) -- goto out_unlock; -+ goto out_pm_put; - - iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, - data->timestamp); - -+out_pm_put: -+ fxas21002c_pm_put(data); -+ - out_unlock: - mutex_unlock(&data->lock); - -diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c -index a5e81906e37ecf..d938bc45439729 100644 ---- a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c -+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c -@@ -17,6 +17,7 @@ - #include - - #include -+#include - - #include "inv_icm42600.h" - #include "inv_icm42600_buffer.h" -@@ -725,6 +726,8 @@ static int inv_icm42600_suspend(struct device *dev) - static int inv_icm42600_resume(struct device *dev) - { - struct inv_icm42600_state *st = dev_get_drvdata(dev); -+ struct inv_sensors_timestamp *gyro_ts = iio_priv(st->indio_gyro); -+ struct inv_sensors_timestamp *accel_ts = iio_priv(st->indio_accel); - int ret; - - mutex_lock(&st->lock); -@@ -745,9 +748,12 @@ static int inv_icm42600_resume(struct device *dev) - goto out_unlock; - - /* restore FIFO data streaming */ -- if (st->fifo.on) -+ if (st->fifo.on) { -+ inv_sensors_timestamp_reset(gyro_ts); -+ inv_sensors_timestamp_reset(accel_ts); - ret = regmap_write(st->map, INV_ICM42600_REG_FIFO_CONFIG, - INV_ICM42600_FIFO_CONFIG_STREAM); -+ } - - out_unlock: - mutex_unlock(&st->lock); -diff --git a/drivers/iio/imu/kmx61.c b/drivers/iio/imu/kmx61.c -index 958167b31241e6..09d2db8f8bae14 100644 ---- a/drivers/iio/imu/kmx61.c -+++ b/drivers/iio/imu/kmx61.c -@@ -1192,7 +1192,7 @@ static irqreturn_t kmx61_trigger_handler(int irq, void *p) - struct kmx61_data *data = kmx61_get_data(indio_dev); - int bit, ret, i = 0; - u8 base; -- s16 buffer[8]; -+ s16 buffer[8] = { }; - - if (indio_dev == data->acc_indio_dev) - base = KMX61_ACC_XOUT_L; -diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c -index 079e30c522bbd0..8255035ff124f3 100644 ---- a/drivers/iio/inkern.c -+++ b/drivers/iio/inkern.c -@@ -514,7 +514,7 @@ struct iio_channel *iio_channel_get_all(struct device *dev) - return chans; - - error_free_chans: -- for (i = 0; i < nummaps; i++) -+ for (i = 0; i < mapind; i++) - iio_device_put(chans[i].indio_dev); - kfree(chans); - error_ret: -diff --git a/drivers/iio/light/vcnl4035.c b/drivers/iio/light/vcnl4035.c -index 56bbefbc0ae643..fe3c4c5db6205d 100644 ---- a/drivers/iio/light/vcnl4035.c -+++ b/drivers/iio/light/vcnl4035.c -@@ -105,7 +105,7 @@ static irqreturn_t vcnl4035_trigger_consumer_handler(int irq, void *p) - struct iio_dev *indio_dev = pf->indio_dev; - struct vcnl4035_data *data = iio_priv(indio_dev); - /* Ensure naturally aligned timestamp */ -- u8 buffer[ALIGN(sizeof(u16), sizeof(s64)) + sizeof(s64)] __aligned(8); -+ u8 buffer[ALIGN(sizeof(u16), sizeof(s64)) + sizeof(s64)] __aligned(8) = { }; - int ret; - - ret = regmap_read(data->regmap, VCNL4035_ALS_DATA, (int *)buffer); -diff --git a/drivers/iio/pressure/zpa2326.c b/drivers/iio/pressure/zpa2326.c -index 421e059d1f190a..ef1d0349f4247d 100644 ---- a/drivers/iio/pressure/zpa2326.c -+++ b/drivers/iio/pressure/zpa2326.c -@@ -586,6 +586,8 @@ static int zpa2326_fill_sample_buffer(struct iio_dev *indio_dev, - } sample; - int err; - -+ memset(&sample, 0, sizeof(sample)); -+ - if (test_bit(0, indio_dev->active_scan_mask)) { - /* Get current pressure from hardware FIFO. */ - err = zpa2326_dequeue_pressure(indio_dev, &sample.pressure); -diff --git a/drivers/md/dm-ebs-target.c b/drivers/md/dm-ebs-target.c -index 435b45201f4d61..66d9622b684dd4 100644 ---- a/drivers/md/dm-ebs-target.c -+++ b/drivers/md/dm-ebs-target.c -@@ -442,7 +442,7 @@ static int ebs_iterate_devices(struct dm_target *ti, - static struct target_type ebs_target = { - .name = "ebs", - .version = {1, 0, 1}, -- .features = DM_TARGET_PASSES_INTEGRITY, -+ .features = 0, - .module = THIS_MODULE, - .ctr = ebs_ctr, - .dtr = ebs_dtr, -diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c -index 032cefe3e351aa..7935363d13b1d0 100644 ---- a/drivers/md/dm-thin.c -+++ b/drivers/md/dm-thin.c -@@ -2334,10 +2334,9 @@ static struct thin_c *get_first_thin(struct pool *pool) - struct thin_c *tc = NULL; - - rcu_read_lock(); -- if (!list_empty(&pool->active_thins)) { -- tc = list_entry_rcu(pool->active_thins.next, struct thin_c, list); -+ tc = list_first_or_null_rcu(&pool->active_thins, struct thin_c, list); -+ if (tc) - thin_get(tc); -- } - rcu_read_unlock(); - - return tc; -diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c -index b475200d8586a6..6a7a17c489c998 100644 ---- a/drivers/md/dm-verity-fec.c -+++ b/drivers/md/dm-verity-fec.c -@@ -60,14 +60,19 @@ static int fec_decode_rs8(struct dm_verity *v, struct dm_verity_fec_io *fio, - * to the data block. Caller is responsible for releasing buf. - */ - static u8 *fec_read_parity(struct dm_verity *v, u64 rsb, int index, -- unsigned int *offset, struct dm_buffer **buf) -+ unsigned int *offset, unsigned int par_buf_offset, -+ struct dm_buffer **buf) - { - u64 position, block, rem; - u8 *res; - -+ /* We have already part of parity bytes read, skip to the next block */ -+ if (par_buf_offset) -+ index++; -+ - position = (index + rsb) * v->fec->roots; - block = div64_u64_rem(position, v->fec->io_size, &rem); -- *offset = (unsigned int)rem; -+ *offset = par_buf_offset ? 0 : (unsigned int)rem; - - res = dm_bufio_read(v->fec->bufio, block, buf); - if (IS_ERR(res)) { -@@ -127,10 +132,11 @@ static int fec_decode_bufs(struct dm_verity *v, struct dm_verity_fec_io *fio, - { - int r, corrected = 0, res; - struct dm_buffer *buf; -- unsigned int n, i, offset; -- u8 *par, *block; -+ unsigned int n, i, offset, par_buf_offset = 0; -+ u8 *par, *block, par_buf[DM_VERITY_FEC_RSM - DM_VERITY_FEC_MIN_RSN]; - -- par = fec_read_parity(v, rsb, block_offset, &offset, &buf); -+ par = fec_read_parity(v, rsb, block_offset, &offset, -+ par_buf_offset, &buf); - if (IS_ERR(par)) - return PTR_ERR(par); - -@@ -140,7 +146,8 @@ static int fec_decode_bufs(struct dm_verity *v, struct dm_verity_fec_io *fio, - */ - fec_for_each_buffer_rs_block(fio, n, i) { - block = fec_buffer_rs_block(v, fio, n, i); -- res = fec_decode_rs8(v, fio, block, &par[offset], neras); -+ memcpy(&par_buf[par_buf_offset], &par[offset], v->fec->roots - par_buf_offset); -+ res = fec_decode_rs8(v, fio, block, par_buf, neras); - if (res < 0) { - r = res; - goto error; -@@ -153,12 +160,21 @@ static int fec_decode_bufs(struct dm_verity *v, struct dm_verity_fec_io *fio, - if (block_offset >= 1 << v->data_dev_block_bits) - goto done; - -- /* read the next block when we run out of parity bytes */ -- offset += v->fec->roots; -+ /* Read the next block when we run out of parity bytes */ -+ offset += (v->fec->roots - par_buf_offset); -+ /* Check if parity bytes are split between blocks */ -+ if (offset < v->fec->io_size && (offset + v->fec->roots) > v->fec->io_size) { -+ par_buf_offset = v->fec->io_size - offset; -+ memcpy(par_buf, &par[offset], par_buf_offset); -+ offset += par_buf_offset; -+ } else -+ par_buf_offset = 0; -+ - if (offset >= v->fec->io_size) { - dm_bufio_release(buf); - -- par = fec_read_parity(v, rsb, block_offset, &offset, &buf); -+ par = fec_read_parity(v, rsb, block_offset, &offset, -+ par_buf_offset, &buf); - if (IS_ERR(par)) - return PTR_ERR(par); - } -@@ -743,10 +759,7 @@ int verity_fec_ctr(struct dm_verity *v) - return -E2BIG; - } - -- if ((f->roots << SECTOR_SHIFT) & ((1 << v->data_dev_block_bits) - 1)) -- f->io_size = 1 << v->data_dev_block_bits; -- else -- f->io_size = v->fec->roots << SECTOR_SHIFT; -+ f->io_size = 1 << v->data_dev_block_bits; - - f->bufio = dm_bufio_client_create(f->dev->bdev, - f->io_size, -diff --git a/drivers/md/persistent-data/dm-array.c b/drivers/md/persistent-data/dm-array.c -index 798c9c53a34353..b1fdfe53e93778 100644 ---- a/drivers/md/persistent-data/dm-array.c -+++ b/drivers/md/persistent-data/dm-array.c -@@ -917,23 +917,27 @@ static int load_ablock(struct dm_array_cursor *c) - if (c->block) - unlock_ablock(c->info, c->block); - -- c->block = NULL; -- c->ab = NULL; - c->index = 0; - - r = dm_btree_cursor_get_value(&c->cursor, &key, &value_le); - if (r) { - DMERR("dm_btree_cursor_get_value failed"); -- dm_btree_cursor_end(&c->cursor); -+ goto out; - - } else { - r = get_ablock(c->info, le64_to_cpu(value_le), &c->block, &c->ab); - if (r) { - DMERR("get_ablock failed"); -- dm_btree_cursor_end(&c->cursor); -+ goto out; - } - } - -+ return 0; -+ -+out: -+ dm_btree_cursor_end(&c->cursor); -+ c->block = NULL; -+ c->ab = NULL; - return r; - } - -@@ -956,10 +960,10 @@ EXPORT_SYMBOL_GPL(dm_array_cursor_begin); - - void dm_array_cursor_end(struct dm_array_cursor *c) - { -- if (c->block) { -+ if (c->block) - unlock_ablock(c->info, c->block); -- dm_btree_cursor_end(&c->cursor); -- } -+ -+ dm_btree_cursor_end(&c->cursor); - } - EXPORT_SYMBOL_GPL(dm_array_cursor_end); - -@@ -999,6 +1003,7 @@ int dm_array_cursor_skip(struct dm_array_cursor *c, uint32_t count) - } - - count -= remaining; -+ c->index += (remaining - 1); - r = dm_array_cursor_next(c); - - } while (!r); -diff --git a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c -index e616e3ec2b42fd..3c1359d8d4e692 100644 ---- a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c -+++ b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c -@@ -148,7 +148,7 @@ static int pci1xxxx_gpio_set_config(struct gpio_chip *gpio, unsigned int offset, - pci1xxx_assign_bit(priv->reg_base, OPENDRAIN_OFFSET(offset), (offset % 32), true); - break; - default: -- ret = -EOPNOTSUPP; -+ ret = -ENOTSUPP; - break; - } - spin_unlock_irqrestore(&priv->lock, flags); -@@ -277,7 +277,7 @@ static irqreturn_t pci1xxxx_gpio_irq_handler(int irq, void *dev_id) - writel(BIT(bit), priv->reg_base + INTR_STATUS_OFFSET(gpiobank)); - spin_unlock_irqrestore(&priv->lock, flags); - irq = irq_find_mapping(gc->irq.domain, (bit + (gpiobank * 32))); -- generic_handle_irq(irq); -+ handle_nested_irq(irq); - } - } - spin_lock_irqsave(&priv->lock, flags); -diff --git a/drivers/net/ethernet/amd/pds_core/devlink.c b/drivers/net/ethernet/amd/pds_core/devlink.c -index d8218bb153d9ed..971d4278280d65 100644 ---- a/drivers/net/ethernet/amd/pds_core/devlink.c -+++ b/drivers/net/ethernet/amd/pds_core/devlink.c -@@ -117,7 +117,7 @@ int pdsc_dl_info_get(struct devlink *dl, struct devlink_info_req *req, - if (err && err != -EIO) - return err; - -- listlen = fw_list.num_fw_slots; -+ listlen = min(fw_list.num_fw_slots, ARRAY_SIZE(fw_list.fw_names)); - for (i = 0; i < listlen; i++) { - if (i < ARRAY_SIZE(fw_slotnames)) - strscpy(buf, fw_slotnames[i], sizeof(buf)); -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c -index 7689086371e03c..2980963208cbf4 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c -@@ -159,7 +159,7 @@ int bnxt_send_msg(struct bnxt_en_dev *edev, - - rc = hwrm_req_replace(bp, req, fw_msg->msg, fw_msg->msg_len); - if (rc) -- return rc; -+ goto drop_req; - - hwrm_req_timeout(bp, req, fw_msg->timeout); - resp = hwrm_req_hold(bp, req); -@@ -171,6 +171,7 @@ int bnxt_send_msg(struct bnxt_en_dev *edev, - - memcpy(fw_msg->resp, resp, resp_len); - } -+drop_req: - hwrm_req_drop(bp, req); - return rc; - } -diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c -index b215ff14da1bc4..3989c9491f0f1e 100644 ---- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c -+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c -@@ -1799,7 +1799,10 @@ void cxgb4_remove_tid(struct tid_info *t, unsigned int chan, unsigned int tid, - struct adapter *adap = container_of(t, struct adapter, tids); - struct sk_buff *skb; - -- WARN_ON(tid_out_of_range(&adap->tids, tid)); -+ if (tid_out_of_range(&adap->tids, tid)) { -+ dev_err(adap->pdev_dev, "tid %d out of range\n", tid); -+ return; -+ } - - if (t->tid_tab[tid - adap->tids.tid_base]) { - t->tid_tab[tid - adap->tids.tid_base] = NULL; -diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c -index d70305654e7d07..90d433b36799fb 100644 ---- a/drivers/net/ethernet/google/gve/gve_main.c -+++ b/drivers/net/ethernet/google/gve/gve_main.c -@@ -2009,14 +2009,18 @@ static void gve_service_task(struct work_struct *work) - - static void gve_set_netdev_xdp_features(struct gve_priv *priv) - { -+ xdp_features_t xdp_features; -+ - if (priv->queue_format == GVE_GQI_QPL_FORMAT) { -- priv->dev->xdp_features = NETDEV_XDP_ACT_BASIC; -- priv->dev->xdp_features |= NETDEV_XDP_ACT_REDIRECT; -- priv->dev->xdp_features |= NETDEV_XDP_ACT_NDO_XMIT; -- priv->dev->xdp_features |= NETDEV_XDP_ACT_XSK_ZEROCOPY; -+ xdp_features = NETDEV_XDP_ACT_BASIC; -+ xdp_features |= NETDEV_XDP_ACT_REDIRECT; -+ xdp_features |= NETDEV_XDP_ACT_NDO_XMIT; -+ xdp_features |= NETDEV_XDP_ACT_XSK_ZEROCOPY; - } else { -- priv->dev->xdp_features = 0; -+ xdp_features = 0; - } -+ -+ xdp_set_features_flag(priv->dev, xdp_features); - } - - static int gve_init_priv(struct gve_priv *priv, bool skip_describe_device) -diff --git a/drivers/net/ethernet/intel/ice/ice_ptp_consts.h b/drivers/net/ethernet/intel/ice/ice_ptp_consts.h -index 4109aa3b2fcd33..87ce20540f572d 100644 ---- a/drivers/net/ethernet/intel/ice/ice_ptp_consts.h -+++ b/drivers/net/ethernet/intel/ice/ice_ptp_consts.h -@@ -359,9 +359,9 @@ const struct ice_vernier_info_e822 e822_vernier[NUM_ICE_PTP_LNK_SPD] = { - /* rx_desk_rsgb_par */ - 644531250, /* 644.53125 MHz Reed Solomon gearbox */ - /* tx_desk_rsgb_pcs */ -- 644531250, /* 644.53125 MHz Reed Solomon gearbox */ -+ 390625000, /* 390.625 MHz Reed Solomon gearbox */ - /* rx_desk_rsgb_pcs */ -- 644531250, /* 644.53125 MHz Reed Solomon gearbox */ -+ 390625000, /* 390.625 MHz Reed Solomon gearbox */ - /* tx_fixed_delay */ - 1620, - /* pmd_adj_divisor */ -diff --git a/drivers/net/ethernet/intel/igc/igc_base.c b/drivers/net/ethernet/intel/igc/igc_base.c -index a1d815af507d90..1613b562d17c52 100644 ---- a/drivers/net/ethernet/intel/igc/igc_base.c -+++ b/drivers/net/ethernet/intel/igc/igc_base.c -@@ -68,8 +68,11 @@ static s32 igc_init_nvm_params_base(struct igc_hw *hw) - u32 eecd = rd32(IGC_EECD); - u16 size; - -- size = (u16)((eecd & IGC_EECD_SIZE_EX_MASK) >> -- IGC_EECD_SIZE_EX_SHIFT); -+ /* failed to read reg and got all F's */ -+ if (!(~eecd)) -+ return -ENXIO; -+ -+ size = FIELD_GET(IGC_EECD_SIZE_EX_MASK, eecd); - - /* Added to a constant, "size" becomes the left-shift value - * for setting word_size. -@@ -162,8 +165,7 @@ static s32 igc_init_phy_params_base(struct igc_hw *hw) - phy->reset_delay_us = 100; - - /* set lan id */ -- hw->bus.func = (rd32(IGC_STATUS) & IGC_STATUS_FUNC_MASK) >> -- IGC_STATUS_FUNC_SHIFT; -+ hw->bus.func = FIELD_GET(IGC_STATUS_FUNC_MASK, rd32(IGC_STATUS)); - - /* Make sure the PHY is in a good state. Several people have reported - * firmware leaving the PHY's page select register set to something -@@ -223,6 +225,8 @@ static s32 igc_get_invariants_base(struct igc_hw *hw) - - /* NVM initialization */ - ret_val = igc_init_nvm_params_base(hw); -+ if (ret_val) -+ goto out; - switch (hw->mac.type) { - case igc_i225: - ret_val = igc_init_nvm_params_i225(hw); -diff --git a/drivers/net/ethernet/intel/igc/igc_i225.c b/drivers/net/ethernet/intel/igc/igc_i225.c -index d2562c8e8015e7..0dd61719f1edc4 100644 ---- a/drivers/net/ethernet/intel/igc/igc_i225.c -+++ b/drivers/net/ethernet/intel/igc/igc_i225.c -@@ -579,9 +579,8 @@ s32 igc_set_ltr_i225(struct igc_hw *hw, bool link) - - /* Calculate tw_system (nsec). */ - if (speed == SPEED_100) { -- tw_system = ((rd32(IGC_EEE_SU) & -- IGC_TW_SYSTEM_100_MASK) >> -- IGC_TW_SYSTEM_100_SHIFT) * 500; -+ tw_system = FIELD_GET(IGC_TW_SYSTEM_100_MASK, -+ rd32(IGC_EEE_SU)) * 500; - } else { - tw_system = (rd32(IGC_EEE_SU) & - IGC_TW_SYSTEM_1000_MASK) * 500; -diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c -index da1018d8326220..91a4722460f66a 100644 ---- a/drivers/net/ethernet/intel/igc/igc_main.c -+++ b/drivers/net/ethernet/intel/igc/igc_main.c -@@ -3708,8 +3708,7 @@ static int igc_enable_nfc_rule(struct igc_adapter *adapter, - } - - if (rule->filter.match_flags & IGC_FILTER_FLAG_VLAN_TCI) { -- int prio = (rule->filter.vlan_tci & VLAN_PRIO_MASK) >> -- VLAN_PRIO_SHIFT; -+ int prio = FIELD_GET(VLAN_PRIO_MASK, rule->filter.vlan_tci); - - err = igc_add_vlan_prio_filter(adapter, prio, rule->action); - if (err) -@@ -3731,8 +3730,7 @@ static void igc_disable_nfc_rule(struct igc_adapter *adapter, - igc_del_etype_filter(adapter, rule->filter.etype); - - if (rule->filter.match_flags & IGC_FILTER_FLAG_VLAN_TCI) { -- int prio = (rule->filter.vlan_tci & VLAN_PRIO_MASK) >> -- VLAN_PRIO_SHIFT; -+ int prio = FIELD_GET(VLAN_PRIO_MASK, rule->filter.vlan_tci); - - igc_del_vlan_prio_filter(adapter, prio); - } -diff --git a/drivers/net/ethernet/intel/igc/igc_phy.c b/drivers/net/ethernet/intel/igc/igc_phy.c -index d0d9e7170154ca..7cd8716d2ffa3a 100644 ---- a/drivers/net/ethernet/intel/igc/igc_phy.c -+++ b/drivers/net/ethernet/intel/igc/igc_phy.c -@@ -727,7 +727,7 @@ static s32 igc_write_xmdio_reg(struct igc_hw *hw, u16 addr, - */ - s32 igc_write_phy_reg_gpy(struct igc_hw *hw, u32 offset, u16 data) - { -- u8 dev_addr = (offset & GPY_MMD_MASK) >> GPY_MMD_SHIFT; -+ u8 dev_addr = FIELD_GET(GPY_MMD_MASK, offset); - s32 ret_val; - - offset = offset & GPY_REG_MASK; -@@ -758,7 +758,7 @@ s32 igc_write_phy_reg_gpy(struct igc_hw *hw, u32 offset, u16 data) - */ - s32 igc_read_phy_reg_gpy(struct igc_hw *hw, u32 offset, u16 *data) - { -- u8 dev_addr = (offset & GPY_MMD_MASK) >> GPY_MMD_SHIFT; -+ u8 dev_addr = FIELD_GET(GPY_MMD_MASK, offset); - s32 ret_val; - - offset = offset & GPY_REG_MASK; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -index 80af0fc7101fdc..3e6bd27f6315d8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -@@ -1006,6 +1006,7 @@ static void cmd_work_handler(struct work_struct *work) - complete(&ent->done); - } - up(&cmd->vars.sem); -+ complete(&ent->slotted); - return; - } - } else { -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c -index e2d61a3a7712d3..760405b805f40a 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c -@@ -1,4 +1,5 @@ - // SPDX-License-Identifier: GPL-2.0-only -+#include - #include - #include - #include -@@ -19,6 +20,8 @@ struct tegra_mgbe { - struct reset_control *rst_mac; - struct reset_control *rst_pcs; - -+ u32 iommu_sid; -+ - void __iomem *hv; - void __iomem *regs; - void __iomem *xpcs; -@@ -50,7 +53,6 @@ struct tegra_mgbe { - #define MGBE_WRAP_COMMON_INTR_ENABLE 0x8704 - #define MAC_SBD_INTR BIT(2) - #define MGBE_WRAP_AXI_ASID0_CTRL 0x8400 --#define MGBE_SID 0x6 - - static int __maybe_unused tegra_mgbe_suspend(struct device *dev) - { -@@ -84,7 +86,7 @@ static int __maybe_unused tegra_mgbe_resume(struct device *dev) - writel(MAC_SBD_INTR, mgbe->regs + MGBE_WRAP_COMMON_INTR_ENABLE); - - /* Program SID */ -- writel(MGBE_SID, mgbe->hv + MGBE_WRAP_AXI_ASID0_CTRL); -+ writel(mgbe->iommu_sid, mgbe->hv + MGBE_WRAP_AXI_ASID0_CTRL); - - value = readl(mgbe->xpcs + XPCS_WRAP_UPHY_STATUS); - if ((value & XPCS_WRAP_UPHY_STATUS_TX_P_UP) == 0) { -@@ -241,6 +243,12 @@ static int tegra_mgbe_probe(struct platform_device *pdev) - if (IS_ERR(mgbe->xpcs)) - return PTR_ERR(mgbe->xpcs); - -+ /* get controller's stream id from iommu property in device tree */ -+ if (!tegra_dev_iommu_get_stream_id(mgbe->dev, &mgbe->iommu_sid)) { -+ dev_err(mgbe->dev, "failed to get iommu stream id\n"); -+ return -EINVAL; -+ } -+ - res.addr = mgbe->regs; - res.irq = irq; - -@@ -346,7 +354,7 @@ static int tegra_mgbe_probe(struct platform_device *pdev) - writel(MAC_SBD_INTR, mgbe->regs + MGBE_WRAP_COMMON_INTR_ENABLE); - - /* Program SID */ -- writel(MGBE_SID, mgbe->hv + MGBE_WRAP_AXI_ASID0_CTRL); -+ writel(mgbe->iommu_sid, mgbe->hv + MGBE_WRAP_AXI_ASID0_CTRL); - - plat->flags |= STMMAC_FLAG_SERDES_UP_AFTER_PHY_LINKUP; - -diff --git a/drivers/net/ethernet/wangxun/libwx/wx_hw.c b/drivers/net/ethernet/wangxun/libwx/wx_hw.c -index 52130df26aee53..d6bc2309d2a388 100644 ---- a/drivers/net/ethernet/wangxun/libwx/wx_hw.c -+++ b/drivers/net/ethernet/wangxun/libwx/wx_hw.c -@@ -242,27 +242,25 @@ int wx_host_interface_command(struct wx *wx, u32 *buffer, - status = read_poll_timeout(rd32, hicr, hicr & WX_MNG_MBOX_CTL_FWRDY, 1000, - timeout * 1000, false, wx, WX_MNG_MBOX_CTL); - -+ buf[0] = rd32(wx, WX_MNG_MBOX); -+ if ((buf[0] & 0xff0000) >> 16 == 0x80) { -+ wx_err(wx, "Unknown FW command: 0x%x\n", buffer[0] & 0xff); -+ status = -EINVAL; -+ goto rel_out; -+ } -+ - /* Check command completion */ - if (status) { -- wx_dbg(wx, "Command has failed with no status valid.\n"); -- -- buf[0] = rd32(wx, WX_MNG_MBOX); -- if ((buffer[0] & 0xff) != (~buf[0] >> 24)) { -- status = -EINVAL; -- goto rel_out; -- } -- if ((buf[0] & 0xff0000) >> 16 == 0x80) { -- wx_dbg(wx, "It's unknown cmd.\n"); -- status = -EINVAL; -- goto rel_out; -- } -- -+ wx_err(wx, "Command has failed with no status valid.\n"); - wx_dbg(wx, "write value:\n"); - for (i = 0; i < dword_len; i++) - wx_dbg(wx, "%x ", buffer[i]); - wx_dbg(wx, "read value:\n"); - for (i = 0; i < dword_len; i++) - wx_dbg(wx, "%x ", buf[i]); -+ wx_dbg(wx, "\ncheck: %x %x\n", buffer[0] & 0xff, ~buf[0] >> 24); -+ -+ goto rel_out; - } - - if (!return_data) -diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c -index 4ec0dab3887299..0a0ad3d77557f9 100644 ---- a/drivers/net/ieee802154/ca8210.c -+++ b/drivers/net/ieee802154/ca8210.c -@@ -3078,7 +3078,11 @@ static int ca8210_probe(struct spi_device *spi_device) - spi_set_drvdata(priv->spi, priv); - if (IS_ENABLED(CONFIG_IEEE802154_CA8210_DEBUGFS)) { - cascoda_api_upstream = ca8210_test_int_driver_write; -- ca8210_test_interface_init(priv); -+ ret = ca8210_test_interface_init(priv); -+ if (ret) { -+ dev_crit(&spi_device->dev, "ca8210_test_interface_init failed\n"); -+ goto error; -+ } - } else { - cascoda_api_upstream = NULL; - } -diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c -index f49b1bb258c73d..70907e8f3ea96d 100644 ---- a/drivers/platform/x86/amd/pmc/pmc.c -+++ b/drivers/platform/x86/amd/pmc/pmc.c -@@ -878,6 +878,10 @@ static int amd_pmc_suspend_handler(struct device *dev) - { - struct amd_pmc_dev *pdev = dev_get_drvdata(dev); - -+ /* -+ * Must be called only from the same set of dev_pm_ops handlers -+ * as i8042_pm_suspend() is called: currently just from .suspend. -+ */ - if (pdev->disable_8042_wakeup && !disable_workarounds) { - int rc = amd_pmc_wa_irq1(pdev); - -@@ -890,7 +894,9 @@ static int amd_pmc_suspend_handler(struct device *dev) - return 0; - } - --static DEFINE_SIMPLE_DEV_PM_OPS(amd_pmc_pm, amd_pmc_suspend_handler, NULL); -+static const struct dev_pm_ops amd_pmc_pm = { -+ .suspend = amd_pmc_suspend_handler, -+}; - - static const struct pci_device_id pmc_pci_ids[] = { - { PCI_DEVICE(PCI_VENDOR_ID_AMD, AMD_CPU_ID_PS) }, -diff --git a/drivers/pmdomain/imx/gpcv2.c b/drivers/pmdomain/imx/gpcv2.c -index fbd3d92f8cd8f2..13fce2b134f60a 100644 ---- a/drivers/pmdomain/imx/gpcv2.c -+++ b/drivers/pmdomain/imx/gpcv2.c -@@ -1449,12 +1449,12 @@ static int imx_gpcv2_probe(struct platform_device *pdev) - .max_register = SZ_4K, - }; - struct device *dev = &pdev->dev; -- struct device_node *pgc_np, *np; -+ struct device_node *pgc_np __free(device_node) = -+ of_get_child_by_name(dev->of_node, "pgc"); - struct regmap *regmap; - void __iomem *base; - int ret; - -- pgc_np = of_get_child_by_name(dev->of_node, "pgc"); - if (!pgc_np) { - dev_err(dev, "No power domains specified in DT\n"); - return -EINVAL; -@@ -1471,7 +1471,7 @@ static int imx_gpcv2_probe(struct platform_device *pdev) - return ret; - } - -- for_each_child_of_node(pgc_np, np) { -+ for_each_child_of_node_scoped(pgc_np, np) { - struct platform_device *pd_pdev; - struct imx_pgc_domain *domain; - u32 domain_index; -@@ -1482,7 +1482,6 @@ static int imx_gpcv2_probe(struct platform_device *pdev) - ret = of_property_read_u32(np, "reg", &domain_index); - if (ret) { - dev_err(dev, "Failed to read 'reg' property\n"); -- of_node_put(np); - return ret; - } - -@@ -1497,7 +1496,6 @@ static int imx_gpcv2_probe(struct platform_device *pdev) - domain_index); - if (!pd_pdev) { - dev_err(dev, "Failed to allocate platform device\n"); -- of_node_put(np); - return -ENOMEM; - } - -@@ -1506,7 +1504,6 @@ static int imx_gpcv2_probe(struct platform_device *pdev) - sizeof(domain_data->domains[domain_index])); - if (ret) { - platform_device_put(pd_pdev); -- of_node_put(np); - return ret; - } - -@@ -1523,7 +1520,6 @@ static int imx_gpcv2_probe(struct platform_device *pdev) - ret = platform_device_add(pd_pdev); - if (ret) { - platform_device_put(pd_pdev); -- of_node_put(np); - return ret; - } - } -diff --git a/drivers/staging/iio/frequency/ad9832.c b/drivers/staging/iio/frequency/ad9832.c -index d58d99d8375ea8..b40609b92980f5 100644 ---- a/drivers/staging/iio/frequency/ad9832.c -+++ b/drivers/staging/iio/frequency/ad9832.c -@@ -158,7 +158,7 @@ static int ad9832_write_frequency(struct ad9832_state *st, - static int ad9832_write_phase(struct ad9832_state *st, - unsigned long addr, unsigned long phase) - { -- if (phase > BIT(AD9832_PHASE_BITS)) -+ if (phase >= BIT(AD9832_PHASE_BITS)) - return -EINVAL; - - st->phase_data[0] = cpu_to_be16((AD9832_CMD_PHA8BITSW << CMD_SHIFT) | -diff --git a/drivers/staging/iio/frequency/ad9834.c b/drivers/staging/iio/frequency/ad9834.c -index cfdfe66d74f17c..bc879f87237cb2 100644 ---- a/drivers/staging/iio/frequency/ad9834.c -+++ b/drivers/staging/iio/frequency/ad9834.c -@@ -131,7 +131,7 @@ static int ad9834_write_frequency(struct ad9834_state *st, - static int ad9834_write_phase(struct ad9834_state *st, - unsigned long addr, unsigned long phase) - { -- if (phase > BIT(AD9834_PHASE_BITS)) -+ if (phase >= BIT(AD9834_PHASE_BITS)) - return -EINVAL; - st->data = cpu_to_be16(addr | phase); - -diff --git a/drivers/thermal/thermal_of.c b/drivers/thermal/thermal_of.c -index 4e5f86c2145616..0f520cf923a1e6 100644 ---- a/drivers/thermal/thermal_of.c -+++ b/drivers/thermal/thermal_of.c -@@ -203,6 +203,7 @@ static struct device_node *of_thermal_zone_find(struct device_node *sensor, int - goto out; - } - -+ of_node_put(sensor_specs.np); - if ((sensor == sensor_specs.np) && id == (sensor_specs.args_count ? - sensor_specs.args[0] : 0)) { - pr_debug("sensor %pOFn id=%d belongs to %pOFn\n", sensor, id, child); -diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c -index 3449f8790e462e..c536028e92dc2e 100644 ---- a/drivers/tty/serial/8250/8250_core.c -+++ b/drivers/tty/serial/8250/8250_core.c -@@ -1131,6 +1131,9 @@ int serial8250_register_8250_port(const struct uart_8250_port *up) - uart->dl_write = up->dl_write; - - if (uart->port.type != PORT_8250_CIR) { -+ if (uart_console_registered(&uart->port)) -+ pm_runtime_get_sync(uart->port.dev); -+ - if (serial8250_isa_config != NULL) - serial8250_isa_config(0, &uart->port, - &uart->capabilities); -diff --git a/drivers/ufs/core/ufshcd-priv.h b/drivers/ufs/core/ufshcd-priv.h -index 099a54009a16f3..524863b157e8aa 100644 ---- a/drivers/ufs/core/ufshcd-priv.h -+++ b/drivers/ufs/core/ufshcd-priv.h -@@ -242,12 +242,6 @@ static inline void ufshcd_vops_config_scaling_param(struct ufs_hba *hba, - hba->vops->config_scaling_param(hba, p, data); - } - --static inline void ufshcd_vops_reinit_notify(struct ufs_hba *hba) --{ -- if (hba->vops && hba->vops->reinit_notify) -- hba->vops->reinit_notify(hba); --} -- - static inline int ufshcd_vops_mcq_config_resource(struct ufs_hba *hba) - { - if (hba->vops && hba->vops->mcq_config_resource) -diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c -index 84dac90500746b..02696c7f9beff9 100644 ---- a/drivers/ufs/core/ufshcd.c -+++ b/drivers/ufs/core/ufshcd.c -@@ -8795,7 +8795,6 @@ static int ufshcd_probe_hba(struct ufs_hba *hba, bool init_dev_params) - ufshcd_device_reset(hba); - ufs_put_device_desc(hba); - ufshcd_hba_stop(hba); -- ufshcd_vops_reinit_notify(hba); - ret = ufshcd_hba_enable(hba); - if (ret) { - dev_err(hba->dev, "Host controller enable failed\n"); -diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c -index 643157a92c62a7..c999acba0f30c3 100644 ---- a/drivers/ufs/host/ufs-qcom.c -+++ b/drivers/ufs/host/ufs-qcom.c -@@ -455,6 +455,11 @@ static int ufs_qcom_power_up_sequence(struct ufs_hba *hba) - dev_warn(hba->dev, "%s: host reset returned %d\n", - __func__, ret); - -+ if (phy->power_count) { -+ phy_power_off(phy); -+ phy_exit(phy); -+ } -+ - /* phy initialization - calibrate the phy */ - ret = phy_init(phy); - if (ret) { -@@ -1638,13 +1643,6 @@ static void ufs_qcom_config_scaling_param(struct ufs_hba *hba, - } - #endif - --static void ufs_qcom_reinit_notify(struct ufs_hba *hba) --{ -- struct ufs_qcom_host *host = ufshcd_get_variant(hba); -- -- phy_power_off(host->generic_phy); --} -- - /* Resources */ - static const struct ufshcd_res_info ufs_res_info[RES_MAX] = { - {.name = "ufs_mem",}, -@@ -1887,7 +1885,6 @@ static const struct ufs_hba_variant_ops ufs_hba_qcom_vops = { - .device_reset = ufs_qcom_device_reset, - .config_scaling_param = ufs_qcom_config_scaling_param, - .program_key = ufs_qcom_ice_program_key, -- .reinit_notify = ufs_qcom_reinit_notify, - .mcq_config_resource = ufs_qcom_mcq_config_resource, - .get_hba_mac = ufs_qcom_get_hba_mac, - .op_runtime_config = ufs_qcom_op_runtime_config, -diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c -index 477af457c1a1f0..b3cbca361a9696 100644 ---- a/drivers/usb/chipidea/ci_hdrc_imx.c -+++ b/drivers/usb/chipidea/ci_hdrc_imx.c -@@ -362,25 +362,29 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) - data->pinctrl = devm_pinctrl_get(dev); - if (PTR_ERR(data->pinctrl) == -ENODEV) - data->pinctrl = NULL; -- else if (IS_ERR(data->pinctrl)) -- return dev_err_probe(dev, PTR_ERR(data->pinctrl), -+ else if (IS_ERR(data->pinctrl)) { -+ ret = dev_err_probe(dev, PTR_ERR(data->pinctrl), - "pinctrl get failed\n"); -+ goto err_put; -+ } - - data->hsic_pad_regulator = - devm_regulator_get_optional(dev, "hsic"); - if (PTR_ERR(data->hsic_pad_regulator) == -ENODEV) { - /* no pad regulator is needed */ - data->hsic_pad_regulator = NULL; -- } else if (IS_ERR(data->hsic_pad_regulator)) -- return dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator), -+ } else if (IS_ERR(data->hsic_pad_regulator)) { -+ ret = dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator), - "Get HSIC pad regulator error\n"); -+ goto err_put; -+ } - - if (data->hsic_pad_regulator) { - ret = regulator_enable(data->hsic_pad_regulator); - if (ret) { - dev_err(dev, - "Failed to enable HSIC pad regulator\n"); -- return ret; -+ goto err_put; - } - } - } -@@ -394,13 +398,14 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) - dev_err(dev, - "pinctrl_hsic_idle lookup failed, err=%ld\n", - PTR_ERR(pinctrl_hsic_idle)); -- return PTR_ERR(pinctrl_hsic_idle); -+ ret = PTR_ERR(pinctrl_hsic_idle); -+ goto err_put; - } - - ret = pinctrl_select_state(data->pinctrl, pinctrl_hsic_idle); - if (ret) { - dev_err(dev, "hsic_idle select failed, err=%d\n", ret); -- return ret; -+ goto err_put; - } - - data->pinctrl_hsic_active = pinctrl_lookup_state(data->pinctrl, -@@ -409,7 +414,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) - dev_err(dev, - "pinctrl_hsic_active lookup failed, err=%ld\n", - PTR_ERR(data->pinctrl_hsic_active)); -- return PTR_ERR(data->pinctrl_hsic_active); -+ ret = PTR_ERR(data->pinctrl_hsic_active); -+ goto err_put; - } - } - -@@ -513,6 +519,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) - if (pdata.flags & CI_HDRC_PMQOS) - cpu_latency_qos_remove_request(&data->pm_qos_req); - data->ci_pdev = NULL; -+err_put: -+ put_device(data->usbmisc_data->dev); - return ret; - } - -@@ -536,6 +544,7 @@ static void ci_hdrc_imx_remove(struct platform_device *pdev) - if (data->hsic_pad_regulator) - regulator_disable(data->hsic_pad_regulator); - } -+ put_device(data->usbmisc_data->dev); - } - - static void ci_hdrc_imx_shutdown(struct platform_device *pdev) -diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c -index 5a2e43331064eb..ff1a941fd2ede4 100644 ---- a/drivers/usb/class/usblp.c -+++ b/drivers/usb/class/usblp.c -@@ -1337,11 +1337,12 @@ static int usblp_set_protocol(struct usblp *usblp, int protocol) - if (protocol < USBLP_FIRST_PROTOCOL || protocol > USBLP_LAST_PROTOCOL) - return -EINVAL; - -+ alts = usblp->protocol[protocol].alt_setting; -+ if (alts < 0) -+ return -EINVAL; -+ - /* Don't unnecessarily set the interface if there's a single alt. */ - if (usblp->intf->num_altsetting > 1) { -- alts = usblp->protocol[protocol].alt_setting; -- if (alts < 0) -- return -EINVAL; - r = usb_set_interface(usblp->dev, usblp->ifnum, alts); - if (r < 0) { - printk(KERN_ERR "usblp: can't set desired altsetting %d on interface %d\n", -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 1ba3feb5e19000..0944cfae8b5567 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -2633,13 +2633,13 @@ int usb_new_device(struct usb_device *udev) - err = sysfs_create_link(&udev->dev.kobj, - &port_dev->dev.kobj, "port"); - if (err) -- goto fail; -+ goto out_del_dev; - - err = sysfs_create_link(&port_dev->dev.kobj, - &udev->dev.kobj, "device"); - if (err) { - sysfs_remove_link(&udev->dev.kobj, "port"); -- goto fail; -+ goto out_del_dev; - } - - if (!test_and_set_bit(port1, hub->child_usage_bits)) -@@ -2651,6 +2651,8 @@ int usb_new_device(struct usb_device *udev) - pm_runtime_put_sync_autosuspend(&udev->dev); - return err; - -+out_del_dev: -+ device_del(&udev->dev); - fail: - usb_set_device_state(udev, USB_STATE_NOTATTACHED); - pm_runtime_disable(&udev->dev); -diff --git a/drivers/usb/core/port.c b/drivers/usb/core/port.c -index 5fb3f55ef06db5..9dd4a4ee61e56b 100644 ---- a/drivers/usb/core/port.c -+++ b/drivers/usb/core/port.c -@@ -451,10 +451,11 @@ static int usb_port_runtime_suspend(struct device *dev) - static void usb_port_shutdown(struct device *dev) - { - struct usb_port *port_dev = to_usb_port(dev); -+ struct usb_device *udev = port_dev->child; - -- if (port_dev->child) { -- usb_disable_usb2_hardware_lpm(port_dev->child); -- usb_unlocked_disable_lpm(port_dev->child); -+ if (udev && !udev->port_is_suspended) { -+ usb_disable_usb2_hardware_lpm(udev); -+ usb_unlocked_disable_lpm(udev); - } - } - -diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h -index d00bf714a7ccfb..516bace7e1dced 100644 ---- a/drivers/usb/dwc3/core.h -+++ b/drivers/usb/dwc3/core.h -@@ -451,6 +451,7 @@ - #define DWC3_DCTL_TRGTULST_SS_INACT (DWC3_DCTL_TRGTULST(6)) - - /* These apply for core versions 1.94a and later */ -+#define DWC3_DCTL_NYET_THRES_MASK (0xf << 20) - #define DWC3_DCTL_NYET_THRES(n) (((n) & 0xf) << 20) - - #define DWC3_DCTL_KEEP_CONNECT BIT(19) -diff --git a/drivers/usb/dwc3/dwc3-am62.c b/drivers/usb/dwc3/dwc3-am62.c -index ea6e29091c0c9a..056ab7246a3a2c 100644 ---- a/drivers/usb/dwc3/dwc3-am62.c -+++ b/drivers/usb/dwc3/dwc3-am62.c -@@ -284,6 +284,7 @@ static void dwc3_ti_remove(struct platform_device *pdev) - - pm_runtime_put_sync(dev); - pm_runtime_disable(dev); -+ pm_runtime_dont_use_autosuspend(dev); - pm_runtime_set_suspended(dev); - } - -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index 656460c0c1dd7e..9b8099cba41429 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -4208,8 +4208,10 @@ static void dwc3_gadget_conndone_interrupt(struct dwc3 *dwc) - WARN_ONCE(DWC3_VER_IS_PRIOR(DWC3, 240A) && dwc->has_lpm_erratum, - "LPM Erratum not available on dwc3 revisions < 2.40a\n"); - -- if (dwc->has_lpm_erratum && !DWC3_VER_IS_PRIOR(DWC3, 240A)) -+ if (dwc->has_lpm_erratum && !DWC3_VER_IS_PRIOR(DWC3, 240A)) { -+ reg &= ~DWC3_DCTL_NYET_THRES_MASK; - reg |= DWC3_DCTL_NYET_THRES(dwc->lpm_nyet_threshold); -+ } - - dwc3_gadget_dctl_write_safe(dwc, reg); - } else { -diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig -index b3592bcb0f9668..c7fa0ec74f5e69 100644 ---- a/drivers/usb/gadget/Kconfig -+++ b/drivers/usb/gadget/Kconfig -@@ -210,6 +210,8 @@ config USB_F_MIDI - - config USB_F_MIDI2 - tristate -+ select SND_UMP -+ select SND_UMP_LEGACY_RAWMIDI - - config USB_F_HID - tristate -@@ -444,8 +446,6 @@ config USB_CONFIGFS_F_MIDI2 - depends on USB_CONFIGFS - depends on SND - select USB_LIBCOMPOSITE -- select SND_UMP -- select SND_UMP_LEGACY_RAWMIDI - select USB_F_MIDI2 - help - The MIDI 2.0 function driver provides the generic emulated -diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c -index 60a1abfc565474..3a80600d68068f 100644 ---- a/drivers/usb/gadget/configfs.c -+++ b/drivers/usb/gadget/configfs.c -@@ -824,11 +824,15 @@ static ssize_t gadget_string_s_store(struct config_item *item, const char *page, - { - struct gadget_string *string = to_gadget_string(item); - int size = min(sizeof(string->string), len + 1); -+ ssize_t cpy_len; - - if (len > USB_MAX_STRING_LEN) - return -EINVAL; - -- return strscpy(string->string, page, size); -+ cpy_len = strscpy(string->string, page, size); -+ if (cpy_len > 0 && string->string[cpy_len - 1] == '\n') -+ string->string[cpy_len - 1] = 0; -+ return len; - } - CONFIGFS_ATTR(gadget_string_, s); - -diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c -index fd0f4879f38e8b..4a88546b1b1576 100644 ---- a/drivers/usb/gadget/function/f_fs.c -+++ b/drivers/usb/gadget/function/f_fs.c -@@ -1810,7 +1810,7 @@ static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev) - struct usb_gadget_strings **lang; - int first_id; - -- if (WARN_ON(ffs->state != FFS_ACTIVE -+ if ((ffs->state != FFS_ACTIVE - || test_and_set_bit(FFS_FL_BOUND, &ffs->flags))) - return -EBADFD; - -diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c -index b3dc5f5164f42c..eabd10817e1e7b 100644 ---- a/drivers/usb/gadget/function/f_uac2.c -+++ b/drivers/usb/gadget/function/f_uac2.c -@@ -1176,6 +1176,7 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn) - uac2->as_in_alt = 0; - } - -+ std_ac_if_desc.bNumEndpoints = 0; - if (FUOUT_EN(uac2_opts) || FUIN_EN(uac2_opts)) { - uac2->int_ep = usb_ep_autoconfig(gadget, &fs_ep_int_desc); - if (!uac2->int_ep) { -diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c -index 729b0472bab098..fe2737e55f8e89 100644 ---- a/drivers/usb/gadget/function/u_serial.c -+++ b/drivers/usb/gadget/function/u_serial.c -@@ -1398,6 +1398,10 @@ void gserial_disconnect(struct gserial *gser) - /* REVISIT as above: how best to track this? */ - port->port_line_coding = gser->port_line_coding; - -+ /* disable endpoints, aborting down any active I/O */ -+ usb_ep_disable(gser->out); -+ usb_ep_disable(gser->in); -+ - port->port_usb = NULL; - gser->ioport = NULL; - if (port->port.count > 0) { -@@ -1409,10 +1413,6 @@ void gserial_disconnect(struct gserial *gser) - spin_unlock(&port->port_lock); - spin_unlock_irqrestore(&serial_port_lock, flags); - -- /* disable endpoints, aborting down any active I/O */ -- usb_ep_disable(gser->out); -- usb_ep_disable(gser->in); -- - /* finally, free any unused/unusable I/O buffers */ - spin_lock_irqsave(&port->port_lock, flags); - if (port->port.count == 0) -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 21fd26609252be..e3c391397e0f8c 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -223,6 +223,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */ - { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ - { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ -+ { USB_DEVICE(0x1B93, 0x1013) }, /* Phoenix Contact UPS Device */ - { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */ - { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */ - { USB_DEVICE(0x1D6F, 0x0010) }, /* Seluxit ApS RF Dongle */ -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index ac1c13b269fc0b..86ac20e2874bab 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -621,7 +621,7 @@ static void option_instat_callback(struct urb *urb); - - /* MeiG Smart Technology products */ - #define MEIGSMART_VENDOR_ID 0x2dee --/* MeiG Smart SRM825L based on Qualcomm 315 */ -+/* MeiG Smart SRM815/SRM825L based on Qualcomm 315 */ - #define MEIGSMART_PRODUCT_SRM825L 0x4d22 - /* MeiG Smart SLM320 based on UNISOC UIS8910 */ - #define MEIGSMART_PRODUCT_SLM320 0x4d41 -@@ -2405,6 +2405,7 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, - { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) }, - { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM770A, 0xff, 0, 0) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0, 0) }, - { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) }, - { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) }, - { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) }, -@@ -2412,6 +2413,7 @@ static const struct usb_device_id option_ids[] = { - .driver_info = NCTRL(1) }, - { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0640, 0xff), /* TCL IK512 ECM */ - .driver_info = NCTRL(3) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x2949, 0x8700, 0xff) }, /* Neoway N723-EA */ - { } /* Terminating entry */ - }; - MODULE_DEVICE_TABLE(usb, option_ids); -diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h -index e5ad23d86833d5..54f0b1c83317cd 100644 ---- a/drivers/usb/storage/unusual_devs.h -+++ b/drivers/usb/storage/unusual_devs.h -@@ -255,6 +255,13 @@ UNUSUAL_DEV( 0x0421, 0x06aa, 0x1110, 0x1110, - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_MAX_SECTORS_64 ), - -+/* Added by Lubomir Rintel , a very fine chap */ -+UNUSUAL_DEV( 0x0421, 0x06c2, 0x0000, 0x0406, -+ "Nokia", -+ "Nokia 208", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_MAX_SECTORS_64 ), -+ - #ifdef NO_SDDR09 - UNUSUAL_DEV( 0x0436, 0x0005, 0x0100, 0x0100, - "Microtech", -diff --git a/drivers/usb/typec/tcpm/maxim_contaminant.c b/drivers/usb/typec/tcpm/maxim_contaminant.c -index f8504a90da2675..60f90272fed315 100644 ---- a/drivers/usb/typec/tcpm/maxim_contaminant.c -+++ b/drivers/usb/typec/tcpm/maxim_contaminant.c -@@ -137,7 +137,7 @@ static int max_contaminant_read_resistance_kohm(struct max_tcpci_chip *chip, - - mv = max_contaminant_read_adc_mv(chip, channel, sleep_msec, raw, true); - if (mv < 0) -- return ret; -+ return mv; - - /* OVP enable */ - ret = regmap_update_bits(regmap, TCPC_VENDOR_CC_CTRL2, CCOVPDIS, 0); -@@ -159,7 +159,7 @@ static int max_contaminant_read_resistance_kohm(struct max_tcpci_chip *chip, - - mv = max_contaminant_read_adc_mv(chip, channel, sleep_msec, raw, true); - if (mv < 0) -- return ret; -+ return mv; - /* Disable current source */ - ret = regmap_update_bits(regmap, TCPC_VENDOR_CC_CTRL2, SBURPCTRL, 0); - if (ret < 0) -diff --git a/fs/Kconfig b/fs/Kconfig -index aa7e03cc1941cb..02a9237807a779 100644 ---- a/fs/Kconfig -+++ b/fs/Kconfig -@@ -253,7 +253,7 @@ config TMPFS_QUOTA - config ARCH_SUPPORTS_HUGETLBFS - def_bool n - --config HUGETLBFS -+menuconfig HUGETLBFS - bool "HugeTLB file system support" - depends on X86 || IA64 || SPARC64 || ARCH_SUPPORTS_HUGETLBFS || BROKEN - depends on (SYSFS || SYSCTL) -@@ -265,6 +265,17 @@ config HUGETLBFS - - If unsure, say N. - -+if HUGETLBFS -+config HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON -+ bool "HugeTLB Vmemmap Optimization (HVO) defaults to on" -+ default n -+ depends on HUGETLB_PAGE_OPTIMIZE_VMEMMAP -+ help -+ The HugeTLB Vmemmap Optimization (HVO) defaults to off. Say Y here to -+ enable HVO by default. It can be disabled via hugetlb_free_vmemmap=off -+ (boot command line) or hugetlb_optimize_vmemmap (sysctl). -+endif # HUGETLBFS -+ - config HUGETLB_PAGE - def_bool HUGETLBFS - -@@ -273,14 +284,9 @@ config HUGETLB_PAGE_OPTIMIZE_VMEMMAP - depends on ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - depends on SPARSEMEM_VMEMMAP - --config HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON -- bool "HugeTLB Vmemmap Optimization (HVO) defaults to on" -- default n -- depends on HUGETLB_PAGE_OPTIMIZE_VMEMMAP -- help -- The HugeTLB VmemmapvOptimization (HVO) defaults to off. Say Y here to -- enable HVO by default. It can be disabled via hugetlb_free_vmemmap=off -- (boot command line) or hugetlb_optimize_vmemmap (sysctl). -+config HUGETLB_PMD_PAGE_TABLE_SHARING -+ def_bool HUGETLB_PAGE -+ depends on ARCH_WANT_HUGE_PMD_SHARE && SPLIT_PMD_PTLOCKS - - config ARCH_HAS_GIGANTIC_PAGE - bool -diff --git a/fs/afs/afs.h b/fs/afs/afs.h -index 81815724db6c9b..25c17100798ba7 100644 ---- a/fs/afs/afs.h -+++ b/fs/afs/afs.h -@@ -10,7 +10,7 @@ - - #include - --#define AFS_MAXCELLNAME 256 /* Maximum length of a cell name */ -+#define AFS_MAXCELLNAME 253 /* Maximum length of a cell name (DNS limited) */ - #define AFS_MAXVOLNAME 64 /* Maximum length of a volume name */ - #define AFS_MAXNSERVERS 8 /* Maximum servers in a basic volume record */ - #define AFS_NMAXNSERVERS 13 /* Maximum servers in a N/U-class volume record */ -diff --git a/fs/afs/afs_vl.h b/fs/afs/afs_vl.h -index 9c65ffb8a523bd..8da0899fbc0835 100644 ---- a/fs/afs/afs_vl.h -+++ b/fs/afs/afs_vl.h -@@ -13,6 +13,7 @@ - #define AFS_VL_PORT 7003 /* volume location service port */ - #define VL_SERVICE 52 /* RxRPC service ID for the Volume Location service */ - #define YFS_VL_SERVICE 2503 /* Service ID for AuriStor upgraded VL service */ -+#define YFS_VL_MAXCELLNAME 256 /* Maximum length of a cell name in YFS protocol */ - - enum AFSVL_Operations { - VLGETENTRYBYID = 503, /* AFS Get VLDB entry by ID */ -diff --git a/fs/afs/vl_alias.c b/fs/afs/vl_alias.c -index f04a80e4f5c3fa..83cf1bfbe343ae 100644 ---- a/fs/afs/vl_alias.c -+++ b/fs/afs/vl_alias.c -@@ -302,6 +302,7 @@ static char *afs_vl_get_cell_name(struct afs_cell *cell, struct key *key) - static int yfs_check_canonical_cell_name(struct afs_cell *cell, struct key *key) - { - struct afs_cell *master; -+ size_t name_len; - char *cell_name; - - cell_name = afs_vl_get_cell_name(cell, key); -@@ -313,8 +314,11 @@ static int yfs_check_canonical_cell_name(struct afs_cell *cell, struct key *key) - return 0; - } - -- master = afs_lookup_cell(cell->net, cell_name, strlen(cell_name), -- NULL, false); -+ name_len = strlen(cell_name); -+ if (!name_len || name_len > AFS_MAXCELLNAME) -+ master = ERR_PTR(-EOPNOTSUPP); -+ else -+ master = afs_lookup_cell(cell->net, cell_name, name_len, NULL, false); - kfree(cell_name); - if (IS_ERR(master)) - return PTR_ERR(master); -diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c -index 00fca3c66ba616..16653f2ffe4f54 100644 ---- a/fs/afs/vlclient.c -+++ b/fs/afs/vlclient.c -@@ -671,7 +671,7 @@ static int afs_deliver_yfsvl_get_cell_name(struct afs_call *call) - return ret; - - namesz = ntohl(call->tmp); -- if (namesz > AFS_MAXCELLNAME) -+ if (namesz > YFS_VL_MAXCELLNAME) - return afs_protocol_error(call, afs_eproto_cellname_len); - paddedsz = (namesz + 3) & ~3; - call->count = namesz; -diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c -index a2d91d9f8a109d..6be092bb814fdc 100644 ---- a/fs/btrfs/scrub.c -+++ b/fs/btrfs/scrub.c -@@ -1538,6 +1538,10 @@ static int scrub_find_fill_first_stripe(struct btrfs_block_group *bg, - u64 extent_gen; - int ret; - -+ if (unlikely(!extent_root)) { -+ btrfs_err(fs_info, "no valid extent root for scrub"); -+ return -EUCLEAN; -+ } - memset(stripe->sectors, 0, sizeof(struct scrub_sector_verification) * - stripe->nr_sectors); - scrub_stripe_reset_bitmaps(stripe); -diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c -index 1c0e6167d8e73b..496e4c7c52a4e0 100644 ---- a/fs/erofs/zdata.c -+++ b/fs/erofs/zdata.c -@@ -1483,14 +1483,13 @@ static struct page *pickup_page_for_submission(struct z_erofs_pcluster *pcl, - goto out; - - lock_page(page); -- -- /* only true if page reclaim goes wrong, should never happen */ -- DBG_BUGON(justfound && PagePrivate(page)); -- -- /* the page is still in manage cache */ -- if (page->mapping == mc) { -+ if (likely(page->mapping == mc)) { - WRITE_ONCE(pcl->compressed_bvecs[nr].page, page); - -+ /* -+ * The cached folio is still in managed cache but without -+ * a valid `->private` pcluster hint. Let's reconnect them. -+ */ - if (!PagePrivate(page)) { - /* - * impossible to be !PagePrivate(page) for -@@ -1504,22 +1503,24 @@ static struct page *pickup_page_for_submission(struct z_erofs_pcluster *pcl, - SetPagePrivate(page); - } - -- /* no need to submit io if it is already up-to-date */ -- if (PageUptodate(page)) { -- unlock_page(page); -- page = NULL; -+ if (likely(page->private == (unsigned long)pcl)) { -+ /* don't submit cache I/Os again if already uptodate */ -+ if (PageUptodate(page)) { -+ unlock_page(page); -+ page = NULL; -+ -+ } -+ goto out; - } -- goto out; -+ /* -+ * Already linked with another pcluster, which only appears in -+ * crafted images by fuzzers for now. But handle this anyway. -+ */ -+ tocache = false; /* use temporary short-lived pages */ -+ } else { -+ DBG_BUGON(1); /* referenced managed folios can't be truncated */ -+ tocache = true; - } -- -- /* -- * the managed page has been truncated, it's unsafe to -- * reuse this one, let's allocate a new cache-managed page. -- */ -- DBG_BUGON(page->mapping); -- DBG_BUGON(!justfound); -- -- tocache = true; - unlock_page(page); - put_page(page); - out_allocpage: -@@ -1677,16 +1678,11 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f, - end = cur + pcl->pclusterpages; - - do { -- struct page *page; -- -- page = pickup_page_for_submission(pcl, i++, -- &f->pagepool, mc); -- if (!page) -- continue; -+ struct page *page = NULL; - - if (bio && (cur != last_index + 1 || - last_bdev != mdev.m_bdev)) { --submit_bio_retry: -+drain_io: - submit_bio(bio); - if (memstall) { - psi_memstall_leave(&pflags); -@@ -1695,6 +1691,13 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f, - bio = NULL; - } - -+ if (!page) { -+ page = pickup_page_for_submission(pcl, i++, -+ &f->pagepool, mc); -+ if (!page) -+ continue; -+ } -+ - if (unlikely(PageWorkingset(page)) && !memstall) { - psi_memstall_enter(&pflags); - memstall = 1; -@@ -1715,7 +1718,7 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f, - } - - if (bio_add_page(bio, page, PAGE_SIZE, 0) < PAGE_SIZE) -- goto submit_bio_retry; -+ goto drain_io; - - last_index = cur; - bypass = false; -@@ -1727,11 +1730,10 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f, - move_to_bypass_jobqueue(pcl, qtail, owned_head); - } while (owned_head != Z_EROFS_PCLUSTER_TAIL); - -- if (bio) { -+ if (bio) - submit_bio(bio); -- if (memstall) -- psi_memstall_leave(&pflags); -- } -+ if (memstall) -+ psi_memstall_leave(&pflags); - - /* - * although background is preferred, no one is pending for submission. -diff --git a/fs/exfat/dir.c b/fs/exfat/dir.c -index 7a715016b96f34..f4f81e349cefe1 100644 ---- a/fs/exfat/dir.c -+++ b/fs/exfat/dir.c -@@ -125,7 +125,7 @@ static int exfat_readdir(struct inode *inode, loff_t *cpos, struct exfat_dir_ent - type = exfat_get_entry_type(ep); - if (type == TYPE_UNUSED) { - brelse(bh); -- break; -+ goto out; - } - - if (type != TYPE_FILE && type != TYPE_DIR) { -@@ -189,6 +189,7 @@ static int exfat_readdir(struct inode *inode, loff_t *cpos, struct exfat_dir_ent - } - } - -+out: - dir_entry->namebuf.lfn[0] = '\0'; - *cpos = EXFAT_DEN_TO_B(dentry); - return 0; -diff --git a/fs/exfat/fatent.c b/fs/exfat/fatent.c -index 56b870d9cc0def..428d862a1d2bfc 100644 ---- a/fs/exfat/fatent.c -+++ b/fs/exfat/fatent.c -@@ -216,6 +216,16 @@ static int __exfat_free_cluster(struct inode *inode, struct exfat_chain *p_chain - - if (err) - goto dec_used_clus; -+ -+ if (num_clusters >= sbi->num_clusters - EXFAT_FIRST_CLUSTER) { -+ /* -+ * The cluster chain includes a loop, scan the -+ * bitmap to get the number of used clusters. -+ */ -+ exfat_count_used_clusters(sb, &sbi->used_clusters); -+ -+ return 0; -+ } - } while (clu != EXFAT_EOF_CLUSTER); - } - -diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c -index b72fa103b9632a..aa0e7cc2489ac9 100644 ---- a/fs/f2fs/super.c -+++ b/fs/f2fs/super.c -@@ -4931,9 +4931,6 @@ static int __init init_f2fs_fs(void) - err = register_shrinker(&f2fs_shrinker_info, "f2fs-shrinker"); - if (err) - goto free_sysfs; -- err = register_filesystem(&f2fs_fs_type); -- if (err) -- goto free_shrinker; - f2fs_create_root_stats(); - err = f2fs_init_post_read_processing(); - if (err) -@@ -4956,7 +4953,12 @@ static int __init init_f2fs_fs(void) - err = f2fs_create_casefold_cache(); - if (err) - goto free_compress_cache; -+ err = register_filesystem(&f2fs_fs_type); -+ if (err) -+ goto free_casefold_cache; - return 0; -+free_casefold_cache: -+ f2fs_destroy_casefold_cache(); - free_compress_cache: - f2fs_destroy_compress_cache(); - free_compress_mempool: -@@ -4971,8 +4973,6 @@ static int __init init_f2fs_fs(void) - f2fs_destroy_post_read_processing(); - free_root_stats: - f2fs_destroy_root_stats(); -- unregister_filesystem(&f2fs_fs_type); --free_shrinker: - unregister_shrinker(&f2fs_shrinker_info); - free_sysfs: - f2fs_exit_sysfs(); -@@ -4996,6 +4996,7 @@ static int __init init_f2fs_fs(void) - - static void __exit exit_f2fs_fs(void) - { -+ unregister_filesystem(&f2fs_fs_type); - f2fs_destroy_casefold_cache(); - f2fs_destroy_compress_cache(); - f2fs_destroy_compress_mempool(); -@@ -5004,7 +5005,6 @@ static void __exit exit_f2fs_fs(void) - f2fs_destroy_iostat_processing(); - f2fs_destroy_post_read_processing(); - f2fs_destroy_root_stats(); -- unregister_filesystem(&f2fs_fs_type); - unregister_shrinker(&f2fs_shrinker_info); - f2fs_exit_sysfs(); - f2fs_destroy_garbage_collection_cache(); -diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c -index 0cd7439470fc43..84663ff7dc5058 100644 ---- a/fs/jbd2/commit.c -+++ b/fs/jbd2/commit.c -@@ -777,9 +777,9 @@ void jbd2_journal_commit_transaction(journal_t *journal) - /* - * If the journal is not located on the file system device, - * then we must flush the file system device before we issue -- * the commit record -+ * the commit record and update the journal tail sequence. - */ -- if (commit_transaction->t_need_data_flush && -+ if ((commit_transaction->t_need_data_flush || update_tail) && - (journal->j_fs_dev != journal->j_dev) && - (journal->j_flags & JBD2_BARRIER)) - blkdev_issue_flush(journal->j_fs_dev); -diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c -index 4556e468902449..ce63d5fde9c3a8 100644 ---- a/fs/jbd2/revoke.c -+++ b/fs/jbd2/revoke.c -@@ -654,7 +654,7 @@ static void flush_descriptor(journal_t *journal, - set_buffer_jwrite(descriptor); - BUFFER_TRACE(descriptor, "write"); - set_buffer_dirty(descriptor); -- write_dirty_buffer(descriptor, REQ_SYNC); -+ write_dirty_buffer(descriptor, JBD2_JOURNAL_REQ_FLAGS); - } - #endif - -diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c -index ada3fcc9c6d501..f14c412c56097d 100644 ---- a/fs/overlayfs/copy_up.c -+++ b/fs/overlayfs/copy_up.c -@@ -371,13 +371,13 @@ int ovl_set_attr(struct ovl_fs *ofs, struct dentry *upperdentry, - return err; - } - --struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct dentry *real, -+struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct inode *realinode, - bool is_upper) - { - struct ovl_fh *fh; - int fh_type, dwords; - int buflen = MAX_HANDLE_SZ; -- uuid_t *uuid = &real->d_sb->s_uuid; -+ uuid_t *uuid = &realinode->i_sb->s_uuid; - int err; - - /* Make sure the real fid stays 32bit aligned */ -@@ -394,7 +394,8 @@ struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct dentry *real, - * the price or reconnecting the dentry. - */ - dwords = buflen >> 2; -- fh_type = exportfs_encode_fh(real, (void *)fh->fb.fid, &dwords, 0); -+ fh_type = exportfs_encode_inode_fh(realinode, (void *)fh->fb.fid, -+ &dwords, NULL, 0); - buflen = (dwords << 2); - - err = -EIO; -@@ -426,29 +427,29 @@ struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct dentry *real, - return ERR_PTR(err); - } - --int ovl_set_origin(struct ovl_fs *ofs, struct dentry *lower, -- struct dentry *upper) -+struct ovl_fh *ovl_get_origin_fh(struct ovl_fs *ofs, struct dentry *origin) - { -- const struct ovl_fh *fh = NULL; -- int err; -- - /* - * When lower layer doesn't support export operations store a 'null' fh, - * so we can use the overlay.origin xattr to distignuish between a copy - * up and a pure upper inode. - */ -- if (ovl_can_decode_fh(lower->d_sb)) { -- fh = ovl_encode_real_fh(ofs, lower, false); -- if (IS_ERR(fh)) -- return PTR_ERR(fh); -- } -+ if (!ovl_can_decode_fh(origin->d_sb)) -+ return NULL; -+ -+ return ovl_encode_real_fh(ofs, d_inode(origin), false); -+} -+ -+int ovl_set_origin_fh(struct ovl_fs *ofs, const struct ovl_fh *fh, -+ struct dentry *upper) -+{ -+ int err; - - /* - * Do not fail when upper doesn't support xattrs. - */ - err = ovl_check_setxattr(ofs, upper, OVL_XATTR_ORIGIN, fh->buf, - fh ? fh->fb.len : 0, 0); -- kfree(fh); - - /* Ignore -EPERM from setting "user.*" on symlink/special */ - return err == -EPERM ? 0 : err; -@@ -461,7 +462,7 @@ static int ovl_set_upper_fh(struct ovl_fs *ofs, struct dentry *upper, - const struct ovl_fh *fh; - int err; - -- fh = ovl_encode_real_fh(ofs, upper, true); -+ fh = ovl_encode_real_fh(ofs, d_inode(upper), true); - if (IS_ERR(fh)) - return PTR_ERR(fh); - -@@ -476,7 +477,7 @@ static int ovl_set_upper_fh(struct ovl_fs *ofs, struct dentry *upper, - * - * Caller must hold i_mutex on indexdir. - */ --static int ovl_create_index(struct dentry *dentry, struct dentry *origin, -+static int ovl_create_index(struct dentry *dentry, const struct ovl_fh *fh, - struct dentry *upper) - { - struct ovl_fs *ofs = OVL_FS(dentry->d_sb); -@@ -502,7 +503,7 @@ static int ovl_create_index(struct dentry *dentry, struct dentry *origin, - if (WARN_ON(ovl_test_flag(OVL_INDEX, d_inode(dentry)))) - return -EIO; - -- err = ovl_get_index_name(ofs, origin, &name); -+ err = ovl_get_index_name_fh(fh, &name); - if (err) - return err; - -@@ -541,6 +542,7 @@ struct ovl_copy_up_ctx { - struct dentry *destdir; - struct qstr destname; - struct dentry *workdir; -+ const struct ovl_fh *origin_fh; - bool origin; - bool indexed; - bool metacopy; -@@ -637,7 +639,7 @@ static int ovl_copy_up_metadata(struct ovl_copy_up_ctx *c, struct dentry *temp) - * hard link. - */ - if (c->origin) { -- err = ovl_set_origin(ofs, c->lowerpath.dentry, temp); -+ err = ovl_set_origin_fh(ofs, c->origin_fh, temp); - if (err) - return err; - } -@@ -749,7 +751,7 @@ static int ovl_copy_up_workdir(struct ovl_copy_up_ctx *c) - goto cleanup; - - if (S_ISDIR(c->stat.mode) && c->indexed) { -- err = ovl_create_index(c->dentry, c->lowerpath.dentry, temp); -+ err = ovl_create_index(c->dentry, c->origin_fh, temp); - if (err) - goto cleanup; - } -@@ -861,6 +863,8 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c) - { - int err; - struct ovl_fs *ofs = OVL_FS(c->dentry->d_sb); -+ struct dentry *origin = c->lowerpath.dentry; -+ struct ovl_fh *fh = NULL; - bool to_index = false; - - /* -@@ -877,17 +881,25 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c) - to_index = true; - } - -- if (S_ISDIR(c->stat.mode) || c->stat.nlink == 1 || to_index) -+ if (S_ISDIR(c->stat.mode) || c->stat.nlink == 1 || to_index) { -+ fh = ovl_get_origin_fh(ofs, origin); -+ if (IS_ERR(fh)) -+ return PTR_ERR(fh); -+ -+ /* origin_fh may be NULL */ -+ c->origin_fh = fh; - c->origin = true; -+ } - - if (to_index) { - c->destdir = ovl_indexdir(c->dentry->d_sb); -- err = ovl_get_index_name(ofs, c->lowerpath.dentry, &c->destname); -+ err = ovl_get_index_name(ofs, origin, &c->destname); - if (err) -- return err; -+ goto out_free_fh; - } else if (WARN_ON(!c->parent)) { - /* Disconnected dentry must be copied up to index dir */ -- return -EIO; -+ err = -EIO; -+ goto out_free_fh; - } else { - /* - * Mark parent "impure" because it may now contain non-pure -@@ -895,7 +907,7 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c) - */ - err = ovl_set_impure(c->parent, c->destdir); - if (err) -- return err; -+ goto out_free_fh; - } - - /* Should we copyup with O_TMPFILE or with workdir? */ -@@ -927,6 +939,8 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c) - out: - if (to_index) - kfree(c->destname.name); -+out_free_fh: -+ kfree(fh); - return err; - } - -diff --git a/fs/overlayfs/export.c b/fs/overlayfs/export.c -index 611ff567a1aa6f..3a17e4366f28c0 100644 ---- a/fs/overlayfs/export.c -+++ b/fs/overlayfs/export.c -@@ -181,35 +181,37 @@ static int ovl_connect_layer(struct dentry *dentry) - * - * Return 0 for upper file handle, > 0 for lower file handle or < 0 on error. - */ --static int ovl_check_encode_origin(struct dentry *dentry) -+static int ovl_check_encode_origin(struct inode *inode) - { -- struct ovl_fs *ofs = OVL_FS(dentry->d_sb); -+ struct ovl_fs *ofs = OVL_FS(inode->i_sb); - bool decodable = ofs->config.nfs_export; -+ struct dentry *dentry; -+ int err; - - /* No upper layer? */ - if (!ovl_upper_mnt(ofs)) - return 1; - - /* Lower file handle for non-upper non-decodable */ -- if (!ovl_dentry_upper(dentry) && !decodable) -+ if (!ovl_inode_upper(inode) && !decodable) - return 1; - - /* Upper file handle for pure upper */ -- if (!ovl_dentry_lower(dentry)) -+ if (!ovl_inode_lower(inode)) - return 0; - - /* - * Root is never indexed, so if there's an upper layer, encode upper for - * root. - */ -- if (dentry == dentry->d_sb->s_root) -+ if (inode == d_inode(inode->i_sb->s_root)) - return 0; - - /* - * Upper decodable file handle for non-indexed upper. - */ -- if (ovl_dentry_upper(dentry) && decodable && -- !ovl_test_flag(OVL_INDEX, d_inode(dentry))) -+ if (ovl_inode_upper(inode) && decodable && -+ !ovl_test_flag(OVL_INDEX, inode)) - return 0; - - /* -@@ -218,14 +220,23 @@ static int ovl_check_encode_origin(struct dentry *dentry) - * ovl_connect_layer() will try to make origin's layer "connected" by - * copying up a "connectable" ancestor. - */ -- if (d_is_dir(dentry) && decodable) -- return ovl_connect_layer(dentry); -+ if (!decodable || !S_ISDIR(inode->i_mode)) -+ return 1; -+ -+ dentry = d_find_any_alias(inode); -+ if (!dentry) -+ return -ENOENT; -+ -+ err = ovl_connect_layer(dentry); -+ dput(dentry); -+ if (err < 0) -+ return err; - - /* Lower file handle for indexed and non-upper dir/non-dir */ - return 1; - } - --static int ovl_dentry_to_fid(struct ovl_fs *ofs, struct dentry *dentry, -+static int ovl_dentry_to_fid(struct ovl_fs *ofs, struct inode *inode, - u32 *fid, int buflen) - { - struct ovl_fh *fh = NULL; -@@ -236,13 +247,13 @@ static int ovl_dentry_to_fid(struct ovl_fs *ofs, struct dentry *dentry, - * Check if we should encode a lower or upper file handle and maybe - * copy up an ancestor to make lower file handle connectable. - */ -- err = enc_lower = ovl_check_encode_origin(dentry); -+ err = enc_lower = ovl_check_encode_origin(inode); - if (enc_lower < 0) - goto fail; - - /* Encode an upper or lower file handle */ -- fh = ovl_encode_real_fh(ofs, enc_lower ? ovl_dentry_lower(dentry) : -- ovl_dentry_upper(dentry), !enc_lower); -+ fh = ovl_encode_real_fh(ofs, enc_lower ? ovl_inode_lower(inode) : -+ ovl_inode_upper(inode), !enc_lower); - if (IS_ERR(fh)) - return PTR_ERR(fh); - -@@ -256,8 +267,8 @@ static int ovl_dentry_to_fid(struct ovl_fs *ofs, struct dentry *dentry, - return err; - - fail: -- pr_warn_ratelimited("failed to encode file handle (%pd2, err=%i)\n", -- dentry, err); -+ pr_warn_ratelimited("failed to encode file handle (ino=%lu, err=%i)\n", -+ inode->i_ino, err); - goto out; - } - -@@ -265,19 +276,13 @@ static int ovl_encode_fh(struct inode *inode, u32 *fid, int *max_len, - struct inode *parent) - { - struct ovl_fs *ofs = OVL_FS(inode->i_sb); -- struct dentry *dentry; - int bytes, buflen = *max_len << 2; - - /* TODO: encode connectable file handles */ - if (parent) - return FILEID_INVALID; - -- dentry = d_find_any_alias(inode); -- if (!dentry) -- return FILEID_INVALID; -- -- bytes = ovl_dentry_to_fid(ofs, dentry, fid, buflen); -- dput(dentry); -+ bytes = ovl_dentry_to_fid(ofs, inode, fid, buflen); - if (bytes <= 0) - return FILEID_INVALID; - -diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c -index 80391c687c2ad8..2d2ef671b36ba5 100644 ---- a/fs/overlayfs/namei.c -+++ b/fs/overlayfs/namei.c -@@ -507,6 +507,19 @@ static int ovl_verify_fh(struct ovl_fs *ofs, struct dentry *dentry, - return err; - } - -+int ovl_verify_set_fh(struct ovl_fs *ofs, struct dentry *dentry, -+ enum ovl_xattr ox, const struct ovl_fh *fh, -+ bool is_upper, bool set) -+{ -+ int err; -+ -+ err = ovl_verify_fh(ofs, dentry, ox, fh); -+ if (set && err == -ENODATA) -+ err = ovl_setxattr(ofs, dentry, ox, fh->buf, fh->fb.len); -+ -+ return err; -+} -+ - /* - * Verify that @real dentry matches the file handle stored in xattr @name. - * -@@ -515,24 +528,22 @@ static int ovl_verify_fh(struct ovl_fs *ofs, struct dentry *dentry, - * - * Return 0 on match, -ESTALE on mismatch, -ENODATA on no xattr, < 0 on error. - */ --int ovl_verify_set_fh(struct ovl_fs *ofs, struct dentry *dentry, -- enum ovl_xattr ox, struct dentry *real, bool is_upper, -- bool set) -+int ovl_verify_origin_xattr(struct ovl_fs *ofs, struct dentry *dentry, -+ enum ovl_xattr ox, struct dentry *real, -+ bool is_upper, bool set) - { - struct inode *inode; - struct ovl_fh *fh; - int err; - -- fh = ovl_encode_real_fh(ofs, real, is_upper); -+ fh = ovl_encode_real_fh(ofs, d_inode(real), is_upper); - err = PTR_ERR(fh); - if (IS_ERR(fh)) { - fh = NULL; - goto fail; - } - -- err = ovl_verify_fh(ofs, dentry, ox, fh); -- if (set && err == -ENODATA) -- err = ovl_setxattr(ofs, dentry, ox, fh->buf, fh->fb.len); -+ err = ovl_verify_set_fh(ofs, dentry, ox, fh, is_upper, set); - if (err) - goto fail; - -@@ -548,6 +559,7 @@ int ovl_verify_set_fh(struct ovl_fs *ofs, struct dentry *dentry, - goto out; - } - -+ - /* Get upper dentry from index */ - struct dentry *ovl_index_upper(struct ovl_fs *ofs, struct dentry *index, - bool connected) -@@ -684,7 +696,7 @@ int ovl_verify_index(struct ovl_fs *ofs, struct dentry *index) - goto out; - } - --static int ovl_get_index_name_fh(struct ovl_fh *fh, struct qstr *name) -+int ovl_get_index_name_fh(const struct ovl_fh *fh, struct qstr *name) - { - char *n, *s; - -@@ -720,7 +732,7 @@ int ovl_get_index_name(struct ovl_fs *ofs, struct dentry *origin, - struct ovl_fh *fh; - int err; - -- fh = ovl_encode_real_fh(ofs, origin, false); -+ fh = ovl_encode_real_fh(ofs, d_inode(origin), false); - if (IS_ERR(fh)) - return PTR_ERR(fh); - -@@ -873,20 +885,27 @@ int ovl_path_next(int idx, struct dentry *dentry, struct path *path) - static int ovl_fix_origin(struct ovl_fs *ofs, struct dentry *dentry, - struct dentry *lower, struct dentry *upper) - { -+ const struct ovl_fh *fh; - int err; - - if (ovl_check_origin_xattr(ofs, upper)) - return 0; - -+ fh = ovl_get_origin_fh(ofs, lower); -+ if (IS_ERR(fh)) -+ return PTR_ERR(fh); -+ - err = ovl_want_write(dentry); - if (err) -- return err; -+ goto out; - -- err = ovl_set_origin(ofs, lower, upper); -+ err = ovl_set_origin_fh(ofs, fh, upper); - if (!err) - err = ovl_set_impure(dentry->d_parent, upper->d_parent); - - ovl_drop_write(dentry); -+out: -+ kfree(fh); - return err; - } - -diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h -index 09ca82ed0f8ced..ca63a26a6170b0 100644 ---- a/fs/overlayfs/overlayfs.h -+++ b/fs/overlayfs/overlayfs.h -@@ -632,11 +632,15 @@ struct dentry *ovl_decode_real_fh(struct ovl_fs *ofs, struct ovl_fh *fh, - int ovl_check_origin_fh(struct ovl_fs *ofs, struct ovl_fh *fh, bool connected, - struct dentry *upperdentry, struct ovl_path **stackp); - int ovl_verify_set_fh(struct ovl_fs *ofs, struct dentry *dentry, -- enum ovl_xattr ox, struct dentry *real, bool is_upper, -- bool set); -+ enum ovl_xattr ox, const struct ovl_fh *fh, -+ bool is_upper, bool set); -+int ovl_verify_origin_xattr(struct ovl_fs *ofs, struct dentry *dentry, -+ enum ovl_xattr ox, struct dentry *real, -+ bool is_upper, bool set); - struct dentry *ovl_index_upper(struct ovl_fs *ofs, struct dentry *index, - bool connected); - int ovl_verify_index(struct ovl_fs *ofs, struct dentry *index); -+int ovl_get_index_name_fh(const struct ovl_fh *fh, struct qstr *name); - int ovl_get_index_name(struct ovl_fs *ofs, struct dentry *origin, - struct qstr *name); - struct dentry *ovl_get_index_fh(struct ovl_fs *ofs, struct ovl_fh *fh); -@@ -648,17 +652,24 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry, - unsigned int flags); - bool ovl_lower_positive(struct dentry *dentry); - -+static inline int ovl_verify_origin_fh(struct ovl_fs *ofs, struct dentry *upper, -+ const struct ovl_fh *fh, bool set) -+{ -+ return ovl_verify_set_fh(ofs, upper, OVL_XATTR_ORIGIN, fh, false, set); -+} -+ - static inline int ovl_verify_origin(struct ovl_fs *ofs, struct dentry *upper, - struct dentry *origin, bool set) - { -- return ovl_verify_set_fh(ofs, upper, OVL_XATTR_ORIGIN, origin, -- false, set); -+ return ovl_verify_origin_xattr(ofs, upper, OVL_XATTR_ORIGIN, origin, -+ false, set); - } - - static inline int ovl_verify_upper(struct ovl_fs *ofs, struct dentry *index, - struct dentry *upper, bool set) - { -- return ovl_verify_set_fh(ofs, index, OVL_XATTR_UPPER, upper, true, set); -+ return ovl_verify_origin_xattr(ofs, index, OVL_XATTR_UPPER, upper, -+ true, set); - } - - /* readdir.c */ -@@ -821,10 +832,11 @@ int ovl_copy_up_with_data(struct dentry *dentry); - int ovl_maybe_copy_up(struct dentry *dentry, int flags); - int ovl_copy_xattr(struct super_block *sb, const struct path *path, struct dentry *new); - int ovl_set_attr(struct ovl_fs *ofs, struct dentry *upper, struct kstat *stat); --struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct dentry *real, -+struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct inode *realinode, - bool is_upper); --int ovl_set_origin(struct ovl_fs *ofs, struct dentry *lower, -- struct dentry *upper); -+struct ovl_fh *ovl_get_origin_fh(struct ovl_fs *ofs, struct dentry *origin); -+int ovl_set_origin_fh(struct ovl_fs *ofs, const struct ovl_fh *fh, -+ struct dentry *upper); - - /* export.c */ - extern const struct export_operations ovl_export_operations; -diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c -index 2c056d737c27c3..e2574034c3fa17 100644 ---- a/fs/overlayfs/super.c -+++ b/fs/overlayfs/super.c -@@ -879,15 +879,20 @@ static int ovl_get_indexdir(struct super_block *sb, struct ovl_fs *ofs, - { - struct vfsmount *mnt = ovl_upper_mnt(ofs); - struct dentry *indexdir; -+ struct dentry *origin = ovl_lowerstack(oe)->dentry; -+ const struct ovl_fh *fh; - int err; - -+ fh = ovl_get_origin_fh(ofs, origin); -+ if (IS_ERR(fh)) -+ return PTR_ERR(fh); -+ - err = mnt_want_write(mnt); - if (err) -- return err; -+ goto out_free_fh; - - /* Verify lower root is upper root origin */ -- err = ovl_verify_origin(ofs, upperpath->dentry, -- ovl_lowerstack(oe)->dentry, true); -+ err = ovl_verify_origin_fh(ofs, upperpath->dentry, fh, true); - if (err) { - pr_err("failed to verify upper root origin\n"); - goto out; -@@ -919,9 +924,10 @@ static int ovl_get_indexdir(struct super_block *sb, struct ovl_fs *ofs, - * directory entries. - */ - if (ovl_check_origin_xattr(ofs, ofs->indexdir)) { -- err = ovl_verify_set_fh(ofs, ofs->indexdir, -- OVL_XATTR_ORIGIN, -- upperpath->dentry, true, false); -+ err = ovl_verify_origin_xattr(ofs, ofs->indexdir, -+ OVL_XATTR_ORIGIN, -+ upperpath->dentry, true, -+ false); - if (err) - pr_err("failed to verify index dir 'origin' xattr\n"); - } -@@ -939,6 +945,8 @@ static int ovl_get_indexdir(struct super_block *sb, struct ovl_fs *ofs, - - out: - mnt_drop_write(mnt); -+out_free_fh: -+ kfree(fh); - return err; - } - -diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c -index 0bf3ffcd072f6a..4e6b747e0f2e25 100644 ---- a/fs/overlayfs/util.c -+++ b/fs/overlayfs/util.c -@@ -976,12 +976,18 @@ static void ovl_cleanup_index(struct dentry *dentry) - struct dentry *index = NULL; - struct inode *inode; - struct qstr name = { }; -+ bool got_write = false; - int err; - - err = ovl_get_index_name(ofs, lowerdentry, &name); - if (err) - goto fail; - -+ err = ovl_want_write(dentry); -+ if (err) -+ goto fail; -+ -+ got_write = true; - inode = d_inode(upperdentry); - if (!S_ISDIR(inode->i_mode) && inode->i_nlink != 1) { - pr_warn_ratelimited("cleanup linked index (%pd2, ino=%lu, nlink=%u)\n", -@@ -1019,6 +1025,8 @@ static void ovl_cleanup_index(struct dentry *dentry) - goto fail; - - out: -+ if (got_write) -+ ovl_drop_write(dentry); - kfree(name.name); - dput(index); - return; -@@ -1089,6 +1097,8 @@ void ovl_nlink_end(struct dentry *dentry) - { - struct inode *inode = d_inode(dentry); - -+ ovl_drop_write(dentry); -+ - if (ovl_test_flag(OVL_INDEX, inode) && inode->i_nlink == 0) { - const struct cred *old_cred; - -diff --git a/fs/smb/client/namespace.c b/fs/smb/client/namespace.c -index 4a517b280f2b79..830f2a292bb00d 100644 ---- a/fs/smb/client/namespace.c -+++ b/fs/smb/client/namespace.c -@@ -196,11 +196,28 @@ static struct vfsmount *cifs_do_automount(struct path *path) - struct smb3_fs_context tmp; - char *full_path; - struct vfsmount *mnt; -+ struct cifs_sb_info *mntpt_sb; -+ struct cifs_ses *ses; - - if (IS_ROOT(mntpt)) - return ERR_PTR(-ESTALE); - -- cur_ctx = CIFS_SB(mntpt->d_sb)->ctx; -+ mntpt_sb = CIFS_SB(mntpt->d_sb); -+ ses = cifs_sb_master_tcon(mntpt_sb)->ses; -+ cur_ctx = mntpt_sb->ctx; -+ -+ /* -+ * At this point, the root session should be in the mntpt sb. We should -+ * bring the sb context passwords in sync with the root session's -+ * passwords. This would help prevent unnecessary retries and password -+ * swaps for automounts. -+ */ -+ mutex_lock(&ses->session_mutex); -+ rc = smb3_sync_session_ctx_passwords(mntpt_sb, ses); -+ mutex_unlock(&ses->session_mutex); -+ -+ if (rc) -+ return ERR_PTR(rc); - - fc = fs_context_for_submount(path->mnt->mnt_sb->s_type, mntpt); - if (IS_ERR(fc)) -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index 2884ebdc0eda02..815a9a5cfa8079 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -695,6 +695,9 @@ void smb2_send_interim_resp(struct ksmbd_work *work, __le32 status) - struct smb2_hdr *rsp_hdr; - struct ksmbd_work *in_work = ksmbd_alloc_work_struct(); - -+ if (!in_work) -+ return; -+ - if (allocate_interim_rsp_buf(in_work)) { - pr_err("smb_allocate_rsp_buf failed!\n"); - ksmbd_free_work_struct(in_work); -@@ -3986,6 +3989,26 @@ static int smb2_populate_readdir_entry(struct ksmbd_conn *conn, int info_level, - posix_info->DeviceId = cpu_to_le32(ksmbd_kstat->kstat->rdev); - posix_info->HardLinks = cpu_to_le32(ksmbd_kstat->kstat->nlink); - posix_info->Mode = cpu_to_le32(ksmbd_kstat->kstat->mode & 0777); -+ switch (ksmbd_kstat->kstat->mode & S_IFMT) { -+ case S_IFDIR: -+ posix_info->Mode |= cpu_to_le32(POSIX_TYPE_DIR << POSIX_FILETYPE_SHIFT); -+ break; -+ case S_IFLNK: -+ posix_info->Mode |= cpu_to_le32(POSIX_TYPE_SYMLINK << POSIX_FILETYPE_SHIFT); -+ break; -+ case S_IFCHR: -+ posix_info->Mode |= cpu_to_le32(POSIX_TYPE_CHARDEV << POSIX_FILETYPE_SHIFT); -+ break; -+ case S_IFBLK: -+ posix_info->Mode |= cpu_to_le32(POSIX_TYPE_BLKDEV << POSIX_FILETYPE_SHIFT); -+ break; -+ case S_IFIFO: -+ posix_info->Mode |= cpu_to_le32(POSIX_TYPE_FIFO << POSIX_FILETYPE_SHIFT); -+ break; -+ case S_IFSOCK: -+ posix_info->Mode |= cpu_to_le32(POSIX_TYPE_SOCKET << POSIX_FILETYPE_SHIFT); -+ } -+ - posix_info->Inode = cpu_to_le64(ksmbd_kstat->kstat->ino); - posix_info->DosAttributes = - S_ISDIR(ksmbd_kstat->kstat->mode) ? -@@ -5174,6 +5197,26 @@ static int find_file_posix_info(struct smb2_query_info_rsp *rsp, - file_info->AllocationSize = cpu_to_le64(stat.blocks << 9); - file_info->HardLinks = cpu_to_le32(stat.nlink); - file_info->Mode = cpu_to_le32(stat.mode & 0777); -+ switch (stat.mode & S_IFMT) { -+ case S_IFDIR: -+ file_info->Mode |= cpu_to_le32(POSIX_TYPE_DIR << POSIX_FILETYPE_SHIFT); -+ break; -+ case S_IFLNK: -+ file_info->Mode |= cpu_to_le32(POSIX_TYPE_SYMLINK << POSIX_FILETYPE_SHIFT); -+ break; -+ case S_IFCHR: -+ file_info->Mode |= cpu_to_le32(POSIX_TYPE_CHARDEV << POSIX_FILETYPE_SHIFT); -+ break; -+ case S_IFBLK: -+ file_info->Mode |= cpu_to_le32(POSIX_TYPE_BLKDEV << POSIX_FILETYPE_SHIFT); -+ break; -+ case S_IFIFO: -+ file_info->Mode |= cpu_to_le32(POSIX_TYPE_FIFO << POSIX_FILETYPE_SHIFT); -+ break; -+ case S_IFSOCK: -+ file_info->Mode |= cpu_to_le32(POSIX_TYPE_SOCKET << POSIX_FILETYPE_SHIFT); -+ } -+ - file_info->DeviceId = cpu_to_le32(stat.rdev); - - /* -diff --git a/fs/smb/server/smb2pdu.h b/fs/smb/server/smb2pdu.h -index 643f5e1cfe3570..25cc81aac350f2 100644 ---- a/fs/smb/server/smb2pdu.h -+++ b/fs/smb/server/smb2pdu.h -@@ -500,4 +500,14 @@ static inline void *smb2_get_msg(void *buf) - return buf + 4; - } - -+#define POSIX_TYPE_FILE 0 -+#define POSIX_TYPE_DIR 1 -+#define POSIX_TYPE_SYMLINK 2 -+#define POSIX_TYPE_CHARDEV 3 -+#define POSIX_TYPE_BLKDEV 4 -+#define POSIX_TYPE_FIFO 5 -+#define POSIX_TYPE_SOCKET 6 -+ -+#define POSIX_FILETYPE_SHIFT 12 -+ - #endif /* _SMB2PDU_H */ -diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c -index 2c548e8efef060..d0c19ad9d0145c 100644 ---- a/fs/smb/server/vfs.c -+++ b/fs/smb/server/vfs.c -@@ -1259,6 +1259,8 @@ int ksmbd_vfs_kern_path_locked(struct ksmbd_work *work, char *name, - filepath, - flags, - path); -+ if (!is_last) -+ next[0] = '/'; - if (err) - goto out2; - else if (is_last) -@@ -1266,7 +1268,6 @@ int ksmbd_vfs_kern_path_locked(struct ksmbd_work *work, char *name, - path_put(parent_path); - *parent_path = *path; - -- next[0] = '/'; - remain_len -= filename_len + 1; - } - -diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h -index 0c50c4fceb95dd..0ca93c7574ad22 100644 ---- a/include/linux/hugetlb.h -+++ b/include/linux/hugetlb.h -@@ -1239,7 +1239,7 @@ static inline __init void hugetlb_cma_reserve(int order) - } - #endif - --#ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE -+#ifdef CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING - static inline bool hugetlb_pmd_shared(pte_t *pte) - { - return page_count(virt_to_page(pte)) > 1; -@@ -1275,8 +1275,7 @@ bool __vma_private_lock(struct vm_area_struct *vma); - static inline pte_t * - hugetlb_walk(struct vm_area_struct *vma, unsigned long addr, unsigned long sz) - { --#if defined(CONFIG_HUGETLB_PAGE) && \ -- defined(CONFIG_ARCH_WANT_HUGE_PMD_SHARE) && defined(CONFIG_LOCKDEP) -+#if defined(CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING) && defined(CONFIG_LOCKDEP) - struct hugetlb_vma_lock *vma_lock = vma->vm_private_data; - - /* -diff --git a/include/linux/mm.h b/include/linux/mm.h -index b6a4d6471b4a72..209370f6443666 100644 ---- a/include/linux/mm.h -+++ b/include/linux/mm.h -@@ -3031,6 +3031,7 @@ static inline bool pagetable_pmd_ctor(struct ptdesc *ptdesc) - if (!pmd_ptlock_init(ptdesc)) - return false; - __folio_set_pgtable(folio); -+ ptdesc_pmd_pts_init(ptdesc); - lruvec_stat_add_folio(folio, NR_PAGETABLE); - return true; - } -diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h -index 20c96ce98751a4..e77d4a5c0baced 100644 ---- a/include/linux/mm_types.h -+++ b/include/linux/mm_types.h -@@ -398,11 +398,12 @@ FOLIO_MATCH(compound_head, _head_2a); - * @pmd_huge_pte: Protected by ptdesc->ptl, used for THPs. - * @__page_mapping: Aliases with page->mapping. Unused for page tables. - * @pt_mm: Used for x86 pgds. -- * @pt_frag_refcount: For fragmented page table tracking. Powerpc and s390 only. -+ * @pt_frag_refcount: For fragmented page table tracking. Powerpc only. -+ * @pt_share_count: Used for HugeTLB PMD page table share count. - * @_pt_pad_2: Padding to ensure proper alignment. - * @ptl: Lock for the page table. - * @__page_type: Same as page->page_type. Unused for page tables. -- * @_refcount: Same as page refcount. Used for s390 page tables. -+ * @_refcount: Same as page refcount. - * @pt_memcg_data: Memcg data. Tracked for page tables here. - * - * This struct overlays struct page for now. Do not modify without a good -@@ -424,6 +425,9 @@ struct ptdesc { - union { - struct mm_struct *pt_mm; - atomic_t pt_frag_refcount; -+#ifdef CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING -+ atomic_t pt_share_count; -+#endif - }; - - union { -@@ -468,6 +472,32 @@ static_assert(sizeof(struct ptdesc) <= sizeof(struct page)); - const struct page *: (const struct ptdesc *)(p), \ - struct page *: (struct ptdesc *)(p))) - -+#ifdef CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING -+static inline void ptdesc_pmd_pts_init(struct ptdesc *ptdesc) -+{ -+ atomic_set(&ptdesc->pt_share_count, 0); -+} -+ -+static inline void ptdesc_pmd_pts_inc(struct ptdesc *ptdesc) -+{ -+ atomic_inc(&ptdesc->pt_share_count); -+} -+ -+static inline void ptdesc_pmd_pts_dec(struct ptdesc *ptdesc) -+{ -+ atomic_dec(&ptdesc->pt_share_count); -+} -+ -+static inline int ptdesc_pmd_pts_count(struct ptdesc *ptdesc) -+{ -+ return atomic_read(&ptdesc->pt_share_count); -+} -+#else -+static inline void ptdesc_pmd_pts_init(struct ptdesc *ptdesc) -+{ -+} -+#endif -+ - /* - * Used for sizing the vmemmap region on some architectures - */ -diff --git a/include/linux/numa.h b/include/linux/numa.h -index 1d43371fafd2fc..eb19503604fe36 100644 ---- a/include/linux/numa.h -+++ b/include/linux/numa.h -@@ -15,6 +15,11 @@ - #define NUMA_NO_NODE (-1) - #define NUMA_NO_MEMBLK (-1) - -+static inline bool numa_valid_node(int nid) -+{ -+ return nid >= 0 && nid < MAX_NUMNODES; -+} -+ - /* optionally keep NUMA memory info available post init */ - #ifdef CONFIG_NUMA_KEEP_MEMINFO - #define __initdata_or_meminfo -diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h -index fee1e565055100..e85834722b8f2b 100644 ---- a/include/net/inet_connection_sock.h -+++ b/include/net/inet_connection_sock.h -@@ -282,7 +282,7 @@ static inline int inet_csk_reqsk_queue_len(const struct sock *sk) - - static inline int inet_csk_reqsk_queue_is_full(const struct sock *sk) - { -- return inet_csk_reqsk_queue_len(sk) >= sk->sk_max_ack_backlog; -+ return inet_csk_reqsk_queue_len(sk) > READ_ONCE(sk->sk_max_ack_backlog); - } - - bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req); -diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h -index f66a275bf8ccdb..20d129914121d5 100644 ---- a/include/ufs/ufshcd.h -+++ b/include/ufs/ufshcd.h -@@ -324,7 +324,6 @@ struct ufs_pwr_mode_info { - * @config_scaling_param: called to configure clock scaling parameters - * @program_key: program or evict an inline encryption key - * @event_notify: called to notify important events -- * @reinit_notify: called to notify reinit of UFSHCD during max gear switch - * @mcq_config_resource: called to configure MCQ platform resources - * @get_hba_mac: called to get vendor specific mac value, mandatory for mcq mode - * @op_runtime_config: called to config Operation and runtime regs Pointers -@@ -369,7 +368,6 @@ struct ufs_hba_variant_ops { - const union ufs_crypto_cfg_entry *cfg, int slot); - void (*event_notify)(struct ufs_hba *hba, - enum ufs_event_type evt, void *data); -- void (*reinit_notify)(struct ufs_hba *); - int (*mcq_config_resource)(struct ufs_hba *hba); - int (*get_hba_mac)(struct ufs_hba *hba); - int (*op_runtime_config)(struct ufs_hba *hba); -diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c -index 0122f220ef0d2b..c7198fbcf734f7 100644 ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -537,6 +537,13 @@ static __cold void io_queue_deferred(struct io_ring_ctx *ctx) - } - } - -+static void io_eventfd_free(struct rcu_head *rcu) -+{ -+ struct io_ev_fd *ev_fd = container_of(rcu, struct io_ev_fd, rcu); -+ -+ eventfd_ctx_put(ev_fd->cq_ev_fd); -+ kfree(ev_fd); -+} - - static void io_eventfd_ops(struct rcu_head *rcu) - { -@@ -550,10 +557,8 @@ static void io_eventfd_ops(struct rcu_head *rcu) - * ordering in a race but if references are 0 we know we have to free - * it regardless. - */ -- if (atomic_dec_and_test(&ev_fd->refs)) { -- eventfd_ctx_put(ev_fd->cq_ev_fd); -- kfree(ev_fd); -- } -+ if (atomic_dec_and_test(&ev_fd->refs)) -+ call_rcu(&ev_fd->rcu, io_eventfd_free); - } - - static void io_eventfd_signal(struct io_ring_ctx *ctx) -diff --git a/io_uring/timeout.c b/io_uring/timeout.c -index 4f1f710197d623..277e22d55c6171 100644 ---- a/io_uring/timeout.c -+++ b/io_uring/timeout.c -@@ -413,10 +413,12 @@ static int io_timeout_update(struct io_ring_ctx *ctx, __u64 user_data, - - timeout->off = 0; /* noseq */ - data = req->async_data; -+ data->ts = *ts; -+ - list_add_tail(&timeout->list, &ctx->timeout_list); - hrtimer_init(&data->timer, io_timeout_get_clock(data), mode); - data->timer.function = io_timeout_fn; -- hrtimer_start(&data->timer, timespec64_to_ktime(*ts), mode); -+ hrtimer_start(&data->timer, timespec64_to_ktime(data->ts), mode); - return 0; - } - -diff --git a/kernel/workqueue.c b/kernel/workqueue.c -index 7fa1c7c9151aef..59b6efb2a11c36 100644 ---- a/kernel/workqueue.c -+++ b/kernel/workqueue.c -@@ -2541,6 +2541,7 @@ __acquires(&pool->lock) - struct pool_workqueue *pwq = get_work_pwq(work); - struct worker_pool *pool = worker->pool; - unsigned long work_data; -+ int lockdep_start_depth, rcu_start_depth; - #ifdef CONFIG_LOCKDEP - /* - * It is permissible to free the struct work_struct from -@@ -2603,6 +2604,8 @@ __acquires(&pool->lock) - pwq->stats[PWQ_STAT_STARTED]++; - raw_spin_unlock_irq(&pool->lock); - -+ rcu_start_depth = rcu_preempt_depth(); -+ lockdep_start_depth = lockdep_depth(current); - lock_map_acquire(&pwq->wq->lockdep_map); - lock_map_acquire(&lockdep_map); - /* -@@ -2638,10 +2641,14 @@ __acquires(&pool->lock) - lock_map_release(&lockdep_map); - lock_map_release(&pwq->wq->lockdep_map); - -- if (unlikely(in_atomic() || lockdep_depth(current) > 0)) { -- pr_err("BUG: workqueue leaked lock or atomic: %s/0x%08x/%d\n" -- " last function: %ps\n", -- current->comm, preempt_count(), task_pid_nr(current), -+ if (unlikely((worker->task && in_atomic()) || -+ lockdep_depth(current) != lockdep_start_depth || -+ rcu_preempt_depth() != rcu_start_depth)) { -+ pr_err("BUG: workqueue leaked atomic, lock or RCU: %s[%d]\n" -+ " preempt=0x%08x lock=%d->%d RCU=%d->%d workfn=%ps\n", -+ current->comm, task_pid_nr(current), preempt_count(), -+ lockdep_start_depth, lockdep_depth(current), -+ rcu_start_depth, rcu_preempt_depth(), - worker->current_func); - debug_show_held_locks(current); - dump_stack(); -@@ -2940,23 +2947,27 @@ static int rescuer_thread(void *__rescuer) - * check_flush_dependency - check for flush dependency sanity - * @target_wq: workqueue being flushed - * @target_work: work item being flushed (NULL for workqueue flushes) -+ * @from_cancel: are we called from the work cancel path - * - * %current is trying to flush the whole @target_wq or @target_work on it. -- * If @target_wq doesn't have %WQ_MEM_RECLAIM, verify that %current is not -- * reclaiming memory or running on a workqueue which doesn't have -- * %WQ_MEM_RECLAIM as that can break forward-progress guarantee leading to -- * a deadlock. -+ * If this is not the cancel path (which implies work being flushed is either -+ * already running, or will not be at all), check if @target_wq doesn't have -+ * %WQ_MEM_RECLAIM and verify that %current is not reclaiming memory or running -+ * on a workqueue which doesn't have %WQ_MEM_RECLAIM as that can break forward- -+ * progress guarantee leading to a deadlock. - */ - static void check_flush_dependency(struct workqueue_struct *target_wq, -- struct work_struct *target_work) -+ struct work_struct *target_work, -+ bool from_cancel) - { -- work_func_t target_func = target_work ? target_work->func : NULL; -+ work_func_t target_func; - struct worker *worker; - -- if (target_wq->flags & WQ_MEM_RECLAIM) -+ if (from_cancel || target_wq->flags & WQ_MEM_RECLAIM) - return; - - worker = current_wq_worker(); -+ target_func = target_work ? target_work->func : NULL; - - WARN_ONCE(current->flags & PF_MEMALLOC, - "workqueue: PF_MEMALLOC task %d(%s) is flushing !WQ_MEM_RECLAIM %s:%ps", -@@ -3122,6 +3133,19 @@ static bool flush_workqueue_prep_pwqs(struct workqueue_struct *wq, - return wait; - } - -+static void touch_wq_lockdep_map(struct workqueue_struct *wq) -+{ -+ lock_map_acquire(&wq->lockdep_map); -+ lock_map_release(&wq->lockdep_map); -+} -+ -+static void touch_work_lockdep_map(struct work_struct *work, -+ struct workqueue_struct *wq) -+{ -+ lock_map_acquire(&work->lockdep_map); -+ lock_map_release(&work->lockdep_map); -+} -+ - /** - * __flush_workqueue - ensure that any scheduled work has run to completion. - * @wq: workqueue to flush -@@ -3141,8 +3165,7 @@ void __flush_workqueue(struct workqueue_struct *wq) - if (WARN_ON(!wq_online)) - return; - -- lock_map_acquire(&wq->lockdep_map); -- lock_map_release(&wq->lockdep_map); -+ touch_wq_lockdep_map(wq); - - mutex_lock(&wq->mutex); - -@@ -3189,7 +3212,7 @@ void __flush_workqueue(struct workqueue_struct *wq) - list_add_tail(&this_flusher.list, &wq->flusher_overflow); - } - -- check_flush_dependency(wq, NULL); -+ check_flush_dependency(wq, NULL, false); - - mutex_unlock(&wq->mutex); - -@@ -3341,6 +3364,7 @@ static bool start_flush_work(struct work_struct *work, struct wq_barrier *barr, - struct worker *worker = NULL; - struct worker_pool *pool; - struct pool_workqueue *pwq; -+ struct workqueue_struct *wq; - - might_sleep(); - -@@ -3364,11 +3388,14 @@ static bool start_flush_work(struct work_struct *work, struct wq_barrier *barr, - pwq = worker->current_pwq; - } - -- check_flush_dependency(pwq->wq, work); -+ wq = pwq->wq; -+ check_flush_dependency(wq, work, from_cancel); - - insert_wq_barrier(pwq, barr, work, worker); - raw_spin_unlock_irq(&pool->lock); - -+ touch_work_lockdep_map(work, wq); -+ - /* - * Force a lock recursion deadlock when using flush_work() inside a - * single-threaded or rescuer equipped workqueue. -@@ -3378,11 +3405,9 @@ static bool start_flush_work(struct work_struct *work, struct wq_barrier *barr, - * workqueues the deadlock happens when the rescuer stalls, blocking - * forward progress. - */ -- if (!from_cancel && -- (pwq->wq->saved_max_active == 1 || pwq->wq->rescuer)) { -- lock_map_acquire(&pwq->wq->lockdep_map); -- lock_map_release(&pwq->wq->lockdep_map); -- } -+ if (!from_cancel && (wq->saved_max_active == 1 || wq->rescuer)) -+ touch_wq_lockdep_map(wq); -+ - rcu_read_unlock(); - return true; - already_gone: -@@ -3401,9 +3426,6 @@ static bool __flush_work(struct work_struct *work, bool from_cancel) - if (WARN_ON(!work->func)) - return false; - -- lock_map_acquire(&work->lockdep_map); -- lock_map_release(&work->lockdep_map); -- - if (start_flush_work(work, &barr, from_cancel)) { - wait_for_completion(&barr.done); - destroy_work_on_stack(&barr.work); -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index 92b955cc5a41d3..21c12519a7ef3a 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -6907,7 +6907,7 @@ long hugetlb_unreserve_pages(struct inode *inode, long start, long end, - return 0; - } - --#ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE -+#ifdef CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING - static unsigned long page_table_shareable(struct vm_area_struct *svma, - struct vm_area_struct *vma, - unsigned long addr, pgoff_t idx) -@@ -7014,7 +7014,7 @@ pte_t *huge_pmd_share(struct mm_struct *mm, struct vm_area_struct *vma, - spte = hugetlb_walk(svma, saddr, - vma_mmu_pagesize(svma)); - if (spte) { -- get_page(virt_to_page(spte)); -+ ptdesc_pmd_pts_inc(virt_to_ptdesc(spte)); - break; - } - } -@@ -7029,7 +7029,7 @@ pte_t *huge_pmd_share(struct mm_struct *mm, struct vm_area_struct *vma, - (pmd_t *)((unsigned long)spte & PAGE_MASK)); - mm_inc_nr_pmds(mm); - } else { -- put_page(virt_to_page(spte)); -+ ptdesc_pmd_pts_dec(virt_to_ptdesc(spte)); - } - spin_unlock(&mm->page_table_lock); - out: -@@ -7041,10 +7041,6 @@ pte_t *huge_pmd_share(struct mm_struct *mm, struct vm_area_struct *vma, - /* - * unmap huge page backed by shared pte. - * -- * Hugetlb pte page is ref counted at the time of mapping. If pte is shared -- * indicated by page_count > 1, unmap is achieved by clearing pud and -- * decrementing the ref count. If count == 1, the pte page is not shared. -- * - * Called with page table lock held. - * - * returns: 1 successfully unmapped a shared pte page -@@ -7053,23 +7049,25 @@ pte_t *huge_pmd_share(struct mm_struct *mm, struct vm_area_struct *vma, - int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, - unsigned long addr, pte_t *ptep) - { -+ unsigned long sz = huge_page_size(hstate_vma(vma)); - pgd_t *pgd = pgd_offset(mm, addr); - p4d_t *p4d = p4d_offset(pgd, addr); - pud_t *pud = pud_offset(p4d, addr); - - i_mmap_assert_write_locked(vma->vm_file->f_mapping); - hugetlb_vma_assert_locked(vma); -- BUG_ON(page_count(virt_to_page(ptep)) == 0); -- if (page_count(virt_to_page(ptep)) == 1) -+ if (sz != PMD_SIZE) -+ return 0; -+ if (!ptdesc_pmd_pts_count(virt_to_ptdesc(ptep))) - return 0; - - pud_clear(pud); -- put_page(virt_to_page(ptep)); -+ ptdesc_pmd_pts_dec(virt_to_ptdesc(ptep)); - mm_dec_nr_pmds(mm); - return 1; - } - --#else /* !CONFIG_ARCH_WANT_HUGE_PMD_SHARE */ -+#else /* !CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING */ - - pte_t *huge_pmd_share(struct mm_struct *mm, struct vm_area_struct *vma, - unsigned long addr, pud_t *pud) -@@ -7092,7 +7090,7 @@ bool want_pmd_share(struct vm_area_struct *vma, unsigned long addr) - { - return false; - } --#endif /* CONFIG_ARCH_WANT_HUGE_PMD_SHARE */ -+#endif /* CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING */ - - #ifdef CONFIG_ARCH_WANT_GENERAL_HUGETLB - pte_t *huge_pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma, -@@ -7190,7 +7188,7 @@ unsigned long hugetlb_mask_last_page(struct hstate *h) - /* See description above. Architectures can provide their own version. */ - __weak unsigned long hugetlb_mask_last_page(struct hstate *h) - { --#ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE -+#ifdef CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING - if (huge_page_size(h) == PMD_SIZE) - return PUD_SIZE - PMD_SIZE; - #endif -diff --git a/mm/memblock.c b/mm/memblock.c -index 87a2b4340ce4ea..e8a2a1537d6a85 100644 ---- a/mm/memblock.c -+++ b/mm/memblock.c -@@ -754,7 +754,7 @@ bool __init_memblock memblock_validate_numa_coverage(unsigned long threshold_byt - - /* calculate lose page */ - for_each_mem_pfn_range(i, MAX_NUMNODES, &start_pfn, &end_pfn, &nid) { -- if (nid == NUMA_NO_NODE) -+ if (!numa_valid_node(nid)) - nr_pages += end_pfn - start_pfn; - } - -@@ -1043,7 +1043,7 @@ static bool should_skip_region(struct memblock_type *type, - return false; - - /* only memory regions are associated with nodes, check it */ -- if (nid != NUMA_NO_NODE && nid != m_nid) -+ if (numa_valid_node(nid) && nid != m_nid) - return true; - - /* skip hotpluggable memory regions if needed */ -@@ -1100,10 +1100,6 @@ void __next_mem_range(u64 *idx, int nid, enum memblock_flags flags, - int idx_a = *idx & 0xffffffff; - int idx_b = *idx >> 32; - -- if (WARN_ONCE(nid == MAX_NUMNODES, -- "Usage of MAX_NUMNODES is deprecated. Use NUMA_NO_NODE instead\n")) -- nid = NUMA_NO_NODE; -- - for (; idx_a < type_a->cnt; idx_a++) { - struct memblock_region *m = &type_a->regions[idx_a]; - -@@ -1197,9 +1193,6 @@ void __init_memblock __next_mem_range_rev(u64 *idx, int nid, - int idx_a = *idx & 0xffffffff; - int idx_b = *idx >> 32; - -- if (WARN_ONCE(nid == MAX_NUMNODES, "Usage of MAX_NUMNODES is deprecated. Use NUMA_NO_NODE instead\n")) -- nid = NUMA_NO_NODE; -- - if (*idx == (u64)ULLONG_MAX) { - idx_a = type_a->cnt - 1; - if (type_b != NULL) -@@ -1285,7 +1278,7 @@ void __init_memblock __next_mem_pfn_range(int *idx, int nid, - - if (PFN_UP(r->base) >= PFN_DOWN(r->base + r->size)) - continue; -- if (nid == MAX_NUMNODES || nid == r_nid) -+ if (!numa_valid_node(nid) || nid == r_nid) - break; - } - if (*idx >= type->cnt) { -@@ -1430,9 +1423,6 @@ phys_addr_t __init memblock_alloc_range_nid(phys_addr_t size, - enum memblock_flags flags = choose_memblock_flags(); - phys_addr_t found; - -- if (WARN_ONCE(nid == MAX_NUMNODES, "Usage of MAX_NUMNODES is deprecated. Use NUMA_NO_NODE instead\n")) -- nid = NUMA_NO_NODE; -- - if (!align) { - /* Can't use WARNs this early in boot on powerpc */ - dump_stack(); -@@ -1445,7 +1435,7 @@ phys_addr_t __init memblock_alloc_range_nid(phys_addr_t size, - if (found && !memblock_reserve(found, size)) - goto done; - -- if (nid != NUMA_NO_NODE && !exact_nid) { -+ if (numa_valid_node(nid) && !exact_nid) { - found = memblock_find_in_range_node(size, align, start, - end, NUMA_NO_NODE, - flags); -@@ -1965,7 +1955,7 @@ static void __init_memblock memblock_dump(struct memblock_type *type) - end = base + size - 1; - flags = rgn->flags; - #ifdef CONFIG_NUMA -- if (memblock_get_region_node(rgn) != MAX_NUMNODES) -+ if (numa_valid_node(memblock_get_region_node(rgn))) - snprintf(nid_buf, sizeof(nid_buf), " on node %d", - memblock_get_region_node(rgn)); - #endif -@@ -2154,7 +2144,7 @@ static void __init memmap_init_reserved_pages(void) - start = region->base; - end = start + region->size; - -- if (nid == NUMA_NO_NODE || nid >= MAX_NUMNODES) -+ if (!numa_valid_node(nid)) - nid = early_pfn_to_nid(PFN_DOWN(start)); - - reserve_bootmem_region(start, end, nid); -@@ -2243,7 +2233,7 @@ static int memblock_debug_show(struct seq_file *m, void *private) - - seq_printf(m, "%4d: ", i); - seq_printf(m, "%pa..%pa ", ®->base, &end); -- if (nid != MAX_NUMNODES) -+ if (numa_valid_node(nid)) - seq_printf(m, "%4d ", nid); - else - seq_printf(m, "%4c ", 'x'); -diff --git a/net/802/psnap.c b/net/802/psnap.c -index 1406bfdbda13b7..dbd9647f2ef1a0 100644 ---- a/net/802/psnap.c -+++ b/net/802/psnap.c -@@ -55,11 +55,11 @@ static int snap_rcv(struct sk_buff *skb, struct net_device *dev, - goto drop; - - rcu_read_lock(); -- proto = find_snap_client(skb_transport_header(skb)); -+ proto = find_snap_client(skb->data); - if (proto) { - /* Pass the frame on. */ -- skb->transport_header += 5; - skb_pull_rcsum(skb, 5); -+ skb_reset_transport_header(skb); - rc = proto->rcvfunc(skb, dev, &snap_packet_type, orig_dev); - } - rcu_read_unlock(); -diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c -index d95e2b55badb47..d6f40806ee5126 100644 ---- a/net/bluetooth/hci_sync.c -+++ b/net/bluetooth/hci_sync.c -@@ -1049,9 +1049,9 @@ static bool adv_use_rpa(struct hci_dev *hdev, uint32_t flags) - - static int hci_set_random_addr_sync(struct hci_dev *hdev, bdaddr_t *rpa) - { -- /* If we're advertising or initiating an LE connection we can't -- * go ahead and change the random address at this time. This is -- * because the eventual initiator address used for the -+ /* If a random_addr has been set we're advertising or initiating an LE -+ * connection we can't go ahead and change the random address at this -+ * time. This is because the eventual initiator address used for the - * subsequently created connection will be undefined (some - * controllers use the new address and others the one we had - * when the operation started). -@@ -1059,8 +1059,9 @@ static int hci_set_random_addr_sync(struct hci_dev *hdev, bdaddr_t *rpa) - * In this kind of scenario skip the update and let the random - * address be updated at the next cycle. - */ -- if (hci_dev_test_flag(hdev, HCI_LE_ADV) || -- hci_lookup_le_connect(hdev)) { -+ if (bacmp(&hdev->random_addr, BDADDR_ANY) && -+ (hci_dev_test_flag(hdev, HCI_LE_ADV) || -+ hci_lookup_le_connect(hdev))) { - bt_dev_dbg(hdev, "Deferring random address update"); - hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); - return 0; -diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c -index 1175248e4bec4b..e3440f0d7d9d97 100644 ---- a/net/bluetooth/mgmt.c -+++ b/net/bluetooth/mgmt.c -@@ -7589,6 +7589,24 @@ static void device_added(struct sock *sk, struct hci_dev *hdev, - mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); - } - -+static void add_device_complete(struct hci_dev *hdev, void *data, int err) -+{ -+ struct mgmt_pending_cmd *cmd = data; -+ struct mgmt_cp_add_device *cp = cmd->param; -+ -+ if (!err) { -+ device_added(cmd->sk, hdev, &cp->addr.bdaddr, cp->addr.type, -+ cp->action); -+ device_flags_changed(NULL, hdev, &cp->addr.bdaddr, -+ cp->addr.type, hdev->conn_flags, -+ PTR_UINT(cmd->user_data)); -+ } -+ -+ mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_ADD_DEVICE, -+ mgmt_status(err), &cp->addr, sizeof(cp->addr)); -+ mgmt_pending_free(cmd); -+} -+ - static int add_device_sync(struct hci_dev *hdev, void *data) - { - return hci_update_passive_scan_sync(hdev); -@@ -7597,6 +7615,7 @@ static int add_device_sync(struct hci_dev *hdev, void *data) - static int add_device(struct sock *sk, struct hci_dev *hdev, - void *data, u16 len) - { -+ struct mgmt_pending_cmd *cmd; - struct mgmt_cp_add_device *cp = data; - u8 auto_conn, addr_type; - struct hci_conn_params *params; -@@ -7677,9 +7696,24 @@ static int add_device(struct sock *sk, struct hci_dev *hdev, - current_flags = params->flags; - } - -- err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL); -- if (err < 0) -+ cmd = mgmt_pending_new(sk, MGMT_OP_ADD_DEVICE, hdev, data, len); -+ if (!cmd) { -+ err = -ENOMEM; - goto unlock; -+ } -+ -+ cmd->user_data = UINT_PTR(current_flags); -+ -+ err = hci_cmd_sync_queue(hdev, add_device_sync, cmd, -+ add_device_complete); -+ if (err < 0) { -+ err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, -+ MGMT_STATUS_FAILED, &cp->addr, -+ sizeof(cp->addr)); -+ mgmt_pending_free(cmd); -+ } -+ -+ goto unlock; - - added: - device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); -diff --git a/net/core/link_watch.c b/net/core/link_watch.c -index 66422c95c83c77..e2e8a341318bda 100644 ---- a/net/core/link_watch.c -+++ b/net/core/link_watch.c -@@ -42,14 +42,18 @@ static unsigned char default_operstate(const struct net_device *dev) - * first check whether lower is indeed the source of its down state. - */ - if (!netif_carrier_ok(dev)) { -- int iflink = dev_get_iflink(dev); - struct net_device *peer; -+ int iflink; - - /* If called from netdev_run_todo()/linkwatch_sync_dev(), - * dev_net(dev) can be already freed, and RTNL is not held. - */ -- if (dev->reg_state == NETREG_UNREGISTERED || -- iflink == dev->ifindex) -+ if (dev->reg_state <= NETREG_REGISTERED) -+ iflink = dev_get_iflink(dev); -+ else -+ iflink = dev->ifindex; -+ -+ if (iflink == dev->ifindex) - return IF_OPER_DOWN; - - ASSERT_RTNL(); -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index df3ddf31f8e673..705320f160ac86 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -832,7 +832,7 @@ static void tcp_v4_send_reset(const struct sock *sk, struct sk_buff *skb) - sock_net_set(ctl_sk, net); - if (sk) { - ctl_sk->sk_mark = (sk->sk_state == TCP_TIME_WAIT) ? -- inet_twsk(sk)->tw_mark : sk->sk_mark; -+ inet_twsk(sk)->tw_mark : READ_ONCE(sk->sk_mark); - ctl_sk->sk_priority = (sk->sk_state == TCP_TIME_WAIT) ? - inet_twsk(sk)->tw_priority : sk->sk_priority; - transmit_time = tcp_transmit_time(sk); -diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c -index de75df904a0034..34ae0ef4f9f396 100644 ---- a/net/mptcp/ctrl.c -+++ b/net/mptcp/ctrl.c -@@ -87,16 +87,15 @@ static void mptcp_pernet_set_defaults(struct mptcp_pernet *pernet) - } - - #ifdef CONFIG_SYSCTL --static int mptcp_set_scheduler(const struct net *net, const char *name) -+static int mptcp_set_scheduler(char *scheduler, const char *name) - { -- struct mptcp_pernet *pernet = mptcp_get_pernet(net); - struct mptcp_sched_ops *sched; - int ret = 0; - - rcu_read_lock(); - sched = mptcp_sched_find(name); - if (sched) -- strscpy(pernet->scheduler, name, MPTCP_SCHED_NAME_MAX); -+ strscpy(scheduler, name, MPTCP_SCHED_NAME_MAX); - else - ret = -ENOENT; - rcu_read_unlock(); -@@ -107,7 +106,7 @@ static int mptcp_set_scheduler(const struct net *net, const char *name) - static int proc_scheduler(struct ctl_table *ctl, int write, - void *buffer, size_t *lenp, loff_t *ppos) - { -- const struct net *net = current->nsproxy->net_ns; -+ char (*scheduler)[MPTCP_SCHED_NAME_MAX] = ctl->data; - char val[MPTCP_SCHED_NAME_MAX]; - struct ctl_table tbl = { - .data = val, -@@ -115,11 +114,11 @@ static int proc_scheduler(struct ctl_table *ctl, int write, - }; - int ret; - -- strscpy(val, mptcp_get_scheduler(net), MPTCP_SCHED_NAME_MAX); -+ strscpy(val, *scheduler, MPTCP_SCHED_NAME_MAX); - - ret = proc_dostring(&tbl, write, buffer, lenp, ppos); - if (write && ret == 0) -- ret = mptcp_set_scheduler(net, val); -+ ret = mptcp_set_scheduler(*scheduler, val); - - return ret; - } -diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c -index e4ae2a08da6ac3..34ad5975fbf3ba 100644 ---- a/net/netfilter/nf_conntrack_core.c -+++ b/net/netfilter/nf_conntrack_core.c -@@ -2568,12 +2568,15 @@ void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls) - struct hlist_nulls_head *hash; - unsigned int nr_slots, i; - -- if (*sizep > (UINT_MAX / sizeof(struct hlist_nulls_head))) -+ if (*sizep > (INT_MAX / sizeof(struct hlist_nulls_head))) - return NULL; - - BUILD_BUG_ON(sizeof(struct hlist_nulls_head) != sizeof(struct hlist_head)); - nr_slots = *sizep = roundup(*sizep, PAGE_SIZE / sizeof(struct hlist_nulls_head)); - -+ if (nr_slots > (INT_MAX / sizeof(struct hlist_nulls_head))) -+ return NULL; -+ - hash = kvcalloc(nr_slots, sizeof(struct hlist_nulls_head), GFP_KERNEL); - - if (hash && nulls) -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index a110aad45fe487..1d1e998acd675e 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -8375,6 +8375,7 @@ static void nft_unregister_flowtable_hook(struct net *net, - } - - static void __nft_unregister_flowtable_net_hooks(struct net *net, -+ struct nft_flowtable *flowtable, - struct list_head *hook_list, - bool release_netdev) - { -@@ -8382,6 +8383,8 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net, - - list_for_each_entry_safe(hook, next, hook_list, list) { - nf_unregister_net_hook(net, &hook->ops); -+ flowtable->data.type->setup(&flowtable->data, hook->ops.dev, -+ FLOW_BLOCK_UNBIND); - if (release_netdev) { - list_del(&hook->list); - kfree_rcu(hook, rcu); -@@ -8390,9 +8393,10 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net, - } - - static void nft_unregister_flowtable_net_hooks(struct net *net, -+ struct nft_flowtable *flowtable, - struct list_head *hook_list) - { -- __nft_unregister_flowtable_net_hooks(net, hook_list, false); -+ __nft_unregister_flowtable_net_hooks(net, flowtable, hook_list, false); - } - - static int nft_register_flowtable_net_hooks(struct net *net, -@@ -9028,8 +9032,6 @@ static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) - - flowtable->data.type->free(&flowtable->data); - list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) { -- flowtable->data.type->setup(&flowtable->data, hook->ops.dev, -- FLOW_BLOCK_UNBIND); - list_del_rcu(&hook->list); - kfree_rcu(hook, rcu); - } -@@ -10399,6 +10401,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) - &nft_trans_flowtable_hooks(trans), - trans->msg_type); - nft_unregister_flowtable_net_hooks(net, -+ nft_trans_flowtable(trans), - &nft_trans_flowtable_hooks(trans)); - } else { - list_del_rcu(&nft_trans_flowtable(trans)->list); -@@ -10407,6 +10410,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) - NULL, - trans->msg_type); - nft_unregister_flowtable_net_hooks(net, -+ nft_trans_flowtable(trans), - &nft_trans_flowtable(trans)->hook_list); - } - break; -@@ -10659,11 +10663,13 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) - case NFT_MSG_NEWFLOWTABLE: - if (nft_trans_flowtable_update(trans)) { - nft_unregister_flowtable_net_hooks(net, -+ nft_trans_flowtable(trans), - &nft_trans_flowtable_hooks(trans)); - } else { - nft_use_dec_restore(&trans->ctx.table->use); - list_del_rcu(&nft_trans_flowtable(trans)->list); - nft_unregister_flowtable_net_hooks(net, -+ nft_trans_flowtable(trans), - &nft_trans_flowtable(trans)->hook_list); - } - break; -@@ -11224,7 +11230,8 @@ static void __nft_release_hook(struct net *net, struct nft_table *table) - list_for_each_entry(chain, &table->chains, list) - __nf_tables_unregister_hook(net, table, chain, true); - list_for_each_entry(flowtable, &table->flowtables, list) -- __nft_unregister_flowtable_net_hooks(net, &flowtable->hook_list, -+ __nft_unregister_flowtable_net_hooks(net, flowtable, -+ &flowtable->hook_list, - true); - } - -diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c -index 6ab317b48d6c39..815216b564f323 100644 ---- a/net/sched/cls_flow.c -+++ b/net/sched/cls_flow.c -@@ -356,7 +356,8 @@ static const struct nla_policy flow_policy[TCA_FLOW_MAX + 1] = { - [TCA_FLOW_KEYS] = { .type = NLA_U32 }, - [TCA_FLOW_MODE] = { .type = NLA_U32 }, - [TCA_FLOW_BASECLASS] = { .type = NLA_U32 }, -- [TCA_FLOW_RSHIFT] = { .type = NLA_U32 }, -+ [TCA_FLOW_RSHIFT] = NLA_POLICY_MAX(NLA_U32, -+ 31 /* BITS_PER_U32 - 1 */), - [TCA_FLOW_ADDEND] = { .type = NLA_U32 }, - [TCA_FLOW_MASK] = { .type = NLA_U32 }, - [TCA_FLOW_XOR] = { .type = NLA_U32 }, -diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c -index a65fad45d55681..09242578dac5bc 100644 ---- a/net/sched/sch_cake.c -+++ b/net/sched/sch_cake.c -@@ -644,6 +644,63 @@ static bool cake_ddst(int flow_mode) - return (flow_mode & CAKE_FLOW_DUAL_DST) == CAKE_FLOW_DUAL_DST; - } - -+static void cake_dec_srchost_bulk_flow_count(struct cake_tin_data *q, -+ struct cake_flow *flow, -+ int flow_mode) -+{ -+ if (likely(cake_dsrc(flow_mode) && -+ q->hosts[flow->srchost].srchost_bulk_flow_count)) -+ q->hosts[flow->srchost].srchost_bulk_flow_count--; -+} -+ -+static void cake_inc_srchost_bulk_flow_count(struct cake_tin_data *q, -+ struct cake_flow *flow, -+ int flow_mode) -+{ -+ if (likely(cake_dsrc(flow_mode) && -+ q->hosts[flow->srchost].srchost_bulk_flow_count < CAKE_QUEUES)) -+ q->hosts[flow->srchost].srchost_bulk_flow_count++; -+} -+ -+static void cake_dec_dsthost_bulk_flow_count(struct cake_tin_data *q, -+ struct cake_flow *flow, -+ int flow_mode) -+{ -+ if (likely(cake_ddst(flow_mode) && -+ q->hosts[flow->dsthost].dsthost_bulk_flow_count)) -+ q->hosts[flow->dsthost].dsthost_bulk_flow_count--; -+} -+ -+static void cake_inc_dsthost_bulk_flow_count(struct cake_tin_data *q, -+ struct cake_flow *flow, -+ int flow_mode) -+{ -+ if (likely(cake_ddst(flow_mode) && -+ q->hosts[flow->dsthost].dsthost_bulk_flow_count < CAKE_QUEUES)) -+ q->hosts[flow->dsthost].dsthost_bulk_flow_count++; -+} -+ -+static u16 cake_get_flow_quantum(struct cake_tin_data *q, -+ struct cake_flow *flow, -+ int flow_mode) -+{ -+ u16 host_load = 1; -+ -+ if (cake_dsrc(flow_mode)) -+ host_load = max(host_load, -+ q->hosts[flow->srchost].srchost_bulk_flow_count); -+ -+ if (cake_ddst(flow_mode)) -+ host_load = max(host_load, -+ q->hosts[flow->dsthost].dsthost_bulk_flow_count); -+ -+ /* The get_random_u16() is a way to apply dithering to avoid -+ * accumulating roundoff errors -+ */ -+ return (q->flow_quantum * quantum_div[host_load] + -+ get_random_u16()) >> 16; -+} -+ - static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, - int flow_mode, u16 flow_override, u16 host_override) - { -@@ -790,10 +847,8 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, - allocate_dst = cake_ddst(flow_mode); - - if (q->flows[outer_hash + k].set == CAKE_SET_BULK) { -- if (allocate_src) -- q->hosts[q->flows[reduced_hash].srchost].srchost_bulk_flow_count--; -- if (allocate_dst) -- q->hosts[q->flows[reduced_hash].dsthost].dsthost_bulk_flow_count--; -+ cake_dec_srchost_bulk_flow_count(q, &q->flows[outer_hash + k], flow_mode); -+ cake_dec_dsthost_bulk_flow_count(q, &q->flows[outer_hash + k], flow_mode); - } - found: - /* reserve queue for future packets in same flow */ -@@ -818,9 +873,10 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, - q->hosts[outer_hash + k].srchost_tag = srchost_hash; - found_src: - srchost_idx = outer_hash + k; -- if (q->flows[reduced_hash].set == CAKE_SET_BULK) -- q->hosts[srchost_idx].srchost_bulk_flow_count++; - q->flows[reduced_hash].srchost = srchost_idx; -+ -+ if (q->flows[reduced_hash].set == CAKE_SET_BULK) -+ cake_inc_srchost_bulk_flow_count(q, &q->flows[reduced_hash], flow_mode); - } - - if (allocate_dst) { -@@ -841,9 +897,10 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, - q->hosts[outer_hash + k].dsthost_tag = dsthost_hash; - found_dst: - dsthost_idx = outer_hash + k; -- if (q->flows[reduced_hash].set == CAKE_SET_BULK) -- q->hosts[dsthost_idx].dsthost_bulk_flow_count++; - q->flows[reduced_hash].dsthost = dsthost_idx; -+ -+ if (q->flows[reduced_hash].set == CAKE_SET_BULK) -+ cake_inc_dsthost_bulk_flow_count(q, &q->flows[reduced_hash], flow_mode); - } - } - -@@ -1856,10 +1913,6 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - - /* flowchain */ - if (!flow->set || flow->set == CAKE_SET_DECAYING) { -- struct cake_host *srchost = &b->hosts[flow->srchost]; -- struct cake_host *dsthost = &b->hosts[flow->dsthost]; -- u16 host_load = 1; -- - if (!flow->set) { - list_add_tail(&flow->flowchain, &b->new_flows); - } else { -@@ -1869,18 +1922,8 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - flow->set = CAKE_SET_SPARSE; - b->sparse_flow_count++; - -- if (cake_dsrc(q->flow_mode)) -- host_load = max(host_load, srchost->srchost_bulk_flow_count); -- -- if (cake_ddst(q->flow_mode)) -- host_load = max(host_load, dsthost->dsthost_bulk_flow_count); -- -- flow->deficit = (b->flow_quantum * -- quantum_div[host_load]) >> 16; -+ flow->deficit = cake_get_flow_quantum(b, flow, q->flow_mode); - } else if (flow->set == CAKE_SET_SPARSE_WAIT) { -- struct cake_host *srchost = &b->hosts[flow->srchost]; -- struct cake_host *dsthost = &b->hosts[flow->dsthost]; -- - /* this flow was empty, accounted as a sparse flow, but actually - * in the bulk rotation. - */ -@@ -1888,12 +1931,8 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - b->sparse_flow_count--; - b->bulk_flow_count++; - -- if (cake_dsrc(q->flow_mode)) -- srchost->srchost_bulk_flow_count++; -- -- if (cake_ddst(q->flow_mode)) -- dsthost->dsthost_bulk_flow_count++; -- -+ cake_inc_srchost_bulk_flow_count(b, flow, q->flow_mode); -+ cake_inc_dsthost_bulk_flow_count(b, flow, q->flow_mode); - } - - if (q->buffer_used > q->buffer_max_used) -@@ -1950,13 +1989,11 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) - { - struct cake_sched_data *q = qdisc_priv(sch); - struct cake_tin_data *b = &q->tins[q->cur_tin]; -- struct cake_host *srchost, *dsthost; - ktime_t now = ktime_get(); - struct cake_flow *flow; - struct list_head *head; - bool first_flow = true; - struct sk_buff *skb; -- u16 host_load; - u64 delay; - u32 len; - -@@ -2056,11 +2093,6 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) - q->cur_flow = flow - b->flows; - first_flow = false; - -- /* triple isolation (modified DRR++) */ -- srchost = &b->hosts[flow->srchost]; -- dsthost = &b->hosts[flow->dsthost]; -- host_load = 1; -- - /* flow isolation (DRR++) */ - if (flow->deficit <= 0) { - /* Keep all flows with deficits out of the sparse and decaying -@@ -2072,11 +2104,8 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) - b->sparse_flow_count--; - b->bulk_flow_count++; - -- if (cake_dsrc(q->flow_mode)) -- srchost->srchost_bulk_flow_count++; -- -- if (cake_ddst(q->flow_mode)) -- dsthost->dsthost_bulk_flow_count++; -+ cake_inc_srchost_bulk_flow_count(b, flow, q->flow_mode); -+ cake_inc_dsthost_bulk_flow_count(b, flow, q->flow_mode); - - flow->set = CAKE_SET_BULK; - } else { -@@ -2088,19 +2117,7 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) - } - } - -- if (cake_dsrc(q->flow_mode)) -- host_load = max(host_load, srchost->srchost_bulk_flow_count); -- -- if (cake_ddst(q->flow_mode)) -- host_load = max(host_load, dsthost->dsthost_bulk_flow_count); -- -- WARN_ON(host_load > CAKE_QUEUES); -- -- /* The get_random_u16() is a way to apply dithering to avoid -- * accumulating roundoff errors -- */ -- flow->deficit += (b->flow_quantum * quantum_div[host_load] + -- get_random_u16()) >> 16; -+ flow->deficit += cake_get_flow_quantum(b, flow, q->flow_mode); - list_move_tail(&flow->flowchain, &b->old_flows); - - goto retry; -@@ -2124,11 +2141,8 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) - if (flow->set == CAKE_SET_BULK) { - b->bulk_flow_count--; - -- if (cake_dsrc(q->flow_mode)) -- srchost->srchost_bulk_flow_count--; -- -- if (cake_ddst(q->flow_mode)) -- dsthost->dsthost_bulk_flow_count--; -+ cake_dec_srchost_bulk_flow_count(b, flow, q->flow_mode); -+ cake_dec_dsthost_bulk_flow_count(b, flow, q->flow_mode); - - b->decaying_flow_count++; - } else if (flow->set == CAKE_SET_SPARSE || -@@ -2146,12 +2160,8 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) - else if (flow->set == CAKE_SET_BULK) { - b->bulk_flow_count--; - -- if (cake_dsrc(q->flow_mode)) -- srchost->srchost_bulk_flow_count--; -- -- if (cake_ddst(q->flow_mode)) -- dsthost->dsthost_bulk_flow_count--; -- -+ cake_dec_srchost_bulk_flow_count(b, flow, q->flow_mode); -+ cake_dec_dsthost_bulk_flow_count(b, flow, q->flow_mode); - } else - b->decaying_flow_count--; - -diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c -index f65d6f92afcbc2..fd73be940f4607 100644 ---- a/net/sctp/sysctl.c -+++ b/net/sctp/sysctl.c -@@ -391,7 +391,8 @@ static struct ctl_table sctp_net_table[] = { - static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write, - void *buffer, size_t *lenp, loff_t *ppos) - { -- struct net *net = current->nsproxy->net_ns; -+ struct net *net = container_of(ctl->data, struct net, -+ sctp.sctp_hmac_alg); - struct ctl_table tbl; - bool changed = false; - char *none = "none"; -@@ -436,7 +437,7 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write, - static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write, - void *buffer, size_t *lenp, loff_t *ppos) - { -- struct net *net = current->nsproxy->net_ns; -+ struct net *net = container_of(ctl->data, struct net, sctp.rto_min); - unsigned int min = *(unsigned int *) ctl->extra1; - unsigned int max = *(unsigned int *) ctl->extra2; - struct ctl_table tbl; -@@ -464,7 +465,7 @@ static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write, - static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write, - void *buffer, size_t *lenp, loff_t *ppos) - { -- struct net *net = current->nsproxy->net_ns; -+ struct net *net = container_of(ctl->data, struct net, sctp.rto_max); - unsigned int min = *(unsigned int *) ctl->extra1; - unsigned int max = *(unsigned int *) ctl->extra2; - struct ctl_table tbl; -@@ -502,7 +503,7 @@ static int proc_sctp_do_alpha_beta(struct ctl_table *ctl, int write, - static int proc_sctp_do_auth(struct ctl_table *ctl, int write, - void *buffer, size_t *lenp, loff_t *ppos) - { -- struct net *net = current->nsproxy->net_ns; -+ struct net *net = container_of(ctl->data, struct net, sctp.auth_enable); - struct ctl_table tbl; - int new_value, ret; - -@@ -531,7 +532,7 @@ static int proc_sctp_do_auth(struct ctl_table *ctl, int write, - static int proc_sctp_do_udp_port(struct ctl_table *ctl, int write, - void *buffer, size_t *lenp, loff_t *ppos) - { -- struct net *net = current->nsproxy->net_ns; -+ struct net *net = container_of(ctl->data, struct net, sctp.udp_port); - unsigned int min = *(unsigned int *)ctl->extra1; - unsigned int max = *(unsigned int *)ctl->extra2; - struct ctl_table tbl; -@@ -572,7 +573,8 @@ static int proc_sctp_do_udp_port(struct ctl_table *ctl, int write, - static int proc_sctp_do_probe_interval(struct ctl_table *ctl, int write, - void *buffer, size_t *lenp, loff_t *ppos) - { -- struct net *net = current->nsproxy->net_ns; -+ struct net *net = container_of(ctl->data, struct net, -+ sctp.probe_interval); - struct ctl_table tbl; - int ret, new_value; - -diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c -index df166f6afad823..6e30fe879d538e 100644 ---- a/net/tls/tls_sw.c -+++ b/net/tls/tls_sw.c -@@ -458,7 +458,7 @@ int tls_tx_records(struct sock *sk, int flags) - - tx_err: - if (rc < 0 && rc != -EAGAIN) -- tls_err_abort(sk, -EBADMSG); -+ tls_err_abort(sk, rc); - - return rc; - } -diff --git a/sound/soc/codecs/rt722-sdca.c b/sound/soc/codecs/rt722-sdca.c -index b9b330375addab..0f9f592744ada3 100644 ---- a/sound/soc/codecs/rt722-sdca.c -+++ b/sound/soc/codecs/rt722-sdca.c -@@ -1466,13 +1466,18 @@ static void rt722_sdca_jack_preset(struct rt722_sdca_priv *rt722) - 0x008d); - /* check HP calibration FSM status */ - for (loop_check = 0; loop_check < chk_cnt; loop_check++) { -+ usleep_range(10000, 11000); - ret = rt722_sdca_index_read(rt722, RT722_VENDOR_CALI, - RT722_DAC_DC_CALI_CTL3, &calib_status); -- if (ret < 0 || loop_check == chk_cnt) -+ if (ret < 0) - dev_dbg(&rt722->slave->dev, "calibration failed!, ret=%d\n", ret); - if ((calib_status & 0x0040) == 0x0) - break; - } -+ -+ if (loop_check == chk_cnt) -+ dev_dbg(&rt722->slave->dev, "%s, calibration time-out!\n", __func__); -+ - /* Set ADC09 power entity floating control */ - rt722_sdca_index_write(rt722, RT722_VENDOR_HDA_CTL, RT722_ADC0A_08_PDE_FLOAT_CTL, - 0x2a12); -diff --git a/sound/soc/mediatek/common/mtk-afe-platform-driver.c b/sound/soc/mediatek/common/mtk-afe-platform-driver.c -index 01501d5747a7c0..52495c930ca3bf 100644 ---- a/sound/soc/mediatek/common/mtk-afe-platform-driver.c -+++ b/sound/soc/mediatek/common/mtk-afe-platform-driver.c -@@ -120,8 +120,8 @@ int mtk_afe_pcm_new(struct snd_soc_component *component, - struct mtk_base_afe *afe = snd_soc_component_get_drvdata(component); - - size = afe->mtk_afe_hardware->buffer_bytes_max; -- snd_pcm_set_managed_buffer_all(pcm, SNDRV_DMA_TYPE_DEV, -- afe->dev, size, size); -+ snd_pcm_set_managed_buffer_all(pcm, SNDRV_DMA_TYPE_DEV, afe->dev, 0, size); -+ - return 0; - } - EXPORT_SYMBOL_GPL(mtk_afe_pcm_new); -diff --git a/tools/include/linux/numa.h b/tools/include/linux/numa.h -index 110b0e5d0fb004..c8b9369335e000 100644 ---- a/tools/include/linux/numa.h -+++ b/tools/include/linux/numa.h -@@ -13,4 +13,9 @@ - - #define NUMA_NO_NODE (-1) - -+static inline bool numa_valid_node(int nid) -+{ -+ return nid >= 0 && nid < MAX_NUMNODES; -+} -+ - #endif /* _LINUX_NUMA_H */ -diff --git a/tools/testing/selftests/alsa/Makefile b/tools/testing/selftests/alsa/Makefile -index 5af9ba8a4645bc..140c7f821727d7 100644 ---- a/tools/testing/selftests/alsa/Makefile -+++ b/tools/testing/selftests/alsa/Makefile -@@ -23,5 +23,5 @@ include ../lib.mk - $(OUTPUT)/libatest.so: conf.c alsa-local.h - $(CC) $(CFLAGS) -shared -fPIC $< $(LDLIBS) -o $@ - --$(OUTPUT)/%: %.c $(TEST_GEN_PROGS_EXTENDED) alsa-local.h -+$(OUTPUT)/%: %.c $(OUTPUT)/libatest.so alsa-local.h - $(CC) $(CFLAGS) $< $(LDLIBS) -latest -o $@ diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.072-073.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.072-073.patch deleted file mode 100644 index 73157e52aa..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.072-073.patch +++ /dev/null @@ -1,586 +0,0 @@ -diff --git a/Makefile b/Makefile -index fb4949cac6ffbf..2ba627f545901e 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 72 -+SUBLEVEL = 73 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c -index f14c412c56097d..ada3fcc9c6d501 100644 ---- a/fs/overlayfs/copy_up.c -+++ b/fs/overlayfs/copy_up.c -@@ -371,13 +371,13 @@ int ovl_set_attr(struct ovl_fs *ofs, struct dentry *upperdentry, - return err; - } - --struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct inode *realinode, -+struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct dentry *real, - bool is_upper) - { - struct ovl_fh *fh; - int fh_type, dwords; - int buflen = MAX_HANDLE_SZ; -- uuid_t *uuid = &realinode->i_sb->s_uuid; -+ uuid_t *uuid = &real->d_sb->s_uuid; - int err; - - /* Make sure the real fid stays 32bit aligned */ -@@ -394,8 +394,7 @@ struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct inode *realinode, - * the price or reconnecting the dentry. - */ - dwords = buflen >> 2; -- fh_type = exportfs_encode_inode_fh(realinode, (void *)fh->fb.fid, -- &dwords, NULL, 0); -+ fh_type = exportfs_encode_fh(real, (void *)fh->fb.fid, &dwords, 0); - buflen = (dwords << 2); - - err = -EIO; -@@ -427,29 +426,29 @@ struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct inode *realinode, - return ERR_PTR(err); - } - --struct ovl_fh *ovl_get_origin_fh(struct ovl_fs *ofs, struct dentry *origin) -+int ovl_set_origin(struct ovl_fs *ofs, struct dentry *lower, -+ struct dentry *upper) - { -+ const struct ovl_fh *fh = NULL; -+ int err; -+ - /* - * When lower layer doesn't support export operations store a 'null' fh, - * so we can use the overlay.origin xattr to distignuish between a copy - * up and a pure upper inode. - */ -- if (!ovl_can_decode_fh(origin->d_sb)) -- return NULL; -- -- return ovl_encode_real_fh(ofs, d_inode(origin), false); --} -- --int ovl_set_origin_fh(struct ovl_fs *ofs, const struct ovl_fh *fh, -- struct dentry *upper) --{ -- int err; -+ if (ovl_can_decode_fh(lower->d_sb)) { -+ fh = ovl_encode_real_fh(ofs, lower, false); -+ if (IS_ERR(fh)) -+ return PTR_ERR(fh); -+ } - - /* - * Do not fail when upper doesn't support xattrs. - */ - err = ovl_check_setxattr(ofs, upper, OVL_XATTR_ORIGIN, fh->buf, - fh ? fh->fb.len : 0, 0); -+ kfree(fh); - - /* Ignore -EPERM from setting "user.*" on symlink/special */ - return err == -EPERM ? 0 : err; -@@ -462,7 +461,7 @@ static int ovl_set_upper_fh(struct ovl_fs *ofs, struct dentry *upper, - const struct ovl_fh *fh; - int err; - -- fh = ovl_encode_real_fh(ofs, d_inode(upper), true); -+ fh = ovl_encode_real_fh(ofs, upper, true); - if (IS_ERR(fh)) - return PTR_ERR(fh); - -@@ -477,7 +476,7 @@ static int ovl_set_upper_fh(struct ovl_fs *ofs, struct dentry *upper, - * - * Caller must hold i_mutex on indexdir. - */ --static int ovl_create_index(struct dentry *dentry, const struct ovl_fh *fh, -+static int ovl_create_index(struct dentry *dentry, struct dentry *origin, - struct dentry *upper) - { - struct ovl_fs *ofs = OVL_FS(dentry->d_sb); -@@ -503,7 +502,7 @@ static int ovl_create_index(struct dentry *dentry, const struct ovl_fh *fh, - if (WARN_ON(ovl_test_flag(OVL_INDEX, d_inode(dentry)))) - return -EIO; - -- err = ovl_get_index_name_fh(fh, &name); -+ err = ovl_get_index_name(ofs, origin, &name); - if (err) - return err; - -@@ -542,7 +541,6 @@ struct ovl_copy_up_ctx { - struct dentry *destdir; - struct qstr destname; - struct dentry *workdir; -- const struct ovl_fh *origin_fh; - bool origin; - bool indexed; - bool metacopy; -@@ -639,7 +637,7 @@ static int ovl_copy_up_metadata(struct ovl_copy_up_ctx *c, struct dentry *temp) - * hard link. - */ - if (c->origin) { -- err = ovl_set_origin_fh(ofs, c->origin_fh, temp); -+ err = ovl_set_origin(ofs, c->lowerpath.dentry, temp); - if (err) - return err; - } -@@ -751,7 +749,7 @@ static int ovl_copy_up_workdir(struct ovl_copy_up_ctx *c) - goto cleanup; - - if (S_ISDIR(c->stat.mode) && c->indexed) { -- err = ovl_create_index(c->dentry, c->origin_fh, temp); -+ err = ovl_create_index(c->dentry, c->lowerpath.dentry, temp); - if (err) - goto cleanup; - } -@@ -863,8 +861,6 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c) - { - int err; - struct ovl_fs *ofs = OVL_FS(c->dentry->d_sb); -- struct dentry *origin = c->lowerpath.dentry; -- struct ovl_fh *fh = NULL; - bool to_index = false; - - /* -@@ -881,25 +877,17 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c) - to_index = true; - } - -- if (S_ISDIR(c->stat.mode) || c->stat.nlink == 1 || to_index) { -- fh = ovl_get_origin_fh(ofs, origin); -- if (IS_ERR(fh)) -- return PTR_ERR(fh); -- -- /* origin_fh may be NULL */ -- c->origin_fh = fh; -+ if (S_ISDIR(c->stat.mode) || c->stat.nlink == 1 || to_index) - c->origin = true; -- } - - if (to_index) { - c->destdir = ovl_indexdir(c->dentry->d_sb); -- err = ovl_get_index_name(ofs, origin, &c->destname); -+ err = ovl_get_index_name(ofs, c->lowerpath.dentry, &c->destname); - if (err) -- goto out_free_fh; -+ return err; - } else if (WARN_ON(!c->parent)) { - /* Disconnected dentry must be copied up to index dir */ -- err = -EIO; -- goto out_free_fh; -+ return -EIO; - } else { - /* - * Mark parent "impure" because it may now contain non-pure -@@ -907,7 +895,7 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c) - */ - err = ovl_set_impure(c->parent, c->destdir); - if (err) -- goto out_free_fh; -+ return err; - } - - /* Should we copyup with O_TMPFILE or with workdir? */ -@@ -939,8 +927,6 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c) - out: - if (to_index) - kfree(c->destname.name); --out_free_fh: -- kfree(fh); - return err; - } - -diff --git a/fs/overlayfs/export.c b/fs/overlayfs/export.c -index 3a17e4366f28c0..611ff567a1aa6f 100644 ---- a/fs/overlayfs/export.c -+++ b/fs/overlayfs/export.c -@@ -181,37 +181,35 @@ static int ovl_connect_layer(struct dentry *dentry) - * - * Return 0 for upper file handle, > 0 for lower file handle or < 0 on error. - */ --static int ovl_check_encode_origin(struct inode *inode) -+static int ovl_check_encode_origin(struct dentry *dentry) - { -- struct ovl_fs *ofs = OVL_FS(inode->i_sb); -+ struct ovl_fs *ofs = OVL_FS(dentry->d_sb); - bool decodable = ofs->config.nfs_export; -- struct dentry *dentry; -- int err; - - /* No upper layer? */ - if (!ovl_upper_mnt(ofs)) - return 1; - - /* Lower file handle for non-upper non-decodable */ -- if (!ovl_inode_upper(inode) && !decodable) -+ if (!ovl_dentry_upper(dentry) && !decodable) - return 1; - - /* Upper file handle for pure upper */ -- if (!ovl_inode_lower(inode)) -+ if (!ovl_dentry_lower(dentry)) - return 0; - - /* - * Root is never indexed, so if there's an upper layer, encode upper for - * root. - */ -- if (inode == d_inode(inode->i_sb->s_root)) -+ if (dentry == dentry->d_sb->s_root) - return 0; - - /* - * Upper decodable file handle for non-indexed upper. - */ -- if (ovl_inode_upper(inode) && decodable && -- !ovl_test_flag(OVL_INDEX, inode)) -+ if (ovl_dentry_upper(dentry) && decodable && -+ !ovl_test_flag(OVL_INDEX, d_inode(dentry))) - return 0; - - /* -@@ -220,23 +218,14 @@ static int ovl_check_encode_origin(struct inode *inode) - * ovl_connect_layer() will try to make origin's layer "connected" by - * copying up a "connectable" ancestor. - */ -- if (!decodable || !S_ISDIR(inode->i_mode)) -- return 1; -- -- dentry = d_find_any_alias(inode); -- if (!dentry) -- return -ENOENT; -- -- err = ovl_connect_layer(dentry); -- dput(dentry); -- if (err < 0) -- return err; -+ if (d_is_dir(dentry) && decodable) -+ return ovl_connect_layer(dentry); - - /* Lower file handle for indexed and non-upper dir/non-dir */ - return 1; - } - --static int ovl_dentry_to_fid(struct ovl_fs *ofs, struct inode *inode, -+static int ovl_dentry_to_fid(struct ovl_fs *ofs, struct dentry *dentry, - u32 *fid, int buflen) - { - struct ovl_fh *fh = NULL; -@@ -247,13 +236,13 @@ static int ovl_dentry_to_fid(struct ovl_fs *ofs, struct inode *inode, - * Check if we should encode a lower or upper file handle and maybe - * copy up an ancestor to make lower file handle connectable. - */ -- err = enc_lower = ovl_check_encode_origin(inode); -+ err = enc_lower = ovl_check_encode_origin(dentry); - if (enc_lower < 0) - goto fail; - - /* Encode an upper or lower file handle */ -- fh = ovl_encode_real_fh(ofs, enc_lower ? ovl_inode_lower(inode) : -- ovl_inode_upper(inode), !enc_lower); -+ fh = ovl_encode_real_fh(ofs, enc_lower ? ovl_dentry_lower(dentry) : -+ ovl_dentry_upper(dentry), !enc_lower); - if (IS_ERR(fh)) - return PTR_ERR(fh); - -@@ -267,8 +256,8 @@ static int ovl_dentry_to_fid(struct ovl_fs *ofs, struct inode *inode, - return err; - - fail: -- pr_warn_ratelimited("failed to encode file handle (ino=%lu, err=%i)\n", -- inode->i_ino, err); -+ pr_warn_ratelimited("failed to encode file handle (%pd2, err=%i)\n", -+ dentry, err); - goto out; - } - -@@ -276,13 +265,19 @@ static int ovl_encode_fh(struct inode *inode, u32 *fid, int *max_len, - struct inode *parent) - { - struct ovl_fs *ofs = OVL_FS(inode->i_sb); -+ struct dentry *dentry; - int bytes, buflen = *max_len << 2; - - /* TODO: encode connectable file handles */ - if (parent) - return FILEID_INVALID; - -- bytes = ovl_dentry_to_fid(ofs, inode, fid, buflen); -+ dentry = d_find_any_alias(inode); -+ if (!dentry) -+ return FILEID_INVALID; -+ -+ bytes = ovl_dentry_to_fid(ofs, dentry, fid, buflen); -+ dput(dentry); - if (bytes <= 0) - return FILEID_INVALID; - -diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c -index 2d2ef671b36ba5..80391c687c2ad8 100644 ---- a/fs/overlayfs/namei.c -+++ b/fs/overlayfs/namei.c -@@ -507,19 +507,6 @@ static int ovl_verify_fh(struct ovl_fs *ofs, struct dentry *dentry, - return err; - } - --int ovl_verify_set_fh(struct ovl_fs *ofs, struct dentry *dentry, -- enum ovl_xattr ox, const struct ovl_fh *fh, -- bool is_upper, bool set) --{ -- int err; -- -- err = ovl_verify_fh(ofs, dentry, ox, fh); -- if (set && err == -ENODATA) -- err = ovl_setxattr(ofs, dentry, ox, fh->buf, fh->fb.len); -- -- return err; --} -- - /* - * Verify that @real dentry matches the file handle stored in xattr @name. - * -@@ -528,22 +515,24 @@ int ovl_verify_set_fh(struct ovl_fs *ofs, struct dentry *dentry, - * - * Return 0 on match, -ESTALE on mismatch, -ENODATA on no xattr, < 0 on error. - */ --int ovl_verify_origin_xattr(struct ovl_fs *ofs, struct dentry *dentry, -- enum ovl_xattr ox, struct dentry *real, -- bool is_upper, bool set) -+int ovl_verify_set_fh(struct ovl_fs *ofs, struct dentry *dentry, -+ enum ovl_xattr ox, struct dentry *real, bool is_upper, -+ bool set) - { - struct inode *inode; - struct ovl_fh *fh; - int err; - -- fh = ovl_encode_real_fh(ofs, d_inode(real), is_upper); -+ fh = ovl_encode_real_fh(ofs, real, is_upper); - err = PTR_ERR(fh); - if (IS_ERR(fh)) { - fh = NULL; - goto fail; - } - -- err = ovl_verify_set_fh(ofs, dentry, ox, fh, is_upper, set); -+ err = ovl_verify_fh(ofs, dentry, ox, fh); -+ if (set && err == -ENODATA) -+ err = ovl_setxattr(ofs, dentry, ox, fh->buf, fh->fb.len); - if (err) - goto fail; - -@@ -559,7 +548,6 @@ int ovl_verify_origin_xattr(struct ovl_fs *ofs, struct dentry *dentry, - goto out; - } - -- - /* Get upper dentry from index */ - struct dentry *ovl_index_upper(struct ovl_fs *ofs, struct dentry *index, - bool connected) -@@ -696,7 +684,7 @@ int ovl_verify_index(struct ovl_fs *ofs, struct dentry *index) - goto out; - } - --int ovl_get_index_name_fh(const struct ovl_fh *fh, struct qstr *name) -+static int ovl_get_index_name_fh(struct ovl_fh *fh, struct qstr *name) - { - char *n, *s; - -@@ -732,7 +720,7 @@ int ovl_get_index_name(struct ovl_fs *ofs, struct dentry *origin, - struct ovl_fh *fh; - int err; - -- fh = ovl_encode_real_fh(ofs, d_inode(origin), false); -+ fh = ovl_encode_real_fh(ofs, origin, false); - if (IS_ERR(fh)) - return PTR_ERR(fh); - -@@ -885,27 +873,20 @@ int ovl_path_next(int idx, struct dentry *dentry, struct path *path) - static int ovl_fix_origin(struct ovl_fs *ofs, struct dentry *dentry, - struct dentry *lower, struct dentry *upper) - { -- const struct ovl_fh *fh; - int err; - - if (ovl_check_origin_xattr(ofs, upper)) - return 0; - -- fh = ovl_get_origin_fh(ofs, lower); -- if (IS_ERR(fh)) -- return PTR_ERR(fh); -- - err = ovl_want_write(dentry); - if (err) -- goto out; -+ return err; - -- err = ovl_set_origin_fh(ofs, fh, upper); -+ err = ovl_set_origin(ofs, lower, upper); - if (!err) - err = ovl_set_impure(dentry->d_parent, upper->d_parent); - - ovl_drop_write(dentry); --out: -- kfree(fh); - return err; - } - -diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h -index ca63a26a6170b0..09ca82ed0f8ced 100644 ---- a/fs/overlayfs/overlayfs.h -+++ b/fs/overlayfs/overlayfs.h -@@ -632,15 +632,11 @@ struct dentry *ovl_decode_real_fh(struct ovl_fs *ofs, struct ovl_fh *fh, - int ovl_check_origin_fh(struct ovl_fs *ofs, struct ovl_fh *fh, bool connected, - struct dentry *upperdentry, struct ovl_path **stackp); - int ovl_verify_set_fh(struct ovl_fs *ofs, struct dentry *dentry, -- enum ovl_xattr ox, const struct ovl_fh *fh, -- bool is_upper, bool set); --int ovl_verify_origin_xattr(struct ovl_fs *ofs, struct dentry *dentry, -- enum ovl_xattr ox, struct dentry *real, -- bool is_upper, bool set); -+ enum ovl_xattr ox, struct dentry *real, bool is_upper, -+ bool set); - struct dentry *ovl_index_upper(struct ovl_fs *ofs, struct dentry *index, - bool connected); - int ovl_verify_index(struct ovl_fs *ofs, struct dentry *index); --int ovl_get_index_name_fh(const struct ovl_fh *fh, struct qstr *name); - int ovl_get_index_name(struct ovl_fs *ofs, struct dentry *origin, - struct qstr *name); - struct dentry *ovl_get_index_fh(struct ovl_fs *ofs, struct ovl_fh *fh); -@@ -652,24 +648,17 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry, - unsigned int flags); - bool ovl_lower_positive(struct dentry *dentry); - --static inline int ovl_verify_origin_fh(struct ovl_fs *ofs, struct dentry *upper, -- const struct ovl_fh *fh, bool set) --{ -- return ovl_verify_set_fh(ofs, upper, OVL_XATTR_ORIGIN, fh, false, set); --} -- - static inline int ovl_verify_origin(struct ovl_fs *ofs, struct dentry *upper, - struct dentry *origin, bool set) - { -- return ovl_verify_origin_xattr(ofs, upper, OVL_XATTR_ORIGIN, origin, -- false, set); -+ return ovl_verify_set_fh(ofs, upper, OVL_XATTR_ORIGIN, origin, -+ false, set); - } - - static inline int ovl_verify_upper(struct ovl_fs *ofs, struct dentry *index, - struct dentry *upper, bool set) - { -- return ovl_verify_origin_xattr(ofs, index, OVL_XATTR_UPPER, upper, -- true, set); -+ return ovl_verify_set_fh(ofs, index, OVL_XATTR_UPPER, upper, true, set); - } - - /* readdir.c */ -@@ -832,11 +821,10 @@ int ovl_copy_up_with_data(struct dentry *dentry); - int ovl_maybe_copy_up(struct dentry *dentry, int flags); - int ovl_copy_xattr(struct super_block *sb, const struct path *path, struct dentry *new); - int ovl_set_attr(struct ovl_fs *ofs, struct dentry *upper, struct kstat *stat); --struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct inode *realinode, -+struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct dentry *real, - bool is_upper); --struct ovl_fh *ovl_get_origin_fh(struct ovl_fs *ofs, struct dentry *origin); --int ovl_set_origin_fh(struct ovl_fs *ofs, const struct ovl_fh *fh, -- struct dentry *upper); -+int ovl_set_origin(struct ovl_fs *ofs, struct dentry *lower, -+ struct dentry *upper); - - /* export.c */ - extern const struct export_operations ovl_export_operations; -diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c -index e2574034c3fa17..2c056d737c27c3 100644 ---- a/fs/overlayfs/super.c -+++ b/fs/overlayfs/super.c -@@ -879,20 +879,15 @@ static int ovl_get_indexdir(struct super_block *sb, struct ovl_fs *ofs, - { - struct vfsmount *mnt = ovl_upper_mnt(ofs); - struct dentry *indexdir; -- struct dentry *origin = ovl_lowerstack(oe)->dentry; -- const struct ovl_fh *fh; - int err; - -- fh = ovl_get_origin_fh(ofs, origin); -- if (IS_ERR(fh)) -- return PTR_ERR(fh); -- - err = mnt_want_write(mnt); - if (err) -- goto out_free_fh; -+ return err; - - /* Verify lower root is upper root origin */ -- err = ovl_verify_origin_fh(ofs, upperpath->dentry, fh, true); -+ err = ovl_verify_origin(ofs, upperpath->dentry, -+ ovl_lowerstack(oe)->dentry, true); - if (err) { - pr_err("failed to verify upper root origin\n"); - goto out; -@@ -924,10 +919,9 @@ static int ovl_get_indexdir(struct super_block *sb, struct ovl_fs *ofs, - * directory entries. - */ - if (ovl_check_origin_xattr(ofs, ofs->indexdir)) { -- err = ovl_verify_origin_xattr(ofs, ofs->indexdir, -- OVL_XATTR_ORIGIN, -- upperpath->dentry, true, -- false); -+ err = ovl_verify_set_fh(ofs, ofs->indexdir, -+ OVL_XATTR_ORIGIN, -+ upperpath->dentry, true, false); - if (err) - pr_err("failed to verify index dir 'origin' xattr\n"); - } -@@ -945,8 +939,6 @@ static int ovl_get_indexdir(struct super_block *sb, struct ovl_fs *ofs, - - out: - mnt_drop_write(mnt); --out_free_fh: -- kfree(fh); - return err; - } - -diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c -index 4e6b747e0f2e25..0bf3ffcd072f6a 100644 ---- a/fs/overlayfs/util.c -+++ b/fs/overlayfs/util.c -@@ -976,18 +976,12 @@ static void ovl_cleanup_index(struct dentry *dentry) - struct dentry *index = NULL; - struct inode *inode; - struct qstr name = { }; -- bool got_write = false; - int err; - - err = ovl_get_index_name(ofs, lowerdentry, &name); - if (err) - goto fail; - -- err = ovl_want_write(dentry); -- if (err) -- goto fail; -- -- got_write = true; - inode = d_inode(upperdentry); - if (!S_ISDIR(inode->i_mode) && inode->i_nlink != 1) { - pr_warn_ratelimited("cleanup linked index (%pd2, ino=%lu, nlink=%u)\n", -@@ -1025,8 +1019,6 @@ static void ovl_cleanup_index(struct dentry *dentry) - goto fail; - - out: -- if (got_write) -- ovl_drop_write(dentry); - kfree(name.name); - dput(index); - return; -@@ -1097,8 +1089,6 @@ void ovl_nlink_end(struct dentry *dentry) - { - struct inode *inode = d_inode(dentry); - -- ovl_drop_write(dentry); -- - if (ovl_test_flag(OVL_INDEX, inode) && inode->i_nlink == 0) { - const struct cred *old_cred; - diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.073-074.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.073-074.patch deleted file mode 100644 index cc7a6c852a..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.073-074.patch +++ /dev/null @@ -1,2591 +0,0 @@ -diff --git a/Makefile b/Makefile -index 2ba627f545901e..b8e5c65910862e 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 73 -+SUBLEVEL = 74 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/x86/include/asm/special_insns.h b/arch/x86/include/asm/special_insns.h -index 48f8dd47cf6882..1c5513b04f0387 100644 ---- a/arch/x86/include/asm/special_insns.h -+++ b/arch/x86/include/asm/special_insns.h -@@ -217,7 +217,7 @@ static inline int write_user_shstk_64(u64 __user *addr, u64 val) - - #define nop() asm volatile ("nop") - --static inline void serialize(void) -+static __always_inline void serialize(void) - { - /* Instruction opcode for SERIALIZE; supported in binutils >= 2.35. */ - asm volatile(".byte 0xf, 0x1, 0xe8" ::: "memory"); -diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm.S -index 901b605166834b..6231f6efb4ee13 100644 ---- a/arch/x86/xen/xen-asm.S -+++ b/arch/x86/xen/xen-asm.S -@@ -221,7 +221,7 @@ SYM_CODE_END(xen_early_idt_handler_array) - push %rax - mov $__HYPERVISOR_iret, %eax - syscall /* Do the IRET. */ --#ifdef CONFIG_MITIGATION_SLS -+#ifdef CONFIG_SLS - int3 - #endif - .endm -diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c -index 63e4812623361d..4990a19e601334 100644 ---- a/block/blk-sysfs.c -+++ b/block/blk-sysfs.c -@@ -842,10 +842,8 @@ int blk_register_queue(struct gendisk *disk) - * faster to shut down and is made fully functional here as - * request_queues for non-existent devices never get registered. - */ -- if (!blk_queue_init_done(q)) { -- blk_queue_flag_set(QUEUE_FLAG_INIT_DONE, q); -- percpu_ref_switch_to_percpu(&q->q_usage_counter); -- } -+ blk_queue_flag_set(QUEUE_FLAG_INIT_DONE, q); -+ percpu_ref_switch_to_percpu(&q->q_usage_counter); - - return ret; - -diff --git a/block/genhd.c b/block/genhd.c -index 203c880c3e1cd2..6d704c37f26e71 100644 ---- a/block/genhd.c -+++ b/block/genhd.c -@@ -710,13 +710,10 @@ void del_gendisk(struct gendisk *disk) - * If the disk does not own the queue, allow using passthrough requests - * again. Else leave the queue frozen to fail all I/O. - */ -- if (!test_bit(GD_OWNS_QUEUE, &disk->state)) { -- blk_queue_flag_clear(QUEUE_FLAG_INIT_DONE, q); -+ if (!test_bit(GD_OWNS_QUEUE, &disk->state)) - __blk_mq_unfreeze_queue(q, true); -- } else { -- if (queue_is_mq(q)) -- blk_mq_exit_queue(q); -- } -+ else if (queue_is_mq(q)) -+ blk_mq_exit_queue(q); - } - EXPORT_SYMBOL(del_gendisk); - -diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c -index c82b255f82bc41..64d83ff3c0d90c 100644 ---- a/drivers/acpi/resource.c -+++ b/drivers/acpi/resource.c -@@ -680,11 +680,11 @@ static bool acpi_dev_irq_override(u32 gsi, u8 triggering, u8 polarity, - for (i = 0; i < ARRAY_SIZE(override_table); i++) { - const struct irq_override_cmp *entry = &override_table[i]; - -- if (dmi_check_system(entry->system) && -- entry->irq == gsi && -+ if (entry->irq == gsi && - entry->triggering == triggering && - entry->polarity == polarity && -- entry->shareable == shareable) -+ entry->shareable == shareable && -+ dmi_check_system(entry->system)) - return entry->override; - } - -diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c -index 1e257ecd624db1..b73038ad86f7f3 100644 ---- a/drivers/block/zram/zram_drv.c -+++ b/drivers/block/zram/zram_drv.c -@@ -1262,6 +1262,7 @@ static bool zram_meta_alloc(struct zram *zram, u64 disksize) - zram->mem_pool = zs_create_pool(zram->disk->disk_name); - if (!zram->mem_pool) { - vfree(zram->table); -+ zram->table = NULL; - return false; - } - -diff --git a/drivers/gpio/gpio-xilinx.c b/drivers/gpio/gpio-xilinx.c -index a16945e8319e3f..956ea29578336c 100644 ---- a/drivers/gpio/gpio-xilinx.c -+++ b/drivers/gpio/gpio-xilinx.c -@@ -66,7 +66,7 @@ struct xgpio_instance { - DECLARE_BITMAP(state, 64); - DECLARE_BITMAP(last_irq_read, 64); - DECLARE_BITMAP(dir, 64); -- spinlock_t gpio_lock; /* For serializing operations */ -+ raw_spinlock_t gpio_lock; /* For serializing operations */ - int irq; - DECLARE_BITMAP(enable, 64); - DECLARE_BITMAP(rising_edge, 64); -@@ -180,14 +180,14 @@ static void xgpio_set(struct gpio_chip *gc, unsigned int gpio, int val) - struct xgpio_instance *chip = gpiochip_get_data(gc); - int bit = xgpio_to_bit(chip, gpio); - -- spin_lock_irqsave(&chip->gpio_lock, flags); -+ raw_spin_lock_irqsave(&chip->gpio_lock, flags); - - /* Write to GPIO signal and set its direction to output */ - __assign_bit(bit, chip->state, val); - - xgpio_write_ch(chip, XGPIO_DATA_OFFSET, bit, chip->state); - -- spin_unlock_irqrestore(&chip->gpio_lock, flags); -+ raw_spin_unlock_irqrestore(&chip->gpio_lock, flags); - } - - /** -@@ -211,7 +211,7 @@ static void xgpio_set_multiple(struct gpio_chip *gc, unsigned long *mask, - bitmap_remap(hw_mask, mask, chip->sw_map, chip->hw_map, 64); - bitmap_remap(hw_bits, bits, chip->sw_map, chip->hw_map, 64); - -- spin_lock_irqsave(&chip->gpio_lock, flags); -+ raw_spin_lock_irqsave(&chip->gpio_lock, flags); - - bitmap_replace(state, chip->state, hw_bits, hw_mask, 64); - -@@ -219,7 +219,7 @@ static void xgpio_set_multiple(struct gpio_chip *gc, unsigned long *mask, - - bitmap_copy(chip->state, state, 64); - -- spin_unlock_irqrestore(&chip->gpio_lock, flags); -+ raw_spin_unlock_irqrestore(&chip->gpio_lock, flags); - } - - /** -@@ -237,13 +237,13 @@ static int xgpio_dir_in(struct gpio_chip *gc, unsigned int gpio) - struct xgpio_instance *chip = gpiochip_get_data(gc); - int bit = xgpio_to_bit(chip, gpio); - -- spin_lock_irqsave(&chip->gpio_lock, flags); -+ raw_spin_lock_irqsave(&chip->gpio_lock, flags); - - /* Set the GPIO bit in shadow register and set direction as input */ - __set_bit(bit, chip->dir); - xgpio_write_ch(chip, XGPIO_TRI_OFFSET, bit, chip->dir); - -- spin_unlock_irqrestore(&chip->gpio_lock, flags); -+ raw_spin_unlock_irqrestore(&chip->gpio_lock, flags); - - return 0; - } -@@ -266,7 +266,7 @@ static int xgpio_dir_out(struct gpio_chip *gc, unsigned int gpio, int val) - struct xgpio_instance *chip = gpiochip_get_data(gc); - int bit = xgpio_to_bit(chip, gpio); - -- spin_lock_irqsave(&chip->gpio_lock, flags); -+ raw_spin_lock_irqsave(&chip->gpio_lock, flags); - - /* Write state of GPIO signal */ - __assign_bit(bit, chip->state, val); -@@ -276,7 +276,7 @@ static int xgpio_dir_out(struct gpio_chip *gc, unsigned int gpio, int val) - __clear_bit(bit, chip->dir); - xgpio_write_ch(chip, XGPIO_TRI_OFFSET, bit, chip->dir); - -- spin_unlock_irqrestore(&chip->gpio_lock, flags); -+ raw_spin_unlock_irqrestore(&chip->gpio_lock, flags); - - return 0; - } -@@ -404,7 +404,7 @@ static void xgpio_irq_mask(struct irq_data *irq_data) - int bit = xgpio_to_bit(chip, irq_offset); - u32 mask = BIT(bit / 32), temp; - -- spin_lock_irqsave(&chip->gpio_lock, flags); -+ raw_spin_lock_irqsave(&chip->gpio_lock, flags); - - __clear_bit(bit, chip->enable); - -@@ -414,7 +414,7 @@ static void xgpio_irq_mask(struct irq_data *irq_data) - temp &= ~mask; - xgpio_writereg(chip->regs + XGPIO_IPIER_OFFSET, temp); - } -- spin_unlock_irqrestore(&chip->gpio_lock, flags); -+ raw_spin_unlock_irqrestore(&chip->gpio_lock, flags); - - gpiochip_disable_irq(&chip->gc, irq_offset); - } -@@ -434,7 +434,7 @@ static void xgpio_irq_unmask(struct irq_data *irq_data) - - gpiochip_enable_irq(&chip->gc, irq_offset); - -- spin_lock_irqsave(&chip->gpio_lock, flags); -+ raw_spin_lock_irqsave(&chip->gpio_lock, flags); - - __set_bit(bit, chip->enable); - -@@ -453,7 +453,7 @@ static void xgpio_irq_unmask(struct irq_data *irq_data) - xgpio_writereg(chip->regs + XGPIO_IPIER_OFFSET, val); - } - -- spin_unlock_irqrestore(&chip->gpio_lock, flags); -+ raw_spin_unlock_irqrestore(&chip->gpio_lock, flags); - } - - /** -@@ -518,7 +518,7 @@ static void xgpio_irqhandler(struct irq_desc *desc) - - chained_irq_enter(irqchip, desc); - -- spin_lock(&chip->gpio_lock); -+ raw_spin_lock(&chip->gpio_lock); - - xgpio_read_ch_all(chip, XGPIO_DATA_OFFSET, all); - -@@ -535,7 +535,7 @@ static void xgpio_irqhandler(struct irq_desc *desc) - bitmap_copy(chip->last_irq_read, all, 64); - bitmap_or(all, rising, falling, 64); - -- spin_unlock(&chip->gpio_lock); -+ raw_spin_unlock(&chip->gpio_lock); - - dev_dbg(gc->parent, "IRQ rising %*pb falling %*pb\n", 64, rising, 64, falling); - -@@ -626,7 +626,7 @@ static int xgpio_probe(struct platform_device *pdev) - bitmap_set(chip->hw_map, 0, width[0]); - bitmap_set(chip->hw_map, 32, width[1]); - -- spin_lock_init(&chip->gpio_lock); -+ raw_spin_lock_init(&chip->gpio_lock); - - chip->gc.base = -1; - chip->gc.ngpio = bitmap_weight(chip->hw_map, 64); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -index f4c1cc6df1c830..2e739b80cfccf1 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -@@ -3172,7 +3172,7 @@ static int amdgpu_device_ip_resume_phase1(struct amdgpu_device *adev) - * - * @adev: amdgpu_device pointer - * -- * Second resume function for hardware IPs. The list of all the hardware -+ * First resume function for hardware IPs. The list of all the hardware - * IPs that make up the asic is walked and the resume callbacks are run for - * all blocks except COMMON, GMC, and IH. resume puts the hardware into a - * functional state after a suspend and updates the software state as -@@ -3190,7 +3190,6 @@ static int amdgpu_device_ip_resume_phase2(struct amdgpu_device *adev) - if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_COMMON || - adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_GMC || - adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_IH || -- adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_DCE || - adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_PSP) - continue; - r = adev->ip_blocks[i].version->funcs->resume(adev); -@@ -3205,36 +3204,6 @@ static int amdgpu_device_ip_resume_phase2(struct amdgpu_device *adev) - return 0; - } - --/** -- * amdgpu_device_ip_resume_phase3 - run resume for hardware IPs -- * -- * @adev: amdgpu_device pointer -- * -- * Third resume function for hardware IPs. The list of all the hardware -- * IPs that make up the asic is walked and the resume callbacks are run for -- * all DCE. resume puts the hardware into a functional state after a suspend -- * and updates the software state as necessary. This function is also used -- * for restoring the GPU after a GPU reset. -- * -- * Returns 0 on success, negative error code on failure. -- */ --static int amdgpu_device_ip_resume_phase3(struct amdgpu_device *adev) --{ -- int i, r; -- -- for (i = 0; i < adev->num_ip_blocks; i++) { -- if (!adev->ip_blocks[i].status.valid || adev->ip_blocks[i].status.hw) -- continue; -- if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_DCE) { -- r = adev->ip_blocks[i].version->funcs->resume(adev); -- if (r) -- return r; -- } -- } -- -- return 0; --} -- - /** - * amdgpu_device_ip_resume - run resume for hardware IPs - * -@@ -3261,13 +3230,6 @@ static int amdgpu_device_ip_resume(struct amdgpu_device *adev) - - r = amdgpu_device_ip_resume_phase2(adev); - -- if (r) -- return r; -- -- amdgpu_fence_driver_hw_init(adev); -- -- r = amdgpu_device_ip_resume_phase3(adev); -- - return r; - } - -@@ -4267,6 +4229,7 @@ int amdgpu_device_resume(struct drm_device *dev, bool fbcon) - dev_err(adev->dev, "amdgpu_device_ip_resume failed (%d).\n", r); - goto exit; - } -+ amdgpu_fence_driver_hw_init(adev); - - r = amdgpu_device_ip_late_init(adev); - if (r) -@@ -5036,10 +4999,6 @@ int amdgpu_do_asic_reset(struct list_head *device_list_handle, - if (r) - goto out; - -- r = amdgpu_device_ip_resume_phase3(tmp_adev); -- if (r) -- goto out; -- - if (vram_lost) - amdgpu_device_fill_reset_magic(tmp_adev); - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c -index 6aa3b1d845abe1..806ec5d021995c 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c -@@ -193,8 +193,8 @@ int amdgpu_ib_schedule(struct amdgpu_ring *ring, unsigned int num_ibs, - need_ctx_switch = ring->current_ctx != fence_ctx; - if (ring->funcs->emit_pipeline_sync && job && - ((tmp = amdgpu_sync_get_fence(&job->explicit_sync)) || -- (amdgpu_sriov_vf(adev) && need_ctx_switch) || -- amdgpu_vm_need_pipeline_sync(ring, job))) { -+ need_ctx_switch || amdgpu_vm_need_pipeline_sync(ring, job))) { -+ - need_pipe_sync = true; - - if (tmp) -diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c -index d1a25fe6c44faa..8dffa5b6426e1c 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c -@@ -1315,7 +1315,7 @@ static struct link_encoder *dcn21_link_encoder_create( - kzalloc(sizeof(struct dcn21_link_encoder), GFP_KERNEL); - int link_regs_id; - -- if (!enc21) -+ if (!enc21 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs)) - return NULL; - - link_regs_id = -diff --git a/drivers/gpu/drm/i915/display/intel_fb.c b/drivers/gpu/drm/i915/display/intel_fb.c -index 689b7c16d30072..22ae38bacb44a5 100644 ---- a/drivers/gpu/drm/i915/display/intel_fb.c -+++ b/drivers/gpu/drm/i915/display/intel_fb.c -@@ -1625,7 +1625,7 @@ int intel_fill_fb_info(struct drm_i915_private *i915, struct intel_framebuffer * - * arithmetic related to alignment and offset calculation. - */ - if (is_gen12_ccs_cc_plane(&fb->base, i)) { -- if (IS_ALIGNED(fb->base.offsets[i], PAGE_SIZE)) -+ if (IS_ALIGNED(fb->base.offsets[i], 64)) - continue; - else - return -EINVAL; -diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c -index 93f08f9479d89b..03eacb22648ef7 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_fence.c -+++ b/drivers/gpu/drm/nouveau/nouveau_fence.c -@@ -386,11 +386,13 @@ nouveau_fence_sync(struct nouveau_bo *nvbo, struct nouveau_channel *chan, - if (f) { - struct nouveau_channel *prev; - bool must_wait = true; -+ bool local; - - rcu_read_lock(); - prev = rcu_dereference(f->channel); -- if (prev && (prev == chan || -- fctx->sync(f, prev, chan) == 0)) -+ local = prev && prev->cli->drm == chan->cli->drm; -+ if (local && (prev == chan || -+ fctx->sync(f, prev, chan) == 0)) - must_wait = false; - rcu_read_unlock(); - if (!must_wait) -diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c -index e714d5318f3095..76806039691a2c 100644 ---- a/drivers/gpu/drm/v3d/v3d_irq.c -+++ b/drivers/gpu/drm/v3d/v3d_irq.c -@@ -103,6 +103,7 @@ v3d_irq(int irq, void *arg) - - trace_v3d_bcl_irq(&v3d->drm, fence->seqno); - dma_fence_signal(&fence->base); -+ v3d->bin_job = NULL; - status = IRQ_HANDLED; - } - -@@ -112,6 +113,7 @@ v3d_irq(int irq, void *arg) - - trace_v3d_rcl_irq(&v3d->drm, fence->seqno); - dma_fence_signal(&fence->base); -+ v3d->render_job = NULL; - status = IRQ_HANDLED; - } - -@@ -121,6 +123,7 @@ v3d_irq(int irq, void *arg) - - trace_v3d_csd_irq(&v3d->drm, fence->seqno); - dma_fence_signal(&fence->base); -+ v3d->csd_job = NULL; - status = IRQ_HANDLED; - } - -@@ -157,6 +160,7 @@ v3d_hub_irq(int irq, void *arg) - - trace_v3d_tfu_irq(&v3d->drm, fence->seqno); - dma_fence_signal(&fence->base); -+ v3d->tfu_job = NULL; - status = IRQ_HANDLED; - } - -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c -index fdc34283eeb97f..ec6ca264ce11ff 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c -@@ -412,7 +412,8 @@ static int vmw_bo_init(struct vmw_private *dev_priv, - - if (params->pin) - ttm_bo_pin(&vmw_bo->tbo); -- ttm_bo_unreserve(&vmw_bo->tbo); -+ if (!params->keep_resv) -+ ttm_bo_unreserve(&vmw_bo->tbo); - - return 0; - } -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.h b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.h -index 156ea612fc2a48..a3ac61b991bf66 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.h -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.h -@@ -53,8 +53,9 @@ struct vmw_bo_params { - u32 domain; - u32 busy_domain; - enum ttm_bo_type bo_type; -- size_t size; - bool pin; -+ bool keep_resv; -+ size_t size; - struct dma_resv *resv; - struct sg_table *sg; - }; -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -index bea576434e475c..4655c266924fed 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -@@ -399,7 +399,8 @@ static int vmw_dummy_query_bo_create(struct vmw_private *dev_priv) - .busy_domain = VMW_BO_DOMAIN_SYS, - .bo_type = ttm_bo_type_kernel, - .size = PAGE_SIZE, -- .pin = true -+ .pin = true, -+ .keep_resv = true, - }; - - /* -@@ -411,10 +412,6 @@ static int vmw_dummy_query_bo_create(struct vmw_private *dev_priv) - if (unlikely(ret != 0)) - return ret; - -- ret = ttm_bo_reserve(&vbo->tbo, false, true, NULL); -- BUG_ON(ret != 0); -- vmw_bo_pin_reserved(vbo, true); -- - ret = ttm_bo_kmap(&vbo->tbo, 0, 1, &map); - if (likely(ret == 0)) { - result = ttm_kmap_obj_virtual(&map, &dummy); -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c -index d6bcaf078b1f40..0dc3dacc5beee8 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c -@@ -163,6 +163,7 @@ struct drm_gem_object *vmw_prime_import_sg_table(struct drm_device *dev, - .bo_type = ttm_bo_type_sg, - .size = attach->dmabuf->size, - .pin = false, -+ .keep_resv = true, - .resv = attach->dmabuf->resv, - .sg = table, - -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c -index a01ca3226d0af8..7fb1c88bcc475f 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c -@@ -896,7 +896,8 @@ int vmw_compat_shader_add(struct vmw_private *dev_priv, - .busy_domain = VMW_BO_DOMAIN_SYS, - .bo_type = ttm_bo_type_device, - .size = size, -- .pin = true -+ .pin = true, -+ .keep_resv = true, - }; - - if (!vmw_shader_id_ok(user_key, shader_type)) -@@ -906,10 +907,6 @@ int vmw_compat_shader_add(struct vmw_private *dev_priv, - if (unlikely(ret != 0)) - goto out; - -- ret = ttm_bo_reserve(&buf->tbo, false, true, NULL); -- if (unlikely(ret != 0)) -- goto no_reserve; -- - /* Map and copy shader bytecode. */ - ret = ttm_bo_kmap(&buf->tbo, 0, PFN_UP(size), &map); - if (unlikely(ret != 0)) { -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c -index fcb87d83760ef6..75cf9e76df2ed4 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c -@@ -604,15 +604,14 @@ int vmw_bo_create_and_populate(struct vmw_private *dev_priv, - .busy_domain = domain, - .bo_type = ttm_bo_type_kernel, - .size = bo_size, -- .pin = true -+ .pin = true, -+ .keep_resv = true, - }; - - ret = vmw_bo_create(dev_priv, &bo_params, &vbo); - if (unlikely(ret != 0)) - return ret; - -- ret = ttm_bo_reserve(&vbo->tbo, false, true, NULL); -- BUG_ON(ret != 0); - ret = vmw_ttm_populate(vbo->tbo.bdev, vbo->tbo.ttm, &ctx); - if (likely(ret == 0)) { - struct vmw_ttm_tt *vmw_tt = -diff --git a/drivers/hwmon/tmp513.c b/drivers/hwmon/tmp513.c -index 070f93226ed696..62d31aadda4bb8 100644 ---- a/drivers/hwmon/tmp513.c -+++ b/drivers/hwmon/tmp513.c -@@ -203,7 +203,8 @@ static int tmp51x_get_value(struct tmp51x_data *data, u8 reg, u8 pos, - *val = sign_extend32(regval, - reg == TMP51X_SHUNT_CURRENT_RESULT ? - 16 - tmp51x_get_pga_shift(data) : 15); -- *val = DIV_ROUND_CLOSEST(*val * 10 * MILLI, data->shunt_uohms); -+ *val = DIV_ROUND_CLOSEST(*val * 10 * (long)MILLI, (long)data->shunt_uohms); -+ - break; - case TMP51X_BUS_VOLTAGE_RESULT: - case TMP51X_BUS_VOLTAGE_H_LIMIT: -@@ -219,7 +220,7 @@ static int tmp51x_get_value(struct tmp51x_data *data, u8 reg, u8 pos, - case TMP51X_BUS_CURRENT_RESULT: - // Current = (ShuntVoltage * CalibrationRegister) / 4096 - *val = sign_extend32(regval, 15) * (long)data->curr_lsb_ua; -- *val = DIV_ROUND_CLOSEST(*val, MILLI); -+ *val = DIV_ROUND_CLOSEST(*val, (long)MILLI); - break; - case TMP51X_LOCAL_TEMP_RESULT: - case TMP51X_REMOTE_TEMP_RESULT_1: -@@ -259,7 +260,7 @@ static int tmp51x_set_value(struct tmp51x_data *data, u8 reg, long val) - * The user enter current value and we convert it to - * voltage. 1lsb = 10uV - */ -- val = DIV_ROUND_CLOSEST(val * data->shunt_uohms, 10 * MILLI); -+ val = DIV_ROUND_CLOSEST(val * (long)data->shunt_uohms, 10 * (long)MILLI); - max_val = U16_MAX >> tmp51x_get_pga_shift(data); - regval = clamp_val(val, -max_val, max_val); - break; -diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c -index 84fdd3f5cc8445..610df67cedaadc 100644 ---- a/drivers/i2c/busses/i2c-rcar.c -+++ b/drivers/i2c/busses/i2c-rcar.c -@@ -110,6 +110,8 @@ - #define ID_P_PM_BLOCKED BIT(31) - #define ID_P_MASK GENMASK(31, 28) - -+#define ID_SLAVE_NACK BIT(0) -+ - enum rcar_i2c_type { - I2C_RCAR_GEN1, - I2C_RCAR_GEN2, -@@ -143,6 +145,7 @@ struct rcar_i2c_priv { - int irq; - - struct i2c_client *host_notify_client; -+ u8 slave_flags; - }; - - #define rcar_i2c_priv_to_dev(p) ((p)->adap.dev.parent) -@@ -597,6 +600,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) - { - u32 ssr_raw, ssr_filtered; - u8 value; -+ int ret; - - ssr_raw = rcar_i2c_read(priv, ICSSR) & 0xff; - ssr_filtered = ssr_raw & rcar_i2c_read(priv, ICSIER); -@@ -612,7 +616,10 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) - rcar_i2c_write(priv, ICRXTX, value); - rcar_i2c_write(priv, ICSIER, SDE | SSR | SAR); - } else { -- i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_REQUESTED, &value); -+ ret = i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_REQUESTED, &value); -+ if (ret) -+ priv->slave_flags |= ID_SLAVE_NACK; -+ - rcar_i2c_read(priv, ICRXTX); /* dummy read */ - rcar_i2c_write(priv, ICSIER, SDR | SSR | SAR); - } -@@ -625,18 +632,21 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) - if (ssr_filtered & SSR) { - i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value); - rcar_i2c_write(priv, ICSCR, SIE | SDBS); /* clear our NACK */ -+ priv->slave_flags &= ~ID_SLAVE_NACK; - rcar_i2c_write(priv, ICSIER, SAR); - rcar_i2c_write(priv, ICSSR, ~SSR & 0xff); - } - - /* master wants to write to us */ - if (ssr_filtered & SDR) { -- int ret; -- - value = rcar_i2c_read(priv, ICRXTX); - ret = i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_RECEIVED, &value); -- /* Send NACK in case of error */ -- rcar_i2c_write(priv, ICSCR, SIE | SDBS | (ret < 0 ? FNA : 0)); -+ if (ret) -+ priv->slave_flags |= ID_SLAVE_NACK; -+ -+ /* Send NACK in case of error, but it will come 1 byte late :( */ -+ rcar_i2c_write(priv, ICSCR, SIE | SDBS | -+ (priv->slave_flags & ID_SLAVE_NACK ? FNA : 0)); - rcar_i2c_write(priv, ICSSR, ~SDR & 0xff); - } - -diff --git a/drivers/i2c/i2c-atr.c b/drivers/i2c/i2c-atr.c -index 8ca1daadec9373..c03196da116351 100644 ---- a/drivers/i2c/i2c-atr.c -+++ b/drivers/i2c/i2c-atr.c -@@ -412,7 +412,7 @@ static int i2c_atr_bus_notifier_call(struct notifier_block *nb, - dev_name(dev), ret); - break; - -- case BUS_NOTIFY_DEL_DEVICE: -+ case BUS_NOTIFY_REMOVED_DEVICE: - i2c_atr_detach_client(client->adapter, client); - break; - -diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c -index 9f2e4aa2815933..299abb6dd9423d 100644 ---- a/drivers/i2c/muxes/i2c-demux-pinctrl.c -+++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c -@@ -261,7 +261,9 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev) - pm_runtime_no_callbacks(&pdev->dev); - - /* switch to first parent as active master */ -- i2c_demux_activate_master(priv, 0); -+ err = i2c_demux_activate_master(priv, 0); -+ if (err) -+ goto err_rollback; - - err = device_create_file(&pdev->dev, &dev_attr_available_masters); - if (err) -diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600.h b/drivers/iio/imu/inv_icm42600/inv_icm42600.h -index 0e290c807b0f91..94c0eb0bf8748a 100644 ---- a/drivers/iio/imu/inv_icm42600/inv_icm42600.h -+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600.h -@@ -362,6 +362,7 @@ struct inv_icm42600_state { - typedef int (*inv_icm42600_bus_setup)(struct inv_icm42600_state *); - - extern const struct regmap_config inv_icm42600_regmap_config; -+extern const struct regmap_config inv_icm42600_spi_regmap_config; - extern const struct dev_pm_ops inv_icm42600_pm_ops; - - const struct iio_mount_matrix * -diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c -index d938bc45439729..da65aa4e27242f 100644 ---- a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c -+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c -@@ -44,6 +44,17 @@ const struct regmap_config inv_icm42600_regmap_config = { - }; - EXPORT_SYMBOL_NS_GPL(inv_icm42600_regmap_config, IIO_ICM42600); - -+/* define specific regmap for SPI not supporting burst write */ -+const struct regmap_config inv_icm42600_spi_regmap_config = { -+ .reg_bits = 8, -+ .val_bits = 8, -+ .max_register = 0x4FFF, -+ .ranges = inv_icm42600_regmap_ranges, -+ .num_ranges = ARRAY_SIZE(inv_icm42600_regmap_ranges), -+ .use_single_write = true, -+}; -+EXPORT_SYMBOL_NS_GPL(inv_icm42600_spi_regmap_config, IIO_ICM42600); -+ - struct inv_icm42600_hw { - uint8_t whoami; - const char *name; -diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c -index 6be4ac79493794..abfa1b73cf4d35 100644 ---- a/drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c -+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c -@@ -59,7 +59,8 @@ static int inv_icm42600_probe(struct spi_device *spi) - return -EINVAL; - chip = (uintptr_t)match; - -- regmap = devm_regmap_init_spi(spi, &inv_icm42600_regmap_config); -+ /* use SPI specific regmap */ -+ regmap = devm_regmap_init_spi(spi, &inv_icm42600_spi_regmap_config); - if (IS_ERR(regmap)) - return PTR_ERR(regmap); - -diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c -index 13c65ec5825687..08da793969ee55 100644 ---- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c -+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c -@@ -2220,6 +2220,7 @@ int bnxt_re_query_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr, - qp_attr->retry_cnt = qplib_qp->retry_cnt; - qp_attr->rnr_retry = qplib_qp->rnr_retry; - qp_attr->min_rnr_timer = qplib_qp->min_rnr_timer; -+ qp_attr->port_num = __to_ib_port_num(qplib_qp->port_id); - qp_attr->rq_psn = qplib_qp->rq.psn; - qp_attr->max_rd_atomic = qplib_qp->max_rd_atomic; - qp_attr->sq_psn = qplib_qp->sq.psn; -diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.h b/drivers/infiniband/hw/bnxt_re/ib_verbs.h -index 98baea98fc1761..ef910e6e2ccb73 100644 ---- a/drivers/infiniband/hw/bnxt_re/ib_verbs.h -+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.h -@@ -245,6 +245,10 @@ void bnxt_re_dealloc_ucontext(struct ib_ucontext *context); - int bnxt_re_mmap(struct ib_ucontext *context, struct vm_area_struct *vma); - void bnxt_re_mmap_free(struct rdma_user_mmap_entry *rdma_entry); - -+static inline u32 __to_ib_port_num(u16 port_id) -+{ -+ return (u32)port_id + 1; -+} - - unsigned long bnxt_re_lock_cqs(struct bnxt_re_qp *qp); - void bnxt_re_unlock_cqs(struct bnxt_re_qp *qp, unsigned long flags); -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c -index 871a49315c880f..c4f10498c79d87 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c -+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c -@@ -1460,6 +1460,7 @@ int bnxt_qplib_query_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) - qp->dest_qpn = le32_to_cpu(sb->dest_qp_id); - memcpy(qp->smac, sb->src_mac, 6); - qp->vlan_id = le16_to_cpu(sb->vlan_pcp_vlan_dei_vlan_id); -+ qp->port_id = le16_to_cpu(sb->port_id); - bail: - dma_free_coherent(&rcfw->pdev->dev, sbuf.size, - sbuf.sb, sbuf.dma_addr); -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h -index b5c53e864fbb39..55fd840359ef23 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h -+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h -@@ -297,6 +297,7 @@ struct bnxt_qplib_qp { - u32 dest_qpn; - u8 smac[6]; - u16 vlan_id; -+ u16 port_id; - u8 nw_type; - struct bnxt_qplib_ah ah; - -diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c -index b1e60c13c1e1e7..a1934fe4ad5ab0 100644 ---- a/drivers/irqchip/irq-gic-v3-its.c -+++ b/drivers/irqchip/irq-gic-v3-its.c -@@ -1970,7 +1970,7 @@ static int its_irq_set_vcpu_affinity(struct irq_data *d, void *vcpu_info) - if (!is_v4(its_dev->its)) - return -EINVAL; - -- guard(raw_spinlock_irq)(&its_dev->event_map.vlpi_lock); -+ guard(raw_spinlock)(&its_dev->event_map.vlpi_lock); - - /* Unmap request? */ - if (!info) -diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c -index e7f000f90bb467..6c7943c516eb09 100644 ---- a/drivers/irqchip/irq-gic-v3.c -+++ b/drivers/irqchip/irq-gic-v3.c -@@ -1460,7 +1460,7 @@ static int gic_retrigger(struct irq_data *data) - static int gic_cpu_pm_notifier(struct notifier_block *self, - unsigned long cmd, void *v) - { -- if (cmd == CPU_PM_EXIT) { -+ if (cmd == CPU_PM_EXIT || cmd == CPU_PM_ENTER_FAILED) { - if (gic_dist_security_disabled()) - gic_enable_redist(true); - gic_cpu_sys_reg_init(); -diff --git a/drivers/irqchip/irqchip.c b/drivers/irqchip/irqchip.c -index 1eeb0d0156ce9e..0ee7b6b71f5fa5 100644 ---- a/drivers/irqchip/irqchip.c -+++ b/drivers/irqchip/irqchip.c -@@ -35,11 +35,10 @@ void __init irqchip_init(void) - int platform_irqchip_probe(struct platform_device *pdev) - { - struct device_node *np = pdev->dev.of_node; -- struct device_node *par_np = of_irq_find_parent(np); -+ struct device_node *par_np __free(device_node) = of_irq_find_parent(np); - of_irq_init_cb_t irq_init_cb = of_device_get_match_data(&pdev->dev); - - if (!irq_init_cb) { -- of_node_put(par_np); - return -EINVAL; - } - -@@ -55,7 +54,6 @@ int platform_irqchip_probe(struct platform_device *pdev) - * interrupt controller can check for specific domains as necessary. - */ - if (par_np && !irq_find_matching_host(par_np, DOMAIN_BUS_ANY)) { -- of_node_put(par_np); - return -EPROBE_DEFER; - } - -diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c -index 8d75a66775cb1f..1b0c6770c14e46 100644 ---- a/drivers/mtd/spi-nor/core.c -+++ b/drivers/mtd/spi-nor/core.c -@@ -89,7 +89,7 @@ void spi_nor_spimem_setup_op(const struct spi_nor *nor, - op->addr.buswidth = spi_nor_get_protocol_addr_nbits(proto); - - if (op->dummy.nbytes) -- op->dummy.buswidth = spi_nor_get_protocol_data_nbits(proto); -+ op->dummy.buswidth = spi_nor_get_protocol_addr_nbits(proto); - - if (op->data.nbytes) - op->data.buswidth = spi_nor_get_protocol_data_nbits(proto); -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c -index 6a716337f48be1..268399dfcf22f0 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c -+++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c -@@ -923,7 +923,6 @@ static void xgbe_phy_free_phy_device(struct xgbe_prv_data *pdata) - - static bool xgbe_phy_finisar_phy_quirks(struct xgbe_prv_data *pdata) - { -- __ETHTOOL_DECLARE_LINK_MODE_MASK(supported) = { 0, }; - struct xgbe_phy_data *phy_data = pdata->phy_data; - unsigned int phy_id = phy_data->phydev->phy_id; - -@@ -945,14 +944,7 @@ static bool xgbe_phy_finisar_phy_quirks(struct xgbe_prv_data *pdata) - phy_write(phy_data->phydev, 0x04, 0x0d01); - phy_write(phy_data->phydev, 0x00, 0x9140); - -- linkmode_set_bit_array(phy_10_100_features_array, -- ARRAY_SIZE(phy_10_100_features_array), -- supported); -- linkmode_set_bit_array(phy_gbit_features_array, -- ARRAY_SIZE(phy_gbit_features_array), -- supported); -- -- linkmode_copy(phy_data->phydev->supported, supported); -+ linkmode_copy(phy_data->phydev->supported, PHY_GBIT_FEATURES); - - phy_support_asym_pause(phy_data->phydev); - -@@ -964,7 +956,6 @@ static bool xgbe_phy_finisar_phy_quirks(struct xgbe_prv_data *pdata) - - static bool xgbe_phy_belfuse_phy_quirks(struct xgbe_prv_data *pdata) - { -- __ETHTOOL_DECLARE_LINK_MODE_MASK(supported) = { 0, }; - struct xgbe_phy_data *phy_data = pdata->phy_data; - struct xgbe_sfp_eeprom *sfp_eeprom = &phy_data->sfp_eeprom; - unsigned int phy_id = phy_data->phydev->phy_id; -@@ -1028,13 +1019,7 @@ static bool xgbe_phy_belfuse_phy_quirks(struct xgbe_prv_data *pdata) - reg = phy_read(phy_data->phydev, 0x00); - phy_write(phy_data->phydev, 0x00, reg & ~0x00800); - -- linkmode_set_bit_array(phy_10_100_features_array, -- ARRAY_SIZE(phy_10_100_features_array), -- supported); -- linkmode_set_bit_array(phy_gbit_features_array, -- ARRAY_SIZE(phy_gbit_features_array), -- supported); -- linkmode_copy(phy_data->phydev->supported, supported); -+ linkmode_copy(phy_data->phydev->supported, PHY_GBIT_FEATURES); - phy_support_asym_pause(phy_data->phydev); - - netif_dbg(pdata, drv, pdata->netdev, -diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c -index e8d9a0eba4d6b5..8f5cc1f2331884 100644 ---- a/drivers/net/ethernet/freescale/fec_main.c -+++ b/drivers/net/ethernet/freescale/fec_main.c -@@ -1572,19 +1572,22 @@ static void fec_enet_tx(struct net_device *ndev, int budget) - fec_enet_tx_queue(ndev, i, budget); - } - --static void fec_enet_update_cbd(struct fec_enet_priv_rx_q *rxq, -+static int fec_enet_update_cbd(struct fec_enet_priv_rx_q *rxq, - struct bufdesc *bdp, int index) - { - struct page *new_page; - dma_addr_t phys_addr; - - new_page = page_pool_dev_alloc_pages(rxq->page_pool); -- WARN_ON(!new_page); -- rxq->rx_skb_info[index].page = new_page; -+ if (unlikely(!new_page)) -+ return -ENOMEM; - -+ rxq->rx_skb_info[index].page = new_page; - rxq->rx_skb_info[index].offset = FEC_ENET_XDP_HEADROOM; - phys_addr = page_pool_get_dma_addr(new_page) + FEC_ENET_XDP_HEADROOM; - bdp->cbd_bufaddr = cpu_to_fec32(phys_addr); -+ -+ return 0; - } - - static u32 -@@ -1679,6 +1682,7 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id) - int cpu = smp_processor_id(); - struct xdp_buff xdp; - struct page *page; -+ __fec32 cbd_bufaddr; - u32 sub_len = 4; - - #if !defined(CONFIG_M5272) -@@ -1743,12 +1747,17 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id) - - index = fec_enet_get_bd_index(bdp, &rxq->bd); - page = rxq->rx_skb_info[index].page; -+ cbd_bufaddr = bdp->cbd_bufaddr; -+ if (fec_enet_update_cbd(rxq, bdp, index)) { -+ ndev->stats.rx_dropped++; -+ goto rx_processing_done; -+ } -+ - dma_sync_single_for_cpu(&fep->pdev->dev, -- fec32_to_cpu(bdp->cbd_bufaddr), -+ fec32_to_cpu(cbd_bufaddr), - pkt_len, - DMA_FROM_DEVICE); - prefetch(page_address(page)); -- fec_enet_update_cbd(rxq, bdp, index); - - if (xdp_prog) { - xdp_buff_clear_frags_flag(&xdp); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -index 015faddabc8e09..463c23ae0ad1ec 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -@@ -719,6 +719,12 @@ static int mlx5e_xfrm_add_state(struct xfrm_state *x, - /* check esn */ - if (x->props.flags & XFRM_STATE_ESN) - mlx5e_ipsec_update_esn_state(sa_entry); -+ else -+ /* According to RFC4303, section "3.3.3. Sequence Number Generation", -+ * the first packet sent using a given SA will contain a sequence -+ * number of 1. -+ */ -+ sa_entry->esn_state.esn = 1; - - mlx5e_ipsec_build_accel_xfrm_attrs(sa_entry, &sa_entry->attrs); - -@@ -763,9 +769,12 @@ static int mlx5e_xfrm_add_state(struct xfrm_state *x, - MLX5_IPSEC_RESCHED); - - if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET && -- x->props.mode == XFRM_MODE_TUNNEL) -- xa_set_mark(&ipsec->sadb, sa_entry->ipsec_obj_id, -- MLX5E_IPSEC_TUNNEL_SA); -+ x->props.mode == XFRM_MODE_TUNNEL) { -+ xa_lock_bh(&ipsec->sadb); -+ __xa_set_mark(&ipsec->sadb, sa_entry->ipsec_obj_id, -+ MLX5E_IPSEC_TUNNEL_SA); -+ xa_unlock_bh(&ipsec->sadb); -+ } - - out: - x->xso.offload_handle = (unsigned long)sa_entry; -@@ -792,7 +801,6 @@ static int mlx5e_xfrm_add_state(struct xfrm_state *x, - static void mlx5e_xfrm_del_state(struct xfrm_state *x) - { - struct mlx5e_ipsec_sa_entry *sa_entry = to_ipsec_sa_entry(x); -- struct mlx5_accel_esp_xfrm_attrs *attrs = &sa_entry->attrs; - struct mlx5e_ipsec *ipsec = sa_entry->ipsec; - struct mlx5e_ipsec_sa_entry *old; - -@@ -801,12 +809,6 @@ static void mlx5e_xfrm_del_state(struct xfrm_state *x) - - old = xa_erase_bh(&ipsec->sadb, sa_entry->ipsec_obj_id); - WARN_ON(old != sa_entry); -- -- if (attrs->mode == XFRM_MODE_TUNNEL && -- attrs->type == XFRM_DEV_OFFLOAD_PACKET) -- /* Make sure that no ARP requests are running in parallel */ -- flush_workqueue(ipsec->wq); -- - } - - static void mlx5e_xfrm_free_state(struct xfrm_state *x) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -index 61288066830d94..2382c712898574 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -@@ -1442,23 +1442,21 @@ static int tx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry) - goto err_alloc; - } - -- if (attrs->family == AF_INET) -- setup_fte_addr4(spec, &attrs->saddr.a4, &attrs->daddr.a4); -- else -- setup_fte_addr6(spec, attrs->saddr.a6, attrs->daddr.a6); -- - setup_fte_no_frags(spec); - setup_fte_upper_proto_match(spec, &attrs->upspec); - - switch (attrs->type) { - case XFRM_DEV_OFFLOAD_CRYPTO: -+ if (attrs->family == AF_INET) -+ setup_fte_addr4(spec, &attrs->saddr.a4, &attrs->daddr.a4); -+ else -+ setup_fte_addr6(spec, attrs->saddr.a6, attrs->daddr.a6); - setup_fte_spi(spec, attrs->spi, false); - setup_fte_esp(spec); - setup_fte_reg_a(spec); - break; - case XFRM_DEV_OFFLOAD_PACKET: -- if (attrs->reqid) -- setup_fte_reg_c4(spec, attrs->reqid); -+ setup_fte_reg_c4(spec, attrs->reqid); - err = setup_pkt_reformat(ipsec, attrs, &flow_act); - if (err) - goto err_pkt_reformat; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c -index de83567aae7913..940e350058d10e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c -@@ -90,8 +90,9 @@ u32 mlx5_ipsec_device_caps(struct mlx5_core_dev *mdev) - EXPORT_SYMBOL_GPL(mlx5_ipsec_device_caps); - - static void mlx5e_ipsec_packet_setup(void *obj, u32 pdn, -- struct mlx5_accel_esp_xfrm_attrs *attrs) -+ struct mlx5e_ipsec_sa_entry *sa_entry) - { -+ struct mlx5_accel_esp_xfrm_attrs *attrs = &sa_entry->attrs; - void *aso_ctx; - - aso_ctx = MLX5_ADDR_OF(ipsec_obj, obj, ipsec_aso); -@@ -119,8 +120,12 @@ static void mlx5e_ipsec_packet_setup(void *obj, u32 pdn, - * active. - */ - MLX5_SET(ipsec_obj, obj, aso_return_reg, MLX5_IPSEC_ASO_REG_C_4_5); -- if (attrs->dir == XFRM_DEV_OFFLOAD_OUT) -+ if (attrs->dir == XFRM_DEV_OFFLOAD_OUT) { - MLX5_SET(ipsec_aso, aso_ctx, mode, MLX5_IPSEC_ASO_INC_SN); -+ if (!attrs->replay_esn.trigger) -+ MLX5_SET(ipsec_aso, aso_ctx, mode_parameter, -+ sa_entry->esn_state.esn); -+ } - - if (attrs->lft.hard_packet_limit != XFRM_INF) { - MLX5_SET(ipsec_aso, aso_ctx, remove_flow_pkt_cnt, -@@ -173,7 +178,7 @@ static int mlx5_create_ipsec_obj(struct mlx5e_ipsec_sa_entry *sa_entry) - - res = &mdev->mlx5e_res.hw_objs; - if (attrs->type == XFRM_DEV_OFFLOAD_PACKET) -- mlx5e_ipsec_packet_setup(obj, res->pdn, attrs); -+ mlx5e_ipsec_packet_setup(obj, res->pdn, sa_entry); - - err = mlx5_cmd_exec(mdev, in, sizeof(in), out, sizeof(out)); - if (!err) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -index 474e63d02ba492..d2dc375f5e49cb 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -@@ -2490,6 +2490,7 @@ struct mlx5_flow_namespace *mlx5_get_flow_namespace(struct mlx5_core_dev *dev, - break; - case MLX5_FLOW_NAMESPACE_RDMA_TX: - root_ns = steering->rdma_tx_root_ns; -+ prio = RDMA_TX_BYPASS_PRIO; - break; - case MLX5_FLOW_NAMESPACE_RDMA_RX_COUNTERS: - root_ns = steering->rdma_rx_root_ns; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/port_sel.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/port_sel.c -index 005661248c7e9c..9faa9ef863a1b6 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lag/port_sel.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/port_sel.c -@@ -540,7 +540,7 @@ int mlx5_lag_port_sel_create(struct mlx5_lag *ldev, - set_tt_map(port_sel, hash_type); - err = mlx5_lag_create_definers(ldev, hash_type, ports); - if (err) -- return err; -+ goto clear_port_sel; - - if (port_sel->tunnel) { - err = mlx5_lag_create_inner_ttc_table(ldev); -@@ -559,6 +559,8 @@ int mlx5_lag_port_sel_create(struct mlx5_lag *ldev, - mlx5_destroy_ttc_table(port_sel->inner.ttc); - destroy_definers: - mlx5_lag_destroy_definers(ldev); -+clear_port_sel: -+ memset(port_sel, 0, sizeof(*port_sel)); - return err; - } - -diff --git a/drivers/net/ethernet/netronome/nfp/bpf/offload.c b/drivers/net/ethernet/netronome/nfp/bpf/offload.c -index 9d97cd281f18e4..c03558adda91eb 100644 ---- a/drivers/net/ethernet/netronome/nfp/bpf/offload.c -+++ b/drivers/net/ethernet/netronome/nfp/bpf/offload.c -@@ -458,7 +458,8 @@ int nfp_bpf_event_output(struct nfp_app_bpf *bpf, const void *data, - map_id_full = be64_to_cpu(cbe->map_ptr); - map_id = map_id_full; - -- if (len < sizeof(struct cmsg_bpf_event) + pkt_size + data_size) -+ if (size_add(pkt_size, data_size) > INT_MAX || -+ len < sizeof(struct cmsg_bpf_event) + pkt_size + data_size) - return -EINVAL; - if (cbe->hdr.ver != NFP_CCM_ABI_VERSION) - return -EINVAL; -diff --git a/drivers/net/ethernet/ti/cpsw_ale.c b/drivers/net/ethernet/ti/cpsw_ale.c -index 64bf22cd860c9a..9eccc7064c2b05 100644 ---- a/drivers/net/ethernet/ti/cpsw_ale.c -+++ b/drivers/net/ethernet/ti/cpsw_ale.c -@@ -106,15 +106,15 @@ struct cpsw_ale_dev_id { - - static inline int cpsw_ale_get_field(u32 *ale_entry, u32 start, u32 bits) - { -- int idx, idx2; -+ int idx, idx2, index; - u32 hi_val = 0; - - idx = start / 32; - idx2 = (start + bits - 1) / 32; - /* Check if bits to be fetched exceed a word */ - if (idx != idx2) { -- idx2 = 2 - idx2; /* flip */ -- hi_val = ale_entry[idx2] << ((idx2 * 32) - start); -+ index = 2 - idx2; /* flip */ -+ hi_val = ale_entry[index] << ((idx2 * 32) - start); - } - start -= idx * 32; - idx = 2 - idx; /* flip */ -@@ -124,16 +124,16 @@ static inline int cpsw_ale_get_field(u32 *ale_entry, u32 start, u32 bits) - static inline void cpsw_ale_set_field(u32 *ale_entry, u32 start, u32 bits, - u32 value) - { -- int idx, idx2; -+ int idx, idx2, index; - - value &= BITMASK(bits); - idx = start / 32; - idx2 = (start + bits - 1) / 32; - /* Check if bits to be set exceed a word */ - if (idx != idx2) { -- idx2 = 2 - idx2; /* flip */ -- ale_entry[idx2] &= ~(BITMASK(bits + start - (idx2 * 32))); -- ale_entry[idx2] |= (value >> ((idx2 * 32) - start)); -+ index = 2 - idx2; /* flip */ -+ ale_entry[index] &= ~(BITMASK(bits + start - (idx2 * 32))); -+ ale_entry[index] |= (value >> ((idx2 * 32) - start)); - } - start -= idx * 32; - idx = 2 - idx; /* flip */ -diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c -index 9f779653ed6225..02e11827440b5c 100644 ---- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c -+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c -@@ -1571,6 +1571,12 @@ axienet_ethtools_set_coalesce(struct net_device *ndev, - return -EFAULT; - } - -+ if (ecoalesce->rx_max_coalesced_frames > 255 || -+ ecoalesce->tx_max_coalesced_frames > 255) { -+ NL_SET_ERR_MSG(extack, "frames must be less than 256"); -+ return -EINVAL; -+ } -+ - if (ecoalesce->rx_max_coalesced_frames) - lp->coalesce_count_rx = ecoalesce->rx_max_coalesced_frames; - if (ecoalesce->rx_coalesce_usecs) -diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c -index 9dd8f66610ce6b..47238c3ec82e75 100644 ---- a/drivers/net/gtp.c -+++ b/drivers/net/gtp.c -@@ -1095,8 +1095,8 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev, - goto out_encap; - } - -- gn = net_generic(dev_net(dev), gtp_net_id); -- list_add_rcu(>p->list, &gn->gtp_dev_list); -+ gn = net_generic(src_net, gtp_net_id); -+ list_add(>p->list, &gn->gtp_dev_list); - dev->priv_destructor = gtp_destructor; - - netdev_dbg(dev, "registered new GTP interface\n"); -@@ -1122,7 +1122,7 @@ static void gtp_dellink(struct net_device *dev, struct list_head *head) - hlist_for_each_entry_safe(pctx, next, >p->tid_hash[i], hlist_tid) - pdp_context_delete(pctx); - -- list_del_rcu(>p->list); -+ list_del(>p->list); - unregister_netdevice_queue(dev, head); - } - -@@ -1690,16 +1690,19 @@ static int gtp_genl_dump_pdp(struct sk_buff *skb, - struct gtp_dev *last_gtp = (struct gtp_dev *)cb->args[2], *gtp; - int i, j, bucket = cb->args[0], skip = cb->args[1]; - struct net *net = sock_net(skb->sk); -+ struct net_device *dev; - struct pdp_ctx *pctx; -- struct gtp_net *gn; -- -- gn = net_generic(net, gtp_net_id); - - if (cb->args[4]) - return 0; - - rcu_read_lock(); -- list_for_each_entry_rcu(gtp, &gn->gtp_dev_list, list) { -+ for_each_netdev_rcu(net, dev) { -+ if (dev->rtnl_link_ops != >p_link_ops) -+ continue; -+ -+ gtp = netdev_priv(dev); -+ - if (last_gtp && last_gtp != gtp) - continue; - else -@@ -1884,23 +1887,28 @@ static int __net_init gtp_net_init(struct net *net) - return 0; - } - --static void __net_exit gtp_net_exit(struct net *net) -+static void __net_exit gtp_net_exit_batch_rtnl(struct list_head *net_list, -+ struct list_head *dev_to_kill) - { -- struct gtp_net *gn = net_generic(net, gtp_net_id); -- struct gtp_dev *gtp; -- LIST_HEAD(list); -+ struct net *net; - -- rtnl_lock(); -- list_for_each_entry(gtp, &gn->gtp_dev_list, list) -- gtp_dellink(gtp->dev, &list); -+ list_for_each_entry(net, net_list, exit_list) { -+ struct gtp_net *gn = net_generic(net, gtp_net_id); -+ struct gtp_dev *gtp, *gtp_next; -+ struct net_device *dev; - -- unregister_netdevice_many(&list); -- rtnl_unlock(); -+ for_each_netdev(net, dev) -+ if (dev->rtnl_link_ops == >p_link_ops) -+ gtp_dellink(dev, dev_to_kill); -+ -+ list_for_each_entry_safe(gtp, gtp_next, &gn->gtp_dev_list, list) -+ gtp_dellink(gtp->dev, dev_to_kill); -+ } - } - - static struct pernet_operations gtp_net_ops = { - .init = gtp_net_init, -- .exit = gtp_net_exit, -+ .exit_batch_rtnl = gtp_net_exit_batch_rtnl, - .id = >p_net_id, - .size = sizeof(struct gtp_net), - }; -diff --git a/drivers/nvme/target/io-cmd-bdev.c b/drivers/nvme/target/io-cmd-bdev.c -index 468833675cc949..c0b342cc93db39 100644 ---- a/drivers/nvme/target/io-cmd-bdev.c -+++ b/drivers/nvme/target/io-cmd-bdev.c -@@ -36,7 +36,7 @@ void nvmet_bdev_set_limits(struct block_device *bdev, struct nvme_id_ns *id) - */ - id->nsfeat |= 1 << 4; - /* NPWG = Namespace Preferred Write Granularity. 0's based */ -- id->npwg = lpp0b; -+ id->npwg = to0based(bdev_io_min(bdev) / bdev_logical_block_size(bdev)); - /* NPWA = Namespace Preferred Write Alignment. 0's based */ - id->npwa = id->npwg; - /* NPDG = Namespace Preferred Deallocate Granularity. 0's based */ -diff --git a/drivers/pci/controller/pci-host-common.c b/drivers/pci/controller/pci-host-common.c -index e2602e38ae4526..6be3266cd7b5b2 100644 ---- a/drivers/pci/controller/pci-host-common.c -+++ b/drivers/pci/controller/pci-host-common.c -@@ -73,6 +73,10 @@ int pci_host_common_probe(struct platform_device *pdev) - if (IS_ERR(cfg)) - return PTR_ERR(cfg); - -+ /* Do not reassign resources if probe only */ -+ if (!pci_has_flag(PCI_PROBE_ONLY)) -+ pci_add_flags(PCI_REASSIGN_ALL_BUS); -+ - bridge->sysdata = cfg; - bridge->ops = (struct pci_ops *)&ops->pci_ops; - bridge->msi_domain = true; -diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c -index 7e84e472b3383c..03b519a2284038 100644 ---- a/drivers/pci/probe.c -+++ b/drivers/pci/probe.c -@@ -3096,18 +3096,20 @@ int pci_host_probe(struct pci_host_bridge *bridge) - - bus = bridge->bus; - -- /* If we must preserve the resource configuration, claim now */ -- if (bridge->preserve_config) -- pci_bus_claim_resources(bus); -- - /* -- * Assign whatever was left unassigned. If we didn't claim above, -- * this will reassign everything. -+ * We insert PCI resources into the iomem_resource and -+ * ioport_resource trees in either pci_bus_claim_resources() -+ * or pci_bus_assign_resources(). - */ -- pci_assign_unassigned_root_bus_resources(bus); -+ if (pci_has_flag(PCI_PROBE_ONLY)) { -+ pci_bus_claim_resources(bus); -+ } else { -+ pci_bus_size_bridges(bus); -+ pci_bus_assign_resources(bus); - -- list_for_each_entry(child, &bus->children, node) -- pcie_bus_configure_settings(child); -+ list_for_each_entry(child, &bus->children, node) -+ pcie_bus_configure_settings(child); -+ } - - pci_bus_add_devices(bus); - return 0; -diff --git a/drivers/pmdomain/imx/imx8mp-blk-ctrl.c b/drivers/pmdomain/imx/imx8mp-blk-ctrl.c -index 31693add7d633f..faf643a4a5d06b 100644 ---- a/drivers/pmdomain/imx/imx8mp-blk-ctrl.c -+++ b/drivers/pmdomain/imx/imx8mp-blk-ctrl.c -@@ -767,7 +767,7 @@ static int imx8mp_blk_ctrl_remove(struct platform_device *pdev) - - of_genpd_del_provider(pdev->dev.of_node); - -- for (i = 0; bc->onecell_data.num_domains; i++) { -+ for (i = 0; i < bc->onecell_data.num_domains; i++) { - struct imx8mp_blk_ctrl_domain *domain = &bc->domains[i]; - - pm_genpd_remove(&domain->genpd); -diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c -index 02696c7f9beff9..0ac0b6aaf9c62c 100644 ---- a/drivers/ufs/core/ufshcd.c -+++ b/drivers/ufs/core/ufshcd.c -@@ -10483,14 +10483,17 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) - } - - /* -- * Set the default power management level for runtime and system PM. -+ * Set the default power management level for runtime and system PM if -+ * not set by the host controller drivers. - * Default power saving mode is to keep UFS link in Hibern8 state - * and UFS device in sleep state. - */ -- hba->rpm_lvl = ufs_get_desired_pm_lvl_for_dev_link_state( -+ if (!hba->rpm_lvl) -+ hba->rpm_lvl = ufs_get_desired_pm_lvl_for_dev_link_state( - UFS_SLEEP_PWR_MODE, - UIC_LINK_HIBERN8_STATE); -- hba->spm_lvl = ufs_get_desired_pm_lvl_for_dev_link_state( -+ if (!hba->spm_lvl) -+ hba->spm_lvl = ufs_get_desired_pm_lvl_for_dev_link_state( - UFS_SLEEP_PWR_MODE, - UIC_LINK_HIBERN8_STATE); - -diff --git a/fs/cachefiles/daemon.c b/fs/cachefiles/daemon.c -index 89b11336a83697..1806bff8e59bc3 100644 ---- a/fs/cachefiles/daemon.c -+++ b/fs/cachefiles/daemon.c -@@ -15,6 +15,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -576,7 +577,7 @@ static int cachefiles_daemon_dir(struct cachefiles_cache *cache, char *args) - */ - static int cachefiles_daemon_secctx(struct cachefiles_cache *cache, char *args) - { -- char *secctx; -+ int err; - - _enter(",%s", args); - -@@ -585,16 +586,16 @@ static int cachefiles_daemon_secctx(struct cachefiles_cache *cache, char *args) - return -EINVAL; - } - -- if (cache->secctx) { -+ if (cache->have_secid) { - pr_err("Second security context specified\n"); - return -EINVAL; - } - -- secctx = kstrdup(args, GFP_KERNEL); -- if (!secctx) -- return -ENOMEM; -+ err = security_secctx_to_secid(args, strlen(args), &cache->secid); -+ if (err) -+ return err; - -- cache->secctx = secctx; -+ cache->have_secid = true; - return 0; - } - -@@ -820,7 +821,6 @@ static void cachefiles_daemon_unbind(struct cachefiles_cache *cache) - put_cred(cache->cache_cred); - - kfree(cache->rootdirname); -- kfree(cache->secctx); - kfree(cache->tag); - - _leave(""); -diff --git a/fs/cachefiles/internal.h b/fs/cachefiles/internal.h -index 111ad6ecd4baf3..4421a12960a662 100644 ---- a/fs/cachefiles/internal.h -+++ b/fs/cachefiles/internal.h -@@ -122,7 +122,6 @@ struct cachefiles_cache { - #define CACHEFILES_STATE_CHANGED 3 /* T if state changed (poll trigger) */ - #define CACHEFILES_ONDEMAND_MODE 4 /* T if in on-demand read mode */ - char *rootdirname; /* name of cache root directory */ -- char *secctx; /* LSM security context */ - char *tag; /* cache binding tag */ - refcount_t unbind_pincount;/* refcount to do daemon unbind */ - struct xarray reqs; /* xarray of pending on-demand requests */ -@@ -130,6 +129,8 @@ struct cachefiles_cache { - struct xarray ondemand_ids; /* xarray for ondemand_id allocation */ - u32 ondemand_id_next; - u32 msg_id_next; -+ u32 secid; /* LSM security id */ -+ bool have_secid; /* whether "secid" was set */ - }; - - static inline bool cachefiles_in_ondemand_mode(struct cachefiles_cache *cache) -diff --git a/fs/cachefiles/security.c b/fs/cachefiles/security.c -index fe777164f1d894..fc6611886b3b5e 100644 ---- a/fs/cachefiles/security.c -+++ b/fs/cachefiles/security.c -@@ -18,7 +18,7 @@ int cachefiles_get_security_ID(struct cachefiles_cache *cache) - struct cred *new; - int ret; - -- _enter("{%s}", cache->secctx); -+ _enter("{%u}", cache->have_secid ? cache->secid : 0); - - new = prepare_kernel_cred(current); - if (!new) { -@@ -26,8 +26,8 @@ int cachefiles_get_security_ID(struct cachefiles_cache *cache) - goto error; - } - -- if (cache->secctx) { -- ret = set_security_override_from_ctx(new, cache->secctx); -+ if (cache->have_secid) { -+ ret = set_security_override(new, cache->secid); - if (ret < 0) { - put_cred(new); - pr_err("Security denies permission to nominate security context: error %d\n", -diff --git a/fs/file.c b/fs/file.c -index bd817e31d79866..a178efc8cf4b5c 100644 ---- a/fs/file.c -+++ b/fs/file.c -@@ -21,6 +21,7 @@ - #include - #include - #include -+#include - - #include "internal.h" - -diff --git a/fs/hfs/super.c b/fs/hfs/super.c -index 6764afa98a6ff1..431bdc65f72312 100644 ---- a/fs/hfs/super.c -+++ b/fs/hfs/super.c -@@ -418,11 +418,13 @@ static int hfs_fill_super(struct super_block *sb, void *data, int silent) - goto bail_no_root; - res = hfs_cat_find_brec(sb, HFS_ROOT_CNID, &fd); - if (!res) { -- if (fd.entrylength > sizeof(rec) || fd.entrylength < 0) { -+ if (fd.entrylength != sizeof(rec.dir)) { - res = -EIO; - goto bail_hfs_find; - } - hfs_bnode_read(fd.bnode, &rec, fd.entryoffset, fd.entrylength); -+ if (rec.type != HFS_CDR_DIR) -+ res = -EIO; - } - if (res) - goto bail_hfs_find; -diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c -index a05ee2cbb77936..e7e6701806ad26 100644 ---- a/fs/iomap/buffered-io.c -+++ b/fs/iomap/buffered-io.c -@@ -1095,7 +1095,7 @@ static int iomap_write_delalloc_scan(struct inode *inode, - } - - /* move offset to start of next folio in range */ -- start_byte = folio_next_index(folio) << PAGE_SHIFT; -+ start_byte = folio_pos(folio) + folio_size(folio); - folio_unlock(folio); - folio_put(folio); - } -diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c -index 6f2bcbfde45e69..0ff07d53931f2f 100644 ---- a/fs/nfsd/filecache.c -+++ b/fs/nfsd/filecache.c -@@ -219,6 +219,7 @@ nfsd_file_alloc(struct net *net, struct inode *inode, unsigned char need, - return NULL; - - INIT_LIST_HEAD(&nf->nf_lru); -+ INIT_LIST_HEAD(&nf->nf_gc); - nf->nf_birthtime = ktime_get(); - nf->nf_file = NULL; - nf->nf_cred = get_current_cred(); -@@ -396,8 +397,8 @@ nfsd_file_dispose_list(struct list_head *dispose) - struct nfsd_file *nf; - - while (!list_empty(dispose)) { -- nf = list_first_entry(dispose, struct nfsd_file, nf_lru); -- list_del_init(&nf->nf_lru); -+ nf = list_first_entry(dispose, struct nfsd_file, nf_gc); -+ list_del_init(&nf->nf_gc); - nfsd_file_free(nf); - } - } -@@ -414,12 +415,12 @@ nfsd_file_dispose_list_delayed(struct list_head *dispose) - { - while(!list_empty(dispose)) { - struct nfsd_file *nf = list_first_entry(dispose, -- struct nfsd_file, nf_lru); -+ struct nfsd_file, nf_gc); - struct nfsd_net *nn = net_generic(nf->nf_net, nfsd_net_id); - struct nfsd_fcache_disposal *l = nn->fcache_disposal; - - spin_lock(&l->lock); -- list_move_tail(&nf->nf_lru, &l->freeme); -+ list_move_tail(&nf->nf_gc, &l->freeme); - spin_unlock(&l->lock); - queue_work(nfsd_filecache_wq, &l->work); - } -@@ -476,7 +477,8 @@ nfsd_file_lru_cb(struct list_head *item, struct list_lru_one *lru, - - /* Refcount went to zero. Unhash it and queue it to the dispose list */ - nfsd_file_unhash(nf); -- list_lru_isolate_move(lru, &nf->nf_lru, head); -+ list_lru_isolate(lru, &nf->nf_lru); -+ list_add(&nf->nf_gc, head); - this_cpu_inc(nfsd_file_evictions); - trace_nfsd_file_gc_disposed(nf); - return LRU_REMOVED; -@@ -555,7 +557,7 @@ nfsd_file_cond_queue(struct nfsd_file *nf, struct list_head *dispose) - - /* If refcount goes to 0, then put on the dispose list */ - if (refcount_sub_and_test(decrement, &nf->nf_ref)) { -- list_add(&nf->nf_lru, dispose); -+ list_add(&nf->nf_gc, dispose); - trace_nfsd_file_closing(nf); - } - } -@@ -631,8 +633,8 @@ nfsd_file_close_inode_sync(struct inode *inode) - - nfsd_file_queue_for_close(inode, &dispose); - while (!list_empty(&dispose)) { -- nf = list_first_entry(&dispose, struct nfsd_file, nf_lru); -- list_del_init(&nf->nf_lru); -+ nf = list_first_entry(&dispose, struct nfsd_file, nf_gc); -+ list_del_init(&nf->nf_gc); - nfsd_file_free(nf); - } - flush_delayed_fput(); -diff --git a/fs/nfsd/filecache.h b/fs/nfsd/filecache.h -index e54165a3224f0b..bf7a630f1a4561 100644 ---- a/fs/nfsd/filecache.h -+++ b/fs/nfsd/filecache.h -@@ -44,6 +44,7 @@ struct nfsd_file { - - struct nfsd_file_mark *nf_mark; - struct list_head nf_lru; -+ struct list_head nf_gc; - struct rcu_head nf_rcu; - ktime_t nf_birthtime; - }; -diff --git a/fs/notify/fdinfo.c b/fs/notify/fdinfo.c -index 5c430736ec12c4..26655572975d3d 100644 ---- a/fs/notify/fdinfo.c -+++ b/fs/notify/fdinfo.c -@@ -51,10 +51,8 @@ static void show_mark_fhandle(struct seq_file *m, struct inode *inode) - size = f.handle.handle_bytes >> 2; - - ret = exportfs_encode_fid(inode, (struct fid *)f.handle.f_handle, &size); -- if ((ret == FILEID_INVALID) || (ret < 0)) { -- WARN_ONCE(1, "Can't encode file handler for inotify: %d\n", ret); -+ if ((ret == FILEID_INVALID) || (ret < 0)) - return; -- } - - f.handle.handle_type = ret; - f.handle.handle_bytes = size * sizeof(u32); -diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c -index 70a768b623cf40..f7672472fa8279 100644 ---- a/fs/ocfs2/extent_map.c -+++ b/fs/ocfs2/extent_map.c -@@ -973,7 +973,13 @@ int ocfs2_read_virt_blocks(struct inode *inode, u64 v_block, int nr, - } - - while (done < nr) { -- down_read(&OCFS2_I(inode)->ip_alloc_sem); -+ if (!down_read_trylock(&OCFS2_I(inode)->ip_alloc_sem)) { -+ rc = -EAGAIN; -+ mlog(ML_ERROR, -+ "Inode #%llu ip_alloc_sem is temporarily unavailable\n", -+ (unsigned long long)OCFS2_I(inode)->ip_blkno); -+ break; -+ } - rc = ocfs2_extent_map_get_blocks(inode, v_block + done, - &p_block, &p_count, NULL); - up_read(&OCFS2_I(inode)->ip_alloc_sem); -diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c -index ada3fcc9c6d501..18e018cb181179 100644 ---- a/fs/overlayfs/copy_up.c -+++ b/fs/overlayfs/copy_up.c -@@ -371,13 +371,13 @@ int ovl_set_attr(struct ovl_fs *ofs, struct dentry *upperdentry, - return err; - } - --struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct dentry *real, -+struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct inode *realinode, - bool is_upper) - { - struct ovl_fh *fh; - int fh_type, dwords; - int buflen = MAX_HANDLE_SZ; -- uuid_t *uuid = &real->d_sb->s_uuid; -+ uuid_t *uuid = &realinode->i_sb->s_uuid; - int err; - - /* Make sure the real fid stays 32bit aligned */ -@@ -394,13 +394,13 @@ struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct dentry *real, - * the price or reconnecting the dentry. - */ - dwords = buflen >> 2; -- fh_type = exportfs_encode_fh(real, (void *)fh->fb.fid, &dwords, 0); -+ fh_type = exportfs_encode_inode_fh(realinode, (void *)fh->fb.fid, -+ &dwords, NULL, 0); - buflen = (dwords << 2); - - err = -EIO; -- if (WARN_ON(fh_type < 0) || -- WARN_ON(buflen > MAX_HANDLE_SZ) || -- WARN_ON(fh_type == FILEID_INVALID)) -+ if (fh_type < 0 || fh_type == FILEID_INVALID || -+ WARN_ON(buflen > MAX_HANDLE_SZ)) - goto out_err; - - fh->fb.version = OVL_FH_VERSION; -@@ -438,7 +438,7 @@ int ovl_set_origin(struct ovl_fs *ofs, struct dentry *lower, - * up and a pure upper inode. - */ - if (ovl_can_decode_fh(lower->d_sb)) { -- fh = ovl_encode_real_fh(ofs, lower, false); -+ fh = ovl_encode_real_fh(ofs, d_inode(lower), false); - if (IS_ERR(fh)) - return PTR_ERR(fh); - } -@@ -461,7 +461,7 @@ static int ovl_set_upper_fh(struct ovl_fs *ofs, struct dentry *upper, - const struct ovl_fh *fh; - int err; - -- fh = ovl_encode_real_fh(ofs, upper, true); -+ fh = ovl_encode_real_fh(ofs, d_inode(upper), true); - if (IS_ERR(fh)) - return PTR_ERR(fh); - -diff --git a/fs/overlayfs/export.c b/fs/overlayfs/export.c -index 611ff567a1aa6f..3a17e4366f28c0 100644 ---- a/fs/overlayfs/export.c -+++ b/fs/overlayfs/export.c -@@ -181,35 +181,37 @@ static int ovl_connect_layer(struct dentry *dentry) - * - * Return 0 for upper file handle, > 0 for lower file handle or < 0 on error. - */ --static int ovl_check_encode_origin(struct dentry *dentry) -+static int ovl_check_encode_origin(struct inode *inode) - { -- struct ovl_fs *ofs = OVL_FS(dentry->d_sb); -+ struct ovl_fs *ofs = OVL_FS(inode->i_sb); - bool decodable = ofs->config.nfs_export; -+ struct dentry *dentry; -+ int err; - - /* No upper layer? */ - if (!ovl_upper_mnt(ofs)) - return 1; - - /* Lower file handle for non-upper non-decodable */ -- if (!ovl_dentry_upper(dentry) && !decodable) -+ if (!ovl_inode_upper(inode) && !decodable) - return 1; - - /* Upper file handle for pure upper */ -- if (!ovl_dentry_lower(dentry)) -+ if (!ovl_inode_lower(inode)) - return 0; - - /* - * Root is never indexed, so if there's an upper layer, encode upper for - * root. - */ -- if (dentry == dentry->d_sb->s_root) -+ if (inode == d_inode(inode->i_sb->s_root)) - return 0; - - /* - * Upper decodable file handle for non-indexed upper. - */ -- if (ovl_dentry_upper(dentry) && decodable && -- !ovl_test_flag(OVL_INDEX, d_inode(dentry))) -+ if (ovl_inode_upper(inode) && decodable && -+ !ovl_test_flag(OVL_INDEX, inode)) - return 0; - - /* -@@ -218,14 +220,23 @@ static int ovl_check_encode_origin(struct dentry *dentry) - * ovl_connect_layer() will try to make origin's layer "connected" by - * copying up a "connectable" ancestor. - */ -- if (d_is_dir(dentry) && decodable) -- return ovl_connect_layer(dentry); -+ if (!decodable || !S_ISDIR(inode->i_mode)) -+ return 1; -+ -+ dentry = d_find_any_alias(inode); -+ if (!dentry) -+ return -ENOENT; -+ -+ err = ovl_connect_layer(dentry); -+ dput(dentry); -+ if (err < 0) -+ return err; - - /* Lower file handle for indexed and non-upper dir/non-dir */ - return 1; - } - --static int ovl_dentry_to_fid(struct ovl_fs *ofs, struct dentry *dentry, -+static int ovl_dentry_to_fid(struct ovl_fs *ofs, struct inode *inode, - u32 *fid, int buflen) - { - struct ovl_fh *fh = NULL; -@@ -236,13 +247,13 @@ static int ovl_dentry_to_fid(struct ovl_fs *ofs, struct dentry *dentry, - * Check if we should encode a lower or upper file handle and maybe - * copy up an ancestor to make lower file handle connectable. - */ -- err = enc_lower = ovl_check_encode_origin(dentry); -+ err = enc_lower = ovl_check_encode_origin(inode); - if (enc_lower < 0) - goto fail; - - /* Encode an upper or lower file handle */ -- fh = ovl_encode_real_fh(ofs, enc_lower ? ovl_dentry_lower(dentry) : -- ovl_dentry_upper(dentry), !enc_lower); -+ fh = ovl_encode_real_fh(ofs, enc_lower ? ovl_inode_lower(inode) : -+ ovl_inode_upper(inode), !enc_lower); - if (IS_ERR(fh)) - return PTR_ERR(fh); - -@@ -256,8 +267,8 @@ static int ovl_dentry_to_fid(struct ovl_fs *ofs, struct dentry *dentry, - return err; - - fail: -- pr_warn_ratelimited("failed to encode file handle (%pd2, err=%i)\n", -- dentry, err); -+ pr_warn_ratelimited("failed to encode file handle (ino=%lu, err=%i)\n", -+ inode->i_ino, err); - goto out; - } - -@@ -265,19 +276,13 @@ static int ovl_encode_fh(struct inode *inode, u32 *fid, int *max_len, - struct inode *parent) - { - struct ovl_fs *ofs = OVL_FS(inode->i_sb); -- struct dentry *dentry; - int bytes, buflen = *max_len << 2; - - /* TODO: encode connectable file handles */ - if (parent) - return FILEID_INVALID; - -- dentry = d_find_any_alias(inode); -- if (!dentry) -- return FILEID_INVALID; -- -- bytes = ovl_dentry_to_fid(ofs, dentry, fid, buflen); -- dput(dentry); -+ bytes = ovl_dentry_to_fid(ofs, inode, fid, buflen); - if (bytes <= 0) - return FILEID_INVALID; - -diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c -index 80391c687c2ad8..273a39d3e95133 100644 ---- a/fs/overlayfs/namei.c -+++ b/fs/overlayfs/namei.c -@@ -523,7 +523,7 @@ int ovl_verify_set_fh(struct ovl_fs *ofs, struct dentry *dentry, - struct ovl_fh *fh; - int err; - -- fh = ovl_encode_real_fh(ofs, real, is_upper); -+ fh = ovl_encode_real_fh(ofs, d_inode(real), is_upper); - err = PTR_ERR(fh); - if (IS_ERR(fh)) { - fh = NULL; -@@ -720,7 +720,7 @@ int ovl_get_index_name(struct ovl_fs *ofs, struct dentry *origin, - struct ovl_fh *fh; - int err; - -- fh = ovl_encode_real_fh(ofs, origin, false); -+ fh = ovl_encode_real_fh(ofs, d_inode(origin), false); - if (IS_ERR(fh)) - return PTR_ERR(fh); - -diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h -index 09ca82ed0f8ced..981967e507b3e1 100644 ---- a/fs/overlayfs/overlayfs.h -+++ b/fs/overlayfs/overlayfs.h -@@ -821,7 +821,7 @@ int ovl_copy_up_with_data(struct dentry *dentry); - int ovl_maybe_copy_up(struct dentry *dentry, int flags); - int ovl_copy_xattr(struct super_block *sb, const struct path *path, struct dentry *new); - int ovl_set_attr(struct ovl_fs *ofs, struct dentry *upper, struct kstat *stat); --struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct dentry *real, -+struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct inode *realinode, - bool is_upper); - int ovl_set_origin(struct ovl_fs *ofs, struct dentry *lower, - struct dentry *upper); -diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c -index 8319bcbe3ee36b..3303cb04e12c36 100644 ---- a/fs/proc/vmcore.c -+++ b/fs/proc/vmcore.c -@@ -404,6 +404,8 @@ static ssize_t __read_vmcore(struct iov_iter *iter, loff_t *fpos) - if (!iov_iter_count(iter)) - return acc; - } -+ -+ cond_resched(); - } - - return acc; -diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c -index 20f303f2a5d75a..dbcaaa274abdbf 100644 ---- a/fs/smb/client/connect.c -+++ b/fs/smb/client/connect.c -@@ -1061,6 +1061,7 @@ clean_demultiplex_info(struct TCP_Server_Info *server) - /* Release netns reference for this server. */ - put_net(cifs_net_ns(server)); - kfree(server->leaf_fullpath); -+ kfree(server->hostname); - kfree(server); - - length = atomic_dec_return(&tcpSesAllocCount); -@@ -1684,8 +1685,6 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect) - kfree_sensitive(server->session_key.response); - server->session_key.response = NULL; - server->session_key.len = 0; -- kfree(server->hostname); -- server->hostname = NULL; - - task = xchg(&server->tsk, NULL); - if (task) -diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h -index 254d4a898179c0..8f77bb0f4ae0ca 100644 ---- a/include/linux/hrtimer.h -+++ b/include/linux/hrtimer.h -@@ -532,6 +532,7 @@ extern void __init hrtimers_init(void); - extern void sysrq_timer_list_show(void); - - int hrtimers_prepare_cpu(unsigned int cpu); -+int hrtimers_cpu_starting(unsigned int cpu); - #ifdef CONFIG_HOTPLUG_CPU - int hrtimers_cpu_dying(unsigned int cpu); - #else -diff --git a/include/linux/poll.h b/include/linux/poll.h -index d1ea4f3714a848..fc641b50f1298e 100644 ---- a/include/linux/poll.h -+++ b/include/linux/poll.h -@@ -41,8 +41,16 @@ typedef struct poll_table_struct { - - static inline void poll_wait(struct file * filp, wait_queue_head_t * wait_address, poll_table *p) - { -- if (p && p->_qproc && wait_address) -+ if (p && p->_qproc && wait_address) { - p->_qproc(filp, wait_address, p); -+ /* -+ * This memory barrier is paired in the wq_has_sleeper(). -+ * See the comment above prepare_to_wait(), we need to -+ * ensure that subsequent tests in this thread can't be -+ * reordered with __add_wait_queue() in _qproc() paths. -+ */ -+ smp_mb(); -+ } - } - - /* -diff --git a/include/linux/pruss_driver.h b/include/linux/pruss_driver.h -index c9a31c567e85bf..2e18fef1a2e109 100644 ---- a/include/linux/pruss_driver.h -+++ b/include/linux/pruss_driver.h -@@ -144,32 +144,32 @@ static inline int pruss_release_mem_region(struct pruss *pruss, - static inline int pruss_cfg_get_gpmux(struct pruss *pruss, - enum pruss_pru_id pru_id, u8 *mux) - { -- return ERR_PTR(-EOPNOTSUPP); -+ return -EOPNOTSUPP; - } - - static inline int pruss_cfg_set_gpmux(struct pruss *pruss, - enum pruss_pru_id pru_id, u8 mux) - { -- return ERR_PTR(-EOPNOTSUPP); -+ return -EOPNOTSUPP; - } - - static inline int pruss_cfg_gpimode(struct pruss *pruss, - enum pruss_pru_id pru_id, - enum pruss_gpi_mode mode) - { -- return ERR_PTR(-EOPNOTSUPP); -+ return -EOPNOTSUPP; - } - - static inline int pruss_cfg_miirt_enable(struct pruss *pruss, bool enable) - { -- return ERR_PTR(-EOPNOTSUPP); -+ return -EOPNOTSUPP; - } - - static inline int pruss_cfg_xfr_enable(struct pruss *pruss, - enum pru_type pru_type, -- bool enable); -+ bool enable) - { -- return ERR_PTR(-EOPNOTSUPP); -+ return -EOPNOTSUPP; - } - - #endif /* CONFIG_TI_PRUSS */ -diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h -index 958c805df1915b..1befad79a67349 100644 ---- a/include/net/net_namespace.h -+++ b/include/net/net_namespace.h -@@ -442,6 +442,9 @@ struct pernet_operations { - void (*pre_exit)(struct net *net); - void (*exit)(struct net *net); - void (*exit_batch)(struct list_head *net_exit_list); -+ /* Following method is called with RTNL held. */ -+ void (*exit_batch_rtnl)(struct list_head *net_exit_list, -+ struct list_head *dev_kill_list); - unsigned int *id; - size_t size; - }; -diff --git a/kernel/cpu.c b/kernel/cpu.c -index 0c72b94ed076a3..7ab11b45976842 100644 ---- a/kernel/cpu.c -+++ b/kernel/cpu.c -@@ -2206,7 +2206,7 @@ static struct cpuhp_step cpuhp_hp_states[] = { - }, - [CPUHP_AP_HRTIMERS_DYING] = { - .name = "hrtimers:dying", -- .startup.single = NULL, -+ .startup.single = hrtimers_cpu_starting, - .teardown.single = hrtimers_cpu_dying, - }, - -diff --git a/kernel/gen_kheaders.sh b/kernel/gen_kheaders.sh -index 383fd43ac61222..7e1340da5acae6 100755 ---- a/kernel/gen_kheaders.sh -+++ b/kernel/gen_kheaders.sh -@@ -89,6 +89,7 @@ find $cpio_dir -type f -print0 | - - # Create archive and try to normalize metadata for reproducibility. - tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \ -+ --exclude=".__afs*" --exclude=".nfs*" \ - --owner=0 --group=0 --sort=name --numeric-owner --mode=u=rw,go=r,a+X \ - -I $XZ -cf $tarfile -C $cpio_dir/ . > /dev/null - -diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c -index 57e5cb36f1bc93..e99b1305e1a5f4 100644 ---- a/kernel/time/hrtimer.c -+++ b/kernel/time/hrtimer.c -@@ -2180,6 +2180,15 @@ int hrtimers_prepare_cpu(unsigned int cpu) - } - - cpu_base->cpu = cpu; -+ hrtimer_cpu_base_init_expiry_lock(cpu_base); -+ return 0; -+} -+ -+int hrtimers_cpu_starting(unsigned int cpu) -+{ -+ struct hrtimer_cpu_base *cpu_base = this_cpu_ptr(&hrtimer_bases); -+ -+ /* Clear out any left over state from a CPU down operation */ - cpu_base->active_bases = 0; - cpu_base->hres_active = 0; - cpu_base->hang_detected = 0; -@@ -2188,7 +2197,6 @@ int hrtimers_prepare_cpu(unsigned int cpu) - cpu_base->expires_next = KTIME_MAX; - cpu_base->softirq_expires_next = KTIME_MAX; - cpu_base->online = 1; -- hrtimer_cpu_base_init_expiry_lock(cpu_base); - return 0; - } - -@@ -2266,6 +2274,7 @@ int hrtimers_cpu_dying(unsigned int dying_cpu) - void __init hrtimers_init(void) - { - hrtimers_prepare_cpu(smp_processor_id()); -+ hrtimers_cpu_starting(smp_processor_id()); - open_softirq(HRTIMER_SOFTIRQ, hrtimer_run_softirq); - } - -diff --git a/mm/filemap.c b/mm/filemap.c -index 2c308413387ffb..6a3d62de1cca7b 100644 ---- a/mm/filemap.c -+++ b/mm/filemap.c -@@ -3037,7 +3037,7 @@ static inline loff_t folio_seek_hole_data(struct xa_state *xas, - if (ops->is_partially_uptodate(folio, offset, bsz) == - seek_data) - break; -- start = (start + bsz) & ~(bsz - 1); -+ start = (start + bsz) & ~((u64)bsz - 1); - offset += bsz; - } while (offset < folio_size(folio)); - unlock: -diff --git a/net/core/filter.c b/net/core/filter.c -index 34320ce70096ac..5881944f1681c9 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -11190,6 +11190,7 @@ BPF_CALL_4(sk_select_reuseport, struct sk_reuseport_kern *, reuse_kern, - bool is_sockarray = map->map_type == BPF_MAP_TYPE_REUSEPORT_SOCKARRAY; - struct sock_reuseport *reuse; - struct sock *selected_sk; -+ int err; - - selected_sk = map->ops->map_lookup_elem(map, key); - if (!selected_sk) -@@ -11197,10 +11198,6 @@ BPF_CALL_4(sk_select_reuseport, struct sk_reuseport_kern *, reuse_kern, - - reuse = rcu_dereference(selected_sk->sk_reuseport_cb); - if (!reuse) { -- /* Lookup in sock_map can return TCP ESTABLISHED sockets. */ -- if (sk_is_refcounted(selected_sk)) -- sock_put(selected_sk); -- - /* reuseport_array has only sk with non NULL sk_reuseport_cb. - * The only (!reuse) case here is - the sk has already been - * unhashed (e.g. by close()), so treat it as -ENOENT. -@@ -11208,24 +11205,33 @@ BPF_CALL_4(sk_select_reuseport, struct sk_reuseport_kern *, reuse_kern, - * Other maps (e.g. sock_map) do not provide this guarantee and - * the sk may never be in the reuseport group to begin with. - */ -- return is_sockarray ? -ENOENT : -EINVAL; -+ err = is_sockarray ? -ENOENT : -EINVAL; -+ goto error; - } - - if (unlikely(reuse->reuseport_id != reuse_kern->reuseport_id)) { - struct sock *sk = reuse_kern->sk; - -- if (sk->sk_protocol != selected_sk->sk_protocol) -- return -EPROTOTYPE; -- else if (sk->sk_family != selected_sk->sk_family) -- return -EAFNOSUPPORT; -- -- /* Catch all. Likely bound to a different sockaddr. */ -- return -EBADFD; -+ if (sk->sk_protocol != selected_sk->sk_protocol) { -+ err = -EPROTOTYPE; -+ } else if (sk->sk_family != selected_sk->sk_family) { -+ err = -EAFNOSUPPORT; -+ } else { -+ /* Catch all. Likely bound to a different sockaddr. */ -+ err = -EBADFD; -+ } -+ goto error; - } - - reuse_kern->selected_sk = selected_sk; - - return 0; -+error: -+ /* Lookup in sock_map can return TCP ESTABLISHED sockets. */ -+ if (sk_is_refcounted(selected_sk)) -+ sock_put(selected_sk); -+ -+ return err; - } - - static const struct bpf_func_proto sk_select_reuseport_proto = { -diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c -index 92b7fea4d495cf..70ac9d9bc87708 100644 ---- a/net/core/net_namespace.c -+++ b/net/core/net_namespace.c -@@ -321,8 +321,9 @@ static __net_init int setup_net(struct net *net, struct user_namespace *user_ns) - { - /* Must be called with pernet_ops_rwsem held */ - const struct pernet_operations *ops, *saved_ops; -- int error = 0; - LIST_HEAD(net_exit_list); -+ LIST_HEAD(dev_kill_list); -+ int error = 0; - - refcount_set(&net->ns.count, 1); - ref_tracker_dir_init(&net->refcnt_tracker, 128, "net refcnt"); -@@ -360,6 +361,15 @@ static __net_init int setup_net(struct net *net, struct user_namespace *user_ns) - - synchronize_rcu(); - -+ ops = saved_ops; -+ rtnl_lock(); -+ list_for_each_entry_continue_reverse(ops, &pernet_list, list) { -+ if (ops->exit_batch_rtnl) -+ ops->exit_batch_rtnl(&net_exit_list, &dev_kill_list); -+ } -+ unregister_netdevice_many(&dev_kill_list); -+ rtnl_unlock(); -+ - ops = saved_ops; - list_for_each_entry_continue_reverse(ops, &pernet_list, list) - ops_exit_list(ops, &net_exit_list); -@@ -588,6 +598,7 @@ static void cleanup_net(struct work_struct *work) - struct net *net, *tmp, *last; - struct llist_node *net_kill_list; - LIST_HEAD(net_exit_list); -+ LIST_HEAD(dev_kill_list); - - /* Atomically snapshot the list of namespaces to cleanup */ - net_kill_list = llist_del_all(&cleanup_list); -@@ -628,6 +639,14 @@ static void cleanup_net(struct work_struct *work) - */ - synchronize_rcu(); - -+ rtnl_lock(); -+ list_for_each_entry_reverse(ops, &pernet_list, list) { -+ if (ops->exit_batch_rtnl) -+ ops->exit_batch_rtnl(&net_exit_list, &dev_kill_list); -+ } -+ unregister_netdevice_many(&dev_kill_list); -+ rtnl_unlock(); -+ - /* Run all of the network namespace exit methods */ - list_for_each_entry_reverse(ops, &pernet_list, list) - ops_exit_list(ops, &net_exit_list); -@@ -1170,7 +1189,17 @@ static void free_exit_list(struct pernet_operations *ops, struct list_head *net_ - { - ops_pre_exit_list(ops, net_exit_list); - synchronize_rcu(); -+ -+ if (ops->exit_batch_rtnl) { -+ LIST_HEAD(dev_kill_list); -+ -+ rtnl_lock(); -+ ops->exit_batch_rtnl(net_exit_list, &dev_kill_list); -+ unregister_netdevice_many(&dev_kill_list); -+ rtnl_unlock(); -+ } - ops_exit_list(ops, net_exit_list); -+ - ops_free_list(ops, net_exit_list); - } - -diff --git a/net/core/pktgen.c b/net/core/pktgen.c -index 0e472f6fab8538..359e24c3f22cab 100644 ---- a/net/core/pktgen.c -+++ b/net/core/pktgen.c -@@ -850,6 +850,9 @@ static ssize_t get_imix_entries(const char __user *buffer, - unsigned long weight; - unsigned long size; - -+ if (pkt_dev->n_imix_entries >= MAX_IMIX_ENTRIES) -+ return -E2BIG; -+ - len = num_arg(&buffer[i], max_digits, &size); - if (len < 0) - return len; -@@ -879,9 +882,6 @@ static ssize_t get_imix_entries(const char __user *buffer, - - i++; - pkt_dev->n_imix_entries++; -- -- if (pkt_dev->n_imix_entries > MAX_IMIX_ENTRIES) -- return -E2BIG; - } while (c == ' '); - - return i; -diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c -index d25e962b18a53e..2839ca8053ba6d 100644 ---- a/net/dccp/ipv6.c -+++ b/net/dccp/ipv6.c -@@ -616,7 +616,7 @@ static int dccp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) - by tcp. Feel free to propose better solution. - --ANK (980728) - */ -- if (np->rxopt.all) -+ if (np->rxopt.all && sk->sk_state != DCCP_LISTEN) - opt_skb = skb_clone_and_charge_r(skb, sk); - - if (sk->sk_state == DCCP_OPEN) { /* Fast path */ -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index 64bdb6d978eed4..f285e52b8b8579 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -1456,7 +1456,7 @@ int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) - by tcp. Feel free to propose better solution. - --ANK (980728) - */ -- if (np->rxopt.all) -+ if (np->rxopt.all && sk->sk_state != TCP_LISTEN) - opt_skb = skb_clone_and_charge_r(skb, sk); - - reason = SKB_DROP_REASON_NOT_SPECIFIED; -@@ -1495,8 +1495,6 @@ int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) - if (nsk != sk) { - if (tcp_child_process(sk, nsk, skb)) - goto reset; -- if (opt_skb) -- __kfree_skb(opt_skb); - return 0; - } - } else -diff --git a/net/mac802154/iface.c b/net/mac802154/iface.c -index c0e2da5072bea2..9e4631fade90c9 100644 ---- a/net/mac802154/iface.c -+++ b/net/mac802154/iface.c -@@ -684,6 +684,10 @@ void ieee802154_if_remove(struct ieee802154_sub_if_data *sdata) - ASSERT_RTNL(); - - mutex_lock(&sdata->local->iflist_mtx); -+ if (list_empty(&sdata->local->interfaces)) { -+ mutex_unlock(&sdata->local->iflist_mtx); -+ return; -+ } - list_del_rcu(&sdata->list); - mutex_unlock(&sdata->local->iflist_mtx); - -diff --git a/net/mptcp/options.c b/net/mptcp/options.c -index 2e1539027e6d33..8e6a6dc6e0a409 100644 ---- a/net/mptcp/options.c -+++ b/net/mptcp/options.c -@@ -607,7 +607,6 @@ static bool mptcp_established_options_dss(struct sock *sk, struct sk_buff *skb, - } - opts->ext_copy.use_ack = 1; - opts->suboptions = OPTION_MPTCP_DSS; -- WRITE_ONCE(msk->old_wspace, __mptcp_space((struct sock *)msk)); - - /* Add kind/length/subtype/flag overhead if mapping is not populated */ - if (dss_size == 0) -@@ -1287,7 +1286,7 @@ static void mptcp_set_rwin(struct tcp_sock *tp, struct tcphdr *th) - } - MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_RCVWNDCONFLICT); - } -- return; -+ goto update_wspace; - } - - if (rcv_wnd_new != rcv_wnd_old) { -@@ -1312,6 +1311,9 @@ static void mptcp_set_rwin(struct tcp_sock *tp, struct tcphdr *th) - th->window = htons(new_win); - MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_RCVWNDSHARED); - } -+ -+update_wspace: -+ WRITE_ONCE(msk->old_wspace, tp->rcv_wnd); - } - - __sum16 __mptcp_make_csum(u64 data_seq, u32 subflow_seq, u16 data_len, __wsum sum) -diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h -index 89d1c299ff2b9f..88c762de772875 100644 ---- a/net/mptcp/protocol.h -+++ b/net/mptcp/protocol.h -@@ -685,10 +685,15 @@ static inline u64 mptcp_data_avail(const struct mptcp_sock *msk) - - static inline bool mptcp_epollin_ready(const struct sock *sk) - { -+ u64 data_avail = mptcp_data_avail(mptcp_sk(sk)); -+ -+ if (!data_avail) -+ return false; -+ - /* mptcp doesn't have to deal with small skbs in the receive queue, -- * at it can always coalesce them -+ * as it can always coalesce them - */ -- return (mptcp_data_avail(mptcp_sk(sk)) >= sk->sk_rcvlowat) || -+ return (data_avail >= sk->sk_rcvlowat) || - (mem_cgroup_sockets_enabled && sk->sk_memcg && - mem_cgroup_under_socket_pressure(sk->sk_memcg)) || - READ_ONCE(tcp_memory_pressure); -diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c -index 4f5cbcaa38386f..9445ca97163b40 100644 ---- a/net/openvswitch/actions.c -+++ b/net/openvswitch/actions.c -@@ -918,7 +918,9 @@ static void do_output(struct datapath *dp, struct sk_buff *skb, int out_port, - { - struct vport *vport = ovs_vport_rcu(dp, out_port); - -- if (likely(vport && netif_carrier_ok(vport->dev))) { -+ if (likely(vport && -+ netif_running(vport->dev) && -+ netif_carrier_ok(vport->dev))) { - u16 mru = OVS_CB(skb)->mru; - u32 cutlen = OVS_CB(skb)->cutlen; - -diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c -index 6e1cd71d33a599..2050d888df2ae1 100644 ---- a/net/vmw_vsock/af_vsock.c -+++ b/net/vmw_vsock/af_vsock.c -@@ -490,6 +490,15 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk) - */ - vsk->transport->release(vsk); - vsock_deassign_transport(vsk); -+ -+ /* transport's release() and destruct() can touch some socket -+ * state, since we are reassigning the socket to a new transport -+ * during vsock_connect(), let's reset these fields to have a -+ * clean state. -+ */ -+ sock_reset_flag(sk, SOCK_DONE); -+ sk->sk_state = TCP_CLOSE; -+ vsk->peer_shutdown = 0; - } - - /* We increase the module refcnt to prevent the transport unloading -@@ -866,6 +875,9 @@ EXPORT_SYMBOL_GPL(vsock_create_connected); - - s64 vsock_stream_has_data(struct vsock_sock *vsk) - { -+ if (WARN_ON(!vsk->transport)) -+ return 0; -+ - return vsk->transport->stream_has_data(vsk); - } - EXPORT_SYMBOL_GPL(vsock_stream_has_data); -@@ -874,6 +886,9 @@ s64 vsock_connectible_has_data(struct vsock_sock *vsk) - { - struct sock *sk = sk_vsock(vsk); - -+ if (WARN_ON(!vsk->transport)) -+ return 0; -+ - if (sk->sk_type == SOCK_SEQPACKET) - return vsk->transport->seqpacket_has_data(vsk); - else -@@ -883,6 +898,9 @@ EXPORT_SYMBOL_GPL(vsock_connectible_has_data); - - s64 vsock_stream_has_space(struct vsock_sock *vsk) - { -+ if (WARN_ON(!vsk->transport)) -+ return 0; -+ - return vsk->transport->stream_has_space(vsk); - } - EXPORT_SYMBOL_GPL(vsock_stream_has_space); -diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c -index 43495820b64fb1..c57fe7ddcf73bf 100644 ---- a/net/vmw_vsock/virtio_transport_common.c -+++ b/net/vmw_vsock/virtio_transport_common.c -@@ -26,6 +26,9 @@ - /* Threshold for detecting small packets to copy */ - #define GOOD_COPY_LEN 128 - -+static void virtio_transport_cancel_close_work(struct vsock_sock *vsk, -+ bool cancel_timeout); -+ - static const struct virtio_transport * - virtio_transport_get_ops(struct vsock_sock *vsk) - { -@@ -922,6 +925,8 @@ void virtio_transport_destruct(struct vsock_sock *vsk) - { - struct virtio_vsock_sock *vvs = vsk->trans; - -+ virtio_transport_cancel_close_work(vsk, true); -+ - kfree(vvs); - vsk->trans = NULL; - } -@@ -1004,17 +1009,11 @@ static void virtio_transport_wait_close(struct sock *sk, long timeout) - } - } - --static void virtio_transport_do_close(struct vsock_sock *vsk, -- bool cancel_timeout) -+static void virtio_transport_cancel_close_work(struct vsock_sock *vsk, -+ bool cancel_timeout) - { - struct sock *sk = sk_vsock(vsk); - -- sock_set_flag(sk, SOCK_DONE); -- vsk->peer_shutdown = SHUTDOWN_MASK; -- if (vsock_stream_has_data(vsk) <= 0) -- sk->sk_state = TCP_CLOSING; -- sk->sk_state_change(sk); -- - if (vsk->close_work_scheduled && - (!cancel_timeout || cancel_delayed_work(&vsk->close_work))) { - vsk->close_work_scheduled = false; -@@ -1026,6 +1025,20 @@ static void virtio_transport_do_close(struct vsock_sock *vsk, - } - } - -+static void virtio_transport_do_close(struct vsock_sock *vsk, -+ bool cancel_timeout) -+{ -+ struct sock *sk = sk_vsock(vsk); -+ -+ sock_set_flag(sk, SOCK_DONE); -+ vsk->peer_shutdown = SHUTDOWN_MASK; -+ if (vsock_stream_has_data(vsk) <= 0) -+ sk->sk_state = TCP_CLOSING; -+ sk->sk_state_change(sk); -+ -+ virtio_transport_cancel_close_work(vsk, cancel_timeout); -+} -+ - static void virtio_transport_close_timeout(struct work_struct *work) - { - struct vsock_sock *vsk = -@@ -1428,8 +1441,11 @@ void virtio_transport_recv_pkt(struct virtio_transport *t, - - lock_sock(sk); - -- /* Check if sk has been closed before lock_sock */ -- if (sock_flag(sk, SOCK_DONE)) { -+ /* Check if sk has been closed or assigned to another transport before -+ * lock_sock (note: listener sockets are not assigned to any transport) -+ */ -+ if (sock_flag(sk, SOCK_DONE) || -+ (sk->sk_state != TCP_LISTEN && vsk->transport != &t->transport)) { - (void)virtio_transport_reset_no_sock(t, skb); - release_sock(sk); - sock_put(sk); -diff --git a/net/vmw_vsock/vsock_bpf.c b/net/vmw_vsock/vsock_bpf.c -index 4aa6e74ec2957b..f201d9eca1df2f 100644 ---- a/net/vmw_vsock/vsock_bpf.c -+++ b/net/vmw_vsock/vsock_bpf.c -@@ -77,6 +77,7 @@ static int vsock_bpf_recvmsg(struct sock *sk, struct msghdr *msg, - size_t len, int flags, int *addr_len) - { - struct sk_psock *psock; -+ struct vsock_sock *vsk; - int copied; - - psock = sk_psock_get(sk); -@@ -84,6 +85,13 @@ static int vsock_bpf_recvmsg(struct sock *sk, struct msghdr *msg, - return __vsock_recvmsg(sk, msg, len, flags); - - lock_sock(sk); -+ vsk = vsock_sk(sk); -+ -+ if (!vsk->transport) { -+ copied = -ENODEV; -+ goto out; -+ } -+ - if (vsock_has_data(sk, psock) && sk_psock_queue_empty(psock)) { - release_sock(sk); - sk_psock_put(sk, psock); -@@ -108,6 +116,7 @@ static int vsock_bpf_recvmsg(struct sock *sk, struct msghdr *msg, - copied = sk_msg_recvmsg(sk, psock, msg, len, flags); - } - -+out: - release_sock(sk); - sk_psock_put(sk, psock); - -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index fc93af80f0bffe..739f8fd1792bd5 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -10430,6 +10430,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1d72, 0x1901, "RedmiBook 14", ALC256_FIXUP_ASUS_HEADSET_MIC), - SND_PCI_QUIRK(0x1d72, 0x1945, "Redmi G", ALC256_FIXUP_ASUS_HEADSET_MIC), - SND_PCI_QUIRK(0x1d72, 0x1947, "RedmiBook Air", ALC255_FIXUP_XIAOMI_HEADSET_MIC), -+ SND_PCI_QUIRK(0x1f66, 0x0105, "Ayaneo Portable Game Player", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x2782, 0x0214, "VAIO VJFE-CL", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), - SND_PCI_QUIRK(0x2782, 0x0228, "Infinix ZERO BOOK 13", ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13), - SND_PCI_QUIRK(0x2782, 0x0232, "CHUWI CoreBook XPro", ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO), -diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.c b/tools/testing/selftests/net/mptcp/mptcp_connect.c -index 4209b95690394b..414addef9a4514 100644 ---- a/tools/testing/selftests/net/mptcp/mptcp_connect.c -+++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c -@@ -25,6 +25,8 @@ - #include - #include - -+#include -+ - #include - #include - -@@ -1211,23 +1213,42 @@ static void parse_setsock_options(const char *name) - exit(1); - } - --void xdisconnect(int fd, int addrlen) -+void xdisconnect(int fd) - { -- struct sockaddr_storage empty; -+ socklen_t addrlen = sizeof(struct sockaddr_storage); -+ struct sockaddr_storage addr, empty; - int msec_sleep = 10; -- int queued = 1; -- int i; -+ void *raw_addr; -+ int i, cmdlen; -+ char cmd[128]; -+ -+ /* get the local address and convert it to string */ -+ if (getsockname(fd, (struct sockaddr *)&addr, &addrlen) < 0) -+ xerror("getsockname"); -+ -+ if (addr.ss_family == AF_INET) -+ raw_addr = &(((struct sockaddr_in *)&addr)->sin_addr); -+ else if (addr.ss_family == AF_INET6) -+ raw_addr = &(((struct sockaddr_in6 *)&addr)->sin6_addr); -+ else -+ xerror("bad family"); -+ -+ strcpy(cmd, "ss -M | grep -q "); -+ cmdlen = strlen(cmd); -+ if (!inet_ntop(addr.ss_family, raw_addr, &cmd[cmdlen], -+ sizeof(cmd) - cmdlen)) -+ xerror("inet_ntop"); - - shutdown(fd, SHUT_WR); - -- /* while until the pending data is completely flushed, the later -+ /* -+ * wait until the pending data is completely flushed and all -+ * the MPTCP sockets reached the closed status. - * disconnect will bypass/ignore/drop any pending data. - */ - for (i = 0; ; i += msec_sleep) { -- if (ioctl(fd, SIOCOUTQ, &queued) < 0) -- xerror("can't query out socket queue: %d", errno); -- -- if (!queued) -+ /* closed socket are not listed by 'ss' */ -+ if (system(cmd) != 0) - break; - - if (i > poll_timeout) -@@ -1281,9 +1302,9 @@ int main_loop(void) - return ret; - - if (cfg_truncate > 0) { -- xdisconnect(fd, peer->ai_addrlen); -+ xdisconnect(fd); - } else if (--cfg_repeat > 0) { -- xdisconnect(fd, peer->ai_addrlen); -+ xdisconnect(fd); - - /* the socket could be unblocking at this point, we need the - * connect to be blocking -diff --git a/tools/testing/selftests/tc-testing/tc-tests/filters/flow.json b/tools/testing/selftests/tc-testing/tc-tests/filters/flow.json -index 58189327f6444a..383fbda07245c8 100644 ---- a/tools/testing/selftests/tc-testing/tc-tests/filters/flow.json -+++ b/tools/testing/selftests/tc-testing/tc-tests/filters/flow.json -@@ -78,10 +78,10 @@ - "setup": [ - "$TC qdisc add dev $DEV1 ingress" - ], -- "cmdUnderTest": "$TC filter add dev $DEV1 parent ffff: handle 1 prio 1 protocol ip flow map key dst rshift 0xff", -+ "cmdUnderTest": "$TC filter add dev $DEV1 parent ffff: handle 1 prio 1 protocol ip flow map key dst rshift 0x1f", - "expExitCode": "0", - "verifyCmd": "$TC filter get dev $DEV1 parent ffff: handle 1 protocol ip prio 1 flow", -- "matchPattern": "filter parent ffff: protocol ip pref 1 flow chain [0-9]+ handle 0x1 map keys dst rshift 255 baseclass", -+ "matchPattern": "filter parent ffff: protocol ip pref 1 flow chain [0-9]+ handle 0x1 map keys dst rshift 31 baseclass", - "matchCount": "1", - "teardown": [ - "$TC qdisc del dev $DEV1 ingress" diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.074-075.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.074-075.patch deleted file mode 100644 index 38dace8c9f..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.074-075.patch +++ /dev/null @@ -1,1630 +0,0 @@ -diff --git a/Makefile b/Makefile -index b8e5c65910862e..b8041104f248d3 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 74 -+SUBLEVEL = 75 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/block/ioctl.c b/block/ioctl.c -index 3786033342848d..231537f79a8cb4 100644 ---- a/block/ioctl.c -+++ b/block/ioctl.c -@@ -115,7 +115,7 @@ static int blk_ioctl_discard(struct block_device *bdev, blk_mode_t mode, - return -EINVAL; - - filemap_invalidate_lock(inode->i_mapping); -- err = truncate_bdev_range(bdev, mode, start, start + len - 1); -+ err = truncate_bdev_range(bdev, mode, start, end - 1); - if (err) - goto fail; - err = blkdev_issue_discard(bdev, start >> 9, len >> 9, GFP_KERNEL); -@@ -127,7 +127,7 @@ static int blk_ioctl_discard(struct block_device *bdev, blk_mode_t mode, - static int blk_ioctl_secure_erase(struct block_device *bdev, blk_mode_t mode, - void __user *argp) - { -- uint64_t start, len; -+ uint64_t start, len, end; - uint64_t range[2]; - int err; - -@@ -142,11 +142,12 @@ static int blk_ioctl_secure_erase(struct block_device *bdev, blk_mode_t mode, - len = range[1]; - if ((start & 511) || (len & 511)) - return -EINVAL; -- if (start + len > bdev_nr_bytes(bdev)) -+ if (check_add_overflow(start, len, &end) || -+ end > bdev_nr_bytes(bdev)) - return -EINVAL; - - filemap_invalidate_lock(bdev->bd_inode->i_mapping); -- err = truncate_bdev_range(bdev, mode, start, start + len - 1); -+ err = truncate_bdev_range(bdev, mode, start, end - 1); - if (!err) - err = blkdev_issue_secure_erase(bdev, start >> 9, len >> 9, - GFP_KERNEL); -diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c -index f1263364fa97fa..86fa5dc7dd99a8 100644 ---- a/drivers/ata/libahci.c -+++ b/drivers/ata/libahci.c -@@ -2082,13 +2082,6 @@ static void ahci_qc_fill_rtf(struct ata_queued_cmd *qc) - struct ahci_port_priv *pp = qc->ap->private_data; - u8 *rx_fis = pp->rx_fis; - -- /* -- * rtf may already be filled (e.g. for successful NCQ commands). -- * If that is the case, we have nothing to do. -- */ -- if (qc->flags & ATA_QCFLAG_RTF_FILLED) -- return; -- - if (pp->fbs_enabled) - rx_fis += qc->dev->link->pmp * AHCI_RX_FIS_SZ; - -@@ -2102,7 +2095,6 @@ static void ahci_qc_fill_rtf(struct ata_queued_cmd *qc) - !(qc->flags & ATA_QCFLAG_EH)) { - ata_tf_from_fis(rx_fis + RX_FIS_PIO_SETUP, &qc->result_tf); - qc->result_tf.status = (rx_fis + RX_FIS_PIO_SETUP)[15]; -- qc->flags |= ATA_QCFLAG_RTF_FILLED; - return; - } - -@@ -2125,12 +2117,10 @@ static void ahci_qc_fill_rtf(struct ata_queued_cmd *qc) - */ - qc->result_tf.status = fis[2]; - qc->result_tf.error = fis[3]; -- qc->flags |= ATA_QCFLAG_RTF_FILLED; - return; - } - - ata_tf_from_fis(rx_fis + RX_FIS_D2H_REG, &qc->result_tf); -- qc->flags |= ATA_QCFLAG_RTF_FILLED; - } - - static void ahci_qc_ncq_fill_rtf(struct ata_port *ap, u64 done_mask) -@@ -2165,6 +2155,7 @@ static void ahci_qc_ncq_fill_rtf(struct ata_port *ap, u64 done_mask) - if (qc && ata_is_ncq(qc->tf.protocol)) { - qc->result_tf.status = status; - qc->result_tf.error = error; -+ qc->result_tf.flags = qc->tf.flags; - qc->flags |= ATA_QCFLAG_RTF_FILLED; - } - done_mask &= ~(1ULL << tag); -@@ -2189,6 +2180,7 @@ static void ahci_qc_ncq_fill_rtf(struct ata_port *ap, u64 done_mask) - fis += RX_FIS_SDB; - qc->result_tf.status = fis[2]; - qc->result_tf.error = fis[3]; -+ qc->result_tf.flags = qc->tf.flags; - qc->flags |= ATA_QCFLAG_RTF_FILLED; - } - done_mask &= ~(1ULL << tag); -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index 4ed90d46a017a8..f627753519b978 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -4792,8 +4792,16 @@ static void fill_result_tf(struct ata_queued_cmd *qc) - { - struct ata_port *ap = qc->ap; - -+ /* -+ * rtf may already be filled (e.g. for successful NCQ commands). -+ * If that is the case, we have nothing to do. -+ */ -+ if (qc->flags & ATA_QCFLAG_RTF_FILLED) -+ return; -+ - qc->result_tf.flags = qc->tf.flags; - ap->ops->qc_fill_rtf(qc); -+ qc->flags |= ATA_QCFLAG_RTF_FILLED; - } - - static void ata_verify_xfer(struct ata_queued_cmd *qc) -diff --git a/drivers/cpufreq/amd-pstate.c b/drivers/cpufreq/amd-pstate.c -index cdead37d0823ad..a64baa97e3583d 100644 ---- a/drivers/cpufreq/amd-pstate.c -+++ b/drivers/cpufreq/amd-pstate.c -@@ -579,8 +579,13 @@ static void amd_pstate_adjust_perf(unsigned int cpu, - unsigned long max_perf, min_perf, des_perf, - cap_perf, lowest_nonlinear_perf, max_freq; - struct cpufreq_policy *policy = cpufreq_cpu_get(cpu); -- struct amd_cpudata *cpudata = policy->driver_data; - unsigned int target_freq; -+ struct amd_cpudata *cpudata; -+ -+ if (!policy) -+ return; -+ -+ cpudata = policy->driver_data; - - if (policy->min != cpudata->min_limit_freq || policy->max != cpudata->max_limit_freq) - amd_pstate_update_min_max_limit(policy); -diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c -index 2aa0e01a6891b0..f11b071a896f59 100644 ---- a/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c -@@ -63,7 +63,8 @@ void dmub_hw_lock_mgr_inbox0_cmd(struct dc_dmub_srv *dmub_srv, - - bool should_use_dmub_lock(struct dc_link *link) - { -- if (link->psr_settings.psr_version == DC_PSR_VERSION_SU_1) -+ if (link->psr_settings.psr_version == DC_PSR_VERSION_SU_1 || -+ link->psr_settings.psr_version == DC_PSR_VERSION_1) - return true; - return false; - } -diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c -index 76806039691a2c..b2d59a16869728 100644 ---- a/drivers/gpu/drm/v3d/v3d_irq.c -+++ b/drivers/gpu/drm/v3d/v3d_irq.c -@@ -102,8 +102,10 @@ v3d_irq(int irq, void *arg) - to_v3d_fence(v3d->bin_job->base.irq_fence); - - trace_v3d_bcl_irq(&v3d->drm, fence->seqno); -- dma_fence_signal(&fence->base); -+ - v3d->bin_job = NULL; -+ dma_fence_signal(&fence->base); -+ - status = IRQ_HANDLED; - } - -@@ -112,8 +114,10 @@ v3d_irq(int irq, void *arg) - to_v3d_fence(v3d->render_job->base.irq_fence); - - trace_v3d_rcl_irq(&v3d->drm, fence->seqno); -- dma_fence_signal(&fence->base); -+ - v3d->render_job = NULL; -+ dma_fence_signal(&fence->base); -+ - status = IRQ_HANDLED; - } - -@@ -122,8 +126,10 @@ v3d_irq(int irq, void *arg) - to_v3d_fence(v3d->csd_job->base.irq_fence); - - trace_v3d_csd_irq(&v3d->drm, fence->seqno); -- dma_fence_signal(&fence->base); -+ - v3d->csd_job = NULL; -+ dma_fence_signal(&fence->base); -+ - status = IRQ_HANDLED; - } - -@@ -159,8 +165,10 @@ v3d_hub_irq(int irq, void *arg) - to_v3d_fence(v3d->tfu_job->base.irq_fence); - - trace_v3d_tfu_irq(&v3d->drm, fence->seqno); -- dma_fence_signal(&fence->base); -+ - v3d->tfu_job = NULL; -+ dma_fence_signal(&fence->base); -+ - status = IRQ_HANDLED; - } - -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index f16940f3d93d46..1174626904cb02 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -506,7 +506,6 @@ - #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100 0xe100 - - #define I2C_VENDOR_ID_GOODIX 0x27c6 --#define I2C_DEVICE_ID_GOODIX_01E0 0x01e0 - #define I2C_DEVICE_ID_GOODIX_01E8 0x01e8 - #define I2C_DEVICE_ID_GOODIX_01E9 0x01e9 - #define I2C_DEVICE_ID_GOODIX_01F0 0x01f0 -diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c -index bf9cad71125923..e62104e1a6038b 100644 ---- a/drivers/hid/hid-multitouch.c -+++ b/drivers/hid/hid-multitouch.c -@@ -1447,8 +1447,7 @@ static __u8 *mt_report_fixup(struct hid_device *hdev, __u8 *rdesc, - { - if (hdev->vendor == I2C_VENDOR_ID_GOODIX && - (hdev->product == I2C_DEVICE_ID_GOODIX_01E8 || -- hdev->product == I2C_DEVICE_ID_GOODIX_01E9 || -- hdev->product == I2C_DEVICE_ID_GOODIX_01E0)) { -+ hdev->product == I2C_DEVICE_ID_GOODIX_01E9)) { - if (rdesc[607] == 0x15) { - rdesc[607] = 0x25; - dev_info( -@@ -2073,10 +2072,7 @@ static const struct hid_device_id mt_devices[] = { - I2C_DEVICE_ID_GOODIX_01E8) }, - { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, - HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX, -- I2C_DEVICE_ID_GOODIX_01E9) }, -- { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, -- HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX, -- I2C_DEVICE_ID_GOODIX_01E0) }, -+ I2C_DEVICE_ID_GOODIX_01E8) }, - - /* GoodTouch panels */ - { .driver_data = MT_CLS_NSMU, -diff --git a/drivers/hwmon/drivetemp.c b/drivers/hwmon/drivetemp.c -index 2a4ec55ddb47ed..291d91f6864676 100644 ---- a/drivers/hwmon/drivetemp.c -+++ b/drivers/hwmon/drivetemp.c -@@ -194,7 +194,7 @@ static int drivetemp_scsi_command(struct drivetemp_data *st, - scsi_cmd[14] = ata_command; - - err = scsi_execute_cmd(st->sdev, scsi_cmd, op, st->smartdata, -- ATA_SECT_SIZE, HZ, 5, NULL); -+ ATA_SECT_SIZE, 10 * HZ, 5, NULL); - if (err > 0) - err = -EIO; - return err; -diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c -index c7e51cc2ea2687..082a383c4913ec 100644 ---- a/drivers/infiniband/hw/bnxt_re/main.c -+++ b/drivers/infiniband/hw/bnxt_re/main.c -@@ -485,6 +485,8 @@ static void bnxt_re_set_default_pacing_data(struct bnxt_re_dev *rdev) - static void __wait_for_fifo_occupancy_below_th(struct bnxt_re_dev *rdev) - { - u32 read_val, fifo_occup; -+ struct bnxt_qplib_db_pacing_data *pacing_data = rdev->qplib_res.pacing_data; -+ u32 retry_fifo_check = 1000; - - /* loop shouldn't run infintely as the occupancy usually goes - * below pacing algo threshold as soon as pacing kicks in. -@@ -500,6 +502,14 @@ static void __wait_for_fifo_occupancy_below_th(struct bnxt_re_dev *rdev) - - if (fifo_occup < rdev->qplib_res.pacing_data->pacing_th) - break; -+ if (!retry_fifo_check--) { -+ dev_info_once(rdev_to_dev(rdev), -+ "%s: fifo_occup = 0x%xfifo_max_depth = 0x%x pacing_th = 0x%x\n", -+ __func__, fifo_occup, pacing_data->fifo_max_depth, -+ pacing_data->pacing_th); -+ break; -+ } -+ - } - } - -diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c -index 0cfcad8348a6da..198a44c87e8411 100644 ---- a/drivers/input/joystick/xpad.c -+++ b/drivers/input/joystick/xpad.c -@@ -150,6 +150,7 @@ static const struct xpad_device { - { 0x045e, 0x028e, "Microsoft X-Box 360 pad", 0, XTYPE_XBOX360 }, - { 0x045e, 0x028f, "Microsoft X-Box 360 pad v2", 0, XTYPE_XBOX360 }, - { 0x045e, 0x0291, "Xbox 360 Wireless Receiver (XBOX)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W }, -+ { 0x045e, 0x02a9, "Xbox 360 Wireless Receiver (Unofficial)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W }, - { 0x045e, 0x02d1, "Microsoft X-Box One pad", 0, XTYPE_XBOXONE }, - { 0x045e, 0x02dd, "Microsoft X-Box One pad (Firmware 2015)", 0, XTYPE_XBOXONE }, - { 0x045e, 0x02e3, "Microsoft X-Box One Elite pad", MAP_PADDLES, XTYPE_XBOXONE }, -@@ -305,6 +306,7 @@ static const struct xpad_device { - { 0x1689, 0xfe00, "Razer Sabertooth", 0, XTYPE_XBOX360 }, - { 0x17ef, 0x6182, "Lenovo Legion Controller for Windows", 0, XTYPE_XBOX360 }, - { 0x1949, 0x041a, "Amazon Game Controller", 0, XTYPE_XBOX360 }, -+ { 0x1a86, 0xe310, "QH Electronics Controller", 0, XTYPE_XBOX360 }, - { 0x1bad, 0x0002, "Harmonix Rock Band Guitar", 0, XTYPE_XBOX360 }, - { 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, - { 0x1bad, 0x0130, "Ion Drum Rocker", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, -@@ -372,16 +374,19 @@ static const struct xpad_device { - { 0x294b, 0x3303, "Snakebyte GAMEPAD BASE X", 0, XTYPE_XBOXONE }, - { 0x294b, 0x3404, "Snakebyte GAMEPAD RGB X", 0, XTYPE_XBOXONE }, - { 0x2dc8, 0x2000, "8BitDo Pro 2 Wired Controller fox Xbox", 0, XTYPE_XBOXONE }, -- { 0x2dc8, 0x3106, "8BitDo Pro 2 Wired Controller", 0, XTYPE_XBOX360 }, -+ { 0x2dc8, 0x3106, "8BitDo Ultimate Wireless / Pro 2 Wired Controller", 0, XTYPE_XBOX360 }, - { 0x2dc8, 0x310a, "8BitDo Ultimate 2C Wireless Controller", 0, XTYPE_XBOX360 }, - { 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE }, - { 0x31e3, 0x1100, "Wooting One", 0, XTYPE_XBOX360 }, - { 0x31e3, 0x1200, "Wooting Two", 0, XTYPE_XBOX360 }, - { 0x31e3, 0x1210, "Wooting Lekker", 0, XTYPE_XBOX360 }, - { 0x31e3, 0x1220, "Wooting Two HE", 0, XTYPE_XBOX360 }, -+ { 0x31e3, 0x1230, "Wooting Two HE (ARM)", 0, XTYPE_XBOX360 }, - { 0x31e3, 0x1300, "Wooting 60HE (AVR)", 0, XTYPE_XBOX360 }, - { 0x31e3, 0x1310, "Wooting 60HE (ARM)", 0, XTYPE_XBOX360 }, - { 0x3285, 0x0607, "Nacon GC-100", 0, XTYPE_XBOX360 }, -+ { 0x3285, 0x0646, "Nacon Pro Compact", 0, XTYPE_XBOXONE }, -+ { 0x3285, 0x0663, "Nacon Evol-X", 0, XTYPE_XBOXONE }, - { 0x3537, 0x1004, "GameSir T4 Kaleid", 0, XTYPE_XBOX360 }, - { 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX }, - { 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX }, -@@ -513,6 +518,7 @@ static const struct usb_device_id xpad_table[] = { - XPAD_XBOX360_VENDOR(0x1689), /* Razer Onza */ - XPAD_XBOX360_VENDOR(0x17ef), /* Lenovo */ - XPAD_XBOX360_VENDOR(0x1949), /* Amazon controllers */ -+ XPAD_XBOX360_VENDOR(0x1a86), /* QH Electronics */ - XPAD_XBOX360_VENDOR(0x1bad), /* Harmonix Rock Band guitar and drums */ - XPAD_XBOX360_VENDOR(0x20d6), /* PowerA controllers */ - XPAD_XBOXONE_VENDOR(0x20d6), /* PowerA controllers */ -@@ -528,6 +534,7 @@ static const struct usb_device_id xpad_table[] = { - XPAD_XBOX360_VENDOR(0x2f24), /* GameSir controllers */ - XPAD_XBOX360_VENDOR(0x31e3), /* Wooting Keyboards */ - XPAD_XBOX360_VENDOR(0x3285), /* Nacon GC-100 */ -+ XPAD_XBOXONE_VENDOR(0x3285), /* Nacon Evol-X */ - XPAD_XBOX360_VENDOR(0x3537), /* GameSir Controllers */ - XPAD_XBOXONE_VENDOR(0x3537), /* GameSir Controllers */ - { } -diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c -index c229bd6b3f7f2f..aad2d75c036781 100644 ---- a/drivers/input/keyboard/atkbd.c -+++ b/drivers/input/keyboard/atkbd.c -@@ -89,7 +89,7 @@ static const unsigned short atkbd_set2_keycode[ATKBD_KEYMAP_SIZE] = { - 0, 46, 45, 32, 18, 5, 4, 95, 0, 57, 47, 33, 20, 19, 6,183, - 0, 49, 48, 35, 34, 21, 7,184, 0, 0, 50, 36, 22, 8, 9,185, - 0, 51, 37, 23, 24, 11, 10, 0, 0, 52, 53, 38, 39, 25, 12, 0, -- 0, 89, 40, 0, 26, 13, 0, 0, 58, 54, 28, 27, 0, 43, 0, 85, -+ 0, 89, 40, 0, 26, 13, 0,193, 58, 54, 28, 27, 0, 43, 0, 85, - 0, 86, 91, 90, 92, 0, 14, 94, 0, 79,124, 75, 71,121, 0, 0, - 82, 83, 80, 76, 77, 72, 1, 69, 87, 78, 81, 74, 55, 73, 70, 99, - -diff --git a/drivers/irqchip/irq-sunxi-nmi.c b/drivers/irqchip/irq-sunxi-nmi.c -index e760b1278143dd..262b625c30c102 100644 ---- a/drivers/irqchip/irq-sunxi-nmi.c -+++ b/drivers/irqchip/irq-sunxi-nmi.c -@@ -186,7 +186,8 @@ static int __init sunxi_sc_nmi_irq_init(struct device_node *node, - gc->chip_types[0].chip.irq_unmask = irq_gc_mask_set_bit; - gc->chip_types[0].chip.irq_eoi = irq_gc_ack_set_bit; - gc->chip_types[0].chip.irq_set_type = sunxi_sc_nmi_set_type; -- gc->chip_types[0].chip.flags = IRQCHIP_EOI_THREADED | IRQCHIP_EOI_IF_HANDLED; -+ gc->chip_types[0].chip.flags = IRQCHIP_EOI_THREADED | IRQCHIP_EOI_IF_HANDLED | -+ IRQCHIP_SKIP_SET_WAKE; - gc->chip_types[0].regs.ack = reg_offs->pend; - gc->chip_types[0].regs.mask = reg_offs->enable; - gc->chip_types[0].regs.type = reg_offs->ctrl; -diff --git a/drivers/of/unittest-data/tests-platform.dtsi b/drivers/of/unittest-data/tests-platform.dtsi -index fa39611071b32f..cd310b26b50c81 100644 ---- a/drivers/of/unittest-data/tests-platform.dtsi -+++ b/drivers/of/unittest-data/tests-platform.dtsi -@@ -34,5 +34,18 @@ dev@100 { - }; - }; - }; -+ -+ platform-tests-2 { -+ // No #address-cells or #size-cells -+ node { -+ #address-cells = <1>; -+ #size-cells = <1>; -+ -+ test-device@100 { -+ compatible = "test-sub-device"; -+ reg = <0x100 1>; -+ }; -+ }; -+ }; - }; - }; -diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c -index 7986113adc7d31..3b22c36bfb0b7c 100644 ---- a/drivers/of/unittest.c -+++ b/drivers/of/unittest.c -@@ -1186,6 +1186,7 @@ static void __init of_unittest_bus_3cell_ranges(void) - static void __init of_unittest_reg(void) - { - struct device_node *np; -+ struct resource res; - int ret; - u64 addr, size; - -@@ -1202,6 +1203,19 @@ static void __init of_unittest_reg(void) - np, addr); - - of_node_put(np); -+ -+ np = of_find_node_by_path("/testcase-data/platform-tests-2/node/test-device@100"); -+ if (!np) { -+ pr_err("missing testcase data\n"); -+ return; -+ } -+ -+ ret = of_address_to_resource(np, 0, &res); -+ unittest(ret == -EINVAL, "of_address_to_resource(%pOF) expected error on untranslatable address\n", -+ np); -+ -+ of_node_put(np); -+ - } - - static void __init of_unittest_parse_interrupts(void) -diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c -index 3075b2ddf7a697..deeb657981a690 100644 ---- a/drivers/scsi/scsi_transport_iscsi.c -+++ b/drivers/scsi/scsi_transport_iscsi.c -@@ -4103,7 +4103,7 @@ iscsi_if_rx(struct sk_buff *skb) - } - do { - /* -- * special case for GET_STATS: -+ * special case for GET_STATS, GET_CHAP and GET_HOST_STATS: - * on success - sending reply and stats from - * inside of if_recv_msg(), - * on error - fall through. -@@ -4112,6 +4112,8 @@ iscsi_if_rx(struct sk_buff *skb) - break; - if (ev->type == ISCSI_UEVENT_GET_CHAP && !err) - break; -+ if (ev->type == ISCSI_UEVENT_GET_HOST_STATS && !err) -+ break; - err = iscsi_if_send_reply(portid, nlh->nlmsg_type, - ev, sizeof(*ev)); - if (err == -EAGAIN && --retries < 0) { -diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c -index d0b55c1fa908a5..b3c588b102d900 100644 ---- a/drivers/scsi/storvsc_drv.c -+++ b/drivers/scsi/storvsc_drv.c -@@ -171,6 +171,12 @@ do { \ - dev_warn(&(dev)->device, fmt, ##__VA_ARGS__); \ - } while (0) - -+#define storvsc_log_ratelimited(dev, level, fmt, ...) \ -+do { \ -+ if (do_logging(level)) \ -+ dev_warn_ratelimited(&(dev)->device, fmt, ##__VA_ARGS__); \ -+} while (0) -+ - struct vmscsi_request { - u16 length; - u8 srb_status; -@@ -1177,7 +1183,7 @@ static void storvsc_on_io_completion(struct storvsc_device *stor_device, - int loglevel = (stor_pkt->vm_srb.cdb[0] == TEST_UNIT_READY) ? - STORVSC_LOGGING_WARN : STORVSC_LOGGING_ERROR; - -- storvsc_log(device, loglevel, -+ storvsc_log_ratelimited(device, loglevel, - "tag#%d cmd 0x%x status: scsi 0x%x srb 0x%x hv 0x%x\n", - scsi_cmd_to_rq(request->cmd)->tag, - stor_pkt->vm_srb.cdb[0], -diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c -index fe2737e55f8e89..729b0472bab098 100644 ---- a/drivers/usb/gadget/function/u_serial.c -+++ b/drivers/usb/gadget/function/u_serial.c -@@ -1398,10 +1398,6 @@ void gserial_disconnect(struct gserial *gser) - /* REVISIT as above: how best to track this? */ - port->port_line_coding = gser->port_line_coding; - -- /* disable endpoints, aborting down any active I/O */ -- usb_ep_disable(gser->out); -- usb_ep_disable(gser->in); -- - port->port_usb = NULL; - gser->ioport = NULL; - if (port->port.count > 0) { -@@ -1413,6 +1409,10 @@ void gserial_disconnect(struct gserial *gser) - spin_unlock(&port->port_lock); - spin_unlock_irqrestore(&serial_port_lock, flags); - -+ /* disable endpoints, aborting down any active I/O */ -+ usb_ep_disable(gser->out); -+ usb_ep_disable(gser->in); -+ - /* finally, free any unused/unusable I/O buffers */ - spin_lock_irqsave(&port->port_lock, flags); - if (port->port.count == 0) -diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c -index 821f25e52ec24c..4cde2bd3885f13 100644 ---- a/drivers/usb/serial/quatech2.c -+++ b/drivers/usb/serial/quatech2.c -@@ -503,7 +503,7 @@ static void qt2_process_read_urb(struct urb *urb) - - newport = *(ch + 3); - -- if (newport > serial->num_ports) { -+ if (newport >= serial->num_ports) { - dev_err(&port->dev, - "%s - port change to invalid port: %i\n", - __func__, newport); -diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c -index e53757d1d0958a..3bf1043cd7957c 100644 ---- a/drivers/vfio/platform/vfio_platform_common.c -+++ b/drivers/vfio/platform/vfio_platform_common.c -@@ -388,6 +388,11 @@ static ssize_t vfio_platform_read_mmio(struct vfio_platform_region *reg, - { - unsigned int done = 0; - -+ if (off >= reg->size) -+ return -EINVAL; -+ -+ count = min_t(size_t, count, reg->size - off); -+ - if (!reg->ioaddr) { - reg->ioaddr = - ioremap(reg->addr, reg->size); -@@ -467,6 +472,11 @@ static ssize_t vfio_platform_write_mmio(struct vfio_platform_region *reg, - { - unsigned int done = 0; - -+ if (off >= reg->size) -+ return -EINVAL; -+ -+ count = min_t(size_t, count, reg->size - off); -+ - if (!reg->ioaddr) { - reg->ioaddr = - ioremap(reg->addr, reg->size); -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 71ced0ada9a2e5..f019ce64eba48e 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -5366,6 +5366,8 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb) - INIT_LIST_HEAD(&sbi->s_orphan); /* unlinked but open files */ - mutex_init(&sbi->s_orphan_lock); - -+ spin_lock_init(&sbi->s_bdev_wb_lock); -+ - ext4_fast_commit_init(sb); - - sb->s_root = NULL; -@@ -5586,7 +5588,6 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb) - * Save the original bdev mapping's wb_err value which could be - * used to detect the metadata async write error. - */ -- spin_lock_init(&sbi->s_bdev_wb_lock); - errseq_check_and_advance(&sb->s_bdev->bd_inode->i_mapping->wb_err, - &sbi->s_bdev_wb_err); - EXT4_SB(sb)->s_mount_state |= EXT4_ORPHAN_FS; -diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c -index 9296e0e282bcd8..2adaffa58e88b4 100644 ---- a/fs/gfs2/file.c -+++ b/fs/gfs2/file.c -@@ -251,6 +251,7 @@ static int do_gfs2_set_flags(struct inode *inode, u32 reqflags, u32 mask) - error = filemap_fdatawait(inode->i_mapping); - if (error) - goto out; -+ truncate_inode_pages(inode->i_mapping, 0); - if (new_flags & GFS2_DIF_JDATA) - gfs2_ordered_del_inode(ip); - } -diff --git a/fs/libfs.c b/fs/libfs.c -index dc0f7519045f11..f5566964aa7d13 100644 ---- a/fs/libfs.c -+++ b/fs/libfs.c -@@ -239,6 +239,18 @@ const struct inode_operations simple_dir_inode_operations = { - }; - EXPORT_SYMBOL(simple_dir_inode_operations); - -+/* simple_offset_add() never assigns these to a dentry */ -+enum { -+ DIR_OFFSET_FIRST = 2, /* Find first real entry */ -+ DIR_OFFSET_EOD = S32_MAX, -+}; -+ -+/* simple_offset_add() allocation range */ -+enum { -+ DIR_OFFSET_MIN = DIR_OFFSET_FIRST + 1, -+ DIR_OFFSET_MAX = DIR_OFFSET_EOD - 1, -+}; -+ - static void offset_set(struct dentry *dentry, u32 offset) - { - dentry->d_fsdata = (void *)((uintptr_t)(offset)); -@@ -260,9 +272,7 @@ void simple_offset_init(struct offset_ctx *octx) - { - xa_init_flags(&octx->xa, XA_FLAGS_ALLOC1); - lockdep_set_class(&octx->xa.xa_lock, &simple_offset_xa_lock); -- -- /* 0 is '.', 1 is '..', so always start with offset 2 */ -- octx->next_offset = 2; -+ octx->next_offset = DIR_OFFSET_MIN; - } - - /** -@@ -275,7 +285,8 @@ void simple_offset_init(struct offset_ctx *octx) - */ - int simple_offset_add(struct offset_ctx *octx, struct dentry *dentry) - { -- static const struct xa_limit limit = XA_LIMIT(2, U32_MAX); -+ static const struct xa_limit limit = XA_LIMIT(DIR_OFFSET_MIN, -+ DIR_OFFSET_MAX); - u32 offset; - int ret; - -@@ -284,9 +295,21 @@ int simple_offset_add(struct offset_ctx *octx, struct dentry *dentry) - - ret = xa_alloc_cyclic(&octx->xa, &offset, dentry, limit, - &octx->next_offset, GFP_KERNEL); -- if (ret < 0) -- return ret; -+ if (unlikely(ret < 0)) -+ return ret == -EBUSY ? -ENOSPC : ret; -+ -+ offset_set(dentry, offset); -+ return 0; -+} - -+static int simple_offset_replace(struct offset_ctx *octx, struct dentry *dentry, -+ long offset) -+{ -+ void *ret; -+ -+ ret = xa_store(&octx->xa, offset, dentry, GFP_KERNEL); -+ if (xa_is_err(ret)) -+ return xa_err(ret); - offset_set(dentry, offset); - return 0; - } -@@ -309,6 +332,36 @@ void simple_offset_remove(struct offset_ctx *octx, struct dentry *dentry) - offset_set(dentry, 0); - } - -+/** -+ * simple_offset_rename - handle directory offsets for rename -+ * @old_dir: parent directory of source entry -+ * @old_dentry: dentry of source entry -+ * @new_dir: parent_directory of destination entry -+ * @new_dentry: dentry of destination -+ * -+ * Caller provides appropriate serialization. -+ * -+ * User space expects the directory offset value of the replaced -+ * (new) directory entry to be unchanged after a rename. -+ * -+ * Returns zero on success, a negative errno value on failure. -+ */ -+int simple_offset_rename(struct inode *old_dir, struct dentry *old_dentry, -+ struct inode *new_dir, struct dentry *new_dentry) -+{ -+ struct offset_ctx *old_ctx = old_dir->i_op->get_offset_ctx(old_dir); -+ struct offset_ctx *new_ctx = new_dir->i_op->get_offset_ctx(new_dir); -+ long new_offset = dentry2offset(new_dentry); -+ -+ simple_offset_remove(old_ctx, old_dentry); -+ -+ if (new_offset) { -+ offset_set(new_dentry, 0); -+ return simple_offset_replace(new_ctx, old_dentry, new_offset); -+ } -+ return simple_offset_add(new_ctx, old_dentry); -+} -+ - /** - * simple_offset_rename_exchange - exchange rename with directory offsets - * @old_dir: parent of dentry being moved -@@ -316,6 +369,9 @@ void simple_offset_remove(struct offset_ctx *octx, struct dentry *dentry) - * @new_dir: destination parent - * @new_dentry: destination dentry - * -+ * This API preserves the directory offset values. Caller provides -+ * appropriate serialization. -+ * - * Returns zero on success. Otherwise a negative errno is returned and the - * rename is rolled back. - */ -@@ -333,11 +389,11 @@ int simple_offset_rename_exchange(struct inode *old_dir, - simple_offset_remove(old_ctx, old_dentry); - simple_offset_remove(new_ctx, new_dentry); - -- ret = simple_offset_add(new_ctx, old_dentry); -+ ret = simple_offset_replace(new_ctx, old_dentry, new_index); - if (ret) - goto out_restore; - -- ret = simple_offset_add(old_ctx, new_dentry); -+ ret = simple_offset_replace(old_ctx, new_dentry, old_index); - if (ret) { - simple_offset_remove(new_ctx, old_dentry); - goto out_restore; -@@ -352,10 +408,8 @@ int simple_offset_rename_exchange(struct inode *old_dir, - return 0; - - out_restore: -- offset_set(old_dentry, old_index); -- xa_store(&old_ctx->xa, old_index, old_dentry, GFP_KERNEL); -- offset_set(new_dentry, new_index); -- xa_store(&new_ctx->xa, new_index, new_dentry, GFP_KERNEL); -+ (void)simple_offset_replace(old_ctx, old_dentry, old_index); -+ (void)simple_offset_replace(new_ctx, new_dentry, new_index); - return ret; - } - -@@ -396,57 +450,91 @@ static loff_t offset_dir_llseek(struct file *file, loff_t offset, int whence) - return -EINVAL; - } - -- /* In this case, ->private_data is protected by f_pos_lock */ -- file->private_data = NULL; - return vfs_setpos(file, offset, U32_MAX); - } - --static struct dentry *offset_find_next(struct xa_state *xas) -+static struct dentry *find_positive_dentry(struct dentry *parent, -+ struct dentry *dentry, -+ bool next) - { -+ struct dentry *found = NULL; -+ -+ spin_lock(&parent->d_lock); -+ if (next) -+ dentry = list_next_entry(dentry, d_child); -+ else if (!dentry) -+ dentry = list_first_entry_or_null(&parent->d_subdirs, -+ struct dentry, d_child); -+ for (; dentry && !list_entry_is_head(dentry, &parent->d_subdirs, d_child); -+ dentry = list_next_entry(dentry, d_child)) { -+ if (!simple_positive(dentry)) -+ continue; -+ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); -+ if (simple_positive(dentry)) -+ found = dget_dlock(dentry); -+ spin_unlock(&dentry->d_lock); -+ if (likely(found)) -+ break; -+ } -+ spin_unlock(&parent->d_lock); -+ return found; -+} -+ -+static noinline_for_stack struct dentry * -+offset_dir_lookup(struct dentry *parent, loff_t offset) -+{ -+ struct inode *inode = d_inode(parent); -+ struct offset_ctx *octx = inode->i_op->get_offset_ctx(inode); - struct dentry *child, *found = NULL; - -- rcu_read_lock(); -- child = xas_next_entry(xas, U32_MAX); -- if (!child) -- goto out; -- spin_lock(&child->d_lock); -- if (simple_positive(child)) -- found = dget_dlock(child); -- spin_unlock(&child->d_lock); --out: -- rcu_read_unlock(); -+ XA_STATE(xas, &octx->xa, offset); -+ -+ if (offset == DIR_OFFSET_FIRST) -+ found = find_positive_dentry(parent, NULL, false); -+ else { -+ rcu_read_lock(); -+ child = xas_next_entry(&xas, DIR_OFFSET_MAX); -+ found = find_positive_dentry(parent, child, false); -+ rcu_read_unlock(); -+ } - return found; - } - - static bool offset_dir_emit(struct dir_context *ctx, struct dentry *dentry) - { -- u32 offset = dentry2offset(dentry); - struct inode *inode = d_inode(dentry); - -- return ctx->actor(ctx, dentry->d_name.name, dentry->d_name.len, offset, -- inode->i_ino, fs_umode_to_dtype(inode->i_mode)); -+ return dir_emit(ctx, dentry->d_name.name, dentry->d_name.len, -+ inode->i_ino, fs_umode_to_dtype(inode->i_mode)); - } - --static void *offset_iterate_dir(struct inode *inode, struct dir_context *ctx) -+static void offset_iterate_dir(struct file *file, struct dir_context *ctx) - { -- struct offset_ctx *so_ctx = inode->i_op->get_offset_ctx(inode); -- XA_STATE(xas, &so_ctx->xa, ctx->pos); -+ struct dentry *dir = file->f_path.dentry; - struct dentry *dentry; - -+ dentry = offset_dir_lookup(dir, ctx->pos); -+ if (!dentry) -+ goto out_eod; - while (true) { -- dentry = offset_find_next(&xas); -- if (!dentry) -- return ERR_PTR(-ENOENT); -+ struct dentry *next; - -- if (!offset_dir_emit(ctx, dentry)) { -- dput(dentry); -+ ctx->pos = dentry2offset(dentry); -+ if (!offset_dir_emit(ctx, dentry)) - break; -- } - -+ next = find_positive_dentry(dir, dentry, true); - dput(dentry); -- ctx->pos = xas.xa_index + 1; -+ -+ if (!next) -+ goto out_eod; -+ dentry = next; - } -- return NULL; -+ dput(dentry); -+ return; -+ -+out_eod: -+ ctx->pos = DIR_OFFSET_EOD; - } - - /** -@@ -466,6 +554,8 @@ static void *offset_iterate_dir(struct inode *inode, struct dir_context *ctx) - * - * On return, @ctx->pos contains an offset that will read the next entry - * in this directory when offset_readdir() is called again with @ctx. -+ * Caller places this value in the d_off field of the last entry in the -+ * user's buffer. - * - * Return values: - * %0 - Complete -@@ -478,13 +568,8 @@ static int offset_readdir(struct file *file, struct dir_context *ctx) - - if (!dir_emit_dots(file, ctx)) - return 0; -- -- /* In this case, ->private_data is protected by f_pos_lock */ -- if (ctx->pos == 2) -- file->private_data = NULL; -- else if (file->private_data == ERR_PTR(-ENOENT)) -- return 0; -- file->private_data = offset_iterate_dir(d_inode(dir), ctx); -+ if (ctx->pos != DIR_OFFSET_EOD) -+ offset_iterate_dir(file, ctx); - return 0; - } - -diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c -index e695df1dbb23b2..9ebd7a5ee23c21 100644 ---- a/fs/smb/client/smb2inode.c -+++ b/fs/smb/client/smb2inode.c -@@ -176,27 +176,27 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - struct kvec *out_iov, int *out_buftype, struct dentry *dentry) - { - -- struct reparse_data_buffer *rbuf; -+ struct smb2_query_info_rsp *qi_rsp = NULL; - struct smb2_compound_vars *vars = NULL; -- struct kvec *rsp_iov, *iov; -- struct smb_rqst *rqst; -- int rc; -- __le16 *utf16_path = NULL; - __u8 oplock = SMB2_OPLOCK_LEVEL_NONE; -- struct cifs_fid fid; -+ struct cifs_open_info_data *idata; - struct cifs_ses *ses = tcon->ses; -+ struct reparse_data_buffer *rbuf; - struct TCP_Server_Info *server; -- int num_rqst = 0, i; - int resp_buftype[MAX_COMPOUND]; -- struct smb2_query_info_rsp *qi_rsp = NULL; -- struct cifs_open_info_data *idata; -+ int retries = 0, cur_sleep = 1; -+ __u8 delete_pending[8] = {1,}; -+ struct kvec *rsp_iov, *iov; - struct inode *inode = NULL; -- int flags = 0; -- __u8 delete_pending[8] = {1, 0, 0, 0, 0, 0, 0, 0}; -+ __le16 *utf16_path = NULL; -+ struct smb_rqst *rqst; - unsigned int size[2]; -- void *data[2]; -+ struct cifs_fid fid; -+ int num_rqst = 0, i; - unsigned int len; -- int retries = 0, cur_sleep = 1; -+ int tmp_rc, rc; -+ int flags = 0; -+ void *data[2]; - - replay_again: - /* reinitialize for possible replay */ -@@ -637,7 +637,14 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - tcon->need_reconnect = true; - } - -+ tmp_rc = rc; - for (i = 0; i < num_cmds; i++) { -+ char *buf = rsp_iov[i + i].iov_base; -+ -+ if (buf && resp_buftype[i + 1] != CIFS_NO_BUFFER) -+ rc = server->ops->map_error(buf, false); -+ else -+ rc = tmp_rc; - switch (cmds[i]) { - case SMB2_OP_QUERY_INFO: - idata = in_iov[i].iov_base; -@@ -803,6 +810,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - } - } - SMB2_close_free(&rqst[num_rqst]); -+ rc = tmp_rc; - - num_cmds += 2; - if (out_iov && out_buftype) { -@@ -858,22 +866,52 @@ static int parse_create_response(struct cifs_open_info_data *data, - return rc; - } - -+/* Check only if SMB2_OP_QUERY_WSL_EA command failed in the compound chain */ -+static bool ea_unsupported(int *cmds, int num_cmds, -+ struct kvec *out_iov, int *out_buftype) -+{ -+ int i; -+ -+ if (cmds[num_cmds - 1] != SMB2_OP_QUERY_WSL_EA) -+ return false; -+ -+ for (i = 1; i < num_cmds - 1; i++) { -+ struct smb2_hdr *hdr = out_iov[i].iov_base; -+ -+ if (out_buftype[i] == CIFS_NO_BUFFER || !hdr || -+ hdr->Status != STATUS_SUCCESS) -+ return false; -+ } -+ return true; -+} -+ -+static inline void free_rsp_iov(struct kvec *iovs, int *buftype, int count) -+{ -+ int i; -+ -+ for (i = 0; i < count; i++) { -+ free_rsp_buf(buftype[i], iovs[i].iov_base); -+ memset(&iovs[i], 0, sizeof(*iovs)); -+ buftype[i] = CIFS_NO_BUFFER; -+ } -+} -+ - int smb2_query_path_info(const unsigned int xid, - struct cifs_tcon *tcon, - struct cifs_sb_info *cifs_sb, - const char *full_path, - struct cifs_open_info_data *data) - { -+ struct kvec in_iov[3], out_iov[5] = {}; -+ struct cached_fid *cfid = NULL; - struct cifs_open_parms oparms; -- __u32 create_options = 0; - struct cifsFileInfo *cfile; -- struct cached_fid *cfid = NULL; -+ __u32 create_options = 0; -+ int out_buftype[5] = {}; - struct smb2_hdr *hdr; -- struct kvec in_iov[3], out_iov[3] = {}; -- int out_buftype[3] = {}; -+ int num_cmds = 0; - int cmds[3]; - bool islink; -- int i, num_cmds = 0; - int rc, rc2; - - data->adjust_tz = false; -@@ -943,14 +981,14 @@ int smb2_query_path_info(const unsigned int xid, - if (rc || !data->reparse_point) - goto out; - -- if (!tcon->posix_extensions) -- cmds[num_cmds++] = SMB2_OP_QUERY_WSL_EA; - /* - * Skip SMB2_OP_GET_REPARSE if symlink already parsed in create - * response. - */ - if (data->reparse.tag != IO_REPARSE_TAG_SYMLINK) - cmds[num_cmds++] = SMB2_OP_GET_REPARSE; -+ if (!tcon->posix_extensions) -+ cmds[num_cmds++] = SMB2_OP_QUERY_WSL_EA; - - oparms = CIFS_OPARMS(cifs_sb, tcon, full_path, - FILE_READ_ATTRIBUTES | -@@ -958,9 +996,18 @@ int smb2_query_path_info(const unsigned int xid, - FILE_OPEN, create_options | - OPEN_REPARSE_POINT, ACL_NO_MODE); - cifs_get_readable_path(tcon, full_path, &cfile); -+ free_rsp_iov(out_iov, out_buftype, ARRAY_SIZE(out_iov)); - rc = smb2_compound_op(xid, tcon, cifs_sb, full_path, - &oparms, in_iov, cmds, num_cmds, -- cfile, NULL, NULL, NULL); -+ cfile, out_iov, out_buftype, NULL); -+ if (rc && ea_unsupported(cmds, num_cmds, -+ out_iov, out_buftype)) { -+ if (data->reparse.tag != IO_REPARSE_TAG_LX_BLK && -+ data->reparse.tag != IO_REPARSE_TAG_LX_CHR) -+ rc = 0; -+ else -+ rc = -EOPNOTSUPP; -+ } - break; - case -EREMOTE: - break; -@@ -978,8 +1025,7 @@ int smb2_query_path_info(const unsigned int xid, - } - - out: -- for (i = 0; i < ARRAY_SIZE(out_buftype); i++) -- free_rsp_buf(out_buftype[i], out_iov[i].iov_base); -+ free_rsp_iov(out_iov, out_buftype, ARRAY_SIZE(out_iov)); - return rc; - } - -diff --git a/include/linux/fs.h b/include/linux/fs.h -index 6c3d86532e3f91..e47596d354ff75 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -3197,6 +3197,8 @@ struct offset_ctx { - void simple_offset_init(struct offset_ctx *octx); - int simple_offset_add(struct offset_ctx *octx, struct dentry *dentry); - void simple_offset_remove(struct offset_ctx *octx, struct dentry *dentry); -+int simple_offset_rename(struct inode *old_dir, struct dentry *old_dentry, -+ struct inode *new_dir, struct dentry *new_dentry); - int simple_offset_rename_exchange(struct inode *old_dir, - struct dentry *old_dentry, - struct inode *new_dir, -diff --git a/include/linux/seccomp.h b/include/linux/seccomp.h -index 175079552f68da..8cf31bb8871988 100644 ---- a/include/linux/seccomp.h -+++ b/include/linux/seccomp.h -@@ -70,10 +70,10 @@ struct seccomp_data; - - #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER - static inline int secure_computing(void) { return 0; } --static inline int __secure_computing(const struct seccomp_data *sd) { return 0; } - #else - static inline void secure_computing_strict(int this_syscall) { return; } - #endif -+static inline int __secure_computing(const struct seccomp_data *sd) { return 0; } - - static inline long prctl_get_seccomp(void) - { -diff --git a/mm/filemap.c b/mm/filemap.c -index 6a3d62de1cca7b..056422e6a0be8f 100644 ---- a/mm/filemap.c -+++ b/mm/filemap.c -@@ -4270,6 +4270,20 @@ static void filemap_cachestat(struct address_space *mapping, - rcu_read_unlock(); - } - -+/* -+ * See mincore: reveal pagecache information only for files -+ * that the calling process has write access to, or could (if -+ * tried) open for writing. -+ */ -+static inline bool can_do_cachestat(struct file *f) -+{ -+ if (f->f_mode & FMODE_WRITE) -+ return true; -+ if (inode_owner_or_capable(file_mnt_idmap(f), file_inode(f))) -+ return true; -+ return file_permission(f, MAY_WRITE) == 0; -+} -+ - /* - * The cachestat(2) system call. - * -@@ -4329,6 +4343,11 @@ SYSCALL_DEFINE4(cachestat, unsigned int, fd, - return -EOPNOTSUPP; - } - -+ if (!can_do_cachestat(f.file)) { -+ fdput(f); -+ return -EPERM; -+ } -+ - if (flags != 0) { - fdput(f); - return -EINVAL; -diff --git a/mm/shmem.c b/mm/shmem.c -index db7dd45c918158..283fb62084d454 100644 ---- a/mm/shmem.c -+++ b/mm/shmem.c -@@ -3434,8 +3434,7 @@ static int shmem_rename2(struct mnt_idmap *idmap, - return error; - } - -- simple_offset_remove(shmem_get_offset_ctx(old_dir), old_dentry); -- error = simple_offset_add(shmem_get_offset_ctx(new_dir), old_dentry); -+ error = simple_offset_rename(old_dir, old_dentry, new_dir, new_dentry); - if (error) - return error; - -diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c -index dd1803bf9c5c63..b5d64cd3ab0a23 100644 ---- a/net/ipv4/ip_tunnel.c -+++ b/net/ipv4/ip_tunnel.c -@@ -218,7 +218,7 @@ static struct ip_tunnel *ip_tunnel_find(struct ip_tunnel_net *itn, - struct ip_tunnel *t = NULL; - struct hlist_head *head = ip_bucket(itn, parms); - -- hlist_for_each_entry_rcu(t, head, hash_node) { -+ hlist_for_each_entry_rcu(t, head, hash_node, lockdep_rtnl_is_held()) { - if (local == t->parms.iph.saddr && - remote == t->parms.iph.daddr && - link == READ_ONCE(t->parms.link) && -diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c -index afa9073567dc40..023ac39041a214 100644 ---- a/net/ipv6/ip6_fib.c -+++ b/net/ipv6/ip6_fib.c -@@ -1179,8 +1179,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, - while (sibling) { - if (sibling->fib6_metric == rt->fib6_metric && - rt6_qualify_for_ecmp(sibling)) { -- list_add_tail(&rt->fib6_siblings, -- &sibling->fib6_siblings); -+ list_add_tail_rcu(&rt->fib6_siblings, -+ &sibling->fib6_siblings); - break; - } - sibling = rcu_dereference_protected(sibling->fib6_next, -@@ -1241,7 +1241,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, - fib6_siblings) - sibling->fib6_nsiblings--; - rt->fib6_nsiblings = 0; -- list_del_init(&rt->fib6_siblings); -+ list_del_rcu(&rt->fib6_siblings); - rt6_multipath_rebalance(next_sibling); - return err; - } -@@ -1954,7 +1954,7 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn, - &rt->fib6_siblings, fib6_siblings) - sibling->fib6_nsiblings--; - rt->fib6_nsiblings = 0; -- list_del_init(&rt->fib6_siblings); -+ list_del_rcu(&rt->fib6_siblings); - rt6_multipath_rebalance(next_sibling); - } - -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index fc5c5346202530..c5cee40a658b46 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -418,8 +418,8 @@ void fib6_select_path(const struct net *net, struct fib6_result *res, - struct flowi6 *fl6, int oif, bool have_oif_match, - const struct sk_buff *skb, int strict) - { -- struct fib6_info *sibling, *next_sibling; - struct fib6_info *match = res->f6i; -+ struct fib6_info *sibling; - - if (!match->nh && (!match->fib6_nsiblings || have_oif_match)) - goto out; -@@ -445,8 +445,8 @@ void fib6_select_path(const struct net *net, struct fib6_result *res, - if (fl6->mp_hash <= atomic_read(&match->fib6_nh->fib_nh_upper_bound)) - goto out; - -- list_for_each_entry_safe(sibling, next_sibling, &match->fib6_siblings, -- fib6_siblings) { -+ list_for_each_entry_rcu(sibling, &match->fib6_siblings, -+ fib6_siblings) { - const struct fib6_nh *nh = sibling->fib6_nh; - int nh_upper_bound; - -@@ -5186,14 +5186,18 @@ static void ip6_route_mpath_notify(struct fib6_info *rt, - * nexthop. Since sibling routes are always added at the end of - * the list, find the first sibling of the last route appended - */ -+ rcu_read_lock(); -+ - if ((nlflags & NLM_F_APPEND) && rt_last && rt_last->fib6_nsiblings) { -- rt = list_first_entry(&rt_last->fib6_siblings, -- struct fib6_info, -- fib6_siblings); -+ rt = list_first_or_null_rcu(&rt_last->fib6_siblings, -+ struct fib6_info, -+ fib6_siblings); - } - - if (rt) - inet6_rt_notify(RTM_NEWROUTE, rt, info, nlflags); -+ -+ rcu_read_unlock(); - } - - static bool ip6_route_mpath_should_notify(const struct fib6_info *rt) -@@ -5538,17 +5542,21 @@ static size_t rt6_nlmsg_size(struct fib6_info *f6i) - nexthop_for_each_fib6_nh(f6i->nh, rt6_nh_nlmsg_size, - &nexthop_len); - } else { -- struct fib6_info *sibling, *next_sibling; - struct fib6_nh *nh = f6i->fib6_nh; -+ struct fib6_info *sibling; - - nexthop_len = 0; - if (f6i->fib6_nsiblings) { - rt6_nh_nlmsg_size(nh, &nexthop_len); - -- list_for_each_entry_safe(sibling, next_sibling, -- &f6i->fib6_siblings, fib6_siblings) { -+ rcu_read_lock(); -+ -+ list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, -+ fib6_siblings) { - rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); - } -+ -+ rcu_read_unlock(); - } - nexthop_len += lwtunnel_get_encap_size(nh->fib_nh_lws); - } -@@ -5712,7 +5720,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb, - lwtunnel_fill_encap(skb, dst->lwtstate, RTA_ENCAP, RTA_ENCAP_TYPE) < 0) - goto nla_put_failure; - } else if (rt->fib6_nsiblings) { -- struct fib6_info *sibling, *next_sibling; -+ struct fib6_info *sibling; - struct nlattr *mp; - - mp = nla_nest_start_noflag(skb, RTA_MULTIPATH); -@@ -5724,14 +5732,21 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb, - 0) < 0) - goto nla_put_failure; - -- list_for_each_entry_safe(sibling, next_sibling, -- &rt->fib6_siblings, fib6_siblings) { -+ rcu_read_lock(); -+ -+ list_for_each_entry_rcu(sibling, &rt->fib6_siblings, -+ fib6_siblings) { - if (fib_add_nexthop(skb, &sibling->fib6_nh->nh_common, - sibling->fib6_nh->fib_nh_weight, -- AF_INET6, 0) < 0) -+ AF_INET6, 0) < 0) { -+ rcu_read_unlock(); -+ - goto nla_put_failure; -+ } - } - -+ rcu_read_unlock(); -+ - nla_nest_end(skb, mp); - } else if (rt->nh) { - if (nla_put_u32(skb, RTA_NH_ID, rt->nh->id)) -@@ -6168,7 +6183,7 @@ void inet6_rt_notify(int event, struct fib6_info *rt, struct nl_info *info, - err = -ENOBUFS; - seq = info->nlh ? info->nlh->nlmsg_seq : 0; - -- skb = nlmsg_new(rt6_nlmsg_size(rt), gfp_any()); -+ skb = nlmsg_new(rt6_nlmsg_size(rt), GFP_ATOMIC); - if (!skb) - goto errout; - -@@ -6181,7 +6196,7 @@ void inet6_rt_notify(int event, struct fib6_info *rt, struct nl_info *info, - goto errout; - } - rtnl_notify(skb, net, info->portid, RTNLGRP_IPV6_ROUTE, -- info->nlh, gfp_any()); -+ info->nlh, GFP_ATOMIC); - return; - errout: - if (err < 0) -diff --git a/net/sched/sch_ets.c b/net/sched/sch_ets.c -index b10efeaf0629d2..9fd70462b41d5a 100644 ---- a/net/sched/sch_ets.c -+++ b/net/sched/sch_ets.c -@@ -91,6 +91,8 @@ ets_class_from_arg(struct Qdisc *sch, unsigned long arg) - { - struct ets_sched *q = qdisc_priv(sch); - -+ if (arg == 0 || arg > q->nbands) -+ return NULL; - return &q->classes[arg - 1]; - } - -diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig -index f1e1dbc509f6e4..6d105a23c8284c 100644 ---- a/sound/soc/codecs/Kconfig -+++ b/sound/soc/codecs/Kconfig -@@ -2209,6 +2209,7 @@ config SND_SOC_WM8993 - - config SND_SOC_WM8994 - tristate -+ depends on MFD_WM8994 - - config SND_SOC_WM8995 - tristate -diff --git a/sound/soc/samsung/Kconfig b/sound/soc/samsung/Kconfig -index 93c2b1b08d0a6f..e8716501685bce 100644 ---- a/sound/soc/samsung/Kconfig -+++ b/sound/soc/samsung/Kconfig -@@ -127,8 +127,9 @@ config SND_SOC_SAMSUNG_TM2_WM5110 - - config SND_SOC_SAMSUNG_ARIES_WM8994 - tristate "SoC I2S Audio support for WM8994 on Aries" -- depends on SND_SOC_SAMSUNG && MFD_WM8994 && IIO && EXTCON -+ depends on SND_SOC_SAMSUNG && I2C && IIO && EXTCON - select SND_SOC_BT_SCO -+ select MFD_WM8994 - select SND_SOC_WM8994 - select SND_SAMSUNG_I2S - help -@@ -140,8 +141,9 @@ config SND_SOC_SAMSUNG_ARIES_WM8994 - - config SND_SOC_SAMSUNG_MIDAS_WM1811 - tristate "SoC I2S Audio support for Midas boards" -- depends on SND_SOC_SAMSUNG -+ depends on SND_SOC_SAMSUNG && I2C - select SND_SAMSUNG_I2S -+ select MFD_WM8994 - select SND_SOC_WM8994 - help - Say Y if you want to add support for SoC audio on the Midas boards. -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index ec81b47c41c9ea..9cdd6cfd8219a7 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -2139,6 +2139,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { - QUIRK_FLAG_CTL_MSG_DELAY_1M), - DEVICE_FLG(0x0c45, 0x6340, /* Sonix HD USB Camera */ - QUIRK_FLAG_GET_SAMPLE_RATE), -+ DEVICE_FLG(0x0d8c, 0x0014, /* USB Audio Device */ -+ QUIRK_FLAG_CTL_MSG_DELAY_1M), - DEVICE_FLG(0x0ecb, 0x205c, /* JBL Quantum610 Wireless */ - QUIRK_FLAG_FIXED_RATE), - DEVICE_FLG(0x0ecb, 0x2069, /* JBL Quantum810 Wireless */ -diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile -index 91a48efb140bef..efaf0e0bc4592b 100644 ---- a/tools/testing/selftests/net/Makefile -+++ b/tools/testing/selftests/net/Makefile -@@ -91,6 +91,7 @@ TEST_PROGS += test_vxlan_mdb.sh - TEST_PROGS += test_bridge_neigh_suppress.sh - TEST_PROGS += test_vxlan_nolocalbypass.sh - TEST_PROGS += test_bridge_backup_port.sh -+TEST_PROGS += ipv6_route_update_soft_lockup.sh - - TEST_FILES := settings - TEST_FILES += in_netns.sh lib.sh net_helper.sh setup_loopback.sh setup_veth.sh -diff --git a/tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh b/tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh -new file mode 100644 -index 00000000000000..a6b2b1f9c641c9 ---- /dev/null -+++ b/tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh -@@ -0,0 +1,262 @@ -+#!/bin/bash -+# SPDX-License-Identifier: GPL-2.0 -+# -+# Testing for potential kernel soft lockup during IPv6 routing table -+# refresh under heavy outgoing IPv6 traffic. If a kernel soft lockup -+# occurs, a kernel panic will be triggered to prevent associated issues. -+# -+# -+# Test Environment Layout -+# -+# ┌----------------┐ ┌----------------┐ -+# | SOURCE_NS | | SINK_NS | -+# | NAMESPACE | | NAMESPACE | -+# |(iperf3 clients)| |(iperf3 servers)| -+# | | | | -+# | | | | -+# | ┌-----------| nexthops |---------┐ | -+# | |veth_source|<--------------------------------------->|veth_sink|<┐ | -+# | └-----------|2001:0DB8:1::0:1/96 2001:0DB8:1::1:1/96 |---------┘ | | -+# | | ^ 2001:0DB8:1::1:2/96 | | | -+# | | . . | fwd | | -+# | ┌---------┐ | . . | | | -+# | | IPv6 | | . . | V | -+# | | routing | | . 2001:0DB8:1::1:80/96| ┌-----┐ | -+# | | table | | . | | lo | | -+# | | nexthop | | . └--------┴-----┴-┘ -+# | | update | | ............................> 2001:0DB8:2::1:1/128 -+# | └-------- ┘ | -+# └----------------┘ -+# -+# The test script sets up two network namespaces, source_ns and sink_ns, -+# connected via a veth link. Within source_ns, it continuously updates the -+# IPv6 routing table by flushing and inserting IPV6_NEXTHOP_ADDR_COUNT nexthop -+# IPs destined for SINK_LOOPBACK_IP_ADDR in sink_ns. This refresh occurs at a -+# rate of 1/ROUTING_TABLE_REFRESH_PERIOD per second for TEST_DURATION seconds. -+# -+# Simultaneously, multiple iperf3 clients within source_ns generate heavy -+# outgoing IPv6 traffic. Each client is assigned a unique port number starting -+# at 5000 and incrementing sequentially. Each client targets a unique iperf3 -+# server running in sink_ns, connected to the SINK_LOOPBACK_IFACE interface -+# using the same port number. -+# -+# The number of iperf3 servers and clients is set to half of the total -+# available cores on each machine. -+# -+# NOTE: We have tested this script on machines with various CPU specifications, -+# ranging from lower to higher performance as listed below. The test script -+# effectively triggered a kernel soft lockup on machines running an unpatched -+# kernel in under a minute: -+# -+# - 1x Intel Xeon E-2278G 8-Core Processor @ 3.40GHz -+# - 1x Intel Xeon E-2378G Processor 8-Core @ 2.80GHz -+# - 1x AMD EPYC 7401P 24-Core Processor @ 2.00GHz -+# - 1x AMD EPYC 7402P 24-Core Processor @ 2.80GHz -+# - 2x Intel Xeon Gold 5120 14-Core Processor @ 2.20GHz -+# - 1x Ampere Altra Q80-30 80-Core Processor @ 3.00GHz -+# - 2x Intel Xeon Gold 5120 14-Core Processor @ 2.20GHz -+# - 2x Intel Xeon Silver 4214 24-Core Processor @ 2.20GHz -+# - 1x AMD EPYC 7502P 32-Core @ 2.50GHz -+# - 1x Intel Xeon Gold 6314U 32-Core Processor @ 2.30GHz -+# - 2x Intel Xeon Gold 6338 32-Core Processor @ 2.00GHz -+# -+# On less performant machines, you may need to increase the TEST_DURATION -+# parameter to enhance the likelihood of encountering a race condition leading -+# to a kernel soft lockup and avoid a false negative result. -+# -+# NOTE: The test may not produce the expected result in virtualized -+# environments (e.g., qemu) due to differences in timing and CPU handling, -+# which can affect the conditions needed to trigger a soft lockup. -+ -+source lib.sh -+source net_helper.sh -+ -+TEST_DURATION=300 -+ROUTING_TABLE_REFRESH_PERIOD=0.01 -+ -+IPERF3_BITRATE="300m" -+ -+ -+IPV6_NEXTHOP_ADDR_COUNT="128" -+IPV6_NEXTHOP_ADDR_MASK="96" -+IPV6_NEXTHOP_PREFIX="2001:0DB8:1" -+ -+ -+SOURCE_TEST_IFACE="veth_source" -+SOURCE_TEST_IP_ADDR="2001:0DB8:1::0:1/96" -+ -+SINK_TEST_IFACE="veth_sink" -+# ${SINK_TEST_IFACE} is populated with the following range of IPv6 addresses: -+# 2001:0DB8:1::1:1 to 2001:0DB8:1::1:${IPV6_NEXTHOP_ADDR_COUNT} -+SINK_LOOPBACK_IFACE="lo" -+SINK_LOOPBACK_IP_MASK="128" -+SINK_LOOPBACK_IP_ADDR="2001:0DB8:2::1:1" -+ -+nexthop_ip_list="" -+termination_signal="" -+kernel_softlokup_panic_prev_val="" -+ -+terminate_ns_processes_by_pattern() { -+ local ns=$1 -+ local pattern=$2 -+ -+ for pid in $(ip netns pids ${ns}); do -+ [ -e /proc/$pid/cmdline ] && grep -qe "${pattern}" /proc/$pid/cmdline && kill -9 $pid -+ done -+} -+ -+cleanup() { -+ echo "info: cleaning up namespaces and terminating all processes within them..." -+ -+ -+ # Terminate iperf3 instances running in the source_ns. To avoid race -+ # conditions, first iterate over the PIDs and terminate those -+ # associated with the bash shells running the -+ # `while true; do iperf3 -c ...; done` loops. In a second iteration, -+ # terminate the individual `iperf3 -c ...` instances. -+ terminate_ns_processes_by_pattern ${source_ns} while -+ terminate_ns_processes_by_pattern ${source_ns} iperf3 -+ -+ # Repeat the same process for sink_ns -+ terminate_ns_processes_by_pattern ${sink_ns} while -+ terminate_ns_processes_by_pattern ${sink_ns} iperf3 -+ -+ # Check if any iperf3 instances are still running. This could happen -+ # if a core has entered an infinite loop and the timeout for detecting -+ # the soft lockup has not expired, but either the test interval has -+ # already elapsed or the test was terminated manually (e.g., with ^C) -+ for pid in $(ip netns pids ${source_ns}); do -+ if [ -e /proc/$pid/cmdline ] && grep -qe 'iperf3' /proc/$pid/cmdline; then -+ echo "FAIL: unable to terminate some iperf3 instances. Soft lockup is underway. A kernel panic is on the way!" -+ exit ${ksft_fail} -+ fi -+ done -+ -+ if [ "$termination_signal" == "SIGINT" ]; then -+ echo "SKIP: Termination due to ^C (SIGINT)" -+ elif [ "$termination_signal" == "SIGALRM" ]; then -+ echo "PASS: No kernel soft lockup occurred during this ${TEST_DURATION} second test" -+ fi -+ -+ cleanup_ns ${source_ns} ${sink_ns} -+ -+ sysctl -qw kernel.softlockup_panic=${kernel_softlokup_panic_prev_val} -+} -+ -+setup_prepare() { -+ setup_ns source_ns sink_ns -+ -+ ip -n ${source_ns} link add name ${SOURCE_TEST_IFACE} type veth peer name ${SINK_TEST_IFACE} netns ${sink_ns} -+ -+ # Setting up the Source namespace -+ ip -n ${source_ns} addr add ${SOURCE_TEST_IP_ADDR} dev ${SOURCE_TEST_IFACE} -+ ip -n ${source_ns} link set dev ${SOURCE_TEST_IFACE} qlen 10000 -+ ip -n ${source_ns} link set dev ${SOURCE_TEST_IFACE} up -+ ip netns exec ${source_ns} sysctl -qw net.ipv6.fib_multipath_hash_policy=1 -+ -+ # Setting up the Sink namespace -+ ip -n ${sink_ns} addr add ${SINK_LOOPBACK_IP_ADDR}/${SINK_LOOPBACK_IP_MASK} dev ${SINK_LOOPBACK_IFACE} -+ ip -n ${sink_ns} link set dev ${SINK_LOOPBACK_IFACE} up -+ ip netns exec ${sink_ns} sysctl -qw net.ipv6.conf.${SINK_LOOPBACK_IFACE}.forwarding=1 -+ -+ ip -n ${sink_ns} link set ${SINK_TEST_IFACE} up -+ ip netns exec ${sink_ns} sysctl -qw net.ipv6.conf.${SINK_TEST_IFACE}.forwarding=1 -+ -+ -+ # Populate nexthop IPv6 addresses on the test interface in the sink_ns -+ echo "info: populating ${IPV6_NEXTHOP_ADDR_COUNT} IPv6 addresses on the ${SINK_TEST_IFACE} interface ..." -+ for IP in $(seq 1 ${IPV6_NEXTHOP_ADDR_COUNT}); do -+ ip -n ${sink_ns} addr add ${IPV6_NEXTHOP_PREFIX}::$(printf "1:%x" "${IP}")/${IPV6_NEXTHOP_ADDR_MASK} dev ${SINK_TEST_IFACE}; -+ done -+ -+ # Preparing list of nexthops -+ for IP in $(seq 1 ${IPV6_NEXTHOP_ADDR_COUNT}); do -+ nexthop_ip_list=$nexthop_ip_list" nexthop via ${IPV6_NEXTHOP_PREFIX}::$(printf "1:%x" $IP) dev ${SOURCE_TEST_IFACE} weight 1" -+ done -+} -+ -+ -+test_soft_lockup_during_routing_table_refresh() { -+ # Start num_of_iperf_servers iperf3 servers in the sink_ns namespace, -+ # each listening on ports starting at 5001 and incrementing -+ # sequentially. Since iperf3 instances may terminate unexpectedly, a -+ # while loop is used to automatically restart them in such cases. -+ echo "info: starting ${num_of_iperf_servers} iperf3 servers in the sink_ns namespace ..." -+ for i in $(seq 1 ${num_of_iperf_servers}); do -+ cmd="iperf3 --bind ${SINK_LOOPBACK_IP_ADDR} -s -p $(printf '5%03d' ${i}) --rcv-timeout 200 &>/dev/null" -+ ip netns exec ${sink_ns} bash -c "while true; do ${cmd}; done &" &>/dev/null -+ done -+ -+ # Wait for the iperf3 servers to be ready -+ for i in $(seq ${num_of_iperf_servers}); do -+ port=$(printf '5%03d' ${i}); -+ wait_local_port_listen ${sink_ns} ${port} tcp -+ done -+ -+ # Continuously refresh the routing table in the background within -+ # the source_ns namespace -+ ip netns exec ${source_ns} bash -c " -+ while \$(ip netns list | grep -q ${source_ns}); do -+ ip -6 route add ${SINK_LOOPBACK_IP_ADDR}/${SINK_LOOPBACK_IP_MASK} ${nexthop_ip_list}; -+ sleep ${ROUTING_TABLE_REFRESH_PERIOD}; -+ ip -6 route delete ${SINK_LOOPBACK_IP_ADDR}/${SINK_LOOPBACK_IP_MASK}; -+ done &" -+ -+ # Start num_of_iperf_servers iperf3 clients in the source_ns namespace, -+ # each sending TCP traffic on sequential ports starting at 5001. -+ # Since iperf3 instances may terminate unexpectedly (e.g., if the route -+ # to the server is deleted in the background during a route refresh), a -+ # while loop is used to automatically restart them in such cases. -+ echo "info: starting ${num_of_iperf_servers} iperf3 clients in the source_ns namespace ..." -+ for i in $(seq 1 ${num_of_iperf_servers}); do -+ cmd="iperf3 -c ${SINK_LOOPBACK_IP_ADDR} -p $(printf '5%03d' ${i}) --length 64 --bitrate ${IPERF3_BITRATE} -t 0 --connect-timeout 150 &>/dev/null" -+ ip netns exec ${source_ns} bash -c "while true; do ${cmd}; done &" &>/dev/null -+ done -+ -+ echo "info: IPv6 routing table is being updated at the rate of $(echo "1/${ROUTING_TABLE_REFRESH_PERIOD}" | bc)/s for ${TEST_DURATION} seconds ..." -+ echo "info: A kernel soft lockup, if detected, results in a kernel panic!" -+ -+ wait -+} -+ -+# Make sure 'iperf3' is installed, skip the test otherwise -+if [ ! -x "$(command -v "iperf3")" ]; then -+ echo "SKIP: 'iperf3' is not installed. Skipping the test." -+ exit ${ksft_skip} -+fi -+ -+# Determine the number of cores on the machine -+num_of_iperf_servers=$(( $(nproc)/2 )) -+ -+# Check if we are running on a multi-core machine, skip the test otherwise -+if [ "${num_of_iperf_servers}" -eq 0 ]; then -+ echo "SKIP: This test is not valid on a single core machine!" -+ exit ${ksft_skip} -+fi -+ -+# Since the kernel soft lockup we're testing causes at least one core to enter -+# an infinite loop, destabilizing the host and likely affecting subsequent -+# tests, we trigger a kernel panic instead of reporting a failure and -+# continuing -+kernel_softlokup_panic_prev_val=$(sysctl -n kernel.softlockup_panic) -+sysctl -qw kernel.softlockup_panic=1 -+ -+handle_sigint() { -+ termination_signal="SIGINT" -+ cleanup -+ exit ${ksft_skip} -+} -+ -+handle_sigalrm() { -+ termination_signal="SIGALRM" -+ cleanup -+ exit ${ksft_pass} -+} -+ -+trap handle_sigint SIGINT -+trap handle_sigalrm SIGALRM -+ -+(sleep ${TEST_DURATION} && kill -s SIGALRM $$)& -+ -+setup_prepare -+test_soft_lockup_during_routing_table_refresh diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.075-076.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.075-076.patch deleted file mode 100644 index a98510e558..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.075-076.patch +++ /dev/null @@ -1,19946 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml b/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml -index e850a8894758df..bb40bb9e036ee0 100644 ---- a/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml -+++ b/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml -@@ -27,7 +27,7 @@ properties: - description: | - For multicolor LED support this property should be defined as either - LED_COLOR_ID_RGB or LED_COLOR_ID_MULTI which can be found in -- include/linux/leds/common.h. -+ include/dt-bindings/leds/common.h. - enum: [ 8, 9 ] - - required: -diff --git a/Documentation/devicetree/bindings/mfd/rohm,bd71815-pmic.yaml b/Documentation/devicetree/bindings/mfd/rohm,bd71815-pmic.yaml -index 05747e012516e2..ab26b1bd567fd9 100644 ---- a/Documentation/devicetree/bindings/mfd/rohm,bd71815-pmic.yaml -+++ b/Documentation/devicetree/bindings/mfd/rohm,bd71815-pmic.yaml -@@ -50,15 +50,15 @@ properties: - minimum: 0 - maximum: 1 - -- rohm,charger-sense-resistor-ohms: -- minimum: 10000000 -- maximum: 50000000 -+ rohm,charger-sense-resistor-micro-ohms: -+ minimum: 10000 -+ maximum: 50000 - description: | -- BD71827 and BD71828 have SAR ADC for measuring charging currents. -- External sense resistor (RSENSE in data sheet) should be used. If -- something other but 30MOhm resistor is used the resistance value -- should be given here in Ohms. -- default: 30000000 -+ BD71815 has SAR ADC for measuring charging currents. External sense -+ resistor (RSENSE in data sheet) should be used. If something other -+ but a 30 mOhm resistor is used the resistance value should be given -+ here in micro Ohms. -+ default: 30000 - - regulators: - $ref: ../regulator/rohm,bd71815-regulator.yaml -@@ -67,7 +67,7 @@ properties: - - gpio-reserved-ranges: - description: | -- Usage of BD71828 GPIO pins can be changed via OTP. This property can be -+ Usage of BD71815 GPIO pins can be changed via OTP. This property can be - used to mark the pins which should not be configured for GPIO. Please see - the ../gpio/gpio.txt for more information. - -@@ -113,7 +113,7 @@ examples: - gpio-controller; - #gpio-cells = <2>; - -- rohm,charger-sense-resistor-ohms = <10000000>; -+ rohm,charger-sense-resistor-micro-ohms = <10000>; - - regulators { - buck1: buck1 { -diff --git a/Documentation/devicetree/bindings/mmc/mmc-controller.yaml b/Documentation/devicetree/bindings/mmc/mmc-controller.yaml -index 58ae298cd2fcf4..23884b8184a9df 100644 ---- a/Documentation/devicetree/bindings/mmc/mmc-controller.yaml -+++ b/Documentation/devicetree/bindings/mmc/mmc-controller.yaml -@@ -25,7 +25,7 @@ properties: - "#address-cells": - const: 1 - description: | -- The cell is the slot ID if a function subnode is used. -+ The cell is the SDIO function number if a function subnode is used. - - "#size-cells": - const: 0 -diff --git a/Documentation/devicetree/bindings/regulator/mt6315-regulator.yaml b/Documentation/devicetree/bindings/regulator/mt6315-regulator.yaml -index 6317daf76d1fbe..2bed57a347827e 100644 ---- a/Documentation/devicetree/bindings/regulator/mt6315-regulator.yaml -+++ b/Documentation/devicetree/bindings/regulator/mt6315-regulator.yaml -@@ -31,10 +31,6 @@ properties: - $ref: regulator.yaml# - unevaluatedProperties: false - -- properties: -- regulator-compatible: -- pattern: "^vbuck[1-4]$" -- - additionalProperties: false - - required: -@@ -52,7 +48,6 @@ examples: - - regulators { - vbuck1 { -- regulator-compatible = "vbuck1"; - regulator-min-microvolt = <300000>; - regulator-max-microvolt = <1193750>; - regulator-enable-ramp-delay = <256>; -@@ -60,7 +55,6 @@ examples: - }; - - vbuck3 { -- regulator-compatible = "vbuck3"; - regulator-min-microvolt = <300000>; - regulator-max-microvolt = <1193750>; - regulator-enable-ramp-delay = <256>; -diff --git a/Makefile b/Makefile -index b8041104f248d3..d679a3dd5a582b 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 75 -+SUBLEVEL = 76 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -@@ -518,7 +518,7 @@ KGZIP = gzip - KBZIP2 = bzip2 - KLZOP = lzop - LZMA = lzma --LZ4 = lz4c -+LZ4 = lz4 - XZ = xz - ZSTD = zstd - -diff --git a/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-yosemite4.dts b/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-yosemite4.dts -index 64075cc41d9275..f5d38a9f47638e 100644 ---- a/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-yosemite4.dts -+++ b/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-yosemite4.dts -@@ -284,12 +284,12 @@ &i2c10 { - &i2c11 { - status = "okay"; - power-sensor@10 { -- compatible = "adi, adm1272"; -+ compatible = "adi,adm1272"; - reg = <0x10>; - }; - - power-sensor@12 { -- compatible = "adi, adm1272"; -+ compatible = "adi,adm1272"; - reg = <0x12>; - }; - -@@ -454,22 +454,20 @@ adc@1f { - }; - - pwm@20{ -- compatible = "max31790"; -+ compatible = "maxim,max31790"; - reg = <0x20>; -- #address-cells = <1>; -- #size-cells = <0>; - }; - - gpio@22{ - compatible = "ti,tca6424"; - reg = <0x22>; -+ gpio-controller; -+ #gpio-cells = <2>; - }; - - pwm@23{ -- compatible = "max31790"; -+ compatible = "maxim,max31790"; - reg = <0x23>; -- #address-cells = <1>; -- #size-cells = <0>; - }; - - adc@33 { -@@ -504,22 +502,20 @@ adc@1f { - }; - - pwm@20{ -- compatible = "max31790"; -+ compatible = "maxim,max31790"; - reg = <0x20>; -- #address-cells = <1>; -- #size-cells = <0>; - }; - - gpio@22{ - compatible = "ti,tca6424"; - reg = <0x22>; -+ gpio-controller; -+ #gpio-cells = <2>; - }; - - pwm@23{ -- compatible = "max31790"; -+ compatible = "maxim,max31790"; - reg = <0x23>; -- #address-cells = <1>; -- #size-cells = <0>; - }; - - adc@33 { -diff --git a/arch/arm/boot/dts/intel/socfpga/socfpga_arria10.dtsi b/arch/arm/boot/dts/intel/socfpga/socfpga_arria10.dtsi -index f36063c57c7f28..72c55e5187ca89 100644 ---- a/arch/arm/boot/dts/intel/socfpga/socfpga_arria10.dtsi -+++ b/arch/arm/boot/dts/intel/socfpga/socfpga_arria10.dtsi -@@ -440,7 +440,7 @@ gmac0: ethernet@ff800000 { - clocks = <&l4_mp_clk>, <&peri_emac_ptp_clk>; - clock-names = "stmmaceth", "ptp_ref"; - resets = <&rst EMAC0_RESET>, <&rst EMAC0_OCP_RESET>; -- reset-names = "stmmaceth", "ahb"; -+ reset-names = "stmmaceth", "stmmaceth-ocp"; - snps,axi-config = <&socfpga_axi_setup>; - status = "disabled"; - }; -@@ -460,7 +460,7 @@ gmac1: ethernet@ff802000 { - clocks = <&l4_mp_clk>, <&peri_emac_ptp_clk>; - clock-names = "stmmaceth", "ptp_ref"; - resets = <&rst EMAC1_RESET>, <&rst EMAC1_OCP_RESET>; -- reset-names = "stmmaceth", "ahb"; -+ reset-names = "stmmaceth", "stmmaceth-ocp"; - snps,axi-config = <&socfpga_axi_setup>; - status = "disabled"; - }; -@@ -480,7 +480,7 @@ gmac2: ethernet@ff804000 { - clocks = <&l4_mp_clk>, <&peri_emac_ptp_clk>; - clock-names = "stmmaceth", "ptp_ref"; - resets = <&rst EMAC2_RESET>, <&rst EMAC2_OCP_RESET>; -- reset-names = "stmmaceth", "ahb"; -+ reset-names = "stmmaceth", "stmmaceth-ocp"; - snps,axi-config = <&socfpga_axi_setup>; - status = "disabled"; - }; -diff --git a/arch/arm/boot/dts/mediatek/mt7623.dtsi b/arch/arm/boot/dts/mediatek/mt7623.dtsi -index f0b4a09004b317..9c5a52ce9351aa 100644 ---- a/arch/arm/boot/dts/mediatek/mt7623.dtsi -+++ b/arch/arm/boot/dts/mediatek/mt7623.dtsi -@@ -308,7 +308,7 @@ pwrap: pwrap@1000d000 { - clock-names = "spi", "wrap"; - }; - -- cir: cir@10013000 { -+ cir: ir-receiver@10013000 { - compatible = "mediatek,mt7623-cir"; - reg = <0 0x10013000 0 0x1000>; - interrupts = ; -diff --git a/arch/arm/boot/dts/microchip/at91-sama5d27_wlsom1_ek.dts b/arch/arm/boot/dts/microchip/at91-sama5d27_wlsom1_ek.dts -index e055b9e2fe3446..35a933eec5738f 100644 ---- a/arch/arm/boot/dts/microchip/at91-sama5d27_wlsom1_ek.dts -+++ b/arch/arm/boot/dts/microchip/at91-sama5d27_wlsom1_ek.dts -@@ -197,7 +197,7 @@ qspi1_flash: flash@0 { - - &sdmmc0 { - bus-width = <4>; -- mmc-ddr-3_3v; -+ no-1-8-v; - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_sdmmc0_default>; - status = "okay"; -diff --git a/arch/arm/boot/dts/st/stm32mp151.dtsi b/arch/arm/boot/dts/st/stm32mp151.dtsi -index aec7fa5ab5d8c6..fe79d5d40c1160 100644 ---- a/arch/arm/boot/dts/st/stm32mp151.dtsi -+++ b/arch/arm/boot/dts/st/stm32mp151.dtsi -@@ -1165,7 +1165,7 @@ ipcc: mailbox@4c001000 { - reg = <0x4c001000 0x400>; - st,proc-id = <0>; - interrupts-extended = -- <&exti 61 1>, -+ <&exti 61 IRQ_TYPE_LEVEL_HIGH>, - <&intc GIC_SPI 101 IRQ_TYPE_LEVEL_HIGH>; - interrupt-names = "rx", "tx"; - clocks = <&rcc IPCC>; -diff --git a/arch/arm/boot/dts/st/stm32mp15xx-dhcom-drc02.dtsi b/arch/arm/boot/dts/st/stm32mp15xx-dhcom-drc02.dtsi -index 35b1034aa3cf63..e4e114d8c3371e 100644 ---- a/arch/arm/boot/dts/st/stm32mp15xx-dhcom-drc02.dtsi -+++ b/arch/arm/boot/dts/st/stm32mp15xx-dhcom-drc02.dtsi -@@ -6,18 +6,6 @@ - #include - #include - --/ { -- aliases { -- serial0 = &uart4; -- serial1 = &usart3; -- serial2 = &uart8; -- }; -- -- chosen { -- stdout-path = "serial0:115200n8"; -- }; --}; -- - &adc { - status = "disabled"; - }; -diff --git a/arch/arm/boot/dts/st/stm32mp15xx-dhcom-pdk2.dtsi b/arch/arm/boot/dts/st/stm32mp15xx-dhcom-pdk2.dtsi -index 46b87a27d8b378..7050582837d58f 100644 ---- a/arch/arm/boot/dts/st/stm32mp15xx-dhcom-pdk2.dtsi -+++ b/arch/arm/boot/dts/st/stm32mp15xx-dhcom-pdk2.dtsi -@@ -7,16 +7,6 @@ - #include - - / { -- aliases { -- serial0 = &uart4; -- serial1 = &usart3; -- serial2 = &uart8; -- }; -- -- chosen { -- stdout-path = "serial0:115200n8"; -- }; -- - clk_ext_audio_codec: clock-codec { - compatible = "fixed-clock"; - #clock-cells = <0>; -diff --git a/arch/arm/boot/dts/st/stm32mp15xx-dhcom-picoitx.dtsi b/arch/arm/boot/dts/st/stm32mp15xx-dhcom-picoitx.dtsi -index abc595350e71a0..81743a448607b0 100644 ---- a/arch/arm/boot/dts/st/stm32mp15xx-dhcom-picoitx.dtsi -+++ b/arch/arm/boot/dts/st/stm32mp15xx-dhcom-picoitx.dtsi -@@ -7,16 +7,6 @@ - #include - - / { -- aliases { -- serial0 = &uart4; -- serial1 = &usart3; -- serial2 = &uart8; -- }; -- -- chosen { -- stdout-path = "serial0:115200n8"; -- }; -- - led { - compatible = "gpio-leds"; - -diff --git a/arch/arm/boot/dts/st/stm32mp15xx-dhcom-som.dtsi b/arch/arm/boot/dts/st/stm32mp15xx-dhcom-som.dtsi -index 74a11ccc5333f8..142d4a8731f8d4 100644 ---- a/arch/arm/boot/dts/st/stm32mp15xx-dhcom-som.dtsi -+++ b/arch/arm/boot/dts/st/stm32mp15xx-dhcom-som.dtsi -@@ -14,6 +14,13 @@ aliases { - ethernet1 = &ksz8851; - rtc0 = &hwrtc; - rtc1 = &rtc; -+ serial0 = &uart4; -+ serial1 = &uart8; -+ serial2 = &usart3; -+ }; -+ -+ chosen { -+ stdout-path = "serial0:115200n8"; - }; - - memory@c0000000 { -diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c -index 1a26af0fabc710..22ecaf09d00f96 100644 ---- a/arch/arm/mach-at91/pm.c -+++ b/arch/arm/mach-at91/pm.c -@@ -591,7 +591,21 @@ static int at91_suspend_finish(unsigned long val) - return 0; - } - --static void at91_pm_switch_ba_to_vbat(void) -+/** -+ * at91_pm_switch_ba_to_auto() - Configure Backup Unit Power Switch -+ * to automatic/hardware mode. -+ * -+ * The Backup Unit Power Switch can be managed either by software or hardware. -+ * Enabling hardware mode allows the automatic transition of power between -+ * VDDANA (or VDDIN33) and VDDBU (or VBAT, respectively), based on the -+ * availability of these power sources. -+ * -+ * If the Backup Unit Power Switch is already in automatic mode, no action is -+ * required. If it is in software-controlled mode, it is switched to automatic -+ * mode to enhance safety and eliminate the need for toggling between power -+ * sources. -+ */ -+static void at91_pm_switch_ba_to_auto(void) - { - unsigned int offset = offsetof(struct at91_pm_sfrbu_regs, pswbu); - unsigned int val; -@@ -602,24 +616,19 @@ static void at91_pm_switch_ba_to_vbat(void) - - val = readl(soc_pm.data.sfrbu + offset); - -- /* Already on VBAT. */ -- if (!(val & soc_pm.sfrbu_regs.pswbu.state)) -+ /* Already on auto/hardware. */ -+ if (!(val & soc_pm.sfrbu_regs.pswbu.ctrl)) - return; - -- val &= ~soc_pm.sfrbu_regs.pswbu.softsw; -- val |= soc_pm.sfrbu_regs.pswbu.key | soc_pm.sfrbu_regs.pswbu.ctrl; -+ val &= ~soc_pm.sfrbu_regs.pswbu.ctrl; -+ val |= soc_pm.sfrbu_regs.pswbu.key; - writel(val, soc_pm.data.sfrbu + offset); -- -- /* Wait for update. */ -- val = readl(soc_pm.data.sfrbu + offset); -- while (val & soc_pm.sfrbu_regs.pswbu.state) -- val = readl(soc_pm.data.sfrbu + offset); - } - - static void at91_pm_suspend(suspend_state_t state) - { - if (soc_pm.data.mode == AT91_PM_BACKUP) { -- at91_pm_switch_ba_to_vbat(); -+ at91_pm_switch_ba_to_auto(); - - cpu_suspend(0, at91_suspend_finish); - -diff --git a/arch/arm/mach-omap1/board-nokia770.c b/arch/arm/mach-omap1/board-nokia770.c -index 3312ef93355da7..a5bf5554800fe1 100644 ---- a/arch/arm/mach-omap1/board-nokia770.c -+++ b/arch/arm/mach-omap1/board-nokia770.c -@@ -289,7 +289,7 @@ static struct gpiod_lookup_table nokia770_irq_gpio_table = { - GPIO_LOOKUP("gpio-0-15", 15, "ads7846_irq", - GPIO_ACTIVE_HIGH), - /* GPIO used for retu IRQ */ -- GPIO_LOOKUP("gpio-48-63", 15, "retu_irq", -+ GPIO_LOOKUP("gpio-48-63", 14, "retu_irq", - GPIO_ACTIVE_HIGH), - /* GPIO used for tahvo IRQ */ - GPIO_LOOKUP("gpio-32-47", 8, "tahvo_irq", -diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts -index 50ed2e9f10ed08..6a69d005249441 100644 ---- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts -+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts -@@ -390,6 +390,8 @@ &sound { - &tcon0 { - pinctrl-names = "default"; - pinctrl-0 = <&lcd_rgb666_pins>; -+ assigned-clocks = <&ccu CLK_TCON0>; -+ assigned-clock-parents = <&ccu CLK_PLL_VIDEO0_2X>; - - status = "okay"; - }; -diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-teres-i.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-teres-i.dts -index 1128030e4c25b5..d3e5eed84f3648 100644 ---- a/arch/arm64/boot/dts/allwinner/sun50i-a64-teres-i.dts -+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-teres-i.dts -@@ -369,6 +369,8 @@ &sound { - &tcon0 { - pinctrl-names = "default"; - pinctrl-0 = <&lcd_rgb666_pins>; -+ assigned-clocks = <&ccu CLK_TCON0>; -+ assigned-clock-parents = <&ccu CLK_PLL_VIDEO0_2X>; - - status = "okay"; - }; -diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi -index 57ac18738c995b..7103298f6a1c27 100644 ---- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi -+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi -@@ -410,6 +410,8 @@ tcon0: lcd-controller@1c0c000 { - clock-names = "ahb", "tcon-ch0"; - clock-output-names = "tcon-data-clock"; - #clock-cells = <0>; -+ assigned-clocks = <&ccu CLK_TCON0>; -+ assigned-clock-parents = <&ccu CLK_PLL_MIPI>; - resets = <&ccu RST_BUS_TCON0>, <&ccu RST_BUS_LVDS>; - reset-names = "lcd", "lvds"; - -diff --git a/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi b/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi -index 111495622cacdc..8df919d39e5ba1 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi -@@ -938,7 +938,7 @@ pmic: pmic { - interrupt-controller; - #interrupt-cells = <2>; - -- clock: mt6397clock { -+ clock: clocks { - compatible = "mediatek,mt6397-clk"; - #clock-cells = <1>; - }; -@@ -949,11 +949,10 @@ pio6397: pinctrl { - #gpio-cells = <2>; - }; - -- regulator: mt6397regulator { -+ regulators { - compatible = "mediatek,mt6397-regulator"; - - mt6397_vpca15_reg: buck_vpca15 { -- regulator-compatible = "buck_vpca15"; - regulator-name = "vpca15"; - regulator-min-microvolt = < 700000>; - regulator-max-microvolt = <1350000>; -@@ -963,7 +962,6 @@ mt6397_vpca15_reg: buck_vpca15 { - }; - - mt6397_vpca7_reg: buck_vpca7 { -- regulator-compatible = "buck_vpca7"; - regulator-name = "vpca7"; - regulator-min-microvolt = < 700000>; - regulator-max-microvolt = <1350000>; -@@ -973,7 +971,6 @@ mt6397_vpca7_reg: buck_vpca7 { - }; - - mt6397_vsramca15_reg: buck_vsramca15 { -- regulator-compatible = "buck_vsramca15"; - regulator-name = "vsramca15"; - regulator-min-microvolt = < 700000>; - regulator-max-microvolt = <1350000>; -@@ -982,7 +979,6 @@ mt6397_vsramca15_reg: buck_vsramca15 { - }; - - mt6397_vsramca7_reg: buck_vsramca7 { -- regulator-compatible = "buck_vsramca7"; - regulator-name = "vsramca7"; - regulator-min-microvolt = < 700000>; - regulator-max-microvolt = <1350000>; -@@ -991,7 +987,6 @@ mt6397_vsramca7_reg: buck_vsramca7 { - }; - - mt6397_vcore_reg: buck_vcore { -- regulator-compatible = "buck_vcore"; - regulator-name = "vcore"; - regulator-min-microvolt = < 700000>; - regulator-max-microvolt = <1350000>; -@@ -1000,7 +995,6 @@ mt6397_vcore_reg: buck_vcore { - }; - - mt6397_vgpu_reg: buck_vgpu { -- regulator-compatible = "buck_vgpu"; - regulator-name = "vgpu"; - regulator-min-microvolt = < 700000>; - regulator-max-microvolt = <1350000>; -@@ -1009,7 +1003,6 @@ mt6397_vgpu_reg: buck_vgpu { - }; - - mt6397_vdrm_reg: buck_vdrm { -- regulator-compatible = "buck_vdrm"; - regulator-name = "vdrm"; - regulator-min-microvolt = <1200000>; - regulator-max-microvolt = <1400000>; -@@ -1018,7 +1011,6 @@ mt6397_vdrm_reg: buck_vdrm { - }; - - mt6397_vio18_reg: buck_vio18 { -- regulator-compatible = "buck_vio18"; - regulator-name = "vio18"; - regulator-min-microvolt = <1620000>; - regulator-max-microvolt = <1980000>; -@@ -1027,18 +1019,15 @@ mt6397_vio18_reg: buck_vio18 { - }; - - mt6397_vtcxo_reg: ldo_vtcxo { -- regulator-compatible = "ldo_vtcxo"; - regulator-name = "vtcxo"; - regulator-always-on; - }; - - mt6397_va28_reg: ldo_va28 { -- regulator-compatible = "ldo_va28"; - regulator-name = "va28"; - }; - - mt6397_vcama_reg: ldo_vcama { -- regulator-compatible = "ldo_vcama"; - regulator-name = "vcama"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; -@@ -1046,18 +1035,15 @@ mt6397_vcama_reg: ldo_vcama { - }; - - mt6397_vio28_reg: ldo_vio28 { -- regulator-compatible = "ldo_vio28"; - regulator-name = "vio28"; - regulator-always-on; - }; - - mt6397_vusb_reg: ldo_vusb { -- regulator-compatible = "ldo_vusb"; - regulator-name = "vusb"; - }; - - mt6397_vmc_reg: ldo_vmc { -- regulator-compatible = "ldo_vmc"; - regulator-name = "vmc"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <3300000>; -@@ -1065,7 +1051,6 @@ mt6397_vmc_reg: ldo_vmc { - }; - - mt6397_vmch_reg: ldo_vmch { -- regulator-compatible = "ldo_vmch"; - regulator-name = "vmch"; - regulator-min-microvolt = <3000000>; - regulator-max-microvolt = <3300000>; -@@ -1073,7 +1058,6 @@ mt6397_vmch_reg: ldo_vmch { - }; - - mt6397_vemc_3v3_reg: ldo_vemc3v3 { -- regulator-compatible = "ldo_vemc3v3"; - regulator-name = "vemc_3v3"; - regulator-min-microvolt = <3000000>; - regulator-max-microvolt = <3300000>; -@@ -1081,7 +1065,6 @@ mt6397_vemc_3v3_reg: ldo_vemc3v3 { - }; - - mt6397_vgp1_reg: ldo_vgp1 { -- regulator-compatible = "ldo_vgp1"; - regulator-name = "vcamd"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; -@@ -1089,7 +1072,6 @@ mt6397_vgp1_reg: ldo_vgp1 { - }; - - mt6397_vgp2_reg: ldo_vgp2 { -- regulator-compatible = "ldo_vgp2"; - regulator-name = "vcamio"; - regulator-min-microvolt = <3300000>; - regulator-max-microvolt = <3300000>; -@@ -1097,7 +1079,6 @@ mt6397_vgp2_reg: ldo_vgp2 { - }; - - mt6397_vgp3_reg: ldo_vgp3 { -- regulator-compatible = "ldo_vgp3"; - regulator-name = "vcamaf"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; -@@ -1105,7 +1086,6 @@ mt6397_vgp3_reg: ldo_vgp3 { - }; - - mt6397_vgp4_reg: ldo_vgp4 { -- regulator-compatible = "ldo_vgp4"; - regulator-name = "vgp4"; - regulator-min-microvolt = <1200000>; - regulator-max-microvolt = <3300000>; -@@ -1113,7 +1093,6 @@ mt6397_vgp4_reg: ldo_vgp4 { - }; - - mt6397_vgp5_reg: ldo_vgp5 { -- regulator-compatible = "ldo_vgp5"; - regulator-name = "vgp5"; - regulator-min-microvolt = <1200000>; - regulator-max-microvolt = <3000000>; -@@ -1121,7 +1100,6 @@ mt6397_vgp5_reg: ldo_vgp5 { - }; - - mt6397_vgp6_reg: ldo_vgp6 { -- regulator-compatible = "ldo_vgp6"; - regulator-name = "vgp6"; - regulator-min-microvolt = <3300000>; - regulator-max-microvolt = <3300000>; -@@ -1130,7 +1108,6 @@ mt6397_vgp6_reg: ldo_vgp6 { - }; - - mt6397_vibr_reg: ldo_vibr { -- regulator-compatible = "ldo_vibr"; - regulator-name = "vibr"; - regulator-min-microvolt = <1300000>; - regulator-max-microvolt = <3300000>; -@@ -1138,7 +1115,7 @@ mt6397_vibr_reg: ldo_vibr { - }; - }; - -- rtc: mt6397rtc { -+ rtc: rtc { - compatible = "mediatek,mt6397-rtc"; - }; - -diff --git a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts -index d258c80213b264..f6a70f22bd0c48 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts -+++ b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts -@@ -308,11 +308,10 @@ pmic: pmic { - interrupt-controller; - #interrupt-cells = <2>; - -- mt6397regulator: mt6397regulator { -+ regulators { - compatible = "mediatek,mt6397-regulator"; - - mt6397_vpca15_reg: buck_vpca15 { -- regulator-compatible = "buck_vpca15"; - regulator-name = "vpca15"; - regulator-min-microvolt = < 700000>; - regulator-max-microvolt = <1350000>; -@@ -321,7 +320,6 @@ mt6397_vpca15_reg: buck_vpca15 { - }; - - mt6397_vpca7_reg: buck_vpca7 { -- regulator-compatible = "buck_vpca7"; - regulator-name = "vpca7"; - regulator-min-microvolt = < 700000>; - regulator-max-microvolt = <1350000>; -@@ -330,7 +328,6 @@ mt6397_vpca7_reg: buck_vpca7 { - }; - - mt6397_vsramca15_reg: buck_vsramca15 { -- regulator-compatible = "buck_vsramca15"; - regulator-name = "vsramca15"; - regulator-min-microvolt = < 700000>; - regulator-max-microvolt = <1350000>; -@@ -339,7 +336,6 @@ mt6397_vsramca15_reg: buck_vsramca15 { - }; - - mt6397_vsramca7_reg: buck_vsramca7 { -- regulator-compatible = "buck_vsramca7"; - regulator-name = "vsramca7"; - regulator-min-microvolt = < 700000>; - regulator-max-microvolt = <1350000>; -@@ -348,7 +344,6 @@ mt6397_vsramca7_reg: buck_vsramca7 { - }; - - mt6397_vcore_reg: buck_vcore { -- regulator-compatible = "buck_vcore"; - regulator-name = "vcore"; - regulator-min-microvolt = < 700000>; - regulator-max-microvolt = <1350000>; -@@ -357,7 +352,6 @@ mt6397_vcore_reg: buck_vcore { - }; - - mt6397_vgpu_reg: buck_vgpu { -- regulator-compatible = "buck_vgpu"; - regulator-name = "vgpu"; - regulator-min-microvolt = < 700000>; - regulator-max-microvolt = <1350000>; -@@ -366,7 +360,6 @@ mt6397_vgpu_reg: buck_vgpu { - }; - - mt6397_vdrm_reg: buck_vdrm { -- regulator-compatible = "buck_vdrm"; - regulator-name = "vdrm"; - regulator-min-microvolt = <1200000>; - regulator-max-microvolt = <1400000>; -@@ -375,7 +368,6 @@ mt6397_vdrm_reg: buck_vdrm { - }; - - mt6397_vio18_reg: buck_vio18 { -- regulator-compatible = "buck_vio18"; - regulator-name = "vio18"; - regulator-min-microvolt = <1620000>; - regulator-max-microvolt = <1980000>; -@@ -384,19 +376,16 @@ mt6397_vio18_reg: buck_vio18 { - }; - - mt6397_vtcxo_reg: ldo_vtcxo { -- regulator-compatible = "ldo_vtcxo"; - regulator-name = "vtcxo"; - regulator-always-on; - }; - - mt6397_va28_reg: ldo_va28 { -- regulator-compatible = "ldo_va28"; - regulator-name = "va28"; - regulator-always-on; - }; - - mt6397_vcama_reg: ldo_vcama { -- regulator-compatible = "ldo_vcama"; - regulator-name = "vcama"; - regulator-min-microvolt = <1500000>; - regulator-max-microvolt = <2800000>; -@@ -404,18 +393,15 @@ mt6397_vcama_reg: ldo_vcama { - }; - - mt6397_vio28_reg: ldo_vio28 { -- regulator-compatible = "ldo_vio28"; - regulator-name = "vio28"; - regulator-always-on; - }; - - mt6397_vusb_reg: ldo_vusb { -- regulator-compatible = "ldo_vusb"; - regulator-name = "vusb"; - }; - - mt6397_vmc_reg: ldo_vmc { -- regulator-compatible = "ldo_vmc"; - regulator-name = "vmc"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <3300000>; -@@ -423,7 +409,6 @@ mt6397_vmc_reg: ldo_vmc { - }; - - mt6397_vmch_reg: ldo_vmch { -- regulator-compatible = "ldo_vmch"; - regulator-name = "vmch"; - regulator-min-microvolt = <3000000>; - regulator-max-microvolt = <3300000>; -@@ -431,7 +416,6 @@ mt6397_vmch_reg: ldo_vmch { - }; - - mt6397_vemc_3v3_reg: ldo_vemc3v3 { -- regulator-compatible = "ldo_vemc3v3"; - regulator-name = "vemc_3v3"; - regulator-min-microvolt = <3000000>; - regulator-max-microvolt = <3300000>; -@@ -439,7 +423,6 @@ mt6397_vemc_3v3_reg: ldo_vemc3v3 { - }; - - mt6397_vgp1_reg: ldo_vgp1 { -- regulator-compatible = "ldo_vgp1"; - regulator-name = "vcamd"; - regulator-min-microvolt = <1220000>; - regulator-max-microvolt = <3300000>; -@@ -447,7 +430,6 @@ mt6397_vgp1_reg: ldo_vgp1 { - }; - - mt6397_vgp2_reg: ldo_vgp2 { -- regulator-compatible = "ldo_vgp2"; - regulator-name = "vcamio"; - regulator-min-microvolt = <1000000>; - regulator-max-microvolt = <3300000>; -@@ -455,7 +437,6 @@ mt6397_vgp2_reg: ldo_vgp2 { - }; - - mt6397_vgp3_reg: ldo_vgp3 { -- regulator-compatible = "ldo_vgp3"; - regulator-name = "vcamaf"; - regulator-min-microvolt = <1200000>; - regulator-max-microvolt = <3300000>; -@@ -463,7 +444,6 @@ mt6397_vgp3_reg: ldo_vgp3 { - }; - - mt6397_vgp4_reg: ldo_vgp4 { -- regulator-compatible = "ldo_vgp4"; - regulator-name = "vgp4"; - regulator-min-microvolt = <1200000>; - regulator-max-microvolt = <3300000>; -@@ -471,7 +451,6 @@ mt6397_vgp4_reg: ldo_vgp4 { - }; - - mt6397_vgp5_reg: ldo_vgp5 { -- regulator-compatible = "ldo_vgp5"; - regulator-name = "vgp5"; - regulator-min-microvolt = <1200000>; - regulator-max-microvolt = <3000000>; -@@ -479,7 +458,6 @@ mt6397_vgp5_reg: ldo_vgp5 { - }; - - mt6397_vgp6_reg: ldo_vgp6 { -- regulator-compatible = "ldo_vgp6"; - regulator-name = "vgp6"; - regulator-min-microvolt = <1200000>; - regulator-max-microvolt = <3300000>; -@@ -487,7 +465,6 @@ mt6397_vgp6_reg: ldo_vgp6 { - }; - - mt6397_vibr_reg: ldo_vibr { -- regulator-compatible = "ldo_vibr"; - regulator-name = "vibr"; - regulator-min-microvolt = <1300000>; - regulator-max-microvolt = <3300000>; -diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts -index 9a166dccd727c7..8f95b7270c3fa8 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts -+++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts -@@ -27,6 +27,10 @@ &touchscreen { - hid-descr-addr = <0x0001>; - }; - -+&mt6358codec { -+ mediatek,dmic-mode = <1>; /* one-wire */ -+}; -+ - &qca_wifi { - qcom,ath10k-calibration-variant = "GO_DAMU"; - }; -diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-kenzo.dts b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-kenzo.dts -index 8fa89db03e6399..328294245a79d2 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-kenzo.dts -+++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-kenzo.dts -@@ -11,3 +11,18 @@ / { - model = "Google kenzo sku17 board"; - compatible = "google,juniper-sku17", "google,juniper", "mediatek,mt8183"; - }; -+ -+&i2c0 { -+ touchscreen@40 { -+ compatible = "hid-over-i2c"; -+ reg = <0x40>; -+ -+ pinctrl-names = "default"; -+ pinctrl-0 = <&touchscreen_pins>; -+ -+ interrupts-extended = <&pio 155 IRQ_TYPE_LEVEL_LOW>; -+ -+ post-power-on-delay-ms = <70>; -+ hid-descr-addr = <0x0001>; -+ }; -+}; -diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-willow.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-willow.dtsi -index 76d33540166f90..c942e461a177ef 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-willow.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-willow.dtsi -@@ -6,6 +6,21 @@ - /dts-v1/; - #include "mt8183-kukui-jacuzzi.dtsi" - -+&i2c0 { -+ touchscreen@40 { -+ compatible = "hid-over-i2c"; -+ reg = <0x40>; -+ -+ pinctrl-names = "default"; -+ pinctrl-0 = <&touchscreen_pins>; -+ -+ interrupts-extended = <&pio 155 IRQ_TYPE_LEVEL_LOW>; -+ -+ post-power-on-delay-ms = <70>; -+ hid-descr-addr = <0x0001>; -+ }; -+}; -+ - &i2c2 { - trackpad@2c { - compatible = "hid-over-i2c"; -diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi -index 629c4b7ecbc629..8e0575f8c1b275 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi -@@ -39,8 +39,6 @@ pp1800_mipibrdg: pp1800-mipibrdg { - pp3300_panel: pp3300-panel { - compatible = "regulator-fixed"; - regulator-name = "pp3300_panel"; -- regulator-min-microvolt = <3300000>; -- regulator-max-microvolt = <3300000>; - pinctrl-names = "default"; - pinctrl-0 = <&pp3300_panel_pins>; - -diff --git a/arch/arm64/boot/dts/mediatek/mt8183.dtsi b/arch/arm64/boot/dts/mediatek/mt8183.dtsi -index 8721a5ffca30a7..d1b6355148620b 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi -@@ -1026,7 +1026,8 @@ pwrap: pwrap@1000d000 { - }; - - keyboard: keyboard@10010000 { -- compatible = "mediatek,mt6779-keypad"; -+ compatible = "mediatek,mt8183-keypad", -+ "mediatek,mt6779-keypad"; - reg = <0 0x10010000 0 0x1000>; - interrupts = ; - clocks = <&clk26m>; -diff --git a/arch/arm64/boot/dts/mediatek/mt8186.dtsi b/arch/arm64/boot/dts/mediatek/mt8186.dtsi -index 2c184f9e0fc390..a63c59bc8e9782 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8186.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt8186.dtsi -@@ -1545,6 +1545,8 @@ ssusb0: usb@11201000 { - #address-cells = <2>; - #size-cells = <2>; - ranges; -+ wakeup-source; -+ mediatek,syscon-wakeup = <&pericfg 0x420 2>; - status = "disabled"; - - usb_host0: usb@11200000 { -@@ -1558,8 +1560,6 @@ usb_host0: usb@11200000 { - <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_XHCI>; - clock-names = "sys_ck", "ref_ck", "mcu_ck", "dma_ck", "xhci_ck"; - interrupts = ; -- mediatek,syscon-wakeup = <&pericfg 0x420 2>; -- wakeup-source; - status = "disabled"; - }; - }; -@@ -1611,6 +1611,8 @@ ssusb1: usb@11281000 { - #address-cells = <2>; - #size-cells = <2>; - ranges; -+ wakeup-source; -+ mediatek,syscon-wakeup = <&pericfg 0x424 2>; - status = "disabled"; - - usb_host1: usb@11280000 { -@@ -1624,8 +1626,6 @@ usb_host1: usb@11280000 { - <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_P1_XHCI>; - clock-names = "sys_ck", "ref_ck", "mcu_ck", "dma_ck","xhci_ck"; - interrupts = ; -- mediatek,syscon-wakeup = <&pericfg 0x424 2>; -- wakeup-source; - status = "disabled"; - }; - }; -diff --git a/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi b/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi -index 6b4b7a7cd35efb..54e3ec168fa9a4 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi -@@ -1391,7 +1391,6 @@ mt6315_6: pmic@6 { - - regulators { - mt6315_6_vbuck1: vbuck1 { -- regulator-compatible = "vbuck1"; - regulator-name = "Vbcpu"; - regulator-min-microvolt = <400000>; - regulator-max-microvolt = <1193750>; -@@ -1401,7 +1400,6 @@ mt6315_6_vbuck1: vbuck1 { - }; - - mt6315_6_vbuck3: vbuck3 { -- regulator-compatible = "vbuck3"; - regulator-name = "Vlcpu"; - regulator-min-microvolt = <400000>; - regulator-max-microvolt = <1193750>; -@@ -1418,7 +1416,6 @@ mt6315_7: pmic@7 { - - regulators { - mt6315_7_vbuck1: vbuck1 { -- regulator-compatible = "vbuck1"; - regulator-name = "Vgpu"; - regulator-min-microvolt = <400000>; - regulator-max-microvolt = <800000>; -diff --git a/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi b/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi -index b21663b46b5192..e3b30543c2c647 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi -@@ -1203,7 +1203,6 @@ mt6315@6 { - - regulators { - mt6315_6_vbuck1: vbuck1 { -- regulator-compatible = "vbuck1"; - regulator-name = "Vbcpu"; - regulator-min-microvolt = <400000>; - regulator-max-microvolt = <1193750>; -@@ -1221,7 +1220,6 @@ mt6315@7 { - - regulators { - mt6315_7_vbuck1: vbuck1 { -- regulator-compatible = "vbuck1"; - regulator-name = "Vgpu"; - regulator-min-microvolt = <400000>; - regulator-max-microvolt = <1193750>; -diff --git a/arch/arm64/boot/dts/mediatek/mt8195-demo.dts b/arch/arm64/boot/dts/mediatek/mt8195-demo.dts -index 9079e48aea23ea..f56aeb81c4168f 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8195-demo.dts -+++ b/arch/arm64/boot/dts/mediatek/mt8195-demo.dts -@@ -137,7 +137,6 @@ charger { - richtek,vinovp-microvolt = <14500000>; - - otg_vbus_regulator: usb-otg-vbus-regulator { -- regulator-compatible = "usb-otg-vbus"; - regulator-name = "usb-otg-vbus"; - regulator-min-microvolt = <4425000>; - regulator-max-microvolt = <5825000>; -@@ -149,7 +148,6 @@ regulator { - LDO_VIN3-supply = <&mt6360_buck2>; - - mt6360_buck1: buck1 { -- regulator-compatible = "BUCK1"; - regulator-name = "mt6360,buck1"; - regulator-min-microvolt = <300000>; - regulator-max-microvolt = <1300000>; -@@ -160,7 +158,6 @@ MT6360_OPMODE_LP - }; - - mt6360_buck2: buck2 { -- regulator-compatible = "BUCK2"; - regulator-name = "mt6360,buck2"; - regulator-min-microvolt = <300000>; - regulator-max-microvolt = <1300000>; -@@ -171,7 +168,6 @@ MT6360_OPMODE_LP - }; - - mt6360_ldo1: ldo1 { -- regulator-compatible = "LDO1"; - regulator-name = "mt6360,ldo1"; - regulator-min-microvolt = <1200000>; - regulator-max-microvolt = <3600000>; -@@ -180,7 +176,6 @@ mt6360_ldo1: ldo1 { - }; - - mt6360_ldo2: ldo2 { -- regulator-compatible = "LDO2"; - regulator-name = "mt6360,ldo2"; - regulator-min-microvolt = <1200000>; - regulator-max-microvolt = <3600000>; -@@ -189,7 +184,6 @@ mt6360_ldo2: ldo2 { - }; - - mt6360_ldo3: ldo3 { -- regulator-compatible = "LDO3"; - regulator-name = "mt6360,ldo3"; - regulator-min-microvolt = <1200000>; - regulator-max-microvolt = <3600000>; -@@ -198,7 +192,6 @@ mt6360_ldo3: ldo3 { - }; - - mt6360_ldo5: ldo5 { -- regulator-compatible = "LDO5"; - regulator-name = "mt6360,ldo5"; - regulator-min-microvolt = <2700000>; - regulator-max-microvolt = <3600000>; -@@ -207,7 +200,6 @@ mt6360_ldo5: ldo5 { - }; - - mt6360_ldo6: ldo6 { -- regulator-compatible = "LDO6"; - regulator-name = "mt6360,ldo6"; - regulator-min-microvolt = <500000>; - regulator-max-microvolt = <2100000>; -@@ -216,7 +208,6 @@ mt6360_ldo6: ldo6 { - }; - - mt6360_ldo7: ldo7 { -- regulator-compatible = "LDO7"; - regulator-name = "mt6360,ldo7"; - regulator-min-microvolt = <500000>; - regulator-max-microvolt = <2100000>; -diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi -index 5a087404ccc2d9..7ba30209ba9a9a 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi -@@ -1572,9 +1572,6 @@ pcie1: pcie@112f8000 { - phy-names = "pcie-phy"; - power-domains = <&spm MT8195_POWER_DOMAIN_PCIE_MAC_P1>; - -- resets = <&infracfg_ao MT8195_INFRA_RST2_PCIE_P1_SWRST>; -- reset-names = "mac"; -- - #interrupt-cells = <1>; - interrupt-map-mask = <0 0 0 7>; - interrupt-map = <0 0 0 1 &pcie_intc1 0>, -@@ -2680,7 +2677,7 @@ larb20: larb@1b010000 { - }; - - ovl0: ovl@1c000000 { -- compatible = "mediatek,mt8195-disp-ovl", "mediatek,mt8183-disp-ovl"; -+ compatible = "mediatek,mt8195-disp-ovl"; - reg = <0 0x1c000000 0 0x1000>; - interrupts = ; - power-domains = <&spm MT8195_POWER_DOMAIN_VDOSYS0>; -diff --git a/arch/arm64/boot/dts/mediatek/mt8365.dtsi b/arch/arm64/boot/dts/mediatek/mt8365.dtsi -index 413496c9206954..62c5b50d3c5fbe 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8365.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt8365.dtsi -@@ -334,7 +334,8 @@ pwrap: pwrap@1000d000 { - }; - - keypad: keypad@10010000 { -- compatible = "mediatek,mt6779-keypad"; -+ compatible = "mediatek,mt8365-keypad", -+ "mediatek,mt6779-keypad"; - reg = <0 0x10010000 0 0x1000>; - wakeup-source; - interrupts = ; -diff --git a/arch/arm64/boot/dts/mediatek/mt8516.dtsi b/arch/arm64/boot/dts/mediatek/mt8516.dtsi -index 9cbd6dd8f671aa..6b89505a64379f 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8516.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt8516.dtsi -@@ -144,10 +144,10 @@ reserved-memory { - #size-cells = <2>; - ranges; - -- /* 128 KiB reserved for ARM Trusted Firmware (BL31) */ -+ /* 192 KiB reserved for ARM Trusted Firmware (BL31) */ - bl31_secmon_reserved: secmon@43000000 { - no-map; -- reg = <0 0x43000000 0 0x20000>; -+ reg = <0 0x43000000 0 0x30000>; - }; - }; - -@@ -206,7 +206,7 @@ watchdog@10007000 { - compatible = "mediatek,mt8516-wdt", - "mediatek,mt6589-wdt"; - reg = <0 0x10007000 0 0x1000>; -- interrupts = ; -+ interrupts = ; - #reset-cells = <1>; - }; - -@@ -268,7 +268,7 @@ gic: interrupt-controller@10310000 { - interrupt-parent = <&gic>; - interrupt-controller; - reg = <0 0x10310000 0 0x1000>, -- <0 0x10320000 0 0x1000>, -+ <0 0x1032f000 0 0x2000>, - <0 0x10340000 0 0x2000>, - <0 0x10360000 0 0x2000>; - interrupts = , - <0 0x11000180 0 0x80>; - interrupts = ; -+ clock-div = <2>; - clocks = <&topckgen CLK_TOP_I2C0>, - <&topckgen CLK_TOP_APDMA>; - clock-names = "main", "dma"; -@@ -358,6 +359,7 @@ i2c1: i2c@1100a000 { - reg = <0 0x1100a000 0 0x90>, - <0 0x11000200 0 0x80>; - interrupts = ; -+ clock-div = <2>; - clocks = <&topckgen CLK_TOP_I2C1>, - <&topckgen CLK_TOP_APDMA>; - clock-names = "main", "dma"; -@@ -372,6 +374,7 @@ i2c2: i2c@1100b000 { - reg = <0 0x1100b000 0 0x90>, - <0 0x11000280 0 0x80>; - interrupts = ; -+ clock-div = <2>; - clocks = <&topckgen CLK_TOP_I2C2>, - <&topckgen CLK_TOP_APDMA>; - clock-names = "main", "dma"; -diff --git a/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi b/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi -index ec8dfb3d1c6d69..a356db5fcc5f3c 100644 ---- a/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi -+++ b/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi -@@ -47,7 +47,6 @@ key-volume-down { - }; - - &i2c0 { -- clock-div = <2>; - pinctrl-names = "default"; - pinctrl-0 = <&i2c0_pins_a>; - status = "okay"; -@@ -156,7 +155,6 @@ cam-pwdn-hog { - }; - - &i2c2 { -- clock-div = <2>; - pinctrl-names = "default"; - pinctrl-0 = <&i2c2_pins_a>; - status = "okay"; -diff --git a/arch/arm64/boot/dts/nvidia/tegra234.dtsi b/arch/arm64/boot/dts/nvidia/tegra234.dtsi -index ac69eacf8a6ba9..be30072fb7471f 100644 ---- a/arch/arm64/boot/dts/nvidia/tegra234.dtsi -+++ b/arch/arm64/boot/dts/nvidia/tegra234.dtsi -@@ -1794,7 +1794,7 @@ spi@c260000 { - assigned-clock-parents = <&bpmp TEGRA234_CLK_PLLP_OUT0>; - resets = <&bpmp TEGRA234_RESET_SPI2>; - reset-names = "spi"; -- dmas = <&gpcdma 19>, <&gpcdma 19>; -+ dmas = <&gpcdma 16>, <&gpcdma 16>; - dma-names = "rx", "tx"; - dma-coherent; - status = "disabled"; -diff --git a/arch/arm64/boot/dts/qcom/Makefile b/arch/arm64/boot/dts/qcom/Makefile -index 2cca20563a1d69..0da076db0418d8 100644 ---- a/arch/arm64/boot/dts/qcom/Makefile -+++ b/arch/arm64/boot/dts/qcom/Makefile -@@ -171,6 +171,9 @@ dtb-$(CONFIG_ARCH_QCOM) += sdm845-cheza-r1.dtb - dtb-$(CONFIG_ARCH_QCOM) += sdm845-cheza-r2.dtb - dtb-$(CONFIG_ARCH_QCOM) += sdm845-cheza-r3.dtb - dtb-$(CONFIG_ARCH_QCOM) += sdm845-db845c.dtb -+ -+sdm845-db845c-navigation-mezzanine-dtbs := sdm845-db845c.dtb sdm845-db845c-navigation-mezzanine.dtbo -+ - dtb-$(CONFIG_ARCH_QCOM) += sdm845-db845c-navigation-mezzanine.dtb - dtb-$(CONFIG_ARCH_QCOM) += sdm845-lg-judyln.dtb - dtb-$(CONFIG_ARCH_QCOM) += sdm845-lg-judyp.dtb -diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi -index 961ceb83a91fae..6f5f96853ba1c2 100644 ---- a/arch/arm64/boot/dts/qcom/msm8916.dtsi -+++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi -@@ -104,7 +104,7 @@ xo_board: xo-board { - sleep_clk: sleep-clk { - compatible = "fixed-clock"; - #clock-cells = <0>; -- clock-frequency = <32768>; -+ clock-frequency = <32764>; - }; - }; - -diff --git a/arch/arm64/boot/dts/qcom/msm8939.dtsi b/arch/arm64/boot/dts/qcom/msm8939.dtsi -index 3fd64cafe99c5f..c844e01f9aa15b 100644 ---- a/arch/arm64/boot/dts/qcom/msm8939.dtsi -+++ b/arch/arm64/boot/dts/qcom/msm8939.dtsi -@@ -33,7 +33,7 @@ xo_board: xo-board { - sleep_clk: sleep-clk { - compatible = "fixed-clock"; - #clock-cells = <0>; -- clock-frequency = <32768>; -+ clock-frequency = <32764>; - }; - }; - -diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi -index c3262571520d3e..a7f9259dda6de3 100644 ---- a/arch/arm64/boot/dts/qcom/msm8994.dtsi -+++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi -@@ -34,7 +34,7 @@ xo_board: xo-board { - sleep_clk: sleep-clk { - compatible = "fixed-clock"; - #clock-cells = <0>; -- clock-frequency = <32768>; -+ clock-frequency = <32764>; - clock-output-names = "sleep_clk"; - }; - }; -@@ -437,6 +437,15 @@ usb3: usb@f92f8800 { - #size-cells = <1>; - ranges; - -+ interrupts = , -+ , -+ , -+ ; -+ interrupt-names = "pwr_event", -+ "qusb2_phy", -+ "hs_phy_irq", -+ "ss_phy_irq"; -+ - clocks = <&gcc GCC_USB30_MASTER_CLK>, - <&gcc GCC_SYS_NOC_USB3_AXI_CLK>, - <&gcc GCC_USB30_SLEEP_CLK>, -diff --git a/arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts b/arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts -index f8e9d90afab000..dbad8f57f2fa34 100644 ---- a/arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts -+++ b/arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts -@@ -64,7 +64,7 @@ led@0 { - }; - - led@1 { -- reg = <0>; -+ reg = <1>; - chan-name = "button-backlight1"; - led-cur = /bits/ 8 <0x32>; - max-cur = /bits/ 8 <0xc8>; -diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi -index 1f7cbb35886db5..70ef8c83e7b9f3 100644 ---- a/arch/arm64/boot/dts/qcom/msm8996.dtsi -+++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi -@@ -3046,9 +3046,14 @@ usb3: usb@6af8800 { - #size-cells = <1>; - ranges; - -- interrupts = , -+ interrupts = , -+ , -+ , - ; -- interrupt-names = "hs_phy_irq", "ss_phy_irq"; -+ interrupt-names = "pwr_event", -+ "qusb2_phy", -+ "hs_phy_irq", -+ "ss_phy_irq"; - - clocks = <&gcc GCC_SYS_NOC_USB3_AXI_CLK>, - <&gcc GCC_USB30_MASTER_CLK>, -diff --git a/arch/arm64/boot/dts/qcom/pm6150.dtsi b/arch/arm64/boot/dts/qcom/pm6150.dtsi -index 7d4d1f2767ed6a..7ae14c53ca8fb3 100644 ---- a/arch/arm64/boot/dts/qcom/pm6150.dtsi -+++ b/arch/arm64/boot/dts/qcom/pm6150.dtsi -@@ -13,7 +13,7 @@ / { - thermal-zones { - pm6150_thermal: pm6150-thermal { - polling-delay-passive = <100>; -- polling-delay = <0>; -+ - thermal-sensors = <&pm6150_temp>; - - trips { -diff --git a/arch/arm64/boot/dts/qcom/pm6150l.dtsi b/arch/arm64/boot/dts/qcom/pm6150l.dtsi -index d13a1ab7c20b34..a20e9b9993b28f 100644 ---- a/arch/arm64/boot/dts/qcom/pm6150l.dtsi -+++ b/arch/arm64/boot/dts/qcom/pm6150l.dtsi -@@ -10,9 +10,6 @@ - / { - thermal-zones { - pm6150l-thermal { -- polling-delay-passive = <0>; -- polling-delay = <0>; -- - thermal-sensors = <&pm6150l_temp>; - - trips { -diff --git a/arch/arm64/boot/dts/qcom/qcs404.dtsi b/arch/arm64/boot/dts/qcom/qcs404.dtsi -index 2721f32dfb7104..cbe469cc159e92 100644 ---- a/arch/arm64/boot/dts/qcom/qcs404.dtsi -+++ b/arch/arm64/boot/dts/qcom/qcs404.dtsi -@@ -28,7 +28,7 @@ xo_board: xo-board { - sleep_clk: sleep-clk { - compatible = "fixed-clock"; - #clock-cells = <0>; -- clock-frequency = <32768>; -+ clock-frequency = <32764>; - }; - }; - -diff --git a/arch/arm64/boot/dts/qcom/qdu1000-idp.dts b/arch/arm64/boot/dts/qcom/qdu1000-idp.dts -index 5a25cdec969eb1..409f06978931af 100644 ---- a/arch/arm64/boot/dts/qcom/qdu1000-idp.dts -+++ b/arch/arm64/boot/dts/qcom/qdu1000-idp.dts -@@ -31,7 +31,7 @@ xo_board: xo-board-clk { - - sleep_clk: sleep-clk { - compatible = "fixed-clock"; -- clock-frequency = <32000>; -+ clock-frequency = <32764>; - #clock-cells = <0>; - }; - }; -diff --git a/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts b/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts -index 5def8c1154ceb3..331b6a76560db4 100644 ---- a/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts -+++ b/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts -@@ -492,7 +492,7 @@ can@0 { - }; - - &sleep_clk { -- clock-frequency = <32000>; -+ clock-frequency = <32764>; - }; - - &tlmm { -diff --git a/arch/arm64/boot/dts/qcom/qru1000-idp.dts b/arch/arm64/boot/dts/qcom/qru1000-idp.dts -index 2a862c83309e70..a3a7dcbc5e6d29 100644 ---- a/arch/arm64/boot/dts/qcom/qru1000-idp.dts -+++ b/arch/arm64/boot/dts/qcom/qru1000-idp.dts -@@ -31,7 +31,7 @@ xo_board: xo-board-clk { - - sleep_clk: sleep-clk { - compatible = "fixed-clock"; -- clock-frequency = <32000>; -+ clock-frequency = <32764>; - #clock-cells = <0>; - }; - }; -diff --git a/arch/arm64/boot/dts/qcom/sa8775p-ride.dts b/arch/arm64/boot/dts/qcom/sa8775p-ride.dts -index 81a7eeb9cfcd27..2e87fd760dbdde 100644 ---- a/arch/arm64/boot/dts/qcom/sa8775p-ride.dts -+++ b/arch/arm64/boot/dts/qcom/sa8775p-ride.dts -@@ -5,828 +5,43 @@ - - /dts-v1/; - --#include --#include -- --#include "sa8775p.dtsi" --#include "sa8775p-pmics.dtsi" -+#include "sa8775p-ride.dtsi" - - / { - model = "Qualcomm SA8775P Ride"; - compatible = "qcom,sa8775p-ride", "qcom,sa8775p"; -- -- aliases { -- ethernet0 = ðernet0; -- ethernet1 = ðernet1; -- i2c11 = &i2c11; -- i2c18 = &i2c18; -- serial0 = &uart10; -- serial1 = &uart12; -- serial2 = &uart17; -- spi16 = &spi16; -- ufshc1 = &ufs_mem_hc; -- }; -- -- chosen { -- stdout-path = "serial0:115200n8"; -- }; --}; -- --&apps_rsc { -- regulators-0 { -- compatible = "qcom,pmm8654au-rpmh-regulators"; -- qcom,pmic-id = "a"; -- -- vreg_s4a: smps4 { -- regulator-name = "vreg_s4a"; -- regulator-min-microvolt = <1800000>; -- regulator-max-microvolt = <1816000>; -- regulator-initial-mode = ; -- }; -- -- vreg_s5a: smps5 { -- regulator-name = "vreg_s5a"; -- regulator-min-microvolt = <1850000>; -- regulator-max-microvolt = <1996000>; -- regulator-initial-mode = ; -- }; -- -- vreg_s9a: smps9 { -- regulator-name = "vreg_s9a"; -- regulator-min-microvolt = <535000>; -- regulator-max-microvolt = <1120000>; -- regulator-initial-mode = ; -- }; -- -- vreg_l4a: ldo4 { -- regulator-name = "vreg_l4a"; -- regulator-min-microvolt = <788000>; -- regulator-max-microvolt = <1050000>; -- regulator-initial-mode = ; -- regulator-allow-set-load; -- regulator-allowed-modes = ; -- }; -- -- vreg_l5a: ldo5 { -- regulator-name = "vreg_l5a"; -- regulator-min-microvolt = <870000>; -- regulator-max-microvolt = <950000>; -- regulator-initial-mode = ; -- regulator-allow-set-load; -- regulator-allowed-modes = ; -- }; -- -- vreg_l6a: ldo6 { -- regulator-name = "vreg_l6a"; -- regulator-min-microvolt = <870000>; -- regulator-max-microvolt = <970000>; -- regulator-initial-mode = ; -- regulator-allow-set-load; -- regulator-allowed-modes = ; -- }; -- -- vreg_l7a: ldo7 { -- regulator-name = "vreg_l7a"; -- regulator-min-microvolt = <720000>; -- regulator-max-microvolt = <950000>; -- regulator-initial-mode = ; -- regulator-allow-set-load; -- regulator-allowed-modes = ; -- }; -- -- vreg_l8a: ldo8 { -- regulator-name = "vreg_l8a"; -- regulator-min-microvolt = <2504000>; -- regulator-max-microvolt = <3300000>; -- regulator-initial-mode = ; -- regulator-allow-set-load; -- regulator-allowed-modes = ; -- }; -- -- vreg_l9a: ldo9 { -- regulator-name = "vreg_l9a"; -- regulator-min-microvolt = <2970000>; -- regulator-max-microvolt = <3544000>; -- regulator-initial-mode = ; -- regulator-allow-set-load; -- regulator-allowed-modes = ; -- }; -- }; -- -- regulators-1 { -- compatible = "qcom,pmm8654au-rpmh-regulators"; -- qcom,pmic-id = "c"; -- -- vreg_l1c: ldo1 { -- regulator-name = "vreg_l1c"; -- regulator-min-microvolt = <1140000>; -- regulator-max-microvolt = <1260000>; -- regulator-initial-mode = ; -- regulator-allow-set-load; -- regulator-allowed-modes = ; -- }; -- -- vreg_l2c: ldo2 { -- regulator-name = "vreg_l2c"; -- regulator-min-microvolt = <900000>; -- regulator-max-microvolt = <1100000>; -- regulator-initial-mode = ; -- regulator-allow-set-load; -- regulator-allowed-modes = ; -- }; -- -- vreg_l3c: ldo3 { -- regulator-name = "vreg_l3c"; -- regulator-min-microvolt = <1100000>; -- regulator-max-microvolt = <1300000>; -- regulator-initial-mode = ; -- regulator-allow-set-load; -- regulator-allowed-modes = ; -- }; -- -- vreg_l4c: ldo4 { -- regulator-name = "vreg_l4c"; -- regulator-min-microvolt = <1200000>; -- regulator-max-microvolt = <1200000>; -- regulator-initial-mode = ; -- /* -- * FIXME: This should have regulator-allow-set-load but -- * we're getting an over-current fault from the PMIC -- * when switching to LPM. -- */ -- }; -- -- vreg_l5c: ldo5 { -- regulator-name = "vreg_l5c"; -- regulator-min-microvolt = <1100000>; -- regulator-max-microvolt = <1300000>; -- regulator-initial-mode = ; -- regulator-allow-set-load; -- regulator-allowed-modes = ; -- }; -- -- vreg_l6c: ldo6 { -- regulator-name = "vreg_l6c"; -- regulator-min-microvolt = <1620000>; -- regulator-max-microvolt = <1980000>; -- regulator-initial-mode = ; -- regulator-allow-set-load; -- regulator-allowed-modes = ; -- }; -- -- vreg_l7c: ldo7 { -- regulator-name = "vreg_l7c"; -- regulator-min-microvolt = <1620000>; -- regulator-max-microvolt = <2000000>; -- regulator-initial-mode = ; -- regulator-allow-set-load; -- regulator-allowed-modes = ; -- }; -- -- vreg_l8c: ldo8 { -- regulator-name = "vreg_l8c"; -- regulator-min-microvolt = <2400000>; -- regulator-max-microvolt = <3300000>; -- regulator-initial-mode = ; -- regulator-allow-set-load; -- regulator-allowed-modes = ; -- }; -- -- vreg_l9c: ldo9 { -- regulator-name = "vreg_l9c"; -- regulator-min-microvolt = <1650000>; -- regulator-max-microvolt = <2700000>; -- regulator-initial-mode = ; -- regulator-allow-set-load; -- regulator-allowed-modes = ; -- }; -- }; -- -- regulators-2 { -- compatible = "qcom,pmm8654au-rpmh-regulators"; -- qcom,pmic-id = "e"; -- -- vreg_s4e: smps4 { -- regulator-name = "vreg_s4e"; -- regulator-min-microvolt = <970000>; -- regulator-max-microvolt = <1520000>; -- regulator-initial-mode = ; -- }; -- -- vreg_s7e: smps7 { -- regulator-name = "vreg_s7e"; -- regulator-min-microvolt = <1010000>; -- regulator-max-microvolt = <1170000>; -- regulator-initial-mode = ; -- }; -- -- vreg_s9e: smps9 { -- regulator-name = "vreg_s9e"; -- regulator-min-microvolt = <300000>; -- regulator-max-microvolt = <570000>; -- regulator-initial-mode = ; -- }; -- -- vreg_l6e: ldo6 { -- regulator-name = "vreg_l6e"; -- regulator-min-microvolt = <1280000>; -- regulator-max-microvolt = <1450000>; -- regulator-initial-mode = ; -- regulator-allow-set-load; -- regulator-allowed-modes = ; -- }; -- -- vreg_l8e: ldo8 { -- regulator-name = "vreg_l8e"; -- regulator-min-microvolt = <1800000>; -- regulator-max-microvolt = <1950000>; -- regulator-initial-mode = ; -- regulator-allow-set-load; -- regulator-allowed-modes = ; -- }; -- }; - }; - - ðernet0 { - phy-mode = "sgmii"; -- phy-handle = <&sgmii_phy0>; -- -- pinctrl-0 = <ðernet0_default>; -- pinctrl-names = "default"; -- -- snps,mtl-rx-config = <&mtl_rx_setup>; -- snps,mtl-tx-config = <&mtl_tx_setup>; -- snps,ps-speed = <1000>; -- -- status = "okay"; -- -- mdio { -- compatible = "snps,dwmac-mdio"; -- #address-cells = <1>; -- #size-cells = <0>; -- -- sgmii_phy0: phy@8 { -- compatible = "ethernet-phy-id0141.0dd4"; -- reg = <0x8>; -- device_type = "ethernet-phy"; -- reset-gpios = <&pmm8654au_2_gpios 8 GPIO_ACTIVE_LOW>; -- reset-assert-us = <11000>; -- reset-deassert-us = <70000>; -- }; -- -- sgmii_phy1: phy@a { -- compatible = "ethernet-phy-id0141.0dd4"; -- reg = <0xa>; -- device_type = "ethernet-phy"; -- reset-gpios = <&pmm8654au_2_gpios 9 GPIO_ACTIVE_LOW>; -- reset-assert-us = <11000>; -- reset-deassert-us = <70000>; -- }; -- }; -- -- mtl_rx_setup: rx-queues-config { -- snps,rx-queues-to-use = <4>; -- snps,rx-sched-sp; -- -- queue0 { -- snps,dcb-algorithm; -- snps,map-to-dma-channel = <0x0>; -- snps,route-up; -- snps,priority = <0x1>; -- }; -- -- queue1 { -- snps,dcb-algorithm; -- snps,map-to-dma-channel = <0x1>; -- snps,route-ptp; -- }; -- -- queue2 { -- snps,avb-algorithm; -- snps,map-to-dma-channel = <0x2>; -- snps,route-avcp; -- }; -- -- queue3 { -- snps,avb-algorithm; -- snps,map-to-dma-channel = <0x3>; -- snps,priority = <0xc>; -- }; -- }; -- -- mtl_tx_setup: tx-queues-config { -- snps,tx-queues-to-use = <4>; -- snps,tx-sched-sp; -- -- queue0 { -- snps,dcb-algorithm; -- }; -- -- queue1 { -- snps,dcb-algorithm; -- }; -- -- queue2 { -- snps,avb-algorithm; -- snps,send_slope = <0x1000>; -- snps,idle_slope = <0x1000>; -- snps,high_credit = <0x3e800>; -- snps,low_credit = <0xffc18000>; -- }; -- -- queue3 { -- snps,avb-algorithm; -- snps,send_slope = <0x1000>; -- snps,idle_slope = <0x1000>; -- snps,high_credit = <0x3e800>; -- snps,low_credit = <0xffc18000>; -- }; -- }; - }; - - ðernet1 { - phy-mode = "sgmii"; -- phy-handle = <&sgmii_phy1>; -- -- snps,mtl-rx-config = <&mtl_rx_setup1>; -- snps,mtl-tx-config = <&mtl_tx_setup1>; -- snps,ps-speed = <1000>; -- -- status = "okay"; -- -- mtl_rx_setup1: rx-queues-config { -- snps,rx-queues-to-use = <4>; -- snps,rx-sched-sp; -- -- queue0 { -- snps,dcb-algorithm; -- snps,map-to-dma-channel = <0x0>; -- snps,route-up; -- snps,priority = <0x1>; -- }; -- -- queue1 { -- snps,dcb-algorithm; -- snps,map-to-dma-channel = <0x1>; -- snps,route-ptp; -- }; -- -- queue2 { -- snps,avb-algorithm; -- snps,map-to-dma-channel = <0x2>; -- snps,route-avcp; -- }; -- -- queue3 { -- snps,avb-algorithm; -- snps,map-to-dma-channel = <0x3>; -- snps,priority = <0xc>; -- }; -- }; -- -- mtl_tx_setup1: tx-queues-config { -- snps,tx-queues-to-use = <4>; -- snps,tx-sched-sp; -- -- queue0 { -- snps,dcb-algorithm; -- }; -- -- queue1 { -- snps,dcb-algorithm; -- }; -- -- queue2 { -- snps,avb-algorithm; -- snps,send_slope = <0x1000>; -- snps,idle_slope = <0x1000>; -- snps,high_credit = <0x3e800>; -- snps,low_credit = <0xffc18000>; -- }; -- -- queue3 { -- snps,avb-algorithm; -- snps,send_slope = <0x1000>; -- snps,idle_slope = <0x1000>; -- snps,high_credit = <0x3e800>; -- snps,low_credit = <0xffc18000>; -- }; -- }; --}; -- --&i2c11 { -- clock-frequency = <400000>; -- pinctrl-0 = <&qup_i2c11_default>; -- pinctrl-names = "default"; -- status = "okay"; --}; -- --&i2c18 { -- clock-frequency = <400000>; -- pinctrl-0 = <&qup_i2c18_default>; -- pinctrl-names = "default"; -- status = "okay"; --}; -- --&pmm8654au_0_gpios { -- gpio-line-names = "DS_EN", -- "POFF_COMPLETE", -- "UFS0_VER_ID", -- "FAST_POFF", -- "DBU1_PON_DONE", -- "AOSS_SLEEP", -- "CAM_DES0_EN", -- "CAM_DES1_EN", -- "CAM_DES2_EN", -- "CAM_DES3_EN", -- "UEFI", -- "ANALOG_PON_OPT"; --}; -- --&pmm8654au_1_gpios { -- gpio-line-names = "PMIC_C_ID0", -- "PMIC_C_ID1", -- "UFS1_VER_ID", -- "IPA_PWR", -- "", -- "WLAN_DBU4_EN", -- "WLAN_EN", -- "BT_EN", -- "USB2_PWR_EN", -- "USB2_FAULT"; -- -- usb2_en_state: usb2-en-state { -- pins = "gpio9"; -- function = "normal"; -- output-high; -- power-source = <0>; -- }; --}; -- --&pmm8654au_2_gpios { -- gpio-line-names = "PMIC_E_ID0", -- "PMIC_E_ID1", -- "USB0_PWR_EN", -- "USB0_FAULT", -- "SENSOR_IRQ_1", -- "SENSOR_IRQ_2", -- "SENSOR_RST", -- "SGMIIO0_RST", -- "SGMIIO1_RST", -- "USB1_PWR_ENABLE", -- "USB1_FAULT", -- "VMON_SPX8"; -- -- usb0_en_state: usb0-en-state { -- pins = "gpio3"; -- function = "normal"; -- output-high; -- power-source = <0>; -- }; -- -- usb1_en_state: usb1-en-state { -- pins = "gpio10"; -- function = "normal"; -- output-high; -- power-source = <0>; -- }; --}; -- --&pmm8654au_3_gpios { -- gpio-line-names = "PMIC_G_ID0", -- "PMIC_G_ID1", -- "GNSS_RST", -- "GNSS_EN", -- "GNSS_BOOT_MODE"; --}; -- --&qupv3_id_1 { -- status = "okay"; --}; -- --&qupv3_id_2 { -- status = "okay"; - }; - --&serdes0 { -- phy-supply = <&vreg_l5a>; -- status = "okay"; --}; -- --&serdes1 { -- phy-supply = <&vreg_l5a>; -- status = "okay"; --}; -- --&sleep_clk { -- clock-frequency = <32764>; --}; -- --&spi16 { -- pinctrl-0 = <&qup_spi16_default>; -- pinctrl-names = "default"; -- status = "okay"; --}; -- --&tlmm { -- ethernet0_default: ethernet0-default-state { -- ethernet0_mdc: ethernet0-mdc-pins { -- pins = "gpio8"; -- function = "emac0_mdc"; -- drive-strength = <16>; -- bias-pull-up; -- }; -- -- ethernet0_mdio: ethernet0-mdio-pins { -- pins = "gpio9"; -- function = "emac0_mdio"; -- drive-strength = <16>; -- bias-pull-up; -- }; -- }; -- -- qup_uart10_default: qup-uart10-state { -- pins = "gpio46", "gpio47"; -- function = "qup1_se3"; -- }; -+&mdio { -+ compatible = "snps,dwmac-mdio"; -+ #address-cells = <1>; -+ #size-cells = <0>; - -- qup_spi16_default: qup-spi16-state { -- pins = "gpio86", "gpio87", "gpio88", "gpio89"; -- function = "qup2_se2"; -- drive-strength = <6>; -- bias-disable; -+ sgmii_phy0: phy@8 { -+ compatible = "ethernet-phy-id0141.0dd4"; -+ reg = <0x8>; -+ device_type = "ethernet-phy"; -+ interrupts-extended = <&tlmm 7 IRQ_TYPE_EDGE_FALLING>; -+ reset-gpios = <&pmm8654au_2_gpios 8 GPIO_ACTIVE_LOW>; -+ reset-assert-us = <11000>; -+ reset-deassert-us = <70000>; - }; - -- qup_i2c11_default: qup-i2c11-state { -- pins = "gpio48", "gpio49"; -- function = "qup1_se4"; -- drive-strength = <2>; -- bias-pull-up; -+ sgmii_phy1: phy@a { -+ compatible = "ethernet-phy-id0141.0dd4"; -+ reg = <0xa>; -+ device_type = "ethernet-phy"; -+ interrupts-extended = <&tlmm 26 IRQ_TYPE_EDGE_FALLING>; -+ reset-gpios = <&pmm8654au_2_gpios 9 GPIO_ACTIVE_LOW>; -+ reset-assert-us = <11000>; -+ reset-deassert-us = <70000>; - }; -- -- qup_i2c18_default: qup-i2c18-state { -- pins = "gpio95", "gpio96"; -- function = "qup2_se4"; -- drive-strength = <2>; -- bias-pull-up; -- }; -- -- qup_uart12_default: qup-uart12-state { -- qup_uart12_cts: qup-uart12-cts-pins { -- pins = "gpio52"; -- function = "qup1_se5"; -- bias-disable; -- }; -- -- qup_uart12_rts: qup-uart12-rts-pins { -- pins = "gpio53"; -- function = "qup1_se5"; -- bias-pull-down; -- }; -- -- qup_uart12_tx: qup-uart12-tx-pins { -- pins = "gpio54"; -- function = "qup1_se5"; -- bias-pull-up; -- }; -- -- qup_uart12_rx: qup-uart12-rx-pins { -- pins = "gpio55"; -- function = "qup1_se5"; -- bias-pull-down; -- }; -- }; -- -- qup_uart17_default: qup-uart17-state { -- qup_uart17_cts: qup-uart17-cts-pins { -- pins = "gpio91"; -- function = "qup2_se3"; -- bias-disable; -- }; -- -- qup_uart17_rts: qup0-uart17-rts-pins { -- pins = "gpio92"; -- function = "qup2_se3"; -- bias-pull-down; -- }; -- -- qup_uart17_tx: qup0-uart17-tx-pins { -- pins = "gpio93"; -- function = "qup2_se3"; -- bias-pull-up; -- }; -- -- qup_uart17_rx: qup0-uart17-rx-pins { -- pins = "gpio94"; -- function = "qup2_se3"; -- bias-pull-down; -- }; -- }; -- -- pcie0_default_state: pcie0-default-state { -- perst-pins { -- pins = "gpio2"; -- function = "gpio"; -- drive-strength = <2>; -- bias-pull-down; -- }; -- -- clkreq-pins { -- pins = "gpio1"; -- function = "pcie0_clkreq"; -- drive-strength = <2>; -- bias-pull-up; -- }; -- -- wake-pins { -- pins = "gpio0"; -- function = "gpio"; -- drive-strength = <2>; -- bias-pull-up; -- }; -- }; -- -- pcie1_default_state: pcie1-default-state { -- perst-pins { -- pins = "gpio4"; -- function = "gpio"; -- drive-strength = <2>; -- bias-pull-down; -- }; -- -- clkreq-pins { -- pins = "gpio3"; -- function = "pcie1_clkreq"; -- drive-strength = <2>; -- bias-pull-up; -- }; -- -- wake-pins { -- pins = "gpio5"; -- function = "gpio"; -- drive-strength = <2>; -- bias-pull-up; -- }; -- }; --}; -- --&pcie0 { -- perst-gpios = <&tlmm 2 GPIO_ACTIVE_LOW>; -- wake-gpios = <&tlmm 0 GPIO_ACTIVE_HIGH>; -- -- pinctrl-names = "default"; -- pinctrl-0 = <&pcie0_default_state>; -- -- status = "okay"; --}; -- --&pcie1 { -- perst-gpios = <&tlmm 4 GPIO_ACTIVE_LOW>; -- wake-gpios = <&tlmm 5 GPIO_ACTIVE_HIGH>; -- -- pinctrl-names = "default"; -- pinctrl-0 = <&pcie1_default_state>; -- -- status = "okay"; --}; -- --&pcie0_phy { -- vdda-phy-supply = <&vreg_l5a>; -- vdda-pll-supply = <&vreg_l1c>; -- -- status = "okay"; --}; -- --&pcie1_phy { -- vdda-phy-supply = <&vreg_l5a>; -- vdda-pll-supply = <&vreg_l1c>; -- -- status = "okay"; --}; -- --&uart10 { -- compatible = "qcom,geni-debug-uart"; -- pinctrl-0 = <&qup_uart10_default>; -- pinctrl-names = "default"; -- status = "okay"; --}; -- --&uart12 { -- pinctrl-0 = <&qup_uart12_default>; -- pinctrl-names = "default"; -- status = "okay"; --}; -- --&uart17 { -- pinctrl-0 = <&qup_uart17_default>; -- pinctrl-names = "default"; -- status = "okay"; --}; -- --&ufs_mem_hc { -- reset-gpios = <&tlmm 149 GPIO_ACTIVE_LOW>; -- vcc-supply = <&vreg_l8a>; -- vcc-max-microamp = <1100000>; -- vccq-supply = <&vreg_l4c>; -- vccq-max-microamp = <1200000>; -- -- status = "okay"; --}; -- --&ufs_mem_phy { -- vdda-phy-supply = <&vreg_l4a>; -- vdda-pll-supply = <&vreg_l1c>; -- -- status = "okay"; --}; -- --&usb_0 { -- pinctrl-names = "default"; -- pinctrl-0 = <&usb0_en_state>; -- -- status = "okay"; --}; -- --&usb_0_dwc3 { -- dr_mode = "peripheral"; --}; -- --&usb_0_hsphy { -- vdda-pll-supply = <&vreg_l7a>; -- vdda18-supply = <&vreg_l6c>; -- vdda33-supply = <&vreg_l9a>; -- -- status = "okay"; --}; -- --&usb_0_qmpphy { -- vdda-phy-supply = <&vreg_l1c>; -- vdda-pll-supply = <&vreg_l7a>; -- -- status = "okay"; --}; -- --&usb_1 { -- pinctrl-names = "default"; -- pinctrl-0 = <&usb1_en_state>; -- -- status = "okay"; --}; -- --&usb_1_dwc3 { -- dr_mode = "host"; --}; -- --&usb_1_hsphy { -- vdda-pll-supply = <&vreg_l7a>; -- vdda18-supply = <&vreg_l6c>; -- vdda33-supply = <&vreg_l9a>; -- -- status = "okay"; --}; -- --&usb_1_qmpphy { -- vdda-phy-supply = <&vreg_l1c>; -- vdda-pll-supply = <&vreg_l7a>; -- -- status = "okay"; --}; -- --&usb_2 { -- pinctrl-names = "default"; -- pinctrl-0 = <&usb2_en_state>; -- -- status = "okay"; --}; -- --&usb_2_dwc3 { -- dr_mode = "host"; --}; -- --&usb_2_hsphy { -- vdda-pll-supply = <&vreg_l7a>; -- vdda18-supply = <&vreg_l6c>; -- vdda33-supply = <&vreg_l9a>; -- -- status = "okay"; --}; -- --&xo_board_clk { -- clock-frequency = <38400000>; - }; -diff --git a/arch/arm64/boot/dts/qcom/sa8775p-ride.dtsi b/arch/arm64/boot/dts/qcom/sa8775p-ride.dtsi -new file mode 100644 -index 00000000000000..864ad109371ca7 ---- /dev/null -+++ b/arch/arm64/boot/dts/qcom/sa8775p-ride.dtsi -@@ -0,0 +1,814 @@ -+// SPDX-License-Identifier: BSD-3-Clause -+/* -+ * Copyright (c) 2023, Linaro Limited -+ */ -+ -+/dts-v1/; -+ -+#include -+#include -+ -+#include "sa8775p.dtsi" -+#include "sa8775p-pmics.dtsi" -+ -+/ { -+ aliases { -+ ethernet0 = ðernet0; -+ ethernet1 = ðernet1; -+ i2c11 = &i2c11; -+ i2c18 = &i2c18; -+ serial0 = &uart10; -+ serial1 = &uart12; -+ serial2 = &uart17; -+ spi16 = &spi16; -+ ufshc1 = &ufs_mem_hc; -+ }; -+ -+ chosen { -+ stdout-path = "serial0:115200n8"; -+ }; -+}; -+ -+&apps_rsc { -+ regulators-0 { -+ compatible = "qcom,pmm8654au-rpmh-regulators"; -+ qcom,pmic-id = "a"; -+ -+ vreg_s4a: smps4 { -+ regulator-name = "vreg_s4a"; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <1816000>; -+ regulator-initial-mode = ; -+ }; -+ -+ vreg_s5a: smps5 { -+ regulator-name = "vreg_s5a"; -+ regulator-min-microvolt = <1850000>; -+ regulator-max-microvolt = <1996000>; -+ regulator-initial-mode = ; -+ }; -+ -+ vreg_s9a: smps9 { -+ regulator-name = "vreg_s9a"; -+ regulator-min-microvolt = <535000>; -+ regulator-max-microvolt = <1120000>; -+ regulator-initial-mode = ; -+ }; -+ -+ vreg_l4a: ldo4 { -+ regulator-name = "vreg_l4a"; -+ regulator-min-microvolt = <788000>; -+ regulator-max-microvolt = <1050000>; -+ regulator-initial-mode = ; -+ regulator-allow-set-load; -+ regulator-allowed-modes = ; -+ }; -+ -+ vreg_l5a: ldo5 { -+ regulator-name = "vreg_l5a"; -+ regulator-min-microvolt = <870000>; -+ regulator-max-microvolt = <950000>; -+ regulator-initial-mode = ; -+ regulator-allow-set-load; -+ regulator-allowed-modes = ; -+ }; -+ -+ vreg_l6a: ldo6 { -+ regulator-name = "vreg_l6a"; -+ regulator-min-microvolt = <870000>; -+ regulator-max-microvolt = <970000>; -+ regulator-initial-mode = ; -+ regulator-allow-set-load; -+ regulator-allowed-modes = ; -+ }; -+ -+ vreg_l7a: ldo7 { -+ regulator-name = "vreg_l7a"; -+ regulator-min-microvolt = <720000>; -+ regulator-max-microvolt = <950000>; -+ regulator-initial-mode = ; -+ regulator-allow-set-load; -+ regulator-allowed-modes = ; -+ }; -+ -+ vreg_l8a: ldo8 { -+ regulator-name = "vreg_l8a"; -+ regulator-min-microvolt = <2504000>; -+ regulator-max-microvolt = <3300000>; -+ regulator-initial-mode = ; -+ regulator-allow-set-load; -+ regulator-allowed-modes = ; -+ }; -+ -+ vreg_l9a: ldo9 { -+ regulator-name = "vreg_l9a"; -+ regulator-min-microvolt = <2970000>; -+ regulator-max-microvolt = <3544000>; -+ regulator-initial-mode = ; -+ regulator-allow-set-load; -+ regulator-allowed-modes = ; -+ }; -+ }; -+ -+ regulators-1 { -+ compatible = "qcom,pmm8654au-rpmh-regulators"; -+ qcom,pmic-id = "c"; -+ -+ vreg_l1c: ldo1 { -+ regulator-name = "vreg_l1c"; -+ regulator-min-microvolt = <1140000>; -+ regulator-max-microvolt = <1260000>; -+ regulator-initial-mode = ; -+ regulator-allow-set-load; -+ regulator-allowed-modes = ; -+ }; -+ -+ vreg_l2c: ldo2 { -+ regulator-name = "vreg_l2c"; -+ regulator-min-microvolt = <900000>; -+ regulator-max-microvolt = <1100000>; -+ regulator-initial-mode = ; -+ regulator-allow-set-load; -+ regulator-allowed-modes = ; -+ }; -+ -+ vreg_l3c: ldo3 { -+ regulator-name = "vreg_l3c"; -+ regulator-min-microvolt = <1100000>; -+ regulator-max-microvolt = <1300000>; -+ regulator-initial-mode = ; -+ regulator-allow-set-load; -+ regulator-allowed-modes = ; -+ }; -+ -+ vreg_l4c: ldo4 { -+ regulator-name = "vreg_l4c"; -+ regulator-min-microvolt = <1200000>; -+ regulator-max-microvolt = <1200000>; -+ regulator-initial-mode = ; -+ /* -+ * FIXME: This should have regulator-allow-set-load but -+ * we're getting an over-current fault from the PMIC -+ * when switching to LPM. -+ */ -+ }; -+ -+ vreg_l5c: ldo5 { -+ regulator-name = "vreg_l5c"; -+ regulator-min-microvolt = <1100000>; -+ regulator-max-microvolt = <1300000>; -+ regulator-initial-mode = ; -+ regulator-allow-set-load; -+ regulator-allowed-modes = ; -+ }; -+ -+ vreg_l6c: ldo6 { -+ regulator-name = "vreg_l6c"; -+ regulator-min-microvolt = <1620000>; -+ regulator-max-microvolt = <1980000>; -+ regulator-initial-mode = ; -+ regulator-allow-set-load; -+ regulator-allowed-modes = ; -+ }; -+ -+ vreg_l7c: ldo7 { -+ regulator-name = "vreg_l7c"; -+ regulator-min-microvolt = <1620000>; -+ regulator-max-microvolt = <2000000>; -+ regulator-initial-mode = ; -+ regulator-allow-set-load; -+ regulator-allowed-modes = ; -+ }; -+ -+ vreg_l8c: ldo8 { -+ regulator-name = "vreg_l8c"; -+ regulator-min-microvolt = <2400000>; -+ regulator-max-microvolt = <3300000>; -+ regulator-initial-mode = ; -+ regulator-allow-set-load; -+ regulator-allowed-modes = ; -+ }; -+ -+ vreg_l9c: ldo9 { -+ regulator-name = "vreg_l9c"; -+ regulator-min-microvolt = <1650000>; -+ regulator-max-microvolt = <2700000>; -+ regulator-initial-mode = ; -+ regulator-allow-set-load; -+ regulator-allowed-modes = ; -+ }; -+ }; -+ -+ regulators-2 { -+ compatible = "qcom,pmm8654au-rpmh-regulators"; -+ qcom,pmic-id = "e"; -+ -+ vreg_s4e: smps4 { -+ regulator-name = "vreg_s4e"; -+ regulator-min-microvolt = <970000>; -+ regulator-max-microvolt = <1520000>; -+ regulator-initial-mode = ; -+ }; -+ -+ vreg_s7e: smps7 { -+ regulator-name = "vreg_s7e"; -+ regulator-min-microvolt = <1010000>; -+ regulator-max-microvolt = <1170000>; -+ regulator-initial-mode = ; -+ }; -+ -+ vreg_s9e: smps9 { -+ regulator-name = "vreg_s9e"; -+ regulator-min-microvolt = <300000>; -+ regulator-max-microvolt = <570000>; -+ regulator-initial-mode = ; -+ }; -+ -+ vreg_l6e: ldo6 { -+ regulator-name = "vreg_l6e"; -+ regulator-min-microvolt = <1280000>; -+ regulator-max-microvolt = <1450000>; -+ regulator-initial-mode = ; -+ regulator-allow-set-load; -+ regulator-allowed-modes = ; -+ }; -+ -+ vreg_l8e: ldo8 { -+ regulator-name = "vreg_l8e"; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <1950000>; -+ regulator-initial-mode = ; -+ regulator-allow-set-load; -+ regulator-allowed-modes = ; -+ }; -+ }; -+}; -+ -+ðernet0 { -+ phy-handle = <&sgmii_phy0>; -+ -+ pinctrl-0 = <ðernet0_default>; -+ pinctrl-names = "default"; -+ -+ snps,mtl-rx-config = <&mtl_rx_setup>; -+ snps,mtl-tx-config = <&mtl_tx_setup>; -+ snps,ps-speed = <1000>; -+ -+ status = "okay"; -+ -+ mdio: mdio { -+ compatible = "snps,dwmac-mdio"; -+ #address-cells = <1>; -+ #size-cells = <0>; -+ }; -+ -+ mtl_rx_setup: rx-queues-config { -+ snps,rx-queues-to-use = <4>; -+ snps,rx-sched-sp; -+ -+ queue0 { -+ snps,dcb-algorithm; -+ snps,map-to-dma-channel = <0x0>; -+ snps,route-up; -+ snps,priority = <0x1>; -+ }; -+ -+ queue1 { -+ snps,dcb-algorithm; -+ snps,map-to-dma-channel = <0x1>; -+ snps,route-ptp; -+ }; -+ -+ queue2 { -+ snps,avb-algorithm; -+ snps,map-to-dma-channel = <0x2>; -+ snps,route-avcp; -+ }; -+ -+ queue3 { -+ snps,avb-algorithm; -+ snps,map-to-dma-channel = <0x3>; -+ snps,priority = <0xc>; -+ }; -+ }; -+ -+ mtl_tx_setup: tx-queues-config { -+ snps,tx-queues-to-use = <4>; -+ snps,tx-sched-sp; -+ -+ queue0 { -+ snps,dcb-algorithm; -+ }; -+ -+ queue1 { -+ snps,dcb-algorithm; -+ }; -+ -+ queue2 { -+ snps,avb-algorithm; -+ snps,send_slope = <0x1000>; -+ snps,idle_slope = <0x1000>; -+ snps,high_credit = <0x3e800>; -+ snps,low_credit = <0xffc18000>; -+ }; -+ -+ queue3 { -+ snps,avb-algorithm; -+ snps,send_slope = <0x1000>; -+ snps,idle_slope = <0x1000>; -+ snps,high_credit = <0x3e800>; -+ snps,low_credit = <0xffc18000>; -+ }; -+ }; -+}; -+ -+ðernet1 { -+ phy-handle = <&sgmii_phy1>; -+ -+ snps,mtl-rx-config = <&mtl_rx_setup1>; -+ snps,mtl-tx-config = <&mtl_tx_setup1>; -+ snps,ps-speed = <1000>; -+ -+ status = "okay"; -+ -+ mtl_rx_setup1: rx-queues-config { -+ snps,rx-queues-to-use = <4>; -+ snps,rx-sched-sp; -+ -+ queue0 { -+ snps,dcb-algorithm; -+ snps,map-to-dma-channel = <0x0>; -+ snps,route-up; -+ snps,priority = <0x1>; -+ }; -+ -+ queue1 { -+ snps,dcb-algorithm; -+ snps,map-to-dma-channel = <0x1>; -+ snps,route-ptp; -+ }; -+ -+ queue2 { -+ snps,avb-algorithm; -+ snps,map-to-dma-channel = <0x2>; -+ snps,route-avcp; -+ }; -+ -+ queue3 { -+ snps,avb-algorithm; -+ snps,map-to-dma-channel = <0x3>; -+ snps,priority = <0xc>; -+ }; -+ }; -+ -+ mtl_tx_setup1: tx-queues-config { -+ snps,tx-queues-to-use = <4>; -+ snps,tx-sched-sp; -+ -+ queue0 { -+ snps,dcb-algorithm; -+ }; -+ -+ queue1 { -+ snps,dcb-algorithm; -+ }; -+ -+ queue2 { -+ snps,avb-algorithm; -+ snps,send_slope = <0x1000>; -+ snps,idle_slope = <0x1000>; -+ snps,high_credit = <0x3e800>; -+ snps,low_credit = <0xffc18000>; -+ }; -+ -+ queue3 { -+ snps,avb-algorithm; -+ snps,send_slope = <0x1000>; -+ snps,idle_slope = <0x1000>; -+ snps,high_credit = <0x3e800>; -+ snps,low_credit = <0xffc18000>; -+ }; -+ }; -+}; -+ -+&i2c11 { -+ clock-frequency = <400000>; -+ pinctrl-0 = <&qup_i2c11_default>; -+ pinctrl-names = "default"; -+ status = "okay"; -+}; -+ -+&i2c18 { -+ clock-frequency = <400000>; -+ pinctrl-0 = <&qup_i2c18_default>; -+ pinctrl-names = "default"; -+ status = "okay"; -+}; -+ -+&pmm8654au_0_gpios { -+ gpio-line-names = "DS_EN", -+ "POFF_COMPLETE", -+ "UFS0_VER_ID", -+ "FAST_POFF", -+ "DBU1_PON_DONE", -+ "AOSS_SLEEP", -+ "CAM_DES0_EN", -+ "CAM_DES1_EN", -+ "CAM_DES2_EN", -+ "CAM_DES3_EN", -+ "UEFI", -+ "ANALOG_PON_OPT"; -+}; -+ -+&pmm8654au_0_pon_resin { -+ linux,code = ; -+ status = "okay"; -+}; -+ -+&pmm8654au_1_gpios { -+ gpio-line-names = "PMIC_C_ID0", -+ "PMIC_C_ID1", -+ "UFS1_VER_ID", -+ "IPA_PWR", -+ "", -+ "WLAN_DBU4_EN", -+ "WLAN_EN", -+ "BT_EN", -+ "USB2_PWR_EN", -+ "USB2_FAULT"; -+ -+ usb2_en_state: usb2-en-state { -+ pins = "gpio9"; -+ function = "normal"; -+ output-high; -+ power-source = <0>; -+ }; -+}; -+ -+&pmm8654au_2_gpios { -+ gpio-line-names = "PMIC_E_ID0", -+ "PMIC_E_ID1", -+ "USB0_PWR_EN", -+ "USB0_FAULT", -+ "SENSOR_IRQ_1", -+ "SENSOR_IRQ_2", -+ "SENSOR_RST", -+ "SGMIIO0_RST", -+ "SGMIIO1_RST", -+ "USB1_PWR_ENABLE", -+ "USB1_FAULT", -+ "VMON_SPX8"; -+ -+ usb0_en_state: usb0-en-state { -+ pins = "gpio3"; -+ function = "normal"; -+ output-high; -+ power-source = <0>; -+ }; -+ -+ usb1_en_state: usb1-en-state { -+ pins = "gpio10"; -+ function = "normal"; -+ output-high; -+ power-source = <0>; -+ }; -+}; -+ -+&pmm8654au_3_gpios { -+ gpio-line-names = "PMIC_G_ID0", -+ "PMIC_G_ID1", -+ "GNSS_RST", -+ "GNSS_EN", -+ "GNSS_BOOT_MODE"; -+}; -+ -+&qupv3_id_1 { -+ status = "okay"; -+}; -+ -+&qupv3_id_2 { -+ status = "okay"; -+}; -+ -+&serdes0 { -+ phy-supply = <&vreg_l5a>; -+ status = "okay"; -+}; -+ -+&serdes1 { -+ phy-supply = <&vreg_l5a>; -+ status = "okay"; -+}; -+ -+&sleep_clk { -+ clock-frequency = <32000>; -+}; -+ -+&spi16 { -+ pinctrl-0 = <&qup_spi16_default>; -+ pinctrl-names = "default"; -+ status = "okay"; -+}; -+ -+&tlmm { -+ ethernet0_default: ethernet0-default-state { -+ ethernet0_mdc: ethernet0-mdc-pins { -+ pins = "gpio8"; -+ function = "emac0_mdc"; -+ drive-strength = <16>; -+ bias-pull-up; -+ }; -+ -+ ethernet0_mdio: ethernet0-mdio-pins { -+ pins = "gpio9"; -+ function = "emac0_mdio"; -+ drive-strength = <16>; -+ bias-pull-up; -+ }; -+ }; -+ -+ qup_uart10_default: qup-uart10-state { -+ pins = "gpio46", "gpio47"; -+ function = "qup1_se3"; -+ }; -+ -+ qup_spi16_default: qup-spi16-state { -+ pins = "gpio86", "gpio87", "gpio88", "gpio89"; -+ function = "qup2_se2"; -+ drive-strength = <6>; -+ bias-disable; -+ }; -+ -+ qup_i2c11_default: qup-i2c11-state { -+ pins = "gpio48", "gpio49"; -+ function = "qup1_se4"; -+ drive-strength = <2>; -+ bias-pull-up; -+ }; -+ -+ qup_i2c18_default: qup-i2c18-state { -+ pins = "gpio95", "gpio96"; -+ function = "qup2_se4"; -+ drive-strength = <2>; -+ bias-pull-up; -+ }; -+ -+ qup_uart12_default: qup-uart12-state { -+ qup_uart12_cts: qup-uart12-cts-pins { -+ pins = "gpio52"; -+ function = "qup1_se5"; -+ bias-disable; -+ }; -+ -+ qup_uart12_rts: qup-uart12-rts-pins { -+ pins = "gpio53"; -+ function = "qup1_se5"; -+ bias-pull-down; -+ }; -+ -+ qup_uart12_tx: qup-uart12-tx-pins { -+ pins = "gpio54"; -+ function = "qup1_se5"; -+ bias-pull-up; -+ }; -+ -+ qup_uart12_rx: qup-uart12-rx-pins { -+ pins = "gpio55"; -+ function = "qup1_se5"; -+ bias-pull-down; -+ }; -+ }; -+ -+ qup_uart17_default: qup-uart17-state { -+ qup_uart17_cts: qup-uart17-cts-pins { -+ pins = "gpio91"; -+ function = "qup2_se3"; -+ bias-disable; -+ }; -+ -+ qup_uart17_rts: qup0-uart17-rts-pins { -+ pins = "gpio92"; -+ function = "qup2_se3"; -+ bias-pull-down; -+ }; -+ -+ qup_uart17_tx: qup0-uart17-tx-pins { -+ pins = "gpio93"; -+ function = "qup2_se3"; -+ bias-pull-up; -+ }; -+ -+ qup_uart17_rx: qup0-uart17-rx-pins { -+ pins = "gpio94"; -+ function = "qup2_se3"; -+ bias-pull-down; -+ }; -+ }; -+ -+ pcie0_default_state: pcie0-default-state { -+ perst-pins { -+ pins = "gpio2"; -+ function = "gpio"; -+ drive-strength = <2>; -+ bias-pull-down; -+ }; -+ -+ clkreq-pins { -+ pins = "gpio1"; -+ function = "pcie0_clkreq"; -+ drive-strength = <2>; -+ bias-pull-up; -+ }; -+ -+ wake-pins { -+ pins = "gpio0"; -+ function = "gpio"; -+ drive-strength = <2>; -+ bias-pull-up; -+ }; -+ }; -+ -+ pcie1_default_state: pcie1-default-state { -+ perst-pins { -+ pins = "gpio4"; -+ function = "gpio"; -+ drive-strength = <2>; -+ bias-pull-down; -+ }; -+ -+ clkreq-pins { -+ pins = "gpio3"; -+ function = "pcie1_clkreq"; -+ drive-strength = <2>; -+ bias-pull-up; -+ }; -+ -+ wake-pins { -+ pins = "gpio5"; -+ function = "gpio"; -+ drive-strength = <2>; -+ bias-pull-up; -+ }; -+ }; -+}; -+ -+&pcie0 { -+ perst-gpios = <&tlmm 2 GPIO_ACTIVE_LOW>; -+ wake-gpios = <&tlmm 0 GPIO_ACTIVE_HIGH>; -+ -+ pinctrl-names = "default"; -+ pinctrl-0 = <&pcie0_default_state>; -+ -+ status = "okay"; -+}; -+ -+&pcie1 { -+ perst-gpios = <&tlmm 4 GPIO_ACTIVE_LOW>; -+ wake-gpios = <&tlmm 5 GPIO_ACTIVE_HIGH>; -+ -+ pinctrl-names = "default"; -+ pinctrl-0 = <&pcie1_default_state>; -+ -+ status = "okay"; -+}; -+ -+&pcie0_phy { -+ vdda-phy-supply = <&vreg_l5a>; -+ vdda-pll-supply = <&vreg_l1c>; -+ -+ status = "okay"; -+}; -+ -+&pcie1_phy { -+ vdda-phy-supply = <&vreg_l5a>; -+ vdda-pll-supply = <&vreg_l1c>; -+ -+ status = "okay"; -+}; -+ -+&uart10 { -+ compatible = "qcom,geni-debug-uart"; -+ pinctrl-0 = <&qup_uart10_default>; -+ pinctrl-names = "default"; -+ status = "okay"; -+}; -+ -+&uart12 { -+ pinctrl-0 = <&qup_uart12_default>; -+ pinctrl-names = "default"; -+ status = "okay"; -+}; -+ -+&uart17 { -+ pinctrl-0 = <&qup_uart17_default>; -+ pinctrl-names = "default"; -+ status = "okay"; -+}; -+ -+&ufs_mem_hc { -+ reset-gpios = <&tlmm 149 GPIO_ACTIVE_LOW>; -+ vcc-supply = <&vreg_l8a>; -+ vcc-max-microamp = <1100000>; -+ vccq-supply = <&vreg_l4c>; -+ vccq-max-microamp = <1200000>; -+ -+ status = "okay"; -+}; -+ -+&ufs_mem_phy { -+ vdda-phy-supply = <&vreg_l4a>; -+ vdda-pll-supply = <&vreg_l1c>; -+ -+ status = "okay"; -+}; -+ -+&usb_0 { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&usb0_en_state>; -+ -+ status = "okay"; -+}; -+ -+&usb_0_dwc3 { -+ dr_mode = "peripheral"; -+}; -+ -+&usb_0_hsphy { -+ vdda-pll-supply = <&vreg_l7a>; -+ vdda18-supply = <&vreg_l6c>; -+ vdda33-supply = <&vreg_l9a>; -+ -+ status = "okay"; -+}; -+ -+&usb_0_qmpphy { -+ vdda-phy-supply = <&vreg_l1c>; -+ vdda-pll-supply = <&vreg_l7a>; -+ -+ status = "okay"; -+}; -+ -+&usb_1 { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&usb1_en_state>; -+ -+ status = "okay"; -+}; -+ -+&usb_1_dwc3 { -+ dr_mode = "host"; -+}; -+ -+&usb_1_hsphy { -+ vdda-pll-supply = <&vreg_l7a>; -+ vdda18-supply = <&vreg_l6c>; -+ vdda33-supply = <&vreg_l9a>; -+ -+ status = "okay"; -+}; -+ -+&usb_1_qmpphy { -+ vdda-phy-supply = <&vreg_l1c>; -+ vdda-pll-supply = <&vreg_l7a>; -+ -+ status = "okay"; -+}; -+ -+&usb_2 { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&usb2_en_state>; -+ -+ status = "okay"; -+}; -+ -+&usb_2_dwc3 { -+ dr_mode = "host"; -+}; -+ -+&usb_2_hsphy { -+ vdda-pll-supply = <&vreg_l7a>; -+ vdda18-supply = <&vreg_l6c>; -+ vdda33-supply = <&vreg_l9a>; -+ -+ status = "okay"; -+}; -+ -+&xo_board_clk { -+ clock-frequency = <38400000>; -+}; -diff --git a/arch/arm64/boot/dts/qcom/sc7180-firmware-tfa.dtsi b/arch/arm64/boot/dts/qcom/sc7180-firmware-tfa.dtsi -index ee35a454dbf6f3..59162b3afcb841 100644 ---- a/arch/arm64/boot/dts/qcom/sc7180-firmware-tfa.dtsi -+++ b/arch/arm64/boot/dts/qcom/sc7180-firmware-tfa.dtsi -@@ -6,82 +6,82 @@ - * by Qualcomm firmware. - */ - --&CPU0 { -+&cpu0 { - /delete-property/ power-domains; - /delete-property/ power-domain-names; - -- cpu-idle-states = <&LITTLE_CPU_SLEEP_0 -- &LITTLE_CPU_SLEEP_1 -- &CLUSTER_SLEEP_0>; -+ cpu-idle-states = <&little_cpu_sleep_0 -+ &little_cpu_sleep_1 -+ &cluster_sleep_0>; - }; - --&CPU1 { -+&cpu1 { - /delete-property/ power-domains; - /delete-property/ power-domain-names; - -- cpu-idle-states = <&LITTLE_CPU_SLEEP_0 -- &LITTLE_CPU_SLEEP_1 -- &CLUSTER_SLEEP_0>; -+ cpu-idle-states = <&little_cpu_sleep_0 -+ &little_cpu_sleep_1 -+ &cluster_sleep_0>; - }; - --&CPU2 { -+&cpu2 { - /delete-property/ power-domains; - /delete-property/ power-domain-names; - -- cpu-idle-states = <&LITTLE_CPU_SLEEP_0 -- &LITTLE_CPU_SLEEP_1 -- &CLUSTER_SLEEP_0>; -+ cpu-idle-states = <&little_cpu_sleep_0 -+ &little_cpu_sleep_1 -+ &cluster_sleep_0>; - }; - --&CPU3 { -+&cpu3 { - /delete-property/ power-domains; - /delete-property/ power-domain-names; - -- cpu-idle-states = <&LITTLE_CPU_SLEEP_0 -- &LITTLE_CPU_SLEEP_1 -- &CLUSTER_SLEEP_0>; -+ cpu-idle-states = <&little_cpu_sleep_0 -+ &little_cpu_sleep_1 -+ &cluster_sleep_0>; - }; - --&CPU4 { -+&cpu4 { - /delete-property/ power-domains; - /delete-property/ power-domain-names; - -- cpu-idle-states = <&LITTLE_CPU_SLEEP_0 -- &LITTLE_CPU_SLEEP_1 -- &CLUSTER_SLEEP_0>; -+ cpu-idle-states = <&little_cpu_sleep_0 -+ &little_cpu_sleep_1 -+ &cluster_sleep_0>; - }; - --&CPU5 { -+&cpu5 { - /delete-property/ power-domains; - /delete-property/ power-domain-names; - -- cpu-idle-states = <&LITTLE_CPU_SLEEP_0 -- &LITTLE_CPU_SLEEP_1 -- &CLUSTER_SLEEP_0>; -+ cpu-idle-states = <&little_cpu_sleep_0 -+ &little_cpu_sleep_1 -+ &cluster_sleep_0>; - }; - --&CPU6 { -+&cpu6 { - /delete-property/ power-domains; - /delete-property/ power-domain-names; - -- cpu-idle-states = <&BIG_CPU_SLEEP_0 -- &BIG_CPU_SLEEP_1 -- &CLUSTER_SLEEP_0>; -+ cpu-idle-states = <&big_cpu_sleep_0 -+ &big_cpu_sleep_1 -+ &cluster_sleep_0>; - }; - --&CPU7 { -+&cpu7 { - /delete-property/ power-domains; - /delete-property/ power-domain-names; - -- cpu-idle-states = <&BIG_CPU_SLEEP_0 -- &BIG_CPU_SLEEP_1 -- &CLUSTER_SLEEP_0>; -+ cpu-idle-states = <&big_cpu_sleep_0 -+ &big_cpu_sleep_1 -+ &cluster_sleep_0>; - }; - - /delete-node/ &domain_idle_states; - - &idle_states { -- CLUSTER_SLEEP_0: cluster-sleep-0 { -+ cluster_sleep_0: cluster-sleep-0 { - compatible = "arm,idle-state"; - idle-state-name = "cluster-power-down"; - arm,psci-suspend-param = <0x40003444>; -@@ -92,15 +92,15 @@ CLUSTER_SLEEP_0: cluster-sleep-0 { - }; - }; - --/delete-node/ &CPU_PD0; --/delete-node/ &CPU_PD1; --/delete-node/ &CPU_PD2; --/delete-node/ &CPU_PD3; --/delete-node/ &CPU_PD4; --/delete-node/ &CPU_PD5; --/delete-node/ &CPU_PD6; --/delete-node/ &CPU_PD7; --/delete-node/ &CLUSTER_PD; -+/delete-node/ &cpu_pd0; -+/delete-node/ &cpu_pd1; -+/delete-node/ &cpu_pd2; -+/delete-node/ &cpu_pd3; -+/delete-node/ &cpu_pd4; -+/delete-node/ &cpu_pd5; -+/delete-node/ &cpu_pd6; -+/delete-node/ &cpu_pd7; -+/delete-node/ &cluster_pd; - - &apps_rsc { - /delete-property/ power-domains; -diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi -index a532cc4aac4740..d338a8a0a9a966 100644 ---- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi -+++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi -@@ -26,7 +26,6 @@ adau7002: audio-codec-1 { - thermal-zones { - skin_temp_thermal: skin-temp-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&pm6150_adc_tm 1>; - sustainable-power = <965>; -@@ -54,14 +53,14 @@ skin-temp-crit { - cooling-maps { - map0 { - trip = <&skin_temp_alert0>; -- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - - map1 { - trip = <&skin_temp_alert1>; -- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - }; - }; -diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-homestar.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-homestar.dtsi -index b27dcd2ec856f0..4452d04e4c547d 100644 ---- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-homestar.dtsi -+++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-homestar.dtsi -@@ -43,7 +43,6 @@ pp3300_touch: pp3300-touch-regulator { - thermal-zones { - skin_temp_thermal: skin-temp-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&pm6150_adc_tm 1>; - sustainable-power = <965>; -@@ -71,14 +70,14 @@ skin-temp-crit { - cooling-maps { - map0 { - trip = <&skin_temp_alert0>; -- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - - map1 { - trip = <&skin_temp_alert1>; -- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - }; - }; -diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-pompom.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-pompom.dtsi -index fd944842dd6cdf..7a05d502620f31 100644 ---- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-pompom.dtsi -+++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-pompom.dtsi -@@ -12,14 +12,11 @@ - - / { - thermal-zones { -- 5v-choke-thermal { -- polling-delay-passive = <0>; -- polling-delay = <250>; -- -+ choke-5v-thermal { - thermal-sensors = <&pm6150_adc_tm 1>; - - trips { -- 5v-choke-crit { -+ choke-5v-crit { - temperature = <125000>; - hysteresis = <1000>; - type = "critical"; -diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-quackingstick.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-quackingstick.dtsi -index 62ab6427dd65d6..e1e31e0fc0e14e 100644 ---- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-quackingstick.dtsi -+++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-quackingstick.dtsi -@@ -84,6 +84,7 @@ panel: panel@0 { - pinctrl-names = "default"; - pinctrl-0 = <&lcd_rst>; - avdd-supply = <&ppvar_lcd>; -+ avee-supply = <&ppvar_lcd>; - pp1800-supply = <&v1p8_disp>; - pp3300-supply = <&pp3300_dx_edp>; - backlight = <&backlight>; -diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-wormdingler.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-wormdingler.dtsi -index 2f6a340ddd2ae3..38335df3a275d3 100644 ---- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-wormdingler.dtsi -+++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-wormdingler.dtsi -@@ -50,7 +50,6 @@ v1p8_mipi: v1p8-mipi-regulator { - thermal-zones { - skin_temp_thermal: skin-temp-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&pm6150_adc_tm 1>; - sustainable-power = <574>; -@@ -78,14 +77,14 @@ skin-temp-crit { - cooling-maps { - map0 { - trip = <&skin_temp_alert0>; -- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - - map1 { - trip = <&skin_temp_alert1>; -- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - }; - }; -diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi -index c2f5e9f6679d69..906e616422706f 100644 ---- a/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi -+++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi -@@ -21,9 +21,6 @@ - / { - thermal-zones { - charger_thermal: charger-thermal { -- polling-delay-passive = <0>; -- polling-delay = <0>; -- - thermal-sensors = <&pm6150_adc_tm 0>; - - trips { -diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi -index 68b1c017a9fd5f..7758136d71d645 100644 ---- a/arch/arm64/boot/dts/qcom/sc7180.dtsi -+++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi -@@ -74,28 +74,28 @@ cpus { - #address-cells = <2>; - #size-cells = <0>; - -- CPU0: cpu@0 { -+ cpu0: cpu@0 { - device_type = "cpu"; - compatible = "qcom,kryo468"; - reg = <0x0 0x0>; - clocks = <&cpufreq_hw 0>; - enable-method = "psci"; -- power-domains = <&CPU_PD0>; -+ power-domains = <&cpu_pd0>; - power-domain-names = "psci"; - capacity-dmips-mhz = <415>; - dynamic-power-coefficient = <137>; - operating-points-v2 = <&cpu0_opp_table>; - interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>, - <&osm_l3 MASTER_OSM_L3_APPS &osm_l3 SLAVE_OSM_L3>; -- next-level-cache = <&L2_0>; -+ next-level-cache = <&l2_0>; - #cooling-cells = <2>; - qcom,freq-domain = <&cpufreq_hw 0>; -- L2_0: l2-cache { -+ l2_0: l2-cache { - compatible = "cache"; - cache-level = <2>; - cache-unified; -- next-level-cache = <&L3_0>; -- L3_0: l3-cache { -+ next-level-cache = <&l3_0>; -+ l3_0: l3-cache { - compatible = "cache"; - cache-level = <3>; - cache-unified; -@@ -103,206 +103,206 @@ L3_0: l3-cache { - }; - }; - -- CPU1: cpu@100 { -+ cpu1: cpu@100 { - device_type = "cpu"; - compatible = "qcom,kryo468"; - reg = <0x0 0x100>; - clocks = <&cpufreq_hw 0>; - enable-method = "psci"; -- power-domains = <&CPU_PD1>; -+ power-domains = <&cpu_pd1>; - power-domain-names = "psci"; - capacity-dmips-mhz = <415>; - dynamic-power-coefficient = <137>; -- next-level-cache = <&L2_100>; -+ next-level-cache = <&l2_100>; - operating-points-v2 = <&cpu0_opp_table>; - interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>, - <&osm_l3 MASTER_OSM_L3_APPS &osm_l3 SLAVE_OSM_L3>; - #cooling-cells = <2>; - qcom,freq-domain = <&cpufreq_hw 0>; -- L2_100: l2-cache { -+ l2_100: l2-cache { - compatible = "cache"; - cache-level = <2>; - cache-unified; -- next-level-cache = <&L3_0>; -+ next-level-cache = <&l3_0>; - }; - }; - -- CPU2: cpu@200 { -+ cpu2: cpu@200 { - device_type = "cpu"; - compatible = "qcom,kryo468"; - reg = <0x0 0x200>; - clocks = <&cpufreq_hw 0>; - enable-method = "psci"; -- power-domains = <&CPU_PD2>; -+ power-domains = <&cpu_pd2>; - power-domain-names = "psci"; - capacity-dmips-mhz = <415>; - dynamic-power-coefficient = <137>; -- next-level-cache = <&L2_200>; -+ next-level-cache = <&l2_200>; - operating-points-v2 = <&cpu0_opp_table>; - interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>, - <&osm_l3 MASTER_OSM_L3_APPS &osm_l3 SLAVE_OSM_L3>; - #cooling-cells = <2>; - qcom,freq-domain = <&cpufreq_hw 0>; -- L2_200: l2-cache { -+ l2_200: l2-cache { - compatible = "cache"; - cache-level = <2>; - cache-unified; -- next-level-cache = <&L3_0>; -+ next-level-cache = <&l3_0>; - }; - }; - -- CPU3: cpu@300 { -+ cpu3: cpu@300 { - device_type = "cpu"; - compatible = "qcom,kryo468"; - reg = <0x0 0x300>; - clocks = <&cpufreq_hw 0>; - enable-method = "psci"; -- power-domains = <&CPU_PD3>; -+ power-domains = <&cpu_pd3>; - power-domain-names = "psci"; - capacity-dmips-mhz = <415>; - dynamic-power-coefficient = <137>; -- next-level-cache = <&L2_300>; -+ next-level-cache = <&l2_300>; - operating-points-v2 = <&cpu0_opp_table>; - interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>, - <&osm_l3 MASTER_OSM_L3_APPS &osm_l3 SLAVE_OSM_L3>; - #cooling-cells = <2>; - qcom,freq-domain = <&cpufreq_hw 0>; -- L2_300: l2-cache { -+ l2_300: l2-cache { - compatible = "cache"; - cache-level = <2>; - cache-unified; -- next-level-cache = <&L3_0>; -+ next-level-cache = <&l3_0>; - }; - }; - -- CPU4: cpu@400 { -+ cpu4: cpu@400 { - device_type = "cpu"; - compatible = "qcom,kryo468"; - reg = <0x0 0x400>; - clocks = <&cpufreq_hw 0>; - enable-method = "psci"; -- power-domains = <&CPU_PD4>; -+ power-domains = <&cpu_pd4>; - power-domain-names = "psci"; - capacity-dmips-mhz = <415>; - dynamic-power-coefficient = <137>; -- next-level-cache = <&L2_400>; -+ next-level-cache = <&l2_400>; - operating-points-v2 = <&cpu0_opp_table>; - interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>, - <&osm_l3 MASTER_OSM_L3_APPS &osm_l3 SLAVE_OSM_L3>; - #cooling-cells = <2>; - qcom,freq-domain = <&cpufreq_hw 0>; -- L2_400: l2-cache { -+ l2_400: l2-cache { - compatible = "cache"; - cache-level = <2>; - cache-unified; -- next-level-cache = <&L3_0>; -+ next-level-cache = <&l3_0>; - }; - }; - -- CPU5: cpu@500 { -+ cpu5: cpu@500 { - device_type = "cpu"; - compatible = "qcom,kryo468"; - reg = <0x0 0x500>; - clocks = <&cpufreq_hw 0>; - enable-method = "psci"; -- power-domains = <&CPU_PD5>; -+ power-domains = <&cpu_pd5>; - power-domain-names = "psci"; - capacity-dmips-mhz = <415>; - dynamic-power-coefficient = <137>; -- next-level-cache = <&L2_500>; -+ next-level-cache = <&l2_500>; - operating-points-v2 = <&cpu0_opp_table>; - interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>, - <&osm_l3 MASTER_OSM_L3_APPS &osm_l3 SLAVE_OSM_L3>; - #cooling-cells = <2>; - qcom,freq-domain = <&cpufreq_hw 0>; -- L2_500: l2-cache { -+ l2_500: l2-cache { - compatible = "cache"; - cache-level = <2>; - cache-unified; -- next-level-cache = <&L3_0>; -+ next-level-cache = <&l3_0>; - }; - }; - -- CPU6: cpu@600 { -+ cpu6: cpu@600 { - device_type = "cpu"; - compatible = "qcom,kryo468"; - reg = <0x0 0x600>; - clocks = <&cpufreq_hw 1>; - enable-method = "psci"; -- power-domains = <&CPU_PD6>; -+ power-domains = <&cpu_pd6>; - power-domain-names = "psci"; - capacity-dmips-mhz = <1024>; - dynamic-power-coefficient = <480>; -- next-level-cache = <&L2_600>; -+ next-level-cache = <&l2_600>; - operating-points-v2 = <&cpu6_opp_table>; - interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>, - <&osm_l3 MASTER_OSM_L3_APPS &osm_l3 SLAVE_OSM_L3>; - #cooling-cells = <2>; - qcom,freq-domain = <&cpufreq_hw 1>; -- L2_600: l2-cache { -+ l2_600: l2-cache { - compatible = "cache"; - cache-level = <2>; - cache-unified; -- next-level-cache = <&L3_0>; -+ next-level-cache = <&l3_0>; - }; - }; - -- CPU7: cpu@700 { -+ cpu7: cpu@700 { - device_type = "cpu"; - compatible = "qcom,kryo468"; - reg = <0x0 0x700>; - clocks = <&cpufreq_hw 1>; - enable-method = "psci"; -- power-domains = <&CPU_PD7>; -+ power-domains = <&cpu_pd7>; - power-domain-names = "psci"; - capacity-dmips-mhz = <1024>; - dynamic-power-coefficient = <480>; -- next-level-cache = <&L2_700>; -+ next-level-cache = <&l2_700>; - operating-points-v2 = <&cpu6_opp_table>; - interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>, - <&osm_l3 MASTER_OSM_L3_APPS &osm_l3 SLAVE_OSM_L3>; - #cooling-cells = <2>; - qcom,freq-domain = <&cpufreq_hw 1>; -- L2_700: l2-cache { -+ l2_700: l2-cache { - compatible = "cache"; - cache-level = <2>; - cache-unified; -- next-level-cache = <&L3_0>; -+ next-level-cache = <&l3_0>; - }; - }; - - cpu-map { - cluster0 { - core0 { -- cpu = <&CPU0>; -+ cpu = <&cpu0>; - }; - - core1 { -- cpu = <&CPU1>; -+ cpu = <&cpu1>; - }; - - core2 { -- cpu = <&CPU2>; -+ cpu = <&cpu2>; - }; - - core3 { -- cpu = <&CPU3>; -+ cpu = <&cpu3>; - }; - - core4 { -- cpu = <&CPU4>; -+ cpu = <&cpu4>; - }; - - core5 { -- cpu = <&CPU5>; -+ cpu = <&cpu5>; - }; - - core6 { -- cpu = <&CPU6>; -+ cpu = <&cpu6>; - }; - - core7 { -- cpu = <&CPU7>; -+ cpu = <&cpu7>; - }; - }; - }; -@@ -310,7 +310,7 @@ core7 { - idle_states: idle-states { - entry-method = "psci"; - -- LITTLE_CPU_SLEEP_0: cpu-sleep-0-0 { -+ little_cpu_sleep_0: cpu-sleep-0-0 { - compatible = "arm,idle-state"; - idle-state-name = "little-power-down"; - arm,psci-suspend-param = <0x40000003>; -@@ -320,7 +320,7 @@ LITTLE_CPU_SLEEP_0: cpu-sleep-0-0 { - local-timer-stop; - }; - -- LITTLE_CPU_SLEEP_1: cpu-sleep-0-1 { -+ little_cpu_sleep_1: cpu-sleep-0-1 { - compatible = "arm,idle-state"; - idle-state-name = "little-rail-power-down"; - arm,psci-suspend-param = <0x40000004>; -@@ -330,7 +330,7 @@ LITTLE_CPU_SLEEP_1: cpu-sleep-0-1 { - local-timer-stop; - }; - -- BIG_CPU_SLEEP_0: cpu-sleep-1-0 { -+ big_cpu_sleep_0: cpu-sleep-1-0 { - compatible = "arm,idle-state"; - idle-state-name = "big-power-down"; - arm,psci-suspend-param = <0x40000003>; -@@ -340,7 +340,7 @@ BIG_CPU_SLEEP_0: cpu-sleep-1-0 { - local-timer-stop; - }; - -- BIG_CPU_SLEEP_1: cpu-sleep-1-1 { -+ big_cpu_sleep_1: cpu-sleep-1-1 { - compatible = "arm,idle-state"; - idle-state-name = "big-rail-power-down"; - arm,psci-suspend-param = <0x40000004>; -@@ -352,7 +352,7 @@ BIG_CPU_SLEEP_1: cpu-sleep-1-1 { - }; - - domain_idle_states: domain-idle-states { -- CLUSTER_SLEEP_PC: cluster-sleep-0 { -+ cluster_sleep_pc: cluster-sleep-0 { - compatible = "domain-idle-state"; - idle-state-name = "cluster-l3-power-collapse"; - arm,psci-suspend-param = <0x41000044>; -@@ -361,7 +361,7 @@ CLUSTER_SLEEP_PC: cluster-sleep-0 { - min-residency-us = <6118>; - }; - -- CLUSTER_SLEEP_CX_RET: cluster-sleep-1 { -+ cluster_sleep_cx_ret: cluster-sleep-1 { - compatible = "domain-idle-state"; - idle-state-name = "cluster-cx-retention"; - arm,psci-suspend-param = <0x41001244>; -@@ -370,7 +370,7 @@ CLUSTER_SLEEP_CX_RET: cluster-sleep-1 { - min-residency-us = <8467>; - }; - -- CLUSTER_AOSS_SLEEP: cluster-sleep-2 { -+ cluster_aoss_sleep: cluster-sleep-2 { - compatible = "domain-idle-state"; - idle-state-name = "cluster-power-down"; - arm,psci-suspend-param = <0x4100b244>; -@@ -580,59 +580,59 @@ psci { - compatible = "arm,psci-1.0"; - method = "smc"; - -- CPU_PD0: cpu0 { -+ cpu_pd0: power-domain-cpu0 { - #power-domain-cells = <0>; -- power-domains = <&CLUSTER_PD>; -- domain-idle-states = <&LITTLE_CPU_SLEEP_0 &LITTLE_CPU_SLEEP_1>; -+ power-domains = <&cluster_pd>; -+ domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>; - }; - -- CPU_PD1: cpu1 { -+ cpu_pd1: power-domain-cpu1 { - #power-domain-cells = <0>; -- power-domains = <&CLUSTER_PD>; -- domain-idle-states = <&LITTLE_CPU_SLEEP_0 &LITTLE_CPU_SLEEP_1>; -+ power-domains = <&cluster_pd>; -+ domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>; - }; - -- CPU_PD2: cpu2 { -+ cpu_pd2: power-domain-cpu2 { - #power-domain-cells = <0>; -- power-domains = <&CLUSTER_PD>; -- domain-idle-states = <&LITTLE_CPU_SLEEP_0 &LITTLE_CPU_SLEEP_1>; -+ power-domains = <&cluster_pd>; -+ domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>; - }; - -- CPU_PD3: cpu3 { -+ cpu_pd3: power-domain-cpu3 { - #power-domain-cells = <0>; -- power-domains = <&CLUSTER_PD>; -- domain-idle-states = <&LITTLE_CPU_SLEEP_0 &LITTLE_CPU_SLEEP_1>; -+ power-domains = <&cluster_pd>; -+ domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>; - }; - -- CPU_PD4: cpu4 { -+ cpu_pd4: power-domain-cpu4 { - #power-domain-cells = <0>; -- power-domains = <&CLUSTER_PD>; -- domain-idle-states = <&LITTLE_CPU_SLEEP_0 &LITTLE_CPU_SLEEP_1>; -+ power-domains = <&cluster_pd>; -+ domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>; - }; - -- CPU_PD5: cpu5 { -+ cpu_pd5: power-domain-cpu5 { - #power-domain-cells = <0>; -- power-domains = <&CLUSTER_PD>; -- domain-idle-states = <&LITTLE_CPU_SLEEP_0 &LITTLE_CPU_SLEEP_1>; -+ power-domains = <&cluster_pd>; -+ domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>; - }; - -- CPU_PD6: cpu6 { -+ cpu_pd6: power-domain-cpu6 { - #power-domain-cells = <0>; -- power-domains = <&CLUSTER_PD>; -- domain-idle-states = <&BIG_CPU_SLEEP_0 &BIG_CPU_SLEEP_1>; -+ power-domains = <&cluster_pd>; -+ domain-idle-states = <&big_cpu_sleep_0 &big_cpu_sleep_1>; - }; - -- CPU_PD7: cpu7 { -+ cpu_pd7: power-domain-cpu7 { - #power-domain-cells = <0>; -- power-domains = <&CLUSTER_PD>; -- domain-idle-states = <&BIG_CPU_SLEEP_0 &BIG_CPU_SLEEP_1>; -+ power-domains = <&cluster_pd>; -+ domain-idle-states = <&big_cpu_sleep_0 &big_cpu_sleep_1>; - }; - -- CLUSTER_PD: cpu-cluster0 { -+ cluster_pd: power-domain-cluster { - #power-domain-cells = <0>; -- domain-idle-states = <&CLUSTER_SLEEP_PC -- &CLUSTER_SLEEP_CX_RET -- &CLUSTER_AOSS_SLEEP>; -+ domain-idle-states = <&cluster_sleep_pc -+ &cluster_sleep_cx_ret -+ &cluster_aoss_sleep>; - }; - }; - -@@ -2465,7 +2465,7 @@ etm@7040000 { - compatible = "arm,coresight-etm4x", "arm,primecell"; - reg = <0 0x07040000 0 0x1000>; - -- cpu = <&CPU0>; -+ cpu = <&cpu0>; - - clocks = <&aoss_qmp>; - clock-names = "apb_pclk"; -@@ -2485,7 +2485,7 @@ etm@7140000 { - compatible = "arm,coresight-etm4x", "arm,primecell"; - reg = <0 0x07140000 0 0x1000>; - -- cpu = <&CPU1>; -+ cpu = <&cpu1>; - - clocks = <&aoss_qmp>; - clock-names = "apb_pclk"; -@@ -2505,7 +2505,7 @@ etm@7240000 { - compatible = "arm,coresight-etm4x", "arm,primecell"; - reg = <0 0x07240000 0 0x1000>; - -- cpu = <&CPU2>; -+ cpu = <&cpu2>; - - clocks = <&aoss_qmp>; - clock-names = "apb_pclk"; -@@ -2525,7 +2525,7 @@ etm@7340000 { - compatible = "arm,coresight-etm4x", "arm,primecell"; - reg = <0 0x07340000 0 0x1000>; - -- cpu = <&CPU3>; -+ cpu = <&cpu3>; - - clocks = <&aoss_qmp>; - clock-names = "apb_pclk"; -@@ -2545,7 +2545,7 @@ etm@7440000 { - compatible = "arm,coresight-etm4x", "arm,primecell"; - reg = <0 0x07440000 0 0x1000>; - -- cpu = <&CPU4>; -+ cpu = <&cpu4>; - - clocks = <&aoss_qmp>; - clock-names = "apb_pclk"; -@@ -2565,7 +2565,7 @@ etm@7540000 { - compatible = "arm,coresight-etm4x", "arm,primecell"; - reg = <0 0x07540000 0 0x1000>; - -- cpu = <&CPU5>; -+ cpu = <&cpu5>; - - clocks = <&aoss_qmp>; - clock-names = "apb_pclk"; -@@ -2585,7 +2585,7 @@ etm@7640000 { - compatible = "arm,coresight-etm4x", "arm,primecell"; - reg = <0 0x07640000 0 0x1000>; - -- cpu = <&CPU6>; -+ cpu = <&cpu6>; - - clocks = <&aoss_qmp>; - clock-names = "apb_pclk"; -@@ -2605,7 +2605,7 @@ etm@7740000 { - compatible = "arm,coresight-etm4x", "arm,primecell"; - reg = <0 0x07740000 0 0x1000>; - -- cpu = <&CPU7>; -+ cpu = <&cpu7>; - - clocks = <&aoss_qmp>; - clock-names = "apb_pclk"; -@@ -3645,7 +3645,7 @@ apps_rsc: rsc@18200000 { - , - , - ; -- power-domains = <&CLUSTER_PD>; -+ power-domains = <&cluster_pd>; - - rpmhcc: clock-controller { - compatible = "qcom,sc7180-rpmh-clk"; -@@ -3827,7 +3827,6 @@ lpass_hm: clock-controller@63000000 { - thermal-zones { - cpu0_thermal: cpu0-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens0 1>; - sustainable-power = <1052>; -@@ -3855,28 +3854,27 @@ cpu0_crit: cpu-crit { - cooling-maps { - map0 { - trip = <&cpu0_alert0>; -- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - map1 { - trip = <&cpu0_alert1>; -- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - }; - }; - - cpu1_thermal: cpu1-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens0 2>; - sustainable-power = <1052>; -@@ -3904,28 +3902,27 @@ cpu1_crit: cpu-crit { - cooling-maps { - map0 { - trip = <&cpu1_alert0>; -- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - map1 { - trip = <&cpu1_alert1>; -- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - }; - }; - - cpu2_thermal: cpu2-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens0 3>; - sustainable-power = <1052>; -@@ -3953,28 +3950,27 @@ cpu2_crit: cpu-crit { - cooling-maps { - map0 { - trip = <&cpu2_alert0>; -- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - map1 { - trip = <&cpu2_alert1>; -- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - }; - }; - - cpu3_thermal: cpu3-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens0 4>; - sustainable-power = <1052>; -@@ -4002,28 +3998,27 @@ cpu3_crit: cpu-crit { - cooling-maps { - map0 { - trip = <&cpu3_alert0>; -- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - map1 { - trip = <&cpu3_alert1>; -- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - }; - }; - - cpu4_thermal: cpu4-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens0 5>; - sustainable-power = <1052>; -@@ -4051,28 +4046,27 @@ cpu4_crit: cpu-crit { - cooling-maps { - map0 { - trip = <&cpu4_alert0>; -- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - map1 { - trip = <&cpu4_alert1>; -- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - }; - }; - - cpu5_thermal: cpu5-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens0 6>; - sustainable-power = <1052>; -@@ -4100,28 +4094,27 @@ cpu5_crit: cpu-crit { - cooling-maps { - map0 { - trip = <&cpu5_alert0>; -- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - map1 { - trip = <&cpu5_alert1>; -- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - }; - }; - - cpu6_thermal: cpu6-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens0 9>; - sustainable-power = <1425>; -@@ -4149,20 +4142,19 @@ cpu6_crit: cpu-crit { - cooling-maps { - map0 { - trip = <&cpu6_alert0>; -- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - map1 { - trip = <&cpu6_alert1>; -- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - }; - }; - - cpu7_thermal: cpu7-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens0 10>; - sustainable-power = <1425>; -@@ -4190,20 +4182,19 @@ cpu7_crit: cpu-crit { - cooling-maps { - map0 { - trip = <&cpu7_alert0>; -- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - map1 { - trip = <&cpu7_alert1>; -- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - }; - }; - - cpu8_thermal: cpu8-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens0 11>; - sustainable-power = <1425>; -@@ -4231,20 +4222,19 @@ cpu8_crit: cpu-crit { - cooling-maps { - map0 { - trip = <&cpu8_alert0>; -- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - map1 { - trip = <&cpu8_alert1>; -- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - }; - }; - - cpu9_thermal: cpu9-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens0 12>; - sustainable-power = <1425>; -@@ -4272,20 +4262,19 @@ cpu9_crit: cpu-crit { - cooling-maps { - map0 { - trip = <&cpu9_alert0>; -- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - map1 { - trip = <&cpu9_alert1>; -- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; - }; - }; - }; - - aoss0-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens0 0>; - -@@ -4306,7 +4295,6 @@ aoss0_crit: aoss0-crit { - - cpuss0-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens0 7>; - -@@ -4326,7 +4314,6 @@ cpuss0_crit: cluster0-crit { - - cpuss1-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens0 8>; - -@@ -4346,7 +4333,6 @@ cpuss1_crit: cluster0-crit { - - gpuss0-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens0 13>; - -@@ -4374,7 +4360,6 @@ map0 { - - gpuss1-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens0 14>; - -@@ -4402,7 +4387,6 @@ map0 { - - aoss1-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens1 0>; - -@@ -4423,7 +4407,6 @@ aoss1_crit: aoss1-crit { - - cwlan-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens1 1>; - -@@ -4444,7 +4427,6 @@ cwlan_crit: cwlan-crit { - - audio-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens1 2>; - -@@ -4465,7 +4447,6 @@ audio_crit: audio-crit { - - ddr-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens1 3>; - -@@ -4486,7 +4467,6 @@ ddr_crit: ddr-crit { - - q6-hvx-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens1 4>; - -@@ -4507,7 +4487,6 @@ q6_hvx_crit: q6-hvx-crit { - - camera-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens1 5>; - -@@ -4528,7 +4507,6 @@ camera_crit: camera-crit { - - mdm-core-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens1 6>; - -@@ -4549,7 +4527,6 @@ mdm_crit: mdm-crit { - - mdm-dsp-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens1 7>; - -@@ -4570,7 +4547,6 @@ mdm_dsp_crit: mdm-dsp-crit { - - npu-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens1 8>; - -@@ -4591,7 +4567,6 @@ npu_crit: npu-crit { - - video-thermal { - polling-delay-passive = <250>; -- polling-delay = <0>; - - thermal-sensors = <&tsens1 9>; - -diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi -index 149c7962f2cbb7..81e95604ef9870 100644 ---- a/arch/arm64/boot/dts/qcom/sc7280.dtsi -+++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi -@@ -80,7 +80,7 @@ xo_board: xo-board { - - sleep_clk: sleep-clk { - compatible = "fixed-clock"; -- clock-frequency = <32000>; -+ clock-frequency = <32764>; - #clock-cells = <0>; - }; - }; -diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi -index 6425c74edd60cc..3e70e79ce24b05 100644 ---- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi -+++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi -@@ -2642,7 +2642,7 @@ usb_2_qmpphy1: phy@88f1000 { - - remoteproc_adsp: remoteproc@3000000 { - compatible = "qcom,sc8280xp-adsp-pas"; -- reg = <0 0x03000000 0 0x100>; -+ reg = <0 0x03000000 0 0x10000>; - - interrupts-extended = <&intc GIC_SPI 162 IRQ_TYPE_LEVEL_HIGH>, - <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>, -@@ -4399,7 +4399,7 @@ cpufreq_hw: cpufreq@18591000 { - - remoteproc_nsp0: remoteproc@1b300000 { - compatible = "qcom,sc8280xp-nsp0-pas"; -- reg = <0 0x1b300000 0 0x100>; -+ reg = <0 0x1b300000 0 0x10000>; - - interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_LEVEL_HIGH>, - <&smp2p_nsp0_in 0 IRQ_TYPE_EDGE_RISING>, -@@ -4530,7 +4530,7 @@ compute-cb@14 { - - remoteproc_nsp1: remoteproc@21300000 { - compatible = "qcom,sc8280xp-nsp1-pas"; -- reg = <0 0x21300000 0 0x100>; -+ reg = <0 0x21300000 0 0x10000>; - - interrupts-extended = <&intc GIC_SPI 887 IRQ_TYPE_LEVEL_HIGH>, - <&smp2p_nsp1_in 0 IRQ_TYPE_EDGE_RISING>, -diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c-navigation-mezzanine.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c-navigation-mezzanine.dts -deleted file mode 100644 -index a21caa6f3fa259..00000000000000 ---- a/arch/arm64/boot/dts/qcom/sdm845-db845c-navigation-mezzanine.dts -+++ /dev/null -@@ -1,104 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/* -- * Copyright (c) 2022, Linaro Ltd. -- */ -- --/dts-v1/; -- --#include "sdm845-db845c.dts" -- --&camss { -- vdda-phy-supply = <&vreg_l1a_0p875>; -- vdda-pll-supply = <&vreg_l26a_1p2>; -- -- status = "okay"; -- -- ports { -- port@0 { -- csiphy0_ep: endpoint { -- data-lanes = <0 1 2 3>; -- remote-endpoint = <&ov8856_ep>; -- }; -- }; -- }; --}; -- --&cci { -- status = "okay"; --}; -- --&cci_i2c0 { -- camera@10 { -- compatible = "ovti,ov8856"; -- reg = <0x10>; -- -- /* CAM0_RST_N */ -- reset-gpios = <&tlmm 9 GPIO_ACTIVE_LOW>; -- pinctrl-names = "default"; -- pinctrl-0 = <&cam0_default>; -- -- clocks = <&clock_camcc CAM_CC_MCLK0_CLK>; -- clock-names = "xvclk"; -- clock-frequency = <19200000>; -- -- /* -- * The &vreg_s4a_1p8 trace is powered on as a, -- * so it is represented by a fixed regulator. -- * -- * The 2.8V vdda-supply and 1.2V vddd-supply regulators -- * both have to be enabled through the power management -- * gpios. -- */ -- dovdd-supply = <&vreg_lvs1a_1p8>; -- avdd-supply = <&cam0_avdd_2v8>; -- dvdd-supply = <&cam0_dvdd_1v2>; -- -- port { -- ov8856_ep: endpoint { -- link-frequencies = /bits/ 64 -- <360000000 180000000>; -- data-lanes = <1 2 3 4>; -- remote-endpoint = <&csiphy0_ep>; -- }; -- }; -- }; --}; -- --&cci_i2c1 { -- camera@60 { -- compatible = "ovti,ov7251"; -- -- /* I2C address as per ov7251.txt linux documentation */ -- reg = <0x60>; -- -- /* CAM3_RST_N */ -- enable-gpios = <&tlmm 21 GPIO_ACTIVE_HIGH>; -- pinctrl-names = "default"; -- pinctrl-0 = <&cam3_default>; -- -- clocks = <&clock_camcc CAM_CC_MCLK3_CLK>; -- clock-names = "xclk"; -- clock-frequency = <24000000>; -- -- /* -- * The &vreg_s4a_1p8 trace always powered on. -- * -- * The 2.8V vdda-supply regulator is enabled when the -- * vreg_s4a_1p8 trace is pulled high. -- * It too is represented by a fixed regulator. -- * -- * No 1.2V vddd-supply regulator is used. -- */ -- vdddo-supply = <&vreg_lvs1a_1p8>; -- vdda-supply = <&cam3_avdd_2v8>; -- -- status = "disabled"; -- -- port { -- ov7251_ep: endpoint { -- data-lanes = <0 1>; --/* remote-endpoint = <&csiphy3_ep>; */ -- }; -- }; -- }; --}; -diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c-navigation-mezzanine.dtso b/arch/arm64/boot/dts/qcom/sdm845-db845c-navigation-mezzanine.dtso -new file mode 100644 -index 00000000000000..51f1a4883ab8f0 ---- /dev/null -+++ b/arch/arm64/boot/dts/qcom/sdm845-db845c-navigation-mezzanine.dtso -@@ -0,0 +1,70 @@ -+// SPDX-License-Identifier: GPL-2.0 -+/* -+ * Copyright (c) 2022, Linaro Ltd. -+ */ -+ -+/dts-v1/; -+/plugin/; -+ -+#include -+#include -+ -+&camss { -+ vdda-phy-supply = <&vreg_l1a_0p875>; -+ vdda-pll-supply = <&vreg_l26a_1p2>; -+ -+ status = "okay"; -+ -+ ports { -+ port@0 { -+ csiphy0_ep: endpoint { -+ data-lanes = <0 1 2 3>; -+ remote-endpoint = <&ov8856_ep>; -+ }; -+ }; -+ }; -+}; -+ -+&cci { -+ status = "okay"; -+}; -+ -+&cci_i2c0 { -+ #address-cells = <1>; -+ #size-cells = <0>; -+ -+ camera@10 { -+ compatible = "ovti,ov8856"; -+ reg = <0x10>; -+ -+ /* CAM0_RST_N */ -+ reset-gpios = <&tlmm 9 GPIO_ACTIVE_LOW>; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&cam0_default>; -+ -+ clocks = <&clock_camcc CAM_CC_MCLK0_CLK>; -+ clock-names = "xvclk"; -+ clock-frequency = <19200000>; -+ -+ /* -+ * The &vreg_s4a_1p8 trace is powered on as a, -+ * so it is represented by a fixed regulator. -+ * -+ * The 2.8V vdda-supply and 1.2V vddd-supply regulators -+ * both have to be enabled through the power management -+ * gpios. -+ */ -+ dovdd-supply = <&vreg_lvs1a_1p8>; -+ avdd-supply = <&cam0_avdd_2v8>; -+ dvdd-supply = <&cam0_dvdd_1v2>; -+ -+ port { -+ ov8856_ep: endpoint { -+ link-frequencies = /bits/ 64 -+ <360000000 180000000>; -+ data-lanes = <1 2 3 4>; -+ remote-endpoint = <&csiphy0_ep>; -+ }; -+ }; -+ }; -+}; -diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi -index dcdc8a0cd1819f..4ea693a0758565 100644 ---- a/arch/arm64/boot/dts/qcom/sdm845.dtsi -+++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi -@@ -4244,16 +4244,16 @@ camss: camss@acb3000 { - "vfe1", - "vfe_lite"; - -- interrupts = , -- , -- , -- , -- , -- , -- , -- , -- , -- ; -+ interrupts = , -+ , -+ , -+ , -+ , -+ , -+ , -+ , -+ , -+ ; - interrupt-names = "csid0", - "csid1", - "csid2", -diff --git a/arch/arm64/boot/dts/qcom/sdx75.dtsi b/arch/arm64/boot/dts/qcom/sdx75.dtsi -index e180aa4023eca4..0d1b5712c5067d 100644 ---- a/arch/arm64/boot/dts/qcom/sdx75.dtsi -+++ b/arch/arm64/boot/dts/qcom/sdx75.dtsi -@@ -29,7 +29,7 @@ xo_board: xo-board { - - sleep_clk: sleep-clk { - compatible = "fixed-clock"; -- clock-frequency = <32000>; -+ clock-frequency = <32764>; - #clock-cells = <0>; - }; - }; -diff --git a/arch/arm64/boot/dts/qcom/sm4450.dtsi b/arch/arm64/boot/dts/qcom/sm4450.dtsi -index c4e5b33f5169c8..51240f45c8e846 100644 ---- a/arch/arm64/boot/dts/qcom/sm4450.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm4450.dtsi -@@ -23,7 +23,7 @@ xo_board: xo-board { - - sleep_clk: sleep-clk { - compatible = "fixed-clock"; -- clock-frequency = <32000>; -+ clock-frequency = <32764>; - #clock-cells = <0>; - }; - }; -diff --git a/arch/arm64/boot/dts/qcom/sm6125.dtsi b/arch/arm64/boot/dts/qcom/sm6125.dtsi -index 07081088ba1463..2b2c55132f6739 100644 ---- a/arch/arm64/boot/dts/qcom/sm6125.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm6125.dtsi -@@ -28,7 +28,7 @@ xo_board: xo-board { - sleep_clk: sleep-clk { - compatible = "fixed-clock"; - #clock-cells = <0>; -- clock-frequency = <32000>; -+ clock-frequency = <32764>; - clock-output-names = "sleep_clk"; - }; - }; -diff --git a/arch/arm64/boot/dts/qcom/sm6375.dtsi b/arch/arm64/boot/dts/qcom/sm6375.dtsi -index e56f7ea4ebc6ae..c5f7715626a09b 100644 ---- a/arch/arm64/boot/dts/qcom/sm6375.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm6375.dtsi -@@ -29,7 +29,7 @@ xo_board_clk: xo-board-clk { - - sleep_clk: sleep-clk { - compatible = "fixed-clock"; -- clock-frequency = <32000>; -+ clock-frequency = <32764>; - #clock-cells = <0>; - }; - }; -diff --git a/arch/arm64/boot/dts/qcom/sm7125.dtsi b/arch/arm64/boot/dts/qcom/sm7125.dtsi -new file mode 100644 -index 00000000000000..a53145a610a3c8 ---- /dev/null -+++ b/arch/arm64/boot/dts/qcom/sm7125.dtsi -@@ -0,0 +1,16 @@ -+// SPDX-License-Identifier: GPL-2.0 -+/* -+ * Copyright (c) 2021, The Linux Foundation. All rights reserved. -+ */ -+ -+#include "sc7180.dtsi" -+ -+/* SM7125 uses Kryo 465 instead of Kryo 468 */ -+&cpu0 { compatible = "qcom,kryo465"; }; -+&cpu1 { compatible = "qcom,kryo465"; }; -+&cpu2 { compatible = "qcom,kryo465"; }; -+&cpu3 { compatible = "qcom,kryo465"; }; -+&cpu4 { compatible = "qcom,kryo465"; }; -+&cpu5 { compatible = "qcom,kryo465"; }; -+&cpu6 { compatible = "qcom,kryo465"; }; -+&cpu7 { compatible = "qcom,kryo465"; }; -diff --git a/arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts b/arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts -index 18171c5d8a3877..c010e86134ff93 100644 ---- a/arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts -+++ b/arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts -@@ -26,7 +26,7 @@ / { - chassis-type = "handset"; - - /* required for bootloader to select correct board */ -- qcom,msm-id = <434 0x10000>, <459 0x10000>; -+ qcom,msm-id = <459 0x10000>; - qcom,board-id = <8 32>; - - aliases { -diff --git a/arch/arm64/boot/dts/qcom/sm8150-microsoft-surface-duo.dts b/arch/arm64/boot/dts/qcom/sm8150-microsoft-surface-duo.dts -index b039773c44653a..a1323a8b8e6bfb 100644 ---- a/arch/arm64/boot/dts/qcom/sm8150-microsoft-surface-duo.dts -+++ b/arch/arm64/boot/dts/qcom/sm8150-microsoft-surface-duo.dts -@@ -376,8 +376,8 @@ da7280@4a { - pinctrl-0 = <&da7280_intr_default>; - - dlg,actuator-type = "LRA"; -- dlg,dlg,const-op-mode = <1>; -- dlg,dlg,periodic-op-mode = <1>; -+ dlg,const-op-mode = <1>; -+ dlg,periodic-op-mode = <1>; - dlg,nom-microvolt = <2000000>; - dlg,abs-max-microvolt = <2000000>; - dlg,imax-microamp = <129000>; -diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi -index b522d19f3a1327..21bbffc4e5a284 100644 ---- a/arch/arm64/boot/dts/qcom/sm8250.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi -@@ -85,7 +85,7 @@ xo_board: xo-board { - - sleep_clk: sleep-clk { - compatible = "fixed-clock"; -- clock-frequency = <32768>; -+ clock-frequency = <32764>; - #clock-cells = <0>; - }; - }; -@@ -4121,20 +4121,20 @@ camss: camss@ac6a000 { - "vfe_lite0", - "vfe_lite1"; - -- interrupts = , -- , -- , -- , -- , -- , -- , -- , -- , -- , -- , -- , -- , -- ; -+ interrupts = , -+ , -+ , -+ , -+ , -+ , -+ , -+ , -+ , -+ , -+ , -+ , -+ , -+ ; - interrupt-names = "csiphy0", - "csiphy1", - "csiphy2", -diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi -index d4f1b36c7aebe4..dded95fa52f075 100644 ---- a/arch/arm64/boot/dts/qcom/sm8350.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi -@@ -40,7 +40,7 @@ xo_board: xo-board { - - sleep_clk: sleep-clk { - compatible = "fixed-clock"; -- clock-frequency = <32000>; -+ clock-frequency = <32764>; - #clock-cells = <0>; - }; - }; -diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi -index a34f460240a076..007689d7f4fa20 100644 ---- a/arch/arm64/boot/dts/qcom/sm8450.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi -@@ -40,7 +40,7 @@ xo_board: xo-board { - sleep_clk: sleep-clk { - compatible = "fixed-clock"; - #clock-cells = <0>; -- clock-frequency = <32000>; -+ clock-frequency = <32764>; - }; - }; - -diff --git a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi -index a9b47ab92a02c7..f156167b4e8a71 100644 ---- a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi -+++ b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi -@@ -23,7 +23,6 @@ gic500: interrupt-controller@1800000 { - interrupt-controller; - reg = <0x00 0x01800000 0x00 0x10000>, /* GICD */ - <0x00 0x01880000 0x00 0xc0000>, /* GICR */ -- <0x00 0x01880000 0x00 0xc0000>, /* GICR */ - <0x01 0x00000000 0x00 0x2000>, /* GICC */ - <0x01 0x00010000 0x00 0x1000>, /* GICH */ - <0x01 0x00020000 0x00 0x2000>; /* GICV */ -diff --git a/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi -index de36abb243f104..1497f7c8adfaf4 100644 ---- a/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi -+++ b/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi -@@ -18,7 +18,6 @@ gic500: interrupt-controller@1800000 { - compatible = "arm,gic-v3"; - reg = <0x00 0x01800000 0x00 0x10000>, /* GICD */ - <0x00 0x01880000 0x00 0xc0000>, /* GICR */ -- <0x00 0x01880000 0x00 0xc0000>, /* GICR */ - <0x01 0x00000000 0x00 0x2000>, /* GICC */ - <0x01 0x00010000 0x00 0x1000>, /* GICH */ - <0x01 0x00020000 0x00 0x2000>; /* GICV */ -diff --git a/arch/hexagon/include/asm/cmpxchg.h b/arch/hexagon/include/asm/cmpxchg.h -index bf6cf5579cf459..9c58fb81f7fd67 100644 ---- a/arch/hexagon/include/asm/cmpxchg.h -+++ b/arch/hexagon/include/asm/cmpxchg.h -@@ -56,7 +56,7 @@ __arch_xchg(unsigned long x, volatile void *ptr, int size) - __typeof__(ptr) __ptr = (ptr); \ - __typeof__(*(ptr)) __old = (old); \ - __typeof__(*(ptr)) __new = (new); \ -- __typeof__(*(ptr)) __oldval = 0; \ -+ __typeof__(*(ptr)) __oldval = (__typeof__(*(ptr))) 0; \ - \ - asm volatile( \ - "1: %0 = memw_locked(%1);\n" \ -diff --git a/arch/hexagon/kernel/traps.c b/arch/hexagon/kernel/traps.c -index 6447763ce5a941..b7e394cebe20d6 100644 ---- a/arch/hexagon/kernel/traps.c -+++ b/arch/hexagon/kernel/traps.c -@@ -195,8 +195,10 @@ int die(const char *str, struct pt_regs *regs, long err) - printk(KERN_EMERG "Oops: %s[#%d]:\n", str, ++die.counter); - - if (notify_die(DIE_OOPS, str, regs, err, pt_cause(regs), SIGSEGV) == -- NOTIFY_STOP) -+ NOTIFY_STOP) { -+ spin_unlock_irq(&die.lock); - return 1; -+ } - - print_modules(); - show_regs(regs); -diff --git a/arch/loongarch/include/asm/hw_breakpoint.h b/arch/loongarch/include/asm/hw_breakpoint.h -index d78330916bd18a..13b2462f3d8c9d 100644 ---- a/arch/loongarch/include/asm/hw_breakpoint.h -+++ b/arch/loongarch/include/asm/hw_breakpoint.h -@@ -38,8 +38,8 @@ struct arch_hw_breakpoint { - * Limits. - * Changing these will require modifications to the register accessors. - */ --#define LOONGARCH_MAX_BRP 8 --#define LOONGARCH_MAX_WRP 8 -+#define LOONGARCH_MAX_BRP 14 -+#define LOONGARCH_MAX_WRP 14 - - /* Virtual debug register bases. */ - #define CSR_CFG_ADDR 0 -diff --git a/arch/loongarch/include/asm/loongarch.h b/arch/loongarch/include/asm/loongarch.h -index 23232c7bdb9ff5..2c996da6a5bf57 100644 ---- a/arch/loongarch/include/asm/loongarch.h -+++ b/arch/loongarch/include/asm/loongarch.h -@@ -928,6 +928,36 @@ - #define LOONGARCH_CSR_DB7CTRL 0x34a /* data breakpoint 7 control */ - #define LOONGARCH_CSR_DB7ASID 0x34b /* data breakpoint 7 asid */ - -+#define LOONGARCH_CSR_DB8ADDR 0x350 /* data breakpoint 8 address */ -+#define LOONGARCH_CSR_DB8MASK 0x351 /* data breakpoint 8 mask */ -+#define LOONGARCH_CSR_DB8CTRL 0x352 /* data breakpoint 8 control */ -+#define LOONGARCH_CSR_DB8ASID 0x353 /* data breakpoint 8 asid */ -+ -+#define LOONGARCH_CSR_DB9ADDR 0x358 /* data breakpoint 9 address */ -+#define LOONGARCH_CSR_DB9MASK 0x359 /* data breakpoint 9 mask */ -+#define LOONGARCH_CSR_DB9CTRL 0x35a /* data breakpoint 9 control */ -+#define LOONGARCH_CSR_DB9ASID 0x35b /* data breakpoint 9 asid */ -+ -+#define LOONGARCH_CSR_DB10ADDR 0x360 /* data breakpoint 10 address */ -+#define LOONGARCH_CSR_DB10MASK 0x361 /* data breakpoint 10 mask */ -+#define LOONGARCH_CSR_DB10CTRL 0x362 /* data breakpoint 10 control */ -+#define LOONGARCH_CSR_DB10ASID 0x363 /* data breakpoint 10 asid */ -+ -+#define LOONGARCH_CSR_DB11ADDR 0x368 /* data breakpoint 11 address */ -+#define LOONGARCH_CSR_DB11MASK 0x369 /* data breakpoint 11 mask */ -+#define LOONGARCH_CSR_DB11CTRL 0x36a /* data breakpoint 11 control */ -+#define LOONGARCH_CSR_DB11ASID 0x36b /* data breakpoint 11 asid */ -+ -+#define LOONGARCH_CSR_DB12ADDR 0x370 /* data breakpoint 12 address */ -+#define LOONGARCH_CSR_DB12MASK 0x371 /* data breakpoint 12 mask */ -+#define LOONGARCH_CSR_DB12CTRL 0x372 /* data breakpoint 12 control */ -+#define LOONGARCH_CSR_DB12ASID 0x373 /* data breakpoint 12 asid */ -+ -+#define LOONGARCH_CSR_DB13ADDR 0x378 /* data breakpoint 13 address */ -+#define LOONGARCH_CSR_DB13MASK 0x379 /* data breakpoint 13 mask */ -+#define LOONGARCH_CSR_DB13CTRL 0x37a /* data breakpoint 13 control */ -+#define LOONGARCH_CSR_DB13ASID 0x37b /* data breakpoint 13 asid */ -+ - #define LOONGARCH_CSR_FWPC 0x380 /* instruction breakpoint config */ - #define LOONGARCH_CSR_FWPS 0x381 /* instruction breakpoint status */ - -@@ -971,6 +1001,36 @@ - #define LOONGARCH_CSR_IB7CTRL 0x3ca /* inst breakpoint 7 control */ - #define LOONGARCH_CSR_IB7ASID 0x3cb /* inst breakpoint 7 asid */ - -+#define LOONGARCH_CSR_IB8ADDR 0x3d0 /* inst breakpoint 8 address */ -+#define LOONGARCH_CSR_IB8MASK 0x3d1 /* inst breakpoint 8 mask */ -+#define LOONGARCH_CSR_IB8CTRL 0x3d2 /* inst breakpoint 8 control */ -+#define LOONGARCH_CSR_IB8ASID 0x3d3 /* inst breakpoint 8 asid */ -+ -+#define LOONGARCH_CSR_IB9ADDR 0x3d8 /* inst breakpoint 9 address */ -+#define LOONGARCH_CSR_IB9MASK 0x3d9 /* inst breakpoint 9 mask */ -+#define LOONGARCH_CSR_IB9CTRL 0x3da /* inst breakpoint 9 control */ -+#define LOONGARCH_CSR_IB9ASID 0x3db /* inst breakpoint 9 asid */ -+ -+#define LOONGARCH_CSR_IB10ADDR 0x3e0 /* inst breakpoint 10 address */ -+#define LOONGARCH_CSR_IB10MASK 0x3e1 /* inst breakpoint 10 mask */ -+#define LOONGARCH_CSR_IB10CTRL 0x3e2 /* inst breakpoint 10 control */ -+#define LOONGARCH_CSR_IB10ASID 0x3e3 /* inst breakpoint 10 asid */ -+ -+#define LOONGARCH_CSR_IB11ADDR 0x3e8 /* inst breakpoint 11 address */ -+#define LOONGARCH_CSR_IB11MASK 0x3e9 /* inst breakpoint 11 mask */ -+#define LOONGARCH_CSR_IB11CTRL 0x3ea /* inst breakpoint 11 control */ -+#define LOONGARCH_CSR_IB11ASID 0x3eb /* inst breakpoint 11 asid */ -+ -+#define LOONGARCH_CSR_IB12ADDR 0x3f0 /* inst breakpoint 12 address */ -+#define LOONGARCH_CSR_IB12MASK 0x3f1 /* inst breakpoint 12 mask */ -+#define LOONGARCH_CSR_IB12CTRL 0x3f2 /* inst breakpoint 12 control */ -+#define LOONGARCH_CSR_IB12ASID 0x3f3 /* inst breakpoint 12 asid */ -+ -+#define LOONGARCH_CSR_IB13ADDR 0x3f8 /* inst breakpoint 13 address */ -+#define LOONGARCH_CSR_IB13MASK 0x3f9 /* inst breakpoint 13 mask */ -+#define LOONGARCH_CSR_IB13CTRL 0x3fa /* inst breakpoint 13 control */ -+#define LOONGARCH_CSR_IB13ASID 0x3fb /* inst breakpoint 13 asid */ -+ - #define LOONGARCH_CSR_DEBUG 0x500 /* debug config */ - #define LOONGARCH_CSR_DERA 0x501 /* debug era */ - #define LOONGARCH_CSR_DESAVE 0x502 /* debug save */ -diff --git a/arch/loongarch/kernel/hw_breakpoint.c b/arch/loongarch/kernel/hw_breakpoint.c -index a6e4b605bfa8d6..c35f9bf3803349 100644 ---- a/arch/loongarch/kernel/hw_breakpoint.c -+++ b/arch/loongarch/kernel/hw_breakpoint.c -@@ -51,7 +51,13 @@ int hw_breakpoint_slots(int type) - READ_WB_REG_CASE(OFF, 4, REG, T, VAL); \ - READ_WB_REG_CASE(OFF, 5, REG, T, VAL); \ - READ_WB_REG_CASE(OFF, 6, REG, T, VAL); \ -- READ_WB_REG_CASE(OFF, 7, REG, T, VAL); -+ READ_WB_REG_CASE(OFF, 7, REG, T, VAL); \ -+ READ_WB_REG_CASE(OFF, 8, REG, T, VAL); \ -+ READ_WB_REG_CASE(OFF, 9, REG, T, VAL); \ -+ READ_WB_REG_CASE(OFF, 10, REG, T, VAL); \ -+ READ_WB_REG_CASE(OFF, 11, REG, T, VAL); \ -+ READ_WB_REG_CASE(OFF, 12, REG, T, VAL); \ -+ READ_WB_REG_CASE(OFF, 13, REG, T, VAL); - - #define GEN_WRITE_WB_REG_CASES(OFF, REG, T, VAL) \ - WRITE_WB_REG_CASE(OFF, 0, REG, T, VAL); \ -@@ -61,7 +67,13 @@ int hw_breakpoint_slots(int type) - WRITE_WB_REG_CASE(OFF, 4, REG, T, VAL); \ - WRITE_WB_REG_CASE(OFF, 5, REG, T, VAL); \ - WRITE_WB_REG_CASE(OFF, 6, REG, T, VAL); \ -- WRITE_WB_REG_CASE(OFF, 7, REG, T, VAL); -+ WRITE_WB_REG_CASE(OFF, 7, REG, T, VAL); \ -+ WRITE_WB_REG_CASE(OFF, 8, REG, T, VAL); \ -+ WRITE_WB_REG_CASE(OFF, 9, REG, T, VAL); \ -+ WRITE_WB_REG_CASE(OFF, 10, REG, T, VAL); \ -+ WRITE_WB_REG_CASE(OFF, 11, REG, T, VAL); \ -+ WRITE_WB_REG_CASE(OFF, 12, REG, T, VAL); \ -+ WRITE_WB_REG_CASE(OFF, 13, REG, T, VAL); - - static u64 read_wb_reg(int reg, int n, int t) - { -diff --git a/arch/loongarch/power/platform.c b/arch/loongarch/power/platform.c -index 3ea8e07aa225f9..6c7735cda4d83f 100644 ---- a/arch/loongarch/power/platform.c -+++ b/arch/loongarch/power/platform.c -@@ -17,7 +17,7 @@ void enable_gpe_wakeup(void) - if (acpi_gbl_reduced_hardware) - return; - -- acpi_enable_all_wakeup_gpes(); -+ acpi_hw_enable_all_wakeup_gpes(); - } - - void enable_pci_wakeup(void) -diff --git a/arch/powerpc/include/asm/hugetlb.h b/arch/powerpc/include/asm/hugetlb.h -index ea71f7245a63e5..8d8f4909ae1a4a 100644 ---- a/arch/powerpc/include/asm/hugetlb.h -+++ b/arch/powerpc/include/asm/hugetlb.h -@@ -15,6 +15,15 @@ - - extern bool hugetlb_disabled; - -+static inline bool hugepages_supported(void) -+{ -+ if (hugetlb_disabled) -+ return false; -+ -+ return HPAGE_SHIFT != 0; -+} -+#define hugepages_supported hugepages_supported -+ - void __init hugetlbpage_init_defaultsize(void); - - int slice_is_hugepage_only_range(struct mm_struct *mm, unsigned long addr, -diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c -index 5826f5108a1244..4e4870031265c7 100644 ---- a/arch/powerpc/kernel/smp.c -+++ b/arch/powerpc/kernel/smp.c -@@ -1051,7 +1051,7 @@ static struct sched_domain_topology_level powerpc_topology[] = { - #endif - { shared_cache_mask, powerpc_shared_cache_flags, SD_INIT_NAME(CACHE) }, - { cpu_mc_mask, SD_INIT_NAME(MC) }, -- { cpu_cpu_mask, SD_INIT_NAME(DIE) }, -+ { cpu_cpu_mask, SD_INIT_NAME(PKG) }, - { NULL, }, - }; - -@@ -1595,7 +1595,7 @@ static void add_cpu_to_masks(int cpu) - /* Skip all CPUs already part of current CPU core mask */ - cpumask_andnot(mask, cpu_online_mask, cpu_core_mask(cpu)); - -- /* If chip_id is -1; limit the cpu_core_mask to within DIE*/ -+ /* If chip_id is -1; limit the cpu_core_mask to within PKG */ - if (chip_id == -1) - cpumask_and(mask, mask, cpu_cpu_mask(cpu)); - -diff --git a/arch/powerpc/sysdev/xive/native.c b/arch/powerpc/sysdev/xive/native.c -index f1c0fa6ece21d0..9928b93dbc4d4d 100644 ---- a/arch/powerpc/sysdev/xive/native.c -+++ b/arch/powerpc/sysdev/xive/native.c -@@ -559,9 +559,7 @@ bool __init xive_native_init(void) - struct device_node *np; - struct resource r; - void __iomem *tima; -- struct property *prop; - u8 max_prio = 7; -- const __be32 *p; - u32 val, cpu; - s64 rc; - -@@ -592,7 +590,7 @@ bool __init xive_native_init(void) - max_prio = val - 1; - - /* Iterate the EQ sizes and pick one */ -- of_property_for_each_u32(np, "ibm,xive-eq-sizes", prop, p, val) { -+ of_property_for_each_u32(np, "ibm,xive-eq-sizes", val) { - xive_queue_shift = val; - if (val == PAGE_SHIFT) - break; -diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c -index e4541926439100..f2fa985a2c7712 100644 ---- a/arch/powerpc/sysdev/xive/spapr.c -+++ b/arch/powerpc/sysdev/xive/spapr.c -@@ -814,7 +814,6 @@ bool __init xive_spapr_init(void) - struct device_node *np; - struct resource r; - void __iomem *tima; -- struct property *prop; - u8 max_prio; - u32 val; - u32 len; -@@ -866,7 +865,7 @@ bool __init xive_spapr_init(void) - } - - /* Iterate the EQ sizes and pick one */ -- of_property_for_each_u32(np, "ibm,xive-eq-sizes", prop, reg, val) { -+ of_property_for_each_u32(np, "ibm,xive-eq-sizes", val) { - xive_queue_shift = val; - if (val == PAGE_SHIFT) - break; -diff --git a/arch/riscv/kernel/vector.c b/arch/riscv/kernel/vector.c -index 8d92fb6c522cc2..81886fc36ed6ac 100644 ---- a/arch/riscv/kernel/vector.c -+++ b/arch/riscv/kernel/vector.c -@@ -270,7 +270,7 @@ static int __init riscv_v_sysctl_init(void) - static int __init riscv_v_sysctl_init(void) { return 0; } - #endif /* ! CONFIG_SYSCTL */ - --static int riscv_v_init(void) -+static int __init riscv_v_init(void) - { - return riscv_v_sysctl_init(); - } -diff --git a/arch/s390/Makefile b/arch/s390/Makefile -index 73873e4516866a..b77294ab0c58d7 100644 ---- a/arch/s390/Makefile -+++ b/arch/s390/Makefile -@@ -21,7 +21,7 @@ KBUILD_AFLAGS_DECOMPRESSOR := $(CLANG_FLAGS) -m64 -D__ASSEMBLY__ - ifndef CONFIG_AS_IS_LLVM - KBUILD_AFLAGS_DECOMPRESSOR += $(if $(CONFIG_DEBUG_INFO),$(aflags_dwarf)) - endif --KBUILD_CFLAGS_DECOMPRESSOR := $(CLANG_FLAGS) -m64 -O2 -mpacked-stack -+KBUILD_CFLAGS_DECOMPRESSOR := $(CLANG_FLAGS) -m64 -O2 -mpacked-stack -std=gnu11 - KBUILD_CFLAGS_DECOMPRESSOR += -DDISABLE_BRANCH_PROFILING -D__NO_FORTIFY - KBUILD_CFLAGS_DECOMPRESSOR += -fno-delete-null-pointer-checks -msoft-float -mbackchain - KBUILD_CFLAGS_DECOMPRESSOR += -fno-asynchronous-unwind-tables -diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c -index 5466e7bada03d2..65a66df5bb865e 100644 ---- a/arch/s390/kernel/perf_cpum_cf.c -+++ b/arch/s390/kernel/perf_cpum_cf.c -@@ -977,7 +977,7 @@ static int cfdiag_push_sample(struct perf_event *event, - if (event->attr.sample_type & PERF_SAMPLE_RAW) { - raw.frag.size = cpuhw->usedss; - raw.frag.data = cpuhw->stop; -- perf_sample_save_raw_data(&data, &raw); -+ perf_sample_save_raw_data(&data, event, &raw); - } - - overflow = perf_event_overflow(event, &data, ®s); -diff --git a/arch/s390/kernel/perf_pai_crypto.c b/arch/s390/kernel/perf_pai_crypto.c -index 4a4e914c283c80..044fba8332b22e 100644 ---- a/arch/s390/kernel/perf_pai_crypto.c -+++ b/arch/s390/kernel/perf_pai_crypto.c -@@ -365,7 +365,7 @@ static int paicrypt_push_sample(void) - if (event->attr.sample_type & PERF_SAMPLE_RAW) { - raw.frag.size = rawsize; - raw.frag.data = cpump->save; -- perf_sample_save_raw_data(&data, &raw); -+ perf_sample_save_raw_data(&data, event, &raw); - } - - overflow = perf_event_overflow(event, &data, ®s); -diff --git a/arch/s390/kernel/perf_pai_ext.c b/arch/s390/kernel/perf_pai_ext.c -index b5febe22d05464..089bd3104b3945 100644 ---- a/arch/s390/kernel/perf_pai_ext.c -+++ b/arch/s390/kernel/perf_pai_ext.c -@@ -454,7 +454,7 @@ static int paiext_push_sample(void) - if (event->attr.sample_type & PERF_SAMPLE_RAW) { - raw.frag.size = rawsize; - raw.frag.data = cpump->save; -- perf_sample_save_raw_data(&data, &raw); -+ perf_sample_save_raw_data(&data, event, &raw); - } - - overflow = perf_event_overflow(event, &data, ®s); -diff --git a/arch/s390/kernel/topology.c b/arch/s390/kernel/topology.c -index 68adf1de8888b2..66bda6a8f918c2 100644 ---- a/arch/s390/kernel/topology.c -+++ b/arch/s390/kernel/topology.c -@@ -522,7 +522,7 @@ static struct sched_domain_topology_level s390_topology[] = { - { cpu_coregroup_mask, cpu_core_flags, SD_INIT_NAME(MC) }, - { cpu_book_mask, SD_INIT_NAME(BOOK) }, - { cpu_drawer_mask, SD_INIT_NAME(DRAWER) }, -- { cpu_cpu_mask, SD_INIT_NAME(DIE) }, -+ { cpu_cpu_mask, SD_INIT_NAME(PKG) }, - { NULL, }, - }; - -diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile -index 4e930f56687899..fe7e71f91711b2 100644 ---- a/arch/s390/purgatory/Makefile -+++ b/arch/s390/purgatory/Makefile -@@ -21,7 +21,7 @@ UBSAN_SANITIZE := n - KASAN_SANITIZE := n - KCSAN_SANITIZE := n - --KBUILD_CFLAGS := -fno-strict-aliasing -Wall -Wstrict-prototypes -+KBUILD_CFLAGS := -std=gnu11 -fno-strict-aliasing -Wall -Wstrict-prototypes - KBUILD_CFLAGS += -Wno-pointer-sign -Wno-sign-compare - KBUILD_CFLAGS += -fno-zero-initialized-in-bss -fno-builtin -ffreestanding - KBUILD_CFLAGS += -Os -m64 -msoft-float -fno-common -diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c -index 6911c5399d02f3..f483874fa20f19 100644 ---- a/arch/x86/events/amd/ibs.c -+++ b/arch/x86/events/amd/ibs.c -@@ -1115,7 +1115,7 @@ static int perf_ibs_handle_irq(struct perf_ibs *perf_ibs, struct pt_regs *iregs) - .data = ibs_data.data, - }, - }; -- perf_sample_save_raw_data(&data, &raw); -+ perf_sample_save_raw_data(&data, event, &raw); - } - - if (perf_ibs == &perf_ibs_op) -diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c -index ce77dac9a0202a..a8f2ab816d5ae2 100644 ---- a/arch/x86/kernel/smpboot.c -+++ b/arch/x86/kernel/smpboot.c -@@ -604,14 +604,6 @@ static int x86_cluster_flags(void) - } - #endif - --static int x86_die_flags(void) --{ -- if (cpu_feature_enabled(X86_FEATURE_HYBRID_CPU)) -- return x86_sched_itmt_flags(); -- -- return 0; --} -- - /* - * Set if a package/die has multiple NUMA nodes inside. - * AMD Magny-Cours, Intel Cluster-on-Die, and Intel -@@ -641,13 +633,13 @@ static void __init build_sched_topology(void) - }; - #endif - /* -- * When there is NUMA topology inside the package skip the DIE domain -+ * When there is NUMA topology inside the package skip the PKG domain - * since the NUMA domains will auto-magically create the right spanning - * domains based on the SLIT. - */ - if (!x86_has_numa_in_package) { - x86_topology[i++] = (struct sched_domain_topology_level){ -- cpu_cpu_mask, x86_die_flags, SD_INIT_NAME(DIE) -+ cpu_cpu_mask, x86_sched_itmt_flags, SD_INIT_NAME(PKG) - }; - } - -diff --git a/block/genhd.c b/block/genhd.c -index 6d704c37f26e71..8f72539e08dea3 100644 ---- a/block/genhd.c -+++ b/block/genhd.c -@@ -763,7 +763,7 @@ static ssize_t disk_badblocks_store(struct device *dev, - } - - #ifdef CONFIG_BLOCK_LEGACY_AUTOLOAD --void blk_request_module(dev_t devt) -+static bool blk_probe_dev(dev_t devt) - { - unsigned int major = MAJOR(devt); - struct blk_major_name **n; -@@ -773,14 +773,26 @@ void blk_request_module(dev_t devt) - if ((*n)->major == major && (*n)->probe) { - (*n)->probe(devt); - mutex_unlock(&major_names_lock); -- return; -+ return true; - } - } - mutex_unlock(&major_names_lock); -+ return false; -+} -+ -+void blk_request_module(dev_t devt) -+{ -+ int error; -+ -+ if (blk_probe_dev(devt)) -+ return; - -- if (request_module("block-major-%d-%d", MAJOR(devt), MINOR(devt)) > 0) -- /* Make old-style 2.4 aliases work */ -- request_module("block-major-%d", MAJOR(devt)); -+ error = request_module("block-major-%d-%d", MAJOR(devt), MINOR(devt)); -+ /* Make old-style 2.4 aliases work */ -+ if (error > 0) -+ error = request_module("block-major-%d", MAJOR(devt)); -+ if (!error) -+ blk_probe_dev(devt); - } - #endif /* CONFIG_BLOCK_LEGACY_AUTOLOAD */ - -diff --git a/block/partitions/ldm.h b/block/partitions/ldm.h -index 0a747a0c782d5d..f98dbee9414977 100644 ---- a/block/partitions/ldm.h -+++ b/block/partitions/ldm.h -@@ -1,5 +1,5 @@ - // SPDX-License-Identifier: GPL-2.0-or-later --/** -+/* - * ldm - Part of the Linux-NTFS project. - * - * Copyright (C) 2001,2002 Richard Russon -diff --git a/drivers/acpi/acpica/achware.h b/drivers/acpi/acpica/achware.h -index 79bbfe00d241f9..b8543a34caeada 100644 ---- a/drivers/acpi/acpica/achware.h -+++ b/drivers/acpi/acpica/achware.h -@@ -103,8 +103,6 @@ acpi_hw_get_gpe_status(struct acpi_gpe_event_info *gpe_event_info, - - acpi_status acpi_hw_enable_all_runtime_gpes(void); - --acpi_status acpi_hw_enable_all_wakeup_gpes(void); -- - u8 acpi_hw_check_all_gpes(acpi_handle gpe_skip_device, u32 gpe_skip_number); - - acpi_status -diff --git a/drivers/acpi/fan_core.c b/drivers/acpi/fan_core.c -index 9dccbae9e8ea76..e416897e3931c4 100644 ---- a/drivers/acpi/fan_core.c -+++ b/drivers/acpi/fan_core.c -@@ -367,19 +367,25 @@ static int acpi_fan_probe(struct platform_device *pdev) - result = sysfs_create_link(&pdev->dev.kobj, - &cdev->device.kobj, - "thermal_cooling"); -- if (result) -+ if (result) { - dev_err(&pdev->dev, "Failed to create sysfs link 'thermal_cooling'\n"); -+ goto err_unregister; -+ } - - result = sysfs_create_link(&cdev->device.kobj, - &pdev->dev.kobj, - "device"); - if (result) { - dev_err(&pdev->dev, "Failed to create sysfs link 'device'\n"); -- goto err_end; -+ goto err_remove_link; - } - - return 0; - -+err_remove_link: -+ sysfs_remove_link(&pdev->dev.kobj, "thermal_cooling"); -+err_unregister: -+ thermal_cooling_device_unregister(cdev); - err_end: - if (fan->acpi4) - acpi_fan_delete_attributes(device); -diff --git a/drivers/base/class.c b/drivers/base/class.c -index 9cd489a5770866..695e7fba580b90 100644 ---- a/drivers/base/class.c -+++ b/drivers/base/class.c -@@ -314,8 +314,12 @@ void class_dev_iter_init(struct class_dev_iter *iter, const struct class *class, - struct subsys_private *sp = class_to_subsys(class); - struct klist_node *start_knode = NULL; - -- if (!sp) -+ memset(iter, 0, sizeof(*iter)); -+ if (!sp) { -+ pr_crit("%s: class %p was not registered yet\n", -+ __func__, class); - return; -+ } - - if (start) - start_knode = &start->p->knode_class; -@@ -342,6 +346,9 @@ struct device *class_dev_iter_next(struct class_dev_iter *iter) - struct klist_node *knode; - struct device *dev; - -+ if (!iter->sp) -+ return NULL; -+ - while (1) { - knode = klist_next(&iter->ki); - if (!knode) -diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c -index 96b349148e5788..2203686156bfe0 100644 ---- a/drivers/block/nbd.c -+++ b/drivers/block/nbd.c -@@ -2164,6 +2164,7 @@ static void nbd_disconnect_and_put(struct nbd_device *nbd) - flush_workqueue(nbd->recv_workq); - nbd_clear_que(nbd); - nbd->task_setup = NULL; -+ clear_bit(NBD_RT_BOUND, &nbd->config->runtime_flags); - mutex_unlock(&nbd->config_lock); - - if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, -diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c -index e809bb2dbe5e07..a4274d8c7faaf3 100644 ---- a/drivers/bluetooth/btnxpuart.c -+++ b/drivers/bluetooth/btnxpuart.c -@@ -1280,13 +1280,12 @@ static void btnxpuart_tx_work(struct work_struct *work) - - while ((skb = nxp_dequeue(nxpdev))) { - len = serdev_device_write_buf(serdev, skb->data, skb->len); -- serdev_device_wait_until_sent(serdev, 0); - hdev->stat.byte_tx += len; - - skb_pull(skb, len); - if (skb->len > 0) { - skb_queue_head(&nxpdev->txq, skb); -- break; -+ continue; - } - - switch (hci_skb_pkt_type(skb)) { -diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c -index 9ed9239b1228f6..65163312dab8ac 100644 ---- a/drivers/bus/ti-sysc.c -+++ b/drivers/bus/ti-sysc.c -@@ -2283,11 +2283,9 @@ static int sysc_init_idlemode(struct sysc *ddata, u8 *idlemodes, - const char *name) - { - struct device_node *np = ddata->dev->of_node; -- struct property *prop; -- const __be32 *p; - u32 val; - -- of_property_for_each_u32(np, name, prop, p, val) { -+ of_property_for_each_u32(np, name, val) { - if (val >= SYSC_NR_IDLEMODES) { - dev_err(ddata->dev, "invalid idlemode: %i\n", val); - return -EINVAL; -diff --git a/drivers/char/ipmi/ipmb_dev_int.c b/drivers/char/ipmi/ipmb_dev_int.c -index 49100845fcb7bb..93718919151292 100644 ---- a/drivers/char/ipmi/ipmb_dev_int.c -+++ b/drivers/char/ipmi/ipmb_dev_int.c -@@ -321,6 +321,9 @@ static int ipmb_probe(struct i2c_client *client) - ipmb_dev->miscdev.name = devm_kasprintf(&client->dev, GFP_KERNEL, - "%s%d", "ipmb-", - client->adapter->nr); -+ if (!ipmb_dev->miscdev.name) -+ return -ENOMEM; -+ - ipmb_dev->miscdev.fops = &ipmb_fops; - ipmb_dev->miscdev.parent = &client->dev; - ret = misc_register(&ipmb_dev->miscdev); -diff --git a/drivers/char/ipmi/ssif_bmc.c b/drivers/char/ipmi/ssif_bmc.c -index ab4e87a99f0874..e8460e966b83e8 100644 ---- a/drivers/char/ipmi/ssif_bmc.c -+++ b/drivers/char/ipmi/ssif_bmc.c -@@ -292,7 +292,6 @@ static void complete_response(struct ssif_bmc_ctx *ssif_bmc) - ssif_bmc->nbytes_processed = 0; - ssif_bmc->remain_len = 0; - ssif_bmc->busy = false; -- memset(&ssif_bmc->part_buf, 0, sizeof(struct ssif_part_buffer)); - wake_up_all(&ssif_bmc->wait_queue); - } - -@@ -744,9 +743,11 @@ static void on_stop_event(struct ssif_bmc_ctx *ssif_bmc, u8 *val) - ssif_bmc->aborting = true; - } - } else if (ssif_bmc->state == SSIF_RES_SENDING) { -- if (ssif_bmc->is_singlepart_read || ssif_bmc->block_num == 0xFF) -+ if (ssif_bmc->is_singlepart_read || ssif_bmc->block_num == 0xFF) { -+ memset(&ssif_bmc->part_buf, 0, sizeof(struct ssif_part_buffer)); - /* Invalidate response buffer to denote it is sent */ - complete_response(ssif_bmc); -+ } - ssif_bmc->state = SSIF_READY; - } - -diff --git a/drivers/clk/analogbits/wrpll-cln28hpc.c b/drivers/clk/analogbits/wrpll-cln28hpc.c -index 09ca8235639930..d8ae3929599697 100644 ---- a/drivers/clk/analogbits/wrpll-cln28hpc.c -+++ b/drivers/clk/analogbits/wrpll-cln28hpc.c -@@ -291,7 +291,7 @@ int wrpll_configure_for_rate(struct wrpll_cfg *c, u32 target_rate, - vco = vco_pre * f; - } - -- delta = abs(target_rate - vco); -+ delta = abs(target_vco_rate - vco); - if (delta < best_delta) { - best_delta = delta; - best_r = r; -diff --git a/drivers/clk/clk-conf.c b/drivers/clk/clk-conf.c -index 1a4e6340f95ce4..05842056202079 100644 ---- a/drivers/clk/clk-conf.c -+++ b/drivers/clk/clk-conf.c -@@ -81,13 +81,11 @@ static int __set_clk_parents(struct device_node *node, bool clk_supplier) - static int __set_clk_rates(struct device_node *node, bool clk_supplier) - { - struct of_phandle_args clkspec; -- struct property *prop; -- const __be32 *cur; - int rc, index = 0; - struct clk *clk; - u32 rate; - -- of_property_for_each_u32(node, "assigned-clock-rates", prop, cur, rate) { -+ of_property_for_each_u32(node, "assigned-clock-rates", rate) { - if (rate) { - rc = of_parse_phandle_with_args(node, "assigned-clocks", - "#clock-cells", index, &clkspec); -diff --git a/drivers/clk/clk-si5351.c b/drivers/clk/clk-si5351.c -index 00fb9b09e030c3..dd3573da12545c 100644 ---- a/drivers/clk/clk-si5351.c -+++ b/drivers/clk/clk-si5351.c -@@ -506,6 +506,8 @@ static int si5351_pll_set_rate(struct clk_hw *hw, unsigned long rate, - { - struct si5351_hw_data *hwdata = - container_of(hw, struct si5351_hw_data, hw); -+ struct si5351_platform_data *pdata = -+ hwdata->drvdata->client->dev.platform_data; - u8 reg = (hwdata->num == 0) ? SI5351_PLLA_PARAMETERS : - SI5351_PLLB_PARAMETERS; - -@@ -518,9 +520,10 @@ static int si5351_pll_set_rate(struct clk_hw *hw, unsigned long rate, - (hwdata->params.p2 == 0) ? SI5351_CLK_INTEGER_MODE : 0); - - /* Do a pll soft reset on the affected pll */ -- si5351_reg_write(hwdata->drvdata, SI5351_PLL_RESET, -- hwdata->num == 0 ? SI5351_PLL_RESET_A : -- SI5351_PLL_RESET_B); -+ if (pdata->pll_reset[hwdata->num]) -+ si5351_reg_write(hwdata->drvdata, SI5351_PLL_RESET, -+ hwdata->num == 0 ? SI5351_PLL_RESET_A : -+ SI5351_PLL_RESET_B); - - dev_dbg(&hwdata->drvdata->client->dev, - "%s - %s: p1 = %lu, p2 = %lu, p3 = %lu, parent_rate = %lu, rate = %lu\n", -@@ -1172,8 +1175,8 @@ static int si5351_dt_parse(struct i2c_client *client, - { - struct device_node *child, *np = client->dev.of_node; - struct si5351_platform_data *pdata; -- struct property *prop; -- const __be32 *p; -+ u32 array[4]; -+ int sz, i; - int num = 0; - u32 val; - -@@ -1188,20 +1191,24 @@ static int si5351_dt_parse(struct i2c_client *client, - * property silabs,pll-source : , [<..>] - * allow to selectively set pll source - */ -- of_property_for_each_u32(np, "silabs,pll-source", prop, p, num) { -+ sz = of_property_read_variable_u32_array(np, "silabs,pll-source", array, 2, 4); -+ sz = (sz == -EINVAL) ? 0 : sz; /* Missing property is OK */ -+ if (sz < 0) -+ return dev_err_probe(&client->dev, sz, "invalid pll-source\n"); -+ if (sz % 2) -+ return dev_err_probe(&client->dev, -EINVAL, -+ "missing pll-source for pll %d\n", array[sz - 1]); -+ -+ for (i = 0; i < sz; i += 2) { -+ num = array[i]; -+ val = array[i + 1]; -+ - if (num >= 2) { - dev_err(&client->dev, - "invalid pll %d on pll-source prop\n", num); - return -EINVAL; - } - -- p = of_prop_next_u32(prop, p, &val); -- if (!p) { -- dev_err(&client->dev, -- "missing pll-source for pll %d\n", num); -- return -EINVAL; -- } -- - switch (val) { - case 0: - pdata->pll_src[num] = SI5351_PLL_SRC_XTAL; -@@ -1222,6 +1229,49 @@ static int si5351_dt_parse(struct i2c_client *client, - } - } - -+ /* -+ * Parse PLL reset mode. For compatibility with older device trees, the -+ * default is to always reset a PLL after setting its rate. -+ */ -+ pdata->pll_reset[0] = true; -+ pdata->pll_reset[1] = true; -+ -+ sz = of_property_read_variable_u32_array(np, "silabs,pll-reset-mode", array, 2, 4); -+ sz = (sz == -EINVAL) ? 0 : sz; /* Missing property is OK */ -+ if (sz < 0) -+ return dev_err_probe(&client->dev, sz, "invalid pll-reset-mode\n"); -+ if (sz % 2) -+ return dev_err_probe(&client->dev, -EINVAL, -+ "missing pll-reset-mode for pll %d\n", array[sz - 1]); -+ -+ for (i = 0; i < sz; i += 2) { -+ num = array[i]; -+ val = array[i + 1]; -+ -+ if (num >= 2) { -+ dev_err(&client->dev, -+ "invalid pll %d on pll-reset-mode prop\n", num); -+ return -EINVAL; -+ } -+ -+ -+ switch (val) { -+ case 0: -+ /* Reset PLL whenever its rate is adjusted */ -+ pdata->pll_reset[num] = true; -+ break; -+ case 1: -+ /* Don't reset PLL whenever its rate is adjusted */ -+ pdata->pll_reset[num] = false; -+ break; -+ default: -+ dev_err(&client->dev, -+ "invalid pll-reset-mode %d for pll %d\n", val, -+ num); -+ return -EINVAL; -+ } -+ } -+ - /* per clkout properties */ - for_each_child_of_node(np, child) { - if (of_property_read_u32(child, "reg", &num)) { -diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c -index f8776065ad1f19..5bbd036f5295f5 100644 ---- a/drivers/clk/clk.c -+++ b/drivers/clk/clk.c -@@ -5316,9 +5316,8 @@ EXPORT_SYMBOL_GPL(of_clk_get_parent_count); - const char *of_clk_get_parent_name(const struct device_node *np, int index) - { - struct of_phandle_args clkspec; -- struct property *prop; - const char *clk_name; -- const __be32 *vp; -+ bool found = false; - u32 pv; - int rc; - int count; -@@ -5335,16 +5334,19 @@ const char *of_clk_get_parent_name(const struct device_node *np, int index) - /* if there is an indices property, use it to transfer the index - * specified into an array offset for the clock-output-names property. - */ -- of_property_for_each_u32(clkspec.np, "clock-indices", prop, vp, pv) { -+ of_property_for_each_u32(clkspec.np, "clock-indices", pv) { - if (index == pv) { - index = count; -+ found = true; - break; - } - count++; - } - /* We went off the end of 'clock-indices' without finding it */ -- if (prop && !vp) -+ if (of_property_present(clkspec.np, "clock-indices") && !found) { -+ of_node_put(clkspec.np); - return NULL; -+ } - - if (of_property_read_string_index(clkspec.np, "clock-output-names", - index, -@@ -5456,14 +5458,12 @@ static int parent_ready(struct device_node *np) - int of_clk_detect_critical(struct device_node *np, int index, - unsigned long *flags) - { -- struct property *prop; -- const __be32 *cur; - uint32_t idx; - - if (!np || !flags) - return -EINVAL; - -- of_property_for_each_u32(np, "clock-critical", prop, cur, idx) -+ of_property_for_each_u32(np, "clock-critical", idx) - if (index == idx) - *flags |= CLK_IS_CRITICAL; - -diff --git a/drivers/clk/imx/clk-imx8mp.c b/drivers/clk/imx/clk-imx8mp.c -index e561ff7b135fb5..747f5397692e5f 100644 ---- a/drivers/clk/imx/clk-imx8mp.c -+++ b/drivers/clk/imx/clk-imx8mp.c -@@ -399,8 +399,9 @@ static const char * const imx8mp_dram_core_sels[] = {"dram_pll_out", "dram_alt_r - - static const char * const imx8mp_clkout_sels[] = {"audio_pll1_out", "audio_pll2_out", "video_pll1_out", - "dummy", "dummy", "gpu_pll_out", "vpu_pll_out", -- "arm_pll_out", "sys_pll1", "sys_pll2", "sys_pll3", -- "dummy", "dummy", "osc_24m", "dummy", "osc_32k"}; -+ "arm_pll_out", "sys_pll1_out", "sys_pll2_out", -+ "sys_pll3_out", "dummy", "dummy", "osc_24m", -+ "dummy", "osc_32k"}; - - static struct clk_hw **hws; - static struct clk_hw_onecell_data *clk_hw_data; -diff --git a/drivers/clk/qcom/common.c b/drivers/clk/qcom/common.c -index 75f09e6e057e1a..35bd987f2e52ab 100644 ---- a/drivers/clk/qcom/common.c -+++ b/drivers/clk/qcom/common.c -@@ -208,11 +208,9 @@ EXPORT_SYMBOL_GPL(qcom_cc_register_sleep_clk); - static void qcom_cc_drop_protected(struct device *dev, struct qcom_cc *cc) - { - struct device_node *np = dev->of_node; -- struct property *prop; -- const __be32 *p; - u32 i; - -- of_property_for_each_u32(np, "protected-clocks", prop, p, i) { -+ of_property_for_each_u32(np, "protected-clocks", i) { - if (i >= cc->num_rclks) - continue; - -diff --git a/drivers/clk/qcom/gcc-sdm845.c b/drivers/clk/qcom/gcc-sdm845.c -index ea4c3bf4fb9bf7..1a23bfd9356d58 100644 ---- a/drivers/clk/qcom/gcc-sdm845.c -+++ b/drivers/clk/qcom/gcc-sdm845.c -@@ -454,7 +454,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s0_clk_src_init = { - .name = "gcc_qupv3_wrap0_s0_clk_src", - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), -- .ops = &clk_rcg2_shared_ops, -+ .ops = &clk_rcg2_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap0_s0_clk_src = { -@@ -470,7 +470,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s1_clk_src_init = { - .name = "gcc_qupv3_wrap0_s1_clk_src", - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), -- .ops = &clk_rcg2_shared_ops, -+ .ops = &clk_rcg2_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap0_s1_clk_src = { -@@ -486,7 +486,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s2_clk_src_init = { - .name = "gcc_qupv3_wrap0_s2_clk_src", - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), -- .ops = &clk_rcg2_shared_ops, -+ .ops = &clk_rcg2_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap0_s2_clk_src = { -@@ -502,7 +502,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s3_clk_src_init = { - .name = "gcc_qupv3_wrap0_s3_clk_src", - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), -- .ops = &clk_rcg2_shared_ops, -+ .ops = &clk_rcg2_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap0_s3_clk_src = { -@@ -518,7 +518,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s4_clk_src_init = { - .name = "gcc_qupv3_wrap0_s4_clk_src", - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), -- .ops = &clk_rcg2_shared_ops, -+ .ops = &clk_rcg2_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap0_s4_clk_src = { -@@ -534,7 +534,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s5_clk_src_init = { - .name = "gcc_qupv3_wrap0_s5_clk_src", - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), -- .ops = &clk_rcg2_shared_ops, -+ .ops = &clk_rcg2_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap0_s5_clk_src = { -@@ -550,7 +550,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s6_clk_src_init = { - .name = "gcc_qupv3_wrap0_s6_clk_src", - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), -- .ops = &clk_rcg2_shared_ops, -+ .ops = &clk_rcg2_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap0_s6_clk_src = { -@@ -566,7 +566,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s7_clk_src_init = { - .name = "gcc_qupv3_wrap0_s7_clk_src", - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), -- .ops = &clk_rcg2_shared_ops, -+ .ops = &clk_rcg2_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap0_s7_clk_src = { -@@ -582,7 +582,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s0_clk_src_init = { - .name = "gcc_qupv3_wrap1_s0_clk_src", - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), -- .ops = &clk_rcg2_shared_ops, -+ .ops = &clk_rcg2_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap1_s0_clk_src = { -@@ -598,7 +598,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s1_clk_src_init = { - .name = "gcc_qupv3_wrap1_s1_clk_src", - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), -- .ops = &clk_rcg2_shared_ops, -+ .ops = &clk_rcg2_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap1_s1_clk_src = { -@@ -614,7 +614,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s2_clk_src_init = { - .name = "gcc_qupv3_wrap1_s2_clk_src", - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), -- .ops = &clk_rcg2_shared_ops, -+ .ops = &clk_rcg2_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap1_s2_clk_src = { -@@ -630,7 +630,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s3_clk_src_init = { - .name = "gcc_qupv3_wrap1_s3_clk_src", - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), -- .ops = &clk_rcg2_shared_ops, -+ .ops = &clk_rcg2_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap1_s3_clk_src = { -@@ -646,7 +646,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s4_clk_src_init = { - .name = "gcc_qupv3_wrap1_s4_clk_src", - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), -- .ops = &clk_rcg2_shared_ops, -+ .ops = &clk_rcg2_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap1_s4_clk_src = { -@@ -662,7 +662,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s5_clk_src_init = { - .name = "gcc_qupv3_wrap1_s5_clk_src", - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), -- .ops = &clk_rcg2_shared_ops, -+ .ops = &clk_rcg2_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap1_s5_clk_src = { -@@ -678,7 +678,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s6_clk_src_init = { - .name = "gcc_qupv3_wrap1_s6_clk_src", - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), -- .ops = &clk_rcg2_shared_ops, -+ .ops = &clk_rcg2_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap1_s6_clk_src = { -@@ -694,7 +694,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s7_clk_src_init = { - .name = "gcc_qupv3_wrap1_s7_clk_src", - .parent_data = gcc_parent_data_0, - .num_parents = ARRAY_SIZE(gcc_parent_data_0), -- .ops = &clk_rcg2_shared_ops, -+ .ops = &clk_rcg2_ops, - }; - - static struct clk_rcg2 gcc_qupv3_wrap1_s7_clk_src = { -diff --git a/drivers/clk/ralink/clk-mtmips.c b/drivers/clk/ralink/clk-mtmips.c -index 76285fbbdeaa2d..4b5d8b741e4e17 100644 ---- a/drivers/clk/ralink/clk-mtmips.c -+++ b/drivers/clk/ralink/clk-mtmips.c -@@ -264,7 +264,6 @@ static int mtmips_register_pherip_clocks(struct device_node *np, - } - - static struct mtmips_clk_fixed rt3883_fixed_clocks[] = { -- CLK_FIXED("xtal", NULL, 40000000), - CLK_FIXED("periph", "xtal", 40000000) - }; - -diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c -index 6a4b2b9ef30a82..aee1a2f14c9517 100644 ---- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c -+++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c -@@ -533,11 +533,11 @@ static SUNXI_CCU_M_WITH_MUX_GATE(de_clk, "de", de_parents, - CLK_SET_RATE_PARENT); - - /* -- * DSI output seems to work only when PLL_MIPI selected. Set it and prevent -- * the mux from reparenting. -+ * Experiments showed that RGB output requires pll-video0-2x, while DSI -+ * requires pll-mipi. It will not work with incorrect clock, the screen will -+ * be blank. -+ * sun50i-a64.dtsi assigns pll-mipi as TCON0 parent by default - */ --#define SUN50I_A64_TCON0_CLK_REG 0x118 -- - static const char * const tcon0_parents[] = { "pll-mipi", "pll-video0-2x" }; - static const u8 tcon0_table[] = { 0, 2, }; - static SUNXI_CCU_MUX_TABLE_WITH_GATE_CLOSEST(tcon0_clk, "tcon0", tcon0_parents, -@@ -957,11 +957,6 @@ static int sun50i_a64_ccu_probe(struct platform_device *pdev) - - writel(0x515, reg + SUN50I_A64_PLL_MIPI_REG); - -- /* Set PLL MIPI as parent for TCON0 */ -- val = readl(reg + SUN50I_A64_TCON0_CLK_REG); -- val &= ~GENMASK(26, 24); -- writel(val | (0 << 24), reg + SUN50I_A64_TCON0_CLK_REG); -- - ret = devm_sunxi_ccu_probe(&pdev->dev, reg, &sun50i_a64_ccu_desc); - if (ret) - return ret; -diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.h b/drivers/clk/sunxi-ng/ccu-sun50i-a64.h -index a8c11c0b4e0676..dfba88a5ad0f7c 100644 ---- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.h -+++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.h -@@ -21,7 +21,6 @@ - - /* PLL_VIDEO0 exported for HDMI PHY */ - --#define CLK_PLL_VIDEO0_2X 8 - #define CLK_PLL_VE 9 - #define CLK_PLL_DDR0 10 - -@@ -32,7 +31,6 @@ - #define CLK_PLL_PERIPH1_2X 14 - #define CLK_PLL_VIDEO1 15 - #define CLK_PLL_GPU 16 --#define CLK_PLL_MIPI 17 - #define CLK_PLL_HSIC 18 - #define CLK_PLL_DE 19 - #define CLK_PLL_DDR1 20 -diff --git a/drivers/clk/sunxi/clk-simple-gates.c b/drivers/clk/sunxi/clk-simple-gates.c -index 0399627c226a68..845efc1ec800b9 100644 ---- a/drivers/clk/sunxi/clk-simple-gates.c -+++ b/drivers/clk/sunxi/clk-simple-gates.c -@@ -21,11 +21,9 @@ static void __init sunxi_simple_gates_setup(struct device_node *node, - { - struct clk_onecell_data *clk_data; - const char *clk_parent, *clk_name; -- struct property *prop; - struct resource res; - void __iomem *clk_reg; - void __iomem *reg; -- const __be32 *p; - int number, i = 0, j; - u8 clk_bit; - u32 index; -@@ -47,7 +45,7 @@ static void __init sunxi_simple_gates_setup(struct device_node *node, - if (!clk_data->clks) - goto err_free_data; - -- of_property_for_each_u32(node, "clock-indices", prop, p, index) { -+ of_property_for_each_u32(node, "clock-indices", index) { - of_property_read_string_index(node, "clock-output-names", - i, &clk_name); - -diff --git a/drivers/clk/sunxi/clk-sun8i-bus-gates.c b/drivers/clk/sunxi/clk-sun8i-bus-gates.c -index b87f331f63c9e8..8482ac8e5898a0 100644 ---- a/drivers/clk/sunxi/clk-sun8i-bus-gates.c -+++ b/drivers/clk/sunxi/clk-sun8i-bus-gates.c -@@ -24,11 +24,9 @@ static void __init sun8i_h3_bus_gates_init(struct device_node *node) - const char *parents[PARENT_MAX]; - struct clk_onecell_data *clk_data; - const char *clk_name; -- struct property *prop; - struct resource res; - void __iomem *clk_reg; - void __iomem *reg; -- const __be32 *p; - int number, i; - u8 clk_bit; - int index; -@@ -58,7 +56,7 @@ static void __init sun8i_h3_bus_gates_init(struct device_node *node) - goto err_free_data; - - i = 0; -- of_property_for_each_u32(node, "clock-indices", prop, p, index) { -+ of_property_for_each_u32(node, "clock-indices", index) { - of_property_read_string_index(node, "clock-output-names", - i, &clk_name); - -diff --git a/drivers/clocksource/samsung_pwm_timer.c b/drivers/clocksource/samsung_pwm_timer.c -index 6e46781bc9acff..b9561e3f196c42 100644 ---- a/drivers/clocksource/samsung_pwm_timer.c -+++ b/drivers/clocksource/samsung_pwm_timer.c -@@ -418,8 +418,6 @@ void __init samsung_pwm_clocksource_init(void __iomem *base, - static int __init samsung_pwm_alloc(struct device_node *np, - const struct samsung_pwm_variant *variant) - { -- struct property *prop; -- const __be32 *cur; - u32 val; - int i, ret; - -@@ -427,7 +425,7 @@ static int __init samsung_pwm_alloc(struct device_node *np, - for (i = 0; i < SAMSUNG_PWM_NUM; ++i) - pwm.irq[i] = irq_of_parse_and_map(np, i); - -- of_property_for_each_u32(np, "samsung,pwm-outputs", prop, cur, val) { -+ of_property_for_each_u32(np, "samsung,pwm-outputs", val) { - if (val >= SAMSUNG_PWM_NUM) { - pr_warn("%s: invalid channel index in samsung,pwm-outputs property\n", __func__); - continue; -diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c -index 4ac3a35dcd983c..0615e7fa20ad7e 100644 ---- a/drivers/cpufreq/acpi-cpufreq.c -+++ b/drivers/cpufreq/acpi-cpufreq.c -@@ -628,7 +628,14 @@ static int acpi_cpufreq_blacklist(struct cpuinfo_x86 *c) - #endif - - #ifdef CONFIG_ACPI_CPPC_LIB --static u64 get_max_boost_ratio(unsigned int cpu) -+/* -+ * get_max_boost_ratio: Computes the max_boost_ratio as the ratio -+ * between the highest_perf and the nominal_perf. -+ * -+ * Returns the max_boost_ratio for @cpu. Returns the CPPC nominal -+ * frequency via @nominal_freq if it is non-NULL pointer. -+ */ -+static u64 get_max_boost_ratio(unsigned int cpu, u64 *nominal_freq) - { - struct cppc_perf_caps perf_caps; - u64 highest_perf, nominal_perf; -@@ -651,6 +658,9 @@ static u64 get_max_boost_ratio(unsigned int cpu) - - nominal_perf = perf_caps.nominal_perf; - -+ if (nominal_freq) -+ *nominal_freq = perf_caps.nominal_freq; -+ - if (!highest_perf || !nominal_perf) { - pr_debug("CPU%d: highest or nominal performance missing\n", cpu); - return 0; -@@ -663,8 +673,12 @@ static u64 get_max_boost_ratio(unsigned int cpu) - - return div_u64(highest_perf << SCHED_CAPACITY_SHIFT, nominal_perf); - } -+ - #else --static inline u64 get_max_boost_ratio(unsigned int cpu) { return 0; } -+static inline u64 get_max_boost_ratio(unsigned int cpu, u64 *nominal_freq) -+{ -+ return 0; -+} - #endif - - static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy) -@@ -674,9 +688,9 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy) - struct acpi_cpufreq_data *data; - unsigned int cpu = policy->cpu; - struct cpuinfo_x86 *c = &cpu_data(cpu); -+ u64 max_boost_ratio, nominal_freq = 0; - unsigned int valid_states = 0; - unsigned int result = 0; -- u64 max_boost_ratio; - unsigned int i; - #ifdef CONFIG_SMP - static int blacklisted; -@@ -826,16 +840,20 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy) - } - freq_table[valid_states].frequency = CPUFREQ_TABLE_END; - -- max_boost_ratio = get_max_boost_ratio(cpu); -+ max_boost_ratio = get_max_boost_ratio(cpu, &nominal_freq); - if (max_boost_ratio) { -- unsigned int freq = freq_table[0].frequency; -+ unsigned int freq = nominal_freq; - - /* -- * Because the loop above sorts the freq_table entries in the -- * descending order, freq is the maximum frequency in the table. -- * Assume that it corresponds to the CPPC nominal frequency and -- * use it to set cpuinfo.max_freq. -+ * The loop above sorts the freq_table entries in the -+ * descending order. If ACPI CPPC has not advertised -+ * the nominal frequency (this is possible in CPPC -+ * revisions prior to 3), then use the first entry in -+ * the pstate table as a proxy for nominal frequency. - */ -+ if (!freq) -+ freq = freq_table[0].frequency; -+ - policy->cpuinfo.max_freq = freq * max_boost_ratio >> SCHED_CAPACITY_SHIFT; - } else { - /* -diff --git a/drivers/cpufreq/qcom-cpufreq-hw.c b/drivers/cpufreq/qcom-cpufreq-hw.c -index 70b0f21968a010..92c0fc4a3cf60b 100644 ---- a/drivers/cpufreq/qcom-cpufreq-hw.c -+++ b/drivers/cpufreq/qcom-cpufreq-hw.c -@@ -142,14 +142,12 @@ static unsigned long qcom_lmh_get_throttle_freq(struct qcom_cpufreq_data *data) - } - - /* Get the frequency requested by the cpufreq core for the CPU */ --static unsigned int qcom_cpufreq_get_freq(unsigned int cpu) -+static unsigned int qcom_cpufreq_get_freq(struct cpufreq_policy *policy) - { - struct qcom_cpufreq_data *data; - const struct qcom_cpufreq_soc_data *soc_data; -- struct cpufreq_policy *policy; - unsigned int index; - -- policy = cpufreq_cpu_get_raw(cpu); - if (!policy) - return 0; - -@@ -162,12 +160,10 @@ static unsigned int qcom_cpufreq_get_freq(unsigned int cpu) - return policy->freq_table[index].frequency; - } - --static unsigned int qcom_cpufreq_hw_get(unsigned int cpu) -+static unsigned int __qcom_cpufreq_hw_get(struct cpufreq_policy *policy) - { - struct qcom_cpufreq_data *data; -- struct cpufreq_policy *policy; - -- policy = cpufreq_cpu_get_raw(cpu); - if (!policy) - return 0; - -@@ -176,7 +172,12 @@ static unsigned int qcom_cpufreq_hw_get(unsigned int cpu) - if (data->throttle_irq >= 0) - return qcom_lmh_get_throttle_freq(data) / HZ_PER_KHZ; - -- return qcom_cpufreq_get_freq(cpu); -+ return qcom_cpufreq_get_freq(policy); -+} -+ -+static unsigned int qcom_cpufreq_hw_get(unsigned int cpu) -+{ -+ return __qcom_cpufreq_hw_get(cpufreq_cpu_get_raw(cpu)); - } - - static unsigned int qcom_cpufreq_hw_fast_switch(struct cpufreq_policy *policy, -@@ -362,7 +363,7 @@ static void qcom_lmh_dcvs_notify(struct qcom_cpufreq_data *data) - * If h/w throttled frequency is higher than what cpufreq has requested - * for, then stop polling and switch back to interrupt mechanism. - */ -- if (throttled_freq >= qcom_cpufreq_get_freq(cpu)) -+ if (throttled_freq >= qcom_cpufreq_get_freq(cpufreq_cpu_get_raw(cpu))) - enable_irq(data->throttle_irq); - else - mod_delayed_work(system_highpri_wq, &data->throttle_work, -@@ -440,7 +441,6 @@ static int qcom_cpufreq_hw_lmh_init(struct cpufreq_policy *policy, int index) - return data->throttle_irq; - - data->cancel_throttle = false; -- data->policy = policy; - - mutex_init(&data->throttle_lock); - INIT_DEFERRABLE_WORK(&data->throttle_work, qcom_lmh_dcvs_poll); -@@ -551,6 +551,7 @@ static int qcom_cpufreq_hw_cpu_init(struct cpufreq_policy *policy) - - policy->driver_data = data; - policy->dvfs_possible_from_any_cpu = true; -+ data->policy = policy; - - ret = qcom_cpufreq_hw_read_lut(cpu_dev, policy); - if (ret) { -@@ -623,11 +624,24 @@ static unsigned long qcom_cpufreq_hw_recalc_rate(struct clk_hw *hw, unsigned lon - { - struct qcom_cpufreq_data *data = container_of(hw, struct qcom_cpufreq_data, cpu_clk); - -- return qcom_lmh_get_throttle_freq(data); -+ return __qcom_cpufreq_hw_get(data->policy) * HZ_PER_KHZ; -+} -+ -+/* -+ * Since we cannot determine the closest rate of the target rate, let's just -+ * return the actual rate at which the clock is running at. This is needed to -+ * make clk_set_rate() API work properly. -+ */ -+static int qcom_cpufreq_hw_determine_rate(struct clk_hw *hw, struct clk_rate_request *req) -+{ -+ req->rate = qcom_cpufreq_hw_recalc_rate(hw, 0); -+ -+ return 0; - } - - static const struct clk_ops qcom_cpufreq_hw_clk_ops = { - .recalc_rate = qcom_cpufreq_hw_recalc_rate, -+ .determine_rate = qcom_cpufreq_hw_determine_rate, - }; - - static int qcom_cpufreq_hw_driver_probe(struct platform_device *pdev) -diff --git a/drivers/crypto/caam/blob_gen.c b/drivers/crypto/caam/blob_gen.c -index 87781c1534ee5b..079a22cc9f02be 100644 ---- a/drivers/crypto/caam/blob_gen.c -+++ b/drivers/crypto/caam/blob_gen.c -@@ -2,6 +2,7 @@ - /* - * Copyright (C) 2015 Pengutronix, Steffen Trumtrar - * Copyright (C) 2021 Pengutronix, Ahmad Fatoum -+ * Copyright 2024 NXP - */ - - #define pr_fmt(fmt) "caam blob_gen: " fmt -@@ -104,7 +105,7 @@ int caam_process_blob(struct caam_blob_priv *priv, - } - - ctrlpriv = dev_get_drvdata(jrdev->parent); -- moo = FIELD_GET(CSTA_MOO, rd_reg32(&ctrlpriv->ctrl->perfmon.status)); -+ moo = FIELD_GET(CSTA_MOO, rd_reg32(&ctrlpriv->jr[0]->perfmon.status)); - if (moo != CSTA_MOO_SECURE && moo != CSTA_MOO_TRUSTED) - dev_warn(jrdev, - "using insecure test key, enable HAB to use unique device key!\n"); -diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h -index 410c83712e2851..30c2b1a64695c0 100644 ---- a/drivers/crypto/hisilicon/sec2/sec.h -+++ b/drivers/crypto/hisilicon/sec2/sec.h -@@ -37,6 +37,7 @@ struct sec_aead_req { - u8 *a_ivin; - dma_addr_t a_ivin_dma; - struct aead_request *aead_req; -+ bool fallback; - }; - - /* SEC request of Crypto */ -@@ -90,9 +91,7 @@ struct sec_auth_ctx { - dma_addr_t a_key_dma; - u8 *a_key; - u8 a_key_len; -- u8 mac_len; - u8 a_alg; -- bool fallback; - struct crypto_shash *hash_tfm; - struct crypto_aead *fallback_aead_tfm; - }; -diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c -index 932cc277eb3a5e..8a6dd2513370a2 100644 ---- a/drivers/crypto/hisilicon/sec2/sec_crypto.c -+++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c -@@ -849,6 +849,7 @@ static int sec_skcipher_setkey(struct crypto_skcipher *tfm, const u8 *key, - ret = sec_skcipher_aes_sm4_setkey(c_ctx, keylen, c_mode); - break; - default: -+ dev_err(dev, "sec c_alg err!\n"); - return -EINVAL; - } - -@@ -952,15 +953,14 @@ static int sec_aead_mac_init(struct sec_aead_req *req) - struct aead_request *aead_req = req->aead_req; - struct crypto_aead *tfm = crypto_aead_reqtfm(aead_req); - size_t authsize = crypto_aead_authsize(tfm); -- u8 *mac_out = req->out_mac; - struct scatterlist *sgl = aead_req->src; -+ u8 *mac_out = req->out_mac; - size_t copy_size; - off_t skip_size; - - /* Copy input mac */ - skip_size = aead_req->assoclen + aead_req->cryptlen - authsize; -- copy_size = sg_pcopy_to_buffer(sgl, sg_nents(sgl), mac_out, -- authsize, skip_size); -+ copy_size = sg_pcopy_to_buffer(sgl, sg_nents(sgl), mac_out, authsize, skip_size); - if (unlikely(copy_size != authsize)) - return -EINVAL; - -@@ -1123,10 +1123,7 @@ static int sec_aead_setauthsize(struct crypto_aead *aead, unsigned int authsize) - struct sec_ctx *ctx = crypto_tfm_ctx(tfm); - struct sec_auth_ctx *a_ctx = &ctx->a_ctx; - -- if (unlikely(a_ctx->fallback_aead_tfm)) -- return crypto_aead_setauthsize(a_ctx->fallback_aead_tfm, authsize); -- -- return 0; -+ return crypto_aead_setauthsize(a_ctx->fallback_aead_tfm, authsize); - } - - static int sec_aead_fallback_setkey(struct sec_auth_ctx *a_ctx, -@@ -1142,7 +1139,6 @@ static int sec_aead_fallback_setkey(struct sec_auth_ctx *a_ctx, - static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, - const u32 keylen, const enum sec_hash_alg a_alg, - const enum sec_calg c_alg, -- const enum sec_mac_len mac_len, - const enum sec_cmode c_mode) - { - struct sec_ctx *ctx = crypto_aead_ctx(tfm); -@@ -1154,7 +1150,6 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, - - ctx->a_ctx.a_alg = a_alg; - ctx->c_ctx.c_alg = c_alg; -- ctx->a_ctx.mac_len = mac_len; - c_ctx->c_mode = c_mode; - - if (c_mode == SEC_CMODE_CCM || c_mode == SEC_CMODE_GCM) { -@@ -1165,16 +1160,11 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, - } - memcpy(c_ctx->c_key, key, keylen); - -- if (unlikely(a_ctx->fallback_aead_tfm)) { -- ret = sec_aead_fallback_setkey(a_ctx, tfm, key, keylen); -- if (ret) -- return ret; -- } -- -- return 0; -+ return sec_aead_fallback_setkey(a_ctx, tfm, key, keylen); - } - -- if (crypto_authenc_extractkeys(&keys, key, keylen)) -+ ret = crypto_authenc_extractkeys(&keys, key, keylen); -+ if (ret) - goto bad_key; - - ret = sec_aead_aes_set_key(c_ctx, &keys); -@@ -1189,9 +1179,15 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, - goto bad_key; - } - -- if ((ctx->a_ctx.mac_len & SEC_SQE_LEN_RATE_MASK) || -- (ctx->a_ctx.a_key_len & SEC_SQE_LEN_RATE_MASK)) { -- dev_err(dev, "MAC or AUTH key length error!\n"); -+ if (ctx->a_ctx.a_key_len & SEC_SQE_LEN_RATE_MASK) { -+ ret = -EINVAL; -+ dev_err(dev, "AUTH key length error!\n"); -+ goto bad_key; -+ } -+ -+ ret = sec_aead_fallback_setkey(a_ctx, tfm, key, keylen); -+ if (ret) { -+ dev_err(dev, "set sec fallback key err!\n"); - goto bad_key; - } - -@@ -1199,31 +1195,23 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, - - bad_key: - memzero_explicit(&keys, sizeof(struct crypto_authenc_keys)); -- return -EINVAL; -+ return ret; - } - - --#define GEN_SEC_AEAD_SETKEY_FUNC(name, aalg, calg, maclen, cmode) \ --static int sec_setkey_##name(struct crypto_aead *tfm, const u8 *key, \ -- u32 keylen) \ --{ \ -- return sec_aead_setkey(tfm, key, keylen, aalg, calg, maclen, cmode);\ --} -- --GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha1, SEC_A_HMAC_SHA1, -- SEC_CALG_AES, SEC_HMAC_SHA1_MAC, SEC_CMODE_CBC) --GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha256, SEC_A_HMAC_SHA256, -- SEC_CALG_AES, SEC_HMAC_SHA256_MAC, SEC_CMODE_CBC) --GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha512, SEC_A_HMAC_SHA512, -- SEC_CALG_AES, SEC_HMAC_SHA512_MAC, SEC_CMODE_CBC) --GEN_SEC_AEAD_SETKEY_FUNC(aes_ccm, 0, SEC_CALG_AES, -- SEC_HMAC_CCM_MAC, SEC_CMODE_CCM) --GEN_SEC_AEAD_SETKEY_FUNC(aes_gcm, 0, SEC_CALG_AES, -- SEC_HMAC_GCM_MAC, SEC_CMODE_GCM) --GEN_SEC_AEAD_SETKEY_FUNC(sm4_ccm, 0, SEC_CALG_SM4, -- SEC_HMAC_CCM_MAC, SEC_CMODE_CCM) --GEN_SEC_AEAD_SETKEY_FUNC(sm4_gcm, 0, SEC_CALG_SM4, -- SEC_HMAC_GCM_MAC, SEC_CMODE_GCM) -+#define GEN_SEC_AEAD_SETKEY_FUNC(name, aalg, calg, cmode) \ -+static int sec_setkey_##name(struct crypto_aead *tfm, const u8 *key, u32 keylen) \ -+{ \ -+ return sec_aead_setkey(tfm, key, keylen, aalg, calg, cmode); \ -+} -+ -+GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha1, SEC_A_HMAC_SHA1, SEC_CALG_AES, SEC_CMODE_CBC) -+GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha256, SEC_A_HMAC_SHA256, SEC_CALG_AES, SEC_CMODE_CBC) -+GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha512, SEC_A_HMAC_SHA512, SEC_CALG_AES, SEC_CMODE_CBC) -+GEN_SEC_AEAD_SETKEY_FUNC(aes_ccm, 0, SEC_CALG_AES, SEC_CMODE_CCM) -+GEN_SEC_AEAD_SETKEY_FUNC(aes_gcm, 0, SEC_CALG_AES, SEC_CMODE_GCM) -+GEN_SEC_AEAD_SETKEY_FUNC(sm4_ccm, 0, SEC_CALG_SM4, SEC_CMODE_CCM) -+GEN_SEC_AEAD_SETKEY_FUNC(sm4_gcm, 0, SEC_CALG_SM4, SEC_CMODE_GCM) - - static int sec_aead_sgl_map(struct sec_ctx *ctx, struct sec_req *req) - { -@@ -1471,9 +1459,10 @@ static void sec_skcipher_callback(struct sec_ctx *ctx, struct sec_req *req, - static void set_aead_auth_iv(struct sec_ctx *ctx, struct sec_req *req) - { - struct aead_request *aead_req = req->aead_req.aead_req; -- struct sec_cipher_req *c_req = &req->c_req; -+ struct crypto_aead *tfm = crypto_aead_reqtfm(aead_req); -+ size_t authsize = crypto_aead_authsize(tfm); - struct sec_aead_req *a_req = &req->aead_req; -- size_t authsize = ctx->a_ctx.mac_len; -+ struct sec_cipher_req *c_req = &req->c_req; - u32 data_size = aead_req->cryptlen; - u8 flage = 0; - u8 cm, cl; -@@ -1514,10 +1503,8 @@ static void set_aead_auth_iv(struct sec_ctx *ctx, struct sec_req *req) - static void sec_aead_set_iv(struct sec_ctx *ctx, struct sec_req *req) - { - struct aead_request *aead_req = req->aead_req.aead_req; -- struct crypto_aead *tfm = crypto_aead_reqtfm(aead_req); -- size_t authsize = crypto_aead_authsize(tfm); -- struct sec_cipher_req *c_req = &req->c_req; - struct sec_aead_req *a_req = &req->aead_req; -+ struct sec_cipher_req *c_req = &req->c_req; - - memcpy(c_req->c_ivin, aead_req->iv, ctx->c_ctx.ivsize); - -@@ -1525,15 +1512,11 @@ static void sec_aead_set_iv(struct sec_ctx *ctx, struct sec_req *req) - /* - * CCM 16Byte Cipher_IV: {1B_Flage,13B_IV,2B_counter}, - * the counter must set to 0x01 -+ * CCM 16Byte Auth_IV: {1B_AFlage,13B_IV,2B_Ptext_length} - */ -- ctx->a_ctx.mac_len = authsize; -- /* CCM 16Byte Auth_IV: {1B_AFlage,13B_IV,2B_Ptext_length} */ - set_aead_auth_iv(ctx, req); -- } -- -- /* GCM 12Byte Cipher_IV == Auth_IV */ -- if (ctx->c_ctx.c_mode == SEC_CMODE_GCM) { -- ctx->a_ctx.mac_len = authsize; -+ } else if (ctx->c_ctx.c_mode == SEC_CMODE_GCM) { -+ /* GCM 12Byte Cipher_IV == Auth_IV */ - memcpy(a_req->a_ivin, c_req->c_ivin, SEC_AIV_SIZE); - } - } -@@ -1543,9 +1526,11 @@ static void sec_auth_bd_fill_xcm(struct sec_auth_ctx *ctx, int dir, - { - struct sec_aead_req *a_req = &req->aead_req; - struct aead_request *aq = a_req->aead_req; -+ struct crypto_aead *tfm = crypto_aead_reqtfm(aq); -+ size_t authsize = crypto_aead_authsize(tfm); - - /* C_ICV_Len is MAC size, 0x4 ~ 0x10 */ -- sec_sqe->type2.icvw_kmode |= cpu_to_le16((u16)ctx->mac_len); -+ sec_sqe->type2.icvw_kmode |= cpu_to_le16((u16)authsize); - - /* mode set to CCM/GCM, don't set {A_Alg, AKey_Len, MAC_Len} */ - sec_sqe->type2.a_key_addr = sec_sqe->type2.c_key_addr; -@@ -1569,9 +1554,11 @@ static void sec_auth_bd_fill_xcm_v3(struct sec_auth_ctx *ctx, int dir, - { - struct sec_aead_req *a_req = &req->aead_req; - struct aead_request *aq = a_req->aead_req; -+ struct crypto_aead *tfm = crypto_aead_reqtfm(aq); -+ size_t authsize = crypto_aead_authsize(tfm); - - /* C_ICV_Len is MAC size, 0x4 ~ 0x10 */ -- sqe3->c_icv_key |= cpu_to_le16((u16)ctx->mac_len << SEC_MAC_OFFSET_V3); -+ sqe3->c_icv_key |= cpu_to_le16((u16)authsize << SEC_MAC_OFFSET_V3); - - /* mode set to CCM/GCM, don't set {A_Alg, AKey_Len, MAC_Len} */ - sqe3->a_key_addr = sqe3->c_key_addr; -@@ -1595,11 +1582,12 @@ static void sec_auth_bd_fill_ex(struct sec_auth_ctx *ctx, int dir, - struct sec_aead_req *a_req = &req->aead_req; - struct sec_cipher_req *c_req = &req->c_req; - struct aead_request *aq = a_req->aead_req; -+ struct crypto_aead *tfm = crypto_aead_reqtfm(aq); -+ size_t authsize = crypto_aead_authsize(tfm); - - sec_sqe->type2.a_key_addr = cpu_to_le64(ctx->a_key_dma); - -- sec_sqe->type2.mac_key_alg = -- cpu_to_le32(ctx->mac_len / SEC_SQE_LEN_RATE); -+ sec_sqe->type2.mac_key_alg = cpu_to_le32(authsize / SEC_SQE_LEN_RATE); - - sec_sqe->type2.mac_key_alg |= - cpu_to_le32((u32)((ctx->a_key_len) / -@@ -1649,11 +1637,13 @@ static void sec_auth_bd_fill_ex_v3(struct sec_auth_ctx *ctx, int dir, - struct sec_aead_req *a_req = &req->aead_req; - struct sec_cipher_req *c_req = &req->c_req; - struct aead_request *aq = a_req->aead_req; -+ struct crypto_aead *tfm = crypto_aead_reqtfm(aq); -+ size_t authsize = crypto_aead_authsize(tfm); - - sqe3->a_key_addr = cpu_to_le64(ctx->a_key_dma); - - sqe3->auth_mac_key |= -- cpu_to_le32((u32)(ctx->mac_len / -+ cpu_to_le32((u32)(authsize / - SEC_SQE_LEN_RATE) << SEC_MAC_OFFSET_V3); - - sqe3->auth_mac_key |= -@@ -1704,9 +1694,9 @@ static void sec_aead_callback(struct sec_ctx *c, struct sec_req *req, int err) - { - struct aead_request *a_req = req->aead_req.aead_req; - struct crypto_aead *tfm = crypto_aead_reqtfm(a_req); -+ size_t authsize = crypto_aead_authsize(tfm); - struct sec_aead_req *aead_req = &req->aead_req; - struct sec_cipher_req *c_req = &req->c_req; -- size_t authsize = crypto_aead_authsize(tfm); - struct sec_qp_ctx *qp_ctx = req->qp_ctx; - struct aead_request *backlog_aead_req; - struct sec_req *backlog_req; -@@ -1719,10 +1709,8 @@ static void sec_aead_callback(struct sec_ctx *c, struct sec_req *req, int err) - if (!err && c_req->encrypt) { - struct scatterlist *sgl = a_req->dst; - -- sz = sg_pcopy_from_buffer(sgl, sg_nents(sgl), -- aead_req->out_mac, -- authsize, a_req->cryptlen + -- a_req->assoclen); -+ sz = sg_pcopy_from_buffer(sgl, sg_nents(sgl), aead_req->out_mac, -+ authsize, a_req->cryptlen + a_req->assoclen); - if (unlikely(sz != authsize)) { - dev_err(c->dev, "copy out mac err!\n"); - err = -EINVAL; -@@ -1930,8 +1918,10 @@ static void sec_aead_exit(struct crypto_aead *tfm) - - static int sec_aead_ctx_init(struct crypto_aead *tfm, const char *hash_name) - { -+ struct aead_alg *alg = crypto_aead_alg(tfm); - struct sec_ctx *ctx = crypto_aead_ctx(tfm); -- struct sec_auth_ctx *auth_ctx = &ctx->a_ctx; -+ struct sec_auth_ctx *a_ctx = &ctx->a_ctx; -+ const char *aead_name = alg->base.cra_name; - int ret; - - ret = sec_aead_init(tfm); -@@ -1940,11 +1930,20 @@ static int sec_aead_ctx_init(struct crypto_aead *tfm, const char *hash_name) - return ret; - } - -- auth_ctx->hash_tfm = crypto_alloc_shash(hash_name, 0, 0); -- if (IS_ERR(auth_ctx->hash_tfm)) { -+ a_ctx->hash_tfm = crypto_alloc_shash(hash_name, 0, 0); -+ if (IS_ERR(a_ctx->hash_tfm)) { - dev_err(ctx->dev, "aead alloc shash error!\n"); - sec_aead_exit(tfm); -- return PTR_ERR(auth_ctx->hash_tfm); -+ return PTR_ERR(a_ctx->hash_tfm); -+ } -+ -+ a_ctx->fallback_aead_tfm = crypto_alloc_aead(aead_name, 0, -+ CRYPTO_ALG_NEED_FALLBACK | CRYPTO_ALG_ASYNC); -+ if (IS_ERR(a_ctx->fallback_aead_tfm)) { -+ dev_err(ctx->dev, "aead driver alloc fallback tfm error!\n"); -+ crypto_free_shash(ctx->a_ctx.hash_tfm); -+ sec_aead_exit(tfm); -+ return PTR_ERR(a_ctx->fallback_aead_tfm); - } - - return 0; -@@ -1954,6 +1953,7 @@ static void sec_aead_ctx_exit(struct crypto_aead *tfm) - { - struct sec_ctx *ctx = crypto_aead_ctx(tfm); - -+ crypto_free_aead(ctx->a_ctx.fallback_aead_tfm); - crypto_free_shash(ctx->a_ctx.hash_tfm); - sec_aead_exit(tfm); - } -@@ -1980,7 +1980,6 @@ static int sec_aead_xcm_ctx_init(struct crypto_aead *tfm) - sec_aead_exit(tfm); - return PTR_ERR(a_ctx->fallback_aead_tfm); - } -- a_ctx->fallback = false; - - return 0; - } -@@ -2261,21 +2260,20 @@ static int sec_aead_spec_check(struct sec_ctx *ctx, struct sec_req *sreq) - { - struct aead_request *req = sreq->aead_req.aead_req; - struct crypto_aead *tfm = crypto_aead_reqtfm(req); -- size_t authsize = crypto_aead_authsize(tfm); -+ size_t sz = crypto_aead_authsize(tfm); - u8 c_mode = ctx->c_ctx.c_mode; - struct device *dev = ctx->dev; - int ret; - -- if (unlikely(req->cryptlen + req->assoclen > MAX_INPUT_DATA_LEN || -- req->assoclen > SEC_MAX_AAD_LEN)) { -- dev_err(dev, "aead input spec error!\n"); -+ /* Hardware does not handle cases where authsize is less than 4 bytes */ -+ if (unlikely(sz < MIN_MAC_LEN)) { -+ sreq->aead_req.fallback = true; - return -EINVAL; - } - -- if (unlikely((c_mode == SEC_CMODE_GCM && authsize < DES_BLOCK_SIZE) || -- (c_mode == SEC_CMODE_CCM && (authsize < MIN_MAC_LEN || -- authsize & MAC_LEN_MASK)))) { -- dev_err(dev, "aead input mac length error!\n"); -+ if (unlikely(req->cryptlen + req->assoclen > MAX_INPUT_DATA_LEN || -+ req->assoclen > SEC_MAX_AAD_LEN)) { -+ dev_err(dev, "aead input spec error!\n"); - return -EINVAL; - } - -@@ -2294,7 +2292,7 @@ static int sec_aead_spec_check(struct sec_ctx *ctx, struct sec_req *sreq) - if (sreq->c_req.encrypt) - sreq->c_req.c_len = req->cryptlen; - else -- sreq->c_req.c_len = req->cryptlen - authsize; -+ sreq->c_req.c_len = req->cryptlen - sz; - if (c_mode == SEC_CMODE_CBC) { - if (unlikely(sreq->c_req.c_len & (AES_BLOCK_SIZE - 1))) { - dev_err(dev, "aead crypto length error!\n"); -@@ -2320,8 +2318,8 @@ static int sec_aead_param_check(struct sec_ctx *ctx, struct sec_req *sreq) - - if (ctx->sec->qm.ver == QM_HW_V2) { - if (unlikely(!req->cryptlen || (!sreq->c_req.encrypt && -- req->cryptlen <= authsize))) { -- ctx->a_ctx.fallback = true; -+ req->cryptlen <= authsize))) { -+ sreq->aead_req.fallback = true; - return -EINVAL; - } - } -@@ -2349,16 +2347,9 @@ static int sec_aead_soft_crypto(struct sec_ctx *ctx, - bool encrypt) - { - struct sec_auth_ctx *a_ctx = &ctx->a_ctx; -- struct device *dev = ctx->dev; - struct aead_request *subreq; - int ret; - -- /* Kunpeng920 aead mode not support input 0 size */ -- if (!a_ctx->fallback_aead_tfm) { -- dev_err(dev, "aead fallback tfm is NULL!\n"); -- return -EINVAL; -- } -- - subreq = aead_request_alloc(a_ctx->fallback_aead_tfm, GFP_KERNEL); - if (!subreq) - return -ENOMEM; -@@ -2390,10 +2381,11 @@ static int sec_aead_crypto(struct aead_request *a_req, bool encrypt) - req->aead_req.aead_req = a_req; - req->c_req.encrypt = encrypt; - req->ctx = ctx; -+ req->aead_req.fallback = false; - - ret = sec_aead_param_check(ctx, req); - if (unlikely(ret)) { -- if (ctx->a_ctx.fallback) -+ if (req->aead_req.fallback) - return sec_aead_soft_crypto(ctx, a_req, encrypt); - return -EINVAL; - } -diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.h b/drivers/crypto/hisilicon/sec2/sec_crypto.h -index d033f63b583f85..db3fceb88e6937 100644 ---- a/drivers/crypto/hisilicon/sec2/sec_crypto.h -+++ b/drivers/crypto/hisilicon/sec2/sec_crypto.h -@@ -23,17 +23,6 @@ enum sec_hash_alg { - SEC_A_HMAC_SHA512 = 0x15, - }; - --enum sec_mac_len { -- SEC_HMAC_CCM_MAC = 16, -- SEC_HMAC_GCM_MAC = 16, -- SEC_SM3_MAC = 32, -- SEC_HMAC_SM3_MAC = 32, -- SEC_HMAC_MD5_MAC = 16, -- SEC_HMAC_SHA1_MAC = 20, -- SEC_HMAC_SHA256_MAC = 32, -- SEC_HMAC_SHA512_MAC = 64, --}; -- - enum sec_cmode { - SEC_CMODE_ECB = 0x0, - SEC_CMODE_CBC = 0x1, -diff --git a/drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c b/drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c -index 4a18095ae5d808..662aac9ea186df 100644 ---- a/drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c -+++ b/drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c -@@ -471,6 +471,7 @@ static int init_ixp_crypto(struct device *dev) - return -ENODEV; - } - npe_id = npe_spec.args[0]; -+ of_node_put(npe_spec.np); - - ret = of_parse_phandle_with_fixed_args(np, "queue-rx", 1, 0, - &queue_spec); -@@ -479,6 +480,7 @@ static int init_ixp_crypto(struct device *dev) - return -ENODEV; - } - recv_qid = queue_spec.args[0]; -+ of_node_put(queue_spec.np); - - ret = of_parse_phandle_with_fixed_args(np, "queue-txready", 1, 0, - &queue_spec); -@@ -487,6 +489,7 @@ static int init_ixp_crypto(struct device *dev) - return -ENODEV; - } - send_qid = queue_spec.args[0]; -+ of_node_put(queue_spec.np); - } else { - /* - * Hardcoded engine when using platform data, this goes away -diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c -index 155c409d2b434d..c0fa5413246756 100644 ---- a/drivers/dma/ti/edma.c -+++ b/drivers/dma/ti/edma.c -@@ -208,7 +208,6 @@ struct edma_desc { - struct edma_cc; - - struct edma_tc { -- struct device_node *node; - u16 id; - }; - -@@ -2466,13 +2465,13 @@ static int edma_probe(struct platform_device *pdev) - if (ret || i == ecc->num_tc) - break; - -- ecc->tc_list[i].node = tc_args.np; - ecc->tc_list[i].id = i; - queue_priority_mapping[i][1] = tc_args.args[0]; - if (queue_priority_mapping[i][1] > lowest_priority) { - lowest_priority = queue_priority_mapping[i][1]; - info->default_queue = i; - } -+ of_node_put(tc_args.np); - } - - /* See if we have optional dma-channel-mask array */ -diff --git a/drivers/firmware/efi/sysfb_efi.c b/drivers/firmware/efi/sysfb_efi.c -index 456d0e5eaf78b5..f479680299838a 100644 ---- a/drivers/firmware/efi/sysfb_efi.c -+++ b/drivers/firmware/efi/sysfb_efi.c -@@ -91,6 +91,7 @@ void efifb_setup_from_dmi(struct screen_info *si, const char *opt) - _ret_; \ - }) - -+#ifdef CONFIG_EFI - static int __init efifb_set_system(const struct dmi_system_id *id) - { - struct efifb_dmi_info *info = id->driver_data; -@@ -346,7 +347,6 @@ static const struct fwnode_operations efifb_fwnode_ops = { - .add_links = efifb_add_links, - }; - --#ifdef CONFIG_EFI - static struct fwnode_handle efifb_fwnode; - - __init void sysfb_apply_efi_quirks(void) -diff --git a/drivers/gpio/gpio-brcmstb.c b/drivers/gpio/gpio-brcmstb.c -index bccdbfd5ec805c..4588666a52d505 100644 ---- a/drivers/gpio/gpio-brcmstb.c -+++ b/drivers/gpio/gpio-brcmstb.c -@@ -594,8 +594,6 @@ static int brcmstb_gpio_probe(struct platform_device *pdev) - void __iomem *reg_base; - struct brcmstb_gpio_priv *priv; - struct resource *res; -- struct property *prop; -- const __be32 *p; - u32 bank_width; - int num_banks = 0; - int err; -@@ -640,8 +638,7 @@ static int brcmstb_gpio_probe(struct platform_device *pdev) - flags = BGPIOF_BIG_ENDIAN_BYTE_ORDER; - #endif - -- of_property_for_each_u32(np, "brcm,gpio-bank-widths", prop, p, -- bank_width) { -+ of_property_for_each_u32(np, "brcm,gpio-bank-widths", bank_width) { - struct brcmstb_gpio_bank *bank; - struct gpio_chip *gc; - -diff --git a/drivers/gpio/gpio-mxc.c b/drivers/gpio/gpio-mxc.c -index 4cb455b2bdee71..619b6fb9d833a4 100644 ---- a/drivers/gpio/gpio-mxc.c -+++ b/drivers/gpio/gpio-mxc.c -@@ -490,8 +490,7 @@ static int mxc_gpio_probe(struct platform_device *pdev) - port->gc.request = mxc_gpio_request; - port->gc.free = mxc_gpio_free; - port->gc.to_irq = mxc_gpio_to_irq; -- port->gc.base = (pdev->id < 0) ? of_alias_get_id(np, "gpio") * 32 : -- pdev->id * 32; -+ port->gc.base = of_alias_get_id(np, "gpio") * 32; - - err = devm_gpiochip_add_data(&pdev->dev, &port->gc, port); - if (err) -diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c -index ce9a94e332801f..9c33f9da724cfd 100644 ---- a/drivers/gpio/gpio-pca953x.c -+++ b/drivers/gpio/gpio-pca953x.c -@@ -211,7 +211,6 @@ struct pca953x_chip { - - struct i2c_client *client; - struct gpio_chip gpio_chip; -- const char *const *names; - unsigned long driver_data; - struct regulator *regulator; - -@@ -712,7 +711,6 @@ static void pca953x_setup_gpio(struct pca953x_chip *chip, int gpios) - gc->label = dev_name(&chip->client->dev); - gc->parent = &chip->client->dev; - gc->owner = THIS_MODULE; -- gc->names = chip->names; - } - - #ifdef CONFIG_GPIO_PCA953X_IRQ -@@ -1000,7 +998,7 @@ static int pca953x_irq_setup(struct pca953x_chip *chip, - } - #endif - --static int device_pca95xx_init(struct pca953x_chip *chip, u32 invert) -+static int device_pca95xx_init(struct pca953x_chip *chip) - { - DECLARE_BITMAP(val, MAX_LINE); - u8 regaddr; -@@ -1018,24 +1016,21 @@ static int device_pca95xx_init(struct pca953x_chip *chip, u32 invert) - if (ret) - goto out; - -- /* set platform specific polarity inversion */ -- if (invert) -- bitmap_fill(val, MAX_LINE); -- else -- bitmap_zero(val, MAX_LINE); -+ /* clear polarity inversion */ -+ bitmap_zero(val, MAX_LINE); - - ret = pca953x_write_regs(chip, chip->regs->invert, val); - out: - return ret; - } - --static int device_pca957x_init(struct pca953x_chip *chip, u32 invert) -+static int device_pca957x_init(struct pca953x_chip *chip) - { - DECLARE_BITMAP(val, MAX_LINE); - unsigned int i; - int ret; - -- ret = device_pca95xx_init(chip, invert); -+ ret = device_pca95xx_init(chip); - if (ret) - goto out; - -@@ -1052,14 +1047,40 @@ static int device_pca957x_init(struct pca953x_chip *chip, u32 invert) - return ret; - } - -+static void pca953x_disable_regulator(void *reg) -+{ -+ regulator_disable(reg); -+} -+ -+static int pca953x_get_and_enable_regulator(struct pca953x_chip *chip) -+{ -+ struct device *dev = &chip->client->dev; -+ struct regulator *reg = chip->regulator; -+ int ret; -+ -+ reg = devm_regulator_get(dev, "vcc"); -+ if (IS_ERR(reg)) -+ return dev_err_probe(dev, PTR_ERR(reg), "reg get err\n"); -+ -+ ret = regulator_enable(reg); -+ if (ret) -+ return dev_err_probe(dev, ret, "reg en err\n"); -+ -+ ret = devm_add_action_or_reset(dev, pca953x_disable_regulator, reg); -+ if (ret) -+ return ret; -+ -+ chip->regulator = reg; -+ return 0; -+} -+ - static int pca953x_probe(struct i2c_client *client) - { -+ struct device *dev = &client->dev; - struct pca953x_platform_data *pdata; - struct pca953x_chip *chip; -- int irq_base = 0; -+ int irq_base; - int ret; -- u32 invert = 0; -- struct regulator *reg; - const struct regmap_config *regmap_config; - - chip = devm_kzalloc(&client->dev, sizeof(*chip), GFP_KERNEL); -@@ -1070,8 +1091,6 @@ static int pca953x_probe(struct i2c_client *client) - if (pdata) { - irq_base = pdata->irq_base; - chip->gpio_start = pdata->gpio_base; -- invert = pdata->invert; -- chip->names = pdata->names; - } else { - struct gpio_desc *reset_gpio; - -@@ -1088,7 +1107,8 @@ static int pca953x_probe(struct i2c_client *client) - reset_gpio = devm_gpiod_get_optional(&client->dev, "reset", - GPIOD_OUT_LOW); - if (IS_ERR(reset_gpio)) -- return PTR_ERR(reset_gpio); -+ return dev_err_probe(dev, PTR_ERR(reset_gpio), -+ "Failed to get reset gpio\n"); - } - - chip->client = client; -@@ -1096,16 +1116,9 @@ static int pca953x_probe(struct i2c_client *client) - if (!chip->driver_data) - return -ENODEV; - -- reg = devm_regulator_get(&client->dev, "vcc"); -- if (IS_ERR(reg)) -- return dev_err_probe(&client->dev, PTR_ERR(reg), "reg get err\n"); -- -- ret = regulator_enable(reg); -- if (ret) { -- dev_err(&client->dev, "reg en err: %d\n", ret); -+ ret = pca953x_get_and_enable_regulator(chip); -+ if (ret) - return ret; -- } -- chip->regulator = reg; - - i2c_set_clientdata(client, chip); - -@@ -1128,10 +1141,8 @@ static int pca953x_probe(struct i2c_client *client) - } - - chip->regmap = devm_regmap_init_i2c(client, regmap_config); -- if (IS_ERR(chip->regmap)) { -- ret = PTR_ERR(chip->regmap); -- goto err_exit; -- } -+ if (IS_ERR(chip->regmap)) -+ return PTR_ERR(chip->regmap); - - regcache_mark_dirty(chip->regmap); - -@@ -1160,47 +1171,19 @@ static int pca953x_probe(struct i2c_client *client) - */ - if (PCA_CHIP_TYPE(chip->driver_data) == PCA957X_TYPE) { - chip->regs = &pca957x_regs; -- ret = device_pca957x_init(chip, invert); -+ ret = device_pca957x_init(chip); - } else { - chip->regs = &pca953x_regs; -- ret = device_pca95xx_init(chip, invert); -+ ret = device_pca95xx_init(chip); - } - if (ret) -- goto err_exit; -+ return ret; - - ret = pca953x_irq_setup(chip, irq_base); - if (ret) -- goto err_exit; -- -- ret = devm_gpiochip_add_data(&client->dev, &chip->gpio_chip, chip); -- if (ret) -- goto err_exit; -- -- if (pdata && pdata->setup) { -- ret = pdata->setup(client, chip->gpio_chip.base, -- chip->gpio_chip.ngpio, pdata->context); -- if (ret < 0) -- dev_warn(&client->dev, "setup failed, %d\n", ret); -- } -- -- return 0; -- --err_exit: -- regulator_disable(chip->regulator); -- return ret; --} -- --static void pca953x_remove(struct i2c_client *client) --{ -- struct pca953x_platform_data *pdata = dev_get_platdata(&client->dev); -- struct pca953x_chip *chip = i2c_get_clientdata(client); -- -- if (pdata && pdata->teardown) { -- pdata->teardown(client, chip->gpio_chip.base, -- chip->gpio_chip.ngpio, pdata->context); -- } -+ return ret; - -- regulator_disable(chip->regulator); -+ return devm_gpiochip_add_data(dev, &chip->gpio_chip, chip); - } - - #ifdef CONFIG_PM_SLEEP -@@ -1368,7 +1351,6 @@ static struct i2c_driver pca953x_driver = { - .acpi_match_table = pca953x_acpi_ids, - }, - .probe = pca953x_probe, -- .remove = pca953x_remove, - .id_table = pca953x_id, - }; - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c -index c89264242bea3a..69dfc3da5e15c9 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c -@@ -2049,6 +2049,7 @@ void amdgpu_ttm_fini(struct amdgpu_device *adev) - ttm_range_man_fini(&adev->mman.bdev, AMDGPU_PL_GDS); - ttm_range_man_fini(&adev->mman.bdev, AMDGPU_PL_GWS); - ttm_range_man_fini(&adev->mman.bdev, AMDGPU_PL_OA); -+ ttm_range_man_fini(&adev->mman.bdev, AMDGPU_PL_DOORBELL); - ttm_device_fini(&adev->mman.bdev); - adev->mman.initialized = false; - DRM_INFO("amdgpu: ttm finalized\n"); -diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c -index e80c4f5b4f4023..d1141a9baa916b 100644 ---- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c -+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c -@@ -896,6 +896,8 @@ static int vcn_v4_0_3_start_sriov(struct amdgpu_device *adev) - for (i = 0; i < adev->vcn.num_vcn_inst; i++) { - vcn_inst = GET_INST(VCN, i); - -+ vcn_v4_0_3_fw_shared_init(adev, vcn_inst); -+ - memset(&header, 0, sizeof(struct mmsch_v4_0_3_init_header)); - header.version = MMSCH_VERSION; - header.total_size = sizeof(struct mmsch_v4_0_3_init_header) >> 2; -diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c -index cc3b62f7339417..1fbd23922082ae 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c -@@ -1420,6 +1420,8 @@ int atomctrl_get_smc_sclk_range_table(struct pp_hwmgr *hwmgr, struct pp_atom_ctr - GetIndexIntoMasterTable(DATA, SMU_Info), - &size, &frev, &crev); - -+ if (!psmu_info) -+ return -EINVAL; - - for (i = 0; i < psmu_info->ucSclkEntryNum; i++) { - table->entry[i].ucVco_setting = psmu_info->asSclkFcwRangeEntry[i].ucVco_setting; -diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_powertune.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_powertune.c -index 3007b054c873c9..776d58ea63ae90 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_powertune.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_powertune.c -@@ -1120,13 +1120,14 @@ static int vega10_enable_se_edc_force_stall_config(struct pp_hwmgr *hwmgr) - result = vega10_program_didt_config_registers(hwmgr, SEEDCForceStallPatternConfig_Vega10, VEGA10_CONFIGREG_DIDT); - result |= vega10_program_didt_config_registers(hwmgr, SEEDCCtrlForceStallConfig_Vega10, VEGA10_CONFIGREG_DIDT); - if (0 != result) -- return result; -+ goto exit_safe_mode; - - vega10_didt_set_mask(hwmgr, false); - -+exit_safe_mode: - amdgpu_gfx_rlc_exit_safe_mode(adev, 0); - -- return 0; -+ return result; - } - - static int vega10_disable_se_edc_force_stall_config(struct pp_hwmgr *hwmgr) -diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c -index 26d3b9b8432675..24c5a926af8d1d 100644 ---- a/drivers/gpu/drm/bridge/ite-it6505.c -+++ b/drivers/gpu/drm/bridge/ite-it6505.c -@@ -299,7 +299,7 @@ - #define MAX_CR_LEVEL 0x03 - #define MAX_EQ_LEVEL 0x03 - #define AUX_WAIT_TIMEOUT_MS 15 --#define AUX_FIFO_MAX_SIZE 32 -+#define AUX_FIFO_MAX_SIZE 16 - #define PIXEL_CLK_DELAY 1 - #define PIXEL_CLK_INVERSE 0 - #define ADJUST_PHASE_THRESHOLD 80000 -diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c -index 69fccbcd92c622..84b7789454962a 100644 ---- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c -+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c -@@ -343,6 +343,7 @@ void *etnaviv_gem_vmap(struct drm_gem_object *obj) - static void *etnaviv_gem_vmap_impl(struct etnaviv_gem_object *obj) - { - struct page **pages; -+ pgprot_t prot; - - lockdep_assert_held(&obj->lock); - -@@ -350,8 +351,19 @@ static void *etnaviv_gem_vmap_impl(struct etnaviv_gem_object *obj) - if (IS_ERR(pages)) - return NULL; - -- return vmap(pages, obj->base.size >> PAGE_SHIFT, -- VM_MAP, pgprot_writecombine(PAGE_KERNEL)); -+ switch (obj->flags & ETNA_BO_CACHE_MASK) { -+ case ETNA_BO_CACHED: -+ prot = PAGE_KERNEL; -+ break; -+ case ETNA_BO_UNCACHED: -+ prot = pgprot_noncached(PAGE_KERNEL); -+ break; -+ case ETNA_BO_WC: -+ default: -+ prot = pgprot_writecombine(PAGE_KERNEL); -+ } -+ -+ return vmap(pages, obj->base.size >> PAGE_SHIFT, VM_MAP, prot); - } - - static inline enum dma_data_direction etnaviv_op_to_dma_dir(u32 op) -diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c -index c9edaa6d763697..9009442b543dda 100644 ---- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c -+++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c -@@ -1510,7 +1510,9 @@ int a6xx_gmu_wrapper_init(struct a6xx_gpu *a6xx_gpu, struct device_node *node) - - gmu->dev = &pdev->dev; - -- of_dma_configure(gmu->dev, node, true); -+ ret = of_dma_configure(gmu->dev, node, true); -+ if (ret) -+ return ret; - - pm_runtime_enable(gmu->dev); - -@@ -1574,7 +1576,9 @@ int a6xx_gmu_init(struct a6xx_gpu *a6xx_gpu, struct device_node *node) - - gmu->dev = &pdev->dev; - -- of_dma_configure(gmu->dev, node, true); -+ ret = of_dma_configure(gmu->dev, node, true); -+ if (ret) -+ return ret; - - /* Fow now, don't do anything fancy until we get our feet under us */ - gmu->idle_level = GMU_IDLE_STATE_ACTIVE; -diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h -index f0c3804f425879..76b668f36477a3 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h -@@ -164,6 +164,7 @@ static const struct dpu_lm_cfg sm8150_lm[] = { - .sblk = &sdm845_lm_sblk, - .lm_pair = LM_3, - .pingpong = PINGPONG_2, -+ .dspp = DSPP_2, - }, { - .name = "lm_3", .id = LM_3, - .base = 0x47000, .len = 0x320, -@@ -171,6 +172,7 @@ static const struct dpu_lm_cfg sm8150_lm[] = { - .sblk = &sdm845_lm_sblk, - .lm_pair = LM_2, - .pingpong = PINGPONG_3, -+ .dspp = DSPP_3, - }, { - .name = "lm_4", .id = LM_4, - .base = 0x48000, .len = 0x320, -diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h -index 47de71e71e3108..427dec0cd1d36d 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h -@@ -163,6 +163,7 @@ static const struct dpu_lm_cfg sc8180x_lm[] = { - .sblk = &sdm845_lm_sblk, - .lm_pair = LM_3, - .pingpong = PINGPONG_2, -+ .dspp = DSPP_2, - }, { - .name = "lm_3", .id = LM_3, - .base = 0x47000, .len = 0x320, -@@ -170,6 +171,7 @@ static const struct dpu_lm_cfg sc8180x_lm[] = { - .sblk = &sdm845_lm_sblk, - .lm_pair = LM_2, - .pingpong = PINGPONG_3, -+ .dspp = DSPP_3, - }, { - .name = "lm_4", .id = LM_4, - .base = 0x48000, .len = 0x320, -diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_0_sm8250.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_0_sm8250.h -index ee781037ada93e..a38fb057ceda6b 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_0_sm8250.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_0_sm8250.h -@@ -163,6 +163,7 @@ static const struct dpu_lm_cfg sm8250_lm[] = { - .sblk = &sdm845_lm_sblk, - .lm_pair = LM_3, - .pingpong = PINGPONG_2, -+ .dspp = DSPP_2, - }, { - .name = "lm_3", .id = LM_3, - .base = 0x47000, .len = 0x320, -@@ -170,6 +171,7 @@ static const struct dpu_lm_cfg sm8250_lm[] = { - .sblk = &sdm845_lm_sblk, - .lm_pair = LM_2, - .pingpong = PINGPONG_3, -+ .dspp = DSPP_3, - }, { - .name = "lm_4", .id = LM_4, - .base = 0x48000, .len = 0x320, -diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_0_sm8350.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_0_sm8350.h -index 428bcbcfbf1925..e2f181077d11e7 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_0_sm8350.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_0_sm8350.h -@@ -163,6 +163,7 @@ static const struct dpu_lm_cfg sm8350_lm[] = { - .sblk = &sdm845_lm_sblk, - .lm_pair = LM_3, - .pingpong = PINGPONG_2, -+ .dspp = DSPP_2, - }, { - .name = "lm_3", .id = LM_3, - .base = 0x47000, .len = 0x320, -@@ -170,6 +171,7 @@ static const struct dpu_lm_cfg sm8350_lm[] = { - .sblk = &sdm845_lm_sblk, - .lm_pair = LM_2, - .pingpong = PINGPONG_3, -+ .dspp = DSPP_3, - }, { - .name = "lm_4", .id = LM_4, - .base = 0x48000, .len = 0x320, -diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_9_0_sm8550.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_9_0_sm8550.h -index 7bed819dfc3902..69b238ed01b980 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_9_0_sm8550.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_9_0_sm8550.h -@@ -181,6 +181,7 @@ static const struct dpu_lm_cfg sm8550_lm[] = { - .sblk = &sdm845_lm_sblk, - .lm_pair = LM_3, - .pingpong = PINGPONG_2, -+ .dspp = DSPP_2, - }, { - .name = "lm_3", .id = LM_3, - .base = 0x47000, .len = 0x320, -@@ -188,6 +189,7 @@ static const struct dpu_lm_cfg sm8550_lm[] = { - .sblk = &sdm845_lm_sblk, - .lm_pair = LM_2, - .pingpong = PINGPONG_3, -+ .dspp = DSPP_3, - }, { - .name = "lm_4", .id = LM_4, - .base = 0x48000, .len = 0x320, -diff --git a/drivers/gpu/drm/msm/dp/dp_audio.c b/drivers/gpu/drm/msm/dp/dp_audio.c -index 4a2e479723a852..610cbe23aa8398 100644 ---- a/drivers/gpu/drm/msm/dp/dp_audio.c -+++ b/drivers/gpu/drm/msm/dp/dp_audio.c -@@ -410,10 +410,10 @@ static void dp_audio_safe_to_exit_level(struct dp_audio_private *audio) - safe_to_exit_level = 5; - break; - default: -+ safe_to_exit_level = 14; - drm_dbg_dp(audio->drm_dev, - "setting the default safe_to_exit_level = %u\n", - safe_to_exit_level); -- safe_to_exit_level = 14; - break; - } - -diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c -index 84aa811ca1e9cf..bd08d57486fef4 100644 ---- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c -+++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c -@@ -30,7 +30,6 @@ - #include - - #include "rockchip_drm_drv.h" --#include "rockchip_drm_vop.h" - - #define RK3288_GRF_SOC_CON6 0x25c - #define RK3288_EDP_LCDC_SEL BIT(5) -diff --git a/drivers/gpu/drm/rockchip/cdn-dp-core.c b/drivers/gpu/drm/rockchip/cdn-dp-core.c -index 3793863c210ebd..fca403ccce47eb 100644 ---- a/drivers/gpu/drm/rockchip/cdn-dp-core.c -+++ b/drivers/gpu/drm/rockchip/cdn-dp-core.c -@@ -24,7 +24,6 @@ - - #include "cdn-dp-core.h" - #include "cdn-dp-reg.h" --#include "rockchip_drm_vop.h" - - static inline struct cdn_dp_device *connector_to_dp(struct drm_connector *connector) - { -diff --git a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c -index 0100162a73b295..002486741aec2b 100644 ---- a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c -+++ b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c -@@ -26,7 +26,6 @@ - #include - - #include "rockchip_drm_drv.h" --#include "rockchip_drm_vop.h" - - #define DSI_PHY_RSTZ 0xa0 - #define PHY_DISFORCEPLL 0 -diff --git a/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c b/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c -index 89bc86d620146c..aae48e906af11b 100644 ---- a/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c -+++ b/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c -@@ -18,7 +18,6 @@ - #include - - #include "rockchip_drm_drv.h" --#include "rockchip_drm_vop.h" - - #define RK3228_GRF_SOC_CON2 0x0408 - #define RK3228_HDMI_SDAIN_MSK BIT(14) -diff --git a/drivers/gpu/drm/rockchip/inno_hdmi.c b/drivers/gpu/drm/rockchip/inno_hdmi.c -index 345253e033c538..50c984ac107d63 100644 ---- a/drivers/gpu/drm/rockchip/inno_hdmi.c -+++ b/drivers/gpu/drm/rockchip/inno_hdmi.c -@@ -23,7 +23,6 @@ - #include - - #include "rockchip_drm_drv.h" --#include "rockchip_drm_vop.h" - - #include "inno_hdmi.h" - -diff --git a/drivers/gpu/drm/rockchip/rk3066_hdmi.c b/drivers/gpu/drm/rockchip/rk3066_hdmi.c -index fa6e592e0276c3..78136d0c5a659e 100644 ---- a/drivers/gpu/drm/rockchip/rk3066_hdmi.c -+++ b/drivers/gpu/drm/rockchip/rk3066_hdmi.c -@@ -17,7 +17,6 @@ - #include "rk3066_hdmi.h" - - #include "rockchip_drm_drv.h" --#include "rockchip_drm_vop.h" - - #define DEFAULT_PLLA_RATE 30000000 - -diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_drv.h b/drivers/gpu/drm/rockchip/rockchip_drm_drv.h -index aeb03a57240fd9..bbb9e0bf68048a 100644 ---- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.h -+++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.h -@@ -20,6 +20,23 @@ - #define ROCKCHIP_MAX_CONNECTOR 2 - #define ROCKCHIP_MAX_CRTC 4 - -+/* -+ * display output interface supported by rockchip lcdc -+ */ -+#define ROCKCHIP_OUT_MODE_P888 0 -+#define ROCKCHIP_OUT_MODE_BT1120 0 -+#define ROCKCHIP_OUT_MODE_P666 1 -+#define ROCKCHIP_OUT_MODE_P565 2 -+#define ROCKCHIP_OUT_MODE_BT656 5 -+#define ROCKCHIP_OUT_MODE_S888 8 -+#define ROCKCHIP_OUT_MODE_S888_DUMMY 12 -+#define ROCKCHIP_OUT_MODE_YUV420 14 -+/* for use special outface */ -+#define ROCKCHIP_OUT_MODE_AAAA 15 -+ -+/* output flags */ -+#define ROCKCHIP_OUTPUT_DSI_DUAL BIT(0) -+ - struct drm_device; - struct drm_connector; - struct iommu_domain; -@@ -31,6 +48,7 @@ struct rockchip_crtc_state { - int output_bpc; - int output_flags; - bool enable_afbc; -+ bool yuv_overlay; - u32 bus_format; - u32 bus_flags; - int color_space; -diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h -index c5c716a69171a8..4ea369e004a912 100644 ---- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h -+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h -@@ -277,18 +277,6 @@ struct vop_data { - /* dst alpha ctrl define */ - #define DST_FACTOR_M0(x) (((x) & 0x7) << 6) - --/* -- * display output interface supported by rockchip lcdc -- */ --#define ROCKCHIP_OUT_MODE_P888 0 --#define ROCKCHIP_OUT_MODE_P666 1 --#define ROCKCHIP_OUT_MODE_P565 2 --/* for use special outface */ --#define ROCKCHIP_OUT_MODE_AAAA 15 -- --/* output flags */ --#define ROCKCHIP_OUTPUT_DSI_DUAL BIT(0) -- - enum alpha_mode { - ALPHA_STRAIGHT, - ALPHA_INVERSE, -diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c -index d1de12e850e746..d8f8c37c326c43 100644 ---- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c -+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c -@@ -33,7 +33,6 @@ - #include - #include - --#include "rockchip_drm_drv.h" - #include "rockchip_drm_gem.h" - #include "rockchip_drm_fb.h" - #include "rockchip_drm_vop2.h" -@@ -465,6 +464,16 @@ static bool rockchip_vop2_mod_supported(struct drm_plane *plane, u32 format, - if (modifier == DRM_FORMAT_MOD_INVALID) - return false; - -+ if (vop2->data->soc_id == 3568 || vop2->data->soc_id == 3566) { -+ if (vop2_cluster_window(win)) { -+ if (modifier == DRM_FORMAT_MOD_LINEAR) { -+ drm_dbg_kms(vop2->drm, -+ "Cluster window only supports format with afbc\n"); -+ return false; -+ } -+ } -+ } -+ - if (modifier == DRM_FORMAT_MOD_LINEAR) - return true; - -@@ -1397,8 +1406,18 @@ static void vop2_post_config(struct drm_crtc *crtc) - u32 top_margin = 100, bottom_margin = 100; - u16 hsize = hdisplay * (left_margin + right_margin) / 200; - u16 vsize = vdisplay * (top_margin + bottom_margin) / 200; -+ u16 hsync_len = mode->crtc_hsync_end - mode->crtc_hsync_start; - u16 hact_end, vact_end; - u32 val; -+ u32 bg_dly; -+ u32 pre_scan_dly; -+ -+ bg_dly = vp->data->pre_scan_max_dly[3]; -+ vop2_writel(vp->vop2, RK3568_VP_BG_MIX_CTRL(vp->id), -+ FIELD_PREP(RK3568_VP_BG_MIX_CTRL__BG_DLY, bg_dly)); -+ -+ pre_scan_dly = ((bg_dly + (hdisplay >> 1) - 1) << 16) | hsync_len; -+ vop2_vp_write(vp, RK3568_VP_PRE_SCAN_HTIMING, pre_scan_dly); - - vsize = rounddown(vsize, 2); - hsize = rounddown(hsize, 2); -@@ -1560,6 +1579,8 @@ static void vop2_crtc_atomic_enable(struct drm_crtc *crtc, - - vop2->enable_count++; - -+ vcstate->yuv_overlay = is_yuv_output(vcstate->bus_format); -+ - vop2_crtc_enable_irq(vp, VP_INT_POST_BUF_EMPTY); - - polflags = 0; -@@ -1587,7 +1608,7 @@ static void vop2_crtc_atomic_enable(struct drm_crtc *crtc, - if (vop2_output_uv_swap(vcstate->bus_format, vcstate->output_mode)) - dsp_ctrl |= RK3568_VP_DSP_CTRL__DSP_RB_SWAP; - -- if (is_yuv_output(vcstate->bus_format)) -+ if (vcstate->yuv_overlay) - dsp_ctrl |= RK3568_VP_DSP_CTRL__POST_DSP_OUT_R2Y; - - vop2_dither_setup(crtc, &dsp_ctrl); -@@ -1741,7 +1762,6 @@ static int vop2_find_start_mixer_id_for_vp(struct vop2 *vop2, u8 port_id) - - static void vop2_setup_cluster_alpha(struct vop2 *vop2, struct vop2_win *main_win) - { -- u32 offset = (main_win->data->phys_id * 0x10); - struct vop2_alpha_config alpha_config; - struct vop2_alpha alpha; - struct drm_plane_state *bottom_win_pstate; -@@ -1749,6 +1769,7 @@ static void vop2_setup_cluster_alpha(struct vop2 *vop2, struct vop2_win *main_wi - u16 src_glb_alpha_val, dst_glb_alpha_val; - bool premulti_en = false; - bool swap = false; -+ u32 offset = 0; - - /* At one win mode, win0 is dst/bottom win, and win1 is a all zero src/top win */ - bottom_win_pstate = main_win->base.state; -@@ -1767,6 +1788,22 @@ static void vop2_setup_cluster_alpha(struct vop2 *vop2, struct vop2_win *main_wi - vop2_parse_alpha(&alpha_config, &alpha); - - alpha.src_color_ctrl.bits.src_dst_swap = swap; -+ -+ switch (main_win->data->phys_id) { -+ case ROCKCHIP_VOP2_CLUSTER0: -+ offset = 0x0; -+ break; -+ case ROCKCHIP_VOP2_CLUSTER1: -+ offset = 0x10; -+ break; -+ case ROCKCHIP_VOP2_CLUSTER2: -+ offset = 0x20; -+ break; -+ case ROCKCHIP_VOP2_CLUSTER3: -+ offset = 0x30; -+ break; -+ } -+ - vop2_writel(vop2, RK3568_CLUSTER0_MIX_SRC_COLOR_CTRL + offset, - alpha.src_color_ctrl.val); - vop2_writel(vop2, RK3568_CLUSTER0_MIX_DST_COLOR_CTRL + offset, -@@ -1814,6 +1851,12 @@ static void vop2_setup_alpha(struct vop2_video_port *vp) - struct vop2_win *win = to_vop2_win(plane); - int zpos = plane->state->normalized_zpos; - -+ /* -+ * Need to configure alpha from second layer. -+ */ -+ if (zpos == 0) -+ continue; -+ - if (plane->state->pixel_blend_mode == DRM_MODE_BLEND_PREMULTI) - premulti_en = 1; - else -@@ -1890,29 +1933,26 @@ static void vop2_setup_layer_mixer(struct vop2_video_port *vp) - struct drm_plane *plane; - u32 layer_sel = 0; - u32 port_sel; -- unsigned int nlayer, ofs; -- struct drm_display_mode *adjusted_mode; -- u16 hsync_len; -- u16 hdisplay; -- u32 bg_dly; -- u32 pre_scan_dly; -+ u8 layer_id; -+ u8 old_layer_id; -+ u8 layer_sel_id; -+ unsigned int ofs; -+ u32 ovl_ctrl; - int i; - struct vop2_video_port *vp0 = &vop2->vps[0]; - struct vop2_video_port *vp1 = &vop2->vps[1]; - struct vop2_video_port *vp2 = &vop2->vps[2]; -+ struct rockchip_crtc_state *vcstate = to_rockchip_crtc_state(vp->crtc.state); - -- adjusted_mode = &vp->crtc.state->adjusted_mode; -- hsync_len = adjusted_mode->crtc_hsync_end - adjusted_mode->crtc_hsync_start; -- hdisplay = adjusted_mode->crtc_hdisplay; -- -- bg_dly = vp->data->pre_scan_max_dly[3]; -- vop2_writel(vop2, RK3568_VP_BG_MIX_CTRL(vp->id), -- FIELD_PREP(RK3568_VP_BG_MIX_CTRL__BG_DLY, bg_dly)); -+ ovl_ctrl = vop2_readl(vop2, RK3568_OVL_CTRL); -+ ovl_ctrl |= RK3568_OVL_CTRL__LAYERSEL_REGDONE_IMD; -+ if (vcstate->yuv_overlay) -+ ovl_ctrl |= RK3568_OVL_CTRL__YUV_MODE(vp->id); -+ else -+ ovl_ctrl &= ~RK3568_OVL_CTRL__YUV_MODE(vp->id); - -- pre_scan_dly = ((bg_dly + (hdisplay >> 1) - 1) << 16) | hsync_len; -- vop2_vp_write(vp, RK3568_VP_PRE_SCAN_HTIMING, pre_scan_dly); -+ vop2_writel(vop2, RK3568_OVL_CTRL, ovl_ctrl); - -- vop2_writel(vop2, RK3568_OVL_CTRL, 0); - port_sel = vop2_readl(vop2, RK3568_OVL_PORT_SEL); - port_sel &= RK3568_OVL_PORT_SEL__SEL_PORT; - -@@ -1940,9 +1980,30 @@ static void vop2_setup_layer_mixer(struct vop2_video_port *vp) - for (i = 0; i < vp->id; i++) - ofs += vop2->vps[i].nlayers; - -- nlayer = 0; - drm_atomic_crtc_for_each_plane(plane, &vp->crtc) { - struct vop2_win *win = to_vop2_win(plane); -+ struct vop2_win *old_win; -+ -+ layer_id = (u8)(plane->state->normalized_zpos + ofs); -+ -+ /* -+ * Find the layer this win bind in old state. -+ */ -+ for (old_layer_id = 0; old_layer_id < vop2->data->win_size; old_layer_id++) { -+ layer_sel_id = (layer_sel >> (4 * old_layer_id)) & 0xf; -+ if (layer_sel_id == win->data->layer_sel_id) -+ break; -+ } -+ -+ /* -+ * Find the win bind to this layer in old state -+ */ -+ for (i = 0; i < vop2->data->win_size; i++) { -+ old_win = &vop2->win[i]; -+ layer_sel_id = (layer_sel >> (4 * layer_id)) & 0xf; -+ if (layer_sel_id == old_win->data->layer_sel_id) -+ break; -+ } - - switch (win->data->phys_id) { - case ROCKCHIP_VOP2_CLUSTER0: -@@ -1971,22 +2032,18 @@ static void vop2_setup_layer_mixer(struct vop2_video_port *vp) - break; - } - -- layer_sel &= ~RK3568_OVL_LAYER_SEL__LAYER(plane->state->normalized_zpos + ofs, -- 0x7); -- layer_sel |= RK3568_OVL_LAYER_SEL__LAYER(plane->state->normalized_zpos + ofs, -- win->data->layer_sel_id); -- nlayer++; -- } -- -- /* configure unused layers to 0x5 (reserved) */ -- for (; nlayer < vp->nlayers; nlayer++) { -- layer_sel &= ~RK3568_OVL_LAYER_SEL__LAYER(nlayer + ofs, 0x7); -- layer_sel |= RK3568_OVL_LAYER_SEL__LAYER(nlayer + ofs, 5); -+ layer_sel &= ~RK3568_OVL_LAYER_SEL__LAYER(layer_id, 0x7); -+ layer_sel |= RK3568_OVL_LAYER_SEL__LAYER(layer_id, win->data->layer_sel_id); -+ /* -+ * When we bind a window from layerM to layerN, we also need to move the old -+ * window on layerN to layerM to avoid one window selected by two or more layers. -+ */ -+ layer_sel &= ~RK3568_OVL_LAYER_SEL__LAYER(old_layer_id, 0x7); -+ layer_sel |= RK3568_OVL_LAYER_SEL__LAYER(old_layer_id, old_win->data->layer_sel_id); - } - - vop2_writel(vop2, RK3568_OVL_LAYER_SEL, layer_sel); - vop2_writel(vop2, RK3568_OVL_PORT_SEL, port_sel); -- vop2_writel(vop2, RK3568_OVL_CTRL, RK3568_OVL_CTRL__LAYERSEL_REGDONE_IMD); - } - - static void vop2_setup_dly_for_windows(struct vop2 *vop2) -diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.h b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.h -index f1234a151130fa..eec06ab1d73713 100644 ---- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.h -+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.h -@@ -7,10 +7,10 @@ - #ifndef _ROCKCHIP_DRM_VOP2_H - #define _ROCKCHIP_DRM_VOP2_H - --#include "rockchip_drm_vop.h" -- - #include - #include -+#include "rockchip_drm_drv.h" -+#include "rockchip_drm_vop.h" - - #define VOP_FEATURE_OUTPUT_10BIT BIT(0) - -@@ -169,19 +169,6 @@ struct vop2_data { - #define WB_YRGB_FIFO_FULL_INTR BIT(18) - #define WB_COMPLETE_INTR BIT(19) - --/* -- * display output interface supported by rockchip lcdc -- */ --#define ROCKCHIP_OUT_MODE_P888 0 --#define ROCKCHIP_OUT_MODE_BT1120 0 --#define ROCKCHIP_OUT_MODE_P666 1 --#define ROCKCHIP_OUT_MODE_P565 2 --#define ROCKCHIP_OUT_MODE_BT656 5 --#define ROCKCHIP_OUT_MODE_S888 8 --#define ROCKCHIP_OUT_MODE_S888_DUMMY 12 --#define ROCKCHIP_OUT_MODE_YUV420 14 --/* for use special outface */ --#define ROCKCHIP_OUT_MODE_AAAA 15 - - enum vop_csc_format { - CSC_BT601L, -@@ -418,6 +405,7 @@ enum dst_factor_mode { - #define VOP2_COLOR_KEY_MASK BIT(31) - - #define RK3568_OVL_CTRL__LAYERSEL_REGDONE_IMD BIT(28) -+#define RK3568_OVL_CTRL__YUV_MODE(vp) BIT(vp) - - #define RK3568_VP_BG_MIX_CTRL__BG_DLY GENMASK(31, 24) - -diff --git a/drivers/gpu/drm/rockchip/rockchip_lvds.c b/drivers/gpu/drm/rockchip/rockchip_lvds.c -index 1b6e0b210aa530..107959530c2201 100644 ---- a/drivers/gpu/drm/rockchip/rockchip_lvds.c -+++ b/drivers/gpu/drm/rockchip/rockchip_lvds.c -@@ -27,7 +27,6 @@ - #include - - #include "rockchip_drm_drv.h" --#include "rockchip_drm_vop.h" - #include "rockchip_lvds.h" - - #define DISPLAY_OUTPUT_RGB 0 -diff --git a/drivers/gpu/drm/rockchip/rockchip_rgb.c b/drivers/gpu/drm/rockchip/rockchip_rgb.c -index c677b71ae516be..dbfbde24698ef0 100644 ---- a/drivers/gpu/drm/rockchip/rockchip_rgb.c -+++ b/drivers/gpu/drm/rockchip/rockchip_rgb.c -@@ -19,7 +19,6 @@ - #include - - #include "rockchip_drm_drv.h" --#include "rockchip_drm_vop.h" - #include "rockchip_rgb.h" - - struct rockchip_rgb { -diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c -index 558f3988fb2cff..8f156a69912c89 100644 ---- a/drivers/hid/hid-core.c -+++ b/drivers/hid/hid-core.c -@@ -1125,6 +1125,8 @@ static void hid_apply_multiplier(struct hid_device *hid, - while (multiplier_collection->parent_idx != -1 && - multiplier_collection->type != HID_COLLECTION_LOGICAL) - multiplier_collection = &hid->collection[multiplier_collection->parent_idx]; -+ if (multiplier_collection->type != HID_COLLECTION_LOGICAL) -+ multiplier_collection = NULL; - - effective_multiplier = hid_calculate_multiplier(hid, multiplier); - -diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c -index fda9dce3da9980..9d80635a91ebd8 100644 ---- a/drivers/hid/hid-input.c -+++ b/drivers/hid/hid-input.c -@@ -810,10 +810,23 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel - break; - } - -- if ((usage->hid & 0xf0) == 0x90) { /* SystemControl*/ -- switch (usage->hid & 0xf) { -- case 0xb: map_key_clear(KEY_DO_NOT_DISTURB); break; -- default: goto ignore; -+ if ((usage->hid & 0xf0) == 0x90) { /* SystemControl & D-pad */ -+ switch (usage->hid) { -+ case HID_GD_UP: usage->hat_dir = 1; break; -+ case HID_GD_DOWN: usage->hat_dir = 5; break; -+ case HID_GD_RIGHT: usage->hat_dir = 3; break; -+ case HID_GD_LEFT: usage->hat_dir = 7; break; -+ case HID_GD_DO_NOT_DISTURB: -+ map_key_clear(KEY_DO_NOT_DISTURB); break; -+ default: goto unknown; -+ } -+ -+ if (usage->hid <= HID_GD_LEFT) { -+ if (field->dpad) { -+ map_abs(field->dpad); -+ goto ignore; -+ } -+ map_abs(ABS_HAT0X); - } - break; - } -@@ -844,22 +857,6 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel - if (field->application == HID_GD_SYSTEM_CONTROL) - goto ignore; - -- if ((usage->hid & 0xf0) == 0x90) { /* D-pad */ -- switch (usage->hid) { -- case HID_GD_UP: usage->hat_dir = 1; break; -- case HID_GD_DOWN: usage->hat_dir = 5; break; -- case HID_GD_RIGHT: usage->hat_dir = 3; break; -- case HID_GD_LEFT: usage->hat_dir = 7; break; -- default: goto unknown; -- } -- if (field->dpad) { -- map_abs(field->dpad); -- goto ignore; -- } -- map_abs(ABS_HAT0X); -- break; -- } -- - switch (usage->hid) { - /* These usage IDs map directly to the usage codes. */ - case HID_GD_X: case HID_GD_Y: case HID_GD_Z: -diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c -index e62104e1a6038b..5ad871a7d1a44c 100644 ---- a/drivers/hid/hid-multitouch.c -+++ b/drivers/hid/hid-multitouch.c -@@ -2072,7 +2072,7 @@ static const struct hid_device_id mt_devices[] = { - I2C_DEVICE_ID_GOODIX_01E8) }, - { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, - HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX, -- I2C_DEVICE_ID_GOODIX_01E8) }, -+ I2C_DEVICE_ID_GOODIX_01E9) }, - - /* GoodTouch panels */ - { .driver_data = MT_CLS_NSMU, -diff --git a/drivers/hid/hid-thrustmaster.c b/drivers/hid/hid-thrustmaster.c -index cf1679b0d4fbb5..6c3e758bbb09e3 100644 ---- a/drivers/hid/hid-thrustmaster.c -+++ b/drivers/hid/hid-thrustmaster.c -@@ -170,6 +170,14 @@ static void thrustmaster_interrupts(struct hid_device *hdev) - ep = &usbif->cur_altsetting->endpoint[1]; - b_ep = ep->desc.bEndpointAddress; - -+ /* Are the expected endpoints present? */ -+ u8 ep_addr[1] = {b_ep}; -+ -+ if (!usb_check_int_endpoints(usbif, ep_addr)) { -+ hid_err(hdev, "Unexpected non-int endpoint\n"); -+ return; -+ } -+ - for (i = 0; i < ARRAY_SIZE(setup_arr); ++i) { - memcpy(send_buf, setup_arr[i], setup_arr_sizes[i]); - -diff --git a/drivers/i3c/master/dw-i3c-master.c b/drivers/i3c/master/dw-i3c-master.c -index 235235613c1b99..030127525672e7 100644 ---- a/drivers/i3c/master/dw-i3c-master.c -+++ b/drivers/i3c/master/dw-i3c-master.c -@@ -1136,6 +1136,23 @@ static void dw_i3c_master_free_ibi(struct i3c_dev_desc *dev) - data->ibi_pool = NULL; - } - -+static void dw_i3c_master_enable_sir_signal(struct dw_i3c_master *master, bool enable) -+{ -+ u32 reg; -+ -+ reg = readl(master->regs + INTR_STATUS_EN); -+ reg &= ~INTR_IBI_THLD_STAT; -+ if (enable) -+ reg |= INTR_IBI_THLD_STAT; -+ writel(reg, master->regs + INTR_STATUS_EN); -+ -+ reg = readl(master->regs + INTR_SIGNAL_EN); -+ reg &= ~INTR_IBI_THLD_STAT; -+ if (enable) -+ reg |= INTR_IBI_THLD_STAT; -+ writel(reg, master->regs + INTR_SIGNAL_EN); -+} -+ - static void dw_i3c_master_set_sir_enabled(struct dw_i3c_master *master, - struct i3c_dev_desc *dev, - u8 idx, bool enable) -@@ -1170,23 +1187,34 @@ static void dw_i3c_master_set_sir_enabled(struct dw_i3c_master *master, - } - writel(reg, master->regs + IBI_SIR_REQ_REJECT); - -- if (global) { -- reg = readl(master->regs + INTR_STATUS_EN); -- reg &= ~INTR_IBI_THLD_STAT; -- if (enable) -- reg |= INTR_IBI_THLD_STAT; -- writel(reg, master->regs + INTR_STATUS_EN); -- -- reg = readl(master->regs + INTR_SIGNAL_EN); -- reg &= ~INTR_IBI_THLD_STAT; -- if (enable) -- reg |= INTR_IBI_THLD_STAT; -- writel(reg, master->regs + INTR_SIGNAL_EN); -- } -+ if (global) -+ dw_i3c_master_enable_sir_signal(master, enable); -+ - - spin_unlock_irqrestore(&master->devs_lock, flags); - } - -+static int dw_i3c_master_enable_hotjoin(struct i3c_master_controller *m) -+{ -+ struct dw_i3c_master *master = to_dw_i3c_master(m); -+ -+ dw_i3c_master_enable_sir_signal(master, true); -+ writel(readl(master->regs + DEVICE_CTRL) & ~DEV_CTRL_HOT_JOIN_NACK, -+ master->regs + DEVICE_CTRL); -+ -+ return 0; -+} -+ -+static int dw_i3c_master_disable_hotjoin(struct i3c_master_controller *m) -+{ -+ struct dw_i3c_master *master = to_dw_i3c_master(m); -+ -+ writel(readl(master->regs + DEVICE_CTRL) | DEV_CTRL_HOT_JOIN_NACK, -+ master->regs + DEVICE_CTRL); -+ -+ return 0; -+} -+ - static int dw_i3c_master_enable_ibi(struct i3c_dev_desc *dev) - { - struct dw_i3c_i2c_dev_data *data = i3c_dev_get_master_data(dev); -@@ -1326,6 +1354,8 @@ static void dw_i3c_master_irq_handle_ibis(struct dw_i3c_master *master) - - if (IBI_TYPE_SIRQ(reg)) { - dw_i3c_master_handle_ibi_sir(master, reg); -+ } else if (IBI_TYPE_HJ(reg)) { -+ queue_work(master->base.wq, &master->hj_work); - } else { - len = IBI_QUEUE_STATUS_DATA_LEN(reg); - dev_info(&master->base.dev, -@@ -1393,6 +1423,8 @@ static const struct i3c_master_controller_ops dw_mipi_i3c_ibi_ops = { - .enable_ibi = dw_i3c_master_enable_ibi, - .disable_ibi = dw_i3c_master_disable_ibi, - .recycle_ibi_slot = dw_i3c_master_recycle_ibi_slot, -+ .enable_hotjoin = dw_i3c_master_enable_hotjoin, -+ .disable_hotjoin = dw_i3c_master_disable_hotjoin, - }; - - /* default platform ops implementations */ -@@ -1412,6 +1444,14 @@ static const struct dw_i3c_platform_ops dw_i3c_platform_ops_default = { - .set_dat_ibi = dw_i3c_platform_set_dat_ibi_nop, - }; - -+static void dw_i3c_hj_work(struct work_struct *work) -+{ -+ struct dw_i3c_master *master = -+ container_of(work, typeof(*master), hj_work); -+ -+ i3c_master_do_daa(&master->base); -+} -+ - int dw_i3c_common_probe(struct dw_i3c_master *master, - struct platform_device *pdev) - { -@@ -1469,6 +1509,7 @@ int dw_i3c_common_probe(struct dw_i3c_master *master, - if (master->ibi_capable) - ops = &dw_mipi_i3c_ibi_ops; - -+ INIT_WORK(&master->hj_work, dw_i3c_hj_work); - ret = i3c_master_register(&master->base, &pdev->dev, ops, false); - if (ret) - goto err_assert_rst; -@@ -1487,6 +1528,7 @@ EXPORT_SYMBOL_GPL(dw_i3c_common_probe); - - void dw_i3c_common_remove(struct dw_i3c_master *master) - { -+ cancel_work_sync(&master->hj_work); - i3c_master_unregister(&master->base); - - reset_control_assert(master->core_rst); -diff --git a/drivers/i3c/master/dw-i3c-master.h b/drivers/i3c/master/dw-i3c-master.h -index ab862c5d15fe72..4ab94aa72252e4 100644 ---- a/drivers/i3c/master/dw-i3c-master.h -+++ b/drivers/i3c/master/dw-i3c-master.h -@@ -57,6 +57,8 @@ struct dw_i3c_master { - - /* platform-specific data */ - const struct dw_i3c_platform_ops *platform_ops; -+ -+ struct work_struct hj_work; - }; - - struct dw_i3c_platform_ops { -diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c -index 5f879598699545..32f1f91e272046 100644 ---- a/drivers/iio/adc/ti_am335x_adc.c -+++ b/drivers/iio/adc/ti_am335x_adc.c -@@ -564,13 +564,11 @@ static int tiadc_parse_dt(struct platform_device *pdev, - struct tiadc_device *adc_dev) - { - struct device_node *node = pdev->dev.of_node; -- struct property *prop; -- const __be32 *cur; - int channels = 0; - u32 val; - int i; - -- of_property_for_each_u32(node, "ti,adc-channels", prop, cur, val) { -+ of_property_for_each_u32(node, "ti,adc-channels", val) { - adc_dev->channel_line[channels] = val; - - /* Set Default values for optional DT parameters */ -diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c -index 08da793969ee55..f7345e4890a141 100644 ---- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c -+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c -@@ -4278,9 +4278,10 @@ int bnxt_re_mmap(struct ib_ucontext *ib_uctx, struct vm_area_struct *vma) - case BNXT_RE_MMAP_DBR_PAGE: - /* Driver doesn't expect write access for user space */ - if (vma->vm_flags & VM_WRITE) -- return -EFAULT; -- ret = vm_insert_page(vma, vma->vm_start, -- virt_to_page((void *)bnxt_entry->mem_offset)); -+ ret = -EFAULT; -+ else -+ ret = vm_insert_page(vma, vma->vm_start, -+ virt_to_page((void *)bnxt_entry->mem_offset)); - break; - default: - ret = -EINVAL; -diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c -index 80970a1738f8a6..034b85c4225555 100644 ---- a/drivers/infiniband/hw/cxgb4/device.c -+++ b/drivers/infiniband/hw/cxgb4/device.c -@@ -1114,8 +1114,10 @@ static inline struct sk_buff *copy_gl_to_skb_pkt(const struct pkt_gl *gl, - * The math here assumes sizeof cpl_pass_accept_req >= sizeof - * cpl_rx_pkt. - */ -- skb = alloc_skb(gl->tot_len + sizeof(struct cpl_pass_accept_req) + -- sizeof(struct rss_header) - pktshift, GFP_ATOMIC); -+ skb = alloc_skb(size_add(gl->tot_len, -+ sizeof(struct cpl_pass_accept_req) + -+ sizeof(struct rss_header)) - pktshift, -+ GFP_ATOMIC); - if (unlikely(!skb)) - return NULL; - -diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c -index 529db874d67c69..b1bbdcff631d56 100644 ---- a/drivers/infiniband/hw/mlx4/main.c -+++ b/drivers/infiniband/hw/mlx4/main.c -@@ -351,7 +351,7 @@ static int mlx4_ib_del_gid(const struct ib_gid_attr *attr, void **context) - struct mlx4_port_gid_table *port_gid_table; - int ret = 0; - int hw_update = 0; -- struct gid_entry *gids; -+ struct gid_entry *gids = NULL; - - if (!rdma_cap_roce_gid_table(attr->device, attr->port_num)) - return -EINVAL; -@@ -389,10 +389,10 @@ static int mlx4_ib_del_gid(const struct ib_gid_attr *attr, void **context) - } - spin_unlock_bh(&iboe->lock); - -- if (!ret && hw_update) { -+ if (gids) - ret = mlx4_ib_update_gids(gids, ibdev, attr->port_num); -- kfree(gids); -- } -+ -+ kfree(gids); - return ret; - } - -diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c -index 3a4605fda6d57e..f1a0a324223c0d 100644 ---- a/drivers/infiniband/hw/mlx5/odp.c -+++ b/drivers/infiniband/hw/mlx5/odp.c -@@ -807,8 +807,7 @@ static bool mkey_is_eq(struct mlx5_ib_mkey *mmkey, u32 key) - /* - * Handle a single data segment in a page-fault WQE or RDMA region. - * -- * Returns number of OS pages retrieved on success. The caller may continue to -- * the next data segment. -+ * Returns zero on success. The caller may continue to the next data segment. - * Can return the following error codes: - * -EAGAIN to designate a temporary error. The caller will abort handling the - * page fault and resolve it. -@@ -821,7 +820,7 @@ static int pagefault_single_data_segment(struct mlx5_ib_dev *dev, - u32 *bytes_committed, - u32 *bytes_mapped) - { -- int npages = 0, ret, i, outlen, cur_outlen = 0, depth = 0; -+ int ret, i, outlen, cur_outlen = 0, depth = 0, pages_in_range; - struct pf_frame *head = NULL, *frame; - struct mlx5_ib_mkey *mmkey; - struct mlx5_ib_mr *mr; -@@ -864,13 +863,20 @@ static int pagefault_single_data_segment(struct mlx5_ib_dev *dev, - case MLX5_MKEY_MR: - mr = container_of(mmkey, struct mlx5_ib_mr, mmkey); - -+ pages_in_range = (ALIGN(io_virt + bcnt, PAGE_SIZE) - -+ (io_virt & PAGE_MASK)) >> -+ PAGE_SHIFT; - ret = pagefault_mr(mr, io_virt, bcnt, bytes_mapped, 0, false); - if (ret < 0) - goto end; - - mlx5_update_odp_stats(mr, faults, ret); - -- npages += ret; -+ if (ret < pages_in_range) { -+ ret = -EFAULT; -+ goto end; -+ } -+ - ret = 0; - break; - -@@ -961,7 +967,7 @@ static int pagefault_single_data_segment(struct mlx5_ib_dev *dev, - kfree(out); - - *bytes_committed = 0; -- return ret ? ret : npages; -+ return ret; - } - - /* -@@ -980,8 +986,7 @@ static int pagefault_single_data_segment(struct mlx5_ib_dev *dev, - * the committed bytes). - * @receive_queue: receive WQE end of sg list - * -- * Returns the number of pages loaded if positive, zero for an empty WQE, or a -- * negative error code. -+ * Returns zero for success or a negative error code. - */ - static int pagefault_data_segments(struct mlx5_ib_dev *dev, - struct mlx5_pagefault *pfault, -@@ -989,7 +994,7 @@ static int pagefault_data_segments(struct mlx5_ib_dev *dev, - void *wqe_end, u32 *bytes_mapped, - u32 *total_wqe_bytes, bool receive_queue) - { -- int ret = 0, npages = 0; -+ int ret = 0; - u64 io_virt; - __be32 key; - u32 byte_count; -@@ -1046,10 +1051,9 @@ static int pagefault_data_segments(struct mlx5_ib_dev *dev, - bytes_mapped); - if (ret < 0) - break; -- npages += ret; - } - -- return ret < 0 ? ret : npages; -+ return ret; - } - - /* -@@ -1285,12 +1289,6 @@ static void mlx5_ib_mr_wqe_pfault_handler(struct mlx5_ib_dev *dev, - free_page((unsigned long)wqe_start); - } - --static int pages_in_range(u64 address, u32 length) --{ -- return (ALIGN(address + length, PAGE_SIZE) - -- (address & PAGE_MASK)) >> PAGE_SHIFT; --} -- - static void mlx5_ib_mr_rdma_pfault_handler(struct mlx5_ib_dev *dev, - struct mlx5_pagefault *pfault) - { -@@ -1329,7 +1327,7 @@ static void mlx5_ib_mr_rdma_pfault_handler(struct mlx5_ib_dev *dev, - if (ret == -EAGAIN) { - /* We're racing with an invalidation, don't prefetch */ - prefetch_activated = 0; -- } else if (ret < 0 || pages_in_range(address, length) > ret) { -+ } else if (ret < 0) { - mlx5_ib_page_fault_resume(dev, pfault, 1); - if (ret != -ENOENT) - mlx5_ib_dbg(dev, "PAGE FAULT error %d. QP 0x%x, type: 0x%x\n", -diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c -index 6f9ec8db014c79..0f8356cea2931e 100644 ---- a/drivers/infiniband/sw/rxe/rxe.c -+++ b/drivers/infiniband/sw/rxe/rxe.c -@@ -163,7 +163,7 @@ void rxe_set_mtu(struct rxe_dev *rxe, unsigned int ndev_mtu) - port->attr.active_mtu = mtu; - port->mtu_cap = ib_mtu_enum_to_int(mtu); - -- rxe_info_dev(rxe, "Set mtu to %d", port->mtu_cap); -+ rxe_info_dev(rxe, "Set mtu to %d\n", port->mtu_cap); - } - - /* called by ifc layer to create new rxe device. -@@ -183,7 +183,7 @@ static int rxe_newlink(const char *ibdev_name, struct net_device *ndev) - int err = 0; - - if (is_vlan_dev(ndev)) { -- rxe_err("rxe creation allowed on top of a real device only"); -+ rxe_err("rxe creation allowed on top of a real device only\n"); - err = -EPERM; - goto err; - } -@@ -191,7 +191,7 @@ static int rxe_newlink(const char *ibdev_name, struct net_device *ndev) - rxe = rxe_get_dev_from_net(ndev); - if (rxe) { - ib_device_put(&rxe->ib_dev); -- rxe_err_dev(rxe, "already configured on %s", ndev->name); -+ rxe_err_dev(rxe, "already configured on %s\n", ndev->name); - err = -EEXIST; - goto err; - } -diff --git a/drivers/infiniband/sw/rxe/rxe.h b/drivers/infiniband/sw/rxe/rxe.h -index d33dd6cf83d377..d8fb2c7af30a7e 100644 ---- a/drivers/infiniband/sw/rxe/rxe.h -+++ b/drivers/infiniband/sw/rxe/rxe.h -@@ -38,7 +38,7 @@ - - #define RXE_ROCE_V2_SPORT (0xc000) - --#define rxe_dbg(fmt, ...) pr_debug("%s: " fmt "\n", __func__, ##__VA_ARGS__) -+#define rxe_dbg(fmt, ...) pr_debug("%s: " fmt, __func__, ##__VA_ARGS__) - #define rxe_dbg_dev(rxe, fmt, ...) ibdev_dbg(&(rxe)->ib_dev, \ - "%s: " fmt, __func__, ##__VA_ARGS__) - #define rxe_dbg_uc(uc, fmt, ...) ibdev_dbg((uc)->ibuc.device, \ -@@ -58,7 +58,7 @@ - #define rxe_dbg_mw(mw, fmt, ...) ibdev_dbg((mw)->ibmw.device, \ - "mw#%d %s: " fmt, (mw)->elem.index, __func__, ##__VA_ARGS__) - --#define rxe_err(fmt, ...) pr_err_ratelimited("%s: " fmt "\n", __func__, \ -+#define rxe_err(fmt, ...) pr_err_ratelimited("%s: " fmt, __func__, \ - ##__VA_ARGS__) - #define rxe_err_dev(rxe, fmt, ...) ibdev_err_ratelimited(&(rxe)->ib_dev, \ - "%s: " fmt, __func__, ##__VA_ARGS__) -@@ -79,7 +79,7 @@ - #define rxe_err_mw(mw, fmt, ...) ibdev_err_ratelimited((mw)->ibmw.device, \ - "mw#%d %s: " fmt, (mw)->elem.index, __func__, ##__VA_ARGS__) - --#define rxe_info(fmt, ...) pr_info_ratelimited("%s: " fmt "\n", __func__, \ -+#define rxe_info(fmt, ...) pr_info_ratelimited("%s: " fmt, __func__, \ - ##__VA_ARGS__) - #define rxe_info_dev(rxe, fmt, ...) ibdev_info_ratelimited(&(rxe)->ib_dev, \ - "%s: " fmt, __func__, ##__VA_ARGS__) -diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c -index acd2172bf092bd..c997b7cbf2a9e8 100644 ---- a/drivers/infiniband/sw/rxe/rxe_comp.c -+++ b/drivers/infiniband/sw/rxe/rxe_comp.c -@@ -433,7 +433,7 @@ static void make_send_cqe(struct rxe_qp *qp, struct rxe_send_wqe *wqe, - } - } else { - if (wqe->status != IB_WC_WR_FLUSH_ERR) -- rxe_err_qp(qp, "non-flush error status = %d", -+ rxe_err_qp(qp, "non-flush error status = %d\n", - wqe->status); - } - } -@@ -582,7 +582,7 @@ static int flush_send_wqe(struct rxe_qp *qp, struct rxe_send_wqe *wqe) - - err = rxe_cq_post(qp->scq, &cqe, 0); - if (err) -- rxe_dbg_cq(qp->scq, "post cq failed, err = %d", err); -+ rxe_dbg_cq(qp->scq, "post cq failed, err = %d\n", err); - - return err; - } -diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c -index d5486cbb3f1004..fec87c9030abdc 100644 ---- a/drivers/infiniband/sw/rxe/rxe_cq.c -+++ b/drivers/infiniband/sw/rxe/rxe_cq.c -@@ -27,7 +27,7 @@ int rxe_cq_chk_attr(struct rxe_dev *rxe, struct rxe_cq *cq, - if (cq) { - count = queue_count(cq->queue, QUEUE_TYPE_TO_CLIENT); - if (cqe < count) { -- rxe_dbg_cq(cq, "cqe(%d) < current # elements in queue (%d)", -+ rxe_dbg_cq(cq, "cqe(%d) < current # elements in queue (%d)\n", - cqe, count); - goto err1; - } -@@ -96,7 +96,7 @@ int rxe_cq_post(struct rxe_cq *cq, struct rxe_cqe *cqe, int solicited) - - full = queue_full(cq->queue, QUEUE_TYPE_TO_CLIENT); - if (unlikely(full)) { -- rxe_err_cq(cq, "queue full"); -+ rxe_err_cq(cq, "queue full\n"); - spin_unlock_irqrestore(&cq->cq_lock, flags); - if (cq->ibcq.event_handler) { - ev.device = cq->ibcq.device; -diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c -index f54042e9aeb268..bc81fde696ee96 100644 ---- a/drivers/infiniband/sw/rxe/rxe_mr.c -+++ b/drivers/infiniband/sw/rxe/rxe_mr.c -@@ -34,7 +34,7 @@ int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length) - case IB_MR_TYPE_MEM_REG: - if (iova < mr->ibmr.iova || - iova + length > mr->ibmr.iova + mr->ibmr.length) { -- rxe_dbg_mr(mr, "iova/length out of range"); -+ rxe_dbg_mr(mr, "iova/length out of range\n"); - return -EINVAL; - } - return 0; -@@ -319,7 +319,7 @@ int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr, - - err = mr_check_range(mr, iova, length); - if (unlikely(err)) { -- rxe_dbg_mr(mr, "iova out of range"); -+ rxe_dbg_mr(mr, "iova out of range\n"); - return err; - } - -@@ -477,7 +477,7 @@ int rxe_mr_do_atomic_op(struct rxe_mr *mr, u64 iova, int opcode, - u64 *va; - - if (unlikely(mr->state != RXE_MR_STATE_VALID)) { -- rxe_dbg_mr(mr, "mr not in valid state"); -+ rxe_dbg_mr(mr, "mr not in valid state\n"); - return RESPST_ERR_RKEY_VIOLATION; - } - -@@ -490,7 +490,7 @@ int rxe_mr_do_atomic_op(struct rxe_mr *mr, u64 iova, int opcode, - - err = mr_check_range(mr, iova, sizeof(value)); - if (err) { -- rxe_dbg_mr(mr, "iova out of range"); -+ rxe_dbg_mr(mr, "iova out of range\n"); - return RESPST_ERR_RKEY_VIOLATION; - } - page_offset = rxe_mr_iova_to_page_offset(mr, iova); -@@ -501,7 +501,7 @@ int rxe_mr_do_atomic_op(struct rxe_mr *mr, u64 iova, int opcode, - } - - if (unlikely(page_offset & 0x7)) { -- rxe_dbg_mr(mr, "iova not aligned"); -+ rxe_dbg_mr(mr, "iova not aligned\n"); - return RESPST_ERR_MISALIGNED_ATOMIC; - } - -@@ -534,7 +534,7 @@ int rxe_mr_do_atomic_write(struct rxe_mr *mr, u64 iova, u64 value) - - /* See IBA oA19-28 */ - if (unlikely(mr->state != RXE_MR_STATE_VALID)) { -- rxe_dbg_mr(mr, "mr not in valid state"); -+ rxe_dbg_mr(mr, "mr not in valid state\n"); - return RESPST_ERR_RKEY_VIOLATION; - } - -@@ -548,7 +548,7 @@ int rxe_mr_do_atomic_write(struct rxe_mr *mr, u64 iova, u64 value) - /* See IBA oA19-28 */ - err = mr_check_range(mr, iova, sizeof(value)); - if (unlikely(err)) { -- rxe_dbg_mr(mr, "iova out of range"); -+ rxe_dbg_mr(mr, "iova out of range\n"); - return RESPST_ERR_RKEY_VIOLATION; - } - page_offset = rxe_mr_iova_to_page_offset(mr, iova); -@@ -560,7 +560,7 @@ int rxe_mr_do_atomic_write(struct rxe_mr *mr, u64 iova, u64 value) - - /* See IBA A19.4.2 */ - if (unlikely(page_offset & 0x7)) { -- rxe_dbg_mr(mr, "misaligned address"); -+ rxe_dbg_mr(mr, "misaligned address\n"); - return RESPST_ERR_MISALIGNED_ATOMIC; - } - -diff --git a/drivers/infiniband/sw/rxe/rxe_mw.c b/drivers/infiniband/sw/rxe/rxe_mw.c -index d9312b5c9d207e..379e65bfcd49af 100644 ---- a/drivers/infiniband/sw/rxe/rxe_mw.c -+++ b/drivers/infiniband/sw/rxe/rxe_mw.c -@@ -198,7 +198,7 @@ int rxe_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe) - } - - if (access & ~RXE_ACCESS_SUPPORTED_MW) { -- rxe_err_mw(mw, "access %#x not supported", access); -+ rxe_err_mw(mw, "access %#x not supported\n", access); - ret = -EOPNOTSUPP; - goto err_drop_mr; - } -diff --git a/drivers/infiniband/sw/rxe/rxe_param.h b/drivers/infiniband/sw/rxe/rxe_param.h -index d2f57ead78ad12..003f681e5dc022 100644 ---- a/drivers/infiniband/sw/rxe/rxe_param.h -+++ b/drivers/infiniband/sw/rxe/rxe_param.h -@@ -129,7 +129,7 @@ enum rxe_device_param { - enum rxe_port_param { - RXE_PORT_GID_TBL_LEN = 1024, - RXE_PORT_PORT_CAP_FLAGS = IB_PORT_CM_SUP, -- RXE_PORT_MAX_MSG_SZ = 0x800000, -+ RXE_PORT_MAX_MSG_SZ = (1UL << 31), - RXE_PORT_BAD_PKEY_CNTR = 0, - RXE_PORT_QKEY_VIOL_CNTR = 0, - RXE_PORT_LID = 0, -diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c -index 6215c6de3a8408..368e366f254d49 100644 ---- a/drivers/infiniband/sw/rxe/rxe_pool.c -+++ b/drivers/infiniband/sw/rxe/rxe_pool.c -@@ -178,7 +178,6 @@ int __rxe_cleanup(struct rxe_pool_elem *elem, bool sleepable) - { - struct rxe_pool *pool = elem->pool; - struct xarray *xa = &pool->xa; -- static int timeout = RXE_POOL_TIMEOUT; - int ret, err = 0; - void *xa_ret; - -@@ -202,19 +201,19 @@ int __rxe_cleanup(struct rxe_pool_elem *elem, bool sleepable) - * return to rdma-core - */ - if (sleepable) { -- if (!completion_done(&elem->complete) && timeout) { -+ if (!completion_done(&elem->complete)) { - ret = wait_for_completion_timeout(&elem->complete, -- timeout); -+ msecs_to_jiffies(50000)); - - /* Shouldn't happen. There are still references to - * the object but, rather than deadlock, free the - * object or pass back to rdma-core. - */ - if (WARN_ON(!ret)) -- err = -EINVAL; -+ err = -ETIMEDOUT; - } - } else { -- unsigned long until = jiffies + timeout; -+ unsigned long until = jiffies + RXE_POOL_TIMEOUT; - - /* AH objects are unique in that the destroy_ah verb - * can be called in atomic context. This delay -@@ -226,7 +225,7 @@ int __rxe_cleanup(struct rxe_pool_elem *elem, bool sleepable) - mdelay(1); - - if (WARN_ON(!completion_done(&elem->complete))) -- err = -EINVAL; -+ err = -ETIMEDOUT; - } - - if (pool->cleanup) -diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c -index 3767d7fc0aac82..287fc8b8f5bafe 100644 ---- a/drivers/infiniband/sw/rxe/rxe_qp.c -+++ b/drivers/infiniband/sw/rxe/rxe_qp.c -@@ -201,7 +201,7 @@ static int rxe_init_sq(struct rxe_qp *qp, struct ib_qp_init_attr *init, - qp->sq.queue = rxe_queue_init(rxe, &qp->sq.max_wr, wqe_size, - QUEUE_TYPE_FROM_CLIENT); - if (!qp->sq.queue) { -- rxe_err_qp(qp, "Unable to allocate send queue"); -+ rxe_err_qp(qp, "Unable to allocate send queue\n"); - err = -ENOMEM; - goto err_out; - } -@@ -211,7 +211,7 @@ static int rxe_init_sq(struct rxe_qp *qp, struct ib_qp_init_attr *init, - qp->sq.queue->buf, qp->sq.queue->buf_size, - &qp->sq.queue->ip); - if (err) { -- rxe_err_qp(qp, "do_mmap_info failed, err = %d", err); -+ rxe_err_qp(qp, "do_mmap_info failed, err = %d\n", err); - goto err_free; - } - -@@ -292,7 +292,7 @@ static int rxe_init_rq(struct rxe_qp *qp, struct ib_qp_init_attr *init, - qp->rq.queue = rxe_queue_init(rxe, &qp->rq.max_wr, wqe_size, - QUEUE_TYPE_FROM_CLIENT); - if (!qp->rq.queue) { -- rxe_err_qp(qp, "Unable to allocate recv queue"); -+ rxe_err_qp(qp, "Unable to allocate recv queue\n"); - err = -ENOMEM; - goto err_out; - } -@@ -302,7 +302,7 @@ static int rxe_init_rq(struct rxe_qp *qp, struct ib_qp_init_attr *init, - qp->rq.queue->buf, qp->rq.queue->buf_size, - &qp->rq.queue->ip); - if (err) { -- rxe_err_qp(qp, "do_mmap_info failed, err = %d", err); -+ rxe_err_qp(qp, "do_mmap_info failed, err = %d\n", err); - goto err_free; - } - -diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c -index c02aa27fe5d817..fa2b87c7492920 100644 ---- a/drivers/infiniband/sw/rxe/rxe_resp.c -+++ b/drivers/infiniband/sw/rxe/rxe_resp.c -@@ -375,18 +375,18 @@ static enum resp_states rxe_resp_check_length(struct rxe_qp *qp, - if ((pkt->mask & RXE_START_MASK) && - (pkt->mask & RXE_END_MASK)) { - if (unlikely(payload > mtu)) { -- rxe_dbg_qp(qp, "only packet too long"); -+ rxe_dbg_qp(qp, "only packet too long\n"); - return RESPST_ERR_LENGTH; - } - } else if ((pkt->mask & RXE_START_MASK) || - (pkt->mask & RXE_MIDDLE_MASK)) { - if (unlikely(payload != mtu)) { -- rxe_dbg_qp(qp, "first or middle packet not mtu"); -+ rxe_dbg_qp(qp, "first or middle packet not mtu\n"); - return RESPST_ERR_LENGTH; - } - } else if (pkt->mask & RXE_END_MASK) { - if (unlikely((payload == 0) || (payload > mtu))) { -- rxe_dbg_qp(qp, "last packet zero or too long"); -+ rxe_dbg_qp(qp, "last packet zero or too long\n"); - return RESPST_ERR_LENGTH; - } - } -@@ -395,7 +395,7 @@ static enum resp_states rxe_resp_check_length(struct rxe_qp *qp, - /* See IBA C9-94 */ - if (pkt->mask & RXE_RETH_MASK) { - if (reth_len(pkt) > (1U << 31)) { -- rxe_dbg_qp(qp, "dma length too long"); -+ rxe_dbg_qp(qp, "dma length too long\n"); - return RESPST_ERR_LENGTH; - } - } -@@ -1146,7 +1146,7 @@ static enum resp_states do_complete(struct rxe_qp *qp, - } - } else { - if (wc->status != IB_WC_WR_FLUSH_ERR) -- rxe_err_qp(qp, "non-flush error status = %d", -+ rxe_err_qp(qp, "non-flush error status = %d\n", - wc->status); - } - -@@ -1455,7 +1455,7 @@ static int flush_recv_wqe(struct rxe_qp *qp, struct rxe_recv_wqe *wqe) - - err = rxe_cq_post(qp->rcq, &cqe, 0); - if (err) -- rxe_dbg_cq(qp->rcq, "post cq failed err = %d", err); -+ rxe_dbg_cq(qp->rcq, "post cq failed err = %d\n", err); - - return err; - } -diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c -index 1501120d4f5241..80332638d9e3ac 100644 ---- a/drivers/infiniband/sw/rxe/rxe_task.c -+++ b/drivers/infiniband/sw/rxe/rxe_task.c -@@ -156,7 +156,7 @@ static void do_task(struct rxe_task *task) - - default: - WARN_ON(1); -- rxe_dbg_qp(task->qp, "unexpected task state = %d", -+ rxe_dbg_qp(task->qp, "unexpected task state = %d\n", - task->state); - task->state = TASK_STATE_IDLE; - } -@@ -167,7 +167,7 @@ static void do_task(struct rxe_task *task) - if (WARN_ON(task->num_done != task->num_sched)) - rxe_dbg_qp( - task->qp, -- "%ld tasks scheduled, %ld tasks done", -+ "%ld tasks scheduled, %ld tasks done\n", - task->num_sched, task->num_done); - } - spin_unlock_irqrestore(&task->lock, flags); -diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c -index 9f46b9f74825ff..dbb9baa4ffd002 100644 ---- a/drivers/infiniband/sw/rxe/rxe_verbs.c -+++ b/drivers/infiniband/sw/rxe/rxe_verbs.c -@@ -23,7 +23,7 @@ static int rxe_query_device(struct ib_device *ibdev, - int err; - - if (udata->inlen || udata->outlen) { -- rxe_dbg_dev(rxe, "malformed udata"); -+ rxe_dbg_dev(rxe, "malformed udata\n"); - err = -EINVAL; - goto err_out; - } -@@ -33,7 +33,7 @@ static int rxe_query_device(struct ib_device *ibdev, - return 0; - - err_out: -- rxe_err_dev(rxe, "returned err = %d", err); -+ rxe_err_dev(rxe, "returned err = %d\n", err); - return err; - } - -@@ -45,7 +45,7 @@ static int rxe_query_port(struct ib_device *ibdev, - - if (port_num != 1) { - err = -EINVAL; -- rxe_dbg_dev(rxe, "bad port_num = %d", port_num); -+ rxe_dbg_dev(rxe, "bad port_num = %d\n", port_num); - goto err_out; - } - -@@ -67,7 +67,7 @@ static int rxe_query_port(struct ib_device *ibdev, - return ret; - - err_out: -- rxe_err_dev(rxe, "returned err = %d", err); -+ rxe_err_dev(rxe, "returned err = %d\n", err); - return err; - } - -@@ -79,7 +79,7 @@ static int rxe_query_pkey(struct ib_device *ibdev, - - if (index != 0) { - err = -EINVAL; -- rxe_dbg_dev(rxe, "bad pkey index = %d", index); -+ rxe_dbg_dev(rxe, "bad pkey index = %d\n", index); - goto err_out; - } - -@@ -87,7 +87,7 @@ static int rxe_query_pkey(struct ib_device *ibdev, - return 0; - - err_out: -- rxe_err_dev(rxe, "returned err = %d", err); -+ rxe_err_dev(rxe, "returned err = %d\n", err); - return err; - } - -@@ -100,7 +100,7 @@ static int rxe_modify_device(struct ib_device *ibdev, - if (mask & ~(IB_DEVICE_MODIFY_SYS_IMAGE_GUID | - IB_DEVICE_MODIFY_NODE_DESC)) { - err = -EOPNOTSUPP; -- rxe_dbg_dev(rxe, "unsupported mask = 0x%x", mask); -+ rxe_dbg_dev(rxe, "unsupported mask = 0x%x\n", mask); - goto err_out; - } - -@@ -115,7 +115,7 @@ static int rxe_modify_device(struct ib_device *ibdev, - return 0; - - err_out: -- rxe_err_dev(rxe, "returned err = %d", err); -+ rxe_err_dev(rxe, "returned err = %d\n", err); - return err; - } - -@@ -128,14 +128,14 @@ static int rxe_modify_port(struct ib_device *ibdev, u32 port_num, - - if (port_num != 1) { - err = -EINVAL; -- rxe_dbg_dev(rxe, "bad port_num = %d", port_num); -+ rxe_dbg_dev(rxe, "bad port_num = %d\n", port_num); - goto err_out; - } - - //TODO is shutdown useful - if (mask & ~(IB_PORT_RESET_QKEY_CNTR)) { - err = -EOPNOTSUPP; -- rxe_dbg_dev(rxe, "unsupported mask = 0x%x", mask); -+ rxe_dbg_dev(rxe, "unsupported mask = 0x%x\n", mask); - goto err_out; - } - -@@ -149,7 +149,7 @@ static int rxe_modify_port(struct ib_device *ibdev, u32 port_num, - return 0; - - err_out: -- rxe_err_dev(rxe, "returned err = %d", err); -+ rxe_err_dev(rxe, "returned err = %d\n", err); - return err; - } - -@@ -161,14 +161,14 @@ static enum rdma_link_layer rxe_get_link_layer(struct ib_device *ibdev, - - if (port_num != 1) { - err = -EINVAL; -- rxe_dbg_dev(rxe, "bad port_num = %d", port_num); -+ rxe_dbg_dev(rxe, "bad port_num = %d\n", port_num); - goto err_out; - } - - return IB_LINK_LAYER_ETHERNET; - - err_out: -- rxe_err_dev(rxe, "returned err = %d", err); -+ rxe_err_dev(rxe, "returned err = %d\n", err); - return err; - } - -@@ -181,7 +181,7 @@ static int rxe_port_immutable(struct ib_device *ibdev, u32 port_num, - - if (port_num != 1) { - err = -EINVAL; -- rxe_dbg_dev(rxe, "bad port_num = %d", port_num); -+ rxe_dbg_dev(rxe, "bad port_num = %d\n", port_num); - goto err_out; - } - -@@ -197,7 +197,7 @@ static int rxe_port_immutable(struct ib_device *ibdev, u32 port_num, - return 0; - - err_out: -- rxe_err_dev(rxe, "returned err = %d", err); -+ rxe_err_dev(rxe, "returned err = %d\n", err); - return err; - } - -@@ -210,7 +210,7 @@ static int rxe_alloc_ucontext(struct ib_ucontext *ibuc, struct ib_udata *udata) - - err = rxe_add_to_pool(&rxe->uc_pool, uc); - if (err) -- rxe_err_dev(rxe, "unable to create uc"); -+ rxe_err_dev(rxe, "unable to create uc\n"); - - return err; - } -@@ -222,7 +222,7 @@ static void rxe_dealloc_ucontext(struct ib_ucontext *ibuc) - - err = rxe_cleanup(uc); - if (err) -- rxe_err_uc(uc, "cleanup failed, err = %d", err); -+ rxe_err_uc(uc, "cleanup failed, err = %d\n", err); - } - - /* pd */ -@@ -234,14 +234,14 @@ static int rxe_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata) - - err = rxe_add_to_pool(&rxe->pd_pool, pd); - if (err) { -- rxe_dbg_dev(rxe, "unable to alloc pd"); -+ rxe_dbg_dev(rxe, "unable to alloc pd\n"); - goto err_out; - } - - return 0; - - err_out: -- rxe_err_dev(rxe, "returned err = %d", err); -+ rxe_err_dev(rxe, "returned err = %d\n", err); - return err; - } - -@@ -252,7 +252,7 @@ static int rxe_dealloc_pd(struct ib_pd *ibpd, struct ib_udata *udata) - - err = rxe_cleanup(pd); - if (err) -- rxe_err_pd(pd, "cleanup failed, err = %d", err); -+ rxe_err_pd(pd, "cleanup failed, err = %d\n", err); - - return 0; - } -@@ -279,7 +279,7 @@ static int rxe_create_ah(struct ib_ah *ibah, - err = rxe_add_to_pool_ah(&rxe->ah_pool, ah, - init_attr->flags & RDMA_CREATE_AH_SLEEPABLE); - if (err) { -- rxe_dbg_dev(rxe, "unable to create ah"); -+ rxe_dbg_dev(rxe, "unable to create ah\n"); - goto err_out; - } - -@@ -288,7 +288,7 @@ static int rxe_create_ah(struct ib_ah *ibah, - - err = rxe_ah_chk_attr(ah, init_attr->ah_attr); - if (err) { -- rxe_dbg_ah(ah, "bad attr"); -+ rxe_dbg_ah(ah, "bad attr\n"); - goto err_cleanup; - } - -@@ -298,7 +298,7 @@ static int rxe_create_ah(struct ib_ah *ibah, - sizeof(uresp->ah_num)); - if (err) { - err = -EFAULT; -- rxe_dbg_ah(ah, "unable to copy to user"); -+ rxe_dbg_ah(ah, "unable to copy to user\n"); - goto err_cleanup; - } - } else if (ah->is_user) { -@@ -314,9 +314,9 @@ static int rxe_create_ah(struct ib_ah *ibah, - err_cleanup: - cleanup_err = rxe_cleanup(ah); - if (cleanup_err) -- rxe_err_ah(ah, "cleanup failed, err = %d", cleanup_err); -+ rxe_err_ah(ah, "cleanup failed, err = %d\n", cleanup_err); - err_out: -- rxe_err_ah(ah, "returned err = %d", err); -+ rxe_err_ah(ah, "returned err = %d\n", err); - return err; - } - -@@ -327,7 +327,7 @@ static int rxe_modify_ah(struct ib_ah *ibah, struct rdma_ah_attr *attr) - - err = rxe_ah_chk_attr(ah, attr); - if (err) { -- rxe_dbg_ah(ah, "bad attr"); -+ rxe_dbg_ah(ah, "bad attr\n"); - goto err_out; - } - -@@ -336,7 +336,7 @@ static int rxe_modify_ah(struct ib_ah *ibah, struct rdma_ah_attr *attr) - return 0; - - err_out: -- rxe_err_ah(ah, "returned err = %d", err); -+ rxe_err_ah(ah, "returned err = %d\n", err); - return err; - } - -@@ -358,7 +358,7 @@ static int rxe_destroy_ah(struct ib_ah *ibah, u32 flags) - - err = rxe_cleanup_ah(ah, flags & RDMA_DESTROY_AH_SLEEPABLE); - if (err) -- rxe_err_ah(ah, "cleanup failed, err = %d", err); -+ rxe_err_ah(ah, "cleanup failed, err = %d\n", err); - - return 0; - } -@@ -376,7 +376,7 @@ static int rxe_create_srq(struct ib_srq *ibsrq, struct ib_srq_init_attr *init, - if (udata) { - if (udata->outlen < sizeof(*uresp)) { - err = -EINVAL; -- rxe_err_dev(rxe, "malformed udata"); -+ rxe_err_dev(rxe, "malformed udata\n"); - goto err_out; - } - uresp = udata->outbuf; -@@ -384,20 +384,20 @@ static int rxe_create_srq(struct ib_srq *ibsrq, struct ib_srq_init_attr *init, - - if (init->srq_type != IB_SRQT_BASIC) { - err = -EOPNOTSUPP; -- rxe_dbg_dev(rxe, "srq type = %d, not supported", -+ rxe_dbg_dev(rxe, "srq type = %d, not supported\n", - init->srq_type); - goto err_out; - } - - err = rxe_srq_chk_init(rxe, init); - if (err) { -- rxe_dbg_dev(rxe, "invalid init attributes"); -+ rxe_dbg_dev(rxe, "invalid init attributes\n"); - goto err_out; - } - - err = rxe_add_to_pool(&rxe->srq_pool, srq); - if (err) { -- rxe_dbg_dev(rxe, "unable to create srq, err = %d", err); -+ rxe_dbg_dev(rxe, "unable to create srq, err = %d\n", err); - goto err_out; - } - -@@ -406,7 +406,7 @@ static int rxe_create_srq(struct ib_srq *ibsrq, struct ib_srq_init_attr *init, - - err = rxe_srq_from_init(rxe, srq, init, udata, uresp); - if (err) { -- rxe_dbg_srq(srq, "create srq failed, err = %d", err); -+ rxe_dbg_srq(srq, "create srq failed, err = %d\n", err); - goto err_cleanup; - } - -@@ -415,9 +415,9 @@ static int rxe_create_srq(struct ib_srq *ibsrq, struct ib_srq_init_attr *init, - err_cleanup: - cleanup_err = rxe_cleanup(srq); - if (cleanup_err) -- rxe_err_srq(srq, "cleanup failed, err = %d", cleanup_err); -+ rxe_err_srq(srq, "cleanup failed, err = %d\n", cleanup_err); - err_out: -- rxe_err_dev(rxe, "returned err = %d", err); -+ rxe_err_dev(rxe, "returned err = %d\n", err); - return err; - } - -@@ -433,34 +433,34 @@ static int rxe_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr, - if (udata) { - if (udata->inlen < sizeof(cmd)) { - err = -EINVAL; -- rxe_dbg_srq(srq, "malformed udata"); -+ rxe_dbg_srq(srq, "malformed udata\n"); - goto err_out; - } - - err = ib_copy_from_udata(&cmd, udata, sizeof(cmd)); - if (err) { - err = -EFAULT; -- rxe_dbg_srq(srq, "unable to read udata"); -+ rxe_dbg_srq(srq, "unable to read udata\n"); - goto err_out; - } - } - - err = rxe_srq_chk_attr(rxe, srq, attr, mask); - if (err) { -- rxe_dbg_srq(srq, "bad init attributes"); -+ rxe_dbg_srq(srq, "bad init attributes\n"); - goto err_out; - } - - err = rxe_srq_from_attr(rxe, srq, attr, mask, &cmd, udata); - if (err) { -- rxe_dbg_srq(srq, "bad attr"); -+ rxe_dbg_srq(srq, "bad attr\n"); - goto err_out; - } - - return 0; - - err_out: -- rxe_err_srq(srq, "returned err = %d", err); -+ rxe_err_srq(srq, "returned err = %d\n", err); - return err; - } - -@@ -471,7 +471,7 @@ static int rxe_query_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr) - - if (srq->error) { - err = -EINVAL; -- rxe_dbg_srq(srq, "srq in error state"); -+ rxe_dbg_srq(srq, "srq in error state\n"); - goto err_out; - } - -@@ -481,7 +481,7 @@ static int rxe_query_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr) - return 0; - - err_out: -- rxe_err_srq(srq, "returned err = %d", err); -+ rxe_err_srq(srq, "returned err = %d\n", err); - return err; - } - -@@ -505,7 +505,7 @@ static int rxe_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr, - - if (err) { - *bad_wr = wr; -- rxe_err_srq(srq, "returned err = %d", err); -+ rxe_err_srq(srq, "returned err = %d\n", err); - } - - return err; -@@ -518,7 +518,7 @@ static int rxe_destroy_srq(struct ib_srq *ibsrq, struct ib_udata *udata) - - err = rxe_cleanup(srq); - if (err) -- rxe_err_srq(srq, "cleanup failed, err = %d", err); -+ rxe_err_srq(srq, "cleanup failed, err = %d\n", err); - - return 0; - } -@@ -536,13 +536,13 @@ static int rxe_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *init, - if (udata) { - if (udata->inlen) { - err = -EINVAL; -- rxe_dbg_dev(rxe, "malformed udata, err = %d", err); -+ rxe_dbg_dev(rxe, "malformed udata, err = %d\n", err); - goto err_out; - } - - if (udata->outlen < sizeof(*uresp)) { - err = -EINVAL; -- rxe_dbg_dev(rxe, "malformed udata, err = %d", err); -+ rxe_dbg_dev(rxe, "malformed udata, err = %d\n", err); - goto err_out; - } - -@@ -554,25 +554,25 @@ static int rxe_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *init, - - if (init->create_flags) { - err = -EOPNOTSUPP; -- rxe_dbg_dev(rxe, "unsupported create_flags, err = %d", err); -+ rxe_dbg_dev(rxe, "unsupported create_flags, err = %d\n", err); - goto err_out; - } - - err = rxe_qp_chk_init(rxe, init); - if (err) { -- rxe_dbg_dev(rxe, "bad init attr, err = %d", err); -+ rxe_dbg_dev(rxe, "bad init attr, err = %d\n", err); - goto err_out; - } - - err = rxe_add_to_pool(&rxe->qp_pool, qp); - if (err) { -- rxe_dbg_dev(rxe, "unable to create qp, err = %d", err); -+ rxe_dbg_dev(rxe, "unable to create qp, err = %d\n", err); - goto err_out; - } - - err = rxe_qp_from_init(rxe, qp, pd, init, uresp, ibqp->pd, udata); - if (err) { -- rxe_dbg_qp(qp, "create qp failed, err = %d", err); -+ rxe_dbg_qp(qp, "create qp failed, err = %d\n", err); - goto err_cleanup; - } - -@@ -582,9 +582,9 @@ static int rxe_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *init, - err_cleanup: - cleanup_err = rxe_cleanup(qp); - if (cleanup_err) -- rxe_err_qp(qp, "cleanup failed, err = %d", cleanup_err); -+ rxe_err_qp(qp, "cleanup failed, err = %d\n", cleanup_err); - err_out: -- rxe_err_dev(rxe, "returned err = %d", err); -+ rxe_err_dev(rxe, "returned err = %d\n", err); - return err; - } - -@@ -597,20 +597,20 @@ static int rxe_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, - - if (mask & ~IB_QP_ATTR_STANDARD_BITS) { - err = -EOPNOTSUPP; -- rxe_dbg_qp(qp, "unsupported mask = 0x%x, err = %d", -+ rxe_dbg_qp(qp, "unsupported mask = 0x%x, err = %d\n", - mask, err); - goto err_out; - } - - err = rxe_qp_chk_attr(rxe, qp, attr, mask); - if (err) { -- rxe_dbg_qp(qp, "bad mask/attr, err = %d", err); -+ rxe_dbg_qp(qp, "bad mask/attr, err = %d\n", err); - goto err_out; - } - - err = rxe_qp_from_attr(qp, attr, mask, udata); - if (err) { -- rxe_dbg_qp(qp, "modify qp failed, err = %d", err); -+ rxe_dbg_qp(qp, "modify qp failed, err = %d\n", err); - goto err_out; - } - -@@ -622,7 +622,7 @@ static int rxe_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, - return 0; - - err_out: -- rxe_err_qp(qp, "returned err = %d", err); -+ rxe_err_qp(qp, "returned err = %d\n", err); - return err; - } - -@@ -644,18 +644,18 @@ static int rxe_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata) - - err = rxe_qp_chk_destroy(qp); - if (err) { -- rxe_dbg_qp(qp, "unable to destroy qp, err = %d", err); -+ rxe_dbg_qp(qp, "unable to destroy qp, err = %d\n", err); - goto err_out; - } - - err = rxe_cleanup(qp); - if (err) -- rxe_err_qp(qp, "cleanup failed, err = %d", err); -+ rxe_err_qp(qp, "cleanup failed, err = %d\n", err); - - return 0; - - err_out: -- rxe_err_qp(qp, "returned err = %d", err); -+ rxe_err_qp(qp, "returned err = %d\n", err); - return err; - } - -@@ -675,12 +675,12 @@ static int validate_send_wr(struct rxe_qp *qp, const struct ib_send_wr *ibwr, - do { - mask = wr_opcode_mask(ibwr->opcode, qp); - if (!mask) { -- rxe_err_qp(qp, "bad wr opcode for qp type"); -+ rxe_err_qp(qp, "bad wr opcode for qp type\n"); - break; - } - - if (num_sge > sq->max_sge) { -- rxe_err_qp(qp, "num_sge > max_sge"); -+ rxe_err_qp(qp, "num_sge > max_sge\n"); - break; - } - -@@ -688,28 +688,28 @@ static int validate_send_wr(struct rxe_qp *qp, const struct ib_send_wr *ibwr, - for (i = 0; i < ibwr->num_sge; i++) - length += ibwr->sg_list[i].length; - -- if (length > (1UL << 31)) { -- rxe_err_qp(qp, "message length too long"); -+ if (length > RXE_PORT_MAX_MSG_SZ) { -+ rxe_err_qp(qp, "message length too long\n"); - break; - } - - if (mask & WR_ATOMIC_MASK) { - if (length != 8) { -- rxe_err_qp(qp, "atomic length != 8"); -+ rxe_err_qp(qp, "atomic length != 8\n"); - break; - } - if (atomic_wr(ibwr)->remote_addr & 0x7) { -- rxe_err_qp(qp, "misaligned atomic address"); -+ rxe_err_qp(qp, "misaligned atomic address\n"); - break; - } - } - if (ibwr->send_flags & IB_SEND_INLINE) { - if (!(mask & WR_INLINE_MASK)) { -- rxe_err_qp(qp, "opcode doesn't support inline data"); -+ rxe_err_qp(qp, "opcode doesn't support inline data\n"); - break; - } - if (length > sq->max_inline) { -- rxe_err_qp(qp, "inline length too big"); -+ rxe_err_qp(qp, "inline length too big\n"); - break; - } - } -@@ -747,7 +747,7 @@ static int init_send_wr(struct rxe_qp *qp, struct rxe_send_wr *wr, - case IB_WR_SEND: - break; - default: -- rxe_err_qp(qp, "bad wr opcode %d for UD/GSI QP", -+ rxe_err_qp(qp, "bad wr opcode %d for UD/GSI QP\n", - wr->opcode); - return -EINVAL; - } -@@ -795,7 +795,7 @@ static int init_send_wr(struct rxe_qp *qp, struct rxe_send_wr *wr, - case IB_WR_ATOMIC_WRITE: - break; - default: -- rxe_err_qp(qp, "unsupported wr opcode %d", -+ rxe_err_qp(qp, "unsupported wr opcode %d\n", - wr->opcode); - return -EINVAL; - } -@@ -870,7 +870,7 @@ static int post_one_send(struct rxe_qp *qp, const struct ib_send_wr *ibwr) - - full = queue_full(sq->queue, QUEUE_TYPE_FROM_ULP); - if (unlikely(full)) { -- rxe_err_qp(qp, "send queue full"); -+ rxe_err_qp(qp, "send queue full\n"); - return -ENOMEM; - } - -@@ -926,14 +926,14 @@ static int rxe_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr, - /* caller has already called destroy_qp */ - if (WARN_ON_ONCE(!qp->valid)) { - spin_unlock_irqrestore(&qp->state_lock, flags); -- rxe_err_qp(qp, "qp has been destroyed"); -+ rxe_err_qp(qp, "qp has been destroyed\n"); - return -EINVAL; - } - - if (unlikely(qp_state(qp) < IB_QPS_RTS)) { - spin_unlock_irqrestore(&qp->state_lock, flags); - *bad_wr = wr; -- rxe_err_qp(qp, "qp not ready to send"); -+ rxe_err_qp(qp, "qp not ready to send\n"); - return -EINVAL; - } - spin_unlock_irqrestore(&qp->state_lock, flags); -@@ -963,13 +963,13 @@ static int post_one_recv(struct rxe_rq *rq, const struct ib_recv_wr *ibwr) - full = queue_full(rq->queue, QUEUE_TYPE_FROM_ULP); - if (unlikely(full)) { - err = -ENOMEM; -- rxe_dbg("queue full"); -+ rxe_dbg("queue full\n"); - goto err_out; - } - - if (unlikely(num_sge > rq->max_sge)) { - err = -EINVAL; -- rxe_dbg("bad num_sge > max_sge"); -+ rxe_dbg("bad num_sge > max_sge\n"); - goto err_out; - } - -@@ -977,10 +977,9 @@ static int post_one_recv(struct rxe_rq *rq, const struct ib_recv_wr *ibwr) - for (i = 0; i < num_sge; i++) - length += ibwr->sg_list[i].length; - -- /* IBA max message size is 2^31 */ -- if (length >= (1UL<<31)) { -+ if (length > RXE_PORT_MAX_MSG_SZ) { - err = -EINVAL; -- rxe_dbg("message length too long"); -+ rxe_dbg("message length too long\n"); - goto err_out; - } - -@@ -1000,7 +999,7 @@ static int post_one_recv(struct rxe_rq *rq, const struct ib_recv_wr *ibwr) - return 0; - - err_out: -- rxe_dbg("returned err = %d", err); -+ rxe_dbg("returned err = %d\n", err); - return err; - } - -@@ -1016,7 +1015,7 @@ static int rxe_post_recv(struct ib_qp *ibqp, const struct ib_recv_wr *wr, - /* caller has already called destroy_qp */ - if (WARN_ON_ONCE(!qp->valid)) { - spin_unlock_irqrestore(&qp->state_lock, flags); -- rxe_err_qp(qp, "qp has been destroyed"); -+ rxe_err_qp(qp, "qp has been destroyed\n"); - return -EINVAL; - } - -@@ -1024,14 +1023,14 @@ static int rxe_post_recv(struct ib_qp *ibqp, const struct ib_recv_wr *wr, - if (unlikely((qp_state(qp) < IB_QPS_INIT))) { - spin_unlock_irqrestore(&qp->state_lock, flags); - *bad_wr = wr; -- rxe_dbg_qp(qp, "qp not ready to post recv"); -+ rxe_dbg_qp(qp, "qp not ready to post recv\n"); - return -EINVAL; - } - spin_unlock_irqrestore(&qp->state_lock, flags); - - if (unlikely(qp->srq)) { - *bad_wr = wr; -- rxe_dbg_qp(qp, "qp has srq, use post_srq_recv instead"); -+ rxe_dbg_qp(qp, "qp has srq, use post_srq_recv instead\n"); - return -EINVAL; - } - -@@ -1069,7 +1068,7 @@ static int rxe_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, - if (udata) { - if (udata->outlen < sizeof(*uresp)) { - err = -EINVAL; -- rxe_dbg_dev(rxe, "malformed udata, err = %d", err); -+ rxe_dbg_dev(rxe, "malformed udata, err = %d\n", err); - goto err_out; - } - uresp = udata->outbuf; -@@ -1077,26 +1076,26 @@ static int rxe_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, - - if (attr->flags) { - err = -EOPNOTSUPP; -- rxe_dbg_dev(rxe, "bad attr->flags, err = %d", err); -+ rxe_dbg_dev(rxe, "bad attr->flags, err = %d\n", err); - goto err_out; - } - - err = rxe_cq_chk_attr(rxe, NULL, attr->cqe, attr->comp_vector); - if (err) { -- rxe_dbg_dev(rxe, "bad init attributes, err = %d", err); -+ rxe_dbg_dev(rxe, "bad init attributes, err = %d\n", err); - goto err_out; - } - - err = rxe_add_to_pool(&rxe->cq_pool, cq); - if (err) { -- rxe_dbg_dev(rxe, "unable to create cq, err = %d", err); -+ rxe_dbg_dev(rxe, "unable to create cq, err = %d\n", err); - goto err_out; - } - - err = rxe_cq_from_init(rxe, cq, attr->cqe, attr->comp_vector, udata, - uresp); - if (err) { -- rxe_dbg_cq(cq, "create cq failed, err = %d", err); -+ rxe_dbg_cq(cq, "create cq failed, err = %d\n", err); - goto err_cleanup; - } - -@@ -1105,9 +1104,9 @@ static int rxe_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, - err_cleanup: - cleanup_err = rxe_cleanup(cq); - if (cleanup_err) -- rxe_err_cq(cq, "cleanup failed, err = %d", cleanup_err); -+ rxe_err_cq(cq, "cleanup failed, err = %d\n", cleanup_err); - err_out: -- rxe_err_dev(rxe, "returned err = %d", err); -+ rxe_err_dev(rxe, "returned err = %d\n", err); - return err; - } - -@@ -1121,7 +1120,7 @@ static int rxe_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata) - if (udata) { - if (udata->outlen < sizeof(*uresp)) { - err = -EINVAL; -- rxe_dbg_cq(cq, "malformed udata"); -+ rxe_dbg_cq(cq, "malformed udata\n"); - goto err_out; - } - uresp = udata->outbuf; -@@ -1129,20 +1128,20 @@ static int rxe_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata) - - err = rxe_cq_chk_attr(rxe, cq, cqe, 0); - if (err) { -- rxe_dbg_cq(cq, "bad attr, err = %d", err); -+ rxe_dbg_cq(cq, "bad attr, err = %d\n", err); - goto err_out; - } - - err = rxe_cq_resize_queue(cq, cqe, uresp, udata); - if (err) { -- rxe_dbg_cq(cq, "resize cq failed, err = %d", err); -+ rxe_dbg_cq(cq, "resize cq failed, err = %d\n", err); - goto err_out; - } - - return 0; - - err_out: -- rxe_err_cq(cq, "returned err = %d", err); -+ rxe_err_cq(cq, "returned err = %d\n", err); - return err; - } - -@@ -1206,18 +1205,18 @@ static int rxe_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) - */ - if (atomic_read(&cq->num_wq)) { - err = -EINVAL; -- rxe_dbg_cq(cq, "still in use"); -+ rxe_dbg_cq(cq, "still in use\n"); - goto err_out; - } - - err = rxe_cleanup(cq); - if (err) -- rxe_err_cq(cq, "cleanup failed, err = %d", err); -+ rxe_err_cq(cq, "cleanup failed, err = %d\n", err); - - return 0; - - err_out: -- rxe_err_cq(cq, "returned err = %d", err); -+ rxe_err_cq(cq, "returned err = %d\n", err); - return err; - } - -@@ -1235,7 +1234,7 @@ static struct ib_mr *rxe_get_dma_mr(struct ib_pd *ibpd, int access) - - err = rxe_add_to_pool(&rxe->mr_pool, mr); - if (err) { -- rxe_dbg_dev(rxe, "unable to create mr"); -+ rxe_dbg_dev(rxe, "unable to create mr\n"); - goto err_free; - } - -@@ -1249,7 +1248,7 @@ static struct ib_mr *rxe_get_dma_mr(struct ib_pd *ibpd, int access) - - err_free: - kfree(mr); -- rxe_err_pd(pd, "returned err = %d", err); -+ rxe_err_pd(pd, "returned err = %d\n", err); - return ERR_PTR(err); - } - -@@ -1263,7 +1262,7 @@ static struct ib_mr *rxe_reg_user_mr(struct ib_pd *ibpd, u64 start, - int err, cleanup_err; - - if (access & ~RXE_ACCESS_SUPPORTED_MR) { -- rxe_err_pd(pd, "access = %#x not supported (%#x)", access, -+ rxe_err_pd(pd, "access = %#x not supported (%#x)\n", access, - RXE_ACCESS_SUPPORTED_MR); - return ERR_PTR(-EOPNOTSUPP); - } -@@ -1274,7 +1273,7 @@ static struct ib_mr *rxe_reg_user_mr(struct ib_pd *ibpd, u64 start, - - err = rxe_add_to_pool(&rxe->mr_pool, mr); - if (err) { -- rxe_dbg_pd(pd, "unable to create mr"); -+ rxe_dbg_pd(pd, "unable to create mr\n"); - goto err_free; - } - -@@ -1284,7 +1283,7 @@ static struct ib_mr *rxe_reg_user_mr(struct ib_pd *ibpd, u64 start, - - err = rxe_mr_init_user(rxe, start, length, iova, access, mr); - if (err) { -- rxe_dbg_mr(mr, "reg_user_mr failed, err = %d", err); -+ rxe_dbg_mr(mr, "reg_user_mr failed, err = %d\n", err); - goto err_cleanup; - } - -@@ -1294,10 +1293,10 @@ static struct ib_mr *rxe_reg_user_mr(struct ib_pd *ibpd, u64 start, - err_cleanup: - cleanup_err = rxe_cleanup(mr); - if (cleanup_err) -- rxe_err_mr(mr, "cleanup failed, err = %d", cleanup_err); -+ rxe_err_mr(mr, "cleanup failed, err = %d\n", cleanup_err); - err_free: - kfree(mr); -- rxe_err_pd(pd, "returned err = %d", err); -+ rxe_err_pd(pd, "returned err = %d\n", err); - return ERR_PTR(err); - } - -@@ -1314,7 +1313,7 @@ static struct ib_mr *rxe_rereg_user_mr(struct ib_mr *ibmr, int flags, - * rereg_pd and rereg_access - */ - if (flags & ~RXE_MR_REREG_SUPPORTED) { -- rxe_err_mr(mr, "flags = %#x not supported", flags); -+ rxe_err_mr(mr, "flags = %#x not supported\n", flags); - return ERR_PTR(-EOPNOTSUPP); - } - -@@ -1326,7 +1325,7 @@ static struct ib_mr *rxe_rereg_user_mr(struct ib_mr *ibmr, int flags, - - if (flags & IB_MR_REREG_ACCESS) { - if (access & ~RXE_ACCESS_SUPPORTED_MR) { -- rxe_err_mr(mr, "access = %#x not supported", access); -+ rxe_err_mr(mr, "access = %#x not supported\n", access); - return ERR_PTR(-EOPNOTSUPP); - } - mr->access = access; -@@ -1345,7 +1344,7 @@ static struct ib_mr *rxe_alloc_mr(struct ib_pd *ibpd, enum ib_mr_type mr_type, - - if (mr_type != IB_MR_TYPE_MEM_REG) { - err = -EINVAL; -- rxe_dbg_pd(pd, "mr type %d not supported, err = %d", -+ rxe_dbg_pd(pd, "mr type %d not supported, err = %d\n", - mr_type, err); - goto err_out; - } -@@ -1364,7 +1363,7 @@ static struct ib_mr *rxe_alloc_mr(struct ib_pd *ibpd, enum ib_mr_type mr_type, - - err = rxe_mr_init_fast(max_num_sg, mr); - if (err) { -- rxe_dbg_mr(mr, "alloc_mr failed, err = %d", err); -+ rxe_dbg_mr(mr, "alloc_mr failed, err = %d\n", err); - goto err_cleanup; - } - -@@ -1374,11 +1373,11 @@ static struct ib_mr *rxe_alloc_mr(struct ib_pd *ibpd, enum ib_mr_type mr_type, - err_cleanup: - cleanup_err = rxe_cleanup(mr); - if (cleanup_err) -- rxe_err_mr(mr, "cleanup failed, err = %d", err); -+ rxe_err_mr(mr, "cleanup failed, err = %d\n", err); - err_free: - kfree(mr); - err_out: -- rxe_err_pd(pd, "returned err = %d", err); -+ rxe_err_pd(pd, "returned err = %d\n", err); - return ERR_PTR(err); - } - -@@ -1390,19 +1389,19 @@ static int rxe_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata) - /* See IBA 10.6.7.2.6 */ - if (atomic_read(&mr->num_mw) > 0) { - err = -EINVAL; -- rxe_dbg_mr(mr, "mr has mw's bound"); -+ rxe_dbg_mr(mr, "mr has mw's bound\n"); - goto err_out; - } - - cleanup_err = rxe_cleanup(mr); - if (cleanup_err) -- rxe_err_mr(mr, "cleanup failed, err = %d", cleanup_err); -+ rxe_err_mr(mr, "cleanup failed, err = %d\n", cleanup_err); - - kfree_rcu_mightsleep(mr); - return 0; - - err_out: -- rxe_err_mr(mr, "returned err = %d", err); -+ rxe_err_mr(mr, "returned err = %d\n", err); - return err; - } - -diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c -index 2916e77f589b81..7289ae0b83aced 100644 ---- a/drivers/infiniband/ulp/srp/ib_srp.c -+++ b/drivers/infiniband/ulp/srp/ib_srp.c -@@ -3978,7 +3978,6 @@ static struct srp_host *srp_add_port(struct srp_device *device, u32 port) - return host; - - put_host: -- device_del(&host->dev); - put_device(&host->dev); - return NULL; - } -diff --git a/drivers/irqchip/irq-atmel-aic-common.c b/drivers/irqchip/irq-atmel-aic-common.c -index 072bd227b6c677..4525366d16d615 100644 ---- a/drivers/irqchip/irq-atmel-aic-common.c -+++ b/drivers/irqchip/irq-atmel-aic-common.c -@@ -111,8 +111,6 @@ static void __init aic_common_ext_irq_of_init(struct irq_domain *domain) - struct device_node *node = irq_domain_get_of_node(domain); - struct irq_chip_generic *gc; - struct aic_chip_data *aic; -- struct property *prop; -- const __be32 *p; - u32 hwirq; - - gc = irq_get_domain_generic_chip(domain, 0); -@@ -120,7 +118,7 @@ static void __init aic_common_ext_irq_of_init(struct irq_domain *domain) - aic = gc->private; - aic->ext_irqs |= 1; - -- of_property_for_each_u32(node, "atmel,external-irqs", prop, p, hwirq) { -+ of_property_for_each_u32(node, "atmel,external-irqs", hwirq) { - gc = irq_get_domain_generic_chip(domain, hwirq); - if (!gc) { - pr_warn("AIC: external irq %d >= %d skip it\n", -diff --git a/drivers/irqchip/irq-pic32-evic.c b/drivers/irqchip/irq-pic32-evic.c -index 1d9bb28d13e5d9..5d6b8e025bb876 100644 ---- a/drivers/irqchip/irq-pic32-evic.c -+++ b/drivers/irqchip/irq-pic32-evic.c -@@ -190,13 +190,11 @@ static void __init pic32_ext_irq_of_init(struct irq_domain *domain) - { - struct device_node *node = irq_domain_get_of_node(domain); - struct evic_chip_data *priv = domain->host_data; -- struct property *prop; -- const __le32 *p; - u32 hwirq; - int i = 0; - const char *pname = "microchip,external-irqs"; - -- of_property_for_each_u32(node, pname, prop, p, hwirq) { -+ of_property_for_each_u32(node, pname, hwirq) { - if (i >= ARRAY_SIZE(priv->ext_irqs)) { - pr_warn("More than %d external irq, skip rest\n", - ARRAY_SIZE(priv->ext_irqs)); -diff --git a/drivers/leds/leds-cht-wcove.c b/drivers/leds/leds-cht-wcove.c -index b4998402b8c6f0..711ac4bd60580d 100644 ---- a/drivers/leds/leds-cht-wcove.c -+++ b/drivers/leds/leds-cht-wcove.c -@@ -394,7 +394,7 @@ static int cht_wc_leds_probe(struct platform_device *pdev) - led->cdev.pattern_clear = cht_wc_leds_pattern_clear; - led->cdev.max_brightness = 255; - -- ret = led_classdev_register(&pdev->dev, &led->cdev); -+ ret = devm_led_classdev_register(&pdev->dev, &led->cdev); - if (ret < 0) - return ret; - } -@@ -406,10 +406,6 @@ static int cht_wc_leds_probe(struct platform_device *pdev) - static void cht_wc_leds_remove(struct platform_device *pdev) - { - struct cht_wc_leds *leds = platform_get_drvdata(pdev); -- int i; -- -- for (i = 0; i < CHT_WC_LED_COUNT; i++) -- led_classdev_unregister(&leds->leds[i].cdev); - - /* Restore LED1 regs if hw-control was active else leave LED1 off */ - if (!(leds->led1_initial_regs.ctrl & CHT_WC_LED1_SWCTL)) -diff --git a/drivers/leds/leds-netxbig.c b/drivers/leds/leds-netxbig.c -index 77213b79f84d95..6692de0af68f1c 100644 ---- a/drivers/leds/leds-netxbig.c -+++ b/drivers/leds/leds-netxbig.c -@@ -440,6 +440,7 @@ static int netxbig_leds_get_of_pdata(struct device *dev, - } - gpio_ext_pdev = of_find_device_by_node(gpio_ext_np); - if (!gpio_ext_pdev) { -+ of_node_put(gpio_ext_np); - dev_err(dev, "Failed to find platform device for gpio-ext\n"); - return -ENODEV; - } -diff --git a/drivers/media/i2c/imx290.c b/drivers/media/i2c/imx290.c -index 6dacd38ae947a1..f8ada6c1ef65bf 100644 ---- a/drivers/media/i2c/imx290.c -+++ b/drivers/media/i2c/imx290.c -@@ -269,7 +269,6 @@ static const struct cci_reg_sequence imx290_global_init_settings[] = { - { IMX290_WINWV, 1097 }, - { IMX290_XSOUTSEL, IMX290_XSOUTSEL_XVSOUTSEL_VSYNC | - IMX290_XSOUTSEL_XHSOUTSEL_HSYNC }, -- { CCI_REG8(0x3011), 0x02 }, - { CCI_REG8(0x3012), 0x64 }, - { CCI_REG8(0x3013), 0x00 }, - }; -@@ -277,6 +276,7 @@ static const struct cci_reg_sequence imx290_global_init_settings[] = { - static const struct cci_reg_sequence imx290_global_init_settings_290[] = { - { CCI_REG8(0x300f), 0x00 }, - { CCI_REG8(0x3010), 0x21 }, -+ { CCI_REG8(0x3011), 0x00 }, - { CCI_REG8(0x3016), 0x09 }, - { CCI_REG8(0x3070), 0x02 }, - { CCI_REG8(0x3071), 0x11 }, -@@ -330,6 +330,7 @@ static const struct cci_reg_sequence xclk_regs[][IMX290_NUM_CLK_REGS] = { - }; - - static const struct cci_reg_sequence imx290_global_init_settings_327[] = { -+ { CCI_REG8(0x3011), 0x02 }, - { CCI_REG8(0x309e), 0x4A }, - { CCI_REG8(0x309f), 0x4A }, - { CCI_REG8(0x313b), 0x61 }, -diff --git a/drivers/media/i2c/imx412.c b/drivers/media/i2c/imx412.c -index 8597f98a8dcf80..90fc8eea171f43 100644 ---- a/drivers/media/i2c/imx412.c -+++ b/drivers/media/i2c/imx412.c -@@ -549,7 +549,7 @@ static int imx412_update_exp_gain(struct imx412 *imx412, u32 exposure, u32 gain) - - lpfr = imx412->vblank + imx412->cur_mode->height; - -- dev_dbg(imx412->dev, "Set exp %u, analog gain %u, lpfr %u", -+ dev_dbg(imx412->dev, "Set exp %u, analog gain %u, lpfr %u\n", - exposure, gain, lpfr); - - ret = imx412_write_reg(imx412, IMX412_REG_HOLD, 1, 1); -@@ -596,7 +596,7 @@ static int imx412_set_ctrl(struct v4l2_ctrl *ctrl) - case V4L2_CID_VBLANK: - imx412->vblank = imx412->vblank_ctrl->val; - -- dev_dbg(imx412->dev, "Received vblank %u, new lpfr %u", -+ dev_dbg(imx412->dev, "Received vblank %u, new lpfr %u\n", - imx412->vblank, - imx412->vblank + imx412->cur_mode->height); - -@@ -615,7 +615,7 @@ static int imx412_set_ctrl(struct v4l2_ctrl *ctrl) - exposure = ctrl->val; - analog_gain = imx412->again_ctrl->val; - -- dev_dbg(imx412->dev, "Received exp %u, analog gain %u", -+ dev_dbg(imx412->dev, "Received exp %u, analog gain %u\n", - exposure, analog_gain); - - ret = imx412_update_exp_gain(imx412, exposure, analog_gain); -@@ -624,7 +624,7 @@ static int imx412_set_ctrl(struct v4l2_ctrl *ctrl) - - break; - default: -- dev_err(imx412->dev, "Invalid control %d", ctrl->id); -+ dev_err(imx412->dev, "Invalid control %d\n", ctrl->id); - ret = -EINVAL; - } - -@@ -805,14 +805,14 @@ static int imx412_start_streaming(struct imx412 *imx412) - ret = imx412_write_regs(imx412, reg_list->regs, - reg_list->num_of_regs); - if (ret) { -- dev_err(imx412->dev, "fail to write initial registers"); -+ dev_err(imx412->dev, "fail to write initial registers\n"); - return ret; - } - - /* Setup handler will write actual exposure and gain */ - ret = __v4l2_ctrl_handler_setup(imx412->sd.ctrl_handler); - if (ret) { -- dev_err(imx412->dev, "fail to setup handler"); -+ dev_err(imx412->dev, "fail to setup handler\n"); - return ret; - } - -@@ -823,7 +823,7 @@ static int imx412_start_streaming(struct imx412 *imx412) - ret = imx412_write_reg(imx412, IMX412_REG_MODE_SELECT, - 1, IMX412_MODE_STREAMING); - if (ret) { -- dev_err(imx412->dev, "fail to start streaming"); -+ dev_err(imx412->dev, "fail to start streaming\n"); - return ret; - } - -@@ -904,7 +904,7 @@ static int imx412_detect(struct imx412 *imx412) - return ret; - - if (val != IMX412_ID) { -- dev_err(imx412->dev, "chip id mismatch: %x!=%x", -+ dev_err(imx412->dev, "chip id mismatch: %x!=%x\n", - IMX412_ID, val); - return -ENXIO; - } -@@ -936,7 +936,7 @@ static int imx412_parse_hw_config(struct imx412 *imx412) - imx412->reset_gpio = devm_gpiod_get_optional(imx412->dev, "reset", - GPIOD_OUT_LOW); - if (IS_ERR(imx412->reset_gpio)) { -- dev_err(imx412->dev, "failed to get reset gpio %ld", -+ dev_err(imx412->dev, "failed to get reset gpio %ld\n", - PTR_ERR(imx412->reset_gpio)); - return PTR_ERR(imx412->reset_gpio); - } -@@ -944,13 +944,13 @@ static int imx412_parse_hw_config(struct imx412 *imx412) - /* Get sensor input clock */ - imx412->inclk = devm_clk_get(imx412->dev, NULL); - if (IS_ERR(imx412->inclk)) { -- dev_err(imx412->dev, "could not get inclk"); -+ dev_err(imx412->dev, "could not get inclk\n"); - return PTR_ERR(imx412->inclk); - } - - rate = clk_get_rate(imx412->inclk); - if (rate != IMX412_INCLK_RATE) { -- dev_err(imx412->dev, "inclk frequency mismatch"); -+ dev_err(imx412->dev, "inclk frequency mismatch\n"); - return -EINVAL; - } - -@@ -975,14 +975,14 @@ static int imx412_parse_hw_config(struct imx412 *imx412) - - if (bus_cfg.bus.mipi_csi2.num_data_lanes != IMX412_NUM_DATA_LANES) { - dev_err(imx412->dev, -- "number of CSI2 data lanes %d is not supported", -+ "number of CSI2 data lanes %d is not supported\n", - bus_cfg.bus.mipi_csi2.num_data_lanes); - ret = -EINVAL; - goto done_endpoint_free; - } - - if (!bus_cfg.nr_of_link_frequencies) { -- dev_err(imx412->dev, "no link frequencies defined"); -+ dev_err(imx412->dev, "no link frequencies defined\n"); - ret = -EINVAL; - goto done_endpoint_free; - } -@@ -1040,7 +1040,7 @@ static int imx412_power_on(struct device *dev) - - ret = clk_prepare_enable(imx412->inclk); - if (ret) { -- dev_err(imx412->dev, "fail to enable inclk"); -+ dev_err(imx412->dev, "fail to enable inclk\n"); - goto error_reset; - } - -@@ -1151,7 +1151,7 @@ static int imx412_init_controls(struct imx412 *imx412) - imx412->hblank_ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY; - - if (ctrl_hdlr->error) { -- dev_err(imx412->dev, "control init failed: %d", -+ dev_err(imx412->dev, "control init failed: %d\n", - ctrl_hdlr->error); - v4l2_ctrl_handler_free(ctrl_hdlr); - return ctrl_hdlr->error; -@@ -1188,7 +1188,7 @@ static int imx412_probe(struct i2c_client *client) - - ret = imx412_parse_hw_config(imx412); - if (ret) { -- dev_err(imx412->dev, "HW configuration is not supported"); -+ dev_err(imx412->dev, "HW configuration is not supported\n"); - return ret; - } - -@@ -1196,14 +1196,14 @@ static int imx412_probe(struct i2c_client *client) - - ret = imx412_power_on(imx412->dev); - if (ret) { -- dev_err(imx412->dev, "failed to power-on the sensor"); -+ dev_err(imx412->dev, "failed to power-on the sensor\n"); - goto error_mutex_destroy; - } - - /* Check module identity */ - ret = imx412_detect(imx412); - if (ret) { -- dev_err(imx412->dev, "failed to find sensor: %d", ret); -+ dev_err(imx412->dev, "failed to find sensor: %d\n", ret); - goto error_power_off; - } - -@@ -1213,7 +1213,7 @@ static int imx412_probe(struct i2c_client *client) - - ret = imx412_init_controls(imx412); - if (ret) { -- dev_err(imx412->dev, "failed to init controls: %d", ret); -+ dev_err(imx412->dev, "failed to init controls: %d\n", ret); - goto error_power_off; - } - -@@ -1227,14 +1227,14 @@ static int imx412_probe(struct i2c_client *client) - imx412->pad.flags = MEDIA_PAD_FL_SOURCE; - ret = media_entity_pads_init(&imx412->sd.entity, 1, &imx412->pad); - if (ret) { -- dev_err(imx412->dev, "failed to init entity pads: %d", ret); -+ dev_err(imx412->dev, "failed to init entity pads: %d\n", ret); - goto error_handler_free; - } - - ret = v4l2_async_register_subdev_sensor(&imx412->sd); - if (ret < 0) { - dev_err(imx412->dev, -- "failed to register async subdev: %d", ret); -+ "failed to register async subdev: %d\n", ret); - goto error_media_entity; - } - -diff --git a/drivers/media/i2c/ov9282.c b/drivers/media/i2c/ov9282.c -index 068c7449f50ed5..7498f55b3ef2b7 100644 ---- a/drivers/media/i2c/ov9282.c -+++ b/drivers/media/i2c/ov9282.c -@@ -40,7 +40,7 @@ - /* Exposure control */ - #define OV9282_REG_EXPOSURE 0x3500 - #define OV9282_EXPOSURE_MIN 1 --#define OV9282_EXPOSURE_OFFSET 12 -+#define OV9282_EXPOSURE_OFFSET 25 - #define OV9282_EXPOSURE_STEP 1 - #define OV9282_EXPOSURE_DEFAULT 0x0282 - -diff --git a/drivers/media/platform/marvell/mcam-core.c b/drivers/media/platform/marvell/mcam-core.c -index 66688b4aece5d8..555f560238c9a1 100644 ---- a/drivers/media/platform/marvell/mcam-core.c -+++ b/drivers/media/platform/marvell/mcam-core.c -@@ -935,7 +935,12 @@ static int mclk_enable(struct clk_hw *hw) - ret = pm_runtime_resume_and_get(cam->dev); - if (ret < 0) - return ret; -- clk_enable(cam->clk[0]); -+ ret = clk_enable(cam->clk[0]); -+ if (ret) { -+ pm_runtime_put(cam->dev); -+ return ret; -+ } -+ - mcam_reg_write(cam, REG_CLKCTRL, (mclk_src << 29) | mclk_div); - mcam_ctlr_power_up(cam); - -diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c -index e8dcd44f6e4692..092d83b7e79549 100644 ---- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c -+++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c -@@ -2674,11 +2674,12 @@ static void mxc_jpeg_detach_pm_domains(struct mxc_jpeg_dev *jpeg) - int i; - - for (i = 0; i < jpeg->num_domains; i++) { -- if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i])) -+ if (!IS_ERR_OR_NULL(jpeg->pd_dev[i]) && -+ !pm_runtime_suspended(jpeg->pd_dev[i])) - pm_runtime_force_suspend(jpeg->pd_dev[i]); -- if (jpeg->pd_link[i] && !IS_ERR(jpeg->pd_link[i])) -+ if (!IS_ERR_OR_NULL(jpeg->pd_link[i])) - device_link_del(jpeg->pd_link[i]); -- if (jpeg->pd_dev[i] && !IS_ERR(jpeg->pd_dev[i])) -+ if (!IS_ERR_OR_NULL(jpeg->pd_dev[i])) - dev_pm_domain_detach(jpeg->pd_dev[i], true); - jpeg->pd_dev[i] = NULL; - jpeg->pd_link[i] = NULL; -diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c -index 10840c9a0912b1..111be77eca1caf 100644 ---- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c -+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c -@@ -861,6 +861,7 @@ int mxc_isi_video_buffer_prepare(struct mxc_isi_dev *isi, struct vb2_buffer *vb2 - const struct mxc_isi_format_info *info, - const struct v4l2_pix_format_mplane *pix) - { -+ struct vb2_v4l2_buffer *v4l2_buf = to_vb2_v4l2_buffer(vb2); - unsigned int i; - - for (i = 0; i < info->mem_planes; i++) { -@@ -875,6 +876,8 @@ int mxc_isi_video_buffer_prepare(struct mxc_isi_dev *isi, struct vb2_buffer *vb2 - vb2_set_plane_payload(vb2, i, size); - } - -+ v4l2_buf->field = pix->field; -+ - return 0; - } - -diff --git a/drivers/media/platform/samsung/exynos4-is/mipi-csis.c b/drivers/media/platform/samsung/exynos4-is/mipi-csis.c -index 686ca8753ba22a..87c6fb88ab920f 100644 ---- a/drivers/media/platform/samsung/exynos4-is/mipi-csis.c -+++ b/drivers/media/platform/samsung/exynos4-is/mipi-csis.c -@@ -940,13 +940,19 @@ static int s5pcsis_pm_resume(struct device *dev, bool runtime) - state->supplies); - goto unlock; - } -- clk_enable(state->clock[CSIS_CLK_GATE]); -+ ret = clk_enable(state->clock[CSIS_CLK_GATE]); -+ if (ret) { -+ phy_power_off(state->phy); -+ regulator_bulk_disable(CSIS_NUM_SUPPLIES, -+ state->supplies); -+ goto unlock; -+ } - } - if (state->flags & ST_STREAMING) - s5pcsis_start_stream(state); - - state->flags &= ~ST_SUSPENDED; -- unlock: -+unlock: - mutex_unlock(&state->lock); - return ret ? -EAGAIN : 0; - } -diff --git a/drivers/media/platform/samsung/s3c-camif/camif-core.c b/drivers/media/platform/samsung/s3c-camif/camif-core.c -index e4529f666e2060..8c597dd01713a6 100644 ---- a/drivers/media/platform/samsung/s3c-camif/camif-core.c -+++ b/drivers/media/platform/samsung/s3c-camif/camif-core.c -@@ -527,10 +527,19 @@ static void s3c_camif_remove(struct platform_device *pdev) - static int s3c_camif_runtime_resume(struct device *dev) - { - struct camif_dev *camif = dev_get_drvdata(dev); -+ int ret; -+ -+ ret = clk_enable(camif->clock[CLK_GATE]); -+ if (ret) -+ return ret; - -- clk_enable(camif->clock[CLK_GATE]); - /* null op on s3c244x */ -- clk_enable(camif->clock[CLK_CAM]); -+ ret = clk_enable(camif->clock[CLK_CAM]); -+ if (ret) { -+ clk_disable(camif->clock[CLK_GATE]); -+ return ret; -+ } -+ - return 0; - } - -diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c -index 276bf3c8a8cb49..8af94246e5916e 100644 ---- a/drivers/media/rc/iguanair.c -+++ b/drivers/media/rc/iguanair.c -@@ -194,8 +194,10 @@ static int iguanair_send(struct iguanair *ir, unsigned size) - if (rc) - return rc; - -- if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0) -+ if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0) { -+ usb_kill_urb(ir->urb_out); - return -ETIMEDOUT; -+ } - - return rc; - } -diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c -index 4eb7dd4599b7e6..7caf5e90721a47 100644 ---- a/drivers/media/usb/dvb-usb-v2/af9035.c -+++ b/drivers/media/usb/dvb-usb-v2/af9035.c -@@ -322,13 +322,16 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, - ret = -EOPNOTSUPP; - } else if ((msg[0].addr == state->af9033_i2c_addr[0]) || - (msg[0].addr == state->af9033_i2c_addr[1])) { -+ /* demod access via firmware interface */ -+ u32 reg; -+ - if (msg[0].len < 3 || msg[1].len < 1) { - ret = -EOPNOTSUPP; - goto unlock; - } -- /* demod access via firmware interface */ -- u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 | -- msg[0].buf[2]; -+ -+ reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 | -+ msg[0].buf[2]; - - if (msg[0].addr == state->af9033_i2c_addr[1]) - reg |= 0x100000; -@@ -385,13 +388,16 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, - ret = -EOPNOTSUPP; - } else if ((msg[0].addr == state->af9033_i2c_addr[0]) || - (msg[0].addr == state->af9033_i2c_addr[1])) { -+ /* demod access via firmware interface */ -+ u32 reg; -+ - if (msg[0].len < 3) { - ret = -EOPNOTSUPP; - goto unlock; - } -- /* demod access via firmware interface */ -- u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 | -- msg[0].buf[2]; -+ -+ reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 | -+ msg[0].buf[2]; - - if (msg[0].addr == state->af9033_i2c_addr[1]) - reg |= 0x100000; -diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c -index 8a34e6c0d6a6d1..f0537b741d1352 100644 ---- a/drivers/media/usb/dvb-usb-v2/lmedm04.c -+++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c -@@ -373,6 +373,7 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap) - struct dvb_usb_device *d = adap_to_d(adap); - struct lme2510_state *lme_int = adap_to_priv(adap); - struct usb_host_endpoint *ep; -+ int ret; - - lme_int->lme_urb = usb_alloc_urb(0, GFP_KERNEL); - -@@ -390,11 +391,20 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap) - - /* Quirk of pipe reporting PIPE_BULK but behaves as interrupt */ - ep = usb_pipe_endpoint(d->udev, lme_int->lme_urb->pipe); -+ if (!ep) { -+ usb_free_urb(lme_int->lme_urb); -+ return -ENODEV; -+ } - - if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK) - lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa); - -- usb_submit_urb(lme_int->lme_urb, GFP_KERNEL); -+ ret = usb_submit_urb(lme_int->lme_urb, GFP_KERNEL); -+ if (ret) { -+ usb_free_urb(lme_int->lme_urb); -+ return ret; -+ } -+ - info("INT Interrupt Service Started"); - - return 0; -diff --git a/drivers/media/usb/uvc/uvc_queue.c b/drivers/media/usb/uvc/uvc_queue.c -index 16fa17bbd15eaa..83ed7821fa2a77 100644 ---- a/drivers/media/usb/uvc/uvc_queue.c -+++ b/drivers/media/usb/uvc/uvc_queue.c -@@ -483,7 +483,8 @@ static void uvc_queue_buffer_complete(struct kref *ref) - - buf->state = buf->error ? UVC_BUF_STATE_ERROR : UVC_BUF_STATE_DONE; - vb2_set_plane_payload(&buf->buf.vb2_buf, 0, buf->bytesused); -- vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_DONE); -+ vb2_buffer_done(&buf->buf.vb2_buf, buf->error ? VB2_BUF_STATE_ERROR : -+ VB2_BUF_STATE_DONE); - } - - /* -diff --git a/drivers/media/usb/uvc/uvc_status.c b/drivers/media/usb/uvc/uvc_status.c -index a78a88c710e24a..b5f6682ff38311 100644 ---- a/drivers/media/usb/uvc/uvc_status.c -+++ b/drivers/media/usb/uvc/uvc_status.c -@@ -269,6 +269,7 @@ int uvc_status_init(struct uvc_device *dev) - dev->int_urb = usb_alloc_urb(0, GFP_KERNEL); - if (!dev->int_urb) { - kfree(dev->status); -+ dev->status = NULL; - return -ENOMEM; - } - -diff --git a/drivers/memory/tegra/tegra20-emc.c b/drivers/memory/tegra/tegra20-emc.c -index fd595c851a2786..eb2813b51d770b 100644 ---- a/drivers/memory/tegra/tegra20-emc.c -+++ b/drivers/memory/tegra/tegra20-emc.c -@@ -477,14 +477,15 @@ tegra_emc_find_node_by_ram_code(struct tegra_emc *emc) - - ram_code = tegra_read_ram_code(); - -- for (np = of_find_node_by_name(dev->of_node, "emc-tables"); np; -- np = of_find_node_by_name(np, "emc-tables")) { -+ for_each_child_of_node(dev->of_node, np) { -+ if (!of_node_name_eq(np, "emc-tables")) -+ continue; - err = of_property_read_u32(np, "nvidia,ram-code", &value); - if (err || value != ram_code) { - struct device_node *lpddr2_np; - bool cfg_mismatches = false; - -- lpddr2_np = of_find_node_by_name(np, "lpddr2"); -+ lpddr2_np = of_get_child_by_name(np, "lpddr2"); - if (lpddr2_np) { - const struct lpddr2_info *info; - -@@ -521,7 +522,6 @@ tegra_emc_find_node_by_ram_code(struct tegra_emc *emc) - } - - if (cfg_mismatches) { -- of_node_put(np); - continue; - } - } -diff --git a/drivers/mfd/syscon.c b/drivers/mfd/syscon.c -index 7d0e91164cbaa3..729e79e1be49fa 100644 ---- a/drivers/mfd/syscon.c -+++ b/drivers/mfd/syscon.c -@@ -8,12 +8,14 @@ - * Author: Dong Aisheng - */ - -+#include - #include - #include - #include - #include - #include - #include -+#include - #include - #include - #include -@@ -26,7 +28,7 @@ - - static struct platform_driver syscon_driver; - --static DEFINE_SPINLOCK(syscon_list_slock); -+static DEFINE_MUTEX(syscon_list_lock); - static LIST_HEAD(syscon_list); - - struct syscon { -@@ -45,7 +47,6 @@ static const struct regmap_config syscon_regmap_config = { - static struct syscon *of_syscon_register(struct device_node *np, bool check_res) - { - struct clk *clk; -- struct syscon *syscon; - struct regmap *regmap; - void __iomem *base; - u32 reg_io_width; -@@ -54,20 +55,18 @@ static struct syscon *of_syscon_register(struct device_node *np, bool check_res) - struct resource res; - struct reset_control *reset; - -- syscon = kzalloc(sizeof(*syscon), GFP_KERNEL); -+ WARN_ON(!mutex_is_locked(&syscon_list_lock)); -+ -+ struct syscon *syscon __free(kfree) = kzalloc(sizeof(*syscon), GFP_KERNEL); - if (!syscon) - return ERR_PTR(-ENOMEM); - -- if (of_address_to_resource(np, 0, &res)) { -- ret = -ENOMEM; -- goto err_map; -- } -+ if (of_address_to_resource(np, 0, &res)) -+ return ERR_PTR(-ENOMEM); - - base = of_iomap(np, 0); -- if (!base) { -- ret = -ENOMEM; -- goto err_map; -- } -+ if (!base) -+ return ERR_PTR(-ENOMEM); - - /* Parse the device's DT node for an endianness specification */ - if (of_property_read_bool(np, "big-endian")) -@@ -148,11 +147,9 @@ static struct syscon *of_syscon_register(struct device_node *np, bool check_res) - syscon->regmap = regmap; - syscon->np = np; - -- spin_lock(&syscon_list_slock); - list_add_tail(&syscon->list, &syscon_list); -- spin_unlock(&syscon_list_slock); - -- return syscon; -+ return_ptr(syscon); - - err_reset: - reset_control_put(reset); -@@ -163,8 +160,6 @@ static struct syscon *of_syscon_register(struct device_node *np, bool check_res) - regmap_exit(regmap); - err_regmap: - iounmap(base); --err_map: -- kfree(syscon); - return ERR_PTR(ret); - } - -@@ -173,7 +168,7 @@ static struct regmap *device_node_get_regmap(struct device_node *np, - { - struct syscon *entry, *syscon = NULL; - -- spin_lock(&syscon_list_slock); -+ mutex_lock(&syscon_list_lock); - - list_for_each_entry(entry, &syscon_list, list) - if (entry->np == np) { -@@ -181,17 +176,65 @@ static struct regmap *device_node_get_regmap(struct device_node *np, - break; - } - -- spin_unlock(&syscon_list_slock); -- - if (!syscon) - syscon = of_syscon_register(np, check_res); - -+ mutex_unlock(&syscon_list_lock); -+ - if (IS_ERR(syscon)) - return ERR_CAST(syscon); - - return syscon->regmap; - } - -+/** -+ * of_syscon_register_regmap() - Register regmap for specified device node -+ * @np: Device tree node -+ * @regmap: Pointer to regmap object -+ * -+ * Register an externally created regmap object with syscon for the specified -+ * device tree node. This regmap will then be returned to client drivers using -+ * the syscon_regmap_lookup_by_phandle() API. -+ * -+ * Return: 0 on success, negative error code on failure. -+ */ -+int of_syscon_register_regmap(struct device_node *np, struct regmap *regmap) -+{ -+ struct syscon *entry, *syscon = NULL; -+ int ret; -+ -+ if (!np || !regmap) -+ return -EINVAL; -+ -+ syscon = kzalloc(sizeof(*syscon), GFP_KERNEL); -+ if (!syscon) -+ return -ENOMEM; -+ -+ /* check if syscon entry already exists */ -+ mutex_lock(&syscon_list_lock); -+ -+ list_for_each_entry(entry, &syscon_list, list) -+ if (entry->np == np) { -+ ret = -EEXIST; -+ goto err_unlock; -+ } -+ -+ syscon->regmap = regmap; -+ syscon->np = np; -+ -+ /* register the regmap in syscon list */ -+ list_add_tail(&syscon->list, &syscon_list); -+ mutex_unlock(&syscon_list_lock); -+ -+ return 0; -+ -+err_unlock: -+ mutex_unlock(&syscon_list_lock); -+ kfree(syscon); -+ return ret; -+} -+EXPORT_SYMBOL_GPL(of_syscon_register_regmap); -+ - struct regmap *device_node_to_regmap(struct device_node *np) - { - return device_node_get_regmap(np, false); -diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c -index b88eb70c17b353..936a9f6c16f0e4 100644 ---- a/drivers/mfd/ti_am335x_tscadc.c -+++ b/drivers/mfd/ti_am335x_tscadc.c -@@ -119,8 +119,6 @@ static int ti_tscadc_probe(struct platform_device *pdev) - struct clk *clk; - struct device_node *node; - struct mfd_cell *cell; -- struct property *prop; -- const __be32 *cur; - bool use_tsc = false, use_mag = false; - u32 val; - int err; -@@ -167,7 +165,7 @@ static int ti_tscadc_probe(struct platform_device *pdev) - } - - node = of_get_child_by_name(pdev->dev.of_node, "adc"); -- of_property_for_each_u32(node, "ti,adc-channels", prop, cur, val) { -+ of_property_for_each_u32(node, "ti,adc-channels", val) { - adc_channels++; - if (val > 7) { - dev_err(&pdev->dev, " PIN numbers are 0..7 (not %d)\n", -diff --git a/drivers/misc/cardreader/rtsx_usb.c b/drivers/misc/cardreader/rtsx_usb.c -index f150d8769f1986..285a748748d701 100644 ---- a/drivers/misc/cardreader/rtsx_usb.c -+++ b/drivers/misc/cardreader/rtsx_usb.c -@@ -286,6 +286,7 @@ static int rtsx_usb_get_status_with_bulk(struct rtsx_ucr *ucr, u16 *status) - int rtsx_usb_get_card_status(struct rtsx_ucr *ucr, u16 *status) - { - int ret; -+ u8 interrupt_val = 0; - u16 *buf; - - if (!status) -@@ -308,6 +309,20 @@ int rtsx_usb_get_card_status(struct rtsx_ucr *ucr, u16 *status) - ret = rtsx_usb_get_status_with_bulk(ucr, status); - } - -+ rtsx_usb_read_register(ucr, CARD_INT_PEND, &interrupt_val); -+ /* Cross check presence with interrupts */ -+ if (*status & XD_CD) -+ if (!(interrupt_val & XD_INT)) -+ *status &= ~XD_CD; -+ -+ if (*status & SD_CD) -+ if (!(interrupt_val & SD_INT)) -+ *status &= ~SD_CD; -+ -+ if (*status & MS_CD) -+ if (!(interrupt_val & MS_INT)) -+ *status &= ~MS_CD; -+ - /* usb_control_msg may return positive when success */ - if (ret < 0) - return ret; -diff --git a/drivers/mtd/hyperbus/hbmc-am654.c b/drivers/mtd/hyperbus/hbmc-am654.c -index a6161ce340d4eb..4b6cbee23fe893 100644 ---- a/drivers/mtd/hyperbus/hbmc-am654.c -+++ b/drivers/mtd/hyperbus/hbmc-am654.c -@@ -174,26 +174,30 @@ static int am654_hbmc_probe(struct platform_device *pdev) - priv->hbdev.np = of_get_next_child(np, NULL); - ret = of_address_to_resource(priv->hbdev.np, 0, &res); - if (ret) -- return ret; -+ goto put_node; - - if (of_property_read_bool(dev->of_node, "mux-controls")) { - struct mux_control *control = devm_mux_control_get(dev, NULL); - -- if (IS_ERR(control)) -- return PTR_ERR(control); -+ if (IS_ERR(control)) { -+ ret = PTR_ERR(control); -+ goto put_node; -+ } - - ret = mux_control_select(control, 1); - if (ret) { - dev_err(dev, "Failed to select HBMC mux\n"); -- return ret; -+ goto put_node; - } - priv->mux_ctrl = control; - } - - priv->hbdev.map.size = resource_size(&res); - priv->hbdev.map.virt = devm_ioremap_resource(dev, &res); -- if (IS_ERR(priv->hbdev.map.virt)) -- return PTR_ERR(priv->hbdev.map.virt); -+ if (IS_ERR(priv->hbdev.map.virt)) { -+ ret = PTR_ERR(priv->hbdev.map.virt); -+ goto disable_mux; -+ } - - priv->ctlr.dev = dev; - priv->ctlr.ops = &am654_hbmc_ops; -@@ -226,10 +230,12 @@ static int am654_hbmc_probe(struct platform_device *pdev) - disable_mux: - if (priv->mux_ctrl) - mux_control_deselect(priv->mux_ctrl); -+put_node: -+ of_node_put(priv->hbdev.np); - return ret; - } - --static int am654_hbmc_remove(struct platform_device *pdev) -+static void am654_hbmc_remove(struct platform_device *pdev) - { - struct am654_hbmc_priv *priv = platform_get_drvdata(pdev); - struct am654_hbmc_device_priv *dev_priv = priv->hbdev.priv; -@@ -241,8 +247,7 @@ static int am654_hbmc_remove(struct platform_device *pdev) - - if (dev_priv->rx_chan) - dma_release_channel(dev_priv->rx_chan); -- -- return 0; -+ of_node_put(priv->hbdev.np); - } - - static const struct of_device_id am654_hbmc_dt_ids[] = { -@@ -256,7 +261,7 @@ MODULE_DEVICE_TABLE(of, am654_hbmc_dt_ids); - - static struct platform_driver am654_hbmc_platform_driver = { - .probe = am654_hbmc_probe, -- .remove = am654_hbmc_remove, -+ .remove_new = am654_hbmc_remove, - .driver = { - .name = "hbmc-am654", - .of_match_table = am654_hbmc_dt_ids, -diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c -index 440bef477930c2..085a16148a68d4 100644 ---- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c -+++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c -@@ -2450,6 +2450,11 @@ static int brcmnand_write(struct mtd_info *mtd, struct nand_chip *chip, - brcmnand_send_cmd(host, CMD_PROGRAM_PAGE); - status = brcmnand_waitfunc(chip); - -+ if (status < 0) { -+ ret = status; -+ goto out; -+ } -+ - if (status & NAND_STATUS_FAIL) { - dev_info(ctrl->dev, "program failed at %llx\n", - (unsigned long long)addr); -diff --git a/drivers/net/ethernet/broadcom/bgmac.h b/drivers/net/ethernet/broadcom/bgmac.h -index d73ef262991d61..6fee9a41839c0b 100644 ---- a/drivers/net/ethernet/broadcom/bgmac.h -+++ b/drivers/net/ethernet/broadcom/bgmac.h -@@ -328,8 +328,7 @@ - #define BGMAC_RX_FRAME_OFFSET 30 /* There are 2 unused bytes between header and real data */ - #define BGMAC_RX_BUF_OFFSET (NET_SKB_PAD + NET_IP_ALIGN - \ - BGMAC_RX_FRAME_OFFSET) --/* Jumbo frame size with FCS */ --#define BGMAC_RX_MAX_FRAME_SIZE 9724 -+#define BGMAC_RX_MAX_FRAME_SIZE 1536 - #define BGMAC_RX_BUF_SIZE (BGMAC_RX_FRAME_OFFSET + BGMAC_RX_MAX_FRAME_SIZE) - #define BGMAC_RX_ALLOC_SIZE (SKB_DATA_ALIGN(BGMAC_RX_BUF_SIZE + BGMAC_RX_BUF_OFFSET) + \ - SKB_DATA_ALIGN(sizeof(struct skb_shared_info))) -diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c -index 05a89ab6766c41..bd38f2f57c8abc 100644 ---- a/drivers/net/ethernet/davicom/dm9000.c -+++ b/drivers/net/ethernet/davicom/dm9000.c -@@ -1778,10 +1778,11 @@ dm9000_drv_remove(struct platform_device *pdev) - - unregister_netdev(ndev); - dm9000_release_board(pdev, dm); -- free_netdev(ndev); /* free device structure */ - if (dm->power_supply) - regulator_disable(dm->power_supply); - -+ free_netdev(ndev); /* free device structure */ -+ - dev_dbg(&pdev->dev, "released and freed device\n"); - return 0; - } -diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c -index 8f5cc1f2331884..2d6b50903c923d 100644 ---- a/drivers/net/ethernet/freescale/fec_main.c -+++ b/drivers/net/ethernet/freescale/fec_main.c -@@ -821,6 +821,8 @@ static int fec_enet_txq_submit_tso(struct fec_enet_priv_tx_q *txq, - struct fec_enet_private *fep = netdev_priv(ndev); - int hdr_len, total_len, data_left; - struct bufdesc *bdp = txq->bd.cur; -+ struct bufdesc *tmp_bdp; -+ struct bufdesc_ex *ebdp; - struct tso_t tso; - unsigned int index = 0; - int ret; -@@ -894,7 +896,34 @@ static int fec_enet_txq_submit_tso(struct fec_enet_priv_tx_q *txq, - return 0; - - err_release: -- /* TODO: Release all used data descriptors for TSO */ -+ /* Release all used data descriptors for TSO */ -+ tmp_bdp = txq->bd.cur; -+ -+ while (tmp_bdp != bdp) { -+ /* Unmap data buffers */ -+ if (tmp_bdp->cbd_bufaddr && -+ !IS_TSO_HEADER(txq, fec32_to_cpu(tmp_bdp->cbd_bufaddr))) -+ dma_unmap_single(&fep->pdev->dev, -+ fec32_to_cpu(tmp_bdp->cbd_bufaddr), -+ fec16_to_cpu(tmp_bdp->cbd_datlen), -+ DMA_TO_DEVICE); -+ -+ /* Clear standard buffer descriptor fields */ -+ tmp_bdp->cbd_sc = 0; -+ tmp_bdp->cbd_datlen = 0; -+ tmp_bdp->cbd_bufaddr = 0; -+ -+ /* Handle extended descriptor if enabled */ -+ if (fep->bufdesc_ex) { -+ ebdp = (struct bufdesc_ex *)tmp_bdp; -+ ebdp->cbd_esc = 0; -+ } -+ -+ tmp_bdp = fec_enet_get_nextdesc(tmp_bdp, &txq->bd); -+ } -+ -+ dev_kfree_skb_any(skb); -+ - return ret; - } - -diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c -index 9a63fbc6940831..b25fb400f4767e 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c -@@ -40,6 +40,21 @@ EXPORT_SYMBOL(hnae3_unregister_ae_algo_prepare); - */ - static DEFINE_MUTEX(hnae3_common_lock); - -+/* ensure the drivers being unloaded one by one */ -+static DEFINE_MUTEX(hnae3_unload_lock); -+ -+void hnae3_acquire_unload_lock(void) -+{ -+ mutex_lock(&hnae3_unload_lock); -+} -+EXPORT_SYMBOL(hnae3_acquire_unload_lock); -+ -+void hnae3_release_unload_lock(void) -+{ -+ mutex_unlock(&hnae3_unload_lock); -+} -+EXPORT_SYMBOL(hnae3_release_unload_lock); -+ - static bool hnae3_client_match(enum hnae3_client_type client_type) - { - if (client_type == HNAE3_CLIENT_KNIC || -diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h -index 57787c380fa07f..7eb22b8ea3e707 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h -+++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h -@@ -946,4 +946,6 @@ int hnae3_register_client(struct hnae3_client *client); - void hnae3_set_client_init_flag(struct hnae3_client *client, - struct hnae3_ae_dev *ae_dev, - unsigned int inited); -+void hnae3_acquire_unload_lock(void); -+void hnae3_release_unload_lock(void); - #endif -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c -index 14d086b535a2dc..801801e8803e9f 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c -@@ -6008,9 +6008,11 @@ module_init(hns3_init_module); - */ - static void __exit hns3_exit_module(void) - { -+ hnae3_acquire_unload_lock(); - pci_unregister_driver(&hns3_driver); - hnae3_unregister_client(&client); - hns3_dbg_unregister_debugfs(); -+ hnae3_release_unload_lock(); - } - module_exit(hns3_exit_module); - -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -index 9650ce594e2fdd..4d318af748a0b7 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -@@ -12814,9 +12814,11 @@ static int __init hclge_init(void) - - static void __exit hclge_exit(void) - { -+ hnae3_acquire_unload_lock(); - hnae3_unregister_ae_algo_prepare(&ae_algo); - hnae3_unregister_ae_algo(&ae_algo); - destroy_workqueue(hclge_wq); -+ hnae3_release_unload_lock(); - } - module_init(hclge_init); - module_exit(hclge_exit); -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c -index affdd9d70549ac..69bfcfb148def4 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c -@@ -3345,8 +3345,10 @@ static int __init hclgevf_init(void) - - static void __exit hclgevf_exit(void) - { -+ hnae3_acquire_unload_lock(); - hnae3_unregister_ae_algo(&ae_algovf); - destroy_workqueue(hclgevf_wq); -+ hnae3_release_unload_lock(); - } - module_init(hclgevf_init); - module_exit(hclgevf_exit); -diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c -index ce0b9199952649..fde8d7b80ca662 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_main.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_main.c -@@ -801,6 +801,11 @@ iavf_vlan_filter *iavf_add_vlan(struct iavf_adapter *adapter, - f->state = IAVF_VLAN_ADD; - adapter->num_vlan_filters++; - iavf_schedule_aq_request(adapter, IAVF_FLAG_AQ_ADD_VLAN_FILTER); -+ } else if (f->state == IAVF_VLAN_REMOVE) { -+ /* IAVF_VLAN_REMOVE means that VLAN wasn't yet removed. -+ * We can safely only change the state here. -+ */ -+ f->state = IAVF_VLAN_ACTIVE; - } - - clearout: -@@ -821,8 +826,18 @@ static void iavf_del_vlan(struct iavf_adapter *adapter, struct iavf_vlan vlan) - - f = iavf_find_vlan(adapter, vlan); - if (f) { -- f->state = IAVF_VLAN_REMOVE; -- iavf_schedule_aq_request(adapter, IAVF_FLAG_AQ_DEL_VLAN_FILTER); -+ /* IAVF_ADD_VLAN means that VLAN wasn't even added yet. -+ * Remove it from the list. -+ */ -+ if (f->state == IAVF_VLAN_ADD) { -+ list_del(&f->list); -+ kfree(f); -+ adapter->num_vlan_filters--; -+ } else { -+ f->state = IAVF_VLAN_REMOVE; -+ iavf_schedule_aq_request(adapter, -+ IAVF_FLAG_AQ_DEL_VLAN_FILTER); -+ } - } - - spin_unlock_bh(&adapter->mac_vlan_list_lock); -diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c -index 2ee1374db4c06e..6f1fe7e283d4eb 100644 ---- a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c -+++ b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c -@@ -761,12 +761,6 @@ static void octep_get_stats64(struct net_device *netdev, - struct octep_device *oct = netdev_priv(netdev); - int q; - -- if (netif_running(netdev)) -- octep_ctrl_net_get_if_stats(oct, -- OCTEP_CTRL_NET_INVALID_VFID, -- &oct->iface_rx_stats, -- &oct->iface_tx_stats); -- - tx_packets = 0; - tx_bytes = 0; - rx_packets = 0; -@@ -784,10 +778,6 @@ static void octep_get_stats64(struct net_device *netdev, - stats->tx_bytes = tx_bytes; - stats->rx_packets = rx_packets; - stats->rx_bytes = rx_bytes; -- stats->multicast = oct->iface_rx_stats.mcast_pkts; -- stats->rx_errors = oct->iface_rx_stats.err_pkts; -- stats->collisions = oct->iface_tx_stats.xscol; -- stats->tx_fifo_errors = oct->iface_tx_stats.undflw; - } - - /** -diff --git a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c -index 46245e0b24623d..43c84900369a36 100644 ---- a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c -+++ b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c -@@ -14,7 +14,6 @@ - #define MLXFW_FSM_STATE_WAIT_TIMEOUT_MS 30000 - #define MLXFW_FSM_STATE_WAIT_ROUNDS \ - (MLXFW_FSM_STATE_WAIT_TIMEOUT_MS / MLXFW_FSM_STATE_WAIT_CYCLE_MS) --#define MLXFW_FSM_MAX_COMPONENT_SIZE (10 * (1 << 20)) - - static const int mlxfw_fsm_state_errno[] = { - [MLXFW_FSM_STATE_ERR_ERROR] = -EIO, -@@ -229,7 +228,6 @@ static int mlxfw_flash_component(struct mlxfw_dev *mlxfw_dev, - return err; - } - -- comp_max_size = min_t(u32, comp_max_size, MLXFW_FSM_MAX_COMPONENT_SIZE); - if (comp->data_size > comp_max_size) { - MLXFW_ERR_MSG(mlxfw_dev, extack, - "Component size is bigger than limit", -EINVAL); -diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c -index 69cd689dbc83e9..5afe6b155ef0d5 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c -@@ -1003,10 +1003,10 @@ static void mlxsw_sp_mr_route_stats_update(struct mlxsw_sp *mlxsw_sp, - mr->mr_ops->route_stats(mlxsw_sp, mr_route->route_priv, &packets, - &bytes); - -- if (mr_route->mfc->mfc_un.res.pkt != packets) -- mr_route->mfc->mfc_un.res.lastuse = jiffies; -- mr_route->mfc->mfc_un.res.pkt = packets; -- mr_route->mfc->mfc_un.res.bytes = bytes; -+ if (atomic_long_read(&mr_route->mfc->mfc_un.res.pkt) != packets) -+ WRITE_ONCE(mr_route->mfc->mfc_un.res.lastuse, jiffies); -+ atomic_long_set(&mr_route->mfc->mfc_un.res.pkt, packets); -+ atomic_long_set(&mr_route->mfc->mfc_un.res.bytes, bytes); - } - - static void mlxsw_sp_mr_stats_update(struct work_struct *work) -diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c -index 274ea16c0a1f71..0c0fd68ded423d 100644 ---- a/drivers/net/ethernet/renesas/sh_eth.c -+++ b/drivers/net/ethernet/renesas/sh_eth.c -@@ -3496,10 +3496,12 @@ static int sh_eth_suspend(struct device *dev) - - netif_device_detach(ndev); - -+ rtnl_lock(); - if (mdp->wol_enabled) - ret = sh_eth_wol_setup(ndev); - else - ret = sh_eth_close(ndev); -+ rtnl_unlock(); - - return ret; - } -@@ -3513,10 +3515,12 @@ static int sh_eth_resume(struct device *dev) - if (!netif_running(ndev)) - return 0; - -+ rtnl_lock(); - if (mdp->wol_enabled) - ret = sh_eth_wol_restore(ndev); - else - ret = sh_eth_open(ndev); -+ rtnl_unlock(); - - if (ret < 0) - return ret; -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index d6ee90fef2eca4..d3d5c01f6dcbaa 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -7103,6 +7103,36 @@ static int stmmac_hw_init(struct stmmac_priv *priv) - if (priv->dma_cap.tsoen) - dev_info(priv->device, "TSO supported\n"); - -+ if (priv->dma_cap.number_rx_queues && -+ priv->plat->rx_queues_to_use > priv->dma_cap.number_rx_queues) { -+ dev_warn(priv->device, -+ "Number of Rx queues (%u) exceeds dma capability\n", -+ priv->plat->rx_queues_to_use); -+ priv->plat->rx_queues_to_use = priv->dma_cap.number_rx_queues; -+ } -+ if (priv->dma_cap.number_tx_queues && -+ priv->plat->tx_queues_to_use > priv->dma_cap.number_tx_queues) { -+ dev_warn(priv->device, -+ "Number of Tx queues (%u) exceeds dma capability\n", -+ priv->plat->tx_queues_to_use); -+ priv->plat->tx_queues_to_use = priv->dma_cap.number_tx_queues; -+ } -+ -+ if (priv->dma_cap.rx_fifo_size && -+ priv->plat->rx_fifo_size > priv->dma_cap.rx_fifo_size) { -+ dev_warn(priv->device, -+ "Rx FIFO size (%u) exceeds dma capability\n", -+ priv->plat->rx_fifo_size); -+ priv->plat->rx_fifo_size = priv->dma_cap.rx_fifo_size; -+ } -+ if (priv->dma_cap.tx_fifo_size && -+ priv->plat->tx_fifo_size > priv->dma_cap.tx_fifo_size) { -+ dev_warn(priv->device, -+ "Tx FIFO size (%u) exceeds dma capability\n", -+ priv->plat->tx_fifo_size); -+ priv->plat->tx_fifo_size = priv->dma_cap.tx_fifo_size; -+ } -+ - priv->hw->vlan_fail_q_en = - (priv->plat->flags & STMMAC_FLAG_VLAN_FAIL_Q_EN); - priv->hw->vlan_fail_q = priv->plat->vlan_fail_q; -diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c -index d556e705ec000d..8ffc1fbb036f9f 100644 ---- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c -+++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c -@@ -1651,7 +1651,7 @@ void am65_cpsw_nuss_remove_tx_chns(struct am65_cpsw_common *common) - for (i = 0; i < common->tx_ch_num; i++) { - struct am65_cpsw_tx_chn *tx_chn = &common->tx_chns[i]; - -- if (tx_chn->irq) -+ if (tx_chn->irq > 0) - devm_free_irq(dev, tx_chn->irq, tx_chn); - - netif_napi_del(&tx_chn->napi_tx); -diff --git a/drivers/net/netdevsim/netdevsim.h b/drivers/net/netdevsim/netdevsim.h -index 028c825b86db1e..dfc6e00b718e31 100644 ---- a/drivers/net/netdevsim/netdevsim.h -+++ b/drivers/net/netdevsim/netdevsim.h -@@ -121,6 +121,7 @@ struct netdevsim { - u32 sleep; - u32 __ports[2][NSIM_UDP_TUNNEL_N_PORTS]; - u32 (*ports)[NSIM_UDP_TUNNEL_N_PORTS]; -+ struct dentry *ddir; - struct debugfs_u32_array dfs_ports[2]; - } udp_ports; - -diff --git a/drivers/net/netdevsim/udp_tunnels.c b/drivers/net/netdevsim/udp_tunnels.c -index 02dc3123eb6c16..640b4983a9a0d1 100644 ---- a/drivers/net/netdevsim/udp_tunnels.c -+++ b/drivers/net/netdevsim/udp_tunnels.c -@@ -112,9 +112,11 @@ nsim_udp_tunnels_info_reset_write(struct file *file, const char __user *data, - struct net_device *dev = file->private_data; - struct netdevsim *ns = netdev_priv(dev); - -- memset(ns->udp_ports.ports, 0, sizeof(ns->udp_ports.__ports)); - rtnl_lock(); -- udp_tunnel_nic_reset_ntf(dev); -+ if (dev->reg_state == NETREG_REGISTERED) { -+ memset(ns->udp_ports.ports, 0, sizeof(ns->udp_ports.__ports)); -+ udp_tunnel_nic_reset_ntf(dev); -+ } - rtnl_unlock(); - - return count; -@@ -144,23 +146,23 @@ int nsim_udp_tunnels_info_create(struct nsim_dev *nsim_dev, - else - ns->udp_ports.ports = nsim_dev->udp_ports.__ports; - -- debugfs_create_u32("udp_ports_inject_error", 0600, -- ns->nsim_dev_port->ddir, -+ ns->udp_ports.ddir = debugfs_create_dir("udp_ports", -+ ns->nsim_dev_port->ddir); -+ -+ debugfs_create_u32("inject_error", 0600, ns->udp_ports.ddir, - &ns->udp_ports.inject_error); - - ns->udp_ports.dfs_ports[0].array = ns->udp_ports.ports[0]; - ns->udp_ports.dfs_ports[0].n_elements = NSIM_UDP_TUNNEL_N_PORTS; -- debugfs_create_u32_array("udp_ports_table0", 0400, -- ns->nsim_dev_port->ddir, -+ debugfs_create_u32_array("table0", 0400, ns->udp_ports.ddir, - &ns->udp_ports.dfs_ports[0]); - - ns->udp_ports.dfs_ports[1].array = ns->udp_ports.ports[1]; - ns->udp_ports.dfs_ports[1].n_elements = NSIM_UDP_TUNNEL_N_PORTS; -- debugfs_create_u32_array("udp_ports_table1", 0400, -- ns->nsim_dev_port->ddir, -+ debugfs_create_u32_array("table1", 0400, ns->udp_ports.ddir, - &ns->udp_ports.dfs_ports[1]); - -- debugfs_create_file("udp_ports_reset", 0200, ns->nsim_dev_port->ddir, -+ debugfs_create_file("reset", 0200, ns->udp_ports.ddir, - dev, &nsim_udp_tunnels_info_reset_fops); - - /* Note: it's not normal to allocate the info struct like this! -@@ -196,6 +198,9 @@ int nsim_udp_tunnels_info_create(struct nsim_dev *nsim_dev, - - void nsim_udp_tunnels_info_destroy(struct net_device *dev) - { -+ struct netdevsim *ns = netdev_priv(dev); -+ -+ debugfs_remove_recursive(ns->udp_ports.ddir); - kfree(dev->udp_tunnel_nic_info); - dev->udp_tunnel_nic_info = NULL; - } -diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c -index ae257fa43d87a3..46a7c9fb6300e3 100644 ---- a/drivers/net/team/team.c -+++ b/drivers/net/team/team.c -@@ -1169,6 +1169,13 @@ static int team_port_add(struct team *team, struct net_device *port_dev, - return -EBUSY; - } - -+ if (netdev_has_upper_dev(port_dev, dev)) { -+ NL_SET_ERR_MSG(extack, "Device is already a lower device of the team interface"); -+ netdev_err(dev, "Device %s is already a lower device of the team interface\n", -+ portname); -+ return -EBUSY; -+ } -+ - if (port_dev->features & NETIF_F_VLAN_CHALLENGED && - vlan_uses_dev(dev)) { - NL_SET_ERR_MSG(extack, "Device is VLAN challenged and team device has VLAN set up"); -diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c -index 01a3b2417a5401..ddff6f19ff98eb 100644 ---- a/drivers/net/usb/rtl8150.c -+++ b/drivers/net/usb/rtl8150.c -@@ -71,6 +71,14 @@ - #define MSR_SPEED (1<<3) - #define MSR_LINK (1<<2) - -+/* USB endpoints */ -+enum rtl8150_usb_ep { -+ RTL8150_USB_EP_CONTROL = 0, -+ RTL8150_USB_EP_BULK_IN = 1, -+ RTL8150_USB_EP_BULK_OUT = 2, -+ RTL8150_USB_EP_INT_IN = 3, -+}; -+ - /* Interrupt pipe data */ - #define INT_TSR 0x00 - #define INT_RSR 0x01 -@@ -867,6 +875,13 @@ static int rtl8150_probe(struct usb_interface *intf, - struct usb_device *udev = interface_to_usbdev(intf); - rtl8150_t *dev; - struct net_device *netdev; -+ static const u8 bulk_ep_addr[] = { -+ RTL8150_USB_EP_BULK_IN | USB_DIR_IN, -+ RTL8150_USB_EP_BULK_OUT | USB_DIR_OUT, -+ 0}; -+ static const u8 int_ep_addr[] = { -+ RTL8150_USB_EP_INT_IN | USB_DIR_IN, -+ 0}; - - netdev = alloc_etherdev(sizeof(rtl8150_t)); - if (!netdev) -@@ -880,6 +895,13 @@ static int rtl8150_probe(struct usb_interface *intf, - return -ENOMEM; - } - -+ /* Verify that all required endpoints are present */ -+ if (!usb_check_bulk_endpoints(intf, bulk_ep_addr) || -+ !usb_check_int_endpoints(intf, int_ep_addr)) { -+ dev_err(&intf->dev, "couldn't find required endpoints\n"); -+ goto out; -+ } -+ - tasklet_setup(&dev->tl, rx_fixup); - spin_lock_init(&dev->rx_pool_lock); - -diff --git a/drivers/net/vxlan/vxlan_vnifilter.c b/drivers/net/vxlan/vxlan_vnifilter.c -index d2023e7131bd4f..6e6e9f05509ab0 100644 ---- a/drivers/net/vxlan/vxlan_vnifilter.c -+++ b/drivers/net/vxlan/vxlan_vnifilter.c -@@ -411,6 +411,11 @@ static int vxlan_vnifilter_dump(struct sk_buff *skb, struct netlink_callback *cb - struct tunnel_msg *tmsg; - struct net_device *dev; - -+ if (cb->nlh->nlmsg_len < nlmsg_msg_size(sizeof(struct tunnel_msg))) { -+ NL_SET_ERR_MSG(cb->extack, "Invalid msg length"); -+ return -EINVAL; -+ } -+ - tmsg = nlmsg_data(cb->nlh); - - if (tmsg->flags & ~TUNNEL_MSG_VALID_USER_FLAGS) { -diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c -index fb426195a3f016..4c70366ac56eb0 100644 ---- a/drivers/net/wireless/ath/ath11k/dp_rx.c -+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c -@@ -3811,6 +3811,7 @@ int ath11k_dp_process_rx_err(struct ath11k_base *ab, struct napi_struct *napi, - ath11k_hal_rx_msdu_link_info_get(link_desc_va, &num_msdus, msdu_cookies, - &rbm); - if (rbm != HAL_RX_BUF_RBM_WBM_IDLE_DESC_LIST && -+ rbm != HAL_RX_BUF_RBM_SW1_BM && - rbm != HAL_RX_BUF_RBM_SW3_BM) { - ab->soc_stats.invalid_rbm++; - ath11k_warn(ab, "invalid return buffer manager %d\n", rbm); -diff --git a/drivers/net/wireless/ath/ath11k/hal_rx.c b/drivers/net/wireless/ath/ath11k/hal_rx.c -index 363adac84a8700..2bc95026335e31 100644 ---- a/drivers/net/wireless/ath/ath11k/hal_rx.c -+++ b/drivers/net/wireless/ath/ath11k/hal_rx.c -@@ -372,7 +372,8 @@ int ath11k_hal_wbm_desc_parse_err(struct ath11k_base *ab, void *desc, - - ret_buf_mgr = FIELD_GET(BUFFER_ADDR_INFO1_RET_BUF_MGR, - wbm_desc->buf_addr_info.info1); -- if (ret_buf_mgr != HAL_RX_BUF_RBM_SW3_BM) { -+ if (ret_buf_mgr != HAL_RX_BUF_RBM_SW1_BM && -+ ret_buf_mgr != HAL_RX_BUF_RBM_SW3_BM) { - ab->soc_stats.invalid_rbm++; - return -EINVAL; - } -diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c -index 713899735ccc5e..e1db6e69d22076 100644 ---- a/drivers/net/wireless/ath/ath12k/mac.c -+++ b/drivers/net/wireless/ath/ath12k/mac.c -@@ -5823,9 +5823,9 @@ ath12k_mac_vdev_start_restart(struct ath12k_vif *arvif, - arg.mode = ath12k_phymodes[chandef->chan->band][chandef->width]; - - arg.min_power = 0; -- arg.max_power = chandef->chan->max_power * 2; -- arg.max_reg_power = chandef->chan->max_reg_power * 2; -- arg.max_antenna_gain = chandef->chan->max_antenna_gain * 2; -+ arg.max_power = chandef->chan->max_power; -+ arg.max_reg_power = chandef->chan->max_reg_power; -+ arg.max_antenna_gain = chandef->chan->max_antenna_gain; - - arg.pref_tx_streams = ar->num_tx_chains; - arg.pref_rx_streams = ar->num_rx_chains; -diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c -index 2bd1163177f08f..9bbbc86fd2d93d 100644 ---- a/drivers/net/wireless/ath/wcn36xx/main.c -+++ b/drivers/net/wireless/ath/wcn36xx/main.c -@@ -1586,7 +1586,10 @@ static int wcn36xx_probe(struct platform_device *pdev) - } - - n_channels = wcn_band_2ghz.n_channels + wcn_band_5ghz.n_channels; -- wcn->chan_survey = devm_kmalloc(wcn->dev, n_channels, GFP_KERNEL); -+ wcn->chan_survey = devm_kcalloc(wcn->dev, -+ n_channels, -+ sizeof(struct wcn36xx_chan_survey), -+ GFP_KERNEL); - if (!wcn->chan_survey) { - ret = -ENOMEM; - goto out_wq; -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h -index 31e080e4da6697..ab3d6cfcb02bde 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h -@@ -6,6 +6,8 @@ - #ifndef _fwil_h_ - #define _fwil_h_ - -+#include "debug.h" -+ - /******************************************************************************* - * Dongle command codes that are interpreted by firmware - ******************************************************************************/ -diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/init.c b/drivers/net/wireless/mediatek/mt76/mt7615/init.c -index f22a1aa8850521..129350186d5d5e 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7615/init.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7615/init.c -@@ -325,7 +325,7 @@ void mt7615_init_work(struct mt7615_dev *dev) - mt7615_mcu_set_eeprom(dev); - mt7615_mac_init(dev); - mt7615_phy_init(dev); -- mt7615_mcu_del_wtbl_all(dev); -+ mt76_connac_mcu_del_wtbl_all(&dev->mt76); - mt7615_check_offload_capability(dev); - } - EXPORT_SYMBOL_GPL(mt7615_init_work); -diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c -index 955974a82180fd..e92040616a1f35 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c -@@ -1876,16 +1876,6 @@ int mt7615_mcu_set_dbdc(struct mt7615_dev *dev) - sizeof(req), true); - } - --int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev) --{ -- struct wtbl_req_hdr req = { -- .operation = WTBL_RESET_ALL, -- }; -- -- return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(WTBL_UPDATE), -- &req, sizeof(req), true); --} -- - int mt7615_mcu_set_fcc5_lpn(struct mt7615_dev *dev, int val) - { - struct { -diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h b/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h -index a20322aae96725..fa83b255e180c3 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h -+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h -@@ -399,7 +399,6 @@ void mt7615_mac_set_rates(struct mt7615_phy *phy, struct mt7615_sta *sta, - struct ieee80211_tx_rate *rates); - void mt7615_pm_wake_work(struct work_struct *work); - void mt7615_pm_power_save_work(struct work_struct *work); --int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev); - int mt7615_mcu_set_chan_info(struct mt7615_phy *phy, int cmd); - int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue, - const struct ieee80211_tx_queue_params *params); -diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c -index 998cfd73764a9c..7420d91bef0de7 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c -+++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c -@@ -2926,6 +2926,17 @@ int mt76_connac_mcu_restart(struct mt76_dev *dev) - } - EXPORT_SYMBOL_GPL(mt76_connac_mcu_restart); - -+int mt76_connac_mcu_del_wtbl_all(struct mt76_dev *dev) -+{ -+ struct wtbl_req_hdr req = { -+ .operation = WTBL_RESET_ALL, -+ }; -+ -+ return mt76_mcu_send_msg(dev, MCU_EXT_CMD(WTBL_UPDATE), -+ &req, sizeof(req), true); -+} -+EXPORT_SYMBOL_GPL(mt76_connac_mcu_del_wtbl_all); -+ - int mt76_connac_mcu_rdd_cmd(struct mt76_dev *dev, int cmd, u8 index, - u8 rx_sel, u8 val) - { -diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h -index 4543e5bf0482d2..27391ee3564a11 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h -+++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h -@@ -1914,6 +1914,7 @@ void mt76_connac_mcu_wtbl_smps_tlv(struct sk_buff *skb, - void *sta_wtbl, void *wtbl_tlv); - int mt76_connac_mcu_set_pm(struct mt76_dev *dev, int band, int enter); - int mt76_connac_mcu_restart(struct mt76_dev *dev); -+int mt76_connac_mcu_del_wtbl_all(struct mt76_dev *dev); - int mt76_connac_mcu_rdd_cmd(struct mt76_dev *dev, int cmd, u8 index, - u8 rx_sel, u8 val); - int mt76_connac_mcu_sta_wed_update(struct mt76_dev *dev, struct sk_buff *skb); -diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c -index 5ff260319282c6..28f84220d50f02 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c -@@ -82,7 +82,7 @@ static ssize_t mt7915_thermal_temp_store(struct device *dev, - return ret; - - mutex_lock(&phy->dev->mt76.mutex); -- val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 60, 130); -+ val = DIV_ROUND_CLOSEST(clamp_val(val, 60 * 1000, 130 * 1000), 1000); - - if ((i - 1 == MT7915_CRIT_TEMP_IDX && - val > phy->throttle_temp[MT7915_MAX_TEMP_IDX]) || -diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c -index 38d27f87217336..92d7dc8e3cc55e 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c -@@ -1383,6 +1383,8 @@ mt7915_mac_restart(struct mt7915_dev *dev) - if (dev_is_pci(mdev->dev)) { - mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0xff); - if (dev->hif2) { -+ mt76_wr(dev, MT_PCIE_RECOG_ID, -+ dev->hif2->index | MT_PCIE_RECOG_ID_SEM); - if (is_mt7915(mdev)) - mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0xff); - else -@@ -1437,9 +1439,11 @@ static void - mt7915_mac_full_reset(struct mt7915_dev *dev) - { - struct mt76_phy *ext_phy; -+ struct mt7915_phy *phy2; - int i; - - ext_phy = dev->mt76.phys[MT_BAND1]; -+ phy2 = ext_phy ? ext_phy->priv : NULL; - - dev->recovery.hw_full_reset = true; - -@@ -1457,26 +1461,30 @@ mt7915_mac_full_reset(struct mt7915_dev *dev) - if (!mt7915_mac_restart(dev)) - break; - } -- mutex_unlock(&dev->mt76.mutex); - - if (i == 10) - dev_err(dev->mt76.dev, "chip full reset failed\n"); - -- ieee80211_restart_hw(mt76_hw(dev)); -- if (ext_phy) -- ieee80211_restart_hw(ext_phy->hw); -+ spin_lock_bh(&dev->mt76.sta_poll_lock); -+ while (!list_empty(&dev->mt76.sta_poll_list)) -+ list_del_init(dev->mt76.sta_poll_list.next); -+ spin_unlock_bh(&dev->mt76.sta_poll_lock); - -- ieee80211_wake_queues(mt76_hw(dev)); -- if (ext_phy) -- ieee80211_wake_queues(ext_phy->hw); -+ memset(dev->mt76.wcid_mask, 0, sizeof(dev->mt76.wcid_mask)); -+ dev->mt76.vif_mask = 0; -+ dev->phy.omac_mask = 0; -+ if (phy2) -+ phy2->omac_mask = 0; - -+ i = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA); -+ dev->mt76.global_wcid.idx = i; - dev->recovery.hw_full_reset = false; -- ieee80211_queue_delayed_work(mt76_hw(dev), &dev->mphy.mac_work, -- MT7915_WATCHDOG_TIME); -+ -+ mutex_unlock(&dev->mt76.mutex); -+ -+ ieee80211_restart_hw(mt76_hw(dev)); - if (ext_phy) -- ieee80211_queue_delayed_work(ext_phy->hw, -- &ext_phy->mac_work, -- MT7915_WATCHDOG_TIME); -+ ieee80211_restart_hw(ext_phy->hw); - } - - /* system error recovery */ -diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c -index 4fd5fd555191a4..c312a0fa199aee 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c -@@ -614,8 +614,9 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw, - if (changed & BSS_CHANGED_ASSOC) - set_bss_info = vif->cfg.assoc; - if (changed & BSS_CHANGED_BEACON_ENABLED && -+ info->enable_beacon && - vif->type != NL80211_IFTYPE_AP) -- set_bss_info = set_sta = info->enable_beacon; -+ set_bss_info = set_sta = 1; - - if (set_bss_info == 1) - mt7915_mcu_add_bss_info(phy, vif, true); -@@ -1649,6 +1650,17 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw, - } - #endif - -+static void -+mt7915_reconfig_complete(struct ieee80211_hw *hw, -+ enum ieee80211_reconfig_type reconfig_type) -+{ -+ struct mt7915_phy *phy = mt7915_hw_phy(hw); -+ -+ ieee80211_wake_queues(hw); -+ ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work, -+ MT7915_WATCHDOG_TIME); -+} -+ - const struct ieee80211_ops mt7915_ops = { - .tx = mt7915_tx, - .start = mt7915_start, -@@ -1703,4 +1715,5 @@ const struct ieee80211_ops mt7915_ops = { - #ifdef CONFIG_NET_MEDIATEK_SOC_WED - .net_fill_forward_path = mt7915_net_fill_forward_path, - #endif -+ .reconfig_complete = mt7915_reconfig_complete, - }; -diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c -index 5fba103bfd65d5..f0226db2e57c7a 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c -@@ -2351,6 +2351,8 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev) - if (ret) - return ret; - -+ mt76_connac_mcu_del_wtbl_all(&dev->mt76); -+ - if ((mtk_wed_device_active(&dev->mt76.mmio.wed) && - is_mt7915(&dev->mt76)) || - !mtk_wed_get_rx_capa(&dev->mt76.mmio.wed)) -diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c -index a306a42777d789..7db436d908a39b 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c -@@ -484,7 +484,7 @@ static u32 __mt7915_reg_addr(struct mt7915_dev *dev, u32 addr) - continue; - - ofs = addr - dev->reg.map[i].phys; -- if (ofs > dev->reg.map[i].size) -+ if (ofs >= dev->reg.map[i].size) - continue; - - return dev->reg.map[i].maps + ofs; -diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h -index e192211d4b23ee..14d4bbeae9d63f 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h -+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h -@@ -191,6 +191,7 @@ struct mt7915_hif { - struct device *dev; - void __iomem *regs; - int irq; -+ u32 index; - }; - - struct mt7915_phy { -diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/pci.c b/drivers/net/wireless/mediatek/mt76/mt7915/pci.c -index 39132894e8ea29..07b0a5766eab7d 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7915/pci.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7915/pci.c -@@ -42,6 +42,7 @@ static struct mt7915_hif *mt7915_pci_get_hif2(u32 idx) - continue; - - get_device(hif->dev); -+ hif->index = idx; - goto out; - } - hif = NULL; -diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c -index 6dec54431312ad..31ef58e2a3d2a3 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c -@@ -519,7 +519,13 @@ static int mt7921_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, - } else { - if (idx == *wcid_keyidx) - *wcid_keyidx = -1; -- goto out; -+ -+ /* For security issue we don't trigger the key deletion when -+ * reassociating. But we should trigger the deletion process -+ * to avoid using incorrect cipher after disconnection, -+ */ -+ if (vif->type != NL80211_IFTYPE_STATION || vif->cfg.assoc) -+ goto out; - } - - mt76_wcid_key_setup(&dev->mt76, wcid, key); -diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c -index aee531cab46f64..0a701dcb8a92c5 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c -@@ -619,6 +619,9 @@ mt7996_init_he_caps(struct mt7996_phy *phy, enum nl80211_band band, - he_cap_elem->phy_cap_info[2] = IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ | - IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ; - -+ he_cap_elem->phy_cap_info[7] = -+ IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI; -+ - switch (iftype) { - case NL80211_IFTYPE_AP: - he_cap_elem->mac_cap_info[0] |= IEEE80211_HE_MAC_CAP0_TWT_RES; -@@ -658,8 +661,7 @@ mt7996_init_he_caps(struct mt7996_phy *phy, enum nl80211_band band, - IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE | - IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT; - he_cap_elem->phy_cap_info[7] |= -- IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP | -- IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI; -+ IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP; - he_cap_elem->phy_cap_info[8] |= - IEEE80211_HE_PHY_CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G | - IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU | -@@ -729,7 +731,9 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band, - - eht_cap_elem->mac_cap_info[0] = - IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS | -- IEEE80211_EHT_MAC_CAP0_OM_CONTROL; -+ IEEE80211_EHT_MAC_CAP0_OM_CONTROL | -+ u8_encode_bits(IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_11454, -+ IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK); - - eht_cap_elem->phy_cap_info[0] = - IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI | -@@ -771,21 +775,20 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band, - IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK; - - eht_cap_elem->phy_cap_info[4] = -+ IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI | - u8_encode_bits(min_t(int, sts - 1, 2), - IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK); - - eht_cap_elem->phy_cap_info[5] = - u8_encode_bits(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US, - IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK) | -- u8_encode_bits(u8_get_bits(0x11, GENMASK(1, 0)), -+ u8_encode_bits(u8_get_bits(1, GENMASK(1, 0)), - IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK); - - val = width == NL80211_CHAN_WIDTH_320 ? 0xf : - width == NL80211_CHAN_WIDTH_160 ? 0x7 : - width == NL80211_CHAN_WIDTH_80 ? 0x3 : 0x1; - eht_cap_elem->phy_cap_info[6] = -- u8_encode_bits(u8_get_bits(0x11, GENMASK(4, 2)), -- IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK) | - u8_encode_bits(val, IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK); - - val = u8_encode_bits(nss, IEEE80211_EHT_MCS_NSS_RX) | -diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c -index 0e69f0a508616b..c559212ea86a73 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c -@@ -474,8 +474,7 @@ static void mt7996_configure_filter(struct ieee80211_hw *hw, - - MT76_FILTER(CONTROL, MT_WF_RFCR_DROP_CTS | - MT_WF_RFCR_DROP_RTS | -- MT_WF_RFCR_DROP_CTL_RSV | -- MT_WF_RFCR_DROP_NDPA); -+ MT_WF_RFCR_DROP_CTL_RSV); - - *total_flags = flags; - mt76_wr(dev, MT_WF_RFCR(phy->mt76->band_idx), phy->rxfilter); -diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c -index 302171e1035977..65a5f24e53136b 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c -@@ -1723,7 +1723,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev, - cap |= STA_CAP_VHT_TX_STBC; - if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1) - cap |= STA_CAP_VHT_RX_STBC; -- if (vif->bss_conf.vht_ldpc && -+ if ((vif->type != NL80211_IFTYPE_AP || vif->bss_conf.vht_ldpc) && - (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC)) - cap |= STA_CAP_VHT_LDPC; - -@@ -3189,6 +3189,13 @@ int mt7996_mcu_get_chip_config(struct mt7996_dev *dev, u32 *cap) - - int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch) - { -+ enum { -+ IDX_TX_TIME, -+ IDX_RX_TIME, -+ IDX_OBSS_AIRTIME, -+ IDX_NON_WIFI_TIME, -+ IDX_NUM -+ }; - struct { - struct { - u8 band; -@@ -3198,16 +3205,15 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch) - __le16 tag; - __le16 len; - __le32 offs; -- } data[4]; -+ } data[IDX_NUM]; - } __packed req = { - .hdr.band = phy->mt76->band_idx, - }; -- /* strict order */ - static const u32 offs[] = { -- UNI_MIB_TX_TIME, -- UNI_MIB_RX_TIME, -- UNI_MIB_OBSS_AIRTIME, -- UNI_MIB_NON_WIFI_TIME, -+ [IDX_TX_TIME] = UNI_MIB_TX_TIME, -+ [IDX_RX_TIME] = UNI_MIB_RX_TIME, -+ [IDX_OBSS_AIRTIME] = UNI_MIB_OBSS_AIRTIME, -+ [IDX_NON_WIFI_TIME] = UNI_MIB_NON_WIFI_TIME, - }; - struct mt76_channel_state *state = phy->mt76->chan_state; - struct mt76_channel_state *state_ts = &phy->state_ts; -@@ -3216,7 +3222,7 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch) - struct sk_buff *skb; - int i, ret; - -- for (i = 0; i < 4; i++) { -+ for (i = 0; i < IDX_NUM; i++) { - req.data[i].tag = cpu_to_le16(UNI_CMD_MIB_DATA); - req.data[i].len = cpu_to_le16(sizeof(req.data[i])); - req.data[i].offs = cpu_to_le32(offs[i]); -@@ -3235,17 +3241,24 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch) - goto out; - - #define __res_u64(s) le64_to_cpu(res[s].data) -- state->cc_tx += __res_u64(1) - state_ts->cc_tx; -- state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx; -- state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx; -- state->cc_busy += __res_u64(0) + __res_u64(1) + __res_u64(2) + __res_u64(3) - -+ state->cc_tx += __res_u64(IDX_TX_TIME) - state_ts->cc_tx; -+ state->cc_bss_rx += __res_u64(IDX_RX_TIME) - state_ts->cc_bss_rx; -+ state->cc_rx += __res_u64(IDX_RX_TIME) + -+ __res_u64(IDX_OBSS_AIRTIME) - -+ state_ts->cc_rx; -+ state->cc_busy += __res_u64(IDX_TX_TIME) + -+ __res_u64(IDX_RX_TIME) + -+ __res_u64(IDX_OBSS_AIRTIME) + -+ __res_u64(IDX_NON_WIFI_TIME) - - state_ts->cc_busy; -- - out: -- state_ts->cc_tx = __res_u64(1); -- state_ts->cc_bss_rx = __res_u64(2); -- state_ts->cc_rx = __res_u64(2) + __res_u64(3); -- state_ts->cc_busy = __res_u64(0) + __res_u64(1) + __res_u64(2) + __res_u64(3); -+ state_ts->cc_tx = __res_u64(IDX_TX_TIME); -+ state_ts->cc_bss_rx = __res_u64(IDX_RX_TIME); -+ state_ts->cc_rx = __res_u64(IDX_RX_TIME) + __res_u64(IDX_OBSS_AIRTIME); -+ state_ts->cc_busy = __res_u64(IDX_TX_TIME) + -+ __res_u64(IDX_RX_TIME) + -+ __res_u64(IDX_OBSS_AIRTIME) + -+ __res_u64(IDX_NON_WIFI_TIME); - #undef __res_u64 - - dev_kfree_skb(skb); -diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c -index e75becadc2e54d..f0fa0f513be907 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c -@@ -119,7 +119,7 @@ static u32 __mt7996_reg_addr(struct mt7996_dev *dev, u32 addr) - continue; - - ofs = addr - dev->reg.map[i].phys; -- if (ofs > dev->reg.map[i].size) -+ if (ofs >= dev->reg.map[i].size) - continue; - - return dev->reg.map[i].mapped + ofs; -diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c -index 1584665fe3cb68..a8f26583b51b22 100644 ---- a/drivers/net/wireless/mediatek/mt76/usb.c -+++ b/drivers/net/wireless/mediatek/mt76/usb.c -@@ -33,9 +33,9 @@ int __mt76u_vendor_request(struct mt76_dev *dev, u8 req, u8 req_type, - - ret = usb_control_msg(udev, pipe, req, req_type, val, - offset, buf, len, MT_VEND_REQ_TOUT_MS); -- if (ret == -ENODEV) -+ if (ret == -ENODEV || ret == -EPROTO) - set_bit(MT76_REMOVED, &dev->phy.state); -- if (ret >= 0 || ret == -ENODEV) -+ if (ret >= 0 || ret == -ENODEV || ret == -EPROTO) - return ret; - usleep_range(5000, 10000); - } -diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c -index 807a53a97325bf..c981739f707730 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/base.c -+++ b/drivers/net/wireless/realtek/rtlwifi/base.c -@@ -575,9 +575,15 @@ static void rtl_free_entries_from_ack_queue(struct ieee80211_hw *hw, - - void rtl_deinit_core(struct ieee80211_hw *hw) - { -+ struct rtl_priv *rtlpriv = rtl_priv(hw); -+ - rtl_c2hcmd_launcher(hw, 0); - rtl_free_entries_from_scan_list(hw); - rtl_free_entries_from_ack_queue(hw, false); -+ if (rtlpriv->works.rtl_wq) { -+ destroy_workqueue(rtlpriv->works.rtl_wq); -+ rtlpriv->works.rtl_wq = NULL; -+ } - } - EXPORT_SYMBOL_GPL(rtl_deinit_core); - -@@ -2710,9 +2716,6 @@ MODULE_AUTHOR("Larry Finger "); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Realtek 802.11n PCI wireless core"); - --struct rtl_global_var rtl_global_var = {}; --EXPORT_SYMBOL_GPL(rtl_global_var); -- - static int __init rtl_core_module_init(void) - { - BUILD_BUG_ON(TX_PWR_BY_RATE_NUM_RATE < TX_PWR_BY_RATE_NUM_SECTION); -@@ -2726,10 +2729,6 @@ static int __init rtl_core_module_init(void) - /* add debugfs */ - rtl_debugfs_add_topdir(); - -- /* init some global vars */ -- INIT_LIST_HEAD(&rtl_global_var.glb_priv_list); -- spin_lock_init(&rtl_global_var.glb_list_lock); -- - return 0; - } - -diff --git a/drivers/net/wireless/realtek/rtlwifi/base.h b/drivers/net/wireless/realtek/rtlwifi/base.h -index f081a9a90563f5..f3a6a43a42eca8 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/base.h -+++ b/drivers/net/wireless/realtek/rtlwifi/base.h -@@ -124,7 +124,6 @@ int rtl_send_smps_action(struct ieee80211_hw *hw, - u8 *rtl_find_ie(u8 *data, unsigned int len, u8 ie); - void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len); - u8 rtl_tid_to_ac(u8 tid); --extern struct rtl_global_var rtl_global_var; - void rtl_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation); - - #endif -diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c -index b118df035243c5..3abd0c4c954bc1 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/pci.c -+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c -@@ -295,46 +295,6 @@ static bool rtl_pci_get_amd_l1_patch(struct ieee80211_hw *hw) - return status; - } - --static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw, -- struct rtl_priv **buddy_priv) --{ -- struct rtl_priv *rtlpriv = rtl_priv(hw); -- struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw); -- struct rtl_priv *tpriv = NULL, *iter; -- struct rtl_pci_priv *tpcipriv = NULL; -- -- if (!list_empty(&rtlpriv->glb_var->glb_priv_list)) { -- list_for_each_entry(iter, &rtlpriv->glb_var->glb_priv_list, -- list) { -- tpcipriv = (struct rtl_pci_priv *)iter->priv; -- rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, -- "pcipriv->ndis_adapter.funcnumber %x\n", -- pcipriv->ndis_adapter.funcnumber); -- rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, -- "tpcipriv->ndis_adapter.funcnumber %x\n", -- tpcipriv->ndis_adapter.funcnumber); -- -- if (pcipriv->ndis_adapter.busnumber == -- tpcipriv->ndis_adapter.busnumber && -- pcipriv->ndis_adapter.devnumber == -- tpcipriv->ndis_adapter.devnumber && -- pcipriv->ndis_adapter.funcnumber != -- tpcipriv->ndis_adapter.funcnumber) { -- tpriv = iter; -- break; -- } -- } -- } -- -- rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, -- "find_buddy_priv %d\n", tpriv != NULL); -- -- if (tpriv) -- *buddy_priv = tpriv; -- -- return tpriv != NULL; --} -- - static void rtl_pci_parse_configuration(struct pci_dev *pdev, - struct ieee80211_hw *hw) - { -@@ -1697,8 +1657,6 @@ static void rtl_pci_deinit(struct ieee80211_hw *hw) - synchronize_irq(rtlpci->pdev->irq); - tasklet_kill(&rtlpriv->works.irq_tasklet); - cancel_work_sync(&rtlpriv->works.lps_change_work); -- -- destroy_workqueue(rtlpriv->works.rtl_wq); - } - - static int rtl_pci_init(struct ieee80211_hw *hw, struct pci_dev *pdev) -@@ -2013,7 +1971,6 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev, - pcipriv->ndis_adapter.amd_l1_patch); - - rtl_pci_parse_configuration(pdev, hw); -- list_add_tail(&rtlpriv->list, &rtlpriv->glb_var->glb_priv_list); - - return true; - } -@@ -2160,7 +2117,6 @@ int rtl_pci_probe(struct pci_dev *pdev, - rtlpriv->rtlhal.interface = INTF_PCI; - rtlpriv->cfg = (struct rtl_hal_cfg *)(id->driver_data); - rtlpriv->intf_ops = &rtl_pci_ops; -- rtlpriv->glb_var = &rtl_global_var; - rtl_efuse_ops_init(hw); - - /* MEM map */ -@@ -2211,7 +2167,7 @@ int rtl_pci_probe(struct pci_dev *pdev, - if (rtlpriv->cfg->ops->init_sw_vars(hw)) { - pr_err("Can't init_sw_vars\n"); - err = -ENODEV; -- goto fail3; -+ goto fail2; - } - rtl_init_sw_leds(hw); - -@@ -2229,14 +2185,14 @@ int rtl_pci_probe(struct pci_dev *pdev, - err = rtl_pci_init(hw, pdev); - if (err) { - pr_err("Failed to init PCI\n"); -- goto fail3; -+ goto fail4; - } - - err = ieee80211_register_hw(hw); - if (err) { - pr_err("Can't register mac80211 hw.\n"); - err = -ENODEV; -- goto fail3; -+ goto fail5; - } - rtlpriv->mac80211.mac80211_registered = 1; - -@@ -2259,16 +2215,19 @@ int rtl_pci_probe(struct pci_dev *pdev, - set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status); - return 0; - --fail3: -- pci_set_drvdata(pdev, NULL); -+fail5: -+ rtl_pci_deinit(hw); -+fail4: - rtl_deinit_core(hw); -+fail3: -+ wait_for_completion(&rtlpriv->firmware_loading_complete); -+ rtlpriv->cfg->ops->deinit_sw_vars(hw); - - fail2: - if (rtlpriv->io.pci_mem_start != 0) - pci_iounmap(pdev, (void __iomem *)rtlpriv->io.pci_mem_start); - - pci_release_regions(pdev); -- complete(&rtlpriv->firmware_loading_complete); - - fail1: - if (hw) -@@ -2319,7 +2278,6 @@ void rtl_pci_disconnect(struct pci_dev *pdev) - if (rtlpci->using_msi) - pci_disable_msi(rtlpci->pdev); - -- list_del(&rtlpriv->list); - if (rtlpriv->io.pci_mem_start != 0) { - pci_iounmap(pdev, (void __iomem *)rtlpriv->io.pci_mem_start); - pci_release_regions(pdev); -@@ -2379,7 +2337,6 @@ const struct rtl_intf_ops rtl_pci_ops = { - .read_efuse_byte = read_efuse_byte, - .adapter_start = rtl_pci_start, - .adapter_stop = rtl_pci_stop, -- .check_buddy_priv = rtl_pci_check_buddy_priv, - .adapter_tx = rtl_pci_tx, - .flush = rtl_pci_flush, - .reset_trx_ring = rtl_pci_reset_trx_ring, -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c -index 30bce381c3bb70..d7dae4488f69bb 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c -@@ -67,22 +67,23 @@ static void rtl92se_fw_cb(const struct firmware *firmware, void *context) - - rtl_dbg(rtlpriv, COMP_ERR, DBG_LOUD, - "Firmware callback routine entered!\n"); -- complete(&rtlpriv->firmware_loading_complete); - if (!firmware) { - pr_err("Firmware %s not available\n", fw_name); - rtlpriv->max_fw_size = 0; -- return; -+ goto exit; - } - if (firmware->size > rtlpriv->max_fw_size) { - pr_err("Firmware is too big!\n"); - rtlpriv->max_fw_size = 0; - release_firmware(firmware); -- return; -+ goto exit; - } - pfirmware = (struct rt_firmware *)rtlpriv->rtlhal.pfirmware; - memcpy(pfirmware->sz_fw_tmpbuffer, firmware->data, firmware->size); - pfirmware->sz_fw_tmpbufferlen = firmware->size; - release_firmware(firmware); -+exit: -+ complete(&rtlpriv->firmware_loading_complete); - } - - static int rtl92s_init_sw_vars(struct ieee80211_hw *hw) -diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c -index 30bf2775a335bc..e2e1e568bdb36b 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/usb.c -+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c -@@ -660,11 +660,6 @@ static void _rtl_usb_cleanup_rx(struct ieee80211_hw *hw) - tasklet_kill(&rtlusb->rx_work_tasklet); - cancel_work_sync(&rtlpriv->works.lps_change_work); - -- if (rtlpriv->works.rtl_wq) { -- destroy_workqueue(rtlpriv->works.rtl_wq); -- rtlpriv->works.rtl_wq = NULL; -- } -- - skb_queue_purge(&rtlusb->rx_queue); - - while ((urb = usb_get_from_anchor(&rtlusb->rx_cleanup_urbs))) { -@@ -1054,19 +1049,22 @@ int rtl_usb_probe(struct usb_interface *intf, - err = ieee80211_register_hw(hw); - if (err) { - pr_err("Can't register mac80211 hw.\n"); -- goto error_out; -+ goto error_init_vars; - } - rtlpriv->mac80211.mac80211_registered = 1; - - set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status); - return 0; - -+error_init_vars: -+ wait_for_completion(&rtlpriv->firmware_loading_complete); -+ rtlpriv->cfg->ops->deinit_sw_vars(hw); - error_out: -+ rtl_usb_deinit(hw); - rtl_deinit_core(hw); - error_out2: - _rtl_usb_io_handler_release(hw); - usb_put_dev(udev); -- complete(&rtlpriv->firmware_loading_complete); - kfree(rtlpriv->usb_data); - ieee80211_free_hw(hw); - return -ENODEV; -diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h -index 8cbf3fb3885397..2106d7763badae 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/wifi.h -+++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h -@@ -2321,8 +2321,6 @@ struct rtl_intf_ops { - void (*read_efuse_byte)(struct ieee80211_hw *hw, u16 _offset, u8 *pbuf); - int (*adapter_start)(struct ieee80211_hw *hw); - void (*adapter_stop)(struct ieee80211_hw *hw); -- bool (*check_buddy_priv)(struct ieee80211_hw *hw, -- struct rtl_priv **buddy_priv); - - int (*adapter_tx)(struct ieee80211_hw *hw, - struct ieee80211_sta *sta, -@@ -2566,14 +2564,6 @@ struct dig_t { - u32 rssi_max; - }; - --struct rtl_global_var { -- /* from this list we can get -- * other adapter's rtl_priv -- */ -- struct list_head glb_priv_list; -- spinlock_t glb_list_lock; --}; -- - #define IN_4WAY_TIMEOUT_TIME (30 * MSEC_PER_SEC) /* 30 seconds */ - - struct rtl_btc_info { -@@ -2719,9 +2709,7 @@ struct rtl_scan_list { - struct rtl_priv { - struct ieee80211_hw *hw; - struct completion firmware_loading_complete; -- struct list_head list; - struct rtl_priv *buddy_priv; -- struct rtl_global_var *glb_var; - struct rtl_dmsp_ctl dmsp_ctl; - struct rtl_locks locks; - struct rtl_works works; -diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c -index bf21611872a3c1..9706240ddd416b 100644 ---- a/drivers/net/wireless/ti/wlcore/main.c -+++ b/drivers/net/wireless/ti/wlcore/main.c -@@ -2533,24 +2533,24 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw, - if (test_bit(WL1271_FLAG_RECOVERY_IN_PROGRESS, &wl->flags) || - test_bit(WLVIF_FLAG_INITIALIZED, &wlvif->flags)) { - ret = -EBUSY; -- goto out; -+ goto out_unlock; - } - - - ret = wl12xx_init_vif_data(wl, vif); - if (ret < 0) -- goto out; -+ goto out_unlock; - - wlvif->wl = wl; - role_type = wl12xx_get_role_type(wl, wlvif); - if (role_type == WL12XX_INVALID_ROLE_TYPE) { - ret = -EINVAL; -- goto out; -+ goto out_unlock; - } - - ret = wlcore_allocate_hw_queue_base(wl, wlvif); - if (ret < 0) -- goto out; -+ goto out_unlock; - - /* - * TODO: after the nvs issue will be solved, move this block -@@ -2565,7 +2565,7 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw, - - ret = wl12xx_init_fw(wl); - if (ret < 0) -- goto out; -+ goto out_unlock; - } - - /* -diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c -index 4aad16390d4790..26e3f1896dc397 100644 ---- a/drivers/nvme/host/core.c -+++ b/drivers/nvme/host/core.c -@@ -2853,7 +2853,7 @@ int nvme_get_log(struct nvme_ctrl *ctrl, u32 nsid, u8 log_page, u8 lsp, u8 csi, - static int nvme_get_effects_log(struct nvme_ctrl *ctrl, u8 csi, - struct nvme_effects_log **log) - { -- struct nvme_effects_log *cel = xa_load(&ctrl->cels, csi); -+ struct nvme_effects_log *old, *cel = xa_load(&ctrl->cels, csi); - int ret; - - if (cel) -@@ -2870,7 +2870,11 @@ static int nvme_get_effects_log(struct nvme_ctrl *ctrl, u8 csi, - return ret; - } - -- xa_store(&ctrl->cels, csi, cel, GFP_KERNEL); -+ old = xa_store(&ctrl->cels, csi, cel, GFP_KERNEL); -+ if (xa_is_err(old)) { -+ kfree(cel); -+ return xa_err(old); -+ } - out: - *log = cel; - return 0; -@@ -2941,6 +2945,25 @@ static int nvme_init_non_mdts_limits(struct nvme_ctrl *ctrl) - return ret; - } - -+static int nvme_init_effects_log(struct nvme_ctrl *ctrl, -+ u8 csi, struct nvme_effects_log **log) -+{ -+ struct nvme_effects_log *effects, *old; -+ -+ effects = kzalloc(sizeof(*effects), GFP_KERNEL); -+ if (!effects) -+ return -ENOMEM; -+ -+ old = xa_store(&ctrl->cels, csi, effects, GFP_KERNEL); -+ if (xa_is_err(old)) { -+ kfree(effects); -+ return xa_err(old); -+ } -+ -+ *log = effects; -+ return 0; -+} -+ - static void nvme_init_known_nvm_effects(struct nvme_ctrl *ctrl) - { - struct nvme_effects_log *log = ctrl->effects; -@@ -2987,10 +3010,9 @@ static int nvme_init_effects(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) - } - - if (!ctrl->effects) { -- ctrl->effects = kzalloc(sizeof(*ctrl->effects), GFP_KERNEL); -- if (!ctrl->effects) -- return -ENOMEM; -- xa_store(&ctrl->cels, NVME_CSI_NVM, ctrl->effects, GFP_KERNEL); -+ ret = nvme_init_effects_log(ctrl, NVME_CSI_NVM, &ctrl->effects); -+ if (ret < 0) -+ return ret; - } - - nvme_init_known_nvm_effects(ctrl); -diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c -index 7ec94cfcbddb18..959f1808c240fa 100644 ---- a/drivers/of/of_reserved_mem.c -+++ b/drivers/of/of_reserved_mem.c -@@ -50,7 +50,8 @@ static int __init early_init_dt_alloc_reserved_memory_arch(phys_addr_t size, - memblock_phys_free(base, size); - } - -- kmemleak_ignore_phys(base); -+ if (!err) -+ kmemleak_ignore_phys(base); - - return err; - } -diff --git a/drivers/opp/core.c b/drivers/opp/core.c -index bceb27b1baa18a..218cb2e7f36055 100644 ---- a/drivers/opp/core.c -+++ b/drivers/opp/core.c -@@ -101,11 +101,30 @@ struct opp_table *_find_opp_table(struct device *dev) - * representation in the OPP table and manage the clock configuration themselves - * in an platform specific way. - */ --static bool assert_single_clk(struct opp_table *opp_table) -+static bool assert_single_clk(struct opp_table *opp_table, -+ unsigned int __always_unused index) - { - return !WARN_ON(opp_table->clk_count > 1); - } - -+/* -+ * Returns true if clock table is large enough to contain the clock index. -+ */ -+static bool assert_clk_index(struct opp_table *opp_table, -+ unsigned int index) -+{ -+ return opp_table->clk_count > index; -+} -+ -+/* -+ * Returns true if bandwidth table is large enough to contain the bandwidth index. -+ */ -+static bool assert_bandwidth_index(struct opp_table *opp_table, -+ unsigned int index) -+{ -+ return opp_table->path_count > index; -+} -+ - /** - * dev_pm_opp_get_voltage() - Gets the voltage corresponding to an opp - * @opp: opp for which voltage has to be returned for -@@ -499,12 +518,12 @@ static struct dev_pm_opp *_opp_table_find_key(struct opp_table *opp_table, - unsigned long (*read)(struct dev_pm_opp *opp, int index), - bool (*compare)(struct dev_pm_opp **opp, struct dev_pm_opp *temp_opp, - unsigned long opp_key, unsigned long key), -- bool (*assert)(struct opp_table *opp_table)) -+ bool (*assert)(struct opp_table *opp_table, unsigned int index)) - { - struct dev_pm_opp *temp_opp, *opp = ERR_PTR(-ERANGE); - - /* Assert that the requirement is met */ -- if (assert && !assert(opp_table)) -+ if (assert && !assert(opp_table, index)) - return ERR_PTR(-EINVAL); - - mutex_lock(&opp_table->lock); -@@ -532,7 +551,7 @@ _find_key(struct device *dev, unsigned long *key, int index, bool available, - unsigned long (*read)(struct dev_pm_opp *opp, int index), - bool (*compare)(struct dev_pm_opp **opp, struct dev_pm_opp *temp_opp, - unsigned long opp_key, unsigned long key), -- bool (*assert)(struct opp_table *opp_table)) -+ bool (*assert)(struct opp_table *opp_table, unsigned int index)) - { - struct opp_table *opp_table; - struct dev_pm_opp *opp; -@@ -555,7 +574,7 @@ _find_key(struct device *dev, unsigned long *key, int index, bool available, - static struct dev_pm_opp *_find_key_exact(struct device *dev, - unsigned long key, int index, bool available, - unsigned long (*read)(struct dev_pm_opp *opp, int index), -- bool (*assert)(struct opp_table *opp_table)) -+ bool (*assert)(struct opp_table *opp_table, unsigned int index)) - { - /* - * The value of key will be updated here, but will be ignored as the -@@ -568,7 +587,7 @@ static struct dev_pm_opp *_find_key_exact(struct device *dev, - static struct dev_pm_opp *_opp_table_find_key_ceil(struct opp_table *opp_table, - unsigned long *key, int index, bool available, - unsigned long (*read)(struct dev_pm_opp *opp, int index), -- bool (*assert)(struct opp_table *opp_table)) -+ bool (*assert)(struct opp_table *opp_table, unsigned int index)) - { - return _opp_table_find_key(opp_table, key, index, available, read, - _compare_ceil, assert); -@@ -577,7 +596,7 @@ static struct dev_pm_opp *_opp_table_find_key_ceil(struct opp_table *opp_table, - static struct dev_pm_opp *_find_key_ceil(struct device *dev, unsigned long *key, - int index, bool available, - unsigned long (*read)(struct dev_pm_opp *opp, int index), -- bool (*assert)(struct opp_table *opp_table)) -+ bool (*assert)(struct opp_table *opp_table, unsigned int index)) - { - return _find_key(dev, key, index, available, read, _compare_ceil, - assert); -@@ -586,7 +605,7 @@ static struct dev_pm_opp *_find_key_ceil(struct device *dev, unsigned long *key, - static struct dev_pm_opp *_find_key_floor(struct device *dev, - unsigned long *key, int index, bool available, - unsigned long (*read)(struct dev_pm_opp *opp, int index), -- bool (*assert)(struct opp_table *opp_table)) -+ bool (*assert)(struct opp_table *opp_table, unsigned int index)) - { - return _find_key(dev, key, index, available, read, _compare_floor, - assert); -@@ -647,7 +666,8 @@ struct dev_pm_opp * - dev_pm_opp_find_freq_exact_indexed(struct device *dev, unsigned long freq, - u32 index, bool available) - { -- return _find_key_exact(dev, freq, index, available, _read_freq, NULL); -+ return _find_key_exact(dev, freq, index, available, _read_freq, -+ assert_clk_index); - } - EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_exact_indexed); - -@@ -707,7 +727,8 @@ struct dev_pm_opp * - dev_pm_opp_find_freq_ceil_indexed(struct device *dev, unsigned long *freq, - u32 index) - { -- return _find_key_ceil(dev, freq, index, true, _read_freq, NULL); -+ return _find_key_ceil(dev, freq, index, true, _read_freq, -+ assert_clk_index); - } - EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_ceil_indexed); - -@@ -760,7 +781,7 @@ struct dev_pm_opp * - dev_pm_opp_find_freq_floor_indexed(struct device *dev, unsigned long *freq, - u32 index) - { -- return _find_key_floor(dev, freq, index, true, _read_freq, NULL); -+ return _find_key_floor(dev, freq, index, true, _read_freq, assert_clk_index); - } - EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_floor_indexed); - -@@ -838,7 +859,8 @@ struct dev_pm_opp *dev_pm_opp_find_bw_ceil(struct device *dev, unsigned int *bw, - unsigned long temp = *bw; - struct dev_pm_opp *opp; - -- opp = _find_key_ceil(dev, &temp, index, true, _read_bw, NULL); -+ opp = _find_key_ceil(dev, &temp, index, true, _read_bw, -+ assert_bandwidth_index); - *bw = temp; - return opp; - } -@@ -869,7 +891,8 @@ struct dev_pm_opp *dev_pm_opp_find_bw_floor(struct device *dev, - unsigned long temp = *bw; - struct dev_pm_opp *opp; - -- opp = _find_key_floor(dev, &temp, index, true, _read_bw, NULL); -+ opp = _find_key_floor(dev, &temp, index, true, _read_bw, -+ assert_bandwidth_index); - *bw = temp; - return opp; - } -@@ -1676,7 +1699,7 @@ void dev_pm_opp_remove(struct device *dev, unsigned long freq) - if (IS_ERR(opp_table)) - return; - -- if (!assert_single_clk(opp_table)) -+ if (!assert_single_clk(opp_table, 0)) - goto put_table; - - mutex_lock(&opp_table->lock); -@@ -2027,7 +2050,7 @@ int _opp_add_v1(struct opp_table *opp_table, struct device *dev, - unsigned long tol; - int ret; - -- if (!assert_single_clk(opp_table)) -+ if (!assert_single_clk(opp_table, 0)) - return -EINVAL; - - new_opp = _opp_allocate(opp_table); -@@ -2889,7 +2912,7 @@ static int _opp_set_availability(struct device *dev, unsigned long freq, - return r; - } - -- if (!assert_single_clk(opp_table)) { -+ if (!assert_single_clk(opp_table, 0)) { - r = -EINVAL; - goto put_table; - } -@@ -2965,7 +2988,7 @@ int dev_pm_opp_adjust_voltage(struct device *dev, unsigned long freq, - return r; - } - -- if (!assert_single_clk(opp_table)) { -+ if (!assert_single_clk(opp_table, 0)) { - r = -EINVAL; - goto put_table; - } -diff --git a/drivers/opp/of.c b/drivers/opp/of.c -index ada4963c7cfae5..657c08d0ad979a 100644 ---- a/drivers/opp/of.c -+++ b/drivers/opp/of.c -@@ -932,7 +932,7 @@ static struct dev_pm_opp *_opp_add_static_v2(struct opp_table *opp_table, - - ret = _of_opp_alloc_required_opps(opp_table, new_opp); - if (ret) -- goto free_opp; -+ goto put_node; - - if (!of_property_read_u32(np, "clock-latency-ns", &val)) - new_opp->clock_latency_ns = val; -@@ -982,6 +982,8 @@ static struct dev_pm_opp *_opp_add_static_v2(struct opp_table *opp_table, - - free_required_opps: - _of_opp_free_required_opps(opp_table, new_opp); -+put_node: -+ of_node_put(np); - free_opp: - _opp_free(new_opp); - -diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c -index 86b09b5d7f2493..822a750b064b27 100644 ---- a/drivers/pci/controller/dwc/pci-imx6.c -+++ b/drivers/pci/controller/dwc/pci-imx6.c -@@ -61,12 +61,16 @@ enum imx6_pcie_variants { - #define IMX6_PCIE_FLAG_IMX6_SPEED_CHANGE BIT(1) - #define IMX6_PCIE_FLAG_SUPPORTS_SUSPEND BIT(2) - -+#define IMX6_PCIE_MAX_CLKS 6 -+ - struct imx6_pcie_drvdata { - enum imx6_pcie_variants variant; - enum dw_pcie_device_mode mode; - u32 flags; - int dbi_length; - const char *gpr; -+ const char * const *clk_names; -+ const u32 clks_cnt; - }; - - struct imx6_pcie { -@@ -74,11 +78,7 @@ struct imx6_pcie { - int reset_gpio; - bool gpio_active_high; - bool link_is_up; -- struct clk *pcie_bus; -- struct clk *pcie_phy; -- struct clk *pcie_inbound_axi; -- struct clk *pcie; -- struct clk *pcie_aux; -+ struct clk_bulk_data clks[IMX6_PCIE_MAX_CLKS]; - struct regmap *iomuxc_gpr; - u16 msi_ctrl; - u32 controller_id; -@@ -407,13 +407,18 @@ static void imx7d_pcie_wait_for_phy_pll_lock(struct imx6_pcie *imx6_pcie) - - static int imx6_setup_phy_mpll(struct imx6_pcie *imx6_pcie) - { -- unsigned long phy_rate = clk_get_rate(imx6_pcie->pcie_phy); -+ unsigned long phy_rate = 0; - int mult, div; - u16 val; -+ int i; - - if (!(imx6_pcie->drvdata->flags & IMX6_PCIE_FLAG_IMX6_PHY)) - return 0; - -+ for (i = 0; i < imx6_pcie->drvdata->clks_cnt; i++) -+ if (strncmp(imx6_pcie->clks[i].id, "pcie_phy", 8) == 0) -+ phy_rate = clk_get_rate(imx6_pcie->clks[i].clk); -+ - switch (phy_rate) { - case 125000000: - /* -@@ -550,19 +555,11 @@ static int imx6_pcie_attach_pd(struct device *dev) - - static int imx6_pcie_enable_ref_clk(struct imx6_pcie *imx6_pcie) - { -- struct dw_pcie *pci = imx6_pcie->pci; -- struct device *dev = pci->dev; - unsigned int offset; - int ret = 0; - - switch (imx6_pcie->drvdata->variant) { - case IMX6SX: -- ret = clk_prepare_enable(imx6_pcie->pcie_inbound_axi); -- if (ret) { -- dev_err(dev, "unable to enable pcie_axi clock\n"); -- break; -- } -- - regmap_update_bits(imx6_pcie->iomuxc_gpr, IOMUXC_GPR12, - IMX6SX_GPR12_PCIE_TEST_POWERDOWN, 0); - break; -@@ -589,12 +586,6 @@ static int imx6_pcie_enable_ref_clk(struct imx6_pcie *imx6_pcie) - case IMX8MQ_EP: - case IMX8MP: - case IMX8MP_EP: -- ret = clk_prepare_enable(imx6_pcie->pcie_aux); -- if (ret) { -- dev_err(dev, "unable to enable pcie_aux clock\n"); -- break; -- } -- - offset = imx6_pcie_grp_offset(imx6_pcie); - /* - * Set the over ride low and enabled -@@ -615,9 +606,6 @@ static int imx6_pcie_enable_ref_clk(struct imx6_pcie *imx6_pcie) - static void imx6_pcie_disable_ref_clk(struct imx6_pcie *imx6_pcie) - { - switch (imx6_pcie->drvdata->variant) { -- case IMX6SX: -- clk_disable_unprepare(imx6_pcie->pcie_inbound_axi); -- break; - case IMX6QP: - case IMX6Q: - regmap_update_bits(imx6_pcie->iomuxc_gpr, IOMUXC_GPR1, -@@ -631,14 +619,6 @@ static void imx6_pcie_disable_ref_clk(struct imx6_pcie *imx6_pcie) - IMX7D_GPR12_PCIE_PHY_REFCLK_SEL, - IMX7D_GPR12_PCIE_PHY_REFCLK_SEL); - break; -- case IMX8MM: -- case IMX8MM_EP: -- case IMX8MQ: -- case IMX8MQ_EP: -- case IMX8MP: -- case IMX8MP_EP: -- clk_disable_unprepare(imx6_pcie->pcie_aux); -- break; - default: - break; - } -@@ -650,23 +630,9 @@ static int imx6_pcie_clk_enable(struct imx6_pcie *imx6_pcie) - struct device *dev = pci->dev; - int ret; - -- ret = clk_prepare_enable(imx6_pcie->pcie_phy); -- if (ret) { -- dev_err(dev, "unable to enable pcie_phy clock\n"); -+ ret = clk_bulk_prepare_enable(imx6_pcie->drvdata->clks_cnt, imx6_pcie->clks); -+ if (ret) - return ret; -- } -- -- ret = clk_prepare_enable(imx6_pcie->pcie_bus); -- if (ret) { -- dev_err(dev, "unable to enable pcie_bus clock\n"); -- goto err_pcie_bus; -- } -- -- ret = clk_prepare_enable(imx6_pcie->pcie); -- if (ret) { -- dev_err(dev, "unable to enable pcie clock\n"); -- goto err_pcie; -- } - - ret = imx6_pcie_enable_ref_clk(imx6_pcie); - if (ret) { -@@ -679,11 +645,7 @@ static int imx6_pcie_clk_enable(struct imx6_pcie *imx6_pcie) - return 0; - - err_ref_clk: -- clk_disable_unprepare(imx6_pcie->pcie); --err_pcie: -- clk_disable_unprepare(imx6_pcie->pcie_bus); --err_pcie_bus: -- clk_disable_unprepare(imx6_pcie->pcie_phy); -+ clk_bulk_disable_unprepare(imx6_pcie->drvdata->clks_cnt, imx6_pcie->clks); - - return ret; - } -@@ -691,9 +653,7 @@ static int imx6_pcie_clk_enable(struct imx6_pcie *imx6_pcie) - static void imx6_pcie_clk_disable(struct imx6_pcie *imx6_pcie) - { - imx6_pcie_disable_ref_clk(imx6_pcie); -- clk_disable_unprepare(imx6_pcie->pcie); -- clk_disable_unprepare(imx6_pcie->pcie_bus); -- clk_disable_unprepare(imx6_pcie->pcie_phy); -+ clk_bulk_disable_unprepare(imx6_pcie->drvdata->clks_cnt, imx6_pcie->clks); - } - - static void imx6_pcie_assert_core_reset(struct imx6_pcie *imx6_pcie) -@@ -1253,6 +1213,7 @@ static int imx6_pcie_probe(struct platform_device *pdev) - struct device_node *node = dev->of_node; - int ret; - u16 val; -+ int i; - - imx6_pcie = devm_kzalloc(dev, sizeof(*imx6_pcie), GFP_KERNEL); - if (!imx6_pcie) -@@ -1306,33 +1267,20 @@ static int imx6_pcie_probe(struct platform_device *pdev) - return imx6_pcie->reset_gpio; - } - -- /* Fetch clocks */ -- imx6_pcie->pcie_bus = devm_clk_get(dev, "pcie_bus"); -- if (IS_ERR(imx6_pcie->pcie_bus)) -- return dev_err_probe(dev, PTR_ERR(imx6_pcie->pcie_bus), -- "pcie_bus clock source missing or invalid\n"); -+ if (imx6_pcie->drvdata->clks_cnt >= IMX6_PCIE_MAX_CLKS) -+ return dev_err_probe(dev, -ENOMEM, "clks_cnt is too big\n"); -+ -+ for (i = 0; i < imx6_pcie->drvdata->clks_cnt; i++) -+ imx6_pcie->clks[i].id = imx6_pcie->drvdata->clk_names[i]; - -- imx6_pcie->pcie = devm_clk_get(dev, "pcie"); -- if (IS_ERR(imx6_pcie->pcie)) -- return dev_err_probe(dev, PTR_ERR(imx6_pcie->pcie), -- "pcie clock source missing or invalid\n"); -+ /* Fetch clocks */ -+ ret = devm_clk_bulk_get(dev, imx6_pcie->drvdata->clks_cnt, imx6_pcie->clks); -+ if (ret) -+ return ret; - - switch (imx6_pcie->drvdata->variant) { -- case IMX6SX: -- imx6_pcie->pcie_inbound_axi = devm_clk_get(dev, -- "pcie_inbound_axi"); -- if (IS_ERR(imx6_pcie->pcie_inbound_axi)) -- return dev_err_probe(dev, PTR_ERR(imx6_pcie->pcie_inbound_axi), -- "pcie_inbound_axi clock missing or invalid\n"); -- break; - case IMX8MQ: - case IMX8MQ_EP: -- imx6_pcie->pcie_aux = devm_clk_get(dev, "pcie_aux"); -- if (IS_ERR(imx6_pcie->pcie_aux)) -- return dev_err_probe(dev, PTR_ERR(imx6_pcie->pcie_aux), -- "pcie_aux clock source missing or invalid\n"); -- fallthrough; -- case IMX7D: - if (dbi_base->start == IMX8MQ_PCIE2_BASE_ADDR) - imx6_pcie->controller_id = 1; - -@@ -1354,10 +1302,6 @@ static int imx6_pcie_probe(struct platform_device *pdev) - case IMX8MM_EP: - case IMX8MP: - case IMX8MP_EP: -- imx6_pcie->pcie_aux = devm_clk_get(dev, "pcie_aux"); -- if (IS_ERR(imx6_pcie->pcie_aux)) -- return dev_err_probe(dev, PTR_ERR(imx6_pcie->pcie_aux), -- "pcie_aux clock source missing or invalid\n"); - imx6_pcie->apps_reset = devm_reset_control_get_exclusive(dev, - "apps"); - if (IS_ERR(imx6_pcie->apps_reset)) -@@ -1373,14 +1317,6 @@ static int imx6_pcie_probe(struct platform_device *pdev) - default: - break; - } -- /* Don't fetch the pcie_phy clock, if it has abstract PHY driver */ -- if (imx6_pcie->phy == NULL) { -- imx6_pcie->pcie_phy = devm_clk_get(dev, "pcie_phy"); -- if (IS_ERR(imx6_pcie->pcie_phy)) -- return dev_err_probe(dev, PTR_ERR(imx6_pcie->pcie_phy), -- "pcie_phy clock source missing or invalid\n"); -- } -- - - /* Grab turnoff reset */ - imx6_pcie->turnoff_reset = devm_reset_control_get_optional_exclusive(dev, "turnoff"); -@@ -1471,6 +1407,11 @@ static void imx6_pcie_shutdown(struct platform_device *pdev) - imx6_pcie_assert_core_reset(imx6_pcie); - } - -+static const char * const imx6q_clks[] = {"pcie_bus", "pcie", "pcie_phy"}; -+static const char * const imx8mm_clks[] = {"pcie_bus", "pcie", "pcie_aux"}; -+static const char * const imx8mq_clks[] = {"pcie_bus", "pcie", "pcie_phy", "pcie_aux"}; -+static const char * const imx6sx_clks[] = {"pcie_bus", "pcie", "pcie_phy", "pcie_inbound_axi"}; -+ - static const struct imx6_pcie_drvdata drvdata[] = { - [IMX6Q] = { - .variant = IMX6Q, -@@ -1478,6 +1419,8 @@ static const struct imx6_pcie_drvdata drvdata[] = { - IMX6_PCIE_FLAG_IMX6_SPEED_CHANGE, - .dbi_length = 0x200, - .gpr = "fsl,imx6q-iomuxc-gpr", -+ .clk_names = imx6q_clks, -+ .clks_cnt = ARRAY_SIZE(imx6q_clks), - }, - [IMX6SX] = { - .variant = IMX6SX, -@@ -1485,6 +1428,8 @@ static const struct imx6_pcie_drvdata drvdata[] = { - IMX6_PCIE_FLAG_IMX6_SPEED_CHANGE | - IMX6_PCIE_FLAG_SUPPORTS_SUSPEND, - .gpr = "fsl,imx6q-iomuxc-gpr", -+ .clk_names = imx6sx_clks, -+ .clks_cnt = ARRAY_SIZE(imx6sx_clks), - }, - [IMX6QP] = { - .variant = IMX6QP, -@@ -1493,40 +1438,56 @@ static const struct imx6_pcie_drvdata drvdata[] = { - IMX6_PCIE_FLAG_SUPPORTS_SUSPEND, - .dbi_length = 0x200, - .gpr = "fsl,imx6q-iomuxc-gpr", -+ .clk_names = imx6q_clks, -+ .clks_cnt = ARRAY_SIZE(imx6q_clks), - }, - [IMX7D] = { - .variant = IMX7D, - .flags = IMX6_PCIE_FLAG_SUPPORTS_SUSPEND, - .gpr = "fsl,imx7d-iomuxc-gpr", -+ .clk_names = imx6q_clks, -+ .clks_cnt = ARRAY_SIZE(imx6q_clks), - }, - [IMX8MQ] = { - .variant = IMX8MQ, - .gpr = "fsl,imx8mq-iomuxc-gpr", -+ .clk_names = imx8mq_clks, -+ .clks_cnt = ARRAY_SIZE(imx8mq_clks), - }, - [IMX8MM] = { - .variant = IMX8MM, - .flags = IMX6_PCIE_FLAG_SUPPORTS_SUSPEND, - .gpr = "fsl,imx8mm-iomuxc-gpr", -+ .clk_names = imx8mm_clks, -+ .clks_cnt = ARRAY_SIZE(imx8mm_clks), - }, - [IMX8MP] = { - .variant = IMX8MP, - .flags = IMX6_PCIE_FLAG_SUPPORTS_SUSPEND, - .gpr = "fsl,imx8mp-iomuxc-gpr", -+ .clk_names = imx8mm_clks, -+ .clks_cnt = ARRAY_SIZE(imx8mm_clks), - }, - [IMX8MQ_EP] = { - .variant = IMX8MQ_EP, - .mode = DW_PCIE_EP_TYPE, - .gpr = "fsl,imx8mq-iomuxc-gpr", -+ .clk_names = imx8mq_clks, -+ .clks_cnt = ARRAY_SIZE(imx8mq_clks), - }, - [IMX8MM_EP] = { - .variant = IMX8MM_EP, - .mode = DW_PCIE_EP_TYPE, - .gpr = "fsl,imx8mm-iomuxc-gpr", -+ .clk_names = imx8mm_clks, -+ .clks_cnt = ARRAY_SIZE(imx8mm_clks), - }, - [IMX8MP_EP] = { - .variant = IMX8MP_EP, - .mode = DW_PCIE_EP_TYPE, - .gpr = "fsl,imx8mp-iomuxc-gpr", -+ .clk_names = imx8mm_clks, -+ .clks_cnt = ARRAY_SIZE(imx8mm_clks), - }, - }; - -diff --git a/drivers/pci/controller/pcie-rcar-ep.c b/drivers/pci/controller/pcie-rcar-ep.c -index f9682df1da6192..209719fb6ddcce 100644 ---- a/drivers/pci/controller/pcie-rcar-ep.c -+++ b/drivers/pci/controller/pcie-rcar-ep.c -@@ -107,7 +107,7 @@ static int rcar_pcie_parse_outbound_ranges(struct rcar_pcie_endpoint *ep, - } - if (!devm_request_mem_region(&pdev->dev, res->start, - resource_size(res), -- outbound_name)) { -+ res->name)) { - dev_err(pcie->dev, "Cannot request memory region %s.\n", - outbound_name); - return -EIO; -diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c -index 1f0d2b84296a34..ac1dae113f2d9f 100644 ---- a/drivers/pci/endpoint/functions/pci-epf-test.c -+++ b/drivers/pci/endpoint/functions/pci-epf-test.c -@@ -251,7 +251,7 @@ static int pci_epf_test_init_dma_chan(struct pci_epf_test *epf_test) - - fail_back_rx: - dma_release_channel(epf_test->dma_chan_rx); -- epf_test->dma_chan_tx = NULL; -+ epf_test->dma_chan_rx = NULL; - - fail_back_tx: - dma_cap_zero(mask); -@@ -361,8 +361,8 @@ static void pci_epf_test_copy(struct pci_epf_test *epf_test, - - ktime_get_ts64(&start); - if (reg->flags & FLAG_USE_DMA) { -- if (epf_test->dma_private) { -- dev_err(dev, "Cannot transfer data using DMA\n"); -+ if (!dma_has_cap(DMA_MEMCPY, epf_test->dma_chan_tx->device->cap_mask)) { -+ dev_err(dev, "DMA controller doesn't support MEMCPY\n"); - ret = -EINVAL; - goto err_map_addr; - } -diff --git a/drivers/pci/endpoint/pci-epc-core.c b/drivers/pci/endpoint/pci-epc-core.c -index d06623c751f84e..3a82c6a613a3c9 100644 ---- a/drivers/pci/endpoint/pci-epc-core.c -+++ b/drivers/pci/endpoint/pci-epc-core.c -@@ -808,7 +808,7 @@ void devm_pci_epc_destroy(struct device *dev, struct pci_epc *epc) - { - int r; - -- r = devres_destroy(dev, devm_pci_epc_release, devm_pci_epc_match, -+ r = devres_release(dev, devm_pci_epc_release, devm_pci_epc_match, - epc); - dev_WARN_ONCE(dev, r, "couldn't find PCI EPC resource\n"); - } -diff --git a/drivers/pinctrl/nxp/pinctrl-s32cc.c b/drivers/pinctrl/nxp/pinctrl-s32cc.c -index f0cad2c501f766..08d80fb935b3ad 100644 ---- a/drivers/pinctrl/nxp/pinctrl-s32cc.c -+++ b/drivers/pinctrl/nxp/pinctrl-s32cc.c -@@ -735,9 +735,7 @@ static int s32_pinctrl_parse_groups(struct device_node *np, - struct s32_pin_group *grp, - struct s32_pinctrl_soc_info *info) - { -- const __be32 *p; - struct device *dev; -- struct property *prop; - unsigned int *pins, *sss; - int i, npins; - u32 pinmux; -@@ -768,7 +766,7 @@ static int s32_pinctrl_parse_groups(struct device_node *np, - return -ENOMEM; - - i = 0; -- of_property_for_each_u32(np, "pinmux", prop, p, pinmux) { -+ of_property_for_each_u32(np, "pinmux", pinmux) { - pins[i] = get_pin_no(pinmux); - sss[i] = get_pin_func(pinmux); - -diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c -index 86034c457c0436..75bff325a42519 100644 ---- a/drivers/pinctrl/pinctrl-amd.c -+++ b/drivers/pinctrl/pinctrl-amd.c -@@ -908,12 +908,13 @@ static bool amd_gpio_should_save(struct amd_gpio *gpio_dev, unsigned int pin) - return false; - } - --static int amd_gpio_suspend(struct device *dev) -+static int amd_gpio_suspend_hibernate_common(struct device *dev, bool is_suspend) - { - struct amd_gpio *gpio_dev = dev_get_drvdata(dev); - struct pinctrl_desc *desc = gpio_dev->pctrl->desc; - unsigned long flags; - int i; -+ u32 wake_mask = is_suspend ? WAKE_SOURCE_SUSPEND : WAKE_SOURCE_HIBERNATE; - - for (i = 0; i < desc->npins; i++) { - int pin = desc->pins[i].number; -@@ -925,11 +926,11 @@ static int amd_gpio_suspend(struct device *dev) - gpio_dev->saved_regs[i] = readl(gpio_dev->base + pin * 4) & ~PIN_IRQ_PENDING; - - /* mask any interrupts not intended to be a wake source */ -- if (!(gpio_dev->saved_regs[i] & WAKE_SOURCE)) { -+ if (!(gpio_dev->saved_regs[i] & wake_mask)) { - writel(gpio_dev->saved_regs[i] & ~BIT(INTERRUPT_MASK_OFF), - gpio_dev->base + pin * 4); -- pm_pr_dbg("Disabling GPIO #%d interrupt for suspend.\n", -- pin); -+ pm_pr_dbg("Disabling GPIO #%d interrupt for %s.\n", -+ pin, is_suspend ? "suspend" : "hibernate"); - } - - raw_spin_unlock_irqrestore(&gpio_dev->lock, flags); -@@ -938,6 +939,16 @@ static int amd_gpio_suspend(struct device *dev) - return 0; - } - -+static int amd_gpio_suspend(struct device *dev) -+{ -+ return amd_gpio_suspend_hibernate_common(dev, true); -+} -+ -+static int amd_gpio_hibernate(struct device *dev) -+{ -+ return amd_gpio_suspend_hibernate_common(dev, false); -+} -+ - static int amd_gpio_resume(struct device *dev) - { - struct amd_gpio *gpio_dev = dev_get_drvdata(dev); -@@ -961,8 +972,12 @@ static int amd_gpio_resume(struct device *dev) - } - - static const struct dev_pm_ops amd_gpio_pm_ops = { -- SET_LATE_SYSTEM_SLEEP_PM_OPS(amd_gpio_suspend, -- amd_gpio_resume) -+ .suspend_late = amd_gpio_suspend, -+ .resume_early = amd_gpio_resume, -+ .freeze_late = amd_gpio_hibernate, -+ .thaw_early = amd_gpio_resume, -+ .poweroff_late = amd_gpio_hibernate, -+ .restore_early = amd_gpio_resume, - }; - #endif - -diff --git a/drivers/pinctrl/pinctrl-amd.h b/drivers/pinctrl/pinctrl-amd.h -index cf59089f277639..c9522c62d7910f 100644 ---- a/drivers/pinctrl/pinctrl-amd.h -+++ b/drivers/pinctrl/pinctrl-amd.h -@@ -80,10 +80,9 @@ - #define FUNCTION_MASK GENMASK(1, 0) - #define FUNCTION_INVALID GENMASK(7, 0) - --#define WAKE_SOURCE (BIT(WAKE_CNTRL_OFF_S0I3) | \ -- BIT(WAKE_CNTRL_OFF_S3) | \ -- BIT(WAKE_CNTRL_OFF_S4) | \ -- BIT(WAKECNTRL_Z_OFF)) -+#define WAKE_SOURCE_SUSPEND (BIT(WAKE_CNTRL_OFF_S0I3) | \ -+ BIT(WAKE_CNTRL_OFF_S3)) -+#define WAKE_SOURCE_HIBERNATE BIT(WAKE_CNTRL_OFF_S4) - - struct amd_function { - const char *name; -diff --git a/drivers/pinctrl/pinctrl-k210.c b/drivers/pinctrl/pinctrl-k210.c -index 7c05dbf533e7a3..558fc2ad976fc8 100644 ---- a/drivers/pinctrl/pinctrl-k210.c -+++ b/drivers/pinctrl/pinctrl-k210.c -@@ -763,8 +763,6 @@ static int k210_pinctrl_dt_subnode_to_map(struct pinctrl_dev *pctldev, - unsigned int *reserved_maps, - unsigned int *num_maps) - { -- struct property *prop; -- const __be32 *p; - int ret, pinmux_groups; - u32 pinmux_group; - unsigned long *configs = NULL; -@@ -797,7 +795,7 @@ static int k210_pinctrl_dt_subnode_to_map(struct pinctrl_dev *pctldev, - if (ret < 0) - goto exit; - -- of_property_for_each_u32(np, "pinmux", prop, p, pinmux_group) { -+ of_property_for_each_u32(np, "pinmux", pinmux_group) { - const char *group_name, *func_name; - u32 pin = FIELD_GET(K210_PG_PIN, pinmux_group); - u32 func = FIELD_GET(K210_PG_FUNC, pinmux_group); -diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c -index 5e91def6078474..84121b125d90ed 100644 ---- a/drivers/pinctrl/stm32/pinctrl-stm32.c -+++ b/drivers/pinctrl/stm32/pinctrl-stm32.c -@@ -86,7 +86,6 @@ struct stm32_pinctrl_group { - - struct stm32_gpio_bank { - void __iomem *base; -- struct clk *clk; - struct reset_control *rstc; - spinlock_t lock; - struct gpio_chip gpio_chip; -@@ -108,6 +107,7 @@ struct stm32_pinctrl { - unsigned ngroups; - const char **grp_names; - struct stm32_gpio_bank *banks; -+ struct clk_bulk_data *clks; - unsigned nbanks; - const struct stm32_pinctrl_match_data *match_data; - struct irq_domain *domain; -@@ -1321,12 +1321,6 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, struct fwnode - if (IS_ERR(bank->base)) - return PTR_ERR(bank->base); - -- err = clk_prepare_enable(bank->clk); -- if (err) { -- dev_err(dev, "failed to prepare_enable clk (%d)\n", err); -- return err; -- } -- - bank->gpio_chip = stm32_gpio_template; - - fwnode_property_read_string(fwnode, "st,bank-name", &bank->gpio_chip.label); -@@ -1373,26 +1367,20 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, struct fwnode - bank->fwnode, &stm32_gpio_domain_ops, - bank); - -- if (!bank->domain) { -- err = -ENODEV; -- goto err_clk; -- } -+ if (!bank->domain) -+ return -ENODEV; - } - - names = devm_kcalloc(dev, npins, sizeof(char *), GFP_KERNEL); -- if (!names) { -- err = -ENOMEM; -- goto err_clk; -- } -+ if (!names) -+ return -ENOMEM; - - for (i = 0; i < npins; i++) { - stm32_pin = stm32_pctrl_get_desc_pin_from_gpio(pctl, bank, i); - if (stm32_pin && stm32_pin->pin.name) { - names[i] = devm_kasprintf(dev, GFP_KERNEL, "%s", stm32_pin->pin.name); -- if (!names[i]) { -- err = -ENOMEM; -- goto err_clk; -- } -+ if (!names[i]) -+ return -ENOMEM; - } else { - names[i] = NULL; - } -@@ -1403,15 +1391,11 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, struct fwnode - err = gpiochip_add_data(&bank->gpio_chip, bank); - if (err) { - dev_err(dev, "Failed to add gpiochip(%d)!\n", bank_nr); -- goto err_clk; -+ return err; - } - - dev_info(dev, "%s bank added\n", bank->gpio_chip.label); - return 0; -- --err_clk: -- clk_disable_unprepare(bank->clk); -- return err; - } - - static struct irq_domain *stm32_pctrl_get_irq_domain(struct platform_device *pdev) -@@ -1634,6 +1618,11 @@ int stm32_pctl_probe(struct platform_device *pdev) - if (!pctl->banks) - return -ENOMEM; - -+ pctl->clks = devm_kcalloc(dev, banks, sizeof(*pctl->clks), -+ GFP_KERNEL); -+ if (!pctl->clks) -+ return -ENOMEM; -+ - i = 0; - for_each_gpiochip_node(dev, child) { - struct stm32_gpio_bank *bank = &pctl->banks[i]; -@@ -1645,24 +1634,27 @@ int stm32_pctl_probe(struct platform_device *pdev) - return -EPROBE_DEFER; - } - -- bank->clk = of_clk_get_by_name(np, NULL); -- if (IS_ERR(bank->clk)) { -+ pctl->clks[i].clk = of_clk_get_by_name(np, NULL); -+ if (IS_ERR(pctl->clks[i].clk)) { - fwnode_handle_put(child); -- return dev_err_probe(dev, PTR_ERR(bank->clk), -+ return dev_err_probe(dev, PTR_ERR(pctl->clks[i].clk), - "failed to get clk\n"); - } -+ pctl->clks[i].id = "pctl"; - i++; - } - -+ ret = clk_bulk_prepare_enable(banks, pctl->clks); -+ if (ret) { -+ dev_err(dev, "failed to prepare_enable clk (%d)\n", ret); -+ return ret; -+ } -+ - for_each_gpiochip_node(dev, child) { - ret = stm32_gpiolib_register_bank(pctl, child); - if (ret) { - fwnode_handle_put(child); -- -- for (i = 0; i < pctl->nbanks; i++) -- clk_disable_unprepare(pctl->banks[i].clk); -- -- return ret; -+ goto err_register; - } - - pctl->nbanks++; -@@ -1671,6 +1663,15 @@ int stm32_pctl_probe(struct platform_device *pdev) - dev_info(dev, "Pinctrl STM32 initialized\n"); - - return 0; -+err_register: -+ for (i = 0; i < pctl->nbanks; i++) { -+ struct stm32_gpio_bank *bank = &pctl->banks[i]; -+ -+ gpiochip_remove(&bank->gpio_chip); -+ } -+ -+ clk_bulk_disable_unprepare(banks, pctl->clks); -+ return ret; - } - - static int __maybe_unused stm32_pinctrl_restore_gpio_regs( -@@ -1739,10 +1740,8 @@ static int __maybe_unused stm32_pinctrl_restore_gpio_regs( - int __maybe_unused stm32_pinctrl_suspend(struct device *dev) - { - struct stm32_pinctrl *pctl = dev_get_drvdata(dev); -- int i; - -- for (i = 0; i < pctl->nbanks; i++) -- clk_disable(pctl->banks[i].clk); -+ clk_bulk_disable(pctl->nbanks, pctl->clks); - - return 0; - } -@@ -1751,10 +1750,11 @@ int __maybe_unused stm32_pinctrl_resume(struct device *dev) - { - struct stm32_pinctrl *pctl = dev_get_drvdata(dev); - struct stm32_pinctrl_group *g = pctl->groups; -- int i; -+ int i, ret; - -- for (i = 0; i < pctl->nbanks; i++) -- clk_enable(pctl->banks[i].clk); -+ ret = clk_bulk_enable(pctl->nbanks, pctl->clks); -+ if (ret) -+ return ret; - - for (i = 0; i < pctl->ngroups; i++, g++) - stm32_pinctrl_restore_gpio_regs(pctl, g->pin); -diff --git a/drivers/pps/clients/pps-gpio.c b/drivers/pps/clients/pps-gpio.c -index 2f4b11b4dfcd91..bf3b6f1aa98425 100644 ---- a/drivers/pps/clients/pps-gpio.c -+++ b/drivers/pps/clients/pps-gpio.c -@@ -214,8 +214,8 @@ static int pps_gpio_probe(struct platform_device *pdev) - return -EINVAL; - } - -- dev_info(data->pps->dev, "Registered IRQ %d as PPS source\n", -- data->irq); -+ dev_dbg(&data->pps->dev, "Registered IRQ %d as PPS source\n", -+ data->irq); - - return 0; - } -diff --git a/drivers/pps/clients/pps-ktimer.c b/drivers/pps/clients/pps-ktimer.c -index d33106bd7a290f..2f465549b843f7 100644 ---- a/drivers/pps/clients/pps-ktimer.c -+++ b/drivers/pps/clients/pps-ktimer.c -@@ -56,7 +56,7 @@ static struct pps_source_info pps_ktimer_info = { - - static void __exit pps_ktimer_exit(void) - { -- dev_info(pps->dev, "ktimer PPS source unregistered\n"); -+ dev_dbg(&pps->dev, "ktimer PPS source unregistered\n"); - - del_timer_sync(&ktimer); - pps_unregister_source(pps); -@@ -74,7 +74,7 @@ static int __init pps_ktimer_init(void) - timer_setup(&ktimer, pps_ktimer_event, 0); - mod_timer(&ktimer, jiffies + HZ); - -- dev_info(pps->dev, "ktimer PPS source registered\n"); -+ dev_dbg(&pps->dev, "ktimer PPS source registered\n"); - - return 0; - } -diff --git a/drivers/pps/clients/pps-ldisc.c b/drivers/pps/clients/pps-ldisc.c -index 443d6bae19d14d..fa5660f3c4b707 100644 ---- a/drivers/pps/clients/pps-ldisc.c -+++ b/drivers/pps/clients/pps-ldisc.c -@@ -32,7 +32,7 @@ static void pps_tty_dcd_change(struct tty_struct *tty, bool active) - pps_event(pps, &ts, active ? PPS_CAPTUREASSERT : - PPS_CAPTURECLEAR, NULL); - -- dev_dbg(pps->dev, "PPS %s at %lu\n", -+ dev_dbg(&pps->dev, "PPS %s at %lu\n", - active ? "assert" : "clear", jiffies); - } - -@@ -69,7 +69,7 @@ static int pps_tty_open(struct tty_struct *tty) - goto err_unregister; - } - -- dev_info(pps->dev, "source \"%s\" added\n", info.path); -+ dev_dbg(&pps->dev, "source \"%s\" added\n", info.path); - - return 0; - -@@ -89,7 +89,7 @@ static void pps_tty_close(struct tty_struct *tty) - if (WARN_ON(!pps)) - return; - -- dev_info(pps->dev, "removed\n"); -+ dev_info(&pps->dev, "removed\n"); - pps_unregister_source(pps); - } - -diff --git a/drivers/pps/clients/pps_parport.c b/drivers/pps/clients/pps_parport.c -index 53e9c304ae0a7a..c3f46efd64c324 100644 ---- a/drivers/pps/clients/pps_parport.c -+++ b/drivers/pps/clients/pps_parport.c -@@ -81,7 +81,7 @@ static void parport_irq(void *handle) - /* check the signal (no signal means the pulse is lost this time) */ - if (!signal_is_set(port)) { - local_irq_restore(flags); -- dev_err(dev->pps->dev, "lost the signal\n"); -+ dev_err(&dev->pps->dev, "lost the signal\n"); - goto out_assert; - } - -@@ -98,7 +98,7 @@ static void parport_irq(void *handle) - /* timeout */ - dev->cw_err++; - if (dev->cw_err >= CLEAR_WAIT_MAX_ERRORS) { -- dev_err(dev->pps->dev, "disabled clear edge capture after %d" -+ dev_err(&dev->pps->dev, "disabled clear edge capture after %d" - " timeouts\n", dev->cw_err); - dev->cw = 0; - dev->cw_err = 0; -diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c -index d9d566f70ed199..92d1b62ea239d7 100644 ---- a/drivers/pps/kapi.c -+++ b/drivers/pps/kapi.c -@@ -41,7 +41,7 @@ static void pps_add_offset(struct pps_ktime *ts, struct pps_ktime *offset) - static void pps_echo_client_default(struct pps_device *pps, int event, - void *data) - { -- dev_info(pps->dev, "echo %s %s\n", -+ dev_info(&pps->dev, "echo %s %s\n", - event & PPS_CAPTUREASSERT ? "assert" : "", - event & PPS_CAPTURECLEAR ? "clear" : ""); - } -@@ -112,7 +112,7 @@ struct pps_device *pps_register_source(struct pps_source_info *info, - goto kfree_pps; - } - -- dev_info(pps->dev, "new PPS source %s\n", info->name); -+ dev_dbg(&pps->dev, "new PPS source %s\n", info->name); - - return pps; - -@@ -166,7 +166,7 @@ void pps_event(struct pps_device *pps, struct pps_event_time *ts, int event, - /* check event type */ - BUG_ON((event & (PPS_CAPTUREASSERT | PPS_CAPTURECLEAR)) == 0); - -- dev_dbg(pps->dev, "PPS event at %lld.%09ld\n", -+ dev_dbg(&pps->dev, "PPS event at %lld.%09ld\n", - (s64)ts->ts_real.tv_sec, ts->ts_real.tv_nsec); - - timespec_to_pps_ktime(&ts_real, ts->ts_real); -@@ -188,7 +188,7 @@ void pps_event(struct pps_device *pps, struct pps_event_time *ts, int event, - /* Save the time stamp */ - pps->assert_tu = ts_real; - pps->assert_sequence++; -- dev_dbg(pps->dev, "capture assert seq #%u\n", -+ dev_dbg(&pps->dev, "capture assert seq #%u\n", - pps->assert_sequence); - - captured = ~0; -@@ -202,7 +202,7 @@ void pps_event(struct pps_device *pps, struct pps_event_time *ts, int event, - /* Save the time stamp */ - pps->clear_tu = ts_real; - pps->clear_sequence++; -- dev_dbg(pps->dev, "capture clear seq #%u\n", -+ dev_dbg(&pps->dev, "capture clear seq #%u\n", - pps->clear_sequence); - - captured = ~0; -diff --git a/drivers/pps/kc.c b/drivers/pps/kc.c -index 50dc59af45be24..fbd23295afd7d9 100644 ---- a/drivers/pps/kc.c -+++ b/drivers/pps/kc.c -@@ -43,11 +43,11 @@ int pps_kc_bind(struct pps_device *pps, struct pps_bind_args *bind_args) - pps_kc_hardpps_mode = 0; - pps_kc_hardpps_dev = NULL; - spin_unlock_irq(&pps_kc_hardpps_lock); -- dev_info(pps->dev, "unbound kernel" -+ dev_info(&pps->dev, "unbound kernel" - " consumer\n"); - } else { - spin_unlock_irq(&pps_kc_hardpps_lock); -- dev_err(pps->dev, "selected kernel consumer" -+ dev_err(&pps->dev, "selected kernel consumer" - " is not bound\n"); - return -EINVAL; - } -@@ -57,11 +57,11 @@ int pps_kc_bind(struct pps_device *pps, struct pps_bind_args *bind_args) - pps_kc_hardpps_mode = bind_args->edge; - pps_kc_hardpps_dev = pps; - spin_unlock_irq(&pps_kc_hardpps_lock); -- dev_info(pps->dev, "bound kernel consumer: " -+ dev_info(&pps->dev, "bound kernel consumer: " - "edge=0x%x\n", bind_args->edge); - } else { - spin_unlock_irq(&pps_kc_hardpps_lock); -- dev_err(pps->dev, "another kernel consumer" -+ dev_err(&pps->dev, "another kernel consumer" - " is already bound\n"); - return -EINVAL; - } -@@ -83,7 +83,7 @@ void pps_kc_remove(struct pps_device *pps) - pps_kc_hardpps_mode = 0; - pps_kc_hardpps_dev = NULL; - spin_unlock_irq(&pps_kc_hardpps_lock); -- dev_info(pps->dev, "unbound kernel consumer" -+ dev_info(&pps->dev, "unbound kernel consumer" - " on device removal\n"); - } else - spin_unlock_irq(&pps_kc_hardpps_lock); -diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c -index 5d19baae6a380a..63f96357eb9fd8 100644 ---- a/drivers/pps/pps.c -+++ b/drivers/pps/pps.c -@@ -25,7 +25,7 @@ - * Local variables - */ - --static dev_t pps_devt; -+static int pps_major; - static struct class *pps_class; - - static DEFINE_MUTEX(pps_idr_lock); -@@ -62,7 +62,7 @@ static int pps_cdev_pps_fetch(struct pps_device *pps, struct pps_fdata *fdata) - else { - unsigned long ticks; - -- dev_dbg(pps->dev, "timeout %lld.%09d\n", -+ dev_dbg(&pps->dev, "timeout %lld.%09d\n", - (long long) fdata->timeout.sec, - fdata->timeout.nsec); - ticks = fdata->timeout.sec * HZ; -@@ -80,7 +80,7 @@ static int pps_cdev_pps_fetch(struct pps_device *pps, struct pps_fdata *fdata) - - /* Check for pending signals */ - if (err == -ERESTARTSYS) { -- dev_dbg(pps->dev, "pending signal caught\n"); -+ dev_dbg(&pps->dev, "pending signal caught\n"); - return -EINTR; - } - -@@ -98,7 +98,7 @@ static long pps_cdev_ioctl(struct file *file, - - switch (cmd) { - case PPS_GETPARAMS: -- dev_dbg(pps->dev, "PPS_GETPARAMS\n"); -+ dev_dbg(&pps->dev, "PPS_GETPARAMS\n"); - - spin_lock_irq(&pps->lock); - -@@ -114,7 +114,7 @@ static long pps_cdev_ioctl(struct file *file, - break; - - case PPS_SETPARAMS: -- dev_dbg(pps->dev, "PPS_SETPARAMS\n"); -+ dev_dbg(&pps->dev, "PPS_SETPARAMS\n"); - - /* Check the capabilities */ - if (!capable(CAP_SYS_TIME)) -@@ -124,14 +124,14 @@ static long pps_cdev_ioctl(struct file *file, - if (err) - return -EFAULT; - if (!(params.mode & (PPS_CAPTUREASSERT | PPS_CAPTURECLEAR))) { -- dev_dbg(pps->dev, "capture mode unspecified (%x)\n", -+ dev_dbg(&pps->dev, "capture mode unspecified (%x)\n", - params.mode); - return -EINVAL; - } - - /* Check for supported capabilities */ - if ((params.mode & ~pps->info.mode) != 0) { -- dev_dbg(pps->dev, "unsupported capabilities (%x)\n", -+ dev_dbg(&pps->dev, "unsupported capabilities (%x)\n", - params.mode); - return -EINVAL; - } -@@ -144,7 +144,7 @@ static long pps_cdev_ioctl(struct file *file, - /* Restore the read only parameters */ - if ((params.mode & (PPS_TSFMT_TSPEC | PPS_TSFMT_NTPFP)) == 0) { - /* section 3.3 of RFC 2783 interpreted */ -- dev_dbg(pps->dev, "time format unspecified (%x)\n", -+ dev_dbg(&pps->dev, "time format unspecified (%x)\n", - params.mode); - pps->params.mode |= PPS_TSFMT_TSPEC; - } -@@ -165,7 +165,7 @@ static long pps_cdev_ioctl(struct file *file, - break; - - case PPS_GETCAP: -- dev_dbg(pps->dev, "PPS_GETCAP\n"); -+ dev_dbg(&pps->dev, "PPS_GETCAP\n"); - - err = put_user(pps->info.mode, iuarg); - if (err) -@@ -176,7 +176,7 @@ static long pps_cdev_ioctl(struct file *file, - case PPS_FETCH: { - struct pps_fdata fdata; - -- dev_dbg(pps->dev, "PPS_FETCH\n"); -+ dev_dbg(&pps->dev, "PPS_FETCH\n"); - - err = copy_from_user(&fdata, uarg, sizeof(struct pps_fdata)); - if (err) -@@ -206,7 +206,7 @@ static long pps_cdev_ioctl(struct file *file, - case PPS_KC_BIND: { - struct pps_bind_args bind_args; - -- dev_dbg(pps->dev, "PPS_KC_BIND\n"); -+ dev_dbg(&pps->dev, "PPS_KC_BIND\n"); - - /* Check the capabilities */ - if (!capable(CAP_SYS_TIME)) -@@ -218,7 +218,7 @@ static long pps_cdev_ioctl(struct file *file, - - /* Check for supported capabilities */ - if ((bind_args.edge & ~pps->info.mode) != 0) { -- dev_err(pps->dev, "unsupported capabilities (%x)\n", -+ dev_err(&pps->dev, "unsupported capabilities (%x)\n", - bind_args.edge); - return -EINVAL; - } -@@ -227,7 +227,7 @@ static long pps_cdev_ioctl(struct file *file, - if (bind_args.tsformat != PPS_TSFMT_TSPEC || - (bind_args.edge & ~PPS_CAPTUREBOTH) != 0 || - bind_args.consumer != PPS_KC_HARDPPS) { -- dev_err(pps->dev, "invalid kernel consumer bind" -+ dev_err(&pps->dev, "invalid kernel consumer bind" - " parameters (%x)\n", bind_args.edge); - return -EINVAL; - } -@@ -259,7 +259,7 @@ static long pps_cdev_compat_ioctl(struct file *file, - struct pps_fdata fdata; - int err; - -- dev_dbg(pps->dev, "PPS_FETCH\n"); -+ dev_dbg(&pps->dev, "PPS_FETCH\n"); - - err = copy_from_user(&compat, uarg, sizeof(struct pps_fdata_compat)); - if (err) -@@ -296,20 +296,36 @@ static long pps_cdev_compat_ioctl(struct file *file, - #define pps_cdev_compat_ioctl NULL - #endif - -+static struct pps_device *pps_idr_get(unsigned long id) -+{ -+ struct pps_device *pps; -+ -+ mutex_lock(&pps_idr_lock); -+ pps = idr_find(&pps_idr, id); -+ if (pps) -+ get_device(&pps->dev); -+ -+ mutex_unlock(&pps_idr_lock); -+ return pps; -+} -+ - static int pps_cdev_open(struct inode *inode, struct file *file) - { -- struct pps_device *pps = container_of(inode->i_cdev, -- struct pps_device, cdev); -+ struct pps_device *pps = pps_idr_get(iminor(inode)); -+ -+ if (!pps) -+ return -ENODEV; -+ - file->private_data = pps; -- kobject_get(&pps->dev->kobj); - return 0; - } - - static int pps_cdev_release(struct inode *inode, struct file *file) - { -- struct pps_device *pps = container_of(inode->i_cdev, -- struct pps_device, cdev); -- kobject_put(&pps->dev->kobj); -+ struct pps_device *pps = file->private_data; -+ -+ WARN_ON(pps->id != iminor(inode)); -+ put_device(&pps->dev); - return 0; - } - -@@ -332,22 +348,13 @@ static void pps_device_destruct(struct device *dev) - { - struct pps_device *pps = dev_get_drvdata(dev); - -- cdev_del(&pps->cdev); -- -- /* Now we can release the ID for re-use */ - pr_debug("deallocating pps%d\n", pps->id); -- mutex_lock(&pps_idr_lock); -- idr_remove(&pps_idr, pps->id); -- mutex_unlock(&pps_idr_lock); -- -- kfree(dev); - kfree(pps); - } - - int pps_register_cdev(struct pps_device *pps) - { - int err; -- dev_t devt; - - mutex_lock(&pps_idr_lock); - /* -@@ -364,40 +371,29 @@ int pps_register_cdev(struct pps_device *pps) - goto out_unlock; - } - pps->id = err; -- mutex_unlock(&pps_idr_lock); -- -- devt = MKDEV(MAJOR(pps_devt), pps->id); -- -- cdev_init(&pps->cdev, &pps_cdev_fops); -- pps->cdev.owner = pps->info.owner; - -- err = cdev_add(&pps->cdev, devt, 1); -- if (err) { -- pr_err("%s: failed to add char device %d:%d\n", -- pps->info.name, MAJOR(pps_devt), pps->id); -+ pps->dev.class = pps_class; -+ pps->dev.parent = pps->info.dev; -+ pps->dev.devt = MKDEV(pps_major, pps->id); -+ dev_set_drvdata(&pps->dev, pps); -+ dev_set_name(&pps->dev, "pps%d", pps->id); -+ err = device_register(&pps->dev); -+ if (err) - goto free_idr; -- } -- pps->dev = device_create(pps_class, pps->info.dev, devt, pps, -- "pps%d", pps->id); -- if (IS_ERR(pps->dev)) { -- err = PTR_ERR(pps->dev); -- goto del_cdev; -- } - - /* Override the release function with our own */ -- pps->dev->release = pps_device_destruct; -+ pps->dev.release = pps_device_destruct; - -- pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, -- MAJOR(pps_devt), pps->id); -+ pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major, -+ pps->id); - -+ get_device(&pps->dev); -+ mutex_unlock(&pps_idr_lock); - return 0; - --del_cdev: -- cdev_del(&pps->cdev); -- - free_idr: -- mutex_lock(&pps_idr_lock); - idr_remove(&pps_idr, pps->id); -+ put_device(&pps->dev); - out_unlock: - mutex_unlock(&pps_idr_lock); - return err; -@@ -407,7 +403,13 @@ void pps_unregister_cdev(struct pps_device *pps) - { - pr_debug("unregistering pps%d\n", pps->id); - pps->lookup_cookie = NULL; -- device_destroy(pps_class, pps->dev->devt); -+ device_destroy(pps_class, pps->dev.devt); -+ -+ /* Now we can release the ID for re-use */ -+ mutex_lock(&pps_idr_lock); -+ idr_remove(&pps_idr, pps->id); -+ put_device(&pps->dev); -+ mutex_unlock(&pps_idr_lock); - } - - /* -@@ -427,6 +429,11 @@ void pps_unregister_cdev(struct pps_device *pps) - * so that it will not be used again, even if the pps device cannot - * be removed from the idr due to pending references holding the minor - * number in use. -+ * -+ * Since pps_idr holds a reference to the device, the returned -+ * pps_device is guaranteed to be valid until pps_unregister_cdev() is -+ * called on it. But after calling pps_unregister_cdev(), it may be -+ * freed at any time. - */ - struct pps_device *pps_lookup_dev(void const *cookie) - { -@@ -449,13 +456,11 @@ EXPORT_SYMBOL(pps_lookup_dev); - static void __exit pps_exit(void) - { - class_destroy(pps_class); -- unregister_chrdev_region(pps_devt, PPS_MAX_SOURCES); -+ __unregister_chrdev(pps_major, 0, PPS_MAX_SOURCES, "pps"); - } - - static int __init pps_init(void) - { -- int err; -- - pps_class = class_create("pps"); - if (IS_ERR(pps_class)) { - pr_err("failed to allocate class\n"); -@@ -463,8 +468,9 @@ static int __init pps_init(void) - } - pps_class->dev_groups = pps_groups; - -- err = alloc_chrdev_region(&pps_devt, 0, PPS_MAX_SOURCES, "pps"); -- if (err < 0) { -+ pps_major = __register_chrdev(0, 0, PPS_MAX_SOURCES, "pps", -+ &pps_cdev_fops); -+ if (pps_major < 0) { - pr_err("failed to allocate char device region\n"); - goto remove_class; - } -@@ -477,8 +483,7 @@ static int __init pps_init(void) - - remove_class: - class_destroy(pps_class); -- -- return err; -+ return pps_major; - } - - subsys_initcall(pps_init); -diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c -index 91cc6ffa0095e0..6f6019fb41c0c4 100644 ---- a/drivers/ptp/ptp_chardev.c -+++ b/drivers/ptp/ptp_chardev.c -@@ -4,6 +4,7 @@ - * - * Copyright (C) 2010 OMICRON electronics GmbH - */ -+#include - #include - #include - #include -@@ -124,6 +125,9 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg) - struct timespec64 ts; - int enable, err = 0; - -+ if (in_compat_syscall() && cmd != PTP_ENABLE_PPS && cmd != PTP_ENABLE_PPS2) -+ arg = (unsigned long)compat_ptr(arg); -+ - switch (cmd) { - - case PTP_CLOCK_GETCAPS: -diff --git a/drivers/ptp/ptp_ocp.c b/drivers/ptp/ptp_ocp.c -index a7a6947ab4bc59..13343c31987706 100644 ---- a/drivers/ptp/ptp_ocp.c -+++ b/drivers/ptp/ptp_ocp.c -@@ -4055,7 +4055,7 @@ ptp_ocp_complete(struct ptp_ocp *bp) - - pps = pps_lookup_dev(bp->ptp); - if (pps) -- ptp_ocp_symlink(bp, pps->dev, "pps"); -+ ptp_ocp_symlink(bp, &pps->dev, "pps"); - - ptp_ocp_debugfs_add_device(bp); - -diff --git a/drivers/pwm/pwm-samsung.c b/drivers/pwm/pwm-samsung.c -index e8828f57ab1502..7d0966b07dffbf 100644 ---- a/drivers/pwm/pwm-samsung.c -+++ b/drivers/pwm/pwm-samsung.c -@@ -521,8 +521,6 @@ static int pwm_samsung_parse_dt(struct samsung_pwm_chip *chip) - { - struct device_node *np = chip->chip.dev->of_node; - const struct of_device_id *match; -- struct property *prop; -- const __be32 *cur; - u32 val; - - match = of_match_node(samsung_pwm_matches, np); -@@ -531,7 +529,7 @@ static int pwm_samsung_parse_dt(struct samsung_pwm_chip *chip) - - memcpy(&chip->variant, match->data, sizeof(chip->variant)); - -- of_property_for_each_u32(np, "samsung,pwm-outputs", prop, cur, val) { -+ of_property_for_each_u32(np, "samsung,pwm-outputs", val) { - if (val >= SAMSUNG_PWM_NUM) { - dev_err(chip->chip.dev, - "%s: invalid channel index in samsung,pwm-outputs property\n", -diff --git a/drivers/pwm/pwm-stm32-lp.c b/drivers/pwm/pwm-stm32-lp.c -index bb3a045a733430..7799258638dfa9 100644 ---- a/drivers/pwm/pwm-stm32-lp.c -+++ b/drivers/pwm/pwm-stm32-lp.c -@@ -168,8 +168,12 @@ static int stm32_pwm_lp_get_state(struct pwm_chip *chip, - regmap_read(priv->regmap, STM32_LPTIM_CR, &val); - state->enabled = !!FIELD_GET(STM32_LPTIM_ENABLE, val); - /* Keep PWM counter clock refcount in sync with PWM initial state */ -- if (state->enabled) -- clk_enable(priv->clk); -+ if (state->enabled) { -+ int ret = clk_enable(priv->clk); -+ -+ if (ret) -+ return ret; -+ } - - regmap_read(priv->regmap, STM32_LPTIM_CFGR, &val); - presc = FIELD_GET(STM32_LPTIM_PRESC, val); -diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c -index b91a14c895bea8..67414b97ef4d27 100644 ---- a/drivers/pwm/pwm-stm32.c -+++ b/drivers/pwm/pwm-stm32.c -@@ -635,8 +635,11 @@ static int stm32_pwm_probe(struct platform_device *pdev) - priv->chip.npwm = stm32_pwm_detect_channels(priv, &num_enabled); - - /* Initialize clock refcount to number of enabled PWM channels. */ -- for (i = 0; i < num_enabled; i++) -- clk_enable(priv->clk); -+ for (i = 0; i < num_enabled; i++) { -+ ret = clk_enable(priv->clk); -+ if (ret) -+ return ret; -+ } - - ret = devm_pwmchip_add(dev, &priv->chip); - if (ret < 0) -diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c -index c96bf095695fd8..352131d2df4cad 100644 ---- a/drivers/regulator/core.c -+++ b/drivers/regulator/core.c -@@ -4876,7 +4876,7 @@ int _regulator_bulk_get(struct device *dev, int num_consumers, - consumers[i].supply, get_type); - if (IS_ERR(consumers[i].consumer)) { - ret = dev_err_probe(dev, PTR_ERR(consumers[i].consumer), -- "Failed to get supply '%s'", -+ "Failed to get supply '%s'\n", - consumers[i].supply); - consumers[i].consumer = NULL; - goto err; -diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c -index 59e71fd0db4390..f23c12f4ffbfad 100644 ---- a/drivers/regulator/of_regulator.c -+++ b/drivers/regulator/of_regulator.c -@@ -435,7 +435,7 @@ int of_regulator_match(struct device *dev, struct device_node *node, - "failed to parse DT for regulator %pOFn\n", - child); - of_node_put(child); -- return -EINVAL; -+ goto err_put; - } - match->of_node = of_node_get(child); - count++; -@@ -444,6 +444,18 @@ int of_regulator_match(struct device *dev, struct device_node *node, - } - - return count; -+ -+err_put: -+ for (i = 0; i < num_matches; i++) { -+ struct of_regulator_match *match = &matches[i]; -+ -+ match->init_data = NULL; -+ if (match->of_node) { -+ of_node_put(match->of_node); -+ match->of_node = NULL; -+ } -+ } -+ return -EINVAL; - } - EXPORT_SYMBOL_GPL(of_regulator_match); - -diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c -index 695cce218e8c64..e230af51a99b9f 100644 ---- a/drivers/remoteproc/remoteproc_core.c -+++ b/drivers/remoteproc/remoteproc_core.c -@@ -2465,6 +2465,13 @@ struct rproc *rproc_alloc(struct device *dev, const char *name, - rproc->dev.driver_data = rproc; - idr_init(&rproc->notifyids); - -+ /* Assign a unique device index and name */ -+ rproc->index = ida_alloc(&rproc_dev_index, GFP_KERNEL); -+ if (rproc->index < 0) { -+ dev_err(dev, "ida_alloc failed: %d\n", rproc->index); -+ goto put_device; -+ } -+ - rproc->name = kstrdup_const(name, GFP_KERNEL); - if (!rproc->name) - goto put_device; -@@ -2475,13 +2482,6 @@ struct rproc *rproc_alloc(struct device *dev, const char *name, - if (rproc_alloc_ops(rproc, ops)) - goto put_device; - -- /* Assign a unique device index and name */ -- rproc->index = ida_alloc(&rproc_dev_index, GFP_KERNEL); -- if (rproc->index < 0) { -- dev_err(dev, "ida_alloc failed: %d\n", rproc->index); -- goto put_device; -- } -- - dev_set_name(&rproc->dev, "remoteproc%d", rproc->index); - - atomic_set(&rproc->power, 0); -diff --git a/drivers/rtc/rtc-loongson.c b/drivers/rtc/rtc-loongson.c -index e8ffc1ab90b02f..90e9d97a86b487 100644 ---- a/drivers/rtc/rtc-loongson.c -+++ b/drivers/rtc/rtc-loongson.c -@@ -114,6 +114,13 @@ static irqreturn_t loongson_rtc_isr(int irq, void *id) - struct loongson_rtc_priv *priv = (struct loongson_rtc_priv *)id; - - rtc_update_irq(priv->rtcdev, 1, RTC_AF | RTC_IRQF); -+ -+ /* -+ * The TOY_MATCH0_REG should be cleared 0 here, -+ * otherwise the interrupt cannot be cleared. -+ */ -+ regmap_write(priv->regmap, TOY_MATCH0_REG, 0); -+ - return IRQ_HANDLED; - } - -@@ -131,11 +138,7 @@ static u32 loongson_rtc_handler(void *id) - writel(RTC_STS, priv->pm_base + PM1_STS_REG); - spin_unlock(&priv->lock); - -- /* -- * The TOY_MATCH0_REG should be cleared 0 here, -- * otherwise the interrupt cannot be cleared. -- */ -- return regmap_write(priv->regmap, TOY_MATCH0_REG, 0); -+ return ACPI_INTERRUPT_HANDLED; - } - - static int loongson_rtc_set_enabled(struct device *dev) -diff --git a/drivers/rtc/rtc-pcf85063.c b/drivers/rtc/rtc-pcf85063.c -index fdbc07f14036af..905986c616559b 100644 ---- a/drivers/rtc/rtc-pcf85063.c -+++ b/drivers/rtc/rtc-pcf85063.c -@@ -322,7 +322,16 @@ static const struct rtc_class_ops pcf85063_rtc_ops = { - static int pcf85063_nvmem_read(void *priv, unsigned int offset, - void *val, size_t bytes) - { -- return regmap_read(priv, PCF85063_REG_RAM, val); -+ unsigned int tmp; -+ int ret; -+ -+ ret = regmap_read(priv, PCF85063_REG_RAM, &tmp); -+ if (ret < 0) -+ return ret; -+ -+ *(u8 *)val = tmp; -+ -+ return 0; - } - - static int pcf85063_nvmem_write(void *priv, unsigned int offset, -diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c -index a5d12b95fbd09f..cd00f196703551 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_base.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c -@@ -5638,8 +5638,7 @@ _base_static_config_pages(struct MPT3SAS_ADAPTER *ioc) - if (!ioc->is_gen35_ioc && ioc->manu_pg11.EEDPTagMode == 0) { - pr_err("%s: overriding NVDATA EEDPTagMode setting\n", - ioc->name); -- ioc->manu_pg11.EEDPTagMode &= ~0x3; -- ioc->manu_pg11.EEDPTagMode |= 0x1; -+ ioc->manu_pg11.EEDPTagMode = 0x1; - mpt3sas_config_set_manufacturing_pg11(ioc, &mpi_reply, - &ioc->manu_pg11); - } -diff --git a/drivers/soc/atmel/soc.c b/drivers/soc/atmel/soc.c -index cc9a3e107479ab..c892c7083ecc9c 100644 ---- a/drivers/soc/atmel/soc.c -+++ b/drivers/soc/atmel/soc.c -@@ -376,7 +376,7 @@ static const struct of_device_id at91_soc_allowed_list[] __initconst = { - - static int __init atmel_soc_device_init(void) - { -- struct device_node *np = of_find_node_by_path("/"); -+ struct device_node *np __free(device_node) = of_find_node_by_path("/"); - - if (!of_match_node(at91_soc_allowed_list, np)) - return 0; -diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c -index 3cfd262c1abc25..35ca8fda45aae3 100644 ---- a/drivers/spi/spi-omap2-mcspi.c -+++ b/drivers/spi/spi-omap2-mcspi.c -@@ -1521,10 +1521,15 @@ static int omap2_mcspi_probe(struct platform_device *pdev) - } - - mcspi->ref_clk = devm_clk_get_optional_enabled(&pdev->dev, NULL); -- if (IS_ERR(mcspi->ref_clk)) -- mcspi->ref_clk_hz = OMAP2_MCSPI_MAX_FREQ; -- else -+ if (IS_ERR(mcspi->ref_clk)) { -+ status = PTR_ERR(mcspi->ref_clk); -+ dev_err_probe(&pdev->dev, status, "Failed to get ref_clk"); -+ goto free_ctlr; -+ } -+ if (mcspi->ref_clk) - mcspi->ref_clk_hz = clk_get_rate(mcspi->ref_clk); -+ else -+ mcspi->ref_clk_hz = OMAP2_MCSPI_MAX_FREQ; - ctlr->max_speed_hz = mcspi->ref_clk_hz; - ctlr->min_speed_hz = mcspi->ref_clk_hz >> 15; - -diff --git a/drivers/spi/spi-zynq-qspi.c b/drivers/spi/spi-zynq-qspi.c -index 0db69a2a72ffcb..9358c75a30f440 100644 ---- a/drivers/spi/spi-zynq-qspi.c -+++ b/drivers/spi/spi-zynq-qspi.c -@@ -379,12 +379,21 @@ static int zynq_qspi_setup_op(struct spi_device *spi) - { - struct spi_controller *ctlr = spi->master; - struct zynq_qspi *qspi = spi_controller_get_devdata(ctlr); -+ int ret; - - if (ctlr->busy) - return -EBUSY; - -- clk_enable(qspi->refclk); -- clk_enable(qspi->pclk); -+ ret = clk_enable(qspi->refclk); -+ if (ret) -+ return ret; -+ -+ ret = clk_enable(qspi->pclk); -+ if (ret) { -+ clk_disable(qspi->refclk); -+ return ret; -+ } -+ - zynq_qspi_write(qspi, ZYNQ_QSPI_ENABLE_OFFSET, - ZYNQ_QSPI_ENABLE_ENABLE_MASK); - -diff --git a/drivers/staging/media/imx/imx-media-of.c b/drivers/staging/media/imx/imx-media-of.c -index 118bff988bc7e6..bb28daa4d71334 100644 ---- a/drivers/staging/media/imx/imx-media-of.c -+++ b/drivers/staging/media/imx/imx-media-of.c -@@ -54,22 +54,18 @@ int imx_media_add_of_subdevs(struct imx_media_dev *imxmd, - break; - - ret = imx_media_of_add_csi(imxmd, csi_np); -+ of_node_put(csi_np); - if (ret) { - /* unavailable or already added is not an error */ - if (ret == -ENODEV || ret == -EEXIST) { -- of_node_put(csi_np); - continue; - } - - /* other error, can't continue */ -- goto err_out; -+ return ret; - } - } - - return 0; -- --err_out: -- of_node_put(csi_np); -- return ret; - } - EXPORT_SYMBOL_GPL(imx_media_add_of_subdevs); -diff --git a/drivers/staging/media/max96712/max96712.c b/drivers/staging/media/max96712/max96712.c -index c44145284aa18f..edaa311d2009e1 100644 ---- a/drivers/staging/media/max96712/max96712.c -+++ b/drivers/staging/media/max96712/max96712.c -@@ -402,7 +402,6 @@ static int max96712_probe(struct i2c_client *client) - return -ENOMEM; - - priv->client = client; -- i2c_set_clientdata(client, priv); - - priv->regmap = devm_regmap_init_i2c(client, &max96712_i2c_regmap); - if (IS_ERR(priv->regmap)) -@@ -435,7 +434,8 @@ static int max96712_probe(struct i2c_client *client) - - static void max96712_remove(struct i2c_client *client) - { -- struct max96712_priv *priv = i2c_get_clientdata(client); -+ struct v4l2_subdev *sd = i2c_get_clientdata(client); -+ struct max96712_priv *priv = container_of(sd, struct max96712_priv, sd); - - v4l2_async_unregister_subdev(&priv->sd); - -diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c -index a17803da83f8cd..2b1b2928ef7b7c 100644 ---- a/drivers/tty/serial/8250/8250_port.c -+++ b/drivers/tty/serial/8250/8250_port.c -@@ -2074,7 +2074,8 @@ static void serial8250_break_ctl(struct uart_port *port, int break_state) - serial8250_rpm_put(up); - } - --static void wait_for_lsr(struct uart_8250_port *up, int bits) -+/* Returns true if @bits were set, false on timeout */ -+static bool wait_for_lsr(struct uart_8250_port *up, int bits) - { - unsigned int status, tmout = 10000; - -@@ -2089,11 +2090,11 @@ static void wait_for_lsr(struct uart_8250_port *up, int bits) - udelay(1); - touch_nmi_watchdog(); - } -+ -+ return (tmout != 0); - } - --/* -- * Wait for transmitter & holding register to empty -- */ -+/* Wait for transmitter and holding register to empty with timeout */ - static void wait_for_xmitr(struct uart_8250_port *up, int bits) - { - unsigned int tmout; -@@ -3350,6 +3351,16 @@ static void serial8250_console_restore(struct uart_8250_port *up) - serial8250_out_MCR(up, up->mcr | UART_MCR_DTR | UART_MCR_RTS); - } - -+static void fifo_wait_for_lsr(struct uart_8250_port *up, unsigned int count) -+{ -+ unsigned int i; -+ -+ for (i = 0; i < count; i++) { -+ if (wait_for_lsr(up, UART_LSR_THRE)) -+ return; -+ } -+} -+ - /* - * Print a string to the serial port using the device FIFO - * -@@ -3359,13 +3370,15 @@ static void serial8250_console_restore(struct uart_8250_port *up) - static void serial8250_console_fifo_write(struct uart_8250_port *up, - const char *s, unsigned int count) - { -- int i; - const char *end = s + count; - unsigned int fifosize = up->tx_loadsz; -+ unsigned int tx_count = 0; - bool cr_sent = false; -+ unsigned int i; - - while (s != end) { -- wait_for_lsr(up, UART_LSR_THRE); -+ /* Allow timeout for each byte of a possibly full FIFO */ -+ fifo_wait_for_lsr(up, fifosize); - - for (i = 0; i < fifosize && s != end; ++i) { - if (*s == '\n' && !cr_sent) { -@@ -3376,7 +3389,14 @@ static void serial8250_console_fifo_write(struct uart_8250_port *up, - cr_sent = false; - } - } -+ tx_count = i; - } -+ -+ /* -+ * Allow timeout for each byte written since the caller will only wait -+ * for UART_LSR_BOTH_EMPTY using the timeout of a single character -+ */ -+ fifo_wait_for_lsr(up, tx_count); - } - - /* -diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c -index f290fbe21d633e..8a2ce2ca6b394a 100644 ---- a/drivers/tty/serial/sc16is7xx.c -+++ b/drivers/tty/serial/sc16is7xx.c -@@ -1410,6 +1410,29 @@ static int sc16is7xx_setup_gpio_chip(struct sc16is7xx_port *s) - } - #endif - -+static void sc16is7xx_setup_irda_ports(struct sc16is7xx_port *s) -+{ -+ int i; -+ int ret; -+ int count; -+ u32 irda_port[2]; -+ struct device *dev = s->p[0].port.dev; -+ -+ count = device_property_count_u32(dev, "irda-mode-ports"); -+ if (count < 0 || count > ARRAY_SIZE(irda_port)) -+ return; -+ -+ ret = device_property_read_u32_array(dev, "irda-mode-ports", -+ irda_port, count); -+ if (ret) -+ return; -+ -+ for (i = 0; i < count; i++) { -+ if (irda_port[i] < s->devtype->nr_uart) -+ s->p[irda_port[i]].irda_mode = true; -+ } -+} -+ - /* - * Configure ports designated to operate as modem control lines. - */ -@@ -1603,16 +1626,7 @@ static int sc16is7xx_probe(struct device *dev, - sc16is7xx_power(&s->p[i].port, 0); - } - -- if (dev->of_node) { -- struct property *prop; -- const __be32 *p; -- u32 u; -- -- of_property_for_each_u32(dev->of_node, "irda-mode-ports", -- prop, p, u) -- if (u < devtype->nr_uart) -- s->p[u].irda_mode = true; -- } -+ sc16is7xx_setup_irda_ports(s); - - ret = sc16is7xx_setup_mctrl_ports(s, regmaps[0]); - if (ret) -diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c -index 6b4a28bcf2f5f5..5a314f5d7630a8 100644 ---- a/drivers/tty/sysrq.c -+++ b/drivers/tty/sysrq.c -@@ -759,8 +759,6 @@ static void sysrq_of_get_keyreset_config(void) - { - u32 key; - struct device_node *np; -- struct property *prop; -- const __be32 *p; - - np = of_find_node_by_path("/chosen/linux,sysrq-reset-seq"); - if (!np) { -@@ -771,7 +769,7 @@ static void sysrq_of_get_keyreset_config(void) - /* Reset in case a __weak definition was present */ - sysrq_reset_seq_len = 0; - -- of_property_for_each_u32(np, "keyset", prop, p, key) { -+ of_property_for_each_u32(np, "keyset", key) { - if (key == KEY_RESERVED || key > KEY_MAX || - sysrq_reset_seq_len == SYSRQ_KEY_RESET_MAX) - break; -diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c -index fec5993c66c39a..f21423a7a6d7db 100644 ---- a/drivers/ufs/core/ufs_bsg.c -+++ b/drivers/ufs/core/ufs_bsg.c -@@ -256,6 +256,7 @@ int ufs_bsg_probe(struct ufs_hba *hba) - q = bsg_setup_queue(bsg_dev, dev_name(bsg_dev), ufs_bsg_request, NULL, 0); - if (IS_ERR(q)) { - ret = PTR_ERR(q); -+ device_del(bsg_dev); - goto out; - } - -diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c -index fcb509059d7c49..318ae24a41f482 100644 ---- a/drivers/usb/dwc3/core.c -+++ b/drivers/usb/dwc3/core.c -@@ -1505,8 +1505,6 @@ static void dwc3_get_properties(struct dwc3 *dwc) - u8 tx_thr_num_pkt_prd = 0; - u8 tx_max_burst_prd = 0; - u8 tx_fifo_resize_max_num; -- const char *usb_psy_name; -- int ret; - - /* default to highest possible threshold */ - lpm_nyet_threshold = 0xf; -@@ -1541,13 +1539,6 @@ static void dwc3_get_properties(struct dwc3 *dwc) - - dwc->sys_wakeup = device_may_wakeup(dwc->sysdev); - -- ret = device_property_read_string(dev, "usb-psy-name", &usb_psy_name); -- if (ret >= 0) { -- dwc->usb_psy = power_supply_get_by_name(usb_psy_name); -- if (!dwc->usb_psy) -- dev_err(dev, "couldn't get usb power supply\n"); -- } -- - dwc->has_lpm_erratum = device_property_read_bool(dev, - "snps,has-lpm-erratum"); - device_property_read_u8(dev, "snps,lpm-nyet-threshold", -@@ -1887,6 +1878,23 @@ static int dwc3_get_clocks(struct dwc3 *dwc) - return 0; - } - -+static struct power_supply *dwc3_get_usb_power_supply(struct dwc3 *dwc) -+{ -+ struct power_supply *usb_psy; -+ const char *usb_psy_name; -+ int ret; -+ -+ ret = device_property_read_string(dwc->dev, "usb-psy-name", &usb_psy_name); -+ if (ret < 0) -+ return NULL; -+ -+ usb_psy = power_supply_get_by_name(usb_psy_name); -+ if (!usb_psy) -+ return ERR_PTR(-EPROBE_DEFER); -+ -+ return usb_psy; -+} -+ - static int dwc3_probe(struct platform_device *pdev) - { - struct device *dev = &pdev->dev; -@@ -1940,6 +1948,10 @@ static int dwc3_probe(struct platform_device *pdev) - - dwc3_get_properties(dwc); - -+ dwc->usb_psy = dwc3_get_usb_power_supply(dwc); -+ if (IS_ERR(dwc->usb_psy)) -+ return dev_err_probe(dev, PTR_ERR(dwc->usb_psy), "couldn't get usb power supply\n"); -+ - dwc->reset = devm_reset_control_array_get_optional_shared(dev); - if (IS_ERR(dwc->reset)) { - ret = PTR_ERR(dwc->reset); -diff --git a/drivers/usb/dwc3/dwc3-am62.c b/drivers/usb/dwc3/dwc3-am62.c -index 056ab7246a3a2c..47d9f56333fe8d 100644 ---- a/drivers/usb/dwc3/dwc3-am62.c -+++ b/drivers/usb/dwc3/dwc3-am62.c -@@ -160,6 +160,7 @@ static int phy_syscon_pll_refclk(struct dwc3_am62 *am62) - if (ret) - return ret; - -+ of_node_put(args.np); - am62->offset = args.args[0]; - - ret = regmap_update_bits(am62->syscon, am62->offset, PHY_PLL_REFCLK_MASK, am62->rate_code); -diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c -index 79ed2e6e576aab..8ac50b9155ac40 100644 ---- a/drivers/usb/gadget/function/f_tcm.c -+++ b/drivers/usb/gadget/function/f_tcm.c -@@ -1066,7 +1066,6 @@ static void usbg_cmd_work(struct work_struct *work) - out: - transport_send_check_condition_and_sense(se_cmd, - TCM_UNSUPPORTED_SCSI_OPCODE, 1); -- transport_generic_free_cmd(&cmd->se_cmd, 0); - } - - static struct usbg_cmd *usbg_get_cmd(struct f_uas *fu, -@@ -1195,7 +1194,6 @@ static void bot_cmd_work(struct work_struct *work) - out: - transport_send_check_condition_and_sense(se_cmd, - TCM_UNSUPPORTED_SCSI_OPCODE, 1); -- transport_generic_free_cmd(&cmd->se_cmd, 0); - } - - static int bot_submit_command(struct f_uas *fu, -@@ -2048,9 +2046,14 @@ static void tcm_delayed_set_alt(struct work_struct *wq) - - static int tcm_get_alt(struct usb_function *f, unsigned intf) - { -- if (intf == bot_intf_desc.bInterfaceNumber) -+ struct f_uas *fu = to_f_uas(f); -+ -+ if (fu->iface != intf) -+ return -EOPNOTSUPP; -+ -+ if (fu->flags & USBG_IS_BOT) - return USB_G_ALT_INT_BBB; -- if (intf == uasp_intf_desc.bInterfaceNumber) -+ else if (fu->flags & USBG_IS_UAS) - return USB_G_ALT_INT_UAS; - - return -EOPNOTSUPP; -@@ -2060,6 +2063,9 @@ static int tcm_set_alt(struct usb_function *f, unsigned intf, unsigned alt) - { - struct f_uas *fu = to_f_uas(f); - -+ if (fu->iface != intf) -+ return -EOPNOTSUPP; -+ - if ((alt == USB_G_ALT_INT_BBB) || (alt == USB_G_ALT_INT_UAS)) { - struct guas_setup_wq *work; - -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index 0d628af5c3ba50..4a081685a1953e 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -420,7 +420,8 @@ static void xhci_handle_stopped_cmd_ring(struct xhci_hcd *xhci, - if ((xhci->cmd_ring->dequeue != xhci->cmd_ring->enqueue) && - !(xhci->xhc_state & XHCI_STATE_DYING)) { - xhci->current_cmd = cur_cmd; -- xhci_mod_cmd_timer(xhci); -+ if (cur_cmd) -+ xhci_mod_cmd_timer(xhci); - xhci_ring_cmd_db(xhci); - } - } -diff --git a/drivers/usb/misc/usb251xb.c b/drivers/usb/misc/usb251xb.c -index 7da404f55a6d90..3970bf9ca818af 100644 ---- a/drivers/usb/misc/usb251xb.c -+++ b/drivers/usb/misc/usb251xb.c -@@ -382,11 +382,9 @@ static void usb251xb_get_ports_field(struct usb251xb *hub, - bool ds_only, u8 *fld) - { - struct device *dev = hub->dev; -- struct property *prop; -- const __be32 *p; - u32 port; - -- of_property_for_each_u32(dev->of_node, prop_name, prop, p, port) { -+ of_property_for_each_u32(dev->of_node, prop_name, port) { - if ((port >= ds_only ? 1 : 0) && (port <= port_cnt)) - *fld |= BIT(port); - else -diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c -index 7118551827f6a2..31ce2071224562 100644 ---- a/drivers/usb/typec/tcpm/tcpci.c -+++ b/drivers/usb/typec/tcpm/tcpci.c -@@ -26,6 +26,7 @@ - #define VPPS_NEW_MIN_PERCENT 95 - #define VPPS_VALID_MIN_MV 100 - #define VSINKDISCONNECT_PD_MIN_PERCENT 90 -+#define VPPS_SHUTDOWN_MIN_PERCENT 85 - - struct tcpci { - struct device *dev; -@@ -337,7 +338,8 @@ static int tcpci_enable_auto_vbus_discharge(struct tcpc_dev *dev, bool enable) - } - - static int tcpci_set_auto_vbus_discharge_threshold(struct tcpc_dev *dev, enum typec_pwr_opmode mode, -- bool pps_active, u32 requested_vbus_voltage_mv) -+ bool pps_active, u32 requested_vbus_voltage_mv, -+ u32 apdo_min_voltage_mv) - { - struct tcpci *tcpci = tcpc_to_tcpci(dev); - unsigned int pwr_ctrl, threshold = 0; -@@ -359,9 +361,12 @@ static int tcpci_set_auto_vbus_discharge_threshold(struct tcpc_dev *dev, enum ty - threshold = AUTO_DISCHARGE_DEFAULT_THRESHOLD_MV; - } else if (mode == TYPEC_PWR_MODE_PD) { - if (pps_active) -- threshold = ((VPPS_NEW_MIN_PERCENT * requested_vbus_voltage_mv / 100) - -- VSINKPD_MIN_IR_DROP_MV - VPPS_VALID_MIN_MV) * -- VSINKDISCONNECT_PD_MIN_PERCENT / 100; -+ /* -+ * To prevent disconnect when the source is in Current Limit Mode. -+ * Set the threshold to the lowest possible voltage vPpsShutdown (min) -+ */ -+ threshold = VPPS_SHUTDOWN_MIN_PERCENT * apdo_min_voltage_mv / 100 - -+ VSINKPD_MIN_IR_DROP_MV; - else - threshold = ((VSRC_NEW_MIN_PERCENT * requested_vbus_voltage_mv / 100) - - VSINKPD_MIN_IR_DROP_MV - VSRC_VALID_MIN_MV) * -diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c -index e053b6e99b9e46..790aadab72a31b 100644 ---- a/drivers/usb/typec/tcpm/tcpm.c -+++ b/drivers/usb/typec/tcpm/tcpm.c -@@ -2326,10 +2326,12 @@ static int tcpm_set_auto_vbus_discharge_threshold(struct tcpm_port *port, - return 0; - - ret = port->tcpc->set_auto_vbus_discharge_threshold(port->tcpc, mode, pps_active, -- requested_vbus_voltage); -+ requested_vbus_voltage, -+ port->pps_data.min_volt); - tcpm_log_force(port, -- "set_auto_vbus_discharge_threshold mode:%d pps_active:%c vbus:%u ret:%d", -- mode, pps_active ? 'y' : 'n', requested_vbus_voltage, ret); -+ "set_auto_vbus_discharge_threshold mode:%d pps_active:%c vbus:%u pps_apdo_min_volt:%u ret:%d", -+ mode, pps_active ? 'y' : 'n', requested_vbus_voltage, -+ port->pps_data.min_volt, ret); - - return ret; - } -@@ -4065,7 +4067,7 @@ static void run_state_machine(struct tcpm_port *port) - port->caps_count = 0; - port->pd_capable = true; - tcpm_set_state_cond(port, SRC_SEND_CAPABILITIES_TIMEOUT, -- PD_T_SEND_SOURCE_CAP); -+ PD_T_SENDER_RESPONSE); - } - break; - case SRC_SEND_CAPABILITIES_TIMEOUT: -diff --git a/drivers/vfio/iova_bitmap.c b/drivers/vfio/iova_bitmap.c -index 7af5b204990bb5..38b51613ecca90 100644 ---- a/drivers/vfio/iova_bitmap.c -+++ b/drivers/vfio/iova_bitmap.c -@@ -127,7 +127,7 @@ struct iova_bitmap { - static unsigned long iova_bitmap_offset_to_index(struct iova_bitmap *bitmap, - unsigned long iova) - { -- unsigned long pgsize = 1 << bitmap->mapped.pgshift; -+ unsigned long pgsize = 1UL << bitmap->mapped.pgshift; - - return iova / (BITS_PER_TYPE(*bitmap->bitmap) * pgsize); - } -diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c b/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c -index 0282d4eef139d4..3b16c3342cb77e 100644 ---- a/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c -+++ b/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c -@@ -102,6 +102,7 @@ struct device_node *dss_of_port_get_parent_device(struct device_node *port) - np = of_get_next_parent(np); - } - -+ of_node_put(np); - return NULL; - } - -diff --git a/drivers/watchdog/rti_wdt.c b/drivers/watchdog/rti_wdt.c -index 563d842014dfba..cc239251e19383 100644 ---- a/drivers/watchdog/rti_wdt.c -+++ b/drivers/watchdog/rti_wdt.c -@@ -301,6 +301,7 @@ static int rti_wdt_probe(struct platform_device *pdev) - node = of_parse_phandle(pdev->dev.of_node, "memory-region", 0); - if (node) { - ret = of_address_to_resource(node, 0, &res); -+ of_node_put(node); - if (ret) { - dev_err(dev, "No memory address assigned to the region.\n"); - goto err_iomap; -diff --git a/fs/afs/dir.c b/fs/afs/dir.c -index 897569e1d3a909..cdd2abdc8975d8 100644 ---- a/fs/afs/dir.c -+++ b/fs/afs/dir.c -@@ -1458,7 +1458,12 @@ static int afs_rmdir(struct inode *dir, struct dentry *dentry) - op->file[1].vnode = vnode; - } - -- return afs_do_sync_operation(op); -+ ret = afs_do_sync_operation(op); -+ -+ /* Not all systems that can host afs servers have ENOTEMPTY. */ -+ if (ret == -EEXIST) -+ ret = -ENOTEMPTY; -+ return ret; - - error: - return afs_put_operation(op); -diff --git a/fs/afs/internal.h b/fs/afs/internal.h -index 8dcc09cf0adbeb..2f135d19545b19 100644 ---- a/fs/afs/internal.h -+++ b/fs/afs/internal.h -@@ -1286,6 +1286,15 @@ extern void afs_send_simple_reply(struct afs_call *, const void *, size_t); - extern int afs_extract_data(struct afs_call *, bool); - extern int afs_protocol_error(struct afs_call *, enum afs_eproto_cause); - -+static inline void afs_see_call(struct afs_call *call, enum afs_call_trace why) -+{ -+ int r = refcount_read(&call->ref); -+ -+ trace_afs_call(call->debug_id, why, r, -+ atomic_read(&call->net->nr_outstanding_calls), -+ __builtin_return_address(0)); -+} -+ - static inline void afs_make_op_call(struct afs_operation *op, struct afs_call *call, - gfp_t gfp) - { -diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c -index d642d06a453be7..43154c70366ae1 100644 ---- a/fs/afs/rxrpc.c -+++ b/fs/afs/rxrpc.c -@@ -396,11 +396,16 @@ void afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call, gfp_t gfp) - return; - - error_do_abort: -- if (ret != -ECONNABORTED) { -+ if (ret != -ECONNABORTED) - rxrpc_kernel_abort_call(call->net->socket, rxcall, - RX_USER_ABORT, ret, - afs_abort_send_data_error); -- } else { -+ if (call->async) { -+ afs_see_call(call, afs_call_trace_async_abort); -+ return; -+ } -+ -+ if (ret == -ECONNABORTED) { - len = 0; - iov_iter_kvec(&msg.msg_iter, ITER_DEST, NULL, 0, 0); - rxrpc_kernel_recv_data(call->net->socket, rxcall, -@@ -412,6 +417,8 @@ void afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call, gfp_t gfp) - call->error = ret; - trace_afs_call_done(call); - error_kill_call: -+ if (call->async) -+ afs_see_call(call, afs_call_trace_async_kill); - if (call->type->done) - call->type->done(call); - -@@ -566,7 +573,6 @@ static void afs_deliver_to_call(struct afs_call *call) - abort_code = 0; - call_complete: - afs_set_call_complete(call, ret, remote_abort); -- state = AFS_CALL_COMPLETE; - goto done; - } - -diff --git a/fs/afs/xdr_fs.h b/fs/afs/xdr_fs.h -index 8ca8681645077d..cc5f143d21a347 100644 ---- a/fs/afs/xdr_fs.h -+++ b/fs/afs/xdr_fs.h -@@ -88,7 +88,7 @@ union afs_xdr_dir_block { - - struct { - struct afs_xdr_dir_hdr hdr; -- u8 alloc_ctrs[AFS_DIR_MAX_BLOCKS]; -+ u8 alloc_ctrs[AFS_DIR_BLOCKS_WITH_CTR]; - __be16 hashtable[AFS_DIR_HASHTBL_SIZE]; - } meta; - -diff --git a/fs/afs/yfsclient.c b/fs/afs/yfsclient.c -index 11571cca86c19a..01f333e691d644 100644 ---- a/fs/afs/yfsclient.c -+++ b/fs/afs/yfsclient.c -@@ -655,8 +655,9 @@ static int yfs_deliver_fs_remove_file2(struct afs_call *call) - static void yfs_done_fs_remove_file2(struct afs_call *call) - { - if (call->error == -ECONNABORTED && -- call->abort_code == RX_INVALID_OPERATION) { -- set_bit(AFS_SERVER_FL_NO_RM2, &call->server->flags); -+ (call->abort_code == RX_INVALID_OPERATION || -+ call->abort_code == RXGEN_OPCODE)) { -+ set_bit(AFS_SERVER_FL_NO_RM2, &call->op->server->flags); - call->op->flags |= AFS_OPERATION_DOWNGRADE; - } - } -diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c -index e33587a814098a..fb4992570c2b59 100644 ---- a/fs/btrfs/super.c -+++ b/fs/btrfs/super.c -@@ -1162,7 +1162,7 @@ static int btrfs_fill_super(struct super_block *sb, - - err = open_ctree(sb, fs_devices, (char *)data); - if (err) { -- btrfs_err(fs_info, "open_ctree failed"); -+ btrfs_err(fs_info, "open_ctree failed: %d", err); - return err; - } - -diff --git a/fs/buffer.c b/fs/buffer.c -index ecd8b47507ff80..4b86e971efd8a1 100644 ---- a/fs/buffer.c -+++ b/fs/buffer.c -@@ -1640,8 +1640,8 @@ EXPORT_SYMBOL(block_invalidate_folio); - * block_dirty_folio() via private_lock. try_to_free_buffers - * is already excluded via the folio lock. - */ --void folio_create_empty_buffers(struct folio *folio, unsigned long blocksize, -- unsigned long b_state) -+struct buffer_head *folio_create_empty_buffers(struct folio *folio, -+ unsigned long blocksize, unsigned long b_state) - { - struct buffer_head *bh, *head, *tail; - -@@ -1667,6 +1667,8 @@ void folio_create_empty_buffers(struct folio *folio, unsigned long blocksize, - } - folio_attach_private(folio, head); - spin_unlock(&folio->mapping->private_lock); -+ -+ return head; - } - EXPORT_SYMBOL(folio_create_empty_buffers); - -@@ -1768,13 +1770,15 @@ static struct buffer_head *folio_create_buffers(struct folio *folio, - struct inode *inode, - unsigned int b_state) - { -+ struct buffer_head *bh; -+ - BUG_ON(!folio_test_locked(folio)); - -- if (!folio_buffers(folio)) -- folio_create_empty_buffers(folio, -- 1 << READ_ONCE(inode->i_blkbits), -- b_state); -- return folio_buffers(folio); -+ bh = folio_buffers(folio); -+ if (!bh) -+ bh = folio_create_empty_buffers(folio, -+ 1 << READ_ONCE(inode->i_blkbits), b_state); -+ return bh; - } - - /* -@@ -2678,10 +2682,8 @@ int block_truncate_page(struct address_space *mapping, - return PTR_ERR(folio); - - bh = folio_buffers(folio); -- if (!bh) { -- folio_create_empty_buffers(folio, blocksize, 0); -- bh = folio_buffers(folio); -- } -+ if (!bh) -+ bh = folio_create_empty_buffers(folio, blocksize, 0); - - /* Find the buffer that contains "offset" */ - offset = offset_in_folio(folio, from); -diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c -index 32dbd1a828d010..0618af36f5506b 100644 ---- a/fs/dlm/lowcomms.c -+++ b/fs/dlm/lowcomms.c -@@ -460,7 +460,8 @@ static bool dlm_lowcomms_con_has_addr(const struct connection *con, - int dlm_lowcomms_addr(int nodeid, struct sockaddr_storage *addr, int len) - { - struct connection *con; -- bool ret, idx; -+ bool ret; -+ int idx; - - idx = srcu_read_lock(&connections_srcu); - con = nodeid2con(nodeid, GFP_NOFS); -diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c -index 166ec8942595e1..13268d1f8c75a6 100644 ---- a/fs/f2fs/dir.c -+++ b/fs/f2fs/dir.c -@@ -166,7 +166,8 @@ static unsigned long dir_block_index(unsigned int level, - static struct f2fs_dir_entry *find_in_block(struct inode *dir, - struct page *dentry_page, - const struct f2fs_filename *fname, -- int *max_slots) -+ int *max_slots, -+ bool use_hash) - { - struct f2fs_dentry_block *dentry_blk; - struct f2fs_dentry_ptr d; -@@ -174,7 +175,7 @@ static struct f2fs_dir_entry *find_in_block(struct inode *dir, - dentry_blk = (struct f2fs_dentry_block *)page_address(dentry_page); - - make_dentry_ptr_block(dir, &d, dentry_blk); -- return f2fs_find_target_dentry(&d, fname, max_slots); -+ return f2fs_find_target_dentry(&d, fname, max_slots, use_hash); - } - - #if IS_ENABLED(CONFIG_UNICODE) -@@ -251,7 +252,8 @@ static inline int f2fs_match_name(const struct inode *dir, - } - - struct f2fs_dir_entry *f2fs_find_target_dentry(const struct f2fs_dentry_ptr *d, -- const struct f2fs_filename *fname, int *max_slots) -+ const struct f2fs_filename *fname, int *max_slots, -+ bool use_hash) - { - struct f2fs_dir_entry *de; - unsigned long bit_pos = 0; -@@ -274,7 +276,7 @@ struct f2fs_dir_entry *f2fs_find_target_dentry(const struct f2fs_dentry_ptr *d, - continue; - } - -- if (de->hash_code == fname->hash) { -+ if (!use_hash || de->hash_code == fname->hash) { - res = f2fs_match_name(d->inode, fname, - d->filename[bit_pos], - le16_to_cpu(de->name_len)); -@@ -301,11 +303,12 @@ struct f2fs_dir_entry *f2fs_find_target_dentry(const struct f2fs_dentry_ptr *d, - static struct f2fs_dir_entry *find_in_level(struct inode *dir, - unsigned int level, - const struct f2fs_filename *fname, -- struct page **res_page) -+ struct page **res_page, -+ bool use_hash) - { - int s = GET_DENTRY_SLOTS(fname->disk_name.len); - unsigned int nbucket, nblock; -- unsigned int bidx, end_block; -+ unsigned int bidx, end_block, bucket_no; - struct page *dentry_page; - struct f2fs_dir_entry *de = NULL; - pgoff_t next_pgofs; -@@ -315,8 +318,11 @@ static struct f2fs_dir_entry *find_in_level(struct inode *dir, - nbucket = dir_buckets(level, F2FS_I(dir)->i_dir_level); - nblock = bucket_blocks(level); - -+ bucket_no = use_hash ? le32_to_cpu(fname->hash) % nbucket : 0; -+ -+start_find_bucket: - bidx = dir_block_index(level, F2FS_I(dir)->i_dir_level, -- le32_to_cpu(fname->hash) % nbucket); -+ bucket_no); - end_block = bidx + nblock; - - while (bidx < end_block) { -@@ -333,7 +339,7 @@ static struct f2fs_dir_entry *find_in_level(struct inode *dir, - } - } - -- de = find_in_block(dir, dentry_page, fname, &max_slots); -+ de = find_in_block(dir, dentry_page, fname, &max_slots, use_hash); - if (IS_ERR(de)) { - *res_page = ERR_CAST(de); - de = NULL; -@@ -350,12 +356,18 @@ static struct f2fs_dir_entry *find_in_level(struct inode *dir, - bidx++; - } - -- if (!de && room && F2FS_I(dir)->chash != fname->hash) { -- F2FS_I(dir)->chash = fname->hash; -- F2FS_I(dir)->clevel = level; -- } -+ if (de) -+ return de; - -- return de; -+ if (likely(use_hash)) { -+ if (room && F2FS_I(dir)->chash != fname->hash) { -+ F2FS_I(dir)->chash = fname->hash; -+ F2FS_I(dir)->clevel = level; -+ } -+ } else if (++bucket_no < nbucket) { -+ goto start_find_bucket; -+ } -+ return NULL; - } - - struct f2fs_dir_entry *__f2fs_find_entry(struct inode *dir, -@@ -366,11 +378,15 @@ struct f2fs_dir_entry *__f2fs_find_entry(struct inode *dir, - struct f2fs_dir_entry *de = NULL; - unsigned int max_depth; - unsigned int level; -+ bool use_hash = true; - - *res_page = NULL; - -+#if IS_ENABLED(CONFIG_UNICODE) -+start_find_entry: -+#endif - if (f2fs_has_inline_dentry(dir)) { -- de = f2fs_find_in_inline_dir(dir, fname, res_page); -+ de = f2fs_find_in_inline_dir(dir, fname, res_page, use_hash); - goto out; - } - -@@ -386,11 +402,18 @@ struct f2fs_dir_entry *__f2fs_find_entry(struct inode *dir, - } - - for (level = 0; level < max_depth; level++) { -- de = find_in_level(dir, level, fname, res_page); -+ de = find_in_level(dir, level, fname, res_page, use_hash); - if (de || IS_ERR(*res_page)) - break; - } -+ - out: -+#if IS_ENABLED(CONFIG_UNICODE) -+ if (IS_CASEFOLDED(dir) && !de && use_hash) { -+ use_hash = false; -+ goto start_find_entry; -+ } -+#endif - /* This is to increase the speed of f2fs_create */ - if (!de) - F2FS_I(dir)->task = current; -diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h -index 33620642ae5ec8..d28e3df61cc4fd 100644 ---- a/fs/f2fs/f2fs.h -+++ b/fs/f2fs/f2fs.h -@@ -3531,7 +3531,8 @@ int f2fs_prepare_lookup(struct inode *dir, struct dentry *dentry, - struct f2fs_filename *fname); - void f2fs_free_filename(struct f2fs_filename *fname); - struct f2fs_dir_entry *f2fs_find_target_dentry(const struct f2fs_dentry_ptr *d, -- const struct f2fs_filename *fname, int *max_slots); -+ const struct f2fs_filename *fname, int *max_slots, -+ bool use_hash); - int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d, - unsigned int start_pos, struct fscrypt_str *fstr); - void f2fs_do_make_empty_dir(struct inode *inode, struct inode *parent, -@@ -4148,7 +4149,8 @@ int f2fs_write_inline_data(struct inode *inode, struct page *page); - int f2fs_recover_inline_data(struct inode *inode, struct page *npage); - struct f2fs_dir_entry *f2fs_find_in_inline_dir(struct inode *dir, - const struct f2fs_filename *fname, -- struct page **res_page); -+ struct page **res_page, -+ bool use_hash); - int f2fs_make_empty_inline_dir(struct inode *inode, struct inode *parent, - struct page *ipage); - int f2fs_add_inline_entry(struct inode *dir, const struct f2fs_filename *fname, -diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c -index a3f8b4ed495efb..d5e8f3e40cc93b 100644 ---- a/fs/f2fs/inline.c -+++ b/fs/f2fs/inline.c -@@ -353,7 +353,8 @@ int f2fs_recover_inline_data(struct inode *inode, struct page *npage) - - struct f2fs_dir_entry *f2fs_find_in_inline_dir(struct inode *dir, - const struct f2fs_filename *fname, -- struct page **res_page) -+ struct page **res_page, -+ bool use_hash) - { - struct f2fs_sb_info *sbi = F2FS_SB(dir->i_sb); - struct f2fs_dir_entry *de; -@@ -370,7 +371,7 @@ struct f2fs_dir_entry *f2fs_find_in_inline_dir(struct inode *dir, - inline_dentry = inline_data_addr(dir, ipage); - - make_dentry_ptr_inline(dir, &d, inline_dentry); -- de = f2fs_find_target_dentry(&d, fname, NULL); -+ de = f2fs_find_target_dentry(&d, fname, NULL, use_hash); - unlock_page(ipage); - if (IS_ERR(de)) { - *res_page = ERR_CAST(de); -diff --git a/fs/file_table.c b/fs/file_table.c -index ee21b3da9d0812..234284ef72a9a5 100644 ---- a/fs/file_table.c -+++ b/fs/file_table.c -@@ -133,7 +133,7 @@ static struct ctl_table fs_stat_sysctls[] = { - .data = &sysctl_nr_open, - .maxlen = sizeof(unsigned int), - .mode = 0644, -- .proc_handler = proc_dointvec_minmax, -+ .proc_handler = proc_douintvec_minmax, - .extra1 = &sysctl_nr_open_min, - .extra2 = &sysctl_nr_open_max, - }, -diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c -index ff201753fd1814..9cddd78b11d416 100644 ---- a/fs/hostfs/hostfs_kern.c -+++ b/fs/hostfs/hostfs_kern.c -@@ -16,11 +16,17 @@ - #include - #include - #include -+#include -+#include - #include - #include "hostfs.h" - #include - #include - -+struct hostfs_fs_info { -+ char *host_root_path; -+}; -+ - struct hostfs_inode_info { - int fd; - fmode_t mode; -@@ -88,30 +94,17 @@ __uml_setup("hostfs=", hostfs_args, - static char *__dentry_name(struct dentry *dentry, char *name) - { - char *p = dentry_path_raw(dentry, name, PATH_MAX); -- char *root; -- size_t len; -- -- root = dentry->d_sb->s_fs_info; -- len = strlen(root); -- if (IS_ERR(p)) { -- __putname(name); -- return NULL; -- } -+ struct hostfs_fs_info *fsi = dentry->d_sb->s_fs_info; -+ char *root = fsi->host_root_path; -+ size_t len = strlen(root); - -- /* -- * This function relies on the fact that dentry_path_raw() will place -- * the path name at the end of the provided buffer. -- */ -- BUG_ON(p + strlen(p) + 1 != name + PATH_MAX); -- -- strscpy(name, root, PATH_MAX); -- if (len > p - name) { -+ if (IS_ERR(p) || len > p - name) { - __putname(name); - return NULL; - } - -- if (p > name + len) -- strcpy(name + len, p); -+ memcpy(name, root, len); -+ memmove(name + len, p, name + PATH_MAX - p); - - return name; - } -@@ -196,8 +189,10 @@ static int hostfs_statfs(struct dentry *dentry, struct kstatfs *sf) - long long f_bavail; - long long f_files; - long long f_ffree; -+ struct hostfs_fs_info *fsi; - -- err = do_statfs(dentry->d_sb->s_fs_info, -+ fsi = dentry->d_sb->s_fs_info; -+ err = do_statfs(fsi->host_root_path, - &sf->f_bsize, &f_blocks, &f_bfree, &f_bavail, &f_files, - &f_ffree, &sf->f_fsid, sizeof(sf->f_fsid), - &sf->f_namelen); -@@ -245,7 +240,11 @@ static void hostfs_free_inode(struct inode *inode) - - static int hostfs_show_options(struct seq_file *seq, struct dentry *root) - { -- const char *root_path = root->d_sb->s_fs_info; -+ struct hostfs_fs_info *fsi; -+ const char *root_path; -+ -+ fsi = root->d_sb->s_fs_info; -+ root_path = fsi->host_root_path; - size_t offset = strlen(root_ino) + 1; - - if (strlen(root_path) > offset) -@@ -924,10 +923,10 @@ static const struct inode_operations hostfs_link_iops = { - .get_link = hostfs_get_link, - }; - --static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent) -+static int hostfs_fill_super(struct super_block *sb, struct fs_context *fc) - { -+ struct hostfs_fs_info *fsi = sb->s_fs_info; - struct inode *root_inode; -- char *host_root_path, *req_root = d; - int err; - - sb->s_blocksize = 1024; -@@ -940,16 +939,7 @@ static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent) - if (err) - return err; - -- /* NULL is printed as '(null)' by printf(): avoid that. */ -- if (req_root == NULL) -- req_root = ""; -- -- sb->s_fs_info = host_root_path = -- kasprintf(GFP_KERNEL, "%s/%s", root_ino, req_root); -- if (host_root_path == NULL) -- return -ENOMEM; -- -- root_inode = hostfs_iget(sb, host_root_path); -+ root_inode = hostfs_iget(sb, fsi->host_root_path); - if (IS_ERR(root_inode)) - return PTR_ERR(root_inode); - -@@ -957,7 +947,7 @@ static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent) - char *name; - - iput(root_inode); -- name = follow_link(host_root_path); -+ name = follow_link(fsi->host_root_path); - if (IS_ERR(name)) - return PTR_ERR(name); - -@@ -974,11 +964,92 @@ static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent) - return 0; - } - --static struct dentry *hostfs_read_sb(struct file_system_type *type, -- int flags, const char *dev_name, -- void *data) -+enum hostfs_parma { -+ Opt_hostfs, -+}; -+ -+static const struct fs_parameter_spec hostfs_param_specs[] = { -+ fsparam_string_empty("hostfs", Opt_hostfs), -+ {} -+}; -+ -+static int hostfs_parse_param(struct fs_context *fc, struct fs_parameter *param) -+{ -+ struct hostfs_fs_info *fsi = fc->s_fs_info; -+ struct fs_parse_result result; -+ char *host_root; -+ int opt; -+ -+ opt = fs_parse(fc, hostfs_param_specs, param, &result); -+ if (opt < 0) -+ return opt; -+ -+ switch (opt) { -+ case Opt_hostfs: -+ host_root = param->string; -+ if (!*host_root) -+ host_root = ""; -+ fsi->host_root_path = -+ kasprintf(GFP_KERNEL, "%s/%s", root_ino, host_root); -+ if (fsi->host_root_path == NULL) -+ return -ENOMEM; -+ break; -+ } -+ -+ return 0; -+} -+ -+static int hostfs_parse_monolithic(struct fs_context *fc, void *data) -+{ -+ struct hostfs_fs_info *fsi = fc->s_fs_info; -+ char *host_root = (char *)data; -+ -+ /* NULL is printed as '(null)' by printf(): avoid that. */ -+ if (host_root == NULL) -+ host_root = ""; -+ -+ fsi->host_root_path = -+ kasprintf(GFP_KERNEL, "%s/%s", root_ino, host_root); -+ if (fsi->host_root_path == NULL) -+ return -ENOMEM; -+ -+ return 0; -+} -+ -+static int hostfs_fc_get_tree(struct fs_context *fc) -+{ -+ return get_tree_nodev(fc, hostfs_fill_super); -+} -+ -+static void hostfs_fc_free(struct fs_context *fc) -+{ -+ struct hostfs_fs_info *fsi = fc->s_fs_info; -+ -+ if (!fsi) -+ return; -+ -+ kfree(fsi->host_root_path); -+ kfree(fsi); -+} -+ -+static const struct fs_context_operations hostfs_context_ops = { -+ .parse_monolithic = hostfs_parse_monolithic, -+ .parse_param = hostfs_parse_param, -+ .get_tree = hostfs_fc_get_tree, -+ .free = hostfs_fc_free, -+}; -+ -+static int hostfs_init_fs_context(struct fs_context *fc) - { -- return mount_nodev(type, flags, data, hostfs_fill_sb_common); -+ struct hostfs_fs_info *fsi; -+ -+ fsi = kzalloc(sizeof(*fsi), GFP_KERNEL); -+ if (!fsi) -+ return -ENOMEM; -+ -+ fc->s_fs_info = fsi; -+ fc->ops = &hostfs_context_ops; -+ return 0; - } - - static void hostfs_kill_sb(struct super_block *s) -@@ -988,11 +1059,11 @@ static void hostfs_kill_sb(struct super_block *s) - } - - static struct file_system_type hostfs_type = { -- .owner = THIS_MODULE, -- .name = "hostfs", -- .mount = hostfs_read_sb, -- .kill_sb = hostfs_kill_sb, -- .fs_flags = 0, -+ .owner = THIS_MODULE, -+ .name = "hostfs", -+ .init_fs_context = hostfs_init_fs_context, -+ .kill_sb = hostfs_kill_sb, -+ .fs_flags = 0, - }; - MODULE_ALIAS_FS("hostfs"); - -diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c -index 531c9c20ef1d1b..9f0d69e6526443 100644 ---- a/fs/nfs/nfs42proc.c -+++ b/fs/nfs/nfs42proc.c -@@ -552,7 +552,7 @@ static int nfs42_do_offload_cancel_async(struct file *dst, - .rpc_message = &msg, - .callback_ops = &nfs42_offload_cancel_ops, - .workqueue = nfsiod_workqueue, -- .flags = RPC_TASK_ASYNC, -+ .flags = RPC_TASK_ASYNC | RPC_TASK_MOVEABLE, - }; - int status; - -diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c -index 9e3ae53e220583..becc3149aa9e5c 100644 ---- a/fs/nfs/nfs42xdr.c -+++ b/fs/nfs/nfs42xdr.c -@@ -144,9 +144,11 @@ - decode_putfh_maxsz + \ - decode_offload_cancel_maxsz) - #define NFS4_enc_copy_notify_sz (compound_encode_hdr_maxsz + \ -+ encode_sequence_maxsz + \ - encode_putfh_maxsz + \ - encode_copy_notify_maxsz) - #define NFS4_dec_copy_notify_sz (compound_decode_hdr_maxsz + \ -+ decode_sequence_maxsz + \ - decode_putfh_maxsz + \ - decode_copy_notify_maxsz) - #define NFS4_enc_deallocate_sz (compound_encode_hdr_maxsz + \ -diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c -index 54ffadf02e034f..875ea311ca3c20 100644 ---- a/fs/nfsd/nfs4callback.c -+++ b/fs/nfsd/nfs4callback.c -@@ -1202,6 +1202,7 @@ static bool nfsd4_cb_sequence_done(struct rpc_task *task, struct nfsd4_callback - ret = false; - break; - case -NFS4ERR_DELAY: -+ cb->cb_seq_status = 1; - if (!rpc_restart_call(task)) - goto out; - -diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c -index 0610cb12c11ca0..d4a98ac72b8eaa 100644 ---- a/fs/nilfs2/segment.c -+++ b/fs/nilfs2/segment.c -@@ -731,11 +731,9 @@ static size_t nilfs_lookup_dirty_data_buffers(struct inode *inode, - continue; - } - head = folio_buffers(folio); -- if (!head) { -- create_empty_buffers(&folio->page, i_blocksize(inode), 0); -- head = folio_buffers(folio); -- } -- folio_unlock(folio); -+ if (!head) -+ head = folio_create_empty_buffers(folio, -+ i_blocksize(inode), 0); - - bh = head; - do { -@@ -745,11 +743,14 @@ static size_t nilfs_lookup_dirty_data_buffers(struct inode *inode, - list_add_tail(&bh->b_assoc_buffers, listp); - ndirties++; - if (unlikely(ndirties >= nlimit)) { -+ folio_unlock(folio); - folio_batch_release(&fbatch); - cond_resched(); - return ndirties; - } - } while (bh = bh->b_this_page, bh != head); -+ -+ folio_unlock(folio); - } - folio_batch_release(&fbatch); - cond_resched(); -diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c -index 0dffd6a44d39dc..24b031dc44ee1e 100644 ---- a/fs/ocfs2/quota_global.c -+++ b/fs/ocfs2/quota_global.c -@@ -749,6 +749,11 @@ static int ocfs2_release_dquot(struct dquot *dquot) - handle = ocfs2_start_trans(osb, - ocfs2_calc_qdel_credits(dquot->dq_sb, dquot->dq_id.type)); - if (IS_ERR(handle)) { -+ /* -+ * Mark dquot as inactive to avoid endless cycle in -+ * quota_release_workfn(). -+ */ -+ clear_bit(DQ_ACTIVE_B, &dquot->dq_flags); - status = PTR_ERR(handle); - mlog_errno(status); - goto out_ilock; -diff --git a/fs/pstore/blk.c b/fs/pstore/blk.c -index de8cf5d75f34d5..85668cb31c3d2f 100644 ---- a/fs/pstore/blk.c -+++ b/fs/pstore/blk.c -@@ -89,7 +89,7 @@ static struct pstore_device_info *pstore_device_info; - _##name_ = check_size(name, alignsize); \ - else \ - _##name_ = 0; \ -- /* Synchronize module parameters with resuls. */ \ -+ /* Synchronize module parameters with results. */ \ - name = _##name_ / 1024; \ - dev->zone.name = _##name_; \ - } -@@ -121,7 +121,7 @@ static int __register_pstore_device(struct pstore_device_info *dev) - if (pstore_device_info) - return -EBUSY; - -- /* zero means not limit on which backends to attempt to store. */ -+ /* zero means no limit on which backends attempt to store. */ - if (!dev->flags) - dev->flags = UINT_MAX; - -diff --git a/fs/select.c b/fs/select.c -index d4d881d439dcdf..3f730b8581f65d 100644 ---- a/fs/select.c -+++ b/fs/select.c -@@ -788,7 +788,7 @@ static inline int get_sigset_argpack(struct sigset_argpack *to, - } - return 0; - Efault: -- user_access_end(); -+ user_read_access_end(); - return -EFAULT; - } - -@@ -1361,7 +1361,7 @@ static inline int get_compat_sigset_argpack(struct compat_sigset_argpack *to, - } - return 0; - Efault: -- user_access_end(); -+ user_read_access_end(); - return -EFAULT; - } - -diff --git a/fs/smb/client/cifsacl.c b/fs/smb/client/cifsacl.c -index bff8d0dd74fe7d..1fc1683b15bd84 100644 ---- a/fs/smb/client/cifsacl.c -+++ b/fs/smb/client/cifsacl.c -@@ -1395,7 +1395,7 @@ static int build_sec_desc(struct smb_ntsd *pntsd, struct smb_ntsd *pnntsd, - #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY - struct smb_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb, - const struct cifs_fid *cifsfid, u32 *pacllen, -- u32 __maybe_unused unused) -+ u32 info) - { - struct smb_ntsd *pntsd = NULL; - unsigned int xid; -@@ -1407,7 +1407,7 @@ struct smb_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb, - - xid = get_xid(); - rc = CIFSSMBGetCIFSACL(xid, tlink_tcon(tlink), cifsfid->netfid, &pntsd, -- pacllen); -+ pacllen, info); - free_xid(xid); - - cifs_put_tlink(tlink); -@@ -1419,7 +1419,7 @@ struct smb_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb, - } - - static struct smb_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb, -- const char *path, u32 *pacllen) -+ const char *path, u32 *pacllen, u32 info) - { - struct smb_ntsd *pntsd = NULL; - int oplock = 0; -@@ -1446,9 +1446,12 @@ static struct smb_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb, - .fid = &fid, - }; - -+ if (info & SACL_SECINFO) -+ oparms.desired_access |= SYSTEM_SECURITY; -+ - rc = CIFS_open(xid, &oparms, &oplock, NULL); - if (!rc) { -- rc = CIFSSMBGetCIFSACL(xid, tcon, fid.netfid, &pntsd, pacllen); -+ rc = CIFSSMBGetCIFSACL(xid, tcon, fid.netfid, &pntsd, pacllen, info); - CIFSSMBClose(xid, tcon, fid.netfid); - } - -@@ -1472,7 +1475,7 @@ struct smb_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb, - if (inode) - open_file = find_readable_file(CIFS_I(inode), true); - if (!open_file) -- return get_cifs_acl_by_path(cifs_sb, path, pacllen); -+ return get_cifs_acl_by_path(cifs_sb, path, pacllen, info); - - pntsd = get_cifs_acl_by_fid(cifs_sb, &open_file->fid, pacllen, info); - cifsFileInfo_put(open_file); -@@ -1485,7 +1488,7 @@ int set_cifs_acl(struct smb_ntsd *pnntsd, __u32 acllen, - { - int oplock = 0; - unsigned int xid; -- int rc, access_flags; -+ int rc, access_flags = 0; - struct cifs_tcon *tcon; - struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb); - struct tcon_link *tlink = cifs_sb_tlink(cifs_sb); -@@ -1498,10 +1501,12 @@ int set_cifs_acl(struct smb_ntsd *pnntsd, __u32 acllen, - tcon = tlink_tcon(tlink); - xid = get_xid(); - -- if (aclflag == CIFS_ACL_OWNER || aclflag == CIFS_ACL_GROUP) -- access_flags = WRITE_OWNER; -- else -- access_flags = WRITE_DAC; -+ if (aclflag & CIFS_ACL_OWNER || aclflag & CIFS_ACL_GROUP) -+ access_flags |= WRITE_OWNER; -+ if (aclflag & CIFS_ACL_SACL) -+ access_flags |= SYSTEM_SECURITY; -+ if (aclflag & CIFS_ACL_DACL) -+ access_flags |= WRITE_DAC; - - oparms = (struct cifs_open_parms) { - .tcon = tcon, -diff --git a/fs/smb/client/cifsproto.h b/fs/smb/client/cifsproto.h -index a151ffffc6f38e..85b0a30493a638 100644 ---- a/fs/smb/client/cifsproto.h -+++ b/fs/smb/client/cifsproto.h -@@ -570,7 +570,7 @@ extern int CIFSSMBSetEA(const unsigned int xid, struct cifs_tcon *tcon, - const struct nls_table *nls_codepage, - struct cifs_sb_info *cifs_sb); - extern int CIFSSMBGetCIFSACL(const unsigned int xid, struct cifs_tcon *tcon, -- __u16 fid, struct smb_ntsd **acl_inf, __u32 *buflen); -+ __u16 fid, struct smb_ntsd **acl_inf, __u32 *buflen, __u32 info); - extern int CIFSSMBSetCIFSACL(const unsigned int, struct cifs_tcon *, __u16, - struct smb_ntsd *pntsd, __u32 len, int aclflag); - extern int cifs_do_get_acl(const unsigned int xid, struct cifs_tcon *tcon, -diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c -index 2f8745736dbb02..769950adb7763b 100644 ---- a/fs/smb/client/cifssmb.c -+++ b/fs/smb/client/cifssmb.c -@@ -3385,7 +3385,7 @@ validate_ntransact(char *buf, char **ppparm, char **ppdata, - /* Get Security Descriptor (by handle) from remote server for a file or dir */ - int - CIFSSMBGetCIFSACL(const unsigned int xid, struct cifs_tcon *tcon, __u16 fid, -- struct smb_ntsd **acl_inf, __u32 *pbuflen) -+ struct smb_ntsd **acl_inf, __u32 *pbuflen, __u32 info) - { - int rc = 0; - int buf_type = 0; -@@ -3408,7 +3408,7 @@ CIFSSMBGetCIFSACL(const unsigned int xid, struct cifs_tcon *tcon, __u16 fid, - pSMB->MaxSetupCount = 0; - pSMB->Fid = fid; /* file handle always le */ - pSMB->AclFlags = cpu_to_le32(CIFS_ACL_OWNER | CIFS_ACL_GROUP | -- CIFS_ACL_DACL); -+ CIFS_ACL_DACL | info); - pSMB->ByteCount = cpu_to_le16(11); /* 3 bytes pad + 8 bytes parm */ - inc_rfc1001_len(pSMB, 11); - iov[0].iov_base = (char *)pSMB; -diff --git a/fs/smb/client/readdir.c b/fs/smb/client/readdir.c -index 3cffdf3975a213..75929a0a56f969 100644 ---- a/fs/smb/client/readdir.c -+++ b/fs/smb/client/readdir.c -@@ -413,7 +413,7 @@ _initiate_cifs_search(const unsigned int xid, struct file *file, - cifsFile->invalidHandle = false; - } else if ((rc == -EOPNOTSUPP) && - (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)) { -- cifs_sb->mnt_cifs_flags &= ~CIFS_MOUNT_SERVER_INUM; -+ cifs_autodisable_serverino(cifs_sb); - goto ffirst_retry; - } - error_exit: -diff --git a/fs/smb/client/reparse.c b/fs/smb/client/reparse.c -index d3abb99cc99094..e56a8df23fec9a 100644 ---- a/fs/smb/client/reparse.c -+++ b/fs/smb/client/reparse.c -@@ -674,11 +674,12 @@ int smb2_parse_reparse_point(struct cifs_sb_info *cifs_sb, - return parse_reparse_point(buf, plen, cifs_sb, full_path, true, data); - } - --static void wsl_to_fattr(struct cifs_open_info_data *data, -+static bool wsl_to_fattr(struct cifs_open_info_data *data, - struct cifs_sb_info *cifs_sb, - u32 tag, struct cifs_fattr *fattr) - { - struct smb2_file_full_ea_info *ea; -+ bool have_xattr_dev = false; - u32 next = 0; - - switch (tag) { -@@ -721,13 +722,24 @@ static void wsl_to_fattr(struct cifs_open_info_data *data, - fattr->cf_uid = wsl_make_kuid(cifs_sb, v); - else if (!strncmp(name, SMB2_WSL_XATTR_GID, nlen)) - fattr->cf_gid = wsl_make_kgid(cifs_sb, v); -- else if (!strncmp(name, SMB2_WSL_XATTR_MODE, nlen)) -+ else if (!strncmp(name, SMB2_WSL_XATTR_MODE, nlen)) { -+ /* File type in reparse point tag and in xattr mode must match. */ -+ if (S_DT(fattr->cf_mode) != S_DT(le32_to_cpu(*(__le32 *)v))) -+ return false; - fattr->cf_mode = (umode_t)le32_to_cpu(*(__le32 *)v); -- else if (!strncmp(name, SMB2_WSL_XATTR_DEV, nlen)) -+ } else if (!strncmp(name, SMB2_WSL_XATTR_DEV, nlen)) { - fattr->cf_rdev = reparse_mkdev(v); -+ have_xattr_dev = true; -+ } - } while (next); - out: -+ -+ /* Major and minor numbers for char and block devices are mandatory. */ -+ if (!have_xattr_dev && (tag == IO_REPARSE_TAG_LX_CHR || tag == IO_REPARSE_TAG_LX_BLK)) -+ return false; -+ - fattr->cf_dtype = S_DT(fattr->cf_mode); -+ return true; - } - - static bool posix_reparse_to_fattr(struct cifs_sb_info *cifs_sb, -@@ -801,7 +813,9 @@ bool cifs_reparse_point_to_fattr(struct cifs_sb_info *cifs_sb, - case IO_REPARSE_TAG_AF_UNIX: - case IO_REPARSE_TAG_LX_CHR: - case IO_REPARSE_TAG_LX_BLK: -- wsl_to_fattr(data, cifs_sb, tag, fattr); -+ ok = wsl_to_fattr(data, cifs_sb, tag, fattr); -+ if (!ok) -+ return false; - break; - case IO_REPARSE_TAG_NFS: - ok = posix_reparse_to_fattr(cifs_sb, fattr, data); -diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c -index fc6d00344c50ea..d4be915bcb70c7 100644 ---- a/fs/smb/client/smb2ops.c -+++ b/fs/smb/client/smb2ops.c -@@ -622,7 +622,8 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, - - while (bytes_left >= (ssize_t)sizeof(*p)) { - memset(&tmp_iface, 0, sizeof(tmp_iface)); -- tmp_iface.speed = le64_to_cpu(p->LinkSpeed); -+ /* default to 1Gbps when link speed is unset */ -+ tmp_iface.speed = le64_to_cpu(p->LinkSpeed) ?: 1000000000; - tmp_iface.rdma_capable = le32_to_cpu(p->Capability & RDMA_CAPABLE) ? 1 : 0; - tmp_iface.rss_capable = le32_to_cpu(p->Capability & RSS_CAPABLE) ? 1 : 0; - -diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c -index eef9e527d9ff94..ff9e574c07a87d 100644 ---- a/fs/ubifs/debug.c -+++ b/fs/ubifs/debug.c -@@ -946,16 +946,20 @@ void ubifs_dump_tnc(struct ubifs_info *c) - - pr_err("\n"); - pr_err("(pid %d) start dumping TNC tree\n", current->pid); -- znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, NULL); -- level = znode->level; -- pr_err("== Level %d ==\n", level); -- while (znode) { -- if (level != znode->level) { -- level = znode->level; -- pr_err("== Level %d ==\n", level); -+ if (c->zroot.znode) { -+ znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, NULL); -+ level = znode->level; -+ pr_err("== Level %d ==\n", level); -+ while (znode) { -+ if (level != znode->level) { -+ level = znode->level; -+ pr_err("== Level %d ==\n", level); -+ } -+ ubifs_dump_znode(c, znode); -+ znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, znode); - } -- ubifs_dump_znode(c, znode); -- znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, znode); -+ } else { -+ pr_err("empty TNC tree in memory\n"); - } - pr_err("(pid %d) finish dumping TNC tree\n", current->pid); - } -diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h -index a3c9dd4a1ac33c..7e9e7e76904369 100644 ---- a/include/acpi/acpixf.h -+++ b/include/acpi/acpixf.h -@@ -763,6 +763,7 @@ ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status - *event_status)) - ACPI_HW_DEPENDENT_RETURN_UINT32(u32 acpi_dispatch_gpe(acpi_handle gpe_device, u32 gpe_number)) - ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_hw_disable_all_gpes(void)) -+ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_hw_enable_all_wakeup_gpes(void)) - ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_disable_all_gpes(void)) - ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable_all_runtime_gpes(void)) - ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable_all_wakeup_gpes(void)) -diff --git a/include/dt-bindings/clock/sun50i-a64-ccu.h b/include/dt-bindings/clock/sun50i-a64-ccu.h -index 175892189e9dcb..4f220ea7a23cc5 100644 ---- a/include/dt-bindings/clock/sun50i-a64-ccu.h -+++ b/include/dt-bindings/clock/sun50i-a64-ccu.h -@@ -44,7 +44,9 @@ - #define _DT_BINDINGS_CLK_SUN50I_A64_H_ - - #define CLK_PLL_VIDEO0 7 -+#define CLK_PLL_VIDEO0_2X 8 - #define CLK_PLL_PERIPH0 11 -+#define CLK_PLL_MIPI 17 - - #define CLK_CPUX 21 - #define CLK_BUS_MIPI_DSI 28 -diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h -index 44e9de51eedfb6..572030db2f0616 100644 ---- a/include/linux/buffer_head.h -+++ b/include/linux/buffer_head.h -@@ -203,8 +203,8 @@ struct buffer_head *alloc_page_buffers(struct page *page, unsigned long size, - bool retry); - void create_empty_buffers(struct page *, unsigned long, - unsigned long b_state); --void folio_create_empty_buffers(struct folio *folio, unsigned long blocksize, -- unsigned long b_state); -+struct buffer_head *folio_create_empty_buffers(struct folio *folio, -+ unsigned long blocksize, unsigned long b_state); - void end_buffer_read_sync(struct buffer_head *bh, int uptodate); - void end_buffer_write_sync(struct buffer_head *bh, int uptodate); - void end_buffer_async_write(struct buffer_head *bh, int uptodate); -diff --git a/include/linux/hid.h b/include/linux/hid.h -index af55a25db91b0d..774cb25dec34c5 100644 ---- a/include/linux/hid.h -+++ b/include/linux/hid.h -@@ -218,6 +218,7 @@ struct hid_item { - #define HID_GD_DOWN 0x00010091 - #define HID_GD_RIGHT 0x00010092 - #define HID_GD_LEFT 0x00010093 -+#define HID_GD_DO_NOT_DISTURB 0x0001009b - /* Microsoft Win8 Wireless Radio Controls CA usage codes */ - #define HID_GD_RFKILL_BTN 0x000100c6 - #define HID_GD_RFKILL_LED 0x000100c7 -diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h -index 5f1e5a16d7b2c3..0ff10007eb1a5e 100644 ---- a/include/linux/ieee80211.h -+++ b/include/linux/ieee80211.h -@@ -4826,28 +4826,24 @@ static inline u8 ieee80211_mle_common_size(const u8 *data) - { - const struct ieee80211_multi_link_elem *mle = (const void *)data; - u16 control = le16_to_cpu(mle->control); -- u8 common = 0; - - switch (u16_get_bits(control, IEEE80211_ML_CONTROL_TYPE)) { - case IEEE80211_ML_CONTROL_TYPE_BASIC: - case IEEE80211_ML_CONTROL_TYPE_PREQ: - case IEEE80211_ML_CONTROL_TYPE_TDLS: - case IEEE80211_ML_CONTROL_TYPE_RECONF: -+ case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS: - /* - * The length is the first octet pointed by mle->variable so no - * need to add anything - */ - break; -- case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS: -- if (control & IEEE80211_MLC_PRIO_ACCESS_PRES_AP_MLD_MAC_ADDR) -- common += ETH_ALEN; -- return common; - default: - WARN_ON(1); - return 0; - } - -- return sizeof(*mle) + common + mle->variable[0]; -+ return sizeof(*mle) + mle->variable[0]; - } - - /** -@@ -4989,8 +4985,7 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len) - check_common_len = true; - break; - case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS: -- if (control & IEEE80211_MLC_PRIO_ACCESS_PRES_AP_MLD_MAC_ADDR) -- common += ETH_ALEN; -+ common = ETH_ALEN + 1; - break; - default: - /* we don't know this type */ -diff --git a/include/linux/kallsyms.h b/include/linux/kallsyms.h -index c3f075e8f60cb6..1c6a6c1704d8d0 100644 ---- a/include/linux/kallsyms.h -+++ b/include/linux/kallsyms.h -@@ -57,10 +57,10 @@ static inline void *dereference_symbol_descriptor(void *ptr) - - preempt_disable(); - mod = __module_address((unsigned long)ptr); -- preempt_enable(); - - if (mod) - ptr = dereference_module_function_descriptor(mod, ptr); -+ preempt_enable(); - #endif - return ptr; - } -diff --git a/include/linux/mfd/syscon.h b/include/linux/mfd/syscon.h -index fecc2fa2a36475..aad9c6b5046368 100644 ---- a/include/linux/mfd/syscon.h -+++ b/include/linux/mfd/syscon.h -@@ -17,20 +17,19 @@ - struct device_node; - - #ifdef CONFIG_MFD_SYSCON --extern struct regmap *device_node_to_regmap(struct device_node *np); --extern struct regmap *syscon_node_to_regmap(struct device_node *np); --extern struct regmap *syscon_regmap_lookup_by_compatible(const char *s); --extern struct regmap *syscon_regmap_lookup_by_phandle( -- struct device_node *np, -- const char *property); --extern struct regmap *syscon_regmap_lookup_by_phandle_args( -- struct device_node *np, -- const char *property, -- int arg_count, -- unsigned int *out_args); --extern struct regmap *syscon_regmap_lookup_by_phandle_optional( -- struct device_node *np, -- const char *property); -+struct regmap *device_node_to_regmap(struct device_node *np); -+struct regmap *syscon_node_to_regmap(struct device_node *np); -+struct regmap *syscon_regmap_lookup_by_compatible(const char *s); -+struct regmap *syscon_regmap_lookup_by_phandle(struct device_node *np, -+ const char *property); -+struct regmap *syscon_regmap_lookup_by_phandle_args(struct device_node *np, -+ const char *property, -+ int arg_count, -+ unsigned int *out_args); -+struct regmap *syscon_regmap_lookup_by_phandle_optional(struct device_node *np, -+ const char *property); -+int of_syscon_register_regmap(struct device_node *np, -+ struct regmap *regmap); - #else - static inline struct regmap *device_node_to_regmap(struct device_node *np) - { -@@ -70,6 +69,12 @@ static inline struct regmap *syscon_regmap_lookup_by_phandle_optional( - return NULL; - } - -+static inline int of_syscon_register_regmap(struct device_node *np, -+ struct regmap *regmap) -+{ -+ return -EOPNOTSUPP; -+} -+ - #endif - - #endif /* __LINUX_MFD_SYSCON_H__ */ -diff --git a/include/linux/mroute_base.h b/include/linux/mroute_base.h -index 9dd4bf1572553f..58a2401e4b551b 100644 ---- a/include/linux/mroute_base.h -+++ b/include/linux/mroute_base.h -@@ -146,9 +146,9 @@ struct mr_mfc { - unsigned long last_assert; - int minvif; - int maxvif; -- unsigned long bytes; -- unsigned long pkt; -- unsigned long wrong_if; -+ atomic_long_t bytes; -+ atomic_long_t pkt; -+ atomic_long_t wrong_if; - unsigned long lastuse; - unsigned char ttls[MAXVIFS]; - refcount_t refcount; -diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index 1576e7443eee50..8b5121eb8757ef 100644 ---- a/include/linux/netdevice.h -+++ b/include/linux/netdevice.h -@@ -2217,7 +2217,7 @@ struct net_device { - void *atalk_ptr; - #endif - #if IS_ENABLED(CONFIG_AX25) -- void *ax25_ptr; -+ struct ax25_dev __rcu *ax25_ptr; - #endif - #if IS_ENABLED(CONFIG_CFG80211) - struct wireless_dev *ieee80211_ptr; -diff --git a/include/linux/of.h b/include/linux/of.h -index 024dda54b9c776..afee93163fddd5 100644 ---- a/include/linux/of.h -+++ b/include/linux/of.h -@@ -423,11 +423,9 @@ extern int of_detach_node(struct device_node *); - #define of_match_ptr(_ptr) (_ptr) - - /* -- * struct property *prop; -- * const __be32 *p; - * u32 u; - * -- * of_property_for_each_u32(np, "propname", prop, p, u) -+ * of_property_for_each_u32(np, "propname", u) - * printk("U32 value: %x\n", u); - */ - const __be32 *of_prop_next_u32(struct property *prop, const __be32 *cur, -@@ -1399,11 +1397,12 @@ static inline int of_property_read_s32(const struct device_node *np, - err == 0; \ - err = of_phandle_iterator_next(it)) - --#define of_property_for_each_u32(np, propname, prop, p, u) \ -- for (prop = of_find_property(np, propname, NULL), \ -- p = of_prop_next_u32(prop, NULL, &u); \ -- p; \ -- p = of_prop_next_u32(prop, p, &u)) -+#define of_property_for_each_u32(np, propname, u) \ -+ for (struct {struct property *prop; const __be32 *item; } _it = \ -+ {of_find_property(np, propname, NULL), \ -+ of_prop_next_u32(_it.prop, NULL, &u)}; \ -+ _it.item; \ -+ _it.item = of_prop_next_u32(_it.prop, _it.item, &u)) - - #define of_property_for_each_string(np, propname, prop, s) \ - for (prop = of_find_property(np, propname, NULL), \ -diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h -index 7a5563ffe61b53..fcb834dd75c240 100644 ---- a/include/linux/perf_event.h -+++ b/include/linux/perf_event.h -@@ -1231,12 +1231,18 @@ static inline void perf_sample_save_callchain(struct perf_sample_data *data, - } - - static inline void perf_sample_save_raw_data(struct perf_sample_data *data, -+ struct perf_event *event, - struct perf_raw_record *raw) - { - struct perf_raw_frag *frag = &raw->frag; - u32 sum = 0; - int size; - -+ if (!(event->attr.sample_type & PERF_SAMPLE_RAW)) -+ return; -+ if (WARN_ON_ONCE(data->sample_flags & PERF_SAMPLE_RAW)) -+ return; -+ - do { - sum += frag->size; - if (perf_raw_frag_last(frag)) -diff --git a/include/linux/platform_data/pca953x.h b/include/linux/platform_data/pca953x.h -index 96c1a14ab3657a..3c3787c4d96ca2 100644 ---- a/include/linux/platform_data/pca953x.h -+++ b/include/linux/platform_data/pca953x.h -@@ -11,21 +11,8 @@ struct pca953x_platform_data { - /* number of the first GPIO */ - unsigned gpio_base; - -- /* initial polarity inversion setting */ -- u32 invert; -- - /* interrupt base */ - int irq_base; -- -- void *context; /* param to setup/teardown */ -- -- int (*setup)(struct i2c_client *client, -- unsigned gpio, unsigned ngpio, -- void *context); -- void (*teardown)(struct i2c_client *client, -- unsigned gpio, unsigned ngpio, -- void *context); -- const char *const *names; - }; - - #endif /* _LINUX_PCA953X_H */ -diff --git a/include/linux/platform_data/si5351.h b/include/linux/platform_data/si5351.h -index c71a2dd661437a..5f412a615532bb 100644 ---- a/include/linux/platform_data/si5351.h -+++ b/include/linux/platform_data/si5351.h -@@ -105,10 +105,12 @@ struct si5351_clkout_config { - * @clk_xtal: xtal input clock - * @clk_clkin: clkin input clock - * @pll_src: array of pll source clock setting -+ * @pll_reset: array indicating if plls should be reset after setting the rate - * @clkout: array of clkout configuration - */ - struct si5351_platform_data { - enum si5351_pll_src pll_src[2]; -+ bool pll_reset[2]; - struct si5351_clkout_config clkout[8]; - }; - -diff --git a/include/linux/pps_kernel.h b/include/linux/pps_kernel.h -index 78c8ac4951b581..c7abce28ed2995 100644 ---- a/include/linux/pps_kernel.h -+++ b/include/linux/pps_kernel.h -@@ -56,8 +56,7 @@ struct pps_device { - - unsigned int id; /* PPS source unique ID */ - void const *lookup_cookie; /* For pps_lookup_dev() only */ -- struct cdev cdev; -- struct device *dev; -+ struct device dev; - struct fasync_struct *async_queue; /* fasync method */ - spinlock_t lock; - }; -diff --git a/include/linux/sched.h b/include/linux/sched.h -index d4f9d82c69e0b0..2af0a8859d6473 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -896,6 +896,7 @@ struct task_struct { - unsigned sched_reset_on_fork:1; - unsigned sched_contributes_to_load:1; - unsigned sched_migrated:1; -+ unsigned sched_task_hot:1; - - /* Force alignment to the next boundary: */ - unsigned :0; -diff --git a/include/linux/usb/tcpm.h b/include/linux/usb/tcpm.h -index ab7ca872950bb1..0bdb4f565d0f89 100644 ---- a/include/linux/usb/tcpm.h -+++ b/include/linux/usb/tcpm.h -@@ -150,7 +150,8 @@ struct tcpc_dev { - void (*frs_sourcing_vbus)(struct tcpc_dev *dev); - int (*enable_auto_vbus_discharge)(struct tcpc_dev *dev, bool enable); - int (*set_auto_vbus_discharge_threshold)(struct tcpc_dev *dev, enum typec_pwr_opmode mode, -- bool pps_active, u32 requested_vbus_voltage); -+ bool pps_active, u32 requested_vbus_voltage, -+ u32 pps_apdo_min_voltage); - bool (*is_vbus_vsafe0v)(struct tcpc_dev *dev); - void (*set_partner_usb_comm_capable)(struct tcpc_dev *dev, bool enable); - void (*check_contaminant)(struct tcpc_dev *dev); -diff --git a/include/net/ax25.h b/include/net/ax25.h -index c2a85fd3f5ea40..ef79023f1a286f 100644 ---- a/include/net/ax25.h -+++ b/include/net/ax25.h -@@ -229,6 +229,7 @@ typedef struct ax25_dev { - #endif - refcount_t refcount; - bool device_up; -+ struct rcu_head rcu; - } ax25_dev; - - typedef struct ax25_cb { -@@ -288,9 +289,8 @@ static inline void ax25_dev_hold(ax25_dev *ax25_dev) - - static inline void ax25_dev_put(ax25_dev *ax25_dev) - { -- if (refcount_dec_and_test(&ax25_dev->refcount)) { -- kfree(ax25_dev); -- } -+ if (refcount_dec_and_test(&ax25_dev->refcount)) -+ kfree_rcu(ax25_dev, rcu); - } - static inline __be16 ax25_type_trans(struct sk_buff *skb, struct net_device *dev) - { -@@ -333,9 +333,9 @@ void ax25_digi_invert(const ax25_digi *, ax25_digi *); - extern spinlock_t ax25_dev_lock; - - #if IS_ENABLED(CONFIG_AX25) --static inline ax25_dev *ax25_dev_ax25dev(struct net_device *dev) -+static inline ax25_dev *ax25_dev_ax25dev(const struct net_device *dev) - { -- return dev->ax25_ptr; -+ return rcu_dereference_rtnl(dev->ax25_ptr); - } - #endif - -diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h -index 74ff688568a0c6..f475757daafba9 100644 ---- a/include/net/inetpeer.h -+++ b/include/net/inetpeer.h -@@ -96,30 +96,28 @@ static inline struct in6_addr *inetpeer_get_addr_v6(struct inetpeer_addr *iaddr) - - /* can be called with or without local BH being disabled */ - struct inet_peer *inet_getpeer(struct inet_peer_base *base, -- const struct inetpeer_addr *daddr, -- int create); -+ const struct inetpeer_addr *daddr); - - static inline struct inet_peer *inet_getpeer_v4(struct inet_peer_base *base, - __be32 v4daddr, -- int vif, int create) -+ int vif) - { - struct inetpeer_addr daddr; - - daddr.a4.addr = v4daddr; - daddr.a4.vif = vif; - daddr.family = AF_INET; -- return inet_getpeer(base, &daddr, create); -+ return inet_getpeer(base, &daddr); - } - - static inline struct inet_peer *inet_getpeer_v6(struct inet_peer_base *base, -- const struct in6_addr *v6daddr, -- int create) -+ const struct in6_addr *v6daddr) - { - struct inetpeer_addr daddr; - - daddr.a6 = *v6daddr; - daddr.family = AF_INET6; -- return inet_getpeer(base, &daddr, create); -+ return inet_getpeer(base, &daddr); - } - - static inline int inetpeer_addr_cmp(const struct inetpeer_addr *a, -diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h -index 8321915dddb284..dcbf3f299548f7 100644 ---- a/include/net/netfilter/nf_tables.h -+++ b/include/net/netfilter/nf_tables.h -@@ -429,6 +429,9 @@ struct nft_set_ext; - * @remove: remove element from set - * @walk: iterate over all set elements - * @get: get set elements -+ * @ksize: kernel set size -+ * @usize: userspace set size -+ * @adjust_maxsize: delta to adjust maximum set size - * @commit: commit set elements - * @abort: abort set elements - * @privsize: function to return size of set private data -@@ -481,7 +484,10 @@ struct nft_set_ops { - const struct nft_set *set, - const struct nft_set_elem *elem, - unsigned int flags); -- void (*commit)(const struct nft_set *set); -+ u32 (*ksize)(u32 size); -+ u32 (*usize)(u32 size); -+ u32 (*adjust_maxsize)(const struct nft_set *set); -+ void (*commit)(struct nft_set *set); - void (*abort)(const struct nft_set *set); - u64 (*privsize)(const struct nlattr * const nla[], - const struct nft_set_desc *desc); -diff --git a/include/net/xfrm.h b/include/net/xfrm.h -index 93a9866ee481fa..b33d27e42cff38 100644 ---- a/include/net/xfrm.h -+++ b/include/net/xfrm.h -@@ -1181,9 +1181,19 @@ static inline int __xfrm_policy_check2(struct sock *sk, int dir, - - if (xo) { - x = xfrm_input_state(skb); -- if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET) -- return (xo->flags & CRYPTO_DONE) && -- (xo->status & CRYPTO_SUCCESS); -+ if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET) { -+ bool check = (xo->flags & CRYPTO_DONE) && -+ (xo->status & CRYPTO_SUCCESS); -+ -+ /* The packets here are plain ones and secpath was -+ * needed to indicate that hardware already handled -+ * them and there is no need to do nothing in addition. -+ * -+ * Consume secpath which was set by drivers. -+ */ -+ secpath_reset(skb); -+ return check; -+ } - } - - return __xfrm_check_nopolicy(net, skb, dir) || -diff --git a/include/trace/events/afs.h b/include/trace/events/afs.h -index d1ee4272d1cb8b..ceb0146ffc7cd1 100644 ---- a/include/trace/events/afs.h -+++ b/include/trace/events/afs.h -@@ -118,6 +118,8 @@ enum yfs_cm_operation { - */ - #define afs_call_traces \ - EM(afs_call_trace_alloc, "ALLOC") \ -+ EM(afs_call_trace_async_abort, "ASYAB") \ -+ EM(afs_call_trace_async_kill, "ASYKL") \ - EM(afs_call_trace_free, "FREE ") \ - EM(afs_call_trace_get, "GET ") \ - EM(afs_call_trace_put, "PUT ") \ -diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h -index ed36f5f577a9d3..252bb90aca599b 100644 ---- a/include/trace/events/rxrpc.h -+++ b/include/trace/events/rxrpc.h -@@ -117,6 +117,7 @@ - #define rxrpc_call_poke_traces \ - EM(rxrpc_call_poke_abort, "Abort") \ - EM(rxrpc_call_poke_complete, "Compl") \ -+ EM(rxrpc_call_poke_conn_abort, "Conn-abort") \ - EM(rxrpc_call_poke_error, "Error") \ - EM(rxrpc_call_poke_idle, "Idle") \ - EM(rxrpc_call_poke_start, "Start") \ -@@ -278,6 +279,7 @@ - EM(rxrpc_call_see_activate_client, "SEE act-clnt") \ - EM(rxrpc_call_see_connect_failed, "SEE con-fail") \ - EM(rxrpc_call_see_connected, "SEE connect ") \ -+ EM(rxrpc_call_see_conn_abort, "SEE conn-abt") \ - EM(rxrpc_call_see_disconnected, "SEE disconn ") \ - EM(rxrpc_call_see_distribute_error, "SEE dist-err") \ - EM(rxrpc_call_see_input, "SEE input ") \ -@@ -961,6 +963,29 @@ TRACE_EVENT(rxrpc_rx_abort, - __entry->abort_code) - ); - -+TRACE_EVENT(rxrpc_rx_conn_abort, -+ TP_PROTO(const struct rxrpc_connection *conn, const struct sk_buff *skb), -+ -+ TP_ARGS(conn, skb), -+ -+ TP_STRUCT__entry( -+ __field(unsigned int, conn) -+ __field(rxrpc_serial_t, serial) -+ __field(u32, abort_code) -+ ), -+ -+ TP_fast_assign( -+ __entry->conn = conn->debug_id; -+ __entry->serial = rxrpc_skb(skb)->hdr.serial; -+ __entry->abort_code = skb->priority; -+ ), -+ -+ TP_printk("C=%08x ABORT %08x ac=%d", -+ __entry->conn, -+ __entry->serial, -+ __entry->abort_code) -+ ); -+ - TRACE_EVENT(rxrpc_rx_challenge, - TP_PROTO(struct rxrpc_connection *conn, rxrpc_serial_t serial, - u32 version, u32 nonce, u32 min_level), -diff --git a/io_uring/uring_cmd.c b/io_uring/uring_cmd.c -index 5fa19861cda546..2cbd1c24414c61 100644 ---- a/io_uring/uring_cmd.c -+++ b/io_uring/uring_cmd.c -@@ -175,7 +175,7 @@ int io_uring_cmd_sock(struct io_uring_cmd *cmd, unsigned int issue_flags) - if (!prot || !prot->ioctl) - return -EOPNOTSUPP; - -- switch (cmd->sqe->cmd_op) { -+ switch (cmd->cmd_op) { - case SOCKET_URING_OP_SIOCINQ: - ret = prot->ioctl(sk, SIOCINQ, &arg); - if (ret) -diff --git a/kernel/bpf/bpf_local_storage.c b/kernel/bpf/bpf_local_storage.c -index e8d02212da7039..b4c6b9b3cb421e 100644 ---- a/kernel/bpf/bpf_local_storage.c -+++ b/kernel/bpf/bpf_local_storage.c -@@ -823,8 +823,12 @@ bpf_local_storage_map_alloc(union bpf_attr *attr, - smap->elem_size = offsetof(struct bpf_local_storage_elem, - sdata.data[attr->value_size]); - -- smap->bpf_ma = bpf_ma; -- if (bpf_ma) { -+ /* In PREEMPT_RT, kmalloc(GFP_ATOMIC) is still not safe in non -+ * preemptible context. Thus, enforce all storages to use -+ * bpf_mem_alloc when CONFIG_PREEMPT_RT is enabled. -+ */ -+ smap->bpf_ma = IS_ENABLED(CONFIG_PREEMPT_RT) ? true : bpf_ma; -+ if (smap->bpf_ma) { - err = bpf_mem_alloc_init(&smap->selem_ma, smap->elem_size, false); - if (err) - goto free_smap; -diff --git a/kernel/events/core.c b/kernel/events/core.c -index ec0fae49a0dd9a..5d6458ea675e9d 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -10157,9 +10157,9 @@ static struct pmu perf_tracepoint = { - }; - - static int perf_tp_filter_match(struct perf_event *event, -- struct perf_sample_data *data) -+ struct perf_raw_record *raw) - { -- void *record = data->raw->frag.data; -+ void *record = raw->frag.data; - - /* only top level events have filters set */ - if (event->parent) -@@ -10171,7 +10171,7 @@ static int perf_tp_filter_match(struct perf_event *event, - } - - static int perf_tp_event_match(struct perf_event *event, -- struct perf_sample_data *data, -+ struct perf_raw_record *raw, - struct pt_regs *regs) - { - if (event->hw.state & PERF_HES_STOPPED) -@@ -10182,7 +10182,7 @@ static int perf_tp_event_match(struct perf_event *event, - if (event->attr.exclude_kernel && !user_mode(regs)) - return 0; - -- if (!perf_tp_filter_match(event, data)) -+ if (!perf_tp_filter_match(event, raw)) - return 0; - - return 1; -@@ -10208,6 +10208,7 @@ EXPORT_SYMBOL_GPL(perf_trace_run_bpf_submit); - static void __perf_tp_event_target_task(u64 count, void *record, - struct pt_regs *regs, - struct perf_sample_data *data, -+ struct perf_raw_record *raw, - struct perf_event *event) - { - struct trace_entry *entry = record; -@@ -10217,13 +10218,17 @@ static void __perf_tp_event_target_task(u64 count, void *record, - /* Cannot deliver synchronous signal to other task. */ - if (event->attr.sigtrap) - return; -- if (perf_tp_event_match(event, data, regs)) -+ if (perf_tp_event_match(event, raw, regs)) { -+ perf_sample_data_init(data, 0, 0); -+ perf_sample_save_raw_data(data, event, raw); - perf_swevent_event(event, count, data, regs); -+ } - } - - static void perf_tp_event_target_task(u64 count, void *record, - struct pt_regs *regs, - struct perf_sample_data *data, -+ struct perf_raw_record *raw, - struct perf_event_context *ctx) - { - unsigned int cpu = smp_processor_id(); -@@ -10231,15 +10236,15 @@ static void perf_tp_event_target_task(u64 count, void *record, - struct perf_event *event, *sibling; - - perf_event_groups_for_cpu_pmu(event, &ctx->pinned_groups, cpu, pmu) { -- __perf_tp_event_target_task(count, record, regs, data, event); -+ __perf_tp_event_target_task(count, record, regs, data, raw, event); - for_each_sibling_event(sibling, event) -- __perf_tp_event_target_task(count, record, regs, data, sibling); -+ __perf_tp_event_target_task(count, record, regs, data, raw, sibling); - } - - perf_event_groups_for_cpu_pmu(event, &ctx->flexible_groups, cpu, pmu) { -- __perf_tp_event_target_task(count, record, regs, data, event); -+ __perf_tp_event_target_task(count, record, regs, data, raw, event); - for_each_sibling_event(sibling, event) -- __perf_tp_event_target_task(count, record, regs, data, sibling); -+ __perf_tp_event_target_task(count, record, regs, data, raw, sibling); - } - } - -@@ -10257,15 +10262,10 @@ void perf_tp_event(u16 event_type, u64 count, void *record, int entry_size, - }, - }; - -- perf_sample_data_init(&data, 0, 0); -- perf_sample_save_raw_data(&data, &raw); -- - perf_trace_buf_update(record, event_type); - - hlist_for_each_entry_rcu(event, head, hlist_entry) { -- if (perf_tp_event_match(event, &data, regs)) { -- perf_swevent_event(event, count, &data, regs); -- -+ if (perf_tp_event_match(event, &raw, regs)) { - /* - * Here use the same on-stack perf_sample_data, - * some members in data are event-specific and -@@ -10275,7 +10275,8 @@ void perf_tp_event(u16 event_type, u64 count, void *record, int entry_size, - * because data->sample_flags is set. - */ - perf_sample_data_init(&data, 0, 0); -- perf_sample_save_raw_data(&data, &raw); -+ perf_sample_save_raw_data(&data, event, &raw); -+ perf_swevent_event(event, count, &data, regs); - } - } - -@@ -10292,7 +10293,7 @@ void perf_tp_event(u16 event_type, u64 count, void *record, int entry_size, - goto unlock; - - raw_spin_lock(&ctx->lock); -- perf_tp_event_target_task(count, record, regs, &data, ctx); -+ perf_tp_event_target_task(count, record, regs, &data, &raw, ctx); - raw_spin_unlock(&ctx->lock); - unlock: - rcu_read_unlock(); -diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h -index bcc7f21db9eeb3..fbeecc608f54cc 100644 ---- a/kernel/irq/internals.h -+++ b/kernel/irq/internals.h -@@ -434,10 +434,6 @@ static inline struct cpumask *irq_desc_get_pending_mask(struct irq_desc *desc) - { - return desc->pending_mask; - } --static inline bool handle_enforce_irqctx(struct irq_data *data) --{ -- return irqd_is_handle_enforce_irqctx(data); --} - bool irq_fixup_move_pending(struct irq_desc *desc, bool force_clear); - #else /* CONFIG_GENERIC_PENDING_IRQ */ - static inline bool irq_can_move_pcntxt(struct irq_data *data) -@@ -464,11 +460,12 @@ static inline bool irq_fixup_move_pending(struct irq_desc *desc, bool fclear) - { - return false; - } -+#endif /* !CONFIG_GENERIC_PENDING_IRQ */ -+ - static inline bool handle_enforce_irqctx(struct irq_data *data) - { -- return false; -+ return irqd_is_handle_enforce_irqctx(data); - } --#endif /* !CONFIG_GENERIC_PENDING_IRQ */ - - #if !defined(CONFIG_IRQ_DOMAIN) || !defined(CONFIG_IRQ_DOMAIN_HIERARCHY) - static inline int irq_domain_activate_irq(struct irq_data *data, bool reserve) -diff --git a/kernel/padata.c b/kernel/padata.c -index 9bf77b58ee08d4..071d8cad807871 100644 ---- a/kernel/padata.c -+++ b/kernel/padata.c -@@ -47,6 +47,22 @@ struct padata_mt_job_state { - static void padata_free_pd(struct parallel_data *pd); - static void __init padata_mt_helper(struct work_struct *work); - -+static inline void padata_get_pd(struct parallel_data *pd) -+{ -+ refcount_inc(&pd->refcnt); -+} -+ -+static inline void padata_put_pd_cnt(struct parallel_data *pd, int cnt) -+{ -+ if (refcount_sub_and_test(cnt, &pd->refcnt)) -+ padata_free_pd(pd); -+} -+ -+static inline void padata_put_pd(struct parallel_data *pd) -+{ -+ padata_put_pd_cnt(pd, 1); -+} -+ - static int padata_index_to_cpu(struct parallel_data *pd, int cpu_index) - { - int cpu, target_cpu; -@@ -206,7 +222,7 @@ int padata_do_parallel(struct padata_shell *ps, - if ((pinst->flags & PADATA_RESET)) - goto out; - -- refcount_inc(&pd->refcnt); -+ padata_get_pd(pd); - padata->pd = pd; - padata->cb_cpu = *cb_cpu; - -@@ -336,8 +352,14 @@ static void padata_reorder(struct parallel_data *pd) - smp_mb(); - - reorder = per_cpu_ptr(pd->reorder_list, pd->cpu); -- if (!list_empty(&reorder->list) && padata_find_next(pd, false)) -+ if (!list_empty(&reorder->list) && padata_find_next(pd, false)) { -+ /* -+ * Other context(eg. the padata_serial_worker) can finish the request. -+ * To avoid UAF issue, add pd ref here, and put pd ref after reorder_work finish. -+ */ -+ padata_get_pd(pd); - queue_work(pinst->serial_wq, &pd->reorder_work); -+ } - } - - static void invoke_padata_reorder(struct work_struct *work) -@@ -348,6 +370,8 @@ static void invoke_padata_reorder(struct work_struct *work) - pd = container_of(work, struct parallel_data, reorder_work); - padata_reorder(pd); - local_bh_enable(); -+ /* Pairs with putting the reorder_work in the serial_wq */ -+ padata_put_pd(pd); - } - - static void padata_serial_worker(struct work_struct *serial_work) -@@ -380,8 +404,7 @@ static void padata_serial_worker(struct work_struct *serial_work) - } - local_bh_enable(); - -- if (refcount_sub_and_test(cnt, &pd->refcnt)) -- padata_free_pd(pd); -+ padata_put_pd_cnt(pd, cnt); - } - - /** -@@ -678,8 +701,7 @@ static int padata_replace(struct padata_instance *pinst) - synchronize_rcu(); - - list_for_each_entry_continue_reverse(ps, &pinst->pslist, list) -- if (refcount_dec_and_test(&ps->opd->refcnt)) -- padata_free_pd(ps->opd); -+ padata_put_pd(ps->opd); - - pinst->flags &= ~PADATA_RESET; - -@@ -967,7 +989,7 @@ static ssize_t padata_sysfs_store(struct kobject *kobj, struct attribute *attr, - - pinst = kobj2pinst(kobj); - pentry = attr2pentry(attr); -- if (pentry->show) -+ if (pentry->store) - ret = pentry->store(pinst, attr, buf, count); - - return ret; -@@ -1118,11 +1140,16 @@ void padata_free_shell(struct padata_shell *ps) - if (!ps) - return; - -+ /* -+ * Wait for all _do_serial calls to finish to avoid touching -+ * freed pd's and ps's. -+ */ -+ synchronize_rcu(); -+ - mutex_lock(&ps->pinst->lock); - list_del(&ps->list); - pd = rcu_dereference_protected(ps->pd, 1); -- if (refcount_dec_and_test(&pd->refcnt)) -- padata_free_pd(pd); -+ padata_put_pd(pd); - mutex_unlock(&ps->pinst->lock); - - kfree(ps); -diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c -index 8d35b9f9aaa3f2..c2fc58938dee5d 100644 ---- a/kernel/power/hibernate.c -+++ b/kernel/power/hibernate.c -@@ -599,7 +599,11 @@ int hibernation_platform_enter(void) - - local_irq_disable(); - system_state = SYSTEM_SUSPEND; -- syscore_suspend(); -+ -+ error = syscore_suspend(); -+ if (error) -+ goto Enable_irqs; -+ - if (pm_wakeup_pending()) { - error = -EAGAIN; - goto Power_up; -@@ -611,6 +615,7 @@ int hibernation_platform_enter(void) - - Power_up: - syscore_resume(); -+ Enable_irqs: - system_state = SYSTEM_RUNNING; - local_irq_enable(); - -diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c -index 458d359f5991ca..a49f136014ce6b 100644 ---- a/kernel/sched/cpufreq_schedutil.c -+++ b/kernel/sched/cpufreq_schedutil.c -@@ -83,7 +83,7 @@ static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time) - - if (unlikely(sg_policy->limits_changed)) { - sg_policy->limits_changed = false; -- sg_policy->need_freq_update = true; -+ sg_policy->need_freq_update = cpufreq_driver_test_flags(CPUFREQ_NEED_UPDATE_LIMITS); - return true; - } - -@@ -96,7 +96,7 @@ static bool sugov_update_next_freq(struct sugov_policy *sg_policy, u64 time, - unsigned int next_freq) - { - if (sg_policy->need_freq_update) -- sg_policy->need_freq_update = cpufreq_driver_test_flags(CPUFREQ_NEED_UPDATE_LIMITS); -+ sg_policy->need_freq_update = false; - else if (sg_policy->next_freq == next_freq) - return false; - -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 3b2cfdb8d788d9..726fa69c4d88b2 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -8921,6 +8921,8 @@ int can_migrate_task(struct task_struct *p, struct lb_env *env) - int tsk_cache_hot; - - lockdep_assert_rq_held(env->src_rq); -+ if (p->sched_task_hot) -+ p->sched_task_hot = 0; - - /* - * We do not migrate tasks that are: -@@ -8993,10 +8995,8 @@ int can_migrate_task(struct task_struct *p, struct lb_env *env) - - if (tsk_cache_hot <= 0 || - env->sd->nr_balance_failed > env->sd->cache_nice_tries) { -- if (tsk_cache_hot == 1) { -- schedstat_inc(env->sd->lb_hot_gained[env->idle]); -- schedstat_inc(p->stats.nr_forced_migrations); -- } -+ if (tsk_cache_hot == 1) -+ p->sched_task_hot = 1; - return 1; - } - -@@ -9011,6 +9011,12 @@ static void detach_task(struct task_struct *p, struct lb_env *env) - { - lockdep_assert_rq_held(env->src_rq); - -+ if (p->sched_task_hot) { -+ p->sched_task_hot = 0; -+ schedstat_inc(env->sd->lb_hot_gained[env->idle]); -+ schedstat_inc(p->stats.nr_forced_migrations); -+ } -+ - deactivate_task(env->src_rq, p, DEQUEUE_NOCLOCK); - set_task_cpu(p, env->dst_cpu); - } -@@ -9171,6 +9177,9 @@ static int detach_tasks(struct lb_env *env) - - continue; - next: -+ if (p->sched_task_hot) -+ schedstat_inc(p->stats.nr_failed_migrations_hot); -+ - list_move(&p->se.group_node, tasks); - } - -@@ -9773,7 +9782,7 @@ static bool sched_use_asym_prio(struct sched_domain *sd, int cpu) - * can only do it if @group is an SMT group and has exactly on busy CPU. Larger - * imbalances in the number of CPUS are dealt with in find_busiest_group(). - * -- * If we are balancing load within an SMT core, or at DIE domain level, always -+ * If we are balancing load within an SMT core, or at PKG domain level, always - * proceed. - * - * Return: true if @env::dst_cpu can do with asym_packing load balance. False -diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c -index 3a13cecf177402..2ed884bb362137 100644 ---- a/kernel/sched/topology.c -+++ b/kernel/sched/topology.c -@@ -1117,7 +1117,7 @@ build_overlap_sched_groups(struct sched_domain *sd, int cpu) - * - * - Simultaneous multithreading (SMT) - * - Multi-Core Cache (MC) -- * - Package (DIE) -+ * - Package (PKG) - * - * Where the last one more or less denotes everything up to a NUMA node. - * -@@ -1139,13 +1139,13 @@ build_overlap_sched_groups(struct sched_domain *sd, int cpu) - * - * CPU 0 1 2 3 4 5 6 7 - * -- * DIE [ ] -+ * PKG [ ] - * MC [ ] [ ] - * SMT [ ] [ ] [ ] [ ] - * - * - or - - * -- * DIE 0-7 0-7 0-7 0-7 0-7 0-7 0-7 0-7 -+ * PKG 0-7 0-7 0-7 0-7 0-7 0-7 0-7 0-7 - * MC 0-3 0-3 0-3 0-3 4-7 4-7 4-7 4-7 - * SMT 0-1 0-1 2-3 2-3 4-5 4-5 6-7 6-7 - * -@@ -1679,7 +1679,7 @@ static struct sched_domain_topology_level default_topology[] = { - #ifdef CONFIG_SCHED_MC - { cpu_coregroup_mask, cpu_core_flags, SD_INIT_NAME(MC) }, - #endif -- { cpu_cpu_mask, SD_INIT_NAME(DIE) }, -+ { cpu_cpu_mask, SD_INIT_NAME(PKG) }, - { NULL, }, - }; - -diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c -index aab43ba3daeb51..9d8f60e0cb5546 100644 ---- a/kernel/trace/bpf_trace.c -+++ b/kernel/trace/bpf_trace.c -@@ -616,7 +616,8 @@ static const struct bpf_func_proto bpf_perf_event_read_value_proto = { - - static __always_inline u64 - __bpf_perf_event_output(struct pt_regs *regs, struct bpf_map *map, -- u64 flags, struct perf_sample_data *sd) -+ u64 flags, struct perf_raw_record *raw, -+ struct perf_sample_data *sd) - { - struct bpf_array *array = container_of(map, struct bpf_array, map); - unsigned int cpu = smp_processor_id(); -@@ -641,6 +642,8 @@ __bpf_perf_event_output(struct pt_regs *regs, struct bpf_map *map, - if (unlikely(event->oncpu != cpu)) - return -EOPNOTSUPP; - -+ perf_sample_save_raw_data(sd, event, raw); -+ - return perf_event_output(event, sd, regs); - } - -@@ -684,9 +687,8 @@ BPF_CALL_5(bpf_perf_event_output, struct pt_regs *, regs, struct bpf_map *, map, - } - - perf_sample_data_init(sd, 0, 0); -- perf_sample_save_raw_data(sd, &raw); - -- err = __bpf_perf_event_output(regs, map, flags, sd); -+ err = __bpf_perf_event_output(regs, map, flags, &raw, sd); - out: - this_cpu_dec(bpf_trace_nest_level); - preempt_enable(); -@@ -745,9 +747,8 @@ u64 bpf_event_output(struct bpf_map *map, u64 flags, void *meta, u64 meta_size, - - perf_fetch_caller_regs(regs); - perf_sample_data_init(sd, 0, 0); -- perf_sample_save_raw_data(sd, &raw); - -- ret = __bpf_perf_event_output(regs, map, flags, sd); -+ ret = __bpf_perf_event_output(regs, map, flags, &raw, sd); - out: - this_cpu_dec(bpf_event_output_nest_level); - preempt_enable(); -@@ -852,7 +853,7 @@ static int bpf_send_signal_common(u32 sig, enum pid_type type) - if (unlikely(is_global_init(current))) - return -EPERM; - -- if (irqs_disabled()) { -+ if (!preemptible()) { - /* Do an early check on signal validity. Otherwise, - * the error is lost in deferred irq_work. - */ -diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c -index 26a3095bec4620..0f66dd8715bd87 100644 ---- a/net/ax25/af_ax25.c -+++ b/net/ax25/af_ax25.c -@@ -467,7 +467,7 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg) - goto out_put; - } - --static void ax25_fillin_cb_from_dev(ax25_cb *ax25, ax25_dev *ax25_dev) -+static void ax25_fillin_cb_from_dev(ax25_cb *ax25, const ax25_dev *ax25_dev) - { - ax25->rtt = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T1]) / 2; - ax25->t1 = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T1]); -@@ -677,22 +677,22 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, - break; - } - -- rtnl_lock(); -- dev = __dev_get_by_name(&init_net, devname); -+ rcu_read_lock(); -+ dev = dev_get_by_name_rcu(&init_net, devname); - if (!dev) { -- rtnl_unlock(); -+ rcu_read_unlock(); - res = -ENODEV; - break; - } - - ax25->ax25_dev = ax25_dev_ax25dev(dev); - if (!ax25->ax25_dev) { -- rtnl_unlock(); -+ rcu_read_unlock(); - res = -ENODEV; - break; - } - ax25_fillin_cb(ax25, ax25->ax25_dev); -- rtnl_unlock(); -+ rcu_read_unlock(); - break; - - default: -diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c -index 67ae6b8c52989b..0715f9b1527569 100644 ---- a/net/ax25/ax25_dev.c -+++ b/net/ax25/ax25_dev.c -@@ -87,7 +87,7 @@ void ax25_dev_device_up(struct net_device *dev) - - spin_lock_bh(&ax25_dev_lock); - list_add(&ax25_dev->list, &ax25_dev_list); -- dev->ax25_ptr = ax25_dev; -+ rcu_assign_pointer(dev->ax25_ptr, ax25_dev); - spin_unlock_bh(&ax25_dev_lock); - - ax25_register_dev_sysctl(ax25_dev); -@@ -122,7 +122,7 @@ void ax25_dev_device_down(struct net_device *dev) - } - } - -- dev->ax25_ptr = NULL; -+ RCU_INIT_POINTER(dev->ax25_ptr, NULL); - spin_unlock_bh(&ax25_dev_lock); - netdev_put(dev, &ax25_dev->dev_tracker); - ax25_dev_put(ax25_dev); -diff --git a/net/ax25/ax25_ip.c b/net/ax25/ax25_ip.c -index 36249776c021e7..215d4ccf12b913 100644 ---- a/net/ax25/ax25_ip.c -+++ b/net/ax25/ax25_ip.c -@@ -122,6 +122,7 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb) - if (dev == NULL) - dev = skb->dev; - -+ rcu_read_lock(); - if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL) { - kfree_skb(skb); - goto put; -@@ -202,7 +203,7 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb) - ax25_queue_xmit(skb, dev); - - put: -- -+ rcu_read_unlock(); - ax25_route_lock_unuse(); - return NETDEV_TX_OK; - } -diff --git a/net/ax25/ax25_out.c b/net/ax25/ax25_out.c -index 3db76d2470e954..8bca2ace98e51b 100644 ---- a/net/ax25/ax25_out.c -+++ b/net/ax25/ax25_out.c -@@ -39,10 +39,14 @@ ax25_cb *ax25_send_frame(struct sk_buff *skb, int paclen, const ax25_address *sr - * specified. - */ - if (paclen == 0) { -- if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL) -+ rcu_read_lock(); -+ ax25_dev = ax25_dev_ax25dev(dev); -+ if (!ax25_dev) { -+ rcu_read_unlock(); - return NULL; -- -+ } - paclen = ax25_dev->values[AX25_VALUES_PACLEN]; -+ rcu_read_unlock(); - } - - /* -@@ -53,13 +57,19 @@ ax25_cb *ax25_send_frame(struct sk_buff *skb, int paclen, const ax25_address *sr - return ax25; /* It already existed */ - } - -- if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL) -+ rcu_read_lock(); -+ ax25_dev = ax25_dev_ax25dev(dev); -+ if (!ax25_dev) { -+ rcu_read_unlock(); - return NULL; -+ } - -- if ((ax25 = ax25_create_cb()) == NULL) -+ if ((ax25 = ax25_create_cb()) == NULL) { -+ rcu_read_unlock(); - return NULL; -- -+ } - ax25_fillin_cb(ax25, ax25_dev); -+ rcu_read_unlock(); - - ax25->source_addr = *src; - ax25->dest_addr = *dest; -@@ -358,7 +368,9 @@ void ax25_queue_xmit(struct sk_buff *skb, struct net_device *dev) - { - unsigned char *ptr; - -+ rcu_read_lock(); - skb->protocol = ax25_type_trans(skb, ax25_fwd_dev(dev)); -+ rcu_read_unlock(); - - ptr = skb_push(skb, 1); - *ptr = 0x00; /* KISS */ -diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c -index b7c4d656a94b71..69de75db0c9c21 100644 ---- a/net/ax25/ax25_route.c -+++ b/net/ax25/ax25_route.c -@@ -406,6 +406,7 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr) - ax25_route_lock_unuse(); - return -EHOSTUNREACH; - } -+ rcu_read_lock(); - if ((ax25->ax25_dev = ax25_dev_ax25dev(ax25_rt->dev)) == NULL) { - err = -EHOSTUNREACH; - goto put; -@@ -442,6 +443,7 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr) - } - - put: -+ rcu_read_unlock(); - ax25_route_lock_unuse(); - return err; - } -diff --git a/net/core/dev.c b/net/core/dev.c -index 69da7b009f8b98..479a3892f98c3c 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -9346,6 +9346,10 @@ static int dev_xdp_attach(struct net_device *dev, struct netlink_ext_ack *extack - NL_SET_ERR_MSG(extack, "Program bound to different device"); - return -EINVAL; - } -+ if (bpf_prog_is_dev_bound(new_prog->aux) && mode == XDP_MODE_SKB) { -+ NL_SET_ERR_MSG(extack, "Can't attach device-bound programs in generic mode"); -+ return -EINVAL; -+ } - if (new_prog->expected_attach_type == BPF_XDP_DEVMAP) { - NL_SET_ERR_MSG(extack, "BPF_XDP_DEVMAP programs can not be attached to a device"); - return -EINVAL; -diff --git a/net/core/filter.c b/net/core/filter.c -index 5881944f1681c9..84992279f4b10e 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -7604,7 +7604,7 @@ static const struct bpf_func_proto bpf_sock_ops_load_hdr_opt_proto = { - .gpl_only = false, - .ret_type = RET_INTEGER, - .arg1_type = ARG_PTR_TO_CTX, -- .arg2_type = ARG_PTR_TO_MEM, -+ .arg2_type = ARG_PTR_TO_MEM | MEM_WRITE, - .arg3_type = ARG_CONST_SIZE, - .arg4_type = ARG_ANYTHING, - }; -diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c -index 373b5b2231c492..0b15272dd2d35b 100644 ---- a/net/core/sysctl_net_core.c -+++ b/net/core/sysctl_net_core.c -@@ -297,7 +297,7 @@ static int proc_do_dev_weight(struct ctl_table *table, int write, - int ret, weight; - - mutex_lock(&dev_weight_mutex); -- ret = proc_dointvec(table, write, buffer, lenp, ppos); -+ ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); - if (!ret && write) { - weight = READ_ONCE(weight_p); - WRITE_ONCE(dev_rx_weight, weight * dev_weight_rx_bias); -@@ -422,6 +422,7 @@ static struct ctl_table net_core_table[] = { - .maxlen = sizeof(int), - .mode = 0644, - .proc_handler = proc_do_dev_weight, -+ .extra1 = SYSCTL_ONE, - }, - { - .procname = "dev_weight_rx_bias", -@@ -429,6 +430,7 @@ static struct ctl_table net_core_table[] = { - .maxlen = sizeof(int), - .mode = 0644, - .proc_handler = proc_do_dev_weight, -+ .extra1 = SYSCTL_ONE, - }, - { - .procname = "dev_weight_tx_bias", -@@ -436,6 +438,7 @@ static struct ctl_table net_core_table[] = { - .maxlen = sizeof(int), - .mode = 0644, - .proc_handler = proc_do_dev_weight, -+ .extra1 = SYSCTL_ONE, - }, - { - .procname = "netdev_max_backlog", -diff --git a/net/ethtool/netlink.c b/net/ethtool/netlink.c -index fe3553f60bf39e..c1ad63bee8eade 100644 ---- a/net/ethtool/netlink.c -+++ b/net/ethtool/netlink.c -@@ -41,7 +41,7 @@ int ethnl_ops_begin(struct net_device *dev) - pm_runtime_get_sync(dev->dev.parent); - - if (!netif_device_present(dev) || -- dev->reg_state == NETREG_UNREGISTERING) { -+ dev->reg_state >= NETREG_UNREGISTERING) { - ret = -ENODEV; - goto err; - } -diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c -index 2790f3964d6bd4..9317f96127c1b1 100644 ---- a/net/hsr/hsr_forward.c -+++ b/net/hsr/hsr_forward.c -@@ -588,9 +588,12 @@ static int fill_frame_info(struct hsr_frame_info *frame, - frame->is_vlan = true; - - if (frame->is_vlan) { -- if (skb->mac_len < offsetofend(struct hsr_vlan_ethhdr, vlanhdr)) -+ /* Note: skb->mac_len might be wrong here. */ -+ if (!pskb_may_pull(skb, -+ skb_mac_offset(skb) + -+ offsetofend(struct hsr_vlan_ethhdr, vlanhdr))) - return -EINVAL; -- vlan_hdr = (struct hsr_vlan_ethhdr *)ethhdr; -+ vlan_hdr = (struct hsr_vlan_ethhdr *)skb_mac_header(skb); - proto = vlan_hdr->vlanhdr.h_vlan_encapsulated_proto; - /* FIXME: */ - netdev_warn_once(skb->dev, "VLAN not yet supported"); -diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c -index 9dffdd876fef50..a6adf6a2ec4b57 100644 ---- a/net/ipv4/icmp.c -+++ b/net/ipv4/icmp.c -@@ -316,7 +316,6 @@ static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt, - struct dst_entry *dst = &rt->dst; - struct inet_peer *peer; - bool rc = true; -- int vif; - - if (!apply_ratelimit) - return true; -@@ -325,12 +324,12 @@ static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt, - if (dst->dev && (dst->dev->flags&IFF_LOOPBACK)) - goto out; - -- vif = l3mdev_master_ifindex(dst->dev); -- peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, vif, 1); -+ rcu_read_lock(); -+ peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, -+ l3mdev_master_ifindex_rcu(dst->dev)); - rc = inet_peer_xrlim_allow(peer, - READ_ONCE(net->ipv4.sysctl_icmp_ratelimit)); -- if (peer) -- inet_putpeer(peer); -+ rcu_read_unlock(); - out: - if (!rc) - __ICMP_INC_STATS(net, ICMP_MIB_RATELIMITHOST); -diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c -index e9fed83e9b3cc5..23896b6b8417df 100644 ---- a/net/ipv4/inetpeer.c -+++ b/net/ipv4/inetpeer.c -@@ -98,6 +98,7 @@ static struct inet_peer *lookup(const struct inetpeer_addr *daddr, - { - struct rb_node **pp, *parent, *next; - struct inet_peer *p; -+ u32 now; - - pp = &base->rb_root.rb_node; - parent = NULL; -@@ -111,8 +112,9 @@ static struct inet_peer *lookup(const struct inetpeer_addr *daddr, - p = rb_entry(parent, struct inet_peer, rb_node); - cmp = inetpeer_addr_cmp(daddr, &p->daddr); - if (cmp == 0) { -- if (!refcount_inc_not_zero(&p->refcnt)) -- break; -+ now = jiffies; -+ if (READ_ONCE(p->dtime) != now) -+ WRITE_ONCE(p->dtime, now); - return p; - } - if (gc_stack) { -@@ -158,9 +160,6 @@ static void inet_peer_gc(struct inet_peer_base *base, - for (i = 0; i < gc_cnt; i++) { - p = gc_stack[i]; - -- /* The READ_ONCE() pairs with the WRITE_ONCE() -- * in inet_putpeer() -- */ - delta = (__u32)jiffies - READ_ONCE(p->dtime); - - if (delta < ttl || !refcount_dec_if_one(&p->refcnt)) -@@ -176,31 +175,23 @@ static void inet_peer_gc(struct inet_peer_base *base, - } - } - -+/* Must be called under RCU : No refcount change is done here. */ - struct inet_peer *inet_getpeer(struct inet_peer_base *base, -- const struct inetpeer_addr *daddr, -- int create) -+ const struct inetpeer_addr *daddr) - { - struct inet_peer *p, *gc_stack[PEER_MAX_GC]; - struct rb_node **pp, *parent; - unsigned int gc_cnt, seq; -- int invalidated; - - /* Attempt a lockless lookup first. - * Because of a concurrent writer, we might not find an existing entry. - */ -- rcu_read_lock(); - seq = read_seqbegin(&base->lock); - p = lookup(daddr, base, seq, NULL, &gc_cnt, &parent, &pp); -- invalidated = read_seqretry(&base->lock, seq); -- rcu_read_unlock(); - - if (p) - return p; - -- /* If no writer did a change during our lookup, we can return early. */ -- if (!create && !invalidated) -- return NULL; -- - /* retry an exact lookup, taking the lock before. - * At least, nodes should be hot in our cache. - */ -@@ -209,12 +200,12 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base, - - gc_cnt = 0; - p = lookup(daddr, base, seq, gc_stack, &gc_cnt, &parent, &pp); -- if (!p && create) { -+ if (!p) { - p = kmem_cache_alloc(peer_cachep, GFP_ATOMIC); - if (p) { - p->daddr = *daddr; - p->dtime = (__u32)jiffies; -- refcount_set(&p->refcnt, 2); -+ refcount_set(&p->refcnt, 1); - atomic_set(&p->rid, 0); - p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW; - p->rate_tokens = 0; -@@ -239,15 +230,9 @@ EXPORT_SYMBOL_GPL(inet_getpeer); - - void inet_putpeer(struct inet_peer *p) - { -- /* The WRITE_ONCE() pairs with itself (we run lockless) -- * and the READ_ONCE() in inet_peer_gc() -- */ -- WRITE_ONCE(p->dtime, (__u32)jiffies); -- - if (refcount_dec_and_test(&p->refcnt)) - call_rcu(&p->rcu, inetpeer_free_rcu); - } --EXPORT_SYMBOL_GPL(inet_putpeer); - - /* - * Check transmit rate limitation for given message. -diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c -index fb947d1613fe2b..877d1e03150c77 100644 ---- a/net/ipv4/ip_fragment.c -+++ b/net/ipv4/ip_fragment.c -@@ -82,15 +82,20 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb, - static void ip4_frag_init(struct inet_frag_queue *q, const void *a) - { - struct ipq *qp = container_of(q, struct ipq, q); -- struct net *net = q->fqdir->net; -- - const struct frag_v4_compare_key *key = a; -+ struct net *net = q->fqdir->net; -+ struct inet_peer *p = NULL; - - q->key.v4 = *key; - qp->ecn = 0; -- qp->peer = q->fqdir->max_dist ? -- inet_getpeer_v4(net->ipv4.peers, key->saddr, key->vif, 1) : -- NULL; -+ if (q->fqdir->max_dist) { -+ rcu_read_lock(); -+ p = inet_getpeer_v4(net->ipv4.peers, key->saddr, key->vif); -+ if (p && !refcount_inc_not_zero(&p->refcnt)) -+ p = NULL; -+ rcu_read_unlock(); -+ } -+ qp->peer = p; - } - - static void ip4_frag_free(struct inet_frag_queue *q) -diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c -index dc0ad979a894ab..af9412a507cf34 100644 ---- a/net/ipv4/ipmr.c -+++ b/net/ipv4/ipmr.c -@@ -816,7 +816,7 @@ static void ipmr_update_thresholds(struct mr_table *mrt, struct mr_mfc *cache, - cache->mfc_un.res.maxvif = vifi + 1; - } - } -- cache->mfc_un.res.lastuse = jiffies; -+ WRITE_ONCE(cache->mfc_un.res.lastuse, jiffies); - } - - static int vif_add(struct net *net, struct mr_table *mrt, -@@ -1666,9 +1666,9 @@ int ipmr_ioctl(struct sock *sk, int cmd, void *arg) - rcu_read_lock(); - c = ipmr_cache_find(mrt, sr->src.s_addr, sr->grp.s_addr); - if (c) { -- sr->pktcnt = c->_c.mfc_un.res.pkt; -- sr->bytecnt = c->_c.mfc_un.res.bytes; -- sr->wrong_if = c->_c.mfc_un.res.wrong_if; -+ sr->pktcnt = atomic_long_read(&c->_c.mfc_un.res.pkt); -+ sr->bytecnt = atomic_long_read(&c->_c.mfc_un.res.bytes); -+ sr->wrong_if = atomic_long_read(&c->_c.mfc_un.res.wrong_if); - rcu_read_unlock(); - return 0; - } -@@ -1738,9 +1738,9 @@ int ipmr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg) - rcu_read_lock(); - c = ipmr_cache_find(mrt, sr.src.s_addr, sr.grp.s_addr); - if (c) { -- sr.pktcnt = c->_c.mfc_un.res.pkt; -- sr.bytecnt = c->_c.mfc_un.res.bytes; -- sr.wrong_if = c->_c.mfc_un.res.wrong_if; -+ sr.pktcnt = atomic_long_read(&c->_c.mfc_un.res.pkt); -+ sr.bytecnt = atomic_long_read(&c->_c.mfc_un.res.bytes); -+ sr.wrong_if = atomic_long_read(&c->_c.mfc_un.res.wrong_if); - rcu_read_unlock(); - - if (copy_to_user(arg, &sr, sizeof(sr))) -@@ -1973,9 +1973,9 @@ static void ip_mr_forward(struct net *net, struct mr_table *mrt, - int vif, ct; - - vif = c->_c.mfc_parent; -- c->_c.mfc_un.res.pkt++; -- c->_c.mfc_un.res.bytes += skb->len; -- c->_c.mfc_un.res.lastuse = jiffies; -+ atomic_long_inc(&c->_c.mfc_un.res.pkt); -+ atomic_long_add(skb->len, &c->_c.mfc_un.res.bytes); -+ WRITE_ONCE(c->_c.mfc_un.res.lastuse, jiffies); - - if (c->mfc_origin == htonl(INADDR_ANY) && true_vifi >= 0) { - struct mfc_cache *cache_proxy; -@@ -2006,7 +2006,7 @@ static void ip_mr_forward(struct net *net, struct mr_table *mrt, - goto dont_forward; - } - -- c->_c.mfc_un.res.wrong_if++; -+ atomic_long_inc(&c->_c.mfc_un.res.wrong_if); - - if (true_vifi >= 0 && mrt->mroute_do_assert && - /* pimsm uses asserts, when switching from RPT to SPT, -@@ -3013,9 +3013,9 @@ static int ipmr_mfc_seq_show(struct seq_file *seq, void *v) - - if (it->cache != &mrt->mfc_unres_queue) { - seq_printf(seq, " %8lu %8lu %8lu", -- mfc->_c.mfc_un.res.pkt, -- mfc->_c.mfc_un.res.bytes, -- mfc->_c.mfc_un.res.wrong_if); -+ atomic_long_read(&mfc->_c.mfc_un.res.pkt), -+ atomic_long_read(&mfc->_c.mfc_un.res.bytes), -+ atomic_long_read(&mfc->_c.mfc_un.res.wrong_if)); - for (n = mfc->_c.mfc_un.res.minvif; - n < mfc->_c.mfc_un.res.maxvif; n++) { - if (VIF_EXISTS(mrt, n) && -diff --git a/net/ipv4/ipmr_base.c b/net/ipv4/ipmr_base.c -index f0af12a2f70bcd..28d77d454d442e 100644 ---- a/net/ipv4/ipmr_base.c -+++ b/net/ipv4/ipmr_base.c -@@ -263,9 +263,9 @@ int mr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb, - lastuse = READ_ONCE(c->mfc_un.res.lastuse); - lastuse = time_after_eq(jiffies, lastuse) ? jiffies - lastuse : 0; - -- mfcs.mfcs_packets = c->mfc_un.res.pkt; -- mfcs.mfcs_bytes = c->mfc_un.res.bytes; -- mfcs.mfcs_wrong_if = c->mfc_un.res.wrong_if; -+ mfcs.mfcs_packets = atomic_long_read(&c->mfc_un.res.pkt); -+ mfcs.mfcs_bytes = atomic_long_read(&c->mfc_un.res.bytes); -+ mfcs.mfcs_wrong_if = atomic_long_read(&c->mfc_un.res.wrong_if); - if (nla_put_64bit(skb, RTA_MFC_STATS, sizeof(mfcs), &mfcs, RTA_PAD) || - nla_put_u64_64bit(skb, RTA_EXPIRES, jiffies_to_clock_t(lastuse), - RTA_PAD)) -@@ -330,9 +330,6 @@ int mr_table_dump(struct mr_table *mrt, struct sk_buff *skb, - list_for_each_entry(mfc, &mrt->mfc_unres_queue, list) { - if (e < s_e) - goto next_entry2; -- if (filter->dev && -- !mr_mfc_uses_dev(mrt, mfc, filter->dev)) -- goto next_entry2; - - err = fill(mrt, skb, NETLINK_CB(cb->skb).portid, - cb->nlh->nlmsg_seq, mfc, RTM_NEWROUTE, flags); -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 285482060082f8..61fc2166a870e6 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -882,11 +882,11 @@ void ip_rt_send_redirect(struct sk_buff *skb) - } - log_martians = IN_DEV_LOG_MARTIANS(in_dev); - vif = l3mdev_master_ifindex_rcu(rt->dst.dev); -- rcu_read_unlock(); - - net = dev_net(rt->dst.dev); -- peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, vif, 1); -+ peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, vif); - if (!peer) { -+ rcu_read_unlock(); - icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, - rt_nexthop(rt, ip_hdr(skb)->daddr)); - return; -@@ -905,7 +905,7 @@ void ip_rt_send_redirect(struct sk_buff *skb) - */ - if (peer->n_redirects >= ip_rt_redirect_number) { - peer->rate_last = jiffies; -- goto out_put_peer; -+ goto out_unlock; - } - - /* Check for load limit; set rate_last to the latest sent -@@ -926,8 +926,8 @@ void ip_rt_send_redirect(struct sk_buff *skb) - &ip_hdr(skb)->saddr, inet_iif(skb), - &ip_hdr(skb)->daddr, &gw); - } --out_put_peer: -- inet_putpeer(peer); -+out_unlock: -+ rcu_read_unlock(); - } - - static int ip_error(struct sk_buff *skb) -@@ -987,9 +987,9 @@ static int ip_error(struct sk_buff *skb) - break; - } - -+ rcu_read_lock(); - peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, -- l3mdev_master_ifindex(skb->dev), 1); -- -+ l3mdev_master_ifindex_rcu(skb->dev)); - send = true; - if (peer) { - now = jiffies; -@@ -1001,8 +1001,9 @@ static int ip_error(struct sk_buff *skb) - peer->rate_tokens -= ip_rt_error_cost; - else - send = false; -- inet_putpeer(peer); - } -+ rcu_read_unlock(); -+ - if (send) - icmp_send(skb, ICMP_DEST_UNREACH, code, 0); - -diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c -index 0fd78ecb67e756..5ff7be13deb6b7 100644 ---- a/net/ipv4/tcp_cubic.c -+++ b/net/ipv4/tcp_cubic.c -@@ -392,6 +392,10 @@ static void hystart_update(struct sock *sk, u32 delay) - if (after(tp->snd_una, ca->end_seq)) - bictcp_hystart_reset(sk); - -+ /* hystart triggers when cwnd is larger than some threshold */ -+ if (tcp_snd_cwnd(tp) < hystart_low_window) -+ return; -+ - if (hystart_detect & HYSTART_ACK_TRAIN) { - u32 now = bictcp_clock_us(sk); - -@@ -467,9 +471,7 @@ __bpf_kfunc static void cubictcp_acked(struct sock *sk, const struct ack_sample - if (ca->delay_min == 0 || ca->delay_min > delay) - ca->delay_min = delay; - -- /* hystart triggers when cwnd is larger than some threshold */ -- if (!ca->found && tcp_in_slow_start(tp) && hystart && -- tcp_snd_cwnd(tp) >= hystart_low_window) -+ if (!ca->found && tcp_in_slow_start(tp) && hystart) - hystart_update(sk, delay); - } - -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index cfddc94508f0b7..3771ed22c2f56f 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -263,11 +263,14 @@ static u16 tcp_select_window(struct sock *sk) - u32 cur_win, new_win; - - /* Make the window 0 if we failed to queue the data because we -- * are out of memory. The window is temporary, so we don't store -- * it on the socket. -+ * are out of memory. - */ -- if (unlikely(inet_csk(sk)->icsk_ack.pending & ICSK_ACK_NOMEM)) -+ if (unlikely(inet_csk(sk)->icsk_ack.pending & ICSK_ACK_NOMEM)) { -+ tp->pred_flags = 0; -+ tp->rcv_wnd = 0; -+ tp->rcv_wup = tp->rcv_nxt; - return 0; -+ } - - cur_win = tcp_receive_window(tp); - new_win = __tcp_select_window(sk); -diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c -index 25a3a726fa1177..35df405ce1f753 100644 ---- a/net/ipv6/icmp.c -+++ b/net/ipv6/icmp.c -@@ -222,10 +222,10 @@ static bool icmpv6_xrlim_allow(struct sock *sk, u8 type, - if (rt->rt6i_dst.plen < 128) - tmo >>= ((128 - rt->rt6i_dst.plen)>>5); - -- peer = inet_getpeer_v6(net->ipv6.peers, &fl6->daddr, 1); -+ rcu_read_lock(); -+ peer = inet_getpeer_v6(net->ipv6.peers, &fl6->daddr); - res = inet_peer_xrlim_allow(peer, tmo); -- if (peer) -- inet_putpeer(peer); -+ rcu_read_unlock(); - } - if (!res) - __ICMP6_INC_STATS(net, ip6_dst_idev(dst), -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index 2341a4373bb949..cd89a2b35dfb56 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -612,15 +612,15 @@ int ip6_forward(struct sk_buff *skb) - else - target = &hdr->daddr; - -- peer = inet_getpeer_v6(net->ipv6.peers, &hdr->daddr, 1); -+ rcu_read_lock(); -+ peer = inet_getpeer_v6(net->ipv6.peers, &hdr->daddr); - - /* Limit redirects both by destination (here) - and by source (inside ndisc_send_redirect) - */ - if (inet_peer_xrlim_allow(peer, 1*HZ)) - ndisc_send_redirect(skb, target); -- if (peer) -- inet_putpeer(peer); -+ rcu_read_unlock(); - } else { - int addrtype = ipv6_addr_type(&hdr->saddr); - -diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c -index 1571e85a3531ed..7f19868d7d6c6b 100644 ---- a/net/ipv6/ip6mr.c -+++ b/net/ipv6/ip6mr.c -@@ -506,9 +506,9 @@ static int ipmr_mfc_seq_show(struct seq_file *seq, void *v) - - if (it->cache != &mrt->mfc_unres_queue) { - seq_printf(seq, " %8lu %8lu %8lu", -- mfc->_c.mfc_un.res.pkt, -- mfc->_c.mfc_un.res.bytes, -- mfc->_c.mfc_un.res.wrong_if); -+ atomic_long_read(&mfc->_c.mfc_un.res.pkt), -+ atomic_long_read(&mfc->_c.mfc_un.res.bytes), -+ atomic_long_read(&mfc->_c.mfc_un.res.wrong_if)); - for (n = mfc->_c.mfc_un.res.minvif; - n < mfc->_c.mfc_un.res.maxvif; n++) { - if (VIF_EXISTS(mrt, n) && -@@ -870,7 +870,7 @@ static void ip6mr_update_thresholds(struct mr_table *mrt, - cache->mfc_un.res.maxvif = vifi + 1; - } - } -- cache->mfc_un.res.lastuse = jiffies; -+ WRITE_ONCE(cache->mfc_un.res.lastuse, jiffies); - } - - static int mif6_add(struct net *net, struct mr_table *mrt, -@@ -1931,9 +1931,9 @@ int ip6mr_ioctl(struct sock *sk, int cmd, void *arg) - c = ip6mr_cache_find(mrt, &sr->src.sin6_addr, - &sr->grp.sin6_addr); - if (c) { -- sr->pktcnt = c->_c.mfc_un.res.pkt; -- sr->bytecnt = c->_c.mfc_un.res.bytes; -- sr->wrong_if = c->_c.mfc_un.res.wrong_if; -+ sr->pktcnt = atomic_long_read(&c->_c.mfc_un.res.pkt); -+ sr->bytecnt = atomic_long_read(&c->_c.mfc_un.res.bytes); -+ sr->wrong_if = atomic_long_read(&c->_c.mfc_un.res.wrong_if); - rcu_read_unlock(); - return 0; - } -@@ -2003,9 +2003,9 @@ int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg) - rcu_read_lock(); - c = ip6mr_cache_find(mrt, &sr.src.sin6_addr, &sr.grp.sin6_addr); - if (c) { -- sr.pktcnt = c->_c.mfc_un.res.pkt; -- sr.bytecnt = c->_c.mfc_un.res.bytes; -- sr.wrong_if = c->_c.mfc_un.res.wrong_if; -+ sr.pktcnt = atomic_long_read(&c->_c.mfc_un.res.pkt); -+ sr.bytecnt = atomic_long_read(&c->_c.mfc_un.res.bytes); -+ sr.wrong_if = atomic_long_read(&c->_c.mfc_un.res.wrong_if); - rcu_read_unlock(); - - if (copy_to_user(arg, &sr, sizeof(sr))) -@@ -2128,9 +2128,9 @@ static void ip6_mr_forward(struct net *net, struct mr_table *mrt, - int true_vifi = ip6mr_find_vif(mrt, dev); - - vif = c->_c.mfc_parent; -- c->_c.mfc_un.res.pkt++; -- c->_c.mfc_un.res.bytes += skb->len; -- c->_c.mfc_un.res.lastuse = jiffies; -+ atomic_long_inc(&c->_c.mfc_un.res.pkt); -+ atomic_long_add(skb->len, &c->_c.mfc_un.res.bytes); -+ WRITE_ONCE(c->_c.mfc_un.res.lastuse, jiffies); - - if (ipv6_addr_any(&c->mf6c_origin) && true_vifi >= 0) { - struct mfc6_cache *cache_proxy; -@@ -2148,7 +2148,7 @@ static void ip6_mr_forward(struct net *net, struct mr_table *mrt, - * Wrong interface: drop packet and (maybe) send PIM assert. - */ - if (rcu_access_pointer(mrt->vif_table[vif].dev) != dev) { -- c->_c.mfc_un.res.wrong_if++; -+ atomic_long_inc(&c->_c.mfc_un.res.wrong_if); - - if (true_vifi >= 0 && mrt->mroute_do_assert && - /* pimsm uses asserts, when switching from RPT to SPT, -diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c -index 23b46b5705c537..2ad0ef47b07c24 100644 ---- a/net/ipv6/ndisc.c -+++ b/net/ipv6/ndisc.c -@@ -1717,10 +1717,12 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target) - "Redirect: destination is not a neighbour\n"); - goto release; - } -- peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr, 1); -+ -+ rcu_read_lock(); -+ peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr); - ret = inet_peer_xrlim_allow(peer, 1*HZ); -- if (peer) -- inet_putpeer(peer); -+ rcu_read_unlock(); -+ - if (!ret) - goto release; - -diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c -index 63250286dc8b7a..d6938ffd764caf 100644 ---- a/net/mac80211/debugfs_netdev.c -+++ b/net/mac80211/debugfs_netdev.c -@@ -616,7 +616,7 @@ static ssize_t ieee80211_if_parse_active_links(struct ieee80211_sub_if_data *sda - { - u16 active_links; - -- if (kstrtou16(buf, 0, &active_links)) -+ if (kstrtou16(buf, 0, &active_links) || !active_links) - return -EINVAL; - - return ieee80211_set_active_links(&sdata->vif, active_links) ?: buflen; -diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h -index 2bc2fbe58f944b..78aa3bc51586e2 100644 ---- a/net/mac80211/driver-ops.h -+++ b/net/mac80211/driver-ops.h -@@ -665,6 +665,9 @@ static inline void drv_flush_sta(struct ieee80211_local *local, - if (sdata && !check_sdata_in_driver(sdata)) - return; - -+ if (!sta->uploaded) -+ return; -+ - trace_drv_flush_sta(local, sdata, &sta->sta); - if (local->ops->flush_sta) - local->ops->flush_sta(&local->hw, &sdata->vif, &sta->sta); -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index 604863cebc198a..5eb233f619817b 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -2957,6 +2957,7 @@ ieee80211_rx_mesh_data(struct ieee80211_sub_if_data *sdata, struct sta_info *sta - } - - IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames); -+ ieee80211_set_qos_hdr(sdata, fwd_skb); - ieee80211_add_pending_skb(local, fwd_skb); - - rx_accept: -diff --git a/net/mptcp/options.c b/net/mptcp/options.c -index 8e6a6dc6e0a409..838c154b2b90f5 100644 ---- a/net/mptcp/options.c -+++ b/net/mptcp/options.c -@@ -108,7 +108,6 @@ static void mptcp_parse_option(const struct sk_buff *skb, - mp_opt->suboptions |= OPTION_MPTCP_DSS; - mp_opt->use_map = 1; - mp_opt->mpc_map = 1; -- mp_opt->use_ack = 0; - mp_opt->data_len = get_unaligned_be16(ptr); - ptr += 2; - } -@@ -157,11 +156,6 @@ static void mptcp_parse_option(const struct sk_buff *skb, - pr_debug("DSS\n"); - ptr++; - -- /* we must clear 'mpc_map' be able to detect MP_CAPABLE -- * map vs DSS map in mptcp_incoming_options(), and reconstruct -- * map info accordingly -- */ -- mp_opt->mpc_map = 0; - flags = (*ptr++) & MPTCP_DSS_FLAG_MASK; - mp_opt->data_fin = (flags & MPTCP_DSS_DATA_FIN) != 0; - mp_opt->dsn64 = (flags & MPTCP_DSS_DSN64) != 0; -@@ -369,8 +363,11 @@ void mptcp_get_options(const struct sk_buff *skb, - const unsigned char *ptr; - int length; - -- /* initialize option status */ -- mp_opt->suboptions = 0; -+ /* Ensure that casting the whole status to u32 is efficient and safe */ -+ BUILD_BUG_ON(sizeof_field(struct mptcp_options_received, status) != sizeof(u32)); -+ BUILD_BUG_ON(!IS_ALIGNED(offsetof(struct mptcp_options_received, status), -+ sizeof(u32))); -+ *(u32 *)&mp_opt->status = 0; - - length = (th->doff * 4) - sizeof(struct tcphdr); - ptr = (const unsigned char *)(th + 1); -diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c -index 07f3a9703312e5..5143214695dcd8 100644 ---- a/net/mptcp/protocol.c -+++ b/net/mptcp/protocol.c -@@ -1768,8 +1768,10 @@ static int mptcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg, - * see mptcp_disconnect(). - * Attempt it again outside the problematic scope. - */ -- if (!mptcp_disconnect(sk, 0)) -+ if (!mptcp_disconnect(sk, 0)) { -+ sk->sk_disconnects++; - sk->sk_socket->state = SS_UNCONNECTED; -+ } - } - inet_clear_bit(DEFER_CONNECT, sk); - -diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h -index 88c762de772875..0bb0386aa0897e 100644 ---- a/net/mptcp/protocol.h -+++ b/net/mptcp/protocol.h -@@ -149,22 +149,24 @@ struct mptcp_options_received { - u32 subflow_seq; - u16 data_len; - __sum16 csum; -- u16 suboptions; -+ struct_group(status, -+ u16 suboptions; -+ u16 use_map:1, -+ dsn64:1, -+ data_fin:1, -+ use_ack:1, -+ ack64:1, -+ mpc_map:1, -+ reset_reason:4, -+ reset_transient:1, -+ echo:1, -+ backup:1, -+ deny_join_id0:1, -+ __unused:2; -+ ); -+ u8 join_id; - u32 token; - u32 nonce; -- u16 use_map:1, -- dsn64:1, -- data_fin:1, -- use_ack:1, -- ack64:1, -- mpc_map:1, -- reset_reason:4, -- reset_transient:1, -- echo:1, -- backup:1, -- deny_join_id0:1, -- __unused:2; -- u8 join_id; - u64 thmac; - u8 hmac[MPTCPOPT_HMAC_LEN]; - struct mptcp_addr_info addr; -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 1d1e998acd675e..bf24c63aff7b54 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -4552,6 +4552,14 @@ static int nf_tables_fill_set_concat(struct sk_buff *skb, - return 0; - } - -+static u32 nft_set_userspace_size(const struct nft_set_ops *ops, u32 size) -+{ -+ if (ops->usize) -+ return ops->usize(size); -+ -+ return size; -+} -+ - static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, - const struct nft_set *set, u16 event, u16 flags) - { -@@ -4622,7 +4630,8 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, - if (!nest) - goto nla_put_failure; - if (set->size && -- nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size))) -+ nla_put_be32(skb, NFTA_SET_DESC_SIZE, -+ htonl(nft_set_userspace_size(set->ops, set->size)))) - goto nla_put_failure; - - if (set->field_count > 1 && -@@ -4866,7 +4875,7 @@ static int nft_set_desc_concat_parse(const struct nlattr *attr, - static int nft_set_desc_concat(struct nft_set_desc *desc, - const struct nlattr *nla) - { -- u32 num_regs = 0, key_num_regs = 0; -+ u32 len = 0, num_regs; - struct nlattr *attr; - int rem, err, i; - -@@ -4880,12 +4889,12 @@ static int nft_set_desc_concat(struct nft_set_desc *desc, - } - - for (i = 0; i < desc->field_count; i++) -- num_regs += DIV_ROUND_UP(desc->field_len[i], sizeof(u32)); -+ len += round_up(desc->field_len[i], sizeof(u32)); - -- key_num_regs = DIV_ROUND_UP(desc->klen, sizeof(u32)); -- if (key_num_regs != num_regs) -+ if (len != desc->klen) - return -EINVAL; - -+ num_regs = DIV_ROUND_UP(desc->klen, sizeof(u32)); - if (num_regs > NFT_REG32_COUNT) - return -E2BIG; - -@@ -4992,6 +5001,15 @@ static bool nft_set_is_same(const struct nft_set *set, - return true; - } - -+static u32 nft_set_kernel_size(const struct nft_set_ops *ops, -+ const struct nft_set_desc *desc) -+{ -+ if (ops->ksize) -+ return ops->ksize(desc->size); -+ -+ return desc->size; -+} -+ - static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, - const struct nlattr * const nla[]) - { -@@ -5174,6 +5192,9 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, - if (err < 0) - return err; - -+ if (desc.size) -+ desc.size = nft_set_kernel_size(set->ops, &desc); -+ - err = 0; - if (!nft_set_is_same(set, &desc, exprs, num_exprs, flags)) { - NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]); -@@ -5196,6 +5217,9 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, - if (IS_ERR(ops)) - return PTR_ERR(ops); - -+ if (desc.size) -+ desc.size = nft_set_kernel_size(ops, &desc); -+ - udlen = 0; - if (nla[NFTA_SET_USERDATA]) - udlen = nla_len(nla[NFTA_SET_USERDATA]); -@@ -6679,6 +6703,27 @@ static bool nft_setelem_valid_key_end(const struct nft_set *set, - return true; - } - -+static u32 nft_set_maxsize(const struct nft_set *set) -+{ -+ u32 maxsize, delta; -+ -+ if (!set->size) -+ return UINT_MAX; -+ -+ if (set->ops->adjust_maxsize) -+ delta = set->ops->adjust_maxsize(set); -+ else -+ delta = 0; -+ -+ if (check_add_overflow(set->size, set->ndeact, &maxsize)) -+ return UINT_MAX; -+ -+ if (check_add_overflow(maxsize, delta, &maxsize)) -+ return UINT_MAX; -+ -+ return maxsize; -+} -+ - static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, - const struct nlattr *attr, u32 nlmsg_flags) - { -@@ -7023,7 +7068,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, - } - - if (!(flags & NFT_SET_ELEM_CATCHALL)) { -- unsigned int max = set->size ? set->size + set->ndeact : UINT_MAX; -+ unsigned int max = nft_set_maxsize(set); - - if (!atomic_add_unless(&set->nelems, 1, max)) { - err = -ENFILE; -diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c -index 397351fa4d5f82..5a3d6854204202 100644 ---- a/net/netfilter/nft_flow_offload.c -+++ b/net/netfilter/nft_flow_offload.c -@@ -288,6 +288,15 @@ static bool nft_flow_offload_skip(struct sk_buff *skb, int family) - return false; - } - -+static void flow_offload_ct_tcp(struct nf_conn *ct) -+{ -+ /* conntrack will not see all packets, disable tcp window validation. */ -+ spin_lock_bh(&ct->lock); -+ ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; -+ ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; -+ spin_unlock_bh(&ct->lock); -+} -+ - static void nft_flow_offload_eval(const struct nft_expr *expr, - struct nft_regs *regs, - const struct nft_pktinfo *pkt) -@@ -355,11 +364,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, - goto err_flow_alloc; - - flow_offload_route_init(flow, &route); -- -- if (tcph) { -- ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; -- ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; -- } -+ if (tcph) -+ flow_offload_ct_tcp(ct); - - ret = flow_offload_add(flowtable, flow); - if (ret < 0) -diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c -index 334958ef8d66c8..5dab9905ebbecc 100644 ---- a/net/netfilter/nft_set_pipapo.c -+++ b/net/netfilter/nft_set_pipapo.c -@@ -1574,12 +1574,11 @@ static void nft_pipapo_gc_deactivate(struct net *net, struct nft_set *set, - - /** - * pipapo_gc() - Drop expired entries from set, destroy start and end elements -- * @_set: nftables API set representation -+ * @set: nftables API set representation - * @m: Matching data - */ --static void pipapo_gc(const struct nft_set *_set, struct nft_pipapo_match *m) -+static void pipapo_gc(struct nft_set *set, struct nft_pipapo_match *m) - { -- struct nft_set *set = (struct nft_set *) _set; - struct nft_pipapo *priv = nft_set_priv(set); - struct net *net = read_pnet(&set->net); - int rules_f0, first_rule = 0; -@@ -1693,7 +1692,7 @@ static void pipapo_reclaim_match(struct rcu_head *rcu) - * We also need to create a new working copy for subsequent insertions and - * deletions. - */ --static void nft_pipapo_commit(const struct nft_set *set) -+static void nft_pipapo_commit(struct nft_set *set) - { - struct nft_pipapo *priv = nft_set_priv(set); - struct nft_pipapo_match *new_clone, *old; -diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c -index afbda7e3fd0487..8ad1e008d12b5b 100644 ---- a/net/netfilter/nft_set_rbtree.c -+++ b/net/netfilter/nft_set_rbtree.c -@@ -19,7 +19,7 @@ struct nft_rbtree { - struct rb_root root; - rwlock_t lock; - seqcount_rwlock_t count; -- struct delayed_work gc_work; -+ unsigned long last_gc; - }; - - struct nft_rbtree_elem { -@@ -48,8 +48,7 @@ static int nft_rbtree_cmp(const struct nft_set *set, - - static bool nft_rbtree_elem_expired(const struct nft_rbtree_elem *rbe) - { -- return nft_set_elem_expired(&rbe->ext) || -- nft_set_elem_is_dead(&rbe->ext); -+ return nft_set_elem_expired(&rbe->ext); - } - - static bool __nft_rbtree_lookup(const struct net *net, const struct nft_set *set, -@@ -221,14 +220,15 @@ static void *nft_rbtree_get(const struct net *net, const struct nft_set *set, - return rbe; - } - --static void nft_rbtree_gc_remove(struct net *net, struct nft_set *set, -- struct nft_rbtree *priv, -- struct nft_rbtree_elem *rbe) -+static void nft_rbtree_gc_elem_remove(struct net *net, struct nft_set *set, -+ struct nft_rbtree *priv, -+ struct nft_rbtree_elem *rbe) - { - struct nft_set_elem elem = { - .priv = rbe, - }; - -+ lockdep_assert_held_write(&priv->lock); - nft_setelem_data_deactivate(net, set, &elem); - rb_erase(&rbe->node, &priv->root); - } -@@ -263,7 +263,7 @@ nft_rbtree_gc_elem(const struct nft_set *__set, struct nft_rbtree *priv, - rbe_prev = NULL; - if (prev) { - rbe_prev = rb_entry(prev, struct nft_rbtree_elem, node); -- nft_rbtree_gc_remove(net, set, priv, rbe_prev); -+ nft_rbtree_gc_elem_remove(net, set, priv, rbe_prev); - - /* There is always room in this trans gc for this element, - * memory allocation never actually happens, hence, the warning -@@ -277,7 +277,7 @@ nft_rbtree_gc_elem(const struct nft_set *__set, struct nft_rbtree *priv, - nft_trans_gc_elem_add(gc, rbe_prev); - } - -- nft_rbtree_gc_remove(net, set, priv, rbe); -+ nft_rbtree_gc_elem_remove(net, set, priv, rbe); - gc = nft_trans_gc_queue_sync(gc, GFP_ATOMIC); - if (WARN_ON_ONCE(!gc)) - return ERR_PTR(-ENOMEM); -@@ -507,6 +507,15 @@ static int nft_rbtree_insert(const struct net *net, const struct nft_set *set, - return err; - } - -+static void nft_rbtree_erase(struct nft_rbtree *priv, struct nft_rbtree_elem *rbe) -+{ -+ write_lock_bh(&priv->lock); -+ write_seqcount_begin(&priv->count); -+ rb_erase(&rbe->node, &priv->root); -+ write_seqcount_end(&priv->count); -+ write_unlock_bh(&priv->lock); -+} -+ - static void nft_rbtree_remove(const struct net *net, - const struct nft_set *set, - const struct nft_set_elem *elem) -@@ -514,11 +523,7 @@ static void nft_rbtree_remove(const struct net *net, - struct nft_rbtree *priv = nft_set_priv(set); - struct nft_rbtree_elem *rbe = elem->priv; - -- write_lock_bh(&priv->lock); -- write_seqcount_begin(&priv->count); -- rb_erase(&rbe->node, &priv->root); -- write_seqcount_end(&priv->count); -- write_unlock_bh(&priv->lock); -+ nft_rbtree_erase(priv, rbe); - } - - static void nft_rbtree_activate(const struct net *net, -@@ -610,45 +615,40 @@ static void nft_rbtree_walk(const struct nft_ctx *ctx, - read_unlock_bh(&priv->lock); - } - --static void nft_rbtree_gc(struct work_struct *work) -+static void nft_rbtree_gc_remove(struct net *net, struct nft_set *set, -+ struct nft_rbtree *priv, -+ struct nft_rbtree_elem *rbe) -+{ -+ struct nft_set_elem elem = { -+ .priv = rbe, -+ }; -+ -+ nft_setelem_data_deactivate(net, set, &elem); -+ nft_rbtree_erase(priv, rbe); -+} -+ -+static void nft_rbtree_gc(struct nft_set *set) - { -+ struct nft_rbtree *priv = nft_set_priv(set); - struct nft_rbtree_elem *rbe, *rbe_end = NULL; - struct nftables_pernet *nft_net; -- struct nft_rbtree *priv; -+ struct rb_node *node, *next; - struct nft_trans_gc *gc; -- struct rb_node *node; -- struct nft_set *set; -- unsigned int gc_seq; - struct net *net; - -- priv = container_of(work, struct nft_rbtree, gc_work.work); - set = nft_set_container_of(priv); - net = read_pnet(&set->net); - nft_net = nft_pernet(net); -- gc_seq = READ_ONCE(nft_net->gc_seq); - -- if (nft_set_gc_is_pending(set)) -- goto done; -- -- gc = nft_trans_gc_alloc(set, gc_seq, GFP_KERNEL); -+ gc = nft_trans_gc_alloc(set, 0, GFP_KERNEL); - if (!gc) -- goto done; -+ return; - -- read_lock_bh(&priv->lock); -- for (node = rb_first(&priv->root); node != NULL; node = rb_next(node)) { -- -- /* Ruleset has been updated, try later. */ -- if (READ_ONCE(nft_net->gc_seq) != gc_seq) { -- nft_trans_gc_destroy(gc); -- gc = NULL; -- goto try_later; -- } -+ for (node = rb_first(&priv->root); node ; node = next) { -+ next = rb_next(node); - - rbe = rb_entry(node, struct nft_rbtree_elem, node); - -- if (nft_set_elem_is_dead(&rbe->ext)) -- goto dead_elem; -- - /* elements are reversed in the rbtree for historical reasons, - * from highest to lowest value, that is why end element is - * always visited before the start element. -@@ -660,37 +660,34 @@ static void nft_rbtree_gc(struct work_struct *work) - if (!nft_set_elem_expired(&rbe->ext)) - continue; - -- nft_set_elem_dead(&rbe->ext); -- -- if (!rbe_end) -- continue; -- -- nft_set_elem_dead(&rbe_end->ext); -- -- gc = nft_trans_gc_queue_async(gc, gc_seq, GFP_ATOMIC); -+ gc = nft_trans_gc_queue_sync(gc, GFP_KERNEL); - if (!gc) - goto try_later; - -- nft_trans_gc_elem_add(gc, rbe_end); -- rbe_end = NULL; --dead_elem: -- gc = nft_trans_gc_queue_async(gc, gc_seq, GFP_ATOMIC); -+ /* end element needs to be removed first, it has -+ * no timeout extension. -+ */ -+ if (rbe_end) { -+ nft_rbtree_gc_remove(net, set, priv, rbe_end); -+ nft_trans_gc_elem_add(gc, rbe_end); -+ rbe_end = NULL; -+ } -+ -+ gc = nft_trans_gc_queue_sync(gc, GFP_KERNEL); - if (!gc) - goto try_later; - -+ nft_rbtree_gc_remove(net, set, priv, rbe); - nft_trans_gc_elem_add(gc, rbe); - } - -- gc = nft_trans_gc_catchall_async(gc, gc_seq); -- - try_later: -- read_unlock_bh(&priv->lock); - -- if (gc) -- nft_trans_gc_queue_async_done(gc); --done: -- queue_delayed_work(system_power_efficient_wq, &priv->gc_work, -- nft_set_gc_interval(set)); -+ if (gc) { -+ gc = nft_trans_gc_catchall_sync(gc); -+ nft_trans_gc_queue_sync_done(gc); -+ priv->last_gc = jiffies; -+ } - } - - static u64 nft_rbtree_privsize(const struct nlattr * const nla[], -@@ -709,11 +706,6 @@ static int nft_rbtree_init(const struct nft_set *set, - seqcount_rwlock_init(&priv->count, &priv->lock); - priv->root = RB_ROOT; - -- INIT_DEFERRABLE_WORK(&priv->gc_work, nft_rbtree_gc); -- if (set->flags & NFT_SET_TIMEOUT) -- queue_delayed_work(system_power_efficient_wq, &priv->gc_work, -- nft_set_gc_interval(set)); -- - return 0; - } - -@@ -724,8 +716,6 @@ static void nft_rbtree_destroy(const struct nft_ctx *ctx, - struct nft_rbtree_elem *rbe; - struct rb_node *node; - -- cancel_delayed_work_sync(&priv->gc_work); -- rcu_barrier(); - while ((node = priv->root.rb_node) != NULL) { - rb_erase(node, &priv->root); - rbe = rb_entry(node, struct nft_rbtree_elem, node); -@@ -751,6 +741,61 @@ static bool nft_rbtree_estimate(const struct nft_set_desc *desc, u32 features, - return true; - } - -+static void nft_rbtree_commit(struct nft_set *set) -+{ -+ struct nft_rbtree *priv = nft_set_priv(set); -+ -+ if (time_after_eq(jiffies, priv->last_gc + nft_set_gc_interval(set))) -+ nft_rbtree_gc(set); -+} -+ -+static void nft_rbtree_gc_init(const struct nft_set *set) -+{ -+ struct nft_rbtree *priv = nft_set_priv(set); -+ -+ priv->last_gc = jiffies; -+} -+ -+/* rbtree stores ranges as singleton elements, each range is composed of two -+ * elements ... -+ */ -+static u32 nft_rbtree_ksize(u32 size) -+{ -+ return size * 2; -+} -+ -+/* ... hide this detail to userspace. */ -+static u32 nft_rbtree_usize(u32 size) -+{ -+ if (!size) -+ return 0; -+ -+ return size / 2; -+} -+ -+static u32 nft_rbtree_adjust_maxsize(const struct nft_set *set) -+{ -+ struct nft_rbtree *priv = nft_set_priv(set); -+ struct nft_rbtree_elem *rbe; -+ struct rb_node *node; -+ const void *key; -+ -+ node = rb_last(&priv->root); -+ if (!node) -+ return 0; -+ -+ rbe = rb_entry(node, struct nft_rbtree_elem, node); -+ if (!nft_rbtree_interval_end(rbe)) -+ return 0; -+ -+ key = nft_set_ext_key(&rbe->ext); -+ if (memchr(key, 1, set->klen)) -+ return 0; -+ -+ /* this is the all-zero no-match element. */ -+ return 1; -+} -+ - const struct nft_set_type nft_set_rbtree_type = { - .features = NFT_SET_INTERVAL | NFT_SET_MAP | NFT_SET_OBJECT | NFT_SET_TIMEOUT, - .ops = { -@@ -764,8 +809,13 @@ const struct nft_set_type nft_set_rbtree_type = { - .deactivate = nft_rbtree_deactivate, - .flush = nft_rbtree_flush, - .activate = nft_rbtree_activate, -+ .commit = nft_rbtree_commit, -+ .gc_init = nft_rbtree_gc_init, - .lookup = nft_rbtree_lookup, - .walk = nft_rbtree_walk, - .get = nft_rbtree_get, -+ .ksize = nft_rbtree_ksize, -+ .usize = nft_rbtree_usize, -+ .adjust_maxsize = nft_rbtree_adjust_maxsize, - }, - }; -diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c -index 42e8b9e37516b2..342823b918e7cc 100644 ---- a/net/rose/af_rose.c -+++ b/net/rose/af_rose.c -@@ -397,15 +397,15 @@ static int rose_setsockopt(struct socket *sock, int level, int optname, - { - struct sock *sk = sock->sk; - struct rose_sock *rose = rose_sk(sk); -- int opt; -+ unsigned int opt; - - if (level != SOL_ROSE) - return -ENOPROTOOPT; - -- if (optlen < sizeof(int)) -+ if (optlen < sizeof(unsigned int)) - return -EINVAL; - -- if (copy_from_sockptr(&opt, optval, sizeof(int))) -+ if (copy_from_sockptr(&opt, optval, sizeof(unsigned int))) - return -EFAULT; - - switch (optname) { -@@ -414,31 +414,31 @@ static int rose_setsockopt(struct socket *sock, int level, int optname, - return 0; - - case ROSE_T1: -- if (opt < 1) -+ if (opt < 1 || opt > UINT_MAX / HZ) - return -EINVAL; - rose->t1 = opt * HZ; - return 0; - - case ROSE_T2: -- if (opt < 1) -+ if (opt < 1 || opt > UINT_MAX / HZ) - return -EINVAL; - rose->t2 = opt * HZ; - return 0; - - case ROSE_T3: -- if (opt < 1) -+ if (opt < 1 || opt > UINT_MAX / HZ) - return -EINVAL; - rose->t3 = opt * HZ; - return 0; - - case ROSE_HOLDBACK: -- if (opt < 1) -+ if (opt < 1 || opt > UINT_MAX / HZ) - return -EINVAL; - rose->hb = opt * HZ; - return 0; - - case ROSE_IDLE: -- if (opt < 0) -+ if (opt > UINT_MAX / (60 * HZ)) - return -EINVAL; - rose->idle = opt * 60 * HZ; - return 0; -diff --git a/net/rose/rose_timer.c b/net/rose/rose_timer.c -index f06ddbed3fed63..1525773e94aa17 100644 ---- a/net/rose/rose_timer.c -+++ b/net/rose/rose_timer.c -@@ -122,6 +122,10 @@ static void rose_heartbeat_expiry(struct timer_list *t) - struct rose_sock *rose = rose_sk(sk); - - bh_lock_sock(sk); -+ if (sock_owned_by_user(sk)) { -+ sk_reset_timer(sk, &sk->sk_timer, jiffies + HZ/20); -+ goto out; -+ } - switch (rose->state) { - case ROSE_STATE_0: - /* Magic here: If we listen() and a new link dies before it -@@ -152,6 +156,7 @@ static void rose_heartbeat_expiry(struct timer_list *t) - } - - rose_start_heartbeat(sk); -+out: - bh_unlock_sock(sk); - sock_put(sk); - } -@@ -162,6 +167,10 @@ static void rose_timer_expiry(struct timer_list *t) - struct sock *sk = &rose->sock; - - bh_lock_sock(sk); -+ if (sock_owned_by_user(sk)) { -+ sk_reset_timer(sk, &rose->timer, jiffies + HZ/20); -+ goto out; -+ } - switch (rose->state) { - case ROSE_STATE_1: /* T1 */ - case ROSE_STATE_4: /* T2 */ -@@ -182,6 +191,7 @@ static void rose_timer_expiry(struct timer_list *t) - } - break; - } -+out: - bh_unlock_sock(sk); - sock_put(sk); - } -@@ -192,6 +202,10 @@ static void rose_idletimer_expiry(struct timer_list *t) - struct sock *sk = &rose->sock; - - bh_lock_sock(sk); -+ if (sock_owned_by_user(sk)) { -+ sk_reset_timer(sk, &rose->idletimer, jiffies + HZ/20); -+ goto out; -+ } - rose_clear_queues(sk); - - rose_write_internal(sk, ROSE_CLEAR_REQUEST); -@@ -207,6 +221,7 @@ static void rose_idletimer_expiry(struct timer_list *t) - sk->sk_state_change(sk); - sock_set_flag(sk, SOCK_DEAD); - } -+out: - bh_unlock_sock(sk); - sock_put(sk); - } -diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c -index 598b4ee389fc1e..2a1396cd892f30 100644 ---- a/net/rxrpc/conn_event.c -+++ b/net/rxrpc/conn_event.c -@@ -63,11 +63,12 @@ int rxrpc_abort_conn(struct rxrpc_connection *conn, struct sk_buff *skb, - /* - * Mark a connection as being remotely aborted. - */ --static bool rxrpc_input_conn_abort(struct rxrpc_connection *conn, -+static void rxrpc_input_conn_abort(struct rxrpc_connection *conn, - struct sk_buff *skb) - { -- return rxrpc_set_conn_aborted(conn, skb, skb->priority, -ECONNABORTED, -- RXRPC_CALL_REMOTELY_ABORTED); -+ trace_rxrpc_rx_conn_abort(conn, skb); -+ rxrpc_set_conn_aborted(conn, skb, skb->priority, -ECONNABORTED, -+ RXRPC_CALL_REMOTELY_ABORTED); - } - - /* -@@ -202,11 +203,14 @@ static void rxrpc_abort_calls(struct rxrpc_connection *conn) - - for (i = 0; i < RXRPC_MAXCALLS; i++) { - call = conn->channels[i].call; -- if (call) -+ if (call) { -+ rxrpc_see_call(call, rxrpc_call_see_conn_abort); - rxrpc_set_call_completion(call, - conn->completion, - conn->abort_code, - conn->error); -+ rxrpc_poke_call(call, rxrpc_call_poke_conn_abort); -+ } - } - - _leave(""); -diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c -index 00f95e7d1b9116..7cddaa6321c7c9 100644 ---- a/net/sched/sch_api.c -+++ b/net/sched/sch_api.c -@@ -1635,6 +1635,10 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n, - q = qdisc_lookup(dev, tcm->tcm_handle); - if (!q) - goto create_n_graft; -+ if (q->parent != tcm->tcm_parent) { -+ NL_SET_ERR_MSG(extack, "Cannot move an existing qdisc to a different parent"); -+ return -EINVAL; -+ } - if (n->nlmsg_flags & NLM_F_EXCL) { - NL_SET_ERR_MSG(extack, "Exclusivity flag on, cannot override"); - return -EEXIST; -diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c -index 66dcb18638fea4..60754f366ab7bc 100644 ---- a/net/sched/sch_sfq.c -+++ b/net/sched/sch_sfq.c -@@ -77,12 +77,6 @@ - #define SFQ_EMPTY_SLOT 0xffff - #define SFQ_DEFAULT_HASH_DIVISOR 1024 - --/* We use 16 bits to store allot, and want to handle packets up to 64K -- * Scale allot by 8 (1<<3) so that no overflow occurs. -- */ --#define SFQ_ALLOT_SHIFT 3 --#define SFQ_ALLOT_SIZE(X) DIV_ROUND_UP(X, 1 << SFQ_ALLOT_SHIFT) -- - /* This type should contain at least SFQ_MAX_DEPTH + 1 + SFQ_MAX_FLOWS values */ - typedef u16 sfq_index; - -@@ -104,7 +98,7 @@ struct sfq_slot { - sfq_index next; /* next slot in sfq RR chain */ - struct sfq_head dep; /* anchor in dep[] chains */ - unsigned short hash; /* hash value (index in ht[]) */ -- short allot; /* credit for this slot */ -+ int allot; /* credit for this slot */ - - unsigned int backlog; - struct red_vars vars; -@@ -120,7 +114,6 @@ struct sfq_sched_data { - siphash_key_t perturbation; - u8 cur_depth; /* depth of longest slot */ - u8 flags; -- unsigned short scaled_quantum; /* SFQ_ALLOT_SIZE(quantum) */ - struct tcf_proto __rcu *filter_list; - struct tcf_block *block; - sfq_index *ht; /* Hash table ('divisor' slots) */ -@@ -456,7 +449,7 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free) - */ - q->tail = slot; - /* We could use a bigger initial quantum for new flows */ -- slot->allot = q->scaled_quantum; -+ slot->allot = q->quantum; - } - if (++sch->q.qlen <= q->limit) - return NET_XMIT_SUCCESS; -@@ -493,7 +486,7 @@ sfq_dequeue(struct Qdisc *sch) - slot = &q->slots[a]; - if (slot->allot <= 0) { - q->tail = slot; -- slot->allot += q->scaled_quantum; -+ slot->allot += q->quantum; - goto next_slot; - } - skb = slot_dequeue_head(slot); -@@ -512,7 +505,7 @@ sfq_dequeue(struct Qdisc *sch) - } - q->tail->next = next_a; - } else { -- slot->allot -= SFQ_ALLOT_SIZE(qdisc_pkt_len(skb)); -+ slot->allot -= qdisc_pkt_len(skb); - } - return skb; - } -@@ -595,7 +588,7 @@ static void sfq_rehash(struct Qdisc *sch) - q->tail->next = x; - } - q->tail = slot; -- slot->allot = q->scaled_quantum; -+ slot->allot = q->quantum; - } - } - sch->q.qlen -= dropped; -@@ -608,6 +601,7 @@ static void sfq_perturbation(struct timer_list *t) - struct Qdisc *sch = q->sch; - spinlock_t *root_lock; - siphash_key_t nkey; -+ int period; - - get_random_bytes(&nkey, sizeof(nkey)); - rcu_read_lock(); -@@ -618,12 +612,17 @@ static void sfq_perturbation(struct timer_list *t) - sfq_rehash(sch); - spin_unlock(root_lock); - -- if (q->perturb_period) -- mod_timer(&q->perturb_timer, jiffies + q->perturb_period); -+ /* q->perturb_period can change under us from -+ * sfq_change() and sfq_destroy(). -+ */ -+ period = READ_ONCE(q->perturb_period); -+ if (period) -+ mod_timer(&q->perturb_timer, jiffies + period); - rcu_read_unlock(); - } - --static int sfq_change(struct Qdisc *sch, struct nlattr *opt) -+static int sfq_change(struct Qdisc *sch, struct nlattr *opt, -+ struct netlink_ext_ack *extack) - { - struct sfq_sched_data *q = qdisc_priv(sch); - struct tc_sfq_qopt *ctl = nla_data(opt); -@@ -641,14 +640,10 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt) - (!is_power_of_2(ctl->divisor) || ctl->divisor > 65536)) - return -EINVAL; - -- /* slot->allot is a short, make sure quantum is not too big. */ -- if (ctl->quantum) { -- unsigned int scaled = SFQ_ALLOT_SIZE(ctl->quantum); -- -- if (scaled <= 0 || scaled > SHRT_MAX) -- return -EINVAL; -+ if ((int)ctl->quantum < 0) { -+ NL_SET_ERR_MSG_MOD(extack, "invalid quantum"); -+ return -EINVAL; - } -- - if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max, - ctl_v1->Wlog, ctl_v1->Scell_log, NULL)) - return -EINVAL; -@@ -657,12 +652,14 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt) - if (!p) - return -ENOMEM; - } -+ if (ctl->limit == 1) { -+ NL_SET_ERR_MSG_MOD(extack, "invalid limit"); -+ return -EINVAL; -+ } - sch_tree_lock(sch); -- if (ctl->quantum) { -+ if (ctl->quantum) - q->quantum = ctl->quantum; -- q->scaled_quantum = SFQ_ALLOT_SIZE(q->quantum); -- } -- q->perturb_period = ctl->perturb_period * HZ; -+ WRITE_ONCE(q->perturb_period, ctl->perturb_period * HZ); - if (ctl->flows) - q->maxflows = min_t(u32, ctl->flows, SFQ_MAX_FLOWS); - if (ctl->divisor) { -@@ -724,7 +721,7 @@ static void sfq_destroy(struct Qdisc *sch) - struct sfq_sched_data *q = qdisc_priv(sch); - - tcf_block_put(q->block); -- q->perturb_period = 0; -+ WRITE_ONCE(q->perturb_period, 0); - del_timer_sync(&q->perturb_timer); - sfq_free(q->ht); - sfq_free(q->slots); -@@ -757,12 +754,11 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt, - q->divisor = SFQ_DEFAULT_HASH_DIVISOR; - q->maxflows = SFQ_DEFAULT_FLOWS; - q->quantum = psched_mtu(qdisc_dev(sch)); -- q->scaled_quantum = SFQ_ALLOT_SIZE(q->quantum); - q->perturb_period = 0; - get_random_bytes(&q->perturbation, sizeof(q->perturbation)); - - if (opt) { -- int err = sfq_change(sch, opt); -+ int err = sfq_change(sch, opt, extack); - if (err) - return err; - } -@@ -873,7 +869,7 @@ static int sfq_dump_class_stats(struct Qdisc *sch, unsigned long cl, - if (idx != SFQ_EMPTY_SLOT) { - const struct sfq_slot *slot = &q->slots[idx]; - -- xstats.allot = slot->allot << SFQ_ALLOT_SHIFT; -+ xstats.allot = slot->allot; - qs.qlen = slot->qlen; - qs.backlog = slot->backlog; - } -diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c -index 0acf07538840cc..45efbbfff94ae2 100644 ---- a/net/smc/af_smc.c -+++ b/net/smc/af_smc.c -@@ -2745,7 +2745,7 @@ static int smc_accept(struct socket *sock, struct socket *new_sock, - release_sock(clcsk); - } else if (!atomic_read(&smc_sk(nsk)->conn.bytes_to_rcv)) { - lock_sock(nsk); -- smc_rx_wait(smc_sk(nsk), &timeo, smc_rx_data_available); -+ smc_rx_wait(smc_sk(nsk), &timeo, 0, smc_rx_data_available); - release_sock(nsk); - } - } -diff --git a/net/smc/smc_rx.c b/net/smc/smc_rx.c -index 9a2f3638d161d2..acb14e28cad411 100644 ---- a/net/smc/smc_rx.c -+++ b/net/smc/smc_rx.c -@@ -238,22 +238,23 @@ static int smc_rx_splice(struct pipe_inode_info *pipe, char *src, size_t len, - return -ENOMEM; - } - --static int smc_rx_data_available_and_no_splice_pend(struct smc_connection *conn) -+static int smc_rx_data_available_and_no_splice_pend(struct smc_connection *conn, size_t peeked) - { -- return atomic_read(&conn->bytes_to_rcv) && -+ return smc_rx_data_available(conn, peeked) && - !atomic_read(&conn->splice_pending); - } - - /* blocks rcvbuf consumer until >=len bytes available or timeout or interrupted - * @smc smc socket - * @timeo pointer to max seconds to wait, pointer to value 0 for no timeout -+ * @peeked number of bytes already peeked - * @fcrit add'l criterion to evaluate as function pointer - * Returns: - * 1 if at least 1 byte available in rcvbuf or if socket error/shutdown. - * 0 otherwise (nothing in rcvbuf nor timeout, e.g. interrupted). - */ --int smc_rx_wait(struct smc_sock *smc, long *timeo, -- int (*fcrit)(struct smc_connection *conn)) -+int smc_rx_wait(struct smc_sock *smc, long *timeo, size_t peeked, -+ int (*fcrit)(struct smc_connection *conn, size_t baseline)) - { - DEFINE_WAIT_FUNC(wait, woken_wake_function); - struct smc_connection *conn = &smc->conn; -@@ -262,7 +263,7 @@ int smc_rx_wait(struct smc_sock *smc, long *timeo, - struct sock *sk = &smc->sk; - int rc; - -- if (fcrit(conn)) -+ if (fcrit(conn, peeked)) - return 1; - sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk); - add_wait_queue(sk_sleep(sk), &wait); -@@ -271,7 +272,7 @@ int smc_rx_wait(struct smc_sock *smc, long *timeo, - cflags->peer_conn_abort || - READ_ONCE(sk->sk_shutdown) & RCV_SHUTDOWN || - conn->killed || -- fcrit(conn), -+ fcrit(conn, peeked), - &wait); - remove_wait_queue(sk_sleep(sk), &wait); - sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk); -@@ -322,11 +323,11 @@ static int smc_rx_recv_urg(struct smc_sock *smc, struct msghdr *msg, int len, - return -EAGAIN; - } - --static bool smc_rx_recvmsg_data_available(struct smc_sock *smc) -+static bool smc_rx_recvmsg_data_available(struct smc_sock *smc, size_t peeked) - { - struct smc_connection *conn = &smc->conn; - -- if (smc_rx_data_available(conn)) -+ if (smc_rx_data_available(conn, peeked)) - return true; - else if (conn->urg_state == SMC_URG_VALID) - /* we received a single urgent Byte - skip */ -@@ -344,10 +345,10 @@ static bool smc_rx_recvmsg_data_available(struct smc_sock *smc) - int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, - struct pipe_inode_info *pipe, size_t len, int flags) - { -- size_t copylen, read_done = 0, read_remaining = len; -+ size_t copylen, read_done = 0, read_remaining = len, peeked_bytes = 0; - size_t chunk_len, chunk_off, chunk_len_sum; - struct smc_connection *conn = &smc->conn; -- int (*func)(struct smc_connection *conn); -+ int (*func)(struct smc_connection *conn, size_t baseline); - union smc_host_cursor cons; - int readable, chunk; - char *rcvbuf_base; -@@ -384,14 +385,14 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, - if (conn->killed) - break; - -- if (smc_rx_recvmsg_data_available(smc)) -+ if (smc_rx_recvmsg_data_available(smc, peeked_bytes)) - goto copy; - - if (sk->sk_shutdown & RCV_SHUTDOWN) { - /* smc_cdc_msg_recv_action() could have run after - * above smc_rx_recvmsg_data_available() - */ -- if (smc_rx_recvmsg_data_available(smc)) -+ if (smc_rx_recvmsg_data_available(smc, peeked_bytes)) - goto copy; - break; - } -@@ -425,26 +426,28 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, - } - } - -- if (!smc_rx_data_available(conn)) { -- smc_rx_wait(smc, &timeo, smc_rx_data_available); -+ if (!smc_rx_data_available(conn, peeked_bytes)) { -+ smc_rx_wait(smc, &timeo, peeked_bytes, smc_rx_data_available); - continue; - } - - copy: - /* initialize variables for 1st iteration of subsequent loop */ - /* could be just 1 byte, even after waiting on data above */ -- readable = atomic_read(&conn->bytes_to_rcv); -+ readable = smc_rx_data_available(conn, peeked_bytes); - splbytes = atomic_read(&conn->splice_pending); - if (!readable || (msg && splbytes)) { - if (splbytes) - func = smc_rx_data_available_and_no_splice_pend; - else - func = smc_rx_data_available; -- smc_rx_wait(smc, &timeo, func); -+ smc_rx_wait(smc, &timeo, peeked_bytes, func); - continue; - } - - smc_curs_copy(&cons, &conn->local_tx_ctrl.cons, conn); -+ if ((flags & MSG_PEEK) && peeked_bytes) -+ smc_curs_add(conn->rmb_desc->len, &cons, peeked_bytes); - /* subsequent splice() calls pick up where previous left */ - if (splbytes) - smc_curs_add(conn->rmb_desc->len, &cons, splbytes); -@@ -480,6 +483,8 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, - } - read_remaining -= chunk_len; - read_done += chunk_len; -+ if (flags & MSG_PEEK) -+ peeked_bytes += chunk_len; - - if (chunk_len_sum == copylen) - break; /* either on 1st or 2nd iteration */ -diff --git a/net/smc/smc_rx.h b/net/smc/smc_rx.h -index db823c97d824ea..994f5e42d1ba26 100644 ---- a/net/smc/smc_rx.h -+++ b/net/smc/smc_rx.h -@@ -21,11 +21,11 @@ void smc_rx_init(struct smc_sock *smc); - - int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, - struct pipe_inode_info *pipe, size_t len, int flags); --int smc_rx_wait(struct smc_sock *smc, long *timeo, -- int (*fcrit)(struct smc_connection *conn)); --static inline int smc_rx_data_available(struct smc_connection *conn) -+int smc_rx_wait(struct smc_sock *smc, long *timeo, size_t peeked, -+ int (*fcrit)(struct smc_connection *conn, size_t baseline)); -+static inline int smc_rx_data_available(struct smc_connection *conn, size_t peeked) - { -- return atomic_read(&conn->bytes_to_rcv); -+ return atomic_read(&conn->bytes_to_rcv) - peeked; - } - - #endif /* SMC_RX_H */ -diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c -index 83996eea100626..8d760f8fc4b5a6 100644 ---- a/net/sunrpc/svcsock.c -+++ b/net/sunrpc/svcsock.c -@@ -1093,9 +1093,6 @@ static void svc_tcp_fragment_received(struct svc_sock *svsk) - /* If we have more data, signal svc_xprt_enqueue() to try again */ - svsk->sk_tcplen = 0; - svsk->sk_marker = xdr_zero; -- -- smp_wmb(); -- tcp_set_rcvlowat(svsk->sk_sk, 1); - } - - /** -@@ -1185,17 +1182,10 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp) - goto err_delete; - if (len == want) - svc_tcp_fragment_received(svsk); -- else { -- /* Avoid more ->sk_data_ready() calls until the rest -- * of the message has arrived. This reduces service -- * thread wake-ups on large incoming messages. */ -- tcp_set_rcvlowat(svsk->sk_sk, -- svc_sock_reclen(svsk) - svsk->sk_tcplen); -- -+ else - trace_svcsock_tcp_recv_short(&svsk->sk_xprt, - svc_sock_reclen(svsk), - svsk->sk_tcplen - sizeof(rpc_fraghdr)); -- } - goto err_noclose; - error: - if (len != -EAGAIN) -diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c -index 2050d888df2ae1..f4dbf5f87962d9 100644 ---- a/net/vmw_vsock/af_vsock.c -+++ b/net/vmw_vsock/af_vsock.c -@@ -1453,6 +1453,11 @@ static int vsock_connect(struct socket *sock, struct sockaddr *addr, - if (err < 0) - goto out; - -+ /* sk_err might have been set as a result of an earlier -+ * (failed) connect attempt. -+ */ -+ sk->sk_err = 0; -+ - /* Mark sock as connecting and set the error code to in - * progress in case this is a non-blocking connect. - */ -diff --git a/net/wireless/scan.c b/net/wireless/scan.c -index 4fc6279750ea15..ce622a287abc6b 100644 ---- a/net/wireless/scan.c -+++ b/net/wireless/scan.c -@@ -831,10 +831,45 @@ static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev) - list_for_each_entry(intbss, &rdev->bss_list, list) { - struct cfg80211_bss *res = &intbss->pub; - const struct cfg80211_bss_ies *ies; -+ const struct element *ssid_elem; -+ struct cfg80211_colocated_ap *entry; -+ u32 s_ssid_tmp; -+ int ret; - - ies = rcu_access_pointer(res->ies); - count += cfg80211_parse_colocated_ap(ies, - &coloc_ap_list); -+ -+ /* In case the scan request specified a specific BSSID -+ * and the BSS is found and operating on 6GHz band then -+ * add this AP to the collocated APs list. -+ * This is relevant for ML probe requests when the lower -+ * band APs have not been discovered. -+ */ -+ if (is_broadcast_ether_addr(rdev_req->bssid) || -+ !ether_addr_equal(rdev_req->bssid, res->bssid) || -+ res->channel->band != NL80211_BAND_6GHZ) -+ continue; -+ -+ ret = cfg80211_calc_short_ssid(ies, &ssid_elem, -+ &s_ssid_tmp); -+ if (ret) -+ continue; -+ -+ entry = kzalloc(sizeof(*entry), GFP_ATOMIC); -+ if (!entry) -+ continue; -+ -+ memcpy(entry->bssid, res->bssid, ETH_ALEN); -+ entry->short_ssid = s_ssid_tmp; -+ memcpy(entry->ssid, ssid_elem->data, -+ ssid_elem->datalen); -+ entry->ssid_len = ssid_elem->datalen; -+ entry->short_ssid_valid = true; -+ entry->center_freq = res->channel->center_freq; -+ -+ list_add_tail(&entry->list, &coloc_ap_list); -+ count++; - } - spin_unlock_bh(&rdev->bss_lock); - } -diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c -index ce56d659c55a69..7f52bb2e14c13a 100644 ---- a/net/xfrm/xfrm_replay.c -+++ b/net/xfrm/xfrm_replay.c -@@ -714,10 +714,12 @@ static int xfrm_replay_overflow_offload_esn(struct xfrm_state *x, struct sk_buff - oseq += skb_shinfo(skb)->gso_segs; - } - -- if (unlikely(xo->seq.low < replay_esn->oseq)) { -- XFRM_SKB_CB(skb)->seq.output.hi = ++oseq_hi; -- xo->seq.hi = oseq_hi; -- replay_esn->oseq_hi = oseq_hi; -+ if (unlikely(oseq < replay_esn->oseq)) { -+ replay_esn->oseq_hi = ++oseq_hi; -+ if (xo->seq.low < replay_esn->oseq) { -+ XFRM_SKB_CB(skb)->seq.output.hi = oseq_hi; -+ xo->seq.hi = oseq_hi; -+ } - if (replay_esn->oseq_hi == 0) { - replay_esn->oseq--; - replay_esn->oseq_hi--; -diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c -index e2056c8b902c55..be4fec95c46010 100644 ---- a/samples/landlock/sandboxer.c -+++ b/samples/landlock/sandboxer.c -@@ -65,6 +65,9 @@ static int parse_path(char *env_path, const char ***const path_list) - } - } - *path_list = malloc(num_paths * sizeof(**path_list)); -+ if (!*path_list) -+ return -1; -+ - for (i = 0; i < num_paths; i++) - (*path_list)[i] = strsep(&env_path, ENV_PATH_TOKEN); - -@@ -100,6 +103,10 @@ static int populate_ruleset(const char *const env_var, const int ruleset_fd, - env_path_name = strdup(env_path_name); - unsetenv(env_var); - num_paths = parse_path(env_path_name, &path_list); -+ if (num_paths < 0) { -+ fprintf(stderr, "Failed to allocate memory\n"); -+ goto out_free_name; -+ } - if (num_paths == 1 && path_list[0][0] == '\0') { - /* - * Allows to not use all possible restrictions (e.g. use -diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib -index e702552fb131af..44f20b1b853a50 100644 ---- a/scripts/Makefile.lib -+++ b/scripts/Makefile.lib -@@ -472,10 +472,10 @@ quiet_cmd_lzo_with_size = LZO $@ - cmd_lzo_with_size = { cat $(real-prereqs) | $(KLZOP) -9; $(size_append); } > $@ - - quiet_cmd_lz4 = LZ4 $@ -- cmd_lz4 = cat $(real-prereqs) | $(LZ4) -l -c1 stdin stdout > $@ -+ cmd_lz4 = cat $(real-prereqs) | $(LZ4) -l -9 - - > $@ - - quiet_cmd_lz4_with_size = LZ4 $@ -- cmd_lz4_with_size = { cat $(real-prereqs) | $(LZ4) -l -c1 stdin stdout; \ -+ cmd_lz4_with_size = { cat $(real-prereqs) | $(LZ4) -l -9 - -; \ - $(size_append); } > $@ - - # U-Boot mkimage -diff --git a/scripts/genksyms/genksyms.c b/scripts/genksyms/genksyms.c -index f5dfdb9d80e9d5..6b0eb3898e4ec7 100644 ---- a/scripts/genksyms/genksyms.c -+++ b/scripts/genksyms/genksyms.c -@@ -241,6 +241,7 @@ static struct symbol *__add_symbol(const char *name, enum symbol_type type, - "unchanged\n"); - } - sym->is_declared = 1; -+ free_list(defn, NULL); - return sym; - } else if (!sym->is_declared) { - if (sym->is_override && flag_preserve) { -@@ -249,6 +250,7 @@ static struct symbol *__add_symbol(const char *name, enum symbol_type type, - print_type_name(type, name); - fprintf(stderr, " modversion change\n"); - sym->is_declared = 1; -+ free_list(defn, NULL); - return sym; - } else { - status = is_unknown_symbol(sym) ? -@@ -256,6 +258,7 @@ static struct symbol *__add_symbol(const char *name, enum symbol_type type, - } - } else { - error_with_pos("redefinition of %s", name); -+ free_list(defn, NULL); - return sym; - } - break; -@@ -271,11 +274,15 @@ static struct symbol *__add_symbol(const char *name, enum symbol_type type, - break; - } - } -+ -+ free_list(sym->defn, NULL); -+ free(sym->name); -+ free(sym); - --nsyms; - } - - sym = xmalloc(sizeof(*sym)); -- sym->name = name; -+ sym->name = xstrdup(name); - sym->type = type; - sym->defn = defn; - sym->expansion_trail = NULL; -@@ -482,7 +489,7 @@ static void read_reference(FILE *f) - defn = def; - def = read_node(f); - } -- subsym = add_reference_symbol(xstrdup(sym->string), sym->tag, -+ subsym = add_reference_symbol(sym->string, sym->tag, - defn, is_extern); - subsym->is_override = is_override; - free_node(sym); -diff --git a/scripts/genksyms/genksyms.h b/scripts/genksyms/genksyms.h -index 21ed2ec2d98ca8..5621533dcb8e43 100644 ---- a/scripts/genksyms/genksyms.h -+++ b/scripts/genksyms/genksyms.h -@@ -32,7 +32,7 @@ struct string_list { - - struct symbol { - struct symbol *hash_next; -- const char *name; -+ char *name; - enum symbol_type type; - struct string_list *defn; - struct symbol *expansion_trail; -diff --git a/scripts/genksyms/parse.y b/scripts/genksyms/parse.y -index 8e9b5e69e8f01d..689cb6bb40b657 100644 ---- a/scripts/genksyms/parse.y -+++ b/scripts/genksyms/parse.y -@@ -152,14 +152,19 @@ simple_declaration: - ; - - init_declarator_list_opt: -- /* empty */ { $$ = NULL; } -- | init_declarator_list -+ /* empty */ { $$ = NULL; } -+ | init_declarator_list { free_list(decl_spec, NULL); $$ = $1; } - ; - - init_declarator_list: - init_declarator - { struct string_list *decl = *$1; - *$1 = NULL; -+ -+ /* avoid sharing among multiple init_declarators */ -+ if (decl_spec) -+ decl_spec = copy_list_range(decl_spec, NULL); -+ - add_symbol(current_name, - is_typedef ? SYM_TYPEDEF : SYM_NORMAL, decl, is_extern); - current_name = NULL; -@@ -170,6 +175,11 @@ init_declarator_list: - *$3 = NULL; - free_list(*$2, NULL); - *$2 = decl_spec; -+ -+ /* avoid sharing among multiple init_declarators */ -+ if (decl_spec) -+ decl_spec = copy_list_range(decl_spec, NULL); -+ - add_symbol(current_name, - is_typedef ? SYM_TYPEDEF : SYM_NORMAL, decl, is_extern); - current_name = NULL; -@@ -472,12 +482,12 @@ enumerator_list: - enumerator: - IDENT - { -- const char *name = strdup((*$1)->string); -+ const char *name = (*$1)->string; - add_symbol(name, SYM_ENUM_CONST, NULL, 0); - } - | IDENT '=' EXPRESSION_PHRASE - { -- const char *name = strdup((*$1)->string); -+ const char *name = (*$1)->string; - struct string_list *expr = copy_list_range(*$3, *$2); - add_symbol(name, SYM_ENUM_CONST, expr, 0); - } -diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c -index 33d19e419908b8..662a5e7c37c285 100644 ---- a/scripts/kconfig/conf.c -+++ b/scripts/kconfig/conf.c -@@ -827,6 +827,9 @@ int main(int ac, char **av) - break; - } - -+ if (conf_errors()) -+ exit(1); -+ - if (sync_kconfig) { - name = getenv("KCONFIG_NOSILENTUPDATE"); - if (name && *name) { -@@ -890,6 +893,9 @@ int main(int ac, char **av) - break; - } - -+ if (sym_dep_errors()) -+ exit(1); -+ - if (input_mode == savedefconfig) { - if (conf_write_defconfig(defconfig_file)) { - fprintf(stderr, "n*** Error while saving defconfig to: %s\n\n", -diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c -index 4a6811d77d1829..f214e8d3762e0a 100644 ---- a/scripts/kconfig/confdata.c -+++ b/scripts/kconfig/confdata.c -@@ -155,6 +155,13 @@ static void conf_message(const char *fmt, ...) - static const char *conf_filename; - static int conf_lineno, conf_warnings; - -+bool conf_errors(void) -+{ -+ if (conf_warnings) -+ return getenv("KCONFIG_WERROR"); -+ return false; -+} -+ - static void conf_warning(const char *fmt, ...) - { - va_list ap; -@@ -346,14 +353,12 @@ int conf_read_simple(const char *name, int def) - FILE *in = NULL; - char *line = NULL; - size_t line_asize = 0; -- char *p, *p2; -+ char *p, *p2, *val; - struct symbol *sym; - int i, def_flags; -- const char *warn_unknown; -- const char *werror; -+ const char *warn_unknown, *sym_name; - - warn_unknown = getenv("KCONFIG_WARN_UNKNOWN_SYMBOLS"); -- werror = getenv("KCONFIG_WERROR"); - if (name) { - in = zconf_fopen(name); - } else { -@@ -386,10 +391,12 @@ int conf_read_simple(const char *name, int def) - - *p = '\0'; - -- in = zconf_fopen(env); -+ name = env; -+ -+ in = zconf_fopen(name); - if (in) { - conf_message("using defaults found in %s", -- env); -+ name); - goto load; - } - -@@ -428,80 +435,34 @@ int conf_read_simple(const char *name, int def) - - while (compat_getline(&line, &line_asize, in) != -1) { - conf_lineno++; -- sym = NULL; - if (line[0] == '#') { -- if (memcmp(line + 2, CONFIG_, strlen(CONFIG_))) -+ if (line[1] != ' ') -+ continue; -+ p = line + 2; -+ if (memcmp(p, CONFIG_, strlen(CONFIG_))) - continue; -- p = strchr(line + 2 + strlen(CONFIG_), ' '); -+ sym_name = p + strlen(CONFIG_); -+ p = strchr(sym_name, ' '); - if (!p) - continue; - *p++ = 0; - if (strncmp(p, "is not set", 10)) - continue; -- if (def == S_DEF_USER) { -- sym = sym_find(line + 2 + strlen(CONFIG_)); -- if (!sym) { -- if (warn_unknown) -- conf_warning("unknown symbol: %s", -- line + 2 + strlen(CONFIG_)); -- -- conf_set_changed(true); -- continue; -- } -- } else { -- sym = sym_lookup(line + 2 + strlen(CONFIG_), 0); -- if (sym->type == S_UNKNOWN) -- sym->type = S_BOOLEAN; -- } -- if (sym->flags & def_flags) { -- conf_warning("override: reassigning to symbol %s", sym->name); -- } -- switch (sym->type) { -- case S_BOOLEAN: -- case S_TRISTATE: -- sym->def[def].tri = no; -- sym->flags |= def_flags; -- break; -- default: -- ; -- } -+ -+ val = "n"; - } else if (memcmp(line, CONFIG_, strlen(CONFIG_)) == 0) { -- p = strchr(line + strlen(CONFIG_), '='); -+ sym_name = line + strlen(CONFIG_); -+ p = strchr(sym_name, '='); - if (!p) - continue; - *p++ = 0; -+ val = p; - p2 = strchr(p, '\n'); - if (p2) { - *p2-- = 0; - if (*p2 == '\r') - *p2 = 0; - } -- -- sym = sym_find(line + strlen(CONFIG_)); -- if (!sym) { -- if (def == S_DEF_AUTO) { -- /* -- * Reading from include/config/auto.conf -- * If CONFIG_FOO previously existed in -- * auto.conf but it is missing now, -- * include/config/FOO must be touched. -- */ -- conf_touch_dep(line + strlen(CONFIG_)); -- } else { -- if (warn_unknown) -- conf_warning("unknown symbol: %s", -- line + strlen(CONFIG_)); -- -- conf_set_changed(true); -- } -- continue; -- } -- -- if (sym->flags & def_flags) { -- conf_warning("override: reassigning to symbol %s", sym->name); -- } -- if (conf_set_sym_val(sym, def, def_flags, p)) -- continue; - } else { - if (line[0] != '\r' && line[0] != '\n') - conf_warning("unexpected data: %.*s", -@@ -510,6 +471,31 @@ int conf_read_simple(const char *name, int def) - continue; - } - -+ sym = sym_find(sym_name); -+ if (!sym) { -+ if (def == S_DEF_AUTO) { -+ /* -+ * Reading from include/config/auto.conf. -+ * If CONFIG_FOO previously existed in auto.conf -+ * but it is missing now, include/config/FOO -+ * must be touched. -+ */ -+ conf_touch_dep(sym_name); -+ } else { -+ if (warn_unknown) -+ conf_warning("unknown symbol: %s", sym_name); -+ -+ conf_set_changed(true); -+ } -+ continue; -+ } -+ -+ if (sym->flags & def_flags) -+ conf_warning("override: reassigning to symbol %s", sym->name); -+ -+ if (conf_set_sym_val(sym, def, def_flags, val)) -+ continue; -+ - if (sym && sym_is_choice_value(sym)) { - struct symbol *cs = prop_get_symbol(sym_get_choice_prop(sym)); - switch (sym->def[def].tri) { -@@ -533,9 +519,6 @@ int conf_read_simple(const char *name, int def) - free(line); - fclose(in); - -- if (conf_warnings && werror) -- exit(1); -- - return 0; - } - -diff --git a/scripts/kconfig/lkc_proto.h b/scripts/kconfig/lkc_proto.h -index edd1e617b25c5c..e4931bde7ca765 100644 ---- a/scripts/kconfig/lkc_proto.h -+++ b/scripts/kconfig/lkc_proto.h -@@ -12,6 +12,7 @@ void conf_set_changed(bool val); - bool conf_get_changed(void); - void conf_set_changed_callback(void (*fn)(void)); - void conf_set_message_callback(void (*fn)(const char *s)); -+bool conf_errors(void); - - /* symbol.c */ - extern struct symbol * symbol_hash[SYMBOL_HASHSIZE]; -@@ -22,6 +23,7 @@ void print_symbol_for_listconfig(struct symbol *sym); - struct symbol ** sym_re_search(const char *pattern); - const char * sym_type_name(enum symbol_type type); - void sym_calc_value(struct symbol *sym); -+bool sym_dep_errors(void); - enum symbol_type sym_get_type(struct symbol *sym); - bool sym_tristate_within_range(struct symbol *sym,tristate tri); - bool sym_set_tristate_value(struct symbol *sym,tristate tri); -diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c -index 7b1df55b017679..1c0306c9d74e2e 100644 ---- a/scripts/kconfig/symbol.c -+++ b/scripts/kconfig/symbol.c -@@ -40,6 +40,7 @@ static struct symbol symbol_empty = { - - struct symbol *modules_sym; - static tristate modules_val; -+static int sym_warnings; - - enum symbol_type sym_get_type(struct symbol *sym) - { -@@ -320,6 +321,15 @@ static void sym_warn_unmet_dep(struct symbol *sym) - " Selected by [m]:\n"); - - fputs(str_get(&gs), stderr); -+ str_free(&gs); -+ sym_warnings++; -+} -+ -+bool sym_dep_errors(void) -+{ -+ if (sym_warnings) -+ return getenv("KCONFIG_WERROR"); -+ return false; - } - - void sym_calc_value(struct symbol *sym) -diff --git a/security/landlock/fs.c b/security/landlock/fs.c -index 1bdd049e3d636a..fe4622d88eb15e 100644 ---- a/security/landlock/fs.c -+++ b/security/landlock/fs.c -@@ -664,10 +664,6 @@ static inline access_mask_t get_mode_access(const umode_t mode) - switch (mode & S_IFMT) { - case S_IFLNK: - return LANDLOCK_ACCESS_FS_MAKE_SYM; -- case 0: -- /* A zero mode translates to S_IFREG. */ -- case S_IFREG: -- return LANDLOCK_ACCESS_FS_MAKE_REG; - case S_IFDIR: - return LANDLOCK_ACCESS_FS_MAKE_DIR; - case S_IFCHR: -@@ -678,9 +674,12 @@ static inline access_mask_t get_mode_access(const umode_t mode) - return LANDLOCK_ACCESS_FS_MAKE_FIFO; - case S_IFSOCK: - return LANDLOCK_ACCESS_FS_MAKE_SOCK; -+ case S_IFREG: -+ case 0: -+ /* A zero mode translates to S_IFREG. */ - default: -- WARN_ON_ONCE(1); -- return 0; -+ /* Treats weird files as regular files. */ -+ return LANDLOCK_ACCESS_FS_MAKE_REG; - } - } - -diff --git a/sound/core/seq/Kconfig b/sound/core/seq/Kconfig -index c14981daf9432f..e4f58cb985d47c 100644 ---- a/sound/core/seq/Kconfig -+++ b/sound/core/seq/Kconfig -@@ -62,7 +62,7 @@ config SND_SEQ_VIRMIDI - - config SND_SEQ_UMP - bool "Support for UMP events" -- default y if SND_SEQ_UMP_CLIENT -+ default SND_UMP - help - Say Y here to enable the support for handling UMP (Universal MIDI - Packet) events via ALSA sequencer infrastructure, which is an -@@ -71,7 +71,6 @@ config SND_SEQ_UMP - among legacy and UMP clients. - - config SND_SEQ_UMP_CLIENT -- tristate -- def_tristate SND_UMP -+ def_tristate SND_UMP && SND_SEQ_UMP - - endif # SND_SEQUENCER -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 739f8fd1792bd5..0b679fd1b82ab9 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -9726,6 +9726,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), - SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC), - SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC), -+ SND_PCI_QUIRK(0x1025, 0x1360, "Acer Aspire A115", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1025, 0x141f, "Acer Spin SP513-54N", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1025, 0x142b, "Acer Swift SF314-42", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1025, 0x1430, "Acer TravelMate B311R-31", ALC256_FIXUP_ACER_MIC_NO_PRESENCE), -diff --git a/sound/soc/codecs/arizona.c b/sound/soc/codecs/arizona.c -index 7434aeeda292ec..402b9a2ff02406 100644 ---- a/sound/soc/codecs/arizona.c -+++ b/sound/soc/codecs/arizona.c -@@ -2786,15 +2786,13 @@ int arizona_of_get_audio_pdata(struct arizona *arizona) - { - struct arizona_pdata *pdata = &arizona->pdata; - struct device_node *np = arizona->dev->of_node; -- struct property *prop; -- const __be32 *cur; - u32 val; - u32 pdm_val[ARIZONA_MAX_PDM_SPK]; - int ret; - int count = 0; - - count = 0; -- of_property_for_each_u32(np, "wlf,inmode", prop, cur, val) { -+ of_property_for_each_u32(np, "wlf,inmode", val) { - if (count == ARRAY_SIZE(pdata->inmode)) - break; - -@@ -2803,7 +2801,7 @@ int arizona_of_get_audio_pdata(struct arizona *arizona) - } - - count = 0; -- of_property_for_each_u32(np, "wlf,dmic-ref", prop, cur, val) { -+ of_property_for_each_u32(np, "wlf,dmic-ref", val) { - if (count == ARRAY_SIZE(pdata->dmic_ref)) - break; - -@@ -2812,7 +2810,7 @@ int arizona_of_get_audio_pdata(struct arizona *arizona) - } - - count = 0; -- of_property_for_each_u32(np, "wlf,out-mono", prop, cur, val) { -+ of_property_for_each_u32(np, "wlf,out-mono", val) { - if (count == ARRAY_SIZE(pdata->out_mono)) - break; - -@@ -2821,7 +2819,7 @@ int arizona_of_get_audio_pdata(struct arizona *arizona) - } - - count = 0; -- of_property_for_each_u32(np, "wlf,max-channels-clocked", prop, cur, val) { -+ of_property_for_each_u32(np, "wlf,max-channels-clocked", val) { - if (count == ARRAY_SIZE(pdata->max_channels_clocked)) - break; - -@@ -2830,7 +2828,7 @@ int arizona_of_get_audio_pdata(struct arizona *arizona) - } - - count = 0; -- of_property_for_each_u32(np, "wlf,out-volume-limit", prop, cur, val) { -+ of_property_for_each_u32(np, "wlf,out-volume-limit", val) { - if (count == ARRAY_SIZE(pdata->out_vol_limit)) - break; - -diff --git a/sound/soc/intel/avs/apl.c b/sound/soc/intel/avs/apl.c -index 1860099c782a72..25c389632db4f7 100644 ---- a/sound/soc/intel/avs/apl.c -+++ b/sound/soc/intel/avs/apl.c -@@ -14,10 +14,10 @@ - #include "topology.h" - - static int __maybe_unused --apl_enable_logs(struct avs_dev *adev, enum avs_log_enable enable, u32 aging_period, -- u32 fifo_full_period, unsigned long resource_mask, u32 *priorities) -+avs_apl_enable_logs(struct avs_dev *adev, enum avs_log_enable enable, u32 aging_period, -+ u32 fifo_full_period, unsigned long resource_mask, u32 *priorities) - { -- struct apl_log_state_info *info; -+ struct avs_apl_log_state_info *info; - u32 size, num_cores = adev->hw_cfg.dsp_cores; - int ret, i; - -@@ -48,9 +48,9 @@ apl_enable_logs(struct avs_dev *adev, enum avs_log_enable enable, u32 aging_peri - return 0; - } - --static int apl_log_buffer_status(struct avs_dev *adev, union avs_notify_msg *msg) -+static int avs_apl_log_buffer_status(struct avs_dev *adev, union avs_notify_msg *msg) - { -- struct apl_log_buffer_layout layout; -+ struct avs_apl_log_buffer_layout layout; - void __iomem *addr, *buf; - - addr = avs_log_buffer_addr(adev, msg->log.core); -@@ -63,11 +63,11 @@ static int apl_log_buffer_status(struct avs_dev *adev, union avs_notify_msg *msg - /* consume the logs regardless of consumer presence */ - goto update_read_ptr; - -- buf = apl_log_payload_addr(addr); -+ buf = avs_apl_log_payload_addr(addr); - - if (layout.read_ptr > layout.write_ptr) { - avs_dump_fw_log(adev, buf + layout.read_ptr, -- apl_log_payload_size(adev) - layout.read_ptr); -+ avs_apl_log_payload_size(adev) - layout.read_ptr); - layout.read_ptr = 0; - } - avs_dump_fw_log_wakeup(adev, buf + layout.read_ptr, layout.write_ptr - layout.read_ptr); -@@ -77,7 +77,8 @@ static int apl_log_buffer_status(struct avs_dev *adev, union avs_notify_msg *msg - return 0; - } - --static int apl_wait_log_entry(struct avs_dev *adev, u32 core, struct apl_log_buffer_layout *layout) -+static int avs_apl_wait_log_entry(struct avs_dev *adev, u32 core, -+ struct avs_apl_log_buffer_layout *layout) - { - unsigned long timeout; - void __iomem *addr; -@@ -99,14 +100,14 @@ static int apl_wait_log_entry(struct avs_dev *adev, u32 core, struct apl_log_buf - } - - /* reads log header and tests its type */ --#define apl_is_entry_stackdump(addr) ((readl(addr) >> 30) & 0x1) -+#define avs_apl_is_entry_stackdump(addr) ((readl(addr) >> 30) & 0x1) - --static int apl_coredump(struct avs_dev *adev, union avs_notify_msg *msg) -+static int avs_apl_coredump(struct avs_dev *adev, union avs_notify_msg *msg) - { -- struct apl_log_buffer_layout layout; -+ struct avs_apl_log_buffer_layout layout; - void __iomem *addr, *buf; - size_t dump_size; -- u16 offset = 0; -+ u32 offset = 0; - u8 *dump, *pos; - - dump_size = AVS_FW_REGS_SIZE + msg->ext.coredump.stack_dump_size; -@@ -124,9 +125,9 @@ static int apl_coredump(struct avs_dev *adev, union avs_notify_msg *msg) - if (!addr) - goto exit; - -- buf = apl_log_payload_addr(addr); -+ buf = avs_apl_log_payload_addr(addr); - memcpy_fromio(&layout, addr, sizeof(layout)); -- if (!apl_is_entry_stackdump(buf + layout.read_ptr)) { -+ if (!avs_apl_is_entry_stackdump(buf + layout.read_ptr)) { - union avs_notify_msg lbs_msg = AVS_NOTIFICATION(LOG_BUFFER_STATUS); - - /* -@@ -142,11 +143,11 @@ static int apl_coredump(struct avs_dev *adev, union avs_notify_msg *msg) - do { - u32 count; - -- if (apl_wait_log_entry(adev, msg->ext.coredump.core_id, &layout)) -+ if (avs_apl_wait_log_entry(adev, msg->ext.coredump.core_id, &layout)) - break; - - if (layout.read_ptr > layout.write_ptr) { -- count = apl_log_payload_size(adev) - layout.read_ptr; -+ count = avs_apl_log_payload_size(adev) - layout.read_ptr; - memcpy_fromio(pos + offset, buf + layout.read_ptr, count); - layout.read_ptr = 0; - offset += count; -@@ -165,7 +166,7 @@ static int apl_coredump(struct avs_dev *adev, union avs_notify_msg *msg) - return 0; - } - --static bool apl_lp_streaming(struct avs_dev *adev) -+static bool avs_apl_lp_streaming(struct avs_dev *adev) - { - struct avs_path *path; - -@@ -201,7 +202,7 @@ static bool apl_lp_streaming(struct avs_dev *adev) - return true; - } - --static bool apl_d0ix_toggle(struct avs_dev *adev, struct avs_ipc_msg *tx, bool wake) -+static bool avs_apl_d0ix_toggle(struct avs_dev *adev, struct avs_ipc_msg *tx, bool wake) - { - /* wake in all cases */ - if (wake) -@@ -215,10 +216,10 @@ static bool apl_d0ix_toggle(struct avs_dev *adev, struct avs_ipc_msg *tx, bool w - * Note: for cAVS 1.5+ and 1.8, D0IX is LP-firmware transition, - * not the power-gating mechanism known from cAVS 2.0. - */ -- return apl_lp_streaming(adev); -+ return avs_apl_lp_streaming(adev); - } - --static int apl_set_d0ix(struct avs_dev *adev, bool enable) -+static int avs_apl_set_d0ix(struct avs_dev *adev, bool enable) - { - bool streaming = false; - int ret; -@@ -231,7 +232,7 @@ static int apl_set_d0ix(struct avs_dev *adev, bool enable) - return AVS_IPC_RET(ret); - } - --const struct avs_dsp_ops apl_dsp_ops = { -+const struct avs_dsp_ops avs_apl_dsp_ops = { - .power = avs_dsp_core_power, - .reset = avs_dsp_core_reset, - .stall = avs_dsp_core_stall, -@@ -241,10 +242,10 @@ const struct avs_dsp_ops apl_dsp_ops = { - .load_basefw = avs_hda_load_basefw, - .load_lib = avs_hda_load_library, - .transfer_mods = avs_hda_transfer_modules, -- .log_buffer_offset = skl_log_buffer_offset, -- .log_buffer_status = apl_log_buffer_status, -- .coredump = apl_coredump, -- .d0ix_toggle = apl_d0ix_toggle, -- .set_d0ix = apl_set_d0ix, -+ .log_buffer_offset = avs_skl_log_buffer_offset, -+ .log_buffer_status = avs_apl_log_buffer_status, -+ .coredump = avs_apl_coredump, -+ .d0ix_toggle = avs_apl_d0ix_toggle, -+ .set_d0ix = avs_apl_set_d0ix, - AVS_SET_ENABLE_LOGS_OP(apl) - }; -diff --git a/sound/soc/intel/avs/avs.h b/sound/soc/intel/avs/avs.h -index 0cf38c9e768e7b..1fd501a6a62d9e 100644 ---- a/sound/soc/intel/avs/avs.h -+++ b/sound/soc/intel/avs/avs.h -@@ -64,8 +64,8 @@ struct avs_dsp_ops { - #define avs_dsp_op(adev, op, ...) \ - ((adev)->spec->dsp_ops->op(adev, ## __VA_ARGS__)) - --extern const struct avs_dsp_ops skl_dsp_ops; --extern const struct avs_dsp_ops apl_dsp_ops; -+extern const struct avs_dsp_ops avs_skl_dsp_ops; -+extern const struct avs_dsp_ops avs_apl_dsp_ops; - - #define AVS_PLATATTR_CLDMA BIT_ULL(0) - #define AVS_PLATATTR_IMR BIT_ULL(1) -@@ -73,6 +73,23 @@ extern const struct avs_dsp_ops apl_dsp_ops; - #define avs_platattr_test(adev, attr) \ - ((adev)->spec->attributes & AVS_PLATATTR_##attr) - -+struct avs_sram_spec { -+ const u32 base_offset; -+ const u32 window_size; -+ const u32 rom_status_offset; -+}; -+ -+struct avs_hipc_spec { -+ const u32 req_offset; -+ const u32 req_ext_offset; -+ const u32 req_busy_mask; -+ const u32 ack_offset; -+ const u32 ack_done_mask; -+ const u32 rsp_offset; -+ const u32 rsp_busy_mask; -+ const u32 ctl_offset; -+}; -+ - /* Platform specific descriptor */ - struct avs_spec { - const char *name; -@@ -82,9 +99,8 @@ struct avs_spec { - - const u32 core_init_mask; /* used during DSP boot */ - const u64 attributes; /* bitmask of AVS_PLATATTR_* */ -- const u32 sram_base_offset; -- const u32 sram_window_size; -- const u32 rom_status; -+ const struct avs_sram_spec *sram; -+ const struct avs_hipc_spec *hipc; - }; - - struct avs_fw_entry { -@@ -264,7 +280,7 @@ void avs_ipc_block(struct avs_ipc *ipc); - int avs_dsp_disable_d0ix(struct avs_dev *adev); - int avs_dsp_enable_d0ix(struct avs_dev *adev); - --int skl_log_buffer_offset(struct avs_dev *adev, u32 core); -+int avs_skl_log_buffer_offset(struct avs_dev *adev, u32 core); - - /* Firmware resources management */ - -@@ -358,21 +374,21 @@ static inline int avs_log_buffer_status_locked(struct avs_dev *adev, union avs_n - return ret; - } - --struct apl_log_buffer_layout { -+struct avs_apl_log_buffer_layout { - u32 read_ptr; - u32 write_ptr; - u8 buffer[]; - } __packed; - --#define apl_log_payload_size(adev) \ -- (avs_log_buffer_size(adev) - sizeof(struct apl_log_buffer_layout)) -+#define avs_apl_log_payload_size(adev) \ -+ (avs_log_buffer_size(adev) - sizeof(struct avs_apl_log_buffer_layout)) - --#define apl_log_payload_addr(addr) \ -- (addr + sizeof(struct apl_log_buffer_layout)) -+#define avs_apl_log_payload_addr(addr) \ -+ (addr + sizeof(struct avs_apl_log_buffer_layout)) - - #ifdef CONFIG_DEBUG_FS - #define AVS_SET_ENABLE_LOGS_OP(name) \ -- .enable_logs = name##_enable_logs -+ .enable_logs = avs_##name##_enable_logs - - bool avs_logging_fw(struct avs_dev *adev); - void avs_dump_fw_log(struct avs_dev *adev, const void __iomem *src, unsigned int len); -diff --git a/sound/soc/intel/avs/core.c b/sound/soc/intel/avs/core.c -index 859b217fc761ba..63e4356e8caf94 100644 ---- a/sound/soc/intel/avs/core.c -+++ b/sound/soc/intel/avs/core.c -@@ -712,36 +712,47 @@ static const struct dev_pm_ops avs_dev_pm = { - SET_RUNTIME_PM_OPS(avs_runtime_suspend, avs_runtime_resume, NULL) - }; - -+static const struct avs_sram_spec skl_sram_spec = { -+ .base_offset = SKL_ADSP_SRAM_BASE_OFFSET, -+ .window_size = SKL_ADSP_SRAM_WINDOW_SIZE, -+ .rom_status_offset = SKL_ADSP_SRAM_BASE_OFFSET, -+}; -+ -+static const struct avs_sram_spec apl_sram_spec = { -+ .base_offset = APL_ADSP_SRAM_BASE_OFFSET, -+ .window_size = APL_ADSP_SRAM_WINDOW_SIZE, -+ .rom_status_offset = APL_ADSP_SRAM_BASE_OFFSET, -+}; -+ -+static const struct avs_hipc_spec skl_hipc_spec = { -+ .req_offset = SKL_ADSP_REG_HIPCI, -+ .req_ext_offset = SKL_ADSP_REG_HIPCIE, -+ .req_busy_mask = SKL_ADSP_HIPCI_BUSY, -+ .ack_offset = SKL_ADSP_REG_HIPCIE, -+ .ack_done_mask = SKL_ADSP_HIPCIE_DONE, -+ .rsp_offset = SKL_ADSP_REG_HIPCT, -+ .rsp_busy_mask = SKL_ADSP_HIPCT_BUSY, -+ .ctl_offset = SKL_ADSP_REG_HIPCCTL, -+}; -+ - static const struct avs_spec skl_desc = { - .name = "skl", -- .min_fw_version = { -- .major = 9, -- .minor = 21, -- .hotfix = 0, -- .build = 4732, -- }, -- .dsp_ops = &skl_dsp_ops, -+ .min_fw_version = { 9, 21, 0, 4732 }, -+ .dsp_ops = &avs_skl_dsp_ops, - .core_init_mask = 1, - .attributes = AVS_PLATATTR_CLDMA, -- .sram_base_offset = SKL_ADSP_SRAM_BASE_OFFSET, -- .sram_window_size = SKL_ADSP_SRAM_WINDOW_SIZE, -- .rom_status = SKL_ADSP_SRAM_BASE_OFFSET, -+ .sram = &skl_sram_spec, -+ .hipc = &skl_hipc_spec, - }; - - static const struct avs_spec apl_desc = { - .name = "apl", -- .min_fw_version = { -- .major = 9, -- .minor = 22, -- .hotfix = 1, -- .build = 4323, -- }, -- .dsp_ops = &apl_dsp_ops, -+ .min_fw_version = { 9, 22, 1, 4323 }, -+ .dsp_ops = &avs_apl_dsp_ops, - .core_init_mask = 3, - .attributes = AVS_PLATATTR_IMR, -- .sram_base_offset = APL_ADSP_SRAM_BASE_OFFSET, -- .sram_window_size = APL_ADSP_SRAM_WINDOW_SIZE, -- .rom_status = APL_ADSP_SRAM_BASE_OFFSET, -+ .sram = &apl_sram_spec, -+ .hipc = &skl_hipc_spec, - }; - - static const struct pci_device_id avs_ids[] = { -diff --git a/sound/soc/intel/avs/ipc.c b/sound/soc/intel/avs/ipc.c -index bdf013c3dd12e2..74f676fdfba29d 100644 ---- a/sound/soc/intel/avs/ipc.c -+++ b/sound/soc/intel/avs/ipc.c -@@ -305,6 +305,7 @@ irqreturn_t avs_dsp_irq_handler(int irq, void *dev_id) - { - struct avs_dev *adev = dev_id; - struct avs_ipc *ipc = adev->ipc; -+ const struct avs_spec *const spec = adev->spec; - u32 adspis, hipc_rsp, hipc_ack; - irqreturn_t ret = IRQ_NONE; - -@@ -312,35 +313,35 @@ irqreturn_t avs_dsp_irq_handler(int irq, void *dev_id) - if (adspis == UINT_MAX || !(adspis & AVS_ADSP_ADSPIS_IPC)) - return ret; - -- hipc_ack = snd_hdac_adsp_readl(adev, SKL_ADSP_REG_HIPCIE); -- hipc_rsp = snd_hdac_adsp_readl(adev, SKL_ADSP_REG_HIPCT); -+ hipc_ack = snd_hdac_adsp_readl(adev, spec->hipc->ack_offset); -+ hipc_rsp = snd_hdac_adsp_readl(adev, spec->hipc->rsp_offset); - - /* DSP acked host's request */ -- if (hipc_ack & SKL_ADSP_HIPCIE_DONE) { -+ if (hipc_ack & spec->hipc->ack_done_mask) { - /* - * As an extra precaution, mask done interrupt. Code executed - * due to complete() found below does not assume any masking. - */ -- snd_hdac_adsp_updatel(adev, SKL_ADSP_REG_HIPCCTL, -+ snd_hdac_adsp_updatel(adev, spec->hipc->ctl_offset, - AVS_ADSP_HIPCCTL_DONE, 0); - - complete(&ipc->done_completion); - - /* tell DSP it has our attention */ -- snd_hdac_adsp_updatel(adev, SKL_ADSP_REG_HIPCIE, -- SKL_ADSP_HIPCIE_DONE, -- SKL_ADSP_HIPCIE_DONE); -+ snd_hdac_adsp_updatel(adev, spec->hipc->ack_offset, -+ spec->hipc->ack_done_mask, -+ spec->hipc->ack_done_mask); - /* unmask done interrupt */ -- snd_hdac_adsp_updatel(adev, SKL_ADSP_REG_HIPCCTL, -+ snd_hdac_adsp_updatel(adev, spec->hipc->ctl_offset, - AVS_ADSP_HIPCCTL_DONE, - AVS_ADSP_HIPCCTL_DONE); - ret = IRQ_HANDLED; - } - - /* DSP sent new response to process */ -- if (hipc_rsp & SKL_ADSP_HIPCT_BUSY) { -+ if (hipc_rsp & spec->hipc->rsp_busy_mask) { - /* mask busy interrupt */ -- snd_hdac_adsp_updatel(adev, SKL_ADSP_REG_HIPCCTL, -+ snd_hdac_adsp_updatel(adev, spec->hipc->ctl_offset, - AVS_ADSP_HIPCCTL_BUSY, 0); - - ret = IRQ_WAKE_THREAD; -@@ -379,10 +380,11 @@ irqreturn_t avs_dsp_irq_thread(int irq, void *dev_id) - static bool avs_ipc_is_busy(struct avs_ipc *ipc) - { - struct avs_dev *adev = to_avs_dev(ipc->dev); -+ const struct avs_spec *const spec = adev->spec; - u32 hipc_rsp; - -- hipc_rsp = snd_hdac_adsp_readl(adev, SKL_ADSP_REG_HIPCT); -- return hipc_rsp & SKL_ADSP_HIPCT_BUSY; -+ hipc_rsp = snd_hdac_adsp_readl(adev, spec->hipc->rsp_offset); -+ return hipc_rsp & spec->hipc->rsp_busy_mask; - } - - static int avs_ipc_wait_busy_completion(struct avs_ipc *ipc, int timeout) -@@ -440,9 +442,10 @@ static void avs_ipc_msg_init(struct avs_ipc *ipc, struct avs_ipc_msg *reply) - - static void avs_dsp_send_tx(struct avs_dev *adev, struct avs_ipc_msg *tx, bool read_fwregs) - { -+ const struct avs_spec *const spec = adev->spec; - u64 reg = ULONG_MAX; - -- tx->header |= SKL_ADSP_HIPCI_BUSY; -+ tx->header |= spec->hipc->req_busy_mask; - if (read_fwregs) - reg = readq(avs_sram_addr(adev, AVS_FW_REGS_WINDOW)); - -@@ -450,8 +453,8 @@ static void avs_dsp_send_tx(struct avs_dev *adev, struct avs_ipc_msg *tx, bool r - - if (tx->size) - memcpy_toio(avs_downlink_addr(adev), tx->data, tx->size); -- snd_hdac_adsp_writel(adev, SKL_ADSP_REG_HIPCIE, tx->header >> 32); -- snd_hdac_adsp_writel(adev, SKL_ADSP_REG_HIPCI, tx->header & UINT_MAX); -+ snd_hdac_adsp_writel(adev, spec->hipc->req_ext_offset, tx->header >> 32); -+ snd_hdac_adsp_writel(adev, spec->hipc->req_offset, tx->header & UINT_MAX); - } - - static int avs_dsp_do_send_msg(struct avs_dev *adev, struct avs_ipc_msg *request, -@@ -586,6 +589,7 @@ int avs_dsp_send_rom_msg(struct avs_dev *adev, struct avs_ipc_msg *request) - - void avs_dsp_interrupt_control(struct avs_dev *adev, bool enable) - { -+ const struct avs_spec *const spec = adev->spec; - u32 value, mask; - - /* -@@ -597,7 +601,7 @@ void avs_dsp_interrupt_control(struct avs_dev *adev, bool enable) - - mask = AVS_ADSP_HIPCCTL_DONE | AVS_ADSP_HIPCCTL_BUSY; - value = enable ? mask : 0; -- snd_hdac_adsp_updatel(adev, SKL_ADSP_REG_HIPCCTL, mask, value); -+ snd_hdac_adsp_updatel(adev, spec->hipc->ctl_offset, mask, value); - } - - int avs_ipc_init(struct avs_ipc *ipc, struct device *dev) -diff --git a/sound/soc/intel/avs/loader.c b/sound/soc/intel/avs/loader.c -index 56bb0a59249d54..5c4ae3927ed243 100644 ---- a/sound/soc/intel/avs/loader.c -+++ b/sound/soc/intel/avs/loader.c -@@ -306,7 +306,7 @@ avs_hda_init_rom(struct avs_dev *adev, unsigned int dma_id, bool purge) - } - - /* await ROM init */ -- ret = snd_hdac_adsp_readq_poll(adev, spec->rom_status, reg, -+ ret = snd_hdac_adsp_readl_poll(adev, spec->sram->rom_status_offset, reg, - (reg & 0xF) == AVS_ROM_INIT_DONE || - (reg & 0xF) == APL_ROM_FW_ENTERED, - AVS_ROM_INIT_POLLING_US, APL_ROM_INIT_TIMEOUT_US); -diff --git a/sound/soc/intel/avs/messages.h b/sound/soc/intel/avs/messages.h -index 7f23a304b4a94e..9540401b093c13 100644 ---- a/sound/soc/intel/avs/messages.h -+++ b/sound/soc/intel/avs/messages.h -@@ -357,21 +357,21 @@ enum avs_skl_log_priority { - AVS_SKL_LOG_VERBOSE, - }; - --struct skl_log_state { -+struct avs_skl_log_state { - u32 enable; - u32 min_priority; - } __packed; - --struct skl_log_state_info { -+struct avs_skl_log_state_info { - u32 core_mask; -- struct skl_log_state logs_core[]; -+ struct avs_skl_log_state logs_core[]; - } __packed; - --struct apl_log_state_info { -+struct avs_apl_log_state_info { - u32 aging_timer_period; - u32 fifo_full_timer_period; - u32 core_mask; -- struct skl_log_state logs_core[]; -+ struct avs_skl_log_state logs_core[]; - } __packed; - - int avs_ipc_set_enable_logs(struct avs_dev *adev, u8 *log_info, size_t size); -diff --git a/sound/soc/intel/avs/registers.h b/sound/soc/intel/avs/registers.h -index 2b464e466ed520..5c1dce46f71d8b 100644 ---- a/sound/soc/intel/avs/registers.h -+++ b/sound/soc/intel/avs/registers.h -@@ -55,7 +55,7 @@ - #define APL_ADSP_SRAM_WINDOW_SIZE 0x20000 - - /* Constants used when accessing SRAM, space shared with firmware */ --#define AVS_FW_REG_BASE(adev) ((adev)->spec->sram_base_offset) -+#define AVS_FW_REG_BASE(adev) ((adev)->spec->sram->base_offset) - #define AVS_FW_REG_STATUS(adev) (AVS_FW_REG_BASE(adev) + 0x0) - #define AVS_FW_REG_ERROR_CODE(adev) (AVS_FW_REG_BASE(adev) + 0x4) - -@@ -70,8 +70,8 @@ - - /* registry I/O helpers */ - #define avs_sram_offset(adev, window_idx) \ -- ((adev)->spec->sram_base_offset + \ -- (adev)->spec->sram_window_size * (window_idx)) -+ ((adev)->spec->sram->base_offset + \ -+ (adev)->spec->sram->window_size * (window_idx)) - - #define avs_sram_addr(adev, window_idx) \ - ((adev)->dsp_ba + avs_sram_offset(adev, window_idx)) -diff --git a/sound/soc/intel/avs/skl.c b/sound/soc/intel/avs/skl.c -index 6bb8bbc70442bd..7ea8d91b54d2ed 100644 ---- a/sound/soc/intel/avs/skl.c -+++ b/sound/soc/intel/avs/skl.c -@@ -13,10 +13,10 @@ - #include "messages.h" - - static int __maybe_unused --skl_enable_logs(struct avs_dev *adev, enum avs_log_enable enable, u32 aging_period, -- u32 fifo_full_period, unsigned long resource_mask, u32 *priorities) -+avs_skl_enable_logs(struct avs_dev *adev, enum avs_log_enable enable, u32 aging_period, -+ u32 fifo_full_period, unsigned long resource_mask, u32 *priorities) - { -- struct skl_log_state_info *info; -+ struct avs_skl_log_state_info *info; - u32 size, num_cores = adev->hw_cfg.dsp_cores; - int ret, i; - -@@ -45,7 +45,7 @@ skl_enable_logs(struct avs_dev *adev, enum avs_log_enable enable, u32 aging_peri - return 0; - } - --int skl_log_buffer_offset(struct avs_dev *adev, u32 core) -+int avs_skl_log_buffer_offset(struct avs_dev *adev, u32 core) - { - return core * avs_log_buffer_size(adev); - } -@@ -53,8 +53,7 @@ int skl_log_buffer_offset(struct avs_dev *adev, u32 core) - /* fw DbgLogWp registers */ - #define FW_REGS_DBG_LOG_WP(core) (0x30 + 0x4 * core) - --static int --skl_log_buffer_status(struct avs_dev *adev, union avs_notify_msg *msg) -+static int avs_skl_log_buffer_status(struct avs_dev *adev, union avs_notify_msg *msg) - { - void __iomem *buf; - u16 size, write, offset; -@@ -74,7 +73,7 @@ skl_log_buffer_status(struct avs_dev *adev, union avs_notify_msg *msg) - return 0; - } - --static int skl_coredump(struct avs_dev *adev, union avs_notify_msg *msg) -+static int avs_skl_coredump(struct avs_dev *adev, union avs_notify_msg *msg) - { - u8 *dump; - -@@ -88,20 +87,19 @@ static int skl_coredump(struct avs_dev *adev, union avs_notify_msg *msg) - return 0; - } - --static bool --skl_d0ix_toggle(struct avs_dev *adev, struct avs_ipc_msg *tx, bool wake) -+static bool avs_skl_d0ix_toggle(struct avs_dev *adev, struct avs_ipc_msg *tx, bool wake) - { - /* unsupported on cAVS 1.5 hw */ - return false; - } - --static int skl_set_d0ix(struct avs_dev *adev, bool enable) -+static int avs_skl_set_d0ix(struct avs_dev *adev, bool enable) - { - /* unsupported on cAVS 1.5 hw */ - return 0; - } - --const struct avs_dsp_ops skl_dsp_ops = { -+const struct avs_dsp_ops avs_skl_dsp_ops = { - .power = avs_dsp_core_power, - .reset = avs_dsp_core_reset, - .stall = avs_dsp_core_stall, -@@ -111,10 +109,10 @@ const struct avs_dsp_ops skl_dsp_ops = { - .load_basefw = avs_cldma_load_basefw, - .load_lib = avs_cldma_load_library, - .transfer_mods = avs_cldma_transfer_modules, -- .log_buffer_offset = skl_log_buffer_offset, -- .log_buffer_status = skl_log_buffer_status, -- .coredump = skl_coredump, -- .d0ix_toggle = skl_d0ix_toggle, -- .set_d0ix = skl_set_d0ix, -+ .log_buffer_offset = avs_skl_log_buffer_offset, -+ .log_buffer_status = avs_skl_log_buffer_status, -+ .coredump = avs_skl_coredump, -+ .d0ix_toggle = avs_skl_d0ix_toggle, -+ .set_d0ix = avs_skl_set_d0ix, - AVS_SET_ENABLE_LOGS_OP(skl) - }; -diff --git a/sound/soc/rockchip/rockchip_i2s_tdm.c b/sound/soc/rockchip/rockchip_i2s_tdm.c -index e6a6eabc47e5bb..14e5c53e697b0e 100644 ---- a/sound/soc/rockchip/rockchip_i2s_tdm.c -+++ b/sound/soc/rockchip/rockchip_i2s_tdm.c -@@ -24,7 +24,6 @@ - - #define DRV_NAME "rockchip-i2s-tdm" - --#define DEFAULT_MCLK_FS 256 - #define CH_GRP_MAX 4 /* The max channel 8 / 2 */ - #define MULTIPLEX_CH_MAX 10 - -@@ -72,6 +71,8 @@ struct rk_i2s_tdm_dev { - bool has_playback; - bool has_capture; - struct snd_soc_dai_driver *dai; -+ unsigned int mclk_rx_freq; -+ unsigned int mclk_tx_freq; - }; - - static int to_ch_num(unsigned int val) -@@ -647,6 +648,27 @@ static int rockchip_i2s_trcm_mode(struct snd_pcm_substream *substream, - return 0; - } - -+static int rockchip_i2s_tdm_set_sysclk(struct snd_soc_dai *cpu_dai, int stream, -+ unsigned int freq, int dir) -+{ -+ struct rk_i2s_tdm_dev *i2s_tdm = to_info(cpu_dai); -+ -+ if (i2s_tdm->clk_trcm) { -+ i2s_tdm->mclk_tx_freq = freq; -+ i2s_tdm->mclk_rx_freq = freq; -+ } else { -+ if (stream == SNDRV_PCM_STREAM_PLAYBACK) -+ i2s_tdm->mclk_tx_freq = freq; -+ else -+ i2s_tdm->mclk_rx_freq = freq; -+ } -+ -+ dev_dbg(i2s_tdm->dev, "The target mclk_%s freq is: %d\n", -+ stream ? "rx" : "tx", freq); -+ -+ return 0; -+} -+ - static int rockchip_i2s_tdm_hw_params(struct snd_pcm_substream *substream, - struct snd_pcm_hw_params *params, - struct snd_soc_dai *dai) -@@ -661,15 +683,19 @@ static int rockchip_i2s_tdm_hw_params(struct snd_pcm_substream *substream, - - if (i2s_tdm->clk_trcm == TRCM_TX) { - mclk = i2s_tdm->mclk_tx; -+ mclk_rate = i2s_tdm->mclk_tx_freq; - } else if (i2s_tdm->clk_trcm == TRCM_RX) { - mclk = i2s_tdm->mclk_rx; -+ mclk_rate = i2s_tdm->mclk_rx_freq; - } else if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) { - mclk = i2s_tdm->mclk_tx; -+ mclk_rate = i2s_tdm->mclk_tx_freq; - } else { - mclk = i2s_tdm->mclk_rx; -+ mclk_rate = i2s_tdm->mclk_rx_freq; - } - -- err = clk_set_rate(mclk, DEFAULT_MCLK_FS * params_rate(params)); -+ err = clk_set_rate(mclk, mclk_rate); - if (err) - return err; - -@@ -829,6 +855,7 @@ static const struct snd_soc_dai_ops rockchip_i2s_tdm_dai_ops = { - .hw_params = rockchip_i2s_tdm_hw_params, - .set_bclk_ratio = rockchip_i2s_tdm_set_bclk_ratio, - .set_fmt = rockchip_i2s_tdm_set_fmt, -+ .set_sysclk = rockchip_i2s_tdm_set_sysclk, - .set_tdm_slot = rockchip_dai_tdm_slot, - .trigger = rockchip_i2s_tdm_trigger, - }; -diff --git a/sound/soc/sh/rz-ssi.c b/sound/soc/sh/rz-ssi.c -index 1588b93cc35d01..353863f49b3131 100644 ---- a/sound/soc/sh/rz-ssi.c -+++ b/sound/soc/sh/rz-ssi.c -@@ -245,8 +245,7 @@ static void rz_ssi_stream_quit(struct rz_ssi_priv *ssi, - static int rz_ssi_clk_setup(struct rz_ssi_priv *ssi, unsigned int rate, - unsigned int channels) - { -- static s8 ckdv[16] = { 1, 2, 4, 8, 16, 32, 64, 128, -- 6, 12, 24, 48, 96, -1, -1, -1 }; -+ static u8 ckdv[] = { 1, 2, 4, 8, 16, 32, 64, 128, 6, 12, 24, 48, 96 }; - unsigned int channel_bits = 32; /* System Word Length */ - unsigned long bclk_rate = rate * channels * channel_bits; - unsigned int div; -diff --git a/sound/soc/sunxi/sun4i-spdif.c b/sound/soc/sunxi/sun4i-spdif.c -index 2347aeb049bccf..e482238388de12 100644 ---- a/sound/soc/sunxi/sun4i-spdif.c -+++ b/sound/soc/sunxi/sun4i-spdif.c -@@ -177,6 +177,7 @@ struct sun4i_spdif_quirks { - unsigned int reg_dac_txdata; - bool has_reset; - unsigned int val_fctl_ftx; -+ unsigned int mclk_multiplier; - }; - - struct sun4i_spdif_dev { -@@ -314,6 +315,7 @@ static int sun4i_spdif_hw_params(struct snd_pcm_substream *substream, - default: - return -EINVAL; - } -+ mclk *= host->quirks->mclk_multiplier; - - ret = clk_set_rate(host->spdif_clk, mclk); - if (ret < 0) { -@@ -348,6 +350,7 @@ static int sun4i_spdif_hw_params(struct snd_pcm_substream *substream, - default: - return -EINVAL; - } -+ mclk_div *= host->quirks->mclk_multiplier; - - reg_val = 0; - reg_val |= SUN4I_SPDIF_TXCFG_ASS; -@@ -541,24 +544,28 @@ static struct snd_soc_dai_driver sun4i_spdif_dai = { - static const struct sun4i_spdif_quirks sun4i_a10_spdif_quirks = { - .reg_dac_txdata = SUN4I_SPDIF_TXFIFO, - .val_fctl_ftx = SUN4I_SPDIF_FCTL_FTX, -+ .mclk_multiplier = 1, - }; - - static const struct sun4i_spdif_quirks sun6i_a31_spdif_quirks = { - .reg_dac_txdata = SUN4I_SPDIF_TXFIFO, - .val_fctl_ftx = SUN4I_SPDIF_FCTL_FTX, - .has_reset = true, -+ .mclk_multiplier = 1, - }; - - static const struct sun4i_spdif_quirks sun8i_h3_spdif_quirks = { - .reg_dac_txdata = SUN8I_SPDIF_TXFIFO, - .val_fctl_ftx = SUN4I_SPDIF_FCTL_FTX, - .has_reset = true, -+ .mclk_multiplier = 4, - }; - - static const struct sun4i_spdif_quirks sun50i_h6_spdif_quirks = { - .reg_dac_txdata = SUN8I_SPDIF_TXFIFO, - .val_fctl_ftx = SUN50I_H6_SPDIF_FCTL_FTX, - .has_reset = true, -+ .mclk_multiplier = 1, - }; - - static const struct of_device_id sun4i_spdif_of_match[] = { -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index 9cdd6cfd8219a7..93d9ed8983dfce 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -2243,6 +2243,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { - QUIRK_FLAG_CTL_MSG_DELAY_1M), - DEVICE_FLG(0x2d95, 0x8021, /* VIVO USB-C-XE710 HEADSET */ - QUIRK_FLAG_CTL_MSG_DELAY_1M), -+ DEVICE_FLG(0x2fc6, 0xf0b7, /* iBasso DC07 Pro */ -+ QUIRK_FLAG_CTL_MSG_DELAY_1M), - DEVICE_FLG(0x30be, 0x0101, /* Schiit Hel */ - QUIRK_FLAG_IGNORE_CTL_ERROR), - DEVICE_FLG(0x413c, 0xa506, /* Dell AE515 sound bar */ -diff --git a/tools/bootconfig/main.c b/tools/bootconfig/main.c -index 156b62a163c5a6..8a48cc2536f566 100644 ---- a/tools/bootconfig/main.c -+++ b/tools/bootconfig/main.c -@@ -226,7 +226,7 @@ static int load_xbc_from_initrd(int fd, char **buf) - /* Wrong Checksum */ - rcsum = xbc_calc_checksum(*buf, size); - if (csum != rcsum) { -- pr_err("checksum error: %d != %d\n", csum, rcsum); -+ pr_err("checksum error: %u != %u\n", csum, rcsum); - return -EINVAL; - } - -@@ -395,7 +395,7 @@ static int apply_xbc(const char *path, const char *xbc_path) - xbc_get_info(&ret, NULL); - printf("\tNumber of nodes: %d\n", ret); - printf("\tSize: %u bytes\n", (unsigned int)size); -- printf("\tChecksum: %d\n", (unsigned int)csum); -+ printf("\tChecksum: %u\n", (unsigned int)csum); - - /* TODO: Check the options by schema */ - xbc_exit(); -diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c -index 88cc7236f12202..736ebceea233f8 100644 ---- a/tools/lib/bpf/linker.c -+++ b/tools/lib/bpf/linker.c -@@ -567,17 +567,15 @@ static int linker_load_obj_file(struct bpf_linker *linker, const char *filename, - } - obj->elf = elf_begin(obj->fd, ELF_C_READ_MMAP, NULL); - if (!obj->elf) { -- err = -errno; - pr_warn_elf("failed to parse ELF file '%s'", filename); -- return err; -+ return -EINVAL; - } - - /* Sanity check ELF file high-level properties */ - ehdr = elf64_getehdr(obj->elf); - if (!ehdr) { -- err = -errno; - pr_warn_elf("failed to get ELF header for %s", filename); -- return err; -+ return -EINVAL; - } - if (ehdr->e_ident[EI_DATA] != host_endianness) { - err = -EOPNOTSUPP; -@@ -593,9 +591,8 @@ static int linker_load_obj_file(struct bpf_linker *linker, const char *filename, - } - - if (elf_getshdrstrndx(obj->elf, &obj->shstrs_sec_idx)) { -- err = -errno; - pr_warn_elf("failed to get SHSTRTAB section index for %s", filename); -- return err; -+ return -EINVAL; - } - - scn = NULL; -@@ -605,26 +602,23 @@ static int linker_load_obj_file(struct bpf_linker *linker, const char *filename, - - shdr = elf64_getshdr(scn); - if (!shdr) { -- err = -errno; - pr_warn_elf("failed to get section #%zu header for %s", - sec_idx, filename); -- return err; -+ return -EINVAL; - } - - sec_name = elf_strptr(obj->elf, obj->shstrs_sec_idx, shdr->sh_name); - if (!sec_name) { -- err = -errno; - pr_warn_elf("failed to get section #%zu name for %s", - sec_idx, filename); -- return err; -+ return -EINVAL; - } - - data = elf_getdata(scn, 0); - if (!data) { -- err = -errno; - pr_warn_elf("failed to get section #%zu (%s) data from %s", - sec_idx, sec_name, filename); -- return err; -+ return -EINVAL; - } - - sec = add_src_sec(obj, sec_name); -@@ -2602,14 +2596,14 @@ int bpf_linker__finalize(struct bpf_linker *linker) - - /* Finalize ELF layout */ - if (elf_update(linker->elf, ELF_C_NULL) < 0) { -- err = -errno; -+ err = -EINVAL; - pr_warn_elf("failed to finalize ELF layout"); - return libbpf_err(err); - } - - /* Write out final ELF contents */ - if (elf_update(linker->elf, ELF_C_WRITE) < 0) { -- err = -errno; -+ err = -EINVAL; - pr_warn_elf("failed to write ELF contents"); - return libbpf_err(err); - } -diff --git a/tools/lib/bpf/usdt.c b/tools/lib/bpf/usdt.c -index 93794f01bb67cb..6ff28e7bf5e3da 100644 ---- a/tools/lib/bpf/usdt.c -+++ b/tools/lib/bpf/usdt.c -@@ -659,7 +659,7 @@ static int collect_usdt_targets(struct usdt_manager *man, Elf *elf, const char * - * [0] https://sourceware.org/systemtap/wiki/UserSpaceProbeImplementation - */ - usdt_abs_ip = note.loc_addr; -- if (base_addr) -+ if (base_addr && note.base_addr) - usdt_abs_ip += base_addr - note.base_addr; - - /* When attaching uprobes (which is what USDTs basically are) -diff --git a/tools/perf/builtin-lock.c b/tools/perf/builtin-lock.c -index fcb32c58bee7e4..bd24ed0af208a1 100644 ---- a/tools/perf/builtin-lock.c -+++ b/tools/perf/builtin-lock.c -@@ -1591,8 +1591,8 @@ static const struct { - { LCB_F_PERCPU | LCB_F_WRITE, "pcpu-sem:W", "percpu-rwsem" }, - { LCB_F_MUTEX, "mutex", "mutex" }, - { LCB_F_MUTEX | LCB_F_SPIN, "mutex", "mutex" }, -- /* alias for get_type_flag() */ -- { LCB_F_MUTEX | LCB_F_SPIN, "mutex-spin", "mutex" }, -+ /* alias for optimistic spinning only */ -+ { LCB_F_MUTEX | LCB_F_SPIN, "mutex:spin", "mutex-spin" }, - }; - - static const char *get_type_str(unsigned int flags) -@@ -1617,19 +1617,6 @@ static const char *get_type_name(unsigned int flags) - return "unknown"; - } - --static unsigned int get_type_flag(const char *str) --{ -- for (unsigned int i = 0; i < ARRAY_SIZE(lock_type_table); i++) { -- if (!strcmp(lock_type_table[i].name, str)) -- return lock_type_table[i].flags; -- } -- for (unsigned int i = 0; i < ARRAY_SIZE(lock_type_table); i++) { -- if (!strcmp(lock_type_table[i].str, str)) -- return lock_type_table[i].flags; -- } -- return UINT_MAX; --} -- - static void lock_filter_finish(void) - { - zfree(&filters.types); -@@ -2321,29 +2308,58 @@ static int parse_lock_type(const struct option *opt __maybe_unused, const char * - int unset __maybe_unused) - { - char *s, *tmp, *tok; -- int ret = 0; - - s = strdup(str); - if (s == NULL) - return -1; - - for (tok = strtok_r(s, ", ", &tmp); tok; tok = strtok_r(NULL, ", ", &tmp)) { -- unsigned int flags = get_type_flag(tok); -+ bool found = false; - -- if (flags == -1U) { -- pr_err("Unknown lock flags: %s\n", tok); -- ret = -1; -- break; -+ /* `tok` is `str` in `lock_type_table` if it contains ':'. */ -+ if (strchr(tok, ':')) { -+ for (unsigned int i = 0; i < ARRAY_SIZE(lock_type_table); i++) { -+ if (!strcmp(lock_type_table[i].str, tok) && -+ add_lock_type(lock_type_table[i].flags)) { -+ found = true; -+ break; -+ } -+ } -+ -+ if (!found) { -+ pr_err("Unknown lock flags name: %s\n", tok); -+ free(s); -+ return -1; -+ } -+ -+ continue; - } - -- if (!add_lock_type(flags)) { -- ret = -1; -- break; -+ /* -+ * Otherwise `tok` is `name` in `lock_type_table`. -+ * Single lock name could contain multiple flags. -+ */ -+ for (unsigned int i = 0; i < ARRAY_SIZE(lock_type_table); i++) { -+ if (!strcmp(lock_type_table[i].name, tok)) { -+ if (add_lock_type(lock_type_table[i].flags)) { -+ found = true; -+ } else { -+ free(s); -+ return -1; -+ } -+ } - } -+ -+ if (!found) { -+ pr_err("Unknown lock name: %s\n", tok); -+ free(s); -+ return -1; -+ } -+ - } - - free(s); -- return ret; -+ return 0; - } - - static bool add_lock_addr(unsigned long addr) -diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c -index cd2f3f1a756330..54b06db597862f 100644 ---- a/tools/perf/builtin-report.c -+++ b/tools/perf/builtin-report.c -@@ -1352,7 +1352,7 @@ int cmd_report(int argc, const char **argv) - OPT_STRING(0, "addr2line", &addr2line_path, "path", - "addr2line binary to use for line numbers"), - OPT_BOOLEAN(0, "demangle", &symbol_conf.demangle, -- "Disable symbol demangling"), -+ "Symbol demangling. Enabled by default, use --no-demangle to disable."), - OPT_BOOLEAN(0, "demangle-kernel", &symbol_conf.demangle_kernel, - "Enable kernel symbol demangling"), - OPT_BOOLEAN(0, "mem-mode", &report.mem_mode, "mem access profile"), -diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c -index 1c1ec444d501ee..381274c70a9afd 100644 ---- a/tools/perf/builtin-top.c -+++ b/tools/perf/builtin-top.c -@@ -809,7 +809,7 @@ static void perf_event__process_sample(struct perf_tool *tool, - * invalid --vmlinux ;-) - */ - if (!machine->kptr_restrict_warned && !top->vmlinux_warned && -- __map__is_kernel(al.map) && map__has_symbols(al.map)) { -+ __map__is_kernel(al.map) && !map__has_symbols(al.map)) { - if (symbol_conf.vmlinux_name) { - char serr[256]; - -diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c -index 3ecd6868be2d6d..12bdbf3ecc6ae4 100644 ---- a/tools/perf/builtin-trace.c -+++ b/tools/perf/builtin-trace.c -@@ -1850,8 +1850,12 @@ static int trace__read_syscall_info(struct trace *trace, int id) - return PTR_ERR(sc->tp_format); - } - -+ /* -+ * The tracepoint format contains __syscall_nr field, so it's one more -+ * than the actual number of syscall arguments. -+ */ - if (syscall__alloc_arg_fmts(sc, IS_ERR(sc->tp_format) ? -- RAW_SYSCALL_ARGS_NUM : sc->tp_format->format.nr_fields)) -+ RAW_SYSCALL_ARGS_NUM : sc->tp_format->format.nr_fields - 1)) - return -ENOMEM; - - sc->args = sc->tp_format->format.fields; -diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c -index b00b5a2634c3d1..b94b4f16a60a54 100644 ---- a/tools/perf/util/bpf-event.c -+++ b/tools/perf/util/bpf-event.c -@@ -288,7 +288,10 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_session *session, - } - - info_node->info_linear = info_linear; -- perf_env__insert_bpf_prog_info(env, info_node); -+ if (!perf_env__insert_bpf_prog_info(env, info_node)) { -+ free(info_linear); -+ free(info_node); -+ } - info_linear = NULL; - - /* -@@ -476,7 +479,10 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id) - info_node = malloc(sizeof(struct bpf_prog_info_node)); - if (info_node) { - info_node->info_linear = info_linear; -- perf_env__insert_bpf_prog_info(env, info_node); -+ if (!perf_env__insert_bpf_prog_info(env, info_node)) { -+ free(info_linear); -+ free(info_node); -+ } - } else - free(info_linear); - -diff --git a/tools/perf/util/env.c b/tools/perf/util/env.c -index d2c7b6e6eae51b..cea15c568602b1 100644 ---- a/tools/perf/util/env.c -+++ b/tools/perf/util/env.c -@@ -20,15 +20,19 @@ struct perf_env perf_env; - #include "bpf-utils.h" - #include - --void perf_env__insert_bpf_prog_info(struct perf_env *env, -+bool perf_env__insert_bpf_prog_info(struct perf_env *env, - struct bpf_prog_info_node *info_node) - { -+ bool ret; -+ - down_write(&env->bpf_progs.lock); -- __perf_env__insert_bpf_prog_info(env, info_node); -+ ret = __perf_env__insert_bpf_prog_info(env, info_node); - up_write(&env->bpf_progs.lock); -+ -+ return ret; - } - --void __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info_node *info_node) -+bool __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info_node *info_node) - { - __u32 prog_id = info_node->info_linear->info.id; - struct bpf_prog_info_node *node; -@@ -46,13 +50,14 @@ void __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info - p = &(*p)->rb_right; - } else { - pr_debug("duplicated bpf prog info %u\n", prog_id); -- return; -+ return false; - } - } - - rb_link_node(&info_node->rb_node, parent, p); - rb_insert_color(&info_node->rb_node, &env->bpf_progs.infos); - env->bpf_progs.infos_cnt++; -+ return true; - } - - struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env, -diff --git a/tools/perf/util/env.h b/tools/perf/util/env.h -index 359eff51cb85b7..bc2d0ef3519978 100644 ---- a/tools/perf/util/env.h -+++ b/tools/perf/util/env.h -@@ -164,9 +164,9 @@ const char *perf_env__raw_arch(struct perf_env *env); - int perf_env__nr_cpus_avail(struct perf_env *env); - - void perf_env__init(struct perf_env *env); --void __perf_env__insert_bpf_prog_info(struct perf_env *env, -+bool __perf_env__insert_bpf_prog_info(struct perf_env *env, - struct bpf_prog_info_node *info_node); --void perf_env__insert_bpf_prog_info(struct perf_env *env, -+bool perf_env__insert_bpf_prog_info(struct perf_env *env, - struct bpf_prog_info_node *info_node); - struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env, - __u32 prog_id); -diff --git a/tools/perf/util/expr.c b/tools/perf/util/expr.c -index b8875aac8f8709..fa0473f7a4ff45 100644 ---- a/tools/perf/util/expr.c -+++ b/tools/perf/util/expr.c -@@ -292,7 +292,7 @@ struct expr_parse_ctx *expr__ctx_new(void) - { - struct expr_parse_ctx *ctx; - -- ctx = malloc(sizeof(struct expr_parse_ctx)); -+ ctx = calloc(1, sizeof(struct expr_parse_ctx)); - if (!ctx) - return NULL; - -@@ -301,9 +301,6 @@ struct expr_parse_ctx *expr__ctx_new(void) - free(ctx); - return NULL; - } -- ctx->sctx.user_requested_cpu_list = NULL; -- ctx->sctx.runtime = 0; -- ctx->sctx.system_wide = false; - - return ctx; - } -diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c -index 1482567e5ac1a7..0b44176826bfd9 100644 ---- a/tools/perf/util/header.c -+++ b/tools/perf/util/header.c -@@ -3177,7 +3177,10 @@ static int process_bpf_prog_info(struct feat_fd *ff, void *data __maybe_unused) - /* after reading from file, translate offset to address */ - bpil_offs_to_addr(info_linear); - info_node->info_linear = info_linear; -- __perf_env__insert_bpf_prog_info(env, info_node); -+ if (!__perf_env__insert_bpf_prog_info(env, info_node)) { -+ free(info_linear); -+ free(info_node); -+ } - } - - up_write(&env->bpf_progs.lock); -@@ -3224,7 +3227,8 @@ static int process_bpf_btf(struct feat_fd *ff, void *data __maybe_unused) - if (__do_read(ff, node->data, data_size)) - goto out; - -- __perf_env__insert_btf(env, node); -+ if (!__perf_env__insert_btf(env, node)) -+ free(node); - node = NULL; - } - -diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c -index 7c6874804660eb..e2a6facd1c4e2a 100644 ---- a/tools/perf/util/machine.c -+++ b/tools/perf/util/machine.c -@@ -1217,7 +1217,7 @@ static int machine__get_running_kernel_start(struct machine *machine, - - err = kallsyms__get_symbol_start(filename, "_edata", &addr); - if (err) -- err = kallsyms__get_function_start(filename, "_etext", &addr); -+ err = kallsyms__get_symbol_start(filename, "_etext", &addr); - if (!err) - *end = addr; - -diff --git a/tools/perf/util/namespaces.c b/tools/perf/util/namespaces.c -index cb185c5659d6b3..68f5de2d79c72c 100644 ---- a/tools/perf/util/namespaces.c -+++ b/tools/perf/util/namespaces.c -@@ -266,11 +266,16 @@ pid_t nsinfo__pid(const struct nsinfo *nsi) - return RC_CHK_ACCESS(nsi)->pid; - } - --pid_t nsinfo__in_pidns(const struct nsinfo *nsi) -+bool nsinfo__in_pidns(const struct nsinfo *nsi) - { - return RC_CHK_ACCESS(nsi)->in_pidns; - } - -+void nsinfo__set_in_pidns(struct nsinfo *nsi) -+{ -+ RC_CHK_ACCESS(nsi)->in_pidns = true; -+} -+ - void nsinfo__mountns_enter(struct nsinfo *nsi, - struct nscookie *nc) - { -diff --git a/tools/perf/util/namespaces.h b/tools/perf/util/namespaces.h -index 8c0731c6cbb7ee..e95c79b80e27c8 100644 ---- a/tools/perf/util/namespaces.h -+++ b/tools/perf/util/namespaces.h -@@ -58,7 +58,8 @@ void nsinfo__clear_need_setns(struct nsinfo *nsi); - pid_t nsinfo__tgid(const struct nsinfo *nsi); - pid_t nsinfo__nstgid(const struct nsinfo *nsi); - pid_t nsinfo__pid(const struct nsinfo *nsi); --pid_t nsinfo__in_pidns(const struct nsinfo *nsi); -+bool nsinfo__in_pidns(const struct nsinfo *nsi); -+void nsinfo__set_in_pidns(struct nsinfo *nsi); - - void nsinfo__mountns_enter(struct nsinfo *nsi, struct nscookie *nc); - void nsinfo__mountns_exit(struct nscookie *nc); -diff --git a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c -index ae6af354a81db5..08a399b0be286c 100644 ---- a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c -+++ b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c -@@ -33,7 +33,7 @@ static int mperf_get_count_percent(unsigned int self_id, double *percent, - unsigned int cpu); - static int mperf_get_count_freq(unsigned int id, unsigned long long *count, - unsigned int cpu); --static struct timespec time_start, time_end; -+static struct timespec *time_start, *time_end; - - static cstate_t mperf_cstates[MPERF_CSTATE_COUNT] = { - { -@@ -174,7 +174,7 @@ static int mperf_get_count_percent(unsigned int id, double *percent, - dprint("%s: TSC Ref - mperf_diff: %llu, tsc_diff: %llu\n", - mperf_cstates[id].name, mperf_diff, tsc_diff); - } else if (max_freq_mode == MAX_FREQ_SYSFS) { -- timediff = max_frequency * timespec_diff_us(time_start, time_end); -+ timediff = max_frequency * timespec_diff_us(time_start[cpu], time_end[cpu]); - *percent = 100.0 * mperf_diff / timediff; - dprint("%s: MAXFREQ - mperf_diff: %llu, time_diff: %llu\n", - mperf_cstates[id].name, mperf_diff, timediff); -@@ -207,7 +207,7 @@ static int mperf_get_count_freq(unsigned int id, unsigned long long *count, - if (max_freq_mode == MAX_FREQ_TSC_REF) { - /* Calculate max_freq from TSC count */ - tsc_diff = tsc_at_measure_end[cpu] - tsc_at_measure_start[cpu]; -- time_diff = timespec_diff_us(time_start, time_end); -+ time_diff = timespec_diff_us(time_start[cpu], time_end[cpu]); - max_frequency = tsc_diff / time_diff; - } - -@@ -226,9 +226,8 @@ static int mperf_start(void) - { - int cpu; - -- clock_gettime(CLOCK_REALTIME, &time_start); -- - for (cpu = 0; cpu < cpu_count; cpu++) { -+ clock_gettime(CLOCK_REALTIME, &time_start[cpu]); - mperf_get_tsc(&tsc_at_measure_start[cpu]); - mperf_init_stats(cpu); - } -@@ -243,9 +242,9 @@ static int mperf_stop(void) - for (cpu = 0; cpu < cpu_count; cpu++) { - mperf_measure_stats(cpu); - mperf_get_tsc(&tsc_at_measure_end[cpu]); -+ clock_gettime(CLOCK_REALTIME, &time_end[cpu]); - } - -- clock_gettime(CLOCK_REALTIME, &time_end); - return 0; - } - -@@ -349,6 +348,8 @@ struct cpuidle_monitor *mperf_register(void) - aperf_current_count = calloc(cpu_count, sizeof(unsigned long long)); - tsc_at_measure_start = calloc(cpu_count, sizeof(unsigned long long)); - tsc_at_measure_end = calloc(cpu_count, sizeof(unsigned long long)); -+ time_start = calloc(cpu_count, sizeof(struct timespec)); -+ time_end = calloc(cpu_count, sizeof(struct timespec)); - mperf_monitor.name_len = strlen(mperf_monitor.name); - return &mperf_monitor; - } -@@ -361,6 +362,8 @@ void mperf_unregister(void) - free(aperf_current_count); - free(tsc_at_measure_start); - free(tsc_at_measure_end); -+ free(time_start); -+ free(time_end); - free(is_valid); - } - -diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl -index 045090085ac5bd..83d65c2abaf010 100755 ---- a/tools/testing/ktest/ktest.pl -+++ b/tools/testing/ktest/ktest.pl -@@ -2406,6 +2406,11 @@ sub get_version { - return if ($have_version); - doprint "$make kernelrelease ... "; - $version = `$make -s kernelrelease | tail -1`; -+ if (!length($version)) { -+ run_command "$make allnoconfig" or return 0; -+ doprint "$make kernelrelease ... "; -+ $version = `$make -s kernelrelease | tail -1`; -+ } - chomp($version); - doprint "$version\n"; - $have_version = 1; -@@ -2946,8 +2951,6 @@ sub run_bisect_test { - - my $failed = 0; - my $result; -- my $output; -- my $ret; - - $in_bisect = 1; - -diff --git a/tools/testing/selftests/bpf/prog_tests/fill_link_info.c b/tools/testing/selftests/bpf/prog_tests/fill_link_info.c -index 5b0c6a04cdbfe0..e0208b0e53f162 100644 ---- a/tools/testing/selftests/bpf/prog_tests/fill_link_info.c -+++ b/tools/testing/selftests/bpf/prog_tests/fill_link_info.c -@@ -164,6 +164,10 @@ static void test_kprobe_fill_link_info(struct test_fill_link_info *skel, - /* See also arch_adjust_kprobe_addr(). */ - if (skel->kconfig->CONFIG_X86_KERNEL_IBT) - entry_offset = 4; -+ if (skel->kconfig->CONFIG_PPC64 && -+ skel->kconfig->CONFIG_KPROBES_ON_FTRACE && -+ !skel->kconfig->CONFIG_PPC_FTRACE_OUT_OF_LINE) -+ entry_offset = 4; - err = verify_perf_link_info(link_fd, type, kprobe_addr, 0, entry_offset); - ASSERT_OK(err, "verify_perf_link_info"); - } else { -diff --git a/tools/testing/selftests/bpf/progs/test_fill_link_info.c b/tools/testing/selftests/bpf/progs/test_fill_link_info.c -index 564f402d56fef7..54b53ad05339df 100644 ---- a/tools/testing/selftests/bpf/progs/test_fill_link_info.c -+++ b/tools/testing/selftests/bpf/progs/test_fill_link_info.c -@@ -6,13 +6,20 @@ - #include - - extern bool CONFIG_X86_KERNEL_IBT __kconfig __weak; -+extern bool CONFIG_PPC_FTRACE_OUT_OF_LINE __kconfig __weak; -+extern bool CONFIG_KPROBES_ON_FTRACE __kconfig __weak; -+extern bool CONFIG_PPC64 __kconfig __weak; - --/* This function is here to have CONFIG_X86_KERNEL_IBT -- * used and added to object BTF. -+/* This function is here to have CONFIG_X86_KERNEL_IBT, -+ * CONFIG_PPC_FTRACE_OUT_OF_LINE, CONFIG_KPROBES_ON_FTRACE, -+ * CONFIG_PPC6 used and added to object BTF. - */ - int unused(void) - { -- return CONFIG_X86_KERNEL_IBT ? 0 : 1; -+ return CONFIG_X86_KERNEL_IBT || -+ CONFIG_PPC_FTRACE_OUT_OF_LINE || -+ CONFIG_KPROBES_ON_FTRACE || -+ CONFIG_PPC64 ? 0 : 1; - } - - SEC("kprobe") -diff --git a/tools/testing/selftests/bpf/test_tc_tunnel.sh b/tools/testing/selftests/bpf/test_tc_tunnel.sh -index 7989ec60845455..cb55a908bb0d70 100755 ---- a/tools/testing/selftests/bpf/test_tc_tunnel.sh -+++ b/tools/testing/selftests/bpf/test_tc_tunnel.sh -@@ -305,6 +305,7 @@ else - client_connect - verify_data - server_listen -+ wait_for_port ${port} ${netcat_opt} - fi - - # serverside, use BPF for decap -diff --git a/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh b/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh -index 185b02d2d4cd14..7af78990b5bb60 100755 ---- a/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh -+++ b/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh -@@ -142,7 +142,7 @@ function pre_ethtool { - } - - function check_table { -- local path=$NSIM_DEV_DFS/ports/$port/udp_ports_table$1 -+ local path=$NSIM_DEV_DFS/ports/$port/udp_ports/table$1 - local -n expected=$2 - local last=$3 - -@@ -212,7 +212,7 @@ function check_tables { - } - - function print_table { -- local path=$NSIM_DEV_DFS/ports/$port/udp_ports_table$1 -+ local path=$NSIM_DEV_DFS/ports/$port/udp_ports/table$1 - read -a have < $path - - tree $NSIM_DEV_DFS/ -@@ -640,7 +640,7 @@ for port in 0 1; do - NSIM_NETDEV=`get_netdev_name old_netdevs` - ifconfig $NSIM_NETDEV up - -- echo 110 > $NSIM_DEV_DFS/ports/$port/udp_ports_inject_error -+ echo 110 > $NSIM_DEV_DFS/ports/$port/udp_ports/inject_error - - msg="1 - create VxLANs v6" - exp0=( 0 0 0 0 ) -@@ -662,7 +662,7 @@ for port in 0 1; do - new_geneve gnv0 20000 - - msg="2 - destroy GENEVE" -- echo 2 > $NSIM_DEV_DFS/ports/$port/udp_ports_inject_error -+ echo 2 > $NSIM_DEV_DFS/ports/$port/udp_ports/inject_error - exp1=( `mke 20000 2` 0 0 0 ) - del_dev gnv0 - -@@ -763,7 +763,7 @@ for port in 0 1; do - msg="create VxLANs v4" - new_vxlan vxlan0 10000 $NSIM_NETDEV - -- echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset -+ echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset - check_tables - - msg="NIC device goes down" -@@ -774,7 +774,7 @@ for port in 0 1; do - fi - check_tables - -- echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset -+ echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset - check_tables - - msg="NIC device goes up again" -@@ -788,7 +788,7 @@ for port in 0 1; do - del_dev vxlan0 - check_tables - -- echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset -+ echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset - check_tables - - msg="destroy NIC" -@@ -895,7 +895,7 @@ msg="vacate VxLAN in overflow table" - exp0=( `mke 10000 1` `mke 10004 1` 0 `mke 10003 1` ) - del_dev vxlan2 - --echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset -+echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset - check_tables - - msg="tunnels destroyed 2" -diff --git a/tools/testing/selftests/kselftest_harness.h b/tools/testing/selftests/kselftest_harness.h -index e05ac826104678..878aac3b5ed543 100644 ---- a/tools/testing/selftests/kselftest_harness.h -+++ b/tools/testing/selftests/kselftest_harness.h -@@ -710,33 +710,33 @@ - /* Report with actual signedness to avoid weird output. */ \ - switch (is_signed_type(__exp) * 2 + is_signed_type(__seen)) { \ - case 0: { \ -- unsigned long long __exp_print = (uintptr_t)__exp; \ -- unsigned long long __seen_print = (uintptr_t)__seen; \ -- __TH_LOG("Expected %s (%llu) %s %s (%llu)", \ -+ uintmax_t __exp_print = (uintmax_t)__exp; \ -+ uintmax_t __seen_print = (uintmax_t)__seen; \ -+ __TH_LOG("Expected %s (%ju) %s %s (%ju)", \ - _expected_str, __exp_print, #_t, \ - _seen_str, __seen_print); \ - break; \ - } \ - case 1: { \ -- unsigned long long __exp_print = (uintptr_t)__exp; \ -- long long __seen_print = (intptr_t)__seen; \ -- __TH_LOG("Expected %s (%llu) %s %s (%lld)", \ -+ uintmax_t __exp_print = (uintmax_t)__exp; \ -+ intmax_t __seen_print = (intmax_t)__seen; \ -+ __TH_LOG("Expected %s (%ju) %s %s (%jd)", \ - _expected_str, __exp_print, #_t, \ - _seen_str, __seen_print); \ - break; \ - } \ - case 2: { \ -- long long __exp_print = (intptr_t)__exp; \ -- unsigned long long __seen_print = (uintptr_t)__seen; \ -- __TH_LOG("Expected %s (%lld) %s %s (%llu)", \ -+ intmax_t __exp_print = (intmax_t)__exp; \ -+ uintmax_t __seen_print = (uintmax_t)__seen; \ -+ __TH_LOG("Expected %s (%jd) %s %s (%ju)", \ - _expected_str, __exp_print, #_t, \ - _seen_str, __seen_print); \ - break; \ - } \ - case 3: { \ -- long long __exp_print = (intptr_t)__exp; \ -- long long __seen_print = (intptr_t)__seen; \ -- __TH_LOG("Expected %s (%lld) %s %s (%lld)", \ -+ intmax_t __exp_print = (intmax_t)__exp; \ -+ intmax_t __seen_print = (intmax_t)__seen; \ -+ __TH_LOG("Expected %s (%jd) %s %s (%jd)", \ - _expected_str, __exp_print, #_t, \ - _seen_str, __seen_print); \ - break; \ -diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c -index 720bafa0f87be2..c239838c796a47 100644 ---- a/tools/testing/selftests/landlock/fs_test.c -+++ b/tools/testing/selftests/landlock/fs_test.c -@@ -1861,8 +1861,7 @@ static void test_execute(struct __test_metadata *const _metadata, const int err, - ASSERT_EQ(1, WIFEXITED(status)); - ASSERT_EQ(err ? 2 : 0, WEXITSTATUS(status)) - { -- TH_LOG("Unexpected return code for \"%s\": %s", path, -- strerror(errno)); -+ TH_LOG("Unexpected return code for \"%s\"", path); - }; - } - -diff --git a/tools/testing/selftests/powerpc/benchmarks/gettimeofday.c b/tools/testing/selftests/powerpc/benchmarks/gettimeofday.c -index 580fcac0a09f31..b71ef8a493ed1a 100644 ---- a/tools/testing/selftests/powerpc/benchmarks/gettimeofday.c -+++ b/tools/testing/selftests/powerpc/benchmarks/gettimeofday.c -@@ -20,7 +20,7 @@ static int test_gettimeofday(void) - gettimeofday(&tv_end, NULL); - } - -- timersub(&tv_start, &tv_end, &tv_diff); -+ timersub(&tv_end, &tv_start, &tv_diff); - - printf("time = %.6f\n", tv_diff.tv_sec + (tv_diff.tv_usec) * 1e-6); - -diff --git a/tools/testing/selftests/rseq/rseq.c b/tools/testing/selftests/rseq/rseq.c -index 5b9772cdf2651b..f6156790c3b4df 100644 ---- a/tools/testing/selftests/rseq/rseq.c -+++ b/tools/testing/selftests/rseq/rseq.c -@@ -61,7 +61,6 @@ unsigned int rseq_size = -1U; - unsigned int rseq_flags; - - static int rseq_ownership; --static int rseq_reg_success; /* At least one rseq registration has succeded. */ - - /* Allocate a large area for the TLS. */ - #define RSEQ_THREAD_AREA_ALLOC_SIZE 1024 -@@ -152,14 +151,27 @@ int rseq_register_current_thread(void) - } - rc = sys_rseq(&__rseq_abi, get_rseq_min_alloc_size(), 0, RSEQ_SIG); - if (rc) { -- if (RSEQ_READ_ONCE(rseq_reg_success)) { -+ /* -+ * After at least one thread has registered successfully -+ * (rseq_size > 0), the registration of other threads should -+ * never fail. -+ */ -+ if (RSEQ_READ_ONCE(rseq_size) > 0) { - /* Incoherent success/failure within process. */ - abort(); - } - return -1; - } - assert(rseq_current_cpu_raw() >= 0); -- RSEQ_WRITE_ONCE(rseq_reg_success, 1); -+ -+ /* -+ * The first thread to register sets the rseq_size to mimic the libc -+ * behavior. -+ */ -+ if (RSEQ_READ_ONCE(rseq_size) == 0) { -+ RSEQ_WRITE_ONCE(rseq_size, get_rseq_kernel_feature_size()); -+ } -+ - return 0; - } - -@@ -235,12 +247,18 @@ void rseq_init(void) - return; - } - rseq_ownership = 1; -- if (!rseq_available()) { -- rseq_size = 0; -- return; -- } -+ -+ /* Calculate the offset of the rseq area from the thread pointer. */ - rseq_offset = (void *)&__rseq_abi - rseq_thread_pointer(); -+ -+ /* rseq flags are deprecated, always set to 0. */ - rseq_flags = 0; -+ -+ /* -+ * Set the size to 0 until at least one thread registers to mimic the -+ * libc behavior. -+ */ -+ rseq_size = 0; - } - - static __attribute__((destructor)) -diff --git a/tools/testing/selftests/rseq/rseq.h b/tools/testing/selftests/rseq/rseq.h -index 4e217b620e0c7a..062d10925a1011 100644 ---- a/tools/testing/selftests/rseq/rseq.h -+++ b/tools/testing/selftests/rseq/rseq.h -@@ -60,7 +60,14 @@ - extern ptrdiff_t rseq_offset; - - /* -- * Size of the registered rseq area. 0 if the registration was -+ * The rseq ABI is composed of extensible feature fields. The extensions -+ * are done by appending additional fields at the end of the structure. -+ * The rseq_size defines the size of the active feature set which can be -+ * used by the application for the current rseq registration. Features -+ * starting at offset >= rseq_size are inactive and should not be used. -+ * -+ * The rseq_size is the intersection between the available allocation -+ * size for the rseq area and the feature size supported by the kernel. - * unsuccessful. - */ - extern unsigned int rseq_size; -diff --git a/tools/testing/selftests/timers/clocksource-switch.c b/tools/testing/selftests/timers/clocksource-switch.c -index c5264594064c85..83faa4e354e389 100644 ---- a/tools/testing/selftests/timers/clocksource-switch.c -+++ b/tools/testing/selftests/timers/clocksource-switch.c -@@ -156,8 +156,8 @@ int main(int argc, char **argv) - /* Check everything is sane before we start switching asynchronously */ - if (do_sanity_check) { - for (i = 0; i < count; i++) { -- printf("Validating clocksource %s\n", -- clocksource_list[i]); -+ ksft_print_msg("Validating clocksource %s\n", -+ clocksource_list[i]); - if (change_clocksource(clocksource_list[i])) { - status = -1; - goto out; -@@ -169,7 +169,7 @@ int main(int argc, char **argv) - } - } - -- printf("Running Asynchronous Switching Tests...\n"); -+ ksft_print_msg("Running Asynchronous Switching Tests...\n"); - pid = fork(); - if (!pid) - return run_tests(runtime); diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.076-077.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.076-077.patch deleted file mode 100644 index e387e02b31..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.076-077.patch +++ /dev/null @@ -1,251 +0,0 @@ -diff --git a/Makefile b/Makefile -index d679a3dd5a582b..1391d545aee9b0 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 76 -+SUBLEVEL = 77 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c -index 9cddd78b11d416..ff201753fd1814 100644 ---- a/fs/hostfs/hostfs_kern.c -+++ b/fs/hostfs/hostfs_kern.c -@@ -16,17 +16,11 @@ - #include - #include - #include --#include --#include - #include - #include "hostfs.h" - #include - #include - --struct hostfs_fs_info { -- char *host_root_path; --}; -- - struct hostfs_inode_info { - int fd; - fmode_t mode; -@@ -94,17 +88,30 @@ __uml_setup("hostfs=", hostfs_args, - static char *__dentry_name(struct dentry *dentry, char *name) - { - char *p = dentry_path_raw(dentry, name, PATH_MAX); -- struct hostfs_fs_info *fsi = dentry->d_sb->s_fs_info; -- char *root = fsi->host_root_path; -- size_t len = strlen(root); -+ char *root; -+ size_t len; -+ -+ root = dentry->d_sb->s_fs_info; -+ len = strlen(root); -+ if (IS_ERR(p)) { -+ __putname(name); -+ return NULL; -+ } - -- if (IS_ERR(p) || len > p - name) { -+ /* -+ * This function relies on the fact that dentry_path_raw() will place -+ * the path name at the end of the provided buffer. -+ */ -+ BUG_ON(p + strlen(p) + 1 != name + PATH_MAX); -+ -+ strscpy(name, root, PATH_MAX); -+ if (len > p - name) { - __putname(name); - return NULL; - } - -- memcpy(name, root, len); -- memmove(name + len, p, name + PATH_MAX - p); -+ if (p > name + len) -+ strcpy(name + len, p); - - return name; - } -@@ -189,10 +196,8 @@ static int hostfs_statfs(struct dentry *dentry, struct kstatfs *sf) - long long f_bavail; - long long f_files; - long long f_ffree; -- struct hostfs_fs_info *fsi; - -- fsi = dentry->d_sb->s_fs_info; -- err = do_statfs(fsi->host_root_path, -+ err = do_statfs(dentry->d_sb->s_fs_info, - &sf->f_bsize, &f_blocks, &f_bfree, &f_bavail, &f_files, - &f_ffree, &sf->f_fsid, sizeof(sf->f_fsid), - &sf->f_namelen); -@@ -240,11 +245,7 @@ static void hostfs_free_inode(struct inode *inode) - - static int hostfs_show_options(struct seq_file *seq, struct dentry *root) - { -- struct hostfs_fs_info *fsi; -- const char *root_path; -- -- fsi = root->d_sb->s_fs_info; -- root_path = fsi->host_root_path; -+ const char *root_path = root->d_sb->s_fs_info; - size_t offset = strlen(root_ino) + 1; - - if (strlen(root_path) > offset) -@@ -923,10 +924,10 @@ static const struct inode_operations hostfs_link_iops = { - .get_link = hostfs_get_link, - }; - --static int hostfs_fill_super(struct super_block *sb, struct fs_context *fc) -+static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent) - { -- struct hostfs_fs_info *fsi = sb->s_fs_info; - struct inode *root_inode; -+ char *host_root_path, *req_root = d; - int err; - - sb->s_blocksize = 1024; -@@ -939,7 +940,16 @@ static int hostfs_fill_super(struct super_block *sb, struct fs_context *fc) - if (err) - return err; - -- root_inode = hostfs_iget(sb, fsi->host_root_path); -+ /* NULL is printed as '(null)' by printf(): avoid that. */ -+ if (req_root == NULL) -+ req_root = ""; -+ -+ sb->s_fs_info = host_root_path = -+ kasprintf(GFP_KERNEL, "%s/%s", root_ino, req_root); -+ if (host_root_path == NULL) -+ return -ENOMEM; -+ -+ root_inode = hostfs_iget(sb, host_root_path); - if (IS_ERR(root_inode)) - return PTR_ERR(root_inode); - -@@ -947,7 +957,7 @@ static int hostfs_fill_super(struct super_block *sb, struct fs_context *fc) - char *name; - - iput(root_inode); -- name = follow_link(fsi->host_root_path); -+ name = follow_link(host_root_path); - if (IS_ERR(name)) - return PTR_ERR(name); - -@@ -964,92 +974,11 @@ static int hostfs_fill_super(struct super_block *sb, struct fs_context *fc) - return 0; - } - --enum hostfs_parma { -- Opt_hostfs, --}; -- --static const struct fs_parameter_spec hostfs_param_specs[] = { -- fsparam_string_empty("hostfs", Opt_hostfs), -- {} --}; -- --static int hostfs_parse_param(struct fs_context *fc, struct fs_parameter *param) --{ -- struct hostfs_fs_info *fsi = fc->s_fs_info; -- struct fs_parse_result result; -- char *host_root; -- int opt; -- -- opt = fs_parse(fc, hostfs_param_specs, param, &result); -- if (opt < 0) -- return opt; -- -- switch (opt) { -- case Opt_hostfs: -- host_root = param->string; -- if (!*host_root) -- host_root = ""; -- fsi->host_root_path = -- kasprintf(GFP_KERNEL, "%s/%s", root_ino, host_root); -- if (fsi->host_root_path == NULL) -- return -ENOMEM; -- break; -- } -- -- return 0; --} -- --static int hostfs_parse_monolithic(struct fs_context *fc, void *data) --{ -- struct hostfs_fs_info *fsi = fc->s_fs_info; -- char *host_root = (char *)data; -- -- /* NULL is printed as '(null)' by printf(): avoid that. */ -- if (host_root == NULL) -- host_root = ""; -- -- fsi->host_root_path = -- kasprintf(GFP_KERNEL, "%s/%s", root_ino, host_root); -- if (fsi->host_root_path == NULL) -- return -ENOMEM; -- -- return 0; --} -- --static int hostfs_fc_get_tree(struct fs_context *fc) --{ -- return get_tree_nodev(fc, hostfs_fill_super); --} -- --static void hostfs_fc_free(struct fs_context *fc) --{ -- struct hostfs_fs_info *fsi = fc->s_fs_info; -- -- if (!fsi) -- return; -- -- kfree(fsi->host_root_path); -- kfree(fsi); --} -- --static const struct fs_context_operations hostfs_context_ops = { -- .parse_monolithic = hostfs_parse_monolithic, -- .parse_param = hostfs_parse_param, -- .get_tree = hostfs_fc_get_tree, -- .free = hostfs_fc_free, --}; -- --static int hostfs_init_fs_context(struct fs_context *fc) -+static struct dentry *hostfs_read_sb(struct file_system_type *type, -+ int flags, const char *dev_name, -+ void *data) - { -- struct hostfs_fs_info *fsi; -- -- fsi = kzalloc(sizeof(*fsi), GFP_KERNEL); -- if (!fsi) -- return -ENOMEM; -- -- fc->s_fs_info = fsi; -- fc->ops = &hostfs_context_ops; -- return 0; -+ return mount_nodev(type, flags, data, hostfs_fill_sb_common); - } - - static void hostfs_kill_sb(struct super_block *s) -@@ -1059,11 +988,11 @@ static void hostfs_kill_sb(struct super_block *s) - } - - static struct file_system_type hostfs_type = { -- .owner = THIS_MODULE, -- .name = "hostfs", -- .init_fs_context = hostfs_init_fs_context, -- .kill_sb = hostfs_kill_sb, -- .fs_flags = 0, -+ .owner = THIS_MODULE, -+ .name = "hostfs", -+ .mount = hostfs_read_sb, -+ .kill_sb = hostfs_kill_sb, -+ .fs_flags = 0, - }; - MODULE_ALIAS_FS("hostfs"); - diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.077-078.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.077-078.patch deleted file mode 100644 index 812e381c8b..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.077-078.patch +++ /dev/null @@ -1,9040 +0,0 @@ -diff --git a/Makefile b/Makefile -index 1391d545aee9b0..1d777c3eb7fb97 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 77 -+SUBLEVEL = 78 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm/boot/dts/ti/omap/dra7-l4.dtsi b/arch/arm/boot/dts/ti/omap/dra7-l4.dtsi -index 5733e3a4ea8e71..3fdb79b0e8bfe7 100644 ---- a/arch/arm/boot/dts/ti/omap/dra7-l4.dtsi -+++ b/arch/arm/boot/dts/ti/omap/dra7-l4.dtsi -@@ -12,6 +12,7 @@ &l4_cfg { /* 0x4a000000 */ - ranges = <0x00000000 0x4a000000 0x100000>, /* segment 0 */ - <0x00100000 0x4a100000 0x100000>, /* segment 1 */ - <0x00200000 0x4a200000 0x100000>; /* segment 2 */ -+ dma-ranges; - - segment@0 { /* 0x4a000000 */ - compatible = "simple-pm-bus"; -@@ -557,6 +558,7 @@ segment@100000 { /* 0x4a100000 */ - <0x0007e000 0x0017e000 0x001000>, /* ap 124 */ - <0x00059000 0x00159000 0x001000>, /* ap 125 */ - <0x0005a000 0x0015a000 0x001000>; /* ap 126 */ -+ dma-ranges; - - target-module@2000 { /* 0x4a102000, ap 27 3c.0 */ - compatible = "ti,sysc"; -diff --git a/arch/arm/boot/dts/ti/omap/omap3-gta04.dtsi b/arch/arm/boot/dts/ti/omap/omap3-gta04.dtsi -index b6b27e93857f56..bf770c7026d79b 100644 ---- a/arch/arm/boot/dts/ti/omap/omap3-gta04.dtsi -+++ b/arch/arm/boot/dts/ti/omap/omap3-gta04.dtsi -@@ -446,6 +446,7 @@ &omap3_pmx_core2 { - pinctrl-names = "default"; - pinctrl-0 = < - &hsusb2_2_pins -+ &mcspi3hog_pins - >; - - hsusb2_2_pins: hsusb2-2-pins { -@@ -459,6 +460,15 @@ OMAP3630_CORE2_IOPAD(0x25fa, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d15.hsusb2_d - >; - }; - -+ mcspi3hog_pins: mcspi3hog-pins { -+ pinctrl-single,pins = < -+ OMAP3630_CORE2_IOPAD(0x25dc, PIN_OUTPUT_PULLDOWN | MUX_MODE4) /* etk_d0 */ -+ OMAP3630_CORE2_IOPAD(0x25de, PIN_OUTPUT_PULLDOWN | MUX_MODE4) /* etk_d1 */ -+ OMAP3630_CORE2_IOPAD(0x25e0, PIN_OUTPUT_PULLDOWN | MUX_MODE4) /* etk_d2 */ -+ OMAP3630_CORE2_IOPAD(0x25e2, PIN_OUTPUT_PULLDOWN | MUX_MODE4) /* etk_d3 */ -+ >; -+ }; -+ - spi_gpio_pins: spi-gpio-pinmux-pins { - pinctrl-single,pins = < - OMAP3630_CORE2_IOPAD(0x25d8, PIN_OUTPUT | MUX_MODE4) /* clk */ -diff --git a/arch/arm64/boot/dts/nvidia/tegra234.dtsi b/arch/arm64/boot/dts/nvidia/tegra234.dtsi -index be30072fb7471f..bcc36055ef97e6 100644 ---- a/arch/arm64/boot/dts/nvidia/tegra234.dtsi -+++ b/arch/arm64/boot/dts/nvidia/tegra234.dtsi -@@ -1709,7 +1709,7 @@ sce-fabric@b600000 { - compatible = "nvidia,tegra234-sce-fabric"; - reg = <0x0 0xb600000 0x0 0x40000>; - interrupts = ; -- status = "okay"; -+ status = "disabled"; - }; - - rce-fabric@be00000 { -@@ -1889,7 +1889,7 @@ bpmp-fabric@d600000 { - }; - - dce-fabric@de00000 { -- compatible = "nvidia,tegra234-sce-fabric"; -+ compatible = "nvidia,tegra234-dce-fabric"; - reg = <0x0 0xde00000 0x0 0x40000>; - interrupts = ; - status = "okay"; -@@ -1912,6 +1912,8 @@ gic: interrupt-controller@f400000 { - #redistributor-regions = <1>; - #interrupt-cells = <3>; - interrupt-controller; -+ -+ #address-cells = <0>; - }; - - smmu_iso: iommu@10000000 { -diff --git a/arch/arm64/boot/dts/qcom/sm6115.dtsi b/arch/arm64/boot/dts/qcom/sm6115.dtsi -index 821db9b8518557..5c6fcf725473c1 100644 ---- a/arch/arm64/boot/dts/qcom/sm6115.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm6115.dtsi -@@ -1667,7 +1667,7 @@ dispcc: clock-controller@5f00000 { - - remoteproc_mpss: remoteproc@6080000 { - compatible = "qcom,sm6115-mpss-pas"; -- reg = <0x0 0x06080000 0x0 0x100>; -+ reg = <0x0 0x06080000 0x0 0x10000>; - - interrupts-extended = <&intc GIC_SPI 307 IRQ_TYPE_EDGE_RISING>, - <&modem_smp2p_in 0 IRQ_TYPE_EDGE_RISING>, -@@ -2310,9 +2310,9 @@ funnel_apss1_in: endpoint { - }; - }; - -- remoteproc_adsp: remoteproc@ab00000 { -+ remoteproc_adsp: remoteproc@a400000 { - compatible = "qcom,sm6115-adsp-pas"; -- reg = <0x0 0x0ab00000 0x0 0x100>; -+ reg = <0x0 0x0a400000 0x0 0x4040>; - - interrupts-extended = <&intc GIC_SPI 282 IRQ_TYPE_EDGE_RISING>, - <&adsp_smp2p_in 0 IRQ_TYPE_EDGE_RISING>, -@@ -2384,7 +2384,7 @@ compute-cb@7 { - - remoteproc_cdsp: remoteproc@b300000 { - compatible = "qcom,sm6115-cdsp-pas"; -- reg = <0x0 0x0b300000 0x0 0x100000>; -+ reg = <0x0 0x0b300000 0x0 0x4040>; - - interrupts-extended = <&intc GIC_SPI 265 IRQ_TYPE_EDGE_RISING>, - <&cdsp_smp2p_in 0 IRQ_TYPE_EDGE_RISING>, -diff --git a/arch/arm64/boot/dts/qcom/sm6350.dtsi b/arch/arm64/boot/dts/qcom/sm6350.dtsi -index f271b69485c5ce..f9739841406901 100644 ---- a/arch/arm64/boot/dts/qcom/sm6350.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm6350.dtsi -@@ -935,7 +935,7 @@ uart1: serial@884000 { - power-domains = <&rpmhpd SM6350_CX>; - operating-points-v2 = <&qup_opp_table>; - interconnects = <&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>, -- <&aggre1_noc MASTER_QUP_0 0 &clk_virt SLAVE_EBI_CH0 0>; -+ <&gem_noc MASTER_AMPSS_M0 0 &config_noc SLAVE_QUP_0 0>; - interconnect-names = "qup-core", "qup-config"; - status = "disabled"; - }; -@@ -1259,7 +1259,7 @@ tcsr_mutex: hwlock@1f40000 { - - adsp: remoteproc@3000000 { - compatible = "qcom,sm6350-adsp-pas"; -- reg = <0 0x03000000 0 0x100>; -+ reg = <0x0 0x03000000 0x0 0x10000>; - - interrupts-extended = <&pdc 6 IRQ_TYPE_LEVEL_HIGH>, - <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>, -@@ -1480,7 +1480,7 @@ gpucc: clock-controller@3d90000 { - - mpss: remoteproc@4080000 { - compatible = "qcom,sm6350-mpss-pas"; -- reg = <0x0 0x04080000 0x0 0x4040>; -+ reg = <0x0 0x04080000 0x0 0x10000>; - - interrupts-extended = <&intc GIC_SPI 136 IRQ_TYPE_EDGE_RISING>, - <&modem_smp2p_in 0 IRQ_TYPE_EDGE_RISING>, -diff --git a/arch/arm64/boot/dts/qcom/sm6375.dtsi b/arch/arm64/boot/dts/qcom/sm6375.dtsi -index c5f7715626a09b..3903df8336e35d 100644 ---- a/arch/arm64/boot/dts/qcom/sm6375.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm6375.dtsi -@@ -1471,9 +1471,9 @@ gpucc: clock-controller@5990000 { - #power-domain-cells = <1>; - }; - -- remoteproc_mss: remoteproc@6000000 { -+ remoteproc_mss: remoteproc@6080000 { - compatible = "qcom,sm6375-mpss-pas"; -- reg = <0 0x06000000 0 0x4040>; -+ reg = <0x0 0x06080000 0x0 0x10000>; - - interrupts-extended = <&intc GIC_SPI 307 IRQ_TYPE_EDGE_RISING>, - <&smp2p_modem_in 0 IRQ_TYPE_EDGE_RISING>, -@@ -1514,7 +1514,7 @@ IPCC_MPROC_SIGNAL_GLINK_QMP - - remoteproc_adsp: remoteproc@a400000 { - compatible = "qcom,sm6375-adsp-pas"; -- reg = <0 0x0a400000 0 0x100>; -+ reg = <0 0x0a400000 0 0x10000>; - - interrupts-extended = <&intc GIC_SPI 282 IRQ_TYPE_LEVEL_HIGH>, - <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>, -@@ -1550,9 +1550,9 @@ IPCC_MPROC_SIGNAL_GLINK_QMP - }; - }; - -- remoteproc_cdsp: remoteproc@b000000 { -+ remoteproc_cdsp: remoteproc@b300000 { - compatible = "qcom,sm6375-cdsp-pas"; -- reg = <0x0 0x0b000000 0x0 0x100000>; -+ reg = <0x0 0x0b300000 0x0 0x10000>; - - interrupts-extended = <&intc GIC_SPI 265 IRQ_TYPE_EDGE_RISING>, - <&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>, -diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi -index dded95fa52f075..2a4d950ac02bfe 100644 ---- a/arch/arm64/boot/dts/qcom/sm8350.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi -@@ -1819,6 +1819,142 @@ tcsr_mutex: hwlock@1f40000 { - #hwlock-cells = <1>; - }; - -+ adsp: remoteproc@3000000 { -+ compatible = "qcom,sm8350-adsp-pas"; -+ reg = <0x0 0x03000000 0x0 0x10000>; -+ -+ interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>, -+ <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>, -+ <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>, -+ <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>, -+ <&smp2p_adsp_in 3 IRQ_TYPE_EDGE_RISING>; -+ interrupt-names = "wdog", "fatal", "ready", -+ "handover", "stop-ack"; -+ -+ clocks = <&rpmhcc RPMH_CXO_CLK>; -+ clock-names = "xo"; -+ -+ power-domains = <&rpmhpd RPMHPD_LCX>, -+ <&rpmhpd RPMHPD_LMX>; -+ power-domain-names = "lcx", "lmx"; -+ -+ memory-region = <&pil_adsp_mem>; -+ -+ qcom,qmp = <&aoss_qmp>; -+ -+ qcom,smem-states = <&smp2p_adsp_out 0>; -+ qcom,smem-state-names = "stop"; -+ -+ status = "disabled"; -+ -+ glink-edge { -+ interrupts-extended = <&ipcc IPCC_CLIENT_LPASS -+ IPCC_MPROC_SIGNAL_GLINK_QMP -+ IRQ_TYPE_EDGE_RISING>; -+ mboxes = <&ipcc IPCC_CLIENT_LPASS -+ IPCC_MPROC_SIGNAL_GLINK_QMP>; -+ -+ label = "lpass"; -+ qcom,remote-pid = <2>; -+ -+ apr { -+ compatible = "qcom,apr-v2"; -+ qcom,glink-channels = "apr_audio_svc"; -+ qcom,domain = ; -+ #address-cells = <1>; -+ #size-cells = <0>; -+ -+ service@3 { -+ reg = ; -+ compatible = "qcom,q6core"; -+ qcom,protection-domain = "avs/audio", "msm/adsp/audio_pd"; -+ }; -+ -+ q6afe: service@4 { -+ compatible = "qcom,q6afe"; -+ reg = ; -+ qcom,protection-domain = "avs/audio", "msm/adsp/audio_pd"; -+ -+ q6afedai: dais { -+ compatible = "qcom,q6afe-dais"; -+ #address-cells = <1>; -+ #size-cells = <0>; -+ #sound-dai-cells = <1>; -+ }; -+ -+ q6afecc: clock-controller { -+ compatible = "qcom,q6afe-clocks"; -+ #clock-cells = <2>; -+ }; -+ }; -+ -+ q6asm: service@7 { -+ compatible = "qcom,q6asm"; -+ reg = ; -+ qcom,protection-domain = "avs/audio", "msm/adsp/audio_pd"; -+ -+ q6asmdai: dais { -+ compatible = "qcom,q6asm-dais"; -+ #address-cells = <1>; -+ #size-cells = <0>; -+ #sound-dai-cells = <1>; -+ iommus = <&apps_smmu 0x1801 0x0>; -+ -+ dai@0 { -+ reg = <0>; -+ }; -+ -+ dai@1 { -+ reg = <1>; -+ }; -+ -+ dai@2 { -+ reg = <2>; -+ }; -+ }; -+ }; -+ -+ q6adm: service@8 { -+ compatible = "qcom,q6adm"; -+ reg = ; -+ qcom,protection-domain = "avs/audio", "msm/adsp/audio_pd"; -+ -+ q6routing: routing { -+ compatible = "qcom,q6adm-routing"; -+ #sound-dai-cells = <0>; -+ }; -+ }; -+ }; -+ -+ fastrpc { -+ compatible = "qcom,fastrpc"; -+ qcom,glink-channels = "fastrpcglink-apps-dsp"; -+ label = "adsp"; -+ qcom,non-secure-domain; -+ #address-cells = <1>; -+ #size-cells = <0>; -+ -+ compute-cb@3 { -+ compatible = "qcom,fastrpc-compute-cb"; -+ reg = <3>; -+ iommus = <&apps_smmu 0x1803 0x0>; -+ }; -+ -+ compute-cb@4 { -+ compatible = "qcom,fastrpc-compute-cb"; -+ reg = <4>; -+ iommus = <&apps_smmu 0x1804 0x0>; -+ }; -+ -+ compute-cb@5 { -+ compatible = "qcom,fastrpc-compute-cb"; -+ reg = <5>; -+ iommus = <&apps_smmu 0x1805 0x0>; -+ }; -+ }; -+ }; -+ }; -+ - lpass_tlmm: pinctrl@33c0000 { - compatible = "qcom,sm8350-lpass-lpi-pinctrl"; - reg = <0 0x033c0000 0 0x20000>, -@@ -2020,7 +2156,7 @@ lpass_ag_noc: interconnect@3c40000 { - - mpss: remoteproc@4080000 { - compatible = "qcom,sm8350-mpss-pas"; -- reg = <0x0 0x04080000 0x0 0x4040>; -+ reg = <0x0 0x04080000 0x0 0x10000>; - - interrupts-extended = <&intc GIC_SPI 264 IRQ_TYPE_EDGE_RISING>, - <&smp2p_modem_in 0 IRQ_TYPE_EDGE_RISING>, -@@ -2299,6 +2435,115 @@ compute_noc: interconnect@a0c0000 { - qcom,bcm-voters = <&apps_bcm_voter>; - }; - -+ cdsp: remoteproc@a300000 { -+ compatible = "qcom,sm8350-cdsp-pas"; -+ reg = <0x0 0x0a300000 0x0 0x10000>; -+ -+ interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>, -+ <&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>, -+ <&smp2p_cdsp_in 1 IRQ_TYPE_EDGE_RISING>, -+ <&smp2p_cdsp_in 2 IRQ_TYPE_EDGE_RISING>, -+ <&smp2p_cdsp_in 3 IRQ_TYPE_EDGE_RISING>; -+ interrupt-names = "wdog", "fatal", "ready", -+ "handover", "stop-ack"; -+ -+ clocks = <&rpmhcc RPMH_CXO_CLK>; -+ clock-names = "xo"; -+ -+ power-domains = <&rpmhpd RPMHPD_CX>, -+ <&rpmhpd RPMHPD_MXC>; -+ power-domain-names = "cx", "mxc"; -+ -+ interconnects = <&compute_noc MASTER_CDSP_PROC 0 &mc_virt SLAVE_EBI1 0>; -+ -+ memory-region = <&pil_cdsp_mem>; -+ -+ qcom,qmp = <&aoss_qmp>; -+ -+ qcom,smem-states = <&smp2p_cdsp_out 0>; -+ qcom,smem-state-names = "stop"; -+ -+ status = "disabled"; -+ -+ glink-edge { -+ interrupts-extended = <&ipcc IPCC_CLIENT_CDSP -+ IPCC_MPROC_SIGNAL_GLINK_QMP -+ IRQ_TYPE_EDGE_RISING>; -+ mboxes = <&ipcc IPCC_CLIENT_CDSP -+ IPCC_MPROC_SIGNAL_GLINK_QMP>; -+ -+ label = "cdsp"; -+ qcom,remote-pid = <5>; -+ -+ fastrpc { -+ compatible = "qcom,fastrpc"; -+ qcom,glink-channels = "fastrpcglink-apps-dsp"; -+ label = "cdsp"; -+ qcom,non-secure-domain; -+ #address-cells = <1>; -+ #size-cells = <0>; -+ -+ compute-cb@1 { -+ compatible = "qcom,fastrpc-compute-cb"; -+ reg = <1>; -+ iommus = <&apps_smmu 0x2161 0x0400>, -+ <&apps_smmu 0x1181 0x0420>; -+ }; -+ -+ compute-cb@2 { -+ compatible = "qcom,fastrpc-compute-cb"; -+ reg = <2>; -+ iommus = <&apps_smmu 0x2162 0x0400>, -+ <&apps_smmu 0x1182 0x0420>; -+ }; -+ -+ compute-cb@3 { -+ compatible = "qcom,fastrpc-compute-cb"; -+ reg = <3>; -+ iommus = <&apps_smmu 0x2163 0x0400>, -+ <&apps_smmu 0x1183 0x0420>; -+ }; -+ -+ compute-cb@4 { -+ compatible = "qcom,fastrpc-compute-cb"; -+ reg = <4>; -+ iommus = <&apps_smmu 0x2164 0x0400>, -+ <&apps_smmu 0x1184 0x0420>; -+ }; -+ -+ compute-cb@5 { -+ compatible = "qcom,fastrpc-compute-cb"; -+ reg = <5>; -+ iommus = <&apps_smmu 0x2165 0x0400>, -+ <&apps_smmu 0x1185 0x0420>; -+ }; -+ -+ compute-cb@6 { -+ compatible = "qcom,fastrpc-compute-cb"; -+ reg = <6>; -+ iommus = <&apps_smmu 0x2166 0x0400>, -+ <&apps_smmu 0x1186 0x0420>; -+ }; -+ -+ compute-cb@7 { -+ compatible = "qcom,fastrpc-compute-cb"; -+ reg = <7>; -+ iommus = <&apps_smmu 0x2167 0x0400>, -+ <&apps_smmu 0x1187 0x0420>; -+ }; -+ -+ compute-cb@8 { -+ compatible = "qcom,fastrpc-compute-cb"; -+ reg = <8>; -+ iommus = <&apps_smmu 0x2168 0x0400>, -+ <&apps_smmu 0x1188 0x0420>; -+ }; -+ -+ /* note: secure cb9 in downstream */ -+ }; -+ }; -+ }; -+ - usb_1: usb@a6f8800 { - compatible = "qcom,sm8350-dwc3", "qcom,dwc3"; - reg = <0 0x0a6f8800 0 0x400>; -@@ -3204,142 +3449,6 @@ apps_smmu: iommu@15000000 { - ; - }; - -- adsp: remoteproc@17300000 { -- compatible = "qcom,sm8350-adsp-pas"; -- reg = <0 0x17300000 0 0x100>; -- -- interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>, -- <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>, -- <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>, -- <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>, -- <&smp2p_adsp_in 3 IRQ_TYPE_EDGE_RISING>; -- interrupt-names = "wdog", "fatal", "ready", -- "handover", "stop-ack"; -- -- clocks = <&rpmhcc RPMH_CXO_CLK>; -- clock-names = "xo"; -- -- power-domains = <&rpmhpd RPMHPD_LCX>, -- <&rpmhpd RPMHPD_LMX>; -- power-domain-names = "lcx", "lmx"; -- -- memory-region = <&pil_adsp_mem>; -- -- qcom,qmp = <&aoss_qmp>; -- -- qcom,smem-states = <&smp2p_adsp_out 0>; -- qcom,smem-state-names = "stop"; -- -- status = "disabled"; -- -- glink-edge { -- interrupts-extended = <&ipcc IPCC_CLIENT_LPASS -- IPCC_MPROC_SIGNAL_GLINK_QMP -- IRQ_TYPE_EDGE_RISING>; -- mboxes = <&ipcc IPCC_CLIENT_LPASS -- IPCC_MPROC_SIGNAL_GLINK_QMP>; -- -- label = "lpass"; -- qcom,remote-pid = <2>; -- -- apr { -- compatible = "qcom,apr-v2"; -- qcom,glink-channels = "apr_audio_svc"; -- qcom,domain = ; -- #address-cells = <1>; -- #size-cells = <0>; -- -- service@3 { -- reg = ; -- compatible = "qcom,q6core"; -- qcom,protection-domain = "avs/audio", "msm/adsp/audio_pd"; -- }; -- -- q6afe: service@4 { -- compatible = "qcom,q6afe"; -- reg = ; -- qcom,protection-domain = "avs/audio", "msm/adsp/audio_pd"; -- -- q6afedai: dais { -- compatible = "qcom,q6afe-dais"; -- #address-cells = <1>; -- #size-cells = <0>; -- #sound-dai-cells = <1>; -- }; -- -- q6afecc: clock-controller { -- compatible = "qcom,q6afe-clocks"; -- #clock-cells = <2>; -- }; -- }; -- -- q6asm: service@7 { -- compatible = "qcom,q6asm"; -- reg = ; -- qcom,protection-domain = "avs/audio", "msm/adsp/audio_pd"; -- -- q6asmdai: dais { -- compatible = "qcom,q6asm-dais"; -- #address-cells = <1>; -- #size-cells = <0>; -- #sound-dai-cells = <1>; -- iommus = <&apps_smmu 0x1801 0x0>; -- -- dai@0 { -- reg = <0>; -- }; -- -- dai@1 { -- reg = <1>; -- }; -- -- dai@2 { -- reg = <2>; -- }; -- }; -- }; -- -- q6adm: service@8 { -- compatible = "qcom,q6adm"; -- reg = ; -- qcom,protection-domain = "avs/audio", "msm/adsp/audio_pd"; -- -- q6routing: routing { -- compatible = "qcom,q6adm-routing"; -- #sound-dai-cells = <0>; -- }; -- }; -- }; -- -- fastrpc { -- compatible = "qcom,fastrpc"; -- qcom,glink-channels = "fastrpcglink-apps-dsp"; -- label = "adsp"; -- qcom,non-secure-domain; -- #address-cells = <1>; -- #size-cells = <0>; -- -- compute-cb@3 { -- compatible = "qcom,fastrpc-compute-cb"; -- reg = <3>; -- iommus = <&apps_smmu 0x1803 0x0>; -- }; -- -- compute-cb@4 { -- compatible = "qcom,fastrpc-compute-cb"; -- reg = <4>; -- iommus = <&apps_smmu 0x1804 0x0>; -- }; -- -- compute-cb@5 { -- compatible = "qcom,fastrpc-compute-cb"; -- reg = <5>; -- iommus = <&apps_smmu 0x1805 0x0>; -- }; -- }; -- }; -- }; -- - intc: interrupt-controller@17a00000 { - compatible = "arm,gic-v3"; - #interrupt-cells = <3>; -@@ -3508,115 +3617,6 @@ cpufreq_hw: cpufreq@18591000 { - #freq-domain-cells = <1>; - #clock-cells = <1>; - }; -- -- cdsp: remoteproc@98900000 { -- compatible = "qcom,sm8350-cdsp-pas"; -- reg = <0 0x98900000 0 0x1400000>; -- -- interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>, -- <&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>, -- <&smp2p_cdsp_in 1 IRQ_TYPE_EDGE_RISING>, -- <&smp2p_cdsp_in 2 IRQ_TYPE_EDGE_RISING>, -- <&smp2p_cdsp_in 3 IRQ_TYPE_EDGE_RISING>; -- interrupt-names = "wdog", "fatal", "ready", -- "handover", "stop-ack"; -- -- clocks = <&rpmhcc RPMH_CXO_CLK>; -- clock-names = "xo"; -- -- power-domains = <&rpmhpd RPMHPD_CX>, -- <&rpmhpd RPMHPD_MXC>; -- power-domain-names = "cx", "mxc"; -- -- interconnects = <&compute_noc MASTER_CDSP_PROC 0 &mc_virt SLAVE_EBI1 0>; -- -- memory-region = <&pil_cdsp_mem>; -- -- qcom,qmp = <&aoss_qmp>; -- -- qcom,smem-states = <&smp2p_cdsp_out 0>; -- qcom,smem-state-names = "stop"; -- -- status = "disabled"; -- -- glink-edge { -- interrupts-extended = <&ipcc IPCC_CLIENT_CDSP -- IPCC_MPROC_SIGNAL_GLINK_QMP -- IRQ_TYPE_EDGE_RISING>; -- mboxes = <&ipcc IPCC_CLIENT_CDSP -- IPCC_MPROC_SIGNAL_GLINK_QMP>; -- -- label = "cdsp"; -- qcom,remote-pid = <5>; -- -- fastrpc { -- compatible = "qcom,fastrpc"; -- qcom,glink-channels = "fastrpcglink-apps-dsp"; -- label = "cdsp"; -- qcom,non-secure-domain; -- #address-cells = <1>; -- #size-cells = <0>; -- -- compute-cb@1 { -- compatible = "qcom,fastrpc-compute-cb"; -- reg = <1>; -- iommus = <&apps_smmu 0x2161 0x0400>, -- <&apps_smmu 0x1181 0x0420>; -- }; -- -- compute-cb@2 { -- compatible = "qcom,fastrpc-compute-cb"; -- reg = <2>; -- iommus = <&apps_smmu 0x2162 0x0400>, -- <&apps_smmu 0x1182 0x0420>; -- }; -- -- compute-cb@3 { -- compatible = "qcom,fastrpc-compute-cb"; -- reg = <3>; -- iommus = <&apps_smmu 0x2163 0x0400>, -- <&apps_smmu 0x1183 0x0420>; -- }; -- -- compute-cb@4 { -- compatible = "qcom,fastrpc-compute-cb"; -- reg = <4>; -- iommus = <&apps_smmu 0x2164 0x0400>, -- <&apps_smmu 0x1184 0x0420>; -- }; -- -- compute-cb@5 { -- compatible = "qcom,fastrpc-compute-cb"; -- reg = <5>; -- iommus = <&apps_smmu 0x2165 0x0400>, -- <&apps_smmu 0x1185 0x0420>; -- }; -- -- compute-cb@6 { -- compatible = "qcom,fastrpc-compute-cb"; -- reg = <6>; -- iommus = <&apps_smmu 0x2166 0x0400>, -- <&apps_smmu 0x1186 0x0420>; -- }; -- -- compute-cb@7 { -- compatible = "qcom,fastrpc-compute-cb"; -- reg = <7>; -- iommus = <&apps_smmu 0x2167 0x0400>, -- <&apps_smmu 0x1187 0x0420>; -- }; -- -- compute-cb@8 { -- compatible = "qcom,fastrpc-compute-cb"; -- reg = <8>; -- iommus = <&apps_smmu 0x2168 0x0400>, -- <&apps_smmu 0x1188 0x0420>; -- }; -- -- /* note: secure cb9 in downstream */ -- }; -- }; -- }; - }; - - thermal_zones: thermal-zones { -diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi -index 007689d7f4fa20..2a49a29713752b 100644 ---- a/arch/arm64/boot/dts/qcom/sm8450.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi -@@ -2475,7 +2475,7 @@ compute-cb@5 { - - remoteproc_cdsp: remoteproc@32300000 { - compatible = "qcom,sm8450-cdsp-pas"; -- reg = <0 0x32300000 0 0x1400000>; -+ reg = <0 0x32300000 0 0x10000>; - - interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>, - <&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>, -@@ -2581,7 +2581,7 @@ compute-cb@8 { - - remoteproc_mpss: remoteproc@4080000 { - compatible = "qcom,sm8450-mpss-pas"; -- reg = <0x0 0x04080000 0x0 0x4040>; -+ reg = <0x0 0x04080000 0x0 0x10000>; - - interrupts-extended = <&intc GIC_SPI 264 IRQ_TYPE_EDGE_RISING>, - <&smp2p_modem_in 0 IRQ_TYPE_EDGE_RISING>, -diff --git a/arch/arm64/boot/dts/qcom/sm8550.dtsi b/arch/arm64/boot/dts/qcom/sm8550.dtsi -index 90e6cd239f5699..f3a0e1fe333c4d 100644 ---- a/arch/arm64/boot/dts/qcom/sm8550.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm8550.dtsi -@@ -1986,7 +1986,7 @@ gpucc: clock-controller@3d90000 { - - remoteproc_mpss: remoteproc@4080000 { - compatible = "qcom,sm8550-mpss-pas"; -- reg = <0x0 0x04080000 0x0 0x4040>; -+ reg = <0x0 0x04080000 0x0 0x10000>; - - interrupts-extended = <&intc GIC_SPI 264 IRQ_TYPE_EDGE_RISING>, - <&smp2p_modem_in 0 IRQ_TYPE_EDGE_RISING>, -@@ -2448,9 +2448,8 @@ mdss: display-subsystem@ae00000 { - - power-domains = <&dispcc MDSS_GDSC>; - -- interconnects = <&mmss_noc MASTER_MDP 0 &gem_noc SLAVE_LLCC 0>, -- <&mc_virt MASTER_LLCC 0 &mc_virt SLAVE_EBI1 0>; -- interconnect-names = "mdp0-mem", "mdp1-mem"; -+ interconnects = <&mmss_noc MASTER_MDP 0 &mc_virt SLAVE_EBI1 0>; -+ interconnect-names = "mdp0-mem"; - - iommus = <&apps_smmu 0x1c00 0x2>; - -@@ -4089,7 +4088,7 @@ nsp_noc: interconnect@320c0000 { - - remoteproc_cdsp: remoteproc@32300000 { - compatible = "qcom,sm8550-cdsp-pas"; -- reg = <0x0 0x32300000 0x0 0x1400000>; -+ reg = <0x0 0x32300000 0x0 0x10000>; - - interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>, - <&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>, -diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi -index aba2748fe54c77..35a0fb73a96a5d 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi -+++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi -@@ -147,7 +147,7 @@ &gmac { - snps,reset-active-low; - snps,reset-delays-us = <0 10000 50000>; - tx_delay = <0x10>; -- rx_delay = <0x10>; -+ rx_delay = <0x23>; - status = "okay"; - }; - -diff --git a/arch/arm64/kvm/arch_timer.c b/arch/arm64/kvm/arch_timer.c -index d221829502f3e0..a795dad2b99ab1 100644 ---- a/arch/arm64/kvm/arch_timer.c -+++ b/arch/arm64/kvm/arch_timer.c -@@ -467,10 +467,8 @@ static void timer_emulate(struct arch_timer_context *ctx) - - trace_kvm_timer_emulate(ctx, should_fire); - -- if (should_fire != ctx->irq.level) { -+ if (should_fire != ctx->irq.level) - kvm_timer_update_irq(ctx->vcpu, should_fire, ctx); -- return; -- } - - /* - * If the timer can fire now, we don't need to have a soft timer -diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c -index 13fd592228b188..a5e1588780b2ce 100644 ---- a/arch/arm64/mm/hugetlbpage.c -+++ b/arch/arm64/mm/hugetlbpage.c -@@ -526,6 +526,18 @@ pte_t huge_ptep_clear_flush(struct vm_area_struct *vma, - - static int __init hugetlbpage_init(void) - { -+ /* -+ * HugeTLB pages are supported on maximum four page table -+ * levels (PUD, CONT PMD, PMD, CONT PTE) for a given base -+ * page size, corresponding to hugetlb_add_hstate() calls -+ * here. -+ * -+ * HUGE_MAX_HSTATE should at least match maximum supported -+ * HugeTLB page sizes on the platform. Any new addition to -+ * supported HugeTLB page sizes will also require changing -+ * HUGE_MAX_HSTATE as well. -+ */ -+ BUILD_BUG_ON(HUGE_MAX_HSTATE < 4); - if (pud_sect_supported()) - hugetlb_add_hstate(PUD_SHIFT - PAGE_SHIFT); - -diff --git a/arch/loongarch/include/uapi/asm/ptrace.h b/arch/loongarch/include/uapi/asm/ptrace.h -index ac915f84165053..aafb3cd9e943e5 100644 ---- a/arch/loongarch/include/uapi/asm/ptrace.h -+++ b/arch/loongarch/include/uapi/asm/ptrace.h -@@ -72,6 +72,16 @@ struct user_watch_state { - } dbg_regs[8]; - }; - -+struct user_watch_state_v2 { -+ uint64_t dbg_info; -+ struct { -+ uint64_t addr; -+ uint64_t mask; -+ uint32_t ctrl; -+ uint32_t pad; -+ } dbg_regs[14]; -+}; -+ - #define PTRACE_SYSEMU 0x1f - #define PTRACE_SYSEMU_SINGLESTEP 0x20 - -diff --git a/arch/loongarch/kernel/ptrace.c b/arch/loongarch/kernel/ptrace.c -index 19dc6eff45ccc8..5e2402cfcab0a1 100644 ---- a/arch/loongarch/kernel/ptrace.c -+++ b/arch/loongarch/kernel/ptrace.c -@@ -720,7 +720,7 @@ static int hw_break_set(struct task_struct *target, - unsigned int note_type = regset->core_note_type; - - /* Resource info */ -- offset = offsetof(struct user_watch_state, dbg_regs); -+ offset = offsetof(struct user_watch_state_v2, dbg_regs); - user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf, 0, offset); - - /* (address, mask, ctrl) registers */ -@@ -920,7 +920,7 @@ static const struct user_regset loongarch64_regsets[] = { - #ifdef CONFIG_HAVE_HW_BREAKPOINT - [REGSET_HW_BREAK] = { - .core_note_type = NT_LOONGARCH_HW_BREAK, -- .n = sizeof(struct user_watch_state) / sizeof(u32), -+ .n = sizeof(struct user_watch_state_v2) / sizeof(u32), - .size = sizeof(u32), - .align = sizeof(u32), - .regset_get = hw_break_get, -@@ -928,7 +928,7 @@ static const struct user_regset loongarch64_regsets[] = { - }, - [REGSET_HW_WATCH] = { - .core_note_type = NT_LOONGARCH_HW_WATCH, -- .n = sizeof(struct user_watch_state) / sizeof(u32), -+ .n = sizeof(struct user_watch_state_v2) / sizeof(u32), - .size = sizeof(u32), - .align = sizeof(u32), - .regset_get = hw_break_get, -diff --git a/arch/m68k/include/asm/vga.h b/arch/m68k/include/asm/vga.h -index 4742e6bc3ab8ea..cdd414fa8710a9 100644 ---- a/arch/m68k/include/asm/vga.h -+++ b/arch/m68k/include/asm/vga.h -@@ -9,7 +9,7 @@ - */ - #ifndef CONFIG_PCI - --#include -+#include - #include - - /* -@@ -29,9 +29,9 @@ - #define inw_p(port) 0 - #define outb_p(port, val) do { } while (0) - #define outw(port, val) do { } while (0) --#define readb raw_inb --#define writeb raw_outb --#define writew raw_outw -+#define readb __raw_readb -+#define writeb __raw_writeb -+#define writew __raw_writew - - #endif /* CONFIG_PCI */ - #endif /* _ASM_M68K_VGA_H */ -diff --git a/arch/mips/kernel/ftrace.c b/arch/mips/kernel/ftrace.c -index 8c401e42301cbf..f39e85fd58fa99 100644 ---- a/arch/mips/kernel/ftrace.c -+++ b/arch/mips/kernel/ftrace.c -@@ -248,7 +248,7 @@ int ftrace_disable_ftrace_graph_caller(void) - #define S_R_SP (0xafb0 << 16) /* s{d,w} R, offset(sp) */ - #define OFFSET_MASK 0xffff /* stack offset range: 0 ~ PT_SIZE */ - --unsigned long ftrace_get_parent_ra_addr(unsigned long self_ra, unsigned long -+static unsigned long ftrace_get_parent_ra_addr(unsigned long self_ra, unsigned long - old_parent_ra, unsigned long parent_ra_addr, unsigned long fp) - { - unsigned long sp, ip, tmp; -diff --git a/arch/mips/loongson64/boardinfo.c b/arch/mips/loongson64/boardinfo.c -index 280989c5a137b5..8bb275c93ac099 100644 ---- a/arch/mips/loongson64/boardinfo.c -+++ b/arch/mips/loongson64/boardinfo.c -@@ -21,13 +21,11 @@ static ssize_t boardinfo_show(struct kobject *kobj, - "BIOS Info\n" - "Vendor\t\t\t: %s\n" - "Version\t\t\t: %s\n" -- "ROM Size\t\t: %d KB\n" - "Release Date\t\t: %s\n", - strsep(&tmp_board_manufacturer, "-"), - eboard->name, - strsep(&tmp_bios_vendor, "-"), - einter->description, -- einter->size, - especial->special_name); - } - static struct kobj_attribute boardinfo_attr = __ATTR(boardinfo, 0444, -diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c -index 265bc57819dfb5..c89e70df43d82b 100644 ---- a/arch/mips/math-emu/cp1emu.c -+++ b/arch/mips/math-emu/cp1emu.c -@@ -1660,7 +1660,7 @@ static int fpux_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx, - break; - } - -- case 0x3: -+ case 0x7: - if (MIPSInst_FUNC(ir) != pfetch_op) - return SIGILL; - -diff --git a/arch/powerpc/kvm/e500_mmu_host.c b/arch/powerpc/kvm/e500_mmu_host.c -index ccb8f16ffe412f..bd413dafbaf969 100644 ---- a/arch/powerpc/kvm/e500_mmu_host.c -+++ b/arch/powerpc/kvm/e500_mmu_host.c -@@ -242,7 +242,7 @@ static inline int tlbe_is_writable(struct kvm_book3e_206_tlb_entry *tlbe) - return tlbe->mas7_3 & (MAS3_SW|MAS3_UW); - } - --static inline void kvmppc_e500_ref_setup(struct tlbe_ref *ref, -+static inline bool kvmppc_e500_ref_setup(struct tlbe_ref *ref, - struct kvm_book3e_206_tlb_entry *gtlbe, - kvm_pfn_t pfn, unsigned int wimg) - { -@@ -252,11 +252,7 @@ static inline void kvmppc_e500_ref_setup(struct tlbe_ref *ref, - /* Use guest supplied MAS2_G and MAS2_E */ - ref->flags |= (gtlbe->mas2 & MAS2_ATTRIB_MASK) | wimg; - -- /* Mark the page accessed */ -- kvm_set_pfn_accessed(pfn); -- -- if (tlbe_is_writable(gtlbe)) -- kvm_set_pfn_dirty(pfn); -+ return tlbe_is_writable(gtlbe); - } - - static inline void kvmppc_e500_ref_release(struct tlbe_ref *ref) -@@ -326,6 +322,7 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500, - { - struct kvm_memory_slot *slot; - unsigned long pfn = 0; /* silence GCC warning */ -+ struct page *page = NULL; - unsigned long hva; - int pfnmap = 0; - int tsize = BOOK3E_PAGESZ_4K; -@@ -337,6 +334,7 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500, - unsigned int wimg = 0; - pgd_t *pgdir; - unsigned long flags; -+ bool writable = false; - - /* used to check for invalidations in progress */ - mmu_seq = kvm->mmu_invalidate_seq; -@@ -446,7 +444,7 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500, - - if (likely(!pfnmap)) { - tsize_pages = 1UL << (tsize + 10 - PAGE_SHIFT); -- pfn = gfn_to_pfn_memslot(slot, gfn); -+ pfn = __kvm_faultin_pfn(slot, gfn, FOLL_WRITE, NULL, &page); - if (is_error_noslot_pfn(pfn)) { - if (printk_ratelimit()) - pr_err("%s: real page not found for gfn %lx\n", -@@ -481,7 +479,6 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500, - if (pte_present(pte)) { - wimg = (pte_val(pte) >> PTE_WIMGE_SHIFT) & - MAS2_WIMGE_MASK; -- local_irq_restore(flags); - } else { - local_irq_restore(flags); - pr_err_ratelimited("%s: pte not present: gfn %lx,pfn %lx\n", -@@ -490,8 +487,9 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500, - goto out; - } - } -- kvmppc_e500_ref_setup(ref, gtlbe, pfn, wimg); -+ local_irq_restore(flags); - -+ writable = kvmppc_e500_ref_setup(ref, gtlbe, pfn, wimg); - kvmppc_e500_setup_stlbe(&vcpu_e500->vcpu, gtlbe, tsize, - ref, gvaddr, stlbe); - -@@ -499,11 +497,8 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500, - kvmppc_mmu_flush_icache(pfn); - - out: -+ kvm_release_faultin_page(kvm, page, !!ret, writable); - spin_unlock(&kvm->mmu_lock); -- -- /* Drop refcount on page, so that mmu notifiers can clear it */ -- kvm_release_pfn_clean(pfn); -- - return ret; - } - -diff --git a/arch/powerpc/platforms/pseries/eeh_pseries.c b/arch/powerpc/platforms/pseries/eeh_pseries.c -index def184da51cf0e..3269c814f65479 100644 ---- a/arch/powerpc/platforms/pseries/eeh_pseries.c -+++ b/arch/powerpc/platforms/pseries/eeh_pseries.c -@@ -580,8 +580,10 @@ static int pseries_eeh_get_state(struct eeh_pe *pe, int *delay) - - switch(rets[0]) { - case 0: -- result = EEH_STATE_MMIO_ACTIVE | -- EEH_STATE_DMA_ACTIVE; -+ result = EEH_STATE_MMIO_ACTIVE | -+ EEH_STATE_DMA_ACTIVE | -+ EEH_STATE_MMIO_ENABLED | -+ EEH_STATE_DMA_ENABLED; - break; - case 1: - result = EEH_STATE_RESET_ACTIVE | -diff --git a/arch/s390/include/asm/futex.h b/arch/s390/include/asm/futex.h -index eaeaeb3ff0be3e..752a2310f0d6c1 100644 ---- a/arch/s390/include/asm/futex.h -+++ b/arch/s390/include/asm/futex.h -@@ -44,7 +44,7 @@ static inline int arch_futex_atomic_op_inuser(int op, int oparg, int *oval, - break; - case FUTEX_OP_ANDN: - __futex_atomic_op("lr %2,%1\nnr %2,%5\n", -- ret, oldval, newval, uaddr, oparg); -+ ret, oldval, newval, uaddr, ~oparg); - break; - case FUTEX_OP_XOR: - __futex_atomic_op("lr %2,%1\nxr %2,%5\n", -diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h -index e7338ed540d8fc..2f373e8cfed33e 100644 ---- a/arch/s390/include/asm/processor.h -+++ b/arch/s390/include/asm/processor.h -@@ -140,8 +140,7 @@ static __always_inline void __stackleak_poison(unsigned long erase_low, - " la %[addr],256(%[addr])\n" - " brctg %[tmp],0b\n" - "1: stg %[poison],0(%[addr])\n" -- " larl %[tmp],3f\n" -- " ex %[count],0(%[tmp])\n" -+ " exrl %[count],3f\n" - " j 4f\n" - "2: stg %[poison],0(%[addr])\n" - " j 4f\n" -diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c -index db9a180de65f1f..b82620cefa684b 100644 ---- a/arch/s390/kvm/vsie.c -+++ b/arch/s390/kvm/vsie.c -@@ -1335,8 +1335,14 @@ static struct vsie_page *get_vsie_page(struct kvm *kvm, unsigned long addr) - page = radix_tree_lookup(&kvm->arch.vsie.addr_to_page, addr >> 9); - rcu_read_unlock(); - if (page) { -- if (page_ref_inc_return(page) == 2) -- return page_to_virt(page); -+ if (page_ref_inc_return(page) == 2) { -+ if (page->index == addr) -+ return page_to_virt(page); -+ /* -+ * We raced with someone reusing + putting this vsie -+ * page before we grabbed it. -+ */ -+ } - page_ref_dec(page); - } - -@@ -1366,15 +1372,20 @@ static struct vsie_page *get_vsie_page(struct kvm *kvm, unsigned long addr) - kvm->arch.vsie.next++; - kvm->arch.vsie.next %= nr_vcpus; - } -- radix_tree_delete(&kvm->arch.vsie.addr_to_page, page->index >> 9); -+ if (page->index != ULONG_MAX) -+ radix_tree_delete(&kvm->arch.vsie.addr_to_page, -+ page->index >> 9); - } -- page->index = addr; -- /* double use of the same address */ -+ /* Mark it as invalid until it resides in the tree. */ -+ page->index = ULONG_MAX; -+ -+ /* Double use of the same address or allocation failure. */ - if (radix_tree_insert(&kvm->arch.vsie.addr_to_page, addr >> 9, page)) { - page_ref_dec(page); - mutex_unlock(&kvm->arch.vsie.mutex); - return NULL; - } -+ page->index = addr; - mutex_unlock(&kvm->arch.vsie.mutex); - - vsie_page = page_to_virt(page); -@@ -1467,7 +1478,9 @@ void kvm_s390_vsie_destroy(struct kvm *kvm) - vsie_page = page_to_virt(page); - release_gmap_shadow(vsie_page); - /* free the radix tree entry */ -- radix_tree_delete(&kvm->arch.vsie.addr_to_page, page->index >> 9); -+ if (page->index != ULONG_MAX) -+ radix_tree_delete(&kvm->arch.vsie.addr_to_page, -+ page->index >> 9); - __free_page(page); - } - kvm->arch.vsie.page_count = 0; -diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile -index 658e9ec065c476..ba17496fad1b3b 100644 ---- a/arch/x86/boot/compressed/Makefile -+++ b/arch/x86/boot/compressed/Makefile -@@ -34,6 +34,7 @@ targets := vmlinux vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2 vmlinux.bin.lzma \ - # avoid errors with '-march=i386', and future flags may depend on the target to - # be valid. - KBUILD_CFLAGS := -m$(BITS) -O2 $(CLANG_FLAGS) -+KBUILD_CFLAGS += -std=gnu11 - KBUILD_CFLAGS += -fno-strict-aliasing -fPIE - KBUILD_CFLAGS += -Wundef - KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING -diff --git a/arch/x86/include/asm/kexec.h b/arch/x86/include/asm/kexec.h -index c9f6a6c5de3cf6..d54dd7084a3e1c 100644 ---- a/arch/x86/include/asm/kexec.h -+++ b/arch/x86/include/asm/kexec.h -@@ -16,6 +16,7 @@ - # define PAGES_NR 4 - #endif - -+# define KEXEC_CONTROL_PAGE_SIZE 4096 - # define KEXEC_CONTROL_CODE_MAX_SIZE 2048 - - #ifndef __ASSEMBLY__ -@@ -44,7 +45,6 @@ struct kimage; - /* Maximum address we can use for the control code buffer */ - # define KEXEC_CONTROL_MEMORY_LIMIT TASK_SIZE - --# define KEXEC_CONTROL_PAGE_SIZE 4096 - - /* The native architecture */ - # define KEXEC_ARCH KEXEC_ARCH_386 -@@ -59,9 +59,6 @@ struct kimage; - /* Maximum address we can use for the control pages */ - # define KEXEC_CONTROL_MEMORY_LIMIT (MAXMEM-1) - --/* Allocate one page for the pdp and the second for the code */ --# define KEXEC_CONTROL_PAGE_SIZE (4096UL + 4096UL) -- - /* The native architecture */ - # define KEXEC_ARCH KEXEC_ARCH_X86_64 - #endif -@@ -146,6 +143,19 @@ struct kimage_arch { - }; - #else - struct kimage_arch { -+ /* -+ * This is a kimage control page, as it must not overlap with either -+ * source or destination address ranges. -+ */ -+ pgd_t *pgd; -+ /* -+ * The virtual mapping of the control code page itself is used only -+ * during the transition, while the current kernel's pages are all -+ * in place. Thus the intermediate page table pages used to map it -+ * are not control pages, but instead just normal pages obtained -+ * with get_zeroed_page(). And have to be tracked (below) so that -+ * they can be freed. -+ */ - p4d_t *p4d; - pud_t *pud; - pmd_t *pmd; -diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h -index 257bf2e71d0605..39672561c6be87 100644 ---- a/arch/x86/include/asm/kvm_host.h -+++ b/arch/x86/include/asm/kvm_host.h -@@ -1650,6 +1650,8 @@ struct kvm_x86_ops { - void (*enable_irq_window)(struct kvm_vcpu *vcpu); - void (*update_cr8_intercept)(struct kvm_vcpu *vcpu, int tpr, int irr); - bool (*check_apicv_inhibit_reasons)(enum kvm_apicv_inhibit reason); -+ -+ const bool x2apic_icr_is_split; - const unsigned long required_apicv_inhibits; - bool allow_apicv_in_x2apic_without_x2apic_virtualization; - void (*refresh_apicv_exec_ctrl)(struct kvm_vcpu *vcpu); -diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c -index 6dabb53f58a445..b6d5fc396f88c8 100644 ---- a/arch/x86/kernel/amd_nb.c -+++ b/arch/x86/kernel/amd_nb.c -@@ -537,6 +537,10 @@ static __init void fix_erratum_688(void) - - static __init int init_amd_nbs(void) - { -+ if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD && -+ boot_cpu_data.x86_vendor != X86_VENDOR_HYGON) -+ return 0; -+ - amd_cache_northbridges(); - amd_cache_gart(); - -diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c -index 2fa12d1dc67602..8509d809a9f1bb 100644 ---- a/arch/x86/kernel/machine_kexec_64.c -+++ b/arch/x86/kernel/machine_kexec_64.c -@@ -149,7 +149,8 @@ static void free_transition_pgtable(struct kimage *image) - image->arch.pte = NULL; - } - --static int init_transition_pgtable(struct kimage *image, pgd_t *pgd) -+static int init_transition_pgtable(struct kimage *image, pgd_t *pgd, -+ unsigned long control_page) - { - pgprot_t prot = PAGE_KERNEL_EXEC_NOENC; - unsigned long vaddr, paddr; -@@ -160,7 +161,7 @@ static int init_transition_pgtable(struct kimage *image, pgd_t *pgd) - pte_t *pte; - - vaddr = (unsigned long)relocate_kernel; -- paddr = __pa(page_address(image->control_code_page)+PAGE_SIZE); -+ paddr = control_page; - pgd += pgd_index(vaddr); - if (!pgd_present(*pgd)) { - p4d = (p4d_t *)get_zeroed_page(GFP_KERNEL); -@@ -219,7 +220,7 @@ static void *alloc_pgt_page(void *data) - return p; - } - --static int init_pgtable(struct kimage *image, unsigned long start_pgtable) -+static int init_pgtable(struct kimage *image, unsigned long control_page) - { - struct x86_mapping_info info = { - .alloc_pgt_page = alloc_pgt_page, -@@ -228,12 +229,12 @@ static int init_pgtable(struct kimage *image, unsigned long start_pgtable) - .kernpg_flag = _KERNPG_TABLE_NOENC, - }; - unsigned long mstart, mend; -- pgd_t *level4p; - int result; - int i; - -- level4p = (pgd_t *)__va(start_pgtable); -- clear_page(level4p); -+ image->arch.pgd = alloc_pgt_page(image); -+ if (!image->arch.pgd) -+ return -ENOMEM; - - if (cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT)) { - info.page_flag |= _PAGE_ENC; -@@ -247,8 +248,8 @@ static int init_pgtable(struct kimage *image, unsigned long start_pgtable) - mstart = pfn_mapped[i].start << PAGE_SHIFT; - mend = pfn_mapped[i].end << PAGE_SHIFT; - -- result = kernel_ident_mapping_init(&info, -- level4p, mstart, mend); -+ result = kernel_ident_mapping_init(&info, image->arch.pgd, -+ mstart, mend); - if (result) - return result; - } -@@ -263,8 +264,8 @@ static int init_pgtable(struct kimage *image, unsigned long start_pgtable) - mstart = image->segment[i].mem; - mend = mstart + image->segment[i].memsz; - -- result = kernel_ident_mapping_init(&info, -- level4p, mstart, mend); -+ result = kernel_ident_mapping_init(&info, image->arch.pgd, -+ mstart, mend); - - if (result) - return result; -@@ -274,15 +275,19 @@ static int init_pgtable(struct kimage *image, unsigned long start_pgtable) - * Prepare EFI systab and ACPI tables for kexec kernel since they are - * not covered by pfn_mapped. - */ -- result = map_efi_systab(&info, level4p); -+ result = map_efi_systab(&info, image->arch.pgd); - if (result) - return result; - -- result = map_acpi_tables(&info, level4p); -+ result = map_acpi_tables(&info, image->arch.pgd); - if (result) - return result; - -- return init_transition_pgtable(image, level4p); -+ /* -+ * This must be last because the intermediate page table pages it -+ * allocates will not be control pages and may overlap the image. -+ */ -+ return init_transition_pgtable(image, image->arch.pgd, control_page); - } - - static void load_segments(void) -@@ -299,14 +304,14 @@ static void load_segments(void) - - int machine_kexec_prepare(struct kimage *image) - { -- unsigned long start_pgtable; -+ unsigned long control_page; - int result; - - /* Calculate the offsets */ -- start_pgtable = page_to_pfn(image->control_code_page) << PAGE_SHIFT; -+ control_page = page_to_pfn(image->control_code_page) << PAGE_SHIFT; - - /* Setup the identity mapped 64bit page table */ -- result = init_pgtable(image, start_pgtable); -+ result = init_pgtable(image, control_page); - if (result) - return result; - -@@ -360,13 +365,12 @@ void machine_kexec(struct kimage *image) - #endif - } - -- control_page = page_address(image->control_code_page) + PAGE_SIZE; -+ control_page = page_address(image->control_code_page); - __memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE); - - page_list[PA_CONTROL_PAGE] = virt_to_phys(control_page); - page_list[VA_CONTROL_PAGE] = (unsigned long)control_page; -- page_list[PA_TABLE_PAGE] = -- (unsigned long)__pa(page_address(image->control_code_page)); -+ page_list[PA_TABLE_PAGE] = (unsigned long)__pa(image->arch.pgd); - - if (image->type == KEXEC_TYPE_DEFAULT) - page_list[PA_SWAP_PAGE] = (page_to_pfn(image->swap_page) -@@ -574,8 +578,7 @@ static void kexec_mark_crashkres(bool protect) - - /* Don't touch the control code page used in crash_kexec().*/ - control = PFN_PHYS(page_to_pfn(kexec_crash_image->control_code_page)); -- /* Control code page is located in the 2nd page. */ -- kexec_mark_range(crashk_res.start, control + PAGE_SIZE - 1, protect); -+ kexec_mark_range(crashk_res.start, control - 1, protect); - control += KEXEC_CONTROL_PAGE_SIZE; - kexec_mark_range(control, crashk_res.end, protect); - } -diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c -index 34766abbabd84f..66c7f2367bb34e 100644 ---- a/arch/x86/kvm/lapic.c -+++ b/arch/x86/kvm/lapic.c -@@ -338,10 +338,8 @@ static void kvm_recalculate_logical_map(struct kvm_apic_map *new, - * reversing the LDR calculation to get cluster of APICs, i.e. no - * additional work is required. - */ -- if (apic_x2apic_mode(apic)) { -- WARN_ON_ONCE(ldr != kvm_apic_calc_x2apic_ldr(kvm_x2apic_id(apic))); -+ if (apic_x2apic_mode(apic)) - return; -- } - - if (WARN_ON_ONCE(!kvm_apic_map_get_logical_dest(new, ldr, - &cluster, &mask))) { -@@ -2461,11 +2459,25 @@ int kvm_x2apic_icr_write(struct kvm_lapic *apic, u64 data) - data &= ~APIC_ICR_BUSY; - - kvm_apic_send_ipi(apic, (u32)data, (u32)(data >> 32)); -- kvm_lapic_set_reg64(apic, APIC_ICR, data); -+ if (kvm_x86_ops.x2apic_icr_is_split) { -+ kvm_lapic_set_reg(apic, APIC_ICR, data); -+ kvm_lapic_set_reg(apic, APIC_ICR2, data >> 32); -+ } else { -+ kvm_lapic_set_reg64(apic, APIC_ICR, data); -+ } - trace_kvm_apic_write(APIC_ICR, data); - return 0; - } - -+static u64 kvm_x2apic_icr_read(struct kvm_lapic *apic) -+{ -+ if (kvm_x86_ops.x2apic_icr_is_split) -+ return (u64)kvm_lapic_get_reg(apic, APIC_ICR) | -+ (u64)kvm_lapic_get_reg(apic, APIC_ICR2) << 32; -+ -+ return kvm_lapic_get_reg64(apic, APIC_ICR); -+} -+ - /* emulate APIC access in a trap manner */ - void kvm_apic_write_nodecode(struct kvm_vcpu *vcpu, u32 offset) - { -@@ -2483,7 +2495,7 @@ void kvm_apic_write_nodecode(struct kvm_vcpu *vcpu, u32 offset) - * maybe-unecessary write, and both are in the noise anyways. - */ - if (apic_x2apic_mode(apic) && offset == APIC_ICR) -- WARN_ON_ONCE(kvm_x2apic_icr_write(apic, kvm_lapic_get_reg64(apic, APIC_ICR))); -+ WARN_ON_ONCE(kvm_x2apic_icr_write(apic, kvm_x2apic_icr_read(apic))); - else - kvm_lapic_reg_write(apic, offset, kvm_lapic_get_reg(apic, offset)); - } -@@ -2964,34 +2976,48 @@ static int kvm_apic_state_fixup(struct kvm_vcpu *vcpu, - struct kvm_lapic_state *s, bool set) - { - if (apic_x2apic_mode(vcpu->arch.apic)) { -+ u32 x2apic_id = kvm_x2apic_id(vcpu->arch.apic); - u32 *id = (u32 *)(s->regs + APIC_ID); - u32 *ldr = (u32 *)(s->regs + APIC_LDR); - u64 icr; - - if (vcpu->kvm->arch.x2apic_format) { -- if (*id != vcpu->vcpu_id) -+ if (*id != x2apic_id) - return -EINVAL; - } else { -+ /* -+ * Ignore the userspace value when setting APIC state. -+ * KVM's model is that the x2APIC ID is readonly, e.g. -+ * KVM only supports delivering interrupts to KVM's -+ * version of the x2APIC ID. However, for backwards -+ * compatibility, don't reject attempts to set a -+ * mismatched ID for userspace that hasn't opted into -+ * x2apic_format. -+ */ - if (set) -- *id >>= 24; -+ *id = x2apic_id; - else -- *id <<= 24; -+ *id = x2apic_id << 24; - } - - /* - * In x2APIC mode, the LDR is fixed and based on the id. And -- * ICR is internally a single 64-bit register, but needs to be -- * split to ICR+ICR2 in userspace for backwards compatibility. -+ * if the ICR is _not_ split, ICR is internally a single 64-bit -+ * register, but needs to be split to ICR+ICR2 in userspace for -+ * backwards compatibility. - */ -- if (set) { -- *ldr = kvm_apic_calc_x2apic_ldr(*id); -- -- icr = __kvm_lapic_get_reg(s->regs, APIC_ICR) | -- (u64)__kvm_lapic_get_reg(s->regs, APIC_ICR2) << 32; -- __kvm_lapic_set_reg64(s->regs, APIC_ICR, icr); -- } else { -- icr = __kvm_lapic_get_reg64(s->regs, APIC_ICR); -- __kvm_lapic_set_reg(s->regs, APIC_ICR2, icr >> 32); -+ if (set) -+ *ldr = kvm_apic_calc_x2apic_ldr(x2apic_id); -+ -+ if (!kvm_x86_ops.x2apic_icr_is_split) { -+ if (set) { -+ icr = __kvm_lapic_get_reg(s->regs, APIC_ICR) | -+ (u64)__kvm_lapic_get_reg(s->regs, APIC_ICR2) << 32; -+ __kvm_lapic_set_reg64(s->regs, APIC_ICR, icr); -+ } else { -+ icr = __kvm_lapic_get_reg64(s->regs, APIC_ICR); -+ __kvm_lapic_set_reg(s->regs, APIC_ICR2, icr >> 32); -+ } - } - } - -@@ -3188,7 +3214,7 @@ static int kvm_lapic_msr_read(struct kvm_lapic *apic, u32 reg, u64 *data) - u32 low; - - if (reg == APIC_ICR) { -- *data = kvm_lapic_get_reg64(apic, APIC_ICR); -+ *data = kvm_x2apic_icr_read(apic); - return 0; - } - -diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c -index 413f1f2aadd1a3..d762330bce166c 100644 ---- a/arch/x86/kvm/svm/svm.c -+++ b/arch/x86/kvm/svm/svm.c -@@ -5014,6 +5014,8 @@ static struct kvm_x86_ops svm_x86_ops __initdata = { - .enable_nmi_window = svm_enable_nmi_window, - .enable_irq_window = svm_enable_irq_window, - .update_cr8_intercept = svm_update_cr8_intercept, -+ -+ .x2apic_icr_is_split = true, - .set_virtual_apic_mode = avic_refresh_virtual_apic_mode, - .refresh_apicv_exec_ctrl = avic_refresh_apicv_exec_ctrl, - .apicv_post_state_restore = avic_apicv_post_state_restore, -diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c -index 479ef26626f2fe..52098844290ad4 100644 ---- a/arch/x86/kvm/vmx/vmx.c -+++ b/arch/x86/kvm/vmx/vmx.c -@@ -8323,6 +8323,8 @@ static struct kvm_x86_ops vmx_x86_ops __initdata = { - .enable_nmi_window = vmx_enable_nmi_window, - .enable_irq_window = vmx_enable_irq_window, - .update_cr8_intercept = vmx_update_cr8_intercept, -+ -+ .x2apic_icr_is_split = false, - .set_virtual_apic_mode = vmx_set_virtual_apic_mode, - .set_apic_access_page_addr = vmx_set_apic_access_page_addr, - .refresh_apicv_exec_ctrl = vmx_refresh_apicv_exec_ctrl, -diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c -index 7cbad417e094f6..fe0b2e66ded93f 100644 ---- a/arch/x86/mm/ident_map.c -+++ b/arch/x86/mm/ident_map.c -@@ -26,18 +26,31 @@ static int ident_pud_init(struct x86_mapping_info *info, pud_t *pud_page, - for (; addr < end; addr = next) { - pud_t *pud = pud_page + pud_index(addr); - pmd_t *pmd; -+ bool use_gbpage; - - next = (addr & PUD_MASK) + PUD_SIZE; - if (next > end) - next = end; - -- if (info->direct_gbpages) { -- pud_t pudval; -+ /* if this is already a gbpage, this portion is already mapped */ -+ if (pud_leaf(*pud)) -+ continue; -+ -+ /* Is using a gbpage allowed? */ -+ use_gbpage = info->direct_gbpages; - -- if (pud_present(*pud)) -- continue; -+ /* Don't use gbpage if it maps more than the requested region. */ -+ /* at the begining: */ -+ use_gbpage &= ((addr & ~PUD_MASK) == 0); -+ /* ... or at the end: */ -+ use_gbpage &= ((next & ~PUD_MASK) == 0); -+ -+ /* Never overwrite existing mappings */ -+ use_gbpage &= !pud_present(*pud); -+ -+ if (use_gbpage) { -+ pud_t pudval; - -- addr &= PUD_MASK; - pudval = __pud((addr - info->offset) | info->page_flag); - set_pud(pud, pudval); - continue; -diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c -index 98a9bb92d75c88..12d5a0f37432ea 100644 ---- a/arch/x86/pci/fixup.c -+++ b/arch/x86/pci/fixup.c -@@ -1010,4 +1010,34 @@ DECLARE_PCI_FIXUP_SUSPEND(PCI_VENDOR_ID_AMD, 0x1668, amd_rp_pme_suspend); - DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x1668, amd_rp_pme_resume); - DECLARE_PCI_FIXUP_SUSPEND(PCI_VENDOR_ID_AMD, 0x1669, amd_rp_pme_suspend); - DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x1669, amd_rp_pme_resume); -+ -+/* -+ * Putting PCIe root ports on Ryzen SoCs with USB4 controllers into D3hot -+ * may cause problems when the system attempts wake up from s2idle. -+ * -+ * On the TUXEDO Sirius 16 Gen 1 with a specific old BIOS this manifests as -+ * a system hang. -+ */ -+static const struct dmi_system_id quirk_tuxeo_rp_d3_dmi_table[] = { -+ { -+ .matches = { -+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "TUXEDO"), -+ DMI_EXACT_MATCH(DMI_BOARD_NAME, "APX958"), -+ DMI_EXACT_MATCH(DMI_BIOS_VERSION, "V1.00A00_20240108"), -+ }, -+ }, -+ {} -+}; -+ -+static void quirk_tuxeo_rp_d3(struct pci_dev *pdev) -+{ -+ struct pci_dev *root_pdev; -+ -+ if (dmi_check_system(quirk_tuxeo_rp_d3_dmi_table)) { -+ root_pdev = pcie_find_root_port(pdev); -+ if (root_pdev) -+ root_pdev->dev_flags |= PCI_DEV_FLAGS_NO_D3; -+ } -+} -+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x1502, quirk_tuxeo_rp_d3); - #endif /* CONFIG_SUSPEND */ -diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S -index 4fd814321ed021..059f343da76d61 100644 ---- a/arch/x86/xen/xen-head.S -+++ b/arch/x86/xen/xen-head.S -@@ -117,8 +117,8 @@ SYM_FUNC_START(xen_hypercall_hvm) - pop %ebx - pop %eax - #else -- lea xen_hypercall_amd(%rip), %rbx -- cmp %rax, %rbx -+ lea xen_hypercall_amd(%rip), %rcx -+ cmp %rax, %rcx - #ifdef CONFIG_FRAME_POINTER - pop %rax /* Dummy pop. */ - #endif -@@ -132,6 +132,7 @@ SYM_FUNC_START(xen_hypercall_hvm) - pop %rcx - pop %rax - #endif -+ FRAME_END - /* Use correct hypercall function. */ - jz xen_hypercall_amd - jmp xen_hypercall_intel -diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c -index 7347eb29524df1..64551b0aa51e66 100644 ---- a/block/blk-cgroup.c -+++ b/block/blk-cgroup.c -@@ -1139,6 +1139,7 @@ static void blkcg_fill_root_iostats(void) - blkg_iostat_set(&blkg->iostat.cur, &tmp); - u64_stats_update_end_irqrestore(&blkg->iostat.sync, flags); - } -+ class_dev_iter_exit(&iter); - } - - static void blkcg_print_one_stat(struct blkcg_gq *blkg, struct seq_file *s) -diff --git a/block/fops.c b/block/fops.c -index 1df187b3067920..7c257eb3564d0c 100644 ---- a/block/fops.c -+++ b/block/fops.c -@@ -718,11 +718,12 @@ static ssize_t blkdev_read_iter(struct kiocb *iocb, struct iov_iter *to) - file_accessed(iocb->ki_filp); - - ret = blkdev_direct_IO(iocb, to); -- if (ret >= 0) { -+ if (ret > 0) { - iocb->ki_pos += ret; - count -= ret; - } -- iov_iter_revert(to, count - iov_iter_count(to)); -+ if (ret != -EIOCBQUEUED) -+ iov_iter_revert(to, count - iov_iter_count(to)); - if (ret < 0 || !count) - goto reexpand; - } -diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c -index ab2a82cb1b0b48..3aadc632d7dd53 100644 ---- a/drivers/acpi/apei/ghes.c -+++ b/drivers/acpi/apei/ghes.c -@@ -170,8 +170,6 @@ static struct gen_pool *ghes_estatus_pool; - static struct ghes_estatus_cache __rcu *ghes_estatus_caches[GHES_ESTATUS_CACHES_SIZE]; - static atomic_t ghes_estatus_cache_alloced; - --static int ghes_panic_timeout __read_mostly = 30; -- - static void __iomem *ghes_map(u64 pfn, enum fixed_addresses fixmap_idx) - { - phys_addr_t paddr; -@@ -899,14 +897,16 @@ static void __ghes_panic(struct ghes *ghes, - struct acpi_hest_generic_status *estatus, - u64 buf_paddr, enum fixed_addresses fixmap_idx) - { -+ const char *msg = GHES_PFX "Fatal hardware error"; -+ - __ghes_print_estatus(KERN_EMERG, ghes->generic, estatus); - - ghes_clear_estatus(ghes, estatus, buf_paddr, fixmap_idx); - -- /* reboot to log the error! */ - if (!panic_timeout) -- panic_timeout = ghes_panic_timeout; -- panic("Fatal hardware error!"); -+ pr_emerg("%s but panic disabled\n", msg); -+ -+ panic(msg); - } - - static int ghes_proc(struct ghes *ghes) -diff --git a/drivers/acpi/prmt.c b/drivers/acpi/prmt.c -index 8b391f12853bb6..a34f7d37877c9a 100644 ---- a/drivers/acpi/prmt.c -+++ b/drivers/acpi/prmt.c -@@ -263,9 +263,7 @@ static acpi_status acpi_platformrt_space_handler(u32 function, - if (!handler || !module) - goto invalid_guid; - -- if (!handler->handler_addr || -- !handler->static_data_buffer_addr || -- !handler->acpi_param_buffer_addr) { -+ if (!handler->handler_addr) { - buffer->prm_status = PRM_HANDLER_ERROR; - return AE_OK; - } -diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c -index 4d958a165da058..dca5682308cb32 100644 ---- a/drivers/acpi/property.c -+++ b/drivers/acpi/property.c -@@ -1116,8 +1116,6 @@ static int acpi_data_prop_read(const struct acpi_device_data *data, - } - break; - } -- if (nval == 0) -- return -EINVAL; - - if (obj->type == ACPI_TYPE_BUFFER) { - if (proptype != DEV_PROP_U8) -@@ -1141,9 +1139,11 @@ static int acpi_data_prop_read(const struct acpi_device_data *data, - ret = acpi_copy_property_array_uint(items, (u64 *)val, nval); - break; - case DEV_PROP_STRING: -- ret = acpi_copy_property_array_string( -- items, (char **)val, -- min_t(u32, nval, obj->package.count)); -+ nval = min_t(u32, nval, obj->package.count); -+ if (nval == 0) -+ return -ENODATA; -+ -+ ret = acpi_copy_property_array_string(items, (char **)val, nval); - break; - default: - ret = -EINVAL; -diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c -index 8fcc622fcb3d49..9b6529f2dfcbd9 100644 ---- a/drivers/ata/libata-sff.c -+++ b/drivers/ata/libata-sff.c -@@ -602,7 +602,7 @@ static void ata_pio_sector(struct ata_queued_cmd *qc) - { - struct ata_port *ap = qc->ap; - struct page *page; -- unsigned int offset; -+ unsigned int offset, count; - - if (!qc->cursg) { - qc->curbytes = qc->nbytes; -@@ -618,25 +618,27 @@ static void ata_pio_sector(struct ata_queued_cmd *qc) - page = nth_page(page, (offset >> PAGE_SHIFT)); - offset %= PAGE_SIZE; - -- trace_ata_sff_pio_transfer_data(qc, offset, qc->sect_size); -+ /* don't overrun current sg */ -+ count = min(qc->cursg->length - qc->cursg_ofs, qc->sect_size); -+ -+ trace_ata_sff_pio_transfer_data(qc, offset, count); - - /* - * Split the transfer when it splits a page boundary. Note that the - * split still has to be dword aligned like all ATA data transfers. - */ - WARN_ON_ONCE(offset % 4); -- if (offset + qc->sect_size > PAGE_SIZE) { -+ if (offset + count > PAGE_SIZE) { - unsigned int split_len = PAGE_SIZE - offset; - - ata_pio_xfer(qc, page, offset, split_len); -- ata_pio_xfer(qc, nth_page(page, 1), 0, -- qc->sect_size - split_len); -+ ata_pio_xfer(qc, nth_page(page, 1), 0, count - split_len); - } else { -- ata_pio_xfer(qc, page, offset, qc->sect_size); -+ ata_pio_xfer(qc, page, offset, count); - } - -- qc->curbytes += qc->sect_size; -- qc->cursg_ofs += qc->sect_size; -+ qc->curbytes += count; -+ qc->cursg_ofs += count; - - if (qc->cursg_ofs == qc->cursg->length) { - qc->cursg = sg_next(qc->cursg); -diff --git a/drivers/char/misc.c b/drivers/char/misc.c -index 541edc26ec89a1..2cf595d2e10b85 100644 ---- a/drivers/char/misc.c -+++ b/drivers/char/misc.c -@@ -63,16 +63,30 @@ static DEFINE_MUTEX(misc_mtx); - #define DYNAMIC_MINORS 128 /* like dynamic majors */ - static DEFINE_IDA(misc_minors_ida); - --static int misc_minor_alloc(void) -+static int misc_minor_alloc(int minor) - { -- int ret; -- -- ret = ida_alloc_max(&misc_minors_ida, DYNAMIC_MINORS - 1, GFP_KERNEL); -- if (ret >= 0) { -- ret = DYNAMIC_MINORS - ret - 1; -+ int ret = 0; -+ -+ if (minor == MISC_DYNAMIC_MINOR) { -+ /* allocate free id */ -+ ret = ida_alloc_max(&misc_minors_ida, DYNAMIC_MINORS - 1, GFP_KERNEL); -+ if (ret >= 0) { -+ ret = DYNAMIC_MINORS - ret - 1; -+ } else { -+ ret = ida_alloc_range(&misc_minors_ida, MISC_DYNAMIC_MINOR + 1, -+ MINORMASK, GFP_KERNEL); -+ } - } else { -- ret = ida_alloc_range(&misc_minors_ida, MISC_DYNAMIC_MINOR + 1, -- MINORMASK, GFP_KERNEL); -+ /* specific minor, check if it is in dynamic or misc dynamic range */ -+ if (minor < DYNAMIC_MINORS) { -+ minor = DYNAMIC_MINORS - minor - 1; -+ ret = ida_alloc_range(&misc_minors_ida, minor, minor, GFP_KERNEL); -+ } else if (minor > MISC_DYNAMIC_MINOR) { -+ ret = ida_alloc_range(&misc_minors_ida, minor, minor, GFP_KERNEL); -+ } else { -+ /* case of non-dynamic minors, no need to allocate id */ -+ ret = 0; -+ } - } - return ret; - } -@@ -219,7 +233,7 @@ int misc_register(struct miscdevice *misc) - mutex_lock(&misc_mtx); - - if (is_dynamic) { -- int i = misc_minor_alloc(); -+ int i = misc_minor_alloc(misc->minor); - - if (i < 0) { - err = -EBUSY; -@@ -228,6 +242,7 @@ int misc_register(struct miscdevice *misc) - misc->minor = i; - } else { - struct miscdevice *c; -+ int i; - - list_for_each_entry(c, &misc_list, list) { - if (c->minor == misc->minor) { -@@ -235,6 +250,12 @@ int misc_register(struct miscdevice *misc) - goto out; - } - } -+ -+ i = misc_minor_alloc(misc->minor); -+ if (i < 0) { -+ err = -EBUSY; -+ goto out; -+ } - } - - dev = MKDEV(MISC_MAJOR, misc->minor); -diff --git a/drivers/char/tpm/eventlog/acpi.c b/drivers/char/tpm/eventlog/acpi.c -index bd757d836c5cf9..1a5644051d3103 100644 ---- a/drivers/char/tpm/eventlog/acpi.c -+++ b/drivers/char/tpm/eventlog/acpi.c -@@ -63,6 +63,11 @@ static bool tpm_is_tpm2_log(void *bios_event_log, u64 len) - return n == 0; - } - -+static void tpm_bios_log_free(void *data) -+{ -+ kvfree(data); -+} -+ - /* read binary bios log */ - int tpm_read_log_acpi(struct tpm_chip *chip) - { -@@ -136,7 +141,7 @@ int tpm_read_log_acpi(struct tpm_chip *chip) - } - - /* malloc EventLog space */ -- log->bios_event_log = devm_kmalloc(&chip->dev, len, GFP_KERNEL); -+ log->bios_event_log = kvmalloc(len, GFP_KERNEL); - if (!log->bios_event_log) - return -ENOMEM; - -@@ -162,10 +167,16 @@ int tpm_read_log_acpi(struct tpm_chip *chip) - goto err; - } - -+ ret = devm_add_action(&chip->dev, tpm_bios_log_free, log->bios_event_log); -+ if (ret) { -+ log->bios_event_log = NULL; -+ goto err; -+ } -+ - return format; - - err: -- devm_kfree(&chip->dev, log->bios_event_log); -+ tpm_bios_log_free(log->bios_event_log); - log->bios_event_log = NULL; - return ret; - } -diff --git a/drivers/clk/mediatek/clk-mt2701-aud.c b/drivers/clk/mediatek/clk-mt2701-aud.c -index 27eecb6d3a533b..d157b07effa2a6 100644 ---- a/drivers/clk/mediatek/clk-mt2701-aud.c -+++ b/drivers/clk/mediatek/clk-mt2701-aud.c -@@ -55,10 +55,16 @@ static const struct mtk_gate audio_clks[] = { - GATE_DUMMY(CLK_DUMMY, "aud_dummy"), - /* AUDIO0 */ - GATE_AUDIO0(CLK_AUD_AFE, "audio_afe", "aud_intbus_sel", 2), -+ GATE_DUMMY(CLK_AUD_LRCK_DETECT, "audio_lrck_detect_dummy"), -+ GATE_DUMMY(CLK_AUD_I2S, "audio_i2c_dummy"), -+ GATE_DUMMY(CLK_AUD_APLL_TUNER, "audio_apll_tuner_dummy"), - GATE_AUDIO0(CLK_AUD_HDMI, "audio_hdmi", "audpll_sel", 20), - GATE_AUDIO0(CLK_AUD_SPDF, "audio_spdf", "audpll_sel", 21), - GATE_AUDIO0(CLK_AUD_SPDF2, "audio_spdf2", "audpll_sel", 22), - GATE_AUDIO0(CLK_AUD_APLL, "audio_apll", "audpll_sel", 23), -+ GATE_DUMMY(CLK_AUD_TML, "audio_tml_dummy"), -+ GATE_DUMMY(CLK_AUD_AHB_IDLE_EXT, "audio_ahb_idle_ext_dummy"), -+ GATE_DUMMY(CLK_AUD_AHB_IDLE_INT, "audio_ahb_idle_int_dummy"), - /* AUDIO1 */ - GATE_AUDIO1(CLK_AUD_I2SIN1, "audio_i2sin1", "aud_mux1_sel", 0), - GATE_AUDIO1(CLK_AUD_I2SIN2, "audio_i2sin2", "aud_mux1_sel", 1), -@@ -76,10 +82,12 @@ static const struct mtk_gate audio_clks[] = { - GATE_AUDIO1(CLK_AUD_ASRCI2, "audio_asrci2", "asm_h_sel", 13), - GATE_AUDIO1(CLK_AUD_ASRCO1, "audio_asrco1", "asm_h_sel", 14), - GATE_AUDIO1(CLK_AUD_ASRCO2, "audio_asrco2", "asm_h_sel", 15), -+ GATE_DUMMY(CLK_AUD_HDMIRX, "audio_hdmirx_dummy"), - GATE_AUDIO1(CLK_AUD_INTDIR, "audio_intdir", "intdir_sel", 20), - GATE_AUDIO1(CLK_AUD_A1SYS, "audio_a1sys", "aud_mux1_sel", 21), - GATE_AUDIO1(CLK_AUD_A2SYS, "audio_a2sys", "aud_mux2_sel", 22), - GATE_AUDIO1(CLK_AUD_AFE_CONN, "audio_afe_conn", "aud_mux1_sel", 23), -+ GATE_DUMMY(CLK_AUD_AFE_PCMIF, "audio_afe_pcmif_dummy"), - GATE_AUDIO1(CLK_AUD_AFE_MRGIF, "audio_afe_mrgif", "aud_mux1_sel", 25), - /* AUDIO2 */ - GATE_AUDIO2(CLK_AUD_MMIF_UL1, "audio_ul1", "aud_mux1_sel", 0), -@@ -100,6 +108,8 @@ static const struct mtk_gate audio_clks[] = { - GATE_AUDIO2(CLK_AUD_MMIF_AWB2, "audio_awb2", "aud_mux1_sel", 15), - GATE_AUDIO2(CLK_AUD_MMIF_DAI, "audio_dai", "aud_mux1_sel", 16), - /* AUDIO3 */ -+ GATE_DUMMY(CLK_AUD_DMIC1, "audio_dmic1_dummy"), -+ GATE_DUMMY(CLK_AUD_DMIC2, "audio_dmic2_dummy"), - GATE_AUDIO3(CLK_AUD_ASRCI3, "audio_asrci3", "asm_h_sel", 2), - GATE_AUDIO3(CLK_AUD_ASRCI4, "audio_asrci4", "asm_h_sel", 3), - GATE_AUDIO3(CLK_AUD_ASRCI5, "audio_asrci5", "asm_h_sel", 4), -diff --git a/drivers/clk/mediatek/clk-mt2701-bdp.c b/drivers/clk/mediatek/clk-mt2701-bdp.c -index b25703ec8dc08f..0728484d6f173d 100644 ---- a/drivers/clk/mediatek/clk-mt2701-bdp.c -+++ b/drivers/clk/mediatek/clk-mt2701-bdp.c -@@ -31,6 +31,7 @@ static const struct mtk_gate_regs bdp1_cg_regs = { - GATE_MTK(_id, _name, _parent, &bdp1_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv) - - static const struct mtk_gate bdp_clks[] = { -+ GATE_DUMMY(CLK_DUMMY, "bdp_dummy"), - GATE_BDP0(CLK_BDP_BRG_BA, "brg_baclk", "mm_sel", 0), - GATE_BDP0(CLK_BDP_BRG_DRAM, "brg_dram", "mm_sel", 1), - GATE_BDP0(CLK_BDP_LARB_DRAM, "larb_dram", "mm_sel", 2), -diff --git a/drivers/clk/mediatek/clk-mt2701-img.c b/drivers/clk/mediatek/clk-mt2701-img.c -index 2768360b213efc..b972deed7ef4ee 100644 ---- a/drivers/clk/mediatek/clk-mt2701-img.c -+++ b/drivers/clk/mediatek/clk-mt2701-img.c -@@ -22,6 +22,7 @@ static const struct mtk_gate_regs img_cg_regs = { - GATE_MTK(_id, _name, _parent, &img_cg_regs, _shift, &mtk_clk_gate_ops_setclr) - - static const struct mtk_gate img_clks[] = { -+ GATE_DUMMY(CLK_DUMMY, "img_dummy"), - GATE_IMG(CLK_IMG_SMI_COMM, "img_smi_comm", "mm_sel", 0), - GATE_IMG(CLK_IMG_RESZ, "img_resz", "mm_sel", 1), - GATE_IMG(CLK_IMG_JPGDEC_SMI, "img_jpgdec_smi", "mm_sel", 5), -diff --git a/drivers/clk/mediatek/clk-mt2701-mm.c b/drivers/clk/mediatek/clk-mt2701-mm.c -index 2b990b5a0422a4..bebb22b32fafa3 100644 ---- a/drivers/clk/mediatek/clk-mt2701-mm.c -+++ b/drivers/clk/mediatek/clk-mt2701-mm.c -@@ -31,6 +31,7 @@ static const struct mtk_gate_regs disp1_cg_regs = { - GATE_MTK(_id, _name, _parent, &disp1_cg_regs, _shift, &mtk_clk_gate_ops_setclr) - - static const struct mtk_gate mm_clks[] = { -+ GATE_DUMMY(CLK_DUMMY, "mm_dummy"), - GATE_DISP0(CLK_MM_SMI_COMMON, "mm_smi_comm", "mm_sel", 0), - GATE_DISP0(CLK_MM_SMI_LARB0, "mm_smi_larb0", "mm_sel", 1), - GATE_DISP0(CLK_MM_CMDQ, "mm_cmdq", "mm_sel", 2), -diff --git a/drivers/clk/mediatek/clk-mt2701-vdec.c b/drivers/clk/mediatek/clk-mt2701-vdec.c -index 57711b953b7f90..5b8035c6794e2e 100644 ---- a/drivers/clk/mediatek/clk-mt2701-vdec.c -+++ b/drivers/clk/mediatek/clk-mt2701-vdec.c -@@ -31,6 +31,7 @@ static const struct mtk_gate_regs vdec1_cg_regs = { - GATE_MTK(_id, _name, _parent, &vdec1_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv) - - static const struct mtk_gate vdec_clks[] = { -+ GATE_DUMMY(CLK_DUMMY, "vdec_dummy"), - GATE_VDEC0(CLK_VDEC_CKGEN, "vdec_cken", "vdec_sel", 0), - GATE_VDEC1(CLK_VDEC_LARB, "vdec_larb_cken", "mm_sel", 0), - }; -diff --git a/drivers/clk/qcom/Kconfig b/drivers/clk/qcom/Kconfig -index a79b837583894f..1de1661037b1b1 100644 ---- a/drivers/clk/qcom/Kconfig -+++ b/drivers/clk/qcom/Kconfig -@@ -881,6 +881,7 @@ config SM_GCC_7150 - config SM_GCC_8150 - tristate "SM8150 Global Clock Controller" - depends on ARM64 || COMPILE_TEST -+ select QCOM_GDSC - help - Support for the global clock controller on SM8150 devices. - Say Y if you want to use peripheral devices such as UART, -diff --git a/drivers/clk/qcom/clk-alpha-pll.c b/drivers/clk/qcom/clk-alpha-pll.c -index ce44dbfd47e275..80aadafffacdb1 100644 ---- a/drivers/clk/qcom/clk-alpha-pll.c -+++ b/drivers/clk/qcom/clk-alpha-pll.c -@@ -407,6 +407,8 @@ void clk_alpha_pll_configure(struct clk_alpha_pll *pll, struct regmap *regmap, - mask |= config->pre_div_mask; - mask |= config->post_div_mask; - mask |= config->vco_mask; -+ mask |= config->alpha_en_mask; -+ mask |= config->alpha_mode_mask; - - regmap_update_bits(regmap, PLL_USER_CTL(pll), mask, val); - -diff --git a/drivers/clk/qcom/clk-rpmh.c b/drivers/clk/qcom/clk-rpmh.c -index a8b5f4d8a7b9e6..edbae2a88afcf1 100644 ---- a/drivers/clk/qcom/clk-rpmh.c -+++ b/drivers/clk/qcom/clk-rpmh.c -@@ -329,7 +329,7 @@ static unsigned long clk_rpmh_bcm_recalc_rate(struct clk_hw *hw, - { - struct clk_rpmh *c = to_clk_rpmh(hw); - -- return c->aggr_state * c->unit; -+ return (unsigned long)c->aggr_state * c->unit; - } - - static const struct clk_ops clk_rpmh_bcm_ops = { -diff --git a/drivers/clk/qcom/dispcc-sm6350.c b/drivers/clk/qcom/dispcc-sm6350.c -index 441f042f5ea459..ddacb4f76eca5f 100644 ---- a/drivers/clk/qcom/dispcc-sm6350.c -+++ b/drivers/clk/qcom/dispcc-sm6350.c -@@ -187,13 +187,12 @@ static struct clk_rcg2 disp_cc_mdss_dp_aux_clk_src = { - .cmd_rcgr = 0x1144, - .mnd_width = 0, - .hid_width = 5, -+ .parent_map = disp_cc_parent_map_6, - .freq_tbl = ftbl_disp_cc_mdss_dp_aux_clk_src, - .clkr.hw.init = &(struct clk_init_data){ - .name = "disp_cc_mdss_dp_aux_clk_src", -- .parent_data = &(const struct clk_parent_data){ -- .fw_name = "bi_tcxo", -- }, -- .num_parents = 1, -+ .parent_data = disp_cc_parent_data_6, -+ .num_parents = ARRAY_SIZE(disp_cc_parent_data_6), - .ops = &clk_rcg2_ops, - }, - }; -diff --git a/drivers/clk/qcom/gcc-mdm9607.c b/drivers/clk/qcom/gcc-mdm9607.c -index fb290e73ce9487..9169cdccf3ed88 100644 ---- a/drivers/clk/qcom/gcc-mdm9607.c -+++ b/drivers/clk/qcom/gcc-mdm9607.c -@@ -535,7 +535,7 @@ static struct clk_rcg2 blsp1_uart5_apps_clk_src = { - }; - - static struct clk_rcg2 blsp1_uart6_apps_clk_src = { -- .cmd_rcgr = 0x6044, -+ .cmd_rcgr = 0x7044, - .mnd_width = 16, - .hid_width = 5, - .parent_map = gcc_xo_gpll0_map, -diff --git a/drivers/clk/qcom/gcc-sm6350.c b/drivers/clk/qcom/gcc-sm6350.c -index 0559a33faf00e6..428cd99dcdcbe5 100644 ---- a/drivers/clk/qcom/gcc-sm6350.c -+++ b/drivers/clk/qcom/gcc-sm6350.c -@@ -182,6 +182,14 @@ static const struct clk_parent_data gcc_parent_data_2_ao[] = { - { .hw = &gpll0_out_odd.clkr.hw }, - }; - -+static const struct parent_map gcc_parent_map_3[] = { -+ { P_BI_TCXO, 0 }, -+}; -+ -+static const struct clk_parent_data gcc_parent_data_3[] = { -+ { .fw_name = "bi_tcxo" }, -+}; -+ - static const struct parent_map gcc_parent_map_4[] = { - { P_BI_TCXO, 0 }, - { P_GPLL0_OUT_MAIN, 1 }, -@@ -701,13 +709,12 @@ static struct clk_rcg2 gcc_ufs_phy_phy_aux_clk_src = { - .cmd_rcgr = 0x3a0b0, - .mnd_width = 0, - .hid_width = 5, -+ .parent_map = gcc_parent_map_3, - .freq_tbl = ftbl_gcc_ufs_phy_phy_aux_clk_src, - .clkr.hw.init = &(struct clk_init_data){ - .name = "gcc_ufs_phy_phy_aux_clk_src", -- .parent_data = &(const struct clk_parent_data){ -- .fw_name = "bi_tcxo", -- }, -- .num_parents = 1, -+ .parent_data = gcc_parent_data_3, -+ .num_parents = ARRAY_SIZE(gcc_parent_data_3), - .ops = &clk_rcg2_ops, - }, - }; -@@ -764,13 +771,12 @@ static struct clk_rcg2 gcc_usb30_prim_mock_utmi_clk_src = { - .cmd_rcgr = 0x1a034, - .mnd_width = 0, - .hid_width = 5, -+ .parent_map = gcc_parent_map_3, - .freq_tbl = ftbl_gcc_usb30_prim_mock_utmi_clk_src, - .clkr.hw.init = &(struct clk_init_data){ - .name = "gcc_usb30_prim_mock_utmi_clk_src", -- .parent_data = &(const struct clk_parent_data){ -- .fw_name = "bi_tcxo", -- }, -- .num_parents = 1, -+ .parent_data = gcc_parent_data_3, -+ .num_parents = ARRAY_SIZE(gcc_parent_data_3), - .ops = &clk_rcg2_ops, - }, - }; -diff --git a/drivers/clk/qcom/gcc-sm8550.c b/drivers/clk/qcom/gcc-sm8550.c -index eb3765c57b6502..b30ece62216f7e 100644 ---- a/drivers/clk/qcom/gcc-sm8550.c -+++ b/drivers/clk/qcom/gcc-sm8550.c -@@ -3003,7 +3003,7 @@ static struct gdsc pcie_0_gdsc = { - .pd = { - .name = "pcie_0_gdsc", - }, -- .pwrsts = PWRSTS_OFF_ON, -+ .pwrsts = PWRSTS_RET_ON, - .flags = VOTABLE | POLL_CFG_GDSCR | RETAIN_FF_ENABLE, - }; - -@@ -3014,7 +3014,7 @@ static struct gdsc pcie_0_phy_gdsc = { - .pd = { - .name = "pcie_0_phy_gdsc", - }, -- .pwrsts = PWRSTS_OFF_ON, -+ .pwrsts = PWRSTS_RET_ON, - .flags = VOTABLE | POLL_CFG_GDSCR | RETAIN_FF_ENABLE, - }; - -@@ -3025,7 +3025,7 @@ static struct gdsc pcie_1_gdsc = { - .pd = { - .name = "pcie_1_gdsc", - }, -- .pwrsts = PWRSTS_OFF_ON, -+ .pwrsts = PWRSTS_RET_ON, - .flags = VOTABLE | POLL_CFG_GDSCR | RETAIN_FF_ENABLE, - }; - -@@ -3036,7 +3036,7 @@ static struct gdsc pcie_1_phy_gdsc = { - .pd = { - .name = "pcie_1_phy_gdsc", - }, -- .pwrsts = PWRSTS_OFF_ON, -+ .pwrsts = PWRSTS_RET_ON, - .flags = VOTABLE | POLL_CFG_GDSCR | RETAIN_FF_ENABLE, - }; - -diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a100.c b/drivers/clk/sunxi-ng/ccu-sun50i-a100.c -index 5f93b5526e13d6..52c1d5ebb0a12a 100644 ---- a/drivers/clk/sunxi-ng/ccu-sun50i-a100.c -+++ b/drivers/clk/sunxi-ng/ccu-sun50i-a100.c -@@ -436,7 +436,7 @@ static SUNXI_CCU_MP_WITH_MUX_GATE_POSTDIV(mmc0_clk, "mmc0", mmc_parents, 0x830, - 24, 2, /* mux */ - BIT(31), /* gate */ - 2, /* post-div */ -- CLK_SET_RATE_NO_REPARENT); -+ 0); - - static SUNXI_CCU_MP_WITH_MUX_GATE_POSTDIV(mmc1_clk, "mmc1", mmc_parents, 0x834, - 0, 4, /* M */ -@@ -444,7 +444,7 @@ static SUNXI_CCU_MP_WITH_MUX_GATE_POSTDIV(mmc1_clk, "mmc1", mmc_parents, 0x834, - 24, 2, /* mux */ - BIT(31), /* gate */ - 2, /* post-div */ -- CLK_SET_RATE_NO_REPARENT); -+ 0); - - static SUNXI_CCU_MP_WITH_MUX_GATE_POSTDIV(mmc2_clk, "mmc2", mmc_parents, 0x838, - 0, 4, /* M */ -@@ -452,7 +452,7 @@ static SUNXI_CCU_MP_WITH_MUX_GATE_POSTDIV(mmc2_clk, "mmc2", mmc_parents, 0x838, - 24, 2, /* mux */ - BIT(31), /* gate */ - 2, /* post-div */ -- CLK_SET_RATE_NO_REPARENT); -+ 0); - - static SUNXI_CCU_GATE(bus_mmc0_clk, "bus-mmc0", "ahb3", 0x84c, BIT(0), 0); - static SUNXI_CCU_GATE(bus_mmc1_clk, "bus-mmc1", "ahb3", 0x84c, BIT(1), 0); -diff --git a/drivers/cpufreq/s3c64xx-cpufreq.c b/drivers/cpufreq/s3c64xx-cpufreq.c -index c6bdfc308e9908..9cef7152807626 100644 ---- a/drivers/cpufreq/s3c64xx-cpufreq.c -+++ b/drivers/cpufreq/s3c64xx-cpufreq.c -@@ -24,6 +24,7 @@ struct s3c64xx_dvfs { - unsigned int vddarm_max; - }; - -+#ifdef CONFIG_REGULATOR - static struct s3c64xx_dvfs s3c64xx_dvfs_table[] = { - [0] = { 1000000, 1150000 }, - [1] = { 1050000, 1150000 }, -@@ -31,6 +32,7 @@ static struct s3c64xx_dvfs s3c64xx_dvfs_table[] = { - [3] = { 1200000, 1350000 }, - [4] = { 1300000, 1350000 }, - }; -+#endif - - static struct cpufreq_frequency_table s3c64xx_freq_table[] = { - { 0, 0, 66000 }, -@@ -51,15 +53,16 @@ static struct cpufreq_frequency_table s3c64xx_freq_table[] = { - static int s3c64xx_cpufreq_set_target(struct cpufreq_policy *policy, - unsigned int index) - { -- struct s3c64xx_dvfs *dvfs; -- unsigned int old_freq, new_freq; -+ unsigned int new_freq = s3c64xx_freq_table[index].frequency; - int ret; - -+#ifdef CONFIG_REGULATOR -+ struct s3c64xx_dvfs *dvfs; -+ unsigned int old_freq; -+ - old_freq = clk_get_rate(policy->clk) / 1000; -- new_freq = s3c64xx_freq_table[index].frequency; - dvfs = &s3c64xx_dvfs_table[s3c64xx_freq_table[index].driver_data]; - --#ifdef CONFIG_REGULATOR - if (vddarm && new_freq > old_freq) { - ret = regulator_set_voltage(vddarm, - dvfs->vddarm_min, -diff --git a/drivers/crypto/qce/aead.c b/drivers/crypto/qce/aead.c -index 7d811728f04782..97b56e92ea33f5 100644 ---- a/drivers/crypto/qce/aead.c -+++ b/drivers/crypto/qce/aead.c -@@ -786,7 +786,7 @@ static int qce_aead_register_one(const struct qce_aead_def *def, struct qce_devi - alg->init = qce_aead_init; - alg->exit = qce_aead_exit; - -- alg->base.cra_priority = 300; -+ alg->base.cra_priority = 275; - alg->base.cra_flags = CRYPTO_ALG_ASYNC | - CRYPTO_ALG_ALLOCATES_MEMORY | - CRYPTO_ALG_KERN_DRIVER_ONLY | -diff --git a/drivers/crypto/qce/core.c b/drivers/crypto/qce/core.c -index fce49c0dee3e2d..8bcb9adf1aee3f 100644 ---- a/drivers/crypto/qce/core.c -+++ b/drivers/crypto/qce/core.c -@@ -51,16 +51,19 @@ static void qce_unregister_algs(struct qce_device *qce) - static int qce_register_algs(struct qce_device *qce) - { - const struct qce_algo_ops *ops; -- int i, ret = -ENODEV; -+ int i, j, ret = -ENODEV; - - for (i = 0; i < ARRAY_SIZE(qce_ops); i++) { - ops = qce_ops[i]; - ret = ops->register_algs(qce); -- if (ret) -- break; -+ if (ret) { -+ for (j = i - 1; j >= 0; j--) -+ ops->unregister_algs(qce); -+ return ret; -+ } - } - -- return ret; -+ return 0; - } - - static int qce_handle_request(struct crypto_async_request *async_req) -@@ -247,7 +250,7 @@ static int qce_crypto_probe(struct platform_device *pdev) - - ret = qce_check_version(qce); - if (ret) -- goto err_clks; -+ goto err_dma; - - spin_lock_init(&qce->lock); - tasklet_init(&qce->done_tasklet, qce_tasklet_req_done, -diff --git a/drivers/crypto/qce/sha.c b/drivers/crypto/qce/sha.c -index fc72af8aa9a725..71b748183cfa86 100644 ---- a/drivers/crypto/qce/sha.c -+++ b/drivers/crypto/qce/sha.c -@@ -482,7 +482,7 @@ static int qce_ahash_register_one(const struct qce_ahash_def *def, - - base = &alg->halg.base; - base->cra_blocksize = def->blocksize; -- base->cra_priority = 300; -+ base->cra_priority = 175; - base->cra_flags = CRYPTO_ALG_ASYNC | CRYPTO_ALG_KERN_DRIVER_ONLY; - base->cra_ctxsize = sizeof(struct qce_sha_ctx); - base->cra_alignmask = 0; -diff --git a/drivers/crypto/qce/skcipher.c b/drivers/crypto/qce/skcipher.c -index 5b493fdc1e747f..ffb334eb5b3461 100644 ---- a/drivers/crypto/qce/skcipher.c -+++ b/drivers/crypto/qce/skcipher.c -@@ -461,7 +461,7 @@ static int qce_skcipher_register_one(const struct qce_skcipher_def *def, - alg->encrypt = qce_skcipher_encrypt; - alg->decrypt = qce_skcipher_decrypt; - -- alg->base.cra_priority = 300; -+ alg->base.cra_priority = 275; - alg->base.cra_flags = CRYPTO_ALG_ASYNC | - CRYPTO_ALG_ALLOCATES_MEMORY | - CRYPTO_ALG_KERN_DRIVER_ONLY; -diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig -index f0e9f250669e2f..3f2f22e47bfa1a 100644 ---- a/drivers/firmware/Kconfig -+++ b/drivers/firmware/Kconfig -@@ -139,7 +139,7 @@ config ISCSI_IBFT - select ISCSI_BOOT_SYSFS - select ISCSI_IBFT_FIND if X86 - depends on ACPI && SCSI && SCSI_LOWLEVEL -- default n -+ default n - help - This option enables support for detection and exposing of iSCSI - Boot Firmware Table (iBFT) via sysfs to userspace. If you wish to -diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile -index a0f1569b790da5..29afa73e4b282c 100644 ---- a/drivers/firmware/efi/libstub/Makefile -+++ b/drivers/firmware/efi/libstub/Makefile -@@ -11,7 +11,7 @@ cflags-y := $(KBUILD_CFLAGS) - - cflags-$(CONFIG_X86_32) := -march=i386 - cflags-$(CONFIG_X86_64) := -mcmodel=small --cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ \ -+cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ -std=gnu11 \ - -fPIC -fno-strict-aliasing -mno-red-zone \ - -mno-mmx -mno-sse -fshort-wchar \ - -Wno-pointer-sign \ -diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c -index 9c33f9da724cfd..b882b26ab5007b 100644 ---- a/drivers/gpio/gpio-pca953x.c -+++ b/drivers/gpio/gpio-pca953x.c -@@ -847,25 +847,6 @@ static bool pca953x_irq_pending(struct pca953x_chip *chip, unsigned long *pendin - DECLARE_BITMAP(trigger, MAX_LINE); - int ret; - -- if (chip->driver_data & PCA_PCAL) { -- /* Read the current interrupt status from the device */ -- ret = pca953x_read_regs(chip, PCAL953X_INT_STAT, trigger); -- if (ret) -- return false; -- -- /* Check latched inputs and clear interrupt status */ -- ret = pca953x_read_regs(chip, chip->regs->input, cur_stat); -- if (ret) -- return false; -- -- /* Apply filter for rising/falling edge selection */ -- bitmap_replace(new_stat, chip->irq_trig_fall, chip->irq_trig_raise, cur_stat, gc->ngpio); -- -- bitmap_and(pending, new_stat, trigger, gc->ngpio); -- -- return !bitmap_empty(pending, gc->ngpio); -- } -- - ret = pca953x_read_regs(chip, chip->regs->input, cur_stat); - if (ret) - return false; -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c -index 0583af4e84fa3f..a02777694d9951 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c -@@ -86,9 +86,12 @@ void kfd_process_dequeue_from_device(struct kfd_process_device *pdd) - - if (pdd->already_dequeued) - return; -- -+ /* The MES context flush needs to filter out the case which the -+ * KFD process is created without setting up the MES context and -+ * queue for creating a compute queue. -+ */ - dev->dqm->ops.process_termination(dev->dqm, &pdd->qpd); -- if (dev->kfd->shared_resources.enable_mes && -+ if (dev->kfd->shared_resources.enable_mes && !!pdd->proc_ctx_gpu_addr && - down_read_trylock(&dev->adev->reset_domain->sem)) { - amdgpu_mes_flush_shader_debugger(dev->adev, - pdd->proc_ctx_gpu_addr); -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 8a152f4974d3c5..aab99df3ba1ae4 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -955,8 +955,10 @@ static int amdgpu_dm_audio_component_get_eld(struct device *kdev, int port, - continue; - - *enabled = true; -+ mutex_lock(&connector->eld_mutex); - ret = drm_eld_size(connector->eld); - memcpy(buf, connector->eld, min(max_bytes, ret)); -+ mutex_unlock(&connector->eld_mutex); - - break; - } -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -index 385a5a75fdf873..5858e288b3fd66 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -@@ -1578,16 +1578,16 @@ int pre_validate_dsc(struct drm_atomic_state *state, - return ret; - } - --static unsigned int kbps_from_pbn(unsigned int pbn) -+static uint32_t kbps_from_pbn(unsigned int pbn) - { -- unsigned int kbps = pbn; -+ uint64_t kbps = (uint64_t)pbn; - - kbps *= (1000000 / PEAK_FACTOR_X1000); - kbps *= 8; - kbps *= 54; - kbps /= 64; - -- return kbps; -+ return (uint32_t)kbps; - } - - static bool is_dsc_common_config_possible(struct dc_stream_state *stream, -diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c -index f11b071a896f59..2aa0e01a6891b0 100644 ---- a/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c -@@ -63,8 +63,7 @@ void dmub_hw_lock_mgr_inbox0_cmd(struct dc_dmub_srv *dmub_srv, - - bool should_use_dmub_lock(struct dc_link *link) - { -- if (link->psr_settings.psr_version == DC_PSR_VERSION_SU_1 || -- link->psr_settings.psr_version == DC_PSR_VERSION_1) -+ if (link->psr_settings.psr_version == DC_PSR_VERSION_SU_1) - return true; - return false; - } -diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c -index ded8952d984907..b2256178014990 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c -@@ -1752,7 +1752,6 @@ static ssize_t aldebaran_get_gpu_metrics(struct smu_context *smu, - - gpu_metrics->average_gfx_activity = metrics.AverageGfxActivity; - gpu_metrics->average_umc_activity = metrics.AverageUclkActivity; -- gpu_metrics->average_mm_activity = 0; - - /* Valid power data is available only from primary die */ - if (aldebaran_is_primary(smu)) { -diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c b/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c -index ebccb74306a765..f30b3d5eeca5c5 100644 ---- a/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c -+++ b/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c -@@ -160,6 +160,10 @@ static int komeda_wb_connector_add(struct komeda_kms_dev *kms, - formats = komeda_get_layer_fourcc_list(&mdev->fmt_tbl, - kwb_conn->wb_layer->layer_type, - &n_formats); -+ if (!formats) { -+ kfree(kwb_conn); -+ return -ENOMEM; -+ } - - err = drm_writeback_connector_init(&kms->base, wb_conn, - &komeda_wb_connector_funcs, -diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c -index 412c6575e87b74..ddf944651c55a9 100644 ---- a/drivers/gpu/drm/bridge/analogix/anx7625.c -+++ b/drivers/gpu/drm/bridge/analogix/anx7625.c -@@ -2014,8 +2014,10 @@ static int anx7625_audio_get_eld(struct device *dev, void *data, - memset(buf, 0, len); - } else { - dev_dbg(dev, "audio copy eld\n"); -+ mutex_lock(&ctx->connector->eld_mutex); - memcpy(buf, ctx->connector->eld, - min(sizeof(ctx->connector->eld), len)); -+ mutex_unlock(&ctx->connector->eld_mutex); - } - - return 0; -diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c -index 24c5a926af8d1d..fe33b988d7523e 100644 ---- a/drivers/gpu/drm/bridge/ite-it6505.c -+++ b/drivers/gpu/drm/bridge/ite-it6505.c -@@ -295,7 +295,7 @@ - #define MAX_LANE_COUNT 4 - #define MAX_LINK_RATE HBR - #define AUTO_TRAIN_RETRY 3 --#define MAX_HDCP_DOWN_STREAM_COUNT 10 -+#define MAX_HDCP_DOWN_STREAM_COUNT 127 - #define MAX_CR_LEVEL 0x03 - #define MAX_EQ_LEVEL 0x03 - #define AUX_WAIT_TIMEOUT_MS 15 -@@ -2020,7 +2020,7 @@ static bool it6505_hdcp_part2_ksvlist_check(struct it6505 *it6505) - { - struct device *dev = it6505->dev; - u8 av[5][4], bv[5][4]; -- int i, err; -+ int i, err, retry; - - i = it6505_setup_sha1_input(it6505, it6505->sha1_input); - if (i <= 0) { -@@ -2029,22 +2029,28 @@ static bool it6505_hdcp_part2_ksvlist_check(struct it6505 *it6505) - } - - it6505_sha1_digest(it6505, it6505->sha1_input, i, (u8 *)av); -+ /*1B-05 V' must retry 3 times */ -+ for (retry = 0; retry < 3; retry++) { -+ err = it6505_get_dpcd(it6505, DP_AUX_HDCP_V_PRIME(0), (u8 *)bv, -+ sizeof(bv)); - -- err = it6505_get_dpcd(it6505, DP_AUX_HDCP_V_PRIME(0), (u8 *)bv, -- sizeof(bv)); -+ if (err < 0) { -+ dev_err(dev, "Read V' value Fail %d", retry); -+ continue; -+ } - -- if (err < 0) { -- dev_err(dev, "Read V' value Fail"); -- return false; -- } -+ for (i = 0; i < 5; i++) { -+ if (bv[i][3] != av[i][0] || bv[i][2] != av[i][1] || -+ av[i][1] != av[i][2] || bv[i][0] != av[i][3]) -+ break; - -- for (i = 0; i < 5; i++) -- if (bv[i][3] != av[i][0] || bv[i][2] != av[i][1] || -- bv[i][1] != av[i][2] || bv[i][0] != av[i][3]) -- return false; -+ DRM_DEV_DEBUG_DRIVER(dev, "V' all match!! %d, %d", retry, i); -+ return true; -+ } -+ } - -- DRM_DEV_DEBUG_DRIVER(dev, "V' all match!!"); -- return true; -+ DRM_DEV_DEBUG_DRIVER(dev, "V' NOT match!! %d", retry); -+ return false; - } - - static void it6505_hdcp_wait_ksv_list(struct work_struct *work) -@@ -2052,12 +2058,13 @@ static void it6505_hdcp_wait_ksv_list(struct work_struct *work) - struct it6505 *it6505 = container_of(work, struct it6505, - hdcp_wait_ksv_list); - struct device *dev = it6505->dev; -- unsigned int timeout = 5000; -- u8 bstatus = 0; -+ u8 bstatus; - bool ksv_list_check; -+ /* 1B-04 wait ksv list for 5s */ -+ unsigned long timeout = jiffies + -+ msecs_to_jiffies(5000) + 1; - -- timeout /= 20; -- while (timeout > 0) { -+ for (;;) { - if (!it6505_get_sink_hpd_status(it6505)) - return; - -@@ -2066,27 +2073,23 @@ static void it6505_hdcp_wait_ksv_list(struct work_struct *work) - if (bstatus & DP_BSTATUS_READY) - break; - -- msleep(20); -- timeout--; -- } -+ if (time_after(jiffies, timeout)) { -+ DRM_DEV_DEBUG_DRIVER(dev, "KSV list wait timeout"); -+ goto timeout; -+ } - -- if (timeout == 0) { -- DRM_DEV_DEBUG_DRIVER(dev, "timeout and ksv list wait failed"); -- goto timeout; -+ msleep(20); - } - - ksv_list_check = it6505_hdcp_part2_ksvlist_check(it6505); - DRM_DEV_DEBUG_DRIVER(dev, "ksv list ready, ksv list check %s", - ksv_list_check ? "pass" : "fail"); -- if (ksv_list_check) { -- it6505_set_bits(it6505, REG_HDCP_TRIGGER, -- HDCP_TRIGGER_KSV_DONE, HDCP_TRIGGER_KSV_DONE); -+ -+ if (ksv_list_check) - return; -- } -+ - timeout: -- it6505_set_bits(it6505, REG_HDCP_TRIGGER, -- HDCP_TRIGGER_KSV_DONE | HDCP_TRIGGER_KSV_FAIL, -- HDCP_TRIGGER_KSV_DONE | HDCP_TRIGGER_KSV_FAIL); -+ it6505_start_hdcp(it6505); - } - - static void it6505_hdcp_work(struct work_struct *work) -@@ -2309,14 +2312,20 @@ static int it6505_process_hpd_irq(struct it6505 *it6505) - DRM_DEV_DEBUG_DRIVER(dev, "dp_irq_vector = 0x%02x", dp_irq_vector); - - if (dp_irq_vector & DP_CP_IRQ) { -- it6505_set_bits(it6505, REG_HDCP_TRIGGER, HDCP_TRIGGER_CPIRQ, -- HDCP_TRIGGER_CPIRQ); -- - bstatus = it6505_dpcd_read(it6505, DP_AUX_HDCP_BSTATUS); - if (bstatus < 0) - return bstatus; - - DRM_DEV_DEBUG_DRIVER(dev, "Bstatus = 0x%02x", bstatus); -+ -+ /*Check BSTATUS when recive CP_IRQ */ -+ if (bstatus & DP_BSTATUS_R0_PRIME_READY && -+ it6505->hdcp_status == HDCP_AUTH_GOING) -+ it6505_set_bits(it6505, REG_HDCP_TRIGGER, HDCP_TRIGGER_CPIRQ, -+ HDCP_TRIGGER_CPIRQ); -+ else if (bstatus & (DP_BSTATUS_REAUTH_REQ | DP_BSTATUS_LINK_FAILURE) && -+ it6505->hdcp_status == HDCP_AUTH_DONE) -+ it6505_start_hdcp(it6505); - } - - ret = drm_dp_dpcd_read_link_status(&it6505->aux, link_status); -@@ -2453,7 +2462,11 @@ static void it6505_irq_hdcp_ksv_check(struct it6505 *it6505) - { - struct device *dev = it6505->dev; - -- DRM_DEV_DEBUG_DRIVER(dev, "HDCP event Interrupt"); -+ DRM_DEV_DEBUG_DRIVER(dev, "HDCP repeater R0 event Interrupt"); -+ /* 1B01 HDCP encription should start when R0 is ready*/ -+ it6505_set_bits(it6505, REG_HDCP_TRIGGER, -+ HDCP_TRIGGER_KSV_DONE, HDCP_TRIGGER_KSV_DONE); -+ - schedule_work(&it6505->hdcp_wait_ksv_list); - } - -diff --git a/drivers/gpu/drm/bridge/ite-it66121.c b/drivers/gpu/drm/bridge/ite-it66121.c -index 8f5846b76d5943..2381cd1cba8797 100644 ---- a/drivers/gpu/drm/bridge/ite-it66121.c -+++ b/drivers/gpu/drm/bridge/ite-it66121.c -@@ -1452,8 +1452,10 @@ static int it66121_audio_get_eld(struct device *dev, void *data, - dev_dbg(dev, "No connector present, passing empty EDID data"); - memset(buf, 0, len); - } else { -+ mutex_lock(&ctx->connector->eld_mutex); - memcpy(buf, ctx->connector->eld, - min(sizeof(ctx->connector->eld), len)); -+ mutex_unlock(&ctx->connector->eld_mutex); - } - mutex_unlock(&ctx->lock); - -diff --git a/drivers/gpu/drm/display/drm_dp_cec.c b/drivers/gpu/drm/display/drm_dp_cec.c -index ae39dc79419030..868bf53db66ce0 100644 ---- a/drivers/gpu/drm/display/drm_dp_cec.c -+++ b/drivers/gpu/drm/display/drm_dp_cec.c -@@ -310,16 +310,6 @@ void drm_dp_cec_set_edid(struct drm_dp_aux *aux, const struct edid *edid) - if (!aux->transfer) - return; - --#ifndef CONFIG_MEDIA_CEC_RC -- /* -- * CEC_CAP_RC is part of CEC_CAP_DEFAULTS, but it is stripped by -- * cec_allocate_adapter() if CONFIG_MEDIA_CEC_RC is undefined. -- * -- * Do this here as well to ensure the tests against cec_caps are -- * correct. -- */ -- cec_caps &= ~CEC_CAP_RC; --#endif - cancel_delayed_work_sync(&aux->cec.unregister_work); - - mutex_lock(&aux->cec.lock); -@@ -336,7 +326,9 @@ void drm_dp_cec_set_edid(struct drm_dp_aux *aux, const struct edid *edid) - num_las = CEC_MAX_LOG_ADDRS; - - if (aux->cec.adap) { -- if (aux->cec.adap->capabilities == cec_caps && -+ /* Check if the adapter properties have changed */ -+ if ((aux->cec.adap->capabilities & CEC_CAP_MONITOR_ALL) == -+ (cec_caps & CEC_CAP_MONITOR_ALL) && - aux->cec.adap->available_log_addrs == num_las) { - /* Unchanged, so just set the phys addr */ - cec_s_phys_addr_from_edid(aux->cec.adap, edid); -diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c -index 309aad5f0c808d..35bed66214474a 100644 ---- a/drivers/gpu/drm/drm_connector.c -+++ b/drivers/gpu/drm/drm_connector.c -@@ -277,6 +277,7 @@ static int __drm_connector_init(struct drm_device *dev, - INIT_LIST_HEAD(&connector->probed_modes); - INIT_LIST_HEAD(&connector->modes); - mutex_init(&connector->mutex); -+ mutex_init(&connector->eld_mutex); - mutex_init(&connector->edid_override_mutex); - connector->edid_blob_ptr = NULL; - connector->epoch_counter = 0; -diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c -index ee3fab115c4b5b..ad872c61aac0e3 100644 ---- a/drivers/gpu/drm/drm_edid.c -+++ b/drivers/gpu/drm/drm_edid.c -@@ -5499,7 +5499,9 @@ EXPORT_SYMBOL(drm_edid_get_monitor_name); - - static void clear_eld(struct drm_connector *connector) - { -+ mutex_lock(&connector->eld_mutex); - memset(connector->eld, 0, sizeof(connector->eld)); -+ mutex_unlock(&connector->eld_mutex); - - connector->latency_present[0] = false; - connector->latency_present[1] = false; -@@ -5530,6 +5532,8 @@ static void drm_edid_to_eld(struct drm_connector *connector, - if (!drm_edid) - return; - -+ mutex_lock(&connector->eld_mutex); -+ - mnl = get_monitor_name(drm_edid, &eld[DRM_ELD_MONITOR_NAME_STRING]); - drm_dbg_kms(connector->dev, "[CONNECTOR:%d:%s] ELD monitor %s\n", - connector->base.id, connector->name, -@@ -5590,6 +5594,8 @@ static void drm_edid_to_eld(struct drm_connector *connector, - drm_dbg_kms(connector->dev, "[CONNECTOR:%d:%s] ELD size %d, SAD count %d\n", - connector->base.id, connector->name, - drm_eld_size(eld), total_sad_count); -+ -+ mutex_unlock(&connector->eld_mutex); - } - - static int _drm_edid_to_sad(const struct drm_edid *drm_edid, -diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c -index 618b045230336e..b507c1c008a3e9 100644 ---- a/drivers/gpu/drm/drm_fb_helper.c -+++ b/drivers/gpu/drm/drm_fb_helper.c -@@ -1361,14 +1361,14 @@ int drm_fb_helper_set_par(struct fb_info *info) - } - EXPORT_SYMBOL(drm_fb_helper_set_par); - --static void pan_set(struct drm_fb_helper *fb_helper, int x, int y) -+static void pan_set(struct drm_fb_helper *fb_helper, int dx, int dy) - { - struct drm_mode_set *mode_set; - - mutex_lock(&fb_helper->client.modeset_mutex); - drm_client_for_each_modeset(mode_set, &fb_helper->client) { -- mode_set->x = x; -- mode_set->y = y; -+ mode_set->x += dx; -+ mode_set->y += dy; - } - mutex_unlock(&fb_helper->client.modeset_mutex); - } -@@ -1377,16 +1377,18 @@ static int pan_display_atomic(struct fb_var_screeninfo *var, - struct fb_info *info) - { - struct drm_fb_helper *fb_helper = info->par; -- int ret; -+ int ret, dx, dy; - -- pan_set(fb_helper, var->xoffset, var->yoffset); -+ dx = var->xoffset - info->var.xoffset; -+ dy = var->yoffset - info->var.yoffset; -+ pan_set(fb_helper, dx, dy); - - ret = drm_client_modeset_commit_locked(&fb_helper->client); - if (!ret) { - info->var.xoffset = var->xoffset; - info->var.yoffset = var->yoffset; - } else -- pan_set(fb_helper, info->var.xoffset, info->var.yoffset); -+ pan_set(fb_helper, -dx, -dy); - - return ret; - } -diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c -index 906133331a4424..c234f9245b1448 100644 ---- a/drivers/gpu/drm/exynos/exynos_hdmi.c -+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c -@@ -1643,7 +1643,9 @@ static int hdmi_audio_get_eld(struct device *dev, void *data, uint8_t *buf, - struct hdmi_context *hdata = dev_get_drvdata(dev); - struct drm_connector *connector = &hdata->connector; - -+ mutex_lock(&connector->eld_mutex); - memcpy(buf, connector->eld, min(sizeof(connector->eld), len)); -+ mutex_unlock(&connector->eld_mutex); - - return 0; - } -diff --git a/drivers/gpu/drm/i915/display/skl_universal_plane.c b/drivers/gpu/drm/i915/display/skl_universal_plane.c -index d557ecd4e1ebe1..18c27542eb3b93 100644 ---- a/drivers/gpu/drm/i915/display/skl_universal_plane.c -+++ b/drivers/gpu/drm/i915/display/skl_universal_plane.c -@@ -102,8 +102,6 @@ static const u32 icl_sdr_y_plane_formats[] = { - DRM_FORMAT_Y216, - DRM_FORMAT_XYUV8888, - DRM_FORMAT_XVYU2101010, -- DRM_FORMAT_XVYU12_16161616, -- DRM_FORMAT_XVYU16161616, - }; - - static const u32 icl_sdr_uv_plane_formats[] = { -@@ -130,8 +128,6 @@ static const u32 icl_sdr_uv_plane_formats[] = { - DRM_FORMAT_Y216, - DRM_FORMAT_XYUV8888, - DRM_FORMAT_XVYU2101010, -- DRM_FORMAT_XVYU12_16161616, -- DRM_FORMAT_XVYU16161616, - }; - - static const u32 icl_hdr_plane_formats[] = { -diff --git a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c -index 73a4a4eb29e086..ba0e45fe432854 100644 ---- a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c -+++ b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c -@@ -209,8 +209,6 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj) - struct address_space *mapping = obj->base.filp->f_mapping; - unsigned int max_segment = i915_sg_segment_size(i915->drm.dev); - struct sg_table *st; -- struct sgt_iter sgt_iter; -- struct page *page; - int ret; - - /* -@@ -239,9 +237,7 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj) - * for PAGE_SIZE chunks instead may be helpful. - */ - if (max_segment > PAGE_SIZE) { -- for_each_sgt_page(page, sgt_iter, st) -- put_page(page); -- sg_free_table(st); -+ shmem_sg_free_table(st, mapping, false, false); - kfree(st); - - max_segment = PAGE_SIZE; -diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c -index ccaf9437cd0d2d..9f8afffbfccb17 100644 ---- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c -+++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c -@@ -5154,12 +5154,20 @@ static inline void guc_log_context(struct drm_printer *p, - { - drm_printf(p, "GuC lrc descriptor %u:\n", ce->guc_id.id); - drm_printf(p, "\tHW Context Desc: 0x%08x\n", ce->lrc.lrca); -- drm_printf(p, "\t\tLRC Head: Internal %u, Memory %u\n", -- ce->ring->head, -- ce->lrc_reg_state[CTX_RING_HEAD]); -- drm_printf(p, "\t\tLRC Tail: Internal %u, Memory %u\n", -- ce->ring->tail, -- ce->lrc_reg_state[CTX_RING_TAIL]); -+ if (intel_context_pin_if_active(ce)) { -+ drm_printf(p, "\t\tLRC Head: Internal %u, Memory %u\n", -+ ce->ring->head, -+ ce->lrc_reg_state[CTX_RING_HEAD]); -+ drm_printf(p, "\t\tLRC Tail: Internal %u, Memory %u\n", -+ ce->ring->tail, -+ ce->lrc_reg_state[CTX_RING_TAIL]); -+ intel_context_unpin(ce); -+ } else { -+ drm_printf(p, "\t\tLRC Head: Internal %u, Memory not pinned\n", -+ ce->ring->head); -+ drm_printf(p, "\t\tLRC Tail: Internal %u, Memory not pinned\n", -+ ce->ring->tail); -+ } - drm_printf(p, "\t\tContext Pin Count: %u\n", - atomic_read(&ce->pin_count)); - drm_printf(p, "\t\tGuC ID Ref Count: %u\n", -diff --git a/drivers/gpu/drm/radeon/radeon_audio.c b/drivers/gpu/drm/radeon/radeon_audio.c -index fc22fe709b9c1b..da37a827337bc5 100644 ---- a/drivers/gpu/drm/radeon/radeon_audio.c -+++ b/drivers/gpu/drm/radeon/radeon_audio.c -@@ -773,8 +773,10 @@ static int radeon_audio_component_get_eld(struct device *kdev, int port, - if (!dig->pin || dig->pin->id != port) - continue; - *enabled = true; -+ mutex_lock(&connector->eld_mutex); - ret = drm_eld_size(connector->eld); - memcpy(buf, connector->eld, min(max_bytes, ret)); -+ mutex_unlock(&connector->eld_mutex); - break; - } - -diff --git a/drivers/gpu/drm/rockchip/cdn-dp-core.c b/drivers/gpu/drm/rockchip/cdn-dp-core.c -index fca403ccce47eb..3fd55eafdf106b 100644 ---- a/drivers/gpu/drm/rockchip/cdn-dp-core.c -+++ b/drivers/gpu/drm/rockchip/cdn-dp-core.c -@@ -946,9 +946,6 @@ static void cdn_dp_pd_event_work(struct work_struct *work) - { - struct cdn_dp_device *dp = container_of(work, struct cdn_dp_device, - event_work); -- struct drm_connector *connector = &dp->connector; -- enum drm_connector_status old_status; -- - int ret; - - mutex_lock(&dp->lock); -@@ -1010,11 +1007,7 @@ static void cdn_dp_pd_event_work(struct work_struct *work) - - out: - mutex_unlock(&dp->lock); -- -- old_status = connector->status; -- connector->status = connector->funcs->detect(connector, false); -- if (old_status != connector->status) -- drm_kms_helper_hotplug_event(dp->drm_dev); -+ drm_connector_helper_hpd_irq_event(&dp->connector); - } - - static int cdn_dp_pd_event(struct notifier_block *nb, -diff --git a/drivers/gpu/drm/sti/sti_hdmi.c b/drivers/gpu/drm/sti/sti_hdmi.c -index 500936d5743c52..90c68e0f493fb5 100644 ---- a/drivers/gpu/drm/sti/sti_hdmi.c -+++ b/drivers/gpu/drm/sti/sti_hdmi.c -@@ -1221,7 +1221,9 @@ static int hdmi_audio_get_eld(struct device *dev, void *data, uint8_t *buf, size - struct drm_connector *connector = hdmi->drm_connector; - - DRM_DEBUG_DRIVER("\n"); -+ mutex_lock(&connector->eld_mutex); - memcpy(buf, connector->eld, min(sizeof(connector->eld), len)); -+ mutex_unlock(&connector->eld_mutex); - - return 0; - } -diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c -index 1727d447786f14..541aba80c14492 100644 ---- a/drivers/gpu/drm/vc4/vc4_hdmi.c -+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c -@@ -2655,9 +2655,9 @@ static int vc4_hdmi_audio_get_eld(struct device *dev, void *data, - struct vc4_hdmi *vc4_hdmi = dev_get_drvdata(dev); - struct drm_connector *connector = &vc4_hdmi->connector; - -- mutex_lock(&vc4_hdmi->mutex); -+ mutex_lock(&connector->eld_mutex); - memcpy(buf, connector->eld, min(sizeof(connector->eld), len)); -- mutex_unlock(&vc4_hdmi->mutex); -+ mutex_unlock(&connector->eld_mutex); - - return 0; - } -diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h -index 4126c384286bff..61fd37f95fbd9f 100644 ---- a/drivers/gpu/drm/virtio/virtgpu_drv.h -+++ b/drivers/gpu/drm/virtio/virtgpu_drv.h -@@ -191,6 +191,13 @@ struct virtio_gpu_framebuffer { - #define to_virtio_gpu_framebuffer(x) \ - container_of(x, struct virtio_gpu_framebuffer, base) - -+struct virtio_gpu_plane_state { -+ struct drm_plane_state base; -+ struct virtio_gpu_fence *fence; -+}; -+#define to_virtio_gpu_plane_state(x) \ -+ container_of(x, struct virtio_gpu_plane_state, base) -+ - struct virtio_gpu_queue { - struct virtqueue *vq; - spinlock_t qlock; -diff --git a/drivers/gpu/drm/virtio/virtgpu_plane.c b/drivers/gpu/drm/virtio/virtgpu_plane.c -index a1ef657eba0774..36de73e03bbfa2 100644 ---- a/drivers/gpu/drm/virtio/virtgpu_plane.c -+++ b/drivers/gpu/drm/virtio/virtgpu_plane.c -@@ -66,11 +66,28 @@ uint32_t virtio_gpu_translate_format(uint32_t drm_fourcc) - return format; - } - -+static struct -+drm_plane_state *virtio_gpu_plane_duplicate_state(struct drm_plane *plane) -+{ -+ struct virtio_gpu_plane_state *new; -+ -+ if (WARN_ON(!plane->state)) -+ return NULL; -+ -+ new = kzalloc(sizeof(*new), GFP_KERNEL); -+ if (!new) -+ return NULL; -+ -+ __drm_atomic_helper_plane_duplicate_state(plane, &new->base); -+ -+ return &new->base; -+} -+ - static const struct drm_plane_funcs virtio_gpu_plane_funcs = { - .update_plane = drm_atomic_helper_update_plane, - .disable_plane = drm_atomic_helper_disable_plane, - .reset = drm_atomic_helper_plane_reset, -- .atomic_duplicate_state = drm_atomic_helper_plane_duplicate_state, -+ .atomic_duplicate_state = virtio_gpu_plane_duplicate_state, - .atomic_destroy_state = drm_atomic_helper_plane_destroy_state, - }; - -@@ -138,11 +155,13 @@ static void virtio_gpu_resource_flush(struct drm_plane *plane, - struct drm_device *dev = plane->dev; - struct virtio_gpu_device *vgdev = dev->dev_private; - struct virtio_gpu_framebuffer *vgfb; -+ struct virtio_gpu_plane_state *vgplane_st; - struct virtio_gpu_object *bo; - - vgfb = to_virtio_gpu_framebuffer(plane->state->fb); -+ vgplane_st = to_virtio_gpu_plane_state(plane->state); - bo = gem_to_virtio_gpu_obj(vgfb->base.obj[0]); -- if (vgfb->fence) { -+ if (vgplane_st->fence) { - struct virtio_gpu_object_array *objs; - - objs = virtio_gpu_array_alloc(1); -@@ -151,13 +170,11 @@ static void virtio_gpu_resource_flush(struct drm_plane *plane, - virtio_gpu_array_add_obj(objs, vgfb->base.obj[0]); - virtio_gpu_array_lock_resv(objs); - virtio_gpu_cmd_resource_flush(vgdev, bo->hw_res_handle, x, y, -- width, height, objs, vgfb->fence); -+ width, height, objs, -+ vgplane_st->fence); - virtio_gpu_notify(vgdev); -- -- dma_fence_wait_timeout(&vgfb->fence->f, true, -+ dma_fence_wait_timeout(&vgplane_st->fence->f, true, - msecs_to_jiffies(50)); -- dma_fence_put(&vgfb->fence->f); -- vgfb->fence = NULL; - } else { - virtio_gpu_cmd_resource_flush(vgdev, bo->hw_res_handle, x, y, - width, height, NULL, NULL); -@@ -247,20 +264,23 @@ static int virtio_gpu_plane_prepare_fb(struct drm_plane *plane, - struct drm_device *dev = plane->dev; - struct virtio_gpu_device *vgdev = dev->dev_private; - struct virtio_gpu_framebuffer *vgfb; -+ struct virtio_gpu_plane_state *vgplane_st; - struct virtio_gpu_object *bo; - - if (!new_state->fb) - return 0; - - vgfb = to_virtio_gpu_framebuffer(new_state->fb); -+ vgplane_st = to_virtio_gpu_plane_state(new_state); - bo = gem_to_virtio_gpu_obj(vgfb->base.obj[0]); - if (!bo || (plane->type == DRM_PLANE_TYPE_PRIMARY && !bo->guest_blob)) - return 0; - -- if (bo->dumb && (plane->state->fb != new_state->fb)) { -- vgfb->fence = virtio_gpu_fence_alloc(vgdev, vgdev->fence_drv.context, -+ if (bo->dumb) { -+ vgplane_st->fence = virtio_gpu_fence_alloc(vgdev, -+ vgdev->fence_drv.context, - 0); -- if (!vgfb->fence) -+ if (!vgplane_st->fence) - return -ENOMEM; - } - -@@ -270,15 +290,15 @@ static int virtio_gpu_plane_prepare_fb(struct drm_plane *plane, - static void virtio_gpu_plane_cleanup_fb(struct drm_plane *plane, - struct drm_plane_state *state) - { -- struct virtio_gpu_framebuffer *vgfb; -+ struct virtio_gpu_plane_state *vgplane_st; - - if (!state->fb) - return; - -- vgfb = to_virtio_gpu_framebuffer(state->fb); -- if (vgfb->fence) { -- dma_fence_put(&vgfb->fence->f); -- vgfb->fence = NULL; -+ vgplane_st = to_virtio_gpu_plane_state(state); -+ if (vgplane_st->fence) { -+ dma_fence_put(&vgplane_st->fence->f); -+ vgplane_st->fence = NULL; - } - } - -@@ -291,6 +311,7 @@ static void virtio_gpu_cursor_plane_update(struct drm_plane *plane, - struct virtio_gpu_device *vgdev = dev->dev_private; - struct virtio_gpu_output *output = NULL; - struct virtio_gpu_framebuffer *vgfb; -+ struct virtio_gpu_plane_state *vgplane_st; - struct virtio_gpu_object *bo = NULL; - uint32_t handle; - -@@ -303,6 +324,7 @@ static void virtio_gpu_cursor_plane_update(struct drm_plane *plane, - - if (plane->state->fb) { - vgfb = to_virtio_gpu_framebuffer(plane->state->fb); -+ vgplane_st = to_virtio_gpu_plane_state(plane->state); - bo = gem_to_virtio_gpu_obj(vgfb->base.obj[0]); - handle = bo->hw_res_handle; - } else { -@@ -322,11 +344,9 @@ static void virtio_gpu_cursor_plane_update(struct drm_plane *plane, - (vgdev, 0, - plane->state->crtc_w, - plane->state->crtc_h, -- 0, 0, objs, vgfb->fence); -+ 0, 0, objs, vgplane_st->fence); - virtio_gpu_notify(vgdev); -- dma_fence_wait(&vgfb->fence->f, true); -- dma_fence_put(&vgfb->fence->f); -- vgfb->fence = NULL; -+ dma_fence_wait(&vgplane_st->fence->f, true); - } - - if (plane->state->fb != old_state->fb) { -diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c -index 26e93a331a5107..3cd00afa453a6d 100644 ---- a/drivers/hid/hid-sensor-hub.c -+++ b/drivers/hid/hid-sensor-hub.c -@@ -730,23 +730,30 @@ static int sensor_hub_probe(struct hid_device *hdev, - return ret; - } - -+static int sensor_hub_finalize_pending_fn(struct device *dev, void *data) -+{ -+ struct hid_sensor_hub_device *hsdev = dev->platform_data; -+ -+ if (hsdev->pending.status) -+ complete(&hsdev->pending.ready); -+ -+ return 0; -+} -+ - static void sensor_hub_remove(struct hid_device *hdev) - { - struct sensor_hub_data *data = hid_get_drvdata(hdev); - unsigned long flags; -- int i; - - hid_dbg(hdev, " hardware removed\n"); - hid_hw_close(hdev); - hid_hw_stop(hdev); -+ - spin_lock_irqsave(&data->lock, flags); -- for (i = 0; i < data->hid_sensor_client_cnt; ++i) { -- struct hid_sensor_hub_device *hsdev = -- data->hid_sensor_hub_client_devs[i].platform_data; -- if (hsdev->pending.status) -- complete(&hsdev->pending.ready); -- } -+ device_for_each_child(&hdev->dev, NULL, -+ sensor_hub_finalize_pending_fn); - spin_unlock_irqrestore(&data->lock, flags); -+ - mfd_remove_devices(&hdev->dev); - mutex_destroy(&data->mutex); - } -diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c -index 33466c71c9da78..dd44373ba930e2 100644 ---- a/drivers/hid/wacom_wac.c -+++ b/drivers/hid/wacom_wac.c -@@ -4911,6 +4911,10 @@ static const struct wacom_features wacom_features_0x94 = - HID_DEVICE(BUS_I2C, HID_GROUP_WACOM, USB_VENDOR_ID_WACOM, prod),\ - .driver_data = (kernel_ulong_t)&wacom_features_##prod - -+#define PCI_DEVICE_WACOM(prod) \ -+ HID_DEVICE(BUS_PCI, HID_GROUP_WACOM, USB_VENDOR_ID_WACOM, prod),\ -+ .driver_data = (kernel_ulong_t)&wacom_features_##prod -+ - #define USB_DEVICE_LENOVO(prod) \ - HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, prod), \ - .driver_data = (kernel_ulong_t)&wacom_features_##prod -@@ -5080,6 +5084,7 @@ const struct hid_device_id wacom_ids[] = { - - { USB_DEVICE_WACOM(HID_ANY_ID) }, - { I2C_DEVICE_WACOM(HID_ANY_ID) }, -+ { PCI_DEVICE_WACOM(HID_ANY_ID) }, - { BT_DEVICE_WACOM(HID_ANY_ID) }, - { } - }; -diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c -index 14ae0cfc325efb..d2499f302b5083 100644 ---- a/drivers/i2c/i2c-core-acpi.c -+++ b/drivers/i2c/i2c-core-acpi.c -@@ -355,6 +355,25 @@ static const struct acpi_device_id i2c_acpi_force_400khz_device_ids[] = { - {} - }; - -+static const struct acpi_device_id i2c_acpi_force_100khz_device_ids[] = { -+ /* -+ * When a 400KHz freq is used on this model of ELAN touchpad in Linux, -+ * excessive smoothing (similar to when the touchpad's firmware detects -+ * a noisy signal) is sometimes applied. As some devices' (e.g, Lenovo -+ * V15 G4) ACPI tables specify a 400KHz frequency for this device and -+ * some I2C busses (e.g, Designware I2C) default to a 400KHz freq, -+ * force the speed to 100KHz as a workaround. -+ * -+ * For future investigation: This problem may be related to the default -+ * HCNT/LCNT values given by some busses' drivers, because they are not -+ * specified in the aforementioned devices' ACPI tables, and because -+ * the device works without issues on Windows at what is expected to be -+ * a 400KHz frequency. The root cause of the issue is not known. -+ */ -+ { "ELAN06FA", 0 }, -+ {} -+}; -+ - static acpi_status i2c_acpi_lookup_speed(acpi_handle handle, u32 level, - void *data, void **return_value) - { -@@ -373,6 +392,9 @@ static acpi_status i2c_acpi_lookup_speed(acpi_handle handle, u32 level, - if (acpi_match_device_ids(adev, i2c_acpi_force_400khz_device_ids) == 0) - lookup->force_speed = I2C_MAX_FAST_MODE_FREQ; - -+ if (acpi_match_device_ids(adev, i2c_acpi_force_100khz_device_ids) == 0) -+ lookup->force_speed = I2C_MAX_STANDARD_MODE_FREQ; -+ - return AE_OK; - } - -diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c -index 1750b315e97011..c073ee74e3dabb 100644 ---- a/drivers/i3c/master.c -+++ b/drivers/i3c/master.c -@@ -1878,7 +1878,7 @@ static int i3c_master_bus_init(struct i3c_master_controller *master) - goto err_bus_cleanup; - - if (master->ops->set_speed) { -- master->ops->set_speed(master, I3C_OPEN_DRAIN_NORMAL_SPEED); -+ ret = master->ops->set_speed(master, I3C_OPEN_DRAIN_NORMAL_SPEED); - if (ret) - goto err_bus_cleanup; - } -diff --git a/drivers/iio/light/as73211.c b/drivers/iio/light/as73211.c -index ec97a3a468392d..c1f9604c27141e 100644 ---- a/drivers/iio/light/as73211.c -+++ b/drivers/iio/light/as73211.c -@@ -154,6 +154,12 @@ struct as73211_data { - BIT(AS73211_SCAN_INDEX_TEMP) | \ - AS73211_SCAN_MASK_COLOR) - -+static const unsigned long as73211_scan_masks[] = { -+ AS73211_SCAN_MASK_COLOR, -+ AS73211_SCAN_MASK_ALL, -+ 0 -+}; -+ - static const struct iio_chan_spec as73211_channels[] = { - { - .type = IIO_TEMP, -@@ -602,9 +608,12 @@ static irqreturn_t as73211_trigger_handler(int irq __always_unused, void *p) - - /* AS73211 starts reading at address 2 */ - ret = i2c_master_recv(data->client, -- (char *)&scan.chan[1], 3 * sizeof(scan.chan[1])); -+ (char *)&scan.chan[0], 3 * sizeof(scan.chan[0])); - if (ret < 0) - goto done; -+ -+ /* Avoid pushing uninitialized data */ -+ scan.chan[3] = 0; - } - - if (data_result) { -@@ -612,9 +621,15 @@ static irqreturn_t as73211_trigger_handler(int irq __always_unused, void *p) - * Saturate all channels (in case of overflows). Temperature channel - * is not affected by overflows. - */ -- scan.chan[1] = cpu_to_le16(U16_MAX); -- scan.chan[2] = cpu_to_le16(U16_MAX); -- scan.chan[3] = cpu_to_le16(U16_MAX); -+ if (*indio_dev->active_scan_mask == AS73211_SCAN_MASK_ALL) { -+ scan.chan[1] = cpu_to_le16(U16_MAX); -+ scan.chan[2] = cpu_to_le16(U16_MAX); -+ scan.chan[3] = cpu_to_le16(U16_MAX); -+ } else { -+ scan.chan[0] = cpu_to_le16(U16_MAX); -+ scan.chan[1] = cpu_to_le16(U16_MAX); -+ scan.chan[2] = cpu_to_le16(U16_MAX); -+ } - } - - iio_push_to_buffers_with_timestamp(indio_dev, &scan, iio_get_time_ns(indio_dev)); -@@ -684,6 +699,7 @@ static int as73211_probe(struct i2c_client *client) - indio_dev->channels = as73211_channels; - indio_dev->num_channels = ARRAY_SIZE(as73211_channels); - indio_dev->modes = INDIO_DIRECT_MODE; -+ indio_dev->available_scan_masks = as73211_scan_masks; - - ret = i2c_smbus_read_byte_data(data->client, AS73211_REG_OSR); - if (ret < 0) -diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c -index 68b81f9c2f4b17..6cecbac0e6babf 100644 ---- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c -+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c -@@ -3875,7 +3875,7 @@ static int arm_smmu_device_probe(struct platform_device *pdev) - /* Initialise in-memory data structures */ - ret = arm_smmu_init_structures(smmu); - if (ret) -- return ret; -+ goto err_free_iopf; - - /* Record our private device structure */ - platform_set_drvdata(pdev, smmu); -@@ -3886,22 +3886,29 @@ static int arm_smmu_device_probe(struct platform_device *pdev) - /* Reset the device */ - ret = arm_smmu_device_reset(smmu, bypass); - if (ret) -- return ret; -+ goto err_disable; - - /* And we're up. Go go go! */ - ret = iommu_device_sysfs_add(&smmu->iommu, dev, NULL, - "smmu3.%pa", &ioaddr); - if (ret) -- return ret; -+ goto err_disable; - - ret = iommu_device_register(&smmu->iommu, &arm_smmu_ops, dev); - if (ret) { - dev_err(dev, "Failed to register iommu\n"); -- iommu_device_sysfs_remove(&smmu->iommu); -- return ret; -+ goto err_free_sysfs; - } - - return 0; -+ -+err_free_sysfs: -+ iommu_device_sysfs_remove(&smmu->iommu); -+err_disable: -+ arm_smmu_device_disable(smmu); -+err_free_iopf: -+ iopf_queue_free(smmu->evtq.iopf); -+ return ret; - } - - static void arm_smmu_device_remove(struct platform_device *pdev) -diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c -index d4915893601979..e6b4bab0dde2e5 100644 ---- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c -+++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c -@@ -554,6 +554,7 @@ static const struct of_device_id __maybe_unused qcom_smmu_impl_of_match[] = { - { .compatible = "qcom,sc8180x-smmu-500", .data = &qcom_smmu_500_impl0_data }, - { .compatible = "qcom,sc8280xp-smmu-500", .data = &qcom_smmu_500_impl0_data }, - { .compatible = "qcom,sdm630-smmu-v2", .data = &qcom_smmu_v2_data }, -+ { .compatible = "qcom,sdm670-smmu-v2", .data = &qcom_smmu_v2_data }, - { .compatible = "qcom,sdm845-smmu-v2", .data = &qcom_smmu_v2_data }, - { .compatible = "qcom,sdm845-smmu-500", .data = &sdm845_smmu_500_data }, - { .compatible = "qcom,sm6115-smmu-500", .data = &qcom_smmu_500_impl0_data}, -diff --git a/drivers/irqchip/irq-apple-aic.c b/drivers/irqchip/irq-apple-aic.c -index 5c534d9fd2b00d..08d3ff8dba0060 100644 ---- a/drivers/irqchip/irq-apple-aic.c -+++ b/drivers/irqchip/irq-apple-aic.c -@@ -563,7 +563,8 @@ static void __exception_irq_entry aic_handle_fiq(struct pt_regs *regs) - AIC_FIQ_HWIRQ(AIC_TMR_EL02_VIRT)); - } - -- if (read_sysreg_s(SYS_IMP_APL_PMCR0_EL1) & PMCR0_IACT) { -+ if ((read_sysreg_s(SYS_IMP_APL_PMCR0_EL1) & (PMCR0_IMODE | PMCR0_IACT)) == -+ (FIELD_PREP(PMCR0_IMODE, PMCR0_IMODE_FIQ) | PMCR0_IACT)) { - int irq; - if (cpumask_test_cpu(smp_processor_id(), - &aic_irqc->fiq_aff[AIC_CPU_PMU_P]->aff)) -diff --git a/drivers/leds/leds-lp8860.c b/drivers/leds/leds-lp8860.c -index 19b621012e582f..03d3ca414a75db 100644 ---- a/drivers/leds/leds-lp8860.c -+++ b/drivers/leds/leds-lp8860.c -@@ -265,7 +265,7 @@ static int lp8860_init(struct lp8860_led *led) - goto out; - } - -- reg_count = ARRAY_SIZE(lp8860_eeprom_disp_regs) / sizeof(lp8860_eeprom_disp_regs[0]); -+ reg_count = ARRAY_SIZE(lp8860_eeprom_disp_regs); - for (i = 0; i < reg_count; i++) { - ret = regmap_write(led->eeprom_regmap, - lp8860_eeprom_disp_regs[i].reg, -diff --git a/drivers/mailbox/tegra-hsp.c b/drivers/mailbox/tegra-hsp.c -index fe29fc2ca5260d..694550fdfddddb 100644 ---- a/drivers/mailbox/tegra-hsp.c -+++ b/drivers/mailbox/tegra-hsp.c -@@ -388,7 +388,6 @@ static void tegra_hsp_sm_recv32(struct tegra_hsp_channel *channel) - value = tegra_hsp_channel_readl(channel, HSP_SM_SHRD_MBOX); - value &= ~HSP_SM_SHRD_MBOX_FULL; - msg = (void *)(unsigned long)value; -- mbox_chan_received_data(channel->chan, msg); - - /* - * Need to clear all bits here since some producers, such as TCU, depend -@@ -398,6 +397,8 @@ static void tegra_hsp_sm_recv32(struct tegra_hsp_channel *channel) - * explicitly, so we have to make sure we cover all possible cases. - */ - tegra_hsp_channel_writel(channel, 0x0, HSP_SM_SHRD_MBOX); -+ -+ mbox_chan_received_data(channel->chan, msg); - } - - static const struct tegra_hsp_sm_ops tegra_hsp_sm_32bit_ops = { -@@ -433,7 +434,6 @@ static void tegra_hsp_sm_recv128(struct tegra_hsp_channel *channel) - value[3] = tegra_hsp_channel_readl(channel, HSP_SHRD_MBOX_TYPE1_DATA3); - - msg = (void *)(unsigned long)value; -- mbox_chan_received_data(channel->chan, msg); - - /* - * Clear data registers and tag. -@@ -443,6 +443,8 @@ static void tegra_hsp_sm_recv128(struct tegra_hsp_channel *channel) - tegra_hsp_channel_writel(channel, 0x0, HSP_SHRD_MBOX_TYPE1_DATA2); - tegra_hsp_channel_writel(channel, 0x0, HSP_SHRD_MBOX_TYPE1_DATA3); - tegra_hsp_channel_writel(channel, 0x0, HSP_SHRD_MBOX_TYPE1_TAG); -+ -+ mbox_chan_received_data(channel->chan, msg); - } - - static const struct tegra_hsp_sm_ops tegra_hsp_sm_128bit_ops = { -diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c -index aa6bb5b4704ba6..1ff16b8264cbdf 100644 ---- a/drivers/md/dm-crypt.c -+++ b/drivers/md/dm-crypt.c -@@ -57,6 +57,7 @@ struct convert_context { - struct bio *bio_out; - struct bvec_iter iter_out; - atomic_t cc_pending; -+ unsigned int tag_offset; - u64 cc_sector; - union { - struct skcipher_request *req; -@@ -1232,6 +1233,7 @@ static void crypt_convert_init(struct crypt_config *cc, - if (bio_out) - ctx->iter_out = bio_out->bi_iter; - ctx->cc_sector = sector + cc->iv_offset; -+ ctx->tag_offset = 0; - init_completion(&ctx->restart); - } - -@@ -1564,7 +1566,6 @@ static void crypt_free_req(struct crypt_config *cc, void *req, struct bio *base_ - static blk_status_t crypt_convert(struct crypt_config *cc, - struct convert_context *ctx, bool atomic, bool reset_pending) - { -- unsigned int tag_offset = 0; - unsigned int sector_step = cc->sector_size >> SECTOR_SHIFT; - int r; - -@@ -1587,9 +1588,9 @@ static blk_status_t crypt_convert(struct crypt_config *cc, - atomic_inc(&ctx->cc_pending); - - if (crypt_integrity_aead(cc)) -- r = crypt_convert_block_aead(cc, ctx, ctx->r.req_aead, tag_offset); -+ r = crypt_convert_block_aead(cc, ctx, ctx->r.req_aead, ctx->tag_offset); - else -- r = crypt_convert_block_skcipher(cc, ctx, ctx->r.req, tag_offset); -+ r = crypt_convert_block_skcipher(cc, ctx, ctx->r.req, ctx->tag_offset); - - switch (r) { - /* -@@ -1609,8 +1610,8 @@ static blk_status_t crypt_convert(struct crypt_config *cc, - * exit and continue processing in a workqueue - */ - ctx->r.req = NULL; -+ ctx->tag_offset++; - ctx->cc_sector += sector_step; -- tag_offset++; - return BLK_STS_DEV_RESOURCE; - } - } else { -@@ -1624,8 +1625,8 @@ static blk_status_t crypt_convert(struct crypt_config *cc, - */ - case -EINPROGRESS: - ctx->r.req = NULL; -+ ctx->tag_offset++; - ctx->cc_sector += sector_step; -- tag_offset++; - continue; - /* - * The request was already processed (synchronously). -@@ -1633,7 +1634,7 @@ static blk_status_t crypt_convert(struct crypt_config *cc, - case 0: - atomic_dec(&ctx->cc_pending); - ctx->cc_sector += sector_step; -- tag_offset++; -+ ctx->tag_offset++; - if (!atomic) - cond_resched(); - continue; -@@ -2068,7 +2069,6 @@ static void kcryptd_crypt_write_continue(struct work_struct *work) - struct crypt_config *cc = io->cc; - struct convert_context *ctx = &io->ctx; - int crypt_finished; -- sector_t sector = io->sector; - blk_status_t r; - - wait_for_completion(&ctx->restart); -@@ -2085,10 +2085,8 @@ static void kcryptd_crypt_write_continue(struct work_struct *work) - } - - /* Encryption was already finished, submit io now */ -- if (crypt_finished) { -+ if (crypt_finished) - kcryptd_crypt_write_io_submit(io, 0); -- io->sector = sector; -- } - - crypt_dec_pending(io); - } -@@ -2099,14 +2097,13 @@ static void kcryptd_crypt_write_convert(struct dm_crypt_io *io) - struct convert_context *ctx = &io->ctx; - struct bio *clone; - int crypt_finished; -- sector_t sector = io->sector; - blk_status_t r; - - /* - * Prevent io from disappearing until this function completes. - */ - crypt_inc_pending(io); -- crypt_convert_init(cc, ctx, NULL, io->base_bio, sector); -+ crypt_convert_init(cc, ctx, NULL, io->base_bio, io->sector); - - clone = crypt_alloc_buffer(io, io->base_bio->bi_iter.bi_size); - if (unlikely(!clone)) { -@@ -2123,8 +2120,6 @@ static void kcryptd_crypt_write_convert(struct dm_crypt_io *io) - io->ctx.iter_in = clone->bi_iter; - } - -- sector += bio_sectors(clone); -- - crypt_inc_pending(io); - r = crypt_convert(cc, ctx, - test_bit(DM_CRYPT_NO_WRITE_WORKQUEUE, &cc->flags), true); -@@ -2148,10 +2143,8 @@ static void kcryptd_crypt_write_convert(struct dm_crypt_io *io) - } - - /* Encryption was already finished, submit io now */ -- if (crypt_finished) { -+ if (crypt_finished) - kcryptd_crypt_write_io_submit(io, 0); -- io->sector = sector; -- } - - dec: - crypt_dec_pending(io); -diff --git a/drivers/media/i2c/ccs/ccs-core.c b/drivers/media/i2c/ccs/ccs-core.c -index 6f8fbd82e21c8f..92ee86ca80a63d 100644 ---- a/drivers/media/i2c/ccs/ccs-core.c -+++ b/drivers/media/i2c/ccs/ccs-core.c -@@ -3658,15 +3658,15 @@ static int ccs_probe(struct i2c_client *client) - out_cleanup: - ccs_cleanup(sensor); - -+out_free_ccs_limits: -+ kfree(sensor->ccs_limits); -+ - out_release_mdata: - kvfree(sensor->mdata.backing); - - out_release_sdata: - kvfree(sensor->sdata.backing); - --out_free_ccs_limits: -- kfree(sensor->ccs_limits); -- - out_power_off: - ccs_power_off(&client->dev); - mutex_destroy(&sensor->mutex); -diff --git a/drivers/media/i2c/ccs/ccs-data.c b/drivers/media/i2c/ccs/ccs-data.c -index 08400edf77ced1..2591dba51e17e2 100644 ---- a/drivers/media/i2c/ccs/ccs-data.c -+++ b/drivers/media/i2c/ccs/ccs-data.c -@@ -10,6 +10,7 @@ - #include - #include - #include -+#include - - #include "ccs-data-defs.h" - -@@ -97,7 +98,7 @@ ccs_data_parse_length_specifier(const struct __ccs_data_length_specifier *__len, - plen = ((size_t) - (__len3->length[0] & - ((1 << CCS_DATA_LENGTH_SPECIFIER_SIZE_SHIFT) - 1)) -- << 16) + (__len3->length[0] << 8) + __len3->length[1]; -+ << 16) + (__len3->length[1] << 8) + __len3->length[2]; - break; - } - default: -@@ -948,15 +949,15 @@ int ccs_data_parse(struct ccs_data_container *ccsdata, const void *data, - - rval = __ccs_data_parse(&bin, ccsdata, data, len, dev, verbose); - if (rval) -- return rval; -+ goto out_cleanup; - - rval = bin_backing_alloc(&bin); - if (rval) -- return rval; -+ goto out_cleanup; - - rval = __ccs_data_parse(&bin, ccsdata, data, len, dev, false); - if (rval) -- goto out_free; -+ goto out_cleanup; - - if (verbose && ccsdata->version) - print_ccs_data_version(dev, ccsdata->version); -@@ -965,15 +966,16 @@ int ccs_data_parse(struct ccs_data_container *ccsdata, const void *data, - rval = -EPROTO; - dev_dbg(dev, "parsing mismatch; base %p; now %p; end %p\n", - bin.base, bin.now, bin.end); -- goto out_free; -+ goto out_cleanup; - } - - ccsdata->backing = bin.base; - - return 0; - --out_free: -+out_cleanup: - kvfree(bin.base); -+ memset(ccsdata, 0, sizeof(*ccsdata)); - - return rval; - } -diff --git a/drivers/media/i2c/ds90ub913.c b/drivers/media/i2c/ds90ub913.c -index 4bfa3b3cf619b3..5a650facae4153 100644 ---- a/drivers/media/i2c/ds90ub913.c -+++ b/drivers/media/i2c/ds90ub913.c -@@ -792,7 +792,6 @@ static void ub913_subdev_uninit(struct ub913_data *priv) - v4l2_async_unregister_subdev(&priv->sd); - ub913_v4l2_nf_unregister(priv); - v4l2_subdev_cleanup(&priv->sd); -- fwnode_handle_put(priv->sd.fwnode); - media_entity_cleanup(&priv->sd.entity); - } - -diff --git a/drivers/media/i2c/ds90ub953.c b/drivers/media/i2c/ds90ub953.c -index dc394e22a42c43..1dd29137d2d9f2 100644 ---- a/drivers/media/i2c/ds90ub953.c -+++ b/drivers/media/i2c/ds90ub953.c -@@ -1290,7 +1290,6 @@ static void ub953_subdev_uninit(struct ub953_data *priv) - v4l2_async_unregister_subdev(&priv->sd); - ub953_v4l2_notifier_unregister(priv); - v4l2_subdev_cleanup(&priv->sd); -- fwnode_handle_put(priv->sd.fwnode); - media_entity_cleanup(&priv->sd.entity); - } - -diff --git a/drivers/media/i2c/ds90ub960.c b/drivers/media/i2c/ds90ub960.c -index 7f30e8923633ef..67714047588ac2 100644 ---- a/drivers/media/i2c/ds90ub960.c -+++ b/drivers/media/i2c/ds90ub960.c -@@ -352,6 +352,8 @@ - - #define UB960_SR_I2C_RX_ID(n) (0xf8 + (n)) /* < UB960_FPD_RX_NPORTS */ - -+#define UB9702_SR_REFCLK_FREQ 0x3d -+ - /* Indirect register blocks */ - #define UB960_IND_TARGET_PAT_GEN 0x00 - #define UB960_IND_TARGET_RX_ANA(n) (0x01 + (n)) -@@ -1575,16 +1577,24 @@ static int ub960_rxport_wait_locks(struct ub960_data *priv, - - ub960_rxport_read16(priv, nport, UB960_RR_RX_FREQ_HIGH, &v); - -- ret = ub960_rxport_get_strobe_pos(priv, nport, &strobe_pos); -- if (ret) -- return ret; -+ if (priv->hw_data->is_ub9702) { -+ dev_dbg(dev, "\trx%u: locked, freq %llu Hz\n", -+ nport, (v * 1000000ULL) >> 8); -+ } else { -+ ret = ub960_rxport_get_strobe_pos(priv, nport, -+ &strobe_pos); -+ if (ret) -+ return ret; - -- ret = ub960_rxport_get_eq_level(priv, nport, &eq_level); -- if (ret) -- return ret; -+ ret = ub960_rxport_get_eq_level(priv, nport, &eq_level); -+ if (ret) -+ return ret; - -- dev_dbg(dev, "\trx%u: locked, SP: %d, EQ: %u, freq %llu Hz\n", -- nport, strobe_pos, eq_level, (v * 1000000ULL) >> 8); -+ dev_dbg(dev, -+ "\trx%u: locked, SP: %d, EQ: %u, freq %llu Hz\n", -+ nport, strobe_pos, eq_level, -+ (v * 1000000ULL) >> 8); -+ } - } - - return 0; -@@ -2524,7 +2534,7 @@ static int ub960_configure_ports_for_streaming(struct ub960_data *priv, - for (i = 0; i < 8; i++) - ub960_rxport_write(priv, nport, - UB960_RR_VC_ID_MAP(i), -- nport); -+ (nport << 4) | nport); - } - - break; -@@ -2946,6 +2956,54 @@ static const struct v4l2_subdev_pad_ops ub960_pad_ops = { - .init_cfg = ub960_init_cfg, - }; - -+static void ub960_log_status_ub960_sp_eq(struct ub960_data *priv, -+ unsigned int nport) -+{ -+ struct device *dev = &priv->client->dev; -+ u8 eq_level; -+ s8 strobe_pos; -+ u8 v = 0; -+ -+ /* Strobe */ -+ -+ ub960_read(priv, UB960_XR_AEQ_CTL1, &v); -+ -+ dev_info(dev, "\t%s strobe\n", -+ (v & UB960_XR_AEQ_CTL1_AEQ_SFILTER_EN) ? "Adaptive" : -+ "Manual"); -+ -+ if (v & UB960_XR_AEQ_CTL1_AEQ_SFILTER_EN) { -+ ub960_read(priv, UB960_XR_SFILTER_CFG, &v); -+ -+ dev_info(dev, "\tStrobe range [%d, %d]\n", -+ ((v >> UB960_XR_SFILTER_CFG_SFILTER_MIN_SHIFT) & 0xf) - 7, -+ ((v >> UB960_XR_SFILTER_CFG_SFILTER_MAX_SHIFT) & 0xf) - 7); -+ } -+ -+ ub960_rxport_get_strobe_pos(priv, nport, &strobe_pos); -+ -+ dev_info(dev, "\tStrobe pos %d\n", strobe_pos); -+ -+ /* EQ */ -+ -+ ub960_rxport_read(priv, nport, UB960_RR_AEQ_BYPASS, &v); -+ -+ dev_info(dev, "\t%s EQ\n", -+ (v & UB960_RR_AEQ_BYPASS_ENABLE) ? "Manual" : -+ "Adaptive"); -+ -+ if (!(v & UB960_RR_AEQ_BYPASS_ENABLE)) { -+ ub960_rxport_read(priv, nport, UB960_RR_AEQ_MIN_MAX, &v); -+ -+ dev_info(dev, "\tEQ range [%u, %u]\n", -+ (v >> UB960_RR_AEQ_MIN_MAX_AEQ_FLOOR_SHIFT) & 0xf, -+ (v >> UB960_RR_AEQ_MIN_MAX_AEQ_MAX_SHIFT) & 0xf); -+ } -+ -+ if (ub960_rxport_get_eq_level(priv, nport, &eq_level) == 0) -+ dev_info(dev, "\tEQ level %u\n", eq_level); -+} -+ - static int ub960_log_status(struct v4l2_subdev *sd) - { - struct ub960_data *priv = sd_to_ub960(sd); -@@ -2993,8 +3051,6 @@ static int ub960_log_status(struct v4l2_subdev *sd) - - for (nport = 0; nport < priv->hw_data->num_rxports; nport++) { - struct ub960_rxport *rxport = priv->rxports[nport]; -- u8 eq_level; -- s8 strobe_pos; - unsigned int i; - - dev_info(dev, "RX %u\n", nport); -@@ -3030,44 +3086,8 @@ static int ub960_log_status(struct v4l2_subdev *sd) - ub960_rxport_read(priv, nport, UB960_RR_CSI_ERR_COUNTER, &v); - dev_info(dev, "\tcsi_err_counter %u\n", v); - -- /* Strobe */ -- -- ub960_read(priv, UB960_XR_AEQ_CTL1, &v); -- -- dev_info(dev, "\t%s strobe\n", -- (v & UB960_XR_AEQ_CTL1_AEQ_SFILTER_EN) ? "Adaptive" : -- "Manual"); -- -- if (v & UB960_XR_AEQ_CTL1_AEQ_SFILTER_EN) { -- ub960_read(priv, UB960_XR_SFILTER_CFG, &v); -- -- dev_info(dev, "\tStrobe range [%d, %d]\n", -- ((v >> UB960_XR_SFILTER_CFG_SFILTER_MIN_SHIFT) & 0xf) - 7, -- ((v >> UB960_XR_SFILTER_CFG_SFILTER_MAX_SHIFT) & 0xf) - 7); -- } -- -- ub960_rxport_get_strobe_pos(priv, nport, &strobe_pos); -- -- dev_info(dev, "\tStrobe pos %d\n", strobe_pos); -- -- /* EQ */ -- -- ub960_rxport_read(priv, nport, UB960_RR_AEQ_BYPASS, &v); -- -- dev_info(dev, "\t%s EQ\n", -- (v & UB960_RR_AEQ_BYPASS_ENABLE) ? "Manual" : -- "Adaptive"); -- -- if (!(v & UB960_RR_AEQ_BYPASS_ENABLE)) { -- ub960_rxport_read(priv, nport, UB960_RR_AEQ_MIN_MAX, &v); -- -- dev_info(dev, "\tEQ range [%u, %u]\n", -- (v >> UB960_RR_AEQ_MIN_MAX_AEQ_FLOOR_SHIFT) & 0xf, -- (v >> UB960_RR_AEQ_MIN_MAX_AEQ_MAX_SHIFT) & 0xf); -- } -- -- if (ub960_rxport_get_eq_level(priv, nport, &eq_level) == 0) -- dev_info(dev, "\tEQ level %u\n", eq_level); -+ if (!priv->hw_data->is_ub9702) -+ ub960_log_status_ub960_sp_eq(priv, nport); - - /* GPIOs */ - for (i = 0; i < UB960_NUM_BC_GPIOS; i++) { -@@ -3838,7 +3858,10 @@ static int ub960_enable_core_hw(struct ub960_data *priv) - if (ret) - goto err_pd_gpio; - -- ret = ub960_read(priv, UB960_XR_REFCLK_FREQ, &refclk_freq); -+ if (priv->hw_data->is_ub9702) -+ ret = ub960_read(priv, UB9702_SR_REFCLK_FREQ, &refclk_freq); -+ else -+ ret = ub960_read(priv, UB960_XR_REFCLK_FREQ, &refclk_freq); - if (ret) - goto err_pd_gpio; - -diff --git a/drivers/media/i2c/imx296.c b/drivers/media/i2c/imx296.c -index 3b4539b622b43b..330e7e149a620a 100644 ---- a/drivers/media/i2c/imx296.c -+++ b/drivers/media/i2c/imx296.c -@@ -960,6 +960,8 @@ static int imx296_identify_model(struct imx296 *sensor) - return ret; - } - -+ usleep_range(2000, 5000); -+ - ret = imx296_read(sensor, IMX296_SENSOR_INFO); - if (ret < 0) { - dev_err(sensor->dev, "failed to read sensor information (%d)\n", -diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c -index 40532f7bcabea8..b8a6acc30a252d 100644 ---- a/drivers/media/i2c/ov5640.c -+++ b/drivers/media/i2c/ov5640.c -@@ -1982,6 +1982,7 @@ static int ov5640_get_light_freq(struct ov5640_dev *sensor) - light_freq = 50; - } else { - /* 60Hz */ -+ light_freq = 60; - } - } - -diff --git a/drivers/media/platform/marvell/mmp-driver.c b/drivers/media/platform/marvell/mmp-driver.c -index 170907cc1885cf..f8d595c0687f72 100644 ---- a/drivers/media/platform/marvell/mmp-driver.c -+++ b/drivers/media/platform/marvell/mmp-driver.c -@@ -230,13 +230,23 @@ static int mmpcam_probe(struct platform_device *pdev) - - mcam_init_clk(mcam); - -+ /* -+ * Register with V4L. -+ */ -+ -+ ret = v4l2_device_register(mcam->dev, &mcam->v4l2_dev); -+ if (ret) -+ return ret; -+ - /* - * Create a match of the sensor against its OF node. - */ - ep = fwnode_graph_get_next_endpoint(of_fwnode_handle(pdev->dev.of_node), - NULL); -- if (!ep) -- return -ENODEV; -+ if (!ep) { -+ ret = -ENODEV; -+ goto out_v4l2_device_unregister; -+ } - - v4l2_async_nf_init(&mcam->notifier, &mcam->v4l2_dev); - -@@ -245,7 +255,7 @@ static int mmpcam_probe(struct platform_device *pdev) - fwnode_handle_put(ep); - if (IS_ERR(asd)) { - ret = PTR_ERR(asd); -- goto out; -+ goto out_v4l2_device_unregister; - } - - /* -@@ -253,7 +263,7 @@ static int mmpcam_probe(struct platform_device *pdev) - */ - ret = mccic_register(mcam); - if (ret) -- goto out; -+ goto out_v4l2_device_unregister; - - /* - * Add OF clock provider. -@@ -282,6 +292,8 @@ static int mmpcam_probe(struct platform_device *pdev) - return 0; - out: - mccic_shutdown(mcam); -+out_v4l2_device_unregister: -+ v4l2_device_unregister(&mcam->v4l2_dev); - - return ret; - } -@@ -292,6 +304,7 @@ static void mmpcam_remove(struct platform_device *pdev) - struct mcam_camera *mcam = &cam->mcam; - - mccic_shutdown(mcam); -+ v4l2_device_unregister(&mcam->v4l2_dev); - pm_runtime_force_suspend(mcam->dev); - } - -diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c -index 07158e9451fed1..ce70e96b8fb52e 100644 ---- a/drivers/media/usb/uvc/uvc_ctrl.c -+++ b/drivers/media/usb/uvc/uvc_ctrl.c -@@ -1593,10 +1593,8 @@ bool uvc_ctrl_status_event_async(struct urb *urb, struct uvc_video_chain *chain, - struct uvc_device *dev = chain->dev; - struct uvc_ctrl_work *w = &dev->async_ctrl; - -- if (list_empty(&ctrl->info.mappings)) { -- ctrl->handle = NULL; -+ if (list_empty(&ctrl->info.mappings)) - return false; -- } - - w->data = data; - w->urb = urb; -@@ -1626,13 +1624,13 @@ static void uvc_ctrl_send_events(struct uvc_fh *handle, - { - struct uvc_control_mapping *mapping; - struct uvc_control *ctrl; -- u32 changes = V4L2_EVENT_CTRL_CH_VALUE; - unsigned int i; - unsigned int j; - - for (i = 0; i < xctrls_count; ++i) { -- ctrl = uvc_find_control(handle->chain, xctrls[i].id, &mapping); -+ u32 changes = V4L2_EVENT_CTRL_CH_VALUE; - -+ ctrl = uvc_find_control(handle->chain, xctrls[i].id, &mapping); - if (ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS) - /* Notification will be sent from an Interrupt event. */ - continue; -diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c -index 1b05890f99f4f4..95c5b90f3e7c11 100644 ---- a/drivers/media/usb/uvc/uvc_driver.c -+++ b/drivers/media/usb/uvc/uvc_driver.c -@@ -775,27 +775,14 @@ static const u8 uvc_media_transport_input_guid[16] = - UVC_GUID_UVC_MEDIA_TRANSPORT_INPUT; - static const u8 uvc_processing_guid[16] = UVC_GUID_UVC_PROCESSING; - --static struct uvc_entity *uvc_alloc_new_entity(struct uvc_device *dev, u16 type, -- u16 id, unsigned int num_pads, -- unsigned int extra_size) -+static struct uvc_entity *uvc_alloc_entity(u16 type, u16 id, -+ unsigned int num_pads, unsigned int extra_size) - { - struct uvc_entity *entity; - unsigned int num_inputs; - unsigned int size; - unsigned int i; - -- /* Per UVC 1.1+ spec 3.7.2, the ID should be non-zero. */ -- if (id == 0) { -- dev_err(&dev->udev->dev, "Found Unit with invalid ID 0.\n"); -- return ERR_PTR(-EINVAL); -- } -- -- /* Per UVC 1.1+ spec 3.7.2, the ID is unique. */ -- if (uvc_entity_by_id(dev, id)) { -- dev_err(&dev->udev->dev, "Found multiple Units with ID %u\n", id); -- return ERR_PTR(-EINVAL); -- } -- - extra_size = roundup(extra_size, sizeof(*entity->pads)); - if (num_pads) - num_inputs = type & UVC_TERM_OUTPUT ? num_pads : num_pads - 1; -@@ -805,7 +792,7 @@ static struct uvc_entity *uvc_alloc_new_entity(struct uvc_device *dev, u16 type, - + num_inputs; - entity = kzalloc(size, GFP_KERNEL); - if (entity == NULL) -- return ERR_PTR(-ENOMEM); -+ return NULL; - - entity->id = id; - entity->type = type; -@@ -917,10 +904,10 @@ static int uvc_parse_vendor_control(struct uvc_device *dev, - break; - } - -- unit = uvc_alloc_new_entity(dev, UVC_VC_EXTENSION_UNIT, -- buffer[3], p + 1, 2 * n); -- if (IS_ERR(unit)) -- return PTR_ERR(unit); -+ unit = uvc_alloc_entity(UVC_VC_EXTENSION_UNIT, buffer[3], -+ p + 1, 2*n); -+ if (unit == NULL) -+ return -ENOMEM; - - memcpy(unit->guid, &buffer[4], 16); - unit->extension.bNumControls = buffer[20]; -@@ -1029,10 +1016,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev, - return -EINVAL; - } - -- term = uvc_alloc_new_entity(dev, type | UVC_TERM_INPUT, -- buffer[3], 1, n + p); -- if (IS_ERR(term)) -- return PTR_ERR(term); -+ term = uvc_alloc_entity(type | UVC_TERM_INPUT, buffer[3], -+ 1, n + p); -+ if (term == NULL) -+ return -ENOMEM; - - if (UVC_ENTITY_TYPE(term) == UVC_ITT_CAMERA) { - term->camera.bControlSize = n; -@@ -1088,10 +1075,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev, - return 0; - } - -- term = uvc_alloc_new_entity(dev, type | UVC_TERM_OUTPUT, -- buffer[3], 1, 0); -- if (IS_ERR(term)) -- return PTR_ERR(term); -+ term = uvc_alloc_entity(type | UVC_TERM_OUTPUT, buffer[3], -+ 1, 0); -+ if (term == NULL) -+ return -ENOMEM; - - memcpy(term->baSourceID, &buffer[7], 1); - -@@ -1110,10 +1097,9 @@ static int uvc_parse_standard_control(struct uvc_device *dev, - return -EINVAL; - } - -- unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3], -- p + 1, 0); -- if (IS_ERR(unit)) -- return PTR_ERR(unit); -+ unit = uvc_alloc_entity(buffer[2], buffer[3], p + 1, 0); -+ if (unit == NULL) -+ return -ENOMEM; - - memcpy(unit->baSourceID, &buffer[5], p); - -@@ -1133,9 +1119,9 @@ static int uvc_parse_standard_control(struct uvc_device *dev, - return -EINVAL; - } - -- unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3], 2, n); -- if (IS_ERR(unit)) -- return PTR_ERR(unit); -+ unit = uvc_alloc_entity(buffer[2], buffer[3], 2, n); -+ if (unit == NULL) -+ return -ENOMEM; - - memcpy(unit->baSourceID, &buffer[4], 1); - unit->processing.wMaxMultiplier = -@@ -1162,10 +1148,9 @@ static int uvc_parse_standard_control(struct uvc_device *dev, - return -EINVAL; - } - -- unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3], -- p + 1, n); -- if (IS_ERR(unit)) -- return PTR_ERR(unit); -+ unit = uvc_alloc_entity(buffer[2], buffer[3], p + 1, n); -+ if (unit == NULL) -+ return -ENOMEM; - - memcpy(unit->guid, &buffer[4], 16); - unit->extension.bNumControls = buffer[20]; -@@ -1295,20 +1280,19 @@ static int uvc_gpio_parse(struct uvc_device *dev) - struct gpio_desc *gpio_privacy; - int irq; - -- gpio_privacy = devm_gpiod_get_optional(&dev->udev->dev, "privacy", -+ gpio_privacy = devm_gpiod_get_optional(&dev->intf->dev, "privacy", - GPIOD_IN); - if (IS_ERR_OR_NULL(gpio_privacy)) - return PTR_ERR_OR_ZERO(gpio_privacy); - - irq = gpiod_to_irq(gpio_privacy); - if (irq < 0) -- return dev_err_probe(&dev->udev->dev, irq, -+ return dev_err_probe(&dev->intf->dev, irq, - "No IRQ for privacy GPIO\n"); - -- unit = uvc_alloc_new_entity(dev, UVC_EXT_GPIO_UNIT, -- UVC_EXT_GPIO_UNIT_ID, 0, 1); -- if (IS_ERR(unit)) -- return PTR_ERR(unit); -+ unit = uvc_alloc_entity(UVC_EXT_GPIO_UNIT, UVC_EXT_GPIO_UNIT_ID, 0, 1); -+ if (!unit) -+ return -ENOMEM; - - unit->gpio.gpio_privacy = gpio_privacy; - unit->gpio.irq = irq; -@@ -1329,15 +1313,27 @@ static int uvc_gpio_parse(struct uvc_device *dev) - static int uvc_gpio_init_irq(struct uvc_device *dev) - { - struct uvc_entity *unit = dev->gpio_unit; -+ int ret; - - if (!unit || unit->gpio.irq < 0) - return 0; - -- return devm_request_threaded_irq(&dev->udev->dev, unit->gpio.irq, NULL, -- uvc_gpio_irq, -- IRQF_ONESHOT | IRQF_TRIGGER_FALLING | -- IRQF_TRIGGER_RISING, -- "uvc_privacy_gpio", dev); -+ ret = request_threaded_irq(unit->gpio.irq, NULL, uvc_gpio_irq, -+ IRQF_ONESHOT | IRQF_TRIGGER_FALLING | -+ IRQF_TRIGGER_RISING, -+ "uvc_privacy_gpio", dev); -+ -+ unit->gpio.initialized = !ret; -+ -+ return ret; -+} -+ -+static void uvc_gpio_deinit(struct uvc_device *dev) -+{ -+ if (!dev->gpio_unit || !dev->gpio_unit->gpio.initialized) -+ return; -+ -+ free_irq(dev->gpio_unit->gpio.irq, dev); - } - - /* ------------------------------------------------------------------------ -@@ -1934,6 +1930,8 @@ static void uvc_unregister_video(struct uvc_device *dev) - { - struct uvc_streaming *stream; - -+ uvc_gpio_deinit(dev); -+ - list_for_each_entry(stream, &dev->streams, list) { - /* Nothing to do here, continue. */ - if (!video_is_registered(&stream->vdev)) -diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c -index 91c350b2541267..a2504e1e991b93 100644 ---- a/drivers/media/usb/uvc/uvc_video.c -+++ b/drivers/media/usb/uvc/uvc_video.c -@@ -79,6 +79,27 @@ int uvc_query_ctrl(struct uvc_device *dev, u8 query, u8 unit, - if (likely(ret == size)) - return 0; - -+ /* -+ * Some devices return shorter USB control packets than expected if the -+ * returned value can fit in less bytes. Zero all the bytes that the -+ * device has not written. -+ * -+ * This quirk is applied to all controls, regardless of their data type. -+ * Most controls are little-endian integers, in which case the missing -+ * bytes become 0 MSBs. For other data types, a different heuristic -+ * could be implemented if a device is found needing it. -+ * -+ * We exclude UVC_GET_INFO from the quirk. UVC_GET_LEN does not need -+ * to be excluded because its size is always 1. -+ */ -+ if (ret > 0 && query != UVC_GET_INFO) { -+ memset(data + ret, 0, size - ret); -+ dev_warn_once(&dev->udev->dev, -+ "UVC non compliance: %s control %u on unit %u returned %d bytes when we expected %u.\n", -+ uvc_query_name(query), cs, unit, ret, size); -+ return 0; -+ } -+ - if (ret != -EPIPE) { - dev_err(&dev->udev->dev, - "Failed to query (%s) UVC control %u on unit %u: %d (exp. %u).\n", -diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h -index e5b12717016fa3..997f4b5b5e22ac 100644 ---- a/drivers/media/usb/uvc/uvcvideo.h -+++ b/drivers/media/usb/uvc/uvcvideo.h -@@ -229,6 +229,7 @@ struct uvc_entity { - u8 *bmControls; - struct gpio_desc *gpio_privacy; - int irq; -+ bool initialized; - } gpio; - }; - -diff --git a/drivers/media/v4l2-core/v4l2-mc.c b/drivers/media/v4l2-core/v4l2-mc.c -index 52d349e72b8ca5..788a4ac3805751 100644 ---- a/drivers/media/v4l2-core/v4l2-mc.c -+++ b/drivers/media/v4l2-core/v4l2-mc.c -@@ -329,7 +329,7 @@ int v4l2_create_fwnode_links_to_pad(struct v4l2_subdev *src_sd, - if (!(sink->flags & MEDIA_PAD_FL_SINK)) - return -EINVAL; - -- fwnode_graph_for_each_endpoint(dev_fwnode(src_sd->dev), endpoint) { -+ fwnode_graph_for_each_endpoint(src_sd->fwnode, endpoint) { - struct fwnode_handle *remote_ep; - int src_idx, sink_idx, ret; - struct media_pad *src; -diff --git a/drivers/mfd/lpc_ich.c b/drivers/mfd/lpc_ich.c -index 7b1c597b6879fb..03367fcac42a7f 100644 ---- a/drivers/mfd/lpc_ich.c -+++ b/drivers/mfd/lpc_ich.c -@@ -756,8 +756,9 @@ static const struct pci_device_id lpc_ich_ids[] = { - { PCI_VDEVICE(INTEL, 0x2917), LPC_ICH9ME}, - { PCI_VDEVICE(INTEL, 0x2918), LPC_ICH9}, - { PCI_VDEVICE(INTEL, 0x2919), LPC_ICH9M}, -- { PCI_VDEVICE(INTEL, 0x3197), LPC_GLK}, - { PCI_VDEVICE(INTEL, 0x2b9c), LPC_COUGARMOUNTAIN}, -+ { PCI_VDEVICE(INTEL, 0x3197), LPC_GLK}, -+ { PCI_VDEVICE(INTEL, 0x31e8), LPC_GLK}, - { PCI_VDEVICE(INTEL, 0x3a14), LPC_ICH10DO}, - { PCI_VDEVICE(INTEL, 0x3a16), LPC_ICH10R}, - { PCI_VDEVICE(INTEL, 0x3a18), LPC_ICH10}, -diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c -index 4df0d7a0cd1184..fc021e265edc01 100644 ---- a/drivers/misc/fastrpc.c -+++ b/drivers/misc/fastrpc.c -@@ -988,7 +988,7 @@ static int fastrpc_get_args(u32 kernel, struct fastrpc_invoke_ctx *ctx) - mmap_read_lock(current->mm); - vma = find_vma(current->mm, ctx->args[i].ptr); - if (vma) -- pages[i].addr += ctx->args[i].ptr - -+ pages[i].addr += (ctx->args[i].ptr & PAGE_MASK) - - vma->vm_start; - mmap_read_unlock(current->mm); - -@@ -1015,8 +1015,8 @@ static int fastrpc_get_args(u32 kernel, struct fastrpc_invoke_ctx *ctx) - (pkt_size - rlen); - pages[i].addr = pages[i].addr & PAGE_MASK; - -- pg_start = (args & PAGE_MASK) >> PAGE_SHIFT; -- pg_end = ((args + len - 1) & PAGE_MASK) >> PAGE_SHIFT; -+ pg_start = (rpra[i].buf.pv & PAGE_MASK) >> PAGE_SHIFT; -+ pg_end = ((rpra[i].buf.pv + len - 1) & PAGE_MASK) >> PAGE_SHIFT; - pages[i].size = (pg_end - pg_start + 1) * PAGE_SIZE; - args = args + mlen; - rlen -= mlen; -@@ -2327,7 +2327,7 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev) - - err = fastrpc_device_register(rdev, data, false, domains[domain_id]); - if (err) -- goto fdev_error; -+ goto populate_error; - break; - default: - err = -EINVAL; -diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c -index 5914516df2f7fd..cb87e827377934 100644 ---- a/drivers/mmc/core/sdio.c -+++ b/drivers/mmc/core/sdio.c -@@ -458,6 +458,8 @@ static unsigned mmc_sdio_get_max_clock(struct mmc_card *card) - if (mmc_card_sd_combo(card)) - max_dtr = min(max_dtr, mmc_sd_get_max_clock(card)); - -+ max_dtr = min_not_zero(max_dtr, card->quirk_max_rate); -+ - return max_dtr; - } - -diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c -index 8716004fcf6c90..945d08531de376 100644 ---- a/drivers/mmc/host/sdhci-msm.c -+++ b/drivers/mmc/host/sdhci-msm.c -@@ -134,9 +134,18 @@ - /* Timeout value to avoid infinite waiting for pwr_irq */ - #define MSM_PWR_IRQ_TIMEOUT_MS 5000 - -+/* Max load for eMMC Vdd supply */ -+#define MMC_VMMC_MAX_LOAD_UA 570000 -+ - /* Max load for eMMC Vdd-io supply */ - #define MMC_VQMMC_MAX_LOAD_UA 325000 - -+/* Max load for SD Vdd supply */ -+#define SD_VMMC_MAX_LOAD_UA 800000 -+ -+/* Max load for SD Vdd-io supply */ -+#define SD_VQMMC_MAX_LOAD_UA 22000 -+ - #define msm_host_readl(msm_host, host, offset) \ - msm_host->var_ops->msm_readl_relaxed(host, offset) - -@@ -1403,11 +1412,48 @@ static int sdhci_msm_set_pincfg(struct sdhci_msm_host *msm_host, bool level) - return ret; - } - --static int sdhci_msm_set_vmmc(struct mmc_host *mmc) -+static void msm_config_vmmc_regulator(struct mmc_host *mmc, bool hpm) -+{ -+ int load; -+ -+ if (!hpm) -+ load = 0; -+ else if (!mmc->card) -+ load = max(MMC_VMMC_MAX_LOAD_UA, SD_VMMC_MAX_LOAD_UA); -+ else if (mmc_card_mmc(mmc->card)) -+ load = MMC_VMMC_MAX_LOAD_UA; -+ else if (mmc_card_sd(mmc->card)) -+ load = SD_VMMC_MAX_LOAD_UA; -+ else -+ return; -+ -+ regulator_set_load(mmc->supply.vmmc, load); -+} -+ -+static void msm_config_vqmmc_regulator(struct mmc_host *mmc, bool hpm) -+{ -+ int load; -+ -+ if (!hpm) -+ load = 0; -+ else if (!mmc->card) -+ load = max(MMC_VQMMC_MAX_LOAD_UA, SD_VQMMC_MAX_LOAD_UA); -+ else if (mmc_card_sd(mmc->card)) -+ load = SD_VQMMC_MAX_LOAD_UA; -+ else -+ return; -+ -+ regulator_set_load(mmc->supply.vqmmc, load); -+} -+ -+static int sdhci_msm_set_vmmc(struct sdhci_msm_host *msm_host, -+ struct mmc_host *mmc, bool hpm) - { - if (IS_ERR(mmc->supply.vmmc)) - return 0; - -+ msm_config_vmmc_regulator(mmc, hpm); -+ - return mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, mmc->ios.vdd); - } - -@@ -1420,6 +1466,8 @@ static int msm_toggle_vqmmc(struct sdhci_msm_host *msm_host, - if (msm_host->vqmmc_enabled == level) - return 0; - -+ msm_config_vqmmc_regulator(mmc, level); -+ - if (level) { - /* Set the IO voltage regulator to default voltage level */ - if (msm_host->caps_0 & CORE_3_0V_SUPPORT) -@@ -1642,7 +1690,8 @@ static void sdhci_msm_handle_pwr_irq(struct sdhci_host *host, int irq) - } - - if (pwr_state) { -- ret = sdhci_msm_set_vmmc(mmc); -+ ret = sdhci_msm_set_vmmc(msm_host, mmc, -+ pwr_state & REQ_BUS_ON); - if (!ret) - ret = sdhci_msm_set_vqmmc(msm_host, mmc, - pwr_state & REQ_BUS_ON); -diff --git a/drivers/mtd/nand/onenand/onenand_base.c b/drivers/mtd/nand/onenand/onenand_base.c -index f66385faf631cd..0dc2ea4fc857b7 100644 ---- a/drivers/mtd/nand/onenand/onenand_base.c -+++ b/drivers/mtd/nand/onenand/onenand_base.c -@@ -2923,6 +2923,7 @@ static int do_otp_read(struct mtd_info *mtd, loff_t from, size_t len, - ret = ONENAND_IS_4KB_PAGE(this) ? - onenand_mlc_read_ops_nolock(mtd, from, &ops) : - onenand_read_ops_nolock(mtd, from, &ops); -+ *retlen = ops.retlen; - - /* Exit OTP access mode */ - this->command(mtd, ONENAND_CMD_RESET, 0, 0); -diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c -index 8ee51e49fced55..144aa76d13e904 100644 ---- a/drivers/mtd/ubi/build.c -+++ b/drivers/mtd/ubi/build.c -@@ -1462,7 +1462,7 @@ static int ubi_mtd_param_parse(const char *val, const struct kernel_param *kp) - if (token) { - int err = kstrtoint(token, 10, &p->ubi_num); - -- if (err) { -+ if (err || p->ubi_num < UBI_DEV_NUM_AUTO) { - pr_err("UBI error: bad value for ubi_num parameter: %s\n", - token); - return -EINVAL; -diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c -index d6d6d5d37ff3e6..c9b0d57696a487 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c -+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c -@@ -1441,7 +1441,9 @@ void aq_nic_deinit(struct aq_nic_s *self, bool link_down) - aq_ptp_ring_free(self); - aq_ptp_free(self); - -- if (likely(self->aq_fw_ops->deinit) && link_down) { -+ /* May be invoked during hot unplug. */ -+ if (pci_device_is_present(self->pdev) && -+ likely(self->aq_fw_ops->deinit) && link_down) { - mutex_lock(&self->fwreq_mutex); - self->aq_fw_ops->deinit(self->aq_hw); - mutex_unlock(&self->fwreq_mutex); -diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c -index 0715ea5bf13ed9..3b082114f2e538 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c -+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c -@@ -41,9 +41,12 @@ void bcmgenet_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol) - { - struct bcmgenet_priv *priv = netdev_priv(dev); - struct device *kdev = &priv->pdev->dev; -+ u32 phy_wolopts = 0; - -- if (dev->phydev) -+ if (dev->phydev) { - phy_ethtool_get_wol(dev->phydev, wol); -+ phy_wolopts = wol->wolopts; -+ } - - /* MAC is not wake-up capable, return what the PHY does */ - if (!device_can_wakeup(kdev)) -@@ -51,9 +54,14 @@ void bcmgenet_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol) - - /* Overlay MAC capabilities with that of the PHY queried before */ - wol->supported |= WAKE_MAGIC | WAKE_MAGICSECURE | WAKE_FILTER; -- wol->wolopts = priv->wolopts; -- memset(wol->sopass, 0, sizeof(wol->sopass)); -+ wol->wolopts |= priv->wolopts; - -+ /* Return the PHY configured magic password */ -+ if (phy_wolopts & WAKE_MAGICSECURE) -+ return; -+ -+ /* Otherwise the MAC one */ -+ memset(wol->sopass, 0, sizeof(wol->sopass)); - if (wol->wolopts & WAKE_MAGICSECURE) - memcpy(wol->sopass, priv->sopass, sizeof(priv->sopass)); - } -@@ -70,7 +78,7 @@ int bcmgenet_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol) - /* Try Wake-on-LAN from the PHY first */ - if (dev->phydev) { - ret = phy_ethtool_set_wol(dev->phydev, wol); -- if (ret != -EOPNOTSUPP) -+ if (ret != -EOPNOTSUPP && wol->wolopts) - return ret; - } - -diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c -index 7f74e5e106d9d4..b3878975bd9c05 100644 ---- a/drivers/net/ethernet/broadcom/tg3.c -+++ b/drivers/net/ethernet/broadcom/tg3.c -@@ -55,6 +55,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -18106,6 +18107,50 @@ static int tg3_resume(struct device *device) - - static SIMPLE_DEV_PM_OPS(tg3_pm_ops, tg3_suspend, tg3_resume); - -+/* Systems where ACPI _PTS (Prepare To Sleep) S5 will result in a fatal -+ * PCIe AER event on the tg3 device if the tg3 device is not, or cannot -+ * be, powered down. -+ */ -+static const struct dmi_system_id tg3_restart_aer_quirk_table[] = { -+ { -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge R440"), -+ }, -+ }, -+ { -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge R540"), -+ }, -+ }, -+ { -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge R640"), -+ }, -+ }, -+ { -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge R650"), -+ }, -+ }, -+ { -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge R740"), -+ }, -+ }, -+ { -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge R750"), -+ }, -+ }, -+ {} -+}; -+ - static void tg3_shutdown(struct pci_dev *pdev) - { - struct net_device *dev = pci_get_drvdata(pdev); -@@ -18122,6 +18167,19 @@ static void tg3_shutdown(struct pci_dev *pdev) - - if (system_state == SYSTEM_POWER_OFF) - tg3_power_down(tp); -+ else if (system_state == SYSTEM_RESTART && -+ dmi_first_match(tg3_restart_aer_quirk_table) && -+ pdev->current_state != PCI_D3cold && -+ pdev->current_state != PCI_UNKNOWN) { -+ /* Disable PCIe AER on the tg3 to avoid a fatal -+ * error during this system restart. -+ */ -+ pcie_capability_clear_word(pdev, PCI_EXP_DEVCTL, -+ PCI_EXP_DEVCTL_CERE | -+ PCI_EXP_DEVCTL_NFERE | -+ PCI_EXP_DEVCTL_FERE | -+ PCI_EXP_DEVCTL_URRE); -+ } - - rtnl_unlock(); - -diff --git a/drivers/net/ethernet/intel/ice/ice_devlink.c b/drivers/net/ethernet/intel/ice/ice_devlink.c -index 80dc5445b50d45..030ca0ef71d876 100644 ---- a/drivers/net/ethernet/intel/ice/ice_devlink.c -+++ b/drivers/net/ethernet/intel/ice/ice_devlink.c -@@ -999,6 +999,9 @@ static int ice_devlink_rate_node_new(struct devlink_rate *rate_node, void **priv - - /* preallocate memory for ice_sched_node */ - node = devm_kzalloc(ice_hw_to_dev(pi->hw), sizeof(*node), GFP_KERNEL); -+ if (!node) -+ return -ENOMEM; -+ - *priv = node; - - return 0; -diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c -index 429afffa4c3169..f5023ac9ab8323 100644 ---- a/drivers/net/ethernet/intel/ice/ice_txrx.c -+++ b/drivers/net/ethernet/intel/ice/ice_txrx.c -@@ -1101,6 +1101,49 @@ ice_put_rx_buf(struct ice_rx_ring *rx_ring, struct ice_rx_buf *rx_buf) - rx_buf->page = NULL; - } - -+/** -+ * ice_put_rx_mbuf - ice_put_rx_buf() caller, for all frame frags -+ * @rx_ring: Rx ring with all the auxiliary data -+ * @xdp: XDP buffer carrying linear + frags part -+ * @xdp_xmit: XDP_TX/XDP_REDIRECT verdict storage -+ * @ntc: a current next_to_clean value to be stored at rx_ring -+ * -+ * Walk through gathered fragments and satisfy internal page -+ * recycle mechanism; we take here an action related to verdict -+ * returned by XDP program; -+ */ -+static void ice_put_rx_mbuf(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp, -+ u32 *xdp_xmit, u32 ntc) -+{ -+ u32 nr_frags = rx_ring->nr_frags + 1; -+ u32 idx = rx_ring->first_desc; -+ u32 cnt = rx_ring->count; -+ struct ice_rx_buf *buf; -+ int i; -+ -+ for (i = 0; i < nr_frags; i++) { -+ buf = &rx_ring->rx_buf[idx]; -+ -+ if (buf->act & (ICE_XDP_TX | ICE_XDP_REDIR)) { -+ ice_rx_buf_adjust_pg_offset(buf, xdp->frame_sz); -+ *xdp_xmit |= buf->act; -+ } else if (buf->act & ICE_XDP_CONSUMED) { -+ buf->pagecnt_bias++; -+ } else if (buf->act == ICE_XDP_PASS) { -+ ice_rx_buf_adjust_pg_offset(buf, xdp->frame_sz); -+ } -+ -+ ice_put_rx_buf(rx_ring, buf); -+ -+ if (++idx == cnt) -+ idx = 0; -+ } -+ -+ xdp->data = NULL; -+ rx_ring->first_desc = ntc; -+ rx_ring->nr_frags = 0; -+} -+ - /** - * ice_clean_rx_irq - Clean completed descriptors from Rx ring - bounce buf - * @rx_ring: Rx descriptor ring to transact packets on -@@ -1118,7 +1161,6 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget) - unsigned int total_rx_bytes = 0, total_rx_pkts = 0; - unsigned int offset = rx_ring->rx_offset; - struct xdp_buff *xdp = &rx_ring->xdp; -- u32 cached_ntc = rx_ring->first_desc; - struct ice_tx_ring *xdp_ring = NULL; - struct bpf_prog *xdp_prog = NULL; - u32 ntc = rx_ring->next_to_clean; -@@ -1126,7 +1168,6 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget) - u32 xdp_xmit = 0; - u32 cached_ntu; - bool failure; -- u32 first; - - xdp_prog = READ_ONCE(rx_ring->xdp_prog); - if (xdp_prog) { -@@ -1189,6 +1230,7 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget) - xdp_prepare_buff(xdp, hard_start, offset, size, !!offset); - xdp_buff_clear_frags_flag(xdp); - } else if (ice_add_xdp_frag(rx_ring, xdp, rx_buf, size)) { -+ ice_put_rx_mbuf(rx_ring, xdp, NULL, ntc); - break; - } - if (++ntc == cnt) -@@ -1204,9 +1246,8 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget) - total_rx_bytes += xdp_get_buff_len(xdp); - total_rx_pkts++; - -- xdp->data = NULL; -- rx_ring->first_desc = ntc; -- rx_ring->nr_frags = 0; -+ ice_put_rx_mbuf(rx_ring, xdp, &xdp_xmit, ntc); -+ - continue; - construct_skb: - if (likely(ice_ring_uses_build_skb(rx_ring))) -@@ -1220,14 +1261,11 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget) - if (unlikely(xdp_buff_has_frags(xdp))) - ice_set_rx_bufs_act(xdp, rx_ring, - ICE_XDP_CONSUMED); -- xdp->data = NULL; -- rx_ring->first_desc = ntc; -- rx_ring->nr_frags = 0; -- break; - } -- xdp->data = NULL; -- rx_ring->first_desc = ntc; -- rx_ring->nr_frags = 0; -+ ice_put_rx_mbuf(rx_ring, xdp, &xdp_xmit, ntc); -+ -+ if (!skb) -+ break; - - stat_err_bits = BIT(ICE_RX_FLEX_DESC_STATUS0_RXE_S); - if (unlikely(ice_test_staterr(rx_desc->wb.status_error0, -@@ -1259,23 +1297,6 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget) - total_rx_pkts++; - } - -- first = rx_ring->first_desc; -- while (cached_ntc != first) { -- struct ice_rx_buf *buf = &rx_ring->rx_buf[cached_ntc]; -- -- if (buf->act & (ICE_XDP_TX | ICE_XDP_REDIR)) { -- ice_rx_buf_adjust_pg_offset(buf, xdp->frame_sz); -- xdp_xmit |= buf->act; -- } else if (buf->act & ICE_XDP_CONSUMED) { -- buf->pagecnt_bias++; -- } else if (buf->act == ICE_XDP_PASS) { -- ice_rx_buf_adjust_pg_offset(buf, xdp->frame_sz); -- } -- -- ice_put_rx_buf(rx_ring, buf); -- if (++cached_ntc >= cnt) -- cached_ntc = 0; -- } - rx_ring->next_to_clean = ntc; - /* return up to cleaned_count buffers to hardware */ - failure = ice_alloc_rx_bufs(rx_ring, ICE_RX_DESC_UNUSED(rx_ring)); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -index 0c83ef174275a7..f00702bf781f17 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -@@ -237,17 +237,16 @@ static void mlx5_pps_out(struct work_struct *work) - } - } - --static void mlx5_timestamp_overflow(struct work_struct *work) -+static long mlx5_timestamp_overflow(struct ptp_clock_info *ptp_info) - { -- struct delayed_work *dwork = to_delayed_work(work); - struct mlx5_core_dev *mdev; - struct mlx5_timer *timer; - struct mlx5_clock *clock; - unsigned long flags; - -- timer = container_of(dwork, struct mlx5_timer, overflow_work); -- clock = container_of(timer, struct mlx5_clock, timer); -+ clock = container_of(ptp_info, struct mlx5_clock, ptp_info); - mdev = container_of(clock, struct mlx5_core_dev, clock); -+ timer = &clock->timer; - - if (mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) - goto out; -@@ -258,7 +257,7 @@ static void mlx5_timestamp_overflow(struct work_struct *work) - write_sequnlock_irqrestore(&clock->lock, flags); - - out: -- schedule_delayed_work(&timer->overflow_work, timer->overflow_period); -+ return timer->overflow_period; - } - - static int mlx5_ptp_settime_real_time(struct mlx5_core_dev *mdev, -@@ -435,6 +434,7 @@ static int mlx5_ptp_adjfine(struct ptp_clock_info *ptp, long scaled_ppm) - timer->cycles.mult = mult; - mlx5_update_clock_info_page(mdev); - write_sequnlock_irqrestore(&clock->lock, flags); -+ ptp_schedule_worker(clock->ptp, timer->overflow_period); - - return 0; - } -@@ -770,6 +770,7 @@ static const struct ptp_clock_info mlx5_ptp_clock_info = { - .settime64 = mlx5_ptp_settime, - .enable = NULL, - .verify = NULL, -+ .do_aux_work = mlx5_timestamp_overflow, - }; - - static int mlx5_query_mtpps_pin_mode(struct mlx5_core_dev *mdev, u8 pin, -@@ -970,12 +971,11 @@ static void mlx5_init_overflow_period(struct mlx5_clock *clock) - do_div(ns, NSEC_PER_SEC / HZ); - timer->overflow_period = ns; - -- INIT_DELAYED_WORK(&timer->overflow_work, mlx5_timestamp_overflow); -- if (timer->overflow_period) -- schedule_delayed_work(&timer->overflow_work, 0); -- else -+ if (!timer->overflow_period) { -+ timer->overflow_period = HZ; - mlx5_core_warn(mdev, -- "invalid overflow period, overflow_work is not scheduled\n"); -+ "invalid overflow period, overflow_work is scheduled once per second\n"); -+ } - - if (clock_info) - clock_info->overflow_period = timer->overflow_period; -@@ -1061,6 +1061,9 @@ void mlx5_init_clock(struct mlx5_core_dev *mdev) - - MLX5_NB_INIT(&clock->pps_nb, mlx5_pps_event, PPS_EVENT); - mlx5_eq_notifier_register(mdev, &clock->pps_nb); -+ -+ if (clock->ptp) -+ ptp_schedule_worker(clock->ptp, 0); - } - - void mlx5_cleanup_clock(struct mlx5_core_dev *mdev) -@@ -1077,7 +1080,6 @@ void mlx5_cleanup_clock(struct mlx5_core_dev *mdev) - } - - cancel_work_sync(&clock->pps_info.out_work); -- cancel_delayed_work_sync(&clock->timer.overflow_work); - - if (mdev->clock_info) { - free_page((unsigned long)mdev->clock_info); -diff --git a/drivers/net/phy/nxp-c45-tja11xx.c b/drivers/net/phy/nxp-c45-tja11xx.c -index 7ab080ff02dfa6..77292c944c76d2 100644 ---- a/drivers/net/phy/nxp-c45-tja11xx.c -+++ b/drivers/net/phy/nxp-c45-tja11xx.c -@@ -1302,6 +1302,8 @@ static int nxp_c45_soft_reset(struct phy_device *phydev) - if (ret) - return ret; - -+ usleep_range(2000, 2050); -+ - return phy_read_mmd_poll_timeout(phydev, MDIO_MMD_VEND1, - VEND1_DEVICE_CONTROL, ret, - !(ret & DEVICE_CONTROL_RESET), 20000, -diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index cbb2f78ffde03c..c1fdf8804d60b6 100644 ---- a/drivers/net/tun.c -+++ b/drivers/net/tun.c -@@ -580,7 +580,7 @@ static inline bool tun_not_capable(struct tun_struct *tun) - struct net *net = dev_net(tun->dev); - - return ((uid_valid(tun->owner) && !uid_eq(cred->euid, tun->owner)) || -- (gid_valid(tun->group) && !in_egroup_p(tun->group))) && -+ (gid_valid(tun->group) && !in_egroup_p(tun->group))) && - !ns_capable(net->user_ns, CAP_NET_ADMIN); - } - -diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c -index 46afb95ffabe3b..a19789b571905a 100644 ---- a/drivers/net/usb/ipheth.c -+++ b/drivers/net/usb/ipheth.c -@@ -61,7 +61,18 @@ - #define IPHETH_USBINTF_PROTO 1 - - #define IPHETH_IP_ALIGN 2 /* padding at front of URB */ --#define IPHETH_NCM_HEADER_SIZE (12 + 96) /* NCMH + NCM0 */ -+/* On iOS devices, NCM headers in RX have a fixed size regardless of DPE count: -+ * - NTH16 (NCMH): 12 bytes, as per CDC NCM 1.0 spec -+ * - NDP16 (NCM0): 96 bytes, of which -+ * - NDP16 fixed header: 8 bytes -+ * - maximum of 22 DPEs (21 datagrams + trailer), 4 bytes each -+ */ -+#define IPHETH_NDP16_MAX_DPE 22 -+#define IPHETH_NDP16_HEADER_SIZE (sizeof(struct usb_cdc_ncm_ndp16) + \ -+ IPHETH_NDP16_MAX_DPE * \ -+ sizeof(struct usb_cdc_ncm_dpe16)) -+#define IPHETH_NCM_HEADER_SIZE (sizeof(struct usb_cdc_ncm_nth16) + \ -+ IPHETH_NDP16_HEADER_SIZE) - #define IPHETH_TX_BUF_SIZE ETH_FRAME_LEN - #define IPHETH_RX_BUF_SIZE_LEGACY (IPHETH_IP_ALIGN + ETH_FRAME_LEN) - #define IPHETH_RX_BUF_SIZE_NCM 65536 -@@ -207,15 +218,23 @@ static int ipheth_rcvbulk_callback_legacy(struct urb *urb) - return ipheth_consume_skb(buf, len, dev); - } - -+/* In "NCM mode", the iOS device encapsulates RX (phone->computer) traffic -+ * in NCM Transfer Blocks (similarly to CDC NCM). However, unlike reverse -+ * tethering (handled by the `cdc_ncm` driver), regular tethering is not -+ * compliant with the CDC NCM spec, as the device is missing the necessary -+ * descriptors, and TX (computer->phone) traffic is not encapsulated -+ * at all. Thus `ipheth` implements a very limited subset of the spec with -+ * the sole purpose of parsing RX URBs. -+ */ - static int ipheth_rcvbulk_callback_ncm(struct urb *urb) - { - struct usb_cdc_ncm_nth16 *ncmh; - struct usb_cdc_ncm_ndp16 *ncm0; - struct usb_cdc_ncm_dpe16 *dpe; - struct ipheth_device *dev; -+ u16 dg_idx, dg_len; - int retval = -EINVAL; - char *buf; -- int len; - - dev = urb->context; - -@@ -226,40 +245,42 @@ static int ipheth_rcvbulk_callback_ncm(struct urb *urb) - - ncmh = urb->transfer_buffer; - if (ncmh->dwSignature != cpu_to_le32(USB_CDC_NCM_NTH16_SIGN) || -- le16_to_cpu(ncmh->wNdpIndex) >= urb->actual_length) { -- dev->net->stats.rx_errors++; -- return retval; -- } -+ /* On iOS, NDP16 directly follows NTH16 */ -+ ncmh->wNdpIndex != cpu_to_le16(sizeof(struct usb_cdc_ncm_nth16))) -+ goto rx_error; - -- ncm0 = urb->transfer_buffer + le16_to_cpu(ncmh->wNdpIndex); -- if (ncm0->dwSignature != cpu_to_le32(USB_CDC_NCM_NDP16_NOCRC_SIGN) || -- le16_to_cpu(ncmh->wHeaderLength) + le16_to_cpu(ncm0->wLength) >= -- urb->actual_length) { -- dev->net->stats.rx_errors++; -- return retval; -- } -+ ncm0 = urb->transfer_buffer + sizeof(struct usb_cdc_ncm_nth16); -+ if (ncm0->dwSignature != cpu_to_le32(USB_CDC_NCM_NDP16_NOCRC_SIGN)) -+ goto rx_error; - - dpe = ncm0->dpe16; -- while (le16_to_cpu(dpe->wDatagramIndex) != 0 && -- le16_to_cpu(dpe->wDatagramLength) != 0) { -- if (le16_to_cpu(dpe->wDatagramIndex) >= urb->actual_length || -- le16_to_cpu(dpe->wDatagramIndex) + -- le16_to_cpu(dpe->wDatagramLength) > urb->actual_length) { -+ for (int dpe_i = 0; dpe_i < IPHETH_NDP16_MAX_DPE; ++dpe_i, ++dpe) { -+ dg_idx = le16_to_cpu(dpe->wDatagramIndex); -+ dg_len = le16_to_cpu(dpe->wDatagramLength); -+ -+ /* Null DPE must be present after last datagram pointer entry -+ * (3.3.1 USB CDC NCM spec v1.0) -+ */ -+ if (dg_idx == 0 && dg_len == 0) -+ return 0; -+ -+ if (dg_idx < IPHETH_NCM_HEADER_SIZE || -+ dg_idx >= urb->actual_length || -+ dg_len > urb->actual_length - dg_idx) { - dev->net->stats.rx_length_errors++; - return retval; - } - -- buf = urb->transfer_buffer + le16_to_cpu(dpe->wDatagramIndex); -- len = le16_to_cpu(dpe->wDatagramLength); -+ buf = urb->transfer_buffer + dg_idx; - -- retval = ipheth_consume_skb(buf, len, dev); -+ retval = ipheth_consume_skb(buf, dg_len, dev); - if (retval != 0) - return retval; -- -- dpe++; - } - -- return 0; -+rx_error: -+ dev->net->stats.rx_errors++; -+ return retval; - } - - static void ipheth_rcvbulk_callback(struct urb *urb) -diff --git a/drivers/net/vmxnet3/vmxnet3_xdp.c b/drivers/net/vmxnet3/vmxnet3_xdp.c -index 1341374a4588a0..616ecc38d1726c 100644 ---- a/drivers/net/vmxnet3/vmxnet3_xdp.c -+++ b/drivers/net/vmxnet3/vmxnet3_xdp.c -@@ -28,7 +28,7 @@ vmxnet3_xdp_get_tq(struct vmxnet3_adapter *adapter) - if (likely(cpu < tq_number)) - tq = &adapter->tx_queue[cpu]; - else -- tq = &adapter->tx_queue[reciprocal_scale(cpu, tq_number)]; -+ tq = &adapter->tx_queue[cpu % tq_number]; - - return tq; - } -@@ -124,6 +124,7 @@ vmxnet3_xdp_xmit_frame(struct vmxnet3_adapter *adapter, - u32 buf_size; - u32 dw2; - -+ spin_lock_irq(&tq->tx_lock); - dw2 = (tq->tx_ring.gen ^ 0x1) << VMXNET3_TXD_GEN_SHIFT; - dw2 |= xdpf->len; - ctx.sop_txd = tq->tx_ring.base + tq->tx_ring.next2fill; -@@ -134,6 +135,7 @@ vmxnet3_xdp_xmit_frame(struct vmxnet3_adapter *adapter, - - if (vmxnet3_cmd_ring_desc_avail(&tq->tx_ring) == 0) { - tq->stats.tx_ring_full++; -+ spin_unlock_irq(&tq->tx_lock); - return -ENOSPC; - } - -@@ -142,8 +144,10 @@ vmxnet3_xdp_xmit_frame(struct vmxnet3_adapter *adapter, - tbi->dma_addr = dma_map_single(&adapter->pdev->dev, - xdpf->data, buf_size, - DMA_TO_DEVICE); -- if (dma_mapping_error(&adapter->pdev->dev, tbi->dma_addr)) -+ if (dma_mapping_error(&adapter->pdev->dev, tbi->dma_addr)) { -+ spin_unlock_irq(&tq->tx_lock); - return -EFAULT; -+ } - tbi->map_type |= VMXNET3_MAP_SINGLE; - } else { /* XDP buffer from page pool */ - page = virt_to_page(xdpf->data); -@@ -182,6 +186,7 @@ vmxnet3_xdp_xmit_frame(struct vmxnet3_adapter *adapter, - dma_wmb(); - gdesc->dword[2] = cpu_to_le32(le32_to_cpu(gdesc->dword[2]) ^ - VMXNET3_TXD_GEN); -+ spin_unlock_irq(&tq->tx_lock); - - /* No need to handle the case when tx_num_deferred doesn't reach - * threshold. Backend driver at hypervisor side will poll and reset -@@ -225,6 +230,7 @@ vmxnet3_xdp_xmit(struct net_device *dev, - { - struct vmxnet3_adapter *adapter = netdev_priv(dev); - struct vmxnet3_tx_queue *tq; -+ struct netdev_queue *nq; - int i; - - if (unlikely(test_bit(VMXNET3_STATE_BIT_QUIESCED, &adapter->state))) -@@ -236,6 +242,9 @@ vmxnet3_xdp_xmit(struct net_device *dev, - if (tq->stopped) - return -ENETDOWN; - -+ nq = netdev_get_tx_queue(adapter->netdev, tq->qid); -+ -+ __netif_tx_lock(nq, smp_processor_id()); - for (i = 0; i < n; i++) { - if (vmxnet3_xdp_xmit_frame(adapter, frames[i], tq, true)) { - tq->stats.xdp_xmit_err++; -@@ -243,6 +252,7 @@ vmxnet3_xdp_xmit(struct net_device *dev, - } - } - tq->stats.xdp_xmit += i; -+ __netif_tx_unlock(nq); - - return i; - } -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c -index f599d5f896e89e..96f607f35490da 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c -@@ -540,6 +540,11 @@ void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success) - struct ethhdr *eh; - u16 type; - -+ if (!ifp) { -+ brcmu_pkt_buf_free_skb(txp); -+ return; -+ } -+ - eh = (struct ethhdr *)(txp->data); - type = ntohs(eh->h_proto); - -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c -index 73fc701204e29b..90d2c536bdaf06 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c -@@ -96,13 +96,13 @@ void brcmf_of_probe(struct device *dev, enum brcmf_bus_type bus_type, - /* Set board-type to the first string of the machine compatible prop */ - root = of_find_node_by_path("/"); - if (root && err) { -- char *board_type; -+ char *board_type = NULL; - const char *tmp; - -- of_property_read_string_index(root, "compatible", 0, &tmp); -- - /* get rid of '/' in the compatible string to be able to find the FW */ -- board_type = devm_kstrdup(dev, tmp, GFP_KERNEL); -+ if (!of_property_read_string_index(root, "compatible", 0, &tmp)) -+ board_type = devm_kstrdup(dev, tmp, GFP_KERNEL); -+ - if (!board_type) { - of_node_put(root); - return; -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c -index 8580a275478918..42e7bc67e9143e 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c -@@ -23427,6 +23427,9 @@ wlc_phy_iqcal_gainparams_nphy(struct brcms_phy *pi, u16 core_no, - break; - } - -+ if (WARN_ON(k == NPHY_IQCAL_NUMGAINS)) -+ return; -+ - params->txgm = tbl_iqcal_gainparams_nphy[band_idx][k][1]; - params->pga = tbl_iqcal_gainparams_nphy[band_idx][k][2]; - params->pad = tbl_iqcal_gainparams_nphy[band_idx][k][3]; -diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c -index 9943e2d21a8f53..e72f238ff7b23c 100644 ---- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c -+++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c -@@ -155,7 +155,7 @@ static int iwl_acpi_get_dsm_integer(struct device *dev, int rev, int func, - size_t expected_size) - { - union acpi_object *obj; -- int ret = 0; -+ int ret; - - obj = iwl_acpi_get_dsm_object(dev, rev, func, NULL, guid); - if (IS_ERR(obj)) { -@@ -170,8 +170,10 @@ static int iwl_acpi_get_dsm_integer(struct device *dev, int rev, int func, - } else if (obj->type == ACPI_TYPE_BUFFER) { - __le64 le_value = 0; - -- if (WARN_ON_ONCE(expected_size > sizeof(le_value))) -- return -EINVAL; -+ if (WARN_ON_ONCE(expected_size > sizeof(le_value))) { -+ ret = -EINVAL; -+ goto out; -+ } - - /* if the buffer size doesn't match the expected size */ - if (obj->buffer.length != expected_size) -@@ -192,8 +194,9 @@ static int iwl_acpi_get_dsm_integer(struct device *dev, int rev, int func, - } - - IWL_DEBUG_DEV_RADIO(dev, -- "ACPI: DSM method evaluated: func=%d, ret=%d\n", -- func, ret); -+ "ACPI: DSM method evaluated: func=%d, value=%lld\n", -+ func, *value); -+ ret = 0; - out: - ACPI_FREE(obj); - return ret; -diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c -index 76be7308460b06..1c47a4d95978a4 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c -@@ -2,9 +2,14 @@ - /* Copyright (C) 2020 MediaTek Inc. */ - - #include -+#include - #include "mt7915.h" - #include "eeprom.h" - -+static bool enable_6ghz; -+module_param(enable_6ghz, bool, 0644); -+MODULE_PARM_DESC(enable_6ghz, "Enable 6 GHz instead of 5 GHz on hardware that supports both"); -+ - static int mt7915_eeprom_load_precal(struct mt7915_dev *dev) - { - struct mt76_dev *mdev = &dev->mt76; -@@ -159,8 +164,20 @@ static void mt7915_eeprom_parse_band_config(struct mt7915_phy *phy) - phy->mt76->cap.has_6ghz = true; - return; - case MT_EE_V2_BAND_SEL_5GHZ_6GHZ: -- phy->mt76->cap.has_5ghz = true; -- phy->mt76->cap.has_6ghz = true; -+ if (enable_6ghz) { -+ phy->mt76->cap.has_6ghz = true; -+ u8p_replace_bits(&eeprom[MT_EE_WIFI_CONF + band], -+ MT_EE_V2_BAND_SEL_6GHZ, -+ MT_EE_WIFI_CONF0_BAND_SEL); -+ } else { -+ phy->mt76->cap.has_5ghz = true; -+ u8p_replace_bits(&eeprom[MT_EE_WIFI_CONF + band], -+ MT_EE_V2_BAND_SEL_5GHZ, -+ MT_EE_WIFI_CONF0_BAND_SEL); -+ } -+ /* force to buffer mode */ -+ dev->flash_mode = true; -+ - return; - default: - phy->mt76->cap.has_2ghz = true; -diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c -index 28f84220d50f02..e9068718b3d1f6 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c -@@ -1220,14 +1220,14 @@ int mt7915_register_device(struct mt7915_dev *dev) - if (ret) - goto unreg_dev; - -- ieee80211_queue_work(mt76_hw(dev), &dev->init_work); -- - if (phy2) { - ret = mt7915_register_ext_phy(dev, phy2); - if (ret) - goto unreg_thermal; - } - -+ ieee80211_queue_work(mt76_hw(dev), &dev->init_work); -+ - dev->recovery.hw_init_done = true; - - ret = mt7915_init_debugfs(&dev->phy); -diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/usb.c b/drivers/net/wireless/mediatek/mt76/mt7921/usb.c -index 59cd3d98bf9086..13e892d788b277 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7921/usb.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7921/usb.c -@@ -21,6 +21,9 @@ static const struct usb_device_id mt7921u_device_table[] = { - /* Netgear, Inc. [A8000,AXE3000] */ - { USB_DEVICE_AND_INTERFACE_INFO(0x0846, 0x9060, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)MT7921_FIRMWARE_WM }, -+ /* TP-Link TXE50UH */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x35bc, 0x0107, 0xff, 0xff, 0xff), -+ .driver_info = (kernel_ulong_t)MT7921_FIRMWARE_WM }, - { }, - }; - -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.h b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.h -index c269942b3f4ab1..af8d17b9e012ca 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.h -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.h -@@ -197,9 +197,9 @@ enum rtl8821a_h2c_cmd { - - /* _MEDIA_STATUS_RPT_PARM_CMD1 */ - #define SET_H2CCMD_MSRRPT_PARM_OPMODE(__cmd, __value) \ -- u8p_replace_bits(__cmd + 1, __value, BIT(0)) -+ u8p_replace_bits(__cmd, __value, BIT(0)) - #define SET_H2CCMD_MSRRPT_PARM_MACID_IND(__cmd, __value) \ -- u8p_replace_bits(__cmd + 1, __value, BIT(1)) -+ u8p_replace_bits(__cmd, __value, BIT(1)) - - /* AP_OFFLOAD */ - #define SET_H2CCMD_AP_OFFLOAD_ON(__cmd, __value) \ -diff --git a/drivers/net/wireless/realtek/rtw88/sdio.c b/drivers/net/wireless/realtek/rtw88/sdio.c -index 5bd1ee81210d1d..9043569935796b 100644 ---- a/drivers/net/wireless/realtek/rtw88/sdio.c -+++ b/drivers/net/wireless/realtek/rtw88/sdio.c -@@ -1191,6 +1191,8 @@ static void rtw_sdio_indicate_tx_status(struct rtw_dev *rtwdev, - struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); - struct ieee80211_hw *hw = rtwdev->hw; - -+ skb_pull(skb, rtwdev->chip->tx_pkt_desc_sz); -+ - /* enqueue to wait for tx report */ - if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) { - rtw_tx_report_enqueue(rtwdev, skb, tx_data->sn); -diff --git a/drivers/net/wireless/realtek/rtw89/phy.c b/drivers/net/wireless/realtek/rtw89/phy.c -index fac83b718a30cd..457c1dd31bf9d9 100644 ---- a/drivers/net/wireless/realtek/rtw89/phy.c -+++ b/drivers/net/wireless/realtek/rtw89/phy.c -@@ -2438,7 +2438,6 @@ static void rtw89_phy_cfo_set_crystal_cap(struct rtw89_dev *rtwdev, - - if (!force && cfo->crystal_cap == crystal_cap) - return; -- crystal_cap = clamp_t(u8, crystal_cap, 0, 127); - if (chip->chip_id == RTL8852A || chip->chip_id == RTL8851B) { - rtw89_phy_cfo_set_xcap_reg(rtwdev, true, crystal_cap); - rtw89_phy_cfo_set_xcap_reg(rtwdev, false, crystal_cap); -@@ -2552,7 +2551,7 @@ static void rtw89_phy_cfo_crystal_cap_adjust(struct rtw89_dev *rtwdev, - s32 curr_cfo) - { - struct rtw89_cfo_tracking_info *cfo = &rtwdev->cfo_tracking; -- s8 crystal_cap = cfo->crystal_cap; -+ int crystal_cap = cfo->crystal_cap; - s32 cfo_abs = abs(curr_cfo); - int sign; - -@@ -2569,15 +2568,17 @@ static void rtw89_phy_cfo_crystal_cap_adjust(struct rtw89_dev *rtwdev, - } - sign = curr_cfo > 0 ? 1 : -1; - if (cfo_abs > CFO_TRK_STOP_TH_4) -- crystal_cap += 7 * sign; -+ crystal_cap += 3 * sign; - else if (cfo_abs > CFO_TRK_STOP_TH_3) -- crystal_cap += 5 * sign; -- else if (cfo_abs > CFO_TRK_STOP_TH_2) - crystal_cap += 3 * sign; -+ else if (cfo_abs > CFO_TRK_STOP_TH_2) -+ crystal_cap += 1 * sign; - else if (cfo_abs > CFO_TRK_STOP_TH_1) - crystal_cap += 1 * sign; - else - return; -+ -+ crystal_cap = clamp(crystal_cap, 0, 127); - rtw89_phy_cfo_set_crystal_cap(rtwdev, (u8)crystal_cap, false); - rtw89_debug(rtwdev, RTW89_DBG_CFO, - "X_cap{Curr,Default}={0x%x,0x%x}\n", -diff --git a/drivers/net/wireless/realtek/rtw89/phy.h b/drivers/net/wireless/realtek/rtw89/phy.h -index d6dc0cbbae43bf..15ed23fa4218fd 100644 ---- a/drivers/net/wireless/realtek/rtw89/phy.h -+++ b/drivers/net/wireless/realtek/rtw89/phy.h -@@ -51,7 +51,7 @@ - #define CFO_TRK_STOP_TH_4 (30 << 2) - #define CFO_TRK_STOP_TH_3 (20 << 2) - #define CFO_TRK_STOP_TH_2 (10 << 2) --#define CFO_TRK_STOP_TH_1 (00 << 2) -+#define CFO_TRK_STOP_TH_1 (03 << 2) - #define CFO_TRK_STOP_TH (2 << 2) - #define CFO_SW_COMP_FINE_TUNE (2 << 2) - #define CFO_PERIOD_CNT 15 -diff --git a/drivers/net/wwan/iosm/iosm_ipc_pcie.c b/drivers/net/wwan/iosm/iosm_ipc_pcie.c -index 04517bd3325a2a..a066977af0be5c 100644 ---- a/drivers/net/wwan/iosm/iosm_ipc_pcie.c -+++ b/drivers/net/wwan/iosm/iosm_ipc_pcie.c -@@ -6,6 +6,7 @@ - #include - #include - #include -+#include - #include - - #include "iosm_ipc_imem.h" -@@ -18,6 +19,7 @@ MODULE_LICENSE("GPL v2"); - /* WWAN GUID */ - static guid_t wwan_acpi_guid = GUID_INIT(0xbad01b75, 0x22a8, 0x4f48, 0x87, 0x92, - 0xbd, 0xde, 0x94, 0x67, 0x74, 0x7d); -+static bool pci_registered; - - static void ipc_pcie_resources_release(struct iosm_pcie *ipc_pcie) - { -@@ -448,7 +450,6 @@ static struct pci_driver iosm_ipc_driver = { - }, - .id_table = iosm_ipc_ids, - }; --module_pci_driver(iosm_ipc_driver); - - int ipc_pcie_addr_map(struct iosm_pcie *ipc_pcie, unsigned char *data, - size_t size, dma_addr_t *mapping, int direction) -@@ -530,3 +531,56 @@ void ipc_pcie_kfree_skb(struct iosm_pcie *ipc_pcie, struct sk_buff *skb) - IPC_CB(skb)->mapping = 0; - dev_kfree_skb(skb); - } -+ -+static int pm_notify(struct notifier_block *nb, unsigned long mode, void *_unused) -+{ -+ if (mode == PM_HIBERNATION_PREPARE || mode == PM_RESTORE_PREPARE) { -+ if (pci_registered) { -+ pci_unregister_driver(&iosm_ipc_driver); -+ pci_registered = false; -+ } -+ } else if (mode == PM_POST_HIBERNATION || mode == PM_POST_RESTORE) { -+ if (!pci_registered) { -+ int ret; -+ -+ ret = pci_register_driver(&iosm_ipc_driver); -+ if (ret) { -+ pr_err(KBUILD_MODNAME ": unable to re-register PCI driver: %d\n", -+ ret); -+ } else { -+ pci_registered = true; -+ } -+ } -+ } -+ -+ return 0; -+} -+ -+static struct notifier_block pm_notifier = { -+ .notifier_call = pm_notify, -+}; -+ -+static int __init iosm_ipc_driver_init(void) -+{ -+ int ret; -+ -+ ret = pci_register_driver(&iosm_ipc_driver); -+ if (ret) -+ return ret; -+ -+ pci_registered = true; -+ -+ register_pm_notifier(&pm_notifier); -+ -+ return 0; -+} -+module_init(iosm_ipc_driver_init); -+ -+static void __exit iosm_ipc_driver_exit(void) -+{ -+ unregister_pm_notifier(&pm_notifier); -+ -+ if (pci_registered) -+ pci_unregister_driver(&iosm_ipc_driver); -+} -+module_exit(iosm_ipc_driver_exit); -diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c -index 26e3f1896dc397..8a200931bc297a 100644 ---- a/drivers/nvme/host/core.c -+++ b/drivers/nvme/host/core.c -@@ -1553,7 +1553,13 @@ int nvme_set_queue_count(struct nvme_ctrl *ctrl, int *count) - - status = nvme_set_features(ctrl, NVME_FEAT_NUM_QUEUES, q_count, NULL, 0, - &result); -- if (status < 0) -+ -+ /* -+ * It's either a kernel error or the host observed a connection -+ * lost. In either case it's not possible communicate with the -+ * controller and thus enter the error code path. -+ */ -+ if (status < 0 || status == NVME_SC_HOST_PATH_ERROR) - return status; - - /* -diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c -index cdb1e706f855e5..91324791a5b66e 100644 ---- a/drivers/nvme/host/fc.c -+++ b/drivers/nvme/host/fc.c -@@ -2080,7 +2080,8 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req) - nvme_fc_complete_rq(rq); - - check_error: -- if (terminate_assoc && ctrl->ctrl.state != NVME_CTRL_RESETTING) -+ if (terminate_assoc && -+ nvme_ctrl_state(&ctrl->ctrl) != NVME_CTRL_RESETTING) - queue_work(nvme_reset_wq, &ctrl->ioerr_work); - } - -@@ -2534,6 +2535,8 @@ __nvme_fc_abort_outstanding_ios(struct nvme_fc_ctrl *ctrl, bool start_queues) - static void - nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg) - { -+ enum nvme_ctrl_state state = nvme_ctrl_state(&ctrl->ctrl); -+ - /* - * if an error (io timeout, etc) while (re)connecting, the remote - * port requested terminating of the association (disconnect_ls) -@@ -2541,7 +2544,7 @@ nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg) - * the controller. Abort any ios on the association and let the - * create_association error path resolve things. - */ -- if (ctrl->ctrl.state == NVME_CTRL_CONNECTING) { -+ if (state == NVME_CTRL_CONNECTING) { - __nvme_fc_abort_outstanding_ios(ctrl, true); - set_bit(ASSOC_FAILED, &ctrl->flags); - dev_warn(ctrl->ctrl.device, -@@ -2551,7 +2554,7 @@ nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg) - } - - /* Otherwise, only proceed if in LIVE state - e.g. on first error */ -- if (ctrl->ctrl.state != NVME_CTRL_LIVE) -+ if (state != NVME_CTRL_LIVE) - return; - - dev_warn(ctrl->ctrl.device, -diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c -index 52c8fd3d5c4796..b1310e69d07daf 100644 ---- a/drivers/nvme/host/pci.c -+++ b/drivers/nvme/host/pci.c -@@ -2949,7 +2949,9 @@ static unsigned long check_vendor_combination_bug(struct pci_dev *pdev) - * because of high power consumption (> 2 Watt) in s2idle - * sleep. Only some boards with Intel CPU are affected. - */ -- if (dmi_match(DMI_BOARD_NAME, "GMxPXxx") || -+ if (dmi_match(DMI_BOARD_NAME, "DN50Z-140HC-YD") || -+ dmi_match(DMI_BOARD_NAME, "GMxPXxx") || -+ dmi_match(DMI_BOARD_NAME, "GXxMRXx") || - dmi_match(DMI_BOARD_NAME, "PH4PG31") || - dmi_match(DMI_BOARD_NAME, "PH4PRX1_PH6PRX1") || - dmi_match(DMI_BOARD_NAME, "PH6PG01_PH6PG71")) -diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c -index f28c005c2bb265..fd11d3825cf854 100644 ---- a/drivers/nvmem/core.c -+++ b/drivers/nvmem/core.c -@@ -1725,6 +1725,8 @@ static int __nvmem_cell_entry_write(struct nvmem_cell_entry *cell, void *buf, si - return -EINVAL; - - if (cell->bit_offset || cell->nbits) { -+ if (len != BITS_TO_BYTES(cell->nbits) && len != cell->bytes) -+ return -EINVAL; - buf = nvmem_cell_prepare_write_buffer(cell, buf, len); - if (IS_ERR(buf)) - return PTR_ERR(buf); -diff --git a/drivers/nvmem/imx-ocotp-ele.c b/drivers/nvmem/imx-ocotp-ele.c -index cf920542f939ea..dfc925edfc83e0 100644 ---- a/drivers/nvmem/imx-ocotp-ele.c -+++ b/drivers/nvmem/imx-ocotp-ele.c -@@ -70,13 +70,15 @@ static int imx_ocotp_reg_read(void *context, unsigned int offset, void *val, siz - u32 *buf; - void *p; - int i; -+ u8 skipbytes; - -- index = offset; -- num_bytes = round_up(bytes, 4); -- count = num_bytes >> 2; -+ if (offset + bytes > priv->data->size) -+ bytes = priv->data->size - offset; - -- if (count > ((priv->data->size >> 2) - index)) -- count = (priv->data->size >> 2) - index; -+ index = offset >> 2; -+ skipbytes = offset - (index << 2); -+ num_bytes = round_up(bytes + skipbytes, 4); -+ count = num_bytes >> 2; - - p = kzalloc(num_bytes, GFP_KERNEL); - if (!p) -@@ -96,7 +98,7 @@ static int imx_ocotp_reg_read(void *context, unsigned int offset, void *val, siz - *buf++ = readl_relaxed(reg + (i << 2)); - } - -- memcpy(val, (u8 *)p, bytes); -+ memcpy(val, ((u8 *)p) + skipbytes, bytes); - - mutex_unlock(&priv->lock); - -@@ -127,7 +129,7 @@ static int imx_ele_ocotp_probe(struct platform_device *pdev) - priv->config.owner = THIS_MODULE; - priv->config.size = priv->data->size; - priv->config.reg_read = priv->data->reg_read; -- priv->config.word_size = 4; -+ priv->config.word_size = 1; - priv->config.stride = 1; - priv->config.priv = priv; - priv->config.read_only = true; -diff --git a/drivers/nvmem/qcom-spmi-sdam.c b/drivers/nvmem/qcom-spmi-sdam.c -index 9aa8f42faa4c93..4f1cca6eab71e1 100644 ---- a/drivers/nvmem/qcom-spmi-sdam.c -+++ b/drivers/nvmem/qcom-spmi-sdam.c -@@ -144,6 +144,7 @@ static int sdam_probe(struct platform_device *pdev) - sdam->sdam_config.owner = THIS_MODULE; - sdam->sdam_config.add_legacy_fixed_of_cells = true; - sdam->sdam_config.stride = 1; -+ sdam->sdam_config.size = sdam->size; - sdam->sdam_config.word_size = 1; - sdam->sdam_config.reg_read = sdam_read; - sdam->sdam_config.reg_write = sdam_write; -diff --git a/drivers/of/base.c b/drivers/of/base.c -index 7a3c05622d9821..ccadc22f18c0ec 100644 ---- a/drivers/of/base.c -+++ b/drivers/of/base.c -@@ -788,10 +788,10 @@ struct device_node *of_find_node_opts_by_path(const char *path, const char **opt - /* The path could begin with an alias */ - if (*path != '/') { - int len; -- const char *p = separator; -+ const char *p = strchrnul(path, '/'); - -- if (!p) -- p = strchrnul(path, '/'); -+ if (separator && separator < p) -+ p = separator; - len = p - path; - - /* of_aliases must not be NULL */ -@@ -1453,7 +1453,6 @@ int of_parse_phandle_with_args_map(const struct device_node *np, - * specifier into the out_args structure, keeping the - * bits specified in -map-pass-thru. - */ -- match_array = map - new_size; - for (i = 0; i < new_size; i++) { - __be32 val = *(map - new_size + i); - -@@ -1462,6 +1461,7 @@ int of_parse_phandle_with_args_map(const struct device_node *np, - val |= cpu_to_be32(out_args->args[i]) & pass[i]; - } - -+ initial_match_array[i] = val; - out_args->args[i] = be32_to_cpu(val); - } - out_args->args_count = list_size = new_size; -diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c -index 959f1808c240fa..4a30daa0a9b9cc 100644 ---- a/drivers/of/of_reserved_mem.c -+++ b/drivers/of/of_reserved_mem.c -@@ -156,12 +156,12 @@ static int __init __reserved_mem_alloc_size(unsigned long node, - - prop = of_get_flat_dt_prop(node, "alignment", &len); - if (prop) { -- if (len != dt_root_addr_cells * sizeof(__be32)) { -+ if (len != dt_root_size_cells * sizeof(__be32)) { - pr_err("invalid alignment property in '%s' node.\n", - uname); - return -EINVAL; - } -- align = dt_mem_next_cell(dt_root_addr_cells, &prop); -+ align = dt_mem_next_cell(dt_root_size_cells, &prop); - } - - nomap = of_get_flat_dt_prop(node, "no-map", NULL) != NULL; -diff --git a/drivers/pci/endpoint/pci-epf-core.c b/drivers/pci/endpoint/pci-epf-core.c -index 2c32de66793778..059f8639f21e92 100644 ---- a/drivers/pci/endpoint/pci-epf-core.c -+++ b/drivers/pci/endpoint/pci-epf-core.c -@@ -202,6 +202,7 @@ void pci_epf_remove_vepf(struct pci_epf *epf_pf, struct pci_epf *epf_vf) - - mutex_lock(&epf_pf->lock); - clear_bit(epf_vf->vfunc_no, &epf_pf->vfunction_num_map); -+ epf_vf->epf_pf = NULL; - list_del(&epf_vf->list); - mutex_unlock(&epf_pf->lock); - } -diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c -index e54847040b4a92..c3609d830873f6 100644 ---- a/drivers/pinctrl/samsung/pinctrl-samsung.c -+++ b/drivers/pinctrl/samsung/pinctrl-samsung.c -@@ -1150,7 +1150,7 @@ static int samsung_pinctrl_probe(struct platform_device *pdev) - - ret = platform_get_irq_optional(pdev, 0); - if (ret < 0 && ret != -ENXIO) -- return ret; -+ goto err_put_banks; - if (ret > 0) - drvdata->irq = ret; - -diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c -index 377a0becd1a181..868faccfb86285 100644 ---- a/drivers/platform/x86/acer-wmi.c -+++ b/drivers/platform/x86/acer-wmi.c -@@ -88,6 +88,7 @@ enum acer_wmi_event_ids { - WMID_HOTKEY_EVENT = 0x1, - WMID_ACCEL_OR_KBD_DOCK_EVENT = 0x5, - WMID_GAMING_TURBO_KEY_EVENT = 0x7, -+ WMID_AC_EVENT = 0x8, - }; - - static const struct key_entry acer_wmi_keymap[] __initconst = { -@@ -1999,6 +2000,9 @@ static void acer_wmi_notify(u32 value, void *context) - if (return_value.key_num == 0x4) - acer_toggle_turbo(); - break; -+ case WMID_AC_EVENT: -+ /* We ignore AC events here */ -+ break; - default: - pr_warn("Unknown function number - %d - %d\n", - return_value.function, return_value.key_num); -diff --git a/drivers/platform/x86/intel/int3472/discrete.c b/drivers/platform/x86/intel/int3472/discrete.c -index e33c2d75975cf5..d56f79043f5e24 100644 ---- a/drivers/platform/x86/intel/int3472/discrete.c -+++ b/drivers/platform/x86/intel/int3472/discrete.c -@@ -284,6 +284,9 @@ static int skl_int3472_discrete_probe(struct platform_device *pdev) - struct int3472_cldb cldb; - int ret; - -+ if (!adev) -+ return -ENODEV; -+ - ret = skl_int3472_fill_cldb(adev, &cldb); - if (ret) { - dev_err(&pdev->dev, "Couldn't fill CLDB structure\n"); -diff --git a/drivers/platform/x86/intel/int3472/tps68470.c b/drivers/platform/x86/intel/int3472/tps68470.c -index 1e107fd49f828c..81ac4c69196309 100644 ---- a/drivers/platform/x86/intel/int3472/tps68470.c -+++ b/drivers/platform/x86/intel/int3472/tps68470.c -@@ -152,6 +152,9 @@ static int skl_int3472_tps68470_probe(struct i2c_client *client) - int ret; - int i; - -+ if (!adev) -+ return -ENODEV; -+ - n_consumers = skl_int3472_fill_clk_pdata(&client->dev, &clk_pdata); - if (n_consumers < 0) - return n_consumers; -diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c -index b586da2e30023c..6b7e8b7ebcef5e 100644 ---- a/drivers/ptp/ptp_clock.c -+++ b/drivers/ptp/ptp_clock.c -@@ -189,6 +189,11 @@ static int ptp_getcycles64(struct ptp_clock_info *info, struct timespec64 *ts) - return info->gettime64(info, ts); - } - -+static int ptp_enable(struct ptp_clock_info *ptp, struct ptp_clock_request *request, int on) -+{ -+ return -EOPNOTSUPP; -+} -+ - static void ptp_aux_kworker(struct kthread_work *work) - { - struct ptp_clock *ptp = container_of(work, struct ptp_clock, -@@ -251,6 +256,9 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, - ptp->info->getcrosscycles = ptp->info->getcrosststamp; - } - -+ if (!ptp->info->enable) -+ ptp->info->enable = ptp_enable; -+ - if (ptp->info->do_aux_work) { - kthread_init_delayed_work(&ptp->aux_work, ptp_aux_kworker); - ptp->kworker = kthread_create_worker(0, "ptp%d", ptp->index); -diff --git a/drivers/pwm/pwm-microchip-core.c b/drivers/pwm/pwm-microchip-core.c -index e7525c98105ebc..d3e60d5d085bc2 100644 ---- a/drivers/pwm/pwm-microchip-core.c -+++ b/drivers/pwm/pwm-microchip-core.c -@@ -328,7 +328,7 @@ static int mchp_core_pwm_apply_locked(struct pwm_chip *chip, struct pwm_device * - * mchp_core_pwm_calc_period(). - * The period is locked and we cannot change this, so we abort. - */ -- if (hw_period_steps == MCHPCOREPWM_PERIOD_STEPS_MAX) -+ if (hw_period_steps > MCHPCOREPWM_PERIOD_STEPS_MAX) - return -EINVAL; - - prescale = hw_prescale; -diff --git a/drivers/rtc/rtc-zynqmp.c b/drivers/rtc/rtc-zynqmp.c -index 08ed171bdab43a..b6f96c10196ae3 100644 ---- a/drivers/rtc/rtc-zynqmp.c -+++ b/drivers/rtc/rtc-zynqmp.c -@@ -318,8 +318,8 @@ static int xlnx_rtc_probe(struct platform_device *pdev) - return ret; - } - -- /* Getting the rtc_clk info */ -- xrtcdev->rtc_clk = devm_clk_get_optional(&pdev->dev, "rtc_clk"); -+ /* Getting the rtc info */ -+ xrtcdev->rtc_clk = devm_clk_get_optional(&pdev->dev, "rtc"); - if (IS_ERR(xrtcdev->rtc_clk)) { - if (PTR_ERR(xrtcdev->rtc_clk) != -EPROBE_DEFER) - dev_warn(&pdev->dev, "Device clock not found.\n"); -diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h -index 7cf998e3cc681c..78a10d4979e90e 100644 ---- a/drivers/scsi/qla2xxx/qla_def.h -+++ b/drivers/scsi/qla2xxx/qla_def.h -@@ -4099,6 +4099,8 @@ struct qla_hw_data { - uint32_t npiv_supported :1; - uint32_t pci_channel_io_perm_failure :1; - uint32_t fce_enabled :1; -+ uint32_t user_enabled_fce :1; -+ uint32_t fce_dump_buf_alloced :1; - uint32_t fac_supported :1; - - uint32_t chip_reset_done :1; -diff --git a/drivers/scsi/qla2xxx/qla_dfs.c b/drivers/scsi/qla2xxx/qla_dfs.c -index 081af4d420a05f..4a82b377928d49 100644 ---- a/drivers/scsi/qla2xxx/qla_dfs.c -+++ b/drivers/scsi/qla2xxx/qla_dfs.c -@@ -409,26 +409,31 @@ qla2x00_dfs_fce_show(struct seq_file *s, void *unused) - - mutex_lock(&ha->fce_mutex); - -- seq_puts(s, "FCE Trace Buffer\n"); -- seq_printf(s, "In Pointer = %llx\n\n", (unsigned long long)ha->fce_wr); -- seq_printf(s, "Base = %llx\n\n", (unsigned long long) ha->fce_dma); -- seq_puts(s, "FCE Enable Registers\n"); -- seq_printf(s, "%08x %08x %08x %08x %08x %08x\n", -- ha->fce_mb[0], ha->fce_mb[2], ha->fce_mb[3], ha->fce_mb[4], -- ha->fce_mb[5], ha->fce_mb[6]); -- -- fce = (uint32_t *) ha->fce; -- fce_start = (unsigned long long) ha->fce_dma; -- for (cnt = 0; cnt < fce_calc_size(ha->fce_bufs) / 4; cnt++) { -- if (cnt % 8 == 0) -- seq_printf(s, "\n%llx: ", -- (unsigned long long)((cnt * 4) + fce_start)); -- else -- seq_putc(s, ' '); -- seq_printf(s, "%08x", *fce++); -- } -+ if (ha->flags.user_enabled_fce) { -+ seq_puts(s, "FCE Trace Buffer\n"); -+ seq_printf(s, "In Pointer = %llx\n\n", (unsigned long long)ha->fce_wr); -+ seq_printf(s, "Base = %llx\n\n", (unsigned long long)ha->fce_dma); -+ seq_puts(s, "FCE Enable Registers\n"); -+ seq_printf(s, "%08x %08x %08x %08x %08x %08x\n", -+ ha->fce_mb[0], ha->fce_mb[2], ha->fce_mb[3], ha->fce_mb[4], -+ ha->fce_mb[5], ha->fce_mb[6]); -+ -+ fce = (uint32_t *)ha->fce; -+ fce_start = (unsigned long long)ha->fce_dma; -+ for (cnt = 0; cnt < fce_calc_size(ha->fce_bufs) / 4; cnt++) { -+ if (cnt % 8 == 0) -+ seq_printf(s, "\n%llx: ", -+ (unsigned long long)((cnt * 4) + fce_start)); -+ else -+ seq_putc(s, ' '); -+ seq_printf(s, "%08x", *fce++); -+ } - -- seq_puts(s, "\nEnd\n"); -+ seq_puts(s, "\nEnd\n"); -+ } else { -+ seq_puts(s, "FCE Trace is currently not enabled\n"); -+ seq_puts(s, "\techo [ 1 | 0 ] > fce\n"); -+ } - - mutex_unlock(&ha->fce_mutex); - -@@ -467,7 +472,7 @@ qla2x00_dfs_fce_release(struct inode *inode, struct file *file) - struct qla_hw_data *ha = vha->hw; - int rval; - -- if (ha->flags.fce_enabled) -+ if (ha->flags.fce_enabled || !ha->fce) - goto out; - - mutex_lock(&ha->fce_mutex); -@@ -488,11 +493,88 @@ qla2x00_dfs_fce_release(struct inode *inode, struct file *file) - return single_release(inode, file); - } - -+static ssize_t -+qla2x00_dfs_fce_write(struct file *file, const char __user *buffer, -+ size_t count, loff_t *pos) -+{ -+ struct seq_file *s = file->private_data; -+ struct scsi_qla_host *vha = s->private; -+ struct qla_hw_data *ha = vha->hw; -+ char *buf; -+ int rc = 0; -+ unsigned long enable; -+ -+ if (!IS_QLA25XX(ha) && !IS_QLA81XX(ha) && !IS_QLA83XX(ha) && -+ !IS_QLA27XX(ha) && !IS_QLA28XX(ha)) { -+ ql_dbg(ql_dbg_user, vha, 0xd034, -+ "this adapter does not support FCE."); -+ return -EINVAL; -+ } -+ -+ buf = memdup_user_nul(buffer, count); -+ if (IS_ERR(buf)) { -+ ql_dbg(ql_dbg_user, vha, 0xd037, -+ "fail to copy user buffer."); -+ return PTR_ERR(buf); -+ } -+ -+ enable = kstrtoul(buf, 0, 0); -+ rc = count; -+ -+ mutex_lock(&ha->fce_mutex); -+ -+ if (enable) { -+ if (ha->flags.user_enabled_fce) { -+ mutex_unlock(&ha->fce_mutex); -+ goto out_free; -+ } -+ ha->flags.user_enabled_fce = 1; -+ if (!ha->fce) { -+ rc = qla2x00_alloc_fce_trace(vha); -+ if (rc) { -+ ha->flags.user_enabled_fce = 0; -+ mutex_unlock(&ha->fce_mutex); -+ goto out_free; -+ } -+ -+ /* adjust fw dump buffer to take into account of this feature */ -+ if (!ha->flags.fce_dump_buf_alloced) -+ qla2x00_alloc_fw_dump(vha); -+ } -+ -+ if (!ha->flags.fce_enabled) -+ qla_enable_fce_trace(vha); -+ -+ ql_dbg(ql_dbg_user, vha, 0xd045, "User enabled FCE .\n"); -+ } else { -+ if (!ha->flags.user_enabled_fce) { -+ mutex_unlock(&ha->fce_mutex); -+ goto out_free; -+ } -+ ha->flags.user_enabled_fce = 0; -+ if (ha->flags.fce_enabled) { -+ qla2x00_disable_fce_trace(vha, NULL, NULL); -+ ha->flags.fce_enabled = 0; -+ } -+ -+ qla2x00_free_fce_trace(ha); -+ /* no need to re-adjust fw dump buffer */ -+ -+ ql_dbg(ql_dbg_user, vha, 0xd04f, "User disabled FCE .\n"); -+ } -+ -+ mutex_unlock(&ha->fce_mutex); -+out_free: -+ kfree(buf); -+ return rc; -+} -+ - static const struct file_operations dfs_fce_ops = { - .open = qla2x00_dfs_fce_open, - .read = seq_read, - .llseek = seq_lseek, - .release = qla2x00_dfs_fce_release, -+ .write = qla2x00_dfs_fce_write, - }; - - static int -@@ -671,8 +753,6 @@ qla2x00_dfs_setup(scsi_qla_host_t *vha) - if (!IS_QLA25XX(ha) && !IS_QLA81XX(ha) && !IS_QLA83XX(ha) && - !IS_QLA27XX(ha) && !IS_QLA28XX(ha)) - goto out; -- if (!ha->fce) -- goto out; - - if (qla2x00_dfs_root) - goto create_dir; -diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h -index cededfda9d0e31..e556f57c91af62 100644 ---- a/drivers/scsi/qla2xxx/qla_gbl.h -+++ b/drivers/scsi/qla2xxx/qla_gbl.h -@@ -11,6 +11,9 @@ - /* - * Global Function Prototypes in qla_init.c source file. - */ -+int qla2x00_alloc_fce_trace(scsi_qla_host_t *); -+void qla2x00_free_fce_trace(struct qla_hw_data *ha); -+void qla_enable_fce_trace(scsi_qla_host_t *); - extern int qla2x00_initialize_adapter(scsi_qla_host_t *); - extern int qla24xx_post_prli_work(struct scsi_qla_host *vha, fc_port_t *fcport); - -diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c -index eda3bdab934d57..5fa2727c1bea76 100644 ---- a/drivers/scsi/qla2xxx/qla_init.c -+++ b/drivers/scsi/qla2xxx/qla_init.c -@@ -2681,7 +2681,7 @@ qla83xx_nic_core_fw_load(scsi_qla_host_t *vha) - return rval; - } - --static void qla_enable_fce_trace(scsi_qla_host_t *vha) -+void qla_enable_fce_trace(scsi_qla_host_t *vha) - { - int rval; - struct qla_hw_data *ha = vha->hw; -@@ -3717,25 +3717,24 @@ qla24xx_chip_diag(scsi_qla_host_t *vha) - return rval; - } - --static void --qla2x00_alloc_fce_trace(scsi_qla_host_t *vha) -+int qla2x00_alloc_fce_trace(scsi_qla_host_t *vha) - { - dma_addr_t tc_dma; - void *tc; - struct qla_hw_data *ha = vha->hw; - - if (!IS_FWI2_CAPABLE(ha)) -- return; -+ return -EINVAL; - - if (!IS_QLA25XX(ha) && !IS_QLA81XX(ha) && !IS_QLA83XX(ha) && - !IS_QLA27XX(ha) && !IS_QLA28XX(ha)) -- return; -+ return -EINVAL; - - if (ha->fce) { - ql_dbg(ql_dbg_init, vha, 0x00bd, - "%s: FCE Mem is already allocated.\n", - __func__); -- return; -+ return -EIO; - } - - /* Allocate memory for Fibre Channel Event Buffer. */ -@@ -3745,7 +3744,7 @@ qla2x00_alloc_fce_trace(scsi_qla_host_t *vha) - ql_log(ql_log_warn, vha, 0x00be, - "Unable to allocate (%d KB) for FCE.\n", - FCE_SIZE / 1024); -- return; -+ return -ENOMEM; - } - - ql_dbg(ql_dbg_init, vha, 0x00c0, -@@ -3754,6 +3753,16 @@ qla2x00_alloc_fce_trace(scsi_qla_host_t *vha) - ha->fce_dma = tc_dma; - ha->fce = tc; - ha->fce_bufs = FCE_NUM_BUFFERS; -+ return 0; -+} -+ -+void qla2x00_free_fce_trace(struct qla_hw_data *ha) -+{ -+ if (!ha->fce) -+ return; -+ dma_free_coherent(&ha->pdev->dev, FCE_SIZE, ha->fce, ha->fce_dma); -+ ha->fce = NULL; -+ ha->fce_dma = 0; - } - - static void -@@ -3844,9 +3853,10 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha) - if (ha->tgt.atio_ring) - mq_size += ha->tgt.atio_q_length * sizeof(request_t); - -- qla2x00_alloc_fce_trace(vha); -- if (ha->fce) -+ if (ha->fce) { - fce_size = sizeof(struct qla2xxx_fce_chain) + FCE_SIZE; -+ ha->flags.fce_dump_buf_alloced = 1; -+ } - qla2x00_alloc_eft_trace(vha); - if (ha->eft) - eft_size = EFT_SIZE; -diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c -index 4e872f2559d138..bdbe94f30f0706 100644 ---- a/drivers/scsi/st.c -+++ b/drivers/scsi/st.c -@@ -1028,6 +1028,11 @@ static int test_ready(struct scsi_tape *STp, int do_wait) - retval = new_session ? CHKRES_NEW_SESSION : CHKRES_READY; - break; - } -+ if (STp->first_tur) { -+ /* Don't set pos_unknown right after device recognition */ -+ STp->pos_unknown = 0; -+ STp->first_tur = 0; -+ } - - if (SRpnt != NULL) - st_release_request(SRpnt); -@@ -4326,6 +4331,7 @@ static int st_probe(struct device *dev) - blk_queue_rq_timeout(tpnt->device->request_queue, ST_TIMEOUT); - tpnt->long_timeout = ST_LONG_TIMEOUT; - tpnt->try_dio = try_direct_io; -+ tpnt->first_tur = 1; - - for (i = 0; i < ST_NBR_MODES; i++) { - STm = &(tpnt->modes[i]); -diff --git a/drivers/scsi/st.h b/drivers/scsi/st.h -index 7a68eaba7e810c..1aaaf5369a40fc 100644 ---- a/drivers/scsi/st.h -+++ b/drivers/scsi/st.h -@@ -170,6 +170,7 @@ struct scsi_tape { - unsigned char rew_at_close; /* rewind necessary at close */ - unsigned char inited; - unsigned char cleaning_req; /* cleaning requested? */ -+ unsigned char first_tur; /* first TEST UNIT READY */ - int block_size; - int min_block; - int max_block; -diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c -index b3c588b102d900..b8186feccdf5aa 100644 ---- a/drivers/scsi/storvsc_drv.c -+++ b/drivers/scsi/storvsc_drv.c -@@ -1800,6 +1800,7 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) - - length = scsi_bufflen(scmnd); - payload = (struct vmbus_packet_mpb_array *)&cmd_request->mpb; -+ payload->range.len = 0; - payload_sz = 0; - - if (scsi_sg_count(scmnd)) { -diff --git a/drivers/soc/mediatek/mtk-devapc.c b/drivers/soc/mediatek/mtk-devapc.c -index b28feb96754021..0dfc1da9471cba 100644 ---- a/drivers/soc/mediatek/mtk-devapc.c -+++ b/drivers/soc/mediatek/mtk-devapc.c -@@ -273,23 +273,31 @@ static int mtk_devapc_probe(struct platform_device *pdev) - return -EINVAL; - - devapc_irq = irq_of_parse_and_map(node, 0); -- if (!devapc_irq) -- return -EINVAL; -+ if (!devapc_irq) { -+ ret = -EINVAL; -+ goto err; -+ } - - ctx->infra_clk = devm_clk_get_enabled(&pdev->dev, "devapc-infra-clock"); -- if (IS_ERR(ctx->infra_clk)) -- return -EINVAL; -+ if (IS_ERR(ctx->infra_clk)) { -+ ret = -EINVAL; -+ goto err; -+ } - - ret = devm_request_irq(&pdev->dev, devapc_irq, devapc_violation_irq, - IRQF_TRIGGER_NONE, "devapc", ctx); - if (ret) -- return ret; -+ goto err; - - platform_set_drvdata(pdev, ctx); - - start_devapc(ctx); - - return 0; -+ -+err: -+ iounmap(ctx->infra_base); -+ return ret; - } - - static int mtk_devapc_remove(struct platform_device *pdev) -diff --git a/drivers/soc/qcom/smem_state.c b/drivers/soc/qcom/smem_state.c -index e848cc9a3cf801..a8be3a2f33824f 100644 ---- a/drivers/soc/qcom/smem_state.c -+++ b/drivers/soc/qcom/smem_state.c -@@ -116,7 +116,8 @@ struct qcom_smem_state *qcom_smem_state_get(struct device *dev, - - if (args.args_count != 1) { - dev_err(dev, "invalid #qcom,smem-state-cells\n"); -- return ERR_PTR(-EINVAL); -+ state = ERR_PTR(-EINVAL); -+ goto put; - } - - state = of_node_to_state(args.np); -diff --git a/drivers/soc/qcom/socinfo.c b/drivers/soc/qcom/socinfo.c -index 2af2b2406fdf39..714d1259b3137c 100644 ---- a/drivers/soc/qcom/socinfo.c -+++ b/drivers/soc/qcom/socinfo.c -@@ -760,7 +760,7 @@ static int qcom_socinfo_probe(struct platform_device *pdev) - if (!qs->attr.soc_id || !qs->attr.revision) - return -ENOMEM; - -- if (offsetof(struct socinfo, serial_num) <= item_size) { -+ if (offsetofend(struct socinfo, serial_num) <= item_size) { - qs->attr.serial_number = devm_kasprintf(&pdev->dev, GFP_KERNEL, - "%u", - le32_to_cpu(info->serial_num)); -diff --git a/drivers/spi/atmel-quadspi.c b/drivers/spi/atmel-quadspi.c -index e7ae7cb4b92a8b..4396d988768f65 100644 ---- a/drivers/spi/atmel-quadspi.c -+++ b/drivers/spi/atmel-quadspi.c -@@ -138,11 +138,15 @@ - #define QSPI_WPSR_WPVSRC_MASK GENMASK(15, 8) - #define QSPI_WPSR_WPVSRC(src) (((src) << 8) & QSPI_WPSR_WPVSRC) - -+#define ATMEL_QSPI_TIMEOUT 1000 /* ms */ -+ - struct atmel_qspi_caps { - bool has_qspick; - bool has_ricr; - }; - -+struct atmel_qspi_ops; -+ - struct atmel_qspi { - void __iomem *regs; - void __iomem *mem; -@@ -150,13 +154,22 @@ struct atmel_qspi { - struct clk *qspick; - struct platform_device *pdev; - const struct atmel_qspi_caps *caps; -+ const struct atmel_qspi_ops *ops; - resource_size_t mmap_size; - u32 pending; -+ u32 irq_mask; - u32 mr; - u32 scr; - struct completion cmd_completion; - }; - -+struct atmel_qspi_ops { -+ int (*set_cfg)(struct atmel_qspi *aq, const struct spi_mem_op *op, -+ u32 *offset); -+ int (*transfer)(struct spi_mem *mem, const struct spi_mem_op *op, -+ u32 offset); -+}; -+ - struct atmel_qspi_mode { - u8 cmd_buswidth; - u8 addr_buswidth; -@@ -404,10 +417,67 @@ static int atmel_qspi_set_cfg(struct atmel_qspi *aq, - return 0; - } - -+static int atmel_qspi_wait_for_completion(struct atmel_qspi *aq, u32 irq_mask) -+{ -+ int err = 0; -+ u32 sr; -+ -+ /* Poll INSTRuction End status */ -+ sr = atmel_qspi_read(aq, QSPI_SR); -+ if ((sr & irq_mask) == irq_mask) -+ return 0; -+ -+ /* Wait for INSTRuction End interrupt */ -+ reinit_completion(&aq->cmd_completion); -+ aq->pending = sr & irq_mask; -+ aq->irq_mask = irq_mask; -+ atmel_qspi_write(irq_mask, aq, QSPI_IER); -+ if (!wait_for_completion_timeout(&aq->cmd_completion, -+ msecs_to_jiffies(ATMEL_QSPI_TIMEOUT))) -+ err = -ETIMEDOUT; -+ atmel_qspi_write(irq_mask, aq, QSPI_IDR); -+ -+ return err; -+} -+ -+static int atmel_qspi_transfer(struct spi_mem *mem, -+ const struct spi_mem_op *op, u32 offset) -+{ -+ struct atmel_qspi *aq = spi_controller_get_devdata(mem->spi->controller); -+ -+ /* Skip to the final steps if there is no data */ -+ if (!op->data.nbytes) -+ return atmel_qspi_wait_for_completion(aq, -+ QSPI_SR_CMD_COMPLETED); -+ -+ /* Dummy read of QSPI_IFR to synchronize APB and AHB accesses */ -+ (void)atmel_qspi_read(aq, QSPI_IFR); -+ -+ /* Send/Receive data */ -+ if (op->data.dir == SPI_MEM_DATA_IN) { -+ memcpy_fromio(op->data.buf.in, aq->mem + offset, -+ op->data.nbytes); -+ -+ /* Synchronize AHB and APB accesses again */ -+ rmb(); -+ } else { -+ memcpy_toio(aq->mem + offset, op->data.buf.out, -+ op->data.nbytes); -+ -+ /* Synchronize AHB and APB accesses again */ -+ wmb(); -+ } -+ -+ /* Release the chip-select */ -+ atmel_qspi_write(QSPI_CR_LASTXFER, aq, QSPI_CR); -+ -+ return atmel_qspi_wait_for_completion(aq, QSPI_SR_CMD_COMPLETED); -+} -+ - static int atmel_qspi_exec_op(struct spi_mem *mem, const struct spi_mem_op *op) - { - struct atmel_qspi *aq = spi_controller_get_devdata(mem->spi->controller); -- u32 sr, offset; -+ u32 offset; - int err; - - /* -@@ -416,46 +486,20 @@ static int atmel_qspi_exec_op(struct spi_mem *mem, const struct spi_mem_op *op) - * when the flash memories overrun the controller's memory space. - */ - if (op->addr.val + op->data.nbytes > aq->mmap_size) -- return -ENOTSUPP; -+ return -EOPNOTSUPP; -+ -+ if (op->addr.nbytes > 4) -+ return -EOPNOTSUPP; - - err = pm_runtime_resume_and_get(&aq->pdev->dev); - if (err < 0) - return err; - -- err = atmel_qspi_set_cfg(aq, op, &offset); -+ err = aq->ops->set_cfg(aq, op, &offset); - if (err) - goto pm_runtime_put; - -- /* Skip to the final steps if there is no data */ -- if (op->data.nbytes) { -- /* Dummy read of QSPI_IFR to synchronize APB and AHB accesses */ -- (void)atmel_qspi_read(aq, QSPI_IFR); -- -- /* Send/Receive data */ -- if (op->data.dir == SPI_MEM_DATA_IN) -- memcpy_fromio(op->data.buf.in, aq->mem + offset, -- op->data.nbytes); -- else -- memcpy_toio(aq->mem + offset, op->data.buf.out, -- op->data.nbytes); -- -- /* Release the chip-select */ -- atmel_qspi_write(QSPI_CR_LASTXFER, aq, QSPI_CR); -- } -- -- /* Poll INSTRuction End status */ -- sr = atmel_qspi_read(aq, QSPI_SR); -- if ((sr & QSPI_SR_CMD_COMPLETED) == QSPI_SR_CMD_COMPLETED) -- goto pm_runtime_put; -- -- /* Wait for INSTRuction End interrupt */ -- reinit_completion(&aq->cmd_completion); -- aq->pending = sr & QSPI_SR_CMD_COMPLETED; -- atmel_qspi_write(QSPI_SR_CMD_COMPLETED, aq, QSPI_IER); -- if (!wait_for_completion_timeout(&aq->cmd_completion, -- msecs_to_jiffies(1000))) -- err = -ETIMEDOUT; -- atmel_qspi_write(QSPI_SR_CMD_COMPLETED, aq, QSPI_IDR); -+ err = aq->ops->transfer(mem, op, offset); - - pm_runtime_put: - pm_runtime_mark_last_busy(&aq->pdev->dev); -@@ -571,12 +615,17 @@ static irqreturn_t atmel_qspi_interrupt(int irq, void *dev_id) - return IRQ_NONE; - - aq->pending |= pending; -- if ((aq->pending & QSPI_SR_CMD_COMPLETED) == QSPI_SR_CMD_COMPLETED) -+ if ((aq->pending & aq->irq_mask) == aq->irq_mask) - complete(&aq->cmd_completion); - - return IRQ_HANDLED; - } - -+static const struct atmel_qspi_ops atmel_qspi_ops = { -+ .set_cfg = atmel_qspi_set_cfg, -+ .transfer = atmel_qspi_transfer, -+}; -+ - static int atmel_qspi_probe(struct platform_device *pdev) - { - struct spi_controller *ctrl; -@@ -601,6 +650,7 @@ static int atmel_qspi_probe(struct platform_device *pdev) - - init_completion(&aq->cmd_completion); - aq->pdev = pdev; -+ aq->ops = &atmel_qspi_ops; - - /* Map the registers */ - res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "qspi_base"); -diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c -index f793624fd5018f..4350a69d97d7ac 100644 ---- a/drivers/tty/serial/sh-sci.c -+++ b/drivers/tty/serial/sh-sci.c -@@ -164,6 +164,7 @@ struct sci_port { - static struct sci_port sci_ports[SCI_NPORTS]; - static unsigned long sci_ports_in_use; - static struct uart_driver sci_uart_driver; -+static bool sci_uart_earlycon; - - static inline struct sci_port * - to_sci_port(struct uart_port *uart) -@@ -3391,6 +3392,7 @@ static int sci_probe_single(struct platform_device *dev, - static int sci_probe(struct platform_device *dev) - { - struct plat_sci_port *p; -+ struct resource *res; - struct sci_port *sp; - unsigned int dev_id; - int ret; -@@ -3420,6 +3422,26 @@ static int sci_probe(struct platform_device *dev) - } - - sp = &sci_ports[dev_id]; -+ -+ /* -+ * In case: -+ * - the probed port alias is zero (as the one used by earlycon), and -+ * - the earlycon is still active (e.g., "earlycon keep_bootcon" in -+ * bootargs) -+ * -+ * defer the probe of this serial. This is a debug scenario and the user -+ * must be aware of it. -+ * -+ * Except when the probed port is the same as the earlycon port. -+ */ -+ -+ res = platform_get_resource(dev, IORESOURCE_MEM, 0); -+ if (!res) -+ return -ENODEV; -+ -+ if (sci_uart_earlycon && sp == &sci_ports[0] && sp->port.mapbase != res->start) -+ return dev_err_probe(&dev->dev, -EBUSY, "sci_port[0] is used by earlycon!\n"); -+ - platform_set_drvdata(dev, sp); - - ret = sci_probe_single(dev, dev_id, p, sp); -@@ -3503,7 +3525,7 @@ sh_early_platform_init_buffer("earlyprintk", &sci_driver, - early_serial_buf, ARRAY_SIZE(early_serial_buf)); - #endif - #ifdef CONFIG_SERIAL_SH_SCI_EARLYCON --static struct plat_sci_port port_cfg __initdata; -+static struct plat_sci_port port_cfg; - - static int __init early_console_setup(struct earlycon_device *device, - int type) -@@ -3518,6 +3540,7 @@ static int __init early_console_setup(struct earlycon_device *device, - port_cfg.type = type; - sci_ports[0].cfg = &port_cfg; - sci_ports[0].params = sci_probe_regmap(&port_cfg); -+ sci_uart_earlycon = true; - port_cfg.scscr = sci_serial_in(&sci_ports[0].port, SCSCR); - sci_serial_out(&sci_ports[0].port, SCSCR, - SCSCR_RE | SCSCR_TE | port_cfg.scscr); -diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c -index 2e5e86a00a77d7..7f83d278001701 100644 ---- a/drivers/tty/serial/xilinx_uartps.c -+++ b/drivers/tty/serial/xilinx_uartps.c -@@ -268,7 +268,7 @@ static void cdns_uart_handle_rx(void *dev_id, unsigned int isrstatus) - continue; - } - -- if (uart_handle_sysrq_char(port, data)) -+ if (uart_prepare_sysrq_char(port, data)) - continue; - - if (is_rxbs_support) { -@@ -369,7 +369,7 @@ static irqreturn_t cdns_uart_isr(int irq, void *dev_id) - !(readl(port->membase + CDNS_UART_CR) & CDNS_UART_CR_RX_DIS)) - cdns_uart_handle_rx(dev_id, isrstatus); - -- spin_unlock(&port->lock); -+ uart_unlock_and_check_sysrq(port); - return IRQ_HANDLED; - } - -@@ -1229,10 +1229,8 @@ static void cdns_uart_console_write(struct console *co, const char *s, - unsigned int imr, ctrl; - int locked = 1; - -- if (port->sysrq) -- locked = 0; -- else if (oops_in_progress) -- locked = spin_trylock_irqsave(&port->lock, flags); -+ if (oops_in_progress) -+ locked = uart_port_trylock_irqsave(port, &flags); - else - spin_lock_irqsave(&port->lock, flags); - -diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c -index c999acba0f30c3..c5a6b133d3643f 100644 ---- a/drivers/ufs/host/ufs-qcom.c -+++ b/drivers/ufs/host/ufs-qcom.c -@@ -158,8 +158,9 @@ static int ufs_qcom_ice_program_key(struct ufs_hba *hba, - { - struct ufs_qcom_host *host = ufshcd_get_variant(hba); - union ufs_crypto_cap_entry cap; -- bool config_enable = -- cfg->config_enable & UFS_CRYPTO_CONFIGURATION_ENABLE; -+ -+ if (!(cfg->config_enable & UFS_CRYPTO_CONFIGURATION_ENABLE)) -+ return qcom_ice_evict_key(host->ice, slot); - - /* Only AES-256-XTS has been tested so far. */ - cap = hba->crypto_cap_array[cfg->crypto_cap_idx]; -@@ -167,14 +168,11 @@ static int ufs_qcom_ice_program_key(struct ufs_hba *hba, - cap.key_size != UFS_CRYPTO_KEY_SIZE_256) - return -EOPNOTSUPP; - -- if (config_enable) -- return qcom_ice_program_key(host->ice, -- QCOM_ICE_CRYPTO_ALG_AES_XTS, -- QCOM_ICE_CRYPTO_KEY_SIZE_256, -- cfg->crypto_key, -- cfg->data_unit_size, slot); -- else -- return qcom_ice_evict_key(host->ice, slot); -+ return qcom_ice_program_key(host->ice, -+ QCOM_ICE_CRYPTO_ALG_AES_XTS, -+ QCOM_ICE_CRYPTO_KEY_SIZE_256, -+ cfg->crypto_key, -+ cfg->data_unit_size, slot); - } - - #else -diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c -index 8ac50b9155ac40..a7cd0a06879e61 100644 ---- a/drivers/usb/gadget/function/f_tcm.c -+++ b/drivers/usb/gadget/function/f_tcm.c -@@ -245,7 +245,6 @@ static int bot_send_write_request(struct usbg_cmd *cmd) - { - struct f_uas *fu = cmd->fu; - struct se_cmd *se_cmd = &cmd->se_cmd; -- struct usb_gadget *gadget = fuas_to_gadget(fu); - int ret; - - init_completion(&cmd->write_complete); -@@ -256,22 +255,6 @@ static int bot_send_write_request(struct usbg_cmd *cmd) - return -EINVAL; - } - -- if (!gadget->sg_supported) { -- cmd->data_buf = kmalloc(se_cmd->data_length, GFP_KERNEL); -- if (!cmd->data_buf) -- return -ENOMEM; -- -- fu->bot_req_out->buf = cmd->data_buf; -- } else { -- fu->bot_req_out->buf = NULL; -- fu->bot_req_out->num_sgs = se_cmd->t_data_nents; -- fu->bot_req_out->sg = se_cmd->t_data_sg; -- } -- -- fu->bot_req_out->complete = usbg_data_write_cmpl; -- fu->bot_req_out->length = se_cmd->data_length; -- fu->bot_req_out->context = cmd; -- - ret = usbg_prepare_w_request(cmd, fu->bot_req_out); - if (ret) - goto cleanup; -@@ -973,6 +956,7 @@ static void usbg_data_write_cmpl(struct usb_ep *ep, struct usb_request *req) - return; - - cleanup: -+ target_put_sess_cmd(se_cmd); - transport_generic_free_cmd(&cmd->se_cmd, 0); - } - -@@ -1065,7 +1049,7 @@ static void usbg_cmd_work(struct work_struct *work) - - out: - transport_send_check_condition_and_sense(se_cmd, -- TCM_UNSUPPORTED_SCSI_OPCODE, 1); -+ TCM_UNSUPPORTED_SCSI_OPCODE, 0); - } - - static struct usbg_cmd *usbg_get_cmd(struct f_uas *fu, -@@ -1193,7 +1177,7 @@ static void bot_cmd_work(struct work_struct *work) - - out: - transport_send_check_condition_and_sense(se_cmd, -- TCM_UNSUPPORTED_SCSI_OPCODE, 1); -+ TCM_UNSUPPORTED_SCSI_OPCODE, 0); - } - - static int bot_submit_command(struct f_uas *fu, -@@ -1966,43 +1950,39 @@ static int tcm_bind(struct usb_configuration *c, struct usb_function *f) - bot_intf_desc.bInterfaceNumber = iface; - uasp_intf_desc.bInterfaceNumber = iface; - fu->iface = iface; -- ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_bi_desc, -- &uasp_bi_ep_comp_desc); -+ ep = usb_ep_autoconfig(gadget, &uasp_fs_bi_desc); - if (!ep) - goto ep_fail; - - fu->ep_in = ep; - -- ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_bo_desc, -- &uasp_bo_ep_comp_desc); -+ ep = usb_ep_autoconfig(gadget, &uasp_fs_bo_desc); - if (!ep) - goto ep_fail; - fu->ep_out = ep; - -- ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_status_desc, -- &uasp_status_in_ep_comp_desc); -+ ep = usb_ep_autoconfig(gadget, &uasp_fs_status_desc); - if (!ep) - goto ep_fail; - fu->ep_status = ep; - -- ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_cmd_desc, -- &uasp_cmd_comp_desc); -+ ep = usb_ep_autoconfig(gadget, &uasp_fs_cmd_desc); - if (!ep) - goto ep_fail; - fu->ep_cmd = ep; - - /* Assume endpoint addresses are the same for both speeds */ -- uasp_bi_desc.bEndpointAddress = uasp_ss_bi_desc.bEndpointAddress; -- uasp_bo_desc.bEndpointAddress = uasp_ss_bo_desc.bEndpointAddress; -+ uasp_bi_desc.bEndpointAddress = uasp_fs_bi_desc.bEndpointAddress; -+ uasp_bo_desc.bEndpointAddress = uasp_fs_bo_desc.bEndpointAddress; - uasp_status_desc.bEndpointAddress = -- uasp_ss_status_desc.bEndpointAddress; -- uasp_cmd_desc.bEndpointAddress = uasp_ss_cmd_desc.bEndpointAddress; -- -- uasp_fs_bi_desc.bEndpointAddress = uasp_ss_bi_desc.bEndpointAddress; -- uasp_fs_bo_desc.bEndpointAddress = uasp_ss_bo_desc.bEndpointAddress; -- uasp_fs_status_desc.bEndpointAddress = -- uasp_ss_status_desc.bEndpointAddress; -- uasp_fs_cmd_desc.bEndpointAddress = uasp_ss_cmd_desc.bEndpointAddress; -+ uasp_fs_status_desc.bEndpointAddress; -+ uasp_cmd_desc.bEndpointAddress = uasp_fs_cmd_desc.bEndpointAddress; -+ -+ uasp_ss_bi_desc.bEndpointAddress = uasp_fs_bi_desc.bEndpointAddress; -+ uasp_ss_bo_desc.bEndpointAddress = uasp_fs_bo_desc.bEndpointAddress; -+ uasp_ss_status_desc.bEndpointAddress = -+ uasp_fs_status_desc.bEndpointAddress; -+ uasp_ss_cmd_desc.bEndpointAddress = uasp_fs_cmd_desc.bEndpointAddress; - - ret = usb_assign_descriptors(f, uasp_fs_function_desc, - uasp_hs_function_desc, uasp_ss_function_desc, -diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c -index 3bf1043cd7957c..d63c2d266d0735 100644 ---- a/drivers/vfio/platform/vfio_platform_common.c -+++ b/drivers/vfio/platform/vfio_platform_common.c -@@ -393,6 +393,11 @@ static ssize_t vfio_platform_read_mmio(struct vfio_platform_region *reg, - - count = min_t(size_t, count, reg->size - off); - -+ if (off >= reg->size) -+ return -EINVAL; -+ -+ count = min_t(size_t, count, reg->size - off); -+ - if (!reg->ioaddr) { - reg->ioaddr = - ioremap(reg->addr, reg->size); -@@ -477,6 +482,11 @@ static ssize_t vfio_platform_write_mmio(struct vfio_platform_region *reg, - - count = min_t(size_t, count, reg->size - off); - -+ if (off >= reg->size) -+ return -EINVAL; -+ -+ count = min_t(size_t, count, reg->size - off); -+ - if (!reg->ioaddr) { - reg->ioaddr = - ioremap(reg->addr, reg->size); -diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c -index cd6d5bbb4b9df5..3f740d8abb4fe2 100644 ---- a/fs/binfmt_flat.c -+++ b/fs/binfmt_flat.c -@@ -478,7 +478,7 @@ static int load_flat_file(struct linux_binprm *bprm, - * 28 bits (256 MB) is way more than reasonable in this case. - * If some top bits are set we have probable binary corruption. - */ -- if ((text_len | data_len | bss_len | stack_len | full_data) >> 28) { -+ if ((text_len | data_len | bss_len | stack_len | relocs | full_data) >> 28) { - pr_err("bad header\n"); - ret = -ENOEXEC; - goto err; -diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c -index fc6c91773bc894..c2d0c62b087c22 100644 ---- a/fs/btrfs/file.c -+++ b/fs/btrfs/file.c -@@ -241,7 +241,7 @@ int btrfs_drop_extents(struct btrfs_trans_handle *trans, - if (args->drop_cache) - btrfs_drop_extent_map_range(inode, args->start, args->end - 1, false); - -- if (args->start >= inode->disk_i_size && !args->replace_extent) -+ if (data_race(args->start >= inode->disk_i_size) && !args->replace_extent) - modify_tree = 0; - - update_refs = (root->root_key.objectid != BTRFS_TREE_LOG_OBJECTID); -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index eb9319d856f2d8..cedffa567a7584 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -7153,8 +7153,6 @@ noinline int can_nocow_extent(struct inode *inode, u64 offset, u64 *len, - ret = -EAGAIN; - goto out; - } -- -- cond_resched(); - } - - if (orig_start) -@@ -10835,6 +10833,8 @@ static int btrfs_swap_activate(struct swap_info_struct *sis, struct file *file, - } - - start += len; -+ -+ cond_resched(); - } - - if (bsi.block_len) -diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c -index 8a3c46cb67f538..86d846eb5ed492 100644 ---- a/fs/btrfs/ordered-data.c -+++ b/fs/btrfs/ordered-data.c -@@ -1171,6 +1171,18 @@ struct btrfs_ordered_extent *btrfs_split_ordered_extent( - */ - if (WARN_ON_ONCE(len >= ordered->num_bytes)) - return ERR_PTR(-EINVAL); -+ /* -+ * If our ordered extent had an error there's no point in continuing. -+ * The error may have come from a transaction abort done either by this -+ * task or some other concurrent task, and the transaction abort path -+ * iterates over all existing ordered extents and sets the flag -+ * BTRFS_ORDERED_IOERR on them. -+ */ -+ if (unlikely(flags & (1U << BTRFS_ORDERED_IOERR))) { -+ const int fs_error = BTRFS_FS_ERROR(fs_info); -+ -+ return fs_error ? ERR_PTR(fs_error) : ERR_PTR(-EIO); -+ } - /* We cannot split partially completed ordered extents. */ - if (ordered->bytes_left) { - ASSERT(!(flags & ~BTRFS_ORDERED_TYPE_FLAGS)); -diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c -index 299eac696eb426..537e184b4b1dfc 100644 ---- a/fs/btrfs/relocation.c -+++ b/fs/btrfs/relocation.c -@@ -4378,8 +4378,18 @@ int btrfs_reloc_cow_block(struct btrfs_trans_handle *trans, - WARN_ON(!first_cow && level == 0); - - node = rc->backref_cache.path[level]; -- BUG_ON(node->bytenr != buf->start && -- node->new_bytenr != buf->start); -+ -+ /* -+ * If node->bytenr != buf->start and node->new_bytenr != -+ * buf->start then we've got the wrong backref node for what we -+ * expected to see here and the cache is incorrect. -+ */ -+ if (unlikely(node->bytenr != buf->start && node->new_bytenr != buf->start)) { -+ btrfs_err(fs_info, -+"bytenr %llu was found but our backref cache was expecting %llu or %llu", -+ buf->start, node->bytenr, node->new_bytenr); -+ return -EUCLEAN; -+ } - - btrfs_backref_drop_node_buffer(node); - atomic_inc(&cow->refs); -diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c -index 0548072c642fb0..aa03db69a0164c 100644 ---- a/fs/btrfs/transaction.c -+++ b/fs/btrfs/transaction.c -@@ -278,8 +278,10 @@ static noinline int join_transaction(struct btrfs_fs_info *fs_info, - cur_trans = fs_info->running_transaction; - if (cur_trans) { - if (TRANS_ABORTED(cur_trans)) { -+ const int abort_error = cur_trans->aborted; -+ - spin_unlock(&fs_info->trans_lock); -- return cur_trans->aborted; -+ return abort_error; - } - if (btrfs_blocked_trans_types[cur_trans->state] & type) { - spin_unlock(&fs_info->trans_lock); -diff --git a/fs/cachefiles/interface.c b/fs/cachefiles/interface.c -index 35ba2117a6f652..3e63cfe1587472 100644 ---- a/fs/cachefiles/interface.c -+++ b/fs/cachefiles/interface.c -@@ -327,6 +327,8 @@ static void cachefiles_commit_object(struct cachefiles_object *object, - static void cachefiles_clean_up_object(struct cachefiles_object *object, - struct cachefiles_cache *cache) - { -+ struct file *file; -+ - if (test_bit(FSCACHE_COOKIE_RETIRED, &object->cookie->flags)) { - if (!test_bit(CACHEFILES_OBJECT_USING_TMPFILE, &object->flags)) { - cachefiles_see_object(object, cachefiles_obj_see_clean_delete); -@@ -342,10 +344,14 @@ static void cachefiles_clean_up_object(struct cachefiles_object *object, - } - - cachefiles_unmark_inode_in_use(object, object->file); -- if (object->file) { -- fput(object->file); -- object->file = NULL; -- } -+ -+ spin_lock(&object->lock); -+ file = object->file; -+ object->file = NULL; -+ spin_unlock(&object->lock); -+ -+ if (file) -+ fput(file); - } - - /* -diff --git a/fs/cachefiles/ondemand.c b/fs/cachefiles/ondemand.c -index d1a0264b08a6c1..3389a373faf680 100644 ---- a/fs/cachefiles/ondemand.c -+++ b/fs/cachefiles/ondemand.c -@@ -61,20 +61,26 @@ static ssize_t cachefiles_ondemand_fd_write_iter(struct kiocb *kiocb, - { - struct cachefiles_object *object = kiocb->ki_filp->private_data; - struct cachefiles_cache *cache = object->volume->cache; -- struct file *file = object->file; -+ struct file *file; - size_t len = iter->count; - loff_t pos = kiocb->ki_pos; - const struct cred *saved_cred; - int ret; - -- if (!file) -+ spin_lock(&object->lock); -+ file = object->file; -+ if (!file) { -+ spin_unlock(&object->lock); - return -ENOBUFS; -+ } -+ get_file(file); -+ spin_unlock(&object->lock); - - cachefiles_begin_secure(cache, &saved_cred); - ret = __cachefiles_prepare_write(object, file, &pos, &len, true); - cachefiles_end_secure(cache, saved_cred); - if (ret < 0) -- return ret; -+ goto out; - - trace_cachefiles_ondemand_fd_write(object, file_inode(file), pos, len); - ret = __cachefiles_write(object, file, pos, iter, NULL, NULL); -@@ -83,6 +89,8 @@ static ssize_t cachefiles_ondemand_fd_write_iter(struct kiocb *kiocb, - kiocb->ki_pos += ret; - } - -+out: -+ fput(file); - return ret; - } - -@@ -90,12 +98,22 @@ static loff_t cachefiles_ondemand_fd_llseek(struct file *filp, loff_t pos, - int whence) - { - struct cachefiles_object *object = filp->private_data; -- struct file *file = object->file; -+ struct file *file; -+ loff_t ret; - -- if (!file) -+ spin_lock(&object->lock); -+ file = object->file; -+ if (!file) { -+ spin_unlock(&object->lock); - return -ENOBUFS; -+ } -+ get_file(file); -+ spin_unlock(&object->lock); - -- return vfs_llseek(file, pos, whence); -+ ret = vfs_llseek(file, pos, whence); -+ fput(file); -+ -+ return ret; - } - - static long cachefiles_ondemand_fd_ioctl(struct file *filp, unsigned int ioctl, -diff --git a/fs/exec.c b/fs/exec.c -index 7776209d98c10b..4a6255aa4ea7f3 100644 ---- a/fs/exec.c -+++ b/fs/exec.c -@@ -1362,7 +1362,28 @@ int begin_new_exec(struct linux_binprm * bprm) - set_dumpable(current->mm, SUID_DUMP_USER); - - perf_event_exec(); -- __set_task_comm(me, kbasename(bprm->filename), true); -+ -+ /* -+ * If the original filename was empty, alloc_bprm() made up a path -+ * that will probably not be useful to admins running ps or similar. -+ * Let's fix it up to be something reasonable. -+ */ -+ if (bprm->comm_from_dentry) { -+ /* -+ * Hold RCU lock to keep the name from being freed behind our back. -+ * Use acquire semantics to make sure the terminating NUL from -+ * __d_alloc() is seen. -+ * -+ * Note, we're deliberately sloppy here. We don't need to care about -+ * detecting a concurrent rename and just want a terminated name. -+ */ -+ rcu_read_lock(); -+ __set_task_comm(me, smp_load_acquire(&bprm->file->f_path.dentry->d_name.name), -+ true); -+ rcu_read_unlock(); -+ } else { -+ __set_task_comm(me, kbasename(bprm->filename), true); -+ } - - /* An exec changes our domain. We are no longer part of the thread - group */ -@@ -1521,11 +1542,13 @@ static struct linux_binprm *alloc_bprm(int fd, struct filename *filename) - if (fd == AT_FDCWD || filename->name[0] == '/') { - bprm->filename = filename->name; - } else { -- if (filename->name[0] == '\0') -+ if (filename->name[0] == '\0') { - bprm->fdpath = kasprintf(GFP_KERNEL, "/dev/fd/%d", fd); -- else -+ bprm->comm_from_dentry = 1; -+ } else { - bprm->fdpath = kasprintf(GFP_KERNEL, "/dev/fd/%d/%s", - fd, filename->name); -+ } - if (!bprm->fdpath) - goto out_free; - -diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c -index 3e724cb7ef01d8..2b3c5eea1f1345 100644 ---- a/fs/nfs/flexfilelayout/flexfilelayout.c -+++ b/fs/nfs/flexfilelayout/flexfilelayout.c -@@ -839,6 +839,9 @@ ff_layout_pg_init_read(struct nfs_pageio_descriptor *pgio, - struct nfs4_pnfs_ds *ds; - u32 ds_idx; - -+ if (NFS_SERVER(pgio->pg_inode)->flags & -+ (NFS_MOUNT_SOFT|NFS_MOUNT_SOFTERR)) -+ pgio->pg_maxretrans = io_maxretrans; - retry: - ff_layout_pg_check_layout(pgio, req); - /* Use full layout for now */ -@@ -852,6 +855,8 @@ ff_layout_pg_init_read(struct nfs_pageio_descriptor *pgio, - if (!pgio->pg_lseg) - goto out_nolseg; - } -+ /* Reset wb_nio, since getting layout segment was successful */ -+ req->wb_nio = 0; - - ds = ff_layout_get_ds_for_read(pgio, &ds_idx); - if (!ds) { -@@ -868,14 +873,24 @@ ff_layout_pg_init_read(struct nfs_pageio_descriptor *pgio, - pgm->pg_bsize = mirror->mirror_ds->ds_versions[0].rsize; - - pgio->pg_mirror_idx = ds_idx; -- -- if (NFS_SERVER(pgio->pg_inode)->flags & -- (NFS_MOUNT_SOFT|NFS_MOUNT_SOFTERR)) -- pgio->pg_maxretrans = io_maxretrans; - return; - out_nolseg: -- if (pgio->pg_error < 0) -- return; -+ if (pgio->pg_error < 0) { -+ if (pgio->pg_error != -EAGAIN) -+ return; -+ /* Retry getting layout segment if lower layer returned -EAGAIN */ -+ if (pgio->pg_maxretrans && req->wb_nio++ > pgio->pg_maxretrans) { -+ if (NFS_SERVER(pgio->pg_inode)->flags & NFS_MOUNT_SOFTERR) -+ pgio->pg_error = -ETIMEDOUT; -+ else -+ pgio->pg_error = -EIO; -+ return; -+ } -+ pgio->pg_error = 0; -+ /* Sleep for 1 second before retrying */ -+ ssleep(1); -+ goto retry; -+ } - out_mds: - trace_pnfs_mds_fallback_pg_init_read(pgio->pg_inode, - 0, NFS4_MAX_UINT64, IOMODE_READ, -diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c -index 489592644b68f5..5f2d73f36e0d2f 100644 ---- a/fs/nilfs2/inode.c -+++ b/fs/nilfs2/inode.c -@@ -1267,7 +1267,7 @@ int nilfs_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, - if (size) { - if (phys && blkphy << blkbits == phys + size) { - /* The current extent goes on */ -- size += n << blkbits; -+ size += (u64)n << blkbits; - } else { - /* Terminate the current extent */ - ret = fiemap_fill_next_extent( -@@ -1280,14 +1280,14 @@ int nilfs_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, - flags = FIEMAP_EXTENT_MERGED; - logical = blkoff << blkbits; - phys = blkphy << blkbits; -- size = n << blkbits; -+ size = (u64)n << blkbits; - } - } else { - /* Start a new extent */ - flags = FIEMAP_EXTENT_MERGED; - logical = blkoff << blkbits; - phys = blkphy << blkbits; -- size = n << blkbits; -+ size = (u64)n << blkbits; - } - blkoff += n; - } -diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c -index 429c22f911fdae..da1ab3282c1817 100644 ---- a/fs/ocfs2/dir.c -+++ b/fs/ocfs2/dir.c -@@ -1065,26 +1065,39 @@ int ocfs2_find_entry(const char *name, int namelen, - { - struct buffer_head *bh; - struct ocfs2_dir_entry *res_dir = NULL; -+ int ret = 0; - - if (ocfs2_dir_indexed(dir)) - return ocfs2_find_entry_dx(name, namelen, dir, lookup); - -+ if (unlikely(i_size_read(dir) <= 0)) { -+ ret = -EFSCORRUPTED; -+ mlog_errno(ret); -+ goto out; -+ } - /* - * The unindexed dir code only uses part of the lookup - * structure, so there's no reason to push it down further - * than this. - */ -- if (OCFS2_I(dir)->ip_dyn_features & OCFS2_INLINE_DATA_FL) -+ if (OCFS2_I(dir)->ip_dyn_features & OCFS2_INLINE_DATA_FL) { -+ if (unlikely(i_size_read(dir) > dir->i_sb->s_blocksize)) { -+ ret = -EFSCORRUPTED; -+ mlog_errno(ret); -+ goto out; -+ } - bh = ocfs2_find_entry_id(name, namelen, dir, &res_dir); -- else -+ } else { - bh = ocfs2_find_entry_el(name, namelen, dir, &res_dir); -+ } - - if (bh == NULL) - return -ENOENT; - - lookup->dl_leaf_bh = bh; - lookup->dl_entry = res_dir; -- return 0; -+out: -+ return ret; - } - - /* -@@ -2012,6 +2025,7 @@ int ocfs2_lookup_ino_from_name(struct inode *dir, const char *name, - * - * Return 0 if the name does not exist - * Return -EEXIST if the directory contains the name -+ * Return -EFSCORRUPTED if found corruption - * - * Callers should have i_rwsem + a cluster lock on dir - */ -@@ -2025,9 +2039,12 @@ int ocfs2_check_dir_for_entry(struct inode *dir, - trace_ocfs2_check_dir_for_entry( - (unsigned long long)OCFS2_I(dir)->ip_blkno, namelen, name); - -- if (ocfs2_find_entry(name, namelen, dir, &lookup) == 0) { -+ ret = ocfs2_find_entry(name, namelen, dir, &lookup); -+ if (ret == 0) { - ret = -EEXIST; - mlog_errno(ret); -+ } else if (ret == -ENOENT) { -+ ret = 0; - } - - ocfs2_free_dir_lookup_result(&lookup); -diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c -index 9f6bbb4a0844aa..84fa585c6513a5 100644 ---- a/fs/ocfs2/super.c -+++ b/fs/ocfs2/super.c -@@ -2343,7 +2343,7 @@ static int ocfs2_verify_volume(struct ocfs2_dinode *di, - mlog(ML_ERROR, "found superblock with incorrect block " - "size bits: found %u, should be 9, 10, 11, or 12\n", - blksz_bits); -- } else if ((1 << le32_to_cpu(blksz_bits)) != blksz) { -+ } else if ((1 << blksz_bits) != blksz) { - mlog(ML_ERROR, "found superblock with incorrect block " - "size: found %u, should be %u\n", 1 << blksz_bits, blksz); - } else if (le16_to_cpu(di->id2.i_super.s_major_rev_level) != -diff --git a/fs/ocfs2/symlink.c b/fs/ocfs2/symlink.c -index d4c5fdcfa1e464..f5cf2255dc0972 100644 ---- a/fs/ocfs2/symlink.c -+++ b/fs/ocfs2/symlink.c -@@ -65,7 +65,7 @@ static int ocfs2_fast_symlink_read_folio(struct file *f, struct folio *folio) - - if (status < 0) { - mlog_errno(status); -- return status; -+ goto out; - } - - fe = (struct ocfs2_dinode *) bh->b_data; -@@ -76,9 +76,10 @@ static int ocfs2_fast_symlink_read_folio(struct file *f, struct folio *folio) - memcpy(kaddr, link, len + 1); - kunmap_atomic(kaddr); - SetPageUptodate(page); -+out: - unlock_page(page); - brelse(bh); -- return 0; -+ return status; - } - - const struct address_space_operations ocfs2_fast_symlink_aops = { -diff --git a/fs/proc/array.c b/fs/proc/array.c -index 34a47fb0c57f25..5e4f7b411fbdb9 100644 ---- a/fs/proc/array.c -+++ b/fs/proc/array.c -@@ -500,7 +500,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, - * a program is not able to use ptrace(2) in that case. It is - * safe because the task has stopped executing permanently. - */ -- if (permitted && (task->flags & (PF_EXITING|PF_DUMPCORE))) { -+ if (permitted && (task->flags & (PF_EXITING|PF_DUMPCORE|PF_POSTCOREDUMP))) { - if (try_get_task_stack(task)) { - eip = KSTK_EIP(task); - esp = KSTK_ESP(task); -diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h -index 43b42eca6780cf..6992e1ec02e416 100644 ---- a/fs/smb/client/cifsglob.h -+++ b/fs/smb/client/cifsglob.h -@@ -323,7 +323,7 @@ struct smb_version_operations { - int (*handle_cancelled_mid)(struct mid_q_entry *, struct TCP_Server_Info *); - void (*downgrade_oplock)(struct TCP_Server_Info *server, - struct cifsInodeInfo *cinode, __u32 oplock, -- unsigned int epoch, bool *purge_cache); -+ __u16 epoch, bool *purge_cache); - /* process transaction2 response */ - bool (*check_trans2)(struct mid_q_entry *, struct TCP_Server_Info *, - char *, int); -@@ -519,12 +519,12 @@ struct smb_version_operations { - /* if we can do cache read operations */ - bool (*is_read_op)(__u32); - /* set oplock level for the inode */ -- void (*set_oplock_level)(struct cifsInodeInfo *, __u32, unsigned int, -- bool *); -+ void (*set_oplock_level)(struct cifsInodeInfo *cinode, __u32 oplock, __u16 epoch, -+ bool *purge_cache); - /* create lease context buffer for CREATE request */ - char * (*create_lease_buf)(u8 *lease_key, u8 oplock); - /* parse lease context buffer and return oplock/epoch info */ -- __u8 (*parse_lease_buf)(void *buf, unsigned int *epoch, char *lkey); -+ __u8 (*parse_lease_buf)(void *buf, __u16 *epoch, char *lkey); - ssize_t (*copychunk_range)(const unsigned int, - struct cifsFileInfo *src_file, - struct cifsFileInfo *target_file, -@@ -1412,7 +1412,7 @@ struct cifs_fid { - __u8 create_guid[16]; - __u32 access; - struct cifs_pending_open *pending_open; -- unsigned int epoch; -+ __u16 epoch; - #ifdef CONFIG_CIFS_DEBUG2 - __u64 mid; - #endif /* CIFS_DEBUG2 */ -@@ -1445,7 +1445,7 @@ struct cifsFileInfo { - bool oplock_break_cancelled:1; - bool status_file_deleted:1; /* file has been deleted */ - bool offload:1; /* offload final part of _put to a wq */ -- unsigned int oplock_epoch; /* epoch from the lease break */ -+ __u16 oplock_epoch; /* epoch from the lease break */ - __u32 oplock_level; /* oplock/lease level from the lease break */ - int count; - spinlock_t file_info_lock; /* protects four flag/count fields above */ -@@ -1584,7 +1584,7 @@ struct cifsInodeInfo { - spinlock_t open_file_lock; /* protects openFileList */ - __u32 cifsAttrs; /* e.g. DOS archive bit, sparse, compressed, system */ - unsigned int oplock; /* oplock/lease level we have */ -- unsigned int epoch; /* used to track lease state changes */ -+ __u16 epoch; /* used to track lease state changes */ - #define CIFS_INODE_PENDING_OPLOCK_BREAK (0) /* oplock break in progress */ - #define CIFS_INODE_PENDING_WRITERS (1) /* Writes in progress */ - #define CIFS_INODE_FLAG_UNUSED (2) /* Unused flag */ -diff --git a/fs/smb/client/dir.c b/fs/smb/client/dir.c -index 864b194dbaa0a0..1822493dd0842e 100644 ---- a/fs/smb/client/dir.c -+++ b/fs/smb/client/dir.c -@@ -627,7 +627,7 @@ int cifs_mknod(struct mnt_idmap *idmap, struct inode *inode, - goto mknod_out; - } - -- trace_smb3_mknod_enter(xid, tcon->ses->Suid, tcon->tid, full_path); -+ trace_smb3_mknod_enter(xid, tcon->tid, tcon->ses->Suid, full_path); - - rc = tcon->ses->server->ops->make_node(xid, inode, direntry, tcon, - full_path, mode, -@@ -635,9 +635,9 @@ int cifs_mknod(struct mnt_idmap *idmap, struct inode *inode, - - mknod_out: - if (rc) -- trace_smb3_mknod_err(xid, tcon->ses->Suid, tcon->tid, rc); -+ trace_smb3_mknod_err(xid, tcon->tid, tcon->ses->Suid, rc); - else -- trace_smb3_mknod_done(xid, tcon->ses->Suid, tcon->tid); -+ trace_smb3_mknod_done(xid, tcon->tid, tcon->ses->Suid); - - free_dentry_path(page); - free_xid(xid); -diff --git a/fs/smb/client/smb1ops.c b/fs/smb/client/smb1ops.c -index b0c0572f9d1fbc..bc1bac36c1b291 100644 ---- a/fs/smb/client/smb1ops.c -+++ b/fs/smb/client/smb1ops.c -@@ -377,7 +377,7 @@ coalesce_t2(char *second_buf, struct smb_hdr *target_hdr) - static void - cifs_downgrade_oplock(struct TCP_Server_Info *server, - struct cifsInodeInfo *cinode, __u32 oplock, -- unsigned int epoch, bool *purge_cache) -+ __u16 epoch, bool *purge_cache) - { - cifs_set_oplock_level(cinode, oplock); - } -diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c -index 9ebd7a5ee23c21..e1078a1decdfa3 100644 ---- a/fs/smb/client/smb2inode.c -+++ b/fs/smb/client/smb2inode.c -@@ -298,8 +298,8 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - goto finished; - } - num_rqst++; -- trace_smb3_query_info_compound_enter(xid, ses->Suid, -- tcon->tid, full_path); -+ trace_smb3_query_info_compound_enter(xid, tcon->tid, -+ ses->Suid, full_path); - break; - case SMB2_OP_POSIX_QUERY_INFO: - rqst[num_rqst].rq_iov = &vars->qi_iov; -@@ -334,18 +334,18 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - goto finished; - } - num_rqst++; -- trace_smb3_posix_query_info_compound_enter(xid, ses->Suid, -- tcon->tid, full_path); -+ trace_smb3_posix_query_info_compound_enter(xid, tcon->tid, -+ ses->Suid, full_path); - break; - case SMB2_OP_DELETE: -- trace_smb3_delete_enter(xid, ses->Suid, tcon->tid, full_path); -+ trace_smb3_delete_enter(xid, tcon->tid, ses->Suid, full_path); - break; - case SMB2_OP_MKDIR: - /* - * Directories are created through parameters in the - * SMB2_open() call. - */ -- trace_smb3_mkdir_enter(xid, ses->Suid, tcon->tid, full_path); -+ trace_smb3_mkdir_enter(xid, tcon->tid, ses->Suid, full_path); - break; - case SMB2_OP_RMDIR: - rqst[num_rqst].rq_iov = &vars->si_iov[0]; -@@ -363,7 +363,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - goto finished; - smb2_set_next_command(tcon, &rqst[num_rqst]); - smb2_set_related(&rqst[num_rqst++]); -- trace_smb3_rmdir_enter(xid, ses->Suid, tcon->tid, full_path); -+ trace_smb3_rmdir_enter(xid, tcon->tid, ses->Suid, full_path); - break; - case SMB2_OP_SET_EOF: - rqst[num_rqst].rq_iov = &vars->si_iov[0]; -@@ -398,7 +398,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - goto finished; - } - num_rqst++; -- trace_smb3_set_eof_enter(xid, ses->Suid, tcon->tid, full_path); -+ trace_smb3_set_eof_enter(xid, tcon->tid, ses->Suid, full_path); - break; - case SMB2_OP_SET_INFO: - rqst[num_rqst].rq_iov = &vars->si_iov[0]; -@@ -429,8 +429,8 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - goto finished; - } - num_rqst++; -- trace_smb3_set_info_compound_enter(xid, ses->Suid, -- tcon->tid, full_path); -+ trace_smb3_set_info_compound_enter(xid, tcon->tid, -+ ses->Suid, full_path); - break; - case SMB2_OP_RENAME: - rqst[num_rqst].rq_iov = &vars->si_iov[0]; -@@ -469,7 +469,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - goto finished; - } - num_rqst++; -- trace_smb3_rename_enter(xid, ses->Suid, tcon->tid, full_path); -+ trace_smb3_rename_enter(xid, tcon->tid, ses->Suid, full_path); - break; - case SMB2_OP_HARDLINK: - rqst[num_rqst].rq_iov = &vars->si_iov[0]; -@@ -496,7 +496,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - goto finished; - smb2_set_next_command(tcon, &rqst[num_rqst]); - smb2_set_related(&rqst[num_rqst++]); -- trace_smb3_hardlink_enter(xid, ses->Suid, tcon->tid, full_path); -+ trace_smb3_hardlink_enter(xid, tcon->tid, ses->Suid, full_path); - break; - case SMB2_OP_SET_REPARSE: - rqst[num_rqst].rq_iov = vars->io_iov; -@@ -523,8 +523,8 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - goto finished; - } - num_rqst++; -- trace_smb3_set_reparse_compound_enter(xid, ses->Suid, -- tcon->tid, full_path); -+ trace_smb3_set_reparse_compound_enter(xid, tcon->tid, -+ ses->Suid, full_path); - break; - case SMB2_OP_GET_REPARSE: - rqst[num_rqst].rq_iov = vars->io_iov; -@@ -549,8 +549,8 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - goto finished; - } - num_rqst++; -- trace_smb3_get_reparse_compound_enter(xid, ses->Suid, -- tcon->tid, full_path); -+ trace_smb3_get_reparse_compound_enter(xid, tcon->tid, -+ ses->Suid, full_path); - break; - case SMB2_OP_QUERY_WSL_EA: - rqst[num_rqst].rq_iov = &vars->ea_iov; -@@ -663,11 +663,11 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - } - SMB2_query_info_free(&rqst[num_rqst++]); - if (rc) -- trace_smb3_query_info_compound_err(xid, ses->Suid, -- tcon->tid, rc); -+ trace_smb3_query_info_compound_err(xid, tcon->tid, -+ ses->Suid, rc); - else -- trace_smb3_query_info_compound_done(xid, ses->Suid, -- tcon->tid); -+ trace_smb3_query_info_compound_done(xid, tcon->tid, -+ ses->Suid); - break; - case SMB2_OP_POSIX_QUERY_INFO: - idata = in_iov[i].iov_base; -@@ -690,15 +690,15 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - - SMB2_query_info_free(&rqst[num_rqst++]); - if (rc) -- trace_smb3_posix_query_info_compound_err(xid, ses->Suid, -- tcon->tid, rc); -+ trace_smb3_posix_query_info_compound_err(xid, tcon->tid, -+ ses->Suid, rc); - else -- trace_smb3_posix_query_info_compound_done(xid, ses->Suid, -- tcon->tid); -+ trace_smb3_posix_query_info_compound_done(xid, tcon->tid, -+ ses->Suid); - break; - case SMB2_OP_DELETE: - if (rc) -- trace_smb3_delete_err(xid, ses->Suid, tcon->tid, rc); -+ trace_smb3_delete_err(xid, tcon->tid, ses->Suid, rc); - else { - /* - * If dentry (hence, inode) is NULL, lease break is going to -@@ -706,59 +706,59 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - */ - if (inode) - cifs_mark_open_handles_for_deleted_file(inode, full_path); -- trace_smb3_delete_done(xid, ses->Suid, tcon->tid); -+ trace_smb3_delete_done(xid, tcon->tid, ses->Suid); - } - break; - case SMB2_OP_MKDIR: - if (rc) -- trace_smb3_mkdir_err(xid, ses->Suid, tcon->tid, rc); -+ trace_smb3_mkdir_err(xid, tcon->tid, ses->Suid, rc); - else -- trace_smb3_mkdir_done(xid, ses->Suid, tcon->tid); -+ trace_smb3_mkdir_done(xid, tcon->tid, ses->Suid); - break; - case SMB2_OP_HARDLINK: - if (rc) -- trace_smb3_hardlink_err(xid, ses->Suid, tcon->tid, rc); -+ trace_smb3_hardlink_err(xid, tcon->tid, ses->Suid, rc); - else -- trace_smb3_hardlink_done(xid, ses->Suid, tcon->tid); -+ trace_smb3_hardlink_done(xid, tcon->tid, ses->Suid); - SMB2_set_info_free(&rqst[num_rqst++]); - break; - case SMB2_OP_RENAME: - if (rc) -- trace_smb3_rename_err(xid, ses->Suid, tcon->tid, rc); -+ trace_smb3_rename_err(xid, tcon->tid, ses->Suid, rc); - else -- trace_smb3_rename_done(xid, ses->Suid, tcon->tid); -+ trace_smb3_rename_done(xid, tcon->tid, ses->Suid); - SMB2_set_info_free(&rqst[num_rqst++]); - break; - case SMB2_OP_RMDIR: - if (rc) -- trace_smb3_rmdir_err(xid, ses->Suid, tcon->tid, rc); -+ trace_smb3_rmdir_err(xid, tcon->tid, ses->Suid, rc); - else -- trace_smb3_rmdir_done(xid, ses->Suid, tcon->tid); -+ trace_smb3_rmdir_done(xid, tcon->tid, ses->Suid); - SMB2_set_info_free(&rqst[num_rqst++]); - break; - case SMB2_OP_SET_EOF: - if (rc) -- trace_smb3_set_eof_err(xid, ses->Suid, tcon->tid, rc); -+ trace_smb3_set_eof_err(xid, tcon->tid, ses->Suid, rc); - else -- trace_smb3_set_eof_done(xid, ses->Suid, tcon->tid); -+ trace_smb3_set_eof_done(xid, tcon->tid, ses->Suid); - SMB2_set_info_free(&rqst[num_rqst++]); - break; - case SMB2_OP_SET_INFO: - if (rc) -- trace_smb3_set_info_compound_err(xid, ses->Suid, -- tcon->tid, rc); -+ trace_smb3_set_info_compound_err(xid, tcon->tid, -+ ses->Suid, rc); - else -- trace_smb3_set_info_compound_done(xid, ses->Suid, -- tcon->tid); -+ trace_smb3_set_info_compound_done(xid, tcon->tid, -+ ses->Suid); - SMB2_set_info_free(&rqst[num_rqst++]); - break; - case SMB2_OP_SET_REPARSE: - if (rc) { -- trace_smb3_set_reparse_compound_err(xid, ses->Suid, -- tcon->tid, rc); -+ trace_smb3_set_reparse_compound_err(xid, tcon->tid, -+ ses->Suid, rc); - } else { -- trace_smb3_set_reparse_compound_done(xid, ses->Suid, -- tcon->tid); -+ trace_smb3_set_reparse_compound_done(xid, tcon->tid, -+ ses->Suid); - } - SMB2_ioctl_free(&rqst[num_rqst++]); - break; -@@ -771,18 +771,18 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - rbuf = reparse_buf_ptr(iov); - if (IS_ERR(rbuf)) { - rc = PTR_ERR(rbuf); -- trace_smb3_set_reparse_compound_err(xid, ses->Suid, -- tcon->tid, rc); -+ trace_smb3_get_reparse_compound_err(xid, tcon->tid, -+ ses->Suid, rc); - } else { - idata->reparse.tag = le32_to_cpu(rbuf->ReparseTag); -- trace_smb3_set_reparse_compound_done(xid, ses->Suid, -- tcon->tid); -+ trace_smb3_get_reparse_compound_done(xid, tcon->tid, -+ ses->Suid); - } - memset(iov, 0, sizeof(*iov)); - resp_buftype[i + 1] = CIFS_NO_BUFFER; - } else { -- trace_smb3_set_reparse_compound_err(xid, ses->Suid, -- tcon->tid, rc); -+ trace_smb3_get_reparse_compound_err(xid, tcon->tid, -+ ses->Suid, rc); - } - SMB2_ioctl_free(&rqst[num_rqst++]); - break; -@@ -799,11 +799,11 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - } - } - if (!rc) { -- trace_smb3_query_wsl_ea_compound_done(xid, ses->Suid, -- tcon->tid); -+ trace_smb3_query_wsl_ea_compound_done(xid, tcon->tid, -+ ses->Suid); - } else { -- trace_smb3_query_wsl_ea_compound_err(xid, ses->Suid, -- tcon->tid, rc); -+ trace_smb3_query_wsl_ea_compound_err(xid, tcon->tid, -+ ses->Suid, rc); - } - SMB2_query_info_free(&rqst[num_rqst++]); - break; -diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c -index d4be915bcb70c7..8d3fa2a3b8a956 100644 ---- a/fs/smb/client/smb2ops.c -+++ b/fs/smb/client/smb2ops.c -@@ -3867,22 +3867,22 @@ static long smb3_fallocate(struct file *file, struct cifs_tcon *tcon, int mode, - static void - smb2_downgrade_oplock(struct TCP_Server_Info *server, - struct cifsInodeInfo *cinode, __u32 oplock, -- unsigned int epoch, bool *purge_cache) -+ __u16 epoch, bool *purge_cache) - { - server->ops->set_oplock_level(cinode, oplock, 0, NULL); - } - - static void - smb21_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock, -- unsigned int epoch, bool *purge_cache); -+ __u16 epoch, bool *purge_cache); - - static void - smb3_downgrade_oplock(struct TCP_Server_Info *server, - struct cifsInodeInfo *cinode, __u32 oplock, -- unsigned int epoch, bool *purge_cache) -+ __u16 epoch, bool *purge_cache) - { - unsigned int old_state = cinode->oplock; -- unsigned int old_epoch = cinode->epoch; -+ __u16 old_epoch = cinode->epoch; - unsigned int new_state; - - if (epoch > old_epoch) { -@@ -3902,7 +3902,7 @@ smb3_downgrade_oplock(struct TCP_Server_Info *server, - - static void - smb2_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock, -- unsigned int epoch, bool *purge_cache) -+ __u16 epoch, bool *purge_cache) - { - oplock &= 0xFF; - cinode->lease_granted = false; -@@ -3926,7 +3926,7 @@ smb2_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock, - - static void - smb21_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock, -- unsigned int epoch, bool *purge_cache) -+ __u16 epoch, bool *purge_cache) - { - char message[5] = {0}; - unsigned int new_oplock = 0; -@@ -3963,7 +3963,7 @@ smb21_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock, - - static void - smb3_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock, -- unsigned int epoch, bool *purge_cache) -+ __u16 epoch, bool *purge_cache) - { - unsigned int old_oplock = cinode->oplock; - -@@ -4077,7 +4077,7 @@ smb3_create_lease_buf(u8 *lease_key, u8 oplock) - } - - static __u8 --smb2_parse_lease_buf(void *buf, unsigned int *epoch, char *lease_key) -+smb2_parse_lease_buf(void *buf, __u16 *epoch, char *lease_key) - { - struct create_lease *lc = (struct create_lease *)buf; - -@@ -4088,7 +4088,7 @@ smb2_parse_lease_buf(void *buf, unsigned int *epoch, char *lease_key) - } - - static __u8 --smb3_parse_lease_buf(void *buf, unsigned int *epoch, char *lease_key) -+smb3_parse_lease_buf(void *buf, __u16 *epoch, char *lease_key) - { - struct create_lease_v2 *lc = (struct create_lease_v2 *)buf; - -diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c -index c012fbc2638ed5..24b1738a35a155 100644 ---- a/fs/smb/client/smb2pdu.c -+++ b/fs/smb/client/smb2pdu.c -@@ -2322,7 +2322,7 @@ parse_posix_ctxt(struct create_context *cc, struct smb2_file_all_info *info, - - int smb2_parse_contexts(struct TCP_Server_Info *server, - struct kvec *rsp_iov, -- unsigned int *epoch, -+ __u16 *epoch, - char *lease_key, __u8 *oplock, - struct smb2_file_all_info *buf, - struct create_posix_rsp *posix) -diff --git a/fs/smb/client/smb2proto.h b/fs/smb/client/smb2proto.h -index 750e4e397b1393..f553e3edd54ecf 100644 ---- a/fs/smb/client/smb2proto.h -+++ b/fs/smb/client/smb2proto.h -@@ -283,7 +283,7 @@ extern enum securityEnum smb2_select_sectype(struct TCP_Server_Info *, - enum securityEnum); - int smb2_parse_contexts(struct TCP_Server_Info *server, - struct kvec *rsp_iov, -- unsigned int *epoch, -+ __u16 *epoch, - char *lease_key, __u8 *oplock, - struct smb2_file_all_info *buf, - struct create_posix_rsp *posix); -diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c -index c12b70d01880c0..449999576a141e 100644 ---- a/fs/smb/server/transport_ipc.c -+++ b/fs/smb/server/transport_ipc.c -@@ -570,6 +570,9 @@ ksmbd_ipc_spnego_authen_request(const char *spnego_blob, int blob_len) - struct ksmbd_spnego_authen_request *req; - struct ksmbd_spnego_authen_response *resp; - -+ if (blob_len > KSMBD_IPC_MAX_PAYLOAD) -+ return NULL; -+ - msg = ipc_msg_alloc(sizeof(struct ksmbd_spnego_authen_request) + - blob_len + 1); - if (!msg) -@@ -749,6 +752,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_write(struct ksmbd_session *sess, int handle - struct ksmbd_rpc_command *req; - struct ksmbd_rpc_command *resp; - -+ if (payload_sz > KSMBD_IPC_MAX_PAYLOAD) -+ return NULL; -+ - msg = ipc_msg_alloc(sizeof(struct ksmbd_rpc_command) + payload_sz + 1); - if (!msg) - return NULL; -@@ -797,6 +803,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_ioctl(struct ksmbd_session *sess, int handle - struct ksmbd_rpc_command *req; - struct ksmbd_rpc_command *resp; - -+ if (payload_sz > KSMBD_IPC_MAX_PAYLOAD) -+ return NULL; -+ - msg = ipc_msg_alloc(sizeof(struct ksmbd_rpc_command) + payload_sz + 1); - if (!msg) - return NULL; -diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c -index 6f7dca1c14c75a..b9784348ebc5c4 100644 ---- a/fs/xfs/xfs_inode.c -+++ b/fs/xfs/xfs_inode.c -@@ -1738,8 +1738,11 @@ xfs_inactive( - goto out; - - /* Try to clean out the cow blocks if there are any. */ -- if (xfs_inode_has_cow_data(ip)) -- xfs_reflink_cancel_cow_range(ip, 0, NULLFILEOFF, true); -+ if (xfs_inode_has_cow_data(ip)) { -+ error = xfs_reflink_cancel_cow_range(ip, 0, NULLFILEOFF, true); -+ if (error) -+ goto out; -+ } - - if (VFS_I(ip)->i_nlink != 0) { - /* -diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c -index 9ce2f48b4ebc01..40d02a1450d3cf 100644 ---- a/fs/xfs/xfs_iomap.c -+++ b/fs/xfs/xfs_iomap.c -@@ -923,10 +923,8 @@ xfs_dax_write_iomap_end( - if (!xfs_is_cow_inode(ip)) - return 0; - -- if (!written) { -- xfs_reflink_cancel_cow_range(ip, pos, length, true); -- return 0; -- } -+ if (!written) -+ return xfs_reflink_cancel_cow_range(ip, pos, length, true); - - return xfs_reflink_end_cow(ip, pos, written); - } -diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h -index d300fde6c1a47a..b2e9dc02fa3495 100644 ---- a/include/drm/drm_connector.h -+++ b/include/drm/drm_connector.h -@@ -1764,8 +1764,11 @@ struct drm_connector { - struct drm_encoder *encoder; - - #define MAX_ELD_BYTES 128 -- /** @eld: EDID-like data, if present */ -+ /** @eld: EDID-like data, if present, protected by @eld_mutex */ - uint8_t eld[MAX_ELD_BYTES]; -+ /** @eld_mutex: protection for concurrenct access to @eld */ -+ struct mutex eld_mutex; -+ - /** @latency_present: AV delay info from ELD, if found */ - bool latency_present[2]; - /** -diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h -index 8d51f69f9f5ef8..af9056d78fadff 100644 ---- a/include/linux/binfmts.h -+++ b/include/linux/binfmts.h -@@ -42,7 +42,9 @@ struct linux_binprm { - * Set when errors can no longer be returned to the - * original userspace. - */ -- point_of_no_return:1; -+ point_of_no_return:1, -+ /* Set when "comm" must come from the dentry. */ -+ comm_from_dentry:1; - struct file *executable; /* Executable to pass to the interpreter */ - struct file *interpreter; - struct file *file; -diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h -index fb6c6109fdcad6..26a8c4ae224459 100644 ---- a/include/linux/kvm_host.h -+++ b/include/linux/kvm_host.h -@@ -920,6 +920,15 @@ static inline struct kvm_io_bus *kvm_get_bus(struct kvm *kvm, enum kvm_bus idx) - static inline struct kvm_vcpu *kvm_get_vcpu(struct kvm *kvm, int i) - { - int num_vcpus = atomic_read(&kvm->online_vcpus); -+ -+ /* -+ * Explicitly verify the target vCPU is online, as the anti-speculation -+ * logic only limits the CPU's ability to speculate, e.g. given a "bad" -+ * index, clamping the index to 0 would return vCPU0, not NULL. -+ */ -+ if (i >= num_vcpus) -+ return NULL; -+ - i = array_index_nospec(i, num_vcpus); - - /* Pairs with smp_wmb() in kvm_vm_ioctl_create_vcpu. */ -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index 38a8ff9c685cb8..69d844b34da0d3 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -709,7 +709,6 @@ struct mlx5_timer { - struct timecounter tc; - u32 nominal_c_mult; - unsigned long overflow_period; -- struct delayed_work overflow_work; - }; - - struct mlx5_clock { -diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h -index 326d3a322c109e..4ec2a948ae3dbb 100644 ---- a/include/net/sch_generic.h -+++ b/include/net/sch_generic.h -@@ -849,7 +849,7 @@ static inline int qdisc_enqueue(struct sk_buff *skb, struct Qdisc *sch, - } - - static inline void _bstats_update(struct gnet_stats_basic_sync *bstats, -- __u64 bytes, __u32 packets) -+ __u64 bytes, __u64 packets) - { - u64_stats_update_begin(&bstats->syncp); - u64_stats_add(&bstats->bytes, bytes); -diff --git a/include/rv/da_monitor.h b/include/rv/da_monitor.h -index 9705b2a98e49e1..510c88bfabd433 100644 ---- a/include/rv/da_monitor.h -+++ b/include/rv/da_monitor.h -@@ -14,6 +14,7 @@ - #include - #include - #include -+#include - - #ifdef CONFIG_RV_REACTORS - -@@ -324,10 +325,13 @@ static inline struct da_monitor *da_get_monitor_##name(struct task_struct *tsk) - static void da_monitor_reset_all_##name(void) \ - { \ - struct task_struct *g, *p; \ -+ int cpu; \ - \ - read_lock(&tasklist_lock); \ - for_each_process_thread(g, p) \ - da_monitor_reset_##name(da_get_monitor_##name(p)); \ -+ for_each_present_cpu(cpu) \ -+ da_monitor_reset_##name(da_get_monitor_##name(idle_task(cpu))); \ - read_unlock(&tasklist_lock); \ - } \ - \ -diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h -index 252bb90aca599b..e7c7b638943629 100644 ---- a/include/trace/events/rxrpc.h -+++ b/include/trace/events/rxrpc.h -@@ -214,6 +214,7 @@ - EM(rxrpc_conn_get_conn_input, "GET inp-conn") \ - EM(rxrpc_conn_get_idle, "GET idle ") \ - EM(rxrpc_conn_get_poke_abort, "GET pk-abort") \ -+ EM(rxrpc_conn_get_poke_secured, "GET secured ") \ - EM(rxrpc_conn_get_poke_timer, "GET poke ") \ - EM(rxrpc_conn_get_service_conn, "GET svc-conn") \ - EM(rxrpc_conn_new_client, "NEW client ") \ -diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h -index a4206723f50333..5a199f3d4a26a2 100644 ---- a/include/uapi/linux/input-event-codes.h -+++ b/include/uapi/linux/input-event-codes.h -@@ -519,6 +519,7 @@ - #define KEY_NOTIFICATION_CENTER 0x1bc /* Show/hide the notification center */ - #define KEY_PICKUP_PHONE 0x1bd /* Answer incoming call */ - #define KEY_HANGUP_PHONE 0x1be /* Decline incoming call */ -+#define KEY_LINK_PHONE 0x1bf /* AL Phone Syncing */ - - #define KEY_DEL_EOL 0x1c0 - #define KEY_DEL_EOS 0x1c1 -diff --git a/include/ufs/ufs.h b/include/ufs/ufs.h -index 0cced88f4531e8..49c90795a2a677 100644 ---- a/include/ufs/ufs.h -+++ b/include/ufs/ufs.h -@@ -384,8 +384,8 @@ enum { - - /* Possible values for dExtendedUFSFeaturesSupport */ - enum { -- UFS_DEV_LOW_TEMP_NOTIF = BIT(4), -- UFS_DEV_HIGH_TEMP_NOTIF = BIT(5), -+ UFS_DEV_HIGH_TEMP_NOTIF = BIT(4), -+ UFS_DEV_LOW_TEMP_NOTIF = BIT(5), - UFS_DEV_EXT_TEMP_NOTIF = BIT(6), - UFS_DEV_HPB_SUPPORT = BIT(7), - UFS_DEV_WRITE_BOOSTER_SUP = BIT(8), -diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c -index c7198fbcf734f7..b61637dad442a7 100644 ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -1779,6 +1779,7 @@ int io_req_prep_async(struct io_kiocb *req) - { - const struct io_cold_def *cdef = &io_cold_defs[req->opcode]; - const struct io_issue_def *def = &io_issue_defs[req->opcode]; -+ int ret; - - /* assign early for deferred execution for non-fixed file */ - if (def->needs_file && !(req->flags & REQ_F_FIXED_FILE) && !req->file) -@@ -1791,7 +1792,9 @@ int io_req_prep_async(struct io_kiocb *req) - if (io_alloc_async_data(req)) - return -EAGAIN; - } -- return cdef->prep_async(req); -+ ret = cdef->prep_async(req); -+ io_kbuf_recycle(req, 0); -+ return ret; - } - - static u32 io_get_sequence(struct io_kiocb *req) -diff --git a/io_uring/net.c b/io_uring/net.c -index 7412904387bfa0..56091292950fd6 100644 ---- a/io_uring/net.c -+++ b/io_uring/net.c -@@ -1533,6 +1533,11 @@ int io_connect(struct io_kiocb *req, unsigned int issue_flags) - io = &__io; - } - -+ if (unlikely(req->flags & REQ_F_FAIL)) { -+ ret = -ECONNRESET; -+ goto out; -+ } -+ - file_flags = force_nonblock ? O_NONBLOCK : 0; - - ret = __sys_connect_file(req->file, &io->address, -diff --git a/io_uring/poll.c b/io_uring/poll.c -index 5cf4fffe8b6c81..cf8e86bc96deb5 100644 ---- a/io_uring/poll.c -+++ b/io_uring/poll.c -@@ -308,6 +308,8 @@ static int io_poll_check_events(struct io_kiocb *req, struct io_tw_state *ts) - return IOU_POLL_REISSUE; - } - } -+ if (unlikely(req->cqe.res & EPOLLERR)) -+ req_set_fail(req); - if (req->apoll_events & EPOLLONESHOT) - return IOU_POLL_DONE; - -@@ -350,8 +352,10 @@ void io_poll_task_func(struct io_kiocb *req, struct io_tw_state *ts) - - ret = io_poll_check_events(req, ts); - if (ret == IOU_POLL_NO_ACTION) { -+ io_kbuf_recycle(req, 0); - return; - } else if (ret == IOU_POLL_REQUEUE) { -+ io_kbuf_recycle(req, 0); - __io_poll_execute(req, 0); - return; - } -diff --git a/io_uring/rw.c b/io_uring/rw.c -index a62f84e28bac35..75b001febb4d28 100644 ---- a/io_uring/rw.c -+++ b/io_uring/rw.c -@@ -793,6 +793,8 @@ static int __io_read(struct io_kiocb *req, unsigned int issue_flags) - goto done; - ret = 0; - } else if (ret == -EIOCBQUEUED) { -+ req->flags |= REQ_F_PARTIAL_IO; -+ io_kbuf_recycle(req, issue_flags); - if (iovec) - kfree(iovec); - return IOU_ISSUE_SKIP_COMPLETE; -@@ -816,6 +818,9 @@ static int __io_read(struct io_kiocb *req, unsigned int issue_flags) - goto done; - } - -+ req->flags |= REQ_F_PARTIAL_IO; -+ io_kbuf_recycle(req, issue_flags); -+ - io = req->async_data; - s = &io->s; - /* -@@ -956,6 +961,11 @@ int io_write(struct io_kiocb *req, unsigned int issue_flags) - else - ret2 = -EINVAL; - -+ if (ret2 == -EIOCBQUEUED) { -+ req->flags |= REQ_F_PARTIAL_IO; -+ io_kbuf_recycle(req, issue_flags); -+ } -+ - if (req->flags & REQ_F_REISSUE) { - req->flags &= ~REQ_F_REISSUE; - ret2 = -EAGAIN; -diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c -index 0fca282c0a2547..dcdf449615bdac 100644 ---- a/kernel/printk/printk.c -+++ b/kernel/printk/printk.c -@@ -474,7 +474,7 @@ static struct latched_seq clear_seq = { - /* record buffer */ - #define LOG_ALIGN __alignof__(unsigned long) - #define __LOG_BUF_LEN (1 << CONFIG_LOG_BUF_SHIFT) --#define LOG_BUF_LEN_MAX (u32)(1 << 31) -+#define LOG_BUF_LEN_MAX ((u32)1 << 31) - static char __log_buf[__LOG_BUF_LEN] __aligned(LOG_ALIGN); - static char *log_buf = __log_buf; - static u32 log_buf_len = __LOG_BUF_LEN; -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 86606fb9e6bc6c..c686d826a91cf5 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -726,13 +726,15 @@ static void update_rq_clock_task(struct rq *rq, s64 delta) - #endif - #ifdef CONFIG_PARAVIRT_TIME_ACCOUNTING - if (static_key_false((¶virt_steal_rq_enabled))) { -- steal = paravirt_steal_clock(cpu_of(rq)); -+ u64 prev_steal; -+ -+ steal = prev_steal = paravirt_steal_clock(cpu_of(rq)); - steal -= rq->prev_steal_time_rq; - - if (unlikely(steal > delta)) - steal = delta; - -- rq->prev_steal_time_rq += steal; -+ rq->prev_steal_time_rq = prev_steal; - delta -= steal; - } - #endif -diff --git a/kernel/trace/trace_osnoise.c b/kernel/trace/trace_osnoise.c -index 3e2bc029fa8c83..cc155590018f65 100644 ---- a/kernel/trace/trace_osnoise.c -+++ b/kernel/trace/trace_osnoise.c -@@ -1235,6 +1235,8 @@ static void trace_sched_migrate_callback(void *data, struct task_struct *p, int - } - } - -+static bool monitor_enabled; -+ - static int register_migration_monitor(void) - { - int ret = 0; -@@ -1243,16 +1245,25 @@ static int register_migration_monitor(void) - * Timerlat thread migration check is only required when running timerlat in user-space. - * Thus, enable callback only if timerlat is set with no workload. - */ -- if (timerlat_enabled() && !test_bit(OSN_WORKLOAD, &osnoise_options)) -+ if (timerlat_enabled() && !test_bit(OSN_WORKLOAD, &osnoise_options)) { -+ if (WARN_ON_ONCE(monitor_enabled)) -+ return 0; -+ - ret = register_trace_sched_migrate_task(trace_sched_migrate_callback, NULL); -+ if (!ret) -+ monitor_enabled = true; -+ } - - return ret; - } - - static void unregister_migration_monitor(void) - { -- if (timerlat_enabled() && !test_bit(OSN_WORKLOAD, &osnoise_options)) -- unregister_trace_sched_migrate_task(trace_sched_migrate_callback, NULL); -+ if (!monitor_enabled) -+ return; -+ -+ unregister_trace_sched_migrate_task(trace_sched_migrate_callback, NULL); -+ monitor_enabled = false; - } - #else - static int register_migration_monitor(void) -diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug -index f94c3e957b8298..e809b6d8bc5373 100644 ---- a/lib/Kconfig.debug -+++ b/lib/Kconfig.debug -@@ -1454,7 +1454,7 @@ config LOCKDEP_SMALL - config LOCKDEP_BITS - int "Bitsize for MAX_LOCKDEP_ENTRIES" - depends on LOCKDEP && !LOCKDEP_SMALL -- range 10 30 -+ range 10 24 - default 15 - help - Try increasing this value if you hit "BUG: MAX_LOCKDEP_ENTRIES too low!" message. -@@ -1470,7 +1470,7 @@ config LOCKDEP_CHAINS_BITS - config LOCKDEP_STACK_TRACE_BITS - int "Bitsize for MAX_STACK_TRACE_ENTRIES" - depends on LOCKDEP && !LOCKDEP_SMALL -- range 10 30 -+ range 10 26 - default 19 - help - Try increasing this value if you hit "BUG: MAX_STACK_TRACE_ENTRIES too low!" message. -@@ -1478,7 +1478,7 @@ config LOCKDEP_STACK_TRACE_BITS - config LOCKDEP_STACK_TRACE_HASH_BITS - int "Bitsize for STACK_TRACE_HASH_SIZE" - depends on LOCKDEP && !LOCKDEP_SMALL -- range 10 30 -+ range 10 26 - default 14 - help - Try increasing this value if you need large STACK_TRACE_HASH_SIZE. -@@ -1486,7 +1486,7 @@ config LOCKDEP_STACK_TRACE_HASH_BITS - config LOCKDEP_CIRCULAR_QUEUE_BITS - int "Bitsize for elements in circular_queue struct" - depends on LOCKDEP -- range 10 30 -+ range 10 26 - default 12 - help - Try increasing this value if you hit "lockdep bfs error:-1" warning due to __cq_enqueue() failure. -diff --git a/lib/maple_tree.c b/lib/maple_tree.c -index 4eda9490636024..a4a2592413b1b6 100644 ---- a/lib/maple_tree.c -+++ b/lib/maple_tree.c -@@ -1870,11 +1870,11 @@ static inline int mab_no_null_split(struct maple_big_node *b_node, - * Return: The first split location. The middle split is set in @mid_split. - */ - static inline int mab_calc_split(struct ma_state *mas, -- struct maple_big_node *bn, unsigned char *mid_split, unsigned long min) -+ struct maple_big_node *bn, unsigned char *mid_split) - { - unsigned char b_end = bn->b_end; - int split = b_end / 2; /* Assume equal split. */ -- unsigned char slot_min, slot_count = mt_slots[bn->type]; -+ unsigned char slot_count = mt_slots[bn->type]; - - /* - * To support gap tracking, all NULL entries are kept together and a node cannot -@@ -1907,18 +1907,7 @@ static inline int mab_calc_split(struct ma_state *mas, - split = b_end / 3; - *mid_split = split * 2; - } else { -- slot_min = mt_min_slots[bn->type]; -- - *mid_split = 0; -- /* -- * Avoid having a range less than the slot count unless it -- * causes one node to be deficient. -- * NOTE: mt_min_slots is 1 based, b_end and split are zero. -- */ -- while ((split < slot_count - 1) && -- ((bn->pivot[split] - min) < slot_count - 1) && -- (b_end - split > slot_min)) -- split++; - } - - /* Avoid ending a node on a NULL entry */ -@@ -2402,7 +2391,7 @@ static inline struct maple_enode - static inline unsigned char mas_mab_to_node(struct ma_state *mas, - struct maple_big_node *b_node, struct maple_enode **left, - struct maple_enode **right, struct maple_enode **middle, -- unsigned char *mid_split, unsigned long min) -+ unsigned char *mid_split) - { - unsigned char split = 0; - unsigned char slot_count = mt_slots[b_node->type]; -@@ -2415,7 +2404,7 @@ static inline unsigned char mas_mab_to_node(struct ma_state *mas, - if (b_node->b_end < slot_count) { - split = b_node->b_end; - } else { -- split = mab_calc_split(mas, b_node, mid_split, min); -+ split = mab_calc_split(mas, b_node, mid_split); - *right = mas_new_ma_node(mas, b_node); - } - -@@ -2905,7 +2894,7 @@ static int mas_spanning_rebalance(struct ma_state *mas, - mast->bn->b_end--; - mast->bn->type = mte_node_type(mast->orig_l->node); - split = mas_mab_to_node(mas, mast->bn, &left, &right, &middle, -- &mid_split, mast->orig_l->min); -+ &mid_split); - mast_set_split_parents(mast, left, middle, right, split, - mid_split); - mast_cp_to_nodes(mast, left, middle, right, split, mid_split); -@@ -3413,7 +3402,7 @@ static int mas_split(struct ma_state *mas, struct maple_big_node *b_node) - if (mas_push_data(mas, height, &mast, false)) - break; - -- split = mab_calc_split(mas, b_node, &mid_split, prev_l_mas.min); -+ split = mab_calc_split(mas, b_node, &mid_split); - mast_split_data(&mast, mas, split); - /* - * Usually correct, mab_mas_cp in the above call overwrites -diff --git a/mm/kfence/core.c b/mm/kfence/core.c -index 3872528d096380..937bbae2611fee 100644 ---- a/mm/kfence/core.c -+++ b/mm/kfence/core.c -@@ -21,6 +21,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -1065,6 +1066,7 @@ void *__kfence_alloc(struct kmem_cache *s, size_t size, gfp_t flags) - * properties (e.g. reside in DMAable memory). - */ - if ((flags & GFP_ZONEMASK) || -+ ((flags & __GFP_THISNODE) && num_online_nodes() > 1) || - (s->flags & (SLAB_CACHE_DMA | SLAB_CACHE_DMA32))) { - atomic_long_inc(&counters[KFENCE_COUNTER_SKIP_INCOMPAT]); - return NULL; -diff --git a/mm/kmemleak.c b/mm/kmemleak.c -index 5811a11cc53a6d..f86d4e04d95e12 100644 ---- a/mm/kmemleak.c -+++ b/mm/kmemleak.c -@@ -1549,7 +1549,7 @@ static void kmemleak_scan(void) - unsigned long phys = object->pointer; - - if (PHYS_PFN(phys) < min_low_pfn || -- PHYS_PFN(phys + object->size) >= max_low_pfn) -+ PHYS_PFN(phys + object->size) > max_low_pfn) - __paint_it(object, KMEMLEAK_BLACK); - } - -diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c -index 379ca86c41cd5b..3451c64fc42dce 100644 ---- a/net/bluetooth/l2cap_sock.c -+++ b/net/bluetooth/l2cap_sock.c -@@ -709,12 +709,12 @@ static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu) - { - switch (chan->scid) { - case L2CAP_CID_ATT: -- if (mtu < L2CAP_LE_MIN_MTU) -+ if (mtu && mtu < L2CAP_LE_MIN_MTU) - return false; - break; - - default: -- if (mtu < L2CAP_DEFAULT_MIN_MTU) -+ if (mtu && mtu < L2CAP_DEFAULT_MIN_MTU) - return false; - } - -@@ -1885,7 +1885,8 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, - chan = l2cap_chan_create(); - if (!chan) { - sk_free(sk); -- sock->sk = NULL; -+ if (sock) -+ sock->sk = NULL; - return NULL; - } - -diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c -index e3440f0d7d9d97..b36254107ef578 100644 ---- a/net/bluetooth/mgmt.c -+++ b/net/bluetooth/mgmt.c -@@ -5453,10 +5453,16 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, - { - struct mgmt_rp_remove_adv_monitor rp; - struct mgmt_pending_cmd *cmd = data; -- struct mgmt_cp_remove_adv_monitor *cp = cmd->param; -+ struct mgmt_cp_remove_adv_monitor *cp; -+ -+ if (status == -ECANCELED || -+ cmd != pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) -+ return; - - hci_dev_lock(hdev); - -+ cp = cmd->param; -+ - rp.monitor_handle = cp->monitor_handle; - - if (!status) -@@ -5474,6 +5480,10 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, - static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data) - { - struct mgmt_pending_cmd *cmd = data; -+ -+ if (cmd != pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) -+ return -ECANCELED; -+ - struct mgmt_cp_remove_adv_monitor *cp = cmd->param; - u16 handle = __le16_to_cpu(cp->monitor_handle); - -diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index 2e4e5356039480..b84d18fcd9e2cd 100644 ---- a/net/ipv4/udp.c -+++ b/net/ipv4/udp.c -@@ -930,9 +930,9 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4, - const int hlen = skb_network_header_len(skb) + - sizeof(struct udphdr); - -- if (hlen + cork->gso_size > cork->fragsize) { -+ if (hlen + min(datalen, cork->gso_size) > cork->fragsize) { - kfree_skb(skb); -- return -EINVAL; -+ return -EMSGSIZE; - } - if (datalen > cork->gso_size * UDP_MAX_SEGMENTS) { - kfree_skb(skb); -diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c -index 954afe6ba883e7..9ff8e723402ba8 100644 ---- a/net/ipv6/udp.c -+++ b/net/ipv6/udp.c -@@ -1246,9 +1246,9 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6, - const int hlen = skb_network_header_len(skb) + - sizeof(struct udphdr); - -- if (hlen + cork->gso_size > cork->fragsize) { -+ if (hlen + min(datalen, cork->gso_size) > cork->fragsize) { - kfree_skb(skb); -- return -EINVAL; -+ return -EMSGSIZE; - } - if (datalen > cork->gso_size * UDP_MAX_SEGMENTS) { - kfree_skb(skb); -diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c -index 2cf4393e48dc06..2b63c5492eedc2 100644 ---- a/net/mptcp/pm_netlink.c -+++ b/net/mptcp/pm_netlink.c -@@ -2069,7 +2069,8 @@ int mptcp_pm_nl_set_flags(struct net *net, struct mptcp_pm_addr_entry *addr, u8 - return -EINVAL; - } - if ((addr->flags & MPTCP_PM_ADDR_FLAG_FULLMESH) && -- (entry->flags & MPTCP_PM_ADDR_FLAG_SIGNAL)) { -+ (entry->flags & (MPTCP_PM_ADDR_FLAG_SIGNAL | -+ MPTCP_PM_ADDR_FLAG_IMPLICIT))) { - spin_unlock_bh(&pernet->lock); - return -EINVAL; - } -diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c -index 5143214695dcd8..140c3ffcb86ba0 100644 ---- a/net/mptcp/protocol.c -+++ b/net/mptcp/protocol.c -@@ -138,6 +138,7 @@ static bool mptcp_try_coalesce(struct sock *sk, struct sk_buff *to, - int delta; - - if (MPTCP_SKB_CB(from)->offset || -+ ((to->len + from->len) > (sk->sk_rcvbuf >> 3)) || - !skb_try_coalesce(to, from, &fragstolen, &delta)) - return false; - -diff --git a/net/ncsi/internal.h b/net/ncsi/internal.h -index ef0f8f73826f53..4e0842df5234ea 100644 ---- a/net/ncsi/internal.h -+++ b/net/ncsi/internal.h -@@ -289,6 +289,7 @@ enum { - ncsi_dev_state_config_sp = 0x0301, - ncsi_dev_state_config_cis, - ncsi_dev_state_config_oem_gma, -+ ncsi_dev_state_config_apply_mac, - ncsi_dev_state_config_clear_vids, - ncsi_dev_state_config_svf, - ncsi_dev_state_config_ev, -@@ -322,6 +323,7 @@ struct ncsi_dev_priv { - #define NCSI_DEV_RESHUFFLE 4 - #define NCSI_DEV_RESET 8 /* Reset state of NC */ - unsigned int gma_flag; /* OEM GMA flag */ -+ struct sockaddr pending_mac; /* MAC address received from GMA */ - spinlock_t lock; /* Protect the NCSI device */ - unsigned int package_probe_id;/* Current ID during probe */ - unsigned int package_num; /* Number of packages */ -diff --git a/net/ncsi/ncsi-cmd.c b/net/ncsi/ncsi-cmd.c -index fd2236ee9a79d3..b3ff37a181d73e 100644 ---- a/net/ncsi/ncsi-cmd.c -+++ b/net/ncsi/ncsi-cmd.c -@@ -270,7 +270,8 @@ static struct ncsi_cmd_handler { - { NCSI_PKT_CMD_GPS, 0, ncsi_cmd_handler_default }, - { NCSI_PKT_CMD_OEM, -1, ncsi_cmd_handler_oem }, - { NCSI_PKT_CMD_PLDM, 0, NULL }, -- { NCSI_PKT_CMD_GPUUID, 0, ncsi_cmd_handler_default } -+ { NCSI_PKT_CMD_GPUUID, 0, ncsi_cmd_handler_default }, -+ { NCSI_PKT_CMD_GMCMA, 0, ncsi_cmd_handler_default } - }; - - static struct ncsi_request *ncsi_alloc_command(struct ncsi_cmd_arg *nca) -diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c -index 90c6cf676221af..a5d3615d7996e6 100644 ---- a/net/ncsi/ncsi-manage.c -+++ b/net/ncsi/ncsi-manage.c -@@ -1038,17 +1038,34 @@ static void ncsi_configure_channel(struct ncsi_dev_priv *ndp) - : ncsi_dev_state_config_clear_vids; - break; - case ncsi_dev_state_config_oem_gma: -- nd->state = ncsi_dev_state_config_clear_vids; -+ nd->state = ncsi_dev_state_config_apply_mac; - -- nca.type = NCSI_PKT_CMD_OEM; - nca.package = np->id; - nca.channel = nc->id; - ndp->pending_req_num = 1; -- ret = ncsi_gma_handler(&nca, nc->version.mf_id); -- if (ret < 0) -+ if (nc->version.major >= 1 && nc->version.minor >= 2) { -+ nca.type = NCSI_PKT_CMD_GMCMA; -+ ret = ncsi_xmit_cmd(&nca); -+ } else { -+ nca.type = NCSI_PKT_CMD_OEM; -+ ret = ncsi_gma_handler(&nca, nc->version.mf_id); -+ } -+ if (ret < 0) { -+ nd->state = ncsi_dev_state_config_clear_vids; - schedule_work(&ndp->work); -+ } - - break; -+ case ncsi_dev_state_config_apply_mac: -+ rtnl_lock(); -+ ret = dev_set_mac_address(dev, &ndp->pending_mac, NULL); -+ rtnl_unlock(); -+ if (ret < 0) -+ netdev_warn(dev, "NCSI: 'Writing MAC address to device failed\n"); -+ -+ nd->state = ncsi_dev_state_config_clear_vids; -+ -+ fallthrough; - case ncsi_dev_state_config_clear_vids: - case ncsi_dev_state_config_svf: - case ncsi_dev_state_config_ev: -@@ -1368,6 +1385,12 @@ static void ncsi_probe_channel(struct ncsi_dev_priv *ndp) - nd->state = ncsi_dev_state_probe_package; - break; - case ncsi_dev_state_probe_package: -+ if (ndp->package_probe_id >= 8) { -+ /* Last package probed, finishing */ -+ ndp->flags |= NCSI_DEV_PROBED; -+ break; -+ } -+ - ndp->pending_req_num = 1; - - nca.type = NCSI_PKT_CMD_SP; -@@ -1484,13 +1507,8 @@ static void ncsi_probe_channel(struct ncsi_dev_priv *ndp) - if (ret) - goto error; - -- /* Probe next package */ -+ /* Probe next package after receiving response */ - ndp->package_probe_id++; -- if (ndp->package_probe_id >= 8) { -- /* Probe finished */ -- ndp->flags |= NCSI_DEV_PROBED; -- break; -- } - nd->state = ncsi_dev_state_probe_package; - ndp->active_package = NULL; - break; -diff --git a/net/ncsi/ncsi-pkt.h b/net/ncsi/ncsi-pkt.h -index c9d1da34dc4dc5..f2f3b5c1b94126 100644 ---- a/net/ncsi/ncsi-pkt.h -+++ b/net/ncsi/ncsi-pkt.h -@@ -338,6 +338,14 @@ struct ncsi_rsp_gpuuid_pkt { - __be32 checksum; - }; - -+/* Get MC MAC Address */ -+struct ncsi_rsp_gmcma_pkt { -+ struct ncsi_rsp_pkt_hdr rsp; -+ unsigned char address_count; -+ unsigned char reserved[3]; -+ unsigned char addresses[][ETH_ALEN]; -+}; -+ - /* AEN: Link State Change */ - struct ncsi_aen_lsc_pkt { - struct ncsi_aen_pkt_hdr aen; /* AEN header */ -@@ -398,6 +406,7 @@ struct ncsi_aen_hncdsc_pkt { - #define NCSI_PKT_CMD_GPUUID 0x52 /* Get package UUID */ - #define NCSI_PKT_CMD_QPNPR 0x56 /* Query Pending NC PLDM request */ - #define NCSI_PKT_CMD_SNPR 0x57 /* Send NC PLDM Reply */ -+#define NCSI_PKT_CMD_GMCMA 0x58 /* Get MC MAC Address */ - - - /* NCSI packet responses */ -@@ -433,6 +442,7 @@ struct ncsi_aen_hncdsc_pkt { - #define NCSI_PKT_RSP_GPUUID (NCSI_PKT_CMD_GPUUID + 0x80) - #define NCSI_PKT_RSP_QPNPR (NCSI_PKT_CMD_QPNPR + 0x80) - #define NCSI_PKT_RSP_SNPR (NCSI_PKT_CMD_SNPR + 0x80) -+#define NCSI_PKT_RSP_GMCMA (NCSI_PKT_CMD_GMCMA + 0x80) - - /* NCSI response code/reason */ - #define NCSI_PKT_RSP_C_COMPLETED 0x0000 /* Command Completed */ -diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c -index f22d67cb04d371..4a8ce2949faeac 100644 ---- a/net/ncsi/ncsi-rsp.c -+++ b/net/ncsi/ncsi-rsp.c -@@ -628,16 +628,14 @@ static int ncsi_rsp_handler_snfc(struct ncsi_request *nr) - static int ncsi_rsp_handler_oem_gma(struct ncsi_request *nr, int mfr_id) - { - struct ncsi_dev_priv *ndp = nr->ndp; -+ struct sockaddr *saddr = &ndp->pending_mac; - struct net_device *ndev = ndp->ndev.dev; - struct ncsi_rsp_oem_pkt *rsp; -- struct sockaddr saddr; - u32 mac_addr_off = 0; -- int ret = 0; - - /* Get the response header */ - rsp = (struct ncsi_rsp_oem_pkt *)skb_network_header(nr->rsp); - -- saddr.sa_family = ndev->type; - ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE; - if (mfr_id == NCSI_OEM_MFR_BCM_ID) - mac_addr_off = BCM_MAC_ADDR_OFFSET; -@@ -646,22 +644,17 @@ static int ncsi_rsp_handler_oem_gma(struct ncsi_request *nr, int mfr_id) - else if (mfr_id == NCSI_OEM_MFR_INTEL_ID) - mac_addr_off = INTEL_MAC_ADDR_OFFSET; - -- memcpy(saddr.sa_data, &rsp->data[mac_addr_off], ETH_ALEN); -+ saddr->sa_family = ndev->type; -+ memcpy(saddr->sa_data, &rsp->data[mac_addr_off], ETH_ALEN); - if (mfr_id == NCSI_OEM_MFR_BCM_ID || mfr_id == NCSI_OEM_MFR_INTEL_ID) -- eth_addr_inc((u8 *)saddr.sa_data); -- if (!is_valid_ether_addr((const u8 *)saddr.sa_data)) -+ eth_addr_inc((u8 *)saddr->sa_data); -+ if (!is_valid_ether_addr((const u8 *)saddr->sa_data)) - return -ENXIO; - - /* Set the flag for GMA command which should only be called once */ - ndp->gma_flag = 1; - -- rtnl_lock(); -- ret = dev_set_mac_address(ndev, &saddr, NULL); -- rtnl_unlock(); -- if (ret < 0) -- netdev_warn(ndev, "NCSI: 'Writing mac address to device failed\n"); -- -- return ret; -+ return 0; - } - - /* Response handler for Mellanox card */ -@@ -1093,6 +1086,42 @@ static int ncsi_rsp_handler_netlink(struct ncsi_request *nr) - return ret; - } - -+static int ncsi_rsp_handler_gmcma(struct ncsi_request *nr) -+{ -+ struct ncsi_dev_priv *ndp = nr->ndp; -+ struct sockaddr *saddr = &ndp->pending_mac; -+ struct net_device *ndev = ndp->ndev.dev; -+ struct ncsi_rsp_gmcma_pkt *rsp; -+ int i; -+ -+ rsp = (struct ncsi_rsp_gmcma_pkt *)skb_network_header(nr->rsp); -+ ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE; -+ -+ netdev_info(ndev, "NCSI: Received %d provisioned MAC addresses\n", -+ rsp->address_count); -+ for (i = 0; i < rsp->address_count; i++) { -+ netdev_info(ndev, "NCSI: MAC address %d: %02x:%02x:%02x:%02x:%02x:%02x\n", -+ i, rsp->addresses[i][0], rsp->addresses[i][1], -+ rsp->addresses[i][2], rsp->addresses[i][3], -+ rsp->addresses[i][4], rsp->addresses[i][5]); -+ } -+ -+ saddr->sa_family = ndev->type; -+ for (i = 0; i < rsp->address_count; i++) { -+ if (!is_valid_ether_addr(rsp->addresses[i])) { -+ netdev_warn(ndev, "NCSI: Unable to assign %pM to device\n", -+ rsp->addresses[i]); -+ continue; -+ } -+ memcpy(saddr->sa_data, rsp->addresses[i], ETH_ALEN); -+ netdev_warn(ndev, "NCSI: Will set MAC address to %pM\n", saddr->sa_data); -+ break; -+ } -+ -+ ndp->gma_flag = 1; -+ return 0; -+} -+ - static struct ncsi_rsp_handler { - unsigned char type; - int payload; -@@ -1129,7 +1158,8 @@ static struct ncsi_rsp_handler { - { NCSI_PKT_RSP_PLDM, -1, ncsi_rsp_handler_pldm }, - { NCSI_PKT_RSP_GPUUID, 20, ncsi_rsp_handler_gpuuid }, - { NCSI_PKT_RSP_QPNPR, -1, ncsi_rsp_handler_pldm }, -- { NCSI_PKT_RSP_SNPR, -1, ncsi_rsp_handler_pldm } -+ { NCSI_PKT_RSP_SNPR, -1, ncsi_rsp_handler_pldm }, -+ { NCSI_PKT_RSP_GMCMA, -1, ncsi_rsp_handler_gmcma }, - }; - - int ncsi_rcv_rsp(struct sk_buff *skb, struct net_device *dev, -diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c -index de175318a3a0f3..082ab66f120b73 100644 ---- a/net/nfc/nci/hci.c -+++ b/net/nfc/nci/hci.c -@@ -542,6 +542,8 @@ static u8 nci_hci_create_pipe(struct nci_dev *ndev, u8 dest_host, - - pr_debug("pipe created=%d\n", pipe); - -+ if (pipe >= NCI_HCI_MAX_PIPES) -+ pipe = NCI_HCI_INVALID_PIPE; - return pipe; - } - -diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c -index 342823b918e7cc..66e9ceaaa43a14 100644 ---- a/net/rose/af_rose.c -+++ b/net/rose/af_rose.c -@@ -701,11 +701,9 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - struct net_device *dev; - ax25_address *source; - ax25_uid_assoc *user; -+ int err = -EINVAL; - int n; - -- if (!sock_flag(sk, SOCK_ZAPPED)) -- return -EINVAL; -- - if (addr_len != sizeof(struct sockaddr_rose) && addr_len != sizeof(struct full_sockaddr_rose)) - return -EINVAL; - -@@ -718,8 +716,15 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - if ((unsigned int) addr->srose_ndigis > ROSE_MAX_DIGIS) - return -EINVAL; - -- if ((dev = rose_dev_get(&addr->srose_addr)) == NULL) -- return -EADDRNOTAVAIL; -+ lock_sock(sk); -+ -+ if (!sock_flag(sk, SOCK_ZAPPED)) -+ goto out_release; -+ -+ err = -EADDRNOTAVAIL; -+ dev = rose_dev_get(&addr->srose_addr); -+ if (!dev) -+ goto out_release; - - source = &addr->srose_call; - -@@ -730,7 +735,8 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - } else { - if (ax25_uid_policy && !capable(CAP_NET_BIND_SERVICE)) { - dev_put(dev); -- return -EACCES; -+ err = -EACCES; -+ goto out_release; - } - rose->source_call = *source; - } -@@ -753,8 +759,10 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - rose_insert_socket(sk); - - sock_reset_flag(sk, SOCK_ZAPPED); -- -- return 0; -+ err = 0; -+out_release: -+ release_sock(sk); -+ return err; - } - - static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_len, int flags) -diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h -index 66ad7dc10864e0..86438c86eb2fd3 100644 ---- a/net/rxrpc/ar-internal.h -+++ b/net/rxrpc/ar-internal.h -@@ -558,6 +558,7 @@ enum rxrpc_call_flag { - RXRPC_CALL_EXCLUSIVE, /* The call uses a once-only connection */ - RXRPC_CALL_RX_IS_IDLE, /* recvmsg() is idle - send an ACK */ - RXRPC_CALL_RECVMSG_READ_ALL, /* recvmsg() read all of the received data */ -+ RXRPC_CALL_CONN_CHALLENGING, /* The connection is being challenged */ - }; - - /* -@@ -578,7 +579,6 @@ enum rxrpc_call_state { - RXRPC_CALL_CLIENT_AWAIT_REPLY, /* - client awaiting reply */ - RXRPC_CALL_CLIENT_RECV_REPLY, /* - client receiving reply phase */ - RXRPC_CALL_SERVER_PREALLOC, /* - service preallocation */ -- RXRPC_CALL_SERVER_SECURING, /* - server securing request connection */ - RXRPC_CALL_SERVER_RECV_REQUEST, /* - server receiving request */ - RXRPC_CALL_SERVER_ACK_REQUEST, /* - server pending ACK of request */ - RXRPC_CALL_SERVER_SEND_REPLY, /* - server sending reply */ -diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c -index 29385908099efc..4f8e8f884d102c 100644 ---- a/net/rxrpc/call_object.c -+++ b/net/rxrpc/call_object.c -@@ -22,7 +22,6 @@ const char *const rxrpc_call_states[NR__RXRPC_CALL_STATES] = { - [RXRPC_CALL_CLIENT_AWAIT_REPLY] = "ClAwtRpl", - [RXRPC_CALL_CLIENT_RECV_REPLY] = "ClRcvRpl", - [RXRPC_CALL_SERVER_PREALLOC] = "SvPrealc", -- [RXRPC_CALL_SERVER_SECURING] = "SvSecure", - [RXRPC_CALL_SERVER_RECV_REQUEST] = "SvRcvReq", - [RXRPC_CALL_SERVER_ACK_REQUEST] = "SvAckReq", - [RXRPC_CALL_SERVER_SEND_REPLY] = "SvSndRpl", -@@ -458,17 +457,16 @@ void rxrpc_incoming_call(struct rxrpc_sock *rx, - call->cong_tstamp = skb->tstamp; - - __set_bit(RXRPC_CALL_EXPOSED, &call->flags); -- rxrpc_set_call_state(call, RXRPC_CALL_SERVER_SECURING); -+ rxrpc_set_call_state(call, RXRPC_CALL_SERVER_RECV_REQUEST); - - spin_lock(&conn->state_lock); - - switch (conn->state) { - case RXRPC_CONN_SERVICE_UNSECURED: - case RXRPC_CONN_SERVICE_CHALLENGING: -- rxrpc_set_call_state(call, RXRPC_CALL_SERVER_SECURING); -+ __set_bit(RXRPC_CALL_CONN_CHALLENGING, &call->flags); - break; - case RXRPC_CONN_SERVICE: -- rxrpc_set_call_state(call, RXRPC_CALL_SERVER_RECV_REQUEST); - break; - - case RXRPC_CONN_ABORTED: -diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c -index 2a1396cd892f30..c4eb7986efddf8 100644 ---- a/net/rxrpc/conn_event.c -+++ b/net/rxrpc/conn_event.c -@@ -222,10 +222,8 @@ static void rxrpc_abort_calls(struct rxrpc_connection *conn) - */ - static void rxrpc_call_is_secure(struct rxrpc_call *call) - { -- if (call && __rxrpc_call_state(call) == RXRPC_CALL_SERVER_SECURING) { -- rxrpc_set_call_state(call, RXRPC_CALL_SERVER_RECV_REQUEST); -+ if (call && __test_and_clear_bit(RXRPC_CALL_CONN_CHALLENGING, &call->flags)) - rxrpc_notify_socket(call); -- } - } - - /* -@@ -266,6 +264,7 @@ static int rxrpc_process_event(struct rxrpc_connection *conn, - * we've already received the packet, put it on the - * front of the queue. - */ -+ sp->conn = rxrpc_get_connection(conn, rxrpc_conn_get_poke_secured); - skb->mark = RXRPC_SKB_MARK_SERVICE_CONN_SECURED; - rxrpc_get_skb(skb, rxrpc_skb_get_conn_secured); - skb_queue_head(&conn->local->rx_queue, skb); -@@ -431,14 +430,16 @@ void rxrpc_input_conn_event(struct rxrpc_connection *conn, struct sk_buff *skb) - if (test_and_clear_bit(RXRPC_CONN_EV_ABORT_CALLS, &conn->events)) - rxrpc_abort_calls(conn); - -- switch (skb->mark) { -- case RXRPC_SKB_MARK_SERVICE_CONN_SECURED: -- if (conn->state != RXRPC_CONN_SERVICE) -- break; -+ if (skb) { -+ switch (skb->mark) { -+ case RXRPC_SKB_MARK_SERVICE_CONN_SECURED: -+ if (conn->state != RXRPC_CONN_SERVICE) -+ break; - -- for (loop = 0; loop < RXRPC_MAXCALLS; loop++) -- rxrpc_call_is_secure(conn->channels[loop].call); -- break; -+ for (loop = 0; loop < RXRPC_MAXCALLS; loop++) -+ rxrpc_call_is_secure(conn->channels[loop].call); -+ break; -+ } - } - - /* Process delayed ACKs whose time has come. */ -diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c -index 7aa58129ae4550..f0c77f437b6167 100644 ---- a/net/rxrpc/conn_object.c -+++ b/net/rxrpc/conn_object.c -@@ -67,6 +67,7 @@ struct rxrpc_connection *rxrpc_alloc_connection(struct rxrpc_net *rxnet, - INIT_WORK(&conn->destructor, rxrpc_clean_up_connection); - INIT_LIST_HEAD(&conn->proc_link); - INIT_LIST_HEAD(&conn->link); -+ INIT_LIST_HEAD(&conn->attend_link); - mutex_init(&conn->security_lock); - skb_queue_head_init(&conn->rx_queue); - conn->rxnet = rxnet; -diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c -index 5dfda1ac51dda7..9a162035d4c1d0 100644 ---- a/net/rxrpc/input.c -+++ b/net/rxrpc/input.c -@@ -574,7 +574,7 @@ static bool rxrpc_input_split_jumbo(struct rxrpc_call *call, struct sk_buff *skb - rxrpc_propose_delay_ACK(call, sp->hdr.serial, - rxrpc_propose_ack_input_data); - } -- if (notify) { -+ if (notify && !test_bit(RXRPC_CALL_CONN_CHALLENGING, &call->flags)) { - trace_rxrpc_notify_socket(call->debug_id, sp->hdr.serial); - rxrpc_notify_socket(call); - } -diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c -index 24f765d243db1c..b9f2f12281b33e 100644 ---- a/net/rxrpc/sendmsg.c -+++ b/net/rxrpc/sendmsg.c -@@ -658,7 +658,7 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len) - } else { - switch (rxrpc_call_state(call)) { - case RXRPC_CALL_CLIENT_AWAIT_CONN: -- case RXRPC_CALL_SERVER_SECURING: -+ case RXRPC_CALL_SERVER_RECV_REQUEST: - if (p.command == RXRPC_CMD_SEND_ABORT) - break; - fallthrough; -diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c -index 152dbbe8fd31ab..447d3e836a24f0 100644 ---- a/net/sched/sch_netem.c -+++ b/net/sched/sch_netem.c -@@ -748,9 +748,9 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch) - if (err != NET_XMIT_SUCCESS) { - if (net_xmit_drop_count(err)) - qdisc_qstats_drop(sch); -- qdisc_tree_reduce_backlog(sch, 1, pkt_len); - sch->qstats.backlog -= pkt_len; - sch->q.qlen--; -+ qdisc_tree_reduce_backlog(sch, 1, pkt_len); - } - goto tfifo_dequeue; - } -diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c -index 43c3f1c971b8fd..c524421ec65252 100644 ---- a/net/tipc/crypto.c -+++ b/net/tipc/crypto.c -@@ -2293,8 +2293,8 @@ static bool tipc_crypto_key_rcv(struct tipc_crypto *rx, struct tipc_msg *hdr) - keylen = ntohl(*((__be32 *)(data + TIPC_AEAD_ALG_NAME))); - - /* Verify the supplied size values */ -- if (unlikely(size != keylen + sizeof(struct tipc_aead_key) || -- keylen > TIPC_AEAD_KEY_SIZE_MAX)) { -+ if (unlikely(keylen > TIPC_AEAD_KEY_SIZE_MAX || -+ size != keylen + sizeof(struct tipc_aead_key))) { - pr_debug("%s: invalid MSG_CRYPTO key size\n", rx->name); - goto exit; - } -diff --git a/rust/kernel/init.rs b/rust/kernel/init.rs -index 0fe043c0eaacdc..2d4b19b8685771 100644 ---- a/rust/kernel/init.rs -+++ b/rust/kernel/init.rs -@@ -788,7 +788,7 @@ pub unsafe trait PinInit: Sized { - /// use kernel::{types::Opaque, init::pin_init_from_closure}; - /// #[repr(C)] - /// struct RawFoo([u8; 16]); -- /// extern { -+ /// extern "C" { - /// fn init_foo(_: *mut RawFoo); - /// } - /// -diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn -index 16c750bb95fafd..0ea3281a92e1eb 100644 ---- a/scripts/Makefile.extrawarn -+++ b/scripts/Makefile.extrawarn -@@ -144,7 +144,6 @@ KBUILD_CFLAGS += -Wno-tautological-constant-out-of-range-compare - KBUILD_CFLAGS += $(call cc-disable-warning, unaligned-access) - KBUILD_CFLAGS += $(call cc-disable-warning, cast-function-type-strict) - KBUILD_CFLAGS += -Wno-enum-compare-conditional --KBUILD_CFLAGS += -Wno-enum-enum-conversion - endif - - endif -@@ -175,6 +174,10 @@ KBUILD_CFLAGS += -Wno-missing-field-initializers - KBUILD_CFLAGS += -Wno-type-limits - KBUILD_CFLAGS += -Wno-shift-negative-value - -+ifdef CONFIG_CC_IS_CLANG -+KBUILD_CFLAGS += -Wno-enum-enum-conversion -+endif -+ - ifdef CONFIG_CC_IS_CLANG - KBUILD_CFLAGS += -Wno-initializer-overrides - else -diff --git a/scripts/gdb/linux/cpus.py b/scripts/gdb/linux/cpus.py -index 255dc18cb9da45..5563c3a79fc17a 100644 ---- a/scripts/gdb/linux/cpus.py -+++ b/scripts/gdb/linux/cpus.py -@@ -172,7 +172,7 @@ def get_current_task(cpu): - var_ptr = gdb.parse_and_eval("&pcpu_hot.current_task") - return per_cpu(var_ptr, cpu).dereference() - elif utils.is_target_arch("aarch64"): -- current_task_addr = gdb.parse_and_eval("$SP_EL0") -+ current_task_addr = gdb.parse_and_eval("(unsigned long)$SP_EL0") - if (current_task_addr >> 63) != 0: - current_task = current_task_addr.cast(task_ptr_type) - return current_task.dereference() -diff --git a/security/safesetid/securityfs.c b/security/safesetid/securityfs.c -index 25310468bcddff..8e1ffd70b18ab4 100644 ---- a/security/safesetid/securityfs.c -+++ b/security/safesetid/securityfs.c -@@ -143,6 +143,9 @@ static ssize_t handle_policy_update(struct file *file, - char *buf, *p, *end; - int err; - -+ if (len >= KMALLOC_MAX_SIZE) -+ return -EINVAL; -+ - pol = kmalloc(sizeof(struct setid_ruleset), GFP_KERNEL); - if (!pol) - return -ENOMEM; -diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c -index ea3140d510ecbf..e58e265d16578e 100644 ---- a/security/tomoyo/common.c -+++ b/security/tomoyo/common.c -@@ -2665,7 +2665,7 @@ ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head, - - if (head->w.avail >= head->writebuf_size - 1) { - const int len = head->writebuf_size * 2; -- char *cp = kzalloc(len, GFP_NOFS); -+ char *cp = kzalloc(len, GFP_NOFS | __GFP_NOWARN); - - if (!cp) { - error = -ENOMEM; -diff --git a/sound/pci/hda/hda_auto_parser.c b/sound/pci/hda/hda_auto_parser.c -index 8e74be038b0fad..0091ab3f2bd56b 100644 ---- a/sound/pci/hda/hda_auto_parser.c -+++ b/sound/pci/hda/hda_auto_parser.c -@@ -80,7 +80,11 @@ static int compare_input_type(const void *ap, const void *bp) - - /* In case one has boost and the other one has not, - pick the one with boost first. */ -- return (int)(b->has_boost_on_pin - a->has_boost_on_pin); -+ if (a->has_boost_on_pin != b->has_boost_on_pin) -+ return (int)(b->has_boost_on_pin - a->has_boost_on_pin); -+ -+ /* Keep the original order */ -+ return a->order - b->order; - } - - /* Reorder the surround channels -@@ -400,6 +404,8 @@ int snd_hda_parse_pin_defcfg(struct hda_codec *codec, - reorder_outputs(cfg->speaker_outs, cfg->speaker_pins); - - /* sort inputs in the order of AUTO_PIN_* type */ -+ for (i = 0; i < cfg->num_inputs; i++) -+ cfg->inputs[i].order = i; - sort(cfg->inputs, cfg->num_inputs, sizeof(cfg->inputs[0]), - compare_input_type, NULL); - -diff --git a/sound/pci/hda/hda_auto_parser.h b/sound/pci/hda/hda_auto_parser.h -index 579b11beac718e..87af3d8c02f7f6 100644 ---- a/sound/pci/hda/hda_auto_parser.h -+++ b/sound/pci/hda/hda_auto_parser.h -@@ -37,6 +37,7 @@ struct auto_pin_cfg_item { - unsigned int is_headset_mic:1; - unsigned int is_headphone_mic:1; /* Mic-only in headphone jack */ - unsigned int has_boost_on_pin:1; -+ int order; - }; - - struct auto_pin_cfg; -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 0b679fd1b82ab9..abe3d5b9b84b3e 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -9949,6 +9949,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x8870, "HP ZBook Fury 15.6 Inch G8 Mobile Workstation PC", ALC285_FIXUP_HP_GPIO_AMP_INIT), - SND_PCI_QUIRK(0x103c, 0x8873, "HP ZBook Studio 15.6 Inch G8 Mobile Workstation PC", ALC285_FIXUP_HP_GPIO_AMP_INIT), - SND_PCI_QUIRK(0x103c, 0x887a, "HP Laptop 15s-eq2xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), -+ SND_PCI_QUIRK(0x103c, 0x887c, "HP Laptop 14s-fq1xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), - SND_PCI_QUIRK(0x103c, 0x888a, "HP ENVY x360 Convertible 15-eu0xxx", ALC245_FIXUP_HP_X360_MUTE_LEDS), - SND_PCI_QUIRK(0x103c, 0x888d, "HP ZBook Power 15.6 inch G8 Mobile Workstation PC", ALC236_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x8895, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_SPEAKERS_MICMUTE_LED), -@@ -10401,6 +10402,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x17aa, 0x511f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), - SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD), - SND_PCI_QUIRK(0x17aa, 0x9e56, "Lenovo ZhaoYang CF4620Z", ALC286_FIXUP_SONY_MIC_NO_PRESENCE), -+ SND_PCI_QUIRK(0x1849, 0x0269, "Positivo Master C6400", ALC269VB_FIXUP_ASUS_ZENBOOK), - SND_PCI_QUIRK(0x1849, 0x1233, "ASRock NUC Box 1100", ALC233_FIXUP_NO_AUDIO_JACK), - SND_PCI_QUIRK(0x1849, 0xa233, "Positivo Master C6300", ALC269_FIXUP_HEADSET_MIC), - SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS), -diff --git a/sound/soc/amd/Kconfig b/sound/soc/amd/Kconfig -index 273688c053172f..0b6a01c6bbb1b1 100644 ---- a/sound/soc/amd/Kconfig -+++ b/sound/soc/amd/Kconfig -@@ -105,7 +105,7 @@ config SND_SOC_AMD_ACP6x - config SND_SOC_AMD_YC_MACH - tristate "AMD YC support for DMIC" - select SND_SOC_DMIC -- depends on SND_SOC_AMD_ACP6x -+ depends on SND_SOC_AMD_ACP6x && ACPI - help - This option enables machine driver for Yellow Carp platform - using dmic. ACP IP has PDM Decoder block with DMA controller. -diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c -index f7fbde1bc2ed2e..eac023283ff790 100644 ---- a/sound/soc/amd/yc/acp6x-mach.c -+++ b/sound/soc/amd/yc/acp6x-mach.c -@@ -304,6 +304,34 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "83AS"), - } - }, -+ { -+ .driver_data = &acp6x_card, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "83L3"), -+ } -+ }, -+ { -+ .driver_data = &acp6x_card, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "83N6"), -+ } -+ }, -+ { -+ .driver_data = &acp6x_card, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "83Q2"), -+ } -+ }, -+ { -+ .driver_data = &acp6x_card, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "83Q3"), -+ } -+ }, - { - .driver_data = &acp6x_card, - .matches = { -diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c -index 511446a30c057b..60248a6820aacc 100644 ---- a/sound/soc/soc-pcm.c -+++ b/sound/soc/soc-pcm.c -@@ -38,7 +38,6 @@ static inline int _soc_pcm_ret(struct snd_soc_pcm_runtime *rtd, - switch (ret) { - case -EPROBE_DEFER: - case -ENOTSUPP: -- case -EINVAL: - break; - default: - dev_err(rtd->dev, -@@ -902,7 +901,13 @@ static int __soc_pcm_prepare(struct snd_soc_pcm_runtime *rtd, - } - - out: -- return soc_pcm_ret(rtd, ret); -+ /* -+ * Don't use soc_pcm_ret() on .prepare callback to lower error log severity -+ * -+ * We don't want to log an error since we do not want to give userspace a way to do a -+ * denial-of-service attack on the syslog / diskspace. -+ */ -+ return ret; - } - - /* PCM prepare ops for non-DPCM streams */ -@@ -914,6 +919,13 @@ static int soc_pcm_prepare(struct snd_pcm_substream *substream) - snd_soc_dpcm_mutex_lock(rtd); - ret = __soc_pcm_prepare(rtd, substream); - snd_soc_dpcm_mutex_unlock(rtd); -+ -+ /* -+ * Don't use soc_pcm_ret() on .prepare callback to lower error log severity -+ * -+ * We don't want to log an error since we do not want to give userspace a way to do a -+ * denial-of-service attack on the syslog / diskspace. -+ */ - return ret; - } - -@@ -2461,7 +2473,13 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream) - be->dpcm[stream].state = SND_SOC_DPCM_STATE_PREPARE; - } - -- return soc_pcm_ret(fe, ret); -+ /* -+ * Don't use soc_pcm_ret() on .prepare callback to lower error log severity -+ * -+ * We don't want to log an error since we do not want to give userspace a way to do a -+ * denial-of-service attack on the syslog / diskspace. -+ */ -+ return ret; - } - - static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) -@@ -2501,7 +2519,13 @@ static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) - dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO); - snd_soc_dpcm_mutex_unlock(fe); - -- return soc_pcm_ret(fe, ret); -+ /* -+ * Don't use soc_pcm_ret() on .prepare callback to lower error log severity -+ * -+ * We don't want to log an error since we do not want to give userspace a way to do a -+ * denial-of-service attack on the syslog / diskspace. -+ */ -+ return ret; - } - - static int dpcm_run_update_shutdown(struct snd_soc_pcm_runtime *fe, int stream) -diff --git a/tools/perf/bench/epoll-wait.c b/tools/perf/bench/epoll-wait.c -index cb5174b53940b2..f370f7872ba4c9 100644 ---- a/tools/perf/bench/epoll-wait.c -+++ b/tools/perf/bench/epoll-wait.c -@@ -420,7 +420,12 @@ static int cmpworker(const void *p1, const void *p2) - - struct worker *w1 = (struct worker *) p1; - struct worker *w2 = (struct worker *) p2; -- return w1->tid > w2->tid; -+ -+ if (w1->tid > w2->tid) -+ return 1; -+ if (w1->tid < w2->tid) -+ return -1; -+ return 0; - } - - int bench_epoll_wait(int argc, const char **argv) -diff --git a/tools/testing/selftests/net/ipsec.c b/tools/testing/selftests/net/ipsec.c -index be4a30a0d02aef..9b44a091802cbb 100644 ---- a/tools/testing/selftests/net/ipsec.c -+++ b/tools/testing/selftests/net/ipsec.c -@@ -227,7 +227,8 @@ static int rtattr_pack(struct nlmsghdr *nh, size_t req_sz, - - attr->rta_len = RTA_LENGTH(size); - attr->rta_type = rta_type; -- memcpy(RTA_DATA(attr), payload, size); -+ if (payload) -+ memcpy(RTA_DATA(attr), payload, size); - - return 0; - } -diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.c b/tools/testing/selftests/net/mptcp/mptcp_connect.c -index 414addef9a4514..d240d02fa443a1 100644 ---- a/tools/testing/selftests/net/mptcp/mptcp_connect.c -+++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c -@@ -1302,7 +1302,7 @@ int main_loop(void) - return ret; - - if (cfg_truncate > 0) { -- xdisconnect(fd); -+ shutdown(fd, SHUT_WR); - } else if (--cfg_repeat > 0) { - xdisconnect(fd); - -diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh -index 17ace5627ce365..497dc187387f8d 100755 ---- a/tools/testing/selftests/net/mptcp/mptcp_join.sh -+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh -@@ -2941,7 +2941,7 @@ verify_listener_events() - type=$(mptcp_lib_evts_get_info type "$evt" "$e_type") - family=$(mptcp_lib_evts_get_info family "$evt" "$e_type") - sport=$(mptcp_lib_evts_get_info sport "$evt" "$e_type") -- if [ $family ] && [ $family = $AF_INET6 ]; then -+ if [ $family ] && [ $family = $MPTCP_LIB_AF_INET6 ]; then - saddr=$(mptcp_lib_evts_get_info saddr6 "$evt" "$e_type") - else - saddr=$(mptcp_lib_evts_get_info saddr4 "$evt" "$e_type") -diff --git a/tools/testing/selftests/net/udpgso.c b/tools/testing/selftests/net/udpgso.c -index b02080d09fbc05..d0fba50bd6ef08 100644 ---- a/tools/testing/selftests/net/udpgso.c -+++ b/tools/testing/selftests/net/udpgso.c -@@ -94,6 +94,19 @@ struct testcase testcases_v4[] = { - .gso_len = CONST_MSS_V4, - .r_num_mss = 1, - }, -+ { -+ /* datalen <= MSS < gso_len: will fall back to no GSO */ -+ .tlen = CONST_MSS_V4, -+ .gso_len = CONST_MSS_V4 + 1, -+ .r_num_mss = 0, -+ .r_len_last = CONST_MSS_V4, -+ }, -+ { -+ /* MSS < datalen < gso_len: fail */ -+ .tlen = CONST_MSS_V4 + 1, -+ .gso_len = CONST_MSS_V4 + 2, -+ .tfail = true, -+ }, - { - /* send a single MSS + 1B */ - .tlen = CONST_MSS_V4 + 1, -@@ -197,6 +210,19 @@ struct testcase testcases_v6[] = { - .gso_len = CONST_MSS_V6, - .r_num_mss = 1, - }, -+ { -+ /* datalen <= MSS < gso_len: will fall back to no GSO */ -+ .tlen = CONST_MSS_V6, -+ .gso_len = CONST_MSS_V6 + 1, -+ .r_num_mss = 0, -+ .r_len_last = CONST_MSS_V6, -+ }, -+ { -+ /* MSS < datalen < gso_len: fail */ -+ .tlen = CONST_MSS_V6 + 1, -+ .gso_len = CONST_MSS_V6 + 2, -+ .tfail = true -+ }, - { - /* send a single MSS + 1B */ - .tlen = CONST_MSS_V6 + 1, -diff --git a/tools/tracing/rtla/src/osnoise.c b/tools/tracing/rtla/src/osnoise.c -index 245e9344932bc4..699a83f538a8e8 100644 ---- a/tools/tracing/rtla/src/osnoise.c -+++ b/tools/tracing/rtla/src/osnoise.c -@@ -867,7 +867,7 @@ int osnoise_set_workload(struct osnoise_context *context, bool onoff) - - retval = osnoise_options_set_option("OSNOISE_WORKLOAD", onoff); - if (retval < 0) -- return -1; -+ return -2; - - context->opt_workload = onoff; - -diff --git a/tools/tracing/rtla/src/timerlat_hist.c b/tools/tracing/rtla/src/timerlat_hist.c -index 667f12f2d67f69..1525e88c6cf968 100644 ---- a/tools/tracing/rtla/src/timerlat_hist.c -+++ b/tools/tracing/rtla/src/timerlat_hist.c -@@ -900,12 +900,15 @@ timerlat_hist_apply_config(struct osnoise_tool *tool, struct timerlat_hist_param - auto_house_keeping(¶ms->monitored_cpus); - } - -- if (params->user_hist) { -- retval = osnoise_set_workload(tool->context, 0); -- if (retval) { -- err_msg("Failed to set OSNOISE_WORKLOAD option\n"); -- goto out_err; -- } -+ /* -+ * Set workload according to type of thread if the kernel supports it. -+ * On kernels without support, user threads will have already failed -+ * on missing timerlat_fd, and kernel threads do not need it. -+ */ -+ retval = osnoise_set_workload(tool->context, params->kernel_workload); -+ if (retval < -1) { -+ err_msg("Failed to set OSNOISE_WORKLOAD option\n"); -+ goto out_err; - } - - return 0; -@@ -946,9 +949,12 @@ static struct osnoise_tool - } - - static int stop_tracing; -+static struct trace_instance *hist_inst = NULL; - static void stop_hist(int sig) - { - stop_tracing = 1; -+ if (hist_inst) -+ trace_instance_stop(hist_inst); - } - - /* -@@ -994,6 +1000,12 @@ int timerlat_hist_main(int argc, char *argv[]) - } - - trace = &tool->trace; -+ /* -+ * Save trace instance into global variable so that SIGINT can stop -+ * the timerlat tracer. -+ * Otherwise, rtla could loop indefinitely when overloaded. -+ */ -+ hist_inst = trace; - - retval = enable_timerlat(trace); - if (retval) { -@@ -1126,7 +1138,7 @@ int timerlat_hist_main(int argc, char *argv[]) - - return_value = 0; - -- if (trace_is_off(&tool->trace, &record->trace)) { -+ if (trace_is_off(&tool->trace, &record->trace) && !stop_tracing) { - printf("rtla timerlat hit stop tracing\n"); - - if (!params->no_aa) -diff --git a/tools/tracing/rtla/src/timerlat_top.c b/tools/tracing/rtla/src/timerlat_top.c -index 0915092057f853..5a33789a375e3c 100644 ---- a/tools/tracing/rtla/src/timerlat_top.c -+++ b/tools/tracing/rtla/src/timerlat_top.c -@@ -679,12 +679,15 @@ timerlat_top_apply_config(struct osnoise_tool *top, struct timerlat_top_params * - auto_house_keeping(¶ms->monitored_cpus); - } - -- if (params->user_top) { -- retval = osnoise_set_workload(top->context, 0); -- if (retval) { -- err_msg("Failed to set OSNOISE_WORKLOAD option\n"); -- goto out_err; -- } -+ /* -+ * Set workload according to type of thread if the kernel supports it. -+ * On kernels without support, user threads will have already failed -+ * on missing timerlat_fd, and kernel threads do not need it. -+ */ -+ retval = osnoise_set_workload(top->context, params->kernel_workload); -+ if (retval < -1) { -+ err_msg("Failed to set OSNOISE_WORKLOAD option\n"); -+ goto out_err; - } - - return 0; -@@ -725,9 +728,12 @@ static struct osnoise_tool - } - - static int stop_tracing; -+static struct trace_instance *top_inst = NULL; - static void stop_top(int sig) - { - stop_tracing = 1; -+ if (top_inst) -+ trace_instance_stop(top_inst); - } - - /* -@@ -774,6 +780,13 @@ int timerlat_top_main(int argc, char *argv[]) - } - - trace = &top->trace; -+ /* -+ * Save trace instance into global variable so that SIGINT can stop -+ * the timerlat tracer. -+ * Otherwise, rtla could loop indefinitely when overloaded. -+ */ -+ top_inst = trace; -+ - - retval = enable_timerlat(trace); - if (retval) { -@@ -922,7 +935,7 @@ int timerlat_top_main(int argc, char *argv[]) - - return_value = 0; - -- if (trace_is_off(&top->trace, &record->trace)) { -+ if (trace_is_off(&top->trace, &record->trace) && !stop_tracing) { - printf("rtla timerlat hit stop tracing\n"); - - if (!params->no_aa) -diff --git a/tools/tracing/rtla/src/trace.c b/tools/tracing/rtla/src/trace.c -index e1ba6d9f426580..93e4032b2397af 100644 ---- a/tools/tracing/rtla/src/trace.c -+++ b/tools/tracing/rtla/src/trace.c -@@ -196,6 +196,14 @@ int trace_instance_start(struct trace_instance *trace) - return tracefs_trace_on(trace->inst); - } - -+/* -+ * trace_instance_stop - stop tracing a given rtla instance -+ */ -+int trace_instance_stop(struct trace_instance *trace) -+{ -+ return tracefs_trace_off(trace->inst); -+} -+ - /* - * trace_events_free - free a list of trace events - */ -diff --git a/tools/tracing/rtla/src/trace.h b/tools/tracing/rtla/src/trace.h -index 2e9a89a256150b..551a7cb81f6361 100644 ---- a/tools/tracing/rtla/src/trace.h -+++ b/tools/tracing/rtla/src/trace.h -@@ -21,6 +21,7 @@ struct trace_instance { - - int trace_instance_init(struct trace_instance *trace, char *tool_name); - int trace_instance_start(struct trace_instance *trace); -+int trace_instance_stop(struct trace_instance *trace); - void trace_instance_destroy(struct trace_instance *trace); - - struct trace_seq *get_trace_seq(void); diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.078-079.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.078-079.patch deleted file mode 100644 index a913f5bd71..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.078-079.patch +++ /dev/null @@ -1,6874 +0,0 @@ -diff --git a/Documentation/arch/arm64/elf_hwcaps.rst b/Documentation/arch/arm64/elf_hwcaps.rst -index 76ff9d7398fda7..f88a24d621dd43 100644 ---- a/Documentation/arch/arm64/elf_hwcaps.rst -+++ b/Documentation/arch/arm64/elf_hwcaps.rst -@@ -174,22 +174,28 @@ HWCAP2_DCPODP - Functionality implied by ID_AA64ISAR1_EL1.DPB == 0b0010. - - HWCAP2_SVE2 -- Functionality implied by ID_AA64ZFR0_EL1.SVEVer == 0b0001. -+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and -+ ID_AA64ZFR0_EL1.SVEver == 0b0001. - - HWCAP2_SVEAES -- Functionality implied by ID_AA64ZFR0_EL1.AES == 0b0001. -+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and -+ ID_AA64ZFR0_EL1.AES == 0b0001. - - HWCAP2_SVEPMULL -- Functionality implied by ID_AA64ZFR0_EL1.AES == 0b0010. -+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and -+ ID_AA64ZFR0_EL1.AES == 0b0010. - - HWCAP2_SVEBITPERM -- Functionality implied by ID_AA64ZFR0_EL1.BitPerm == 0b0001. -+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and -+ ID_AA64ZFR0_EL1.BitPerm == 0b0001. - - HWCAP2_SVESHA3 -- Functionality implied by ID_AA64ZFR0_EL1.SHA3 == 0b0001. -+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and -+ ID_AA64ZFR0_EL1.SHA3 == 0b0001. - - HWCAP2_SVESM4 -- Functionality implied by ID_AA64ZFR0_EL1.SM4 == 0b0001. -+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and -+ ID_AA64ZFR0_EL1.SM4 == 0b0001. - - HWCAP2_FLAGM2 - Functionality implied by ID_AA64ISAR0_EL1.TS == 0b0010. -@@ -198,16 +204,20 @@ HWCAP2_FRINT - Functionality implied by ID_AA64ISAR1_EL1.FRINTTS == 0b0001. - - HWCAP2_SVEI8MM -- Functionality implied by ID_AA64ZFR0_EL1.I8MM == 0b0001. -+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and -+ ID_AA64ZFR0_EL1.I8MM == 0b0001. - - HWCAP2_SVEF32MM -- Functionality implied by ID_AA64ZFR0_EL1.F32MM == 0b0001. -+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and -+ ID_AA64ZFR0_EL1.F32MM == 0b0001. - - HWCAP2_SVEF64MM -- Functionality implied by ID_AA64ZFR0_EL1.F64MM == 0b0001. -+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and -+ ID_AA64ZFR0_EL1.F64MM == 0b0001. - - HWCAP2_SVEBF16 -- Functionality implied by ID_AA64ZFR0_EL1.BF16 == 0b0001. -+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and -+ ID_AA64ZFR0_EL1.BF16 == 0b0001. - - HWCAP2_I8MM - Functionality implied by ID_AA64ISAR1_EL1.I8MM == 0b0001. -@@ -273,7 +283,8 @@ HWCAP2_EBF16 - Functionality implied by ID_AA64ISAR1_EL1.BF16 == 0b0010. - - HWCAP2_SVE_EBF16 -- Functionality implied by ID_AA64ZFR0_EL1.BF16 == 0b0010. -+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and -+ ID_AA64ZFR0_EL1.BF16 == 0b0010. - - HWCAP2_CSSC - Functionality implied by ID_AA64ISAR2_EL1.CSSC == 0b0001. -@@ -282,7 +293,8 @@ HWCAP2_RPRFM - Functionality implied by ID_AA64ISAR2_EL1.RPRFM == 0b0001. - - HWCAP2_SVE2P1 -- Functionality implied by ID_AA64ZFR0_EL1.SVEver == 0b0010. -+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and -+ ID_AA64ZFR0_EL1.SVEver == 0b0010. - - HWCAP2_SME2 - Functionality implied by ID_AA64SMFR0_EL1.SMEver == 0b0001. -diff --git a/Documentation/devicetree/bindings/regulator/qcom,smd-rpm-regulator.yaml b/Documentation/devicetree/bindings/regulator/qcom,smd-rpm-regulator.yaml -index 9ea8ac0786acce..a72175a0910ba5 100644 ---- a/Documentation/devicetree/bindings/regulator/qcom,smd-rpm-regulator.yaml -+++ b/Documentation/devicetree/bindings/regulator/qcom,smd-rpm-regulator.yaml -@@ -22,7 +22,7 @@ description: - Each sub-node is identified using the node's name, with valid values listed - for each of the pmics below. - -- For mp5496, s1, s2 -+ For mp5496, s1, s2, l2, l5 - - For pm2250, s1, s2, s3, s4, l1, l2, l3, l4, l5, l6, l7, l8, l9, l10, l11, - l12, l13, l14, l15, l16, l17, l18, l19, l20, l21, l22 -diff --git a/Makefile b/Makefile -index 1d777c3eb7fb97..de16ab06861410 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 78 -+SUBLEVEL = 79 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -@@ -1054,8 +1054,8 @@ LDFLAGS_vmlinux += --orphan-handling=$(CONFIG_LD_ORPHAN_WARN_LEVEL) - endif - - # Align the bit size of userspace programs with the kernel --KBUILD_USERCFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CFLAGS)) --KBUILD_USERLDFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CFLAGS)) -+KBUILD_USERCFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS)) -+KBUILD_USERLDFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS)) - - # make the checker run with the right architecture - CHECKFLAGS += --arch=$(ARCH) -@@ -1348,18 +1348,13 @@ ifneq ($(wildcard $(resolve_btfids_O)),) - $(Q)$(MAKE) -sC $(srctree)/tools/bpf/resolve_btfids O=$(resolve_btfids_O) clean - endif - --# Clear a bunch of variables before executing the submake --ifeq ($(quiet),silent_) --tools_silent=s --endif -- - tools/: FORCE - $(Q)mkdir -p $(objtree)/tools -- $(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(tools_silent) $(filter --j% -j,$(MAKEFLAGS))" O=$(abspath $(objtree)) subdir=tools -C $(srctree)/tools/ -+ $(Q)$(MAKE) LDFLAGS= O=$(abspath $(objtree)) subdir=tools -C $(srctree)/tools/ - - tools/%: FORCE - $(Q)mkdir -p $(objtree)/tools -- $(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(tools_silent) $(filter --j% -j,$(MAKEFLAGS))" O=$(abspath $(objtree)) subdir=tools -C $(srctree)/tools/ $* -+ $(Q)$(MAKE) LDFLAGS= O=$(abspath $(objtree)) subdir=tools -C $(srctree)/tools/ $* - - # --------------------------------------------------------------------------- - # Kernel selftest -diff --git a/arch/alpha/include/uapi/asm/ptrace.h b/arch/alpha/include/uapi/asm/ptrace.h -index 5ca45934fcbb82..72ed913a910f25 100644 ---- a/arch/alpha/include/uapi/asm/ptrace.h -+++ b/arch/alpha/include/uapi/asm/ptrace.h -@@ -42,6 +42,8 @@ struct pt_regs { - unsigned long trap_a0; - unsigned long trap_a1; - unsigned long trap_a2; -+/* This makes the stack 16-byte aligned as GCC expects */ -+ unsigned long __pad0; - /* These are saved by PAL-code: */ - unsigned long ps; - unsigned long pc; -diff --git a/arch/alpha/kernel/asm-offsets.c b/arch/alpha/kernel/asm-offsets.c -index b121294bee2663..11c35cf45b4610 100644 ---- a/arch/alpha/kernel/asm-offsets.c -+++ b/arch/alpha/kernel/asm-offsets.c -@@ -34,7 +34,9 @@ void foo(void) - DEFINE(CRED_EGID, offsetof(struct cred, egid)); - BLANK(); - -+ DEFINE(SP_OFF, offsetof(struct pt_regs, ps)); - DEFINE(SIZEOF_PT_REGS, sizeof(struct pt_regs)); -+ DEFINE(SWITCH_STACK_SIZE, sizeof(struct switch_stack)); - DEFINE(PT_PTRACED, PT_PTRACED); - DEFINE(CLONE_VM, CLONE_VM); - DEFINE(CLONE_UNTRACED, CLONE_UNTRACED); -diff --git a/arch/alpha/kernel/entry.S b/arch/alpha/kernel/entry.S -index eb51f93a70c8f1..602f701a1c3963 100644 ---- a/arch/alpha/kernel/entry.S -+++ b/arch/alpha/kernel/entry.S -@@ -15,10 +15,6 @@ - .set noat - .cfi_sections .debug_frame - --/* Stack offsets. */ --#define SP_OFF 184 --#define SWITCH_STACK_SIZE 64 -- - .macro CFI_START_OSF_FRAME func - .align 4 - .globl \func -@@ -198,8 +194,8 @@ CFI_END_OSF_FRAME entArith - CFI_START_OSF_FRAME entMM - SAVE_ALL - /* save $9 - $15 so the inline exception code can manipulate them. */ -- subq $sp, 56, $sp -- .cfi_adjust_cfa_offset 56 -+ subq $sp, 64, $sp -+ .cfi_adjust_cfa_offset 64 - stq $9, 0($sp) - stq $10, 8($sp) - stq $11, 16($sp) -@@ -214,7 +210,7 @@ CFI_START_OSF_FRAME entMM - .cfi_rel_offset $13, 32 - .cfi_rel_offset $14, 40 - .cfi_rel_offset $15, 48 -- addq $sp, 56, $19 -+ addq $sp, 64, $19 - /* handle the fault */ - lda $8, 0x3fff - bic $sp, $8, $8 -@@ -227,7 +223,7 @@ CFI_START_OSF_FRAME entMM - ldq $13, 32($sp) - ldq $14, 40($sp) - ldq $15, 48($sp) -- addq $sp, 56, $sp -+ addq $sp, 64, $sp - .cfi_restore $9 - .cfi_restore $10 - .cfi_restore $11 -@@ -235,7 +231,7 @@ CFI_START_OSF_FRAME entMM - .cfi_restore $13 - .cfi_restore $14 - .cfi_restore $15 -- .cfi_adjust_cfa_offset -56 -+ .cfi_adjust_cfa_offset -64 - /* finish up the syscall as normal. */ - br ret_from_sys_call - CFI_END_OSF_FRAME entMM -@@ -382,8 +378,8 @@ entUnaUser: - .cfi_restore $0 - .cfi_adjust_cfa_offset -256 - SAVE_ALL /* setup normal kernel stack */ -- lda $sp, -56($sp) -- .cfi_adjust_cfa_offset 56 -+ lda $sp, -64($sp) -+ .cfi_adjust_cfa_offset 64 - stq $9, 0($sp) - stq $10, 8($sp) - stq $11, 16($sp) -@@ -399,7 +395,7 @@ entUnaUser: - .cfi_rel_offset $14, 40 - .cfi_rel_offset $15, 48 - lda $8, 0x3fff -- addq $sp, 56, $19 -+ addq $sp, 64, $19 - bic $sp, $8, $8 - jsr $26, do_entUnaUser - ldq $9, 0($sp) -@@ -409,7 +405,7 @@ entUnaUser: - ldq $13, 32($sp) - ldq $14, 40($sp) - ldq $15, 48($sp) -- lda $sp, 56($sp) -+ lda $sp, 64($sp) - .cfi_restore $9 - .cfi_restore $10 - .cfi_restore $11 -@@ -417,7 +413,7 @@ entUnaUser: - .cfi_restore $13 - .cfi_restore $14 - .cfi_restore $15 -- .cfi_adjust_cfa_offset -56 -+ .cfi_adjust_cfa_offset -64 - br ret_from_sys_call - CFI_END_OSF_FRAME entUna - -diff --git a/arch/alpha/kernel/traps.c b/arch/alpha/kernel/traps.c -index d9a67b370e0476..de72bd837c5af7 100644 ---- a/arch/alpha/kernel/traps.c -+++ b/arch/alpha/kernel/traps.c -@@ -707,7 +707,7 @@ s_reg_to_mem (unsigned long s_reg) - static int unauser_reg_offsets[32] = { - R(r0), R(r1), R(r2), R(r3), R(r4), R(r5), R(r6), R(r7), R(r8), - /* r9 ... r15 are stored in front of regs. */ -- -56, -48, -40, -32, -24, -16, -8, -+ -64, -56, -48, -40, -32, -24, -16, /* padding at -8 */ - R(r16), R(r17), R(r18), - R(r19), R(r20), R(r21), R(r22), R(r23), R(r24), R(r25), R(r26), - R(r27), R(r28), R(gp), -diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c -index 8c9850437e6744..a9816bbc9f34d3 100644 ---- a/arch/alpha/mm/fault.c -+++ b/arch/alpha/mm/fault.c -@@ -78,8 +78,8 @@ __load_new_mm_context(struct mm_struct *next_mm) - - /* Macro for exception fixup code to access integer registers. */ - #define dpf_reg(r) \ -- (((unsigned long *)regs)[(r) <= 8 ? (r) : (r) <= 15 ? (r)-16 : \ -- (r) <= 18 ? (r)+10 : (r)-10]) -+ (((unsigned long *)regs)[(r) <= 8 ? (r) : (r) <= 15 ? (r)-17 : \ -+ (r) <= 18 ? (r)+11 : (r)-10]) - - asmlinkage void - do_page_fault(unsigned long address, unsigned long mmcsr, -diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c -index d9c9218fa1fddc..309942b06c5bc2 100644 ---- a/arch/arm64/kernel/cacheinfo.c -+++ b/arch/arm64/kernel/cacheinfo.c -@@ -101,16 +101,18 @@ int populate_cache_leaves(unsigned int cpu) - unsigned int level, idx; - enum cache_type type; - struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); -- struct cacheinfo *this_leaf = this_cpu_ci->info_list; -+ struct cacheinfo *infos = this_cpu_ci->info_list; - - for (idx = 0, level = 1; level <= this_cpu_ci->num_levels && -- idx < this_cpu_ci->num_leaves; idx++, level++) { -+ idx < this_cpu_ci->num_leaves; level++) { - type = get_cache_type(level); - if (type == CACHE_TYPE_SEPARATE) { -- ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level); -- ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level); -+ if (idx + 1 >= this_cpu_ci->num_leaves) -+ break; -+ ci_leaf_init(&infos[idx++], CACHE_TYPE_DATA, level); -+ ci_leaf_init(&infos[idx++], CACHE_TYPE_INST, level); - } else { -- ci_leaf_init(this_leaf++, type, level); -+ ci_leaf_init(&infos[idx++], type, level); - } - } - return 0; -diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c -index 7e96604559004b..82778258855d1a 100644 ---- a/arch/arm64/kernel/cpufeature.c -+++ b/arch/arm64/kernel/cpufeature.c -@@ -2762,6 +2762,13 @@ static const struct arm64_cpu_capabilities arm64_features[] = { - .matches = match, \ - } - -+#define HWCAP_CAP_MATCH_ID(match, reg, field, min_value, cap_type, cap) \ -+ { \ -+ __HWCAP_CAP(#cap, cap_type, cap) \ -+ HWCAP_CPUID_MATCH(reg, field, min_value) \ -+ .matches = match, \ -+ } -+ - #ifdef CONFIG_ARM64_PTR_AUTH - static const struct arm64_cpu_capabilities ptr_auth_hwcap_addr_matches[] = { - { -@@ -2790,6 +2797,13 @@ static const struct arm64_cpu_capabilities ptr_auth_hwcap_gen_matches[] = { - }; - #endif - -+#ifdef CONFIG_ARM64_SVE -+static bool has_sve_feature(const struct arm64_cpu_capabilities *cap, int scope) -+{ -+ return system_supports_sve() && has_user_cpuid_feature(cap, scope); -+} -+#endif -+ - static const struct arm64_cpu_capabilities arm64_elf_hwcaps[] = { - HWCAP_CAP(ID_AA64ISAR0_EL1, AES, PMULL, CAP_HWCAP, KERNEL_HWCAP_PMULL), - HWCAP_CAP(ID_AA64ISAR0_EL1, AES, AES, CAP_HWCAP, KERNEL_HWCAP_AES), -@@ -2827,18 +2841,18 @@ static const struct arm64_cpu_capabilities arm64_elf_hwcaps[] = { - HWCAP_CAP(ID_AA64MMFR2_EL1, AT, IMP, CAP_HWCAP, KERNEL_HWCAP_USCAT), - #ifdef CONFIG_ARM64_SVE - HWCAP_CAP(ID_AA64PFR0_EL1, SVE, IMP, CAP_HWCAP, KERNEL_HWCAP_SVE), -- HWCAP_CAP(ID_AA64ZFR0_EL1, SVEver, SVE2p1, CAP_HWCAP, KERNEL_HWCAP_SVE2P1), -- HWCAP_CAP(ID_AA64ZFR0_EL1, SVEver, SVE2, CAP_HWCAP, KERNEL_HWCAP_SVE2), -- HWCAP_CAP(ID_AA64ZFR0_EL1, AES, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEAES), -- HWCAP_CAP(ID_AA64ZFR0_EL1, AES, PMULL128, CAP_HWCAP, KERNEL_HWCAP_SVEPMULL), -- HWCAP_CAP(ID_AA64ZFR0_EL1, BitPerm, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEBITPERM), -- HWCAP_CAP(ID_AA64ZFR0_EL1, BF16, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEBF16), -- HWCAP_CAP(ID_AA64ZFR0_EL1, BF16, EBF16, CAP_HWCAP, KERNEL_HWCAP_SVE_EBF16), -- HWCAP_CAP(ID_AA64ZFR0_EL1, SHA3, IMP, CAP_HWCAP, KERNEL_HWCAP_SVESHA3), -- HWCAP_CAP(ID_AA64ZFR0_EL1, SM4, IMP, CAP_HWCAP, KERNEL_HWCAP_SVESM4), -- HWCAP_CAP(ID_AA64ZFR0_EL1, I8MM, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEI8MM), -- HWCAP_CAP(ID_AA64ZFR0_EL1, F32MM, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEF32MM), -- HWCAP_CAP(ID_AA64ZFR0_EL1, F64MM, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEF64MM), -+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, SVEver, SVE2p1, CAP_HWCAP, KERNEL_HWCAP_SVE2P1), -+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, SVEver, SVE2, CAP_HWCAP, KERNEL_HWCAP_SVE2), -+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, AES, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEAES), -+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, AES, PMULL128, CAP_HWCAP, KERNEL_HWCAP_SVEPMULL), -+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, BitPerm, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEBITPERM), -+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, BF16, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEBF16), -+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, BF16, EBF16, CAP_HWCAP, KERNEL_HWCAP_SVE_EBF16), -+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, SHA3, IMP, CAP_HWCAP, KERNEL_HWCAP_SVESHA3), -+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, SM4, IMP, CAP_HWCAP, KERNEL_HWCAP_SVESM4), -+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, I8MM, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEI8MM), -+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, F32MM, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEF32MM), -+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, F64MM, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEF64MM), - #endif - HWCAP_CAP(ID_AA64PFR1_EL1, SSBS, SSBS2, CAP_HWCAP, KERNEL_HWCAP_SSBS), - #ifdef CONFIG_ARM64_BTI -diff --git a/arch/arm64/kernel/vdso/vdso.lds.S b/arch/arm64/kernel/vdso/vdso.lds.S -index 45354f2ddf7069..2e126ab79ecd86 100644 ---- a/arch/arm64/kernel/vdso/vdso.lds.S -+++ b/arch/arm64/kernel/vdso/vdso.lds.S -@@ -38,6 +38,7 @@ SECTIONS - */ - /DISCARD/ : { - *(.note.GNU-stack .note.gnu.property) -+ *(.ARM.attributes) - } - .note : { *(.note.*) } :text :note - -diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S -index a553dae9a0d482..d4353741f331e3 100644 ---- a/arch/arm64/kernel/vmlinux.lds.S -+++ b/arch/arm64/kernel/vmlinux.lds.S -@@ -162,6 +162,7 @@ SECTIONS - /DISCARD/ : { - *(.interp .dynamic) - *(.dynsym .dynstr .hash .gnu.hash) -+ *(.ARM.attributes) - } - - . = KIMAGE_VADDR; -diff --git a/arch/loongarch/kernel/genex.S b/arch/loongarch/kernel/genex.S -index 2bb3aa2dcfcb2e..e75c2dbd5f2c52 100644 ---- a/arch/loongarch/kernel/genex.S -+++ b/arch/loongarch/kernel/genex.S -@@ -18,27 +18,29 @@ - - .align 5 - SYM_FUNC_START(__arch_cpu_idle) -- /* start of rollback region */ -- LONG_L t0, tp, TI_FLAGS -- nop -- andi t0, t0, _TIF_NEED_RESCHED -- bnez t0, 1f -- nop -- nop -- nop -+ /* start of idle interrupt region */ -+ ori t0, zero, CSR_CRMD_IE -+ /* idle instruction needs irq enabled */ -+ csrxchg t0, t0, LOONGARCH_CSR_CRMD -+ /* -+ * If an interrupt lands here; between enabling interrupts above and -+ * going idle on the next instruction, we must *NOT* go idle since the -+ * interrupt could have set TIF_NEED_RESCHED or caused an timer to need -+ * reprogramming. Fall through -- see handle_vint() below -- and have -+ * the idle loop take care of things. -+ */ - idle 0 -- /* end of rollback region */ -+ /* end of idle interrupt region */ - 1: jr ra - SYM_FUNC_END(__arch_cpu_idle) - - SYM_CODE_START(handle_vint) - BACKUP_T0T1 - SAVE_ALL -- la_abs t1, __arch_cpu_idle -+ la_abs t1, 1b - LONG_L t0, sp, PT_ERA -- /* 32 byte rollback region */ -- ori t0, t0, 0x1f -- xori t0, t0, 0x1f -+ /* 3 instructions idle interrupt region */ -+ ori t0, t0, 0b1100 - bne t0, t1, 1f - LONG_S t0, sp, PT_ERA - 1: move a0, sp -diff --git a/arch/loongarch/kernel/idle.c b/arch/loongarch/kernel/idle.c -index 0b5dd2faeb90b8..54b247d8cdb695 100644 ---- a/arch/loongarch/kernel/idle.c -+++ b/arch/loongarch/kernel/idle.c -@@ -11,7 +11,6 @@ - - void __cpuidle arch_cpu_idle(void) - { -- raw_local_irq_enable(); -- __arch_cpu_idle(); /* idle instruction needs irq enabled */ -+ __arch_cpu_idle(); - raw_local_irq_disable(); - } -diff --git a/arch/loongarch/kernel/reset.c b/arch/loongarch/kernel/reset.c -index 1ef8c63835351b..de8fa5a8a825cd 100644 ---- a/arch/loongarch/kernel/reset.c -+++ b/arch/loongarch/kernel/reset.c -@@ -33,7 +33,7 @@ void machine_halt(void) - console_flush_on_panic(CONSOLE_FLUSH_PENDING); - - while (true) { -- __arch_cpu_idle(); -+ __asm__ __volatile__("idle 0" : : : "memory"); - } - } - -@@ -53,7 +53,7 @@ void machine_power_off(void) - #endif - - while (true) { -- __arch_cpu_idle(); -+ __asm__ __volatile__("idle 0" : : : "memory"); - } - } - -@@ -74,6 +74,6 @@ void machine_restart(char *command) - acpi_reboot(); - - while (true) { -- __arch_cpu_idle(); -+ __asm__ __volatile__("idle 0" : : : "memory"); - } - } -diff --git a/arch/loongarch/lib/csum.c b/arch/loongarch/lib/csum.c -index a5e84b403c3b34..df309ae4045dee 100644 ---- a/arch/loongarch/lib/csum.c -+++ b/arch/loongarch/lib/csum.c -@@ -25,7 +25,7 @@ unsigned int __no_sanitize_address do_csum(const unsigned char *buff, int len) - const u64 *ptr; - u64 data, sum64 = 0; - -- if (unlikely(len == 0)) -+ if (unlikely(len <= 0)) - return 0; - - offset = (unsigned long)buff & 7; -diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c -index 37c8badd270155..df286789c94f18 100644 ---- a/arch/x86/events/intel/core.c -+++ b/arch/x86/events/intel/core.c -@@ -4715,8 +4715,11 @@ static void intel_pmu_cpu_starting(int cpu) - - init_debug_store_on_cpu(cpu); - /* -- * Deal with CPUs that don't clear their LBRs on power-up. -+ * Deal with CPUs that don't clear their LBRs on power-up, and that may -+ * even boot with LBRs enabled. - */ -+ if (!static_cpu_has(X86_FEATURE_ARCH_LBR) && x86_pmu.lbr_nr) -+ msr_clear_bit(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR_BIT); - intel_pmu_lbr_reset(); - - cpuc->lbr_sel = NULL; -diff --git a/arch/x86/include/asm/mmu.h b/arch/x86/include/asm/mmu.h -index 0da5c227f490c0..53763cf1927775 100644 ---- a/arch/x86/include/asm/mmu.h -+++ b/arch/x86/include/asm/mmu.h -@@ -37,6 +37,8 @@ typedef struct { - */ - atomic64_t tlb_gen; - -+ unsigned long next_trim_cpumask; -+ - #ifdef CONFIG_MODIFY_LDT_SYSCALL - struct rw_semaphore ldt_usr_sem; - struct ldt_struct *ldt; -diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h -index 8dac45a2c7fcf2..f5afd956d5e50a 100644 ---- a/arch/x86/include/asm/mmu_context.h -+++ b/arch/x86/include/asm/mmu_context.h -@@ -145,6 +145,7 @@ static inline int init_new_context(struct task_struct *tsk, - - mm->context.ctx_id = atomic64_inc_return(&last_mm_ctx_id); - atomic64_set(&mm->context.tlb_gen, 0); -+ mm->context.next_trim_cpumask = jiffies + HZ; - - #ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS - if (cpu_feature_enabled(X86_FEATURE_OSPKE)) { -diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h -index 24b7bd255e9830..623bb48774d44c 100644 ---- a/arch/x86/include/asm/msr-index.h -+++ b/arch/x86/include/asm/msr-index.h -@@ -358,7 +358,8 @@ - #define MSR_IA32_PASID_VALID BIT_ULL(31) - - /* DEBUGCTLMSR bits (others vary by model): */ --#define DEBUGCTLMSR_LBR (1UL << 0) /* last branch recording */ -+#define DEBUGCTLMSR_LBR_BIT 0 /* last branch recording */ -+#define DEBUGCTLMSR_LBR (1UL << DEBUGCTLMSR_LBR_BIT) - #define DEBUGCTLMSR_BTF_SHIFT 1 - #define DEBUGCTLMSR_BTF (1UL << 1) /* single-step on branches */ - #define DEBUGCTLMSR_BUS_LOCK_DETECT (1UL << 2) -diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h -index 25726893c6f4dd..5d61adc6e892ea 100644 ---- a/arch/x86/include/asm/tlbflush.h -+++ b/arch/x86/include/asm/tlbflush.h -@@ -222,6 +222,7 @@ struct flush_tlb_info { - unsigned int initiating_cpu; - u8 stride_shift; - u8 freed_tables; -+ u8 trim_cpumask; - }; - - void flush_tlb_local(void); -diff --git a/arch/x86/kernel/i8253.c b/arch/x86/kernel/i8253.c -index 2b7999a1a50a83..80e262bb627fe1 100644 ---- a/arch/x86/kernel/i8253.c -+++ b/arch/x86/kernel/i8253.c -@@ -8,6 +8,7 @@ - #include - #include - -+#include - #include - #include - #include -@@ -39,9 +40,15 @@ static bool __init use_pit(void) - - bool __init pit_timer_init(void) - { -- if (!use_pit()) -+ if (!use_pit()) { -+ /* -+ * Don't just ignore the PIT. Ensure it's stopped, because -+ * VMMs otherwise steal CPU time just to pointlessly waggle -+ * the (masked) IRQ. -+ */ -+ clockevent_i8253_disable(); - return false; -- -+ } - clockevent_i8253_init(true); - global_clock_event = &i8253_clockevent; - return true; -diff --git a/arch/x86/kernel/static_call.c b/arch/x86/kernel/static_call.c -index e332d835d6583f..07961b362e2a0c 100644 ---- a/arch/x86/kernel/static_call.c -+++ b/arch/x86/kernel/static_call.c -@@ -175,7 +175,6 @@ EXPORT_SYMBOL_GPL(arch_static_call_transform); - noinstr void __static_call_update_early(void *tramp, void *func) - { - BUG_ON(system_state != SYSTEM_BOOTING); -- BUG_ON(!early_boot_irqs_disabled); - BUG_ON(static_call_initialized); - __text_gen_insn(tramp, JMP32_INSN_OPCODE, tramp, func, JMP32_INSN_SIZE); - sync_core(); -diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c -index 238afd7335e46d..bd3fbd5be5da6e 100644 ---- a/arch/x86/kvm/hyperv.c -+++ b/arch/x86/kvm/hyperv.c -@@ -2175,6 +2175,9 @@ static u64 kvm_hv_send_ipi(struct kvm_vcpu *vcpu, struct kvm_hv_hcall *hc) - u32 vector; - bool all_cpus; - -+ if (!lapic_in_kernel(vcpu)) -+ return HV_STATUS_INVALID_HYPERCALL_INPUT; -+ - if (hc->code == HVCALL_SEND_IPI) { - if (!hc->fast) { - if (unlikely(kvm_read_guest(kvm, hc->ingpa, &send_ipi, -@@ -2801,7 +2804,8 @@ int kvm_get_hv_cpuid(struct kvm_vcpu *vcpu, struct kvm_cpuid2 *cpuid, - ent->eax |= HV_X64_REMOTE_TLB_FLUSH_RECOMMENDED; - ent->eax |= HV_X64_APIC_ACCESS_RECOMMENDED; - ent->eax |= HV_X64_RELAXED_TIMING_RECOMMENDED; -- ent->eax |= HV_X64_CLUSTER_IPI_RECOMMENDED; -+ if (!vcpu || lapic_in_kernel(vcpu)) -+ ent->eax |= HV_X64_CLUSTER_IPI_RECOMMENDED; - ent->eax |= HV_X64_EX_PROCESSOR_MASKS_RECOMMENDED; - if (evmcs_ver) - ent->eax |= HV_X64_ENLIGHTENED_VMCS_RECOMMENDED; -diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c -index ff85526a9d4819..04b9b919235ecf 100644 ---- a/arch/x86/kvm/mmu/mmu.c -+++ b/arch/x86/kvm/mmu/mmu.c -@@ -5289,7 +5289,7 @@ void kvm_init_shadow_npt_mmu(struct kvm_vcpu *vcpu, unsigned long cr0, - union kvm_mmu_page_role root_role; - - /* NPT requires CR0.PG=1. */ -- WARN_ON_ONCE(cpu_role.base.direct); -+ WARN_ON_ONCE(cpu_role.base.direct || !cpu_role.base.guest_mode); - - root_role = cpu_role.base; - root_role.level = kvm_mmu_get_tdp_level(vcpu); -diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c -index acf22bd99efcd8..e3f3e30fc89cac 100644 ---- a/arch/x86/kvm/svm/nested.c -+++ b/arch/x86/kvm/svm/nested.c -@@ -644,6 +644,11 @@ static void nested_vmcb02_prepare_control(struct vcpu_svm *svm, - u32 pause_count12; - u32 pause_thresh12; - -+ nested_svm_transition_tlb_flush(vcpu); -+ -+ /* Enter Guest-Mode */ -+ enter_guest_mode(vcpu); -+ - /* - * Filled at exit: exit_code, exit_code_hi, exit_info_1, exit_info_2, - * exit_int_info, exit_int_info_err, next_rip, insn_len, insn_bytes. -@@ -760,11 +765,6 @@ static void nested_vmcb02_prepare_control(struct vcpu_svm *svm, - } - } - -- nested_svm_transition_tlb_flush(vcpu); -- -- /* Enter Guest-Mode */ -- enter_guest_mode(vcpu); -- - /* - * Merge guest and host intercepts - must be called with vcpu in - * guest-mode to take effect. -diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c -index 64f594826a2822..df1794a5e38a57 100644 ---- a/arch/x86/mm/tlb.c -+++ b/arch/x86/mm/tlb.c -@@ -898,9 +898,36 @@ static void flush_tlb_func(void *info) - nr_invalidate); - } - --static bool tlb_is_not_lazy(int cpu, void *data) -+static bool should_flush_tlb(int cpu, void *data) - { -- return !per_cpu(cpu_tlbstate_shared.is_lazy, cpu); -+ struct flush_tlb_info *info = data; -+ -+ /* Lazy TLB will get flushed at the next context switch. */ -+ if (per_cpu(cpu_tlbstate_shared.is_lazy, cpu)) -+ return false; -+ -+ /* No mm means kernel memory flush. */ -+ if (!info->mm) -+ return true; -+ -+ /* The target mm is loaded, and the CPU is not lazy. */ -+ if (per_cpu(cpu_tlbstate.loaded_mm, cpu) == info->mm) -+ return true; -+ -+ /* In cpumask, but not the loaded mm? Periodically remove by flushing. */ -+ if (info->trim_cpumask) -+ return true; -+ -+ return false; -+} -+ -+static bool should_trim_cpumask(struct mm_struct *mm) -+{ -+ if (time_after(jiffies, READ_ONCE(mm->context.next_trim_cpumask))) { -+ WRITE_ONCE(mm->context.next_trim_cpumask, jiffies + HZ); -+ return true; -+ } -+ return false; - } - - DEFINE_PER_CPU_SHARED_ALIGNED(struct tlb_state_shared, cpu_tlbstate_shared); -@@ -934,7 +961,7 @@ STATIC_NOPV void native_flush_tlb_multi(const struct cpumask *cpumask, - if (info->freed_tables) - on_each_cpu_mask(cpumask, flush_tlb_func, (void *)info, true); - else -- on_each_cpu_cond_mask(tlb_is_not_lazy, flush_tlb_func, -+ on_each_cpu_cond_mask(should_flush_tlb, flush_tlb_func, - (void *)info, 1, cpumask); - } - -@@ -985,6 +1012,7 @@ static struct flush_tlb_info *get_flush_tlb_info(struct mm_struct *mm, - info->freed_tables = freed_tables; - info->new_tlb_gen = new_tlb_gen; - info->initiating_cpu = smp_processor_id(); -+ info->trim_cpumask = 0; - - return info; - } -@@ -1027,6 +1055,7 @@ void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start, - * flush_tlb_func_local() directly in this case. - */ - if (cpumask_any_but(mm_cpumask(mm), cpu) < nr_cpu_ids) { -+ info->trim_cpumask = should_trim_cpumask(mm); - flush_tlb_multi(mm_cpumask(mm), info); - } else if (mm == this_cpu_read(cpu_tlbstate.loaded_mm)) { - lockdep_assert_irqs_enabled(); -diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c -index 6b201e64d8abc8..88a722954f3f78 100644 ---- a/arch/x86/xen/mmu_pv.c -+++ b/arch/x86/xen/mmu_pv.c -@@ -113,6 +113,51 @@ static pud_t level3_user_vsyscall[PTRS_PER_PUD] __page_aligned_bss; - */ - static DEFINE_SPINLOCK(xen_reservation_lock); - -+/* Protected by xen_reservation_lock. */ -+#define MIN_CONTIG_ORDER 9 /* 2MB */ -+static unsigned int discontig_frames_order = MIN_CONTIG_ORDER; -+static unsigned long discontig_frames_early[1UL << MIN_CONTIG_ORDER] __initdata; -+static unsigned long *discontig_frames __refdata = discontig_frames_early; -+static bool discontig_frames_dyn; -+ -+static int alloc_discontig_frames(unsigned int order) -+{ -+ unsigned long *new_array, *old_array; -+ unsigned int old_order; -+ unsigned long flags; -+ -+ BUG_ON(order < MIN_CONTIG_ORDER); -+ BUILD_BUG_ON(sizeof(discontig_frames_early) != PAGE_SIZE); -+ -+ new_array = (unsigned long *)__get_free_pages(GFP_KERNEL, -+ order - MIN_CONTIG_ORDER); -+ if (!new_array) -+ return -ENOMEM; -+ -+ spin_lock_irqsave(&xen_reservation_lock, flags); -+ -+ old_order = discontig_frames_order; -+ -+ if (order > discontig_frames_order || !discontig_frames_dyn) { -+ if (!discontig_frames_dyn) -+ old_array = NULL; -+ else -+ old_array = discontig_frames; -+ -+ discontig_frames = new_array; -+ discontig_frames_order = order; -+ discontig_frames_dyn = true; -+ } else { -+ old_array = new_array; -+ } -+ -+ spin_unlock_irqrestore(&xen_reservation_lock, flags); -+ -+ free_pages((unsigned long)old_array, old_order - MIN_CONTIG_ORDER); -+ -+ return 0; -+} -+ - /* - * Note about cr3 (pagetable base) values: - * -@@ -782,6 +827,7 @@ void xen_mm_pin_all(void) - { - struct page *page; - -+ spin_lock(&init_mm.page_table_lock); - spin_lock(&pgd_lock); - - list_for_each_entry(page, &pgd_list, lru) { -@@ -792,6 +838,7 @@ void xen_mm_pin_all(void) - } - - spin_unlock(&pgd_lock); -+ spin_unlock(&init_mm.page_table_lock); - } - - static void __init xen_mark_pinned(struct mm_struct *mm, struct page *page, -@@ -813,6 +860,9 @@ static void __init xen_after_bootmem(void) - SetPagePinned(virt_to_page(level3_user_vsyscall)); - #endif - xen_pgd_walk(&init_mm, xen_mark_pinned, FIXADDR_TOP); -+ -+ if (alloc_discontig_frames(MIN_CONTIG_ORDER)) -+ BUG(); - } - - static void xen_unpin_page(struct mm_struct *mm, struct page *page, -@@ -888,6 +938,7 @@ void xen_mm_unpin_all(void) - { - struct page *page; - -+ spin_lock(&init_mm.page_table_lock); - spin_lock(&pgd_lock); - - list_for_each_entry(page, &pgd_list, lru) { -@@ -899,6 +950,7 @@ void xen_mm_unpin_all(void) - } - - spin_unlock(&pgd_lock); -+ spin_unlock(&init_mm.page_table_lock); - } - - static void xen_enter_mmap(struct mm_struct *mm) -@@ -2199,10 +2251,6 @@ void __init xen_init_mmu_ops(void) - memset(dummy_mapping, 0xff, PAGE_SIZE); - } - --/* Protected by xen_reservation_lock. */ --#define MAX_CONTIG_ORDER 9 /* 2MB */ --static unsigned long discontig_frames[1< MAX_CONTIG_ORDER)) -- return -ENOMEM; -+ if (unlikely(order > discontig_frames_order)) { -+ if (!discontig_frames_dyn) -+ return -ENOMEM; -+ -+ if (alloc_discontig_frames(order)) -+ return -ENOMEM; -+ } - - memset((void *) vstart, 0, PAGE_SIZE << order); - - spin_lock_irqsave(&xen_reservation_lock, flags); - -+ in_frames = discontig_frames; -+ - /* 1. Zap current PTEs, remembering MFNs. */ - xen_zap_pfn_range(vstart, order, in_frames, NULL); - -@@ -2354,12 +2409,12 @@ int xen_create_contiguous_region(phys_addr_t pstart, unsigned int order, - - void xen_destroy_contiguous_region(phys_addr_t pstart, unsigned int order) - { -- unsigned long *out_frames = discontig_frames, in_frame; -+ unsigned long *out_frames, in_frame; - unsigned long flags; - int success; - unsigned long vstart; - -- if (unlikely(order > MAX_CONTIG_ORDER)) -+ if (unlikely(order > discontig_frames_order)) - return; - - vstart = (unsigned long)phys_to_virt(pstart); -@@ -2367,6 +2422,8 @@ void xen_destroy_contiguous_region(phys_addr_t pstart, unsigned int order) - - spin_lock_irqsave(&xen_reservation_lock, flags); - -+ out_frames = discontig_frames; -+ - /* 1. Find start MFN of contiguous extent. */ - in_frame = virt_to_mfn((void *)vstart); - -diff --git a/block/partitions/mac.c b/block/partitions/mac.c -index 7b521df00a39f4..6415213cd184e7 100644 ---- a/block/partitions/mac.c -+++ b/block/partitions/mac.c -@@ -51,13 +51,25 @@ int mac_partition(struct parsed_partitions *state) - } - secsize = be16_to_cpu(md->block_size); - put_dev_sector(sect); -+ -+ /* -+ * If the "block size" is not a power of 2, things get weird - we might -+ * end up with a partition straddling a sector boundary, so we wouldn't -+ * be able to read a partition entry with read_part_sector(). -+ * Real block sizes are probably (?) powers of two, so just require -+ * that. -+ */ -+ if (!is_power_of_2(secsize)) -+ return -1; - datasize = round_down(secsize, 512); - data = read_part_sector(state, datasize / 512, §); - if (!data) - return -1; - partoffset = secsize % 512; -- if (partoffset + sizeof(*part) > datasize) -+ if (partoffset + sizeof(*part) > datasize) { -+ put_dev_sector(sect); - return -1; -+ } - part = (struct mac_partition *) (data + partoffset); - if (be16_to_cpu(part->signature) != MAC_PARTITION_MAGIC) { - put_dev_sector(sect); -@@ -110,8 +122,8 @@ int mac_partition(struct parsed_partitions *state) - int i, l; - - goodness++; -- l = strlen(part->name); -- if (strcmp(part->name, "/") == 0) -+ l = strnlen(part->name, sizeof(part->name)); -+ if (strncmp(part->name, "/", sizeof(part->name)) == 0) - goodness++; - for (i = 0; i <= l - 4; ++i) { - if (strncasecmp(part->name + i, "root", -diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c -index fdfc88e09986ec..e894fdf6d5531d 100644 ---- a/drivers/acpi/x86/utils.c -+++ b/drivers/acpi/x86/utils.c -@@ -400,6 +400,19 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = { - .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | - ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY), - }, -+ { -+ /* Vexia Edu Atla 10 tablet 5V version */ -+ .matches = { -+ /* Having all 3 of these not set is somewhat unique */ -+ DMI_MATCH(DMI_SYS_VENDOR, "To be filled by O.E.M."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "To be filled by O.E.M."), -+ DMI_MATCH(DMI_BOARD_NAME, "To be filled by O.E.M."), -+ /* Above strings are too generic, also match on BIOS date */ -+ DMI_MATCH(DMI_BIOS_DATE, "05/14/2015"), -+ }, -+ .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | -+ ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY), -+ }, - { - /* Vexia Edu Atla 10 tablet 9V version */ - .matches = { -diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c -index dceab5d013dec9..d99c9fb666c2d3 100644 ---- a/drivers/base/regmap/regmap-irq.c -+++ b/drivers/base/regmap/regmap-irq.c -@@ -894,6 +894,7 @@ int regmap_add_irq_chip_fwnode(struct fwnode_handle *fwnode, - kfree(d->wake_buf); - kfree(d->mask_buf_def); - kfree(d->mask_buf); -+ kfree(d->main_status_buf); - kfree(d->status_buf); - kfree(d->status_reg_buf); - if (d->config_buf) { -@@ -969,6 +970,7 @@ void regmap_del_irq_chip(int irq, struct regmap_irq_chip_data *d) - kfree(d->wake_buf); - kfree(d->mask_buf_def); - kfree(d->mask_buf); -+ kfree(d->main_status_buf); - kfree(d->status_reg_buf); - kfree(d->status_buf); - if (d->config_buf) { -diff --git a/drivers/clocksource/i8253.c b/drivers/clocksource/i8253.c -index d4350bb10b83a2..cb215e6f2e8344 100644 ---- a/drivers/clocksource/i8253.c -+++ b/drivers/clocksource/i8253.c -@@ -108,11 +108,8 @@ int __init clocksource_i8253_init(void) - #endif - - #ifdef CONFIG_CLKEVT_I8253 --static int pit_shutdown(struct clock_event_device *evt) -+void clockevent_i8253_disable(void) - { -- if (!clockevent_state_oneshot(evt) && !clockevent_state_periodic(evt)) -- return 0; -- - raw_spin_lock(&i8253_lock); - - outb_p(0x30, PIT_MODE); -@@ -123,6 +120,14 @@ static int pit_shutdown(struct clock_event_device *evt) - } - - raw_spin_unlock(&i8253_lock); -+} -+ -+static int pit_shutdown(struct clock_event_device *evt) -+{ -+ if (!clockevent_state_oneshot(evt) && !clockevent_state_periodic(evt)) -+ return 0; -+ -+ clockevent_i8253_disable(); - return 0; - } - -diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c -index 2c1095dcc2f2f8..1ab161e00c8679 100644 ---- a/drivers/firmware/efi/efi.c -+++ b/drivers/firmware/efi/efi.c -@@ -908,13 +908,15 @@ char * __init efi_md_typeattr_format(char *buf, size_t size, - EFI_MEMORY_WB | EFI_MEMORY_UCE | EFI_MEMORY_RO | - EFI_MEMORY_WP | EFI_MEMORY_RP | EFI_MEMORY_XP | - EFI_MEMORY_NV | EFI_MEMORY_SP | EFI_MEMORY_CPU_CRYPTO | -- EFI_MEMORY_RUNTIME | EFI_MEMORY_MORE_RELIABLE)) -+ EFI_MEMORY_MORE_RELIABLE | EFI_MEMORY_HOT_PLUGGABLE | -+ EFI_MEMORY_RUNTIME)) - snprintf(pos, size, "|attr=0x%016llx]", - (unsigned long long)attr); - else - snprintf(pos, size, -- "|%3s|%2s|%2s|%2s|%2s|%2s|%2s|%2s|%2s|%3s|%2s|%2s|%2s|%2s]", -+ "|%3s|%2s|%2s|%2s|%2s|%2s|%2s|%2s|%2s|%2s|%3s|%2s|%2s|%2s|%2s]", - attr & EFI_MEMORY_RUNTIME ? "RUN" : "", -+ attr & EFI_MEMORY_HOT_PLUGGABLE ? "HP" : "", - attr & EFI_MEMORY_MORE_RELIABLE ? "MR" : "", - attr & EFI_MEMORY_CPU_CRYPTO ? "CC" : "", - attr & EFI_MEMORY_SP ? "SP" : "", -diff --git a/drivers/firmware/efi/libstub/randomalloc.c b/drivers/firmware/efi/libstub/randomalloc.c -index c41e7b2091cdd1..8ad3efb9b1ff16 100644 ---- a/drivers/firmware/efi/libstub/randomalloc.c -+++ b/drivers/firmware/efi/libstub/randomalloc.c -@@ -25,6 +25,9 @@ static unsigned long get_entry_num_slots(efi_memory_desc_t *md, - if (md->type != EFI_CONVENTIONAL_MEMORY) - return 0; - -+ if (md->attribute & EFI_MEMORY_HOT_PLUGGABLE) -+ return 0; -+ - if (efi_soft_reserve_enabled() && - (md->attribute & EFI_MEMORY_SP)) - return 0; -diff --git a/drivers/firmware/efi/libstub/relocate.c b/drivers/firmware/efi/libstub/relocate.c -index bf6fbd5d22a1a5..713ee2de02cf3f 100644 ---- a/drivers/firmware/efi/libstub/relocate.c -+++ b/drivers/firmware/efi/libstub/relocate.c -@@ -53,6 +53,9 @@ efi_status_t efi_low_alloc_above(unsigned long size, unsigned long align, - if (desc->type != EFI_CONVENTIONAL_MEMORY) - continue; - -+ if (desc->attribute & EFI_MEMORY_HOT_PLUGGABLE) -+ continue; -+ - if (efi_soft_reserve_enabled() && - (desc->attribute & EFI_MEMORY_SP)) - continue; -diff --git a/drivers/gpio/gpio-bcm-kona.c b/drivers/gpio/gpio-bcm-kona.c -index 5321ef98f4427d..64908f1a5e7f9b 100644 ---- a/drivers/gpio/gpio-bcm-kona.c -+++ b/drivers/gpio/gpio-bcm-kona.c -@@ -69,6 +69,22 @@ struct bcm_kona_gpio { - struct bcm_kona_gpio_bank { - int id; - int irq; -+ /* -+ * Used to keep track of lock/unlock operations for each GPIO in the -+ * bank. -+ * -+ * All GPIOs are locked by default (see bcm_kona_gpio_reset), and the -+ * unlock count for all GPIOs is 0 by default. Each unlock increments -+ * the counter, and each lock decrements the counter. -+ * -+ * The lock function only locks the GPIO once its unlock counter is -+ * down to 0. This is necessary because the GPIO is unlocked in two -+ * places in this driver: once for requested GPIOs, and once for -+ * requested IRQs. Since it is possible for a GPIO to be requested -+ * as both a GPIO and an IRQ, we need to ensure that we don't lock it -+ * too early. -+ */ -+ u8 gpio_unlock_count[GPIO_PER_BANK]; - /* Used in the interrupt handler */ - struct bcm_kona_gpio *kona_gpio; - }; -@@ -86,14 +102,24 @@ static void bcm_kona_gpio_lock_gpio(struct bcm_kona_gpio *kona_gpio, - u32 val; - unsigned long flags; - int bank_id = GPIO_BANK(gpio); -+ int bit = GPIO_BIT(gpio); -+ struct bcm_kona_gpio_bank *bank = &kona_gpio->banks[bank_id]; - -- raw_spin_lock_irqsave(&kona_gpio->lock, flags); -+ if (bank->gpio_unlock_count[bit] == 0) { -+ dev_err(kona_gpio->gpio_chip.parent, -+ "Unbalanced locks for GPIO %u\n", gpio); -+ return; -+ } - -- val = readl(kona_gpio->reg_base + GPIO_PWD_STATUS(bank_id)); -- val |= BIT(gpio); -- bcm_kona_gpio_write_lock_regs(kona_gpio->reg_base, bank_id, val); -+ if (--bank->gpio_unlock_count[bit] == 0) { -+ raw_spin_lock_irqsave(&kona_gpio->lock, flags); - -- raw_spin_unlock_irqrestore(&kona_gpio->lock, flags); -+ val = readl(kona_gpio->reg_base + GPIO_PWD_STATUS(bank_id)); -+ val |= BIT(bit); -+ bcm_kona_gpio_write_lock_regs(kona_gpio->reg_base, bank_id, val); -+ -+ raw_spin_unlock_irqrestore(&kona_gpio->lock, flags); -+ } - } - - static void bcm_kona_gpio_unlock_gpio(struct bcm_kona_gpio *kona_gpio, -@@ -102,14 +128,20 @@ static void bcm_kona_gpio_unlock_gpio(struct bcm_kona_gpio *kona_gpio, - u32 val; - unsigned long flags; - int bank_id = GPIO_BANK(gpio); -+ int bit = GPIO_BIT(gpio); -+ struct bcm_kona_gpio_bank *bank = &kona_gpio->banks[bank_id]; - -- raw_spin_lock_irqsave(&kona_gpio->lock, flags); -+ if (bank->gpio_unlock_count[bit] == 0) { -+ raw_spin_lock_irqsave(&kona_gpio->lock, flags); - -- val = readl(kona_gpio->reg_base + GPIO_PWD_STATUS(bank_id)); -- val &= ~BIT(gpio); -- bcm_kona_gpio_write_lock_regs(kona_gpio->reg_base, bank_id, val); -+ val = readl(kona_gpio->reg_base + GPIO_PWD_STATUS(bank_id)); -+ val &= ~BIT(bit); -+ bcm_kona_gpio_write_lock_regs(kona_gpio->reg_base, bank_id, val); - -- raw_spin_unlock_irqrestore(&kona_gpio->lock, flags); -+ raw_spin_unlock_irqrestore(&kona_gpio->lock, flags); -+ } -+ -+ ++bank->gpio_unlock_count[bit]; - } - - static int bcm_kona_gpio_get_dir(struct gpio_chip *chip, unsigned gpio) -@@ -360,6 +392,7 @@ static void bcm_kona_gpio_irq_mask(struct irq_data *d) - - kona_gpio = irq_data_get_irq_chip_data(d); - reg_base = kona_gpio->reg_base; -+ - raw_spin_lock_irqsave(&kona_gpio->lock, flags); - - val = readl(reg_base + GPIO_INT_MASK(bank_id)); -@@ -382,6 +415,7 @@ static void bcm_kona_gpio_irq_unmask(struct irq_data *d) - - kona_gpio = irq_data_get_irq_chip_data(d); - reg_base = kona_gpio->reg_base; -+ - raw_spin_lock_irqsave(&kona_gpio->lock, flags); - - val = readl(reg_base + GPIO_INT_MSKCLR(bank_id)); -@@ -477,15 +511,26 @@ static void bcm_kona_gpio_irq_handler(struct irq_desc *desc) - static int bcm_kona_gpio_irq_reqres(struct irq_data *d) - { - struct bcm_kona_gpio *kona_gpio = irq_data_get_irq_chip_data(d); -+ unsigned int gpio = d->hwirq; - -- return gpiochip_reqres_irq(&kona_gpio->gpio_chip, d->hwirq); -+ /* -+ * We need to unlock the GPIO before any other operations are performed -+ * on the relevant GPIO configuration registers -+ */ -+ bcm_kona_gpio_unlock_gpio(kona_gpio, gpio); -+ -+ return gpiochip_reqres_irq(&kona_gpio->gpio_chip, gpio); - } - - static void bcm_kona_gpio_irq_relres(struct irq_data *d) - { - struct bcm_kona_gpio *kona_gpio = irq_data_get_irq_chip_data(d); -+ unsigned int gpio = d->hwirq; -+ -+ /* Once we no longer use it, lock the GPIO again */ -+ bcm_kona_gpio_lock_gpio(kona_gpio, gpio); - -- gpiochip_relres_irq(&kona_gpio->gpio_chip, d->hwirq); -+ gpiochip_relres_irq(&kona_gpio->gpio_chip, gpio); - } - - static struct irq_chip bcm_gpio_irq_chip = { -@@ -614,7 +659,7 @@ static int bcm_kona_gpio_probe(struct platform_device *pdev) - bank->irq = platform_get_irq(pdev, i); - bank->kona_gpio = kona_gpio; - if (bank->irq < 0) { -- dev_err(dev, "Couldn't get IRQ for bank %d", i); -+ dev_err(dev, "Couldn't get IRQ for bank %d\n", i); - ret = -ENOENT; - goto err_irq_domain; - } -diff --git a/drivers/gpio/gpio-stmpe.c b/drivers/gpio/gpio-stmpe.c -index 27cc4da5356540..2731e97f2812ce 100644 ---- a/drivers/gpio/gpio-stmpe.c -+++ b/drivers/gpio/gpio-stmpe.c -@@ -191,7 +191,7 @@ static void stmpe_gpio_irq_sync_unlock(struct irq_data *d) - [REG_IE][CSB] = STMPE_IDX_IEGPIOR_CSB, - [REG_IE][MSB] = STMPE_IDX_IEGPIOR_MSB, - }; -- int i, j; -+ int ret, i, j; - - /* - * STMPE1600: to be able to get IRQ from pins, -@@ -199,8 +199,16 @@ static void stmpe_gpio_irq_sync_unlock(struct irq_data *d) - * GPSR or GPCR registers - */ - if (stmpe->partnum == STMPE1600) { -- stmpe_reg_read(stmpe, stmpe->regs[STMPE_IDX_GPMR_LSB]); -- stmpe_reg_read(stmpe, stmpe->regs[STMPE_IDX_GPMR_CSB]); -+ ret = stmpe_reg_read(stmpe, stmpe->regs[STMPE_IDX_GPMR_LSB]); -+ if (ret < 0) { -+ dev_err(stmpe->dev, "Failed to read GPMR_LSB: %d\n", ret); -+ goto err; -+ } -+ ret = stmpe_reg_read(stmpe, stmpe->regs[STMPE_IDX_GPMR_CSB]); -+ if (ret < 0) { -+ dev_err(stmpe->dev, "Failed to read GPMR_CSB: %d\n", ret); -+ goto err; -+ } - } - - for (i = 0; i < CACHE_NR_REGS; i++) { -@@ -222,6 +230,7 @@ static void stmpe_gpio_irq_sync_unlock(struct irq_data *d) - } - } - -+err: - mutex_unlock(&stmpe_gpio->irq_lock); - } - -diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c -index b366b4ca4c40e9..8ddd5e8341a05b 100644 ---- a/drivers/gpio/gpiolib-acpi.c -+++ b/drivers/gpio/gpiolib-acpi.c -@@ -1706,6 +1706,20 @@ static const struct dmi_system_id gpiolib_acpi_quirks[] __initconst = { - .ignore_wake = "PNP0C50:00@8", - }, - }, -+ { -+ /* -+ * Spurious wakeups from GPIO 11 -+ * Found in BIOS 1.04 -+ * https://gitlab.freedesktop.org/drm/amd/-/issues/3954 -+ */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), -+ DMI_MATCH(DMI_PRODUCT_FAMILY, "Acer Nitro V 14"), -+ }, -+ .driver_data = &(struct acpi_gpiolib_dmi_quirk) { -+ .ignore_interrupt = "AMDI0030:00@11", -+ }, -+ }, - {} /* Terminating entry */ - }; - -diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c -index 5c0016c77d2abe..efb592b6f6aa7a 100644 ---- a/drivers/gpio/gpiolib.c -+++ b/drivers/gpio/gpiolib.c -@@ -723,13 +723,13 @@ int gpiochip_get_ngpios(struct gpio_chip *gc, struct device *dev) - } - - if (gc->ngpio == 0) { -- chip_err(gc, "tried to insert a GPIO chip with zero lines\n"); -+ dev_err(dev, "tried to insert a GPIO chip with zero lines\n"); - return -EINVAL; - } - - if (gc->ngpio > FASTPATH_NGPIO) -- chip_warn(gc, "line cnt %u is greater than fast path cnt %u\n", -- gc->ngpio, FASTPATH_NGPIO); -+ dev_warn(dev, "line cnt %u is greater than fast path cnt %u\n", -+ gc->ngpio, FASTPATH_NGPIO); - - return 0; - } -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c -index a4f9015345ccb5..6a24e8ceb94493 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c -@@ -3450,9 +3450,10 @@ int psp_init_cap_microcode(struct psp_context *psp, const char *chip_name) - if (err == -ENODEV) { - dev_warn(adev->dev, "cap microcode does not exist, skip\n"); - err = 0; -- goto out; -+ } else { -+ dev_err(adev->dev, "fail to initialize cap microcode\n"); - } -- dev_err(adev->dev, "fail to initialize cap microcode\n"); -+ goto out; - } - - info = &adev->firmware.ucode[AMDGPU_UCODE_ID_CAP]; -diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c -index d587f807dfd7c4..294609557b73ab 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c -@@ -2026,6 +2026,7 @@ bool dcn20_fast_validate_bw( - { - bool out = false; - int split[MAX_PIPES] = { 0 }; -+ bool merge[MAX_PIPES] = { false }; - int pipe_cnt, i, pipe_idx, vlevel; - - ASSERT(pipes); -@@ -2050,7 +2051,7 @@ bool dcn20_fast_validate_bw( - if (vlevel > context->bw_ctx.dml.soc.num_states) - goto validate_fail; - -- vlevel = dcn20_validate_apply_pipe_split_flags(dc, context, vlevel, split, NULL); -+ vlevel = dcn20_validate_apply_pipe_split_flags(dc, context, vlevel, split, merge); - - /*initialize pipe_just_split_from to invalid idx*/ - for (i = 0; i < MAX_PIPES; i++) -diff --git a/drivers/gpu/drm/amd/display/dc/dcn201/dcn201_resource.c b/drivers/gpu/drm/amd/display/dc/dcn201/dcn201_resource.c -index 2dc4d2c1410b81..8efe3f32a0e79b 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn201/dcn201_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn201/dcn201_resource.c -@@ -1002,8 +1002,10 @@ static struct pipe_ctx *dcn201_acquire_free_pipe_for_layer( - struct pipe_ctx *head_pipe = resource_get_otg_master_for_stream(res_ctx, opp_head_pipe->stream); - struct pipe_ctx *idle_pipe = resource_find_free_secondary_pipe_legacy(res_ctx, pool, head_pipe); - -- if (!head_pipe) -+ if (!head_pipe) { - ASSERT(0); -+ return NULL; -+ } - - if (!idle_pipe) - return NULL; -diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c -index 8dffa5b6426e1c..24105a5b9f2a59 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c -@@ -800,6 +800,7 @@ bool dcn21_fast_validate_bw(struct dc *dc, - { - bool out = false; - int split[MAX_PIPES] = { 0 }; -+ bool merge[MAX_PIPES] = { false }; - int pipe_cnt, i, pipe_idx, vlevel; - - ASSERT(pipes); -@@ -842,7 +843,7 @@ bool dcn21_fast_validate_bw(struct dc *dc, - goto validate_fail; - } - -- vlevel = dcn20_validate_apply_pipe_split_flags(dc, context, vlevel, split, NULL); -+ vlevel = dcn20_validate_apply_pipe_split_flags(dc, context, vlevel, split, merge); - - for (i = 0, pipe_idx = 0; i < dc->res_pool->pipe_count; i++) { - struct pipe_ctx *pipe = &context->res_ctx.pipe_ctx[i]; -diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c -index 4d17b6958397ed..2997aeed634084 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c -@@ -517,7 +517,8 @@ static int smu_sys_set_pp_table(void *handle, - return -EIO; - } - -- if (!smu_table->hardcode_pptable) { -+ if (!smu_table->hardcode_pptable || smu_table->power_play_table_size < size) { -+ kfree(smu_table->hardcode_pptable); - smu_table->hardcode_pptable = kzalloc(size, GFP_KERNEL); - if (!smu_table->hardcode_pptable) - return -ENOMEM; -diff --git a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c -index 5c397a2df70e28..5d27e1c733c527 100644 ---- a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c -+++ b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c -@@ -168,7 +168,7 @@ static int igt_ppgtt_alloc(void *arg) - return PTR_ERR(ppgtt); - - if (!ppgtt->vm.allocate_va_range) -- goto err_ppgtt_cleanup; -+ goto ppgtt_vm_put; - - /* - * While we only allocate the page tables here and so we could -@@ -236,7 +236,7 @@ static int igt_ppgtt_alloc(void *arg) - goto retry; - } - i915_gem_ww_ctx_fini(&ww); -- -+ppgtt_vm_put: - i915_vm_put(&ppgtt->vm); - return err; - } -diff --git a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c -index 2dba7c5ffd2c62..92f4261305bd9d 100644 ---- a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c -+++ b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c -@@ -587,7 +587,7 @@ static int rcar_mipi_dsi_startup(struct rcar_mipi_dsi *dsi, - for (timeout = 10; timeout > 0; --timeout) { - if ((rcar_mipi_dsi_read(dsi, PPICLSR) & PPICLSR_STPST) && - (rcar_mipi_dsi_read(dsi, PPIDLSR) & PPIDLSR_STPST) && -- (rcar_mipi_dsi_read(dsi, CLOCKSET1) & CLOCKSET1_LOCK)) -+ (rcar_mipi_dsi_read(dsi, CLOCKSET1) & CLOCKSET1_LOCK_PHY)) - break; - - usleep_range(1000, 2000); -diff --git a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h -index f8114d11f2d158..a6b276f1d6ee15 100644 ---- a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h -+++ b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h -@@ -142,7 +142,6 @@ - - #define CLOCKSET1 0x101c - #define CLOCKSET1_LOCK_PHY (1 << 17) --#define CLOCKSET1_LOCK (1 << 16) - #define CLOCKSET1_CLKSEL (1 << 8) - #define CLOCKSET1_CLKINSEL_EXTAL (0 << 2) - #define CLOCKSET1_CLKINSEL_DIG (1 << 2) -diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c -index 98efbaf3b0c23f..ee3531bbccd7df 100644 ---- a/drivers/gpu/drm/tidss/tidss_dispc.c -+++ b/drivers/gpu/drm/tidss/tidss_dispc.c -@@ -646,7 +646,7 @@ void dispc_k2g_set_irqenable(struct dispc_device *dispc, dispc_irq_t mask) - { - dispc_irq_t old_mask = dispc_k2g_read_irqenable(dispc); - -- /* clear the irqstatus for newly enabled irqs */ -+ /* clear the irqstatus for irqs that will be enabled */ - dispc_k2g_clear_irqstatus(dispc, (mask ^ old_mask) & mask); - - dispc_k2g_vp_set_irqenable(dispc, 0, mask); -@@ -654,6 +654,9 @@ void dispc_k2g_set_irqenable(struct dispc_device *dispc, dispc_irq_t mask) - - dispc_write(dispc, DISPC_IRQENABLE_SET, (1 << 0) | (1 << 7)); - -+ /* clear the irqstatus for irqs that were disabled */ -+ dispc_k2g_clear_irqstatus(dispc, (mask ^ old_mask) & old_mask); -+ - /* flush posted write */ - dispc_k2g_read_irqenable(dispc); - } -@@ -726,24 +729,20 @@ static - void dispc_k3_clear_irqstatus(struct dispc_device *dispc, dispc_irq_t clearmask) - { - unsigned int i; -- u32 top_clear = 0; - - for (i = 0; i < dispc->feat->num_vps; ++i) { -- if (clearmask & DSS_IRQ_VP_MASK(i)) { -+ if (clearmask & DSS_IRQ_VP_MASK(i)) - dispc_k3_vp_write_irqstatus(dispc, i, clearmask); -- top_clear |= BIT(i); -- } - } - for (i = 0; i < dispc->feat->num_planes; ++i) { -- if (clearmask & DSS_IRQ_PLANE_MASK(i)) { -+ if (clearmask & DSS_IRQ_PLANE_MASK(i)) - dispc_k3_vid_write_irqstatus(dispc, i, clearmask); -- top_clear |= BIT(4 + i); -- } - } - if (dispc->feat->subrev == DISPC_K2G) - return; - -- dispc_write(dispc, DISPC_IRQSTATUS, top_clear); -+ /* always clear the top level irqstatus */ -+ dispc_write(dispc, DISPC_IRQSTATUS, dispc_read(dispc, DISPC_IRQSTATUS)); - - /* Flush posted writes */ - dispc_read(dispc, DISPC_IRQSTATUS); -@@ -789,7 +788,7 @@ static void dispc_k3_set_irqenable(struct dispc_device *dispc, - - old_mask = dispc_k3_read_irqenable(dispc); - -- /* clear the irqstatus for newly enabled irqs */ -+ /* clear the irqstatus for irqs that will be enabled */ - dispc_k3_clear_irqstatus(dispc, (old_mask ^ mask) & mask); - - for (i = 0; i < dispc->feat->num_vps; ++i) { -@@ -814,6 +813,9 @@ static void dispc_k3_set_irqenable(struct dispc_device *dispc, - if (main_disable) - dispc_write(dispc, DISPC_IRQENABLE_CLR, main_disable); - -+ /* clear the irqstatus for irqs that were disabled */ -+ dispc_k3_clear_irqstatus(dispc, (old_mask ^ mask) & old_mask); -+ - /* Flush posted writes */ - dispc_read(dispc, DISPC_IRQENABLE_SET); - } -diff --git a/drivers/gpu/drm/v3d/v3d_perfmon.c b/drivers/gpu/drm/v3d/v3d_perfmon.c -index 141b8abf08629f..e56b5935f2f1c1 100644 ---- a/drivers/gpu/drm/v3d/v3d_perfmon.c -+++ b/drivers/gpu/drm/v3d/v3d_perfmon.c -@@ -179,6 +179,7 @@ int v3d_perfmon_destroy_ioctl(struct drm_device *dev, void *data, - { - struct v3d_file_priv *v3d_priv = file_priv->driver_priv; - struct drm_v3d_perfmon_destroy *req = data; -+ struct v3d_dev *v3d = v3d_priv->v3d; - struct v3d_perfmon *perfmon; - - mutex_lock(&v3d_priv->perfmon.lock); -@@ -188,6 +189,10 @@ int v3d_perfmon_destroy_ioctl(struct drm_device *dev, void *data, - if (!perfmon) - return -EINVAL; - -+ /* If the active perfmon is being destroyed, stop it first */ -+ if (perfmon == v3d->active_perfmon) -+ v3d_perfmon_stop(v3d, perfmon, false); -+ - v3d_perfmon_put(perfmon); - - return 0; -diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c -index 5ad871a7d1a44c..6386043aab0bbf 100644 ---- a/drivers/hid/hid-multitouch.c -+++ b/drivers/hid/hid-multitouch.c -@@ -1668,9 +1668,12 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi) - break; - } - -- if (suffix) -+ if (suffix) { - hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL, - "%s %s", hdev->name, suffix); -+ if (!hi->input->name) -+ return -ENOMEM; -+ } - - return 0; - } -diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c -index b110818fc94586..49c067133975f7 100644 ---- a/drivers/hid/hid-steam.c -+++ b/drivers/hid/hid-steam.c -@@ -66,55 +66,225 @@ static LIST_HEAD(steam_devices); - #define STEAM_DECK_TRIGGER_RESOLUTION 5461 - /* Joystick runs are about 5 mm and 32768 units */ - #define STEAM_DECK_JOYSTICK_RESOLUTION 6553 -+/* Accelerometer has 16 bit resolution and a range of +/- 2g */ -+#define STEAM_DECK_ACCEL_RES_PER_G 16384 -+#define STEAM_DECK_ACCEL_RANGE 32768 -+#define STEAM_DECK_ACCEL_FUZZ 32 -+/* Gyroscope has 16 bit resolution and a range of +/- 2000 dps */ -+#define STEAM_DECK_GYRO_RES_PER_DPS 16 -+#define STEAM_DECK_GYRO_RANGE 32768 -+#define STEAM_DECK_GYRO_FUZZ 1 - - #define STEAM_PAD_FUZZ 256 - - /* - * Commands that can be sent in a feature report. -- * Thanks to Valve for some valuable hints. -+ * Thanks to Valve and SDL for the names. - */ --#define STEAM_CMD_SET_MAPPINGS 0x80 --#define STEAM_CMD_CLEAR_MAPPINGS 0x81 --#define STEAM_CMD_GET_MAPPINGS 0x82 --#define STEAM_CMD_GET_ATTRIB 0x83 --#define STEAM_CMD_GET_ATTRIB_LABEL 0x84 --#define STEAM_CMD_DEFAULT_MAPPINGS 0x85 --#define STEAM_CMD_FACTORY_RESET 0x86 --#define STEAM_CMD_WRITE_REGISTER 0x87 --#define STEAM_CMD_CLEAR_REGISTER 0x88 --#define STEAM_CMD_READ_REGISTER 0x89 --#define STEAM_CMD_GET_REGISTER_LABEL 0x8a --#define STEAM_CMD_GET_REGISTER_MAX 0x8b --#define STEAM_CMD_GET_REGISTER_DEFAULT 0x8c --#define STEAM_CMD_SET_MODE 0x8d --#define STEAM_CMD_DEFAULT_MOUSE 0x8e --#define STEAM_CMD_FORCEFEEDBAK 0x8f --#define STEAM_CMD_REQUEST_COMM_STATUS 0xb4 --#define STEAM_CMD_GET_SERIAL 0xae --#define STEAM_CMD_HAPTIC_RUMBLE 0xeb -- --/* Some useful register ids */ --#define STEAM_REG_LPAD_MODE 0x07 --#define STEAM_REG_RPAD_MODE 0x08 --#define STEAM_REG_RPAD_MARGIN 0x18 --#define STEAM_REG_LED 0x2d --#define STEAM_REG_GYRO_MODE 0x30 --#define STEAM_REG_LPAD_CLICK_PRESSURE 0x34 --#define STEAM_REG_RPAD_CLICK_PRESSURE 0x35 -- --/* Raw event identifiers */ --#define STEAM_EV_INPUT_DATA 0x01 --#define STEAM_EV_CONNECT 0x03 --#define STEAM_EV_BATTERY 0x04 --#define STEAM_EV_DECK_INPUT_DATA 0x09 -+enum { -+ ID_SET_DIGITAL_MAPPINGS = 0x80, -+ ID_CLEAR_DIGITAL_MAPPINGS = 0x81, -+ ID_GET_DIGITAL_MAPPINGS = 0x82, -+ ID_GET_ATTRIBUTES_VALUES = 0x83, -+ ID_GET_ATTRIBUTE_LABEL = 0x84, -+ ID_SET_DEFAULT_DIGITAL_MAPPINGS = 0x85, -+ ID_FACTORY_RESET = 0x86, -+ ID_SET_SETTINGS_VALUES = 0x87, -+ ID_CLEAR_SETTINGS_VALUES = 0x88, -+ ID_GET_SETTINGS_VALUES = 0x89, -+ ID_GET_SETTING_LABEL = 0x8A, -+ ID_GET_SETTINGS_MAXS = 0x8B, -+ ID_GET_SETTINGS_DEFAULTS = 0x8C, -+ ID_SET_CONTROLLER_MODE = 0x8D, -+ ID_LOAD_DEFAULT_SETTINGS = 0x8E, -+ ID_TRIGGER_HAPTIC_PULSE = 0x8F, -+ ID_TURN_OFF_CONTROLLER = 0x9F, -+ -+ ID_GET_DEVICE_INFO = 0xA1, -+ -+ ID_CALIBRATE_TRACKPADS = 0xA7, -+ ID_RESERVED_0 = 0xA8, -+ ID_SET_SERIAL_NUMBER = 0xA9, -+ ID_GET_TRACKPAD_CALIBRATION = 0xAA, -+ ID_GET_TRACKPAD_FACTORY_CALIBRATION = 0xAB, -+ ID_GET_TRACKPAD_RAW_DATA = 0xAC, -+ ID_ENABLE_PAIRING = 0xAD, -+ ID_GET_STRING_ATTRIBUTE = 0xAE, -+ ID_RADIO_ERASE_RECORDS = 0xAF, -+ ID_RADIO_WRITE_RECORD = 0xB0, -+ ID_SET_DONGLE_SETTING = 0xB1, -+ ID_DONGLE_DISCONNECT_DEVICE = 0xB2, -+ ID_DONGLE_COMMIT_DEVICE = 0xB3, -+ ID_DONGLE_GET_WIRELESS_STATE = 0xB4, -+ ID_CALIBRATE_GYRO = 0xB5, -+ ID_PLAY_AUDIO = 0xB6, -+ ID_AUDIO_UPDATE_START = 0xB7, -+ ID_AUDIO_UPDATE_DATA = 0xB8, -+ ID_AUDIO_UPDATE_COMPLETE = 0xB9, -+ ID_GET_CHIPID = 0xBA, -+ -+ ID_CALIBRATE_JOYSTICK = 0xBF, -+ ID_CALIBRATE_ANALOG_TRIGGERS = 0xC0, -+ ID_SET_AUDIO_MAPPING = 0xC1, -+ ID_CHECK_GYRO_FW_LOAD = 0xC2, -+ ID_CALIBRATE_ANALOG = 0xC3, -+ ID_DONGLE_GET_CONNECTED_SLOTS = 0xC4, -+ -+ ID_RESET_IMU = 0xCE, -+ -+ ID_TRIGGER_HAPTIC_CMD = 0xEA, -+ ID_TRIGGER_RUMBLE_CMD = 0xEB, -+}; -+ -+/* Settings IDs */ -+enum { -+ /* 0 */ -+ SETTING_MOUSE_SENSITIVITY, -+ SETTING_MOUSE_ACCELERATION, -+ SETTING_TRACKBALL_ROTATION_ANGLE, -+ SETTING_HAPTIC_INTENSITY_UNUSED, -+ SETTING_LEFT_GAMEPAD_STICK_ENABLED, -+ SETTING_RIGHT_GAMEPAD_STICK_ENABLED, -+ SETTING_USB_DEBUG_MODE, -+ SETTING_LEFT_TRACKPAD_MODE, -+ SETTING_RIGHT_TRACKPAD_MODE, -+ SETTING_MOUSE_POINTER_ENABLED, -+ -+ /* 10 */ -+ SETTING_DPAD_DEADZONE, -+ SETTING_MINIMUM_MOMENTUM_VEL, -+ SETTING_MOMENTUM_DECAY_AMMOUNT, -+ SETTING_TRACKPAD_RELATIVE_MODE_TICKS_PER_PIXEL, -+ SETTING_HAPTIC_INCREMENT, -+ SETTING_DPAD_ANGLE_SIN, -+ SETTING_DPAD_ANGLE_COS, -+ SETTING_MOMENTUM_VERTICAL_DIVISOR, -+ SETTING_MOMENTUM_MAXIMUM_VELOCITY, -+ SETTING_TRACKPAD_Z_ON, -+ -+ /* 20 */ -+ SETTING_TRACKPAD_Z_OFF, -+ SETTING_SENSITIVY_SCALE_AMMOUNT, -+ SETTING_LEFT_TRACKPAD_SECONDARY_MODE, -+ SETTING_RIGHT_TRACKPAD_SECONDARY_MODE, -+ SETTING_SMOOTH_ABSOLUTE_MOUSE, -+ SETTING_STEAMBUTTON_POWEROFF_TIME, -+ SETTING_UNUSED_1, -+ SETTING_TRACKPAD_OUTER_RADIUS, -+ SETTING_TRACKPAD_Z_ON_LEFT, -+ SETTING_TRACKPAD_Z_OFF_LEFT, -+ -+ /* 30 */ -+ SETTING_TRACKPAD_OUTER_SPIN_VEL, -+ SETTING_TRACKPAD_OUTER_SPIN_RADIUS, -+ SETTING_TRACKPAD_OUTER_SPIN_HORIZONTAL_ONLY, -+ SETTING_TRACKPAD_RELATIVE_MODE_DEADZONE, -+ SETTING_TRACKPAD_RELATIVE_MODE_MAX_VEL, -+ SETTING_TRACKPAD_RELATIVE_MODE_INVERT_Y, -+ SETTING_TRACKPAD_DOUBLE_TAP_BEEP_ENABLED, -+ SETTING_TRACKPAD_DOUBLE_TAP_BEEP_PERIOD, -+ SETTING_TRACKPAD_DOUBLE_TAP_BEEP_COUNT, -+ SETTING_TRACKPAD_OUTER_RADIUS_RELEASE_ON_TRANSITION, -+ -+ /* 40 */ -+ SETTING_RADIAL_MODE_ANGLE, -+ SETTING_HAPTIC_INTENSITY_MOUSE_MODE, -+ SETTING_LEFT_DPAD_REQUIRES_CLICK, -+ SETTING_RIGHT_DPAD_REQUIRES_CLICK, -+ SETTING_LED_BASELINE_BRIGHTNESS, -+ SETTING_LED_USER_BRIGHTNESS, -+ SETTING_ENABLE_RAW_JOYSTICK, -+ SETTING_ENABLE_FAST_SCAN, -+ SETTING_IMU_MODE, -+ SETTING_WIRELESS_PACKET_VERSION, -+ -+ /* 50 */ -+ SETTING_SLEEP_INACTIVITY_TIMEOUT, -+ SETTING_TRACKPAD_NOISE_THRESHOLD, -+ SETTING_LEFT_TRACKPAD_CLICK_PRESSURE, -+ SETTING_RIGHT_TRACKPAD_CLICK_PRESSURE, -+ SETTING_LEFT_BUMPER_CLICK_PRESSURE, -+ SETTING_RIGHT_BUMPER_CLICK_PRESSURE, -+ SETTING_LEFT_GRIP_CLICK_PRESSURE, -+ SETTING_RIGHT_GRIP_CLICK_PRESSURE, -+ SETTING_LEFT_GRIP2_CLICK_PRESSURE, -+ SETTING_RIGHT_GRIP2_CLICK_PRESSURE, -+ -+ /* 60 */ -+ SETTING_PRESSURE_MODE, -+ SETTING_CONTROLLER_TEST_MODE, -+ SETTING_TRIGGER_MODE, -+ SETTING_TRACKPAD_Z_THRESHOLD, -+ SETTING_FRAME_RATE, -+ SETTING_TRACKPAD_FILT_CTRL, -+ SETTING_TRACKPAD_CLIP, -+ SETTING_DEBUG_OUTPUT_SELECT, -+ SETTING_TRIGGER_THRESHOLD_PERCENT, -+ SETTING_TRACKPAD_FREQUENCY_HOPPING, -+ -+ /* 70 */ -+ SETTING_HAPTICS_ENABLED, -+ SETTING_STEAM_WATCHDOG_ENABLE, -+ SETTING_TIMP_TOUCH_THRESHOLD_ON, -+ SETTING_TIMP_TOUCH_THRESHOLD_OFF, -+ SETTING_FREQ_HOPPING, -+ SETTING_TEST_CONTROL, -+ SETTING_HAPTIC_MASTER_GAIN_DB, -+ SETTING_THUMB_TOUCH_THRESH, -+ SETTING_DEVICE_POWER_STATUS, -+ SETTING_HAPTIC_INTENSITY, -+ -+ /* 80 */ -+ SETTING_STABILIZER_ENABLED, -+ SETTING_TIMP_MODE_MTE, -+}; -+ -+/* Input report identifiers */ -+enum -+{ -+ ID_CONTROLLER_STATE = 1, -+ ID_CONTROLLER_DEBUG = 2, -+ ID_CONTROLLER_WIRELESS = 3, -+ ID_CONTROLLER_STATUS = 4, -+ ID_CONTROLLER_DEBUG2 = 5, -+ ID_CONTROLLER_SECONDARY_STATE = 6, -+ ID_CONTROLLER_BLE_STATE = 7, -+ ID_CONTROLLER_DECK_STATE = 9 -+}; -+ -+/* String attribute idenitifiers */ -+enum { -+ ATTRIB_STR_BOARD_SERIAL, -+ ATTRIB_STR_UNIT_SERIAL, -+}; - - /* Values for GYRO_MODE (bitmask) */ --#define STEAM_GYRO_MODE_OFF 0x0000 --#define STEAM_GYRO_MODE_STEERING 0x0001 --#define STEAM_GYRO_MODE_TILT 0x0002 --#define STEAM_GYRO_MODE_SEND_ORIENTATION 0x0004 --#define STEAM_GYRO_MODE_SEND_RAW_ACCEL 0x0008 --#define STEAM_GYRO_MODE_SEND_RAW_GYRO 0x0010 -+enum { -+ SETTING_GYRO_MODE_OFF = 0, -+ SETTING_GYRO_MODE_STEERING = BIT(0), -+ SETTING_GYRO_MODE_TILT = BIT(1), -+ SETTING_GYRO_MODE_SEND_ORIENTATION = BIT(2), -+ SETTING_GYRO_MODE_SEND_RAW_ACCEL = BIT(3), -+ SETTING_GYRO_MODE_SEND_RAW_GYRO = BIT(4), -+}; -+ -+/* Trackpad modes */ -+enum { -+ TRACKPAD_ABSOLUTE_MOUSE, -+ TRACKPAD_RELATIVE_MOUSE, -+ TRACKPAD_DPAD_FOUR_WAY_DISCRETE, -+ TRACKPAD_DPAD_FOUR_WAY_OVERLAP, -+ TRACKPAD_DPAD_EIGHT_WAY, -+ TRACKPAD_RADIAL_MODE, -+ TRACKPAD_ABSOLUTE_DPAD, -+ TRACKPAD_NONE, -+ TRACKPAD_GESTURE_KEYBOARD, -+}; -+ -+/* Pad identifiers for the deck */ -+#define STEAM_PAD_LEFT 0 -+#define STEAM_PAD_RIGHT 1 -+#define STEAM_PAD_BOTH 2 - - /* Other random constants */ - #define STEAM_SERIAL_LEN 10 -@@ -123,9 +293,10 @@ struct steam_device { - struct list_head list; - spinlock_t lock; - struct hid_device *hdev, *client_hdev; -- struct mutex mutex; -+ struct mutex report_mutex; - bool client_opened; - struct input_dev __rcu *input; -+ struct input_dev __rcu *sensors; - unsigned long quirks; - struct work_struct work_connect; - bool connected; -@@ -134,10 +305,14 @@ struct steam_device { - struct power_supply __rcu *battery; - u8 battery_charge; - u16 voltage; -- struct delayed_work heartbeat; -+ struct delayed_work mode_switch; -+ bool did_mode_switch; -+ bool gamepad_mode; - struct work_struct rumble_work; - u16 rumble_left; - u16 rumble_right; -+ unsigned int sensor_timestamp_us; -+ struct work_struct unregister_work; - }; - - static int steam_recv_report(struct steam_device *steam, -@@ -226,13 +401,13 @@ static inline int steam_send_report_byte(struct steam_device *steam, u8 cmd) - return steam_send_report(steam, &cmd, 1); - } - --static int steam_write_registers(struct steam_device *steam, -+static int steam_write_settings(struct steam_device *steam, - /* u8 reg, u16 val */...) - { - /* Send: 0x87 len (reg valLo valHi)* */ - u8 reg; - u16 val; -- u8 cmd[64] = {STEAM_CMD_WRITE_REGISTER, 0x00}; -+ u8 cmd[64] = {ID_SET_SETTINGS_VALUES, 0x00}; - int ret; - va_list args; - -@@ -267,21 +442,26 @@ static int steam_get_serial(struct steam_device *steam) - * Send: 0xae 0x15 0x01 - * Recv: 0xae 0x15 0x01 serialnumber (10 chars) - */ -- int ret; -- u8 cmd[] = {STEAM_CMD_GET_SERIAL, 0x15, 0x01}; -+ int ret = 0; -+ u8 cmd[] = {ID_GET_STRING_ATTRIBUTE, 0x15, ATTRIB_STR_UNIT_SERIAL}; - u8 reply[3 + STEAM_SERIAL_LEN + 1]; - -+ mutex_lock(&steam->report_mutex); - ret = steam_send_report(steam, cmd, sizeof(cmd)); - if (ret < 0) -- return ret; -+ goto out; - ret = steam_recv_report(steam, reply, sizeof(reply)); - if (ret < 0) -- return ret; -- if (reply[0] != 0xae || reply[1] != 0x15 || reply[2] != 0x01) -- return -EIO; -+ goto out; -+ if (reply[0] != ID_GET_STRING_ATTRIBUTE || reply[1] != 0x15 || reply[2] != ATTRIB_STR_UNIT_SERIAL) { -+ ret = -EIO; -+ goto out; -+ } - reply[3 + STEAM_SERIAL_LEN] = 0; - strscpy(steam->serial_no, reply + 3, sizeof(steam->serial_no)); -- return 0; -+out: -+ mutex_unlock(&steam->report_mutex); -+ return ret; - } - - /* -@@ -291,14 +471,50 @@ static int steam_get_serial(struct steam_device *steam) - */ - static inline int steam_request_conn_status(struct steam_device *steam) - { -- return steam_send_report_byte(steam, STEAM_CMD_REQUEST_COMM_STATUS); -+ int ret; -+ mutex_lock(&steam->report_mutex); -+ ret = steam_send_report_byte(steam, ID_DONGLE_GET_WIRELESS_STATE); -+ mutex_unlock(&steam->report_mutex); -+ return ret; -+} -+ -+/* -+ * Send a haptic pulse to the trackpads -+ * Duration and interval are measured in microseconds, count is the number -+ * of pulses to send for duration time with interval microseconds between them -+ * and gain is measured in decibels, ranging from -24 to +6 -+ */ -+static inline int steam_haptic_pulse(struct steam_device *steam, u8 pad, -+ u16 duration, u16 interval, u16 count, u8 gain) -+{ -+ int ret; -+ u8 report[10] = {ID_TRIGGER_HAPTIC_PULSE, 8}; -+ -+ /* Left and right are swapped on this report for legacy reasons */ -+ if (pad < STEAM_PAD_BOTH) -+ pad ^= 1; -+ -+ report[2] = pad; -+ report[3] = duration & 0xFF; -+ report[4] = duration >> 8; -+ report[5] = interval & 0xFF; -+ report[6] = interval >> 8; -+ report[7] = count & 0xFF; -+ report[8] = count >> 8; -+ report[9] = gain; -+ -+ mutex_lock(&steam->report_mutex); -+ ret = steam_send_report(steam, report, sizeof(report)); -+ mutex_unlock(&steam->report_mutex); -+ return ret; - } - - static inline int steam_haptic_rumble(struct steam_device *steam, - u16 intensity, u16 left_speed, u16 right_speed, - u8 left_gain, u8 right_gain) - { -- u8 report[11] = {STEAM_CMD_HAPTIC_RUMBLE, 9}; -+ int ret; -+ u8 report[11] = {ID_TRIGGER_RUMBLE_CMD, 9}; - - report[3] = intensity & 0xFF; - report[4] = intensity >> 8; -@@ -309,7 +525,10 @@ static inline int steam_haptic_rumble(struct steam_device *steam, - report[9] = left_gain; - report[10] = right_gain; - -- return steam_send_report(steam, report, sizeof(report)); -+ mutex_lock(&steam->report_mutex); -+ ret = steam_send_report(steam, report, sizeof(report)); -+ mutex_unlock(&steam->report_mutex); -+ return ret; - } - - static void steam_haptic_rumble_cb(struct work_struct *work) -@@ -335,40 +554,36 @@ static int steam_play_effect(struct input_dev *dev, void *data, - - static void steam_set_lizard_mode(struct steam_device *steam, bool enable) - { -+ if (steam->gamepad_mode) -+ enable = false; -+ - if (enable) { -+ mutex_lock(&steam->report_mutex); - /* enable esc, enter, cursors */ -- steam_send_report_byte(steam, STEAM_CMD_DEFAULT_MAPPINGS); -- /* enable mouse */ -- steam_send_report_byte(steam, STEAM_CMD_DEFAULT_MOUSE); -- steam_write_registers(steam, -- STEAM_REG_RPAD_MARGIN, 0x01, /* enable margin */ -- 0); -- -- cancel_delayed_work_sync(&steam->heartbeat); -+ steam_send_report_byte(steam, ID_SET_DEFAULT_DIGITAL_MAPPINGS); -+ /* reset settings */ -+ steam_send_report_byte(steam, ID_LOAD_DEFAULT_SETTINGS); -+ mutex_unlock(&steam->report_mutex); - } else { -+ mutex_lock(&steam->report_mutex); - /* disable esc, enter, cursor */ -- steam_send_report_byte(steam, STEAM_CMD_CLEAR_MAPPINGS); -+ steam_send_report_byte(steam, ID_CLEAR_DIGITAL_MAPPINGS); - - if (steam->quirks & STEAM_QUIRK_DECK) { -- steam_write_registers(steam, -- STEAM_REG_RPAD_MARGIN, 0x00, /* disable margin */ -- STEAM_REG_LPAD_MODE, 0x07, /* disable mouse */ -- STEAM_REG_RPAD_MODE, 0x07, /* disable mouse */ -- STEAM_REG_LPAD_CLICK_PRESSURE, 0xFFFF, /* disable clicky pad */ -- STEAM_REG_RPAD_CLICK_PRESSURE, 0xFFFF, /* disable clicky pad */ -+ steam_write_settings(steam, -+ SETTING_LEFT_TRACKPAD_MODE, TRACKPAD_NONE, /* disable mouse */ -+ SETTING_RIGHT_TRACKPAD_MODE, TRACKPAD_NONE, /* disable mouse */ -+ SETTING_LEFT_TRACKPAD_CLICK_PRESSURE, 0xFFFF, /* disable haptic click */ -+ SETTING_RIGHT_TRACKPAD_CLICK_PRESSURE, 0xFFFF, /* disable haptic click */ -+ SETTING_STEAM_WATCHDOG_ENABLE, 0, /* disable watchdog that tests if Steam is active */ - 0); -- /* -- * The Steam Deck has a watchdog that automatically enables -- * lizard mode if it doesn't see any traffic for too long -- */ -- if (!work_busy(&steam->heartbeat.work)) -- schedule_delayed_work(&steam->heartbeat, 5 * HZ); -+ mutex_unlock(&steam->report_mutex); - } else { -- steam_write_registers(steam, -- STEAM_REG_RPAD_MARGIN, 0x00, /* disable margin */ -- STEAM_REG_LPAD_MODE, 0x07, /* disable mouse */ -- STEAM_REG_RPAD_MODE, 0x07, /* disable mouse */ -+ steam_write_settings(steam, -+ SETTING_LEFT_TRACKPAD_MODE, TRACKPAD_NONE, /* disable mouse */ -+ SETTING_RIGHT_TRACKPAD_MODE, TRACKPAD_NONE, /* disable mouse */ - 0); -+ mutex_unlock(&steam->report_mutex); - } - } - } -@@ -376,22 +591,38 @@ static void steam_set_lizard_mode(struct steam_device *steam, bool enable) - static int steam_input_open(struct input_dev *dev) - { - struct steam_device *steam = input_get_drvdata(dev); -+ unsigned long flags; -+ bool set_lizard_mode; -+ -+ /* -+ * Disabling lizard mode automatically is only done on the Steam -+ * Controller. On the Steam Deck, this is toggled manually by holding -+ * the options button instead, handled by steam_mode_switch_cb. -+ */ -+ if (!(steam->quirks & STEAM_QUIRK_DECK)) { -+ spin_lock_irqsave(&steam->lock, flags); -+ set_lizard_mode = !steam->client_opened && lizard_mode; -+ spin_unlock_irqrestore(&steam->lock, flags); -+ if (set_lizard_mode) -+ steam_set_lizard_mode(steam, false); -+ } - -- mutex_lock(&steam->mutex); -- if (!steam->client_opened && lizard_mode) -- steam_set_lizard_mode(steam, false); -- mutex_unlock(&steam->mutex); - return 0; - } - - static void steam_input_close(struct input_dev *dev) - { - struct steam_device *steam = input_get_drvdata(dev); -+ unsigned long flags; -+ bool set_lizard_mode; - -- mutex_lock(&steam->mutex); -- if (!steam->client_opened && lizard_mode) -- steam_set_lizard_mode(steam, true); -- mutex_unlock(&steam->mutex); -+ if (!(steam->quirks & STEAM_QUIRK_DECK)) { -+ spin_lock_irqsave(&steam->lock, flags); -+ set_lizard_mode = !steam->client_opened && lizard_mode; -+ spin_unlock_irqrestore(&steam->lock, flags); -+ if (set_lizard_mode) -+ steam_set_lizard_mode(steam, true); -+ } - } - - static enum power_supply_property steam_battery_props[] = { -@@ -604,6 +835,74 @@ static int steam_input_register(struct steam_device *steam) - return ret; - } - -+static int steam_sensors_register(struct steam_device *steam) -+{ -+ struct hid_device *hdev = steam->hdev; -+ struct input_dev *sensors; -+ int ret; -+ -+ if (!(steam->quirks & STEAM_QUIRK_DECK)) -+ return 0; -+ -+ rcu_read_lock(); -+ sensors = rcu_dereference(steam->sensors); -+ rcu_read_unlock(); -+ if (sensors) { -+ dbg_hid("%s: already connected\n", __func__); -+ return 0; -+ } -+ -+ sensors = input_allocate_device(); -+ if (!sensors) -+ return -ENOMEM; -+ -+ input_set_drvdata(sensors, steam); -+ sensors->dev.parent = &hdev->dev; -+ -+ sensors->name = "Steam Deck Motion Sensors"; -+ sensors->phys = hdev->phys; -+ sensors->uniq = steam->serial_no; -+ sensors->id.bustype = hdev->bus; -+ sensors->id.vendor = hdev->vendor; -+ sensors->id.product = hdev->product; -+ sensors->id.version = hdev->version; -+ -+ __set_bit(INPUT_PROP_ACCELEROMETER, sensors->propbit); -+ __set_bit(EV_MSC, sensors->evbit); -+ __set_bit(MSC_TIMESTAMP, sensors->mscbit); -+ -+ input_set_abs_params(sensors, ABS_X, -STEAM_DECK_ACCEL_RANGE, -+ STEAM_DECK_ACCEL_RANGE, STEAM_DECK_ACCEL_FUZZ, 0); -+ input_set_abs_params(sensors, ABS_Y, -STEAM_DECK_ACCEL_RANGE, -+ STEAM_DECK_ACCEL_RANGE, STEAM_DECK_ACCEL_FUZZ, 0); -+ input_set_abs_params(sensors, ABS_Z, -STEAM_DECK_ACCEL_RANGE, -+ STEAM_DECK_ACCEL_RANGE, STEAM_DECK_ACCEL_FUZZ, 0); -+ input_abs_set_res(sensors, ABS_X, STEAM_DECK_ACCEL_RES_PER_G); -+ input_abs_set_res(sensors, ABS_Y, STEAM_DECK_ACCEL_RES_PER_G); -+ input_abs_set_res(sensors, ABS_Z, STEAM_DECK_ACCEL_RES_PER_G); -+ -+ input_set_abs_params(sensors, ABS_RX, -STEAM_DECK_GYRO_RANGE, -+ STEAM_DECK_GYRO_RANGE, STEAM_DECK_GYRO_FUZZ, 0); -+ input_set_abs_params(sensors, ABS_RY, -STEAM_DECK_GYRO_RANGE, -+ STEAM_DECK_GYRO_RANGE, STEAM_DECK_GYRO_FUZZ, 0); -+ input_set_abs_params(sensors, ABS_RZ, -STEAM_DECK_GYRO_RANGE, -+ STEAM_DECK_GYRO_RANGE, STEAM_DECK_GYRO_FUZZ, 0); -+ input_abs_set_res(sensors, ABS_RX, STEAM_DECK_GYRO_RES_PER_DPS); -+ input_abs_set_res(sensors, ABS_RY, STEAM_DECK_GYRO_RES_PER_DPS); -+ input_abs_set_res(sensors, ABS_RZ, STEAM_DECK_GYRO_RES_PER_DPS); -+ -+ ret = input_register_device(sensors); -+ if (ret) -+ goto sensors_register_fail; -+ -+ rcu_assign_pointer(steam->sensors, sensors); -+ return 0; -+ -+sensors_register_fail: -+ input_free_device(sensors); -+ return ret; -+} -+ - static void steam_input_unregister(struct steam_device *steam) - { - struct input_dev *input; -@@ -617,6 +916,24 @@ static void steam_input_unregister(struct steam_device *steam) - input_unregister_device(input); - } - -+static void steam_sensors_unregister(struct steam_device *steam) -+{ -+ struct input_dev *sensors; -+ -+ if (!(steam->quirks & STEAM_QUIRK_DECK)) -+ return; -+ -+ rcu_read_lock(); -+ sensors = rcu_dereference(steam->sensors); -+ rcu_read_unlock(); -+ -+ if (!sensors) -+ return; -+ RCU_INIT_POINTER(steam->sensors, NULL); -+ synchronize_rcu(); -+ input_unregister_device(sensors); -+} -+ - static void steam_battery_unregister(struct steam_device *steam) - { - struct power_supply *battery; -@@ -636,6 +953,7 @@ static int steam_register(struct steam_device *steam) - { - int ret; - bool client_opened; -+ unsigned long flags; - - /* - * This function can be called several times in a row with the -@@ -648,11 +966,9 @@ static int steam_register(struct steam_device *steam) - * Unlikely, but getting the serial could fail, and it is not so - * important, so make up a serial number and go on. - */ -- mutex_lock(&steam->mutex); - if (steam_get_serial(steam) < 0) - strscpy(steam->serial_no, "XXXXXXXXXX", - sizeof(steam->serial_no)); -- mutex_unlock(&steam->mutex); - - hid_info(steam->hdev, "Steam Controller '%s' connected", - steam->serial_no); -@@ -667,23 +983,31 @@ static int steam_register(struct steam_device *steam) - mutex_unlock(&steam_devices_lock); - } - -- mutex_lock(&steam->mutex); -+ spin_lock_irqsave(&steam->lock, flags); - client_opened = steam->client_opened; -- if (!client_opened) -- steam_set_lizard_mode(steam, lizard_mode); -- mutex_unlock(&steam->mutex); -+ spin_unlock_irqrestore(&steam->lock, flags); - -- if (!client_opened) -+ if (!client_opened) { -+ steam_set_lizard_mode(steam, lizard_mode); - ret = steam_input_register(steam); -- else -- ret = 0; -+ if (ret != 0) -+ goto steam_register_input_fail; -+ ret = steam_sensors_register(steam); -+ if (ret != 0) -+ goto steam_register_sensors_fail; -+ } -+ return 0; - -+steam_register_sensors_fail: -+ steam_input_unregister(steam); -+steam_register_input_fail: - return ret; - } - - static void steam_unregister(struct steam_device *steam) - { - steam_battery_unregister(steam); -+ steam_sensors_unregister(steam); - steam_input_unregister(steam); - if (steam->serial_no[0]) { - hid_info(steam->hdev, "Steam Controller '%s' disconnected", -@@ -719,6 +1043,59 @@ static void steam_work_connect_cb(struct work_struct *work) - } - } - -+static void steam_mode_switch_cb(struct work_struct *work) -+{ -+ struct steam_device *steam = container_of(to_delayed_work(work), -+ struct steam_device, mode_switch); -+ unsigned long flags; -+ bool client_opened; -+ steam->gamepad_mode = !steam->gamepad_mode; -+ if (!lizard_mode) -+ return; -+ -+ if (steam->gamepad_mode) -+ steam_set_lizard_mode(steam, false); -+ else { -+ spin_lock_irqsave(&steam->lock, flags); -+ client_opened = steam->client_opened; -+ spin_unlock_irqrestore(&steam->lock, flags); -+ if (!client_opened) -+ steam_set_lizard_mode(steam, lizard_mode); -+ } -+ -+ steam_haptic_pulse(steam, STEAM_PAD_RIGHT, 0x190, 0, 1, 0); -+ if (steam->gamepad_mode) { -+ steam_haptic_pulse(steam, STEAM_PAD_LEFT, 0x14D, 0x14D, 0x2D, 0); -+ } else { -+ steam_haptic_pulse(steam, STEAM_PAD_LEFT, 0x1F4, 0x1F4, 0x1E, 0); -+ } -+} -+ -+static void steam_work_unregister_cb(struct work_struct *work) -+{ -+ struct steam_device *steam = container_of(work, struct steam_device, -+ unregister_work); -+ unsigned long flags; -+ bool connected; -+ bool opened; -+ -+ spin_lock_irqsave(&steam->lock, flags); -+ opened = steam->client_opened; -+ connected = steam->connected; -+ spin_unlock_irqrestore(&steam->lock, flags); -+ -+ if (connected) { -+ if (opened) { -+ steam_sensors_unregister(steam); -+ steam_input_unregister(steam); -+ } else { -+ steam_set_lizard_mode(steam, lizard_mode); -+ steam_input_register(steam); -+ steam_sensors_register(steam); -+ } -+ } -+} -+ - static bool steam_is_valve_interface(struct hid_device *hdev) - { - struct hid_report_enum *rep_enum; -@@ -738,22 +1115,6 @@ static bool steam_is_valve_interface(struct hid_device *hdev) - return !list_empty(&rep_enum->report_list); - } - --static void steam_lizard_mode_heartbeat(struct work_struct *work) --{ -- struct steam_device *steam = container_of(work, struct steam_device, -- heartbeat.work); -- -- mutex_lock(&steam->mutex); -- if (!steam->client_opened && steam->client_hdev) { -- steam_send_report_byte(steam, STEAM_CMD_CLEAR_MAPPINGS); -- steam_write_registers(steam, -- STEAM_REG_RPAD_MODE, 0x07, /* disable mouse */ -- 0); -- schedule_delayed_work(&steam->heartbeat, 5 * HZ); -- } -- mutex_unlock(&steam->mutex); --} -- - static int steam_client_ll_parse(struct hid_device *hdev) - { - struct steam_device *steam = hdev->driver_data; -@@ -774,12 +1135,13 @@ static void steam_client_ll_stop(struct hid_device *hdev) - static int steam_client_ll_open(struct hid_device *hdev) - { - struct steam_device *steam = hdev->driver_data; -+ unsigned long flags; - -- mutex_lock(&steam->mutex); -+ spin_lock_irqsave(&steam->lock, flags); - steam->client_opened = true; -- mutex_unlock(&steam->mutex); -+ spin_unlock_irqrestore(&steam->lock, flags); - -- steam_input_unregister(steam); -+ schedule_work(&steam->unregister_work); - - return 0; - } -@@ -792,17 +1154,11 @@ static void steam_client_ll_close(struct hid_device *hdev) - bool connected; - - spin_lock_irqsave(&steam->lock, flags); -- connected = steam->connected; -- spin_unlock_irqrestore(&steam->lock, flags); -- -- mutex_lock(&steam->mutex); - steam->client_opened = false; -- if (connected) -- steam_set_lizard_mode(steam, lizard_mode); -- mutex_unlock(&steam->mutex); -+ connected = steam->connected && !steam->client_opened; -+ spin_unlock_irqrestore(&steam->lock, flags); - -- if (connected) -- steam_input_register(steam); -+ schedule_work(&steam->unregister_work); - } - - static int steam_client_ll_raw_request(struct hid_device *hdev, -@@ -881,26 +1237,20 @@ static int steam_probe(struct hid_device *hdev, - return hid_hw_start(hdev, HID_CONNECT_DEFAULT); - - steam = devm_kzalloc(&hdev->dev, sizeof(*steam), GFP_KERNEL); -- if (!steam) { -- ret = -ENOMEM; -- goto steam_alloc_fail; -- } -+ if (!steam) -+ return -ENOMEM; -+ - steam->hdev = hdev; - hid_set_drvdata(hdev, steam); - spin_lock_init(&steam->lock); -- mutex_init(&steam->mutex); -+ mutex_init(&steam->report_mutex); - steam->quirks = id->driver_data; - INIT_WORK(&steam->work_connect, steam_work_connect_cb); -+ INIT_DELAYED_WORK(&steam->mode_switch, steam_mode_switch_cb); - INIT_LIST_HEAD(&steam->list); -- INIT_DEFERRABLE_WORK(&steam->heartbeat, steam_lizard_mode_heartbeat); - INIT_WORK(&steam->rumble_work, steam_haptic_rumble_cb); -- -- steam->client_hdev = steam_create_client_hid(hdev); -- if (IS_ERR(steam->client_hdev)) { -- ret = PTR_ERR(steam->client_hdev); -- goto client_hdev_fail; -- } -- steam->client_hdev->driver_data = steam; -+ steam->sensor_timestamp_us = 0; -+ INIT_WORK(&steam->unregister_work, steam_work_unregister_cb); - - /* - * With the real steam controller interface, do not connect hidraw. -@@ -908,18 +1258,14 @@ static int steam_probe(struct hid_device *hdev, - */ - ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT & ~HID_CONNECT_HIDRAW); - if (ret) -- goto hid_hw_start_fail; -- -- ret = hid_add_device(steam->client_hdev); -- if (ret) -- goto client_hdev_add_fail; -+ goto err_cancel_work; - - ret = hid_hw_open(hdev); - if (ret) { - hid_err(hdev, - "%s:hid_hw_open\n", - __func__); -- goto hid_hw_open_fail; -+ goto err_hw_stop; - } - - if (steam->quirks & STEAM_QUIRK_WIRELESS) { -@@ -935,25 +1281,38 @@ static int steam_probe(struct hid_device *hdev, - hid_err(hdev, - "%s:steam_register failed with error %d\n", - __func__, ret); -- goto input_register_fail; -+ goto err_hw_close; - } - } - -+ steam->client_hdev = steam_create_client_hid(hdev); -+ if (IS_ERR(steam->client_hdev)) { -+ ret = PTR_ERR(steam->client_hdev); -+ goto err_stream_unregister; -+ } -+ steam->client_hdev->driver_data = steam; -+ -+ ret = hid_add_device(steam->client_hdev); -+ if (ret) -+ goto err_destroy; -+ - return 0; - --input_register_fail: --hid_hw_open_fail: --client_hdev_add_fail: -- hid_hw_stop(hdev); --hid_hw_start_fail: -+err_destroy: - hid_destroy_device(steam->client_hdev); --client_hdev_fail: -+err_stream_unregister: -+ if (steam->connected) -+ steam_unregister(steam); -+err_hw_close: -+ hid_hw_close(hdev); -+err_hw_stop: -+ hid_hw_stop(hdev); -+err_cancel_work: - cancel_work_sync(&steam->work_connect); -- cancel_delayed_work_sync(&steam->heartbeat); -+ cancel_delayed_work_sync(&steam->mode_switch); - cancel_work_sync(&steam->rumble_work); --steam_alloc_fail: -- hid_err(hdev, "%s: failed with error %d\n", -- __func__, ret); -+ cancel_work_sync(&steam->unregister_work); -+ - return ret; - } - -@@ -966,13 +1325,13 @@ static void steam_remove(struct hid_device *hdev) - return; - } - -+ cancel_delayed_work_sync(&steam->mode_switch); -+ cancel_work_sync(&steam->work_connect); -+ cancel_work_sync(&steam->rumble_work); -+ cancel_work_sync(&steam->unregister_work); - hid_destroy_device(steam->client_hdev); -- mutex_lock(&steam->mutex); - steam->client_hdev = NULL; - steam->client_opened = false; -- cancel_delayed_work_sync(&steam->heartbeat); -- mutex_unlock(&steam->mutex); -- cancel_work_sync(&steam->work_connect); - if (steam->quirks & STEAM_QUIRK_WIRELESS) { - hid_info(hdev, "Steam wireless receiver disconnected"); - } -@@ -1154,12 +1513,12 @@ static void steam_do_input_event(struct steam_device *steam, - * 18-19 | s16 | ABS_HAT0Y | left-pad Y value - * 20-21 | s16 | ABS_HAT1X | right-pad X value - * 22-23 | s16 | ABS_HAT1Y | right-pad Y value -- * 24-25 | s16 | -- | accelerometer X value -- * 26-27 | s16 | -- | accelerometer Y value -- * 28-29 | s16 | -- | accelerometer Z value -- * 30-31 | s16 | -- | gyro X value -- * 32-33 | s16 | -- | gyro Y value -- * 34-35 | s16 | -- | gyro Z value -+ * 24-25 | s16 | IMU ABS_X | accelerometer X value -+ * 26-27 | s16 | IMU ABS_Z | accelerometer Y value -+ * 28-29 | s16 | IMU ABS_Y | accelerometer Z value -+ * 30-31 | s16 | IMU ABS_RX | gyro X value -+ * 32-33 | s16 | IMU ABS_RZ | gyro Y value -+ * 34-35 | s16 | IMU ABS_RY | gyro Z value - * 36-37 | s16 | -- | quaternion W value - * 38-39 | s16 | -- | quaternion X value - * 40-41 | s16 | -- | quaternion Y value -@@ -1254,6 +1613,17 @@ static void steam_do_deck_input_event(struct steam_device *steam, - b13 = data[13]; - b14 = data[14]; - -+ if (!(b9 & BIT(6)) && steam->did_mode_switch) { -+ steam->did_mode_switch = false; -+ cancel_delayed_work(&steam->mode_switch); -+ } else if (!steam->client_opened && (b9 & BIT(6)) && !steam->did_mode_switch) { -+ steam->did_mode_switch = true; -+ schedule_delayed_work(&steam->mode_switch, 45 * HZ / 100); -+ } -+ -+ if (!steam->gamepad_mode) -+ return; -+ - lpad_touched = b10 & BIT(3); - rpad_touched = b10 & BIT(4); - -@@ -1309,6 +1679,32 @@ static void steam_do_deck_input_event(struct steam_device *steam, - input_sync(input); - } - -+static void steam_do_deck_sensors_event(struct steam_device *steam, -+ struct input_dev *sensors, u8 *data) -+{ -+ /* -+ * The deck input report is received every 4 ms on average, -+ * with a jitter of +/- 4 ms even though the USB descriptor claims -+ * that it uses 1 kHz. -+ * Since the HID report does not include a sensor timestamp, -+ * use a fixed increment here. -+ */ -+ steam->sensor_timestamp_us += 4000; -+ -+ if (!steam->gamepad_mode) -+ return; -+ -+ input_event(sensors, EV_MSC, MSC_TIMESTAMP, steam->sensor_timestamp_us); -+ input_report_abs(sensors, ABS_X, steam_le16(data + 24)); -+ input_report_abs(sensors, ABS_Z, -steam_le16(data + 26)); -+ input_report_abs(sensors, ABS_Y, steam_le16(data + 28)); -+ input_report_abs(sensors, ABS_RX, steam_le16(data + 30)); -+ input_report_abs(sensors, ABS_RZ, -steam_le16(data + 32)); -+ input_report_abs(sensors, ABS_RY, steam_le16(data + 34)); -+ -+ input_sync(sensors); -+} -+ - /* - * The size for this message payload is 11. - * The known values are: -@@ -1346,6 +1742,7 @@ static int steam_raw_event(struct hid_device *hdev, - { - struct steam_device *steam = hid_get_drvdata(hdev); - struct input_dev *input; -+ struct input_dev *sensors; - struct power_supply *battery; - - if (!steam) -@@ -1375,7 +1772,7 @@ static int steam_raw_event(struct hid_device *hdev, - return 0; - - switch (data[2]) { -- case STEAM_EV_INPUT_DATA: -+ case ID_CONTROLLER_STATE: - if (steam->client_opened) - return 0; - rcu_read_lock(); -@@ -1384,16 +1781,19 @@ static int steam_raw_event(struct hid_device *hdev, - steam_do_input_event(steam, input, data); - rcu_read_unlock(); - break; -- case STEAM_EV_DECK_INPUT_DATA: -+ case ID_CONTROLLER_DECK_STATE: - if (steam->client_opened) - return 0; - rcu_read_lock(); - input = rcu_dereference(steam->input); - if (likely(input)) - steam_do_deck_input_event(steam, input, data); -+ sensors = rcu_dereference(steam->sensors); -+ if (likely(sensors)) -+ steam_do_deck_sensors_event(steam, sensors, data); - rcu_read_unlock(); - break; -- case STEAM_EV_CONNECT: -+ case ID_CONTROLLER_WIRELESS: - /* - * The payload of this event is a single byte: - * 0x01: disconnected. -@@ -1408,7 +1808,7 @@ static int steam_raw_event(struct hid_device *hdev, - break; - } - break; -- case STEAM_EV_BATTERY: -+ case ID_CONTROLLER_STATUS: - if (steam->quirks & STEAM_QUIRK_WIRELESS) { - rcu_read_lock(); - battery = rcu_dereference(steam->battery); -@@ -1439,10 +1839,8 @@ static int steam_param_set_lizard_mode(const char *val, - - mutex_lock(&steam_devices_lock); - list_for_each_entry(steam, &steam_devices, list) { -- mutex_lock(&steam->mutex); - if (!steam->client_opened) - steam_set_lizard_mode(steam, lizard_mode); -- mutex_unlock(&steam->mutex); - } - mutex_unlock(&steam_devices_lock); - return 0; -diff --git a/drivers/hid/hid-thrustmaster.c b/drivers/hid/hid-thrustmaster.c -index 6c3e758bbb09e3..3b81468a1df297 100644 ---- a/drivers/hid/hid-thrustmaster.c -+++ b/drivers/hid/hid-thrustmaster.c -@@ -171,7 +171,7 @@ static void thrustmaster_interrupts(struct hid_device *hdev) - b_ep = ep->desc.bEndpointAddress; - - /* Are the expected endpoints present? */ -- u8 ep_addr[1] = {b_ep}; -+ u8 ep_addr[2] = {b_ep, 0}; - - if (!usb_check_int_endpoints(usbif, ep_addr)) { - hid_err(hdev, "Unexpected non-int endpoint\n"); -diff --git a/drivers/infiniband/hw/efa/efa_main.c b/drivers/infiniband/hw/efa/efa_main.c -index 15ee9208111879..924940ca9de0a0 100644 ---- a/drivers/infiniband/hw/efa/efa_main.c -+++ b/drivers/infiniband/hw/efa/efa_main.c -@@ -452,7 +452,6 @@ static void efa_ib_device_remove(struct efa_dev *dev) - ibdev_info(&dev->ibdev, "Unregister ib device\n"); - ib_unregister_device(&dev->ibdev); - efa_destroy_eqs(dev); -- efa_com_dev_reset(&dev->edev, EFA_REGS_RESET_NORMAL); - efa_release_doorbell_bar(dev); - } - -@@ -623,12 +622,14 @@ static struct efa_dev *efa_probe_device(struct pci_dev *pdev) - return ERR_PTR(err); - } - --static void efa_remove_device(struct pci_dev *pdev) -+static void efa_remove_device(struct pci_dev *pdev, -+ enum efa_regs_reset_reason_types reset_reason) - { - struct efa_dev *dev = pci_get_drvdata(pdev); - struct efa_com_dev *edev; - - edev = &dev->edev; -+ efa_com_dev_reset(edev, reset_reason); - efa_com_admin_destroy(edev); - efa_free_irq(dev, &dev->admin_irq); - efa_disable_msix(dev); -@@ -656,7 +657,7 @@ static int efa_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - return 0; - - err_remove_device: -- efa_remove_device(pdev); -+ efa_remove_device(pdev, EFA_REGS_RESET_INIT_ERR); - return err; - } - -@@ -665,7 +666,7 @@ static void efa_remove(struct pci_dev *pdev) - struct efa_dev *dev = pci_get_drvdata(pdev); - - efa_ib_device_remove(dev); -- efa_remove_device(pdev); -+ efa_remove_device(pdev, EFA_REGS_RESET_NORMAL); - } - - static struct pci_driver efa_pci_driver = { -diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c -index ba63076cd8f2b2..2085b1705f144f 100644 ---- a/drivers/md/md-bitmap.c -+++ b/drivers/md/md-bitmap.c -@@ -1465,22 +1465,12 @@ __acquires(bitmap->lock) - &(bitmap->bp[page].map[pageoff]); - } - --int md_bitmap_startwrite(struct bitmap *bitmap, sector_t offset, unsigned long sectors, int behind) -+int md_bitmap_startwrite(struct bitmap *bitmap, sector_t offset, -+ unsigned long sectors) - { - if (!bitmap) - return 0; - -- if (behind) { -- int bw; -- atomic_inc(&bitmap->behind_writes); -- bw = atomic_read(&bitmap->behind_writes); -- if (bw > bitmap->behind_writes_used) -- bitmap->behind_writes_used = bw; -- -- pr_debug("inc write-behind count %d/%lu\n", -- bw, bitmap->mddev->bitmap_info.max_write_behind); -- } -- - while (sectors) { - sector_t blocks; - bitmap_counter_t *bmc; -@@ -1527,20 +1517,12 @@ int md_bitmap_startwrite(struct bitmap *bitmap, sector_t offset, unsigned long s - } - return 0; - } --EXPORT_SYMBOL(md_bitmap_startwrite); - - void md_bitmap_endwrite(struct bitmap *bitmap, sector_t offset, -- unsigned long sectors, int success, int behind) -+ unsigned long sectors) - { - if (!bitmap) - return; -- if (behind) { -- if (atomic_dec_and_test(&bitmap->behind_writes)) -- wake_up(&bitmap->behind_wait); -- pr_debug("dec write-behind count %d/%lu\n", -- atomic_read(&bitmap->behind_writes), -- bitmap->mddev->bitmap_info.max_write_behind); -- } - - while (sectors) { - sector_t blocks; -@@ -1554,15 +1536,16 @@ void md_bitmap_endwrite(struct bitmap *bitmap, sector_t offset, - return; - } - -- if (success && !bitmap->mddev->degraded && -- bitmap->events_cleared < bitmap->mddev->events) { -- bitmap->events_cleared = bitmap->mddev->events; -- bitmap->need_sync = 1; -- sysfs_notify_dirent_safe(bitmap->sysfs_can_clear); -- } -- -- if (!success && !NEEDED(*bmc)) -+ if (!bitmap->mddev->degraded) { -+ if (bitmap->events_cleared < bitmap->mddev->events) { -+ bitmap->events_cleared = bitmap->mddev->events; -+ bitmap->need_sync = 1; -+ sysfs_notify_dirent_safe( -+ bitmap->sysfs_can_clear); -+ } -+ } else if (!NEEDED(*bmc)) { - *bmc |= NEEDED_MASK; -+ } - - if (COUNTER(*bmc) == COUNTER_MAX) - wake_up(&bitmap->overflow_wait); -@@ -1580,7 +1563,6 @@ void md_bitmap_endwrite(struct bitmap *bitmap, sector_t offset, - sectors = 0; - } - } --EXPORT_SYMBOL(md_bitmap_endwrite); - - static int __bitmap_start_sync(struct bitmap *bitmap, sector_t offset, sector_t *blocks, - int degraded) -@@ -1842,6 +1824,39 @@ void md_bitmap_free(struct bitmap *bitmap) - } - EXPORT_SYMBOL(md_bitmap_free); - -+void md_bitmap_start_behind_write(struct mddev *mddev) -+{ -+ struct bitmap *bitmap = mddev->bitmap; -+ int bw; -+ -+ if (!bitmap) -+ return; -+ -+ atomic_inc(&bitmap->behind_writes); -+ bw = atomic_read(&bitmap->behind_writes); -+ if (bw > bitmap->behind_writes_used) -+ bitmap->behind_writes_used = bw; -+ -+ pr_debug("inc write-behind count %d/%lu\n", -+ bw, bitmap->mddev->bitmap_info.max_write_behind); -+} -+EXPORT_SYMBOL_GPL(md_bitmap_start_behind_write); -+ -+void md_bitmap_end_behind_write(struct mddev *mddev) -+{ -+ struct bitmap *bitmap = mddev->bitmap; -+ -+ if (!bitmap) -+ return; -+ -+ if (atomic_dec_and_test(&bitmap->behind_writes)) -+ wake_up(&bitmap->behind_wait); -+ pr_debug("dec write-behind count %d/%lu\n", -+ atomic_read(&bitmap->behind_writes), -+ bitmap->mddev->bitmap_info.max_write_behind); -+} -+EXPORT_SYMBOL_GPL(md_bitmap_end_behind_write); -+ - void md_bitmap_wait_behind_writes(struct mddev *mddev) - { - struct bitmap *bitmap = mddev->bitmap; -diff --git a/drivers/md/md-bitmap.h b/drivers/md/md-bitmap.h -index bb9eb418780a62..8b89e260a93b71 100644 ---- a/drivers/md/md-bitmap.h -+++ b/drivers/md/md-bitmap.h -@@ -253,9 +253,11 @@ void md_bitmap_dirty_bits(struct bitmap *bitmap, unsigned long s, unsigned long - - /* these are exported */ - int md_bitmap_startwrite(struct bitmap *bitmap, sector_t offset, -- unsigned long sectors, int behind); -+ unsigned long sectors); - void md_bitmap_endwrite(struct bitmap *bitmap, sector_t offset, -- unsigned long sectors, int success, int behind); -+ unsigned long sectors); -+void md_bitmap_start_behind_write(struct mddev *mddev); -+void md_bitmap_end_behind_write(struct mddev *mddev); - int md_bitmap_start_sync(struct bitmap *bitmap, sector_t offset, sector_t *blocks, int degraded); - void md_bitmap_end_sync(struct bitmap *bitmap, sector_t offset, sector_t *blocks, int aborted); - void md_bitmap_close_sync(struct bitmap *bitmap); -diff --git a/drivers/md/md.c b/drivers/md/md.c -index d1f6770c5cc094..9bc19a5a4119bd 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -8713,12 +8713,32 @@ void md_submit_discard_bio(struct mddev *mddev, struct md_rdev *rdev, - } - EXPORT_SYMBOL_GPL(md_submit_discard_bio); - -+static void md_bitmap_start(struct mddev *mddev, -+ struct md_io_clone *md_io_clone) -+{ -+ if (mddev->pers->bitmap_sector) -+ mddev->pers->bitmap_sector(mddev, &md_io_clone->offset, -+ &md_io_clone->sectors); -+ -+ md_bitmap_startwrite(mddev->bitmap, md_io_clone->offset, -+ md_io_clone->sectors); -+} -+ -+static void md_bitmap_end(struct mddev *mddev, struct md_io_clone *md_io_clone) -+{ -+ md_bitmap_endwrite(mddev->bitmap, md_io_clone->offset, -+ md_io_clone->sectors); -+} -+ - static void md_end_clone_io(struct bio *bio) - { - struct md_io_clone *md_io_clone = bio->bi_private; - struct bio *orig_bio = md_io_clone->orig_bio; - struct mddev *mddev = md_io_clone->mddev; - -+ if (bio_data_dir(orig_bio) == WRITE && mddev->bitmap) -+ md_bitmap_end(mddev, md_io_clone); -+ - if (bio->bi_status && !orig_bio->bi_status) - orig_bio->bi_status = bio->bi_status; - -@@ -8743,6 +8763,12 @@ static void md_clone_bio(struct mddev *mddev, struct bio **bio) - if (blk_queue_io_stat(bdev->bd_disk->queue)) - md_io_clone->start_time = bio_start_io_acct(*bio); - -+ if (bio_data_dir(*bio) == WRITE && mddev->bitmap) { -+ md_io_clone->offset = (*bio)->bi_iter.bi_sector; -+ md_io_clone->sectors = bio_sectors(*bio); -+ md_bitmap_start(mddev, md_io_clone); -+ } -+ - clone->bi_end_io = md_end_clone_io; - clone->bi_private = md_io_clone; - *bio = clone; -diff --git a/drivers/md/md.h b/drivers/md/md.h -index 7c9c13abd7cac0..f29fa8650cd0f0 100644 ---- a/drivers/md/md.h -+++ b/drivers/md/md.h -@@ -661,6 +661,9 @@ struct md_personality - void *(*takeover) (struct mddev *mddev); - /* Changes the consistency policy of an active array. */ - int (*change_consistency_policy)(struct mddev *mddev, const char *buf); -+ /* convert io ranges from array to bitmap */ -+ void (*bitmap_sector)(struct mddev *mddev, sector_t *offset, -+ unsigned long *sectors); - }; - - struct md_sysfs_entry { -@@ -743,6 +746,8 @@ struct md_io_clone { - struct mddev *mddev; - struct bio *orig_bio; - unsigned long start_time; -+ sector_t offset; -+ unsigned long sectors; - struct bio bio_clone; - }; - -diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index cc02e7ec72c08c..65309da1dca340 100644 ---- a/drivers/md/raid1.c -+++ b/drivers/md/raid1.c -@@ -419,11 +419,8 @@ static void close_write(struct r1bio *r1_bio) - bio_put(r1_bio->behind_master_bio); - r1_bio->behind_master_bio = NULL; - } -- /* clear the bitmap if all writes complete successfully */ -- md_bitmap_endwrite(r1_bio->mddev->bitmap, r1_bio->sector, -- r1_bio->sectors, -- !test_bit(R1BIO_Degraded, &r1_bio->state), -- test_bit(R1BIO_BehindIO, &r1_bio->state)); -+ if (test_bit(R1BIO_BehindIO, &r1_bio->state)) -+ md_bitmap_end_behind_write(r1_bio->mddev); - md_write_end(r1_bio->mddev); - } - -@@ -480,8 +477,6 @@ static void raid1_end_write_request(struct bio *bio) - if (!test_bit(Faulty, &rdev->flags)) - set_bit(R1BIO_WriteError, &r1_bio->state); - else { -- /* Fail the request */ -- set_bit(R1BIO_Degraded, &r1_bio->state); - /* Finished with this branch */ - r1_bio->bios[mirror] = NULL; - to_put = bio; -@@ -1414,11 +1409,8 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, - break; - } - r1_bio->bios[i] = NULL; -- if (!rdev || test_bit(Faulty, &rdev->flags)) { -- if (i < conf->raid_disks) -- set_bit(R1BIO_Degraded, &r1_bio->state); -+ if (!rdev || test_bit(Faulty, &rdev->flags)) - continue; -- } - - atomic_inc(&rdev->nr_pending); - if (test_bit(WriteErrorSeen, &rdev->flags)) { -@@ -1444,16 +1436,6 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, - */ - max_sectors = bad_sectors; - rdev_dec_pending(rdev, mddev); -- /* We don't set R1BIO_Degraded as that -- * only applies if the disk is -- * missing, so it might be re-added, -- * and we want to know to recover this -- * chunk. -- * In this case the device is here, -- * and the fact that this chunk is not -- * in-sync is recorded in the bad -- * block log -- */ - continue; - } - if (is_bad) { -@@ -1530,8 +1512,8 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, - alloc_behind_master_bio(r1_bio, bio); - } - -- md_bitmap_startwrite(bitmap, r1_bio->sector, r1_bio->sectors, -- test_bit(R1BIO_BehindIO, &r1_bio->state)); -+ if (test_bit(R1BIO_BehindIO, &r1_bio->state)) -+ md_bitmap_start_behind_write(mddev); - first_clone = 0; - } - -@@ -2476,12 +2458,9 @@ static void handle_write_finished(struct r1conf *conf, struct r1bio *r1_bio) - * errors. - */ - fail = true; -- if (!narrow_write_error(r1_bio, m)) { -+ if (!narrow_write_error(r1_bio, m)) - md_error(conf->mddev, - conf->mirrors[m].rdev); -- /* an I/O failed, we can't clear the bitmap */ -- set_bit(R1BIO_Degraded, &r1_bio->state); -- } - rdev_dec_pending(conf->mirrors[m].rdev, - conf->mddev); - } -@@ -2573,8 +2552,6 @@ static void raid1d(struct md_thread *thread) - list_del(&r1_bio->retry_list); - idx = sector_to_idx(r1_bio->sector); - atomic_dec(&conf->nr_queued[idx]); -- if (mddev->degraded) -- set_bit(R1BIO_Degraded, &r1_bio->state); - if (test_bit(R1BIO_WriteError, &r1_bio->state)) - close_write(r1_bio); - raid_end_bio_io(r1_bio); -diff --git a/drivers/md/raid1.h b/drivers/md/raid1.h -index 14d4211a123a8e..44f2390a886690 100644 ---- a/drivers/md/raid1.h -+++ b/drivers/md/raid1.h -@@ -187,7 +187,6 @@ struct r1bio { - enum r1bio_state { - R1BIO_Uptodate, - R1BIO_IsSync, -- R1BIO_Degraded, - R1BIO_BehindIO, - /* Set ReadError on bios that experience a readerror so that - * raid1d knows what to do with them. -diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c -index 02341312085162..c300fd609ef08c 100644 ---- a/drivers/md/raid10.c -+++ b/drivers/md/raid10.c -@@ -427,11 +427,6 @@ static void raid10_end_read_request(struct bio *bio) - - static void close_write(struct r10bio *r10_bio) - { -- /* clear the bitmap if all writes complete successfully */ -- md_bitmap_endwrite(r10_bio->mddev->bitmap, r10_bio->sector, -- r10_bio->sectors, -- !test_bit(R10BIO_Degraded, &r10_bio->state), -- 0); - md_write_end(r10_bio->mddev); - } - -@@ -501,7 +496,6 @@ static void raid10_end_write_request(struct bio *bio) - set_bit(R10BIO_WriteError, &r10_bio->state); - else { - /* Fail the request */ -- set_bit(R10BIO_Degraded, &r10_bio->state); - r10_bio->devs[slot].bio = NULL; - to_put = bio; - dec_rdev = 1; -@@ -1490,10 +1484,8 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio, - r10_bio->devs[i].bio = NULL; - r10_bio->devs[i].repl_bio = NULL; - -- if (!rdev && !rrdev) { -- set_bit(R10BIO_Degraded, &r10_bio->state); -+ if (!rdev && !rrdev) - continue; -- } - if (rdev && test_bit(WriteErrorSeen, &rdev->flags)) { - sector_t first_bad; - sector_t dev_sector = r10_bio->devs[i].addr; -@@ -1510,14 +1502,6 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio, - * to other devices yet - */ - max_sectors = bad_sectors; -- /* We don't set R10BIO_Degraded as that -- * only applies if the disk is missing, -- * so it might be re-added, and we want to -- * know to recover this chunk. -- * In this case the device is here, and the -- * fact that this chunk is not in-sync is -- * recorded in the bad block log. -- */ - continue; - } - if (is_bad) { -@@ -1554,7 +1538,6 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio, - md_account_bio(mddev, &bio); - r10_bio->master_bio = bio; - atomic_set(&r10_bio->remaining, 1); -- md_bitmap_startwrite(mddev->bitmap, r10_bio->sector, r10_bio->sectors, 0); - - for (i = 0; i < conf->copies; i++) { - if (r10_bio->devs[i].bio) -@@ -3063,11 +3046,8 @@ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio) - rdev_dec_pending(rdev, conf->mddev); - } else if (bio != NULL && bio->bi_status) { - fail = true; -- if (!narrow_write_error(r10_bio, m)) { -+ if (!narrow_write_error(r10_bio, m)) - md_error(conf->mddev, rdev); -- set_bit(R10BIO_Degraded, -- &r10_bio->state); -- } - rdev_dec_pending(rdev, conf->mddev); - } - bio = r10_bio->devs[m].repl_bio; -@@ -3126,8 +3106,6 @@ static void raid10d(struct md_thread *thread) - r10_bio = list_first_entry(&tmp, struct r10bio, - retry_list); - list_del(&r10_bio->retry_list); -- if (mddev->degraded) -- set_bit(R10BIO_Degraded, &r10_bio->state); - - if (test_bit(R10BIO_WriteError, - &r10_bio->state)) -diff --git a/drivers/md/raid10.h b/drivers/md/raid10.h -index 2e75e88d08023f..3f16ad6904a9fb 100644 ---- a/drivers/md/raid10.h -+++ b/drivers/md/raid10.h -@@ -161,7 +161,6 @@ enum r10bio_state { - R10BIO_IsSync, - R10BIO_IsRecover, - R10BIO_IsReshape, -- R10BIO_Degraded, - /* Set ReadError on bios that experience a read error - * so that raid10d knows what to do with them. - */ -diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c -index 889bba60d6ff71..53f3718c01ebe1 100644 ---- a/drivers/md/raid5-cache.c -+++ b/drivers/md/raid5-cache.c -@@ -313,10 +313,6 @@ void r5c_handle_cached_data_endio(struct r5conf *conf, - if (sh->dev[i].written) { - set_bit(R5_UPTODATE, &sh->dev[i].flags); - r5c_return_dev_pending_writes(conf, &sh->dev[i]); -- md_bitmap_endwrite(conf->mddev->bitmap, sh->sector, -- RAID5_STRIPE_SECTORS(conf), -- !test_bit(STRIPE_DEGRADED, &sh->state), -- 0); - } - } - } -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index 2c7f11e5766735..f69e4a6a8a5923 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -905,7 +905,6 @@ static bool stripe_can_batch(struct stripe_head *sh) - if (raid5_has_log(conf) || raid5_has_ppl(conf)) - return false; - return test_bit(STRIPE_BATCH_READY, &sh->state) && -- !test_bit(STRIPE_BITMAP_PENDING, &sh->state) && - is_full_stripe_write(sh); - } - -@@ -1359,8 +1358,6 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s) - submit_bio_noacct(rbi); - } - if (!rdev && !rrdev) { -- if (op_is_write(op)) -- set_bit(STRIPE_DEGRADED, &sh->state); - pr_debug("skip op %d on disc %d for sector %llu\n", - bi->bi_opf, i, (unsigned long long)sh->sector); - clear_bit(R5_LOCKED, &sh->dev[i].flags); -@@ -2925,7 +2922,6 @@ static void raid5_end_write_request(struct bio *bi) - set_bit(R5_MadeGoodRepl, &sh->dev[i].flags); - } else { - if (bi->bi_status) { -- set_bit(STRIPE_DEGRADED, &sh->state); - set_bit(WriteErrorSeen, &rdev->flags); - set_bit(R5_WriteError, &sh->dev[i].flags); - if (!test_and_set_bit(WantReplacement, &rdev->flags)) -@@ -3590,29 +3586,9 @@ static void __add_stripe_bio(struct stripe_head *sh, struct bio *bi, - (*bip)->bi_iter.bi_sector, sh->sector, dd_idx, - sh->dev[dd_idx].sector); - -- if (conf->mddev->bitmap && firstwrite) { -- /* Cannot hold spinlock over bitmap_startwrite, -- * but must ensure this isn't added to a batch until -- * we have added to the bitmap and set bm_seq. -- * So set STRIPE_BITMAP_PENDING to prevent -- * batching. -- * If multiple __add_stripe_bio() calls race here they -- * much all set STRIPE_BITMAP_PENDING. So only the first one -- * to complete "bitmap_startwrite" gets to set -- * STRIPE_BIT_DELAY. This is important as once a stripe -- * is added to a batch, STRIPE_BIT_DELAY cannot be changed -- * any more. -- */ -- set_bit(STRIPE_BITMAP_PENDING, &sh->state); -- spin_unlock_irq(&sh->stripe_lock); -- md_bitmap_startwrite(conf->mddev->bitmap, sh->sector, -- RAID5_STRIPE_SECTORS(conf), 0); -- spin_lock_irq(&sh->stripe_lock); -- clear_bit(STRIPE_BITMAP_PENDING, &sh->state); -- if (!sh->batch_head) { -- sh->bm_seq = conf->seq_flush+1; -- set_bit(STRIPE_BIT_DELAY, &sh->state); -- } -+ if (conf->mddev->bitmap && firstwrite && !sh->batch_head) { -+ sh->bm_seq = conf->seq_flush+1; -+ set_bit(STRIPE_BIT_DELAY, &sh->state); - } - } - -@@ -3663,7 +3639,6 @@ handle_failed_stripe(struct r5conf *conf, struct stripe_head *sh, - BUG_ON(sh->batch_head); - for (i = disks; i--; ) { - struct bio *bi; -- int bitmap_end = 0; - - if (test_bit(R5_ReadError, &sh->dev[i].flags)) { - struct md_rdev *rdev; -@@ -3690,8 +3665,6 @@ handle_failed_stripe(struct r5conf *conf, struct stripe_head *sh, - sh->dev[i].towrite = NULL; - sh->overwrite_disks = 0; - spin_unlock_irq(&sh->stripe_lock); -- if (bi) -- bitmap_end = 1; - - log_stripe_write_finished(sh); - -@@ -3706,10 +3679,6 @@ handle_failed_stripe(struct r5conf *conf, struct stripe_head *sh, - bio_io_error(bi); - bi = nextbi; - } -- if (bitmap_end) -- md_bitmap_endwrite(conf->mddev->bitmap, sh->sector, -- RAID5_STRIPE_SECTORS(conf), 0, 0); -- bitmap_end = 0; - /* and fail all 'written' */ - bi = sh->dev[i].written; - sh->dev[i].written = NULL; -@@ -3718,7 +3687,6 @@ handle_failed_stripe(struct r5conf *conf, struct stripe_head *sh, - sh->dev[i].page = sh->dev[i].orig_page; - } - -- if (bi) bitmap_end = 1; - while (bi && bi->bi_iter.bi_sector < - sh->dev[i].sector + RAID5_STRIPE_SECTORS(conf)) { - struct bio *bi2 = r5_next_bio(conf, bi, sh->dev[i].sector); -@@ -3752,9 +3720,6 @@ handle_failed_stripe(struct r5conf *conf, struct stripe_head *sh, - bi = nextbi; - } - } -- if (bitmap_end) -- md_bitmap_endwrite(conf->mddev->bitmap, sh->sector, -- RAID5_STRIPE_SECTORS(conf), 0, 0); - /* If we were in the middle of a write the parity block might - * still be locked - so just clear all R5_LOCKED flags - */ -@@ -4105,10 +4070,7 @@ static void handle_stripe_clean_event(struct r5conf *conf, - bio_endio(wbi); - wbi = wbi2; - } -- md_bitmap_endwrite(conf->mddev->bitmap, sh->sector, -- RAID5_STRIPE_SECTORS(conf), -- !test_bit(STRIPE_DEGRADED, &sh->state), -- 0); -+ - if (head_sh->batch_head) { - sh = list_first_entry(&sh->batch_list, - struct stripe_head, -@@ -4385,7 +4347,6 @@ static void handle_parity_checks5(struct r5conf *conf, struct stripe_head *sh, - s->locked++; - set_bit(R5_Wantwrite, &dev->flags); - -- clear_bit(STRIPE_DEGRADED, &sh->state); - set_bit(STRIPE_INSYNC, &sh->state); - break; - case check_state_run: -@@ -4542,7 +4503,6 @@ static void handle_parity_checks6(struct r5conf *conf, struct stripe_head *sh, - clear_bit(R5_Wantwrite, &dev->flags); - s->locked--; - } -- clear_bit(STRIPE_DEGRADED, &sh->state); - - set_bit(STRIPE_INSYNC, &sh->state); - break; -@@ -4942,8 +4902,7 @@ static void break_stripe_batch_list(struct stripe_head *head_sh, - (1 << STRIPE_COMPUTE_RUN) | - (1 << STRIPE_DISCARD) | - (1 << STRIPE_BATCH_READY) | -- (1 << STRIPE_BATCH_ERR) | -- (1 << STRIPE_BITMAP_PENDING)), -+ (1 << STRIPE_BATCH_ERR)), - "stripe state: %lx\n", sh->state); - WARN_ONCE(head_sh->state & ((1 << STRIPE_DISCARD) | - (1 << STRIPE_REPLACED)), -@@ -4951,7 +4910,6 @@ static void break_stripe_batch_list(struct stripe_head *head_sh, - - set_mask_bits(&sh->state, ~(STRIPE_EXPAND_SYNC_FLAGS | - (1 << STRIPE_PREREAD_ACTIVE) | -- (1 << STRIPE_DEGRADED) | - (1 << STRIPE_ON_UNPLUG_LIST)), - head_sh->state & (1 << STRIPE_INSYNC)); - -@@ -5848,13 +5806,6 @@ static void make_discard_request(struct mddev *mddev, struct bio *bi) - } - spin_unlock_irq(&sh->stripe_lock); - if (conf->mddev->bitmap) { -- for (d = 0; -- d < conf->raid_disks - conf->max_degraded; -- d++) -- md_bitmap_startwrite(mddev->bitmap, -- sh->sector, -- RAID5_STRIPE_SECTORS(conf), -- 0); - sh->bm_seq = conf->seq_flush + 1; - set_bit(STRIPE_BIT_DELAY, &sh->state); - } -@@ -5972,6 +5923,87 @@ static bool reshape_disabled(struct mddev *mddev) - return is_md_suspended(mddev) || !md_is_rdwr(mddev); - } - -+enum reshape_loc { -+ LOC_NO_RESHAPE, -+ LOC_AHEAD_OF_RESHAPE, -+ LOC_INSIDE_RESHAPE, -+ LOC_BEHIND_RESHAPE, -+}; -+ -+static enum reshape_loc get_reshape_loc(struct mddev *mddev, -+ struct r5conf *conf, sector_t logical_sector) -+{ -+ sector_t reshape_progress, reshape_safe; -+ /* -+ * Spinlock is needed as reshape_progress may be -+ * 64bit on a 32bit platform, and so it might be -+ * possible to see a half-updated value -+ * Of course reshape_progress could change after -+ * the lock is dropped, so once we get a reference -+ * to the stripe that we think it is, we will have -+ * to check again. -+ */ -+ spin_lock_irq(&conf->device_lock); -+ reshape_progress = conf->reshape_progress; -+ reshape_safe = conf->reshape_safe; -+ spin_unlock_irq(&conf->device_lock); -+ if (reshape_progress == MaxSector) -+ return LOC_NO_RESHAPE; -+ if (ahead_of_reshape(mddev, logical_sector, reshape_progress)) -+ return LOC_AHEAD_OF_RESHAPE; -+ if (ahead_of_reshape(mddev, logical_sector, reshape_safe)) -+ return LOC_INSIDE_RESHAPE; -+ return LOC_BEHIND_RESHAPE; -+} -+ -+static void raid5_bitmap_sector(struct mddev *mddev, sector_t *offset, -+ unsigned long *sectors) -+{ -+ struct r5conf *conf = mddev->private; -+ sector_t start = *offset; -+ sector_t end = start + *sectors; -+ sector_t prev_start = start; -+ sector_t prev_end = end; -+ int sectors_per_chunk; -+ enum reshape_loc loc; -+ int dd_idx; -+ -+ sectors_per_chunk = conf->chunk_sectors * -+ (conf->raid_disks - conf->max_degraded); -+ start = round_down(start, sectors_per_chunk); -+ end = round_up(end, sectors_per_chunk); -+ -+ start = raid5_compute_sector(conf, start, 0, &dd_idx, NULL); -+ end = raid5_compute_sector(conf, end, 0, &dd_idx, NULL); -+ -+ /* -+ * For LOC_INSIDE_RESHAPE, this IO will wait for reshape to make -+ * progress, hence it's the same as LOC_BEHIND_RESHAPE. -+ */ -+ loc = get_reshape_loc(mddev, conf, prev_start); -+ if (likely(loc != LOC_AHEAD_OF_RESHAPE)) { -+ *offset = start; -+ *sectors = end - start; -+ return; -+ } -+ -+ sectors_per_chunk = conf->prev_chunk_sectors * -+ (conf->previous_raid_disks - conf->max_degraded); -+ prev_start = round_down(prev_start, sectors_per_chunk); -+ prev_end = round_down(prev_end, sectors_per_chunk); -+ -+ prev_start = raid5_compute_sector(conf, prev_start, 1, &dd_idx, NULL); -+ prev_end = raid5_compute_sector(conf, prev_end, 1, &dd_idx, NULL); -+ -+ /* -+ * for LOC_AHEAD_OF_RESHAPE, reshape can make progress before this IO -+ * is handled in make_stripe_request(), we can't know this here hence -+ * we set bits for both. -+ */ -+ *offset = min(start, prev_start); -+ *sectors = max(end, prev_end) - *offset; -+} -+ - static enum stripe_result make_stripe_request(struct mddev *mddev, - struct r5conf *conf, struct stripe_request_ctx *ctx, - sector_t logical_sector, struct bio *bi) -@@ -5986,28 +6018,14 @@ static enum stripe_result make_stripe_request(struct mddev *mddev, - seq = read_seqcount_begin(&conf->gen_lock); - - if (unlikely(conf->reshape_progress != MaxSector)) { -- /* -- * Spinlock is needed as reshape_progress may be -- * 64bit on a 32bit platform, and so it might be -- * possible to see a half-updated value -- * Of course reshape_progress could change after -- * the lock is dropped, so once we get a reference -- * to the stripe that we think it is, we will have -- * to check again. -- */ -- spin_lock_irq(&conf->device_lock); -- if (ahead_of_reshape(mddev, logical_sector, -- conf->reshape_progress)) { -- previous = 1; -- } else { -- if (ahead_of_reshape(mddev, logical_sector, -- conf->reshape_safe)) { -- spin_unlock_irq(&conf->device_lock); -- ret = STRIPE_SCHEDULE_AND_RETRY; -- goto out; -- } -+ enum reshape_loc loc = get_reshape_loc(mddev, conf, -+ logical_sector); -+ if (loc == LOC_INSIDE_RESHAPE) { -+ ret = STRIPE_SCHEDULE_AND_RETRY; -+ goto out; - } -- spin_unlock_irq(&conf->device_lock); -+ if (loc == LOC_AHEAD_OF_RESHAPE) -+ previous = 1; - } - - new_sector = raid5_compute_sector(conf, logical_sector, previous, -@@ -6189,8 +6207,7 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) - /* Bail out if conflicts with reshape and REQ_NOWAIT is set */ - if ((bi->bi_opf & REQ_NOWAIT) && - (conf->reshape_progress != MaxSector) && -- !ahead_of_reshape(mddev, logical_sector, conf->reshape_progress) && -- ahead_of_reshape(mddev, logical_sector, conf->reshape_safe)) { -+ get_reshape_loc(mddev, conf, logical_sector) == LOC_INSIDE_RESHAPE) { - bio_wouldblock_error(bi); - if (rw == WRITE) - md_write_end(mddev); -@@ -9090,6 +9107,7 @@ static struct md_personality raid6_personality = - .quiesce = raid5_quiesce, - .takeover = raid6_takeover, - .change_consistency_policy = raid5_change_consistency_policy, -+ .bitmap_sector = raid5_bitmap_sector, - }; - static struct md_personality raid5_personality = - { -@@ -9115,6 +9133,7 @@ static struct md_personality raid5_personality = - .quiesce = raid5_quiesce, - .takeover = raid5_takeover, - .change_consistency_policy = raid5_change_consistency_policy, -+ .bitmap_sector = raid5_bitmap_sector, - }; - - static struct md_personality raid4_personality = -@@ -9141,6 +9160,7 @@ static struct md_personality raid4_personality = - .quiesce = raid5_quiesce, - .takeover = raid4_takeover, - .change_consistency_policy = raid5_change_consistency_policy, -+ .bitmap_sector = raid5_bitmap_sector, - }; - - static int __init raid5_init(void) -diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h -index 97a795979a3502..fd617155388000 100644 ---- a/drivers/md/raid5.h -+++ b/drivers/md/raid5.h -@@ -358,7 +358,6 @@ enum { - STRIPE_REPLACED, - STRIPE_PREREAD_ACTIVE, - STRIPE_DELAYED, -- STRIPE_DEGRADED, - STRIPE_BIT_DELAY, - STRIPE_EXPANDING, - STRIPE_EXPAND_SOURCE, -@@ -372,9 +371,6 @@ enum { - STRIPE_ON_RELEASE_LIST, - STRIPE_BATCH_READY, - STRIPE_BATCH_ERR, -- STRIPE_BITMAP_PENDING, /* Being added to bitmap, don't add -- * to batch yet. -- */ - STRIPE_LOG_TRAPPED, /* trapped into log (see raid5-cache.c) - * this bit is used in two scenarios: - * -diff --git a/drivers/media/dvb-frontends/cxd2841er.c b/drivers/media/dvb-frontends/cxd2841er.c -index d925ca24183b50..415f1f91cc3072 100644 ---- a/drivers/media/dvb-frontends/cxd2841er.c -+++ b/drivers/media/dvb-frontends/cxd2841er.c -@@ -311,12 +311,8 @@ static int cxd2841er_set_reg_bits(struct cxd2841er_priv *priv, - - static u32 cxd2841er_calc_iffreq_xtal(enum cxd2841er_xtal xtal, u32 ifhz) - { -- u64 tmp; -- -- tmp = (u64) ifhz * 16777216; -- do_div(tmp, ((xtal == SONY_XTAL_24000) ? 48000000 : 41000000)); -- -- return (u32) tmp; -+ return div_u64(ifhz * 16777216ull, -+ (xtal == SONY_XTAL_24000) ? 48000000 : 41000000); - } - - static u32 cxd2841er_calc_iffreq(u32 ifhz) -diff --git a/drivers/media/i2c/ds90ub913.c b/drivers/media/i2c/ds90ub913.c -index 5a650facae4153..ae33d1ecf835df 100644 ---- a/drivers/media/i2c/ds90ub913.c -+++ b/drivers/media/i2c/ds90ub913.c -@@ -8,6 +8,7 @@ - * Copyright (c) 2023 Tomi Valkeinen - */ - -+#include - #include - #include - #include -@@ -146,6 +147,19 @@ static int ub913_write(const struct ub913_data *priv, u8 reg, u8 val) - return ret; - } - -+static int ub913_update_bits(const struct ub913_data *priv, u8 reg, u8 mask, -+ u8 val) -+{ -+ int ret; -+ -+ ret = regmap_update_bits(priv->regmap, reg, mask, val); -+ if (ret < 0) -+ dev_err(&priv->client->dev, -+ "Cannot update register 0x%02x %d!\n", reg, ret); -+ -+ return ret; -+} -+ - /* - * GPIO chip - */ -@@ -733,10 +747,13 @@ static int ub913_hw_init(struct ub913_data *priv) - if (ret) - return dev_err_probe(dev, ret, "i2c master init failed\n"); - -- ub913_read(priv, UB913_REG_GENERAL_CFG, &v); -- v &= ~UB913_REG_GENERAL_CFG_PCLK_RISING; -- v |= priv->pclk_polarity_rising ? UB913_REG_GENERAL_CFG_PCLK_RISING : 0; -- ub913_write(priv, UB913_REG_GENERAL_CFG, v); -+ ret = ub913_update_bits(priv, UB913_REG_GENERAL_CFG, -+ UB913_REG_GENERAL_CFG_PCLK_RISING, -+ FIELD_PREP(UB913_REG_GENERAL_CFG_PCLK_RISING, -+ priv->pclk_polarity_rising)); -+ -+ if (ret) -+ return ret; - - return 0; - } -diff --git a/drivers/media/i2c/ds90ub953.c b/drivers/media/i2c/ds90ub953.c -index 1dd29137d2d9f2..007c95ac34d931 100644 ---- a/drivers/media/i2c/ds90ub953.c -+++ b/drivers/media/i2c/ds90ub953.c -@@ -398,8 +398,13 @@ static int ub953_gpiochip_probe(struct ub953_data *priv) - int ret; - - /* Set all GPIOs to local input mode */ -- ub953_write(priv, UB953_REG_LOCAL_GPIO_DATA, 0); -- ub953_write(priv, UB953_REG_GPIO_INPUT_CTRL, 0xf); -+ ret = ub953_write(priv, UB953_REG_LOCAL_GPIO_DATA, 0); -+ if (ret) -+ return ret; -+ -+ ret = ub953_write(priv, UB953_REG_GPIO_INPUT_CTRL, 0xf); -+ if (ret) -+ return ret; - - gc->label = dev_name(dev); - gc->parent = dev; -@@ -961,10 +966,11 @@ static void ub953_calc_clkout_params(struct ub953_data *priv, - clkout_data->rate = clkout_rate; - } - --static void ub953_write_clkout_regs(struct ub953_data *priv, -- const struct ub953_clkout_data *clkout_data) -+static int ub953_write_clkout_regs(struct ub953_data *priv, -+ const struct ub953_clkout_data *clkout_data) - { - u8 clkout_ctrl0, clkout_ctrl1; -+ int ret; - - if (priv->hw_data->is_ub971) - clkout_ctrl0 = clkout_data->m; -@@ -974,8 +980,15 @@ static void ub953_write_clkout_regs(struct ub953_data *priv, - - clkout_ctrl1 = clkout_data->n; - -- ub953_write(priv, UB953_REG_CLKOUT_CTRL0, clkout_ctrl0); -- ub953_write(priv, UB953_REG_CLKOUT_CTRL1, clkout_ctrl1); -+ ret = ub953_write(priv, UB953_REG_CLKOUT_CTRL0, clkout_ctrl0); -+ if (ret) -+ return ret; -+ -+ ret = ub953_write(priv, UB953_REG_CLKOUT_CTRL1, clkout_ctrl1); -+ if (ret) -+ return ret; -+ -+ return 0; - } - - static unsigned long ub953_clkout_recalc_rate(struct clk_hw *hw, -@@ -1055,9 +1068,7 @@ static int ub953_clkout_set_rate(struct clk_hw *hw, unsigned long rate, - dev_dbg(&priv->client->dev, "%s %lu (requested %lu)\n", __func__, - clkout_data.rate, rate); - -- ub953_write_clkout_regs(priv, &clkout_data); -- -- return 0; -+ return ub953_write_clkout_regs(priv, &clkout_data); - } - - static const struct clk_ops ub953_clkout_ops = { -@@ -1082,7 +1093,9 @@ static int ub953_register_clkout(struct ub953_data *priv) - - /* Initialize clkout to 25MHz by default */ - ub953_calc_clkout_params(priv, UB953_DEFAULT_CLKOUT_RATE, &clkout_data); -- ub953_write_clkout_regs(priv, &clkout_data); -+ ret = ub953_write_clkout_regs(priv, &clkout_data); -+ if (ret) -+ return ret; - - priv->clkout_clk_hw.init = &init; - -@@ -1229,10 +1242,15 @@ static int ub953_hw_init(struct ub953_data *priv) - if (ret) - return dev_err_probe(dev, ret, "i2c init failed\n"); - -- ub953_write(priv, UB953_REG_GENERAL_CFG, -- (priv->non_continous_clk ? 0 : UB953_REG_GENERAL_CFG_CONT_CLK) | -- ((priv->num_data_lanes - 1) << UB953_REG_GENERAL_CFG_CSI_LANE_SEL_SHIFT) | -- UB953_REG_GENERAL_CFG_CRC_TX_GEN_ENABLE); -+ v = 0; -+ v |= priv->non_continous_clk ? 0 : UB953_REG_GENERAL_CFG_CONT_CLK; -+ v |= (priv->num_data_lanes - 1) << -+ UB953_REG_GENERAL_CFG_CSI_LANE_SEL_SHIFT; -+ v |= UB953_REG_GENERAL_CFG_CRC_TX_GEN_ENABLE; -+ -+ ret = ub953_write(priv, UB953_REG_GENERAL_CFG, v); -+ if (ret) -+ return ret; - - return 0; - } -diff --git a/drivers/media/test-drivers/vidtv/vidtv_bridge.c b/drivers/media/test-drivers/vidtv/vidtv_bridge.c -index 8b04e12af286cc..6e030584d598a7 100644 ---- a/drivers/media/test-drivers/vidtv/vidtv_bridge.c -+++ b/drivers/media/test-drivers/vidtv/vidtv_bridge.c -@@ -191,10 +191,11 @@ static int vidtv_start_streaming(struct vidtv_dvb *dvb) - - mux_args.mux_buf_sz = mux_buf_sz; - -- dvb->streaming = true; - dvb->mux = vidtv_mux_init(dvb->fe[0], dev, &mux_args); - if (!dvb->mux) - return -ENOMEM; -+ -+ dvb->streaming = true; - vidtv_mux_start_thread(dvb->mux); - - dev_dbg_ratelimited(dev, "Started streaming\n"); -@@ -205,6 +206,11 @@ static int vidtv_stop_streaming(struct vidtv_dvb *dvb) - { - struct device *dev = &dvb->pdev->dev; - -+ if (!dvb->streaming) { -+ dev_warn_ratelimited(dev, "No streaming. Skipping.\n"); -+ return 0; -+ } -+ - dvb->streaming = false; - vidtv_mux_stop_thread(dvb->mux); - vidtv_mux_destroy(dvb->mux); -diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c -index 95c5b90f3e7c11..ae2e8bd2b3f73d 100644 ---- a/drivers/media/usb/uvc/uvc_driver.c -+++ b/drivers/media/usb/uvc/uvc_driver.c -@@ -2886,6 +2886,15 @@ static const struct usb_device_id uvc_ids[] = { - .bInterfaceSubClass = 1, - .bInterfaceProtocol = 0, - .driver_info = (kernel_ulong_t)&uvc_quirk_probe_minmax }, -+ /* Sonix Technology Co. Ltd. - 292A IPC AR0330 */ -+ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE -+ | USB_DEVICE_ID_MATCH_INT_INFO, -+ .idVendor = 0x0c45, -+ .idProduct = 0x6366, -+ .bInterfaceClass = USB_CLASS_VIDEO, -+ .bInterfaceSubClass = 1, -+ .bInterfaceProtocol = 0, -+ .driver_info = UVC_INFO_QUIRK(UVC_QUIRK_MJPEG_NO_EOF) }, - /* MT6227 */ - { .match_flags = USB_DEVICE_ID_MATCH_DEVICE - | USB_DEVICE_ID_MATCH_INT_INFO, -@@ -2914,6 +2923,15 @@ static const struct usb_device_id uvc_ids[] = { - .bInterfaceSubClass = 1, - .bInterfaceProtocol = 0, - .driver_info = (kernel_ulong_t)&uvc_quirk_probe_minmax }, -+ /* Kurokesu C1 PRO */ -+ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE -+ | USB_DEVICE_ID_MATCH_INT_INFO, -+ .idVendor = 0x16d0, -+ .idProduct = 0x0ed1, -+ .bInterfaceClass = USB_CLASS_VIDEO, -+ .bInterfaceSubClass = 1, -+ .bInterfaceProtocol = 0, -+ .driver_info = UVC_INFO_QUIRK(UVC_QUIRK_MJPEG_NO_EOF) }, - /* Syntek (HP Spartan) */ - { .match_flags = USB_DEVICE_ID_MATCH_DEVICE - | USB_DEVICE_ID_MATCH_INT_INFO, -diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c -index a2504e1e991b93..9572fdfe74f246 100644 ---- a/drivers/media/usb/uvc/uvc_video.c -+++ b/drivers/media/usb/uvc/uvc_video.c -@@ -20,6 +20,7 @@ - #include - #include - -+#include - #include - - #include "uvcvideo.h" -@@ -1114,6 +1115,7 @@ static void uvc_video_stats_stop(struct uvc_streaming *stream) - static int uvc_video_decode_start(struct uvc_streaming *stream, - struct uvc_buffer *buf, const u8 *data, int len) - { -+ u8 header_len; - u8 fid; - - /* -@@ -1127,6 +1129,7 @@ static int uvc_video_decode_start(struct uvc_streaming *stream, - return -EINVAL; - } - -+ header_len = data[0]; - fid = data[1] & UVC_STREAM_FID; - - /* -@@ -1208,9 +1211,31 @@ static int uvc_video_decode_start(struct uvc_streaming *stream, - return -EAGAIN; - } - -+ /* -+ * Some cameras, when running two parallel streams (one MJPEG alongside -+ * another non-MJPEG stream), are known to lose the EOF packet for a frame. -+ * We can detect the end of a frame by checking for a new SOI marker, as -+ * the SOI always lies on the packet boundary between two frames for -+ * these devices. -+ */ -+ if (stream->dev->quirks & UVC_QUIRK_MJPEG_NO_EOF && -+ (stream->cur_format->fcc == V4L2_PIX_FMT_MJPEG || -+ stream->cur_format->fcc == V4L2_PIX_FMT_JPEG)) { -+ const u8 *packet = data + header_len; -+ -+ if (len >= header_len + 2 && -+ packet[0] == 0xff && packet[1] == JPEG_MARKER_SOI && -+ buf->bytesused != 0) { -+ buf->state = UVC_BUF_STATE_READY; -+ buf->error = 1; -+ stream->last_fid ^= UVC_STREAM_FID; -+ return -EAGAIN; -+ } -+ } -+ - stream->last_fid = fid; - -- return data[0]; -+ return header_len; - } - - static inline enum dma_data_direction uvc_stream_dir( -diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h -index 997f4b5b5e22ac..30fd056b2aec9d 100644 ---- a/drivers/media/usb/uvc/uvcvideo.h -+++ b/drivers/media/usb/uvc/uvcvideo.h -@@ -76,6 +76,7 @@ - #define UVC_QUIRK_NO_RESET_RESUME 0x00004000 - #define UVC_QUIRK_DISABLE_AUTOSUSPEND 0x00008000 - #define UVC_QUIRK_INVALID_DEVICE_SOF 0x00010000 -+#define UVC_QUIRK_MJPEG_NO_EOF 0x00020000 - - /* Format flags */ - #define UVC_FMT_FLAG_COMPRESSED 0x00000001 -diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c -index 4f4b7607eaa9b1..02f3748e46c144 100644 ---- a/drivers/mmc/host/mtk-sd.c -+++ b/drivers/mmc/host/mtk-sd.c -@@ -260,6 +260,7 @@ - #define MSDC_PAD_TUNE_CMD_SEL BIT(21) /* RW */ - - #define PAD_DS_TUNE_DLY_SEL BIT(0) /* RW */ -+#define PAD_DS_TUNE_DLY2_SEL BIT(1) /* RW */ - #define PAD_DS_TUNE_DLY1 GENMASK(6, 2) /* RW */ - #define PAD_DS_TUNE_DLY2 GENMASK(11, 7) /* RW */ - #define PAD_DS_TUNE_DLY3 GENMASK(16, 12) /* RW */ -@@ -305,6 +306,7 @@ - - /* EMMC50_PAD_DS_TUNE mask */ - #define PAD_DS_DLY_SEL BIT(16) /* RW */ -+#define PAD_DS_DLY2_SEL BIT(15) /* RW */ - #define PAD_DS_DLY1 GENMASK(14, 10) /* RW */ - #define PAD_DS_DLY3 GENMASK(4, 0) /* RW */ - -@@ -2309,13 +2311,23 @@ static int msdc_execute_tuning(struct mmc_host *mmc, u32 opcode) - static int msdc_prepare_hs400_tuning(struct mmc_host *mmc, struct mmc_ios *ios) - { - struct msdc_host *host = mmc_priv(mmc); -+ - host->hs400_mode = true; - -- if (host->top_base) -- writel(host->hs400_ds_delay, -- host->top_base + EMMC50_PAD_DS_TUNE); -- else -- writel(host->hs400_ds_delay, host->base + PAD_DS_TUNE); -+ if (host->top_base) { -+ if (host->hs400_ds_dly3) -+ sdr_set_field(host->top_base + EMMC50_PAD_DS_TUNE, -+ PAD_DS_DLY3, host->hs400_ds_dly3); -+ if (host->hs400_ds_delay) -+ writel(host->hs400_ds_delay, -+ host->top_base + EMMC50_PAD_DS_TUNE); -+ } else { -+ if (host->hs400_ds_dly3) -+ sdr_set_field(host->base + PAD_DS_TUNE, -+ PAD_DS_TUNE_DLY3, host->hs400_ds_dly3); -+ if (host->hs400_ds_delay) -+ writel(host->hs400_ds_delay, host->base + PAD_DS_TUNE); -+ } - /* hs400 mode must set it to 0 */ - sdr_clr_bits(host->base + MSDC_PATCH_BIT2, MSDC_PATCH_BIT2_CFGCRCSTS); - /* to improve read performance, set outstanding to 2 */ -@@ -2335,14 +2347,11 @@ static int msdc_execute_hs400_tuning(struct mmc_host *mmc, struct mmc_card *card - if (host->top_base) { - sdr_set_bits(host->top_base + EMMC50_PAD_DS_TUNE, - PAD_DS_DLY_SEL); -- if (host->hs400_ds_dly3) -- sdr_set_field(host->top_base + EMMC50_PAD_DS_TUNE, -- PAD_DS_DLY3, host->hs400_ds_dly3); -+ sdr_clr_bits(host->top_base + EMMC50_PAD_DS_TUNE, -+ PAD_DS_DLY2_SEL); - } else { - sdr_set_bits(host->base + PAD_DS_TUNE, PAD_DS_TUNE_DLY_SEL); -- if (host->hs400_ds_dly3) -- sdr_set_field(host->base + PAD_DS_TUNE, -- PAD_DS_TUNE_DLY3, host->hs400_ds_dly3); -+ sdr_clr_bits(host->base + PAD_DS_TUNE, PAD_DS_TUNE_DLY2_SEL); - } - - host->hs400_tuning = true; -diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c -index f44ba2600415f6..7f405bcf11c23e 100644 ---- a/drivers/net/can/c_can/c_can_platform.c -+++ b/drivers/net/can/c_can/c_can_platform.c -@@ -394,15 +394,16 @@ static int c_can_plat_probe(struct platform_device *pdev) - if (ret) { - dev_err(&pdev->dev, "registering %s failed (err=%d)\n", - KBUILD_MODNAME, ret); -- goto exit_free_device; -+ goto exit_pm_runtime; - } - - dev_info(&pdev->dev, "%s device registered (regs=%p, irq=%d)\n", - KBUILD_MODNAME, priv->base, dev->irq); - return 0; - --exit_free_device: -+exit_pm_runtime: - pm_runtime_disable(priv->device); -+exit_free_device: - free_c_can_dev(dev); - exit: - dev_err(&pdev->dev, "probe failed\n"); -diff --git a/drivers/net/can/ctucanfd/ctucanfd_base.c b/drivers/net/can/ctucanfd/ctucanfd_base.c -index 64c349fd46007f..f65c1a1e05ccdf 100644 ---- a/drivers/net/can/ctucanfd/ctucanfd_base.c -+++ b/drivers/net/can/ctucanfd/ctucanfd_base.c -@@ -867,10 +867,12 @@ static void ctucan_err_interrupt(struct net_device *ndev, u32 isr) - } - break; - case CAN_STATE_ERROR_ACTIVE: -- cf->can_id |= CAN_ERR_CNT; -- cf->data[1] = CAN_ERR_CRTL_ACTIVE; -- cf->data[6] = bec.txerr; -- cf->data[7] = bec.rxerr; -+ if (skb) { -+ cf->can_id |= CAN_ERR_CNT; -+ cf->data[1] = CAN_ERR_CRTL_ACTIVE; -+ cf->data[6] = bec.txerr; -+ cf->data[7] = bec.rxerr; -+ } - break; - default: - netdev_warn(ndev, "unhandled error state (%d:%s)!\n", -diff --git a/drivers/net/can/usb/etas_es58x/es58x_devlink.c b/drivers/net/can/usb/etas_es58x/es58x_devlink.c -index 635edeb8f68cdf..e763a9904bedd0 100644 ---- a/drivers/net/can/usb/etas_es58x/es58x_devlink.c -+++ b/drivers/net/can/usb/etas_es58x/es58x_devlink.c -@@ -248,7 +248,11 @@ static int es58x_devlink_info_get(struct devlink *devlink, - return ret; - } - -- return devlink_info_serial_number_put(req, es58x_dev->udev->serial); -+ if (es58x_dev->udev->serial) -+ ret = devlink_info_serial_number_put(req, -+ es58x_dev->udev->serial); -+ -+ return ret; - } - - const struct devlink_ops es58x_dl_ops = { -diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c -index 91a4722460f66a..ae93b45cf55e8e 100644 ---- a/drivers/net/ethernet/intel/igc/igc_main.c -+++ b/drivers/net/ethernet/intel/igc/igc_main.c -@@ -1096,6 +1096,7 @@ static int igc_init_empty_frame(struct igc_ring *ring, - return -ENOMEM; - } - -+ buffer->type = IGC_TX_BUFFER_TYPE_SKB; - buffer->skb = skb; - buffer->protocol = 0; - buffer->bytecount = skb->len; -diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ethtool.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ethtool.c -index 472830d07ac12e..13b5281d676b45 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ethtool.c -@@ -768,7 +768,9 @@ static void __mlxsw_sp_port_get_stats(struct net_device *dev, - err = mlxsw_sp_get_hw_stats_by_group(&hw_stats, &len, grp); - if (err) - return; -- mlxsw_sp_port_get_stats_raw(dev, grp, prio, ppcnt_pl); -+ err = mlxsw_sp_port_get_stats_raw(dev, grp, prio, ppcnt_pl); -+ if (err) -+ return; - for (i = 0; i < len; i++) { - data[data_index + i] = hw_stats[i].getter(ppcnt_pl); - if (!hw_stats[i].cells_bytes) -diff --git a/drivers/net/netdevsim/ipsec.c b/drivers/net/netdevsim/ipsec.c -index 3612b0633bd177..88187dd4eb2d40 100644 ---- a/drivers/net/netdevsim/ipsec.c -+++ b/drivers/net/netdevsim/ipsec.c -@@ -39,10 +39,14 @@ static ssize_t nsim_dbg_netdev_ops_read(struct file *filp, - if (!sap->used) - continue; - -- p += scnprintf(p, bufsize - (p - buf), -- "sa[%i] %cx ipaddr=0x%08x %08x %08x %08x\n", -- i, (sap->rx ? 'r' : 't'), sap->ipaddr[0], -- sap->ipaddr[1], sap->ipaddr[2], sap->ipaddr[3]); -+ if (sap->xs->props.family == AF_INET6) -+ p += scnprintf(p, bufsize - (p - buf), -+ "sa[%i] %cx ipaddr=%pI6c\n", -+ i, (sap->rx ? 'r' : 't'), &sap->ipaddr); -+ else -+ p += scnprintf(p, bufsize - (p - buf), -+ "sa[%i] %cx ipaddr=%pI4\n", -+ i, (sap->rx ? 'r' : 't'), &sap->ipaddr[3]); - p += scnprintf(p, bufsize - (p - buf), - "sa[%i] spi=0x%08x proto=0x%x salt=0x%08x crypt=%d\n", - i, be32_to_cpu(sap->xs->id.spi), -diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c -index 46a7c9fb6300e3..1ce3bccd4ebd4e 100644 ---- a/drivers/net/team/team.c -+++ b/drivers/net/team/team.c -@@ -2657,7 +2657,9 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info) - ctx.data.u32_val = nla_get_u32(attr_data); - break; - case TEAM_OPTION_TYPE_STRING: -- if (nla_len(attr_data) > TEAM_STRING_MAX_LEN) { -+ if (nla_len(attr_data) > TEAM_STRING_MAX_LEN || -+ !memchr(nla_data(attr_data), '\0', -+ nla_len(attr_data))) { - err = -EINVAL; - goto team_put; - } -diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c -index ee02a92338da1b..64db3e98a1b664 100644 ---- a/drivers/net/vxlan/vxlan_core.c -+++ b/drivers/net/vxlan/vxlan_core.c -@@ -2966,8 +2966,11 @@ static int vxlan_init(struct net_device *dev) - struct vxlan_dev *vxlan = netdev_priv(dev); - int err; - -- if (vxlan->cfg.flags & VXLAN_F_VNIFILTER) -- vxlan_vnigroup_init(vxlan); -+ if (vxlan->cfg.flags & VXLAN_F_VNIFILTER) { -+ err = vxlan_vnigroup_init(vxlan); -+ if (err) -+ return err; -+ } - - dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats); - if (!dev->tstats) { -diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c -index 9105fdd14c6671..c977dfbae0a464 100644 ---- a/drivers/net/wireless/ath/ath12k/wmi.c -+++ b/drivers/net/wireless/ath/ath12k/wmi.c -@@ -4418,6 +4418,22 @@ static struct ath12k_reg_rule - return reg_rule_ptr; - } - -+static u8 ath12k_wmi_ignore_num_extra_rules(struct ath12k_wmi_reg_rule_ext_params *rule, -+ u32 num_reg_rules) -+{ -+ u8 num_invalid_5ghz_rules = 0; -+ u32 count, start_freq; -+ -+ for (count = 0; count < num_reg_rules; count++) { -+ start_freq = le32_get_bits(rule[count].freq_info, REG_RULE_START_FREQ); -+ -+ if (start_freq >= ATH12K_MIN_6G_FREQ) -+ num_invalid_5ghz_rules++; -+ } -+ -+ return num_invalid_5ghz_rules; -+} -+ - static int ath12k_pull_reg_chan_list_ext_update_ev(struct ath12k_base *ab, - struct sk_buff *skb, - struct ath12k_reg_info *reg_info) -@@ -4428,6 +4444,7 @@ static int ath12k_pull_reg_chan_list_ext_update_ev(struct ath12k_base *ab, - u32 num_2g_reg_rules, num_5g_reg_rules; - u32 num_6g_reg_rules_ap[WMI_REG_CURRENT_MAX_AP_TYPE]; - u32 num_6g_reg_rules_cl[WMI_REG_CURRENT_MAX_AP_TYPE][WMI_REG_MAX_CLIENT_TYPE]; -+ u8 num_invalid_5ghz_ext_rules; - u32 total_reg_rules = 0; - int ret, i, j; - -@@ -4521,20 +4538,6 @@ static int ath12k_pull_reg_chan_list_ext_update_ev(struct ath12k_base *ab, - - memcpy(reg_info->alpha2, &ev->alpha2, REG_ALPHA2_LEN); - -- /* FIXME: Currently FW includes 6G reg rule also in 5G rule -- * list for country US. -- * Having same 6G reg rule in 5G and 6G rules list causes -- * intersect check to be true, and same rules will be shown -- * multiple times in iw cmd. So added hack below to avoid -- * parsing 6G rule from 5G reg rule list, and this can be -- * removed later, after FW updates to remove 6G reg rule -- * from 5G rules list. -- */ -- if (memcmp(reg_info->alpha2, "US", 2) == 0) { -- reg_info->num_5g_reg_rules = REG_US_5G_NUM_REG_RULES; -- num_5g_reg_rules = reg_info->num_5g_reg_rules; -- } -- - reg_info->dfs_region = le32_to_cpu(ev->dfs_region); - reg_info->phybitmap = le32_to_cpu(ev->phybitmap); - reg_info->num_phy = le32_to_cpu(ev->num_phy); -@@ -4636,8 +4639,29 @@ static int ath12k_pull_reg_chan_list_ext_update_ev(struct ath12k_base *ab, - } - } - -+ ext_wmi_reg_rule += num_2g_reg_rules; -+ -+ /* Firmware might include 6 GHz reg rule in 5 GHz rule list -+ * for few countries along with separate 6 GHz rule. -+ * Having same 6 GHz reg rule in 5 GHz and 6 GHz rules list -+ * causes intersect check to be true, and same rules will be -+ * shown multiple times in iw cmd. -+ * Hence, avoid parsing 6 GHz rule from 5 GHz reg rule list -+ */ -+ num_invalid_5ghz_ext_rules = ath12k_wmi_ignore_num_extra_rules(ext_wmi_reg_rule, -+ num_5g_reg_rules); -+ -+ if (num_invalid_5ghz_ext_rules) { -+ ath12k_dbg(ab, ATH12K_DBG_WMI, -+ "CC: %s 5 GHz reg rules number %d from fw, %d number of invalid 5 GHz rules", -+ reg_info->alpha2, reg_info->num_5g_reg_rules, -+ num_invalid_5ghz_ext_rules); -+ -+ num_5g_reg_rules = num_5g_reg_rules - num_invalid_5ghz_ext_rules; -+ reg_info->num_5g_reg_rules = num_5g_reg_rules; -+ } -+ - if (num_5g_reg_rules) { -- ext_wmi_reg_rule += num_2g_reg_rules; - reg_info->reg_rules_5g_ptr = - create_ext_reg_rules_from_wmi(num_5g_reg_rules, - ext_wmi_reg_rule); -@@ -4649,7 +4673,12 @@ static int ath12k_pull_reg_chan_list_ext_update_ev(struct ath12k_base *ab, - } - } - -- ext_wmi_reg_rule += num_5g_reg_rules; -+ /* We have adjusted the number of 5 GHz reg rules above. But still those -+ * many rules needs to be adjusted in ext_wmi_reg_rule. -+ * -+ * NOTE: num_invalid_5ghz_ext_rules will be 0 for rest other cases. -+ */ -+ ext_wmi_reg_rule += (num_5g_reg_rules + num_invalid_5ghz_ext_rules); - - for (i = 0; i < WMI_REG_CURRENT_MAX_AP_TYPE; i++) { - reg_info->reg_rules_6g_ap_ptr[i] = -diff --git a/drivers/net/wireless/ath/ath12k/wmi.h b/drivers/net/wireless/ath/ath12k/wmi.h -index a19a2c29f2264a..4cfcc83f52269b 100644 ---- a/drivers/net/wireless/ath/ath12k/wmi.h -+++ b/drivers/net/wireless/ath/ath12k/wmi.h -@@ -3891,7 +3891,6 @@ struct ath12k_wmi_eht_rate_set_params { - #define MAX_REG_RULES 10 - #define REG_ALPHA2_LEN 2 - #define MAX_6G_REG_RULES 5 --#define REG_US_5G_NUM_REG_RULES 4 - - enum wmi_start_event_param { - WMI_VDEV_START_RESP_EVENT = 0, -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index fd35ad0648a07b..70f484b811dea7 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -5978,6 +5978,17 @@ SWITCHTEC_QUIRK(0x5552); /* PAXA 52XG5 */ - SWITCHTEC_QUIRK(0x5536); /* PAXA 36XG5 */ - SWITCHTEC_QUIRK(0x5528); /* PAXA 28XG5 */ - -+#define SWITCHTEC_PCI100X_QUIRK(vid) \ -+ DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_EFAR, vid, \ -+ PCI_CLASS_BRIDGE_OTHER, 8, quirk_switchtec_ntb_dma_alias) -+SWITCHTEC_PCI100X_QUIRK(0x1001); /* PCI1001XG4 */ -+SWITCHTEC_PCI100X_QUIRK(0x1002); /* PCI1002XG4 */ -+SWITCHTEC_PCI100X_QUIRK(0x1003); /* PCI1003XG4 */ -+SWITCHTEC_PCI100X_QUIRK(0x1004); /* PCI1004XG4 */ -+SWITCHTEC_PCI100X_QUIRK(0x1005); /* PCI1005XG4 */ -+SWITCHTEC_PCI100X_QUIRK(0x1006); /* PCI1006XG4 */ -+ -+ - /* - * The PLX NTB uses devfn proxy IDs to move TLPs between NT endpoints. - * These IDs are used to forward responses to the originator on the other -@@ -6247,6 +6258,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a2b, dpc_log_size); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a2d, dpc_log_size); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a2f, dpc_log_size); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a31, dpc_log_size); -+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0xa72f, dpc_log_size); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0xa73f, dpc_log_size); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0xa76e, dpc_log_size); - #endif -diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c -index 5a4adf6c04cf89..455fa5035a2450 100644 ---- a/drivers/pci/switch/switchtec.c -+++ b/drivers/pci/switch/switchtec.c -@@ -1737,6 +1737,26 @@ static void switchtec_pci_remove(struct pci_dev *pdev) - .driver_data = gen, \ - } - -+#define SWITCHTEC_PCI100X_DEVICE(device_id, gen) \ -+ { \ -+ .vendor = PCI_VENDOR_ID_EFAR, \ -+ .device = device_id, \ -+ .subvendor = PCI_ANY_ID, \ -+ .subdevice = PCI_ANY_ID, \ -+ .class = (PCI_CLASS_MEMORY_OTHER << 8), \ -+ .class_mask = 0xFFFFFFFF, \ -+ .driver_data = gen, \ -+ }, \ -+ { \ -+ .vendor = PCI_VENDOR_ID_EFAR, \ -+ .device = device_id, \ -+ .subvendor = PCI_ANY_ID, \ -+ .subdevice = PCI_ANY_ID, \ -+ .class = (PCI_CLASS_BRIDGE_OTHER << 8), \ -+ .class_mask = 0xFFFFFFFF, \ -+ .driver_data = gen, \ -+ } -+ - static const struct pci_device_id switchtec_pci_tbl[] = { - SWITCHTEC_PCI_DEVICE(0x8531, SWITCHTEC_GEN3), /* PFX 24xG3 */ - SWITCHTEC_PCI_DEVICE(0x8532, SWITCHTEC_GEN3), /* PFX 32xG3 */ -@@ -1831,6 +1851,12 @@ static const struct pci_device_id switchtec_pci_tbl[] = { - SWITCHTEC_PCI_DEVICE(0x5552, SWITCHTEC_GEN5), /* PAXA 52XG5 */ - SWITCHTEC_PCI_DEVICE(0x5536, SWITCHTEC_GEN5), /* PAXA 36XG5 */ - SWITCHTEC_PCI_DEVICE(0x5528, SWITCHTEC_GEN5), /* PAXA 28XG5 */ -+ SWITCHTEC_PCI100X_DEVICE(0x1001, SWITCHTEC_GEN4), /* PCI1001 16XG4 */ -+ SWITCHTEC_PCI100X_DEVICE(0x1002, SWITCHTEC_GEN4), /* PCI1002 12XG4 */ -+ SWITCHTEC_PCI100X_DEVICE(0x1003, SWITCHTEC_GEN4), /* PCI1003 16XG4 */ -+ SWITCHTEC_PCI100X_DEVICE(0x1004, SWITCHTEC_GEN4), /* PCI1004 16XG4 */ -+ SWITCHTEC_PCI100X_DEVICE(0x1005, SWITCHTEC_GEN4), /* PCI1005 16XG4 */ -+ SWITCHTEC_PCI100X_DEVICE(0x1006, SWITCHTEC_GEN4), /* PCI1006 16XG4 */ - {0} - }; - MODULE_DEVICE_TABLE(pci, switchtec_pci_tbl); -diff --git a/drivers/pinctrl/pinctrl-cy8c95x0.c b/drivers/pinctrl/pinctrl-cy8c95x0.c -index f2b9db66fdb6a4..d2488d80912c9f 100644 ---- a/drivers/pinctrl/pinctrl-cy8c95x0.c -+++ b/drivers/pinctrl/pinctrl-cy8c95x0.c -@@ -1281,7 +1281,7 @@ static int cy8c95x0_irq_setup(struct cy8c95x0_pinctrl *chip, int irq) - - ret = devm_request_threaded_irq(chip->dev, irq, - NULL, cy8c95x0_irq_handler, -- IRQF_ONESHOT | IRQF_SHARED | IRQF_TRIGGER_HIGH, -+ IRQF_ONESHOT | IRQF_SHARED, - dev_name(chip->dev), chip); - if (ret) { - dev_err(chip->dev, "failed to request irq %d\n", irq); -diff --git a/drivers/soc/tegra/fuse/fuse-tegra30.c b/drivers/soc/tegra/fuse/fuse-tegra30.c -index e94d46372a6396..402cf939c03263 100644 ---- a/drivers/soc/tegra/fuse/fuse-tegra30.c -+++ b/drivers/soc/tegra/fuse/fuse-tegra30.c -@@ -646,15 +646,20 @@ static const struct nvmem_cell_lookup tegra234_fuse_lookups[] = { - }; - - static const struct nvmem_keepout tegra234_fuse_keepouts[] = { -- { .start = 0x01c, .end = 0x0c8 }, -- { .start = 0x12c, .end = 0x184 }, -+ { .start = 0x01c, .end = 0x064 }, -+ { .start = 0x084, .end = 0x0a0 }, -+ { .start = 0x0a4, .end = 0x0c8 }, -+ { .start = 0x12c, .end = 0x164 }, -+ { .start = 0x16c, .end = 0x184 }, - { .start = 0x190, .end = 0x198 }, - { .start = 0x1a0, .end = 0x204 }, -- { .start = 0x21c, .end = 0x250 }, -- { .start = 0x25c, .end = 0x2f0 }, -+ { .start = 0x21c, .end = 0x2f0 }, - { .start = 0x310, .end = 0x3d8 }, -- { .start = 0x400, .end = 0x4f0 }, -- { .start = 0x4f8, .end = 0x7e8 }, -+ { .start = 0x400, .end = 0x420 }, -+ { .start = 0x444, .end = 0x490 }, -+ { .start = 0x4bc, .end = 0x4f0 }, -+ { .start = 0x4f8, .end = 0x54c }, -+ { .start = 0x57c, .end = 0x7e8 }, - { .start = 0x8d0, .end = 0x8d8 }, - { .start = 0xacc, .end = 0xf00 } - }; -diff --git a/drivers/spi/spi-sn-f-ospi.c b/drivers/spi/spi-sn-f-ospi.c -index a7c3b3923b4af7..fd8c8eb37d01d6 100644 ---- a/drivers/spi/spi-sn-f-ospi.c -+++ b/drivers/spi/spi-sn-f-ospi.c -@@ -116,6 +116,9 @@ struct f_ospi { - - static u32 f_ospi_get_dummy_cycle(const struct spi_mem_op *op) - { -+ if (!op->dummy.nbytes) -+ return 0; -+ - return (op->dummy.nbytes * 8) / op->dummy.buswidth; - } - -diff --git a/drivers/tty/serial/8250/8250.h b/drivers/tty/serial/8250/8250.h -index 1aa3e55c8b47da..f76c9ecc51bcd6 100644 ---- a/drivers/tty/serial/8250/8250.h -+++ b/drivers/tty/serial/8250/8250.h -@@ -350,6 +350,7 @@ static inline int is_omap1510_8250(struct uart_8250_port *pt) - - #ifdef CONFIG_SERIAL_8250_DMA - extern int serial8250_tx_dma(struct uart_8250_port *); -+extern void serial8250_tx_dma_flush(struct uart_8250_port *); - extern int serial8250_rx_dma(struct uart_8250_port *); - extern void serial8250_rx_dma_flush(struct uart_8250_port *); - extern int serial8250_request_dma(struct uart_8250_port *); -@@ -382,6 +383,7 @@ static inline int serial8250_tx_dma(struct uart_8250_port *p) - { - return -1; - } -+static inline void serial8250_tx_dma_flush(struct uart_8250_port *p) { } - static inline int serial8250_rx_dma(struct uart_8250_port *p) - { - return -1; -diff --git a/drivers/tty/serial/8250/8250_dma.c b/drivers/tty/serial/8250/8250_dma.c -index 7fa66501792dd8..7f23037813bc85 100644 ---- a/drivers/tty/serial/8250/8250_dma.c -+++ b/drivers/tty/serial/8250/8250_dma.c -@@ -139,6 +139,22 @@ int serial8250_tx_dma(struct uart_8250_port *p) - return ret; - } - -+void serial8250_tx_dma_flush(struct uart_8250_port *p) -+{ -+ struct uart_8250_dma *dma = p->dma; -+ -+ if (!dma->tx_running) -+ return; -+ -+ /* -+ * kfifo_reset() has been called by the serial core, avoid -+ * advancing and underflowing in __dma_tx_complete(). -+ */ -+ dma->tx_size = 0; -+ -+ dmaengine_terminate_async(dma->rxchan); -+} -+ - int serial8250_rx_dma(struct uart_8250_port *p) - { - struct uart_8250_dma *dma = p->dma; -diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c -index 2b1b2928ef7b7c..c2778300e15100 100644 ---- a/drivers/tty/serial/8250/8250_port.c -+++ b/drivers/tty/serial/8250/8250_port.c -@@ -2557,6 +2557,14 @@ static unsigned int npcm_get_divisor(struct uart_8250_port *up, - return DIV_ROUND_CLOSEST(port->uartclk, 16 * baud + 2) - 2; - } - -+static void serial8250_flush_buffer(struct uart_port *port) -+{ -+ struct uart_8250_port *up = up_to_u8250p(port); -+ -+ if (up->dma) -+ serial8250_tx_dma_flush(up); -+} -+ - static unsigned int serial8250_do_get_divisor(struct uart_port *port, - unsigned int baud, - unsigned int *frac) -@@ -3260,6 +3268,7 @@ static const struct uart_ops serial8250_pops = { - .break_ctl = serial8250_break_ctl, - .startup = serial8250_startup, - .shutdown = serial8250_shutdown, -+ .flush_buffer = serial8250_flush_buffer, - .set_termios = serial8250_set_termios, - .set_ldisc = serial8250_set_ldisc, - .pm = serial8250_pm, -diff --git a/drivers/tty/serial/serial_port.c b/drivers/tty/serial/serial_port.c -index 469ad26cde4870..a21c287077039d 100644 ---- a/drivers/tty/serial/serial_port.c -+++ b/drivers/tty/serial/serial_port.c -@@ -172,6 +172,7 @@ EXPORT_SYMBOL(uart_remove_one_port); - * The caller is responsible to initialize the following fields of the @port - * ->dev (must be valid) - * ->flags -+ * ->iobase - * ->mapbase - * ->mapsize - * ->regshift (if @use_defaults is false) -@@ -213,7 +214,7 @@ static int __uart_read_properties(struct uart_port *port, bool use_defaults) - /* Read the registers I/O access type (default: MMIO 8-bit) */ - ret = device_property_read_u32(dev, "reg-io-width", &value); - if (ret) { -- port->iotype = UPIO_MEM; -+ port->iotype = port->iobase ? UPIO_PORT : UPIO_MEM; - } else { - switch (value) { - case 1: -@@ -226,11 +227,11 @@ static int __uart_read_properties(struct uart_port *port, bool use_defaults) - port->iotype = device_is_big_endian(dev) ? UPIO_MEM32BE : UPIO_MEM32; - break; - default: -+ port->iotype = UPIO_UNKNOWN; - if (!use_defaults) { - dev_err(dev, "Unsupported reg-io-width (%u)\n", value); - return -EINVAL; - } -- port->iotype = UPIO_UNKNOWN; - break; - } - } -diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c -index f21423a7a6d7db..8fbd46cd8c2b8e 100644 ---- a/drivers/ufs/core/ufs_bsg.c -+++ b/drivers/ufs/core/ufs_bsg.c -@@ -216,6 +216,7 @@ void ufs_bsg_remove(struct ufs_hba *hba) - return; - - bsg_remove_queue(hba->bsg_queue); -+ hba->bsg_queue = NULL; - - device_del(bsg_dev); - put_device(bsg_dev); -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index 605fea4611029b..c1d7d87b32cc5a 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -371,7 +371,7 @@ static void acm_process_notification(struct acm *acm, unsigned char *buf) - static void acm_ctrl_irq(struct urb *urb) - { - struct acm *acm = urb->context; -- struct usb_cdc_notification *dr = urb->transfer_buffer; -+ struct usb_cdc_notification *dr; - unsigned int current_size = urb->actual_length; - unsigned int expected_size, copy_size, alloc_size; - int retval; -@@ -398,14 +398,25 @@ static void acm_ctrl_irq(struct urb *urb) - - usb_mark_last_busy(acm->dev); - -- if (acm->nb_index) -+ if (acm->nb_index == 0) { -+ /* -+ * The first chunk of a message must contain at least the -+ * notification header with the length field, otherwise we -+ * can't get an expected_size. -+ */ -+ if (current_size < sizeof(struct usb_cdc_notification)) { -+ dev_dbg(&acm->control->dev, "urb too short\n"); -+ goto exit; -+ } -+ dr = urb->transfer_buffer; -+ } else { - dr = (struct usb_cdc_notification *)acm->notification_buffer; -- -+ } - /* size = notification-header + (optional) data */ - expected_size = sizeof(struct usb_cdc_notification) + - le16_to_cpu(dr->wLength); - -- if (current_size < expected_size) { -+ if (acm->nb_index != 0 || current_size < expected_size) { - /* notification is transmitted fragmented, reassemble */ - if (acm->nb_size < expected_size) { - u8 *new_buffer; -@@ -1727,13 +1738,16 @@ static const struct usb_device_id acm_ids[] = { - { USB_DEVICE(0x0870, 0x0001), /* Metricom GS Modem */ - .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ - }, -- { USB_DEVICE(0x045b, 0x023c), /* Renesas USB Download mode */ -+ { USB_DEVICE(0x045b, 0x023c), /* Renesas R-Car H3 USB Download mode */ -+ .driver_info = DISABLE_ECHO, /* Don't echo banner */ -+ }, -+ { USB_DEVICE(0x045b, 0x0247), /* Renesas R-Car D3 USB Download mode */ - .driver_info = DISABLE_ECHO, /* Don't echo banner */ - }, -- { USB_DEVICE(0x045b, 0x0248), /* Renesas USB Download mode */ -+ { USB_DEVICE(0x045b, 0x0248), /* Renesas R-Car M3-N USB Download mode */ - .driver_info = DISABLE_ECHO, /* Don't echo banner */ - }, -- { USB_DEVICE(0x045b, 0x024D), /* Renesas USB Download mode */ -+ { USB_DEVICE(0x045b, 0x024D), /* Renesas R-Car E3 USB Download mode */ - .driver_info = DISABLE_ECHO, /* Don't echo banner */ - }, - { USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; andrey.arapov@gmail.com */ -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 0944cfae8b5567..38f3f5a766dfdf 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -1818,6 +1818,17 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id) - desc = intf->cur_altsetting; - hdev = interface_to_usbdev(intf); - -+ /* -+ * The USB 2.0 spec prohibits hubs from having more than one -+ * configuration or interface, and we rely on this prohibition. -+ * Refuse to accept a device that violates it. -+ */ -+ if (hdev->descriptor.bNumConfigurations > 1 || -+ hdev->actconfig->desc.bNumInterfaces > 1) { -+ dev_err(&intf->dev, "Invalid hub with more than one config or interface\n"); -+ return -EINVAL; -+ } -+ - /* - * Set default autosuspend delay as 0 to speedup bus suspend, - * based on the below considerations: -@@ -4666,7 +4677,6 @@ void usb_ep0_reinit(struct usb_device *udev) - EXPORT_SYMBOL_GPL(usb_ep0_reinit); - - #define usb_sndaddr0pipe() (PIPE_CONTROL << 30) --#define usb_rcvaddr0pipe() ((PIPE_CONTROL << 30) | USB_DIR_IN) - - static int hub_set_address(struct usb_device *udev, int devnum) - { -@@ -4772,7 +4782,7 @@ static int get_bMaxPacketSize0(struct usb_device *udev, - for (i = 0; i < GET_MAXPACKET0_TRIES; ++i) { - /* Start with invalid values in case the transfer fails */ - buf->bDescriptorType = buf->bMaxPacketSize0 = 0; -- rc = usb_control_msg(udev, usb_rcvaddr0pipe(), -+ rc = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), - USB_REQ_GET_DESCRIPTOR, USB_DIR_IN, - USB_DT_DEVICE << 8, 0, - buf, size, -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 13171454f9591a..027479179f09e9 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -432,6 +432,9 @@ static const struct usb_device_id usb_quirk_list[] = { - { USB_DEVICE(0x0c45, 0x7056), .driver_info = - USB_QUIRK_IGNORE_REMOTE_WAKEUP }, - -+ /* Sony Xperia XZ1 Compact (lilac) smartphone in fastboot mode */ -+ { USB_DEVICE(0x0fce, 0x0dde), .driver_info = USB_QUIRK_NO_LPM }, -+ - /* Action Semiconductor flash disk */ - { USB_DEVICE(0x10d6, 0x2200), .driver_info = - USB_QUIRK_STRING_FETCH_255 }, -@@ -522,6 +525,9 @@ static const struct usb_device_id usb_quirk_list[] = { - /* Blackmagic Design UltraStudio SDI */ - { USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM }, - -+ /* Teclast disk */ -+ { USB_DEVICE(0x1f75, 0x0917), .driver_info = USB_QUIRK_NO_LPM }, -+ - /* Hauppauge HVR-950q */ - { USB_DEVICE(0x2040, 0x7200), .driver_info = - USB_QUIRK_CONFIG_INTF_STRINGS }, -diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c -index b26de09f6b6d5e..ce20c06a902531 100644 ---- a/drivers/usb/dwc2/gadget.c -+++ b/drivers/usb/dwc2/gadget.c -@@ -4612,6 +4612,7 @@ static int dwc2_hsotg_udc_stop(struct usb_gadget *gadget) - spin_lock_irqsave(&hsotg->lock, flags); - - hsotg->driver = NULL; -+ hsotg->gadget.dev.of_node = NULL; - hsotg->gadget.speed = USB_SPEED_UNKNOWN; - hsotg->enabled = 0; - -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index 9b8099cba41429..f6d9a9c67db4e2 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -2618,10 +2618,38 @@ static int dwc3_gadget_run_stop(struct dwc3 *dwc, int is_on) - { - u32 reg; - u32 timeout = 2000; -+ u32 saved_config = 0; - - if (pm_runtime_suspended(dwc->dev)) - return 0; - -+ /* -+ * When operating in USB 2.0 speeds (HS/FS), ensure that -+ * GUSB2PHYCFG.ENBLSLPM and GUSB2PHYCFG.SUSPHY are cleared before starting -+ * or stopping the controller. This resolves timeout issues that occur -+ * during frequent role switches between host and device modes. -+ * -+ * Save and clear these settings, then restore them after completing the -+ * controller start or stop sequence. -+ * -+ * This solution was discovered through experimentation as it is not -+ * mentioned in the dwc3 programming guide. It has been tested on an -+ * Exynos platforms. -+ */ -+ reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0)); -+ if (reg & DWC3_GUSB2PHYCFG_SUSPHY) { -+ saved_config |= DWC3_GUSB2PHYCFG_SUSPHY; -+ reg &= ~DWC3_GUSB2PHYCFG_SUSPHY; -+ } -+ -+ if (reg & DWC3_GUSB2PHYCFG_ENBLSLPM) { -+ saved_config |= DWC3_GUSB2PHYCFG_ENBLSLPM; -+ reg &= ~DWC3_GUSB2PHYCFG_ENBLSLPM; -+ } -+ -+ if (saved_config) -+ dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg); -+ - reg = dwc3_readl(dwc->regs, DWC3_DCTL); - if (is_on) { - if (DWC3_VER_IS_WITHIN(DWC3, ANY, 187A)) { -@@ -2649,6 +2677,12 @@ static int dwc3_gadget_run_stop(struct dwc3 *dwc, int is_on) - reg &= DWC3_DSTS_DEVCTRLHLT; - } while (--timeout && !(!is_on ^ !reg)); - -+ if (saved_config) { -+ reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0)); -+ reg |= saved_config; -+ dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg); -+ } -+ - if (!timeout) - return -ETIMEDOUT; - -diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c -index 2d02f25f959791..49946af11a9058 100644 ---- a/drivers/usb/gadget/function/f_midi.c -+++ b/drivers/usb/gadget/function/f_midi.c -@@ -906,6 +906,15 @@ static int f_midi_bind(struct usb_configuration *c, struct usb_function *f) - - status = -ENODEV; - -+ /* -+ * Reset wMaxPacketSize with maximum packet size of FS bulk transfer before -+ * endpoint claim. This ensures that the wMaxPacketSize does not exceed the -+ * limit during bind retries where configured dwc3 TX/RX FIFO's maxpacket -+ * size of 512 bytes for IN/OUT endpoints in support HS speed only. -+ */ -+ bulk_in_desc.wMaxPacketSize = cpu_to_le16(64); -+ bulk_out_desc.wMaxPacketSize = cpu_to_le16(64); -+ - /* allocate instance-specific endpoints */ - midi->in_ep = usb_ep_autoconfig(cdev->gadget, &bulk_in_desc); - if (!midi->in_ep) -@@ -999,11 +1008,11 @@ static int f_midi_bind(struct usb_configuration *c, struct usb_function *f) - } - - /* configure the endpoint descriptors ... */ -- ms_out_desc.bLength = USB_DT_MS_ENDPOINT_SIZE(midi->in_ports); -- ms_out_desc.bNumEmbMIDIJack = midi->in_ports; -+ ms_out_desc.bLength = USB_DT_MS_ENDPOINT_SIZE(midi->out_ports); -+ ms_out_desc.bNumEmbMIDIJack = midi->out_ports; - -- ms_in_desc.bLength = USB_DT_MS_ENDPOINT_SIZE(midi->out_ports); -- ms_in_desc.bNumEmbMIDIJack = midi->out_ports; -+ ms_in_desc.bLength = USB_DT_MS_ENDPOINT_SIZE(midi->in_ports); -+ ms_in_desc.bNumEmbMIDIJack = midi->in_ports; - - /* ... and add them to the list */ - endpoint_descriptor_index = i; -diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c -index 3b01734ce1b7e5..a93ad93390ba17 100644 ---- a/drivers/usb/gadget/udc/renesas_usb3.c -+++ b/drivers/usb/gadget/udc/renesas_usb3.c -@@ -310,7 +310,7 @@ struct renesas_usb3_request { - struct list_head queue; - }; - --#define USB3_EP_NAME_SIZE 8 -+#define USB3_EP_NAME_SIZE 16 - struct renesas_usb3_ep { - struct usb_ep ep; - struct renesas_usb3 *usb3; -diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c -index 2665832f9addff..b96d9062a0837a 100644 ---- a/drivers/usb/host/pci-quirks.c -+++ b/drivers/usb/host/pci-quirks.c -@@ -946,6 +946,15 @@ static void quirk_usb_disable_ehci(struct pci_dev *pdev) - * booting from USB disk or using a usb keyboard - */ - hcc_params = readl(base + EHCI_HCC_PARAMS); -+ -+ /* LS7A EHCI controller doesn't have extended capabilities, the -+ * EECP (EHCI Extended Capabilities Pointer) field of HCCPARAMS -+ * register should be 0x0 but it reads as 0xa0. So clear it to -+ * avoid error messages on boot. -+ */ -+ if (pdev->vendor == PCI_VENDOR_ID_LOONGSON && pdev->device == 0x7a14) -+ hcc_params &= ~(0xffL << 8); -+ - offset = (hcc_params >> 8) & 0xff; - while (offset && --count) { - pci_read_config_dword(pdev, offset, &cap); -diff --git a/drivers/usb/roles/class.c b/drivers/usb/roles/class.c -index 70165dd86b5de9..8664449ca2ff8a 100644 ---- a/drivers/usb/roles/class.c -+++ b/drivers/usb/roles/class.c -@@ -355,14 +355,15 @@ usb_role_switch_register(struct device *parent, - dev_set_name(&sw->dev, "%s-role-switch", - desc->name ? desc->name : dev_name(parent)); - -+ sw->registered = true; -+ - ret = device_register(&sw->dev); - if (ret) { -+ sw->registered = false; - put_device(&sw->dev); - return ERR_PTR(ret); - } - -- sw->registered = true; -- - /* TODO: Symlinks for the host port and the device controller. */ - - return sw; -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 86ac20e2874bab..37ff48702e43e1 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -619,15 +619,6 @@ static void option_instat_callback(struct urb *urb); - /* Luat Air72*U series based on UNISOC UIS8910 uses UNISOC's vendor ID */ - #define LUAT_PRODUCT_AIR720U 0x4e00 - --/* MeiG Smart Technology products */ --#define MEIGSMART_VENDOR_ID 0x2dee --/* MeiG Smart SRM815/SRM825L based on Qualcomm 315 */ --#define MEIGSMART_PRODUCT_SRM825L 0x4d22 --/* MeiG Smart SLM320 based on UNISOC UIS8910 */ --#define MEIGSMART_PRODUCT_SLM320 0x4d41 --/* MeiG Smart SLM770A based on ASR1803 */ --#define MEIGSMART_PRODUCT_SLM770A 0x4d57 -- - /* Device flags */ - - /* Highest interface number which can be used with NCTRL() and RSVD() */ -@@ -1367,15 +1358,15 @@ static const struct usb_device_id option_ids[] = { - .driver_info = NCTRL(2) | RSVD(3) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1063, 0xff), /* Telit LN920 (ECM) */ - .driver_info = NCTRL(0) | RSVD(1) }, -- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1070, 0xff), /* Telit FN990 (rmnet) */ -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1070, 0xff), /* Telit FN990A (rmnet) */ - .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, -- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1071, 0xff), /* Telit FN990 (MBIM) */ -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1071, 0xff), /* Telit FN990A (MBIM) */ - .driver_info = NCTRL(0) | RSVD(1) }, -- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1072, 0xff), /* Telit FN990 (RNDIS) */ -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1072, 0xff), /* Telit FN990A (RNDIS) */ - .driver_info = NCTRL(2) | RSVD(3) }, -- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1073, 0xff), /* Telit FN990 (ECM) */ -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1073, 0xff), /* Telit FN990A (ECM) */ - .driver_info = NCTRL(0) | RSVD(1) }, -- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990 (PCIe) */ -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990A (PCIe) */ - .driver_info = RSVD(0) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1080, 0xff), /* Telit FE990 (rmnet) */ - .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, -@@ -1403,6 +1394,22 @@ static const struct usb_device_id option_ids[] = { - .driver_info = RSVD(0) | NCTRL(3) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff), /* Telit FE910C04 (rmnet) */ - .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, -+ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x60) }, /* Telit FN990B (rmnet) */ -+ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x40) }, -+ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x30), -+ .driver_info = NCTRL(5) }, -+ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x60) }, /* Telit FN990B (MBIM) */ -+ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x40) }, -+ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x30), -+ .driver_info = NCTRL(6) }, -+ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x60) }, /* Telit FN990B (RNDIS) */ -+ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x40) }, -+ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x30), -+ .driver_info = NCTRL(6) }, -+ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x60) }, /* Telit FN990B (ECM) */ -+ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x40) }, -+ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x30), -+ .driver_info = NCTRL(6) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), - .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), -@@ -2347,6 +2354,14 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a05, 0xff) }, /* Fibocom FM650-CN (NCM mode) */ - { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a06, 0xff) }, /* Fibocom FM650-CN (RNDIS mode) */ - { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a07, 0xff) }, /* Fibocom FM650-CN (MBIM mode) */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d41, 0xff, 0, 0) }, /* MeiG Smart SLM320 */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d57, 0xff, 0, 0) }, /* MeiG Smart SLM770A */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0, 0) }, /* MeiG Smart SRM815 */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0x10, 0x02) }, /* MeiG Smart SLM828 */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0x10, 0x03) }, /* MeiG Smart SLM828 */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0xff, 0x30) }, /* MeiG Smart SRM815 and SRM825L */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0xff, 0x40) }, /* MeiG Smart SRM825L */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0xff, 0x60) }, /* MeiG Smart SRM825L */ - { USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */ - { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ - { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ -@@ -2403,12 +2418,6 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0, 0) }, - { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) }, - { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, -- { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) }, -- { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM770A, 0xff, 0, 0) }, -- { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0, 0) }, -- { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) }, -- { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) }, -- { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) }, - { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0530, 0xff), /* TCL IK512 MBIM */ - .driver_info = NCTRL(1) }, - { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0640, 0xff), /* TCL IK512 ECM */ -diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_rdwr.c -index e27de61ac9fe75..8191c8fcfb2565 100644 ---- a/drivers/vfio/pci/vfio_pci_rdwr.c -+++ b/drivers/vfio/pci/vfio_pci_rdwr.c -@@ -16,6 +16,7 @@ - #include - #include - #include -+#include - - #include "vfio_pci_priv.h" - -diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c -index d63c2d266d0735..3bf1043cd7957c 100644 ---- a/drivers/vfio/platform/vfio_platform_common.c -+++ b/drivers/vfio/platform/vfio_platform_common.c -@@ -393,11 +393,6 @@ static ssize_t vfio_platform_read_mmio(struct vfio_platform_region *reg, - - count = min_t(size_t, count, reg->size - off); - -- if (off >= reg->size) -- return -EINVAL; -- -- count = min_t(size_t, count, reg->size - off); -- - if (!reg->ioaddr) { - reg->ioaddr = - ioremap(reg->addr, reg->size); -@@ -482,11 +477,6 @@ static ssize_t vfio_platform_write_mmio(struct vfio_platform_region *reg, - - count = min_t(size_t, count, reg->size - off); - -- if (off >= reg->size) -- return -EINVAL; -- -- count = min_t(size_t, count, reg->size - off); -- - if (!reg->ioaddr) { - reg->ioaddr = - ioremap(reg->addr, reg->size); -diff --git a/drivers/video/fbdev/omap/lcd_dma.c b/drivers/video/fbdev/omap/lcd_dma.c -index f85817635a8c2c..0da23c57e4757e 100644 ---- a/drivers/video/fbdev/omap/lcd_dma.c -+++ b/drivers/video/fbdev/omap/lcd_dma.c -@@ -432,8 +432,8 @@ static int __init omap_init_lcd_dma(void) - - spin_lock_init(&lcd_dma.lock); - -- r = request_irq(INT_DMA_LCD, lcd_dma_irq_handler, 0, -- "LCD DMA", NULL); -+ r = request_threaded_irq(INT_DMA_LCD, NULL, lcd_dma_irq_handler, -+ IRQF_ONESHOT, "LCD DMA", NULL); - if (r != 0) - pr_err("unable to request IRQ for LCD DMA (error %d)\n", r); - -diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c -index 6d0d1c8a508bf9..b6e54ab3b6f3bb 100644 ---- a/drivers/xen/swiotlb-xen.c -+++ b/drivers/xen/swiotlb-xen.c -@@ -74,19 +74,21 @@ static inline phys_addr_t xen_dma_to_phys(struct device *dev, - return xen_bus_to_phys(dev, dma_to_phys(dev, dma_addr)); - } - -+static inline bool range_requires_alignment(phys_addr_t p, size_t size) -+{ -+ phys_addr_t algn = 1ULL << (get_order(size) + PAGE_SHIFT); -+ phys_addr_t bus_addr = pfn_to_bfn(XEN_PFN_DOWN(p)) << XEN_PAGE_SHIFT; -+ -+ return IS_ALIGNED(p, algn) && !IS_ALIGNED(bus_addr, algn); -+} -+ - static inline int range_straddles_page_boundary(phys_addr_t p, size_t size) - { - unsigned long next_bfn, xen_pfn = XEN_PFN_DOWN(p); - unsigned int i, nr_pages = XEN_PFN_UP(xen_offset_in_page(p) + size); -- phys_addr_t algn = 1ULL << (get_order(size) + PAGE_SHIFT); - - next_bfn = pfn_to_bfn(xen_pfn); - -- /* If buffer is physically aligned, ensure DMA alignment. */ -- if (IS_ALIGNED(p, algn) && -- !IS_ALIGNED((phys_addr_t)next_bfn << XEN_PAGE_SHIFT, algn)) -- return 1; -- - for (i = 1; i < nr_pages; i++) - if (pfn_to_bfn(++xen_pfn) != ++next_bfn) - return 1; -@@ -155,7 +157,8 @@ xen_swiotlb_alloc_coherent(struct device *dev, size_t size, - - *dma_handle = xen_phys_to_dma(dev, phys); - if (*dma_handle + size - 1 > dma_mask || -- range_straddles_page_boundary(phys, size)) { -+ range_straddles_page_boundary(phys, size) || -+ range_requires_alignment(phys, size)) { - if (xen_create_contiguous_region(phys, order, fls64(dma_mask), - dma_handle) != 0) - goto out_free_pages; -@@ -181,7 +184,8 @@ xen_swiotlb_free_coherent(struct device *dev, size_t size, void *vaddr, - size = ALIGN(size, XEN_PAGE_SIZE); - - if (WARN_ON_ONCE(dma_handle + size - 1 > dev->coherent_dma_mask) || -- WARN_ON_ONCE(range_straddles_page_boundary(phys, size))) -+ WARN_ON_ONCE(range_straddles_page_boundary(phys, size) || -+ range_requires_alignment(phys, size))) - return; - - if (TestClearPageXenRemapped(virt_to_page(vaddr))) -diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c -index c2d0c62b087c22..68092b64e29eac 100644 ---- a/fs/btrfs/file.c -+++ b/fs/btrfs/file.c -@@ -1134,7 +1134,6 @@ static int btrfs_write_check(struct kiocb *iocb, struct iov_iter *from, - loff_t pos = iocb->ki_pos; - int ret; - loff_t oldsize; -- loff_t start_pos; - - /* - * Quickly bail out on NOWAIT writes if we don't have the nodatacow or -@@ -1158,9 +1157,8 @@ static int btrfs_write_check(struct kiocb *iocb, struct iov_iter *from, - */ - update_time_for_write(inode); - -- start_pos = round_down(pos, fs_info->sectorsize); - oldsize = i_size_read(inode); -- if (start_pos > oldsize) { -+ if (pos > oldsize) { - /* Expand hole size to cover write data, preventing empty gap */ - loff_t end_pos = round_up(pos + count, fs_info->sectorsize); - -diff --git a/fs/nfs/sysfs.c b/fs/nfs/sysfs.c -index bf378ecd5d9fdd..7b59a40d40c061 100644 ---- a/fs/nfs/sysfs.c -+++ b/fs/nfs/sysfs.c -@@ -280,9 +280,9 @@ void nfs_sysfs_link_rpc_client(struct nfs_server *server, - char name[RPC_CLIENT_NAME_SIZE]; - int ret; - -- strcpy(name, clnt->cl_program->name); -- strcat(name, uniq ? uniq : ""); -- strcat(name, "_client"); -+ strscpy(name, clnt->cl_program->name, sizeof(name)); -+ strncat(name, uniq ? uniq : "", sizeof(name) - strlen(name) - 1); -+ strncat(name, "_client", sizeof(name) - strlen(name) - 1); - - ret = sysfs_create_link_nowarn(&server->kobj, - &clnt->cl_sysfs->kobject, name); -diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c -index 12b2b9bc07bfe3..f1f32ad4f42ca1 100644 ---- a/fs/nfsd/nfs2acl.c -+++ b/fs/nfsd/nfs2acl.c -@@ -84,6 +84,8 @@ static __be32 nfsacld_proc_getacl(struct svc_rqst *rqstp) - fail: - posix_acl_release(resp->acl_access); - posix_acl_release(resp->acl_default); -+ resp->acl_access = NULL; -+ resp->acl_default = NULL; - goto out; - } - -diff --git a/fs/nfsd/nfs3acl.c b/fs/nfsd/nfs3acl.c -index 73adca47d37398..d7af28f445044e 100644 ---- a/fs/nfsd/nfs3acl.c -+++ b/fs/nfsd/nfs3acl.c -@@ -76,6 +76,8 @@ static __be32 nfsd3_proc_getacl(struct svc_rqst *rqstp) - fail: - posix_acl_release(resp->acl_access); - posix_acl_release(resp->acl_default); -+ resp->acl_access = NULL; -+ resp->acl_default = NULL; - goto out; - } - -diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c -index 875ea311ca3c20..d47173d98eef71 100644 ---- a/fs/nfsd/nfs4callback.c -+++ b/fs/nfsd/nfs4callback.c -@@ -1410,8 +1410,11 @@ nfsd4_run_cb_work(struct work_struct *work) - nfsd4_process_cb_update(cb); - - clnt = clp->cl_cb_client; -- if (!clnt) { -- /* Callback channel broken, or client killed; give up: */ -+ if (!clnt || clp->cl_state == NFSD4_COURTESY) { -+ /* -+ * Callback channel broken, client killed or -+ * nfs4_client in courtesy state; give up. -+ */ - nfsd41_destroy_cb(cb); - return; - } -diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c -index 1b508f5433846e..fa41db08848802 100644 ---- a/fs/orangefs/orangefs-debugfs.c -+++ b/fs/orangefs/orangefs-debugfs.c -@@ -393,9 +393,9 @@ static ssize_t orangefs_debug_write(struct file *file, - * Thwart users who try to jamb a ridiculous number - * of bytes into the debug file... - */ -- if (count > ORANGEFS_MAX_DEBUG_STRING_LEN + 1) { -+ if (count > ORANGEFS_MAX_DEBUG_STRING_LEN) { - silly = count; -- count = ORANGEFS_MAX_DEBUG_STRING_LEN + 1; -+ count = ORANGEFS_MAX_DEBUG_STRING_LEN; - } - - buf = kzalloc(ORANGEFS_MAX_DEBUG_STRING_LEN, GFP_KERNEL); -diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h -index 958ed7e89b301e..1d482c2aabbdfa 100644 ---- a/include/linux/blk-mq.h -+++ b/include/linux/blk-mq.h -@@ -849,12 +849,22 @@ static inline bool blk_mq_add_to_batch(struct request *req, - void (*complete)(struct io_comp_batch *)) - { - /* -- * blk_mq_end_request_batch() can't end request allocated from -- * sched tags -+ * Check various conditions that exclude batch processing: -+ * 1) No batch container -+ * 2) Has scheduler data attached -+ * 3) Not a passthrough request and end_io set -+ * 4) Not a passthrough request and an ioerror - */ -- if (!iob || (req->rq_flags & RQF_SCHED_TAGS) || ioerror || -- (req->end_io && !blk_rq_is_passthrough(req))) -+ if (!iob) - return false; -+ if (req->rq_flags & RQF_SCHED_TAGS) -+ return false; -+ if (!blk_rq_is_passthrough(req)) { -+ if (req->end_io) -+ return false; -+ if (ioerror < 0) -+ return false; -+ } - - if (!iob->complete) - iob->complete = complete; -diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h -index 6eefe5153a6ff7..c0c2b26725d0fc 100644 ---- a/include/linux/cgroup-defs.h -+++ b/include/linux/cgroup-defs.h -@@ -71,9 +71,6 @@ enum { - - /* Cgroup is frozen. */ - CGRP_FROZEN, -- -- /* Control group has to be killed. */ -- CGRP_KILL, - }; - - /* cgroup_root->flags */ -@@ -438,6 +435,9 @@ struct cgroup { - - int nr_threaded_children; /* # of live threaded child cgroups */ - -+ /* sequence number for cgroup.kill, serialized by css_set_lock. */ -+ unsigned int kill_seq; -+ - struct kernfs_node *kn; /* cgroup kernfs entry */ - struct cgroup_file procs_file; /* handle for "cgroup.procs" */ - struct cgroup_file events_file; /* handle for "cgroup.events" */ -diff --git a/include/linux/efi.h b/include/linux/efi.h -index 80b21d1c6eafaf..7db1c0759c0969 100644 ---- a/include/linux/efi.h -+++ b/include/linux/efi.h -@@ -127,6 +127,7 @@ typedef struct { - #define EFI_MEMORY_RO ((u64)0x0000000000020000ULL) /* read-only */ - #define EFI_MEMORY_SP ((u64)0x0000000000040000ULL) /* soft reserved */ - #define EFI_MEMORY_CPU_CRYPTO ((u64)0x0000000000080000ULL) /* supports encryption */ -+#define EFI_MEMORY_HOT_PLUGGABLE BIT_ULL(20) /* supports unplugging at runtime */ - #define EFI_MEMORY_RUNTIME ((u64)0x8000000000000000ULL) /* range requires runtime mapping */ - #define EFI_MEMORY_DESCRIPTOR_VERSION 1 - -diff --git a/include/linux/i8253.h b/include/linux/i8253.h -index 8336b2f6f83462..bf169cfef7f12d 100644 ---- a/include/linux/i8253.h -+++ b/include/linux/i8253.h -@@ -24,6 +24,7 @@ extern raw_spinlock_t i8253_lock; - extern bool i8253_clear_counter_on_shutdown; - extern struct clock_event_device i8253_clockevent; - extern void clockevent_i8253_init(bool oneshot); -+extern void clockevent_i8253_disable(void); - - extern void setup_pit_timer(void); - -diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index 8b5121eb8757ef..95ee88dfe0b9c6 100644 ---- a/include/linux/netdevice.h -+++ b/include/linux/netdevice.h -@@ -2593,6 +2593,12 @@ struct net *dev_net(const struct net_device *dev) - return read_pnet(&dev->nd_net); - } - -+static inline -+struct net *dev_net_rcu(const struct net_device *dev) -+{ -+ return read_pnet_rcu(&dev->nd_net); -+} -+ - static inline - void dev_net_set(struct net_device *dev, struct net *net) - { -diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h -index a23af225c89839..8dbecab4c4000f 100644 ---- a/include/linux/sched/task.h -+++ b/include/linux/sched/task.h -@@ -41,6 +41,7 @@ struct kernel_clone_args { - void *fn_arg; - struct cgroup *cgrp; - struct css_set *cset; -+ unsigned int kill_seq; - }; - - /* -diff --git a/include/net/l3mdev.h b/include/net/l3mdev.h -index 031c661aa14df7..bdfa9d414360c7 100644 ---- a/include/net/l3mdev.h -+++ b/include/net/l3mdev.h -@@ -198,10 +198,12 @@ struct sk_buff *l3mdev_l3_out(struct sock *sk, struct sk_buff *skb, u16 proto) - if (netif_is_l3_slave(dev)) { - struct net_device *master; - -+ rcu_read_lock(); - master = netdev_master_upper_dev_get_rcu(dev); - if (master && master->l3mdev_ops->l3mdev_l3_out) - skb = master->l3mdev_ops->l3mdev_l3_out(master, sk, - skb, proto); -+ rcu_read_unlock(); - } - - return skb; -diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h -index 1befad79a67349..ce3f84c6eb8eb3 100644 ---- a/include/net/net_namespace.h -+++ b/include/net/net_namespace.h -@@ -369,21 +369,30 @@ static inline void put_net_track(struct net *net, netns_tracker *tracker) - - typedef struct { - #ifdef CONFIG_NET_NS -- struct net *net; -+ struct net __rcu *net; - #endif - } possible_net_t; - - static inline void write_pnet(possible_net_t *pnet, struct net *net) - { - #ifdef CONFIG_NET_NS -- pnet->net = net; -+ rcu_assign_pointer(pnet->net, net); - #endif - } - - static inline struct net *read_pnet(const possible_net_t *pnet) - { - #ifdef CONFIG_NET_NS -- return pnet->net; -+ return rcu_dereference_protected(pnet->net, true); -+#else -+ return &init_net; -+#endif -+} -+ -+static inline struct net *read_pnet_rcu(const possible_net_t *pnet) -+{ -+#ifdef CONFIG_NET_NS -+ return rcu_dereference(pnet->net); - #else - return &init_net; - #endif -diff --git a/include/net/route.h b/include/net/route.h -index 51a45b1887b562..0171e9e1bbea3d 100644 ---- a/include/net/route.h -+++ b/include/net/route.h -@@ -357,10 +357,15 @@ static inline int inet_iif(const struct sk_buff *skb) - static inline int ip4_dst_hoplimit(const struct dst_entry *dst) - { - int hoplimit = dst_metric_raw(dst, RTAX_HOPLIMIT); -- struct net *net = dev_net(dst->dev); - -- if (hoplimit == 0) -+ if (hoplimit == 0) { -+ const struct net *net; -+ -+ rcu_read_lock(); -+ net = dev_net_rcu(dst->dev); - hoplimit = READ_ONCE(net->ipv4.sysctl_ip_default_ttl); -+ rcu_read_unlock(); -+ } - return hoplimit; - } - -diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c -index 702c08c26cd4fa..b6fbae874f27f7 100644 ---- a/io_uring/kbuf.c -+++ b/io_uring/kbuf.c -@@ -301,6 +301,12 @@ void io_destroy_buffers(struct io_ring_ctx *ctx) - } - } - -+static void io_destroy_bl(struct io_ring_ctx *ctx, struct io_buffer_list *bl) -+{ -+ xa_erase(&ctx->io_bl_xa, bl->bgid); -+ io_put_bl(ctx, bl); -+} -+ - int io_remove_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) - { - struct io_provide_buf *p = io_kiocb_to_cmd(req, struct io_provide_buf); -@@ -642,12 +648,13 @@ int io_register_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg) - /* if mapped buffer ring OR classic exists, don't allow */ - if (bl->is_mapped || !list_empty(&bl->buf_list)) - return -EEXIST; -- } else { -- free_bl = bl = kzalloc(sizeof(*bl), GFP_KERNEL); -- if (!bl) -- return -ENOMEM; -+ io_destroy_bl(ctx, bl); - } - -+ free_bl = bl = kzalloc(sizeof(*bl), GFP_KERNEL); -+ if (!bl) -+ return -ENOMEM; -+ - if (!(reg.flags & IOU_PBUF_RING_MMAP)) - ret = io_pin_pbuf_ring(®, bl); - else -diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c -index 36097e8c904fe5..3ccf80dfa587a3 100644 ---- a/kernel/cgroup/cgroup.c -+++ b/kernel/cgroup/cgroup.c -@@ -3941,7 +3941,7 @@ static void __cgroup_kill(struct cgroup *cgrp) - lockdep_assert_held(&cgroup_mutex); - - spin_lock_irq(&css_set_lock); -- set_bit(CGRP_KILL, &cgrp->flags); -+ cgrp->kill_seq++; - spin_unlock_irq(&css_set_lock); - - css_task_iter_start(&cgrp->self, CSS_TASK_ITER_PROCS | CSS_TASK_ITER_THREADED, &it); -@@ -3957,10 +3957,6 @@ static void __cgroup_kill(struct cgroup *cgrp) - send_sig(SIGKILL, task, 0); - } - css_task_iter_end(&it); -- -- spin_lock_irq(&css_set_lock); -- clear_bit(CGRP_KILL, &cgrp->flags); -- spin_unlock_irq(&css_set_lock); - } - - static void cgroup_kill(struct cgroup *cgrp) -@@ -6399,6 +6395,10 @@ static int cgroup_css_set_fork(struct kernel_clone_args *kargs) - spin_lock_irq(&css_set_lock); - cset = task_css_set(current); - get_css_set(cset); -+ if (kargs->cgrp) -+ kargs->kill_seq = kargs->cgrp->kill_seq; -+ else -+ kargs->kill_seq = cset->dfl_cgrp->kill_seq; - spin_unlock_irq(&css_set_lock); - - if (!(kargs->flags & CLONE_INTO_CGROUP)) { -@@ -6582,6 +6582,7 @@ void cgroup_post_fork(struct task_struct *child, - struct kernel_clone_args *kargs) - __releases(&cgroup_threadgroup_rwsem) __releases(&cgroup_mutex) - { -+ unsigned int cgrp_kill_seq = 0; - unsigned long cgrp_flags = 0; - bool kill = false; - struct cgroup_subsys *ss; -@@ -6595,10 +6596,13 @@ void cgroup_post_fork(struct task_struct *child, - - /* init tasks are special, only link regular threads */ - if (likely(child->pid)) { -- if (kargs->cgrp) -+ if (kargs->cgrp) { - cgrp_flags = kargs->cgrp->flags; -- else -+ cgrp_kill_seq = kargs->cgrp->kill_seq; -+ } else { - cgrp_flags = cset->dfl_cgrp->flags; -+ cgrp_kill_seq = cset->dfl_cgrp->kill_seq; -+ } - - WARN_ON_ONCE(!list_empty(&child->cg_list)); - cset->nr_tasks++; -@@ -6633,7 +6637,7 @@ void cgroup_post_fork(struct task_struct *child, - * child down right after we finished preparing it for - * userspace. - */ -- kill = test_bit(CGRP_KILL, &cgrp_flags); -+ kill = kargs->kill_seq != cgrp_kill_seq; - } - - spin_unlock_irq(&css_set_lock); -diff --git a/kernel/cgroup/rstat.c b/kernel/cgroup/rstat.c -index d80d7a60814129..c32439b855f5dd 100644 ---- a/kernel/cgroup/rstat.c -+++ b/kernel/cgroup/rstat.c -@@ -469,7 +469,6 @@ static void root_cgroup_cputime(struct cgroup_base_stat *bstat) - - cputime->sum_exec_runtime += user; - cputime->sum_exec_runtime += sys; -- cputime->sum_exec_runtime += cpustat[CPUTIME_STEAL]; - - #ifdef CONFIG_SCHED_CORE - bstat->forceidle_sum += cpustat[CPUTIME_FORCEIDLE]; -diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c -index aa864999dc21be..3130f24daf5979 100644 ---- a/kernel/time/clocksource.c -+++ b/kernel/time/clocksource.c -@@ -351,16 +351,18 @@ void clocksource_verify_percpu(struct clocksource *cs) - cpumask_clear(&cpus_ahead); - cpumask_clear(&cpus_behind); - cpus_read_lock(); -- preempt_disable(); -+ migrate_disable(); - clocksource_verify_choose_cpus(); - if (cpumask_empty(&cpus_chosen)) { -- preempt_enable(); -+ migrate_enable(); - cpus_read_unlock(); - pr_warn("Not enough CPUs to check clocksource '%s'.\n", cs->name); - return; - } - testcpu = smp_processor_id(); -- pr_warn("Checking clocksource %s synchronization from CPU %d to CPUs %*pbl.\n", cs->name, testcpu, cpumask_pr_args(&cpus_chosen)); -+ pr_info("Checking clocksource %s synchronization from CPU %d to CPUs %*pbl.\n", -+ cs->name, testcpu, cpumask_pr_args(&cpus_chosen)); -+ preempt_disable(); - for_each_cpu(cpu, &cpus_chosen) { - if (cpu == testcpu) - continue; -@@ -380,6 +382,7 @@ void clocksource_verify_percpu(struct clocksource *cs) - cs_nsec_min = cs_nsec; - } - preempt_enable(); -+ migrate_enable(); - cpus_read_unlock(); - if (!cpumask_empty(&cpus_ahead)) - pr_warn(" CPUs %*pbl ahead of CPU %d for clocksource %s.\n", -diff --git a/mm/gup.c b/mm/gup.c -index fdd75384160d8d..69d259f7bf37ec 100644 ---- a/mm/gup.c -+++ b/mm/gup.c -@@ -1946,14 +1946,14 @@ struct page *get_dump_page(unsigned long addr) - /* - * Returns the number of collected pages. Return value is always >= 0. - */ --static unsigned long collect_longterm_unpinnable_pages( -+static void collect_longterm_unpinnable_pages( - struct list_head *movable_page_list, - unsigned long nr_pages, - struct page **pages) - { -- unsigned long i, collected = 0; - struct folio *prev_folio = NULL; - bool drain_allow = true; -+ unsigned long i; - - for (i = 0; i < nr_pages; i++) { - struct folio *folio = page_folio(pages[i]); -@@ -1965,8 +1965,6 @@ static unsigned long collect_longterm_unpinnable_pages( - if (folio_is_longterm_pinnable(folio)) - continue; - -- collected++; -- - if (folio_is_device_coherent(folio)) - continue; - -@@ -1988,8 +1986,6 @@ static unsigned long collect_longterm_unpinnable_pages( - NR_ISOLATED_ANON + folio_is_file_lru(folio), - folio_nr_pages(folio)); - } -- -- return collected; - } - - /* -@@ -2082,12 +2078,10 @@ static int migrate_longterm_unpinnable_pages( - static long check_and_migrate_movable_pages(unsigned long nr_pages, - struct page **pages) - { -- unsigned long collected; - LIST_HEAD(movable_page_list); - -- collected = collect_longterm_unpinnable_pages(&movable_page_list, -- nr_pages, pages); -- if (!collected) -+ collect_longterm_unpinnable_pages(&movable_page_list, nr_pages, pages); -+ if (list_empty(&movable_page_list)) - return 0; - - return migrate_longterm_unpinnable_pages(&movable_page_list, nr_pages, -diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c -index 0f66dd8715bd87..4a16142ac58a94 100644 ---- a/net/ax25/af_ax25.c -+++ b/net/ax25/af_ax25.c -@@ -685,6 +685,15 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, - break; - } - -+ if (ax25->ax25_dev) { -+ if (dev == ax25->ax25_dev->dev) { -+ rcu_read_unlock(); -+ break; -+ } -+ netdev_put(ax25->ax25_dev->dev, &ax25->dev_tracker); -+ ax25_dev_put(ax25->ax25_dev); -+ } -+ - ax25->ax25_dev = ax25_dev_ax25dev(dev); - if (!ax25->ax25_dev) { - rcu_read_unlock(); -@@ -692,6 +701,8 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, - break; - } - ax25_fillin_cb(ax25, ax25->ax25_dev); -+ netdev_hold(dev, &ax25->dev_tracker, GFP_ATOMIC); -+ ax25_dev_hold(ax25->ax25_dev); - rcu_read_unlock(); - break; - -diff --git a/net/batman-adv/bat_v.c b/net/batman-adv/bat_v.c -index ac11f1f08db0f9..d35479c465e2c4 100644 ---- a/net/batman-adv/bat_v.c -+++ b/net/batman-adv/bat_v.c -@@ -113,8 +113,6 @@ static void - batadv_v_hardif_neigh_init(struct batadv_hardif_neigh_node *hardif_neigh) - { - ewma_throughput_init(&hardif_neigh->bat_v.throughput); -- INIT_WORK(&hardif_neigh->bat_v.metric_work, -- batadv_v_elp_throughput_metric_update); - } - - /** -diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c -index 1d704574e6bf54..b065578b4436ee 100644 ---- a/net/batman-adv/bat_v_elp.c -+++ b/net/batman-adv/bat_v_elp.c -@@ -18,6 +18,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -26,6 +27,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -41,6 +43,18 @@ - #include "routing.h" - #include "send.h" - -+/** -+ * struct batadv_v_metric_queue_entry - list of hardif neighbors which require -+ * and metric update -+ */ -+struct batadv_v_metric_queue_entry { -+ /** @hardif_neigh: hardif neighbor scheduled for metric update */ -+ struct batadv_hardif_neigh_node *hardif_neigh; -+ -+ /** @list: list node for metric_queue */ -+ struct list_head list; -+}; -+ - /** - * batadv_v_elp_start_timer() - restart timer for ELP periodic work - * @hard_iface: the interface for which the timer has to be reset -@@ -59,25 +73,36 @@ static void batadv_v_elp_start_timer(struct batadv_hard_iface *hard_iface) - /** - * batadv_v_elp_get_throughput() - get the throughput towards a neighbour - * @neigh: the neighbour for which the throughput has to be obtained -+ * @pthroughput: calculated throughput towards the given neighbour in multiples -+ * of 100kpbs (a value of '1' equals 0.1Mbps, '10' equals 1Mbps, etc). - * -- * Return: The throughput towards the given neighbour in multiples of 100kpbs -- * (a value of '1' equals 0.1Mbps, '10' equals 1Mbps, etc). -+ * Return: true when value behind @pthroughput was set - */ --static u32 batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh) -+static bool batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh, -+ u32 *pthroughput) - { - struct batadv_hard_iface *hard_iface = neigh->if_incoming; -+ struct net_device *soft_iface = hard_iface->soft_iface; - struct ethtool_link_ksettings link_settings; - struct net_device *real_netdev; - struct station_info sinfo; - u32 throughput; - int ret; - -+ /* don't query throughput when no longer associated with any -+ * batman-adv interface -+ */ -+ if (!soft_iface) -+ return false; -+ - /* if the user specified a customised value for this interface, then - * return it directly - */ - throughput = atomic_read(&hard_iface->bat_v.throughput_override); -- if (throughput != 0) -- return throughput; -+ if (throughput != 0) { -+ *pthroughput = throughput; -+ return true; -+ } - - /* if this is a wireless device, then ask its throughput through - * cfg80211 API -@@ -104,27 +129,39 @@ static u32 batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh) - * possible to delete this neighbor. For now set - * the throughput metric to 0. - */ -- return 0; -+ *pthroughput = 0; -+ return true; - } - if (ret) - goto default_throughput; - -- if (sinfo.filled & BIT(NL80211_STA_INFO_EXPECTED_THROUGHPUT)) -- return sinfo.expected_throughput / 100; -+ if (sinfo.filled & BIT(NL80211_STA_INFO_EXPECTED_THROUGHPUT)) { -+ *pthroughput = sinfo.expected_throughput / 100; -+ return true; -+ } - - /* try to estimate the expected throughput based on reported tx - * rates - */ -- if (sinfo.filled & BIT(NL80211_STA_INFO_TX_BITRATE)) -- return cfg80211_calculate_bitrate(&sinfo.txrate) / 3; -+ if (sinfo.filled & BIT(NL80211_STA_INFO_TX_BITRATE)) { -+ *pthroughput = cfg80211_calculate_bitrate(&sinfo.txrate) / 3; -+ return true; -+ } - - goto default_throughput; - } - -+ /* only use rtnl_trylock because the elp worker will be cancelled while -+ * the rntl_lock is held. the cancel_delayed_work_sync() would otherwise -+ * wait forever when the elp work_item was started and it is then also -+ * trying to rtnl_lock -+ */ -+ if (!rtnl_trylock()) -+ return false; -+ - /* if not a wifi interface, check if this device provides data via - * ethtool (e.g. an Ethernet adapter) - */ -- rtnl_lock(); - ret = __ethtool_get_link_ksettings(hard_iface->net_dev, &link_settings); - rtnl_unlock(); - if (ret == 0) { -@@ -135,13 +172,15 @@ static u32 batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh) - hard_iface->bat_v.flags &= ~BATADV_FULL_DUPLEX; - - throughput = link_settings.base.speed; -- if (throughput && throughput != SPEED_UNKNOWN) -- return throughput * 10; -+ if (throughput && throughput != SPEED_UNKNOWN) { -+ *pthroughput = throughput * 10; -+ return true; -+ } - } - - default_throughput: - if (!(hard_iface->bat_v.flags & BATADV_WARNING_DEFAULT)) { -- batadv_info(hard_iface->soft_iface, -+ batadv_info(soft_iface, - "WiFi driver or ethtool info does not provide information about link speeds on interface %s, therefore defaulting to hardcoded throughput values of %u.%1u Mbps. Consider overriding the throughput manually or checking your driver.\n", - hard_iface->net_dev->name, - BATADV_THROUGHPUT_DEFAULT_VALUE / 10, -@@ -150,31 +189,26 @@ static u32 batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh) - } - - /* if none of the above cases apply, return the base_throughput */ -- return BATADV_THROUGHPUT_DEFAULT_VALUE; -+ *pthroughput = BATADV_THROUGHPUT_DEFAULT_VALUE; -+ return true; - } - - /** - * batadv_v_elp_throughput_metric_update() - worker updating the throughput - * metric of a single hop neighbour -- * @work: the work queue item -+ * @neigh: the neighbour to probe - */ --void batadv_v_elp_throughput_metric_update(struct work_struct *work) -+static void -+batadv_v_elp_throughput_metric_update(struct batadv_hardif_neigh_node *neigh) - { -- struct batadv_hardif_neigh_node_bat_v *neigh_bat_v; -- struct batadv_hardif_neigh_node *neigh; -- -- neigh_bat_v = container_of(work, struct batadv_hardif_neigh_node_bat_v, -- metric_work); -- neigh = container_of(neigh_bat_v, struct batadv_hardif_neigh_node, -- bat_v); -+ u32 throughput; -+ bool valid; - -- ewma_throughput_add(&neigh->bat_v.throughput, -- batadv_v_elp_get_throughput(neigh)); -+ valid = batadv_v_elp_get_throughput(neigh, &throughput); -+ if (!valid) -+ return; - -- /* decrement refcounter to balance increment performed before scheduling -- * this task -- */ -- batadv_hardif_neigh_put(neigh); -+ ewma_throughput_add(&neigh->bat_v.throughput, throughput); - } - - /** -@@ -248,14 +282,16 @@ batadv_v_elp_wifi_neigh_probe(struct batadv_hardif_neigh_node *neigh) - */ - static void batadv_v_elp_periodic_work(struct work_struct *work) - { -+ struct batadv_v_metric_queue_entry *metric_entry; -+ struct batadv_v_metric_queue_entry *metric_safe; - struct batadv_hardif_neigh_node *hardif_neigh; - struct batadv_hard_iface *hard_iface; - struct batadv_hard_iface_bat_v *bat_v; - struct batadv_elp_packet *elp_packet; -+ struct list_head metric_queue; - struct batadv_priv *bat_priv; - struct sk_buff *skb; - u32 elp_interval; -- bool ret; - - bat_v = container_of(work, struct batadv_hard_iface_bat_v, elp_wq.work); - hard_iface = container_of(bat_v, struct batadv_hard_iface, bat_v); -@@ -291,6 +327,8 @@ static void batadv_v_elp_periodic_work(struct work_struct *work) - - atomic_inc(&hard_iface->bat_v.elp_seqno); - -+ INIT_LIST_HEAD(&metric_queue); -+ - /* The throughput metric is updated on each sent packet. This way, if a - * node is dead and no longer sends packets, batman-adv is still able to - * react timely to its death. -@@ -315,16 +353,28 @@ static void batadv_v_elp_periodic_work(struct work_struct *work) - - /* Reading the estimated throughput from cfg80211 is a task that - * may sleep and that is not allowed in an rcu protected -- * context. Therefore schedule a task for that. -+ * context. Therefore add it to metric_queue and process it -+ * outside rcu protected context. - */ -- ret = queue_work(batadv_event_workqueue, -- &hardif_neigh->bat_v.metric_work); -- -- if (!ret) -+ metric_entry = kzalloc(sizeof(*metric_entry), GFP_ATOMIC); -+ if (!metric_entry) { - batadv_hardif_neigh_put(hardif_neigh); -+ continue; -+ } -+ -+ metric_entry->hardif_neigh = hardif_neigh; -+ list_add(&metric_entry->list, &metric_queue); - } - rcu_read_unlock(); - -+ list_for_each_entry_safe(metric_entry, metric_safe, &metric_queue, list) { -+ batadv_v_elp_throughput_metric_update(metric_entry->hardif_neigh); -+ -+ batadv_hardif_neigh_put(metric_entry->hardif_neigh); -+ list_del(&metric_entry->list); -+ kfree(metric_entry); -+ } -+ - restart_timer: - batadv_v_elp_start_timer(hard_iface); - out: -diff --git a/net/batman-adv/bat_v_elp.h b/net/batman-adv/bat_v_elp.h -index 9e2740195fa2d4..c9cb0a30710045 100644 ---- a/net/batman-adv/bat_v_elp.h -+++ b/net/batman-adv/bat_v_elp.h -@@ -10,7 +10,6 @@ - #include "main.h" - - #include --#include - - int batadv_v_elp_iface_enable(struct batadv_hard_iface *hard_iface); - void batadv_v_elp_iface_disable(struct batadv_hard_iface *hard_iface); -@@ -19,6 +18,5 @@ void batadv_v_elp_iface_activate(struct batadv_hard_iface *primary_iface, - void batadv_v_elp_primary_iface_set(struct batadv_hard_iface *primary_iface); - int batadv_v_elp_packet_recv(struct sk_buff *skb, - struct batadv_hard_iface *if_incoming); --void batadv_v_elp_throughput_metric_update(struct work_struct *work); - - #endif /* _NET_BATMAN_ADV_BAT_V_ELP_H_ */ -diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h -index 17d5ea1d8e84e3..d6854c109cd291 100644 ---- a/net/batman-adv/types.h -+++ b/net/batman-adv/types.h -@@ -596,9 +596,6 @@ struct batadv_hardif_neigh_node_bat_v { - * neighbor - */ - unsigned long last_unicast_tx; -- -- /** @metric_work: work queue callback item for metric update */ -- struct work_struct metric_work; - }; - - /** -diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c -index 1f49d6164ea1da..cf9a12d8da6f90 100644 ---- a/net/can/j1939/socket.c -+++ b/net/can/j1939/socket.c -@@ -1132,7 +1132,7 @@ static int j1939_sk_send_loop(struct j1939_priv *priv, struct sock *sk, - - todo_size = size; - -- while (todo_size) { -+ do { - struct j1939_sk_buff_cb *skcb; - - segment_size = min_t(size_t, J1939_MAX_TP_PACKET_SIZE, -@@ -1177,7 +1177,7 @@ static int j1939_sk_send_loop(struct j1939_priv *priv, struct sock *sk, - - todo_size -= segment_size; - session->total_queued_size += segment_size; -- } -+ } while (todo_size); - - switch (ret) { - case 0: /* OK */ -diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c -index 95f7a7e65a73fa..9b72d118d756dd 100644 ---- a/net/can/j1939/transport.c -+++ b/net/can/j1939/transport.c -@@ -382,8 +382,9 @@ sk_buff *j1939_session_skb_get_by_offset(struct j1939_session *session, - skb_queue_walk(&session->skb_queue, do_skb) { - do_skcb = j1939_skb_to_cb(do_skb); - -- if (offset_start >= do_skcb->offset && -- offset_start < (do_skcb->offset + do_skb->len)) { -+ if ((offset_start >= do_skcb->offset && -+ offset_start < (do_skcb->offset + do_skb->len)) || -+ (offset_start == 0 && do_skcb->offset == 0 && do_skb->len == 0)) { - skb = do_skb; - } - } -diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c -index b22d20cc417b21..00a5c41c1831df 100644 ---- a/net/core/flow_dissector.c -+++ b/net/core/flow_dissector.c -@@ -1084,10 +1084,12 @@ bool __skb_flow_dissect(const struct net *net, - FLOW_DISSECTOR_KEY_BASIC, - target_container); - -+ rcu_read_lock(); -+ - if (skb) { - if (!net) { - if (skb->dev) -- net = dev_net(skb->dev); -+ net = dev_net_rcu(skb->dev); - else if (skb->sk) - net = sock_net(skb->sk); - } -@@ -1098,7 +1100,6 @@ bool __skb_flow_dissect(const struct net *net, - enum netns_bpf_attach_type type = NETNS_BPF_FLOW_DISSECTOR; - struct bpf_prog_array *run_array; - -- rcu_read_lock(); - run_array = rcu_dereference(init_net.bpf.run_array[type]); - if (!run_array) - run_array = rcu_dereference(net->bpf.run_array[type]); -@@ -1126,17 +1127,17 @@ bool __skb_flow_dissect(const struct net *net, - prog = READ_ONCE(run_array->items[0].prog); - result = bpf_flow_dissect(prog, &ctx, n_proto, nhoff, - hlen, flags); -- if (result == BPF_FLOW_DISSECTOR_CONTINUE) -- goto dissect_continue; -- __skb_flow_bpf_to_target(&flow_keys, flow_dissector, -- target_container); -- rcu_read_unlock(); -- return result == BPF_OK; -+ if (result != BPF_FLOW_DISSECTOR_CONTINUE) { -+ __skb_flow_bpf_to_target(&flow_keys, flow_dissector, -+ target_container); -+ rcu_read_unlock(); -+ return result == BPF_OK; -+ } - } --dissect_continue: -- rcu_read_unlock(); - } - -+ rcu_read_unlock(); -+ - if (dissector_uses_key(flow_dissector, - FLOW_DISSECTOR_KEY_ETH_ADDRS)) { - struct ethhdr *eth = eth_hdr(skb); -diff --git a/net/core/neighbour.c b/net/core/neighbour.c -index cb0c233e83962f..e44feb39d459a7 100644 ---- a/net/core/neighbour.c -+++ b/net/core/neighbour.c -@@ -3508,10 +3508,12 @@ static const struct seq_operations neigh_stat_seq_ops = { - static void __neigh_notify(struct neighbour *n, int type, int flags, - u32 pid) - { -- struct net *net = dev_net(n->dev); - struct sk_buff *skb; - int err = -ENOBUFS; -+ struct net *net; - -+ rcu_read_lock(); -+ net = dev_net_rcu(n->dev); - skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC); - if (skb == NULL) - goto errout; -@@ -3524,10 +3526,11 @@ static void __neigh_notify(struct neighbour *n, int type, int flags, - goto errout; - } - rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC); -- return; -+ goto out; - errout: -- if (err < 0) -- rtnl_set_sk_err(net, RTNLGRP_NEIGH, err); -+ rtnl_set_sk_err(net, RTNLGRP_NEIGH, err); -+out: -+ rcu_read_unlock(); - } - - void neigh_app_ns(struct neighbour *n) -diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c -index 0d0d725b46ad0c..02776453bf97a8 100644 ---- a/net/ipv4/arp.c -+++ b/net/ipv4/arp.c -@@ -658,10 +658,12 @@ static int arp_xmit_finish(struct net *net, struct sock *sk, struct sk_buff *skb - */ - void arp_xmit(struct sk_buff *skb) - { -+ rcu_read_lock(); - /* Send it off, maybe filter it using firewalling first. */ - NF_HOOK(NFPROTO_ARP, NF_ARP_OUT, -- dev_net(skb->dev), NULL, skb, NULL, skb->dev, -+ dev_net_rcu(skb->dev), NULL, skb, NULL, skb->dev, - arp_xmit_finish); -+ rcu_read_unlock(); - } - EXPORT_SYMBOL(arp_xmit); - -diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c -index 4822f68edbf08b..c33b1ecc591e4e 100644 ---- a/net/ipv4/devinet.c -+++ b/net/ipv4/devinet.c -@@ -1341,10 +1341,11 @@ __be32 inet_select_addr(const struct net_device *dev, __be32 dst, int scope) - __be32 addr = 0; - unsigned char localnet_scope = RT_SCOPE_HOST; - struct in_device *in_dev; -- struct net *net = dev_net(dev); -+ struct net *net; - int master_idx; - - rcu_read_lock(); -+ net = dev_net_rcu(dev); - in_dev = __in_dev_get_rcu(dev); - if (!in_dev) - goto no_in_dev; -diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c -index a6adf6a2ec4b57..a21d32b3ae6c36 100644 ---- a/net/ipv4/icmp.c -+++ b/net/ipv4/icmp.c -@@ -403,10 +403,10 @@ static void icmp_push_reply(struct sock *sk, - - static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb) - { -- struct ipcm_cookie ipc; - struct rtable *rt = skb_rtable(skb); -- struct net *net = dev_net(rt->dst.dev); -+ struct net *net = dev_net_rcu(rt->dst.dev); - bool apply_ratelimit = false; -+ struct ipcm_cookie ipc; - struct flowi4 fl4; - struct sock *sk; - struct inet_sock *inet; -@@ -609,12 +609,14 @@ void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info, - struct sock *sk; - - if (!rt) -- goto out; -+ return; -+ -+ rcu_read_lock(); - - if (rt->dst.dev) -- net = dev_net(rt->dst.dev); -+ net = dev_net_rcu(rt->dst.dev); - else if (skb_in->dev) -- net = dev_net(skb_in->dev); -+ net = dev_net_rcu(skb_in->dev); - else - goto out; - -@@ -783,7 +785,8 @@ void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info, - icmp_xmit_unlock(sk); - out_bh_enable: - local_bh_enable(); --out:; -+out: -+ rcu_read_unlock(); - } - EXPORT_SYMBOL(__icmp_send); - -@@ -832,7 +835,7 @@ static void icmp_socket_deliver(struct sk_buff *skb, u32 info) - * avoid additional coding at protocol handlers. - */ - if (!pskb_may_pull(skb, iph->ihl * 4 + 8)) { -- __ICMP_INC_STATS(dev_net(skb->dev), ICMP_MIB_INERRORS); -+ __ICMP_INC_STATS(dev_net_rcu(skb->dev), ICMP_MIB_INERRORS); - return; - } - -@@ -866,7 +869,7 @@ static enum skb_drop_reason icmp_unreach(struct sk_buff *skb) - struct net *net; - u32 info = 0; - -- net = dev_net(skb_dst(skb)->dev); -+ net = dev_net_rcu(skb_dst(skb)->dev); - - /* - * Incomplete header ? -@@ -977,7 +980,7 @@ static enum skb_drop_reason icmp_unreach(struct sk_buff *skb) - static enum skb_drop_reason icmp_redirect(struct sk_buff *skb) - { - if (skb->len < sizeof(struct iphdr)) { -- __ICMP_INC_STATS(dev_net(skb->dev), ICMP_MIB_INERRORS); -+ __ICMP_INC_STATS(dev_net_rcu(skb->dev), ICMP_MIB_INERRORS); - return SKB_DROP_REASON_PKT_TOO_SMALL; - } - -@@ -1009,7 +1012,7 @@ static enum skb_drop_reason icmp_echo(struct sk_buff *skb) - struct icmp_bxm icmp_param; - struct net *net; - -- net = dev_net(skb_dst(skb)->dev); -+ net = dev_net_rcu(skb_dst(skb)->dev); - /* should there be an ICMP stat for ignored echos? */ - if (READ_ONCE(net->ipv4.sysctl_icmp_echo_ignore_all)) - return SKB_NOT_DROPPED_YET; -@@ -1038,9 +1041,9 @@ static enum skb_drop_reason icmp_echo(struct sk_buff *skb) - - bool icmp_build_probe(struct sk_buff *skb, struct icmphdr *icmphdr) - { -+ struct net *net = dev_net_rcu(skb->dev); - struct icmp_ext_hdr *ext_hdr, _ext_hdr; - struct icmp_ext_echo_iio *iio, _iio; -- struct net *net = dev_net(skb->dev); - struct inet6_dev *in6_dev; - struct in_device *in_dev; - struct net_device *dev; -@@ -1179,7 +1182,7 @@ static enum skb_drop_reason icmp_timestamp(struct sk_buff *skb) - return SKB_NOT_DROPPED_YET; - - out_err: -- __ICMP_INC_STATS(dev_net(skb_dst(skb)->dev), ICMP_MIB_INERRORS); -+ __ICMP_INC_STATS(dev_net_rcu(skb_dst(skb)->dev), ICMP_MIB_INERRORS); - return SKB_DROP_REASON_PKT_TOO_SMALL; - } - -@@ -1196,7 +1199,7 @@ int icmp_rcv(struct sk_buff *skb) - { - enum skb_drop_reason reason = SKB_DROP_REASON_NOT_SPECIFIED; - struct rtable *rt = skb_rtable(skb); -- struct net *net = dev_net(rt->dst.dev); -+ struct net *net = dev_net_rcu(rt->dst.dev); - struct icmphdr *icmph; - - if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) { -@@ -1369,9 +1372,9 @@ int icmp_err(struct sk_buff *skb, u32 info) - struct iphdr *iph = (struct iphdr *)skb->data; - int offset = iph->ihl<<2; - struct icmphdr *icmph = (struct icmphdr *)(skb->data + offset); -+ struct net *net = dev_net_rcu(skb->dev); - int type = icmp_hdr(skb)->type; - int code = icmp_hdr(skb)->code; -- struct net *net = dev_net(skb->dev); - - /* - * Use ping_err to handle all icmp errors except those -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 61fc2166a870e6..97dc30a03dbf26 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -393,7 +393,13 @@ static inline int ip_rt_proc_init(void) - - static inline bool rt_is_expired(const struct rtable *rth) - { -- return rth->rt_genid != rt_genid_ipv4(dev_net(rth->dst.dev)); -+ bool res; -+ -+ rcu_read_lock(); -+ res = rth->rt_genid != rt_genid_ipv4(dev_net_rcu(rth->dst.dev)); -+ rcu_read_unlock(); -+ -+ return res; - } - - void rt_cache_flush(struct net *net) -@@ -1014,9 +1020,9 @@ out: kfree_skb_reason(skb, reason); - static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu) - { - struct dst_entry *dst = &rt->dst; -- struct net *net = dev_net(dst->dev); - struct fib_result res; - bool lock = false; -+ struct net *net; - u32 old_mtu; - - if (ip_mtu_locked(dst)) -@@ -1026,6 +1032,8 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu) - if (old_mtu < mtu) - return; - -+ rcu_read_lock(); -+ net = dev_net_rcu(dst->dev); - if (mtu < net->ipv4.ip_rt_min_pmtu) { - lock = true; - mtu = min(old_mtu, net->ipv4.ip_rt_min_pmtu); -@@ -1033,17 +1041,29 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu) - - if (rt->rt_pmtu == mtu && !lock && - time_before(jiffies, dst->expires - net->ipv4.ip_rt_mtu_expires / 2)) -- return; -+ goto out; - -- rcu_read_lock(); - if (fib_lookup(net, fl4, &res, 0) == 0) { - struct fib_nh_common *nhc; - - fib_select_path(net, &res, fl4, NULL); -+#ifdef CONFIG_IP_ROUTE_MULTIPATH -+ if (fib_info_num_path(res.fi) > 1) { -+ int nhsel; -+ -+ for (nhsel = 0; nhsel < fib_info_num_path(res.fi); nhsel++) { -+ nhc = fib_info_nhc(res.fi, nhsel); -+ update_or_create_fnhe(nhc, fl4->daddr, 0, mtu, lock, -+ jiffies + net->ipv4.ip_rt_mtu_expires); -+ } -+ goto out; -+ } -+#endif /* CONFIG_IP_ROUTE_MULTIPATH */ - nhc = FIB_RES_NHC(res); - update_or_create_fnhe(nhc, fl4->daddr, 0, mtu, lock, - jiffies + net->ipv4.ip_rt_mtu_expires); - } -+out: - rcu_read_unlock(); - } - -@@ -1306,10 +1326,15 @@ static void set_class_tag(struct rtable *rt, u32 tag) - - static unsigned int ipv4_default_advmss(const struct dst_entry *dst) - { -- struct net *net = dev_net(dst->dev); - unsigned int header_size = sizeof(struct tcphdr) + sizeof(struct iphdr); -- unsigned int advmss = max_t(unsigned int, ipv4_mtu(dst) - header_size, -- net->ipv4.ip_rt_min_advmss); -+ unsigned int advmss; -+ struct net *net; -+ -+ rcu_read_lock(); -+ net = dev_net_rcu(dst->dev); -+ advmss = max_t(unsigned int, ipv4_mtu(dst) - header_size, -+ net->ipv4.ip_rt_min_advmss); -+ rcu_read_unlock(); - - return min(advmss, IPV4_MAX_PMTU - header_size); - } -diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c -index 35df405ce1f753..fd91fd139d76cf 100644 ---- a/net/ipv6/icmp.c -+++ b/net/ipv6/icmp.c -@@ -76,7 +76,7 @@ static int icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, - { - /* icmpv6_notify checks 8 bytes can be pulled, icmp6hdr is 8 bytes */ - struct icmp6hdr *icmp6 = (struct icmp6hdr *) (skb->data + offset); -- struct net *net = dev_net(skb->dev); -+ struct net *net = dev_net_rcu(skb->dev); - - if (type == ICMPV6_PKT_TOOBIG) - ip6_update_pmtu(skb, net, info, skb->dev->ifindex, 0, sock_net_uid(net, NULL)); -@@ -473,7 +473,10 @@ void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, - - if (!skb->dev) - return; -- net = dev_net(skb->dev); -+ -+ rcu_read_lock(); -+ -+ net = dev_net_rcu(skb->dev); - mark = IP6_REPLY_MARK(net, skb->mark); - /* - * Make sure we respect the rules -@@ -496,7 +499,7 @@ void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, - !(type == ICMPV6_PARAMPROB && - code == ICMPV6_UNK_OPTION && - (opt_unrec(skb, info)))) -- return; -+ goto out; - - saddr = NULL; - } -@@ -526,7 +529,7 @@ void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, - if ((addr_type == IPV6_ADDR_ANY) || (addr_type & IPV6_ADDR_MULTICAST)) { - net_dbg_ratelimited("icmp6_send: addr_any/mcast source [%pI6c > %pI6c]\n", - &hdr->saddr, &hdr->daddr); -- return; -+ goto out; - } - - /* -@@ -535,7 +538,7 @@ void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, - if (is_ineligible(skb)) { - net_dbg_ratelimited("icmp6_send: no reply to icmp error [%pI6c > %pI6c]\n", - &hdr->saddr, &hdr->daddr); -- return; -+ goto out; - } - - /* Needed by both icmpv6_global_allow and icmpv6_xmit_lock */ -@@ -582,7 +585,7 @@ void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, - np = inet6_sk(sk); - - if (!icmpv6_xrlim_allow(sk, type, &fl6, apply_ratelimit)) -- goto out; -+ goto out_unlock; - - tmp_hdr.icmp6_type = type; - tmp_hdr.icmp6_code = code; -@@ -600,7 +603,7 @@ void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, - - dst = icmpv6_route_lookup(net, skb, sk, &fl6); - if (IS_ERR(dst)) -- goto out; -+ goto out_unlock; - - ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst); - -@@ -616,7 +619,6 @@ void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, - goto out_dst_release; - } - -- rcu_read_lock(); - idev = __in6_dev_get(skb->dev); - - if (ip6_append_data(sk, icmpv6_getfrag, &msg, -@@ -630,13 +632,15 @@ void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, - icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr, - len + sizeof(struct icmp6hdr)); - } -- rcu_read_unlock(); -+ - out_dst_release: - dst_release(dst); --out: -+out_unlock: - icmpv6_xmit_unlock(sk); - out_bh_enable: - local_bh_enable(); -+out: -+ rcu_read_unlock(); - } - EXPORT_SYMBOL(icmp6_send); - -@@ -679,8 +683,8 @@ int ip6_err_gen_icmpv6_unreach(struct sk_buff *skb, int nhs, int type, - skb_pull(skb2, nhs); - skb_reset_network_header(skb2); - -- rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr, NULL, 0, -- skb, 0); -+ rt = rt6_lookup(dev_net_rcu(skb->dev), &ipv6_hdr(skb2)->saddr, -+ NULL, 0, skb, 0); - - if (rt && rt->dst.dev) - skb2->dev = rt->dst.dev; -@@ -717,7 +721,7 @@ EXPORT_SYMBOL(ip6_err_gen_icmpv6_unreach); - - static enum skb_drop_reason icmpv6_echo_reply(struct sk_buff *skb) - { -- struct net *net = dev_net(skb->dev); -+ struct net *net = dev_net_rcu(skb->dev); - struct sock *sk; - struct inet6_dev *idev; - struct ipv6_pinfo *np; -@@ -832,7 +836,7 @@ enum skb_drop_reason icmpv6_notify(struct sk_buff *skb, u8 type, - u8 code, __be32 info) - { - struct inet6_skb_parm *opt = IP6CB(skb); -- struct net *net = dev_net(skb->dev); -+ struct net *net = dev_net_rcu(skb->dev); - const struct inet6_protocol *ipprot; - enum skb_drop_reason reason; - int inner_offset; -@@ -889,7 +893,7 @@ enum skb_drop_reason icmpv6_notify(struct sk_buff *skb, u8 type, - static int icmpv6_rcv(struct sk_buff *skb) - { - enum skb_drop_reason reason = SKB_DROP_REASON_NOT_SPECIFIED; -- struct net *net = dev_net(skb->dev); -+ struct net *net = dev_net_rcu(skb->dev); - struct net_device *dev = icmp6_dev(skb); - struct inet6_dev *idev = __in6_dev_get(dev); - const struct in6_addr *saddr, *daddr; -@@ -921,7 +925,7 @@ static int icmpv6_rcv(struct sk_buff *skb) - skb_set_network_header(skb, nh); - } - -- __ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_INMSGS); -+ __ICMP6_INC_STATS(dev_net_rcu(dev), idev, ICMP6_MIB_INMSGS); - - saddr = &ipv6_hdr(skb)->saddr; - daddr = &ipv6_hdr(skb)->daddr; -@@ -939,7 +943,7 @@ static int icmpv6_rcv(struct sk_buff *skb) - - type = hdr->icmp6_type; - -- ICMP6MSGIN_INC_STATS(dev_net(dev), idev, type); -+ ICMP6MSGIN_INC_STATS(dev_net_rcu(dev), idev, type); - - switch (type) { - case ICMPV6_ECHO_REQUEST: -@@ -1034,9 +1038,9 @@ static int icmpv6_rcv(struct sk_buff *skb) - - csum_error: - reason = SKB_DROP_REASON_ICMP_CSUM; -- __ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_CSUMERRORS); -+ __ICMP6_INC_STATS(dev_net_rcu(dev), idev, ICMP6_MIB_CSUMERRORS); - discard_it: -- __ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_INERRORS); -+ __ICMP6_INC_STATS(dev_net_rcu(dev), idev, ICMP6_MIB_INERRORS); - drop_no_count: - kfree_skb_reason(skb, reason); - return 0; -diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c -index 6e2f77a95a657a..9bb246c09fcee8 100644 ---- a/net/ipv6/mcast.c -+++ b/net/ipv6/mcast.c -@@ -1729,21 +1729,19 @@ static struct sk_buff *mld_newpack(struct inet6_dev *idev, unsigned int mtu) - struct net_device *dev = idev->dev; - int hlen = LL_RESERVED_SPACE(dev); - int tlen = dev->needed_tailroom; -- struct net *net = dev_net(dev); - const struct in6_addr *saddr; - struct in6_addr addr_buf; - struct mld2_report *pmr; - struct sk_buff *skb; - unsigned int size; - struct sock *sk; -- int err; -+ struct net *net; - -- sk = net->ipv6.igmp_sk; - /* we assume size > sizeof(ra) here - * Also try to not allocate high-order pages for big MTU - */ - size = min_t(int, mtu, PAGE_SIZE / 2) + hlen + tlen; -- skb = sock_alloc_send_skb(sk, size, 1, &err); -+ skb = alloc_skb(size, GFP_KERNEL); - if (!skb) - return NULL; - -@@ -1751,6 +1749,12 @@ static struct sk_buff *mld_newpack(struct inet6_dev *idev, unsigned int mtu) - skb_reserve(skb, hlen); - skb_tailroom_reserve(skb, mtu, tlen); - -+ rcu_read_lock(); -+ -+ net = dev_net_rcu(dev); -+ sk = net->ipv6.igmp_sk; -+ skb_set_owner_w(skb, sk); -+ - if (ipv6_get_lladdr(dev, &addr_buf, IFA_F_TENTATIVE)) { - /* : - * use unspecified address as the source address -@@ -1762,6 +1766,8 @@ static struct sk_buff *mld_newpack(struct inet6_dev *idev, unsigned int mtu) - - ip6_mc_hdr(sk, skb, dev, saddr, &mld2_all_mcr, NEXTHDR_HOP, 0); - -+ rcu_read_unlock(); -+ - skb_put_data(skb, ra, sizeof(ra)); - - skb_set_transport_header(skb, skb_tail_pointer(skb) - skb->data); -@@ -2121,21 +2127,21 @@ static void mld_send_cr(struct inet6_dev *idev) - - static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) - { -- struct net *net = dev_net(dev); -- struct sock *sk = net->ipv6.igmp_sk; -+ const struct in6_addr *snd_addr, *saddr; -+ int err, len, payload_len, full_len; -+ struct in6_addr addr_buf; - struct inet6_dev *idev; - struct sk_buff *skb; - struct mld_msg *hdr; -- const struct in6_addr *snd_addr, *saddr; -- struct in6_addr addr_buf; - int hlen = LL_RESERVED_SPACE(dev); - int tlen = dev->needed_tailroom; -- int err, len, payload_len, full_len; - u8 ra[8] = { IPPROTO_ICMPV6, 0, - IPV6_TLV_ROUTERALERT, 2, 0, 0, - IPV6_TLV_PADN, 0 }; -- struct flowi6 fl6; - struct dst_entry *dst; -+ struct flowi6 fl6; -+ struct net *net; -+ struct sock *sk; - - if (type == ICMPV6_MGM_REDUCTION) - snd_addr = &in6addr_linklocal_allrouters; -@@ -2146,19 +2152,21 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) - payload_len = len + sizeof(ra); - full_len = sizeof(struct ipv6hdr) + payload_len; - -- rcu_read_lock(); -- IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_OUTREQUESTS); -- rcu_read_unlock(); -+ skb = alloc_skb(hlen + tlen + full_len, GFP_KERNEL); - -- skb = sock_alloc_send_skb(sk, hlen + tlen + full_len, 1, &err); -+ rcu_read_lock(); - -+ net = dev_net_rcu(dev); -+ idev = __in6_dev_get(dev); -+ IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS); - if (!skb) { -- rcu_read_lock(); -- IP6_INC_STATS(net, __in6_dev_get(dev), -- IPSTATS_MIB_OUTDISCARDS); -+ IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); - rcu_read_unlock(); - return; - } -+ sk = net->ipv6.igmp_sk; -+ skb_set_owner_w(skb, sk); -+ - skb->priority = TC_PRIO_CONTROL; - skb_reserve(skb, hlen); - -@@ -2183,9 +2191,6 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) - IPPROTO_ICMPV6, - csum_partial(hdr, len, 0)); - -- rcu_read_lock(); -- idev = __in6_dev_get(skb->dev); -- - icmpv6_flow_init(sk, &fl6, type, - &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr, - skb->dev->ifindex); -diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c -index 2ad0ef47b07c24..8d853971f2f68e 100644 ---- a/net/ipv6/ndisc.c -+++ b/net/ipv6/ndisc.c -@@ -418,15 +418,11 @@ static struct sk_buff *ndisc_alloc_skb(struct net_device *dev, - { - int hlen = LL_RESERVED_SPACE(dev); - int tlen = dev->needed_tailroom; -- struct sock *sk = dev_net(dev)->ipv6.ndisc_sk; - struct sk_buff *skb; - - skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC); -- if (!skb) { -- ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n", -- __func__); -+ if (!skb) - return NULL; -- } - - skb->protocol = htons(ETH_P_IPV6); - skb->dev = dev; -@@ -437,7 +433,9 @@ static struct sk_buff *ndisc_alloc_skb(struct net_device *dev, - /* Manually assign socket ownership as we avoid calling - * sock_alloc_send_pskb() to bypass wmem buffer limits - */ -- skb_set_owner_w(skb, sk); -+ rcu_read_lock(); -+ skb_set_owner_w(skb, dev_net_rcu(dev)->ipv6.ndisc_sk); -+ rcu_read_unlock(); - - return skb; - } -@@ -473,16 +471,20 @@ static void ip6_nd_hdr(struct sk_buff *skb, - void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr, - const struct in6_addr *saddr) - { -+ struct icmp6hdr *icmp6h = icmp6_hdr(skb); - struct dst_entry *dst = skb_dst(skb); -- struct net *net = dev_net(skb->dev); -- struct sock *sk = net->ipv6.ndisc_sk; - struct inet6_dev *idev; -+ struct net *net; -+ struct sock *sk; - int err; -- struct icmp6hdr *icmp6h = icmp6_hdr(skb); - u8 type; - - type = icmp6h->icmp6_type; - -+ rcu_read_lock(); -+ -+ net = dev_net_rcu(skb->dev); -+ sk = net->ipv6.ndisc_sk; - if (!dst) { - struct flowi6 fl6; - int oif = skb->dev->ifindex; -@@ -490,6 +492,7 @@ void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr, - icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif); - dst = icmp6_dst_alloc(skb->dev, &fl6); - if (IS_ERR(dst)) { -+ rcu_read_unlock(); - kfree_skb(skb); - return; - } -@@ -504,7 +507,6 @@ void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr, - - ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len); - -- rcu_read_lock(); - idev = __in6_dev_get(dst->dev); - IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS); - -@@ -1680,7 +1682,7 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target) - bool ret; - - if (netif_is_l3_master(skb->dev)) { -- dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif); -+ dev = dev_get_by_index_rcu(dev_net(skb->dev), IPCB(skb)->iif); - if (!dev) - return; - } -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index c5cee40a658b46..5715d54f3d0bed 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -3188,13 +3188,18 @@ static unsigned int ip6_default_advmss(const struct dst_entry *dst) - { - struct net_device *dev = dst->dev; - unsigned int mtu = dst_mtu(dst); -- struct net *net = dev_net(dev); -+ struct net *net; - - mtu -= sizeof(struct ipv6hdr) + sizeof(struct tcphdr); - -+ rcu_read_lock(); -+ -+ net = dev_net_rcu(dev); - if (mtu < net->ipv6.sysctl.ip6_rt_min_advmss) - mtu = net->ipv6.sysctl.ip6_rt_min_advmss; - -+ rcu_read_unlock(); -+ - /* - * Maximal non-jumbo IPv6 payload is IPV6_MAXPLEN and - * corresponding MSS is IPV6_MAXPLEN - tcp_header_size. -diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c -index b7232142c13f83..cb52fac7caa3cd 100644 ---- a/net/openvswitch/datapath.c -+++ b/net/openvswitch/datapath.c -@@ -2103,6 +2103,7 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb, - { - struct ovs_header *ovs_header; - struct ovs_vport_stats vport_stats; -+ struct net *net_vport; - int err; - - ovs_header = genlmsg_put(skb, portid, seq, &dp_vport_genl_family, -@@ -2119,12 +2120,15 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb, - nla_put_u32(skb, OVS_VPORT_ATTR_IFINDEX, vport->dev->ifindex)) - goto nla_put_failure; - -- if (!net_eq(net, dev_net(vport->dev))) { -- int id = peernet2id_alloc(net, dev_net(vport->dev), gfp); -+ rcu_read_lock(); -+ net_vport = dev_net_rcu(vport->dev); -+ if (!net_eq(net, net_vport)) { -+ int id = peernet2id_alloc(net, net_vport, GFP_ATOMIC); - - if (nla_put_s32(skb, OVS_VPORT_ATTR_NETNSID, id)) -- goto nla_put_failure; -+ goto nla_put_failure_unlock; - } -+ rcu_read_unlock(); - - ovs_vport_get_stats(vport, &vport_stats); - if (nla_put_64bit(skb, OVS_VPORT_ATTR_STATS, -@@ -2145,6 +2149,8 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb, - genlmsg_end(skb, ovs_header); - return 0; - -+nla_put_failure_unlock: -+ rcu_read_unlock(); - nla_put_failure: - err = -EMSGSIZE; - error: -diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c -index f4dbf5f87962d9..618b18e80cea04 100644 ---- a/net/vmw_vsock/af_vsock.c -+++ b/net/vmw_vsock/af_vsock.c -@@ -336,7 +336,10 @@ EXPORT_SYMBOL_GPL(vsock_find_connected_socket); - - void vsock_remove_sock(struct vsock_sock *vsk) - { -- vsock_remove_bound(vsk); -+ /* Transport reassignment must not remove the binding. */ -+ if (sock_flag(sk_vsock(vsk), SOCK_DEAD)) -+ vsock_remove_bound(vsk); -+ - vsock_remove_connected(vsk); - } - EXPORT_SYMBOL_GPL(vsock_remove_sock); -@@ -820,6 +823,13 @@ static void __vsock_release(struct sock *sk, int level) - */ - lock_sock_nested(sk, level); - -+ /* Indicate to vsock_remove_sock() that the socket is being released and -+ * can be removed from the bound_table. Unlike transport reassignment -+ * case, where the socket must remain bound despite vsock_remove_sock() -+ * being called from the transport release() callback. -+ */ -+ sock_set_flag(sk, SOCK_DEAD); -+ - if (vsk->transport) - vsk->transport->release(vsk); - else if (sock_type_connectible(sk->sk_type)) -diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c -index ddf68be0af14a5..ce80adc30fe946 100644 ---- a/sound/soc/intel/boards/bytcr_rt5640.c -+++ b/sound/soc/intel/boards/bytcr_rt5640.c -@@ -1132,7 +1132,22 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { - BYT_RT5640_SSP0_AIF2 | - BYT_RT5640_MCLK_EN), - }, -- { /* Vexia Edu Atla 10 tablet */ -+ { -+ /* Vexia Edu Atla 10 tablet 5V version */ -+ .matches = { -+ /* Having all 3 of these not set is somewhat unique */ -+ DMI_MATCH(DMI_SYS_VENDOR, "To be filled by O.E.M."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "To be filled by O.E.M."), -+ DMI_MATCH(DMI_BOARD_NAME, "To be filled by O.E.M."), -+ /* Above strings are too generic, also match on BIOS date */ -+ DMI_MATCH(DMI_BIOS_DATE, "05/14/2015"), -+ }, -+ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS | -+ BYT_RT5640_JD_NOT_INV | -+ BYT_RT5640_SSP0_AIF1 | -+ BYT_RT5640_MCLK_EN), -+ }, -+ { /* Vexia Edu Atla 10 tablet 9V version */ - .matches = { - DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"), - DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"), -diff --git a/tools/testing/selftests/gpio/gpio-sim.sh b/tools/testing/selftests/gpio/gpio-sim.sh -index 6fb66a687f1737..bbc29ed9c60a91 100755 ---- a/tools/testing/selftests/gpio/gpio-sim.sh -+++ b/tools/testing/selftests/gpio/gpio-sim.sh -@@ -46,12 +46,6 @@ remove_chip() { - rmdir $CONFIGFS_DIR/$CHIP || fail "Unable to remove the chip" - } - --configfs_cleanup() { -- for CHIP in `ls $CONFIGFS_DIR/`; do -- remove_chip $CHIP -- done --} -- - create_chip() { - local CHIP=$1 - -@@ -105,6 +99,13 @@ disable_chip() { - echo 0 > $CONFIGFS_DIR/$CHIP/live || fail "Unable to disable the chip" - } - -+configfs_cleanup() { -+ for CHIP in `ls $CONFIGFS_DIR/`; do -+ disable_chip $CHIP -+ remove_chip $CHIP -+ done -+} -+ - configfs_chip_name() { - local CHIP=$1 - local BANK=$2 -@@ -181,6 +182,7 @@ create_chip chip - create_bank chip bank - enable_chip chip - test -n `cat $CONFIGFS_DIR/chip/bank/chip_name` || fail "chip_name doesn't work" -+disable_chip chip - remove_chip chip - - echo "1.2. chip_name returns 'none' if the chip is still pending" -@@ -195,6 +197,7 @@ create_chip chip - create_bank chip bank - enable_chip chip - test -n `cat $CONFIGFS_DIR/chip/dev_name` || fail "dev_name doesn't work" -+disable_chip chip - remove_chip chip - - echo "2. Creating and configuring simulated chips" -@@ -204,6 +207,7 @@ create_chip chip - create_bank chip bank - enable_chip chip - test "`get_chip_num_lines chip bank`" = "1" || fail "default number of lines is not 1" -+disable_chip chip - remove_chip chip - - echo "2.2. Number of lines can be specified" -@@ -212,6 +216,7 @@ create_bank chip bank - set_num_lines chip bank 16 - enable_chip chip - test "`get_chip_num_lines chip bank`" = "16" || fail "number of lines is not 16" -+disable_chip chip - remove_chip chip - - echo "2.3. Label can be set" -@@ -220,6 +225,7 @@ create_bank chip bank - set_label chip bank foobar - enable_chip chip - test "`get_chip_label chip bank`" = "foobar" || fail "label is incorrect" -+disable_chip chip - remove_chip chip - - echo "2.4. Label can be left empty" -@@ -227,6 +233,7 @@ create_chip chip - create_bank chip bank - enable_chip chip - test -z "`cat $CONFIGFS_DIR/chip/bank/label`" || fail "label is not empty" -+disable_chip chip - remove_chip chip - - echo "2.5. Line names can be configured" -@@ -238,6 +245,7 @@ set_line_name chip bank 2 bar - enable_chip chip - test "`get_line_name chip bank 0`" = "foo" || fail "line name is incorrect" - test "`get_line_name chip bank 2`" = "bar" || fail "line name is incorrect" -+disable_chip chip - remove_chip chip - - echo "2.6. Line config can remain unused if offset is greater than number of lines" -@@ -248,6 +256,7 @@ set_line_name chip bank 5 foobar - enable_chip chip - test "`get_line_name chip bank 0`" = "" || fail "line name is incorrect" - test "`get_line_name chip bank 1`" = "" || fail "line name is incorrect" -+disable_chip chip - remove_chip chip - - echo "2.7. Line configfs directory names are sanitized" -@@ -267,6 +276,7 @@ for CHIP in $CHIPS; do - enable_chip $CHIP - done - for CHIP in $CHIPS; do -+ disable_chip $CHIP - remove_chip $CHIP - done - -@@ -278,6 +288,7 @@ echo foobar > $CONFIGFS_DIR/chip/bank/label 2> /dev/null && \ - fail "Setting label of a live chip should fail" - echo 8 > $CONFIGFS_DIR/chip/bank/num_lines 2> /dev/null && \ - fail "Setting number of lines of a live chip should fail" -+disable_chip chip - remove_chip chip - - echo "2.10. Can't create line items when chip is live" -@@ -285,6 +296,7 @@ create_chip chip - create_bank chip bank - enable_chip chip - mkdir $CONFIGFS_DIR/chip/bank/line0 2> /dev/null && fail "Creating line item should fail" -+disable_chip chip - remove_chip chip - - echo "2.11. Probe errors are propagated to user-space" -@@ -316,6 +328,7 @@ mkdir -p $CONFIGFS_DIR/chip/bank/line4/hog - enable_chip chip - $BASE_DIR/gpio-mockup-cdev -s 1 /dev/`configfs_chip_name chip bank` 4 2> /dev/null && \ - fail "Setting the value of a hogged line shouldn't succeed" -+disable_chip chip - remove_chip chip - - echo "3. Controlling simulated chips" -@@ -331,6 +344,7 @@ test "$?" = "1" || fail "pull set incorrectly" - sysfs_set_pull chip bank 0 pull-down - $BASE_DIR/gpio-mockup-cdev /dev/`configfs_chip_name chip bank` 1 - test "$?" = "0" || fail "pull set incorrectly" -+disable_chip chip - remove_chip chip - - echo "3.2. Pull can be read from sysfs" -@@ -344,6 +358,7 @@ SYSFS_PATH=/sys/devices/platform/$DEVNAME/$CHIPNAME/sim_gpio0/pull - test `cat $SYSFS_PATH` = "pull-down" || fail "reading the pull failed" - sysfs_set_pull chip bank 0 pull-up - test `cat $SYSFS_PATH` = "pull-up" || fail "reading the pull failed" -+disable_chip chip - remove_chip chip - - echo "3.3. Incorrect input in sysfs is rejected" -@@ -355,6 +370,7 @@ DEVNAME=`configfs_dev_name chip` - CHIPNAME=`configfs_chip_name chip bank` - SYSFS_PATH="/sys/devices/platform/$DEVNAME/$CHIPNAME/sim_gpio0/pull" - echo foobar > $SYSFS_PATH 2> /dev/null && fail "invalid input not detected" -+disable_chip chip - remove_chip chip - - echo "3.4. Can't write to value" -@@ -365,6 +381,7 @@ DEVNAME=`configfs_dev_name chip` - CHIPNAME=`configfs_chip_name chip bank` - SYSFS_PATH="/sys/devices/platform/$DEVNAME/$CHIPNAME/sim_gpio0/value" - echo 1 > $SYSFS_PATH 2> /dev/null && fail "writing to 'value' succeeded unexpectedly" -+disable_chip chip - remove_chip chip - - echo "4. Simulated GPIO chips are functional" -@@ -382,6 +399,7 @@ $BASE_DIR/gpio-mockup-cdev -s 1 /dev/`configfs_chip_name chip bank` 0 & - sleep 0.1 # FIXME Any better way? - test `cat $SYSFS_PATH` = "1" || fail "incorrect value read from sysfs" - kill $! -+disable_chip chip - remove_chip chip - - echo "4.2. Bias settings work correctly" -@@ -394,6 +412,7 @@ CHIPNAME=`configfs_chip_name chip bank` - SYSFS_PATH="/sys/devices/platform/$DEVNAME/$CHIPNAME/sim_gpio0/value" - $BASE_DIR/gpio-mockup-cdev -b pull-up /dev/`configfs_chip_name chip bank` 0 - test `cat $SYSFS_PATH` = "1" || fail "bias setting does not work" -+disable_chip chip - remove_chip chip - - echo "GPIO $MODULE test PASS" -diff --git a/tools/testing/selftests/net/pmtu.sh b/tools/testing/selftests/net/pmtu.sh -index 1c0dd2f7816782..771f237c43534e 100755 ---- a/tools/testing/selftests/net/pmtu.sh -+++ b/tools/testing/selftests/net/pmtu.sh -@@ -197,6 +197,12 @@ - # - # - pmtu_ipv6_route_change - # Same as above but with IPv6 -+# -+# - pmtu_ipv4_mp_exceptions -+# Use the same topology as in pmtu_ipv4, but add routeable addresses -+# on host A and B on lo reachable via both routers. Host A and B -+# addresses have multipath routes to each other, b_r1 mtu = 1500. -+# Check that PMTU exceptions are created for both paths. - - source lib.sh - source net_helper.sh -@@ -266,7 +272,8 @@ tests=" - list_flush_ipv4_exception ipv4: list and flush cached exceptions 1 - list_flush_ipv6_exception ipv6: list and flush cached exceptions 1 - pmtu_ipv4_route_change ipv4: PMTU exception w/route replace 1 -- pmtu_ipv6_route_change ipv6: PMTU exception w/route replace 1" -+ pmtu_ipv6_route_change ipv6: PMTU exception w/route replace 1 -+ pmtu_ipv4_mp_exceptions ipv4: PMTU multipath nh exceptions 1" - - # Addressing and routing for tests with routers: four network segments, with - # index SEGMENT between 1 and 4, a common prefix (PREFIX4 or PREFIX6) and an -@@ -343,6 +350,9 @@ tunnel6_a_addr="fd00:2::a" - tunnel6_b_addr="fd00:2::b" - tunnel6_mask="64" - -+host4_a_addr="192.168.99.99" -+host4_b_addr="192.168.88.88" -+ - dummy6_0_prefix="fc00:1000::" - dummy6_1_prefix="fc00:1001::" - dummy6_mask="64" -@@ -902,6 +912,52 @@ setup_ovs_bridge() { - run_cmd ip route add ${prefix6}:${b_r1}::1 via ${prefix6}:${a_r1}::2 - } - -+setup_multipath_new() { -+ # Set up host A with multipath routes to host B host4_b_addr -+ run_cmd ${ns_a} ip addr add ${host4_a_addr} dev lo -+ run_cmd ${ns_a} ip nexthop add id 401 via ${prefix4}.${a_r1}.2 dev veth_A-R1 -+ run_cmd ${ns_a} ip nexthop add id 402 via ${prefix4}.${a_r2}.2 dev veth_A-R2 -+ run_cmd ${ns_a} ip nexthop add id 403 group 401/402 -+ run_cmd ${ns_a} ip route add ${host4_b_addr} src ${host4_a_addr} nhid 403 -+ -+ # Set up host B with multipath routes to host A host4_a_addr -+ run_cmd ${ns_b} ip addr add ${host4_b_addr} dev lo -+ run_cmd ${ns_b} ip nexthop add id 401 via ${prefix4}.${b_r1}.2 dev veth_B-R1 -+ run_cmd ${ns_b} ip nexthop add id 402 via ${prefix4}.${b_r2}.2 dev veth_B-R2 -+ run_cmd ${ns_b} ip nexthop add id 403 group 401/402 -+ run_cmd ${ns_b} ip route add ${host4_a_addr} src ${host4_b_addr} nhid 403 -+} -+ -+setup_multipath_old() { -+ # Set up host A with multipath routes to host B host4_b_addr -+ run_cmd ${ns_a} ip addr add ${host4_a_addr} dev lo -+ run_cmd ${ns_a} ip route add ${host4_b_addr} \ -+ src ${host4_a_addr} \ -+ nexthop via ${prefix4}.${a_r1}.2 weight 1 \ -+ nexthop via ${prefix4}.${a_r2}.2 weight 1 -+ -+ # Set up host B with multipath routes to host A host4_a_addr -+ run_cmd ${ns_b} ip addr add ${host4_b_addr} dev lo -+ run_cmd ${ns_b} ip route add ${host4_a_addr} \ -+ src ${host4_b_addr} \ -+ nexthop via ${prefix4}.${b_r1}.2 weight 1 \ -+ nexthop via ${prefix4}.${b_r2}.2 weight 1 -+} -+ -+setup_multipath() { -+ if [ "$USE_NH" = "yes" ]; then -+ setup_multipath_new -+ else -+ setup_multipath_old -+ fi -+ -+ # Set up routers with routes to dummies -+ run_cmd ${ns_r1} ip route add ${host4_a_addr} via ${prefix4}.${a_r1}.1 -+ run_cmd ${ns_r2} ip route add ${host4_a_addr} via ${prefix4}.${a_r2}.1 -+ run_cmd ${ns_r1} ip route add ${host4_b_addr} via ${prefix4}.${b_r1}.1 -+ run_cmd ${ns_r2} ip route add ${host4_b_addr} via ${prefix4}.${b_r2}.1 -+} -+ - setup() { - [ "$(id -u)" -ne 0 ] && echo " need to run as root" && return $ksft_skip - -@@ -982,23 +1038,15 @@ link_get_mtu() { - } - - route_get_dst_exception() { -- ns_cmd="${1}" -- dst="${2}" -- dsfield="${3}" -+ ns_cmd="${1}"; shift - -- if [ -z "${dsfield}" ]; then -- dsfield=0 -- fi -- -- ${ns_cmd} ip route get "${dst}" dsfield "${dsfield}" -+ ${ns_cmd} ip route get "$@" - } - - route_get_dst_pmtu_from_exception() { -- ns_cmd="${1}" -- dst="${2}" -- dsfield="${3}" -+ ns_cmd="${1}"; shift - -- mtu_parse "$(route_get_dst_exception "${ns_cmd}" "${dst}" "${dsfield}")" -+ mtu_parse "$(route_get_dst_exception "${ns_cmd}" "$@")" - } - - check_pmtu_value() { -@@ -1141,10 +1189,10 @@ test_pmtu_ipv4_dscp_icmp_exception() { - run_cmd "${ns_a}" ping -q -M want -Q "${dsfield}" -c 1 -w 1 -s "${len}" "${dst2}" - - # Check that exceptions have been created with the correct PMTU -- pmtu_1="$(route_get_dst_pmtu_from_exception "${ns_a}" "${dst1}" "${policy_mark}")" -+ pmtu_1="$(route_get_dst_pmtu_from_exception "${ns_a}" "${dst1}" dsfield "${policy_mark}")" - check_pmtu_value "1400" "${pmtu_1}" "exceeding MTU" || return 1 - -- pmtu_2="$(route_get_dst_pmtu_from_exception "${ns_a}" "${dst2}" "${policy_mark}")" -+ pmtu_2="$(route_get_dst_pmtu_from_exception "${ns_a}" "${dst2}" dsfield "${policy_mark}")" - check_pmtu_value "1500" "${pmtu_2}" "exceeding MTU" || return 1 - } - -@@ -1191,9 +1239,9 @@ test_pmtu_ipv4_dscp_udp_exception() { - UDP:"${dst2}":50000,tos="${dsfield}" - - # Check that exceptions have been created with the correct PMTU -- pmtu_1="$(route_get_dst_pmtu_from_exception "${ns_a}" "${dst1}" "${policy_mark}")" -+ pmtu_1="$(route_get_dst_pmtu_from_exception "${ns_a}" "${dst1}" dsfield "${policy_mark}")" - check_pmtu_value "1400" "${pmtu_1}" "exceeding MTU" || return 1 -- pmtu_2="$(route_get_dst_pmtu_from_exception "${ns_a}" "${dst2}" "${policy_mark}")" -+ pmtu_2="$(route_get_dst_pmtu_from_exception "${ns_a}" "${dst2}" dsfield "${policy_mark}")" - check_pmtu_value "1500" "${pmtu_2}" "exceeding MTU" || return 1 - } - -@@ -2234,6 +2282,36 @@ test_pmtu_ipv6_route_change() { - test_pmtu_ipvX_route_change 6 - } - -+test_pmtu_ipv4_mp_exceptions() { -+ setup namespaces routing multipath || return $ksft_skip -+ -+ trace "${ns_a}" veth_A-R1 "${ns_r1}" veth_R1-A \ -+ "${ns_r1}" veth_R1-B "${ns_b}" veth_B-R1 \ -+ "${ns_a}" veth_A-R2 "${ns_r2}" veth_R2-A \ -+ "${ns_r2}" veth_R2-B "${ns_b}" veth_B-R2 -+ -+ # Set up initial MTU values -+ mtu "${ns_a}" veth_A-R1 2000 -+ mtu "${ns_r1}" veth_R1-A 2000 -+ mtu "${ns_r1}" veth_R1-B 1500 -+ mtu "${ns_b}" veth_B-R1 1500 -+ -+ mtu "${ns_a}" veth_A-R2 2000 -+ mtu "${ns_r2}" veth_R2-A 2000 -+ mtu "${ns_r2}" veth_R2-B 1500 -+ mtu "${ns_b}" veth_B-R2 1500 -+ -+ # Ping and expect two nexthop exceptions for two routes -+ run_cmd ${ns_a} ping -q -M want -i 0.1 -c 1 -s 1800 "${host4_b_addr}" -+ -+ # Check that exceptions have been created with the correct PMTU -+ pmtu_a_R1="$(route_get_dst_pmtu_from_exception "${ns_a}" "${host4_b_addr}" oif veth_A-R1)" -+ pmtu_a_R2="$(route_get_dst_pmtu_from_exception "${ns_a}" "${host4_b_addr}" oif veth_A-R2)" -+ -+ check_pmtu_value "1500" "${pmtu_a_R1}" "exceeding MTU (veth_A-R1)" || return 1 -+ check_pmtu_value "1500" "${pmtu_a_R2}" "exceeding MTU (veth_A-R2)" || return 1 -+} -+ - usage() { - echo - echo "$0 [OPTIONS] [TEST]..." -diff --git a/tools/testing/selftests/net/rtnetlink.sh b/tools/testing/selftests/net/rtnetlink.sh -index 488f4964365e73..855505c40ed8eb 100755 ---- a/tools/testing/selftests/net/rtnetlink.sh -+++ b/tools/testing/selftests/net/rtnetlink.sh -@@ -921,10 +921,10 @@ kci_test_ipsec_offload() - # does driver have correct offload info - diff $sysfsf - << EOF - SA count=2 tx=3 --sa[0] tx ipaddr=0x00000000 00000000 00000000 00000000 -+sa[0] tx ipaddr=$dstip - sa[0] spi=0x00000009 proto=0x32 salt=0x61626364 crypt=1 - sa[0] key=0x34333231 38373635 32313039 36353433 --sa[1] rx ipaddr=0x00000000 00000000 00000000 037ba8c0 -+sa[1] rx ipaddr=$srcip - sa[1] spi=0x00000009 proto=0x32 salt=0x61626364 crypt=1 - sa[1] key=0x34333231 38373635 32313039 36353433 - EOF -diff --git a/tools/tracing/rtla/src/timerlat_hist.c b/tools/tracing/rtla/src/timerlat_hist.c -index 1525e88c6cf968..a985e57954820e 100644 ---- a/tools/tracing/rtla/src/timerlat_hist.c -+++ b/tools/tracing/rtla/src/timerlat_hist.c -@@ -952,6 +952,14 @@ static int stop_tracing; - static struct trace_instance *hist_inst = NULL; - static void stop_hist(int sig) - { -+ if (stop_tracing) { -+ /* -+ * Stop requested twice in a row; abort event processing and -+ * exit immediately -+ */ -+ tracefs_iterate_stop(hist_inst->inst); -+ return; -+ } - stop_tracing = 1; - if (hist_inst) - trace_instance_stop(hist_inst); -diff --git a/tools/tracing/rtla/src/timerlat_top.c b/tools/tracing/rtla/src/timerlat_top.c -index 5a33789a375e3c..1fed4c8d8520f9 100644 ---- a/tools/tracing/rtla/src/timerlat_top.c -+++ b/tools/tracing/rtla/src/timerlat_top.c -@@ -731,6 +731,14 @@ static int stop_tracing; - static struct trace_instance *top_inst = NULL; - static void stop_top(int sig) - { -+ if (stop_tracing) { -+ /* -+ * Stop requested twice in a row; abort event processing and -+ * exit immediately -+ */ -+ tracefs_iterate_stop(top_inst->inst); -+ return; -+ } - stop_tracing = 1; - if (top_inst) - trace_instance_stop(top_inst); diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.079-080.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.079-080.patch deleted file mode 100644 index e9285d473f..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.079-080.patch +++ /dev/null @@ -1,6502 +0,0 @@ -diff --git a/Documentation/networking/strparser.rst b/Documentation/networking/strparser.rst -index 6cab1f74ae05a3..7f623d1db72aae 100644 ---- a/Documentation/networking/strparser.rst -+++ b/Documentation/networking/strparser.rst -@@ -112,7 +112,7 @@ Functions - Callbacks - ========= - --There are six callbacks: -+There are seven callbacks: - - :: - -@@ -182,6 +182,13 @@ There are six callbacks: - the length of the message. skb->len - offset may be greater - then full_len since strparser does not trim the skb. - -+ :: -+ -+ int (*read_sock)(struct strparser *strp, read_descriptor_t *desc, -+ sk_read_actor_t recv_actor); -+ -+ The read_sock callback is used by strparser instead of -+ sock->ops->read_sock, if provided. - :: - - int (*read_sock_done)(struct strparser *strp, int err); -diff --git a/Makefile b/Makefile -index de16ab06861410..67c5799f259e2e 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 79 -+SUBLEVEL = 80 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm64/boot/dts/mediatek/mt8183.dtsi b/arch/arm64/boot/dts/mediatek/mt8183.dtsi -index d1b6355148620b..f3a1b96f1ee4db 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi -@@ -1828,6 +1828,7 @@ dsi0: dsi@14014000 { - resets = <&mmsys MT8183_MMSYS_SW0_RST_B_DISP_DSI0>; - phys = <&mipi_tx0>; - phy-names = "dphy"; -+ status = "disabled"; - }; - - mutex: mutex@14016000 { -diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi -index 2a49a29713752b..3b4d7882300897 100644 ---- a/arch/arm64/boot/dts/qcom/sm8450.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi -@@ -2135,6 +2135,7 @@ fastrpc { - compatible = "qcom,fastrpc"; - qcom,glink-channels = "fastrpcglink-apps-dsp"; - label = "sdsp"; -+ qcom,non-secure-domain; - #address-cells = <1>; - #size-cells = <0>; - -@@ -2160,6 +2161,112 @@ compute-cb@3 { - }; - }; - -+ remoteproc_adsp: remoteproc@3000000 { -+ compatible = "qcom,sm8450-adsp-pas"; -+ reg = <0x0 0x03000000 0x0 0x10000>; -+ -+ interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>, -+ <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>, -+ <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>, -+ <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>, -+ <&smp2p_adsp_in 3 IRQ_TYPE_EDGE_RISING>; -+ interrupt-names = "wdog", "fatal", "ready", -+ "handover", "stop-ack"; -+ -+ clocks = <&rpmhcc RPMH_CXO_CLK>; -+ clock-names = "xo"; -+ -+ power-domains = <&rpmhpd RPMHPD_LCX>, -+ <&rpmhpd RPMHPD_LMX>; -+ power-domain-names = "lcx", "lmx"; -+ -+ memory-region = <&adsp_mem>; -+ -+ qcom,qmp = <&aoss_qmp>; -+ -+ qcom,smem-states = <&smp2p_adsp_out 0>; -+ qcom,smem-state-names = "stop"; -+ -+ status = "disabled"; -+ -+ remoteproc_adsp_glink: glink-edge { -+ interrupts-extended = <&ipcc IPCC_CLIENT_LPASS -+ IPCC_MPROC_SIGNAL_GLINK_QMP -+ IRQ_TYPE_EDGE_RISING>; -+ mboxes = <&ipcc IPCC_CLIENT_LPASS -+ IPCC_MPROC_SIGNAL_GLINK_QMP>; -+ -+ label = "lpass"; -+ qcom,remote-pid = <2>; -+ -+ gpr { -+ compatible = "qcom,gpr"; -+ qcom,glink-channels = "adsp_apps"; -+ qcom,domain = ; -+ qcom,intents = <512 20>; -+ #address-cells = <1>; -+ #size-cells = <0>; -+ -+ q6apm: service@1 { -+ compatible = "qcom,q6apm"; -+ reg = ; -+ #sound-dai-cells = <0>; -+ qcom,protection-domain = "avs/audio", -+ "msm/adsp/audio_pd"; -+ -+ q6apmdai: dais { -+ compatible = "qcom,q6apm-dais"; -+ iommus = <&apps_smmu 0x1801 0x0>; -+ }; -+ -+ q6apmbedai: bedais { -+ compatible = "qcom,q6apm-lpass-dais"; -+ #sound-dai-cells = <1>; -+ }; -+ }; -+ -+ q6prm: service@2 { -+ compatible = "qcom,q6prm"; -+ reg = ; -+ qcom,protection-domain = "avs/audio", -+ "msm/adsp/audio_pd"; -+ -+ q6prmcc: clock-controller { -+ compatible = "qcom,q6prm-lpass-clocks"; -+ #clock-cells = <2>; -+ }; -+ }; -+ }; -+ -+ fastrpc { -+ compatible = "qcom,fastrpc"; -+ qcom,glink-channels = "fastrpcglink-apps-dsp"; -+ label = "adsp"; -+ qcom,non-secure-domain; -+ #address-cells = <1>; -+ #size-cells = <0>; -+ -+ compute-cb@3 { -+ compatible = "qcom,fastrpc-compute-cb"; -+ reg = <3>; -+ iommus = <&apps_smmu 0x1803 0x0>; -+ }; -+ -+ compute-cb@4 { -+ compatible = "qcom,fastrpc-compute-cb"; -+ reg = <4>; -+ iommus = <&apps_smmu 0x1804 0x0>; -+ }; -+ -+ compute-cb@5 { -+ compatible = "qcom,fastrpc-compute-cb"; -+ reg = <5>; -+ iommus = <&apps_smmu 0x1805 0x0>; -+ }; -+ }; -+ }; -+ }; -+ - wsa2macro: codec@31e0000 { - compatible = "qcom,sm8450-lpass-wsa-macro"; - reg = <0 0x031e0000 0 0x1000>; -@@ -2368,111 +2475,6 @@ vamacro: codec@33f0000 { - status = "disabled"; - }; - -- remoteproc_adsp: remoteproc@30000000 { -- compatible = "qcom,sm8450-adsp-pas"; -- reg = <0 0x30000000 0 0x100>; -- -- interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>, -- <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>, -- <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>, -- <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>, -- <&smp2p_adsp_in 3 IRQ_TYPE_EDGE_RISING>; -- interrupt-names = "wdog", "fatal", "ready", -- "handover", "stop-ack"; -- -- clocks = <&rpmhcc RPMH_CXO_CLK>; -- clock-names = "xo"; -- -- power-domains = <&rpmhpd RPMHPD_LCX>, -- <&rpmhpd RPMHPD_LMX>; -- power-domain-names = "lcx", "lmx"; -- -- memory-region = <&adsp_mem>; -- -- qcom,qmp = <&aoss_qmp>; -- -- qcom,smem-states = <&smp2p_adsp_out 0>; -- qcom,smem-state-names = "stop"; -- -- status = "disabled"; -- -- remoteproc_adsp_glink: glink-edge { -- interrupts-extended = <&ipcc IPCC_CLIENT_LPASS -- IPCC_MPROC_SIGNAL_GLINK_QMP -- IRQ_TYPE_EDGE_RISING>; -- mboxes = <&ipcc IPCC_CLIENT_LPASS -- IPCC_MPROC_SIGNAL_GLINK_QMP>; -- -- label = "lpass"; -- qcom,remote-pid = <2>; -- -- gpr { -- compatible = "qcom,gpr"; -- qcom,glink-channels = "adsp_apps"; -- qcom,domain = ; -- qcom,intents = <512 20>; -- #address-cells = <1>; -- #size-cells = <0>; -- -- q6apm: service@1 { -- compatible = "qcom,q6apm"; -- reg = ; -- #sound-dai-cells = <0>; -- qcom,protection-domain = "avs/audio", -- "msm/adsp/audio_pd"; -- -- q6apmdai: dais { -- compatible = "qcom,q6apm-dais"; -- iommus = <&apps_smmu 0x1801 0x0>; -- }; -- -- q6apmbedai: bedais { -- compatible = "qcom,q6apm-lpass-dais"; -- #sound-dai-cells = <1>; -- }; -- }; -- -- q6prm: service@2 { -- compatible = "qcom,q6prm"; -- reg = ; -- qcom,protection-domain = "avs/audio", -- "msm/adsp/audio_pd"; -- -- q6prmcc: clock-controller { -- compatible = "qcom,q6prm-lpass-clocks"; -- #clock-cells = <2>; -- }; -- }; -- }; -- -- fastrpc { -- compatible = "qcom,fastrpc"; -- qcom,glink-channels = "fastrpcglink-apps-dsp"; -- label = "adsp"; -- #address-cells = <1>; -- #size-cells = <0>; -- -- compute-cb@3 { -- compatible = "qcom,fastrpc-compute-cb"; -- reg = <3>; -- iommus = <&apps_smmu 0x1803 0x0>; -- }; -- -- compute-cb@4 { -- compatible = "qcom,fastrpc-compute-cb"; -- reg = <4>; -- iommus = <&apps_smmu 0x1804 0x0>; -- }; -- -- compute-cb@5 { -- compatible = "qcom,fastrpc-compute-cb"; -- reg = <5>; -- iommus = <&apps_smmu 0x1805 0x0>; -- }; -- }; -- }; -- }; -- - remoteproc_cdsp: remoteproc@32300000 { - compatible = "qcom,sm8450-cdsp-pas"; - reg = <0 0x32300000 0 0x10000>; -@@ -2515,6 +2517,7 @@ fastrpc { - compatible = "qcom,fastrpc"; - qcom,glink-channels = "fastrpcglink-apps-dsp"; - label = "cdsp"; -+ qcom,non-secure-domain; - #address-cells = <1>; - #size-cells = <0>; - -diff --git a/arch/arm64/boot/dts/qcom/sm8550.dtsi b/arch/arm64/boot/dts/qcom/sm8550.dtsi -index f3a0e1fe333c4d..bc9a1fca2db3ae 100644 ---- a/arch/arm64/boot/dts/qcom/sm8550.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm8550.dtsi -@@ -2026,6 +2026,137 @@ IPCC_MPROC_SIGNAL_GLINK_QMP - }; - }; - -+ remoteproc_adsp: remoteproc@6800000 { -+ compatible = "qcom,sm8550-adsp-pas"; -+ reg = <0x0 0x06800000 0x0 0x10000>; -+ -+ interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>, -+ <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>, -+ <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>, -+ <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>, -+ <&smp2p_adsp_in 3 IRQ_TYPE_EDGE_RISING>; -+ interrupt-names = "wdog", "fatal", "ready", -+ "handover", "stop-ack"; -+ -+ clocks = <&rpmhcc RPMH_CXO_CLK>; -+ clock-names = "xo"; -+ -+ power-domains = <&rpmhpd RPMHPD_LCX>, -+ <&rpmhpd RPMHPD_LMX>; -+ power-domain-names = "lcx", "lmx"; -+ -+ interconnects = <&lpass_lpicx_noc MASTER_LPASS_PROC 0 &mc_virt SLAVE_EBI1 0>; -+ -+ memory-region = <&adspslpi_mem>, <&q6_adsp_dtb_mem>; -+ -+ qcom,qmp = <&aoss_qmp>; -+ -+ qcom,smem-states = <&smp2p_adsp_out 0>; -+ qcom,smem-state-names = "stop"; -+ -+ status = "disabled"; -+ -+ remoteproc_adsp_glink: glink-edge { -+ interrupts-extended = <&ipcc IPCC_CLIENT_LPASS -+ IPCC_MPROC_SIGNAL_GLINK_QMP -+ IRQ_TYPE_EDGE_RISING>; -+ mboxes = <&ipcc IPCC_CLIENT_LPASS -+ IPCC_MPROC_SIGNAL_GLINK_QMP>; -+ -+ label = "lpass"; -+ qcom,remote-pid = <2>; -+ -+ fastrpc { -+ compatible = "qcom,fastrpc"; -+ qcom,glink-channels = "fastrpcglink-apps-dsp"; -+ label = "adsp"; -+ qcom,non-secure-domain; -+ #address-cells = <1>; -+ #size-cells = <0>; -+ -+ compute-cb@3 { -+ compatible = "qcom,fastrpc-compute-cb"; -+ reg = <3>; -+ iommus = <&apps_smmu 0x1003 0x80>, -+ <&apps_smmu 0x1063 0x0>; -+ dma-coherent; -+ }; -+ -+ compute-cb@4 { -+ compatible = "qcom,fastrpc-compute-cb"; -+ reg = <4>; -+ iommus = <&apps_smmu 0x1004 0x80>, -+ <&apps_smmu 0x1064 0x0>; -+ dma-coherent; -+ }; -+ -+ compute-cb@5 { -+ compatible = "qcom,fastrpc-compute-cb"; -+ reg = <5>; -+ iommus = <&apps_smmu 0x1005 0x80>, -+ <&apps_smmu 0x1065 0x0>; -+ dma-coherent; -+ }; -+ -+ compute-cb@6 { -+ compatible = "qcom,fastrpc-compute-cb"; -+ reg = <6>; -+ iommus = <&apps_smmu 0x1006 0x80>, -+ <&apps_smmu 0x1066 0x0>; -+ dma-coherent; -+ }; -+ -+ compute-cb@7 { -+ compatible = "qcom,fastrpc-compute-cb"; -+ reg = <7>; -+ iommus = <&apps_smmu 0x1007 0x80>, -+ <&apps_smmu 0x1067 0x0>; -+ dma-coherent; -+ }; -+ }; -+ -+ gpr { -+ compatible = "qcom,gpr"; -+ qcom,glink-channels = "adsp_apps"; -+ qcom,domain = ; -+ qcom,intents = <512 20>; -+ #address-cells = <1>; -+ #size-cells = <0>; -+ -+ q6apm: service@1 { -+ compatible = "qcom,q6apm"; -+ reg = ; -+ #sound-dai-cells = <0>; -+ qcom,protection-domain = "avs/audio", -+ "msm/adsp/audio_pd"; -+ -+ q6apmdai: dais { -+ compatible = "qcom,q6apm-dais"; -+ iommus = <&apps_smmu 0x1001 0x80>, -+ <&apps_smmu 0x1061 0x0>; -+ }; -+ -+ q6apmbedai: bedais { -+ compatible = "qcom,q6apm-lpass-dais"; -+ #sound-dai-cells = <1>; -+ }; -+ }; -+ -+ q6prm: service@2 { -+ compatible = "qcom,q6prm"; -+ reg = ; -+ qcom,protection-domain = "avs/audio", -+ "msm/adsp/audio_pd"; -+ -+ q6prmcc: clock-controller { -+ compatible = "qcom,q6prm-lpass-clocks"; -+ #clock-cells = <2>; -+ }; -+ }; -+ }; -+ }; -+ }; -+ - lpass_wsa2macro: codec@6aa0000 { - compatible = "qcom,sm8550-lpass-wsa-macro"; - reg = <0 0x06aa0000 0 0x1000>; -@@ -3954,131 +4085,6 @@ system-cache-controller@25000000 { - interrupts = ; - }; - -- remoteproc_adsp: remoteproc@30000000 { -- compatible = "qcom,sm8550-adsp-pas"; -- reg = <0x0 0x30000000 0x0 0x100>; -- -- interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>, -- <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>, -- <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>, -- <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>, -- <&smp2p_adsp_in 3 IRQ_TYPE_EDGE_RISING>; -- interrupt-names = "wdog", "fatal", "ready", -- "handover", "stop-ack"; -- -- clocks = <&rpmhcc RPMH_CXO_CLK>; -- clock-names = "xo"; -- -- power-domains = <&rpmhpd RPMHPD_LCX>, -- <&rpmhpd RPMHPD_LMX>; -- power-domain-names = "lcx", "lmx"; -- -- interconnects = <&lpass_lpicx_noc MASTER_LPASS_PROC 0 &mc_virt SLAVE_EBI1 0>; -- -- memory-region = <&adspslpi_mem>, <&q6_adsp_dtb_mem>; -- -- qcom,qmp = <&aoss_qmp>; -- -- qcom,smem-states = <&smp2p_adsp_out 0>; -- qcom,smem-state-names = "stop"; -- -- status = "disabled"; -- -- remoteproc_adsp_glink: glink-edge { -- interrupts-extended = <&ipcc IPCC_CLIENT_LPASS -- IPCC_MPROC_SIGNAL_GLINK_QMP -- IRQ_TYPE_EDGE_RISING>; -- mboxes = <&ipcc IPCC_CLIENT_LPASS -- IPCC_MPROC_SIGNAL_GLINK_QMP>; -- -- label = "lpass"; -- qcom,remote-pid = <2>; -- -- fastrpc { -- compatible = "qcom,fastrpc"; -- qcom,glink-channels = "fastrpcglink-apps-dsp"; -- label = "adsp"; -- #address-cells = <1>; -- #size-cells = <0>; -- -- compute-cb@3 { -- compatible = "qcom,fastrpc-compute-cb"; -- reg = <3>; -- iommus = <&apps_smmu 0x1003 0x80>, -- <&apps_smmu 0x1063 0x0>; -- }; -- -- compute-cb@4 { -- compatible = "qcom,fastrpc-compute-cb"; -- reg = <4>; -- iommus = <&apps_smmu 0x1004 0x80>, -- <&apps_smmu 0x1064 0x0>; -- }; -- -- compute-cb@5 { -- compatible = "qcom,fastrpc-compute-cb"; -- reg = <5>; -- iommus = <&apps_smmu 0x1005 0x80>, -- <&apps_smmu 0x1065 0x0>; -- }; -- -- compute-cb@6 { -- compatible = "qcom,fastrpc-compute-cb"; -- reg = <6>; -- iommus = <&apps_smmu 0x1006 0x80>, -- <&apps_smmu 0x1066 0x0>; -- }; -- -- compute-cb@7 { -- compatible = "qcom,fastrpc-compute-cb"; -- reg = <7>; -- iommus = <&apps_smmu 0x1007 0x80>, -- <&apps_smmu 0x1067 0x0>; -- }; -- }; -- -- gpr { -- compatible = "qcom,gpr"; -- qcom,glink-channels = "adsp_apps"; -- qcom,domain = ; -- qcom,intents = <512 20>; -- #address-cells = <1>; -- #size-cells = <0>; -- -- q6apm: service@1 { -- compatible = "qcom,q6apm"; -- reg = ; -- #sound-dai-cells = <0>; -- qcom,protection-domain = "avs/audio", -- "msm/adsp/audio_pd"; -- -- q6apmdai: dais { -- compatible = "qcom,q6apm-dais"; -- iommus = <&apps_smmu 0x1001 0x80>, -- <&apps_smmu 0x1061 0x0>; -- }; -- -- q6apmbedai: bedais { -- compatible = "qcom,q6apm-lpass-dais"; -- #sound-dai-cells = <1>; -- }; -- }; -- -- q6prm: service@2 { -- compatible = "qcom,q6prm"; -- reg = ; -- qcom,protection-domain = "avs/audio", -- "msm/adsp/audio_pd"; -- -- q6prmcc: clock-controller { -- compatible = "qcom,q6prm-lpass-clocks"; -- #clock-cells = <2>; -- }; -- }; -- }; -- }; -- }; -- - nsp_noc: interconnect@320c0000 { - compatible = "qcom,sm8550-nsp-noc"; - reg = <0 0x320c0000 0 0xe080>; -@@ -4131,6 +4137,7 @@ fastrpc { - compatible = "qcom,fastrpc"; - qcom,glink-channels = "fastrpcglink-apps-dsp"; - label = "cdsp"; -+ qcom,non-secure-domain; - #address-cells = <1>; - #size-cells = <0>; - -@@ -4140,6 +4147,7 @@ compute-cb@1 { - iommus = <&apps_smmu 0x1961 0x0>, - <&apps_smmu 0x0c01 0x20>, - <&apps_smmu 0x19c1 0x10>; -+ dma-coherent; - }; - - compute-cb@2 { -@@ -4148,6 +4156,7 @@ compute-cb@2 { - iommus = <&apps_smmu 0x1962 0x0>, - <&apps_smmu 0x0c02 0x20>, - <&apps_smmu 0x19c2 0x10>; -+ dma-coherent; - }; - - compute-cb@3 { -@@ -4156,6 +4165,7 @@ compute-cb@3 { - iommus = <&apps_smmu 0x1963 0x0>, - <&apps_smmu 0x0c03 0x20>, - <&apps_smmu 0x19c3 0x10>; -+ dma-coherent; - }; - - compute-cb@4 { -@@ -4164,6 +4174,7 @@ compute-cb@4 { - iommus = <&apps_smmu 0x1964 0x0>, - <&apps_smmu 0x0c04 0x20>, - <&apps_smmu 0x19c4 0x10>; -+ dma-coherent; - }; - - compute-cb@5 { -@@ -4172,6 +4183,7 @@ compute-cb@5 { - iommus = <&apps_smmu 0x1965 0x0>, - <&apps_smmu 0x0c05 0x20>, - <&apps_smmu 0x19c5 0x10>; -+ dma-coherent; - }; - - compute-cb@6 { -@@ -4180,6 +4192,7 @@ compute-cb@6 { - iommus = <&apps_smmu 0x1966 0x0>, - <&apps_smmu 0x0c06 0x20>, - <&apps_smmu 0x19c6 0x10>; -+ dma-coherent; - }; - - compute-cb@7 { -@@ -4188,6 +4201,7 @@ compute-cb@7 { - iommus = <&apps_smmu 0x1967 0x0>, - <&apps_smmu 0x0c07 0x20>, - <&apps_smmu 0x19c7 0x10>; -+ dma-coherent; - }; - - compute-cb@8 { -@@ -4196,6 +4210,7 @@ compute-cb@8 { - iommus = <&apps_smmu 0x1968 0x0>, - <&apps_smmu 0x0c08 0x20>, - <&apps_smmu 0x19c8 0x10>; -+ dma-coherent; - }; - - /* note: secure cb9 in downstream */ -diff --git a/arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus-lts.dts b/arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus-lts.dts -index 4237f2ee8fee33..f57d4acd9807cb 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus-lts.dts -+++ b/arch/arm64/boot/dts/rockchip/rk3328-orangepi-r1-plus-lts.dts -@@ -15,9 +15,11 @@ / { - }; - - &gmac2io { -+ /delete-property/ tx_delay; -+ /delete-property/ rx_delay; -+ - phy-handle = <&yt8531c>; -- tx_delay = <0x19>; -- rx_delay = <0x05>; -+ phy-mode = "rgmii-id"; - - mdio { - /delete-node/ ethernet-phy@1; -diff --git a/arch/arm64/include/asm/mman.h b/arch/arm64/include/asm/mman.h -index ef35c52aabd66d..101771c60d80d2 100644 ---- a/arch/arm64/include/asm/mman.h -+++ b/arch/arm64/include/asm/mman.h -@@ -31,9 +31,12 @@ static inline unsigned long arch_calc_vm_flag_bits(struct file *file, - * backed by tags-capable memory. The vm_flags may be overridden by a - * filesystem supporting MTE (RAM-based). - */ -- if (system_supports_mte() && -- ((flags & MAP_ANONYMOUS) || shmem_file(file))) -- return VM_MTE_ALLOWED; -+ if (system_supports_mte()) { -+ if ((flags & MAP_ANONYMOUS) && !(flags & MAP_HUGETLB)) -+ return VM_MTE_ALLOWED; -+ if (shmem_file(file)) -+ return VM_MTE_ALLOWED; -+ } - - return 0; - } -diff --git a/arch/powerpc/include/asm/book3s/64/hash-4k.h b/arch/powerpc/include/asm/book3s/64/hash-4k.h -index 6472b08fa1b0cd..2a2649e0f91dff 100644 ---- a/arch/powerpc/include/asm/book3s/64/hash-4k.h -+++ b/arch/powerpc/include/asm/book3s/64/hash-4k.h -@@ -89,6 +89,34 @@ static inline int hash__hugepd_ok(hugepd_t hpd) - } - #endif - -+/* -+ * With 4K page size the real_pte machinery is all nops. -+ */ -+static inline real_pte_t __real_pte(pte_t pte, pte_t *ptep, int offset) -+{ -+ return (real_pte_t){pte}; -+} -+ -+#define __rpte_to_pte(r) ((r).pte) -+ -+static inline unsigned long __rpte_to_hidx(real_pte_t rpte, unsigned long index) -+{ -+ return pte_val(__rpte_to_pte(rpte)) >> H_PAGE_F_GIX_SHIFT; -+} -+ -+#define pte_iterate_hashed_subpages(rpte, psize, va, index, shift) \ -+ do { \ -+ index = 0; \ -+ shift = mmu_psize_defs[psize].shift; \ -+ -+#define pte_iterate_hashed_end() } while(0) -+ -+/* -+ * We expect this to be called only for user addresses or kernel virtual -+ * addresses other than the linear mapping. -+ */ -+#define pte_pagesize_index(mm, addr, pte) MMU_PAGE_4K -+ - /* - * 4K PTE format is different from 64K PTE format. Saving the hash_slot is just - * a matter of returning the PTE bits that need to be modified. On 64K PTE, -diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h -index 5c497c862d757e..8a6e6b6daa9065 100644 ---- a/arch/powerpc/include/asm/book3s/64/pgtable.h -+++ b/arch/powerpc/include/asm/book3s/64/pgtable.h -@@ -319,32 +319,6 @@ extern unsigned long pci_io_base; - - #ifndef __ASSEMBLY__ - --/* -- * This is the default implementation of various PTE accessors, it's -- * used in all cases except Book3S with 64K pages where we have a -- * concept of sub-pages -- */ --#ifndef __real_pte -- --#define __real_pte(e, p, o) ((real_pte_t){(e)}) --#define __rpte_to_pte(r) ((r).pte) --#define __rpte_to_hidx(r,index) (pte_val(__rpte_to_pte(r)) >> H_PAGE_F_GIX_SHIFT) -- --#define pte_iterate_hashed_subpages(rpte, psize, va, index, shift) \ -- do { \ -- index = 0; \ -- shift = mmu_psize_defs[psize].shift; \ -- --#define pte_iterate_hashed_end() } while(0) -- --/* -- * We expect this to be called only for user addresses or kernel virtual -- * addresses other than the linear mapping. -- */ --#define pte_pagesize_index(mm, addr, pte) MMU_PAGE_4K -- --#endif /* __real_pte */ -- - static inline unsigned long pte_update(struct mm_struct *mm, unsigned long addr, - pte_t *ptep, unsigned long clr, - unsigned long set, int huge) -diff --git a/arch/powerpc/lib/code-patching.c b/arch/powerpc/lib/code-patching.c -index b00112d7ad467d..4426a77c8f063b 100644 ---- a/arch/powerpc/lib/code-patching.c -+++ b/arch/powerpc/lib/code-patching.c -@@ -105,7 +105,7 @@ static int text_area_cpu_up(unsigned int cpu) - unsigned long addr; - int err; - -- area = get_vm_area(PAGE_SIZE, VM_ALLOC); -+ area = get_vm_area(PAGE_SIZE, 0); - if (!area) { - WARN_ONCE(1, "Failed to create text area for cpu %d\n", - cpu); -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 05c82fd5d0f60b..989d432b58345d 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -2514,7 +2514,8 @@ config CPU_IBPB_ENTRY - depends on CPU_SUP_AMD && X86_64 - default y - help -- Compile the kernel with support for the retbleed=ibpb mitigation. -+ Compile the kernel with support for the retbleed=ibpb and -+ spec_rstack_overflow={ibpb,ibpb-vmexit} mitigations. - - config CPU_IBRS_ENTRY - bool "Enable IBRS on kernel entry" -diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c -index df286789c94f18..61ac094e26bd78 100644 ---- a/arch/x86/events/intel/core.c -+++ b/arch/x86/events/intel/core.c -@@ -4643,16 +4643,19 @@ static void intel_pmu_check_num_counters(int *num_counters, - - static void update_pmu_cap(struct x86_hybrid_pmu *pmu) - { -- unsigned int sub_bitmaps = cpuid_eax(ARCH_PERFMON_EXT_LEAF); -- unsigned int eax, ebx, ecx, edx; -+ unsigned int cntr, fixed_cntr, ecx, edx; -+ union cpuid35_eax eax; -+ union cpuid35_ebx ebx; - -- if (sub_bitmaps & ARCH_PERFMON_NUM_COUNTER_LEAF_BIT) { -+ cpuid(ARCH_PERFMON_EXT_LEAF, &eax.full, &ebx.full, &ecx, &edx); -+ -+ if (eax.split.cntr_subleaf) { - cpuid_count(ARCH_PERFMON_EXT_LEAF, ARCH_PERFMON_NUM_COUNTER_LEAF, -- &eax, &ebx, &ecx, &edx); -- pmu->num_counters = fls(eax); -- pmu->num_counters_fixed = fls(ebx); -+ &cntr, &fixed_cntr, &ecx, &edx); -+ pmu->num_counters = fls(cntr); -+ pmu->num_counters_fixed = fls(fixed_cntr); - intel_pmu_check_num_counters(&pmu->num_counters, &pmu->num_counters_fixed, -- &pmu->intel_ctrl, ebx); -+ &pmu->intel_ctrl, fixed_cntr); - } - } - -diff --git a/arch/x86/include/asm/perf_event.h b/arch/x86/include/asm/perf_event.h -index 85a9fd5a3ec331..384e8a7db4827b 100644 ---- a/arch/x86/include/asm/perf_event.h -+++ b/arch/x86/include/asm/perf_event.h -@@ -177,9 +177,33 @@ union cpuid10_edx { - * detection/enumeration details: - */ - #define ARCH_PERFMON_EXT_LEAF 0x00000023 --#define ARCH_PERFMON_NUM_COUNTER_LEAF_BIT 0x1 - #define ARCH_PERFMON_NUM_COUNTER_LEAF 0x1 - -+union cpuid35_eax { -+ struct { -+ unsigned int leaf0:1; -+ /* Counters Sub-Leaf */ -+ unsigned int cntr_subleaf:1; -+ /* Auto Counter Reload Sub-Leaf */ -+ unsigned int acr_subleaf:1; -+ /* Events Sub-Leaf */ -+ unsigned int events_subleaf:1; -+ unsigned int reserved:28; -+ } split; -+ unsigned int full; -+}; -+ -+union cpuid35_ebx { -+ struct { -+ /* UnitMask2 Supported */ -+ unsigned int umask2:1; -+ /* EQ-bit Supported */ -+ unsigned int eq:1; -+ unsigned int reserved:30; -+ } split; -+ unsigned int full; -+}; -+ - /* - * Intel Architectural LBR CPUID detection/enumeration details: - */ -diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c -index 7b5ba5b8592a25..7df458a6553eb2 100644 ---- a/arch/x86/kernel/cpu/bugs.c -+++ b/arch/x86/kernel/cpu/bugs.c -@@ -1113,6 +1113,8 @@ static void __init retbleed_select_mitigation(void) - - case RETBLEED_MITIGATION_IBPB: - setup_force_cpu_cap(X86_FEATURE_ENTRY_IBPB); -+ setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT); -+ mitigate_smt = true; - - /* - * IBPB on entry already obviates the need for -@@ -1122,9 +1124,6 @@ static void __init retbleed_select_mitigation(void) - setup_clear_cpu_cap(X86_FEATURE_UNRET); - setup_clear_cpu_cap(X86_FEATURE_RETHUNK); - -- setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT); -- mitigate_smt = true; -- - /* - * There is no need for RSB filling: entry_ibpb() ensures - * all predictions, including the RSB, are invalidated, -@@ -2626,6 +2625,7 @@ static void __init srso_select_mitigation(void) - if (IS_ENABLED(CONFIG_CPU_IBPB_ENTRY)) { - if (has_microcode) { - setup_force_cpu_cap(X86_FEATURE_ENTRY_IBPB); -+ setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT); - srso_mitigation = SRSO_MITIGATION_IBPB; - - /* -@@ -2635,6 +2635,13 @@ static void __init srso_select_mitigation(void) - */ - setup_clear_cpu_cap(X86_FEATURE_UNRET); - setup_clear_cpu_cap(X86_FEATURE_RETHUNK); -+ -+ /* -+ * There is no need for RSB filling: entry_ibpb() ensures -+ * all predictions, including the RSB, are invalidated, -+ * regardless of IBPB implementation. -+ */ -+ setup_clear_cpu_cap(X86_FEATURE_RSB_VMEXIT); - } - } else { - pr_err("WARNING: kernel not compiled with CPU_IBPB_ENTRY.\n"); -@@ -2643,8 +2650,8 @@ static void __init srso_select_mitigation(void) - break; - - case SRSO_CMD_IBPB_ON_VMEXIT: -- if (IS_ENABLED(CONFIG_CPU_SRSO)) { -- if (!boot_cpu_has(X86_FEATURE_ENTRY_IBPB) && has_microcode) { -+ if (IS_ENABLED(CONFIG_CPU_IBPB_ENTRY)) { -+ if (has_microcode) { - setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT); - srso_mitigation = SRSO_MITIGATION_IBPB_ON_VMEXIT; - -@@ -2656,9 +2663,9 @@ static void __init srso_select_mitigation(void) - setup_clear_cpu_cap(X86_FEATURE_RSB_VMEXIT); - } - } else { -- pr_err("WARNING: kernel not compiled with CPU_SRSO.\n"); -+ pr_err("WARNING: kernel not compiled with CPU_IBPB_ENTRY.\n"); - goto pred_cmd; -- } -+ } - break; - - default: -diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c -index 35fb26cbf22941..892e2540f008ae 100644 ---- a/drivers/bluetooth/btqca.c -+++ b/drivers/bluetooth/btqca.c -@@ -289,6 +289,39 @@ int qca_send_pre_shutdown_cmd(struct hci_dev *hdev) - } - EXPORT_SYMBOL_GPL(qca_send_pre_shutdown_cmd); - -+static bool qca_filename_has_extension(const char *filename) -+{ -+ const char *suffix = strrchr(filename, '.'); -+ -+ /* File extensions require a dot, but not as the first or last character */ -+ if (!suffix || suffix == filename || *(suffix + 1) == '\0') -+ return 0; -+ -+ /* Avoid matching directories with names that look like files with extensions */ -+ return !strchr(suffix, '/'); -+} -+ -+static bool qca_get_alt_nvm_file(char *filename, size_t max_size) -+{ -+ char fwname[64]; -+ const char *suffix; -+ -+ /* nvm file name has an extension, replace with .bin */ -+ if (qca_filename_has_extension(filename)) { -+ suffix = strrchr(filename, '.'); -+ strscpy(fwname, filename, suffix - filename + 1); -+ snprintf(fwname + (suffix - filename), -+ sizeof(fwname) - (suffix - filename), ".bin"); -+ /* If nvm file is already the default one, return false to skip the retry. */ -+ if (strcmp(fwname, filename) == 0) -+ return false; -+ -+ snprintf(filename, max_size, "%s", fwname); -+ return true; -+ } -+ return false; -+} -+ - static int qca_tlv_check_data(struct hci_dev *hdev, - struct qca_fw_config *config, - u8 *fw_data, size_t fw_size, -@@ -586,6 +619,19 @@ static int qca_download_firmware(struct hci_dev *hdev, - config->fwname, ret); - return ret; - } -+ } -+ /* If the board-specific file is missing, try loading the default -+ * one, unless that was attempted already. -+ */ -+ else if (config->type == TLV_TYPE_NVM && -+ qca_get_alt_nvm_file(config->fwname, sizeof(config->fwname))) { -+ bt_dev_info(hdev, "QCA Downloading %s", config->fwname); -+ ret = request_firmware(&fw, config->fwname, &hdev->dev); -+ if (ret) { -+ bt_dev_err(hdev, "QCA Failed to request file: %s (%d)", -+ config->fwname, ret); -+ return ret; -+ } - } else { - bt_dev_err(hdev, "QCA Failed to request file: %s (%d)", - config->fwname, ret); -@@ -722,21 +768,38 @@ static int qca_check_bdaddr(struct hci_dev *hdev, const struct qca_fw_config *co - return 0; - } - --static void qca_generate_hsp_nvm_name(char *fwname, size_t max_size, -+static void qca_get_nvm_name_by_board(char *fwname, size_t max_size, -+ const char *stem, enum qca_btsoc_type soc_type, - struct qca_btsoc_version ver, u8 rom_ver, u16 bid) - { - const char *variant; -+ const char *prefix; - -- /* hsp gf chip */ -- if ((le32_to_cpu(ver.soc_id) & QCA_HSP_GF_SOC_MASK) == QCA_HSP_GF_SOC_ID) -- variant = "g"; -- else -- variant = ""; -+ /* Set the default value to variant and prefix */ -+ variant = ""; -+ prefix = "b"; - -- if (bid == 0x0) -- snprintf(fwname, max_size, "qca/hpnv%02x%s.bin", rom_ver, variant); -- else -- snprintf(fwname, max_size, "qca/hpnv%02x%s.%x", rom_ver, variant, bid); -+ if (soc_type == QCA_QCA2066) -+ prefix = ""; -+ -+ if (soc_type == QCA_WCN6855 || soc_type == QCA_QCA2066) { -+ /* If the chip is manufactured by GlobalFoundries */ -+ if ((le32_to_cpu(ver.soc_id) & QCA_HSP_GF_SOC_MASK) == QCA_HSP_GF_SOC_ID) -+ variant = "g"; -+ } -+ -+ if (rom_ver != 0) { -+ if (bid == 0x0 || bid == 0xffff) -+ snprintf(fwname, max_size, "qca/%s%02x%s.bin", stem, rom_ver, variant); -+ else -+ snprintf(fwname, max_size, "qca/%s%02x%s.%s%02x", stem, rom_ver, -+ variant, prefix, bid); -+ } else { -+ if (bid == 0x0 || bid == 0xffff) -+ snprintf(fwname, max_size, "qca/%s%s.bin", stem, variant); -+ else -+ snprintf(fwname, max_size, "qca/%s%s.%s%02x", stem, variant, prefix, bid); -+ } - } - - int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate, -@@ -819,14 +882,20 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate, - /* Give the controller some time to get ready to receive the NVM */ - msleep(10); - -- if (soc_type == QCA_QCA2066) -+ if (soc_type == QCA_QCA2066 || soc_type == QCA_WCN7850) - qca_read_fw_board_id(hdev, &boardid); - - /* Download NVM configuration */ - config.type = TLV_TYPE_NVM; - if (firmware_name) { -- snprintf(config.fwname, sizeof(config.fwname), -- "qca/%s", firmware_name); -+ /* The firmware name has an extension, use it directly */ -+ if (qca_filename_has_extension(firmware_name)) { -+ snprintf(config.fwname, sizeof(config.fwname), "qca/%s", firmware_name); -+ } else { -+ qca_read_fw_board_id(hdev, &boardid); -+ qca_get_nvm_name_by_board(config.fwname, sizeof(config.fwname), -+ firmware_name, soc_type, ver, 0, boardid); -+ } - } else { - switch (soc_type) { - case QCA_WCN3990: -@@ -845,8 +914,9 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate, - "qca/apnv%02x.bin", rom_ver); - break; - case QCA_QCA2066: -- qca_generate_hsp_nvm_name(config.fwname, -- sizeof(config.fwname), ver, rom_ver, boardid); -+ qca_get_nvm_name_by_board(config.fwname, -+ sizeof(config.fwname), "hpnv", soc_type, ver, -+ rom_ver, boardid); - break; - case QCA_QCA6390: - snprintf(config.fwname, sizeof(config.fwname), -@@ -857,14 +927,14 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate, - "qca/msnv%02x.bin", rom_ver); - break; - case QCA_WCN6855: -- snprintf(config.fwname, sizeof(config.fwname), -- "qca/hpnv%02x.bin", rom_ver); -+ qca_read_fw_board_id(hdev, &boardid); -+ qca_get_nvm_name_by_board(config.fwname, sizeof(config.fwname), -+ "hpnv", soc_type, ver, rom_ver, boardid); - break; - case QCA_WCN7850: -- snprintf(config.fwname, sizeof(config.fwname), -- "qca/hmtnv%02x.bin", rom_ver); -+ qca_get_nvm_name_by_board(config.fwname, sizeof(config.fwname), -+ "hmtnv", soc_type, ver, rom_ver, boardid); - break; -- - default: - snprintf(config.fwname, sizeof(config.fwname), - "qca/nvm_%08x.bin", soc_ver); -diff --git a/drivers/cpufreq/Kconfig b/drivers/cpufreq/Kconfig -index f429b9b37b76c7..7e773c47a4fcd2 100644 ---- a/drivers/cpufreq/Kconfig -+++ b/drivers/cpufreq/Kconfig -@@ -218,7 +218,7 @@ config CPUFREQ_DT - If in doubt, say N. - - config CPUFREQ_DT_PLATDEV -- tristate "Generic DT based cpufreq platdev driver" -+ bool "Generic DT based cpufreq platdev driver" - depends on OF - help - This adds a generic DT based cpufreq platdev driver for frequency -diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c -index fb2875ce1fdd57..09becf14653b58 100644 ---- a/drivers/cpufreq/cpufreq-dt-platdev.c -+++ b/drivers/cpufreq/cpufreq-dt-platdev.c -@@ -225,4 +225,3 @@ static int __init cpufreq_dt_platdev_init(void) - sizeof(struct cpufreq_dt_platform_data))); - } - core_initcall(cpufreq_dt_platdev_init); --MODULE_LICENSE("GPL"); -diff --git a/drivers/edac/qcom_edac.c b/drivers/edac/qcom_edac.c -index b2db545c681031..345cae059c029a 100644 ---- a/drivers/edac/qcom_edac.c -+++ b/drivers/edac/qcom_edac.c -@@ -95,7 +95,7 @@ static int qcom_llcc_core_setup(struct llcc_drv_data *drv, struct regmap *llcc_b - * Configure interrupt enable registers such that Tag, Data RAM related - * interrupts are propagated to interrupt controller for servicing - */ -- ret = regmap_update_bits(llcc_bcast_regmap, drv->edac_reg_offset->cmn_interrupt_2_enable, -+ ret = regmap_update_bits(llcc_bcast_regmap, drv->edac_reg_offset->cmn_interrupt_0_enable, - TRP0_INTERRUPT_ENABLE, - TRP0_INTERRUPT_ENABLE); - if (ret) -@@ -113,7 +113,7 @@ static int qcom_llcc_core_setup(struct llcc_drv_data *drv, struct regmap *llcc_b - if (ret) - return ret; - -- ret = regmap_update_bits(llcc_bcast_regmap, drv->edac_reg_offset->cmn_interrupt_2_enable, -+ ret = regmap_update_bits(llcc_bcast_regmap, drv->edac_reg_offset->cmn_interrupt_0_enable, - DRP0_INTERRUPT_ENABLE, - DRP0_INTERRUPT_ENABLE); - if (ret) -diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c -index 7af59985f1c1f9..4c5c2b73d42c21 100644 ---- a/drivers/firmware/qcom_scm.c -+++ b/drivers/firmware/qcom_scm.c -@@ -1339,7 +1339,8 @@ static int qcom_scm_find_dload_address(struct device *dev, u64 *addr) - */ - bool qcom_scm_is_available(void) - { -- return !!READ_ONCE(__scm); -+ /* Paired with smp_store_release() in qcom_scm_probe */ -+ return !!smp_load_acquire(&__scm); - } - EXPORT_SYMBOL_GPL(qcom_scm_is_available); - -@@ -1457,7 +1458,7 @@ static int qcom_scm_probe(struct platform_device *pdev) - if (ret) - return ret; - -- /* Let all above stores be available after this */ -+ /* Paired with smp_load_acquire() in qcom_scm_is_available(). */ - smp_store_release(&__scm, scm); - - irq = platform_get_irq_optional(pdev, 0); -diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c -index 1a59fca40252cd..347527885ffd75 100644 ---- a/drivers/gpu/drm/i915/display/intel_display.c -+++ b/drivers/gpu/drm/i915/display/intel_display.c -@@ -6141,12 +6141,30 @@ static int intel_async_flip_check_hw(struct intel_atomic_state *state, struct in - static int intel_bigjoiner_add_affected_crtcs(struct intel_atomic_state *state) - { - struct drm_i915_private *i915 = to_i915(state->base.dev); -+ const struct intel_plane_state *plane_state; - struct intel_crtc_state *crtc_state; -+ struct intel_plane *plane; - struct intel_crtc *crtc; - u8 affected_pipes = 0; - u8 modeset_pipes = 0; - int i; - -+ /* -+ * Any plane which is in use by the joiner needs its crtc. -+ * Pull those in first as this will not have happened yet -+ * if the plane remains disabled according to uapi. -+ */ -+ for_each_new_intel_plane_in_state(state, plane, plane_state, i) { -+ crtc = to_intel_crtc(plane_state->hw.crtc); -+ if (!crtc) -+ continue; -+ -+ crtc_state = intel_atomic_get_crtc_state(&state->base, crtc); -+ if (IS_ERR(crtc_state)) -+ return PTR_ERR(crtc_state); -+ } -+ -+ /* Now pull in all joined crtcs */ - for_each_new_intel_crtc_in_state(state, crtc, crtc_state, i) { - affected_pipes |= crtc_state->bigjoiner_pipes; - if (intel_crtc_needs_modeset(crtc_state)) -diff --git a/drivers/gpu/drm/i915/display/intel_dp_link_training.c b/drivers/gpu/drm/i915/display/intel_dp_link_training.c -index eb5559e1a20024..f79809a48672ed 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp_link_training.c -+++ b/drivers/gpu/drm/i915/display/intel_dp_link_training.c -@@ -1364,7 +1364,7 @@ intel_dp_128b132b_link_train(struct intel_dp *intel_dp, - - if (wait_for(intel_dp_128b132b_intra_hop(intel_dp, crtc_state) == 0, 500)) { - lt_err(intel_dp, DP_PHY_DPRX, "128b/132b intra-hop not clear\n"); -- return false; -+ goto out; - } - - if (intel_dp_128b132b_lane_eq(intel_dp, crtc_state) && -@@ -1376,6 +1376,19 @@ intel_dp_128b132b_link_train(struct intel_dp *intel_dp, - passed ? "passed" : "failed", - crtc_state->port_clock, crtc_state->lane_count); - -+out: -+ /* -+ * Ensure that the training pattern does get set to TPS2 even in case -+ * of a failure, as is the case at the end of a passing link training -+ * and what is expected by the transcoder. Leaving TPS1 set (and -+ * disabling the link train mode in DP_TP_CTL later from TPS1 directly) -+ * would result in a stuck transcoder HW state and flip-done timeouts -+ * later in the modeset sequence. -+ */ -+ if (!passed) -+ intel_dp_program_link_training_pattern(intel_dp, crtc_state, -+ DP_PHY_DPRX, DP_TRAINING_PATTERN_2); -+ - return passed; - } - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c -index 10c68de1bf22ca..35cf9080168b12 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c -@@ -2075,6 +2075,9 @@ void dpu_encoder_helper_phys_cleanup(struct dpu_encoder_phys *phys_enc) - } - } - -+ if (phys_enc->hw_pp && phys_enc->hw_pp->ops.setup_dither) -+ phys_enc->hw_pp->ops.setup_dither(phys_enc->hw_pp, NULL); -+ - /* reset the merge 3D HW block */ - if (phys_enc->hw_pp && phys_enc->hw_pp->merge_3d) { - phys_enc->hw_pp->merge_3d->ops.setup_3d_mode(phys_enc->hw_pp->merge_3d, -diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h -index 48e1a8c6942c9f..223bf904235a81 100644 ---- a/drivers/gpu/drm/msm/msm_drv.h -+++ b/drivers/gpu/drm/msm/msm_drv.h -@@ -533,15 +533,12 @@ static inline int align_pitch(int width, int bpp) - static inline unsigned long timeout_to_jiffies(const ktime_t *timeout) - { - ktime_t now = ktime_get(); -- s64 remaining_jiffies; - -- if (ktime_compare(*timeout, now) < 0) { -- remaining_jiffies = 0; -- } else { -- ktime_t rem = ktime_sub(*timeout, now); -- remaining_jiffies = ktime_divns(rem, NSEC_PER_SEC / HZ); -- } -+ if (ktime_compare(*timeout, now) <= 0) -+ return 0; - -+ ktime_t rem = ktime_sub(*timeout, now); -+ s64 remaining_jiffies = ktime_divns(rem, NSEC_PER_SEC / HZ); - return clamp(remaining_jiffies, 1LL, (s64)INT_MAX); - } - -diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c -index db1e748daa753f..1113e6b2ec8ec9 100644 ---- a/drivers/gpu/drm/msm/msm_gem.c -+++ b/drivers/gpu/drm/msm/msm_gem.c -@@ -226,9 +226,9 @@ static struct page **msm_gem_pin_pages_locked(struct drm_gem_object *obj, - - msm_gem_assert_locked(obj); - -- if (GEM_WARN_ON(msm_obj->madv > madv)) { -- DRM_DEV_ERROR(obj->dev->dev, "Invalid madv state: %u vs %u\n", -- msm_obj->madv, madv); -+ if (msm_obj->madv > madv) { -+ DRM_DEV_DEBUG_DRIVER(obj->dev->dev, "Invalid madv state: %u vs %u\n", -+ msm_obj->madv, madv); - return ERR_PTR(-EBUSY); - } - -diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c -index 99744de6c05a1b..018b39546fc1dd 100644 ---- a/drivers/gpu/drm/msm/msm_gem_submit.c -+++ b/drivers/gpu/drm/msm/msm_gem_submit.c -@@ -17,6 +17,12 @@ - #include "msm_gem.h" - #include "msm_gpu_trace.h" - -+/* For userspace errors, use DRM_UT_DRIVER.. so that userspace can enable -+ * error msgs for debugging, but we don't spam dmesg by default -+ */ -+#define SUBMIT_ERROR(submit, fmt, ...) \ -+ DRM_DEV_DEBUG_DRIVER((submit)->dev->dev, fmt, ##__VA_ARGS__) -+ - /* - * Cmdstream submission: - */ -@@ -136,7 +142,7 @@ static int submit_lookup_objects(struct msm_gem_submit *submit, - - if ((submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) || - !(submit_bo.flags & MANDATORY_FLAGS)) { -- DRM_ERROR("invalid flags: %x\n", submit_bo.flags); -+ SUBMIT_ERROR(submit, "invalid flags: %x\n", submit_bo.flags); - ret = -EINVAL; - i = 0; - goto out; -@@ -158,7 +164,7 @@ static int submit_lookup_objects(struct msm_gem_submit *submit, - */ - obj = idr_find(&file->object_idr, submit->bos[i].handle); - if (!obj) { -- DRM_ERROR("invalid handle %u at index %u\n", submit->bos[i].handle, i); -+ SUBMIT_ERROR(submit, "invalid handle %u at index %u\n", submit->bos[i].handle, i); - ret = -EINVAL; - goto out_unlock; - } -@@ -202,13 +208,13 @@ static int submit_lookup_cmds(struct msm_gem_submit *submit, - case MSM_SUBMIT_CMD_CTX_RESTORE_BUF: - break; - default: -- DRM_ERROR("invalid type: %08x\n", submit_cmd.type); -+ SUBMIT_ERROR(submit, "invalid type: %08x\n", submit_cmd.type); - return -EINVAL; - } - - if (submit_cmd.size % 4) { -- DRM_ERROR("non-aligned cmdstream buffer size: %u\n", -- submit_cmd.size); -+ SUBMIT_ERROR(submit, "non-aligned cmdstream buffer size: %u\n", -+ submit_cmd.size); - ret = -EINVAL; - goto out; - } -@@ -306,8 +312,8 @@ static int submit_lock_objects(struct msm_gem_submit *submit) - - fail: - if (ret == -EALREADY) { -- DRM_ERROR("handle %u at index %u already on submit list\n", -- submit->bos[i].handle, i); -+ SUBMIT_ERROR(submit, "handle %u at index %u already on submit list\n", -+ submit->bos[i].handle, i); - ret = -EINVAL; - } - -@@ -448,8 +454,8 @@ static int submit_bo(struct msm_gem_submit *submit, uint32_t idx, - struct drm_gem_object **obj, uint64_t *iova, bool *valid) - { - if (idx >= submit->nr_bos) { -- DRM_ERROR("invalid buffer index: %u (out of %u)\n", -- idx, submit->nr_bos); -+ SUBMIT_ERROR(submit, "invalid buffer index: %u (out of %u)\n", -+ idx, submit->nr_bos); - return -EINVAL; - } - -@@ -475,7 +481,7 @@ static int submit_reloc(struct msm_gem_submit *submit, struct drm_gem_object *ob - return 0; - - if (offset % 4) { -- DRM_ERROR("non-aligned cmdstream buffer: %u\n", offset); -+ SUBMIT_ERROR(submit, "non-aligned cmdstream buffer: %u\n", offset); - return -EINVAL; - } - -@@ -497,8 +503,8 @@ static int submit_reloc(struct msm_gem_submit *submit, struct drm_gem_object *ob - bool valid; - - if (submit_reloc.submit_offset % 4) { -- DRM_ERROR("non-aligned reloc offset: %u\n", -- submit_reloc.submit_offset); -+ SUBMIT_ERROR(submit, "non-aligned reloc offset: %u\n", -+ submit_reloc.submit_offset); - ret = -EINVAL; - goto out; - } -@@ -508,7 +514,7 @@ static int submit_reloc(struct msm_gem_submit *submit, struct drm_gem_object *ob - - if ((off >= (obj->size / 4)) || - (off < last_offset)) { -- DRM_ERROR("invalid offset %u at reloc %u\n", off, i); -+ SUBMIT_ERROR(submit, "invalid offset %u at reloc %u\n", off, i); - ret = -EINVAL; - goto out; - } -@@ -879,9 +885,8 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, - goto out; - - if (!submit->cmd[i].size || -- ((submit->cmd[i].size + submit->cmd[i].offset) > -- obj->size / 4)) { -- DRM_ERROR("invalid cmdstream size: %u\n", submit->cmd[i].size * 4); -+ (size_add(submit->cmd[i].size, submit->cmd[i].offset) > obj->size / 4)) { -+ SUBMIT_ERROR(submit, "invalid cmdstream size: %u\n", submit->cmd[i].size * 4); - ret = -EINVAL; - goto out; - } -@@ -893,7 +898,7 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, - - if (!gpu->allow_relocs) { - if (submit->cmd[i].nr_relocs) { -- DRM_ERROR("relocs not allowed\n"); -+ SUBMIT_ERROR(submit, "relocs not allowed\n"); - ret = -EINVAL; - goto out; - } -diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c -index ec9f307370fa8a..6c71f6738ca510 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_svm.c -+++ b/drivers/gpu/drm/nouveau/nouveau_svm.c -@@ -593,6 +593,7 @@ static int nouveau_atomic_range_fault(struct nouveau_svmm *svmm, - unsigned long timeout = - jiffies + msecs_to_jiffies(HMM_RANGE_DEFAULT_TIMEOUT); - struct mm_struct *mm = svmm->notifier.mm; -+ struct folio *folio; - struct page *page; - unsigned long start = args->p.addr; - unsigned long notifier_seq; -@@ -619,12 +620,16 @@ static int nouveau_atomic_range_fault(struct nouveau_svmm *svmm, - ret = -EINVAL; - goto out; - } -+ folio = page_folio(page); - - mutex_lock(&svmm->mutex); - if (!mmu_interval_read_retry(¬ifier->notifier, - notifier_seq)) - break; - mutex_unlock(&svmm->mutex); -+ -+ folio_unlock(folio); -+ folio_put(folio); - } - - /* Map the page on the GPU. */ -@@ -640,8 +645,8 @@ static int nouveau_atomic_range_fault(struct nouveau_svmm *svmm, - ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, size, NULL); - mutex_unlock(&svmm->mutex); - -- unlock_page(page); -- put_page(page); -+ folio_unlock(folio); -+ folio_put(folio); - - out: - mmu_interval_notifier_remove(¬ifier->notifier); -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c -index a6f410ba60bc94..d393bc540f8628 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c -@@ -75,7 +75,7 @@ gp10b_pmu_acr = { - .bootstrap_multiple_falcons = gp10b_pmu_acr_bootstrap_multiple_falcons, - }; - --#if IS_ENABLED(CONFIG_ARCH_TEGRA_210_SOC) -+#if IS_ENABLED(CONFIG_ARCH_TEGRA_186_SOC) - MODULE_FIRMWARE("nvidia/gp10b/pmu/desc.bin"); - MODULE_FIRMWARE("nvidia/gp10b/pmu/image.bin"); - MODULE_FIRMWARE("nvidia/gp10b/pmu/sig.bin"); -diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c -index ee3531bbccd7df..355c64bafb82b8 100644 ---- a/drivers/gpu/drm/tidss/tidss_dispc.c -+++ b/drivers/gpu/drm/tidss/tidss_dispc.c -@@ -2704,14 +2704,32 @@ static void dispc_init_errata(struct dispc_device *dispc) - } - } - -+/* -+ * K2G display controller does not support soft reset, so we do a basic manual -+ * reset here: make sure the IRQs are masked and VPs are disabled. -+ */ -+static void dispc_softreset_k2g(struct dispc_device *dispc) -+{ -+ unsigned long flags; -+ -+ spin_lock_irqsave(&dispc->tidss->wait_lock, flags); -+ dispc_set_irqenable(dispc, 0); -+ dispc_read_and_clear_irqstatus(dispc); -+ spin_unlock_irqrestore(&dispc->tidss->wait_lock, flags); -+ -+ for (unsigned int vp_idx = 0; vp_idx < dispc->feat->num_vps; ++vp_idx) -+ VP_REG_FLD_MOD(dispc, vp_idx, DISPC_VP_CONTROL, 0, 0, 0); -+} -+ - static int dispc_softreset(struct dispc_device *dispc) - { - u32 val; - int ret = 0; - -- /* K2G display controller does not support soft reset */ -- if (dispc->feat->subrev == DISPC_K2G) -+ if (dispc->feat->subrev == DISPC_K2G) { -+ dispc_softreset_k2g(dispc); - return 0; -+ } - - /* Soft reset */ - REG_FLD_MOD(dispc, DSS_SYSCONFIG, 1, 1, 1); -diff --git a/drivers/gpu/drm/tidss/tidss_irq.c b/drivers/gpu/drm/tidss/tidss_irq.c -index 0c681c7600bcb2..f13c7e434f8ede 100644 ---- a/drivers/gpu/drm/tidss/tidss_irq.c -+++ b/drivers/gpu/drm/tidss/tidss_irq.c -@@ -60,7 +60,9 @@ static irqreturn_t tidss_irq_handler(int irq, void *arg) - unsigned int id; - dispc_irq_t irqstatus; - -+ spin_lock(&tidss->wait_lock); - irqstatus = dispc_read_and_clear_irqstatus(tidss->dispc); -+ spin_unlock(&tidss->wait_lock); - - for (id = 0; id < tidss->num_crtcs; id++) { - struct drm_crtc *crtc = tidss->crtcs[id]; -diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c -index cff3393f0dd000..26677432ac8361 100644 ---- a/drivers/input/mouse/synaptics.c -+++ b/drivers/input/mouse/synaptics.c -@@ -667,23 +667,50 @@ static void synaptics_pt_stop(struct serio *serio) - serio_continue_rx(parent->ps2dev.serio); - } - -+static int synaptics_pt_open(struct serio *serio) -+{ -+ struct psmouse *parent = psmouse_from_serio(serio->parent); -+ struct synaptics_data *priv = parent->private; -+ -+ guard(serio_pause_rx)(parent->ps2dev.serio); -+ priv->pt_port_open = true; -+ -+ return 0; -+} -+ -+static void synaptics_pt_close(struct serio *serio) -+{ -+ struct psmouse *parent = psmouse_from_serio(serio->parent); -+ struct synaptics_data *priv = parent->private; -+ -+ guard(serio_pause_rx)(parent->ps2dev.serio); -+ priv->pt_port_open = false; -+} -+ - static int synaptics_is_pt_packet(u8 *buf) - { - return (buf[0] & 0xFC) == 0x84 && (buf[3] & 0xCC) == 0xC4; - } - --static void synaptics_pass_pt_packet(struct serio *ptport, u8 *packet) -+static void synaptics_pass_pt_packet(struct synaptics_data *priv, u8 *packet) - { -- struct psmouse *child = psmouse_from_serio(ptport); -+ struct serio *ptport; - -- if (child && child->state == PSMOUSE_ACTIVATED) { -- serio_interrupt(ptport, packet[1], 0); -- serio_interrupt(ptport, packet[4], 0); -- serio_interrupt(ptport, packet[5], 0); -- if (child->pktsize == 4) -- serio_interrupt(ptport, packet[2], 0); -- } else { -- serio_interrupt(ptport, packet[1], 0); -+ ptport = priv->pt_port; -+ if (!ptport) -+ return; -+ -+ serio_interrupt(ptport, packet[1], 0); -+ -+ if (priv->pt_port_open) { -+ struct psmouse *child = psmouse_from_serio(ptport); -+ -+ if (child->state == PSMOUSE_ACTIVATED) { -+ serio_interrupt(ptport, packet[4], 0); -+ serio_interrupt(ptport, packet[5], 0); -+ if (child->pktsize == 4) -+ serio_interrupt(ptport, packet[2], 0); -+ } - } - } - -@@ -722,6 +749,8 @@ static void synaptics_pt_create(struct psmouse *psmouse) - serio->write = synaptics_pt_write; - serio->start = synaptics_pt_start; - serio->stop = synaptics_pt_stop; -+ serio->open = synaptics_pt_open; -+ serio->close = synaptics_pt_close; - serio->parent = psmouse->ps2dev.serio; - - psmouse->pt_activate = synaptics_pt_activate; -@@ -1218,11 +1247,10 @@ static psmouse_ret_t synaptics_process_byte(struct psmouse *psmouse) - - if (SYN_CAP_PASS_THROUGH(priv->info.capabilities) && - synaptics_is_pt_packet(psmouse->packet)) { -- if (priv->pt_port) -- synaptics_pass_pt_packet(priv->pt_port, -- psmouse->packet); -- } else -+ synaptics_pass_pt_packet(priv, psmouse->packet); -+ } else { - synaptics_process_packet(psmouse); -+ } - - return PSMOUSE_FULL_PACKET; - } -diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h -index 08533d1b1b16fc..4b34f13b9f7616 100644 ---- a/drivers/input/mouse/synaptics.h -+++ b/drivers/input/mouse/synaptics.h -@@ -188,6 +188,7 @@ struct synaptics_data { - bool disable_gesture; /* disable gestures */ - - struct serio *pt_port; /* Pass-through serio port */ -+ bool pt_port_open; - - /* - * Last received Advanced Gesture Mode (AGM) packet. An AGM packet -diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c -index 2085b1705f144f..deb40a8ba39995 100644 ---- a/drivers/md/md-bitmap.c -+++ b/drivers/md/md-bitmap.c -@@ -2112,33 +2112,29 @@ int md_bitmap_copy_from_slot(struct mddev *mddev, int slot, - } - EXPORT_SYMBOL_GPL(md_bitmap_copy_from_slot); - -- --void md_bitmap_status(struct seq_file *seq, struct bitmap *bitmap) -+int md_bitmap_get_stats(struct bitmap *bitmap, struct md_bitmap_stats *stats) - { -- unsigned long chunk_kb; - struct bitmap_counts *counts; -+ bitmap_super_t *sb; - - if (!bitmap) -- return; -+ return -ENOENT; -+ if (bitmap->mddev->bitmap_info.external) -+ return -ENOENT; -+ if (!bitmap->storage.sb_page) /* no superblock */ -+ return -EINVAL; -+ sb = kmap_local_page(bitmap->storage.sb_page); -+ stats->sync_size = le64_to_cpu(sb->sync_size); -+ kunmap_local(sb); - - counts = &bitmap->counts; -+ stats->missing_pages = counts->missing_pages; -+ stats->pages = counts->pages; -+ stats->file = bitmap->storage.file; - -- chunk_kb = bitmap->mddev->bitmap_info.chunksize >> 10; -- seq_printf(seq, "bitmap: %lu/%lu pages [%luKB], " -- "%lu%s chunk", -- counts->pages - counts->missing_pages, -- counts->pages, -- (counts->pages - counts->missing_pages) -- << (PAGE_SHIFT - 10), -- chunk_kb ? chunk_kb : bitmap->mddev->bitmap_info.chunksize, -- chunk_kb ? "KB" : "B"); -- if (bitmap->storage.file) { -- seq_printf(seq, ", file: "); -- seq_file_path(seq, bitmap->storage.file, " \t\n"); -- } -- -- seq_printf(seq, "\n"); -+ return 0; - } -+EXPORT_SYMBOL_GPL(md_bitmap_get_stats); - - int md_bitmap_resize(struct bitmap *bitmap, sector_t blocks, - int chunksize, int init) -diff --git a/drivers/md/md-bitmap.h b/drivers/md/md-bitmap.h -index 8b89e260a93b71..840efd1b8a01cd 100644 ---- a/drivers/md/md-bitmap.h -+++ b/drivers/md/md-bitmap.h -@@ -234,6 +234,13 @@ struct bitmap { - int cluster_slot; /* Slot offset for clustered env */ - }; - -+struct md_bitmap_stats { -+ unsigned long missing_pages; -+ unsigned long sync_size; -+ unsigned long pages; -+ struct file *file; -+}; -+ - /* the bitmap API */ - - /* these are used only by md/bitmap */ -@@ -244,7 +251,7 @@ void md_bitmap_destroy(struct mddev *mddev); - - void md_bitmap_print_sb(struct bitmap *bitmap); - void md_bitmap_update_sb(struct bitmap *bitmap); --void md_bitmap_status(struct seq_file *seq, struct bitmap *bitmap); -+int md_bitmap_get_stats(struct bitmap *bitmap, struct md_bitmap_stats *stats); - - int md_bitmap_setallbits(struct bitmap *bitmap); - void md_bitmap_write_all(struct bitmap *bitmap); -diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c -index 1e26eb22334950..6a89f6b5d64f98 100644 ---- a/drivers/md/md-cluster.c -+++ b/drivers/md/md-cluster.c -@@ -1190,18 +1190,21 @@ static int resize_bitmaps(struct mddev *mddev, sector_t newsize, sector_t oldsiz - */ - static int cluster_check_sync_size(struct mddev *mddev) - { -- int i, rv; -- bitmap_super_t *sb; -- unsigned long my_sync_size, sync_size = 0; -- int node_num = mddev->bitmap_info.nodes; - int current_slot = md_cluster_ops->slot_number(mddev); -+ int node_num = mddev->bitmap_info.nodes; - struct bitmap *bitmap = mddev->bitmap; -- char str[64]; - struct dlm_lock_resource *bm_lockres; -+ struct md_bitmap_stats stats; -+ unsigned long sync_size = 0; -+ unsigned long my_sync_size; -+ char str[64]; -+ int i, rv; - -- sb = kmap_atomic(bitmap->storage.sb_page); -- my_sync_size = sb->sync_size; -- kunmap_atomic(sb); -+ rv = md_bitmap_get_stats(bitmap, &stats); -+ if (rv) -+ return rv; -+ -+ my_sync_size = stats.sync_size; - - for (i = 0; i < node_num; i++) { - if (i == current_slot) -@@ -1230,15 +1233,18 @@ static int cluster_check_sync_size(struct mddev *mddev) - md_bitmap_update_sb(bitmap); - lockres_free(bm_lockres); - -- sb = kmap_atomic(bitmap->storage.sb_page); -- if (sync_size == 0) -- sync_size = sb->sync_size; -- else if (sync_size != sb->sync_size) { -- kunmap_atomic(sb); -+ rv = md_bitmap_get_stats(bitmap, &stats); -+ if (rv) { -+ md_bitmap_free(bitmap); -+ return rv; -+ } -+ -+ if (sync_size == 0) { -+ sync_size = stats.sync_size; -+ } else if (sync_size != stats.sync_size) { - md_bitmap_free(bitmap); - return -1; - } -- kunmap_atomic(sb); - md_bitmap_free(bitmap); - } - -diff --git a/drivers/md/md.c b/drivers/md/md.c -index 9bc19a5a4119bd..a8ac4afc51d91d 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -633,28 +633,33 @@ static inline struct mddev *mddev_get(struct mddev *mddev) - - static void mddev_delayed_delete(struct work_struct *ws); - -+static void __mddev_put(struct mddev *mddev) -+{ -+ if (mddev->raid_disks || !list_empty(&mddev->disks) || -+ mddev->ctime || mddev->hold_active) -+ return; -+ -+ /* Array is not configured at all, and not held active, so destroy it */ -+ set_bit(MD_DELETED, &mddev->flags); -+ -+ /* -+ * Call queue_work inside the spinlock so that flush_workqueue() after -+ * mddev_find will succeed in waiting for the work to be done. -+ */ -+ queue_work(md_misc_wq, &mddev->del_work); -+} -+ - void mddev_put(struct mddev *mddev) - { - if (!atomic_dec_and_lock(&mddev->active, &all_mddevs_lock)) - return; -- if (!mddev->raid_disks && list_empty(&mddev->disks) && -- mddev->ctime == 0 && !mddev->hold_active) { -- /* Array is not configured at all, and not held active, -- * so destroy it */ -- set_bit(MD_DELETED, &mddev->flags); - -- /* -- * Call queue_work inside the spinlock so that -- * flush_workqueue() after mddev_find will succeed in waiting -- * for the work to be done. -- */ -- INIT_WORK(&mddev->del_work, mddev_delayed_delete); -- queue_work(md_misc_wq, &mddev->del_work); -- } -+ __mddev_put(mddev); - spin_unlock(&all_mddevs_lock); - } - - static void md_safemode_timeout(struct timer_list *t); -+static void md_start_sync(struct work_struct *ws); - - void mddev_init(struct mddev *mddev) - { -@@ -679,6 +684,9 @@ void mddev_init(struct mddev *mddev) - mddev->resync_min = 0; - mddev->resync_max = MaxSector; - mddev->level = LEVEL_NONE; -+ -+ INIT_WORK(&mddev->sync_work, md_start_sync); -+ INIT_WORK(&mddev->del_work, mddev_delayed_delete); - } - EXPORT_SYMBOL_GPL(mddev_init); - -@@ -4828,7 +4836,7 @@ static void stop_sync_thread(struct mddev *mddev) - return; - } - -- if (work_pending(&mddev->del_work)) -+ if (work_pending(&mddev->sync_work)) - flush_workqueue(md_misc_wq); - - set_bit(MD_RECOVERY_INTR, &mddev->recovery); -@@ -6285,7 +6293,7 @@ static void md_clean(struct mddev *mddev) - static void __md_stop_writes(struct mddev *mddev) - { - set_bit(MD_RECOVERY_FROZEN, &mddev->recovery); -- if (work_pending(&mddev->del_work)) -+ if (work_pending(&mddev->sync_work)) - flush_workqueue(md_misc_wq); - if (mddev->sync_thread) { - set_bit(MD_RECOVERY_INTR, &mddev->recovery); -@@ -8113,6 +8121,19 @@ static void status_unused(struct seq_file *seq) - seq_printf(seq, "\n"); - } - -+static void status_personalities(struct seq_file *seq) -+{ -+ struct md_personality *pers; -+ -+ seq_puts(seq, "Personalities : "); -+ spin_lock(&pers_lock); -+ list_for_each_entry(pers, &pers_list, list) -+ seq_printf(seq, "[%s] ", pers->name); -+ -+ spin_unlock(&pers_lock); -+ seq_puts(seq, "\n"); -+} -+ - static int status_resync(struct seq_file *seq, struct mddev *mddev) - { - sector_t max_sectors, resync, res; -@@ -8252,104 +8273,73 @@ static int status_resync(struct seq_file *seq, struct mddev *mddev) - } - - static void *md_seq_start(struct seq_file *seq, loff_t *pos) -+ __acquires(&all_mddevs_lock) - { -- struct list_head *tmp; -- loff_t l = *pos; -- struct mddev *mddev; -- -- if (l == 0x10000) { -- ++*pos; -- return (void *)2; -- } -- if (l > 0x10000) -- return NULL; -- if (!l--) -- /* header */ -- return (void*)1; -- -+ seq->poll_event = atomic_read(&md_event_count); - spin_lock(&all_mddevs_lock); -- list_for_each(tmp,&all_mddevs) -- if (!l--) { -- mddev = list_entry(tmp, struct mddev, all_mddevs); -- if (!mddev_get(mddev)) -- continue; -- spin_unlock(&all_mddevs_lock); -- return mddev; -- } -- spin_unlock(&all_mddevs_lock); -- if (!l--) -- return (void*)2;/* tail */ -- return NULL; -+ -+ return seq_list_start_head(&all_mddevs, *pos); - } - - static void *md_seq_next(struct seq_file *seq, void *v, loff_t *pos) - { -- struct list_head *tmp; -- struct mddev *next_mddev, *mddev = v; -- struct mddev *to_put = NULL; -+ return seq_list_next(v, &all_mddevs, pos); -+} - -- ++*pos; -- if (v == (void*)2) -- return NULL; -+static void md_seq_stop(struct seq_file *seq, void *v) -+ __releases(&all_mddevs_lock) -+{ -+ spin_unlock(&all_mddevs_lock); -+} - -- spin_lock(&all_mddevs_lock); -- if (v == (void*)1) { -- tmp = all_mddevs.next; -- } else { -- to_put = mddev; -- tmp = mddev->all_mddevs.next; -- } -+static void md_bitmap_status(struct seq_file *seq, struct mddev *mddev) -+{ -+ struct md_bitmap_stats stats; -+ unsigned long used_pages; -+ unsigned long chunk_kb; -+ int err; - -- for (;;) { -- if (tmp == &all_mddevs) { -- next_mddev = (void*)2; -- *pos = 0x10000; -- break; -- } -- next_mddev = list_entry(tmp, struct mddev, all_mddevs); -- if (mddev_get(next_mddev)) -- break; -- mddev = next_mddev; -- tmp = mddev->all_mddevs.next; -- } -- spin_unlock(&all_mddevs_lock); -+ err = md_bitmap_get_stats(mddev->bitmap, &stats); -+ if (err) -+ return; - -- if (to_put) -- mddev_put(to_put); -- return next_mddev; -+ chunk_kb = mddev->bitmap_info.chunksize >> 10; -+ used_pages = stats.pages - stats.missing_pages; - --} -+ seq_printf(seq, "bitmap: %lu/%lu pages [%luKB], %lu%s chunk", -+ used_pages, stats.pages, used_pages << (PAGE_SHIFT - 10), -+ chunk_kb ? chunk_kb : mddev->bitmap_info.chunksize, -+ chunk_kb ? "KB" : "B"); - --static void md_seq_stop(struct seq_file *seq, void *v) --{ -- struct mddev *mddev = v; -+ if (stats.file) { -+ seq_puts(seq, ", file: "); -+ seq_file_path(seq, stats.file, " \t\n"); -+ } - -- if (mddev && v != (void*)1 && v != (void*)2) -- mddev_put(mddev); -+ seq_putc(seq, '\n'); - } - - static int md_seq_show(struct seq_file *seq, void *v) - { -- struct mddev *mddev = v; -+ struct mddev *mddev; - sector_t sectors; - struct md_rdev *rdev; - -- if (v == (void*)1) { -- struct md_personality *pers; -- seq_printf(seq, "Personalities : "); -- spin_lock(&pers_lock); -- list_for_each_entry(pers, &pers_list, list) -- seq_printf(seq, "[%s] ", pers->name); -- -- spin_unlock(&pers_lock); -- seq_printf(seq, "\n"); -- seq->poll_event = atomic_read(&md_event_count); -+ if (v == &all_mddevs) { -+ status_personalities(seq); -+ if (list_empty(&all_mddevs)) -+ status_unused(seq); - return 0; - } -- if (v == (void*)2) { -- status_unused(seq); -+ -+ mddev = list_entry(v, struct mddev, all_mddevs); -+ if (!mddev_get(mddev)) - return 0; -- } -+ -+ spin_unlock(&all_mddevs_lock); -+ -+ /* prevent bitmap to be freed after checking */ -+ mutex_lock(&mddev->bitmap_info.mutex); - - spin_lock(&mddev->lock); - if (mddev->pers || mddev->raid_disks || !list_empty(&mddev->disks)) { -@@ -8416,11 +8406,19 @@ static int md_seq_show(struct seq_file *seq, void *v) - } else - seq_printf(seq, "\n "); - -- md_bitmap_status(seq, mddev->bitmap); -+ md_bitmap_status(seq, mddev); - - seq_printf(seq, "\n"); - } - spin_unlock(&mddev->lock); -+ mutex_unlock(&mddev->bitmap_info.mutex); -+ spin_lock(&all_mddevs_lock); -+ -+ if (mddev == list_last_entry(&all_mddevs, struct mddev, all_mddevs)) -+ status_unused(seq); -+ -+ if (atomic_dec_and_test(&mddev->active)) -+ __mddev_put(mddev); - - return 0; - } -@@ -9333,7 +9331,7 @@ static int remove_and_add_spares(struct mddev *mddev, - - static void md_start_sync(struct work_struct *ws) - { -- struct mddev *mddev = container_of(ws, struct mddev, del_work); -+ struct mddev *mddev = container_of(ws, struct mddev, sync_work); - - rcu_assign_pointer(mddev->sync_thread, - md_register_thread(md_do_sync, mddev, "resync")); -@@ -9546,8 +9544,7 @@ void md_check_recovery(struct mddev *mddev) - */ - md_bitmap_write_all(mddev->bitmap); - } -- INIT_WORK(&mddev->del_work, md_start_sync); -- queue_work(md_misc_wq, &mddev->del_work); -+ queue_work(md_misc_wq, &mddev->sync_work); - goto unlock; - } - not_running: -diff --git a/drivers/md/md.h b/drivers/md/md.h -index f29fa8650cd0f0..46995558d3bd91 100644 ---- a/drivers/md/md.h -+++ b/drivers/md/md.h -@@ -453,7 +453,10 @@ struct mddev { - struct kernfs_node *sysfs_degraded; /*handle for 'degraded' */ - struct kernfs_node *sysfs_level; /*handle for 'level' */ - -- struct work_struct del_work; /* used for delayed sysfs removal */ -+ /* used for delayed sysfs removal */ -+ struct work_struct del_work; -+ /* used for register new sync thread */ -+ struct work_struct sync_work; - - /* "lock" protects: - * flush_bio transition from NULL to !NULL -diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c -index ce70e96b8fb52e..028c4a5049af97 100644 ---- a/drivers/media/usb/uvc/uvc_ctrl.c -+++ b/drivers/media/usb/uvc/uvc_ctrl.c -@@ -1532,6 +1532,40 @@ static void uvc_ctrl_send_slave_event(struct uvc_video_chain *chain, - uvc_ctrl_send_event(chain, handle, ctrl, mapping, val, changes); - } - -+static void uvc_ctrl_set_handle(struct uvc_fh *handle, struct uvc_control *ctrl, -+ struct uvc_fh *new_handle) -+{ -+ lockdep_assert_held(&handle->chain->ctrl_mutex); -+ -+ if (new_handle) { -+ if (ctrl->handle) -+ dev_warn_ratelimited(&handle->stream->dev->udev->dev, -+ "UVC non compliance: Setting an async control with a pending operation."); -+ -+ if (new_handle == ctrl->handle) -+ return; -+ -+ if (ctrl->handle) { -+ WARN_ON(!ctrl->handle->pending_async_ctrls); -+ if (ctrl->handle->pending_async_ctrls) -+ ctrl->handle->pending_async_ctrls--; -+ } -+ -+ ctrl->handle = new_handle; -+ handle->pending_async_ctrls++; -+ return; -+ } -+ -+ /* Cannot clear the handle for a control not owned by us.*/ -+ if (WARN_ON(ctrl->handle != handle)) -+ return; -+ -+ ctrl->handle = NULL; -+ if (WARN_ON(!handle->pending_async_ctrls)) -+ return; -+ handle->pending_async_ctrls--; -+} -+ - void uvc_ctrl_status_event(struct uvc_video_chain *chain, - struct uvc_control *ctrl, const u8 *data) - { -@@ -1542,7 +1576,8 @@ void uvc_ctrl_status_event(struct uvc_video_chain *chain, - mutex_lock(&chain->ctrl_mutex); - - handle = ctrl->handle; -- ctrl->handle = NULL; -+ if (handle) -+ uvc_ctrl_set_handle(handle, ctrl, NULL); - - list_for_each_entry(mapping, &ctrl->info.mappings, list) { - s32 value = __uvc_ctrl_get_value(mapping, data); -@@ -1762,7 +1797,10 @@ int uvc_ctrl_begin(struct uvc_video_chain *chain) - } - - static int uvc_ctrl_commit_entity(struct uvc_device *dev, -- struct uvc_entity *entity, int rollback, struct uvc_control **err_ctrl) -+ struct uvc_fh *handle, -+ struct uvc_entity *entity, -+ int rollback, -+ struct uvc_control **err_ctrl) - { - struct uvc_control *ctrl; - unsigned int i; -@@ -1810,6 +1848,10 @@ static int uvc_ctrl_commit_entity(struct uvc_device *dev, - *err_ctrl = ctrl; - return ret; - } -+ -+ if (!rollback && handle && -+ ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS) -+ uvc_ctrl_set_handle(handle, ctrl, handle); - } - - return 0; -@@ -1846,18 +1888,20 @@ int __uvc_ctrl_commit(struct uvc_fh *handle, int rollback, - - /* Find the control. */ - list_for_each_entry(entity, &chain->entities, chain) { -- ret = uvc_ctrl_commit_entity(chain->dev, entity, rollback, -- &err_ctrl); -- if (ret < 0) -+ ret = uvc_ctrl_commit_entity(chain->dev, handle, entity, -+ rollback, &err_ctrl); -+ if (ret < 0) { -+ if (ctrls) -+ ctrls->error_idx = -+ uvc_ctrl_find_ctrl_idx(entity, ctrls, -+ err_ctrl); - goto done; -+ } - } - - if (!rollback) - uvc_ctrl_send_events(handle, ctrls->controls, ctrls->count); - done: -- if (ret < 0 && ctrls) -- ctrls->error_idx = uvc_ctrl_find_ctrl_idx(entity, ctrls, -- err_ctrl); - mutex_unlock(&chain->ctrl_mutex); - return ret; - } -@@ -1995,9 +2039,6 @@ int uvc_ctrl_set(struct uvc_fh *handle, - mapping->set(mapping, value, - uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT)); - -- if (ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS) -- ctrl->handle = handle; -- - ctrl->dirty = 1; - ctrl->modified = 1; - return 0; -@@ -2170,7 +2211,7 @@ static int uvc_ctrl_init_xu_ctrl(struct uvc_device *dev, - int uvc_xu_ctrl_query(struct uvc_video_chain *chain, - struct uvc_xu_control_query *xqry) - { -- struct uvc_entity *entity; -+ struct uvc_entity *entity, *iter; - struct uvc_control *ctrl; - unsigned int i; - bool found; -@@ -2180,16 +2221,16 @@ int uvc_xu_ctrl_query(struct uvc_video_chain *chain, - int ret; - - /* Find the extension unit. */ -- found = false; -- list_for_each_entry(entity, &chain->entities, chain) { -- if (UVC_ENTITY_TYPE(entity) == UVC_VC_EXTENSION_UNIT && -- entity->id == xqry->unit) { -- found = true; -+ entity = NULL; -+ list_for_each_entry(iter, &chain->entities, chain) { -+ if (UVC_ENTITY_TYPE(iter) == UVC_VC_EXTENSION_UNIT && -+ iter->id == xqry->unit) { -+ entity = iter; - break; - } - } - -- if (!found) { -+ if (!entity) { - uvc_dbg(chain->dev, CONTROL, "Extension unit %u not found\n", - xqry->unit); - return -ENOENT; -@@ -2326,7 +2367,7 @@ int uvc_ctrl_restore_values(struct uvc_device *dev) - ctrl->dirty = 1; - } - -- ret = uvc_ctrl_commit_entity(dev, entity, 0, NULL); -+ ret = uvc_ctrl_commit_entity(dev, NULL, entity, 0, NULL); - if (ret < 0) - return ret; - } -@@ -2748,6 +2789,26 @@ int uvc_ctrl_init_device(struct uvc_device *dev) - return 0; - } - -+void uvc_ctrl_cleanup_fh(struct uvc_fh *handle) -+{ -+ struct uvc_entity *entity; -+ -+ guard(mutex)(&handle->chain->ctrl_mutex); -+ -+ if (!handle->pending_async_ctrls) -+ return; -+ -+ list_for_each_entry(entity, &handle->chain->dev->entities, list) { -+ for (unsigned int i = 0; i < entity->ncontrols; ++i) { -+ if (entity->controls[i].handle != handle) -+ continue; -+ uvc_ctrl_set_handle(handle, &entity->controls[i], NULL); -+ } -+ } -+ -+ WARN_ON(handle->pending_async_ctrls); -+} -+ - /* - * Cleanup device controls. - */ -diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c -index f4988f03640aec..7bcd706281daf3 100644 ---- a/drivers/media/usb/uvc/uvc_v4l2.c -+++ b/drivers/media/usb/uvc/uvc_v4l2.c -@@ -659,6 +659,8 @@ static int uvc_v4l2_release(struct file *file) - - uvc_dbg(stream->dev, CALLS, "%s\n", __func__); - -+ uvc_ctrl_cleanup_fh(handle); -+ - /* Only free resources if this is a privileged handle. */ - if (uvc_has_privileges(handle)) - uvc_queue_release(&stream->queue); -diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h -index 30fd056b2aec9d..e99bfaa622669b 100644 ---- a/drivers/media/usb/uvc/uvcvideo.h -+++ b/drivers/media/usb/uvc/uvcvideo.h -@@ -334,7 +334,11 @@ struct uvc_video_chain { - struct uvc_entity *processing; /* Processing unit */ - struct uvc_entity *selector; /* Selector unit */ - -- struct mutex ctrl_mutex; /* Protects ctrl.info */ -+ struct mutex ctrl_mutex; /* -+ * Protects ctrl.info, -+ * ctrl.handle and -+ * uvc_fh.pending_async_ctrls -+ */ - - struct v4l2_prio_state prio; /* V4L2 priority state */ - u32 caps; /* V4L2 chain-wide caps */ -@@ -609,6 +613,7 @@ struct uvc_fh { - struct uvc_video_chain *chain; - struct uvc_streaming *stream; - enum uvc_handle_state state; -+ unsigned int pending_async_ctrls; - }; - - struct uvc_driver { -@@ -794,6 +799,8 @@ int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id, - int uvc_xu_ctrl_query(struct uvc_video_chain *chain, - struct uvc_xu_control_query *xqry); - -+void uvc_ctrl_cleanup_fh(struct uvc_fh *handle); -+ - /* Utility functions */ - struct usb_host_endpoint *uvc_find_endpoint(struct usb_host_interface *alts, - u8 epaddr); -diff --git a/drivers/mtd/nand/raw/cadence-nand-controller.c b/drivers/mtd/nand/raw/cadence-nand-controller.c -index 034ec564c2edb0..4f37ca894d18a1 100644 ---- a/drivers/mtd/nand/raw/cadence-nand-controller.c -+++ b/drivers/mtd/nand/raw/cadence-nand-controller.c -@@ -469,6 +469,8 @@ struct cdns_nand_ctrl { - struct { - void __iomem *virt; - dma_addr_t dma; -+ dma_addr_t iova_dma; -+ u32 size; - } io; - - int irq; -@@ -1838,11 +1840,11 @@ static int cadence_nand_slave_dma_transfer(struct cdns_nand_ctrl *cdns_ctrl, - } - - if (dir == DMA_FROM_DEVICE) { -- src_dma = cdns_ctrl->io.dma; -+ src_dma = cdns_ctrl->io.iova_dma; - dst_dma = buf_dma; - } else { - src_dma = buf_dma; -- dst_dma = cdns_ctrl->io.dma; -+ dst_dma = cdns_ctrl->io.iova_dma; - } - - tx = dmaengine_prep_dma_memcpy(cdns_ctrl->dmac, dst_dma, src_dma, len, -@@ -1864,12 +1866,12 @@ static int cadence_nand_slave_dma_transfer(struct cdns_nand_ctrl *cdns_ctrl, - dma_async_issue_pending(cdns_ctrl->dmac); - wait_for_completion(&finished); - -- dma_unmap_single(cdns_ctrl->dev, buf_dma, len, dir); -+ dma_unmap_single(dma_dev->dev, buf_dma, len, dir); - - return 0; - - err_unmap: -- dma_unmap_single(cdns_ctrl->dev, buf_dma, len, dir); -+ dma_unmap_single(dma_dev->dev, buf_dma, len, dir); - - err: - dev_dbg(cdns_ctrl->dev, "Fall back to CPU I/O\n"); -@@ -2874,6 +2876,7 @@ cadence_nand_irq_cleanup(int irqnum, struct cdns_nand_ctrl *cdns_ctrl) - static int cadence_nand_init(struct cdns_nand_ctrl *cdns_ctrl) - { - dma_cap_mask_t mask; -+ struct dma_device *dma_dev = cdns_ctrl->dmac->device; - int ret; - - cdns_ctrl->cdma_desc = dma_alloc_coherent(cdns_ctrl->dev, -@@ -2909,15 +2912,24 @@ static int cadence_nand_init(struct cdns_nand_ctrl *cdns_ctrl) - dma_cap_set(DMA_MEMCPY, mask); - - if (cdns_ctrl->caps1->has_dma) { -- cdns_ctrl->dmac = dma_request_channel(mask, NULL, NULL); -- if (!cdns_ctrl->dmac) { -- dev_err(cdns_ctrl->dev, -- "Unable to get a DMA channel\n"); -- ret = -EBUSY; -+ cdns_ctrl->dmac = dma_request_chan_by_mask(&mask); -+ if (IS_ERR(cdns_ctrl->dmac)) { -+ ret = dev_err_probe(cdns_ctrl->dev, PTR_ERR(cdns_ctrl->dmac), -+ "%d: Failed to get a DMA channel\n", ret); - goto disable_irq; - } - } - -+ cdns_ctrl->io.iova_dma = dma_map_resource(dma_dev->dev, cdns_ctrl->io.dma, -+ cdns_ctrl->io.size, -+ DMA_BIDIRECTIONAL, 0); -+ -+ ret = dma_mapping_error(dma_dev->dev, cdns_ctrl->io.iova_dma); -+ if (ret) { -+ dev_err(cdns_ctrl->dev, "Failed to map I/O resource to DMA\n"); -+ goto dma_release_chnl; -+ } -+ - nand_controller_init(&cdns_ctrl->controller); - INIT_LIST_HEAD(&cdns_ctrl->chips); - -@@ -2928,18 +2940,22 @@ static int cadence_nand_init(struct cdns_nand_ctrl *cdns_ctrl) - if (ret) { - dev_err(cdns_ctrl->dev, "Failed to register MTD: %d\n", - ret); -- goto dma_release_chnl; -+ goto unmap_dma_resource; - } - - kfree(cdns_ctrl->buf); - cdns_ctrl->buf = kzalloc(cdns_ctrl->buf_size, GFP_KERNEL); - if (!cdns_ctrl->buf) { - ret = -ENOMEM; -- goto dma_release_chnl; -+ goto unmap_dma_resource; - } - - return 0; - -+unmap_dma_resource: -+ dma_unmap_resource(dma_dev->dev, cdns_ctrl->io.iova_dma, -+ cdns_ctrl->io.size, DMA_BIDIRECTIONAL, 0); -+ - dma_release_chnl: - if (cdns_ctrl->dmac) - dma_release_channel(cdns_ctrl->dmac); -@@ -2961,6 +2977,8 @@ static int cadence_nand_init(struct cdns_nand_ctrl *cdns_ctrl) - static void cadence_nand_remove(struct cdns_nand_ctrl *cdns_ctrl) - { - cadence_nand_chips_cleanup(cdns_ctrl); -+ dma_unmap_resource(cdns_ctrl->dmac->device->dev, cdns_ctrl->io.iova_dma, -+ cdns_ctrl->io.size, DMA_BIDIRECTIONAL, 0); - cadence_nand_irq_cleanup(cdns_ctrl->irq, cdns_ctrl); - kfree(cdns_ctrl->buf); - dma_free_coherent(cdns_ctrl->dev, sizeof(struct cadence_nand_cdma_desc), -@@ -3029,7 +3047,9 @@ static int cadence_nand_dt_probe(struct platform_device *ofdev) - cdns_ctrl->io.virt = devm_platform_get_and_ioremap_resource(ofdev, 1, &res); - if (IS_ERR(cdns_ctrl->io.virt)) - return PTR_ERR(cdns_ctrl->io.virt); -+ - cdns_ctrl->io.dma = res->start; -+ cdns_ctrl->io.size = resource_size(res); - - dt->clk = devm_clk_get(cdns_ctrl->dev, "nf_clk"); - if (IS_ERR(dt->clk)) -diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c -index 61685c3053ad7e..4f18addc191b85 100644 ---- a/drivers/net/ethernet/ibm/ibmvnic.c -+++ b/drivers/net/ethernet/ibm/ibmvnic.c -@@ -117,6 +117,7 @@ static void free_long_term_buff(struct ibmvnic_adapter *adapter, - struct ibmvnic_long_term_buff *ltb); - static void ibmvnic_disable_irqs(struct ibmvnic_adapter *adapter); - static void flush_reset_queue(struct ibmvnic_adapter *adapter); -+static void print_subcrq_error(struct device *dev, int rc, const char *func); - - struct ibmvnic_stat { - char name[ETH_GSTRING_LEN]; -@@ -2325,7 +2326,7 @@ static void ibmvnic_tx_scrq_clean_buffer(struct ibmvnic_adapter *adapter, - tx_buff = &tx_pool->tx_buff[index]; - adapter->netdev->stats.tx_packets--; - adapter->netdev->stats.tx_bytes -= tx_buff->skb->len; -- adapter->tx_stats_buffers[queue_num].packets--; -+ adapter->tx_stats_buffers[queue_num].batched_packets--; - adapter->tx_stats_buffers[queue_num].bytes -= - tx_buff->skb->len; - dev_kfree_skb_any(tx_buff->skb); -@@ -2350,8 +2351,29 @@ static void ibmvnic_tx_scrq_clean_buffer(struct ibmvnic_adapter *adapter, - } - } - -+static int send_subcrq_direct(struct ibmvnic_adapter *adapter, -+ u64 remote_handle, u64 *entry) -+{ -+ unsigned int ua = adapter->vdev->unit_address; -+ struct device *dev = &adapter->vdev->dev; -+ int rc; -+ -+ /* Make sure the hypervisor sees the complete request */ -+ dma_wmb(); -+ rc = plpar_hcall_norets(H_SEND_SUB_CRQ, ua, -+ cpu_to_be64(remote_handle), -+ cpu_to_be64(entry[0]), cpu_to_be64(entry[1]), -+ cpu_to_be64(entry[2]), cpu_to_be64(entry[3])); -+ -+ if (rc) -+ print_subcrq_error(dev, rc, __func__); -+ -+ return rc; -+} -+ - static int ibmvnic_tx_scrq_flush(struct ibmvnic_adapter *adapter, -- struct ibmvnic_sub_crq_queue *tx_scrq) -+ struct ibmvnic_sub_crq_queue *tx_scrq, -+ bool indirect) - { - struct ibmvnic_ind_xmit_queue *ind_bufp; - u64 dma_addr; -@@ -2366,12 +2388,18 @@ static int ibmvnic_tx_scrq_flush(struct ibmvnic_adapter *adapter, - - if (!entries) - return 0; -- rc = send_subcrq_indirect(adapter, handle, dma_addr, entries); -+ -+ if (indirect) -+ rc = send_subcrq_indirect(adapter, handle, dma_addr, entries); -+ else -+ rc = send_subcrq_direct(adapter, handle, -+ (u64 *)ind_bufp->indir_arr); -+ - if (rc) - ibmvnic_tx_scrq_clean_buffer(adapter, tx_scrq); - else - ind_bufp->index = 0; -- return 0; -+ return rc; - } - - static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) -@@ -2390,11 +2418,13 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) - unsigned int tx_map_failed = 0; - union sub_crq indir_arr[16]; - unsigned int tx_dropped = 0; -- unsigned int tx_packets = 0; -+ unsigned int tx_dpackets = 0; -+ unsigned int tx_bpackets = 0; - unsigned int tx_bytes = 0; - dma_addr_t data_dma_addr; - struct netdev_queue *txq; - unsigned long lpar_rc; -+ unsigned int skblen; - union sub_crq tx_crq; - unsigned int offset; - int num_entries = 1; -@@ -2424,7 +2454,9 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) - tx_dropped++; - tx_send_failed++; - ret = NETDEV_TX_OK; -- ibmvnic_tx_scrq_flush(adapter, tx_scrq); -+ lpar_rc = ibmvnic_tx_scrq_flush(adapter, tx_scrq, true); -+ if (lpar_rc != H_SUCCESS) -+ goto tx_err; - goto out; - } - -@@ -2439,8 +2471,10 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) - dev_kfree_skb_any(skb); - tx_send_failed++; - tx_dropped++; -- ibmvnic_tx_scrq_flush(adapter, tx_scrq); - ret = NETDEV_TX_OK; -+ lpar_rc = ibmvnic_tx_scrq_flush(adapter, tx_scrq, true); -+ if (lpar_rc != H_SUCCESS) -+ goto tx_err; - goto out; - } - -@@ -2493,6 +2527,7 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) - tx_buff->skb = skb; - tx_buff->index = bufidx; - tx_buff->pool_index = queue_num; -+ skblen = skb->len; - - memset(&tx_crq, 0, sizeof(tx_crq)); - tx_crq.v1.first = IBMVNIC_CRQ_CMD; -@@ -2536,6 +2571,17 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) - tx_crq.v1.flags1 |= IBMVNIC_TX_LSO; - tx_crq.v1.mss = cpu_to_be16(skb_shinfo(skb)->gso_size); - hdrs += 2; -+ } else if (!ind_bufp->index && !netdev_xmit_more()) { -+ ind_bufp->indir_arr[0] = tx_crq; -+ ind_bufp->index = 1; -+ tx_buff->num_entries = 1; -+ netdev_tx_sent_queue(txq, skb->len); -+ lpar_rc = ibmvnic_tx_scrq_flush(adapter, tx_scrq, false); -+ if (lpar_rc != H_SUCCESS) -+ goto tx_err; -+ -+ tx_dpackets++; -+ goto early_exit; - } - - if ((*hdrs >> 7) & 1) -@@ -2545,7 +2591,7 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) - tx_buff->num_entries = num_entries; - /* flush buffer if current entry can not fit */ - if (num_entries + ind_bufp->index > IBMVNIC_MAX_IND_DESCS) { -- lpar_rc = ibmvnic_tx_scrq_flush(adapter, tx_scrq); -+ lpar_rc = ibmvnic_tx_scrq_flush(adapter, tx_scrq, true); - if (lpar_rc != H_SUCCESS) - goto tx_flush_err; - } -@@ -2553,23 +2599,26 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) - indir_arr[0] = tx_crq; - memcpy(&ind_bufp->indir_arr[ind_bufp->index], &indir_arr[0], - num_entries * sizeof(struct ibmvnic_generic_scrq)); -+ - ind_bufp->index += num_entries; - if (__netdev_tx_sent_queue(txq, skb->len, - netdev_xmit_more() && - ind_bufp->index < IBMVNIC_MAX_IND_DESCS)) { -- lpar_rc = ibmvnic_tx_scrq_flush(adapter, tx_scrq); -+ lpar_rc = ibmvnic_tx_scrq_flush(adapter, tx_scrq, true); - if (lpar_rc != H_SUCCESS) - goto tx_err; - } - -+ tx_bpackets++; -+ -+early_exit: - if (atomic_add_return(num_entries, &tx_scrq->used) - >= adapter->req_tx_entries_per_subcrq) { - netdev_dbg(netdev, "Stopping queue %d\n", queue_num); - netif_stop_subqueue(netdev, queue_num); - } - -- tx_packets++; -- tx_bytes += skb->len; -+ tx_bytes += skblen; - txq_trans_cond_update(txq); - ret = NETDEV_TX_OK; - goto out; -@@ -2598,10 +2647,11 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) - rcu_read_unlock(); - netdev->stats.tx_dropped += tx_dropped; - netdev->stats.tx_bytes += tx_bytes; -- netdev->stats.tx_packets += tx_packets; -+ netdev->stats.tx_packets += tx_bpackets + tx_dpackets; - adapter->tx_send_failed += tx_send_failed; - adapter->tx_map_failed += tx_map_failed; -- adapter->tx_stats_buffers[queue_num].packets += tx_packets; -+ adapter->tx_stats_buffers[queue_num].batched_packets += tx_bpackets; -+ adapter->tx_stats_buffers[queue_num].direct_packets += tx_dpackets; - adapter->tx_stats_buffers[queue_num].bytes += tx_bytes; - adapter->tx_stats_buffers[queue_num].dropped_packets += tx_dropped; - -@@ -3767,7 +3817,10 @@ static void ibmvnic_get_strings(struct net_device *dev, u32 stringset, u8 *data) - memcpy(data, ibmvnic_stats[i].name, ETH_GSTRING_LEN); - - for (i = 0; i < adapter->req_tx_queues; i++) { -- snprintf(data, ETH_GSTRING_LEN, "tx%d_packets", i); -+ snprintf(data, ETH_GSTRING_LEN, "tx%d_batched_packets", i); -+ data += ETH_GSTRING_LEN; -+ -+ snprintf(data, ETH_GSTRING_LEN, "tx%d_direct_packets", i); - data += ETH_GSTRING_LEN; - - snprintf(data, ETH_GSTRING_LEN, "tx%d_bytes", i); -@@ -3832,7 +3885,9 @@ static void ibmvnic_get_ethtool_stats(struct net_device *dev, - (adapter, ibmvnic_stats[i].offset)); - - for (j = 0; j < adapter->req_tx_queues; j++) { -- data[i] = adapter->tx_stats_buffers[j].packets; -+ data[i] = adapter->tx_stats_buffers[j].batched_packets; -+ i++; -+ data[i] = adapter->tx_stats_buffers[j].direct_packets; - i++; - data[i] = adapter->tx_stats_buffers[j].bytes; - i++; -diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h -index 4e18b4cefa972c..b3fc18db4f4c39 100644 ---- a/drivers/net/ethernet/ibm/ibmvnic.h -+++ b/drivers/net/ethernet/ibm/ibmvnic.h -@@ -213,7 +213,8 @@ struct ibmvnic_statistics { - - #define NUM_TX_STATS 3 - struct ibmvnic_tx_queue_stats { -- u64 packets; -+ u64 batched_packets; -+ u64 direct_packets; - u64 bytes; - u64 dropped_packets; - }; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 6e431f587c233a..b34f57ab9755ce 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -6110,7 +6110,9 @@ static void mlx5e_remove(struct auxiliary_device *adev) - mlx5e_dcbnl_delete_app(priv); - unregister_netdev(priv->netdev); - mlx5e_suspend(adev, state); -- priv->profile->cleanup(priv); -+ /* Avoid cleanup if profile rollback failed. */ -+ if (priv->profile) -+ priv->profile->cleanup(priv); - mlx5e_destroy_netdev(priv); - mlx5e_devlink_port_unregister(mlx5e_dev); - mlx5e_destroy_devlink(mlx5e_dev); -diff --git a/drivers/net/ethernet/netronome/nfp/bpf/cmsg.c b/drivers/net/ethernet/netronome/nfp/bpf/cmsg.c -index 2ec62c8d86e1c1..59486fe2ad18c2 100644 ---- a/drivers/net/ethernet/netronome/nfp/bpf/cmsg.c -+++ b/drivers/net/ethernet/netronome/nfp/bpf/cmsg.c -@@ -20,6 +20,8 @@ nfp_bpf_cmsg_alloc(struct nfp_app_bpf *bpf, unsigned int size) - struct sk_buff *skb; - - skb = nfp_app_ctrl_msg_alloc(bpf->app, size, GFP_KERNEL); -+ if (!skb) -+ return NULL; - skb_put(skb, size); - - return skb; -diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c -index 02e11827440b5c..3517a2275821ff 100644 ---- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c -+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c -@@ -2161,6 +2161,7 @@ static int axienet_probe(struct platform_device *pdev) - - lp->phylink_config.dev = &ndev->dev; - lp->phylink_config.type = PHYLINK_NETDEV; -+ lp->phylink_config.mac_managed_pm = true; - lp->phylink_config.mac_capabilities = MAC_SYM_PAUSE | MAC_ASYM_PAUSE | - MAC_10FD | MAC_100FD | MAC_1000FD; - -diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c -index b939d4711c59b6..27761334e1bff7 100644 ---- a/drivers/net/geneve.c -+++ b/drivers/net/geneve.c -@@ -1961,21 +1961,9 @@ static void geneve_destroy_tunnels(struct net *net, struct list_head *head) - { - struct geneve_net *gn = net_generic(net, geneve_net_id); - struct geneve_dev *geneve, *next; -- struct net_device *dev, *aux; - -- /* gather any geneve devices that were moved into this ns */ -- for_each_netdev_safe(net, dev, aux) -- if (dev->rtnl_link_ops == &geneve_link_ops) -- unregister_netdevice_queue(dev, head); -- -- /* now gather any other geneve devices that were created in this ns */ -- list_for_each_entry_safe(geneve, next, &gn->geneve_list, next) { -- /* If geneve->dev is in the same netns, it was already added -- * to the list by the previous loop. -- */ -- if (!net_eq(dev_net(geneve->dev), net)) -- unregister_netdevice_queue(geneve->dev, head); -- } -+ list_for_each_entry_safe(geneve, next, &gn->geneve_list, next) -+ geneve_dellink(geneve->dev, head); - } - - static void __net_exit geneve_exit_batch_net(struct list_head *net_list) -diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c -index 47238c3ec82e75..55160a5fc90fc6 100644 ---- a/drivers/net/gtp.c -+++ b/drivers/net/gtp.c -@@ -1895,11 +1895,6 @@ static void __net_exit gtp_net_exit_batch_rtnl(struct list_head *net_list, - list_for_each_entry(net, net_list, exit_list) { - struct gtp_net *gn = net_generic(net, gtp_net_id); - struct gtp_dev *gtp, *gtp_next; -- struct net_device *dev; -- -- for_each_netdev(net, dev) -- if (dev->rtnl_link_ops == >p_link_ops) -- gtp_dellink(dev, dev_to_kill); - - list_for_each_entry_safe(gtp, gtp_next, &gn->gtp_dev_list, list) - gtp_dellink(gtp->dev, dev_to_kill); -diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c -index 19a7f0160618d1..4ce31f9f069475 100644 ---- a/drivers/nvme/host/ioctl.c -+++ b/drivers/nvme/host/ioctl.c -@@ -336,8 +336,7 @@ static bool nvme_validate_passthru_nsid(struct nvme_ctrl *ctrl, - { - if (ns && nsid != ns->head->ns_id) { - dev_err(ctrl->device, -- "%s: nsid (%u) in cmd does not match nsid (%u)" -- "of namespace\n", -+ "%s: nsid (%u) in cmd does not match nsid (%u) of namespace\n", - current->comm, nsid, ns->head->ns_id); - return false; - } -diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c -index fd11d3825cf854..3ea94bc26e8003 100644 ---- a/drivers/nvmem/core.c -+++ b/drivers/nvmem/core.c -@@ -19,29 +19,7 @@ - #include - #include - --struct nvmem_device { -- struct module *owner; -- struct device dev; -- int stride; -- int word_size; -- int id; -- struct kref refcnt; -- size_t size; -- bool read_only; -- bool root_only; -- int flags; -- enum nvmem_type type; -- struct bin_attribute eeprom; -- struct device *base_dev; -- struct list_head cells; -- const struct nvmem_keepout *keepout; -- unsigned int nkeepout; -- nvmem_reg_read_t reg_read; -- nvmem_reg_write_t reg_write; -- struct gpio_desc *wp_gpio; -- struct nvmem_layout *layout; -- void *priv; --}; -+#include "internals.h" - - #define to_nvmem_device(d) container_of(d, struct nvmem_device, dev) - -@@ -696,7 +674,6 @@ static int nvmem_validate_keepouts(struct nvmem_device *nvmem) - - static int nvmem_add_cells_from_dt(struct nvmem_device *nvmem, struct device_node *np) - { -- struct nvmem_layout *layout = nvmem->layout; - struct device *dev = &nvmem->dev; - struct device_node *child; - const __be32 *addr; -@@ -726,8 +703,8 @@ static int nvmem_add_cells_from_dt(struct nvmem_device *nvmem, struct device_nod - - info.np = of_node_get(child); - -- if (layout && layout->fixup_cell_info) -- layout->fixup_cell_info(nvmem, layout, &info); -+ if (nvmem->fixup_dt_cell_info) -+ nvmem->fixup_dt_cell_info(nvmem, &info); - - ret = nvmem_add_one_cell(nvmem, &info); - kfree(info.name); -@@ -837,7 +814,7 @@ static int nvmem_add_cells_from_layout(struct nvmem_device *nvmem) - int ret; - - if (layout && layout->add_cells) { -- ret = layout->add_cells(&nvmem->dev, nvmem, layout); -+ ret = layout->add_cells(&nvmem->dev, nvmem); - if (ret) - return ret; - } -@@ -924,6 +901,7 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) - - kref_init(&nvmem->refcnt); - INIT_LIST_HEAD(&nvmem->cells); -+ nvmem->fixup_dt_cell_info = config->fixup_dt_cell_info; - - nvmem->owner = config->owner; - if (!nvmem->owner && config->dev->driver) -diff --git a/drivers/nvmem/imx-ocotp-ele.c b/drivers/nvmem/imx-ocotp-ele.c -index dfc925edfc83e0..1356ec93bfd00c 100644 ---- a/drivers/nvmem/imx-ocotp-ele.c -+++ b/drivers/nvmem/imx-ocotp-ele.c -@@ -107,6 +107,26 @@ static int imx_ocotp_reg_read(void *context, unsigned int offset, void *val, siz - return 0; - }; - -+static int imx_ocotp_cell_pp(void *context, const char *id, int index, -+ unsigned int offset, void *data, size_t bytes) -+{ -+ u8 *buf = data; -+ int i; -+ -+ /* Deal with some post processing of nvmem cell data */ -+ if (id && !strcmp(id, "mac-address")) -+ for (i = 0; i < bytes / 2; i++) -+ swap(buf[i], buf[bytes - i - 1]); -+ -+ return 0; -+} -+ -+static void imx_ocotp_fixup_dt_cell_info(struct nvmem_device *nvmem, -+ struct nvmem_cell_info *cell) -+{ -+ cell->read_post_process = imx_ocotp_cell_pp; -+} -+ - static int imx_ele_ocotp_probe(struct platform_device *pdev) - { - struct device *dev = &pdev->dev; -@@ -133,6 +153,8 @@ static int imx_ele_ocotp_probe(struct platform_device *pdev) - priv->config.stride = 1; - priv->config.priv = priv; - priv->config.read_only = true; -+ priv->config.add_legacy_fixed_of_cells = true; -+ priv->config.fixup_dt_cell_info = imx_ocotp_fixup_dt_cell_info; - mutex_init(&priv->lock); - - nvmem = devm_nvmem_register(dev, &priv->config); -diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c -index f1e202efaa4970..79dd4fda03295a 100644 ---- a/drivers/nvmem/imx-ocotp.c -+++ b/drivers/nvmem/imx-ocotp.c -@@ -583,17 +583,12 @@ static const struct of_device_id imx_ocotp_dt_ids[] = { - }; - MODULE_DEVICE_TABLE(of, imx_ocotp_dt_ids); - --static void imx_ocotp_fixup_cell_info(struct nvmem_device *nvmem, -- struct nvmem_layout *layout, -- struct nvmem_cell_info *cell) -+static void imx_ocotp_fixup_dt_cell_info(struct nvmem_device *nvmem, -+ struct nvmem_cell_info *cell) - { - cell->read_post_process = imx_ocotp_cell_pp; - } - --static struct nvmem_layout imx_ocotp_layout = { -- .fixup_cell_info = imx_ocotp_fixup_cell_info, --}; -- - static int imx_ocotp_probe(struct platform_device *pdev) - { - struct device *dev = &pdev->dev; -@@ -619,7 +614,7 @@ static int imx_ocotp_probe(struct platform_device *pdev) - imx_ocotp_nvmem_config.size = 4 * priv->params->nregs; - imx_ocotp_nvmem_config.dev = dev; - imx_ocotp_nvmem_config.priv = priv; -- imx_ocotp_nvmem_config.layout = &imx_ocotp_layout; -+ imx_ocotp_nvmem_config.fixup_dt_cell_info = &imx_ocotp_fixup_dt_cell_info; - - priv->config = &imx_ocotp_nvmem_config; - -diff --git a/drivers/nvmem/internals.h b/drivers/nvmem/internals.h -new file mode 100644 -index 00000000000000..893553fbdf51aa ---- /dev/null -+++ b/drivers/nvmem/internals.h -@@ -0,0 +1,37 @@ -+/* SPDX-License-Identifier: GPL-2.0 */ -+ -+#ifndef _LINUX_NVMEM_INTERNALS_H -+#define _LINUX_NVMEM_INTERNALS_H -+ -+#include -+#include -+#include -+ -+struct nvmem_device { -+ struct module *owner; -+ struct device dev; -+ struct list_head node; -+ int stride; -+ int word_size; -+ int id; -+ struct kref refcnt; -+ size_t size; -+ bool read_only; -+ bool root_only; -+ int flags; -+ enum nvmem_type type; -+ struct bin_attribute eeprom; -+ struct device *base_dev; -+ struct list_head cells; -+ void (*fixup_dt_cell_info)(struct nvmem_device *nvmem, -+ struct nvmem_cell_info *cell); -+ const struct nvmem_keepout *keepout; -+ unsigned int nkeepout; -+ nvmem_reg_read_t reg_read; -+ nvmem_reg_write_t reg_write; -+ struct gpio_desc *wp_gpio; -+ struct nvmem_layout *layout; -+ void *priv; -+}; -+ -+#endif /* ifndef _LINUX_NVMEM_INTERNALS_H */ -diff --git a/drivers/nvmem/layouts/onie-tlv.c b/drivers/nvmem/layouts/onie-tlv.c -index 59fc87ccfcffeb..defd42d4375cc1 100644 ---- a/drivers/nvmem/layouts/onie-tlv.c -+++ b/drivers/nvmem/layouts/onie-tlv.c -@@ -182,8 +182,7 @@ static bool onie_tlv_crc_is_valid(struct device *dev, size_t table_len, u8 *tabl - return true; - } - --static int onie_tlv_parse_table(struct device *dev, struct nvmem_device *nvmem, -- struct nvmem_layout *layout) -+static int onie_tlv_parse_table(struct device *dev, struct nvmem_device *nvmem) - { - struct onie_tlv_hdr hdr; - size_t table_len, data_len, hdr_len; -diff --git a/drivers/nvmem/layouts/sl28vpd.c b/drivers/nvmem/layouts/sl28vpd.c -index 05671371f63166..26c7cf21b52336 100644 ---- a/drivers/nvmem/layouts/sl28vpd.c -+++ b/drivers/nvmem/layouts/sl28vpd.c -@@ -80,8 +80,7 @@ static int sl28vpd_v1_check_crc(struct device *dev, struct nvmem_device *nvmem) - return 0; - } - --static int sl28vpd_add_cells(struct device *dev, struct nvmem_device *nvmem, -- struct nvmem_layout *layout) -+static int sl28vpd_add_cells(struct device *dev, struct nvmem_device *nvmem) - { - const struct nvmem_cell_info *pinfo; - struct nvmem_cell_info info = {0}; -diff --git a/drivers/nvmem/mtk-efuse.c b/drivers/nvmem/mtk-efuse.c -index 87c94686cfd216..84f05b40a4112e 100644 ---- a/drivers/nvmem/mtk-efuse.c -+++ b/drivers/nvmem/mtk-efuse.c -@@ -45,9 +45,8 @@ static int mtk_efuse_gpu_speedbin_pp(void *context, const char *id, int index, - return 0; - } - --static void mtk_efuse_fixup_cell_info(struct nvmem_device *nvmem, -- struct nvmem_layout *layout, -- struct nvmem_cell_info *cell) -+static void mtk_efuse_fixup_dt_cell_info(struct nvmem_device *nvmem, -+ struct nvmem_cell_info *cell) - { - size_t sz = strlen(cell->name); - -@@ -61,10 +60,6 @@ static void mtk_efuse_fixup_cell_info(struct nvmem_device *nvmem, - cell->read_post_process = mtk_efuse_gpu_speedbin_pp; - } - --static struct nvmem_layout mtk_efuse_layout = { -- .fixup_cell_info = mtk_efuse_fixup_cell_info, --}; -- - static int mtk_efuse_probe(struct platform_device *pdev) - { - struct device *dev = &pdev->dev; -@@ -91,7 +86,7 @@ static int mtk_efuse_probe(struct platform_device *pdev) - econfig.priv = priv; - econfig.dev = dev; - if (pdata->uses_post_processing) -- econfig.layout = &mtk_efuse_layout; -+ econfig.fixup_dt_cell_info = &mtk_efuse_fixup_dt_cell_info; - nvmem = devm_nvmem_register(dev, &econfig); - - return PTR_ERR_OR_ZERO(nvmem); -diff --git a/drivers/power/supply/da9150-fg.c b/drivers/power/supply/da9150-fg.c -index 652c1f213af1c2..4f28ef1bba1a3c 100644 ---- a/drivers/power/supply/da9150-fg.c -+++ b/drivers/power/supply/da9150-fg.c -@@ -247,9 +247,9 @@ static int da9150_fg_current_avg(struct da9150_fg *fg, - DA9150_QIF_SD_GAIN_SIZE); - da9150_fg_read_sync_end(fg); - -- div = (u64) (sd_gain * shunt_val * 65536ULL); -+ div = 65536ULL * sd_gain * shunt_val; - do_div(div, 1000000); -- res = (u64) (iavg * 1000000ULL); -+ res = 1000000ULL * iavg; - do_div(res, div); - - val->intval = (int) res; -diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c -index f6a0626a6b3ec6..af0d90beba6380 100644 ---- a/drivers/s390/net/ism_drv.c -+++ b/drivers/s390/net/ism_drv.c -@@ -611,6 +611,15 @@ static int ism_dev_init(struct ism_dev *ism) - return ret; - } - -+static void ism_dev_release(struct device *dev) -+{ -+ struct ism_dev *ism; -+ -+ ism = container_of(dev, struct ism_dev, dev); -+ -+ kfree(ism); -+} -+ - static int ism_probe(struct pci_dev *pdev, const struct pci_device_id *id) - { - struct ism_dev *ism; -@@ -624,6 +633,7 @@ static int ism_probe(struct pci_dev *pdev, const struct pci_device_id *id) - dev_set_drvdata(&pdev->dev, ism); - ism->pdev = pdev; - ism->dev.parent = &pdev->dev; -+ ism->dev.release = ism_dev_release; - device_initialize(&ism->dev); - dev_set_name(&ism->dev, dev_name(&pdev->dev)); - ret = device_add(&ism->dev); -@@ -660,7 +670,7 @@ static int ism_probe(struct pci_dev *pdev, const struct pci_device_id *id) - device_del(&ism->dev); - err_dev: - dev_set_drvdata(&pdev->dev, NULL); -- kfree(ism); -+ put_device(&ism->dev); - - return ret; - } -@@ -706,7 +716,7 @@ static void ism_remove(struct pci_dev *pdev) - pci_disable_device(pdev); - device_del(&ism->dev); - dev_set_drvdata(&pdev->dev, NULL); -- kfree(ism); -+ put_device(&ism->dev); - } - - static struct pci_driver ism_driver = { -diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c -index 97def2619ecf2a..f026377f1cf1c4 100644 ---- a/drivers/scsi/scsi_lib.c -+++ b/drivers/scsi/scsi_lib.c -@@ -774,12 +774,18 @@ static void scsi_io_completion_action(struct scsi_cmnd *cmd, int result) - case 0x1a: /* start stop unit in progress */ - case 0x1b: /* sanitize in progress */ - case 0x1d: /* configuration in progress */ -- case 0x24: /* depopulation in progress */ - action = ACTION_DELAYED_RETRY; - break; - case 0x0a: /* ALUA state transition */ - action = ACTION_DELAYED_REPREP; - break; -+ /* -+ * Depopulation might take many hours, -+ * thus it is not worthwhile to retry. -+ */ -+ case 0x24: /* depopulation in progress */ -+ case 0x25: /* depopulation restore in progress */ -+ fallthrough; - default: - action = ACTION_FAIL; - break; -diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c -index 2c627deedc1fa2..fe694fec16b516 100644 ---- a/drivers/scsi/sd.c -+++ b/drivers/scsi/sd.c -@@ -2309,6 +2309,10 @@ sd_spinup_disk(struct scsi_disk *sdkp) - break; /* unavailable */ - if (sshdr.asc == 4 && sshdr.ascq == 0x1b) - break; /* sanitize in progress */ -+ if (sshdr.asc == 4 && sshdr.ascq == 0x24) -+ break; /* depopulation in progress */ -+ if (sshdr.asc == 4 && sshdr.ascq == 0x25) -+ break; /* depopulation restoration in progress */ - /* - * Issue command to spin up drive when not ready - */ -diff --git a/drivers/soc/loongson/loongson2_guts.c b/drivers/soc/loongson/loongson2_guts.c -index 9a469779eea75b..2d7045ee4ac87d 100644 ---- a/drivers/soc/loongson/loongson2_guts.c -+++ b/drivers/soc/loongson/loongson2_guts.c -@@ -114,8 +114,11 @@ static int loongson2_guts_probe(struct platform_device *pdev) - if (of_property_read_string(root, "model", &machine)) - of_property_read_string_index(root, "compatible", 0, &machine); - of_node_put(root); -- if (machine) -+ if (machine) { - soc_dev_attr.machine = devm_kstrdup(dev, machine, GFP_KERNEL); -+ if (!soc_dev_attr.machine) -+ return -ENOMEM; -+ } - - svr = loongson2_guts_get_svr(); - soc_die = loongson2_soc_die_match(svr, loongson2_soc_die); -diff --git a/drivers/soc/mediatek/mtk-devapc.c b/drivers/soc/mediatek/mtk-devapc.c -index 0dfc1da9471cba..d83a46334adbbe 100644 ---- a/drivers/soc/mediatek/mtk-devapc.c -+++ b/drivers/soc/mediatek/mtk-devapc.c -@@ -300,18 +300,17 @@ static int mtk_devapc_probe(struct platform_device *pdev) - return ret; - } - --static int mtk_devapc_remove(struct platform_device *pdev) -+static void mtk_devapc_remove(struct platform_device *pdev) - { - struct mtk_devapc_context *ctx = platform_get_drvdata(pdev); - - stop_devapc(ctx); -- -- return 0; -+ iounmap(ctx->infra_base); - } - - static struct platform_driver mtk_devapc_driver = { - .probe = mtk_devapc_probe, -- .remove = mtk_devapc_remove, -+ .remove_new = mtk_devapc_remove, - .driver = { - .name = "mtk-devapc", - .of_match_table = mtk_devapc_dt_match, -diff --git a/drivers/tee/optee/supp.c b/drivers/tee/optee/supp.c -index 322a543b8c278a..d0f397c9024201 100644 ---- a/drivers/tee/optee/supp.c -+++ b/drivers/tee/optee/supp.c -@@ -80,7 +80,6 @@ u32 optee_supp_thrd_req(struct tee_context *ctx, u32 func, size_t num_params, - struct optee *optee = tee_get_drvdata(ctx->teedev); - struct optee_supp *supp = &optee->supp; - struct optee_supp_req *req; -- bool interruptable; - u32 ret; - - /* -@@ -111,36 +110,18 @@ u32 optee_supp_thrd_req(struct tee_context *ctx, u32 func, size_t num_params, - /* - * Wait for supplicant to process and return result, once we've - * returned from wait_for_completion(&req->c) successfully we have -- * exclusive access again. -+ * exclusive access again. Allow the wait to be killable such that -+ * the wait doesn't turn into an indefinite state if the supplicant -+ * gets hung for some reason. - */ -- while (wait_for_completion_interruptible(&req->c)) { -+ if (wait_for_completion_killable(&req->c)) { - mutex_lock(&supp->mutex); -- interruptable = !supp->ctx; -- if (interruptable) { -- /* -- * There's no supplicant available and since the -- * supp->mutex currently is held none can -- * become available until the mutex released -- * again. -- * -- * Interrupting an RPC to supplicant is only -- * allowed as a way of slightly improving the user -- * experience in case the supplicant hasn't been -- * started yet. During normal operation the supplicant -- * will serve all requests in a timely manner and -- * interrupting then wouldn't make sense. -- */ -- if (req->in_queue) { -- list_del(&req->link); -- req->in_queue = false; -- } -+ if (req->in_queue) { -+ list_del(&req->link); -+ req->in_queue = false; - } - mutex_unlock(&supp->mutex); -- -- if (interruptable) { -- req->ret = TEEC_ERROR_COMMUNICATION; -- break; -- } -+ req->ret = TEEC_ERROR_COMMUNICATION; - } - - ret = req->ret; -diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c -index 49946af11a9058..6d91d7d7a23f85 100644 ---- a/drivers/usb/gadget/function/f_midi.c -+++ b/drivers/usb/gadget/function/f_midi.c -@@ -282,7 +282,7 @@ f_midi_complete(struct usb_ep *ep, struct usb_request *req) - /* Our transmit completed. See if there's more to go. - * f_midi_transmit eats req, don't queue it again. */ - req->length = 0; -- f_midi_transmit(midi); -+ queue_work(system_highpri_wq, &midi->work); - return; - } - break; -diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c -index 33979f61dc4dd7..a4120a25428e5d 100644 ---- a/drivers/usb/gadget/udc/core.c -+++ b/drivers/usb/gadget/udc/core.c -@@ -1419,8 +1419,16 @@ int usb_add_gadget(struct usb_gadget *gadget) - if (ret) - goto err_free_id; - -+ ret = sysfs_create_link(&udc->dev.kobj, -+ &gadget->dev.kobj, "gadget"); -+ if (ret) -+ goto err_del_gadget; -+ - return 0; - -+ err_del_gadget: -+ device_del(&gadget->dev); -+ - err_free_id: - ida_free(&gadget_id_numbers, gadget->id_number); - -@@ -1529,8 +1537,9 @@ void usb_del_gadget(struct usb_gadget *gadget) - mutex_unlock(&udc_lock); - - kobject_uevent(&udc->dev.kobj, KOBJ_REMOVE); -- flush_work(&gadget->work); -+ sysfs_remove_link(&udc->dev.kobj, "gadget"); - device_del(&gadget->dev); -+ flush_work(&gadget->work); - ida_free(&gadget_id_numbers, gadget->id_number); - cancel_work_sync(&udc->vbus_work); - device_unregister(&udc->dev); -diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c -index 652279c8b1680a..49ca762baa8f15 100644 ---- a/fs/nilfs2/dir.c -+++ b/fs/nilfs2/dir.c -@@ -64,12 +64,6 @@ static inline unsigned int nilfs_chunk_size(struct inode *inode) - return inode->i_sb->s_blocksize; - } - --static inline void nilfs_put_page(struct page *page) --{ -- kunmap(page); -- put_page(page); --} -- - /* - * Return the offset into page `page_nr' of the last valid - * byte in that page, plus one. -@@ -450,8 +444,7 @@ int nilfs_inode_by_name(struct inode *dir, const struct qstr *qstr, ino_t *ino) - return 0; - } - --/* Releases the page */ --void nilfs_set_link(struct inode *dir, struct nilfs_dir_entry *de, -+int nilfs_set_link(struct inode *dir, struct nilfs_dir_entry *de, - struct page *page, struct inode *inode) - { - unsigned int from = (char *)de - (char *)page_address(page); -@@ -461,12 +454,15 @@ void nilfs_set_link(struct inode *dir, struct nilfs_dir_entry *de, - - lock_page(page); - err = nilfs_prepare_chunk(page, from, to); -- BUG_ON(err); -+ if (unlikely(err)) { -+ unlock_page(page); -+ return err; -+ } - de->inode = cpu_to_le64(inode->i_ino); - nilfs_set_de_type(de, inode); - nilfs_commit_chunk(page, mapping, from, to); -- nilfs_put_page(page); - dir->i_mtime = inode_set_ctime_current(dir); -+ return 0; - } - - /* -@@ -569,7 +565,7 @@ int nilfs_add_link(struct dentry *dentry, struct inode *inode) - - /* - * nilfs_delete_entry deletes a directory entry by merging it with the -- * previous entry. Page is up-to-date. Releases the page. -+ * previous entry. Page is up-to-date. - */ - int nilfs_delete_entry(struct nilfs_dir_entry *dir, struct page *page) - { -@@ -598,14 +594,16 @@ int nilfs_delete_entry(struct nilfs_dir_entry *dir, struct page *page) - from = (char *)pde - (char *)page_address(page); - lock_page(page); - err = nilfs_prepare_chunk(page, from, to); -- BUG_ON(err); -+ if (unlikely(err)) { -+ unlock_page(page); -+ goto out; -+ } - if (pde) - pde->rec_len = nilfs_rec_len_to_disk(to - from); - dir->inode = 0; - nilfs_commit_chunk(page, mapping, from, to); - inode->i_mtime = inode_set_ctime_current(inode); - out: -- nilfs_put_page(page); - return err; - } - -diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c -index ac0adeb58e4104..43f01fe556fe17 100644 ---- a/fs/nilfs2/namei.c -+++ b/fs/nilfs2/namei.c -@@ -297,6 +297,7 @@ static int nilfs_do_unlink(struct inode *dir, struct dentry *dentry) - set_nlink(inode, 1); - } - err = nilfs_delete_entry(de, page); -+ nilfs_put_page(page); - if (err) - goto out; - -@@ -405,7 +406,10 @@ static int nilfs_rename(struct mnt_idmap *idmap, - err = PTR_ERR(new_de); - goto out_dir; - } -- nilfs_set_link(new_dir, new_de, new_page, old_inode); -+ err = nilfs_set_link(new_dir, new_de, new_page, old_inode); -+ nilfs_put_page(new_page); -+ if (unlikely(err)) -+ goto out_dir; - nilfs_mark_inode_dirty(new_dir); - inode_set_ctime_current(new_inode); - if (dir_de) -@@ -428,28 +432,27 @@ static int nilfs_rename(struct mnt_idmap *idmap, - */ - inode_set_ctime_current(old_inode); - -- nilfs_delete_entry(old_de, old_page); -- -- if (dir_de) { -- nilfs_set_link(old_inode, dir_de, dir_page, new_dir); -- drop_nlink(old_dir); -+ err = nilfs_delete_entry(old_de, old_page); -+ if (likely(!err)) { -+ if (dir_de) { -+ err = nilfs_set_link(old_inode, dir_de, dir_page, -+ new_dir); -+ drop_nlink(old_dir); -+ } -+ nilfs_mark_inode_dirty(old_dir); - } -- nilfs_mark_inode_dirty(old_dir); - nilfs_mark_inode_dirty(old_inode); - -- err = nilfs_transaction_commit(old_dir->i_sb); -- return err; -- - out_dir: -- if (dir_de) { -- kunmap(dir_page); -- put_page(dir_page); -- } -+ if (dir_de) -+ nilfs_put_page(dir_page); - out_old: -- kunmap(old_page); -- put_page(old_page); -+ nilfs_put_page(old_page); - out: -- nilfs_transaction_abort(old_dir->i_sb); -+ if (likely(!err)) -+ err = nilfs_transaction_commit(old_dir->i_sb); -+ else -+ nilfs_transaction_abort(old_dir->i_sb); - return err; - } - -diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h -index e2c5376b56cd8e..4c4b7686548434 100644 ---- a/fs/nilfs2/nilfs.h -+++ b/fs/nilfs2/nilfs.h -@@ -240,8 +240,14 @@ nilfs_find_entry(struct inode *, const struct qstr *, struct page **); - extern int nilfs_delete_entry(struct nilfs_dir_entry *, struct page *); - extern int nilfs_empty_dir(struct inode *); - extern struct nilfs_dir_entry *nilfs_dotdot(struct inode *, struct page **); --extern void nilfs_set_link(struct inode *, struct nilfs_dir_entry *, -- struct page *, struct inode *); -+int nilfs_set_link(struct inode *dir, struct nilfs_dir_entry *de, -+ struct page *page, struct inode *inode); -+ -+static inline void nilfs_put_page(struct page *page) -+{ -+ kunmap(page); -+ put_page(page); -+} - - /* file.c */ - extern int nilfs_sync_file(struct file *, loff_t, loff_t, int); -diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c -index 8d3fa2a3b8a956..b809a616728f27 100644 ---- a/fs/smb/client/smb2ops.c -+++ b/fs/smb/client/smb2ops.c -@@ -4905,6 +4905,10 @@ receive_encrypted_standard(struct TCP_Server_Info *server, - next_buffer = (char *)cifs_buf_get(); - else - next_buffer = (char *)cifs_small_buf_get(); -+ if (!next_buffer) { -+ cifs_server_dbg(VFS, "No memory for (large) SMB response\n"); -+ return -1; -+ } - memcpy(next_buffer, buf + next_cmd, pdu_length - next_cmd); - } - -diff --git a/fs/xfs/libxfs/xfs_ag.c b/fs/xfs/libxfs/xfs_ag.c -index 1531bd0ee359c9..ea0e9492b37402 100644 ---- a/fs/xfs/libxfs/xfs_ag.c -+++ b/fs/xfs/libxfs/xfs_ag.c -@@ -357,31 +357,37 @@ xfs_free_unused_perag_range( - } - } - -+int -+xfs_update_last_ag_size( -+ struct xfs_mount *mp, -+ xfs_agnumber_t prev_agcount) -+{ -+ struct xfs_perag *pag = xfs_perag_grab(mp, prev_agcount - 1); -+ -+ if (!pag) -+ return -EFSCORRUPTED; -+ pag->block_count = __xfs_ag_block_count(mp, prev_agcount - 1, -+ mp->m_sb.sb_agcount, mp->m_sb.sb_dblocks); -+ __xfs_agino_range(mp, pag->block_count, &pag->agino_min, -+ &pag->agino_max); -+ xfs_perag_rele(pag); -+ return 0; -+} -+ - int - xfs_initialize_perag( - struct xfs_mount *mp, -- xfs_agnumber_t agcount, -+ xfs_agnumber_t old_agcount, -+ xfs_agnumber_t new_agcount, - xfs_rfsblock_t dblocks, - xfs_agnumber_t *maxagi) - { - struct xfs_perag *pag; - xfs_agnumber_t index; -- xfs_agnumber_t first_initialised = NULLAGNUMBER; - int error; - -- /* -- * Walk the current per-ag tree so we don't try to initialise AGs -- * that already exist (growfs case). Allocate and insert all the -- * AGs we don't find ready for initialisation. -- */ -- for (index = 0; index < agcount; index++) { -- pag = xfs_perag_get(mp, index); -- if (pag) { -- xfs_perag_put(pag); -- continue; -- } -- -- pag = kmem_zalloc(sizeof(*pag), KM_MAYFAIL); -+ for (index = old_agcount; index < new_agcount; index++) { -+ pag = kmem_zalloc(sizeof(*pag), 0); - if (!pag) { - error = -ENOMEM; - goto out_unwind_new_pags; -@@ -425,21 +431,17 @@ xfs_initialize_perag( - /* Active ref owned by mount indicates AG is online. */ - atomic_set(&pag->pag_active_ref, 1); - -- /* first new pag is fully initialized */ -- if (first_initialised == NULLAGNUMBER) -- first_initialised = index; -- - /* - * Pre-calculated geometry - */ -- pag->block_count = __xfs_ag_block_count(mp, index, agcount, -+ pag->block_count = __xfs_ag_block_count(mp, index, new_agcount, - dblocks); - pag->min_block = XFS_AGFL_BLOCK(mp); - __xfs_agino_range(mp, pag->block_count, &pag->agino_min, - &pag->agino_max); - } - -- index = xfs_set_inode_alloc(mp, agcount); -+ index = xfs_set_inode_alloc(mp, new_agcount); - - if (maxagi) - *maxagi = index; -@@ -455,8 +457,7 @@ xfs_initialize_perag( - out_free_pag: - kmem_free(pag); - out_unwind_new_pags: -- /* unwind any prior newly initialized pags */ -- xfs_free_unused_perag_range(mp, first_initialised, agcount); -+ xfs_free_unused_perag_range(mp, old_agcount, index); - return error; - } - -diff --git a/fs/xfs/libxfs/xfs_ag.h b/fs/xfs/libxfs/xfs_ag.h -index 40d7b6427afb5d..423c489fec5832 100644 ---- a/fs/xfs/libxfs/xfs_ag.h -+++ b/fs/xfs/libxfs/xfs_ag.h -@@ -135,10 +135,12 @@ __XFS_AG_OPSTATE(agfl_needs_reset, AGFL_NEEDS_RESET) - - void xfs_free_unused_perag_range(struct xfs_mount *mp, xfs_agnumber_t agstart, - xfs_agnumber_t agend); --int xfs_initialize_perag(struct xfs_mount *mp, xfs_agnumber_t agcount, -- xfs_rfsblock_t dcount, xfs_agnumber_t *maxagi); -+int xfs_initialize_perag(struct xfs_mount *mp, xfs_agnumber_t old_agcount, -+ xfs_agnumber_t agcount, xfs_rfsblock_t dcount, -+ xfs_agnumber_t *maxagi); - int xfs_initialize_perag_data(struct xfs_mount *mp, xfs_agnumber_t agno); - void xfs_free_perag(struct xfs_mount *mp); -+int xfs_update_last_ag_size(struct xfs_mount *mp, xfs_agnumber_t prev_agcount); - - /* Passive AG references */ - struct xfs_perag *xfs_perag_get(struct xfs_mount *mp, xfs_agnumber_t agno); -diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c -index 100ab5931b3132..ad2fa3c26f8a94 100644 ---- a/fs/xfs/libxfs/xfs_alloc.c -+++ b/fs/xfs/libxfs/xfs_alloc.c -@@ -1783,7 +1783,7 @@ xfs_alloc_ag_vextent_size( - error = -EFSCORRUPTED; - goto error0; - } -- if (flen < bestrlen) -+ if (flen <= bestrlen) - break; - busy = xfs_alloc_compute_aligned(args, fbno, flen, - &rbno, &rlen, &busy_gen); -@@ -2581,7 +2581,6 @@ __xfs_free_extent_later( - return 0; - } - --#ifdef DEBUG - /* - * Check if an AGF has a free extent record whose length is equal to - * args->minlen. -@@ -2620,7 +2619,6 @@ xfs_exact_minlen_extent_available( - - return error; - } --#endif - - /* - * Decide whether to use this allocation group for this allocation. -@@ -2694,15 +2692,14 @@ xfs_alloc_fix_freelist( - if (!xfs_alloc_space_available(args, need, alloc_flags)) - goto out_agbp_relse; - --#ifdef DEBUG -- if (args->alloc_minlen_only) { -+ if (IS_ENABLED(CONFIG_XFS_DEBUG) && args->alloc_minlen_only) { - int stat; - - error = xfs_exact_minlen_extent_available(args, agbp, &stat); - if (error || !stat) - goto out_agbp_relse; - } --#endif -+ - /* - * Make the freelist shorter if it's too long. - * -diff --git a/fs/xfs/libxfs/xfs_alloc.h b/fs/xfs/libxfs/xfs_alloc.h -index 6bb8d295c321d2..a12294cb83bbaf 100644 ---- a/fs/xfs/libxfs/xfs_alloc.h -+++ b/fs/xfs/libxfs/xfs_alloc.h -@@ -53,11 +53,9 @@ typedef struct xfs_alloc_arg { - int datatype; /* mask defining data type treatment */ - char wasdel; /* set if allocation was prev delayed */ - char wasfromfl; /* set if allocation is from freelist */ -+ bool alloc_minlen_only; /* allocate exact minlen extent */ - struct xfs_owner_info oinfo; /* owner of blocks being allocated */ - enum xfs_ag_resv_type resv; /* block reservation to use */ --#ifdef DEBUG -- bool alloc_minlen_only; /* allocate exact minlen extent */ --#endif - } xfs_alloc_arg_t; - - /* -diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c -index 33edf047e0ad2f..50172bb8026fd9 100644 ---- a/fs/xfs/libxfs/xfs_attr.c -+++ b/fs/xfs/libxfs/xfs_attr.c -@@ -50,7 +50,6 @@ STATIC int xfs_attr_shortform_addname(xfs_da_args_t *args); - STATIC int xfs_attr_leaf_get(xfs_da_args_t *args); - STATIC int xfs_attr_leaf_removename(xfs_da_args_t *args); - STATIC int xfs_attr_leaf_hasname(struct xfs_da_args *args, struct xfs_buf **bp); --STATIC int xfs_attr_leaf_try_add(struct xfs_da_args *args); - - /* - * Internal routines when attribute list is more than one block. -@@ -401,6 +400,33 @@ xfs_attr_sf_addname( - return error; - } - -+/* Save the current remote block info and clear the current pointers. */ -+static void -+xfs_attr_save_rmt_blk( -+ struct xfs_da_args *args) -+{ -+ args->blkno2 = args->blkno; -+ args->index2 = args->index; -+ args->rmtblkno2 = args->rmtblkno; -+ args->rmtblkcnt2 = args->rmtblkcnt; -+ args->rmtvaluelen2 = args->rmtvaluelen; -+ args->rmtblkno = 0; -+ args->rmtblkcnt = 0; -+ args->rmtvaluelen = 0; -+} -+ -+/* Set stored info about a remote block */ -+static void -+xfs_attr_restore_rmt_blk( -+ struct xfs_da_args *args) -+{ -+ args->blkno = args->blkno2; -+ args->index = args->index2; -+ args->rmtblkno = args->rmtblkno2; -+ args->rmtblkcnt = args->rmtblkcnt2; -+ args->rmtvaluelen = args->rmtvaluelen2; -+} -+ - /* - * Handle the state change on completion of a multi-state attr operation. - * -@@ -428,48 +454,73 @@ xfs_attr_complete_op( - return XFS_DAS_DONE; - } - -+/* -+ * Try to add an attribute to an inode in leaf form. -+ */ - static int - xfs_attr_leaf_addname( - struct xfs_attr_intent *attr) - { - struct xfs_da_args *args = attr->xattri_da_args; -+ struct xfs_buf *bp; - int error; - - ASSERT(xfs_attr_is_leaf(args->dp)); - -+ error = xfs_attr3_leaf_read(args->trans, args->dp, 0, &bp); -+ if (error) -+ return error; -+ - /* -- * Use the leaf buffer we may already hold locked as a result of -- * a sf-to-leaf conversion. -+ * Look up the xattr name to set the insertion point for the new xattr. - */ -- error = xfs_attr_leaf_try_add(args); -- -- if (error == -ENOSPC) { -- error = xfs_attr3_leaf_to_node(args); -- if (error) -- return error; -+ error = xfs_attr3_leaf_lookup_int(bp, args); -+ switch (error) { -+ case -ENOATTR: -+ if (args->op_flags & XFS_DA_OP_REPLACE) -+ goto out_brelse; -+ break; -+ case -EEXIST: -+ if (!(args->op_flags & XFS_DA_OP_REPLACE)) -+ goto out_brelse; - -+ trace_xfs_attr_leaf_replace(args); - /* -- * We're not in leaf format anymore, so roll the transaction and -- * retry the add to the newly allocated node block. -+ * Save the existing remote attr state so that the current -+ * values reflect the state of the new attribute we are about to -+ * add, not the attribute we just found and will remove later. - */ -- attr->xattri_dela_state = XFS_DAS_NODE_ADD; -- goto out; -+ xfs_attr_save_rmt_blk(args); -+ break; -+ case 0: -+ break; -+ default: -+ goto out_brelse; - } -- if (error) -- return error; - - /* - * We need to commit and roll if we need to allocate remote xattr blocks - * or perform more xattr manipulations. Otherwise there is nothing more - * to do and we can return success. - */ -- if (args->rmtblkno) -+ if (!xfs_attr3_leaf_add(bp, args)) { -+ error = xfs_attr3_leaf_to_node(args); -+ if (error) -+ return error; -+ -+ attr->xattri_dela_state = XFS_DAS_NODE_ADD; -+ } else if (args->rmtblkno) { - attr->xattri_dela_state = XFS_DAS_LEAF_SET_RMT; -- else -- attr->xattri_dela_state = xfs_attr_complete_op(attr, -- XFS_DAS_LEAF_REPLACE); --out: -+ } else { -+ attr->xattri_dela_state = -+ xfs_attr_complete_op(attr, XFS_DAS_LEAF_REPLACE); -+ } -+ - trace_xfs_attr_leaf_addname_return(attr->xattri_dela_state, args->dp); -+ return 0; -+ -+out_brelse: -+ xfs_trans_brelse(args->trans, bp); - return error; - } - -@@ -492,7 +543,7 @@ xfs_attr_node_addname( - return error; - - error = xfs_attr_node_try_addname(attr); -- if (error == -ENOSPC) { -+ if (error == 1) { - error = xfs_attr3_leaf_to_node(args); - if (error) - return error; -@@ -1164,88 +1215,6 @@ xfs_attr_shortform_addname( - * External routines when attribute list is one block - *========================================================================*/ - --/* Save the current remote block info and clear the current pointers. */ --static void --xfs_attr_save_rmt_blk( -- struct xfs_da_args *args) --{ -- args->blkno2 = args->blkno; -- args->index2 = args->index; -- args->rmtblkno2 = args->rmtblkno; -- args->rmtblkcnt2 = args->rmtblkcnt; -- args->rmtvaluelen2 = args->rmtvaluelen; -- args->rmtblkno = 0; -- args->rmtblkcnt = 0; -- args->rmtvaluelen = 0; --} -- --/* Set stored info about a remote block */ --static void --xfs_attr_restore_rmt_blk( -- struct xfs_da_args *args) --{ -- args->blkno = args->blkno2; -- args->index = args->index2; -- args->rmtblkno = args->rmtblkno2; -- args->rmtblkcnt = args->rmtblkcnt2; -- args->rmtvaluelen = args->rmtvaluelen2; --} -- --/* -- * Tries to add an attribute to an inode in leaf form -- * -- * This function is meant to execute as part of a delayed operation and leaves -- * the transaction handling to the caller. On success the attribute is added -- * and the inode and transaction are left dirty. If there is not enough space, -- * the attr data is converted to node format and -ENOSPC is returned. Caller is -- * responsible for handling the dirty inode and transaction or adding the attr -- * in node format. -- */ --STATIC int --xfs_attr_leaf_try_add( -- struct xfs_da_args *args) --{ -- struct xfs_buf *bp; -- int error; -- -- error = xfs_attr3_leaf_read(args->trans, args->dp, 0, &bp); -- if (error) -- return error; -- -- /* -- * Look up the xattr name to set the insertion point for the new xattr. -- */ -- error = xfs_attr3_leaf_lookup_int(bp, args); -- switch (error) { -- case -ENOATTR: -- if (args->op_flags & XFS_DA_OP_REPLACE) -- goto out_brelse; -- break; -- case -EEXIST: -- if (!(args->op_flags & XFS_DA_OP_REPLACE)) -- goto out_brelse; -- -- trace_xfs_attr_leaf_replace(args); -- /* -- * Save the existing remote attr state so that the current -- * values reflect the state of the new attribute we are about to -- * add, not the attribute we just found and will remove later. -- */ -- xfs_attr_save_rmt_blk(args); -- break; -- case 0: -- break; -- default: -- goto out_brelse; -- } -- -- return xfs_attr3_leaf_add(bp, args); -- --out_brelse: -- xfs_trans_brelse(args->trans, bp); -- return error; --} -- - /* - * Return EEXIST if attr is found, or ENOATTR if not - */ -@@ -1411,9 +1380,12 @@ xfs_attr_node_addname_find_attr( - /* - * Add a name to a Btree-format attribute list. - * -- * This will involve walking down the Btree, and may involve splitting -- * leaf nodes and even splitting intermediate nodes up to and including -- * the root node (a special case of an intermediate node). -+ * This will involve walking down the Btree, and may involve splitting leaf -+ * nodes and even splitting intermediate nodes up to and including the root -+ * node (a special case of an intermediate node). -+ * -+ * If the tree was still in single leaf format and needs to converted to -+ * real node format return 1 and let the caller handle that. - */ - static int - xfs_attr_node_try_addname( -@@ -1421,21 +1393,21 @@ xfs_attr_node_try_addname( - { - struct xfs_da_state *state = attr->xattri_da_state; - struct xfs_da_state_blk *blk; -- int error; -+ int error = 0; - - trace_xfs_attr_node_addname(state->args); - - blk = &state->path.blk[state->path.active-1]; - ASSERT(blk->magic == XFS_ATTR_LEAF_MAGIC); - -- error = xfs_attr3_leaf_add(blk->bp, state->args); -- if (error == -ENOSPC) { -+ if (!xfs_attr3_leaf_add(blk->bp, state->args)) { - if (state->path.active == 1) { - /* - * Its really a single leaf node, but it had - * out-of-line values so it looked like it *might* - * have been a b-tree. Let the caller deal with this. - */ -+ error = 1; - goto out; - } - -diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c -index 51ff4406867539..4e5ede2a296a58 100644 ---- a/fs/xfs/libxfs/xfs_attr_leaf.c -+++ b/fs/xfs/libxfs/xfs_attr_leaf.c -@@ -46,7 +46,7 @@ - */ - STATIC int xfs_attr3_leaf_create(struct xfs_da_args *args, - xfs_dablk_t which_block, struct xfs_buf **bpp); --STATIC int xfs_attr3_leaf_add_work(struct xfs_buf *leaf_buffer, -+STATIC void xfs_attr3_leaf_add_work(struct xfs_buf *leaf_buffer, - struct xfs_attr3_icleaf_hdr *ichdr, - struct xfs_da_args *args, int freemap_index); - STATIC void xfs_attr3_leaf_compact(struct xfs_da_args *args, -@@ -990,10 +990,8 @@ xfs_attr_shortform_to_leaf( - } - error = xfs_attr3_leaf_lookup_int(bp, &nargs); /* set a->index */ - ASSERT(error == -ENOATTR); -- error = xfs_attr3_leaf_add(bp, &nargs); -- ASSERT(error != -ENOSPC); -- if (error) -- goto out; -+ if (!xfs_attr3_leaf_add(bp, &nargs)) -+ ASSERT(0); - sfe = xfs_attr_sf_nextentry(sfe); - } - error = 0; -@@ -1342,6 +1340,9 @@ xfs_attr3_leaf_create( - - /* - * Split the leaf node, rebalance, then add the new entry. -+ * -+ * Returns 0 if the entry was added, 1 if a further split is needed or a -+ * negative error number otherwise. - */ - int - xfs_attr3_leaf_split( -@@ -1349,8 +1350,9 @@ xfs_attr3_leaf_split( - struct xfs_da_state_blk *oldblk, - struct xfs_da_state_blk *newblk) - { -- xfs_dablk_t blkno; -- int error; -+ bool added; -+ xfs_dablk_t blkno; -+ int error; - - trace_xfs_attr_leaf_split(state->args); - -@@ -1385,10 +1387,10 @@ xfs_attr3_leaf_split( - */ - if (state->inleaf) { - trace_xfs_attr_leaf_add_old(state->args); -- error = xfs_attr3_leaf_add(oldblk->bp, state->args); -+ added = xfs_attr3_leaf_add(oldblk->bp, state->args); - } else { - trace_xfs_attr_leaf_add_new(state->args); -- error = xfs_attr3_leaf_add(newblk->bp, state->args); -+ added = xfs_attr3_leaf_add(newblk->bp, state->args); - } - - /* -@@ -1396,13 +1398,15 @@ xfs_attr3_leaf_split( - */ - oldblk->hashval = xfs_attr_leaf_lasthash(oldblk->bp, NULL); - newblk->hashval = xfs_attr_leaf_lasthash(newblk->bp, NULL); -- return error; -+ if (!added) -+ return 1; -+ return 0; - } - - /* - * Add a name to the leaf attribute list structure. - */ --int -+bool - xfs_attr3_leaf_add( - struct xfs_buf *bp, - struct xfs_da_args *args) -@@ -1411,6 +1415,7 @@ xfs_attr3_leaf_add( - struct xfs_attr3_icleaf_hdr ichdr; - int tablesize; - int entsize; -+ bool added = true; - int sum; - int tmp; - int i; -@@ -1439,7 +1444,7 @@ xfs_attr3_leaf_add( - if (ichdr.freemap[i].base < ichdr.firstused) - tmp += sizeof(xfs_attr_leaf_entry_t); - if (ichdr.freemap[i].size >= tmp) { -- tmp = xfs_attr3_leaf_add_work(bp, &ichdr, args, i); -+ xfs_attr3_leaf_add_work(bp, &ichdr, args, i); - goto out_log_hdr; - } - sum += ichdr.freemap[i].size; -@@ -1451,7 +1456,7 @@ xfs_attr3_leaf_add( - * no good and we should just give up. - */ - if (!ichdr.holes && sum < entsize) -- return -ENOSPC; -+ return false; - - /* - * Compact the entries to coalesce free space. -@@ -1464,24 +1469,24 @@ xfs_attr3_leaf_add( - * free region, in freemap[0]. If it is not big enough, give up. - */ - if (ichdr.freemap[0].size < (entsize + sizeof(xfs_attr_leaf_entry_t))) { -- tmp = -ENOSPC; -+ added = false; - goto out_log_hdr; - } - -- tmp = xfs_attr3_leaf_add_work(bp, &ichdr, args, 0); -+ xfs_attr3_leaf_add_work(bp, &ichdr, args, 0); - - out_log_hdr: - xfs_attr3_leaf_hdr_to_disk(args->geo, leaf, &ichdr); - xfs_trans_log_buf(args->trans, bp, - XFS_DA_LOGRANGE(leaf, &leaf->hdr, - xfs_attr3_leaf_hdr_size(leaf))); -- return tmp; -+ return added; - } - - /* - * Add a name to a leaf attribute list structure. - */ --STATIC int -+STATIC void - xfs_attr3_leaf_add_work( - struct xfs_buf *bp, - struct xfs_attr3_icleaf_hdr *ichdr, -@@ -1599,7 +1604,6 @@ xfs_attr3_leaf_add_work( - } - } - ichdr->usedbytes += xfs_attr_leaf_entsize(leaf, args->index); -- return 0; - } - - /* -diff --git a/fs/xfs/libxfs/xfs_attr_leaf.h b/fs/xfs/libxfs/xfs_attr_leaf.h -index 368f4d9fa1d596..d15cc5b6f4a943 100644 ---- a/fs/xfs/libxfs/xfs_attr_leaf.h -+++ b/fs/xfs/libxfs/xfs_attr_leaf.h -@@ -78,7 +78,7 @@ int xfs_attr3_leaf_split(struct xfs_da_state *state, - int xfs_attr3_leaf_lookup_int(struct xfs_buf *leaf, - struct xfs_da_args *args); - int xfs_attr3_leaf_getvalue(struct xfs_buf *bp, struct xfs_da_args *args); --int xfs_attr3_leaf_add(struct xfs_buf *leaf_buffer, -+bool xfs_attr3_leaf_add(struct xfs_buf *leaf_buffer, - struct xfs_da_args *args); - int xfs_attr3_leaf_remove(struct xfs_buf *leaf_buffer, - struct xfs_da_args *args); -diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c -index e6ea35098e07f8..c111f691ea51a1 100644 ---- a/fs/xfs/libxfs/xfs_bmap.c -+++ b/fs/xfs/libxfs/xfs_bmap.c -@@ -3388,31 +3388,19 @@ xfs_bmap_process_allocated_extent( - xfs_bmap_btalloc_accounting(ap, args); - } - --#ifdef DEBUG - static int - xfs_bmap_exact_minlen_extent_alloc( -- struct xfs_bmalloca *ap) -+ struct xfs_bmalloca *ap, -+ struct xfs_alloc_arg *args) - { -- struct xfs_mount *mp = ap->ip->i_mount; -- struct xfs_alloc_arg args = { .tp = ap->tp, .mp = mp }; -- xfs_fileoff_t orig_offset; -- xfs_extlen_t orig_length; -- int error; -- -- ASSERT(ap->length); -- - if (ap->minlen != 1) { -- ap->blkno = NULLFSBLOCK; -- ap->length = 0; -+ args->fsbno = NULLFSBLOCK; - return 0; - } - -- orig_offset = ap->offset; -- orig_length = ap->length; -- -- args.alloc_minlen_only = 1; -- -- xfs_bmap_compute_alignments(ap, &args); -+ args->alloc_minlen_only = 1; -+ args->minlen = args->maxlen = ap->minlen; -+ args->total = ap->total; - - /* - * Unlike the longest extent available in an AG, we don't track -@@ -3422,39 +3410,16 @@ xfs_bmap_exact_minlen_extent_alloc( - * we need not be concerned about a drop in performance in - * "debug only" code paths. - */ -- ap->blkno = XFS_AGB_TO_FSB(mp, 0, 0); -+ ap->blkno = XFS_AGB_TO_FSB(ap->ip->i_mount, 0, 0); - -- args.oinfo = XFS_RMAP_OINFO_SKIP_UPDATE; -- args.minlen = args.maxlen = ap->minlen; -- args.total = ap->total; -- -- args.alignment = 1; -- args.minalignslop = 0; -- -- args.minleft = ap->minleft; -- args.wasdel = ap->wasdel; -- args.resv = XFS_AG_RESV_NONE; -- args.datatype = ap->datatype; -- -- error = xfs_alloc_vextent_first_ag(&args, ap->blkno); -- if (error) -- return error; -- -- if (args.fsbno != NULLFSBLOCK) { -- xfs_bmap_process_allocated_extent(ap, &args, orig_offset, -- orig_length); -- } else { -- ap->blkno = NULLFSBLOCK; -- ap->length = 0; -- } -- -- return 0; -+ /* -+ * Call xfs_bmap_btalloc_low_space here as it first does a "normal" AG -+ * iteration and then drops args->total to args->minlen, which might be -+ * required to find an allocation for the transaction reservation when -+ * the file system is very full. -+ */ -+ return xfs_bmap_btalloc_low_space(ap, args); - } --#else -- --#define xfs_bmap_exact_minlen_extent_alloc(bma) (-EFSCORRUPTED) -- --#endif - - /* - * If we are not low on available data blocks and we are allocating at -@@ -3712,8 +3677,11 @@ xfs_bmap_btalloc( - /* Trim the allocation back to the maximum an AG can fit. */ - args.maxlen = min(ap->length, mp->m_ag_max_usable); - -- if ((ap->datatype & XFS_ALLOC_USERDATA) && -- xfs_inode_is_filestream(ap->ip)) -+ if (unlikely(XFS_TEST_ERROR(false, mp, -+ XFS_ERRTAG_BMAP_ALLOC_MINLEN_EXTENT))) -+ error = xfs_bmap_exact_minlen_extent_alloc(ap, &args); -+ else if ((ap->datatype & XFS_ALLOC_USERDATA) && -+ xfs_inode_is_filestream(ap->ip)) - error = xfs_bmap_btalloc_filestreams(ap, &args, stripe_align); - else - error = xfs_bmap_btalloc_best_length(ap, &args, stripe_align); -@@ -4077,43 +4045,6 @@ xfs_bmapi_reserve_delalloc( - return error; - } - --static int --xfs_bmap_alloc_userdata( -- struct xfs_bmalloca *bma) --{ -- struct xfs_mount *mp = bma->ip->i_mount; -- int whichfork = xfs_bmapi_whichfork(bma->flags); -- int error; -- -- /* -- * Set the data type being allocated. For the data fork, the first data -- * in the file is treated differently to all other allocations. For the -- * attribute fork, we only need to ensure the allocated range is not on -- * the busy list. -- */ -- bma->datatype = XFS_ALLOC_NOBUSY; -- if (whichfork == XFS_DATA_FORK || whichfork == XFS_COW_FORK) { -- bma->datatype |= XFS_ALLOC_USERDATA; -- if (bma->offset == 0) -- bma->datatype |= XFS_ALLOC_INITIAL_USER_DATA; -- -- if (mp->m_dalign && bma->length >= mp->m_dalign) { -- error = xfs_bmap_isaeof(bma, whichfork); -- if (error) -- return error; -- } -- -- if (XFS_IS_REALTIME_INODE(bma->ip)) -- return xfs_bmap_rtalloc(bma); -- } -- -- if (unlikely(XFS_TEST_ERROR(false, mp, -- XFS_ERRTAG_BMAP_ALLOC_MINLEN_EXTENT))) -- return xfs_bmap_exact_minlen_extent_alloc(bma); -- -- return xfs_bmap_btalloc(bma); --} -- - static int - xfs_bmapi_allocate( - struct xfs_bmalloca *bma) -@@ -4147,15 +4078,32 @@ xfs_bmapi_allocate( - else - bma->minlen = 1; - -- if (bma->flags & XFS_BMAPI_METADATA) { -- if (unlikely(XFS_TEST_ERROR(false, mp, -- XFS_ERRTAG_BMAP_ALLOC_MINLEN_EXTENT))) -- error = xfs_bmap_exact_minlen_extent_alloc(bma); -- else -- error = xfs_bmap_btalloc(bma); -- } else { -- error = xfs_bmap_alloc_userdata(bma); -+ if (!(bma->flags & XFS_BMAPI_METADATA)) { -+ /* -+ * For the data and COW fork, the first data in the file is -+ * treated differently to all other allocations. For the -+ * attribute fork, we only need to ensure the allocated range -+ * is not on the busy list. -+ */ -+ bma->datatype = XFS_ALLOC_NOBUSY; -+ if (whichfork == XFS_DATA_FORK || whichfork == XFS_COW_FORK) { -+ bma->datatype |= XFS_ALLOC_USERDATA; -+ if (bma->offset == 0) -+ bma->datatype |= XFS_ALLOC_INITIAL_USER_DATA; -+ -+ if (mp->m_dalign && bma->length >= mp->m_dalign) { -+ error = xfs_bmap_isaeof(bma, whichfork); -+ if (error) -+ return error; -+ } -+ } - } -+ -+ if ((bma->datatype & XFS_ALLOC_USERDATA) && -+ XFS_IS_REALTIME_INODE(bma->ip)) -+ error = xfs_bmap_rtalloc(bma); -+ else -+ error = xfs_bmap_btalloc(bma); - if (error) - return error; - if (bma->blkno == NULLFSBLOCK) -diff --git a/fs/xfs/libxfs/xfs_da_btree.c b/fs/xfs/libxfs/xfs_da_btree.c -index 12e3cca804b7ec..28bbfc31039c0e 100644 ---- a/fs/xfs/libxfs/xfs_da_btree.c -+++ b/fs/xfs/libxfs/xfs_da_btree.c -@@ -522,9 +522,8 @@ xfs_da3_split( - switch (oldblk->magic) { - case XFS_ATTR_LEAF_MAGIC: - error = xfs_attr3_leaf_split(state, oldblk, newblk); -- if ((error != 0) && (error != -ENOSPC)) { -+ if (error < 0) - return error; /* GROT: attr is inconsistent */ -- } - if (!error) { - addblk = newblk; - break; -@@ -546,6 +545,8 @@ xfs_da3_split( - error = xfs_attr3_leaf_split(state, newblk, - &state->extrablk); - } -+ if (error == 1) -+ return -ENOSPC; - if (error) - return error; /* GROT: attr inconsistent */ - addblk = newblk; -diff --git a/fs/xfs/libxfs/xfs_inode_fork.c b/fs/xfs/libxfs/xfs_inode_fork.c -index 5a2e7ddfa76d63..25b86ffc2ce327 100644 ---- a/fs/xfs/libxfs/xfs_inode_fork.c -+++ b/fs/xfs/libxfs/xfs_inode_fork.c -@@ -449,15 +449,15 @@ xfs_iroot_realloc( - } - - /* -- * Only copy the records and pointers if there are any. -+ * Only copy the keys and pointers if there are any. - */ - if (new_max > 0) { - /* -- * First copy the records. -+ * First copy the keys. - */ -- op = (char *)XFS_BMBT_REC_ADDR(mp, ifp->if_broot, 1); -- np = (char *)XFS_BMBT_REC_ADDR(mp, new_broot, 1); -- memcpy(np, op, new_max * (uint)sizeof(xfs_bmbt_rec_t)); -+ op = (char *)XFS_BMBT_KEY_ADDR(mp, ifp->if_broot, 1); -+ np = (char *)XFS_BMBT_KEY_ADDR(mp, new_broot, 1); -+ memcpy(np, op, new_max * (uint)sizeof(xfs_bmbt_key_t)); - - /* - * Then copy the pointers. -diff --git a/fs/xfs/libxfs/xfs_rtbitmap.c b/fs/xfs/libxfs/xfs_rtbitmap.c -index 760172a65aff31..d7d06dc89eb7e3 100644 ---- a/fs/xfs/libxfs/xfs_rtbitmap.c -+++ b/fs/xfs/libxfs/xfs_rtbitmap.c -@@ -288,6 +288,8 @@ xfs_rtfind_forw( - xfs_rtword_t wdiff; /* difference from wanted value */ - int word; /* word number in the buffer */ - -+ ASSERT(start <= limit); -+ - /* - * Compute and read in starting bitmap block for starting block. - */ -diff --git a/fs/xfs/xfs_buf_item_recover.c b/fs/xfs/xfs_buf_item_recover.c -index 43167f543afc33..c12dee0cb7fc96 100644 ---- a/fs/xfs/xfs_buf_item_recover.c -+++ b/fs/xfs/xfs_buf_item_recover.c -@@ -22,6 +22,9 @@ - #include "xfs_inode.h" - #include "xfs_dir2.h" - #include "xfs_quota.h" -+#include "xfs_alloc.h" -+#include "xfs_ag.h" -+#include "xfs_sb.h" - - /* - * This is the number of entries in the l_buf_cancel_table used during -@@ -684,6 +687,67 @@ xlog_recover_do_inode_buffer( - return 0; - } - -+/* -+ * Update the in-memory superblock and perag structures from the primary SB -+ * buffer. -+ * -+ * This is required because transactions running after growfs may require the -+ * updated values to be set in a previous fully commit transaction. -+ */ -+static int -+xlog_recover_do_primary_sb_buffer( -+ struct xfs_mount *mp, -+ struct xlog_recover_item *item, -+ struct xfs_buf *bp, -+ struct xfs_buf_log_format *buf_f, -+ xfs_lsn_t current_lsn) -+{ -+ struct xfs_dsb *dsb = bp->b_addr; -+ xfs_agnumber_t orig_agcount = mp->m_sb.sb_agcount; -+ int error; -+ -+ xlog_recover_do_reg_buffer(mp, item, bp, buf_f, current_lsn); -+ -+ if (orig_agcount == 0) { -+ xfs_alert(mp, "Trying to grow file system without AGs"); -+ return -EFSCORRUPTED; -+ } -+ -+ /* -+ * Update the in-core super block from the freshly recovered on-disk one. -+ */ -+ xfs_sb_from_disk(&mp->m_sb, dsb); -+ -+ if (mp->m_sb.sb_agcount < orig_agcount) { -+ xfs_alert(mp, "Shrinking AG count in log recovery not supported"); -+ return -EFSCORRUPTED; -+ } -+ -+ /* -+ * Growfs can also grow the last existing AG. In this case we also need -+ * to update the length in the in-core perag structure and values -+ * depending on it. -+ */ -+ error = xfs_update_last_ag_size(mp, orig_agcount); -+ if (error) -+ return error; -+ -+ /* -+ * Initialize the new perags, and also update various block and inode -+ * allocator setting based off the number of AGs or total blocks. -+ * Because of the latter this also needs to happen if the agcount did -+ * not change. -+ */ -+ error = xfs_initialize_perag(mp, orig_agcount, mp->m_sb.sb_agcount, -+ mp->m_sb.sb_dblocks, &mp->m_maxagi); -+ if (error) { -+ xfs_warn(mp, "Failed recovery per-ag init: %d", error); -+ return error; -+ } -+ mp->m_alloc_set_aside = xfs_alloc_set_aside(mp); -+ return 0; -+} -+ - /* - * V5 filesystems know the age of the buffer on disk being recovered. We can - * have newer objects on disk than we are replaying, and so for these cases we -@@ -967,6 +1031,12 @@ xlog_recover_buf_commit_pass2( - dirty = xlog_recover_do_dquot_buffer(mp, log, item, bp, buf_f); - if (!dirty) - goto out_release; -+ } else if ((xfs_blft_from_flags(buf_f) & XFS_BLFT_SB_BUF) && -+ xfs_buf_daddr(bp) == 0) { -+ error = xlog_recover_do_primary_sb_buffer(mp, item, bp, buf_f, -+ current_lsn); -+ if (error) -+ goto out_release; - } else { - xlog_recover_do_reg_buffer(mp, item, bp, buf_f, current_lsn); - } -diff --git a/fs/xfs/xfs_filestream.c b/fs/xfs/xfs_filestream.c -index f62b023f274e96..4e1e8356121851 100644 ---- a/fs/xfs/xfs_filestream.c -+++ b/fs/xfs/xfs_filestream.c -@@ -67,22 +67,28 @@ xfs_filestream_pick_ag( - xfs_extlen_t minfree, maxfree = 0; - xfs_agnumber_t agno; - bool first_pass = true; -- int err; - - /* 2% of an AG's blocks must be free for it to be chosen. */ - minfree = mp->m_sb.sb_agblocks / 50; - - restart: - for_each_perag_wrap(mp, start_agno, agno, pag) { -+ int err; -+ - trace_xfs_filestream_scan(pag, pino); -+ - *longest = 0; - err = xfs_bmap_longest_free_extent(pag, NULL, longest); - if (err) { -- if (err != -EAGAIN) -- break; -- /* Couldn't lock the AGF, skip this AG. */ -- err = 0; -- continue; -+ if (err == -EAGAIN) { -+ /* Couldn't lock the AGF, skip this AG. */ -+ err = 0; -+ continue; -+ } -+ xfs_perag_rele(pag); -+ if (max_pag) -+ xfs_perag_rele(max_pag); -+ return err; - } - - /* Keep track of the AG with the most free blocks. */ -@@ -107,7 +113,9 @@ xfs_filestream_pick_ag( - !(flags & XFS_PICK_USERDATA) || - (flags & XFS_PICK_LOWSPACE))) { - /* Break out, retaining the reference on the AG. */ -- break; -+ if (max_pag) -+ xfs_perag_rele(max_pag); -+ goto done; - } - } - -@@ -115,56 +123,44 @@ xfs_filestream_pick_ag( - atomic_dec(&pag->pagf_fstrms); - } - -- if (err) { -- xfs_perag_rele(pag); -- if (max_pag) -- xfs_perag_rele(max_pag); -- return err; -+ /* -+ * Allow a second pass to give xfs_bmap_longest_free_extent() another -+ * attempt at locking AGFs that it might have skipped over before we -+ * fail. -+ */ -+ if (first_pass) { -+ first_pass = false; -+ goto restart; - } - -- if (!pag) { -- /* -- * Allow a second pass to give xfs_bmap_longest_free_extent() -- * another attempt at locking AGFs that it might have skipped -- * over before we fail. -- */ -- if (first_pass) { -- first_pass = false; -- goto restart; -- } -- -- /* -- * We must be low on data space, so run a final lowspace -- * optimised selection pass if we haven't already. -- */ -- if (!(flags & XFS_PICK_LOWSPACE)) { -- flags |= XFS_PICK_LOWSPACE; -- goto restart; -- } -- -- /* -- * No unassociated AGs are available, so select the AG with the -- * most free space, regardless of whether it's already in use by -- * another filestream. It none suit, just use whatever AG we can -- * grab. -- */ -- if (!max_pag) { -- for_each_perag_wrap(args->mp, 0, start_agno, pag) { -- max_pag = pag; -- break; -- } -+ /* -+ * We must be low on data space, so run a final lowspace optimised -+ * selection pass if we haven't already. -+ */ -+ if (!(flags & XFS_PICK_LOWSPACE)) { -+ flags |= XFS_PICK_LOWSPACE; -+ goto restart; -+ } - -- /* Bail if there are no AGs at all to select from. */ -- if (!max_pag) -- return -ENOSPC; -+ /* -+ * No unassociated AGs are available, so select the AG with the most -+ * free space, regardless of whether it's already in use by another -+ * filestream. It none suit, just use whatever AG we can grab. -+ */ -+ if (!max_pag) { -+ for_each_perag_wrap(args->mp, 0, start_agno, pag) { -+ max_pag = pag; -+ break; - } - -- pag = max_pag; -- atomic_inc(&pag->pagf_fstrms); -- } else if (max_pag) { -- xfs_perag_rele(max_pag); -+ /* Bail if there are no AGs at all to select from. */ -+ if (!max_pag) -+ return -ENOSPC; - } - -+ pag = max_pag; -+ atomic_inc(&pag->pagf_fstrms); -+done: - trace_xfs_filestream_pick(pag, pino); - args->pag = pag; - return 0; -diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c -index c3f0e3cae87e56..a2c1eab5fa4af8 100644 ---- a/fs/xfs/xfs_fsops.c -+++ b/fs/xfs/xfs_fsops.c -@@ -87,6 +87,7 @@ xfs_growfs_data_private( - struct xfs_mount *mp, /* mount point for filesystem */ - struct xfs_growfs_data *in) /* growfs data input struct */ - { -+ xfs_agnumber_t oagcount = mp->m_sb.sb_agcount; - struct xfs_buf *bp; - int error; - xfs_agnumber_t nagcount; -@@ -94,7 +95,6 @@ xfs_growfs_data_private( - xfs_rfsblock_t nb, nb_div, nb_mod; - int64_t delta; - bool lastag_extended = false; -- xfs_agnumber_t oagcount; - struct xfs_trans *tp; - struct aghdr_init_data id = {}; - struct xfs_perag *last_pag; -@@ -138,16 +138,14 @@ xfs_growfs_data_private( - if (delta == 0) - return 0; - -- oagcount = mp->m_sb.sb_agcount; -- /* allocate the new per-ag structures */ -- if (nagcount > oagcount) { -- error = xfs_initialize_perag(mp, nagcount, nb, &nagimax); -- if (error) -- return error; -- } else if (nagcount < oagcount) { -- /* TODO: shrinking the entire AGs hasn't yet completed */ -+ /* TODO: shrinking the entire AGs hasn't yet completed */ -+ if (nagcount < oagcount) - return -EINVAL; -- } -+ -+ /* allocate the new per-ag structures */ -+ error = xfs_initialize_perag(mp, oagcount, nagcount, nb, &nagimax); -+ if (error) -+ return error; - - if (delta > 0) - error = xfs_trans_alloc(mp, &M_RES(mp)->tr_growdata, -diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c -index 57a9f23175250a..c54a7c60e06332 100644 ---- a/fs/xfs/xfs_icache.c -+++ b/fs/xfs/xfs_icache.c -@@ -748,7 +748,7 @@ xfs_iget( - ASSERT((lock_flags & (XFS_IOLOCK_EXCL | XFS_IOLOCK_SHARED)) == 0); - - /* reject inode numbers outside existing AGs */ -- if (!ino || XFS_INO_TO_AGNO(mp, ino) >= mp->m_sb.sb_agcount) -+ if (!xfs_verify_ino(mp, ino)) - return -EINVAL; - - XFS_STATS_INC(mp, xs_ig_attempts); -@@ -1234,14 +1234,17 @@ xfs_inode_clear_eofblocks_tag( - } - - /* -- * Set ourselves up to free CoW blocks from this file. If it's already clean -- * then we can bail out quickly, but otherwise we must back off if the file -- * is undergoing some kind of write. -+ * Prepare to free COW fork blocks from an inode. - */ - static bool - xfs_prep_free_cowblocks( -- struct xfs_inode *ip) -+ struct xfs_inode *ip, -+ struct xfs_icwalk *icw) - { -+ bool sync; -+ -+ sync = icw && (icw->icw_flags & XFS_ICWALK_FLAG_SYNC); -+ - /* - * Just clear the tag if we have an empty cow fork or none at all. It's - * possible the inode was fully unshared since it was originally tagged. -@@ -1253,16 +1256,22 @@ xfs_prep_free_cowblocks( - } - - /* -- * If the mapping is dirty or under writeback we cannot touch the -- * CoW fork. Leave it alone if we're in the midst of a directio. -+ * A cowblocks trim of an inode can have a significant effect on -+ * fragmentation even when a reasonable COW extent size hint is set. -+ * Therefore, we prefer to not process cowblocks unless they are clean -+ * and idle. We can never process a cowblocks inode that is dirty or has -+ * in-flight I/O under any circumstances, because outstanding writeback -+ * or dio expects targeted COW fork blocks exist through write -+ * completion where they can be remapped into the data fork. -+ * -+ * Therefore, the heuristic used here is to never process inodes -+ * currently opened for write from background (i.e. non-sync) scans. For -+ * sync scans, use the pagecache/dio state of the inode to ensure we -+ * never free COW fork blocks out from under pending I/O. - */ -- if ((VFS_I(ip)->i_state & I_DIRTY_PAGES) || -- mapping_tagged(VFS_I(ip)->i_mapping, PAGECACHE_TAG_DIRTY) || -- mapping_tagged(VFS_I(ip)->i_mapping, PAGECACHE_TAG_WRITEBACK) || -- atomic_read(&VFS_I(ip)->i_dio_count)) -+ if (!sync && inode_is_open_for_write(VFS_I(ip))) - return false; -- -- return true; -+ return xfs_can_free_cowblocks(ip); - } - - /* -@@ -1291,7 +1300,7 @@ xfs_inode_free_cowblocks( - if (!xfs_iflags_test(ip, XFS_ICOWBLOCKS)) - return 0; - -- if (!xfs_prep_free_cowblocks(ip)) -+ if (!xfs_prep_free_cowblocks(ip, icw)) - return 0; - - if (!xfs_icwalk_match(ip, icw)) -@@ -1320,7 +1329,7 @@ xfs_inode_free_cowblocks( - * Check again, nobody else should be able to dirty blocks or change - * the reflink iflag now that we have the first two locks held. - */ -- if (xfs_prep_free_cowblocks(ip)) -+ if (xfs_prep_free_cowblocks(ip, icw)) - ret = xfs_reflink_cancel_cow_range(ip, 0, NULLFILEOFF, false); - return ret; - } -diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c -index b9784348ebc5c4..e1adad91dba666 100644 ---- a/fs/xfs/xfs_inode.c -+++ b/fs/xfs/xfs_inode.c -@@ -1758,7 +1758,7 @@ xfs_inactive( - - if (S_ISREG(VFS_I(ip)->i_mode) && - (ip->i_disk_size != 0 || XFS_ISIZE(ip) != 0 || -- ip->i_df.if_nextents > 0 || ip->i_delayed_blks > 0)) -+ xfs_inode_has_filedata(ip))) - truncate = 1; - - if (xfs_iflags_test(ip, XFS_IQUOTAUNCHECKED)) { -diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h -index 0f2999b84e7d96..4820c4699f7d0f 100644 ---- a/fs/xfs/xfs_inode.h -+++ b/fs/xfs/xfs_inode.h -@@ -286,6 +286,11 @@ static inline bool xfs_is_metadata_inode(struct xfs_inode *ip) - xfs_is_quota_inode(&mp->m_sb, ip->i_ino); - } - -+static inline bool xfs_inode_has_filedata(const struct xfs_inode *ip) -+{ -+ return ip->i_df.if_nextents > 0 || ip->i_delayed_blks > 0; -+} -+ - /* - * Check if an inode has any data in the COW fork. This might be often false - * even for inodes with the reflink flag when there is no pending COW operation. -diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c -index 32e718043e0e2e..d22285a7453940 100644 ---- a/fs/xfs/xfs_ioctl.c -+++ b/fs/xfs/xfs_ioctl.c -@@ -1126,7 +1126,7 @@ xfs_ioctl_setattr_xflags( - - if (rtflag != XFS_IS_REALTIME_INODE(ip)) { - /* Can't change realtime flag if any extents are allocated. */ -- if (ip->i_df.if_nextents || ip->i_delayed_blks) -+ if (xfs_inode_has_filedata(ip)) - return -EINVAL; - - /* -@@ -1247,7 +1247,7 @@ xfs_ioctl_setattr_check_extsize( - if (!fa->fsx_valid) - return 0; - -- if (S_ISREG(VFS_I(ip)->i_mode) && ip->i_df.if_nextents && -+ if (S_ISREG(VFS_I(ip)->i_mode) && xfs_inode_has_filedata(ip) && - XFS_FSB_TO_B(mp, ip->i_extsize) != fa->fsx_extsize) - return -EINVAL; - -diff --git a/fs/xfs/xfs_log.h b/fs/xfs/xfs_log.h -index 2728886c296390..8e0f52599d8db5 100644 ---- a/fs/xfs/xfs_log.h -+++ b/fs/xfs/xfs_log.h -@@ -161,6 +161,5 @@ bool xlog_force_shutdown(struct xlog *log, uint32_t shutdown_flags); - - void xlog_use_incompat_feat(struct xlog *log); - void xlog_drop_incompat_feat(struct xlog *log); --int xfs_attr_use_log_assist(struct xfs_mount *mp); - - #endif /* __XFS_LOG_H__ */ -diff --git a/fs/xfs/xfs_log_cil.c b/fs/xfs/xfs_log_cil.c -index 67a99d94701e5b..d152d0945dab1c 100644 ---- a/fs/xfs/xfs_log_cil.c -+++ b/fs/xfs/xfs_log_cil.c -@@ -156,7 +156,6 @@ xlog_cil_insert_pcp_aggregate( - struct xfs_cil *cil, - struct xfs_cil_ctx *ctx) - { -- struct xlog_cil_pcp *cilpcp; - int cpu; - int count = 0; - -@@ -171,13 +170,11 @@ xlog_cil_insert_pcp_aggregate( - * structures that could have a nonzero space_used. - */ - for_each_cpu(cpu, &ctx->cil_pcpmask) { -- int old, prev; -+ struct xlog_cil_pcp *cilpcp = per_cpu_ptr(cil->xc_pcp, cpu); -+ int old = READ_ONCE(cilpcp->space_used); - -- cilpcp = per_cpu_ptr(cil->xc_pcp, cpu); -- do { -- old = cilpcp->space_used; -- prev = cmpxchg(&cilpcp->space_used, old, 0); -- } while (old != prev); -+ while (!try_cmpxchg(&cilpcp->space_used, &old, 0)) -+ ; - count += old; - } - atomic_add(count, &ctx->space_used); -diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c -index d11de0fa5c5f80..60382eb4996105 100644 ---- a/fs/xfs/xfs_log_recover.c -+++ b/fs/xfs/xfs_log_recover.c -@@ -1820,7 +1820,7 @@ xlog_find_item_ops( - * from the transaction. However, we can't do that until after we've - * replayed all the other items because they may be dependent on the - * cancelled buffer and replaying the cancelled buffer can remove it -- * form the cancelled buffer table. Hence they have tobe done last. -+ * form the cancelled buffer table. Hence they have to be done last. - * - * 3. Inode allocation buffers must be replayed before inode items that - * read the buffer and replay changes into it. For filesystems using the -@@ -3365,13 +3365,6 @@ xlog_do_recover( - /* re-initialise in-core superblock and geometry structures */ - mp->m_features |= xfs_sb_version_to_features(sbp); - xfs_reinit_percpu_counters(mp); -- error = xfs_initialize_perag(mp, sbp->sb_agcount, sbp->sb_dblocks, -- &mp->m_maxagi); -- if (error) { -- xfs_warn(mp, "Failed post-recovery per-ag init: %d", error); -- return error; -- } -- mp->m_alloc_set_aside = xfs_alloc_set_aside(mp); - - /* Normal transactions can now occur */ - clear_bit(XLOG_ACTIVE_RECOVERY, &log->l_opstate); -diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c -index 0a0fd19573d8ce..747db90731e894 100644 ---- a/fs/xfs/xfs_mount.c -+++ b/fs/xfs/xfs_mount.c -@@ -797,8 +797,8 @@ xfs_mountfs( - /* - * Allocate and initialize the per-ag data. - */ -- error = xfs_initialize_perag(mp, sbp->sb_agcount, mp->m_sb.sb_dblocks, -- &mp->m_maxagi); -+ error = xfs_initialize_perag(mp, 0, sbp->sb_agcount, -+ mp->m_sb.sb_dblocks, &mp->m_maxagi); - if (error) { - xfs_warn(mp, "Failed per-ag init: %d", error); - goto out_free_dir; -diff --git a/fs/xfs/xfs_qm_bhv.c b/fs/xfs/xfs_qm_bhv.c -index b77673dd05581e..26b2c449f3c665 100644 ---- a/fs/xfs/xfs_qm_bhv.c -+++ b/fs/xfs/xfs_qm_bhv.c -@@ -19,28 +19,41 @@ - STATIC void - xfs_fill_statvfs_from_dquot( - struct kstatfs *statp, -+ struct xfs_inode *ip, - struct xfs_dquot *dqp) - { -+ struct xfs_dquot_res *blkres = &dqp->q_blk; - uint64_t limit; - -- limit = dqp->q_blk.softlimit ? -- dqp->q_blk.softlimit : -- dqp->q_blk.hardlimit; -- if (limit && statp->f_blocks > limit) { -- statp->f_blocks = limit; -- statp->f_bfree = statp->f_bavail = -- (statp->f_blocks > dqp->q_blk.reserved) ? -- (statp->f_blocks - dqp->q_blk.reserved) : 0; -+ if (XFS_IS_REALTIME_MOUNT(ip->i_mount) && -+ (ip->i_diflags & (XFS_DIFLAG_RTINHERIT | XFS_DIFLAG_REALTIME))) -+ blkres = &dqp->q_rtb; -+ -+ limit = blkres->softlimit ? -+ blkres->softlimit : -+ blkres->hardlimit; -+ if (limit) { -+ uint64_t remaining = 0; -+ -+ if (limit > blkres->reserved) -+ remaining = limit - blkres->reserved; -+ -+ statp->f_blocks = min(statp->f_blocks, limit); -+ statp->f_bfree = min(statp->f_bfree, remaining); -+ statp->f_bavail = min(statp->f_bavail, remaining); - } - - limit = dqp->q_ino.softlimit ? - dqp->q_ino.softlimit : - dqp->q_ino.hardlimit; -- if (limit && statp->f_files > limit) { -- statp->f_files = limit; -- statp->f_ffree = -- (statp->f_files > dqp->q_ino.reserved) ? -- (statp->f_files - dqp->q_ino.reserved) : 0; -+ if (limit) { -+ uint64_t remaining = 0; -+ -+ if (limit > dqp->q_ino.reserved) -+ remaining = limit - dqp->q_ino.reserved; -+ -+ statp->f_files = min(statp->f_files, limit); -+ statp->f_ffree = min(statp->f_ffree, remaining); - } - } - -@@ -61,7 +74,7 @@ xfs_qm_statvfs( - struct xfs_dquot *dqp; - - if (!xfs_qm_dqget(mp, ip->i_projid, XFS_DQTYPE_PROJ, false, &dqp)) { -- xfs_fill_statvfs_from_dquot(statp, dqp); -+ xfs_fill_statvfs_from_dquot(statp, ip, dqp); - xfs_qm_dqput(dqp); - } - } -diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c -index 3431d0d8b6f3a1..4058cf361d2153 100644 ---- a/fs/xfs/xfs_reflink.c -+++ b/fs/xfs/xfs_reflink.c -@@ -1600,6 +1600,9 @@ xfs_reflink_clear_inode_flag( - - ASSERT(xfs_is_reflink_inode(ip)); - -+ if (!xfs_can_free_cowblocks(ip)) -+ return 0; -+ - error = xfs_reflink_inode_has_shared_extents(*tpp, ip, &needs_flag); - if (error || needs_flag) - return error; -diff --git a/fs/xfs/xfs_reflink.h b/fs/xfs/xfs_reflink.h -index 65c5dfe17ecf7f..67a335b247b157 100644 ---- a/fs/xfs/xfs_reflink.h -+++ b/fs/xfs/xfs_reflink.h -@@ -16,6 +16,25 @@ static inline bool xfs_is_cow_inode(struct xfs_inode *ip) - return xfs_is_reflink_inode(ip) || xfs_is_always_cow_inode(ip); - } - -+/* -+ * Check whether it is safe to free COW fork blocks from an inode. It is unsafe -+ * to do so when an inode has dirty cache or I/O in-flight, even if no shared -+ * extents exist in the data fork, because outstanding I/O may target blocks -+ * that were speculatively allocated to the COW fork. -+ */ -+static inline bool -+xfs_can_free_cowblocks(struct xfs_inode *ip) -+{ -+ struct inode *inode = VFS_I(ip); -+ -+ if ((inode->i_state & I_DIRTY_PAGES) || -+ mapping_tagged(inode->i_mapping, PAGECACHE_TAG_DIRTY) || -+ mapping_tagged(inode->i_mapping, PAGECACHE_TAG_WRITEBACK) || -+ atomic_read(&inode->i_dio_count)) -+ return false; -+ return true; -+} -+ - extern int xfs_reflink_trim_around_shared(struct xfs_inode *ip, - struct xfs_bmbt_irec *irec, bool *shared); - int xfs_bmap_trim_cow(struct xfs_inode *ip, struct xfs_bmbt_irec *imap, -diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c -index 13007b6bc9f337..a726fbba49e40a 100644 ---- a/fs/xfs/xfs_super.c -+++ b/fs/xfs/xfs_super.c -@@ -878,12 +878,6 @@ xfs_fs_statfs( - ffree = statp->f_files - (icount - ifree); - statp->f_ffree = max_t(int64_t, ffree, 0); - -- -- if ((ip->i_diflags & XFS_DIFLAG_PROJINHERIT) && -- ((mp->m_qflags & (XFS_PQUOTA_ACCT|XFS_PQUOTA_ENFD))) == -- (XFS_PQUOTA_ACCT|XFS_PQUOTA_ENFD)) -- xfs_qm_statvfs(ip, statp); -- - if (XFS_IS_REALTIME_MOUNT(mp) && - (ip->i_diflags & (XFS_DIFLAG_RTINHERIT | XFS_DIFLAG_REALTIME))) { - s64 freertx; -@@ -893,6 +887,11 @@ xfs_fs_statfs( - statp->f_bavail = statp->f_bfree = freertx * sbp->sb_rextsize; - } - -+ if ((ip->i_diflags & XFS_DIFLAG_PROJINHERIT) && -+ ((mp->m_qflags & (XFS_PQUOTA_ACCT|XFS_PQUOTA_ENFD))) == -+ (XFS_PQUOTA_ACCT|XFS_PQUOTA_ENFD)) -+ xfs_qm_statvfs(ip, statp); -+ - return 0; - } - -diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index 95ee88dfe0b9c6..337a9d1c558f3c 100644 ---- a/include/linux/netdevice.h -+++ b/include/linux/netdevice.h -@@ -3072,6 +3072,8 @@ static inline struct net_device *first_net_device_rcu(struct net *net) - } - - int netdev_boot_setup_check(struct net_device *dev); -+struct net_device *dev_getbyhwaddr(struct net *net, unsigned short type, -+ const char *hwaddr); - struct net_device *dev_getbyhwaddr_rcu(struct net *net, unsigned short type, - const char *hwaddr); - struct net_device *dev_getfirstbyhwtype(struct net *net, unsigned short type); -diff --git a/include/linux/nvmem-provider.h b/include/linux/nvmem-provider.h -index 1b81adebdb8beb..9a015e4d428ccb 100644 ---- a/include/linux/nvmem-provider.h -+++ b/include/linux/nvmem-provider.h -@@ -83,6 +83,8 @@ struct nvmem_cell_info { - * @cells: Optional array of pre-defined NVMEM cells. - * @ncells: Number of elements in cells. - * @add_legacy_fixed_of_cells: Read fixed NVMEM cells from old OF syntax. -+ * @fixup_dt_cell_info: Will be called before a cell is added. Can be -+ * used to modify the nvmem_cell_info. - * @keepout: Optional array of keepout ranges (sorted ascending by start). - * @nkeepout: Number of elements in the keepout array. - * @type: Type of the nvmem storage -@@ -114,6 +116,8 @@ struct nvmem_config { - const struct nvmem_cell_info *cells; - int ncells; - bool add_legacy_fixed_of_cells; -+ void (*fixup_dt_cell_info)(struct nvmem_device *nvmem, -+ struct nvmem_cell_info *cell); - const struct nvmem_keepout *keepout; - unsigned int nkeepout; - enum nvmem_type type; -@@ -158,11 +162,8 @@ struct nvmem_cell_table { - * - * @name: Layout name. - * @of_match_table: Open firmware match table. -- * @add_cells: Will be called if a nvmem device is found which -- * has this layout. The function will add layout -- * specific cells with nvmem_add_one_cell(). -- * @fixup_cell_info: Will be called before a cell is added. Can be -- * used to modify the nvmem_cell_info. -+ * @add_cells: Called to populate the layout using -+ * nvmem_add_one_cell(). - * @owner: Pointer to struct module. - * @node: List node. - * -@@ -174,11 +175,7 @@ struct nvmem_cell_table { - struct nvmem_layout { - const char *name; - const struct of_device_id *of_match_table; -- int (*add_cells)(struct device *dev, struct nvmem_device *nvmem, -- struct nvmem_layout *layout); -- void (*fixup_cell_info)(struct nvmem_device *nvmem, -- struct nvmem_layout *layout, -- struct nvmem_cell_info *cell); -+ int (*add_cells)(struct device *dev, struct nvmem_device *nvmem); - - /* private */ - struct module *owner; -diff --git a/include/linux/serio.h b/include/linux/serio.h -index 6c27d413da921d..e105ff2ee651a6 100644 ---- a/include/linux/serio.h -+++ b/include/linux/serio.h -@@ -6,6 +6,7 @@ - #define _SERIO_H - - -+#include - #include - #include - #include -@@ -161,4 +162,6 @@ static inline void serio_continue_rx(struct serio *serio) - spin_unlock_irq(&serio->lock); - } - -+DEFINE_GUARD(serio_pause_rx, struct serio *, serio_pause_rx(_T), serio_continue_rx(_T)) -+ - #endif -diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h -index 6ccfd9236387c6..32bbebf5b71e3c 100644 ---- a/include/linux/skmsg.h -+++ b/include/linux/skmsg.h -@@ -87,6 +87,8 @@ struct sk_psock { - struct sk_psock_progs progs; - #if IS_ENABLED(CONFIG_BPF_STREAM_PARSER) - struct strparser strp; -+ u32 copied_seq; -+ u32 ingress_bytes; - #endif - struct sk_buff_head ingress_skb; - struct list_head ingress_msg; -diff --git a/include/net/strparser.h b/include/net/strparser.h -index 41e2ce9e9e10ff..0a83010b3a64a9 100644 ---- a/include/net/strparser.h -+++ b/include/net/strparser.h -@@ -43,6 +43,8 @@ struct strparser; - struct strp_callbacks { - int (*parse_msg)(struct strparser *strp, struct sk_buff *skb); - void (*rcv_msg)(struct strparser *strp, struct sk_buff *skb); -+ int (*read_sock)(struct strparser *strp, read_descriptor_t *desc, -+ sk_read_actor_t recv_actor); - int (*read_sock_done)(struct strparser *strp, int err); - void (*abort_parser)(struct strparser *strp, int err); - void (*lock)(struct strparser *strp); -diff --git a/include/net/tcp.h b/include/net/tcp.h -index b3917af309e0f1..a6def0aab3ed31 100644 ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -40,6 +40,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -630,6 +631,19 @@ void tcp_fin(struct sock *sk); - void tcp_check_space(struct sock *sk); - void tcp_sack_compress_send_ack(struct sock *sk); - -+static inline void tcp_cleanup_skb(struct sk_buff *skb) -+{ -+ skb_dst_drop(skb); -+ secpath_reset(skb); -+} -+ -+static inline void tcp_add_receive_queue(struct sock *sk, struct sk_buff *skb) -+{ -+ DEBUG_NET_WARN_ON_ONCE(skb_dst(skb)); -+ DEBUG_NET_WARN_ON_ONCE(secpath_exists(skb)); -+ __skb_queue_tail(&sk->sk_receive_queue, skb); -+} -+ - /* tcp_timer.c */ - void tcp_init_xmit_timers(struct sock *); - static inline void tcp_clear_xmit_timers(struct sock *sk) -@@ -676,6 +690,9 @@ void tcp_get_info(struct sock *, struct tcp_info *); - /* Read 'sendfile()'-style from a TCP socket */ - int tcp_read_sock(struct sock *sk, read_descriptor_t *desc, - sk_read_actor_t recv_actor); -+int tcp_read_sock_noack(struct sock *sk, read_descriptor_t *desc, -+ sk_read_actor_t recv_actor, bool noack, -+ u32 *copied_seq); - int tcp_read_skb(struct sock *sk, skb_read_actor_t recv_actor); - struct sk_buff *tcp_recv_skb(struct sock *sk, u32 seq, u32 *off); - void tcp_read_done(struct sock *sk, size_t len); -@@ -2390,6 +2407,11 @@ struct sk_psock; - #ifdef CONFIG_BPF_SYSCALL - int tcp_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool restore); - void tcp_bpf_clone(const struct sock *sk, struct sock *newsk); -+#ifdef CONFIG_BPF_STREAM_PARSER -+struct strparser; -+int tcp_bpf_strp_read_sock(struct strparser *strp, read_descriptor_t *desc, -+ sk_read_actor_t recv_actor); -+#endif /* CONFIG_BPF_STREAM_PARSER */ - #endif /* CONFIG_BPF_SYSCALL */ - - #ifdef CONFIG_INET -diff --git a/include/trace/events/oom.h b/include/trace/events/oom.h -index 26a11e4a2c361d..b799f3bcba8233 100644 ---- a/include/trace/events/oom.h -+++ b/include/trace/events/oom.h -@@ -7,6 +7,8 @@ - #include - #include - -+#define PG_COUNT_TO_KB(x) ((x) << (PAGE_SHIFT - 10)) -+ - TRACE_EVENT(oom_score_adj_update, - - TP_PROTO(struct task_struct *task), -@@ -72,19 +74,45 @@ TRACE_EVENT(reclaim_retry_zone, - ); - - TRACE_EVENT(mark_victim, -- TP_PROTO(int pid), -+ TP_PROTO(struct task_struct *task, uid_t uid), - -- TP_ARGS(pid), -+ TP_ARGS(task, uid), - - TP_STRUCT__entry( - __field(int, pid) -+ __string(comm, task->comm) -+ __field(unsigned long, total_vm) -+ __field(unsigned long, anon_rss) -+ __field(unsigned long, file_rss) -+ __field(unsigned long, shmem_rss) -+ __field(uid_t, uid) -+ __field(unsigned long, pgtables) -+ __field(short, oom_score_adj) - ), - - TP_fast_assign( -- __entry->pid = pid; -+ __entry->pid = task->pid; -+ __assign_str(comm, task->comm); -+ __entry->total_vm = PG_COUNT_TO_KB(task->mm->total_vm); -+ __entry->anon_rss = PG_COUNT_TO_KB(get_mm_counter(task->mm, MM_ANONPAGES)); -+ __entry->file_rss = PG_COUNT_TO_KB(get_mm_counter(task->mm, MM_FILEPAGES)); -+ __entry->shmem_rss = PG_COUNT_TO_KB(get_mm_counter(task->mm, MM_SHMEMPAGES)); -+ __entry->uid = uid; -+ __entry->pgtables = mm_pgtables_bytes(task->mm) >> 10; -+ __entry->oom_score_adj = task->signal->oom_score_adj; - ), - -- TP_printk("pid=%d", __entry->pid) -+ TP_printk("pid=%d comm=%s total-vm=%lukB anon-rss=%lukB file-rss:%lukB shmem-rss:%lukB uid=%u pgtables=%lukB oom_score_adj=%hd", -+ __entry->pid, -+ __get_str(comm), -+ __entry->total_vm, -+ __entry->anon_rss, -+ __entry->file_rss, -+ __entry->shmem_rss, -+ __entry->uid, -+ __entry->pgtables, -+ __entry->oom_score_adj -+ ) - ); - - TRACE_EVENT(wake_reaper, -diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c -index b61637dad442a7..5776440f584c76 100644 ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -2176,6 +2176,8 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, - req->opcode = 0; - return io_init_fail_req(req, -EINVAL); - } -+ opcode = array_index_nospec(opcode, IORING_OP_LAST); -+ - def = &io_issue_defs[opcode]; - if (unlikely(sqe_flags & ~SQE_COMMON_FLAGS)) { - /* enforce forwards compatibility on users */ -diff --git a/kernel/acct.c b/kernel/acct.c -index 1a9f929fe629e7..a58a284f1f38de 100644 ---- a/kernel/acct.c -+++ b/kernel/acct.c -@@ -104,48 +104,50 @@ struct bsd_acct_struct { - atomic_long_t count; - struct rcu_head rcu; - struct mutex lock; -- int active; -+ bool active; -+ bool check_space; - unsigned long needcheck; - struct file *file; - struct pid_namespace *ns; - struct work_struct work; - struct completion done; -+ acct_t ac; - }; - --static void do_acct_process(struct bsd_acct_struct *acct); -+static void fill_ac(struct bsd_acct_struct *acct); -+static void acct_write_process(struct bsd_acct_struct *acct); - - /* - * Check the amount of free space and suspend/resume accordingly. - */ --static int check_free_space(struct bsd_acct_struct *acct) -+static bool check_free_space(struct bsd_acct_struct *acct) - { - struct kstatfs sbuf; - -- if (time_is_after_jiffies(acct->needcheck)) -- goto out; -+ if (!acct->check_space) -+ return acct->active; - - /* May block */ - if (vfs_statfs(&acct->file->f_path, &sbuf)) -- goto out; -+ return acct->active; - - if (acct->active) { - u64 suspend = sbuf.f_blocks * SUSPEND; - do_div(suspend, 100); - if (sbuf.f_bavail <= suspend) { -- acct->active = 0; -+ acct->active = false; - pr_info("Process accounting paused\n"); - } - } else { - u64 resume = sbuf.f_blocks * RESUME; - do_div(resume, 100); - if (sbuf.f_bavail >= resume) { -- acct->active = 1; -+ acct->active = true; - pr_info("Process accounting resumed\n"); - } - } - - acct->needcheck = jiffies + ACCT_TIMEOUT*HZ; --out: - return acct->active; - } - -@@ -190,7 +192,11 @@ static void acct_pin_kill(struct fs_pin *pin) - { - struct bsd_acct_struct *acct = to_acct(pin); - mutex_lock(&acct->lock); -- do_acct_process(acct); -+ /* -+ * Fill the accounting struct with the exiting task's info -+ * before punting to the workqueue. -+ */ -+ fill_ac(acct); - schedule_work(&acct->work); - wait_for_completion(&acct->done); - cmpxchg(&acct->ns->bacct, pin, NULL); -@@ -203,6 +209,9 @@ static void close_work(struct work_struct *work) - { - struct bsd_acct_struct *acct = container_of(work, struct bsd_acct_struct, work); - struct file *file = acct->file; -+ -+ /* We were fired by acct_pin_kill() which holds acct->lock. */ -+ acct_write_process(acct); - if (file->f_op->flush) - file->f_op->flush(file, NULL); - __fput_sync(file); -@@ -235,6 +244,20 @@ static int acct_on(struct filename *pathname) - return -EACCES; - } - -+ /* Exclude kernel kernel internal filesystems. */ -+ if (file_inode(file)->i_sb->s_flags & (SB_NOUSER | SB_KERNMOUNT)) { -+ kfree(acct); -+ filp_close(file, NULL); -+ return -EINVAL; -+ } -+ -+ /* Exclude procfs and sysfs. */ -+ if (file_inode(file)->i_sb->s_iflags & SB_I_USERNS_VISIBLE) { -+ kfree(acct); -+ filp_close(file, NULL); -+ return -EINVAL; -+ } -+ - if (!(file->f_mode & FMODE_CAN_WRITE)) { - kfree(acct); - filp_close(file, NULL); -@@ -431,13 +454,27 @@ static u32 encode_float(u64 value) - * do_exit() or when switching to a different output file. - */ - --static void fill_ac(acct_t *ac) -+static void fill_ac(struct bsd_acct_struct *acct) - { - struct pacct_struct *pacct = ¤t->signal->pacct; -+ struct file *file = acct->file; -+ acct_t *ac = &acct->ac; - u64 elapsed, run_time; - time64_t btime; - struct tty_struct *tty; - -+ lockdep_assert_held(&acct->lock); -+ -+ if (time_is_after_jiffies(acct->needcheck)) { -+ acct->check_space = false; -+ -+ /* Don't fill in @ac if nothing will be written. */ -+ if (!acct->active) -+ return; -+ } else { -+ acct->check_space = true; -+ } -+ - /* - * Fill the accounting struct with the needed info as recorded - * by the different kernel functions. -@@ -485,64 +522,61 @@ static void fill_ac(acct_t *ac) - ac->ac_majflt = encode_comp_t(pacct->ac_majflt); - ac->ac_exitcode = pacct->ac_exitcode; - spin_unlock_irq(¤t->sighand->siglock); --} --/* -- * do_acct_process does all actual work. Caller holds the reference to file. -- */ --static void do_acct_process(struct bsd_acct_struct *acct) --{ -- acct_t ac; -- unsigned long flim; -- const struct cred *orig_cred; -- struct file *file = acct->file; - -- /* -- * Accounting records are not subject to resource limits. -- */ -- flim = rlimit(RLIMIT_FSIZE); -- current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY; -- /* Perform file operations on behalf of whoever enabled accounting */ -- orig_cred = override_creds(file->f_cred); -- -- /* -- * First check to see if there is enough free_space to continue -- * the process accounting system. -- */ -- if (!check_free_space(acct)) -- goto out; -- -- fill_ac(&ac); - /* we really need to bite the bullet and change layout */ -- ac.ac_uid = from_kuid_munged(file->f_cred->user_ns, orig_cred->uid); -- ac.ac_gid = from_kgid_munged(file->f_cred->user_ns, orig_cred->gid); -+ ac->ac_uid = from_kuid_munged(file->f_cred->user_ns, current_uid()); -+ ac->ac_gid = from_kgid_munged(file->f_cred->user_ns, current_gid()); - #if ACCT_VERSION == 1 || ACCT_VERSION == 2 - /* backward-compatible 16 bit fields */ -- ac.ac_uid16 = ac.ac_uid; -- ac.ac_gid16 = ac.ac_gid; -+ ac->ac_uid16 = ac->ac_uid; -+ ac->ac_gid16 = ac->ac_gid; - #elif ACCT_VERSION == 3 - { - struct pid_namespace *ns = acct->ns; - -- ac.ac_pid = task_tgid_nr_ns(current, ns); -+ ac->ac_pid = task_tgid_nr_ns(current, ns); - rcu_read_lock(); -- ac.ac_ppid = task_tgid_nr_ns(rcu_dereference(current->real_parent), -- ns); -+ ac->ac_ppid = task_tgid_nr_ns(rcu_dereference(current->real_parent), ns); - rcu_read_unlock(); - } - #endif -+} -+ -+static void acct_write_process(struct bsd_acct_struct *acct) -+{ -+ struct file *file = acct->file; -+ const struct cred *cred; -+ acct_t *ac = &acct->ac; -+ -+ /* Perform file operations on behalf of whoever enabled accounting */ -+ cred = override_creds(file->f_cred); -+ - /* -- * Get freeze protection. If the fs is frozen, just skip the write -- * as we could deadlock the system otherwise. -+ * First check to see if there is enough free_space to continue -+ * the process accounting system. Then get freeze protection. If -+ * the fs is frozen, just skip the write as we could deadlock -+ * the system otherwise. - */ -- if (file_start_write_trylock(file)) { -+ if (check_free_space(acct) && file_start_write_trylock(file)) { - /* it's been opened O_APPEND, so position is irrelevant */ - loff_t pos = 0; -- __kernel_write(file, &ac, sizeof(acct_t), &pos); -+ __kernel_write(file, ac, sizeof(acct_t), &pos); - file_end_write(file); - } --out: -+ -+ revert_creds(cred); -+} -+ -+static void do_acct_process(struct bsd_acct_struct *acct) -+{ -+ unsigned long flim; -+ -+ /* Accounting records are not subject to resource limits. */ -+ flim = rlimit(RLIMIT_FSIZE); -+ current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY; -+ fill_ac(acct); -+ acct_write_process(acct); - current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim; -- revert_creds(orig_cred); - } - - /** -diff --git a/kernel/bpf/bpf_cgrp_storage.c b/kernel/bpf/bpf_cgrp_storage.c -index d44fe8dd973295..ee1c7b77096e7b 100644 ---- a/kernel/bpf/bpf_cgrp_storage.c -+++ b/kernel/bpf/bpf_cgrp_storage.c -@@ -154,7 +154,7 @@ static struct bpf_map *cgroup_storage_map_alloc(union bpf_attr *attr) - - static void cgroup_storage_map_free(struct bpf_map *map) - { -- bpf_local_storage_map_free(map, &cgroup_cache, NULL); -+ bpf_local_storage_map_free(map, &cgroup_cache, &bpf_cgrp_storage_busy); - } - - /* *gfp_flags* is a hidden argument provided by the verifier */ -diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c -index 246559c3e93d0d..528f4d6342262e 100644 ---- a/kernel/bpf/ringbuf.c -+++ b/kernel/bpf/ringbuf.c -@@ -268,8 +268,6 @@ static int ringbuf_map_mmap_kern(struct bpf_map *map, struct vm_area_struct *vma - /* allow writable mapping for the consumer_pos only */ - if (vma->vm_pgoff != 0 || vma->vm_end - vma->vm_start != PAGE_SIZE) - return -EPERM; -- } else { -- vm_flags_clear(vma, VM_MAYWRITE); - } - /* remap_vmalloc_range() checks size and offset constraints */ - return remap_vmalloc_range(vma, rb_map->rb, -@@ -289,8 +287,6 @@ static int ringbuf_map_mmap_user(struct bpf_map *map, struct vm_area_struct *vma - * position, and the ring buffer data itself. - */ - return -EPERM; -- } else { -- vm_flags_clear(vma, VM_MAYWRITE); - } - /* remap_vmalloc_range() checks size and offset constraints */ - return remap_vmalloc_range(vma, rb_map->rb, vma->vm_pgoff + RINGBUF_PGOFF); -diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c -index ba38c08a9a059a..f089a616301119 100644 ---- a/kernel/bpf/syscall.c -+++ b/kernel/bpf/syscall.c -@@ -882,7 +882,7 @@ static const struct vm_operations_struct bpf_map_default_vmops = { - static int bpf_map_mmap(struct file *filp, struct vm_area_struct *vma) - { - struct bpf_map *map = filp->private_data; -- int err; -+ int err = 0; - - if (!map->ops->map_mmap || !IS_ERR_OR_NULL(map->record)) - return -ENOTSUPP; -@@ -906,24 +906,33 @@ static int bpf_map_mmap(struct file *filp, struct vm_area_struct *vma) - err = -EACCES; - goto out; - } -+ bpf_map_write_active_inc(map); - } -+out: -+ mutex_unlock(&map->freeze_mutex); -+ if (err) -+ return err; - - /* set default open/close callbacks */ - vma->vm_ops = &bpf_map_default_vmops; - vma->vm_private_data = map; - vm_flags_clear(vma, VM_MAYEXEC); -+ /* If mapping is read-only, then disallow potentially re-mapping with -+ * PROT_WRITE by dropping VM_MAYWRITE flag. This VM_MAYWRITE clearing -+ * means that as far as BPF map's memory-mapped VMAs are concerned, -+ * VM_WRITE and VM_MAYWRITE and equivalent, if one of them is set, -+ * both should be set, so we can forget about VM_MAYWRITE and always -+ * check just VM_WRITE -+ */ - if (!(vma->vm_flags & VM_WRITE)) -- /* disallow re-mapping with PROT_WRITE */ - vm_flags_clear(vma, VM_MAYWRITE); - - err = map->ops->map_mmap(map, vma); -- if (err) -- goto out; -+ if (err) { -+ if (vma->vm_flags & VM_WRITE) -+ bpf_map_write_active_dec(map); -+ } - -- if (vma->vm_flags & VM_MAYWRITE) -- bpf_map_write_active_inc(map); --out: -- mutex_unlock(&map->freeze_mutex); - return err; - } - -@@ -1798,8 +1807,6 @@ int generic_map_update_batch(struct bpf_map *map, struct file *map_file, - return err; - } - --#define MAP_LOOKUP_RETRIES 3 -- - int generic_map_lookup_batch(struct bpf_map *map, - const union bpf_attr *attr, - union bpf_attr __user *uattr) -@@ -1809,8 +1816,8 @@ int generic_map_lookup_batch(struct bpf_map *map, - void __user *values = u64_to_user_ptr(attr->batch.values); - void __user *keys = u64_to_user_ptr(attr->batch.keys); - void *buf, *buf_prevkey, *prev_key, *key, *value; -- int err, retry = MAP_LOOKUP_RETRIES; - u32 value_size, cp, max_count; -+ int err; - - if (attr->batch.elem_flags & ~BPF_F_LOCK) - return -EINVAL; -@@ -1856,14 +1863,8 @@ int generic_map_lookup_batch(struct bpf_map *map, - err = bpf_map_copy_value(map, key, value, - attr->batch.elem_flags); - -- if (err == -ENOENT) { -- if (retry) { -- retry--; -- continue; -- } -- err = -EINTR; -- break; -- } -+ if (err == -ENOENT) -+ goto next_key; - - if (err) - goto free_buf; -@@ -1878,12 +1879,12 @@ int generic_map_lookup_batch(struct bpf_map *map, - goto free_buf; - } - -+ cp++; -+next_key: - if (!prev_key) - prev_key = buf_prevkey; - - swap(prev_key, key); -- retry = MAP_LOOKUP_RETRIES; -- cp++; - cond_resched(); - } - -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 1043936b352d12..6e6b2a5aa1402b 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -5233,6 +5233,9 @@ __ftrace_match_addr(struct ftrace_hash *hash, unsigned long ip, int remove) - return -ENOENT; - free_hash_entry(hash, entry); - return 0; -+ } else if (__ftrace_lookup_ip(hash, ip) != NULL) { -+ /* Already exists */ -+ return 0; - } - - entry = add_hash_entry(hash, ip); -diff --git a/kernel/trace/trace_functions.c b/kernel/trace/trace_functions.c -index 9f1bfbe105e8d9..69e92c7359fb9a 100644 ---- a/kernel/trace/trace_functions.c -+++ b/kernel/trace/trace_functions.c -@@ -185,7 +185,7 @@ function_trace_call(unsigned long ip, unsigned long parent_ip, - if (bit < 0) - return; - -- trace_ctx = tracing_gen_ctx(); -+ trace_ctx = tracing_gen_ctx_dec(); - - cpu = smp_processor_id(); - data = per_cpu_ptr(tr->array_buffer.data, cpu); -@@ -285,7 +285,6 @@ function_no_repeats_trace_call(unsigned long ip, unsigned long parent_ip, - struct trace_array *tr = op->private; - struct trace_array_cpu *data; - unsigned int trace_ctx; -- unsigned long flags; - int bit; - int cpu; - -@@ -312,8 +311,7 @@ function_no_repeats_trace_call(unsigned long ip, unsigned long parent_ip, - if (is_repeat_check(tr, last_info, ip, parent_ip)) - goto out; - -- local_save_flags(flags); -- trace_ctx = tracing_gen_ctx_flags(flags); -+ trace_ctx = tracing_gen_ctx_dec(); - process_repeats(tr, ip, parent_ip, last_info, trace_ctx); - - trace_function(tr, ip, parent_ip, trace_ctx); -diff --git a/lib/iov_iter.c b/lib/iov_iter.c -index a4bb47efafe37d..d6620eaa951539 100644 ---- a/lib/iov_iter.c -+++ b/lib/iov_iter.c -@@ -1441,6 +1441,8 @@ static ssize_t __import_iovec_ubuf(int type, const struct iovec __user *uvec, - struct iovec *iov = *iovp; - ssize_t ret; - -+ *iovp = NULL; -+ - if (compat) - ret = copy_compat_iovec_from_user(iov, uvec, 1); - else -@@ -1451,7 +1453,6 @@ static ssize_t __import_iovec_ubuf(int type, const struct iovec __user *uvec, - ret = import_ubuf(type, iov->iov_base, iov->iov_len, i); - if (unlikely(ret)) - return ret; -- *iovp = NULL; - return i->count; - } - -diff --git a/mm/madvise.c b/mm/madvise.c -index 98fdb9288a68a8..9d2a6cb655ff20 100644 ---- a/mm/madvise.c -+++ b/mm/madvise.c -@@ -899,7 +899,16 @@ static long madvise_dontneed_free(struct vm_area_struct *vma, - */ - end = vma->vm_end; - } -- VM_WARN_ON(start >= end); -+ /* -+ * If the memory region between start and end was -+ * originally backed by 4kB pages and then remapped to -+ * be backed by hugepages while mmap_lock was dropped, -+ * the adjustment for hugetlb vma above may have rounded -+ * end down to the start address. -+ */ -+ if (start == end) -+ return 0; -+ VM_WARN_ON(start > end); - } - - if (behavior == MADV_DONTNEED || behavior == MADV_DONTNEED_LOCKED) -diff --git a/mm/memcontrol.c b/mm/memcontrol.c -index d2ceadd11b1004..9bf5a69e20d87a 100644 ---- a/mm/memcontrol.c -+++ b/mm/memcontrol.c -@@ -1266,6 +1266,7 @@ void mem_cgroup_scan_tasks(struct mem_cgroup *memcg, - { - struct mem_cgroup *iter; - int ret = 0; -+ int i = 0; - - BUG_ON(mem_cgroup_is_root(memcg)); - -@@ -1274,8 +1275,12 @@ void mem_cgroup_scan_tasks(struct mem_cgroup *memcg, - struct task_struct *task; - - css_task_iter_start(&iter->css, CSS_TASK_ITER_PROCS, &it); -- while (!ret && (task = css_task_iter_next(&it))) -+ while (!ret && (task = css_task_iter_next(&it))) { -+ /* Avoid potential softlockup warning */ -+ if ((++i & 1023) == 0) -+ cond_resched(); - ret = fn(task, arg); -+ } - css_task_iter_end(&it); - if (ret) { - mem_cgroup_iter_break(memcg, iter); -diff --git a/mm/oom_kill.c b/mm/oom_kill.c -index 44bde56ecd025a..17a2ef9f93d3d3 100644 ---- a/mm/oom_kill.c -+++ b/mm/oom_kill.c -@@ -44,6 +44,8 @@ - #include - #include - #include -+#include -+#include - - #include - #include "internal.h" -@@ -429,10 +431,15 @@ static void dump_tasks(struct oom_control *oc) - mem_cgroup_scan_tasks(oc->memcg, dump_task, oc); - else { - struct task_struct *p; -+ int i = 0; - - rcu_read_lock(); -- for_each_process(p) -+ for_each_process(p) { -+ /* Avoid potential softlockup warning */ -+ if ((++i & 1023) == 0) -+ touch_softlockup_watchdog(); - dump_task(p, oc); -+ } - rcu_read_unlock(); - } - } -@@ -755,6 +762,7 @@ static inline void queue_oom_reaper(struct task_struct *tsk) - */ - static void mark_oom_victim(struct task_struct *tsk) - { -+ const struct cred *cred; - struct mm_struct *mm = tsk->mm; - - WARN_ON(oom_killer_disabled); -@@ -774,7 +782,9 @@ static void mark_oom_victim(struct task_struct *tsk) - */ - __thaw_task(tsk); - atomic_inc(&oom_victims); -- trace_mark_victim(tsk->pid); -+ cred = get_task_cred(tsk); -+ trace_mark_victim(tsk, cred->uid.val); -+ put_cred(cred); - } - - /** -diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c -index 905de361f8623f..73fb9db55798c8 100644 ---- a/net/bpf/test_run.c -+++ b/net/bpf/test_run.c -@@ -630,12 +630,9 @@ static void *bpf_test_init(const union bpf_attr *kattr, u32 user_size, - void __user *data_in = u64_to_user_ptr(kattr->test.data_in); - void *data; - -- if (size < ETH_HLEN || size > PAGE_SIZE - headroom - tailroom) -+ if (user_size < ETH_HLEN || user_size > PAGE_SIZE - headroom - tailroom) - return ERR_PTR(-EINVAL); - -- if (user_size > size) -- return ERR_PTR(-EMSGSIZE); -- - size = SKB_DATA_ALIGN(size); - data = kzalloc(size + headroom + tailroom, GFP_USER); - if (!data) -diff --git a/net/core/dev.c b/net/core/dev.c -index 479a3892f98c3c..8c30cdcf05d4bd 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -954,6 +954,12 @@ int netdev_get_name(struct net *net, char *name, int ifindex) - return ret; - } - -+static bool dev_addr_cmp(struct net_device *dev, unsigned short type, -+ const char *ha) -+{ -+ return dev->type == type && !memcmp(dev->dev_addr, ha, dev->addr_len); -+} -+ - /** - * dev_getbyhwaddr_rcu - find a device by its hardware address - * @net: the applicable net namespace -@@ -962,7 +968,7 @@ int netdev_get_name(struct net *net, char *name, int ifindex) - * - * Search for an interface by MAC address. Returns NULL if the device - * is not found or a pointer to the device. -- * The caller must hold RCU or RTNL. -+ * The caller must hold RCU. - * The returned device has not had its ref count increased - * and the caller must therefore be careful about locking - * -@@ -974,14 +980,39 @@ struct net_device *dev_getbyhwaddr_rcu(struct net *net, unsigned short type, - struct net_device *dev; - - for_each_netdev_rcu(net, dev) -- if (dev->type == type && -- !memcmp(dev->dev_addr, ha, dev->addr_len)) -+ if (dev_addr_cmp(dev, type, ha)) - return dev; - - return NULL; - } - EXPORT_SYMBOL(dev_getbyhwaddr_rcu); - -+/** -+ * dev_getbyhwaddr() - find a device by its hardware address -+ * @net: the applicable net namespace -+ * @type: media type of device -+ * @ha: hardware address -+ * -+ * Similar to dev_getbyhwaddr_rcu(), but the owner needs to hold -+ * rtnl_lock. -+ * -+ * Context: rtnl_lock() must be held. -+ * Return: pointer to the net_device, or NULL if not found -+ */ -+struct net_device *dev_getbyhwaddr(struct net *net, unsigned short type, -+ const char *ha) -+{ -+ struct net_device *dev; -+ -+ ASSERT_RTNL(); -+ for_each_netdev(net, dev) -+ if (dev_addr_cmp(dev, type, ha)) -+ return dev; -+ -+ return NULL; -+} -+EXPORT_SYMBOL(dev_getbyhwaddr); -+ - struct net_device *dev_getfirstbyhwtype(struct net *net, unsigned short type) - { - struct net_device *dev, *ret = NULL; -diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c -index 58843a52bad0e7..fccda85ce8fe1f 100644 ---- a/net/core/drop_monitor.c -+++ b/net/core/drop_monitor.c -@@ -1731,30 +1731,30 @@ static int __init init_net_drop_monitor(void) - return -ENOSPC; - } - -- rc = genl_register_family(&net_drop_monitor_family); -- if (rc) { -- pr_err("Could not create drop monitor netlink family\n"); -- return rc; -+ for_each_possible_cpu(cpu) { -+ net_dm_cpu_data_init(cpu); -+ net_dm_hw_cpu_data_init(cpu); - } -- WARN_ON(net_drop_monitor_family.mcgrp_offset != NET_DM_GRP_ALERT); - - rc = register_netdevice_notifier(&dropmon_net_notifier); - if (rc < 0) { - pr_crit("Failed to register netdevice notifier\n"); -+ return rc; -+ } -+ -+ rc = genl_register_family(&net_drop_monitor_family); -+ if (rc) { -+ pr_err("Could not create drop monitor netlink family\n"); - goto out_unreg; - } -+ WARN_ON(net_drop_monitor_family.mcgrp_offset != NET_DM_GRP_ALERT); - - rc = 0; - -- for_each_possible_cpu(cpu) { -- net_dm_cpu_data_init(cpu); -- net_dm_hw_cpu_data_init(cpu); -- } -- - goto out; - - out_unreg: -- genl_unregister_family(&net_drop_monitor_family); -+ WARN_ON(unregister_netdevice_notifier(&dropmon_net_notifier)); - out: - return rc; - } -@@ -1763,19 +1763,18 @@ static void exit_net_drop_monitor(void) - { - int cpu; - -- BUG_ON(unregister_netdevice_notifier(&dropmon_net_notifier)); -- - /* - * Because of the module_get/put we do in the trace state change path - * we are guaranteed not to have any current users when we get here - */ -+ BUG_ON(genl_unregister_family(&net_drop_monitor_family)); -+ -+ BUG_ON(unregister_netdevice_notifier(&dropmon_net_notifier)); - - for_each_possible_cpu(cpu) { - net_dm_hw_cpu_data_fini(cpu); - net_dm_cpu_data_fini(cpu); - } -- -- BUG_ON(genl_unregister_family(&net_drop_monitor_family)); - } - - module_init(init_net_drop_monitor); -diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c -index 00a5c41c1831df..aafa754b6cbab9 100644 ---- a/net/core/flow_dissector.c -+++ b/net/core/flow_dissector.c -@@ -829,23 +829,30 @@ __skb_flow_dissect_ports(const struct sk_buff *skb, - void *target_container, const void *data, - int nhoff, u8 ip_proto, int hlen) - { -- enum flow_dissector_key_id dissector_ports = FLOW_DISSECTOR_KEY_MAX; -- struct flow_dissector_key_ports *key_ports; -+ struct flow_dissector_key_ports_range *key_ports_range = NULL; -+ struct flow_dissector_key_ports *key_ports = NULL; -+ __be32 ports; - - if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_PORTS)) -- dissector_ports = FLOW_DISSECTOR_KEY_PORTS; -- else if (dissector_uses_key(flow_dissector, -- FLOW_DISSECTOR_KEY_PORTS_RANGE)) -- dissector_ports = FLOW_DISSECTOR_KEY_PORTS_RANGE; -+ key_ports = skb_flow_dissector_target(flow_dissector, -+ FLOW_DISSECTOR_KEY_PORTS, -+ target_container); - -- if (dissector_ports == FLOW_DISSECTOR_KEY_MAX) -+ if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_PORTS_RANGE)) -+ key_ports_range = skb_flow_dissector_target(flow_dissector, -+ FLOW_DISSECTOR_KEY_PORTS_RANGE, -+ target_container); -+ -+ if (!key_ports && !key_ports_range) - return; - -- key_ports = skb_flow_dissector_target(flow_dissector, -- dissector_ports, -- target_container); -- key_ports->ports = __skb_flow_get_ports(skb, nhoff, ip_proto, -- data, hlen); -+ ports = __skb_flow_get_ports(skb, nhoff, ip_proto, data, hlen); -+ -+ if (key_ports) -+ key_ports->ports = ports; -+ -+ if (key_ports_range) -+ key_ports_range->tp.ports = ports; - } - - static void -@@ -900,6 +907,7 @@ static void __skb_flow_bpf_to_target(const struct bpf_flow_keys *flow_keys, - struct flow_dissector *flow_dissector, - void *target_container) - { -+ struct flow_dissector_key_ports_range *key_ports_range = NULL; - struct flow_dissector_key_ports *key_ports = NULL; - struct flow_dissector_key_control *key_control; - struct flow_dissector_key_basic *key_basic; -@@ -944,20 +952,21 @@ static void __skb_flow_bpf_to_target(const struct bpf_flow_keys *flow_keys, - key_control->addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS; - } - -- if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_PORTS)) -+ if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_PORTS)) { - key_ports = skb_flow_dissector_target(flow_dissector, - FLOW_DISSECTOR_KEY_PORTS, - target_container); -- else if (dissector_uses_key(flow_dissector, -- FLOW_DISSECTOR_KEY_PORTS_RANGE)) -- key_ports = skb_flow_dissector_target(flow_dissector, -- FLOW_DISSECTOR_KEY_PORTS_RANGE, -- target_container); -- -- if (key_ports) { - key_ports->src = flow_keys->sport; - key_ports->dst = flow_keys->dport; - } -+ if (dissector_uses_key(flow_dissector, -+ FLOW_DISSECTOR_KEY_PORTS_RANGE)) { -+ key_ports_range = skb_flow_dissector_target(flow_dissector, -+ FLOW_DISSECTOR_KEY_PORTS_RANGE, -+ target_container); -+ key_ports_range->tp.src = flow_keys->sport; -+ key_ports_range->tp.dst = flow_keys->dport; -+ } - - if (dissector_uses_key(flow_dissector, - FLOW_DISSECTOR_KEY_FLOW_LABEL)) { -diff --git a/net/core/skmsg.c b/net/core/skmsg.c -index 902098e221b396..b9b941c487c8a7 100644 ---- a/net/core/skmsg.c -+++ b/net/core/skmsg.c -@@ -548,6 +548,9 @@ static int sk_psock_skb_ingress_enqueue(struct sk_buff *skb, - return num_sge; - } - -+#if IS_ENABLED(CONFIG_BPF_STREAM_PARSER) -+ psock->ingress_bytes += len; -+#endif - copied = len; - msg->sg.start = 0; - msg->sg.size = copied; -@@ -1143,6 +1146,10 @@ int sk_psock_init_strp(struct sock *sk, struct sk_psock *psock) - if (!ret) - sk_psock_set_state(psock, SK_PSOCK_RX_STRP_ENABLED); - -+ if (sk_is_tcp(sk)) { -+ psock->strp.cb.read_sock = tcp_bpf_strp_read_sock; -+ psock->copied_seq = tcp_sk(sk)->copied_seq; -+ } - return ret; - } - -diff --git a/net/core/sock_map.c b/net/core/sock_map.c -index f37a26efdd8abe..3a53b6a0e76e2b 100644 ---- a/net/core/sock_map.c -+++ b/net/core/sock_map.c -@@ -300,7 +300,10 @@ static int sock_map_link(struct bpf_map *map, struct sock *sk) - - write_lock_bh(&sk->sk_callback_lock); - if (stream_parser && stream_verdict && !psock->saved_data_ready) { -- ret = sk_psock_init_strp(sk, psock); -+ if (sk_is_tcp(sk)) -+ ret = sk_psock_init_strp(sk, psock); -+ else -+ ret = -EOPNOTSUPP; - if (ret) { - write_unlock_bh(&sk->sk_callback_lock); - sk_psock_put(sk, psock); -@@ -538,6 +541,9 @@ static bool sock_map_sk_state_allowed(const struct sock *sk) - return (1 << sk->sk_state) & (TCPF_ESTABLISHED | TCPF_LISTEN); - if (sk_is_stream_unix(sk)) - return (1 << sk->sk_state) & TCPF_ESTABLISHED; -+ if (sk_is_vsock(sk) && -+ (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET)) -+ return (1 << sk->sk_state) & TCPF_ESTABLISHED; - return true; - } - -diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c -index 02776453bf97a8..784dc8b37be5a2 100644 ---- a/net/ipv4/arp.c -+++ b/net/ipv4/arp.c -@@ -1030,7 +1030,7 @@ static int arp_req_set_public(struct net *net, struct arpreq *r, - if (mask && mask != htonl(0xFFFFFFFF)) - return -EINVAL; - if (!dev && (r->arp_flags & ATF_COM)) { -- dev = dev_getbyhwaddr_rcu(net, r->arp_ha.sa_family, -+ dev = dev_getbyhwaddr(net, r->arp_ha.sa_family, - r->arp_ha.sa_data); - if (!dev) - return -ENODEV; -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 5e6615f69f175d..7ad82be40f348d 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -1553,12 +1553,13 @@ EXPORT_SYMBOL(tcp_recv_skb); - * or for 'peeking' the socket using this routine - * (although both would be easy to implement). - */ --int tcp_read_sock(struct sock *sk, read_descriptor_t *desc, -- sk_read_actor_t recv_actor) -+static int __tcp_read_sock(struct sock *sk, read_descriptor_t *desc, -+ sk_read_actor_t recv_actor, bool noack, -+ u32 *copied_seq) - { - struct sk_buff *skb; - struct tcp_sock *tp = tcp_sk(sk); -- u32 seq = tp->copied_seq; -+ u32 seq = *copied_seq; - u32 offset; - int copied = 0; - -@@ -1612,9 +1613,12 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc, - tcp_eat_recv_skb(sk, skb); - if (!desc->count) - break; -- WRITE_ONCE(tp->copied_seq, seq); -+ WRITE_ONCE(*copied_seq, seq); - } -- WRITE_ONCE(tp->copied_seq, seq); -+ WRITE_ONCE(*copied_seq, seq); -+ -+ if (noack) -+ goto out; - - tcp_rcv_space_adjust(sk); - -@@ -1623,10 +1627,25 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc, - tcp_recv_skb(sk, seq, &offset); - tcp_cleanup_rbuf(sk, copied); - } -+out: - return copied; - } -+ -+int tcp_read_sock(struct sock *sk, read_descriptor_t *desc, -+ sk_read_actor_t recv_actor) -+{ -+ return __tcp_read_sock(sk, desc, recv_actor, false, -+ &tcp_sk(sk)->copied_seq); -+} - EXPORT_SYMBOL(tcp_read_sock); - -+int tcp_read_sock_noack(struct sock *sk, read_descriptor_t *desc, -+ sk_read_actor_t recv_actor, bool noack, -+ u32 *copied_seq) -+{ -+ return __tcp_read_sock(sk, desc, recv_actor, noack, copied_seq); -+} -+ - int tcp_read_skb(struct sock *sk, skb_read_actor_t recv_actor) - { - struct sk_buff *skb; -diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c -index f882054fae5ee1..5312237e804093 100644 ---- a/net/ipv4/tcp_bpf.c -+++ b/net/ipv4/tcp_bpf.c -@@ -646,6 +646,42 @@ static int tcp_bpf_assert_proto_ops(struct proto *ops) - ops->sendmsg == tcp_sendmsg ? 0 : -ENOTSUPP; - } - -+#if IS_ENABLED(CONFIG_BPF_STREAM_PARSER) -+int tcp_bpf_strp_read_sock(struct strparser *strp, read_descriptor_t *desc, -+ sk_read_actor_t recv_actor) -+{ -+ struct sock *sk = strp->sk; -+ struct sk_psock *psock; -+ struct tcp_sock *tp; -+ int copied = 0; -+ -+ tp = tcp_sk(sk); -+ rcu_read_lock(); -+ psock = sk_psock(sk); -+ if (WARN_ON_ONCE(!psock)) { -+ desc->error = -EINVAL; -+ goto out; -+ } -+ -+ psock->ingress_bytes = 0; -+ copied = tcp_read_sock_noack(sk, desc, recv_actor, true, -+ &psock->copied_seq); -+ if (copied < 0) -+ goto out; -+ /* recv_actor may redirect skb to another socket (SK_REDIRECT) or -+ * just put skb into ingress queue of current socket (SK_PASS). -+ * For SK_REDIRECT, we need to ack the frame immediately but for -+ * SK_PASS, we want to delay the ack until tcp_bpf_recvmsg_parser(). -+ */ -+ tp->copied_seq = psock->copied_seq - psock->ingress_bytes; -+ tcp_rcv_space_adjust(sk); -+ __tcp_cleanup_rbuf(sk, copied - psock->ingress_bytes); -+out: -+ rcu_read_unlock(); -+ return copied; -+} -+#endif /* CONFIG_BPF_STREAM_PARSER */ -+ - int tcp_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool restore) - { - int family = sk->sk_family == AF_INET6 ? TCP_BPF_IPV6 : TCP_BPF_IPV4; -diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c -index 0f523cbfe329ef..32b28fc21b63c0 100644 ---- a/net/ipv4/tcp_fastopen.c -+++ b/net/ipv4/tcp_fastopen.c -@@ -178,7 +178,7 @@ void tcp_fastopen_add_skb(struct sock *sk, struct sk_buff *skb) - if (!skb) - return; - -- skb_dst_drop(skb); -+ tcp_cleanup_skb(skb); - /* segs_in has been initialized to 1 in tcp_create_openreq_child(). - * Hence, reset segs_in to 0 before calling tcp_segs_in() - * to avoid double counting. Also, tcp_segs_in() expects -@@ -195,7 +195,7 @@ void tcp_fastopen_add_skb(struct sock *sk, struct sk_buff *skb) - TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_SYN; - - tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq; -- __skb_queue_tail(&sk->sk_receive_queue, skb); -+ tcp_add_receive_queue(sk, skb); - tp->syn_data_acked = 1; - - /* u64_stats_update_begin(&tp->syncp) not needed here, -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index f6a213bae5cccb..10d38ec0ff5acd 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -248,9 +248,15 @@ static void tcp_measure_rcv_mss(struct sock *sk, const struct sk_buff *skb) - do_div(val, skb->truesize); - tcp_sk(sk)->scaling_ratio = val ? val : 1; - -- if (old_ratio != tcp_sk(sk)->scaling_ratio) -- WRITE_ONCE(tcp_sk(sk)->window_clamp, -- tcp_win_from_space(sk, sk->sk_rcvbuf)); -+ if (old_ratio != tcp_sk(sk)->scaling_ratio) { -+ struct tcp_sock *tp = tcp_sk(sk); -+ -+ val = tcp_win_from_space(sk, sk->sk_rcvbuf); -+ tcp_set_window_clamp(sk, val); -+ -+ if (tp->window_clamp < tp->rcvq_space.space) -+ tp->rcvq_space.space = tp->window_clamp; -+ } - } - icsk->icsk_ack.rcv_mss = min_t(unsigned int, len, - tcp_sk(sk)->advmss); -@@ -4868,7 +4874,7 @@ static void tcp_ofo_queue(struct sock *sk) - tcp_rcv_nxt_update(tp, TCP_SKB_CB(skb)->end_seq); - fin = TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN; - if (!eaten) -- __skb_queue_tail(&sk->sk_receive_queue, skb); -+ tcp_add_receive_queue(sk, skb); - else - kfree_skb_partial(skb, fragstolen); - -@@ -5059,7 +5065,7 @@ static int __must_check tcp_queue_rcv(struct sock *sk, struct sk_buff *skb, - skb, fragstolen)) ? 1 : 0; - tcp_rcv_nxt_update(tcp_sk(sk), TCP_SKB_CB(skb)->end_seq); - if (!eaten) { -- __skb_queue_tail(&sk->sk_receive_queue, skb); -+ tcp_add_receive_queue(sk, skb); - skb_set_owner_r(skb, sk); - } - return eaten; -@@ -5142,7 +5148,7 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb) - __kfree_skb(skb); - return; - } -- skb_dst_drop(skb); -+ tcp_cleanup_skb(skb); - __skb_pull(skb, tcp_hdr(skb)->doff * 4); - - reason = SKB_DROP_REASON_NOT_SPECIFIED; -@@ -6092,7 +6098,7 @@ void tcp_rcv_established(struct sock *sk, struct sk_buff *skb) - NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPHPHITS); - - /* Bulk data transfer: receiver */ -- skb_dst_drop(skb); -+ tcp_cleanup_skb(skb); - __skb_pull(skb, tcp_header_len); - eaten = tcp_queue_rcv(sk, skb, &fragstolen); - -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index 705320f160ac86..2f49a504c9d3e3 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -1842,7 +1842,7 @@ bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb, - */ - skb_condense(skb); - -- skb_dst_drop(skb); -+ tcp_cleanup_skb(skb); - - if (unlikely(tcp_checksum_complete(skb))) { - bh_unlock_sock(sk); -diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c -index 84e18b5f72a305..96c39e9a873c75 100644 ---- a/net/sched/cls_api.c -+++ b/net/sched/cls_api.c -@@ -97,7 +97,7 @@ tcf_exts_miss_cookie_base_alloc(struct tcf_exts *exts, struct tcf_proto *tp, - - err = xa_alloc_cyclic(&tcf_exts_miss_cookies_xa, &n->miss_cookie_base, - n, xa_limit_32b, &next, GFP_KERNEL); -- if (err) -+ if (err < 0) - goto err_xa_alloc; - - exts->miss_cookie_node = n; -diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c -index 8299ceb3e3739d..95696f42647ec1 100644 ---- a/net/strparser/strparser.c -+++ b/net/strparser/strparser.c -@@ -347,7 +347,10 @@ static int strp_read_sock(struct strparser *strp) - struct socket *sock = strp->sk->sk_socket; - read_descriptor_t desc; - -- if (unlikely(!sock || !sock->ops || !sock->ops->read_sock)) -+ if (unlikely(!sock || !sock->ops)) -+ return -EBUSY; -+ -+ if (unlikely(!strp->cb.read_sock && !sock->ops->read_sock)) - return -EBUSY; - - desc.arg.data = strp; -@@ -355,7 +358,10 @@ static int strp_read_sock(struct strparser *strp) - desc.count = 1; /* give more than one skb per call */ - - /* sk should be locked here, so okay to do read_sock */ -- sock->ops->read_sock(strp->sk, &desc, strp_recv); -+ if (strp->cb.read_sock) -+ strp->cb.read_sock(strp, &desc, strp_recv); -+ else -+ sock->ops->read_sock(strp->sk, &desc, strp_recv); - - desc.error = strp->cb.read_sock_done(strp, desc.error); - -@@ -468,6 +474,7 @@ int strp_init(struct strparser *strp, struct sock *sk, - strp->cb.unlock = cb->unlock ? : strp_sock_unlock; - strp->cb.rcv_msg = cb->rcv_msg; - strp->cb.parse_msg = cb->parse_msg; -+ strp->cb.read_sock = cb->read_sock; - strp->cb.read_sock_done = cb->read_sock_done ? : default_read_sock_done; - strp->cb.abort_parser = cb->abort_parser ? : strp_abort_strp; - -diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c -index 618b18e80cea04..622875a6f787ca 100644 ---- a/net/vmw_vsock/af_vsock.c -+++ b/net/vmw_vsock/af_vsock.c -@@ -1185,6 +1185,9 @@ static int vsock_read_skb(struct sock *sk, skb_read_actor_t read_actor) - { - struct vsock_sock *vsk = vsock_sk(sk); - -+ if (WARN_ON_ONCE(!vsk->transport)) -+ return -ENODEV; -+ - return vsk->transport->read_skb(vsk, read_actor); - } - -diff --git a/net/vmw_vsock/vsock_bpf.c b/net/vmw_vsock/vsock_bpf.c -index f201d9eca1df2f..07b96d56f3a577 100644 ---- a/net/vmw_vsock/vsock_bpf.c -+++ b/net/vmw_vsock/vsock_bpf.c -@@ -87,7 +87,7 @@ static int vsock_bpf_recvmsg(struct sock *sk, struct msghdr *msg, - lock_sock(sk); - vsk = vsock_sk(sk); - -- if (!vsk->transport) { -+ if (WARN_ON_ONCE(!vsk->transport)) { - copied = -ENODEV; - goto out; - } -diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c -index 8b7dfbc8e82075..54931ad0dc990f 100644 ---- a/sound/core/seq/seq_clientmgr.c -+++ b/sound/core/seq/seq_clientmgr.c -@@ -682,12 +682,18 @@ static int snd_seq_deliver_single_event(struct snd_seq_client *client, - dest_port->time_real); - - #if IS_ENABLED(CONFIG_SND_SEQ_UMP) -- if (!(dest->filter & SNDRV_SEQ_FILTER_NO_CONVERT)) { -- if (snd_seq_ev_is_ump(event)) { -+ if (snd_seq_ev_is_ump(event)) { -+ if (!(dest->filter & SNDRV_SEQ_FILTER_NO_CONVERT)) { - result = snd_seq_deliver_from_ump(client, dest, dest_port, - event, atomic, hop); - goto __skip; -- } else if (snd_seq_client_is_ump(dest)) { -+ } else if (dest->type == USER_CLIENT && -+ !snd_seq_client_is_ump(dest)) { -+ result = 0; // drop the event -+ goto __skip; -+ } -+ } else if (snd_seq_client_is_ump(dest)) { -+ if (!(dest->filter & SNDRV_SEQ_FILTER_NO_CONVERT)) { - result = snd_seq_deliver_to_ump(client, dest, dest_port, - event, atomic, hop); - goto __skip; -diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c -index 33af707a65ab11..aa6dc00985b514 100644 ---- a/sound/pci/hda/hda_codec.c -+++ b/sound/pci/hda/hda_codec.c -@@ -2463,7 +2463,9 @@ int snd_hda_create_dig_out_ctls(struct hda_codec *codec, - break; - id = kctl->id; - id.index = spdif_index; -- snd_ctl_rename_id(codec->card, &kctl->id, &id); -+ err = snd_ctl_rename_id(codec->card, &kctl->id, &id); -+ if (err < 0) -+ return err; - } - bus->primary_dig_out_type = HDA_PCM_TYPE_HDMI; - } -diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c -index 989ce0fb62919f..157efd1530fbf3 100644 ---- a/sound/pci/hda/patch_conexant.c -+++ b/sound/pci/hda/patch_conexant.c -@@ -1084,6 +1084,7 @@ static const struct hda_quirk cxt5066_fixups[] = { - SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO), - SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE), - SND_PCI_QUIRK(0x103c, 0x822e, "HP ProBook 440 G4", CXT_FIXUP_MUTE_LED_GPIO), -+ SND_PCI_QUIRK(0x103c, 0x8231, "HP ProBook 450 G4", CXT_FIXUP_MUTE_LED_GPIO), - SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK), - SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE), -diff --git a/sound/pci/hda/patch_cs8409-tables.c b/sound/pci/hda/patch_cs8409-tables.c -index 759f48038273df..621f947e38174d 100644 ---- a/sound/pci/hda/patch_cs8409-tables.c -+++ b/sound/pci/hda/patch_cs8409-tables.c -@@ -121,7 +121,7 @@ static const struct cs8409_i2c_param cs42l42_init_reg_seq[] = { - { CS42L42_MIXER_CHA_VOL, 0x3F }, - { CS42L42_MIXER_CHB_VOL, 0x3F }, - { CS42L42_MIXER_ADC_VOL, 0x3f }, -- { CS42L42_HP_CTL, 0x03 }, -+ { CS42L42_HP_CTL, 0x0D }, - { CS42L42_MIC_DET_CTL1, 0xB6 }, - { CS42L42_TIPSENSE_CTL, 0xC2 }, - { CS42L42_HS_CLAMP_DISABLE, 0x01 }, -@@ -315,7 +315,7 @@ static const struct cs8409_i2c_param dolphin_c0_init_reg_seq[] = { - { CS42L42_ASP_TX_SZ_EN, 0x01 }, - { CS42L42_PWR_CTL1, 0x0A }, - { CS42L42_PWR_CTL2, 0x84 }, -- { CS42L42_HP_CTL, 0x03 }, -+ { CS42L42_HP_CTL, 0x0D }, - { CS42L42_MIXER_CHA_VOL, 0x3F }, - { CS42L42_MIXER_CHB_VOL, 0x3F }, - { CS42L42_MIXER_ADC_VOL, 0x3f }, -@@ -371,7 +371,7 @@ static const struct cs8409_i2c_param dolphin_c1_init_reg_seq[] = { - { CS42L42_ASP_TX_SZ_EN, 0x00 }, - { CS42L42_PWR_CTL1, 0x0E }, - { CS42L42_PWR_CTL2, 0x84 }, -- { CS42L42_HP_CTL, 0x01 }, -+ { CS42L42_HP_CTL, 0x0D }, - { CS42L42_MIXER_CHA_VOL, 0x3F }, - { CS42L42_MIXER_CHB_VOL, 0x3F }, - { CS42L42_MIXER_ADC_VOL, 0x3f }, -diff --git a/sound/pci/hda/patch_cs8409.c b/sound/pci/hda/patch_cs8409.c -index 892223d9e64aba..b003ac1990ba86 100644 ---- a/sound/pci/hda/patch_cs8409.c -+++ b/sound/pci/hda/patch_cs8409.c -@@ -876,7 +876,7 @@ static void cs42l42_resume(struct sub_codec *cs42l42) - { CS42L42_DET_INT_STATUS2, 0x00 }, - { CS42L42_TSRS_PLUG_STATUS, 0x00 }, - }; -- int fsv_old, fsv_new; -+ unsigned int fsv; - - /* Bring CS42L42 out of Reset */ - spec->gpio_data = snd_hda_codec_read(codec, CS8409_PIN_AFG, 0, AC_VERB_GET_GPIO_DATA, 0); -@@ -893,13 +893,15 @@ static void cs42l42_resume(struct sub_codec *cs42l42) - /* Clear interrupts, by reading interrupt status registers */ - cs8409_i2c_bulk_read(cs42l42, irq_regs, ARRAY_SIZE(irq_regs)); - -- fsv_old = cs8409_i2c_read(cs42l42, CS42L42_HP_CTL); -- if (cs42l42->full_scale_vol == CS42L42_FULL_SCALE_VOL_0DB) -- fsv_new = fsv_old & ~CS42L42_FULL_SCALE_VOL_MASK; -- else -- fsv_new = fsv_old & CS42L42_FULL_SCALE_VOL_MASK; -- if (fsv_new != fsv_old) -- cs8409_i2c_write(cs42l42, CS42L42_HP_CTL, fsv_new); -+ fsv = cs8409_i2c_read(cs42l42, CS42L42_HP_CTL); -+ if (cs42l42->full_scale_vol) { -+ // Set the full scale volume bit -+ fsv |= CS42L42_FULL_SCALE_VOL_MASK; -+ cs8409_i2c_write(cs42l42, CS42L42_HP_CTL, fsv); -+ } -+ // Unmute analog channels A and B -+ fsv = (fsv & ~CS42L42_ANA_MUTE_AB); -+ cs8409_i2c_write(cs42l42, CS42L42_HP_CTL, fsv); - - /* we have to explicitly allow unsol event handling even during the - * resume phase so that the jack event is processed properly -@@ -921,7 +923,7 @@ static void cs42l42_suspend(struct sub_codec *cs42l42) - { CS42L42_MIXER_CHA_VOL, 0x3F }, - { CS42L42_MIXER_ADC_VOL, 0x3F }, - { CS42L42_MIXER_CHB_VOL, 0x3F }, -- { CS42L42_HP_CTL, 0x0F }, -+ { CS42L42_HP_CTL, 0x0D }, - { CS42L42_ASP_RX_DAI0_EN, 0x00 }, - { CS42L42_ASP_CLK_CFG, 0x00 }, - { CS42L42_PWR_CTL1, 0xFE }, -diff --git a/sound/pci/hda/patch_cs8409.h b/sound/pci/hda/patch_cs8409.h -index 5e48115caf096b..14645d25e70fd2 100644 ---- a/sound/pci/hda/patch_cs8409.h -+++ b/sound/pci/hda/patch_cs8409.h -@@ -230,9 +230,10 @@ enum cs8409_coefficient_index_registers { - #define CS42L42_PDN_TIMEOUT_US (250000) - #define CS42L42_PDN_SLEEP_US (2000) - #define CS42L42_INIT_TIMEOUT_MS (45) -+#define CS42L42_ANA_MUTE_AB (0x0C) - #define CS42L42_FULL_SCALE_VOL_MASK (2) --#define CS42L42_FULL_SCALE_VOL_0DB (1) --#define CS42L42_FULL_SCALE_VOL_MINUS6DB (0) -+#define CS42L42_FULL_SCALE_VOL_0DB (0) -+#define CS42L42_FULL_SCALE_VOL_MINUS6DB (1) - - /* Dell BULLSEYE / WARLOCK / CYBORG Specific Definitions */ - -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index abe3d5b9b84b3e..75162e5f712b40 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -3779,6 +3779,7 @@ static void alc225_init(struct hda_codec *codec) - AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE); - - msleep(75); -+ alc_update_coef_idx(codec, 0x4a, 3 << 10, 0); - alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x4); /* Hight power */ - } - } -diff --git a/sound/soc/fsl/fsl_micfil.c b/sound/soc/fsl/fsl_micfil.c -index f57f0ab8a1add1..80ff1d1359f64c 100644 ---- a/sound/soc/fsl/fsl_micfil.c -+++ b/sound/soc/fsl/fsl_micfil.c -@@ -156,6 +156,8 @@ static int micfil_set_quality(struct fsl_micfil *micfil) - case QUALITY_VLOW2: - qsel = MICFIL_QSEL_VLOW2_QUALITY; - break; -+ default: -+ return -EINVAL; - } - - return regmap_update_bits(micfil->regmap, REG_MICFIL_CTRL2, -diff --git a/sound/soc/rockchip/rockchip_i2s_tdm.c b/sound/soc/rockchip/rockchip_i2s_tdm.c -index 14e5c53e697b0e..7ae93cbaea9a77 100644 ---- a/sound/soc/rockchip/rockchip_i2s_tdm.c -+++ b/sound/soc/rockchip/rockchip_i2s_tdm.c -@@ -453,11 +453,11 @@ static int rockchip_i2s_tdm_set_fmt(struct snd_soc_dai *cpu_dai, - break; - case SND_SOC_DAIFMT_DSP_A: - val = I2S_TXCR_TFS_TDM_PCM; -- tdm_val = TDM_SHIFT_CTRL(0); -+ tdm_val = TDM_SHIFT_CTRL(2); - break; - case SND_SOC_DAIFMT_DSP_B: - val = I2S_TXCR_TFS_TDM_PCM; -- tdm_val = TDM_SHIFT_CTRL(2); -+ tdm_val = TDM_SHIFT_CTRL(4); - break; - default: - ret = -EINVAL; -diff --git a/sound/soc/sh/rz-ssi.c b/sound/soc/sh/rz-ssi.c -index 353863f49b3131..54f096bdc7ee27 100644 ---- a/sound/soc/sh/rz-ssi.c -+++ b/sound/soc/sh/rz-ssi.c -@@ -484,6 +484,8 @@ static int rz_ssi_pio_send(struct rz_ssi_priv *ssi, struct rz_ssi_stream *strm) - sample_space = strm->fifo_sample_size; - ssifsr = rz_ssi_reg_readl(ssi, SSIFSR); - sample_space -= (ssifsr >> SSIFSR_TDC_SHIFT) & SSIFSR_TDC_MASK; -+ if (sample_space < 0) -+ return -EINVAL; - - /* Only add full frames at a time */ - while (frames_left && (sample_space >= runtime->channels)) { -diff --git a/sound/soc/sof/pcm.c b/sound/soc/sof/pcm.c -index 8e602e42afee23..7a8eebb078e83d 100644 ---- a/sound/soc/sof/pcm.c -+++ b/sound/soc/sof/pcm.c -@@ -507,6 +507,8 @@ static int sof_pcm_close(struct snd_soc_component *component, - */ - } - -+ spcm->stream[substream->stream].substream = NULL; -+ - return 0; - } - -diff --git a/sound/soc/sof/stream-ipc.c b/sound/soc/sof/stream-ipc.c -index 216b454f6b94e3..3edcb0ea38488c 100644 ---- a/sound/soc/sof/stream-ipc.c -+++ b/sound/soc/sof/stream-ipc.c -@@ -43,7 +43,7 @@ int sof_ipc_msg_data(struct snd_sof_dev *sdev, - return -ESTRPIPE; - - posn_offset = stream->posn_offset; -- } else { -+ } else if (sps->cstream) { - - struct sof_compr_stream *sstream = sps->cstream->runtime->private_data; - -@@ -51,6 +51,10 @@ int sof_ipc_msg_data(struct snd_sof_dev *sdev, - return -ESTRPIPE; - - posn_offset = sstream->posn_offset; -+ -+ } else { -+ dev_err(sdev->dev, "%s: No stream opened\n", __func__); -+ return -EINVAL; - } - - snd_sof_dsp_mailbox_read(sdev, posn_offset, p, sz); diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.080-081.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.080-081.patch deleted file mode 100644 index 6ca4d5297a..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.080-081.patch +++ /dev/null @@ -1,8344 +0,0 @@ -diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt -index d83a3f47e20074..184f2f96f6a547 100644 ---- a/Documentation/admin-guide/kernel-parameters.txt -+++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -3287,6 +3287,11 @@ - - mga= [HW,DRM] - -+ microcode.force_minrev= [X86] -+ Format: -+ Enable or disable the microcode minimal revision -+ enforcement for the runtime microcode loader. -+ - min_addr=nn[KMG] [KNL,BOOT,IA-64] All physical memory below this - physical address is ignored. - -diff --git a/Makefile b/Makefile -index 67c5799f259e2e..892ed237b1e1b6 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 80 -+SUBLEVEL = 81 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi b/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi -index 5fcc5f32be2d79..2963d634baba99 100644 ---- a/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi -+++ b/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi -@@ -367,6 +367,11 @@ &u2phy_host { - status = "okay"; - }; - -+&uart5 { -+ /delete-property/ dmas; -+ /delete-property/ dma-names; -+}; -+ - /* Mule UCAN */ - &usb_host0_ehci { - status = "okay"; -diff --git a/arch/riscv/include/asm/futex.h b/arch/riscv/include/asm/futex.h -index fc8130f995c1ee..6907c456ac8c05 100644 ---- a/arch/riscv/include/asm/futex.h -+++ b/arch/riscv/include/asm/futex.h -@@ -93,7 +93,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, - _ASM_EXTABLE_UACCESS_ERR(1b, 3b, %[r]) \ - _ASM_EXTABLE_UACCESS_ERR(2b, 3b, %[r]) \ - : [r] "+r" (ret), [v] "=&r" (val), [u] "+m" (*uaddr), [t] "=&r" (tmp) -- : [ov] "Jr" (oldval), [nv] "Jr" (newval) -+ : [ov] "Jr" ((long)(int)oldval), [nv] "Jr" (newval) - : "memory"); - __disable_user_access(); - -diff --git a/arch/riscv/include/asm/kvm_host.h b/arch/riscv/include/asm/kvm_host.h -index 1ebf20dfbaa698..459e61ad7d2b68 100644 ---- a/arch/riscv/include/asm/kvm_host.h -+++ b/arch/riscv/include/asm/kvm_host.h -@@ -236,8 +236,9 @@ struct kvm_vcpu_arch { - /* Cache pages needed to program page tables with spinlock held */ - struct kvm_mmu_memory_cache mmu_page_cache; - -- /* VCPU power-off state */ -- bool power_off; -+ /* VCPU power state */ -+ struct kvm_mp_state mp_state; -+ spinlock_t mp_state_lock; - - /* Don't run the VCPU (blocked) */ - bool pause; -@@ -351,7 +352,10 @@ int kvm_riscv_vcpu_unset_interrupt(struct kvm_vcpu *vcpu, unsigned int irq); - void kvm_riscv_vcpu_flush_interrupts(struct kvm_vcpu *vcpu); - void kvm_riscv_vcpu_sync_interrupts(struct kvm_vcpu *vcpu); - bool kvm_riscv_vcpu_has_interrupts(struct kvm_vcpu *vcpu, u64 mask); -+void __kvm_riscv_vcpu_power_off(struct kvm_vcpu *vcpu); - void kvm_riscv_vcpu_power_off(struct kvm_vcpu *vcpu); -+void __kvm_riscv_vcpu_power_on(struct kvm_vcpu *vcpu); - void kvm_riscv_vcpu_power_on(struct kvm_vcpu *vcpu); -+bool kvm_riscv_vcpu_stopped(struct kvm_vcpu *vcpu); - - #endif /* __RISCV_KVM_HOST_H__ */ -diff --git a/arch/riscv/kernel/signal.c b/arch/riscv/kernel/signal.c -index 88b6220b260879..048b9b23d7543e 100644 ---- a/arch/riscv/kernel/signal.c -+++ b/arch/riscv/kernel/signal.c -@@ -211,12 +211,6 @@ static size_t get_rt_frame_size(bool cal_all) - if (cal_all || riscv_v_vstate_query(task_pt_regs(current))) - total_context_size += riscv_v_sc_size; - } -- /* -- * Preserved a __riscv_ctx_hdr for END signal context header if an -- * extension uses __riscv_extra_ext_header -- */ -- if (total_context_size) -- total_context_size += sizeof(struct __riscv_ctx_hdr); - - frame_size += total_context_size; - -diff --git a/arch/riscv/kvm/vcpu.c b/arch/riscv/kvm/vcpu.c -index 82229db1ce73f3..9584d62c96ee74 100644 ---- a/arch/riscv/kvm/vcpu.c -+++ b/arch/riscv/kvm/vcpu.c -@@ -100,6 +100,8 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu) - struct kvm_cpu_context *cntx; - struct kvm_vcpu_csr *reset_csr = &vcpu->arch.guest_reset_csr; - -+ spin_lock_init(&vcpu->arch.mp_state_lock); -+ - /* Mark this VCPU never ran */ - vcpu->arch.ran_atleast_once = false; - vcpu->arch.mmu_page_cache.gfp_zero = __GFP_ZERO; -@@ -193,7 +195,7 @@ void kvm_arch_vcpu_unblocking(struct kvm_vcpu *vcpu) - int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu) - { - return (kvm_riscv_vcpu_has_interrupts(vcpu, -1UL) && -- !vcpu->arch.power_off && !vcpu->arch.pause); -+ !kvm_riscv_vcpu_stopped(vcpu) && !vcpu->arch.pause); - } - - int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu) -@@ -421,26 +423,42 @@ bool kvm_riscv_vcpu_has_interrupts(struct kvm_vcpu *vcpu, u64 mask) - return kvm_riscv_vcpu_aia_has_interrupts(vcpu, mask); - } - --void kvm_riscv_vcpu_power_off(struct kvm_vcpu *vcpu) -+void __kvm_riscv_vcpu_power_off(struct kvm_vcpu *vcpu) - { -- vcpu->arch.power_off = true; -+ WRITE_ONCE(vcpu->arch.mp_state.mp_state, KVM_MP_STATE_STOPPED); - kvm_make_request(KVM_REQ_SLEEP, vcpu); - kvm_vcpu_kick(vcpu); - } - --void kvm_riscv_vcpu_power_on(struct kvm_vcpu *vcpu) -+void kvm_riscv_vcpu_power_off(struct kvm_vcpu *vcpu) - { -- vcpu->arch.power_off = false; -+ spin_lock(&vcpu->arch.mp_state_lock); -+ __kvm_riscv_vcpu_power_off(vcpu); -+ spin_unlock(&vcpu->arch.mp_state_lock); -+} -+ -+void __kvm_riscv_vcpu_power_on(struct kvm_vcpu *vcpu) -+{ -+ WRITE_ONCE(vcpu->arch.mp_state.mp_state, KVM_MP_STATE_RUNNABLE); - kvm_vcpu_wake_up(vcpu); - } - -+void kvm_riscv_vcpu_power_on(struct kvm_vcpu *vcpu) -+{ -+ spin_lock(&vcpu->arch.mp_state_lock); -+ __kvm_riscv_vcpu_power_on(vcpu); -+ spin_unlock(&vcpu->arch.mp_state_lock); -+} -+ -+bool kvm_riscv_vcpu_stopped(struct kvm_vcpu *vcpu) -+{ -+ return READ_ONCE(vcpu->arch.mp_state.mp_state) == KVM_MP_STATE_STOPPED; -+} -+ - int kvm_arch_vcpu_ioctl_get_mpstate(struct kvm_vcpu *vcpu, - struct kvm_mp_state *mp_state) - { -- if (vcpu->arch.power_off) -- mp_state->mp_state = KVM_MP_STATE_STOPPED; -- else -- mp_state->mp_state = KVM_MP_STATE_RUNNABLE; -+ *mp_state = READ_ONCE(vcpu->arch.mp_state); - - return 0; - } -@@ -450,17 +468,21 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu, - { - int ret = 0; - -+ spin_lock(&vcpu->arch.mp_state_lock); -+ - switch (mp_state->mp_state) { - case KVM_MP_STATE_RUNNABLE: -- vcpu->arch.power_off = false; -+ WRITE_ONCE(vcpu->arch.mp_state, *mp_state); - break; - case KVM_MP_STATE_STOPPED: -- kvm_riscv_vcpu_power_off(vcpu); -+ __kvm_riscv_vcpu_power_off(vcpu); - break; - default: - ret = -EINVAL; - } - -+ spin_unlock(&vcpu->arch.mp_state_lock); -+ - return ret; - } - -@@ -561,11 +583,11 @@ static void kvm_riscv_check_vcpu_requests(struct kvm_vcpu *vcpu) - if (kvm_check_request(KVM_REQ_SLEEP, vcpu)) { - kvm_vcpu_srcu_read_unlock(vcpu); - rcuwait_wait_event(wait, -- (!vcpu->arch.power_off) && (!vcpu->arch.pause), -+ (!kvm_riscv_vcpu_stopped(vcpu)) && (!vcpu->arch.pause), - TASK_INTERRUPTIBLE); - kvm_vcpu_srcu_read_lock(vcpu); - -- if (vcpu->arch.power_off || vcpu->arch.pause) { -+ if (kvm_riscv_vcpu_stopped(vcpu) || vcpu->arch.pause) { - /* - * Awaken to handle a signal, request to - * sleep again later. -diff --git a/arch/riscv/kvm/vcpu_sbi.c b/arch/riscv/kvm/vcpu_sbi.c -index 7a7fe40d0930be..be43278109f4e8 100644 ---- a/arch/riscv/kvm/vcpu_sbi.c -+++ b/arch/riscv/kvm/vcpu_sbi.c -@@ -102,8 +102,11 @@ void kvm_riscv_vcpu_sbi_system_reset(struct kvm_vcpu *vcpu, - unsigned long i; - struct kvm_vcpu *tmp; - -- kvm_for_each_vcpu(i, tmp, vcpu->kvm) -- tmp->arch.power_off = true; -+ kvm_for_each_vcpu(i, tmp, vcpu->kvm) { -+ spin_lock(&vcpu->arch.mp_state_lock); -+ WRITE_ONCE(tmp->arch.mp_state.mp_state, KVM_MP_STATE_STOPPED); -+ spin_unlock(&vcpu->arch.mp_state_lock); -+ } - kvm_make_all_cpus_request(vcpu->kvm, KVM_REQ_SLEEP); - - memset(&run->system_event, 0, sizeof(run->system_event)); -diff --git a/arch/riscv/kvm/vcpu_sbi_hsm.c b/arch/riscv/kvm/vcpu_sbi_hsm.c -index 7dca0e9381d9a5..7e349b4ee926cb 100644 ---- a/arch/riscv/kvm/vcpu_sbi_hsm.c -+++ b/arch/riscv/kvm/vcpu_sbi_hsm.c -@@ -18,12 +18,18 @@ static int kvm_sbi_hsm_vcpu_start(struct kvm_vcpu *vcpu) - struct kvm_cpu_context *cp = &vcpu->arch.guest_context; - struct kvm_vcpu *target_vcpu; - unsigned long target_vcpuid = cp->a0; -+ int ret = 0; - - target_vcpu = kvm_get_vcpu_by_id(vcpu->kvm, target_vcpuid); - if (!target_vcpu) - return SBI_ERR_INVALID_PARAM; -- if (!target_vcpu->arch.power_off) -- return SBI_ERR_ALREADY_AVAILABLE; -+ -+ spin_lock(&target_vcpu->arch.mp_state_lock); -+ -+ if (!kvm_riscv_vcpu_stopped(target_vcpu)) { -+ ret = SBI_ERR_ALREADY_AVAILABLE; -+ goto out; -+ } - - reset_cntx = &target_vcpu->arch.guest_reset_context; - /* start address */ -@@ -34,19 +40,31 @@ static int kvm_sbi_hsm_vcpu_start(struct kvm_vcpu *vcpu) - reset_cntx->a1 = cp->a2; - kvm_make_request(KVM_REQ_VCPU_RESET, target_vcpu); - -- kvm_riscv_vcpu_power_on(target_vcpu); -+ __kvm_riscv_vcpu_power_on(target_vcpu); - -- return 0; -+out: -+ spin_unlock(&target_vcpu->arch.mp_state_lock); -+ -+ return ret; - } - - static int kvm_sbi_hsm_vcpu_stop(struct kvm_vcpu *vcpu) - { -- if (vcpu->arch.power_off) -- return SBI_ERR_FAILURE; -+ int ret = 0; - -- kvm_riscv_vcpu_power_off(vcpu); -+ spin_lock(&vcpu->arch.mp_state_lock); - -- return 0; -+ if (kvm_riscv_vcpu_stopped(vcpu)) { -+ ret = SBI_ERR_FAILURE; -+ goto out; -+ } -+ -+ __kvm_riscv_vcpu_power_off(vcpu); -+ -+out: -+ spin_unlock(&vcpu->arch.mp_state_lock); -+ -+ return ret; - } - - static int kvm_sbi_hsm_vcpu_get_status(struct kvm_vcpu *vcpu) -@@ -58,12 +76,12 @@ static int kvm_sbi_hsm_vcpu_get_status(struct kvm_vcpu *vcpu) - target_vcpu = kvm_get_vcpu_by_id(vcpu->kvm, target_vcpuid); - if (!target_vcpu) - return SBI_ERR_INVALID_PARAM; -- if (!target_vcpu->arch.power_off) -- return SBI_HSM_STATE_STARTED; -- else if (vcpu->stat.generic.blocking) -+ if (kvm_riscv_vcpu_stopped(target_vcpu)) -+ return SBI_HSM_STATE_STOPPED; -+ else if (target_vcpu->stat.generic.blocking) - return SBI_HSM_STATE_SUSPENDED; - else -- return SBI_HSM_STATE_STOPPED; -+ return SBI_HSM_STATE_STARTED; - } - - static int kvm_sbi_ext_hsm_handler(struct kvm_vcpu *vcpu, struct kvm_run *run, -@@ -71,14 +89,11 @@ static int kvm_sbi_ext_hsm_handler(struct kvm_vcpu *vcpu, struct kvm_run *run, - { - int ret = 0; - struct kvm_cpu_context *cp = &vcpu->arch.guest_context; -- struct kvm *kvm = vcpu->kvm; - unsigned long funcid = cp->a6; - - switch (funcid) { - case SBI_EXT_HSM_HART_START: -- mutex_lock(&kvm->lock); - ret = kvm_sbi_hsm_vcpu_start(vcpu); -- mutex_unlock(&kvm->lock); - break; - case SBI_EXT_HSM_HART_STOP: - ret = kvm_sbi_hsm_vcpu_stop(vcpu); -diff --git a/arch/riscv/kvm/vcpu_sbi_replace.c b/arch/riscv/kvm/vcpu_sbi_replace.c -index 7c4d5d38a33908..87ec68ed52d762 100644 ---- a/arch/riscv/kvm/vcpu_sbi_replace.c -+++ b/arch/riscv/kvm/vcpu_sbi_replace.c -@@ -21,7 +21,7 @@ static int kvm_sbi_ext_time_handler(struct kvm_vcpu *vcpu, struct kvm_run *run, - u64 next_cycle; - - if (cp->a6 != SBI_EXT_TIME_SET_TIMER) { -- retdata->err_val = SBI_ERR_INVALID_PARAM; -+ retdata->err_val = SBI_ERR_NOT_SUPPORTED; - return 0; - } - -@@ -51,9 +51,10 @@ static int kvm_sbi_ext_ipi_handler(struct kvm_vcpu *vcpu, struct kvm_run *run, - struct kvm_cpu_context *cp = &vcpu->arch.guest_context; - unsigned long hmask = cp->a0; - unsigned long hbase = cp->a1; -+ unsigned long hart_bit = 0, sentmask = 0; - - if (cp->a6 != SBI_EXT_IPI_SEND_IPI) { -- retdata->err_val = SBI_ERR_INVALID_PARAM; -+ retdata->err_val = SBI_ERR_NOT_SUPPORTED; - return 0; - } - -@@ -62,15 +63,23 @@ static int kvm_sbi_ext_ipi_handler(struct kvm_vcpu *vcpu, struct kvm_run *run, - if (hbase != -1UL) { - if (tmp->vcpu_id < hbase) - continue; -- if (!(hmask & (1UL << (tmp->vcpu_id - hbase)))) -+ hart_bit = tmp->vcpu_id - hbase; -+ if (hart_bit >= __riscv_xlen) -+ goto done; -+ if (!(hmask & (1UL << hart_bit))) - continue; - } - ret = kvm_riscv_vcpu_set_interrupt(tmp, IRQ_VS_SOFT); - if (ret < 0) - break; -+ sentmask |= 1UL << hart_bit; - kvm_riscv_vcpu_pmu_incr_fw(tmp, SBI_PMU_FW_IPI_RCVD); - } - -+done: -+ if (hbase != -1UL && (hmask ^ sentmask)) -+ retdata->err_val = SBI_ERR_INVALID_PARAM; -+ - return ret; - } - -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 989d432b58345d..1e666454ebdc3e 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -1313,17 +1313,39 @@ config X86_REBOOTFIXUPS - config MICROCODE - def_bool y - depends on CPU_SUP_AMD || CPU_SUP_INTEL -+ select CRYPTO_LIB_SHA256 if CPU_SUP_AMD - - config MICROCODE_LATE_LOADING - bool "Late microcode loading (DANGEROUS)" - default n -- depends on MICROCODE -+ depends on MICROCODE && SMP - help - Loading microcode late, when the system is up and executing instructions - is a tricky business and should be avoided if possible. Just the sequence - of synchronizing all cores and SMT threads is one fragile dance which does - not guarantee that cores might not softlock after the loading. Therefore, -- use this at your own risk. Late loading taints the kernel too. -+ use this at your own risk. Late loading taints the kernel unless the -+ microcode header indicates that it is safe for late loading via the -+ minimal revision check. This minimal revision check can be enforced on -+ the kernel command line with "microcode.minrev=Y". -+ -+config MICROCODE_LATE_FORCE_MINREV -+ bool "Enforce late microcode loading minimal revision check" -+ default n -+ depends on MICROCODE_LATE_LOADING -+ help -+ To prevent that users load microcode late which modifies already -+ in use features, newer microcode patches have a minimum revision field -+ in the microcode header, which tells the kernel which minimum -+ revision must be active in the CPU to safely load that new microcode -+ late into the running system. If disabled the check will not -+ be enforced but the kernel will be tainted when the minimal -+ revision check fails. -+ -+ This minimal revision check can also be controlled via the -+ "microcode.minrev" parameter on the kernel command line. -+ -+ If unsure say Y. - - config X86_MSR - tristate "/dev/cpu/*/msr - Model-specific register support" -diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c -index 150a365b4fbc89..1458ccaa6a0579 100644 ---- a/arch/x86/events/core.c -+++ b/arch/x86/events/core.c -@@ -623,7 +623,7 @@ int x86_pmu_hw_config(struct perf_event *event) - if (event->attr.type == event->pmu->type) - event->hw.config |= event->attr.config & X86_RAW_EVENT_MASK; - -- if (event->attr.sample_period && x86_pmu.limit_period) { -+ if (!event->attr.freq && x86_pmu.limit_period) { - s64 left = event->attr.sample_period; - x86_pmu.limit_period(event, &left); - if (left > event->attr.sample_period) -diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h -index 33aa0c31c21cf1..a2258c894244a8 100644 ---- a/arch/x86/include/asm/apic.h -+++ b/arch/x86/include/asm/apic.h -@@ -277,7 +277,8 @@ struct apic { - - u32 disable_esr : 1, - dest_mode_logical : 1, -- x2apic_set_max_apicid : 1; -+ x2apic_set_max_apicid : 1, -+ nmi_to_offline_cpu : 1; - - u32 (*calc_dest_apicid)(unsigned int cpu); - -@@ -543,6 +544,8 @@ extern bool default_check_apicid_used(physid_mask_t *map, int apicid); - extern void default_ioapic_phys_id_map(physid_mask_t *phys_map, physid_mask_t *retmap); - extern int default_cpu_present_to_apicid(int mps_cpu); - -+void apic_send_nmi_to_offline_cpu(unsigned int cpu); -+ - #else /* CONFIG_X86_LOCAL_APIC */ - - static inline unsigned int read_apic_id(void) { return 0; } -diff --git a/arch/x86/include/asm/cpu.h b/arch/x86/include/asm/cpu.h -index 25050d953eee02..fecc4fe1d68aff 100644 ---- a/arch/x86/include/asm/cpu.h -+++ b/arch/x86/include/asm/cpu.h -@@ -71,26 +71,12 @@ static inline void init_ia32_feat_ctl(struct cpuinfo_x86 *c) {} - - extern __noendbr void cet_disable(void); - --struct ucode_cpu_info; -+struct cpu_signature; - --int intel_cpu_collect_info(struct ucode_cpu_info *uci); -- --static inline bool intel_cpu_signatures_match(unsigned int s1, unsigned int p1, -- unsigned int s2, unsigned int p2) --{ -- if (s1 != s2) -- return false; -- -- /* Processor flags are either both 0 ... */ -- if (!p1 && !p2) -- return true; -- -- /* ... or they intersect. */ -- return p1 & p2; --} -+void intel_collect_cpu_info(struct cpu_signature *sig); - - extern u64 x86_read_arch_cap_msr(void); --int intel_find_matching_signature(void *mc, unsigned int csig, int cpf); -+bool intel_find_matching_signature(void *mc, struct cpu_signature *sig); - int intel_microcode_sanity_check(void *mc, bool print_err, int hdr_type); - - extern struct cpumask cpus_stop_mask; -diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h -index bbbe9d744977d0..1ab475a518e9a5 100644 ---- a/arch/x86/include/asm/microcode.h -+++ b/arch/x86/include/asm/microcode.h -@@ -68,11 +68,19 @@ static inline u32 intel_get_microcode_revision(void) - - return rev; - } -+#endif /* !CONFIG_CPU_SUP_INTEL */ - --void show_ucode_info_early(void); -+bool microcode_nmi_handler(void); -+void microcode_offline_nmi_handler(void); - --#else /* CONFIG_CPU_SUP_INTEL */ --static inline void show_ucode_info_early(void) { } --#endif /* !CONFIG_CPU_SUP_INTEL */ -+#ifdef CONFIG_MICROCODE_LATE_LOADING -+DECLARE_STATIC_KEY_FALSE(microcode_nmi_handler_enable); -+static __always_inline bool microcode_nmi_handler_enabled(void) -+{ -+ return static_branch_unlikely(µcode_nmi_handler_enable); -+} -+#else -+static __always_inline bool microcode_nmi_handler_enabled(void) { return false; } -+#endif - - #endif /* _ASM_X86_MICROCODE_H */ -diff --git a/arch/x86/kernel/apic/apic_flat_64.c b/arch/x86/kernel/apic/apic_flat_64.c -index 032a84e2c3ccc7..cd16228611ce8f 100644 ---- a/arch/x86/kernel/apic/apic_flat_64.c -+++ b/arch/x86/kernel/apic/apic_flat_64.c -@@ -103,6 +103,7 @@ static struct apic apic_flat __ro_after_init = { - .send_IPI_allbutself = default_send_IPI_allbutself, - .send_IPI_all = default_send_IPI_all, - .send_IPI_self = default_send_IPI_self, -+ .nmi_to_offline_cpu = true, - - .read = native_apic_mem_read, - .write = native_apic_mem_write, -@@ -175,6 +176,7 @@ static struct apic apic_physflat __ro_after_init = { - .send_IPI_allbutself = default_send_IPI_allbutself, - .send_IPI_all = default_send_IPI_all, - .send_IPI_self = default_send_IPI_self, -+ .nmi_to_offline_cpu = true, - - .read = native_apic_mem_read, - .write = native_apic_mem_write, -diff --git a/arch/x86/kernel/apic/ipi.c b/arch/x86/kernel/apic/ipi.c -index a44ba7209ef3a8..edad86f32e38cb 100644 ---- a/arch/x86/kernel/apic/ipi.c -+++ b/arch/x86/kernel/apic/ipi.c -@@ -97,6 +97,14 @@ void native_send_call_func_ipi(const struct cpumask *mask) - __apic_send_IPI_mask(mask, CALL_FUNCTION_VECTOR); - } - -+void apic_send_nmi_to_offline_cpu(unsigned int cpu) -+{ -+ if (WARN_ON_ONCE(!apic->nmi_to_offline_cpu)) -+ return; -+ if (WARN_ON_ONCE(!cpumask_test_cpu(cpu, &cpus_booted_once_mask))) -+ return; -+ apic->send_IPI(cpu, NMI_VECTOR); -+} - #endif /* CONFIG_SMP */ - - static inline int __prepare_ICR2(unsigned int mask) -diff --git a/arch/x86/kernel/apic/x2apic_cluster.c b/arch/x86/kernel/apic/x2apic_cluster.c -index affbff65e49713..a8306089c91bca 100644 ---- a/arch/x86/kernel/apic/x2apic_cluster.c -+++ b/arch/x86/kernel/apic/x2apic_cluster.c -@@ -251,6 +251,7 @@ static struct apic apic_x2apic_cluster __ro_after_init = { - .send_IPI_allbutself = x2apic_send_IPI_allbutself, - .send_IPI_all = x2apic_send_IPI_all, - .send_IPI_self = x2apic_send_IPI_self, -+ .nmi_to_offline_cpu = true, - - .read = native_apic_msr_read, - .write = native_apic_msr_write, -diff --git a/arch/x86/kernel/apic/x2apic_phys.c b/arch/x86/kernel/apic/x2apic_phys.c -index 788cdb4ee394da..c8ac1b12b8ac6c 100644 ---- a/arch/x86/kernel/apic/x2apic_phys.c -+++ b/arch/x86/kernel/apic/x2apic_phys.c -@@ -166,6 +166,7 @@ static struct apic apic_x2apic_phys __ro_after_init = { - .send_IPI_allbutself = x2apic_send_IPI_allbutself, - .send_IPI_all = x2apic_send_IPI_all, - .send_IPI_self = x2apic_send_IPI_self, -+ .nmi_to_offline_cpu = true, - - .read = native_apic_msr_read, - .write = native_apic_msr_write, -diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index 8bc90a501e7b80..a844110691f978 100644 ---- a/arch/x86/kernel/cpu/common.c -+++ b/arch/x86/kernel/cpu/common.c -@@ -2224,8 +2224,6 @@ static inline void setup_getcpu(int cpu) - } - - #ifdef CONFIG_X86_64 --static inline void ucode_cpu_init(int cpu) { } -- - static inline void tss_setup_ist(struct tss_struct *tss) - { - /* Set up the per-CPU TSS IST stacks */ -@@ -2236,16 +2234,8 @@ static inline void tss_setup_ist(struct tss_struct *tss) - /* Only mapped when SEV-ES is active */ - tss->x86_tss.ist[IST_INDEX_VC] = __this_cpu_ist_top_va(VC); - } -- - #else /* CONFIG_X86_64 */ -- --static inline void ucode_cpu_init(int cpu) --{ -- show_ucode_info_early(); --} -- - static inline void tss_setup_ist(struct tss_struct *tss) { } -- - #endif /* !CONFIG_X86_64 */ - - static inline void tss_setup_io_bitmap(struct tss_struct *tss) -@@ -2301,8 +2291,6 @@ void cpu_init(void) - struct task_struct *cur = current; - int cpu = raw_smp_processor_id(); - -- ucode_cpu_init(cpu); -- - #ifdef CONFIG_NUMA - if (this_cpu_read(numa_node) == 0 && - early_cpu_to_node(cpu) != NUMA_NO_NODE) -diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c -index 9651275aecd1bb..dfec2c61e3547d 100644 ---- a/arch/x86/kernel/cpu/cyrix.c -+++ b/arch/x86/kernel/cpu/cyrix.c -@@ -153,8 +153,8 @@ static void geode_configure(void) - u8 ccr3; - local_irq_save(flags); - -- /* Suspend on halt power saving and enable #SUSP pin */ -- setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x88); -+ /* Suspend on halt power saving */ -+ setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x08); - - ccr3 = getCx86(CX86_CCR3); - setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10); /* enable MAPEN */ -diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c -index bbd1dc38ea0316..13a632da09ed7b 100644 ---- a/arch/x86/kernel/cpu/microcode/amd.c -+++ b/arch/x86/kernel/cpu/microcode/amd.c -@@ -23,20 +23,35 @@ - - #include - #include -+#include - #include - #include - #include - #include - #include - -+#include -+ - #include - #include -+#include - #include - #include - #include -+#include - - #include "internal.h" - -+struct ucode_patch { -+ struct list_head plist; -+ void *data; -+ unsigned int size; -+ u32 patch_id; -+ u16 equiv_cpu; -+}; -+ -+static LIST_HEAD(microcode_cache); -+ - #define UCODE_MAGIC 0x00414d44 - #define UCODE_EQUIV_CPU_TABLE_TYPE 0x00000000 - #define UCODE_UCODE_TYPE 0x00000001 -@@ -81,6 +96,31 @@ static struct equiv_cpu_table { - struct equiv_cpu_entry *entry; - } equiv_table; - -+union zen_patch_rev { -+ struct { -+ __u32 rev : 8, -+ stepping : 4, -+ model : 4, -+ __reserved : 4, -+ ext_model : 4, -+ ext_fam : 8; -+ }; -+ __u32 ucode_rev; -+}; -+ -+union cpuid_1_eax { -+ struct { -+ __u32 stepping : 4, -+ model : 4, -+ family : 4, -+ __reserved0 : 4, -+ ext_model : 4, -+ ext_fam : 8, -+ __reserved1 : 4; -+ }; -+ __u32 full; -+}; -+ - /* - * This points to the current valid container of microcode patches which we will - * save from the initrd/builtin before jettisoning its contents. @mc is the -@@ -88,14 +128,11 @@ static struct equiv_cpu_table { - */ - struct cont_desc { - struct microcode_amd *mc; -- u32 cpuid_1_eax; - u32 psize; - u8 *data; - size_t size; - }; - --static u32 ucode_new_rev; -- - /* - * Microcode patch container file is prepended to the initrd in cpio - * format. See Documentation/arch/x86/microcode.rst -@@ -103,10 +140,143 @@ static u32 ucode_new_rev; - static const char - ucode_path[] __maybe_unused = "kernel/x86/microcode/AuthenticAMD.bin"; - -+/* -+ * This is CPUID(1).EAX on the BSP. It is used in two ways: -+ * -+ * 1. To ignore the equivalence table on Zen1 and newer. -+ * -+ * 2. To match which patches to load because the patch revision ID -+ * already contains the f/m/s for which the microcode is destined -+ * for. -+ */ -+static u32 bsp_cpuid_1_eax __ro_after_init; -+ -+static bool sha_check = true; -+ -+struct patch_digest { -+ u32 patch_id; -+ u8 sha256[SHA256_DIGEST_SIZE]; -+}; -+ -+#include "amd_shas.c" -+ -+static int cmp_id(const void *key, const void *elem) -+{ -+ struct patch_digest *pd = (struct patch_digest *)elem; -+ u32 patch_id = *(u32 *)key; -+ -+ if (patch_id == pd->patch_id) -+ return 0; -+ else if (patch_id < pd->patch_id) -+ return -1; -+ else -+ return 1; -+} -+ -+static bool need_sha_check(u32 cur_rev) -+{ -+ switch (cur_rev >> 8) { -+ case 0x80012: return cur_rev <= 0x800126f; break; -+ case 0x83010: return cur_rev <= 0x830107c; break; -+ case 0x86001: return cur_rev <= 0x860010e; break; -+ case 0x86081: return cur_rev <= 0x8608108; break; -+ case 0x87010: return cur_rev <= 0x8701034; break; -+ case 0x8a000: return cur_rev <= 0x8a0000a; break; -+ case 0xa0011: return cur_rev <= 0xa0011da; break; -+ case 0xa0012: return cur_rev <= 0xa001243; break; -+ case 0xa1011: return cur_rev <= 0xa101153; break; -+ case 0xa1012: return cur_rev <= 0xa10124e; break; -+ case 0xa1081: return cur_rev <= 0xa108109; break; -+ case 0xa2010: return cur_rev <= 0xa20102f; break; -+ case 0xa2012: return cur_rev <= 0xa201212; break; -+ case 0xa6012: return cur_rev <= 0xa60120a; break; -+ case 0xa7041: return cur_rev <= 0xa704109; break; -+ case 0xa7052: return cur_rev <= 0xa705208; break; -+ case 0xa7080: return cur_rev <= 0xa708009; break; -+ case 0xa70c0: return cur_rev <= 0xa70C009; break; -+ case 0xaa002: return cur_rev <= 0xaa00218; break; -+ default: break; -+ } -+ -+ pr_info("You should not be seeing this. Please send the following couple of lines to x86--kernel.org\n"); -+ pr_info("CPUID(1).EAX: 0x%x, current revision: 0x%x\n", bsp_cpuid_1_eax, cur_rev); -+ return true; -+} -+ -+static bool verify_sha256_digest(u32 patch_id, u32 cur_rev, const u8 *data, unsigned int len) -+{ -+ struct patch_digest *pd = NULL; -+ u8 digest[SHA256_DIGEST_SIZE]; -+ struct sha256_state s; -+ int i; -+ -+ if (x86_family(bsp_cpuid_1_eax) < 0x17 || -+ x86_family(bsp_cpuid_1_eax) > 0x19) -+ return true; -+ -+ if (!need_sha_check(cur_rev)) -+ return true; -+ -+ if (!sha_check) -+ return true; -+ -+ pd = bsearch(&patch_id, phashes, ARRAY_SIZE(phashes), sizeof(struct patch_digest), cmp_id); -+ if (!pd) { -+ pr_err("No sha256 digest for patch ID: 0x%x found\n", patch_id); -+ return false; -+ } -+ -+ sha256_init(&s); -+ sha256_update(&s, data, len); -+ sha256_final(&s, digest); -+ -+ if (memcmp(digest, pd->sha256, sizeof(digest))) { -+ pr_err("Patch 0x%x SHA256 digest mismatch!\n", patch_id); -+ -+ for (i = 0; i < SHA256_DIGEST_SIZE; i++) -+ pr_cont("0x%x ", digest[i]); -+ pr_info("\n"); -+ -+ return false; -+ } -+ -+ return true; -+} -+ -+static u32 get_patch_level(void) -+{ -+ u32 rev, dummy __always_unused; -+ -+ native_rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy); -+ -+ return rev; -+} -+ -+static union cpuid_1_eax ucode_rev_to_cpuid(unsigned int val) -+{ -+ union zen_patch_rev p; -+ union cpuid_1_eax c; -+ -+ p.ucode_rev = val; -+ c.full = 0; -+ -+ c.stepping = p.stepping; -+ c.model = p.model; -+ c.ext_model = p.ext_model; -+ c.family = 0xf; -+ c.ext_fam = p.ext_fam; -+ -+ return c; -+} -+ - static u16 find_equiv_id(struct equiv_cpu_table *et, u32 sig) - { - unsigned int i; - -+ /* Zen and newer do not need an equivalence table. */ -+ if (x86_family(bsp_cpuid_1_eax) >= 0x17) -+ return 0; -+ - if (!et || !et->num_entries) - return 0; - -@@ -121,24 +291,20 @@ static u16 find_equiv_id(struct equiv_cpu_table *et, u32 sig) - - /* - * Check whether there is a valid microcode container file at the beginning -- * of @buf of size @buf_size. Set @early to use this function in the early path. -+ * of @buf of size @buf_size. - */ --static bool verify_container(const u8 *buf, size_t buf_size, bool early) -+static bool verify_container(const u8 *buf, size_t buf_size) - { - u32 cont_magic; - - if (buf_size <= CONTAINER_HDR_SZ) { -- if (!early) -- pr_debug("Truncated microcode container header.\n"); -- -+ pr_debug("Truncated microcode container header.\n"); - return false; - } - - cont_magic = *(const u32 *)buf; - if (cont_magic != UCODE_MAGIC) { -- if (!early) -- pr_debug("Invalid magic value (0x%08x).\n", cont_magic); -- -+ pr_debug("Invalid magic value (0x%08x).\n", cont_magic); - return false; - } - -@@ -147,23 +313,24 @@ static bool verify_container(const u8 *buf, size_t buf_size, bool early) - - /* - * Check whether there is a valid, non-truncated CPU equivalence table at the -- * beginning of @buf of size @buf_size. Set @early to use this function in the -- * early path. -+ * beginning of @buf of size @buf_size. - */ --static bool verify_equivalence_table(const u8 *buf, size_t buf_size, bool early) -+static bool verify_equivalence_table(const u8 *buf, size_t buf_size) - { - const u32 *hdr = (const u32 *)buf; - u32 cont_type, equiv_tbl_len; - -- if (!verify_container(buf, buf_size, early)) -+ if (!verify_container(buf, buf_size)) - return false; - -+ /* Zen and newer do not need an equivalence table. */ -+ if (x86_family(bsp_cpuid_1_eax) >= 0x17) -+ return true; -+ - cont_type = hdr[1]; - if (cont_type != UCODE_EQUIV_CPU_TABLE_TYPE) { -- if (!early) -- pr_debug("Wrong microcode container equivalence table type: %u.\n", -- cont_type); -- -+ pr_debug("Wrong microcode container equivalence table type: %u.\n", -+ cont_type); - return false; - } - -@@ -172,9 +339,7 @@ static bool verify_equivalence_table(const u8 *buf, size_t buf_size, bool early) - equiv_tbl_len = hdr[2]; - if (equiv_tbl_len < sizeof(struct equiv_cpu_entry) || - buf_size < equiv_tbl_len) { -- if (!early) -- pr_debug("Truncated equivalence table.\n"); -- -+ pr_debug("Truncated equivalence table.\n"); - return false; - } - -@@ -183,22 +348,19 @@ static bool verify_equivalence_table(const u8 *buf, size_t buf_size, bool early) - - /* - * Check whether there is a valid, non-truncated microcode patch section at the -- * beginning of @buf of size @buf_size. Set @early to use this function in the -- * early path. -+ * beginning of @buf of size @buf_size. - * - * On success, @sh_psize returns the patch size according to the section header, - * to the caller. - */ - static bool --__verify_patch_section(const u8 *buf, size_t buf_size, u32 *sh_psize, bool early) -+__verify_patch_section(const u8 *buf, size_t buf_size, u32 *sh_psize) - { - u32 p_type, p_size; - const u32 *hdr; - - if (buf_size < SECTION_HDR_SIZE) { -- if (!early) -- pr_debug("Truncated patch section.\n"); -- -+ pr_debug("Truncated patch section.\n"); - return false; - } - -@@ -207,17 +369,13 @@ __verify_patch_section(const u8 *buf, size_t buf_size, u32 *sh_psize, bool early - p_size = hdr[1]; - - if (p_type != UCODE_UCODE_TYPE) { -- if (!early) -- pr_debug("Invalid type field (0x%x) in container file section header.\n", -- p_type); -- -+ pr_debug("Invalid type field (0x%x) in container file section header.\n", -+ p_type); - return false; - } - - if (p_size < sizeof(struct microcode_header_amd)) { -- if (!early) -- pr_debug("Patch of size %u too short.\n", p_size); -- -+ pr_debug("Patch of size %u too short.\n", p_size); - return false; - } - -@@ -232,12 +390,13 @@ __verify_patch_section(const u8 *buf, size_t buf_size, u32 *sh_psize, bool early - * exceed the per-family maximum). @sh_psize is the size read from the section - * header. - */ --static unsigned int __verify_patch_size(u8 family, u32 sh_psize, size_t buf_size) -+static bool __verify_patch_size(u32 sh_psize, size_t buf_size) - { -+ u8 family = x86_family(bsp_cpuid_1_eax); - u32 max_size; - - if (family >= 0x15) -- return min_t(u32, sh_psize, buf_size); -+ goto ret; - - #define F1XH_MPB_MAX_SIZE 2048 - #define F14H_MPB_MAX_SIZE 1824 -@@ -251,13 +410,15 @@ static unsigned int __verify_patch_size(u8 family, u32 sh_psize, size_t buf_size - break; - default: - WARN(1, "%s: WTF family: 0x%x\n", __func__, family); -- return 0; -+ return false; - } - -- if (sh_psize > min_t(u32, buf_size, max_size)) -- return 0; -+ if (sh_psize > max_size) -+ return false; - -- return sh_psize; -+ret: -+ /* Working with the whole buffer so < is ok. */ -+ return sh_psize <= buf_size; - } - - /* -@@ -268,16 +429,15 @@ static unsigned int __verify_patch_size(u8 family, u32 sh_psize, size_t buf_size - * positive: patch is not for this family, skip it - * 0: success - */ --static int --verify_patch(u8 family, const u8 *buf, size_t buf_size, u32 *patch_size, bool early) -+static int verify_patch(const u8 *buf, size_t buf_size, u32 *patch_size) - { -+ u8 family = x86_family(bsp_cpuid_1_eax); - struct microcode_header_amd *mc_hdr; -- unsigned int ret; - u32 sh_psize; - u16 proc_id; - u8 patch_fam; - -- if (!__verify_patch_section(buf, buf_size, &sh_psize, early)) -+ if (!__verify_patch_section(buf, buf_size, &sh_psize)) - return -1; - - /* -@@ -292,16 +452,12 @@ verify_patch(u8 family, const u8 *buf, size_t buf_size, u32 *patch_size, bool ea - * size sh_psize, as the section claims. - */ - if (buf_size < sh_psize) { -- if (!early) -- pr_debug("Patch of size %u truncated.\n", sh_psize); -- -+ pr_debug("Patch of size %u truncated.\n", sh_psize); - return -1; - } - -- ret = __verify_patch_size(family, sh_psize, buf_size); -- if (!ret) { -- if (!early) -- pr_debug("Per-family patch size mismatch.\n"); -+ if (!__verify_patch_size(sh_psize, buf_size)) { -+ pr_debug("Per-family patch size mismatch.\n"); - return -1; - } - -@@ -309,8 +465,7 @@ verify_patch(u8 family, const u8 *buf, size_t buf_size, u32 *patch_size, bool ea - - mc_hdr = (struct microcode_header_amd *)(buf + SECTION_HDR_SIZE); - if (mc_hdr->nb_dev_id || mc_hdr->sb_dev_id) { -- if (!early) -- pr_err("Patch-ID 0x%08x: chipset-specific code unsupported.\n", mc_hdr->patch_id); -+ pr_err("Patch-ID 0x%08x: chipset-specific code unsupported.\n", mc_hdr->patch_id); - return -1; - } - -@@ -322,6 +477,15 @@ verify_patch(u8 family, const u8 *buf, size_t buf_size, u32 *patch_size, bool ea - return 0; - } - -+static bool mc_patch_matches(struct microcode_amd *mc, u16 eq_id) -+{ -+ /* Zen and newer do not need an equivalence table. */ -+ if (x86_family(bsp_cpuid_1_eax) >= 0x17) -+ return ucode_rev_to_cpuid(mc->hdr.patch_id).full == bsp_cpuid_1_eax; -+ else -+ return eq_id == mc->hdr.processor_rev_id; -+} -+ - /* - * This scans the ucode blob for the proper container as we can have multiple - * containers glued together. Returns the equivalence ID from the equivalence -@@ -337,7 +501,7 @@ static size_t parse_container(u8 *ucode, size_t size, struct cont_desc *desc) - u16 eq_id; - u8 *buf; - -- if (!verify_equivalence_table(ucode, size, true)) -+ if (!verify_equivalence_table(ucode, size)) - return 0; - - buf = ucode; -@@ -350,7 +514,7 @@ static size_t parse_container(u8 *ucode, size_t size, struct cont_desc *desc) - * doesn't contain a patch for the CPU, scan through the whole container - * so that it can be skipped in case there are other containers appended. - */ -- eq_id = find_equiv_id(&table, desc->cpuid_1_eax); -+ eq_id = find_equiv_id(&table, bsp_cpuid_1_eax); - - buf += hdr[2] + CONTAINER_HDR_SZ; - size -= hdr[2] + CONTAINER_HDR_SZ; -@@ -364,7 +528,7 @@ static size_t parse_container(u8 *ucode, size_t size, struct cont_desc *desc) - u32 patch_size; - int ret; - -- ret = verify_patch(x86_family(desc->cpuid_1_eax), buf, size, &patch_size, true); -+ ret = verify_patch(buf, size, &patch_size); - if (ret < 0) { - /* - * Patch verification failed, skip to the next container, if -@@ -377,7 +541,7 @@ static size_t parse_container(u8 *ucode, size_t size, struct cont_desc *desc) - } - - mc = (struct microcode_amd *)(buf + SECTION_HDR_SIZE); -- if (eq_id == mc->hdr.processor_rev_id) { -+ if (mc_patch_matches(mc, eq_id)) { - desc->psize = patch_size; - desc->mc = mc; - } -@@ -427,73 +591,42 @@ static void scan_containers(u8 *ucode, size_t size, struct cont_desc *desc) - } - } - --static int __apply_microcode_amd(struct microcode_amd *mc) -+static bool __apply_microcode_amd(struct microcode_amd *mc, u32 *cur_rev, -+ unsigned int psize) - { -- u32 rev, dummy; -+ unsigned long p_addr = (unsigned long)&mc->hdr.data_code; - -- native_wrmsrl(MSR_AMD64_PATCH_LOADER, (u64)(long)&mc->hdr.data_code); -- -- /* verify patch application was successful */ -- native_rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy); -- if (rev != mc->hdr.patch_id) -+ if (!verify_sha256_digest(mc->hdr.patch_id, *cur_rev, (const u8 *)p_addr, psize)) - return -1; - -- return 0; --} -- --/* -- * Early load occurs before we can vmalloc(). So we look for the microcode -- * patch container file in initrd, traverse equivalent cpu table, look for a -- * matching microcode patch, and update, all in initrd memory in place. -- * When vmalloc() is available for use later -- on 64-bit during first AP load, -- * and on 32-bit during save_microcode_in_initrd_amd() -- we can call -- * load_microcode_amd() to save equivalent cpu table and microcode patches in -- * kernel heap memory. -- * -- * Returns true if container found (sets @desc), false otherwise. -- */ --static bool early_apply_microcode(u32 cpuid_1_eax, void *ucode, size_t size) --{ -- struct cont_desc desc = { 0 }; -- struct microcode_amd *mc; -- u32 rev, dummy, *new_rev; -- bool ret = false; -- --#ifdef CONFIG_X86_32 -- new_rev = (u32 *)__pa_nodebug(&ucode_new_rev); --#else -- new_rev = &ucode_new_rev; --#endif -- -- desc.cpuid_1_eax = cpuid_1_eax; -- -- scan_containers(ucode, size, &desc); -- -- mc = desc.mc; -- if (!mc) -- return ret; -+ native_wrmsrl(MSR_AMD64_PATCH_LOADER, p_addr); - -- native_rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy); -+ if (x86_family(bsp_cpuid_1_eax) == 0x17) { -+ unsigned long p_addr_end = p_addr + psize - 1; - -- /* -- * Allow application of the same revision to pick up SMT-specific -- * changes even if the revision of the other SMT thread is already -- * up-to-date. -- */ -- if (rev > mc->hdr.patch_id) -- return ret; -+ invlpg(p_addr); - -- if (!__apply_microcode_amd(mc)) { -- *new_rev = mc->hdr.patch_id; -- ret = true; -+ /* -+ * Flush next page too if patch image is crossing a page -+ * boundary. -+ */ -+ if (p_addr >> PAGE_SHIFT != p_addr_end >> PAGE_SHIFT) -+ invlpg(p_addr_end); - } - -- return ret; -+ /* verify patch application was successful */ -+ *cur_rev = get_patch_level(); -+ if (*cur_rev != mc->hdr.patch_id) -+ return false; -+ -+ return true; - } - --static bool get_builtin_microcode(struct cpio_data *cp, unsigned int family) -+ -+static bool get_builtin_microcode(struct cpio_data *cp) - { - char fw_name[36] = "amd-ucode/microcode_amd.bin"; -+ u8 family = x86_family(bsp_cpuid_1_eax); - struct firmware fw; - - if (IS_ENABLED(CONFIG_X86_32)) -@@ -512,93 +645,144 @@ static bool get_builtin_microcode(struct cpio_data *cp, unsigned int family) - return false; - } - --static void find_blobs_in_containers(unsigned int cpuid_1_eax, struct cpio_data *ret) -+static bool __init find_blobs_in_containers(struct cpio_data *ret) - { -- struct ucode_cpu_info *uci; - struct cpio_data cp; -- const char *path; -- bool use_pa; -- -- if (IS_ENABLED(CONFIG_X86_32)) { -- uci = (struct ucode_cpu_info *)__pa_nodebug(ucode_cpu_info); -- path = (const char *)__pa_nodebug(ucode_path); -- use_pa = true; -- } else { -- uci = ucode_cpu_info; -- path = ucode_path; -- use_pa = false; -- } -+ bool found; - -- if (!get_builtin_microcode(&cp, x86_family(cpuid_1_eax))) -- cp = find_microcode_in_initrd(path, use_pa); -+ if (!get_builtin_microcode(&cp)) -+ cp = find_microcode_in_initrd(ucode_path); - -- /* Needed in load_microcode_amd() */ -- uci->cpu_sig.sig = cpuid_1_eax; -+ found = cp.data && cp.size; -+ if (found) -+ *ret = cp; - -- *ret = cp; -+ return found; - } - --static void apply_ucode_from_containers(unsigned int cpuid_1_eax) -+/* -+ * Early load occurs before we can vmalloc(). So we look for the microcode -+ * patch container file in initrd, traverse equivalent cpu table, look for a -+ * matching microcode patch, and update, all in initrd memory in place. -+ * When vmalloc() is available for use later -- on 64-bit during first AP load, -+ * and on 32-bit during save_microcode_in_initrd() -- we can call -+ * load_microcode_amd() to save equivalent cpu table and microcode patches in -+ * kernel heap memory. -+ */ -+void __init load_ucode_amd_bsp(struct early_load_data *ed, unsigned int cpuid_1_eax) - { -+ struct cont_desc desc = { }; -+ struct microcode_amd *mc; - struct cpio_data cp = { }; -+ char buf[4]; -+ u32 rev; -+ -+ if (cmdline_find_option(boot_command_line, "microcode.amd_sha_check", buf, 4)) { -+ if (!strncmp(buf, "off", 3)) { -+ sha_check = false; -+ pr_warn_once("It is a very very bad idea to disable the blobs SHA check!\n"); -+ add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK); -+ } -+ } - -- find_blobs_in_containers(cpuid_1_eax, &cp); -- if (!(cp.data && cp.size)) -- return; -+ bsp_cpuid_1_eax = cpuid_1_eax; - -- early_apply_microcode(cpuid_1_eax, cp.data, cp.size); --} -+ rev = get_patch_level(); -+ ed->old_rev = rev; - --void load_ucode_amd_early(unsigned int cpuid_1_eax) --{ -- return apply_ucode_from_containers(cpuid_1_eax); --} -+ /* Needed in load_microcode_amd() */ -+ ucode_cpu_info[0].cpu_sig.sig = cpuid_1_eax; - --static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size); -+ if (!find_blobs_in_containers(&cp)) -+ return; - --int __init save_microcode_in_initrd_amd(unsigned int cpuid_1_eax) --{ -- struct cont_desc desc = { 0 }; -- enum ucode_state ret; -- struct cpio_data cp; -+ scan_containers(cp.data, cp.size, &desc); - -- cp = find_microcode_in_initrd(ucode_path, false); -- if (!(cp.data && cp.size)) -- return -EINVAL; -+ mc = desc.mc; -+ if (!mc) -+ return; - -- desc.cpuid_1_eax = cpuid_1_eax; -+ /* -+ * Allow application of the same revision to pick up SMT-specific -+ * changes even if the revision of the other SMT thread is already -+ * up-to-date. -+ */ -+ if (ed->old_rev > mc->hdr.patch_id) -+ return; - -- scan_containers(cp.data, cp.size, &desc); -- if (!desc.mc) -- return -EINVAL; -+ if (__apply_microcode_amd(mc, &rev, desc.psize)) -+ ed->new_rev = rev; -+} - -- ret = load_microcode_amd(x86_family(cpuid_1_eax), desc.data, desc.size); -- if (ret > UCODE_UPDATED) -- return -EINVAL; -+static inline bool patch_cpus_equivalent(struct ucode_patch *p, -+ struct ucode_patch *n, -+ bool ignore_stepping) -+{ -+ /* Zen and newer hardcode the f/m/s in the patch ID */ -+ if (x86_family(bsp_cpuid_1_eax) >= 0x17) { -+ union cpuid_1_eax p_cid = ucode_rev_to_cpuid(p->patch_id); -+ union cpuid_1_eax n_cid = ucode_rev_to_cpuid(n->patch_id); -+ -+ if (ignore_stepping) { -+ p_cid.stepping = 0; -+ n_cid.stepping = 0; -+ } - -- return 0; -+ return p_cid.full == n_cid.full; -+ } else { -+ return p->equiv_cpu == n->equiv_cpu; -+ } - } - - /* - * a small, trivial cache of per-family ucode patches - */ --static struct ucode_patch *cache_find_patch(u16 equiv_cpu) -+static struct ucode_patch *cache_find_patch(struct ucode_cpu_info *uci, u16 equiv_cpu) - { - struct ucode_patch *p; -+ struct ucode_patch n; -+ -+ n.equiv_cpu = equiv_cpu; -+ n.patch_id = uci->cpu_sig.rev; -+ -+ WARN_ON_ONCE(!n.patch_id); - - list_for_each_entry(p, µcode_cache, plist) -- if (p->equiv_cpu == equiv_cpu) -+ if (patch_cpus_equivalent(p, &n, false)) - return p; -+ - return NULL; - } - -+static inline int patch_newer(struct ucode_patch *p, struct ucode_patch *n) -+{ -+ /* Zen and newer hardcode the f/m/s in the patch ID */ -+ if (x86_family(bsp_cpuid_1_eax) >= 0x17) { -+ union zen_patch_rev zp, zn; -+ -+ zp.ucode_rev = p->patch_id; -+ zn.ucode_rev = n->patch_id; -+ -+ if (zn.stepping != zp.stepping) -+ return -1; -+ -+ return zn.rev > zp.rev; -+ } else { -+ return n->patch_id > p->patch_id; -+ } -+} -+ - static void update_cache(struct ucode_patch *new_patch) - { - struct ucode_patch *p; -+ int ret; - - list_for_each_entry(p, µcode_cache, plist) { -- if (p->equiv_cpu == new_patch->equiv_cpu) { -- if (p->patch_id >= new_patch->patch_id) { -+ if (patch_cpus_equivalent(p, new_patch, true)) { -+ ret = patch_newer(p, new_patch); -+ if (ret < 0) -+ continue; -+ else if (!ret) { - /* we already have the latest patch */ - kfree(new_patch->data); - kfree(new_patch); -@@ -629,14 +813,17 @@ static void free_cache(void) - static struct ucode_patch *find_patch(unsigned int cpu) - { - struct ucode_cpu_info *uci = ucode_cpu_info + cpu; -- u16 equiv_id; -+ u16 equiv_id = 0; - -+ uci->cpu_sig.rev = get_patch_level(); - -- equiv_id = find_equiv_id(&equiv_table, uci->cpu_sig.sig); -- if (!equiv_id) -- return NULL; -+ if (x86_family(bsp_cpuid_1_eax) < 0x17) { -+ equiv_id = find_equiv_id(&equiv_table, uci->cpu_sig.sig); -+ if (!equiv_id) -+ return NULL; -+ } - -- return cache_find_patch(equiv_id); -+ return cache_find_patch(uci, equiv_id); - } - - void reload_ucode_amd(unsigned int cpu) -@@ -651,24 +838,20 @@ void reload_ucode_amd(unsigned int cpu) - - mc = p->data; - -- rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy); -- -+ rev = get_patch_level(); - if (rev < mc->hdr.patch_id) { -- if (!__apply_microcode_amd(mc)) { -- ucode_new_rev = mc->hdr.patch_id; -- pr_info("reload patch_level=0x%08x\n", ucode_new_rev); -- } -+ if (__apply_microcode_amd(mc, &rev, p->size)) -+ pr_info_once("reload revision: 0x%08x\n", rev); - } - } - - static int collect_cpu_info_amd(int cpu, struct cpu_signature *csig) - { -- struct cpuinfo_x86 *c = &cpu_data(cpu); - struct ucode_cpu_info *uci = ucode_cpu_info + cpu; - struct ucode_patch *p; - - csig->sig = cpuid_eax(0x00000001); -- csig->rev = c->microcode; -+ csig->rev = get_patch_level(); - - /* - * a patch could have been loaded early, set uci->mc so that -@@ -678,8 +861,6 @@ static int collect_cpu_info_amd(int cpu, struct cpu_signature *csig) - if (p && (p->patch_id == csig->rev)) - uci->mc = p->data; - -- pr_info("CPU%d: patch_level=0x%08x\n", cpu, csig->rev); -- - return 0; - } - -@@ -690,7 +871,7 @@ static enum ucode_state apply_microcode_amd(int cpu) - struct ucode_cpu_info *uci; - struct ucode_patch *p; - enum ucode_state ret; -- u32 rev, dummy __always_unused; -+ u32 rev; - - BUG_ON(raw_smp_processor_id() != cpu); - -@@ -700,18 +881,18 @@ static enum ucode_state apply_microcode_amd(int cpu) - if (!p) - return UCODE_NFOUND; - -+ rev = uci->cpu_sig.rev; -+ - mc_amd = p->data; - uci->mc = p->data; - -- rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy); -- - /* need to apply patch? */ - if (rev > mc_amd->hdr.patch_id) { - ret = UCODE_OK; - goto out; - } - -- if (__apply_microcode_amd(mc_amd)) { -+ if (!__apply_microcode_amd(mc_amd, &rev, p->size)) { - pr_err("CPU%d: update failed for patch_level=0x%08x\n", - cpu, mc_amd->hdr.patch_id); - return UCODE_ERROR; -@@ -720,8 +901,6 @@ static enum ucode_state apply_microcode_amd(int cpu) - rev = mc_amd->hdr.patch_id; - ret = UCODE_UPDATED; - -- pr_info("CPU%d: new patch_level=0x%08x\n", cpu, rev); -- - out: - uci->cpu_sig.rev = rev; - c->microcode = rev; -@@ -733,17 +912,29 @@ static enum ucode_state apply_microcode_amd(int cpu) - return ret; - } - -+void load_ucode_amd_ap(unsigned int cpuid_1_eax) -+{ -+ unsigned int cpu = smp_processor_id(); -+ -+ ucode_cpu_info[cpu].cpu_sig.sig = cpuid_1_eax; -+ apply_microcode_amd(cpu); -+} -+ - static size_t install_equiv_cpu_table(const u8 *buf, size_t buf_size) - { - u32 equiv_tbl_len; - const u32 *hdr; - -- if (!verify_equivalence_table(buf, buf_size, false)) -+ if (!verify_equivalence_table(buf, buf_size)) - return 0; - - hdr = (const u32 *)buf; - equiv_tbl_len = hdr[2]; - -+ /* Zen and newer do not need an equivalence table. */ -+ if (x86_family(bsp_cpuid_1_eax) >= 0x17) -+ goto out; -+ - equiv_table.entry = vmalloc(equiv_tbl_len); - if (!equiv_table.entry) { - pr_err("failed to allocate equivalent CPU table\n"); -@@ -753,12 +944,16 @@ static size_t install_equiv_cpu_table(const u8 *buf, size_t buf_size) - memcpy(equiv_table.entry, buf + CONTAINER_HDR_SZ, equiv_tbl_len); - equiv_table.num_entries = equiv_tbl_len / sizeof(struct equiv_cpu_entry); - -+out: - /* add header length */ - return equiv_tbl_len + CONTAINER_HDR_SZ; - } - - static void free_equiv_cpu_table(void) - { -+ if (x86_family(bsp_cpuid_1_eax) >= 0x17) -+ return; -+ - vfree(equiv_table.entry); - memset(&equiv_table, 0, sizeof(equiv_table)); - } -@@ -784,7 +979,7 @@ static int verify_and_add_patch(u8 family, u8 *fw, unsigned int leftover, - u16 proc_id; - int ret; - -- ret = verify_patch(family, fw, leftover, patch_size, false); -+ ret = verify_patch(fw, leftover, patch_size); - if (ret) - return ret; - -@@ -809,7 +1004,7 @@ static int verify_and_add_patch(u8 family, u8 *fw, unsigned int leftover, - patch->patch_id = mc_hdr->patch_id; - patch->equiv_cpu = proc_id; - -- pr_debug("%s: Added patch_id: 0x%08x, proc_id: 0x%04x\n", -+ pr_debug("%s: Adding patch_id: 0x%08x, proc_id: 0x%04x\n", - __func__, patch->patch_id, proc_id); - - /* ... and add to cache. */ -@@ -819,8 +1014,7 @@ static int verify_and_add_patch(u8 family, u8 *fw, unsigned int leftover, - } - - /* Scan the blob in @data and add microcode patches to the cache. */ --static enum ucode_state __load_microcode_amd(u8 family, const u8 *data, -- size_t size) -+static enum ucode_state __load_microcode_amd(u8 family, const u8 *data, size_t size) - { - u8 *fw = (u8 *)data; - size_t offset; -@@ -853,21 +1047,30 @@ static enum ucode_state __load_microcode_amd(u8 family, const u8 *data, - return UCODE_OK; - } - --static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size) -+static enum ucode_state _load_microcode_amd(u8 family, const u8 *data, size_t size) - { -- struct cpuinfo_x86 *c; -- unsigned int nid, cpu; -- struct ucode_patch *p; - enum ucode_state ret; - - /* free old equiv table */ - free_equiv_cpu_table(); - - ret = __load_microcode_amd(family, data, size); -- if (ret != UCODE_OK) { -+ if (ret != UCODE_OK) - cleanup(); -+ -+ return ret; -+} -+ -+static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size) -+{ -+ struct cpuinfo_x86 *c; -+ unsigned int nid, cpu; -+ struct ucode_patch *p; -+ enum ucode_state ret; -+ -+ ret = _load_microcode_amd(family, data, size); -+ if (ret != UCODE_OK) - return ret; -- } - - for_each_node(nid) { - cpu = cpumask_first(cpumask_of_node(nid)); -@@ -886,6 +1089,32 @@ static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t siz - return ret; - } - -+static int __init save_microcode_in_initrd(void) -+{ -+ unsigned int cpuid_1_eax = native_cpuid_eax(1); -+ struct cpuinfo_x86 *c = &boot_cpu_data; -+ struct cont_desc desc = { 0 }; -+ enum ucode_state ret; -+ struct cpio_data cp; -+ -+ if (dis_ucode_ldr || c->x86_vendor != X86_VENDOR_AMD || c->x86 < 0x10) -+ return 0; -+ -+ if (!find_blobs_in_containers(&cp)) -+ return -EINVAL; -+ -+ scan_containers(cp.data, cp.size, &desc); -+ if (!desc.mc) -+ return -EINVAL; -+ -+ ret = _load_microcode_amd(x86_family(cpuid_1_eax), desc.data, desc.size); -+ if (ret > UCODE_UPDATED) -+ return -EINVAL; -+ -+ return 0; -+} -+early_initcall(save_microcode_in_initrd); -+ - /* - * AMD microcode firmware naming convention, up to family 15h they are in - * the legacy file: -@@ -909,6 +1138,9 @@ static enum ucode_state request_microcode_amd(int cpu, struct device *device) - enum ucode_state ret = UCODE_NFOUND; - const struct firmware *fw; - -+ if (force_minrev) -+ return UCODE_NFOUND; -+ - if (c->x86 >= 0x15) - snprintf(fw_name, sizeof(fw_name), "amd-ucode/microcode_amd_fam%.2xh.bin", c->x86); - -@@ -918,7 +1150,7 @@ static enum ucode_state request_microcode_amd(int cpu, struct device *device) - } - - ret = UCODE_ERROR; -- if (!verify_container(fw->data, fw->size, false)) -+ if (!verify_container(fw->data, fw->size)) - goto fw_release; - - ret = load_microcode_amd(c->x86, fw->data, fw->size); -@@ -938,10 +1170,11 @@ static void microcode_fini_cpu_amd(int cpu) - } - - static struct microcode_ops microcode_amd_ops = { -- .request_microcode_fw = request_microcode_amd, -- .collect_cpu_info = collect_cpu_info_amd, -- .apply_microcode = apply_microcode_amd, -- .microcode_fini_cpu = microcode_fini_cpu_amd, -+ .request_microcode_fw = request_microcode_amd, -+ .collect_cpu_info = collect_cpu_info_amd, -+ .apply_microcode = apply_microcode_amd, -+ .microcode_fini_cpu = microcode_fini_cpu_amd, -+ .nmi_safe = true, - }; - - struct microcode_ops * __init init_amd_microcode(void) -@@ -952,11 +1185,6 @@ struct microcode_ops * __init init_amd_microcode(void) - pr_warn("AMD CPU family 0x%x not supported\n", c->x86); - return NULL; - } -- -- if (ucode_new_rev) -- pr_info_once("microcode updated early to new patch_level=0x%08x\n", -- ucode_new_rev); -- - return µcode_amd_ops; - } - -diff --git a/arch/x86/kernel/cpu/microcode/amd_shas.c b/arch/x86/kernel/cpu/microcode/amd_shas.c -new file mode 100644 -index 00000000000000..2a1655b1fdd883 ---- /dev/null -+++ b/arch/x86/kernel/cpu/microcode/amd_shas.c -@@ -0,0 +1,444 @@ -+/* Keep 'em sorted. */ -+static const struct patch_digest phashes[] = { -+ { 0x8001227, { -+ 0x99,0xc0,0x9b,0x2b,0xcc,0x9f,0x52,0x1b, -+ 0x1a,0x5f,0x1d,0x83,0xa1,0x6c,0xc4,0x46, -+ 0xe2,0x6c,0xda,0x73,0xfb,0x2d,0x23,0xa8, -+ 0x77,0xdc,0x15,0x31,0x33,0x4a,0x46,0x18, -+ } -+ }, -+ { 0x8001250, { -+ 0xc0,0x0b,0x6b,0x19,0xfd,0x5c,0x39,0x60, -+ 0xd5,0xc3,0x57,0x46,0x54,0xe4,0xd1,0xaa, -+ 0xa8,0xf7,0x1f,0xa8,0x6a,0x60,0x3e,0xe3, -+ 0x27,0x39,0x8e,0x53,0x30,0xf8,0x49,0x19, -+ } -+ }, -+ { 0x800126e, { -+ 0xf3,0x8b,0x2b,0xb6,0x34,0xe3,0xc8,0x2c, -+ 0xef,0xec,0x63,0x6d,0xc8,0x76,0x77,0xb3, -+ 0x25,0x5a,0xb7,0x52,0x8c,0x83,0x26,0xe6, -+ 0x4c,0xbe,0xbf,0xe9,0x7d,0x22,0x6a,0x43, -+ } -+ }, -+ { 0x800126f, { -+ 0x2b,0x5a,0xf2,0x9c,0xdd,0xd2,0x7f,0xec, -+ 0xec,0x96,0x09,0x57,0xb0,0x96,0x29,0x8b, -+ 0x2e,0x26,0x91,0xf0,0x49,0x33,0x42,0x18, -+ 0xdd,0x4b,0x65,0x5a,0xd4,0x15,0x3d,0x33, -+ } -+ }, -+ { 0x800820d, { -+ 0x68,0x98,0x83,0xcd,0x22,0x0d,0xdd,0x59, -+ 0x73,0x2c,0x5b,0x37,0x1f,0x84,0x0e,0x67, -+ 0x96,0x43,0x83,0x0c,0x46,0x44,0xab,0x7c, -+ 0x7b,0x65,0x9e,0x57,0xb5,0x90,0x4b,0x0e, -+ } -+ }, -+ { 0x8301025, { -+ 0xe4,0x7d,0xdb,0x1e,0x14,0xb4,0x5e,0x36, -+ 0x8f,0x3e,0x48,0x88,0x3c,0x6d,0x76,0xa1, -+ 0x59,0xc6,0xc0,0x72,0x42,0xdf,0x6c,0x30, -+ 0x6f,0x0b,0x28,0x16,0x61,0xfc,0x79,0x77, -+ } -+ }, -+ { 0x8301055, { -+ 0x81,0x7b,0x99,0x1b,0xae,0x2d,0x4f,0x9a, -+ 0xef,0x13,0xce,0xb5,0x10,0xaf,0x6a,0xea, -+ 0xe5,0xb0,0x64,0x98,0x10,0x68,0x34,0x3b, -+ 0x9d,0x7a,0xd6,0x22,0x77,0x5f,0xb3,0x5b, -+ } -+ }, -+ { 0x8301072, { -+ 0xcf,0x76,0xa7,0x1a,0x49,0xdf,0x2a,0x5e, -+ 0x9e,0x40,0x70,0xe5,0xdd,0x8a,0xa8,0x28, -+ 0x20,0xdc,0x91,0xd8,0x2c,0xa6,0xa0,0xb1, -+ 0x2d,0x22,0x26,0x94,0x4b,0x40,0x85,0x30, -+ } -+ }, -+ { 0x830107a, { -+ 0x2a,0x65,0x8c,0x1a,0x5e,0x07,0x21,0x72, -+ 0xdf,0x90,0xa6,0x51,0x37,0xd3,0x4b,0x34, -+ 0xc4,0xda,0x03,0xe1,0x8a,0x6c,0xfb,0x20, -+ 0x04,0xb2,0x81,0x05,0xd4,0x87,0xf4,0x0a, -+ } -+ }, -+ { 0x830107b, { -+ 0xb3,0x43,0x13,0x63,0x56,0xc1,0x39,0xad, -+ 0x10,0xa6,0x2b,0xcc,0x02,0xe6,0x76,0x2a, -+ 0x1e,0x39,0x58,0x3e,0x23,0x6e,0xa4,0x04, -+ 0x95,0xea,0xf9,0x6d,0xc2,0x8a,0x13,0x19, -+ } -+ }, -+ { 0x830107c, { -+ 0x21,0x64,0xde,0xfb,0x9f,0x68,0x96,0x47, -+ 0x70,0x5c,0xe2,0x8f,0x18,0x52,0x6a,0xac, -+ 0xa4,0xd2,0x2e,0xe0,0xde,0x68,0x66,0xc3, -+ 0xeb,0x1e,0xd3,0x3f,0xbc,0x51,0x1d,0x38, -+ } -+ }, -+ { 0x860010d, { -+ 0x86,0xb6,0x15,0x83,0xbc,0x3b,0x9c,0xe0, -+ 0xb3,0xef,0x1d,0x99,0x84,0x35,0x15,0xf7, -+ 0x7c,0x2a,0xc6,0x42,0xdb,0x73,0x07,0x5c, -+ 0x7d,0xc3,0x02,0xb5,0x43,0x06,0x5e,0xf8, -+ } -+ }, -+ { 0x8608108, { -+ 0x14,0xfe,0x57,0x86,0x49,0xc8,0x68,0xe2, -+ 0x11,0xa3,0xcb,0x6e,0xff,0x6e,0xd5,0x38, -+ 0xfe,0x89,0x1a,0xe0,0x67,0xbf,0xc4,0xcc, -+ 0x1b,0x9f,0x84,0x77,0x2b,0x9f,0xaa,0xbd, -+ } -+ }, -+ { 0x8701034, { -+ 0xc3,0x14,0x09,0xa8,0x9c,0x3f,0x8d,0x83, -+ 0x9b,0x4c,0xa5,0xb7,0x64,0x8b,0x91,0x5d, -+ 0x85,0x6a,0x39,0x26,0x1e,0x14,0x41,0xa8, -+ 0x75,0xea,0xa6,0xf9,0xc9,0xd1,0xea,0x2b, -+ } -+ }, -+ { 0x8a00008, { -+ 0xd7,0x2a,0x93,0xdc,0x05,0x2f,0xa5,0x6e, -+ 0x0c,0x61,0x2c,0x07,0x9f,0x38,0xe9,0x8e, -+ 0xef,0x7d,0x2a,0x05,0x4d,0x56,0xaf,0x72, -+ 0xe7,0x56,0x47,0x6e,0x60,0x27,0xd5,0x8c, -+ } -+ }, -+ { 0x8a0000a, { -+ 0x73,0x31,0x26,0x22,0xd4,0xf9,0xee,0x3c, -+ 0x07,0x06,0xe7,0xb9,0xad,0xd8,0x72,0x44, -+ 0x33,0x31,0xaa,0x7d,0xc3,0x67,0x0e,0xdb, -+ 0x47,0xb5,0xaa,0xbc,0xf5,0xbb,0xd9,0x20, -+ } -+ }, -+ { 0xa00104c, { -+ 0x3c,0x8a,0xfe,0x04,0x62,0xd8,0x6d,0xbe, -+ 0xa7,0x14,0x28,0x64,0x75,0xc0,0xa3,0x76, -+ 0xb7,0x92,0x0b,0x97,0x0a,0x8e,0x9c,0x5b, -+ 0x1b,0xc8,0x9d,0x3a,0x1e,0x81,0x3d,0x3b, -+ } -+ }, -+ { 0xa00104e, { -+ 0xc4,0x35,0x82,0x67,0xd2,0x86,0xe5,0xb2, -+ 0xfd,0x69,0x12,0x38,0xc8,0x77,0xba,0xe0, -+ 0x70,0xf9,0x77,0x89,0x10,0xa6,0x74,0x4e, -+ 0x56,0x58,0x13,0xf5,0x84,0x70,0x28,0x0b, -+ } -+ }, -+ { 0xa001053, { -+ 0x92,0x0e,0xf4,0x69,0x10,0x3b,0xf9,0x9d, -+ 0x31,0x1b,0xa6,0x99,0x08,0x7d,0xd7,0x25, -+ 0x7e,0x1e,0x89,0xba,0x35,0x8d,0xac,0xcb, -+ 0x3a,0xb4,0xdf,0x58,0x12,0xcf,0xc0,0xc3, -+ } -+ }, -+ { 0xa001058, { -+ 0x33,0x7d,0xa9,0xb5,0x4e,0x62,0x13,0x36, -+ 0xef,0x66,0xc9,0xbd,0x0a,0xa6,0x3b,0x19, -+ 0xcb,0xf5,0xc2,0xc3,0x55,0x47,0x20,0xec, -+ 0x1f,0x7b,0xa1,0x44,0x0e,0x8e,0xa4,0xb2, -+ } -+ }, -+ { 0xa001075, { -+ 0x39,0x02,0x82,0xd0,0x7c,0x26,0x43,0xe9, -+ 0x26,0xa3,0xd9,0x96,0xf7,0x30,0x13,0x0a, -+ 0x8a,0x0e,0xac,0xe7,0x1d,0xdc,0xe2,0x0f, -+ 0xcb,0x9e,0x8d,0xbc,0xd2,0xa2,0x44,0xe0, -+ } -+ }, -+ { 0xa001078, { -+ 0x2d,0x67,0xc7,0x35,0xca,0xef,0x2f,0x25, -+ 0x4c,0x45,0x93,0x3f,0x36,0x01,0x8c,0xce, -+ 0xa8,0x5b,0x07,0xd3,0xc1,0x35,0x3c,0x04, -+ 0x20,0xa2,0xfc,0xdc,0xe6,0xce,0x26,0x3e, -+ } -+ }, -+ { 0xa001079, { -+ 0x43,0xe2,0x05,0x9c,0xfd,0xb7,0x5b,0xeb, -+ 0x5b,0xe9,0xeb,0x3b,0x96,0xf4,0xe4,0x93, -+ 0x73,0x45,0x3e,0xac,0x8d,0x3b,0xe4,0xdb, -+ 0x10,0x31,0xc1,0xe4,0xa2,0xd0,0x5a,0x8a, -+ } -+ }, -+ { 0xa00107a, { -+ 0x5f,0x92,0xca,0xff,0xc3,0x59,0x22,0x5f, -+ 0x02,0xa0,0x91,0x3b,0x4a,0x45,0x10,0xfd, -+ 0x19,0xe1,0x8a,0x6d,0x9a,0x92,0xc1,0x3f, -+ 0x75,0x78,0xac,0x78,0x03,0x1d,0xdb,0x18, -+ } -+ }, -+ { 0xa001143, { -+ 0x56,0xca,0xf7,0x43,0x8a,0x4c,0x46,0x80, -+ 0xec,0xde,0xe5,0x9c,0x50,0x84,0x9a,0x42, -+ 0x27,0xe5,0x51,0x84,0x8f,0x19,0xc0,0x8d, -+ 0x0c,0x25,0xb4,0xb0,0x8f,0x10,0xf3,0xf8, -+ } -+ }, -+ { 0xa001144, { -+ 0x42,0xd5,0x9b,0xa7,0xd6,0x15,0x29,0x41, -+ 0x61,0xc4,0x72,0x3f,0xf3,0x06,0x78,0x4b, -+ 0x65,0xf3,0x0e,0xfa,0x9c,0x87,0xde,0x25, -+ 0xbd,0xb3,0x9a,0xf4,0x75,0x13,0x53,0xdc, -+ } -+ }, -+ { 0xa00115d, { -+ 0xd4,0xc4,0x49,0x36,0x89,0x0b,0x47,0xdd, -+ 0xfb,0x2f,0x88,0x3b,0x5f,0xf2,0x8e,0x75, -+ 0xc6,0x6c,0x37,0x5a,0x90,0x25,0x94,0x3e, -+ 0x36,0x9c,0xae,0x02,0x38,0x6c,0xf5,0x05, -+ } -+ }, -+ { 0xa001173, { -+ 0x28,0xbb,0x9b,0xd1,0xa0,0xa0,0x7e,0x3a, -+ 0x59,0x20,0xc0,0xa9,0xb2,0x5c,0xc3,0x35, -+ 0x53,0x89,0xe1,0x4c,0x93,0x2f,0x1d,0xc3, -+ 0xe5,0xf7,0xf3,0xc8,0x9b,0x61,0xaa,0x9e, -+ } -+ }, -+ { 0xa0011a8, { -+ 0x97,0xc6,0x16,0x65,0x99,0xa4,0x85,0x3b, -+ 0xf6,0xce,0xaa,0x49,0x4a,0x3a,0xc5,0xb6, -+ 0x78,0x25,0xbc,0x53,0xaf,0x5d,0xcf,0xf4, -+ 0x23,0x12,0xbb,0xb1,0xbc,0x8a,0x02,0x2e, -+ } -+ }, -+ { 0xa0011ce, { -+ 0xcf,0x1c,0x90,0xa3,0x85,0x0a,0xbf,0x71, -+ 0x94,0x0e,0x80,0x86,0x85,0x4f,0xd7,0x86, -+ 0xae,0x38,0x23,0x28,0x2b,0x35,0x9b,0x4e, -+ 0xfe,0xb8,0xcd,0x3d,0x3d,0x39,0xc9,0x6a, -+ } -+ }, -+ { 0xa0011d1, { -+ 0xdf,0x0e,0xca,0xde,0xf6,0xce,0x5c,0x1e, -+ 0x4c,0xec,0xd7,0x71,0x83,0xcc,0xa8,0x09, -+ 0xc7,0xc5,0xfe,0xb2,0xf7,0x05,0xd2,0xc5, -+ 0x12,0xdd,0xe4,0xf3,0x92,0x1c,0x3d,0xb8, -+ } -+ }, -+ { 0xa0011d3, { -+ 0x91,0xe6,0x10,0xd7,0x57,0xb0,0x95,0x0b, -+ 0x9a,0x24,0xee,0xf7,0xcf,0x56,0xc1,0xa6, -+ 0x4a,0x52,0x7d,0x5f,0x9f,0xdf,0xf6,0x00, -+ 0x65,0xf7,0xea,0xe8,0x2a,0x88,0xe2,0x26, -+ } -+ }, -+ { 0xa0011d5, { -+ 0xed,0x69,0x89,0xf4,0xeb,0x64,0xc2,0x13, -+ 0xe0,0x51,0x1f,0x03,0x26,0x52,0x7d,0xb7, -+ 0x93,0x5d,0x65,0xca,0xb8,0x12,0x1d,0x62, -+ 0x0d,0x5b,0x65,0x34,0x69,0xb2,0x62,0x21, -+ } -+ }, -+ { 0xa001223, { -+ 0xfb,0x32,0x5f,0xc6,0x83,0x4f,0x8c,0xb8, -+ 0xa4,0x05,0xf9,0x71,0x53,0x01,0x16,0xc4, -+ 0x83,0x75,0x94,0xdd,0xeb,0x7e,0xb7,0x15, -+ 0x8e,0x3b,0x50,0x29,0x8a,0x9c,0xcc,0x45, -+ } -+ }, -+ { 0xa001224, { -+ 0x0e,0x0c,0xdf,0xb4,0x89,0xee,0x35,0x25, -+ 0xdd,0x9e,0xdb,0xc0,0x69,0x83,0x0a,0xad, -+ 0x26,0xa9,0xaa,0x9d,0xfc,0x3c,0xea,0xf9, -+ 0x6c,0xdc,0xd5,0x6d,0x8b,0x6e,0x85,0x4a, -+ } -+ }, -+ { 0xa001227, { -+ 0xab,0xc6,0x00,0x69,0x4b,0x50,0x87,0xad, -+ 0x5f,0x0e,0x8b,0xea,0x57,0x38,0xce,0x1d, -+ 0x0f,0x75,0x26,0x02,0xf6,0xd6,0x96,0xe9, -+ 0x87,0xb9,0xd6,0x20,0x27,0x7c,0xd2,0xe0, -+ } -+ }, -+ { 0xa001229, { -+ 0x7f,0x49,0x49,0x48,0x46,0xa5,0x50,0xa6, -+ 0x28,0x89,0x98,0xe2,0x9e,0xb4,0x7f,0x75, -+ 0x33,0xa7,0x04,0x02,0xe4,0x82,0xbf,0xb4, -+ 0xa5,0x3a,0xba,0x24,0x8d,0x31,0x10,0x1d, -+ } -+ }, -+ { 0xa00122e, { -+ 0x56,0x94,0xa9,0x5d,0x06,0x68,0xfe,0xaf, -+ 0xdf,0x7a,0xff,0x2d,0xdf,0x74,0x0f,0x15, -+ 0x66,0xfb,0x00,0xb5,0x51,0x97,0x9b,0xfa, -+ 0xcb,0x79,0x85,0x46,0x25,0xb4,0xd2,0x10, -+ } -+ }, -+ { 0xa001231, { -+ 0x0b,0x46,0xa5,0xfc,0x18,0x15,0xa0,0x9e, -+ 0xa6,0xdc,0xb7,0xff,0x17,0xf7,0x30,0x64, -+ 0xd4,0xda,0x9e,0x1b,0xc3,0xfc,0x02,0x3b, -+ 0xe2,0xc6,0x0e,0x41,0x54,0xb5,0x18,0xdd, -+ } -+ }, -+ { 0xa001234, { -+ 0x88,0x8d,0xed,0xab,0xb5,0xbd,0x4e,0xf7, -+ 0x7f,0xd4,0x0e,0x95,0x34,0x91,0xff,0xcc, -+ 0xfb,0x2a,0xcd,0xf7,0xd5,0xdb,0x4c,0x9b, -+ 0xd6,0x2e,0x73,0x50,0x8f,0x83,0x79,0x1a, -+ } -+ }, -+ { 0xa001236, { -+ 0x3d,0x30,0x00,0xb9,0x71,0xba,0x87,0x78, -+ 0xa8,0x43,0x55,0xc4,0x26,0x59,0xcf,0x9d, -+ 0x93,0xce,0x64,0x0e,0x8b,0x72,0x11,0x8b, -+ 0xa3,0x8f,0x51,0xe9,0xca,0x98,0xaa,0x25, -+ } -+ }, -+ { 0xa001238, { -+ 0x72,0xf7,0x4b,0x0c,0x7d,0x58,0x65,0xcc, -+ 0x00,0xcc,0x57,0x16,0x68,0x16,0xf8,0x2a, -+ 0x1b,0xb3,0x8b,0xe1,0xb6,0x83,0x8c,0x7e, -+ 0xc0,0xcd,0x33,0xf2,0x8d,0xf9,0xef,0x59, -+ } -+ }, -+ { 0xa00820c, { -+ 0xa8,0x0c,0x81,0xc0,0xa6,0x00,0xe7,0xf3, -+ 0x5f,0x65,0xd3,0xb9,0x6f,0xea,0x93,0x63, -+ 0xf1,0x8c,0x88,0x45,0xd7,0x82,0x80,0xd1, -+ 0xe1,0x3b,0x8d,0xb2,0xf8,0x22,0x03,0xe2, -+ } -+ }, -+ { 0xa10113e, { -+ 0x05,0x3c,0x66,0xd7,0xa9,0x5a,0x33,0x10, -+ 0x1b,0xf8,0x9c,0x8f,0xed,0xfc,0xa7,0xa0, -+ 0x15,0xe3,0x3f,0x4b,0x1d,0x0d,0x0a,0xd5, -+ 0xfa,0x90,0xc4,0xed,0x9d,0x90,0xaf,0x53, -+ } -+ }, -+ { 0xa101144, { -+ 0xb3,0x0b,0x26,0x9a,0xf8,0x7c,0x02,0x26, -+ 0x35,0x84,0x53,0xa4,0xd3,0x2c,0x7c,0x09, -+ 0x68,0x7b,0x96,0xb6,0x93,0xef,0xde,0xbc, -+ 0xfd,0x4b,0x15,0xd2,0x81,0xd3,0x51,0x47, -+ } -+ }, -+ { 0xa101148, { -+ 0x20,0xd5,0x6f,0x40,0x4a,0xf6,0x48,0x90, -+ 0xc2,0x93,0x9a,0xc2,0xfd,0xac,0xef,0x4f, -+ 0xfa,0xc0,0x3d,0x92,0x3c,0x6d,0x01,0x08, -+ 0xf1,0x5e,0xb0,0xde,0xb4,0x98,0xae,0xc4, -+ } -+ }, -+ { 0xa10123e, { -+ 0x03,0xb9,0x2c,0x76,0x48,0x93,0xc9,0x18, -+ 0xfb,0x56,0xfd,0xf7,0xe2,0x1d,0xca,0x4d, -+ 0x1d,0x13,0x53,0x63,0xfe,0x42,0x6f,0xfc, -+ 0x19,0x0f,0xf1,0xfc,0xa7,0xdd,0x89,0x1b, -+ } -+ }, -+ { 0xa101244, { -+ 0x71,0x56,0xb5,0x9f,0x21,0xbf,0xb3,0x3c, -+ 0x8c,0xd7,0x36,0xd0,0x34,0x52,0x1b,0xb1, -+ 0x46,0x2f,0x04,0xf0,0x37,0xd8,0x1e,0x72, -+ 0x24,0xa2,0x80,0x84,0x83,0x65,0x84,0xc0, -+ } -+ }, -+ { 0xa101248, { -+ 0xed,0x3b,0x95,0xa6,0x68,0xa7,0x77,0x3e, -+ 0xfc,0x17,0x26,0xe2,0x7b,0xd5,0x56,0x22, -+ 0x2c,0x1d,0xef,0xeb,0x56,0xdd,0xba,0x6e, -+ 0x1b,0x7d,0x64,0x9d,0x4b,0x53,0x13,0x75, -+ } -+ }, -+ { 0xa108108, { -+ 0xed,0xc2,0xec,0xa1,0x15,0xc6,0x65,0xe9, -+ 0xd0,0xef,0x39,0xaa,0x7f,0x55,0x06,0xc6, -+ 0xf5,0xd4,0x3f,0x7b,0x14,0xd5,0x60,0x2c, -+ 0x28,0x1e,0x9c,0x59,0x69,0x99,0x4d,0x16, -+ } -+ }, -+ { 0xa20102d, { -+ 0xf9,0x6e,0xf2,0x32,0xd3,0x0f,0x5f,0x11, -+ 0x59,0xa1,0xfe,0xcc,0xcd,0x9b,0x42,0x89, -+ 0x8b,0x89,0x2f,0xb5,0xbb,0x82,0xef,0x23, -+ 0x8c,0xe9,0x19,0x3e,0xcc,0x3f,0x7b,0xb4, -+ } -+ }, -+ { 0xa201210, { -+ 0xe8,0x6d,0x51,0x6a,0x8e,0x72,0xf3,0xfe, -+ 0x6e,0x16,0xbc,0x62,0x59,0x40,0x17,0xe9, -+ 0x6d,0x3d,0x0e,0x6b,0xa7,0xac,0xe3,0x68, -+ 0xf7,0x55,0xf0,0x13,0xbb,0x22,0xf6,0x41, -+ } -+ }, -+ { 0xa404107, { -+ 0xbb,0x04,0x4e,0x47,0xdd,0x5e,0x26,0x45, -+ 0x1a,0xc9,0x56,0x24,0xa4,0x4c,0x82,0xb0, -+ 0x8b,0x0d,0x9f,0xf9,0x3a,0xdf,0xc6,0x81, -+ 0x13,0xbc,0xc5,0x25,0xe4,0xc5,0xc3,0x99, -+ } -+ }, -+ { 0xa500011, { -+ 0x23,0x3d,0x70,0x7d,0x03,0xc3,0xc4,0xf4, -+ 0x2b,0x82,0xc6,0x05,0xda,0x80,0x0a,0xf1, -+ 0xd7,0x5b,0x65,0x3a,0x7d,0xab,0xdf,0xa2, -+ 0x11,0x5e,0x96,0x7e,0x71,0xe9,0xfc,0x74, -+ } -+ }, -+ { 0xa601209, { -+ 0x66,0x48,0xd4,0x09,0x05,0xcb,0x29,0x32, -+ 0x66,0xb7,0x9a,0x76,0xcd,0x11,0xf3,0x30, -+ 0x15,0x86,0xcc,0x5d,0x97,0x0f,0xc0,0x46, -+ 0xe8,0x73,0xe2,0xd6,0xdb,0xd2,0x77,0x1d, -+ } -+ }, -+ { 0xa704107, { -+ 0xf3,0xc6,0x58,0x26,0xee,0xac,0x3f,0xd6, -+ 0xce,0xa1,0x72,0x47,0x3b,0xba,0x2b,0x93, -+ 0x2a,0xad,0x8e,0x6b,0xea,0x9b,0xb7,0xc2, -+ 0x64,0x39,0x71,0x8c,0xce,0xe7,0x41,0x39, -+ } -+ }, -+ { 0xa705206, { -+ 0x8d,0xc0,0x76,0xbd,0x58,0x9f,0x8f,0xa4, -+ 0x12,0x9d,0x21,0xfb,0x48,0x21,0xbc,0xe7, -+ 0x67,0x6f,0x04,0x18,0xae,0x20,0x87,0x4b, -+ 0x03,0x35,0xe9,0xbe,0xfb,0x06,0xdf,0xfc, -+ } -+ }, -+ { 0xa708007, { -+ 0x6b,0x76,0xcc,0x78,0xc5,0x8a,0xa3,0xe3, -+ 0x32,0x2d,0x79,0xe4,0xc3,0x80,0xdb,0xb2, -+ 0x07,0xaa,0x3a,0xe0,0x57,0x13,0x72,0x80, -+ 0xdf,0x92,0x73,0x84,0x87,0x3c,0x73,0x93, -+ } -+ }, -+ { 0xa70c005, { -+ 0x88,0x5d,0xfb,0x79,0x64,0xd8,0x46,0x3b, -+ 0x4a,0x83,0x8e,0x77,0x7e,0xcf,0xb3,0x0f, -+ 0x1f,0x1f,0xf1,0x97,0xeb,0xfe,0x56,0x55, -+ 0xee,0x49,0xac,0xe1,0x8b,0x13,0xc5,0x13, -+ } -+ }, -+ { 0xaa00116, { -+ 0xe8,0x4c,0x2c,0x88,0xa1,0xac,0x24,0x63, -+ 0x65,0xe5,0xaa,0x2d,0x16,0xa9,0xc3,0xf5, -+ 0xfe,0x1d,0x5e,0x65,0xc7,0xaa,0x92,0x4d, -+ 0x91,0xee,0x76,0xbb,0x4c,0x66,0x78,0xc9, -+ } -+ }, -+ { 0xaa00212, { -+ 0xbd,0x57,0x5d,0x0a,0x0a,0x30,0xc1,0x75, -+ 0x95,0x58,0x5e,0x93,0x02,0x28,0x43,0x71, -+ 0xed,0x42,0x29,0xc8,0xec,0x34,0x2b,0xb2, -+ 0x1a,0x65,0x4b,0xfe,0x07,0x0f,0x34,0xa1, -+ } -+ }, -+ { 0xaa00213, { -+ 0xed,0x58,0xb7,0x76,0x81,0x7f,0xd9,0x3a, -+ 0x1a,0xff,0x8b,0x34,0xb8,0x4a,0x99,0x0f, -+ 0x28,0x49,0x6c,0x56,0x2b,0xdc,0xb7,0xed, -+ 0x96,0xd5,0x9d,0xc1,0x7a,0xd4,0x51,0x9b, -+ } -+ }, -+ { 0xaa00215, { -+ 0x55,0xd3,0x28,0xcb,0x87,0xa9,0x32,0xe9, -+ 0x4e,0x85,0x4b,0x7c,0x6b,0xd5,0x7c,0xd4, -+ 0x1b,0x51,0x71,0x3a,0x0e,0x0b,0xdc,0x9b, -+ 0x68,0x2f,0x46,0xee,0xfe,0xc6,0x6d,0xef, -+ } -+ }, -+}; -diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c -index a4ebd5e0ae8287..c15c7b862bec1c 100644 ---- a/arch/x86/kernel/cpu/microcode/core.c -+++ b/arch/x86/kernel/cpu/microcode/core.c -@@ -23,6 +23,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -31,6 +32,7 @@ - #include - #include - -+#include - #include - #include - #include -@@ -42,11 +44,10 @@ - #define DRIVER_VERSION "2.2" - - static struct microcode_ops *microcode_ops; --static bool dis_ucode_ldr = true; -+bool dis_ucode_ldr = true; - --bool initrd_gone; -- --LIST_HEAD(microcode_cache); -+bool force_minrev = IS_ENABLED(CONFIG_MICROCODE_LATE_FORCE_MINREV); -+module_param(force_minrev, bool, S_IRUSR | S_IWUSR); - - /* - * Synchronization. -@@ -76,6 +77,8 @@ static u32 final_levels[] = { - 0, /* T-101 terminator */ - }; - -+struct early_load_data early_data; -+ - /* - * Check the current patch level on this CPU. - * -@@ -90,10 +93,7 @@ static bool amd_check_current_patch_level(void) - - native_rdmsr(MSR_AMD64_PATCH_LEVEL, lvl, dummy); - -- if (IS_ENABLED(CONFIG_X86_32)) -- levels = (u32 *)__pa_nodebug(&final_levels); -- else -- levels = final_levels; -+ levels = final_levels; - - for (i = 0; levels[i]; i++) { - if (lvl == levels[i]) -@@ -105,17 +105,8 @@ static bool amd_check_current_patch_level(void) - static bool __init check_loader_disabled_bsp(void) - { - static const char *__dis_opt_str = "dis_ucode_ldr"; -- --#ifdef CONFIG_X86_32 -- const char *cmdline = (const char *)__pa_nodebug(boot_command_line); -- const char *option = (const char *)__pa_nodebug(__dis_opt_str); -- bool *res = (bool *)__pa_nodebug(&dis_ucode_ldr); -- --#else /* CONFIG_X86_64 */ - const char *cmdline = boot_command_line; - const char *option = __dis_opt_str; -- bool *res = &dis_ucode_ldr; --#endif - - /* - * CPUID(1).ECX[31]: reserved for hypervisor use. This is still not -@@ -123,17 +114,17 @@ static bool __init check_loader_disabled_bsp(void) - * that's good enough as they don't land on the BSP path anyway. - */ - if (native_cpuid_ecx(1) & BIT(31)) -- return *res; -+ return true; - - if (x86_cpuid_vendor() == X86_VENDOR_AMD) { - if (amd_check_current_patch_level()) -- return *res; -+ return true; - } - - if (cmdline_find_option_bool(cmdline, option) <= 0) -- *res = false; -+ dis_ucode_ldr = false; - -- return *res; -+ return dis_ucode_ldr; - } - - void __init load_ucode_bsp(void) -@@ -166,25 +157,16 @@ void __init load_ucode_bsp(void) - return; - - if (intel) -- load_ucode_intel_bsp(); -+ load_ucode_intel_bsp(&early_data); - else -- load_ucode_amd_early(cpuid_1_eax); --} -- --static bool check_loader_disabled_ap(void) --{ --#ifdef CONFIG_X86_32 -- return *((bool *)__pa_nodebug(&dis_ucode_ldr)); --#else -- return dis_ucode_ldr; --#endif -+ load_ucode_amd_bsp(&early_data, cpuid_1_eax); - } - - void load_ucode_ap(void) - { - unsigned int cpuid_1_eax; - -- if (check_loader_disabled_ap()) -+ if (dis_ucode_ldr) - return; - - cpuid_1_eax = native_cpuid_eax(1); -@@ -196,103 +178,44 @@ void load_ucode_ap(void) - break; - case X86_VENDOR_AMD: - if (x86_family(cpuid_1_eax) >= 0x10) -- load_ucode_amd_early(cpuid_1_eax); -+ load_ucode_amd_ap(cpuid_1_eax); - break; - default: - break; - } - } - --static int __init save_microcode_in_initrd(void) --{ -- struct cpuinfo_x86 *c = &boot_cpu_data; -- int ret = -EINVAL; -- -- if (dis_ucode_ldr) { -- ret = 0; -- goto out; -- } -- -- switch (c->x86_vendor) { -- case X86_VENDOR_INTEL: -- if (c->x86 >= 6) -- ret = save_microcode_in_initrd_intel(); -- break; -- case X86_VENDOR_AMD: -- if (c->x86 >= 0x10) -- ret = save_microcode_in_initrd_amd(cpuid_eax(1)); -- break; -- default: -- break; -- } -- --out: -- initrd_gone = true; -- -- return ret; --} -- --struct cpio_data find_microcode_in_initrd(const char *path, bool use_pa) -+struct cpio_data __init find_microcode_in_initrd(const char *path) - { - #ifdef CONFIG_BLK_DEV_INITRD - unsigned long start = 0; - size_t size; - - #ifdef CONFIG_X86_32 -- struct boot_params *params; -- -- if (use_pa) -- params = (struct boot_params *)__pa_nodebug(&boot_params); -- else -- params = &boot_params; -- -- size = params->hdr.ramdisk_size; -- -- /* -- * Set start only if we have an initrd image. We cannot use initrd_start -- * because it is not set that early yet. -- */ -+ size = boot_params.hdr.ramdisk_size; -+ /* Early load on BSP has a temporary mapping. */ - if (size) -- start = params->hdr.ramdisk_image; -+ start = initrd_start_early; - --# else /* CONFIG_X86_64 */ -+#else /* CONFIG_X86_64 */ - size = (unsigned long)boot_params.ext_ramdisk_size << 32; - size |= boot_params.hdr.ramdisk_size; - - if (size) { - start = (unsigned long)boot_params.ext_ramdisk_image << 32; - start |= boot_params.hdr.ramdisk_image; -- - start += PAGE_OFFSET; - } --# endif -+#endif - - /* - * Fixup the start address: after reserve_initrd() runs, initrd_start - * has the virtual address of the beginning of the initrd. It also - * possibly relocates the ramdisk. In either case, initrd_start contains - * the updated address so use that instead. -- * -- * initrd_gone is for the hotplug case where we've thrown out initrd -- * already. - */ -- if (!use_pa) { -- if (initrd_gone) -- return (struct cpio_data){ NULL, 0, "" }; -- if (initrd_start) -- start = initrd_start; -- } else { -- /* -- * The picture with physical addresses is a bit different: we -- * need to get the *physical* address to which the ramdisk was -- * relocated, i.e., relocated_ramdisk (not initrd_start) and -- * since we're running from physical addresses, we need to access -- * relocated_ramdisk through its *physical* address too. -- */ -- u64 *rr = (u64 *)__pa_nodebug(&relocated_ramdisk); -- if (*rr) -- start = *rr; -- } -+ if (initrd_start) -+ start = initrd_start; - - return find_cpio_data(path, (void *)start, size, NULL); - #else /* !CONFIG_BLK_DEV_INITRD */ -@@ -336,117 +259,298 @@ static struct platform_device *microcode_pdev; - * requirement can be relaxed in the future. Right now, this is conservative - * and good. - */ --#define SPINUNIT 100 /* 100 nsec */ -+enum sibling_ctrl { -+ /* Spinwait with timeout */ -+ SCTRL_WAIT, -+ /* Invoke the microcode_apply() callback */ -+ SCTRL_APPLY, -+ /* Proceed without invoking the microcode_apply() callback */ -+ SCTRL_DONE, -+}; - --static int check_online_cpus(void) -+struct microcode_ctrl { -+ enum sibling_ctrl ctrl; -+ enum ucode_state result; -+ unsigned int ctrl_cpu; -+ bool nmi_enabled; -+}; -+ -+DEFINE_STATIC_KEY_FALSE(microcode_nmi_handler_enable); -+static DEFINE_PER_CPU(struct microcode_ctrl, ucode_ctrl); -+static atomic_t late_cpus_in, offline_in_nmi; -+static unsigned int loops_per_usec; -+static cpumask_t cpu_offline_mask; -+ -+static noinstr bool wait_for_cpus(atomic_t *cnt) - { -- unsigned int cpu; -+ unsigned int timeout, loops; - -- /* -- * Make sure all CPUs are online. It's fine for SMT to be disabled if -- * all the primary threads are still online. -- */ -- for_each_present_cpu(cpu) { -- if (topology_is_primary_thread(cpu) && !cpu_online(cpu)) { -- pr_err("Not all CPUs online, aborting microcode update.\n"); -- return -EINVAL; -+ WARN_ON_ONCE(raw_atomic_dec_return(cnt) < 0); -+ -+ for (timeout = 0; timeout < USEC_PER_SEC; timeout++) { -+ if (!raw_atomic_read(cnt)) -+ return true; -+ -+ for (loops = 0; loops < loops_per_usec; loops++) -+ cpu_relax(); -+ -+ /* If invoked directly, tickle the NMI watchdog */ -+ if (!microcode_ops->use_nmi && !(timeout % USEC_PER_MSEC)) { -+ instrumentation_begin(); -+ touch_nmi_watchdog(); -+ instrumentation_end(); - } - } -- -- return 0; -+ /* Prevent the late comers from making progress and let them time out */ -+ raw_atomic_inc(cnt); -+ return false; - } - --static atomic_t late_cpus_in; --static atomic_t late_cpus_out; -- --static int __wait_for_cpus(atomic_t *t, long long timeout) -+static noinstr bool wait_for_ctrl(void) - { -- int all_cpus = num_online_cpus(); -- -- atomic_inc(t); -+ unsigned int timeout, loops; - -- while (atomic_read(t) < all_cpus) { -- if (timeout < SPINUNIT) { -- pr_err("Timeout while waiting for CPUs rendezvous, remaining: %d\n", -- all_cpus - atomic_read(t)); -- return 1; -- } -+ for (timeout = 0; timeout < USEC_PER_SEC; timeout++) { -+ if (raw_cpu_read(ucode_ctrl.ctrl) != SCTRL_WAIT) -+ return true; - -- ndelay(SPINUNIT); -- timeout -= SPINUNIT; -+ for (loops = 0; loops < loops_per_usec; loops++) -+ cpu_relax(); - -- touch_nmi_watchdog(); -+ /* If invoked directly, tickle the NMI watchdog */ -+ if (!microcode_ops->use_nmi && !(timeout % USEC_PER_MSEC)) { -+ instrumentation_begin(); -+ touch_nmi_watchdog(); -+ instrumentation_end(); -+ } - } -- return 0; -+ return false; - } - - /* -- * Returns: -- * < 0 - on error -- * 0 - success (no update done or microcode was updated) -+ * Protected against instrumentation up to the point where the primary -+ * thread completed the update. See microcode_nmi_handler() for details. - */ --static int __reload_late(void *info) -+static noinstr bool load_secondary_wait(unsigned int ctrl_cpu) - { -- int cpu = smp_processor_id(); -- enum ucode_state err; -- int ret = 0; -+ /* Initial rendezvous to ensure that all CPUs have arrived */ -+ if (!wait_for_cpus(&late_cpus_in)) { -+ raw_cpu_write(ucode_ctrl.result, UCODE_TIMEOUT); -+ return false; -+ } - - /* -- * Wait for all CPUs to arrive. A load will not be attempted unless all -- * CPUs show up. -- * */ -- if (__wait_for_cpus(&late_cpus_in, NSEC_PER_SEC)) -- return -1; -+ * Wait for primary threads to complete. If one of them hangs due -+ * to the update, there is no way out. This is non-recoverable -+ * because the CPU might hold locks or resources and confuse the -+ * scheduler, watchdogs etc. There is no way to safely evacuate the -+ * machine. -+ */ -+ if (wait_for_ctrl()) -+ return true; -+ -+ instrumentation_begin(); -+ panic("Microcode load: Primary CPU %d timed out\n", ctrl_cpu); -+ instrumentation_end(); -+} -+ -+/* -+ * Protected against instrumentation up to the point where the primary -+ * thread completed the update. See microcode_nmi_handler() for details. -+ */ -+static noinstr void load_secondary(unsigned int cpu) -+{ -+ unsigned int ctrl_cpu = raw_cpu_read(ucode_ctrl.ctrl_cpu); -+ enum ucode_state ret; -+ -+ if (!load_secondary_wait(ctrl_cpu)) { -+ instrumentation_begin(); -+ pr_err_once("load: %d CPUs timed out\n", -+ atomic_read(&late_cpus_in) - 1); -+ instrumentation_end(); -+ return; -+ } - -+ /* Primary thread completed. Allow to invoke instrumentable code */ -+ instrumentation_begin(); - /* -- * On an SMT system, it suffices to load the microcode on one sibling of -- * the core because the microcode engine is shared between the threads. -- * Synchronization still needs to take place so that no concurrent -- * loading attempts happen on multiple threads of an SMT core. See -- * below. -+ * If the primary succeeded then invoke the apply() callback, -+ * otherwise copy the state from the primary thread. - */ -- if (cpumask_first(topology_sibling_cpumask(cpu)) == cpu) -- err = microcode_ops->apply_microcode(cpu); -+ if (this_cpu_read(ucode_ctrl.ctrl) == SCTRL_APPLY) -+ ret = microcode_ops->apply_microcode(cpu); - else -- goto wait_for_siblings; -+ ret = per_cpu(ucode_ctrl.result, ctrl_cpu); - -- if (err >= UCODE_NFOUND) { -- if (err == UCODE_ERROR) { -- pr_warn("Error reloading microcode on CPU %d\n", cpu); -- ret = -1; -- } -+ this_cpu_write(ucode_ctrl.result, ret); -+ this_cpu_write(ucode_ctrl.ctrl, SCTRL_DONE); -+ instrumentation_end(); -+} -+ -+static void __load_primary(unsigned int cpu) -+{ -+ struct cpumask *secondaries = topology_sibling_cpumask(cpu); -+ enum sibling_ctrl ctrl; -+ enum ucode_state ret; -+ unsigned int sibling; -+ -+ /* Initial rendezvous to ensure that all CPUs have arrived */ -+ if (!wait_for_cpus(&late_cpus_in)) { -+ this_cpu_write(ucode_ctrl.result, UCODE_TIMEOUT); -+ pr_err_once("load: %d CPUs timed out\n", atomic_read(&late_cpus_in) - 1); -+ return; - } - --wait_for_siblings: -- if (__wait_for_cpus(&late_cpus_out, NSEC_PER_SEC)) -- panic("Timeout during microcode update!\n"); -+ ret = microcode_ops->apply_microcode(cpu); -+ this_cpu_write(ucode_ctrl.result, ret); -+ this_cpu_write(ucode_ctrl.ctrl, SCTRL_DONE); - - /* -- * At least one thread has completed update on each core. -- * For others, simply call the update to make sure the -- * per-cpu cpuinfo can be updated with right microcode -- * revision. -+ * If the update was successful, let the siblings run the apply() -+ * callback. If not, tell them it's done. This also covers the -+ * case where the CPU has uniform loading at package or system -+ * scope implemented but does not advertise it. - */ -- if (cpumask_first(topology_sibling_cpumask(cpu)) != cpu) -- err = microcode_ops->apply_microcode(cpu); -+ if (ret == UCODE_UPDATED || ret == UCODE_OK) -+ ctrl = SCTRL_APPLY; -+ else -+ ctrl = SCTRL_DONE; -+ -+ for_each_cpu(sibling, secondaries) { -+ if (sibling != cpu) -+ per_cpu(ucode_ctrl.ctrl, sibling) = ctrl; -+ } -+} -+ -+static bool kick_offline_cpus(unsigned int nr_offl) -+{ -+ unsigned int cpu, timeout; -+ -+ for_each_cpu(cpu, &cpu_offline_mask) { -+ /* Enable the rendezvous handler and send NMI */ -+ per_cpu(ucode_ctrl.nmi_enabled, cpu) = true; -+ apic_send_nmi_to_offline_cpu(cpu); -+ } -+ -+ /* Wait for them to arrive */ -+ for (timeout = 0; timeout < (USEC_PER_SEC / 2); timeout++) { -+ if (atomic_read(&offline_in_nmi) == nr_offl) -+ return true; -+ udelay(1); -+ } -+ /* Let the others time out */ -+ return false; -+} -+ -+static void release_offline_cpus(void) -+{ -+ unsigned int cpu; -+ -+ for_each_cpu(cpu, &cpu_offline_mask) -+ per_cpu(ucode_ctrl.ctrl, cpu) = SCTRL_DONE; -+} -+ -+static void load_primary(unsigned int cpu) -+{ -+ unsigned int nr_offl = cpumask_weight(&cpu_offline_mask); -+ bool proceed = true; -+ -+ /* Kick soft-offlined SMT siblings if required */ -+ if (!cpu && nr_offl) -+ proceed = kick_offline_cpus(nr_offl); - -- return ret; -+ /* If the soft-offlined CPUs did not respond, abort */ -+ if (proceed) -+ __load_primary(cpu); -+ -+ /* Unconditionally release soft-offlined SMT siblings if required */ -+ if (!cpu && nr_offl) -+ release_offline_cpus(); - } - - /* -- * Reload microcode late on all CPUs. Wait for a sec until they -- * all gather together. -+ * Minimal stub rendezvous handler for soft-offlined CPUs which participate -+ * in the NMI rendezvous to protect against a concurrent NMI on affected -+ * CPUs. - */ --static int microcode_reload_late(void) -+void noinstr microcode_offline_nmi_handler(void) - { -- int old = boot_cpu_data.microcode, ret; -+ if (!raw_cpu_read(ucode_ctrl.nmi_enabled)) -+ return; -+ raw_cpu_write(ucode_ctrl.nmi_enabled, false); -+ raw_cpu_write(ucode_ctrl.result, UCODE_OFFLINE); -+ raw_atomic_inc(&offline_in_nmi); -+ wait_for_ctrl(); -+} -+ -+static noinstr bool microcode_update_handler(void) -+{ -+ unsigned int cpu = raw_smp_processor_id(); -+ -+ if (raw_cpu_read(ucode_ctrl.ctrl_cpu) == cpu) { -+ instrumentation_begin(); -+ load_primary(cpu); -+ instrumentation_end(); -+ } else { -+ load_secondary(cpu); -+ } -+ -+ instrumentation_begin(); -+ touch_nmi_watchdog(); -+ instrumentation_end(); -+ -+ return true; -+} -+ -+/* -+ * Protection against instrumentation is required for CPUs which are not -+ * safe against an NMI which is delivered to the secondary SMT sibling -+ * while the primary thread updates the microcode. Instrumentation can end -+ * up in #INT3, #DB and #PF. The IRET from those exceptions reenables NMI -+ * which is the opposite of what the NMI rendezvous is trying to achieve. -+ * -+ * The primary thread is safe versus instrumentation as the actual -+ * microcode update handles this correctly. It's only the sibling code -+ * path which must be NMI safe until the primary thread completed the -+ * update. -+ */ -+bool noinstr microcode_nmi_handler(void) -+{ -+ if (!raw_cpu_read(ucode_ctrl.nmi_enabled)) -+ return false; -+ -+ raw_cpu_write(ucode_ctrl.nmi_enabled, false); -+ return microcode_update_handler(); -+} -+ -+static int load_cpus_stopped(void *unused) -+{ -+ if (microcode_ops->use_nmi) { -+ /* Enable the NMI handler and raise NMI */ -+ this_cpu_write(ucode_ctrl.nmi_enabled, true); -+ apic->send_IPI(smp_processor_id(), NMI_VECTOR); -+ } else { -+ /* Just invoke the handler directly */ -+ microcode_update_handler(); -+ } -+ return 0; -+} -+ -+static int load_late_stop_cpus(bool is_safe) -+{ -+ unsigned int cpu, updated = 0, failed = 0, timedout = 0, siblings = 0; -+ unsigned int nr_offl, offline = 0; -+ int old_rev = boot_cpu_data.microcode; - struct cpuinfo_x86 prev_info; - -- pr_err("Attempting late microcode loading - it is dangerous and taints the kernel.\n"); -- pr_err("You should switch to early loading, if possible.\n"); -+ if (!is_safe) { -+ pr_err("Late microcode loading without minimal revision check.\n"); -+ pr_err("You should switch to early loading, if possible.\n"); -+ } - -- atomic_set(&late_cpus_in, 0); -- atomic_set(&late_cpus_out, 0); -+ atomic_set(&late_cpus_in, num_online_cpus()); -+ atomic_set(&offline_in_nmi, 0); -+ loops_per_usec = loops_per_jiffy / (TICK_NSEC / 1000); - - /* - * Take a snapshot before the microcode update in order to compare and -@@ -454,52 +558,162 @@ static int microcode_reload_late(void) - */ - store_cpu_caps(&prev_info); - -- ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask); -- if (!ret) { -- pr_info("Reload succeeded, microcode revision: 0x%x -> 0x%x\n", -- old, boot_cpu_data.microcode); -- microcode_check(&prev_info); -- } else { -- pr_info("Reload failed, current microcode revision: 0x%x\n", -- boot_cpu_data.microcode); -+ if (microcode_ops->use_nmi) -+ static_branch_enable_cpuslocked(µcode_nmi_handler_enable); -+ -+ stop_machine_cpuslocked(load_cpus_stopped, NULL, cpu_online_mask); -+ -+ if (microcode_ops->use_nmi) -+ static_branch_disable_cpuslocked(µcode_nmi_handler_enable); -+ -+ /* Analyze the results */ -+ for_each_cpu_and(cpu, cpu_present_mask, &cpus_booted_once_mask) { -+ switch (per_cpu(ucode_ctrl.result, cpu)) { -+ case UCODE_UPDATED: updated++; break; -+ case UCODE_TIMEOUT: timedout++; break; -+ case UCODE_OK: siblings++; break; -+ case UCODE_OFFLINE: offline++; break; -+ default: failed++; break; -+ } -+ } -+ -+ if (microcode_ops->finalize_late_load) -+ microcode_ops->finalize_late_load(!updated); -+ -+ if (!updated) { -+ /* Nothing changed. */ -+ if (!failed && !timedout) -+ return 0; -+ -+ nr_offl = cpumask_weight(&cpu_offline_mask); -+ if (offline < nr_offl) { -+ pr_warn("%u offline siblings did not respond.\n", -+ nr_offl - atomic_read(&offline_in_nmi)); -+ return -EIO; -+ } -+ pr_err("update failed: %u CPUs failed %u CPUs timed out\n", -+ failed, timedout); -+ return -EIO; -+ } -+ -+ if (!is_safe || failed || timedout) -+ add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK); -+ -+ pr_info("load: updated on %u primary CPUs with %u siblings\n", updated, siblings); -+ if (failed || timedout) { -+ pr_err("load incomplete. %u CPUs timed out or failed\n", -+ num_online_cpus() - (updated + siblings)); - } -+ pr_info("revision: 0x%x -> 0x%x\n", old_rev, boot_cpu_data.microcode); -+ microcode_check(&prev_info); - -- return ret; -+ return updated + siblings == num_online_cpus() ? 0 : -EIO; -+} -+ -+/* -+ * This function does two things: -+ * -+ * 1) Ensure that all required CPUs which are present and have been booted -+ * once are online. -+ * -+ * To pass this check, all primary threads must be online. -+ * -+ * If the microcode load is not safe against NMI then all SMT threads -+ * must be online as well because they still react to NMIs when they are -+ * soft-offlined and parked in one of the play_dead() variants. So if a -+ * NMI hits while the primary thread updates the microcode the resulting -+ * behaviour is undefined. The default play_dead() implementation on -+ * modern CPUs uses MWAIT, which is also not guaranteed to be safe -+ * against a microcode update which affects MWAIT. -+ * -+ * As soft-offlined CPUs still react on NMIs, the SMT sibling -+ * restriction can be lifted when the vendor driver signals to use NMI -+ * for rendezvous and the APIC provides a mechanism to send an NMI to a -+ * soft-offlined CPU. The soft-offlined CPUs are then able to -+ * participate in the rendezvous in a trivial stub handler. -+ * -+ * 2) Initialize the per CPU control structure and create a cpumask -+ * which contains "offline"; secondary threads, so they can be handled -+ * correctly by a control CPU. -+ */ -+static bool setup_cpus(void) -+{ -+ struct microcode_ctrl ctrl = { .ctrl = SCTRL_WAIT, .result = -1, }; -+ bool allow_smt_offline; -+ unsigned int cpu; -+ -+ allow_smt_offline = microcode_ops->nmi_safe || -+ (microcode_ops->use_nmi && apic->nmi_to_offline_cpu); -+ -+ cpumask_clear(&cpu_offline_mask); -+ -+ for_each_cpu_and(cpu, cpu_present_mask, &cpus_booted_once_mask) { -+ /* -+ * Offline CPUs sit in one of the play_dead() functions -+ * with interrupts disabled, but they still react on NMIs -+ * and execute arbitrary code. Also MWAIT being updated -+ * while the offline CPU sits there is not necessarily safe -+ * on all CPU variants. -+ * -+ * Mark them in the offline_cpus mask which will be handled -+ * by CPU0 later in the update process. -+ * -+ * Ensure that the primary thread is online so that it is -+ * guaranteed that all cores are updated. -+ */ -+ if (!cpu_online(cpu)) { -+ if (topology_is_primary_thread(cpu) || !allow_smt_offline) { -+ pr_err("CPU %u not online, loading aborted\n", cpu); -+ return false; -+ } -+ cpumask_set_cpu(cpu, &cpu_offline_mask); -+ per_cpu(ucode_ctrl, cpu) = ctrl; -+ continue; -+ } -+ -+ /* -+ * Initialize the per CPU state. This is core scope for now, -+ * but prepared to take package or system scope into account. -+ */ -+ ctrl.ctrl_cpu = cpumask_first(topology_sibling_cpumask(cpu)); -+ per_cpu(ucode_ctrl, cpu) = ctrl; -+ } -+ return true; -+} -+ -+static int load_late_locked(void) -+{ -+ if (!setup_cpus()) -+ return -EBUSY; -+ -+ switch (microcode_ops->request_microcode_fw(0, µcode_pdev->dev)) { -+ case UCODE_NEW: -+ return load_late_stop_cpus(false); -+ case UCODE_NEW_SAFE: -+ return load_late_stop_cpus(true); -+ case UCODE_NFOUND: -+ return -ENOENT; -+ default: -+ return -EBADFD; -+ } - } - - static ssize_t reload_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t size) - { -- enum ucode_state tmp_ret = UCODE_OK; -- int bsp = boot_cpu_data.cpu_index; - unsigned long val; -- ssize_t ret = 0; -+ ssize_t ret; - - ret = kstrtoul(buf, 0, &val); - if (ret || val != 1) - return -EINVAL; - - cpus_read_lock(); -- -- ret = check_online_cpus(); -- if (ret) -- goto put; -- -- tmp_ret = microcode_ops->request_microcode_fw(bsp, µcode_pdev->dev); -- if (tmp_ret != UCODE_NEW) -- goto put; -- -- ret = microcode_reload_late(); --put: -+ ret = load_late_locked(); - cpus_read_unlock(); - -- if (ret == 0) -- ret = size; -- -- add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK); -- -- return ret; -+ return ret ? : size; - } - - static DEVICE_ATTR_WO(reload); -@@ -541,17 +755,6 @@ static void microcode_fini_cpu(int cpu) - microcode_ops->microcode_fini_cpu(cpu); - } - --static enum ucode_state microcode_init_cpu(int cpu) --{ -- struct ucode_cpu_info *uci = ucode_cpu_info + cpu; -- -- memset(uci, 0, sizeof(*uci)); -- -- microcode_ops->collect_cpu_info(cpu, &uci->cpu_sig); -- -- return microcode_ops->apply_microcode(cpu); --} -- - /** - * microcode_bsp_resume - Update boot CPU microcode during resume. - */ -@@ -570,19 +773,18 @@ static struct syscore_ops mc_syscore_ops = { - .resume = microcode_bsp_resume, - }; - --static int mc_cpu_starting(unsigned int cpu) --{ -- enum ucode_state err = microcode_ops->apply_microcode(cpu); -- -- pr_debug("%s: CPU%d, err: %d\n", __func__, cpu, err); -- -- return err == UCODE_ERROR; --} -- - static int mc_cpu_online(unsigned int cpu) - { -+ struct ucode_cpu_info *uci = ucode_cpu_info + cpu; - struct device *dev = get_cpu_device(cpu); - -+ memset(uci, 0, sizeof(*uci)); -+ -+ microcode_ops->collect_cpu_info(cpu, &uci->cpu_sig); -+ cpu_data(cpu).microcode = uci->cpu_sig.rev; -+ if (!cpu) -+ boot_cpu_data.microcode = uci->cpu_sig.rev; -+ - if (sysfs_create_group(&dev->kobj, &mc_attr_group)) - pr_err("Failed to create group for CPU%d\n", cpu); - return 0; -@@ -590,33 +792,13 @@ static int mc_cpu_online(unsigned int cpu) - - static int mc_cpu_down_prep(unsigned int cpu) - { -- struct device *dev; -- -- dev = get_cpu_device(cpu); -+ struct device *dev = get_cpu_device(cpu); - - microcode_fini_cpu(cpu); -- -- /* Suspend is in progress, only remove the interface */ - sysfs_remove_group(&dev->kobj, &mc_attr_group); -- pr_debug("%s: CPU%d\n", __func__, cpu); -- - return 0; - } - --static void setup_online_cpu(struct work_struct *work) --{ -- int cpu = smp_processor_id(); -- enum ucode_state err; -- -- err = microcode_init_cpu(cpu); -- if (err == UCODE_ERROR) { -- pr_err("Error applying microcode on CPU%d\n", cpu); -- return; -- } -- -- mc_cpu_online(cpu); --} -- - static struct attribute *cpu_root_microcode_attrs[] = { - #ifdef CONFIG_MICROCODE_LATE_LOADING - &dev_attr_reload.attr, -@@ -648,6 +830,11 @@ static int __init microcode_init(void) - if (!microcode_ops) - return -ENODEV; - -+ pr_info_once("Current revision: 0x%08x\n", (early_data.new_rev ?: early_data.old_rev)); -+ -+ if (early_data.new_rev) -+ pr_info_once("Updated early from: 0x%08x\n", early_data.old_rev); -+ - microcode_pdev = platform_device_register_simple("microcode", -1, NULL, 0); - if (IS_ERR(microcode_pdev)) - return PTR_ERR(microcode_pdev); -@@ -662,14 +849,9 @@ static int __init microcode_init(void) - } - } - -- /* Do per-CPU setup */ -- schedule_on_each_cpu(setup_online_cpu); -- - register_syscore_ops(&mc_syscore_ops); -- cpuhp_setup_state_nocalls(CPUHP_AP_MICROCODE_LOADER, "x86/microcode:starting", -- mc_cpu_starting, NULL); -- cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN, "x86/microcode:online", -- mc_cpu_online, mc_cpu_down_prep); -+ cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "x86/microcode:online", -+ mc_cpu_online, mc_cpu_down_prep); - - pr_info("Microcode Update Driver: v%s.", DRIVER_VERSION); - -@@ -680,5 +862,4 @@ static int __init microcode_init(void) - return error; - - } --fs_initcall(save_microcode_in_initrd); - late_initcall(microcode_init); -diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c -index 94dd6af9c963a8..9d7baf2573bcde 100644 ---- a/arch/x86/kernel/cpu/microcode/intel.c -+++ b/arch/x86/kernel/cpu/microcode/intel.c -@@ -14,7 +14,6 @@ - #include - #include - #include --#include - #include - #include - #include -@@ -32,11 +31,14 @@ - - static const char ucode_path[] = "kernel/x86/microcode/GenuineIntel.bin"; - -+#define UCODE_BSP_LOADED ((struct microcode_intel *)0x1UL) -+ - /* Current microcode patch used in early patching on the APs. */ --static struct microcode_intel *intel_ucode_patch; -+static struct microcode_intel *ucode_patch_va __read_mostly; -+static struct microcode_intel *ucode_patch_late __read_mostly; - - /* last level cache size per core */ --static int llc_size_per_core; -+static unsigned int llc_size_per_core __ro_after_init; - - /* microcode format is extended from prescott processors */ - struct extended_signature { -@@ -66,60 +68,52 @@ static inline unsigned int exttable_size(struct extended_sigtable *et) - return et->count * EXT_SIGNATURE_SIZE + EXT_HEADER_SIZE; - } - --int intel_cpu_collect_info(struct ucode_cpu_info *uci) -+void intel_collect_cpu_info(struct cpu_signature *sig) - { -- unsigned int val[2]; -- unsigned int family, model; -- struct cpu_signature csig = { 0 }; -- unsigned int eax, ebx, ecx, edx; -- -- memset(uci, 0, sizeof(*uci)); -- -- eax = 0x00000001; -- ecx = 0; -- native_cpuid(&eax, &ebx, &ecx, &edx); -- csig.sig = eax; -+ sig->sig = cpuid_eax(1); -+ sig->pf = 0; -+ sig->rev = intel_get_microcode_revision(); - -- family = x86_family(eax); -- model = x86_model(eax); -+ if (x86_model(sig->sig) >= 5 || x86_family(sig->sig) > 6) { -+ unsigned int val[2]; - -- if (model >= 5 || family > 6) { - /* get processor flags from MSR 0x17 */ - native_rdmsr(MSR_IA32_PLATFORM_ID, val[0], val[1]); -- csig.pf = 1 << ((val[1] >> 18) & 7); -+ sig->pf = 1 << ((val[1] >> 18) & 7); - } -+} -+EXPORT_SYMBOL_GPL(intel_collect_cpu_info); - -- csig.rev = intel_get_microcode_revision(); -- -- uci->cpu_sig = csig; -+static inline bool cpu_signatures_match(struct cpu_signature *s1, unsigned int sig2, -+ unsigned int pf2) -+{ -+ if (s1->sig != sig2) -+ return false; - -- return 0; -+ /* Processor flags are either both 0 or they intersect. */ -+ return ((!s1->pf && !pf2) || (s1->pf & pf2)); - } --EXPORT_SYMBOL_GPL(intel_cpu_collect_info); - --/* -- * Returns 1 if update has been found, 0 otherwise. -- */ --int intel_find_matching_signature(void *mc, unsigned int csig, int cpf) -+bool intel_find_matching_signature(void *mc, struct cpu_signature *sig) - { - struct microcode_header_intel *mc_hdr = mc; -- struct extended_sigtable *ext_hdr; - struct extended_signature *ext_sig; -+ struct extended_sigtable *ext_hdr; - int i; - -- if (intel_cpu_signatures_match(csig, cpf, mc_hdr->sig, mc_hdr->pf)) -- return 1; -+ if (cpu_signatures_match(sig, mc_hdr->sig, mc_hdr->pf)) -+ return true; - - /* Look for ext. headers: */ - if (get_totalsize(mc_hdr) <= intel_microcode_get_datasize(mc_hdr) + MC_HEADER_SIZE) -- return 0; -+ return false; - - ext_hdr = mc + intel_microcode_get_datasize(mc_hdr) + MC_HEADER_SIZE; - ext_sig = (void *)ext_hdr + EXT_HEADER_SIZE; - - for (i = 0; i < ext_hdr->count; i++) { -- if (intel_cpu_signatures_match(csig, cpf, ext_sig->sig, ext_sig->pf)) -- return 1; -+ if (cpu_signatures_match(sig, ext_sig->sig, ext_sig->pf)) -+ return true; - ext_sig++; - } - return 0; -@@ -240,516 +234,245 @@ int intel_microcode_sanity_check(void *mc, bool print_err, int hdr_type) - } - EXPORT_SYMBOL_GPL(intel_microcode_sanity_check); - --/* -- * Returns 1 if update has been found, 0 otherwise. -- */ --static int has_newer_microcode(void *mc, unsigned int csig, int cpf, int new_rev) --{ -- struct microcode_header_intel *mc_hdr = mc; -- -- if (mc_hdr->rev <= new_rev) -- return 0; -- -- return intel_find_matching_signature(mc, csig, cpf); --} -- --static struct ucode_patch *memdup_patch(void *data, unsigned int size) --{ -- struct ucode_patch *p; -- -- p = kzalloc(sizeof(struct ucode_patch), GFP_KERNEL); -- if (!p) -- return NULL; -- -- p->data = kmemdup(data, size, GFP_KERNEL); -- if (!p->data) { -- kfree(p); -- return NULL; -- } -- -- return p; --} -- --static void save_microcode_patch(struct ucode_cpu_info *uci, void *data, unsigned int size) -+static void update_ucode_pointer(struct microcode_intel *mc) - { -- struct microcode_header_intel *mc_hdr, *mc_saved_hdr; -- struct ucode_patch *iter, *tmp, *p = NULL; -- bool prev_found = false; -- unsigned int sig, pf; -- -- mc_hdr = (struct microcode_header_intel *)data; -- -- list_for_each_entry_safe(iter, tmp, µcode_cache, plist) { -- mc_saved_hdr = (struct microcode_header_intel *)iter->data; -- sig = mc_saved_hdr->sig; -- pf = mc_saved_hdr->pf; -- -- if (intel_find_matching_signature(data, sig, pf)) { -- prev_found = true; -- -- if (mc_hdr->rev <= mc_saved_hdr->rev) -- continue; -- -- p = memdup_patch(data, size); -- if (!p) -- pr_err("Error allocating buffer %p\n", data); -- else { -- list_replace(&iter->plist, &p->plist); -- kfree(iter->data); -- kfree(iter); -- } -- } -- } -+ kvfree(ucode_patch_va); - - /* -- * There weren't any previous patches found in the list cache; save the -- * newly found. -+ * Save the virtual address for early loading and for eventual free -+ * on late loading. - */ -- if (!prev_found) { -- p = memdup_patch(data, size); -- if (!p) -- pr_err("Error allocating buffer for %p\n", data); -- else -- list_add_tail(&p->plist, µcode_cache); -- } -- -- if (!p) -- return; -+ ucode_patch_va = mc; -+} - -- if (!intel_find_matching_signature(p->data, uci->cpu_sig.sig, uci->cpu_sig.pf)) -- return; -+static void save_microcode_patch(struct microcode_intel *patch) -+{ -+ unsigned int size = get_totalsize(&patch->hdr); -+ struct microcode_intel *mc; - -- /* -- * Save for early loading. On 32-bit, that needs to be a physical -- * address as the APs are running from physical addresses, before -- * paging has been enabled. -- */ -- if (IS_ENABLED(CONFIG_X86_32)) -- intel_ucode_patch = (struct microcode_intel *)__pa_nodebug(p->data); -+ mc = kvmemdup(patch, size, GFP_KERNEL); -+ if (mc) -+ update_ucode_pointer(mc); - else -- intel_ucode_patch = p->data; -+ pr_err("Unable to allocate microcode memory size: %u\n", size); - } - --/* -- * Get microcode matching with BSP's model. Only CPUs with the same model as -- * BSP can stay in the platform. -- */ --static struct microcode_intel * --scan_microcode(void *data, size_t size, struct ucode_cpu_info *uci, bool save) -+/* Scan blob for microcode matching the boot CPUs family, model, stepping */ -+static __init struct microcode_intel *scan_microcode(void *data, size_t size, -+ struct ucode_cpu_info *uci, -+ bool save) - { - struct microcode_header_intel *mc_header; - struct microcode_intel *patch = NULL; -+ u32 cur_rev = uci->cpu_sig.rev; - unsigned int mc_size; - -- while (size) { -- if (size < sizeof(struct microcode_header_intel)) -- break; -- -+ for (; size >= sizeof(struct microcode_header_intel); size -= mc_size, data += mc_size) { - mc_header = (struct microcode_header_intel *)data; - - mc_size = get_totalsize(mc_header); -- if (!mc_size || -- mc_size > size || -+ if (!mc_size || mc_size > size || - intel_microcode_sanity_check(data, false, MC_HEADER_TYPE_MICROCODE) < 0) - break; - -- size -= mc_size; -- -- if (!intel_find_matching_signature(data, uci->cpu_sig.sig, -- uci->cpu_sig.pf)) { -- data += mc_size; -+ if (!intel_find_matching_signature(data, &uci->cpu_sig)) - continue; -- } - -+ /* -+ * For saving the early microcode, find the matching revision which -+ * was loaded on the BSP. -+ * -+ * On the BSP during early boot, find a newer revision than -+ * actually loaded in the CPU. -+ */ - if (save) { -- save_microcode_patch(uci, data, mc_size); -- goto next; -- } -- -- -- if (!patch) { -- if (!has_newer_microcode(data, -- uci->cpu_sig.sig, -- uci->cpu_sig.pf, -- uci->cpu_sig.rev)) -- goto next; -- -- } else { -- struct microcode_header_intel *phdr = &patch->hdr; -- -- if (!has_newer_microcode(data, -- phdr->sig, -- phdr->pf, -- phdr->rev)) -- goto next; -+ if (cur_rev != mc_header->rev) -+ continue; -+ } else if (cur_rev >= mc_header->rev) { -+ continue; - } - -- /* We have a newer patch, save it. */ - patch = data; -- --next: -- data += mc_size; -+ cur_rev = mc_header->rev; - } - -- if (size) -- return NULL; -- -- return patch; -+ return size ? NULL : patch; - } - --static bool load_builtin_intel_microcode(struct cpio_data *cp) -+static enum ucode_state __apply_microcode(struct ucode_cpu_info *uci, -+ struct microcode_intel *mc, -+ u32 *cur_rev) - { -- unsigned int eax = 1, ebx, ecx = 0, edx; -- struct firmware fw; -- char name[30]; -- -- if (IS_ENABLED(CONFIG_X86_32)) -- return false; -- -- native_cpuid(&eax, &ebx, &ecx, &edx); -- -- sprintf(name, "intel-ucode/%02x-%02x-%02x", -- x86_family(eax), x86_model(eax), x86_stepping(eax)); -- -- if (firmware_request_builtin(&fw, name)) { -- cp->size = fw.size; -- cp->data = (void *)fw.data; -- return true; -- } -- -- return false; --} -- --static void print_ucode_info(int old_rev, int new_rev, unsigned int date) --{ -- pr_info_once("updated early: 0x%x -> 0x%x, date = %04x-%02x-%02x\n", -- old_rev, -- new_rev, -- date & 0xffff, -- date >> 24, -- (date >> 16) & 0xff); --} -- --#ifdef CONFIG_X86_32 -- --static int delay_ucode_info; --static int current_mc_date; --static int early_old_rev; -- --/* -- * Print early updated ucode info after printk works. This is delayed info dump. -- */ --void show_ucode_info_early(void) --{ -- struct ucode_cpu_info uci; -- -- if (delay_ucode_info) { -- intel_cpu_collect_info(&uci); -- print_ucode_info(early_old_rev, uci.cpu_sig.rev, current_mc_date); -- delay_ucode_info = 0; -- } --} -- --/* -- * At this point, we can not call printk() yet. Delay printing microcode info in -- * show_ucode_info_early() until printk() works. -- */ --static void print_ucode(int old_rev, int new_rev, int date) --{ -- int *delay_ucode_info_p; -- int *current_mc_date_p; -- int *early_old_rev_p; -- -- delay_ucode_info_p = (int *)__pa_nodebug(&delay_ucode_info); -- current_mc_date_p = (int *)__pa_nodebug(¤t_mc_date); -- early_old_rev_p = (int *)__pa_nodebug(&early_old_rev); -- -- *delay_ucode_info_p = 1; -- *current_mc_date_p = date; -- *early_old_rev_p = old_rev; --} --#else -- --static inline void print_ucode(int old_rev, int new_rev, int date) --{ -- print_ucode_info(old_rev, new_rev, date); --} --#endif -- --static int apply_microcode_early(struct ucode_cpu_info *uci, bool early) --{ -- struct microcode_intel *mc; -- u32 rev, old_rev; -+ u32 rev; - -- mc = uci->mc; - if (!mc) -- return 0; -+ return UCODE_NFOUND; - - /* - * Save us the MSR write below - which is a particular expensive - * operation - when the other hyperthread has updated the microcode - * already. - */ -- rev = intel_get_microcode_revision(); -- if (rev >= mc->hdr.rev) { -- uci->cpu_sig.rev = rev; -+ *cur_rev = intel_get_microcode_revision(); -+ if (*cur_rev >= mc->hdr.rev) { -+ uci->cpu_sig.rev = *cur_rev; - return UCODE_OK; - } - -- old_rev = rev; -- -- /* -- * Writeback and invalidate caches before updating microcode to avoid -- * internal issues depending on what the microcode is updating. -- */ -- native_wbinvd(); -- - /* write microcode via MSR 0x79 */ - native_wrmsrl(MSR_IA32_UCODE_WRITE, (unsigned long)mc->bits); - - rev = intel_get_microcode_revision(); - if (rev != mc->hdr.rev) -- return -1; -+ return UCODE_ERROR; - - uci->cpu_sig.rev = rev; -+ return UCODE_UPDATED; -+} - -- if (early) -- print_ucode(old_rev, uci->cpu_sig.rev, mc->hdr.date); -- else -- print_ucode_info(old_rev, uci->cpu_sig.rev, mc->hdr.date); -+static enum ucode_state apply_microcode_early(struct ucode_cpu_info *uci) -+{ -+ struct microcode_intel *mc = uci->mc; -+ u32 cur_rev; - -- return 0; -+ return __apply_microcode(uci, mc, &cur_rev); - } - --int __init save_microcode_in_initrd_intel(void) -+static __init bool load_builtin_intel_microcode(struct cpio_data *cp) - { -- struct ucode_cpu_info uci; -- struct cpio_data cp; -- -- /* -- * initrd is going away, clear patch ptr. We will scan the microcode one -- * last time before jettisoning and save a patch, if found. Then we will -- * update that pointer too, with a stable patch address to use when -- * resuming the cores. -- */ -- intel_ucode_patch = NULL; -+ unsigned int eax = 1, ebx, ecx = 0, edx; -+ struct firmware fw; -+ char name[30]; - -- if (!load_builtin_intel_microcode(&cp)) -- cp = find_microcode_in_initrd(ucode_path, false); -+ if (IS_ENABLED(CONFIG_X86_32)) -+ return false; - -- if (!(cp.data && cp.size)) -- return 0; -+ native_cpuid(&eax, &ebx, &ecx, &edx); - -- intel_cpu_collect_info(&uci); -+ sprintf(name, "intel-ucode/%02x-%02x-%02x", -+ x86_family(eax), x86_model(eax), x86_stepping(eax)); - -- scan_microcode(cp.data, cp.size, &uci, true); -- return 0; -+ if (firmware_request_builtin(&fw, name)) { -+ cp->size = fw.size; -+ cp->data = (void *)fw.data; -+ return true; -+ } -+ return false; - } - --/* -- * @res_patch, output: a pointer to the patch we found. -- */ --static struct microcode_intel *__load_ucode_intel(struct ucode_cpu_info *uci) -+static __init struct microcode_intel *get_microcode_blob(struct ucode_cpu_info *uci, bool save) - { -- static const char *path; - struct cpio_data cp; -- bool use_pa; -- -- if (IS_ENABLED(CONFIG_X86_32)) { -- path = (const char *)__pa_nodebug(ucode_path); -- use_pa = true; -- } else { -- path = ucode_path; -- use_pa = false; -- } - -- /* try built-in microcode first */ -+ intel_collect_cpu_info(&uci->cpu_sig); -+ - if (!load_builtin_intel_microcode(&cp)) -- cp = find_microcode_in_initrd(path, use_pa); -+ cp = find_microcode_in_initrd(ucode_path); - - if (!(cp.data && cp.size)) - return NULL; - -- intel_cpu_collect_info(uci); -- -- return scan_microcode(cp.data, cp.size, uci, false); -+ return scan_microcode(cp.data, cp.size, uci, save); - } - --void __init load_ucode_intel_bsp(void) -+/* -+ * Invoked from an early init call to save the microcode blob which was -+ * selected during early boot when mm was not usable. The microcode must be -+ * saved because initrd is going away. It's an early init call so the APs -+ * just can use the pointer and do not have to scan initrd/builtin firmware -+ * again. -+ */ -+static int __init save_builtin_microcode(void) - { -- struct microcode_intel *patch; - struct ucode_cpu_info uci; - -- patch = __load_ucode_intel(&uci); -- if (!patch) -- return; -+ if (xchg(&ucode_patch_va, NULL) != UCODE_BSP_LOADED) -+ return 0; - -- uci.mc = patch; -+ if (dis_ucode_ldr || boot_cpu_data.x86_vendor != X86_VENDOR_INTEL) -+ return 0; - -- apply_microcode_early(&uci, true); -+ uci.mc = get_microcode_blob(&uci, true); -+ if (uci.mc) -+ save_microcode_patch(uci.mc); -+ return 0; - } -+early_initcall(save_builtin_microcode); - --void load_ucode_intel_ap(void) -+/* Load microcode on BSP from initrd or builtin blobs */ -+void __init load_ucode_intel_bsp(struct early_load_data *ed) - { -- struct microcode_intel *patch, **iup; - struct ucode_cpu_info uci; - -- if (IS_ENABLED(CONFIG_X86_32)) -- iup = (struct microcode_intel **) __pa_nodebug(&intel_ucode_patch); -- else -- iup = &intel_ucode_patch; -+ uci.mc = get_microcode_blob(&uci, false); -+ ed->old_rev = uci.cpu_sig.rev; - -- if (!*iup) { -- patch = __load_ucode_intel(&uci); -- if (!patch) -- return; -- -- *iup = patch; -+ if (uci.mc && apply_microcode_early(&uci) == UCODE_UPDATED) { -+ ucode_patch_va = UCODE_BSP_LOADED; -+ ed->new_rev = uci.cpu_sig.rev; - } -- -- uci.mc = *iup; -- -- apply_microcode_early(&uci, true); - } - --static struct microcode_intel *find_patch(struct ucode_cpu_info *uci) -+void load_ucode_intel_ap(void) - { -- struct microcode_header_intel *phdr; -- struct ucode_patch *iter, *tmp; -- -- list_for_each_entry_safe(iter, tmp, µcode_cache, plist) { -- -- phdr = (struct microcode_header_intel *)iter->data; -- -- if (phdr->rev <= uci->cpu_sig.rev) -- continue; -- -- if (!intel_find_matching_signature(phdr, -- uci->cpu_sig.sig, -- uci->cpu_sig.pf)) -- continue; -+ struct ucode_cpu_info uci; - -- return iter->data; -- } -- return NULL; -+ uci.mc = ucode_patch_va; -+ if (uci.mc) -+ apply_microcode_early(&uci); - } - -+/* Reload microcode on resume */ - void reload_ucode_intel(void) - { -- struct microcode_intel *p; -- struct ucode_cpu_info uci; -- -- intel_cpu_collect_info(&uci); -- -- p = find_patch(&uci); -- if (!p) -- return; -- -- uci.mc = p; -+ struct ucode_cpu_info uci = { .mc = ucode_patch_va, }; - -- apply_microcode_early(&uci, false); -+ if (uci.mc) -+ apply_microcode_early(&uci); - } - - static int collect_cpu_info(int cpu_num, struct cpu_signature *csig) - { -- struct cpuinfo_x86 *c = &cpu_data(cpu_num); -- unsigned int val[2]; -- -- memset(csig, 0, sizeof(*csig)); -- -- csig->sig = cpuid_eax(0x00000001); -- -- if ((c->x86_model >= 5) || (c->x86 > 6)) { -- /* get processor flags from MSR 0x17 */ -- rdmsr(MSR_IA32_PLATFORM_ID, val[0], val[1]); -- csig->pf = 1 << ((val[1] >> 18) & 7); -- } -- -- csig->rev = c->microcode; -- -+ intel_collect_cpu_info(csig); - return 0; - } - --static enum ucode_state apply_microcode_intel(int cpu) -+static enum ucode_state apply_microcode_late(int cpu) - { - struct ucode_cpu_info *uci = ucode_cpu_info + cpu; -- struct cpuinfo_x86 *c = &cpu_data(cpu); -- bool bsp = c->cpu_index == boot_cpu_data.cpu_index; -- struct microcode_intel *mc; -+ struct microcode_intel *mc = ucode_patch_late; - enum ucode_state ret; -- static int prev_rev; -- u32 rev; -+ u32 cur_rev; - -- /* We should bind the task to the CPU */ -- if (WARN_ON(raw_smp_processor_id() != cpu)) -+ if (WARN_ON_ONCE(smp_processor_id() != cpu)) - return UCODE_ERROR; - -- /* Look for a newer patch in our cache: */ -- mc = find_patch(uci); -- if (!mc) { -- mc = uci->mc; -- if (!mc) -- return UCODE_NFOUND; -- } -+ ret = __apply_microcode(uci, mc, &cur_rev); -+ if (ret != UCODE_UPDATED && ret != UCODE_OK) -+ return ret; - -- /* -- * Save us the MSR write below - which is a particular expensive -- * operation - when the other hyperthread has updated the microcode -- * already. -- */ -- rev = intel_get_microcode_revision(); -- if (rev >= mc->hdr.rev) { -- ret = UCODE_OK; -- goto out; -- } -- -- /* -- * Writeback and invalidate caches before updating microcode to avoid -- * internal issues depending on what the microcode is updating. -- */ -- native_wbinvd(); -- -- /* write microcode via MSR 0x79 */ -- wrmsrl(MSR_IA32_UCODE_WRITE, (unsigned long)mc->bits); -- -- rev = intel_get_microcode_revision(); -- -- if (rev != mc->hdr.rev) { -- pr_err("CPU%d update to revision 0x%x failed\n", -- cpu, mc->hdr.rev); -- return UCODE_ERROR; -- } -- -- if (bsp && rev != prev_rev) { -- pr_info("updated to revision 0x%x, date = %04x-%02x-%02x\n", -- rev, -- mc->hdr.date & 0xffff, -- mc->hdr.date >> 24, -+ if (!cpu && uci->cpu_sig.rev != cur_rev) { -+ pr_info("Updated to revision 0x%x, date = %04x-%02x-%02x\n", -+ uci->cpu_sig.rev, mc->hdr.date & 0xffff, mc->hdr.date >> 24, - (mc->hdr.date >> 16) & 0xff); -- prev_rev = rev; - } - -- ret = UCODE_UPDATED; -- --out: -- uci->cpu_sig.rev = rev; -- c->microcode = rev; -- -- /* Update boot_cpu_data's revision too, if we're on the BSP: */ -- if (bsp) -- boot_cpu_data.microcode = rev; -+ cpu_data(cpu).microcode = uci->cpu_sig.rev; -+ if (!cpu) -+ boot_cpu_data.microcode = uci->cpu_sig.rev; - - return ret; - } - --static enum ucode_state generic_load_microcode(int cpu, struct iov_iter *iter) -+static enum ucode_state parse_microcode_blobs(int cpu, struct iov_iter *iter) - { - struct ucode_cpu_info *uci = ucode_cpu_info + cpu; -- unsigned int curr_mc_size = 0, new_mc_size = 0; -- enum ucode_state ret = UCODE_OK; -- int new_rev = uci->cpu_sig.rev; -+ int cur_rev = uci->cpu_sig.rev; -+ unsigned int curr_mc_size = 0; - u8 *new_mc = NULL, *mc = NULL; -- unsigned int csig, cpf; -+ -+ if (force_minrev) -+ return UCODE_NFOUND; - - while (iov_iter_count(iter)) { - struct microcode_header_intel mc_header; -@@ -758,68 +481,61 @@ static enum ucode_state generic_load_microcode(int cpu, struct iov_iter *iter) - - if (!copy_from_iter_full(&mc_header, sizeof(mc_header), iter)) { - pr_err("error! Truncated or inaccessible header in microcode data file\n"); -- break; -+ goto fail; - } - - mc_size = get_totalsize(&mc_header); - if (mc_size < sizeof(mc_header)) { - pr_err("error! Bad data in microcode data file (totalsize too small)\n"); -- break; -+ goto fail; - } - data_size = mc_size - sizeof(mc_header); - if (data_size > iov_iter_count(iter)) { - pr_err("error! Bad data in microcode data file (truncated file?)\n"); -- break; -+ goto fail; - } - - /* For performance reasons, reuse mc area when possible */ - if (!mc || mc_size > curr_mc_size) { -- vfree(mc); -- mc = vmalloc(mc_size); -+ kvfree(mc); -+ mc = kvmalloc(mc_size, GFP_KERNEL); - if (!mc) -- break; -+ goto fail; - curr_mc_size = mc_size; - } - - memcpy(mc, &mc_header, sizeof(mc_header)); - data = mc + sizeof(mc_header); - if (!copy_from_iter_full(data, data_size, iter) || -- intel_microcode_sanity_check(mc, true, MC_HEADER_TYPE_MICROCODE) < 0) { -- break; -- } -+ intel_microcode_sanity_check(mc, true, MC_HEADER_TYPE_MICROCODE) < 0) -+ goto fail; - -- csig = uci->cpu_sig.sig; -- cpf = uci->cpu_sig.pf; -- if (has_newer_microcode(mc, csig, cpf, new_rev)) { -- vfree(new_mc); -- new_rev = mc_header.rev; -- new_mc = mc; -- new_mc_size = mc_size; -- mc = NULL; /* trigger new vmalloc */ -- ret = UCODE_NEW; -- } -- } -+ if (cur_rev >= mc_header.rev) -+ continue; - -- vfree(mc); -+ if (!intel_find_matching_signature(mc, &uci->cpu_sig)) -+ continue; - -- if (iov_iter_count(iter)) { -- vfree(new_mc); -- return UCODE_ERROR; -+ kvfree(new_mc); -+ cur_rev = mc_header.rev; -+ new_mc = mc; -+ mc = NULL; - } - -+ if (iov_iter_count(iter)) -+ goto fail; -+ -+ kvfree(mc); - if (!new_mc) - return UCODE_NFOUND; - -- vfree(uci->mc); -- uci->mc = (struct microcode_intel *)new_mc; -- -- /* Save for CPU hotplug */ -- save_microcode_patch(uci, new_mc, new_mc_size); -+ ucode_patch_late = (struct microcode_intel *)new_mc; -+ return UCODE_NEW; - -- pr_debug("CPU%d found a matching microcode update with version 0x%x (current=0x%x)\n", -- cpu, new_rev, uci->cpu_sig.rev); -- -- return ret; -+fail: -+ kvfree(mc); -+ kvfree(new_mc); -+ return UCODE_ERROR; - } - - static bool is_blacklisted(unsigned int cpu) -@@ -829,7 +545,7 @@ static bool is_blacklisted(unsigned int cpu) - /* - * Late loading on model 79 with microcode revision less than 0x0b000021 - * and LLC size per core bigger than 2.5MB may result in a system hang. -- * This behavior is documented in item BDF90, #334165 (Intel Xeon -+ * This behavior is documented in item BDX90, #334165 (Intel Xeon - * Processor E7-8800/4800 v4 Product Family). - */ - if (c->x86 == 6 && -@@ -837,7 +553,7 @@ static bool is_blacklisted(unsigned int cpu) - c->x86_stepping == 0x01 && - llc_size_per_core > 2621440 && - c->microcode < 0x0b000021) { -- pr_err_once("Erratum BDF90: late loading with revision < 0x0b000021 (0x%x) disabled.\n", c->microcode); -+ pr_err_once("Erratum BDX90: late loading with revision < 0x0b000021 (0x%x) disabled.\n", c->microcode); - pr_err_once("Please consider either early loading through initrd/built-in or a potential BIOS update.\n"); - return true; - } -@@ -868,26 +584,36 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device) - kvec.iov_base = (void *)firmware->data; - kvec.iov_len = firmware->size; - iov_iter_kvec(&iter, ITER_SOURCE, &kvec, 1, firmware->size); -- ret = generic_load_microcode(cpu, &iter); -+ ret = parse_microcode_blobs(cpu, &iter); - - release_firmware(firmware); - - return ret; - } - -+static void finalize_late_load(int result) -+{ -+ if (!result) -+ update_ucode_pointer(ucode_patch_late); -+ else -+ kvfree(ucode_patch_late); -+ ucode_patch_late = NULL; -+} -+ - static struct microcode_ops microcode_intel_ops = { -- .request_microcode_fw = request_microcode_fw, -- .collect_cpu_info = collect_cpu_info, -- .apply_microcode = apply_microcode_intel, -+ .request_microcode_fw = request_microcode_fw, -+ .collect_cpu_info = collect_cpu_info, -+ .apply_microcode = apply_microcode_late, -+ .finalize_late_load = finalize_late_load, -+ .use_nmi = IS_ENABLED(CONFIG_X86_64), - }; - --static int __init calc_llc_size_per_core(struct cpuinfo_x86 *c) -+static __init void calc_llc_size_per_core(struct cpuinfo_x86 *c) - { - u64 llc_size = c->x86_cache_size * 1024ULL; - - do_div(llc_size, c->x86_max_cores); -- -- return (int)llc_size; -+ llc_size_per_core = (unsigned int)llc_size; - } - - struct microcode_ops * __init init_intel_microcode(void) -@@ -900,7 +626,7 @@ struct microcode_ops * __init init_intel_microcode(void) - return NULL; - } - -- llc_size_per_core = calc_llc_size_per_core(c); -+ calc_llc_size_per_core(c); - - return µcode_intel_ops; - } -diff --git a/arch/x86/kernel/cpu/microcode/internal.h b/arch/x86/kernel/cpu/microcode/internal.h -index bf883aa712330a..21776c529fa97a 100644 ---- a/arch/x86/kernel/cpu/microcode/internal.h -+++ b/arch/x86/kernel/cpu/microcode/internal.h -@@ -8,43 +8,43 @@ - #include - #include - --struct ucode_patch { -- struct list_head plist; -- void *data; /* Intel uses only this one */ -- unsigned int size; -- u32 patch_id; -- u16 equiv_cpu; --}; -- --extern struct list_head microcode_cache; -- - struct device; - - enum ucode_state { - UCODE_OK = 0, - UCODE_NEW, -+ UCODE_NEW_SAFE, - UCODE_UPDATED, - UCODE_NFOUND, - UCODE_ERROR, -+ UCODE_TIMEOUT, -+ UCODE_OFFLINE, - }; - - struct microcode_ops { - enum ucode_state (*request_microcode_fw)(int cpu, struct device *dev); -- - void (*microcode_fini_cpu)(int cpu); - - /* -- * The generic 'microcode_core' part guarantees that -- * the callbacks below run on a target cpu when they -- * are being called. -+ * The generic 'microcode_core' part guarantees that the callbacks -+ * below run on a target CPU when they are being called. - * See also the "Synchronization" section in microcode_core.c. - */ -- enum ucode_state (*apply_microcode)(int cpu); -- int (*collect_cpu_info)(int cpu, struct cpu_signature *csig); -+ enum ucode_state (*apply_microcode)(int cpu); -+ int (*collect_cpu_info)(int cpu, struct cpu_signature *csig); -+ void (*finalize_late_load)(int result); -+ unsigned int nmi_safe : 1, -+ use_nmi : 1; -+}; -+ -+struct early_load_data { -+ u32 old_rev; -+ u32 new_rev; - }; - -+extern struct early_load_data early_data; - extern struct ucode_cpu_info ucode_cpu_info[]; --struct cpio_data find_microcode_in_initrd(const char *path, bool use_pa); -+struct cpio_data find_microcode_in_initrd(const char *path); - - #define MAX_UCODE_COUNT 128 - -@@ -94,20 +94,19 @@ static inline unsigned int x86_cpuid_family(void) - return x86_family(eax); - } - --extern bool initrd_gone; -+extern bool dis_ucode_ldr; -+extern bool force_minrev; - - #ifdef CONFIG_CPU_SUP_AMD --void load_ucode_amd_bsp(unsigned int family); -+void load_ucode_amd_bsp(struct early_load_data *ed, unsigned int family); - void load_ucode_amd_ap(unsigned int family); --void load_ucode_amd_early(unsigned int cpuid_1_eax); - int save_microcode_in_initrd_amd(unsigned int family); - void reload_ucode_amd(unsigned int cpu); - struct microcode_ops *init_amd_microcode(void); - void exit_amd_microcode(void); - #else /* CONFIG_CPU_SUP_AMD */ --static inline void load_ucode_amd_bsp(unsigned int family) { } -+static inline void load_ucode_amd_bsp(struct early_load_data *ed, unsigned int family) { } - static inline void load_ucode_amd_ap(unsigned int family) { } --static inline void load_ucode_amd_early(unsigned int family) { } - static inline int save_microcode_in_initrd_amd(unsigned int family) { return -EINVAL; } - static inline void reload_ucode_amd(unsigned int cpu) { } - static inline struct microcode_ops *init_amd_microcode(void) { return NULL; } -@@ -115,15 +114,13 @@ static inline void exit_amd_microcode(void) { } - #endif /* !CONFIG_CPU_SUP_AMD */ - - #ifdef CONFIG_CPU_SUP_INTEL --void load_ucode_intel_bsp(void); -+void load_ucode_intel_bsp(struct early_load_data *ed); - void load_ucode_intel_ap(void); --int save_microcode_in_initrd_intel(void); - void reload_ucode_intel(void); - struct microcode_ops *init_intel_microcode(void); - #else /* CONFIG_CPU_SUP_INTEL */ --static inline void load_ucode_intel_bsp(void) { } -+static inline void load_ucode_intel_bsp(struct early_load_data *ed) { } - static inline void load_ucode_intel_ap(void) { } --static inline int save_microcode_in_initrd_intel(void) { return -EINVAL; } - static inline void reload_ucode_intel(void) { } - static inline struct microcode_ops *init_intel_microcode(void) { return NULL; } - #endif /* !CONFIG_CPU_SUP_INTEL */ -diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c -index 246a609f889b20..bde27a35bf2e28 100644 ---- a/arch/x86/kernel/head32.c -+++ b/arch/x86/kernel/head32.c -@@ -19,6 +19,7 @@ - #include - #include - #include -+#include - #include - #include - -@@ -34,6 +35,8 @@ asmlinkage __visible void __init __noreturn i386_start_kernel(void) - /* Make sure IDT is set up before any exception happens */ - idt_setup_early_handler(); - -+ load_ucode_bsp(); -+ - cr4_init_shadow(); - - sanitize_boot_params(&boot_params); -diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S -index c9318993f95945..63f6ff4b28eb17 100644 ---- a/arch/x86/kernel/head_32.S -+++ b/arch/x86/kernel/head_32.S -@@ -118,11 +118,6 @@ SYM_CODE_START(startup_32) - movl %eax, pa(olpc_ofw_pgd) - #endif - --#ifdef CONFIG_MICROCODE -- /* Early load ucode on BSP. */ -- call load_ucode_bsp --#endif -- - /* Create early pagetables. */ - call mk_early_pgtbl_32 - -@@ -157,11 +152,6 @@ SYM_FUNC_START(startup_32_smp) - movl %eax,%ss - leal -__PAGE_OFFSET(%ecx),%esp - --#ifdef CONFIG_MICROCODE -- /* Early load ucode on AP. */ -- call load_ucode_ap --#endif -- - .Ldefault_entry: - movl $(CR0_STATE & ~X86_CR0_PG),%eax - movl %eax,%cr0 -diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c -index 87aee638e1a5d8..6da2cfa23c2939 100644 ---- a/arch/x86/kernel/nmi.c -+++ b/arch/x86/kernel/nmi.c -@@ -33,6 +33,7 @@ - #include - #include - #include -+#include - #include - - #define CREATE_TRACE_POINTS -@@ -343,6 +344,9 @@ static noinstr void default_do_nmi(struct pt_regs *regs) - - instrumentation_begin(); - -+ if (microcode_nmi_handler_enabled() && microcode_nmi_handler()) -+ goto out; -+ - handled = nmi_handle(NMI_LOCAL, regs); - __this_cpu_add(nmi_stats.normal, handled); - if (handled) { -@@ -498,8 +502,11 @@ DEFINE_IDTENTRY_RAW(exc_nmi) - if (IS_ENABLED(CONFIG_NMI_CHECK_CPU)) - raw_atomic_long_inc(&nsp->idt_calls); - -- if (IS_ENABLED(CONFIG_SMP) && arch_cpu_is_offline(smp_processor_id())) -+ if (IS_ENABLED(CONFIG_SMP) && arch_cpu_is_offline(smp_processor_id())) { -+ if (microcode_nmi_handler_enabled()) -+ microcode_offline_nmi_handler(); - return; -+ } - - if (this_cpu_read(nmi_state) != NMI_NOT_RUNNING) { - this_cpu_write(nmi_state, NMI_LATCHED); -diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c -index a8f2ab816d5ae2..77f0d9ccb2c004 100644 ---- a/arch/x86/kernel/smpboot.c -+++ b/arch/x86/kernel/smpboot.c -@@ -259,12 +259,9 @@ static void notrace start_secondary(void *unused) - cpu_init_exception_handling(); - - /* -- * 32-bit systems load the microcode from the ASM startup code for -- * historical reasons. -- * -- * On 64-bit systems load it before reaching the AP alive -- * synchronization point below so it is not part of the full per -- * CPU serialized bringup part when "parallel" bringup is enabled. -+ * Load the microcode before reaching the AP alive synchronization -+ * point below so it is not part of the full per CPU serialized -+ * bringup part when "parallel" bringup is enabled. - * - * That's even safe when hyperthreading is enabled in the CPU as - * the core code starts the primary threads first and leaves the -@@ -277,8 +274,7 @@ static void notrace start_secondary(void *unused) - * CPUID, MSRs etc. must be strictly serialized to maintain - * software state correctness. - */ -- if (IS_ENABLED(CONFIG_X86_64)) -- load_ucode_ap(); -+ load_ucode_ap(); - - /* - * Synchronization point with the hotplug core. Sets this CPUs -diff --git a/drivers/firmware/cirrus/cs_dsp.c b/drivers/firmware/cirrus/cs_dsp.c -index e62ffffe5fb8d4..4ce5681be18f05 100644 ---- a/drivers/firmware/cirrus/cs_dsp.c -+++ b/drivers/firmware/cirrus/cs_dsp.c -@@ -1562,8 +1562,8 @@ static int cs_dsp_load(struct cs_dsp *dsp, const struct firmware *firmware, - goto out_fw; - } - -- ret = regmap_raw_write_async(regmap, reg, buf->buf, -- le32_to_cpu(region->len)); -+ ret = regmap_raw_write(regmap, reg, buf->buf, -+ le32_to_cpu(region->len)); - if (ret != 0) { - cs_dsp_err(dsp, - "%s.%d: Failed to write %d bytes at %d in %s: %d\n", -@@ -1578,12 +1578,6 @@ static int cs_dsp_load(struct cs_dsp *dsp, const struct firmware *firmware, - regions++; - } - -- ret = regmap_async_complete(regmap); -- if (ret != 0) { -- cs_dsp_err(dsp, "Failed to complete async write: %d\n", ret); -- goto out_fw; -- } -- - if (pos > firmware->size) - cs_dsp_warn(dsp, "%s.%d: %zu bytes at end of file\n", - file, regions, pos - firmware->size); -@@ -1591,7 +1585,6 @@ static int cs_dsp_load(struct cs_dsp *dsp, const struct firmware *firmware, - cs_dsp_debugfs_save_wmfwname(dsp, file); - - out_fw: -- regmap_async_complete(regmap); - cs_dsp_buf_free(&buf_list); - kfree(text); - -@@ -2287,8 +2280,8 @@ static int cs_dsp_load_coeff(struct cs_dsp *dsp, const struct firmware *firmware - cs_dsp_dbg(dsp, "%s.%d: Writing %d bytes at %x\n", - file, blocks, le32_to_cpu(blk->len), - reg); -- ret = regmap_raw_write_async(regmap, reg, buf->buf, -- le32_to_cpu(blk->len)); -+ ret = regmap_raw_write(regmap, reg, buf->buf, -+ le32_to_cpu(blk->len)); - if (ret != 0) { - cs_dsp_err(dsp, - "%s.%d: Failed to write to %x in %s: %d\n", -@@ -2300,10 +2293,6 @@ static int cs_dsp_load_coeff(struct cs_dsp *dsp, const struct firmware *firmware - blocks++; - } - -- ret = regmap_async_complete(regmap); -- if (ret != 0) -- cs_dsp_err(dsp, "Failed to complete async write: %d\n", ret); -- - if (pos > firmware->size) - cs_dsp_warn(dsp, "%s.%d: %zu bytes at end of file\n", - file, blocks, pos - firmware->size); -@@ -2311,7 +2300,6 @@ static int cs_dsp_load_coeff(struct cs_dsp *dsp, const struct firmware *firmware - cs_dsp_debugfs_save_binname(dsp, file); - - out_fw: -- regmap_async_complete(regmap); - cs_dsp_buf_free(&buf_list); - kfree(text); - -@@ -2523,8 +2511,8 @@ static int cs_dsp_adsp2_enable_core(struct cs_dsp *dsp) - { - int ret; - -- ret = regmap_update_bits_async(dsp->regmap, dsp->base + ADSP2_CONTROL, -- ADSP2_SYS_ENA, ADSP2_SYS_ENA); -+ ret = regmap_update_bits(dsp->regmap, dsp->base + ADSP2_CONTROL, -+ ADSP2_SYS_ENA, ADSP2_SYS_ENA); - if (ret != 0) - return ret; - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c -index 51467f132c2604..da47e68b10ce0d 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c -@@ -891,6 +891,7 @@ void amdgpu_dm_hpd_init(struct amdgpu_device *adev) - struct drm_device *dev = adev_to_drm(adev); - struct drm_connector *connector; - struct drm_connector_list_iter iter; -+ int i; - - drm_connector_list_iter_begin(dev, &iter); - drm_for_each_connector_iter(connector, &iter) { -@@ -912,6 +913,12 @@ void amdgpu_dm_hpd_init(struct amdgpu_device *adev) - } - } - drm_connector_list_iter_end(&iter); -+ -+ /* Update reference counts for HPDs */ -+ for (i = DC_IRQ_SOURCE_HPD1; i <= adev->mode_info.num_hpd; i++) { -+ if (amdgpu_irq_get(adev, &adev->hpd_irq, i - DC_IRQ_SOURCE_HPD1)) -+ drm_err(dev, "DM_IRQ: Failed get HPD for source=%d)!\n", i); -+ } - } - - /** -@@ -927,6 +934,7 @@ void amdgpu_dm_hpd_fini(struct amdgpu_device *adev) - struct drm_device *dev = adev_to_drm(adev); - struct drm_connector *connector; - struct drm_connector_list_iter iter; -+ int i; - - drm_connector_list_iter_begin(dev, &iter); - drm_for_each_connector_iter(connector, &iter) { -@@ -947,4 +955,10 @@ void amdgpu_dm_hpd_fini(struct amdgpu_device *adev) - } - } - drm_connector_list_iter_end(&iter); -+ -+ /* Update reference counts for HPDs */ -+ for (i = DC_IRQ_SOURCE_HPD1; i <= adev->mode_info.num_hpd; i++) { -+ if (amdgpu_irq_put(adev, &adev->hpd_irq, i - DC_IRQ_SOURCE_HPD1)) -+ drm_err(dev, "DM_IRQ: Failed put HPD for source=%d!\n", i); -+ } - } -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c -index 08ce3bb8f640d9..fe96bab7d05d7b 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c -@@ -51,7 +51,8 @@ static bool link_supports_psrsu(struct dc_link *link) - !link->dpcd_caps.psr_info.psr2_su_y_granularity_cap) - return false; - -- return dc_dmub_check_min_version(dc->ctx->dmub_srv->dmub); -+ /* Temporarily disable PSR-SU to avoid glitches */ -+ return false; - } - - /* -diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c -index c8586cb7d0fec5..4d193313a6d6e3 100644 ---- a/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c -+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c -@@ -3043,6 +3043,7 @@ static int kv_dpm_hw_init(void *handle) - if (!amdgpu_dpm) - return 0; - -+ mutex_lock(&adev->pm.mutex); - kv_dpm_setup_asic(adev); - ret = kv_dpm_enable(adev); - if (ret) -@@ -3050,6 +3051,8 @@ static int kv_dpm_hw_init(void *handle) - else - adev->pm.dpm_enabled = true; - amdgpu_legacy_dpm_compute_clocks(adev); -+ mutex_unlock(&adev->pm.mutex); -+ - return ret; - } - -@@ -3067,32 +3070,42 @@ static int kv_dpm_suspend(void *handle) - { - struct amdgpu_device *adev = (struct amdgpu_device *)handle; - -+ cancel_work_sync(&adev->pm.dpm.thermal.work); -+ - if (adev->pm.dpm_enabled) { -+ mutex_lock(&adev->pm.mutex); -+ adev->pm.dpm_enabled = false; - /* disable dpm */ - kv_dpm_disable(adev); - /* reset the power state */ - adev->pm.dpm.current_ps = adev->pm.dpm.requested_ps = adev->pm.dpm.boot_ps; -+ mutex_unlock(&adev->pm.mutex); - } - return 0; - } - - static int kv_dpm_resume(void *handle) - { -- int ret; -+ int ret = 0; - struct amdgpu_device *adev = (struct amdgpu_device *)handle; - -- if (adev->pm.dpm_enabled) { -+ if (!amdgpu_dpm) -+ return 0; -+ -+ if (!adev->pm.dpm_enabled) { -+ mutex_lock(&adev->pm.mutex); - /* asic init will reset to the boot state */ - kv_dpm_setup_asic(adev); - ret = kv_dpm_enable(adev); -- if (ret) -+ if (ret) { - adev->pm.dpm_enabled = false; -- else -+ } else { - adev->pm.dpm_enabled = true; -- if (adev->pm.dpm_enabled) - amdgpu_legacy_dpm_compute_clocks(adev); -+ } -+ mutex_unlock(&adev->pm.mutex); - } -- return 0; -+ return ret; - } - - static bool kv_dpm_is_idle(void *handle) -diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c -index 60377747bab4fc..48ad413d72afe7 100644 ---- a/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c -+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c -@@ -1018,9 +1018,12 @@ void amdgpu_dpm_thermal_work_handler(struct work_struct *work) - enum amd_pm_state_type dpm_state = POWER_STATE_TYPE_INTERNAL_THERMAL; - int temp, size = sizeof(temp); - -- if (!adev->pm.dpm_enabled) -- return; -+ mutex_lock(&adev->pm.mutex); - -+ if (!adev->pm.dpm_enabled) { -+ mutex_unlock(&adev->pm.mutex); -+ return; -+ } - if (!pp_funcs->read_sensor(adev->powerplay.pp_handle, - AMDGPU_PP_SENSOR_GPU_TEMP, - (void *)&temp, -@@ -1042,4 +1045,5 @@ void amdgpu_dpm_thermal_work_handler(struct work_struct *work) - adev->pm.dpm.state = dpm_state; - - amdgpu_legacy_dpm_compute_clocks(adev->powerplay.pp_handle); -+ mutex_unlock(&adev->pm.mutex); - } -diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c -index 99dde52a429013..e7b1fa2feb9288 100644 ---- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c -+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c -@@ -7789,6 +7789,7 @@ static int si_dpm_hw_init(void *handle) - if (!amdgpu_dpm) - return 0; - -+ mutex_lock(&adev->pm.mutex); - si_dpm_setup_asic(adev); - ret = si_dpm_enable(adev); - if (ret) -@@ -7796,6 +7797,7 @@ static int si_dpm_hw_init(void *handle) - else - adev->pm.dpm_enabled = true; - amdgpu_legacy_dpm_compute_clocks(adev); -+ mutex_unlock(&adev->pm.mutex); - return ret; - } - -@@ -7813,32 +7815,44 @@ static int si_dpm_suspend(void *handle) - { - struct amdgpu_device *adev = (struct amdgpu_device *)handle; - -+ cancel_work_sync(&adev->pm.dpm.thermal.work); -+ - if (adev->pm.dpm_enabled) { -+ mutex_lock(&adev->pm.mutex); -+ adev->pm.dpm_enabled = false; - /* disable dpm */ - si_dpm_disable(adev); - /* reset the power state */ - adev->pm.dpm.current_ps = adev->pm.dpm.requested_ps = adev->pm.dpm.boot_ps; -+ mutex_unlock(&adev->pm.mutex); - } -+ - return 0; - } - - static int si_dpm_resume(void *handle) - { -- int ret; -+ int ret = 0; - struct amdgpu_device *adev = (struct amdgpu_device *)handle; - -- if (adev->pm.dpm_enabled) { -+ if (!amdgpu_dpm) -+ return 0; -+ -+ if (!adev->pm.dpm_enabled) { - /* asic init will reset to the boot state */ -+ mutex_lock(&adev->pm.mutex); - si_dpm_setup_asic(adev); - ret = si_dpm_enable(adev); -- if (ret) -+ if (ret) { - adev->pm.dpm_enabled = false; -- else -+ } else { - adev->pm.dpm_enabled = true; -- if (adev->pm.dpm_enabled) - amdgpu_legacy_dpm_compute_clocks(adev); -+ } -+ mutex_unlock(&adev->pm.mutex); - } -- return 0; -+ -+ return ret; - } - - static bool si_dpm_is_idle(void *handle) -diff --git a/drivers/i2c/busses/i2c-ls2x.c b/drivers/i2c/busses/i2c-ls2x.c -index ebae6035701db7..d74625d72f4c52 100644 ---- a/drivers/i2c/busses/i2c-ls2x.c -+++ b/drivers/i2c/busses/i2c-ls2x.c -@@ -10,6 +10,7 @@ - * Rewritten for mainline by Binbin Zhou - */ - -+#include - #include - #include - #include -@@ -26,7 +27,8 @@ - #include - - /* I2C Registers */ --#define I2C_LS2X_PRER 0x0 /* Freq Division Register(16 bits) */ -+#define I2C_LS2X_PRER_LO 0x0 /* Freq Division Low Byte Register */ -+#define I2C_LS2X_PRER_HI 0x1 /* Freq Division High Byte Register */ - #define I2C_LS2X_CTR 0x2 /* Control Register */ - #define I2C_LS2X_TXR 0x3 /* Transport Data Register */ - #define I2C_LS2X_RXR 0x3 /* Receive Data Register */ -@@ -93,6 +95,7 @@ static irqreturn_t ls2x_i2c_isr(int this_irq, void *dev_id) - */ - static void ls2x_i2c_adjust_bus_speed(struct ls2x_i2c_priv *priv) - { -+ u16 val; - struct i2c_timings *t = &priv->i2c_t; - struct device *dev = priv->adapter.dev.parent; - u32 acpi_speed = i2c_acpi_find_bus_speed(dev); -@@ -104,9 +107,14 @@ static void ls2x_i2c_adjust_bus_speed(struct ls2x_i2c_priv *priv) - else - t->bus_freq_hz = LS2X_I2C_FREQ_STD; - -- /* Calculate and set i2c frequency. */ -- writew(LS2X_I2C_PCLK_FREQ / (5 * t->bus_freq_hz) - 1, -- priv->base + I2C_LS2X_PRER); -+ /* -+ * According to the chip manual, we can only access the registers as bytes, -+ * otherwise the high bits will be truncated. -+ * So set the I2C frequency with a sequential writeb() instead of writew(). -+ */ -+ val = LS2X_I2C_PCLK_FREQ / (5 * t->bus_freq_hz) - 1; -+ writeb(FIELD_GET(GENMASK(7, 0), val), priv->base + I2C_LS2X_PRER_LO); -+ writeb(FIELD_GET(GENMASK(15, 8), val), priv->base + I2C_LS2X_PRER_HI); - } - - static void ls2x_i2c_init(struct ls2x_i2c_priv *priv) -diff --git a/drivers/i2c/busses/i2c-npcm7xx.c b/drivers/i2c/busses/i2c-npcm7xx.c -index ae4bae63ad4f3c..91f508d50e7ab4 100644 ---- a/drivers/i2c/busses/i2c-npcm7xx.c -+++ b/drivers/i2c/busses/i2c-npcm7xx.c -@@ -2333,6 +2333,13 @@ static int npcm_i2c_probe_bus(struct platform_device *pdev) - if (irq < 0) - return irq; - -+ /* -+ * Disable the interrupt to avoid the interrupt handler being triggered -+ * incorrectly by the asynchronous interrupt status since the machine -+ * might do a warm reset during the last smbus/i2c transfer session. -+ */ -+ npcm_i2c_int_enable(bus, false); -+ - ret = devm_request_irq(bus->dev, irq, npcm_i2c_bus_irq, 0, - dev_name(bus->dev), bus); - if (ret) -diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c -index 45500d2d5b4bb5..44842f243f40b5 100644 ---- a/drivers/idle/intel_idle.c -+++ b/drivers/idle/intel_idle.c -@@ -56,6 +56,7 @@ - #include - #include - #include -+#include - #include - - #define INTEL_IDLE_VERSION "0.5.1" -@@ -1573,6 +1574,9 @@ static void __init intel_idle_init_cstates_acpi(struct cpuidle_driver *drv) - if (intel_idle_state_needs_timer_stop(state)) - state->flags |= CPUIDLE_FLAG_TIMER_STOP; - -+ if (cx->type > ACPI_STATE_C1 && !boot_cpu_has(X86_FEATURE_NONSTOP_TSC)) -+ mark_tsc_unstable("TSC halts in idle"); -+ - state->enter = intel_idle; - state->enter_s2idle = intel_idle_s2idle; - } -diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c -index ec5efdc1666013..9f97bef0214975 100644 ---- a/drivers/infiniband/core/sysfs.c -+++ b/drivers/infiniband/core/sysfs.c -@@ -342,6 +342,10 @@ static ssize_t rate_show(struct ib_device *ibdev, u32 port_num, - speed = " NDR"; - rate = 1000; - break; -+ case IB_SPEED_XDR: -+ speed = " XDR"; -+ rate = 2000; -+ break; - case IB_SPEED_SDR: - default: /* default to SDR for invalid rates */ - speed = " SDR"; -diff --git a/drivers/infiniband/core/uverbs_std_types_device.c b/drivers/infiniband/core/uverbs_std_types_device.c -index 049684880ae03d..fb0555647336f4 100644 ---- a/drivers/infiniband/core/uverbs_std_types_device.c -+++ b/drivers/infiniband/core/uverbs_std_types_device.c -@@ -203,6 +203,7 @@ static int UVERBS_HANDLER(UVERBS_METHOD_QUERY_PORT)( - - copy_port_attr_to_resp(&attr, &resp.legacy_resp, ib_dev, port_num); - resp.port_cap_flags2 = attr.port_cap_flags2; -+ resp.active_speed_ex = attr.active_speed; - - return uverbs_copy_to_struct_or_zero(attrs, UVERBS_ATTR_QUERY_PORT_RESP, - &resp, sizeof(resp)); -@@ -461,7 +462,7 @@ DECLARE_UVERBS_NAMED_METHOD( - UVERBS_ATTR_PTR_OUT( - UVERBS_ATTR_QUERY_PORT_RESP, - UVERBS_ATTR_STRUCT(struct ib_uverbs_query_port_resp_ex, -- reserved), -+ active_speed_ex), - UA_MANDATORY)); - - DECLARE_UVERBS_NAMED_METHOD( -diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c -index 186ed3c22ec9e3..ba05de0380e96e 100644 ---- a/drivers/infiniband/core/verbs.c -+++ b/drivers/infiniband/core/verbs.c -@@ -147,6 +147,7 @@ __attribute_const__ int ib_rate_to_mult(enum ib_rate rate) - case IB_RATE_50_GBPS: return 20; - case IB_RATE_400_GBPS: return 160; - case IB_RATE_600_GBPS: return 240; -+ case IB_RATE_800_GBPS: return 320; - default: return -1; - } - } -@@ -176,6 +177,7 @@ __attribute_const__ enum ib_rate mult_to_ib_rate(int mult) - case 20: return IB_RATE_50_GBPS; - case 160: return IB_RATE_400_GBPS; - case 240: return IB_RATE_600_GBPS; -+ case 320: return IB_RATE_800_GBPS; - default: return IB_RATE_PORT_CURRENT; - } - } -@@ -205,6 +207,7 @@ __attribute_const__ int ib_rate_to_mbps(enum ib_rate rate) - case IB_RATE_50_GBPS: return 53125; - case IB_RATE_400_GBPS: return 425000; - case IB_RATE_600_GBPS: return 637500; -+ case IB_RATE_800_GBPS: return 850000; - default: return -1; - } - } -diff --git a/drivers/infiniband/hw/mana/main.c b/drivers/infiniband/hw/mana/main.c -index 85717482a616e7..6fa9b125329970 100644 ---- a/drivers/infiniband/hw/mana/main.c -+++ b/drivers/infiniband/hw/mana/main.c -@@ -180,7 +180,7 @@ static int mana_gd_allocate_doorbell_page(struct gdma_context *gc, - - req.resource_type = GDMA_RESOURCE_DOORBELL_PAGE; - req.num_resources = 1; -- req.alignment = 1; -+ req.alignment = PAGE_SIZE / MANA_PAGE_SIZE; - - /* Have GDMA start searching from 0 */ - req.allocated_resources = 0; -diff --git a/drivers/infiniband/hw/mlx5/ah.c b/drivers/infiniband/hw/mlx5/ah.c -index 505bc47fd575d5..99036afb3aef0b 100644 ---- a/drivers/infiniband/hw/mlx5/ah.c -+++ b/drivers/infiniband/hw/mlx5/ah.c -@@ -67,7 +67,8 @@ static void create_ib_ah(struct mlx5_ib_dev *dev, struct mlx5_ib_ah *ah, - ah->av.tclass = grh->traffic_class; - } - -- ah->av.stat_rate_sl = (rdma_ah_get_static_rate(ah_attr) << 4); -+ ah->av.stat_rate_sl = -+ (mlx5r_ib_rate(dev, rdma_ah_get_static_rate(ah_attr)) << 4); - - if (ah_attr->type == RDMA_AH_ATTR_TYPE_ROCE) { - if (init_attr->xmit_slave) -diff --git a/drivers/infiniband/hw/mlx5/counters.c b/drivers/infiniband/hw/mlx5/counters.c -index 8300ce6228350d..b049bba2157905 100644 ---- a/drivers/infiniband/hw/mlx5/counters.c -+++ b/drivers/infiniband/hw/mlx5/counters.c -@@ -542,6 +542,7 @@ static int mlx5_ib_counter_bind_qp(struct rdma_counter *counter, - struct ib_qp *qp) - { - struct mlx5_ib_dev *dev = to_mdev(qp->device); -+ bool new = false; - int err; - - if (!counter->id) { -@@ -556,6 +557,7 @@ static int mlx5_ib_counter_bind_qp(struct rdma_counter *counter, - return err; - counter->id = - MLX5_GET(alloc_q_counter_out, out, counter_set_id); -+ new = true; - } - - err = mlx5_ib_qp_set_counter(qp, counter); -@@ -565,8 +567,10 @@ static int mlx5_ib_counter_bind_qp(struct rdma_counter *counter, - return 0; - - fail_set_counter: -- mlx5_ib_counter_dealloc(counter); -- counter->id = 0; -+ if (new) { -+ mlx5_ib_counter_dealloc(counter); -+ counter->id = 0; -+ } - - return err; - } -diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c -index 71a856409cee2c..0a9ae84600b204 100644 ---- a/drivers/infiniband/hw/mlx5/qp.c -+++ b/drivers/infiniband/hw/mlx5/qp.c -@@ -3433,11 +3433,11 @@ static int ib_to_mlx5_rate_map(u8 rate) - return 0; - } - --static int ib_rate_to_mlx5(struct mlx5_ib_dev *dev, u8 rate) -+int mlx5r_ib_rate(struct mlx5_ib_dev *dev, u8 rate) - { - u32 stat_rate_support; - -- if (rate == IB_RATE_PORT_CURRENT) -+ if (rate == IB_RATE_PORT_CURRENT || rate == IB_RATE_800_GBPS) - return 0; - - if (rate < IB_RATE_2_5_GBPS || rate > IB_RATE_600_GBPS) -@@ -3582,7 +3582,7 @@ static int mlx5_set_path(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp, - sizeof(grh->dgid.raw)); - } - -- err = ib_rate_to_mlx5(dev, rdma_ah_get_static_rate(ah)); -+ err = mlx5r_ib_rate(dev, rdma_ah_get_static_rate(ah)); - if (err < 0) - return err; - MLX5_SET(ads, path, stat_rate, err); -@@ -4555,6 +4555,8 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr, - - set_id = mlx5_ib_get_counters_id(dev, attr->port_num - 1); - MLX5_SET(dctc, dctc, counter_set_id, set_id); -+ -+ qp->port = attr->port_num; - } else if (cur_state == IB_QPS_INIT && new_state == IB_QPS_RTR) { - struct mlx5_ib_modify_qp_resp resp = {}; - u32 out[MLX5_ST_SZ_DW(create_dct_out)] = {}; -@@ -5045,7 +5047,7 @@ static int mlx5_ib_dct_query_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *mqp, - } - - if (qp_attr_mask & IB_QP_PORT) -- qp_attr->port_num = MLX5_GET(dctc, dctc, port); -+ qp_attr->port_num = mqp->port; - if (qp_attr_mask & IB_QP_MIN_RNR_TIMER) - qp_attr->min_rnr_timer = MLX5_GET(dctc, dctc, min_rnr_nak); - if (qp_attr_mask & IB_QP_AV) { -diff --git a/drivers/infiniband/hw/mlx5/qp.h b/drivers/infiniband/hw/mlx5/qp.h -index b6ee7c3ee1ca1b..2530e7730635f3 100644 ---- a/drivers/infiniband/hw/mlx5/qp.h -+++ b/drivers/infiniband/hw/mlx5/qp.h -@@ -56,4 +56,5 @@ int mlx5_core_xrcd_dealloc(struct mlx5_ib_dev *dev, u32 xrcdn); - int mlx5_ib_qp_set_counter(struct ib_qp *qp, struct rdma_counter *counter); - int mlx5_ib_qp_event_init(void); - void mlx5_ib_qp_event_cleanup(void); -+int mlx5r_ib_rate(struct mlx5_ib_dev *dev, u8 rate); - #endif /* _MLX5_IB_QP_H */ -diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h -index 78c972bb1d9623..9fb5a18e056d41 100644 ---- a/drivers/net/ethernet/cadence/macb.h -+++ b/drivers/net/ethernet/cadence/macb.h -@@ -1270,6 +1270,8 @@ struct macb { - struct clk *rx_clk; - struct clk *tsu_clk; - struct net_device *dev; -+ /* Protects hw_stats and ethtool_stats */ -+ spinlock_t stats_lock; - union { - struct macb_stats macb; - struct gem_stats gem; -diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c -index 8f61731e4554ba..4325d0ace1f268 100644 ---- a/drivers/net/ethernet/cadence/macb_main.c -+++ b/drivers/net/ethernet/cadence/macb_main.c -@@ -1992,10 +1992,12 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id) - - if (status & MACB_BIT(ISR_ROVR)) { - /* We missed at least one packet */ -+ spin_lock(&bp->stats_lock); - if (macb_is_gem(bp)) - bp->hw_stats.gem.rx_overruns++; - else - bp->hw_stats.macb.rx_overruns++; -+ spin_unlock(&bp->stats_lock); - - if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE) - queue_writel(queue, ISR, MACB_BIT(ISR_ROVR)); -@@ -3084,6 +3086,7 @@ static struct net_device_stats *gem_get_stats(struct macb *bp) - if (!netif_running(bp->dev)) - return nstat; - -+ spin_lock_irq(&bp->stats_lock); - gem_update_stats(bp); - - nstat->rx_errors = (hwstat->rx_frame_check_sequence_errors + -@@ -3113,6 +3116,7 @@ static struct net_device_stats *gem_get_stats(struct macb *bp) - nstat->tx_aborted_errors = hwstat->tx_excessive_collisions; - nstat->tx_carrier_errors = hwstat->tx_carrier_sense_errors; - nstat->tx_fifo_errors = hwstat->tx_underrun; -+ spin_unlock_irq(&bp->stats_lock); - - return nstat; - } -@@ -3120,12 +3124,13 @@ static struct net_device_stats *gem_get_stats(struct macb *bp) - static void gem_get_ethtool_stats(struct net_device *dev, - struct ethtool_stats *stats, u64 *data) - { -- struct macb *bp; -+ struct macb *bp = netdev_priv(dev); - -- bp = netdev_priv(dev); -+ spin_lock_irq(&bp->stats_lock); - gem_update_stats(bp); - memcpy(data, &bp->ethtool_stats, sizeof(u64) - * (GEM_STATS_LEN + QUEUE_STATS_LEN * MACB_MAX_QUEUES)); -+ spin_unlock_irq(&bp->stats_lock); - } - - static int gem_get_sset_count(struct net_device *dev, int sset) -@@ -3175,6 +3180,7 @@ static struct net_device_stats *macb_get_stats(struct net_device *dev) - return gem_get_stats(bp); - - /* read stats from hardware */ -+ spin_lock_irq(&bp->stats_lock); - macb_update_stats(bp); - - /* Convert HW stats into netdevice stats */ -@@ -3208,6 +3214,7 @@ static struct net_device_stats *macb_get_stats(struct net_device *dev) - nstat->tx_carrier_errors = hwstat->tx_carrier_errors; - nstat->tx_fifo_errors = hwstat->tx_underruns; - /* Don't know about heartbeat or window errors... */ -+ spin_unlock_irq(&bp->stats_lock); - - return nstat; - } -@@ -5063,6 +5070,7 @@ static int macb_probe(struct platform_device *pdev) - } - } - spin_lock_init(&bp->lock); -+ spin_lock_init(&bp->stats_lock); - - /* setup capabilities */ - macb_configure_caps(bp, macb_config); -diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c -index 87b27bd7a13bb1..9aa57134f460cd 100644 ---- a/drivers/net/ethernet/freescale/enetc/enetc.c -+++ b/drivers/net/ethernet/freescale/enetc/enetc.c -@@ -145,6 +145,24 @@ static int enetc_ptp_parse(struct sk_buff *skb, u8 *udp, - return 0; - } - -+/** -+ * enetc_unwind_tx_frame() - Unwind the DMA mappings of a multi-buffer Tx frame -+ * @tx_ring: Pointer to the Tx ring on which the buffer descriptors are located -+ * @count: Number of Tx buffer descriptors which need to be unmapped -+ * @i: Index of the last successfully mapped Tx buffer descriptor -+ */ -+static void enetc_unwind_tx_frame(struct enetc_bdr *tx_ring, int count, int i) -+{ -+ while (count--) { -+ struct enetc_tx_swbd *tx_swbd = &tx_ring->tx_swbd[i]; -+ -+ enetc_free_tx_frame(tx_ring, tx_swbd); -+ if (i == 0) -+ i = tx_ring->bd_count; -+ i--; -+ } -+} -+ - static int enetc_map_tx_buffs(struct enetc_bdr *tx_ring, struct sk_buff *skb) - { - bool do_vlan, do_onestep_tstamp = false, do_twostep_tstamp = false; -@@ -235,9 +253,11 @@ static int enetc_map_tx_buffs(struct enetc_bdr *tx_ring, struct sk_buff *skb) - } - - if (do_onestep_tstamp) { -- u32 lo, hi, val; -- u64 sec, nsec; -+ __be32 new_sec_l, new_nsec; -+ u32 lo, hi, nsec, val; -+ __be16 new_sec_h; - u8 *data; -+ u64 sec; - - lo = enetc_rd_hot(hw, ENETC_SICTR0); - hi = enetc_rd_hot(hw, ENETC_SICTR1); -@@ -251,13 +271,38 @@ static int enetc_map_tx_buffs(struct enetc_bdr *tx_ring, struct sk_buff *skb) - /* Update originTimestamp field of Sync packet - * - 48 bits seconds field - * - 32 bits nanseconds field -+ * -+ * In addition, the UDP checksum needs to be updated -+ * by software after updating originTimestamp field, -+ * otherwise the hardware will calculate the wrong -+ * checksum when updating the correction field and -+ * update it to the packet. - */ - data = skb_mac_header(skb); -- *(__be16 *)(data + offset2) = -- htons((sec >> 32) & 0xffff); -- *(__be32 *)(data + offset2 + 2) = -- htonl(sec & 0xffffffff); -- *(__be32 *)(data + offset2 + 6) = htonl(nsec); -+ new_sec_h = htons((sec >> 32) & 0xffff); -+ new_sec_l = htonl(sec & 0xffffffff); -+ new_nsec = htonl(nsec); -+ if (udp) { -+ struct udphdr *uh = udp_hdr(skb); -+ __be32 old_sec_l, old_nsec; -+ __be16 old_sec_h; -+ -+ old_sec_h = *(__be16 *)(data + offset2); -+ inet_proto_csum_replace2(&uh->check, skb, old_sec_h, -+ new_sec_h, false); -+ -+ old_sec_l = *(__be32 *)(data + offset2 + 2); -+ inet_proto_csum_replace4(&uh->check, skb, old_sec_l, -+ new_sec_l, false); -+ -+ old_nsec = *(__be32 *)(data + offset2 + 6); -+ inet_proto_csum_replace4(&uh->check, skb, old_nsec, -+ new_nsec, false); -+ } -+ -+ *(__be16 *)(data + offset2) = new_sec_h; -+ *(__be32 *)(data + offset2 + 2) = new_sec_l; -+ *(__be32 *)(data + offset2 + 6) = new_nsec; - - /* Configure single-step register */ - val = ENETC_PM0_SINGLE_STEP_EN; -@@ -328,25 +373,20 @@ static int enetc_map_tx_buffs(struct enetc_bdr *tx_ring, struct sk_buff *skb) - dma_err: - dev_err(tx_ring->dev, "DMA map error"); - -- do { -- tx_swbd = &tx_ring->tx_swbd[i]; -- enetc_free_tx_frame(tx_ring, tx_swbd); -- if (i == 0) -- i = tx_ring->bd_count; -- i--; -- } while (count--); -+ enetc_unwind_tx_frame(tx_ring, count, i); - - return 0; - } - --static void enetc_map_tx_tso_hdr(struct enetc_bdr *tx_ring, struct sk_buff *skb, -- struct enetc_tx_swbd *tx_swbd, -- union enetc_tx_bd *txbd, int *i, int hdr_len, -- int data_len) -+static int enetc_map_tx_tso_hdr(struct enetc_bdr *tx_ring, struct sk_buff *skb, -+ struct enetc_tx_swbd *tx_swbd, -+ union enetc_tx_bd *txbd, int *i, int hdr_len, -+ int data_len) - { - union enetc_tx_bd txbd_tmp; - u8 flags = 0, e_flags = 0; - dma_addr_t addr; -+ int count = 1; - - enetc_clear_tx_bd(&txbd_tmp); - addr = tx_ring->tso_headers_dma + *i * TSO_HEADER_SIZE; -@@ -389,7 +429,10 @@ static void enetc_map_tx_tso_hdr(struct enetc_bdr *tx_ring, struct sk_buff *skb, - /* Write the BD */ - txbd_tmp.ext.e_flags = e_flags; - *txbd = txbd_tmp; -+ count++; - } -+ -+ return count; - } - - static int enetc_map_tx_tso_data(struct enetc_bdr *tx_ring, struct sk_buff *skb, -@@ -521,9 +564,9 @@ static int enetc_map_tx_tso_buffs(struct enetc_bdr *tx_ring, struct sk_buff *skb - - /* compute the csum over the L4 header */ - csum = enetc_tso_hdr_csum(&tso, skb, hdr, hdr_len, &pos); -- enetc_map_tx_tso_hdr(tx_ring, skb, tx_swbd, txbd, &i, hdr_len, data_len); -+ count += enetc_map_tx_tso_hdr(tx_ring, skb, tx_swbd, txbd, -+ &i, hdr_len, data_len); - bd_data_num = 0; -- count++; - - while (data_len > 0) { - int size; -@@ -547,8 +590,13 @@ static int enetc_map_tx_tso_buffs(struct enetc_bdr *tx_ring, struct sk_buff *skb - err = enetc_map_tx_tso_data(tx_ring, skb, tx_swbd, txbd, - tso.data, size, - size == data_len); -- if (err) -+ if (err) { -+ if (i == 0) -+ i = tx_ring->bd_count; -+ i--; -+ - goto err_map_data; -+ } - - data_len -= size; - count++; -@@ -577,13 +625,7 @@ static int enetc_map_tx_tso_buffs(struct enetc_bdr *tx_ring, struct sk_buff *skb - dev_err(tx_ring->dev, "DMA map error"); - - err_chained_bd: -- do { -- tx_swbd = &tx_ring->tx_swbd[i]; -- enetc_free_tx_frame(tx_ring, tx_swbd); -- if (i == 0) -- i = tx_ring->bd_count; -- i--; -- } while (count--); -+ enetc_unwind_tx_frame(tx_ring, count, i); - - return 0; - } -@@ -1626,7 +1668,7 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring, - enetc_xdp_drop(rx_ring, orig_i, i); - tx_ring->stats.xdp_tx_drops++; - } else { -- tx_ring->stats.xdp_tx += xdp_tx_bd_cnt; -+ tx_ring->stats.xdp_tx++; - rx_ring->xdp.xdp_tx_in_flight += xdp_tx_bd_cnt; - xdp_tx_frm_cnt++; - /* The XDP_TX enqueue was successful, so we -diff --git a/drivers/net/ethernet/google/gve/gve.h b/drivers/net/ethernet/google/gve/gve.h -index 0d1e681be25070..d59e28c8677523 100644 ---- a/drivers/net/ethernet/google/gve/gve.h -+++ b/drivers/net/ethernet/google/gve/gve.h -@@ -1030,6 +1030,16 @@ static inline u32 gve_xdp_tx_start_queue_id(struct gve_priv *priv) - return gve_xdp_tx_queue_id(priv, 0); - } - -+static inline bool gve_supports_xdp_xmit(struct gve_priv *priv) -+{ -+ switch (priv->queue_format) { -+ case GVE_GQI_QPL_FORMAT: -+ return true; -+ default: -+ return false; -+ } -+} -+ - /* buffers */ - int gve_alloc_page(struct gve_priv *priv, struct device *dev, - struct page **page, dma_addr_t *dma, -diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c -index 90d433b36799fb..8cd098fe88ef26 100644 ---- a/drivers/net/ethernet/google/gve/gve_main.c -+++ b/drivers/net/ethernet/google/gve/gve_main.c -@@ -1753,6 +1753,8 @@ static void gve_turndown(struct gve_priv *priv) - /* Stop tx queues */ - netif_tx_disable(priv->dev); - -+ xdp_features_clear_redirect_target(priv->dev); -+ - gve_clear_napi_enabled(priv); - gve_clear_report_stats(priv); - -@@ -1793,6 +1795,9 @@ static void gve_turnup(struct gve_priv *priv) - } - } - -+ if (priv->num_xdp_queues && gve_supports_xdp_xmit(priv)) -+ xdp_features_set_redirect_target(priv->dev, false); -+ - gve_set_napi_enabled(priv); - } - -@@ -2014,7 +2019,6 @@ static void gve_set_netdev_xdp_features(struct gve_priv *priv) - if (priv->queue_format == GVE_GQI_QPL_FORMAT) { - xdp_features = NETDEV_XDP_ACT_BASIC; - xdp_features |= NETDEV_XDP_ACT_REDIRECT; -- xdp_features |= NETDEV_XDP_ACT_NDO_XMIT; - xdp_features |= NETDEV_XDP_ACT_XSK_ZEROCOPY; - } else { - xdp_features = 0; -diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h -index f943964ec05ae7..e29a7ffd5f1437 100644 ---- a/drivers/net/ethernet/intel/ice/ice.h -+++ b/drivers/net/ethernet/intel/ice/ice.h -@@ -202,6 +202,7 @@ enum ice_feature { - ICE_F_GNSS, - ICE_F_ROCE_LAG, - ICE_F_SRIOV_LAG, -+ ICE_F_MBX_LIMIT, - ICE_F_MAX - }; - -diff --git a/drivers/net/ethernet/intel/ice/ice_common.c b/drivers/net/ethernet/intel/ice/ice_common.c -index 80deca45ab599a..983332cbace21f 100644 ---- a/drivers/net/ethernet/intel/ice/ice_common.c -+++ b/drivers/net/ethernet/intel/ice/ice_common.c -@@ -1,5 +1,5 @@ - // SPDX-License-Identifier: GPL-2.0 --/* Copyright (c) 2018, Intel Corporation. */ -+/* Copyright (c) 2018-2023, Intel Corporation. */ - - #include "ice_common.h" - #include "ice_sched.h" -@@ -153,6 +153,12 @@ static int ice_set_mac_type(struct ice_hw *hw) - case ICE_DEV_ID_E823L_SFP: - hw->mac_type = ICE_MAC_GENERIC; - break; -+ case ICE_DEV_ID_E830_BACKPLANE: -+ case ICE_DEV_ID_E830_QSFP56: -+ case ICE_DEV_ID_E830_SFP: -+ case ICE_DEV_ID_E830_SFP_DD: -+ hw->mac_type = ICE_MAC_E830; -+ break; - default: - hw->mac_type = ICE_MAC_UNKNOWN; - break; -@@ -684,8 +690,7 @@ static void - ice_fill_tx_timer_and_fc_thresh(struct ice_hw *hw, - struct ice_aqc_set_mac_cfg *cmd) - { -- u16 fc_thres_val, tx_timer_val; -- u32 val; -+ u32 val, fc_thres_m; - - /* We read back the transmit timer and FC threshold value of - * LFC. Thus, we will use index = -@@ -694,19 +699,32 @@ ice_fill_tx_timer_and_fc_thresh(struct ice_hw *hw, - * Also, because we are operating on transmit timer and FC - * threshold of LFC, we don't turn on any bit in tx_tmr_priority - */ --#define IDX_OF_LFC PRTMAC_HSEC_CTL_TX_PAUSE_QUANTA_MAX_INDEX -- -- /* Retrieve the transmit timer */ -- val = rd32(hw, PRTMAC_HSEC_CTL_TX_PAUSE_QUANTA(IDX_OF_LFC)); -- tx_timer_val = val & -- PRTMAC_HSEC_CTL_TX_PAUSE_QUANTA_HSEC_CTL_TX_PAUSE_QUANTA_M; -- cmd->tx_tmr_value = cpu_to_le16(tx_timer_val); -- -- /* Retrieve the FC threshold */ -- val = rd32(hw, PRTMAC_HSEC_CTL_TX_PAUSE_REFRESH_TIMER(IDX_OF_LFC)); -- fc_thres_val = val & PRTMAC_HSEC_CTL_TX_PAUSE_REFRESH_TIMER_M; -- -- cmd->fc_refresh_threshold = cpu_to_le16(fc_thres_val); -+#define E800_IDX_OF_LFC E800_PRTMAC_HSEC_CTL_TX_PS_QNT_MAX -+#define E800_REFRESH_TMR E800_PRTMAC_HSEC_CTL_TX_PS_RFSH_TMR -+ -+ if (hw->mac_type == ICE_MAC_E830) { -+ /* Retrieve the transmit timer */ -+ val = rd32(hw, E830_PRTMAC_CL01_PS_QNT); -+ cmd->tx_tmr_value = -+ le16_encode_bits(val, E830_PRTMAC_CL01_PS_QNT_CL0_M); -+ -+ /* Retrieve the fc threshold */ -+ val = rd32(hw, E830_PRTMAC_CL01_QNT_THR); -+ fc_thres_m = E830_PRTMAC_CL01_QNT_THR_CL0_M; -+ } else { -+ /* Retrieve the transmit timer */ -+ val = rd32(hw, -+ E800_PRTMAC_HSEC_CTL_TX_PS_QNT(E800_IDX_OF_LFC)); -+ cmd->tx_tmr_value = -+ le16_encode_bits(val, -+ E800_PRTMAC_HSEC_CTL_TX_PS_QNT_M); -+ -+ /* Retrieve the fc threshold */ -+ val = rd32(hw, -+ E800_REFRESH_TMR(E800_IDX_OF_LFC)); -+ fc_thres_m = E800_PRTMAC_HSEC_CTL_TX_PS_RFSH_TMR_M; -+ } -+ cmd->fc_refresh_threshold = le16_encode_bits(val, fc_thres_m); - } - - /** -@@ -2389,16 +2407,21 @@ ice_parse_1588_func_caps(struct ice_hw *hw, struct ice_hw_func_caps *func_p, - static void - ice_parse_fdir_func_caps(struct ice_hw *hw, struct ice_hw_func_caps *func_p) - { -- u32 reg_val, val; -+ u32 reg_val, gsize, bsize; - - reg_val = rd32(hw, GLQF_FD_SIZE); -- val = (reg_val & GLQF_FD_SIZE_FD_GSIZE_M) >> -- GLQF_FD_SIZE_FD_GSIZE_S; -- func_p->fd_fltr_guar = -- ice_get_num_per_func(hw, val); -- val = (reg_val & GLQF_FD_SIZE_FD_BSIZE_M) >> -- GLQF_FD_SIZE_FD_BSIZE_S; -- func_p->fd_fltr_best_effort = val; -+ switch (hw->mac_type) { -+ case ICE_MAC_E830: -+ gsize = FIELD_GET(E830_GLQF_FD_SIZE_FD_GSIZE_M, reg_val); -+ bsize = FIELD_GET(E830_GLQF_FD_SIZE_FD_BSIZE_M, reg_val); -+ break; -+ case ICE_MAC_E810: -+ default: -+ gsize = FIELD_GET(E800_GLQF_FD_SIZE_FD_GSIZE_M, reg_val); -+ bsize = FIELD_GET(E800_GLQF_FD_SIZE_FD_BSIZE_M, reg_val); -+ } -+ func_p->fd_fltr_guar = ice_get_num_per_func(hw, gsize); -+ func_p->fd_fltr_best_effort = bsize; - - ice_debug(hw, ICE_DBG_INIT, "func caps: fd_fltr_guar = %d\n", - func_p->fd_fltr_guar); -diff --git a/drivers/net/ethernet/intel/ice/ice_devids.h b/drivers/net/ethernet/intel/ice/ice_devids.h -index 6d560d1c74a4a3..a2d384dbfc767b 100644 ---- a/drivers/net/ethernet/intel/ice/ice_devids.h -+++ b/drivers/net/ethernet/intel/ice/ice_devids.h -@@ -1,5 +1,5 @@ - /* SPDX-License-Identifier: GPL-2.0 */ --/* Copyright (c) 2018, Intel Corporation. */ -+/* Copyright (c) 2018-2023, Intel Corporation. */ - - #ifndef _ICE_DEVIDS_H_ - #define _ICE_DEVIDS_H_ -@@ -16,6 +16,14 @@ - #define ICE_DEV_ID_E823L_1GBE 0x124F - /* Intel(R) Ethernet Connection E823-L for QSFP */ - #define ICE_DEV_ID_E823L_QSFP 0x151D -+/* Intel(R) Ethernet Controller E830-C for backplane */ -+#define ICE_DEV_ID_E830_BACKPLANE 0x12D1 -+/* Intel(R) Ethernet Controller E830-C for QSFP */ -+#define ICE_DEV_ID_E830_QSFP56 0x12D2 -+/* Intel(R) Ethernet Controller E830-C for SFP */ -+#define ICE_DEV_ID_E830_SFP 0x12D3 -+/* Intel(R) Ethernet Controller E830-C for SFP-DD */ -+#define ICE_DEV_ID_E830_SFP_DD 0x12D4 - /* Intel(R) Ethernet Controller E810-C for backplane */ - #define ICE_DEV_ID_E810C_BACKPLANE 0x1591 - /* Intel(R) Ethernet Controller E810-C for QSFP */ -diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c b/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c -index b6bbf2376ef5c1..d43b642cbc01cc 100644 ---- a/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c -+++ b/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c -@@ -1,5 +1,5 @@ - // SPDX-License-Identifier: GPL-2.0 --/* Copyright (C) 2018-2020, Intel Corporation. */ -+/* Copyright (C) 2018-2023, Intel Corporation. */ - - /* flow director ethtool support for ice */ - -@@ -540,16 +540,24 @@ int ice_fdir_num_avail_fltr(struct ice_hw *hw, struct ice_vsi *vsi) - /* total guaranteed filters assigned to this VSI */ - num_guar = vsi->num_gfltr; - -- /* minus the guaranteed filters programed by this VSI */ -- num_guar -= (rd32(hw, VSIQF_FD_CNT(vsi_num)) & -- VSIQF_FD_CNT_FD_GCNT_M) >> VSIQF_FD_CNT_FD_GCNT_S; -- - /* total global best effort filters */ - num_be = hw->func_caps.fd_fltr_best_effort; - -- /* minus the global best effort filters programmed */ -- num_be -= (rd32(hw, GLQF_FD_CNT) & GLQF_FD_CNT_FD_BCNT_M) >> -- GLQF_FD_CNT_FD_BCNT_S; -+ /* Subtract the number of programmed filters from the global values */ -+ switch (hw->mac_type) { -+ case ICE_MAC_E830: -+ num_guar -= FIELD_GET(E830_VSIQF_FD_CNT_FD_GCNT_M, -+ rd32(hw, VSIQF_FD_CNT(vsi_num))); -+ num_be -= FIELD_GET(E830_GLQF_FD_CNT_FD_BCNT_M, -+ rd32(hw, GLQF_FD_CNT)); -+ break; -+ case ICE_MAC_E810: -+ default: -+ num_guar -= FIELD_GET(E800_VSIQF_FD_CNT_FD_GCNT_M, -+ rd32(hw, VSIQF_FD_CNT(vsi_num))); -+ num_be -= FIELD_GET(E800_GLQF_FD_CNT_FD_BCNT_M, -+ rd32(hw, GLQF_FD_CNT)); -+ } - - return num_guar + num_be; - } -diff --git a/drivers/net/ethernet/intel/ice/ice_hw_autogen.h b/drivers/net/ethernet/intel/ice/ice_hw_autogen.h -index 531cc2194741ed..96f70c0a965980 100644 ---- a/drivers/net/ethernet/intel/ice/ice_hw_autogen.h -+++ b/drivers/net/ethernet/intel/ice/ice_hw_autogen.h -@@ -1,5 +1,5 @@ - /* SPDX-License-Identifier: GPL-2.0 */ --/* Copyright (c) 2018, Intel Corporation. */ -+/* Copyright (c) 2018-2023, Intel Corporation. */ - - /* Machine-generated file */ - -@@ -284,11 +284,11 @@ - #define VPLAN_TX_QBASE_VFNUMQ_M ICE_M(0xFF, 16) - #define VPLAN_TXQ_MAPENA(_VF) (0x00073800 + ((_VF) * 4)) - #define VPLAN_TXQ_MAPENA_TX_ENA_M BIT(0) --#define PRTMAC_HSEC_CTL_TX_PAUSE_QUANTA(_i) (0x001E36E0 + ((_i) * 32)) --#define PRTMAC_HSEC_CTL_TX_PAUSE_QUANTA_MAX_INDEX 8 --#define PRTMAC_HSEC_CTL_TX_PAUSE_QUANTA_HSEC_CTL_TX_PAUSE_QUANTA_M ICE_M(0xFFFF, 0) --#define PRTMAC_HSEC_CTL_TX_PAUSE_REFRESH_TIMER(_i) (0x001E3800 + ((_i) * 32)) --#define PRTMAC_HSEC_CTL_TX_PAUSE_REFRESH_TIMER_M ICE_M(0xFFFF, 0) -+#define E800_PRTMAC_HSEC_CTL_TX_PS_QNT(_i) (0x001E36E0 + ((_i) * 32)) -+#define E800_PRTMAC_HSEC_CTL_TX_PS_QNT_MAX 8 -+#define E800_PRTMAC_HSEC_CTL_TX_PS_QNT_M GENMASK(15, 0) -+#define E800_PRTMAC_HSEC_CTL_TX_PS_RFSH_TMR(_i) (0x001E3800 + ((_i) * 32)) -+#define E800_PRTMAC_HSEC_CTL_TX_PS_RFSH_TMR_M GENMASK(15, 0) - #define GL_MDCK_TX_TDPU 0x00049348 - #define GL_MDCK_TX_TDPU_RCU_ANTISPOOF_ITR_DIS_M BIT(1) - #define GL_MDET_RX 0x00294C00 -@@ -311,7 +311,11 @@ - #define GL_MDET_TX_PQM_MAL_TYPE_S 26 - #define GL_MDET_TX_PQM_MAL_TYPE_M ICE_M(0x1F, 26) - #define GL_MDET_TX_PQM_VALID_M BIT(31) --#define GL_MDET_TX_TCLAN 0x000FC068 -+#define GL_MDET_TX_TCLAN_BY_MAC(hw) \ -+ ((hw)->mac_type == ICE_MAC_E830 ? E830_GL_MDET_TX_TCLAN : \ -+ E800_GL_MDET_TX_TCLAN) -+#define E800_GL_MDET_TX_TCLAN 0x000FC068 -+#define E830_GL_MDET_TX_TCLAN 0x000FCCC0 - #define GL_MDET_TX_TCLAN_QNUM_S 0 - #define GL_MDET_TX_TCLAN_QNUM_M ICE_M(0x7FFF, 0) - #define GL_MDET_TX_TCLAN_VF_NUM_S 15 -@@ -325,7 +329,11 @@ - #define PF_MDET_RX_VALID_M BIT(0) - #define PF_MDET_TX_PQM 0x002D2C80 - #define PF_MDET_TX_PQM_VALID_M BIT(0) --#define PF_MDET_TX_TCLAN 0x000FC000 -+#define PF_MDET_TX_TCLAN_BY_MAC(hw) \ -+ ((hw)->mac_type == ICE_MAC_E830 ? E830_PF_MDET_TX_TCLAN : \ -+ E800_PF_MDET_TX_TCLAN) -+#define E800_PF_MDET_TX_TCLAN 0x000FC000 -+#define E830_PF_MDET_TX_TCLAN 0x000FCC00 - #define PF_MDET_TX_TCLAN_VALID_M BIT(0) - #define VP_MDET_RX(_VF) (0x00294400 + ((_VF) * 4)) - #define VP_MDET_RX_VALID_M BIT(0) -@@ -335,6 +343,8 @@ - #define VP_MDET_TX_TCLAN_VALID_M BIT(0) - #define VP_MDET_TX_TDPU(_VF) (0x00040000 + ((_VF) * 4)) - #define VP_MDET_TX_TDPU_VALID_M BIT(0) -+#define E800_GL_MNG_FWSM_FW_MODES_M GENMASK(2, 0) -+#define E830_GL_MNG_FWSM_FW_MODES_M GENMASK(1, 0) - #define GL_MNG_FWSM 0x000B6134 - #define GL_MNG_FWSM_FW_LOADING_M BIT(30) - #define GLNVM_FLA 0x000B6108 -@@ -363,13 +373,18 @@ - #define GL_PWR_MODE_CTL_CAR_MAX_BW_S 30 - #define GL_PWR_MODE_CTL_CAR_MAX_BW_M ICE_M(0x3, 30) - #define GLQF_FD_CNT 0x00460018 -+#define E800_GLQF_FD_CNT_FD_GCNT_M GENMASK(14, 0) -+#define E830_GLQF_FD_CNT_FD_GCNT_M GENMASK(15, 0) - #define GLQF_FD_CNT_FD_BCNT_S 16 --#define GLQF_FD_CNT_FD_BCNT_M ICE_M(0x7FFF, 16) -+#define E800_GLQF_FD_CNT_FD_BCNT_M GENMASK(30, 16) -+#define E830_GLQF_FD_CNT_FD_BCNT_M GENMASK(31, 16) - #define GLQF_FD_SIZE 0x00460010 - #define GLQF_FD_SIZE_FD_GSIZE_S 0 --#define GLQF_FD_SIZE_FD_GSIZE_M ICE_M(0x7FFF, 0) -+#define E800_GLQF_FD_SIZE_FD_GSIZE_M GENMASK(14, 0) -+#define E830_GLQF_FD_SIZE_FD_GSIZE_M GENMASK(15, 0) - #define GLQF_FD_SIZE_FD_BSIZE_S 16 --#define GLQF_FD_SIZE_FD_BSIZE_M ICE_M(0x7FFF, 16) -+#define E800_GLQF_FD_SIZE_FD_BSIZE_M GENMASK(30, 16) -+#define E830_GLQF_FD_SIZE_FD_BSIZE_M GENMASK(31, 16) - #define GLQF_FDINSET(_i, _j) (0x00412000 + ((_i) * 4 + (_j) * 512)) - #define GLQF_FDMASK(_i) (0x00410800 + ((_i) * 4)) - #define GLQF_FDMASK_MAX_INDEX 31 -@@ -388,6 +403,10 @@ - #define GLQF_HMASK_SEL(_i) (0x00410000 + ((_i) * 4)) - #define GLQF_HMASK_SEL_MAX_INDEX 127 - #define GLQF_HMASK_SEL_MASK_SEL_S 0 -+#define E800_PFQF_FD_CNT_FD_GCNT_M GENMASK(14, 0) -+#define E830_PFQF_FD_CNT_FD_GCNT_M GENMASK(15, 0) -+#define E800_PFQF_FD_CNT_FD_BCNT_M GENMASK(30, 16) -+#define E830_PFQF_FD_CNT_FD_BCNT_M GENMASK(31, 16) - #define PFQF_FD_ENA 0x0043A000 - #define PFQF_FD_ENA_FD_ENA_M BIT(0) - #define PFQF_FD_SIZE 0x00460100 -@@ -478,6 +497,7 @@ - #define GLTSYN_SYNC_DLAY 0x00088818 - #define GLTSYN_TGT_H_0(_i) (0x00088930 + ((_i) * 4)) - #define GLTSYN_TGT_L_0(_i) (0x00088928 + ((_i) * 4)) -+#define GLTSYN_TIME_0(_i) (0x000888C8 + ((_i) * 4)) - #define GLTSYN_TIME_H(_i) (0x000888D8 + ((_i) * 4)) - #define GLTSYN_TIME_L(_i) (0x000888D0 + ((_i) * 4)) - #define PFHH_SEM 0x000A4200 /* Reset Source: PFR */ -@@ -486,9 +506,11 @@ - #define PFTSYN_SEM_BUSY_M BIT(0) - #define VSIQF_FD_CNT(_VSI) (0x00464000 + ((_VSI) * 4)) - #define VSIQF_FD_CNT_FD_GCNT_S 0 --#define VSIQF_FD_CNT_FD_GCNT_M ICE_M(0x3FFF, 0) -+#define E800_VSIQF_FD_CNT_FD_GCNT_M GENMASK(13, 0) -+#define E830_VSIQF_FD_CNT_FD_GCNT_M GENMASK(15, 0) - #define VSIQF_FD_CNT_FD_BCNT_S 16 --#define VSIQF_FD_CNT_FD_BCNT_M ICE_M(0x3FFF, 16) -+#define E800_VSIQF_FD_CNT_FD_BCNT_M GENMASK(29, 16) -+#define E830_VSIQF_FD_CNT_FD_BCNT_M GENMASK(31, 16) - #define VSIQF_FD_SIZE(_VSI) (0x00462000 + ((_VSI) * 4)) - #define VSIQF_HKEY_MAX_INDEX 12 - #define PFPM_APM 0x000B8080 -@@ -500,7 +522,14 @@ - #define PFPM_WUS_MAG_M BIT(1) - #define PFPM_WUS_MNG_M BIT(3) - #define PFPM_WUS_FW_RST_WK_M BIT(31) -+#define E830_PRTMAC_CL01_PS_QNT 0x001E32A0 -+#define E830_PRTMAC_CL01_PS_QNT_CL0_M GENMASK(15, 0) -+#define E830_PRTMAC_CL01_QNT_THR 0x001E3320 -+#define E830_PRTMAC_CL01_QNT_THR_CL0_M GENMASK(15, 0) - #define VFINT_DYN_CTLN(_i) (0x00003800 + ((_i) * 4)) - #define VFINT_DYN_CTLN_CLEARPBA_M BIT(1) -+#define E830_MBX_PF_IN_FLIGHT_VF_MSGS_THRESH 0x00234000 -+#define E830_MBX_VF_DEC_TRIG(_VF) (0x00233800 + (_VF) * 4) -+#define E830_MBX_VF_IN_FLIGHT_MSGS_AT_PF_CNT(_VF) (0x00233000 + (_VF) * 4) - - #endif /* _ICE_HW_AUTOGEN_H_ */ -diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c -index 3a0ef56d3edcac..1fc4805353eb58 100644 ---- a/drivers/net/ethernet/intel/ice/ice_lib.c -+++ b/drivers/net/ethernet/intel/ice/ice_lib.c -@@ -4023,6 +4023,9 @@ void ice_init_feature_support(struct ice_pf *pf) - default: - break; - } -+ -+ if (pf->hw.mac_type == ICE_MAC_E830) -+ ice_set_feature_support(pf, ICE_F_MBX_LIMIT); - } - - /** -diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c -index 9f12c9a0fe2968..0ae7bdfff83fb2 100644 ---- a/drivers/net/ethernet/intel/ice/ice_main.c -+++ b/drivers/net/ethernet/intel/ice/ice_main.c -@@ -1,5 +1,5 @@ - // SPDX-License-Identifier: GPL-2.0 --/* Copyright (c) 2018, Intel Corporation. */ -+/* Copyright (c) 2018-2023, Intel Corporation. */ - - /* Intel(R) Ethernet Connection E800 Series Linux Driver */ - -@@ -1514,12 +1514,20 @@ static int __ice_clean_ctrlq(struct ice_pf *pf, enum ice_ctl_q q_type) - ice_vf_lan_overflow_event(pf, &event); - break; - case ice_mbx_opc_send_msg_to_pf: -- data.num_msg_proc = i; -- data.num_pending_arq = pending; -- data.max_num_msgs_mbx = hw->mailboxq.num_rq_entries; -- data.async_watermark_val = ICE_MBX_OVERFLOW_WATERMARK; -+ if (ice_is_feature_supported(pf, ICE_F_MBX_LIMIT)) { -+ ice_vc_process_vf_msg(pf, &event, NULL); -+ ice_mbx_vf_dec_trig_e830(hw, &event); -+ } else { -+ u16 val = hw->mailboxq.num_rq_entries; -+ -+ data.max_num_msgs_mbx = val; -+ val = ICE_MBX_OVERFLOW_WATERMARK; -+ data.async_watermark_val = val; -+ data.num_msg_proc = i; -+ data.num_pending_arq = pending; - -- ice_vc_process_vf_msg(pf, &event, &data); -+ ice_vc_process_vf_msg(pf, &event, &data); -+ } - break; - case ice_aqc_opc_fw_logging: - ice_output_fw_log(hw, &event.desc, event.msg_buf); -@@ -1748,7 +1756,7 @@ static void ice_handle_mdd_event(struct ice_pf *pf) - wr32(hw, GL_MDET_TX_PQM, 0xffffffff); - } - -- reg = rd32(hw, GL_MDET_TX_TCLAN); -+ reg = rd32(hw, GL_MDET_TX_TCLAN_BY_MAC(hw)); - if (reg & GL_MDET_TX_TCLAN_VALID_M) { - u8 pf_num = (reg & GL_MDET_TX_TCLAN_PF_NUM_M) >> - GL_MDET_TX_TCLAN_PF_NUM_S; -@@ -1762,7 +1770,7 @@ static void ice_handle_mdd_event(struct ice_pf *pf) - if (netif_msg_tx_err(pf)) - dev_info(dev, "Malicious Driver Detection event %d on TX queue %d PF# %d VF# %d\n", - event, queue, pf_num, vf_num); -- wr32(hw, GL_MDET_TX_TCLAN, 0xffffffff); -+ wr32(hw, GL_MDET_TX_TCLAN_BY_MAC(hw), U32_MAX); - } - - reg = rd32(hw, GL_MDET_RX); -@@ -1790,9 +1798,9 @@ static void ice_handle_mdd_event(struct ice_pf *pf) - dev_info(dev, "Malicious Driver Detection event TX_PQM detected on PF\n"); - } - -- reg = rd32(hw, PF_MDET_TX_TCLAN); -+ reg = rd32(hw, PF_MDET_TX_TCLAN_BY_MAC(hw)); - if (reg & PF_MDET_TX_TCLAN_VALID_M) { -- wr32(hw, PF_MDET_TX_TCLAN, 0xFFFF); -+ wr32(hw, PF_MDET_TX_TCLAN_BY_MAC(hw), 0xffff); - if (netif_msg_tx_err(pf)) - dev_info(dev, "Malicious Driver Detection event TX_TCLAN detected on PF\n"); - } -@@ -3873,7 +3881,8 @@ static void ice_set_pf_caps(struct ice_pf *pf) - } - - clear_bit(ICE_FLAG_PTP_SUPPORTED, pf->flags); -- if (func_caps->common_cap.ieee_1588) -+ if (func_caps->common_cap.ieee_1588 && -+ !(pf->hw.mac_type == ICE_MAC_E830)) - set_bit(ICE_FLAG_PTP_SUPPORTED, pf->flags); - - pf->max_pf_txqs = func_caps->common_cap.num_txq; -@@ -3919,7 +3928,11 @@ static int ice_init_pf(struct ice_pf *pf) - - mutex_init(&pf->vfs.table_lock); - hash_init(pf->vfs.table); -- ice_mbx_init_snapshot(&pf->hw); -+ if (ice_is_feature_supported(pf, ICE_F_MBX_LIMIT)) -+ wr32(&pf->hw, E830_MBX_PF_IN_FLIGHT_VF_MSGS_THRESH, -+ ICE_MBX_OVERFLOW_WATERMARK); -+ else -+ ice_mbx_init_snapshot(&pf->hw); - - return 0; - } -diff --git a/drivers/net/ethernet/intel/ice/ice_sriov.c b/drivers/net/ethernet/intel/ice/ice_sriov.c -index 31314e7540f8cf..56345fe6537079 100644 ---- a/drivers/net/ethernet/intel/ice/ice_sriov.c -+++ b/drivers/net/ethernet/intel/ice/ice_sriov.c -@@ -36,6 +36,7 @@ static void ice_free_vf_entries(struct ice_pf *pf) - - hash_for_each_safe(vfs->table, bkt, tmp, vf, entry) { - hash_del_rcu(&vf->entry); -+ ice_deinitialize_vf_entry(vf); - ice_put_vf(vf); - } - } -@@ -194,9 +195,6 @@ void ice_free_vfs(struct ice_pf *pf) - wr32(hw, GLGEN_VFLRSTAT(reg_idx), BIT(bit_idx)); - } - -- /* clear malicious info since the VF is getting released */ -- list_del(&vf->mbx_info.list_entry); -- - mutex_unlock(&vf->cfg_lock); - } - -diff --git a/drivers/net/ethernet/intel/ice/ice_type.h b/drivers/net/ethernet/intel/ice/ice_type.h -index 5e353b0cbe6f73..35ee5b29ea34e4 100644 ---- a/drivers/net/ethernet/intel/ice/ice_type.h -+++ b/drivers/net/ethernet/intel/ice/ice_type.h -@@ -1,5 +1,5 @@ - /* SPDX-License-Identifier: GPL-2.0 */ --/* Copyright (c) 2018, Intel Corporation. */ -+/* Copyright (c) 2018-2023, Intel Corporation. */ - - #ifndef _ICE_TYPE_H_ - #define _ICE_TYPE_H_ -@@ -129,6 +129,7 @@ enum ice_set_fc_aq_failures { - enum ice_mac_type { - ICE_MAC_UNKNOWN = 0, - ICE_MAC_E810, -+ ICE_MAC_E830, - ICE_MAC_GENERIC, - }; - -diff --git a/drivers/net/ethernet/intel/ice/ice_vf_lib.c b/drivers/net/ethernet/intel/ice/ice_vf_lib.c -index 03b9d7d748518c..58f9ac81dfbb2c 100644 ---- a/drivers/net/ethernet/intel/ice/ice_vf_lib.c -+++ b/drivers/net/ethernet/intel/ice/ice_vf_lib.c -@@ -701,6 +701,23 @@ ice_vf_clear_vsi_promisc(struct ice_vf *vf, struct ice_vsi *vsi, u8 promisc_m) - return 0; - } - -+/** -+ * ice_reset_vf_mbx_cnt - reset VF mailbox message count -+ * @vf: pointer to the VF structure -+ * -+ * This function clears the VF mailbox message count, and should be called on -+ * VF reset. -+ */ -+static void ice_reset_vf_mbx_cnt(struct ice_vf *vf) -+{ -+ struct ice_pf *pf = vf->pf; -+ -+ if (ice_is_feature_supported(pf, ICE_F_MBX_LIMIT)) -+ ice_mbx_vf_clear_cnt_e830(&pf->hw, vf->vf_id); -+ else -+ ice_mbx_clear_malvf(&vf->mbx_info); -+} -+ - /** - * ice_reset_all_vfs - reset all allocated VFs in one go - * @pf: pointer to the PF structure -@@ -727,7 +744,7 @@ void ice_reset_all_vfs(struct ice_pf *pf) - - /* clear all malicious info if the VFs are getting reset */ - ice_for_each_vf(pf, bkt, vf) -- ice_mbx_clear_malvf(&vf->mbx_info); -+ ice_reset_vf_mbx_cnt(vf); - - /* If VFs have been disabled, there is no need to reset */ - if (test_and_set_bit(ICE_VF_DIS, pf->state)) { -@@ -944,7 +961,7 @@ int ice_reset_vf(struct ice_vf *vf, u32 flags) - ice_eswitch_update_repr(vsi); - - /* if the VF has been reset allow it to come up again */ -- ice_mbx_clear_malvf(&vf->mbx_info); -+ ice_reset_vf_mbx_cnt(vf); - - out_unlock: - if (lag && lag->bonded && lag->primary && -@@ -994,11 +1011,22 @@ void ice_initialize_vf_entry(struct ice_vf *vf) - ice_vf_fdir_init(vf); - - /* Initialize mailbox info for this VF */ -- ice_mbx_init_vf_info(&pf->hw, &vf->mbx_info); -+ if (ice_is_feature_supported(pf, ICE_F_MBX_LIMIT)) -+ ice_mbx_vf_clear_cnt_e830(&pf->hw, vf->vf_id); -+ else -+ ice_mbx_init_vf_info(&pf->hw, &vf->mbx_info); - - mutex_init(&vf->cfg_lock); - } - -+void ice_deinitialize_vf_entry(struct ice_vf *vf) -+{ -+ struct ice_pf *pf = vf->pf; -+ -+ if (!ice_is_feature_supported(pf, ICE_F_MBX_LIMIT)) -+ list_del(&vf->mbx_info.list_entry); -+} -+ - /** - * ice_dis_vf_qs - Disable the VF queues - * @vf: pointer to the VF structure -diff --git a/drivers/net/ethernet/intel/ice/ice_vf_lib_private.h b/drivers/net/ethernet/intel/ice/ice_vf_lib_private.h -index 0c7e77c0a09fa6..5392b040498621 100644 ---- a/drivers/net/ethernet/intel/ice/ice_vf_lib_private.h -+++ b/drivers/net/ethernet/intel/ice/ice_vf_lib_private.h -@@ -24,6 +24,7 @@ - #endif - - void ice_initialize_vf_entry(struct ice_vf *vf); -+void ice_deinitialize_vf_entry(struct ice_vf *vf); - void ice_dis_vf_qs(struct ice_vf *vf); - int ice_check_vf_init(struct ice_vf *vf); - enum virtchnl_status_code ice_err_to_virt_err(int err); -diff --git a/drivers/net/ethernet/intel/ice/ice_vf_mbx.c b/drivers/net/ethernet/intel/ice/ice_vf_mbx.c -index 40cb4ba0789ced..75c8113e58ee92 100644 ---- a/drivers/net/ethernet/intel/ice/ice_vf_mbx.c -+++ b/drivers/net/ethernet/intel/ice/ice_vf_mbx.c -@@ -210,6 +210,38 @@ ice_mbx_detect_malvf(struct ice_hw *hw, struct ice_mbx_vf_info *vf_info, - return 0; - } - -+/** -+ * ice_mbx_vf_dec_trig_e830 - Decrements the VF mailbox queue counter -+ * @hw: pointer to the HW struct -+ * @event: pointer to the control queue receive event -+ * -+ * This function triggers to decrement the counter -+ * MBX_VF_IN_FLIGHT_MSGS_AT_PF_CNT when the driver replenishes -+ * the buffers at the PF mailbox queue. -+ */ -+void ice_mbx_vf_dec_trig_e830(const struct ice_hw *hw, -+ const struct ice_rq_event_info *event) -+{ -+ u16 vfid = le16_to_cpu(event->desc.retval); -+ -+ wr32(hw, E830_MBX_VF_DEC_TRIG(vfid), 1); -+} -+ -+/** -+ * ice_mbx_vf_clear_cnt_e830 - Clear the VF mailbox queue count -+ * @hw: pointer to the HW struct -+ * @vf_id: VF ID in the PF space -+ * -+ * This function clears the counter MBX_VF_IN_FLIGHT_MSGS_AT_PF_CNT, and should -+ * be called when a VF is created and on VF reset. -+ */ -+void ice_mbx_vf_clear_cnt_e830(const struct ice_hw *hw, u16 vf_id) -+{ -+ u32 reg = rd32(hw, E830_MBX_VF_IN_FLIGHT_MSGS_AT_PF_CNT(vf_id)); -+ -+ wr32(hw, E830_MBX_VF_DEC_TRIG(vf_id), reg); -+} -+ - /** - * ice_mbx_vf_state_handler - Handle states of the overflow algorithm - * @hw: pointer to the HW struct -diff --git a/drivers/net/ethernet/intel/ice/ice_vf_mbx.h b/drivers/net/ethernet/intel/ice/ice_vf_mbx.h -index 44bc030d17e07a..684de89e5c5ed7 100644 ---- a/drivers/net/ethernet/intel/ice/ice_vf_mbx.h -+++ b/drivers/net/ethernet/intel/ice/ice_vf_mbx.h -@@ -19,6 +19,9 @@ ice_aq_send_msg_to_vf(struct ice_hw *hw, u16 vfid, u32 v_opcode, u32 v_retval, - u8 *msg, u16 msglen, struct ice_sq_cd *cd); - - u32 ice_conv_link_speed_to_virtchnl(bool adv_link_support, u16 link_speed); -+void ice_mbx_vf_dec_trig_e830(const struct ice_hw *hw, -+ const struct ice_rq_event_info *event); -+void ice_mbx_vf_clear_cnt_e830(const struct ice_hw *hw, u16 vf_id); - int - ice_mbx_vf_state_handler(struct ice_hw *hw, struct ice_mbx_data *mbx_data, - struct ice_mbx_vf_info *vf_info, bool *report_malvf); -@@ -47,5 +50,11 @@ static inline void ice_mbx_init_snapshot(struct ice_hw *hw) - { - } - -+static inline void -+ice_mbx_vf_dec_trig_e830(const struct ice_hw *hw, -+ const struct ice_rq_event_info *event) -+{ -+} -+ - #endif /* CONFIG_PCI_IOV */ - #endif /* _ICE_VF_MBX_H_ */ -diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl.c b/drivers/net/ethernet/intel/ice/ice_virtchnl.c -index 9f7268bb2ee3b4..e709b10a29761b 100644 ---- a/drivers/net/ethernet/intel/ice/ice_virtchnl.c -+++ b/drivers/net/ethernet/intel/ice/ice_virtchnl.c -@@ -3899,8 +3899,10 @@ ice_is_malicious_vf(struct ice_vf *vf, struct ice_mbx_data *mbxdata) - * @event: pointer to the AQ event - * @mbxdata: information used to detect VF attempting mailbox overflow - * -- * called from the common asq/arq handler to -- * process request from VF -+ * Called from the common asq/arq handler to process request from VF. When this -+ * flow is used for devices with hardware VF to PF message queue overflow -+ * support (ICE_F_MBX_LIMIT) mbxdata is set to NULL and ice_is_malicious_vf -+ * check is skipped. - */ - void ice_vc_process_vf_msg(struct ice_pf *pf, struct ice_rq_event_info *event, - struct ice_mbx_data *mbxdata) -@@ -3926,7 +3928,7 @@ void ice_vc_process_vf_msg(struct ice_pf *pf, struct ice_rq_event_info *event, - mutex_lock(&vf->cfg_lock); - - /* Check if the VF is trying to overflow the mailbox */ -- if (ice_is_malicious_vf(vf, mbxdata)) -+ if (mbxdata && ice_is_malicious_vf(vf, mbxdata)) - goto finish; - - /* Check if VF is disabled. */ -diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c -index 974c71490d97c0..3ca5f44dea26eb 100644 ---- a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c -+++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c -@@ -1,5 +1,5 @@ - // SPDX-License-Identifier: GPL-2.0 --/* Copyright (C) 2021, Intel Corporation. */ -+/* Copyright (C) 2021-2023, Intel Corporation. */ - - #include "ice.h" - #include "ice_base.h" -@@ -1421,8 +1421,8 @@ ice_vc_fdir_irq_handler(struct ice_vsi *ctrl_vsi, - */ - static void ice_vf_fdir_dump_info(struct ice_vf *vf) - { -+ u32 fd_size, fd_cnt, fd_size_g, fd_cnt_g, fd_size_b, fd_cnt_b; - struct ice_vsi *vf_vsi; -- u32 fd_size, fd_cnt; - struct device *dev; - struct ice_pf *pf; - struct ice_hw *hw; -@@ -1441,12 +1441,25 @@ static void ice_vf_fdir_dump_info(struct ice_vf *vf) - - fd_size = rd32(hw, VSIQF_FD_SIZE(vsi_num)); - fd_cnt = rd32(hw, VSIQF_FD_CNT(vsi_num)); -- dev_dbg(dev, "VF %d: space allocated: guar:0x%x, be:0x%x, space consumed: guar:0x%x, be:0x%x\n", -- vf->vf_id, -- (fd_size & VSIQF_FD_CNT_FD_GCNT_M) >> VSIQF_FD_CNT_FD_GCNT_S, -- (fd_size & VSIQF_FD_CNT_FD_BCNT_M) >> VSIQF_FD_CNT_FD_BCNT_S, -- (fd_cnt & VSIQF_FD_CNT_FD_GCNT_M) >> VSIQF_FD_CNT_FD_GCNT_S, -- (fd_cnt & VSIQF_FD_CNT_FD_BCNT_M) >> VSIQF_FD_CNT_FD_BCNT_S); -+ switch (hw->mac_type) { -+ case ICE_MAC_E830: -+ fd_size_g = FIELD_GET(E830_VSIQF_FD_CNT_FD_GCNT_M, fd_size); -+ fd_size_b = FIELD_GET(E830_VSIQF_FD_CNT_FD_BCNT_M, fd_size); -+ fd_cnt_g = FIELD_GET(E830_VSIQF_FD_CNT_FD_GCNT_M, fd_cnt); -+ fd_cnt_b = FIELD_GET(E830_VSIQF_FD_CNT_FD_BCNT_M, fd_cnt); -+ break; -+ case ICE_MAC_E810: -+ default: -+ fd_size_g = FIELD_GET(E800_VSIQF_FD_CNT_FD_GCNT_M, fd_size); -+ fd_size_b = FIELD_GET(E800_VSIQF_FD_CNT_FD_BCNT_M, fd_size); -+ fd_cnt_g = FIELD_GET(E800_VSIQF_FD_CNT_FD_GCNT_M, fd_cnt); -+ fd_cnt_b = FIELD_GET(E800_VSIQF_FD_CNT_FD_BCNT_M, fd_cnt); -+ } -+ -+ dev_dbg(dev, "VF %d: Size in the FD table: guaranteed:0x%x, best effort:0x%x\n", -+ vf->vf_id, fd_size_g, fd_size_b); -+ dev_dbg(dev, "VF %d: Filter counter in the FD table: guaranteed:0x%x, best effort:0x%x\n", -+ vf->vf_id, fd_cnt_g, fd_cnt_b); - } - - /** -diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c -index 40aeaa7bd739fa..d2757cc1161391 100644 ---- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c -+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c -@@ -324,7 +324,7 @@ static const struct mvpp2_cls_flow cls_flows[MVPP2_N_PRS_FLOWS] = { - MVPP2_PRS_RI_VLAN_MASK), - /* Non IP flow, with vlan tag */ - MVPP2_DEF_FLOW(MVPP22_FLOW_ETHERNET, MVPP2_FL_NON_IP_TAG, -- MVPP22_CLS_HEK_OPT_VLAN, -+ MVPP22_CLS_HEK_TAGGED, - 0, 0), - }; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c b/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c -index 6bac8ad70ba60b..a8d6fd18c0f557 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c -@@ -617,7 +617,7 @@ irq_pool_alloc(struct mlx5_core_dev *dev, int start, int size, char *name, - pool->min_threshold = min_threshold * MLX5_EQ_REFS_PER_IRQ; - pool->max_threshold = max_threshold * MLX5_EQ_REFS_PER_IRQ; - mlx5_core_dbg(dev, "pool->name = %s, pool->size = %d, pool->start = %d", -- name, size, start); -+ name ? name : "mlx5_pcif_pool", size, start); - return pool; - } - -diff --git a/drivers/net/ethernet/ti/icssg/icss_iep.c b/drivers/net/ethernet/ti/icssg/icss_iep.c -index f06cdec14ed7a1..3f9a030471fe2f 100644 ---- a/drivers/net/ethernet/ti/icssg/icss_iep.c -+++ b/drivers/net/ethernet/ti/icssg/icss_iep.c -@@ -110,7 +110,6 @@ struct icss_iep { - struct ptp_clock_info ptp_info; - struct ptp_clock *ptp_clock; - struct mutex ptp_clk_mutex; /* PHC access serializer */ -- spinlock_t irq_lock; /* CMP IRQ vs icss_iep_ptp_enable access */ - u32 def_inc; - s16 slow_cmp_inc; - u32 slow_cmp_count; -@@ -192,14 +191,11 @@ static void icss_iep_update_to_next_boundary(struct icss_iep *iep, u64 start_ns) - */ - static void icss_iep_settime(struct icss_iep *iep, u64 ns) - { -- unsigned long flags; -- - if (iep->ops && iep->ops->settime) { - iep->ops->settime(iep->clockops_data, ns); - return; - } - -- spin_lock_irqsave(&iep->irq_lock, flags); - if (iep->pps_enabled || iep->perout_enabled) - writel(0, iep->base + iep->plat_data->reg_offs[ICSS_IEP_SYNC_CTRL_REG]); - -@@ -210,7 +206,6 @@ static void icss_iep_settime(struct icss_iep *iep, u64 ns) - writel(IEP_SYNC_CTRL_SYNC_N_EN(0) | IEP_SYNC_CTRL_SYNC_EN, - iep->base + iep->plat_data->reg_offs[ICSS_IEP_SYNC_CTRL_REG]); - } -- spin_unlock_irqrestore(&iep->irq_lock, flags); - } - - /** -@@ -549,36 +544,13 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep, - static int icss_iep_perout_enable(struct icss_iep *iep, - struct ptp_perout_request *req, int on) - { -- unsigned long flags; -- int ret = 0; -- -- mutex_lock(&iep->ptp_clk_mutex); -- -- if (iep->pps_enabled) { -- ret = -EBUSY; -- goto exit; -- } -- -- if (iep->perout_enabled == !!on) -- goto exit; -- -- spin_lock_irqsave(&iep->irq_lock, flags); -- ret = icss_iep_perout_enable_hw(iep, req, on); -- if (!ret) -- iep->perout_enabled = !!on; -- spin_unlock_irqrestore(&iep->irq_lock, flags); -- --exit: -- mutex_unlock(&iep->ptp_clk_mutex); -- -- return ret; -+ return -EOPNOTSUPP; - } - - static int icss_iep_pps_enable(struct icss_iep *iep, int on) - { - struct ptp_clock_request rq; - struct timespec64 ts; -- unsigned long flags; - int ret = 0; - u64 ns; - -@@ -592,8 +564,6 @@ static int icss_iep_pps_enable(struct icss_iep *iep, int on) - if (iep->pps_enabled == !!on) - goto exit; - -- spin_lock_irqsave(&iep->irq_lock, flags); -- - rq.perout.index = 0; - if (on) { - ns = icss_iep_gettime(iep, NULL); -@@ -610,8 +580,6 @@ static int icss_iep_pps_enable(struct icss_iep *iep, int on) - if (!ret) - iep->pps_enabled = !!on; - -- spin_unlock_irqrestore(&iep->irq_lock, flags); -- - exit: - mutex_unlock(&iep->ptp_clk_mutex); - -@@ -861,7 +829,6 @@ static int icss_iep_probe(struct platform_device *pdev) - - iep->ptp_info = icss_iep_ptp_info; - mutex_init(&iep->ptp_clk_mutex); -- spin_lock_init(&iep->irq_lock); - dev_set_drvdata(dev, iep); - icss_iep_disable(iep); - -diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c -index fef4eff7753a7a..ca62188a317ad4 100644 ---- a/drivers/net/ipvlan/ipvlan_core.c -+++ b/drivers/net/ipvlan/ipvlan_core.c -@@ -2,6 +2,9 @@ - /* Copyright (c) 2014 Mahesh Bandewar - */ - -+#include -+#include -+ - #include "ipvlan.h" - - static u32 ipvlan_jhash_secret __read_mostly; -@@ -413,20 +416,25 @@ struct ipvl_addr *ipvlan_addr_lookup(struct ipvl_port *port, void *lyr3h, - - static noinline_for_stack int ipvlan_process_v4_outbound(struct sk_buff *skb) - { -- const struct iphdr *ip4h = ip_hdr(skb); - struct net_device *dev = skb->dev; - struct net *net = dev_net(dev); -- struct rtable *rt; - int err, ret = NET_XMIT_DROP; -+ const struct iphdr *ip4h; -+ struct rtable *rt; - struct flowi4 fl4 = { - .flowi4_oif = dev->ifindex, -- .flowi4_tos = RT_TOS(ip4h->tos), - .flowi4_flags = FLOWI_FLAG_ANYSRC, - .flowi4_mark = skb->mark, -- .daddr = ip4h->daddr, -- .saddr = ip4h->saddr, - }; - -+ if (!pskb_network_may_pull(skb, sizeof(struct iphdr))) -+ goto err; -+ -+ ip4h = ip_hdr(skb); -+ fl4.daddr = ip4h->daddr; -+ fl4.saddr = ip4h->saddr; -+ fl4.flowi4_tos = inet_dscp_to_dsfield(ip4h_dscp(ip4h)); -+ - rt = ip_route_output_flow(net, &fl4, NULL); - if (IS_ERR(rt)) - goto err; -@@ -485,6 +493,12 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb) - struct net_device *dev = skb->dev; - int err, ret = NET_XMIT_DROP; - -+ if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr))) { -+ DEV_STATS_INC(dev, tx_errors); -+ kfree_skb(skb); -+ return ret; -+ } -+ - err = ipvlan_route_v6_outbound(dev, skb); - if (unlikely(err)) { - DEV_STATS_INC(dev, tx_errors); -diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c -index f6eab66c266081..6aa00f62b1f902 100644 ---- a/drivers/net/loopback.c -+++ b/drivers/net/loopback.c -@@ -247,8 +247,22 @@ static netdev_tx_t blackhole_netdev_xmit(struct sk_buff *skb, - return NETDEV_TX_OK; - } - -+static int blackhole_neigh_output(struct neighbour *n, struct sk_buff *skb) -+{ -+ kfree_skb(skb); -+ return 0; -+} -+ -+static int blackhole_neigh_construct(struct net_device *dev, -+ struct neighbour *n) -+{ -+ n->output = blackhole_neigh_output; -+ return 0; -+} -+ - static const struct net_device_ops blackhole_netdev_ops = { - .ndo_start_xmit = blackhole_netdev_xmit, -+ .ndo_neigh_construct = blackhole_neigh_construct, - }; - - /* This is a dst-dummy device used specifically for invalidated -diff --git a/drivers/net/usb/gl620a.c b/drivers/net/usb/gl620a.c -index 46af78caf457a6..0bfa37c1405918 100644 ---- a/drivers/net/usb/gl620a.c -+++ b/drivers/net/usb/gl620a.c -@@ -179,9 +179,7 @@ static int genelink_bind(struct usbnet *dev, struct usb_interface *intf) - { - dev->hard_mtu = GL_RCV_BUF_SIZE; - dev->net->hard_header_len += 4; -- dev->in = usb_rcvbulkpipe(dev->udev, dev->driver_info->in); -- dev->out = usb_sndbulkpipe(dev->udev, dev->driver_info->out); -- return 0; -+ return usbnet_get_endpoints(dev, intf); - } - - static const struct driver_info genelink_info = { -diff --git a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c -index 9c231094ba3594..2354ce8b215943 100644 ---- a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c -+++ b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c -@@ -309,7 +309,10 @@ static int rockchip_combphy_parse_dt(struct device *dev, struct rockchip_combphy - - priv->ext_refclk = device_property_present(dev, "rockchip,ext-refclk"); - -- priv->phy_rst = devm_reset_control_get(dev, "phy"); -+ priv->phy_rst = devm_reset_control_get_exclusive(dev, "phy"); -+ /* fallback to old behaviour */ -+ if (PTR_ERR(priv->phy_rst) == -ENOENT) -+ priv->phy_rst = devm_reset_control_array_get_exclusive(dev); - if (IS_ERR(priv->phy_rst)) - return dev_err_probe(dev, PTR_ERR(priv->phy_rst), "failed to get phy reset\n"); - -diff --git a/drivers/phy/samsung/phy-exynos5-usbdrd.c b/drivers/phy/samsung/phy-exynos5-usbdrd.c -index 3f310b28bfff79..fea76f2ce6fff6 100644 ---- a/drivers/phy/samsung/phy-exynos5-usbdrd.c -+++ b/drivers/phy/samsung/phy-exynos5-usbdrd.c -@@ -319,9 +319,9 @@ exynos5_usbdrd_pipe3_set_refclk(struct phy_usb_instance *inst) - reg |= PHYCLKRST_REFCLKSEL_EXT_REFCLK; - - /* FSEL settings corresponding to reference clock */ -- reg &= ~PHYCLKRST_FSEL_PIPE_MASK | -- PHYCLKRST_MPLL_MULTIPLIER_MASK | -- PHYCLKRST_SSC_REFCLKSEL_MASK; -+ reg &= ~(PHYCLKRST_FSEL_PIPE_MASK | -+ PHYCLKRST_MPLL_MULTIPLIER_MASK | -+ PHYCLKRST_SSC_REFCLKSEL_MASK); - switch (phy_drd->extrefclk) { - case EXYNOS5_FSEL_50MHZ: - reg |= (PHYCLKRST_MPLL_MULTIPLIER_50M_REF | -@@ -363,9 +363,9 @@ exynos5_usbdrd_utmi_set_refclk(struct phy_usb_instance *inst) - reg &= ~PHYCLKRST_REFCLKSEL_MASK; - reg |= PHYCLKRST_REFCLKSEL_EXT_REFCLK; - -- reg &= ~PHYCLKRST_FSEL_UTMI_MASK | -- PHYCLKRST_MPLL_MULTIPLIER_MASK | -- PHYCLKRST_SSC_REFCLKSEL_MASK; -+ reg &= ~(PHYCLKRST_FSEL_UTMI_MASK | -+ PHYCLKRST_MPLL_MULTIPLIER_MASK | -+ PHYCLKRST_SSC_REFCLKSEL_MASK); - reg |= PHYCLKRST_FSEL(phy_drd->extrefclk); - - return reg; -diff --git a/drivers/phy/tegra/xusb-tegra186.c b/drivers/phy/tegra/xusb-tegra186.c -index 0f60d5d1c1678d..fae6242aa730e0 100644 ---- a/drivers/phy/tegra/xusb-tegra186.c -+++ b/drivers/phy/tegra/xusb-tegra186.c -@@ -928,6 +928,7 @@ static int tegra186_utmi_phy_init(struct phy *phy) - unsigned int index = lane->index; - struct device *dev = padctl->dev; - int err; -+ u32 reg; - - port = tegra_xusb_find_usb2_port(padctl, index); - if (!port) { -@@ -935,6 +936,16 @@ static int tegra186_utmi_phy_init(struct phy *phy) - return -ENODEV; - } - -+ if (port->mode == USB_DR_MODE_OTG || -+ port->mode == USB_DR_MODE_PERIPHERAL) { -+ /* reset VBUS&ID OVERRIDE */ -+ reg = padctl_readl(padctl, USB2_VBUS_ID); -+ reg &= ~VBUS_OVERRIDE; -+ reg &= ~ID_OVERRIDE(~0); -+ reg |= ID_OVERRIDE_FLOATING; -+ padctl_writel(padctl, reg, USB2_VBUS_ID); -+ } -+ - if (port->supply && port->mode == USB_DR_MODE_HOST) { - err = regulator_enable(port->supply); - if (err) { -diff --git a/drivers/platform/x86/intel/ifs/load.c b/drivers/platform/x86/intel/ifs/load.c -index 53d957d4eea4d1..1c50ecd8a03299 100644 ---- a/drivers/platform/x86/intel/ifs/load.c -+++ b/drivers/platform/x86/intel/ifs/load.c -@@ -227,7 +227,7 @@ static int scan_chunks_sanity_check(struct device *dev) - - static int image_sanity_check(struct device *dev, const struct microcode_header_intel *data) - { -- struct ucode_cpu_info uci; -+ struct cpu_signature sig; - - /* Provide a specific error message when loading an older/unsupported image */ - if (data->hdrver != MC_HEADER_TYPE_IFS) { -@@ -240,11 +240,9 @@ static int image_sanity_check(struct device *dev, const struct microcode_header_ - return -EINVAL; - } - -- intel_cpu_collect_info(&uci); -+ intel_collect_cpu_info(&sig); - -- if (!intel_find_matching_signature((void *)data, -- uci.cpu_sig.sig, -- uci.cpu_sig.pf)) { -+ if (!intel_find_matching_signature((void *)data, &sig)) { - dev_err(dev, "cpu signature, processor flags not matching\n"); - return -EINVAL; - } -diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c -index f026377f1cf1c4..e6dc2c556fde9e 100644 ---- a/drivers/scsi/scsi_lib.c -+++ b/drivers/scsi/scsi_lib.c -@@ -1570,13 +1570,6 @@ static blk_status_t scsi_prepare_cmd(struct request *req) - if (in_flight) - __set_bit(SCMD_STATE_INFLIGHT, &cmd->state); - -- /* -- * Only clear the driver-private command data if the LLD does not supply -- * a function to initialize that data. -- */ -- if (!shost->hostt->init_cmd_priv) -- memset(cmd + 1, 0, shost->hostt->cmd_size); -- - cmd->prot_op = SCSI_PROT_NORMAL; - if (blk_rq_bytes(req)) - cmd->sc_data_direction = rq_dma_dir(req); -@@ -1743,6 +1736,13 @@ static blk_status_t scsi_queue_rq(struct blk_mq_hw_ctx *hctx, - if (!scsi_host_queue_ready(q, shost, sdev, cmd)) - goto out_dec_target_busy; - -+ /* -+ * Only clear the driver-private command data if the LLD does not supply -+ * a function to initialize that data. -+ */ -+ if (shost->hostt->cmd_size && !shost->hostt->init_cmd_priv) -+ memset(cmd + 1, 0, shost->hostt->cmd_size); -+ - if (!(req->rq_flags & RQF_DONTPREP)) { - ret = scsi_prepare_cmd(req); - if (ret != BLK_STS_OK) -diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c -index 8fbd46cd8c2b8e..0043d69077b646 100644 ---- a/drivers/ufs/core/ufs_bsg.c -+++ b/drivers/ufs/core/ufs_bsg.c -@@ -194,10 +194,12 @@ static int ufs_bsg_request(struct bsg_job *job) - ufshcd_rpm_put_sync(hba); - kfree(buff); - bsg_reply->result = ret; -- job->reply_len = !rpmb ? sizeof(struct ufs_bsg_reply) : sizeof(struct ufs_rpmb_reply); - /* complete the job here only if no error */ -- if (ret == 0) -+ if (ret == 0) { -+ job->reply_len = rpmb ? sizeof(struct ufs_rpmb_reply) : -+ sizeof(struct ufs_bsg_reply); - bsg_job_done(job, ret, bsg_reply->reply_payload_rcv_len); -+ } - - return ret; - } -diff --git a/drivers/ufs/core/ufshcd-priv.h b/drivers/ufs/core/ufshcd-priv.h -index 524863b157e8aa..dffc932285ac50 100644 ---- a/drivers/ufs/core/ufshcd-priv.h -+++ b/drivers/ufs/core/ufshcd-priv.h -@@ -324,6 +324,11 @@ static inline int ufshcd_rpm_get_sync(struct ufs_hba *hba) - return pm_runtime_get_sync(&hba->ufs_device_wlun->sdev_gendev); - } - -+static inline int ufshcd_rpm_get_if_active(struct ufs_hba *hba) -+{ -+ return pm_runtime_get_if_active(&hba->ufs_device_wlun->sdev_gendev, true); -+} -+ - static inline int ufshcd_rpm_put_sync(struct ufs_hba *hba) - { - return pm_runtime_put_sync(&hba->ufs_device_wlun->sdev_gendev); -diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c -index 0ac0b6aaf9c62c..6d53dd7d411a85 100644 ---- a/drivers/ufs/core/ufshcd.c -+++ b/drivers/ufs/core/ufshcd.c -@@ -98,6 +98,9 @@ - /* Polling time to wait for fDeviceInit */ - #define FDEVICEINIT_COMPL_TIMEOUT 1500 /* millisecs */ - -+/* Default RTC update every 10 seconds */ -+#define UFS_RTC_UPDATE_INTERVAL_MS (10 * MSEC_PER_SEC) -+ - /* UFSHC 4.0 compliant HC support this mode. */ - static bool use_mcq_mode = true; - -@@ -234,6 +237,17 @@ ufs_get_desired_pm_lvl_for_dev_link_state(enum ufs_dev_pwr_mode dev_state, - return UFS_PM_LVL_0; - } - -+static bool ufshcd_has_pending_tasks(struct ufs_hba *hba) -+{ -+ return hba->outstanding_tasks || hba->active_uic_cmd || -+ hba->uic_async_done; -+} -+ -+static bool ufshcd_is_ufs_dev_busy(struct ufs_hba *hba) -+{ -+ return scsi_host_busy(hba->host) || ufshcd_has_pending_tasks(hba); -+} -+ - static const struct ufs_dev_quirk ufs_fixups[] = { - /* UFS cards deviations table */ - { .wmanufacturerid = UFS_VENDOR_MICRON, -@@ -602,8 +616,8 @@ static void ufshcd_print_host_state(struct ufs_hba *hba) - const struct scsi_device *sdev_ufs = hba->ufs_device_wlun; - - dev_err(hba->dev, "UFS Host state=%d\n", hba->ufshcd_state); -- dev_err(hba->dev, "outstanding reqs=0x%lx tasks=0x%lx\n", -- hba->outstanding_reqs, hba->outstanding_tasks); -+ dev_err(hba->dev, "%d outstanding reqs, tasks=0x%lx\n", -+ scsi_host_busy(hba->host), hba->outstanding_tasks); - dev_err(hba->dev, "saved_err=0x%x, saved_uic_err=0x%x\n", - hba->saved_err, hba->saved_uic_err); - dev_err(hba->dev, "Device power mode=%d, UIC link state=%d\n", -@@ -676,6 +690,8 @@ static void ufshcd_device_reset(struct ufs_hba *hba) - hba->dev_info.wb_enabled = false; - hba->dev_info.wb_buf_flush_enabled = false; - } -+ if (hba->dev_info.rtc_type == UFS_RTC_RELATIVE) -+ hba->dev_info.rtc_time_baseline = 0; - } - if (err != -EOPNOTSUPP) - ufshcd_update_evt_hist(hba, UFS_EVT_DEV_RESET, err); -@@ -1816,10 +1832,9 @@ static void ufshcd_gate_work(struct work_struct *work) - goto rel_lock; - } - -- if (hba->clk_gating.active_reqs -- || hba->ufshcd_state != UFSHCD_STATE_OPERATIONAL -- || hba->outstanding_reqs || hba->outstanding_tasks -- || hba->active_uic_cmd || hba->uic_async_done) -+ if (ufshcd_is_ufs_dev_busy(hba) || -+ hba->ufshcd_state != UFSHCD_STATE_OPERATIONAL || -+ hba->clk_gating.active_reqs) - goto rel_lock; - - spin_unlock_irqrestore(hba->host->host_lock, flags); -@@ -1875,8 +1890,7 @@ static void __ufshcd_release(struct ufs_hba *hba) - - if (hba->clk_gating.active_reqs || hba->clk_gating.is_suspended || - hba->ufshcd_state != UFSHCD_STATE_OPERATIONAL || -- hba->outstanding_tasks || !hba->clk_gating.is_initialized || -- hba->active_uic_cmd || hba->uic_async_done || -+ ufshcd_has_pending_tasks(hba) || !hba->clk_gating.is_initialized || - hba->clk_gating.state == CLKS_OFF) - return; - -@@ -8146,6 +8160,77 @@ static void ufs_fixup_device_setup(struct ufs_hba *hba) - ufshcd_vops_fixup_dev_quirks(hba); - } - -+static void ufshcd_update_rtc(struct ufs_hba *hba) -+{ -+ struct timespec64 ts64; -+ int err; -+ u32 val; -+ -+ ktime_get_real_ts64(&ts64); -+ -+ if (ts64.tv_sec < hba->dev_info.rtc_time_baseline) { -+ dev_warn_once(hba->dev, "%s: Current time precedes previous setting!\n", __func__); -+ return; -+ } -+ -+ /* -+ * The Absolute RTC mode has a 136-year limit, spanning from 2010 to 2146. If a time beyond -+ * 2146 is required, it is recommended to choose the relative RTC mode. -+ */ -+ val = ts64.tv_sec - hba->dev_info.rtc_time_baseline; -+ -+ /* Skip update RTC if RPM state is not RPM_ACTIVE */ -+ if (ufshcd_rpm_get_if_active(hba) <= 0) -+ return; -+ -+ err = ufshcd_query_attr(hba, UPIU_QUERY_OPCODE_WRITE_ATTR, QUERY_ATTR_IDN_SECONDS_PASSED, -+ 0, 0, &val); -+ ufshcd_rpm_put(hba); -+ -+ if (err) -+ dev_err(hba->dev, "%s: Failed to update rtc %d\n", __func__, err); -+ else if (hba->dev_info.rtc_type == UFS_RTC_RELATIVE) -+ hba->dev_info.rtc_time_baseline = ts64.tv_sec; -+} -+ -+static void ufshcd_rtc_work(struct work_struct *work) -+{ -+ struct ufs_hba *hba; -+ -+ hba = container_of(to_delayed_work(work), struct ufs_hba, ufs_rtc_update_work); -+ -+ /* Update RTC only when there are no requests in progress and UFSHCI is operational */ -+ if (!ufshcd_is_ufs_dev_busy(hba) && -+ hba->ufshcd_state == UFSHCD_STATE_OPERATIONAL && -+ !hba->clk_gating.active_reqs) -+ ufshcd_update_rtc(hba); -+ -+ if (ufshcd_is_ufs_dev_active(hba)) -+ schedule_delayed_work(&hba->ufs_rtc_update_work, -+ msecs_to_jiffies(UFS_RTC_UPDATE_INTERVAL_MS)); -+} -+ -+static void ufs_init_rtc(struct ufs_hba *hba, u8 *desc_buf) -+{ -+ u16 periodic_rtc_update = get_unaligned_be16(&desc_buf[DEVICE_DESC_PARAM_FRQ_RTC]); -+ struct ufs_dev_info *dev_info = &hba->dev_info; -+ -+ if (periodic_rtc_update & UFS_RTC_TIME_BASELINE) { -+ dev_info->rtc_type = UFS_RTC_ABSOLUTE; -+ -+ /* -+ * The concept of measuring time in Linux as the number of seconds elapsed since -+ * 00:00:00 UTC on January 1, 1970, and UFS ABS RTC is elapsed from January 1st -+ * 2010 00:00, here we need to adjust ABS baseline. -+ */ -+ dev_info->rtc_time_baseline = mktime64(2010, 1, 1, 0, 0, 0) - -+ mktime64(1970, 1, 1, 0, 0, 0); -+ } else { -+ dev_info->rtc_type = UFS_RTC_RELATIVE; -+ dev_info->rtc_time_baseline = 0; -+ } -+} -+ - static int ufs_get_device_desc(struct ufs_hba *hba) - { - int err; -@@ -8198,6 +8283,8 @@ static int ufs_get_device_desc(struct ufs_hba *hba) - - ufshcd_temp_notif_probe(hba, desc_buf); - -+ ufs_init_rtc(hba, desc_buf); -+ - if (hba->ext_iid_sup) - ufshcd_ext_iid_probe(hba, desc_buf); - -@@ -8591,6 +8678,14 @@ static int ufshcd_add_lus(struct ufs_hba *hba) - ufshcd_init_clk_scaling_sysfs(hba); - } - -+ /* -+ * The RTC update code accesses the hba->ufs_device_wlun->sdev_gendev -+ * pointer and hence must only be started after the WLUN pointer has -+ * been initialized by ufshcd_scsi_add_wlus(). -+ */ -+ schedule_delayed_work(&hba->ufs_rtc_update_work, -+ msecs_to_jiffies(UFS_RTC_UPDATE_INTERVAL_MS)); -+ - ufs_bsg_probe(hba); - scsi_scan_host(hba->host); - -@@ -8887,7 +8982,7 @@ static enum scsi_timeout_action ufshcd_eh_timed_out(struct scsi_cmnd *scmd) - dev_info(hba->dev, "%s() finished; outstanding_tasks = %#lx.\n", - __func__, hba->outstanding_tasks); - -- return hba->outstanding_reqs ? SCSI_EH_RESET_TIMER : SCSI_EH_DONE; -+ return scsi_host_busy(hba->host) ? SCSI_EH_RESET_TIMER : SCSI_EH_DONE; - } - - static const struct attribute_group *ufshcd_driver_groups[] = { -@@ -9695,6 +9790,8 @@ static int __ufshcd_wl_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op) - ret = ufshcd_vops_suspend(hba, pm_op, POST_CHANGE); - if (ret) - goto set_link_active; -+ -+ cancel_delayed_work_sync(&hba->ufs_rtc_update_work); - goto out; - - set_link_active: -@@ -9789,6 +9886,8 @@ static int __ufshcd_wl_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op) - if (ret) - goto set_old_link_state; - ufshcd_set_timestamp_attr(hba); -+ schedule_delayed_work(&hba->ufs_rtc_update_work, -+ msecs_to_jiffies(UFS_RTC_UPDATE_INTERVAL_MS)); - } - - if (ufshcd_keep_autobkops_enabled_except_suspend(hba)) -@@ -10160,6 +10259,7 @@ void ufshcd_remove(struct ufs_hba *hba) - ufs_hwmon_remove(hba); - ufs_bsg_remove(hba); - ufs_sysfs_remove_nodes(hba->dev); -+ cancel_delayed_work_sync(&hba->ufs_rtc_update_work); - blk_mq_destroy_queue(hba->tmf_queue); - blk_put_queue(hba->tmf_queue); - blk_mq_free_tag_set(&hba->tmf_tag_set); -@@ -10497,8 +10597,8 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) - UFS_SLEEP_PWR_MODE, - UIC_LINK_HIBERN8_STATE); - -- INIT_DELAYED_WORK(&hba->rpm_dev_flush_recheck_work, -- ufshcd_rpm_dev_flush_recheck_work); -+ INIT_DELAYED_WORK(&hba->rpm_dev_flush_recheck_work, ufshcd_rpm_dev_flush_recheck_work); -+ INIT_DELAYED_WORK(&hba->ufs_rtc_update_work, ufshcd_rtc_work); - - /* Set the default auto-hiberate idle timer value to 150 ms */ - if (ufshcd_is_auto_hibern8_supported(hba) && !hba->ahit) { -diff --git a/fs/afs/cell.c b/fs/afs/cell.c -index 926cb1188eba6c..7c0dce8eecadd1 100644 ---- a/fs/afs/cell.c -+++ b/fs/afs/cell.c -@@ -161,6 +161,7 @@ static struct afs_cell *afs_alloc_cell(struct afs_net *net, - refcount_set(&cell->ref, 1); - atomic_set(&cell->active, 0); - INIT_WORK(&cell->manager, afs_manage_cell_work); -+ spin_lock_init(&cell->vs_lock); - cell->volumes = RB_ROOT; - INIT_HLIST_HEAD(&cell->proc_volumes); - seqlock_init(&cell->volume_lock); -diff --git a/fs/afs/internal.h b/fs/afs/internal.h -index 2f135d19545b19..0973cd0a396959 100644 ---- a/fs/afs/internal.h -+++ b/fs/afs/internal.h -@@ -379,6 +379,7 @@ struct afs_cell { - unsigned int debug_id; - - /* The volumes belonging to this cell */ -+ spinlock_t vs_lock; /* Lock for server->volumes */ - struct rb_root volumes; /* Tree of volumes on this server */ - struct hlist_head proc_volumes; /* procfs volume list */ - seqlock_t volume_lock; /* For volumes */ -@@ -502,6 +503,7 @@ struct afs_server { - struct hlist_node addr4_link; /* Link in net->fs_addresses4 */ - struct hlist_node addr6_link; /* Link in net->fs_addresses6 */ - struct hlist_node proc_link; /* Link in net->fs_proc */ -+ struct list_head volumes; /* RCU list of afs_server_entry objects */ - struct work_struct initcb_work; /* Work for CB.InitCallBackState* */ - struct afs_server *gc_next; /* Next server in manager's list */ - time64_t unuse_time; /* Time at which last unused */ -@@ -550,12 +552,14 @@ struct afs_server { - */ - struct afs_server_entry { - struct afs_server *server; -+ struct afs_volume *volume; -+ struct list_head slink; /* Link in server->volumes */ - }; - - struct afs_server_list { - struct rcu_head rcu; -- afs_volid_t vids[AFS_MAXTYPES]; /* Volume IDs */ - refcount_t usage; -+ bool attached; /* T if attached to servers */ - unsigned char nr_servers; - unsigned char preferred; /* Preferred server */ - unsigned short vnovol_mask; /* Servers to be skipped due to VNOVOL */ -@@ -568,10 +572,9 @@ struct afs_server_list { - * Live AFS volume management. - */ - struct afs_volume { -- union { -- struct rcu_head rcu; -- afs_volid_t vid; /* volume ID */ -- }; -+ struct rcu_head rcu; -+ afs_volid_t vid; /* The volume ID of this volume */ -+ afs_volid_t vids[AFS_MAXTYPES]; /* All associated volume IDs */ - refcount_t ref; - time64_t update_at; /* Time at which to next update */ - struct afs_cell *cell; /* Cell to which belongs (pins ref) */ -@@ -1453,10 +1456,14 @@ static inline struct afs_server_list *afs_get_serverlist(struct afs_server_list - } - - extern void afs_put_serverlist(struct afs_net *, struct afs_server_list *); --extern struct afs_server_list *afs_alloc_server_list(struct afs_cell *, struct key *, -- struct afs_vldb_entry *, -- u8); -+struct afs_server_list *afs_alloc_server_list(struct afs_volume *volume, -+ struct key *key, -+ struct afs_vldb_entry *vldb); - extern bool afs_annotate_server_list(struct afs_server_list *, struct afs_server_list *); -+void afs_attach_volume_to_servers(struct afs_volume *volume, struct afs_server_list *slist); -+void afs_reattach_volume_to_servers(struct afs_volume *volume, struct afs_server_list *slist, -+ struct afs_server_list *old); -+void afs_detach_volume_from_servers(struct afs_volume *volume, struct afs_server_list *slist); - - /* - * super.c -diff --git a/fs/afs/server.c b/fs/afs/server.c -index 0bd2f5ba6900c1..87381c2ffe374c 100644 ---- a/fs/afs/server.c -+++ b/fs/afs/server.c -@@ -236,6 +236,7 @@ static struct afs_server *afs_alloc_server(struct afs_cell *cell, - server->addr_version = alist->version; - server->uuid = *uuid; - rwlock_init(&server->fs_lock); -+ INIT_LIST_HEAD(&server->volumes); - INIT_WORK(&server->initcb_work, afs_server_init_callback_work); - init_waitqueue_head(&server->probe_wq); - INIT_LIST_HEAD(&server->probe_link); -diff --git a/fs/afs/server_list.c b/fs/afs/server_list.c -index b59896b1de0af2..89c75d934f79e1 100644 ---- a/fs/afs/server_list.c -+++ b/fs/afs/server_list.c -@@ -24,13 +24,13 @@ void afs_put_serverlist(struct afs_net *net, struct afs_server_list *slist) - /* - * Build a server list from a VLDB record. - */ --struct afs_server_list *afs_alloc_server_list(struct afs_cell *cell, -+struct afs_server_list *afs_alloc_server_list(struct afs_volume *volume, - struct key *key, -- struct afs_vldb_entry *vldb, -- u8 type_mask) -+ struct afs_vldb_entry *vldb) - { - struct afs_server_list *slist; - struct afs_server *server; -+ unsigned int type_mask = 1 << volume->type; - int ret = -ENOMEM, nr_servers = 0, i, j; - - for (i = 0; i < vldb->nr_servers; i++) -@@ -44,15 +44,12 @@ struct afs_server_list *afs_alloc_server_list(struct afs_cell *cell, - refcount_set(&slist->usage, 1); - rwlock_init(&slist->lock); - -- for (i = 0; i < AFS_MAXTYPES; i++) -- slist->vids[i] = vldb->vid[i]; -- - /* Make sure a records exists for each server in the list. */ - for (i = 0; i < vldb->nr_servers; i++) { - if (!(vldb->fs_mask[i] & type_mask)) - continue; - -- server = afs_lookup_server(cell, key, &vldb->fs_server[i], -+ server = afs_lookup_server(volume->cell, key, &vldb->fs_server[i], - vldb->addr_version[i]); - if (IS_ERR(server)) { - ret = PTR_ERR(server); -@@ -70,8 +67,8 @@ struct afs_server_list *afs_alloc_server_list(struct afs_cell *cell, - break; - if (j < slist->nr_servers) { - if (slist->servers[j].server == server) { -- afs_put_server(cell->net, server, -- afs_server_trace_put_slist_isort); -+ afs_unuse_server(volume->cell->net, server, -+ afs_server_trace_put_slist_isort); - continue; - } - -@@ -81,6 +78,7 @@ struct afs_server_list *afs_alloc_server_list(struct afs_cell *cell, - } - - slist->servers[j].server = server; -+ slist->servers[j].volume = volume; - slist->nr_servers++; - } - -@@ -92,7 +90,7 @@ struct afs_server_list *afs_alloc_server_list(struct afs_cell *cell, - return slist; - - error_2: -- afs_put_serverlist(cell->net, slist); -+ afs_put_serverlist(volume->cell->net, slist); - error: - return ERR_PTR(ret); - } -@@ -127,3 +125,99 @@ bool afs_annotate_server_list(struct afs_server_list *new, - - return true; - } -+ -+/* -+ * Attach a volume to the servers it is going to use. -+ */ -+void afs_attach_volume_to_servers(struct afs_volume *volume, struct afs_server_list *slist) -+{ -+ struct afs_server_entry *se, *pe; -+ struct afs_server *server; -+ struct list_head *p; -+ unsigned int i; -+ -+ spin_lock(&volume->cell->vs_lock); -+ -+ for (i = 0; i < slist->nr_servers; i++) { -+ se = &slist->servers[i]; -+ server = se->server; -+ -+ list_for_each(p, &server->volumes) { -+ pe = list_entry(p, struct afs_server_entry, slink); -+ if (volume->vid <= pe->volume->vid) -+ break; -+ } -+ list_add_tail_rcu(&se->slink, p); -+ } -+ -+ slist->attached = true; -+ spin_unlock(&volume->cell->vs_lock); -+} -+ -+/* -+ * Reattach a volume to the servers it is going to use when server list is -+ * replaced. We try to switch the attachment points to avoid rewalking the -+ * lists. -+ */ -+void afs_reattach_volume_to_servers(struct afs_volume *volume, struct afs_server_list *new, -+ struct afs_server_list *old) -+{ -+ unsigned int n = 0, o = 0; -+ -+ spin_lock(&volume->cell->vs_lock); -+ -+ while (n < new->nr_servers || o < old->nr_servers) { -+ struct afs_server_entry *pn = n < new->nr_servers ? &new->servers[n] : NULL; -+ struct afs_server_entry *po = o < old->nr_servers ? &old->servers[o] : NULL; -+ struct afs_server_entry *s; -+ struct list_head *p; -+ int diff; -+ -+ if (pn && po && pn->server == po->server) { -+ list_replace_rcu(&po->slink, &pn->slink); -+ n++; -+ o++; -+ continue; -+ } -+ -+ if (pn && po) -+ diff = memcmp(&pn->server->uuid, &po->server->uuid, -+ sizeof(pn->server->uuid)); -+ else -+ diff = pn ? -1 : 1; -+ -+ if (diff < 0) { -+ list_for_each(p, &pn->server->volumes) { -+ s = list_entry(p, struct afs_server_entry, slink); -+ if (volume->vid <= s->volume->vid) -+ break; -+ } -+ list_add_tail_rcu(&pn->slink, p); -+ n++; -+ } else { -+ list_del_rcu(&po->slink); -+ o++; -+ } -+ } -+ -+ spin_unlock(&volume->cell->vs_lock); -+} -+ -+/* -+ * Detach a volume from the servers it has been using. -+ */ -+void afs_detach_volume_from_servers(struct afs_volume *volume, struct afs_server_list *slist) -+{ -+ unsigned int i; -+ -+ if (!slist->attached) -+ return; -+ -+ spin_lock(&volume->cell->vs_lock); -+ -+ for (i = 0; i < slist->nr_servers; i++) -+ list_del_rcu(&slist->servers[i].slink); -+ -+ slist->attached = false; -+ spin_unlock(&volume->cell->vs_lock); -+} -diff --git a/fs/afs/vl_alias.c b/fs/afs/vl_alias.c -index 83cf1bfbe343ae..b2cc10df95308c 100644 ---- a/fs/afs/vl_alias.c -+++ b/fs/afs/vl_alias.c -@@ -126,7 +126,7 @@ static int afs_compare_volume_slists(const struct afs_volume *vol_a, - lb = rcu_dereference(vol_b->servers); - - for (i = 0; i < AFS_MAXTYPES; i++) -- if (la->vids[i] != lb->vids[i]) -+ if (vol_a->vids[i] != vol_b->vids[i]) - return 0; - - while (a < la->nr_servers && b < lb->nr_servers) { -diff --git a/fs/afs/volume.c b/fs/afs/volume.c -index c028598a903c9c..0f64b97581272e 100644 ---- a/fs/afs/volume.c -+++ b/fs/afs/volume.c -@@ -72,11 +72,11 @@ static void afs_remove_volume_from_cell(struct afs_volume *volume) - */ - static struct afs_volume *afs_alloc_volume(struct afs_fs_context *params, - struct afs_vldb_entry *vldb, -- unsigned long type_mask) -+ struct afs_server_list **_slist) - { - struct afs_server_list *slist; - struct afs_volume *volume; -- int ret = -ENOMEM; -+ int ret = -ENOMEM, i; - - volume = kzalloc(sizeof(struct afs_volume), GFP_KERNEL); - if (!volume) -@@ -95,13 +95,16 @@ static struct afs_volume *afs_alloc_volume(struct afs_fs_context *params, - rwlock_init(&volume->cb_v_break_lock); - memcpy(volume->name, vldb->name, vldb->name_len + 1); - -- slist = afs_alloc_server_list(params->cell, params->key, vldb, type_mask); -+ for (i = 0; i < AFS_MAXTYPES; i++) -+ volume->vids[i] = vldb->vid[i]; -+ -+ slist = afs_alloc_server_list(volume, params->key, vldb); - if (IS_ERR(slist)) { - ret = PTR_ERR(slist); - goto error_1; - } - -- refcount_set(&slist->usage, 1); -+ *_slist = slist; - rcu_assign_pointer(volume->servers, slist); - trace_afs_volume(volume->vid, 1, afs_volume_trace_alloc); - return volume; -@@ -117,17 +120,19 @@ static struct afs_volume *afs_alloc_volume(struct afs_fs_context *params, - * Look up or allocate a volume record. - */ - static struct afs_volume *afs_lookup_volume(struct afs_fs_context *params, -- struct afs_vldb_entry *vldb, -- unsigned long type_mask) -+ struct afs_vldb_entry *vldb) - { -+ struct afs_server_list *slist; - struct afs_volume *candidate, *volume; - -- candidate = afs_alloc_volume(params, vldb, type_mask); -+ candidate = afs_alloc_volume(params, vldb, &slist); - if (IS_ERR(candidate)) - return candidate; - - volume = afs_insert_volume_into_cell(params->cell, candidate); -- if (volume != candidate) -+ if (volume == candidate) -+ afs_attach_volume_to_servers(volume, slist); -+ else - afs_put_volume(params->net, candidate, afs_volume_trace_put_cell_dup); - return volume; - } -@@ -208,8 +213,7 @@ struct afs_volume *afs_create_volume(struct afs_fs_context *params) - goto error; - } - -- type_mask = 1UL << params->type; -- volume = afs_lookup_volume(params, vldb, type_mask); -+ volume = afs_lookup_volume(params, vldb); - - error: - kfree(vldb); -@@ -221,14 +225,17 @@ struct afs_volume *afs_create_volume(struct afs_fs_context *params) - */ - static void afs_destroy_volume(struct afs_net *net, struct afs_volume *volume) - { -+ struct afs_server_list *slist = rcu_access_pointer(volume->servers); -+ - _enter("%p", volume); - - #ifdef CONFIG_AFS_FSCACHE - ASSERTCMP(volume->cache, ==, NULL); - #endif - -+ afs_detach_volume_from_servers(volume, slist); - afs_remove_volume_from_cell(volume); -- afs_put_serverlist(net, rcu_access_pointer(volume->servers)); -+ afs_put_serverlist(net, slist); - afs_put_cell(volume->cell, afs_cell_trace_put_vol); - trace_afs_volume(volume->vid, refcount_read(&volume->ref), - afs_volume_trace_free); -@@ -362,8 +369,7 @@ static int afs_update_volume_status(struct afs_volume *volume, struct key *key) - } - - /* See if the volume's server list got updated. */ -- new = afs_alloc_server_list(volume->cell, key, -- vldb, (1 << volume->type)); -+ new = afs_alloc_server_list(volume, key, vldb); - if (IS_ERR(new)) { - ret = PTR_ERR(new); - goto error_vldb; -@@ -384,9 +390,11 @@ static int afs_update_volume_status(struct afs_volume *volume, struct key *key) - - volume->update_at = ktime_get_real_seconds() + afs_volume_record_life; - write_unlock(&volume->servers_lock); -- ret = 0; - -+ if (discard == old) -+ afs_reattach_volume_to_servers(volume, new, old); - afs_put_serverlist(volume->cell->net, discard); -+ ret = 0; - error_vldb: - kfree(vldb); - error: -diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c -index 18e018cb181179..dbf7b3cd70ca5e 100644 ---- a/fs/overlayfs/copy_up.c -+++ b/fs/overlayfs/copy_up.c -@@ -570,7 +570,6 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c) - err = PTR_ERR(upper); - if (!IS_ERR(upper)) { - err = ovl_do_link(ofs, ovl_dentry_upper(c->dentry), udir, upper); -- dput(upper); - - if (!err) { - /* Restore timestamps on parent (best effort) */ -@@ -578,6 +577,7 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c) - ovl_dentry_set_upper_alias(c->dentry); - ovl_dentry_update_reval(c->dentry, upper); - } -+ dput(upper); - } - inode_unlock(udir); - if (err) -diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h -index 7e11ca6f86dcda..cf3f8b9bf43f08 100644 ---- a/include/asm-generic/vmlinux.lds.h -+++ b/include/asm-generic/vmlinux.lds.h -@@ -445,7 +445,7 @@ - . = ALIGN((align)); \ - .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \ - __start_rodata = .; \ -- *(.rodata) *(.rodata.*) \ -+ *(.rodata) *(.rodata.*) *(.data.rel.ro*) \ - SCHED_DATA \ - RO_AFTER_INIT_DATA /* Read only after init */ \ - . = ALIGN(8); \ -diff --git a/include/linux/rcuref.h b/include/linux/rcuref.h -index 2c8bfd0f1b6b3a..6322d8c1c6b429 100644 ---- a/include/linux/rcuref.h -+++ b/include/linux/rcuref.h -@@ -71,27 +71,30 @@ static inline __must_check bool rcuref_get(rcuref_t *ref) - return rcuref_get_slowpath(ref); - } - --extern __must_check bool rcuref_put_slowpath(rcuref_t *ref); -+extern __must_check bool rcuref_put_slowpath(rcuref_t *ref, unsigned int cnt); - - /* - * Internal helper. Do not invoke directly. - */ - static __always_inline __must_check bool __rcuref_put(rcuref_t *ref) - { -+ int cnt; -+ - RCU_LOCKDEP_WARN(!rcu_read_lock_held() && preemptible(), - "suspicious rcuref_put_rcusafe() usage"); - /* - * Unconditionally decrease the reference count. The saturation and - * dead zones provide enough tolerance for this. - */ -- if (likely(!atomic_add_negative_release(-1, &ref->refcnt))) -+ cnt = atomic_sub_return_release(1, &ref->refcnt); -+ if (likely(cnt >= 0)) - return false; - - /* - * Handle the last reference drop and cases inside the saturation - * and dead zones. - */ -- return rcuref_put_slowpath(ref); -+ return rcuref_put_slowpath(ref, cnt); - } - - /** -diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h -index 8f9bee0e21c3bc..a220b28904ca52 100644 ---- a/include/linux/sunrpc/sched.h -+++ b/include/linux/sunrpc/sched.h -@@ -140,13 +140,14 @@ struct rpc_task_setup { - #define RPC_WAS_SENT(t) ((t)->tk_flags & RPC_TASK_SENT) - #define RPC_IS_MOVEABLE(t) ((t)->tk_flags & RPC_TASK_MOVEABLE) - --#define RPC_TASK_RUNNING 0 --#define RPC_TASK_QUEUED 1 --#define RPC_TASK_ACTIVE 2 --#define RPC_TASK_NEED_XMIT 3 --#define RPC_TASK_NEED_RECV 4 --#define RPC_TASK_MSG_PIN_WAIT 5 --#define RPC_TASK_SIGNALLED 6 -+enum { -+ RPC_TASK_RUNNING, -+ RPC_TASK_QUEUED, -+ RPC_TASK_ACTIVE, -+ RPC_TASK_NEED_XMIT, -+ RPC_TASK_NEED_RECV, -+ RPC_TASK_MSG_PIN_WAIT, -+}; - - #define rpc_test_and_set_running(t) \ - test_and_set_bit(RPC_TASK_RUNNING, &(t)->tk_runstate) -@@ -158,7 +159,7 @@ struct rpc_task_setup { - - #define RPC_IS_ACTIVATED(t) test_bit(RPC_TASK_ACTIVE, &(t)->tk_runstate) - --#define RPC_SIGNALLED(t) test_bit(RPC_TASK_SIGNALLED, &(t)->tk_runstate) -+#define RPC_SIGNALLED(t) (READ_ONCE(task->tk_rpc_status) == -ERESTARTSYS) - - /* - * Task priorities. -diff --git a/include/net/dst.h b/include/net/dst.h -index 78884429deed82..16b7b99b5f309c 100644 ---- a/include/net/dst.h -+++ b/include/net/dst.h -@@ -448,6 +448,15 @@ static inline void dst_set_expires(struct dst_entry *dst, int timeout) - dst->expires = expires; - } - -+static inline unsigned int dst_dev_overhead(struct dst_entry *dst, -+ struct sk_buff *skb) -+{ -+ if (likely(dst)) -+ return LL_RESERVED_SPACE(dst->dev); -+ -+ return skb->mac_len; -+} -+ - INDIRECT_CALLABLE_DECLARE(int ip6_output(struct net *, struct sock *, - struct sk_buff *)); - INDIRECT_CALLABLE_DECLARE(int ip_output(struct net *, struct sock *, -diff --git a/include/net/ip.h b/include/net/ip.h -index 7db5912e0c5f63..d8bf1f0a6919c4 100644 ---- a/include/net/ip.h -+++ b/include/net/ip.h -@@ -415,6 +415,11 @@ int ip_decrease_ttl(struct iphdr *iph) - return --iph->ttl; - } - -+static inline dscp_t ip4h_dscp(const struct iphdr *ip4h) -+{ -+ return inet_dsfield_to_dscp(ip4h->tos); -+} -+ - static inline int ip_mtu_locked(const struct dst_entry *dst) - { - const struct rtable *rt = (const struct rtable *)dst; -diff --git a/include/net/route.h b/include/net/route.h -index 0171e9e1bbea3d..27c17aff0bbe14 100644 ---- a/include/net/route.h -+++ b/include/net/route.h -@@ -200,12 +200,13 @@ int ip_route_use_hint(struct sk_buff *skb, __be32 dst, __be32 src, - const struct sk_buff *hint); - - static inline int ip_route_input(struct sk_buff *skb, __be32 dst, __be32 src, -- u8 tos, struct net_device *devin) -+ dscp_t dscp, struct net_device *devin) - { - int err; - - rcu_read_lock(); -- err = ip_route_input_noref(skb, dst, src, tos, devin); -+ err = ip_route_input_noref(skb, dst, src, inet_dscp_to_dsfield(dscp), -+ devin); - if (!err) { - skb_dst_force(skb); - if (!skb_dst(skb)) -diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h -index 62f9d126a71ad1..bc459d06162971 100644 ---- a/include/rdma/ib_verbs.h -+++ b/include/rdma/ib_verbs.h -@@ -561,6 +561,7 @@ enum ib_port_speed { - IB_SPEED_EDR = 32, - IB_SPEED_HDR = 64, - IB_SPEED_NDR = 128, -+ IB_SPEED_XDR = 256, - }; - - enum ib_stat_flag { -@@ -840,6 +841,7 @@ enum ib_rate { - IB_RATE_50_GBPS = 20, - IB_RATE_400_GBPS = 21, - IB_RATE_600_GBPS = 22, -+ IB_RATE_800_GBPS = 23, - }; - - /** -diff --git a/include/trace/events/icmp.h b/include/trace/events/icmp.h -new file mode 100644 -index 00000000000000..31559796949a78 ---- /dev/null -+++ b/include/trace/events/icmp.h -@@ -0,0 +1,67 @@ -+/* SPDX-License-Identifier: GPL-2.0 */ -+#undef TRACE_SYSTEM -+#define TRACE_SYSTEM icmp -+ -+#if !defined(_TRACE_ICMP_H) || defined(TRACE_HEADER_MULTI_READ) -+#define _TRACE_ICMP_H -+ -+#include -+#include -+ -+TRACE_EVENT(icmp_send, -+ -+ TP_PROTO(const struct sk_buff *skb, int type, int code), -+ -+ TP_ARGS(skb, type, code), -+ -+ TP_STRUCT__entry( -+ __field(const void *, skbaddr) -+ __field(int, type) -+ __field(int, code) -+ __array(__u8, saddr, 4) -+ __array(__u8, daddr, 4) -+ __field(__u16, sport) -+ __field(__u16, dport) -+ __field(unsigned short, ulen) -+ ), -+ -+ TP_fast_assign( -+ struct iphdr *iph = ip_hdr(skb); -+ struct udphdr *uh = udp_hdr(skb); -+ int proto_4 = iph->protocol; -+ __be32 *p32; -+ -+ __entry->skbaddr = skb; -+ __entry->type = type; -+ __entry->code = code; -+ -+ if (proto_4 != IPPROTO_UDP || (u8 *)uh < skb->head || -+ (u8 *)uh + sizeof(struct udphdr) -+ > skb_tail_pointer(skb)) { -+ __entry->sport = 0; -+ __entry->dport = 0; -+ __entry->ulen = 0; -+ } else { -+ __entry->sport = ntohs(uh->source); -+ __entry->dport = ntohs(uh->dest); -+ __entry->ulen = ntohs(uh->len); -+ } -+ -+ p32 = (__be32 *) __entry->saddr; -+ *p32 = iph->saddr; -+ -+ p32 = (__be32 *) __entry->daddr; -+ *p32 = iph->daddr; -+ ), -+ -+ TP_printk("icmp_send: type=%d, code=%d. From %pI4:%u to %pI4:%u ulen=%d skbaddr=%p", -+ __entry->type, __entry->code, -+ __entry->saddr, __entry->sport, __entry->daddr, -+ __entry->dport, __entry->ulen, __entry->skbaddr) -+); -+ -+#endif /* _TRACE_ICMP_H */ -+ -+/* This part must be outside protection */ -+#include -+ -diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h -index 6beb38c1dcb5eb..9eba2ca0a6ff80 100644 ---- a/include/trace/events/sunrpc.h -+++ b/include/trace/events/sunrpc.h -@@ -360,8 +360,7 @@ TRACE_EVENT(rpc_request, - { (1UL << RPC_TASK_ACTIVE), "ACTIVE" }, \ - { (1UL << RPC_TASK_NEED_XMIT), "NEED_XMIT" }, \ - { (1UL << RPC_TASK_NEED_RECV), "NEED_RECV" }, \ -- { (1UL << RPC_TASK_MSG_PIN_WAIT), "MSG_PIN_WAIT" }, \ -- { (1UL << RPC_TASK_SIGNALLED), "SIGNALLED" }) -+ { (1UL << RPC_TASK_MSG_PIN_WAIT), "MSG_PIN_WAIT" }) - - DECLARE_EVENT_CLASS(rpc_task_running, - -diff --git a/include/uapi/rdma/ib_user_ioctl_verbs.h b/include/uapi/rdma/ib_user_ioctl_verbs.h -index d7c5aaa3274453..fe15bc7e9f707b 100644 ---- a/include/uapi/rdma/ib_user_ioctl_verbs.h -+++ b/include/uapi/rdma/ib_user_ioctl_verbs.h -@@ -220,7 +220,8 @@ enum ib_uverbs_advise_mr_flag { - struct ib_uverbs_query_port_resp_ex { - struct ib_uverbs_query_port_resp legacy_resp; - __u16 port_cap_flags2; -- __u8 reserved[6]; -+ __u8 reserved[2]; -+ __u32 active_speed_ex; - }; - - struct ib_uverbs_qp_cap { -diff --git a/include/ufs/ufs.h b/include/ufs/ufs.h -index 49c90795a2a677..571a08ce912429 100644 ---- a/include/ufs/ufs.h -+++ b/include/ufs/ufs.h -@@ -14,6 +14,7 @@ - #include - #include - #include -+#include - - /* - * Using static_assert() is not allowed in UAPI header files. Hence the check -@@ -550,6 +551,14 @@ struct ufs_vreg_info { - struct ufs_vreg *vdd_hba; - }; - -+/* UFS device descriptor wPeriodicRTCUpdate bit9 defines RTC time baseline */ -+#define UFS_RTC_TIME_BASELINE BIT(9) -+ -+enum ufs_rtc_time { -+ UFS_RTC_RELATIVE, -+ UFS_RTC_ABSOLUTE -+}; -+ - struct ufs_dev_info { - bool f_power_on_wp_en; - /* Keeps information if any of the LU is power on write protected */ -@@ -577,6 +586,10 @@ struct ufs_dev_info { - - /* UFS EXT_IID Enable */ - bool b_ext_iid_en; -+ -+ /* UFS RTC */ -+ enum ufs_rtc_time rtc_type; -+ time64_t rtc_time_baseline; - }; - - /* -diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h -index 20d129914121d5..d5aa832f8dba3c 100644 ---- a/include/ufs/ufshcd.h -+++ b/include/ufs/ufshcd.h -@@ -908,6 +908,8 @@ enum ufshcd_mcq_opr { - * @mcq_base: Multi circular queue registers base address - * @uhq: array of supported hardware queues - * @dev_cmd_queue: Queue for issuing device management commands -+ * @mcq_opr: MCQ operation and runtime registers -+ * @ufs_rtc_update_work: A work for UFS RTC periodic update - */ - struct ufs_hba { - void __iomem *mmio_base; -@@ -1068,6 +1070,8 @@ struct ufs_hba { - struct ufs_hw_queue *uhq; - struct ufs_hw_queue *dev_cmd_queue; - struct ufshcd_mcq_opr_info_t mcq_opr[OPR_MAX]; -+ -+ struct delayed_work ufs_rtc_update_work; - }; - - /** -diff --git a/io_uring/net.c b/io_uring/net.c -index 56091292950fd6..1a0e98e19dc0ed 100644 ---- a/io_uring/net.c -+++ b/io_uring/net.c -@@ -303,7 +303,9 @@ static int io_sendmsg_copy_hdr(struct io_kiocb *req, - if (unlikely(ret)) - return ret; - -- return __get_compat_msghdr(&iomsg->msg, &cmsg, NULL); -+ ret = __get_compat_msghdr(&iomsg->msg, &cmsg, NULL); -+ sr->msg_control = iomsg->msg.msg_control_user; -+ return ret; - } - #endif - -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 5d6458ea675e9d..4f6b18ecfdb219 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -4842,7 +4842,7 @@ static struct perf_event_pmu_context * - find_get_pmu_context(struct pmu *pmu, struct perf_event_context *ctx, - struct perf_event *event) - { -- struct perf_event_pmu_context *new = NULL, *epc; -+ struct perf_event_pmu_context *new = NULL, *pos = NULL, *epc; - void *task_ctx_data = NULL; - - if (!ctx->task) { -@@ -4899,12 +4899,19 @@ find_get_pmu_context(struct pmu *pmu, struct perf_event_context *ctx, - atomic_inc(&epc->refcount); - goto found_epc; - } -+ /* Make sure the pmu_ctx_list is sorted by PMU type: */ -+ if (!pos && epc->pmu->type > pmu->type) -+ pos = epc; - } - - epc = new; - new = NULL; - -- list_add(&epc->pmu_ctx_entry, &ctx->pmu_ctx_list); -+ if (!pos) -+ list_add_tail(&epc->pmu_ctx_entry, &ctx->pmu_ctx_list); -+ else -+ list_add(&epc->pmu_ctx_entry, pos->pmu_ctx_entry.prev); -+ - epc->ctx = ctx; - - found_epc: -@@ -5854,14 +5861,15 @@ static int _perf_event_period(struct perf_event *event, u64 value) - if (!value) - return -EINVAL; - -- if (event->attr.freq && value > sysctl_perf_event_sample_rate) -- return -EINVAL; -- -- if (perf_event_check_period(event, value)) -- return -EINVAL; -- -- if (!event->attr.freq && (value & (1ULL << 63))) -- return -EINVAL; -+ if (event->attr.freq) { -+ if (value > sysctl_perf_event_sample_rate) -+ return -EINVAL; -+ } else { -+ if (perf_event_check_period(event, value)) -+ return -EINVAL; -+ if (value & (1ULL << 63)) -+ return -EINVAL; -+ } - - event_function_call(event, __perf_event_period, &value); - -@@ -8106,7 +8114,8 @@ void perf_event_exec(void) - - perf_event_enable_on_exec(ctx); - perf_event_remove_on_exec(ctx); -- perf_iterate_ctx(ctx, perf_event_addr_filters_exec, NULL, true); -+ scoped_guard(rcu) -+ perf_iterate_ctx(ctx, perf_event_addr_filters_exec, NULL, true); - - perf_unpin_context(ctx); - put_ctx(ctx); -diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c -index 6dac0b5798213b..7e2edd1b069397 100644 ---- a/kernel/events/uprobes.c -+++ b/kernel/events/uprobes.c -@@ -481,6 +481,11 @@ int uprobe_write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm, - if (ret <= 0) - goto put_old; - -+ if (is_zero_page(old_page)) { -+ ret = -EINVAL; -+ goto put_old; -+ } -+ - if (WARN(!is_register && PageCompound(old_page), - "uprobe unregister should never work on compound page\n")) { - ret = -EINVAL; -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index c686d826a91cf5..784a4f8409453d 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -8561,7 +8561,7 @@ SYSCALL_DEFINE0(sched_yield) - #if !defined(CONFIG_PREEMPTION) || defined(CONFIG_PREEMPT_DYNAMIC) - int __sched __cond_resched(void) - { -- if (should_resched(0)) { -+ if (should_resched(0) && !irqs_disabled()) { - preempt_schedule_common(); - return 1; - } -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 6e6b2a5aa1402b..99fdeee3bcd87a 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -538,6 +538,7 @@ static int function_stat_show(struct seq_file *m, void *v) - static struct trace_seq s; - unsigned long long avg; - unsigned long long stddev; -+ unsigned long long stddev_denom; - #endif - mutex_lock(&ftrace_profile_lock); - -@@ -559,23 +560,19 @@ static int function_stat_show(struct seq_file *m, void *v) - #ifdef CONFIG_FUNCTION_GRAPH_TRACER - seq_puts(m, " "); - -- /* Sample standard deviation (s^2) */ -- if (rec->counter <= 1) -- stddev = 0; -- else { -- /* -- * Apply Welford's method: -- * s^2 = 1 / (n * (n-1)) * (n * \Sum (x_i)^2 - (\Sum x_i)^2) -- */ -+ /* -+ * Variance formula: -+ * s^2 = 1 / (n * (n-1)) * (n * \Sum (x_i)^2 - (\Sum x_i)^2) -+ * Maybe Welford's method is better here? -+ * Divide only by 1000 for ns^2 -> us^2 conversion. -+ * trace_print_graph_duration will divide by 1000 again. -+ */ -+ stddev = 0; -+ stddev_denom = rec->counter * (rec->counter - 1) * 1000; -+ if (stddev_denom) { - stddev = rec->counter * rec->time_squared - - rec->time * rec->time; -- -- /* -- * Divide only 1000 for ns^2 -> us^2 conversion. -- * trace_print_graph_duration will divide 1000 again. -- */ -- stddev = div64_ul(stddev, -- rec->counter * (rec->counter - 1) * 1000); -+ stddev = div64_ul(stddev, stddev_denom); - } - - trace_seq_init(&s); -diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c -index dd16faf0d1500c..604d63380a90b1 100644 ---- a/kernel/trace/trace_events_hist.c -+++ b/kernel/trace/trace_events_hist.c -@@ -6660,27 +6660,27 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops, - if (existing_hist_update_only(glob, trigger_data, file)) - goto out_free; - -- ret = event_trigger_register(cmd_ops, file, glob, trigger_data); -- if (ret < 0) -- goto out_free; -+ if (!get_named_trigger_data(trigger_data)) { - -- if (get_named_trigger_data(trigger_data)) -- goto enable; -+ ret = create_actions(hist_data); -+ if (ret) -+ goto out_free; - -- ret = create_actions(hist_data); -- if (ret) -- goto out_unreg; -+ if (has_hist_vars(hist_data) || hist_data->n_var_refs) { -+ ret = save_hist_vars(hist_data); -+ if (ret) -+ goto out_free; -+ } - -- if (has_hist_vars(hist_data) || hist_data->n_var_refs) { -- ret = save_hist_vars(hist_data); -+ ret = tracing_map_init(hist_data->map); - if (ret) -- goto out_unreg; -+ goto out_free; - } - -- ret = tracing_map_init(hist_data->map); -- if (ret) -- goto out_unreg; --enable: -+ ret = event_trigger_register(cmd_ops, file, glob, trigger_data); -+ if (ret < 0) -+ goto out_free; -+ - ret = hist_trigger_enable(trigger_data, file); - if (ret) - goto out_unreg; -diff --git a/lib/rcuref.c b/lib/rcuref.c -index 5ec00a4a64d11c..185967b8508e86 100644 ---- a/lib/rcuref.c -+++ b/lib/rcuref.c -@@ -220,6 +220,7 @@ EXPORT_SYMBOL_GPL(rcuref_get_slowpath); - /** - * rcuref_put_slowpath - Slowpath of __rcuref_put() - * @ref: Pointer to the reference count -+ * @cnt: The resulting value of the fastpath decrement - * - * Invoked when the reference count is outside of the valid zone. - * -@@ -233,10 +234,8 @@ EXPORT_SYMBOL_GPL(rcuref_get_slowpath); - * with a concurrent get()/put() pair. Caller is not allowed to - * deconstruct the protected object. - */ --bool rcuref_put_slowpath(rcuref_t *ref) -+bool rcuref_put_slowpath(rcuref_t *ref, unsigned int cnt) - { -- unsigned int cnt = atomic_read(&ref->refcnt); -- - /* Did this drop the last reference? */ - if (likely(cnt == RCUREF_NOREF)) { - /* -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index acb148759bd049..304ebb31cebba6 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -636,7 +636,8 @@ void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan) - test_bit(FLAG_HOLD_HCI_CONN, &chan->flags)) - hci_conn_hold(conn->hcon); - -- list_add(&chan->list, &conn->chan_l); -+ /* Append to the list since the order matters for ECRED */ -+ list_add_tail(&chan->list, &conn->chan_l); - } - - void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan) -@@ -3774,7 +3775,11 @@ static void l2cap_ecred_rsp_defer(struct l2cap_chan *chan, void *data) - { - struct l2cap_ecred_rsp_data *rsp = data; - -- if (test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags)) -+ /* Check if channel for outgoing connection or if it wasn't deferred -+ * since in those cases it must be skipped. -+ */ -+ if (test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags) || -+ !test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags)) - return; - - /* Reset ident so only one response is sent */ -diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c -index a1cfa75bbadb97..2a4958e995f2d9 100644 ---- a/net/bridge/br_netfilter_hooks.c -+++ b/net/bridge/br_netfilter_hooks.c -@@ -366,9 +366,9 @@ br_nf_ipv4_daddr_was_changed(const struct sk_buff *skb, - */ - static int br_nf_pre_routing_finish(struct net *net, struct sock *sk, struct sk_buff *skb) - { -- struct net_device *dev = skb->dev, *br_indev; -- struct iphdr *iph = ip_hdr(skb); - struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); -+ struct net_device *dev = skb->dev, *br_indev; -+ const struct iphdr *iph = ip_hdr(skb); - struct rtable *rt; - int err; - -@@ -386,7 +386,9 @@ static int br_nf_pre_routing_finish(struct net *net, struct sock *sk, struct sk_ - } - nf_bridge->in_prerouting = 0; - if (br_nf_ipv4_daddr_was_changed(skb, nf_bridge)) { -- if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))) { -+ err = ip_route_input(skb, iph->daddr, iph->saddr, -+ ip4h_dscp(iph), dev); -+ if (err) { - struct in_device *in_dev = __in_dev_get_rcu(dev); - - /* If err equals -EHOSTUNREACH the error is due to a -diff --git a/net/core/gro.c b/net/core/gro.c -index 85d3f686ba539b..397cf598425034 100644 ---- a/net/core/gro.c -+++ b/net/core/gro.c -@@ -627,6 +627,7 @@ static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb) - skb->pkt_type = PACKET_HOST; - - skb->encapsulation = 0; -+ skb->ip_summed = CHECKSUM_NONE; - skb_shinfo(skb)->gso_type = 0; - skb_shinfo(skb)->gso_size = 0; - if (unlikely(skb->slow_gro)) { -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index f0a9ef1aeaa298..21a83e26f004bb 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -5867,11 +5867,11 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet) - skb->offload_fwd_mark = 0; - skb->offload_l3_fwd_mark = 0; - #endif -+ ipvs_reset(skb); - - if (!xnet) - return; - -- ipvs_reset(skb); - skb->mark = 0; - skb_clear_tstamp(skb); - } -diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c -index 0b15272dd2d35b..a7fa17b6a12978 100644 ---- a/net/core/sysctl_net_core.c -+++ b/net/core/sysctl_net_core.c -@@ -31,6 +31,7 @@ static int min_sndbuf = SOCK_MIN_SNDBUF; - static int min_rcvbuf = SOCK_MIN_RCVBUF; - static int max_skb_frags = MAX_SKB_FRAGS; - static int min_mem_pcpu_rsv = SK_MEMORY_PCPU_RESERVE; -+static int netdev_budget_usecs_min = 2 * USEC_PER_SEC / HZ; - - static int net_msg_warn; /* Unused, but still a sysctl */ - -@@ -613,7 +614,7 @@ static struct ctl_table net_core_table[] = { - .maxlen = sizeof(unsigned int), - .mode = 0644, - .proc_handler = proc_dointvec_minmax, -- .extra1 = SYSCTL_ZERO, -+ .extra1 = &netdev_budget_usecs_min, - }, - { - .procname = "fb_tunnels_only_for_init_net", -diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c -index a21d32b3ae6c36..94501bb30c431b 100644 ---- a/net/ipv4/icmp.c -+++ b/net/ipv4/icmp.c -@@ -93,6 +93,9 @@ - #include - #include - #include -+#include -+#define CREATE_TRACE_POINTS -+#include - - /* - * Build xmit assembly blocks -@@ -481,13 +484,11 @@ static struct net_device *icmp_get_route_lookup_dev(struct sk_buff *skb) - return route_lookup_dev; - } - --static struct rtable *icmp_route_lookup(struct net *net, -- struct flowi4 *fl4, -+static struct rtable *icmp_route_lookup(struct net *net, struct flowi4 *fl4, - struct sk_buff *skb_in, -- const struct iphdr *iph, -- __be32 saddr, u8 tos, u32 mark, -- int type, int code, -- struct icmp_bxm *param) -+ const struct iphdr *iph, __be32 saddr, -+ dscp_t dscp, u32 mark, int type, -+ int code, struct icmp_bxm *param) - { - struct net_device *route_lookup_dev; - struct rtable *rt, *rt2; -@@ -500,7 +501,7 @@ static struct rtable *icmp_route_lookup(struct net *net, - fl4->saddr = saddr; - fl4->flowi4_mark = mark; - fl4->flowi4_uid = sock_net_uid(net, NULL); -- fl4->flowi4_tos = RT_TOS(tos); -+ fl4->flowi4_tos = inet_dscp_to_dsfield(dscp); - fl4->flowi4_proto = IPPROTO_ICMP; - fl4->fl4_icmp_type = type; - fl4->fl4_icmp_code = code; -@@ -548,7 +549,7 @@ static struct rtable *icmp_route_lookup(struct net *net, - orefdst = skb_in->_skb_refdst; /* save old refdst */ - skb_dst_set(skb_in, NULL); - err = ip_route_input(skb_in, fl4_dec.daddr, fl4_dec.saddr, -- RT_TOS(tos), rt2->dst.dev); -+ dscp, rt2->dst.dev); - - dst_release(&rt2->dst); - rt2 = skb_rtable(skb_in); -@@ -744,8 +745,9 @@ void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info, - ipc.opt = &icmp_param.replyopts.opt; - ipc.sockc.mark = mark; - -- rt = icmp_route_lookup(net, &fl4, skb_in, iph, saddr, tos, mark, -- type, code, &icmp_param); -+ rt = icmp_route_lookup(net, &fl4, skb_in, iph, saddr, -+ inet_dsfield_to_dscp(tos), mark, type, code, -+ &icmp_param); - if (IS_ERR(rt)) - goto out_unlock; - -@@ -778,6 +780,8 @@ void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info, - if (!fl4.saddr) - fl4.saddr = htonl(INADDR_DUMMY); - -+ trace_icmp_send(skb_in, type, code); -+ - icmp_push_reply(sk, &icmp_param, &fl4, &ipc, &rt); - ende: - ip_rt_put(rt); -diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c -index a9e22a098872fa..b4c59708fc0956 100644 ---- a/net/ipv4/ip_options.c -+++ b/net/ipv4/ip_options.c -@@ -617,7 +617,8 @@ int ip_options_rcv_srr(struct sk_buff *skb, struct net_device *dev) - - orefdst = skb->_skb_refdst; - skb_dst_set(skb, NULL); -- err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, dev); -+ err = ip_route_input(skb, nexthop, iph->saddr, ip4h_dscp(iph), -+ dev); - rt2 = skb_rtable(skb); - if (err || (rt2->rt_type != RTN_UNICAST && rt2->rt_type != RTN_LOCAL)) { - skb_dst_drop(skb); -diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c -index cc2b608b1a8e78..ddb90b9057e756 100644 ---- a/net/ipv4/tcp_minisocks.c -+++ b/net/ipv4/tcp_minisocks.c -@@ -754,12 +754,6 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb, - - /* In sequence, PAWS is OK. */ - -- /* TODO: We probably should defer ts_recent change once -- * we take ownership of @req. -- */ -- if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_nxt)) -- WRITE_ONCE(req->ts_recent, tmp_opt.rcv_tsval); -- - if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) { - /* Truncate SYN, it is out of window starting - at tcp_rsk(req)->rcv_isn + 1. */ -@@ -808,6 +802,10 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb, - if (!child) - goto listen_overflow; - -+ if (own_req && tmp_opt.saw_tstamp && -+ !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_nxt)) -+ tcp_sk(child)->rx_opt.ts_recent = tmp_opt.rcv_tsval; -+ - if (own_req && rsk_drop_req(req)) { - reqsk_queue_removed(&inet_csk(req->rsk_listener)->icsk_accept_queue, req); - inet_csk_reqsk_queue_drop_and_put(req->rsk_listener, req); -diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index 97905d4174eca5..d645d022ce7745 100644 ---- a/net/ipv6/ip6_tunnel.c -+++ b/net/ipv6/ip6_tunnel.c -@@ -628,8 +628,8 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, - } - skb_dst_set(skb2, &rt->dst); - } else { -- if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos, -- skb2->dev) || -+ if (ip_route_input(skb2, eiph->daddr, eiph->saddr, -+ ip4h_dscp(eiph), skb2->dev) || - skb_dst(skb2)->dev->type != ARPHRD_TUNNEL6) - goto out; - } -diff --git a/net/ipv6/rpl_iptunnel.c b/net/ipv6/rpl_iptunnel.c -index db3c19a42e1ca7..28fc7fae579723 100644 ---- a/net/ipv6/rpl_iptunnel.c -+++ b/net/ipv6/rpl_iptunnel.c -@@ -125,7 +125,8 @@ static void rpl_destroy_state(struct lwtunnel_state *lwt) - } - - static int rpl_do_srh_inline(struct sk_buff *skb, const struct rpl_lwt *rlwt, -- const struct ipv6_rpl_sr_hdr *srh) -+ const struct ipv6_rpl_sr_hdr *srh, -+ struct dst_entry *cache_dst) - { - struct ipv6_rpl_sr_hdr *isrh, *csrh; - const struct ipv6hdr *oldhdr; -@@ -153,7 +154,7 @@ static int rpl_do_srh_inline(struct sk_buff *skb, const struct rpl_lwt *rlwt, - - hdrlen = ((csrh->hdrlen + 1) << 3); - -- err = skb_cow_head(skb, hdrlen + skb->mac_len); -+ err = skb_cow_head(skb, hdrlen + dst_dev_overhead(cache_dst, skb)); - if (unlikely(err)) { - kfree(buf); - return err; -@@ -186,7 +187,8 @@ static int rpl_do_srh_inline(struct sk_buff *skb, const struct rpl_lwt *rlwt, - return 0; - } - --static int rpl_do_srh(struct sk_buff *skb, const struct rpl_lwt *rlwt) -+static int rpl_do_srh(struct sk_buff *skb, const struct rpl_lwt *rlwt, -+ struct dst_entry *cache_dst) - { - struct dst_entry *dst = skb_dst(skb); - struct rpl_iptunnel_encap *tinfo; -@@ -196,7 +198,7 @@ static int rpl_do_srh(struct sk_buff *skb, const struct rpl_lwt *rlwt) - - tinfo = rpl_encap_lwtunnel(dst->lwtstate); - -- return rpl_do_srh_inline(skb, rlwt, tinfo->srh); -+ return rpl_do_srh_inline(skb, rlwt, tinfo->srh, cache_dst); - } - - static int rpl_output(struct net *net, struct sock *sk, struct sk_buff *skb) -@@ -208,14 +210,14 @@ static int rpl_output(struct net *net, struct sock *sk, struct sk_buff *skb) - - rlwt = rpl_lwt_lwtunnel(orig_dst->lwtstate); - -- err = rpl_do_srh(skb, rlwt); -- if (unlikely(err)) -- goto drop; -- - local_bh_disable(); - dst = dst_cache_get(&rlwt->cache); - local_bh_enable(); - -+ err = rpl_do_srh(skb, rlwt, dst); -+ if (unlikely(err)) -+ goto drop; -+ - if (unlikely(!dst)) { - struct ipv6hdr *hdr = ipv6_hdr(skb); - struct flowi6 fl6; -@@ -237,15 +239,15 @@ static int rpl_output(struct net *net, struct sock *sk, struct sk_buff *skb) - local_bh_disable(); - dst_cache_set_ip6(&rlwt->cache, dst, &fl6.saddr); - local_bh_enable(); -+ -+ err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); -+ if (unlikely(err)) -+ goto drop; - } - - skb_dst_drop(skb); - skb_dst_set(skb, dst); - -- err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); -- if (unlikely(err)) -- goto drop; -- - return dst_output(net, sk, skb); - - drop: -@@ -257,34 +259,46 @@ static int rpl_input(struct sk_buff *skb) - { - struct dst_entry *orig_dst = skb_dst(skb); - struct dst_entry *dst = NULL; -+ struct lwtunnel_state *lwtst; - struct rpl_lwt *rlwt; - int err; - -- rlwt = rpl_lwt_lwtunnel(orig_dst->lwtstate); -+ /* We cannot dereference "orig_dst" once ip6_route_input() or -+ * skb_dst_drop() is called. However, in order to detect a dst loop, we -+ * need the address of its lwtstate. So, save the address of lwtstate -+ * now and use it later as a comparison. -+ */ -+ lwtst = orig_dst->lwtstate; - -- err = rpl_do_srh(skb, rlwt); -- if (unlikely(err)) -- goto drop; -+ rlwt = rpl_lwt_lwtunnel(lwtst); - - local_bh_disable(); - dst = dst_cache_get(&rlwt->cache); -+ local_bh_enable(); -+ -+ err = rpl_do_srh(skb, rlwt, dst); -+ if (unlikely(err)) -+ goto drop; - - if (!dst) { - ip6_route_input(skb); - dst = skb_dst(skb); -- if (!dst->error) { -+ -+ /* cache only if we don't create a dst reference loop */ -+ if (!dst->error && lwtst != dst->lwtstate) { -+ local_bh_disable(); - dst_cache_set_ip6(&rlwt->cache, dst, - &ipv6_hdr(skb)->saddr); -+ local_bh_enable(); - } -+ -+ err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); -+ if (unlikely(err)) -+ goto drop; - } else { - skb_dst_drop(skb); - skb_dst_set(skb, dst); - } -- local_bh_enable(); -- -- err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); -- if (unlikely(err)) -- goto drop; - - return dst_input(skb); - -diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c -index 098632adc9b5af..c44e4c0824e0d8 100644 ---- a/net/ipv6/seg6_iptunnel.c -+++ b/net/ipv6/seg6_iptunnel.c -@@ -124,8 +124,8 @@ static __be32 seg6_make_flowlabel(struct net *net, struct sk_buff *skb, - return flowlabel; - } - --/* encapsulate an IPv6 packet within an outer IPv6 header with a given SRH */ --int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto) -+static int __seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, -+ int proto, struct dst_entry *cache_dst) - { - struct dst_entry *dst = skb_dst(skb); - struct net *net = dev_net(dst->dev); -@@ -137,7 +137,7 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto) - hdrlen = (osrh->hdrlen + 1) << 3; - tot_len = hdrlen + sizeof(*hdr); - -- err = skb_cow_head(skb, tot_len + skb->mac_len); -+ err = skb_cow_head(skb, tot_len + dst_dev_overhead(cache_dst, skb)); - if (unlikely(err)) - return err; - -@@ -197,11 +197,18 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto) - - return 0; - } -+ -+/* encapsulate an IPv6 packet within an outer IPv6 header with a given SRH */ -+int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto) -+{ -+ return __seg6_do_srh_encap(skb, osrh, proto, NULL); -+} - EXPORT_SYMBOL_GPL(seg6_do_srh_encap); - - /* encapsulate an IPv6 packet within an outer IPv6 header with reduced SRH */ - static int seg6_do_srh_encap_red(struct sk_buff *skb, -- struct ipv6_sr_hdr *osrh, int proto) -+ struct ipv6_sr_hdr *osrh, int proto, -+ struct dst_entry *cache_dst) - { - __u8 first_seg = osrh->first_segment; - struct dst_entry *dst = skb_dst(skb); -@@ -230,7 +237,7 @@ static int seg6_do_srh_encap_red(struct sk_buff *skb, - - tot_len = red_hdrlen + sizeof(struct ipv6hdr); - -- err = skb_cow_head(skb, tot_len + skb->mac_len); -+ err = skb_cow_head(skb, tot_len + dst_dev_overhead(cache_dst, skb)); - if (unlikely(err)) - return err; - -@@ -317,8 +324,8 @@ static int seg6_do_srh_encap_red(struct sk_buff *skb, - return 0; - } - --/* insert an SRH within an IPv6 packet, just after the IPv6 header */ --int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh) -+static int __seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, -+ struct dst_entry *cache_dst) - { - struct ipv6hdr *hdr, *oldhdr; - struct ipv6_sr_hdr *isrh; -@@ -326,7 +333,7 @@ int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh) - - hdrlen = (osrh->hdrlen + 1) << 3; - -- err = skb_cow_head(skb, hdrlen + skb->mac_len); -+ err = skb_cow_head(skb, hdrlen + dst_dev_overhead(cache_dst, skb)); - if (unlikely(err)) - return err; - -@@ -369,9 +376,8 @@ int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh) - - return 0; - } --EXPORT_SYMBOL_GPL(seg6_do_srh_inline); - --static int seg6_do_srh(struct sk_buff *skb) -+static int seg6_do_srh(struct sk_buff *skb, struct dst_entry *cache_dst) - { - struct dst_entry *dst = skb_dst(skb); - struct seg6_iptunnel_encap *tinfo; -@@ -384,7 +390,7 @@ static int seg6_do_srh(struct sk_buff *skb) - if (skb->protocol != htons(ETH_P_IPV6)) - return -EINVAL; - -- err = seg6_do_srh_inline(skb, tinfo->srh); -+ err = __seg6_do_srh_inline(skb, tinfo->srh, cache_dst); - if (err) - return err; - break; -@@ -402,9 +408,11 @@ static int seg6_do_srh(struct sk_buff *skb) - return -EINVAL; - - if (tinfo->mode == SEG6_IPTUN_MODE_ENCAP) -- err = seg6_do_srh_encap(skb, tinfo->srh, proto); -+ err = __seg6_do_srh_encap(skb, tinfo->srh, -+ proto, cache_dst); - else -- err = seg6_do_srh_encap_red(skb, tinfo->srh, proto); -+ err = seg6_do_srh_encap_red(skb, tinfo->srh, -+ proto, cache_dst); - - if (err) - return err; -@@ -425,11 +433,13 @@ static int seg6_do_srh(struct sk_buff *skb) - skb_push(skb, skb->mac_len); - - if (tinfo->mode == SEG6_IPTUN_MODE_L2ENCAP) -- err = seg6_do_srh_encap(skb, tinfo->srh, -- IPPROTO_ETHERNET); -+ err = __seg6_do_srh_encap(skb, tinfo->srh, -+ IPPROTO_ETHERNET, -+ cache_dst); - else - err = seg6_do_srh_encap_red(skb, tinfo->srh, -- IPPROTO_ETHERNET); -+ IPPROTO_ETHERNET, -+ cache_dst); - - if (err) - return err; -@@ -444,6 +454,13 @@ static int seg6_do_srh(struct sk_buff *skb) - return 0; - } - -+/* insert an SRH within an IPv6 packet, just after the IPv6 header */ -+int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh) -+{ -+ return __seg6_do_srh_inline(skb, osrh, NULL); -+} -+EXPORT_SYMBOL_GPL(seg6_do_srh_inline); -+ - static int seg6_input_finish(struct net *net, struct sock *sk, - struct sk_buff *skb) - { -@@ -455,34 +472,46 @@ static int seg6_input_core(struct net *net, struct sock *sk, - { - struct dst_entry *orig_dst = skb_dst(skb); - struct dst_entry *dst = NULL; -+ struct lwtunnel_state *lwtst; - struct seg6_lwt *slwt; - int err; - -- err = seg6_do_srh(skb); -- if (unlikely(err)) -- goto drop; -+ /* We cannot dereference "orig_dst" once ip6_route_input() or -+ * skb_dst_drop() is called. However, in order to detect a dst loop, we -+ * need the address of its lwtstate. So, save the address of lwtstate -+ * now and use it later as a comparison. -+ */ -+ lwtst = orig_dst->lwtstate; - -- slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate); -+ slwt = seg6_lwt_lwtunnel(lwtst); - - local_bh_disable(); - dst = dst_cache_get(&slwt->cache); -+ local_bh_enable(); -+ -+ err = seg6_do_srh(skb, dst); -+ if (unlikely(err)) -+ goto drop; - - if (!dst) { - ip6_route_input(skb); - dst = skb_dst(skb); -- if (!dst->error) { -+ -+ /* cache only if we don't create a dst reference loop */ -+ if (!dst->error && lwtst != dst->lwtstate) { -+ local_bh_disable(); - dst_cache_set_ip6(&slwt->cache, dst, - &ipv6_hdr(skb)->saddr); -+ local_bh_enable(); - } -+ -+ err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); -+ if (unlikely(err)) -+ goto drop; - } else { - skb_dst_drop(skb); - skb_dst_set(skb, dst); - } -- local_bh_enable(); -- -- err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); -- if (unlikely(err)) -- goto drop; - - if (static_branch_unlikely(&nf_hooks_lwtunnel_enabled)) - return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, -@@ -528,16 +557,16 @@ static int seg6_output_core(struct net *net, struct sock *sk, - struct seg6_lwt *slwt; - int err; - -- err = seg6_do_srh(skb); -- if (unlikely(err)) -- goto drop; -- - slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate); - - local_bh_disable(); - dst = dst_cache_get(&slwt->cache); - local_bh_enable(); - -+ err = seg6_do_srh(skb, dst); -+ if (unlikely(err)) -+ goto drop; -+ - if (unlikely(!dst)) { - struct ipv6hdr *hdr = ipv6_hdr(skb); - struct flowi6 fl6; -@@ -559,15 +588,15 @@ static int seg6_output_core(struct net *net, struct sock *sk, - local_bh_disable(); - dst_cache_set_ip6(&slwt->cache, dst, &fl6.saddr); - local_bh_enable(); -+ -+ err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); -+ if (unlikely(err)) -+ goto drop; - } - - skb_dst_drop(skb); - skb_dst_set(skb, dst); - -- err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); -- if (unlikely(err)) -- goto drop; -- - if (static_branch_unlikely(&nf_hooks_lwtunnel_enabled)) - return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, net, sk, skb, - NULL, skb_dst(skb)->dev, dst_output); -diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c -index 2b63c5492eedc2..5f16e2fa2de67a 100644 ---- a/net/mptcp/pm_netlink.c -+++ b/net/mptcp/pm_netlink.c -@@ -1559,11 +1559,6 @@ static int mptcp_nl_remove_subflow_and_signal_addr(struct net *net, - if (mptcp_pm_is_userspace(msk)) - goto next; - -- if (list_empty(&msk->conn_list)) { -- mptcp_pm_remove_anno_addr(msk, addr, false); -- goto next; -- } -- - lock_sock(sk); - remove_subflow = lookup_subflow_by_saddr(&msk->conn_list, addr); - mptcp_pm_remove_anno_addr(msk, addr, remove_subflow && -diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c -index 282ecc8bf75e80..b3eeeb948b6132 100644 ---- a/net/mptcp/subflow.c -+++ b/net/mptcp/subflow.c -@@ -1109,7 +1109,6 @@ static enum mapping_status get_mapping_status(struct sock *ssk, - if (data_len == 0) { - pr_debug("infinite mapping received\n"); - MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_INFINITEMAPRX); -- subflow->map_data_len = 0; - return MAPPING_INVALID; - } - -@@ -1251,18 +1250,6 @@ static void subflow_sched_work_if_closed(struct mptcp_sock *msk, struct sock *ss - mptcp_schedule_work(sk); - } - --static bool subflow_can_fallback(struct mptcp_subflow_context *subflow) --{ -- struct mptcp_sock *msk = mptcp_sk(subflow->conn); -- -- if (subflow->mp_join) -- return false; -- else if (READ_ONCE(msk->csum_enabled)) -- return !subflow->valid_csum_seen; -- else -- return READ_ONCE(msk->allow_infinite_fallback); --} -- - static void mptcp_subflow_fail(struct mptcp_sock *msk, struct sock *ssk) - { - struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk); -@@ -1358,7 +1345,7 @@ static bool subflow_check_data_avail(struct sock *ssk) - return true; - } - -- if (!subflow_can_fallback(subflow) && subflow->map_data_len) { -+ if (!READ_ONCE(msk->allow_infinite_fallback)) { - /* fatal protocol error, close the socket. - * subflow_error_report() will introduce the appropriate barriers - */ -diff --git a/net/rxrpc/rxperf.c b/net/rxrpc/rxperf.c -index 085e7892d31040..b1536da2246b82 100644 ---- a/net/rxrpc/rxperf.c -+++ b/net/rxrpc/rxperf.c -@@ -478,6 +478,18 @@ static int rxperf_deliver_request(struct rxperf_call *call) - call->unmarshal++; - fallthrough; - case 2: -+ ret = rxperf_extract_data(call, true); -+ if (ret < 0) -+ return ret; -+ -+ /* Deal with the terminal magic cookie. */ -+ call->iov_len = 4; -+ call->kvec[0].iov_len = call->iov_len; -+ call->kvec[0].iov_base = call->tmp; -+ iov_iter_kvec(&call->iter, READ, call->kvec, 1, call->iov_len); -+ call->unmarshal++; -+ fallthrough; -+ case 3: - ret = rxperf_extract_data(call, false); - if (ret < 0) - return ret; -diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c -index 3298da2e37e43d..cb6a6bc9fea77d 100644 ---- a/net/sunrpc/cache.c -+++ b/net/sunrpc/cache.c -@@ -1675,12 +1675,14 @@ static void remove_cache_proc_entries(struct cache_detail *cd) - } - } - --#ifdef CONFIG_PROC_FS - static int create_cache_proc_entries(struct cache_detail *cd, struct net *net) - { - struct proc_dir_entry *p; - struct sunrpc_net *sn; - -+ if (!IS_ENABLED(CONFIG_PROC_FS)) -+ return 0; -+ - sn = net_generic(net, sunrpc_net_id); - cd->procfs = proc_mkdir(cd->name, sn->proc_net_rpc); - if (cd->procfs == NULL) -@@ -1708,12 +1710,6 @@ static int create_cache_proc_entries(struct cache_detail *cd, struct net *net) - remove_cache_proc_entries(cd); - return -ENOMEM; - } --#else /* CONFIG_PROC_FS */ --static int create_cache_proc_entries(struct cache_detail *cd, struct net *net) --{ -- return 0; --} --#endif - - void __init cache_initialize(void) - { -diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c -index cef623ea150609..9b45fbdc90cabe 100644 ---- a/net/sunrpc/sched.c -+++ b/net/sunrpc/sched.c -@@ -864,8 +864,6 @@ void rpc_signal_task(struct rpc_task *task) - if (!rpc_task_set_rpc_status(task, -ERESTARTSYS)) - return; - trace_rpc_task_signalled(task, task->tk_action); -- set_bit(RPC_TASK_SIGNALLED, &task->tk_runstate); -- smp_mb__after_atomic(); - queue = READ_ONCE(task->tk_waitqueue); - if (queue) - rpc_wake_up_queued_task(queue, task); -diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c -index 1c4bc8234ea875..29df05879c8e95 100644 ---- a/net/sunrpc/xprtsock.c -+++ b/net/sunrpc/xprtsock.c -@@ -2561,7 +2561,15 @@ static void xs_tls_handshake_done(void *data, int status, key_serial_t peerid) - struct sock_xprt *lower_transport = - container_of(lower_xprt, struct sock_xprt, xprt); - -- lower_transport->xprt_err = status ? -EACCES : 0; -+ switch (status) { -+ case 0: -+ case -EACCES: -+ case -ETIMEDOUT: -+ lower_transport->xprt_err = status; -+ break; -+ default: -+ lower_transport->xprt_err = -EACCES; -+ } - complete(&lower_transport->handshake_done); - xprt_put(lower_xprt); - } -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 75162e5f712b40..822bd9a00892c3 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -10084,23 +10084,27 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1043, 0x1313, "Asus K42JZ", ALC269VB_FIXUP_ASUS_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC), - SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK), -- SND_PCI_QUIRK(0x1043, 0x1433, "ASUS GX650P", ALC285_FIXUP_ASUS_I2C_HEADSET_MIC), -- SND_PCI_QUIRK(0x1043, 0x1463, "Asus GA402X", ALC285_FIXUP_ASUS_I2C_HEADSET_MIC), -- SND_PCI_QUIRK(0x1043, 0x1473, "ASUS GU604V", ALC285_FIXUP_ASUS_HEADSET_MIC), -- SND_PCI_QUIRK(0x1043, 0x1483, "ASUS GU603V", ALC285_FIXUP_ASUS_HEADSET_MIC), -- SND_PCI_QUIRK(0x1043, 0x1493, "ASUS GV601V", ALC285_FIXUP_ASUS_HEADSET_MIC), -+ SND_PCI_QUIRK(0x1043, 0x1433, "ASUS GX650PY/PZ/PV/PU/PYV/PZV/PIV/PVV", ALC285_FIXUP_ASUS_I2C_HEADSET_MIC), -+ SND_PCI_QUIRK(0x1043, 0x1460, "Asus VivoBook 15", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE), -+ SND_PCI_QUIRK(0x1043, 0x1463, "Asus GA402X/GA402N", ALC285_FIXUP_ASUS_I2C_HEADSET_MIC), -+ SND_PCI_QUIRK(0x1043, 0x1473, "ASUS GU604VI/VC/VE/VG/VJ/VQ/VU/VV/VY/VZ", ALC285_FIXUP_ASUS_HEADSET_MIC), -+ SND_PCI_QUIRK(0x1043, 0x1483, "ASUS GU603VQ/VU/VV/VJ/VI", ALC285_FIXUP_ASUS_HEADSET_MIC), -+ SND_PCI_QUIRK(0x1043, 0x1493, "ASUS GV601VV/VU/VJ/VQ/VI", ALC285_FIXUP_ASUS_HEADSET_MIC), -+ SND_PCI_QUIRK(0x1043, 0x14d3, "ASUS G614JY/JZ/JG", ALC245_FIXUP_CS35L41_SPI_2), -+ SND_PCI_QUIRK(0x1043, 0x14e3, "ASUS G513PI/PU/PV", ALC287_FIXUP_CS35L41_I2C_2), -+ SND_PCI_QUIRK(0x1043, 0x1503, "ASUS G733PY/PZ/PZV/PYV", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A), -- SND_PCI_QUIRK(0x1043, 0x1533, "ASUS GV302XA", ALC287_FIXUP_CS35L41_I2C_2), -- SND_PCI_QUIRK(0x1043, 0x1573, "ASUS GZ301V", ALC285_FIXUP_ASUS_HEADSET_MIC), -+ SND_PCI_QUIRK(0x1043, 0x1533, "ASUS GV302XA/XJ/XQ/XU/XV/XI", ALC287_FIXUP_CS35L41_I2C_2), -+ SND_PCI_QUIRK(0x1043, 0x1573, "ASUS GZ301VV/VQ/VU/VJ/VA/VC/VE/VVC/VQC/VUC/VJC/VEC/VCC", ALC285_FIXUP_ASUS_HEADSET_MIC), - SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK), -- SND_PCI_QUIRK(0x1043, 0x1663, "ASUS GU603ZV", ALC285_FIXUP_ASUS_HEADSET_MIC), -+ SND_PCI_QUIRK(0x1043, 0x1663, "ASUS GU603ZI/ZJ/ZQ/ZU/ZV", ALC285_FIXUP_ASUS_HEADSET_MIC), - SND_PCI_QUIRK(0x1043, 0x1683, "ASUS UM3402YAR", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x1043, 0x16a3, "ASUS UX3402VA", ALC245_FIXUP_CS35L41_SPI_2), - SND_PCI_QUIRK(0x1043, 0x16b2, "ASUS GU603", ALC289_FIXUP_ASUS_GA401), - SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC), - SND_PCI_QUIRK(0x1043, 0x1740, "ASUS UX430UA", ALC295_FIXUP_ASUS_DACS), - SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_DUAL_SPK), -- SND_PCI_QUIRK(0x1043, 0x17f3, "ROG Ally RC71L_RC71L", ALC294_FIXUP_ASUS_ALLY), -+ SND_PCI_QUIRK(0x1043, 0x17f3, "ROG Ally NR2301L/X", ALC294_FIXUP_ASUS_ALLY), - SND_PCI_QUIRK(0x1043, 0x1881, "ASUS Zephyrus S/M", ALC294_FIXUP_ASUS_GX502_PINS), - SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC), - SND_PCI_QUIRK(0x1043, 0x18d3, "ASUS UM3504DA", ALC294_FIXUP_CS35L41_I2C_2), -@@ -10111,7 +10115,6 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1043, 0x19ce, "ASUS B9450FA", ALC294_FIXUP_ASUS_HPE), - SND_PCI_QUIRK(0x1043, 0x19e1, "ASUS UX581LV", ALC295_FIXUP_ASUS_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW), -- SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC), - SND_PCI_QUIRK(0x1043, 0x1a63, "ASUS UX3405MA", ALC245_FIXUP_CS35L41_SPI_2), - SND_PCI_QUIRK(0x1043, 0x1a83, "ASUS UM5302LA", ALC294_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x1043, 0x1a8f, "ASUS UX582ZS", ALC245_FIXUP_CS35L41_SPI_2), -@@ -10125,10 +10128,13 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1043, 0x1c43, "ASUS UX8406MA", ALC245_FIXUP_CS35L41_SPI_2), - SND_PCI_QUIRK(0x1043, 0x1c62, "ASUS GU603", ALC289_FIXUP_ASUS_GA401), - SND_PCI_QUIRK(0x1043, 0x1c92, "ASUS ROG Strix G15", ALC285_FIXUP_ASUS_G533Z_PINS), -- SND_PCI_QUIRK(0x1043, 0x1c9f, "ASUS G614JI", ALC285_FIXUP_ASUS_HEADSET_MIC), -- SND_PCI_QUIRK(0x1043, 0x1caf, "ASUS G634JYR/JZR", ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS), -+ SND_PCI_QUIRK(0x1043, 0x1c9f, "ASUS G614JU/JV/JI", ALC285_FIXUP_ASUS_HEADSET_MIC), -+ SND_PCI_QUIRK(0x1043, 0x1caf, "ASUS G634JY/JZ/JI/JG", ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS), - SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC), -- SND_PCI_QUIRK(0x1043, 0x1d1f, "ASUS ROG Strix G17 2023 (G713PV)", ALC287_FIXUP_CS35L41_I2C_2), -+ SND_PCI_QUIRK(0x1043, 0x1ccf, "ASUS G814JU/JV/JI", ALC245_FIXUP_CS35L41_SPI_2), -+ SND_PCI_QUIRK(0x1043, 0x1cdf, "ASUS G814JY/JZ/JG", ALC245_FIXUP_CS35L41_SPI_2), -+ SND_PCI_QUIRK(0x1043, 0x1cef, "ASUS G834JY/JZ/JI/JG", ALC285_FIXUP_ASUS_HEADSET_MIC), -+ SND_PCI_QUIRK(0x1043, 0x1d1f, "ASUS G713PI/PU/PV/PVN", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401), - SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE), - SND_PCI_QUIRK(0x1043, 0x1da2, "ASUS UP6502ZA/ZD", ALC245_FIXUP_CS35L41_SPI_2), -diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c -index 0bd9ba5a11b4e5..43792e175d75f1 100644 ---- a/sound/soc/codecs/es8328.c -+++ b/sound/soc/codecs/es8328.c -@@ -234,7 +234,6 @@ static const struct snd_kcontrol_new es8328_right_line_controls = - - /* Left Mixer */ - static const struct snd_kcontrol_new es8328_left_mixer_controls[] = { -- SOC_DAPM_SINGLE("Playback Switch", ES8328_DACCONTROL17, 7, 1, 0), - SOC_DAPM_SINGLE("Left Bypass Switch", ES8328_DACCONTROL17, 6, 1, 0), - SOC_DAPM_SINGLE("Right Playback Switch", ES8328_DACCONTROL18, 7, 1, 0), - SOC_DAPM_SINGLE("Right Bypass Switch", ES8328_DACCONTROL18, 6, 1, 0), -@@ -244,7 +243,6 @@ static const struct snd_kcontrol_new es8328_left_mixer_controls[] = { - static const struct snd_kcontrol_new es8328_right_mixer_controls[] = { - SOC_DAPM_SINGLE("Left Playback Switch", ES8328_DACCONTROL19, 7, 1, 0), - SOC_DAPM_SINGLE("Left Bypass Switch", ES8328_DACCONTROL19, 6, 1, 0), -- SOC_DAPM_SINGLE("Playback Switch", ES8328_DACCONTROL20, 7, 1, 0), - SOC_DAPM_SINGLE("Right Bypass Switch", ES8328_DACCONTROL20, 6, 1, 0), - }; - -@@ -337,10 +335,10 @@ static const struct snd_soc_dapm_widget es8328_dapm_widgets[] = { - SND_SOC_DAPM_DAC("Left DAC", "Left Playback", ES8328_DACPOWER, - ES8328_DACPOWER_LDAC_OFF, 1), - -- SND_SOC_DAPM_MIXER("Left Mixer", SND_SOC_NOPM, 0, 0, -+ SND_SOC_DAPM_MIXER("Left Mixer", ES8328_DACCONTROL17, 7, 0, - &es8328_left_mixer_controls[0], - ARRAY_SIZE(es8328_left_mixer_controls)), -- SND_SOC_DAPM_MIXER("Right Mixer", SND_SOC_NOPM, 0, 0, -+ SND_SOC_DAPM_MIXER("Right Mixer", ES8328_DACCONTROL20, 7, 0, - &es8328_right_mixer_controls[0], - ARRAY_SIZE(es8328_right_mixer_controls)), - -@@ -419,19 +417,14 @@ static const struct snd_soc_dapm_route es8328_dapm_routes[] = { - { "Right Line Mux", "PGA", "Right PGA Mux" }, - { "Right Line Mux", "Differential", "Differential Mux" }, - -- { "Left Out 1", NULL, "Left DAC" }, -- { "Right Out 1", NULL, "Right DAC" }, -- { "Left Out 2", NULL, "Left DAC" }, -- { "Right Out 2", NULL, "Right DAC" }, -- -- { "Left Mixer", "Playback Switch", "Left DAC" }, -+ { "Left Mixer", NULL, "Left DAC" }, - { "Left Mixer", "Left Bypass Switch", "Left Line Mux" }, - { "Left Mixer", "Right Playback Switch", "Right DAC" }, - { "Left Mixer", "Right Bypass Switch", "Right Line Mux" }, - - { "Right Mixer", "Left Playback Switch", "Left DAC" }, - { "Right Mixer", "Left Bypass Switch", "Left Line Mux" }, -- { "Right Mixer", "Playback Switch", "Right DAC" }, -+ { "Right Mixer", NULL, "Right DAC" }, - { "Right Mixer", "Right Bypass Switch", "Right Line Mux" }, - - { "DAC DIG", NULL, "DAC STM" }, -diff --git a/sound/usb/midi.c b/sound/usb/midi.c -index 6b0993258e039b..6d861046b582b5 100644 ---- a/sound/usb/midi.c -+++ b/sound/usb/midi.c -@@ -1145,7 +1145,7 @@ static int snd_usbmidi_output_close(struct snd_rawmidi_substream *substream) - { - struct usbmidi_out_port *port = substream->runtime->private_data; - -- cancel_work_sync(&port->ep->work); -+ flush_work(&port->ep->work); - return substream_open(substream, 0, 0); - } - -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index 93d9ed8983dfce..d9d4c5922a50bb 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -1775,6 +1775,7 @@ void snd_usb_set_format_quirk(struct snd_usb_substream *subs, - case USB_ID(0x534d, 0x2109): /* MacroSilicon MS2109 */ - subs->stream_offset_adj = 2; - break; -+ case USB_ID(0x2b73, 0x000a): /* Pioneer DJM-900NXS2 */ - case USB_ID(0x2b73, 0x0013): /* Pioneer DJM-450 */ - pioneer_djm_set_format_quirk(subs, 0x0082); - break; -diff --git a/tools/testing/selftests/rseq/rseq-riscv-bits.h b/tools/testing/selftests/rseq/rseq-riscv-bits.h -index de31a0143139b7..f02f411d550d18 100644 ---- a/tools/testing/selftests/rseq/rseq-riscv-bits.h -+++ b/tools/testing/selftests/rseq/rseq-riscv-bits.h -@@ -243,7 +243,7 @@ int RSEQ_TEMPLATE_IDENTIFIER(rseq_offset_deref_addv)(intptr_t *ptr, off_t off, i - #ifdef RSEQ_COMPARE_TWICE - RSEQ_ASM_CMP_CPU_ID(cpu_id, current_cpu_id, "%l[error1]") - #endif -- RSEQ_ASM_OP_R_DEREF_ADDV(ptr, off, 3) -+ RSEQ_ASM_OP_R_DEREF_ADDV(ptr, off, inc, 3) - RSEQ_INJECT_ASM(4) - RSEQ_ASM_DEFINE_ABORT(4, abort) - : /* gcc asm goto does not allow outputs */ -@@ -251,8 +251,8 @@ int RSEQ_TEMPLATE_IDENTIFIER(rseq_offset_deref_addv)(intptr_t *ptr, off_t off, i - [current_cpu_id] "m" (rseq_get_abi()->RSEQ_TEMPLATE_CPU_ID_FIELD), - [rseq_cs] "m" (rseq_get_abi()->rseq_cs.arch.ptr), - [ptr] "r" (ptr), -- [off] "er" (off), -- [inc] "er" (inc) -+ [off] "r" (off), -+ [inc] "r" (inc) - RSEQ_INJECT_INPUT - : "memory", RSEQ_ASM_TMP_REG_1 - RSEQ_INJECT_CLOBBER -diff --git a/tools/testing/selftests/rseq/rseq-riscv.h b/tools/testing/selftests/rseq/rseq-riscv.h -index 37e598d0a365e2..67d544aaa9a3b0 100644 ---- a/tools/testing/selftests/rseq/rseq-riscv.h -+++ b/tools/testing/selftests/rseq/rseq-riscv.h -@@ -158,7 +158,7 @@ do { \ - "bnez " RSEQ_ASM_TMP_REG_1 ", 222b\n" \ - "333:\n" - --#define RSEQ_ASM_OP_R_DEREF_ADDV(ptr, off, post_commit_label) \ -+#define RSEQ_ASM_OP_R_DEREF_ADDV(ptr, off, inc, post_commit_label) \ - "mv " RSEQ_ASM_TMP_REG_1 ", %[" __rseq_str(ptr) "]\n" \ - RSEQ_ASM_OP_R_ADD(off) \ - REG_L RSEQ_ASM_TMP_REG_1 ", 0(" RSEQ_ASM_TMP_REG_1 ")\n" \ -diff --git a/tools/tracing/rtla/src/timerlat_hist.c b/tools/tracing/rtla/src/timerlat_hist.c -index a985e57954820e..198cdf75c837bb 100644 ---- a/tools/tracing/rtla/src/timerlat_hist.c -+++ b/tools/tracing/rtla/src/timerlat_hist.c -@@ -905,7 +905,7 @@ timerlat_hist_apply_config(struct osnoise_tool *tool, struct timerlat_hist_param - * On kernels without support, user threads will have already failed - * on missing timerlat_fd, and kernel threads do not need it. - */ -- retval = osnoise_set_workload(tool->context, params->kernel_workload); -+ retval = osnoise_set_workload(tool->context, !params->user_hist); - if (retval < -1) { - err_msg("Failed to set OSNOISE_WORKLOAD option\n"); - goto out_err; -diff --git a/tools/tracing/rtla/src/timerlat_top.c b/tools/tracing/rtla/src/timerlat_top.c -index 1fed4c8d8520f9..7212855d336417 100644 ---- a/tools/tracing/rtla/src/timerlat_top.c -+++ b/tools/tracing/rtla/src/timerlat_top.c -@@ -684,7 +684,7 @@ timerlat_top_apply_config(struct osnoise_tool *top, struct timerlat_top_params * - * On kernels without support, user threads will have already failed - * on missing timerlat_fd, and kernel threads do not need it. - */ -- retval = osnoise_set_workload(top->context, params->kernel_workload); -+ retval = osnoise_set_workload(top->context, !params->user_top); - if (retval < -1) { - err_msg("Failed to set OSNOISE_WORKLOAD option\n"); - goto out_err; diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.081-082.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.081-082.patch deleted file mode 100644 index 870c805bb5..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.081-082.patch +++ /dev/null @@ -1,219 +0,0 @@ -diff --git a/Makefile b/Makefile -index 892ed237b1e1b6..bca0f2e14c5c2f 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 81 -+SUBLEVEL = 82 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 1e666454ebdc3e..a06fab5016fdf4 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -1315,6 +1315,10 @@ config MICROCODE - depends on CPU_SUP_AMD || CPU_SUP_INTEL - select CRYPTO_LIB_SHA256 if CPU_SUP_AMD - -+config MICROCODE_INITRD32 -+ def_bool y -+ depends on MICROCODE && X86_32 && BLK_DEV_INITRD -+ - config MICROCODE_LATE_LOADING - bool "Late microcode loading (DANGEROUS)" - default n -diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h -index 1ab475a518e9a5..0ee6ed0ff2bf20 100644 ---- a/arch/x86/include/asm/microcode.h -+++ b/arch/x86/include/asm/microcode.h -@@ -23,6 +23,8 @@ static inline void load_ucode_ap(void) { } - static inline void microcode_bsp_resume(void) { } - #endif - -+extern unsigned long initrd_start_early; -+ - #ifdef CONFIG_CPU_SUP_INTEL - /* Intel specific microcode defines. Public for IFS */ - struct microcode_header_intel { -diff --git a/arch/x86/include/asm/setup.h b/arch/x86/include/asm/setup.h -index f3495623ac9972..bf483fcb4e5744 100644 ---- a/arch/x86/include/asm/setup.h -+++ b/arch/x86/include/asm/setup.h -@@ -126,6 +126,7 @@ void clear_bss(void); - #ifdef __i386__ - - asmlinkage void __init __noreturn i386_start_kernel(void); -+void __init mk_early_pgtbl_32(void); - - #else - asmlinkage void __init __noreturn x86_64_start_kernel(char *real_mode); -diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile -index 3269a0e23d3ab8..0000325ab98f4d 100644 ---- a/arch/x86/kernel/Makefile -+++ b/arch/x86/kernel/Makefile -@@ -16,6 +16,7 @@ CFLAGS_REMOVE_kvmclock.o = -pg - CFLAGS_REMOVE_ftrace.o = -pg - CFLAGS_REMOVE_early_printk.o = -pg - CFLAGS_REMOVE_head64.o = -pg -+CFLAGS_REMOVE_head32.o = -pg - CFLAGS_REMOVE_sev.o = -pg - CFLAGS_REMOVE_rethook.o = -pg - endif -diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c -index bde27a35bf2e28..de001b2146abf3 100644 ---- a/arch/x86/kernel/head32.c -+++ b/arch/x86/kernel/head32.c -@@ -30,12 +30,32 @@ static void __init i386_default_early_setup(void) - x86_init.mpparse.setup_ioapic_ids = setup_ioapic_ids_from_mpc; - } - -+#ifdef CONFIG_MICROCODE_INITRD32 -+unsigned long __initdata initrd_start_early; -+static pte_t __initdata *initrd_pl2p_start, *initrd_pl2p_end; -+ -+static void zap_early_initrd_mapping(void) -+{ -+ pte_t *pl2p = initrd_pl2p_start; -+ -+ for (; pl2p < initrd_pl2p_end; pl2p++) { -+ *pl2p = (pte_t){ .pte = 0 }; -+ -+ if (!IS_ENABLED(CONFIG_X86_PAE)) -+ *(pl2p + ((PAGE_OFFSET >> PGDIR_SHIFT))) = (pte_t) {.pte = 0}; -+ } -+} -+#else -+static inline void zap_early_initrd_mapping(void) { } -+#endif -+ - asmlinkage __visible void __init __noreturn i386_start_kernel(void) - { - /* Make sure IDT is set up before any exception happens */ - idt_setup_early_handler(); - - load_ucode_bsp(); -+ zap_early_initrd_mapping(); - - cr4_init_shadow(); - -@@ -72,52 +92,83 @@ asmlinkage __visible void __init __noreturn i386_start_kernel(void) - * to the first kernel PMD. Note the upper half of each PMD or PTE are - * always zero at this stage. - */ --void __init mk_early_pgtbl_32(void); --void __init mk_early_pgtbl_32(void) --{ --#ifdef __pa --#undef __pa --#endif --#define __pa(x) ((unsigned long)(x) - PAGE_OFFSET) -- pte_t pte, *ptep; -- int i; -- unsigned long *ptr; -- /* Enough space to fit pagetables for the low memory linear map */ -- const unsigned long limit = __pa(_end) + -- (PAGE_TABLE_SIZE(LOWMEM_PAGES) << PAGE_SHIFT); - #ifdef CONFIG_X86_PAE -- pmd_t pl2, *pl2p = (pmd_t *)__pa(initial_pg_pmd); --#define SET_PL2(pl2, val) { (pl2).pmd = (val); } -+typedef pmd_t pl2_t; -+#define pl2_base initial_pg_pmd -+#define SET_PL2(val) { .pmd = (val), } - #else -- pgd_t pl2, *pl2p = (pgd_t *)__pa(initial_page_table); --#define SET_PL2(pl2, val) { (pl2).pgd = (val); } -+typedef pgd_t pl2_t; -+#define pl2_base initial_page_table -+#define SET_PL2(val) { .pgd = (val), } - #endif - -- ptep = (pte_t *)__pa(__brk_base); -- pte.pte = PTE_IDENT_ATTR; -- -+static __init __no_stack_protector pte_t init_map(pte_t pte, pte_t **ptep, pl2_t **pl2p, -+ const unsigned long limit) -+{ - while ((pte.pte & PTE_PFN_MASK) < limit) { -+ pl2_t pl2 = SET_PL2((unsigned long)*ptep | PDE_IDENT_ATTR); -+ int i; -+ -+ **pl2p = pl2; -+ if (!IS_ENABLED(CONFIG_X86_PAE)) { -+ /* Kernel PDE entry */ -+ *(*pl2p + ((PAGE_OFFSET >> PGDIR_SHIFT))) = pl2; -+ } - -- SET_PL2(pl2, (unsigned long)ptep | PDE_IDENT_ATTR); -- *pl2p = pl2; --#ifndef CONFIG_X86_PAE -- /* Kernel PDE entry */ -- *(pl2p + ((PAGE_OFFSET >> PGDIR_SHIFT))) = pl2; --#endif - for (i = 0; i < PTRS_PER_PTE; i++) { -- *ptep = pte; -+ **ptep = pte; - pte.pte += PAGE_SIZE; -- ptep++; -+ (*ptep)++; - } -- -- pl2p++; -+ (*pl2p)++; - } -+ return pte; -+} -+ -+void __init __no_stack_protector mk_early_pgtbl_32(void) -+{ -+ /* Enough space to fit pagetables for the low memory linear map */ -+ unsigned long limit = __pa_nodebug(_end) + (PAGE_TABLE_SIZE(LOWMEM_PAGES) << PAGE_SHIFT); -+ pte_t pte, *ptep = (pte_t *)__pa_nodebug(__brk_base); -+ struct boot_params __maybe_unused *params; -+ pl2_t *pl2p = (pl2_t *)__pa_nodebug(pl2_base); -+ unsigned long *ptr; -+ -+ pte.pte = PTE_IDENT_ATTR; -+ pte = init_map(pte, &ptep, &pl2p, limit); - -- ptr = (unsigned long *)__pa(&max_pfn_mapped); -+ ptr = (unsigned long *)__pa_nodebug(&max_pfn_mapped); - /* Can't use pte_pfn() since it's a call with CONFIG_PARAVIRT */ - *ptr = (pte.pte & PTE_PFN_MASK) >> PAGE_SHIFT; - -- ptr = (unsigned long *)__pa(&_brk_end); -+ ptr = (unsigned long *)__pa_nodebug(&_brk_end); - *ptr = (unsigned long)ptep + PAGE_OFFSET; --} - -+#ifdef CONFIG_MICROCODE_INITRD32 -+ /* Running on a hypervisor? */ -+ if (native_cpuid_ecx(1) & BIT(31)) -+ return; -+ -+ params = (struct boot_params *)__pa_nodebug(&boot_params); -+ if (!params->hdr.ramdisk_size || !params->hdr.ramdisk_image) -+ return; -+ -+ /* Save the virtual start address */ -+ ptr = (unsigned long *)__pa_nodebug(&initrd_start_early); -+ *ptr = (pte.pte & PTE_PFN_MASK) + PAGE_OFFSET; -+ *ptr += ((unsigned long)params->hdr.ramdisk_image) & ~PAGE_MASK; -+ -+ /* Save PLP2 for cleanup */ -+ ptr = (unsigned long *)__pa_nodebug(&initrd_pl2p_start); -+ *ptr = (unsigned long)pl2p + PAGE_OFFSET; -+ -+ limit = (unsigned long)params->hdr.ramdisk_image; -+ pte.pte = PTE_IDENT_ATTR | PFN_ALIGN(limit); -+ limit = (unsigned long)params->hdr.ramdisk_image + params->hdr.ramdisk_size; -+ -+ init_map(pte, &ptep, &pl2p, limit); -+ -+ ptr = (unsigned long *)__pa_nodebug(&initrd_pl2p_end); -+ *ptr = (unsigned long)pl2p + PAGE_OFFSET; -+#endif -+} diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.082-083.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.082-083.patch deleted file mode 100644 index 69d675e84b..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.082-083.patch +++ /dev/null @@ -1,6083 +0,0 @@ -diff --git a/Makefile b/Makefile -index bca0f2e14c5c2f..59060f58cfeff1 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 82 -+SUBLEVEL = 83 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -@@ -1057,6 +1057,11 @@ endif - KBUILD_USERCFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS)) - KBUILD_USERLDFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS)) - -+# userspace programs are linked via the compiler, use the correct linker -+ifeq ($(CONFIG_CC_IS_CLANG)$(CONFIG_LD_IS_LLD),yy) -+KBUILD_USERLDFLAGS += $(call cc-option, --ld-path=$(LD)) -+endif -+ - # make the checker run with the right architecture - CHECKFLAGS += --arch=$(ARCH) - -diff --git a/arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts b/arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts -index de0a1f2af983be..56f73c17363fd0 100644 ---- a/arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts -+++ b/arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts -@@ -226,6 +226,7 @@ &uart0 { - - &uart5 { - pinctrl-0 = <&uart5_xfer>; -+ rts-gpios = <&gpio0 RK_PB5 GPIO_ACTIVE_HIGH>; - status = "okay"; - }; - -diff --git a/arch/arm64/include/asm/hugetlb.h b/arch/arm64/include/asm/hugetlb.h -index 2ddc33d93b13b2..92a5e0879b1111 100644 ---- a/arch/arm64/include/asm/hugetlb.h -+++ b/arch/arm64/include/asm/hugetlb.h -@@ -34,8 +34,8 @@ extern int huge_ptep_set_access_flags(struct vm_area_struct *vma, - unsigned long addr, pte_t *ptep, - pte_t pte, int dirty); - #define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEAR --extern pte_t huge_ptep_get_and_clear(struct mm_struct *mm, -- unsigned long addr, pte_t *ptep); -+extern pte_t huge_ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, -+ pte_t *ptep, unsigned long sz); - #define __HAVE_ARCH_HUGE_PTEP_SET_WRPROTECT - extern void huge_ptep_set_wrprotect(struct mm_struct *mm, - unsigned long addr, pte_t *ptep); -diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c -index a5e1588780b2ce..06efc3a1652eb5 100644 ---- a/arch/arm64/mm/hugetlbpage.c -+++ b/arch/arm64/mm/hugetlbpage.c -@@ -121,20 +121,11 @@ static int find_num_contig(struct mm_struct *mm, unsigned long addr, - - static inline int num_contig_ptes(unsigned long size, size_t *pgsize) - { -- int contig_ptes = 0; -+ int contig_ptes = 1; - - *pgsize = size; - - switch (size) { --#ifndef __PAGETABLE_PMD_FOLDED -- case PUD_SIZE: -- if (pud_sect_supported()) -- contig_ptes = 1; -- break; --#endif -- case PMD_SIZE: -- contig_ptes = 1; -- break; - case CONT_PMD_SIZE: - *pgsize = PMD_SIZE; - contig_ptes = CONT_PMDS; -@@ -143,6 +134,8 @@ static inline int num_contig_ptes(unsigned long size, size_t *pgsize) - *pgsize = PAGE_SIZE; - contig_ptes = CONT_PTES; - break; -+ default: -+ WARN_ON(!__hugetlb_valid_size(size)); - } - - return contig_ptes; -@@ -184,24 +177,23 @@ static pte_t get_clear_contig(struct mm_struct *mm, - unsigned long pgsize, - unsigned long ncontig) - { -- pte_t orig_pte = ptep_get(ptep); -- unsigned long i; -- -- for (i = 0; i < ncontig; i++, addr += pgsize, ptep++) { -- pte_t pte = ptep_get_and_clear(mm, addr, ptep); -- -- /* -- * If HW_AFDBM is enabled, then the HW could turn on -- * the dirty or accessed bit for any page in the set, -- * so check them all. -- */ -- if (pte_dirty(pte)) -- orig_pte = pte_mkdirty(orig_pte); -- -- if (pte_young(pte)) -- orig_pte = pte_mkyoung(orig_pte); -+ pte_t pte, tmp_pte; -+ bool present; -+ -+ pte = ptep_get_and_clear(mm, addr, ptep); -+ present = pte_present(pte); -+ while (--ncontig) { -+ ptep++; -+ addr += pgsize; -+ tmp_pte = ptep_get_and_clear(mm, addr, ptep); -+ if (present) { -+ if (pte_dirty(tmp_pte)) -+ pte = pte_mkdirty(pte); -+ if (pte_young(tmp_pte)) -+ pte = pte_mkyoung(pte); -+ } - } -- return orig_pte; -+ return pte; - } - - static pte_t get_clear_contig_flush(struct mm_struct *mm, -@@ -403,18 +395,13 @@ void huge_pte_clear(struct mm_struct *mm, unsigned long addr, - pte_clear(mm, addr, ptep); - } - --pte_t huge_ptep_get_and_clear(struct mm_struct *mm, -- unsigned long addr, pte_t *ptep) -+pte_t huge_ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, -+ pte_t *ptep, unsigned long sz) - { - int ncontig; - size_t pgsize; -- pte_t orig_pte = ptep_get(ptep); -- -- if (!pte_cont(orig_pte)) -- return ptep_get_and_clear(mm, addr, ptep); -- -- ncontig = find_num_contig(mm, addr, ptep, &pgsize); - -+ ncontig = num_contig_ptes(sz, &pgsize); - return get_clear_contig(mm, addr, ptep, pgsize, ncontig); - } - -@@ -556,6 +543,8 @@ bool __init arch_hugetlb_valid_size(unsigned long size) - - pte_t huge_ptep_modify_prot_start(struct vm_area_struct *vma, unsigned long addr, pte_t *ptep) - { -+ unsigned long psize = huge_page_size(hstate_vma(vma)); -+ - if (IS_ENABLED(CONFIG_ARM64_ERRATUM_2645198) && - cpus_have_const_cap(ARM64_WORKAROUND_2645198)) { - /* -@@ -566,7 +555,7 @@ pte_t huge_ptep_modify_prot_start(struct vm_area_struct *vma, unsigned long addr - if (pte_user_exec(READ_ONCE(*ptep))) - return huge_ptep_clear_flush(vma, addr, ptep); - } -- return huge_ptep_get_and_clear(vma->vm_mm, addr, ptep); -+ return huge_ptep_get_and_clear(vma->vm_mm, addr, ptep, psize); - } - - void huge_ptep_modify_prot_commit(struct vm_area_struct *vma, unsigned long addr, pte_t *ptep, -diff --git a/arch/loongarch/include/asm/hugetlb.h b/arch/loongarch/include/asm/hugetlb.h -index 427b487fbfd658..7b88eda0ac7e84 100644 ---- a/arch/loongarch/include/asm/hugetlb.h -+++ b/arch/loongarch/include/asm/hugetlb.h -@@ -41,7 +41,8 @@ static inline void huge_pte_clear(struct mm_struct *mm, unsigned long addr, - - #define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEAR - static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm, -- unsigned long addr, pte_t *ptep) -+ unsigned long addr, pte_t *ptep, -+ unsigned long sz) - { - pte_t clear; - pte_t pte = *ptep; -@@ -56,8 +57,9 @@ static inline pte_t huge_ptep_clear_flush(struct vm_area_struct *vma, - unsigned long addr, pte_t *ptep) - { - pte_t pte; -+ unsigned long sz = huge_page_size(hstate_vma(vma)); - -- pte = huge_ptep_get_and_clear(vma->vm_mm, addr, ptep); -+ pte = huge_ptep_get_and_clear(vma->vm_mm, addr, ptep, sz); - flush_tlb_page(vma, addr); - return pte; - } -diff --git a/arch/loongarch/kernel/machine_kexec.c b/arch/loongarch/kernel/machine_kexec.c -index 2dcb9e003657c8..30aa420610a06a 100644 ---- a/arch/loongarch/kernel/machine_kexec.c -+++ b/arch/loongarch/kernel/machine_kexec.c -@@ -126,14 +126,14 @@ void kexec_reboot(void) - /* All secondary cpus go to kexec_smp_wait */ - if (smp_processor_id() > 0) { - relocated_kexec_smp_wait(NULL); -- unreachable(); -+ BUG(); - } - #endif - - do_kexec = (void *)reboot_code_buffer; - do_kexec(efi_boot, cmdline_ptr, systable_ptr, start_addr, first_ind_entry); - -- unreachable(); -+ BUG(); - } - - -diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c -index 7ef1c1ff1fc44c..655dc2b1616f2c 100644 ---- a/arch/loongarch/kernel/setup.c -+++ b/arch/loongarch/kernel/setup.c -@@ -400,6 +400,9 @@ static void __init check_kernel_sections_mem(void) - */ - static void __init arch_mem_init(char **cmdline_p) - { -+ /* Recalculate max_low_pfn for "mem=xxx" */ -+ max_pfn = max_low_pfn = PHYS_PFN(memblock_end_of_DRAM()); -+ - if (usermem) - pr_info("User-defined physical RAM map overwrite\n"); - -diff --git a/arch/loongarch/kernel/smp.c b/arch/loongarch/kernel/smp.c -index 9dbe7907a96124..ed67629454374f 100644 ---- a/arch/loongarch/kernel/smp.c -+++ b/arch/loongarch/kernel/smp.c -@@ -18,6 +18,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -388,7 +389,7 @@ void loongson_cpu_die(unsigned int cpu) - mb(); - } - --void __noreturn arch_cpu_idle_dead(void) -+static void __noreturn idle_play_dead(void) - { - register uint64_t addr; - register void (*init_fn)(void); -@@ -412,6 +413,50 @@ void __noreturn arch_cpu_idle_dead(void) - BUG(); - } - -+#ifdef CONFIG_HIBERNATION -+static void __noreturn poll_play_dead(void) -+{ -+ register uint64_t addr; -+ register void (*init_fn)(void); -+ -+ idle_task_exit(); -+ __this_cpu_write(cpu_state, CPU_DEAD); -+ -+ __smp_mb(); -+ do { -+ __asm__ __volatile__("nop\n\t"); -+ addr = iocsr_read64(LOONGARCH_IOCSR_MBUF0); -+ } while (addr == 0); -+ -+ init_fn = (void *)TO_CACHE(addr); -+ iocsr_write32(0xffffffff, LOONGARCH_IOCSR_IPI_CLEAR); -+ -+ init_fn(); -+ BUG(); -+} -+#endif -+ -+static void (*play_dead)(void) = idle_play_dead; -+ -+void __noreturn arch_cpu_idle_dead(void) -+{ -+ play_dead(); -+ BUG(); /* play_dead() doesn't return */ -+} -+ -+#ifdef CONFIG_HIBERNATION -+int hibernate_resume_nonboot_cpu_disable(void) -+{ -+ int ret; -+ -+ play_dead = poll_play_dead; -+ ret = suspend_disable_secondary_cpus(); -+ play_dead = idle_play_dead; -+ -+ return ret; -+} -+#endif -+ - #endif - - /* -diff --git a/arch/mips/include/asm/hugetlb.h b/arch/mips/include/asm/hugetlb.h -index fd69c88085542e..00ee3c0366305c 100644 ---- a/arch/mips/include/asm/hugetlb.h -+++ b/arch/mips/include/asm/hugetlb.h -@@ -32,7 +32,8 @@ static inline int prepare_hugepage_range(struct file *file, - - #define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEAR - static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm, -- unsigned long addr, pte_t *ptep) -+ unsigned long addr, pte_t *ptep, -+ unsigned long sz) - { - pte_t clear; - pte_t pte = *ptep; -@@ -47,13 +48,14 @@ static inline pte_t huge_ptep_clear_flush(struct vm_area_struct *vma, - unsigned long addr, pte_t *ptep) - { - pte_t pte; -+ unsigned long sz = huge_page_size(hstate_vma(vma)); - - /* - * clear the huge pte entry firstly, so that the other smp threads will - * not get old pte entry after finishing flush_tlb_page and before - * setting new huge pte entry - */ -- pte = huge_ptep_get_and_clear(vma->vm_mm, addr, ptep); -+ pte = huge_ptep_get_and_clear(vma->vm_mm, addr, ptep, sz); - flush_tlb_page(vma, addr); - return pte; - } -diff --git a/arch/parisc/include/asm/hugetlb.h b/arch/parisc/include/asm/hugetlb.h -index 72daacc472a0a3..f7a91411dcc955 100644 ---- a/arch/parisc/include/asm/hugetlb.h -+++ b/arch/parisc/include/asm/hugetlb.h -@@ -10,7 +10,7 @@ void set_huge_pte_at(struct mm_struct *mm, unsigned long addr, - - #define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEAR - pte_t huge_ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, -- pte_t *ptep); -+ pte_t *ptep, unsigned long sz); - - /* - * If the arch doesn't supply something else, assume that hugepage -diff --git a/arch/parisc/mm/hugetlbpage.c b/arch/parisc/mm/hugetlbpage.c -index a9f7e21f66567a..9e8da00e55f611 100644 ---- a/arch/parisc/mm/hugetlbpage.c -+++ b/arch/parisc/mm/hugetlbpage.c -@@ -147,7 +147,7 @@ void set_huge_pte_at(struct mm_struct *mm, unsigned long addr, - - - pte_t huge_ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, -- pte_t *ptep) -+ pte_t *ptep, unsigned long sz) - { - pte_t entry; - -diff --git a/arch/powerpc/include/asm/hugetlb.h b/arch/powerpc/include/asm/hugetlb.h -index 8d8f4909ae1a4a..167c66c4e9ea74 100644 ---- a/arch/powerpc/include/asm/hugetlb.h -+++ b/arch/powerpc/include/asm/hugetlb.h -@@ -46,7 +46,8 @@ void hugetlb_free_pgd_range(struct mmu_gather *tlb, unsigned long addr, - - #define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEAR - static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm, -- unsigned long addr, pte_t *ptep) -+ unsigned long addr, pte_t *ptep, -+ unsigned long sz) - { - return __pte(pte_update(mm, addr, ptep, ~0UL, 0, 1)); - } -@@ -56,8 +57,9 @@ static inline pte_t huge_ptep_clear_flush(struct vm_area_struct *vma, - unsigned long addr, pte_t *ptep) - { - pte_t pte; -+ unsigned long sz = huge_page_size(hstate_vma(vma)); - -- pte = huge_ptep_get_and_clear(vma->vm_mm, addr, ptep); -+ pte = huge_ptep_get_and_clear(vma->vm_mm, addr, ptep, sz); - flush_hugetlb_page(vma, addr); - return pte; - } -diff --git a/arch/powerpc/kvm/e500_mmu_host.c b/arch/powerpc/kvm/e500_mmu_host.c -index bd413dafbaf969..ccb8f16ffe412f 100644 ---- a/arch/powerpc/kvm/e500_mmu_host.c -+++ b/arch/powerpc/kvm/e500_mmu_host.c -@@ -242,7 +242,7 @@ static inline int tlbe_is_writable(struct kvm_book3e_206_tlb_entry *tlbe) - return tlbe->mas7_3 & (MAS3_SW|MAS3_UW); - } - --static inline bool kvmppc_e500_ref_setup(struct tlbe_ref *ref, -+static inline void kvmppc_e500_ref_setup(struct tlbe_ref *ref, - struct kvm_book3e_206_tlb_entry *gtlbe, - kvm_pfn_t pfn, unsigned int wimg) - { -@@ -252,7 +252,11 @@ static inline bool kvmppc_e500_ref_setup(struct tlbe_ref *ref, - /* Use guest supplied MAS2_G and MAS2_E */ - ref->flags |= (gtlbe->mas2 & MAS2_ATTRIB_MASK) | wimg; - -- return tlbe_is_writable(gtlbe); -+ /* Mark the page accessed */ -+ kvm_set_pfn_accessed(pfn); -+ -+ if (tlbe_is_writable(gtlbe)) -+ kvm_set_pfn_dirty(pfn); - } - - static inline void kvmppc_e500_ref_release(struct tlbe_ref *ref) -@@ -322,7 +326,6 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500, - { - struct kvm_memory_slot *slot; - unsigned long pfn = 0; /* silence GCC warning */ -- struct page *page = NULL; - unsigned long hva; - int pfnmap = 0; - int tsize = BOOK3E_PAGESZ_4K; -@@ -334,7 +337,6 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500, - unsigned int wimg = 0; - pgd_t *pgdir; - unsigned long flags; -- bool writable = false; - - /* used to check for invalidations in progress */ - mmu_seq = kvm->mmu_invalidate_seq; -@@ -444,7 +446,7 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500, - - if (likely(!pfnmap)) { - tsize_pages = 1UL << (tsize + 10 - PAGE_SHIFT); -- pfn = __kvm_faultin_pfn(slot, gfn, FOLL_WRITE, NULL, &page); -+ pfn = gfn_to_pfn_memslot(slot, gfn); - if (is_error_noslot_pfn(pfn)) { - if (printk_ratelimit()) - pr_err("%s: real page not found for gfn %lx\n", -@@ -479,6 +481,7 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500, - if (pte_present(pte)) { - wimg = (pte_val(pte) >> PTE_WIMGE_SHIFT) & - MAS2_WIMGE_MASK; -+ local_irq_restore(flags); - } else { - local_irq_restore(flags); - pr_err_ratelimited("%s: pte not present: gfn %lx,pfn %lx\n", -@@ -487,9 +490,8 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500, - goto out; - } - } -- local_irq_restore(flags); -+ kvmppc_e500_ref_setup(ref, gtlbe, pfn, wimg); - -- writable = kvmppc_e500_ref_setup(ref, gtlbe, pfn, wimg); - kvmppc_e500_setup_stlbe(&vcpu_e500->vcpu, gtlbe, tsize, - ref, gvaddr, stlbe); - -@@ -497,8 +499,11 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500, - kvmppc_mmu_flush_icache(pfn); - - out: -- kvm_release_faultin_page(kvm, page, !!ret, writable); - spin_unlock(&kvm->mmu_lock); -+ -+ /* Drop refcount on page, so that mmu notifiers can clear it */ -+ kvm_release_pfn_clean(pfn); -+ - return ret; - } - -diff --git a/arch/riscv/include/asm/cpufeature.h b/arch/riscv/include/asm/cpufeature.h -index d0345bd659c94f..13b7d35648a9c5 100644 ---- a/arch/riscv/include/asm/cpufeature.h -+++ b/arch/riscv/include/asm/cpufeature.h -@@ -31,5 +31,6 @@ DECLARE_PER_CPU(long, misaligned_access_speed); - extern struct riscv_isainfo hart_isa[NR_CPUS]; - - void check_unaligned_access(int cpu); -+void riscv_user_isa_enable(void); - - #endif -diff --git a/arch/riscv/include/asm/csr.h b/arch/riscv/include/asm/csr.h -index 777cb8299551ca..4b61a033fd33df 100644 ---- a/arch/riscv/include/asm/csr.h -+++ b/arch/riscv/include/asm/csr.h -@@ -275,6 +275,7 @@ - #define CSR_SIE 0x104 - #define CSR_STVEC 0x105 - #define CSR_SCOUNTEREN 0x106 -+#define CSR_SENVCFG 0x10a - #define CSR_SSCRATCH 0x140 - #define CSR_SEPC 0x141 - #define CSR_SCAUSE 0x142 -@@ -397,6 +398,7 @@ - # define CSR_STATUS CSR_MSTATUS - # define CSR_IE CSR_MIE - # define CSR_TVEC CSR_MTVEC -+# define CSR_ENVCFG CSR_MENVCFG - # define CSR_SCRATCH CSR_MSCRATCH - # define CSR_EPC CSR_MEPC - # define CSR_CAUSE CSR_MCAUSE -@@ -421,6 +423,7 @@ - # define CSR_STATUS CSR_SSTATUS - # define CSR_IE CSR_SIE - # define CSR_TVEC CSR_STVEC -+# define CSR_ENVCFG CSR_SENVCFG - # define CSR_SCRATCH CSR_SSCRATCH - # define CSR_EPC CSR_SEPC - # define CSR_CAUSE CSR_SCAUSE -diff --git a/arch/riscv/include/asm/hugetlb.h b/arch/riscv/include/asm/hugetlb.h -index 22deb7a2a6ec4e..0e809026b6e39c 100644 ---- a/arch/riscv/include/asm/hugetlb.h -+++ b/arch/riscv/include/asm/hugetlb.h -@@ -28,7 +28,8 @@ void set_huge_pte_at(struct mm_struct *mm, - - #define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEAR - pte_t huge_ptep_get_and_clear(struct mm_struct *mm, -- unsigned long addr, pte_t *ptep); -+ unsigned long addr, pte_t *ptep, -+ unsigned long sz); - - #define __HAVE_ARCH_HUGE_PTEP_CLEAR_FLUSH - pte_t huge_ptep_clear_flush(struct vm_area_struct *vma, -diff --git a/arch/riscv/include/asm/hwcap.h b/arch/riscv/include/asm/hwcap.h -index f4157034efa9cb..e215d3399a1791 100644 ---- a/arch/riscv/include/asm/hwcap.h -+++ b/arch/riscv/include/asm/hwcap.h -@@ -70,6 +70,7 @@ - #ifndef __ASSEMBLY__ - - #include -+#include - - unsigned long riscv_get_elf_hwcap(void); - -@@ -137,6 +138,21 @@ riscv_has_extension_unlikely(const unsigned long ext) - return true; - } - -+static __always_inline bool riscv_cpu_has_extension_likely(int cpu, const unsigned long ext) -+{ -+ if (IS_ENABLED(CONFIG_RISCV_ALTERNATIVE) && riscv_has_extension_likely(ext)) -+ return true; -+ -+ return __riscv_isa_extension_available(hart_isa[cpu].isa, ext); -+} -+ -+static __always_inline bool riscv_cpu_has_extension_unlikely(int cpu, const unsigned long ext) -+{ -+ if (IS_ENABLED(CONFIG_RISCV_ALTERNATIVE) && riscv_has_extension_unlikely(ext)) -+ return true; -+ -+ return __riscv_isa_extension_available(hart_isa[cpu].isa, ext); -+} - #endif - - #endif /* _ASM_RISCV_HWCAP_H */ -diff --git a/arch/riscv/kernel/cacheinfo.c b/arch/riscv/kernel/cacheinfo.c -index 09e9b88110d151..9fb97c9f9b0bee 100644 ---- a/arch/riscv/kernel/cacheinfo.c -+++ b/arch/riscv/kernel/cacheinfo.c -@@ -3,6 +3,7 @@ - * Copyright (C) 2017 SiFive - */ - -+#include - #include - #include - #include -@@ -64,7 +65,6 @@ uintptr_t get_cache_geometry(u32 level, enum cache_type type) - } - - static void ci_leaf_init(struct cacheinfo *this_leaf, -- struct device_node *node, - enum cache_type type, unsigned int level) - { - this_leaf->level = level; -@@ -75,16 +75,40 @@ int populate_cache_leaves(unsigned int cpu) - { - struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); - struct cacheinfo *this_leaf = this_cpu_ci->info_list; -- struct device_node *np = of_cpu_device_node_get(cpu); -- struct device_node *prev = NULL; -+ struct device_node *np, *prev; - int levels = 1, level = 1; - -- if (of_property_read_bool(np, "cache-size")) -- ci_leaf_init(this_leaf++, np, CACHE_TYPE_UNIFIED, level); -- if (of_property_read_bool(np, "i-cache-size")) -- ci_leaf_init(this_leaf++, np, CACHE_TYPE_INST, level); -- if (of_property_read_bool(np, "d-cache-size")) -- ci_leaf_init(this_leaf++, np, CACHE_TYPE_DATA, level); -+ if (!acpi_disabled) { -+ int ret, fw_levels, split_levels; -+ -+ ret = acpi_get_cache_info(cpu, &fw_levels, &split_levels); -+ if (ret) -+ return ret; -+ -+ BUG_ON((split_levels > fw_levels) || -+ (split_levels + fw_levels > this_cpu_ci->num_leaves)); -+ -+ for (; level <= this_cpu_ci->num_levels; level++) { -+ if (level <= split_levels) { -+ ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level); -+ ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level); -+ } else { -+ ci_leaf_init(this_leaf++, CACHE_TYPE_UNIFIED, level); -+ } -+ } -+ return 0; -+ } -+ -+ np = of_cpu_device_node_get(cpu); -+ if (!np) -+ return -ENOENT; -+ -+ if (of_property_present(np, "cache-size")) -+ ci_leaf_init(this_leaf++, CACHE_TYPE_UNIFIED, level); -+ if (of_property_present(np, "i-cache-size")) -+ ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level); -+ if (of_property_present(np, "d-cache-size")) -+ ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level); - - prev = np; - while ((np = of_find_next_cache_node(np))) { -@@ -96,12 +120,12 @@ int populate_cache_leaves(unsigned int cpu) - break; - if (level <= levels) - break; -- if (of_property_read_bool(np, "cache-size")) -- ci_leaf_init(this_leaf++, np, CACHE_TYPE_UNIFIED, level); -- if (of_property_read_bool(np, "i-cache-size")) -- ci_leaf_init(this_leaf++, np, CACHE_TYPE_INST, level); -- if (of_property_read_bool(np, "d-cache-size")) -- ci_leaf_init(this_leaf++, np, CACHE_TYPE_DATA, level); -+ if (of_property_present(np, "cache-size")) -+ ci_leaf_init(this_leaf++, CACHE_TYPE_UNIFIED, level); -+ if (of_property_present(np, "i-cache-size")) -+ ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level); -+ if (of_property_present(np, "d-cache-size")) -+ ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level); - levels = level; - } - of_node_put(np); -diff --git a/arch/riscv/kernel/cpufeature.c b/arch/riscv/kernel/cpufeature.c -index bb5fb2b820a21e..3f0ad09e16500a 100644 ---- a/arch/riscv/kernel/cpufeature.c -+++ b/arch/riscv/kernel/cpufeature.c -@@ -676,6 +676,12 @@ static int check_unaligned_access_boot_cpu(void) - - arch_initcall(check_unaligned_access_boot_cpu); - -+void riscv_user_isa_enable(void) -+{ -+ if (riscv_cpu_has_extension_unlikely(smp_processor_id(), RISCV_ISA_EXT_ZICBOZ)) -+ csr_set(CSR_ENVCFG, ENVCFG_CBZE); -+} -+ - #ifdef CONFIG_RISCV_ALTERNATIVE - /* - * Alternative patch sites consider 48 bits when determining when to patch -diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c -index ff802d100a5715..175184b0592649 100644 ---- a/arch/riscv/kernel/setup.c -+++ b/arch/riscv/kernel/setup.c -@@ -26,6 +26,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -305,12 +306,15 @@ void __init setup_arch(char **cmdline_p) - - riscv_init_cbo_blocksizes(); - riscv_fill_hwcap(); -- init_rt_signal_env(); - apply_boot_alternatives(); -+ init_rt_signal_env(); -+ - if (IS_ENABLED(CONFIG_RISCV_ISA_ZICBOM) && - riscv_isa_extension_available(NULL, ZICBOM)) - riscv_noncoherent_supported(); - riscv_set_dma_cache_alignment(); -+ -+ riscv_user_isa_enable(); - } - - static int __init topology_init(void) -diff --git a/arch/riscv/kernel/smpboot.c b/arch/riscv/kernel/smpboot.c -index 1b8da4e40a4d6e..d1b0a6fc3adfc7 100644 ---- a/arch/riscv/kernel/smpboot.c -+++ b/arch/riscv/kernel/smpboot.c -@@ -25,6 +25,8 @@ - #include - #include - #include -+ -+#include - #include - #include - #include -@@ -253,6 +255,8 @@ asmlinkage __visible void smp_callin(void) - elf_hwcap &= ~COMPAT_HWCAP_ISA_V; - } - -+ riscv_user_isa_enable(); -+ - /* - * Remote TLB flushes are ignored while the CPU is offline, so emit - * a local TLB flush right now just in case. -diff --git a/arch/riscv/mm/hugetlbpage.c b/arch/riscv/mm/hugetlbpage.c -index 5ef2a6891158a6..c9d70dc310d59f 100644 ---- a/arch/riscv/mm/hugetlbpage.c -+++ b/arch/riscv/mm/hugetlbpage.c -@@ -293,7 +293,7 @@ int huge_ptep_set_access_flags(struct vm_area_struct *vma, - - pte_t huge_ptep_get_and_clear(struct mm_struct *mm, - unsigned long addr, -- pte_t *ptep) -+ pte_t *ptep, unsigned long sz) - { - pte_t orig_pte = ptep_get(ptep); - int pte_num; -diff --git a/arch/s390/include/asm/hugetlb.h b/arch/s390/include/asm/hugetlb.h -index deb198a610395b..097b388d4e6901 100644 ---- a/arch/s390/include/asm/hugetlb.h -+++ b/arch/s390/include/asm/hugetlb.h -@@ -20,8 +20,15 @@ void set_huge_pte_at(struct mm_struct *mm, unsigned long addr, - void __set_huge_pte_at(struct mm_struct *mm, unsigned long addr, - pte_t *ptep, pte_t pte); - pte_t huge_ptep_get(pte_t *ptep); --pte_t huge_ptep_get_and_clear(struct mm_struct *mm, -- unsigned long addr, pte_t *ptep); -+pte_t __huge_ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, -+ pte_t *ptep); -+ -+static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm, -+ unsigned long addr, pte_t *ptep, -+ unsigned long sz) -+{ -+ return __huge_ptep_get_and_clear(mm, addr, ptep); -+} - - /* - * If the arch doesn't supply something else, assume that hugepage -@@ -57,7 +64,7 @@ static inline void huge_pte_clear(struct mm_struct *mm, unsigned long addr, - static inline pte_t huge_ptep_clear_flush(struct vm_area_struct *vma, - unsigned long address, pte_t *ptep) - { -- return huge_ptep_get_and_clear(vma->vm_mm, address, ptep); -+ return __huge_ptep_get_and_clear(vma->vm_mm, address, ptep); - } - - static inline int huge_ptep_set_access_flags(struct vm_area_struct *vma, -@@ -66,7 +73,7 @@ static inline int huge_ptep_set_access_flags(struct vm_area_struct *vma, - { - int changed = !pte_same(huge_ptep_get(ptep), pte); - if (changed) { -- huge_ptep_get_and_clear(vma->vm_mm, addr, ptep); -+ __huge_ptep_get_and_clear(vma->vm_mm, addr, ptep); - __set_huge_pte_at(vma->vm_mm, addr, ptep, pte); - } - return changed; -@@ -75,7 +82,7 @@ static inline int huge_ptep_set_access_flags(struct vm_area_struct *vma, - static inline void huge_ptep_set_wrprotect(struct mm_struct *mm, - unsigned long addr, pte_t *ptep) - { -- pte_t pte = huge_ptep_get_and_clear(mm, addr, ptep); -+ pte_t pte = __huge_ptep_get_and_clear(mm, addr, ptep); - __set_huge_pte_at(mm, addr, ptep, pte_wrprotect(pte)); - } - -diff --git a/arch/s390/kernel/traps.c b/arch/s390/kernel/traps.c -index 1d2aa448d1031c..bfedbd7fae3bc1 100644 ---- a/arch/s390/kernel/traps.c -+++ b/arch/s390/kernel/traps.c -@@ -276,10 +276,10 @@ static void __init test_monitor_call(void) - return; - asm volatile( - " mc 0,0\n" -- "0: xgr %0,%0\n" -+ "0: lhi %[val],0\n" - "1:\n" -- EX_TABLE(0b,1b) -- : "+d" (val)); -+ EX_TABLE(0b, 1b) -+ : [val] "+d" (val)); - if (!val) - panic("Monitor call doesn't work!\n"); - } -diff --git a/arch/s390/mm/hugetlbpage.c b/arch/s390/mm/hugetlbpage.c -index 763469e518eec8..5ebd730f1ffbbc 100644 ---- a/arch/s390/mm/hugetlbpage.c -+++ b/arch/s390/mm/hugetlbpage.c -@@ -174,8 +174,8 @@ pte_t huge_ptep_get(pte_t *ptep) - return __rste_to_pte(pte_val(*ptep)); - } - --pte_t huge_ptep_get_and_clear(struct mm_struct *mm, -- unsigned long addr, pte_t *ptep) -+pte_t __huge_ptep_get_and_clear(struct mm_struct *mm, -+ unsigned long addr, pte_t *ptep) - { - pte_t pte = huge_ptep_get(ptep); - pmd_t *pmdp = (pmd_t *) ptep; -diff --git a/arch/sparc/include/asm/hugetlb.h b/arch/sparc/include/asm/hugetlb.h -index c714ca6a05aa04..e7a9cdd498dca6 100644 ---- a/arch/sparc/include/asm/hugetlb.h -+++ b/arch/sparc/include/asm/hugetlb.h -@@ -20,7 +20,7 @@ void __set_huge_pte_at(struct mm_struct *mm, unsigned long addr, - - #define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEAR - pte_t huge_ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, -- pte_t *ptep); -+ pte_t *ptep, unsigned long sz); - - #define __HAVE_ARCH_HUGE_PTEP_CLEAR_FLUSH - static inline pte_t huge_ptep_clear_flush(struct vm_area_struct *vma, -diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c -index b432500c13a5d8..8dad5d0995dcce 100644 ---- a/arch/sparc/mm/hugetlbpage.c -+++ b/arch/sparc/mm/hugetlbpage.c -@@ -371,7 +371,7 @@ void set_huge_pte_at(struct mm_struct *mm, unsigned long addr, - } - - pte_t huge_ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, -- pte_t *ptep) -+ pte_t *ptep, unsigned long sz) - { - unsigned int i, nptes, orig_shift, shift; - unsigned long size; -diff --git a/arch/x86/boot/compressed/acpi.c b/arch/x86/boot/compressed/acpi.c -index 9caf89063e775e..55c98fdd67d2b7 100644 ---- a/arch/x86/boot/compressed/acpi.c -+++ b/arch/x86/boot/compressed/acpi.c -@@ -30,13 +30,13 @@ __efi_get_rsdp_addr(unsigned long cfg_tbl_pa, unsigned int cfg_tbl_len) - * Search EFI system tables for RSDP. Preferred is ACPI_20_TABLE_GUID to - * ACPI_TABLE_GUID because it has more features. - */ -- rsdp_addr = efi_find_vendor_table(boot_params, cfg_tbl_pa, cfg_tbl_len, -+ rsdp_addr = efi_find_vendor_table(boot_params_ptr, cfg_tbl_pa, cfg_tbl_len, - ACPI_20_TABLE_GUID); - if (rsdp_addr) - return (acpi_physical_address)rsdp_addr; - - /* No ACPI_20_TABLE_GUID found, fallback to ACPI_TABLE_GUID. */ -- rsdp_addr = efi_find_vendor_table(boot_params, cfg_tbl_pa, cfg_tbl_len, -+ rsdp_addr = efi_find_vendor_table(boot_params_ptr, cfg_tbl_pa, cfg_tbl_len, - ACPI_TABLE_GUID); - if (rsdp_addr) - return (acpi_physical_address)rsdp_addr; -@@ -56,15 +56,15 @@ static acpi_physical_address efi_get_rsdp_addr(void) - enum efi_type et; - int ret; - -- et = efi_get_type(boot_params); -+ et = efi_get_type(boot_params_ptr); - if (et == EFI_TYPE_NONE) - return 0; - -- systab_pa = efi_get_system_table(boot_params); -+ systab_pa = efi_get_system_table(boot_params_ptr); - if (!systab_pa) - error("EFI support advertised, but unable to locate system table."); - -- ret = efi_get_conf_table(boot_params, &cfg_tbl_pa, &cfg_tbl_len); -+ ret = efi_get_conf_table(boot_params_ptr, &cfg_tbl_pa, &cfg_tbl_len); - if (ret || !cfg_tbl_pa) - error("EFI config table not found."); - -@@ -156,7 +156,7 @@ acpi_physical_address get_rsdp_addr(void) - { - acpi_physical_address pa; - -- pa = boot_params->acpi_rsdp_addr; -+ pa = boot_params_ptr->acpi_rsdp_addr; - - if (!pa) - pa = efi_get_rsdp_addr(); -@@ -210,7 +210,7 @@ static unsigned long get_acpi_srat_table(void) - rsdp = (struct acpi_table_rsdp *)get_cmdline_acpi_rsdp(); - if (!rsdp) - rsdp = (struct acpi_table_rsdp *)(long) -- boot_params->acpi_rsdp_addr; -+ boot_params_ptr->acpi_rsdp_addr; - - if (!rsdp) - return 0; -diff --git a/arch/x86/boot/compressed/cmdline.c b/arch/x86/boot/compressed/cmdline.c -index f1add5d85da9d9..c1bb180973ea2a 100644 ---- a/arch/x86/boot/compressed/cmdline.c -+++ b/arch/x86/boot/compressed/cmdline.c -@@ -14,9 +14,9 @@ static inline char rdfs8(addr_t addr) - #include "../cmdline.c" - unsigned long get_cmd_line_ptr(void) - { -- unsigned long cmd_line_ptr = boot_params->hdr.cmd_line_ptr; -+ unsigned long cmd_line_ptr = boot_params_ptr->hdr.cmd_line_ptr; - -- cmd_line_ptr |= (u64)boot_params->ext_cmd_line_ptr << 32; -+ cmd_line_ptr |= (u64)boot_params_ptr->ext_cmd_line_ptr << 32; - - return cmd_line_ptr; - } -diff --git a/arch/x86/boot/compressed/ident_map_64.c b/arch/x86/boot/compressed/ident_map_64.c -index aead80ec70a0bf..d040080d7edbd6 100644 ---- a/arch/x86/boot/compressed/ident_map_64.c -+++ b/arch/x86/boot/compressed/ident_map_64.c -@@ -159,8 +159,9 @@ void initialize_identity_maps(void *rmode) - * or does not touch all the pages covering them. - */ - kernel_add_identity_map((unsigned long)_head, (unsigned long)_end); -- boot_params = rmode; -- kernel_add_identity_map((unsigned long)boot_params, (unsigned long)(boot_params + 1)); -+ boot_params_ptr = rmode; -+ kernel_add_identity_map((unsigned long)boot_params_ptr, -+ (unsigned long)(boot_params_ptr + 1)); - cmdline = get_cmd_line_ptr(); - kernel_add_identity_map(cmdline, cmdline + COMMAND_LINE_SIZE); - -@@ -168,7 +169,7 @@ void initialize_identity_maps(void *rmode) - * Also map the setup_data entries passed via boot_params in case they - * need to be accessed by uncompressed kernel via the identity mapping. - */ -- sd = (struct setup_data *)boot_params->hdr.setup_data; -+ sd = (struct setup_data *)boot_params_ptr->hdr.setup_data; - while (sd) { - unsigned long sd_addr = (unsigned long)sd; - -diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c -index 9193acf0e9cdec..dec961c6d16a7c 100644 ---- a/arch/x86/boot/compressed/kaslr.c -+++ b/arch/x86/boot/compressed/kaslr.c -@@ -63,7 +63,7 @@ static unsigned long get_boot_seed(void) - unsigned long hash = 0; - - hash = rotate_xor(hash, build_str, sizeof(build_str)); -- hash = rotate_xor(hash, boot_params, sizeof(*boot_params)); -+ hash = rotate_xor(hash, boot_params_ptr, sizeof(*boot_params_ptr)); - - return hash; - } -@@ -383,7 +383,7 @@ static void handle_mem_options(void) - static void mem_avoid_init(unsigned long input, unsigned long input_size, - unsigned long output) - { -- unsigned long init_size = boot_params->hdr.init_size; -+ unsigned long init_size = boot_params_ptr->hdr.init_size; - u64 initrd_start, initrd_size; - unsigned long cmd_line, cmd_line_size; - -@@ -395,10 +395,10 @@ static void mem_avoid_init(unsigned long input, unsigned long input_size, - mem_avoid[MEM_AVOID_ZO_RANGE].size = (output + init_size) - input; - - /* Avoid initrd. */ -- initrd_start = (u64)boot_params->ext_ramdisk_image << 32; -- initrd_start |= boot_params->hdr.ramdisk_image; -- initrd_size = (u64)boot_params->ext_ramdisk_size << 32; -- initrd_size |= boot_params->hdr.ramdisk_size; -+ initrd_start = (u64)boot_params_ptr->ext_ramdisk_image << 32; -+ initrd_start |= boot_params_ptr->hdr.ramdisk_image; -+ initrd_size = (u64)boot_params_ptr->ext_ramdisk_size << 32; -+ initrd_size |= boot_params_ptr->hdr.ramdisk_size; - mem_avoid[MEM_AVOID_INITRD].start = initrd_start; - mem_avoid[MEM_AVOID_INITRD].size = initrd_size; - /* No need to set mapping for initrd, it will be handled in VO. */ -@@ -413,8 +413,8 @@ static void mem_avoid_init(unsigned long input, unsigned long input_size, - } - - /* Avoid boot parameters. */ -- mem_avoid[MEM_AVOID_BOOTPARAMS].start = (unsigned long)boot_params; -- mem_avoid[MEM_AVOID_BOOTPARAMS].size = sizeof(*boot_params); -+ mem_avoid[MEM_AVOID_BOOTPARAMS].start = (unsigned long)boot_params_ptr; -+ mem_avoid[MEM_AVOID_BOOTPARAMS].size = sizeof(*boot_params_ptr); - - /* We don't need to set a mapping for setup_data. */ - -@@ -447,7 +447,7 @@ static bool mem_avoid_overlap(struct mem_vector *img, - } - - /* Avoid all entries in the setup_data linked list. */ -- ptr = (struct setup_data *)(unsigned long)boot_params->hdr.setup_data; -+ ptr = (struct setup_data *)(unsigned long)boot_params_ptr->hdr.setup_data; - while (ptr) { - struct mem_vector avoid; - -@@ -706,7 +706,7 @@ static inline bool memory_type_is_free(efi_memory_desc_t *md) - static bool - process_efi_entries(unsigned long minimum, unsigned long image_size) - { -- struct efi_info *e = &boot_params->efi_info; -+ struct efi_info *e = &boot_params_ptr->efi_info; - bool efi_mirror_found = false; - struct mem_vector region; - efi_memory_desc_t *md; -@@ -777,8 +777,8 @@ static void process_e820_entries(unsigned long minimum, - struct boot_e820_entry *entry; - - /* Verify potential e820 positions, appending to slots list. */ -- for (i = 0; i < boot_params->e820_entries; i++) { -- entry = &boot_params->e820_table[i]; -+ for (i = 0; i < boot_params_ptr->e820_entries; i++) { -+ entry = &boot_params_ptr->e820_table[i]; - /* Skip non-RAM entries. */ - if (entry->type != E820_TYPE_RAM) - continue; -@@ -852,7 +852,7 @@ void choose_random_location(unsigned long input, - return; - } - -- boot_params->hdr.loadflags |= KASLR_FLAG; -+ boot_params_ptr->hdr.loadflags |= KASLR_FLAG; - - if (IS_ENABLED(CONFIG_X86_32)) - mem_limit = KERNEL_IMAGE_SIZE; -diff --git a/arch/x86/boot/compressed/mem.c b/arch/x86/boot/compressed/mem.c -index 3c1609245f2add..b3c3a4be7471f1 100644 ---- a/arch/x86/boot/compressed/mem.c -+++ b/arch/x86/boot/compressed/mem.c -@@ -54,17 +54,17 @@ bool init_unaccepted_memory(void) - enum efi_type et; - int ret; - -- et = efi_get_type(boot_params); -+ et = efi_get_type(boot_params_ptr); - if (et == EFI_TYPE_NONE) - return false; - -- ret = efi_get_conf_table(boot_params, &cfg_table_pa, &cfg_table_len); -+ ret = efi_get_conf_table(boot_params_ptr, &cfg_table_pa, &cfg_table_len); - if (ret) { - warn("EFI config table not found."); - return false; - } - -- table = (void *)efi_find_vendor_table(boot_params, cfg_table_pa, -+ table = (void *)efi_find_vendor_table(boot_params_ptr, cfg_table_pa, - cfg_table_len, guid); - if (!table) - return false; -diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c -index b5ecbd32a46fac..ee0fac468e7f76 100644 ---- a/arch/x86/boot/compressed/misc.c -+++ b/arch/x86/boot/compressed/misc.c -@@ -46,7 +46,7 @@ void *memmove(void *dest, const void *src, size_t n); - /* - * This is set up by the setup-routine at boot-time - */ --struct boot_params *boot_params; -+struct boot_params *boot_params_ptr; - - struct port_io_ops pio_ops; - -@@ -132,8 +132,8 @@ void __putstr(const char *s) - if (lines == 0 || cols == 0) - return; - -- x = boot_params->screen_info.orig_x; -- y = boot_params->screen_info.orig_y; -+ x = boot_params_ptr->screen_info.orig_x; -+ y = boot_params_ptr->screen_info.orig_y; - - while ((c = *s++) != '\0') { - if (c == '\n') { -@@ -154,8 +154,8 @@ void __putstr(const char *s) - } - } - -- boot_params->screen_info.orig_x = x; -- boot_params->screen_info.orig_y = y; -+ boot_params_ptr->screen_info.orig_x = x; -+ boot_params_ptr->screen_info.orig_y = y; - - pos = (x + cols * y) * 2; /* Update cursor position */ - outb(14, vidport); -@@ -396,16 +396,16 @@ asmlinkage __visible void *extract_kernel(void *rmode, unsigned char *output) - size_t entry_offset; - - /* Retain x86 boot parameters pointer passed from startup_32/64. */ -- boot_params = rmode; -+ boot_params_ptr = rmode; - - /* Clear flags intended for solely in-kernel use. */ -- boot_params->hdr.loadflags &= ~KASLR_FLAG; -+ boot_params_ptr->hdr.loadflags &= ~KASLR_FLAG; - -- parse_mem_encrypt(&boot_params->hdr); -+ parse_mem_encrypt(&boot_params_ptr->hdr); - -- sanitize_boot_params(boot_params); -+ sanitize_boot_params(boot_params_ptr); - -- if (boot_params->screen_info.orig_video_mode == 7) { -+ if (boot_params_ptr->screen_info.orig_video_mode == 7) { - vidmem = (char *) 0xb0000; - vidport = 0x3b4; - } else { -@@ -413,8 +413,8 @@ asmlinkage __visible void *extract_kernel(void *rmode, unsigned char *output) - vidport = 0x3d4; - } - -- lines = boot_params->screen_info.orig_video_lines; -- cols = boot_params->screen_info.orig_video_cols; -+ lines = boot_params_ptr->screen_info.orig_video_lines; -+ cols = boot_params_ptr->screen_info.orig_video_cols; - - init_default_io_ops(); - -@@ -433,7 +433,7 @@ asmlinkage __visible void *extract_kernel(void *rmode, unsigned char *output) - * so that early debugging output from the RSDP parsing code can be - * collected. - */ -- boot_params->acpi_rsdp_addr = get_rsdp_addr(); -+ boot_params_ptr->acpi_rsdp_addr = get_rsdp_addr(); - - debug_putstr("early console in extract_kernel\n"); - -diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h -index aae1a2db425103..bc2f0f17fb90ec 100644 ---- a/arch/x86/boot/compressed/misc.h -+++ b/arch/x86/boot/compressed/misc.h -@@ -61,7 +61,6 @@ extern memptr free_mem_ptr; - extern memptr free_mem_end_ptr; - void *malloc(int size); - void free(void *where); --extern struct boot_params *boot_params; - void __putstr(const char *s); - void __puthex(unsigned long value); - #define error_putstr(__x) __putstr(__x) -diff --git a/arch/x86/boot/compressed/pgtable_64.c b/arch/x86/boot/compressed/pgtable_64.c -index 7939eb6e6ce9bb..15354673d3aa7f 100644 ---- a/arch/x86/boot/compressed/pgtable_64.c -+++ b/arch/x86/boot/compressed/pgtable_64.c -@@ -1,5 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0 - #include "misc.h" -+#include - #include - #include - #include "pgtable.h" -@@ -28,7 +29,6 @@ static char trampoline_save[TRAMPOLINE_32BIT_SIZE]; - */ - unsigned long *trampoline_32bit __section(".data"); - --extern struct boot_params *boot_params; - int cmdline_find_option_bool(const char *option); - - static unsigned long find_trampoline_placement(void) -@@ -49,7 +49,7 @@ static unsigned long find_trampoline_placement(void) - * - * Only look for values in the legacy ROM for non-EFI system. - */ -- signature = (char *)&boot_params->efi_info.efi_loader_signature; -+ signature = (char *)&boot_params_ptr->efi_info.efi_loader_signature; - if (strncmp(signature, EFI32_LOADER_SIGNATURE, 4) && - strncmp(signature, EFI64_LOADER_SIGNATURE, 4)) { - ebda_start = *(unsigned short *)0x40e << 4; -@@ -65,10 +65,10 @@ static unsigned long find_trampoline_placement(void) - bios_start = round_down(bios_start, PAGE_SIZE); - - /* Find the first usable memory region under bios_start. */ -- for (i = boot_params->e820_entries - 1; i >= 0; i--) { -+ for (i = boot_params_ptr->e820_entries - 1; i >= 0; i--) { - unsigned long new = bios_start; - -- entry = &boot_params->e820_table[i]; -+ entry = &boot_params_ptr->e820_table[i]; - - /* Skip all entries above bios_start. */ - if (bios_start <= entry->addr) -@@ -107,7 +107,8 @@ asmlinkage void configure_5level_paging(struct boot_params *bp, void *pgtable) - bool l5_required = false; - - /* Initialize boot_params. Required for cmdline_find_option_bool(). */ -- boot_params = bp; -+ sanitize_boot_params(bp); -+ boot_params_ptr = bp; - - /* - * Check if LA57 is desired and supported. -diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c -index 0a49218a516a28..01d61f0609ab4d 100644 ---- a/arch/x86/boot/compressed/sev.c -+++ b/arch/x86/boot/compressed/sev.c -@@ -618,7 +618,7 @@ void sev_prep_identity_maps(unsigned long top_level_pgt) - * accessed after switchover. - */ - if (sev_snp_enabled()) { -- unsigned long cc_info_pa = boot_params->cc_blob_address; -+ unsigned long cc_info_pa = boot_params_ptr->cc_blob_address; - struct cc_blob_sev_info *cc_info; - - kernel_add_identity_map(cc_info_pa, cc_info_pa + sizeof(*cc_info)); -diff --git a/arch/x86/include/asm/boot.h b/arch/x86/include/asm/boot.h -index c945c893c52e0a..a3e0be0470a400 100644 ---- a/arch/x86/include/asm/boot.h -+++ b/arch/x86/include/asm/boot.h -@@ -86,6 +86,8 @@ extern const unsigned long kernel_total_size; - - unsigned long decompress_kernel(unsigned char *outbuf, unsigned long virt_addr, - void (*error)(char *x)); -+ -+extern struct boot_params *boot_params_ptr; - #endif - - #endif /* _ASM_X86_BOOT_H */ -diff --git a/arch/x86/include/asm/spec-ctrl.h b/arch/x86/include/asm/spec-ctrl.h -index cb0386fc4dc3b3..c648502e453579 100644 ---- a/arch/x86/include/asm/spec-ctrl.h -+++ b/arch/x86/include/asm/spec-ctrl.h -@@ -4,6 +4,7 @@ - - #include - #include -+#include - - /* - * On VMENTER we must preserve whatever view of the SPEC_CTRL MSR -@@ -76,6 +77,16 @@ static inline u64 ssbd_tif_to_amd_ls_cfg(u64 tifn) - return (tifn & _TIF_SSBD) ? x86_amd_ls_cfg_ssbd_mask : 0ULL; - } - -+/* -+ * This can be used in noinstr functions & should only be called in bare -+ * metal context. -+ */ -+static __always_inline void __update_spec_ctrl(u64 val) -+{ -+ __this_cpu_write(x86_spec_ctrl_current, val); -+ native_wrmsrl(MSR_IA32_SPEC_CTRL, val); -+} -+ - #ifdef CONFIG_SMP - extern void speculative_store_bypass_ht_init(void); - #else -diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c -index b6d5fc396f88c8..ef75930d07545a 100644 ---- a/arch/x86/kernel/amd_nb.c -+++ b/arch/x86/kernel/amd_nb.c -@@ -360,7 +360,6 @@ bool __init early_is_amd_nb(u32 device) - - struct resource *amd_get_mmconfig_range(struct resource *res) - { -- u32 address; - u64 base, msr; - unsigned int segn_busn_bits; - -@@ -368,13 +367,11 @@ struct resource *amd_get_mmconfig_range(struct resource *res) - boot_cpu_data.x86_vendor != X86_VENDOR_HYGON) - return NULL; - -- /* assume all cpus from fam10h have mmconfig */ -- if (boot_cpu_data.x86 < 0x10) -+ /* Assume CPUs from Fam10h have mmconfig, although not all VMs do */ -+ if (boot_cpu_data.x86 < 0x10 || -+ rdmsrl_safe(MSR_FAM10H_MMIO_CONF_BASE, &msr)) - return NULL; - -- address = MSR_FAM10H_MMIO_CONF_BASE; -- rdmsrl(address, msr); -- - /* mmconfig is not enabled */ - if (!(msr & FAM10H_MMIO_CONF_ENABLE)) - return NULL; -diff --git a/arch/x86/kernel/cpu/cacheinfo.c b/arch/x86/kernel/cpu/cacheinfo.c -index 8f86eacf69f7c9..4729b5771dce8e 100644 ---- a/arch/x86/kernel/cpu/cacheinfo.c -+++ b/arch/x86/kernel/cpu/cacheinfo.c -@@ -810,7 +810,7 @@ void init_intel_cacheinfo(struct cpuinfo_x86 *c) - cpuid(2, ®s[0], ®s[1], ®s[2], ®s[3]); - - /* If bit 31 is set, this is an unknown format */ -- for (j = 0 ; j < 3 ; j++) -+ for (j = 0 ; j < 4 ; j++) - if (regs[j] & (1 << 31)) - regs[j] = 0; - -diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c -index 4752a9f17ef615..38eeff91109f9b 100644 ---- a/arch/x86/kernel/cpu/intel.c -+++ b/arch/x86/kernel/cpu/intel.c -@@ -748,26 +748,37 @@ static unsigned int intel_size_cache(struct cpuinfo_x86 *c, unsigned int size) - } - #endif - --#define TLB_INST_4K 0x01 --#define TLB_INST_4M 0x02 --#define TLB_INST_2M_4M 0x03 -+#define TLB_INST_4K 0x01 -+#define TLB_INST_4M 0x02 -+#define TLB_INST_2M_4M 0x03 - --#define TLB_INST_ALL 0x05 --#define TLB_INST_1G 0x06 -+#define TLB_INST_ALL 0x05 -+#define TLB_INST_1G 0x06 - --#define TLB_DATA_4K 0x11 --#define TLB_DATA_4M 0x12 --#define TLB_DATA_2M_4M 0x13 --#define TLB_DATA_4K_4M 0x14 -+#define TLB_DATA_4K 0x11 -+#define TLB_DATA_4M 0x12 -+#define TLB_DATA_2M_4M 0x13 -+#define TLB_DATA_4K_4M 0x14 - --#define TLB_DATA_1G 0x16 -+#define TLB_DATA_1G 0x16 -+#define TLB_DATA_1G_2M_4M 0x17 - --#define TLB_DATA0_4K 0x21 --#define TLB_DATA0_4M 0x22 --#define TLB_DATA0_2M_4M 0x23 -+#define TLB_DATA0_4K 0x21 -+#define TLB_DATA0_4M 0x22 -+#define TLB_DATA0_2M_4M 0x23 - --#define STLB_4K 0x41 --#define STLB_4K_2M 0x42 -+#define STLB_4K 0x41 -+#define STLB_4K_2M 0x42 -+ -+/* -+ * All of leaf 0x2's one-byte TLB descriptors implies the same number of -+ * entries for their respective TLB types. The 0x63 descriptor is an -+ * exception: it implies 4 dTLB entries for 1GB pages 32 dTLB entries -+ * for 2MB or 4MB pages. Encode descriptor 0x63 dTLB entry count for -+ * 2MB/4MB pages here, as its count for dTLB 1GB pages is already at the -+ * intel_tlb_table[] mapping. -+ */ -+#define TLB_0x63_2M_4M_ENTRIES 32 - - static const struct _tlb_table intel_tlb_table[] = { - { 0x01, TLB_INST_4K, 32, " TLB_INST 4 KByte pages, 4-way set associative" }, -@@ -789,7 +800,8 @@ static const struct _tlb_table intel_tlb_table[] = { - { 0x5c, TLB_DATA_4K_4M, 128, " TLB_DATA 4 KByte and 4 MByte pages" }, - { 0x5d, TLB_DATA_4K_4M, 256, " TLB_DATA 4 KByte and 4 MByte pages" }, - { 0x61, TLB_INST_4K, 48, " TLB_INST 4 KByte pages, full associative" }, -- { 0x63, TLB_DATA_1G, 4, " TLB_DATA 1 GByte pages, 4-way set associative" }, -+ { 0x63, TLB_DATA_1G_2M_4M, 4, " TLB_DATA 1 GByte pages, 4-way set associative" -+ " (plus 32 entries TLB_DATA 2 MByte or 4 MByte pages, not encoded here)" }, - { 0x6b, TLB_DATA_4K, 256, " TLB_DATA 4 KByte pages, 8-way associative" }, - { 0x6c, TLB_DATA_2M_4M, 128, " TLB_DATA 2 MByte or 4 MByte pages, 8-way associative" }, - { 0x6d, TLB_DATA_1G, 16, " TLB_DATA 1 GByte pages, fully associative" }, -@@ -889,6 +901,12 @@ static void intel_tlb_lookup(const unsigned char desc) - if (tlb_lld_4m[ENTRIES] < intel_tlb_table[k].entries) - tlb_lld_4m[ENTRIES] = intel_tlb_table[k].entries; - break; -+ case TLB_DATA_1G_2M_4M: -+ if (tlb_lld_2m[ENTRIES] < TLB_0x63_2M_4M_ENTRIES) -+ tlb_lld_2m[ENTRIES] = TLB_0x63_2M_4M_ENTRIES; -+ if (tlb_lld_4m[ENTRIES] < TLB_0x63_2M_4M_ENTRIES) -+ tlb_lld_4m[ENTRIES] = TLB_0x63_2M_4M_ENTRIES; -+ fallthrough; - case TLB_DATA_1G: - if (tlb_lld_1g[ENTRIES] < intel_tlb_table[k].entries) - tlb_lld_1g[ENTRIES] = intel_tlb_table[k].entries; -@@ -912,7 +930,7 @@ static void intel_detect_tlb(struct cpuinfo_x86 *c) - cpuid(2, ®s[0], ®s[1], ®s[2], ®s[3]); - - /* If bit 31 is set, this is an unknown format */ -- for (j = 0 ; j < 3 ; j++) -+ for (j = 0 ; j < 4 ; j++) - if (regs[j] & (1 << 31)) - regs[j] = 0; - -diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c -index 13a632da09ed7b..af766298b253bd 100644 ---- a/arch/x86/kernel/cpu/microcode/amd.c -+++ b/arch/x86/kernel/cpu/microcode/amd.c -@@ -177,23 +177,29 @@ static bool need_sha_check(u32 cur_rev) - { - switch (cur_rev >> 8) { - case 0x80012: return cur_rev <= 0x800126f; break; -+ case 0x80082: return cur_rev <= 0x800820f; break; - case 0x83010: return cur_rev <= 0x830107c; break; - case 0x86001: return cur_rev <= 0x860010e; break; - case 0x86081: return cur_rev <= 0x8608108; break; - case 0x87010: return cur_rev <= 0x8701034; break; - case 0x8a000: return cur_rev <= 0x8a0000a; break; -+ case 0xa0010: return cur_rev <= 0xa00107a; break; - case 0xa0011: return cur_rev <= 0xa0011da; break; - case 0xa0012: return cur_rev <= 0xa001243; break; -+ case 0xa0082: return cur_rev <= 0xa00820e; break; - case 0xa1011: return cur_rev <= 0xa101153; break; - case 0xa1012: return cur_rev <= 0xa10124e; break; - case 0xa1081: return cur_rev <= 0xa108109; break; - case 0xa2010: return cur_rev <= 0xa20102f; break; - case 0xa2012: return cur_rev <= 0xa201212; break; -+ case 0xa4041: return cur_rev <= 0xa404109; break; -+ case 0xa5000: return cur_rev <= 0xa500013; break; - case 0xa6012: return cur_rev <= 0xa60120a; break; - case 0xa7041: return cur_rev <= 0xa704109; break; - case 0xa7052: return cur_rev <= 0xa705208; break; - case 0xa7080: return cur_rev <= 0xa708009; break; - case 0xa70c0: return cur_rev <= 0xa70C009; break; -+ case 0xaa001: return cur_rev <= 0xaa00116; break; - case 0xaa002: return cur_rev <= 0xaa00218; break; - default: break; - } -diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c b/arch/x86/kernel/cpu/sgx/ioctl.c -index 5d390df2144066..a59a0011c930ad 100644 ---- a/arch/x86/kernel/cpu/sgx/ioctl.c -+++ b/arch/x86/kernel/cpu/sgx/ioctl.c -@@ -64,6 +64,13 @@ static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs) - struct file *backing; - long ret; - -+ /* -+ * ECREATE would detect this too, but checking here also ensures -+ * that the 'encl_size' calculations below can never overflow. -+ */ -+ if (!is_power_of_2(secs->size)) -+ return -EINVAL; -+ - va_page = sgx_encl_grow(encl, true); - if (IS_ERR(va_page)) - return PTR_ERR(va_page); -diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c -index 7e6763c2bc01e9..5fb12d9c71befa 100644 ---- a/arch/x86/kvm/cpuid.c -+++ b/arch/x86/kvm/cpuid.c -@@ -1307,7 +1307,7 @@ static inline int __do_cpuid_func(struct kvm_cpuid_array *array, u32 function) - - entry->ecx = entry->edx = 0; - if (!enable_pmu || !kvm_cpu_cap_has(X86_FEATURE_PERFMON_V2)) { -- entry->eax = entry->ebx; -+ entry->eax = entry->ebx = 0; - break; - } - -diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c -index d762330bce166c..1d06b8fc15a85c 100644 ---- a/arch/x86/kvm/svm/svm.c -+++ b/arch/x86/kvm/svm/svm.c -@@ -3156,6 +3156,27 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr) - kvm_pr_unimpl_wrmsr(vcpu, ecx, data); - break; - } -+ -+ /* -+ * AMD changed the architectural behavior of bits 5:2. On CPUs -+ * without BusLockTrap, bits 5:2 control "external pins", but -+ * on CPUs that support BusLockDetect, bit 2 enables BusLockTrap -+ * and bits 5:3 are reserved-to-zero. Sadly, old KVM allowed -+ * the guest to set bits 5:2 despite not actually virtualizing -+ * Performance-Monitoring/Breakpoint external pins. Drop bits -+ * 5:2 for backwards compatibility. -+ */ -+ data &= ~GENMASK(5, 2); -+ -+ /* -+ * Suppress BTF as KVM doesn't virtualize BTF, but there's no -+ * way to communicate lack of support to the guest. -+ */ -+ if (data & DEBUGCTLMSR_BTF) { -+ kvm_pr_unimpl_wrmsr(vcpu, MSR_IA32_DEBUGCTLMSR, data); -+ data &= ~DEBUGCTLMSR_BTF; -+ } -+ - if (data & DEBUGCTL_RESERVED_BITS) - return 1; - -diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h -index 37ada9808d9b57..81f00177f501a1 100644 ---- a/arch/x86/kvm/svm/svm.h -+++ b/arch/x86/kvm/svm/svm.h -@@ -533,7 +533,7 @@ static inline bool is_vnmi_enabled(struct vcpu_svm *svm) - /* svm.c */ - #define MSR_INVALID 0xffffffffU - --#define DEBUGCTL_RESERVED_BITS (~(0x3fULL)) -+#define DEBUGCTL_RESERVED_BITS (~DEBUGCTLMSR_LBR) - - extern bool dump_invalid_vmcb; - -diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c -index 6215dfa23578da..71d29dd7ad761e 100644 ---- a/arch/x86/mm/init.c -+++ b/arch/x86/mm/init.c -@@ -262,28 +262,33 @@ static void __init probe_page_size_mask(void) - } - - /* -- * INVLPG may not properly flush Global entries -- * on these CPUs when PCIDs are enabled. -+ * INVLPG may not properly flush Global entries on -+ * these CPUs. New microcode fixes the issue. - */ - static const struct x86_cpu_id invlpg_miss_ids[] = { -- X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE, 0), -- X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_L, 0), -- X86_MATCH_INTEL_FAM6_MODEL(ATOM_GRACEMONT, 0), -- X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE, 0), -- X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P, 0), -- X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S, 0), -+ X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE, 0x2e), -+ X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_L, 0x42c), -+ X86_MATCH_INTEL_FAM6_MODEL(ATOM_GRACEMONT, 0x11), -+ X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE, 0x118), -+ X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P, 0x4117), -+ X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S, 0x2e), - {} - }; - - static void setup_pcid(void) - { -+ const struct x86_cpu_id *invlpg_miss_match; -+ - if (!IS_ENABLED(CONFIG_X86_64)) - return; - - if (!boot_cpu_has(X86_FEATURE_PCID)) - return; - -- if (x86_match_cpu(invlpg_miss_ids)) { -+ invlpg_miss_match = x86_match_cpu(invlpg_miss_ids); -+ -+ if (invlpg_miss_match && -+ boot_cpu_data.microcode < invlpg_miss_match->driver_data) { - pr_info("Incomplete global flushes, disabling PCID"); - setup_clear_cpu_cap(X86_FEATURE_PCID); - return; -diff --git a/block/partitions/efi.c b/block/partitions/efi.c -index 5e9be13a56a82a..7acba66eed481c 100644 ---- a/block/partitions/efi.c -+++ b/block/partitions/efi.c -@@ -682,7 +682,7 @@ static void utf16_le_to_7bit(const __le16 *in, unsigned int size, u8 *out) - out[size] = 0; - - while (i < size) { -- u8 c = le16_to_cpu(in[i]) & 0xff; -+ u8 c = le16_to_cpu(in[i]) & 0x7f; - - if (c && !isprint(c)) - c = '!'; -diff --git a/drivers/base/core.c b/drivers/base/core.c -index 18a73e49210261..8e2caa9eb5cd41 100644 ---- a/drivers/base/core.c -+++ b/drivers/base/core.c -@@ -2026,6 +2026,7 @@ static bool __fw_devlink_relax_cycles(struct fwnode_handle *con_handle, - out: - sup_handle->flags &= ~FWNODE_FLAG_VISITED; - put_device(sup_dev); -+ put_device(con_dev); - put_device(par_dev); - return ret; - } -diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c -index 1105e8adf7f96f..95095500f93afb 100644 ---- a/drivers/block/ublk_drv.c -+++ b/drivers/block/ublk_drv.c -@@ -2599,9 +2599,12 @@ static int ublk_ctrl_set_params(struct ublk_device *ub, - if (ph.len > sizeof(struct ublk_params)) - ph.len = sizeof(struct ublk_params); - -- /* parameters can only be changed when device isn't live */ - mutex_lock(&ub->mutex); -- if (ub->dev_info.state == UBLK_S_DEV_LIVE) { -+ if (test_bit(UB_STATE_USED, &ub->state)) { -+ /* -+ * Parameters can only be changed when device hasn't -+ * been started yet -+ */ - ret = -EACCES; - } else if (copy_from_user(&ub->params, argp, ph.len)) { - ret = -EFAULT; -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index c80b5aa7628ae9..bc3f63f1ccd863 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -4230,6 +4230,7 @@ static ssize_t force_poll_sync_write(struct file *file, - } - - static const struct file_operations force_poll_sync_fops = { -+ .owner = THIS_MODULE, - .open = simple_open, - .read = force_poll_sync_read, - .write = force_poll_sync_write, -diff --git a/drivers/bus/mhi/host/pci_generic.c b/drivers/bus/mhi/host/pci_generic.c -index 154841916f5652..6121ca84654114 100644 ---- a/drivers/bus/mhi/host/pci_generic.c -+++ b/drivers/bus/mhi/host/pci_generic.c -@@ -892,8 +892,9 @@ static void mhi_pci_recovery_work(struct work_struct *work) - err_unprepare: - mhi_unprepare_after_power_down(mhi_cntrl); - err_try_reset: -- if (pci_reset_function(pdev)) -- dev_err(&pdev->dev, "Recovery failed\n"); -+ err = pci_try_reset_function(pdev); -+ if (err) -+ dev_err(&pdev->dev, "Recovery failed: %d\n", err); - } - - static void health_check(struct timer_list *t) -diff --git a/drivers/cdx/cdx.c b/drivers/cdx/cdx.c -index d2cad4c670a073..a61834bc84a991 100644 ---- a/drivers/cdx/cdx.c -+++ b/drivers/cdx/cdx.c -@@ -365,8 +365,12 @@ static ssize_t driver_override_show(struct device *dev, - struct device_attribute *attr, char *buf) - { - struct cdx_device *cdx_dev = to_cdx_device(dev); -+ ssize_t len; - -- return sysfs_emit(buf, "%s\n", cdx_dev->driver_override); -+ device_lock(dev); -+ len = sysfs_emit(buf, "%s\n", cdx_dev->driver_override); -+ device_unlock(dev); -+ return len; - } - static DEVICE_ATTR_RW(driver_override); - -diff --git a/drivers/char/misc.c b/drivers/char/misc.c -index 2cf595d2e10b85..f7dd455dd0dd3c 100644 ---- a/drivers/char/misc.c -+++ b/drivers/char/misc.c -@@ -264,8 +264,8 @@ int misc_register(struct miscdevice *misc) - device_create_with_groups(&misc_class, misc->parent, dev, - misc, misc->groups, "%s", misc->name); - if (IS_ERR(misc->this_device)) { -+ misc_minor_free(misc->minor); - if (is_dynamic) { -- misc_minor_free(misc->minor); - misc->minor = MISC_DYNAMIC_MINOR; - } - err = PTR_ERR(misc->this_device); -diff --git a/drivers/firmware/efi/libstub/x86-stub.c b/drivers/firmware/efi/libstub/x86-stub.c -index b2b06d18b7b4a7..7bea03963b2812 100644 ---- a/drivers/firmware/efi/libstub/x86-stub.c -+++ b/drivers/firmware/efi/libstub/x86-stub.c -@@ -883,7 +883,7 @@ void __noreturn efi_stub_entry(efi_handle_t handle, - unsigned long kernel_entry; - efi_status_t status; - -- boot_params_pointer = boot_params; -+ boot_params_ptr = boot_params; - - efi_system_table = sys_table_arg; - /* Check if we were booted by the EFI firmware */ -diff --git a/drivers/firmware/efi/libstub/x86-stub.h b/drivers/firmware/efi/libstub/x86-stub.h -index 4433d0f97441ca..1c20e99a649442 100644 ---- a/drivers/firmware/efi/libstub/x86-stub.h -+++ b/drivers/firmware/efi/libstub/x86-stub.h -@@ -2,8 +2,6 @@ - - #include - --extern struct boot_params *boot_params_pointer asm("boot_params"); -- - extern void trampoline_32bit_src(void *, bool); - extern const u16 trampoline_ljmp_imm_offset; - -diff --git a/drivers/firmware/efi/mokvar-table.c b/drivers/firmware/efi/mokvar-table.c -index 5ed0602c2f75f0..4eb0dff4dfaf8b 100644 ---- a/drivers/firmware/efi/mokvar-table.c -+++ b/drivers/firmware/efi/mokvar-table.c -@@ -103,9 +103,7 @@ void __init efi_mokvar_table_init(void) - void *va = NULL; - unsigned long cur_offset = 0; - unsigned long offset_limit; -- unsigned long map_size = 0; - unsigned long map_size_needed = 0; -- unsigned long size; - struct efi_mokvar_table_entry *mokvar_entry; - int err; - -@@ -134,48 +132,34 @@ void __init efi_mokvar_table_init(void) - */ - err = -EINVAL; - while (cur_offset + sizeof(*mokvar_entry) <= offset_limit) { -- mokvar_entry = va + cur_offset; -- map_size_needed = cur_offset + sizeof(*mokvar_entry); -- if (map_size_needed > map_size) { -- if (va) -- early_memunmap(va, map_size); -- /* -- * Map a little more than the fixed size entry -- * header, anticipating some data. It's safe to -- * do so as long as we stay within current memory -- * descriptor. -- */ -- map_size = min(map_size_needed + 2*EFI_PAGE_SIZE, -- offset_limit); -- va = early_memremap(efi.mokvar_table, map_size); -- if (!va) { -- pr_err("Failed to map EFI MOKvar config table pa=0x%lx, size=%lu.\n", -- efi.mokvar_table, map_size); -- return; -- } -- mokvar_entry = va + cur_offset; -+ if (va) -+ early_memunmap(va, sizeof(*mokvar_entry)); -+ va = early_memremap(efi.mokvar_table + cur_offset, sizeof(*mokvar_entry)); -+ if (!va) { -+ pr_err("Failed to map EFI MOKvar config table pa=0x%lx, size=%zu.\n", -+ efi.mokvar_table + cur_offset, sizeof(*mokvar_entry)); -+ return; - } -+ mokvar_entry = va; - - /* Check for last sentinel entry */ - if (mokvar_entry->name[0] == '\0') { - if (mokvar_entry->data_size != 0) - break; - err = 0; -+ map_size_needed = cur_offset + sizeof(*mokvar_entry); - break; - } - -- /* Sanity check that the name is null terminated */ -- size = strnlen(mokvar_entry->name, -- sizeof(mokvar_entry->name)); -- if (size >= sizeof(mokvar_entry->name)) -- break; -+ /* Enforce that the name is NUL terminated */ -+ mokvar_entry->name[sizeof(mokvar_entry->name) - 1] = '\0'; - - /* Advance to the next entry */ -- cur_offset = map_size_needed + mokvar_entry->data_size; -+ cur_offset += sizeof(*mokvar_entry) + mokvar_entry->data_size; - } - - if (va) -- early_memunmap(va, map_size); -+ early_memunmap(va, sizeof(*mokvar_entry)); - if (err) { - pr_err("EFI MOKvar config table is not valid\n"); - return; -diff --git a/drivers/gpio/gpio-aggregator.c b/drivers/gpio/gpio-aggregator.c -index 38e0fff9afe722..cc6ee4334602aa 100644 ---- a/drivers/gpio/gpio-aggregator.c -+++ b/drivers/gpio/gpio-aggregator.c -@@ -121,10 +121,15 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, - struct platform_device *pdev; - int res, id; - -+ if (!try_module_get(THIS_MODULE)) -+ return -ENOENT; -+ - /* kernfs guarantees string termination, so count + 1 is safe */ - aggr = kzalloc(sizeof(*aggr) + count + 1, GFP_KERNEL); -- if (!aggr) -- return -ENOMEM; -+ if (!aggr) { -+ res = -ENOMEM; -+ goto put_module; -+ } - - memcpy(aggr->args, buf, count + 1); - -@@ -163,6 +168,7 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, - } - - aggr->pdev = pdev; -+ module_put(THIS_MODULE); - return count; - - remove_table: -@@ -177,6 +183,8 @@ static ssize_t new_device_store(struct device_driver *driver, const char *buf, - kfree(aggr->lookups); - free_ga: - kfree(aggr); -+put_module: -+ module_put(THIS_MODULE); - return res; - } - -@@ -205,13 +213,19 @@ static ssize_t delete_device_store(struct device_driver *driver, - if (error) - return error; - -+ if (!try_module_get(THIS_MODULE)) -+ return -ENOENT; -+ - mutex_lock(&gpio_aggregator_lock); - aggr = idr_remove(&gpio_aggregator_idr, id); - mutex_unlock(&gpio_aggregator_lock); -- if (!aggr) -+ if (!aggr) { -+ module_put(THIS_MODULE); - return -ENOENT; -+ } - - gpio_aggregator_free(aggr); -+ module_put(THIS_MODULE); - return count; - } - static DRIVER_ATTR_WO(delete_device); -diff --git a/drivers/gpio/gpio-rcar.c b/drivers/gpio/gpio-rcar.c -index 86e69cde04da0f..53ec8cc0479835 100644 ---- a/drivers/gpio/gpio-rcar.c -+++ b/drivers/gpio/gpio-rcar.c -@@ -40,7 +40,7 @@ struct gpio_rcar_info { - - struct gpio_rcar_priv { - void __iomem *base; -- spinlock_t lock; -+ raw_spinlock_t lock; - struct device *dev; - struct gpio_chip gpio_chip; - unsigned int irq_parent; -@@ -123,7 +123,7 @@ static void gpio_rcar_config_interrupt_input_mode(struct gpio_rcar_priv *p, - * "Setting Level-Sensitive Interrupt Input Mode" - */ - -- spin_lock_irqsave(&p->lock, flags); -+ raw_spin_lock_irqsave(&p->lock, flags); - - /* Configure positive or negative logic in POSNEG */ - gpio_rcar_modify_bit(p, POSNEG, hwirq, !active_high_rising_edge); -@@ -142,7 +142,7 @@ static void gpio_rcar_config_interrupt_input_mode(struct gpio_rcar_priv *p, - if (!level_trigger) - gpio_rcar_write(p, INTCLR, BIT(hwirq)); - -- spin_unlock_irqrestore(&p->lock, flags); -+ raw_spin_unlock_irqrestore(&p->lock, flags); - } - - static int gpio_rcar_irq_set_type(struct irq_data *d, unsigned int type) -@@ -246,7 +246,7 @@ static void gpio_rcar_config_general_input_output_mode(struct gpio_chip *chip, - * "Setting General Input Mode" - */ - -- spin_lock_irqsave(&p->lock, flags); -+ raw_spin_lock_irqsave(&p->lock, flags); - - /* Configure positive logic in POSNEG */ - gpio_rcar_modify_bit(p, POSNEG, gpio, false); -@@ -261,7 +261,7 @@ static void gpio_rcar_config_general_input_output_mode(struct gpio_chip *chip, - if (p->info.has_outdtsel && output) - gpio_rcar_modify_bit(p, OUTDTSEL, gpio, false); - -- spin_unlock_irqrestore(&p->lock, flags); -+ raw_spin_unlock_irqrestore(&p->lock, flags); - } - - static int gpio_rcar_request(struct gpio_chip *chip, unsigned offset) -@@ -347,7 +347,7 @@ static int gpio_rcar_get_multiple(struct gpio_chip *chip, unsigned long *mask, - return 0; - } - -- spin_lock_irqsave(&p->lock, flags); -+ raw_spin_lock_irqsave(&p->lock, flags); - outputs = gpio_rcar_read(p, INOUTSEL); - m = outputs & bankmask; - if (m) -@@ -356,7 +356,7 @@ static int gpio_rcar_get_multiple(struct gpio_chip *chip, unsigned long *mask, - m = ~outputs & bankmask; - if (m) - val |= gpio_rcar_read(p, INDT) & m; -- spin_unlock_irqrestore(&p->lock, flags); -+ raw_spin_unlock_irqrestore(&p->lock, flags); - - bits[0] = val; - return 0; -@@ -367,9 +367,9 @@ static void gpio_rcar_set(struct gpio_chip *chip, unsigned offset, int value) - struct gpio_rcar_priv *p = gpiochip_get_data(chip); - unsigned long flags; - -- spin_lock_irqsave(&p->lock, flags); -+ raw_spin_lock_irqsave(&p->lock, flags); - gpio_rcar_modify_bit(p, OUTDT, offset, value); -- spin_unlock_irqrestore(&p->lock, flags); -+ raw_spin_unlock_irqrestore(&p->lock, flags); - } - - static void gpio_rcar_set_multiple(struct gpio_chip *chip, unsigned long *mask, -@@ -386,12 +386,12 @@ static void gpio_rcar_set_multiple(struct gpio_chip *chip, unsigned long *mask, - if (!bankmask) - return; - -- spin_lock_irqsave(&p->lock, flags); -+ raw_spin_lock_irqsave(&p->lock, flags); - val = gpio_rcar_read(p, OUTDT); - val &= ~bankmask; - val |= (bankmask & bits[0]); - gpio_rcar_write(p, OUTDT, val); -- spin_unlock_irqrestore(&p->lock, flags); -+ raw_spin_unlock_irqrestore(&p->lock, flags); - } - - static int gpio_rcar_direction_output(struct gpio_chip *chip, unsigned offset, -@@ -468,7 +468,12 @@ static int gpio_rcar_parse_dt(struct gpio_rcar_priv *p, unsigned int *npins) - p->info = *info; - - ret = of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3, 0, &args); -- *npins = ret == 0 ? args.args[2] : RCAR_MAX_GPIO_PER_BANK; -+ if (ret) { -+ *npins = RCAR_MAX_GPIO_PER_BANK; -+ } else { -+ *npins = args.args[2]; -+ of_node_put(args.np); -+ } - - if (*npins == 0 || *npins > RCAR_MAX_GPIO_PER_BANK) { - dev_warn(p->dev, "Invalid number of gpio lines %u, using %u\n", -@@ -505,7 +510,7 @@ static int gpio_rcar_probe(struct platform_device *pdev) - return -ENOMEM; - - p->dev = dev; -- spin_lock_init(&p->lock); -+ raw_spin_lock_init(&p->lock); - - /* Get device configuration from DT node */ - ret = gpio_rcar_parse_dt(p, &npins); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -index 2e739b80cfccf1..45dd6cbad81e79 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -@@ -1116,6 +1116,17 @@ int amdgpu_device_resize_fb_bar(struct amdgpu_device *adev) - if (amdgpu_sriov_vf(adev)) - return 0; - -+ /* resizing on Dell G5 SE platforms causes problems with runtime pm */ -+ if ((amdgpu_runtime_pm != 0) && -+ adev->pdev->vendor == PCI_VENDOR_ID_ATI && -+ adev->pdev->device == 0x731f && -+ adev->pdev->subsystem_vendor == PCI_VENDOR_ID_DELL) -+ return 0; -+ -+ /* PCI_EXT_CAP_ID_VNDR extended capability is located at 0x100 */ -+ if (!pci_find_ext_capability(adev->pdev, PCI_EXT_CAP_ID_VNDR)) -+ DRM_WARN("System can't access extended configuration space,please check!!\n"); -+ - /* skip if the bios has already enabled large BAR */ - if (adev->gmc.real_vram_size && - (pci_resource_len(adev->pdev, 0) >= adev->gmc.real_vram_size)) -diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -index 99fcd39bb15e0d..69c0d0b341af2a 100644 ---- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -@@ -1394,7 +1394,8 @@ bool resource_build_scaling_params(struct pipe_ctx *pipe_ctx) - DC_LOGGER_INIT(pipe_ctx->stream->ctx->logger); - - /* Invalid input */ -- if (!plane_state->dst_rect.width || -+ if (!plane_state || -+ !plane_state->dst_rect.width || - !plane_state->dst_rect.height || - !plane_state->src_rect.width || - !plane_state->src_rect.height) { -diff --git a/drivers/gpu/drm/i915/display/icl_dsi.c b/drivers/gpu/drm/i915/display/icl_dsi.c -index 5b8efe8e735a9b..0a0efeeb790e26 100644 ---- a/drivers/gpu/drm/i915/display/icl_dsi.c -+++ b/drivers/gpu/drm/i915/display/icl_dsi.c -@@ -797,8 +797,8 @@ gen11_dsi_configure_transcoder(struct intel_encoder *encoder, - - /* select data lane width */ - tmp = intel_de_read(dev_priv, TRANS_DDI_FUNC_CTL(dsi_trans)); -- tmp &= ~DDI_PORT_WIDTH_MASK; -- tmp |= DDI_PORT_WIDTH(intel_dsi->lane_count); -+ tmp &= ~TRANS_DDI_PORT_WIDTH_MASK; -+ tmp |= TRANS_DDI_PORT_WIDTH(intel_dsi->lane_count); - - /* select input pipe */ - tmp &= ~TRANS_DDI_EDP_INPUT_MASK; -diff --git a/drivers/gpu/drm/i915/display/intel_ddi.c b/drivers/gpu/drm/i915/display/intel_ddi.c -index b347f906234945..893ecee3949acb 100644 ---- a/drivers/gpu/drm/i915/display/intel_ddi.c -+++ b/drivers/gpu/drm/i915/display/intel_ddi.c -@@ -2357,13 +2357,22 @@ mtl_ddi_enable_d2d(struct intel_encoder *encoder) - { - struct drm_i915_private *dev_priv = to_i915(encoder->base.dev); - enum port port = encoder->port; -+ i915_reg_t reg; -+ u32 set_bits, wait_bits; - -- intel_de_rmw(dev_priv, XELPDP_PORT_BUF_CTL1(port), 0, -- XELPDP_PORT_BUF_D2D_LINK_ENABLE); -+ if (DISPLAY_VER(dev_priv) >= 20) { -+ reg = DDI_BUF_CTL(port); -+ set_bits = XE2LPD_DDI_BUF_D2D_LINK_ENABLE; -+ wait_bits = XE2LPD_DDI_BUF_D2D_LINK_STATE; -+ } else { -+ reg = XELPDP_PORT_BUF_CTL1(port); -+ set_bits = XELPDP_PORT_BUF_D2D_LINK_ENABLE; -+ wait_bits = XELPDP_PORT_BUF_D2D_LINK_STATE; -+ } - -- if (wait_for_us((intel_de_read(dev_priv, XELPDP_PORT_BUF_CTL1(port)) & -- XELPDP_PORT_BUF_D2D_LINK_STATE), 100)) { -- drm_err(&dev_priv->drm, "Timeout waiting for D2D Link enable for PORT_BUF_CTL %c\n", -+ intel_de_rmw(dev_priv, reg, 0, set_bits); -+ if (wait_for_us(intel_de_read(dev_priv, reg) & wait_bits, 100)) { -+ drm_err(&dev_priv->drm, "Timeout waiting for D2D Link enable for DDI/PORT_BUF_CTL %c\n", - port_name(port)); - } - } -@@ -2810,13 +2819,22 @@ mtl_ddi_disable_d2d_link(struct intel_encoder *encoder) - { - struct drm_i915_private *dev_priv = to_i915(encoder->base.dev); - enum port port = encoder->port; -+ i915_reg_t reg; -+ u32 clr_bits, wait_bits; - -- intel_de_rmw(dev_priv, XELPDP_PORT_BUF_CTL1(port), -- XELPDP_PORT_BUF_D2D_LINK_ENABLE, 0); -+ if (DISPLAY_VER(dev_priv) >= 20) { -+ reg = DDI_BUF_CTL(port); -+ clr_bits = XE2LPD_DDI_BUF_D2D_LINK_ENABLE; -+ wait_bits = XE2LPD_DDI_BUF_D2D_LINK_STATE; -+ } else { -+ reg = XELPDP_PORT_BUF_CTL1(port); -+ clr_bits = XELPDP_PORT_BUF_D2D_LINK_ENABLE; -+ wait_bits = XELPDP_PORT_BUF_D2D_LINK_STATE; -+ } - -- if (wait_for_us(!(intel_de_read(dev_priv, XELPDP_PORT_BUF_CTL1(port)) & -- XELPDP_PORT_BUF_D2D_LINK_STATE), 100)) -- drm_err(&dev_priv->drm, "Timeout waiting for D2D Link disable for PORT_BUF_CTL %c\n", -+ intel_de_rmw(dev_priv, reg, clr_bits, 0); -+ if (wait_for_us(!(intel_de_read(dev_priv, reg) & wait_bits), 100)) -+ drm_err(&dev_priv->drm, "Timeout waiting for D2D Link disable for DDI/PORT_BUF_CTL %c\n", - port_name(port)); - } - -@@ -3224,7 +3242,10 @@ static void intel_enable_ddi_hdmi(struct intel_atomic_state *state, - intel_de_rmw(dev_priv, XELPDP_PORT_BUF_CTL1(port), - XELPDP_PORT_WIDTH_MASK | XELPDP_PORT_REVERSAL, port_buf); - -- buf_ctl |= DDI_PORT_WIDTH(lane_count); -+ buf_ctl |= DDI_PORT_WIDTH(crtc_state->lane_count); -+ -+ if (DISPLAY_VER(dev_priv) >= 20) -+ buf_ctl |= XE2LPD_DDI_BUF_D2D_LINK_ENABLE; - } else if (IS_ALDERLAKE_P(dev_priv) && intel_phy_is_tc(dev_priv, phy)) { - drm_WARN_ON(&dev_priv->drm, !intel_tc_port_in_legacy_mode(dig_port)); - buf_ctl |= DDI_BUF_CTL_TC_PHY_OWNERSHIP; -@@ -3449,6 +3470,9 @@ static void mtl_ddi_prepare_link_retrain(struct intel_dp *intel_dp, - - /* 6.i Configure and enable DDI_CTL_DE to start sending valid data to port slice */ - intel_dp->DP |= DDI_BUF_CTL_ENABLE; -+ if (DISPLAY_VER(dev_priv) >= 20) -+ intel_dp->DP |= XE2LPD_DDI_BUF_D2D_LINK_ENABLE; -+ - intel_de_write(dev_priv, DDI_BUF_CTL(port), intel_dp->DP); - intel_de_posting_read(dev_priv, DDI_BUF_CTL(port)); - -diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h -index aefad14ab27a42..589a10253d8986 100644 ---- a/drivers/gpu/drm/i915/i915_reg.h -+++ b/drivers/gpu/drm/i915/i915_reg.h -@@ -5724,6 +5724,8 @@ enum skl_power_gate { - /* Known as DDI_CTL_DE in MTL+ */ - #define DDI_BUF_CTL(port) _MMIO_PORT(port, _DDI_BUF_CTL_A, _DDI_BUF_CTL_B) - #define DDI_BUF_CTL_ENABLE (1 << 31) -+#define XE2LPD_DDI_BUF_D2D_LINK_ENABLE REG_BIT(29) -+#define XE2LPD_DDI_BUF_D2D_LINK_STATE REG_BIT(28) - #define DDI_BUF_TRANS_SELECT(n) ((n) << 24) - #define DDI_BUF_EMP_MASK (0xf << 24) - #define DDI_BUF_PHY_LINK_RATE(r) ((r) << 20) -@@ -5735,7 +5737,7 @@ enum skl_power_gate { - #define DDI_BUF_IS_IDLE (1 << 7) - #define DDI_BUF_CTL_TC_PHY_OWNERSHIP REG_BIT(6) - #define DDI_A_4_LANES (1 << 4) --#define DDI_PORT_WIDTH(width) (((width) - 1) << 1) -+#define DDI_PORT_WIDTH(width) (((width) == 3 ? 4 : ((width) - 1)) << 1) - #define DDI_PORT_WIDTH_MASK (7 << 1) - #define DDI_PORT_WIDTH_SHIFT 1 - #define DDI_INIT_DISPLAY_DETECTED (1 << 0) -diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c -index 430a4263ccf7a8..b0c9970c2abd1f 100644 ---- a/drivers/gpu/drm/radeon/r300.c -+++ b/drivers/gpu/drm/radeon/r300.c -@@ -358,7 +358,8 @@ int r300_mc_wait_for_idle(struct radeon_device *rdev) - return -1; - } - --static void r300_gpu_init(struct radeon_device *rdev) -+/* rs400_gpu_init also calls this! */ -+void r300_gpu_init(struct radeon_device *rdev) - { - uint32_t gb_tile_config, tmp; - -diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h -index 1e00f6b99f94b6..8f5e07834fcc60 100644 ---- a/drivers/gpu/drm/radeon/radeon_asic.h -+++ b/drivers/gpu/drm/radeon/radeon_asic.h -@@ -165,6 +165,7 @@ void r200_set_safe_registers(struct radeon_device *rdev); - */ - extern int r300_init(struct radeon_device *rdev); - extern void r300_fini(struct radeon_device *rdev); -+extern void r300_gpu_init(struct radeon_device *rdev); - extern int r300_suspend(struct radeon_device *rdev); - extern int r300_resume(struct radeon_device *rdev); - extern int r300_asic_reset(struct radeon_device *rdev, bool hard); -diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c -index 4f93fe468ec7f9..a6f90cea59dffc 100644 ---- a/drivers/gpu/drm/radeon/rs400.c -+++ b/drivers/gpu/drm/radeon/rs400.c -@@ -255,8 +255,22 @@ int rs400_mc_wait_for_idle(struct radeon_device *rdev) - - static void rs400_gpu_init(struct radeon_device *rdev) - { -- /* FIXME: is this correct ? */ -- r420_pipes_init(rdev); -+ /* Earlier code was calling r420_pipes_init and then -+ * rs400_mc_wait_for_idle(rdev). The problem is that -+ * at least on my Mobility Radeon Xpress 200M RC410 card -+ * that ends up in this code path ends up num_gb_pipes == 3 -+ * while the card seems to have only one pipe. With the -+ * r420 pipe initialization method. -+ * -+ * Problems shown up as HyperZ glitches, see: -+ * https://bugs.freedesktop.org/show_bug.cgi?id=110897 -+ * -+ * Delegating initialization to r300 code seems to work -+ * and results in proper pipe numbers. The rs400 cards -+ * are said to be not r400, but r300 kind of cards. -+ */ -+ r300_gpu_init(rdev); -+ - if (rs400_mc_wait_for_idle(rdev)) { - pr_warn("rs400: Failed to wait MC idle while programming pipes. Bad things might happen. %08x\n", - RREG32(RADEON_MC_STATUS)); -diff --git a/drivers/gpu/drm/scheduler/gpu_scheduler_trace.h b/drivers/gpu/drm/scheduler/gpu_scheduler_trace.h -index 3143ecaaff8628..f7f10e97ac0556 100644 ---- a/drivers/gpu/drm/scheduler/gpu_scheduler_trace.h -+++ b/drivers/gpu/drm/scheduler/gpu_scheduler_trace.h -@@ -21,7 +21,7 @@ - * - */ - --#if !defined(_GPU_SCHED_TRACE_H) || defined(TRACE_HEADER_MULTI_READ) -+#if !defined(_GPU_SCHED_TRACE_H_) || defined(TRACE_HEADER_MULTI_READ) - #define _GPU_SCHED_TRACE_H_ - - #include -@@ -106,7 +106,7 @@ TRACE_EVENT(drm_sched_job_wait_dep, - __entry->seqno) - ); - --#endif -+#endif /* _GPU_SCHED_TRACE_H_ */ - - /* This part must be outside protection */ - #undef TRACE_INCLUDE_PATH -diff --git a/drivers/hid/hid-appleir.c b/drivers/hid/hid-appleir.c -index 8deded1857254a..c45e5aa569d25f 100644 ---- a/drivers/hid/hid-appleir.c -+++ b/drivers/hid/hid-appleir.c -@@ -188,7 +188,7 @@ static int appleir_raw_event(struct hid_device *hid, struct hid_report *report, - static const u8 flatbattery[] = { 0x25, 0x87, 0xe0 }; - unsigned long flags; - -- if (len != 5) -+ if (len != 5 || !(hid->claimed & HID_CLAIMED_INPUT)) - goto out; - - if (!memcmp(data, keydown, sizeof(keydown))) { -diff --git a/drivers/hid/hid-google-hammer.c b/drivers/hid/hid-google-hammer.c -index c6bdb9c4ef3e00..d25291ed900d02 100644 ---- a/drivers/hid/hid-google-hammer.c -+++ b/drivers/hid/hid-google-hammer.c -@@ -269,11 +269,13 @@ static int cbas_ec_remove(struct platform_device *pdev) - return 0; - } - -+#ifdef CONFIG_ACPI - static const struct acpi_device_id cbas_ec_acpi_ids[] = { - { "GOOG000B", 0 }, - { } - }; - MODULE_DEVICE_TABLE(acpi, cbas_ec_acpi_ids); -+#endif - - #ifdef CONFIG_OF - static const struct of_device_id cbas_ec_of_match[] = { -diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c -index 49c067133975f7..29ff4eb5194b7b 100644 ---- a/drivers/hid/hid-steam.c -+++ b/drivers/hid/hid-steam.c -@@ -1325,11 +1325,11 @@ static void steam_remove(struct hid_device *hdev) - return; - } - -+ hid_destroy_device(steam->client_hdev); - cancel_delayed_work_sync(&steam->mode_switch); - cancel_work_sync(&steam->work_connect); - cancel_work_sync(&steam->rumble_work); - cancel_work_sync(&steam->unregister_work); -- hid_destroy_device(steam->client_hdev); - steam->client_hdev = NULL; - steam->client_opened = false; - if (steam->quirks & STEAM_QUIRK_WIRELESS) { -diff --git a/drivers/hid/intel-ish-hid/ishtp-hid.c b/drivers/hid/intel-ish-hid/ishtp-hid.c -index 00c6f0ebf35633..be2c62fc8251d7 100644 ---- a/drivers/hid/intel-ish-hid/ishtp-hid.c -+++ b/drivers/hid/intel-ish-hid/ishtp-hid.c -@@ -261,12 +261,14 @@ int ishtp_hid_probe(unsigned int cur_hid_dev, - */ - void ishtp_hid_remove(struct ishtp_cl_data *client_data) - { -+ void *data; - int i; - - for (i = 0; i < client_data->num_hid_devices; ++i) { - if (client_data->hid_sensor_hubs[i]) { -- kfree(client_data->hid_sensor_hubs[i]->driver_data); -+ data = client_data->hid_sensor_hubs[i]->driver_data; - hid_destroy_device(client_data->hid_sensor_hubs[i]); -+ kfree(data); - client_data->hid_sensor_hubs[i] = NULL; - } - } -diff --git a/drivers/hwmon/ad7314.c b/drivers/hwmon/ad7314.c -index 7802bbf5f9587f..59424103f6348a 100644 ---- a/drivers/hwmon/ad7314.c -+++ b/drivers/hwmon/ad7314.c -@@ -22,11 +22,13 @@ - */ - #define AD7314_TEMP_MASK 0x7FE0 - #define AD7314_TEMP_SHIFT 5 -+#define AD7314_LEADING_ZEROS_MASK BIT(15) - - /* - * ADT7301 and ADT7302 temperature masks - */ - #define ADT7301_TEMP_MASK 0x3FFF -+#define ADT7301_LEADING_ZEROS_MASK (BIT(15) | BIT(14)) - - enum ad7314_variant { - adt7301, -@@ -65,12 +67,20 @@ static ssize_t ad7314_temperature_show(struct device *dev, - return ret; - switch (spi_get_device_id(chip->spi_dev)->driver_data) { - case ad7314: -+ if (ret & AD7314_LEADING_ZEROS_MASK) { -+ /* Invalid read-out, leading zero part is missing */ -+ return -EIO; -+ } - data = (ret & AD7314_TEMP_MASK) >> AD7314_TEMP_SHIFT; - data = sign_extend32(data, 9); - - return sprintf(buf, "%d\n", 250 * data); - case adt7301: - case adt7302: -+ if (ret & ADT7301_LEADING_ZEROS_MASK) { -+ /* Invalid read-out, leading zero part is missing */ -+ return -EIO; -+ } - /* - * Documented as a 13 bit twos complement register - * with a sign bit - which is a 14 bit 2's complement -diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c -index b5352900463fb9..0d29c8f97ba7c2 100644 ---- a/drivers/hwmon/ntc_thermistor.c -+++ b/drivers/hwmon/ntc_thermistor.c -@@ -181,40 +181,40 @@ static const struct ntc_compensation ncpXXwf104[] = { - }; - - static const struct ntc_compensation ncpXXxh103[] = { -- { .temp_c = -40, .ohm = 247565 }, -- { .temp_c = -35, .ohm = 181742 }, -- { .temp_c = -30, .ohm = 135128 }, -- { .temp_c = -25, .ohm = 101678 }, -- { .temp_c = -20, .ohm = 77373 }, -- { .temp_c = -15, .ohm = 59504 }, -- { .temp_c = -10, .ohm = 46222 }, -- { .temp_c = -5, .ohm = 36244 }, -- { .temp_c = 0, .ohm = 28674 }, -- { .temp_c = 5, .ohm = 22878 }, -- { .temp_c = 10, .ohm = 18399 }, -- { .temp_c = 15, .ohm = 14910 }, -- { .temp_c = 20, .ohm = 12169 }, -+ { .temp_c = -40, .ohm = 195652 }, -+ { .temp_c = -35, .ohm = 148171 }, -+ { .temp_c = -30, .ohm = 113347 }, -+ { .temp_c = -25, .ohm = 87559 }, -+ { .temp_c = -20, .ohm = 68237 }, -+ { .temp_c = -15, .ohm = 53650 }, -+ { .temp_c = -10, .ohm = 42506 }, -+ { .temp_c = -5, .ohm = 33892 }, -+ { .temp_c = 0, .ohm = 27219 }, -+ { .temp_c = 5, .ohm = 22021 }, -+ { .temp_c = 10, .ohm = 17926 }, -+ { .temp_c = 15, .ohm = 14674 }, -+ { .temp_c = 20, .ohm = 12081 }, - { .temp_c = 25, .ohm = 10000 }, -- { .temp_c = 30, .ohm = 8271 }, -- { .temp_c = 35, .ohm = 6883 }, -- { .temp_c = 40, .ohm = 5762 }, -- { .temp_c = 45, .ohm = 4851 }, -- { .temp_c = 50, .ohm = 4105 }, -- { .temp_c = 55, .ohm = 3492 }, -- { .temp_c = 60, .ohm = 2985 }, -- { .temp_c = 65, .ohm = 2563 }, -- { .temp_c = 70, .ohm = 2211 }, -- { .temp_c = 75, .ohm = 1915 }, -- { .temp_c = 80, .ohm = 1666 }, -- { .temp_c = 85, .ohm = 1454 }, -- { .temp_c = 90, .ohm = 1275 }, -- { .temp_c = 95, .ohm = 1121 }, -- { .temp_c = 100, .ohm = 990 }, -- { .temp_c = 105, .ohm = 876 }, -- { .temp_c = 110, .ohm = 779 }, -- { .temp_c = 115, .ohm = 694 }, -- { .temp_c = 120, .ohm = 620 }, -- { .temp_c = 125, .ohm = 556 }, -+ { .temp_c = 30, .ohm = 8315 }, -+ { .temp_c = 35, .ohm = 6948 }, -+ { .temp_c = 40, .ohm = 5834 }, -+ { .temp_c = 45, .ohm = 4917 }, -+ { .temp_c = 50, .ohm = 4161 }, -+ { .temp_c = 55, .ohm = 3535 }, -+ { .temp_c = 60, .ohm = 3014 }, -+ { .temp_c = 65, .ohm = 2586 }, -+ { .temp_c = 70, .ohm = 2228 }, -+ { .temp_c = 75, .ohm = 1925 }, -+ { .temp_c = 80, .ohm = 1669 }, -+ { .temp_c = 85, .ohm = 1452 }, -+ { .temp_c = 90, .ohm = 1268 }, -+ { .temp_c = 95, .ohm = 1110 }, -+ { .temp_c = 100, .ohm = 974 }, -+ { .temp_c = 105, .ohm = 858 }, -+ { .temp_c = 110, .ohm = 758 }, -+ { .temp_c = 115, .ohm = 672 }, -+ { .temp_c = 120, .ohm = 596 }, -+ { .temp_c = 125, .ohm = 531 }, - }; - - /* -diff --git a/drivers/hwmon/peci/dimmtemp.c b/drivers/hwmon/peci/dimmtemp.c -index 5ca4d04e4b14ab..01329fce390938 100644 ---- a/drivers/hwmon/peci/dimmtemp.c -+++ b/drivers/hwmon/peci/dimmtemp.c -@@ -127,8 +127,6 @@ static int update_thresholds(struct peci_dimmtemp *priv, int dimm_no) - return 0; - - ret = priv->gen_info->read_thresholds(priv, dimm_order, chan_rank, &data); -- if (ret == -ENODATA) /* Use default or previous value */ -- return 0; - if (ret) - return ret; - -@@ -509,11 +507,11 @@ read_thresholds_icx(struct peci_dimmtemp *priv, int dimm_order, int chan_rank, u - - ret = peci_ep_pci_local_read(priv->peci_dev, 0, 13, 0, 2, 0xd4, ®_val); - if (ret || !(reg_val & BIT(31))) -- return -ENODATA; /* Use default or previous value */ -+ return -ENODATA; - - ret = peci_ep_pci_local_read(priv->peci_dev, 0, 13, 0, 2, 0xd0, ®_val); - if (ret) -- return -ENODATA; /* Use default or previous value */ -+ return -ENODATA; - - /* - * Device 26, Offset 224e0: IMC 0 channel 0 -> rank 0 -@@ -546,11 +544,11 @@ read_thresholds_spr(struct peci_dimmtemp *priv, int dimm_order, int chan_rank, u - - ret = peci_ep_pci_local_read(priv->peci_dev, 0, 30, 0, 2, 0xd4, ®_val); - if (ret || !(reg_val & BIT(31))) -- return -ENODATA; /* Use default or previous value */ -+ return -ENODATA; - - ret = peci_ep_pci_local_read(priv->peci_dev, 0, 30, 0, 2, 0xd0, ®_val); - if (ret) -- return -ENODATA; /* Use default or previous value */ -+ return -ENODATA; - - /* - * Device 26, Offset 219a8: IMC 0 channel 0 -> rank 0 -diff --git a/drivers/hwmon/pmbus/pmbus.c b/drivers/hwmon/pmbus/pmbus.c -index ec40c5c599543a..59424dc518c8f9 100644 ---- a/drivers/hwmon/pmbus/pmbus.c -+++ b/drivers/hwmon/pmbus/pmbus.c -@@ -103,6 +103,8 @@ static int pmbus_identify(struct i2c_client *client, - if (pmbus_check_byte_register(client, 0, PMBUS_PAGE)) { - int page; - -+ info->pages = PMBUS_PAGES; -+ - for (page = 1; page < PMBUS_PAGES; page++) { - if (pmbus_set_page(client, page, 0xff) < 0) - break; -diff --git a/drivers/hwmon/xgene-hwmon.c b/drivers/hwmon/xgene-hwmon.c -index 78d9f52e2a7194..207084d55044a1 100644 ---- a/drivers/hwmon/xgene-hwmon.c -+++ b/drivers/hwmon/xgene-hwmon.c -@@ -712,7 +712,7 @@ static int xgene_hwmon_probe(struct platform_device *pdev) - goto out; - } - -- if (!ctx->pcc_comm_addr) { -+ if (IS_ERR_OR_NULL(ctx->pcc_comm_addr)) { - dev_err(&pdev->dev, - "Failed to ioremap PCC comm region\n"); - rc = -ENOMEM; -diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c -index 8dad239aba2cea..e7985db1f29b36 100644 ---- a/drivers/hwtracing/intel_th/pci.c -+++ b/drivers/hwtracing/intel_th/pci.c -@@ -329,6 +329,21 @@ static const struct pci_device_id intel_th_pci_id_table[] = { - PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa824), - .driver_data = (kernel_ulong_t)&intel_th_2x, - }, -+ { -+ /* Arrow Lake */ -+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x7724), -+ .driver_data = (kernel_ulong_t)&intel_th_2x, -+ }, -+ { -+ /* Panther Lake-H */ -+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xe324), -+ .driver_data = (kernel_ulong_t)&intel_th_2x, -+ }, -+ { -+ /* Panther Lake-P/U */ -+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xe424), -+ .driver_data = (kernel_ulong_t)&intel_th_2x, -+ }, - { - /* Alder Lake CPU */ - PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x466f), -diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c -index df67b63ccf69ca..b54e4481fafb4d 100644 ---- a/drivers/iio/adc/at91-sama5d2_adc.c -+++ b/drivers/iio/adc/at91-sama5d2_adc.c -@@ -329,7 +329,7 @@ static const struct at91_adc_reg_layout sama7g5_layout = { - #define AT91_HWFIFO_MAX_SIZE_STR "128" - #define AT91_HWFIFO_MAX_SIZE 128 - --#define AT91_SAMA5D2_CHAN_SINGLE(index, num, addr) \ -+#define AT91_SAMA_CHAN_SINGLE(index, num, addr, rbits) \ - { \ - .type = IIO_VOLTAGE, \ - .channel = num, \ -@@ -337,7 +337,7 @@ static const struct at91_adc_reg_layout sama7g5_layout = { - .scan_index = index, \ - .scan_type = { \ - .sign = 'u', \ -- .realbits = 14, \ -+ .realbits = rbits, \ - .storagebits = 16, \ - }, \ - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), \ -@@ -350,7 +350,13 @@ static const struct at91_adc_reg_layout sama7g5_layout = { - .indexed = 1, \ - } - --#define AT91_SAMA5D2_CHAN_DIFF(index, num, num2, addr) \ -+#define AT91_SAMA5D2_CHAN_SINGLE(index, num, addr) \ -+ AT91_SAMA_CHAN_SINGLE(index, num, addr, 14) -+ -+#define AT91_SAMA7G5_CHAN_SINGLE(index, num, addr) \ -+ AT91_SAMA_CHAN_SINGLE(index, num, addr, 16) -+ -+#define AT91_SAMA_CHAN_DIFF(index, num, num2, addr, rbits) \ - { \ - .type = IIO_VOLTAGE, \ - .differential = 1, \ -@@ -360,7 +366,7 @@ static const struct at91_adc_reg_layout sama7g5_layout = { - .scan_index = index, \ - .scan_type = { \ - .sign = 's', \ -- .realbits = 14, \ -+ .realbits = rbits, \ - .storagebits = 16, \ - }, \ - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), \ -@@ -373,6 +379,12 @@ static const struct at91_adc_reg_layout sama7g5_layout = { - .indexed = 1, \ - } - -+#define AT91_SAMA5D2_CHAN_DIFF(index, num, num2, addr) \ -+ AT91_SAMA_CHAN_DIFF(index, num, num2, addr, 14) -+ -+#define AT91_SAMA7G5_CHAN_DIFF(index, num, num2, addr) \ -+ AT91_SAMA_CHAN_DIFF(index, num, num2, addr, 16) -+ - #define AT91_SAMA5D2_CHAN_TOUCH(num, name, mod) \ - { \ - .type = IIO_POSITIONRELATIVE, \ -@@ -666,30 +678,30 @@ static const struct iio_chan_spec at91_sama5d2_adc_channels[] = { - }; - - static const struct iio_chan_spec at91_sama7g5_adc_channels[] = { -- AT91_SAMA5D2_CHAN_SINGLE(0, 0, 0x60), -- AT91_SAMA5D2_CHAN_SINGLE(1, 1, 0x64), -- AT91_SAMA5D2_CHAN_SINGLE(2, 2, 0x68), -- AT91_SAMA5D2_CHAN_SINGLE(3, 3, 0x6c), -- AT91_SAMA5D2_CHAN_SINGLE(4, 4, 0x70), -- AT91_SAMA5D2_CHAN_SINGLE(5, 5, 0x74), -- AT91_SAMA5D2_CHAN_SINGLE(6, 6, 0x78), -- AT91_SAMA5D2_CHAN_SINGLE(7, 7, 0x7c), -- AT91_SAMA5D2_CHAN_SINGLE(8, 8, 0x80), -- AT91_SAMA5D2_CHAN_SINGLE(9, 9, 0x84), -- AT91_SAMA5D2_CHAN_SINGLE(10, 10, 0x88), -- AT91_SAMA5D2_CHAN_SINGLE(11, 11, 0x8c), -- AT91_SAMA5D2_CHAN_SINGLE(12, 12, 0x90), -- AT91_SAMA5D2_CHAN_SINGLE(13, 13, 0x94), -- AT91_SAMA5D2_CHAN_SINGLE(14, 14, 0x98), -- AT91_SAMA5D2_CHAN_SINGLE(15, 15, 0x9c), -- AT91_SAMA5D2_CHAN_DIFF(16, 0, 1, 0x60), -- AT91_SAMA5D2_CHAN_DIFF(17, 2, 3, 0x68), -- AT91_SAMA5D2_CHAN_DIFF(18, 4, 5, 0x70), -- AT91_SAMA5D2_CHAN_DIFF(19, 6, 7, 0x78), -- AT91_SAMA5D2_CHAN_DIFF(20, 8, 9, 0x80), -- AT91_SAMA5D2_CHAN_DIFF(21, 10, 11, 0x88), -- AT91_SAMA5D2_CHAN_DIFF(22, 12, 13, 0x90), -- AT91_SAMA5D2_CHAN_DIFF(23, 14, 15, 0x98), -+ AT91_SAMA7G5_CHAN_SINGLE(0, 0, 0x60), -+ AT91_SAMA7G5_CHAN_SINGLE(1, 1, 0x64), -+ AT91_SAMA7G5_CHAN_SINGLE(2, 2, 0x68), -+ AT91_SAMA7G5_CHAN_SINGLE(3, 3, 0x6c), -+ AT91_SAMA7G5_CHAN_SINGLE(4, 4, 0x70), -+ AT91_SAMA7G5_CHAN_SINGLE(5, 5, 0x74), -+ AT91_SAMA7G5_CHAN_SINGLE(6, 6, 0x78), -+ AT91_SAMA7G5_CHAN_SINGLE(7, 7, 0x7c), -+ AT91_SAMA7G5_CHAN_SINGLE(8, 8, 0x80), -+ AT91_SAMA7G5_CHAN_SINGLE(9, 9, 0x84), -+ AT91_SAMA7G5_CHAN_SINGLE(10, 10, 0x88), -+ AT91_SAMA7G5_CHAN_SINGLE(11, 11, 0x8c), -+ AT91_SAMA7G5_CHAN_SINGLE(12, 12, 0x90), -+ AT91_SAMA7G5_CHAN_SINGLE(13, 13, 0x94), -+ AT91_SAMA7G5_CHAN_SINGLE(14, 14, 0x98), -+ AT91_SAMA7G5_CHAN_SINGLE(15, 15, 0x9c), -+ AT91_SAMA7G5_CHAN_DIFF(16, 0, 1, 0x60), -+ AT91_SAMA7G5_CHAN_DIFF(17, 2, 3, 0x68), -+ AT91_SAMA7G5_CHAN_DIFF(18, 4, 5, 0x70), -+ AT91_SAMA7G5_CHAN_DIFF(19, 6, 7, 0x78), -+ AT91_SAMA7G5_CHAN_DIFF(20, 8, 9, 0x80), -+ AT91_SAMA7G5_CHAN_DIFF(21, 10, 11, 0x88), -+ AT91_SAMA7G5_CHAN_DIFF(22, 12, 13, 0x90), -+ AT91_SAMA7G5_CHAN_DIFF(23, 14, 15, 0x98), - IIO_CHAN_SOFT_TIMESTAMP(24), - AT91_SAMA5D2_CHAN_TEMP(AT91_SAMA7G5_ADC_TEMP_CHANNEL, "temp", 0xdc), - }; -diff --git a/drivers/iio/dac/ad3552r.c b/drivers/iio/dac/ad3552r.c -index a492e8f2fc0fbc..130bda62022293 100644 ---- a/drivers/iio/dac/ad3552r.c -+++ b/drivers/iio/dac/ad3552r.c -@@ -703,6 +703,12 @@ static int ad3552r_reset(struct ad3552r_desc *dac) - return ret; - } - -+ /* Clear reset error flag, see ad3552r manual, rev B table 38. */ -+ ret = ad3552r_write_reg(dac, AD3552R_REG_ADDR_ERR_STATUS, -+ AD3552R_MASK_RESET_STATUS); -+ if (ret) -+ return ret; -+ - return ad3552r_update_reg_field(dac, - addr_mask_map[AD3552R_ADDR_ASCENSION][0], - addr_mask_map[AD3552R_ADDR_ASCENSION][1], -diff --git a/drivers/iio/filter/admv8818.c b/drivers/iio/filter/admv8818.c -index 848baa6e3bbf5d..d85b7d3de86604 100644 ---- a/drivers/iio/filter/admv8818.c -+++ b/drivers/iio/filter/admv8818.c -@@ -574,21 +574,15 @@ static int admv8818_init(struct admv8818_state *st) - struct spi_device *spi = st->spi; - unsigned int chip_id; - -- ret = regmap_update_bits(st->regmap, ADMV8818_REG_SPI_CONFIG_A, -- ADMV8818_SOFTRESET_N_MSK | -- ADMV8818_SOFTRESET_MSK, -- FIELD_PREP(ADMV8818_SOFTRESET_N_MSK, 1) | -- FIELD_PREP(ADMV8818_SOFTRESET_MSK, 1)); -+ ret = regmap_write(st->regmap, ADMV8818_REG_SPI_CONFIG_A, -+ ADMV8818_SOFTRESET_N_MSK | ADMV8818_SOFTRESET_MSK); - if (ret) { - dev_err(&spi->dev, "ADMV8818 Soft Reset failed.\n"); - return ret; - } - -- ret = regmap_update_bits(st->regmap, ADMV8818_REG_SPI_CONFIG_A, -- ADMV8818_SDOACTIVE_N_MSK | -- ADMV8818_SDOACTIVE_MSK, -- FIELD_PREP(ADMV8818_SDOACTIVE_N_MSK, 1) | -- FIELD_PREP(ADMV8818_SDOACTIVE_MSK, 1)); -+ ret = regmap_write(st->regmap, ADMV8818_REG_SPI_CONFIG_A, -+ ADMV8818_SDOACTIVE_N_MSK | ADMV8818_SDOACTIVE_MSK); - if (ret) { - dev_err(&spi->dev, "ADMV8818 SDO Enable failed.\n"); - return ret; -diff --git a/drivers/misc/cardreader/rtsx_usb.c b/drivers/misc/cardreader/rtsx_usb.c -index 285a748748d701..f150d8769f1986 100644 ---- a/drivers/misc/cardreader/rtsx_usb.c -+++ b/drivers/misc/cardreader/rtsx_usb.c -@@ -286,7 +286,6 @@ static int rtsx_usb_get_status_with_bulk(struct rtsx_ucr *ucr, u16 *status) - int rtsx_usb_get_card_status(struct rtsx_ucr *ucr, u16 *status) - { - int ret; -- u8 interrupt_val = 0; - u16 *buf; - - if (!status) -@@ -309,20 +308,6 @@ int rtsx_usb_get_card_status(struct rtsx_ucr *ucr, u16 *status) - ret = rtsx_usb_get_status_with_bulk(ucr, status); - } - -- rtsx_usb_read_register(ucr, CARD_INT_PEND, &interrupt_val); -- /* Cross check presence with interrupts */ -- if (*status & XD_CD) -- if (!(interrupt_val & XD_INT)) -- *status &= ~XD_CD; -- -- if (*status & SD_CD) -- if (!(interrupt_val & SD_INT)) -- *status &= ~SD_CD; -- -- if (*status & MS_CD) -- if (!(interrupt_val & MS_INT)) -- *status &= ~MS_CD; -- - /* usb_control_msg may return positive when success */ - if (ret < 0) - return ret; -diff --git a/drivers/misc/eeprom/digsy_mtc_eeprom.c b/drivers/misc/eeprom/digsy_mtc_eeprom.c -index 4eddc5ba1af9c8..dfaedc0e350dbd 100644 ---- a/drivers/misc/eeprom/digsy_mtc_eeprom.c -+++ b/drivers/misc/eeprom/digsy_mtc_eeprom.c -@@ -60,7 +60,7 @@ static struct platform_device digsy_mtc_eeprom = { - }; - - static struct gpiod_lookup_table eeprom_spi_gpiod_table = { -- .dev_id = "spi_gpio", -+ .dev_id = "spi_gpio.1", - .table = { - GPIO_LOOKUP("gpio@b00", GPIO_EEPROM_CLK, - "sck", GPIO_ACTIVE_HIGH), -diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h -index d3c03d4edbeff3..a4668ddd94551a 100644 ---- a/drivers/misc/mei/hw-me-regs.h -+++ b/drivers/misc/mei/hw-me-regs.h -@@ -117,6 +117,8 @@ - - #define MEI_DEV_ID_LNL_M 0xA870 /* Lunar Lake Point M */ - -+#define MEI_DEV_ID_PTL_P 0xE470 /* Panther Lake P */ -+ - /* - * MEI HW Section - */ -diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c -index 6c4f5e9fe834dc..6826cc50d29f36 100644 ---- a/drivers/misc/mei/pci-me.c -+++ b/drivers/misc/mei/pci-me.c -@@ -124,6 +124,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = { - - {MEI_PCI_DEVICE(MEI_DEV_ID_LNL_M, MEI_ME_PCH15_CFG)}, - -+ {MEI_PCI_DEVICE(MEI_DEV_ID_PTL_P, MEI_ME_PCH15_CFG)}, -+ - /* required last entry */ - {0, } - }; -diff --git a/drivers/net/caif/caif_virtio.c b/drivers/net/caif/caif_virtio.c -index 0b0f234b0b5080..a8b9ada7526c7a 100644 ---- a/drivers/net/caif/caif_virtio.c -+++ b/drivers/net/caif/caif_virtio.c -@@ -745,7 +745,7 @@ static int cfv_probe(struct virtio_device *vdev) - - if (cfv->vr_rx) - vdev->vringh_config->del_vrhs(cfv->vdev); -- if (cfv->vdev) -+ if (cfv->vq_tx) - vdev->config->del_vqs(cfv->vdev); - free_netdev(netdev); - return err; -diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c -index 53ead0989777ff..90ab2f1058ce0e 100644 ---- a/drivers/net/dsa/mt7530.c -+++ b/drivers/net/dsa/mt7530.c -@@ -2640,7 +2640,8 @@ mt7531_setup_common(struct dsa_switch *ds) - if (ret < 0) - return ret; - -- return 0; -+ /* Setup VLAN ID 0 for VLAN-unaware bridges */ -+ return mt7530_setup_vlan0(priv); - } - - static int -@@ -2734,11 +2735,6 @@ mt7531_setup(struct dsa_switch *ds) - - mt7531_setup_common(ds); - -- /* Setup VLAN ID 0 for VLAN-unaware bridges */ -- ret = mt7530_setup_vlan0(priv); -- if (ret) -- return ret; -- - ds->assisted_learning_on_cpu_port = true; - ds->mtu_enforcement_ingress = true; - -diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h -index 61fe9625bed1f2..06f42e5b5149f2 100644 ---- a/drivers/net/ethernet/emulex/benet/be.h -+++ b/drivers/net/ethernet/emulex/benet/be.h -@@ -562,7 +562,7 @@ struct be_adapter { - struct be_dma_mem mbox_mem_alloced; - - struct be_mcc_obj mcc_obj; -- struct mutex mcc_lock; /* For serializing mcc cmds to BE card */ -+ spinlock_t mcc_lock; /* For serializing mcc cmds to BE card */ - spinlock_t mcc_cq_lock; - - u16 cfg_num_rx_irqs; /* configured via set-channels */ -diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c -index 61adcebeef0107..51b8377edd1d04 100644 ---- a/drivers/net/ethernet/emulex/benet/be_cmds.c -+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c -@@ -575,7 +575,7 @@ int be_process_mcc(struct be_adapter *adapter) - /* Wait till no more pending mcc requests are present */ - static int be_mcc_wait_compl(struct be_adapter *adapter) - { --#define mcc_timeout 12000 /* 12s timeout */ -+#define mcc_timeout 120000 /* 12s timeout */ - int i, status = 0; - struct be_mcc_obj *mcc_obj = &adapter->mcc_obj; - -@@ -589,7 +589,7 @@ static int be_mcc_wait_compl(struct be_adapter *adapter) - - if (atomic_read(&mcc_obj->q.used) == 0) - break; -- usleep_range(500, 1000); -+ udelay(100); - } - if (i == mcc_timeout) { - dev_err(&adapter->pdev->dev, "FW not responding\n"); -@@ -866,7 +866,7 @@ static bool use_mcc(struct be_adapter *adapter) - static int be_cmd_lock(struct be_adapter *adapter) - { - if (use_mcc(adapter)) { -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - return 0; - } else { - return mutex_lock_interruptible(&adapter->mbox_lock); -@@ -877,7 +877,7 @@ static int be_cmd_lock(struct be_adapter *adapter) - static void be_cmd_unlock(struct be_adapter *adapter) - { - if (use_mcc(adapter)) -- return mutex_unlock(&adapter->mcc_lock); -+ return spin_unlock_bh(&adapter->mcc_lock); - else - return mutex_unlock(&adapter->mbox_lock); - } -@@ -1047,7 +1047,7 @@ int be_cmd_mac_addr_query(struct be_adapter *adapter, u8 *mac_addr, - struct be_cmd_req_mac_query *req; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -1076,7 +1076,7 @@ int be_cmd_mac_addr_query(struct be_adapter *adapter, u8 *mac_addr, - } - - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -1088,7 +1088,7 @@ int be_cmd_pmac_add(struct be_adapter *adapter, const u8 *mac_addr, - struct be_cmd_req_pmac_add *req; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -1113,7 +1113,7 @@ int be_cmd_pmac_add(struct be_adapter *adapter, const u8 *mac_addr, - } - - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - - if (base_status(status) == MCC_STATUS_UNAUTHORIZED_REQUEST) - status = -EPERM; -@@ -1131,7 +1131,7 @@ int be_cmd_pmac_del(struct be_adapter *adapter, u32 if_id, int pmac_id, u32 dom) - if (pmac_id == -1) - return 0; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -1151,7 +1151,7 @@ int be_cmd_pmac_del(struct be_adapter *adapter, u32 if_id, int pmac_id, u32 dom) - status = be_mcc_notify_wait(adapter); - - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -1414,7 +1414,7 @@ int be_cmd_rxq_create(struct be_adapter *adapter, - struct be_dma_mem *q_mem = &rxq->dma_mem; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -1444,7 +1444,7 @@ int be_cmd_rxq_create(struct be_adapter *adapter, - } - - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -1508,7 +1508,7 @@ int be_cmd_rxq_destroy(struct be_adapter *adapter, struct be_queue_info *q) - struct be_cmd_req_q_destroy *req; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -1525,7 +1525,7 @@ int be_cmd_rxq_destroy(struct be_adapter *adapter, struct be_queue_info *q) - q->created = false; - - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -1593,7 +1593,7 @@ int be_cmd_get_stats(struct be_adapter *adapter, struct be_dma_mem *nonemb_cmd) - struct be_cmd_req_hdr *hdr; - int status = 0; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -1621,7 +1621,7 @@ int be_cmd_get_stats(struct be_adapter *adapter, struct be_dma_mem *nonemb_cmd) - adapter->stats_cmd_sent = true; - - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -1637,7 +1637,7 @@ int lancer_cmd_get_pport_stats(struct be_adapter *adapter, - CMD_SUBSYSTEM_ETH)) - return -EPERM; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -1660,7 +1660,7 @@ int lancer_cmd_get_pport_stats(struct be_adapter *adapter, - adapter->stats_cmd_sent = true; - - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -1697,7 +1697,7 @@ int be_cmd_link_status_query(struct be_adapter *adapter, u16 *link_speed, - struct be_cmd_req_link_status *req; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - if (link_status) - *link_status = LINK_DOWN; -@@ -1736,7 +1736,7 @@ int be_cmd_link_status_query(struct be_adapter *adapter, u16 *link_speed, - } - - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -1747,7 +1747,7 @@ int be_cmd_get_die_temperature(struct be_adapter *adapter) - struct be_cmd_req_get_cntl_addnl_attribs *req; - int status = 0; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -1762,7 +1762,7 @@ int be_cmd_get_die_temperature(struct be_adapter *adapter) - - status = be_mcc_notify(adapter); - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -1811,7 +1811,7 @@ int be_cmd_get_fat_dump(struct be_adapter *adapter, u32 buf_len, void *buf) - if (!get_fat_cmd.va) - return -ENOMEM; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - while (total_size) { - buf_size = min(total_size, (u32)60 * 1024); -@@ -1849,9 +1849,9 @@ int be_cmd_get_fat_dump(struct be_adapter *adapter, u32 buf_len, void *buf) - log_offset += buf_size; - } - err: -+ spin_unlock_bh(&adapter->mcc_lock); - dma_free_coherent(&adapter->pdev->dev, get_fat_cmd.size, - get_fat_cmd.va, get_fat_cmd.dma); -- mutex_unlock(&adapter->mcc_lock); - return status; - } - -@@ -1862,7 +1862,7 @@ int be_cmd_get_fw_ver(struct be_adapter *adapter) - struct be_cmd_req_get_fw_version *req; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -1885,7 +1885,7 @@ int be_cmd_get_fw_ver(struct be_adapter *adapter) - sizeof(adapter->fw_on_flash)); - } - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -1899,7 +1899,7 @@ static int __be_cmd_modify_eqd(struct be_adapter *adapter, - struct be_cmd_req_modify_eq_delay *req; - int status = 0, i; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -1922,7 +1922,7 @@ static int __be_cmd_modify_eqd(struct be_adapter *adapter, - - status = be_mcc_notify(adapter); - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -1949,7 +1949,7 @@ int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array, - struct be_cmd_req_vlan_config *req; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -1971,7 +1971,7 @@ int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array, - - status = be_mcc_notify_wait(adapter); - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -1982,7 +1982,7 @@ static int __be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 value) - struct be_cmd_req_rx_filter *req = mem->va; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -2015,7 +2015,7 @@ static int __be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 value) - - status = be_mcc_notify_wait(adapter); - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -2046,7 +2046,7 @@ int be_cmd_set_flow_control(struct be_adapter *adapter, u32 tx_fc, u32 rx_fc) - CMD_SUBSYSTEM_COMMON)) - return -EPERM; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -2066,7 +2066,7 @@ int be_cmd_set_flow_control(struct be_adapter *adapter, u32 tx_fc, u32 rx_fc) - status = be_mcc_notify_wait(adapter); - - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - - if (base_status(status) == MCC_STATUS_FEATURE_NOT_SUPPORTED) - return -EOPNOTSUPP; -@@ -2085,7 +2085,7 @@ int be_cmd_get_flow_control(struct be_adapter *adapter, u32 *tx_fc, u32 *rx_fc) - CMD_SUBSYSTEM_COMMON)) - return -EPERM; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -2108,7 +2108,7 @@ int be_cmd_get_flow_control(struct be_adapter *adapter, u32 *tx_fc, u32 *rx_fc) - } - - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -2189,7 +2189,7 @@ int be_cmd_rss_config(struct be_adapter *adapter, u8 *rsstable, - if (!(be_if_cap_flags(adapter) & BE_IF_FLAGS_RSS)) - return 0; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -2214,7 +2214,7 @@ int be_cmd_rss_config(struct be_adapter *adapter, u8 *rsstable, - - status = be_mcc_notify_wait(adapter); - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -2226,7 +2226,7 @@ int be_cmd_set_beacon_state(struct be_adapter *adapter, u8 port_num, - struct be_cmd_req_enable_disable_beacon *req; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -2247,7 +2247,7 @@ int be_cmd_set_beacon_state(struct be_adapter *adapter, u8 port_num, - status = be_mcc_notify_wait(adapter); - - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -2258,7 +2258,7 @@ int be_cmd_get_beacon_state(struct be_adapter *adapter, u8 port_num, u32 *state) - struct be_cmd_req_get_beacon_state *req; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -2282,7 +2282,7 @@ int be_cmd_get_beacon_state(struct be_adapter *adapter, u8 port_num, u32 *state) - } - - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -2306,7 +2306,7 @@ int be_cmd_read_port_transceiver_data(struct be_adapter *adapter, - return -ENOMEM; - } - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -2328,7 +2328,7 @@ int be_cmd_read_port_transceiver_data(struct be_adapter *adapter, - memcpy(data, resp->page_data + off, len); - } - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - dma_free_coherent(&adapter->pdev->dev, cmd.size, cmd.va, cmd.dma); - return status; - } -@@ -2345,7 +2345,7 @@ static int lancer_cmd_write_object(struct be_adapter *adapter, - void *ctxt = NULL; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - adapter->flash_status = 0; - - wrb = wrb_from_mccq(adapter); -@@ -2387,7 +2387,7 @@ static int lancer_cmd_write_object(struct be_adapter *adapter, - if (status) - goto err_unlock; - -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - - if (!wait_for_completion_timeout(&adapter->et_cmd_compl, - msecs_to_jiffies(60000))) -@@ -2406,7 +2406,7 @@ static int lancer_cmd_write_object(struct be_adapter *adapter, - return status; - - err_unlock: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -2460,7 +2460,7 @@ static int lancer_cmd_delete_object(struct be_adapter *adapter, - struct be_mcc_wrb *wrb; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -2478,7 +2478,7 @@ static int lancer_cmd_delete_object(struct be_adapter *adapter, - - status = be_mcc_notify_wait(adapter); - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -2491,7 +2491,7 @@ int lancer_cmd_read_object(struct be_adapter *adapter, struct be_dma_mem *cmd, - struct lancer_cmd_resp_read_object *resp; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -2525,7 +2525,7 @@ int lancer_cmd_read_object(struct be_adapter *adapter, struct be_dma_mem *cmd, - } - - err_unlock: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -2537,7 +2537,7 @@ static int be_cmd_write_flashrom(struct be_adapter *adapter, - struct be_cmd_write_flashrom *req; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - adapter->flash_status = 0; - - wrb = wrb_from_mccq(adapter); -@@ -2562,7 +2562,7 @@ static int be_cmd_write_flashrom(struct be_adapter *adapter, - if (status) - goto err_unlock; - -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - - if (!wait_for_completion_timeout(&adapter->et_cmd_compl, - msecs_to_jiffies(40000))) -@@ -2573,7 +2573,7 @@ static int be_cmd_write_flashrom(struct be_adapter *adapter, - return status; - - err_unlock: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -2584,7 +2584,7 @@ static int be_cmd_get_flash_crc(struct be_adapter *adapter, u8 *flashed_crc, - struct be_mcc_wrb *wrb; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -2611,7 +2611,7 @@ static int be_cmd_get_flash_crc(struct be_adapter *adapter, u8 *flashed_crc, - memcpy(flashed_crc, req->crc, 4); - - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -3217,7 +3217,7 @@ int be_cmd_enable_magic_wol(struct be_adapter *adapter, u8 *mac, - struct be_cmd_req_acpi_wol_magic_config *req; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -3234,7 +3234,7 @@ int be_cmd_enable_magic_wol(struct be_adapter *adapter, u8 *mac, - status = be_mcc_notify_wait(adapter); - - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -3249,7 +3249,7 @@ int be_cmd_set_loopback(struct be_adapter *adapter, u8 port_num, - CMD_SUBSYSTEM_LOWLEVEL)) - return -EPERM; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -3272,7 +3272,7 @@ int be_cmd_set_loopback(struct be_adapter *adapter, u8 port_num, - if (status) - goto err_unlock; - -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - - if (!wait_for_completion_timeout(&adapter->et_cmd_compl, - msecs_to_jiffies(SET_LB_MODE_TIMEOUT))) -@@ -3281,7 +3281,7 @@ int be_cmd_set_loopback(struct be_adapter *adapter, u8 port_num, - return status; - - err_unlock: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -3298,7 +3298,7 @@ int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num, - CMD_SUBSYSTEM_LOWLEVEL)) - return -EPERM; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -3324,7 +3324,7 @@ int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num, - if (status) - goto err; - -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - - wait_for_completion(&adapter->et_cmd_compl); - resp = embedded_payload(wrb); -@@ -3332,7 +3332,7 @@ int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num, - - return status; - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -3348,7 +3348,7 @@ int be_cmd_ddr_dma_test(struct be_adapter *adapter, u64 pattern, - CMD_SUBSYSTEM_LOWLEVEL)) - return -EPERM; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -3382,7 +3382,7 @@ int be_cmd_ddr_dma_test(struct be_adapter *adapter, u64 pattern, - } - - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -3393,7 +3393,7 @@ int be_cmd_get_seeprom_data(struct be_adapter *adapter, - struct be_cmd_req_seeprom_read *req; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -3409,7 +3409,7 @@ int be_cmd_get_seeprom_data(struct be_adapter *adapter, - status = be_mcc_notify_wait(adapter); - - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -3424,7 +3424,7 @@ int be_cmd_get_phy_info(struct be_adapter *adapter) - CMD_SUBSYSTEM_COMMON)) - return -EPERM; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -3469,7 +3469,7 @@ int be_cmd_get_phy_info(struct be_adapter *adapter) - } - dma_free_coherent(&adapter->pdev->dev, cmd.size, cmd.va, cmd.dma); - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -3479,7 +3479,7 @@ static int be_cmd_set_qos(struct be_adapter *adapter, u32 bps, u32 domain) - struct be_cmd_req_set_qos *req; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -3499,7 +3499,7 @@ static int be_cmd_set_qos(struct be_adapter *adapter, u32 bps, u32 domain) - status = be_mcc_notify_wait(adapter); - - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -3611,7 +3611,7 @@ int be_cmd_get_fn_privileges(struct be_adapter *adapter, u32 *privilege, - struct be_cmd_req_get_fn_privileges *req; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -3643,7 +3643,7 @@ int be_cmd_get_fn_privileges(struct be_adapter *adapter, u32 *privilege, - } - - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -3655,7 +3655,7 @@ int be_cmd_set_fn_privileges(struct be_adapter *adapter, u32 privileges, - struct be_cmd_req_set_fn_privileges *req; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -3675,7 +3675,7 @@ int be_cmd_set_fn_privileges(struct be_adapter *adapter, u32 privileges, - - status = be_mcc_notify_wait(adapter); - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -3707,7 +3707,7 @@ int be_cmd_get_mac_from_list(struct be_adapter *adapter, u8 *mac, - return -ENOMEM; - } - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -3771,7 +3771,7 @@ int be_cmd_get_mac_from_list(struct be_adapter *adapter, u8 *mac, - } - - out: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - dma_free_coherent(&adapter->pdev->dev, get_mac_list_cmd.size, - get_mac_list_cmd.va, get_mac_list_cmd.dma); - return status; -@@ -3831,7 +3831,7 @@ int be_cmd_set_mac_list(struct be_adapter *adapter, u8 *mac_array, - if (!cmd.va) - return -ENOMEM; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -3853,7 +3853,7 @@ int be_cmd_set_mac_list(struct be_adapter *adapter, u8 *mac_array, - - err: - dma_free_coherent(&adapter->pdev->dev, cmd.size, cmd.va, cmd.dma); -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -3889,7 +3889,7 @@ int be_cmd_set_hsw_config(struct be_adapter *adapter, u16 pvid, - CMD_SUBSYSTEM_COMMON)) - return -EPERM; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -3930,7 +3930,7 @@ int be_cmd_set_hsw_config(struct be_adapter *adapter, u16 pvid, - status = be_mcc_notify_wait(adapter); - - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -3944,7 +3944,7 @@ int be_cmd_get_hsw_config(struct be_adapter *adapter, u16 *pvid, - int status; - u16 vid; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -3991,7 +3991,7 @@ int be_cmd_get_hsw_config(struct be_adapter *adapter, u16 *pvid, - } - - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -4190,7 +4190,7 @@ int be_cmd_set_ext_fat_capabilites(struct be_adapter *adapter, - struct be_cmd_req_set_ext_fat_caps *req; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -4206,7 +4206,7 @@ int be_cmd_set_ext_fat_capabilites(struct be_adapter *adapter, - - status = be_mcc_notify_wait(adapter); - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -4684,7 +4684,7 @@ int be_cmd_manage_iface(struct be_adapter *adapter, u32 iface, u8 op) - if (iface == 0xFFFFFFFF) - return -1; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -4701,7 +4701,7 @@ int be_cmd_manage_iface(struct be_adapter *adapter, u32 iface, u8 op) - - status = be_mcc_notify_wait(adapter); - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -4735,7 +4735,7 @@ int be_cmd_get_if_id(struct be_adapter *adapter, struct be_vf_cfg *vf_cfg, - struct be_cmd_resp_get_iface_list *resp; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -4756,7 +4756,7 @@ int be_cmd_get_if_id(struct be_adapter *adapter, struct be_vf_cfg *vf_cfg, - } - - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -4850,7 +4850,7 @@ int be_cmd_enable_vf(struct be_adapter *adapter, u8 domain) - if (BEx_chip(adapter)) - return 0; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -4868,7 +4868,7 @@ int be_cmd_enable_vf(struct be_adapter *adapter, u8 domain) - req->enable = 1; - status = be_mcc_notify_wait(adapter); - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -4941,7 +4941,7 @@ __be_cmd_set_logical_link_config(struct be_adapter *adapter, - u32 link_config = 0; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -4969,7 +4969,7 @@ __be_cmd_set_logical_link_config(struct be_adapter *adapter, - - status = be_mcc_notify_wait(adapter); - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -5000,8 +5000,7 @@ int be_cmd_set_features(struct be_adapter *adapter) - struct be_mcc_wrb *wrb; - int status; - -- if (mutex_lock_interruptible(&adapter->mcc_lock)) -- return -1; -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -5039,7 +5038,7 @@ int be_cmd_set_features(struct be_adapter *adapter) - dev_info(&adapter->pdev->dev, - "Adapter does not support HW error recovery\n"); - -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - -@@ -5053,7 +5052,7 @@ int be_roce_mcc_cmd(void *netdev_handle, void *wrb_payload, - struct be_cmd_resp_hdr *resp; - int status; - -- mutex_lock(&adapter->mcc_lock); -+ spin_lock_bh(&adapter->mcc_lock); - - wrb = wrb_from_mccq(adapter); - if (!wrb) { -@@ -5076,7 +5075,7 @@ int be_roce_mcc_cmd(void *netdev_handle, void *wrb_payload, - memcpy(wrb_payload, resp, sizeof(*resp) + resp->response_length); - be_dws_le_to_cpu(wrb_payload, sizeof(*resp) + resp->response_length); - err: -- mutex_unlock(&adapter->mcc_lock); -+ spin_unlock_bh(&adapter->mcc_lock); - return status; - } - EXPORT_SYMBOL(be_roce_mcc_cmd); -diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c -index 9d425ece33fd2a..6bc0fde95f9dcf 100644 ---- a/drivers/net/ethernet/emulex/benet/be_main.c -+++ b/drivers/net/ethernet/emulex/benet/be_main.c -@@ -5670,8 +5670,8 @@ static int be_drv_init(struct be_adapter *adapter) - } - - mutex_init(&adapter->mbox_lock); -- mutex_init(&adapter->mcc_lock); - mutex_init(&adapter->rx_filter_lock); -+ spin_lock_init(&adapter->mcc_lock); - spin_lock_init(&adapter->mcc_cq_lock); - init_completion(&adapter->et_cmd_compl); - -diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c -index 9aa57134f460cd..8feb7d4226bb58 100644 ---- a/drivers/net/ethernet/freescale/enetc/enetc.c -+++ b/drivers/net/ethernet/freescale/enetc/enetc.c -@@ -1023,7 +1023,6 @@ static int enetc_refill_rx_ring(struct enetc_bdr *rx_ring, const int buff_cnt) - return j; - } - --#ifdef CONFIG_FSL_ENETC_PTP_CLOCK - static void enetc_get_rx_tstamp(struct net_device *ndev, - union enetc_rx_bd *rxbd, - struct sk_buff *skb) -@@ -1047,7 +1046,6 @@ static void enetc_get_rx_tstamp(struct net_device *ndev, - shhwtstamps->hwtstamp = ns_to_ktime(tstamp); - } - } --#endif - - static void enetc_get_offloads(struct enetc_bdr *rx_ring, - union enetc_rx_bd *rxbd, struct sk_buff *skb) -@@ -1087,10 +1085,9 @@ static void enetc_get_offloads(struct enetc_bdr *rx_ring, - __vlan_hwaccel_put_tag(skb, tpid, le16_to_cpu(rxbd->r.vlan_opt)); - } - --#ifdef CONFIG_FSL_ENETC_PTP_CLOCK -- if (priv->active_offloads & ENETC_F_RX_TSTAMP) -+ if (IS_ENABLED(CONFIG_FSL_ENETC_PTP_CLOCK) && -+ (priv->active_offloads & ENETC_F_RX_TSTAMP)) - enetc_get_rx_tstamp(rx_ring->ndev, rxbd, skb); --#endif - } - - /* This gets called during the non-XDP NAPI poll cycle as well as on XDP_PASS, -@@ -2956,7 +2953,6 @@ void enetc_set_features(struct net_device *ndev, netdev_features_t features) - } - EXPORT_SYMBOL_GPL(enetc_set_features); - --#ifdef CONFIG_FSL_ENETC_PTP_CLOCK - static int enetc_hwtstamp_set(struct net_device *ndev, struct ifreq *ifr) - { - struct enetc_ndev_priv *priv = netdev_priv(ndev); -@@ -2975,6 +2971,9 @@ static int enetc_hwtstamp_set(struct net_device *ndev, struct ifreq *ifr) - new_offloads |= ENETC_F_TX_TSTAMP; - break; - case HWTSTAMP_TX_ONESTEP_SYNC: -+ if (!enetc_si_is_pf(priv->si)) -+ return -EOPNOTSUPP; -+ - new_offloads &= ~ENETC_F_TX_TSTAMP_MASK; - new_offloads |= ENETC_F_TX_ONESTEP_SYNC_TSTAMP; - break; -@@ -3025,17 +3024,17 @@ static int enetc_hwtstamp_get(struct net_device *ndev, struct ifreq *ifr) - return copy_to_user(ifr->ifr_data, &config, sizeof(config)) ? - -EFAULT : 0; - } --#endif - - int enetc_ioctl(struct net_device *ndev, struct ifreq *rq, int cmd) - { - struct enetc_ndev_priv *priv = netdev_priv(ndev); --#ifdef CONFIG_FSL_ENETC_PTP_CLOCK -- if (cmd == SIOCSHWTSTAMP) -- return enetc_hwtstamp_set(ndev, rq); -- if (cmd == SIOCGHWTSTAMP) -- return enetc_hwtstamp_get(ndev, rq); --#endif -+ -+ if (IS_ENABLED(CONFIG_FSL_ENETC_PTP_CLOCK)) { -+ if (cmd == SIOCSHWTSTAMP) -+ return enetc_hwtstamp_set(ndev, rq); -+ if (cmd == SIOCGHWTSTAMP) -+ return enetc_hwtstamp_get(ndev, rq); -+ } - - if (!priv->phylink) - return -EOPNOTSUPP; -diff --git a/drivers/net/ethernet/freescale/enetc/enetc.h b/drivers/net/ethernet/freescale/enetc/enetc.h -index fcadb0848d2541..860ecee302f1a6 100644 ---- a/drivers/net/ethernet/freescale/enetc/enetc.h -+++ b/drivers/net/ethernet/freescale/enetc/enetc.h -@@ -184,10 +184,9 @@ static inline union enetc_rx_bd *enetc_rxbd(struct enetc_bdr *rx_ring, int i) - { - int hw_idx = i; - --#ifdef CONFIG_FSL_ENETC_PTP_CLOCK -- if (rx_ring->ext_en) -+ if (IS_ENABLED(CONFIG_FSL_ENETC_PTP_CLOCK) && rx_ring->ext_en) - hw_idx = 2 * i; --#endif -+ - return &(((union enetc_rx_bd *)rx_ring->bd_base)[hw_idx]); - } - -@@ -199,10 +198,8 @@ static inline void enetc_rxbd_next(struct enetc_bdr *rx_ring, - - new_rxbd++; - --#ifdef CONFIG_FSL_ENETC_PTP_CLOCK -- if (rx_ring->ext_en) -+ if (IS_ENABLED(CONFIG_FSL_ENETC_PTP_CLOCK) && rx_ring->ext_en) - new_rxbd++; --#endif - - if (unlikely(++new_index == rx_ring->bd_count)) { - new_rxbd = rx_ring->bd_base; -diff --git a/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c b/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c -index e993ed04ab5720..1e3e0073276ecb 100644 ---- a/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c -+++ b/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c -@@ -840,34 +840,35 @@ static int enetc_set_coalesce(struct net_device *ndev, - static int enetc_get_ts_info(struct net_device *ndev, - struct ethtool_ts_info *info) - { -+ struct enetc_ndev_priv *priv = netdev_priv(ndev); - int *phc_idx; - - phc_idx = symbol_get(enetc_phc_index); - if (phc_idx) { - info->phc_index = *phc_idx; - symbol_put(enetc_phc_index); -- } else { -- info->phc_index = -1; - } - --#ifdef CONFIG_FSL_ENETC_PTP_CLOCK -+ if (!IS_ENABLED(CONFIG_FSL_ENETC_PTP_CLOCK)) { -+ info->so_timestamping = SOF_TIMESTAMPING_TX_SOFTWARE; -+ -+ return 0; -+ } -+ - info->so_timestamping = SOF_TIMESTAMPING_TX_HARDWARE | - SOF_TIMESTAMPING_RX_HARDWARE | - SOF_TIMESTAMPING_RAW_HARDWARE | -- SOF_TIMESTAMPING_TX_SOFTWARE | -- SOF_TIMESTAMPING_RX_SOFTWARE | -- SOF_TIMESTAMPING_SOFTWARE; -+ SOF_TIMESTAMPING_TX_SOFTWARE; - - info->tx_types = (1 << HWTSTAMP_TX_OFF) | -- (1 << HWTSTAMP_TX_ON) | -- (1 << HWTSTAMP_TX_ONESTEP_SYNC); -+ (1 << HWTSTAMP_TX_ON); -+ -+ if (enetc_si_is_pf(priv->si)) -+ info->tx_types |= (1 << HWTSTAMP_TX_ONESTEP_SYNC); -+ - info->rx_filters = (1 << HWTSTAMP_FILTER_NONE) | - (1 << HWTSTAMP_FILTER_ALL); --#else -- info->so_timestamping = SOF_TIMESTAMPING_RX_SOFTWARE | -- SOF_TIMESTAMPING_TX_SOFTWARE | -- SOF_TIMESTAMPING_SOFTWARE; --#endif -+ - return 0; - } - -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c -index 507d7ce26d8317..ddc691424c8163 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c -@@ -484,7 +484,7 @@ int hclge_ptp_init(struct hclge_dev *hdev) - - ret = hclge_ptp_get_cycle(hdev); - if (ret) -- return ret; -+ goto out; - } - - ret = hclge_ptp_int_en(hdev, true); -diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c -index 4f18addc191b85..05f410999a5a13 100644 ---- a/drivers/net/ethernet/ibm/ibmvnic.c -+++ b/drivers/net/ethernet/ibm/ibmvnic.c -@@ -2427,6 +2427,7 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) - unsigned int skblen; - union sub_crq tx_crq; - unsigned int offset; -+ bool use_scrq_send_direct = false; - int num_entries = 1; - unsigned char *dst; - int bufidx = 0; -@@ -2486,6 +2487,20 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) - memset(dst, 0, tx_pool->buf_size); - data_dma_addr = ltb->addr + offset; - -+ /* if we are going to send_subcrq_direct this then we need to -+ * update the checksum before copying the data into ltb. Essentially -+ * these packets force disable CSO so that we can guarantee that -+ * FW does not need header info and we can send direct. Also, vnic -+ * server must be able to xmit standard packets without header data -+ */ -+ if (*hdrs == 0 && !skb_is_gso(skb) && -+ !ind_bufp->index && !netdev_xmit_more()) { -+ use_scrq_send_direct = true; -+ if (skb->ip_summed == CHECKSUM_PARTIAL && -+ skb_checksum_help(skb)) -+ use_scrq_send_direct = false; -+ } -+ - if (skb_shinfo(skb)->nr_frags) { - int cur, i; - -@@ -2571,11 +2586,13 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) - tx_crq.v1.flags1 |= IBMVNIC_TX_LSO; - tx_crq.v1.mss = cpu_to_be16(skb_shinfo(skb)->gso_size); - hdrs += 2; -- } else if (!ind_bufp->index && !netdev_xmit_more()) { -- ind_bufp->indir_arr[0] = tx_crq; -+ } else if (use_scrq_send_direct) { -+ /* See above comment, CSO disabled with direct xmit */ -+ tx_crq.v1.flags1 &= ~(IBMVNIC_TX_CHKSUM_OFFLOAD); - ind_bufp->index = 1; - tx_buff->num_entries = 1; - netdev_tx_sent_queue(txq, skb->len); -+ ind_bufp->indir_arr[0] = tx_crq; - lpar_rc = ibmvnic_tx_scrq_flush(adapter, tx_scrq, false); - if (lpar_rc != H_SUCCESS) - goto tx_err; -diff --git a/drivers/net/ipa/data/ipa_data-v4.7.c b/drivers/net/ipa/data/ipa_data-v4.7.c -index b83390c4861580..1e4a9f632eddf5 100644 ---- a/drivers/net/ipa/data/ipa_data-v4.7.c -+++ b/drivers/net/ipa/data/ipa_data-v4.7.c -@@ -27,20 +27,18 @@ enum ipa_resource_type { - enum ipa_rsrc_group_id { - /* Source resource group identifiers */ - IPA_RSRC_GROUP_SRC_UL_DL = 0, -- IPA_RSRC_GROUP_SRC_UC_RX_Q, - IPA_RSRC_GROUP_SRC_COUNT, /* Last in set; not a source group */ - - /* Destination resource group identifiers */ -- IPA_RSRC_GROUP_DST_UL_DL_DPL = 0, -- IPA_RSRC_GROUP_DST_UNUSED_1, -+ IPA_RSRC_GROUP_DST_UL_DL = 0, - IPA_RSRC_GROUP_DST_COUNT, /* Last; not a destination group */ - }; - - /* QSB configuration data for an SoC having IPA v4.7 */ - static const struct ipa_qsb_data ipa_qsb_data[] = { - [IPA_QSB_MASTER_DDR] = { -- .max_writes = 8, -- .max_reads = 0, /* no limit (hardware max) */ -+ .max_writes = 12, -+ .max_reads = 13, - .max_reads_beats = 120, - }, - }; -@@ -80,7 +78,7 @@ static const struct ipa_gsi_endpoint_data ipa_gsi_endpoint_data[] = { - }, - .endpoint = { - .config = { -- .resource_group = IPA_RSRC_GROUP_DST_UL_DL_DPL, -+ .resource_group = IPA_RSRC_GROUP_DST_UL_DL, - .aggregation = true, - .status_enable = true, - .rx = { -@@ -105,6 +103,7 @@ static const struct ipa_gsi_endpoint_data ipa_gsi_endpoint_data[] = { - .filter_support = true, - .config = { - .resource_group = IPA_RSRC_GROUP_SRC_UL_DL, -+ .checksum = true, - .qmap = true, - .status_enable = true, - .tx = { -@@ -127,7 +126,8 @@ static const struct ipa_gsi_endpoint_data ipa_gsi_endpoint_data[] = { - }, - .endpoint = { - .config = { -- .resource_group = IPA_RSRC_GROUP_DST_UL_DL_DPL, -+ .resource_group = IPA_RSRC_GROUP_DST_UL_DL, -+ .checksum = true, - .qmap = true, - .aggregation = true, - .rx = { -@@ -196,12 +196,12 @@ static const struct ipa_resource ipa_resource_src[] = { - /* Destination resource configuration data for an SoC having IPA v4.7 */ - static const struct ipa_resource ipa_resource_dst[] = { - [IPA_RESOURCE_TYPE_DST_DATA_SECTORS] = { -- .limits[IPA_RSRC_GROUP_DST_UL_DL_DPL] = { -+ .limits[IPA_RSRC_GROUP_DST_UL_DL] = { - .min = 7, .max = 7, - }, - }, - [IPA_RESOURCE_TYPE_DST_DPS_DMARS] = { -- .limits[IPA_RSRC_GROUP_DST_UL_DL_DPL] = { -+ .limits[IPA_RSRC_GROUP_DST_UL_DL] = { - .min = 2, .max = 2, - }, - }, -diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c -index 90f1cfbc7c50b3..ee1527cf3d0c4c 100644 ---- a/drivers/net/ppp/ppp_generic.c -+++ b/drivers/net/ppp/ppp_generic.c -@@ -72,6 +72,17 @@ - #define PPP_PROTO_LEN 2 - #define PPP_LCP_HDRLEN 4 - -+/* The filter instructions generated by libpcap are constructed -+ * assuming a four-byte PPP header on each packet, where the last -+ * 2 bytes are the protocol field defined in the RFC and the first -+ * byte of the first 2 bytes indicates the direction. -+ * The second byte is currently unused, but we still need to initialize -+ * it to prevent crafted BPF programs from reading them which would -+ * cause reading of uninitialized data. -+ */ -+#define PPP_FILTER_OUTBOUND_TAG 0x0100 -+#define PPP_FILTER_INBOUND_TAG 0x0000 -+ - /* - * An instance of /dev/ppp can be associated with either a ppp - * interface unit or a ppp channel. In both cases, file->private_data -@@ -1762,10 +1773,10 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb) - - if (proto < 0x8000) { - #ifdef CONFIG_PPP_FILTER -- /* check if we should pass this packet */ -- /* the filter instructions are constructed assuming -- a four-byte PPP header on each packet */ -- *(u8 *)skb_push(skb, 2) = 1; -+ /* check if the packet passes the pass and active filters. -+ * See comment for PPP_FILTER_OUTBOUND_TAG above. -+ */ -+ *(__be16 *)skb_push(skb, 2) = htons(PPP_FILTER_OUTBOUND_TAG); - if (ppp->pass_filter && - bpf_prog_run(ppp->pass_filter, skb) == 0) { - if (ppp->debug & 1) -@@ -2482,14 +2493,13 @@ ppp_receive_nonmp_frame(struct ppp *ppp, struct sk_buff *skb) - /* network protocol frame - give it to the kernel */ - - #ifdef CONFIG_PPP_FILTER -- /* check if the packet passes the pass and active filters */ -- /* the filter instructions are constructed assuming -- a four-byte PPP header on each packet */ - if (ppp->pass_filter || ppp->active_filter) { - if (skb_unclone(skb, GFP_ATOMIC)) - goto err; -- -- *(u8 *)skb_push(skb, 2) = 0; -+ /* Check if the packet passes the pass and active filters. -+ * See comment for PPP_FILTER_INBOUND_TAG above. -+ */ -+ *(__be16 *)skb_push(skb, 2) = htons(PPP_FILTER_INBOUND_TAG); - if (ppp->pass_filter && - bpf_prog_run(ppp->pass_filter, skb) == 0) { - if (ppp->debug & 1) -diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c -index 47bea1855e8c8d..42f7f95dac225e 100644 ---- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c -+++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c -@@ -1200,7 +1200,7 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv, - - if (tlv_len != sizeof(*fseq_ver)) - goto invalid_tlv_len; -- IWL_INFO(drv, "TLV_FW_FSEQ_VERSION: %s\n", -+ IWL_INFO(drv, "TLV_FW_FSEQ_VERSION: %.32s\n", - fseq_ver->version); - } - break; -diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c -index bd142aed20f456..a0af659a4c4a21 100644 ---- a/drivers/nvme/target/tcp.c -+++ b/drivers/nvme/target/tcp.c -@@ -547,10 +547,16 @@ static void nvmet_tcp_queue_response(struct nvmet_req *req) - struct nvmet_tcp_cmd *cmd = - container_of(req, struct nvmet_tcp_cmd, req); - struct nvmet_tcp_queue *queue = cmd->queue; -+ enum nvmet_tcp_recv_state queue_state; -+ struct nvmet_tcp_cmd *queue_cmd; - struct nvme_sgl_desc *sgl; - u32 len; - -- if (unlikely(cmd == queue->cmd)) { -+ /* Pairs with store_release in nvmet_prepare_receive_pdu() */ -+ queue_state = smp_load_acquire(&queue->rcv_state); -+ queue_cmd = READ_ONCE(queue->cmd); -+ -+ if (unlikely(cmd == queue_cmd)) { - sgl = &cmd->req.cmd->common.dptr.sgl; - len = le32_to_cpu(sgl->length); - -@@ -559,7 +565,7 @@ static void nvmet_tcp_queue_response(struct nvmet_req *req) - * Avoid using helpers, this might happen before - * nvmet_req_init is completed. - */ -- if (queue->rcv_state == NVMET_TCP_RECV_PDU && -+ if (queue_state == NVMET_TCP_RECV_PDU && - len && len <= cmd->req.port->inline_data_size && - nvme_is_write(cmd->req.cmd)) - return; -@@ -823,8 +829,9 @@ static void nvmet_prepare_receive_pdu(struct nvmet_tcp_queue *queue) - { - queue->offset = 0; - queue->left = sizeof(struct nvme_tcp_hdr); -- queue->cmd = NULL; -- queue->rcv_state = NVMET_TCP_RECV_PDU; -+ WRITE_ONCE(queue->cmd, NULL); -+ /* Ensure rcv_state is visible only after queue->cmd is set */ -+ smp_store_release(&queue->rcv_state, NVMET_TCP_RECV_PDU); - } - - static void nvmet_tcp_free_crypto(struct nvmet_tcp_queue *queue) -diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c -index 4a30daa0a9b9cc..959f1808c240fa 100644 ---- a/drivers/of/of_reserved_mem.c -+++ b/drivers/of/of_reserved_mem.c -@@ -156,12 +156,12 @@ static int __init __reserved_mem_alloc_size(unsigned long node, - - prop = of_get_flat_dt_prop(node, "alignment", &len); - if (prop) { -- if (len != dt_root_size_cells * sizeof(__be32)) { -+ if (len != dt_root_addr_cells * sizeof(__be32)) { - pr_err("invalid alignment property in '%s' node.\n", - uname); - return -EINVAL; - } -- align = dt_mem_next_cell(dt_root_size_cells, &prop); -+ align = dt_mem_next_cell(dt_root_addr_cells, &prop); - } - - nomap = of_get_flat_dt_prop(node, "no-map", NULL) != NULL; -diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c -index 964670d4ca1e2a..692bd6fea3744e 100644 ---- a/drivers/platform/x86/thinkpad_acpi.c -+++ b/drivers/platform/x86/thinkpad_acpi.c -@@ -9911,6 +9911,7 @@ static const struct tpacpi_quirk battery_quirk_table[] __initconst = { - * Individual addressing is broken on models that expose the - * primary battery as BAT1. - */ -+ TPACPI_Q_LNV('G', '8', true), /* ThinkPad X131e */ - TPACPI_Q_LNV('8', 'F', true), /* Thinkpad X120e */ - TPACPI_Q_LNV('J', '7', true), /* B5400 */ - TPACPI_Q_LNV('J', 'I', true), /* Thinkpad 11e */ -diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c -index a115730ebf1461..ca5d06060e0577 100644 ---- a/drivers/rapidio/devices/rio_mport_cdev.c -+++ b/drivers/rapidio/devices/rio_mport_cdev.c -@@ -1740,7 +1740,8 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv, - err = rio_add_net(net); - if (err) { - rmcd_debug(RDEV, "failed to register net, err=%d", err); -- kfree(net); -+ put_device(&net->dev); -+ mport->net = NULL; - goto cleanup; - } - } -diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c -index fdcf742b2adbcb..c12941f71e2cba 100644 ---- a/drivers/rapidio/rio-scan.c -+++ b/drivers/rapidio/rio-scan.c -@@ -871,7 +871,10 @@ static struct rio_net *rio_scan_alloc_net(struct rio_mport *mport, - dev_set_name(&net->dev, "rnet_%d", net->id); - net->dev.parent = &mport->dev; - net->dev.release = rio_scan_release_dev; -- rio_add_net(net); -+ if (rio_add_net(net)) { -+ put_device(&net->dev); -+ net = NULL; -+ } - } - - return net; -diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c -index 4ce0cb61e48135..245e9c7f92cdc4 100644 ---- a/drivers/slimbus/messaging.c -+++ b/drivers/slimbus/messaging.c -@@ -147,8 +147,9 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn) - } - - ret = ctrl->xfer_msg(ctrl, txn); -- -- if (!ret && need_tid && !txn->msg->comp) { -+ if (ret == -ETIMEDOUT) { -+ slim_free_txn_tid(ctrl, txn); -+ } else if (!ret && need_tid && !txn->msg->comp) { - unsigned long ms = txn->rl + HZ; - - timeout = wait_for_completion_timeout(txn->comp, -diff --git a/drivers/spi/spi-mxs.c b/drivers/spi/spi-mxs.c -index cd0e7ae07162c0..7e556f37d598cb 100644 ---- a/drivers/spi/spi-mxs.c -+++ b/drivers/spi/spi-mxs.c -@@ -39,6 +39,7 @@ - #include - #include - #include -+#include - - #define DRIVER_NAME "mxs-spi" - -@@ -252,7 +253,7 @@ static int mxs_spi_txrx_dma(struct mxs_spi *spi, - desc = dmaengine_prep_slave_sg(ssp->dmach, - &dma_xfer[sg_count].sg, 1, - (flags & TXRX_WRITE) ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM, -- DMA_PREP_INTERRUPT | DMA_CTRL_ACK); -+ DMA_PREP_INTERRUPT | MXS_DMA_CTRL_WAIT4END); - - if (!desc) { - dev_err(ssp->dev, -diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c -index 8f3b9a0a38e1dd..1443e9cf631a6e 100644 ---- a/drivers/usb/atm/cxacru.c -+++ b/drivers/usb/atm/cxacru.c -@@ -1131,7 +1131,10 @@ static int cxacru_bind(struct usbatm_data *usbatm_instance, - struct cxacru_data *instance; - struct usb_device *usb_dev = interface_to_usbdev(intf); - struct usb_host_endpoint *cmd_ep = usb_dev->ep_in[CXACRU_EP_CMD]; -- struct usb_endpoint_descriptor *in, *out; -+ static const u8 ep_addrs[] = { -+ CXACRU_EP_CMD + USB_DIR_IN, -+ CXACRU_EP_CMD + USB_DIR_OUT, -+ 0}; - int ret; - - /* instance init */ -@@ -1179,13 +1182,11 @@ static int cxacru_bind(struct usbatm_data *usbatm_instance, - } - - if (usb_endpoint_xfer_int(&cmd_ep->desc)) -- ret = usb_find_common_endpoints(intf->cur_altsetting, -- NULL, NULL, &in, &out); -+ ret = usb_check_int_endpoints(intf, ep_addrs); - else -- ret = usb_find_common_endpoints(intf->cur_altsetting, -- &in, &out, NULL, NULL); -+ ret = usb_check_bulk_endpoints(intf, ep_addrs); - -- if (ret) { -+ if (!ret) { - usb_err(usbatm_instance, "cxacru_bind: interface has incorrect endpoints\n"); - ret = -ENODEV; - goto fail; -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 38f3f5a766dfdf..760283a541b41b 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -6033,6 +6033,36 @@ void usb_hub_cleanup(void) - usb_deregister(&hub_driver); - } /* usb_hub_cleanup() */ - -+/** -+ * hub_hc_release_resources - clear resources used by host controller -+ * @udev: pointer to device being released -+ * -+ * Context: task context, might sleep -+ * -+ * Function releases the host controller resources in correct order before -+ * making any operation on resuming usb device. The host controller resources -+ * allocated for devices in tree should be released starting from the last -+ * usb device in tree toward the root hub. This function is used only during -+ * resuming device when usb device require reinitialization – that is, when -+ * flag udev->reset_resume is set. -+ * -+ * This call is synchronous, and may not be used in an interrupt context. -+ */ -+static void hub_hc_release_resources(struct usb_device *udev) -+{ -+ struct usb_hub *hub = usb_hub_to_struct_hub(udev); -+ struct usb_hcd *hcd = bus_to_hcd(udev->bus); -+ int i; -+ -+ /* Release up resources for all children before this device */ -+ for (i = 0; i < udev->maxchild; i++) -+ if (hub->ports[i]->child) -+ hub_hc_release_resources(hub->ports[i]->child); -+ -+ if (hcd->driver->reset_device) -+ hcd->driver->reset_device(hcd, udev); -+} -+ - /** - * usb_reset_and_verify_device - perform a USB port reset to reinitialize a device - * @udev: device to reset (not in SUSPENDED or NOTATTACHED state) -@@ -6097,6 +6127,9 @@ static int usb_reset_and_verify_device(struct usb_device *udev) - bos = udev->bos; - udev->bos = NULL; - -+ if (udev->reset_resume) -+ hub_hc_release_resources(udev); -+ - mutex_lock(hcd->address0_mutex); - - for (i = 0; i < PORT_INIT_TRIES; ++i) { -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 027479179f09e9..6926bd639ec6ff 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -341,6 +341,10 @@ static const struct usb_device_id usb_quirk_list[] = { - { USB_DEVICE(0x0638, 0x0a13), .driver_info = - USB_QUIRK_STRING_FETCH_255 }, - -+ /* Prolific Single-LUN Mass Storage Card Reader */ -+ { USB_DEVICE(0x067b, 0x2731), .driver_info = USB_QUIRK_DELAY_INIT | -+ USB_QUIRK_NO_LPM }, -+ - /* Saitek Cyborg Gold Joystick */ - { USB_DEVICE(0x06a3, 0x0006), .driver_info = - USB_QUIRK_CONFIG_INTF_STRINGS }, -diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c -index 318ae24a41f482..30404461ef7de3 100644 ---- a/drivers/usb/dwc3/core.c -+++ b/drivers/usb/dwc3/core.c -@@ -125,11 +125,24 @@ void dwc3_enable_susphy(struct dwc3 *dwc, bool enable) - dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg); - } - --void dwc3_set_prtcap(struct dwc3 *dwc, u32 mode) -+void dwc3_set_prtcap(struct dwc3 *dwc, u32 mode, bool ignore_susphy) - { -+ unsigned int hw_mode; - u32 reg; - - reg = dwc3_readl(dwc->regs, DWC3_GCTL); -+ -+ /* -+ * For DRD controllers, GUSB3PIPECTL.SUSPENDENABLE and -+ * GUSB2PHYCFG.SUSPHY should be cleared during mode switching, -+ * and they can be set after core initialization. -+ */ -+ hw_mode = DWC3_GHWPARAMS0_MODE(dwc->hwparams.hwparams0); -+ if (hw_mode == DWC3_GHWPARAMS0_MODE_DRD && !ignore_susphy) { -+ if (DWC3_GCTL_PRTCAP(reg) != mode) -+ dwc3_enable_susphy(dwc, false); -+ } -+ - reg &= ~(DWC3_GCTL_PRTCAPDIR(DWC3_GCTL_PRTCAP_OTG)); - reg |= DWC3_GCTL_PRTCAPDIR(mode); - dwc3_writel(dwc->regs, DWC3_GCTL, reg); -@@ -209,7 +222,7 @@ static void __dwc3_set_mode(struct work_struct *work) - - spin_lock_irqsave(&dwc->lock, flags); - -- dwc3_set_prtcap(dwc, desired_dr_role); -+ dwc3_set_prtcap(dwc, desired_dr_role, false); - - spin_unlock_irqrestore(&dwc->lock, flags); - -@@ -643,16 +656,7 @@ static int dwc3_phy_setup(struct dwc3 *dwc) - */ - reg &= ~DWC3_GUSB3PIPECTL_UX_EXIT_PX; - -- /* -- * Above DWC_usb3.0 1.94a, it is recommended to set -- * DWC3_GUSB3PIPECTL_SUSPHY to '0' during coreConsultant configuration. -- * So default value will be '0' when the core is reset. Application -- * needs to set it to '1' after the core initialization is completed. -- * -- * Similarly for DRD controllers, GUSB3PIPECTL.SUSPENDENABLE must be -- * cleared after power-on reset, and it can be set after core -- * initialization. -- */ -+ /* Ensure the GUSB3PIPECTL.SUSPENDENABLE is cleared prior to phy init. */ - reg &= ~DWC3_GUSB3PIPECTL_SUSPHY; - - if (dwc->u2ss_inp3_quirk) -@@ -725,15 +729,7 @@ static int dwc3_phy_setup(struct dwc3 *dwc) - break; - } - -- /* -- * Above DWC_usb3.0 1.94a, it is recommended to set -- * DWC3_GUSB2PHYCFG_SUSPHY to '0' during coreConsultant configuration. -- * So default value will be '0' when the core is reset. Application -- * needs to set it to '1' after the core initialization is completed. -- * -- * Similarly for DRD controllers, GUSB2PHYCFG.SUSPHY must be cleared -- * after power-on reset, and it can be set after core initialization. -- */ -+ /* Ensure the GUSB2PHYCFG.SUSPHY is cleared prior to phy init. */ - reg &= ~DWC3_GUSB2PHYCFG_SUSPHY; - - if (dwc->dis_enblslpm_quirk) -@@ -809,6 +805,25 @@ static int dwc3_phy_power_on(struct dwc3 *dwc) - if (ret < 0) - goto err_power_off_usb2_phy; - -+ /* -+ * Above DWC_usb3.0 1.94a, it is recommended to set -+ * DWC3_GUSB3PIPECTL_SUSPHY and DWC3_GUSB2PHYCFG_SUSPHY to '0' during -+ * coreConsultant configuration. So default value will be '0' when the -+ * core is reset. Application needs to set it to '1' after the core -+ * initialization is completed. -+ * -+ * Certain phy requires to be in P0 power state during initialization. -+ * Make sure GUSB3PIPECTL.SUSPENDENABLE and GUSB2PHYCFG.SUSPHY are clear -+ * prior to phy init to maintain in the P0 state. -+ * -+ * After phy initialization, some phy operations can only be executed -+ * while in lower P states. Ensure GUSB3PIPECTL.SUSPENDENABLE and -+ * GUSB2PHYCFG.SUSPHY are set soon after initialization to avoid -+ * blocking phy ops. -+ */ -+ if (!DWC3_VER_IS_WITHIN(DWC3, ANY, 194A)) -+ dwc3_enable_susphy(dwc, true); -+ - return 0; - - err_power_off_usb2_phy: -@@ -1432,7 +1447,7 @@ static int dwc3_core_init_mode(struct dwc3 *dwc) - - switch (dwc->dr_mode) { - case USB_DR_MODE_PERIPHERAL: -- dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_DEVICE); -+ dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_DEVICE, false); - - if (dwc->usb2_phy) - otg_set_vbus(dwc->usb2_phy->otg, false); -@@ -1444,7 +1459,7 @@ static int dwc3_core_init_mode(struct dwc3 *dwc) - return dev_err_probe(dev, ret, "failed to initialize gadget\n"); - break; - case USB_DR_MODE_HOST: -- dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_HOST); -+ dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_HOST, false); - - if (dwc->usb2_phy) - otg_set_vbus(dwc->usb2_phy->otg, true); -@@ -1487,7 +1502,7 @@ static void dwc3_core_exit_mode(struct dwc3 *dwc) - } - - /* de-assert DRVVBUS for HOST and OTG mode */ -- dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_DEVICE); -+ dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_DEVICE, true); - } - - static void dwc3_get_properties(struct dwc3 *dwc) -@@ -1656,8 +1671,6 @@ static void dwc3_get_properties(struct dwc3 *dwc) - dwc->tx_thr_num_pkt_prd = tx_thr_num_pkt_prd; - dwc->tx_max_burst_prd = tx_max_burst_prd; - -- dwc->imod_interval = 0; -- - dwc->tx_fifo_resize_max_num = tx_fifo_resize_max_num; - } - -@@ -1675,21 +1688,19 @@ static void dwc3_check_params(struct dwc3 *dwc) - unsigned int hwparam_gen = - DWC3_GHWPARAMS3_SSPHY_IFC(dwc->hwparams.hwparams3); - -- /* Check for proper value of imod_interval */ -- if (dwc->imod_interval && !dwc3_has_imod(dwc)) { -- dev_warn(dwc->dev, "Interrupt moderation not supported\n"); -- dwc->imod_interval = 0; -- } -- - /* -+ * Enable IMOD for all supporting controllers. -+ * -+ * Particularly, DWC_usb3 v3.00a must enable this feature for -+ * the following reason: -+ * - * Workaround for STAR 9000961433 which affects only version - * 3.00a of the DWC_usb3 core. This prevents the controller - * interrupt from being masked while handling events. IMOD - * allows us to work around this issue. Enable it for the - * affected version. - */ -- if (!dwc->imod_interval && -- DWC3_VER_IS(DWC3, 300A)) -+ if (dwc3_has_imod((dwc))) - dwc->imod_interval = 1; - - /* Check the maximum_speed parameter */ -@@ -2192,7 +2203,7 @@ static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg) - if (ret) - return ret; - -- dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_DEVICE); -+ dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_DEVICE, true); - dwc3_gadget_resume(dwc); - break; - case DWC3_GCTL_PRTCAP_HOST: -@@ -2200,7 +2211,7 @@ static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg) - ret = dwc3_core_init_for_resume(dwc); - if (ret) - return ret; -- dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_HOST); -+ dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_HOST, true); - break; - } - /* Restore GUSB2PHYCFG bits that were modified in suspend */ -@@ -2225,7 +2236,7 @@ static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg) - if (ret) - return ret; - -- dwc3_set_prtcap(dwc, dwc->current_dr_role); -+ dwc3_set_prtcap(dwc, dwc->current_dr_role, true); - - dwc3_otg_init(dwc); - if (dwc->current_otg_role == DWC3_OTG_ROLE_HOST) { -diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h -index 516bace7e1dced..06be72f789690e 100644 ---- a/drivers/usb/dwc3/core.h -+++ b/drivers/usb/dwc3/core.h -@@ -1531,7 +1531,7 @@ struct dwc3_gadget_ep_cmd_params { - #define DWC3_HAS_OTG BIT(3) - - /* prototypes */ --void dwc3_set_prtcap(struct dwc3 *dwc, u32 mode); -+void dwc3_set_prtcap(struct dwc3 *dwc, u32 mode, bool ignore_susphy); - void dwc3_set_mode(struct dwc3 *dwc, u32 mode); - u32 dwc3_core_fifo_space(struct dwc3_ep *dep, u8 type); - -diff --git a/drivers/usb/dwc3/drd.c b/drivers/usb/dwc3/drd.c -index 57ddd2e43022eb..80bfe68cde62d2 100644 ---- a/drivers/usb/dwc3/drd.c -+++ b/drivers/usb/dwc3/drd.c -@@ -173,7 +173,7 @@ void dwc3_otg_init(struct dwc3 *dwc) - * block "Initialize GCTL for OTG operation". - */ - /* GCTL.PrtCapDir=2'b11 */ -- dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_OTG); -+ dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_OTG, true); - /* GUSB2PHYCFG0.SusPHY=0 */ - reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0)); - reg &= ~DWC3_GUSB2PHYCFG_SUSPHY; -@@ -553,7 +553,7 @@ int dwc3_drd_init(struct dwc3 *dwc) - - dwc3_drd_update(dwc); - } else { -- dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_OTG); -+ dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_OTG, true); - - /* use OTG block to get ID event */ - irq = dwc3_otg_get_irq(dwc); -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index f6d9a9c67db4e2..fdaace1564f96f 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -4507,14 +4507,18 @@ static irqreturn_t dwc3_process_event_buf(struct dwc3_event_buffer *evt) - dwc3_writel(dwc->regs, DWC3_GEVNTSIZ(0), - DWC3_GEVNTSIZ_SIZE(evt->length)); - -+ evt->flags &= ~DWC3_EVENT_PENDING; -+ /* -+ * Add an explicit write memory barrier to make sure that the update of -+ * clearing DWC3_EVENT_PENDING is observed in dwc3_check_event_buf() -+ */ -+ wmb(); -+ - if (dwc->imod_interval) { - dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(0), DWC3_GEVNTCOUNT_EHB); - dwc3_writel(dwc->regs, DWC3_DEV_IMOD(0), dwc->imod_interval); - } - -- /* Keep the clearing of DWC3_EVENT_PENDING at the end */ -- evt->flags &= ~DWC3_EVENT_PENDING; -- - return ret; - } - -diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c -index 9225c21d118453..69ce7d384ba8bb 100644 ---- a/drivers/usb/gadget/composite.c -+++ b/drivers/usb/gadget/composite.c -@@ -1050,10 +1050,11 @@ static int set_config(struct usb_composite_dev *cdev, - else - usb_gadget_set_remote_wakeup(gadget, 0); - done: -- if (power <= USB_SELF_POWER_VBUS_MAX_DRAW) -- usb_gadget_set_selfpowered(gadget); -- else -+ if (power > USB_SELF_POWER_VBUS_MAX_DRAW || -+ (c && !(c->bmAttributes & USB_CONFIG_ATT_SELFPOWER))) - usb_gadget_clear_selfpowered(gadget); -+ else -+ usb_gadget_set_selfpowered(gadget); - - usb_gadget_vbus_draw(gadget, power); - if (result >= 0 && cdev->delayed_status) -@@ -2615,7 +2616,10 @@ void composite_suspend(struct usb_gadget *gadget) - - cdev->suspended = 1; - -- usb_gadget_set_selfpowered(gadget); -+ if (cdev->config && -+ cdev->config->bmAttributes & USB_CONFIG_ATT_SELFPOWER) -+ usb_gadget_set_selfpowered(gadget); -+ - usb_gadget_vbus_draw(gadget, 2); - } - -@@ -2649,8 +2653,11 @@ void composite_resume(struct usb_gadget *gadget) - else - maxpower = min(maxpower, 900U); - -- if (maxpower > USB_SELF_POWER_VBUS_MAX_DRAW) -+ if (maxpower > USB_SELF_POWER_VBUS_MAX_DRAW || -+ !(cdev->config->bmAttributes & USB_CONFIG_ATT_SELFPOWER)) - usb_gadget_clear_selfpowered(gadget); -+ else -+ usb_gadget_set_selfpowered(gadget); - - usb_gadget_vbus_draw(gadget, maxpower); - } else { -diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c -index 4bb0553da65857..2da2db5e15a3c8 100644 ---- a/drivers/usb/gadget/function/u_ether.c -+++ b/drivers/usb/gadget/function/u_ether.c -@@ -1052,8 +1052,8 @@ void gether_suspend(struct gether *link) - * There is a transfer in progress. So we trigger a remote - * wakeup to inform the host. - */ -- ether_wakeup_host(dev->port_usb); -- return; -+ if (!ether_wakeup_host(dev->port_usb)) -+ return; - } - spin_lock_irqsave(&dev->lock, flags); - link->is_suspend = true; -diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c -index 54c47463c215c2..b0137eac7ab383 100644 ---- a/drivers/usb/host/xhci-mem.c -+++ b/drivers/usb/host/xhci-mem.c -@@ -2364,7 +2364,8 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags) - * and our use of dma addresses in the trb_address_map radix tree needs - * TRB_SEGMENT_SIZE alignment, so we pick the greater alignment need. - */ -- if (xhci->quirks & XHCI_ZHAOXIN_TRB_FETCH) -+ if (xhci->quirks & XHCI_TRB_OVERFETCH) -+ /* Buggy HC prefetches beyond segment bounds - allocate dummy space at the end */ - xhci->segment_pool = dma_pool_create("xHCI ring segments", dev, - TRB_SEGMENT_SIZE * 2, TRB_SEGMENT_SIZE * 2, xhci->page_size * 2); - else -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index 340d9597d1ab05..c1a172b6feae84 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -28,8 +28,8 @@ - #define SPARSE_CNTL_ENABLE 0xC12C - - /* Device for a quirk */ --#define PCI_VENDOR_ID_FRESCO_LOGIC 0x1b73 --#define PCI_DEVICE_ID_FRESCO_LOGIC_PDK 0x1000 -+#define PCI_VENDOR_ID_FRESCO_LOGIC 0x1b73 -+#define PCI_DEVICE_ID_FRESCO_LOGIC_PDK 0x1000 - #define PCI_DEVICE_ID_FRESCO_LOGIC_FL1009 0x1009 - #define PCI_DEVICE_ID_FRESCO_LOGIC_FL1100 0x1100 - #define PCI_DEVICE_ID_FRESCO_LOGIC_FL1400 0x1400 -@@ -38,8 +38,10 @@ - #define PCI_DEVICE_ID_EJ168 0x7023 - #define PCI_DEVICE_ID_EJ188 0x7052 - --#define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI 0x8c31 --#define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI 0x9c31 -+#define PCI_DEVICE_ID_VIA_VL805 0x3483 -+ -+#define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI 0x8c31 -+#define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI 0x9c31 - #define PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_XHCI 0x9cb1 - #define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI 0x22b5 - #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f -@@ -480,8 +482,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - pdev->device == 0x3432) - xhci->quirks |= XHCI_BROKEN_STREAMS; - -- if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == 0x3483) -+ if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == PCI_DEVICE_ID_VIA_VL805) { - xhci->quirks |= XHCI_LPM_SUPPORT; -+ xhci->quirks |= XHCI_TRB_OVERFETCH; -+ } - - if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && - pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI) { -@@ -529,11 +533,11 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - - if (pdev->device == 0x9202) { - xhci->quirks |= XHCI_RESET_ON_RESUME; -- xhci->quirks |= XHCI_ZHAOXIN_TRB_FETCH; -+ xhci->quirks |= XHCI_TRB_OVERFETCH; - } - - if (pdev->device == 0x9203) -- xhci->quirks |= XHCI_ZHAOXIN_TRB_FETCH; -+ xhci->quirks |= XHCI_TRB_OVERFETCH; - } - - if (pdev->vendor == PCI_DEVICE_ID_CADENCE && -diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h -index fddb3a90dae3df..df87e8bcb7d246 100644 ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -1657,7 +1657,7 @@ struct xhci_hcd { - #define XHCI_EP_CTX_BROKEN_DCS BIT_ULL(42) - #define XHCI_SUSPEND_RESUME_CLKS BIT_ULL(43) - #define XHCI_RESET_TO_DEFAULT BIT_ULL(44) --#define XHCI_ZHAOXIN_TRB_FETCH BIT_ULL(45) -+#define XHCI_TRB_OVERFETCH BIT_ULL(45) - #define XHCI_ZHAOXIN_HOST BIT_ULL(46) - #define XHCI_WRITE_64_HI_LO BIT_ULL(47) - #define XHCI_CDNS_SCTX_QUIRK BIT_ULL(48) -diff --git a/drivers/usb/renesas_usbhs/common.c b/drivers/usb/renesas_usbhs/common.c -index dd1c1754243942..205820544f6f9e 100644 ---- a/drivers/usb/renesas_usbhs/common.c -+++ b/drivers/usb/renesas_usbhs/common.c -@@ -312,8 +312,10 @@ static int usbhsc_clk_get(struct device *dev, struct usbhs_priv *priv) - priv->clks[1] = of_clk_get(dev_of_node(dev), 1); - if (PTR_ERR(priv->clks[1]) == -ENOENT) - priv->clks[1] = NULL; -- else if (IS_ERR(priv->clks[1])) -+ else if (IS_ERR(priv->clks[1])) { -+ clk_put(priv->clks[0]); - return PTR_ERR(priv->clks[1]); -+ } - - return 0; - } -@@ -768,6 +770,8 @@ static void usbhs_remove(struct platform_device *pdev) - - dev_dbg(&pdev->dev, "usb remove\n"); - -+ flush_delayed_work(&priv->notify_hotplug_work); -+ - /* power off */ - if (!usbhs_get_dparam(priv, runtime_pwctrl)) - usbhsc_power_ctrl(priv, 0); -diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c -index 105132ae87acbc..e8e5723f541226 100644 ---- a/drivers/usb/renesas_usbhs/mod_gadget.c -+++ b/drivers/usb/renesas_usbhs/mod_gadget.c -@@ -1094,7 +1094,7 @@ int usbhs_mod_gadget_probe(struct usbhs_priv *priv) - goto usbhs_mod_gadget_probe_err_gpriv; - } - -- gpriv->transceiver = usb_get_phy(USB_PHY_TYPE_UNDEFINED); -+ gpriv->transceiver = devm_usb_get_phy(dev, USB_PHY_TYPE_UNDEFINED); - dev_info(dev, "%stransceiver found\n", - !IS_ERR(gpriv->transceiver) ? "" : "no "); - -diff --git a/drivers/usb/typec/tcpm/tcpci_rt1711h.c b/drivers/usb/typec/tcpm/tcpci_rt1711h.c -index 17ebc5fb684f9f..66b29d09372ed7 100644 ---- a/drivers/usb/typec/tcpm/tcpci_rt1711h.c -+++ b/drivers/usb/typec/tcpm/tcpci_rt1711h.c -@@ -331,6 +331,11 @@ static int rt1711h_probe(struct i2c_client *client) - { - int ret; - struct rt1711h_chip *chip; -+ const u16 alert_mask = TCPC_ALERT_TX_SUCCESS | TCPC_ALERT_TX_DISCARDED | -+ TCPC_ALERT_TX_FAILED | TCPC_ALERT_RX_HARD_RST | -+ TCPC_ALERT_RX_STATUS | TCPC_ALERT_POWER_STATUS | -+ TCPC_ALERT_CC_STATUS | TCPC_ALERT_RX_BUF_OVF | -+ TCPC_ALERT_FAULT; - - chip = devm_kzalloc(&client->dev, sizeof(*chip), GFP_KERNEL); - if (!chip) -@@ -379,6 +384,12 @@ static int rt1711h_probe(struct i2c_client *client) - dev_name(chip->dev), chip); - if (ret < 0) - return ret; -+ -+ /* Enable alert interrupts */ -+ ret = rt1711h_write16(chip, TCPC_ALERT_MASK, alert_mask); -+ if (ret < 0) -+ return ret; -+ - enable_irq_wake(client->irq); - - return 0; -diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c -index d6a3fd00c3a5c4..29a04d6795012d 100644 ---- a/drivers/usb/typec/ucsi/ucsi.c -+++ b/drivers/usb/typec/ucsi/ucsi.c -@@ -25,7 +25,7 @@ - * difficult to estimate the time it takes for the system to process the command - * before it is actually passed to the PPM. - */ --#define UCSI_TIMEOUT_MS 5000 -+#define UCSI_TIMEOUT_MS 10000 - - /* - * UCSI_SWAP_TIMEOUT_MS - Timeout for role swap requests -@@ -1465,11 +1465,11 @@ static int ucsi_init(struct ucsi *ucsi) - - err_unregister: - for (con = connector; con->port; con++) { -+ if (con->wq) -+ destroy_workqueue(con->wq); - ucsi_unregister_partner(con); - ucsi_unregister_altmodes(con, UCSI_RECIPIENT_CON); - ucsi_unregister_port_psy(con); -- if (con->wq) -- destroy_workqueue(con->wq); - - usb_power_delivery_unregister_capabilities(con->port_sink_caps); - con->port_sink_caps = NULL; -@@ -1651,10 +1651,6 @@ void ucsi_unregister(struct ucsi *ucsi) - - for (i = 0; i < ucsi->cap.num_connectors; i++) { - cancel_work_sync(&ucsi->connector[i].work); -- ucsi_unregister_partner(&ucsi->connector[i]); -- ucsi_unregister_altmodes(&ucsi->connector[i], -- UCSI_RECIPIENT_CON); -- ucsi_unregister_port_psy(&ucsi->connector[i]); - - if (ucsi->connector[i].wq) { - struct ucsi_work *uwork; -@@ -1670,6 +1666,11 @@ void ucsi_unregister(struct ucsi *ucsi) - destroy_workqueue(ucsi->connector[i].wq); - } - -+ ucsi_unregister_partner(&ucsi->connector[i]); -+ ucsi_unregister_altmodes(&ucsi->connector[i], -+ UCSI_RECIPIENT_CON); -+ ucsi_unregister_port_psy(&ucsi->connector[i]); -+ - usb_power_delivery_unregister_capabilities(ucsi->connector[i].port_sink_caps); - ucsi->connector[i].port_sink_caps = NULL; - usb_power_delivery_unregister_capabilities(ucsi->connector[i].port_source_caps); -diff --git a/drivers/virt/acrn/hsm.c b/drivers/virt/acrn/hsm.c -index 423ea888d79af3..92730c08fd7934 100644 ---- a/drivers/virt/acrn/hsm.c -+++ b/drivers/virt/acrn/hsm.c -@@ -49,7 +49,7 @@ static int pmcmd_ioctl(u64 cmd, void __user *uptr) - switch (cmd & PMCMD_TYPE_MASK) { - case ACRN_PMCMD_GET_PX_CNT: - case ACRN_PMCMD_GET_CX_CNT: -- pm_info = kmalloc(sizeof(u64), GFP_KERNEL); -+ pm_info = kzalloc(sizeof(u64), GFP_KERNEL); - if (!pm_info) - return -ENOMEM; - -@@ -64,7 +64,7 @@ static int pmcmd_ioctl(u64 cmd, void __user *uptr) - kfree(pm_info); - break; - case ACRN_PMCMD_GET_PX_DATA: -- px_data = kmalloc(sizeof(*px_data), GFP_KERNEL); -+ px_data = kzalloc(sizeof(*px_data), GFP_KERNEL); - if (!px_data) - return -ENOMEM; - -@@ -79,7 +79,7 @@ static int pmcmd_ioctl(u64 cmd, void __user *uptr) - kfree(px_data); - break; - case ACRN_PMCMD_GET_CX_DATA: -- cx_data = kmalloc(sizeof(*cx_data), GFP_KERNEL); -+ cx_data = kzalloc(sizeof(*cx_data), GFP_KERNEL); - if (!cx_data) - return -ENOMEM; - -diff --git a/fs/exfat/balloc.c b/fs/exfat/balloc.c -index 5b547a5963808e..32209acd51be4f 100644 ---- a/fs/exfat/balloc.c -+++ b/fs/exfat/balloc.c -@@ -160,7 +160,7 @@ int exfat_set_bitmap(struct inode *inode, unsigned int clu, bool sync) - return 0; - } - --void exfat_clear_bitmap(struct inode *inode, unsigned int clu, bool sync) -+int exfat_clear_bitmap(struct inode *inode, unsigned int clu, bool sync) - { - int i, b; - unsigned int ent_idx; -@@ -169,13 +169,17 @@ void exfat_clear_bitmap(struct inode *inode, unsigned int clu, bool sync) - struct exfat_mount_options *opts = &sbi->options; - - if (!is_valid_cluster(sbi, clu)) -- return; -+ return -EIO; - - ent_idx = CLUSTER_TO_BITMAP_ENT(clu); - i = BITMAP_OFFSET_SECTOR_INDEX(sb, ent_idx); - b = BITMAP_OFFSET_BIT_IN_SECTOR(sb, ent_idx); - -+ if (!test_bit_le(b, sbi->vol_amap[i]->b_data)) -+ return -EIO; -+ - clear_bit_le(b, sbi->vol_amap[i]->b_data); -+ - exfat_update_bh(sbi->vol_amap[i], sync); - - if (opts->discard) { -@@ -190,6 +194,8 @@ void exfat_clear_bitmap(struct inode *inode, unsigned int clu, bool sync) - opts->discard = 0; - } - } -+ -+ return 0; - } - - /* -diff --git a/fs/exfat/exfat_fs.h b/fs/exfat/exfat_fs.h -index f55498e5c23d46..19245ddd885fc3 100644 ---- a/fs/exfat/exfat_fs.h -+++ b/fs/exfat/exfat_fs.h -@@ -441,7 +441,7 @@ int exfat_count_num_clusters(struct super_block *sb, - int exfat_load_bitmap(struct super_block *sb); - void exfat_free_bitmap(struct exfat_sb_info *sbi); - int exfat_set_bitmap(struct inode *inode, unsigned int clu, bool sync); --void exfat_clear_bitmap(struct inode *inode, unsigned int clu, bool sync); -+int exfat_clear_bitmap(struct inode *inode, unsigned int clu, bool sync); - unsigned int exfat_find_free_bitmap(struct super_block *sb, unsigned int clu); - int exfat_count_used_clusters(struct super_block *sb, unsigned int *ret_count); - int exfat_trim_fs(struct inode *inode, struct fstrim_range *range); -diff --git a/fs/exfat/fatent.c b/fs/exfat/fatent.c -index 428d862a1d2bfc..74590041fb2c7b 100644 ---- a/fs/exfat/fatent.c -+++ b/fs/exfat/fatent.c -@@ -175,6 +175,7 @@ static int __exfat_free_cluster(struct inode *inode, struct exfat_chain *p_chain - BITMAP_OFFSET_SECTOR_INDEX(sb, CLUSTER_TO_BITMAP_ENT(clu)); - - if (p_chain->flags == ALLOC_NO_FAT_CHAIN) { -+ int err; - unsigned int last_cluster = p_chain->dir + p_chain->size - 1; - do { - bool sync = false; -@@ -189,7 +190,9 @@ static int __exfat_free_cluster(struct inode *inode, struct exfat_chain *p_chain - cur_cmap_i = next_cmap_i; - } - -- exfat_clear_bitmap(inode, clu, (sync && IS_DIRSYNC(inode))); -+ err = exfat_clear_bitmap(inode, clu, (sync && IS_DIRSYNC(inode))); -+ if (err) -+ break; - clu++; - num_clusters++; - } while (num_clusters < p_chain->size); -@@ -210,12 +213,13 @@ static int __exfat_free_cluster(struct inode *inode, struct exfat_chain *p_chain - cur_cmap_i = next_cmap_i; - } - -- exfat_clear_bitmap(inode, clu, (sync && IS_DIRSYNC(inode))); -+ if (exfat_clear_bitmap(inode, clu, (sync && IS_DIRSYNC(inode)))) -+ break; - clu = n_clu; - num_clusters++; - - if (err) -- goto dec_used_clus; -+ break; - - if (num_clusters >= sbi->num_clusters - EXFAT_FIRST_CLUSTER) { - /* -@@ -229,7 +233,6 @@ static int __exfat_free_cluster(struct inode *inode, struct exfat_chain *p_chain - } while (clu != EXFAT_EOF_CLUSTER); - } - --dec_used_clus: - sbi->used_clusters -= num_clusters; - return 0; - } -diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c -index 258521d5125edd..a1ff4a4f5380eb 100644 ---- a/fs/nfs/direct.c -+++ b/fs/nfs/direct.c -@@ -130,6 +130,20 @@ static void nfs_direct_truncate_request(struct nfs_direct_req *dreq, - dreq->count = req_start; - } - -+static void nfs_direct_file_adjust_size_locked(struct inode *inode, -+ loff_t offset, size_t count) -+{ -+ loff_t newsize = offset + (loff_t)count; -+ loff_t oldsize = i_size_read(inode); -+ -+ if (newsize > oldsize) { -+ i_size_write(inode, newsize); -+ NFS_I(inode)->cache_validity &= ~NFS_INO_INVALID_SIZE; -+ trace_nfs_size_grow(inode, newsize); -+ nfs_inc_stats(inode, NFSIOS_EXTENDWRITE); -+ } -+} -+ - /** - * nfs_swap_rw - NFS address space operation for swap I/O - * @iocb: target I/O control block -@@ -728,6 +742,7 @@ static void nfs_direct_write_completion(struct nfs_pgio_header *hdr) - struct nfs_direct_req *dreq = hdr->dreq; - struct nfs_commit_info cinfo; - struct nfs_page *req = nfs_list_entry(hdr->pages.next); -+ struct inode *inode = dreq->inode; - int flags = NFS_ODIRECT_DONE; - - trace_nfs_direct_write_completion(dreq); -@@ -749,6 +764,10 @@ static void nfs_direct_write_completion(struct nfs_pgio_header *hdr) - } - spin_unlock(&dreq->lock); - -+ spin_lock(&inode->i_lock); -+ nfs_direct_file_adjust_size_locked(inode, dreq->io_start, dreq->count); -+ spin_unlock(&inode->i_lock); -+ - while (!list_empty(&hdr->pages)) { - - req = nfs_list_entry(hdr->pages.next); -diff --git a/fs/nfs/file.c b/fs/nfs/file.c -index 3f9768810427df..003dda0018403d 100644 ---- a/fs/nfs/file.c -+++ b/fs/nfs/file.c -@@ -29,6 +29,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -450,7 +451,7 @@ static bool nfs_release_folio(struct folio *folio, gfp_t gfp) - /* If the private flag is set, then the folio is not freeable */ - if (folio_test_private(folio)) { - if ((current_gfp_context(gfp) & GFP_KERNEL) != GFP_KERNEL || -- current_is_kswapd()) -+ current_is_kswapd() || current_is_kcompactd()) - return false; - if (nfs_wb_folio(folio_file_mapping(folio)->host, folio) < 0) - return false; -diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c -index b3e59a7c71205f..dbb407d5e6dab2 100644 ---- a/fs/smb/client/inode.c -+++ b/fs/smb/client/inode.c -@@ -1320,7 +1320,7 @@ int cifs_get_inode_info(struct inode **inode, - struct cifs_fattr fattr = {}; - int rc; - -- if (is_inode_cache_good(*inode)) { -+ if (!data && is_inode_cache_good(*inode)) { - cifs_dbg(FYI, "No need to revalidate cached inode sizes\n"); - return 0; - } -@@ -1419,7 +1419,7 @@ int smb311_posix_get_inode_info(struct inode **inode, - struct cifs_fattr fattr = {}; - int rc; - -- if (is_inode_cache_good(*inode)) { -+ if (!data && is_inode_cache_good(*inode)) { - cifs_dbg(FYI, "No need to revalidate cached inode sizes\n"); - return 0; - } -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index 815a9a5cfa8079..58e5cc2b1f3e1d 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -7442,17 +7442,17 @@ int smb2_lock(struct ksmbd_work *work) - } - - no_check_cl: -+ flock = smb_lock->fl; -+ list_del(&smb_lock->llist); -+ - if (smb_lock->zero_len) { - err = 0; - goto skip; - } -- -- flock = smb_lock->fl; -- list_del(&smb_lock->llist); - retry: - rc = vfs_lock_file(filp, smb_lock->cmd, flock, NULL); - skip: -- if (flags & SMB2_LOCKFLAG_UNLOCK) { -+ if (smb_lock->flags & SMB2_LOCKFLAG_UNLOCK) { - if (!rc) { - ksmbd_debug(SMB, "File unlocked\n"); - } else if (rc == -ENOENT) { -diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c -index 1c9775f1efa56d..da8ed72f335d99 100644 ---- a/fs/smb/server/smbacl.c -+++ b/fs/smb/server/smbacl.c -@@ -807,6 +807,13 @@ static int parse_sid(struct smb_sid *psid, char *end_of_acl) - return -EINVAL; - } - -+ if (!psid->num_subauth) -+ return 0; -+ -+ if (psid->num_subauth > SID_MAX_SUB_AUTHORITIES || -+ end_of_acl < (char *)psid + 8 + sizeof(__le32) * psid->num_subauth) -+ return -EINVAL; -+ - return 0; - } - -@@ -848,6 +855,9 @@ int parse_sec_desc(struct mnt_idmap *idmap, struct smb_ntsd *pntsd, - pntsd->type = cpu_to_le16(DACL_PRESENT); - - if (pntsd->osidoffset) { -+ if (le32_to_cpu(pntsd->osidoffset) < sizeof(struct smb_ntsd)) -+ return -EINVAL; -+ - rc = parse_sid(owner_sid_ptr, end_of_acl); - if (rc) { - pr_err("%s: Error %d parsing Owner SID\n", __func__, rc); -@@ -863,6 +873,9 @@ int parse_sec_desc(struct mnt_idmap *idmap, struct smb_ntsd *pntsd, - } - - if (pntsd->gsidoffset) { -+ if (le32_to_cpu(pntsd->gsidoffset) < sizeof(struct smb_ntsd)) -+ return -EINVAL; -+ - rc = parse_sid(group_sid_ptr, end_of_acl); - if (rc) { - pr_err("%s: Error %d mapping Owner SID to gid\n", -@@ -884,6 +897,9 @@ int parse_sec_desc(struct mnt_idmap *idmap, struct smb_ntsd *pntsd, - pntsd->type |= cpu_to_le16(DACL_PROTECTED); - - if (dacloffset) { -+ if (dacloffset < sizeof(struct smb_ntsd)) -+ return -EINVAL; -+ - parse_dacl(idmap, dacl_ptr, end_of_acl, - owner_sid_ptr, group_sid_ptr, fattr); - } -diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c -index 449999576a141e..2d7cd7f42f2785 100644 ---- a/fs/smb/server/transport_ipc.c -+++ b/fs/smb/server/transport_ipc.c -@@ -267,6 +267,7 @@ static int handle_response(int type, void *payload, size_t sz) - if (entry->type + 1 != type) { - pr_err("Waiting for IPC type %d, got %d. Ignore.\n", - entry->type + 1, type); -+ continue; - } - - entry->response = kvzalloc(sz, GFP_KERNEL); -diff --git a/include/asm-generic/hugetlb.h b/include/asm-generic/hugetlb.h -index 6dcf4d576970c4..2d7ae9b51d1e35 100644 ---- a/include/asm-generic/hugetlb.h -+++ b/include/asm-generic/hugetlb.h -@@ -84,7 +84,7 @@ static inline void set_huge_pte_at(struct mm_struct *mm, unsigned long addr, - - #ifndef __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEAR - static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm, -- unsigned long addr, pte_t *ptep) -+ unsigned long addr, pte_t *ptep, unsigned long sz) - { - return ptep_get_and_clear(mm, addr, ptep); - } -diff --git a/include/linux/compaction.h b/include/linux/compaction.h -index e9477649604964..7bf0c521db6340 100644 ---- a/include/linux/compaction.h -+++ b/include/linux/compaction.h -@@ -80,6 +80,11 @@ static inline unsigned long compact_gap(unsigned int order) - return 2UL << order; - } - -+static inline int current_is_kcompactd(void) -+{ -+ return current->flags & PF_KCOMPACTD; -+} -+ - #ifdef CONFIG_COMPACTION - - extern unsigned int extfrag_for_order(struct zone *zone, unsigned int order); -diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h -index 0ca93c7574ad22..fc2023d07f6931 100644 ---- a/include/linux/hugetlb.h -+++ b/include/linux/hugetlb.h -@@ -1007,7 +1007,9 @@ static inline void hugetlb_count_sub(long l, struct mm_struct *mm) - static inline pte_t huge_ptep_modify_prot_start(struct vm_area_struct *vma, - unsigned long addr, pte_t *ptep) - { -- return huge_ptep_get_and_clear(vma->vm_mm, addr, ptep); -+ unsigned long psize = huge_page_size(hstate_vma(vma)); -+ -+ return huge_ptep_get_and_clear(vma->vm_mm, addr, ptep, psize); - } - #endif - -diff --git a/include/linux/sched.h b/include/linux/sched.h -index 2af0a8859d6473..393c300347dee4 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -1746,7 +1746,7 @@ extern struct pid *cad_pid; - #define PF_USED_MATH 0x00002000 /* If unset the fpu must be initialized before use */ - #define PF_USER_WORKER 0x00004000 /* Kernel thread cloned from userspace thread */ - #define PF_NOFREEZE 0x00008000 /* This thread should not be frozen */ --#define PF__HOLE__00010000 0x00010000 -+#define PF_KCOMPACTD 0x00010000 /* I am kcompactd */ - #define PF_KSWAPD 0x00020000 /* I am kswapd */ - #define PF_MEMALLOC_NOFS 0x00040000 /* All allocation requests will inherit GFP_NOFS */ - #define PF_MEMALLOC_NOIO 0x00080000 /* All allocation requests will inherit GFP_NOIO */ -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 4f6b18ecfdb219..4dd8936b5aa09a 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -11660,6 +11660,8 @@ void perf_pmu_unregister(struct pmu *pmu) - { - mutex_lock(&pmus_lock); - list_del_rcu(&pmu->entry); -+ idr_remove(&pmu_idr, pmu->type); -+ mutex_unlock(&pmus_lock); - - /* - * We dereference the pmu list under both SRCU and regular RCU, so -@@ -11669,7 +11671,6 @@ void perf_pmu_unregister(struct pmu *pmu) - synchronize_rcu(); - - free_percpu(pmu->pmu_disable_count); -- idr_remove(&pmu_idr, pmu->type); - if (pmu_bus_running && pmu->dev && pmu->dev != PMU_NULL_DEV) { - if (pmu->nr_addr_filters) - device_remove_file(pmu->dev, &dev_attr_nr_addr_filters); -@@ -11677,7 +11678,6 @@ void perf_pmu_unregister(struct pmu *pmu) - put_device(pmu->dev); - } - free_pmu_context(pmu); -- mutex_unlock(&pmus_lock); - } - EXPORT_SYMBOL_GPL(perf_pmu_unregister); - -diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c -index 7e2edd1b069397..f5dfc2f22d798b 100644 ---- a/kernel/events/uprobes.c -+++ b/kernel/events/uprobes.c -@@ -1721,6 +1721,7 @@ void uprobe_free_utask(struct task_struct *t) - if (!utask) - return; - -+ t->utask = NULL; - if (utask->active_uprobe) - put_uprobe(utask->active_uprobe); - -@@ -1730,7 +1731,6 @@ void uprobe_free_utask(struct task_struct *t) - - xol_free_insn_slot(t); - kfree(utask); -- t->utask = NULL; - } - - /* -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 726fa69c4d88b2..2808dbdd03847e 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -4118,15 +4118,17 @@ static inline bool child_cfs_rq_on_list(struct cfs_rq *cfs_rq) - { - struct cfs_rq *prev_cfs_rq; - struct list_head *prev; -+ struct rq *rq = rq_of(cfs_rq); - - if (cfs_rq->on_list) { - prev = cfs_rq->leaf_cfs_rq_list.prev; - } else { -- struct rq *rq = rq_of(cfs_rq); -- - prev = rq->tmp_alone_branch; - } - -+ if (prev == &rq->leaf_cfs_rq_list) -+ return false; -+ - prev_cfs_rq = container_of(prev, struct cfs_rq, leaf_cfs_rq_list); - - return (prev_cfs_rq->tg->parent == cfs_rq->tg); -diff --git a/kernel/trace/trace_fprobe.c b/kernel/trace/trace_fprobe.c -index f26bb8a90cb541..93620a78358769 100644 ---- a/kernel/trace/trace_fprobe.c -+++ b/kernel/trace/trace_fprobe.c -@@ -948,6 +948,8 @@ static int parse_symbol_and_return(int argc, const char *argv[], - if (is_tracepoint) { - trace_probe_log_set_index(i); - trace_probe_log_err(tmp - argv[i], RETVAL_ON_PROBE); -+ kfree(*symbol); -+ *symbol = NULL; - return -EINVAL; - } - *is_return = true; -diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h -index cef3a50628a3e4..48afed3c3f88ec 100644 ---- a/kernel/trace/trace_probe.h -+++ b/kernel/trace/trace_probe.h -@@ -35,7 +35,6 @@ - #define MAX_ARG_NAME_LEN 32 - #define MAX_BTF_ARGS_LEN 128 - #define MAX_STRING_SIZE PATH_MAX --#define MAX_ARG_BUF_LEN (MAX_TRACE_ARGS * MAX_ARG_NAME_LEN) - - /* Reserved field names */ - #define FIELD_STRING_IP "__probe_ip" -diff --git a/mm/compaction.c b/mm/compaction.c -index 61c741f11e9bb3..8b889bee2ace50 100644 ---- a/mm/compaction.c -+++ b/mm/compaction.c -@@ -3050,6 +3050,7 @@ static int kcompactd(void *p) - if (!cpumask_empty(cpumask)) - set_cpus_allowed_ptr(tsk, cpumask); - -+ current->flags |= PF_KCOMPACTD; - set_freezable(); - - pgdat->kcompactd_max_order = 0; -@@ -3106,6 +3107,8 @@ static int kcompactd(void *p) - pgdat->proactive_compact_trigger = false; - } - -+ current->flags &= ~PF_KCOMPACTD; -+ - return 0; - } - -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index 21c12519a7ef3a..faded25b19be83 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -5236,7 +5236,7 @@ static void move_huge_pte(struct vm_area_struct *vma, unsigned long old_addr, - if (src_ptl != dst_ptl) - spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING); - -- pte = huge_ptep_get_and_clear(mm, old_addr, src_pte); -+ pte = huge_ptep_get_and_clear(mm, old_addr, src_pte, sz); - set_huge_pte_at(mm, new_addr, dst_pte, pte, sz); - - if (src_ptl != dst_ptl) -@@ -5399,7 +5399,7 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, - set_vma_resv_flags(vma, HPAGE_RESV_UNMAPPED); - } - -- pte = huge_ptep_get_and_clear(mm, address, ptep); -+ pte = huge_ptep_get_and_clear(mm, address, ptep, sz); - tlb_remove_huge_tlb_entry(h, tlb, ptep, address); - if (huge_pte_dirty(pte)) - set_page_dirty(page); -diff --git a/mm/kmsan/hooks.c b/mm/kmsan/hooks.c -index 5d6e2dee5692a3..7478dfca737bcb 100644 ---- a/mm/kmsan/hooks.c -+++ b/mm/kmsan/hooks.c -@@ -346,6 +346,7 @@ void kmsan_handle_dma(struct page *page, size_t offset, size_t size, - size -= to_go; - } - } -+EXPORT_SYMBOL_GPL(kmsan_handle_dma); - - void kmsan_handle_dma_sg(struct scatterlist *sg, int nents, - enum dma_data_direction dir) -diff --git a/mm/memory.c b/mm/memory.c -index 742c2f65c2c857..65f1865cb461e4 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -2746,8 +2746,10 @@ static int __apply_to_page_range(struct mm_struct *mm, unsigned long addr, - next = pgd_addr_end(addr, end); - if (pgd_none(*pgd) && !create) - continue; -- if (WARN_ON_ONCE(pgd_leaf(*pgd))) -- return -EINVAL; -+ if (WARN_ON_ONCE(pgd_leaf(*pgd))) { -+ err = -EINVAL; -+ break; -+ } - if (!pgd_none(*pgd) && WARN_ON_ONCE(pgd_bad(*pgd))) { - if (!create) - continue; -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index f47439e0ef1085..191f0f95d3edf6 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -3936,6 +3936,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - restart: - compaction_retries = 0; - no_progress_loops = 0; -+ compact_result = COMPACT_SKIPPED; - compact_priority = DEF_COMPACT_PRIORITY; - cpuset_mems_cookie = read_mems_allowed_begin(); - zonelist_iter_cookie = zonelist_iter_begin(); -diff --git a/mm/vmalloc.c b/mm/vmalloc.c -index 5c2b5f93cb666d..fb947787f25da2 100644 ---- a/mm/vmalloc.c -+++ b/mm/vmalloc.c -@@ -558,13 +558,13 @@ static int vmap_small_pages_range_noflush(unsigned long addr, unsigned long end, - mask |= PGTBL_PGD_MODIFIED; - err = vmap_pages_p4d_range(pgd, addr, next, prot, pages, &nr, &mask); - if (err) -- return err; -+ break; - } while (pgd++, addr = next, addr != end); - - if (mask & ARCH_PAGE_TABLE_SYNC_MASK) - arch_sync_kernel_mappings(start, end); - -- return 0; -+ return err; - } - - /* -diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c -index e40aa3e3641cbf..b477ba37a6991f 100644 ---- a/net/8021q/vlan.c -+++ b/net/8021q/vlan.c -@@ -131,7 +131,8 @@ int vlan_check_real_dev(struct net_device *real_dev, - { - const char *name = real_dev->name; - -- if (real_dev->features & NETIF_F_VLAN_CHALLENGED) { -+ if (real_dev->features & NETIF_F_VLAN_CHALLENGED || -+ real_dev->type != ARPHRD_ETHER) { - pr_info("VLANs not supported on %s\n", name); - NL_SET_ERR_MSG_MOD(extack, "VLANs not supported on device"); - return -EOPNOTSUPP; -diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c -index b36254107ef578..29e420e9754bb3 100644 ---- a/net/bluetooth/mgmt.c -+++ b/net/bluetooth/mgmt.c -@@ -9679,6 +9679,9 @@ void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, - sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) + - eir_precalc_len(sizeof(conn->dev_class))); - -+ if (!skb) -+ return; -+ - ev = skb_put(skb, sizeof(*ev)); - bacpy(&ev->addr.bdaddr, &conn->dst); - ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); -@@ -10443,6 +10446,8 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, - - skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, - sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); -+ if (!skb) -+ return; - - ev = skb_put(skb, sizeof(*ev)); - bacpy(&ev->addr.bdaddr, bdaddr); -diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c -index 69e6012ae82fbd..f1f723579a490c 100644 ---- a/net/ipv4/tcp_offload.c -+++ b/net/ipv4/tcp_offload.c -@@ -13,12 +13,15 @@ - #include - #include - --static void tcp_gso_tstamp(struct sk_buff *skb, unsigned int ts_seq, -+static void tcp_gso_tstamp(struct sk_buff *skb, struct sk_buff *gso_skb, - unsigned int seq, unsigned int mss) - { -+ u32 flags = skb_shinfo(gso_skb)->tx_flags & SKBTX_ANY_TSTAMP; -+ u32 ts_seq = skb_shinfo(gso_skb)->tskey; -+ - while (skb) { - if (before(ts_seq, seq + mss)) { -- skb_shinfo(skb)->tx_flags |= SKBTX_SW_TSTAMP; -+ skb_shinfo(skb)->tx_flags |= flags; - skb_shinfo(skb)->tskey = ts_seq; - return; - } -@@ -120,8 +123,8 @@ struct sk_buff *tcp_gso_segment(struct sk_buff *skb, - th = tcp_hdr(skb); - seq = ntohl(th->seq); - -- if (unlikely(skb_shinfo(gso_skb)->tx_flags & SKBTX_SW_TSTAMP)) -- tcp_gso_tstamp(segs, skb_shinfo(gso_skb)->tskey, seq, mss); -+ if (unlikely(skb_shinfo(gso_skb)->tx_flags & SKBTX_ANY_TSTAMP)) -+ tcp_gso_tstamp(segs, gso_skb, seq, mss); - - newcheck = ~csum_fold(csum_add(csum_unfold(th->check), delta)); - -diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c -index a727eeafd0a96d..2ab16139c197b3 100644 ---- a/net/ipv4/udp_offload.c -+++ b/net/ipv4/udp_offload.c -@@ -315,13 +315,17 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb, - - /* clear destructor to avoid skb_segment assigning it to tail */ - copy_dtor = gso_skb->destructor == sock_wfree; -- if (copy_dtor) -+ if (copy_dtor) { - gso_skb->destructor = NULL; -+ gso_skb->sk = NULL; -+ } - - segs = skb_segment(gso_skb, features); - if (IS_ERR_OR_NULL(segs)) { -- if (copy_dtor) -+ if (copy_dtor) { - gso_skb->destructor = sock_wfree; -+ gso_skb->sk = sk; -+ } - return segs; - } - -diff --git a/net/ipv6/ila/ila_lwt.c b/net/ipv6/ila/ila_lwt.c -index ff7e734e335b06..7d574f5132e2fb 100644 ---- a/net/ipv6/ila/ila_lwt.c -+++ b/net/ipv6/ila/ila_lwt.c -@@ -88,13 +88,15 @@ static int ila_output(struct net *net, struct sock *sk, struct sk_buff *skb) - goto drop; - } - -- if (ilwt->connected) { -+ /* cache only if we don't create a dst reference loop */ -+ if (ilwt->connected && orig_dst->lwtstate != dst->lwtstate) { - local_bh_disable(); - dst_cache_set_ip6(&ilwt->dst_cache, dst, &fl6.saddr); - local_bh_enable(); - } - } - -+ skb_dst_drop(skb); - skb_dst_set(skb, dst); - return dst_output(net, sk, skb); - -diff --git a/net/llc/llc_s_ac.c b/net/llc/llc_s_ac.c -index 06fb8e6944b06a..7a0cae9a811148 100644 ---- a/net/llc/llc_s_ac.c -+++ b/net/llc/llc_s_ac.c -@@ -24,7 +24,7 @@ - #include - #include - #include -- -+#include - - /** - * llc_sap_action_unitdata_ind - forward UI PDU to network layer -@@ -40,6 +40,26 @@ int llc_sap_action_unitdata_ind(struct llc_sap *sap, struct sk_buff *skb) - return 0; - } - -+static int llc_prepare_and_xmit(struct sk_buff *skb) -+{ -+ struct llc_sap_state_ev *ev = llc_sap_ev(skb); -+ struct sk_buff *nskb; -+ int rc; -+ -+ rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac); -+ if (rc) -+ return rc; -+ -+ nskb = skb_clone(skb, GFP_ATOMIC); -+ if (!nskb) -+ return -ENOMEM; -+ -+ if (skb->sk) -+ skb_set_owner_w(nskb, skb->sk); -+ -+ return dev_queue_xmit(nskb); -+} -+ - /** - * llc_sap_action_send_ui - sends UI PDU resp to UNITDATA REQ to MAC layer - * @sap: SAP -@@ -52,17 +72,12 @@ int llc_sap_action_unitdata_ind(struct llc_sap *sap, struct sk_buff *skb) - int llc_sap_action_send_ui(struct llc_sap *sap, struct sk_buff *skb) - { - struct llc_sap_state_ev *ev = llc_sap_ev(skb); -- int rc; - - llc_pdu_header_init(skb, LLC_PDU_TYPE_U, ev->saddr.lsap, - ev->daddr.lsap, LLC_PDU_CMD); - llc_pdu_init_as_ui_cmd(skb); -- rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac); -- if (likely(!rc)) { -- skb_get(skb); -- rc = dev_queue_xmit(skb); -- } -- return rc; -+ -+ return llc_prepare_and_xmit(skb); - } - - /** -@@ -77,17 +92,12 @@ int llc_sap_action_send_ui(struct llc_sap *sap, struct sk_buff *skb) - int llc_sap_action_send_xid_c(struct llc_sap *sap, struct sk_buff *skb) - { - struct llc_sap_state_ev *ev = llc_sap_ev(skb); -- int rc; - - llc_pdu_header_init(skb, LLC_PDU_TYPE_U_XID, ev->saddr.lsap, - ev->daddr.lsap, LLC_PDU_CMD); - llc_pdu_init_as_xid_cmd(skb, LLC_XID_NULL_CLASS_2, 0); -- rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac); -- if (likely(!rc)) { -- skb_get(skb); -- rc = dev_queue_xmit(skb); -- } -- return rc; -+ -+ return llc_prepare_and_xmit(skb); - } - - /** -@@ -133,17 +143,12 @@ int llc_sap_action_send_xid_r(struct llc_sap *sap, struct sk_buff *skb) - int llc_sap_action_send_test_c(struct llc_sap *sap, struct sk_buff *skb) - { - struct llc_sap_state_ev *ev = llc_sap_ev(skb); -- int rc; - - llc_pdu_header_init(skb, LLC_PDU_TYPE_U, ev->saddr.lsap, - ev->daddr.lsap, LLC_PDU_CMD); - llc_pdu_init_as_test_cmd(skb); -- rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac); -- if (likely(!rc)) { -- skb_get(skb); -- rc = dev_queue_xmit(skb); -- } -- return rc; -+ -+ return llc_prepare_and_xmit(skb); - } - - int llc_sap_action_send_test_r(struct llc_sap *sap, struct sk_buff *skb) -diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c -index 5f16e2fa2de67a..f7257de37bd090 100644 ---- a/net/mptcp/pm_netlink.c -+++ b/net/mptcp/pm_netlink.c -@@ -969,7 +969,7 @@ static void __mptcp_pm_release_addr_entry(struct mptcp_pm_addr_entry *entry) - - static int mptcp_pm_nl_append_new_local_addr(struct pm_nl_pernet *pernet, - struct mptcp_pm_addr_entry *entry, -- bool needs_id) -+ bool needs_id, bool replace) - { - struct mptcp_pm_addr_entry *cur, *del_entry = NULL; - unsigned int addr_max; -@@ -1009,6 +1009,17 @@ static int mptcp_pm_nl_append_new_local_addr(struct pm_nl_pernet *pernet, - if (entry->addr.id) - goto out; - -+ /* allow callers that only need to look up the local -+ * addr's id to skip replacement. This allows them to -+ * avoid calling synchronize_rcu in the packet recv -+ * path. -+ */ -+ if (!replace) { -+ kfree(entry); -+ ret = cur->addr.id; -+ goto out; -+ } -+ - pernet->addrs--; - entry->addr.id = cur->addr.id; - list_del_rcu(&cur->list); -@@ -1161,7 +1172,7 @@ int mptcp_pm_nl_get_local_id(struct mptcp_sock *msk, struct mptcp_addr_info *skc - entry->ifindex = 0; - entry->flags = MPTCP_PM_ADDR_FLAG_IMPLICIT; - entry->lsk = NULL; -- ret = mptcp_pm_nl_append_new_local_addr(pernet, entry, true); -+ ret = mptcp_pm_nl_append_new_local_addr(pernet, entry, true, false); - if (ret < 0) - kfree(entry); - -@@ -1456,7 +1467,8 @@ static int mptcp_nl_cmd_add_addr(struct sk_buff *skb, struct genl_info *info) - } - } - ret = mptcp_pm_nl_append_new_local_addr(pernet, entry, -- !mptcp_pm_has_addr_attr_id(attr, info)); -+ !mptcp_pm_has_addr_attr_id(attr, info), -+ true); - if (ret < 0) { - GENL_SET_ERR_MSG_FMT(info, "too many addresses or duplicate one: %d", ret); - goto out_free; -diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c -index e1040421b79797..1080d89f917802 100644 ---- a/net/sched/sch_fifo.c -+++ b/net/sched/sch_fifo.c -@@ -39,6 +39,9 @@ static int pfifo_tail_enqueue(struct sk_buff *skb, struct Qdisc *sch, - { - unsigned int prev_backlog; - -+ if (unlikely(sch->limit == 0)) -+ return qdisc_drop(skb, sch, to_free); -+ - if (likely(sch->q.qlen < sch->limit)) - return qdisc_enqueue_tail(skb, sch); - -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index 5b9f39d93b0456..0fdd614e08d08b 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -4102,6 +4102,11 @@ static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags) - if (flags[flag]) - *mntrflags |= (1<mutex); - - if (test_and_clear_bit(IMA_CHANGE_ATTR, &iint->atomic_flags)) -- /* reset appraisal flags if ima_inode_post_setattr was called */ -+ /* -+ * Reset appraisal flags (action and non-action rule-specific) -+ * if ima_inode_post_setattr was called. -+ */ - iint->flags &= ~(IMA_APPRAISE | IMA_APPRAISED | - IMA_APPRAISE_SUBMASK | IMA_APPRAISED_SUBMASK | -- IMA_NONACTION_FLAGS); -+ IMA_NONACTION_RULE_FLAGS); - - /* - * Re-evaulate the file if either the xattr has changed or the -diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h -index 9561db7cf6b42c..ad20ff7f5dfaa4 100644 ---- a/security/integrity/integrity.h -+++ b/security/integrity/integrity.h -@@ -42,6 +42,9 @@ - #define IMA_CHECK_BLACKLIST 0x40000000 - #define IMA_VERITY_REQUIRED 0x80000000 - -+/* Exclude non-action flags which are not rule-specific. */ -+#define IMA_NONACTION_RULE_FLAGS (IMA_NONACTION_FLAGS & ~IMA_NEW_FILE) -+ - #define IMA_DO_MASK (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \ - IMA_HASH | IMA_APPRAISE_SUBMASK) - #define IMA_DONE_MASK (IMA_MEASURED | IMA_APPRAISED | IMA_AUDITED | \ -diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c -index 54931ad0dc990f..6195fe9dda1799 100644 ---- a/sound/core/seq/seq_clientmgr.c -+++ b/sound/core/seq/seq_clientmgr.c -@@ -106,7 +106,7 @@ static struct snd_seq_client *clientptr(int clientid) - return clienttab[clientid]; - } - --struct snd_seq_client *snd_seq_client_use_ptr(int clientid) -+static struct snd_seq_client *client_use_ptr(int clientid, bool load_module) - { - unsigned long flags; - struct snd_seq_client *client; -@@ -126,7 +126,7 @@ struct snd_seq_client *snd_seq_client_use_ptr(int clientid) - } - spin_unlock_irqrestore(&clients_lock, flags); - #ifdef CONFIG_MODULES -- if (!in_interrupt()) { -+ if (load_module) { - static DECLARE_BITMAP(client_requested, SNDRV_SEQ_GLOBAL_CLIENTS); - static DECLARE_BITMAP(card_requested, SNDRV_CARDS); - -@@ -168,6 +168,20 @@ struct snd_seq_client *snd_seq_client_use_ptr(int clientid) - return client; - } - -+/* get snd_seq_client object for the given id quickly */ -+struct snd_seq_client *snd_seq_client_use_ptr(int clientid) -+{ -+ return client_use_ptr(clientid, false); -+} -+ -+/* get snd_seq_client object for the given id; -+ * if not found, retry after loading the modules -+ */ -+static struct snd_seq_client *client_load_and_use_ptr(int clientid) -+{ -+ return client_use_ptr(clientid, IS_ENABLED(CONFIG_MODULES)); -+} -+ - /* Take refcount and perform ioctl_mutex lock on the given client; - * used only for OSS sequencer - * Unlock via snd_seq_client_ioctl_unlock() below -@@ -176,7 +190,7 @@ bool snd_seq_client_ioctl_lock(int clientid) - { - struct snd_seq_client *client; - -- client = snd_seq_client_use_ptr(clientid); -+ client = client_load_and_use_ptr(clientid); - if (!client) - return false; - mutex_lock(&client->ioctl_mutex); -@@ -1200,7 +1214,7 @@ static int snd_seq_ioctl_running_mode(struct snd_seq_client *client, void *arg) - int err = 0; - - /* requested client number */ -- cptr = snd_seq_client_use_ptr(info->client); -+ cptr = client_load_and_use_ptr(info->client); - if (cptr == NULL) - return -ENOENT; /* don't change !!! */ - -@@ -1262,7 +1276,7 @@ static int snd_seq_ioctl_get_client_info(struct snd_seq_client *client, - struct snd_seq_client *cptr; - - /* requested client number */ -- cptr = snd_seq_client_use_ptr(client_info->client); -+ cptr = client_load_and_use_ptr(client_info->client); - if (cptr == NULL) - return -ENOENT; /* don't change !!! */ - -@@ -1397,7 +1411,7 @@ static int snd_seq_ioctl_get_port_info(struct snd_seq_client *client, void *arg) - struct snd_seq_client *cptr; - struct snd_seq_client_port *port; - -- cptr = snd_seq_client_use_ptr(info->addr.client); -+ cptr = client_load_and_use_ptr(info->addr.client); - if (cptr == NULL) - return -ENXIO; - -@@ -1501,10 +1515,10 @@ static int snd_seq_ioctl_subscribe_port(struct snd_seq_client *client, - struct snd_seq_client *receiver = NULL, *sender = NULL; - struct snd_seq_client_port *sport = NULL, *dport = NULL; - -- receiver = snd_seq_client_use_ptr(subs->dest.client); -+ receiver = client_load_and_use_ptr(subs->dest.client); - if (!receiver) - goto __end; -- sender = snd_seq_client_use_ptr(subs->sender.client); -+ sender = client_load_and_use_ptr(subs->sender.client); - if (!sender) - goto __end; - sport = snd_seq_port_use_ptr(sender, subs->sender.port); -@@ -1865,7 +1879,7 @@ static int snd_seq_ioctl_get_client_pool(struct snd_seq_client *client, - struct snd_seq_client_pool *info = arg; - struct snd_seq_client *cptr; - -- cptr = snd_seq_client_use_ptr(info->client); -+ cptr = client_load_and_use_ptr(info->client); - if (cptr == NULL) - return -ENOENT; - memset(info, 0, sizeof(*info)); -@@ -1969,7 +1983,7 @@ static int snd_seq_ioctl_get_subscription(struct snd_seq_client *client, - struct snd_seq_client_port *sport = NULL; - - result = -EINVAL; -- sender = snd_seq_client_use_ptr(subs->sender.client); -+ sender = client_load_and_use_ptr(subs->sender.client); - if (!sender) - goto __end; - sport = snd_seq_port_use_ptr(sender, subs->sender.port); -@@ -2000,7 +2014,7 @@ static int snd_seq_ioctl_query_subs(struct snd_seq_client *client, void *arg) - struct list_head *p; - int i; - -- cptr = snd_seq_client_use_ptr(subs->root.client); -+ cptr = client_load_and_use_ptr(subs->root.client); - if (!cptr) - goto __end; - port = snd_seq_port_use_ptr(cptr, subs->root.port); -@@ -2067,7 +2081,7 @@ static int snd_seq_ioctl_query_next_client(struct snd_seq_client *client, - if (info->client < 0) - info->client = 0; - for (; info->client < SNDRV_SEQ_MAX_CLIENTS; info->client++) { -- cptr = snd_seq_client_use_ptr(info->client); -+ cptr = client_load_and_use_ptr(info->client); - if (cptr) - break; /* found */ - } -@@ -2090,7 +2104,7 @@ static int snd_seq_ioctl_query_next_port(struct snd_seq_client *client, - struct snd_seq_client *cptr; - struct snd_seq_client_port *port = NULL; - -- cptr = snd_seq_client_use_ptr(info->addr.client); -+ cptr = client_load_and_use_ptr(info->addr.client); - if (cptr == NULL) - return -ENXIO; - -@@ -2187,7 +2201,7 @@ static int snd_seq_ioctl_client_ump_info(struct snd_seq_client *caller, - size = sizeof(struct snd_ump_endpoint_info); - else - size = sizeof(struct snd_ump_block_info); -- cptr = snd_seq_client_use_ptr(client); -+ cptr = client_load_and_use_ptr(client); - if (!cptr) - return -ENOENT; - -@@ -2459,7 +2473,7 @@ int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event *ev, - if (check_event_type_and_length(ev)) - return -EINVAL; - -- cptr = snd_seq_client_use_ptr(client); -+ cptr = client_load_and_use_ptr(client); - if (cptr == NULL) - return -EINVAL; - -@@ -2686,7 +2700,7 @@ void snd_seq_info_clients_read(struct snd_info_entry *entry, - - /* list the client table */ - for (c = 0; c < SNDRV_SEQ_MAX_CLIENTS; c++) { -- client = snd_seq_client_use_ptr(c); -+ client = client_load_and_use_ptr(c); - if (client == NULL) - continue; - if (client->type == NO_CLIENT) { -diff --git a/sound/pci/hda/Kconfig b/sound/pci/hda/Kconfig -index 233b03bb4f9869..bc32a2e345b7eb 100644 ---- a/sound/pci/hda/Kconfig -+++ b/sound/pci/hda/Kconfig -@@ -183,6 +183,7 @@ comment "Set to Y if you want auto-loading the side codec driver" - - config SND_HDA_CODEC_REALTEK - tristate "Build Realtek HD-audio codec support" -+ depends on INPUT - select SND_HDA_GENERIC - select SND_HDA_GENERIC_LEDS - help -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index 134c6f6e0959ae..d90151910bee90 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -2222,6 +2222,8 @@ static const struct snd_pci_quirk power_save_denylist[] = { - SND_PCI_QUIRK(0x1631, 0xe017, "Packard Bell NEC IMEDIA 5204", 0), - /* KONTRON SinglePC may cause a stall at runtime resume */ - SND_PCI_QUIRK(0x1734, 0x1232, "KONTRON SinglePC", 0), -+ /* Dell ALC3271 */ -+ SND_PCI_QUIRK(0x1028, 0x0962, "Dell ALC3271", 0), - {} - }; - #endif /* CONFIG_PM */ -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 822bd9a00892c3..ec57148453c820 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -3834,6 +3834,79 @@ static void alc225_shutup(struct hda_codec *codec) - } - } - -+static void alc222_init(struct hda_codec *codec) -+{ -+ struct alc_spec *spec = codec->spec; -+ hda_nid_t hp_pin = alc_get_hp_pin(spec); -+ bool hp1_pin_sense, hp2_pin_sense; -+ -+ if (!hp_pin) -+ return; -+ -+ msleep(30); -+ -+ hp1_pin_sense = snd_hda_jack_detect(codec, hp_pin); -+ hp2_pin_sense = snd_hda_jack_detect(codec, 0x14); -+ -+ if (hp1_pin_sense || hp2_pin_sense) { -+ msleep(2); -+ -+ if (hp1_pin_sense) -+ snd_hda_codec_write(codec, hp_pin, 0, -+ AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT); -+ if (hp2_pin_sense) -+ snd_hda_codec_write(codec, 0x14, 0, -+ AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT); -+ msleep(75); -+ -+ if (hp1_pin_sense) -+ snd_hda_codec_write(codec, hp_pin, 0, -+ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE); -+ if (hp2_pin_sense) -+ snd_hda_codec_write(codec, 0x14, 0, -+ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE); -+ -+ msleep(75); -+ } -+} -+ -+static void alc222_shutup(struct hda_codec *codec) -+{ -+ struct alc_spec *spec = codec->spec; -+ hda_nid_t hp_pin = alc_get_hp_pin(spec); -+ bool hp1_pin_sense, hp2_pin_sense; -+ -+ if (!hp_pin) -+ hp_pin = 0x21; -+ -+ hp1_pin_sense = snd_hda_jack_detect(codec, hp_pin); -+ hp2_pin_sense = snd_hda_jack_detect(codec, 0x14); -+ -+ if (hp1_pin_sense || hp2_pin_sense) { -+ msleep(2); -+ -+ if (hp1_pin_sense) -+ snd_hda_codec_write(codec, hp_pin, 0, -+ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE); -+ if (hp2_pin_sense) -+ snd_hda_codec_write(codec, 0x14, 0, -+ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE); -+ -+ msleep(75); -+ -+ if (hp1_pin_sense) -+ snd_hda_codec_write(codec, hp_pin, 0, -+ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); -+ if (hp2_pin_sense) -+ snd_hda_codec_write(codec, 0x14, 0, -+ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); -+ -+ msleep(75); -+ } -+ alc_auto_setup_eapd(codec, false); -+ alc_shutup_pins(codec); -+} -+ - static void alc_default_init(struct hda_codec *codec) - { - struct alc_spec *spec = codec->spec; -@@ -4792,7 +4865,6 @@ static void alc298_fixup_samsung_amp(struct hda_codec *codec, - } - } - --#if IS_REACHABLE(CONFIG_INPUT) - static void gpio2_mic_hotkey_event(struct hda_codec *codec, - struct hda_jack_callback *event) - { -@@ -4901,10 +4973,6 @@ static void alc233_fixup_lenovo_line2_mic_hotkey(struct hda_codec *codec, - spec->kb_dev = NULL; - } - } --#else /* INPUT */ --#define alc280_fixup_hp_gpio2_mic_hotkey NULL --#define alc233_fixup_lenovo_line2_mic_hotkey NULL --#endif /* INPUT */ - - static void alc269_fixup_hp_line1_mic1_led(struct hda_codec *codec, - const struct hda_fixup *fix, int action) -@@ -4918,6 +4986,16 @@ static void alc269_fixup_hp_line1_mic1_led(struct hda_codec *codec, - } - } - -+static void alc233_fixup_lenovo_low_en_micmute_led(struct hda_codec *codec, -+ const struct hda_fixup *fix, int action) -+{ -+ struct alc_spec *spec = codec->spec; -+ -+ if (action == HDA_FIXUP_ACT_PRE_PROBE) -+ spec->micmute_led_polarity = 1; -+ alc233_fixup_lenovo_line2_mic_hotkey(codec, fix, action); -+} -+ - static void alc_hp_mute_disable(struct hda_codec *codec, unsigned int delay) - { - if (delay <= 0) -@@ -7295,6 +7373,7 @@ enum { - ALC275_FIXUP_DELL_XPS, - ALC293_FIXUP_LENOVO_SPK_NOISE, - ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, -+ ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED, - ALC255_FIXUP_DELL_SPK_NOISE, - ALC225_FIXUP_DISABLE_MIC_VREF, - ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, -@@ -8282,6 +8361,10 @@ static const struct hda_fixup alc269_fixups[] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc233_fixup_lenovo_line2_mic_hotkey, - }, -+ [ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED] = { -+ .type = HDA_FIXUP_FUNC, -+ .v.func = alc233_fixup_lenovo_low_en_micmute_led, -+ }, - [ALC233_FIXUP_INTEL_NUC8_DMIC] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc_fixup_inv_dmic, -@@ -10343,6 +10426,9 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x17aa, 0x3178, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC), - SND_PCI_QUIRK(0x17aa, 0x31af, "ThinkCentre Station", ALC623_FIXUP_LENOVO_THINKSTATION_P340), - SND_PCI_QUIRK(0x17aa, 0x334b, "Lenovo ThinkCentre M70 Gen5", ALC283_FIXUP_HEADSET_MIC), -+ SND_PCI_QUIRK(0x17aa, 0x3384, "ThinkCentre M90a PRO", ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED), -+ SND_PCI_QUIRK(0x17aa, 0x3386, "ThinkCentre M90a Gen6", ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED), -+ SND_PCI_QUIRK(0x17aa, 0x3387, "ThinkCentre M70a Gen6", ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED), - SND_PCI_QUIRK(0x17aa, 0x3801, "Lenovo Yoga9 14IAP7", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN), - SND_PCI_QUIRK(0x17aa, 0x3802, "Lenovo Yoga Pro 9 14IRP8 / DuetITL 2021", ALC287_FIXUP_LENOVO_14IRP8_DUETITL), - SND_PCI_QUIRK(0x17aa, 0x3813, "Legion 7i 15IMHG05", ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS), -@@ -11291,8 +11377,11 @@ static int patch_alc269(struct hda_codec *codec) - spec->codec_variant = ALC269_TYPE_ALC300; - spec->gen.mixer_nid = 0; /* no loopback on ALC300 */ - break; -+ case 0x10ec0222: - case 0x10ec0623: - spec->codec_variant = ALC269_TYPE_ALC623; -+ spec->shutup = alc222_shutup; -+ spec->init_hook = alc222_init; - break; - case 0x10ec0700: - case 0x10ec0701: -diff --git a/sound/usb/usx2y/usbusx2y.c b/sound/usb/usx2y/usbusx2y.c -index 4c4ce0319d624d..0fe989a6337691 100644 ---- a/sound/usb/usx2y/usbusx2y.c -+++ b/sound/usb/usx2y/usbusx2y.c -@@ -151,6 +151,12 @@ static int snd_usx2y_card_used[SNDRV_CARDS]; - static void snd_usx2y_card_private_free(struct snd_card *card); - static void usx2y_unlinkseq(struct snd_usx2y_async_seq *s); - -+#ifdef USX2Y_NRPACKS_VARIABLE -+int nrpacks = USX2Y_NRPACKS; /* number of packets per urb */ -+module_param(nrpacks, int, 0444); -+MODULE_PARM_DESC(nrpacks, "Number of packets per URB."); -+#endif -+ - /* - * pipe 4 is used for switching the lamps, setting samplerate, volumes .... - */ -@@ -433,6 +439,11 @@ static int snd_usx2y_probe(struct usb_interface *intf, - struct snd_card *card; - int err; - -+#ifdef USX2Y_NRPACKS_VARIABLE -+ if (nrpacks < 0 || nrpacks > USX2Y_NRPACKS_MAX) -+ return -EINVAL; -+#endif -+ - if (le16_to_cpu(device->descriptor.idVendor) != 0x1604 || - (le16_to_cpu(device->descriptor.idProduct) != USB_ID_US122 && - le16_to_cpu(device->descriptor.idProduct) != USB_ID_US224 && -diff --git a/sound/usb/usx2y/usbusx2y.h b/sound/usb/usx2y/usbusx2y.h -index 8d82f5cc2fe1c8..0538c457921e67 100644 ---- a/sound/usb/usx2y/usbusx2y.h -+++ b/sound/usb/usx2y/usbusx2y.h -@@ -7,6 +7,32 @@ - - #define NRURBS 2 - -+/* Default value used for nr of packs per urb. -+ * 1 to 4 have been tested ok on uhci. -+ * To use 3 on ohci, you'd need a patch: -+ * look for "0000425-linux-2.6.9-rc4-mm1_ohci-hcd.patch.gz" on -+ * "https://bugtrack.alsa-project.org/alsa-bug/bug_view_page.php?bug_id=0000425" -+ * -+ * 1, 2 and 4 work out of the box on ohci, if I recall correctly. -+ * Bigger is safer operation, smaller gives lower latencies. -+ */ -+#define USX2Y_NRPACKS 4 -+ -+#define USX2Y_NRPACKS_MAX 1024 -+ -+/* If your system works ok with this module's parameter -+ * nrpacks set to 1, you might as well comment -+ * this define out, and thereby produce smaller, faster code. -+ * You'd also set USX2Y_NRPACKS to 1 then. -+ */ -+#define USX2Y_NRPACKS_VARIABLE 1 -+ -+#ifdef USX2Y_NRPACKS_VARIABLE -+extern int nrpacks; -+#define nr_of_packs() nrpacks -+#else -+#define nr_of_packs() USX2Y_NRPACKS -+#endif - - #define URBS_ASYNC_SEQ 10 - #define URB_DATA_LEN_ASYNC_SEQ 32 -diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c -index 5197599e7aa61b..98d0e8edc98328 100644 ---- a/sound/usb/usx2y/usbusx2yaudio.c -+++ b/sound/usb/usx2y/usbusx2yaudio.c -@@ -28,33 +28,6 @@ - #include "usx2y.h" - #include "usbusx2y.h" - --/* Default value used for nr of packs per urb. -- * 1 to 4 have been tested ok on uhci. -- * To use 3 on ohci, you'd need a patch: -- * look for "0000425-linux-2.6.9-rc4-mm1_ohci-hcd.patch.gz" on -- * "https://bugtrack.alsa-project.org/alsa-bug/bug_view_page.php?bug_id=0000425" -- * -- * 1, 2 and 4 work out of the box on ohci, if I recall correctly. -- * Bigger is safer operation, smaller gives lower latencies. -- */ --#define USX2Y_NRPACKS 4 -- --/* If your system works ok with this module's parameter -- * nrpacks set to 1, you might as well comment -- * this define out, and thereby produce smaller, faster code. -- * You'd also set USX2Y_NRPACKS to 1 then. -- */ --#define USX2Y_NRPACKS_VARIABLE 1 -- --#ifdef USX2Y_NRPACKS_VARIABLE --static int nrpacks = USX2Y_NRPACKS; /* number of packets per urb */ --#define nr_of_packs() nrpacks --module_param(nrpacks, int, 0444); --MODULE_PARM_DESC(nrpacks, "Number of packets per URB."); --#else --#define nr_of_packs() USX2Y_NRPACKS --#endif -- - static int usx2y_urb_capt_retire(struct snd_usx2y_substream *subs) - { - struct urb *urb = subs->completed_urb; -diff --git a/usr/include/Makefile b/usr/include/Makefile -index 07796df0a295b9..c16fbabb362581 100644 ---- a/usr/include/Makefile -+++ b/usr/include/Makefile -@@ -10,7 +10,7 @@ UAPI_CFLAGS := -std=c90 -Wall -Werror=implicit-function-declaration - - # In theory, we do not care -m32 or -m64 for header compile tests. - # It is here just because CONFIG_CC_CAN_LINK is tested with -m32 or -m64. --UAPI_CFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CFLAGS)) -+UAPI_CFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS)) - - # USERCFLAGS might contain sysroot location for CC. - UAPI_CFLAGS += $(USERCFLAGS) diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.083-084.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.083-084.patch deleted file mode 100644 index bf6653a4cd..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.083-084.patch +++ /dev/null @@ -1,7777 +0,0 @@ -diff --git a/Documentation/timers/no_hz.rst b/Documentation/timers/no_hz.rst -index f8786be15183c1..7fe8ef9718d8e3 100644 ---- a/Documentation/timers/no_hz.rst -+++ b/Documentation/timers/no_hz.rst -@@ -129,11 +129,8 @@ adaptive-tick CPUs: At least one non-adaptive-tick CPU must remain - online to handle timekeeping tasks in order to ensure that system - calls like gettimeofday() returns accurate values on adaptive-tick CPUs. - (This is not an issue for CONFIG_NO_HZ_IDLE=y because there are no running --user processes to observe slight drifts in clock rate.) Therefore, the --boot CPU is prohibited from entering adaptive-ticks mode. Specifying a --"nohz_full=" mask that includes the boot CPU will result in a boot-time --error message, and the boot CPU will be removed from the mask. Note that --this means that your system must have at least two CPUs in order for -+user processes to observe slight drifts in clock rate.) Note that this -+means that your system must have at least two CPUs in order for - CONFIG_NO_HZ_FULL=y to do anything for you. - - Finally, adaptive-ticks CPUs must have their RCU callbacks offloaded. -diff --git a/Makefile b/Makefile -index 59060f58cfeff1..dfef2497467b83 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 83 -+SUBLEVEL = 84 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/alpha/include/asm/elf.h b/arch/alpha/include/asm/elf.h -index e6da23f1da830a..adc87404ef87f7 100644 ---- a/arch/alpha/include/asm/elf.h -+++ b/arch/alpha/include/asm/elf.h -@@ -74,7 +74,7 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG]; - /* - * This is used to ensure we don't load something for the wrong architecture. - */ --#define elf_check_arch(x) ((x)->e_machine == EM_ALPHA) -+#define elf_check_arch(x) (((x)->e_machine == EM_ALPHA) && !((x)->e_flags & EF_ALPHA_32BIT)) - - /* - * These are used to set parameters in the core dumps. -@@ -139,10 +139,6 @@ extern int dump_elf_task(elf_greg_t *dest, struct task_struct *task); - : amask (AMASK_CIX) ? "ev6" : "ev67"); \ - }) - --#define SET_PERSONALITY(EX) \ -- set_personality(((EX).e_flags & EF_ALPHA_32BIT) \ -- ? PER_LINUX_32BIT : PER_LINUX) -- - extern int alpha_l1i_cacheshape; - extern int alpha_l1d_cacheshape; - extern int alpha_l2_cacheshape; -diff --git a/arch/alpha/include/asm/pgtable.h b/arch/alpha/include/asm/pgtable.h -index 635f0a5f5bbdeb..02e8817a89212c 100644 ---- a/arch/alpha/include/asm/pgtable.h -+++ b/arch/alpha/include/asm/pgtable.h -@@ -360,7 +360,7 @@ static inline pte_t pte_swp_clear_exclusive(pte_t pte) - - extern void paging_init(void); - --/* We have our own get_unmapped_area to cope with ADDR_LIMIT_32BIT. */ -+/* We have our own get_unmapped_area */ - #define HAVE_ARCH_UNMAPPED_AREA - - #endif /* _ALPHA_PGTABLE_H */ -diff --git a/arch/alpha/include/asm/processor.h b/arch/alpha/include/asm/processor.h -index 55bb1c09fd39d5..5dce5518a21119 100644 ---- a/arch/alpha/include/asm/processor.h -+++ b/arch/alpha/include/asm/processor.h -@@ -8,23 +8,19 @@ - #ifndef __ASM_ALPHA_PROCESSOR_H - #define __ASM_ALPHA_PROCESSOR_H - --#include /* for ADDR_LIMIT_32BIT */ -- - /* - * We have a 42-bit user address space: 4TB user VM... - */ - #define TASK_SIZE (0x40000000000UL) - --#define STACK_TOP \ -- (current->personality & ADDR_LIMIT_32BIT ? 0x80000000 : 0x00120000000UL) -+#define STACK_TOP (0x00120000000UL) - - #define STACK_TOP_MAX 0x00120000000UL - - /* This decides where the kernel will search for a free chunk of vm - * space during mmap's. - */ --#define TASK_UNMAPPED_BASE \ -- ((current->personality & ADDR_LIMIT_32BIT) ? 0x40000000 : TASK_SIZE / 2) -+#define TASK_UNMAPPED_BASE (TASK_SIZE / 2) - - /* This is dead. Everything has been moved to thread_info. */ - struct thread_struct { }; -diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c -index 5db88b6274396d..ebd076fad804fa 100644 ---- a/arch/alpha/kernel/osf_sys.c -+++ b/arch/alpha/kernel/osf_sys.c -@@ -1211,8 +1211,7 @@ SYSCALL_DEFINE1(old_adjtimex, struct timex32 __user *, txc_p) - return ret; - } - --/* Get an address range which is currently unmapped. Similar to the -- generic version except that we know how to honor ADDR_LIMIT_32BIT. */ -+/* Get an address range which is currently unmapped. */ - - static unsigned long - arch_get_unmapped_area_1(unsigned long addr, unsigned long len, -@@ -1234,13 +1233,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, - unsigned long len, unsigned long pgoff, - unsigned long flags) - { -- unsigned long limit; -- -- /* "32 bit" actually means 31 bit, since pointers sign extend. */ -- if (current->personality & ADDR_LIMIT_32BIT) -- limit = 0x80000000; -- else -- limit = TASK_SIZE; -+ unsigned long limit = TASK_SIZE; - - if (len > limit) - return -ENOMEM; -diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c -index 47781bec61719d..38f3fe2e6bf6b0 100644 ---- a/arch/arm64/mm/mmu.c -+++ b/arch/arm64/mm/mmu.c -@@ -1150,8 +1150,11 @@ int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node, - struct vmem_altmap *altmap) - { - WARN_ON((start < VMEMMAP_START) || (end > VMEMMAP_END)); -+ /* [start, end] should be within one section */ -+ WARN_ON_ONCE(end - start > PAGES_PER_SECTION * sizeof(struct page)); - -- if (!IS_ENABLED(CONFIG_ARM64_4K_PAGES)) -+ if (!IS_ENABLED(CONFIG_ARM64_4K_PAGES) || -+ (end - start < PAGES_PER_SECTION * sizeof(struct page))) - return vmemmap_populate_basepages(start, end, node, altmap); - else - return vmemmap_populate_hugepages(start, end, node, altmap); -diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c -index 61ac094e26bd78..b163817ad6daff 100644 ---- a/arch/x86/events/intel/core.c -+++ b/arch/x86/events/intel/core.c -@@ -3881,6 +3881,85 @@ static inline bool intel_pmu_has_cap(struct perf_event *event, int idx) - return test_bit(idx, (unsigned long *)&intel_cap->capabilities); - } - -+static u64 intel_pmu_freq_start_period(struct perf_event *event) -+{ -+ int type = event->attr.type; -+ u64 config, factor; -+ s64 start; -+ -+ /* -+ * The 127 is the lowest possible recommended SAV (sample after value) -+ * for a 4000 freq (default freq), according to the event list JSON file. -+ * Also, assume the workload is idle 50% time. -+ */ -+ factor = 64 * 4000; -+ if (type != PERF_TYPE_HARDWARE && type != PERF_TYPE_HW_CACHE) -+ goto end; -+ -+ /* -+ * The estimation of the start period in the freq mode is -+ * based on the below assumption. -+ * -+ * For a cycles or an instructions event, 1GHZ of the -+ * underlying platform, 1 IPC. The workload is idle 50% time. -+ * The start period = 1,000,000,000 * 1 / freq / 2. -+ * = 500,000,000 / freq -+ * -+ * Usually, the branch-related events occur less than the -+ * instructions event. According to the Intel event list JSON -+ * file, the SAV (sample after value) of a branch-related event -+ * is usually 1/4 of an instruction event. -+ * The start period of branch-related events = 125,000,000 / freq. -+ * -+ * The cache-related events occurs even less. The SAV is usually -+ * 1/20 of an instruction event. -+ * The start period of cache-related events = 25,000,000 / freq. -+ */ -+ config = event->attr.config & PERF_HW_EVENT_MASK; -+ if (type == PERF_TYPE_HARDWARE) { -+ switch (config) { -+ case PERF_COUNT_HW_CPU_CYCLES: -+ case PERF_COUNT_HW_INSTRUCTIONS: -+ case PERF_COUNT_HW_BUS_CYCLES: -+ case PERF_COUNT_HW_STALLED_CYCLES_FRONTEND: -+ case PERF_COUNT_HW_STALLED_CYCLES_BACKEND: -+ case PERF_COUNT_HW_REF_CPU_CYCLES: -+ factor = 500000000; -+ break; -+ case PERF_COUNT_HW_BRANCH_INSTRUCTIONS: -+ case PERF_COUNT_HW_BRANCH_MISSES: -+ factor = 125000000; -+ break; -+ case PERF_COUNT_HW_CACHE_REFERENCES: -+ case PERF_COUNT_HW_CACHE_MISSES: -+ factor = 25000000; -+ break; -+ default: -+ goto end; -+ } -+ } -+ -+ if (type == PERF_TYPE_HW_CACHE) -+ factor = 25000000; -+end: -+ /* -+ * Usually, a prime or a number with less factors (close to prime) -+ * is chosen as an SAV, which makes it less likely that the sampling -+ * period synchronizes with some periodic event in the workload. -+ * Minus 1 to make it at least avoiding values near power of twos -+ * for the default freq. -+ */ -+ start = DIV_ROUND_UP_ULL(factor, event->attr.sample_freq) - 1; -+ -+ if (start > x86_pmu.max_period) -+ start = x86_pmu.max_period; -+ -+ if (x86_pmu.limit_period) -+ x86_pmu.limit_period(event, &start); -+ -+ return start; -+} -+ - static int intel_pmu_hw_config(struct perf_event *event) - { - int ret = x86_pmu_hw_config(event); -@@ -3892,6 +3971,12 @@ static int intel_pmu_hw_config(struct perf_event *event) - if (ret) - return ret; - -+ if (event->attr.freq && event->attr.sample_freq) { -+ event->hw.sample_period = intel_pmu_freq_start_period(event); -+ event->hw.last_period = event->hw.sample_period; -+ local64_set(&event->hw.period_left, event->hw.sample_period); -+ } -+ - if (event->attr.precise_ip) { - if ((event->attr.config & INTEL_ARCH_EVENT_MASK) == INTEL_FIXED_VLBR_EVENT) - return -EINVAL; -diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c -index af766298b253bd..c683e8dedfee83 100644 ---- a/arch/x86/kernel/cpu/microcode/amd.c -+++ b/arch/x86/kernel/cpu/microcode/amd.c -@@ -1078,7 +1078,7 @@ static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t siz - if (ret != UCODE_OK) - return ret; - -- for_each_node(nid) { -+ for_each_node_with_cpus(nid) { - cpu = cpumask_first(cpumask_of_node(nid)); - c = &cpu_data(cpu); - -diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c -index 5ae77d966cafea..e709070eed7083 100644 ---- a/arch/x86/kernel/cpu/mshyperv.c -+++ b/arch/x86/kernel/cpu/mshyperv.c -@@ -16,7 +16,6 @@ - #include - #include - #include --#include - #include - #include - #include -@@ -575,16 +574,6 @@ static void __init ms_hyperv_init_platform(void) - if (efi_enabled(EFI_BOOT)) - x86_platform.get_nmi_reason = hv_get_nmi_reason; - -- /* -- * Hyper-V VMs have a PIT emulation quirk such that zeroing the -- * counter register during PIT shutdown restarts the PIT. So it -- * continues to interrupt @18.2 HZ. Setting i8253_clear_counter -- * to false tells pit_shutdown() not to zero the counter so that -- * the PIT really is shutdown. Generation 2 VMs don't have a PIT, -- * and setting this value has no effect. -- */ -- i8253_clear_counter_on_shutdown = false; -- - #if IS_ENABLED(CONFIG_HYPERV) - if ((hv_get_isolation_type() == HV_ISOLATION_TYPE_VBS) || - ms_hyperv.paravisor_present) -diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c -index 11761c12454533..6573678c4bf4be 100644 ---- a/arch/x86/kernel/irq.c -+++ b/arch/x86/kernel/irq.c -@@ -23,8 +23,10 @@ - #include - #include - -+#if defined(CONFIG_X86_LOCAL_APIC) || defined(CONFIG_X86_THERMAL_VECTOR) - #define CREATE_TRACE_POINTS - #include -+#endif - - DEFINE_PER_CPU_SHARED_ALIGNED(irq_cpustat_t, irq_stat); - EXPORT_PER_CPU_SYMBOL(irq_stat); -diff --git a/block/bio.c b/block/bio.c -index 62419aa09d7319..4a8e7616995718 100644 ---- a/block/bio.c -+++ b/block/bio.c -@@ -78,7 +78,7 @@ struct bio_slab { - struct kmem_cache *slab; - unsigned int slab_ref; - unsigned int slab_size; -- char name[8]; -+ char name[12]; - }; - static DEFINE_MUTEX(bio_slab_lock); - static DEFINE_XARRAY(bio_slabs); -diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c -index 64d83ff3c0d90c..96a987506e717b 100644 ---- a/drivers/acpi/resource.c -+++ b/drivers/acpi/resource.c -@@ -549,6 +549,12 @@ static const struct dmi_system_id maingear_laptop[] = { - DMI_MATCH(DMI_BOARD_NAME, "RP-15"), - }, - }, -+ { -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Eluktronics Inc."), -+ DMI_MATCH(DMI_BOARD_NAME, "MECH-17"), -+ }, -+ }, - { - /* TongFang GM6XGxX/TUXEDO Stellaris 16 Gen5 AMD */ - .matches = { -diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c -index b73038ad86f7f3..44cf0e51d7db62 100644 ---- a/drivers/block/zram/zram_drv.c -+++ b/drivers/block/zram/zram_drv.c -@@ -2247,6 +2247,8 @@ static int zram_add(void) - zram->disk->private_data = zram; - snprintf(zram->disk->disk_name, 16, "zram%d", device_id); - -+ comp_algorithm_set(zram, ZRAM_PRIMARY_COMP, default_compressor); -+ - /* Actual capacity set using sysfs (/sys/block/zram/disksize */ - set_capacity(zram->disk, 0); - /* zram devices sort of resembles non-rotational disks */ -@@ -2281,8 +2283,6 @@ static int zram_add(void) - if (ret) - goto out_cleanup_disk; - -- comp_algorithm_set(zram, ZRAM_PRIMARY_COMP, default_compressor); -- - zram_debugfs_register(zram); - pr_info("Added device: %s\n", zram->disk->disk_name); - return device_id; -diff --git a/drivers/clk/samsung/clk-pll.c b/drivers/clk/samsung/clk-pll.c -index 74934c6182cea9..31650f32208929 100644 ---- a/drivers/clk/samsung/clk-pll.c -+++ b/drivers/clk/samsung/clk-pll.c -@@ -206,6 +206,7 @@ static const struct clk_ops samsung_pll3000_clk_ops = { - */ - /* Maximum lock time can be 270 * PDIV cycles */ - #define PLL35XX_LOCK_FACTOR (270) -+#define PLL142XX_LOCK_FACTOR (150) - - #define PLL35XX_MDIV_MASK (0x3FF) - #define PLL35XX_PDIV_MASK (0x3F) -@@ -272,7 +273,11 @@ static int samsung_pll35xx_set_rate(struct clk_hw *hw, unsigned long drate, - } - - /* Set PLL lock time. */ -- writel_relaxed(rate->pdiv * PLL35XX_LOCK_FACTOR, -+ if (pll->type == pll_142xx) -+ writel_relaxed(rate->pdiv * PLL142XX_LOCK_FACTOR, -+ pll->lock_reg); -+ else -+ writel_relaxed(rate->pdiv * PLL35XX_LOCK_FACTOR, - pll->lock_reg); - - /* Change PLL PMS values */ -diff --git a/drivers/clocksource/i8253.c b/drivers/clocksource/i8253.c -index cb215e6f2e8344..39f7c2d736d169 100644 ---- a/drivers/clocksource/i8253.c -+++ b/drivers/clocksource/i8253.c -@@ -20,13 +20,6 @@ - DEFINE_RAW_SPINLOCK(i8253_lock); - EXPORT_SYMBOL(i8253_lock); - --/* -- * Handle PIT quirk in pit_shutdown() where zeroing the counter register -- * restarts the PIT, negating the shutdown. On platforms with the quirk, -- * platform specific code can set this to false. -- */ --bool i8253_clear_counter_on_shutdown __ro_after_init = true; -- - #ifdef CONFIG_CLKSRC_I8253 - /* - * Since the PIT overflows every tick, its not very useful -@@ -112,12 +105,33 @@ void clockevent_i8253_disable(void) - { - raw_spin_lock(&i8253_lock); - -+ /* -+ * Writing the MODE register should stop the counter, according to -+ * the datasheet. This appears to work on real hardware (well, on -+ * modern Intel and AMD boxes; I didn't dig the Pegasos out of the -+ * shed). -+ * -+ * However, some virtual implementations differ, and the MODE change -+ * doesn't have any effect until either the counter is written (KVM -+ * in-kernel PIT) or the next interrupt (QEMU). And in those cases, -+ * it may not stop the *count*, only the interrupts. Although in -+ * the virt case, that probably doesn't matter, as the value of the -+ * counter will only be calculated on demand if the guest reads it; -+ * it's the interrupts which cause steal time. -+ * -+ * Hyper-V apparently has a bug where even in mode 0, the IRQ keeps -+ * firing repeatedly if the counter is running. But it *does* do the -+ * right thing when the MODE register is written. -+ * -+ * So: write the MODE and then load the counter, which ensures that -+ * the IRQ is stopped on those buggy virt implementations. And then -+ * write the MODE again, which is the right way to stop it. -+ */ - outb_p(0x30, PIT_MODE); -+ outb_p(0, PIT_CH0); -+ outb_p(0, PIT_CH0); - -- if (i8253_clear_counter_on_shutdown) { -- outb_p(0, PIT_CH0); -- outb_p(0, PIT_CH0); -- } -+ outb_p(0x30, PIT_MODE); - - raw_spin_unlock(&i8253_lock); - } -diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c -index 6e9788324fea55..371f24569b3b22 100644 ---- a/drivers/firmware/iscsi_ibft.c -+++ b/drivers/firmware/iscsi_ibft.c -@@ -310,7 +310,10 @@ static ssize_t ibft_attr_show_nic(void *data, int type, char *buf) - str += sprintf_ipaddr(str, nic->ip_addr); - break; - case ISCSI_BOOT_ETH_SUBNET_MASK: -- val = cpu_to_be32(~((1 << (32-nic->subnet_mask_prefix))-1)); -+ if (nic->subnet_mask_prefix > 32) -+ val = cpu_to_be32(~0); -+ else -+ val = cpu_to_be32(~((1 << (32-nic->subnet_mask_prefix))-1)); - str += sprintf(str, "%pI4", &val); - break; - case ISCSI_BOOT_ETH_PREFIX_LEN: -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index aab99df3ba1ae4..986ee37688c16c 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -227,6 +227,10 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev, - static void handle_hpd_irq_helper(struct amdgpu_dm_connector *aconnector); - static void handle_hpd_rx_irq(void *param); - -+static void amdgpu_dm_backlight_set_level(struct amdgpu_display_manager *dm, -+ int bl_idx, -+ u32 user_brightness); -+ - static bool - is_timing_unchanged_for_freesync(struct drm_crtc_state *old_crtc_state, - struct drm_crtc_state *new_crtc_state); -@@ -2879,6 +2883,12 @@ static int dm_resume(void *handle) - - mutex_unlock(&dm->dc_lock); - -+ /* set the backlight after a reset */ -+ for (i = 0; i < dm->num_of_edps; i++) { -+ if (dm->backlight_dev[i]) -+ amdgpu_dm_backlight_set_level(dm, i, dm->brightness[i]); -+ } -+ - return 0; - } - /* Recreate dc_state - DC invalidates it when setting power state to S3. */ -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c -index 20cfc5be21a44a..2ad9f900a85749 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c -@@ -455,6 +455,7 @@ void hdcp_destroy(struct kobject *kobj, struct hdcp_workqueue *hdcp_work) - for (i = 0; i < hdcp_work->max_link; i++) { - cancel_delayed_work_sync(&hdcp_work[i].callback_dwork); - cancel_delayed_work_sync(&hdcp_work[i].watchdog_timer_dwork); -+ cancel_delayed_work_sync(&hdcp_work[i].property_validate_dwork); - } - - sysfs_remove_bin_file(kobj, &hdcp_work[0].attr); -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c -index da47e68b10ce0d..29e1b252ec7305 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c -@@ -891,8 +891,16 @@ void amdgpu_dm_hpd_init(struct amdgpu_device *adev) - struct drm_device *dev = adev_to_drm(adev); - struct drm_connector *connector; - struct drm_connector_list_iter iter; -+ int irq_type; - int i; - -+ /* First, clear all hpd and hpdrx interrupts */ -+ for (i = DC_IRQ_SOURCE_HPD1; i <= DC_IRQ_SOURCE_HPD6RX; i++) { -+ if (!dc_interrupt_set(adev->dm.dc, i, false)) -+ drm_err(dev, "Failed to clear hpd(rx) source=%d on init\n", -+ i); -+ } -+ - drm_connector_list_iter_begin(dev, &iter); - drm_for_each_connector_iter(connector, &iter) { - struct amdgpu_dm_connector *amdgpu_dm_connector = -@@ -900,10 +908,31 @@ void amdgpu_dm_hpd_init(struct amdgpu_device *adev) - - const struct dc_link *dc_link = amdgpu_dm_connector->dc_link; - -+ /* -+ * Get a base driver irq reference for hpd ints for the lifetime -+ * of dm. Note that only hpd interrupt types are registered with -+ * base driver; hpd_rx types aren't. IOW, amdgpu_irq_get/put on -+ * hpd_rx isn't available. DM currently controls hpd_rx -+ * explicitly with dc_interrupt_set() -+ */ - if (dc_link->irq_source_hpd != DC_IRQ_SOURCE_INVALID) { -- dc_interrupt_set(adev->dm.dc, -- dc_link->irq_source_hpd, -- true); -+ irq_type = dc_link->irq_source_hpd - DC_IRQ_SOURCE_HPD1; -+ /* -+ * TODO: There's a mismatch between mode_info.num_hpd -+ * and what bios reports as the # of connectors with hpd -+ * sources. Since the # of hpd source types registered -+ * with base driver == mode_info.num_hpd, we have to -+ * fallback to dc_interrupt_set for the remaining types. -+ */ -+ if (irq_type < adev->mode_info.num_hpd) { -+ if (amdgpu_irq_get(adev, &adev->hpd_irq, irq_type)) -+ drm_err(dev, "DM_IRQ: Failed get HPD for source=%d)!\n", -+ dc_link->irq_source_hpd); -+ } else { -+ dc_interrupt_set(adev->dm.dc, -+ dc_link->irq_source_hpd, -+ true); -+ } - } - - if (dc_link->irq_source_hpd_rx != DC_IRQ_SOURCE_INVALID) { -@@ -913,12 +942,6 @@ void amdgpu_dm_hpd_init(struct amdgpu_device *adev) - } - } - drm_connector_list_iter_end(&iter); -- -- /* Update reference counts for HPDs */ -- for (i = DC_IRQ_SOURCE_HPD1; i <= adev->mode_info.num_hpd; i++) { -- if (amdgpu_irq_get(adev, &adev->hpd_irq, i - DC_IRQ_SOURCE_HPD1)) -- drm_err(dev, "DM_IRQ: Failed get HPD for source=%d)!\n", i); -- } - } - - /** -@@ -934,7 +957,7 @@ void amdgpu_dm_hpd_fini(struct amdgpu_device *adev) - struct drm_device *dev = adev_to_drm(adev); - struct drm_connector *connector; - struct drm_connector_list_iter iter; -- int i; -+ int irq_type; - - drm_connector_list_iter_begin(dev, &iter); - drm_for_each_connector_iter(connector, &iter) { -@@ -943,9 +966,18 @@ void amdgpu_dm_hpd_fini(struct amdgpu_device *adev) - const struct dc_link *dc_link = amdgpu_dm_connector->dc_link; - - if (dc_link->irq_source_hpd != DC_IRQ_SOURCE_INVALID) { -- dc_interrupt_set(adev->dm.dc, -- dc_link->irq_source_hpd, -- false); -+ irq_type = dc_link->irq_source_hpd - DC_IRQ_SOURCE_HPD1; -+ -+ /* TODO: See same TODO in amdgpu_dm_hpd_init() */ -+ if (irq_type < adev->mode_info.num_hpd) { -+ if (amdgpu_irq_put(adev, &adev->hpd_irq, irq_type)) -+ drm_err(dev, "DM_IRQ: Failed put HPD for source=%d!\n", -+ dc_link->irq_source_hpd); -+ } else { -+ dc_interrupt_set(adev->dm.dc, -+ dc_link->irq_source_hpd, -+ false); -+ } - } - - if (dc_link->irq_source_hpd_rx != DC_IRQ_SOURCE_INVALID) { -@@ -955,10 +987,4 @@ void amdgpu_dm_hpd_fini(struct amdgpu_device *adev) - } - } - drm_connector_list_iter_end(&iter); -- -- /* Update reference counts for HPDs */ -- for (i = DC_IRQ_SOURCE_HPD1; i <= adev->mode_info.num_hpd; i++) { -- if (amdgpu_irq_put(adev, &adev->hpd_irq, i - DC_IRQ_SOURCE_HPD1)) -- drm_err(dev, "DM_IRQ: Failed put HPD for source=%d!\n", i); -- } - } -diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -index 69c0d0b341af2a..2f25f7096c4d63 100644 ---- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -@@ -2567,10 +2567,13 @@ static int get_norm_pix_clk(const struct dc_crtc_timing *timing) - break; - case COLOR_DEPTH_121212: - normalized_pix_clk = (pix_clk * 36) / 24; -- break; -+ break; -+ case COLOR_DEPTH_141414: -+ normalized_pix_clk = (pix_clk * 42) / 24; -+ break; - case COLOR_DEPTH_161616: - normalized_pix_clk = (pix_clk * 48) / 24; -- break; -+ break; - default: - ASSERT(0); - break; -diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c -index d6c5de190c2742..08f8a22431fe1f 100644 ---- a/drivers/gpu/drm/display/drm_dp_mst_topology.c -+++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c -@@ -3959,6 +3959,22 @@ static int drm_dp_mst_handle_down_rep(struct drm_dp_mst_topology_mgr *mgr) - return 0; - } - -+static bool primary_mstb_probing_is_done(struct drm_dp_mst_topology_mgr *mgr) -+{ -+ bool probing_done = false; -+ -+ mutex_lock(&mgr->lock); -+ -+ if (mgr->mst_primary && drm_dp_mst_topology_try_get_mstb(mgr->mst_primary)) { -+ probing_done = mgr->mst_primary->link_address_sent; -+ drm_dp_mst_topology_put_mstb(mgr->mst_primary); -+ } -+ -+ mutex_unlock(&mgr->lock); -+ -+ return probing_done; -+} -+ - static inline bool - drm_dp_mst_process_up_req(struct drm_dp_mst_topology_mgr *mgr, - struct drm_dp_pending_up_req *up_req) -@@ -3989,8 +4005,12 @@ drm_dp_mst_process_up_req(struct drm_dp_mst_topology_mgr *mgr, - - /* TODO: Add missing handler for DP_RESOURCE_STATUS_NOTIFY events */ - if (msg->req_type == DP_CONNECTION_STATUS_NOTIFY) { -- dowork = drm_dp_mst_handle_conn_stat(mstb, &msg->u.conn_stat); -- hotplug = true; -+ if (!primary_mstb_probing_is_done(mgr)) { -+ drm_dbg_kms(mgr->dev, "Got CSN before finish topology probing. Skip it.\n"); -+ } else { -+ dowork = drm_dp_mst_handle_conn_stat(mstb, &msg->u.conn_stat); -+ hotplug = true; -+ } - } - - drm_dp_mst_topology_put_mstb(mstb); -@@ -4069,10 +4089,11 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) - drm_dp_send_up_ack_reply(mgr, mst_primary, up_req->msg.req_type, - false); - -+ drm_dp_mst_topology_put_mstb(mst_primary); -+ - if (up_req->msg.req_type == DP_CONNECTION_STATUS_NOTIFY) { - const struct drm_dp_connection_status_notify *conn_stat = - &up_req->msg.u.conn_stat; -- bool handle_csn; - - drm_dbg_kms(mgr->dev, "Got CSN: pn: %d ldps:%d ddps: %d mcs: %d ip: %d pdt: %d\n", - conn_stat->port_number, -@@ -4081,16 +4102,6 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) - conn_stat->message_capability_status, - conn_stat->input_port, - conn_stat->peer_device_type); -- -- mutex_lock(&mgr->probe_lock); -- handle_csn = mst_primary->link_address_sent; -- mutex_unlock(&mgr->probe_lock); -- -- if (!handle_csn) { -- drm_dbg_kms(mgr->dev, "Got CSN before finish topology probing. Skip it."); -- kfree(up_req); -- goto out_put_primary; -- } - } else if (up_req->msg.req_type == DP_RESOURCE_STATUS_NOTIFY) { - const struct drm_dp_resource_status_notify *res_stat = - &up_req->msg.u.resource_stat; -@@ -4105,9 +4116,6 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) - list_add_tail(&up_req->next, &mgr->up_req_list); - mutex_unlock(&mgr->up_req_lock); - queue_work(system_long_wq, &mgr->up_req_work); -- --out_put_primary: -- drm_dp_mst_topology_put_mstb(mst_primary); - out_clear_reply: - memset(&mgr->up_req_recv, 0, sizeof(struct drm_dp_sideband_msg_rx)); - return 0; -diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c -index ab03b08433f8f3..814b1da36ee947 100644 ---- a/drivers/gpu/drm/drm_atomic_uapi.c -+++ b/drivers/gpu/drm/drm_atomic_uapi.c -@@ -974,6 +974,10 @@ int drm_atomic_connector_commit_dpms(struct drm_atomic_state *state, - - if (mode != DRM_MODE_DPMS_ON) - mode = DRM_MODE_DPMS_OFF; -+ -+ if (connector->dpms == mode) -+ goto out; -+ - connector->dpms = mode; - - crtc = connector->state->crtc; -diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c -index 35bed66214474a..573086d88fd261 100644 ---- a/drivers/gpu/drm/drm_connector.c -+++ b/drivers/gpu/drm/drm_connector.c -@@ -1162,6 +1162,10 @@ static const u32 dp_colorspaces = - * callback. For atomic drivers the remapping to the "ACTIVE" property is - * implemented in the DRM core. - * -+ * On atomic drivers any DPMS setproperty ioctl where the value does not -+ * change is completely skipped, otherwise a full atomic commit will occur. -+ * On legacy drivers the exact behavior is driver specific. -+ * - * Note that this property cannot be set through the MODE_ATOMIC ioctl, - * userspace must use "ACTIVE" on the CRTC instead. - * -diff --git a/drivers/gpu/drm/gma500/mid_bios.c b/drivers/gpu/drm/gma500/mid_bios.c -index 7e76790c6a81fa..cba97d7db131d8 100644 ---- a/drivers/gpu/drm/gma500/mid_bios.c -+++ b/drivers/gpu/drm/gma500/mid_bios.c -@@ -279,6 +279,11 @@ static void mid_get_vbt_data(struct drm_psb_private *dev_priv) - 0, PCI_DEVFN(2, 0)); - int ret = -1; - -+ if (pci_gfx_root == NULL) { -+ WARN_ON(1); -+ return; -+ } -+ - /* Get the address of the platform config vbt */ - pci_read_config_dword(pci_gfx_root, 0xFC, &addr); - pci_dev_put(pci_gfx_root); -diff --git a/drivers/gpu/drm/hyperv/hyperv_drm_drv.c b/drivers/gpu/drm/hyperv/hyperv_drm_drv.c -index 8026118c6e0330..8a7933f5c6ebe8 100644 ---- a/drivers/gpu/drm/hyperv/hyperv_drm_drv.c -+++ b/drivers/gpu/drm/hyperv/hyperv_drm_drv.c -@@ -157,6 +157,7 @@ static int hyperv_vmbus_probe(struct hv_device *hdev, - return 0; - - err_free_mmio: -+ iounmap(hv->vram); - vmbus_free_mmio(hv->mem->start, hv->fb_size); - err_vmbus_close: - vmbus_close(hdev->channel); -@@ -175,6 +176,7 @@ static void hyperv_vmbus_remove(struct hv_device *hdev) - vmbus_close(hdev->channel); - hv_set_drvdata(hdev, NULL); - -+ iounmap(hv->vram); - vmbus_free_mmio(hv->mem->start, hv->fb_size); - } - -diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c -index 347527885ffd75..28d132c238d192 100644 ---- a/drivers/gpu/drm/i915/display/intel_display.c -+++ b/drivers/gpu/drm/i915/display/intel_display.c -@@ -7097,9 +7097,6 @@ static void intel_atomic_commit_tail(struct intel_atomic_state *state) - /* Now enable the clocks, plane, pipe, and connectors that we set up. */ - dev_priv->display.funcs.display->commit_modeset_enables(state); - -- if (state->modeset) -- intel_set_cdclk_post_plane_update(state); -- - intel_wait_for_vblank_workers(state); - - /* FIXME: We should call drm_atomic_helper_commit_hw_done() here -@@ -7178,6 +7175,8 @@ static void intel_atomic_commit_tail(struct intel_atomic_state *state) - intel_verify_planes(state); - - intel_sagv_post_plane_update(state); -+ if (state->modeset) -+ intel_set_cdclk_post_plane_update(state); - intel_pmdemand_post_plane_update(state); - - drm_atomic_helper_commit_hw_done(&state->base); -diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c -index 22a125243d81f7..c1985448d9b382 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_connector.c -+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c -@@ -758,7 +758,6 @@ nouveau_connector_force(struct drm_connector *connector) - if (!nv_encoder) { - NV_ERROR(drm, "can't find encoder to force %s on!\n", - connector->name); -- connector->status = connector_status_disconnected; - return; - } - -diff --git a/drivers/gpu/drm/vkms/vkms_composer.c b/drivers/gpu/drm/vkms/vkms_composer.c -index e7441b227b3cea..3d6785d081f2cd 100644 ---- a/drivers/gpu/drm/vkms/vkms_composer.c -+++ b/drivers/gpu/drm/vkms/vkms_composer.c -@@ -98,7 +98,7 @@ static u16 lerp_u16(u16 a, u16 b, s64 t) - - s64 delta = drm_fixp_mul(b_fp - a_fp, t); - -- return drm_fixp2int(a_fp + delta); -+ return drm_fixp2int_round(a_fp + delta); - } - - static s64 get_lut_index(const struct vkms_color_lut *lut, u16 channel_value) -diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig -index 9e2cde55b465ce..979ebe69c8e303 100644 ---- a/drivers/hid/Kconfig -+++ b/drivers/hid/Kconfig -@@ -1151,7 +1151,8 @@ config HID_TOPRE - tristate "Topre REALFORCE keyboards" - depends on HID - help -- Say Y for N-key rollover support on Topre REALFORCE R2 108/87 key keyboards. -+ Say Y for N-key rollover support on Topre REALFORCE R2 108/87 key and -+ Topre REALFORCE R3S 87 key keyboards. - - config HID_THINGM - tristate "ThingM blink(1) USB RGB LED" -diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c -index d9e9829b22001a..0b561c1eb59e2e 100644 ---- a/drivers/hid/hid-apple.c -+++ b/drivers/hid/hid-apple.c -@@ -363,6 +363,12 @@ static bool apple_is_non_apple_keyboard(struct hid_device *hdev) - return false; - } - -+static bool apple_is_omoton_kb066(struct hid_device *hdev) -+{ -+ return hdev->product == USB_DEVICE_ID_APPLE_ALU_WIRELESS_ANSI && -+ strcmp(hdev->name, "Bluetooth Keyboard") == 0; -+} -+ - static inline void apple_setup_key_translation(struct input_dev *input, - const struct apple_key_translation *table) - { -@@ -459,6 +465,7 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input, - hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_2015) - table = magic_keyboard_2015_fn_keys; - else if (hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021 || -+ hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2024 || - hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021 || - hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_2021) - table = apple2021_fn_keys; -@@ -709,7 +716,7 @@ static int apple_input_configured(struct hid_device *hdev, - { - struct apple_sc *asc = hid_get_drvdata(hdev); - -- if ((asc->quirks & APPLE_HAS_FN) && !asc->fn_found) { -+ if (((asc->quirks & APPLE_HAS_FN) && !asc->fn_found) || apple_is_omoton_kb066(hdev)) { - hid_info(hdev, "Fn key not found (Apple Wireless Keyboard clone?), disabling Fn key handling\n"); - asc->quirks &= ~APPLE_HAS_FN; - } -@@ -1064,6 +1071,10 @@ static const struct hid_device_id apple_devices[] = { - .driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK | APPLE_RDESC_BATTERY }, - { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021), - .driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2024), -+ .driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK | APPLE_RDESC_BATTERY }, -+ { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2024), -+ .driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK }, - { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021), - .driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK | APPLE_RDESC_BATTERY }, - { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021), -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index 1174626904cb02..09090803f1dd2a 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -184,6 +184,7 @@ - #define USB_DEVICE_ID_APPLE_IRCONTROL4 0x8242 - #define USB_DEVICE_ID_APPLE_IRCONTROL5 0x8243 - #define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021 0x029c -+#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2024 0x0320 - #define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021 0x029a - #define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_2021 0x029f - #define USB_DEVICE_ID_APPLE_TOUCHBAR_BACKLIGHT 0x8102 -@@ -1085,6 +1086,7 @@ - #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001 0x3001 - #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003 0x3003 - #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008 0x3008 -+#define USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473 0x5473 - - #define I2C_VENDOR_ID_RAYDIUM 0x2386 - #define I2C_PRODUCT_ID_RAYDIUM_4B33 0x4b33 -@@ -1284,6 +1286,7 @@ - #define USB_VENDOR_ID_TOPRE 0x0853 - #define USB_DEVICE_ID_TOPRE_REALFORCE_R2_108 0x0148 - #define USB_DEVICE_ID_TOPRE_REALFORCE_R2_87 0x0146 -+#define USB_DEVICE_ID_TOPRE_REALFORCE_R3S_87 0x0313 - - #define USB_VENDOR_ID_TOPSEED 0x0766 - #define USB_DEVICE_ID_TOPSEED_CYBERLINK 0x0204 -diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c -index e0bbf0c6345d68..5d7a418ccdbecf 100644 ---- a/drivers/hid/hid-quirks.c -+++ b/drivers/hid/hid-quirks.c -@@ -891,6 +891,7 @@ - { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_DPAD) }, - #endif - { HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473) }, - { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_MULTITOUCH) }, - { HID_USB_DEVICE(USB_VENDOR_ID_ODROID, USB_DEVICE_ID_VU5) }, - { HID_USB_DEVICE(USB_VENDOR_ID_ODROID, USB_DEVICE_ID_VU7PLUS) }, -diff --git a/drivers/hid/hid-topre.c b/drivers/hid/hid-topre.c -index d1d5ca310eadc0..e69367267d841d 100644 ---- a/drivers/hid/hid-topre.c -+++ b/drivers/hid/hid-topre.c -@@ -29,6 +29,11 @@ static __u8 *topre_report_fixup(struct hid_device *hdev, __u8 *rdesc, - hid_info(hdev, - "fixing up Topre REALFORCE keyboard report descriptor\n"); - rdesc[72] = 0x02; -+ } else if (*rsize >= 106 && rdesc[28] == 0x29 && rdesc[29] == 0xe7 && -+ rdesc[30] == 0x81 && rdesc[31] == 0x00) { -+ hid_info(hdev, -+ "fixing up Topre REALFORCE keyboard report descriptor\n"); -+ rdesc[31] = 0x02; - } - return rdesc; - } -@@ -38,6 +43,8 @@ static const struct hid_device_id topre_id_table[] = { - USB_DEVICE_ID_TOPRE_REALFORCE_R2_108) }, - { HID_USB_DEVICE(USB_VENDOR_ID_TOPRE, - USB_DEVICE_ID_TOPRE_REALFORCE_R2_87) }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_TOPRE, -+ USB_DEVICE_ID_TOPRE_REALFORCE_R3S_87) }, - { } - }; - MODULE_DEVICE_TABLE(hid, topre_id_table); -diff --git a/drivers/hid/intel-ish-hid/ipc/ipc.c b/drivers/hid/intel-ish-hid/ipc/ipc.c -index dd5fc60874ba1d..42141a78bdb4b2 100644 ---- a/drivers/hid/intel-ish-hid/ipc/ipc.c -+++ b/drivers/hid/intel-ish-hid/ipc/ipc.c -@@ -517,6 +517,10 @@ static int ish_fw_reset_handler(struct ishtp_device *dev) - /* ISH FW is dead */ - if (!ish_is_input_ready(dev)) - return -EPIPE; -+ -+ /* Send clock sync at once after reset */ -+ ishtp_dev->prev_sync = 0; -+ - /* - * Set HOST2ISH.ILUP. Apparently we need this BEFORE sending - * RESET_NOTIFY_ACK - FW will be checking for it -@@ -576,15 +580,14 @@ static void fw_reset_work_fn(struct work_struct *unused) - */ - static void _ish_sync_fw_clock(struct ishtp_device *dev) - { -- static unsigned long prev_sync; -- uint64_t usec; -+ struct ipc_time_update_msg time = {}; - -- if (prev_sync && time_before(jiffies, prev_sync + 20 * HZ)) -+ if (dev->prev_sync && time_before(jiffies, dev->prev_sync + 20 * HZ)) - return; - -- prev_sync = jiffies; -- usec = ktime_to_us(ktime_get_boottime()); -- ipc_send_mng_msg(dev, MNG_SYNC_FW_CLOCK, &usec, sizeof(uint64_t)); -+ dev->prev_sync = jiffies; -+ /* The fields of time would be updated while sending message */ -+ ipc_send_mng_msg(dev, MNG_SYNC_FW_CLOCK, &time, sizeof(time)); - } - - /** -diff --git a/drivers/hid/intel-ish-hid/ishtp/ishtp-dev.h b/drivers/hid/intel-ish-hid/ishtp/ishtp-dev.h -index 32142c7d9a0438..9b2ee3fe04b8fe 100644 ---- a/drivers/hid/intel-ish-hid/ishtp/ishtp-dev.h -+++ b/drivers/hid/intel-ish-hid/ishtp/ishtp-dev.h -@@ -212,6 +212,8 @@ struct ishtp_device { - unsigned int ipc_tx_cnt; - unsigned long long ipc_tx_bytes_cnt; - -+ /* Time of the last clock sync */ -+ unsigned long prev_sync; - const struct ishtp_hw_ops *ops; - size_t mtu; - uint32_t ishtp_msg_hdr; -diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c -index 756aebf324735f..c54d759b073842 100644 ---- a/drivers/hv/vmbus_drv.c -+++ b/drivers/hv/vmbus_drv.c -@@ -2242,12 +2242,25 @@ void vmbus_free_mmio(resource_size_t start, resource_size_t size) - struct resource *iter; - - mutex_lock(&hyperv_mmio_lock); -+ -+ /* -+ * If all bytes of the MMIO range to be released are within the -+ * special case fb_mmio shadow region, skip releasing the shadow -+ * region since no corresponding __request_region() was done -+ * in vmbus_allocate_mmio(). -+ */ -+ if (fb_mmio && start >= fb_mmio->start && -+ (start + size - 1 <= fb_mmio->end)) -+ goto skip_shadow_release; -+ - for (iter = hyperv_mmio; iter; iter = iter->sibling) { - if ((iter->start >= start + size) || (iter->end <= start)) - continue; - - __release_region(iter, start, size); - } -+ -+skip_shadow_release: - release_mem_region(start, size); - mutex_unlock(&hyperv_mmio_lock); - -diff --git a/drivers/i2c/busses/i2c-ali1535.c b/drivers/i2c/busses/i2c-ali1535.c -index ee83c4581bce05..cd2c8afebe798d 100644 ---- a/drivers/i2c/busses/i2c-ali1535.c -+++ b/drivers/i2c/busses/i2c-ali1535.c -@@ -490,6 +490,8 @@ MODULE_DEVICE_TABLE(pci, ali1535_ids); - - static int ali1535_probe(struct pci_dev *dev, const struct pci_device_id *id) - { -+ int ret; -+ - if (ali1535_setup(dev)) { - dev_warn(&dev->dev, - "ALI1535 not detected, module not inserted.\n"); -@@ -501,7 +503,15 @@ static int ali1535_probe(struct pci_dev *dev, const struct pci_device_id *id) - - snprintf(ali1535_adapter.name, sizeof(ali1535_adapter.name), - "SMBus ALI1535 adapter at %04x", ali1535_offset); -- return i2c_add_adapter(&ali1535_adapter); -+ ret = i2c_add_adapter(&ali1535_adapter); -+ if (ret) -+ goto release_region; -+ -+ return 0; -+ -+release_region: -+ release_region(ali1535_smba, ALI1535_SMB_IOSIZE); -+ return ret; - } - - static void ali1535_remove(struct pci_dev *dev) -diff --git a/drivers/i2c/busses/i2c-ali15x3.c b/drivers/i2c/busses/i2c-ali15x3.c -index 0231c5be6354f4..c3f76b13a76f52 100644 ---- a/drivers/i2c/busses/i2c-ali15x3.c -+++ b/drivers/i2c/busses/i2c-ali15x3.c -@@ -474,6 +474,8 @@ MODULE_DEVICE_TABLE (pci, ali15x3_ids); - - static int ali15x3_probe(struct pci_dev *dev, const struct pci_device_id *id) - { -+ int ret; -+ - if (ali15x3_setup(dev)) { - dev_err(&dev->dev, - "ALI15X3 not detected, module not inserted.\n"); -@@ -485,7 +487,15 @@ static int ali15x3_probe(struct pci_dev *dev, const struct pci_device_id *id) - - snprintf(ali15x3_adapter.name, sizeof(ali15x3_adapter.name), - "SMBus ALI15X3 adapter at %04x", ali15x3_smba); -- return i2c_add_adapter(&ali15x3_adapter); -+ ret = i2c_add_adapter(&ali15x3_adapter); -+ if (ret) -+ goto release_region; -+ -+ return 0; -+ -+release_region: -+ release_region(ali15x3_smba, ALI15X3_SMB_IOSIZE); -+ return ret; - } - - static void ali15x3_remove(struct pci_dev *dev) -diff --git a/drivers/i2c/busses/i2c-sis630.c b/drivers/i2c/busses/i2c-sis630.c -index 87d56250d78a3e..c42ecadac4f22d 100644 ---- a/drivers/i2c/busses/i2c-sis630.c -+++ b/drivers/i2c/busses/i2c-sis630.c -@@ -509,6 +509,8 @@ MODULE_DEVICE_TABLE(pci, sis630_ids); - - static int sis630_probe(struct pci_dev *dev, const struct pci_device_id *id) - { -+ int ret; -+ - if (sis630_setup(dev)) { - dev_err(&dev->dev, - "SIS630 compatible bus not detected, " -@@ -522,7 +524,15 @@ static int sis630_probe(struct pci_dev *dev, const struct pci_device_id *id) - snprintf(sis630_adapter.name, sizeof(sis630_adapter.name), - "SMBus SIS630 adapter at %04x", smbus_base + SMB_STS); - -- return i2c_add_adapter(&sis630_adapter); -+ ret = i2c_add_adapter(&sis630_adapter); -+ if (ret) -+ goto release_region; -+ -+ return 0; -+ -+release_region: -+ release_region(smbus_base + SMB_STS, SIS630_SMB_IOREGION); -+ return ret; - } - - static void sis630_remove(struct pci_dev *dev) -diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c -index 198a44c87e8411..b91467c8e6c402 100644 ---- a/drivers/input/joystick/xpad.c -+++ b/drivers/input/joystick/xpad.c -@@ -140,6 +140,7 @@ static const struct xpad_device { - { 0x044f, 0x0f00, "Thrustmaster Wheel", 0, XTYPE_XBOX }, - { 0x044f, 0x0f03, "Thrustmaster Wheel", 0, XTYPE_XBOX }, - { 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX }, -+ { 0x044f, 0xd01e, "ThrustMaster, Inc. ESWAP X 2 ELDEN RING EDITION", 0, XTYPE_XBOXONE }, - { 0x044f, 0x0f10, "Thrustmaster Modena GT Wheel", 0, XTYPE_XBOX }, - { 0x044f, 0xb326, "Thrustmaster Gamepad GP XID", 0, XTYPE_XBOX360 }, - { 0x045e, 0x0202, "Microsoft X-Box pad v1 (US)", 0, XTYPE_XBOX }, -@@ -177,6 +178,7 @@ static const struct xpad_device { - { 0x06a3, 0x0200, "Saitek Racing Wheel", 0, XTYPE_XBOX }, - { 0x06a3, 0x0201, "Saitek Adrenalin", 0, XTYPE_XBOX }, - { 0x06a3, 0xf51a, "Saitek P3600", 0, XTYPE_XBOX360 }, -+ { 0x0738, 0x4503, "Mad Catz Racing Wheel", 0, XTYPE_XBOXONE }, - { 0x0738, 0x4506, "Mad Catz 4506 Wireless Controller", 0, XTYPE_XBOX }, - { 0x0738, 0x4516, "Mad Catz Control Pad", 0, XTYPE_XBOX }, - { 0x0738, 0x4520, "Mad Catz Control Pad Pro", 0, XTYPE_XBOX }, -@@ -238,6 +240,7 @@ static const struct xpad_device { - { 0x0e6f, 0x0146, "Rock Candy Wired Controller for Xbox One", 0, XTYPE_XBOXONE }, - { 0x0e6f, 0x0147, "PDP Marvel Xbox One Controller", 0, XTYPE_XBOXONE }, - { 0x0e6f, 0x015c, "PDP Xbox One Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, -+ { 0x0e6f, 0x015d, "PDP Mirror's Edge Official Wired Controller for Xbox One", XTYPE_XBOXONE }, - { 0x0e6f, 0x0161, "PDP Xbox One Controller", 0, XTYPE_XBOXONE }, - { 0x0e6f, 0x0162, "PDP Xbox One Controller", 0, XTYPE_XBOXONE }, - { 0x0e6f, 0x0163, "PDP Xbox One Controller", 0, XTYPE_XBOXONE }, -@@ -276,12 +279,15 @@ static const struct xpad_device { - { 0x0f0d, 0x0078, "Hori Real Arcade Pro V Kai Xbox One", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, - { 0x0f0d, 0x00c5, "Hori Fighting Commander ONE", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, - { 0x0f0d, 0x00dc, "HORIPAD FPS for Nintendo Switch", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x0f0d, 0x0151, "Hori Racing Wheel Overdrive for Xbox Series X", 0, XTYPE_XBOXONE }, -+ { 0x0f0d, 0x0152, "Hori Racing Wheel Overdrive for Xbox Series X", 0, XTYPE_XBOXONE }, - { 0x0f30, 0x010b, "Philips Recoil", 0, XTYPE_XBOX }, - { 0x0f30, 0x0202, "Joytech Advanced Controller", 0, XTYPE_XBOX }, - { 0x0f30, 0x8888, "BigBen XBMiniPad Controller", 0, XTYPE_XBOX }, - { 0x102c, 0xff0c, "Joytech Wireless Advanced Controller", 0, XTYPE_XBOX }, - { 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 }, - { 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 }, -+ { 0x10f5, 0x7005, "Turtle Beach Recon Controller", 0, XTYPE_XBOXONE }, - { 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 }, - { 0x11ff, 0x0511, "PXN V900", 0, XTYPE_XBOX360 }, - { 0x1209, 0x2882, "Ardwiino Controller", 0, XTYPE_XBOX360 }, -@@ -306,7 +312,7 @@ static const struct xpad_device { - { 0x1689, 0xfe00, "Razer Sabertooth", 0, XTYPE_XBOX360 }, - { 0x17ef, 0x6182, "Lenovo Legion Controller for Windows", 0, XTYPE_XBOX360 }, - { 0x1949, 0x041a, "Amazon Game Controller", 0, XTYPE_XBOX360 }, -- { 0x1a86, 0xe310, "QH Electronics Controller", 0, XTYPE_XBOX360 }, -+ { 0x1a86, 0xe310, "Legion Go S", 0, XTYPE_XBOX360 }, - { 0x1bad, 0x0002, "Harmonix Rock Band Guitar", 0, XTYPE_XBOX360 }, - { 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, - { 0x1bad, 0x0130, "Ion Drum Rocker", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, -@@ -343,6 +349,7 @@ static const struct xpad_device { - { 0x1bad, 0xfa01, "MadCatz GamePad", 0, XTYPE_XBOX360 }, - { 0x1bad, 0xfd00, "Razer Onza TE", 0, XTYPE_XBOX360 }, - { 0x1bad, 0xfd01, "Razer Onza", 0, XTYPE_XBOX360 }, -+ { 0x1ee9, 0x1590, "ZOTAC Gaming Zone", 0, XTYPE_XBOX360 }, - { 0x20d6, 0x2001, "BDA Xbox Series X Wired Controller", 0, XTYPE_XBOXONE }, - { 0x20d6, 0x2009, "PowerA Enhanced Wired Controller for Xbox Series X|S", 0, XTYPE_XBOXONE }, - { 0x20d6, 0x281f, "PowerA Wired Controller For Xbox 360", 0, XTYPE_XBOX360 }, -@@ -365,6 +372,7 @@ static const struct xpad_device { - { 0x24c6, 0x5510, "Hori Fighting Commander ONE (Xbox 360/PC Mode)", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, - { 0x24c6, 0x551a, "PowerA FUSION Pro Controller", 0, XTYPE_XBOXONE }, - { 0x24c6, 0x561a, "PowerA FUSION Controller", 0, XTYPE_XBOXONE }, -+ { 0x24c6, 0x581a, "ThrustMaster XB1 Classic Controller", 0, XTYPE_XBOXONE }, - { 0x24c6, 0x5b00, "ThrustMaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 }, - { 0x24c6, 0x5b02, "Thrustmaster, Inc. GPX Controller", 0, XTYPE_XBOX360 }, - { 0x24c6, 0x5b03, "Thrustmaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 }, -@@ -373,10 +381,15 @@ static const struct xpad_device { - { 0x2563, 0x058d, "OneXPlayer Gamepad", 0, XTYPE_XBOX360 }, - { 0x294b, 0x3303, "Snakebyte GAMEPAD BASE X", 0, XTYPE_XBOXONE }, - { 0x294b, 0x3404, "Snakebyte GAMEPAD RGB X", 0, XTYPE_XBOXONE }, -+ { 0x2993, 0x2001, "TECNO Pocket Go", 0, XTYPE_XBOX360 }, - { 0x2dc8, 0x2000, "8BitDo Pro 2 Wired Controller fox Xbox", 0, XTYPE_XBOXONE }, - { 0x2dc8, 0x3106, "8BitDo Ultimate Wireless / Pro 2 Wired Controller", 0, XTYPE_XBOX360 }, -+ { 0x2dc8, 0x3109, "8BitDo Ultimate Wireless Bluetooth", 0, XTYPE_XBOX360 }, - { 0x2dc8, 0x310a, "8BitDo Ultimate 2C Wireless Controller", 0, XTYPE_XBOX360 }, -+ { 0x2dc8, 0x6001, "8BitDo SN30 Pro", 0, XTYPE_XBOX360 }, - { 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE }, -+ { 0x2e24, 0x1688, "Hyperkin X91 X-Box One pad", 0, XTYPE_XBOXONE }, -+ { 0x2e95, 0x0504, "SCUF Gaming Controller", MAP_SELECT_BUTTON, XTYPE_XBOXONE }, - { 0x31e3, 0x1100, "Wooting One", 0, XTYPE_XBOX360 }, - { 0x31e3, 0x1200, "Wooting Two", 0, XTYPE_XBOX360 }, - { 0x31e3, 0x1210, "Wooting Lekker", 0, XTYPE_XBOX360 }, -@@ -384,11 +397,16 @@ static const struct xpad_device { - { 0x31e3, 0x1230, "Wooting Two HE (ARM)", 0, XTYPE_XBOX360 }, - { 0x31e3, 0x1300, "Wooting 60HE (AVR)", 0, XTYPE_XBOX360 }, - { 0x31e3, 0x1310, "Wooting 60HE (ARM)", 0, XTYPE_XBOX360 }, -+ { 0x3285, 0x0603, "Nacon Pro Compact controller for Xbox", 0, XTYPE_XBOXONE }, - { 0x3285, 0x0607, "Nacon GC-100", 0, XTYPE_XBOX360 }, -+ { 0x3285, 0x0614, "Nacon Pro Compact", 0, XTYPE_XBOXONE }, - { 0x3285, 0x0646, "Nacon Pro Compact", 0, XTYPE_XBOXONE }, -+ { 0x3285, 0x0662, "Nacon Revolution5 Pro", 0, XTYPE_XBOX360 }, - { 0x3285, 0x0663, "Nacon Evol-X", 0, XTYPE_XBOXONE }, - { 0x3537, 0x1004, "GameSir T4 Kaleid", 0, XTYPE_XBOX360 }, -+ { 0x3537, 0x1010, "GameSir G7 SE", 0, XTYPE_XBOXONE }, - { 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX }, -+ { 0x413d, 0x2104, "Black Shark Green Ghost Gamepad", 0, XTYPE_XBOX360 }, - { 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX }, - { 0x0000, 0x0000, "Generic X-Box pad", 0, XTYPE_UNKNOWN } - }; -@@ -487,6 +505,7 @@ static const struct usb_device_id xpad_table[] = { - XPAD_XBOX360_VENDOR(0x03f0), /* HP HyperX Xbox 360 controllers */ - XPAD_XBOXONE_VENDOR(0x03f0), /* HP HyperX Xbox One controllers */ - XPAD_XBOX360_VENDOR(0x044f), /* Thrustmaster Xbox 360 controllers */ -+ XPAD_XBOXONE_VENDOR(0x044f), /* Thrustmaster Xbox One controllers */ - XPAD_XBOX360_VENDOR(0x045e), /* Microsoft Xbox 360 controllers */ - XPAD_XBOXONE_VENDOR(0x045e), /* Microsoft Xbox One controllers */ - XPAD_XBOX360_VENDOR(0x046d), /* Logitech Xbox 360-style controllers */ -@@ -518,25 +537,29 @@ static const struct usb_device_id xpad_table[] = { - XPAD_XBOX360_VENDOR(0x1689), /* Razer Onza */ - XPAD_XBOX360_VENDOR(0x17ef), /* Lenovo */ - XPAD_XBOX360_VENDOR(0x1949), /* Amazon controllers */ -- XPAD_XBOX360_VENDOR(0x1a86), /* QH Electronics */ -+ XPAD_XBOX360_VENDOR(0x1a86), /* Nanjing Qinheng Microelectronics (WCH) */ - XPAD_XBOX360_VENDOR(0x1bad), /* Harmonix Rock Band guitar and drums */ -+ XPAD_XBOX360_VENDOR(0x1ee9), /* ZOTAC Technology Limited */ - XPAD_XBOX360_VENDOR(0x20d6), /* PowerA controllers */ - XPAD_XBOXONE_VENDOR(0x20d6), /* PowerA controllers */ - XPAD_XBOX360_VENDOR(0x24c6), /* PowerA controllers */ - XPAD_XBOXONE_VENDOR(0x24c6), /* PowerA controllers */ - XPAD_XBOX360_VENDOR(0x2563), /* OneXPlayer Gamepad */ - XPAD_XBOX360_VENDOR(0x260d), /* Dareu H101 */ -- XPAD_XBOXONE_VENDOR(0x294b), /* Snakebyte */ -+ XPAD_XBOXONE_VENDOR(0x294b), /* Snakebyte */ -+ XPAD_XBOX360_VENDOR(0x2993), /* TECNO Mobile */ - XPAD_XBOX360_VENDOR(0x2c22), /* Qanba Controllers */ -- XPAD_XBOX360_VENDOR(0x2dc8), /* 8BitDo Pro 2 Wired Controller */ -- XPAD_XBOXONE_VENDOR(0x2dc8), /* 8BitDo Pro 2 Wired Controller for Xbox */ -- XPAD_XBOXONE_VENDOR(0x2e24), /* Hyperkin Duke Xbox One pad */ -- XPAD_XBOX360_VENDOR(0x2f24), /* GameSir controllers */ -+ XPAD_XBOX360_VENDOR(0x2dc8), /* 8BitDo Controllers */ -+ XPAD_XBOXONE_VENDOR(0x2dc8), /* 8BitDo Controllers */ -+ XPAD_XBOXONE_VENDOR(0x2e24), /* Hyperkin Controllers */ -+ XPAD_XBOX360_VENDOR(0x2f24), /* GameSir Controllers */ -+ XPAD_XBOXONE_VENDOR(0x2e95), /* SCUF Gaming Controller */ - XPAD_XBOX360_VENDOR(0x31e3), /* Wooting Keyboards */ - XPAD_XBOX360_VENDOR(0x3285), /* Nacon GC-100 */ - XPAD_XBOXONE_VENDOR(0x3285), /* Nacon Evol-X */ - XPAD_XBOX360_VENDOR(0x3537), /* GameSir Controllers */ - XPAD_XBOXONE_VENDOR(0x3537), /* GameSir Controllers */ -+ XPAD_XBOX360_VENDOR(0x413d), /* Black Shark Green Ghost Controller */ - { } - }; - -@@ -689,7 +712,9 @@ static const struct xboxone_init_packet xboxone_init_packets[] = { - XBOXONE_INIT_PKT(0x045e, 0x0b00, xboxone_s_init), - XBOXONE_INIT_PKT(0x045e, 0x0b00, extra_input_packet_init), - XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_led_on), -+ XBOXONE_INIT_PKT(0x20d6, 0xa01a, xboxone_pdp_led_on), - XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_auth), -+ XBOXONE_INIT_PKT(0x20d6, 0xa01a, xboxone_pdp_auth), - XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init), - XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_rumblebegin_init), - XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumblebegin_init), -diff --git a/drivers/input/misc/iqs7222.c b/drivers/input/misc/iqs7222.c -index 9ca5a743f19feb..b98529568eeb83 100644 ---- a/drivers/input/misc/iqs7222.c -+++ b/drivers/input/misc/iqs7222.c -@@ -100,11 +100,11 @@ enum iqs7222_reg_key_id { - - enum iqs7222_reg_grp_id { - IQS7222_REG_GRP_STAT, -- IQS7222_REG_GRP_FILT, - IQS7222_REG_GRP_CYCLE, - IQS7222_REG_GRP_GLBL, - IQS7222_REG_GRP_BTN, - IQS7222_REG_GRP_CHAN, -+ IQS7222_REG_GRP_FILT, - IQS7222_REG_GRP_SLDR, - IQS7222_REG_GRP_TPAD, - IQS7222_REG_GRP_GPIO, -@@ -286,6 +286,7 @@ static const struct iqs7222_event_desc iqs7222_tp_events[] = { - - struct iqs7222_reg_grp_desc { - u16 base; -+ u16 val_len; - int num_row; - int num_col; - }; -@@ -342,6 +343,7 @@ static const struct iqs7222_dev_desc iqs7222_devs[] = { - }, - [IQS7222_REG_GRP_FILT] = { - .base = 0xAC00, -+ .val_len = 3, - .num_row = 1, - .num_col = 2, - }, -@@ -400,6 +402,7 @@ static const struct iqs7222_dev_desc iqs7222_devs[] = { - }, - [IQS7222_REG_GRP_FILT] = { - .base = 0xAC00, -+ .val_len = 3, - .num_row = 1, - .num_col = 2, - }, -@@ -454,6 +457,7 @@ static const struct iqs7222_dev_desc iqs7222_devs[] = { - }, - [IQS7222_REG_GRP_FILT] = { - .base = 0xC400, -+ .val_len = 3, - .num_row = 1, - .num_col = 2, - }, -@@ -496,6 +500,7 @@ static const struct iqs7222_dev_desc iqs7222_devs[] = { - }, - [IQS7222_REG_GRP_FILT] = { - .base = 0xC400, -+ .val_len = 3, - .num_row = 1, - .num_col = 2, - }, -@@ -543,6 +548,7 @@ static const struct iqs7222_dev_desc iqs7222_devs[] = { - }, - [IQS7222_REG_GRP_FILT] = { - .base = 0xAA00, -+ .val_len = 3, - .num_row = 1, - .num_col = 2, - }, -@@ -600,6 +606,7 @@ static const struct iqs7222_dev_desc iqs7222_devs[] = { - }, - [IQS7222_REG_GRP_FILT] = { - .base = 0xAA00, -+ .val_len = 3, - .num_row = 1, - .num_col = 2, - }, -@@ -656,6 +663,7 @@ static const struct iqs7222_dev_desc iqs7222_devs[] = { - }, - [IQS7222_REG_GRP_FILT] = { - .base = 0xAE00, -+ .val_len = 3, - .num_row = 1, - .num_col = 2, - }, -@@ -712,6 +720,7 @@ static const struct iqs7222_dev_desc iqs7222_devs[] = { - }, - [IQS7222_REG_GRP_FILT] = { - .base = 0xAE00, -+ .val_len = 3, - .num_row = 1, - .num_col = 2, - }, -@@ -768,6 +777,7 @@ static const struct iqs7222_dev_desc iqs7222_devs[] = { - }, - [IQS7222_REG_GRP_FILT] = { - .base = 0xAE00, -+ .val_len = 3, - .num_row = 1, - .num_col = 2, - }, -@@ -1604,7 +1614,7 @@ static int iqs7222_force_comms(struct iqs7222_private *iqs7222) - } - - static int iqs7222_read_burst(struct iqs7222_private *iqs7222, -- u16 reg, void *val, u16 num_val) -+ u16 reg, void *val, u16 val_len) - { - u8 reg_buf[sizeof(__be16)]; - int ret, i; -@@ -1619,7 +1629,7 @@ static int iqs7222_read_burst(struct iqs7222_private *iqs7222, - { - .addr = client->addr, - .flags = I2C_M_RD, -- .len = num_val * sizeof(__le16), -+ .len = val_len, - .buf = (u8 *)val, - }, - }; -@@ -1675,7 +1685,7 @@ static int iqs7222_read_word(struct iqs7222_private *iqs7222, u16 reg, u16 *val) - __le16 val_buf; - int error; - -- error = iqs7222_read_burst(iqs7222, reg, &val_buf, 1); -+ error = iqs7222_read_burst(iqs7222, reg, &val_buf, sizeof(val_buf)); - if (error) - return error; - -@@ -1685,10 +1695,9 @@ static int iqs7222_read_word(struct iqs7222_private *iqs7222, u16 reg, u16 *val) - } - - static int iqs7222_write_burst(struct iqs7222_private *iqs7222, -- u16 reg, const void *val, u16 num_val) -+ u16 reg, const void *val, u16 val_len) - { - int reg_len = reg > U8_MAX ? sizeof(reg) : sizeof(u8); -- int val_len = num_val * sizeof(__le16); - int msg_len = reg_len + val_len; - int ret, i; - struct i2c_client *client = iqs7222->client; -@@ -1747,7 +1756,7 @@ static int iqs7222_write_word(struct iqs7222_private *iqs7222, u16 reg, u16 val) - { - __le16 val_buf = cpu_to_le16(val); - -- return iqs7222_write_burst(iqs7222, reg, &val_buf, 1); -+ return iqs7222_write_burst(iqs7222, reg, &val_buf, sizeof(val_buf)); - } - - static int iqs7222_ati_trigger(struct iqs7222_private *iqs7222) -@@ -1831,30 +1840,14 @@ static int iqs7222_dev_init(struct iqs7222_private *iqs7222, int dir) - - /* - * Acknowledge reset before writing any registers in case the device -- * suffers a spurious reset during initialization. Because this step -- * may change the reserved fields of the second filter beta register, -- * its cache must be updated. -- * -- * Writing the second filter beta register, in turn, may clobber the -- * system status register. As such, the filter beta register pair is -- * written first to protect against this hazard. -+ * suffers a spurious reset during initialization. - */ - if (dir == WRITE) { -- u16 reg = dev_desc->reg_grps[IQS7222_REG_GRP_FILT].base + 1; -- u16 filt_setup; -- - error = iqs7222_write_word(iqs7222, IQS7222_SYS_SETUP, - iqs7222->sys_setup[0] | - IQS7222_SYS_SETUP_ACK_RESET); - if (error) - return error; -- -- error = iqs7222_read_word(iqs7222, reg, &filt_setup); -- if (error) -- return error; -- -- iqs7222->filt_setup[1] &= GENMASK(7, 0); -- iqs7222->filt_setup[1] |= (filt_setup & ~GENMASK(7, 0)); - } - - /* -@@ -1883,6 +1876,7 @@ static int iqs7222_dev_init(struct iqs7222_private *iqs7222, int dir) - int num_col = dev_desc->reg_grps[i].num_col; - u16 reg = dev_desc->reg_grps[i].base; - __le16 *val_buf; -+ u16 val_len = dev_desc->reg_grps[i].val_len ? : num_col * sizeof(*val_buf); - u16 *val; - - if (!num_col) -@@ -1900,7 +1894,7 @@ static int iqs7222_dev_init(struct iqs7222_private *iqs7222, int dir) - switch (dir) { - case READ: - error = iqs7222_read_burst(iqs7222, reg, -- val_buf, num_col); -+ val_buf, val_len); - for (k = 0; k < num_col; k++) - val[k] = le16_to_cpu(val_buf[k]); - break; -@@ -1909,7 +1903,7 @@ static int iqs7222_dev_init(struct iqs7222_private *iqs7222, int dir) - for (k = 0; k < num_col; k++) - val_buf[k] = cpu_to_le16(val[k]); - error = iqs7222_write_burst(iqs7222, reg, -- val_buf, num_col); -+ val_buf, val_len); - break; - - default: -@@ -1962,7 +1956,7 @@ static int iqs7222_dev_info(struct iqs7222_private *iqs7222) - int error, i; - - error = iqs7222_read_burst(iqs7222, IQS7222_PROD_NUM, dev_id, -- ARRAY_SIZE(dev_id)); -+ sizeof(dev_id)); - if (error) - return error; - -@@ -2917,7 +2911,7 @@ static int iqs7222_report(struct iqs7222_private *iqs7222) - __le16 status[IQS7222_MAX_COLS_STAT]; - - error = iqs7222_read_burst(iqs7222, IQS7222_SYS_STATUS, status, -- num_stat); -+ num_stat * sizeof(*status)); - if (error) - return error; - -diff --git a/drivers/input/serio/i8042-acpipnpio.h b/drivers/input/serio/i8042-acpipnpio.h -index 34d1f07ea4c304..8813db7eec3978 100644 ---- a/drivers/input/serio/i8042-acpipnpio.h -+++ b/drivers/input/serio/i8042-acpipnpio.h -@@ -1080,16 +1080,14 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { - DMI_MATCH(DMI_BOARD_VENDOR, "TUXEDO"), - DMI_MATCH(DMI_BOARD_NAME, "AURA1501"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) - }, - { - .matches = { - DMI_MATCH(DMI_BOARD_VENDOR, "TUXEDO"), - DMI_MATCH(DMI_BOARD_NAME, "EDUBOOK1502"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) - }, - { - /* Mivvy M310 */ -@@ -1159,9 +1157,7 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { - }, - /* - * A lot of modern Clevo barebones have touchpad and/or keyboard issues -- * after suspend fixable with nomux + reset + noloop + nopnp. Luckily, -- * none of them have an external PS/2 port so this can safely be set for -- * all of them. -+ * after suspend fixable with the forcenorestore quirk. - * Clevo barebones come with board_vendor and/or system_vendor set to - * either the very generic string "Notebook" and/or a different value - * for each individual reseller. The only somewhat universal way to -@@ -1171,29 +1167,25 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { - .matches = { - DMI_MATCH(DMI_BOARD_NAME, "LAPQC71A"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) - }, - { - .matches = { - DMI_MATCH(DMI_BOARD_NAME, "LAPQC71B"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) - }, - { - .matches = { - DMI_MATCH(DMI_BOARD_NAME, "N140CU"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) - }, - { - .matches = { - DMI_MATCH(DMI_BOARD_NAME, "N141CU"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) - }, - { - .matches = { -@@ -1205,29 +1197,19 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { - .matches = { - DMI_MATCH(DMI_BOARD_NAME, "NH5xAx"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) - }, - { -- /* -- * Setting SERIO_QUIRK_NOMUX or SERIO_QUIRK_RESET_ALWAYS makes -- * the keyboard very laggy for ~5 seconds after boot and -- * sometimes also after resume. -- * However both are required for the keyboard to not fail -- * completely sometimes after boot or resume. -- */ - .matches = { - DMI_MATCH(DMI_BOARD_NAME, "NHxxRZQ"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) - }, - { - .matches = { - DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) - }, - /* - * At least one modern Clevo barebone has the touchpad connected both -@@ -1243,17 +1225,15 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { - .matches = { - DMI_MATCH(DMI_BOARD_NAME, "NS50MU"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOAUX | SERIO_QUIRK_NOMUX | -- SERIO_QUIRK_RESET_ALWAYS | SERIO_QUIRK_NOLOOP | -- SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_NOAUX | -+ SERIO_QUIRK_FORCENORESTORE) - }, - { - .matches = { - DMI_MATCH(DMI_BOARD_NAME, "NS50_70MU"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOAUX | SERIO_QUIRK_NOMUX | -- SERIO_QUIRK_RESET_ALWAYS | SERIO_QUIRK_NOLOOP | -- SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_NOAUX | -+ SERIO_QUIRK_FORCENORESTORE) - }, - { - .matches = { -@@ -1265,8 +1245,13 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { - .matches = { - DMI_MATCH(DMI_BOARD_NAME, "NJ50_70CU"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) -+ }, -+ { -+ .matches = { -+ DMI_MATCH(DMI_BOARD_NAME, "P640RE"), -+ }, -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) - }, - { - /* -@@ -1277,16 +1262,14 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { - .matches = { - DMI_MATCH(DMI_PRODUCT_NAME, "P65xH"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) - }, - { - /* Clevo P650RS, 650RP6, Sager NP8152-S, and others */ - .matches = { - DMI_MATCH(DMI_PRODUCT_NAME, "P65xRP"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) - }, - { - /* -@@ -1297,8 +1280,7 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { - .matches = { - DMI_MATCH(DMI_PRODUCT_NAME, "P65_P67H"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) - }, - { - /* -@@ -1309,8 +1291,7 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { - .matches = { - DMI_MATCH(DMI_PRODUCT_NAME, "P65_67RP"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) - }, - { - /* -@@ -1321,8 +1302,7 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { - .matches = { - DMI_MATCH(DMI_PRODUCT_NAME, "P65_67RS"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) - }, - { - /* -@@ -1333,22 +1313,43 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { - .matches = { - DMI_MATCH(DMI_PRODUCT_NAME, "P67xRP"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) - }, - { - .matches = { - DMI_MATCH(DMI_BOARD_NAME, "PB50_70DFx,DDx"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) -+ }, -+ { -+ .matches = { -+ DMI_MATCH(DMI_BOARD_NAME, "PB51RF"), -+ }, -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) -+ }, -+ { -+ .matches = { -+ DMI_MATCH(DMI_BOARD_NAME, "PB71RD"), -+ }, -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) -+ }, -+ { -+ .matches = { -+ DMI_MATCH(DMI_BOARD_NAME, "PC70DR"), -+ }, -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) - }, - { - .matches = { - DMI_MATCH(DMI_BOARD_NAME, "PCX0DX"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) -+ }, -+ { -+ .matches = { -+ DMI_MATCH(DMI_BOARD_NAME, "PCX0DX_GN20"), -+ }, -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) - }, - /* See comment on TUXEDO InfinityBook S17 Gen6 / Clevo NS70MU above */ - { -@@ -1361,15 +1362,13 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { - .matches = { - DMI_MATCH(DMI_BOARD_NAME, "X170SM"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) - }, - { - .matches = { - DMI_MATCH(DMI_BOARD_NAME, "X170KM-G"), - }, -- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) - }, - { - /* -diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c -index 8b8c43b3c27f29..32a2691185dfe1 100644 ---- a/drivers/input/touchscreen/ads7846.c -+++ b/drivers/input/touchscreen/ads7846.c -@@ -995,7 +995,7 @@ static int ads7846_setup_pendown(struct spi_device *spi, - if (pdata->get_pendown_state) { - ts->get_pendown_state = pdata->get_pendown_state; - } else { -- ts->gpio_pendown = gpiod_get(&spi->dev, "pendown", GPIOD_IN); -+ ts->gpio_pendown = devm_gpiod_get(&spi->dev, "pendown", GPIOD_IN); - if (IS_ERR(ts->gpio_pendown)) { - dev_err(&spi->dev, "failed to request pendown GPIO\n"); - return PTR_ERR(ts->gpio_pendown); -diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c -index 120153e44ae0d3..dc491dc771d712 100644 ---- a/drivers/md/dm-flakey.c -+++ b/drivers/md/dm-flakey.c -@@ -426,7 +426,7 @@ static struct bio *clone_bio(struct dm_target *ti, struct flakey_c *fc, struct b - if (!clone) - return NULL; - -- bio_init(clone, fc->dev->bdev, bio->bi_inline_vecs, nr_iovecs, bio->bi_opf); -+ bio_init(clone, fc->dev->bdev, clone->bi_inline_vecs, nr_iovecs, bio->bi_opf); - - clone->bi_iter.bi_sector = flakey_map_sector(ti, bio->bi_iter.bi_sector); - clone->bi_private = bio; -diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c -index 8c326e41b8d633..6d003c0ef6698f 100644 ---- a/drivers/net/bonding/bond_options.c -+++ b/drivers/net/bonding/bond_options.c -@@ -1226,10 +1226,28 @@ static bool slave_can_set_ns_maddr(const struct bonding *bond, struct slave *sla - slave->dev->flags & IFF_MULTICAST; - } - -+/** -+ * slave_set_ns_maddrs - add/del all NS mac addresses for slave -+ * @bond: bond device -+ * @slave: slave device -+ * @add: add or remove all the NS mac addresses -+ * -+ * This function tries to add or delete all the NS mac addresses on the slave -+ * -+ * Note, the IPv6 NS target address is the unicast address in Neighbor -+ * Solicitation (NS) message. The dest address of NS message should be -+ * solicited-node multicast address of the target. The dest mac of NS message -+ * is converted from the solicited-node multicast address. -+ * -+ * This function is called when -+ * * arp_validate changes -+ * * enslaving, releasing new slaves -+ */ - static void slave_set_ns_maddrs(struct bonding *bond, struct slave *slave, bool add) - { - struct in6_addr *targets = bond->params.ns_targets; - char slot_maddr[MAX_ADDR_LEN]; -+ struct in6_addr mcaddr; - int i; - - if (!slave_can_set_ns_maddr(bond, slave)) -@@ -1239,7 +1257,8 @@ static void slave_set_ns_maddrs(struct bonding *bond, struct slave *slave, bool - if (ipv6_addr_any(&targets[i])) - break; - -- if (!ndisc_mc_map(&targets[i], slot_maddr, slave->dev, 0)) { -+ addrconf_addr_solict_mult(&targets[i], &mcaddr); -+ if (!ndisc_mc_map(&mcaddr, slot_maddr, slave->dev, 0)) { - if (add) - dev_mc_add(slave->dev, slot_maddr); - else -@@ -1262,23 +1281,43 @@ void bond_slave_ns_maddrs_del(struct bonding *bond, struct slave *slave) - slave_set_ns_maddrs(bond, slave, false); - } - -+/** -+ * slave_set_ns_maddr - set new NS mac address for slave -+ * @bond: bond device -+ * @slave: slave device -+ * @target: the new IPv6 target -+ * @slot: the old IPv6 target in the slot -+ * -+ * This function tries to replace the old mac address to new one on the slave. -+ * -+ * Note, the target/slot IPv6 address is the unicast address in Neighbor -+ * Solicitation (NS) message. The dest address of NS message should be -+ * solicited-node multicast address of the target. The dest mac of NS message -+ * is converted from the solicited-node multicast address. -+ * -+ * This function is called when -+ * * An IPv6 NS target is added or removed. -+ */ - static void slave_set_ns_maddr(struct bonding *bond, struct slave *slave, - struct in6_addr *target, struct in6_addr *slot) - { -- char target_maddr[MAX_ADDR_LEN], slot_maddr[MAX_ADDR_LEN]; -+ char mac_addr[MAX_ADDR_LEN]; -+ struct in6_addr mcast_addr; - - if (!bond->params.arp_validate || !slave_can_set_ns_maddr(bond, slave)) - return; - -- /* remove the previous maddr from slave */ -+ /* remove the previous mac addr from slave */ -+ addrconf_addr_solict_mult(slot, &mcast_addr); - if (!ipv6_addr_any(slot) && -- !ndisc_mc_map(slot, slot_maddr, slave->dev, 0)) -- dev_mc_del(slave->dev, slot_maddr); -+ !ndisc_mc_map(&mcast_addr, mac_addr, slave->dev, 0)) -+ dev_mc_del(slave->dev, mac_addr); - -- /* add new maddr on slave if target is set */ -+ /* add new mac addr on slave if target is set */ -+ addrconf_addr_solict_mult(target, &mcast_addr); - if (!ipv6_addr_any(target) && -- !ndisc_mc_map(target, target_maddr, slave->dev, 0)) -- dev_mc_add(slave->dev, target_maddr); -+ !ndisc_mc_map(&mcast_addr, mac_addr, slave->dev, 0)) -+ dev_mc_add(slave->dev, mac_addr); - } - - static void _bond_options_ns_ip6_target_set(struct bonding *bond, int slot, -diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c -index 062bcbe6255cff..a39b33353ca6c8 100644 ---- a/drivers/net/dsa/mv88e6xxx/chip.c -+++ b/drivers/net/dsa/mv88e6xxx/chip.c -@@ -2125,13 +2125,11 @@ mv88e6xxx_port_vlan_prepare(struct dsa_switch *ds, int port, - return err; - } - --static int mv88e6xxx_port_db_load_purge(struct mv88e6xxx_chip *chip, int port, -- const unsigned char *addr, u16 vid, -- u8 state) -+static int mv88e6xxx_port_db_get(struct mv88e6xxx_chip *chip, -+ const unsigned char *addr, u16 vid, -+ u16 *fid, struct mv88e6xxx_atu_entry *entry) - { -- struct mv88e6xxx_atu_entry entry; - struct mv88e6xxx_vtu_entry vlan; -- u16 fid; - int err; - - /* Ports have two private address databases: one for when the port is -@@ -2142,7 +2140,7 @@ static int mv88e6xxx_port_db_load_purge(struct mv88e6xxx_chip *chip, int port, - * VLAN ID into the port's database used for VLAN-unaware bridging. - */ - if (vid == 0) { -- fid = MV88E6XXX_FID_BRIDGED; -+ *fid = MV88E6XXX_FID_BRIDGED; - } else { - err = mv88e6xxx_vtu_get(chip, vid, &vlan); - if (err) -@@ -2152,14 +2150,39 @@ static int mv88e6xxx_port_db_load_purge(struct mv88e6xxx_chip *chip, int port, - if (!vlan.valid) - return -EOPNOTSUPP; - -- fid = vlan.fid; -+ *fid = vlan.fid; - } - -- entry.state = 0; -- ether_addr_copy(entry.mac, addr); -- eth_addr_dec(entry.mac); -+ entry->state = 0; -+ ether_addr_copy(entry->mac, addr); -+ eth_addr_dec(entry->mac); -+ -+ return mv88e6xxx_g1_atu_getnext(chip, *fid, entry); -+} -+ -+static bool mv88e6xxx_port_db_find(struct mv88e6xxx_chip *chip, -+ const unsigned char *addr, u16 vid) -+{ -+ struct mv88e6xxx_atu_entry entry; -+ u16 fid; -+ int err; - -- err = mv88e6xxx_g1_atu_getnext(chip, fid, &entry); -+ err = mv88e6xxx_port_db_get(chip, addr, vid, &fid, &entry); -+ if (err) -+ return false; -+ -+ return entry.state && ether_addr_equal(entry.mac, addr); -+} -+ -+static int mv88e6xxx_port_db_load_purge(struct mv88e6xxx_chip *chip, int port, -+ const unsigned char *addr, u16 vid, -+ u8 state) -+{ -+ struct mv88e6xxx_atu_entry entry; -+ u16 fid; -+ int err; -+ -+ err = mv88e6xxx_port_db_get(chip, addr, vid, &fid, &entry); - if (err) - return err; - -@@ -2757,6 +2780,13 @@ static int mv88e6xxx_port_fdb_add(struct dsa_switch *ds, int port, - mv88e6xxx_reg_lock(chip); - err = mv88e6xxx_port_db_load_purge(chip, port, addr, vid, - MV88E6XXX_G1_ATU_DATA_STATE_UC_STATIC); -+ if (err) -+ goto out; -+ -+ if (!mv88e6xxx_port_db_find(chip, addr, vid)) -+ err = -ENOSPC; -+ -+out: - mv88e6xxx_reg_unlock(chip); - - return err; -@@ -6454,6 +6484,13 @@ static int mv88e6xxx_port_mdb_add(struct dsa_switch *ds, int port, - mv88e6xxx_reg_lock(chip); - err = mv88e6xxx_port_db_load_purge(chip, port, mdb->addr, mdb->vid, - MV88E6XXX_G1_ATU_DATA_STATE_MC_STATIC); -+ if (err) -+ goto out; -+ -+ if (!mv88e6xxx_port_db_find(chip, mdb->addr, mdb->vid)) -+ err = -ENOSPC; -+ -+out: - mv88e6xxx_reg_unlock(chip); - - return err; -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index c440f4d8d43a27..915ef1062d7149 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -1958,7 +1958,8 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, - if (!skb) - goto oom_next_rx; - } else { -- skb = bnxt_xdp_build_skb(bp, skb, agg_bufs, rxr->page_pool, &xdp, rxcmp1); -+ skb = bnxt_xdp_build_skb(bp, skb, agg_bufs, -+ rxr->page_pool, &xdp); - if (!skb) { - /* we should be able to free the old skb here */ - bnxt_xdp_buff_frags_free(rxr, &xdp); -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c -index 2845796f782c24..758f51366ef032 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c -@@ -462,20 +462,13 @@ int bnxt_xdp(struct net_device *dev, struct netdev_bpf *xdp) - - struct sk_buff * - bnxt_xdp_build_skb(struct bnxt *bp, struct sk_buff *skb, u8 num_frags, -- struct page_pool *pool, struct xdp_buff *xdp, -- struct rx_cmp_ext *rxcmp1) -+ struct page_pool *pool, struct xdp_buff *xdp) - { - struct skb_shared_info *sinfo = xdp_get_shared_info_from_buff(xdp); - - if (!skb) - return NULL; -- skb_checksum_none_assert(skb); -- if (RX_CMP_L4_CS_OK(rxcmp1)) { -- if (bp->dev->features & NETIF_F_RXCSUM) { -- skb->ip_summed = CHECKSUM_UNNECESSARY; -- skb->csum_level = RX_CMP_ENCAP(rxcmp1); -- } -- } -+ - xdp_update_skb_shared_info(skb, num_frags, - sinfo->xdp_frags_size, - BNXT_RX_PAGE_SIZE * sinfo->nr_frags, -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.h -index 5e412c5655ba56..9f5829a0adeb1b 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.h -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.h -@@ -33,6 +33,5 @@ void bnxt_xdp_buff_frags_free(struct bnxt_rx_ring_info *rxr, - struct xdp_buff *xdp); - struct sk_buff *bnxt_xdp_build_skb(struct bnxt *bp, struct sk_buff *skb, - u8 num_frags, struct page_pool *pool, -- struct xdp_buff *xdp, -- struct rx_cmp_ext *rxcmp1); -+ struct xdp_buff *xdp); - #endif -diff --git a/drivers/net/ethernet/intel/ice/ice_arfs.c b/drivers/net/ethernet/intel/ice/ice_arfs.c -index cca0e753f38ff9..d7e0116f67737b 100644 ---- a/drivers/net/ethernet/intel/ice/ice_arfs.c -+++ b/drivers/net/ethernet/intel/ice/ice_arfs.c -@@ -510,7 +510,7 @@ void ice_init_arfs(struct ice_vsi *vsi) - struct hlist_head *arfs_fltr_list; - unsigned int i; - -- if (!vsi || vsi->type != ICE_VSI_PF) -+ if (!vsi || vsi->type != ICE_VSI_PF || ice_is_arfs_active(vsi)) - return; - - arfs_fltr_list = kcalloc(ICE_MAX_ARFS_LIST, sizeof(*arfs_fltr_list), -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -index 1bccb5633ab4be..f66788a2ed77ec 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -@@ -46,6 +46,9 @@ mlx5_devlink_info_get(struct devlink *devlink, struct devlink_info_req *req, - u32 running_fw, stored_fw; - int err; - -+ if (!mlx5_core_is_pf(dev)) -+ return 0; -+ - err = devlink_info_version_fixed_put(req, "fw.psid", dev->board_id); - if (err) - return err; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c -index 5d128c5b4529af..0f5d7ea8956f72 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c -@@ -48,15 +48,10 @@ mlx5_esw_bridge_lag_rep_get(struct net_device *dev, struct mlx5_eswitch *esw) - struct list_head *iter; - - netdev_for_each_lower_dev(dev, lower, iter) { -- struct mlx5_core_dev *mdev; -- struct mlx5e_priv *priv; -- - if (!mlx5e_eswitch_rep(lower)) - continue; - -- priv = netdev_priv(lower); -- mdev = priv->mdev; -- if (mlx5_lag_is_shared_fdb(mdev) && mlx5_esw_bridge_dev_same_esw(lower, esw)) -+ if (mlx5_esw_bridge_dev_same_esw(lower, esw)) - return lower; - } - -@@ -125,7 +120,7 @@ static bool mlx5_esw_bridge_is_local(struct net_device *dev, struct net_device * - priv = netdev_priv(rep); - mdev = priv->mdev; - if (netif_is_lag_master(dev)) -- return mlx5_lag_is_shared_fdb(mdev) && mlx5_lag_is_master(mdev); -+ return mlx5_lag_is_master(mdev); - return true; - } - -@@ -455,6 +450,9 @@ static int mlx5_esw_bridge_switchdev_event(struct notifier_block *nb, - if (!rep) - return NOTIFY_DONE; - -+ if (netif_is_lag_master(dev) && !mlx5_lag_is_shared_fdb(esw->dev)) -+ return NOTIFY_DONE; -+ - switch (event) { - case SWITCHDEV_FDB_ADD_TO_BRIDGE: - fdb_info = container_of(info, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index b34f57ab9755ce..8a892614015cd9 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -4891,11 +4891,9 @@ static int mlx5e_bridge_getlink(struct sk_buff *skb, u32 pid, u32 seq, - struct mlx5e_priv *priv = netdev_priv(dev); - struct mlx5_core_dev *mdev = priv->mdev; - u8 mode, setting; -- int err; - -- err = mlx5_eswitch_get_vepa(mdev->priv.eswitch, &setting); -- if (err) -- return err; -+ if (mlx5_eswitch_get_vepa(mdev->priv.eswitch, &setting)) -+ return -EOPNOTSUPP; - mode = setting ? BRIDGE_MODE_VEPA : BRIDGE_MODE_VEB; - return ndo_dflt_bridge_getlink(skb, pid, seq, dev, - mode, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c -index 18cf756bad8cc3..f6b1ac80c0af96 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c -@@ -823,7 +823,7 @@ void mlx5_disable_lag(struct mlx5_lag *ldev) - mlx5_eswitch_reload_ib_reps(ldev->pf[i].dev->priv.eswitch); - } - --static bool mlx5_shared_fdb_supported(struct mlx5_lag *ldev) -+bool mlx5_lag_shared_fdb_supported(struct mlx5_lag *ldev) - { - struct mlx5_core_dev *dev; - int i; -@@ -900,7 +900,7 @@ static void mlx5_do_bond(struct mlx5_lag *ldev) - } - - if (do_bond && !__mlx5_lag_is_active(ldev)) { -- bool shared_fdb = mlx5_shared_fdb_supported(ldev); -+ bool shared_fdb = mlx5_lag_shared_fdb_supported(ldev); - - roce_lag = mlx5_lag_is_roce_lag(ldev); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.h b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.h -index 481e92f39fe614..b7ccf0e955f562 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.h -@@ -92,6 +92,7 @@ mlx5_lag_is_ready(struct mlx5_lag *ldev) - return test_bit(MLX5_LAG_FLAG_NDEVS_READY, &ldev->state_flags); - } - -+bool mlx5_lag_shared_fdb_supported(struct mlx5_lag *ldev); - bool mlx5_lag_check_prereq(struct mlx5_lag *ldev); - void mlx5_modify_lag(struct mlx5_lag *ldev, - struct lag_tracker *tracker); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c -index 6b0413a3987ce0..8a07fdf295056b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c -@@ -81,7 +81,8 @@ static int enable_mpesw(struct mlx5_lag *ldev) - if (mlx5_eswitch_mode(dev0) != MLX5_ESWITCH_OFFLOADS || - !MLX5_CAP_PORT_SELECTION(dev0, port_select_flow_table) || - !MLX5_CAP_GEN(dev0, create_lag_when_not_master_up) || -- !mlx5_lag_check_prereq(ldev)) -+ !mlx5_lag_check_prereq(ldev) || -+ !mlx5_lag_shared_fdb_supported(ldev)) - return -EOPNOTSUPP; - - err = mlx5_mpesw_metadata_set(ldev); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c -index a80ecb672f33dd..711d14dea2485f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c -@@ -196,6 +196,11 @@ mlx5_chains_create_table(struct mlx5_fs_chains *chains, - ns = mlx5_get_flow_namespace(chains->dev, chains->ns); - } - -+ if (!ns) { -+ mlx5_core_warn(chains->dev, "Failed to get flow namespace\n"); -+ return ERR_PTR(-EOPNOTSUPP); -+ } -+ - ft_attr.autogroup.num_reserved_entries = 2; - ft_attr.autogroup.max_num_groups = chains->group_num; - ft = mlx5_create_auto_grouped_flow_table(ns, &ft_attr); -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c -index f9dd50152b1e3e..28d24d59efb84f 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c -@@ -454,8 +454,10 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter, - - num_vlans = sriov->num_allowed_vlans; - sriov->allowed_vlans = kcalloc(num_vlans, sizeof(u16), GFP_KERNEL); -- if (!sriov->allowed_vlans) -+ if (!sriov->allowed_vlans) { -+ qlcnic_sriov_free_vlans(adapter); - return -ENOMEM; -+ } - - vlans = (u16 *)&cmd->rsp.arg[3]; - for (i = 0; i < num_vlans; i++) -@@ -2167,8 +2169,10 @@ int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter) - vf = &sriov->vf_info[i]; - vf->sriov_vlans = kcalloc(sriov->num_allowed_vlans, - sizeof(*vf->sriov_vlans), GFP_KERNEL); -- if (!vf->sriov_vlans) -+ if (!vf->sriov_vlans) { -+ qlcnic_sriov_free_vlans(adapter); - return -ENOMEM; -+ } - } - - return 0; -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c -index ee3604f58def52..bdeec098309abf 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c -@@ -9,7 +9,10 @@ - #include - #include "stmmac.h" - -+#define DRIVER_NAME "dwmac-loongson-pci" -+ - static int loongson_default_data(struct plat_stmmacenet_data *plat) -+ - { - plat->clk_csr = 2; /* clk_csr_i = 20-35MHz & MDC = clk_csr_i/16 */ - plat->has_gmac = 1; -@@ -95,7 +98,7 @@ static int loongson_dwmac_probe(struct pci_dev *pdev, const struct pci_device_id - for (i = 0; i < PCI_STD_NUM_BARS; i++) { - if (pci_resource_len(pdev, i) == 0) - continue; -- ret = pcim_iomap_regions(pdev, BIT(0), pci_name(pdev)); -+ ret = pcim_iomap_regions(pdev, BIT(0), DRIVER_NAME); - if (ret) - goto err_disable_device; - break; -@@ -222,7 +225,7 @@ static const struct pci_device_id loongson_dwmac_id_table[] = { - MODULE_DEVICE_TABLE(pci, loongson_dwmac_id_table); - - static struct pci_driver loongson_dwmac_driver = { -- .name = "dwmac-loongson-pci", -+ .name = DRIVER_NAME, - .id_table = loongson_dwmac_id_table, - .probe = loongson_dwmac_probe, - .remove = loongson_dwmac_remove, -diff --git a/drivers/net/mctp/mctp-i2c.c b/drivers/net/mctp/mctp-i2c.c -index 20b8d7d528bafc..fbe8483a07b589 100644 ---- a/drivers/net/mctp/mctp-i2c.c -+++ b/drivers/net/mctp/mctp-i2c.c -@@ -543,6 +543,7 @@ static int mctp_i2c_header_create(struct sk_buff *skb, struct net_device *dev, - struct mctp_i2c_hdr *hdr; - struct mctp_hdr *mhdr; - u8 lldst, llsrc; -+ int rc; - - if (len > MCTP_I2C_MAXMTU) - return -EMSGSIZE; -@@ -553,6 +554,10 @@ static int mctp_i2c_header_create(struct sk_buff *skb, struct net_device *dev, - lldst = *((u8 *)daddr); - llsrc = *((u8 *)saddr); - -+ rc = skb_cow_head(skb, sizeof(struct mctp_i2c_hdr)); -+ if (rc) -+ return rc; -+ - skb_push(skb, sizeof(struct mctp_i2c_hdr)); - skb_reset_mac_header(skb); - hdr = (void *)skb_mac_header(skb); -diff --git a/drivers/net/wwan/mhi_wwan_mbim.c b/drivers/net/wwan/mhi_wwan_mbim.c -index 3f72ae943b2945..b1b2870a054ba2 100644 ---- a/drivers/net/wwan/mhi_wwan_mbim.c -+++ b/drivers/net/wwan/mhi_wwan_mbim.c -@@ -209,7 +209,7 @@ static int mbim_rx_verify_nth16(struct mhi_mbim_context *mbim, struct sk_buff *s - if (mbim->rx_seq + 1 != le16_to_cpu(nth16->wSequence) && - (mbim->rx_seq || le16_to_cpu(nth16->wSequence)) && - !(mbim->rx_seq == 0xffff && !le16_to_cpu(nth16->wSequence))) { -- net_err_ratelimited("sequence number glitch prev=%d curr=%d\n", -+ net_dbg_ratelimited("sequence number glitch prev=%d curr=%d\n", - mbim->rx_seq, le16_to_cpu(nth16->wSequence)); - } - mbim->rx_seq = le16_to_cpu(nth16->wSequence); -diff --git a/drivers/nvme/host/apple.c b/drivers/nvme/host/apple.c -index 396eb943765979..9b1019ee74789b 100644 ---- a/drivers/nvme/host/apple.c -+++ b/drivers/nvme/host/apple.c -@@ -1517,6 +1517,7 @@ static struct apple_nvme *apple_nvme_alloc(struct platform_device *pdev) - - return anv; - put_dev: -+ apple_nvme_detach_genpd(anv); - put_device(anv->dev); - return ERR_PTR(ret); - } -@@ -1545,6 +1546,7 @@ static int apple_nvme_probe(struct platform_device *pdev) - out_uninit_ctrl: - nvme_uninit_ctrl(&anv->ctrl); - nvme_put_ctrl(&anv->ctrl); -+ apple_nvme_detach_genpd(anv); - return ret; - } - -diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c -index 8a200931bc297a..f00665ad0c11a3 100644 ---- a/drivers/nvme/host/core.c -+++ b/drivers/nvme/host/core.c -@@ -503,8 +503,6 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl, - switch (new_state) { - case NVME_CTRL_LIVE: - switch (old_state) { -- case NVME_CTRL_NEW: -- case NVME_CTRL_RESETTING: - case NVME_CTRL_CONNECTING: - changed = true; - fallthrough; -diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c -index 91324791a5b66e..3e0da2422b3343 100644 ---- a/drivers/nvme/host/fc.c -+++ b/drivers/nvme/host/fc.c -@@ -786,49 +786,8 @@ nvme_fc_ctrl_connectivity_loss(struct nvme_fc_ctrl *ctrl) - "NVME-FC{%d}: controller connectivity lost. Awaiting " - "Reconnect", ctrl->cnum); - -- switch (nvme_ctrl_state(&ctrl->ctrl)) { -- case NVME_CTRL_NEW: -- case NVME_CTRL_LIVE: -- /* -- * Schedule a controller reset. The reset will terminate the -- * association and schedule the reconnect timer. Reconnects -- * will be attempted until either the ctlr_loss_tmo -- * (max_retries * connect_delay) expires or the remoteport's -- * dev_loss_tmo expires. -- */ -- if (nvme_reset_ctrl(&ctrl->ctrl)) { -- dev_warn(ctrl->ctrl.device, -- "NVME-FC{%d}: Couldn't schedule reset.\n", -- ctrl->cnum); -- nvme_delete_ctrl(&ctrl->ctrl); -- } -- break; -- -- case NVME_CTRL_CONNECTING: -- /* -- * The association has already been terminated and the -- * controller is attempting reconnects. No need to do anything -- * futher. Reconnects will be attempted until either the -- * ctlr_loss_tmo (max_retries * connect_delay) expires or the -- * remoteport's dev_loss_tmo expires. -- */ -- break; -- -- case NVME_CTRL_RESETTING: -- /* -- * Controller is already in the process of terminating the -- * association. No need to do anything further. The reconnect -- * step will kick in naturally after the association is -- * terminated. -- */ -- break; -- -- case NVME_CTRL_DELETING: -- case NVME_CTRL_DELETING_NOIO: -- default: -- /* no action to take - let it delete */ -- break; -- } -+ set_bit(ASSOC_FAILED, &ctrl->flags); -+ nvme_reset_ctrl(&ctrl->ctrl); - } - - /** -@@ -2546,7 +2505,6 @@ nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg) - */ - if (state == NVME_CTRL_CONNECTING) { - __nvme_fc_abort_outstanding_ios(ctrl, true); -- set_bit(ASSOC_FAILED, &ctrl->flags); - dev_warn(ctrl->ctrl.device, - "NVME-FC{%d}: transport error during (re)connect\n", - ctrl->cnum); -@@ -3063,7 +3021,6 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl) - struct nvmefc_ls_rcv_op *disls = NULL; - unsigned long flags; - int ret; -- bool changed; - - ++ctrl->ctrl.nr_reconnects; - -@@ -3173,12 +3130,13 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl) - if (ret) - goto out_term_aen_ops; - -- changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE); -+ if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE)) { -+ ret = -EIO; -+ goto out_term_aen_ops; -+ } - - ctrl->ctrl.nr_reconnects = 0; -- -- if (changed) -- nvme_start_ctrl(&ctrl->ctrl); -+ nvme_start_ctrl(&ctrl->ctrl); - - return 0; /* Success */ - -@@ -3553,8 +3511,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts, - list_add_tail(&ctrl->ctrl_list, &rport->ctrl_list); - spin_unlock_irqrestore(&rport->lock, flags); - -- if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RESETTING) || -- !nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) { -+ if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) { - dev_err(ctrl->ctrl.device, - "NVME-FC{%d}: failed to init ctrl state\n", ctrl->cnum); - goto fail_ctrl; -diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c -index b1310e69d07daf..a36ec6df6624b8 100644 ---- a/drivers/nvme/host/pci.c -+++ b/drivers/nvme/host/pci.c -@@ -3509,6 +3509,8 @@ static const struct pci_device_id nvme_id_table[] = { - .driver_data = NVME_QUIRK_BOGUS_NID, }, - { PCI_DEVICE(0x1cc1, 0x5350), /* ADATA XPG GAMMIX S50 */ - .driver_data = NVME_QUIRK_BOGUS_NID, }, -+ { PCI_DEVICE(0x1dbe, 0x5216), /* Acer/INNOGRIT FA100/5216 NVMe SSD */ -+ .driver_data = NVME_QUIRK_BOGUS_NID, }, - { PCI_DEVICE(0x1dbe, 0x5236), /* ADATA XPG GAMMIX S70 */ - .driver_data = NVME_QUIRK_BOGUS_NID, }, - { PCI_DEVICE(0x1e49, 0x0021), /* ZHITAI TiPro5000 NVMe SSD */ -diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c -index be04c5f3856d24..2a8bd812b1a6f3 100644 ---- a/drivers/nvme/host/tcp.c -+++ b/drivers/nvme/host/tcp.c -@@ -707,6 +707,40 @@ static int nvme_tcp_handle_r2t(struct nvme_tcp_queue *queue, - return 0; - } - -+static void nvme_tcp_handle_c2h_term(struct nvme_tcp_queue *queue, -+ struct nvme_tcp_term_pdu *pdu) -+{ -+ u16 fes; -+ const char *msg; -+ u32 plen = le32_to_cpu(pdu->hdr.plen); -+ -+ static const char * const msg_table[] = { -+ [NVME_TCP_FES_INVALID_PDU_HDR] = "Invalid PDU Header Field", -+ [NVME_TCP_FES_PDU_SEQ_ERR] = "PDU Sequence Error", -+ [NVME_TCP_FES_HDR_DIGEST_ERR] = "Header Digest Error", -+ [NVME_TCP_FES_DATA_OUT_OF_RANGE] = "Data Transfer Out Of Range", -+ [NVME_TCP_FES_DATA_LIMIT_EXCEEDED] = "Data Transfer Limit Exceeded", -+ [NVME_TCP_FES_UNSUPPORTED_PARAM] = "Unsupported Parameter", -+ }; -+ -+ if (plen < NVME_TCP_MIN_C2HTERM_PLEN || -+ plen > NVME_TCP_MAX_C2HTERM_PLEN) { -+ dev_err(queue->ctrl->ctrl.device, -+ "Received a malformed C2HTermReq PDU (plen = %u)\n", -+ plen); -+ return; -+ } -+ -+ fes = le16_to_cpu(pdu->fes); -+ if (fes && fes < ARRAY_SIZE(msg_table)) -+ msg = msg_table[fes]; -+ else -+ msg = "Unknown"; -+ -+ dev_err(queue->ctrl->ctrl.device, -+ "Received C2HTermReq (FES = %s)\n", msg); -+} -+ - static int nvme_tcp_recv_pdu(struct nvme_tcp_queue *queue, struct sk_buff *skb, - unsigned int *offset, size_t *len) - { -@@ -728,6 +762,15 @@ static int nvme_tcp_recv_pdu(struct nvme_tcp_queue *queue, struct sk_buff *skb, - return 0; - - hdr = queue->pdu; -+ if (unlikely(hdr->type == nvme_tcp_c2h_term)) { -+ /* -+ * C2HTermReq never includes Header or Data digests. -+ * Skip the checks. -+ */ -+ nvme_tcp_handle_c2h_term(queue, (void *)queue->pdu); -+ return -EINVAL; -+ } -+ - if (queue->hdr_digest) { - ret = nvme_tcp_verify_hdgst(queue, queue->pdu, hdr->hlen); - if (unlikely(ret)) -diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c -index a6d55ebb823824..298c46834a5391 100644 ---- a/drivers/nvme/target/rdma.c -+++ b/drivers/nvme/target/rdma.c -@@ -997,6 +997,27 @@ static void nvmet_rdma_handle_command(struct nvmet_rdma_queue *queue, - nvmet_req_complete(&cmd->req, status); - } - -+static bool nvmet_rdma_recv_not_live(struct nvmet_rdma_queue *queue, -+ struct nvmet_rdma_rsp *rsp) -+{ -+ unsigned long flags; -+ bool ret = true; -+ -+ spin_lock_irqsave(&queue->state_lock, flags); -+ /* -+ * recheck queue state is not live to prevent a race condition -+ * with RDMA_CM_EVENT_ESTABLISHED handler. -+ */ -+ if (queue->state == NVMET_RDMA_Q_LIVE) -+ ret = false; -+ else if (queue->state == NVMET_RDMA_Q_CONNECTING) -+ list_add_tail(&rsp->wait_list, &queue->rsp_wait_list); -+ else -+ nvmet_rdma_put_rsp(rsp); -+ spin_unlock_irqrestore(&queue->state_lock, flags); -+ return ret; -+} -+ - static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc) - { - struct nvmet_rdma_cmd *cmd = -@@ -1038,17 +1059,9 @@ static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc) - rsp->req.port = queue->port; - rsp->n_rdma = 0; - -- if (unlikely(queue->state != NVMET_RDMA_Q_LIVE)) { -- unsigned long flags; -- -- spin_lock_irqsave(&queue->state_lock, flags); -- if (queue->state == NVMET_RDMA_Q_CONNECTING) -- list_add_tail(&rsp->wait_list, &queue->rsp_wait_list); -- else -- nvmet_rdma_put_rsp(rsp); -- spin_unlock_irqrestore(&queue->state_lock, flags); -+ if (unlikely(queue->state != NVMET_RDMA_Q_LIVE) && -+ nvmet_rdma_recv_not_live(queue, rsp)) - return; -- } - - nvmet_rdma_handle_command(queue, rsp); - } -diff --git a/drivers/pinctrl/bcm/pinctrl-bcm281xx.c b/drivers/pinctrl/bcm/pinctrl-bcm281xx.c -index 73dbf29c002f39..cf6efa9c0364a1 100644 ---- a/drivers/pinctrl/bcm/pinctrl-bcm281xx.c -+++ b/drivers/pinctrl/bcm/pinctrl-bcm281xx.c -@@ -974,7 +974,7 @@ static const struct regmap_config bcm281xx_pinctrl_regmap_config = { - .reg_bits = 32, - .reg_stride = 4, - .val_bits = 32, -- .max_register = BCM281XX_PIN_VC_CAM3_SDA, -+ .max_register = BCM281XX_PIN_VC_CAM3_SDA * 4, - }; - - static int bcm281xx_pinctrl_get_groups_count(struct pinctrl_dev *pctldev) -diff --git a/drivers/platform/x86/intel/pmc/core.c b/drivers/platform/x86/intel/pmc/core.c -index 022afb97d531c9..2fb73e924bd64d 100644 ---- a/drivers/platform/x86/intel/pmc/core.c -+++ b/drivers/platform/x86/intel/pmc/core.c -@@ -620,8 +620,8 @@ static u32 convert_ltr_scale(u32 val) - static int pmc_core_ltr_show(struct seq_file *s, void *unused) - { - struct pmc_dev *pmcdev = s->private; -- u64 decoded_snoop_ltr, decoded_non_snoop_ltr; -- u32 ltr_raw_data, scale, val; -+ u64 decoded_snoop_ltr, decoded_non_snoop_ltr, val; -+ u32 ltr_raw_data, scale; - u16 snoop_ltr, nonsnoop_ltr; - int i, index, ltr_index = 0; - -diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c -index 692bd6fea3744e..cde5f845cf2557 100644 ---- a/drivers/platform/x86/thinkpad_acpi.c -+++ b/drivers/platform/x86/thinkpad_acpi.c -@@ -7961,6 +7961,7 @@ static struct ibm_struct volume_driver_data = { - - #define FAN_NS_CTRL_STATUS BIT(2) /* Bit which determines control is enabled or not */ - #define FAN_NS_CTRL BIT(4) /* Bit which determines control is by host or EC */ -+#define FAN_CLOCK_TPM (22500*60) /* Ticks per minute for a 22.5 kHz clock */ - - enum { /* Fan control constants */ - fan_status_offset = 0x2f, /* EC register 0x2f */ -@@ -8014,6 +8015,7 @@ static int fan_watchdog_maxinterval; - - static bool fan_with_ns_addr; - static bool ecfw_with_fan_dec_rpm; -+static bool fan_speed_in_tpr; - - static struct mutex fan_mutex; - -@@ -8195,8 +8197,11 @@ static int fan_get_speed(unsigned int *speed) - !acpi_ec_read(fan_rpm_offset + 1, &hi))) - return -EIO; - -- if (likely(speed)) -+ if (likely(speed)) { - *speed = (hi << 8) | lo; -+ if (fan_speed_in_tpr && *speed != 0) -+ *speed = FAN_CLOCK_TPM / *speed; -+ } - break; - case TPACPI_FAN_RD_TPEC_NS: - if (!acpi_ec_read(fan_rpm_status_ns, &lo)) -@@ -8229,8 +8234,11 @@ static int fan2_get_speed(unsigned int *speed) - if (rc) - return -EIO; - -- if (likely(speed)) -+ if (likely(speed)) { - *speed = (hi << 8) | lo; -+ if (fan_speed_in_tpr && *speed != 0) -+ *speed = FAN_CLOCK_TPM / *speed; -+ } - break; - - case TPACPI_FAN_RD_TPEC_NS: -@@ -8758,6 +8766,7 @@ static const struct attribute_group fan_driver_attr_group = { - #define TPACPI_FAN_NOFAN 0x0008 /* no fan available */ - #define TPACPI_FAN_NS 0x0010 /* For EC with non-Standard register addresses */ - #define TPACPI_FAN_DECRPM 0x0020 /* For ECFW's with RPM in register as decimal */ -+#define TPACPI_FAN_TPR 0x0040 /* Fan speed is in Ticks Per Revolution */ - - static const struct tpacpi_quirk fan_quirk_table[] __initconst = { - TPACPI_QEC_IBM('1', 'Y', TPACPI_FAN_Q1), -@@ -8780,6 +8789,7 @@ static const struct tpacpi_quirk fan_quirk_table[] __initconst = { - TPACPI_Q_LNV3('N', '2', 'U', TPACPI_FAN_NS), /* X13 Yoga Gen 2*/ - TPACPI_Q_LNV3('N', '1', 'O', TPACPI_FAN_NOFAN), /* X1 Tablet (2nd gen) */ - TPACPI_Q_LNV3('R', '0', 'Q', TPACPI_FAN_DECRPM),/* L480 */ -+ TPACPI_Q_LNV('8', 'F', TPACPI_FAN_TPR), /* ThinkPad x120e */ - }; - - static int __init fan_init(struct ibm_init_struct *iibm) -@@ -8843,6 +8853,8 @@ static int __init fan_init(struct ibm_init_struct *iibm) - - if (quirks & TPACPI_FAN_Q1) - fan_quirk1_setup(); -+ if (quirks & TPACPI_FAN_TPR) -+ fan_speed_in_tpr = true; - /* Try and probe the 2nd fan */ - tp_features.second_fan = 1; /* needed for get_speed to work */ - res = fan2_get_speed(&speed); -@@ -10271,6 +10283,10 @@ static struct ibm_struct proxsensor_driver_data = { - #define DYTC_MODE_PSC_BALANCE 5 /* Default mode aka balanced */ - #define DYTC_MODE_PSC_PERFORM 7 /* High power mode aka performance */ - -+#define DYTC_MODE_PSCV9_LOWPOWER 1 /* Low power mode */ -+#define DYTC_MODE_PSCV9_BALANCE 3 /* Default mode aka balanced */ -+#define DYTC_MODE_PSCV9_PERFORM 4 /* High power mode aka performance */ -+ - #define DYTC_ERR_MASK 0xF /* Bits 0-3 in cmd result are the error result */ - #define DYTC_ERR_SUCCESS 1 /* CMD completed successful */ - -@@ -10291,6 +10307,10 @@ static int dytc_capabilities; - static bool dytc_mmc_get_available; - static int profile_force; - -+static int platform_psc_profile_lowpower = DYTC_MODE_PSC_LOWPOWER; -+static int platform_psc_profile_balanced = DYTC_MODE_PSC_BALANCE; -+static int platform_psc_profile_performance = DYTC_MODE_PSC_PERFORM; -+ - static int convert_dytc_to_profile(int funcmode, int dytcmode, - enum platform_profile_option *profile) - { -@@ -10312,19 +10332,15 @@ static int convert_dytc_to_profile(int funcmode, int dytcmode, - } - return 0; - case DYTC_FUNCTION_PSC: -- switch (dytcmode) { -- case DYTC_MODE_PSC_LOWPOWER: -+ if (dytcmode == platform_psc_profile_lowpower) - *profile = PLATFORM_PROFILE_LOW_POWER; -- break; -- case DYTC_MODE_PSC_BALANCE: -+ else if (dytcmode == platform_psc_profile_balanced) - *profile = PLATFORM_PROFILE_BALANCED; -- break; -- case DYTC_MODE_PSC_PERFORM: -+ else if (dytcmode == platform_psc_profile_performance) - *profile = PLATFORM_PROFILE_PERFORMANCE; -- break; -- default: /* Unknown mode */ -+ else - return -EINVAL; -- } -+ - return 0; - case DYTC_FUNCTION_AMT: - /* For now return balanced. It's the closest we have to 'auto' */ -@@ -10345,19 +10361,19 @@ static int convert_profile_to_dytc(enum platform_profile_option profile, int *pe - if (dytc_capabilities & BIT(DYTC_FC_MMC)) - *perfmode = DYTC_MODE_MMC_LOWPOWER; - else if (dytc_capabilities & BIT(DYTC_FC_PSC)) -- *perfmode = DYTC_MODE_PSC_LOWPOWER; -+ *perfmode = platform_psc_profile_lowpower; - break; - case PLATFORM_PROFILE_BALANCED: - if (dytc_capabilities & BIT(DYTC_FC_MMC)) - *perfmode = DYTC_MODE_MMC_BALANCE; - else if (dytc_capabilities & BIT(DYTC_FC_PSC)) -- *perfmode = DYTC_MODE_PSC_BALANCE; -+ *perfmode = platform_psc_profile_balanced; - break; - case PLATFORM_PROFILE_PERFORMANCE: - if (dytc_capabilities & BIT(DYTC_FC_MMC)) - *perfmode = DYTC_MODE_MMC_PERFORM; - else if (dytc_capabilities & BIT(DYTC_FC_PSC)) -- *perfmode = DYTC_MODE_PSC_PERFORM; -+ *perfmode = platform_psc_profile_performance; - break; - default: /* Unknown profile */ - return -EOPNOTSUPP; -@@ -10546,6 +10562,7 @@ static int tpacpi_dytc_profile_init(struct ibm_init_struct *iibm) - if (output & BIT(DYTC_QUERY_ENABLE_BIT)) - dytc_version = (output >> DYTC_QUERY_REV_BIT) & 0xF; - -+ dbg_printk(TPACPI_DBG_INIT, "DYTC version %d\n", dytc_version); - /* Check DYTC is enabled and supports mode setting */ - if (dytc_version < 5) - return -ENODEV; -@@ -10584,6 +10601,11 @@ static int tpacpi_dytc_profile_init(struct ibm_init_struct *iibm) - } - } else if (dytc_capabilities & BIT(DYTC_FC_PSC)) { /* PSC MODE */ - pr_debug("PSC is supported\n"); -+ if (dytc_version >= 9) { /* update profiles for DYTC 9 and up */ -+ platform_psc_profile_lowpower = DYTC_MODE_PSCV9_LOWPOWER; -+ platform_psc_profile_balanced = DYTC_MODE_PSCV9_BALANCE; -+ platform_psc_profile_performance = DYTC_MODE_PSCV9_PERFORM; -+ } - } else { - dbg_printk(TPACPI_DBG_INIT, "No DYTC support available\n"); - return -ENODEV; -diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c -index 52c32dcbf7d846..4112a009733826 100644 ---- a/drivers/powercap/powercap_sys.c -+++ b/drivers/powercap/powercap_sys.c -@@ -627,8 +627,7 @@ struct powercap_control_type *powercap_register_control_type( - dev_set_name(&control_type->dev, "%s", name); - result = device_register(&control_type->dev); - if (result) { -- if (control_type->allocated) -- kfree(control_type); -+ put_device(&control_type->dev); - return ERR_PTR(result); - } - idr_init(&control_type->idr); -diff --git a/drivers/s390/cio/chp.c b/drivers/s390/cio/chp.c -index 5440f285f3494d..7e00c061538dba 100644 ---- a/drivers/s390/cio/chp.c -+++ b/drivers/s390/cio/chp.c -@@ -661,7 +661,8 @@ static int info_update(void) - if (time_after(jiffies, chp_info_expires)) { - /* Data is too old, update. */ - rc = sclp_chp_read_info(&chp_info); -- chp_info_expires = jiffies + CHP_INFO_UPDATE_INTERVAL ; -+ if (!rc) -+ chp_info_expires = jiffies + CHP_INFO_UPDATE_INTERVAL; - } - mutex_unlock(&info_lock); - -diff --git a/drivers/scsi/qla1280.c b/drivers/scsi/qla1280.c -index 6e5e89aaa283ba..74b23c43af3eae 100644 ---- a/drivers/scsi/qla1280.c -+++ b/drivers/scsi/qla1280.c -@@ -2866,7 +2866,7 @@ qla1280_64bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp) - dprintk(3, "S/G Segment phys_addr=%x %x, len=0x%x\n", - cpu_to_le32(upper_32_bits(dma_handle)), - cpu_to_le32(lower_32_bits(dma_handle)), -- cpu_to_le32(sg_dma_len(sg_next(s)))); -+ cpu_to_le32(sg_dma_len(s))); - remseg--; - } - dprintk(5, "qla1280_64bit_start_scsi: Scatter/gather " -diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c -index ca99be7341d9be..cead0fbbe5dbdf 100644 ---- a/drivers/scsi/scsi_scan.c -+++ b/drivers/scsi/scsi_scan.c -@@ -245,7 +245,7 @@ static int scsi_realloc_sdev_budget_map(struct scsi_device *sdev, - } - ret = sbitmap_init_node(&sdev->budget_map, - scsi_device_max_queue_depth(sdev), -- new_shift, GFP_KERNEL, -+ new_shift, GFP_NOIO, - sdev->request_queue->node, false, true); - if (!ret) - sbitmap_resize(&sdev->budget_map, depth); -diff --git a/drivers/thermal/cpufreq_cooling.c b/drivers/thermal/cpufreq_cooling.c -index e2cc7bd308620d..874b4838d2c92e 100644 ---- a/drivers/thermal/cpufreq_cooling.c -+++ b/drivers/thermal/cpufreq_cooling.c -@@ -57,8 +57,6 @@ struct time_in_idle { - * @max_level: maximum cooling level. One less than total number of valid - * cpufreq frequencies. - * @em: Reference on the Energy Model of the device -- * @cdev: thermal_cooling_device pointer to keep track of the -- * registered cooling device. - * @policy: cpufreq policy. - * @cooling_ops: cpufreq callbacks to thermal cooling device ops - * @idle_time: idle time stats -diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c -index 6d53dd7d411a85..cb5611cbf45474 100644 ---- a/drivers/ufs/core/ufshcd.c -+++ b/drivers/ufs/core/ufshcd.c -@@ -3027,8 +3027,13 @@ ufshcd_dev_cmd_completion(struct ufs_hba *hba, struct ufshcd_lrb *lrbp) - case UPIU_TRANSACTION_QUERY_RSP: { - u8 response = lrbp->ucd_rsp_ptr->header.response; - -- if (response == 0) -+ if (response == 0) { - err = ufshcd_copy_query_response(hba, lrbp); -+ } else { -+ err = -EINVAL; -+ dev_err(hba->dev, "%s: unexpected response in Query RSP: %x\n", -+ __func__, response); -+ } - break; - } - case UPIU_TRANSACTION_REJECT_UPIU: -diff --git a/drivers/usb/phy/phy-generic.c b/drivers/usb/phy/phy-generic.c -index 770081b828a429..2b4d2cbafe7480 100644 ---- a/drivers/usb/phy/phy-generic.c -+++ b/drivers/usb/phy/phy-generic.c -@@ -217,7 +217,7 @@ int usb_phy_gen_create_phy(struct device *dev, struct usb_phy_generic *nop) - if (of_property_read_u32(node, "clock-frequency", &clk_rate)) - clk_rate = 0; - -- needs_clk = of_property_read_bool(node, "clocks"); -+ needs_clk = of_property_present(node, "clocks"); - } - nop->gpiod_reset = devm_gpiod_get_optional(dev, "reset", - GPIOD_ASIS); -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 22d01a0f10fbc2..b8e2bfd4282809 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -1079,6 +1079,20 @@ static const struct usb_device_id id_table_combined[] = { - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - /* GMC devices */ - { USB_DEVICE(GMC_VID, GMC_Z216C_PID) }, -+ /* Altera USB Blaster 3 */ -+ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6022_PID, 1) }, -+ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6025_PID, 2) }, -+ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6026_PID, 2) }, -+ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6026_PID, 3) }, -+ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6029_PID, 2) }, -+ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602A_PID, 2) }, -+ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602A_PID, 3) }, -+ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602C_PID, 1) }, -+ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602D_PID, 1) }, -+ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602D_PID, 2) }, -+ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 1) }, -+ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 2) }, -+ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 3) }, - { } /* Terminating entry */ - }; - -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index 5ee60ba2a73cdb..52be47d684ea66 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -1612,3 +1612,16 @@ - */ - #define GMC_VID 0x1cd7 - #define GMC_Z216C_PID 0x0217 /* GMC Z216C Adapter IR-USB */ -+ -+/* -+ * Altera USB Blaster 3 (http://www.altera.com). -+ */ -+#define ALTERA_VID 0x09fb -+#define ALTERA_UB3_6022_PID 0x6022 -+#define ALTERA_UB3_6025_PID 0x6025 -+#define ALTERA_UB3_6026_PID 0x6026 -+#define ALTERA_UB3_6029_PID 0x6029 -+#define ALTERA_UB3_602A_PID 0x602a -+#define ALTERA_UB3_602C_PID 0x602c -+#define ALTERA_UB3_602D_PID 0x602d -+#define ALTERA_UB3_602E_PID 0x602e -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 37ff48702e43e1..a9f95bb35bb0f5 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -1368,13 +1368,13 @@ static const struct usb_device_id option_ids[] = { - .driver_info = NCTRL(0) | RSVD(1) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990A (PCIe) */ - .driver_info = RSVD(0) }, -- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1080, 0xff), /* Telit FE990 (rmnet) */ -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1080, 0xff), /* Telit FE990A (rmnet) */ - .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, -- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1081, 0xff), /* Telit FE990 (MBIM) */ -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1081, 0xff), /* Telit FE990A (MBIM) */ - .driver_info = NCTRL(0) | RSVD(1) }, -- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1082, 0xff), /* Telit FE990 (RNDIS) */ -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1082, 0xff), /* Telit FE990A (RNDIS) */ - .driver_info = NCTRL(2) | RSVD(3) }, -- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1083, 0xff), /* Telit FE990 (ECM) */ -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1083, 0xff), /* Telit FE990A (ECM) */ - .driver_info = NCTRL(0) | RSVD(1) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a0, 0xff), /* Telit FN20C04 (rmnet) */ - .driver_info = RSVD(0) | NCTRL(3) }, -@@ -1388,28 +1388,44 @@ static const struct usb_device_id option_ids[] = { - .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10aa, 0xff), /* Telit FN920C04 (MBIM) */ - .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x30), /* Telit FE990B (rmnet) */ -+ .driver_info = NCTRL(5) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x40) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x60) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b1, 0xff, 0xff, 0x30), /* Telit FE990B (MBIM) */ -+ .driver_info = NCTRL(6) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b1, 0xff, 0xff, 0x40) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b1, 0xff, 0xff, 0x60) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b2, 0xff, 0xff, 0x30), /* Telit FE990B (RNDIS) */ -+ .driver_info = NCTRL(6) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b2, 0xff, 0xff, 0x40) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b2, 0xff, 0xff, 0x60) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x30), /* Telit FE990B (ECM) */ -+ .driver_info = NCTRL(6) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x40) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x60) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c0, 0xff), /* Telit FE910C04 (rmnet) */ - .driver_info = RSVD(0) | NCTRL(3) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c4, 0xff), /* Telit FE910C04 (rmnet) */ - .driver_info = RSVD(0) | NCTRL(3) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff), /* Telit FE910C04 (rmnet) */ - .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, -- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x60) }, /* Telit FN990B (rmnet) */ -- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x40) }, -- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x30), -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x30), /* Telit FN990B (rmnet) */ - .driver_info = NCTRL(5) }, -- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x60) }, /* Telit FN990B (MBIM) */ -- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x40) }, -- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x30), -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x60) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x30), /* Telit FN990B (MBIM) */ - .driver_info = NCTRL(6) }, -- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x60) }, /* Telit FN990B (RNDIS) */ -- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x40) }, -- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x30), -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x40) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x60) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d2, 0xff, 0xff, 0x30), /* Telit FN990B (RNDIS) */ - .driver_info = NCTRL(6) }, -- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x60) }, /* Telit FN990B (ECM) */ -- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x40) }, -- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x30), -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d2, 0xff, 0xff, 0x40) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d2, 0xff, 0xff, 0x60) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d3, 0xff, 0xff, 0x30), /* Telit FN990B (ECM) */ - .driver_info = NCTRL(6) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d3, 0xff, 0xff, 0x40) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d3, 0xff, 0xff, 0x60) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), - .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), -diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c -index b9965cbdd76427..80e8ec36b7db23 100644 ---- a/drivers/video/fbdev/hyperv_fb.c -+++ b/drivers/video/fbdev/hyperv_fb.c -@@ -1106,7 +1106,7 @@ static void hvfb_putmem(struct hv_device *hdev, struct fb_info *info) - - if (par->need_docopy) { - vfree(par->dio_vp); -- iounmap(info->screen_base); -+ iounmap(par->mmio_vp); - vmbus_free_mmio(par->mem->start, screen_fb_size); - } else { - hvfb_release_phymem(hdev, info->fix.smem_start, -diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c -index b6e54ab3b6f3bb..0b3bd9a7575e5f 100644 ---- a/drivers/xen/swiotlb-xen.c -+++ b/drivers/xen/swiotlb-xen.c -@@ -112,7 +112,7 @@ static int is_xen_swiotlb_buffer(struct device *dev, dma_addr_t dma_addr) - } - - #ifdef CONFIG_X86 --int xen_swiotlb_fixup(void *buf, unsigned long nslabs) -+int __init xen_swiotlb_fixup(void *buf, unsigned long nslabs) - { - int rc; - unsigned int order = get_order(IO_TLB_SEGSIZE << IO_TLB_SHIFT); -diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c -index 95f9913a353731..89bffaed421fa6 100644 ---- a/fs/fuse/dir.c -+++ b/fs/fuse/dir.c -@@ -1608,7 +1608,7 @@ static const char *fuse_get_link(struct dentry *dentry, struct inode *inode, - goto out_err; - - if (fc->cache_symlinks) -- return page_get_link(dentry, inode, callback); -+ return page_get_link_raw(dentry, inode, callback); - - err = -ECHILD; - if (!dentry) -diff --git a/fs/namei.c b/fs/namei.c -index beffbb02a24e67..155e4d09a5fb2c 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -5154,10 +5154,9 @@ const char *vfs_get_link(struct dentry *dentry, struct delayed_call *done) - EXPORT_SYMBOL(vfs_get_link); - - /* get the link contents into pagecache */ --const char *page_get_link(struct dentry *dentry, struct inode *inode, -- struct delayed_call *callback) -+static char *__page_get_link(struct dentry *dentry, struct inode *inode, -+ struct delayed_call *callback) - { -- char *kaddr; - struct page *page; - struct address_space *mapping = inode->i_mapping; - -@@ -5176,8 +5175,23 @@ const char *page_get_link(struct dentry *dentry, struct inode *inode, - } - set_delayed_call(callback, page_put_link, page); - BUG_ON(mapping_gfp_mask(mapping) & __GFP_HIGHMEM); -- kaddr = page_address(page); -- nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1); -+ return page_address(page); -+} -+ -+const char *page_get_link_raw(struct dentry *dentry, struct inode *inode, -+ struct delayed_call *callback) -+{ -+ return __page_get_link(dentry, inode, callback); -+} -+EXPORT_SYMBOL_GPL(page_get_link_raw); -+ -+const char *page_get_link(struct dentry *dentry, struct inode *inode, -+ struct delayed_call *callback) -+{ -+ char *kaddr = __page_get_link(dentry, inode, callback); -+ -+ if (!IS_ERR(kaddr)) -+ nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1); - return kaddr; - } - -diff --git a/fs/proc/base.c b/fs/proc/base.c -index 699f085d4de7d7..91fe20b7657c09 100644 ---- a/fs/proc/base.c -+++ b/fs/proc/base.c -@@ -2633,10 +2633,11 @@ static ssize_t timerslack_ns_write(struct file *file, const char __user *buf, - } - - task_lock(p); -- if (slack_ns == 0) -- p->timer_slack_ns = p->default_timer_slack_ns; -- else -- p->timer_slack_ns = slack_ns; -+ if (task_is_realtime(p)) -+ slack_ns = 0; -+ else if (slack_ns == 0) -+ slack_ns = p->default_timer_slack_ns; -+ p->timer_slack_ns = slack_ns; - task_unlock(p); - - out: -diff --git a/fs/select.c b/fs/select.c -index 3f730b8581f65d..e66b6189845ea9 100644 ---- a/fs/select.c -+++ b/fs/select.c -@@ -77,19 +77,16 @@ u64 select_estimate_accuracy(struct timespec64 *tv) - { - u64 ret; - struct timespec64 now; -+ u64 slack = current->timer_slack_ns; - -- /* -- * Realtime tasks get a slack of 0 for obvious reasons. -- */ -- -- if (rt_task(current)) -+ if (slack == 0) - return 0; - - ktime_get_ts64(&now); - now = timespec64_sub(*tv, now); - ret = __estimate_accuracy(&now); -- if (ret < current->timer_slack_ns) -- return current->timer_slack_ns; -+ if (ret < slack) -+ return slack; - return ret; - } - -diff --git a/fs/smb/client/asn1.c b/fs/smb/client/asn1.c -index b5724ef9f182f4..214a44509e7b99 100644 ---- a/fs/smb/client/asn1.c -+++ b/fs/smb/client/asn1.c -@@ -52,6 +52,8 @@ int cifs_neg_token_init_mech_type(void *context, size_t hdrlen, - server->sec_kerberos = true; - else if (oid == OID_ntlmssp) - server->sec_ntlmssp = true; -+ else if (oid == OID_IAKerb) -+ server->sec_iakerb = true; - else { - char buf[50]; - -diff --git a/fs/smb/client/cifs_spnego.c b/fs/smb/client/cifs_spnego.c -index af7849e5974ff3..2ad067886ec3fa 100644 ---- a/fs/smb/client/cifs_spnego.c -+++ b/fs/smb/client/cifs_spnego.c -@@ -130,11 +130,13 @@ cifs_get_spnego_key(struct cifs_ses *sesInfo, - - dp = description + strlen(description); - -- /* for now, only sec=krb5 and sec=mskrb5 are valid */ -+ /* for now, only sec=krb5 and sec=mskrb5 and iakerb are valid */ - if (server->sec_kerberos) - sprintf(dp, ";sec=krb5"); - else if (server->sec_mskerberos) - sprintf(dp, ";sec=mskrb5"); -+ else if (server->sec_iakerb) -+ sprintf(dp, ";sec=iakerb"); - else { - cifs_dbg(VFS, "unknown or missing server auth type, use krb5\n"); - sprintf(dp, ";sec=krb5"); -diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h -index 6992e1ec02e416..39117343b703fa 100644 ---- a/fs/smb/client/cifsglob.h -+++ b/fs/smb/client/cifsglob.h -@@ -151,6 +151,7 @@ enum securityEnum { - NTLMv2, /* Legacy NTLM auth with NTLMv2 hash */ - RawNTLMSSP, /* NTLMSSP without SPNEGO, NTLMv2 hash */ - Kerberos, /* Kerberos via SPNEGO */ -+ IAKerb, /* Kerberos proxy */ - }; - - enum cifs_reparse_type { -@@ -749,6 +750,7 @@ struct TCP_Server_Info { - bool sec_kerberosu2u; /* supports U2U Kerberos */ - bool sec_kerberos; /* supports plain Kerberos */ - bool sec_mskerberos; /* supports legacy MS Kerberos */ -+ bool sec_iakerb; /* supports pass-through auth for Kerberos (krb5 proxy) */ - bool large_buf; /* is current buffer large? */ - /* use SMBD connection instead of socket */ - bool rdma; -@@ -2156,6 +2158,8 @@ static inline char *get_security_type_str(enum securityEnum sectype) - return "Kerberos"; - case NTLMv2: - return "NTLMv2"; -+ case IAKerb: -+ return "IAKerb"; - default: - return "Unknown"; - } -diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c -index dbcaaa274abdbf..198681d14153ea 100644 ---- a/fs/smb/client/connect.c -+++ b/fs/smb/client/connect.c -@@ -1884,9 +1884,8 @@ cifs_get_tcp_session(struct smb3_fs_context *ctx, - /* this function must be called with ses_lock and chan_lock held */ - static int match_session(struct cifs_ses *ses, struct smb3_fs_context *ctx) - { -- if (ctx->sectype != Unspecified && -- ctx->sectype != ses->sectype) -- return 0; -+ struct TCP_Server_Info *server = ses->server; -+ enum securityEnum ctx_sec, ses_sec; - - if (ctx->dfs_root_ses != ses->dfs_root_ses) - return 0; -@@ -1898,11 +1897,20 @@ static int match_session(struct cifs_ses *ses, struct smb3_fs_context *ctx) - if (ses->chan_max < ctx->max_channels) - return 0; - -- switch (ses->sectype) { -+ ctx_sec = server->ops->select_sectype(server, ctx->sectype); -+ ses_sec = server->ops->select_sectype(server, ses->sectype); -+ -+ if (ctx_sec != ses_sec) -+ return 0; -+ -+ switch (ctx_sec) { -+ case IAKerb: - case Kerberos: - if (!uid_eq(ctx->cred_uid, ses->cred_uid)) - return 0; - break; -+ case NTLMv2: -+ case RawNTLMSSP: - default: - /* NULL username means anonymous session */ - if (ses->user_name == NULL) { -diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c -index 4e77ba191ef87e..b90cc918de7a39 100644 ---- a/fs/smb/client/fs_context.c -+++ b/fs/smb/client/fs_context.c -@@ -162,6 +162,7 @@ const struct fs_parameter_spec smb3_fs_parameters[] = { - fsparam_string("username", Opt_user), - fsparam_string("pass", Opt_pass), - fsparam_string("password", Opt_pass), -+ fsparam_string("pass2", Opt_pass2), - fsparam_string("password2", Opt_pass2), - fsparam_string("ip", Opt_ip), - fsparam_string("addr", Opt_ip), -@@ -1041,6 +1042,9 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, - } else if (!strcmp("user", param->key) || !strcmp("username", param->key)) { - skip_parsing = true; - opt = Opt_user; -+ } else if (!strcmp("pass2", param->key) || !strcmp("password2", param->key)) { -+ skip_parsing = true; -+ opt = Opt_pass2; - } - } - -@@ -1262,21 +1266,21 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, - } - break; - case Opt_acregmax: -- ctx->acregmax = HZ * result.uint_32; -- if (ctx->acregmax > CIFS_MAX_ACTIMEO) { -+ if (result.uint_32 > CIFS_MAX_ACTIMEO / HZ) { - cifs_errorf(fc, "acregmax too large\n"); - goto cifs_parse_mount_err; - } -+ ctx->acregmax = HZ * result.uint_32; - break; - case Opt_acdirmax: -- ctx->acdirmax = HZ * result.uint_32; -- if (ctx->acdirmax > CIFS_MAX_ACTIMEO) { -+ if (result.uint_32 > CIFS_MAX_ACTIMEO / HZ) { - cifs_errorf(fc, "acdirmax too large\n"); - goto cifs_parse_mount_err; - } -+ ctx->acdirmax = HZ * result.uint_32; - break; - case Opt_actimeo: -- if (HZ * result.uint_32 > CIFS_MAX_ACTIMEO) { -+ if (result.uint_32 > CIFS_MAX_ACTIMEO / HZ) { - cifs_errorf(fc, "timeout too large\n"); - goto cifs_parse_mount_err; - } -@@ -1288,11 +1292,11 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, - ctx->acdirmax = ctx->acregmax = HZ * result.uint_32; - break; - case Opt_closetimeo: -- ctx->closetimeo = HZ * result.uint_32; -- if (ctx->closetimeo > SMB3_MAX_DCLOSETIMEO) { -+ if (result.uint_32 > SMB3_MAX_DCLOSETIMEO / HZ) { - cifs_errorf(fc, "closetimeo too large\n"); - goto cifs_parse_mount_err; - } -+ ctx->closetimeo = HZ * result.uint_32; - break; - case Opt_echo_interval: - ctx->echo_interval = result.uint_32; -diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c -index dbb407d5e6dab2..b9cf05e0940d07 100644 ---- a/fs/smb/client/inode.c -+++ b/fs/smb/client/inode.c -@@ -1132,6 +1132,19 @@ static int reparse_info_to_fattr(struct cifs_open_info_data *data, - rc = server->ops->parse_reparse_point(cifs_sb, - full_path, - iov, data); -+ /* -+ * If the reparse point was not handled but it is the -+ * name surrogate which points to directory, then treat -+ * is as a new mount point. Name surrogate reparse point -+ * represents another named entity in the system. -+ */ -+ if (rc == -EOPNOTSUPP && -+ IS_REPARSE_TAG_NAME_SURROGATE(data->reparse.tag) && -+ (le32_to_cpu(data->fi.Attributes) & ATTR_DIRECTORY)) { -+ rc = 0; -+ cifs_create_junction_fattr(fattr, sb); -+ goto out; -+ } - } - break; - } -diff --git a/fs/smb/client/reparse.c b/fs/smb/client/reparse.c -index e56a8df23fec9a..bb246ef0458fb5 100644 ---- a/fs/smb/client/reparse.c -+++ b/fs/smb/client/reparse.c -@@ -651,13 +651,17 @@ int parse_reparse_point(struct reparse_data_buffer *buf, - case IO_REPARSE_TAG_LX_FIFO: - case IO_REPARSE_TAG_LX_CHR: - case IO_REPARSE_TAG_LX_BLK: -- break; -+ if (le16_to_cpu(buf->ReparseDataLength) != 0) { -+ cifs_dbg(VFS, "srv returned malformed buffer for reparse point: 0x%08x\n", -+ le32_to_cpu(buf->ReparseTag)); -+ return -EIO; -+ } -+ return 0; - default: - cifs_tcon_dbg(VFS | ONCE, "unhandled reparse tag: 0x%08x\n", - le32_to_cpu(buf->ReparseTag)); -- break; -+ return -EOPNOTSUPP; - } -- return 0; - } - - int smb2_parse_reparse_point(struct cifs_sb_info *cifs_sb, -diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c -index 3216f786908fbb..c2a98b2736645d 100644 ---- a/fs/smb/client/sess.c -+++ b/fs/smb/client/sess.c -@@ -1295,12 +1295,13 @@ cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested) - switch (requested) { - case Kerberos: - case RawNTLMSSP: -+ case IAKerb: - return requested; - case Unspecified: - if (server->sec_ntlmssp && - (global_secflags & CIFSSEC_MAY_NTLMSSP)) - return RawNTLMSSP; -- if ((server->sec_kerberos || server->sec_mskerberos) && -+ if ((server->sec_kerberos || server->sec_mskerberos || server->sec_iakerb) && - (global_secflags & CIFSSEC_MAY_KRB5)) - return Kerberos; - fallthrough; -diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c -index 24b1738a35a155..0af3535e08f308 100644 ---- a/fs/smb/client/smb2pdu.c -+++ b/fs/smb/client/smb2pdu.c -@@ -1428,7 +1428,7 @@ smb2_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested) - if (server->sec_ntlmssp && - (global_secflags & CIFSSEC_MAY_NTLMSSP)) - return RawNTLMSSP; -- if ((server->sec_kerberos || server->sec_mskerberos) && -+ if ((server->sec_kerberos || server->sec_mskerberos || server->sec_iakerb) && - (global_secflags & CIFSSEC_MAY_KRB5)) - return Kerberos; - fallthrough; -@@ -2162,7 +2162,7 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, - - tcon_error_exit: - if (rsp && rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) -- cifs_tcon_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree); -+ cifs_dbg(VFS | ONCE, "BAD_NETWORK_NAME: %s\n", tree); - goto tcon_exit; - } - -diff --git a/fs/smb/common/smbfsctl.h b/fs/smb/common/smbfsctl.h -index a94d658b88e86b..6eff3a8bde0963 100644 ---- a/fs/smb/common/smbfsctl.h -+++ b/fs/smb/common/smbfsctl.h -@@ -158,6 +158,9 @@ - #define IO_REPARSE_TAG_LX_CHR 0x80000025 - #define IO_REPARSE_TAG_LX_BLK 0x80000026 - -+/* If Name Surrogate Bit is set, the file or directory represents another named entity in the system. */ -+#define IS_REPARSE_TAG_NAME_SURROGATE(tag) (!!((tag) & 0x20000000)) -+ - /* fsctl flags */ - /* If Flags is set to this value, the request is an FSCTL not ioctl request */ - #define SMB2_0_IOCTL_IS_FSCTL 0x00000001 -diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c -index f3178570329a0e..e7bcc383003103 100644 ---- a/fs/smb/server/connection.c -+++ b/fs/smb/server/connection.c -@@ -432,6 +432,26 @@ void ksmbd_conn_init_server_callbacks(struct ksmbd_conn_ops *ops) - default_conn_ops.terminate_fn = ops->terminate_fn; - } - -+void ksmbd_conn_r_count_inc(struct ksmbd_conn *conn) -+{ -+ atomic_inc(&conn->r_count); -+} -+ -+void ksmbd_conn_r_count_dec(struct ksmbd_conn *conn) -+{ -+ /* -+ * Checking waitqueue to dropping pending requests on -+ * disconnection. waitqueue_active is safe because it -+ * uses atomic operation for condition. -+ */ -+ atomic_inc(&conn->refcnt); -+ if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q)) -+ wake_up(&conn->r_count_q); -+ -+ if (atomic_dec_and_test(&conn->refcnt)) -+ kfree(conn); -+} -+ - int ksmbd_conn_transport_init(void) - { - int ret; -diff --git a/fs/smb/server/connection.h b/fs/smb/server/connection.h -index 82343afc8d0499..4fdd76ce53b90c 100644 ---- a/fs/smb/server/connection.h -+++ b/fs/smb/server/connection.h -@@ -168,6 +168,8 @@ int ksmbd_conn_transport_init(void); - void ksmbd_conn_transport_destroy(void); - void ksmbd_conn_lock(struct ksmbd_conn *conn); - void ksmbd_conn_unlock(struct ksmbd_conn *conn); -+void ksmbd_conn_r_count_inc(struct ksmbd_conn *conn); -+void ksmbd_conn_r_count_dec(struct ksmbd_conn *conn); - - /* - * WARNING -diff --git a/fs/smb/server/ksmbd_work.c b/fs/smb/server/ksmbd_work.c -index d7c676c151e209..544d8ccd29b0a0 100644 ---- a/fs/smb/server/ksmbd_work.c -+++ b/fs/smb/server/ksmbd_work.c -@@ -26,7 +26,6 @@ struct ksmbd_work *ksmbd_alloc_work_struct(void) - INIT_LIST_HEAD(&work->request_entry); - INIT_LIST_HEAD(&work->async_request_entry); - INIT_LIST_HEAD(&work->fp_entry); -- INIT_LIST_HEAD(&work->interim_entry); - INIT_LIST_HEAD(&work->aux_read_list); - work->iov_alloc_cnt = 4; - work->iov = kcalloc(work->iov_alloc_cnt, sizeof(struct kvec), -@@ -56,8 +55,6 @@ void ksmbd_free_work_struct(struct ksmbd_work *work) - kfree(work->tr_buf); - kvfree(work->request_buf); - kfree(work->iov); -- if (!list_empty(&work->interim_entry)) -- list_del(&work->interim_entry); - - if (work->async_id) - ksmbd_release_id(&work->conn->async_ida, work->async_id); -diff --git a/fs/smb/server/ksmbd_work.h b/fs/smb/server/ksmbd_work.h -index 8ca2c813246e61..d36393ff8310cd 100644 ---- a/fs/smb/server/ksmbd_work.h -+++ b/fs/smb/server/ksmbd_work.h -@@ -89,7 +89,6 @@ struct ksmbd_work { - /* List head at conn->async_requests */ - struct list_head async_request_entry; - struct list_head fp_entry; -- struct list_head interim_entry; - }; - - /** -diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c -index 8ee86478287f93..11e82a14a40add 100644 ---- a/fs/smb/server/oplock.c -+++ b/fs/smb/server/oplock.c -@@ -46,7 +46,6 @@ static struct oplock_info *alloc_opinfo(struct ksmbd_work *work, - opinfo->fid = id; - opinfo->Tid = Tid; - INIT_LIST_HEAD(&opinfo->op_entry); -- INIT_LIST_HEAD(&opinfo->interim_list); - init_waitqueue_head(&opinfo->oplock_q); - init_waitqueue_head(&opinfo->oplock_brk); - atomic_set(&opinfo->refcount, 1); -@@ -635,6 +634,7 @@ static void __smb2_oplock_break_noti(struct work_struct *wk) - { - struct smb2_oplock_break *rsp = NULL; - struct ksmbd_work *work = container_of(wk, struct ksmbd_work, work); -+ struct ksmbd_conn *conn = work->conn; - struct oplock_break_info *br_info = work->request_buf; - struct smb2_hdr *rsp_hdr; - struct ksmbd_file *fp; -@@ -690,6 +690,7 @@ static void __smb2_oplock_break_noti(struct work_struct *wk) - - out: - ksmbd_free_work_struct(work); -+ ksmbd_conn_r_count_dec(conn); - } - - /** -@@ -724,6 +725,7 @@ static int smb2_oplock_break_noti(struct oplock_info *opinfo) - work->sess = opinfo->sess; - - if (opinfo->op_state == OPLOCK_ACK_WAIT) { -+ ksmbd_conn_r_count_inc(conn); - INIT_WORK(&work->work, __smb2_oplock_break_noti); - ksmbd_queue_work(work); - -@@ -745,6 +747,7 @@ static void __smb2_lease_break_noti(struct work_struct *wk) - { - struct smb2_lease_break *rsp = NULL; - struct ksmbd_work *work = container_of(wk, struct ksmbd_work, work); -+ struct ksmbd_conn *conn = work->conn; - struct lease_break_info *br_info = work->request_buf; - struct smb2_hdr *rsp_hdr; - -@@ -791,6 +794,7 @@ static void __smb2_lease_break_noti(struct work_struct *wk) - - out: - ksmbd_free_work_struct(work); -+ ksmbd_conn_r_count_dec(conn); - } - - /** -@@ -803,7 +807,6 @@ static void __smb2_lease_break_noti(struct work_struct *wk) - static int smb2_lease_break_noti(struct oplock_info *opinfo) - { - struct ksmbd_conn *conn = opinfo->conn; -- struct list_head *tmp, *t; - struct ksmbd_work *work; - struct lease_break_info *br_info; - struct lease *lease = opinfo->o_lease; -@@ -831,16 +834,7 @@ static int smb2_lease_break_noti(struct oplock_info *opinfo) - work->sess = opinfo->sess; - - if (opinfo->op_state == OPLOCK_ACK_WAIT) { -- list_for_each_safe(tmp, t, &opinfo->interim_list) { -- struct ksmbd_work *in_work; -- -- in_work = list_entry(tmp, struct ksmbd_work, -- interim_entry); -- setup_async_work(in_work, NULL, NULL); -- smb2_send_interim_resp(in_work, STATUS_PENDING); -- list_del_init(&in_work->interim_entry); -- release_async_work(in_work); -- } -+ ksmbd_conn_r_count_inc(conn); - INIT_WORK(&work->work, __smb2_lease_break_noti); - ksmbd_queue_work(work); - wait_for_break_ack(opinfo); -@@ -871,7 +865,8 @@ static void wait_lease_breaking(struct oplock_info *opinfo) - } - } - --static int oplock_break(struct oplock_info *brk_opinfo, int req_op_level) -+static int oplock_break(struct oplock_info *brk_opinfo, int req_op_level, -+ struct ksmbd_work *in_work) - { - int err = 0; - -@@ -914,9 +909,15 @@ static int oplock_break(struct oplock_info *brk_opinfo, int req_op_level) - } - - if (lease->state & (SMB2_LEASE_WRITE_CACHING_LE | -- SMB2_LEASE_HANDLE_CACHING_LE)) -+ SMB2_LEASE_HANDLE_CACHING_LE)) { -+ if (in_work) { -+ setup_async_work(in_work, NULL, NULL); -+ smb2_send_interim_resp(in_work, STATUS_PENDING); -+ release_async_work(in_work); -+ } -+ - brk_opinfo->op_state = OPLOCK_ACK_WAIT; -- else -+ } else - atomic_dec(&brk_opinfo->breaking_cnt); - } else { - err = oplock_break_pending(brk_opinfo, req_op_level); -@@ -1116,7 +1117,7 @@ void smb_send_parent_lease_break_noti(struct ksmbd_file *fp, - if (ksmbd_conn_releasing(opinfo->conn)) - continue; - -- oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE); -+ oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE, NULL); - opinfo_put(opinfo); - } - } -@@ -1152,7 +1153,7 @@ void smb_lazy_parent_lease_break_close(struct ksmbd_file *fp) - - if (ksmbd_conn_releasing(opinfo->conn)) - continue; -- oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE); -+ oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE, NULL); - opinfo_put(opinfo); - } - } -@@ -1252,8 +1253,7 @@ int smb_grant_oplock(struct ksmbd_work *work, int req_op_level, u64 pid, - goto op_break_not_needed; - } - -- list_add(&work->interim_entry, &prev_opinfo->interim_list); -- err = oplock_break(prev_opinfo, SMB2_OPLOCK_LEVEL_II); -+ err = oplock_break(prev_opinfo, SMB2_OPLOCK_LEVEL_II, work); - opinfo_put(prev_opinfo); - if (err == -ENOENT) - goto set_lev; -@@ -1322,8 +1322,7 @@ static void smb_break_all_write_oplock(struct ksmbd_work *work, - } - - brk_opinfo->open_trunc = is_trunc; -- list_add(&work->interim_entry, &brk_opinfo->interim_list); -- oplock_break(brk_opinfo, SMB2_OPLOCK_LEVEL_II); -+ oplock_break(brk_opinfo, SMB2_OPLOCK_LEVEL_II, work); - opinfo_put(brk_opinfo); - } - -@@ -1386,7 +1385,7 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp, - SMB2_LEASE_KEY_SIZE)) - goto next; - brk_op->open_trunc = is_trunc; -- oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE); -+ oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE, NULL); - next: - opinfo_put(brk_op); - rcu_read_lock(); -diff --git a/fs/smb/server/oplock.h b/fs/smb/server/oplock.h -index e9da63f25b2061..59554b73f60c26 100644 ---- a/fs/smb/server/oplock.h -+++ b/fs/smb/server/oplock.h -@@ -74,7 +74,6 @@ struct oplock_info { - bool is_lease; - bool open_trunc; /* truncate on open */ - struct lease *o_lease; -- struct list_head interim_list; - struct list_head op_entry; - struct list_head lease_entry; - wait_queue_head_t oplock_q; /* Other server threads */ -diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c -index 71e1c1db9deae4..80050b2178980a 100644 ---- a/fs/smb/server/server.c -+++ b/fs/smb/server/server.c -@@ -270,17 +270,7 @@ static void handle_ksmbd_work(struct work_struct *wk) - - ksmbd_conn_try_dequeue_request(work); - ksmbd_free_work_struct(work); -- /* -- * Checking waitqueue to dropping pending requests on -- * disconnection. waitqueue_active is safe because it -- * uses atomic operation for condition. -- */ -- atomic_inc(&conn->refcnt); -- if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q)) -- wake_up(&conn->r_count_q); -- -- if (atomic_dec_and_test(&conn->refcnt)) -- kfree(conn); -+ ksmbd_conn_r_count_dec(conn); - } - - /** -@@ -310,7 +300,7 @@ static int queue_ksmbd_work(struct ksmbd_conn *conn) - conn->request_buf = NULL; - - ksmbd_conn_enqueue_request(work); -- atomic_inc(&conn->r_count); -+ ksmbd_conn_r_count_inc(conn); - /* update activity on connection */ - conn->last_active = jiffies; - INIT_WORK(&work->work, handle_ksmbd_work); -diff --git a/fs/vboxsf/super.c b/fs/vboxsf/super.c -index 9848af78215bf0..6e9ebf2321230a 100644 ---- a/fs/vboxsf/super.c -+++ b/fs/vboxsf/super.c -@@ -21,7 +21,8 @@ - - #define VBOXSF_SUPER_MAGIC 0x786f4256 /* 'VBox' little endian */ - --static const unsigned char VBSF_MOUNT_SIGNATURE[4] = "\000\377\376\375"; -+static const unsigned char VBSF_MOUNT_SIGNATURE[4] = { '\000', '\377', '\376', -+ '\375' }; - - static int follow_symlinks; - module_param(follow_symlinks, int, 0444); -diff --git a/include/linux/fs.h b/include/linux/fs.h -index e47596d354ff75..81edfa1e66b608 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -3085,6 +3085,8 @@ extern const struct file_operations generic_ro_fops; - - extern int readlink_copy(char __user *, int, const char *); - extern int page_readlink(struct dentry *, char __user *, int); -+extern const char *page_get_link_raw(struct dentry *, struct inode *, -+ struct delayed_call *); - extern const char *page_get_link(struct dentry *, struct inode *, - struct delayed_call *); - extern void page_put_link(void *); -diff --git a/include/linux/i8253.h b/include/linux/i8253.h -index bf169cfef7f12d..56c280eb2d4fd4 100644 ---- a/include/linux/i8253.h -+++ b/include/linux/i8253.h -@@ -21,7 +21,6 @@ - #define PIT_LATCH ((PIT_TICK_RATE + HZ/2) / HZ) - - extern raw_spinlock_t i8253_lock; --extern bool i8253_clear_counter_on_shutdown; - extern struct clock_event_device i8253_clockevent; - extern void clockevent_i8253_init(bool oneshot); - extern void clockevent_i8253_disable(void); -diff --git a/include/linux/io_uring_types.h b/include/linux/io_uring_types.h -index 8215e193178aa8..0fadef2983e01b 100644 ---- a/include/linux/io_uring_types.h -+++ b/include/linux/io_uring_types.h -@@ -326,9 +326,6 @@ struct io_ring_ctx { - - struct list_head io_buffers_cache; - -- /* deferred free list, protected by ->uring_lock */ -- struct hlist_head io_buf_list; -- - /* Keep this last, we don't need it for the fast path */ - struct wait_queue_head poll_wq; - struct io_restriction restrictions; -diff --git a/include/linux/nvme-tcp.h b/include/linux/nvme-tcp.h -index e07e8978d691b7..e435250fcb4d05 100644 ---- a/include/linux/nvme-tcp.h -+++ b/include/linux/nvme-tcp.h -@@ -13,6 +13,8 @@ - #define NVME_TCP_ADMIN_CCSZ SZ_8K - #define NVME_TCP_DIGEST_LENGTH 4 - #define NVME_TCP_MIN_MAXH2CDATA 4096 -+#define NVME_TCP_MIN_C2HTERM_PLEN 24 -+#define NVME_TCP_MAX_C2HTERM_PLEN 152 - - enum nvme_tcp_pfv { - NVME_TCP_PFV_1_0 = 0x0, -diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h -index 4fcee6b734b74c..e9214ccfde2d72 100644 ---- a/include/net/bluetooth/hci_core.h -+++ b/include/net/bluetooth/hci_core.h -@@ -800,6 +800,7 @@ struct hci_conn_params { - extern struct list_head hci_dev_list; - extern struct list_head hci_cb_list; - extern rwlock_t hci_dev_list_lock; -+extern struct mutex hci_cb_list_lock; - - #define hci_dev_set_flag(hdev, nr) set_bit((nr), (hdev)->dev_flags) - #define hci_dev_clear_flag(hdev, nr) clear_bit((nr), (hdev)->dev_flags) -@@ -1948,47 +1949,24 @@ struct hci_cb { - - char *name; - -- bool (*match) (struct hci_conn *conn); - void (*connect_cfm) (struct hci_conn *conn, __u8 status); - void (*disconn_cfm) (struct hci_conn *conn, __u8 status); - void (*security_cfm) (struct hci_conn *conn, __u8 status, -- __u8 encrypt); -+ __u8 encrypt); - void (*key_change_cfm) (struct hci_conn *conn, __u8 status); - void (*role_switch_cfm) (struct hci_conn *conn, __u8 status, __u8 role); - }; - --static inline void hci_cb_lookup(struct hci_conn *conn, struct list_head *list) --{ -- struct hci_cb *cb, *cpy; -- -- rcu_read_lock(); -- list_for_each_entry_rcu(cb, &hci_cb_list, list) { -- if (cb->match && cb->match(conn)) { -- cpy = kmalloc(sizeof(*cpy), GFP_ATOMIC); -- if (!cpy) -- break; -- -- *cpy = *cb; -- INIT_LIST_HEAD(&cpy->list); -- list_add_rcu(&cpy->list, list); -- } -- } -- rcu_read_unlock(); --} -- - static inline void hci_connect_cfm(struct hci_conn *conn, __u8 status) - { -- struct list_head list; -- struct hci_cb *cb, *tmp; -- -- INIT_LIST_HEAD(&list); -- hci_cb_lookup(conn, &list); -+ struct hci_cb *cb; - -- list_for_each_entry_safe(cb, tmp, &list, list) { -+ mutex_lock(&hci_cb_list_lock); -+ list_for_each_entry(cb, &hci_cb_list, list) { - if (cb->connect_cfm) - cb->connect_cfm(conn, status); -- kfree(cb); - } -+ mutex_unlock(&hci_cb_list_lock); - - if (conn->connect_cfm_cb) - conn->connect_cfm_cb(conn, status); -@@ -1996,43 +1974,22 @@ static inline void hci_connect_cfm(struct hci_conn *conn, __u8 status) - - static inline void hci_disconn_cfm(struct hci_conn *conn, __u8 reason) - { -- struct list_head list; -- struct hci_cb *cb, *tmp; -- -- INIT_LIST_HEAD(&list); -- hci_cb_lookup(conn, &list); -+ struct hci_cb *cb; - -- list_for_each_entry_safe(cb, tmp, &list, list) { -+ mutex_lock(&hci_cb_list_lock); -+ list_for_each_entry(cb, &hci_cb_list, list) { - if (cb->disconn_cfm) - cb->disconn_cfm(conn, reason); -- kfree(cb); - } -+ mutex_unlock(&hci_cb_list_lock); - - if (conn->disconn_cfm_cb) - conn->disconn_cfm_cb(conn, reason); - } - --static inline void hci_security_cfm(struct hci_conn *conn, __u8 status, -- __u8 encrypt) --{ -- struct list_head list; -- struct hci_cb *cb, *tmp; -- -- INIT_LIST_HEAD(&list); -- hci_cb_lookup(conn, &list); -- -- list_for_each_entry_safe(cb, tmp, &list, list) { -- if (cb->security_cfm) -- cb->security_cfm(conn, status, encrypt); -- kfree(cb); -- } -- -- if (conn->security_cfm_cb) -- conn->security_cfm_cb(conn, status); --} -- - static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status) - { -+ struct hci_cb *cb; - __u8 encrypt; - - if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) -@@ -2040,11 +1997,20 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status) - - encrypt = test_bit(HCI_CONN_ENCRYPT, &conn->flags) ? 0x01 : 0x00; - -- hci_security_cfm(conn, status, encrypt); -+ mutex_lock(&hci_cb_list_lock); -+ list_for_each_entry(cb, &hci_cb_list, list) { -+ if (cb->security_cfm) -+ cb->security_cfm(conn, status, encrypt); -+ } -+ mutex_unlock(&hci_cb_list_lock); -+ -+ if (conn->security_cfm_cb) -+ conn->security_cfm_cb(conn, status); - } - - static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status) - { -+ struct hci_cb *cb; - __u8 encrypt; - - if (conn->state == BT_CONFIG) { -@@ -2071,38 +2037,40 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status) - conn->sec_level = conn->pending_sec_level; - } - -- hci_security_cfm(conn, status, encrypt); -+ mutex_lock(&hci_cb_list_lock); -+ list_for_each_entry(cb, &hci_cb_list, list) { -+ if (cb->security_cfm) -+ cb->security_cfm(conn, status, encrypt); -+ } -+ mutex_unlock(&hci_cb_list_lock); -+ -+ if (conn->security_cfm_cb) -+ conn->security_cfm_cb(conn, status); - } - - static inline void hci_key_change_cfm(struct hci_conn *conn, __u8 status) - { -- struct list_head list; -- struct hci_cb *cb, *tmp; -- -- INIT_LIST_HEAD(&list); -- hci_cb_lookup(conn, &list); -+ struct hci_cb *cb; - -- list_for_each_entry_safe(cb, tmp, &list, list) { -+ mutex_lock(&hci_cb_list_lock); -+ list_for_each_entry(cb, &hci_cb_list, list) { - if (cb->key_change_cfm) - cb->key_change_cfm(conn, status); -- kfree(cb); - } -+ mutex_unlock(&hci_cb_list_lock); - } - - static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status, - __u8 role) - { -- struct list_head list; -- struct hci_cb *cb, *tmp; -- -- INIT_LIST_HEAD(&list); -- hci_cb_lookup(conn, &list); -+ struct hci_cb *cb; - -- list_for_each_entry_safe(cb, tmp, &list, list) { -+ mutex_lock(&hci_cb_list_lock); -+ list_for_each_entry(cb, &hci_cb_list, list) { - if (cb->role_switch_cfm) - cb->role_switch_cfm(conn, status, role); -- kfree(cb); - } -+ mutex_unlock(&hci_cb_list_lock); - } - - static inline bool hci_bdaddr_is_rpa(bdaddr_t *bdaddr, u8 addr_type) -diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h -index d2a1154121d0d5..08574278645de1 100644 ---- a/include/net/bluetooth/l2cap.h -+++ b/include/net/bluetooth/l2cap.h -@@ -662,7 +662,7 @@ struct l2cap_conn { - struct l2cap_chan *smp; - - struct list_head chan_l; -- struct mutex chan_lock; -+ struct mutex lock; - struct kref ref; - struct list_head users; - }; -@@ -968,6 +968,7 @@ void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan, - void __l2cap_physical_cfm(struct l2cap_chan *chan, int result); - - struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn); -+struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *conn); - void l2cap_conn_put(struct l2cap_conn *conn); - - int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user); -diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h -index dcbf3f299548f7..c0f4b91e4f5ece 100644 ---- a/include/net/netfilter/nf_tables.h -+++ b/include/net/netfilter/nf_tables.h -@@ -407,7 +407,7 @@ struct nft_expr_info; - - int nft_expr_inner_parse(const struct nft_ctx *ctx, const struct nlattr *nla, - struct nft_expr_info *info); --int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src); -+int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src, gfp_t gfp); - void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr); - int nft_expr_dump(struct sk_buff *skb, unsigned int attr, - const struct nft_expr *expr, bool reset); -@@ -826,10 +826,16 @@ static inline struct nft_set_elem_expr *nft_set_ext_expr(const struct nft_set_ex - return nft_set_ext(ext, NFT_SET_EXT_EXPRESSIONS); - } - --static inline bool nft_set_elem_expired(const struct nft_set_ext *ext) -+static inline bool __nft_set_elem_expired(const struct nft_set_ext *ext, -+ u64 tstamp) - { - return nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION) && -- time_is_before_eq_jiffies64(*nft_set_ext_expiration(ext)); -+ time_after_eq64(tstamp, *nft_set_ext_expiration(ext)); -+} -+ -+static inline bool nft_set_elem_expired(const struct nft_set_ext *ext) -+{ -+ return __nft_set_elem_expired(ext, get_jiffies_64()); - } - - static inline struct nft_set_ext *nft_set_elem_ext(const struct nft_set *set, -@@ -930,7 +936,7 @@ struct nft_expr_ops { - struct nft_regs *regs, - const struct nft_pktinfo *pkt); - int (*clone)(struct nft_expr *dst, -- const struct nft_expr *src); -+ const struct nft_expr *src, gfp_t gfp); - unsigned int size; - - int (*init)(const struct nft_ctx *ctx, -@@ -1791,6 +1797,7 @@ struct nftables_pernet { - struct list_head notify_list; - struct mutex commit_mutex; - u64 table_handle; -+ u64 tstamp; - unsigned int base_seq; - unsigned int gc_seq; - u8 validate_state; -@@ -1803,6 +1810,11 @@ static inline struct nftables_pernet *nft_pernet(const struct net *net) - return net_generic(net, nf_tables_net_id); - } - -+static inline u64 nft_net_tstamp(const struct net *net) -+{ -+ return nft_pernet(net)->tstamp; -+} -+ - #define __NFT_REDUCE_READONLY 1UL - #define NFT_REDUCE_READONLY (void *)__NFT_REDUCE_READONLY - -diff --git a/include/sound/soc.h b/include/sound/soc.h -index c1acc46529b9db..1f99c29aebdfeb 100644 ---- a/include/sound/soc.h -+++ b/include/sound/soc.h -@@ -1184,7 +1184,10 @@ void snd_soc_close_delayed_work(struct snd_soc_pcm_runtime *rtd); - - /* mixer control */ - struct soc_mixer_control { -- int min, max, platform_max; -+ /* Minimum and maximum specified as written to the hardware */ -+ int min, max; -+ /* Limited maximum value specified as presented through the control */ -+ int platform_max; - int reg, rreg; - unsigned int shift, rshift; - unsigned int sign_bit; -diff --git a/init/Kconfig b/init/Kconfig -index 60ed7713b5ee2a..1105cb53f391ab 100644 ---- a/init/Kconfig -+++ b/init/Kconfig -@@ -1908,7 +1908,7 @@ config RUST - depends on !GCC_PLUGINS - depends on !RANDSTRUCT - depends on !SHADOW_CALL_STACK -- depends on !DEBUG_INFO_BTF || PAHOLE_HAS_LANG_EXCLUDE -+ depends on !DEBUG_INFO_BTF || (PAHOLE_HAS_LANG_EXCLUDE && !LTO) - help - Enables Rust support in the kernel. - -diff --git a/io_uring/io-wq.c b/io_uring/io-wq.c -index a1e31723c9ed69..93f3e4d1df853e 100644 ---- a/io_uring/io-wq.c -+++ b/io_uring/io-wq.c -@@ -65,7 +65,7 @@ struct io_worker { - - union { - struct rcu_head rcu; -- struct work_struct work; -+ struct delayed_work work; - }; - }; - -@@ -771,6 +771,18 @@ static inline bool io_should_retry_thread(struct io_worker *worker, long err) - } - } - -+static void queue_create_worker_retry(struct io_worker *worker) -+{ -+ /* -+ * We only bother retrying because there's a chance that the -+ * failure to create a worker is due to some temporary condition -+ * in the forking task (e.g. outstanding signal); give the task -+ * some time to clear that condition. -+ */ -+ schedule_delayed_work(&worker->work, -+ msecs_to_jiffies(worker->init_retries * 5)); -+} -+ - static void create_worker_cont(struct callback_head *cb) - { - struct io_worker *worker; -@@ -810,12 +822,13 @@ static void create_worker_cont(struct callback_head *cb) - - /* re-create attempts grab a new worker ref, drop the existing one */ - io_worker_release(worker); -- schedule_work(&worker->work); -+ queue_create_worker_retry(worker); - } - - static void io_workqueue_create(struct work_struct *work) - { -- struct io_worker *worker = container_of(work, struct io_worker, work); -+ struct io_worker *worker = container_of(work, struct io_worker, -+ work.work); - struct io_wq_acct *acct = io_wq_get_acct(worker); - - if (!io_queue_worker_create(worker, acct, create_worker_cont)) -@@ -856,8 +869,8 @@ static bool create_io_worker(struct io_wq *wq, int index) - kfree(worker); - goto fail; - } else { -- INIT_WORK(&worker->work, io_workqueue_create); -- schedule_work(&worker->work); -+ INIT_DELAYED_WORK(&worker->work, io_workqueue_create); -+ queue_create_worker_retry(worker); - } - - return true; -diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c -index 5776440f584c76..efa7849b82c184 100644 ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -64,13 +64,13 @@ - #include - #include - #include --#include - #include - #include - #include - #include - #include - #include -+#include - #include - - #define CREATE_TRACE_POINTS -@@ -312,7 +312,6 @@ static __cold struct io_ring_ctx *io_ring_ctx_alloc(struct io_uring_params *p) - INIT_LIST_HEAD(&ctx->sqd_list); - INIT_LIST_HEAD(&ctx->cq_overflow_list); - INIT_LIST_HEAD(&ctx->io_buffers_cache); -- INIT_HLIST_HEAD(&ctx->io_buf_list); - io_alloc_cache_init(&ctx->rsrc_node_cache, IO_NODE_ALLOC_CACHE_MAX, - sizeof(struct io_rsrc_node)); - io_alloc_cache_init(&ctx->apoll_cache, IO_ALLOC_CACHE_MAX, -@@ -2683,12 +2682,34 @@ static int io_cqring_wait(struct io_ring_ctx *ctx, int min_events, - return READ_ONCE(rings->cq.head) == READ_ONCE(rings->cq.tail) ? ret : 0; - } - --void io_mem_free(void *ptr) -+void io_pages_unmap(void *ptr, struct page ***pages, unsigned short *npages, -+ bool put_pages) - { -+ bool do_vunmap = false; -+ - if (!ptr) - return; - -- folio_put(virt_to_folio(ptr)); -+ if (put_pages && *npages) { -+ struct page **to_free = *pages; -+ int i; -+ -+ /* -+ * Only did vmap for the non-compound multiple page case. -+ * For the compound page, we just need to put the head. -+ */ -+ if (PageCompound(to_free[0])) -+ *npages = 1; -+ else if (*npages > 1) -+ do_vunmap = true; -+ for (i = 0; i < *npages; i++) -+ put_page(to_free[i]); -+ } -+ if (do_vunmap) -+ vunmap(ptr); -+ kvfree(*pages); -+ *pages = NULL; -+ *npages = 0; - } - - static void io_pages_free(struct page ***pages, int npages) -@@ -2709,65 +2730,67 @@ static void io_pages_free(struct page ***pages, int npages) - *pages = NULL; - } - -+struct page **io_pin_pages(unsigned long uaddr, unsigned long len, int *npages) -+{ -+ unsigned long start, end, nr_pages; -+ struct page **pages; -+ int ret; -+ -+ end = (uaddr + len + PAGE_SIZE - 1) >> PAGE_SHIFT; -+ start = uaddr >> PAGE_SHIFT; -+ nr_pages = end - start; -+ if (WARN_ON_ONCE(!nr_pages)) -+ return ERR_PTR(-EINVAL); -+ -+ pages = kvmalloc_array(nr_pages, sizeof(struct page *), GFP_KERNEL); -+ if (!pages) -+ return ERR_PTR(-ENOMEM); -+ -+ ret = pin_user_pages_fast(uaddr, nr_pages, FOLL_WRITE | FOLL_LONGTERM, -+ pages); -+ /* success, mapped all pages */ -+ if (ret == nr_pages) { -+ *npages = nr_pages; -+ return pages; -+ } -+ -+ /* partial map, or didn't map anything */ -+ if (ret >= 0) { -+ /* if we did partial map, release any pages we did get */ -+ if (ret) -+ unpin_user_pages(pages, ret); -+ ret = -EFAULT; -+ } -+ kvfree(pages); -+ return ERR_PTR(ret); -+} -+ - static void *__io_uaddr_map(struct page ***pages, unsigned short *npages, - unsigned long uaddr, size_t size) - { - struct page **page_array; - unsigned int nr_pages; - void *page_addr; -- int ret, i, pinned; - - *npages = 0; - - if (uaddr & (PAGE_SIZE - 1) || !size) - return ERR_PTR(-EINVAL); - -- nr_pages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT; -- if (nr_pages > USHRT_MAX) -- return ERR_PTR(-EINVAL); -- page_array = kvmalloc_array(nr_pages, sizeof(struct page *), GFP_KERNEL); -- if (!page_array) -- return ERR_PTR(-ENOMEM); -+ nr_pages = 0; -+ page_array = io_pin_pages(uaddr, size, &nr_pages); -+ if (IS_ERR(page_array)) -+ return page_array; - -- -- pinned = pin_user_pages_fast(uaddr, nr_pages, FOLL_WRITE | FOLL_LONGTERM, -- page_array); -- if (pinned != nr_pages) { -- ret = (pinned < 0) ? pinned : -EFAULT; -- goto free_pages; -+ page_addr = vmap(page_array, nr_pages, VM_MAP, PAGE_KERNEL); -+ if (page_addr) { -+ *pages = page_array; -+ *npages = nr_pages; -+ return page_addr; - } - -- page_addr = page_address(page_array[0]); -- for (i = 0; i < nr_pages; i++) { -- ret = -EINVAL; -- -- /* -- * Can't support mapping user allocated ring memory on 32-bit -- * archs where it could potentially reside in highmem. Just -- * fail those with -EINVAL, just like we did on kernels that -- * didn't support this feature. -- */ -- if (PageHighMem(page_array[i])) -- goto free_pages; -- -- /* -- * No support for discontig pages for now, should either be a -- * single normal page, or a huge page. Later on we can add -- * support for remapping discontig pages, for now we will -- * just fail them with EINVAL. -- */ -- if (page_address(page_array[i]) != page_addr) -- goto free_pages; -- page_addr += PAGE_SIZE; -- } -- -- *pages = page_array; -- *npages = nr_pages; -- return page_to_virt(page_array[0]); -- --free_pages: -- io_pages_free(&page_array, pinned > 0 ? pinned : 0); -- return ERR_PTR(ret); -+ io_pages_free(&page_array, nr_pages); -+ return ERR_PTR(-ENOMEM); - } - - static void *io_rings_map(struct io_ring_ctx *ctx, unsigned long uaddr, -@@ -2787,30 +2810,99 @@ static void *io_sqes_map(struct io_ring_ctx *ctx, unsigned long uaddr, - static void io_rings_free(struct io_ring_ctx *ctx) - { - if (!(ctx->flags & IORING_SETUP_NO_MMAP)) { -- io_mem_free(ctx->rings); -- io_mem_free(ctx->sq_sqes); -+ io_pages_unmap(ctx->rings, &ctx->ring_pages, &ctx->n_ring_pages, -+ true); -+ io_pages_unmap(ctx->sq_sqes, &ctx->sqe_pages, &ctx->n_sqe_pages, -+ true); - } else { - io_pages_free(&ctx->ring_pages, ctx->n_ring_pages); - ctx->n_ring_pages = 0; - io_pages_free(&ctx->sqe_pages, ctx->n_sqe_pages); - ctx->n_sqe_pages = 0; -+ vunmap(ctx->rings); -+ vunmap(ctx->sq_sqes); - } - - ctx->rings = NULL; - ctx->sq_sqes = NULL; - } - --void *io_mem_alloc(size_t size) -+static void *io_mem_alloc_compound(struct page **pages, int nr_pages, -+ size_t size, gfp_t gfp) -+{ -+ struct page *page; -+ int i, order; -+ -+ order = get_order(size); -+ if (order > 10) -+ return ERR_PTR(-ENOMEM); -+ else if (order) -+ gfp |= __GFP_COMP; -+ -+ page = alloc_pages(gfp, order); -+ if (!page) -+ return ERR_PTR(-ENOMEM); -+ -+ for (i = 0; i < nr_pages; i++) -+ pages[i] = page + i; -+ -+ return page_address(page); -+} -+ -+static void *io_mem_alloc_single(struct page **pages, int nr_pages, size_t size, -+ gfp_t gfp) - { -- gfp_t gfp = GFP_KERNEL_ACCOUNT | __GFP_ZERO | __GFP_NOWARN | __GFP_COMP; - void *ret; -+ int i; -+ -+ for (i = 0; i < nr_pages; i++) { -+ pages[i] = alloc_page(gfp); -+ if (!pages[i]) -+ goto err; -+ } - -- ret = (void *) __get_free_pages(gfp, get_order(size)); -+ ret = vmap(pages, nr_pages, VM_MAP, PAGE_KERNEL); - if (ret) - return ret; -+err: -+ while (i--) -+ put_page(pages[i]); - return ERR_PTR(-ENOMEM); - } - -+void *io_pages_map(struct page ***out_pages, unsigned short *npages, -+ size_t size) -+{ -+ gfp_t gfp = GFP_KERNEL_ACCOUNT | __GFP_ZERO | __GFP_NOWARN; -+ struct page **pages; -+ int nr_pages; -+ void *ret; -+ -+ nr_pages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT; -+ pages = kvmalloc_array(nr_pages, sizeof(struct page *), gfp); -+ if (!pages) -+ return ERR_PTR(-ENOMEM); -+ -+ ret = io_mem_alloc_compound(pages, nr_pages, size, gfp); -+ if (!IS_ERR(ret)) -+ goto done; -+ if (nr_pages == 1) -+ goto fail; -+ -+ ret = io_mem_alloc_single(pages, nr_pages, size, gfp); -+ if (!IS_ERR(ret)) { -+done: -+ *out_pages = pages; -+ *npages = nr_pages; -+ return ret; -+ } -+fail: -+ kvfree(pages); -+ *out_pages = NULL; -+ *npages = 0; -+ return ret; -+} -+ - static unsigned long rings_size(struct io_ring_ctx *ctx, unsigned int sq_entries, - unsigned int cq_entries, size_t *sq_offset) - { -@@ -2964,7 +3056,6 @@ static __cold void io_ring_ctx_free(struct io_ring_ctx *ctx) - ctx->mm_account = NULL; - } - io_rings_free(ctx); -- io_kbuf_mmap_list_free(ctx); - - percpu_ref_exit(&ctx->refs); - free_uid(ctx->user); -@@ -3454,26 +3545,23 @@ static void *io_uring_validate_mmap_request(struct file *file, - { - struct io_ring_ctx *ctx = file->private_data; - loff_t offset = pgoff << PAGE_SHIFT; -- struct page *page; -- void *ptr; - -- switch (offset & IORING_OFF_MMAP_MASK) { -+ switch ((pgoff << PAGE_SHIFT) & IORING_OFF_MMAP_MASK) { - case IORING_OFF_SQ_RING: - case IORING_OFF_CQ_RING: - /* Don't allow mmap if the ring was setup without it */ - if (ctx->flags & IORING_SETUP_NO_MMAP) - return ERR_PTR(-EINVAL); -- ptr = ctx->rings; -- break; -+ return ctx->rings; - case IORING_OFF_SQES: - /* Don't allow mmap if the ring was setup without it */ - if (ctx->flags & IORING_SETUP_NO_MMAP) - return ERR_PTR(-EINVAL); -- ptr = ctx->sq_sqes; -- break; -+ return ctx->sq_sqes; - case IORING_OFF_PBUF_RING: { - struct io_buffer_list *bl; - unsigned int bgid; -+ void *ptr; - - bgid = (offset & ~IORING_OFF_MMAP_MASK) >> IORING_OFF_PBUF_SHIFT; - bl = io_pbuf_get_bl(ctx, bgid); -@@ -3481,33 +3569,49 @@ static void *io_uring_validate_mmap_request(struct file *file, - return bl; - ptr = bl->buf_ring; - io_put_bl(ctx, bl); -- break; -+ return ptr; - } -- default: -- return ERR_PTR(-EINVAL); - } - -- page = virt_to_head_page(ptr); -- if (sz > page_size(page)) -- return ERR_PTR(-EINVAL); -+ return ERR_PTR(-EINVAL); -+} -+ -+int io_uring_mmap_pages(struct io_ring_ctx *ctx, struct vm_area_struct *vma, -+ struct page **pages, int npages) -+{ -+ unsigned long nr_pages = npages; - -- return ptr; -+ vm_flags_set(vma, VM_DONTEXPAND); -+ return vm_insert_pages(vma, vma->vm_start, pages, &nr_pages); - } - - #ifdef CONFIG_MMU - - static __cold int io_uring_mmap(struct file *file, struct vm_area_struct *vma) - { -+ struct io_ring_ctx *ctx = file->private_data; - size_t sz = vma->vm_end - vma->vm_start; -- unsigned long pfn; -+ long offset = vma->vm_pgoff << PAGE_SHIFT; -+ unsigned int npages; - void *ptr; - - ptr = io_uring_validate_mmap_request(file, vma->vm_pgoff, sz); - if (IS_ERR(ptr)) - return PTR_ERR(ptr); - -- pfn = virt_to_phys(ptr) >> PAGE_SHIFT; -- return remap_pfn_range(vma, vma->vm_start, pfn, sz, vma->vm_page_prot); -+ switch (offset & IORING_OFF_MMAP_MASK) { -+ case IORING_OFF_SQ_RING: -+ case IORING_OFF_CQ_RING: -+ npages = min(ctx->n_ring_pages, (sz + PAGE_SIZE - 1) >> PAGE_SHIFT); -+ return io_uring_mmap_pages(ctx, vma, ctx->ring_pages, npages); -+ case IORING_OFF_SQES: -+ return io_uring_mmap_pages(ctx, vma, ctx->sqe_pages, -+ ctx->n_sqe_pages); -+ case IORING_OFF_PBUF_RING: -+ return io_pbuf_mmap(file, vma); -+ } -+ -+ return -EINVAL; - } - - static unsigned long io_uring_mmu_get_unmapped_area(struct file *filp, -@@ -3795,7 +3899,7 @@ static __cold int io_allocate_scq_urings(struct io_ring_ctx *ctx, - return -EOVERFLOW; - - if (!(ctx->flags & IORING_SETUP_NO_MMAP)) -- rings = io_mem_alloc(size); -+ rings = io_pages_map(&ctx->ring_pages, &ctx->n_ring_pages, size); - else - rings = io_rings_map(ctx, p->cq_off.user_addr, size); - -@@ -3820,7 +3924,7 @@ static __cold int io_allocate_scq_urings(struct io_ring_ctx *ctx, - } - - if (!(ctx->flags & IORING_SETUP_NO_MMAP)) -- ptr = io_mem_alloc(size); -+ ptr = io_pages_map(&ctx->sqe_pages, &ctx->n_sqe_pages, size); - else - ptr = io_sqes_map(ctx, p->sq_off.user_addr, size); - -diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h -index 57658d24a73e96..0ffec66deee7f1 100644 ---- a/io_uring/io_uring.h -+++ b/io_uring/io_uring.h -@@ -55,6 +55,8 @@ bool io_fill_cqe_req_aux(struct io_kiocb *req, bool defer, s32 res, u32 cflags); - void __io_commit_cqring_flush(struct io_ring_ctx *ctx); - - struct page **io_pin_pages(unsigned long ubuf, unsigned long len, int *npages); -+int io_uring_mmap_pages(struct io_ring_ctx *ctx, struct vm_area_struct *vma, -+ struct page **pages, int npages); - - struct file *io_file_get_normal(struct io_kiocb *req, int fd); - struct file *io_file_get_fixed(struct io_kiocb *req, int fd, -@@ -91,8 +93,10 @@ bool __io_alloc_req_refill(struct io_ring_ctx *ctx); - bool io_match_task_safe(struct io_kiocb *head, struct task_struct *task, - bool cancel_all); - --void *io_mem_alloc(size_t size); --void io_mem_free(void *ptr); -+void *io_pages_map(struct page ***out_pages, unsigned short *npages, -+ size_t size); -+void io_pages_unmap(void *ptr, struct page ***pages, unsigned short *npages, -+ bool put_pages); - - #if defined(CONFIG_PROVE_LOCKING) - static inline void io_lockdep_assert_cq_locked(struct io_ring_ctx *ctx) -diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c -index b6fbae874f27f7..0d9b8a8b42c278 100644 ---- a/io_uring/kbuf.c -+++ b/io_uring/kbuf.c -@@ -7,6 +7,7 @@ - #include - #include - #include -+#include - #include - - #include -@@ -29,25 +30,12 @@ struct io_provide_buf { - __u16 bid; - }; - --static inline struct io_buffer_list *__io_buffer_get_list(struct io_ring_ctx *ctx, -- unsigned int bgid) --{ -- return xa_load(&ctx->io_bl_xa, bgid); --} -- --struct io_buf_free { -- struct hlist_node list; -- void *mem; -- size_t size; -- int inuse; --}; -- - static inline struct io_buffer_list *io_buffer_get_list(struct io_ring_ctx *ctx, - unsigned int bgid) - { - lockdep_assert_held(&ctx->uring_lock); - -- return __io_buffer_get_list(ctx, bgid); -+ return xa_load(&ctx->io_bl_xa, bgid); - } - - static int io_buffer_add_list(struct io_ring_ctx *ctx, -@@ -153,15 +141,7 @@ static void __user *io_ring_buffer_select(struct io_kiocb *req, size_t *len, - return NULL; - - head &= bl->mask; -- /* mmaped buffers are always contig */ -- if (bl->is_mmap || head < IO_BUFFER_LIST_BUF_PER_PAGE) { -- buf = &br->bufs[head]; -- } else { -- int off = head & (IO_BUFFER_LIST_BUF_PER_PAGE - 1); -- int index = head / IO_BUFFER_LIST_BUF_PER_PAGE; -- buf = page_address(bl->buf_pages[index]); -- buf += off; -- } -+ buf = &br->bufs[head]; - if (*len == 0 || *len > buf->len) - *len = buf->len; - req->flags |= REQ_F_BUFFER_RING; -@@ -206,24 +186,6 @@ void __user *io_buffer_select(struct io_kiocb *req, size_t *len, - return ret; - } - --/* -- * Mark the given mapped range as free for reuse -- */ --static void io_kbuf_mark_free(struct io_ring_ctx *ctx, struct io_buffer_list *bl) --{ -- struct io_buf_free *ibf; -- -- hlist_for_each_entry(ibf, &ctx->io_buf_list, list) { -- if (bl->buf_ring == ibf->mem) { -- ibf->inuse = 0; -- return; -- } -- } -- -- /* can't happen... */ -- WARN_ON_ONCE(1); --} -- - static int __io_remove_buffers(struct io_ring_ctx *ctx, - struct io_buffer_list *bl, unsigned nbufs) - { -@@ -235,22 +197,16 @@ static int __io_remove_buffers(struct io_ring_ctx *ctx, - - if (bl->is_mapped) { - i = bl->buf_ring->tail - bl->head; -- if (bl->is_mmap) { -- /* -- * io_kbuf_list_free() will free the page(s) at -- * ->release() time. -- */ -- io_kbuf_mark_free(ctx, bl); -- bl->buf_ring = NULL; -- bl->is_mmap = 0; -- } else if (bl->buf_nr_pages) { -+ if (bl->buf_nr_pages) { - int j; - -- for (j = 0; j < bl->buf_nr_pages; j++) -- unpin_user_page(bl->buf_pages[j]); -- kvfree(bl->buf_pages); -- bl->buf_pages = NULL; -- bl->buf_nr_pages = 0; -+ if (!bl->is_mmap) { -+ for (j = 0; j < bl->buf_nr_pages; j++) -+ unpin_user_page(bl->buf_pages[j]); -+ } -+ io_pages_unmap(bl->buf_ring, &bl->buf_pages, -+ &bl->buf_nr_pages, bl->is_mmap); -+ bl->is_mmap = 0; - } - /* make sure it's seen as empty */ - INIT_LIST_HEAD(&bl->buf_list); -@@ -501,9 +457,9 @@ int io_provide_buffers(struct io_kiocb *req, unsigned int issue_flags) - static int io_pin_pbuf_ring(struct io_uring_buf_reg *reg, - struct io_buffer_list *bl) - { -- struct io_uring_buf_ring *br; -+ struct io_uring_buf_ring *br = NULL; - struct page **pages; -- int i, nr_pages; -+ int nr_pages, ret; - - pages = io_pin_pages(reg->ring_addr, - flex_array_size(br, bufs, reg->ring_entries), -@@ -511,18 +467,12 @@ static int io_pin_pbuf_ring(struct io_uring_buf_reg *reg, - if (IS_ERR(pages)) - return PTR_ERR(pages); - -- /* -- * Apparently some 32-bit boxes (ARM) will return highmem pages, -- * which then need to be mapped. We could support that, but it'd -- * complicate the code and slowdown the common cases quite a bit. -- * So just error out, returning -EINVAL just like we did on kernels -- * that didn't support mapped buffer rings. -- */ -- for (i = 0; i < nr_pages; i++) -- if (PageHighMem(pages[i])) -- goto error_unpin; -+ br = vmap(pages, nr_pages, VM_MAP, PAGE_KERNEL); -+ if (!br) { -+ ret = -ENOMEM; -+ goto error_unpin; -+ } - -- br = page_address(pages[0]); - #ifdef SHM_COLOUR - /* - * On platforms that have specific aliasing requirements, SHM_COLOUR -@@ -533,8 +483,10 @@ static int io_pin_pbuf_ring(struct io_uring_buf_reg *reg, - * should use IOU_PBUF_RING_MMAP instead, and liburing will handle - * this transparently. - */ -- if ((reg->ring_addr | (unsigned long) br) & (SHM_COLOUR - 1)) -+ if ((reg->ring_addr | (unsigned long) br) & (SHM_COLOUR - 1)) { -+ ret = -EINVAL; - goto error_unpin; -+ } - #endif - bl->buf_pages = pages; - bl->buf_nr_pages = nr_pages; -@@ -543,69 +495,25 @@ static int io_pin_pbuf_ring(struct io_uring_buf_reg *reg, - bl->is_mmap = 0; - return 0; - error_unpin: -- for (i = 0; i < nr_pages; i++) -- unpin_user_page(pages[i]); -+ unpin_user_pages(pages, nr_pages); - kvfree(pages); -- return -EINVAL; --} -- --/* -- * See if we have a suitable region that we can reuse, rather than allocate -- * both a new io_buf_free and mem region again. We leave it on the list as -- * even a reused entry will need freeing at ring release. -- */ --static struct io_buf_free *io_lookup_buf_free_entry(struct io_ring_ctx *ctx, -- size_t ring_size) --{ -- struct io_buf_free *ibf, *best = NULL; -- size_t best_dist; -- -- hlist_for_each_entry(ibf, &ctx->io_buf_list, list) { -- size_t dist; -- -- if (ibf->inuse || ibf->size < ring_size) -- continue; -- dist = ibf->size - ring_size; -- if (!best || dist < best_dist) { -- best = ibf; -- if (!dist) -- break; -- best_dist = dist; -- } -- } -- -- return best; -+ vunmap(br); -+ return ret; - } - - static int io_alloc_pbuf_ring(struct io_ring_ctx *ctx, - struct io_uring_buf_reg *reg, - struct io_buffer_list *bl) - { -- struct io_buf_free *ibf; - size_t ring_size; -- void *ptr; - - ring_size = reg->ring_entries * sizeof(struct io_uring_buf_ring); - -- /* Reuse existing entry, if we can */ -- ibf = io_lookup_buf_free_entry(ctx, ring_size); -- if (!ibf) { -- ptr = io_mem_alloc(ring_size); -- if (IS_ERR(ptr)) -- return PTR_ERR(ptr); -- -- /* Allocate and store deferred free entry */ -- ibf = kmalloc(sizeof(*ibf), GFP_KERNEL_ACCOUNT); -- if (!ibf) { -- io_mem_free(ptr); -- return -ENOMEM; -- } -- ibf->mem = ptr; -- ibf->size = ring_size; -- hlist_add_head(&ibf->list, &ctx->io_buf_list); -+ bl->buf_ring = io_pages_map(&bl->buf_pages, &bl->buf_nr_pages, ring_size); -+ if (IS_ERR(bl->buf_ring)) { -+ bl->buf_ring = NULL; -+ return -ENOMEM; - } -- ibf->inuse = 1; -- bl->buf_ring = ibf->mem; - bl->is_mapped = 1; - bl->is_mmap = 1; - return 0; -@@ -728,18 +636,19 @@ struct io_buffer_list *io_pbuf_get_bl(struct io_ring_ctx *ctx, - return ERR_PTR(-EINVAL); - } - --/* -- * Called at or after ->release(), free the mmap'ed buffers that we used -- * for memory mapped provided buffer rings. -- */ --void io_kbuf_mmap_list_free(struct io_ring_ctx *ctx) -+int io_pbuf_mmap(struct file *file, struct vm_area_struct *vma) - { -- struct io_buf_free *ibf; -- struct hlist_node *tmp; -+ struct io_ring_ctx *ctx = file->private_data; -+ loff_t pgoff = vma->vm_pgoff << PAGE_SHIFT; -+ struct io_buffer_list *bl; -+ int bgid, ret; - -- hlist_for_each_entry_safe(ibf, tmp, &ctx->io_buf_list, list) { -- hlist_del(&ibf->list); -- io_mem_free(ibf->mem); -- kfree(ibf); -- } -+ bgid = (pgoff & ~IORING_OFF_MMAP_MASK) >> IORING_OFF_PBUF_SHIFT; -+ bl = io_pbuf_get_bl(ctx, bgid); -+ if (IS_ERR(bl)) -+ return PTR_ERR(bl); -+ -+ ret = io_uring_mmap_pages(ctx, vma, bl->buf_pages, bl->buf_nr_pages); -+ io_put_bl(ctx, bl); -+ return ret; - } -diff --git a/io_uring/kbuf.h b/io_uring/kbuf.h -index 8d7929369501d2..292af16f35c1b2 100644 ---- a/io_uring/kbuf.h -+++ b/io_uring/kbuf.h -@@ -54,8 +54,6 @@ int io_provide_buffers(struct io_kiocb *req, unsigned int issue_flags); - int io_register_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg); - int io_unregister_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg); - --void io_kbuf_mmap_list_free(struct io_ring_ctx *ctx); -- - unsigned int __io_put_kbuf(struct io_kiocb *req, unsigned issue_flags); - - void io_kbuf_recycle_legacy(struct io_kiocb *req, unsigned issue_flags); -@@ -63,6 +61,7 @@ void io_kbuf_recycle_legacy(struct io_kiocb *req, unsigned issue_flags); - void io_put_bl(struct io_ring_ctx *ctx, struct io_buffer_list *bl); - struct io_buffer_list *io_pbuf_get_bl(struct io_ring_ctx *ctx, - unsigned long bgid); -+int io_pbuf_mmap(struct file *file, struct vm_area_struct *vma); - - static inline void io_kbuf_recycle_ring(struct io_kiocb *req) - { -diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c -index 0f9dcde72ebffa..f0353e8707d5a2 100644 ---- a/io_uring/rsrc.c -+++ b/io_uring/rsrc.c -@@ -873,45 +873,6 @@ static int io_buffer_account_pin(struct io_ring_ctx *ctx, struct page **pages, - return ret; - } - --struct page **io_pin_pages(unsigned long ubuf, unsigned long len, int *npages) --{ -- unsigned long start, end, nr_pages; -- struct page **pages = NULL; -- int pret, ret = -ENOMEM; -- -- end = (ubuf + len + PAGE_SIZE - 1) >> PAGE_SHIFT; -- start = ubuf >> PAGE_SHIFT; -- nr_pages = end - start; -- -- pages = kvmalloc_array(nr_pages, sizeof(struct page *), GFP_KERNEL); -- if (!pages) -- goto done; -- -- ret = 0; -- mmap_read_lock(current->mm); -- pret = pin_user_pages(ubuf, nr_pages, FOLL_WRITE | FOLL_LONGTERM, -- pages); -- if (pret == nr_pages) -- *npages = nr_pages; -- else -- ret = pret < 0 ? pret : -EFAULT; -- -- mmap_read_unlock(current->mm); -- if (ret) { -- /* if we did partial map, release any pages we did get */ -- if (pret > 0) -- unpin_user_pages(pages, pret); -- goto done; -- } -- ret = 0; --done: -- if (ret < 0) { -- kvfree(pages); -- pages = ERR_PTR(ret); -- } -- return pages; --} -- - static int io_sqe_buffer_register(struct io_ring_ctx *ctx, struct iovec *iov, - struct io_mapped_ubuf **pimu, - struct page **last_hpage) -diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c -index 528f4d6342262e..6aff5ee483b60e 100644 ---- a/kernel/bpf/ringbuf.c -+++ b/kernel/bpf/ringbuf.c -@@ -29,7 +29,7 @@ struct bpf_ringbuf { - u64 mask; - struct page **pages; - int nr_pages; -- spinlock_t spinlock ____cacheline_aligned_in_smp; -+ raw_spinlock_t spinlock ____cacheline_aligned_in_smp; - /* For user-space producer ring buffers, an atomic_t busy bit is used - * to synchronize access to the ring buffers in the kernel, rather than - * the spinlock that is used for kernel-producer ring buffers. This is -@@ -173,7 +173,7 @@ static struct bpf_ringbuf *bpf_ringbuf_alloc(size_t data_sz, int numa_node) - if (!rb) - return NULL; - -- spin_lock_init(&rb->spinlock); -+ raw_spin_lock_init(&rb->spinlock); - atomic_set(&rb->busy, 0); - init_waitqueue_head(&rb->waitq); - init_irq_work(&rb->work, bpf_ringbuf_notify); -@@ -417,10 +417,10 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) - cons_pos = smp_load_acquire(&rb->consumer_pos); - - if (in_nmi()) { -- if (!spin_trylock_irqsave(&rb->spinlock, flags)) -+ if (!raw_spin_trylock_irqsave(&rb->spinlock, flags)) - return NULL; - } else { -- spin_lock_irqsave(&rb->spinlock, flags); -+ raw_spin_lock_irqsave(&rb->spinlock, flags); - } - - pend_pos = rb->pending_pos; -@@ -446,7 +446,7 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) - */ - if (new_prod_pos - cons_pos > rb->mask || - new_prod_pos - pend_pos > rb->mask) { -- spin_unlock_irqrestore(&rb->spinlock, flags); -+ raw_spin_unlock_irqrestore(&rb->spinlock, flags); - return NULL; - } - -@@ -458,7 +458,7 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) - /* pairs with consumer's smp_load_acquire() */ - smp_store_release(&rb->producer_pos, new_prod_pos); - -- spin_unlock_irqrestore(&rb->spinlock, flags); -+ raw_spin_unlock_irqrestore(&rb->spinlock, flags); - - return (void *)hdr + BPF_RINGBUF_HDR_SZ; - } -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 784a4f8409453d..942734bf7347d0 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -1019,9 +1019,10 @@ void wake_up_q(struct wake_q_head *head) - struct task_struct *task; - - task = container_of(node, struct task_struct, wake_q); -- /* Task can safely be re-inserted now: */ - node = node->next; -- task->wake_q.next = NULL; -+ /* pairs with cmpxchg_relaxed() in __wake_q_add() */ -+ WRITE_ONCE(task->wake_q.next, NULL); -+ /* Task can safely be re-inserted now. */ - - /* - * wake_up_process() executes a full barrier, which pairs with -@@ -7530,6 +7531,14 @@ static void __setscheduler_params(struct task_struct *p, - else if (fair_policy(policy)) - p->static_prio = NICE_TO_PRIO(attr->sched_nice); - -+ /* rt-policy tasks do not have a timerslack */ -+ if (task_is_realtime(p)) { -+ p->timer_slack_ns = 0; -+ } else if (p->timer_slack_ns == 0) { -+ /* when switching back to non-rt policy, restore timerslack */ -+ p->timer_slack_ns = p->default_timer_slack_ns; -+ } -+ - /* - * __sched_setscheduler() ensures attr->sched_priority == 0 when - * !rt_policy. Always setting this ensures that things like -diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c -index 4c3d0d9f3db632..115e266db76bfa 100644 ---- a/kernel/sched/debug.c -+++ b/kernel/sched/debug.c -@@ -1089,6 +1089,8 @@ void proc_sched_show_task(struct task_struct *p, struct pid_namespace *ns, - if (task_has_dl_policy(p)) { - P(dl.runtime); - P(dl.deadline); -+ } else if (fair_policy(p->policy)) { -+ P(se.slice); - } - #undef PN_SCHEDSTAT - #undef P_SCHEDSTAT -diff --git a/kernel/sys.c b/kernel/sys.c -index 44b5759903332b..355de0b65c2358 100644 ---- a/kernel/sys.c -+++ b/kernel/sys.c -@@ -2535,6 +2535,8 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, - error = current->timer_slack_ns; - break; - case PR_SET_TIMERSLACK: -+ if (task_is_realtime(current)) -+ break; - if (arg2 <= 0) - current->timer_slack_ns = - current->default_timer_slack_ns; -diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c -index e99b1305e1a5f4..877535b06e73aa 100644 ---- a/kernel/time/hrtimer.c -+++ b/kernel/time/hrtimer.c -@@ -145,11 +145,6 @@ static struct hrtimer_cpu_base migration_cpu_base = { - - #define migration_base migration_cpu_base.clock_base[0] - --static inline bool is_migration_base(struct hrtimer_clock_base *base) --{ -- return base == &migration_base; --} -- - /* - * We are using hashed locking: holding per_cpu(hrtimer_bases)[n].lock - * means that all timers which are tied to this base via timer->base are -@@ -275,11 +270,6 @@ switch_hrtimer_base(struct hrtimer *timer, struct hrtimer_clock_base *base, - - #else /* CONFIG_SMP */ - --static inline bool is_migration_base(struct hrtimer_clock_base *base) --{ -- return false; --} -- - static inline struct hrtimer_clock_base * - lock_hrtimer_base(const struct hrtimer *timer, unsigned long *flags) - __acquires(&timer->base->cpu_base->lock) -@@ -1381,6 +1371,18 @@ static void hrtimer_sync_wait_running(struct hrtimer_cpu_base *cpu_base, - } - } - -+#ifdef CONFIG_SMP -+static __always_inline bool is_migration_base(struct hrtimer_clock_base *base) -+{ -+ return base == &migration_base; -+} -+#else -+static __always_inline bool is_migration_base(struct hrtimer_clock_base *base) -+{ -+ return false; -+} -+#endif -+ - /* - * This function is called on PREEMPT_RT kernels when the fast path - * deletion of a timer failed because the timer callback function was -@@ -2093,14 +2095,9 @@ long hrtimer_nanosleep(ktime_t rqtp, const enum hrtimer_mode mode, - struct restart_block *restart; - struct hrtimer_sleeper t; - int ret = 0; -- u64 slack; -- -- slack = current->timer_slack_ns; -- if (rt_task(current)) -- slack = 0; - - hrtimer_init_sleeper_on_stack(&t, clockid, mode); -- hrtimer_set_expires_range_ns(&t.timer, rqtp, slack); -+ hrtimer_set_expires_range_ns(&t.timer, rqtp, current->timer_slack_ns); - ret = do_nanosleep(&t, mode); - if (ret != -ERESTART_RESTARTBLOCK) - goto out; -@@ -2281,7 +2278,7 @@ void __init hrtimers_init(void) - /** - * schedule_hrtimeout_range_clock - sleep until timeout - * @expires: timeout value (ktime_t) -- * @delta: slack in expires timeout (ktime_t) for SCHED_OTHER tasks -+ * @delta: slack in expires timeout (ktime_t) - * @mode: timer mode - * @clock_id: timer clock to be used - */ -@@ -2308,13 +2305,6 @@ schedule_hrtimeout_range_clock(ktime_t *expires, u64 delta, - return -EINTR; - } - -- /* -- * Override any slack passed by the user if under -- * rt contraints. -- */ -- if (rt_task(current)) -- delta = 0; -- - hrtimer_init_sleeper_on_stack(&t, clock_id, mode); - hrtimer_set_expires_range_ns(&t.timer, *expires, delta); - hrtimer_sleeper_start_expires(&t, mode); -@@ -2334,7 +2324,7 @@ EXPORT_SYMBOL_GPL(schedule_hrtimeout_range_clock); - /** - * schedule_hrtimeout_range - sleep until timeout - * @expires: timeout value (ktime_t) -- * @delta: slack in expires timeout (ktime_t) for SCHED_OTHER tasks -+ * @delta: slack in expires timeout (ktime_t) - * @mode: timer mode - * - * Make the current task sleep until the given expiry time has -diff --git a/lib/buildid.c b/lib/buildid.c -index 9fc46366597e78..8d839ff5548ea2 100644 ---- a/lib/buildid.c -+++ b/lib/buildid.c -@@ -5,6 +5,7 @@ - #include - #include - #include -+#include - - #define BUILD_ID 3 - -@@ -157,6 +158,10 @@ int build_id_parse(struct vm_area_struct *vma, unsigned char *build_id, - if (!vma->vm_file) - return -EINVAL; - -+ /* reject secretmem folios created with memfd_secret() */ -+ if (vma_is_secretmem(vma)) -+ return -EFAULT; -+ - page = find_get_page(vma->vm_file->f_mapping, 0); - if (!page) - return -EFAULT; /* page not mapped */ -diff --git a/mm/mmap.c b/mm/mmap.c -index e4dfeaef668a8e..03a24cb3951d47 100644 ---- a/mm/mmap.c -+++ b/mm/mmap.c -@@ -2981,6 +2981,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, - unsigned long populate = 0; - unsigned long ret = -EINVAL; - struct file *file; -+ vm_flags_t vm_flags; - - pr_warn_once("%s (%d) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst.\n", - current->comm, current->pid); -@@ -2997,12 +2998,60 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, - if (pgoff + (size >> PAGE_SHIFT) < pgoff) - return ret; - -- if (mmap_write_lock_killable(mm)) -+ if (mmap_read_lock_killable(mm)) -+ return -EINTR; -+ -+ /* -+ * Look up VMA under read lock first so we can perform the security -+ * without holding locks (which can be problematic). We reacquire a -+ * write lock later and check nothing changed underneath us. -+ */ -+ vma = vma_lookup(mm, start); -+ -+ if (!vma || !(vma->vm_flags & VM_SHARED)) { -+ mmap_read_unlock(mm); -+ return -EINVAL; -+ } -+ -+ prot |= vma->vm_flags & VM_READ ? PROT_READ : 0; -+ prot |= vma->vm_flags & VM_WRITE ? PROT_WRITE : 0; -+ prot |= vma->vm_flags & VM_EXEC ? PROT_EXEC : 0; -+ -+ flags &= MAP_NONBLOCK; -+ flags |= MAP_SHARED | MAP_FIXED | MAP_POPULATE; -+ if (vma->vm_flags & VM_LOCKED) -+ flags |= MAP_LOCKED; -+ -+ /* Save vm_flags used to calculate prot and flags, and recheck later. */ -+ vm_flags = vma->vm_flags; -+ file = get_file(vma->vm_file); -+ -+ mmap_read_unlock(mm); -+ -+ /* Call outside mmap_lock to be consistent with other callers. */ -+ ret = security_mmap_file(file, prot, flags); -+ if (ret) { -+ fput(file); -+ return ret; -+ } -+ -+ ret = -EINVAL; -+ -+ /* OK security check passed, take write lock + let it rip. */ -+ if (mmap_write_lock_killable(mm)) { -+ fput(file); - return -EINTR; -+ } - - vma = vma_lookup(mm, start); - -- if (!vma || !(vma->vm_flags & VM_SHARED)) -+ if (!vma) -+ goto out; -+ -+ /* Make sure things didn't change under us. */ -+ if (vma->vm_flags != vm_flags) -+ goto out; -+ if (vma->vm_file != file) - goto out; - - if (start + size > vma->vm_end) { -@@ -3030,25 +3079,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, - goto out; - } - -- prot |= vma->vm_flags & VM_READ ? PROT_READ : 0; -- prot |= vma->vm_flags & VM_WRITE ? PROT_WRITE : 0; -- prot |= vma->vm_flags & VM_EXEC ? PROT_EXEC : 0; -- -- flags &= MAP_NONBLOCK; -- flags |= MAP_SHARED | MAP_FIXED | MAP_POPULATE; -- if (vma->vm_flags & VM_LOCKED) -- flags |= MAP_LOCKED; -- -- file = get_file(vma->vm_file); -- ret = security_mmap_file(vma->vm_file, prot, flags); -- if (ret) -- goto out_fput; - ret = do_mmap(vma->vm_file, start, size, - prot, flags, 0, pgoff, &populate, NULL); --out_fput: -- fput(file); - out: - mmap_write_unlock(mm); -+ fput(file); - if (populate) - mm_populate(ret, populate); - if (!IS_ERR_VALUE(ret)) -diff --git a/mm/nommu.c b/mm/nommu.c -index f848d98e8997d2..3228b2d3e4ab6c 100644 ---- a/mm/nommu.c -+++ b/mm/nommu.c -@@ -357,6 +357,13 @@ int vm_insert_page(struct vm_area_struct *vma, unsigned long addr, - } - EXPORT_SYMBOL(vm_insert_page); - -+int vm_insert_pages(struct vm_area_struct *vma, unsigned long addr, -+ struct page **pages, unsigned long *num) -+{ -+ return -EINVAL; -+} -+EXPORT_SYMBOL(vm_insert_pages); -+ - int vm_map_pages(struct vm_area_struct *vma, struct page **pages, - unsigned long num) - { -diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c -index f29fd326440115..30519d47e8a695 100644 ---- a/net/bluetooth/hci_core.c -+++ b/net/bluetooth/hci_core.c -@@ -58,6 +58,7 @@ DEFINE_RWLOCK(hci_dev_list_lock); - - /* HCI callback list */ - LIST_HEAD(hci_cb_list); -+DEFINE_MUTEX(hci_cb_list_lock); - - /* HCI ID Numbering */ - static DEFINE_IDA(hci_index_ida); -@@ -2956,7 +2957,9 @@ int hci_register_cb(struct hci_cb *cb) - { - BT_DBG("%p name %s", cb, cb->name); - -- list_add_tail_rcu(&cb->list, &hci_cb_list); -+ mutex_lock(&hci_cb_list_lock); -+ list_add_tail(&cb->list, &hci_cb_list); -+ mutex_unlock(&hci_cb_list_lock); - - return 0; - } -@@ -2966,8 +2969,9 @@ int hci_unregister_cb(struct hci_cb *cb) - { - BT_DBG("%p name %s", cb, cb->name); - -- list_del_rcu(&cb->list); -- synchronize_rcu(); -+ mutex_lock(&hci_cb_list_lock); -+ list_del(&cb->list); -+ mutex_unlock(&hci_cb_list_lock); - - return 0; - } -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index 01e51e1dc9b333..1e689d8c00a509 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -3394,23 +3394,30 @@ static void hci_disconn_complete_evt(struct hci_dev *hdev, void *data, - hci_update_scan(hdev); - } - -- params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type); -- if (params) { -- switch (params->auto_connect) { -- case HCI_AUTO_CONN_LINK_LOSS: -- if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT) -+ /* Re-enable passive scanning if disconnected device is marked -+ * as auto-connectable. -+ */ -+ if (conn->type == LE_LINK) { -+ params = hci_conn_params_lookup(hdev, &conn->dst, -+ conn->dst_type); -+ if (params) { -+ switch (params->auto_connect) { -+ case HCI_AUTO_CONN_LINK_LOSS: -+ if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT) -+ break; -+ fallthrough; -+ -+ case HCI_AUTO_CONN_DIRECT: -+ case HCI_AUTO_CONN_ALWAYS: -+ hci_pend_le_list_del_init(params); -+ hci_pend_le_list_add(params, -+ &hdev->pend_le_conns); -+ hci_update_passive_scan(hdev); - break; -- fallthrough; - -- case HCI_AUTO_CONN_DIRECT: -- case HCI_AUTO_CONN_ALWAYS: -- hci_pend_le_list_del_init(params); -- hci_pend_le_list_add(params, &hdev->pend_le_conns); -- hci_update_passive_scan(hdev); -- break; -- -- default: -- break; -+ default: -+ break; -+ } - } - } - -diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c -index f165cafa3aa98b..b94d202bf3745c 100644 ---- a/net/bluetooth/iso.c -+++ b/net/bluetooth/iso.c -@@ -1929,11 +1929,6 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags) - return lm; - } - --static bool iso_match(struct hci_conn *hcon) --{ -- return hcon->type == ISO_LINK || hcon->type == LE_LINK; --} -- - static void iso_connect_cfm(struct hci_conn *hcon, __u8 status) - { - if (hcon->type != ISO_LINK) { -@@ -2115,7 +2110,6 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) - - static struct hci_cb iso_cb = { - .name = "ISO", -- .match = iso_match, - .connect_cfm = iso_connect_cfm, - .disconn_cfm = iso_disconn_cfm, - }; -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index 304ebb31cebba6..8d6fc186950334 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -119,7 +119,6 @@ static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, - { - struct l2cap_chan *c; - -- mutex_lock(&conn->chan_lock); - c = __l2cap_get_chan_by_scid(conn, cid); - if (c) { - /* Only lock if chan reference is not 0 */ -@@ -127,7 +126,6 @@ static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, - if (c) - l2cap_chan_lock(c); - } -- mutex_unlock(&conn->chan_lock); - - return c; - } -@@ -140,7 +138,6 @@ static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn, - { - struct l2cap_chan *c; - -- mutex_lock(&conn->chan_lock); - c = __l2cap_get_chan_by_dcid(conn, cid); - if (c) { - /* Only lock if chan reference is not 0 */ -@@ -148,7 +145,6 @@ static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn, - if (c) - l2cap_chan_lock(c); - } -- mutex_unlock(&conn->chan_lock); - - return c; - } -@@ -418,7 +414,7 @@ static void l2cap_chan_timeout(struct work_struct *work) - if (!conn) - return; - -- mutex_lock(&conn->chan_lock); -+ mutex_lock(&conn->lock); - /* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling - * this work. No need to call l2cap_chan_hold(chan) here again. - */ -@@ -439,7 +435,7 @@ static void l2cap_chan_timeout(struct work_struct *work) - l2cap_chan_unlock(chan); - l2cap_chan_put(chan); - -- mutex_unlock(&conn->chan_lock); -+ mutex_unlock(&conn->lock); - } - - struct l2cap_chan *l2cap_chan_create(void) -@@ -642,9 +638,9 @@ void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan) - - void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan) - { -- mutex_lock(&conn->chan_lock); -+ mutex_lock(&conn->lock); - __l2cap_chan_add(conn, chan); -- mutex_unlock(&conn->chan_lock); -+ mutex_unlock(&conn->lock); - } - - void l2cap_chan_del(struct l2cap_chan *chan, int err) -@@ -732,9 +728,9 @@ void l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func, - if (!conn) - return; - -- mutex_lock(&conn->chan_lock); -+ mutex_lock(&conn->lock); - __l2cap_chan_list(conn, func, data); -- mutex_unlock(&conn->chan_lock); -+ mutex_unlock(&conn->lock); - } - - EXPORT_SYMBOL_GPL(l2cap_chan_list); -@@ -746,7 +742,7 @@ static void l2cap_conn_update_id_addr(struct work_struct *work) - struct hci_conn *hcon = conn->hcon; - struct l2cap_chan *chan; - -- mutex_lock(&conn->chan_lock); -+ mutex_lock(&conn->lock); - - list_for_each_entry(chan, &conn->chan_l, list) { - l2cap_chan_lock(chan); -@@ -755,7 +751,7 @@ static void l2cap_conn_update_id_addr(struct work_struct *work) - l2cap_chan_unlock(chan); - } - -- mutex_unlock(&conn->chan_lock); -+ mutex_unlock(&conn->lock); - } - - static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan) -@@ -949,6 +945,16 @@ static u8 l2cap_get_ident(struct l2cap_conn *conn) - return id; - } - -+static void l2cap_send_acl(struct l2cap_conn *conn, struct sk_buff *skb, -+ u8 flags) -+{ -+ /* Check if the hcon still valid before attempting to send */ -+ if (hci_conn_valid(conn->hcon->hdev, conn->hcon)) -+ hci_send_acl(conn->hchan, skb, flags); -+ else -+ kfree_skb(skb); -+} -+ - static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, - void *data) - { -@@ -971,7 +977,7 @@ static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, - bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON; - skb->priority = HCI_PRIO_MAX; - -- hci_send_acl(conn->hchan, skb, flags); -+ l2cap_send_acl(conn, skb, flags); - } - - static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb) -@@ -1498,8 +1504,6 @@ static void l2cap_conn_start(struct l2cap_conn *conn) - - BT_DBG("conn %p", conn); - -- mutex_lock(&conn->chan_lock); -- - list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { - l2cap_chan_lock(chan); - -@@ -1568,8 +1572,6 @@ static void l2cap_conn_start(struct l2cap_conn *conn) - - l2cap_chan_unlock(chan); - } -- -- mutex_unlock(&conn->chan_lock); - } - - static void l2cap_le_conn_ready(struct l2cap_conn *conn) -@@ -1615,7 +1617,7 @@ static void l2cap_conn_ready(struct l2cap_conn *conn) - if (hcon->type == ACL_LINK) - l2cap_request_info(conn); - -- mutex_lock(&conn->chan_lock); -+ mutex_lock(&conn->lock); - - list_for_each_entry(chan, &conn->chan_l, list) { - -@@ -1633,7 +1635,7 @@ static void l2cap_conn_ready(struct l2cap_conn *conn) - l2cap_chan_unlock(chan); - } - -- mutex_unlock(&conn->chan_lock); -+ mutex_unlock(&conn->lock); - - if (hcon->type == LE_LINK) - l2cap_le_conn_ready(conn); -@@ -1648,14 +1650,10 @@ static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err) - - BT_DBG("conn %p", conn); - -- mutex_lock(&conn->chan_lock); -- - list_for_each_entry(chan, &conn->chan_l, list) { - if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags)) - l2cap_chan_set_err(chan, err); - } -- -- mutex_unlock(&conn->chan_lock); - } - - static void l2cap_info_timeout(struct work_struct *work) -@@ -1666,7 +1664,9 @@ static void l2cap_info_timeout(struct work_struct *work) - conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; - conn->info_ident = 0; - -+ mutex_lock(&conn->lock); - l2cap_conn_start(conn); -+ mutex_unlock(&conn->lock); - } - - /* -@@ -1758,6 +1758,8 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err) - - BT_DBG("hcon %p conn %p, err %d", hcon, conn, err); - -+ mutex_lock(&conn->lock); -+ - kfree_skb(conn->rx_skb); - - skb_queue_purge(&conn->pending_rx); -@@ -1776,8 +1778,6 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err) - /* Force the connection to be immediately dropped */ - hcon->disc_timeout = 0; - -- mutex_lock(&conn->chan_lock); -- - /* Kill channels */ - list_for_each_entry_safe(chan, l, &conn->chan_l, list) { - l2cap_chan_hold(chan); -@@ -1791,15 +1791,14 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err) - l2cap_chan_put(chan); - } - -- mutex_unlock(&conn->chan_lock); -- -- hci_chan_del(conn->hchan); -- - if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) - cancel_delayed_work_sync(&conn->info_timer); - -- hcon->l2cap_data = NULL; -+ hci_chan_del(conn->hchan); - conn->hchan = NULL; -+ -+ hcon->l2cap_data = NULL; -+ mutex_unlock(&conn->lock); - l2cap_conn_put(conn); - } - -@@ -2917,8 +2916,6 @@ static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb) - - BT_DBG("conn %p", conn); - -- mutex_lock(&conn->chan_lock); -- - list_for_each_entry(chan, &conn->chan_l, list) { - if (chan->chan_type != L2CAP_CHAN_RAW) - continue; -@@ -2933,8 +2930,6 @@ static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb) - if (chan->ops->recv(chan, nskb)) - kfree_skb(nskb); - } -- -- mutex_unlock(&conn->chan_lock); - } - - /* ---- L2CAP signalling commands ---- */ -@@ -3955,7 +3950,6 @@ static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, - goto response; - } - -- mutex_lock(&conn->chan_lock); - l2cap_chan_lock(pchan); - - /* Check if the ACL is secure enough (if not SDP) */ -@@ -4062,7 +4056,6 @@ static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, - } - - l2cap_chan_unlock(pchan); -- mutex_unlock(&conn->chan_lock); - l2cap_chan_put(pchan); - } - -@@ -4101,27 +4094,19 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn, - BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", - dcid, scid, result, status); - -- mutex_lock(&conn->chan_lock); -- - if (scid) { - chan = __l2cap_get_chan_by_scid(conn, scid); -- if (!chan) { -- err = -EBADSLT; -- goto unlock; -- } -+ if (!chan) -+ return -EBADSLT; - } else { - chan = __l2cap_get_chan_by_ident(conn, cmd->ident); -- if (!chan) { -- err = -EBADSLT; -- goto unlock; -- } -+ if (!chan) -+ return -EBADSLT; - } - - chan = l2cap_chan_hold_unless_zero(chan); -- if (!chan) { -- err = -EBADSLT; -- goto unlock; -- } -+ if (!chan) -+ return -EBADSLT; - - err = 0; - -@@ -4159,9 +4144,6 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn, - l2cap_chan_unlock(chan); - l2cap_chan_put(chan); - --unlock: -- mutex_unlock(&conn->chan_lock); -- - return err; - } - -@@ -4449,11 +4431,7 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, - - chan->ops->set_shutdown(chan); - -- l2cap_chan_unlock(chan); -- mutex_lock(&conn->chan_lock); -- l2cap_chan_lock(chan); - l2cap_chan_del(chan, ECONNRESET); -- mutex_unlock(&conn->chan_lock); - - chan->ops->close(chan); - -@@ -4490,11 +4468,7 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, - return 0; - } - -- l2cap_chan_unlock(chan); -- mutex_lock(&conn->chan_lock); -- l2cap_chan_lock(chan); - l2cap_chan_del(chan, 0); -- mutex_unlock(&conn->chan_lock); - - chan->ops->close(chan); - -@@ -4692,13 +4666,9 @@ static int l2cap_le_connect_rsp(struct l2cap_conn *conn, - BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x", - dcid, mtu, mps, credits, result); - -- mutex_lock(&conn->chan_lock); -- - chan = __l2cap_get_chan_by_ident(conn, cmd->ident); -- if (!chan) { -- err = -EBADSLT; -- goto unlock; -- } -+ if (!chan) -+ return -EBADSLT; - - err = 0; - -@@ -4746,9 +4716,6 @@ static int l2cap_le_connect_rsp(struct l2cap_conn *conn, - - l2cap_chan_unlock(chan); - --unlock: -- mutex_unlock(&conn->chan_lock); -- - return err; - } - -@@ -4860,7 +4827,6 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn, - goto response; - } - -- mutex_lock(&conn->chan_lock); - l2cap_chan_lock(pchan); - - if (!smp_sufficient_security(conn->hcon, pchan->sec_level, -@@ -4926,7 +4892,6 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn, - - response_unlock: - l2cap_chan_unlock(pchan); -- mutex_unlock(&conn->chan_lock); - l2cap_chan_put(pchan); - - if (result == L2CAP_CR_PEND) -@@ -5063,7 +5028,6 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn, - goto response; - } - -- mutex_lock(&conn->chan_lock); - l2cap_chan_lock(pchan); - - if (!smp_sufficient_security(conn->hcon, pchan->sec_level, -@@ -5138,7 +5102,6 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn, - - unlock: - l2cap_chan_unlock(pchan); -- mutex_unlock(&conn->chan_lock); - l2cap_chan_put(pchan); - - response: -@@ -5175,8 +5138,6 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn, - BT_DBG("mtu %u mps %u credits %u result 0x%4.4x", mtu, mps, credits, - result); - -- mutex_lock(&conn->chan_lock); -- - cmd_len -= sizeof(*rsp); - - list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { -@@ -5262,8 +5223,6 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn, - l2cap_chan_unlock(chan); - } - -- mutex_unlock(&conn->chan_lock); -- - return err; - } - -@@ -5376,8 +5335,6 @@ static inline int l2cap_le_command_rej(struct l2cap_conn *conn, - if (cmd_len < sizeof(*rej)) - return -EPROTO; - -- mutex_lock(&conn->chan_lock); -- - chan = __l2cap_get_chan_by_ident(conn, cmd->ident); - if (!chan) - goto done; -@@ -5392,7 +5349,6 @@ static inline int l2cap_le_command_rej(struct l2cap_conn *conn, - l2cap_chan_put(chan); - - done: -- mutex_unlock(&conn->chan_lock); - return 0; - } - -@@ -6847,8 +6803,12 @@ static void process_pending_rx(struct work_struct *work) - - BT_DBG(""); - -+ mutex_lock(&conn->lock); -+ - while ((skb = skb_dequeue(&conn->pending_rx))) - l2cap_recv_frame(conn, skb); -+ -+ mutex_unlock(&conn->lock); - } - - static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon) -@@ -6887,7 +6847,7 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon) - conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR; - - mutex_init(&conn->ident_lock); -- mutex_init(&conn->chan_lock); -+ mutex_init(&conn->lock); - - INIT_LIST_HEAD(&conn->chan_l); - INIT_LIST_HEAD(&conn->users); -@@ -7080,7 +7040,7 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, - } - } - -- mutex_lock(&conn->chan_lock); -+ mutex_lock(&conn->lock); - l2cap_chan_lock(chan); - - if (cid && __l2cap_get_chan_by_dcid(conn, cid)) { -@@ -7121,7 +7081,7 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, - - chan_unlock: - l2cap_chan_unlock(chan); -- mutex_unlock(&conn->chan_lock); -+ mutex_unlock(&conn->lock); - done: - hci_dev_unlock(hdev); - hci_dev_put(hdev); -@@ -7228,11 +7188,6 @@ static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c, - return NULL; - } - --static bool l2cap_match(struct hci_conn *hcon) --{ -- return hcon->type == ACL_LINK || hcon->type == LE_LINK; --} -- - static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status) - { - struct hci_dev *hdev = hcon->hdev; -@@ -7240,6 +7195,9 @@ static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status) - struct l2cap_chan *pchan; - u8 dst_type; - -+ if (hcon->type != ACL_LINK && hcon->type != LE_LINK) -+ return; -+ - BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status); - - if (status) { -@@ -7304,6 +7262,9 @@ int l2cap_disconn_ind(struct hci_conn *hcon) - - static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason) - { -+ if (hcon->type != ACL_LINK && hcon->type != LE_LINK) -+ return; -+ - BT_DBG("hcon %p reason %d", hcon, reason); - - l2cap_conn_del(hcon, bt_to_errno(reason)); -@@ -7336,7 +7297,7 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) - - BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt); - -- mutex_lock(&conn->chan_lock); -+ mutex_lock(&conn->lock); - - list_for_each_entry(chan, &conn->chan_l, list) { - l2cap_chan_lock(chan); -@@ -7410,7 +7371,7 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) - l2cap_chan_unlock(chan); - } - -- mutex_unlock(&conn->chan_lock); -+ mutex_unlock(&conn->lock); - } - - /* Append fragment into frame respecting the maximum len of rx_skb */ -@@ -7477,19 +7438,45 @@ static void l2cap_recv_reset(struct l2cap_conn *conn) - conn->rx_len = 0; - } - -+struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c) -+{ -+ if (!c) -+ return NULL; -+ -+ BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref)); -+ -+ if (!kref_get_unless_zero(&c->ref)) -+ return NULL; -+ -+ return c; -+} -+ - void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) - { -- struct l2cap_conn *conn = hcon->l2cap_data; -+ struct l2cap_conn *conn; - int len; - -+ /* Lock hdev to access l2cap_data to avoid race with l2cap_conn_del */ -+ hci_dev_lock(hcon->hdev); -+ -+ conn = hcon->l2cap_data; -+ - if (!conn) - conn = l2cap_conn_add(hcon); - -- if (!conn) -- goto drop; -+ conn = l2cap_conn_hold_unless_zero(conn); -+ -+ hci_dev_unlock(hcon->hdev); -+ -+ if (!conn) { -+ kfree_skb(skb); -+ return; -+ } - - BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags); - -+ mutex_lock(&conn->lock); -+ - switch (flags) { - case ACL_START: - case ACL_START_NO_FLUSH: -@@ -7514,7 +7501,7 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) - if (len == skb->len) { - /* Complete frame received */ - l2cap_recv_frame(conn, skb); -- return; -+ goto unlock; - } - - BT_DBG("Start: total len %d, frag len %u", len, skb->len); -@@ -7578,11 +7565,13 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) - - drop: - kfree_skb(skb); -+unlock: -+ mutex_unlock(&conn->lock); -+ l2cap_conn_put(conn); - } - - static struct hci_cb l2cap_cb = { - .name = "L2CAP", -- .match = l2cap_match, - .connect_cfm = l2cap_connect_cfm, - .disconn_cfm = l2cap_disconn_cfm, - .security_cfm = l2cap_security_cfm, -diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c -index 3451c64fc42dce..aaaaf9733b5894 100644 ---- a/net/bluetooth/l2cap_sock.c -+++ b/net/bluetooth/l2cap_sock.c -@@ -1323,9 +1323,10 @@ static int l2cap_sock_shutdown(struct socket *sock, int how) - /* prevent sk structure from being freed whilst unlocked */ - sock_hold(sk); - -- chan = l2cap_pi(sk)->chan; - /* prevent chan structure from being freed whilst unlocked */ -- l2cap_chan_hold(chan); -+ chan = l2cap_chan_hold_unless_zero(l2cap_pi(sk)->chan); -+ if (!chan) -+ goto shutdown_already; - - BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); - -@@ -1355,22 +1356,20 @@ static int l2cap_sock_shutdown(struct socket *sock, int how) - release_sock(sk); - - l2cap_chan_lock(chan); -- conn = chan->conn; -- if (conn) -- /* prevent conn structure from being freed */ -- l2cap_conn_get(conn); -+ /* prevent conn structure from being freed */ -+ conn = l2cap_conn_hold_unless_zero(chan->conn); - l2cap_chan_unlock(chan); - - if (conn) - /* mutex lock must be taken before l2cap_chan_lock() */ -- mutex_lock(&conn->chan_lock); -+ mutex_lock(&conn->lock); - - l2cap_chan_lock(chan); - l2cap_chan_close(chan, 0); - l2cap_chan_unlock(chan); - - if (conn) { -- mutex_unlock(&conn->chan_lock); -+ mutex_unlock(&conn->lock); - l2cap_conn_put(conn); - } - -diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c -index 9d46afb24caf07..1d34d849703329 100644 ---- a/net/bluetooth/rfcomm/core.c -+++ b/net/bluetooth/rfcomm/core.c -@@ -2134,11 +2134,6 @@ static int rfcomm_run(void *unused) - return 0; - } - --static bool rfcomm_match(struct hci_conn *hcon) --{ -- return hcon->type == ACL_LINK; --} -- - static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt) - { - struct rfcomm_session *s; -@@ -2185,7 +2180,6 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt) - - static struct hci_cb rfcomm_cb = { - .name = "RFCOMM", -- .match = rfcomm_match, - .security_cfm = rfcomm_security_cfm - }; - -diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c -index c4c36ff25fb202..64d4d57c7033a3 100644 ---- a/net/bluetooth/sco.c -+++ b/net/bluetooth/sco.c -@@ -1353,13 +1353,11 @@ int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags) - return lm; - } - --static bool sco_match(struct hci_conn *hcon) --{ -- return hcon->type == SCO_LINK || hcon->type == ESCO_LINK; --} -- - static void sco_connect_cfm(struct hci_conn *hcon, __u8 status) - { -+ if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK) -+ return; -+ - BT_DBG("hcon %p bdaddr %pMR status %u", hcon, &hcon->dst, status); - - if (!status) { -@@ -1374,6 +1372,9 @@ static void sco_connect_cfm(struct hci_conn *hcon, __u8 status) - - static void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason) - { -+ if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK) -+ return; -+ - BT_DBG("hcon %p reason %d", hcon, reason); - - sco_conn_del(hcon, bt_to_errno(reason)); -@@ -1399,7 +1400,6 @@ void sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb) - - static struct hci_cb sco_cb = { - .name = "SCO", -- .match = sco_match, - .connect_cfm = sco_connect_cfm, - .disconn_cfm = sco_disconn_cfm, - }; -diff --git a/net/core/dev.c b/net/core/dev.c -index 8c30cdcf05d4bd..c31a7f7bedf3db 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -4532,7 +4532,7 @@ static inline void ____napi_schedule(struct softnet_data *sd, - * we have to raise NET_RX_SOFTIRQ. - */ - if (!sd->in_net_rx_action) -- __raise_softirq_irqoff(NET_RX_SOFTIRQ); -+ raise_softirq_irqoff(NET_RX_SOFTIRQ); - } - - #ifdef CONFIG_RPS -diff --git a/net/core/netpoll.c b/net/core/netpoll.c -index 1791462f1600ac..1a4d2a61b060bd 100644 ---- a/net/core/netpoll.c -+++ b/net/core/netpoll.c -@@ -326,6 +326,7 @@ static int netpoll_owner_active(struct net_device *dev) - static netdev_tx_t __netpoll_send_skb(struct netpoll *np, struct sk_buff *skb) - { - netdev_tx_t status = NETDEV_TX_BUSY; -+ netdev_tx_t ret = NET_XMIT_DROP; - struct net_device *dev; - unsigned long tries; - /* It is up to the caller to keep npinfo alive. */ -@@ -334,11 +335,12 @@ static netdev_tx_t __netpoll_send_skb(struct netpoll *np, struct sk_buff *skb) - lockdep_assert_irqs_disabled(); - - dev = np->dev; -+ rcu_read_lock(); - npinfo = rcu_dereference_bh(dev->npinfo); - - if (!npinfo || !netif_running(dev) || !netif_device_present(dev)) { - dev_kfree_skb_irq(skb); -- return NET_XMIT_DROP; -+ goto out; - } - - /* don't get messages out of order, and no recursion */ -@@ -377,7 +379,10 @@ static netdev_tx_t __netpoll_send_skb(struct netpoll *np, struct sk_buff *skb) - skb_queue_tail(&npinfo->txq, skb); - schedule_delayed_work(&npinfo->tx_work,0); - } -- return NETDEV_TX_OK; -+ ret = NETDEV_TX_OK; -+out: -+ rcu_read_unlock(); -+ return ret; - } - - netdev_tx_t netpoll_send_skb(struct netpoll *np, struct sk_buff *skb) -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 7ad82be40f348d..ff22060f9145f9 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -4620,6 +4620,13 @@ int tcp_abort(struct sock *sk, int err) - /* Don't race with userspace socket closes such as tcp_close. */ - lock_sock(sk); - -+ /* Avoid closing the same socket twice. */ -+ if (sk->sk_state == TCP_CLOSE) { -+ if (!has_current_bpf_ctx()) -+ release_sock(sk); -+ return -ENOENT; -+ } -+ - if (sk->sk_state == TCP_LISTEN) { - tcp_set_state(sk, TCP_CLOSE); - inet_csk_listen_stop(sk); -@@ -4629,19 +4636,12 @@ int tcp_abort(struct sock *sk, int err) - local_bh_disable(); - bh_lock_sock(sk); - -- if (!sock_flag(sk, SOCK_DEAD)) { -- WRITE_ONCE(sk->sk_err, err); -- /* This barrier is coupled with smp_rmb() in tcp_poll() */ -- smp_wmb(); -- sk_error_report(sk); -- if (tcp_need_reset(sk->sk_state)) -- tcp_send_active_reset(sk, GFP_ATOMIC); -- tcp_done(sk); -- } -+ if (tcp_need_reset(sk->sk_state)) -+ tcp_send_active_reset(sk, GFP_ATOMIC); -+ tcp_done_with_error(sk, err); - - bh_unlock_sock(sk); - local_bh_enable(); -- tcp_write_queue_purge(sk); - if (!has_current_bpf_ctx()) - release_sock(sk); - return 0; -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 8360939acf85ad..db07d3bbaf3799 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -3189,16 +3189,13 @@ static void add_v4_addrs(struct inet6_dev *idev) - struct in6_addr addr; - struct net_device *dev; - struct net *net = dev_net(idev->dev); -- int scope, plen, offset = 0; -+ int scope, plen; - u32 pflags = 0; - - ASSERT_RTNL(); - - memset(&addr, 0, sizeof(struct in6_addr)); -- /* in case of IP6GRE the dev_addr is an IPv6 and therefore we use only the last 4 bytes */ -- if (idev->dev->addr_len == sizeof(struct in6_addr)) -- offset = sizeof(struct in6_addr) - 4; -- memcpy(&addr.s6_addr32[3], idev->dev->dev_addr + offset, 4); -+ memcpy(&addr.s6_addr32[3], idev->dev->dev_addr, 4); - - if (!(idev->dev->flags & IFF_POINTOPOINT) && idev->dev->type == ARPHRD_SIT) { - scope = IPV6_ADDR_COMPATv4; -@@ -3508,7 +3505,13 @@ static void addrconf_gre_config(struct net_device *dev) - return; - } - -- if (dev->type == ARPHRD_ETHER) { -+ /* Generate the IPv6 link-local address using addrconf_addr_gen(), -+ * unless we have an IPv4 GRE device not bound to an IP address and -+ * which is in EUI64 mode (as __ipv6_isatap_ifid() would fail in this -+ * case). Such devices fall back to add_v4_addrs() instead. -+ */ -+ if (!(dev->type == ARPHRD_IPGRE && *(__be32 *)dev->dev_addr == 0 && -+ idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_EUI64)) { - addrconf_addr_gen(idev, true); - return; - } -diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h -index 0bb0386aa0897e..d67add91c9b905 100644 ---- a/net/mptcp/protocol.h -+++ b/net/mptcp/protocol.h -@@ -1103,6 +1103,8 @@ static inline void __mptcp_do_fallback(struct mptcp_sock *msk) - pr_debug("TCP fallback already done (msk=%p)\n", msk); - return; - } -+ if (WARN_ON_ONCE(!READ_ONCE(msk->allow_infinite_fallback))) -+ return; - set_bit(MPTCP_FALLBACK_DONE, &msk->flags); - } - -diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c -index dec5309d9f1f59..ae76542de3e989 100644 ---- a/net/netfilter/ipvs/ip_vs_ctl.c -+++ b/net/netfilter/ipvs/ip_vs_ctl.c -@@ -3091,12 +3091,12 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) - case IP_VS_SO_GET_SERVICES: - { - struct ip_vs_get_services *get; -- int size; -+ size_t size; - - get = (struct ip_vs_get_services *)arg; - size = struct_size(get, entrytable, get->num_services); - if (*len != size) { -- pr_err("length: %u != %u\n", *len, size); -+ pr_err("length: %u != %zu\n", *len, size); - ret = -EINVAL; - goto out; - } -@@ -3132,12 +3132,12 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) - case IP_VS_SO_GET_DESTS: - { - struct ip_vs_get_dests *get; -- int size; -+ size_t size; - - get = (struct ip_vs_get_dests *)arg; - size = struct_size(get, entrytable, get->num_dests); - if (*len != size) { -- pr_err("length: %u != %u\n", *len, size); -+ pr_err("length: %u != %zu\n", *len, size); - ret = -EINVAL; - goto out; - } -diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c -index 5885810da412fa..6156c0751056c2 100644 ---- a/net/netfilter/nf_conncount.c -+++ b/net/netfilter/nf_conncount.c -@@ -132,7 +132,7 @@ static int __nf_conncount_add(struct net *net, - struct nf_conn *found_ct; - unsigned int collect = 0; - -- if (time_is_after_eq_jiffies((unsigned long)list->last_gc)) -+ if ((u32)jiffies == list->last_gc) - goto add_new_node; - - /* check the saved connections */ -@@ -234,7 +234,7 @@ bool nf_conncount_gc_list(struct net *net, - bool ret = false; - - /* don't bother if we just did GC */ -- if (time_is_after_eq_jiffies((unsigned long)READ_ONCE(list->last_gc))) -+ if ((u32)jiffies == READ_ONCE(list->last_gc)) - return false; - - /* don't bother if other cpu is already doing GC */ -@@ -377,6 +377,8 @@ insert_tree(struct net *net, - - conn->tuple = *tuple; - conn->zone = *zone; -+ conn->cpu = raw_smp_processor_id(); -+ conn->jiffies32 = (u32)jiffies; - memcpy(rbconn->key, key, sizeof(u32) * data->keylen); - - nf_conncount_list_init(&rbconn->list); -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index bf24c63aff7b54..9e9544f819421a 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -3332,18 +3332,17 @@ static struct nft_expr *nft_expr_init(const struct nft_ctx *ctx, - return ERR_PTR(err); - } - --int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src) -+int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src, gfp_t gfp) - { - int err; - -- if (src->ops->clone) { -- dst->ops = src->ops; -- err = src->ops->clone(dst, src); -- if (err < 0) -- return err; -- } else { -- memcpy(dst, src, src->ops->size); -- } -+ if (WARN_ON_ONCE(!src->ops->clone)) -+ return -EINVAL; -+ -+ dst->ops = src->ops; -+ err = src->ops->clone(dst, src, gfp); -+ if (err < 0) -+ return err; - - __module_get(src->ops->type->owner); - -@@ -6458,7 +6457,7 @@ int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set, - if (!expr) - goto err_expr; - -- err = nft_expr_clone(expr, set->exprs[i]); -+ err = nft_expr_clone(expr, set->exprs[i], GFP_KERNEL_ACCOUNT); - if (err < 0) { - kfree(expr); - goto err_expr; -@@ -6497,7 +6496,7 @@ static int nft_set_elem_expr_setup(struct nft_ctx *ctx, - - for (i = 0; i < num_exprs; i++) { - expr = nft_setelem_expr_at(elem_expr, elem_expr->size); -- err = nft_expr_clone(expr, expr_array[i]); -+ err = nft_expr_clone(expr, expr_array[i], GFP_KERNEL_ACCOUNT); - if (err < 0) - goto err_elem_expr_setup; - -@@ -9963,6 +9962,7 @@ struct nft_trans_gc *nft_trans_gc_catchall_async(struct nft_trans_gc *gc, - struct nft_trans_gc *nft_trans_gc_catchall_sync(struct nft_trans_gc *gc) - { - struct nft_set_elem_catchall *catchall, *next; -+ u64 tstamp = nft_net_tstamp(gc->net); - const struct nft_set *set = gc->set; - struct nft_set_elem elem; - struct nft_set_ext *ext; -@@ -9972,7 +9972,7 @@ struct nft_trans_gc *nft_trans_gc_catchall_sync(struct nft_trans_gc *gc) - list_for_each_entry_safe(catchall, next, &set->catchall_list, list) { - ext = nft_set_elem_ext(set, catchall->elem); - -- if (!nft_set_elem_expired(ext)) -+ if (!__nft_set_elem_expired(ext, tstamp)) - continue; - - gc = nft_trans_gc_queue_sync(gc, GFP_KERNEL); -@@ -10777,6 +10777,7 @@ static bool nf_tables_valid_genid(struct net *net, u32 genid) - bool genid_ok; - - mutex_lock(&nft_net->commit_mutex); -+ nft_net->tstamp = get_jiffies_64(); - - genid_ok = genid == 0 || nft_net->base_seq == genid; - if (!genid_ok) -diff --git a/net/netfilter/nft_connlimit.c b/net/netfilter/nft_connlimit.c -index de9d1980df6964..92b984fa8175c2 100644 ---- a/net/netfilter/nft_connlimit.c -+++ b/net/netfilter/nft_connlimit.c -@@ -210,12 +210,12 @@ static void nft_connlimit_destroy(const struct nft_ctx *ctx, - nft_connlimit_do_destroy(ctx, priv); - } - --static int nft_connlimit_clone(struct nft_expr *dst, const struct nft_expr *src) -+static int nft_connlimit_clone(struct nft_expr *dst, const struct nft_expr *src, gfp_t gfp) - { - struct nft_connlimit *priv_dst = nft_expr_priv(dst); - struct nft_connlimit *priv_src = nft_expr_priv(src); - -- priv_dst->list = kmalloc(sizeof(*priv_dst->list), GFP_ATOMIC); -+ priv_dst->list = kmalloc(sizeof(*priv_dst->list), gfp); - if (!priv_dst->list) - return -ENOMEM; - -diff --git a/net/netfilter/nft_counter.c b/net/netfilter/nft_counter.c -index b7aa4d2c8c22f6..eab0dc66bee6bd 100644 ---- a/net/netfilter/nft_counter.c -+++ b/net/netfilter/nft_counter.c -@@ -231,7 +231,7 @@ static void nft_counter_destroy(const struct nft_ctx *ctx, - nft_counter_do_destroy(priv); - } - --static int nft_counter_clone(struct nft_expr *dst, const struct nft_expr *src) -+static int nft_counter_clone(struct nft_expr *dst, const struct nft_expr *src, gfp_t gfp) - { - struct nft_counter_percpu_priv *priv = nft_expr_priv(src); - struct nft_counter_percpu_priv *priv_clone = nft_expr_priv(dst); -@@ -241,7 +241,7 @@ static int nft_counter_clone(struct nft_expr *dst, const struct nft_expr *src) - - nft_counter_fetch(priv, &total); - -- cpu_stats = alloc_percpu_gfp(struct nft_counter, GFP_ATOMIC); -+ cpu_stats = alloc_percpu_gfp(struct nft_counter, gfp); - if (cpu_stats == NULL) - return -ENOMEM; - -diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c -index 255640013ab845..ab1214da99ff39 100644 ---- a/net/netfilter/nft_ct.c -+++ b/net/netfilter/nft_ct.c -@@ -230,6 +230,7 @@ static void nft_ct_set_zone_eval(const struct nft_expr *expr, - enum ip_conntrack_info ctinfo; - u16 value = nft_reg_load16(®s->data[priv->sreg]); - struct nf_conn *ct; -+ int oldcnt; - - ct = nf_ct_get(skb, &ctinfo); - if (ct) /* already tracked */ -@@ -250,10 +251,11 @@ static void nft_ct_set_zone_eval(const struct nft_expr *expr, - - ct = this_cpu_read(nft_ct_pcpu_template); - -- if (likely(refcount_read(&ct->ct_general.use) == 1)) { -- refcount_inc(&ct->ct_general.use); -+ __refcount_inc(&ct->ct_general.use, &oldcnt); -+ if (likely(oldcnt == 1)) { - nf_ct_zone_add(ct, &zone); - } else { -+ refcount_dec(&ct->ct_general.use); - /* previous skb got queued to userspace, allocate temporary - * one until percpu template can be reused. - */ -diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c -index 629a91a8c61419..a81bd69b059b30 100644 ---- a/net/netfilter/nft_dynset.c -+++ b/net/netfilter/nft_dynset.c -@@ -35,7 +35,7 @@ static int nft_dynset_expr_setup(const struct nft_dynset *priv, - - for (i = 0; i < priv->num_exprs; i++) { - expr = nft_setelem_expr_at(elem_expr, elem_expr->size); -- if (nft_expr_clone(expr, priv->expr_array[i]) < 0) -+ if (nft_expr_clone(expr, priv->expr_array[i], GFP_ATOMIC) < 0) - return -1; - - elem_expr->size += priv->expr_array[i]->ops->size; -diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c -index 6eb571d0c3fdfc..cfa90ab660cfef 100644 ---- a/net/netfilter/nft_exthdr.c -+++ b/net/netfilter/nft_exthdr.c -@@ -85,7 +85,6 @@ static int ipv4_find_option(struct net *net, struct sk_buff *skb, - unsigned char optbuf[sizeof(struct ip_options) + 40]; - struct ip_options *opt = (struct ip_options *)optbuf; - struct iphdr *iph, _iph; -- unsigned int start; - bool found = false; - __be32 info; - int optlen; -@@ -93,7 +92,6 @@ static int ipv4_find_option(struct net *net, struct sk_buff *skb, - iph = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); - if (!iph) - return -EBADMSG; -- start = sizeof(struct iphdr); - - optlen = iph->ihl * 4 - (int)sizeof(struct iphdr); - if (optlen <= 0) -@@ -103,7 +101,7 @@ static int ipv4_find_option(struct net *net, struct sk_buff *skb, - /* Copy the options since __ip_options_compile() modifies - * the options. - */ -- if (skb_copy_bits(skb, start, opt->__data, optlen)) -+ if (skb_copy_bits(skb, sizeof(struct iphdr), opt->__data, optlen)) - return -EBADMSG; - opt->optlen = optlen; - -@@ -118,18 +116,18 @@ static int ipv4_find_option(struct net *net, struct sk_buff *skb, - found = target == IPOPT_SSRR ? opt->is_strictroute : - !opt->is_strictroute; - if (found) -- *offset = opt->srr + start; -+ *offset = opt->srr; - break; - case IPOPT_RR: - if (!opt->rr) - break; -- *offset = opt->rr + start; -+ *offset = opt->rr; - found = true; - break; - case IPOPT_RA: - if (!opt->router_alert) - break; -- *offset = opt->router_alert + start; -+ *offset = opt->router_alert; - found = true; - break; - default: -diff --git a/net/netfilter/nft_last.c b/net/netfilter/nft_last.c -index 8e6d7eaf9dc8b5..de1b6066bfa856 100644 ---- a/net/netfilter/nft_last.c -+++ b/net/netfilter/nft_last.c -@@ -102,12 +102,12 @@ static void nft_last_destroy(const struct nft_ctx *ctx, - kfree(priv->last); - } - --static int nft_last_clone(struct nft_expr *dst, const struct nft_expr *src) -+static int nft_last_clone(struct nft_expr *dst, const struct nft_expr *src, gfp_t gfp) - { - struct nft_last_priv *priv_dst = nft_expr_priv(dst); - struct nft_last_priv *priv_src = nft_expr_priv(src); - -- priv_dst->last = kzalloc(sizeof(*priv_dst->last), GFP_ATOMIC); -+ priv_dst->last = kzalloc(sizeof(*priv_dst->last), gfp); - if (!priv_dst->last) - return -ENOMEM; - -diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c -index cefa25e0dbb0a2..21d26b79b46072 100644 ---- a/net/netfilter/nft_limit.c -+++ b/net/netfilter/nft_limit.c -@@ -150,7 +150,7 @@ static void nft_limit_destroy(const struct nft_ctx *ctx, - } - - static int nft_limit_clone(struct nft_limit_priv *priv_dst, -- const struct nft_limit_priv *priv_src) -+ const struct nft_limit_priv *priv_src, gfp_t gfp) - { - priv_dst->tokens_max = priv_src->tokens_max; - priv_dst->rate = priv_src->rate; -@@ -158,7 +158,7 @@ static int nft_limit_clone(struct nft_limit_priv *priv_dst, - priv_dst->burst = priv_src->burst; - priv_dst->invert = priv_src->invert; - -- priv_dst->limit = kmalloc(sizeof(*priv_dst->limit), GFP_ATOMIC); -+ priv_dst->limit = kmalloc(sizeof(*priv_dst->limit), gfp); - if (!priv_dst->limit) - return -ENOMEM; - -@@ -223,14 +223,15 @@ static void nft_limit_pkts_destroy(const struct nft_ctx *ctx, - nft_limit_destroy(ctx, &priv->limit); - } - --static int nft_limit_pkts_clone(struct nft_expr *dst, const struct nft_expr *src) -+static int nft_limit_pkts_clone(struct nft_expr *dst, const struct nft_expr *src, -+ gfp_t gfp) - { - struct nft_limit_priv_pkts *priv_dst = nft_expr_priv(dst); - struct nft_limit_priv_pkts *priv_src = nft_expr_priv(src); - - priv_dst->cost = priv_src->cost; - -- return nft_limit_clone(&priv_dst->limit, &priv_src->limit); -+ return nft_limit_clone(&priv_dst->limit, &priv_src->limit, gfp); - } - - static struct nft_expr_type nft_limit_type; -@@ -281,12 +282,13 @@ static void nft_limit_bytes_destroy(const struct nft_ctx *ctx, - nft_limit_destroy(ctx, priv); - } - --static int nft_limit_bytes_clone(struct nft_expr *dst, const struct nft_expr *src) -+static int nft_limit_bytes_clone(struct nft_expr *dst, const struct nft_expr *src, -+ gfp_t gfp) - { - struct nft_limit_priv *priv_dst = nft_expr_priv(dst); - struct nft_limit_priv *priv_src = nft_expr_priv(src); - -- return nft_limit_clone(priv_dst, priv_src); -+ return nft_limit_clone(priv_dst, priv_src, gfp); - } - - static const struct nft_expr_ops nft_limit_bytes_ops = { -diff --git a/net/netfilter/nft_quota.c b/net/netfilter/nft_quota.c -index 3ba12a7471b0f6..9b2d7463d3d326 100644 ---- a/net/netfilter/nft_quota.c -+++ b/net/netfilter/nft_quota.c -@@ -233,7 +233,7 @@ static void nft_quota_destroy(const struct nft_ctx *ctx, - return nft_quota_do_destroy(ctx, priv); - } - --static int nft_quota_clone(struct nft_expr *dst, const struct nft_expr *src) -+static int nft_quota_clone(struct nft_expr *dst, const struct nft_expr *src, gfp_t gfp) - { - struct nft_quota *priv_dst = nft_expr_priv(dst); - struct nft_quota *priv_src = nft_expr_priv(src); -@@ -241,7 +241,7 @@ static int nft_quota_clone(struct nft_expr *dst, const struct nft_expr *src) - priv_dst->quota = priv_src->quota; - priv_dst->flags = priv_src->flags; - -- priv_dst->consumed = kmalloc(sizeof(*priv_dst->consumed), GFP_ATOMIC); -+ priv_dst->consumed = kmalloc(sizeof(*priv_dst->consumed), gfp); - if (!priv_dst->consumed) - return -ENOMEM; - -diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c -index cc1ae18485fafe..0370f69dce86dd 100644 ---- a/net/netfilter/nft_set_hash.c -+++ b/net/netfilter/nft_set_hash.c -@@ -37,6 +37,7 @@ struct nft_rhash_cmp_arg { - const struct nft_set *set; - const u32 *key; - u8 genmask; -+ u64 tstamp; - }; - - static inline u32 nft_rhash_key(const void *data, u32 len, u32 seed) -@@ -63,7 +64,7 @@ static inline int nft_rhash_cmp(struct rhashtable_compare_arg *arg, - return 1; - if (nft_set_elem_is_dead(&he->ext)) - return 1; -- if (nft_set_elem_expired(&he->ext)) -+ if (__nft_set_elem_expired(&he->ext, x->tstamp)) - return 1; - if (!nft_set_elem_active(&he->ext, x->genmask)) - return 1; -@@ -88,6 +89,7 @@ bool nft_rhash_lookup(const struct net *net, const struct nft_set *set, - .genmask = nft_genmask_cur(net), - .set = set, - .key = key, -+ .tstamp = get_jiffies_64(), - }; - - he = rhashtable_lookup(&priv->ht, &arg, nft_rhash_params); -@@ -106,6 +108,7 @@ static void *nft_rhash_get(const struct net *net, const struct nft_set *set, - .genmask = nft_genmask_cur(net), - .set = set, - .key = elem->key.val.data, -+ .tstamp = get_jiffies_64(), - }; - - he = rhashtable_lookup(&priv->ht, &arg, nft_rhash_params); -@@ -129,6 +132,7 @@ static bool nft_rhash_update(struct nft_set *set, const u32 *key, - .genmask = NFT_GENMASK_ANY, - .set = set, - .key = key, -+ .tstamp = get_jiffies_64(), - }; - - he = rhashtable_lookup(&priv->ht, &arg, nft_rhash_params); -@@ -172,6 +176,7 @@ static int nft_rhash_insert(const struct net *net, const struct nft_set *set, - .genmask = nft_genmask_next(net), - .set = set, - .key = elem->key.val.data, -+ .tstamp = nft_net_tstamp(net), - }; - struct nft_rhash_elem *prev; - -@@ -214,6 +219,7 @@ static void *nft_rhash_deactivate(const struct net *net, - .genmask = nft_genmask_next(net), - .set = set, - .key = elem->key.val.data, -+ .tstamp = nft_net_tstamp(net), - }; - - rcu_read_lock(); -diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c -index 5dab9905ebbecc..4274831b6e67ba 100644 ---- a/net/netfilter/nft_set_pipapo.c -+++ b/net/netfilter/nft_set_pipapo.c -@@ -504,6 +504,7 @@ bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set, - * @set: nftables API set representation - * @data: Key data to be matched against existing elements - * @genmask: If set, check that element is active in given genmask -+ * @tstamp: timestamp to check for expired elements - * - * This is essentially the same as the lookup function, except that it matches - * key data against the uncommitted copy and doesn't use preallocated maps for -@@ -513,7 +514,8 @@ bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set, - */ - static struct nft_pipapo_elem *pipapo_get(const struct net *net, - const struct nft_set *set, -- const u8 *data, u8 genmask) -+ const u8 *data, u8 genmask, -+ u64 tstamp) - { - struct nft_pipapo_elem *ret = ERR_PTR(-ENOENT); - struct nft_pipapo *priv = nft_set_priv(set); -@@ -568,7 +570,7 @@ static struct nft_pipapo_elem *pipapo_get(const struct net *net, - goto out; - - if (last) { -- if (nft_set_elem_expired(&f->mt[b].e->ext)) -+ if (__nft_set_elem_expired(&f->mt[b].e->ext, tstamp)) - goto next_match; - if ((genmask && - !nft_set_elem_active(&f->mt[b].e->ext, genmask))) -@@ -605,7 +607,7 @@ static void *nft_pipapo_get(const struct net *net, const struct nft_set *set, - const struct nft_set_elem *elem, unsigned int flags) - { - return pipapo_get(net, set, (const u8 *)elem->key.val.data, -- nft_genmask_cur(net)); -+ nft_genmask_cur(net), get_jiffies_64()); - } - - /** -@@ -1199,6 +1201,7 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, - struct nft_pipapo *priv = nft_set_priv(set); - struct nft_pipapo_match *m = priv->clone; - u8 genmask = nft_genmask_next(net); -+ u64 tstamp = nft_net_tstamp(net); - struct nft_pipapo_field *f; - const u8 *start_p, *end_p; - int i, bsize_max, err = 0; -@@ -1208,7 +1211,7 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, - else - end = start; - -- dup = pipapo_get(net, set, start, genmask); -+ dup = pipapo_get(net, set, start, genmask, tstamp); - if (!IS_ERR(dup)) { - /* Check if we already have the same exact entry */ - const struct nft_data *dup_key, *dup_end; -@@ -1230,7 +1233,7 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, - - if (PTR_ERR(dup) == -ENOENT) { - /* Look for partially overlapping entries */ -- dup = pipapo_get(net, set, end, nft_genmask_next(net)); -+ dup = pipapo_get(net, set, end, nft_genmask_next(net), tstamp); - } - - if (PTR_ERR(dup) != -ENOENT) { -@@ -1581,6 +1584,7 @@ static void pipapo_gc(struct nft_set *set, struct nft_pipapo_match *m) - { - struct nft_pipapo *priv = nft_set_priv(set); - struct net *net = read_pnet(&set->net); -+ u64 tstamp = nft_net_tstamp(net); - int rules_f0, first_rule = 0; - struct nft_pipapo_elem *e; - struct nft_trans_gc *gc; -@@ -1615,7 +1619,7 @@ static void pipapo_gc(struct nft_set *set, struct nft_pipapo_match *m) - /* synchronous gc never fails, there is no need to set on - * NFT_SET_ELEM_DEAD_BIT. - */ -- if (nft_set_elem_expired(&e->ext)) { -+ if (__nft_set_elem_expired(&e->ext, tstamp)) { - priv->dirty = true; - - gc = nft_trans_gc_queue_sync(gc, GFP_ATOMIC); -@@ -1786,7 +1790,7 @@ static void *pipapo_deactivate(const struct net *net, const struct nft_set *set, - { - struct nft_pipapo_elem *e; - -- e = pipapo_get(net, set, data, nft_genmask_next(net)); -+ e = pipapo_get(net, set, data, nft_genmask_next(net), nft_net_tstamp(net)); - if (IS_ERR(e)) - return NULL; - -diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c -index 8ad1e008d12b5b..04672238e17dce 100644 ---- a/net/netfilter/nft_set_rbtree.c -+++ b/net/netfilter/nft_set_rbtree.c -@@ -314,6 +314,7 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set, - struct nft_rbtree *priv = nft_set_priv(set); - u8 cur_genmask = nft_genmask_cur(net); - u8 genmask = nft_genmask_next(net); -+ u64 tstamp = nft_net_tstamp(net); - int d; - - /* Descend the tree to search for an existing element greater than the -@@ -361,7 +362,7 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set, - /* perform garbage collection to avoid bogus overlap reports - * but skip new elements in this transaction. - */ -- if (nft_set_elem_expired(&rbe->ext) && -+ if (__nft_set_elem_expired(&rbe->ext, tstamp) && - nft_set_elem_active(&rbe->ext, cur_genmask)) { - const struct nft_rbtree_elem *removed_end; - -@@ -553,6 +554,7 @@ static void *nft_rbtree_deactivate(const struct net *net, - const struct rb_node *parent = priv->root.rb_node; - struct nft_rbtree_elem *rbe, *this = elem->priv; - u8 genmask = nft_genmask_next(net); -+ u64 tstamp = nft_net_tstamp(net); - int d; - - while (parent != NULL) { -@@ -573,7 +575,7 @@ static void *nft_rbtree_deactivate(const struct net *net, - nft_rbtree_interval_end(this)) { - parent = parent->rb_right; - continue; -- } else if (nft_set_elem_expired(&rbe->ext)) { -+ } else if (__nft_set_elem_expired(&rbe->ext, tstamp)) { - break; - } else if (!nft_set_elem_active(&rbe->ext, genmask)) { - parent = parent->rb_left; -@@ -632,9 +634,10 @@ static void nft_rbtree_gc(struct nft_set *set) - struct nft_rbtree *priv = nft_set_priv(set); - struct nft_rbtree_elem *rbe, *rbe_end = NULL; - struct nftables_pernet *nft_net; -+ struct net *net = read_pnet(&set->net); -+ u64 tstamp = nft_net_tstamp(net); - struct rb_node *node, *next; - struct nft_trans_gc *gc; -- struct net *net; - - set = nft_set_container_of(priv); - net = read_pnet(&set->net); -@@ -657,7 +660,7 @@ static void nft_rbtree_gc(struct nft_set *set) - rbe_end = rbe; - continue; - } -- if (!nft_set_elem_expired(&rbe->ext)) -+ if (!__nft_set_elem_expired(&rbe->ext, tstamp)) - continue; - - gc = nft_trans_gc_queue_sync(gc, GFP_KERNEL); -diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c -index ebc5728aab4eaf..9c13e14034d3b6 100644 ---- a/net/openvswitch/flow_netlink.c -+++ b/net/openvswitch/flow_netlink.c -@@ -2304,14 +2304,10 @@ int ovs_nla_put_mask(const struct sw_flow *flow, struct sk_buff *skb) - OVS_FLOW_ATTR_MASK, true, skb); - } - --#define MAX_ACTIONS_BUFSIZE (32 * 1024) -- - static struct sw_flow_actions *nla_alloc_flow_actions(int size) - { - struct sw_flow_actions *sfa; - -- WARN_ON_ONCE(size > MAX_ACTIONS_BUFSIZE); -- - sfa = kmalloc(kmalloc_size_roundup(sizeof(*sfa) + size), GFP_KERNEL); - if (!sfa) - return ERR_PTR(-ENOMEM); -@@ -2467,15 +2463,6 @@ static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa, - - new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2); - -- if (new_acts_size > MAX_ACTIONS_BUFSIZE) { -- if ((next_offset + req_size) > MAX_ACTIONS_BUFSIZE) { -- OVS_NLERR(log, "Flow action size exceeds max %u", -- MAX_ACTIONS_BUFSIZE); -- return ERR_PTR(-EMSGSIZE); -- } -- new_acts_size = MAX_ACTIONS_BUFSIZE; -- } -- - acts = nla_alloc_flow_actions(new_acts_size); - if (IS_ERR(acts)) - return (void *)acts; -@@ -3502,7 +3489,7 @@ int ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, - int err; - u32 mpls_label_count = 0; - -- *sfa = nla_alloc_flow_actions(min(nla_len(attr), MAX_ACTIONS_BUFSIZE)); -+ *sfa = nla_alloc_flow_actions(nla_len(attr)); - if (IS_ERR(*sfa)) - return PTR_ERR(*sfa); - -diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c -index 7cddaa6321c7c9..df89790c459ad6 100644 ---- a/net/sched/sch_api.c -+++ b/net/sched/sch_api.c -@@ -2197,6 +2197,12 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n, - return -EOPNOTSUPP; - } - -+ /* Prevent creation of traffic classes with classid TC_H_ROOT */ -+ if (clid == TC_H_ROOT) { -+ NL_SET_ERR_MSG(extack, "Cannot create traffic class with classid TC_H_ROOT"); -+ return -EINVAL; -+ } -+ - new_cl = cl; - err = -EOPNOTSUPP; - if (cops->change) -diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c -index 872d127c9db42a..fa7a1b69c0f358 100644 ---- a/net/sched/sch_gred.c -+++ b/net/sched/sch_gred.c -@@ -913,7 +913,8 @@ static void gred_destroy(struct Qdisc *sch) - for (i = 0; i < table->DPs; i++) - gred_destroy_vq(table->tab[i]); - -- gred_offload(sch, TC_GRED_DESTROY); -+ if (table->opt) -+ gred_offload(sch, TC_GRED_DESTROY); - kfree(table->opt); - } - -diff --git a/net/sctp/stream.c b/net/sctp/stream.c -index c241cc552e8d58..bfcff6d6a43866 100644 ---- a/net/sctp/stream.c -+++ b/net/sctp/stream.c -@@ -735,7 +735,7 @@ struct sctp_chunk *sctp_process_strreset_tsnreq( - * value SHOULD be the smallest TSN not acknowledged by the - * receiver of the request plus 2^31. - */ -- init_tsn = sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map) + (1 << 31); -+ init_tsn = sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map) + (1U << 31); - sctp_tsnmap_init(&asoc->peer.tsn_map, SCTP_TSN_MAP_INITIAL, - init_tsn, GFP_ATOMIC); - -diff --git a/net/switchdev/switchdev.c b/net/switchdev/switchdev.c -index c9189a970eec31..fb0e65c89525da 100644 ---- a/net/switchdev/switchdev.c -+++ b/net/switchdev/switchdev.c -@@ -381,7 +381,7 @@ bool switchdev_port_obj_act_is_deferred(struct net_device *dev, - EXPORT_SYMBOL_GPL(switchdev_port_obj_act_is_deferred); - - static ATOMIC_NOTIFIER_HEAD(switchdev_notif_chain); --static BLOCKING_NOTIFIER_HEAD(switchdev_blocking_notif_chain); -+static RAW_NOTIFIER_HEAD(switchdev_blocking_notif_chain); - - /** - * register_switchdev_notifier - Register notifier -@@ -427,17 +427,27 @@ EXPORT_SYMBOL_GPL(call_switchdev_notifiers); - - int register_switchdev_blocking_notifier(struct notifier_block *nb) - { -- struct blocking_notifier_head *chain = &switchdev_blocking_notif_chain; -+ struct raw_notifier_head *chain = &switchdev_blocking_notif_chain; -+ int err; -+ -+ rtnl_lock(); -+ err = raw_notifier_chain_register(chain, nb); -+ rtnl_unlock(); - -- return blocking_notifier_chain_register(chain, nb); -+ return err; - } - EXPORT_SYMBOL_GPL(register_switchdev_blocking_notifier); - - int unregister_switchdev_blocking_notifier(struct notifier_block *nb) - { -- struct blocking_notifier_head *chain = &switchdev_blocking_notif_chain; -+ struct raw_notifier_head *chain = &switchdev_blocking_notif_chain; -+ int err; - -- return blocking_notifier_chain_unregister(chain, nb); -+ rtnl_lock(); -+ err = raw_notifier_chain_unregister(chain, nb); -+ rtnl_unlock(); -+ -+ return err; - } - EXPORT_SYMBOL_GPL(unregister_switchdev_blocking_notifier); - -@@ -445,10 +455,11 @@ int call_switchdev_blocking_notifiers(unsigned long val, struct net_device *dev, - struct switchdev_notifier_info *info, - struct netlink_ext_ack *extack) - { -+ ASSERT_RTNL(); - info->dev = dev; - info->extack = extack; -- return blocking_notifier_call_chain(&switchdev_blocking_notif_chain, -- val, info); -+ return raw_notifier_call_chain(&switchdev_blocking_notif_chain, -+ val, info); - } - EXPORT_SYMBOL_GPL(call_switchdev_blocking_notifiers); - -diff --git a/net/wireless/core.c b/net/wireless/core.c -index 3c1247933ae92c..a2b15349324b6e 100644 ---- a/net/wireless/core.c -+++ b/net/wireless/core.c -@@ -1151,6 +1151,13 @@ void cfg80211_dev_free(struct cfg80211_registered_device *rdev) - { - struct cfg80211_internal_bss *scan, *tmp; - struct cfg80211_beacon_registration *reg, *treg; -+ unsigned long flags; -+ -+ spin_lock_irqsave(&rdev->wiphy_work_lock, flags); -+ WARN_ON(!list_empty(&rdev->wiphy_work_list)); -+ spin_unlock_irqrestore(&rdev->wiphy_work_lock, flags); -+ cancel_work_sync(&rdev->wiphy_work); -+ - rfkill_destroy(rdev->wiphy.rfkill); - list_for_each_entry_safe(reg, treg, &rdev->beacon_registrations, list) { - list_del(®->list); -diff --git a/rust/kernel/error.rs b/rust/kernel/error.rs -index 032b6454395395..e82d31aa1f3073 100644 ---- a/rust/kernel/error.rs -+++ b/rust/kernel/error.rs -@@ -103,7 +103,7 @@ pub(crate) fn from_errno(errno: core::ffi::c_int) -> Error { - if errno < -(bindings::MAX_ERRNO as i32) || errno >= 0 { - // TODO: Make it a `WARN_ONCE` once available. - crate::pr_warn!( -- "attempted to create `Error` with out of range `errno`: {}", -+ "attempted to create `Error` with out of range `errno`: {}\n", - errno - ); - return code::EINVAL; -diff --git a/rust/kernel/init.rs b/rust/kernel/init.rs -index 2d4b19b8685771..af1c77cc12b28a 100644 ---- a/rust/kernel/init.rs -+++ b/rust/kernel/init.rs -@@ -258,7 +258,7 @@ - /// }, - /// })); - /// let foo: Pin<&mut Foo> = foo; --/// pr_info!("a: {}", &*foo.a.lock()); -+/// pr_info!("a: {}\n", &*foo.a.lock()); - /// ``` - /// - /// # Syntax -@@ -310,7 +310,7 @@ macro_rules! stack_pin_init { - /// })?, - /// })); - /// let foo = foo.unwrap(); --/// pr_info!("a: {}", &*foo.a.lock()); -+/// pr_info!("a: {}\n", &*foo.a.lock()); - /// ``` - /// - /// ```rust,ignore -@@ -335,7 +335,7 @@ macro_rules! stack_pin_init { - /// x: 64, - /// })?, - /// })); --/// pr_info!("a: {}", &*foo.a.lock()); -+/// pr_info!("a: {}\n", &*foo.a.lock()); - /// # Ok::<_, AllocError>(()) - /// ``` - /// -@@ -800,7 +800,7 @@ pub unsafe trait PinInit: Sized { - /// - /// impl Foo { - /// fn setup(self: Pin<&mut Self>) { -- /// pr_info!("Setting up foo"); -+ /// pr_info!("Setting up foo\n"); - /// } - /// } - /// -@@ -906,7 +906,7 @@ pub unsafe trait Init: PinInit { - /// - /// impl Foo { - /// fn setup(&mut self) { -- /// pr_info!("Setting up foo"); -+ /// pr_info!("Setting up foo\n"); - /// } - /// } - /// -@@ -1229,7 +1229,7 @@ fn try_init(init: impl Init) -> Result - /// #[pinned_drop] - /// impl PinnedDrop for Foo { - /// fn drop(self: Pin<&mut Self>) { --/// pr_info!("Foo is being dropped!"); -+/// pr_info!("Foo is being dropped!\n"); - /// } - /// } - /// ``` -@@ -1310,17 +1310,14 @@ macro_rules! impl_zeroable { - // SAFETY: `T: Zeroable` and `UnsafeCell` is `repr(transparent)`. - {} UnsafeCell, - -- // SAFETY: All zeros is equivalent to `None` (option layout optimization guarantee). -+ // SAFETY: All zeros is equivalent to `None` (option layout optimization guarantee: -+ // https://doc.rust-lang.org/stable/std/option/index.html#representation). - Option, Option, Option, Option, - Option, Option, - Option, Option, Option, Option, - Option, Option, -- -- // SAFETY: All zeros is equivalent to `None` (option layout optimization guarantee). -- // -- // In this case we are allowed to use `T: ?Sized`, since all zeros is the `None` variant. -- {} Option>, -- {} Option>, -+ {} Option>, -+ {} Option>, - - // SAFETY: `null` pointer is valid. - // -diff --git a/rust/kernel/init/macros.rs b/rust/kernel/init/macros.rs -index cb6e61b6c50bda..cb769a09e74263 100644 ---- a/rust/kernel/init/macros.rs -+++ b/rust/kernel/init/macros.rs -@@ -45,7 +45,7 @@ - //! #[pinned_drop] - //! impl PinnedDrop for Foo { - //! fn drop(self: Pin<&mut Self>) { --//! pr_info!("{self:p} is getting dropped."); -+//! pr_info!("{self:p} is getting dropped.\n"); - //! } - //! } - //! -@@ -412,7 +412,7 @@ - //! #[pinned_drop] - //! impl PinnedDrop for Foo { - //! fn drop(self: Pin<&mut Self>) { --//! pr_info!("{self:p} is getting dropped."); -+//! pr_info!("{self:p} is getting dropped.\n"); - //! } - //! } - //! ``` -@@ -423,7 +423,7 @@ - //! // `unsafe`, full path and the token parameter are added, everything else stays the same. - //! unsafe impl ::kernel::init::PinnedDrop for Foo { - //! fn drop(self: Pin<&mut Self>, _: ::kernel::init::__internal::OnlyCallFromDrop) { --//! pr_info!("{self:p} is getting dropped."); -+//! pr_info!("{self:p} is getting dropped.\n"); - //! } - //! } - //! ``` -diff --git a/rust/kernel/sync.rs b/rust/kernel/sync.rs -index d219ee518eff15..8b40589b1028b0 100644 ---- a/rust/kernel/sync.rs -+++ b/rust/kernel/sync.rs -@@ -26,11 +26,6 @@ - unsafe impl Sync for LockClassKey {} - - impl LockClassKey { -- /// Creates a new lock class key. -- pub const fn new() -> Self { -- Self(Opaque::uninit()) -- } -- - pub(crate) fn as_ptr(&self) -> *mut bindings::lock_class_key { - self.0.get() - } -@@ -41,7 +36,10 @@ pub(crate) fn as_ptr(&self) -> *mut bindings::lock_class_key { - #[macro_export] - macro_rules! static_lock_class { - () => {{ -- static CLASS: $crate::sync::LockClassKey = $crate::sync::LockClassKey::new(); -+ static CLASS: $crate::sync::LockClassKey = -+ // SAFETY: lockdep expects uninitialized memory when it's handed a statically allocated -+ // lock_class_key -+ unsafe { ::core::mem::MaybeUninit::uninit().assume_init() }; - &CLASS - }}; - } -diff --git a/scripts/generate_rust_analyzer.py b/scripts/generate_rust_analyzer.py -index fc52bc41d3e7bd..c99173e4b8f3ea 100755 ---- a/scripts/generate_rust_analyzer.py -+++ b/scripts/generate_rust_analyzer.py -@@ -49,14 +49,26 @@ def generate_crates(srctree, objtree, sysroot_src, external_src, cfgs): - } - }) - -- # First, the ones in `rust/` since they are a bit special. -- append_crate( -- "core", -- sysroot_src / "core" / "src" / "lib.rs", -- [], -- cfg=crates_cfgs.get("core", []), -- is_workspace_member=False, -- ) -+ def append_sysroot_crate( -+ display_name, -+ deps, -+ cfg=[], -+ ): -+ append_crate( -+ display_name, -+ sysroot_src / display_name / "src" / "lib.rs", -+ deps, -+ cfg, -+ is_workspace_member=False, -+ ) -+ -+ # NB: sysroot crates reexport items from one another so setting up our transitive dependencies -+ # here is important for ensuring that rust-analyzer can resolve symbols. The sources of truth -+ # for this dependency graph are `(sysroot_src / crate / "Cargo.toml" for crate in crates)`. -+ append_sysroot_crate("core", [], cfg=crates_cfgs.get("core", [])) -+ append_sysroot_crate("alloc", ["core"]) -+ append_sysroot_crate("std", ["alloc", "core"]) -+ append_sysroot_crate("proc_macro", ["core", "std"]) - - append_crate( - "compiler_builtins", -@@ -74,7 +86,7 @@ def generate_crates(srctree, objtree, sysroot_src, external_src, cfgs): - append_crate( - "macros", - srctree / "rust" / "macros" / "lib.rs", -- [], -+ ["std", "proc_macro"], - is_proc_macro=True, - ) - crates[-1]["proc_macro_dylib_path"] = f"{objtree}/rust/libmacros.so" -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index ec57148453c820..1fd6e84b0e3718 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -10527,6 +10527,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1d72, 0x1945, "Redmi G", ALC256_FIXUP_ASUS_HEADSET_MIC), - SND_PCI_QUIRK(0x1d72, 0x1947, "RedmiBook Air", ALC255_FIXUP_XIAOMI_HEADSET_MIC), - SND_PCI_QUIRK(0x1f66, 0x0105, "Ayaneo Portable Game Player", ALC287_FIXUP_CS35L41_I2C_2), -+ SND_PCI_QUIRK(0x2014, 0x800a, "Positivo ARN50", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), - SND_PCI_QUIRK(0x2782, 0x0214, "VAIO VJFE-CL", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), - SND_PCI_QUIRK(0x2782, 0x0228, "Infinix ZERO BOOK 13", ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13), - SND_PCI_QUIRK(0x2782, 0x0232, "CHUWI CoreBook XPro", ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO), -diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c -index eac023283ff790..2981bd1c3530d0 100644 ---- a/sound/soc/amd/yc/acp6x-mach.c -+++ b/sound/soc/amd/yc/acp6x-mach.c -@@ -248,6 +248,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "21M5"), - } - }, -+ { -+ .driver_data = &acp6x_card, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "21M6"), -+ } -+ }, - { - .driver_data = &acp6x_card, - .matches = { -diff --git a/sound/soc/codecs/arizona.c b/sound/soc/codecs/arizona.c -index 402b9a2ff02406..68cdb1027d0c05 100644 ---- a/sound/soc/codecs/arizona.c -+++ b/sound/soc/codecs/arizona.c -@@ -967,7 +967,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w, - case ARIZONA_OUT3L_ENA_SHIFT: - case ARIZONA_OUT3R_ENA_SHIFT: - priv->out_up_pending++; -- priv->out_up_delay += 17; -+ priv->out_up_delay += 17000; - break; - case ARIZONA_OUT4L_ENA_SHIFT: - case ARIZONA_OUT4R_ENA_SHIFT: -@@ -977,7 +977,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w, - case WM8997: - break; - default: -- priv->out_up_delay += 10; -+ priv->out_up_delay += 10000; - break; - } - break; -@@ -999,7 +999,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w, - if (!priv->out_up_pending && priv->out_up_delay) { - dev_dbg(component->dev, "Power up delay: %d\n", - priv->out_up_delay); -- msleep(priv->out_up_delay); -+ fsleep(priv->out_up_delay); - priv->out_up_delay = 0; - } - break; -@@ -1017,7 +1017,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w, - case ARIZONA_OUT3L_ENA_SHIFT: - case ARIZONA_OUT3R_ENA_SHIFT: - priv->out_down_pending++; -- priv->out_down_delay++; -+ priv->out_down_delay += 1000; - break; - case ARIZONA_OUT4L_ENA_SHIFT: - case ARIZONA_OUT4R_ENA_SHIFT: -@@ -1028,10 +1028,10 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w, - break; - case WM8998: - case WM1814: -- priv->out_down_delay += 5; -+ priv->out_down_delay += 5000; - break; - default: -- priv->out_down_delay++; -+ priv->out_down_delay += 1000; - break; - } - break; -@@ -1053,7 +1053,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w, - if (!priv->out_down_pending && priv->out_down_delay) { - dev_dbg(component->dev, "Power down delay: %d\n", - priv->out_down_delay); -- msleep(priv->out_down_delay); -+ fsleep(priv->out_down_delay); - priv->out_down_delay = 0; - } - break; -diff --git a/sound/soc/codecs/cs42l43.c b/sound/soc/codecs/cs42l43.c -index 1443eb1dc0b170..4f78b7668b6093 100644 ---- a/sound/soc/codecs/cs42l43.c -+++ b/sound/soc/codecs/cs42l43.c -@@ -1020,7 +1020,7 @@ static const struct snd_kcontrol_new cs42l43_controls[] = { - - SOC_DOUBLE_R_SX_TLV("ADC Volume", CS42L43_ADC_B_CTRL1, CS42L43_ADC_B_CTRL2, - CS42L43_ADC_PGA_GAIN_SHIFT, -- 0xF, 5, cs42l43_adc_tlv), -+ 0xF, 4, cs42l43_adc_tlv), - - SOC_DOUBLE("PDM1 Invert Switch", CS42L43_DMIC_PDM_CTRL, - CS42L43_PDM1L_INV_SHIFT, CS42L43_PDM1R_INV_SHIFT, 1, 0), -diff --git a/sound/soc/codecs/madera.c b/sound/soc/codecs/madera.c -index b9f19fbd291145..30e680ee106998 100644 ---- a/sound/soc/codecs/madera.c -+++ b/sound/soc/codecs/madera.c -@@ -2322,10 +2322,10 @@ int madera_out_ev(struct snd_soc_dapm_widget *w, - case CS42L92: - case CS47L92: - case CS47L93: -- out_up_delay = 6; -+ out_up_delay = 6000; - break; - default: -- out_up_delay = 17; -+ out_up_delay = 17000; - break; - } - -@@ -2356,7 +2356,7 @@ int madera_out_ev(struct snd_soc_dapm_widget *w, - case MADERA_OUT3R_ENA_SHIFT: - priv->out_up_pending--; - if (!priv->out_up_pending) { -- msleep(priv->out_up_delay); -+ fsleep(priv->out_up_delay); - priv->out_up_delay = 0; - } - break; -@@ -2375,7 +2375,7 @@ int madera_out_ev(struct snd_soc_dapm_widget *w, - case MADERA_OUT3L_ENA_SHIFT: - case MADERA_OUT3R_ENA_SHIFT: - priv->out_down_pending++; -- priv->out_down_delay++; -+ priv->out_down_delay += 1000; - break; - default: - break; -@@ -2392,7 +2392,7 @@ int madera_out_ev(struct snd_soc_dapm_widget *w, - case MADERA_OUT3R_ENA_SHIFT: - priv->out_down_pending--; - if (!priv->out_down_pending) { -- msleep(priv->out_down_delay); -+ fsleep(priv->out_down_delay); - priv->out_down_delay = 0; - } - break; -diff --git a/sound/soc/codecs/rt722-sdca-sdw.c b/sound/soc/codecs/rt722-sdca-sdw.c -index 91314327d9eeec..c382cb6be60256 100644 ---- a/sound/soc/codecs/rt722-sdca-sdw.c -+++ b/sound/soc/codecs/rt722-sdca-sdw.c -@@ -86,6 +86,10 @@ static bool rt722_sdca_mbq_readable_register(struct device *dev, unsigned int re - case 0x6100067: - case 0x6100070 ... 0x610007c: - case 0x6100080: -+ case SDW_SDCA_CTL(FUNC_NUM_MIC_ARRAY, RT722_SDCA_ENT_FU15, RT722_SDCA_CTL_FU_CH_GAIN, -+ CH_01) ... -+ SDW_SDCA_CTL(FUNC_NUM_MIC_ARRAY, RT722_SDCA_ENT_FU15, RT722_SDCA_CTL_FU_CH_GAIN, -+ CH_04): - case SDW_SDCA_CTL(FUNC_NUM_MIC_ARRAY, RT722_SDCA_ENT_USER_FU1E, RT722_SDCA_CTL_FU_VOLUME, - CH_01): - case SDW_SDCA_CTL(FUNC_NUM_MIC_ARRAY, RT722_SDCA_ENT_USER_FU1E, RT722_SDCA_CTL_FU_VOLUME, -diff --git a/sound/soc/codecs/tas2764.c b/sound/soc/codecs/tas2764.c -index a9838e0738cc1b..e87a07eee97377 100644 ---- a/sound/soc/codecs/tas2764.c -+++ b/sound/soc/codecs/tas2764.c -@@ -367,7 +367,7 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) - { - struct snd_soc_component *component = dai->component; - struct tas2764_priv *tas2764 = snd_soc_component_get_drvdata(component); -- u8 tdm_rx_start_slot = 0, asi_cfg_0 = 0, asi_cfg_1 = 0; -+ u8 tdm_rx_start_slot = 0, asi_cfg_0 = 0, asi_cfg_1 = 0, asi_cfg_4 = 0; - int ret; - - switch (fmt & SND_SOC_DAIFMT_INV_MASK) { -@@ -376,12 +376,14 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) - fallthrough; - case SND_SOC_DAIFMT_NB_NF: - asi_cfg_1 = TAS2764_TDM_CFG1_RX_RISING; -+ asi_cfg_4 = TAS2764_TDM_CFG4_TX_FALLING; - break; - case SND_SOC_DAIFMT_IB_IF: - asi_cfg_0 ^= TAS2764_TDM_CFG0_FRAME_START; - fallthrough; - case SND_SOC_DAIFMT_IB_NF: - asi_cfg_1 = TAS2764_TDM_CFG1_RX_FALLING; -+ asi_cfg_4 = TAS2764_TDM_CFG4_TX_RISING; - break; - } - -@@ -391,6 +393,12 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) - if (ret < 0) - return ret; - -+ ret = snd_soc_component_update_bits(component, TAS2764_TDM_CFG4, -+ TAS2764_TDM_CFG4_TX_MASK, -+ asi_cfg_4); -+ if (ret < 0) -+ return ret; -+ - switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) { - case SND_SOC_DAIFMT_I2S: - asi_cfg_0 ^= TAS2764_TDM_CFG0_FRAME_START; -diff --git a/sound/soc/codecs/tas2764.h b/sound/soc/codecs/tas2764.h -index 168af772a898ff..9490f2686e3891 100644 ---- a/sound/soc/codecs/tas2764.h -+++ b/sound/soc/codecs/tas2764.h -@@ -25,7 +25,7 @@ - - /* Power Control */ - #define TAS2764_PWR_CTRL TAS2764_REG(0X0, 0x02) --#define TAS2764_PWR_CTRL_MASK GENMASK(1, 0) -+#define TAS2764_PWR_CTRL_MASK GENMASK(2, 0) - #define TAS2764_PWR_CTRL_ACTIVE 0x0 - #define TAS2764_PWR_CTRL_MUTE BIT(0) - #define TAS2764_PWR_CTRL_SHUTDOWN BIT(1) -@@ -79,6 +79,12 @@ - #define TAS2764_TDM_CFG3_RXS_SHIFT 0x4 - #define TAS2764_TDM_CFG3_MASK GENMASK(3, 0) - -+/* TDM Configuration Reg4 */ -+#define TAS2764_TDM_CFG4 TAS2764_REG(0X0, 0x0d) -+#define TAS2764_TDM_CFG4_TX_MASK BIT(0) -+#define TAS2764_TDM_CFG4_TX_RISING 0x0 -+#define TAS2764_TDM_CFG4_TX_FALLING BIT(0) -+ - /* TDM Configuration Reg5 */ - #define TAS2764_TDM_CFG5 TAS2764_REG(0X0, 0x0e) - #define TAS2764_TDM_CFG5_VSNS_MASK BIT(6) -diff --git a/sound/soc/codecs/tas2770.c b/sound/soc/codecs/tas2770.c -index 99bf402eb56673..5c6b825c757b33 100644 ---- a/sound/soc/codecs/tas2770.c -+++ b/sound/soc/codecs/tas2770.c -@@ -508,7 +508,7 @@ static int tas2770_codec_probe(struct snd_soc_component *component) - } - - static DECLARE_TLV_DB_SCALE(tas2770_digital_tlv, 1100, 50, 0); --static DECLARE_TLV_DB_SCALE(tas2770_playback_volume, -12750, 50, 0); -+static DECLARE_TLV_DB_SCALE(tas2770_playback_volume, -10050, 50, 0); - - static const struct snd_kcontrol_new tas2770_snd_controls[] = { - SOC_SINGLE_TLV("Speaker Playback Volume", TAS2770_PLAY_CFG_REG2, -diff --git a/sound/soc/codecs/wm0010.c b/sound/soc/codecs/wm0010.c -index 1d4259433f47e7..6b67edd528bc53 100644 ---- a/sound/soc/codecs/wm0010.c -+++ b/sound/soc/codecs/wm0010.c -@@ -951,7 +951,7 @@ static int wm0010_spi_probe(struct spi_device *spi) - if (ret) { - dev_err(wm0010->dev, "Failed to set IRQ %d as wake source: %d\n", - irq, ret); -- return ret; -+ goto free_irq; - } - - if (spi->max_speed_hz) -@@ -963,9 +963,18 @@ static int wm0010_spi_probe(struct spi_device *spi) - &soc_component_dev_wm0010, wm0010_dai, - ARRAY_SIZE(wm0010_dai)); - if (ret < 0) -- return ret; -+ goto disable_irq_wake; - - return 0; -+ -+disable_irq_wake: -+ irq_set_irq_wake(wm0010->irq, 0); -+ -+free_irq: -+ if (wm0010->irq) -+ free_irq(wm0010->irq, wm0010); -+ -+ return ret; - } - - static void wm0010_spi_remove(struct spi_device *spi) -diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c -index ac1f2c85034650..da5933fbdbf8a8 100644 ---- a/sound/soc/codecs/wm5110.c -+++ b/sound/soc/codecs/wm5110.c -@@ -302,7 +302,7 @@ static int wm5110_hp_pre_enable(struct snd_soc_dapm_widget *w) - } else { - wseq = wm5110_no_dre_left_enable; - nregs = ARRAY_SIZE(wm5110_no_dre_left_enable); -- priv->out_up_delay += 10; -+ priv->out_up_delay += 10000; - } - break; - case ARIZONA_OUT1R_ENA_SHIFT: -@@ -312,7 +312,7 @@ static int wm5110_hp_pre_enable(struct snd_soc_dapm_widget *w) - } else { - wseq = wm5110_no_dre_right_enable; - nregs = ARRAY_SIZE(wm5110_no_dre_right_enable); -- priv->out_up_delay += 10; -+ priv->out_up_delay += 10000; - } - break; - default: -@@ -338,7 +338,7 @@ static int wm5110_hp_pre_disable(struct snd_soc_dapm_widget *w) - snd_soc_component_update_bits(component, - ARIZONA_SPARE_TRIGGERS, - ARIZONA_WS_TRG1, 0); -- priv->out_down_delay += 27; -+ priv->out_down_delay += 27000; - } - break; - case ARIZONA_OUT1R_ENA_SHIFT: -@@ -350,7 +350,7 @@ static int wm5110_hp_pre_disable(struct snd_soc_dapm_widget *w) - snd_soc_component_update_bits(component, - ARIZONA_SPARE_TRIGGERS, - ARIZONA_WS_TRG2, 0); -- priv->out_down_delay += 27; -+ priv->out_down_delay += 27000; - } - break; - default: -diff --git a/sound/soc/generic/simple-card-utils.c b/sound/soc/generic/simple-card-utils.c -index 2588ec735dbdf2..598b0000df244d 100644 ---- a/sound/soc/generic/simple-card-utils.c -+++ b/sound/soc/generic/simple-card-utils.c -@@ -1086,6 +1086,7 @@ int asoc_graph_parse_dai(struct device *dev, struct device_node *ep, - args.np = ep; - dai = snd_soc_get_dai_via_args(&args); - if (dai) { -+ dlc->of_node = node; - dlc->dai_name = snd_soc_dai_name_get(dai); - dlc->dai_args = snd_soc_copy_dai_args(dev, &args); - if (!dlc->dai_args) -diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c -index 98c7be340a536d..3cd14fbca28eae 100644 ---- a/sound/soc/sh/rcar/core.c -+++ b/sound/soc/sh/rcar/core.c -@@ -1775,20 +1775,6 @@ int rsnd_kctrl_accept_anytime(struct rsnd_dai_stream *io) - return 1; - } - --int rsnd_kctrl_accept_runtime(struct rsnd_dai_stream *io) --{ -- struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io); -- struct rsnd_priv *priv = rsnd_io_to_priv(io); -- struct device *dev = rsnd_priv_to_dev(priv); -- -- if (!runtime) { -- dev_warn(dev, "Can't update kctrl when idle\n"); -- return 0; -- } -- -- return 1; --} -- - struct rsnd_kctrl_cfg *rsnd_kctrl_init_m(struct rsnd_kctrl_cfg_m *cfg) - { - cfg->cfg.val = cfg->val; -diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h -index 43c0d675cc3433..1214dbba6898b1 100644 ---- a/sound/soc/sh/rcar/rsnd.h -+++ b/sound/soc/sh/rcar/rsnd.h -@@ -755,7 +755,6 @@ struct rsnd_kctrl_cfg_s { - #define rsnd_kctrl_vals(x) ((x).val) /* = (x).cfg.val[0] */ - - int rsnd_kctrl_accept_anytime(struct rsnd_dai_stream *io); --int rsnd_kctrl_accept_runtime(struct rsnd_dai_stream *io); - struct rsnd_kctrl_cfg *rsnd_kctrl_init_m(struct rsnd_kctrl_cfg_m *cfg); - struct rsnd_kctrl_cfg *rsnd_kctrl_init_s(struct rsnd_kctrl_cfg_s *cfg); - int rsnd_kctrl_new(struct rsnd_mod *mod, -diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c -index f832165e46bc04..e985681363e25c 100644 ---- a/sound/soc/sh/rcar/src.c -+++ b/sound/soc/sh/rcar/src.c -@@ -34,6 +34,7 @@ struct rsnd_src { - struct rsnd_mod *dma; - struct rsnd_kctrl_cfg_s sen; /* sync convert enable */ - struct rsnd_kctrl_cfg_s sync; /* sync convert */ -+ u32 current_sync_rate; - int irq; - }; - -@@ -99,7 +100,7 @@ static u32 rsnd_src_convert_rate(struct rsnd_dai_stream *io, - if (!rsnd_src_sync_is_enabled(mod)) - return rsnd_io_converted_rate(io); - -- convert_rate = src->sync.val; -+ convert_rate = src->current_sync_rate; - - if (!convert_rate) - convert_rate = rsnd_io_converted_rate(io); -@@ -200,13 +201,73 @@ static const u32 chan222222[] = { - static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io, - struct rsnd_mod *mod) - { -+ struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io); - struct rsnd_priv *priv = rsnd_mod_to_priv(mod); -- struct device *dev = rsnd_priv_to_dev(priv); -+ struct rsnd_src *src = rsnd_mod_to_src(mod); -+ u32 fin, fout, new_rate; -+ int inc, cnt, rate; -+ u64 base, val; -+ -+ if (!runtime) -+ return; -+ -+ if (!rsnd_src_sync_is_enabled(mod)) -+ return; -+ -+ fin = rsnd_src_get_in_rate(priv, io); -+ fout = rsnd_src_get_out_rate(priv, io); -+ -+ new_rate = src->sync.val; -+ -+ if (!new_rate) -+ new_rate = fout; -+ -+ /* Do nothing if no diff */ -+ if (new_rate == src->current_sync_rate) -+ return; -+ -+ /* -+ * SRCm_IFSVR::INTIFS can change within 1% -+ * see -+ * SRCm_IFSVR::INTIFS Note -+ */ -+ inc = fout / 100; -+ cnt = abs(new_rate - fout) / inc; -+ if (fout > new_rate) -+ inc *= -1; -+ -+ /* -+ * After start running SRC, we can update only SRC_IFSVR -+ * for Synchronous Mode -+ */ -+ base = (u64)0x0400000 * fin; -+ rate = fout; -+ for (int i = 0; i < cnt; i++) { -+ val = base; -+ rate += inc; -+ do_div(val, rate); -+ -+ rsnd_mod_write(mod, SRC_IFSVR, val); -+ } -+ val = base; -+ do_div(val, new_rate); -+ -+ rsnd_mod_write(mod, SRC_IFSVR, val); -+ -+ /* update current_sync_rate */ -+ src->current_sync_rate = new_rate; -+} -+ -+static void rsnd_src_init_convert_rate(struct rsnd_dai_stream *io, -+ struct rsnd_mod *mod) -+{ - struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io); -+ struct rsnd_priv *priv = rsnd_mod_to_priv(mod); -+ struct device *dev = rsnd_priv_to_dev(priv); - int is_play = rsnd_io_is_play(io); - int use_src = 0; - u32 fin, fout; -- u32 ifscr, fsrate, adinr; -+ u32 ifscr, adinr; - u32 cr, route; - u32 i_busif, o_busif, tmp; - const u32 *bsdsr_table; -@@ -244,26 +305,15 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io, - adinr = rsnd_get_adinr_bit(mod, io) | chan; - - /* -- * SRC_IFSCR / SRC_IFSVR -- */ -- ifscr = 0; -- fsrate = 0; -- if (use_src) { -- u64 n; -- -- ifscr = 1; -- n = (u64)0x0400000 * fin; -- do_div(n, fout); -- fsrate = n; -- } -- -- /* -+ * SRC_IFSCR - * SRC_SRCCR / SRC_ROUTE_MODE0 - */ -+ ifscr = 0; - cr = 0x00011110; - route = 0x0; - if (use_src) { - route = 0x1; -+ ifscr = 0x1; - - if (rsnd_src_sync_is_enabled(mod)) { - cr |= 0x1; -@@ -334,7 +384,6 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io, - rsnd_mod_write(mod, SRC_SRCIR, 1); /* initialize */ - rsnd_mod_write(mod, SRC_ADINR, adinr); - rsnd_mod_write(mod, SRC_IFSCR, ifscr); -- rsnd_mod_write(mod, SRC_IFSVR, fsrate); - rsnd_mod_write(mod, SRC_SRCCR, cr); - rsnd_mod_write(mod, SRC_BSDSR, bsdsr_table[idx]); - rsnd_mod_write(mod, SRC_BSISR, bsisr_table[idx]); -@@ -347,6 +396,9 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io, - - rsnd_adg_set_src_timesel_gen2(mod, io, fin, fout); - -+ /* update SRC_IFSVR */ -+ rsnd_src_set_convert_rate(io, mod); -+ - return; - - convert_rate_err: -@@ -466,7 +518,8 @@ static int rsnd_src_init(struct rsnd_mod *mod, - int ret; - - /* reset sync convert_rate */ -- src->sync.val = 0; -+ src->sync.val = -+ src->current_sync_rate = 0; - - ret = rsnd_mod_power_on(mod); - if (ret < 0) -@@ -474,7 +527,7 @@ static int rsnd_src_init(struct rsnd_mod *mod, - - rsnd_src_activation(mod); - -- rsnd_src_set_convert_rate(io, mod); -+ rsnd_src_init_convert_rate(io, mod); - - rsnd_src_status_clear(mod); - -@@ -492,7 +545,8 @@ static int rsnd_src_quit(struct rsnd_mod *mod, - rsnd_mod_power_off(mod); - - /* reset sync convert_rate */ -- src->sync.val = 0; -+ src->sync.val = -+ src->current_sync_rate = 0; - - return 0; - } -@@ -530,6 +584,22 @@ static irqreturn_t rsnd_src_interrupt(int irq, void *data) - return IRQ_HANDLED; - } - -+static int rsnd_src_kctrl_accept_runtime(struct rsnd_dai_stream *io) -+{ -+ struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io); -+ -+ if (!runtime) { -+ struct rsnd_priv *priv = rsnd_io_to_priv(io); -+ struct device *dev = rsnd_priv_to_dev(priv); -+ -+ dev_warn(dev, "\"SRC Out Rate\" can use during running\n"); -+ -+ return 0; -+ } -+ -+ return 1; -+} -+ - static int rsnd_src_probe_(struct rsnd_mod *mod, - struct rsnd_dai_stream *io, - struct rsnd_priv *priv) -@@ -584,7 +654,7 @@ static int rsnd_src_pcm_new(struct rsnd_mod *mod, - "SRC Out Rate Switch" : - "SRC In Rate Switch", - rsnd_kctrl_accept_anytime, -- rsnd_src_set_convert_rate, -+ rsnd_src_init_convert_rate, - &src->sen, 1); - if (ret < 0) - return ret; -@@ -593,7 +663,7 @@ static int rsnd_src_pcm_new(struct rsnd_mod *mod, - rsnd_io_is_play(io) ? - "SRC Out Rate" : - "SRC In Rate", -- rsnd_kctrl_accept_runtime, -+ rsnd_src_kctrl_accept_runtime, - rsnd_src_set_convert_rate, - &src->sync, 192000); - -diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c -index 690ac0d6ef41a8..2a9e8d20c23c36 100644 ---- a/sound/soc/sh/rcar/ssi.c -+++ b/sound/soc/sh/rcar/ssi.c -@@ -334,7 +334,8 @@ static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod, - return 0; - - rate_err: -- dev_err(dev, "unsupported clock rate\n"); -+ dev_err(dev, "unsupported clock rate (%d)\n", rate); -+ - return ret; - } - -diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c -index b27e89ff6a1673..b4cfc34d00ee63 100644 ---- a/sound/soc/soc-ops.c -+++ b/sound/soc/soc-ops.c -@@ -336,7 +336,7 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol, - if (ucontrol->value.integer.value[0] < 0) - return -EINVAL; - val = ucontrol->value.integer.value[0]; -- if (mc->platform_max && ((int)val + min) > mc->platform_max) -+ if (mc->platform_max && val > mc->platform_max) - return -EINVAL; - if (val > max - min) - return -EINVAL; -@@ -349,7 +349,7 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol, - if (ucontrol->value.integer.value[1] < 0) - return -EINVAL; - val2 = ucontrol->value.integer.value[1]; -- if (mc->platform_max && ((int)val2 + min) > mc->platform_max) -+ if (mc->platform_max && val2 > mc->platform_max) - return -EINVAL; - if (val2 > max - min) - return -EINVAL; -@@ -502,17 +502,16 @@ int snd_soc_info_volsw_range(struct snd_kcontrol *kcontrol, - { - struct soc_mixer_control *mc = - (struct soc_mixer_control *)kcontrol->private_value; -- int platform_max; -- int min = mc->min; -+ int max; - -- if (!mc->platform_max) -- mc->platform_max = mc->max; -- platform_max = mc->platform_max; -+ max = mc->max - mc->min; -+ if (mc->platform_max && mc->platform_max < max) -+ max = mc->platform_max; - - uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER; - uinfo->count = snd_soc_volsw_is_stereo(mc) ? 2 : 1; - uinfo->value.integer.min = 0; -- uinfo->value.integer.max = platform_max - min; -+ uinfo->value.integer.max = max; - - return 0; - } -diff --git a/sound/soc/sof/amd/acp-ipc.c b/sound/soc/sof/amd/acp-ipc.c -index fcb54f545fea3d..a4e9bc20adaff6 100644 ---- a/sound/soc/sof/amd/acp-ipc.c -+++ b/sound/soc/sof/amd/acp-ipc.c -@@ -167,6 +167,7 @@ irqreturn_t acp_sof_ipc_irq_thread(int irq, void *context) - - if (sdev->first_boot && sdev->fw_state != SOF_FW_BOOT_COMPLETE) { - acp_mailbox_read(sdev, sdev->dsp_box.offset, &status, sizeof(status)); -+ - if ((status & SOF_IPC_PANIC_MAGIC_MASK) == SOF_IPC_PANIC_MAGIC) { - snd_sof_dsp_panic(sdev, sdev->dsp_box.offset + sizeof(status), - true); -@@ -188,13 +189,21 @@ irqreturn_t acp_sof_ipc_irq_thread(int irq, void *context) - - dsp_ack = snd_sof_dsp_read(sdev, ACP_DSP_BAR, ACP_SCRATCH_REG_0 + dsp_ack_write); - if (dsp_ack) { -- spin_lock_irq(&sdev->ipc_lock); -- /* handle immediate reply from DSP core */ -- acp_dsp_ipc_get_reply(sdev); -- snd_sof_ipc_reply(sdev, 0); -- /* set the done bit */ -- acp_dsp_ipc_dsp_done(sdev); -- spin_unlock_irq(&sdev->ipc_lock); -+ if (likely(sdev->fw_state == SOF_FW_BOOT_COMPLETE)) { -+ spin_lock_irq(&sdev->ipc_lock); -+ -+ /* handle immediate reply from DSP core */ -+ acp_dsp_ipc_get_reply(sdev); -+ snd_sof_ipc_reply(sdev, 0); -+ /* set the done bit */ -+ acp_dsp_ipc_dsp_done(sdev); -+ -+ spin_unlock_irq(&sdev->ipc_lock); -+ } else { -+ dev_dbg_ratelimited(sdev->dev, "IPC reply before FW_BOOT_COMPLETE: %#x\n", -+ dsp_ack); -+ } -+ - ipc_irq = true; - } - -diff --git a/sound/soc/sof/intel/hda-codec.c b/sound/soc/sof/intel/hda-codec.c -index 328d7c227b2184..82a6707fb4b800 100644 ---- a/sound/soc/sof/intel/hda-codec.c -+++ b/sound/soc/sof/intel/hda-codec.c -@@ -444,6 +444,7 @@ int hda_codec_i915_exit(struct snd_sof_dev *sdev) - } - EXPORT_SYMBOL_NS_GPL(hda_codec_i915_exit, SND_SOC_SOF_HDA_AUDIO_CODEC_I915); - -+MODULE_SOFTDEP("pre: snd-hda-codec-hdmi"); - #endif - - MODULE_LICENSE("Dual BSD/GPL"); -diff --git a/tools/objtool/check.c b/tools/objtool/check.c -index 1b242c3c2d4515..6e59e7f578ffe2 100644 ---- a/tools/objtool/check.c -+++ b/tools/objtool/check.c -@@ -2028,6 +2028,14 @@ static int add_jump_table(struct objtool_file *file, struct instruction *insn, - reloc_addend(reloc) == pfunc->offset) - break; - -+ /* -+ * Clang sometimes leaves dangling unused jump table entries -+ * which point to the end of the function. Ignore them. -+ */ -+ if (reloc->sym->sec == pfunc->sec && -+ reloc_addend(reloc) == pfunc->offset + pfunc->len) -+ goto next; -+ - dest_insn = find_insn(file, reloc->sym->sec, reloc_addend(reloc)); - if (!dest_insn) - break; -@@ -2045,6 +2053,7 @@ static int add_jump_table(struct objtool_file *file, struct instruction *insn, - alt->insn = dest_insn; - alt->next = insn->alts; - insn->alts = alt; -+next: - prev_offset = reloc_offset(reloc); - } - -diff --git a/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c b/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c -index dda7060e86a097..b16d765a153a95 100644 ---- a/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c -+++ b/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c -@@ -402,8 +402,8 @@ static void test_sockmap_skb_verdict_shutdown(void) - if (!ASSERT_EQ(err, 1, "epoll_wait(fd)")) - goto out_close; - -- n = recv(c1, &b, 1, SOCK_NONBLOCK); -- ASSERT_EQ(n, 0, "recv_timeout(fin)"); -+ n = recv(c1, &b, 1, MSG_DONTWAIT); -+ ASSERT_EQ(n, 0, "recv(fin)"); - out_close: - close(c1); - close(p1); -@@ -459,7 +459,7 @@ static void test_sockmap_skb_verdict_fionread(bool pass_prog) - ASSERT_EQ(avail, expected, "ioctl(FIONREAD)"); - /* On DROP test there will be no data to read */ - if (pass_prog) { -- recvd = recv_timeout(c1, &buf, sizeof(buf), SOCK_NONBLOCK, IO_TIMEOUT_SEC); -+ recvd = recv_timeout(c1, &buf, sizeof(buf), MSG_DONTWAIT, IO_TIMEOUT_SEC); - ASSERT_EQ(recvd, sizeof(buf), "recv_timeout(c0)"); - } - diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.084-085.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.084-085.patch deleted file mode 100644 index 5a32423219..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.084-085.patch +++ /dev/null @@ -1,3361 +0,0 @@ -diff --git a/Makefile b/Makefile -index dfef2497467b83..bb3bd3c9072059 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 84 -+SUBLEVEL = 85 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm/boot/dts/broadcom/bcm2711.dtsi b/arch/arm/boot/dts/broadcom/bcm2711.dtsi -index 4a379a14966d8d..8a0600e659ee19 100644 ---- a/arch/arm/boot/dts/broadcom/bcm2711.dtsi -+++ b/arch/arm/boot/dts/broadcom/bcm2711.dtsi -@@ -134,7 +134,7 @@ uart2: serial@7e201400 { - clocks = <&clocks BCM2835_CLOCK_UART>, - <&clocks BCM2835_CLOCK_VPU>; - clock-names = "uartclk", "apb_pclk"; -- arm,primecell-periphid = <0x00241011>; -+ arm,primecell-periphid = <0x00341011>; - status = "disabled"; - }; - -@@ -145,7 +145,7 @@ uart3: serial@7e201600 { - clocks = <&clocks BCM2835_CLOCK_UART>, - <&clocks BCM2835_CLOCK_VPU>; - clock-names = "uartclk", "apb_pclk"; -- arm,primecell-periphid = <0x00241011>; -+ arm,primecell-periphid = <0x00341011>; - status = "disabled"; - }; - -@@ -156,7 +156,7 @@ uart4: serial@7e201800 { - clocks = <&clocks BCM2835_CLOCK_UART>, - <&clocks BCM2835_CLOCK_VPU>; - clock-names = "uartclk", "apb_pclk"; -- arm,primecell-periphid = <0x00241011>; -+ arm,primecell-periphid = <0x00341011>; - status = "disabled"; - }; - -@@ -167,7 +167,7 @@ uart5: serial@7e201a00 { - clocks = <&clocks BCM2835_CLOCK_UART>, - <&clocks BCM2835_CLOCK_VPU>; - clock-names = "uartclk", "apb_pclk"; -- arm,primecell-periphid = <0x00241011>; -+ arm,primecell-periphid = <0x00341011>; - status = "disabled"; - }; - -@@ -451,8 +451,6 @@ IRQ_TYPE_LEVEL_LOW)>, - IRQ_TYPE_LEVEL_LOW)>, - ; -- /* This only applies to the ARMv7 stub */ -- arm,cpu-registers-not-fw-configured; - }; - - cpus: cpus { -@@ -1155,6 +1153,7 @@ &txp { - }; - - &uart0 { -+ arm,primecell-periphid = <0x00341011>; - interrupts = ; - }; - -diff --git a/arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi b/arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi -index dcb4f6a32f8092..f492075870ed5f 100644 ---- a/arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi -+++ b/arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi -@@ -101,6 +101,11 @@ lvds_panel_in: endpoint { - }; - }; - -+ poweroff { -+ compatible = "regulator-poweroff"; -+ cpu-supply = <&vgen2_reg>; -+ }; -+ - reg_module_3v3: regulator-module-3v3 { - compatible = "regulator-fixed"; - regulator-always-on; -@@ -220,10 +225,6 @@ &can2 { - status = "disabled"; - }; - --&clks { -- fsl,pmic-stby-poweroff; --}; -- - /* Apalis SPI1 */ - &ecspi1 { - cs-gpios = <&gpio5 25 GPIO_ACTIVE_LOW>; -@@ -511,7 +512,6 @@ &i2c2 { - - pmic: pmic@8 { - compatible = "fsl,pfuze100"; -- fsl,pmic-stby-poweroff; - reg = <0x08>; - - regulators { -diff --git a/arch/arm/mach-davinci/Kconfig b/arch/arm/mach-davinci/Kconfig -index 2a8a9fe46586d2..3fa15f3422409a 100644 ---- a/arch/arm/mach-davinci/Kconfig -+++ b/arch/arm/mach-davinci/Kconfig -@@ -27,6 +27,7 @@ config ARCH_DAVINCI_DA830 - - config ARCH_DAVINCI_DA850 - bool "DA850/OMAP-L138/AM18x based system" -+ select ARCH_DAVINCI_DA8XX - select DAVINCI_CP_INTC - - config ARCH_DAVINCI_DA8XX -diff --git a/arch/arm/mach-omap1/Kconfig b/arch/arm/mach-omap1/Kconfig -index cbf703f0d850f6..c5bd2535e0f4ca 100644 ---- a/arch/arm/mach-omap1/Kconfig -+++ b/arch/arm/mach-omap1/Kconfig -@@ -9,6 +9,7 @@ menuconfig ARCH_OMAP1 - select ARCH_OMAP - select CLKSRC_MMIO - select FORCE_PCI if PCCARD -+ select GENERIC_IRQ_CHIP - select GPIOLIB - help - Support for older TI OMAP1 (omap7xx, omap15xx or omap16xx) -diff --git a/arch/arm/mach-shmobile/headsmp.S b/arch/arm/mach-shmobile/headsmp.S -index a956b489b6ea12..2bc7e73a8582d2 100644 ---- a/arch/arm/mach-shmobile/headsmp.S -+++ b/arch/arm/mach-shmobile/headsmp.S -@@ -136,6 +136,7 @@ ENDPROC(shmobile_smp_sleep) - .long shmobile_smp_arg - 1b - - .bss -+ .align 2 - .globl shmobile_smp_mpidr - shmobile_smp_mpidr: - .space NR_CPUS * 4 -diff --git a/arch/arm64/boot/dts/freescale/imx8mm-verdin-dahlia.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-verdin-dahlia.dtsi -index 1cff0b829357ed..ac97c09b204d7e 100644 ---- a/arch/arm64/boot/dts/freescale/imx8mm-verdin-dahlia.dtsi -+++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin-dahlia.dtsi -@@ -16,10 +16,10 @@ sound_card: sound-card { - "Headphone Jack", "HPOUTR", - "IN2L", "Line In Jack", - "IN2R", "Line In Jack", -- "Headphone Jack", "MICBIAS", -- "IN1L", "Headphone Jack"; -+ "Microphone Jack", "MICBIAS", -+ "IN1L", "Microphone Jack"; - simple-audio-card,widgets = -- "Microphone", "Headphone Jack", -+ "Microphone", "Microphone Jack", - "Headphone", "Headphone Jack", - "Line", "Line In Jack"; - -diff --git a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi -index ebc29a950ba9a7..e9413c9ccafc59 100644 ---- a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi -+++ b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi -@@ -1,7 +1,8 @@ - // SPDX-License-Identifier: GPL-2.0-or-later OR MIT - /* -- * Copyright 2021-2022 TQ-Systems GmbH -- * Author: Alexander Stein -+ * Copyright 2021-2025 TQ-Systems GmbH , -+ * D-82229 Seefeld, Germany. -+ * Author: Alexander Stein - */ - - #include "imx8mp.dtsi" -@@ -23,15 +24,6 @@ reg_vcc3v3: regulator-vcc3v3 { - regulator-max-microvolt = <3300000>; - regulator-always-on; - }; -- -- /* e-MMC IO, needed for HS modes */ -- reg_vcc1v8: regulator-vcc1v8 { -- compatible = "regulator-fixed"; -- regulator-name = "VCC1V8"; -- regulator-min-microvolt = <1800000>; -- regulator-max-microvolt = <1800000>; -- regulator-always-on; -- }; - }; - - &A53_0 { -@@ -193,7 +185,7 @@ &usdhc3 { - no-sd; - no-sdio; - vmmc-supply = <®_vcc3v3>; -- vqmmc-supply = <®_vcc1v8>; -+ vqmmc-supply = <&buck5_reg>; - status = "okay"; - }; - -diff --git a/arch/arm64/boot/dts/freescale/imx8mp-verdin-dahlia.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-verdin-dahlia.dtsi -index 7e9e4b13b5c50d..437f8557768a83 100644 ---- a/arch/arm64/boot/dts/freescale/imx8mp-verdin-dahlia.dtsi -+++ b/arch/arm64/boot/dts/freescale/imx8mp-verdin-dahlia.dtsi -@@ -16,10 +16,10 @@ sound { - "Headphone Jack", "HPOUTR", - "IN2L", "Line In Jack", - "IN2R", "Line In Jack", -- "Headphone Jack", "MICBIAS", -- "IN1L", "Headphone Jack"; -+ "Microphone Jack", "MICBIAS", -+ "IN1L", "Microphone Jack"; - simple-audio-card,widgets = -- "Microphone", "Headphone Jack", -+ "Microphone", "Microphone Jack", - "Headphone", "Headphone Jack", - "Line", "Line In Jack"; - -diff --git a/arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts b/arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts -index 56f73c17363fd0..776c2236da6eda 100644 ---- a/arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts -+++ b/arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts -@@ -221,6 +221,8 @@ &u2phy_otg { - }; - - &uart0 { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&uart0_xfer>; - status = "okay"; - }; - -diff --git a/arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts b/arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts -index fe5b526100107a..6a6b36c36ce215 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts -+++ b/arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts -@@ -117,7 +117,7 @@ &u2phy0_host { - }; - - &u2phy1_host { -- status = "disabled"; -+ phy-supply = <&vdd_5v>; - }; - - &uart0 { -diff --git a/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts b/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts -index c1e611c040a2c4..df68a59694fb25 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts -+++ b/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts -@@ -513,7 +513,6 @@ &sdhci { - - &sdmmc0 { - max-frequency = <150000000>; -- supports-sd; - bus-width = <4>; - cap-mmc-highspeed; - cap-sd-highspeed; -diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h -index b84ed3ad91a9eb..df73e452d2cc0e 100644 ---- a/arch/arm64/include/asm/kvm_host.h -+++ b/arch/arm64/include/asm/kvm_host.h -@@ -73,6 +73,7 @@ static inline enum kvm_mode kvm_get_mode(void) { return KVM_MODE_NONE; }; - #endif - - extern unsigned int __ro_after_init kvm_sve_max_vl; -+extern unsigned int __ro_after_init kvm_host_sve_max_vl; - int __init kvm_arm_init_sve(void); - - u32 __attribute_const__ kvm_target_cpu(void); -@@ -486,7 +487,6 @@ struct kvm_vcpu_arch { - /* Values of trap registers for the guest. */ - u64 hcr_el2; - u64 mdcr_el2; -- u64 cptr_el2; - - /* Values of trap registers for the host before guest entry. */ - u64 mdcr_el2_host; -@@ -536,7 +536,6 @@ struct kvm_vcpu_arch { - struct kvm_guest_debug_arch vcpu_debug_state; - struct kvm_guest_debug_arch external_debug_state; - -- struct user_fpsimd_state *host_fpsimd_state; /* hyp VA */ - struct task_struct *parent_task; - - struct { -@@ -719,10 +718,6 @@ struct kvm_vcpu_arch { - /* vcpu running in HYP context */ - #define VCPU_HYP_CONTEXT __vcpu_single_flag(iflags, BIT(7)) - --/* SVE enabled for host EL0 */ --#define HOST_SVE_ENABLED __vcpu_single_flag(sflags, BIT(0)) --/* SME enabled for EL0 */ --#define HOST_SME_ENABLED __vcpu_single_flag(sflags, BIT(1)) - /* Physical CPU not in supported_cpus */ - #define ON_UNSUPPORTED_CPU __vcpu_single_flag(sflags, BIT(2)) - /* WFIT instruction trapped */ -diff --git a/arch/arm64/include/asm/kvm_hyp.h b/arch/arm64/include/asm/kvm_hyp.h -index 66efd67ea7e8d6..51cd106cd840a0 100644 ---- a/arch/arm64/include/asm/kvm_hyp.h -+++ b/arch/arm64/include/asm/kvm_hyp.h -@@ -145,5 +145,6 @@ extern u64 kvm_nvhe_sym(id_aa64smfr0_el1_sys_val); - - extern unsigned long kvm_nvhe_sym(__icache_flags); - extern unsigned int kvm_nvhe_sym(kvm_arm_vmid_bits); -+extern unsigned int kvm_nvhe_sym(kvm_host_sve_max_vl); - - #endif /* __ARM64_KVM_HYP_H__ */ -diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c -index 0137d987631e08..bd4f6c6ee0f318 100644 ---- a/arch/arm64/kernel/fpsimd.c -+++ b/arch/arm64/kernel/fpsimd.c -@@ -1707,31 +1707,6 @@ void fpsimd_signal_preserve_current_state(void) - sve_to_fpsimd(current); - } - --/* -- * Called by KVM when entering the guest. -- */ --void fpsimd_kvm_prepare(void) --{ -- if (!system_supports_sve()) -- return; -- -- /* -- * KVM does not save host SVE state since we can only enter -- * the guest from a syscall so the ABI means that only the -- * non-saved SVE state needs to be saved. If we have left -- * SVE enabled for performance reasons then update the task -- * state to be FPSIMD only. -- */ -- get_cpu_fpsimd_context(); -- -- if (test_and_clear_thread_flag(TIF_SVE)) { -- sve_to_fpsimd(current); -- current->thread.fp_type = FP_STATE_FPSIMD; -- } -- -- put_cpu_fpsimd_context(); --} -- - /* - * Associate current's FPSIMD context with this cpu - * The caller must have ownership of the cpu FPSIMD context before calling -diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c -index ffdc2c4d07ee83..9818cde948ca9c 100644 ---- a/arch/arm64/kvm/arm.c -+++ b/arch/arm64/kvm/arm.c -@@ -1309,7 +1309,6 @@ static int kvm_arch_vcpu_ioctl_vcpu_init(struct kvm_vcpu *vcpu, - } - - vcpu_reset_hcr(vcpu); -- vcpu->arch.cptr_el2 = kvm_get_reset_cptr_el2(vcpu); - - /* - * Handle the "start in power-off" case. -diff --git a/arch/arm64/kvm/fpsimd.c b/arch/arm64/kvm/fpsimd.c -index 8c1d0d4853df48..e57db49ea468e4 100644 ---- a/arch/arm64/kvm/fpsimd.c -+++ b/arch/arm64/kvm/fpsimd.c -@@ -49,8 +49,6 @@ int kvm_arch_vcpu_run_map_fp(struct kvm_vcpu *vcpu) - if (ret) - return ret; - -- vcpu->arch.host_fpsimd_state = kern_hyp_va(fpsimd); -- - /* - * We need to keep current's task_struct pinned until its data has been - * unshared with the hypervisor to make sure it is not re-used by the -@@ -79,41 +77,16 @@ void kvm_arch_vcpu_load_fp(struct kvm_vcpu *vcpu) - if (!system_supports_fpsimd()) - return; - -- fpsimd_kvm_prepare(); -- - /* -- * We will check TIF_FOREIGN_FPSTATE just before entering the -- * guest in kvm_arch_vcpu_ctxflush_fp() and override this to -- * FP_STATE_FREE if the flag set. -+ * Ensure that any host FPSIMD/SVE/SME state is saved and unbound such -+ * that the host kernel is responsible for restoring this state upon -+ * return to userspace, and the hyp code doesn't need to save anything. -+ * -+ * When the host may use SME, fpsimd_save_and_flush_cpu_state() ensures -+ * that PSTATE.{SM,ZA} == {0,0}. - */ -- vcpu->arch.fp_state = FP_STATE_HOST_OWNED; -- -- vcpu_clear_flag(vcpu, HOST_SVE_ENABLED); -- if (read_sysreg(cpacr_el1) & CPACR_EL1_ZEN_EL0EN) -- vcpu_set_flag(vcpu, HOST_SVE_ENABLED); -- -- if (system_supports_sme()) { -- vcpu_clear_flag(vcpu, HOST_SME_ENABLED); -- if (read_sysreg(cpacr_el1) & CPACR_EL1_SMEN_EL0EN) -- vcpu_set_flag(vcpu, HOST_SME_ENABLED); -- -- /* -- * If PSTATE.SM is enabled then save any pending FP -- * state and disable PSTATE.SM. If we leave PSTATE.SM -- * enabled and the guest does not enable SME via -- * CPACR_EL1.SMEN then operations that should be valid -- * may generate SME traps from EL1 to EL1 which we -- * can't intercept and which would confuse the guest. -- * -- * Do the same for PSTATE.ZA in the case where there -- * is state in the registers which has not already -- * been saved, this is very unlikely to happen. -- */ -- if (read_sysreg_s(SYS_SVCR) & (SVCR_SM_MASK | SVCR_ZA_MASK)) { -- vcpu->arch.fp_state = FP_STATE_FREE; -- fpsimd_save_and_flush_cpu_state(); -- } -- } -+ fpsimd_save_and_flush_cpu_state(); -+ vcpu->arch.fp_state = FP_STATE_FREE; - } - - /* -@@ -178,46 +151,18 @@ void kvm_arch_vcpu_put_fp(struct kvm_vcpu *vcpu) - - local_irq_save(flags); - -- /* -- * If we have VHE then the Hyp code will reset CPACR_EL1 to -- * the default value and we need to reenable SME. -- */ -- if (has_vhe() && system_supports_sme()) { -- /* Also restore EL0 state seen on entry */ -- if (vcpu_get_flag(vcpu, HOST_SME_ENABLED)) -- sysreg_clear_set(CPACR_EL1, 0, -- CPACR_EL1_SMEN_EL0EN | -- CPACR_EL1_SMEN_EL1EN); -- else -- sysreg_clear_set(CPACR_EL1, -- CPACR_EL1_SMEN_EL0EN, -- CPACR_EL1_SMEN_EL1EN); -- isb(); -- } -- - if (vcpu->arch.fp_state == FP_STATE_GUEST_OWNED) { -- if (vcpu_has_sve(vcpu)) { -- __vcpu_sys_reg(vcpu, ZCR_EL1) = read_sysreg_el1(SYS_ZCR); -- -- /* Restore the VL that was saved when bound to the CPU */ -- if (!has_vhe()) -- sve_cond_update_zcr_vq(vcpu_sve_max_vq(vcpu) - 1, -- SYS_ZCR_EL1); -- } -- -- fpsimd_save_and_flush_cpu_state(); -- } else if (has_vhe() && system_supports_sve()) { - /* -- * The FPSIMD/SVE state in the CPU has not been touched, and we -- * have SVE (and VHE): CPACR_EL1 (alias CPTR_EL2) has been -- * reset by kvm_reset_cptr_el2() in the Hyp code, disabling SVE -- * for EL0. To avoid spurious traps, restore the trap state -- * seen by kvm_arch_vcpu_load_fp(): -+ * Flush (save and invalidate) the fpsimd/sve state so that if -+ * the host tries to use fpsimd/sve, it's not using stale data -+ * from the guest. -+ * -+ * Flushing the state sets the TIF_FOREIGN_FPSTATE bit for the -+ * context unconditionally, in both nVHE and VHE. This allows -+ * the kernel to restore the fpsimd/sve state, including ZCR_EL1 -+ * when needed. - */ -- if (vcpu_get_flag(vcpu, HOST_SVE_ENABLED)) -- sysreg_clear_set(CPACR_EL1, 0, CPACR_EL1_ZEN_EL0EN); -- else -- sysreg_clear_set(CPACR_EL1, CPACR_EL1_ZEN_EL0EN, 0); -+ fpsimd_save_and_flush_cpu_state(); - } - - local_irq_restore(flags); -diff --git a/arch/arm64/kvm/hyp/entry.S b/arch/arm64/kvm/hyp/entry.S -index f3aa7738b477d6..f02d5701fc21c6 100644 ---- a/arch/arm64/kvm/hyp/entry.S -+++ b/arch/arm64/kvm/hyp/entry.S -@@ -44,6 +44,11 @@ alternative_if ARM64_HAS_RAS_EXTN - alternative_else_nop_endif - mrs x1, isr_el1 - cbz x1, 1f -+ -+ // Ensure that __guest_enter() always provides a context -+ // synchronization event so that callers don't need ISBs for anything -+ // that would usually be synchonized by the ERET. -+ isb - mov x0, #ARM_EXCEPTION_IRQ - ret - -diff --git a/arch/arm64/kvm/hyp/include/hyp/switch.h b/arch/arm64/kvm/hyp/include/hyp/switch.h -index 9cfe6bd1dbe459..526085401f6638 100644 ---- a/arch/arm64/kvm/hyp/include/hyp/switch.h -+++ b/arch/arm64/kvm/hyp/include/hyp/switch.h -@@ -273,13 +273,68 @@ static inline void __hyp_sve_restore_guest(struct kvm_vcpu *vcpu) - write_sysreg_el1(__vcpu_sys_reg(vcpu, ZCR_EL1), SYS_ZCR); - } - -+static inline void fpsimd_lazy_switch_to_guest(struct kvm_vcpu *vcpu) -+{ -+ u64 zcr_el1, zcr_el2; -+ -+ if (!guest_owns_fp_regs(vcpu)) -+ return; -+ -+ if (vcpu_has_sve(vcpu)) { -+ zcr_el2 = vcpu_sve_max_vq(vcpu) - 1; -+ -+ write_sysreg_el2(zcr_el2, SYS_ZCR); -+ -+ zcr_el1 = __vcpu_sys_reg(vcpu, ZCR_EL1); -+ write_sysreg_el1(zcr_el1, SYS_ZCR); -+ } -+} -+ -+static inline void fpsimd_lazy_switch_to_host(struct kvm_vcpu *vcpu) -+{ -+ u64 zcr_el1, zcr_el2; -+ -+ if (!guest_owns_fp_regs(vcpu)) -+ return; -+ -+ /* -+ * When the guest owns the FP regs, we know that guest+hyp traps for -+ * any FPSIMD/SVE/SME features exposed to the guest have been disabled -+ * by either fpsimd_lazy_switch_to_guest() or kvm_hyp_handle_fpsimd() -+ * prior to __guest_entry(). As __guest_entry() guarantees a context -+ * synchronization event, we don't need an ISB here to avoid taking -+ * traps for anything that was exposed to the guest. -+ */ -+ if (vcpu_has_sve(vcpu)) { -+ zcr_el1 = read_sysreg_el1(SYS_ZCR); -+ __vcpu_sys_reg(vcpu, ZCR_EL1) = zcr_el1; -+ -+ /* -+ * The guest's state is always saved using the guest's max VL. -+ * Ensure that the host has the guest's max VL active such that -+ * the host can save the guest's state lazily, but don't -+ * artificially restrict the host to the guest's max VL. -+ */ -+ if (has_vhe()) { -+ zcr_el2 = vcpu_sve_max_vq(vcpu) - 1; -+ write_sysreg_el2(zcr_el2, SYS_ZCR); -+ } else { -+ zcr_el2 = sve_vq_from_vl(kvm_host_sve_max_vl) - 1; -+ write_sysreg_el2(zcr_el2, SYS_ZCR); -+ -+ zcr_el1 = vcpu_sve_max_vq(vcpu) - 1; -+ write_sysreg_el1(zcr_el1, SYS_ZCR); -+ } -+ } -+} -+ - /* - * We trap the first access to the FP/SIMD to save the host context and - * restore the guest context lazily. - * If FP/SIMD is not implemented, handle the trap and inject an undefined - * instruction exception to the guest. Similarly for trapped SVE accesses. - */ --static bool kvm_hyp_handle_fpsimd(struct kvm_vcpu *vcpu, u64 *exit_code) -+static inline bool kvm_hyp_handle_fpsimd(struct kvm_vcpu *vcpu, u64 *exit_code) - { - bool sve_guest; - u8 esr_ec; -@@ -321,10 +376,6 @@ static bool kvm_hyp_handle_fpsimd(struct kvm_vcpu *vcpu, u64 *exit_code) - } - isb(); - -- /* Write out the host state if it's in the registers */ -- if (vcpu->arch.fp_state == FP_STATE_HOST_OWNED) -- __fpsimd_save_state(vcpu->arch.host_fpsimd_state); -- - /* Restore the guest state */ - if (sve_guest) - __hyp_sve_restore_guest(vcpu); -@@ -522,7 +573,7 @@ static bool handle_ampere1_tcr(struct kvm_vcpu *vcpu) - return true; - } - --static bool kvm_hyp_handle_sysreg(struct kvm_vcpu *vcpu, u64 *exit_code) -+static inline bool kvm_hyp_handle_sysreg(struct kvm_vcpu *vcpu, u64 *exit_code) - { - if (cpus_have_final_cap(ARM64_WORKAROUND_CAVIUM_TX2_219_TVM) && - handle_tx2_tvm(vcpu)) -@@ -545,7 +596,7 @@ static bool kvm_hyp_handle_sysreg(struct kvm_vcpu *vcpu, u64 *exit_code) - return false; - } - --static bool kvm_hyp_handle_cp15_32(struct kvm_vcpu *vcpu, u64 *exit_code) -+static inline bool kvm_hyp_handle_cp15_32(struct kvm_vcpu *vcpu, u64 *exit_code) - { - if (static_branch_unlikely(&vgic_v3_cpuif_trap) && - __vgic_v3_perform_cpuif_access(vcpu) == 1) -@@ -554,19 +605,18 @@ static bool kvm_hyp_handle_cp15_32(struct kvm_vcpu *vcpu, u64 *exit_code) - return false; - } - --static bool kvm_hyp_handle_memory_fault(struct kvm_vcpu *vcpu, u64 *exit_code) -+static inline bool kvm_hyp_handle_memory_fault(struct kvm_vcpu *vcpu, -+ u64 *exit_code) - { - if (!__populate_fault_info(vcpu)) - return true; - - return false; - } --static bool kvm_hyp_handle_iabt_low(struct kvm_vcpu *vcpu, u64 *exit_code) -- __alias(kvm_hyp_handle_memory_fault); --static bool kvm_hyp_handle_watchpt_low(struct kvm_vcpu *vcpu, u64 *exit_code) -- __alias(kvm_hyp_handle_memory_fault); -+#define kvm_hyp_handle_iabt_low kvm_hyp_handle_memory_fault -+#define kvm_hyp_handle_watchpt_low kvm_hyp_handle_memory_fault - --static bool kvm_hyp_handle_dabt_low(struct kvm_vcpu *vcpu, u64 *exit_code) -+static inline bool kvm_hyp_handle_dabt_low(struct kvm_vcpu *vcpu, u64 *exit_code) - { - if (kvm_hyp_handle_memory_fault(vcpu, exit_code)) - return true; -@@ -596,23 +646,16 @@ static bool kvm_hyp_handle_dabt_low(struct kvm_vcpu *vcpu, u64 *exit_code) - - typedef bool (*exit_handler_fn)(struct kvm_vcpu *, u64 *); - --static const exit_handler_fn *kvm_get_exit_handler_array(struct kvm_vcpu *vcpu); -- --static void early_exit_filter(struct kvm_vcpu *vcpu, u64 *exit_code); -- - /* - * Allow the hypervisor to handle the exit with an exit handler if it has one. - * - * Returns true if the hypervisor handled the exit, and control should go back - * to the guest, or false if it hasn't. - */ --static inline bool kvm_hyp_handle_exit(struct kvm_vcpu *vcpu, u64 *exit_code) -+static inline bool kvm_hyp_handle_exit(struct kvm_vcpu *vcpu, u64 *exit_code, -+ const exit_handler_fn *handlers) - { -- const exit_handler_fn *handlers = kvm_get_exit_handler_array(vcpu); -- exit_handler_fn fn; -- -- fn = handlers[kvm_vcpu_trap_get_class(vcpu)]; -- -+ exit_handler_fn fn = handlers[kvm_vcpu_trap_get_class(vcpu)]; - if (fn) - return fn(vcpu, exit_code); - -@@ -642,20 +685,9 @@ static inline void synchronize_vcpu_pstate(struct kvm_vcpu *vcpu, u64 *exit_code - * the guest, false when we should restore the host state and return to the - * main run loop. - */ --static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code) -+static inline bool __fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code, -+ const exit_handler_fn *handlers) - { -- /* -- * Save PSTATE early so that we can evaluate the vcpu mode -- * early on. -- */ -- synchronize_vcpu_pstate(vcpu, exit_code); -- -- /* -- * Check whether we want to repaint the state one way or -- * another. -- */ -- early_exit_filter(vcpu, exit_code); -- - if (ARM_EXCEPTION_CODE(*exit_code) != ARM_EXCEPTION_IRQ) - vcpu->arch.fault.esr_el2 = read_sysreg_el2(SYS_ESR); - -@@ -685,7 +717,7 @@ static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code) - goto exit; - - /* Check if there's an exit handler and allow it to handle the exit. */ -- if (kvm_hyp_handle_exit(vcpu, exit_code)) -+ if (kvm_hyp_handle_exit(vcpu, exit_code, handlers)) - goto guest; - exit: - /* Return to the host kernel and handle the exit */ -diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c -index 2385fd03ed87c6..350d1775a5ce88 100644 ---- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c -+++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c -@@ -5,6 +5,7 @@ - */ - - #include -+#include - - #include - #include -@@ -36,13 +37,11 @@ static void flush_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu) - - hyp_vcpu->vcpu.arch.hcr_el2 = host_vcpu->arch.hcr_el2; - hyp_vcpu->vcpu.arch.mdcr_el2 = host_vcpu->arch.mdcr_el2; -- hyp_vcpu->vcpu.arch.cptr_el2 = host_vcpu->arch.cptr_el2; - - hyp_vcpu->vcpu.arch.iflags = host_vcpu->arch.iflags; - hyp_vcpu->vcpu.arch.fp_state = host_vcpu->arch.fp_state; - - hyp_vcpu->vcpu.arch.debug_ptr = kern_hyp_va(host_vcpu->arch.debug_ptr); -- hyp_vcpu->vcpu.arch.host_fpsimd_state = host_vcpu->arch.host_fpsimd_state; - - hyp_vcpu->vcpu.arch.vsesr_el2 = host_vcpu->arch.vsesr_el2; - -@@ -59,7 +58,6 @@ static void sync_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu) - host_vcpu->arch.ctxt = hyp_vcpu->vcpu.arch.ctxt; - - host_vcpu->arch.hcr_el2 = hyp_vcpu->vcpu.arch.hcr_el2; -- host_vcpu->arch.cptr_el2 = hyp_vcpu->vcpu.arch.cptr_el2; - - host_vcpu->arch.fault = hyp_vcpu->vcpu.arch.fault; - -@@ -98,7 +96,9 @@ static void handle___kvm_vcpu_run(struct kvm_cpu_context *host_ctxt) - pkvm_put_hyp_vcpu(hyp_vcpu); - } else { - /* The host is fully trusted, run its vCPU directly. */ -+ fpsimd_lazy_switch_to_guest(host_vcpu); - ret = __kvm_vcpu_run(host_vcpu); -+ fpsimd_lazy_switch_to_host(host_vcpu); - } - - out: -@@ -419,15 +419,6 @@ void handle_trap(struct kvm_cpu_context *host_ctxt) - case ESR_ELx_EC_SMC64: - handle_host_smc(host_ctxt); - break; -- case ESR_ELx_EC_SVE: -- if (has_hvhe()) -- sysreg_clear_set(cpacr_el1, 0, (CPACR_EL1_ZEN_EL1EN | -- CPACR_EL1_ZEN_EL0EN)); -- else -- sysreg_clear_set(cptr_el2, CPTR_EL2_TZ, 0); -- isb(); -- sve_cond_update_zcr_vq(ZCR_ELx_LEN_MASK, SYS_ZCR_EL2); -- break; - case ESR_ELx_EC_IABT_LOW: - case ESR_ELx_EC_DABT_LOW: - handle_host_mem_abort(host_ctxt); -diff --git a/arch/arm64/kvm/hyp/nvhe/pkvm.c b/arch/arm64/kvm/hyp/nvhe/pkvm.c -index 8033ef353a5da4..03acc8343c5d1b 100644 ---- a/arch/arm64/kvm/hyp/nvhe/pkvm.c -+++ b/arch/arm64/kvm/hyp/nvhe/pkvm.c -@@ -18,6 +18,8 @@ unsigned long __icache_flags; - /* Used by kvm_get_vttbr(). */ - unsigned int kvm_arm_vmid_bits; - -+unsigned int kvm_host_sve_max_vl; -+ - /* - * Set trap register values based on features in ID_AA64PFR0. - */ -@@ -26,8 +28,6 @@ static void pvm_init_traps_aa64pfr0(struct kvm_vcpu *vcpu) - const u64 feature_ids = pvm_read_id_reg(vcpu, SYS_ID_AA64PFR0_EL1); - u64 hcr_set = HCR_RW; - u64 hcr_clear = 0; -- u64 cptr_set = 0; -- u64 cptr_clear = 0; - - /* Protected KVM does not support AArch32 guests. */ - BUILD_BUG_ON(FIELD_GET(ARM64_FEATURE_MASK(ID_AA64PFR0_EL1_EL0), -@@ -57,21 +57,10 @@ static void pvm_init_traps_aa64pfr0(struct kvm_vcpu *vcpu) - /* Trap AMU */ - if (!FIELD_GET(ARM64_FEATURE_MASK(ID_AA64PFR0_EL1_AMU), feature_ids)) { - hcr_clear |= HCR_AMVOFFEN; -- cptr_set |= CPTR_EL2_TAM; -- } -- -- /* Trap SVE */ -- if (!FIELD_GET(ARM64_FEATURE_MASK(ID_AA64PFR0_EL1_SVE), feature_ids)) { -- if (has_hvhe()) -- cptr_clear |= CPACR_EL1_ZEN_EL0EN | CPACR_EL1_ZEN_EL1EN; -- else -- cptr_set |= CPTR_EL2_TZ; - } - - vcpu->arch.hcr_el2 |= hcr_set; - vcpu->arch.hcr_el2 &= ~hcr_clear; -- vcpu->arch.cptr_el2 |= cptr_set; -- vcpu->arch.cptr_el2 &= ~cptr_clear; - } - - /* -@@ -101,7 +90,6 @@ static void pvm_init_traps_aa64dfr0(struct kvm_vcpu *vcpu) - const u64 feature_ids = pvm_read_id_reg(vcpu, SYS_ID_AA64DFR0_EL1); - u64 mdcr_set = 0; - u64 mdcr_clear = 0; -- u64 cptr_set = 0; - - /* Trap/constrain PMU */ - if (!FIELD_GET(ARM64_FEATURE_MASK(ID_AA64DFR0_EL1_PMUVer), feature_ids)) { -@@ -128,17 +116,8 @@ static void pvm_init_traps_aa64dfr0(struct kvm_vcpu *vcpu) - if (!FIELD_GET(ARM64_FEATURE_MASK(ID_AA64DFR0_EL1_TraceFilt), feature_ids)) - mdcr_set |= MDCR_EL2_TTRF; - -- /* Trap Trace */ -- if (!FIELD_GET(ARM64_FEATURE_MASK(ID_AA64DFR0_EL1_TraceVer), feature_ids)) { -- if (has_hvhe()) -- cptr_set |= CPACR_EL1_TTA; -- else -- cptr_set |= CPTR_EL2_TTA; -- } -- - vcpu->arch.mdcr_el2 |= mdcr_set; - vcpu->arch.mdcr_el2 &= ~mdcr_clear; -- vcpu->arch.cptr_el2 |= cptr_set; - } - - /* -@@ -189,10 +168,6 @@ static void pvm_init_trap_regs(struct kvm_vcpu *vcpu) - /* Clear res0 and set res1 bits to trap potential new features. */ - vcpu->arch.hcr_el2 &= ~(HCR_RES0); - vcpu->arch.mdcr_el2 &= ~(MDCR_EL2_RES0); -- if (!has_hvhe()) { -- vcpu->arch.cptr_el2 |= CPTR_NVHE_EL2_RES1; -- vcpu->arch.cptr_el2 &= ~(CPTR_NVHE_EL2_RES0); -- } - } - - /* -diff --git a/arch/arm64/kvm/hyp/nvhe/switch.c b/arch/arm64/kvm/hyp/nvhe/switch.c -index c353a06ee7e6d6..27ad6933bec003 100644 ---- a/arch/arm64/kvm/hyp/nvhe/switch.c -+++ b/arch/arm64/kvm/hyp/nvhe/switch.c -@@ -36,34 +36,71 @@ DEFINE_PER_CPU(unsigned long, kvm_hyp_vector); - - extern void kvm_nvhe_prepare_backtrace(unsigned long fp, unsigned long pc); - --static void __activate_traps(struct kvm_vcpu *vcpu) -+static void __activate_cptr_traps(struct kvm_vcpu *vcpu) - { -- u64 val; -+ u64 val = CPTR_EL2_TAM; /* Same bit irrespective of E2H */ - -- ___activate_traps(vcpu); -- __activate_traps_common(vcpu); -+ if (!guest_owns_fp_regs(vcpu)) -+ __activate_traps_fpsimd32(vcpu); - -- val = vcpu->arch.cptr_el2; -- val |= CPTR_EL2_TAM; /* Same bit irrespective of E2H */ -- val |= has_hvhe() ? CPACR_EL1_TTA : CPTR_EL2_TTA; -- if (cpus_have_final_cap(ARM64_SME)) { -- if (has_hvhe()) -- val &= ~(CPACR_EL1_SMEN_EL1EN | CPACR_EL1_SMEN_EL0EN); -- else -- val |= CPTR_EL2_TSM; -+ if (has_hvhe()) { -+ val |= CPACR_ELx_TTA; -+ -+ if (guest_owns_fp_regs(vcpu)) { -+ val |= CPACR_ELx_FPEN; -+ if (vcpu_has_sve(vcpu)) -+ val |= CPACR_ELx_ZEN; -+ } -+ -+ write_sysreg(val, cpacr_el1); -+ } else { -+ val |= CPTR_EL2_TTA | CPTR_NVHE_EL2_RES1; -+ -+ /* -+ * Always trap SME since it's not supported in KVM. -+ * TSM is RES1 if SME isn't implemented. -+ */ -+ val |= CPTR_EL2_TSM; -+ -+ if (!vcpu_has_sve(vcpu) || !guest_owns_fp_regs(vcpu)) -+ val |= CPTR_EL2_TZ; -+ -+ if (!guest_owns_fp_regs(vcpu)) -+ val |= CPTR_EL2_TFP; -+ -+ write_sysreg(val, cptr_el2); - } -+} -+ -+static void __deactivate_cptr_traps(struct kvm_vcpu *vcpu) -+{ -+ if (has_hvhe()) { -+ u64 val = CPACR_ELx_FPEN; - -- if (!guest_owns_fp_regs(vcpu)) { -- if (has_hvhe()) -- val &= ~(CPACR_EL1_FPEN_EL0EN | CPACR_EL1_FPEN_EL1EN | -- CPACR_EL1_ZEN_EL0EN | CPACR_EL1_ZEN_EL1EN); -- else -- val |= CPTR_EL2_TFP | CPTR_EL2_TZ; -+ if (cpus_have_final_cap(ARM64_SVE)) -+ val |= CPACR_ELx_ZEN; -+ if (cpus_have_final_cap(ARM64_SME)) -+ val |= CPACR_ELx_SMEN; - -- __activate_traps_fpsimd32(vcpu); -+ write_sysreg(val, cpacr_el1); -+ } else { -+ u64 val = CPTR_NVHE_EL2_RES1; -+ -+ if (!cpus_have_final_cap(ARM64_SVE)) -+ val |= CPTR_EL2_TZ; -+ if (!cpus_have_final_cap(ARM64_SME)) -+ val |= CPTR_EL2_TSM; -+ -+ write_sysreg(val, cptr_el2); - } -+} -+ -+static void __activate_traps(struct kvm_vcpu *vcpu) -+{ -+ ___activate_traps(vcpu); -+ __activate_traps_common(vcpu); -+ __activate_cptr_traps(vcpu); - -- kvm_write_cptr_el2(val); - write_sysreg(__this_cpu_read(kvm_hyp_vector), vbar_el2); - - if (cpus_have_final_cap(ARM64_WORKAROUND_SPECULATIVE_AT)) { -@@ -108,7 +145,7 @@ static void __deactivate_traps(struct kvm_vcpu *vcpu) - - write_sysreg(this_cpu_ptr(&kvm_init_params)->hcr_el2, hcr_el2); - -- kvm_reset_cptr_el2(vcpu); -+ __deactivate_cptr_traps(vcpu); - write_sysreg(__kvm_hyp_host_vector, vbar_el2); - } - -@@ -213,21 +250,22 @@ static const exit_handler_fn *kvm_get_exit_handler_array(struct kvm_vcpu *vcpu) - return hyp_exit_handlers; - } - --/* -- * Some guests (e.g., protected VMs) are not be allowed to run in AArch32. -- * The ARMv8 architecture does not give the hypervisor a mechanism to prevent a -- * guest from dropping to AArch32 EL0 if implemented by the CPU. If the -- * hypervisor spots a guest in such a state ensure it is handled, and don't -- * trust the host to spot or fix it. The check below is based on the one in -- * kvm_arch_vcpu_ioctl_run(). -- * -- * Returns false if the guest ran in AArch32 when it shouldn't have, and -- * thus should exit to the host, or true if a the guest run loop can continue. -- */ --static void early_exit_filter(struct kvm_vcpu *vcpu, u64 *exit_code) -+static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code) - { -+ const exit_handler_fn *handlers = kvm_get_exit_handler_array(vcpu); - struct kvm *kvm = kern_hyp_va(vcpu->kvm); - -+ synchronize_vcpu_pstate(vcpu, exit_code); -+ -+ /* -+ * Some guests (e.g., protected VMs) are not be allowed to run in -+ * AArch32. The ARMv8 architecture does not give the hypervisor a -+ * mechanism to prevent a guest from dropping to AArch32 EL0 if -+ * implemented by the CPU. If the hypervisor spots a guest in such a -+ * state ensure it is handled, and don't trust the host to spot or fix -+ * it. The check below is based on the one in -+ * kvm_arch_vcpu_ioctl_run(). -+ */ - if (kvm_vm_is_protected(kvm) && vcpu_mode_is_32bit(vcpu)) { - /* - * As we have caught the guest red-handed, decide that it isn't -@@ -240,6 +278,8 @@ static void early_exit_filter(struct kvm_vcpu *vcpu, u64 *exit_code) - *exit_code &= BIT(ARM_EXIT_WITH_SERROR_BIT); - *exit_code |= ARM_EXCEPTION_IL; - } -+ -+ return __fixup_guest_exit(vcpu, exit_code, handlers); - } - - /* Switch to the guest for legacy non-VHE systems */ -diff --git a/arch/arm64/kvm/hyp/vhe/switch.c b/arch/arm64/kvm/hyp/vhe/switch.c -index 448b17080d3617..31304da0d61731 100644 ---- a/arch/arm64/kvm/hyp/vhe/switch.c -+++ b/arch/arm64/kvm/hyp/vhe/switch.c -@@ -172,13 +172,10 @@ static const exit_handler_fn hyp_exit_handlers[] = { - [ESR_ELx_EC_PAC] = kvm_hyp_handle_ptrauth, - }; - --static const exit_handler_fn *kvm_get_exit_handler_array(struct kvm_vcpu *vcpu) -+static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code) - { -- return hyp_exit_handlers; --} -+ synchronize_vcpu_pstate(vcpu, exit_code); - --static void early_exit_filter(struct kvm_vcpu *vcpu, u64 *exit_code) --{ - /* - * If we were in HYP context on entry, adjust the PSTATE view - * so that the usual helpers work correctly. -@@ -198,6 +195,8 @@ static void early_exit_filter(struct kvm_vcpu *vcpu, u64 *exit_code) - *vcpu_cpsr(vcpu) &= ~(PSR_MODE_MASK | PSR_MODE32_BIT); - *vcpu_cpsr(vcpu) |= mode; - } -+ -+ return __fixup_guest_exit(vcpu, exit_code, hyp_exit_handlers); - } - - /* Switch to the guest for VHE systems running in EL2 */ -@@ -213,6 +212,8 @@ static int __kvm_vcpu_run_vhe(struct kvm_vcpu *vcpu) - - sysreg_save_host_state_vhe(host_ctxt); - -+ fpsimd_lazy_switch_to_guest(vcpu); -+ - /* - * ARM erratum 1165522 requires us to configure both stage 1 and - * stage 2 translation for the guest context before we clear -@@ -248,6 +249,8 @@ static int __kvm_vcpu_run_vhe(struct kvm_vcpu *vcpu) - - __deactivate_traps(vcpu); - -+ fpsimd_lazy_switch_to_host(vcpu); -+ - sysreg_restore_host_state_vhe(host_ctxt); - - if (vcpu->arch.fp_state == FP_STATE_GUEST_OWNED) -diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c -index 7a65a35ee4ac41..43a53a403f5102 100644 ---- a/arch/arm64/kvm/reset.c -+++ b/arch/arm64/kvm/reset.c -@@ -46,11 +46,14 @@ static u32 __ro_after_init kvm_ipa_limit; - PSR_AA32_I_BIT | PSR_AA32_F_BIT) - - unsigned int __ro_after_init kvm_sve_max_vl; -+unsigned int __ro_after_init kvm_host_sve_max_vl; - - int __init kvm_arm_init_sve(void) - { - if (system_supports_sve()) { - kvm_sve_max_vl = sve_max_virtualisable_vl(); -+ kvm_host_sve_max_vl = sve_max_vl(); -+ kvm_nvhe_sym(kvm_host_sve_max_vl) = kvm_host_sve_max_vl; - - /* - * The get_sve_reg()/set_sve_reg() ioctl interface will need -diff --git a/arch/riscv/boot/dts/starfive/jh7110-pinfunc.h b/arch/riscv/boot/dts/starfive/jh7110-pinfunc.h -index fb0139b56723a1..c33fa9c76c0389 100644 ---- a/arch/riscv/boot/dts/starfive/jh7110-pinfunc.h -+++ b/arch/riscv/boot/dts/starfive/jh7110-pinfunc.h -@@ -89,7 +89,7 @@ - #define GPOUT_SYS_SDIO1_DATA1 59 - #define GPOUT_SYS_SDIO1_DATA2 60 - #define GPOUT_SYS_SDIO1_DATA3 61 --#define GPOUT_SYS_SDIO1_DATA4 63 -+#define GPOUT_SYS_SDIO1_DATA4 62 - #define GPOUT_SYS_SDIO1_DATA5 63 - #define GPOUT_SYS_SDIO1_DATA6 64 - #define GPOUT_SYS_SDIO1_DATA7 65 -diff --git a/drivers/accel/qaic/qaic_data.c b/drivers/accel/qaic/qaic_data.c -index d2f8c70a77a5b4..d00068987d9bdc 100644 ---- a/drivers/accel/qaic/qaic_data.c -+++ b/drivers/accel/qaic/qaic_data.c -@@ -165,9 +165,10 @@ static void free_slice(struct kref *kref) - static int clone_range_of_sgt_for_slice(struct qaic_device *qdev, struct sg_table **sgt_out, - struct sg_table *sgt_in, u64 size, u64 offset) - { -- int total_len, len, nents, offf = 0, offl = 0; - struct scatterlist *sg, *sgn, *sgf, *sgl; -+ unsigned int len, nents, offf, offl; - struct sg_table *sgt; -+ size_t total_len; - int ret, j; - - /* find out number of relevant nents needed for this mem */ -@@ -175,6 +176,8 @@ static int clone_range_of_sgt_for_slice(struct qaic_device *qdev, struct sg_tabl - sgf = NULL; - sgl = NULL; - nents = 0; -+ offf = 0; -+ offl = 0; - - size = size ? size : PAGE_SIZE; - for_each_sgtable_dma_sg(sgt_in, sg, j) { -@@ -547,6 +550,7 @@ static bool invalid_sem(struct qaic_sem *sem) - static int qaic_validate_req(struct qaic_device *qdev, struct qaic_attach_slice_entry *slice_ent, - u32 count, u64 total_size) - { -+ u64 total; - int i; - - for (i = 0; i < count; i++) { -@@ -556,7 +560,8 @@ static int qaic_validate_req(struct qaic_device *qdev, struct qaic_attach_slice_ - invalid_sem(&slice_ent[i].sem2) || invalid_sem(&slice_ent[i].sem3)) - return -EINVAL; - -- if (slice_ent[i].offset + slice_ent[i].size > total_size) -+ if (check_add_overflow(slice_ent[i].offset, slice_ent[i].size, &total) || -+ total > total_size) - return -EINVAL; - } - -diff --git a/drivers/firmware/efi/libstub/randomalloc.c b/drivers/firmware/efi/libstub/randomalloc.c -index 8ad3efb9b1ff16..593e98e3b993ea 100644 ---- a/drivers/firmware/efi/libstub/randomalloc.c -+++ b/drivers/firmware/efi/libstub/randomalloc.c -@@ -75,6 +75,10 @@ efi_status_t efi_random_alloc(unsigned long size, - if (align < EFI_ALLOC_ALIGN) - align = EFI_ALLOC_ALIGN; - -+ /* Avoid address 0x0, as it can be mistaken for NULL */ -+ if (alloc_min == 0) -+ alloc_min = align; -+ - size = round_up(size, EFI_ALLOC_ALIGN); - - /* count the suitable slots in each memory map entry */ -diff --git a/drivers/firmware/imx/imx-scu.c b/drivers/firmware/imx/imx-scu.c -index 1dd4362ef9a3fc..8c28e25ddc8a65 100644 ---- a/drivers/firmware/imx/imx-scu.c -+++ b/drivers/firmware/imx/imx-scu.c -@@ -280,6 +280,7 @@ static int imx_scu_probe(struct platform_device *pdev) - return ret; - - sc_ipc->fast_ipc = of_device_is_compatible(args.np, "fsl,imx8-mu-scu"); -+ of_node_put(args.np); - - num_channel = sc_ipc->fast_ipc ? 2 : SCU_MU_CHAN_NUM; - for (i = 0; i < num_channel; i++) { -diff --git a/drivers/gpu/drm/amd/amdgpu/nv.c b/drivers/gpu/drm/amd/amdgpu/nv.c -index 13aca808ecab95..7910c463ae3855 100644 ---- a/drivers/gpu/drm/amd/amdgpu/nv.c -+++ b/drivers/gpu/drm/amd/amdgpu/nv.c -@@ -79,12 +79,12 @@ static const struct amdgpu_video_codecs nv_video_codecs_encode = { - - /* Navi1x */ - static const struct amdgpu_video_codec_info nv_video_codecs_decode_array[] = { -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 1920, 1088, 3)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 1920, 1088, 5)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 8192, 8192, 0)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)}, - }; - -@@ -105,10 +105,10 @@ static const struct amdgpu_video_codecs sc_video_codecs_encode = { - }; - - static const struct amdgpu_video_codec_info sc_video_codecs_decode_array_vcn0[] = { -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 1920, 1088, 3)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 1920, 1088, 5)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)}, -@@ -116,10 +116,10 @@ static const struct amdgpu_video_codec_info sc_video_codecs_decode_array_vcn0[] - }; - - static const struct amdgpu_video_codec_info sc_video_codecs_decode_array_vcn1[] = { -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 1920, 1088, 3)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 1920, 1088, 5)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)}, -diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c -index a41ed67ea9feaf..8fe12904fdb7a6 100644 ---- a/drivers/gpu/drm/amd/amdgpu/soc15.c -+++ b/drivers/gpu/drm/amd/amdgpu/soc15.c -@@ -103,10 +103,10 @@ static const struct amdgpu_video_codecs vega_video_codecs_encode = - /* Vega */ - static const struct amdgpu_video_codec_info vega_video_codecs_decode_array[] = - { -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 1920, 1088, 3)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 1920, 1088, 5)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 4096, 186)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)}, - }; -@@ -120,12 +120,12 @@ static const struct amdgpu_video_codecs vega_video_codecs_decode = - /* Raven */ - static const struct amdgpu_video_codec_info rv_video_codecs_decode_array[] = - { -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 1920, 1088, 3)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 1920, 1088, 5)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 4096, 186)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 8192, 8192, 0)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 4096, 4096, 0)}, - }; - -@@ -138,10 +138,10 @@ static const struct amdgpu_video_codecs rv_video_codecs_decode = - /* Renoir, Arcturus */ - static const struct amdgpu_video_codec_info rn_video_codecs_decode_array[] = - { -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 1920, 1088, 3)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 1920, 1088, 5)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)}, -diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c -index fe8ba9e9837b39..3683a5d9348bff 100644 ---- a/drivers/gpu/drm/amd/amdgpu/vi.c -+++ b/drivers/gpu/drm/amd/amdgpu/vi.c -@@ -167,16 +167,16 @@ static const struct amdgpu_video_codec_info tonga_video_codecs_decode_array[] = - { - { - .codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, -- .max_width = 4096, -- .max_height = 4096, -- .max_pixels_per_frame = 4096 * 4096, -+ .max_width = 1920, -+ .max_height = 1088, -+ .max_pixels_per_frame = 1920 * 1088, - .max_level = 3, - }, - { - .codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, -- .max_width = 4096, -- .max_height = 4096, -- .max_pixels_per_frame = 4096 * 4096, -+ .max_width = 1920, -+ .max_height = 1088, -+ .max_pixels_per_frame = 1920 * 1088, - .max_level = 5, - }, - { -@@ -188,9 +188,9 @@ static const struct amdgpu_video_codec_info tonga_video_codecs_decode_array[] = - }, - { - .codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, -- .max_width = 4096, -- .max_height = 4096, -- .max_pixels_per_frame = 4096 * 4096, -+ .max_width = 1920, -+ .max_height = 1088, -+ .max_pixels_per_frame = 1920 * 1088, - .max_level = 4, - }, - }; -@@ -206,16 +206,16 @@ static const struct amdgpu_video_codec_info cz_video_codecs_decode_array[] = - { - { - .codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, -- .max_width = 4096, -- .max_height = 4096, -- .max_pixels_per_frame = 4096 * 4096, -+ .max_width = 1920, -+ .max_height = 1088, -+ .max_pixels_per_frame = 1920 * 1088, - .max_level = 3, - }, - { - .codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, -- .max_width = 4096, -- .max_height = 4096, -- .max_pixels_per_frame = 4096 * 4096, -+ .max_width = 1920, -+ .max_height = 1088, -+ .max_pixels_per_frame = 1920 * 1088, - .max_level = 5, - }, - { -@@ -227,9 +227,9 @@ static const struct amdgpu_video_codec_info cz_video_codecs_decode_array[] = - }, - { - .codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, -- .max_width = 4096, -- .max_height = 4096, -- .max_pixels_per_frame = 4096 * 4096, -+ .max_width = 1920, -+ .max_height = 1088, -+ .max_pixels_per_frame = 1920 * 1088, - .max_level = 4, - }, - { -diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c -index 2aa0e01a6891b0..5c7530287730e5 100644 ---- a/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c -@@ -65,5 +65,20 @@ bool should_use_dmub_lock(struct dc_link *link) - { - if (link->psr_settings.psr_version == DC_PSR_VERSION_SU_1) - return true; -+ -+ if (link->replay_settings.replay_feature_enabled) -+ return true; -+ -+ /* only use HW lock for PSR1 on single eDP */ -+ if (link->psr_settings.psr_version == DC_PSR_VERSION_1) { -+ struct dc_link *edp_links[MAX_NUM_EDP]; -+ int edp_num; -+ -+ dc_get_edp_links(link->dc, edp_links, &edp_num); -+ -+ if (edp_num == 1) -+ return true; -+ } -+ - return false; - } -diff --git a/drivers/gpu/drm/radeon/radeon_vce.c b/drivers/gpu/drm/radeon/radeon_vce.c -index d1871af967d4af..2355a78e1b69d6 100644 ---- a/drivers/gpu/drm/radeon/radeon_vce.c -+++ b/drivers/gpu/drm/radeon/radeon_vce.c -@@ -557,7 +557,7 @@ int radeon_vce_cs_parse(struct radeon_cs_parser *p) - { - int session_idx = -1; - bool destroyed = false, created = false, allocated = false; -- uint32_t tmp, handle = 0; -+ uint32_t tmp = 0, handle = 0; - uint32_t *size = &tmp; - int i, r = 0; - -diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c -index d3462be7493037..53130a50584ca0 100644 ---- a/drivers/gpu/drm/scheduler/sched_entity.c -+++ b/drivers/gpu/drm/scheduler/sched_entity.c -@@ -237,9 +237,16 @@ static void drm_sched_entity_kill(struct drm_sched_entity *entity) - struct drm_sched_fence *s_fence = job->s_fence; - - dma_fence_get(&s_fence->finished); -- if (!prev || dma_fence_add_callback(prev, &job->finish_cb, -- drm_sched_entity_kill_jobs_cb)) -+ if (!prev || -+ dma_fence_add_callback(prev, &job->finish_cb, -+ drm_sched_entity_kill_jobs_cb)) { -+ /* -+ * Adding callback above failed. -+ * dma_fence_put() checks for NULL. -+ */ -+ dma_fence_put(prev); - drm_sched_entity_kill_jobs_cb(NULL, &job->finish_cb); -+ } - - prev = &s_fence->finished; - } -diff --git a/drivers/gpu/drm/v3d/v3d_sched.c b/drivers/gpu/drm/v3d/v3d_sched.c -index 06238e6d7f5cda..5b729013fd26f5 100644 ---- a/drivers/gpu/drm/v3d/v3d_sched.c -+++ b/drivers/gpu/drm/v3d/v3d_sched.c -@@ -179,11 +179,15 @@ v3d_tfu_job_run(struct drm_sched_job *sched_job) - struct drm_device *dev = &v3d->drm; - struct dma_fence *fence; - -+ if (unlikely(job->base.base.s_fence->finished.error)) -+ return NULL; -+ -+ v3d->tfu_job = job; -+ - fence = v3d_fence_create(v3d, V3D_TFU); - if (IS_ERR(fence)) - return NULL; - -- v3d->tfu_job = job; - if (job->base.irq_fence) - dma_fence_put(job->base.irq_fence); - job->base.irq_fence = dma_fence_get(fence); -@@ -217,6 +221,9 @@ v3d_csd_job_run(struct drm_sched_job *sched_job) - struct dma_fence *fence; - int i; - -+ if (unlikely(job->base.base.s_fence->finished.error)) -+ return NULL; -+ - v3d->csd_job = job; - - v3d_invalidate_caches(v3d); -diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c -index 58fd6fa3edf144..22975bfd6b252b 100644 ---- a/drivers/i2c/busses/i2c-omap.c -+++ b/drivers/i2c/busses/i2c-omap.c -@@ -1049,23 +1049,6 @@ static int omap_i2c_transmit_data(struct omap_i2c_dev *omap, u8 num_bytes, - return 0; - } - --static irqreturn_t --omap_i2c_isr(int irq, void *dev_id) --{ -- struct omap_i2c_dev *omap = dev_id; -- irqreturn_t ret = IRQ_HANDLED; -- u16 mask; -- u16 stat; -- -- stat = omap_i2c_read_reg(omap, OMAP_I2C_STAT_REG); -- mask = omap_i2c_read_reg(omap, OMAP_I2C_IE_REG) & ~OMAP_I2C_STAT_NACK; -- -- if (stat & mask) -- ret = IRQ_WAKE_THREAD; -- -- return ret; --} -- - static int omap_i2c_xfer_data(struct omap_i2c_dev *omap) - { - u16 bits; -@@ -1096,8 +1079,13 @@ static int omap_i2c_xfer_data(struct omap_i2c_dev *omap) - } - - if (stat & OMAP_I2C_STAT_NACK) { -- err |= OMAP_I2C_STAT_NACK; -+ omap->cmd_err |= OMAP_I2C_STAT_NACK; - omap_i2c_ack_stat(omap, OMAP_I2C_STAT_NACK); -+ -+ if (!(stat & ~OMAP_I2C_STAT_NACK)) { -+ err = -EAGAIN; -+ break; -+ } - } - - if (stat & OMAP_I2C_STAT_AL) { -@@ -1475,7 +1463,7 @@ omap_i2c_probe(struct platform_device *pdev) - IRQF_NO_SUSPEND, pdev->name, omap); - else - r = devm_request_threaded_irq(&pdev->dev, omap->irq, -- omap_i2c_isr, omap_i2c_isr_thread, -+ NULL, omap_i2c_isr_thread, - IRQF_NO_SUSPEND | IRQF_ONESHOT, - pdev->name, omap); - -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c -index c4f10498c79d87..68ea4ed0b171b8 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c -+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c -@@ -1197,8 +1197,6 @@ static void __modify_flags_from_init_state(struct bnxt_qplib_qp *qp) - qp->path_mtu = - CMDQ_MODIFY_QP_PATH_MTU_MTU_2048; - } -- qp->modify_flags &= -- ~CMDQ_MODIFY_QP_MODIFY_MASK_VLAN_ID; - /* Bono FW require the max_dest_rd_atomic to be >= 1 */ - if (qp->max_dest_rd_atomic < 1) - qp->max_dest_rd_atomic = 1; -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h -index 07779aeb75759d..a4deb45ec849fa 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h -+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h -@@ -283,9 +283,10 @@ int bnxt_qplib_deinit_rcfw(struct bnxt_qplib_rcfw *rcfw); - int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw, - struct bnxt_qplib_ctx *ctx, int is_virtfn); - void bnxt_qplib_mark_qp_error(void *qp_handle); -+ - static inline u32 map_qp_id_to_tbl_indx(u32 qid, struct bnxt_qplib_rcfw *rcfw) - { - /* Last index of the qp_tbl is for QP1 ie. qp_tbl_size - 1*/ -- return (qid == 1) ? rcfw->qp_tbl_size - 1 : qid % rcfw->qp_tbl_size - 2; -+ return (qid == 1) ? rcfw->qp_tbl_size - 1 : (qid % (rcfw->qp_tbl_size - 2)); - } - #endif /* __BNXT_QPLIB_RCFW_H__ */ -diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c -index 51ab6041ca91bc..f13016dc8016a5 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_hem.c -+++ b/drivers/infiniband/hw/hns/hns_roce_hem.c -@@ -1416,6 +1416,11 @@ static int hem_list_alloc_root_bt(struct hns_roce_dev *hr_dev, - return ret; - } - -+/* This is the bottom bt pages number of a 100G MR on 4K OS, assuming -+ * the bt page size is not expanded by cal_best_bt_pg_sz() -+ */ -+#define RESCHED_LOOP_CNT_THRESHOLD_ON_4K 12800 -+ - /* construct the base address table and link them by address hop config */ - int hns_roce_hem_list_request(struct hns_roce_dev *hr_dev, - struct hns_roce_hem_list *hem_list, -@@ -1424,6 +1429,7 @@ int hns_roce_hem_list_request(struct hns_roce_dev *hr_dev, - { - const struct hns_roce_buf_region *r; - int ofs, end; -+ int loop; - int unit; - int ret; - int i; -@@ -1441,7 +1447,10 @@ int hns_roce_hem_list_request(struct hns_roce_dev *hr_dev, - continue; - - end = r->offset + r->count; -- for (ofs = r->offset; ofs < end; ofs += unit) { -+ for (ofs = r->offset, loop = 1; ofs < end; ofs += unit, loop++) { -+ if (!(loop % RESCHED_LOOP_CNT_THRESHOLD_ON_4K)) -+ cond_resched(); -+ - ret = hem_list_alloc_mid_bt(hr_dev, r, unit, ofs, - hem_list->mid_bt[i], - &hem_list->btm_bt); -@@ -1498,9 +1507,14 @@ void *hns_roce_hem_list_find_mtt(struct hns_roce_dev *hr_dev, - struct list_head *head = &hem_list->btm_bt; - struct hns_roce_hem_item *hem, *temp_hem; - void *cpu_base = NULL; -+ int loop = 1; - int nr = 0; - - list_for_each_entry_safe(hem, temp_hem, head, sibling) { -+ if (!(loop % RESCHED_LOOP_CNT_THRESHOLD_ON_4K)) -+ cond_resched(); -+ loop++; -+ - if (hem_list_page_is_in_range(hem, offset)) { - nr = offset - hem->start; - cpu_base = hem->addr + nr * BA_BYTE_LEN; -diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c -index c8c49110a3378d..dcd763dbb636d9 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_main.c -+++ b/drivers/infiniband/hw/hns/hns_roce_main.c -@@ -182,7 +182,7 @@ static int hns_roce_query_device(struct ib_device *ib_dev, - IB_DEVICE_RC_RNR_NAK_GEN; - props->max_send_sge = hr_dev->caps.max_sq_sg; - props->max_recv_sge = hr_dev->caps.max_rq_sg; -- props->max_sge_rd = 1; -+ props->max_sge_rd = hr_dev->caps.max_sq_sg; - props->max_cq = hr_dev->caps.num_cqs; - props->max_cqe = hr_dev->caps.max_cqes; - props->max_mr = hr_dev->caps.num_mtpts; -diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c -index 97d79c8d5cd069..0cad6fc7bf32c3 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_qp.c -+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c -@@ -860,12 +860,14 @@ static int alloc_user_qp_db(struct hns_roce_dev *hr_dev, - struct hns_roce_ib_create_qp *ucmd, - struct hns_roce_ib_create_qp_resp *resp) - { -+ bool has_sdb = user_qp_has_sdb(hr_dev, init_attr, udata, resp, ucmd); - struct hns_roce_ucontext *uctx = rdma_udata_to_drv_context(udata, - struct hns_roce_ucontext, ibucontext); -+ bool has_rdb = user_qp_has_rdb(hr_dev, init_attr, udata, resp); - struct ib_device *ibdev = &hr_dev->ib_dev; - int ret; - -- if (user_qp_has_sdb(hr_dev, init_attr, udata, resp, ucmd)) { -+ if (has_sdb) { - ret = hns_roce_db_map_user(uctx, ucmd->sdb_addr, &hr_qp->sdb); - if (ret) { - ibdev_err(ibdev, -@@ -876,7 +878,7 @@ static int alloc_user_qp_db(struct hns_roce_dev *hr_dev, - hr_qp->en_flags |= HNS_ROCE_QP_CAP_SQ_RECORD_DB; - } - -- if (user_qp_has_rdb(hr_dev, init_attr, udata, resp)) { -+ if (has_rdb) { - ret = hns_roce_db_map_user(uctx, ucmd->db_addr, &hr_qp->rdb); - if (ret) { - ibdev_err(ibdev, -@@ -890,7 +892,7 @@ static int alloc_user_qp_db(struct hns_roce_dev *hr_dev, - return 0; - - err_sdb: -- if (hr_qp->en_flags & HNS_ROCE_QP_CAP_SQ_RECORD_DB) -+ if (has_sdb) - hns_roce_db_unmap_user(uctx, &hr_qp->sdb); - err_out: - return ret; -@@ -1147,7 +1149,7 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev, - min(udata->outlen, sizeof(resp))); - if (ret) { - ibdev_err(ibdev, "copy qp resp failed!\n"); -- goto err_store; -+ goto err_flow_ctrl; - } - } - -diff --git a/drivers/infiniband/hw/mlx5/ah.c b/drivers/infiniband/hw/mlx5/ah.c -index 99036afb3aef0b..531a57f9ee7e8b 100644 ---- a/drivers/infiniband/hw/mlx5/ah.c -+++ b/drivers/infiniband/hw/mlx5/ah.c -@@ -50,11 +50,12 @@ static __be16 mlx5_ah_get_udp_sport(const struct mlx5_ib_dev *dev, - return sport; - } - --static void create_ib_ah(struct mlx5_ib_dev *dev, struct mlx5_ib_ah *ah, -+static int create_ib_ah(struct mlx5_ib_dev *dev, struct mlx5_ib_ah *ah, - struct rdma_ah_init_attr *init_attr) - { - struct rdma_ah_attr *ah_attr = init_attr->ah_attr; - enum ib_gid_type gid_type; -+ int rate_val; - - if (rdma_ah_get_ah_flags(ah_attr) & IB_AH_GRH) { - const struct ib_global_route *grh = rdma_ah_read_grh(ah_attr); -@@ -67,8 +68,10 @@ static void create_ib_ah(struct mlx5_ib_dev *dev, struct mlx5_ib_ah *ah, - ah->av.tclass = grh->traffic_class; - } - -- ah->av.stat_rate_sl = -- (mlx5r_ib_rate(dev, rdma_ah_get_static_rate(ah_attr)) << 4); -+ rate_val = mlx5r_ib_rate(dev, rdma_ah_get_static_rate(ah_attr)); -+ if (rate_val < 0) -+ return rate_val; -+ ah->av.stat_rate_sl = rate_val << 4; - - if (ah_attr->type == RDMA_AH_ATTR_TYPE_ROCE) { - if (init_attr->xmit_slave) -@@ -89,6 +92,8 @@ static void create_ib_ah(struct mlx5_ib_dev *dev, struct mlx5_ib_ah *ah, - ah->av.fl_mlid = rdma_ah_get_path_bits(ah_attr) & 0x7f; - ah->av.stat_rate_sl |= (rdma_ah_get_sl(ah_attr) & 0xf); - } -+ -+ return 0; - } - - int mlx5_ib_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr, -@@ -121,8 +126,7 @@ int mlx5_ib_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr, - return err; - } - -- create_ib_ah(dev, ah, init_attr); -- return 0; -+ return create_ib_ah(dev, ah, init_attr); - } - - int mlx5_ib_query_ah(struct ib_ah *ibah, struct rdma_ah_attr *ah_attr) -diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c -index 535783c4310567..45cda1248816c8 100644 ---- a/drivers/mmc/host/atmel-mci.c -+++ b/drivers/mmc/host/atmel-mci.c -@@ -2536,8 +2536,10 @@ static int atmci_probe(struct platform_device *pdev) - /* Get MCI capabilities and set operations according to it */ - atmci_get_cap(host); - ret = atmci_configure_dma(host); -- if (ret == -EPROBE_DEFER) -+ if (ret == -EPROBE_DEFER) { -+ clk_disable_unprepare(host->mck); - goto err_dma_probe_defer; -+ } - if (ret == 0) { - host->prepare_data = &atmci_prepare_data_dma; - host->submit_data = &atmci_submit_data_dma; -diff --git a/drivers/mmc/host/sdhci-brcmstb.c b/drivers/mmc/host/sdhci-brcmstb.c -index 25664cd5e90f4e..e181b393ba650c 100644 ---- a/drivers/mmc/host/sdhci-brcmstb.c -+++ b/drivers/mmc/host/sdhci-brcmstb.c -@@ -384,8 +384,15 @@ static int sdhci_brcmstb_suspend(struct device *dev) - struct sdhci_host *host = dev_get_drvdata(dev); - struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); - struct sdhci_brcmstb_priv *priv = sdhci_pltfm_priv(pltfm_host); -+ int ret; - - clk_disable_unprepare(priv->base_clk); -+ if (host->mmc->caps2 & MMC_CAP2_CQE) { -+ ret = cqhci_suspend(host->mmc); -+ if (ret) -+ return ret; -+ } -+ - return sdhci_pltfm_suspend(dev); - } - -@@ -410,6 +417,9 @@ static int sdhci_brcmstb_resume(struct device *dev) - ret = clk_set_rate(priv->base_clk, priv->base_freq_hz); - } - -+ if (host->mmc->caps2 & MMC_CAP2_CQE) -+ ret = cqhci_resume(host->mmc); -+ - return ret; - } - #endif -diff --git a/drivers/net/can/flexcan/flexcan-core.c b/drivers/net/can/flexcan/flexcan-core.c -index d15f85a40c1e5b..a27d6ce7cd540d 100644 ---- a/drivers/net/can/flexcan/flexcan-core.c -+++ b/drivers/net/can/flexcan/flexcan-core.c -@@ -2245,14 +2245,19 @@ static int __maybe_unused flexcan_suspend(struct device *device) - - flexcan_chip_interrupts_disable(dev); - -+ err = flexcan_transceiver_disable(priv); -+ if (err) -+ return err; -+ - err = pinctrl_pm_select_sleep_state(device); - if (err) - return err; - } - netif_stop_queue(dev); - netif_device_detach(dev); -+ -+ priv->can.state = CAN_STATE_SLEEPING; - } -- priv->can.state = CAN_STATE_SLEEPING; - - return 0; - } -@@ -2263,7 +2268,6 @@ static int __maybe_unused flexcan_resume(struct device *device) - struct flexcan_priv *priv = netdev_priv(dev); - int err; - -- priv->can.state = CAN_STATE_ERROR_ACTIVE; - if (netif_running(dev)) { - netif_device_attach(dev); - netif_start_queue(dev); -@@ -2277,12 +2281,20 @@ static int __maybe_unused flexcan_resume(struct device *device) - if (err) - return err; - -- err = flexcan_chip_start(dev); -+ err = flexcan_transceiver_enable(priv); - if (err) - return err; - -+ err = flexcan_chip_start(dev); -+ if (err) { -+ flexcan_transceiver_disable(priv); -+ return err; -+ } -+ - flexcan_chip_interrupts_enable(dev); - } -+ -+ priv->can.state = CAN_STATE_ERROR_ACTIVE; - } - - return 0; -diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c -index b828427187353d..e501b55678d1dc 100644 ---- a/drivers/net/can/rcar/rcar_canfd.c -+++ b/drivers/net/can/rcar/rcar_canfd.c -@@ -793,22 +793,14 @@ static void rcar_canfd_configure_controller(struct rcar_canfd_global *gpriv) - } - - static void rcar_canfd_configure_afl_rules(struct rcar_canfd_global *gpriv, -- u32 ch) -+ u32 ch, u32 rule_entry) - { -- u32 cfg; -- int offset, start, page, num_rules = RCANFD_CHANNEL_NUMRULES; -+ int offset, page, num_rules = RCANFD_CHANNEL_NUMRULES; -+ u32 rule_entry_index = rule_entry % 16; - u32 ridx = ch + RCANFD_RFFIFO_IDX; - -- if (ch == 0) { -- start = 0; /* Channel 0 always starts from 0th rule */ -- } else { -- /* Get number of Channel 0 rules and adjust */ -- cfg = rcar_canfd_read(gpriv->base, RCANFD_GAFLCFG(ch)); -- start = RCANFD_GAFLCFG_GETRNC(gpriv, 0, cfg); -- } -- - /* Enable write access to entry */ -- page = RCANFD_GAFL_PAGENUM(start); -+ page = RCANFD_GAFL_PAGENUM(rule_entry); - rcar_canfd_set_bit(gpriv->base, RCANFD_GAFLECTR, - (RCANFD_GAFLECTR_AFLPN(gpriv, page) | - RCANFD_GAFLECTR_AFLDAE)); -@@ -824,13 +816,13 @@ static void rcar_canfd_configure_afl_rules(struct rcar_canfd_global *gpriv, - offset = RCANFD_C_GAFL_OFFSET; - - /* Accept all IDs */ -- rcar_canfd_write(gpriv->base, RCANFD_GAFLID(offset, start), 0); -+ rcar_canfd_write(gpriv->base, RCANFD_GAFLID(offset, rule_entry_index), 0); - /* IDE or RTR is not considered for matching */ -- rcar_canfd_write(gpriv->base, RCANFD_GAFLM(offset, start), 0); -+ rcar_canfd_write(gpriv->base, RCANFD_GAFLM(offset, rule_entry_index), 0); - /* Any data length accepted */ -- rcar_canfd_write(gpriv->base, RCANFD_GAFLP0(offset, start), 0); -+ rcar_canfd_write(gpriv->base, RCANFD_GAFLP0(offset, rule_entry_index), 0); - /* Place the msg in corresponding Rx FIFO entry */ -- rcar_canfd_set_bit(gpriv->base, RCANFD_GAFLP1(offset, start), -+ rcar_canfd_set_bit(gpriv->base, RCANFD_GAFLP1(offset, rule_entry_index), - RCANFD_GAFLP1_GAFLFDP(ridx)); - - /* Disable write access to page */ -@@ -1857,6 +1849,7 @@ static int rcar_canfd_probe(struct platform_device *pdev) - unsigned long channels_mask = 0; - int err, ch_irq, g_irq; - int g_err_irq, g_recc_irq; -+ u32 rule_entry = 0; - bool fdmode = true; /* CAN FD only mode - default */ - char name[9] = "channelX"; - int i; -@@ -2033,7 +2026,8 @@ static int rcar_canfd_probe(struct platform_device *pdev) - rcar_canfd_configure_tx(gpriv, ch); - - /* Configure receive rules */ -- rcar_canfd_configure_afl_rules(gpriv, ch); -+ rcar_canfd_configure_afl_rules(gpriv, ch, rule_entry); -+ rule_entry += RCANFD_CHANNEL_NUMRULES; - } - - /* Configure common interrupts */ -diff --git a/drivers/net/can/usb/ucan.c b/drivers/net/can/usb/ucan.c -index 39a63b7313a46d..07406daf7c88ed 100644 ---- a/drivers/net/can/usb/ucan.c -+++ b/drivers/net/can/usb/ucan.c -@@ -186,7 +186,7 @@ union ucan_ctl_payload { - */ - struct ucan_ctl_cmd_get_protocol_version cmd_get_protocol_version; - -- u8 raw[128]; -+ u8 fw_str[128]; - } __packed; - - enum { -@@ -424,18 +424,20 @@ static int ucan_ctrl_command_out(struct ucan_priv *up, - UCAN_USB_CTL_PIPE_TIMEOUT); - } - --static int ucan_device_request_in(struct ucan_priv *up, -- u8 cmd, u16 subcmd, u16 datalen) -+static void ucan_get_fw_str(struct ucan_priv *up, char *fw_str, size_t size) - { -- return usb_control_msg(up->udev, -- usb_rcvctrlpipe(up->udev, 0), -- cmd, -- USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, -- subcmd, -- 0, -- up->ctl_msg_buffer, -- datalen, -- UCAN_USB_CTL_PIPE_TIMEOUT); -+ int ret; -+ -+ ret = usb_control_msg(up->udev, usb_rcvctrlpipe(up->udev, 0), -+ UCAN_DEVICE_GET_FW_STRING, -+ USB_DIR_IN | USB_TYPE_VENDOR | -+ USB_RECIP_DEVICE, -+ 0, 0, fw_str, size - 1, -+ UCAN_USB_CTL_PIPE_TIMEOUT); -+ if (ret > 0) -+ fw_str[ret] = '\0'; -+ else -+ strscpy(fw_str, "unknown", size); - } - - /* Parse the device information structure reported by the device and -@@ -1314,7 +1316,6 @@ static int ucan_probe(struct usb_interface *intf, - u8 in_ep_addr; - u8 out_ep_addr; - union ucan_ctl_payload *ctl_msg_buffer; -- char firmware_str[sizeof(union ucan_ctl_payload) + 1]; - - udev = interface_to_usbdev(intf); - -@@ -1527,17 +1528,6 @@ static int ucan_probe(struct usb_interface *intf, - */ - ucan_parse_device_info(up, &ctl_msg_buffer->cmd_get_device_info); - -- /* just print some device information - if available */ -- ret = ucan_device_request_in(up, UCAN_DEVICE_GET_FW_STRING, 0, -- sizeof(union ucan_ctl_payload)); -- if (ret > 0) { -- /* copy string while ensuring zero termination */ -- strscpy(firmware_str, up->ctl_msg_buffer->raw, -- sizeof(union ucan_ctl_payload) + 1); -- } else { -- strcpy(firmware_str, "unknown"); -- } -- - /* device is compatible, reset it */ - ret = ucan_ctrl_command_out(up, UCAN_COMMAND_RESET, 0, 0); - if (ret < 0) -@@ -1555,7 +1545,10 @@ static int ucan_probe(struct usb_interface *intf, - - /* initialisation complete, log device info */ - netdev_info(up->netdev, "registered device\n"); -- netdev_info(up->netdev, "firmware string: %s\n", firmware_str); -+ ucan_get_fw_str(up, up->ctl_msg_buffer->fw_str, -+ sizeof(up->ctl_msg_buffer->fw_str)); -+ netdev_info(up->netdev, "firmware string: %s\n", -+ up->ctl_msg_buffer->fw_str); - - /* success */ - return 0; -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index 915ef1062d7149..6bf4a21853858f 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -3987,7 +3987,7 @@ int bnxt_set_rx_skb_mode(struct bnxt *bp, bool page_mode) - struct net_device *dev = bp->dev; - - if (page_mode) { -- bp->flags &= ~BNXT_FLAG_AGG_RINGS; -+ bp->flags &= ~(BNXT_FLAG_AGG_RINGS | BNXT_FLAG_NO_AGG_RINGS); - bp->flags |= BNXT_FLAG_RX_PAGE_MODE; - - if (bp->xdp_prog->aux->xdp_has_frags) -@@ -12796,6 +12796,14 @@ static int bnxt_change_mtu(struct net_device *dev, int new_mtu) - bnxt_close_nic(bp, true, false); - - dev->mtu = new_mtu; -+ -+ /* MTU change may change the AGG ring settings if an XDP multi-buffer -+ * program is attached. We need to set the AGG rings settings and -+ * rx_skb_func accordingly. -+ */ -+ if (READ_ONCE(bp->xdp_prog)) -+ bnxt_set_rx_skb_mode(bp, true); -+ - bnxt_set_ring_params(bp); - - if (netif_running(dev)) -diff --git a/drivers/net/wireless/intel/iwlwifi/fw/file.h b/drivers/net/wireless/intel/iwlwifi/fw/file.h -index b36e9613a52c8c..b1687e6d3ad273 100644 ---- a/drivers/net/wireless/intel/iwlwifi/fw/file.h -+++ b/drivers/net/wireless/intel/iwlwifi/fw/file.h -@@ -372,6 +372,8 @@ typedef unsigned int __bitwise iwl_ucode_tlv_capa_t; - * channels even when these are not enabled. - * @IWL_UCODE_TLV_CAPA_DUMP_COMPLETE_SUPPORT: Support for indicating dump collection - * complete to FW. -+ * @IWL_UCODE_TLV_CAPA_BIOS_OVERRIDE_5G9_FOR_CA: supports (de)activating 5G9 -+ * for CA from BIOS. - * - * @NUM_IWL_UCODE_TLV_CAPA: number of bits used - */ -@@ -468,7 +470,7 @@ enum iwl_ucode_tlv_capa { - IWL_UCODE_TLV_CAPA_OFFLOAD_BTM_SUPPORT = (__force iwl_ucode_tlv_capa_t)113, - IWL_UCODE_TLV_CAPA_STA_EXP_MFP_SUPPORT = (__force iwl_ucode_tlv_capa_t)114, - IWL_UCODE_TLV_CAPA_SNIFF_VALIDATE_SUPPORT = (__force iwl_ucode_tlv_capa_t)116, -- -+ IWL_UCODE_TLV_CAPA_BIOS_OVERRIDE_5G9_FOR_CA = (__force iwl_ucode_tlv_capa_t)123, - #ifdef __CHECKER__ - /* sparse says it cannot increment the previous enum member */ - #define NUM_IWL_UCODE_TLV_CAPA 128 -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c -index 592b9157d50c67..a82cdd897173f5 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c -@@ -1293,7 +1293,9 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw, - - mvm->net_detect = true; - } else { -- struct iwl_wowlan_config_cmd wowlan_config_cmd = {}; -+ struct iwl_wowlan_config_cmd wowlan_config_cmd = { -+ .offloading_tid = 0, -+ }; - - wowlan_config_cmd.sta_id = mvmvif->deflink.ap_sta_id; - -@@ -1305,6 +1307,11 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw, - goto out_noreset; - } - -+ ret = iwl_mvm_sta_ensure_queue( -+ mvm, ap_sta->txq[wowlan_config_cmd.offloading_tid]); -+ if (ret) -+ goto out_noreset; -+ - ret = iwl_mvm_get_wowlan_config(mvm, wowlan, &wowlan_config_cmd, - vif, mvmvif, ap_sta); - if (ret) -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c -index 80b5c20d3a4804..c597492668fad5 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c -@@ -1195,11 +1195,30 @@ static u8 iwl_mvm_eval_dsm_rfi(struct iwl_mvm *mvm) - return DSM_VALUE_RFI_DISABLE; - } - -+enum iwl_dsm_unii4_bitmap { -+ DSM_VALUE_UNII4_US_OVERRIDE_MSK = BIT(0), -+ DSM_VALUE_UNII4_US_EN_MSK = BIT(1), -+ DSM_VALUE_UNII4_ETSI_OVERRIDE_MSK = BIT(2), -+ DSM_VALUE_UNII4_ETSI_EN_MSK = BIT(3), -+ DSM_VALUE_UNII4_CANADA_OVERRIDE_MSK = BIT(4), -+ DSM_VALUE_UNII4_CANADA_EN_MSK = BIT(5), -+}; -+ -+#define DSM_UNII4_ALLOW_BITMAP (DSM_VALUE_UNII4_US_OVERRIDE_MSK |\ -+ DSM_VALUE_UNII4_US_EN_MSK |\ -+ DSM_VALUE_UNII4_ETSI_OVERRIDE_MSK |\ -+ DSM_VALUE_UNII4_ETSI_EN_MSK |\ -+ DSM_VALUE_UNII4_CANADA_OVERRIDE_MSK |\ -+ DSM_VALUE_UNII4_CANADA_EN_MSK) -+ - static void iwl_mvm_lari_cfg(struct iwl_mvm *mvm) - { - int ret; - u32 value; - struct iwl_lari_config_change_cmd_v6 cmd = {}; -+ u8 cmd_ver = iwl_fw_lookup_cmd_ver(mvm->fw, -+ WIDE_ID(REGULATORY_AND_NVM_GROUP, -+ LARI_CONFIG_CHANGE), 1); - - cmd.config_bitmap = iwl_acpi_get_lari_config_bitmap(&mvm->fwrt); - -@@ -1211,8 +1230,22 @@ static void iwl_mvm_lari_cfg(struct iwl_mvm *mvm) - ret = iwl_acpi_get_dsm_u32(mvm->fwrt.dev, 0, - DSM_FUNC_ENABLE_UNII4_CHAN, - &iwl_guid, &value); -- if (!ret) -- cmd.oem_unii4_allow_bitmap = cpu_to_le32(value); -+ if (!ret) { -+ u32 _value = cpu_to_le32(value); -+ -+ _value &= DSM_UNII4_ALLOW_BITMAP; -+ -+ /* Since version 9, bits 4 and 5 are supported -+ * regardless of this capability. -+ */ -+ if (cmd_ver < 9 && -+ !fw_has_capa(&mvm->fw->ucode_capa, -+ IWL_UCODE_TLV_CAPA_BIOS_OVERRIDE_5G9_FOR_CA)) -+ _value &= ~(DSM_VALUE_UNII4_CANADA_OVERRIDE_MSK | -+ DSM_VALUE_UNII4_CANADA_EN_MSK); -+ -+ cmd.oem_unii4_allow_bitmap = cpu_to_le32(_value); -+ } - - ret = iwl_acpi_get_dsm_u32(mvm->fwrt.dev, 0, - DSM_FUNC_ACTIVATE_CHANNEL, -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c -index 84f4a9576cbda1..662efded3125d1 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c -@@ -1501,6 +1501,34 @@ static int iwl_mvm_sta_alloc_queue(struct iwl_mvm *mvm, - return ret; - } - -+int iwl_mvm_sta_ensure_queue(struct iwl_mvm *mvm, -+ struct ieee80211_txq *txq) -+{ -+ struct iwl_mvm_txq *mvmtxq = iwl_mvm_txq_from_mac80211(txq); -+ int ret = -EINVAL; -+ -+ lockdep_assert_held(&mvm->mutex); -+ -+ if (likely(test_bit(IWL_MVM_TXQ_STATE_READY, &mvmtxq->state)) || -+ !txq->sta) { -+ return 0; -+ } -+ -+ if (!iwl_mvm_sta_alloc_queue(mvm, txq->sta, txq->ac, txq->tid)) { -+ set_bit(IWL_MVM_TXQ_STATE_READY, &mvmtxq->state); -+ ret = 0; -+ } -+ -+ local_bh_disable(); -+ spin_lock(&mvm->add_stream_lock); -+ if (!list_empty(&mvmtxq->list)) -+ list_del_init(&mvmtxq->list); -+ spin_unlock(&mvm->add_stream_lock); -+ local_bh_enable(); -+ -+ return ret; -+} -+ - void iwl_mvm_add_new_dqa_stream_wk(struct work_struct *wk) - { - struct iwl_mvm *mvm = container_of(wk, struct iwl_mvm, -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h -index 95ef60daa62f04..799ea7675e0137 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h -@@ -1,6 +1,6 @@ - /* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */ - /* -- * Copyright (C) 2012-2014, 2018-2022 Intel Corporation -+ * Copyright (C) 2012-2014, 2018-2024 Intel Corporation - * Copyright (C) 2013-2014 Intel Mobile Communications GmbH - * Copyright (C) 2015-2016 Intel Deutschland GmbH - */ -@@ -577,6 +577,7 @@ void iwl_mvm_modify_all_sta_disable_tx(struct iwl_mvm *mvm, - bool disable); - - void iwl_mvm_csa_client_absent(struct iwl_mvm *mvm, struct ieee80211_vif *vif); -+int iwl_mvm_sta_ensure_queue(struct iwl_mvm *mvm, struct ieee80211_txq *txq); - void iwl_mvm_add_new_dqa_stream_wk(struct work_struct *wk); - int iwl_mvm_add_pasn_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif, - struct iwl_mvm_int_sta *sta, u8 *addr, u32 cipher, -diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c -index 352131d2df4cad..d2e21dc61dd7d5 100644 ---- a/drivers/regulator/core.c -+++ b/drivers/regulator/core.c -@@ -2084,6 +2084,10 @@ static int regulator_resolve_supply(struct regulator_dev *rdev) - - if (have_full_constraints()) { - r = dummy_regulator_rdev; -+ if (!r) { -+ ret = -EPROBE_DEFER; -+ goto out; -+ } - get_device(&r->dev); - } else { - dev_err(dev, "Failed to resolve %s-supply for %s\n", -@@ -2101,6 +2105,10 @@ static int regulator_resolve_supply(struct regulator_dev *rdev) - goto out; - } - r = dummy_regulator_rdev; -+ if (!r) { -+ ret = -EPROBE_DEFER; -+ goto out; -+ } - get_device(&r->dev); - } - -@@ -2209,8 +2217,10 @@ struct regulator *_regulator_get(struct device *dev, const char *id, - * enabled, even if it isn't hooked up, and just - * provide a dummy. - */ -- dev_warn(dev, "supply %s not found, using dummy regulator\n", id); - rdev = dummy_regulator_rdev; -+ if (!rdev) -+ return ERR_PTR(-EPROBE_DEFER); -+ dev_warn(dev, "supply %s not found, using dummy regulator\n", id); - get_device(&rdev->dev); - break; - -diff --git a/drivers/regulator/dummy.c b/drivers/regulator/dummy.c -index 5b9b9e4e762d52..9f59889129abec 100644 ---- a/drivers/regulator/dummy.c -+++ b/drivers/regulator/dummy.c -@@ -60,7 +60,7 @@ static struct platform_driver dummy_regulator_driver = { - .probe = dummy_regulator_probe, - .driver = { - .name = "reg-dummy", -- .probe_type = PROBE_PREFER_ASYNCHRONOUS, -+ .probe_type = PROBE_FORCE_SYNCHRONOUS, - }, - }; - -diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c -index 1ff8c7d847a9e2..064188a0870b0c 100644 ---- a/drivers/soc/imx/soc-imx8m.c -+++ b/drivers/soc/imx/soc-imx8m.c -@@ -30,11 +30,9 @@ - - struct imx8_soc_data { - char *name; -- int (*soc_revision)(u32 *socrev); -+ int (*soc_revision)(u32 *socrev, u64 *socuid); - }; - --static u64 soc_uid; -- - #ifdef CONFIG_HAVE_ARM_SMCCC - static u32 imx8mq_soc_revision_from_atf(void) - { -@@ -51,24 +49,22 @@ static u32 imx8mq_soc_revision_from_atf(void) - static inline u32 imx8mq_soc_revision_from_atf(void) { return 0; }; - #endif - --static int imx8mq_soc_revision(u32 *socrev) -+static int imx8mq_soc_revision(u32 *socrev, u64 *socuid) - { -- struct device_node *np; -+ struct device_node *np __free(device_node) = -+ of_find_compatible_node(NULL, NULL, "fsl,imx8mq-ocotp"); - void __iomem *ocotp_base; - u32 magic; - u32 rev; - struct clk *clk; - int ret; - -- np = of_find_compatible_node(NULL, NULL, "fsl,imx8mq-ocotp"); - if (!np) - return -EINVAL; - - ocotp_base = of_iomap(np, 0); -- if (!ocotp_base) { -- ret = -EINVAL; -- goto err_iomap; -- } -+ if (!ocotp_base) -+ return -EINVAL; - - clk = of_clk_get_by_name(np, NULL); - if (IS_ERR(clk)) { -@@ -89,44 +85,39 @@ static int imx8mq_soc_revision(u32 *socrev) - rev = REV_B1; - } - -- soc_uid = readl_relaxed(ocotp_base + OCOTP_UID_HIGH); -- soc_uid <<= 32; -- soc_uid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW); -+ *socuid = readl_relaxed(ocotp_base + OCOTP_UID_HIGH); -+ *socuid <<= 32; -+ *socuid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW); - - *socrev = rev; - - clk_disable_unprepare(clk); - clk_put(clk); - iounmap(ocotp_base); -- of_node_put(np); - - return 0; - - err_clk: - iounmap(ocotp_base); --err_iomap: -- of_node_put(np); - return ret; - } - --static int imx8mm_soc_uid(void) -+static int imx8mm_soc_uid(u64 *socuid) - { -+ struct device_node *np __free(device_node) = -+ of_find_compatible_node(NULL, NULL, "fsl,imx8mm-ocotp"); - void __iomem *ocotp_base; -- struct device_node *np; - struct clk *clk; - int ret = 0; - u32 offset = of_machine_is_compatible("fsl,imx8mp") ? - IMX8MP_OCOTP_UID_OFFSET : 0; - -- np = of_find_compatible_node(NULL, NULL, "fsl,imx8mm-ocotp"); - if (!np) - return -EINVAL; - - ocotp_base = of_iomap(np, 0); -- if (!ocotp_base) { -- ret = -EINVAL; -- goto err_iomap; -- } -+ if (!ocotp_base) -+ return -EINVAL; - - clk = of_clk_get_by_name(np, NULL); - if (IS_ERR(clk)) { -@@ -136,47 +127,36 @@ static int imx8mm_soc_uid(void) - - clk_prepare_enable(clk); - -- soc_uid = readl_relaxed(ocotp_base + OCOTP_UID_HIGH + offset); -- soc_uid <<= 32; -- soc_uid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW + offset); -+ *socuid = readl_relaxed(ocotp_base + OCOTP_UID_HIGH + offset); -+ *socuid <<= 32; -+ *socuid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW + offset); - - clk_disable_unprepare(clk); - clk_put(clk); - - err_clk: - iounmap(ocotp_base); --err_iomap: -- of_node_put(np); -- - return ret; - } - --static int imx8mm_soc_revision(u32 *socrev) -+static int imx8mm_soc_revision(u32 *socrev, u64 *socuid) - { -- struct device_node *np; -+ struct device_node *np __free(device_node) = -+ of_find_compatible_node(NULL, NULL, "fsl,imx8mm-anatop"); - void __iomem *anatop_base; -- int ret; - -- np = of_find_compatible_node(NULL, NULL, "fsl,imx8mm-anatop"); - if (!np) - return -EINVAL; - - anatop_base = of_iomap(np, 0); -- if (!anatop_base) { -- ret = -EINVAL; -- goto err_iomap; -- } -+ if (!anatop_base) -+ return -EINVAL; - - *socrev = readl_relaxed(anatop_base + ANADIG_DIGPROG_IMX8MM); - - iounmap(anatop_base); -- of_node_put(np); - -- return imx8mm_soc_uid(); -- --err_iomap: -- of_node_put(np); -- return ret; -+ return imx8mm_soc_uid(socuid); - } - - static const struct imx8_soc_data imx8mq_soc_data = { -@@ -207,21 +187,34 @@ static __maybe_unused const struct of_device_id imx8_soc_match[] = { - { } - }; - --#define imx8_revision(soc_rev) \ -- soc_rev ? \ -- kasprintf(GFP_KERNEL, "%d.%d", (soc_rev >> 4) & 0xf, soc_rev & 0xf) : \ -+#define imx8_revision(dev, soc_rev) \ -+ (soc_rev) ? \ -+ devm_kasprintf((dev), GFP_KERNEL, "%d.%d", ((soc_rev) >> 4) & 0xf, (soc_rev) & 0xf) : \ - "unknown" - -+static void imx8m_unregister_soc(void *data) -+{ -+ soc_device_unregister(data); -+} -+ -+static void imx8m_unregister_cpufreq(void *data) -+{ -+ platform_device_unregister(data); -+} -+ - static int imx8m_soc_probe(struct platform_device *pdev) - { - struct soc_device_attribute *soc_dev_attr; -- struct soc_device *soc_dev; -+ struct platform_device *cpufreq_dev; -+ const struct imx8_soc_data *data; -+ struct device *dev = &pdev->dev; - const struct of_device_id *id; -+ struct soc_device *soc_dev; - u32 soc_rev = 0; -- const struct imx8_soc_data *data; -+ u64 soc_uid = 0; - int ret; - -- soc_dev_attr = kzalloc(sizeof(*soc_dev_attr), GFP_KERNEL); -+ soc_dev_attr = devm_kzalloc(dev, sizeof(*soc_dev_attr), GFP_KERNEL); - if (!soc_dev_attr) - return -ENOMEM; - -@@ -229,58 +222,52 @@ static int imx8m_soc_probe(struct platform_device *pdev) - - ret = of_property_read_string(of_root, "model", &soc_dev_attr->machine); - if (ret) -- goto free_soc; -+ return ret; - - id = of_match_node(imx8_soc_match, of_root); -- if (!id) { -- ret = -ENODEV; -- goto free_soc; -- } -+ if (!id) -+ return -ENODEV; - - data = id->data; - if (data) { - soc_dev_attr->soc_id = data->name; - if (data->soc_revision) { -- ret = data->soc_revision(&soc_rev); -+ ret = data->soc_revision(&soc_rev, &soc_uid); - if (ret) -- goto free_soc; -+ return ret; - } - } - -- soc_dev_attr->revision = imx8_revision(soc_rev); -- if (!soc_dev_attr->revision) { -- ret = -ENOMEM; -- goto free_soc; -- } -+ soc_dev_attr->revision = imx8_revision(dev, soc_rev); -+ if (!soc_dev_attr->revision) -+ return -ENOMEM; - -- soc_dev_attr->serial_number = kasprintf(GFP_KERNEL, "%016llX", soc_uid); -- if (!soc_dev_attr->serial_number) { -- ret = -ENOMEM; -- goto free_rev; -- } -+ soc_dev_attr->serial_number = devm_kasprintf(dev, GFP_KERNEL, "%016llX", soc_uid); -+ if (!soc_dev_attr->serial_number) -+ return -ENOMEM; - - soc_dev = soc_device_register(soc_dev_attr); -- if (IS_ERR(soc_dev)) { -- ret = PTR_ERR(soc_dev); -- goto free_serial_number; -- } -+ if (IS_ERR(soc_dev)) -+ return PTR_ERR(soc_dev); -+ -+ ret = devm_add_action(dev, imx8m_unregister_soc, soc_dev); -+ if (ret) -+ return ret; - - pr_info("SoC: %s revision %s\n", soc_dev_attr->soc_id, - soc_dev_attr->revision); - -- if (IS_ENABLED(CONFIG_ARM_IMX_CPUFREQ_DT)) -- platform_device_register_simple("imx-cpufreq-dt", -1, NULL, 0); -+ if (IS_ENABLED(CONFIG_ARM_IMX_CPUFREQ_DT)) { -+ cpufreq_dev = platform_device_register_simple("imx-cpufreq-dt", -1, NULL, 0); -+ if (IS_ERR(cpufreq_dev)) -+ return dev_err_probe(dev, PTR_ERR(cpufreq_dev), -+ "Failed to register imx-cpufreq-dev device\n"); -+ ret = devm_add_action(dev, imx8m_unregister_cpufreq, cpufreq_dev); -+ if (ret) -+ return ret; -+ } - - return 0; -- --free_serial_number: -- kfree(soc_dev_attr->serial_number); --free_rev: -- if (strcmp(soc_dev_attr->revision, "unknown")) -- kfree(soc_dev_attr->revision); --free_soc: -- kfree(soc_dev_attr); -- return ret; - } - - static struct platform_driver imx8m_soc_driver = { -diff --git a/drivers/soc/qcom/pdr_interface.c b/drivers/soc/qcom/pdr_interface.c -index c7cd4daa10b0fd..f83491a7510e0f 100644 ---- a/drivers/soc/qcom/pdr_interface.c -+++ b/drivers/soc/qcom/pdr_interface.c -@@ -74,7 +74,6 @@ static int pdr_locator_new_server(struct qmi_handle *qmi, - { - struct pdr_handle *pdr = container_of(qmi, struct pdr_handle, - locator_hdl); -- struct pdr_service *pds; - - mutex_lock(&pdr->lock); - /* Create a local client port for QMI communication */ -@@ -86,12 +85,7 @@ static int pdr_locator_new_server(struct qmi_handle *qmi, - mutex_unlock(&pdr->lock); - - /* Service pending lookup requests */ -- mutex_lock(&pdr->list_lock); -- list_for_each_entry(pds, &pdr->lookups, node) { -- if (pds->need_locator_lookup) -- schedule_work(&pdr->locator_work); -- } -- mutex_unlock(&pdr->list_lock); -+ schedule_work(&pdr->locator_work); - - return 0; - } -diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c -index 53c74010140e06..6d16506bbdc0d9 100644 ---- a/fs/btrfs/tree-checker.c -+++ b/fs/btrfs/tree-checker.c -@@ -1889,6 +1889,11 @@ enum btrfs_tree_block_status __btrfs_check_leaf(struct extent_buffer *leaf) - return BTRFS_TREE_BLOCK_INVALID_LEVEL; - } - -+ if (unlikely(!btrfs_header_flag(leaf, BTRFS_HEADER_FLAG_WRITTEN))) { -+ generic_err(leaf, 0, "invalid flag for leaf, WRITTEN not set"); -+ return BTRFS_TREE_BLOCK_WRITTEN_NOT_SET; -+ } -+ - /* - * Extent buffers from a relocation tree have a owner field that - * corresponds to the subvolume tree they are based on. So just from an -@@ -1950,6 +1955,7 @@ enum btrfs_tree_block_status __btrfs_check_leaf(struct extent_buffer *leaf) - for (slot = 0; slot < nritems; slot++) { - u32 item_end_expected; - u64 item_data_end; -+ enum btrfs_tree_block_status ret; - - btrfs_item_key_to_cpu(leaf, &key, slot); - -@@ -2005,21 +2011,10 @@ enum btrfs_tree_block_status __btrfs_check_leaf(struct extent_buffer *leaf) - return BTRFS_TREE_BLOCK_INVALID_OFFSETS; - } - -- /* -- * We only want to do this if WRITTEN is set, otherwise the leaf -- * may be in some intermediate state and won't appear valid. -- */ -- if (btrfs_header_flag(leaf, BTRFS_HEADER_FLAG_WRITTEN)) { -- enum btrfs_tree_block_status ret; -- -- /* -- * Check if the item size and content meet other -- * criteria -- */ -- ret = check_leaf_item(leaf, &key, slot, &prev_key); -- if (unlikely(ret != BTRFS_TREE_BLOCK_CLEAN)) -- return ret; -- } -+ /* Check if the item size and content meet other criteria. */ -+ ret = check_leaf_item(leaf, &key, slot, &prev_key); -+ if (unlikely(ret != BTRFS_TREE_BLOCK_CLEAN)) -+ return ret; - - prev_key.objectid = key.objectid; - prev_key.type = key.type; -@@ -2049,6 +2044,11 @@ enum btrfs_tree_block_status __btrfs_check_node(struct extent_buffer *node) - int level = btrfs_header_level(node); - u64 bytenr; - -+ if (unlikely(!btrfs_header_flag(node, BTRFS_HEADER_FLAG_WRITTEN))) { -+ generic_err(node, 0, "invalid flag for node, WRITTEN not set"); -+ return BTRFS_TREE_BLOCK_WRITTEN_NOT_SET; -+ } -+ - if (unlikely(level <= 0 || level >= BTRFS_MAX_LEVEL)) { - generic_err(node, 0, - "invalid level for node, have %d expect [1, %d]", -diff --git a/fs/btrfs/tree-checker.h b/fs/btrfs/tree-checker.h -index 3c2a02a72f6498..43f2ceb78f342f 100644 ---- a/fs/btrfs/tree-checker.h -+++ b/fs/btrfs/tree-checker.h -@@ -51,6 +51,7 @@ enum btrfs_tree_block_status { - BTRFS_TREE_BLOCK_INVALID_BLOCKPTR, - BTRFS_TREE_BLOCK_INVALID_ITEM, - BTRFS_TREE_BLOCK_INVALID_OWNER, -+ BTRFS_TREE_BLOCK_WRITTEN_NOT_SET, - }; - - /* -diff --git a/fs/proc/generic.c b/fs/proc/generic.c -index 775ce0bcf08ce2..c8785d68e870bf 100644 ---- a/fs/proc/generic.c -+++ b/fs/proc/generic.c -@@ -557,10 +557,16 @@ struct proc_dir_entry *proc_create_reg(const char *name, umode_t mode, - return p; - } - --static inline void pde_set_flags(struct proc_dir_entry *pde) -+static void pde_set_flags(struct proc_dir_entry *pde) - { - if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT) - pde->flags |= PROC_ENTRY_PERMANENT; -+ if (pde->proc_ops->proc_read_iter) -+ pde->flags |= PROC_ENTRY_proc_read_iter; -+#ifdef CONFIG_COMPAT -+ if (pde->proc_ops->proc_compat_ioctl) -+ pde->flags |= PROC_ENTRY_proc_compat_ioctl; -+#endif - } - - struct proc_dir_entry *proc_create_data(const char *name, umode_t mode, -@@ -624,6 +630,7 @@ struct proc_dir_entry *proc_create_seq_private(const char *name, umode_t mode, - p->proc_ops = &proc_seq_ops; - p->seq_ops = ops; - p->state_size = state_size; -+ pde_set_flags(p); - return proc_register(parent, p); - } - EXPORT_SYMBOL(proc_create_seq_private); -@@ -654,6 +661,7 @@ struct proc_dir_entry *proc_create_single_data(const char *name, umode_t mode, - return NULL; - p->proc_ops = &proc_single_ops; - p->single_show = show; -+ pde_set_flags(p); - return proc_register(parent, p); - } - EXPORT_SYMBOL(proc_create_single_data); -diff --git a/fs/proc/inode.c b/fs/proc/inode.c -index 532dc9d240f7f9..897c71077a0f7e 100644 ---- a/fs/proc/inode.c -+++ b/fs/proc/inode.c -@@ -679,13 +679,13 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) - - if (S_ISREG(inode->i_mode)) { - inode->i_op = de->proc_iops; -- if (de->proc_ops->proc_read_iter) -+ if (pde_has_proc_read_iter(de)) - inode->i_fop = &proc_iter_file_ops; - else - inode->i_fop = &proc_reg_file_ops; - #ifdef CONFIG_COMPAT -- if (de->proc_ops->proc_compat_ioctl) { -- if (de->proc_ops->proc_read_iter) -+ if (pde_has_proc_compat_ioctl(de)) { -+ if (pde_has_proc_read_iter(de)) - inode->i_fop = &proc_iter_file_ops_compat; - else - inode->i_fop = &proc_reg_file_ops_compat; -diff --git a/fs/proc/internal.h b/fs/proc/internal.h -index 9a8f32f21ff569..445c74a39a931f 100644 ---- a/fs/proc/internal.h -+++ b/fs/proc/internal.h -@@ -84,6 +84,20 @@ static inline void pde_make_permanent(struct proc_dir_entry *pde) - pde->flags |= PROC_ENTRY_PERMANENT; - } - -+static inline bool pde_has_proc_read_iter(const struct proc_dir_entry *pde) -+{ -+ return pde->flags & PROC_ENTRY_proc_read_iter; -+} -+ -+static inline bool pde_has_proc_compat_ioctl(const struct proc_dir_entry *pde) -+{ -+#ifdef CONFIG_COMPAT -+ return pde->flags & PROC_ENTRY_proc_compat_ioctl; -+#else -+ return false; -+#endif -+} -+ - extern struct kmem_cache *proc_dir_entry_cache; - void pde_free(struct proc_dir_entry *pde); - -diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c -index da8ed72f335d99..109036e2227ca1 100644 ---- a/fs/smb/server/smbacl.c -+++ b/fs/smb/server/smbacl.c -@@ -398,7 +398,9 @@ static void parse_dacl(struct mnt_idmap *idmap, - if (num_aces <= 0) - return; - -- if (num_aces > ULONG_MAX / sizeof(struct smb_ace *)) -+ if (num_aces > (le16_to_cpu(pdacl->size) - sizeof(struct smb_acl)) / -+ (offsetof(struct smb_ace, sid) + -+ offsetof(struct smb_sid, sub_auth) + sizeof(__le16))) - return; - - ret = init_acl_state(&acl_state, num_aces); -@@ -432,6 +434,7 @@ static void parse_dacl(struct mnt_idmap *idmap, - offsetof(struct smb_sid, sub_auth); - - if (end_of_acl - acl_base < acl_size || -+ ppace[i]->sid.num_subauth == 0 || - ppace[i]->sid.num_subauth > SID_MAX_SUB_AUTHORITIES || - (end_of_acl - acl_base < - acl_size + sizeof(__le32) * ppace[i]->sid.num_subauth) || -diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h -index de407e7c3b55fd..1aca3f332d9c06 100644 ---- a/include/linux/proc_fs.h -+++ b/include/linux/proc_fs.h -@@ -20,10 +20,13 @@ enum { - * If in doubt, ignore this flag. - */ - #ifdef MODULE -- PROC_ENTRY_PERMANENT = 0U, -+ PROC_ENTRY_PERMANENT = 0U, - #else -- PROC_ENTRY_PERMANENT = 1U << 0, -+ PROC_ENTRY_PERMANENT = 1U << 0, - #endif -+ -+ PROC_ENTRY_proc_read_iter = 1U << 1, -+ PROC_ENTRY_proc_compat_ioctl = 1U << 2, - }; - - struct proc_ops { -diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h -index 77a3040a3f29dc..e4a97b2d099841 100644 ---- a/include/net/bluetooth/hci.h -+++ b/include/net/bluetooth/hci.h -@@ -668,7 +668,7 @@ enum { - #define HCI_ERROR_REMOTE_POWER_OFF 0x15 - #define HCI_ERROR_LOCAL_HOST_TERM 0x16 - #define HCI_ERROR_PAIRING_NOT_ALLOWED 0x18 --#define HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE 0x1e -+#define HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE 0x1a - #define HCI_ERROR_INVALID_LL_PARAMS 0x1e - #define HCI_ERROR_UNSPECIFIED 0x1f - #define HCI_ERROR_ADVERTISING_TIMEOUT 0x3c -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 942734bf7347d0..8c5f75af07db0e 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -10494,7 +10494,7 @@ void sched_release_group(struct task_group *tg) - spin_unlock_irqrestore(&task_group_lock, flags); - } - --static struct task_group *sched_get_task_group(struct task_struct *tsk) -+static void sched_change_group(struct task_struct *tsk) - { - struct task_group *tg; - -@@ -10506,13 +10506,7 @@ static struct task_group *sched_get_task_group(struct task_struct *tsk) - tg = container_of(task_css_check(tsk, cpu_cgrp_id, true), - struct task_group, css); - tg = autogroup_task_group(tsk, tg); -- -- return tg; --} -- --static void sched_change_group(struct task_struct *tsk, struct task_group *group) --{ -- tsk->sched_task_group = group; -+ tsk->sched_task_group = tg; - - #ifdef CONFIG_FAIR_GROUP_SCHED - if (tsk->sched_class->task_change_group) -@@ -10533,19 +10527,10 @@ void sched_move_task(struct task_struct *tsk) - { - int queued, running, queue_flags = - DEQUEUE_SAVE | DEQUEUE_MOVE | DEQUEUE_NOCLOCK; -- struct task_group *group; - struct rq_flags rf; - struct rq *rq; - - rq = task_rq_lock(tsk, &rf); -- /* -- * Esp. with SCHED_AUTOGROUP enabled it is possible to get superfluous -- * group changes. -- */ -- group = sched_get_task_group(tsk); -- if (group == tsk->sched_task_group) -- goto unlock; -- - update_rq_clock(rq); - - running = task_current(rq, tsk); -@@ -10556,7 +10541,7 @@ void sched_move_task(struct task_struct *tsk) - if (running) - put_prev_task(rq, tsk); - -- sched_change_group(tsk, group); -+ sched_change_group(tsk); - - if (queued) - enqueue_task(rq, tsk, queue_flags); -@@ -10570,7 +10555,6 @@ void sched_move_task(struct task_struct *tsk) - resched_curr(rq); - } - --unlock: - task_rq_unlock(rq, tsk, &rf); - } - -diff --git a/mm/filemap.c b/mm/filemap.c -index 056422e6a0be8f..d7c79a69afc88f 100644 ---- a/mm/filemap.c -+++ b/mm/filemap.c -@@ -1976,8 +1976,19 @@ struct folio *__filemap_get_folio(struct address_space *mapping, pgoff_t index, - - if (err == -EEXIST) - goto repeat; -- if (err) -+ if (err) { -+ /* -+ * When NOWAIT I/O fails to allocate folios this could -+ * be due to a nonblocking memory allocation and not -+ * because the system actually is out of memory. -+ * Return -EAGAIN so that there caller retries in a -+ * blocking fashion instead of propagating -ENOMEM -+ * to the application. -+ */ -+ if ((fgp_flags & FGP_NOWAIT) && err == -ENOMEM) -+ err = -EAGAIN; - return ERR_PTR(err); -+ } - /* - * filemap_add_folio locks the page, and for mmap - * we expect an unlocked page. -diff --git a/mm/migrate.c b/mm/migrate.c -index c5ed8caf6a406a..1004b1def1c201 100644 ---- a/mm/migrate.c -+++ b/mm/migrate.c -@@ -437,15 +437,13 @@ int folio_migrate_mapping(struct address_space *mapping, - newfolio->index = folio->index; - newfolio->mapping = folio->mapping; - folio_ref_add(newfolio, nr); /* add cache reference */ -- if (folio_test_swapbacked(folio)) { -+ if (folio_test_swapbacked(folio)) - __folio_set_swapbacked(newfolio); -- if (folio_test_swapcache(folio)) { -- folio_set_swapcache(newfolio); -- newfolio->private = folio_get_private(folio); -- } -+ if (folio_test_swapcache(folio)) { -+ folio_set_swapcache(newfolio); -+ newfolio->private = folio_get_private(folio); - entries = nr; - } else { -- VM_BUG_ON_FOLIO(folio_test_swapcache(folio), folio); - entries = 1; - } - -diff --git a/net/atm/lec.c b/net/atm/lec.c -index 6257bf12e5a00b..ac3cfc1ae51024 100644 ---- a/net/atm/lec.c -+++ b/net/atm/lec.c -@@ -181,6 +181,7 @@ static void - lec_send(struct atm_vcc *vcc, struct sk_buff *skb) - { - struct net_device *dev = skb->dev; -+ unsigned int len = skb->len; - - ATM_SKB(skb)->vcc = vcc; - atm_account_tx(vcc, skb); -@@ -191,7 +192,7 @@ lec_send(struct atm_vcc *vcc, struct sk_buff *skb) - } - - dev->stats.tx_packets++; -- dev->stats.tx_bytes += skb->len; -+ dev->stats.tx_bytes += len; - } - - static void lec_tx_timeout(struct net_device *dev, unsigned int txqueue) -diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c -index 74b49c35ddc14d..209180b4c26817 100644 ---- a/net/batman-adv/bat_iv_ogm.c -+++ b/net/batman-adv/bat_iv_ogm.c -@@ -324,8 +324,7 @@ batadv_iv_ogm_aggr_packet(int buff_pos, int packet_len, - /* check if there is enough space for the optional TVLV */ - next_buff_pos += ntohs(ogm_packet->tvlv_len); - -- return (next_buff_pos <= packet_len) && -- (next_buff_pos <= BATADV_MAX_AGGREGATION_BYTES); -+ return next_buff_pos <= packet_len; - } - - /* send a batman ogm to a given interface */ -diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c -index e503ee0d896bd5..8f89ffe6020ced 100644 ---- a/net/batman-adv/bat_v_ogm.c -+++ b/net/batman-adv/bat_v_ogm.c -@@ -839,8 +839,7 @@ batadv_v_ogm_aggr_packet(int buff_pos, int packet_len, - /* check if there is enough space for the optional TVLV */ - next_buff_pos += ntohs(ogm2_packet->tvlv_len); - -- return (next_buff_pos <= packet_len) && -- (next_buff_pos <= BATADV_MAX_AGGREGATION_BYTES); -+ return next_buff_pos <= packet_len; - } - - /** -diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c -index 3bcc15c9415fc9..13b752c169bed7 100644 ---- a/net/bluetooth/6lowpan.c -+++ b/net/bluetooth/6lowpan.c -@@ -825,11 +825,16 @@ static struct sk_buff *chan_alloc_skb_cb(struct l2cap_chan *chan, - unsigned long hdr_len, - unsigned long len, int nb) - { -+ struct sk_buff *skb; -+ - /* Note that we must allocate using GFP_ATOMIC here as - * this function is called originally from netdev hard xmit - * function in atomic context. - */ -- return bt_skb_alloc(hdr_len + len, GFP_ATOMIC); -+ skb = bt_skb_alloc(hdr_len + len, GFP_ATOMIC); -+ if (!skb) -+ return ERR_PTR(-ENOMEM); -+ return skb; - } - - static void chan_suspend_cb(struct l2cap_chan *chan) -diff --git a/net/core/lwtunnel.c b/net/core/lwtunnel.c -index 711cd3b4347a79..4417a18b3e951a 100644 ---- a/net/core/lwtunnel.c -+++ b/net/core/lwtunnel.c -@@ -23,6 +23,8 @@ - #include - #include - -+#include "dev.h" -+ - DEFINE_STATIC_KEY_FALSE(nf_hooks_lwtunnel_enabled); - EXPORT_SYMBOL_GPL(nf_hooks_lwtunnel_enabled); - -@@ -325,13 +327,23 @@ EXPORT_SYMBOL_GPL(lwtunnel_cmp_encap); - - int lwtunnel_output(struct net *net, struct sock *sk, struct sk_buff *skb) - { -- struct dst_entry *dst = skb_dst(skb); - const struct lwtunnel_encap_ops *ops; - struct lwtunnel_state *lwtstate; -- int ret = -EINVAL; -+ struct dst_entry *dst; -+ int ret; -+ -+ if (dev_xmit_recursion()) { -+ net_crit_ratelimited("%s(): recursion limit reached on datapath\n", -+ __func__); -+ ret = -ENETDOWN; -+ goto drop; -+ } - -- if (!dst) -+ dst = skb_dst(skb); -+ if (!dst) { -+ ret = -EINVAL; - goto drop; -+ } - lwtstate = dst->lwtstate; - - if (lwtstate->type == LWTUNNEL_ENCAP_NONE || -@@ -341,8 +353,11 @@ int lwtunnel_output(struct net *net, struct sock *sk, struct sk_buff *skb) - ret = -EOPNOTSUPP; - rcu_read_lock(); - ops = rcu_dereference(lwtun_encaps[lwtstate->type]); -- if (likely(ops && ops->output)) -+ if (likely(ops && ops->output)) { -+ dev_xmit_recursion_inc(); - ret = ops->output(net, sk, skb); -+ dev_xmit_recursion_dec(); -+ } - rcu_read_unlock(); - - if (ret == -EOPNOTSUPP) -@@ -359,13 +374,23 @@ EXPORT_SYMBOL_GPL(lwtunnel_output); - - int lwtunnel_xmit(struct sk_buff *skb) - { -- struct dst_entry *dst = skb_dst(skb); - const struct lwtunnel_encap_ops *ops; - struct lwtunnel_state *lwtstate; -- int ret = -EINVAL; -+ struct dst_entry *dst; -+ int ret; -+ -+ if (dev_xmit_recursion()) { -+ net_crit_ratelimited("%s(): recursion limit reached on datapath\n", -+ __func__); -+ ret = -ENETDOWN; -+ goto drop; -+ } - -- if (!dst) -+ dst = skb_dst(skb); -+ if (!dst) { -+ ret = -EINVAL; - goto drop; -+ } - - lwtstate = dst->lwtstate; - -@@ -376,8 +401,11 @@ int lwtunnel_xmit(struct sk_buff *skb) - ret = -EOPNOTSUPP; - rcu_read_lock(); - ops = rcu_dereference(lwtun_encaps[lwtstate->type]); -- if (likely(ops && ops->xmit)) -+ if (likely(ops && ops->xmit)) { -+ dev_xmit_recursion_inc(); - ret = ops->xmit(skb); -+ dev_xmit_recursion_dec(); -+ } - rcu_read_unlock(); - - if (ret == -EOPNOTSUPP) -@@ -394,13 +422,23 @@ EXPORT_SYMBOL_GPL(lwtunnel_xmit); - - int lwtunnel_input(struct sk_buff *skb) - { -- struct dst_entry *dst = skb_dst(skb); - const struct lwtunnel_encap_ops *ops; - struct lwtunnel_state *lwtstate; -- int ret = -EINVAL; -+ struct dst_entry *dst; -+ int ret; - -- if (!dst) -+ if (dev_xmit_recursion()) { -+ net_crit_ratelimited("%s(): recursion limit reached on datapath\n", -+ __func__); -+ ret = -ENETDOWN; - goto drop; -+ } -+ -+ dst = skb_dst(skb); -+ if (!dst) { -+ ret = -EINVAL; -+ goto drop; -+ } - lwtstate = dst->lwtstate; - - if (lwtstate->type == LWTUNNEL_ENCAP_NONE || -@@ -410,8 +448,11 @@ int lwtunnel_input(struct sk_buff *skb) - ret = -EOPNOTSUPP; - rcu_read_lock(); - ops = rcu_dereference(lwtun_encaps[lwtstate->type]); -- if (likely(ops && ops->input)) -+ if (likely(ops && ops->input)) { -+ dev_xmit_recursion_inc(); - ret = ops->input(skb); -+ dev_xmit_recursion_dec(); -+ } - rcu_read_unlock(); - - if (ret == -EOPNOTSUPP) -diff --git a/net/core/neighbour.c b/net/core/neighbour.c -index e44feb39d459a7..1e2e60ffe76629 100644 ---- a/net/core/neighbour.c -+++ b/net/core/neighbour.c -@@ -2293,6 +2293,7 @@ static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = { - static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = { - [NDTPA_IFINDEX] = { .type = NLA_U32 }, - [NDTPA_QUEUE_LEN] = { .type = NLA_U32 }, -+ [NDTPA_QUEUE_LENBYTES] = { .type = NLA_U32 }, - [NDTPA_PROXY_QLEN] = { .type = NLA_U32 }, - [NDTPA_APP_PROBES] = { .type = NLA_U32 }, - [NDTPA_UCAST_PROBES] = { .type = NLA_U32 }, -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index db07d3bbaf3799..8360939acf85ad 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -3189,13 +3189,16 @@ static void add_v4_addrs(struct inet6_dev *idev) - struct in6_addr addr; - struct net_device *dev; - struct net *net = dev_net(idev->dev); -- int scope, plen; -+ int scope, plen, offset = 0; - u32 pflags = 0; - - ASSERT_RTNL(); - - memset(&addr, 0, sizeof(struct in6_addr)); -- memcpy(&addr.s6_addr32[3], idev->dev->dev_addr, 4); -+ /* in case of IP6GRE the dev_addr is an IPv6 and therefore we use only the last 4 bytes */ -+ if (idev->dev->addr_len == sizeof(struct in6_addr)) -+ offset = sizeof(struct in6_addr) - 4; -+ memcpy(&addr.s6_addr32[3], idev->dev->dev_addr + offset, 4); - - if (!(idev->dev->flags & IFF_POINTOPOINT) && idev->dev->type == ARPHRD_SIT) { - scope = IPV6_ADDR_COMPATv4; -@@ -3505,13 +3508,7 @@ static void addrconf_gre_config(struct net_device *dev) - return; - } - -- /* Generate the IPv6 link-local address using addrconf_addr_gen(), -- * unless we have an IPv4 GRE device not bound to an IP address and -- * which is in EUI64 mode (as __ipv6_isatap_ifid() would fail in this -- * case). Such devices fall back to add_v4_addrs() instead. -- */ -- if (!(dev->type == ARPHRD_IPGRE && *(__be32 *)dev->dev_addr == 0 && -- idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_EUI64)) { -+ if (dev->type == ARPHRD_ETHER) { - addrconf_addr_gen(idev, true); - return; - } -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index 5715d54f3d0bed..3ab5ea55ff8c35 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -3636,7 +3636,8 @@ int fib6_nh_init(struct net *net, struct fib6_nh *fib6_nh, - in6_dev_put(idev); - - if (err) { -- lwtstate_put(fib6_nh->fib_nh_lws); -+ fib_nh_common_release(&fib6_nh->nh_common); -+ fib6_nh->nh_common.nhc_pcpu_rth_output = NULL; - fib6_nh->fib_nh_lws = NULL; - netdev_put(dev, dev_tracker); - } -@@ -3796,10 +3797,12 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg, - if (nh) { - if (rt->fib6_src.plen) { - NL_SET_ERR_MSG(extack, "Nexthops can not be used with source routing"); -+ err = -EINVAL; - goto out_free; - } - if (!nexthop_get(nh)) { - NL_SET_ERR_MSG(extack, "Nexthop has been deleted"); -+ err = -ENOENT; - goto out_free; - } - rt->nh = nh; -diff --git a/net/mptcp/options.c b/net/mptcp/options.c -index 838c154b2b90f5..6ef98608ac64cc 100644 ---- a/net/mptcp/options.c -+++ b/net/mptcp/options.c -@@ -651,6 +651,7 @@ static bool mptcp_established_options_add_addr(struct sock *sk, struct sk_buff * - struct mptcp_sock *msk = mptcp_sk(subflow->conn); - bool drop_other_suboptions = false; - unsigned int opt_size = *size; -+ struct mptcp_addr_info addr; - bool echo; - int len; - -@@ -659,7 +660,7 @@ static bool mptcp_established_options_add_addr(struct sock *sk, struct sk_buff * - */ - if (!mptcp_pm_should_add_signal(msk) || - (opts->suboptions & (OPTION_MPTCP_MPJ_ACK | OPTION_MPTCP_MPC_ACK)) || -- !mptcp_pm_add_addr_signal(msk, skb, opt_size, remaining, &opts->addr, -+ !mptcp_pm_add_addr_signal(msk, skb, opt_size, remaining, &addr, - &echo, &drop_other_suboptions)) - return false; - -@@ -672,7 +673,7 @@ static bool mptcp_established_options_add_addr(struct sock *sk, struct sk_buff * - else if (opts->suboptions & OPTION_MPTCP_DSS) - return false; - -- len = mptcp_add_addr_len(opts->addr.family, echo, !!opts->addr.port); -+ len = mptcp_add_addr_len(addr.family, echo, !!addr.port); - if (remaining < len) - return false; - -@@ -689,6 +690,7 @@ static bool mptcp_established_options_add_addr(struct sock *sk, struct sk_buff * - opts->ahmac = 0; - *size -= opt_size; - } -+ opts->addr = addr; - opts->suboptions |= OPTION_MPTCP_ADD_ADDR; - if (!echo) { - MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_ADDADDRTX); -diff --git a/net/netfilter/nft_counter.c b/net/netfilter/nft_counter.c -index eab0dc66bee6bd..cc732532949630 100644 ---- a/net/netfilter/nft_counter.c -+++ b/net/netfilter/nft_counter.c -@@ -8,7 +8,7 @@ - #include - #include - #include --#include -+#include - #include - #include - #include -@@ -17,6 +17,11 @@ - #include - - struct nft_counter { -+ u64_stats_t bytes; -+ u64_stats_t packets; -+}; -+ -+struct nft_counter_tot { - s64 bytes; - s64 packets; - }; -@@ -25,25 +30,24 @@ struct nft_counter_percpu_priv { - struct nft_counter __percpu *counter; - }; - --static DEFINE_PER_CPU(seqcount_t, nft_counter_seq); -+static DEFINE_PER_CPU(struct u64_stats_sync, nft_counter_sync); - - static inline void nft_counter_do_eval(struct nft_counter_percpu_priv *priv, - struct nft_regs *regs, - const struct nft_pktinfo *pkt) - { -+ struct u64_stats_sync *nft_sync; - struct nft_counter *this_cpu; -- seqcount_t *myseq; - - local_bh_disable(); - this_cpu = this_cpu_ptr(priv->counter); -- myseq = this_cpu_ptr(&nft_counter_seq); -- -- write_seqcount_begin(myseq); -+ nft_sync = this_cpu_ptr(&nft_counter_sync); - -- this_cpu->bytes += pkt->skb->len; -- this_cpu->packets++; -+ u64_stats_update_begin(nft_sync); -+ u64_stats_add(&this_cpu->bytes, pkt->skb->len); -+ u64_stats_inc(&this_cpu->packets); -+ u64_stats_update_end(nft_sync); - -- write_seqcount_end(myseq); - local_bh_enable(); - } - -@@ -66,17 +70,16 @@ static int nft_counter_do_init(const struct nlattr * const tb[], - if (cpu_stats == NULL) - return -ENOMEM; - -- preempt_disable(); -- this_cpu = this_cpu_ptr(cpu_stats); -+ this_cpu = raw_cpu_ptr(cpu_stats); - if (tb[NFTA_COUNTER_PACKETS]) { -- this_cpu->packets = -- be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS])); -+ u64_stats_set(&this_cpu->packets, -+ be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]))); - } - if (tb[NFTA_COUNTER_BYTES]) { -- this_cpu->bytes = -- be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES])); -+ u64_stats_set(&this_cpu->bytes, -+ be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]))); - } -- preempt_enable(); -+ - priv->counter = cpu_stats; - return 0; - } -@@ -104,40 +107,41 @@ static void nft_counter_obj_destroy(const struct nft_ctx *ctx, - } - - static void nft_counter_reset(struct nft_counter_percpu_priv *priv, -- struct nft_counter *total) -+ struct nft_counter_tot *total) - { -+ struct u64_stats_sync *nft_sync; - struct nft_counter *this_cpu; -- seqcount_t *myseq; - - local_bh_disable(); - this_cpu = this_cpu_ptr(priv->counter); -- myseq = this_cpu_ptr(&nft_counter_seq); -+ nft_sync = this_cpu_ptr(&nft_counter_sync); -+ -+ u64_stats_update_begin(nft_sync); -+ u64_stats_add(&this_cpu->packets, -total->packets); -+ u64_stats_add(&this_cpu->bytes, -total->bytes); -+ u64_stats_update_end(nft_sync); - -- write_seqcount_begin(myseq); -- this_cpu->packets -= total->packets; -- this_cpu->bytes -= total->bytes; -- write_seqcount_end(myseq); - local_bh_enable(); - } - - static void nft_counter_fetch(struct nft_counter_percpu_priv *priv, -- struct nft_counter *total) -+ struct nft_counter_tot *total) - { - struct nft_counter *this_cpu; -- const seqcount_t *myseq; - u64 bytes, packets; - unsigned int seq; - int cpu; - - memset(total, 0, sizeof(*total)); - for_each_possible_cpu(cpu) { -- myseq = per_cpu_ptr(&nft_counter_seq, cpu); -+ struct u64_stats_sync *nft_sync = per_cpu_ptr(&nft_counter_sync, cpu); -+ - this_cpu = per_cpu_ptr(priv->counter, cpu); - do { -- seq = read_seqcount_begin(myseq); -- bytes = this_cpu->bytes; -- packets = this_cpu->packets; -- } while (read_seqcount_retry(myseq, seq)); -+ seq = u64_stats_fetch_begin(nft_sync); -+ bytes = u64_stats_read(&this_cpu->bytes); -+ packets = u64_stats_read(&this_cpu->packets); -+ } while (u64_stats_fetch_retry(nft_sync, seq)); - - total->bytes += bytes; - total->packets += packets; -@@ -148,7 +152,7 @@ static int nft_counter_do_dump(struct sk_buff *skb, - struct nft_counter_percpu_priv *priv, - bool reset) - { -- struct nft_counter total; -+ struct nft_counter_tot total; - - nft_counter_fetch(priv, &total); - -@@ -237,7 +241,7 @@ static int nft_counter_clone(struct nft_expr *dst, const struct nft_expr *src, g - struct nft_counter_percpu_priv *priv_clone = nft_expr_priv(dst); - struct nft_counter __percpu *cpu_stats; - struct nft_counter *this_cpu; -- struct nft_counter total; -+ struct nft_counter_tot total; - - nft_counter_fetch(priv, &total); - -@@ -245,11 +249,9 @@ static int nft_counter_clone(struct nft_expr *dst, const struct nft_expr *src, g - if (cpu_stats == NULL) - return -ENOMEM; - -- preempt_disable(); -- this_cpu = this_cpu_ptr(cpu_stats); -- this_cpu->packets = total.packets; -- this_cpu->bytes = total.bytes; -- preempt_enable(); -+ this_cpu = raw_cpu_ptr(cpu_stats); -+ u64_stats_set(&this_cpu->packets, total.packets); -+ u64_stats_set(&this_cpu->bytes, total.bytes); - - priv_clone->counter = cpu_stats; - return 0; -@@ -267,17 +269,17 @@ static void nft_counter_offload_stats(struct nft_expr *expr, - const struct flow_stats *stats) - { - struct nft_counter_percpu_priv *priv = nft_expr_priv(expr); -+ struct u64_stats_sync *nft_sync; - struct nft_counter *this_cpu; -- seqcount_t *myseq; - - local_bh_disable(); - this_cpu = this_cpu_ptr(priv->counter); -- myseq = this_cpu_ptr(&nft_counter_seq); -+ nft_sync = this_cpu_ptr(&nft_counter_sync); - -- write_seqcount_begin(myseq); -- this_cpu->packets += stats->pkts; -- this_cpu->bytes += stats->bytes; -- write_seqcount_end(myseq); -+ u64_stats_update_begin(nft_sync); -+ u64_stats_add(&this_cpu->packets, stats->pkts); -+ u64_stats_add(&this_cpu->bytes, stats->bytes); -+ u64_stats_update_end(nft_sync); - local_bh_enable(); - } - -@@ -286,7 +288,7 @@ void nft_counter_init_seqcount(void) - int cpu; - - for_each_possible_cpu(cpu) -- seqcount_init(per_cpu_ptr(&nft_counter_seq, cpu)); -+ u64_stats_init(per_cpu_ptr(&nft_counter_sync, cpu)); - } - - struct nft_expr_type nft_counter_type; -diff --git a/net/xdp/xsk_buff_pool.c b/net/xdp/xsk_buff_pool.c -index f38388b6b62c21..e83b707da25b51 100644 ---- a/net/xdp/xsk_buff_pool.c -+++ b/net/xdp/xsk_buff_pool.c -@@ -104,7 +104,7 @@ struct xsk_buff_pool *xp_create_and_assign_umem(struct xdp_sock *xs, - if (pool->unaligned) - pool->free_heads[i] = xskb; - else -- xp_init_xskb_addr(xskb, pool, i * pool->chunk_size); -+ xp_init_xskb_addr(xskb, pool, (u64)i * pool->chunk_size); - } - - return pool; -diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c -index e5722c95b8bb38..a30538a980cc7f 100644 ---- a/net/xfrm/xfrm_output.c -+++ b/net/xfrm/xfrm_output.c -@@ -610,6 +610,40 @@ int xfrm_output_resume(struct sock *sk, struct sk_buff *skb, int err) - } - EXPORT_SYMBOL_GPL(xfrm_output_resume); - -+static int xfrm_dev_direct_output(struct sock *sk, struct xfrm_state *x, -+ struct sk_buff *skb) -+{ -+ struct dst_entry *dst = skb_dst(skb); -+ struct net *net = xs_net(x); -+ int err; -+ -+ dst = skb_dst_pop(skb); -+ if (!dst) { -+ XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); -+ kfree_skb(skb); -+ return -EHOSTUNREACH; -+ } -+ skb_dst_set(skb, dst); -+ nf_reset_ct(skb); -+ -+ err = skb_dst(skb)->ops->local_out(net, sk, skb); -+ if (unlikely(err != 1)) { -+ kfree_skb(skb); -+ return err; -+ } -+ -+ /* In transport mode, network destination is -+ * directly reachable, while in tunnel mode, -+ * inner packet network may not be. In packet -+ * offload type, HW is responsible for hard -+ * header packet mangling so directly xmit skb -+ * to netdevice. -+ */ -+ skb->dev = x->xso.dev; -+ __skb_push(skb, skb->dev->hard_header_len); -+ return dev_queue_xmit(skb); -+} -+ - static int xfrm_output2(struct net *net, struct sock *sk, struct sk_buff *skb) - { - return xfrm_output_resume(sk, skb, 1); -@@ -729,6 +763,13 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb) - return -EHOSTUNREACH; - } - -+ /* Exclusive direct xmit for tunnel mode, as -+ * some filtering or matching rules may apply -+ * in transport mode. -+ */ -+ if (x->props.mode == XFRM_MODE_TUNNEL) -+ return xfrm_dev_direct_output(sk, x, skb); -+ - return xfrm_output_resume(sk, skb, 0); - } - -@@ -752,7 +793,7 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb) - skb->encapsulation = 1; - - if (skb_is_gso(skb)) { -- if (skb->inner_protocol) -+ if (skb->inner_protocol && x->props.mode == XFRM_MODE_TUNNEL) - return xfrm_output_gso(net, sk, skb); - - skb_shinfo(skb)->gso_type |= SKB_GSO_ESP; diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.085-086.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.085-086.patch deleted file mode 100644 index 2139cd2c2b..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.085-086.patch +++ /dev/null @@ -1,950 +0,0 @@ -diff --git a/Makefile b/Makefile -index bb3bd3c9072059..2b22872d3cea59 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 85 -+SUBLEVEL = 86 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c -index fef62e4a9edde6..ed1a25f457e48e 100644 ---- a/arch/arm/mm/fault.c -+++ b/arch/arm/mm/fault.c -@@ -27,6 +27,13 @@ - - #ifdef CONFIG_MMU - -+bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size) -+{ -+ unsigned long addr = (unsigned long)unsafe_src; -+ -+ return addr >= TASK_SIZE && ULONG_MAX - addr >= size; -+} -+ - /* - * This is useful to dump out the page tables associated with - * 'addr' in mm 'mm'. -@@ -556,6 +563,7 @@ do_PrefetchAbort(unsigned long addr, unsigned int ifsr, struct pt_regs *regs) - if (!inf->fn(addr, ifsr | FSR_LNX_PF, regs)) - return; - -+ pr_alert("8<--- cut here ---\n"); - pr_alert("Unhandled prefetch abort: %s (0x%03x) at 0x%08lx\n", - inf->name, ifsr, addr); - -diff --git a/drivers/counter/microchip-tcb-capture.c b/drivers/counter/microchip-tcb-capture.c -index b3e615cbd2caa6..461f57f66631c3 100644 ---- a/drivers/counter/microchip-tcb-capture.c -+++ b/drivers/counter/microchip-tcb-capture.c -@@ -368,6 +368,25 @@ static int mchp_tc_probe(struct platform_device *pdev) - channel); - } - -+ /* Disable Quadrature Decoder and position measure */ -+ ret = regmap_update_bits(regmap, ATMEL_TC_BMR, ATMEL_TC_QDEN | ATMEL_TC_POSEN, 0); -+ if (ret) -+ return ret; -+ -+ /* Setup the period capture mode */ -+ ret = regmap_update_bits(regmap, ATMEL_TC_REG(priv->channel[0], CMR), -+ ATMEL_TC_WAVE | ATMEL_TC_ABETRG | ATMEL_TC_CMR_MASK | -+ ATMEL_TC_TCCLKS, -+ ATMEL_TC_CMR_MASK); -+ if (ret) -+ return ret; -+ -+ /* Enable clock and trigger counter */ -+ ret = regmap_write(regmap, ATMEL_TC_REG(priv->channel[0], CCR), -+ ATMEL_TC_CLKEN | ATMEL_TC_SWTRG); -+ if (ret) -+ return ret; -+ - priv->tc_cfg = tcb_config; - priv->regmap = regmap; - counter->name = dev_name(&pdev->dev); -diff --git a/drivers/counter/stm32-lptimer-cnt.c b/drivers/counter/stm32-lptimer-cnt.c -index 8439755559b219..537fe9b669f352 100644 ---- a/drivers/counter/stm32-lptimer-cnt.c -+++ b/drivers/counter/stm32-lptimer-cnt.c -@@ -58,37 +58,43 @@ static int stm32_lptim_set_enable_state(struct stm32_lptim_cnt *priv, - return 0; - } - -+ ret = clk_enable(priv->clk); -+ if (ret) -+ goto disable_cnt; -+ - /* LP timer must be enabled before writing CMP & ARR */ - ret = regmap_write(priv->regmap, STM32_LPTIM_ARR, priv->ceiling); - if (ret) -- return ret; -+ goto disable_clk; - - ret = regmap_write(priv->regmap, STM32_LPTIM_CMP, 0); - if (ret) -- return ret; -+ goto disable_clk; - - /* ensure CMP & ARR registers are properly written */ - ret = regmap_read_poll_timeout(priv->regmap, STM32_LPTIM_ISR, val, - (val & STM32_LPTIM_CMPOK_ARROK) == STM32_LPTIM_CMPOK_ARROK, - 100, 1000); - if (ret) -- return ret; -+ goto disable_clk; - - ret = regmap_write(priv->regmap, STM32_LPTIM_ICR, - STM32_LPTIM_CMPOKCF_ARROKCF); - if (ret) -- return ret; -+ goto disable_clk; - -- ret = clk_enable(priv->clk); -- if (ret) { -- regmap_write(priv->regmap, STM32_LPTIM_CR, 0); -- return ret; -- } - priv->enabled = true; - - /* Start LP timer in continuous mode */ - return regmap_update_bits(priv->regmap, STM32_LPTIM_CR, - STM32_LPTIM_CNTSTRT, STM32_LPTIM_CNTSTRT); -+ -+disable_clk: -+ clk_disable(priv->clk); -+disable_cnt: -+ regmap_write(priv->regmap, STM32_LPTIM_CR, 0); -+ -+ return ret; - } - - static int stm32_lptim_setup(struct stm32_lptim_cnt *priv, int enable) -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 986ee37688c16c..2b7f98a2e36f55 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -2825,8 +2825,7 @@ static int dm_resume(void *handle) - struct dm_atomic_state *dm_state = to_dm_atomic_state(dm->atomic_obj.state); - enum dc_connection_type new_connection_type = dc_connection_none; - struct dc_state *dc_state; -- int i, r, j, ret; -- bool need_hotplug = false; -+ int i, r, j; - - if (amdgpu_in_reset(adev)) { - dc_state = dm->cached_dc_state; -@@ -3003,23 +3002,16 @@ static int dm_resume(void *handle) - aconnector->mst_root) - continue; - -- ret = drm_dp_mst_topology_mgr_resume(&aconnector->mst_mgr, true); -- -- if (ret < 0) { -- dm_helpers_dp_mst_stop_top_mgr(aconnector->dc_link->ctx, -- aconnector->dc_link); -- need_hotplug = true; -- } -+ drm_dp_mst_topology_queue_probe(&aconnector->mst_mgr); - } - drm_connector_list_iter_end(&iter); - -- if (need_hotplug) -- drm_kms_helper_hotplug_event(ddev); -- - amdgpu_dm_irq_resume_late(adev); - - amdgpu_dm_smu_write_watermarks_table(adev); - -+ drm_kms_helper_hotplug_event(ddev); -+ - return 0; - } - -diff --git a/drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c b/drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c -index 3f3b555b4523a2..597fa0364a3a9b 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c -@@ -1753,7 +1753,7 @@ static int dcn315_populate_dml_pipes_from_context( - bool split_required = pipe->stream->timing.pix_clk_100hz >= dcn_get_max_non_odm_pix_rate_100hz(&dc->dml.soc) - || (pipe->plane_state && pipe->plane_state->src_rect.width > 5120); - -- if (remaining_det_segs > MIN_RESERVED_DET_SEGS) -+ if (remaining_det_segs > MIN_RESERVED_DET_SEGS && crb_pipes != 0) - pipes[pipe_cnt].pipe.src.det_size_override += (remaining_det_segs - MIN_RESERVED_DET_SEGS) / crb_pipes + - (crb_idx < (remaining_det_segs - MIN_RESERVED_DET_SEGS) % crb_pipes ? 1 : 0); - if (pipes[pipe_cnt].pipe.src.det_size_override > 2 * DCN3_15_MAX_DET_SEGS) { -diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c -index 08f8a22431fe1f..71a30387ca125b 100644 ---- a/drivers/gpu/drm/display/drm_dp_mst_topology.c -+++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c -@@ -2692,6 +2692,11 @@ static void drm_dp_mst_link_probe_work(struct work_struct *work) - drm_kms_helper_hotplug_event(dev); - } - -+static void drm_dp_mst_queue_probe_work(struct drm_dp_mst_topology_mgr *mgr) -+{ -+ queue_work(system_long_wq, &mgr->work); -+} -+ - static bool drm_dp_validate_guid(struct drm_dp_mst_topology_mgr *mgr, - u8 *guid) - { -@@ -3643,7 +3648,7 @@ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool ms - /* Write reset payload */ - drm_dp_dpcd_write_payload(mgr, 0, 0, 0x3f); - -- queue_work(system_long_wq, &mgr->work); -+ drm_dp_mst_queue_probe_work(mgr); - - ret = 0; - } else { -@@ -3680,6 +3685,33 @@ drm_dp_mst_topology_mgr_invalidate_mstb(struct drm_dp_mst_branch *mstb) - drm_dp_mst_topology_mgr_invalidate_mstb(port->mstb); - } - -+/** -+ * drm_dp_mst_topology_queue_probe - Queue a topology probe -+ * @mgr: manager to probe -+ * -+ * Queue a work to probe the MST topology. Driver's should call this only to -+ * sync the topology's HW->SW state after the MST link's parameters have -+ * changed in a way the state could've become out-of-sync. This is the case -+ * for instance when the link rate between the source and first downstream -+ * branch device has switched between UHBR and non-UHBR rates. Except of those -+ * cases - for instance when a sink gets plugged/unplugged to a port - the SW -+ * state will get updated automatically via MST UP message notifications. -+ */ -+void drm_dp_mst_topology_queue_probe(struct drm_dp_mst_topology_mgr *mgr) -+{ -+ mutex_lock(&mgr->lock); -+ -+ if (drm_WARN_ON(mgr->dev, !mgr->mst_state || !mgr->mst_primary)) -+ goto out_unlock; -+ -+ drm_dp_mst_topology_mgr_invalidate_mstb(mgr->mst_primary); -+ drm_dp_mst_queue_probe_work(mgr); -+ -+out_unlock: -+ mutex_unlock(&mgr->lock); -+} -+EXPORT_SYMBOL(drm_dp_mst_topology_queue_probe); -+ - /** - * drm_dp_mst_topology_mgr_suspend() - suspend the MST manager - * @mgr: manager to suspend -@@ -3766,7 +3798,7 @@ int drm_dp_mst_topology_mgr_resume(struct drm_dp_mst_topology_mgr *mgr, - * state of our in-memory topology back into sync with reality. So, - * restart the probing process as if we're probing a new hub - */ -- queue_work(system_long_wq, &mgr->work); -+ drm_dp_mst_queue_probe_work(mgr); - mutex_unlock(&mgr->lock); - - if (sync) { -diff --git a/drivers/hid/hid-plantronics.c b/drivers/hid/hid-plantronics.c -index 25cfd964dc25d9..acb9eb18f7ccfe 100644 ---- a/drivers/hid/hid-plantronics.c -+++ b/drivers/hid/hid-plantronics.c -@@ -6,9 +6,6 @@ - * Copyright (c) 2015-2018 Terry Junge - */ - --/* -- */ -- - #include "hid-ids.h" - - #include -@@ -23,30 +20,28 @@ - - #define PLT_VOL_UP 0x00b1 - #define PLT_VOL_DOWN 0x00b2 -+#define PLT_MIC_MUTE 0x00b5 - - #define PLT1_VOL_UP (PLT_HID_1_0_PAGE | PLT_VOL_UP) - #define PLT1_VOL_DOWN (PLT_HID_1_0_PAGE | PLT_VOL_DOWN) -+#define PLT1_MIC_MUTE (PLT_HID_1_0_PAGE | PLT_MIC_MUTE) - #define PLT2_VOL_UP (PLT_HID_2_0_PAGE | PLT_VOL_UP) - #define PLT2_VOL_DOWN (PLT_HID_2_0_PAGE | PLT_VOL_DOWN) -+#define PLT2_MIC_MUTE (PLT_HID_2_0_PAGE | PLT_MIC_MUTE) -+#define HID_TELEPHONY_MUTE (HID_UP_TELEPHONY | 0x2f) -+#define HID_CONSUMER_MUTE (HID_UP_CONSUMER | 0xe2) - - #define PLT_DA60 0xda60 - #define PLT_BT300_MIN 0x0413 - #define PLT_BT300_MAX 0x0418 - -- --#define PLT_ALLOW_CONSUMER (field->application == HID_CP_CONSUMERCONTROL && \ -- (usage->hid & HID_USAGE_PAGE) == HID_UP_CONSUMER) -- --#define PLT_QUIRK_DOUBLE_VOLUME_KEYS BIT(0) --#define PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS BIT(1) -- - #define PLT_DOUBLE_KEY_TIMEOUT 5 /* ms */ --#define PLT_FOLLOWED_OPPOSITE_KEY_TIMEOUT 220 /* ms */ - - struct plt_drv_data { - unsigned long device_type; -- unsigned long last_volume_key_ts; -- u32 quirks; -+ unsigned long last_key_ts; -+ unsigned long double_key_to; -+ __u16 last_key; - }; - - static int plantronics_input_mapping(struct hid_device *hdev, -@@ -58,34 +53,43 @@ static int plantronics_input_mapping(struct hid_device *hdev, - unsigned short mapped_key; - struct plt_drv_data *drv_data = hid_get_drvdata(hdev); - unsigned long plt_type = drv_data->device_type; -+ int allow_mute = usage->hid == HID_TELEPHONY_MUTE; -+ int allow_consumer = field->application == HID_CP_CONSUMERCONTROL && -+ (usage->hid & HID_USAGE_PAGE) == HID_UP_CONSUMER && -+ usage->hid != HID_CONSUMER_MUTE; - - /* special case for PTT products */ - if (field->application == HID_GD_JOYSTICK) - goto defaulted; - -- /* handle volume up/down mapping */ - /* non-standard types or multi-HID interfaces - plt_type is PID */ - if (!(plt_type & HID_USAGE_PAGE)) { - switch (plt_type) { - case PLT_DA60: -- if (PLT_ALLOW_CONSUMER) -+ if (allow_consumer) - goto defaulted; -- goto ignored; -+ if (usage->hid == HID_CONSUMER_MUTE) { -+ mapped_key = KEY_MICMUTE; -+ goto mapped; -+ } -+ break; - default: -- if (PLT_ALLOW_CONSUMER) -+ if (allow_consumer || allow_mute) - goto defaulted; - } -+ goto ignored; - } -- /* handle standard types - plt_type is 0xffa0uuuu or 0xffa2uuuu */ -- /* 'basic telephony compliant' - allow default consumer page map */ -- else if ((plt_type & HID_USAGE) >= PLT_BASIC_TELEPHONY && -- (plt_type & HID_USAGE) != PLT_BASIC_EXCEPTION) { -- if (PLT_ALLOW_CONSUMER) -- goto defaulted; -- } -- /* not 'basic telephony' - apply legacy mapping */ -- /* only map if the field is in the device's primary vendor page */ -- else if (!((field->application ^ plt_type) & HID_USAGE_PAGE)) { -+ -+ /* handle standard consumer control mapping */ -+ /* and standard telephony mic mute mapping */ -+ if (allow_consumer || allow_mute) -+ goto defaulted; -+ -+ /* handle vendor unique types - plt_type is 0xffa0uuuu or 0xffa2uuuu */ -+ /* if not 'basic telephony compliant' - map vendor unique controls */ -+ if (!((plt_type & HID_USAGE) >= PLT_BASIC_TELEPHONY && -+ (plt_type & HID_USAGE) != PLT_BASIC_EXCEPTION) && -+ !((field->application ^ plt_type) & HID_USAGE_PAGE)) - switch (usage->hid) { - case PLT1_VOL_UP: - case PLT2_VOL_UP: -@@ -95,8 +99,11 @@ static int plantronics_input_mapping(struct hid_device *hdev, - case PLT2_VOL_DOWN: - mapped_key = KEY_VOLUMEDOWN; - goto mapped; -+ case PLT1_MIC_MUTE: -+ case PLT2_MIC_MUTE: -+ mapped_key = KEY_MICMUTE; -+ goto mapped; - } -- } - - /* - * Future mapping of call control or other usages, -@@ -105,6 +112,8 @@ static int plantronics_input_mapping(struct hid_device *hdev, - */ - - ignored: -+ hid_dbg(hdev, "usage: %08x (appl: %08x) - ignored\n", -+ usage->hid, field->application); - return -1; - - defaulted: -@@ -123,38 +132,26 @@ static int plantronics_event(struct hid_device *hdev, struct hid_field *field, - struct hid_usage *usage, __s32 value) - { - struct plt_drv_data *drv_data = hid_get_drvdata(hdev); -+ unsigned long prev_tsto, cur_ts; -+ __u16 prev_key, cur_key; - -- if (drv_data->quirks & PLT_QUIRK_DOUBLE_VOLUME_KEYS) { -- unsigned long prev_ts, cur_ts; -+ /* Usages are filtered in plantronics_usages. */ - -- /* Usages are filtered in plantronics_usages. */ -+ /* HZ too low for ms resolution - double key detection disabled */ -+ /* or it is a key release - handle key presses only. */ -+ if (!drv_data->double_key_to || !value) -+ return 0; - -- if (!value) /* Handle key presses only. */ -- return 0; -+ prev_tsto = drv_data->last_key_ts + drv_data->double_key_to; -+ cur_ts = drv_data->last_key_ts = jiffies; -+ prev_key = drv_data->last_key; -+ cur_key = drv_data->last_key = usage->code; - -- prev_ts = drv_data->last_volume_key_ts; -- cur_ts = jiffies; -- if (jiffies_to_msecs(cur_ts - prev_ts) <= PLT_DOUBLE_KEY_TIMEOUT) -- return 1; /* Ignore the repeated key. */ -- -- drv_data->last_volume_key_ts = cur_ts; -+ /* If the same key occurs in <= double_key_to -- ignore it */ -+ if (prev_key == cur_key && time_before_eq(cur_ts, prev_tsto)) { -+ hid_dbg(hdev, "double key %d ignored\n", cur_key); -+ return 1; /* Ignore the repeated key. */ - } -- if (drv_data->quirks & PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS) { -- unsigned long prev_ts, cur_ts; -- -- /* Usages are filtered in plantronics_usages. */ -- -- if (!value) /* Handle key presses only. */ -- return 0; -- -- prev_ts = drv_data->last_volume_key_ts; -- cur_ts = jiffies; -- if (jiffies_to_msecs(cur_ts - prev_ts) <= PLT_FOLLOWED_OPPOSITE_KEY_TIMEOUT) -- return 1; /* Ignore the followed opposite volume key. */ -- -- drv_data->last_volume_key_ts = cur_ts; -- } -- - return 0; - } - -@@ -196,12 +193,16 @@ static int plantronics_probe(struct hid_device *hdev, - ret = hid_parse(hdev); - if (ret) { - hid_err(hdev, "parse failed\n"); -- goto err; -+ return ret; - } - - drv_data->device_type = plantronics_device_type(hdev); -- drv_data->quirks = id->driver_data; -- drv_data->last_volume_key_ts = jiffies - msecs_to_jiffies(PLT_DOUBLE_KEY_TIMEOUT); -+ drv_data->double_key_to = msecs_to_jiffies(PLT_DOUBLE_KEY_TIMEOUT); -+ drv_data->last_key_ts = jiffies - drv_data->double_key_to; -+ -+ /* if HZ does not allow ms resolution - disable double key detection */ -+ if (drv_data->double_key_to < PLT_DOUBLE_KEY_TIMEOUT) -+ drv_data->double_key_to = 0; - - hid_set_drvdata(hdev, drv_data); - -@@ -210,29 +211,10 @@ static int plantronics_probe(struct hid_device *hdev, - if (ret) - hid_err(hdev, "hw start failed\n"); - --err: - return ret; - } - - static const struct hid_device_id plantronics_devices[] = { -- { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, -- USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3210_SERIES), -- .driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS }, -- { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, -- USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES), -- .driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS }, -- { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, -- USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3215_SERIES), -- .driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS }, -- { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, -- USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3225_SERIES), -- .driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS }, -- { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, -- USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3325_SERIES), -- .driver_data = PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS }, -- { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, -- USB_DEVICE_ID_PLANTRONICS_ENCOREPRO_500_SERIES), -- .driver_data = PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS }, - { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, HID_ANY_ID) }, - { } - }; -@@ -241,6 +223,14 @@ MODULE_DEVICE_TABLE(hid, plantronics_devices); - static const struct hid_usage_id plantronics_usages[] = { - { HID_CP_VOLUMEUP, EV_KEY, HID_ANY_ID }, - { HID_CP_VOLUMEDOWN, EV_KEY, HID_ANY_ID }, -+ { HID_TELEPHONY_MUTE, EV_KEY, HID_ANY_ID }, -+ { HID_CONSUMER_MUTE, EV_KEY, HID_ANY_ID }, -+ { PLT2_VOL_UP, EV_KEY, HID_ANY_ID }, -+ { PLT2_VOL_DOWN, EV_KEY, HID_ANY_ID }, -+ { PLT2_MIC_MUTE, EV_KEY, HID_ANY_ID }, -+ { PLT1_VOL_UP, EV_KEY, HID_ANY_ID }, -+ { PLT1_VOL_DOWN, EV_KEY, HID_ANY_ID }, -+ { PLT1_MIC_MUTE, EV_KEY, HID_ANY_ID }, - { HID_TERMINATOR, HID_TERMINATOR, HID_TERMINATOR } - }; - -diff --git a/drivers/memstick/host/rtsx_usb_ms.c b/drivers/memstick/host/rtsx_usb_ms.c -index 29271ad4728a2f..dec279845a752d 100644 ---- a/drivers/memstick/host/rtsx_usb_ms.c -+++ b/drivers/memstick/host/rtsx_usb_ms.c -@@ -813,6 +813,7 @@ static int rtsx_usb_ms_drv_remove(struct platform_device *pdev) - - host->eject = true; - cancel_work_sync(&host->handle_req); -+ cancel_delayed_work_sync(&host->poll_card); - - mutex_lock(&host->host_mutex); - if (host->req) { -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index 8e30df676ededb..dc84d9029c2c79 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -1373,9 +1373,11 @@ static const struct usb_device_id products[] = { - {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a0, 0)}, /* Telit FN920C04 */ - {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a4, 0)}, /* Telit FN920C04 */ - {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a9, 0)}, /* Telit FN920C04 */ -+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10b0, 0)}, /* Telit FE990B */ - {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c0, 0)}, /* Telit FE910C04 */ - {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c4, 0)}, /* Telit FE910C04 */ - {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c8, 0)}, /* Telit FE910C04 */ -+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10d0, 0)}, /* Telit FN990B */ - {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ - {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ - {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ -diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c -index 9f66c47dc58bc7..08cbc8e4b361df 100644 ---- a/drivers/net/usb/usbnet.c -+++ b/drivers/net/usb/usbnet.c -@@ -178,6 +178,17 @@ int usbnet_get_ethernet_addr(struct usbnet *dev, int iMACAddress) - } - EXPORT_SYMBOL_GPL(usbnet_get_ethernet_addr); - -+static bool usbnet_needs_usb_name_format(struct usbnet *dev, struct net_device *net) -+{ -+ /* Point to point devices which don't have a real MAC address -+ * (or report a fake local one) have historically used the usb%d -+ * naming. Preserve this.. -+ */ -+ return (dev->driver_info->flags & FLAG_POINTTOPOINT) != 0 && -+ (is_zero_ether_addr(net->dev_addr) || -+ is_local_ether_addr(net->dev_addr)); -+} -+ - static void intr_complete (struct urb *urb) - { - struct usbnet *dev = urb->context; -@@ -1766,13 +1777,11 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod) - if (status < 0) - goto out1; - -- // heuristic: "usb%d" for links we know are two-host, -- // else "eth%d" when there's reasonable doubt. userspace -- // can rename the link if it knows better. -+ /* heuristic: rename to "eth%d" if we are not sure this link -+ * is two-host (these links keep "usb%d") -+ */ - if ((dev->driver_info->flags & FLAG_ETHER) != 0 && -- ((dev->driver_info->flags & FLAG_POINTTOPOINT) == 0 || -- /* somebody touched it*/ -- !is_zero_ether_addr(net->dev_addr))) -+ !usbnet_needs_usb_name_format(dev, net)) - strscpy(net->name, "eth%d", sizeof(net->name)); - /* WLAN devices should always be named "wlan%d" */ - if ((dev->driver_info->flags & FLAG_WLAN) != 0) -diff --git a/drivers/reset/starfive/reset-starfive-jh71x0.c b/drivers/reset/starfive/reset-starfive-jh71x0.c -index 55bbbd2de52cf9..29ce3486752f38 100644 ---- a/drivers/reset/starfive/reset-starfive-jh71x0.c -+++ b/drivers/reset/starfive/reset-starfive-jh71x0.c -@@ -94,6 +94,9 @@ static int jh71x0_reset_status(struct reset_controller_dev *rcdev, - void __iomem *reg_status = data->status + offset * sizeof(u32); - u32 value = readl(reg_status); - -+ if (!data->asserted) -+ return !(value & mask); -+ - return !((value ^ data->asserted[offset]) & mask); - } - -diff --git a/drivers/tty/serial/8250/8250_dma.c b/drivers/tty/serial/8250/8250_dma.c -index 7f23037813bc85..62492cf10bc9d4 100644 ---- a/drivers/tty/serial/8250/8250_dma.c -+++ b/drivers/tty/serial/8250/8250_dma.c -@@ -152,7 +152,7 @@ void serial8250_tx_dma_flush(struct uart_8250_port *p) - */ - dma->tx_size = 0; - -- dmaengine_terminate_async(dma->rxchan); -+ dmaengine_terminate_async(dma->txchan); - } - - int serial8250_rx_dma(struct uart_8250_port *p) -diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c -index bbd7914ddc9adc..0b38fada414472 100644 ---- a/drivers/tty/serial/8250/8250_pci.c -+++ b/drivers/tty/serial/8250/8250_pci.c -@@ -2576,6 +2576,22 @@ static struct pci_serial_quirk pci_serial_quirks[] = { - .init = pci_oxsemi_tornado_init, - .setup = pci_oxsemi_tornado_setup, - }, -+ { -+ .vendor = PCI_VENDOR_ID_INTASHIELD, -+ .device = 0x4026, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .init = pci_oxsemi_tornado_init, -+ .setup = pci_oxsemi_tornado_setup, -+ }, -+ { -+ .vendor = PCI_VENDOR_ID_INTASHIELD, -+ .device = 0x4021, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .init = pci_oxsemi_tornado_init, -+ .setup = pci_oxsemi_tornado_setup, -+ }, - { - .vendor = PCI_VENDOR_ID_INTEL, - .device = 0x8811, -@@ -5107,6 +5123,14 @@ static const struct pci_device_id serial_pci_tbl[] = { - PCI_ANY_ID, PCI_ANY_ID, - 0, 0, - pbn_b2_2_115200 }, -+ { PCI_VENDOR_ID_INTASHIELD, 0x0BA2, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, -+ pbn_b2_2_115200 }, -+ { PCI_VENDOR_ID_INTASHIELD, 0x0BA3, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, -+ pbn_b2_2_115200 }, - /* - * Brainboxes UC-235/246 - */ -@@ -5227,6 +5251,14 @@ static const struct pci_device_id serial_pci_tbl[] = { - PCI_ANY_ID, PCI_ANY_ID, - 0, 0, - pbn_b2_4_115200 }, -+ { PCI_VENDOR_ID_INTASHIELD, 0x0C42, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, -+ pbn_b2_4_115200 }, -+ { PCI_VENDOR_ID_INTASHIELD, 0x0C43, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, -+ pbn_b2_4_115200 }, - /* - * Brainboxes UC-420 - */ -@@ -5453,6 +5485,20 @@ static const struct pci_device_id serial_pci_tbl[] = { - PCI_ANY_ID, PCI_ANY_ID, - 0, 0, - pbn_oxsemi_1_15625000 }, -+ /* -+ * Brainboxes XC-235 -+ */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x4026, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, -+ pbn_oxsemi_1_15625000 }, -+ /* -+ * Brainboxes XC-475 -+ */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x4021, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, -+ pbn_oxsemi_1_15625000 }, - - /* - * Perle PCI-RAS cards -diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c -index 8bd0f8e45b146f..70fa1e6aebe136 100644 ---- a/drivers/tty/serial/fsl_lpuart.c -+++ b/drivers/tty/serial/fsl_lpuart.c -@@ -1488,6 +1488,19 @@ static int lpuart32_config_rs485(struct uart_port *port, struct ktermios *termio - - unsigned long modem = lpuart32_read(&sport->port, UARTMODIR) - & ~(UARTMODIR_TXRTSPOL | UARTMODIR_TXRTSE); -+ u32 ctrl; -+ -+ /* TXRTSE and TXRTSPOL only can be changed when transmitter is disabled. */ -+ ctrl = lpuart32_read(&sport->port, UARTCTRL); -+ if (ctrl & UARTCTRL_TE) { -+ /* wait for the transmit engine to complete */ -+ lpuart32_wait_bit_set(&sport->port, UARTSTAT, UARTSTAT_TC); -+ lpuart32_write(&sport->port, ctrl & ~UARTCTRL_TE, UARTCTRL); -+ -+ while (lpuart32_read(&sport->port, UARTCTRL) & UARTCTRL_TE) -+ cpu_relax(); -+ } -+ - lpuart32_write(&sport->port, modem, UARTMODIR); - - if (rs485->flags & SER_RS485_ENABLED) { -@@ -1507,6 +1520,10 @@ static int lpuart32_config_rs485(struct uart_port *port, struct ktermios *termio - } - - lpuart32_write(&sport->port, modem, UARTMODIR); -+ -+ if (ctrl & UARTCTRL_TE) -+ lpuart32_write(&sport->port, ctrl, UARTCTRL); -+ - return 0; - } - -diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c -index c5a6b133d3643f..51ed40529f9a7b 100644 ---- a/drivers/ufs/host/ufs-qcom.c -+++ b/drivers/ufs/host/ufs-qcom.c -@@ -1918,10 +1918,12 @@ static int ufs_qcom_probe(struct platform_device *pdev) - static int ufs_qcom_remove(struct platform_device *pdev) - { - struct ufs_hba *hba = platform_get_drvdata(pdev); -+ struct ufs_qcom_host *host = ufshcd_get_variant(hba); - - pm_runtime_get_sync(&(pdev)->dev); - ufshcd_remove(hba); -- platform_msi_domain_free_irqs(hba->dev); -+ if (host->esi_enabled) -+ platform_msi_domain_free_irqs(hba->dev); - return 0; - } - -diff --git a/drivers/usb/gadget/function/uvc_v4l2.c b/drivers/usb/gadget/function/uvc_v4l2.c -index 3f0a9795c0d45d..0195625bef53ab 100644 ---- a/drivers/usb/gadget/function/uvc_v4l2.c -+++ b/drivers/usb/gadget/function/uvc_v4l2.c -@@ -121,6 +121,9 @@ static struct uvcg_format *find_format_by_pix(struct uvc_device *uvc, - list_for_each_entry(format, &uvc->header->formats, entry) { - const struct uvc_format_desc *fmtdesc = to_uvc_format(format->fmt); - -+ if (IS_ERR(fmtdesc)) -+ continue; -+ - if (fmtdesc->fcc == pixelformat) { - uformat = format->fmt; - break; -@@ -240,6 +243,7 @@ uvc_v4l2_try_format(struct file *file, void *fh, struct v4l2_format *fmt) - struct uvc_video *video = &uvc->video; - struct uvcg_format *uformat; - struct uvcg_frame *uframe; -+ const struct uvc_format_desc *fmtdesc; - u8 *fcc; - - if (fmt->type != video->queue.queue.type) -@@ -265,7 +269,10 @@ uvc_v4l2_try_format(struct file *file, void *fh, struct v4l2_format *fmt) - fmt->fmt.pix.field = V4L2_FIELD_NONE; - fmt->fmt.pix.bytesperline = uvc_v4l2_get_bytesperline(uformat, uframe); - fmt->fmt.pix.sizeimage = uvc_get_frame_size(uformat, uframe); -- fmt->fmt.pix.pixelformat = to_uvc_format(uformat)->fcc; -+ fmtdesc = to_uvc_format(uformat); -+ if (IS_ERR(fmtdesc)) -+ return PTR_ERR(fmtdesc); -+ fmt->fmt.pix.pixelformat = fmtdesc->fcc; - fmt->fmt.pix.colorspace = V4L2_COLORSPACE_SRGB; - fmt->fmt.pix.priv = 0; - -@@ -375,6 +382,9 @@ uvc_v4l2_enum_format(struct file *file, void *fh, struct v4l2_fmtdesc *f) - return -EINVAL; - - fmtdesc = to_uvc_format(uformat); -+ if (IS_ERR(fmtdesc)) -+ return PTR_ERR(fmtdesc); -+ - f->pixelformat = fmtdesc->fcc; - - return 0; -diff --git a/include/drm/display/drm_dp_mst_helper.h b/include/drm/display/drm_dp_mst_helper.h -index ab1d73f93408e7..46705dacdd0816 100644 ---- a/include/drm/display/drm_dp_mst_helper.h -+++ b/include/drm/display/drm_dp_mst_helper.h -@@ -859,6 +859,8 @@ int drm_dp_check_act_status(struct drm_dp_mst_topology_mgr *mgr); - void drm_dp_mst_dump_topology(struct seq_file *m, - struct drm_dp_mst_topology_mgr *mgr); - -+void drm_dp_mst_topology_queue_probe(struct drm_dp_mst_topology_mgr *mgr); -+ - void drm_dp_mst_topology_mgr_suspend(struct drm_dp_mst_topology_mgr *mgr); - int __must_check - drm_dp_mst_topology_mgr_resume(struct drm_dp_mst_topology_mgr *mgr, -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 191f0f95d3edf6..bc62bb2a3b132e 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -6653,7 +6653,7 @@ static bool try_to_accept_memory_one(struct zone *zone) - - static bool cond_accept_memory(struct zone *zone, unsigned int order) - { -- long to_accept; -+ long to_accept, wmark; - bool ret = false; - - if (!has_unaccepted_memory()) -@@ -6662,8 +6662,18 @@ static bool cond_accept_memory(struct zone *zone, unsigned int order) - if (list_empty(&zone->unaccepted_pages)) - return false; - -+ wmark = high_wmark_pages(zone); -+ -+ /* -+ * Watermarks have not been initialized yet. -+ * -+ * Accepting one MAX_ORDER page to ensure progress. -+ */ -+ if (!wmark) -+ return try_to_accept_memory_one(zone); -+ - /* How much to accept to get to high watermark? */ -- to_accept = high_wmark_pages(zone) - -+ to_accept = wmark - - (zone_page_state(zone, NR_FREE_PAGES) - - __zone_watermark_unusable_free(zone, order, 0) - - zone_page_state(zone, NR_UNACCEPTED)); -diff --git a/net/atm/mpc.c b/net/atm/mpc.c -index 033871e718a34f..583c27131b7d64 100644 ---- a/net/atm/mpc.c -+++ b/net/atm/mpc.c -@@ -1314,6 +1314,8 @@ static void MPOA_cache_impos_rcvd(struct k_message *msg, - holding_time = msg->content.eg_info.holding_time; - dprintk("(%s) entry = %p, holding_time = %u\n", - mpc->dev->name, entry, holding_time); -+ if (entry == NULL && !holding_time) -+ return; - if (entry == NULL && holding_time) { - entry = mpc->eg_ops->add_entry(msg, mpc); - mpc->eg_ops->put(entry); -diff --git a/net/ipv6/netfilter/nf_socket_ipv6.c b/net/ipv6/netfilter/nf_socket_ipv6.c -index a7690ec6232596..9ea5ef56cb2704 100644 ---- a/net/ipv6/netfilter/nf_socket_ipv6.c -+++ b/net/ipv6/netfilter/nf_socket_ipv6.c -@@ -103,6 +103,10 @@ struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb, - struct sk_buff *data_skb = NULL; - int doff = 0; - int thoff = 0, tproto; -+#if IS_ENABLED(CONFIG_NF_CONNTRACK) -+ enum ip_conntrack_info ctinfo; -+ struct nf_conn const *ct; -+#endif - - tproto = ipv6_find_hdr(skb, &thoff, -1, NULL, NULL); - if (tproto < 0) { -@@ -136,6 +140,25 @@ struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb, - return NULL; - } - -+#if IS_ENABLED(CONFIG_NF_CONNTRACK) -+ /* Do the lookup with the original socket address in -+ * case this is a reply packet of an established -+ * SNAT-ted connection. -+ */ -+ ct = nf_ct_get(skb, &ctinfo); -+ if (ct && -+ ((tproto != IPPROTO_ICMPV6 && -+ ctinfo == IP_CT_ESTABLISHED_REPLY) || -+ (tproto == IPPROTO_ICMPV6 && -+ ctinfo == IP_CT_RELATED_REPLY)) && -+ (ct->status & IPS_SRC_NAT_DONE)) { -+ daddr = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.in6; -+ dport = (tproto == IPPROTO_TCP) ? -+ ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.tcp.port : -+ ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.udp.port; -+ } -+#endif -+ - return nf_socket_get_sock_v6(net, data_skb, doff, tproto, saddr, daddr, - sport, dport, indev); - } -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 1fd6e84b0e3718..b3cd6090f46aad 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -10023,6 +10023,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x8811, "HP Spectre x360 15-eb1xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1), - SND_PCI_QUIRK(0x103c, 0x8812, "HP Spectre x360 15-eb1xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1), - SND_PCI_QUIRK(0x103c, 0x881d, "HP 250 G8 Notebook PC", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), -+ SND_PCI_QUIRK(0x103c, 0x881e, "HP Laptop 15s-du3xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), - SND_PCI_QUIRK(0x103c, 0x8846, "HP EliteBook 850 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x8847, "HP EliteBook x360 830 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x884b, "HP EliteBook 840 Aero G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED), -diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c -index 06965da51dd083..be0b3c8ac7055b 100644 ---- a/sound/usb/mixer_quirks.c -+++ b/sound/usb/mixer_quirks.c -@@ -3575,6 +3575,52 @@ static void snd_dragonfly_quirk_db_scale(struct usb_mixer_interface *mixer, - } - } - -+/* -+ * Some Plantronics headsets have control names that don't meet ALSA naming -+ * standards. This function fixes nonstandard source names. By the time -+ * this function is called the control name should look like one of these: -+ * "source names Playback Volume" -+ * "source names Playback Switch" -+ * "source names Capture Volume" -+ * "source names Capture Switch" -+ * If any of the trigger words are found in the name then the name will -+ * be changed to: -+ * "Headset Playback Volume" -+ * "Headset Playback Switch" -+ * "Headset Capture Volume" -+ * "Headset Capture Switch" -+ * depending on the current suffix. -+ */ -+static void snd_fix_plt_name(struct snd_usb_audio *chip, -+ struct snd_ctl_elem_id *id) -+{ -+ /* no variant of "Sidetone" should be added to this list */ -+ static const char * const trigger[] = { -+ "Earphone", "Microphone", "Receive", "Transmit" -+ }; -+ static const char * const suffix[] = { -+ " Playback Volume", " Playback Switch", -+ " Capture Volume", " Capture Switch" -+ }; -+ int i; -+ -+ for (i = 0; i < ARRAY_SIZE(trigger); i++) -+ if (strstr(id->name, trigger[i])) -+ goto triggered; -+ usb_audio_dbg(chip, "no change in %s\n", id->name); -+ return; -+ -+triggered: -+ for (i = 0; i < ARRAY_SIZE(suffix); i++) -+ if (strstr(id->name, suffix[i])) { -+ usb_audio_dbg(chip, "fixing kctl name %s\n", id->name); -+ snprintf(id->name, sizeof(id->name), "Headset%s", -+ suffix[i]); -+ return; -+ } -+ usb_audio_dbg(chip, "something wrong in kctl name %s\n", id->name); -+} -+ - void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer, - struct usb_mixer_elem_info *cval, int unitid, - struct snd_kcontrol *kctl) -@@ -3592,5 +3638,10 @@ void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer, - cval->min_mute = 1; - break; - } -+ -+ /* ALSA-ify some Plantronics headset control names */ -+ if (USB_ID_VENDOR(mixer->chip->usb_id) == 0x047f && -+ (cval->control == UAC_FU_MUTE || cval->control == UAC_FU_VOLUME)) -+ snd_fix_plt_name(mixer->chip, &kctl->id); - } - diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.086-087.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.086-087.patch deleted file mode 100644 index 4d1b91e6ba..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.086-087.patch +++ /dev/null @@ -1,9515 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/vendor-prefixes.yaml b/Documentation/devicetree/bindings/vendor-prefixes.yaml -index 12a16031d7b6d0..dc275ab60e5344 100644 ---- a/Documentation/devicetree/bindings/vendor-prefixes.yaml -+++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml -@@ -524,6 +524,8 @@ patternProperties: - description: GlobalTop Technology, Inc. - "^gmt,.*": - description: Global Mixed-mode Technology, Inc. -+ "^gocontroll,.*": -+ description: GOcontroll Modular Embedded Electronics B.V. - "^goldelico,.*": - description: Golden Delicious Computers GmbH & Co. KG - "^goodix,.*": -diff --git a/Makefile b/Makefile -index 2b22872d3cea59..45f6b7d3d51e26 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 86 -+SUBLEVEL = 87 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm64/kernel/compat_alignment.c b/arch/arm64/kernel/compat_alignment.c -index deff21bfa6800c..b68e1d328d4cb9 100644 ---- a/arch/arm64/kernel/compat_alignment.c -+++ b/arch/arm64/kernel/compat_alignment.c -@@ -368,6 +368,8 @@ int do_compat_alignment_fixup(unsigned long addr, struct pt_regs *regs) - return 1; - } - -+ if (!handler) -+ return 1; - type = handler(addr, instr, regs); - - if (type == TYPE_ERROR || type == TYPE_FAULT) -diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig -index 9fd8644a9a4c6a..623cf80639decc 100644 ---- a/arch/loongarch/Kconfig -+++ b/arch/loongarch/Kconfig -@@ -356,8 +356,8 @@ config CMDLINE_BOOTLOADER - config CMDLINE_EXTEND - bool "Use built-in to extend bootloader kernel arguments" - help -- The command-line arguments provided during boot will be -- appended to the built-in command line. This is useful in -+ The built-in command line will be appended to the command- -+ line arguments provided during boot. This is useful in - cases where the provided arguments are insufficient and - you don't want to or cannot modify them. - -diff --git a/arch/loongarch/include/asm/cache.h b/arch/loongarch/include/asm/cache.h -index 1b6d0961719989..aa622c75441442 100644 ---- a/arch/loongarch/include/asm/cache.h -+++ b/arch/loongarch/include/asm/cache.h -@@ -8,6 +8,8 @@ - #define L1_CACHE_SHIFT CONFIG_L1_CACHE_SHIFT - #define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT) - -+#define ARCH_DMA_MINALIGN (16) -+ - #define __read_mostly __section(".data..read_mostly") - - #endif /* _ASM_CACHE_H */ -diff --git a/arch/loongarch/kernel/kgdb.c b/arch/loongarch/kernel/kgdb.c -index 445c452d72a79c..7be5b4c0c90020 100644 ---- a/arch/loongarch/kernel/kgdb.c -+++ b/arch/loongarch/kernel/kgdb.c -@@ -8,6 +8,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -224,13 +225,13 @@ void kgdb_arch_set_pc(struct pt_regs *regs, unsigned long pc) - regs->csr_era = pc; - } - --void arch_kgdb_breakpoint(void) -+noinline void arch_kgdb_breakpoint(void) - { - __asm__ __volatile__ ( \ - ".globl kgdb_breakinst\n\t" \ -- "nop\n" \ - "kgdb_breakinst:\tbreak 2\n\t"); /* BRK_KDB = 2 */ - } -+STACK_FRAME_NON_STANDARD(arch_kgdb_breakpoint); - - /* - * Calls linux_debug_hook before the kernel dies. If KGDB is enabled, -diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c -index 6595e992fda852..dcb1428b458c8f 100644 ---- a/arch/loongarch/net/bpf_jit.c -+++ b/arch/loongarch/net/bpf_jit.c -@@ -142,6 +142,8 @@ static void build_prologue(struct jit_ctx *ctx) - */ - if (seen_tail_call(ctx) && seen_call(ctx)) - move_reg(ctx, TCC_SAVED, REG_TCC); -+ else -+ emit_insn(ctx, nop); - - ctx->stack_size = stack_adjust; - } -@@ -842,7 +844,10 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext - - move_addr(ctx, t1, func_addr); - emit_insn(ctx, jirl, LOONGARCH_GPR_RA, t1, 0); -- move_reg(ctx, regmap[BPF_REG_0], LOONGARCH_GPR_A0); -+ -+ if (insn->src_reg != BPF_PSEUDO_CALL) -+ move_reg(ctx, regmap[BPF_REG_0], LOONGARCH_GPR_A0); -+ - break; - - /* tail call */ -@@ -867,7 +872,10 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext - { - const u64 imm64 = (u64)(insn + 1)->imm << 32 | (u32)insn->imm; - -- move_imm(ctx, dst, imm64, is32); -+ if (bpf_pseudo_func(insn)) -+ move_addr(ctx, dst, imm64); -+ else -+ move_imm(ctx, dst, imm64, is32); - return 1; - } - -diff --git a/arch/loongarch/net/bpf_jit.h b/arch/loongarch/net/bpf_jit.h -index 68586338ecf859..f9c569f5394914 100644 ---- a/arch/loongarch/net/bpf_jit.h -+++ b/arch/loongarch/net/bpf_jit.h -@@ -27,6 +27,11 @@ struct jit_data { - struct jit_ctx ctx; - }; - -+static inline void emit_nop(union loongarch_instruction *insn) -+{ -+ insn->word = INSN_NOP; -+} -+ - #define emit_insn(ctx, func, ...) \ - do { \ - if (ctx->image != NULL) { \ -diff --git a/arch/powerpc/configs/mpc885_ads_defconfig b/arch/powerpc/configs/mpc885_ads_defconfig -index 56b876e418e915..6b998cb5725538 100644 ---- a/arch/powerpc/configs/mpc885_ads_defconfig -+++ b/arch/powerpc/configs/mpc885_ads_defconfig -@@ -78,4 +78,4 @@ CONFIG_DEBUG_VM_PGTABLE=y - CONFIG_DETECT_HUNG_TASK=y - CONFIG_BDI_SWITCH=y - CONFIG_PPC_EARLY_DEBUG=y --CONFIG_GENERIC_PTDUMP=y -+CONFIG_PTDUMP_DEBUGFS=y -diff --git a/arch/powerpc/platforms/cell/spufs/gang.c b/arch/powerpc/platforms/cell/spufs/gang.c -index 827d338deaf4c6..2c2999de6bfa25 100644 ---- a/arch/powerpc/platforms/cell/spufs/gang.c -+++ b/arch/powerpc/platforms/cell/spufs/gang.c -@@ -25,6 +25,7 @@ struct spu_gang *alloc_spu_gang(void) - mutex_init(&gang->aff_mutex); - INIT_LIST_HEAD(&gang->list); - INIT_LIST_HEAD(&gang->aff_list_head); -+ gang->alive = 1; - - out: - return gang; -diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c -index 38c5be34c8951f..3216245a648ae6 100644 ---- a/arch/powerpc/platforms/cell/spufs/inode.c -+++ b/arch/powerpc/platforms/cell/spufs/inode.c -@@ -191,13 +191,32 @@ static int spufs_fill_dir(struct dentry *dir, - return -ENOMEM; - ret = spufs_new_file(dir->d_sb, dentry, files->ops, - files->mode & mode, files->size, ctx); -- if (ret) -+ if (ret) { -+ dput(dentry); - return ret; -+ } - files++; - } - return 0; - } - -+static void unuse_gang(struct dentry *dir) -+{ -+ struct inode *inode = dir->d_inode; -+ struct spu_gang *gang = SPUFS_I(inode)->i_gang; -+ -+ if (gang) { -+ bool dead; -+ -+ inode_lock(inode); // exclusion with spufs_create_context() -+ dead = !--gang->alive; -+ inode_unlock(inode); -+ -+ if (dead) -+ simple_recursive_removal(dir, NULL); -+ } -+} -+ - static int spufs_dir_close(struct inode *inode, struct file *file) - { - struct inode *parent; -@@ -212,6 +231,7 @@ static int spufs_dir_close(struct inode *inode, struct file *file) - inode_unlock(parent); - WARN_ON(ret); - -+ unuse_gang(dir->d_parent); - return dcache_dir_close(inode, file); - } - -@@ -404,7 +424,7 @@ spufs_create_context(struct inode *inode, struct dentry *dentry, - { - int ret; - int affinity; -- struct spu_gang *gang; -+ struct spu_gang *gang = SPUFS_I(inode)->i_gang; - struct spu_context *neighbor; - struct path path = {.mnt = mnt, .dentry = dentry}; - -@@ -419,11 +439,15 @@ spufs_create_context(struct inode *inode, struct dentry *dentry, - if ((flags & SPU_CREATE_ISOLATE) && !isolated_loader) - return -ENODEV; - -- gang = NULL; -+ if (gang) { -+ if (!gang->alive) -+ return -ENOENT; -+ gang->alive++; -+ } -+ - neighbor = NULL; - affinity = flags & (SPU_CREATE_AFFINITY_MEM | SPU_CREATE_AFFINITY_SPU); - if (affinity) { -- gang = SPUFS_I(inode)->i_gang; - if (!gang) - return -EINVAL; - mutex_lock(&gang->aff_mutex); -@@ -435,8 +459,11 @@ spufs_create_context(struct inode *inode, struct dentry *dentry, - } - - ret = spufs_mkdir(inode, dentry, flags, mode & 0777); -- if (ret) -+ if (ret) { -+ if (neighbor) -+ put_spu_context(neighbor); - goto out_aff_unlock; -+ } - - if (affinity) { - spufs_set_affinity(flags, SPUFS_I(d_inode(dentry))->i_ctx, -@@ -452,6 +479,8 @@ spufs_create_context(struct inode *inode, struct dentry *dentry, - out_aff_unlock: - if (affinity) - mutex_unlock(&gang->aff_mutex); -+ if (ret && gang) -+ gang->alive--; // can't reach 0 - return ret; - } - -@@ -481,6 +510,7 @@ spufs_mkgang(struct inode *dir, struct dentry *dentry, umode_t mode) - inode->i_fop = &simple_dir_operations; - - d_instantiate(dentry, inode); -+ dget(dentry); - inc_nlink(dir); - inc_nlink(d_inode(dentry)); - return ret; -@@ -491,6 +521,21 @@ spufs_mkgang(struct inode *dir, struct dentry *dentry, umode_t mode) - return ret; - } - -+static int spufs_gang_close(struct inode *inode, struct file *file) -+{ -+ unuse_gang(file->f_path.dentry); -+ return dcache_dir_close(inode, file); -+} -+ -+static const struct file_operations spufs_gang_fops = { -+ .open = dcache_dir_open, -+ .release = spufs_gang_close, -+ .llseek = dcache_dir_lseek, -+ .read = generic_read_dir, -+ .iterate_shared = dcache_readdir, -+ .fsync = noop_fsync, -+}; -+ - static int spufs_gang_open(const struct path *path) - { - int ret; -@@ -510,7 +555,7 @@ static int spufs_gang_open(const struct path *path) - return PTR_ERR(filp); - } - -- filp->f_op = &simple_dir_operations; -+ filp->f_op = &spufs_gang_fops; - fd_install(ret, filp); - return ret; - } -@@ -525,10 +570,8 @@ static int spufs_create_gang(struct inode *inode, - ret = spufs_mkgang(inode, dentry, mode & 0777); - if (!ret) { - ret = spufs_gang_open(&path); -- if (ret < 0) { -- int err = simple_rmdir(inode, dentry); -- WARN_ON(err); -- } -+ if (ret < 0) -+ unuse_gang(dentry); - } - return ret; - } -diff --git a/arch/powerpc/platforms/cell/spufs/spufs.h b/arch/powerpc/platforms/cell/spufs/spufs.h -index 84958487f696a4..d33787c57c39a2 100644 ---- a/arch/powerpc/platforms/cell/spufs/spufs.h -+++ b/arch/powerpc/platforms/cell/spufs/spufs.h -@@ -151,6 +151,8 @@ struct spu_gang { - int aff_flags; - struct spu *aff_ref_spu; - atomic_t aff_sched_count; -+ -+ int alive; - }; - - /* Flag bits for spu_gang aff_flags */ -diff --git a/arch/riscv/errata/Makefile b/arch/riscv/errata/Makefile -index 8a27394851233d..f96ace8ea1df14 100644 ---- a/arch/riscv/errata/Makefile -+++ b/arch/riscv/errata/Makefile -@@ -1,5 +1,9 @@ - ifdef CONFIG_RELOCATABLE --KBUILD_CFLAGS += -fno-pie -+# We can't use PIC/PIE when handling early-boot errata parsing, as the kernel -+# doesn't have a GOT setup at that point. So instead just use medany: it's -+# usually position-independent, so it should be good enough for the errata -+# handling. -+KBUILD_CFLAGS += -fno-pie -mcmodel=medany - endif - - obj-$(CONFIG_ERRATA_ANDES) += andes/ -diff --git a/arch/riscv/include/asm/ftrace.h b/arch/riscv/include/asm/ftrace.h -index 42777f91a9c580..9004dfec8c8559 100644 ---- a/arch/riscv/include/asm/ftrace.h -+++ b/arch/riscv/include/asm/ftrace.h -@@ -103,7 +103,7 @@ struct dyn_arch_ftrace { - #define make_call_t0(caller, callee, call) \ - do { \ - unsigned int offset = \ -- (unsigned long) callee - (unsigned long) caller; \ -+ (unsigned long) (callee) - (unsigned long) (caller); \ - call[0] = to_auipc_t0(offset); \ - call[1] = to_jalr_t0(offset); \ - } while (0) -@@ -119,7 +119,7 @@ do { \ - #define make_call_ra(caller, callee, call) \ - do { \ - unsigned int offset = \ -- (unsigned long) callee - (unsigned long) caller; \ -+ (unsigned long) (callee) - (unsigned long) (caller); \ - call[0] = to_auipc_ra(offset); \ - call[1] = to_jalr_ra(offset); \ - } while (0) -diff --git a/arch/riscv/kvm/vcpu_pmu.c b/arch/riscv/kvm/vcpu_pmu.c -index cee1b9ca4ec481..e2e2a115afb5c3 100644 ---- a/arch/riscv/kvm/vcpu_pmu.c -+++ b/arch/riscv/kvm/vcpu_pmu.c -@@ -468,6 +468,7 @@ int kvm_riscv_vcpu_pmu_ctr_cfg_match(struct kvm_vcpu *vcpu, unsigned long ctr_ba - .type = etype, - .size = sizeof(struct perf_event_attr), - .pinned = true, -+ .disabled = true, - /* - * It should never reach here if the platform doesn't support the sscofpmf - * extension as mode filtering won't work without it. -diff --git a/arch/riscv/mm/hugetlbpage.c b/arch/riscv/mm/hugetlbpage.c -index c9d70dc310d59f..57afbc3270a3cf 100644 ---- a/arch/riscv/mm/hugetlbpage.c -+++ b/arch/riscv/mm/hugetlbpage.c -@@ -148,22 +148,25 @@ unsigned long hugetlb_mask_last_page(struct hstate *h) - static pte_t get_clear_contig(struct mm_struct *mm, - unsigned long addr, - pte_t *ptep, -- unsigned long pte_num) -+ unsigned long ncontig) - { -- pte_t orig_pte = ptep_get(ptep); -- unsigned long i; -- -- for (i = 0; i < pte_num; i++, addr += PAGE_SIZE, ptep++) { -- pte_t pte = ptep_get_and_clear(mm, addr, ptep); -- -- if (pte_dirty(pte)) -- orig_pte = pte_mkdirty(orig_pte); -- -- if (pte_young(pte)) -- orig_pte = pte_mkyoung(orig_pte); -+ pte_t pte, tmp_pte; -+ bool present; -+ -+ pte = ptep_get_and_clear(mm, addr, ptep); -+ present = pte_present(pte); -+ while (--ncontig) { -+ ptep++; -+ addr += PAGE_SIZE; -+ tmp_pte = ptep_get_and_clear(mm, addr, ptep); -+ if (present) { -+ if (pte_dirty(tmp_pte)) -+ pte = pte_mkdirty(pte); -+ if (pte_young(tmp_pte)) -+ pte = pte_mkyoung(pte); -+ } - } -- -- return orig_pte; -+ return pte; - } - - static pte_t get_clear_contig_flush(struct mm_struct *mm, -@@ -212,6 +215,26 @@ static void clear_flush(struct mm_struct *mm, - flush_tlb_range(&vma, saddr, addr); - } - -+static int num_contig_ptes_from_size(unsigned long sz, size_t *pgsize) -+{ -+ unsigned long hugepage_shift; -+ -+ if (sz >= PGDIR_SIZE) -+ hugepage_shift = PGDIR_SHIFT; -+ else if (sz >= P4D_SIZE) -+ hugepage_shift = P4D_SHIFT; -+ else if (sz >= PUD_SIZE) -+ hugepage_shift = PUD_SHIFT; -+ else if (sz >= PMD_SIZE) -+ hugepage_shift = PMD_SHIFT; -+ else -+ hugepage_shift = PAGE_SHIFT; -+ -+ *pgsize = 1 << hugepage_shift; -+ -+ return sz >> hugepage_shift; -+} -+ - /* - * When dealing with NAPOT mappings, the privileged specification indicates that - * "if an update needs to be made, the OS generally should first mark all of the -@@ -226,22 +249,10 @@ void set_huge_pte_at(struct mm_struct *mm, - pte_t pte, - unsigned long sz) - { -- unsigned long hugepage_shift, pgsize; -+ size_t pgsize; - int i, pte_num; - -- if (sz >= PGDIR_SIZE) -- hugepage_shift = PGDIR_SHIFT; -- else if (sz >= P4D_SIZE) -- hugepage_shift = P4D_SHIFT; -- else if (sz >= PUD_SIZE) -- hugepage_shift = PUD_SHIFT; -- else if (sz >= PMD_SIZE) -- hugepage_shift = PMD_SHIFT; -- else -- hugepage_shift = PAGE_SHIFT; -- -- pte_num = sz >> hugepage_shift; -- pgsize = 1 << hugepage_shift; -+ pte_num = num_contig_ptes_from_size(sz, &pgsize); - - if (!pte_present(pte)) { - for (i = 0; i < pte_num; i++, ptep++, addr += pgsize) -@@ -295,13 +306,14 @@ pte_t huge_ptep_get_and_clear(struct mm_struct *mm, - unsigned long addr, - pte_t *ptep, unsigned long sz) - { -+ size_t pgsize; - pte_t orig_pte = ptep_get(ptep); - int pte_num; - - if (!pte_napot(orig_pte)) - return ptep_get_and_clear(mm, addr, ptep); - -- pte_num = napot_pte_num(napot_cont_order(orig_pte)); -+ pte_num = num_contig_ptes_from_size(sz, &pgsize); - - return get_clear_contig(mm, addr, ptep, pte_num); - } -@@ -351,6 +363,7 @@ void huge_pte_clear(struct mm_struct *mm, - pte_t *ptep, - unsigned long sz) - { -+ size_t pgsize; - pte_t pte = ptep_get(ptep); - int i, pte_num; - -@@ -359,8 +372,9 @@ void huge_pte_clear(struct mm_struct *mm, - return; - } - -- pte_num = napot_pte_num(napot_cont_order(pte)); -- for (i = 0; i < pte_num; i++, addr += PAGE_SIZE, ptep++) -+ pte_num = num_contig_ptes_from_size(sz, &pgsize); -+ -+ for (i = 0; i < pte_num; i++, addr += pgsize, ptep++) - pte_clear(mm, addr, ptep); - } - -diff --git a/arch/um/include/shared/os.h b/arch/um/include/shared/os.h -index 0df646c6651ea0..3b382da2996f01 100644 ---- a/arch/um/include/shared/os.h -+++ b/arch/um/include/shared/os.h -@@ -211,7 +211,6 @@ extern int os_protect_memory(void *addr, unsigned long len, - extern int os_unmap_memory(void *addr, int len); - extern int os_drop_memory(void *addr, int length); - extern int can_drop_memory(void); --extern int os_mincore(void *addr, unsigned long len); - - /* execvp.c */ - extern int execvp_noalloc(char *buf, const char *file, char *const argv[]); -diff --git a/arch/um/kernel/Makefile b/arch/um/kernel/Makefile -index 811188be954cad..321250f3f57035 100644 ---- a/arch/um/kernel/Makefile -+++ b/arch/um/kernel/Makefile -@@ -17,7 +17,7 @@ extra-y := vmlinux.lds - obj-y = config.o exec.o exitcode.o irq.o ksyms.o mem.o \ - physmem.o process.o ptrace.o reboot.o sigio.o \ - signal.o sysrq.o time.o tlb.o trap.o \ -- um_arch.o umid.o maccess.o kmsg_dump.o capflags.o skas/ -+ um_arch.o umid.o kmsg_dump.o capflags.o skas/ - obj-y += load_file.o - - obj-$(CONFIG_BLK_DEV_INITRD) += initrd.o -diff --git a/arch/um/kernel/maccess.c b/arch/um/kernel/maccess.c -deleted file mode 100644 -index 8ccd56813f684f..00000000000000 ---- a/arch/um/kernel/maccess.c -+++ /dev/null -@@ -1,19 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0-only --/* -- * Copyright (C) 2013 Richard Weinberger -- */ -- --#include --#include --#include -- --bool copy_from_kernel_nofault_allowed(const void *src, size_t size) --{ -- void *psrc = (void *)rounddown((unsigned long)src, PAGE_SIZE); -- -- if ((unsigned long)src < PAGE_SIZE || size <= 0) -- return false; -- if (os_mincore(psrc, size + src - psrc) <= 0) -- return false; -- return true; --} -diff --git a/arch/um/os-Linux/process.c b/arch/um/os-Linux/process.c -index e52dd37ddadccc..2686120ab2325a 100644 ---- a/arch/um/os-Linux/process.c -+++ b/arch/um/os-Linux/process.c -@@ -223,57 +223,6 @@ int __init can_drop_memory(void) - return ok; - } - --static int os_page_mincore(void *addr) --{ -- char vec[2]; -- int ret; -- -- ret = mincore(addr, UM_KERN_PAGE_SIZE, vec); -- if (ret < 0) { -- if (errno == ENOMEM || errno == EINVAL) -- return 0; -- else -- return -errno; -- } -- -- return vec[0] & 1; --} -- --int os_mincore(void *addr, unsigned long len) --{ -- char *vec; -- int ret, i; -- -- if (len <= UM_KERN_PAGE_SIZE) -- return os_page_mincore(addr); -- -- vec = calloc(1, (len + UM_KERN_PAGE_SIZE - 1) / UM_KERN_PAGE_SIZE); -- if (!vec) -- return -ENOMEM; -- -- ret = mincore(addr, UM_KERN_PAGE_SIZE, vec); -- if (ret < 0) { -- if (errno == ENOMEM || errno == EINVAL) -- ret = 0; -- else -- ret = -errno; -- -- goto out; -- } -- -- for (i = 0; i < ((len + UM_KERN_PAGE_SIZE - 1) / UM_KERN_PAGE_SIZE); i++) { -- if (!(vec[i] & 1)) { -- ret = 0; -- goto out; -- } -- } -- -- ret = 1; --out: -- free(vec); -- return ret; --} -- - void init_new_thread_signals(void) - { - set_handler(SIGSEGV); -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index a06fab5016fdf4..a0af6e8d584b02 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -215,7 +215,7 @@ config X86 - select HAVE_SAMPLE_FTRACE_DIRECT_MULTI if X86_64 - select HAVE_EBPF_JIT - select HAVE_EFFICIENT_UNALIGNED_ACCESS -- select HAVE_EISA -+ select HAVE_EISA if X86_32 - select HAVE_EXIT_THREAD - select HAVE_FAST_GUP - select HAVE_FENTRY if X86_64 || DYNAMIC_FTRACE -diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h -index f6907627172ba9..01e9593e2bd95a 100644 ---- a/arch/x86/entry/calling.h -+++ b/arch/x86/entry/calling.h -@@ -70,6 +70,8 @@ For 32-bit we have the following conventions - kernel is built with - pushq %rsi /* pt_regs->si */ - movq 8(%rsp), %rsi /* temporarily store the return address in %rsi */ - movq %rdi, 8(%rsp) /* pt_regs->di (overwriting original return address) */ -+ /* We just clobbered the return address - use the IRET frame for unwinding: */ -+ UNWIND_HINT_IRET_REGS offset=3*8 - .else - pushq %rdi /* pt_regs->di */ - pushq %rsi /* pt_regs->si */ -diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c -index b163817ad6daff..66d5782df18f8c 100644 ---- a/arch/x86/events/intel/core.c -+++ b/arch/x86/events/intel/core.c -@@ -2720,28 +2720,33 @@ static u64 adl_update_topdown_event(struct perf_event *event) - - DEFINE_STATIC_CALL(intel_pmu_update_topdown_event, x86_perf_event_update); - --static void intel_pmu_read_topdown_event(struct perf_event *event) -+static void intel_pmu_read_event(struct perf_event *event) - { -- struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events); -+ if (event->hw.flags & (PERF_X86_EVENT_AUTO_RELOAD | PERF_X86_EVENT_TOPDOWN)) { -+ struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events); -+ bool pmu_enabled = cpuc->enabled; - -- /* Only need to call update_topdown_event() once for group read. */ -- if ((cpuc->txn_flags & PERF_PMU_TXN_READ) && -- !is_slots_event(event)) -- return; -+ /* Only need to call update_topdown_event() once for group read. */ -+ if (is_metric_event(event) && (cpuc->txn_flags & PERF_PMU_TXN_READ)) -+ return; - -- perf_pmu_disable(event->pmu); -- static_call(intel_pmu_update_topdown_event)(event); -- perf_pmu_enable(event->pmu); --} -+ cpuc->enabled = 0; -+ if (pmu_enabled) -+ intel_pmu_disable_all(); - --static void intel_pmu_read_event(struct perf_event *event) --{ -- if (event->hw.flags & PERF_X86_EVENT_AUTO_RELOAD) -- intel_pmu_auto_reload_read(event); -- else if (is_topdown_count(event)) -- intel_pmu_read_topdown_event(event); -- else -- x86_perf_event_update(event); -+ if (is_topdown_event(event)) -+ static_call(intel_pmu_update_topdown_event)(event); -+ else -+ intel_pmu_drain_pebs_buffer(); -+ -+ cpuc->enabled = pmu_enabled; -+ if (pmu_enabled) -+ intel_pmu_enable_all(0); -+ -+ return; -+ } -+ -+ x86_perf_event_update(event); - } - - static void intel_pmu_enable_fixed(struct perf_event *event) -@@ -3006,7 +3011,7 @@ static int handle_pmi_common(struct pt_regs *regs, u64 status) - - handled++; - x86_pmu_handle_guest_pebs(regs, &data); -- x86_pmu.drain_pebs(regs, &data); -+ static_call(x86_pmu_drain_pebs)(regs, &data); - status &= intel_ctrl | GLOBAL_STATUS_TRACE_TOPAPMI; - - /* -diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c -index d9a51b638931c6..dcb1e9b8d86629 100644 ---- a/arch/x86/events/intel/ds.c -+++ b/arch/x86/events/intel/ds.c -@@ -843,11 +843,11 @@ int intel_pmu_drain_bts_buffer(void) - return 1; - } - --static inline void intel_pmu_drain_pebs_buffer(void) -+void intel_pmu_drain_pebs_buffer(void) - { - struct perf_sample_data data; - -- x86_pmu.drain_pebs(NULL, &data); -+ static_call(x86_pmu_drain_pebs)(NULL, &data); - } - - /* -@@ -1965,15 +1965,6 @@ get_next_pebs_record_by_bit(void *base, void *top, int bit) - return NULL; - } - --void intel_pmu_auto_reload_read(struct perf_event *event) --{ -- WARN_ON(!(event->hw.flags & PERF_X86_EVENT_AUTO_RELOAD)); -- -- perf_pmu_disable(event->pmu); -- intel_pmu_drain_pebs_buffer(); -- perf_pmu_enable(event->pmu); --} -- - /* - * Special variant of intel_pmu_save_and_restart() for auto-reload. - */ -diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h -index c8ba2be7585d44..4564521296acb3 100644 ---- a/arch/x86/events/perf_event.h -+++ b/arch/x86/events/perf_event.h -@@ -1052,6 +1052,7 @@ extern struct x86_pmu x86_pmu __read_mostly; - - DECLARE_STATIC_CALL(x86_pmu_set_period, *x86_pmu.set_period); - DECLARE_STATIC_CALL(x86_pmu_update, *x86_pmu.update); -+DECLARE_STATIC_CALL(x86_pmu_drain_pebs, *x86_pmu.drain_pebs); - - static __always_inline struct x86_perf_task_context_opt *task_context_opt(void *ctx) - { -@@ -1539,7 +1540,7 @@ void intel_pmu_pebs_disable_all(void); - - void intel_pmu_pebs_sched_task(struct perf_event_pmu_context *pmu_ctx, bool sched_in); - --void intel_pmu_auto_reload_read(struct perf_event *event); -+void intel_pmu_drain_pebs_buffer(void); - - void intel_pmu_store_pebs_lbrs(struct lbr_entry *lbr); - -diff --git a/arch/x86/hyperv/hv_vtl.c b/arch/x86/hyperv/hv_vtl.c -index c2f78fabc865bb..b12bef0ff7bb6f 100644 ---- a/arch/x86/hyperv/hv_vtl.c -+++ b/arch/x86/hyperv/hv_vtl.c -@@ -30,6 +30,7 @@ void __init hv_vtl_init_platform(void) - x86_platform.realmode_init = x86_init_noop; - x86_init.irqs.pre_vector_init = x86_init_noop; - x86_init.timers.timer_init = x86_init_noop; -+ x86_init.resources.probe_roms = x86_init_noop; - - /* Avoid searching for BIOS MP tables */ - x86_init.mpparse.find_smp_config = x86_init_noop; -diff --git a/arch/x86/hyperv/ivm.c b/arch/x86/hyperv/ivm.c -index 8c6bf07f7d2b80..87eabfcc1d1c29 100644 ---- a/arch/x86/hyperv/ivm.c -+++ b/arch/x86/hyperv/ivm.c -@@ -338,7 +338,7 @@ int hv_snp_boot_ap(int cpu, unsigned long start_ip) - vmsa->sev_features = sev_status >> 2; - - ret = snp_set_vmsa(vmsa, true); -- if (!ret) { -+ if (ret) { - pr_err("RMPADJUST(%llx) failed: %llx\n", (u64)vmsa, ret); - free_page((u64)vmsa); - return ret; -@@ -464,7 +464,6 @@ static int hv_mark_gpa_visibility(u16 count, const u64 pfn[], - enum hv_mem_host_visibility visibility) - { - struct hv_gpa_range_for_visibility *input; -- u16 pages_processed; - u64 hv_status; - unsigned long flags; - -@@ -493,7 +492,7 @@ static int hv_mark_gpa_visibility(u16 count, const u64 pfn[], - memcpy((void *)input->gpa_page_list, pfn, count * sizeof(*pfn)); - hv_status = hv_do_rep_hypercall( - HVCALL_MODIFY_SPARSE_GPA_PAGE_HOST_VISIBILITY, count, -- 0, input, &pages_processed); -+ 0, input, NULL); - local_irq_restore(flags); - - if (hv_result_success(hv_status)) -diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h -index 5d61adc6e892ea..a496d9dc75d94b 100644 ---- a/arch/x86/include/asm/tlbflush.h -+++ b/arch/x86/include/asm/tlbflush.h -@@ -242,7 +242,7 @@ void flush_tlb_multi(const struct cpumask *cpumask, - flush_tlb_mm_range((vma)->vm_mm, start, end, \ - ((vma)->vm_flags & VM_HUGETLB) \ - ? huge_page_shift(hstate_vma(vma)) \ -- : PAGE_SHIFT, false) -+ : PAGE_SHIFT, true) - - extern void flush_tlb_all(void); - extern void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start, -diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c -index c683e8dedfee83..0ee172ce2d2124 100644 ---- a/arch/x86/kernel/cpu/microcode/amd.c -+++ b/arch/x86/kernel/cpu/microcode/amd.c -@@ -603,7 +603,7 @@ static bool __apply_microcode_amd(struct microcode_amd *mc, u32 *cur_rev, - unsigned long p_addr = (unsigned long)&mc->hdr.data_code; - - if (!verify_sha256_digest(mc->hdr.patch_id, *cur_rev, (const u8 *)p_addr, psize)) -- return -1; -+ return false; - - native_wrmsrl(MSR_AMD64_PATCH_LOADER, p_addr); - -diff --git a/arch/x86/kernel/cpu/sgx/driver.c b/arch/x86/kernel/cpu/sgx/driver.c -index 262f5fb18d74d3..c453953d5a33fb 100644 ---- a/arch/x86/kernel/cpu/sgx/driver.c -+++ b/arch/x86/kernel/cpu/sgx/driver.c -@@ -150,13 +150,15 @@ int __init sgx_drv_init(void) - u64 xfrm_mask; - int ret; - -- if (!cpu_feature_enabled(X86_FEATURE_SGX_LC)) -+ if (!cpu_feature_enabled(X86_FEATURE_SGX_LC)) { -+ pr_info("SGX disabled: SGX launch control CPU feature is not available, /dev/sgx_enclave disabled.\n"); - return -ENODEV; -+ } - - cpuid_count(SGX_CPUID, 0, &eax, &ebx, &ecx, &edx); - - if (!(eax & 1)) { -- pr_err("SGX disabled: SGX1 instruction support not available.\n"); -+ pr_info("SGX disabled: SGX1 instruction support not available, /dev/sgx_enclave disabled.\n"); - return -ENODEV; - } - -@@ -173,8 +175,10 @@ int __init sgx_drv_init(void) - } - - ret = misc_register(&sgx_dev_enclave); -- if (ret) -+ if (ret) { -+ pr_info("SGX disabled: Unable to register the /dev/sgx_enclave driver (%d).\n", ret); - return ret; -+ } - - return 0; - } -diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c -index f18ca44c904b74..52dc5839d1e8e9 100644 ---- a/arch/x86/kernel/dumpstack.c -+++ b/arch/x86/kernel/dumpstack.c -@@ -195,6 +195,7 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, - printk("%sCall Trace:\n", log_lvl); - - unwind_start(&state, task, regs, stack); -+ stack = stack ?: get_stack_pointer(task, regs); - regs = unwind_get_entry_regs(&state, &partial); - - /* -@@ -213,9 +214,7 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, - * - hardirq stack - * - entry stack - */ -- for (stack = stack ?: get_stack_pointer(task, regs); -- stack; -- stack = stack_info.next_sp) { -+ for (; stack; stack = stack_info.next_sp) { - const char *stack_name; - - stack = PTR_ALIGN(stack, sizeof(long)); -diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c -index 4b414b0ab0692a..aaed20f46be4ce 100644 ---- a/arch/x86/kernel/fpu/core.c -+++ b/arch/x86/kernel/fpu/core.c -@@ -220,7 +220,7 @@ bool fpu_alloc_guest_fpstate(struct fpu_guest *gfpu) - struct fpstate *fpstate; - unsigned int size; - -- size = fpu_user_cfg.default_size + ALIGN(offsetof(struct fpstate, regs), 64); -+ size = fpu_kernel_cfg.default_size + ALIGN(offsetof(struct fpstate, regs), 64); - fpstate = vzalloc(size); - if (!fpstate) - return false; -@@ -232,8 +232,8 @@ bool fpu_alloc_guest_fpstate(struct fpu_guest *gfpu) - fpstate->is_guest = true; - - gfpu->fpstate = fpstate; -- gfpu->xfeatures = fpu_user_cfg.default_features; -- gfpu->perm = fpu_user_cfg.default_features; -+ gfpu->xfeatures = fpu_kernel_cfg.default_features; -+ gfpu->perm = fpu_kernel_cfg.default_features; - - /* - * KVM sets the FP+SSE bits in the XSAVE header when copying FPU state -diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c -index 5351f293f770b5..bbe11363550bea 100644 ---- a/arch/x86/kernel/process.c -+++ b/arch/x86/kernel/process.c -@@ -92,7 +92,12 @@ EXPORT_PER_CPU_SYMBOL_GPL(__tss_limit_invalid); - */ - int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src) - { -- memcpy(dst, src, arch_task_struct_size); -+ /* init_task is not dynamically sized (incomplete FPU state) */ -+ if (unlikely(src == &init_task)) -+ memcpy_and_pad(dst, arch_task_struct_size, src, sizeof(init_task), 0); -+ else -+ memcpy(dst, src, arch_task_struct_size); -+ - #ifdef CONFIG_VM86 - dst->thread.vm86 = NULL; - #endif -diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c -index 37b8e20c03a9fe..d8d9bc5a9b3280 100644 ---- a/arch/x86/kernel/traps.c -+++ b/arch/x86/kernel/traps.c -@@ -377,6 +377,21 @@ __visible void __noreturn handle_stack_overflow(struct pt_regs *regs, - } - #endif - -+/* -+ * Prevent the compiler and/or objtool from marking the !CONFIG_X86_ESPFIX64 -+ * version of exc_double_fault() as noreturn. Otherwise the noreturn mismatch -+ * between configs triggers objtool warnings. -+ * -+ * This is a temporary hack until we have compiler or plugin support for -+ * annotating noreturns. -+ */ -+#ifdef CONFIG_X86_ESPFIX64 -+#define always_true() true -+#else -+bool always_true(void); -+bool __weak always_true(void) { return true; } -+#endif -+ - /* - * Runs on an IST stack for x86_64 and on a special task stack for x86_32. - * -@@ -512,7 +527,8 @@ DEFINE_IDTENTRY_DF(exc_double_fault) - - pr_emerg("PANIC: double fault, error_code: 0x%lx\n", error_code); - die("double fault", regs, error_code); -- panic("Machine halted."); -+ if (always_true()) -+ panic("Machine halted."); - instrumentation_end(); - } - -diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c -index 15f97c0abc9d09..81e9b436c3b686 100644 ---- a/arch/x86/kernel/tsc.c -+++ b/arch/x86/kernel/tsc.c -@@ -955,7 +955,7 @@ static unsigned long long cyc2ns_suspend; - - void tsc_save_sched_clock_state(void) - { -- if (!sched_clock_stable()) -+ if (!static_branch_likely(&__use_tsc) && !sched_clock_stable()) - return; - - cyc2ns_suspend = sched_clock(); -@@ -975,7 +975,7 @@ void tsc_restore_sched_clock_state(void) - unsigned long flags; - int cpu; - -- if (!sched_clock_stable()) -+ if (!static_branch_likely(&__use_tsc) && !sched_clock_stable()) - return; - - local_irq_save(flags); -diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S -index 0a81aafed7f88e..0544a24baedb5b 100644 ---- a/arch/x86/lib/copy_user_64.S -+++ b/arch/x86/lib/copy_user_64.S -@@ -74,6 +74,24 @@ SYM_FUNC_START(rep_movs_alternative) - _ASM_EXTABLE_UA( 0b, 1b) - - .Llarge_movsq: -+ /* Do the first possibly unaligned word */ -+0: movq (%rsi),%rax -+1: movq %rax,(%rdi) -+ -+ _ASM_EXTABLE_UA( 0b, .Lcopy_user_tail) -+ _ASM_EXTABLE_UA( 1b, .Lcopy_user_tail) -+ -+ /* What would be the offset to the aligned destination? */ -+ leaq 8(%rdi),%rax -+ andq $-8,%rax -+ subq %rdi,%rax -+ -+ /* .. and update pointers and count to match */ -+ addq %rax,%rdi -+ addq %rax,%rsi -+ subq %rax,%rcx -+ -+ /* make %rcx contain the number of words, %rax the remainder */ - movq %rcx,%rax - shrq $3,%rcx - andl $7,%eax -diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c -index cc47a818a640af..075899e3fc8a45 100644 ---- a/arch/x86/mm/mem_encrypt_identity.c -+++ b/arch/x86/mm/mem_encrypt_identity.c -@@ -562,7 +562,7 @@ void __head sme_enable(struct boot_params *bp) - } - - RIP_REL_REF(sme_me_mask) = me_mask; -- physical_mask &= ~me_mask; -- cc_vendor = CC_VENDOR_AMD; -+ RIP_REL_REF(physical_mask) &= ~me_mask; -+ RIP_REL_REF(cc_vendor) = CC_VENDOR_AMD; - cc_set_mask(me_mask); - } -diff --git a/arch/x86/mm/pat/cpa-test.c b/arch/x86/mm/pat/cpa-test.c -index 3d2f7f0a6ed142..ad3c1feec990db 100644 ---- a/arch/x86/mm/pat/cpa-test.c -+++ b/arch/x86/mm/pat/cpa-test.c -@@ -183,7 +183,7 @@ static int pageattr_test(void) - break; - - case 1: -- err = change_page_attr_set(addrs, len[1], PAGE_CPA_TEST, 1); -+ err = change_page_attr_set(addrs, len[i], PAGE_CPA_TEST, 1); - break; - - case 2: -diff --git a/arch/x86/mm/pat/memtype.c b/arch/x86/mm/pat/memtype.c -index e7b9ac63bb02aa..8dc4eedd49475a 100644 ---- a/arch/x86/mm/pat/memtype.c -+++ b/arch/x86/mm/pat/memtype.c -@@ -982,29 +982,42 @@ static int get_pat_info(struct vm_area_struct *vma, resource_size_t *paddr, - return -EINVAL; - } - --/* -- * track_pfn_copy is called when vma that is covering the pfnmap gets -- * copied through copy_page_range(). -- * -- * If the vma has a linear pfn mapping for the entire range, we get the prot -- * from pte and reserve the entire vma range with single reserve_pfn_range call. -- */ --int track_pfn_copy(struct vm_area_struct *vma) -+int track_pfn_copy(struct vm_area_struct *dst_vma, -+ struct vm_area_struct *src_vma, unsigned long *pfn) - { -+ const unsigned long vma_size = src_vma->vm_end - src_vma->vm_start; - resource_size_t paddr; -- unsigned long vma_size = vma->vm_end - vma->vm_start; - pgprot_t pgprot; -+ int rc; - -- if (vma->vm_flags & VM_PAT) { -- if (get_pat_info(vma, &paddr, &pgprot)) -- return -EINVAL; -- /* reserve the whole chunk covered by vma. */ -- return reserve_pfn_range(paddr, vma_size, &pgprot, 1); -- } -+ if (!(src_vma->vm_flags & VM_PAT)) -+ return 0; -+ -+ /* -+ * Duplicate the PAT information for the dst VMA based on the src -+ * VMA. -+ */ -+ if (get_pat_info(src_vma, &paddr, &pgprot)) -+ return -EINVAL; -+ rc = reserve_pfn_range(paddr, vma_size, &pgprot, 1); -+ if (rc) -+ return rc; - -+ /* Reservation for the destination VMA succeeded. */ -+ vm_flags_set(dst_vma, VM_PAT); -+ *pfn = PHYS_PFN(paddr); - return 0; - } - -+void untrack_pfn_copy(struct vm_area_struct *dst_vma, unsigned long pfn) -+{ -+ untrack_pfn(dst_vma, pfn, dst_vma->vm_end - dst_vma->vm_start, true); -+ /* -+ * Reservation was freed, any copied page tables will get cleaned -+ * up later, but without getting PAT involved again. -+ */ -+} -+ - /* - * prot is passed in as a parameter for the new mapping. If the vma has - * a linear pfn mapping for the entire range, or no vma is provided, -@@ -1093,15 +1106,6 @@ void untrack_pfn(struct vm_area_struct *vma, unsigned long pfn, - } - } - --/* -- * untrack_pfn_clear is called if the following situation fits: -- * -- * 1) while mremapping a pfnmap for a new region, with the old vma after -- * its pfnmap page table has been removed. The new vma has a new pfnmap -- * to the same pfn & cache type with VM_PAT set. -- * 2) while duplicating vm area, the new vma fails to copy the pgtable from -- * old vma. -- */ - void untrack_pfn_clear(struct vm_area_struct *vma) - { - vm_flags_clear(vma, VM_PAT); -diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c -index 7918923e3b7417..a466ad6e5d93a9 100644 ---- a/drivers/acpi/nfit/core.c -+++ b/drivers/acpi/nfit/core.c -@@ -485,7 +485,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, - cmd_mask = nd_desc->cmd_mask; - if (cmd == ND_CMD_CALL && call_pkg->nd_family) { - family = call_pkg->nd_family; -- if (family > NVDIMM_BUS_FAMILY_MAX || -+ if (call_pkg->nd_family > NVDIMM_BUS_FAMILY_MAX || - !test_bit(family, &nd_desc->bus_family_mask)) - return -EINVAL; - family = array_index_nospec(family, -diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c -index 831fa4a1215985..0888e4d618d53a 100644 ---- a/drivers/acpi/processor_idle.c -+++ b/drivers/acpi/processor_idle.c -@@ -268,6 +268,10 @@ static int acpi_processor_get_power_info_fadt(struct acpi_processor *pr) - ACPI_CX_DESC_LEN, "ACPI P_LVL3 IOPORT 0x%x", - pr->power.states[ACPI_STATE_C3].address); - -+ if (!pr->power.states[ACPI_STATE_C2].address && -+ !pr->power.states[ACPI_STATE_C3].address) -+ return -ENODEV; -+ - return 0; - } - -diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c -index 96a987506e717b..531684a69c645d 100644 ---- a/drivers/acpi/resource.c -+++ b/drivers/acpi/resource.c -@@ -439,6 +439,13 @@ static const struct dmi_system_id asus_laptop[] = { - DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"), - }, - }, -+ { -+ /* Asus Vivobook X1404VAP */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), -+ DMI_MATCH(DMI_BOARD_NAME, "X1404VAP"), -+ }, -+ }, - { - /* Asus Vivobook X1504VAP */ - .matches = { -diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c -index e894fdf6d5531d..aac052e2820cd5 100644 ---- a/drivers/acpi/x86/utils.c -+++ b/drivers/acpi/x86/utils.c -@@ -367,7 +367,8 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = { - DMI_MATCH(DMI_PRODUCT_VERSION, "Blade3-10A-001"), - }, - .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | -- ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY), -+ ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | -+ ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), - }, - { - /* Medion Lifetab S10346 */ -diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c -index 9c5a5f4dba5a6e..343d3c966e7a7b 100644 ---- a/drivers/base/power/main.c -+++ b/drivers/base/power/main.c -@@ -894,6 +894,9 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async) - if (dev->power.syscore) - goto Complete; - -+ if (!dev->power.is_suspended) -+ goto Complete; -+ - if (dev->power.direct_complete) { - /* Match the pm_runtime_disable() in __device_suspend(). */ - pm_runtime_enable(dev); -@@ -912,9 +915,6 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async) - */ - dev->power.is_prepared = false; - -- if (!dev->power.is_suspended) -- goto Unlock; -- - if (dev->pm_domain) { - info = "power domain "; - callback = pm_op(&dev->pm_domain->ops, state); -@@ -954,7 +954,6 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async) - error = dpm_run_callback(callback, dev, state, info); - dev->power.is_suspended = false; - -- Unlock: - device_unlock(dev); - dpm_watchdog_clear(&wd); - -@@ -1236,14 +1235,13 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a - dev->power.is_noirq_suspended = true; - - /* -- * Skipping the resume of devices that were in use right before the -- * system suspend (as indicated by their PM-runtime usage counters) -- * would be suboptimal. Also resume them if doing that is not allowed -- * to be skipped. -+ * Devices must be resumed unless they are explicitly allowed to be left -+ * in suspend, but even in that case skipping the resume of devices that -+ * were in use right before the system suspend (as indicated by their -+ * runtime PM usage counters and child counters) would be suboptimal. - */ -- if (atomic_read(&dev->power.usage_count) > 1 || -- !(dev_pm_test_driver_flags(dev, DPM_FLAG_MAY_SKIP_RESUME) && -- dev->power.may_skip_resume)) -+ if (!(dev_pm_test_driver_flags(dev, DPM_FLAG_MAY_SKIP_RESUME) && -+ dev->power.may_skip_resume) || !pm_runtime_need_not_resume(dev)) - dev->power.must_resume = true; - - if (dev->power.must_resume) -@@ -1639,6 +1637,7 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async) - pm_runtime_disable(dev); - if (pm_runtime_status_suspended(dev)) { - pm_dev_dbg(dev, state, "direct-complete "); -+ dev->power.is_suspended = true; - goto Complete; - } - -diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c -index 4545669cb9735a..0af26cf8c0059f 100644 ---- a/drivers/base/power/runtime.c -+++ b/drivers/base/power/runtime.c -@@ -1841,7 +1841,7 @@ void pm_runtime_drop_link(struct device_link *link) - pm_request_idle(link->supplier); - } - --static bool pm_runtime_need_not_resume(struct device *dev) -+bool pm_runtime_need_not_resume(struct device *dev) - { - return atomic_read(&dev->power.usage_count) <= 1 && - (atomic_read(&dev->power.child_count) == 0 || -diff --git a/drivers/clk/imx/clk-imx8mp-audiomix.c b/drivers/clk/imx/clk-imx8mp-audiomix.c -index ab2a028b3027d3..f802e54d7b709f 100644 ---- a/drivers/clk/imx/clk-imx8mp-audiomix.c -+++ b/drivers/clk/imx/clk-imx8mp-audiomix.c -@@ -170,14 +170,14 @@ static struct clk_imx8mp_audiomix_sel sels[] = { - CLK_GATE("asrc", ASRC_IPG), - CLK_GATE("pdm", PDM_IPG), - CLK_GATE("earc", EARC_IPG), -- CLK_GATE("ocrama", OCRAMA_IPG), -+ CLK_GATE_PARENT("ocrama", OCRAMA_IPG, "axi"), - CLK_GATE("aud2htx", AUD2HTX_IPG), - CLK_GATE_PARENT("earc_phy", EARC_PHY, "sai_pll_out_div2"), - CLK_GATE("sdma2", SDMA2_ROOT), - CLK_GATE("sdma3", SDMA3_ROOT), - CLK_GATE("spba2", SPBA2_ROOT), -- CLK_GATE("dsp", DSP_ROOT), -- CLK_GATE("dspdbg", DSPDBG_ROOT), -+ CLK_GATE_PARENT("dsp", DSP_ROOT, "axi"), -+ CLK_GATE_PARENT("dspdbg", DSPDBG_ROOT, "axi"), - CLK_GATE("edma", EDMA_ROOT), - CLK_GATE_PARENT("audpll", AUDPLL_ROOT, "osc_24m"), - CLK_GATE("mu2", MU2_ROOT), -diff --git a/drivers/clk/meson/g12a.c b/drivers/clk/meson/g12a.c -index f373a8d48b1d3b..233ce4a4c1c2f1 100644 ---- a/drivers/clk/meson/g12a.c -+++ b/drivers/clk/meson/g12a.c -@@ -1138,8 +1138,18 @@ static struct clk_regmap g12a_cpu_clk_div16_en = { - .hw.init = &(struct clk_init_data) { - .name = "cpu_clk_div16_en", - .ops = &clk_regmap_gate_ro_ops, -- .parent_hws = (const struct clk_hw *[]) { -- &g12a_cpu_clk.hw -+ .parent_data = &(const struct clk_parent_data) { -+ /* -+ * Note: -+ * G12A and G12B have different cpu clocks (with -+ * different struct clk_hw). We fallback to the global -+ * naming string mechanism so this clock picks -+ * up the appropriate one. Same goes for the other -+ * clock using cpu cluster A clock output and present -+ * on both G12 variant. -+ */ -+ .name = "cpu_clk", -+ .index = -1, - }, - .num_parents = 1, - /* -@@ -1204,7 +1214,10 @@ static struct clk_regmap g12a_cpu_clk_apb_div = { - .hw.init = &(struct clk_init_data){ - .name = "cpu_clk_apb_div", - .ops = &clk_regmap_divider_ro_ops, -- .parent_hws = (const struct clk_hw *[]) { &g12a_cpu_clk.hw }, -+ .parent_data = &(const struct clk_parent_data) { -+ .name = "cpu_clk", -+ .index = -1, -+ }, - .num_parents = 1, - }, - }; -@@ -1238,7 +1251,10 @@ static struct clk_regmap g12a_cpu_clk_atb_div = { - .hw.init = &(struct clk_init_data){ - .name = "cpu_clk_atb_div", - .ops = &clk_regmap_divider_ro_ops, -- .parent_hws = (const struct clk_hw *[]) { &g12a_cpu_clk.hw }, -+ .parent_data = &(const struct clk_parent_data) { -+ .name = "cpu_clk", -+ .index = -1, -+ }, - .num_parents = 1, - }, - }; -@@ -1272,7 +1288,10 @@ static struct clk_regmap g12a_cpu_clk_axi_div = { - .hw.init = &(struct clk_init_data){ - .name = "cpu_clk_axi_div", - .ops = &clk_regmap_divider_ro_ops, -- .parent_hws = (const struct clk_hw *[]) { &g12a_cpu_clk.hw }, -+ .parent_data = &(const struct clk_parent_data) { -+ .name = "cpu_clk", -+ .index = -1, -+ }, - .num_parents = 1, - }, - }; -@@ -1307,13 +1326,6 @@ static struct clk_regmap g12a_cpu_clk_trace_div = { - .name = "cpu_clk_trace_div", - .ops = &clk_regmap_divider_ro_ops, - .parent_data = &(const struct clk_parent_data) { -- /* -- * Note: -- * G12A and G12B have different cpu_clks (with -- * different struct clk_hw). We fallback to the global -- * naming string mechanism so cpu_clk_trace_div picks -- * up the appropriate one. -- */ - .name = "cpu_clk", - .index = -1, - }, -@@ -4189,7 +4201,7 @@ static MESON_GATE(g12a_spicc_1, HHI_GCLK_MPEG0, 14); - static MESON_GATE(g12a_hiu_reg, HHI_GCLK_MPEG0, 19); - static MESON_GATE(g12a_mipi_dsi_phy, HHI_GCLK_MPEG0, 20); - static MESON_GATE(g12a_assist_misc, HHI_GCLK_MPEG0, 23); --static MESON_GATE(g12a_emmc_a, HHI_GCLK_MPEG0, 4); -+static MESON_GATE(g12a_emmc_a, HHI_GCLK_MPEG0, 24); - static MESON_GATE(g12a_emmc_b, HHI_GCLK_MPEG0, 25); - static MESON_GATE(g12a_emmc_c, HHI_GCLK_MPEG0, 26); - static MESON_GATE(g12a_audio_codec, HHI_GCLK_MPEG0, 28); -diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c -index 1b1279d94781e5..a133013356b645 100644 ---- a/drivers/clk/meson/gxbb.c -+++ b/drivers/clk/meson/gxbb.c -@@ -1272,14 +1272,13 @@ static struct clk_regmap gxbb_cts_i958 = { - }, - }; - -+/* -+ * This table skips a clock named 'cts_slow_oscin' in the documentation -+ * This clock does not exist yet in this controller or the AO one -+ */ -+static u32 gxbb_32k_clk_parents_val_table[] = { 0, 2, 3 }; - static const struct clk_parent_data gxbb_32k_clk_parent_data[] = { - { .fw_name = "xtal", }, -- /* -- * FIXME: This clock is provided by the ao clock controller but the -- * clock is not yet part of the binding of this controller, so string -- * name must be use to set this parent. -- */ -- { .name = "cts_slow_oscin", .index = -1 }, - { .hw = &gxbb_fclk_div3.hw }, - { .hw = &gxbb_fclk_div5.hw }, - }; -@@ -1289,6 +1288,7 @@ static struct clk_regmap gxbb_32k_clk_sel = { - .offset = HHI_32K_CLK_CNTL, - .mask = 0x3, - .shift = 16, -+ .table = gxbb_32k_clk_parents_val_table, - }, - .hw.init = &(struct clk_init_data){ - .name = "32k_clk_sel", -@@ -1312,7 +1312,7 @@ static struct clk_regmap gxbb_32k_clk_div = { - &gxbb_32k_clk_sel.hw - }, - .num_parents = 1, -- .flags = CLK_SET_RATE_PARENT | CLK_DIVIDER_ROUND_CLOSEST, -+ .flags = CLK_SET_RATE_PARENT, - }, - }; - -diff --git a/drivers/clk/qcom/gcc-msm8953.c b/drivers/clk/qcom/gcc-msm8953.c -index 3e5a8cb14d4df1..e6e2ab1380f20b 100644 ---- a/drivers/clk/qcom/gcc-msm8953.c -+++ b/drivers/clk/qcom/gcc-msm8953.c -@@ -3770,7 +3770,7 @@ static struct clk_branch gcc_venus0_axi_clk = { - - static struct clk_branch gcc_venus0_core0_vcodec0_clk = { - .halt_reg = 0x4c02c, -- .halt_check = BRANCH_HALT, -+ .halt_check = BRANCH_HALT_SKIP, - .clkr = { - .enable_reg = 0x4c02c, - .enable_mask = BIT(0), -diff --git a/drivers/clk/qcom/mmcc-sdm660.c b/drivers/clk/qcom/mmcc-sdm660.c -index bc19a23e13f8ab..4d187d6aba7342 100644 ---- a/drivers/clk/qcom/mmcc-sdm660.c -+++ b/drivers/clk/qcom/mmcc-sdm660.c -@@ -2544,7 +2544,7 @@ static struct clk_branch video_core_clk = { - - static struct clk_branch video_subcore0_clk = { - .halt_reg = 0x1048, -- .halt_check = BRANCH_HALT, -+ .halt_check = BRANCH_HALT_SKIP, - .clkr = { - .enable_reg = 0x1048, - .enable_mask = BIT(0), -diff --git a/drivers/clk/rockchip/clk-rk3328.c b/drivers/clk/rockchip/clk-rk3328.c -index 267ab54937d3df..a3587c500de28c 100644 ---- a/drivers/clk/rockchip/clk-rk3328.c -+++ b/drivers/clk/rockchip/clk-rk3328.c -@@ -201,7 +201,7 @@ PNAME(mux_aclk_peri_pre_p) = { "cpll_peri", - "gpll_peri", - "hdmiphy_peri" }; - PNAME(mux_ref_usb3otg_src_p) = { "xin24m", -- "clk_usb3otg_ref" }; -+ "clk_ref_usb3otg_src" }; - PNAME(mux_xin24m_32k_p) = { "xin24m", - "clk_rtc32k" }; - PNAME(mux_mac2io_src_p) = { "clk_mac2io_src", -diff --git a/drivers/clk/samsung/clk.c b/drivers/clk/samsung/clk.c -index b6701905f25461..fa5bdf6b3a9297 100644 ---- a/drivers/clk/samsung/clk.c -+++ b/drivers/clk/samsung/clk.c -@@ -74,12 +74,12 @@ struct samsung_clk_provider * __init samsung_clk_init(struct device *dev, - if (!ctx) - panic("could not allocate clock provider context.\n"); - -+ ctx->clk_data.num = nr_clks; - for (i = 0; i < nr_clks; ++i) - ctx->clk_data.hws[i] = ERR_PTR(-ENOENT); - - ctx->dev = dev; - ctx->reg_base = base; -- ctx->clk_data.num = nr_clks; - spin_lock_init(&ctx->lock); - - return ctx; -diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c -index af44ee6a64304f..1a7fcaf39cc9b5 100644 ---- a/drivers/cpufreq/cpufreq_governor.c -+++ b/drivers/cpufreq/cpufreq_governor.c -@@ -145,7 +145,23 @@ unsigned int dbs_update(struct cpufreq_policy *policy) - time_elapsed = update_time - j_cdbs->prev_update_time; - j_cdbs->prev_update_time = update_time; - -- idle_time = cur_idle_time - j_cdbs->prev_cpu_idle; -+ /* -+ * cur_idle_time could be smaller than j_cdbs->prev_cpu_idle if -+ * it's obtained from get_cpu_idle_time_jiffy() when NOHZ is -+ * off, where idle_time is calculated by the difference between -+ * time elapsed in jiffies and "busy time" obtained from CPU -+ * statistics. If a CPU is 100% busy, the time elapsed and busy -+ * time should grow with the same amount in two consecutive -+ * samples, but in practice there could be a tiny difference, -+ * making the accumulated idle time decrease sometimes. Hence, -+ * in this case, idle_time should be regarded as 0 in order to -+ * make the further process correct. -+ */ -+ if (cur_idle_time > j_cdbs->prev_cpu_idle) -+ idle_time = cur_idle_time - j_cdbs->prev_cpu_idle; -+ else -+ idle_time = 0; -+ - j_cdbs->prev_cpu_idle = cur_idle_time; - - if (ignore_nice) { -@@ -162,7 +178,7 @@ unsigned int dbs_update(struct cpufreq_policy *policy) - * calls, so the previous load value can be used then. - */ - load = j_cdbs->prev_load; -- } else if (unlikely((int)idle_time > 2 * sampling_rate && -+ } else if (unlikely(idle_time > 2 * sampling_rate && - j_cdbs->prev_load)) { - /* - * If the CPU had gone completely idle and a task has -@@ -189,30 +205,15 @@ unsigned int dbs_update(struct cpufreq_policy *policy) - load = j_cdbs->prev_load; - j_cdbs->prev_load = 0; - } else { -- if (time_elapsed >= idle_time) { -+ if (time_elapsed > idle_time) - load = 100 * (time_elapsed - idle_time) / time_elapsed; -- } else { -- /* -- * That can happen if idle_time is returned by -- * get_cpu_idle_time_jiffy(). In that case -- * idle_time is roughly equal to the difference -- * between time_elapsed and "busy time" obtained -- * from CPU statistics. Then, the "busy time" -- * can end up being greater than time_elapsed -- * (for example, if jiffies_64 and the CPU -- * statistics are updated by different CPUs), -- * so idle_time may in fact be negative. That -- * means, though, that the CPU was busy all -- * the time (on the rough average) during the -- * last sampling interval and 100 can be -- * returned as the load. -- */ -- load = (int)idle_time < 0 ? 100 : 0; -- } -+ else -+ load = 0; -+ - j_cdbs->prev_load = load; - } - -- if (unlikely((int)idle_time > 2 * sampling_rate)) { -+ if (unlikely(idle_time > 2 * sampling_rate)) { - unsigned int periods = idle_time / sampling_rate; - - if (periods < idle_periods) -diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c -index d33be56983ed37..bfc2e65e1e5022 100644 ---- a/drivers/cpufreq/scpi-cpufreq.c -+++ b/drivers/cpufreq/scpi-cpufreq.c -@@ -39,8 +39,9 @@ static unsigned int scpi_cpufreq_get_rate(unsigned int cpu) - static int - scpi_cpufreq_set_target(struct cpufreq_policy *policy, unsigned int index) - { -- u64 rate = policy->freq_table[index].frequency * 1000; -+ unsigned long freq_khz = policy->freq_table[index].frequency; - struct scpi_data *priv = policy->driver_data; -+ unsigned long rate = freq_khz * 1000; - int ret; - - ret = clk_set_rate(priv->clk, rate); -@@ -48,7 +49,7 @@ scpi_cpufreq_set_target(struct cpufreq_policy *policy, unsigned int index) - if (ret) - return ret; - -- if (clk_get_rate(priv->clk) != rate) -+ if (clk_get_rate(priv->clk) / 1000 != freq_khz) - return -EIO; - - return 0; -diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h -index 30c2b1a64695c0..2fc04e210bc4f6 100644 ---- a/drivers/crypto/hisilicon/sec2/sec.h -+++ b/drivers/crypto/hisilicon/sec2/sec.h -@@ -37,7 +37,6 @@ struct sec_aead_req { - u8 *a_ivin; - dma_addr_t a_ivin_dma; - struct aead_request *aead_req; -- bool fallback; - }; - - /* SEC request of Crypto */ -diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c -index 8a6dd2513370a2..d6727b8ff582b6 100644 ---- a/drivers/crypto/hisilicon/sec2/sec_crypto.c -+++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c -@@ -57,7 +57,6 @@ - #define SEC_TYPE_MASK 0x0F - #define SEC_DONE_MASK 0x0001 - #define SEC_ICV_MASK 0x000E --#define SEC_SQE_LEN_RATE_MASK 0x3 - - #define SEC_TOTAL_IV_SZ(depth) (SEC_IV_SIZE * (depth)) - #define SEC_SGL_SGE_NR 128 -@@ -80,16 +79,16 @@ - #define SEC_TOTAL_PBUF_SZ(depth) (PAGE_SIZE * SEC_PBUF_PAGE_NUM(depth) + \ - SEC_PBUF_LEFT_SZ(depth)) - --#define SEC_SQE_LEN_RATE 4 - #define SEC_SQE_CFLAG 2 - #define SEC_SQE_AEAD_FLAG 3 - #define SEC_SQE_DONE 0x1 - #define SEC_ICV_ERR 0x2 --#define MIN_MAC_LEN 4 - #define MAC_LEN_MASK 0x1U - #define MAX_INPUT_DATA_LEN 0xFFFE00 - #define BITS_MASK 0xFF -+#define WORD_MASK 0x3 - #define BYTE_BITS 0x8 -+#define BYTES_TO_WORDS(bcount) ((bcount) >> 2) - #define SEC_XTS_NAME_SZ 0x3 - #define IV_CM_CAL_NUM 2 - #define IV_CL_MASK 0x7 -@@ -690,14 +689,10 @@ static int sec_skcipher_fbtfm_init(struct crypto_skcipher *tfm) - - c_ctx->fallback = false; - -- /* Currently, only XTS mode need fallback tfm when using 192bit key */ -- if (likely(strncmp(alg, "xts", SEC_XTS_NAME_SZ))) -- return 0; -- - c_ctx->fbtfm = crypto_alloc_sync_skcipher(alg, 0, - CRYPTO_ALG_NEED_FALLBACK); - if (IS_ERR(c_ctx->fbtfm)) { -- pr_err("failed to alloc xts mode fallback tfm!\n"); -+ pr_err("failed to alloc fallback tfm for %s!\n", alg); - return PTR_ERR(c_ctx->fbtfm); - } - -@@ -859,7 +854,7 @@ static int sec_skcipher_setkey(struct crypto_skcipher *tfm, const u8 *key, - } - - memcpy(c_ctx->c_key, key, keylen); -- if (c_ctx->fallback && c_ctx->fbtfm) { -+ if (c_ctx->fbtfm) { - ret = crypto_sync_skcipher_setkey(c_ctx->fbtfm, key, keylen); - if (ret) { - dev_err(dev, "failed to set fallback skcipher key!\n"); -@@ -1094,11 +1089,6 @@ static int sec_aead_auth_set_key(struct sec_auth_ctx *ctx, - struct crypto_shash *hash_tfm = ctx->hash_tfm; - int blocksize, digestsize, ret; - -- if (!keys->authkeylen) { -- pr_err("hisi_sec2: aead auth key error!\n"); -- return -EINVAL; -- } -- - blocksize = crypto_shash_blocksize(hash_tfm); - digestsize = crypto_shash_digestsize(hash_tfm); - if (keys->authkeylen > blocksize) { -@@ -1110,7 +1100,8 @@ static int sec_aead_auth_set_key(struct sec_auth_ctx *ctx, - } - ctx->a_key_len = digestsize; - } else { -- memcpy(ctx->a_key, keys->authkey, keys->authkeylen); -+ if (keys->authkeylen) -+ memcpy(ctx->a_key, keys->authkey, keys->authkeylen); - ctx->a_key_len = keys->authkeylen; - } - -@@ -1164,8 +1155,10 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, - } - - ret = crypto_authenc_extractkeys(&keys, key, keylen); -- if (ret) -+ if (ret) { -+ dev_err(dev, "sec extract aead keys err!\n"); - goto bad_key; -+ } - - ret = sec_aead_aes_set_key(c_ctx, &keys); - if (ret) { -@@ -1179,12 +1172,6 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, - goto bad_key; - } - -- if (ctx->a_ctx.a_key_len & SEC_SQE_LEN_RATE_MASK) { -- ret = -EINVAL; -- dev_err(dev, "AUTH key length error!\n"); -- goto bad_key; -- } -- - ret = sec_aead_fallback_setkey(a_ctx, tfm, key, keylen); - if (ret) { - dev_err(dev, "set sec fallback key err!\n"); -@@ -1587,11 +1574,10 @@ static void sec_auth_bd_fill_ex(struct sec_auth_ctx *ctx, int dir, - - sec_sqe->type2.a_key_addr = cpu_to_le64(ctx->a_key_dma); - -- sec_sqe->type2.mac_key_alg = cpu_to_le32(authsize / SEC_SQE_LEN_RATE); -+ sec_sqe->type2.mac_key_alg = cpu_to_le32(BYTES_TO_WORDS(authsize)); - - sec_sqe->type2.mac_key_alg |= -- cpu_to_le32((u32)((ctx->a_key_len) / -- SEC_SQE_LEN_RATE) << SEC_AKEY_OFFSET); -+ cpu_to_le32((u32)BYTES_TO_WORDS(ctx->a_key_len) << SEC_AKEY_OFFSET); - - sec_sqe->type2.mac_key_alg |= - cpu_to_le32((u32)(ctx->a_alg) << SEC_AEAD_ALG_OFFSET); -@@ -1643,12 +1629,10 @@ static void sec_auth_bd_fill_ex_v3(struct sec_auth_ctx *ctx, int dir, - sqe3->a_key_addr = cpu_to_le64(ctx->a_key_dma); - - sqe3->auth_mac_key |= -- cpu_to_le32((u32)(authsize / -- SEC_SQE_LEN_RATE) << SEC_MAC_OFFSET_V3); -+ cpu_to_le32(BYTES_TO_WORDS(authsize) << SEC_MAC_OFFSET_V3); - - sqe3->auth_mac_key |= -- cpu_to_le32((u32)(ctx->a_key_len / -- SEC_SQE_LEN_RATE) << SEC_AKEY_OFFSET_V3); -+ cpu_to_le32((u32)BYTES_TO_WORDS(ctx->a_key_len) << SEC_AKEY_OFFSET_V3); - - sqe3->auth_mac_key |= - cpu_to_le32((u32)(ctx->a_alg) << SEC_AUTH_ALG_OFFSET_V3); -@@ -2007,8 +1991,7 @@ static int sec_aead_sha512_ctx_init(struct crypto_aead *tfm) - return sec_aead_ctx_init(tfm, "sha512"); - } - --static int sec_skcipher_cryptlen_check(struct sec_ctx *ctx, -- struct sec_req *sreq) -+static int sec_skcipher_cryptlen_check(struct sec_ctx *ctx, struct sec_req *sreq) - { - u32 cryptlen = sreq->c_req.sk_req->cryptlen; - struct device *dev = ctx->dev; -@@ -2032,10 +2015,6 @@ static int sec_skcipher_cryptlen_check(struct sec_ctx *ctx, - case SEC_CMODE_CFB: - case SEC_CMODE_OFB: - case SEC_CMODE_CTR: -- if (unlikely(ctx->sec->qm.ver < QM_HW_V3)) { -- dev_err(dev, "skcipher HW version error!\n"); -- ret = -EINVAL; -- } - break; - default: - ret = -EINVAL; -@@ -2044,17 +2023,21 @@ static int sec_skcipher_cryptlen_check(struct sec_ctx *ctx, - return ret; - } - --static int sec_skcipher_param_check(struct sec_ctx *ctx, struct sec_req *sreq) -+static int sec_skcipher_param_check(struct sec_ctx *ctx, -+ struct sec_req *sreq, bool *need_fallback) - { - struct skcipher_request *sk_req = sreq->c_req.sk_req; - struct device *dev = ctx->dev; - u8 c_alg = ctx->c_ctx.c_alg; - -- if (unlikely(!sk_req->src || !sk_req->dst || -- sk_req->cryptlen > MAX_INPUT_DATA_LEN)) { -+ if (unlikely(!sk_req->src || !sk_req->dst)) { - dev_err(dev, "skcipher input param error!\n"); - return -EINVAL; - } -+ -+ if (sk_req->cryptlen > MAX_INPUT_DATA_LEN) -+ *need_fallback = true; -+ - sreq->c_req.c_len = sk_req->cryptlen; - - if (ctx->pbuf_supported && sk_req->cryptlen <= SEC_PBUF_SZ) -@@ -2112,6 +2095,7 @@ static int sec_skcipher_crypto(struct skcipher_request *sk_req, bool encrypt) - struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(sk_req); - struct sec_req *req = skcipher_request_ctx(sk_req); - struct sec_ctx *ctx = crypto_skcipher_ctx(tfm); -+ bool need_fallback = false; - int ret; - - if (!sk_req->cryptlen) { -@@ -2125,11 +2109,11 @@ static int sec_skcipher_crypto(struct skcipher_request *sk_req, bool encrypt) - req->c_req.encrypt = encrypt; - req->ctx = ctx; - -- ret = sec_skcipher_param_check(ctx, req); -+ ret = sec_skcipher_param_check(ctx, req, &need_fallback); - if (unlikely(ret)) - return -EINVAL; - -- if (unlikely(ctx->c_ctx.fallback)) -+ if (unlikely(ctx->c_ctx.fallback || need_fallback)) - return sec_skcipher_soft_crypto(ctx, sk_req, encrypt); - - return ctx->req_op->process(ctx, req); -@@ -2262,52 +2246,35 @@ static int sec_aead_spec_check(struct sec_ctx *ctx, struct sec_req *sreq) - struct crypto_aead *tfm = crypto_aead_reqtfm(req); - size_t sz = crypto_aead_authsize(tfm); - u8 c_mode = ctx->c_ctx.c_mode; -- struct device *dev = ctx->dev; - int ret; - -- /* Hardware does not handle cases where authsize is less than 4 bytes */ -- if (unlikely(sz < MIN_MAC_LEN)) { -- sreq->aead_req.fallback = true; -+ if (unlikely(ctx->sec->qm.ver == QM_HW_V2 && !sreq->c_req.c_len)) - return -EINVAL; -- } - - if (unlikely(req->cryptlen + req->assoclen > MAX_INPUT_DATA_LEN || -- req->assoclen > SEC_MAX_AAD_LEN)) { -- dev_err(dev, "aead input spec error!\n"); -+ req->assoclen > SEC_MAX_AAD_LEN)) - return -EINVAL; -- } - - if (c_mode == SEC_CMODE_CCM) { -- if (unlikely(req->assoclen > SEC_MAX_CCM_AAD_LEN)) { -- dev_err_ratelimited(dev, "CCM input aad parameter is too long!\n"); -+ if (unlikely(req->assoclen > SEC_MAX_CCM_AAD_LEN)) - return -EINVAL; -- } -- ret = aead_iv_demension_check(req); -- if (ret) { -- dev_err(dev, "aead input iv param error!\n"); -- return ret; -- } -- } - -- if (sreq->c_req.encrypt) -- sreq->c_req.c_len = req->cryptlen; -- else -- sreq->c_req.c_len = req->cryptlen - sz; -- if (c_mode == SEC_CMODE_CBC) { -- if (unlikely(sreq->c_req.c_len & (AES_BLOCK_SIZE - 1))) { -- dev_err(dev, "aead crypto length error!\n"); -+ ret = aead_iv_demension_check(req); -+ if (unlikely(ret)) -+ return -EINVAL; -+ } else if (c_mode == SEC_CMODE_CBC) { -+ if (unlikely(sz & WORD_MASK)) -+ return -EINVAL; -+ if (unlikely(ctx->a_ctx.a_key_len & WORD_MASK)) - return -EINVAL; -- } - } - - return 0; - } - --static int sec_aead_param_check(struct sec_ctx *ctx, struct sec_req *sreq) -+static int sec_aead_param_check(struct sec_ctx *ctx, struct sec_req *sreq, bool *need_fallback) - { - struct aead_request *req = sreq->aead_req.aead_req; -- struct crypto_aead *tfm = crypto_aead_reqtfm(req); -- size_t authsize = crypto_aead_authsize(tfm); - struct device *dev = ctx->dev; - u8 c_alg = ctx->c_ctx.c_alg; - -@@ -2316,12 +2283,10 @@ static int sec_aead_param_check(struct sec_ctx *ctx, struct sec_req *sreq) - return -EINVAL; - } - -- if (ctx->sec->qm.ver == QM_HW_V2) { -- if (unlikely(!req->cryptlen || (!sreq->c_req.encrypt && -- req->cryptlen <= authsize))) { -- sreq->aead_req.fallback = true; -- return -EINVAL; -- } -+ if (unlikely(ctx->c_ctx.c_mode == SEC_CMODE_CBC && -+ sreq->c_req.c_len & (AES_BLOCK_SIZE - 1))) { -+ dev_err(dev, "aead cbc mode input data length error!\n"); -+ return -EINVAL; - } - - /* Support AES or SM4 */ -@@ -2330,8 +2295,10 @@ static int sec_aead_param_check(struct sec_ctx *ctx, struct sec_req *sreq) - return -EINVAL; - } - -- if (unlikely(sec_aead_spec_check(ctx, sreq))) -+ if (unlikely(sec_aead_spec_check(ctx, sreq))) { -+ *need_fallback = true; - return -EINVAL; -+ } - - if (ctx->pbuf_supported && (req->cryptlen + req->assoclen) <= - SEC_PBUF_SZ) -@@ -2375,17 +2342,19 @@ static int sec_aead_crypto(struct aead_request *a_req, bool encrypt) - struct crypto_aead *tfm = crypto_aead_reqtfm(a_req); - struct sec_req *req = aead_request_ctx(a_req); - struct sec_ctx *ctx = crypto_aead_ctx(tfm); -+ size_t sz = crypto_aead_authsize(tfm); -+ bool need_fallback = false; - int ret; - - req->flag = a_req->base.flags; - req->aead_req.aead_req = a_req; - req->c_req.encrypt = encrypt; - req->ctx = ctx; -- req->aead_req.fallback = false; -+ req->c_req.c_len = a_req->cryptlen - (req->c_req.encrypt ? 0 : sz); - -- ret = sec_aead_param_check(ctx, req); -+ ret = sec_aead_param_check(ctx, req, &need_fallback); - if (unlikely(ret)) { -- if (req->aead_req.fallback) -+ if (need_fallback) - return sec_aead_soft_crypto(ctx, a_req, encrypt); - return -EINVAL; - } -diff --git a/drivers/crypto/nx/nx-common-pseries.c b/drivers/crypto/nx/nx-common-pseries.c -index 35f2d0d8507ed7..7e98f174f69b99 100644 ---- a/drivers/crypto/nx/nx-common-pseries.c -+++ b/drivers/crypto/nx/nx-common-pseries.c -@@ -1144,6 +1144,7 @@ static void __init nxcop_get_capabilities(void) - { - struct hv_vas_all_caps *hv_caps; - struct hv_nx_cop_caps *hv_nxc; -+ u64 feat; - int rc; - - hv_caps = kmalloc(sizeof(*hv_caps), GFP_KERNEL); -@@ -1154,27 +1155,26 @@ static void __init nxcop_get_capabilities(void) - */ - rc = h_query_vas_capabilities(H_QUERY_NX_CAPABILITIES, 0, - (u64)virt_to_phys(hv_caps)); -+ if (!rc) -+ feat = be64_to_cpu(hv_caps->feat_type); -+ kfree(hv_caps); - if (rc) -- goto out; -+ return; -+ if (!(feat & VAS_NX_GZIP_FEAT_BIT)) -+ return; - -- caps_feat = be64_to_cpu(hv_caps->feat_type); - /* - * NX-GZIP feature available - */ -- if (caps_feat & VAS_NX_GZIP_FEAT_BIT) { -- hv_nxc = kmalloc(sizeof(*hv_nxc), GFP_KERNEL); -- if (!hv_nxc) -- goto out; -- /* -- * Get capabilities for NX-GZIP feature -- */ -- rc = h_query_vas_capabilities(H_QUERY_NX_CAPABILITIES, -- VAS_NX_GZIP_FEAT, -- (u64)virt_to_phys(hv_nxc)); -- } else { -- pr_err("NX-GZIP feature is not available\n"); -- rc = -EINVAL; -- } -+ hv_nxc = kmalloc(sizeof(*hv_nxc), GFP_KERNEL); -+ if (!hv_nxc) -+ return; -+ /* -+ * Get capabilities for NX-GZIP feature -+ */ -+ rc = h_query_vas_capabilities(H_QUERY_NX_CAPABILITIES, -+ VAS_NX_GZIP_FEAT, -+ (u64)virt_to_phys(hv_nxc)); - - if (!rc) { - nx_cop_caps.descriptor = be64_to_cpu(hv_nxc->descriptor); -@@ -1184,13 +1184,10 @@ static void __init nxcop_get_capabilities(void) - be64_to_cpu(hv_nxc->min_compress_len); - nx_cop_caps.min_decompress_len = - be64_to_cpu(hv_nxc->min_decompress_len); -- } else { -- caps_feat = 0; -+ caps_feat = feat; - } - - kfree(hv_nxc); --out: -- kfree(hv_caps); - } - - static const struct vio_device_id nx842_vio_driver_ids[] = { -diff --git a/drivers/dma/fsl-edma-main.c b/drivers/dma/fsl-edma-main.c -index cd394eae47d179..cc9923ab686dcd 100644 ---- a/drivers/dma/fsl-edma-main.c -+++ b/drivers/dma/fsl-edma-main.c -@@ -675,9 +675,9 @@ static int fsl_edma_remove(struct platform_device *pdev) - struct fsl_edma_engine *fsl_edma = platform_get_drvdata(pdev); - - fsl_edma_irq_exit(pdev, fsl_edma); -- fsl_edma_cleanup_vchan(&fsl_edma->dma_dev); - of_dma_controller_free(np); - dma_async_device_unregister(&fsl_edma->dma_dev); -+ fsl_edma_cleanup_vchan(&fsl_edma->dma_dev); - fsl_disable_clocks(fsl_edma, fsl_edma->drvdata->dmamuxs); - - return 0; -diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c -index 535f058b48eef5..67a46abe07da9e 100644 ---- a/drivers/edac/i10nm_base.c -+++ b/drivers/edac/i10nm_base.c -@@ -755,6 +755,8 @@ static int i10nm_get_ddr_munits(void) - continue; - } else { - d->imc[lmc].mdev = mdev; -+ if (res_cfg->type == SPR) -+ skx_set_mc_mapping(d, i, lmc); - lmc++; - } - } -diff --git a/drivers/edac/ie31200_edac.c b/drivers/edac/ie31200_edac.c -index 9ef13570f2e540..56be8ef40f376b 100644 ---- a/drivers/edac/ie31200_edac.c -+++ b/drivers/edac/ie31200_edac.c -@@ -91,8 +91,6 @@ - (((did) & PCI_DEVICE_ID_INTEL_IE31200_HB_CFL_MASK) == \ - PCI_DEVICE_ID_INTEL_IE31200_HB_CFL_MASK)) - --#define IE31200_DIMMS 4 --#define IE31200_RANKS 8 - #define IE31200_RANKS_PER_CHANNEL 4 - #define IE31200_DIMMS_PER_CHANNEL 2 - #define IE31200_CHANNELS 2 -@@ -164,6 +162,7 @@ - #define IE31200_MAD_DIMM_0_OFFSET 0x5004 - #define IE31200_MAD_DIMM_0_OFFSET_SKL 0x500C - #define IE31200_MAD_DIMM_SIZE GENMASK_ULL(7, 0) -+#define IE31200_MAD_DIMM_SIZE_SKL GENMASK_ULL(5, 0) - #define IE31200_MAD_DIMM_A_RANK BIT(17) - #define IE31200_MAD_DIMM_A_RANK_SHIFT 17 - #define IE31200_MAD_DIMM_A_RANK_SKL BIT(10) -@@ -377,7 +376,7 @@ static void __iomem *ie31200_map_mchbar(struct pci_dev *pdev) - static void __skl_populate_dimm_info(struct dimm_data *dd, u32 addr_decode, - int chan) - { -- dd->size = (addr_decode >> (chan << 4)) & IE31200_MAD_DIMM_SIZE; -+ dd->size = (addr_decode >> (chan << 4)) & IE31200_MAD_DIMM_SIZE_SKL; - dd->dual_rank = (addr_decode & (IE31200_MAD_DIMM_A_RANK_SKL << (chan << 4))) ? 1 : 0; - dd->x16_width = ((addr_decode & (IE31200_MAD_DIMM_A_WIDTH_SKL << (chan << 4))) >> - (IE31200_MAD_DIMM_A_WIDTH_SKL_SHIFT + (chan << 4))); -@@ -426,7 +425,7 @@ static int ie31200_probe1(struct pci_dev *pdev, int dev_idx) - - nr_channels = how_many_channels(pdev); - layers[0].type = EDAC_MC_LAYER_CHIP_SELECT; -- layers[0].size = IE31200_DIMMS; -+ layers[0].size = IE31200_RANKS_PER_CHANNEL; - layers[0].is_virt_csrow = true; - layers[1].type = EDAC_MC_LAYER_CHANNEL; - layers[1].size = nr_channels; -@@ -618,7 +617,7 @@ static int __init ie31200_init(void) - - pci_rc = pci_register_driver(&ie31200_driver); - if (pci_rc < 0) -- goto fail0; -+ return pci_rc; - - if (!mci_pdev) { - ie31200_registered = 0; -@@ -629,11 +628,13 @@ static int __init ie31200_init(void) - if (mci_pdev) - break; - } -+ - if (!mci_pdev) { - edac_dbg(0, "ie31200 pci_get_device fail\n"); - pci_rc = -ENODEV; -- goto fail1; -+ goto fail0; - } -+ - pci_rc = ie31200_init_one(mci_pdev, &ie31200_pci_tbl[i]); - if (pci_rc < 0) { - edac_dbg(0, "ie31200 init fail\n"); -@@ -641,12 +642,12 @@ static int __init ie31200_init(void) - goto fail1; - } - } -- return 0; - -+ return 0; - fail1: -- pci_unregister_driver(&ie31200_driver); --fail0: - pci_dev_put(mci_pdev); -+fail0: -+ pci_unregister_driver(&ie31200_driver); - - return pci_rc; - } -diff --git a/drivers/edac/skx_common.c b/drivers/edac/skx_common.c -index 0b8aaf5f77d9f6..d47f0055217e43 100644 ---- a/drivers/edac/skx_common.c -+++ b/drivers/edac/skx_common.c -@@ -120,6 +120,35 @@ void skx_adxl_put(void) - } - EXPORT_SYMBOL_GPL(skx_adxl_put); - -+static void skx_init_mc_mapping(struct skx_dev *d) -+{ -+ /* -+ * By default, the BIOS presents all memory controllers within each -+ * socket to the EDAC driver. The physical indices are the same as -+ * the logical indices of the memory controllers enumerated by the -+ * EDAC driver. -+ */ -+ for (int i = 0; i < NUM_IMC; i++) -+ d->mc_mapping[i] = i; -+} -+ -+void skx_set_mc_mapping(struct skx_dev *d, u8 pmc, u8 lmc) -+{ -+ edac_dbg(0, "Set the mapping of mc phy idx to logical idx: %02d -> %02d\n", -+ pmc, lmc); -+ -+ d->mc_mapping[pmc] = lmc; -+} -+EXPORT_SYMBOL_GPL(skx_set_mc_mapping); -+ -+static u8 skx_get_mc_mapping(struct skx_dev *d, u8 pmc) -+{ -+ edac_dbg(0, "Get the mapping of mc phy idx to logical idx: %02d -> %02d\n", -+ pmc, d->mc_mapping[pmc]); -+ -+ return d->mc_mapping[pmc]; -+} -+ - static bool skx_adxl_decode(struct decoded_addr *res, enum error_source err_src) - { - struct skx_dev *d; -@@ -187,6 +216,8 @@ static bool skx_adxl_decode(struct decoded_addr *res, enum error_source err_src) - return false; - } - -+ res->imc = skx_get_mc_mapping(d, res->imc); -+ - for (i = 0; i < adxl_component_count; i++) { - if (adxl_values[i] == ~0x0ull) - continue; -@@ -307,6 +338,8 @@ int skx_get_all_bus_mappings(struct res_config *cfg, struct list_head **list) - d->bus[0], d->bus[1], d->bus[2], d->bus[3]); - list_add_tail(&d->list, &dev_edac_list); - prev = pdev; -+ -+ skx_init_mc_mapping(d); - } - - if (list) -diff --git a/drivers/edac/skx_common.h b/drivers/edac/skx_common.h -index e7f18ada166814..5acfef8fd3d362 100644 ---- a/drivers/edac/skx_common.h -+++ b/drivers/edac/skx_common.h -@@ -94,6 +94,16 @@ struct skx_dev { - struct pci_dev *uracu; /* for i10nm CPU */ - struct pci_dev *pcu_cr3; /* for HBM memory detection */ - u32 mcroute; -+ /* -+ * Some server BIOS may hide certain memory controllers, and the -+ * EDAC driver skips those hidden memory controllers. However, the -+ * ADXL still decodes memory error address using physical memory -+ * controller indices. The mapping table is used to convert the -+ * physical indices (reported by ADXL) to the logical indices -+ * (used the EDAC driver) of present memory controllers during the -+ * error handling process. -+ */ -+ u8 mc_mapping[NUM_IMC]; - struct skx_imc { - struct mem_ctl_info *mci; - struct pci_dev *mdev; /* for i10nm CPU */ -@@ -243,6 +253,7 @@ void skx_adxl_put(void); - void skx_set_decode(skx_decode_f decode, skx_show_retry_log_f show_retry_log); - void skx_set_mem_cfg(bool mem_cfg_2lm); - void skx_set_res_cfg(struct res_config *cfg); -+void skx_set_mc_mapping(struct skx_dev *d, u8 pmc, u8 lmc); - - int skx_get_src_id(struct skx_dev *d, int off, u8 *id); - int skx_get_node_id(struct skx_dev *d, u8 *id); -diff --git a/drivers/firmware/cirrus/cs_dsp.c b/drivers/firmware/cirrus/cs_dsp.c -index 4ce5681be18f05..c015d2b4c5cf97 100644 ---- a/drivers/firmware/cirrus/cs_dsp.c -+++ b/drivers/firmware/cirrus/cs_dsp.c -@@ -1584,6 +1584,7 @@ static int cs_dsp_load(struct cs_dsp *dsp, const struct firmware *firmware, - - cs_dsp_debugfs_save_wmfwname(dsp, file); - -+ ret = 0; - out_fw: - cs_dsp_buf_free(&buf_list); - kfree(text); -@@ -2299,6 +2300,7 @@ static int cs_dsp_load_coeff(struct cs_dsp *dsp, const struct firmware *firmware - - cs_dsp_debugfs_save_binname(dsp, file); - -+ ret = 0; - out_fw: - cs_dsp_buf_free(&buf_list); - kfree(text); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -index f9bc38d20ce3ee..a51ceebb80547e 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -@@ -2461,7 +2461,6 @@ static int amdgpu_pmops_freeze(struct device *dev) - - adev->in_s4 = true; - r = amdgpu_device_suspend(drm_dev, true); -- adev->in_s4 = false; - if (r) - return r; - -@@ -2473,8 +2472,13 @@ static int amdgpu_pmops_freeze(struct device *dev) - static int amdgpu_pmops_thaw(struct device *dev) - { - struct drm_device *drm_dev = dev_get_drvdata(dev); -+ struct amdgpu_device *adev = drm_to_adev(drm_dev); -+ int r; - -- return amdgpu_device_resume(drm_dev, true); -+ r = amdgpu_device_resume(drm_dev, true); -+ adev->in_s4 = false; -+ -+ return r; - } - - static int amdgpu_pmops_poweroff(struct device *dev) -@@ -2487,6 +2491,9 @@ static int amdgpu_pmops_poweroff(struct device *dev) - static int amdgpu_pmops_restore(struct device *dev) - { - struct drm_device *drm_dev = dev_get_drvdata(dev); -+ struct amdgpu_device *adev = drm_to_adev(drm_dev); -+ -+ adev->in_s4 = false; - - return amdgpu_device_resume(drm_dev, true); - } -diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c -index 54ec9b32562c28..480d718d09cb6b 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c -@@ -1318,7 +1318,7 @@ static int gfx_v11_0_sw_init(void *handle) - adev->gfx.me.num_me = 1; - adev->gfx.me.num_pipe_per_me = 1; - adev->gfx.me.num_queue_per_pipe = 1; -- adev->gfx.mec.num_mec = 2; -+ adev->gfx.mec.num_mec = 1; - adev->gfx.mec.num_pipe_per_mec = 4; - adev->gfx.mec.num_queue_per_pipe = 4; - break; -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c -index 43fa260ddbcea0..4d9a406925e189 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c -@@ -197,21 +197,6 @@ static int add_queue_mes(struct device_queue_manager *dqm, struct queue *q, - if (dqm->is_hws_hang) - return -EIO; - -- if (!pdd->proc_ctx_cpu_ptr) { -- r = amdgpu_amdkfd_alloc_gtt_mem(adev, -- AMDGPU_MES_PROC_CTX_SIZE, -- &pdd->proc_ctx_bo, -- &pdd->proc_ctx_gpu_addr, -- &pdd->proc_ctx_cpu_ptr, -- false); -- if (r) { -- dev_err(adev->dev, -- "failed to allocate process context bo\n"); -- return r; -- } -- memset(pdd->proc_ctx_cpu_ptr, 0, AMDGPU_MES_PROC_CTX_SIZE); -- } -- - memset(&queue_input, 0x0, sizeof(struct mes_add_queue_input)); - queue_input.process_id = qpd->pqm->process->pasid; - queue_input.page_table_base_addr = qpd->page_table_base; -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c -index a02777694d9951..e057c2bc7be424 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c -@@ -329,10 +329,26 @@ int pqm_create_queue(struct process_queue_manager *pqm, - if (retval != 0) - return retval; - -+ /* Register process if this is the first queue */ - if (list_empty(&pdd->qpd.queues_list) && - list_empty(&pdd->qpd.priv_queue_list)) - dev->dqm->ops.register_process(dev->dqm, &pdd->qpd); - -+ /* Allocate proc_ctx_bo only if MES is enabled and this is the first queue */ -+ if (!pdd->proc_ctx_cpu_ptr && dev->kfd->shared_resources.enable_mes) { -+ retval = amdgpu_amdkfd_alloc_gtt_mem(dev->adev, -+ AMDGPU_MES_PROC_CTX_SIZE, -+ &pdd->proc_ctx_bo, -+ &pdd->proc_ctx_gpu_addr, -+ &pdd->proc_ctx_cpu_ptr, -+ false); -+ if (retval) { -+ dev_err(dev->adev->dev, "failed to allocate process context bo\n"); -+ return retval; -+ } -+ memset(pdd->proc_ctx_cpu_ptr, 0, AMDGPU_MES_PROC_CTX_SIZE); -+ } -+ - pqn = kzalloc(sizeof(*pqn), GFP_KERNEL); - if (!pqn) { - retval = -ENOMEM; -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 2b7f98a2e36f55..3696b9112c74e3 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -2890,6 +2890,11 @@ static int dm_resume(void *handle) - - return 0; - } -+ -+ /* leave display off for S4 sequence */ -+ if (adev->in_s4) -+ return 0; -+ - /* Recreate dc_state - DC invalidates it when setting power state to S3. */ - dc_release_state(dm_state->context); - dm_state->context = dc_create_state(dm->dc); -diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c -index f365773d571485..e9b3c1c7a9312a 100644 ---- a/drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c -+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c -@@ -37,6 +37,9 @@ - #include "dce/dce_i2c.h" - struct dc_link *dc_get_link_at_index(struct dc *dc, uint32_t link_index) - { -+ if (link_index >= (MAX_PIPES * 2)) -+ return NULL; -+ - return dc->links[link_index]; - } - -diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c -index 5c7530287730e5..4dc9856e87301b 100644 ---- a/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c -@@ -63,6 +63,10 @@ void dmub_hw_lock_mgr_inbox0_cmd(struct dc_dmub_srv *dmub_srv, - - bool should_use_dmub_lock(struct dc_link *link) - { -+ /* ASIC doesn't support DMUB */ -+ if (!link->ctx->dmub_srv) -+ return false; -+ - if (link->psr_settings.psr_version == DC_PSR_VERSION_SU_1) - return true; - -diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c b/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c -index ad741a723c0e8a..72ffa1abebaa18 100644 ---- a/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c -+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c -@@ -281,10 +281,10 @@ static void CalculateDynamicMetadataParameters( - double DISPCLK, - double DCFClkDeepSleep, - double PixelClock, -- long HTotal, -- long VBlank, -- long DynamicMetadataTransmittedBytes, -- long DynamicMetadataLinesBeforeActiveRequired, -+ unsigned int HTotal, -+ unsigned int VBlank, -+ unsigned int DynamicMetadataTransmittedBytes, -+ int DynamicMetadataLinesBeforeActiveRequired, - int InterlaceEnable, - bool ProgressiveToInterlaceUnitInOPP, - double *Tsetup, -@@ -3277,8 +3277,8 @@ static double CalculateWriteBackDelay( - - - static void CalculateDynamicMetadataParameters(int MaxInterDCNTileRepeaters, double DPPCLK, double DISPCLK, -- double DCFClkDeepSleep, double PixelClock, long HTotal, long VBlank, long DynamicMetadataTransmittedBytes, -- long DynamicMetadataLinesBeforeActiveRequired, int InterlaceEnable, bool ProgressiveToInterlaceUnitInOPP, -+ double DCFClkDeepSleep, double PixelClock, unsigned int HTotal, unsigned int VBlank, unsigned int DynamicMetadataTransmittedBytes, -+ int DynamicMetadataLinesBeforeActiveRequired, int InterlaceEnable, bool ProgressiveToInterlaceUnitInOPP, - double *Tsetup, double *Tdmbf, double *Tdmec, double *Tdmsks) - { - double TotalRepeaterDelayTime = 0; -diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c -index fe33b988d7523e..e094165e584a5f 100644 ---- a/drivers/gpu/drm/bridge/ite-it6505.c -+++ b/drivers/gpu/drm/bridge/ite-it6505.c -@@ -2039,12 +2039,13 @@ static bool it6505_hdcp_part2_ksvlist_check(struct it6505 *it6505) - continue; - } - -- for (i = 0; i < 5; i++) { -+ for (i = 0; i < 5; i++) - if (bv[i][3] != av[i][0] || bv[i][2] != av[i][1] || -- av[i][1] != av[i][2] || bv[i][0] != av[i][3]) -+ bv[i][1] != av[i][2] || bv[i][0] != av[i][3]) - break; - -- DRM_DEV_DEBUG_DRIVER(dev, "V' all match!! %d, %d", retry, i); -+ if (i == 5) { -+ DRM_DEV_DEBUG_DRIVER(dev, "V' all match!! %d", retry); - return true; - } - } -diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c -index 3309c01fa7153c..bfbd3fee125671 100644 ---- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c -+++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c -@@ -480,6 +480,7 @@ static int ti_sn65dsi86_add_aux_device(struct ti_sn65dsi86 *pdata, - const char *name) - { - struct device *dev = pdata->dev; -+ const struct i2c_client *client = to_i2c_client(dev); - struct auxiliary_device *aux; - int ret; - -@@ -488,6 +489,7 @@ static int ti_sn65dsi86_add_aux_device(struct ti_sn65dsi86 *pdata, - return -ENOMEM; - - aux->name = name; -+ aux->id = (client->adapter->nr << 10) | client->addr; - aux->dev.parent = dev; - aux->dev.release = ti_sn65dsi86_aux_device_release; - device_set_of_node_from_dev(&aux->dev, dev); -diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c -index 71a30387ca125b..21ff7ef7ce920f 100644 ---- a/drivers/gpu/drm/display/drm_dp_mst_topology.c -+++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c -@@ -178,13 +178,13 @@ static int - drm_dp_mst_rad_to_str(const u8 rad[8], u8 lct, char *out, size_t len) - { - int i; -- u8 unpacked_rad[16]; -+ u8 unpacked_rad[16] = {}; - -- for (i = 0; i < lct; i++) { -+ for (i = 1; i < lct; i++) { - if (i % 2) -- unpacked_rad[i] = rad[i / 2] >> 4; -+ unpacked_rad[i] = rad[(i - 1) / 2] >> 4; - else -- unpacked_rad[i] = rad[i / 2] & BIT_MASK(4); -+ unpacked_rad[i] = rad[(i - 1) / 2] & 0xF; - } - - /* TODO: Eventually add something to printk so we can format the rad -diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c -index be4de26c77f917..199527643093af 100644 ---- a/drivers/gpu/drm/mediatek/mtk_dp.c -+++ b/drivers/gpu/drm/mediatek/mtk_dp.c -@@ -1648,7 +1648,7 @@ static int mtk_dp_parse_capabilities(struct mtk_dp *mtk_dp) - - ret = drm_dp_dpcd_readb(&mtk_dp->aux, DP_MSTM_CAP, &val); - if (ret < 1) { -- drm_err(mtk_dp->drm_dev, "Read mstm cap failed\n"); -+ dev_err(mtk_dp->dev, "Read mstm cap failed: %zd\n", ret); - return ret == 0 ? -EIO : ret; - } - -@@ -1658,7 +1658,7 @@ static int mtk_dp_parse_capabilities(struct mtk_dp *mtk_dp) - DP_DEVICE_SERVICE_IRQ_VECTOR_ESI0, - &val); - if (ret < 1) { -- drm_err(mtk_dp->drm_dev, "Read irq vector failed\n"); -+ dev_err(mtk_dp->dev, "Read irq vector failed: %zd\n", ret); - return ret == 0 ? -EIO : ret; - } - -@@ -1941,7 +1941,7 @@ static int mtk_dp_wait_hpd_asserted(struct drm_dp_aux *mtk_aux, unsigned long wa - - ret = mtk_dp_parse_capabilities(mtk_dp); - if (ret) { -- drm_err(mtk_dp->drm_dev, "Can't parse capabilities\n"); -+ dev_err(mtk_dp->dev, "Can't parse capabilities: %d\n", ret); - return ret; - } - -diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c -index 0d96264ec5c6da..f154b3a7c2c2da 100644 ---- a/drivers/gpu/drm/mediatek/mtk_dsi.c -+++ b/drivers/gpu/drm/mediatek/mtk_dsi.c -@@ -1016,12 +1016,12 @@ static ssize_t mtk_dsi_host_transfer(struct mipi_dsi_host *host, - const struct mipi_dsi_msg *msg) - { - struct mtk_dsi *dsi = host_to_dsi(host); -- u32 recv_cnt, i; -+ ssize_t recv_cnt; - u8 read_data[16]; - void *src_addr; - u8 irq_flag = CMD_DONE_INT_FLAG; - u32 dsi_mode; -- int ret; -+ int ret, i; - - dsi_mode = readl(dsi->regs + DSI_MODE_CTRL); - if (dsi_mode & MODE) { -@@ -1070,7 +1070,7 @@ static ssize_t mtk_dsi_host_transfer(struct mipi_dsi_host *host, - if (recv_cnt) - memcpy(msg->rx_buf, src_addr, recv_cnt); - -- DRM_INFO("dsi get %d byte data from the panel address(0x%x)\n", -+ DRM_INFO("dsi get %zd byte data from the panel address(0x%x)\n", - recv_cnt, *((u8 *)(msg->tx_buf))); - - restore_dsi_mode: -diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c -index 86133bf16326b1..68d0b65ef783a1 100644 ---- a/drivers/gpu/drm/mediatek/mtk_hdmi.c -+++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c -@@ -137,7 +137,7 @@ enum hdmi_aud_channel_swap_type { - - struct hdmi_audio_param { - enum hdmi_audio_coding_type aud_codec; -- enum hdmi_audio_sample_size aud_sampe_size; -+ enum hdmi_audio_sample_size aud_sample_size; - enum hdmi_aud_input_type aud_input_type; - enum hdmi_aud_i2s_fmt aud_i2s_fmt; - enum hdmi_aud_mclk aud_mclk; -@@ -173,6 +173,7 @@ struct mtk_hdmi { - unsigned int sys_offset; - void __iomem *regs; - enum hdmi_colorspace csp; -+ struct platform_device *audio_pdev; - struct hdmi_audio_param aud_param; - bool audio_enable; - bool powered; -@@ -1074,7 +1075,7 @@ static int mtk_hdmi_output_init(struct mtk_hdmi *hdmi) - - hdmi->csp = HDMI_COLORSPACE_RGB; - aud_param->aud_codec = HDMI_AUDIO_CODING_TYPE_PCM; -- aud_param->aud_sampe_size = HDMI_AUDIO_SAMPLE_SIZE_16; -+ aud_param->aud_sample_size = HDMI_AUDIO_SAMPLE_SIZE_16; - aud_param->aud_input_type = HDMI_AUD_INPUT_I2S; - aud_param->aud_i2s_fmt = HDMI_I2S_MODE_I2S_24BIT; - aud_param->aud_mclk = HDMI_AUD_MCLK_128FS; -@@ -1575,14 +1576,14 @@ static int mtk_hdmi_audio_hw_params(struct device *dev, void *data, - switch (daifmt->fmt) { - case HDMI_I2S: - hdmi_params.aud_codec = HDMI_AUDIO_CODING_TYPE_PCM; -- hdmi_params.aud_sampe_size = HDMI_AUDIO_SAMPLE_SIZE_16; -+ hdmi_params.aud_sample_size = HDMI_AUDIO_SAMPLE_SIZE_16; - hdmi_params.aud_input_type = HDMI_AUD_INPUT_I2S; - hdmi_params.aud_i2s_fmt = HDMI_I2S_MODE_I2S_24BIT; - hdmi_params.aud_mclk = HDMI_AUD_MCLK_128FS; - break; - case HDMI_SPDIF: - hdmi_params.aud_codec = HDMI_AUDIO_CODING_TYPE_PCM; -- hdmi_params.aud_sampe_size = HDMI_AUDIO_SAMPLE_SIZE_16; -+ hdmi_params.aud_sample_size = HDMI_AUDIO_SAMPLE_SIZE_16; - hdmi_params.aud_input_type = HDMI_AUD_INPUT_SPDIF; - break; - default: -@@ -1666,6 +1667,11 @@ static const struct hdmi_codec_ops mtk_hdmi_audio_codec_ops = { - .no_capture_mute = 1, - }; - -+static void mtk_hdmi_unregister_audio_driver(void *data) -+{ -+ platform_device_unregister(data); -+} -+ - static int mtk_hdmi_register_audio_driver(struct device *dev) - { - struct mtk_hdmi *hdmi = dev_get_drvdata(dev); -@@ -1675,13 +1681,20 @@ static int mtk_hdmi_register_audio_driver(struct device *dev) - .i2s = 1, - .data = hdmi, - }; -- struct platform_device *pdev; -+ int ret; - -- pdev = platform_device_register_data(dev, HDMI_CODEC_DRV_NAME, -- PLATFORM_DEVID_AUTO, &codec_data, -- sizeof(codec_data)); -- if (IS_ERR(pdev)) -- return PTR_ERR(pdev); -+ hdmi->audio_pdev = platform_device_register_data(dev, -+ HDMI_CODEC_DRV_NAME, -+ PLATFORM_DEVID_AUTO, -+ &codec_data, -+ sizeof(codec_data)); -+ if (IS_ERR(hdmi->audio_pdev)) -+ return PTR_ERR(hdmi->audio_pdev); -+ -+ ret = devm_add_action_or_reset(dev, mtk_hdmi_unregister_audio_driver, -+ hdmi->audio_pdev); -+ if (ret) -+ return ret; - - DRM_INFO("%s driver bound to HDMI\n", HDMI_CODEC_DRV_NAME); - return 0; -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c -index ad57368dc13f03..2df1e6293062d4 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c -@@ -1210,10 +1210,6 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc, - - DRM_DEBUG_ATOMIC("%s: check\n", dpu_crtc->name); - -- /* force a full mode set if active state changed */ -- if (crtc_state->active_changed) -- crtc_state->mode_changed = true; -- - if (cstate->num_mixers) { - rc = _dpu_crtc_check_and_setup_lm_bounds(crtc, crtc_state); - if (rc) -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c -index 35cf9080168b12..99cccde5d2216a 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c -@@ -669,12 +669,11 @@ static int dpu_encoder_virt_atomic_check( - - /* - * Release and Allocate resources on every modeset -- * Dont allocate when active is false. - */ - if (drm_atomic_crtc_needs_modeset(crtc_state)) { - dpu_rm_release(global_state, drm_enc); - -- if (!crtc_state->active_changed || crtc_state->enable) -+ if (crtc_state->enable) - ret = dpu_rm_reserve(&dpu_kms->rm, global_state, - drm_enc, crtc_state, topology); - } -diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c -index f920329fe2e090..f90ccdfbb2fc7c 100644 ---- a/drivers/gpu/drm/msm/dsi/dsi_host.c -+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c -@@ -825,7 +825,7 @@ static void dsi_ctrl_enable(struct msm_dsi_host *msm_host, - dsi_write(msm_host, REG_DSI_CPHY_MODE_CTRL, BIT(0)); - } - --static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mode, u32 hdisplay) -+static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mode) - { - struct drm_dsc_config *dsc = msm_host->dsc; - u32 reg, reg_ctrl, reg_ctrl2; -@@ -837,7 +837,7 @@ static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mod - /* first calculate dsc parameters and then program - * compress mode registers - */ -- slice_per_intf = msm_dsc_get_slices_per_intf(dsc, hdisplay); -+ slice_per_intf = dsc->slice_count; - - total_bytes_per_intf = dsc->slice_chunk_size * slice_per_intf; - bytes_per_pkt = dsc->slice_chunk_size; /* * slice_per_pkt; */ -@@ -948,7 +948,7 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi) - - if (msm_host->mode_flags & MIPI_DSI_MODE_VIDEO) { - if (msm_host->dsc) -- dsi_update_dsc_timing(msm_host, false, mode->hdisplay); -+ dsi_update_dsc_timing(msm_host, false); - - dsi_write(msm_host, REG_DSI_ACTIVE_H, - DSI_ACTIVE_H_START(ha_start) | -@@ -969,7 +969,7 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi) - DSI_ACTIVE_VSYNC_VPOS_END(vs_end)); - } else { /* command mode */ - if (msm_host->dsc) -- dsi_update_dsc_timing(msm_host, true, mode->hdisplay); -+ dsi_update_dsc_timing(msm_host, true); - - /* image data and 1 byte write_memory_start cmd */ - if (!msm_host->dsc) -diff --git a/drivers/gpu/drm/msm/dsi/dsi_manager.c b/drivers/gpu/drm/msm/dsi/dsi_manager.c -index 28b8012a21f2b3..1a75f9c18c24b6 100644 ---- a/drivers/gpu/drm/msm/dsi/dsi_manager.c -+++ b/drivers/gpu/drm/msm/dsi/dsi_manager.c -@@ -74,17 +74,35 @@ static int dsi_mgr_setup_components(int id) - int ret; - - if (!IS_BONDED_DSI()) { -+ /* -+ * Set the usecase before calling msm_dsi_host_register(), which would -+ * already program the PLL source mux based on a default usecase. -+ */ -+ msm_dsi_phy_set_usecase(msm_dsi->phy, MSM_DSI_PHY_STANDALONE); -+ msm_dsi_host_set_phy_mode(msm_dsi->host, msm_dsi->phy); -+ - ret = msm_dsi_host_register(msm_dsi->host); - if (ret) - return ret; -- -- msm_dsi_phy_set_usecase(msm_dsi->phy, MSM_DSI_PHY_STANDALONE); -- msm_dsi_host_set_phy_mode(msm_dsi->host, msm_dsi->phy); - } else if (other_dsi) { - struct msm_dsi *master_link_dsi = IS_MASTER_DSI_LINK(id) ? - msm_dsi : other_dsi; - struct msm_dsi *slave_link_dsi = IS_MASTER_DSI_LINK(id) ? - other_dsi : msm_dsi; -+ -+ /* -+ * PLL0 is to drive both DSI link clocks in bonded DSI mode. -+ * -+ * Set the usecase before calling msm_dsi_host_register(), which would -+ * already program the PLL source mux based on a default usecase. -+ */ -+ msm_dsi_phy_set_usecase(clk_master_dsi->phy, -+ MSM_DSI_PHY_MASTER); -+ msm_dsi_phy_set_usecase(clk_slave_dsi->phy, -+ MSM_DSI_PHY_SLAVE); -+ msm_dsi_host_set_phy_mode(msm_dsi->host, msm_dsi->phy); -+ msm_dsi_host_set_phy_mode(other_dsi->host, other_dsi->phy); -+ - /* Register slave host first, so that slave DSI device - * has a chance to probe, and do not block the master - * DSI device's probe. -@@ -98,14 +116,6 @@ static int dsi_mgr_setup_components(int id) - ret = msm_dsi_host_register(master_link_dsi->host); - if (ret) - return ret; -- -- /* PLL0 is to drive both 2 DSI link clocks in bonded DSI mode. */ -- msm_dsi_phy_set_usecase(clk_master_dsi->phy, -- MSM_DSI_PHY_MASTER); -- msm_dsi_phy_set_usecase(clk_slave_dsi->phy, -- MSM_DSI_PHY_SLAVE); -- msm_dsi_host_set_phy_mode(msm_dsi->host, msm_dsi->phy); -- msm_dsi_host_set_phy_mode(other_dsi->host, other_dsi->phy); - } - - return 0; -diff --git a/drivers/gpu/drm/msm/msm_dsc_helper.h b/drivers/gpu/drm/msm/msm_dsc_helper.h -index b9049fe1e27907..63f95523b2cbb4 100644 ---- a/drivers/gpu/drm/msm/msm_dsc_helper.h -+++ b/drivers/gpu/drm/msm/msm_dsc_helper.h -@@ -12,17 +12,6 @@ - #include - #include - --/** -- * msm_dsc_get_slices_per_intf() - calculate number of slices per interface -- * @dsc: Pointer to drm dsc config struct -- * @intf_width: interface width in pixels -- * Returns: Integer representing the number of slices for the given interface -- */ --static inline u32 msm_dsc_get_slices_per_intf(const struct drm_dsc_config *dsc, u32 intf_width) --{ -- return DIV_ROUND_UP(intf_width, dsc->slice_width); --} -- - /** - * msm_dsc_get_bytes_per_line() - calculate bytes per line - * @dsc: Pointer to drm dsc config struct -diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c -index dd0af086e7fa94..25db36ec06d493 100644 ---- a/drivers/gpu/drm/vkms/vkms_drv.c -+++ b/drivers/gpu/drm/vkms/vkms_drv.c -@@ -243,17 +243,19 @@ static int __init vkms_init(void) - if (!config) - return -ENOMEM; - -- default_config = config; -- - config->cursor = enable_cursor; - config->writeback = enable_writeback; - config->overlay = enable_overlay; - - ret = vkms_create(config); -- if (ret) -+ if (ret) { - kfree(config); -+ return ret; -+ } - -- return ret; -+ default_config = config; -+ -+ return 0; - } - - static void vkms_destroy(struct vkms_config *config) -@@ -277,9 +279,10 @@ static void vkms_destroy(struct vkms_config *config) - - static void __exit vkms_exit(void) - { -- if (default_config->dev) -- vkms_destroy(default_config); -+ if (!default_config) -+ return; - -+ vkms_destroy(default_config); - kfree(default_config); - } - -diff --git a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c -index f5781939de9c35..a25b22238e3d2f 100644 ---- a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c -+++ b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c -@@ -231,6 +231,8 @@ static int zynqmp_dpsub_probe(struct platform_device *pdev) - if (ret) - return ret; - -+ dma_set_max_seg_size(&pdev->dev, DMA_BIT_MASK(32)); -+ - /* Try the reserved memory. Proceed if there's none. */ - of_reserved_mem_device_init(&pdev->dev); - -diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile -index 082a728eac6004..f5a06b62b385db 100644 ---- a/drivers/hid/Makefile -+++ b/drivers/hid/Makefile -@@ -165,7 +165,6 @@ obj-$(CONFIG_USB_KBD) += usbhid/ - obj-$(CONFIG_I2C_HID_CORE) += i2c-hid/ - - obj-$(CONFIG_INTEL_ISH_HID) += intel-ish-hid/ --obj-$(INTEL_ISH_FIRMWARE_DOWNLOADER) += intel-ish-hid/ - - obj-$(CONFIG_AMD_SFH_HID) += amd-sfh-hid/ - -diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c -index 045db6f0fb4c4f..3dcdd3368b463e 100644 ---- a/drivers/hid/i2c-hid/i2c-hid-core.c -+++ b/drivers/hid/i2c-hid/i2c-hid-core.c -@@ -258,7 +258,7 @@ static int i2c_hid_get_report(struct i2c_hid *ihid, - ihid->rawbuf, recv_len + sizeof(__le16)); - if (error) { - dev_err(&ihid->client->dev, -- "failed to set a report to device: %d\n", error); -+ "failed to get a report from device: %d\n", error); - return error; - } - -diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c -index 16f6b7ba2a5def..da4c3425d2d1dd 100644 ---- a/drivers/hwmon/nct6775-core.c -+++ b/drivers/hwmon/nct6775-core.c -@@ -273,8 +273,8 @@ static const s8 NCT6776_BEEP_BITS[NUM_BEEP_BITS] = { - static const u16 NCT6776_REG_TOLERANCE_H[] = { - 0x10c, 0x20c, 0x30c, 0x80c, 0x90c, 0xa0c, 0xb0c }; - --static const u8 NCT6776_REG_PWM_MODE[] = { 0x04, 0, 0, 0, 0, 0 }; --static const u8 NCT6776_PWM_MODE_MASK[] = { 0x01, 0, 0, 0, 0, 0 }; -+static const u8 NCT6776_REG_PWM_MODE[] = { 0x04, 0, 0, 0, 0, 0, 0 }; -+static const u8 NCT6776_PWM_MODE_MASK[] = { 0x01, 0, 0, 0, 0, 0, 0 }; - - static const u16 NCT6776_REG_FAN_MIN[] = { - 0x63a, 0x63c, 0x63e, 0x640, 0x642, 0x64a, 0x64c }; -diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c -index 3949ded0d4fa59..c062bcc09466aa 100644 ---- a/drivers/hwtracing/coresight/coresight-catu.c -+++ b/drivers/hwtracing/coresight/coresight-catu.c -@@ -267,7 +267,7 @@ catu_init_sg_table(struct device *catu_dev, int node, - * Each table can address upto 1MB and we can have - * CATU_PAGES_PER_SYSPAGE tables in a system page. - */ -- nr_tpages = DIV_ROUND_UP(size, SZ_1M) / CATU_PAGES_PER_SYSPAGE; -+ nr_tpages = DIV_ROUND_UP(size, CATU_PAGES_PER_SYSPAGE * SZ_1M); - catu_table = tmc_alloc_sg_table(catu_dev, node, nr_tpages, - size >> PAGE_SHIFT, pages); - if (IS_ERR(catu_table)) -diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c -index 4b80026db1ab61..783e259c376121 100644 ---- a/drivers/hwtracing/coresight/coresight-core.c -+++ b/drivers/hwtracing/coresight/coresight-core.c -@@ -1465,18 +1465,20 @@ static void coresight_remove_conns(struct coresight_device *csdev) - } - - /** -- * coresight_timeout - loop until a bit has changed to a specific register -- * state. -+ * coresight_timeout_action - loop until a bit has changed to a specific register -+ * state, with a callback after every trial. - * @csa: coresight device access for the device - * @offset: Offset of the register from the base of the device. - * @position: the position of the bit of interest. - * @value: the value the bit should have. -+ * @cb: Call back after each trial. - * - * Return: 0 as soon as the bit has taken the desired state or -EAGAIN if - * TIMEOUT_US has elapsed, which ever happens first. - */ --int coresight_timeout(struct csdev_access *csa, u32 offset, -- int position, int value) -+int coresight_timeout_action(struct csdev_access *csa, u32 offset, -+ int position, int value, -+ coresight_timeout_cb_t cb) - { - int i; - u32 val; -@@ -1492,7 +1494,8 @@ int coresight_timeout(struct csdev_access *csa, u32 offset, - if (!(val & BIT(position))) - return 0; - } -- -+ if (cb) -+ cb(csa, offset, position, value); - /* - * Delay is arbitrary - the specification doesn't say how long - * we are expected to wait. Extra check required to make sure -@@ -1504,6 +1507,13 @@ int coresight_timeout(struct csdev_access *csa, u32 offset, - - return -EAGAIN; - } -+EXPORT_SYMBOL_GPL(coresight_timeout_action); -+ -+int coresight_timeout(struct csdev_access *csa, u32 offset, -+ int position, int value) -+{ -+ return coresight_timeout_action(csa, offset, position, value, NULL); -+} - EXPORT_SYMBOL_GPL(coresight_timeout); - - u32 coresight_relaxed_read32(struct coresight_device *csdev, u32 offset) -diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c -index 840e4cccf8c4ba..05d9f87e35333c 100644 ---- a/drivers/hwtracing/coresight/coresight-etm4x-core.c -+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c -@@ -399,6 +399,29 @@ static void etm4_check_arch_features(struct etmv4_drvdata *drvdata, - } - #endif /* CONFIG_ETM4X_IMPDEF_FEATURE */ - -+static void etm4x_sys_ins_barrier(struct csdev_access *csa, u32 offset, int pos, int val) -+{ -+ if (!csa->io_mem) -+ isb(); -+} -+ -+/* -+ * etm4x_wait_status: Poll for TRCSTATR. == . While using system -+ * instruction to access the trace unit, each access must be separated by a -+ * synchronization barrier. See ARM IHI0064H.b section "4.3.7 Synchronization of -+ * register updates", for system instructions section, in "Notes": -+ * -+ * "In particular, whenever disabling or enabling the trace unit, a poll of -+ * TRCSTATR needs explicit synchronization between each read of TRCSTATR" -+ */ -+static int etm4x_wait_status(struct csdev_access *csa, int pos, int val) -+{ -+ if (!csa->io_mem) -+ return coresight_timeout_action(csa, TRCSTATR, pos, val, -+ etm4x_sys_ins_barrier); -+ return coresight_timeout(csa, TRCSTATR, pos, val); -+} -+ - static int etm4_enable_hw(struct etmv4_drvdata *drvdata) - { - int i, rc; -@@ -430,7 +453,7 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata) - isb(); - - /* wait for TRCSTATR.IDLE to go up */ -- if (coresight_timeout(csa, TRCSTATR, TRCSTATR_IDLE_BIT, 1)) -+ if (etm4x_wait_status(csa, TRCSTATR_IDLE_BIT, 1)) - dev_err(etm_dev, - "timeout while waiting for Idle Trace Status\n"); - if (drvdata->nr_pe) -@@ -523,7 +546,7 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata) - isb(); - - /* wait for TRCSTATR.IDLE to go back down to '0' */ -- if (coresight_timeout(csa, TRCSTATR, TRCSTATR_IDLE_BIT, 0)) -+ if (etm4x_wait_status(csa, TRCSTATR_IDLE_BIT, 0)) - dev_err(etm_dev, - "timeout while waiting for Idle Trace Status\n"); - -@@ -903,10 +926,25 @@ static void etm4_disable_hw(void *info) - tsb_csync(); - etm4x_relaxed_write32(csa, control, TRCPRGCTLR); - -+ /* -+ * As recommended by section 4.3.7 ("Synchronization when using system -+ * instructions to progrom the trace unit") of ARM IHI 0064H.b, the -+ * self-hosted trace analyzer must perform a Context synchronization -+ * event between writing to the TRCPRGCTLR and reading the TRCSTATR. -+ */ -+ if (!csa->io_mem) -+ isb(); -+ - /* wait for TRCSTATR.PMSTABLE to go to '1' */ -- if (coresight_timeout(csa, TRCSTATR, TRCSTATR_PMSTABLE_BIT, 1)) -+ if (etm4x_wait_status(csa, TRCSTATR_PMSTABLE_BIT, 1)) - dev_err(etm_dev, - "timeout while waiting for PM stable Trace Status\n"); -+ /* -+ * As recommended by section 4.3.7 (Synchronization of register updates) -+ * of ARM IHI 0064H.b. -+ */ -+ isb(); -+ - /* read the status of the single shot comparators */ - for (i = 0; i < drvdata->nr_ss_cmp; i++) { - config->ss_status[i] = -@@ -1672,7 +1710,7 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata) - etm4_os_lock(drvdata); - - /* wait for TRCSTATR.PMSTABLE to go up */ -- if (coresight_timeout(csa, TRCSTATR, TRCSTATR_PMSTABLE_BIT, 1)) { -+ if (etm4x_wait_status(csa, TRCSTATR_PMSTABLE_BIT, 1)) { - dev_err(etm_dev, - "timeout while waiting for PM Stable Status\n"); - etm4_os_unlock(drvdata); -@@ -1763,7 +1801,7 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata) - state->trcpdcr = etm4x_read32(csa, TRCPDCR); - - /* wait for TRCSTATR.IDLE to go up */ -- if (coresight_timeout(csa, TRCSTATR, TRCSTATR_IDLE_BIT, 1)) { -+ if (etm4x_wait_status(csa, TRCSTATR_PMSTABLE_BIT, 1)) { - dev_err(etm_dev, - "timeout while waiting for Idle Trace Status\n"); - etm4_os_unlock(drvdata); -diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c -index c5ab39f1e755c8..652a666909a552 100644 ---- a/drivers/i3c/master/svc-i3c-master.c -+++ b/drivers/i3c/master/svc-i3c-master.c -@@ -951,7 +951,7 @@ static int svc_i3c_update_ibirules(struct svc_i3c_master *master) - - /* Create the IBIRULES register for both cases */ - i3c_bus_for_each_i3cdev(&master->base.bus, dev) { -- if (I3C_BCR_DEVICE_ROLE(dev->info.bcr) == I3C_BCR_I3C_MASTER) -+ if (!(dev->info.bcr & I3C_BCR_IBI_REQ_CAP)) - continue; - - if (dev->info.bcr & I3C_BCR_IBI_PAYLOAD) { -diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c -index f42a8871148653..16a0de6002be05 100644 ---- a/drivers/iio/accel/mma8452.c -+++ b/drivers/iio/accel/mma8452.c -@@ -711,7 +711,7 @@ static int mma8452_write_raw(struct iio_dev *indio_dev, - int val, int val2, long mask) - { - struct mma8452_data *data = iio_priv(indio_dev); -- int i, ret; -+ int i, j, ret; - - ret = iio_device_claim_direct_mode(indio_dev); - if (ret) -@@ -771,14 +771,18 @@ static int mma8452_write_raw(struct iio_dev *indio_dev, - break; - - case IIO_CHAN_INFO_OVERSAMPLING_RATIO: -- ret = mma8452_get_odr_index(data); -+ j = mma8452_get_odr_index(data); - - for (i = 0; i < ARRAY_SIZE(mma8452_os_ratio); i++) { -- if (mma8452_os_ratio[i][ret] == val) { -+ if (mma8452_os_ratio[i][j] == val) { - ret = mma8452_set_power_mode(data, i); - break; - } - } -+ if (i == ARRAY_SIZE(mma8452_os_ratio)) { -+ ret = -EINVAL; -+ break; -+ } - break; - default: - ret = -EINVAL; -diff --git a/drivers/iio/accel/msa311.c b/drivers/iio/accel/msa311.c -index 6ddcc3c2f84091..5927df633e1f94 100644 ---- a/drivers/iio/accel/msa311.c -+++ b/drivers/iio/accel/msa311.c -@@ -593,23 +593,25 @@ static int msa311_read_raw_data(struct iio_dev *indio_dev, - __le16 axis; - int err; - -- err = pm_runtime_resume_and_get(dev); -+ err = iio_device_claim_direct_mode(indio_dev); - if (err) - return err; - -- err = iio_device_claim_direct_mode(indio_dev); -- if (err) -+ err = pm_runtime_resume_and_get(dev); -+ if (err) { -+ iio_device_release_direct_mode(indio_dev); - return err; -+ } - - mutex_lock(&msa311->lock); - err = msa311_get_axis(msa311, chan, &axis); - mutex_unlock(&msa311->lock); - -- iio_device_release_direct_mode(indio_dev); -- - pm_runtime_mark_last_busy(dev); - pm_runtime_put_autosuspend(dev); - -+ iio_device_release_direct_mode(indio_dev); -+ - if (err) { - dev_err(dev, "can't get axis %s (%pe)\n", - chan->datasheet_name, ERR_PTR(err)); -@@ -755,10 +757,6 @@ static int msa311_write_samp_freq(struct iio_dev *indio_dev, int val, int val2) - unsigned int odr; - int err; - -- err = pm_runtime_resume_and_get(dev); -- if (err) -- return err; -- - /* - * Sampling frequency changing is prohibited when buffer mode is - * enabled, because sometimes MSA311 chip returns outliers during -@@ -768,6 +766,12 @@ static int msa311_write_samp_freq(struct iio_dev *indio_dev, int val, int val2) - if (err) - return err; - -+ err = pm_runtime_resume_and_get(dev); -+ if (err) { -+ iio_device_release_direct_mode(indio_dev); -+ return err; -+ } -+ - err = -EINVAL; - for (odr = 0; odr < ARRAY_SIZE(msa311_odr_table); odr++) - if (val == msa311_odr_table[odr].integral && -@@ -778,11 +782,11 @@ static int msa311_write_samp_freq(struct iio_dev *indio_dev, int val, int val2) - break; - } - -- iio_device_release_direct_mode(indio_dev); -- - pm_runtime_mark_last_busy(dev); - pm_runtime_put_autosuspend(dev); - -+ iio_device_release_direct_mode(indio_dev); -+ - if (err) - dev_err(dev, "can't update frequency (%pe)\n", ERR_PTR(err)); - -diff --git a/drivers/iio/adc/ad4130.c b/drivers/iio/adc/ad4130.c -index e650ebd167b038..64422186285185 100644 ---- a/drivers/iio/adc/ad4130.c -+++ b/drivers/iio/adc/ad4130.c -@@ -223,6 +223,10 @@ enum ad4130_pin_function { - AD4130_PIN_FN_VBIAS = BIT(3), - }; - -+/* -+ * If you make adaptations in this struct, you most likely also have to adapt -+ * ad4130_setup_info_eq(), too. -+ */ - struct ad4130_setup_info { - unsigned int iout0_val; - unsigned int iout1_val; -@@ -591,6 +595,40 @@ static irqreturn_t ad4130_irq_handler(int irq, void *private) - return IRQ_HANDLED; - } - -+static bool ad4130_setup_info_eq(struct ad4130_setup_info *a, -+ struct ad4130_setup_info *b) -+{ -+ /* -+ * This is just to make sure that the comparison is adapted after -+ * struct ad4130_setup_info was changed. -+ */ -+ static_assert(sizeof(*a) == -+ sizeof(struct { -+ unsigned int iout0_val; -+ unsigned int iout1_val; -+ unsigned int burnout; -+ unsigned int pga; -+ unsigned int fs; -+ u32 ref_sel; -+ enum ad4130_filter_mode filter_mode; -+ bool ref_bufp; -+ bool ref_bufm; -+ })); -+ -+ if (a->iout0_val != b->iout0_val || -+ a->iout1_val != b->iout1_val || -+ a->burnout != b->burnout || -+ a->pga != b->pga || -+ a->fs != b->fs || -+ a->ref_sel != b->ref_sel || -+ a->filter_mode != b->filter_mode || -+ a->ref_bufp != b->ref_bufp || -+ a->ref_bufm != b->ref_bufm) -+ return false; -+ -+ return true; -+} -+ - static int ad4130_find_slot(struct ad4130_state *st, - struct ad4130_setup_info *target_setup_info, - unsigned int *slot, bool *overwrite) -@@ -604,8 +642,7 @@ static int ad4130_find_slot(struct ad4130_state *st, - struct ad4130_slot_info *slot_info = &st->slots_info[i]; - - /* Immediately accept a matching setup info. */ -- if (!memcmp(target_setup_info, &slot_info->setup, -- sizeof(*target_setup_info))) { -+ if (ad4130_setup_info_eq(target_setup_info, &slot_info->setup)) { - *slot = i; - return 0; - } -diff --git a/drivers/iio/adc/ad7124.c b/drivers/iio/adc/ad7124.c -index d2060d394c8d27..0e6baf017bfd1e 100644 ---- a/drivers/iio/adc/ad7124.c -+++ b/drivers/iio/adc/ad7124.c -@@ -147,7 +147,11 @@ struct ad7124_chip_info { - struct ad7124_channel_config { - bool live; - unsigned int cfg_slot; -- /* Following fields are used to compare equality. */ -+ /* -+ * Following fields are used to compare for equality. If you -+ * make adaptations in it, you most likely also have to adapt -+ * ad7124_find_similar_live_cfg(), too. -+ */ - struct_group(config_props, - enum ad7124_ref_sel refsel; - bool bipolar; -@@ -334,15 +338,38 @@ static struct ad7124_channel_config *ad7124_find_similar_live_cfg(struct ad7124_ - struct ad7124_channel_config *cfg) - { - struct ad7124_channel_config *cfg_aux; -- ptrdiff_t cmp_size; - int i; - -- cmp_size = sizeof_field(struct ad7124_channel_config, config_props); -+ /* -+ * This is just to make sure that the comparison is adapted after -+ * struct ad7124_channel_config was changed. -+ */ -+ static_assert(sizeof_field(struct ad7124_channel_config, config_props) == -+ sizeof(struct { -+ enum ad7124_ref_sel refsel; -+ bool bipolar; -+ bool buf_positive; -+ bool buf_negative; -+ unsigned int vref_mv; -+ unsigned int pga_bits; -+ unsigned int odr; -+ unsigned int odr_sel_bits; -+ unsigned int filter_type; -+ })); -+ - for (i = 0; i < st->num_channels; i++) { - cfg_aux = &st->channels[i].cfg; - - if (cfg_aux->live && -- !memcmp(&cfg->config_props, &cfg_aux->config_props, cmp_size)) -+ cfg->refsel == cfg_aux->refsel && -+ cfg->bipolar == cfg_aux->bipolar && -+ cfg->buf_positive == cfg_aux->buf_positive && -+ cfg->buf_negative == cfg_aux->buf_negative && -+ cfg->vref_mv == cfg_aux->vref_mv && -+ cfg->pga_bits == cfg_aux->pga_bits && -+ cfg->odr == cfg_aux->odr && -+ cfg->odr_sel_bits == cfg_aux->odr_sel_bits && -+ cfg->filter_type == cfg_aux->filter_type) - return cfg_aux; - } - -diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c -index 56dd030045a206..6769c42e46d4f9 100644 ---- a/drivers/infiniband/core/device.c -+++ b/drivers/infiniband/core/device.c -@@ -543,6 +543,8 @@ static struct class ib_class = { - static void rdma_init_coredev(struct ib_core_device *coredev, - struct ib_device *dev, struct net *net) - { -+ bool is_full_dev = &dev->coredev == coredev; -+ - /* This BUILD_BUG_ON is intended to catch layout change - * of union of ib_core_device and device. - * dev must be the first element as ib_core and providers -@@ -554,6 +556,13 @@ static void rdma_init_coredev(struct ib_core_device *coredev, - - coredev->dev.class = &ib_class; - coredev->dev.groups = dev->groups; -+ -+ /* -+ * Don't expose hw counters outside of the init namespace. -+ */ -+ if (!is_full_dev && dev->hw_stats_attr_index) -+ coredev->dev.groups[dev->hw_stats_attr_index] = NULL; -+ - device_initialize(&coredev->dev); - coredev->owner = dev; - INIT_LIST_HEAD(&coredev->port_list); -diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c -index 58befbaaf0ad54..242434c09e8d8f 100644 ---- a/drivers/infiniband/core/mad.c -+++ b/drivers/infiniband/core/mad.c -@@ -2671,11 +2671,11 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, - struct ib_mad_private *mad) - { - unsigned long flags; -- int post, ret; - struct ib_mad_private *mad_priv; - struct ib_sge sg_list; - struct ib_recv_wr recv_wr; - struct ib_mad_queue *recv_queue = &qp_info->recv_queue; -+ int ret = 0; - - /* Initialize common scatter list fields */ - sg_list.lkey = qp_info->port_priv->pd->local_dma_lkey; -@@ -2685,7 +2685,7 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, - recv_wr.sg_list = &sg_list; - recv_wr.num_sge = 1; - -- do { -+ while (true) { - /* Allocate and map receive buffer */ - if (mad) { - mad_priv = mad; -@@ -2693,10 +2693,8 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, - } else { - mad_priv = alloc_mad_private(port_mad_size(qp_info->port_priv), - GFP_ATOMIC); -- if (!mad_priv) { -- ret = -ENOMEM; -- break; -- } -+ if (!mad_priv) -+ return -ENOMEM; - } - sg_list.length = mad_priv_dma_size(mad_priv); - sg_list.addr = ib_dma_map_single(qp_info->port_priv->device, -@@ -2705,37 +2703,41 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, - DMA_FROM_DEVICE); - if (unlikely(ib_dma_mapping_error(qp_info->port_priv->device, - sg_list.addr))) { -- kfree(mad_priv); - ret = -ENOMEM; -- break; -+ goto free_mad_priv; - } - mad_priv->header.mapping = sg_list.addr; - mad_priv->header.mad_list.mad_queue = recv_queue; - mad_priv->header.mad_list.cqe.done = ib_mad_recv_done; - recv_wr.wr_cqe = &mad_priv->header.mad_list.cqe; -- -- /* Post receive WR */ - spin_lock_irqsave(&recv_queue->lock, flags); -- post = (++recv_queue->count < recv_queue->max_active); -- list_add_tail(&mad_priv->header.mad_list.list, &recv_queue->list); -+ if (recv_queue->count >= recv_queue->max_active) { -+ /* Fully populated the receive queue */ -+ spin_unlock_irqrestore(&recv_queue->lock, flags); -+ break; -+ } -+ recv_queue->count++; -+ list_add_tail(&mad_priv->header.mad_list.list, -+ &recv_queue->list); - spin_unlock_irqrestore(&recv_queue->lock, flags); -+ - ret = ib_post_recv(qp_info->qp, &recv_wr, NULL); - if (ret) { - spin_lock_irqsave(&recv_queue->lock, flags); - list_del(&mad_priv->header.mad_list.list); - recv_queue->count--; - spin_unlock_irqrestore(&recv_queue->lock, flags); -- ib_dma_unmap_single(qp_info->port_priv->device, -- mad_priv->header.mapping, -- mad_priv_dma_size(mad_priv), -- DMA_FROM_DEVICE); -- kfree(mad_priv); - dev_err(&qp_info->port_priv->device->dev, - "ib_post_recv failed: %d\n", ret); - break; - } -- } while (post); -+ } - -+ ib_dma_unmap_single(qp_info->port_priv->device, -+ mad_priv->header.mapping, -+ mad_priv_dma_size(mad_priv), DMA_FROM_DEVICE); -+free_mad_priv: -+ kfree(mad_priv); - return ret; - } - -diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c -index 9f97bef0214975..210092b9bf17d2 100644 ---- a/drivers/infiniband/core/sysfs.c -+++ b/drivers/infiniband/core/sysfs.c -@@ -988,6 +988,7 @@ int ib_setup_device_attrs(struct ib_device *ibdev) - for (i = 0; i != ARRAY_SIZE(ibdev->groups); i++) - if (!ibdev->groups[i]) { - ibdev->groups[i] = &data->group; -+ ibdev->hw_stats_attr_index = i; - return 0; - } - WARN(true, "struct ib_device->groups is too small"); -diff --git a/drivers/infiniband/hw/erdma/erdma_cm.c b/drivers/infiniband/hw/erdma/erdma_cm.c -index 771059a8eb7d7f..e349e8d2fb50a8 100644 ---- a/drivers/infiniband/hw/erdma/erdma_cm.c -+++ b/drivers/infiniband/hw/erdma/erdma_cm.c -@@ -705,7 +705,6 @@ static void erdma_accept_newconn(struct erdma_cep *cep) - erdma_cancel_mpatimer(new_cep); - - erdma_cep_put(new_cep); -- new_cep->sock = NULL; - } - - if (new_s) { -diff --git a/drivers/infiniband/hw/mana/main.c b/drivers/infiniband/hw/mana/main.c -index 6fa9b125329970..c4c49a3f11b0a3 100644 ---- a/drivers/infiniband/hw/mana/main.c -+++ b/drivers/infiniband/hw/mana/main.c -@@ -327,7 +327,7 @@ int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem, - unsigned int tail = 0; - u64 *page_addr_list; - void *request_buf; -- int err; -+ int err = 0; - - mdev = dev->gdma_dev; - gc = mdev->gdma_context; -diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c -index 9773d2a3d97fb0..ee9acd58c5121f 100644 ---- a/drivers/infiniband/hw/mlx5/cq.c -+++ b/drivers/infiniband/hw/mlx5/cq.c -@@ -487,7 +487,7 @@ static int mlx5_poll_one(struct mlx5_ib_cq *cq, - } - - qpn = ntohl(cqe64->sop_drop_qpn) & 0xffffff; -- if (!*cur_qp || (qpn != (*cur_qp)->ibqp.qp_num)) { -+ if (!*cur_qp || (qpn != (*cur_qp)->trans_qp.base.mqp.qpn)) { - /* We do not have to take the QP table lock here, - * because CQs will be locked while QPs are removed - * from the table. -diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c -index f1a0a324223c0d..7ad5db46ffce79 100644 ---- a/drivers/infiniband/hw/mlx5/odp.c -+++ b/drivers/infiniband/hw/mlx5/odp.c -@@ -274,9 +274,6 @@ static bool mlx5_ib_invalidate_range(struct mmu_interval_notifier *mni, - blk_start_idx = idx; - in_block = 1; - } -- -- /* Count page invalidations */ -- invalidations += idx - blk_start_idx + 1; - } else { - u64 umr_offset = idx & umr_block_mask; - -@@ -286,14 +283,19 @@ static bool mlx5_ib_invalidate_range(struct mmu_interval_notifier *mni, - MLX5_IB_UPD_XLT_ZAP | - MLX5_IB_UPD_XLT_ATOMIC); - in_block = 0; -+ /* Count page invalidations */ -+ invalidations += idx - blk_start_idx + 1; - } - } - } -- if (in_block) -+ if (in_block) { - mlx5r_umr_update_xlt(mr, blk_start_idx, - idx - blk_start_idx + 1, 0, - MLX5_IB_UPD_XLT_ZAP | - MLX5_IB_UPD_XLT_ATOMIC); -+ /* Count page invalidations */ -+ invalidations += idx - blk_start_idx + 1; -+ } - - mlx5_update_odp_stats(mr, invalidations, invalidations); - -diff --git a/drivers/leds/led-core.c b/drivers/leds/led-core.c -index 214ed81eb0e926..136cb7f7469b6c 100644 ---- a/drivers/leds/led-core.c -+++ b/drivers/leds/led-core.c -@@ -147,8 +147,19 @@ static void set_brightness_delayed(struct work_struct *ws) - * before this work item runs once. To make sure this works properly - * handle LED_SET_BRIGHTNESS_OFF first. - */ -- if (test_and_clear_bit(LED_SET_BRIGHTNESS_OFF, &led_cdev->work_flags)) -+ if (test_and_clear_bit(LED_SET_BRIGHTNESS_OFF, &led_cdev->work_flags)) { - set_brightness_delayed_set_brightness(led_cdev, LED_OFF); -+ /* -+ * The consecutives led_set_brightness(LED_OFF), -+ * led_set_brightness(LED_FULL) could have been executed out of -+ * order (LED_FULL first), if the work_flags has been set -+ * between LED_SET_BRIGHTNESS_OFF and LED_SET_BRIGHTNESS of this -+ * work. To avoid ending with the LED turned off, turn the LED -+ * on again. -+ */ -+ if (led_cdev->delayed_set_value != LED_OFF) -+ set_bit(LED_SET_BRIGHTNESS, &led_cdev->work_flags); -+ } - - if (test_and_clear_bit(LED_SET_BRIGHTNESS, &led_cdev->work_flags)) - set_brightness_delayed_set_brightness(led_cdev, led_cdev->delayed_set_value); -@@ -319,10 +330,13 @@ void led_set_brightness_nopm(struct led_classdev *led_cdev, unsigned int value) - * change is done immediately afterwards (before the work runs), - * it uses a separate work_flag. - */ -- if (value) { -- led_cdev->delayed_set_value = value; -+ led_cdev->delayed_set_value = value; -+ /* Ensure delayed_set_value is seen before work_flags modification */ -+ smp_mb__before_atomic(); -+ -+ if (value) - set_bit(LED_SET_BRIGHTNESS, &led_cdev->work_flags); -- } else { -+ else { - clear_bit(LED_SET_BRIGHTNESS, &led_cdev->work_flags); - clear_bit(LED_SET_BLINK, &led_cdev->work_flags); - set_bit(LED_SET_BRIGHTNESS_OFF, &led_cdev->work_flags); -diff --git a/drivers/media/dvb-frontends/dib8000.c b/drivers/media/dvb-frontends/dib8000.c -index 2f5165918163df..cfe59c3255f706 100644 ---- a/drivers/media/dvb-frontends/dib8000.c -+++ b/drivers/media/dvb-frontends/dib8000.c -@@ -2701,8 +2701,11 @@ static void dib8000_set_dds(struct dib8000_state *state, s32 offset_khz) - u8 ratio; - - if (state->revision == 0x8090) { -+ u32 internal = dib8000_read32(state, 23) / 1000; -+ - ratio = 4; -- unit_khz_dds_val = (1<<26) / (dib8000_read32(state, 23) / 1000); -+ -+ unit_khz_dds_val = (1<<26) / (internal ?: 1); - if (offset_khz < 0) - dds = (1 << 26) - (abs_offset_khz * unit_khz_dds_val); - else -diff --git a/drivers/media/platform/allegro-dvt/allegro-core.c b/drivers/media/platform/allegro-dvt/allegro-core.c -index 7dffea2ad88a15..4994a2e65fedc8 100644 ---- a/drivers/media/platform/allegro-dvt/allegro-core.c -+++ b/drivers/media/platform/allegro-dvt/allegro-core.c -@@ -3914,6 +3914,7 @@ static int allegro_probe(struct platform_device *pdev) - if (ret < 0) { - v4l2_err(&dev->v4l2_dev, - "failed to request firmware: %d\n", ret); -+ v4l2_device_unregister(&dev->v4l2_dev); - return ret; - } - -diff --git a/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c b/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c -index a9d4ac84a8d8d4..d1971af5f7fa66 100644 ---- a/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c -+++ b/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c -@@ -517,6 +517,7 @@ static void set_buffers(struct hantro_ctx *ctx) - hantro_reg_write(vpu, &g2_stream_len, src_len); - hantro_reg_write(vpu, &g2_strm_buffer_len, src_buf_len); - hantro_reg_write(vpu, &g2_strm_start_offset, 0); -+ hantro_reg_write(vpu, &g2_start_bit, 0); - hantro_reg_write(vpu, &g2_write_mvs_e, 1); - - hantro_write_addr(vpu, G2_TILE_SIZES_ADDR, ctx->hevc_dec.tile_sizes.dma); -diff --git a/drivers/media/rc/streamzap.c b/drivers/media/rc/streamzap.c -index 9b209e687f256d..2ce62fe5d60f5a 100644 ---- a/drivers/media/rc/streamzap.c -+++ b/drivers/media/rc/streamzap.c -@@ -385,8 +385,8 @@ static void streamzap_disconnect(struct usb_interface *interface) - if (!sz) - return; - -- rc_unregister_device(sz->rdev); - usb_kill_urb(sz->urb_in); -+ rc_unregister_device(sz->rdev); - usb_free_urb(sz->urb_in); - usb_free_coherent(usbdev, sz->buf_in_len, sz->buf_in, sz->dma_in); - -diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c -index d78f73db37c88c..ab0985bb5789a9 100644 ---- a/drivers/memory/omap-gpmc.c -+++ b/drivers/memory/omap-gpmc.c -@@ -2247,26 +2247,6 @@ static int gpmc_probe_generic_child(struct platform_device *pdev, - goto err; - } - -- if (of_node_name_eq(child, "nand")) { -- /* Warn about older DT blobs with no compatible property */ -- if (!of_property_read_bool(child, "compatible")) { -- dev_warn(&pdev->dev, -- "Incompatible NAND node: missing compatible"); -- ret = -EINVAL; -- goto err; -- } -- } -- -- if (of_node_name_eq(child, "onenand")) { -- /* Warn about older DT blobs with no compatible property */ -- if (!of_property_read_bool(child, "compatible")) { -- dev_warn(&pdev->dev, -- "Incompatible OneNAND node: missing compatible"); -- ret = -EINVAL; -- goto err; -- } -- } -- - if (of_match_node(omap_nand_ids, child)) { - /* NAND specific setup */ - val = 8; -diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c -index 28027982cf6939..509dcb226cbfb5 100644 ---- a/drivers/mfd/sm501.c -+++ b/drivers/mfd/sm501.c -@@ -920,7 +920,7 @@ static void sm501_gpio_set(struct gpio_chip *chip, unsigned offset, int value) - { - struct sm501_gpio_chip *smchip = gpiochip_get_data(chip); - struct sm501_gpio *smgpio = smchip->ourgpio; -- unsigned long bit = 1 << offset; -+ unsigned long bit = BIT(offset); - void __iomem *regs = smchip->regbase; - unsigned long save; - unsigned long val; -@@ -946,7 +946,7 @@ static int sm501_gpio_input(struct gpio_chip *chip, unsigned offset) - struct sm501_gpio_chip *smchip = gpiochip_get_data(chip); - struct sm501_gpio *smgpio = smchip->ourgpio; - void __iomem *regs = smchip->regbase; -- unsigned long bit = 1 << offset; -+ unsigned long bit = BIT(offset); - unsigned long save; - unsigned long ddr; - -@@ -971,7 +971,7 @@ static int sm501_gpio_output(struct gpio_chip *chip, - { - struct sm501_gpio_chip *smchip = gpiochip_get_data(chip); - struct sm501_gpio *smgpio = smchip->ourgpio; -- unsigned long bit = 1 << offset; -+ unsigned long bit = BIT(offset); - void __iomem *regs = smchip->regbase; - unsigned long save; - unsigned long val; -diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c -index 13fa8588e38c10..0293a4dbe7e013 100644 ---- a/drivers/mmc/host/omap.c -+++ b/drivers/mmc/host/omap.c -@@ -1276,19 +1276,25 @@ static int mmc_omap_new_slot(struct mmc_omap_host *host, int id) - /* Check for some optional GPIO controls */ - slot->vsd = devm_gpiod_get_index_optional(host->dev, "vsd", - id, GPIOD_OUT_LOW); -- if (IS_ERR(slot->vsd)) -- return dev_err_probe(host->dev, PTR_ERR(slot->vsd), -+ if (IS_ERR(slot->vsd)) { -+ r = dev_err_probe(host->dev, PTR_ERR(slot->vsd), - "error looking up VSD GPIO\n"); -+ goto err_free_host; -+ } - slot->vio = devm_gpiod_get_index_optional(host->dev, "vio", - id, GPIOD_OUT_LOW); -- if (IS_ERR(slot->vio)) -- return dev_err_probe(host->dev, PTR_ERR(slot->vio), -+ if (IS_ERR(slot->vio)) { -+ r = dev_err_probe(host->dev, PTR_ERR(slot->vio), - "error looking up VIO GPIO\n"); -+ goto err_free_host; -+ } - slot->cover = devm_gpiod_get_index_optional(host->dev, "cover", - id, GPIOD_IN); -- if (IS_ERR(slot->cover)) -- return dev_err_probe(host->dev, PTR_ERR(slot->cover), -+ if (IS_ERR(slot->cover)) { -+ r = dev_err_probe(host->dev, PTR_ERR(slot->cover), - "error looking up cover switch GPIO\n"); -+ goto err_free_host; -+ } - - host->slots[id] = slot; - -@@ -1348,6 +1354,7 @@ static int mmc_omap_new_slot(struct mmc_omap_host *host, int id) - device_remove_file(&mmc->class_dev, &dev_attr_slot_name); - err_remove_host: - mmc_remove_host(mmc); -+err_free_host: - mmc_free_host(mmc); - return r; - } -diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c -index 0a26831b3b67d4..713ac30327661e 100644 ---- a/drivers/mmc/host/sdhci-omap.c -+++ b/drivers/mmc/host/sdhci-omap.c -@@ -1339,8 +1339,8 @@ static int sdhci_omap_probe(struct platform_device *pdev) - /* R1B responses is required to properly manage HW busy detection. */ - mmc->caps |= MMC_CAP_NEED_RSP_BUSY; - -- /* Allow card power off and runtime PM for eMMC/SD card devices */ -- mmc->caps |= MMC_CAP_POWER_OFF_CARD | MMC_CAP_AGGRESSIVE_PM; -+ /* Enable SDIO card power off. */ -+ mmc->caps |= MMC_CAP_POWER_OFF_CARD; - - ret = sdhci_setup_host(host); - if (ret) -diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c -index 3af43ac0582552..376fd927ae7386 100644 ---- a/drivers/mmc/host/sdhci-pxav3.c -+++ b/drivers/mmc/host/sdhci-pxav3.c -@@ -399,6 +399,7 @@ static int sdhci_pxav3_probe(struct platform_device *pdev) - if (!IS_ERR(pxa->clk_core)) - clk_prepare_enable(pxa->clk_core); - -+ host->mmc->caps |= MMC_CAP_NEED_RSP_BUSY; - /* enable 1/8V DDR capable */ - host->mmc->caps |= MMC_CAP_1_8V_DDR; - -diff --git a/drivers/net/arcnet/com20020-pci.c b/drivers/net/arcnet/com20020-pci.c -index 7b5c8bb02f1194..e7db6a4e4dc9da 100644 ---- a/drivers/net/arcnet/com20020-pci.c -+++ b/drivers/net/arcnet/com20020-pci.c -@@ -250,18 +250,33 @@ static int com20020pci_probe(struct pci_dev *pdev, - card->tx_led.default_trigger = devm_kasprintf(&pdev->dev, - GFP_KERNEL, "arc%d-%d-tx", - dev->dev_id, i); -+ if (!card->tx_led.default_trigger) { -+ ret = -ENOMEM; -+ goto err_free_arcdev; -+ } - card->tx_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL, - "pci:green:tx:%d-%d", - dev->dev_id, i); -- -+ if (!card->tx_led.name) { -+ ret = -ENOMEM; -+ goto err_free_arcdev; -+ } - card->tx_led.dev = &dev->dev; - card->recon_led.brightness_set = led_recon_set; - card->recon_led.default_trigger = devm_kasprintf(&pdev->dev, - GFP_KERNEL, "arc%d-%d-recon", - dev->dev_id, i); -+ if (!card->recon_led.default_trigger) { -+ ret = -ENOMEM; -+ goto err_free_arcdev; -+ } - card->recon_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL, - "pci:red:recon:%d-%d", - dev->dev_id, i); -+ if (!card->recon_led.name) { -+ ret = -ENOMEM; -+ goto err_free_arcdev; -+ } - card->recon_led.dev = &dev->dev; - - ret = devm_led_classdev_register(&pdev->dev, &card->tx_led); -diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c -index a39b33353ca6c8..8b01ee3e684a38 100644 ---- a/drivers/net/dsa/mv88e6xxx/chip.c -+++ b/drivers/net/dsa/mv88e6xxx/chip.c -@@ -7156,13 +7156,13 @@ static int mv88e6xxx_probe(struct mdio_device *mdiodev) - err = mv88e6xxx_switch_reset(chip); - mv88e6xxx_reg_unlock(chip); - if (err) -- goto out; -+ goto out_phy; - - if (np) { - chip->irq = of_irq_get(np, 0); - if (chip->irq == -EPROBE_DEFER) { - err = chip->irq; -- goto out; -+ goto out_phy; - } - } - -@@ -7181,7 +7181,7 @@ static int mv88e6xxx_probe(struct mdio_device *mdiodev) - mv88e6xxx_reg_unlock(chip); - - if (err) -- goto out; -+ goto out_phy; - - if (chip->info->g2_irqs > 0) { - err = mv88e6xxx_g2_irq_setup(chip); -@@ -7215,6 +7215,8 @@ static int mv88e6xxx_probe(struct mdio_device *mdiodev) - mv88e6xxx_g1_irq_free(chip); - else - mv88e6xxx_irq_poll_free(chip); -+out_phy: -+ mv88e6xxx_phy_destroy(chip); - out: - if (pdata) - dev_put(pdata->netdev); -@@ -7237,7 +7239,6 @@ static void mv88e6xxx_remove(struct mdio_device *mdiodev) - mv88e6xxx_ptp_free(chip); - } - -- mv88e6xxx_phy_destroy(chip); - mv88e6xxx_unregister_switch(chip); - - mv88e6xxx_g1_vtu_prob_irq_free(chip); -@@ -7250,6 +7251,8 @@ static void mv88e6xxx_remove(struct mdio_device *mdiodev) - mv88e6xxx_g1_irq_free(chip); - else - mv88e6xxx_irq_poll_free(chip); -+ -+ mv88e6xxx_phy_destroy(chip); - } - - static void mv88e6xxx_shutdown(struct mdio_device *mdiodev) -diff --git a/drivers/net/dsa/mv88e6xxx/phy.c b/drivers/net/dsa/mv88e6xxx/phy.c -index 8bb88b3d900db3..ee9e5d7e527709 100644 ---- a/drivers/net/dsa/mv88e6xxx/phy.c -+++ b/drivers/net/dsa/mv88e6xxx/phy.c -@@ -229,7 +229,10 @@ static void mv88e6xxx_phy_ppu_state_init(struct mv88e6xxx_chip *chip) - - static void mv88e6xxx_phy_ppu_state_destroy(struct mv88e6xxx_chip *chip) - { -+ mutex_lock(&chip->ppu_mutex); - del_timer_sync(&chip->ppu_timer); -+ cancel_work_sync(&chip->ppu_work); -+ mutex_unlock(&chip->ppu_mutex); - } - - int mv88e6185_phy_ppu_read(struct mv88e6xxx_chip *chip, struct mii_bus *bus, -diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c -index a8d79ee350f8da..a332a0e3154a26 100644 ---- a/drivers/net/ethernet/ibm/ibmveth.c -+++ b/drivers/net/ethernet/ibm/ibmveth.c -@@ -1824,18 +1824,22 @@ static ssize_t veth_pool_store(struct kobject *kobj, struct attribute *attr, - long value = simple_strtol(buf, NULL, 10); - long rc; - -+ rtnl_lock(); -+ - if (attr == &veth_active_attr) { - if (value && !pool->active) { - if (netif_running(netdev)) { - if (ibmveth_alloc_buffer_pool(pool)) { - netdev_err(netdev, - "unable to alloc pool\n"); -- return -ENOMEM; -+ rc = -ENOMEM; -+ goto unlock_err; - } - pool->active = 1; - ibmveth_close(netdev); -- if ((rc = ibmveth_open(netdev))) -- return rc; -+ rc = ibmveth_open(netdev); -+ if (rc) -+ goto unlock_err; - } else { - pool->active = 1; - } -@@ -1855,48 +1859,59 @@ static ssize_t veth_pool_store(struct kobject *kobj, struct attribute *attr, - - if (i == IBMVETH_NUM_BUFF_POOLS) { - netdev_err(netdev, "no active pool >= MTU\n"); -- return -EPERM; -+ rc = -EPERM; -+ goto unlock_err; - } - - if (netif_running(netdev)) { - ibmveth_close(netdev); - pool->active = 0; -- if ((rc = ibmveth_open(netdev))) -- return rc; -+ rc = ibmveth_open(netdev); -+ if (rc) -+ goto unlock_err; - } - pool->active = 0; - } - } else if (attr == &veth_num_attr) { - if (value <= 0 || value > IBMVETH_MAX_POOL_COUNT) { -- return -EINVAL; -+ rc = -EINVAL; -+ goto unlock_err; - } else { - if (netif_running(netdev)) { - ibmveth_close(netdev); - pool->size = value; -- if ((rc = ibmveth_open(netdev))) -- return rc; -+ rc = ibmveth_open(netdev); -+ if (rc) -+ goto unlock_err; - } else { - pool->size = value; - } - } - } else if (attr == &veth_size_attr) { - if (value <= IBMVETH_BUFF_OH || value > IBMVETH_MAX_BUF_SIZE) { -- return -EINVAL; -+ rc = -EINVAL; -+ goto unlock_err; - } else { - if (netif_running(netdev)) { - ibmveth_close(netdev); - pool->buff_size = value; -- if ((rc = ibmveth_open(netdev))) -- return rc; -+ rc = ibmveth_open(netdev); -+ if (rc) -+ goto unlock_err; - } else { - pool->buff_size = value; - } - } - } -+ rtnl_unlock(); - - /* kick the interrupt handler to allocate/deallocate pools */ - ibmveth_interrupt(netdev->irq, netdev); - return count; -+ -+unlock_err: -+ rtnl_unlock(); -+ return rc; - } - - -diff --git a/drivers/net/ethernet/intel/e1000e/defines.h b/drivers/net/ethernet/intel/e1000e/defines.h -index 63c3c79380a1b6..0a35d36c2c8571 100644 ---- a/drivers/net/ethernet/intel/e1000e/defines.h -+++ b/drivers/net/ethernet/intel/e1000e/defines.h -@@ -808,4 +808,7 @@ - /* SerDes Control */ - #define E1000_GEN_POLL_TIMEOUT 640 - -+#define E1000_FEXTNVM12_PHYPD_CTRL_MASK 0x00C00000 -+#define E1000_FEXTNVM12_PHYPD_CTRL_P1 0x00800000 -+ - #endif /* _E1000_DEFINES_H_ */ -diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c -index 2f9655cf5dd9ee..364378133526a1 100644 ---- a/drivers/net/ethernet/intel/e1000e/ich8lan.c -+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c -@@ -285,6 +285,45 @@ static void e1000_toggle_lanphypc_pch_lpt(struct e1000_hw *hw) - } - } - -+/** -+ * e1000_reconfigure_k1_exit_timeout - reconfigure K1 exit timeout to -+ * align to MTP and later platform requirements. -+ * @hw: pointer to the HW structure -+ * -+ * Context: PHY semaphore must be held by caller. -+ * Return: 0 on success, negative on failure -+ */ -+static s32 e1000_reconfigure_k1_exit_timeout(struct e1000_hw *hw) -+{ -+ u16 phy_timeout; -+ u32 fextnvm12; -+ s32 ret_val; -+ -+ if (hw->mac.type < e1000_pch_mtp) -+ return 0; -+ -+ /* Change Kumeran K1 power down state from P0s to P1 */ -+ fextnvm12 = er32(FEXTNVM12); -+ fextnvm12 &= ~E1000_FEXTNVM12_PHYPD_CTRL_MASK; -+ fextnvm12 |= E1000_FEXTNVM12_PHYPD_CTRL_P1; -+ ew32(FEXTNVM12, fextnvm12); -+ -+ /* Wait for the interface the settle */ -+ usleep_range(1000, 1100); -+ -+ /* Change K1 exit timeout */ -+ ret_val = e1e_rphy_locked(hw, I217_PHY_TIMEOUTS_REG, -+ &phy_timeout); -+ if (ret_val) -+ return ret_val; -+ -+ phy_timeout &= ~I217_PHY_TIMEOUTS_K1_EXIT_TO_MASK; -+ phy_timeout |= 0xF00; -+ -+ return e1e_wphy_locked(hw, I217_PHY_TIMEOUTS_REG, -+ phy_timeout); -+} -+ - /** - * e1000_init_phy_workarounds_pchlan - PHY initialization workarounds - * @hw: pointer to the HW structure -@@ -327,15 +366,22 @@ static s32 e1000_init_phy_workarounds_pchlan(struct e1000_hw *hw) - * LANPHYPC Value bit to force the interconnect to PCIe mode. - */ - switch (hw->mac.type) { -+ case e1000_pch_mtp: -+ case e1000_pch_lnp: -+ case e1000_pch_ptp: -+ case e1000_pch_nvp: -+ /* At this point the PHY might be inaccessible so don't -+ * propagate the failure -+ */ -+ if (e1000_reconfigure_k1_exit_timeout(hw)) -+ e_dbg("Failed to reconfigure K1 exit timeout\n"); -+ -+ fallthrough; - case e1000_pch_lpt: - case e1000_pch_spt: - case e1000_pch_cnp: - case e1000_pch_tgp: - case e1000_pch_adp: -- case e1000_pch_mtp: -- case e1000_pch_lnp: -- case e1000_pch_ptp: -- case e1000_pch_nvp: - if (e1000_phy_is_accessible_pchlan(hw)) - break; - -@@ -419,8 +465,20 @@ static s32 e1000_init_phy_workarounds_pchlan(struct e1000_hw *hw) - * the PHY is in. - */ - ret_val = hw->phy.ops.check_reset_block(hw); -- if (ret_val) -+ if (ret_val) { - e_err("ME blocked access to PHY after reset\n"); -+ goto out; -+ } -+ -+ if (hw->mac.type >= e1000_pch_mtp) { -+ ret_val = hw->phy.ops.acquire(hw); -+ if (ret_val) { -+ e_err("Failed to reconfigure K1 exit timeout\n"); -+ goto out; -+ } -+ ret_val = e1000_reconfigure_k1_exit_timeout(hw); -+ hw->phy.ops.release(hw); -+ } - } - - out: -@@ -4888,6 +4946,18 @@ static s32 e1000_init_hw_ich8lan(struct e1000_hw *hw) - u16 i; - - e1000_initialize_hw_bits_ich8lan(hw); -+ if (hw->mac.type >= e1000_pch_mtp) { -+ ret_val = hw->phy.ops.acquire(hw); -+ if (ret_val) -+ return ret_val; -+ -+ ret_val = e1000_reconfigure_k1_exit_timeout(hw); -+ hw->phy.ops.release(hw); -+ if (ret_val) { -+ e_dbg("Error failed to reconfigure K1 exit timeout\n"); -+ return ret_val; -+ } -+ } - - /* Initialize identification LED */ - ret_val = mac->ops.id_led_init(hw); -diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h -index 2504b11c3169fa..5feb589a9b5ff2 100644 ---- a/drivers/net/ethernet/intel/e1000e/ich8lan.h -+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h -@@ -219,6 +219,10 @@ - #define I217_PLL_CLOCK_GATE_REG PHY_REG(772, 28) - #define I217_PLL_CLOCK_GATE_MASK 0x07FF - -+/* PHY Timeouts */ -+#define I217_PHY_TIMEOUTS_REG PHY_REG(770, 21) -+#define I217_PHY_TIMEOUTS_K1_EXIT_TO_MASK 0x0FC0 -+ - #define SW_FLAG_TIMEOUT 1000 /* SW Semaphore flag timeout in ms */ - - /* Inband Control */ -diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h -index 9e02e4367bec81..9bd3d76b5fe2ac 100644 ---- a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h -+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h -@@ -1108,6 +1108,9 @@ struct mvpp2 { - - /* Spinlocks for CM3 shared memory configuration */ - spinlock_t mss_spinlock; -+ -+ /* Spinlock for shared PRS parser memory and shadow table */ -+ spinlock_t prs_spinlock; - }; - - struct mvpp2_pcpu_stats { -diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c -index 34051c9abd97df..fce57faf345ce4 100644 ---- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c -+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c -@@ -7615,8 +7615,9 @@ static int mvpp2_probe(struct platform_device *pdev) - if (mvpp2_read(priv, MVPP2_VER_ID_REG) == MVPP2_VER_PP23) - priv->hw_version = MVPP23; - -- /* Init mss lock */ -+ /* Init locks for shared packet processor resources */ - spin_lock_init(&priv->mss_spinlock); -+ spin_lock_init(&priv->prs_spinlock); - - /* Initialize network controller */ - err = mvpp2_init(pdev, priv); -diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c -index 9af22f497a40f5..93e978bdf303c4 100644 ---- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c -+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c -@@ -23,6 +23,8 @@ static int mvpp2_prs_hw_write(struct mvpp2 *priv, struct mvpp2_prs_entry *pe) - { - int i; - -+ lockdep_assert_held(&priv->prs_spinlock); -+ - if (pe->index > MVPP2_PRS_TCAM_SRAM_SIZE - 1) - return -EINVAL; - -@@ -43,11 +45,13 @@ static int mvpp2_prs_hw_write(struct mvpp2 *priv, struct mvpp2_prs_entry *pe) - } - - /* Initialize tcam entry from hw */ --int mvpp2_prs_init_from_hw(struct mvpp2 *priv, struct mvpp2_prs_entry *pe, -- int tid) -+static int __mvpp2_prs_init_from_hw(struct mvpp2 *priv, -+ struct mvpp2_prs_entry *pe, int tid) - { - int i; - -+ lockdep_assert_held(&priv->prs_spinlock); -+ - if (tid > MVPP2_PRS_TCAM_SRAM_SIZE - 1) - return -EINVAL; - -@@ -73,6 +77,18 @@ int mvpp2_prs_init_from_hw(struct mvpp2 *priv, struct mvpp2_prs_entry *pe, - return 0; - } - -+int mvpp2_prs_init_from_hw(struct mvpp2 *priv, struct mvpp2_prs_entry *pe, -+ int tid) -+{ -+ int err; -+ -+ spin_lock_bh(&priv->prs_spinlock); -+ err = __mvpp2_prs_init_from_hw(priv, pe, tid); -+ spin_unlock_bh(&priv->prs_spinlock); -+ -+ return err; -+} -+ - /* Invalidate tcam hw entry */ - static void mvpp2_prs_hw_inv(struct mvpp2 *priv, int index) - { -@@ -374,7 +390,7 @@ static int mvpp2_prs_flow_find(struct mvpp2 *priv, int flow) - priv->prs_shadow[tid].lu != MVPP2_PRS_LU_FLOWS) - continue; - -- mvpp2_prs_init_from_hw(priv, &pe, tid); -+ __mvpp2_prs_init_from_hw(priv, &pe, tid); - bits = mvpp2_prs_sram_ai_get(&pe); - - /* Sram store classification lookup ID in AI bits [5:0] */ -@@ -441,7 +457,7 @@ static void mvpp2_prs_mac_drop_all_set(struct mvpp2 *priv, int port, bool add) - - if (priv->prs_shadow[MVPP2_PE_DROP_ALL].valid) { - /* Entry exist - update port only */ -- mvpp2_prs_init_from_hw(priv, &pe, MVPP2_PE_DROP_ALL); -+ __mvpp2_prs_init_from_hw(priv, &pe, MVPP2_PE_DROP_ALL); - } else { - /* Entry doesn't exist - create new */ - memset(&pe, 0, sizeof(pe)); -@@ -469,14 +485,17 @@ static void mvpp2_prs_mac_drop_all_set(struct mvpp2 *priv, int port, bool add) - } - - /* Set port to unicast or multicast promiscuous mode */ --void mvpp2_prs_mac_promisc_set(struct mvpp2 *priv, int port, -- enum mvpp2_prs_l2_cast l2_cast, bool add) -+static void __mvpp2_prs_mac_promisc_set(struct mvpp2 *priv, int port, -+ enum mvpp2_prs_l2_cast l2_cast, -+ bool add) - { - struct mvpp2_prs_entry pe; - unsigned char cast_match; - unsigned int ri; - int tid; - -+ lockdep_assert_held(&priv->prs_spinlock); -+ - if (l2_cast == MVPP2_PRS_L2_UNI_CAST) { - cast_match = MVPP2_PRS_UCAST_VAL; - tid = MVPP2_PE_MAC_UC_PROMISCUOUS; -@@ -489,7 +508,7 @@ void mvpp2_prs_mac_promisc_set(struct mvpp2 *priv, int port, - - /* promiscuous mode - Accept unknown unicast or multicast packets */ - if (priv->prs_shadow[tid].valid) { -- mvpp2_prs_init_from_hw(priv, &pe, tid); -+ __mvpp2_prs_init_from_hw(priv, &pe, tid); - } else { - memset(&pe, 0, sizeof(pe)); - mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_MAC); -@@ -522,6 +541,14 @@ void mvpp2_prs_mac_promisc_set(struct mvpp2 *priv, int port, - mvpp2_prs_hw_write(priv, &pe); - } - -+void mvpp2_prs_mac_promisc_set(struct mvpp2 *priv, int port, -+ enum mvpp2_prs_l2_cast l2_cast, bool add) -+{ -+ spin_lock_bh(&priv->prs_spinlock); -+ __mvpp2_prs_mac_promisc_set(priv, port, l2_cast, add); -+ spin_unlock_bh(&priv->prs_spinlock); -+} -+ - /* Set entry for dsa packets */ - static void mvpp2_prs_dsa_tag_set(struct mvpp2 *priv, int port, bool add, - bool tagged, bool extend) -@@ -539,7 +566,7 @@ static void mvpp2_prs_dsa_tag_set(struct mvpp2 *priv, int port, bool add, - - if (priv->prs_shadow[tid].valid) { - /* Entry exist - update port only */ -- mvpp2_prs_init_from_hw(priv, &pe, tid); -+ __mvpp2_prs_init_from_hw(priv, &pe, tid); - } else { - /* Entry doesn't exist - create new */ - memset(&pe, 0, sizeof(pe)); -@@ -610,7 +637,7 @@ static void mvpp2_prs_dsa_tag_ethertype_set(struct mvpp2 *priv, int port, - - if (priv->prs_shadow[tid].valid) { - /* Entry exist - update port only */ -- mvpp2_prs_init_from_hw(priv, &pe, tid); -+ __mvpp2_prs_init_from_hw(priv, &pe, tid); - } else { - /* Entry doesn't exist - create new */ - memset(&pe, 0, sizeof(pe)); -@@ -673,7 +700,7 @@ static int mvpp2_prs_vlan_find(struct mvpp2 *priv, unsigned short tpid, int ai) - priv->prs_shadow[tid].lu != MVPP2_PRS_LU_VLAN) - continue; - -- mvpp2_prs_init_from_hw(priv, &pe, tid); -+ __mvpp2_prs_init_from_hw(priv, &pe, tid); - match = mvpp2_prs_tcam_data_cmp(&pe, 0, tpid); - if (!match) - continue; -@@ -726,7 +753,7 @@ static int mvpp2_prs_vlan_add(struct mvpp2 *priv, unsigned short tpid, int ai, - priv->prs_shadow[tid_aux].lu != MVPP2_PRS_LU_VLAN) - continue; - -- mvpp2_prs_init_from_hw(priv, &pe, tid_aux); -+ __mvpp2_prs_init_from_hw(priv, &pe, tid_aux); - ri_bits = mvpp2_prs_sram_ri_get(&pe); - if ((ri_bits & MVPP2_PRS_RI_VLAN_MASK) == - MVPP2_PRS_RI_VLAN_DOUBLE) -@@ -760,7 +787,7 @@ static int mvpp2_prs_vlan_add(struct mvpp2 *priv, unsigned short tpid, int ai, - - mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_VLAN); - } else { -- mvpp2_prs_init_from_hw(priv, &pe, tid); -+ __mvpp2_prs_init_from_hw(priv, &pe, tid); - } - /* Update ports' mask */ - mvpp2_prs_tcam_port_map_set(&pe, port_map); -@@ -800,7 +827,7 @@ static int mvpp2_prs_double_vlan_find(struct mvpp2 *priv, unsigned short tpid1, - priv->prs_shadow[tid].lu != MVPP2_PRS_LU_VLAN) - continue; - -- mvpp2_prs_init_from_hw(priv, &pe, tid); -+ __mvpp2_prs_init_from_hw(priv, &pe, tid); - - match = mvpp2_prs_tcam_data_cmp(&pe, 0, tpid1) && - mvpp2_prs_tcam_data_cmp(&pe, 4, tpid2); -@@ -849,7 +876,7 @@ static int mvpp2_prs_double_vlan_add(struct mvpp2 *priv, unsigned short tpid1, - priv->prs_shadow[tid_aux].lu != MVPP2_PRS_LU_VLAN) - continue; - -- mvpp2_prs_init_from_hw(priv, &pe, tid_aux); -+ __mvpp2_prs_init_from_hw(priv, &pe, tid_aux); - ri_bits = mvpp2_prs_sram_ri_get(&pe); - ri_bits &= MVPP2_PRS_RI_VLAN_MASK; - if (ri_bits == MVPP2_PRS_RI_VLAN_SINGLE || -@@ -880,7 +907,7 @@ static int mvpp2_prs_double_vlan_add(struct mvpp2 *priv, unsigned short tpid1, - - mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_VLAN); - } else { -- mvpp2_prs_init_from_hw(priv, &pe, tid); -+ __mvpp2_prs_init_from_hw(priv, &pe, tid); - } - - /* Update ports' mask */ -@@ -1213,8 +1240,8 @@ static void mvpp2_prs_mac_init(struct mvpp2 *priv) - /* Create dummy entries for drop all and promiscuous modes */ - mvpp2_prs_drop_fc(priv); - mvpp2_prs_mac_drop_all_set(priv, 0, false); -- mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_UNI_CAST, false); -- mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_MULTI_CAST, false); -+ __mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_UNI_CAST, false); -+ __mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_MULTI_CAST, false); - } - - /* Set default entries for various types of dsa packets */ -@@ -1533,12 +1560,6 @@ static int mvpp2_prs_vlan_init(struct platform_device *pdev, struct mvpp2 *priv) - struct mvpp2_prs_entry pe; - int err; - -- priv->prs_double_vlans = devm_kcalloc(&pdev->dev, sizeof(bool), -- MVPP2_PRS_DBL_VLANS_MAX, -- GFP_KERNEL); -- if (!priv->prs_double_vlans) -- return -ENOMEM; -- - /* Double VLAN: 0x88A8, 0x8100 */ - err = mvpp2_prs_double_vlan_add(priv, ETH_P_8021AD, ETH_P_8021Q, - MVPP2_PRS_PORT_MASK); -@@ -1941,7 +1962,7 @@ static int mvpp2_prs_vid_range_find(struct mvpp2_port *port, u16 vid, u16 mask) - port->priv->prs_shadow[tid].lu != MVPP2_PRS_LU_VID) - continue; - -- mvpp2_prs_init_from_hw(port->priv, &pe, tid); -+ __mvpp2_prs_init_from_hw(port->priv, &pe, tid); - - mvpp2_prs_tcam_data_byte_get(&pe, 2, &byte[0], &enable[0]); - mvpp2_prs_tcam_data_byte_get(&pe, 3, &byte[1], &enable[1]); -@@ -1970,6 +1991,8 @@ int mvpp2_prs_vid_entry_add(struct mvpp2_port *port, u16 vid) - - memset(&pe, 0, sizeof(pe)); - -+ spin_lock_bh(&priv->prs_spinlock); -+ - /* Scan TCAM and see if entry with this already exist */ - tid = mvpp2_prs_vid_range_find(port, vid, mask); - -@@ -1988,8 +2011,10 @@ int mvpp2_prs_vid_entry_add(struct mvpp2_port *port, u16 vid) - MVPP2_PRS_VLAN_FILT_MAX_ENTRY); - - /* There isn't room for a new VID filter */ -- if (tid < 0) -+ if (tid < 0) { -+ spin_unlock_bh(&priv->prs_spinlock); - return tid; -+ } - - mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_VID); - pe.index = tid; -@@ -1997,7 +2022,7 @@ int mvpp2_prs_vid_entry_add(struct mvpp2_port *port, u16 vid) - /* Mask all ports */ - mvpp2_prs_tcam_port_map_set(&pe, 0); - } else { -- mvpp2_prs_init_from_hw(priv, &pe, tid); -+ __mvpp2_prs_init_from_hw(priv, &pe, tid); - } - - /* Enable the current port */ -@@ -2019,6 +2044,7 @@ int mvpp2_prs_vid_entry_add(struct mvpp2_port *port, u16 vid) - mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_VID); - mvpp2_prs_hw_write(priv, &pe); - -+ spin_unlock_bh(&priv->prs_spinlock); - return 0; - } - -@@ -2028,15 +2054,16 @@ void mvpp2_prs_vid_entry_remove(struct mvpp2_port *port, u16 vid) - struct mvpp2 *priv = port->priv; - int tid; - -- /* Scan TCAM and see if entry with this already exist */ -- tid = mvpp2_prs_vid_range_find(port, vid, 0xfff); -+ spin_lock_bh(&priv->prs_spinlock); - -- /* No such entry */ -- if (tid < 0) -- return; -+ /* Invalidate TCAM entry with this , if it exists */ -+ tid = mvpp2_prs_vid_range_find(port, vid, 0xfff); -+ if (tid >= 0) { -+ mvpp2_prs_hw_inv(priv, tid); -+ priv->prs_shadow[tid].valid = false; -+ } - -- mvpp2_prs_hw_inv(priv, tid); -- priv->prs_shadow[tid].valid = false; -+ spin_unlock_bh(&priv->prs_spinlock); - } - - /* Remove all existing VID filters on this port */ -@@ -2045,6 +2072,8 @@ void mvpp2_prs_vid_remove_all(struct mvpp2_port *port) - struct mvpp2 *priv = port->priv; - int tid; - -+ spin_lock_bh(&priv->prs_spinlock); -+ - for (tid = MVPP2_PRS_VID_PORT_FIRST(port->id); - tid <= MVPP2_PRS_VID_PORT_LAST(port->id); tid++) { - if (priv->prs_shadow[tid].valid) { -@@ -2052,6 +2081,8 @@ void mvpp2_prs_vid_remove_all(struct mvpp2_port *port) - priv->prs_shadow[tid].valid = false; - } - } -+ -+ spin_unlock_bh(&priv->prs_spinlock); - } - - /* Remove VID filering entry for this port */ -@@ -2060,10 +2091,14 @@ void mvpp2_prs_vid_disable_filtering(struct mvpp2_port *port) - unsigned int tid = MVPP2_PRS_VID_PORT_DFLT(port->id); - struct mvpp2 *priv = port->priv; - -+ spin_lock_bh(&priv->prs_spinlock); -+ - /* Invalidate the guard entry */ - mvpp2_prs_hw_inv(priv, tid); - - priv->prs_shadow[tid].valid = false; -+ -+ spin_unlock_bh(&priv->prs_spinlock); - } - - /* Add guard entry that drops packets when no VID is matched on this port */ -@@ -2079,6 +2114,8 @@ void mvpp2_prs_vid_enable_filtering(struct mvpp2_port *port) - - memset(&pe, 0, sizeof(pe)); - -+ spin_lock_bh(&priv->prs_spinlock); -+ - pe.index = tid; - - reg_val = mvpp2_read(priv, MVPP2_MH_REG(port->id)); -@@ -2111,6 +2148,8 @@ void mvpp2_prs_vid_enable_filtering(struct mvpp2_port *port) - /* Update shadow table */ - mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_VID); - mvpp2_prs_hw_write(priv, &pe); -+ -+ spin_unlock_bh(&priv->prs_spinlock); - } - - /* Parser default initialization */ -@@ -2118,6 +2157,20 @@ int mvpp2_prs_default_init(struct platform_device *pdev, struct mvpp2 *priv) - { - int err, index, i; - -+ priv->prs_shadow = devm_kcalloc(&pdev->dev, MVPP2_PRS_TCAM_SRAM_SIZE, -+ sizeof(*priv->prs_shadow), -+ GFP_KERNEL); -+ if (!priv->prs_shadow) -+ return -ENOMEM; -+ -+ priv->prs_double_vlans = devm_kcalloc(&pdev->dev, sizeof(bool), -+ MVPP2_PRS_DBL_VLANS_MAX, -+ GFP_KERNEL); -+ if (!priv->prs_double_vlans) -+ return -ENOMEM; -+ -+ spin_lock_bh(&priv->prs_spinlock); -+ - /* Enable tcam table */ - mvpp2_write(priv, MVPP2_PRS_TCAM_CTRL_REG, MVPP2_PRS_TCAM_EN_MASK); - -@@ -2136,12 +2189,6 @@ int mvpp2_prs_default_init(struct platform_device *pdev, struct mvpp2 *priv) - for (index = 0; index < MVPP2_PRS_TCAM_SRAM_SIZE; index++) - mvpp2_prs_hw_inv(priv, index); - -- priv->prs_shadow = devm_kcalloc(&pdev->dev, MVPP2_PRS_TCAM_SRAM_SIZE, -- sizeof(*priv->prs_shadow), -- GFP_KERNEL); -- if (!priv->prs_shadow) -- return -ENOMEM; -- - /* Always start from lookup = 0 */ - for (index = 0; index < MVPP2_MAX_PORTS; index++) - mvpp2_prs_hw_port_init(priv, index, MVPP2_PRS_LU_MH, -@@ -2158,26 +2205,13 @@ int mvpp2_prs_default_init(struct platform_device *pdev, struct mvpp2 *priv) - mvpp2_prs_vid_init(priv); - - err = mvpp2_prs_etype_init(priv); -- if (err) -- return err; -- -- err = mvpp2_prs_vlan_init(pdev, priv); -- if (err) -- return err; -- -- err = mvpp2_prs_pppoe_init(priv); -- if (err) -- return err; -- -- err = mvpp2_prs_ip6_init(priv); -- if (err) -- return err; -- -- err = mvpp2_prs_ip4_init(priv); -- if (err) -- return err; -+ err = err ? : mvpp2_prs_vlan_init(pdev, priv); -+ err = err ? : mvpp2_prs_pppoe_init(priv); -+ err = err ? : mvpp2_prs_ip6_init(priv); -+ err = err ? : mvpp2_prs_ip4_init(priv); - -- return 0; -+ spin_unlock_bh(&priv->prs_spinlock); -+ return err; - } - - /* Compare MAC DA with tcam entry data */ -@@ -2217,7 +2251,7 @@ mvpp2_prs_mac_da_range_find(struct mvpp2 *priv, int pmap, const u8 *da, - (priv->prs_shadow[tid].udf != udf_type)) - continue; - -- mvpp2_prs_init_from_hw(priv, &pe, tid); -+ __mvpp2_prs_init_from_hw(priv, &pe, tid); - entry_pmap = mvpp2_prs_tcam_port_map_get(&pe); - - if (mvpp2_prs_mac_range_equals(&pe, da, mask) && -@@ -2229,7 +2263,8 @@ mvpp2_prs_mac_da_range_find(struct mvpp2 *priv, int pmap, const u8 *da, - } - - /* Update parser's mac da entry */ --int mvpp2_prs_mac_da_accept(struct mvpp2_port *port, const u8 *da, bool add) -+static int __mvpp2_prs_mac_da_accept(struct mvpp2_port *port, -+ const u8 *da, bool add) - { - unsigned char mask[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; - struct mvpp2 *priv = port->priv; -@@ -2261,7 +2296,7 @@ int mvpp2_prs_mac_da_accept(struct mvpp2_port *port, const u8 *da, bool add) - /* Mask all ports */ - mvpp2_prs_tcam_port_map_set(&pe, 0); - } else { -- mvpp2_prs_init_from_hw(priv, &pe, tid); -+ __mvpp2_prs_init_from_hw(priv, &pe, tid); - } - - mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_MAC); -@@ -2317,6 +2352,17 @@ int mvpp2_prs_mac_da_accept(struct mvpp2_port *port, const u8 *da, bool add) - return 0; - } - -+int mvpp2_prs_mac_da_accept(struct mvpp2_port *port, const u8 *da, bool add) -+{ -+ int err; -+ -+ spin_lock_bh(&port->priv->prs_spinlock); -+ err = __mvpp2_prs_mac_da_accept(port, da, add); -+ spin_unlock_bh(&port->priv->prs_spinlock); -+ -+ return err; -+} -+ - int mvpp2_prs_update_mac_da(struct net_device *dev, const u8 *da) - { - struct mvpp2_port *port = netdev_priv(dev); -@@ -2345,6 +2391,8 @@ void mvpp2_prs_mac_del_all(struct mvpp2_port *port) - unsigned long pmap; - int index, tid; - -+ spin_lock_bh(&priv->prs_spinlock); -+ - for (tid = MVPP2_PE_MAC_RANGE_START; - tid <= MVPP2_PE_MAC_RANGE_END; tid++) { - unsigned char da[ETH_ALEN], da_mask[ETH_ALEN]; -@@ -2354,7 +2402,7 @@ void mvpp2_prs_mac_del_all(struct mvpp2_port *port) - (priv->prs_shadow[tid].udf != MVPP2_PRS_UDF_MAC_DEF)) - continue; - -- mvpp2_prs_init_from_hw(priv, &pe, tid); -+ __mvpp2_prs_init_from_hw(priv, &pe, tid); - - pmap = mvpp2_prs_tcam_port_map_get(&pe); - -@@ -2375,14 +2423,17 @@ void mvpp2_prs_mac_del_all(struct mvpp2_port *port) - continue; - - /* Remove entry from TCAM */ -- mvpp2_prs_mac_da_accept(port, da, false); -+ __mvpp2_prs_mac_da_accept(port, da, false); - } -+ -+ spin_unlock_bh(&priv->prs_spinlock); - } - - int mvpp2_prs_tag_mode_set(struct mvpp2 *priv, int port, int type) - { - switch (type) { - case MVPP2_TAG_TYPE_EDSA: -+ spin_lock_bh(&priv->prs_spinlock); - /* Add port to EDSA entries */ - mvpp2_prs_dsa_tag_set(priv, port, true, - MVPP2_PRS_TAGGED, MVPP2_PRS_EDSA); -@@ -2393,9 +2444,11 @@ int mvpp2_prs_tag_mode_set(struct mvpp2 *priv, int port, int type) - MVPP2_PRS_TAGGED, MVPP2_PRS_DSA); - mvpp2_prs_dsa_tag_set(priv, port, false, - MVPP2_PRS_UNTAGGED, MVPP2_PRS_DSA); -+ spin_unlock_bh(&priv->prs_spinlock); - break; - - case MVPP2_TAG_TYPE_DSA: -+ spin_lock_bh(&priv->prs_spinlock); - /* Add port to DSA entries */ - mvpp2_prs_dsa_tag_set(priv, port, true, - MVPP2_PRS_TAGGED, MVPP2_PRS_DSA); -@@ -2406,10 +2459,12 @@ int mvpp2_prs_tag_mode_set(struct mvpp2 *priv, int port, int type) - MVPP2_PRS_TAGGED, MVPP2_PRS_EDSA); - mvpp2_prs_dsa_tag_set(priv, port, false, - MVPP2_PRS_UNTAGGED, MVPP2_PRS_EDSA); -+ spin_unlock_bh(&priv->prs_spinlock); - break; - - case MVPP2_TAG_TYPE_MH: - case MVPP2_TAG_TYPE_NONE: -+ spin_lock_bh(&priv->prs_spinlock); - /* Remove port form EDSA and DSA entries */ - mvpp2_prs_dsa_tag_set(priv, port, false, - MVPP2_PRS_TAGGED, MVPP2_PRS_DSA); -@@ -2419,6 +2474,7 @@ int mvpp2_prs_tag_mode_set(struct mvpp2 *priv, int port, int type) - MVPP2_PRS_TAGGED, MVPP2_PRS_EDSA); - mvpp2_prs_dsa_tag_set(priv, port, false, - MVPP2_PRS_UNTAGGED, MVPP2_PRS_EDSA); -+ spin_unlock_bh(&priv->prs_spinlock); - break; - - default: -@@ -2437,11 +2493,15 @@ int mvpp2_prs_add_flow(struct mvpp2 *priv, int flow, u32 ri, u32 ri_mask) - - memset(&pe, 0, sizeof(pe)); - -+ spin_lock_bh(&priv->prs_spinlock); -+ - tid = mvpp2_prs_tcam_first_free(priv, - MVPP2_PE_LAST_FREE_TID, - MVPP2_PE_FIRST_FREE_TID); -- if (tid < 0) -+ if (tid < 0) { -+ spin_unlock_bh(&priv->prs_spinlock); - return tid; -+ } - - pe.index = tid; - -@@ -2461,6 +2521,7 @@ int mvpp2_prs_add_flow(struct mvpp2 *priv, int flow, u32 ri, u32 ri_mask) - mvpp2_prs_tcam_port_map_set(&pe, MVPP2_PRS_PORT_MASK); - mvpp2_prs_hw_write(priv, &pe); - -+ spin_unlock_bh(&priv->prs_spinlock); - return 0; - } - -@@ -2472,6 +2533,8 @@ int mvpp2_prs_def_flow(struct mvpp2_port *port) - - memset(&pe, 0, sizeof(pe)); - -+ spin_lock_bh(&port->priv->prs_spinlock); -+ - tid = mvpp2_prs_flow_find(port->priv, port->id); - - /* Such entry not exist */ -@@ -2480,8 +2543,10 @@ int mvpp2_prs_def_flow(struct mvpp2_port *port) - tid = mvpp2_prs_tcam_first_free(port->priv, - MVPP2_PE_LAST_FREE_TID, - MVPP2_PE_FIRST_FREE_TID); -- if (tid < 0) -+ if (tid < 0) { -+ spin_unlock_bh(&port->priv->prs_spinlock); - return tid; -+ } - - pe.index = tid; - -@@ -2492,13 +2557,14 @@ int mvpp2_prs_def_flow(struct mvpp2_port *port) - /* Update shadow table */ - mvpp2_prs_shadow_set(port->priv, pe.index, MVPP2_PRS_LU_FLOWS); - } else { -- mvpp2_prs_init_from_hw(port->priv, &pe, tid); -+ __mvpp2_prs_init_from_hw(port->priv, &pe, tid); - } - - mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_FLOWS); - mvpp2_prs_tcam_port_map_set(&pe, (1 << port->id)); - mvpp2_prs_hw_write(port->priv, &pe); - -+ spin_unlock_bh(&port->priv->prs_spinlock); - return 0; - } - -@@ -2509,11 +2575,14 @@ int mvpp2_prs_hits(struct mvpp2 *priv, int index) - if (index > MVPP2_PRS_TCAM_SRAM_SIZE) - return -EINVAL; - -+ spin_lock_bh(&priv->prs_spinlock); -+ - mvpp2_write(priv, MVPP2_PRS_TCAM_HIT_IDX_REG, index); - - val = mvpp2_read(priv, MVPP2_PRS_TCAM_HIT_CNT_REG); - - val &= MVPP2_PRS_TCAM_HIT_CNT_MASK; - -+ spin_unlock_bh(&priv->prs_spinlock); - return val; - } -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c -index 5241737222236a..67e6d755b30ecf 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c -@@ -2563,7 +2563,7 @@ static irqreturn_t rvu_mbox_intr_handler(int irq, void *rvu_irq) - rvupf_write64(rvu, RVU_PF_VFPF_MBOX_INTX(1), intr); - - rvu_queue_work(&rvu->afvf_wq_info, 64, vfs, intr); -- vfs -= 64; -+ vfs = 64; - } - - intr = rvupf_read64(rvu, RVU_PF_VFPF_MBOX_INTX(0)); -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c -index bffe04e6d0254a..774d8b034725d6 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c -@@ -217,7 +217,7 @@ static void rvu_nix_unregister_interrupts(struct rvu *rvu) - rvu->irq_allocated[offs + NIX_AF_INT_VEC_RVU] = false; - } - -- for (i = NIX_AF_INT_VEC_AF_ERR; i < NIX_AF_INT_VEC_CNT; i++) -+ for (i = NIX_AF_INT_VEC_GEN; i < NIX_AF_INT_VEC_CNT; i++) - if (rvu->irq_allocated[offs + i]) { - free_irq(pci_irq_vector(rvu->pdev, offs + i), rvu_dl); - rvu->irq_allocated[offs + i] = false; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -index 30507b7c2fb179..775010e94cb7c6 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -@@ -408,7 +408,7 @@ u8 mlx5e_shampo_get_log_pkt_per_rsrv(struct mlx5_core_dev *mdev, - struct mlx5e_params *params) - { - u32 resrv_size = BIT(mlx5e_shampo_get_log_rsrv_size(mdev, params)) * -- PAGE_SIZE; -+ MLX5E_SHAMPO_WQ_BASE_RESRV_SIZE; - - return order_base_2(DIV_ROUND_UP(resrv_size, params->sw_mtu)); - } -@@ -881,7 +881,8 @@ static u32 mlx5e_shampo_get_log_cq_size(struct mlx5_core_dev *mdev, - struct mlx5e_params *params, - struct mlx5e_xsk_param *xsk) - { -- int rsrv_size = BIT(mlx5e_shampo_get_log_rsrv_size(mdev, params)) * PAGE_SIZE; -+ int rsrv_size = BIT(mlx5e_shampo_get_log_rsrv_size(mdev, params)) * -+ MLX5E_SHAMPO_WQ_BASE_RESRV_SIZE; - u16 num_strides = BIT(mlx5e_mpwqe_get_log_num_strides(mdev, params, xsk)); - int pkt_per_rsrv = BIT(mlx5e_shampo_get_log_pkt_per_rsrv(mdev, params)); - u8 log_stride_sz = mlx5e_mpwqe_get_log_stride_size(mdev, params, xsk); -@@ -1094,7 +1095,8 @@ u32 mlx5e_shampo_hd_per_wqe(struct mlx5_core_dev *mdev, - struct mlx5e_params *params, - struct mlx5e_rq_param *rq_param) - { -- int resv_size = BIT(mlx5e_shampo_get_log_rsrv_size(mdev, params)) * PAGE_SIZE; -+ int resv_size = BIT(mlx5e_shampo_get_log_rsrv_size(mdev, params)) * -+ MLX5E_SHAMPO_WQ_BASE_RESRV_SIZE; - u16 num_strides = BIT(mlx5e_mpwqe_get_log_num_strides(mdev, params, NULL)); - int pkt_per_resv = BIT(mlx5e_shampo_get_log_pkt_per_rsrv(mdev, params)); - u8 log_stride_sz = mlx5e_mpwqe_get_log_stride_size(mdev, params, NULL); -diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c -index 7b3739b29c8f72..bb0bf141587274 100644 ---- a/drivers/net/usb/rndis_host.c -+++ b/drivers/net/usb/rndis_host.c -@@ -630,6 +630,16 @@ static const struct driver_info zte_rndis_info = { - .tx_fixup = rndis_tx_fixup, - }; - -+static const struct driver_info wwan_rndis_info = { -+ .description = "Mobile Broadband RNDIS device", -+ .flags = FLAG_WWAN | FLAG_POINTTOPOINT | FLAG_FRAMING_RN | FLAG_NO_SETINT, -+ .bind = rndis_bind, -+ .unbind = rndis_unbind, -+ .status = rndis_status, -+ .rx_fixup = rndis_rx_fixup, -+ .tx_fixup = rndis_tx_fixup, -+}; -+ - /*-------------------------------------------------------------------------*/ - - static const struct usb_device_id products [] = { -@@ -666,9 +676,11 @@ static const struct usb_device_id products [] = { - USB_INTERFACE_INFO(USB_CLASS_WIRELESS_CONTROLLER, 1, 3), - .driver_info = (unsigned long) &rndis_info, - }, { -- /* Novatel Verizon USB730L */ -+ /* Mobile Broadband Modem, seen in Novatel Verizon USB730L and -+ * Telit FN990A (RNDIS) -+ */ - USB_INTERFACE_INFO(USB_CLASS_MISC, 4, 1), -- .driver_info = (unsigned long) &rndis_info, -+ .driver_info = (unsigned long)&wwan_rndis_info, - }, - { }, // END - }; -diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c -index 08cbc8e4b361df..ac0458b96738c1 100644 ---- a/drivers/net/usb/usbnet.c -+++ b/drivers/net/usb/usbnet.c -@@ -530,7 +530,8 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags) - netif_device_present (dev->net) && - test_bit(EVENT_DEV_OPEN, &dev->flags) && - !test_bit (EVENT_RX_HALT, &dev->flags) && -- !test_bit (EVENT_DEV_ASLEEP, &dev->flags)) { -+ !test_bit (EVENT_DEV_ASLEEP, &dev->flags) && -+ !usbnet_going_away(dev)) { - switch (retval = usb_submit_urb (urb, GFP_ATOMIC)) { - case -EPIPE: - usbnet_defer_kevent (dev, EVENT_RX_HALT); -@@ -551,8 +552,7 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags) - tasklet_schedule (&dev->bh); - break; - case 0: -- if (!usbnet_going_away(dev)) -- __usbnet_queue_skb(&dev->rxq, skb, rx_start); -+ __usbnet_queue_skb(&dev->rxq, skb, rx_start); - } - } else { - netif_dbg(dev, ifdown, dev->net, "rx: stopped\n"); -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c -index 7710367c319ec8..14f3c4900f56cd 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c -@@ -1167,6 +1167,7 @@ static int brcmf_ops_sdio_suspend(struct device *dev) - struct brcmf_bus *bus_if; - struct brcmf_sdio_dev *sdiodev; - mmc_pm_flag_t sdio_flags; -+ bool cap_power_off; - int ret = 0; - - func = container_of(dev, struct sdio_func, dev); -@@ -1174,19 +1175,23 @@ static int brcmf_ops_sdio_suspend(struct device *dev) - if (func->num != 1) - return 0; - -+ cap_power_off = !!(func->card->host->caps & MMC_CAP_POWER_OFF_CARD); - - bus_if = dev_get_drvdata(dev); - sdiodev = bus_if->bus_priv.sdio; - -- if (sdiodev->wowl_enabled) { -+ if (sdiodev->wowl_enabled || !cap_power_off) { - brcmf_sdiod_freezer_on(sdiodev); - brcmf_sdio_wd_timer(sdiodev->bus, 0); - - sdio_flags = MMC_PM_KEEP_POWER; -- if (sdiodev->settings->bus.sdio.oob_irq_supported) -- enable_irq_wake(sdiodev->settings->bus.sdio.oob_irq_nr); -- else -- sdio_flags |= MMC_PM_WAKE_SDIO_IRQ; -+ -+ if (sdiodev->wowl_enabled) { -+ if (sdiodev->settings->bus.sdio.oob_irq_supported) -+ enable_irq_wake(sdiodev->settings->bus.sdio.oob_irq_nr); -+ else -+ sdio_flags |= MMC_PM_WAKE_SDIO_IRQ; -+ } - - if (sdio_set_host_pm_flags(sdiodev->func1, sdio_flags)) - brcmf_err("Failed to set pm_flags %x\n", sdio_flags); -@@ -1208,18 +1213,19 @@ static int brcmf_ops_sdio_resume(struct device *dev) - struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio; - struct sdio_func *func = container_of(dev, struct sdio_func, dev); - int ret = 0; -+ bool cap_power_off = !!(func->card->host->caps & MMC_CAP_POWER_OFF_CARD); - - brcmf_dbg(SDIO, "Enter: F%d\n", func->num); - if (func->num != 2) - return 0; - -- if (!sdiodev->wowl_enabled) { -+ if (!sdiodev->wowl_enabled && cap_power_off) { - /* bus was powered off and device removed, probe again */ - ret = brcmf_sdiod_probe(sdiodev); - if (ret) - brcmf_err("Failed to probe device on resume\n"); - } else { -- if (sdiodev->settings->bus.sdio.oob_irq_supported) -+ if (sdiodev->wowl_enabled && sdiodev->settings->bus.sdio.oob_irq_supported) - disable_irq_wake(sdiodev->settings->bus.sdio.oob_irq_nr); - - brcmf_sdiod_freezer_off(sdiodev); -diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c -index 2a408e1ce06ec1..0a1f302ad6d3fd 100644 ---- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c -+++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c -@@ -559,41 +559,71 @@ static void iwl_dump_prph(struct iwl_fw_runtime *fwrt, - } - - /* -- * alloc_sgtable - allocates scallerlist table in the given size, -- * fills it with pages and returns it -+ * alloc_sgtable - allocates (chained) scatterlist in the given size, -+ * fills it with pages and returns it - * @size: the size (in bytes) of the table --*/ --static struct scatterlist *alloc_sgtable(int size) -+ */ -+static struct scatterlist *alloc_sgtable(ssize_t size) - { -- int alloc_size, nents, i; -- struct page *new_page; -- struct scatterlist *iter; -- struct scatterlist *table; -+ struct scatterlist *result = NULL, *prev; -+ int nents, i, n_prev; - - nents = DIV_ROUND_UP(size, PAGE_SIZE); -- table = kcalloc(nents, sizeof(*table), GFP_KERNEL); -- if (!table) -- return NULL; -- sg_init_table(table, nents); -- iter = table; -- for_each_sg(table, iter, sg_nents(table), i) { -- new_page = alloc_page(GFP_KERNEL); -- if (!new_page) { -- /* release all previous allocated pages in the table */ -- iter = table; -- for_each_sg(table, iter, sg_nents(table), i) { -- new_page = sg_page(iter); -- if (new_page) -- __free_page(new_page); -- } -- kfree(table); -+ -+#define N_ENTRIES_PER_PAGE (PAGE_SIZE / sizeof(*result)) -+ /* -+ * We need an additional entry for table chaining, -+ * this ensures the loop can finish i.e. we can -+ * fit at least two entries per page (obviously, -+ * many more really fit.) -+ */ -+ BUILD_BUG_ON(N_ENTRIES_PER_PAGE < 2); -+ -+ while (nents > 0) { -+ struct scatterlist *new, *iter; -+ int n_fill, n_alloc; -+ -+ if (nents <= N_ENTRIES_PER_PAGE) { -+ /* last needed table */ -+ n_fill = nents; -+ n_alloc = nents; -+ nents = 0; -+ } else { -+ /* fill a page with entries */ -+ n_alloc = N_ENTRIES_PER_PAGE; -+ /* reserve one for chaining */ -+ n_fill = n_alloc - 1; -+ nents -= n_fill; -+ } -+ -+ new = kcalloc(n_alloc, sizeof(*new), GFP_KERNEL); -+ if (!new) { -+ if (result) -+ _devcd_free_sgtable(result); - return NULL; - } -- alloc_size = min_t(int, size, PAGE_SIZE); -- size -= PAGE_SIZE; -- sg_set_page(iter, new_page, alloc_size, 0); -+ sg_init_table(new, n_alloc); -+ -+ if (!result) -+ result = new; -+ else -+ sg_chain(prev, n_prev, new); -+ prev = new; -+ n_prev = n_alloc; -+ -+ for_each_sg(new, iter, n_fill, i) { -+ struct page *new_page = alloc_page(GFP_KERNEL); -+ -+ if (!new_page) { -+ _devcd_free_sgtable(result); -+ return NULL; -+ } -+ -+ sg_set_page(iter, new_page, PAGE_SIZE, 0); -+ } - } -- return table; -+ -+ return result; - } - - static void iwl_fw_get_prph_len(struct iwl_fw_runtime *fwrt, -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c -index 8cff24d5f5f405..e4efd3349bc1bb 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c -@@ -1275,7 +1275,7 @@ iwl_mvm_decode_he_phy_ru_alloc(struct iwl_mvm_rx_phy_data *phy_data, - */ - u8 ru = le32_get_bits(phy_data->d1, IWL_RX_PHY_DATA1_HE_RU_ALLOC_MASK); - u32 rate_n_flags = phy_data->rate_n_flags; -- u32 he_type = rate_n_flags & RATE_MCS_HE_TYPE_MSK_V1; -+ u32 he_type = rate_n_flags & RATE_MCS_HE_TYPE_MSK; - u8 offs = 0; - - rx_status->bw = RATE_INFO_BW_HE_RU; -@@ -1330,13 +1330,13 @@ iwl_mvm_decode_he_phy_ru_alloc(struct iwl_mvm_rx_phy_data *phy_data, - - if (he_mu) - he_mu->flags2 |= -- le16_encode_bits(FIELD_GET(RATE_MCS_CHAN_WIDTH_MSK_V1, -+ le16_encode_bits(FIELD_GET(RATE_MCS_CHAN_WIDTH_MSK, - rate_n_flags), - IEEE80211_RADIOTAP_HE_MU_FLAGS2_BW_FROM_SIG_A_BW); -- else if (he_type == RATE_MCS_HE_TYPE_TRIG_V1) -+ else if (he_type == RATE_MCS_HE_TYPE_TRIG) - he->data6 |= - cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW_KNOWN) | -- le16_encode_bits(FIELD_GET(RATE_MCS_CHAN_WIDTH_MSK_V1, -+ le16_encode_bits(FIELD_GET(RATE_MCS_CHAN_WIDTH_MSK, - rate_n_flags), - IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW); - } -diff --git a/drivers/ntb/hw/intel/ntb_hw_gen3.c b/drivers/ntb/hw/intel/ntb_hw_gen3.c -index ffcfc3e02c3532..a5aa96a31f4a64 100644 ---- a/drivers/ntb/hw/intel/ntb_hw_gen3.c -+++ b/drivers/ntb/hw/intel/ntb_hw_gen3.c -@@ -215,6 +215,9 @@ static int gen3_init_ntb(struct intel_ntb_dev *ndev) - } - - ndev->db_valid_mask = BIT_ULL(ndev->db_count) - 1; -+ /* Make sure we are not using DB's used for link status */ -+ if (ndev->hwerr_flags & NTB_HWERR_MSIX_VECTOR32_BAD) -+ ndev->db_valid_mask &= ~ndev->db_link_mask; - - ndev->reg->db_iowrite(ndev->db_valid_mask, - ndev->self_mmio + -diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c -index 0a94c634ddc27e..b5f93f07e22a4d 100644 ---- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c -+++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c -@@ -288,7 +288,7 @@ static int switchtec_ntb_mw_set_trans(struct ntb_dev *ntb, int pidx, int widx, - if (size != 0 && xlate_pos < 12) - return -EINVAL; - -- if (!IS_ALIGNED(addr, BIT_ULL(xlate_pos))) { -+ if (xlate_pos >= 0 && !IS_ALIGNED(addr, BIT_ULL(xlate_pos))) { - /* - * In certain circumstances we can get a buffer that is - * not aligned to its size. (Most of the time -diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c -index 72bc1d017a46ee..dfd175f79e8f08 100644 ---- a/drivers/ntb/test/ntb_perf.c -+++ b/drivers/ntb/test/ntb_perf.c -@@ -839,10 +839,8 @@ static int perf_copy_chunk(struct perf_thread *pthr, - dma_set_unmap(tx, unmap); - - ret = dma_submit_error(dmaengine_submit(tx)); -- if (ret) { -- dmaengine_unmap_put(unmap); -+ if (ret) - goto err_free_resource; -- } - - dmaengine_unmap_put(unmap); - -diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c -index a36ec6df6624b8..a763df0200ab46 100644 ---- a/drivers/nvme/host/pci.c -+++ b/drivers/nvme/host/pci.c -@@ -1282,8 +1282,19 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req) - struct nvme_dev *dev = nvmeq->dev; - struct request *abort_req; - struct nvme_command cmd = { }; -+ struct pci_dev *pdev = to_pci_dev(dev->dev); - u32 csts = readl(dev->bar + NVME_REG_CSTS); - -+ /* -+ * Shutdown the device immediately if we see it is disconnected. This -+ * unblocks PCIe error handling if the nvme driver is waiting in -+ * error_resume for a device that has been removed. We can't unbind the -+ * driver while the driver's error callback is waiting to complete, so -+ * we're relying on a timeout to break that deadlock if a removal -+ * occurs while reset work is running. -+ */ -+ if (pci_dev_is_disconnected(pdev)) -+ nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_DELETING); - if (nvme_state_terminal(&dev->ctrl)) - goto disable; - -@@ -1291,7 +1302,7 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req) - * the recovery mechanism will surely fail. - */ - mb(); -- if (pci_channel_offline(to_pci_dev(dev->dev))) -+ if (pci_channel_offline(pdev)) - return BLK_EH_RESET_TIMER; - - /* -@@ -1850,6 +1861,18 @@ static void nvme_map_cmb(struct nvme_dev *dev) - if (offset > bar_size) - return; - -+ /* -+ * Controllers may support a CMB size larger than their BAR, for -+ * example, due to being behind a bridge. Reduce the CMB to the -+ * reported size of the BAR -+ */ -+ size = min(size, bar_size - offset); -+ -+ if (!IS_ALIGNED(size, memremap_compat_align()) || -+ !IS_ALIGNED(pci_resource_start(pdev, bar), -+ memremap_compat_align())) -+ return; -+ - /* - * Tell the controller about the host side address mapping the CMB, - * and enable CMB decoding for the NVMe 1.4+ scheme: -@@ -1860,17 +1883,10 @@ static void nvme_map_cmb(struct nvme_dev *dev) - dev->bar + NVME_REG_CMBMSC); - } - -- /* -- * Controllers may support a CMB size larger than their BAR, -- * for example, due to being behind a bridge. Reduce the CMB to -- * the reported size of the BAR -- */ -- if (size > bar_size - offset) -- size = bar_size - offset; -- - if (pci_p2pdma_add_resource(pdev, bar, size, offset)) { - dev_warn(dev->ctrl.device, - "failed to register the CMB\n"); -+ hi_lo_writeq(0, dev->bar + NVME_REG_CMBMSC); - return; - } - -diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c -index 2a8bd812b1a6f3..84db7f4f861cb1 100644 ---- a/drivers/nvme/host/tcp.c -+++ b/drivers/nvme/host/tcp.c -@@ -2467,6 +2467,7 @@ static int nvme_tcp_poll(struct blk_mq_hw_ctx *hctx, struct io_comp_batch *iob) - { - struct nvme_tcp_queue *queue = hctx->driver_data; - struct sock *sk = queue->sock->sk; -+ int ret; - - if (!test_bit(NVME_TCP_Q_LIVE, &queue->flags)) - return 0; -@@ -2474,9 +2475,9 @@ static int nvme_tcp_poll(struct blk_mq_hw_ctx *hctx, struct io_comp_batch *iob) - set_bit(NVME_TCP_Q_POLLING, &queue->flags); - if (sk_can_busy_loop(sk) && skb_queue_empty_lockless(&sk->sk_receive_queue)) - sk_busy_loop(sk, true); -- nvme_tcp_try_recv(queue); -+ ret = nvme_tcp_try_recv(queue); - clear_bit(NVME_TCP_Q_POLLING, &queue->flags); -- return queue->nr_cqe; -+ return ret < 0 ? ret : queue->nr_cqe; - } - - static int nvme_tcp_get_address(struct nvme_ctrl *ctrl, char *buf, int size) -diff --git a/drivers/pci/controller/cadence/pcie-cadence-ep.c b/drivers/pci/controller/cadence/pcie-cadence-ep.c -index b8b655d4047eca..a87dab9abba26f 100644 ---- a/drivers/pci/controller/cadence/pcie-cadence-ep.c -+++ b/drivers/pci/controller/cadence/pcie-cadence-ep.c -@@ -354,8 +354,7 @@ static void cdns_pcie_ep_assert_intx(struct cdns_pcie_ep *ep, u8 fn, u8 intx, - spin_unlock_irqrestore(&ep->lock, flags); - - offset = CDNS_PCIE_NORMAL_MSG_ROUTING(MSG_ROUTING_LOCAL) | -- CDNS_PCIE_NORMAL_MSG_CODE(msg_code) | -- CDNS_PCIE_MSG_NO_DATA; -+ CDNS_PCIE_NORMAL_MSG_CODE(msg_code); - writel(0, ep->irq_cpu_addr + offset); - } - -diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/pci/controller/cadence/pcie-cadence.h -index d55dfd173f228f..9efb71cbe6996c 100644 ---- a/drivers/pci/controller/cadence/pcie-cadence.h -+++ b/drivers/pci/controller/cadence/pcie-cadence.h -@@ -240,7 +240,7 @@ struct cdns_pcie_rp_ib_bar { - #define CDNS_PCIE_NORMAL_MSG_CODE_MASK GENMASK(15, 8) - #define CDNS_PCIE_NORMAL_MSG_CODE(code) \ - (((code) << 8) & CDNS_PCIE_NORMAL_MSG_CODE_MASK) --#define CDNS_PCIE_MSG_NO_DATA BIT(16) -+#define CDNS_PCIE_MSG_DATA BIT(16) - - struct cdns_pcie; - -diff --git a/drivers/pci/controller/dwc/pcie-histb.c b/drivers/pci/controller/dwc/pcie-histb.c -index fd484cc7c481dc..335b26635ee993 100644 ---- a/drivers/pci/controller/dwc/pcie-histb.c -+++ b/drivers/pci/controller/dwc/pcie-histb.c -@@ -409,16 +409,21 @@ static int histb_pcie_probe(struct platform_device *pdev) - ret = histb_pcie_host_enable(pp); - if (ret) { - dev_err(dev, "failed to enable host\n"); -- return ret; -+ goto err_exit_phy; - } - - ret = dw_pcie_host_init(pp); - if (ret) { - dev_err(dev, "failed to initialize host\n"); -- return ret; -+ goto err_exit_phy; - } - - return 0; -+ -+err_exit_phy: -+ phy_exit(hipcie->phy); -+ -+ return ret; - } - - static void histb_pcie_remove(struct platform_device *pdev) -@@ -427,8 +432,7 @@ static void histb_pcie_remove(struct platform_device *pdev) - - histb_pcie_host_disable(hipcie); - -- if (hipcie->phy) -- phy_exit(hipcie->phy); -+ phy_exit(hipcie->phy); - } - - static const struct of_device_id histb_pcie_of_match[] = { -diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c -index e47a77f943b1e1..44d385f5c27cd4 100644 ---- a/drivers/pci/controller/pcie-brcmstb.c -+++ b/drivers/pci/controller/pcie-brcmstb.c -@@ -378,10 +378,10 @@ static int brcm_pcie_set_ssc(struct brcm_pcie *pcie) - static void brcm_pcie_set_gen(struct brcm_pcie *pcie, int gen) - { - u16 lnkctl2 = readw(pcie->base + BRCM_PCIE_CAP_REGS + PCI_EXP_LNKCTL2); -- u32 lnkcap = readl(pcie->base + BRCM_PCIE_CAP_REGS + PCI_EXP_LNKCAP); -+ u32 lnkcap = readl(pcie->base + PCIE_RC_CFG_PRIV1_LINK_CAPABILITY); - - lnkcap = (lnkcap & ~PCI_EXP_LNKCAP_SLS) | gen; -- writel(lnkcap, pcie->base + BRCM_PCIE_CAP_REGS + PCI_EXP_LNKCAP); -+ writel(lnkcap, pcie->base + PCIE_RC_CFG_PRIV1_LINK_CAPABILITY); - - lnkctl2 = (lnkctl2 & ~0xf) | gen; - writew(lnkctl2, pcie->base + BRCM_PCIE_CAP_REGS + PCI_EXP_LNKCTL2); -@@ -1132,7 +1132,8 @@ static int brcm_pcie_add_bus(struct pci_bus *bus) - - ret = regulator_bulk_get(dev, sr->num_supplies, sr->supplies); - if (ret) { -- dev_info(dev, "No regulators for downstream device\n"); -+ dev_info(dev, "Did not get regulators, err=%d\n", ret); -+ pcie->sr = NULL; - goto no_regulators; - } - -@@ -1155,7 +1156,7 @@ static void brcm_pcie_remove_bus(struct pci_bus *bus) - struct subdev_regulators *sr = pcie->sr; - struct device *dev = &bus->dev; - -- if (!sr) -+ if (!sr || !bus->parent || !pci_is_root_bus(bus->parent)) - return; - - if (regulator_bulk_disable(sr->num_supplies, sr->supplies)) -diff --git a/drivers/pci/controller/pcie-xilinx-cpm.c b/drivers/pci/controller/pcie-xilinx-cpm.c -index 4a787a941674bc..51379d791005b8 100644 ---- a/drivers/pci/controller/pcie-xilinx-cpm.c -+++ b/drivers/pci/controller/pcie-xilinx-cpm.c -@@ -594,15 +594,17 @@ static int xilinx_cpm_pcie_probe(struct platform_device *pdev) - return err; - - bus = resource_list_first_type(&bridge->windows, IORESOURCE_BUS); -- if (!bus) -- return -ENODEV; -+ if (!bus) { -+ err = -ENODEV; -+ goto err_free_irq_domains; -+ } - - port->variant = of_device_get_match_data(dev); - - err = xilinx_cpm_pcie_parse_dt(port, bus->res); - if (err) { - dev_err(dev, "Parsing DT failed\n"); -- goto err_parse_dt; -+ goto err_free_irq_domains; - } - - xilinx_cpm_pcie_init_port(port); -@@ -626,7 +628,7 @@ static int xilinx_cpm_pcie_probe(struct platform_device *pdev) - xilinx_cpm_free_interrupts(port); - err_setup_irq: - pci_ecam_free(port->cfg); --err_parse_dt: -+err_free_irq_domains: - xilinx_cpm_free_irq_domains(port); - return err; - } -diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c -index fd713abdfb9f96..b0bccc4d0da282 100644 ---- a/drivers/pci/hotplug/pciehp_hpc.c -+++ b/drivers/pci/hotplug/pciehp_hpc.c -@@ -839,7 +839,9 @@ void pcie_enable_interrupt(struct controller *ctrl) - { - u16 mask; - -- mask = PCI_EXP_SLTCTL_HPIE | PCI_EXP_SLTCTL_DLLSCE; -+ mask = PCI_EXP_SLTCTL_DLLSCE; -+ if (!pciehp_poll_mode) -+ mask |= PCI_EXP_SLTCTL_HPIE; - pcie_write_cmd(ctrl, mask, mask); - } - -diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c -index 095fa1910d36db..bcce569a833956 100644 ---- a/drivers/pci/pci.c -+++ b/drivers/pci/pci.c -@@ -5714,6 +5714,8 @@ static bool pci_bus_resettable(struct pci_bus *bus) - return false; - - list_for_each_entry(dev, &bus->devices, bus_list) { -+ if (!pci_reset_supported(dev)) -+ return false; - if (dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET || - (dev->subordinate && !pci_bus_resettable(dev->subordinate))) - return false; -@@ -5790,6 +5792,8 @@ static bool pci_slot_resettable(struct pci_slot *slot) - list_for_each_entry(dev, &slot->bus->devices, bus_list) { - if (!dev->slot || dev->slot != slot) - continue; -+ if (!pci_reset_supported(dev)) -+ return false; - if (dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET || - (dev->subordinate && !pci_bus_resettable(dev->subordinate))) - return false; -diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c -index 0aef6dc055b922..4e995ca4de01bf 100644 ---- a/drivers/pci/pcie/aspm.c -+++ b/drivers/pci/pcie/aspm.c -@@ -977,16 +977,16 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) - parent_link = link->parent; - - /* -- * link->downstream is a pointer to the pci_dev of function 0. If -- * we remove that function, the pci_dev is about to be deallocated, -- * so we can't use link->downstream again. Free the link state to -- * avoid this. -+ * Free the parent link state, no later than function 0 (i.e. -+ * link->downstream) being removed. - * -- * If we're removing a non-0 function, it's possible we could -- * retain the link state, but PCIe r6.0, sec 7.5.3.7, recommends -- * programming the same ASPM Control value for all functions of -- * multi-function devices, so disable ASPM for all of them. -+ * Do not free the link state any earlier. If function 0 is a -+ * switch upstream port, this link state is parent_link to all -+ * subordinate ones. - */ -+ if (pdev != link->downstream) -+ goto out; -+ - pcie_config_aspm_link(link, 0); - list_del(&link->sibling); - free_link_state(link); -@@ -997,6 +997,7 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) - pcie_config_aspm_path(parent_link); - } - -+ out: - mutex_unlock(&aspm_lock); - up_read(&pci_bus_sem); - } -diff --git a/drivers/pci/pcie/portdrv.c b/drivers/pci/pcie/portdrv.c -index 46fad0d813b2b4..d6e5fef54c3b8d 100644 ---- a/drivers/pci/pcie/portdrv.c -+++ b/drivers/pci/pcie/portdrv.c -@@ -227,10 +227,12 @@ static int get_port_device_capability(struct pci_dev *dev) - - /* - * Disable hot-plug interrupts in case they have been enabled -- * by the BIOS and the hot-plug service driver is not loaded. -+ * by the BIOS and the hot-plug service driver won't be loaded -+ * to handle them. - */ -- pcie_capability_clear_word(dev, PCI_EXP_SLTCTL, -- PCI_EXP_SLTCTL_CCIE | PCI_EXP_SLTCTL_HPIE); -+ if (!IS_ENABLED(CONFIG_HOTPLUG_PCI_PCIE)) -+ pcie_capability_clear_word(dev, PCI_EXP_SLTCTL, -+ PCI_EXP_SLTCTL_CCIE | PCI_EXP_SLTCTL_HPIE); - } - - #ifdef CONFIG_PCIEAER -diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c -index 03b519a2284038..bcd1ba829e1fc1 100644 ---- a/drivers/pci/probe.c -+++ b/drivers/pci/probe.c -@@ -927,10 +927,9 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge) - /* Temporarily move resources off the list */ - list_splice_init(&bridge->windows, &resources); - err = device_add(&bridge->dev); -- if (err) { -- put_device(&bridge->dev); -+ if (err) - goto free; -- } -+ - bus->bridge = get_device(&bridge->dev); - device_enable_async_suspend(bus->bridge); - pci_set_bus_of_node(bus); -diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c -index 5a143ad5fca249..fba402f4f6330d 100644 ---- a/drivers/pci/setup-bus.c -+++ b/drivers/pci/setup-bus.c -@@ -2018,8 +2018,7 @@ pci_root_bus_distribute_available_resources(struct pci_bus *bus, - * in case of root bus. - */ - if (bridge && pci_bridge_resources_not_assigned(dev)) -- pci_bridge_distribute_available_resources(bridge, -- add_list); -+ pci_bridge_distribute_available_resources(dev, add_list); - else - pci_root_bus_distribute_available_resources(b, add_list); - } -diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c -index 3be04ab760d3f5..9775f6be1c1e68 100644 ---- a/drivers/pinctrl/intel/pinctrl-intel.c -+++ b/drivers/pinctrl/intel/pinctrl-intel.c -@@ -1524,7 +1524,6 @@ static int intel_pinctrl_probe_pwm(struct intel_pinctrl *pctrl, - .clk_rate = 19200000, - .npwm = 1, - .base_unit_bits = 22, -- .bypass = true, - }; - struct pwm_lpss_chip *pwm; - -diff --git a/drivers/pinctrl/renesas/pinctrl-rza2.c b/drivers/pinctrl/renesas/pinctrl-rza2.c -index 990b96d459671b..c5d733216508e8 100644 ---- a/drivers/pinctrl/renesas/pinctrl-rza2.c -+++ b/drivers/pinctrl/renesas/pinctrl-rza2.c -@@ -253,6 +253,8 @@ static int rza2_gpio_register(struct rza2_pinctrl_priv *priv) - return ret; - } - -+ of_node_put(of_args.np); -+ - if ((of_args.args[0] != 0) || - (of_args.args[1] != 0) || - (of_args.args[2] != priv->npins)) { -diff --git a/drivers/pinctrl/renesas/pinctrl-rzg2l.c b/drivers/pinctrl/renesas/pinctrl-rzg2l.c -index 2ea6ef99cc70bf..ac629c72d59277 100644 ---- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c -+++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c -@@ -1367,6 +1367,8 @@ static int rzg2l_gpio_register(struct rzg2l_pinctrl *pctrl) - return ret; - } - -+ of_node_put(of_args.np); -+ - if (of_args.args[0] != 0 || of_args.args[1] != 0 || - of_args.args[2] != pctrl->data->n_port_pins) { - dev_err(pctrl->dev, "gpio-ranges does not match selected SOC\n"); -diff --git a/drivers/pinctrl/renesas/pinctrl-rzv2m.c b/drivers/pinctrl/renesas/pinctrl-rzv2m.c -index 52aeafaba4b697..b89ae65e71b0ec 100644 ---- a/drivers/pinctrl/renesas/pinctrl-rzv2m.c -+++ b/drivers/pinctrl/renesas/pinctrl-rzv2m.c -@@ -944,6 +944,8 @@ static int rzv2m_gpio_register(struct rzv2m_pinctrl *pctrl) - return ret; - } - -+ of_node_put(of_args.np); -+ - if (of_args.args[0] != 0 || of_args.args[1] != 0 || - of_args.args[2] != pctrl->data->n_port_pins) { - dev_err(pctrl->dev, "gpio-ranges does not match selected SOC\n"); -diff --git a/drivers/pinctrl/tegra/pinctrl-tegra.c b/drivers/pinctrl/tegra/pinctrl-tegra.c -index 734c71ef005b8c..7c12a3470642c3 100644 ---- a/drivers/pinctrl/tegra/pinctrl-tegra.c -+++ b/drivers/pinctrl/tegra/pinctrl-tegra.c -@@ -272,6 +272,9 @@ static int tegra_pinctrl_set_mux(struct pinctrl_dev *pctldev, - val = pmx_readl(pmx, g->mux_bank, g->mux_reg); - val &= ~(0x3 << g->mux_bit); - val |= i << g->mux_bit; -+ /* Set the SFIO/GPIO selection to SFIO when under pinmux control*/ -+ if (pmx->soc->sfsel_in_mux) -+ val |= (1 << g->sfsel_bit); - pmx_writel(pmx, val, g->mux_bank, g->mux_reg); - - return 0; -diff --git a/drivers/platform/x86/dell/dell-wmi-ddv.c b/drivers/platform/x86/dell/dell-wmi-ddv.c -index db1e9240dd02c2..8fb434b6ab4b97 100644 ---- a/drivers/platform/x86/dell/dell-wmi-ddv.c -+++ b/drivers/platform/x86/dell/dell-wmi-ddv.c -@@ -665,8 +665,10 @@ static ssize_t temp_show(struct device *dev, struct device_attribute *attr, char - if (ret < 0) - return ret; - -- /* Use 2731 instead of 2731.5 to avoid unnecessary rounding */ -- return sysfs_emit(buf, "%d\n", value - 2731); -+ /* Use 2732 instead of 2731.5 to avoid unnecessary rounding and to emulate -+ * the behaviour of the OEM application which seems to round down the result. -+ */ -+ return sysfs_emit(buf, "%d\n", value - 2732); - } - - static ssize_t eppid_show(struct device *dev, struct device_attribute *attr, char *buf) -diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c -index 7457ca2b27a60b..36209997ba988e 100644 ---- a/drivers/platform/x86/intel/hid.c -+++ b/drivers/platform/x86/intel/hid.c -@@ -128,6 +128,13 @@ static const struct dmi_system_id button_array_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "Surface Go 3"), - }, - }, -+ { -+ .ident = "Microsoft Surface Go 4", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Surface Go 4"), -+ }, -+ }, - { } - }; - -diff --git a/drivers/platform/x86/intel/speed_select_if/isst_if_common.c b/drivers/platform/x86/intel/speed_select_if/isst_if_common.c -index 9040a3d39924bb..7760ecab3e8317 100644 ---- a/drivers/platform/x86/intel/speed_select_if/isst_if_common.c -+++ b/drivers/platform/x86/intel/speed_select_if/isst_if_common.c -@@ -84,7 +84,7 @@ static DECLARE_HASHTABLE(isst_hash, 8); - static DEFINE_MUTEX(isst_hash_lock); - - static int isst_store_new_cmd(int cmd, u32 cpu, int mbox_cmd_type, u32 param, -- u32 data) -+ u64 data) - { - struct isst_cmd *sst_cmd; - -diff --git a/drivers/platform/x86/intel/vsec.c b/drivers/platform/x86/intel/vsec.c -index 343ab6a82c0177..666ed3698afe75 100644 ---- a/drivers/platform/x86/intel/vsec.c -+++ b/drivers/platform/x86/intel/vsec.c -@@ -420,6 +420,11 @@ static const struct intel_vsec_platform_info oobmsm_info = { - .caps = VSEC_CAP_TELEMETRY | VSEC_CAP_SDSI | VSEC_CAP_TPMI, - }; - -+/* DMR OOBMSM info */ -+static const struct intel_vsec_platform_info dmr_oobmsm_info = { -+ .caps = VSEC_CAP_TELEMETRY | VSEC_CAP_TPMI, -+}; -+ - /* TGL info */ - static const struct intel_vsec_platform_info tgl_info = { - .caps = VSEC_CAP_TELEMETRY, -@@ -431,6 +436,7 @@ static const struct intel_vsec_platform_info tgl_info = { - #define PCI_DEVICE_ID_INTEL_VSEC_MTL_M 0x7d0d - #define PCI_DEVICE_ID_INTEL_VSEC_MTL_S 0xad0d - #define PCI_DEVICE_ID_INTEL_VSEC_OOBMSM 0x09a7 -+#define PCI_DEVICE_ID_INTEL_VSEC_OOBMSM_DMR 0x09a1 - #define PCI_DEVICE_ID_INTEL_VSEC_RPL 0xa77d - #define PCI_DEVICE_ID_INTEL_VSEC_TGL 0x9a0d - static const struct pci_device_id intel_vsec_pci_ids[] = { -@@ -439,6 +445,7 @@ static const struct pci_device_id intel_vsec_pci_ids[] = { - { PCI_DEVICE_DATA(INTEL, VSEC_MTL_M, &mtl_info) }, - { PCI_DEVICE_DATA(INTEL, VSEC_MTL_S, &mtl_info) }, - { PCI_DEVICE_DATA(INTEL, VSEC_OOBMSM, &oobmsm_info) }, -+ { PCI_DEVICE_DATA(INTEL, VSEC_OOBMSM_DMR, &dmr_oobmsm_info) }, - { PCI_DEVICE_DATA(INTEL, VSEC_RPL, &tgl_info) }, - { PCI_DEVICE_DATA(INTEL, VSEC_TGL, &tgl_info) }, - { } -diff --git a/drivers/power/supply/max77693_charger.c b/drivers/power/supply/max77693_charger.c -index 794c8c054450e8..0e7b3277d481ab 100644 ---- a/drivers/power/supply/max77693_charger.c -+++ b/drivers/power/supply/max77693_charger.c -@@ -556,7 +556,7 @@ static int max77693_set_charge_input_threshold_volt(struct max77693_charger *chg - case 4700000: - case 4800000: - case 4900000: -- data = (uvolt - 4700000) / 100000; -+ data = ((uvolt - 4700000) / 100000) + 1; - break; - default: - dev_err(chg->dev, "Wrong value for charge input voltage regulation threshold\n"); -diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c -index 2d717f2ed396c6..8f93489aa0d492 100644 ---- a/drivers/remoteproc/qcom_q6v5_mss.c -+++ b/drivers/remoteproc/qcom_q6v5_mss.c -@@ -1838,6 +1838,13 @@ static int q6v5_pds_attach(struct device *dev, struct device **devs, - while (pd_names[num_pds]) - num_pds++; - -+ /* Handle single power domain */ -+ if (num_pds == 1 && dev->pm_domain) { -+ devs[0] = dev; -+ pm_runtime_enable(dev); -+ return 1; -+ } -+ - for (i = 0; i < num_pds; i++) { - devs[i] = dev_pm_domain_attach_by_name(dev, pd_names[i]); - if (IS_ERR_OR_NULL(devs[i])) { -@@ -1858,8 +1865,15 @@ static int q6v5_pds_attach(struct device *dev, struct device **devs, - static void q6v5_pds_detach(struct q6v5 *qproc, struct device **pds, - size_t pd_count) - { -+ struct device *dev = qproc->dev; - int i; - -+ /* Handle single power domain */ -+ if (pd_count == 1 && dev->pm_domain) { -+ pm_runtime_disable(dev); -+ return; -+ } -+ - for (i = 0; i < pd_count; i++) - dev_pm_domain_detach(pds[i], false); - } -@@ -2471,13 +2485,13 @@ static const struct rproc_hexagon_res msm8974_mss = { - .supply = "pll", - .uA = 100000, - }, -- {} -- }, -- .fallback_proxy_supply = (struct qcom_mss_reg_res[]) { - { - .supply = "mx", - .uV = 1050000, - }, -+ {} -+ }, -+ .fallback_proxy_supply = (struct qcom_mss_reg_res[]) { - { - .supply = "cx", - .uA = 100000, -@@ -2503,7 +2517,6 @@ static const struct rproc_hexagon_res msm8974_mss = { - NULL - }, - .proxy_pd_names = (char*[]){ -- "mx", - "cx", - NULL - }, -diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c -index fd6bf9e77afcb8..f6336bf4a38b9b 100644 ---- a/drivers/remoteproc/qcom_q6v5_pas.c -+++ b/drivers/remoteproc/qcom_q6v5_pas.c -@@ -490,16 +490,16 @@ static int adsp_pds_attach(struct device *dev, struct device **devs, - if (!pd_names) - return 0; - -+ while (pd_names[num_pds]) -+ num_pds++; -+ - /* Handle single power domain */ -- if (dev->pm_domain) { -+ if (num_pds == 1 && dev->pm_domain) { - devs[0] = dev; - pm_runtime_enable(dev); - return 1; - } - -- while (pd_names[num_pds]) -- num_pds++; -- - for (i = 0; i < num_pds; i++) { - devs[i] = dev_pm_domain_attach_by_name(dev, pd_names[i]); - if (IS_ERR_OR_NULL(devs[i])) { -@@ -524,7 +524,7 @@ static void adsp_pds_detach(struct qcom_adsp *adsp, struct device **pds, - int i; - - /* Handle single power domain */ -- if (dev->pm_domain && pd_count) { -+ if (pd_count == 1 && dev->pm_domain) { - pm_runtime_disable(dev); - return; - } -@@ -1240,7 +1240,7 @@ static const struct adsp_data sm8550_mpss_resource = { - }; - - static const struct of_device_id adsp_of_match[] = { -- { .compatible = "qcom,msm8226-adsp-pil", .data = &adsp_resource_init}, -+ { .compatible = "qcom,msm8226-adsp-pil", .data = &msm8996_adsp_resource}, - { .compatible = "qcom,msm8953-adsp-pil", .data = &msm8996_adsp_resource}, - { .compatible = "qcom,msm8974-adsp-pil", .data = &adsp_resource_init}, - { .compatible = "qcom,msm8996-adsp-pil", .data = &msm8996_adsp_resource}, -diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c -index e230af51a99b9f..0c363ca566ffdb 100644 ---- a/drivers/remoteproc/remoteproc_core.c -+++ b/drivers/remoteproc/remoteproc_core.c -@@ -2024,6 +2024,7 @@ int rproc_shutdown(struct rproc *rproc) - kfree(rproc->cached_table); - rproc->cached_table = NULL; - rproc->table_ptr = NULL; -+ rproc->table_sz = 0; - out: - mutex_unlock(&rproc->lock); - return ret; -diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c -index 91d12198cc6c87..0a3a5af67f0ae7 100644 ---- a/drivers/scsi/qla2xxx/qla_os.c -+++ b/drivers/scsi/qla2xxx/qla_os.c -@@ -2883,7 +2883,7 @@ static void qla2x00_iocb_work_fn(struct work_struct *work) - static void - qla_trace_init(void) - { -- qla_trc_array = trace_array_get_by_name("qla2xxx"); -+ qla_trc_array = trace_array_get_by_name("qla2xxx", NULL); - if (!qla_trc_array) { - ql_log(ql_log_fatal, NULL, 0x0001, - "Unable to create qla2xxx trace instance, instance logging will be disabled.\n"); -diff --git a/drivers/soundwire/slave.c b/drivers/soundwire/slave.c -index 060c2982e26b00..0aadfc20102879 100644 ---- a/drivers/soundwire/slave.c -+++ b/drivers/soundwire/slave.c -@@ -12,6 +12,7 @@ static void sdw_slave_release(struct device *dev) - { - struct sdw_slave *slave = dev_to_sdw_dev(dev); - -+ of_node_put(slave->dev.of_node); - mutex_destroy(&slave->sdw_dev_lock); - kfree(slave); - } -diff --git a/drivers/staging/rtl8723bs/Kconfig b/drivers/staging/rtl8723bs/Kconfig -index f23e29b679fb5e..14afcbbd610450 100644 ---- a/drivers/staging/rtl8723bs/Kconfig -+++ b/drivers/staging/rtl8723bs/Kconfig -@@ -5,6 +5,7 @@ config RTL8723BS - depends on m - select CFG80211_WEXT - select CRYPTO -+ select CRYPTO_LIB_AES - select CRYPTO_LIB_ARC4 - help - This option enables support for RTL8723BS SDIO drivers, such as -diff --git a/drivers/thermal/intel/int340x_thermal/int3402_thermal.c b/drivers/thermal/intel/int340x_thermal/int3402_thermal.c -index 43fa351e2b9ec1..b7fdf25bfd237e 100644 ---- a/drivers/thermal/intel/int340x_thermal/int3402_thermal.c -+++ b/drivers/thermal/intel/int340x_thermal/int3402_thermal.c -@@ -45,6 +45,9 @@ static int int3402_thermal_probe(struct platform_device *pdev) - struct int3402_thermal_data *d; - int ret; - -+ if (!adev) -+ return -ENODEV; -+ - if (!acpi_has_method(adev->handle, "_TMP")) - return -ENODEV; - -diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c -index e05341b85c599f..788035f0c1ab22 100644 ---- a/drivers/tty/n_tty.c -+++ b/drivers/tty/n_tty.c -@@ -491,7 +491,8 @@ static int do_output_char(u8 c, struct tty_struct *tty, int space) - static int process_output(u8 c, struct tty_struct *tty) - { - struct n_tty_data *ldata = tty->disc_data; -- int space, retval; -+ unsigned int space; -+ int retval; - - mutex_lock(&ldata->output_lock); - -@@ -527,16 +528,16 @@ static ssize_t process_output_block(struct tty_struct *tty, - const u8 *buf, unsigned int nr) - { - struct n_tty_data *ldata = tty->disc_data; -- int space; -- int i; -+ unsigned int space; -+ int i; - const u8 *cp; - - mutex_lock(&ldata->output_lock); - - space = tty_write_room(tty); -- if (space <= 0) { -+ if (space == 0) { - mutex_unlock(&ldata->output_lock); -- return space; -+ return 0; - } - if (nr > space) - nr = space; -@@ -701,7 +702,7 @@ static int n_tty_process_echo_ops(struct tty_struct *tty, size_t *tail, - static size_t __process_echoes(struct tty_struct *tty) - { - struct n_tty_data *ldata = tty->disc_data; -- int space, old_space; -+ unsigned int space, old_space; - size_t tail; - u8 c; - -diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c -index b0137eac7ab383..fbc486546b8533 100644 ---- a/drivers/usb/host/xhci-mem.c -+++ b/drivers/usb/host/xhci-mem.c -@@ -2318,10 +2318,10 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags) - page_size = readl(&xhci->op_regs->page_size); - xhci_dbg_trace(xhci, trace_xhci_dbg_init, - "Supported page size register = 0x%x", page_size); -- i = ffs(page_size); -- if (i < 16) -+ val = ffs(page_size) - 1; -+ if (val < 16) - xhci_dbg_trace(xhci, trace_xhci_dbg_init, -- "Supported page size of %iK", (1 << (i+12)) / 1024); -+ "Supported page size of %iK", (1 << (val + 12)) / 1024); - else - xhci_warn(xhci, "WARN: no supported page size\n"); - /* Use 4K pages, since that's common and the minimum the HC supports */ -diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c -index cf3c8e552defeb..7c7f388aac96b3 100644 ---- a/drivers/usb/typec/ucsi/ucsi_ccg.c -+++ b/drivers/usb/typec/ucsi/ucsi_ccg.c -@@ -1366,11 +1366,10 @@ static int ucsi_ccg_probe(struct i2c_client *client) - uc->fw_build = CCG_FW_BUILD_NVIDIA_TEGRA; - else if (!strcmp(fw_name, "nvidia,gpu")) - uc->fw_build = CCG_FW_BUILD_NVIDIA; -+ if (!uc->fw_build) -+ dev_err(uc->dev, "failed to get FW build information\n"); - } - -- if (!uc->fw_build) -- dev_err(uc->dev, "failed to get FW build information\n"); -- - /* reset ccg device and initialize ucsi */ - status = ucsi_ccg_init(uc); - if (status < 0) { -diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c -index 99813232c25e98..8d8a22504d71fc 100644 ---- a/drivers/vhost/scsi.c -+++ b/drivers/vhost/scsi.c -@@ -1688,14 +1688,19 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, - } - } - -+ if (vs->vs_tpg) { -+ pr_err("vhost-scsi endpoint already set for %s.\n", -+ vs->vs_vhost_wwpn); -+ ret = -EEXIST; -+ goto out; -+ } -+ - len = sizeof(vs_tpg[0]) * VHOST_SCSI_MAX_TARGET; - vs_tpg = kzalloc(len, GFP_KERNEL); - if (!vs_tpg) { - ret = -ENOMEM; - goto out; - } -- if (vs->vs_tpg) -- memcpy(vs_tpg, vs->vs_tpg, len); - - mutex_lock(&vhost_scsi_mutex); - list_for_each_entry(tpg, &vhost_scsi_list, tv_tpg_list) { -@@ -1711,12 +1716,6 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, - tv_tport = tpg->tport; - - if (!strcmp(tv_tport->tport_name, t->vhost_wwpn)) { -- if (vs->vs_tpg && vs->vs_tpg[tpg->tport_tpgt]) { -- mutex_unlock(&tpg->tv_tpg_mutex); -- mutex_unlock(&vhost_scsi_mutex); -- ret = -EEXIST; -- goto undepend; -- } - /* - * In order to ensure individual vhost-scsi configfs - * groups cannot be removed while in use by vhost ioctl, -@@ -1763,15 +1762,15 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, - } - ret = 0; - } else { -- ret = -EEXIST; -+ ret = -ENODEV; -+ goto free_tpg; - } - - /* -- * Act as synchronize_rcu to make sure access to -- * old vs->vs_tpg is finished. -+ * Act as synchronize_rcu to make sure requests after this point -+ * see a fully setup device. - */ - vhost_scsi_flush(vs); -- kfree(vs->vs_tpg); - vs->vs_tpg = vs_tpg; - goto out; - -@@ -1791,6 +1790,7 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, - target_undepend_item(&tpg->se_tpg.tpg_group.cg_item); - } - } -+free_tpg: - kfree(vs_tpg); - out: - mutex_unlock(&vs->dev.mutex); -@@ -1893,6 +1893,7 @@ vhost_scsi_clear_endpoint(struct vhost_scsi *vs, - vhost_scsi_flush(vs); - kfree(vs->vs_tpg); - vs->vs_tpg = NULL; -+ memset(vs->vs_vhost_wwpn, 0, sizeof(vs->vs_vhost_wwpn)); - WARN_ON(vs->vs_events_nr); - mutex_unlock(&vs->dev.mutex); - return 0; -diff --git a/drivers/video/console/Kconfig b/drivers/video/console/Kconfig -index 30577b1d3de590..cdbcb86ff39442 100644 ---- a/drivers/video/console/Kconfig -+++ b/drivers/video/console/Kconfig -@@ -24,7 +24,7 @@ config VGA_CONSOLE - Say Y. - - config MDA_CONSOLE -- depends on !M68K && !PARISC && ISA -+ depends on VGA_CONSOLE && ISA - tristate "MDA text console (dual-headed)" - help - Say Y here if you have an old MDA or monochrome Hercules graphics -diff --git a/drivers/video/fbdev/au1100fb.c b/drivers/video/fbdev/au1100fb.c -index 648d6cac86e8fb..6822589680798d 100644 ---- a/drivers/video/fbdev/au1100fb.c -+++ b/drivers/video/fbdev/au1100fb.c -@@ -137,13 +137,15 @@ static int au1100fb_fb_blank(int blank_mode, struct fb_info *fbi) - */ - int au1100fb_setmode(struct au1100fb_device *fbdev) - { -- struct fb_info *info = &fbdev->info; -+ struct fb_info *info; - u32 words; - int index; - - if (!fbdev) - return -EINVAL; - -+ info = &fbdev->info; -+ - /* Update var-dependent FB info */ - if (panel_is_active(fbdev->panel) || panel_is_color(fbdev->panel)) { - if (info->var.bits_per_pixel <= 8) { -diff --git a/drivers/video/fbdev/sm501fb.c b/drivers/video/fbdev/sm501fb.c -index 65c799ac5604f5..b9d72f368c6c69 100644 ---- a/drivers/video/fbdev/sm501fb.c -+++ b/drivers/video/fbdev/sm501fb.c -@@ -326,6 +326,13 @@ static int sm501fb_check_var(struct fb_var_screeninfo *var, - if (var->xres_virtual > 4096 || var->yres_virtual > 2048) - return -EINVAL; - -+ /* geometry sanity checks */ -+ if (var->xres + var->xoffset > var->xres_virtual) -+ return -EINVAL; -+ -+ if (var->yres + var->yoffset > var->yres_virtual) -+ return -EINVAL; -+ - /* can cope with 8,16 or 32bpp */ - - if (var->bits_per_pixel <= 8) -diff --git a/fs/affs/file.c b/fs/affs/file.c -index 04c018e196028e..93b319917c9a9e 100644 ---- a/fs/affs/file.c -+++ b/fs/affs/file.c -@@ -597,7 +597,7 @@ affs_extent_file_ofs(struct inode *inode, u32 newsize) - BUG_ON(tmp > bsize); - AFFS_DATA_HEAD(bh)->ptype = cpu_to_be32(T_DATA); - AFFS_DATA_HEAD(bh)->key = cpu_to_be32(inode->i_ino); -- AFFS_DATA_HEAD(bh)->sequence = cpu_to_be32(bidx); -+ AFFS_DATA_HEAD(bh)->sequence = cpu_to_be32(bidx + 1); - AFFS_DATA_HEAD(bh)->size = cpu_to_be32(tmp); - affs_fix_checksum(sb, bh); - bh->b_state &= ~(1UL << BH_New); -@@ -726,7 +726,8 @@ static int affs_write_end_ofs(struct file *file, struct address_space *mapping, - tmp = min(bsize - boff, to - from); - BUG_ON(boff + tmp > bsize || tmp > bsize); - memcpy(AFFS_DATA(bh) + boff, data + from, tmp); -- be32_add_cpu(&AFFS_DATA_HEAD(bh)->size, tmp); -+ AFFS_DATA_HEAD(bh)->size = cpu_to_be32( -+ max(boff + tmp, be32_to_cpu(AFFS_DATA_HEAD(bh)->size))); - affs_fix_checksum(sb, bh); - mark_buffer_dirty_inode(bh, inode); - written += tmp; -@@ -748,7 +749,7 @@ static int affs_write_end_ofs(struct file *file, struct address_space *mapping, - if (buffer_new(bh)) { - AFFS_DATA_HEAD(bh)->ptype = cpu_to_be32(T_DATA); - AFFS_DATA_HEAD(bh)->key = cpu_to_be32(inode->i_ino); -- AFFS_DATA_HEAD(bh)->sequence = cpu_to_be32(bidx); -+ AFFS_DATA_HEAD(bh)->sequence = cpu_to_be32(bidx + 1); - AFFS_DATA_HEAD(bh)->size = cpu_to_be32(bsize); - AFFS_DATA_HEAD(bh)->next = 0; - bh->b_state &= ~(1UL << BH_New); -@@ -782,7 +783,7 @@ static int affs_write_end_ofs(struct file *file, struct address_space *mapping, - if (buffer_new(bh)) { - AFFS_DATA_HEAD(bh)->ptype = cpu_to_be32(T_DATA); - AFFS_DATA_HEAD(bh)->key = cpu_to_be32(inode->i_ino); -- AFFS_DATA_HEAD(bh)->sequence = cpu_to_be32(bidx); -+ AFFS_DATA_HEAD(bh)->sequence = cpu_to_be32(bidx + 1); - AFFS_DATA_HEAD(bh)->size = cpu_to_be32(tmp); - AFFS_DATA_HEAD(bh)->next = 0; - bh->b_state &= ~(1UL << BH_New); -diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c -index 021cf468274b7d..af03a1c6ba768c 100644 ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -5540,7 +5540,10 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans, - ret = btrfs_dec_ref(trans, root, eb, 1); - else - ret = btrfs_dec_ref(trans, root, eb, 0); -- BUG_ON(ret); /* -ENOMEM */ -+ if (ret) { -+ btrfs_abort_transaction(trans, ret); -+ return ret; -+ } - if (is_fstree(root->root_key.objectid)) { - ret = btrfs_qgroup_trace_leaf_items(trans, eb); - if (ret) { -diff --git a/fs/exec.c b/fs/exec.c -index 4a6255aa4ea7f3..ee71a315cc51f5 100644 ---- a/fs/exec.c -+++ b/fs/exec.c -@@ -1257,13 +1257,12 @@ int begin_new_exec(struct linux_binprm * bprm) - */ - bprm->point_of_no_return = true; - -- /* -- * Make this the only thread in the thread group. -- */ -+ /* Make this the only thread in the thread group */ - retval = de_thread(me); - if (retval) - goto out; -- -+ /* see the comment in check_unsafe_exec() */ -+ current->fs->in_exec = 0; - /* - * Cancel any io_uring activity across execve - */ -@@ -1516,6 +1515,8 @@ static void free_bprm(struct linux_binprm *bprm) - } - free_arg_pages(bprm); - if (bprm->cred) { -+ /* in case exec fails before de_thread() succeeds */ -+ current->fs->in_exec = 0; - mutex_unlock(¤t->signal->cred_guard_mutex); - abort_creds(bprm->cred); - } -@@ -1604,6 +1605,10 @@ static void check_unsafe_exec(struct linux_binprm *bprm) - * suid exec because the differently privileged task - * will be able to manipulate the current directory, etc. - * It would be nice to force an unshare instead... -+ * -+ * Otherwise we set fs->in_exec = 1 to deny clone(CLONE_FS) -+ * from another sub-thread until de_thread() succeeds, this -+ * state is protected by cred_guard_mutex we hold. - */ - t = p; - n_fs = 1; -@@ -1890,7 +1895,6 @@ static int bprm_execve(struct linux_binprm *bprm, - - sched_mm_cid_after_execve(current); - /* execve succeeded */ -- current->fs->in_exec = 0; - current->in_execve = 0; - rseq_execve(current); - user_events_execve(current); -@@ -1910,7 +1914,6 @@ static int bprm_execve(struct linux_binprm *bprm, - - out_unmark: - sched_mm_cid_after_execve(current); -- current->fs->in_exec = 0; - current->in_execve = 0; - - return retval; -diff --git a/fs/exfat/fatent.c b/fs/exfat/fatent.c -index 74590041fb2c7b..24e1e05f9f34a7 100644 ---- a/fs/exfat/fatent.c -+++ b/fs/exfat/fatent.c -@@ -265,7 +265,7 @@ int exfat_find_last_cluster(struct super_block *sb, struct exfat_chain *p_chain, - clu = next; - if (exfat_ent_get(sb, clu, &next)) - return -EIO; -- } while (next != EXFAT_EOF_CLUSTER); -+ } while (next != EXFAT_EOF_CLUSTER && count <= p_chain->size); - - if (p_chain->size != count) { - exfat_fs_error(sb, -diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c -index 7ea33c3fe94e1c..6682b8ab11f1cb 100644 ---- a/fs/ext4/dir.c -+++ b/fs/ext4/dir.c -@@ -104,6 +104,9 @@ int __ext4_check_dir_entry(const char *function, unsigned int line, - else if (unlikely(le32_to_cpu(de->inode) > - le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count))) - error_msg = "inode out of bounds"; -+ else if (unlikely(next_offset == size && de->name_len == 1 && -+ de->name[0] == '.')) -+ error_msg = "'.' directory cannot be the last in data block"; - else - return 0; - -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index f019ce64eba48e..a4d7af7495b784 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -6808,22 +6808,29 @@ static int ext4_statfs_project(struct super_block *sb, - dquot->dq_dqb.dqb_bhardlimit); - limit >>= sb->s_blocksize_bits; - -- if (limit && buf->f_blocks > limit) { -+ if (limit) { -+ uint64_t remaining = 0; -+ - curblock = (dquot->dq_dqb.dqb_curspace + - dquot->dq_dqb.dqb_rsvspace) >> sb->s_blocksize_bits; -- buf->f_blocks = limit; -- buf->f_bfree = buf->f_bavail = -- (buf->f_blocks > curblock) ? -- (buf->f_blocks - curblock) : 0; -+ if (limit > curblock) -+ remaining = limit - curblock; -+ -+ buf->f_blocks = min(buf->f_blocks, limit); -+ buf->f_bfree = min(buf->f_bfree, remaining); -+ buf->f_bavail = min(buf->f_bavail, remaining); - } - - limit = min_not_zero(dquot->dq_dqb.dqb_isoftlimit, - dquot->dq_dqb.dqb_ihardlimit); -- if (limit && buf->f_files > limit) { -- buf->f_files = limit; -- buf->f_ffree = -- (buf->f_files > dquot->dq_dqb.dqb_curinodes) ? -- (buf->f_files - dquot->dq_dqb.dqb_curinodes) : 0; -+ if (limit) { -+ uint64_t remaining = 0; -+ -+ if (limit > dquot->dq_dqb.dqb_curinodes) -+ remaining = limit - dquot->dq_dqb.dqb_curinodes; -+ -+ buf->f_files = min(buf->f_files, limit); -+ buf->f_ffree = min(buf->f_ffree, remaining); - } - - spin_unlock(&dquot->dq_dqb_lock); -diff --git a/fs/fuse/dax.c b/fs/fuse/dax.c -index 12ef91d170bb30..7faf1af59d5d84 100644 ---- a/fs/fuse/dax.c -+++ b/fs/fuse/dax.c -@@ -681,7 +681,6 @@ static int __fuse_dax_break_layouts(struct inode *inode, bool *retry, - 0, 0, fuse_wait_dax_page(inode)); - } - --/* dmap_end == 0 leads to unmapping of whole file */ - int fuse_dax_break_layouts(struct inode *inode, u64 dmap_start, - u64 dmap_end) - { -diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c -index 89bffaed421fa6..e4d6cc0d2332a4 100644 ---- a/fs/fuse/dir.c -+++ b/fs/fuse/dir.c -@@ -1875,7 +1875,7 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr, - if (FUSE_IS_DAX(inode) && is_truncate) { - filemap_invalidate_lock(mapping); - fault_blocked = true; -- err = fuse_dax_break_layouts(inode, 0, 0); -+ err = fuse_dax_break_layouts(inode, 0, -1); - if (err) { - filemap_invalidate_unlock(mapping); - return err; -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index ceb9f7d2303882..3e4c3fcb588ba8 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -241,7 +241,7 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir) - - if (dax_truncate) { - filemap_invalidate_lock(inode->i_mapping); -- err = fuse_dax_break_layouts(inode, 0, 0); -+ err = fuse_dax_break_layouts(inode, 0, -1); - if (err) - goto out_inode_unlock; - } -@@ -3023,7 +3023,7 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset, - inode_lock(inode); - if (block_faults) { - filemap_invalidate_lock(inode->i_mapping); -- err = fuse_dax_break_layouts(inode, 0, 0); -+ err = fuse_dax_break_layouts(inode, 0, -1); - if (err) - goto out; - } -diff --git a/fs/hostfs/hostfs.h b/fs/hostfs/hostfs.h -index 8b39c15c408ccd..15b2f094d36ef8 100644 ---- a/fs/hostfs/hostfs.h -+++ b/fs/hostfs/hostfs.h -@@ -60,7 +60,7 @@ struct hostfs_stat { - unsigned int uid; - unsigned int gid; - unsigned long long size; -- struct hostfs_timespec atime, mtime, ctime; -+ struct hostfs_timespec atime, mtime, ctime, btime; - unsigned int blksize; - unsigned long long blocks; - struct { -diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c -index ff201753fd1814..44fe76174e1227 100644 ---- a/fs/hostfs/hostfs_kern.c -+++ b/fs/hostfs/hostfs_kern.c -@@ -27,6 +27,7 @@ struct hostfs_inode_info { - struct inode vfs_inode; - struct mutex open_mutex; - dev_t dev; -+ struct hostfs_timespec btime; - }; - - static inline struct hostfs_inode_info *HOSTFS_I(struct inode *inode) -@@ -557,6 +558,7 @@ static int hostfs_inode_set(struct inode *ino, void *data) - } - - HOSTFS_I(ino)->dev = dev; -+ HOSTFS_I(ino)->btime = st->btime; - ino->i_ino = st->ino; - ino->i_mode = st->mode; - return hostfs_inode_update(ino, st); -@@ -567,7 +569,10 @@ static int hostfs_inode_test(struct inode *inode, void *data) - const struct hostfs_stat *st = data; - dev_t dev = MKDEV(st->dev.maj, st->dev.min); - -- return inode->i_ino == st->ino && HOSTFS_I(inode)->dev == dev; -+ return inode->i_ino == st->ino && HOSTFS_I(inode)->dev == dev && -+ (inode->i_mode & S_IFMT) == (st->mode & S_IFMT) && -+ HOSTFS_I(inode)->btime.tv_sec == st->btime.tv_sec && -+ HOSTFS_I(inode)->btime.tv_nsec == st->btime.tv_nsec; - } - - static struct inode *hostfs_iget(struct super_block *sb, char *name) -diff --git a/fs/hostfs/hostfs_user.c b/fs/hostfs/hostfs_user.c -index 97e9c40a944883..3bcd9f35e70b22 100644 ---- a/fs/hostfs/hostfs_user.c -+++ b/fs/hostfs/hostfs_user.c -@@ -18,39 +18,48 @@ - #include "hostfs.h" - #include - --static void stat64_to_hostfs(const struct stat64 *buf, struct hostfs_stat *p) -+static void statx_to_hostfs(const struct statx *buf, struct hostfs_stat *p) - { -- p->ino = buf->st_ino; -- p->mode = buf->st_mode; -- p->nlink = buf->st_nlink; -- p->uid = buf->st_uid; -- p->gid = buf->st_gid; -- p->size = buf->st_size; -- p->atime.tv_sec = buf->st_atime; -- p->atime.tv_nsec = 0; -- p->ctime.tv_sec = buf->st_ctime; -- p->ctime.tv_nsec = 0; -- p->mtime.tv_sec = buf->st_mtime; -- p->mtime.tv_nsec = 0; -- p->blksize = buf->st_blksize; -- p->blocks = buf->st_blocks; -- p->rdev.maj = os_major(buf->st_rdev); -- p->rdev.min = os_minor(buf->st_rdev); -- p->dev.maj = os_major(buf->st_dev); -- p->dev.min = os_minor(buf->st_dev); -+ p->ino = buf->stx_ino; -+ p->mode = buf->stx_mode; -+ p->nlink = buf->stx_nlink; -+ p->uid = buf->stx_uid; -+ p->gid = buf->stx_gid; -+ p->size = buf->stx_size; -+ p->atime.tv_sec = buf->stx_atime.tv_sec; -+ p->atime.tv_nsec = buf->stx_atime.tv_nsec; -+ p->ctime.tv_sec = buf->stx_ctime.tv_sec; -+ p->ctime.tv_nsec = buf->stx_ctime.tv_nsec; -+ p->mtime.tv_sec = buf->stx_mtime.tv_sec; -+ p->mtime.tv_nsec = buf->stx_mtime.tv_nsec; -+ if (buf->stx_mask & STATX_BTIME) { -+ p->btime.tv_sec = buf->stx_btime.tv_sec; -+ p->btime.tv_nsec = buf->stx_btime.tv_nsec; -+ } else { -+ memset(&p->btime, 0, sizeof(p->btime)); -+ } -+ p->blksize = buf->stx_blksize; -+ p->blocks = buf->stx_blocks; -+ p->rdev.maj = buf->stx_rdev_major; -+ p->rdev.min = buf->stx_rdev_minor; -+ p->dev.maj = buf->stx_dev_major; -+ p->dev.min = buf->stx_dev_minor; - } - - int stat_file(const char *path, struct hostfs_stat *p, int fd) - { -- struct stat64 buf; -+ struct statx buf; -+ int flags = AT_SYMLINK_NOFOLLOW; - - if (fd >= 0) { -- if (fstat64(fd, &buf) < 0) -- return -errno; -- } else if (lstat64(path, &buf) < 0) { -- return -errno; -+ flags |= AT_EMPTY_PATH; -+ path = ""; - } -- stat64_to_hostfs(&buf, p); -+ -+ if ((statx(fd, path, flags, STATX_BASIC_STATS | STATX_BTIME, &buf)) < 0) -+ return -errno; -+ -+ statx_to_hostfs(&buf, p); - return 0; - } - -diff --git a/fs/isofs/dir.c b/fs/isofs/dir.c -index eb2f8273e6f15e..09df40b612fbf2 100644 ---- a/fs/isofs/dir.c -+++ b/fs/isofs/dir.c -@@ -147,7 +147,8 @@ static int do_isofs_readdir(struct inode *inode, struct file *file, - de = tmpde; - } - /* Basic sanity check, whether name doesn't exceed dir entry */ -- if (de_len < de->name_len[0] + -+ if (de_len < sizeof(struct iso_directory_record) || -+ de_len < de->name_len[0] + - sizeof(struct iso_directory_record)) { - printk(KERN_NOTICE "iso9660: Corrupted directory entry" - " in block %lu of inode %lu\n", block, -diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c -index 8f85177f284b5a..93db6eec446556 100644 ---- a/fs/jfs/jfs_dtree.c -+++ b/fs/jfs/jfs_dtree.c -@@ -117,7 +117,8 @@ do { \ - if (!(RC)) { \ - if (((P)->header.nextindex > \ - (((BN) == 0) ? DTROOTMAXSLOT : (P)->header.maxslot)) || \ -- ((BN) && ((P)->header.maxslot > DTPAGEMAXSLOT))) { \ -+ ((BN) && (((P)->header.maxslot > DTPAGEMAXSLOT) || \ -+ ((P)->header.stblindex >= DTPAGEMAXSLOT)))) { \ - BT_PUTPAGE(MP); \ - jfs_error((IP)->i_sb, \ - "DT_GETPAGE: dtree page corrupt\n"); \ -diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c -index 7252941bf165bc..b3b08c5ae701e2 100644 ---- a/fs/jfs/xattr.c -+++ b/fs/jfs/xattr.c -@@ -559,11 +559,16 @@ static int ea_get(struct inode *inode, struct ea_buffer *ea_buf, int min_size) - - size_check: - if (EALIST_SIZE(ea_buf->xattr) != ea_size) { -- int size = clamp_t(int, ea_size, 0, EALIST_SIZE(ea_buf->xattr)); -- -- printk(KERN_ERR "ea_get: invalid extended attribute\n"); -- print_hex_dump(KERN_ERR, "", DUMP_PREFIX_ADDRESS, 16, 1, -- ea_buf->xattr, size, 1); -+ if (unlikely(EALIST_SIZE(ea_buf->xattr) > INT_MAX)) { -+ printk(KERN_ERR "ea_get: extended attribute size too large: %u > INT_MAX\n", -+ EALIST_SIZE(ea_buf->xattr)); -+ } else { -+ int size = clamp_t(int, ea_size, 0, EALIST_SIZE(ea_buf->xattr)); -+ -+ printk(KERN_ERR "ea_get: invalid extended attribute\n"); -+ print_hex_dump(KERN_ERR, "", DUMP_PREFIX_ADDRESS, 16, 1, -+ ea_buf->xattr, size, 1); -+ } - ea_release(inode, ea_buf); - rc = -EIO; - goto clean_up; -diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c -index 4bf2526a3a1892..55cfa1c4e0a65d 100644 ---- a/fs/nfs/delegation.c -+++ b/fs/nfs/delegation.c -@@ -570,17 +570,6 @@ static bool nfs_delegation_need_return(struct nfs_delegation *delegation) - - if (test_and_clear_bit(NFS_DELEGATION_RETURN, &delegation->flags)) - ret = true; -- else if (test_bit(NFS_DELEGATION_RETURN_IF_CLOSED, &delegation->flags)) { -- struct inode *inode; -- -- spin_lock(&delegation->lock); -- inode = delegation->inode; -- if (inode && list_empty(&NFS_I(inode)->open_files)) -- ret = true; -- spin_unlock(&delegation->lock); -- } -- if (ret) -- clear_bit(NFS_DELEGATION_RETURN_IF_CLOSED, &delegation->flags); - if (test_bit(NFS_DELEGATION_RETURNING, &delegation->flags) || - test_bit(NFS_DELEGATION_RETURN_DELAYED, &delegation->flags) || - test_bit(NFS_DELEGATION_REVOKED, &delegation->flags)) -@@ -821,11 +810,25 @@ int nfs4_inode_make_writeable(struct inode *inode) - return nfs4_inode_return_delegation(inode); - } - --static void nfs_mark_return_if_closed_delegation(struct nfs_server *server, -- struct nfs_delegation *delegation) -+static void -+nfs_mark_return_if_closed_delegation(struct nfs_server *server, -+ struct nfs_delegation *delegation) - { -- set_bit(NFS_DELEGATION_RETURN_IF_CLOSED, &delegation->flags); -- set_bit(NFS4CLNT_DELEGRETURN, &server->nfs_client->cl_state); -+ struct inode *inode; -+ -+ if (test_bit(NFS_DELEGATION_RETURN, &delegation->flags) || -+ test_bit(NFS_DELEGATION_RETURN_IF_CLOSED, &delegation->flags)) -+ return; -+ spin_lock(&delegation->lock); -+ inode = delegation->inode; -+ if (!inode) -+ goto out; -+ if (list_empty(&NFS_I(inode)->open_files)) -+ nfs_mark_return_delegation(server, delegation); -+ else -+ set_bit(NFS_DELEGATION_RETURN_IF_CLOSED, &delegation->flags); -+out: -+ spin_unlock(&delegation->lock); - } - - static bool nfs_server_mark_return_all_delegations(struct nfs_server *server) -diff --git a/fs/nfs/sysfs.c b/fs/nfs/sysfs.c -index 7b59a40d40c061..784f7c1d003bfc 100644 ---- a/fs/nfs/sysfs.c -+++ b/fs/nfs/sysfs.c -@@ -14,6 +14,7 @@ - #include - #include - -+#include "internal.h" - #include "nfs4_fs.h" - #include "netns.h" - #include "sysfs.h" -@@ -228,6 +229,25 @@ static void shutdown_client(struct rpc_clnt *clnt) - rpc_cancel_tasks(clnt, -EIO, shutdown_match_client, NULL); - } - -+/* -+ * Shut down the nfs_client only once all the superblocks -+ * have been shut down. -+ */ -+static void shutdown_nfs_client(struct nfs_client *clp) -+{ -+ struct nfs_server *server; -+ rcu_read_lock(); -+ list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) { -+ if (!(server->flags & NFS_MOUNT_SHUTDOWN)) { -+ rcu_read_unlock(); -+ return; -+ } -+ } -+ rcu_read_unlock(); -+ nfs_mark_client_ready(clp, -EIO); -+ shutdown_client(clp->cl_rpcclient); -+} -+ - static ssize_t - shutdown_show(struct kobject *kobj, struct kobj_attribute *attr, - char *buf) -@@ -259,7 +279,6 @@ shutdown_store(struct kobject *kobj, struct kobj_attribute *attr, - - server->flags |= NFS_MOUNT_SHUTDOWN; - shutdown_client(server->client); -- shutdown_client(server->nfs_client->cl_rpcclient); - - if (!IS_ERR(server->client_acl)) - shutdown_client(server->client_acl); -@@ -267,6 +286,7 @@ shutdown_store(struct kobject *kobj, struct kobj_attribute *attr, - if (server->nlm_host) - shutdown_client(server->nlm_host->h_rpcclnt); - out: -+ shutdown_nfs_client(server->nfs_client); - return count; - } - -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index a25cb2ff1b0b64..140784446ad220 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -1066,6 +1066,12 @@ static struct nfs4_ol_stateid * nfs4_alloc_open_stateid(struct nfs4_client *clp) - return openlockstateid(stid); - } - -+/* -+ * As the sc_free callback of deleg, this may be called by nfs4_put_stid -+ * in nfsd_break_one_deleg. -+ * Considering nfsd_break_one_deleg is called with the flc->flc_lock held, -+ * this function mustn't ever sleep. -+ */ - static void nfs4_free_deleg(struct nfs4_stid *stid) - { - struct nfs4_delegation *dp = delegstateid(stid); -@@ -4920,6 +4926,7 @@ static const struct nfsd4_callback_ops nfsd4_cb_recall_ops = { - - static void nfsd_break_one_deleg(struct nfs4_delegation *dp) - { -+ bool queued; - /* - * We're assuming the state code never drops its reference - * without first removing the lease. Since we're in this lease -@@ -4928,7 +4935,10 @@ static void nfsd_break_one_deleg(struct nfs4_delegation *dp) - * we know it's safe to take a reference. - */ - refcount_inc(&dp->dl_stid.sc_count); -- WARN_ON_ONCE(!nfsd4_run_cb(&dp->dl_recall)); -+ queued = nfsd4_run_cb(&dp->dl_recall); -+ WARN_ON_ONCE(!queued); -+ if (!queued) -+ nfs4_put_stid(&dp->dl_stid); - } - - /* Called from break_lease() with flc_lock held. */ -@@ -6279,14 +6289,19 @@ deleg_reaper(struct nfsd_net *nn) - spin_lock(&nn->client_lock); - list_for_each_safe(pos, next, &nn->client_lru) { - clp = list_entry(pos, struct nfs4_client, cl_lru); -- if (clp->cl_state != NFSD4_ACTIVE || -- list_empty(&clp->cl_delegations) || -- atomic_read(&clp->cl_delegs_in_recall) || -- test_bit(NFSD4_CLIENT_CB_RECALL_ANY, &clp->cl_flags) || -- (ktime_get_boottime_seconds() - -- clp->cl_ra_time < 5)) { -+ -+ if (clp->cl_state != NFSD4_ACTIVE) -+ continue; -+ if (list_empty(&clp->cl_delegations)) -+ continue; -+ if (atomic_read(&clp->cl_delegs_in_recall)) -+ continue; -+ if (test_bit(NFSD4_CLIENT_CB_RECALL_ANY, &clp->cl_flags)) -+ continue; -+ if (ktime_get_boottime_seconds() - clp->cl_ra_time < 5) -+ continue; -+ if (clp->cl_cb_state != NFSD4_CB_UP) - continue; -- } - list_add(&clp->cl_ra_cblist, &cblist); - - /* release in nfsd4_cb_recall_any_release */ -diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c -index 9089c58a005ce1..28aae6ea1e615e 100644 ---- a/fs/ntfs3/index.c -+++ b/fs/ntfs3/index.c -@@ -618,7 +618,7 @@ static bool index_hdr_check(const struct INDEX_HDR *hdr, u32 bytes) - u32 off = le32_to_cpu(hdr->de_off); - - if (!IS_ALIGNED(off, 8) || tot > bytes || end > tot || -- off + sizeof(struct NTFS_DE) > end) { -+ size_add(off, sizeof(struct NTFS_DE)) > end) { - /* incorrect index buffer. */ - return false; - } -@@ -736,7 +736,7 @@ static struct NTFS_DE *hdr_find_e(const struct ntfs_index *indx, - if (end > total) - return NULL; - -- if (off + sizeof(struct NTFS_DE) > end) -+ if (size_add(off, sizeof(struct NTFS_DE)) > end) - return NULL; - - e = Add2Ptr(hdr, off); -diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h -index 964e27c7b90164..c1d1c4a7cf4d60 100644 ---- a/fs/ntfs3/ntfs.h -+++ b/fs/ntfs3/ntfs.h -@@ -717,7 +717,7 @@ static inline struct NTFS_DE *hdr_first_de(const struct INDEX_HDR *hdr) - struct NTFS_DE *e; - u16 esize; - -- if (de_off >= used || de_off + sizeof(struct NTFS_DE) > used ) -+ if (de_off >= used || size_add(de_off, sizeof(struct NTFS_DE)) > used) - return NULL; - - e = Add2Ptr(hdr, de_off); -diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c -index f0937902f7b46e..e6191249169e62 100644 ---- a/fs/ocfs2/alloc.c -+++ b/fs/ocfs2/alloc.c -@@ -1796,6 +1796,14 @@ static int __ocfs2_find_path(struct ocfs2_caching_info *ci, - - el = root_el; - while (el->l_tree_depth) { -+ if (unlikely(le16_to_cpu(el->l_tree_depth) >= OCFS2_MAX_PATH_DEPTH)) { -+ ocfs2_error(ocfs2_metadata_cache_get_super(ci), -+ "Owner %llu has invalid tree depth %u in extent list\n", -+ (unsigned long long)ocfs2_metadata_cache_owner(ci), -+ le16_to_cpu(el->l_tree_depth)); -+ ret = -EROFS; -+ goto out; -+ } - if (le16_to_cpu(el->l_next_free_rec) == 0) { - ocfs2_error(ocfs2_metadata_cache_get_super(ci), - "Owner %llu has empty extent list at depth %u\n", -diff --git a/fs/proc/base.c b/fs/proc/base.c -index 91fe20b7657c09..d444155581cabc 100644 ---- a/fs/proc/base.c -+++ b/fs/proc/base.c -@@ -416,7 +416,7 @@ static const struct file_operations proc_pid_cmdline_ops = { - #ifdef CONFIG_KALLSYMS - /* - * Provides a wchan file via kallsyms in a proper one-value-per-file format. -- * Returns the resolved symbol. If that fails, simply return the address. -+ * Returns the resolved symbol to user space. - */ - static int proc_pid_wchan(struct seq_file *m, struct pid_namespace *ns, - struct pid *pid, struct task_struct *task) -diff --git a/fs/smb/client/cifsacl.c b/fs/smb/client/cifsacl.c -index 1fc1683b15bd84..db9076da2182ad 100644 ---- a/fs/smb/client/cifsacl.c -+++ b/fs/smb/client/cifsacl.c -@@ -778,7 +778,8 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - } - - /* validate that we do not go past end of acl */ -- if (end_of_acl < (char *)pdacl + le16_to_cpu(pdacl->size)) { -+ if (end_of_acl < (char *)pdacl + sizeof(struct smb_acl) || -+ end_of_acl < (char *)pdacl + le16_to_cpu(pdacl->size)) { - cifs_dbg(VFS, "ACL too small to parse DACL\n"); - return; - } -@@ -799,8 +800,11 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - if (num_aces > 0) { - umode_t denied_mode = 0; - -- if (num_aces > ULONG_MAX / sizeof(struct smb_ace *)) -+ if (num_aces > (le16_to_cpu(pdacl->size) - sizeof(struct smb_acl)) / -+ (offsetof(struct smb_ace, sid) + -+ offsetof(struct smb_sid, sub_auth) + sizeof(__le16))) - return; -+ - ppace = kmalloc_array(num_aces, sizeof(struct smb_ace *), - GFP_KERNEL); - if (!ppace) -diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c -index 198681d14153ea..2d2e41ac9e9d83 100644 ---- a/fs/smb/client/connect.c -+++ b/fs/smb/client/connect.c -@@ -316,6 +316,7 @@ cifs_abort_connection(struct TCP_Server_Info *server) - server->ssocket->flags); - sock_release(server->ssocket); - server->ssocket = NULL; -+ put_net(cifs_net_ns(server)); - } - server->sequence_number = 0; - server->session_estab = false; -@@ -3147,8 +3148,12 @@ generic_ip_connect(struct TCP_Server_Info *server) - /* - * Grab netns reference for the socket. - * -- * It'll be released here, on error, or in clean_demultiplex_info() upon server -- * teardown. -+ * This reference will be released in several situations: -+ * - In the failure path before the cifsd thread is started. -+ * - In the all place where server->socket is released, it is -+ * also set to NULL. -+ * - Ultimately in clean_demultiplex_info(), during the final -+ * teardown. - */ - get_net(net); - -@@ -3164,10 +3169,8 @@ generic_ip_connect(struct TCP_Server_Info *server) - } - - rc = bind_socket(server); -- if (rc < 0) { -- put_net(cifs_net_ns(server)); -+ if (rc < 0) - return rc; -- } - - /* - * Eventually check for other socket options to change from -@@ -3213,9 +3216,6 @@ generic_ip_connect(struct TCP_Server_Info *server) - if (sport == htons(RFC1001_PORT)) - rc = ip_rfc1001_connect(server); - -- if (rc < 0) -- put_net(cifs_net_ns(server)); -- - return rc; - } - -diff --git a/fs/smb/server/auth.c b/fs/smb/server/auth.c -index 58380a986af55c..5345d2417c7fc9 100644 ---- a/fs/smb/server/auth.c -+++ b/fs/smb/server/auth.c -@@ -1012,9 +1012,9 @@ static int ksmbd_get_encryption_key(struct ksmbd_work *work, __u64 ses_id, - - ses_enc_key = enc ? sess->smb3encryptionkey : - sess->smb3decryptionkey; -- if (enc) -- ksmbd_user_session_get(sess); - memcpy(key, ses_enc_key, SMB3_ENC_DEC_KEY_SIZE); -+ if (!enc) -+ ksmbd_user_session_put(sess); - - return 0; - } -@@ -1213,7 +1213,7 @@ int ksmbd_crypt_message(struct ksmbd_work *work, struct kvec *iov, - free_sg: - kfree(sg); - free_req: -- kfree(req); -+ aead_request_free(req); - free_ctx: - ksmbd_release_crypto_ctx(ctx); - return rc; -diff --git a/fs/smb/server/mgmt/user_session.c b/fs/smb/server/mgmt/user_session.c -index 9a134181df61f0..82dcc86a32c57a 100644 ---- a/fs/smb/server/mgmt/user_session.c -+++ b/fs/smb/server/mgmt/user_session.c -@@ -180,7 +180,7 @@ static void ksmbd_expire_session(struct ksmbd_conn *conn) - down_write(&sessions_table_lock); - down_write(&conn->session_lock); - xa_for_each(&conn->sessions, id, sess) { -- if (atomic_read(&sess->refcnt) == 0 && -+ if (atomic_read(&sess->refcnt) <= 1 && - (sess->state != SMB2_SESSION_VALID || - time_after(jiffies, - sess->last_active + SMB2_SESSION_TIMEOUT))) { -@@ -229,7 +229,11 @@ void ksmbd_sessions_deregister(struct ksmbd_conn *conn) - if (!ksmbd_chann_del(conn, sess) && - xa_empty(&sess->ksmbd_chann_list)) { - hash_del(&sess->hlist); -- ksmbd_session_destroy(sess); -+ down_write(&conn->session_lock); -+ xa_erase(&conn->sessions, sess->id); -+ up_write(&conn->session_lock); -+ if (atomic_dec_and_test(&sess->refcnt)) -+ ksmbd_session_destroy(sess); - } - } - } -@@ -248,13 +252,30 @@ void ksmbd_sessions_deregister(struct ksmbd_conn *conn) - if (xa_empty(&sess->ksmbd_chann_list)) { - xa_erase(&conn->sessions, sess->id); - hash_del(&sess->hlist); -- ksmbd_session_destroy(sess); -+ if (atomic_dec_and_test(&sess->refcnt)) -+ ksmbd_session_destroy(sess); - } - } - up_write(&conn->session_lock); - up_write(&sessions_table_lock); - } - -+bool is_ksmbd_session_in_connection(struct ksmbd_conn *conn, -+ unsigned long long id) -+{ -+ struct ksmbd_session *sess; -+ -+ down_read(&conn->session_lock); -+ sess = xa_load(&conn->sessions, id); -+ if (sess) { -+ up_read(&conn->session_lock); -+ return true; -+ } -+ up_read(&conn->session_lock); -+ -+ return false; -+} -+ - struct ksmbd_session *ksmbd_session_lookup(struct ksmbd_conn *conn, - unsigned long long id) - { -@@ -308,8 +329,8 @@ void ksmbd_user_session_put(struct ksmbd_session *sess) - - if (atomic_read(&sess->refcnt) <= 0) - WARN_ON(1); -- else -- atomic_dec(&sess->refcnt); -+ else if (atomic_dec_and_test(&sess->refcnt)) -+ ksmbd_session_destroy(sess); - } - - struct preauth_session *ksmbd_preauth_session_alloc(struct ksmbd_conn *conn, -@@ -414,7 +435,7 @@ static struct ksmbd_session *__session_create(int protocol) - xa_init(&sess->rpc_handle_list); - sess->sequence_number = 1; - rwlock_init(&sess->tree_conns_lock); -- atomic_set(&sess->refcnt, 1); -+ atomic_set(&sess->refcnt, 2); - - ret = __init_smb2_session(sess); - if (ret) -diff --git a/fs/smb/server/mgmt/user_session.h b/fs/smb/server/mgmt/user_session.h -index c1c4b20bd5c6cf..f21348381d5984 100644 ---- a/fs/smb/server/mgmt/user_session.h -+++ b/fs/smb/server/mgmt/user_session.h -@@ -87,6 +87,8 @@ void ksmbd_session_destroy(struct ksmbd_session *sess); - struct ksmbd_session *ksmbd_session_lookup_slowpath(unsigned long long id); - struct ksmbd_session *ksmbd_session_lookup(struct ksmbd_conn *conn, - unsigned long long id); -+bool is_ksmbd_session_in_connection(struct ksmbd_conn *conn, -+ unsigned long long id); - int ksmbd_session_register(struct ksmbd_conn *conn, - struct ksmbd_session *sess); - void ksmbd_sessions_deregister(struct ksmbd_conn *conn); -diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c -index 11e82a14a40add..371a5ead86635d 100644 ---- a/fs/smb/server/oplock.c -+++ b/fs/smb/server/oplock.c -@@ -724,8 +724,8 @@ static int smb2_oplock_break_noti(struct oplock_info *opinfo) - work->conn = conn; - work->sess = opinfo->sess; - -+ ksmbd_conn_r_count_inc(conn); - if (opinfo->op_state == OPLOCK_ACK_WAIT) { -- ksmbd_conn_r_count_inc(conn); - INIT_WORK(&work->work, __smb2_oplock_break_noti); - ksmbd_queue_work(work); - -@@ -833,8 +833,8 @@ static int smb2_lease_break_noti(struct oplock_info *opinfo) - work->conn = conn; - work->sess = opinfo->sess; - -+ ksmbd_conn_r_count_inc(conn); - if (opinfo->op_state == OPLOCK_ACK_WAIT) { -- ksmbd_conn_r_count_inc(conn); - INIT_WORK(&work->work, __smb2_lease_break_noti); - ksmbd_queue_work(work); - wait_for_break_ack(opinfo); -@@ -1505,6 +1505,10 @@ struct lease_ctx_info *parse_lease_state(void *open_req) - if (sizeof(struct lease_context_v2) == le32_to_cpu(cc->DataLength)) { - struct create_lease_v2 *lc = (struct create_lease_v2 *)cc; - -+ if (le16_to_cpu(cc->DataOffset) + le32_to_cpu(cc->DataLength) < -+ sizeof(struct create_lease_v2) - 4) -+ return NULL; -+ - memcpy(lreq->lease_key, lc->lcontext.LeaseKey, SMB2_LEASE_KEY_SIZE); - lreq->req_state = lc->lcontext.LeaseState; - lreq->flags = lc->lcontext.LeaseFlags; -@@ -1517,6 +1521,10 @@ struct lease_ctx_info *parse_lease_state(void *open_req) - } else { - struct create_lease *lc = (struct create_lease *)cc; - -+ if (le16_to_cpu(cc->DataOffset) + le32_to_cpu(cc->DataLength) < -+ sizeof(struct create_lease)) -+ return NULL; -+ - memcpy(lreq->lease_key, lc->lcontext.LeaseKey, SMB2_LEASE_KEY_SIZE); - lreq->req_state = lc->lcontext.LeaseState; - lreq->flags = lc->lcontext.LeaseFlags; -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index 58e5cc2b1f3e1d..8877f9e900b2fb 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -1707,44 +1707,38 @@ int smb2_sess_setup(struct ksmbd_work *work) - - if (conn->dialect != sess->dialect) { - rc = -EINVAL; -- ksmbd_user_session_put(sess); - goto out_err; - } - - if (!(req->hdr.Flags & SMB2_FLAGS_SIGNED)) { - rc = -EINVAL; -- ksmbd_user_session_put(sess); - goto out_err; - } - - if (strncmp(conn->ClientGUID, sess->ClientGUID, - SMB2_CLIENT_GUID_SIZE)) { - rc = -ENOENT; -- ksmbd_user_session_put(sess); - goto out_err; - } - - if (sess->state == SMB2_SESSION_IN_PROGRESS) { - rc = -EACCES; -- ksmbd_user_session_put(sess); - goto out_err; - } - - if (sess->state == SMB2_SESSION_EXPIRED) { - rc = -EFAULT; -- ksmbd_user_session_put(sess); - goto out_err; - } -- ksmbd_user_session_put(sess); - - if (ksmbd_conn_need_reconnect(conn)) { - rc = -EFAULT; -+ ksmbd_user_session_put(sess); - sess = NULL; - goto out_err; - } - -- sess = ksmbd_session_lookup(conn, sess_id); -- if (!sess) { -+ if (is_ksmbd_session_in_connection(conn, sess_id)) { - rc = -EACCES; - goto out_err; - } -@@ -1910,6 +1904,8 @@ int smb2_sess_setup(struct ksmbd_work *work) - - sess->last_active = jiffies; - sess->state = SMB2_SESSION_EXPIRED; -+ ksmbd_user_session_put(sess); -+ work->sess = NULL; - if (try_delay) { - ksmbd_conn_set_need_reconnect(conn); - ssleep(5); -@@ -2235,13 +2231,14 @@ int smb2_session_logoff(struct ksmbd_work *work) - return -ENOENT; - } - -- ksmbd_destroy_file_table(&sess->file_table); - down_write(&conn->session_lock); - sess->state = SMB2_SESSION_EXPIRED; - up_write(&conn->session_lock); - -- ksmbd_free_user(sess->user); -- sess->user = NULL; -+ if (sess->user) { -+ ksmbd_free_user(sess->user); -+ sess->user = NULL; -+ } - ksmbd_all_conn_set_status(sess_id, KSMBD_SESS_NEED_NEGOTIATE); - - rsp->StructureSize = cpu_to_le16(4); -@@ -2704,6 +2701,13 @@ static int parse_durable_handle_context(struct ksmbd_work *work, - goto out; - } - -+ if (le16_to_cpu(context->DataOffset) + -+ le32_to_cpu(context->DataLength) < -+ sizeof(struct create_durable_reconn_v2_req)) { -+ err = -EINVAL; -+ goto out; -+ } -+ - recon_v2 = (struct create_durable_reconn_v2_req *)context; - persistent_id = recon_v2->Fid.PersistentFileId; - dh_info->fp = ksmbd_lookup_durable_fd(persistent_id); -@@ -2737,6 +2741,13 @@ static int parse_durable_handle_context(struct ksmbd_work *work, - goto out; - } - -+ if (le16_to_cpu(context->DataOffset) + -+ le32_to_cpu(context->DataLength) < -+ sizeof(struct create_durable_reconn_req)) { -+ err = -EINVAL; -+ goto out; -+ } -+ - recon = (struct create_durable_reconn_req *)context; - persistent_id = recon->Data.Fid.PersistentFileId; - dh_info->fp = ksmbd_lookup_durable_fd(persistent_id); -@@ -2762,6 +2773,13 @@ static int parse_durable_handle_context(struct ksmbd_work *work, - goto out; - } - -+ if (le16_to_cpu(context->DataOffset) + -+ le32_to_cpu(context->DataLength) < -+ sizeof(struct create_durable_req_v2)) { -+ err = -EINVAL; -+ goto out; -+ } -+ - durable_v2_blob = - (struct create_durable_req_v2 *)context; - ksmbd_debug(SMB, "Request for durable v2 open\n"); -diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c -index 109036e2227ca1..b90f893762f447 100644 ---- a/fs/smb/server/smbacl.c -+++ b/fs/smb/server/smbacl.c -@@ -270,6 +270,11 @@ static int sid_to_id(struct mnt_idmap *idmap, - return -EIO; - } - -+ if (psid->num_subauth == 0) { -+ pr_err("%s: zero subauthorities!\n", __func__); -+ return -EIO; -+ } -+ - if (sidtype == SIDOWNER) { - kuid_t uid; - uid_t id; -diff --git a/include/drm/display/drm_dp_mst_helper.h b/include/drm/display/drm_dp_mst_helper.h -index 46705dacdd0816..7751be9452c150 100644 ---- a/include/drm/display/drm_dp_mst_helper.h -+++ b/include/drm/display/drm_dp_mst_helper.h -@@ -215,6 +215,13 @@ struct drm_dp_mst_branch { - */ - struct list_head destroy_next; - -+ /** -+ * @rad: Relative Address of the MST branch. -+ * For &drm_dp_mst_topology_mgr.mst_primary, it's rad[8] are all 0, -+ * unset and unused. For MST branches connected after mst_primary, -+ * in each element of rad[] the nibbles are ordered by the most -+ * signifcant 4 bits first and the least significant 4 bits second. -+ */ - u8 rad[8]; - u8 lct; - int num_ports; -diff --git a/include/linux/context_tracking_irq.h b/include/linux/context_tracking_irq.h -index c50b5670c4a52f..197916ee91a4bd 100644 ---- a/include/linux/context_tracking_irq.h -+++ b/include/linux/context_tracking_irq.h -@@ -10,12 +10,12 @@ void ct_irq_exit_irqson(void); - void ct_nmi_enter(void); - void ct_nmi_exit(void); - #else --static inline void ct_irq_enter(void) { } --static inline void ct_irq_exit(void) { } -+static __always_inline void ct_irq_enter(void) { } -+static __always_inline void ct_irq_exit(void) { } - static inline void ct_irq_enter_irqson(void) { } - static inline void ct_irq_exit_irqson(void) { } --static inline void ct_nmi_enter(void) { } --static inline void ct_nmi_exit(void) { } -+static __always_inline void ct_nmi_enter(void) { } -+static __always_inline void ct_nmi_exit(void) { } - #endif - - #endif -diff --git a/include/linux/coresight.h b/include/linux/coresight.h -index a269fffaf991ce..dccfadde84f41d 100644 ---- a/include/linux/coresight.h -+++ b/include/linux/coresight.h -@@ -575,6 +575,10 @@ extern int coresight_enable(struct coresight_device *csdev); - extern void coresight_disable(struct coresight_device *csdev); - extern int coresight_timeout(struct csdev_access *csa, u32 offset, - int position, int value); -+typedef void (*coresight_timeout_cb_t) (struct csdev_access *, u32, int, int); -+extern int coresight_timeout_action(struct csdev_access *csa, u32 offset, -+ int position, int value, -+ coresight_timeout_cb_t cb); - - extern int coresight_claim_device(struct coresight_device *csdev); - extern int coresight_claim_device_unlocked(struct coresight_device *csdev); -diff --git a/include/linux/fwnode.h b/include/linux/fwnode.h -index 525cc031596b68..7efb4493e51c03 100644 ---- a/include/linux/fwnode.h -+++ b/include/linux/fwnode.h -@@ -83,7 +83,7 @@ struct fwnode_endpoint { - #define SWNODE_GRAPH_PORT_NAME_FMT "port@%u" - #define SWNODE_GRAPH_ENDPOINT_NAME_FMT "endpoint@%u" - --#define NR_FWNODE_REFERENCE_ARGS 8 -+#define NR_FWNODE_REFERENCE_ARGS 16 - - /** - * struct fwnode_reference_args - Fwnode reference with additional arguments -diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h -index 4a1dc88ddbff9a..2610a7d156da85 100644 ---- a/include/linux/interrupt.h -+++ b/include/linux/interrupt.h -@@ -441,7 +441,7 @@ irq_calc_affinity_vectors(unsigned int minvec, unsigned int maxvec, - static inline void disable_irq_nosync_lockdep(unsigned int irq) - { - disable_irq_nosync(irq); --#ifdef CONFIG_LOCKDEP -+#if defined(CONFIG_LOCKDEP) && !defined(CONFIG_PREEMPT_RT) - local_irq_disable(); - #endif - } -@@ -449,7 +449,7 @@ static inline void disable_irq_nosync_lockdep(unsigned int irq) - static inline void disable_irq_nosync_lockdep_irqsave(unsigned int irq, unsigned long *flags) - { - disable_irq_nosync(irq); --#ifdef CONFIG_LOCKDEP -+#if defined(CONFIG_LOCKDEP) && !defined(CONFIG_PREEMPT_RT) - local_irq_save(*flags); - #endif - } -@@ -464,7 +464,7 @@ static inline void disable_irq_lockdep(unsigned int irq) - - static inline void enable_irq_lockdep(unsigned int irq) - { --#ifdef CONFIG_LOCKDEP -+#if defined(CONFIG_LOCKDEP) && !defined(CONFIG_PREEMPT_RT) - local_irq_enable(); - #endif - enable_irq(irq); -@@ -472,7 +472,7 @@ static inline void enable_irq_lockdep(unsigned int irq) - - static inline void enable_irq_lockdep_irqrestore(unsigned int irq, unsigned long *flags) - { --#ifdef CONFIG_LOCKDEP -+#if defined(CONFIG_LOCKDEP) && !defined(CONFIG_PREEMPT_RT) - local_irq_restore(*flags); - #endif - enable_irq(irq); -diff --git a/include/linux/pgtable.h b/include/linux/pgtable.h -index 8b7daccd11bef2..3c3a7dede0ef5b 100644 ---- a/include/linux/pgtable.h -+++ b/include/linux/pgtable.h -@@ -1286,14 +1286,25 @@ static inline void track_pfn_insert(struct vm_area_struct *vma, pgprot_t *prot, - } - - /* -- * track_pfn_copy is called when vma that is covering the pfnmap gets -- * copied through copy_page_range(). -+ * track_pfn_copy is called when a VM_PFNMAP VMA is about to get the page -+ * tables copied during copy_page_range(). On success, stores the pfn to be -+ * passed to untrack_pfn_copy(). - */ --static inline int track_pfn_copy(struct vm_area_struct *vma) -+static inline int track_pfn_copy(struct vm_area_struct *dst_vma, -+ struct vm_area_struct *src_vma, unsigned long *pfn) - { - return 0; - } - -+/* -+ * untrack_pfn_copy is called when a VM_PFNMAP VMA failed to copy during -+ * copy_page_range(), but after track_pfn_copy() was already called. -+ */ -+static inline void untrack_pfn_copy(struct vm_area_struct *dst_vma, -+ unsigned long pfn) -+{ -+} -+ - /* - * untrack_pfn is called while unmapping a pfnmap for a region. - * untrack can be called for a specific region indicated by pfn and size or -@@ -1306,8 +1317,10 @@ static inline void untrack_pfn(struct vm_area_struct *vma, - } - - /* -- * untrack_pfn_clear is called while mremapping a pfnmap for a new region -- * or fails to copy pgtable during duplicate vm area. -+ * untrack_pfn_clear is called in the following cases on a VM_PFNMAP VMA: -+ * -+ * 1) During mremap() on the src VMA after the page tables were moved. -+ * 2) During fork() on the dst VMA, immediately after duplicating the src VMA. - */ - static inline void untrack_pfn_clear(struct vm_area_struct *vma) - { -@@ -1318,7 +1331,10 @@ extern int track_pfn_remap(struct vm_area_struct *vma, pgprot_t *prot, - unsigned long size); - extern void track_pfn_insert(struct vm_area_struct *vma, pgprot_t *prot, - pfn_t pfn); --extern int track_pfn_copy(struct vm_area_struct *vma); -+extern int track_pfn_copy(struct vm_area_struct *dst_vma, -+ struct vm_area_struct *src_vma, unsigned long *pfn); -+extern void untrack_pfn_copy(struct vm_area_struct *dst_vma, -+ unsigned long pfn); - extern void untrack_pfn(struct vm_area_struct *vma, unsigned long pfn, - unsigned long size, bool mm_wr_locked); - extern void untrack_pfn_clear(struct vm_area_struct *vma); -diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h -index 7c9b3544856343..406855d73901a4 100644 ---- a/include/linux/pm_runtime.h -+++ b/include/linux/pm_runtime.h -@@ -66,6 +66,7 @@ static inline bool queue_pm_work(struct work_struct *work) - - extern int pm_generic_runtime_suspend(struct device *dev); - extern int pm_generic_runtime_resume(struct device *dev); -+extern bool pm_runtime_need_not_resume(struct device *dev); - extern int pm_runtime_force_suspend(struct device *dev); - extern int pm_runtime_force_resume(struct device *dev); - -@@ -252,6 +253,7 @@ static inline bool queue_pm_work(struct work_struct *work) { return false; } - - static inline int pm_generic_runtime_suspend(struct device *dev) { return 0; } - static inline int pm_generic_runtime_resume(struct device *dev) { return 0; } -+static inline bool pm_runtime_need_not_resume(struct device *dev) {return true; } - static inline int pm_runtime_force_suspend(struct device *dev) { return 0; } - static inline int pm_runtime_force_resume(struct device *dev) { return 0; } - -diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h -index 7602d1f8a9ecb3..72da69cc5764f3 100644 ---- a/include/linux/rcupdate.h -+++ b/include/linux/rcupdate.h -@@ -142,7 +142,7 @@ static inline void rcu_sysrq_end(void) { } - #if defined(CONFIG_NO_HZ_FULL) && (!defined(CONFIG_GENERIC_ENTRY) || !defined(CONFIG_KVM_XFER_TO_GUEST_WORK)) - void rcu_irq_work_resched(void); - #else --static inline void rcu_irq_work_resched(void) { } -+static __always_inline void rcu_irq_work_resched(void) { } - #endif - - #ifdef CONFIG_RCU_NOCB_CPU -diff --git a/include/linux/sched/smt.h b/include/linux/sched/smt.h -index 59d3736c454cf8..737b50f40137bf 100644 ---- a/include/linux/sched/smt.h -+++ b/include/linux/sched/smt.h -@@ -12,7 +12,7 @@ static __always_inline bool sched_smt_active(void) - return static_branch_likely(&sched_smt_present); - } - #else --static inline bool sched_smt_active(void) { return false; } -+static __always_inline bool sched_smt_active(void) { return false; } - #endif - - void arch_smt_update(void); -diff --git a/include/linux/trace.h b/include/linux/trace.h -index 2a70a447184c9e..fdcd76b7be83d7 100644 ---- a/include/linux/trace.h -+++ b/include/linux/trace.h -@@ -51,7 +51,7 @@ int trace_array_printk(struct trace_array *tr, unsigned long ip, - const char *fmt, ...); - int trace_array_init_printk(struct trace_array *tr); - void trace_array_put(struct trace_array *tr); --struct trace_array *trace_array_get_by_name(const char *name); -+struct trace_array *trace_array_get_by_name(const char *name, const char *systems); - int trace_array_destroy(struct trace_array *tr); - - /* For osnoise tracer */ -@@ -84,7 +84,7 @@ static inline int trace_array_init_printk(struct trace_array *tr) - static inline void trace_array_put(struct trace_array *tr) - { - } --static inline struct trace_array *trace_array_get_by_name(const char *name) -+static inline struct trace_array *trace_array_get_by_name(const char *name, const char *systems) - { - return NULL; - } -diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h -index aa1bc417266208..fe95d13c5e4d86 100644 ---- a/include/linux/trace_events.h -+++ b/include/linux/trace_events.h -@@ -683,6 +683,20 @@ struct trace_event_file { - atomic_t tm_ref; /* trigger-mode reference counter */ - }; - -+#ifdef CONFIG_HIST_TRIGGERS -+extern struct irq_work hist_poll_work; -+extern wait_queue_head_t hist_poll_wq; -+ -+static inline void hist_poll_wakeup(void) -+{ -+ if (wq_has_sleeper(&hist_poll_wq)) -+ irq_work_queue(&hist_poll_work); -+} -+ -+#define hist_poll_wait(file, wait) \ -+ poll_wait(file, &hist_poll_wq, wait) -+#endif -+ - #define __TRACE_EVENT_FLAGS(name, value) \ - static int __init trace_init_flags_##name(void) \ - { \ -diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h -index bc459d06162971..c7e9ec9e9a802a 100644 ---- a/include/rdma/ib_verbs.h -+++ b/include/rdma/ib_verbs.h -@@ -2738,6 +2738,7 @@ struct ib_device { - * It is a NULL terminated array. - */ - const struct attribute_group *groups[4]; -+ u8 hw_stats_attr_index; - - u64 uverbs_cmd_mask; - -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 4dd8936b5aa09a..b710976fb01b17 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -2333,6 +2333,7 @@ group_sched_out(struct perf_event *group_event, struct perf_event_context *ctx) - #define DETACH_GROUP 0x01UL - #define DETACH_CHILD 0x02UL - #define DETACH_DEAD 0x04UL -+#define DETACH_EXIT 0x08UL - - /* - * Cross CPU call to remove a performance event -@@ -2347,6 +2348,7 @@ __perf_remove_from_context(struct perf_event *event, - void *info) - { - struct perf_event_pmu_context *pmu_ctx = event->pmu_ctx; -+ enum perf_event_state state = PERF_EVENT_STATE_OFF; - unsigned long flags = (unsigned long)info; - - if (ctx->is_active & EVENT_TIME) { -@@ -2358,16 +2360,19 @@ __perf_remove_from_context(struct perf_event *event, - * Ensure event_sched_out() switches to OFF, at the very least - * this avoids raising perf_pending_task() at this time. - */ -- if (flags & DETACH_DEAD) -+ if (flags & DETACH_EXIT) -+ state = PERF_EVENT_STATE_EXIT; -+ if (flags & DETACH_DEAD) { - event->pending_disable = 1; -+ state = PERF_EVENT_STATE_DEAD; -+ } - event_sched_out(event, ctx); -+ perf_event_set_state(event, min(event->state, state)); - if (flags & DETACH_GROUP) - perf_group_detach(event); - if (flags & DETACH_CHILD) - perf_child_detach(event); - list_del_event(event, ctx); -- if (flags & DETACH_DEAD) -- event->state = PERF_EVENT_STATE_DEAD; - - if (!pmu_ctx->nr_events) { - pmu_ctx->rotate_necessary = 0; -@@ -11556,6 +11561,21 @@ static int pmu_dev_alloc(struct pmu *pmu) - static struct lock_class_key cpuctx_mutex; - static struct lock_class_key cpuctx_lock; - -+static bool idr_cmpxchg(struct idr *idr, unsigned long id, void *old, void *new) -+{ -+ void *tmp, *val = idr_find(idr, id); -+ -+ if (val != old) -+ return false; -+ -+ tmp = idr_replace(idr, new, id); -+ if (IS_ERR(tmp)) -+ return false; -+ -+ WARN_ON_ONCE(tmp != val); -+ return true; -+} -+ - int perf_pmu_register(struct pmu *pmu, const char *name, int type) - { - int cpu, ret, max = PERF_TYPE_MAX; -@@ -11577,7 +11597,7 @@ int perf_pmu_register(struct pmu *pmu, const char *name, int type) - if (type >= 0) - max = type; - -- ret = idr_alloc(&pmu_idr, pmu, max, 0, GFP_KERNEL); -+ ret = idr_alloc(&pmu_idr, NULL, max, 0, GFP_KERNEL); - if (ret < 0) - goto free_pdc; - -@@ -11585,6 +11605,7 @@ int perf_pmu_register(struct pmu *pmu, const char *name, int type) - - type = ret; - pmu->type = type; -+ atomic_set(&pmu->exclusive_cnt, 0); - - if (pmu_bus_running && !pmu->dev) { - ret = pmu_dev_alloc(pmu); -@@ -11633,14 +11654,22 @@ int perf_pmu_register(struct pmu *pmu, const char *name, int type) - if (!pmu->event_idx) - pmu->event_idx = perf_event_idx_default; - -+ /* -+ * Now that the PMU is complete, make it visible to perf_try_init_event(). -+ */ -+ if (!idr_cmpxchg(&pmu_idr, pmu->type, NULL, pmu)) -+ goto free_context; - list_add_rcu(&pmu->entry, &pmus); -- atomic_set(&pmu->exclusive_cnt, 0); -+ - ret = 0; - unlock: - mutex_unlock(&pmus_lock); - - return ret; - -+free_context: -+ free_percpu(pmu->cpu_pmu_context); -+ - free_dev: - if (pmu->dev && pmu->dev != PMU_NULL_DEV) { - device_del(pmu->dev); -@@ -13116,12 +13145,7 @@ perf_event_exit_event(struct perf_event *event, struct perf_event_context *ctx) - mutex_lock(&parent_event->child_mutex); - } - -- perf_remove_from_context(event, detach_flags); -- -- raw_spin_lock_irq(&ctx->lock); -- if (event->state > PERF_EVENT_STATE_EXIT) -- perf_event_set_state(event, PERF_EVENT_STATE_EXIT); -- raw_spin_unlock_irq(&ctx->lock); -+ perf_remove_from_context(event, detach_flags | DETACH_EXIT); - - /* - * Child events can be freed. -diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c -index b0930b41855276..52de76ef8723b8 100644 ---- a/kernel/events/ring_buffer.c -+++ b/kernel/events/ring_buffer.c -@@ -19,7 +19,7 @@ - - static void perf_output_wakeup(struct perf_output_handle *handle) - { -- atomic_set(&handle->rb->poll, EPOLLIN); -+ atomic_set(&handle->rb->poll, EPOLLIN | EPOLLRDNORM); - - handle->event->pending_wakeup = 1; - irq_work_queue(&handle->event->pending_irq); -diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c -index f5dfc2f22d798b..a554f43d3ceb9e 100644 ---- a/kernel/events/uprobes.c -+++ b/kernel/events/uprobes.c -@@ -159,6 +159,7 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr, - DEFINE_FOLIO_VMA_WALK(pvmw, old_folio, vma, addr, 0); - int err; - struct mmu_notifier_range range; -+ pte_t pte; - - mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, mm, addr, - addr + PAGE_SIZE); -@@ -178,6 +179,16 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr, - if (!page_vma_mapped_walk(&pvmw)) - goto unlock; - VM_BUG_ON_PAGE(addr != pvmw.address, old_page); -+ pte = ptep_get(pvmw.pte); -+ -+ /* -+ * Handle PFN swap PTES, such as device-exclusive ones, that actually -+ * map pages: simply trigger GUP again to fix it up. -+ */ -+ if (unlikely(!pte_present(pte))) { -+ page_vma_mapped_walk_done(&pvmw); -+ goto unlock; -+ } - - if (new_page) { - folio_get(new_folio); -@@ -192,7 +203,7 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr, - inc_mm_counter(mm, MM_ANONPAGES); - } - -- flush_cache_page(vma, addr, pte_pfn(ptep_get(pvmw.pte))); -+ flush_cache_page(vma, addr, pte_pfn(pte)); - ptep_clear_flush(vma, addr, pvmw.pte); - if (new_page) - set_pte_at_notify(mm, addr, pvmw.pte, -diff --git a/kernel/fork.c b/kernel/fork.c -index 23efaa2c42e4f8..97f433fb4b5ef4 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -518,6 +518,10 @@ struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig) - vma_numab_state_init(new); - dup_anon_vma_name(orig, new); - -+ /* track_pfn_copy() will later take care of copying internal state. */ -+ if (unlikely(new->vm_flags & VM_PFNMAP)) -+ untrack_pfn_clear(new); -+ - return new; - } - -diff --git a/kernel/kexec_elf.c b/kernel/kexec_elf.c -index d3689632e8b90f..3a5c25b2adc94d 100644 ---- a/kernel/kexec_elf.c -+++ b/kernel/kexec_elf.c -@@ -390,7 +390,7 @@ int kexec_elf_load(struct kimage *image, struct elfhdr *ehdr, - struct kexec_buf *kbuf, - unsigned long *lowest_load_addr) - { -- unsigned long lowest_addr = UINT_MAX; -+ unsigned long lowest_addr = ULONG_MAX; - int ret; - size_t i; - -diff --git a/kernel/locking/semaphore.c b/kernel/locking/semaphore.c -index 34bfae72f29526..de9117c0e671e9 100644 ---- a/kernel/locking/semaphore.c -+++ b/kernel/locking/semaphore.c -@@ -29,6 +29,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -38,7 +39,7 @@ static noinline void __down(struct semaphore *sem); - static noinline int __down_interruptible(struct semaphore *sem); - static noinline int __down_killable(struct semaphore *sem); - static noinline int __down_timeout(struct semaphore *sem, long timeout); --static noinline void __up(struct semaphore *sem); -+static noinline void __up(struct semaphore *sem, struct wake_q_head *wake_q); - - /** - * down - acquire the semaphore -@@ -183,13 +184,16 @@ EXPORT_SYMBOL(down_timeout); - void __sched up(struct semaphore *sem) - { - unsigned long flags; -+ DEFINE_WAKE_Q(wake_q); - - raw_spin_lock_irqsave(&sem->lock, flags); - if (likely(list_empty(&sem->wait_list))) - sem->count++; - else -- __up(sem); -+ __up(sem, &wake_q); - raw_spin_unlock_irqrestore(&sem->lock, flags); -+ if (!wake_q_empty(&wake_q)) -+ wake_up_q(&wake_q); - } - EXPORT_SYMBOL(up); - -@@ -269,11 +273,12 @@ static noinline int __sched __down_timeout(struct semaphore *sem, long timeout) - return __down_common(sem, TASK_UNINTERRUPTIBLE, timeout); - } - --static noinline void __sched __up(struct semaphore *sem) -+static noinline void __sched __up(struct semaphore *sem, -+ struct wake_q_head *wake_q) - { - struct semaphore_waiter *waiter = list_first_entry(&sem->wait_list, - struct semaphore_waiter, list); - list_del(&waiter->list); - waiter->up = true; -- wake_up_process(waiter->task); -+ wake_q_add(wake_q, waiter->task); - } -diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c -index b9e99bc3b1cf24..6c639e48e49a97 100644 ---- a/kernel/sched/deadline.c -+++ b/kernel/sched/deadline.c -@@ -2780,7 +2780,7 @@ int sched_dl_global_validate(void) - * value smaller than the currently allocated bandwidth in - * any of the root_domains. - */ -- for_each_possible_cpu(cpu) { -+ for_each_online_cpu(cpu) { - rcu_read_lock_sched(); - - if (dl_bw_visited(cpu, gen)) -diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c -index 9d8f60e0cb5546..545393601be8ce 100644 ---- a/kernel/trace/bpf_trace.c -+++ b/kernel/trace/bpf_trace.c -@@ -853,7 +853,7 @@ static int bpf_send_signal_common(u32 sig, enum pid_type type) - if (unlikely(is_global_init(current))) - return -EPERM; - -- if (!preemptible()) { -+ if (preempt_count() != 0 || irqs_disabled()) { - /* Do an early check on signal validity. Otherwise, - * the error is lost in deferred irq_work. - */ -diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c -index 61caff3d4091f7..62d93db72b0a9d 100644 ---- a/kernel/trace/ring_buffer.c -+++ b/kernel/trace/ring_buffer.c -@@ -5995,9 +5995,9 @@ static __init int rb_write_something(struct rb_test_data *data, bool nested) - /* Ignore dropped events before test starts. */ - if (started) { - if (nested) -- data->bytes_dropped += len; -- else - data->bytes_dropped_nested += len; -+ else -+ data->bytes_dropped += len; - } - return len; - } -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 9d9af60b238e27..a41c99350a5bf7 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -9417,7 +9417,8 @@ static int trace_array_create_dir(struct trace_array *tr) - return ret; - } - --static struct trace_array *trace_array_create(const char *name) -+static struct trace_array * -+trace_array_create_systems(const char *name, const char *systems) - { - struct trace_array *tr; - int ret; -@@ -9437,6 +9438,12 @@ static struct trace_array *trace_array_create(const char *name) - if (!zalloc_cpumask_var(&tr->pipe_cpumask, GFP_KERNEL)) - goto out_free_tr; - -+ if (systems) { -+ tr->system_names = kstrdup_const(systems, GFP_KERNEL); -+ if (!tr->system_names) -+ goto out_free_tr; -+ } -+ - tr->trace_flags = global_trace.trace_flags & ~ZEROED_TRACE_FLAGS; - - cpumask_copy(tr->tracing_cpumask, cpu_all_mask); -@@ -9480,12 +9487,18 @@ static struct trace_array *trace_array_create(const char *name) - free_trace_buffers(tr); - free_cpumask_var(tr->pipe_cpumask); - free_cpumask_var(tr->tracing_cpumask); -+ kfree_const(tr->system_names); - kfree(tr->name); - kfree(tr); - - return ERR_PTR(ret); - } - -+static struct trace_array *trace_array_create(const char *name) -+{ -+ return trace_array_create_systems(name, NULL); -+} -+ - static int instance_mkdir(const char *name) - { - struct trace_array *tr; -@@ -9511,6 +9524,7 @@ static int instance_mkdir(const char *name) - /** - * trace_array_get_by_name - Create/Lookup a trace array, given its name. - * @name: The name of the trace array to be looked up/created. -+ * @systems: A list of systems to create event directories for (NULL for all) - * - * Returns pointer to trace array with given name. - * NULL, if it cannot be created. -@@ -9524,7 +9538,7 @@ static int instance_mkdir(const char *name) - * trace_array_put() is called, user space can not delete it. - * - */ --struct trace_array *trace_array_get_by_name(const char *name) -+struct trace_array *trace_array_get_by_name(const char *name, const char *systems) - { - struct trace_array *tr; - -@@ -9536,7 +9550,7 @@ struct trace_array *trace_array_get_by_name(const char *name) - goto out_unlock; - } - -- tr = trace_array_create(name); -+ tr = trace_array_create_systems(name, systems); - - if (IS_ERR(tr)) - tr = NULL; -@@ -9583,6 +9597,7 @@ static int __remove_instance(struct trace_array *tr) - - free_cpumask_var(tr->pipe_cpumask); - free_cpumask_var(tr->tracing_cpumask); -+ kfree_const(tr->system_names); - kfree(tr->name); - kfree(tr); - -@@ -10301,7 +10316,7 @@ __init static void enable_instances(void) - if (IS_ENABLED(CONFIG_TRACER_MAX_TRACE)) - do_allocate_snapshot(tok); - -- tr = trace_array_get_by_name(tok); -+ tr = trace_array_get_by_name(tok, NULL); - if (!tr) { - pr_warn("Failed to create instance buffer %s\n", curr_str); - continue; -diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h -index e45756f1ac2b12..db0d2641125e7e 100644 ---- a/kernel/trace/trace.h -+++ b/kernel/trace/trace.h -@@ -377,6 +377,7 @@ struct trace_array { - unsigned char trace_flags_index[TRACE_FLAGS_MAX_SIZE]; - unsigned int flags; - raw_spinlock_t start_lock; -+ const char *system_names; - struct list_head err_log; - struct dentry *dir; - struct dentry *options; -diff --git a/kernel/trace/trace_boot.c b/kernel/trace/trace_boot.c -index 7ccc7a8e155b9e..dbe29b4c6a7a07 100644 ---- a/kernel/trace/trace_boot.c -+++ b/kernel/trace/trace_boot.c -@@ -633,7 +633,7 @@ trace_boot_init_instances(struct xbc_node *node) - if (!p || *p == '\0') - continue; - -- tr = trace_array_get_by_name(p); -+ tr = trace_array_get_by_name(p, NULL); - if (!tr) { - pr_err("Failed to get trace instance %s\n", p); - continue; -diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c -index 9d22745cdea5aa..562efd66857267 100644 ---- a/kernel/trace/trace_events.c -+++ b/kernel/trace/trace_events.c -@@ -3056,6 +3056,41 @@ void trace_event_eval_update(struct trace_eval_map **map, int len) - up_write(&trace_event_sem); - } - -+static bool event_in_systems(struct trace_event_call *call, -+ const char *systems) -+{ -+ const char *system; -+ const char *p; -+ -+ if (!systems) -+ return true; -+ -+ system = call->class->system; -+ p = strstr(systems, system); -+ if (!p) -+ return false; -+ -+ if (p != systems && !isspace(*(p - 1)) && *(p - 1) != ',') -+ return false; -+ -+ p += strlen(system); -+ return !*p || isspace(*p) || *p == ','; -+} -+ -+#ifdef CONFIG_HIST_TRIGGERS -+/* -+ * Wake up waiter on the hist_poll_wq from irq_work because the hist trigger -+ * may happen in any context. -+ */ -+static void hist_poll_event_irq_work(struct irq_work *work) -+{ -+ wake_up_all(&hist_poll_wq); -+} -+ -+DEFINE_IRQ_WORK(hist_poll_work, hist_poll_event_irq_work); -+DECLARE_WAIT_QUEUE_HEAD(hist_poll_wq); -+#endif -+ - static struct trace_event_file * - trace_create_new_event(struct trace_event_call *call, - struct trace_array *tr) -@@ -3065,9 +3100,12 @@ trace_create_new_event(struct trace_event_call *call, - struct trace_event_file *file; - unsigned int first; - -+ if (!event_in_systems(call, tr->system_names)) -+ return NULL; -+ - file = kmem_cache_alloc(file_cachep, GFP_TRACE); - if (!file) -- return NULL; -+ return ERR_PTR(-ENOMEM); - - pid_list = rcu_dereference_protected(tr->filtered_pids, - lockdep_is_held(&event_mutex)); -@@ -3132,8 +3170,17 @@ __trace_add_new_event(struct trace_event_call *call, struct trace_array *tr) - struct trace_event_file *file; - - file = trace_create_new_event(call, tr); -+ /* -+ * trace_create_new_event() returns ERR_PTR(-ENOMEM) if failed -+ * allocation, or NULL if the event is not part of the tr->system_names. -+ * When the event is not part of the tr->system_names, return zero, not -+ * an error. -+ */ - if (!file) -- return -ENOMEM; -+ return 0; -+ -+ if (IS_ERR(file)) -+ return PTR_ERR(file); - - if (eventdir_initialized) - return event_create_dir(tr->event_dir, file); -@@ -3172,8 +3219,17 @@ __trace_early_add_new_event(struct trace_event_call *call, - int ret; - - file = trace_create_new_event(call, tr); -+ /* -+ * trace_create_new_event() returns ERR_PTR(-ENOMEM) if failed -+ * allocation, or NULL if the event is not part of the tr->system_names. -+ * When the event is not part of the tr->system_names, return zero, not -+ * an error. -+ */ - if (!file) -- return -ENOMEM; -+ return 0; -+ -+ if (IS_ERR(file)) -+ return PTR_ERR(file); - - ret = event_define_fields(call); - if (ret) -diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c -index 604d63380a90b1..e6f9cbc622c759 100644 ---- a/kernel/trace/trace_events_hist.c -+++ b/kernel/trace/trace_events_hist.c -@@ -5322,6 +5322,8 @@ static void event_hist_trigger(struct event_trigger_data *data, - - if (resolve_var_refs(hist_data, key, var_ref_vals, true)) - hist_trigger_actions(hist_data, elt, buffer, rec, rbe, key, var_ref_vals); -+ -+ hist_poll_wakeup(); - } - - static void hist_trigger_stacktrace_print(struct seq_file *m, -@@ -5601,49 +5603,137 @@ static void hist_trigger_show(struct seq_file *m, - n_entries, (u64)atomic64_read(&hist_data->map->drops)); - } - -+struct hist_file_data { -+ struct file *file; -+ u64 last_read; -+ u64 last_act; -+}; -+ -+static u64 get_hist_hit_count(struct trace_event_file *event_file) -+{ -+ struct hist_trigger_data *hist_data; -+ struct event_trigger_data *data; -+ u64 ret = 0; -+ -+ list_for_each_entry(data, &event_file->triggers, list) { -+ if (data->cmd_ops->trigger_type == ETT_EVENT_HIST) { -+ hist_data = data->private_data; -+ ret += atomic64_read(&hist_data->map->hits); -+ } -+ } -+ return ret; -+} -+ - static int hist_show(struct seq_file *m, void *v) - { -+ struct hist_file_data *hist_file = m->private; - struct event_trigger_data *data; - struct trace_event_file *event_file; -- int n = 0, ret = 0; -+ int n = 0; - -- mutex_lock(&event_mutex); -+ guard(mutex)(&event_mutex); - -- event_file = event_file_file(m->private); -- if (unlikely(!event_file)) { -- ret = -ENODEV; -- goto out_unlock; -- } -+ event_file = event_file_file(hist_file->file); -+ if (unlikely(!event_file)) -+ return -ENODEV; - - list_for_each_entry(data, &event_file->triggers, list) { - if (data->cmd_ops->trigger_type == ETT_EVENT_HIST) - hist_trigger_show(m, data, n++); - } -+ hist_file->last_read = get_hist_hit_count(event_file); -+ /* -+ * Update last_act too so that poll()/POLLPRI can wait for the next -+ * event after any syscall on hist file. -+ */ -+ hist_file->last_act = hist_file->last_read; - -- out_unlock: -- mutex_unlock(&event_mutex); -+ return 0; -+} -+ -+static __poll_t event_hist_poll(struct file *file, struct poll_table_struct *wait) -+{ -+ struct trace_event_file *event_file; -+ struct seq_file *m = file->private_data; -+ struct hist_file_data *hist_file = m->private; -+ __poll_t ret = 0; -+ u64 cnt; -+ -+ guard(mutex)(&event_mutex); -+ -+ event_file = event_file_data(file); -+ if (!event_file) -+ return EPOLLERR; -+ -+ hist_poll_wait(file, wait); -+ -+ cnt = get_hist_hit_count(event_file); -+ if (hist_file->last_read != cnt) -+ ret |= EPOLLIN | EPOLLRDNORM; -+ if (hist_file->last_act != cnt) { -+ hist_file->last_act = cnt; -+ ret |= EPOLLPRI; -+ } - - return ret; - } - -+static int event_hist_release(struct inode *inode, struct file *file) -+{ -+ struct seq_file *m = file->private_data; -+ struct hist_file_data *hist_file = m->private; -+ -+ kfree(hist_file); -+ return tracing_single_release_file_tr(inode, file); -+} -+ - static int event_hist_open(struct inode *inode, struct file *file) - { -+ struct trace_event_file *event_file; -+ struct hist_file_data *hist_file; - int ret; - - ret = tracing_open_file_tr(inode, file); - if (ret) - return ret; - -+ guard(mutex)(&event_mutex); -+ -+ event_file = event_file_data(file); -+ if (!event_file) { -+ ret = -ENODEV; -+ goto err; -+ } -+ -+ hist_file = kzalloc(sizeof(*hist_file), GFP_KERNEL); -+ if (!hist_file) { -+ ret = -ENOMEM; -+ goto err; -+ } -+ -+ hist_file->file = file; -+ hist_file->last_act = get_hist_hit_count(event_file); -+ - /* Clear private_data to avoid warning in single_open() */ - file->private_data = NULL; -- return single_open(file, hist_show, file); -+ ret = single_open(file, hist_show, hist_file); -+ if (ret) { -+ kfree(hist_file); -+ goto err; -+ } -+ -+ return 0; -+err: -+ tracing_release_file_tr(inode, file); -+ return ret; - } - - const struct file_operations event_hist_fops = { - .open = event_hist_open, - .read = seq_read, - .llseek = seq_lseek, -- .release = tracing_single_release_file_tr, -+ .release = event_hist_release, -+ .poll = event_hist_poll, - }; - - #ifdef CONFIG_HIST_TRIGGERS_DEBUG -@@ -5884,25 +5974,19 @@ static int hist_debug_show(struct seq_file *m, void *v) - { - struct event_trigger_data *data; - struct trace_event_file *event_file; -- int n = 0, ret = 0; -+ int n = 0; - -- mutex_lock(&event_mutex); -+ guard(mutex)(&event_mutex); - - event_file = event_file_file(m->private); -- if (unlikely(!event_file)) { -- ret = -ENODEV; -- goto out_unlock; -- } -+ if (unlikely(!event_file)) -+ return -ENODEV; - - list_for_each_entry(data, &event_file->triggers, list) { - if (data->cmd_ops->trigger_type == ETT_EVENT_HIST) - hist_trigger_debug_show(m, data, n++); - } -- -- out_unlock: -- mutex_unlock(&event_mutex); -- -- return ret; -+ return 0; - } - - static int event_hist_debug_open(struct inode *inode, struct file *file) -@@ -5915,7 +5999,10 @@ static int event_hist_debug_open(struct inode *inode, struct file *file) - - /* Clear private_data to avoid warning in single_open() */ - file->private_data = NULL; -- return single_open(file, hist_debug_show, file); -+ ret = single_open(file, hist_debug_show, file); -+ if (ret) -+ tracing_release_file_tr(inode, file); -+ return ret; - } - - const struct file_operations event_hist_debug_fops = { -diff --git a/kernel/trace/trace_events_synth.c b/kernel/trace/trace_events_synth.c -index 624e0867316d02..ccd6703ac50b71 100644 ---- a/kernel/trace/trace_events_synth.c -+++ b/kernel/trace/trace_events_synth.c -@@ -312,7 +312,7 @@ static const char *synth_field_fmt(char *type) - else if (strcmp(type, "gfp_t") == 0) - fmt = "%x"; - else if (synth_field_is_string(type)) -- fmt = "%.*s"; -+ fmt = "%s"; - else if (synth_field_is_stack(type)) - fmt = "%s"; - -@@ -859,6 +859,38 @@ static struct trace_event_fields synth_event_fields_array[] = { - {} - }; - -+static int synth_event_reg(struct trace_event_call *call, -+ enum trace_reg type, void *data) -+{ -+ struct synth_event *event = container_of(call, struct synth_event, call); -+ -+ switch (type) { -+#ifdef CONFIG_PERF_EVENTS -+ case TRACE_REG_PERF_REGISTER: -+#endif -+ case TRACE_REG_REGISTER: -+ if (!try_module_get(event->mod)) -+ return -EBUSY; -+ break; -+ default: -+ break; -+ } -+ -+ int ret = trace_event_reg(call, type, data); -+ -+ switch (type) { -+#ifdef CONFIG_PERF_EVENTS -+ case TRACE_REG_PERF_UNREGISTER: -+#endif -+ case TRACE_REG_UNREGISTER: -+ module_put(event->mod); -+ break; -+ default: -+ break; -+ } -+ return ret; -+} -+ - static int register_synth_event(struct synth_event *event) - { - struct trace_event_call *call = &event->call; -@@ -888,7 +920,7 @@ static int register_synth_event(struct synth_event *event) - goto out; - } - call->flags = TRACE_EVENT_FL_TRACEPOINT; -- call->class->reg = trace_event_reg; -+ call->class->reg = synth_event_reg; - call->class->probe = trace_event_raw_event_synth; - call->data = event; - call->tp = event->tp; -diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c -index c35fbaab2a4747..4d4808186a0ff0 100644 ---- a/kernel/trace/trace_functions_graph.c -+++ b/kernel/trace/trace_functions_graph.c -@@ -1317,6 +1317,7 @@ void graph_trace_close(struct trace_iterator *iter) - if (data) { - free_percpu(data->cpu_data); - kfree(data); -+ iter->private = NULL; - } - } - -diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c -index ba37f768e2f273..6c9db857fe0ea2 100644 ---- a/kernel/trace/trace_irqsoff.c -+++ b/kernel/trace/trace_irqsoff.c -@@ -231,8 +231,6 @@ static void irqsoff_trace_open(struct trace_iterator *iter) - { - if (is_graph(iter->tr)) - graph_trace_open(iter); -- else -- iter->private = NULL; - } - - static void irqsoff_trace_close(struct trace_iterator *iter) -diff --git a/kernel/trace/trace_osnoise.c b/kernel/trace/trace_osnoise.c -index cc155590018f65..5bd781359d38b0 100644 ---- a/kernel/trace/trace_osnoise.c -+++ b/kernel/trace/trace_osnoise.c -@@ -2038,7 +2038,6 @@ static int start_kthread(unsigned int cpu) - - if (IS_ERR(kthread)) { - pr_err(BANNER "could not start sampling thread\n"); -- stop_per_cpu_kthreads(); - return -ENOMEM; - } - -diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c -index 0469a04a355f2c..330aee1c1a49e6 100644 ---- a/kernel/trace/trace_sched_wakeup.c -+++ b/kernel/trace/trace_sched_wakeup.c -@@ -168,8 +168,6 @@ static void wakeup_trace_open(struct trace_iterator *iter) - { - if (is_graph(iter->tr)) - graph_trace_open(iter); -- else -- iter->private = NULL; - } - - static void wakeup_trace_close(struct trace_iterator *iter) -diff --git a/kernel/watch_queue.c b/kernel/watch_queue.c -index 778b4056700ff5..17254597accd4d 100644 ---- a/kernel/watch_queue.c -+++ b/kernel/watch_queue.c -@@ -269,6 +269,15 @@ long watch_queue_set_size(struct pipe_inode_info *pipe, unsigned int nr_notes) - if (ret < 0) - goto error; - -+ /* -+ * pipe_resize_ring() does not update nr_accounted for watch_queue -+ * pipes, because the above vastly overprovisions. Set nr_accounted on -+ * and max_usage this pipe to the number that was actually charged to -+ * the user above via account_pipe_buffers. -+ */ -+ pipe->max_usage = nr_pages; -+ pipe->nr_accounted = nr_pages; -+ - ret = -ENOMEM; - pages = kcalloc(sizeof(struct page *), nr_pages, GFP_KERNEL); - if (!pages) -diff --git a/lib/842/842_compress.c b/lib/842/842_compress.c -index c02baa4168e168..055356508d97c5 100644 ---- a/lib/842/842_compress.c -+++ b/lib/842/842_compress.c -@@ -532,6 +532,8 @@ int sw842_compress(const u8 *in, unsigned int ilen, - } - if (repeat_count) { - ret = add_repeat_template(p, repeat_count); -+ if (ret) -+ return ret; - repeat_count = 0; - if (next == last) /* reached max repeat bits */ - goto repeat; -diff --git a/lib/overflow_kunit.c b/lib/overflow_kunit.c -index 34db0b3aa50234..9493a1b28b9e74 100644 ---- a/lib/overflow_kunit.c -+++ b/lib/overflow_kunit.c -@@ -608,7 +608,6 @@ DEFINE_TEST_ALLOC(devm_kzalloc, devm_kfree, 1, 1, 0); - - static void overflow_allocation_test(struct kunit *test) - { -- const char device_name[] = "overflow-test"; - struct device *dev; - int count = 0; - -@@ -618,7 +617,7 @@ static void overflow_allocation_test(struct kunit *test) - } while (0) - - /* Create dummy device for devm_kmalloc()-family tests. */ -- dev = root_device_register(device_name); -+ dev = root_device_register("overflow-test"); - KUNIT_ASSERT_FALSE_MSG(test, IS_ERR(dev), - "Cannot register test device\n"); - -diff --git a/mm/memory.c b/mm/memory.c -index 65f1865cb461e4..d04faa09eaf6cc 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -1268,12 +1268,12 @@ int - copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma) - { - pgd_t *src_pgd, *dst_pgd; -- unsigned long next; - unsigned long addr = src_vma->vm_start; - unsigned long end = src_vma->vm_end; - struct mm_struct *dst_mm = dst_vma->vm_mm; - struct mm_struct *src_mm = src_vma->vm_mm; - struct mmu_notifier_range range; -+ unsigned long next, pfn; - bool is_cow; - int ret; - -@@ -1284,11 +1284,7 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma) - return copy_hugetlb_page_range(dst_mm, src_mm, dst_vma, src_vma); - - if (unlikely(src_vma->vm_flags & VM_PFNMAP)) { -- /* -- * We do not free on error cases below as remove_vma -- * gets called on error from higher level routine -- */ -- ret = track_pfn_copy(src_vma); -+ ret = track_pfn_copy(dst_vma, src_vma, &pfn); - if (ret) - return ret; - } -@@ -1325,7 +1321,6 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma) - continue; - if (unlikely(copy_p4d_range(dst_vma, src_vma, dst_pgd, src_pgd, - addr, next))) { -- untrack_pfn_clear(dst_vma); - ret = -ENOMEM; - break; - } -@@ -1335,6 +1330,8 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma) - raw_write_seqcount_end(&src_mm->write_protect_seq); - mmu_notifier_invalidate_range_end(&range); - } -+ if (ret && unlikely(src_vma->vm_flags & VM_PFNMAP)) -+ untrack_pfn_copy(dst_vma, pfn); - return ret; - } - -@@ -5945,10 +5942,8 @@ void __might_fault(const char *file, int line) - if (pagefault_disabled()) - return; - __might_sleep(file, line); --#if defined(CONFIG_DEBUG_ATOMIC_SLEEP) - if (current->mm) - might_lock_read(¤t->mm->mmap_lock); --#endif - } - EXPORT_SYMBOL(__might_fault); - #endif -diff --git a/net/can/af_can.c b/net/can/af_can.c -index c469fc187f0c7c..cdad0be43e8ff1 100644 ---- a/net/can/af_can.c -+++ b/net/can/af_can.c -@@ -287,8 +287,8 @@ int can_send(struct sk_buff *skb, int loop) - netif_rx(newskb); - - /* update statistics */ -- pkg_stats->tx_frames++; -- pkg_stats->tx_frames_delta++; -+ atomic_long_inc(&pkg_stats->tx_frames); -+ atomic_long_inc(&pkg_stats->tx_frames_delta); - - return 0; - -@@ -647,8 +647,8 @@ static void can_receive(struct sk_buff *skb, struct net_device *dev) - int matches; - - /* update statistics */ -- pkg_stats->rx_frames++; -- pkg_stats->rx_frames_delta++; -+ atomic_long_inc(&pkg_stats->rx_frames); -+ atomic_long_inc(&pkg_stats->rx_frames_delta); - - /* create non-zero unique skb identifier together with *skb */ - while (!(can_skb_prv(skb)->skbcnt)) -@@ -669,8 +669,8 @@ static void can_receive(struct sk_buff *skb, struct net_device *dev) - consume_skb(skb); - - if (matches > 0) { -- pkg_stats->matches++; -- pkg_stats->matches_delta++; -+ atomic_long_inc(&pkg_stats->matches); -+ atomic_long_inc(&pkg_stats->matches_delta); - } - } - -diff --git a/net/can/af_can.h b/net/can/af_can.h -index 7c2d9161e22457..22f3352c77fece 100644 ---- a/net/can/af_can.h -+++ b/net/can/af_can.h -@@ -66,9 +66,9 @@ struct receiver { - struct can_pkg_stats { - unsigned long jiffies_init; - -- unsigned long rx_frames; -- unsigned long tx_frames; -- unsigned long matches; -+ atomic_long_t rx_frames; -+ atomic_long_t tx_frames; -+ atomic_long_t matches; - - unsigned long total_rx_rate; - unsigned long total_tx_rate; -@@ -82,9 +82,9 @@ struct can_pkg_stats { - unsigned long max_tx_rate; - unsigned long max_rx_match_ratio; - -- unsigned long rx_frames_delta; -- unsigned long tx_frames_delta; -- unsigned long matches_delta; -+ atomic_long_t rx_frames_delta; -+ atomic_long_t tx_frames_delta; -+ atomic_long_t matches_delta; - }; - - /* persistent statistics */ -diff --git a/net/can/proc.c b/net/can/proc.c -index bbce97825f13fb..25fdf060e30d0d 100644 ---- a/net/can/proc.c -+++ b/net/can/proc.c -@@ -118,6 +118,13 @@ void can_stat_update(struct timer_list *t) - struct can_pkg_stats *pkg_stats = net->can.pkg_stats; - unsigned long j = jiffies; /* snapshot */ - -+ long rx_frames = atomic_long_read(&pkg_stats->rx_frames); -+ long tx_frames = atomic_long_read(&pkg_stats->tx_frames); -+ long matches = atomic_long_read(&pkg_stats->matches); -+ long rx_frames_delta = atomic_long_read(&pkg_stats->rx_frames_delta); -+ long tx_frames_delta = atomic_long_read(&pkg_stats->tx_frames_delta); -+ long matches_delta = atomic_long_read(&pkg_stats->matches_delta); -+ - /* restart counting in timer context on user request */ - if (user_reset) - can_init_stats(net); -@@ -127,35 +134,33 @@ void can_stat_update(struct timer_list *t) - can_init_stats(net); - - /* prevent overflow in calc_rate() */ -- if (pkg_stats->rx_frames > (ULONG_MAX / HZ)) -+ if (rx_frames > (LONG_MAX / HZ)) - can_init_stats(net); - - /* prevent overflow in calc_rate() */ -- if (pkg_stats->tx_frames > (ULONG_MAX / HZ)) -+ if (tx_frames > (LONG_MAX / HZ)) - can_init_stats(net); - - /* matches overflow - very improbable */ -- if (pkg_stats->matches > (ULONG_MAX / 100)) -+ if (matches > (LONG_MAX / 100)) - can_init_stats(net); - - /* calc total values */ -- if (pkg_stats->rx_frames) -- pkg_stats->total_rx_match_ratio = (pkg_stats->matches * 100) / -- pkg_stats->rx_frames; -+ if (rx_frames) -+ pkg_stats->total_rx_match_ratio = (matches * 100) / rx_frames; - - pkg_stats->total_tx_rate = calc_rate(pkg_stats->jiffies_init, j, -- pkg_stats->tx_frames); -+ tx_frames); - pkg_stats->total_rx_rate = calc_rate(pkg_stats->jiffies_init, j, -- pkg_stats->rx_frames); -+ rx_frames); - - /* calc current values */ -- if (pkg_stats->rx_frames_delta) -+ if (rx_frames_delta) - pkg_stats->current_rx_match_ratio = -- (pkg_stats->matches_delta * 100) / -- pkg_stats->rx_frames_delta; -+ (matches_delta * 100) / rx_frames_delta; - -- pkg_stats->current_tx_rate = calc_rate(0, HZ, pkg_stats->tx_frames_delta); -- pkg_stats->current_rx_rate = calc_rate(0, HZ, pkg_stats->rx_frames_delta); -+ pkg_stats->current_tx_rate = calc_rate(0, HZ, tx_frames_delta); -+ pkg_stats->current_rx_rate = calc_rate(0, HZ, rx_frames_delta); - - /* check / update maximum values */ - if (pkg_stats->max_tx_rate < pkg_stats->current_tx_rate) -@@ -168,9 +173,9 @@ void can_stat_update(struct timer_list *t) - pkg_stats->max_rx_match_ratio = pkg_stats->current_rx_match_ratio; - - /* clear values for 'current rate' calculation */ -- pkg_stats->tx_frames_delta = 0; -- pkg_stats->rx_frames_delta = 0; -- pkg_stats->matches_delta = 0; -+ atomic_long_set(&pkg_stats->tx_frames_delta, 0); -+ atomic_long_set(&pkg_stats->rx_frames_delta, 0); -+ atomic_long_set(&pkg_stats->matches_delta, 0); - - /* restart timer (one second) */ - mod_timer(&net->can.stattimer, round_jiffies(jiffies + HZ)); -@@ -214,9 +219,12 @@ static int can_stats_proc_show(struct seq_file *m, void *v) - struct can_rcv_lists_stats *rcv_lists_stats = net->can.rcv_lists_stats; - - seq_putc(m, '\n'); -- seq_printf(m, " %8ld transmitted frames (TXF)\n", pkg_stats->tx_frames); -- seq_printf(m, " %8ld received frames (RXF)\n", pkg_stats->rx_frames); -- seq_printf(m, " %8ld matched frames (RXMF)\n", pkg_stats->matches); -+ seq_printf(m, " %8ld transmitted frames (TXF)\n", -+ atomic_long_read(&pkg_stats->tx_frames)); -+ seq_printf(m, " %8ld received frames (RXF)\n", -+ atomic_long_read(&pkg_stats->rx_frames)); -+ seq_printf(m, " %8ld matched frames (RXMF)\n", -+ atomic_long_read(&pkg_stats->matches)); - - seq_putc(m, '\n'); - -diff --git a/net/core/dst.c b/net/core/dst.c -index 137b8d1c72203a..aad197e761cb4c 100644 ---- a/net/core/dst.c -+++ b/net/core/dst.c -@@ -167,6 +167,14 @@ static void dst_count_dec(struct dst_entry *dst) - void dst_release(struct dst_entry *dst) - { - if (dst && rcuref_put(&dst->__rcuref)) { -+#ifdef CONFIG_DST_CACHE -+ if (dst->flags & DST_METADATA) { -+ struct metadata_dst *md_dst = (struct metadata_dst *)dst; -+ -+ if (md_dst->type == METADATA_IP_TUNNEL) -+ dst_cache_reset_now(&md_dst->u.tun_info.dst_cache); -+ } -+#endif - dst_count_dec(dst); - call_rcu_hurry(&dst->rcu_head, dst_destroy_rcu); - } -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index 4acde7067519ee..26c520d1af6e61 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -1011,6 +1011,9 @@ static inline int rtnl_vfinfo_size(const struct net_device *dev, - /* IFLA_VF_STATS_TX_DROPPED */ - nla_total_size_64bit(sizeof(__u64))); - } -+ if (dev->netdev_ops->ndo_get_vf_guid) -+ size += num_vfs * 2 * -+ nla_total_size(sizeof(struct ifla_vf_guid)); - return size; - } else - return 0; -diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c -index 80ccd6661aa32f..deb08cab44640d 100644 ---- a/net/ipv4/ip_tunnel_core.c -+++ b/net/ipv4/ip_tunnel_core.c -@@ -415,7 +415,7 @@ int skb_tunnel_check_pmtu(struct sk_buff *skb, struct dst_entry *encap_dst, - - skb_dst_update_pmtu_no_confirm(skb, mtu); - -- if (!reply || skb->pkt_type == PACKET_HOST) -+ if (!reply) - return 0; - - if (skb->protocol == htons(ETH_P_IP)) -@@ -450,7 +450,7 @@ static const struct nla_policy - geneve_opt_policy[LWTUNNEL_IP_OPT_GENEVE_MAX + 1] = { - [LWTUNNEL_IP_OPT_GENEVE_CLASS] = { .type = NLA_U16 }, - [LWTUNNEL_IP_OPT_GENEVE_TYPE] = { .type = NLA_U8 }, -- [LWTUNNEL_IP_OPT_GENEVE_DATA] = { .type = NLA_BINARY, .len = 128 }, -+ [LWTUNNEL_IP_OPT_GENEVE_DATA] = { .type = NLA_BINARY, .len = 127 }, - }; - - static const struct nla_policy -diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index b84d18fcd9e2cd..dc91699ce0328a 100644 ---- a/net/ipv4/udp.c -+++ b/net/ipv4/udp.c -@@ -1412,12 +1412,12 @@ static bool udp_skb_has_head_state(struct sk_buff *skb) - } - - /* fully reclaim rmem/fwd memory allocated for skb */ --static void udp_rmem_release(struct sock *sk, int size, int partial, -- bool rx_queue_lock_held) -+static void udp_rmem_release(struct sock *sk, unsigned int size, -+ int partial, bool rx_queue_lock_held) - { - struct udp_sock *up = udp_sk(sk); - struct sk_buff_head *sk_queue; -- int amt; -+ unsigned int amt; - - if (likely(partial)) { - up->forward_deficit += size; -@@ -1437,10 +1437,8 @@ static void udp_rmem_release(struct sock *sk, int size, int partial, - if (!rx_queue_lock_held) - spin_lock(&sk_queue->lock); - -- -- sk_forward_alloc_add(sk, size); -- amt = (sk->sk_forward_alloc - partial) & ~(PAGE_SIZE - 1); -- sk_forward_alloc_add(sk, -amt); -+ amt = (size + sk->sk_forward_alloc - partial) & ~(PAGE_SIZE - 1); -+ sk_forward_alloc_add(sk, size - amt); - - if (amt) - __sk_mem_reduce_allocated(sk, amt >> PAGE_SHIFT); -@@ -1630,7 +1628,7 @@ EXPORT_SYMBOL_GPL(skb_consume_udp); - - static struct sk_buff *__first_packet_length(struct sock *sk, - struct sk_buff_head *rcvq, -- int *total) -+ unsigned int *total) - { - struct sk_buff *skb; - -@@ -1663,8 +1661,8 @@ static int first_packet_length(struct sock *sk) - { - struct sk_buff_head *rcvq = &udp_sk(sk)->reader_queue; - struct sk_buff_head *sk_queue = &sk->sk_receive_queue; -+ unsigned int total = 0; - struct sk_buff *skb; -- int total = 0; - int res; - - spin_lock_bh(&rcvq->lock); -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 8360939acf85ad..bb9add46e382a6 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -5750,6 +5750,27 @@ static void snmp6_fill_stats(u64 *stats, struct inet6_dev *idev, int attrtype, - } - } - -+static int inet6_fill_ifla6_stats_attrs(struct sk_buff *skb, -+ struct inet6_dev *idev) -+{ -+ struct nlattr *nla; -+ -+ nla = nla_reserve(skb, IFLA_INET6_STATS, IPSTATS_MIB_MAX * sizeof(u64)); -+ if (!nla) -+ goto nla_put_failure; -+ snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_STATS, nla_len(nla)); -+ -+ nla = nla_reserve(skb, IFLA_INET6_ICMP6STATS, ICMP6_MIB_MAX * sizeof(u64)); -+ if (!nla) -+ goto nla_put_failure; -+ snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_ICMP6STATS, nla_len(nla)); -+ -+ return 0; -+ -+nla_put_failure: -+ return -EMSGSIZE; -+} -+ - static int inet6_fill_ifla6_attrs(struct sk_buff *skb, struct inet6_dev *idev, - u32 ext_filter_mask) - { -@@ -5771,18 +5792,10 @@ static int inet6_fill_ifla6_attrs(struct sk_buff *skb, struct inet6_dev *idev, - - /* XXX - MC not implemented */ - -- if (ext_filter_mask & RTEXT_FILTER_SKIP_STATS) -- return 0; -- -- nla = nla_reserve(skb, IFLA_INET6_STATS, IPSTATS_MIB_MAX * sizeof(u64)); -- if (!nla) -- goto nla_put_failure; -- snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_STATS, nla_len(nla)); -- -- nla = nla_reserve(skb, IFLA_INET6_ICMP6STATS, ICMP6_MIB_MAX * sizeof(u64)); -- if (!nla) -- goto nla_put_failure; -- snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_ICMP6STATS, nla_len(nla)); -+ if (!(ext_filter_mask & RTEXT_FILTER_SKIP_STATS)) { -+ if (inet6_fill_ifla6_stats_attrs(skb, idev) < 0) -+ goto nla_put_failure; -+ } - - nla = nla_reserve(skb, IFLA_INET6_TOKEN, sizeof(struct in6_addr)); - if (!nla) -diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c -index 1578ed9e97d892..c07e3da08d2a8b 100644 ---- a/net/ipv6/calipso.c -+++ b/net/ipv6/calipso.c -@@ -1075,8 +1075,13 @@ static int calipso_sock_getattr(struct sock *sk, - struct ipv6_opt_hdr *hop; - int opt_len, len, ret_val = -ENOMSG, offset; - unsigned char *opt; -- struct ipv6_txoptions *txopts = txopt_get(inet6_sk(sk)); -+ struct ipv6_pinfo *pinfo = inet6_sk(sk); -+ struct ipv6_txoptions *txopts; -+ -+ if (!pinfo) -+ return -EAFNOSUPPORT; - -+ txopts = txopt_get(pinfo); - if (!txopts || !txopts->hopopt) - goto done; - -@@ -1128,8 +1133,13 @@ static int calipso_sock_setattr(struct sock *sk, - { - int ret_val; - struct ipv6_opt_hdr *old, *new; -- struct ipv6_txoptions *txopts = txopt_get(inet6_sk(sk)); -+ struct ipv6_pinfo *pinfo = inet6_sk(sk); -+ struct ipv6_txoptions *txopts; -+ -+ if (!pinfo) -+ return -EAFNOSUPPORT; - -+ txopts = txopt_get(pinfo); - old = NULL; - if (txopts) - old = txopts->hopopt; -@@ -1156,8 +1166,13 @@ static int calipso_sock_setattr(struct sock *sk, - static void calipso_sock_delattr(struct sock *sk) - { - struct ipv6_opt_hdr *new_hop; -- struct ipv6_txoptions *txopts = txopt_get(inet6_sk(sk)); -+ struct ipv6_pinfo *pinfo = inet6_sk(sk); -+ struct ipv6_txoptions *txopts; -+ -+ if (!pinfo) -+ return; - -+ txopts = txopt_get(pinfo); - if (!txopts || !txopts->hopopt) - goto done; - -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index 3ab5ea55ff8c35..2e98531fa51a31 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -414,12 +414,37 @@ static bool rt6_check_expired(const struct rt6_info *rt) - return false; - } - -+static struct fib6_info * -+rt6_multipath_first_sibling_rcu(const struct fib6_info *rt) -+{ -+ struct fib6_info *iter; -+ struct fib6_node *fn; -+ -+ fn = rcu_dereference(rt->fib6_node); -+ if (!fn) -+ goto out; -+ iter = rcu_dereference(fn->leaf); -+ if (!iter) -+ goto out; -+ -+ while (iter) { -+ if (iter->fib6_metric == rt->fib6_metric && -+ rt6_qualify_for_ecmp(iter)) -+ return iter; -+ iter = rcu_dereference(iter->fib6_next); -+ } -+ -+out: -+ return NULL; -+} -+ - void fib6_select_path(const struct net *net, struct fib6_result *res, - struct flowi6 *fl6, int oif, bool have_oif_match, - const struct sk_buff *skb, int strict) - { -- struct fib6_info *match = res->f6i; -+ struct fib6_info *first, *match = res->f6i; - struct fib6_info *sibling; -+ int hash; - - if (!match->nh && (!match->fib6_nsiblings || have_oif_match)) - goto out; -@@ -442,16 +467,25 @@ void fib6_select_path(const struct net *net, struct fib6_result *res, - return; - } - -- if (fl6->mp_hash <= atomic_read(&match->fib6_nh->fib_nh_upper_bound)) -+ first = rt6_multipath_first_sibling_rcu(match); -+ if (!first) - goto out; - -- list_for_each_entry_rcu(sibling, &match->fib6_siblings, -+ hash = fl6->mp_hash; -+ if (hash <= atomic_read(&first->fib6_nh->fib_nh_upper_bound) && -+ rt6_score_route(first->fib6_nh, first->fib6_flags, oif, -+ strict) >= 0) { -+ match = first; -+ goto out; -+ } -+ -+ list_for_each_entry_rcu(sibling, &first->fib6_siblings, - fib6_siblings) { - const struct fib6_nh *nh = sibling->fib6_nh; - int nh_upper_bound; - - nh_upper_bound = atomic_read(&nh->fib_nh_upper_bound); -- if (fl6->mp_hash > nh_upper_bound) -+ if (hash > nh_upper_bound) - continue; - if (rt6_score_route(nh, sibling->fib6_flags, oif, strict) < 0) - break; -diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c -index 5d71e8d084c459..64cf5589989bbb 100644 ---- a/net/mac80211/sta_info.c -+++ b/net/mac80211/sta_info.c -@@ -4,7 +4,7 @@ - * Copyright 2006-2007 Jiri Benc - * Copyright 2013-2014 Intel Mobile Communications GmbH - * Copyright (C) 2015 - 2017 Intel Deutschland GmbH -- * Copyright (C) 2018-2023 Intel Corporation -+ * Copyright (C) 2018-2024 Intel Corporation - */ - - #include -@@ -1321,9 +1321,13 @@ static int _sta_info_move_state(struct sta_info *sta, - sta->sta.addr, new_state); - - /* notify the driver before the actual changes so it can -- * fail the transition -+ * fail the transition if the state is increasing. -+ * The driver is required not to fail when the transition -+ * is decreasing the state, so first, do all the preparation -+ * work and only then, notify the driver. - */ -- if (test_sta_flag(sta, WLAN_STA_INSERTED)) { -+ if (new_state > sta->sta_state && -+ test_sta_flag(sta, WLAN_STA_INSERTED)) { - int err = drv_sta_state(sta->local, sta->sdata, sta, - sta->sta_state, new_state); - if (err) -@@ -1399,6 +1403,16 @@ static int _sta_info_move_state(struct sta_info *sta, - break; - } - -+ if (new_state < sta->sta_state && -+ test_sta_flag(sta, WLAN_STA_INSERTED)) { -+ int err = drv_sta_state(sta->local, sta->sdata, sta, -+ sta->sta_state, new_state); -+ -+ WARN_ONCE(err, -+ "Driver is not allowed to fail if the sta_state is transitioning down the list: %d\n", -+ err); -+ } -+ - sta->sta_state = new_state; - - return 0; -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 9e9544f819421a..18ae39cf418876 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -2669,11 +2669,11 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, - err = nft_netdev_register_hooks(ctx->net, &hook.list); - if (err < 0) - goto err_hooks; -+ -+ unregister = true; - } - } - -- unregister = true; -- - if (nla[NFTA_CHAIN_COUNTERS]) { - if (!nft_is_base_chain(chain)) { - err = -EOPNOTSUPP; -diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c -index 0370f69dce86dd..2f1012bde1f34e 100644 ---- a/net/netfilter/nft_set_hash.c -+++ b/net/netfilter/nft_set_hash.c -@@ -308,7 +308,8 @@ static bool nft_rhash_expr_needs_gc_run(const struct nft_set *set, - - nft_setelem_expr_foreach(expr, elem_expr, size) { - if (expr->ops->gc && -- expr->ops->gc(read_pnet(&set->net), expr)) -+ expr->ops->gc(read_pnet(&set->net), expr) && -+ set->flags & NFT_SET_EVAL) - return true; - } - -diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c -index f735d79d8be577..d499eb3f4f2978 100644 ---- a/net/netfilter/nft_tunnel.c -+++ b/net/netfilter/nft_tunnel.c -@@ -333,13 +333,13 @@ static int nft_tunnel_obj_erspan_init(const struct nlattr *attr, - static const struct nla_policy nft_tunnel_opts_geneve_policy[NFTA_TUNNEL_KEY_GENEVE_MAX + 1] = { - [NFTA_TUNNEL_KEY_GENEVE_CLASS] = { .type = NLA_U16 }, - [NFTA_TUNNEL_KEY_GENEVE_TYPE] = { .type = NLA_U8 }, -- [NFTA_TUNNEL_KEY_GENEVE_DATA] = { .type = NLA_BINARY, .len = 128 }, -+ [NFTA_TUNNEL_KEY_GENEVE_DATA] = { .type = NLA_BINARY, .len = 127 }, - }; - - static int nft_tunnel_obj_geneve_init(const struct nlattr *attr, - struct nft_tunnel_opts *opts) - { -- struct geneve_opt *opt = (struct geneve_opt *)opts->u.data + opts->len; -+ struct geneve_opt *opt = (struct geneve_opt *)(opts->u.data + opts->len); - struct nlattr *tb[NFTA_TUNNEL_KEY_GENEVE_MAX + 1]; - int err, data_len; - -@@ -621,7 +621,7 @@ static int nft_tunnel_opts_dump(struct sk_buff *skb, - if (!inner) - goto failure; - while (opts->len > offset) { -- opt = (struct geneve_opt *)opts->u.data + offset; -+ opt = (struct geneve_opt *)(opts->u.data + offset); - if (nla_put_be16(skb, NFTA_TUNNEL_KEY_GENEVE_CLASS, - opt->opt_class) || - nla_put_u8(skb, NFTA_TUNNEL_KEY_GENEVE_TYPE, -diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c -index 9445ca97163b40..6c5afb4ad67bb6 100644 ---- a/net/openvswitch/actions.c -+++ b/net/openvswitch/actions.c -@@ -931,12 +931,6 @@ static void do_output(struct datapath *dp, struct sk_buff *skb, int out_port, - pskb_trim(skb, ovs_mac_header_len(key)); - } - -- /* Need to set the pkt_type to involve the routing layer. The -- * packet movement through the OVS datapath doesn't generally -- * use routing, but this is needed for tunnel cases. -- */ -- skb->pkt_type = PACKET_OUTGOING; -- - if (likely(!mru || - (skb->len <= mru + vport->dev->hard_header_len))) { - ovs_vport_send(vport, skb, ovs_key_mac_proto(key)); -diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c -index 0c8aa7e686eab0..99fb869aee91b7 100644 ---- a/net/sched/act_tunnel_key.c -+++ b/net/sched/act_tunnel_key.c -@@ -68,7 +68,7 @@ geneve_opt_policy[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_MAX + 1] = { - [TCA_TUNNEL_KEY_ENC_OPT_GENEVE_CLASS] = { .type = NLA_U16 }, - [TCA_TUNNEL_KEY_ENC_OPT_GENEVE_TYPE] = { .type = NLA_U8 }, - [TCA_TUNNEL_KEY_ENC_OPT_GENEVE_DATA] = { .type = NLA_BINARY, -- .len = 128 }, -+ .len = 127 }, - }; - - static const struct nla_policy -diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c -index bcf1b8012b2c3a..b00e491e8130d7 100644 ---- a/net/sched/cls_flower.c -+++ b/net/sched/cls_flower.c -@@ -748,7 +748,7 @@ geneve_opt_policy[TCA_FLOWER_KEY_ENC_OPT_GENEVE_MAX + 1] = { - [TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS] = { .type = NLA_U16 }, - [TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE] = { .type = NLA_U8 }, - [TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA] = { .type = NLA_BINARY, -- .len = 128 }, -+ .len = 127 }, - }; - - static const struct nla_policy -diff --git a/net/sched/sch_skbprio.c b/net/sched/sch_skbprio.c -index 5df2dacb7b1aba..05aa363a7fee95 100644 ---- a/net/sched/sch_skbprio.c -+++ b/net/sched/sch_skbprio.c -@@ -121,8 +121,6 @@ static int skbprio_enqueue(struct sk_buff *skb, struct Qdisc *sch, - /* Check to update highest and lowest priorities. */ - if (skb_queue_empty(lp_qdisc)) { - if (q->lowest_prio == q->highest_prio) { -- /* The incoming packet is the only packet in queue. */ -- BUG_ON(sch->q.qlen != 1); - q->lowest_prio = prio; - q->highest_prio = prio; - } else { -@@ -154,7 +152,6 @@ static struct sk_buff *skbprio_dequeue(struct Qdisc *sch) - /* Update highest priority field. */ - if (skb_queue_empty(hpq)) { - if (q->lowest_prio == q->highest_prio) { -- BUG_ON(sch->q.qlen); - q->highest_prio = 0; - q->lowest_prio = SKBPRIO_MAX_PRIORITY - 1; - } else { -diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c -index 622875a6f787ca..f8f1a49689da6c 100644 ---- a/net/vmw_vsock/af_vsock.c -+++ b/net/vmw_vsock/af_vsock.c -@@ -1485,7 +1485,11 @@ static int vsock_connect(struct socket *sock, struct sockaddr *addr, - timeout = vsk->connect_timeout; - prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE); - -- while (sk->sk_state != TCP_ESTABLISHED && sk->sk_err == 0) { -+ /* If the socket is already closing or it is in an error state, there -+ * is no point in waiting. -+ */ -+ while (sk->sk_state != TCP_ESTABLISHED && -+ sk->sk_state != TCP_CLOSING && sk->sk_err == 0) { - if (flags & O_NONBLOCK) { - /* If we're not going to block, we schedule a timeout - * function to generate a timeout on the connection -diff --git a/samples/ftrace/sample-trace-array.c b/samples/ftrace/sample-trace-array.c -index 6aba02a31c96c5..d0ee9001c7b376 100644 ---- a/samples/ftrace/sample-trace-array.c -+++ b/samples/ftrace/sample-trace-array.c -@@ -105,7 +105,7 @@ static int __init sample_trace_array_init(void) - * NOTE: This function increments the reference counter - * associated with the trace array - "tr". - */ -- tr = trace_array_get_by_name("sample-instance"); -+ tr = trace_array_get_by_name("sample-instance", "sched,timer,kprobes"); - - if (!tr) - return -1; -diff --git a/scripts/selinux/install_policy.sh b/scripts/selinux/install_policy.sh -index 24086793b0d8d4..db40237e60ce7e 100755 ---- a/scripts/selinux/install_policy.sh -+++ b/scripts/selinux/install_policy.sh -@@ -6,27 +6,24 @@ if [ `id -u` -ne 0 ]; then - exit 1 - fi - --SF=`which setfiles` --if [ $? -eq 1 ]; then -+SF=`which setfiles` || { - echo "Could not find setfiles" - echo "Do you have policycoreutils installed?" - exit 1 --fi -+} - --CP=`which checkpolicy` --if [ $? -eq 1 ]; then -+CP=`which checkpolicy` || { - echo "Could not find checkpolicy" - echo "Do you have checkpolicy installed?" - exit 1 --fi -+} - VERS=`$CP -V | awk '{print $1}'` - --ENABLED=`which selinuxenabled` --if [ $? -eq 1 ]; then -+ENABLED=`which selinuxenabled` || { - echo "Could not find selinuxenabled" - echo "Do you have libselinux-utils installed?" - exit 1 --fi -+} - - if selinuxenabled; then - echo "SELinux is already enabled" -diff --git a/security/smack/smack.h b/security/smack/smack.h -index 041688e5a77a3e..5e4a3c3144dd98 100644 ---- a/security/smack/smack.h -+++ b/security/smack/smack.h -@@ -152,6 +152,7 @@ struct smk_net4addr { - struct smack_known *smk_label; /* label */ - }; - -+#if IS_ENABLED(CONFIG_IPV6) - /* - * An entry in the table identifying IPv6 hosts. - */ -@@ -162,7 +163,9 @@ struct smk_net6addr { - int smk_masks; /* mask size */ - struct smack_known *smk_label; /* label */ - }; -+#endif /* CONFIG_IPV6 */ - -+#ifdef SMACK_IPV6_PORT_LABELING - /* - * An entry in the table identifying ports. - */ -@@ -175,6 +178,7 @@ struct smk_port_label { - short smk_sock_type; /* Socket type */ - short smk_can_reuse; - }; -+#endif /* SMACK_IPV6_PORT_LABELING */ - - struct smack_known_list_elem { - struct list_head list; -@@ -314,7 +318,9 @@ extern struct smack_known smack_known_web; - extern struct mutex smack_known_lock; - extern struct list_head smack_known_list; - extern struct list_head smk_net4addr_list; -+#if IS_ENABLED(CONFIG_IPV6) - extern struct list_head smk_net6addr_list; -+#endif /* CONFIG_IPV6 */ - - extern struct mutex smack_onlycap_lock; - extern struct list_head smack_onlycap_list; -diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c -index 4625674f0e95b8..d272cf8160d530 100644 ---- a/security/smack/smack_lsm.c -+++ b/security/smack/smack_lsm.c -@@ -2476,6 +2476,7 @@ static struct smack_known *smack_ipv4host_label(struct sockaddr_in *sip) - return NULL; - } - -+#if IS_ENABLED(CONFIG_IPV6) - /* - * smk_ipv6_localhost - Check for local ipv6 host address - * @sip: the address -@@ -2543,6 +2544,7 @@ static struct smack_known *smack_ipv6host_label(struct sockaddr_in6 *sip) - - return NULL; - } -+#endif /* CONFIG_IPV6 */ - - /** - * smack_netlbl_add - Set the secattr on a socket -@@ -2646,6 +2648,7 @@ static int smk_ipv4_check(struct sock *sk, struct sockaddr_in *sap) - return rc; - } - -+#if IS_ENABLED(CONFIG_IPV6) - /** - * smk_ipv6_check - check Smack access - * @subject: subject Smack label -@@ -2678,6 +2681,7 @@ static int smk_ipv6_check(struct smack_known *subject, - rc = smk_bu_note("IPv6 check", subject, object, MAY_WRITE, rc); - return rc; - } -+#endif /* CONFIG_IPV6 */ - - #ifdef SMACK_IPV6_PORT_LABELING - /** -@@ -3010,7 +3014,9 @@ static int smack_socket_connect(struct socket *sock, struct sockaddr *sap, - return 0; - if (addrlen < offsetofend(struct sockaddr, sa_family)) - return 0; -- if (IS_ENABLED(CONFIG_IPV6) && sap->sa_family == AF_INET6) { -+ -+#if IS_ENABLED(CONFIG_IPV6) -+ if (sap->sa_family == AF_INET6) { - struct sockaddr_in6 *sip = (struct sockaddr_in6 *)sap; - struct smack_known *rsp = NULL; - -@@ -3030,6 +3036,8 @@ static int smack_socket_connect(struct socket *sock, struct sockaddr *sap, - - return rc; - } -+#endif /* CONFIG_IPV6 */ -+ - if (sap->sa_family != AF_INET || addrlen < sizeof(struct sockaddr_in)) - return 0; - rc = smk_ipv4_check(sock->sk, (struct sockaddr_in *)sap); -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index b3cd6090f46aad..5179061f57b573 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -584,6 +584,9 @@ static void alc_shutup_pins(struct hda_codec *codec) - { - struct alc_spec *spec = codec->spec; - -+ if (spec->no_shutup_pins) -+ return; -+ - switch (codec->core.vendor_id) { - case 0x10ec0236: - case 0x10ec0256: -@@ -599,8 +602,7 @@ static void alc_shutup_pins(struct hda_codec *codec) - alc_headset_mic_no_shutup(codec); - break; - default: -- if (!spec->no_shutup_pins) -- snd_hda_shutup_pins(codec); -+ snd_hda_shutup_pins(codec); - break; - } - } -@@ -4783,6 +4785,21 @@ static void alc236_fixup_hp_coef_micmute_led(struct hda_codec *codec, - } - } - -+static void alc295_fixup_hp_mute_led_coefbit11(struct hda_codec *codec, -+ const struct hda_fixup *fix, int action) -+{ -+ struct alc_spec *spec = codec->spec; -+ -+ if (action == HDA_FIXUP_ACT_PRE_PROBE) { -+ spec->mute_led_polarity = 0; -+ spec->mute_led_coef.idx = 0xb; -+ spec->mute_led_coef.mask = 3 << 3; -+ spec->mute_led_coef.on = 1 << 3; -+ spec->mute_led_coef.off = 1 << 4; -+ snd_hda_gen_add_mute_led_cdev(codec, coef_mute_led_set); -+ } -+} -+ - static void alc285_fixup_hp_mute_led(struct hda_codec *codec, - const struct hda_fixup *fix, int action) - { -@@ -7331,6 +7348,7 @@ enum { - ALC290_FIXUP_MONO_SPEAKERS_HSJACK, - ALC290_FIXUP_SUBWOOFER, - ALC290_FIXUP_SUBWOOFER_HSJACK, -+ ALC295_FIXUP_HP_MUTE_LED_COEFBIT11, - ALC269_FIXUP_THINKPAD_ACPI, - ALC269_FIXUP_DMIC_THINKPAD_ACPI, - ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13, -@@ -9068,6 +9086,10 @@ static const struct hda_fixup alc269_fixups[] = { - .chained = true, - .chain_id = ALC283_FIXUP_INT_MIC, - }, -+ [ALC295_FIXUP_HP_MUTE_LED_COEFBIT11] = { -+ .type = HDA_FIXUP_FUNC, -+ .v.func = alc295_fixup_hp_mute_led_coefbit11, -+ }, - [ALC298_FIXUP_SAMSUNG_AMP] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc298_fixup_samsung_amp, -@@ -9976,6 +9998,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3), - SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360), - SND_PCI_QUIRK(0x103c, 0x8537, "HP ProBook 440 G6", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), -+ SND_PCI_QUIRK(0x103c, 0x85c6, "HP Pavilion x360 Convertible 14-dy1xxx", ALC295_FIXUP_HP_MUTE_LED_COEFBIT11), - SND_PCI_QUIRK(0x103c, 0x85de, "HP Envy x360 13-ar0xxx", ALC285_FIXUP_HP_ENVY_X360), - SND_PCI_QUIRK(0x103c, 0x860f, "HP ZBook 15 G6", ALC285_FIXUP_HP_GPIO_AMP_INIT), - SND_PCI_QUIRK(0x103c, 0x861f, "HP Elite Dragonfly G1", ALC285_FIXUP_HP_GPIO_AMP_INIT), -@@ -10150,12 +10173,15 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x8e1a, "HP ZBook Firefly 14 G12A", ALC285_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), - SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), -+ SND_PCI_QUIRK(0x1043, 0x1054, "ASUS G614FH/FM/FP", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), -+ SND_PCI_QUIRK(0x1043, 0x1074, "ASUS G614PH/PM/PP", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x1043, 0x10a1, "ASUS UX391UA", ALC294_FIXUP_ASUS_SPK), - SND_PCI_QUIRK(0x1043, 0x10c0, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), - SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1043, 0x10d3, "ASUS K6500ZC", ALC294_FIXUP_ASUS_SPK), - SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), -+ SND_PCI_QUIRK(0x1043, 0x1194, "ASUS UM3406KA", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x1043, 0x11c0, "ASUS X556UR", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1043, 0x125e, "ASUS Q524UQK", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1043, 0x1271, "ASUS X430UN", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE), -@@ -10176,6 +10202,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1043, 0x1493, "ASUS GV601VV/VU/VJ/VQ/VI", ALC285_FIXUP_ASUS_HEADSET_MIC), - SND_PCI_QUIRK(0x1043, 0x14d3, "ASUS G614JY/JZ/JG", ALC245_FIXUP_CS35L41_SPI_2), - SND_PCI_QUIRK(0x1043, 0x14e3, "ASUS G513PI/PU/PV", ALC287_FIXUP_CS35L41_I2C_2), -+ SND_PCI_QUIRK(0x1043, 0x14f2, "ASUS VivoBook X515JA", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1043, 0x1503, "ASUS G733PY/PZ/PZV/PYV", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A), - SND_PCI_QUIRK(0x1043, 0x1533, "ASUS GV302XA/XJ/XQ/XU/XV/XI", ALC287_FIXUP_CS35L41_I2C_2), -@@ -10233,7 +10260,9 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401), - SND_PCI_QUIRK(0x1043, 0x1f12, "ASUS UM5302", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x1043, 0x1f62, "ASUS UX7602ZM", ALC245_FIXUP_CS35L41_SPI_2), -+ SND_PCI_QUIRK(0x1043, 0x1f63, "ASUS P5405CSA", ALC245_FIXUP_CS35L41_SPI_2), - SND_PCI_QUIRK(0x1043, 0x1f92, "ASUS ROG Flow X16", ALC289_FIXUP_ASUS_GA401), -+ SND_PCI_QUIRK(0x1043, 0x1fb3, "ASUS ROG Flow Z13 GZ302EA", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2), - SND_PCI_QUIRK(0x1043, 0x3a20, "ASUS G614JZR", ALC245_FIXUP_CS35L41_SPI_2), - SND_PCI_QUIRK(0x1043, 0x3a30, "ASUS G814JVR/JIR", ALC245_FIXUP_CS35L41_SPI_2), -diff --git a/sound/soc/codecs/cs35l41-spi.c b/sound/soc/codecs/cs35l41-spi.c -index 5c8bb24909eb40..bd73944758c6df 100644 ---- a/sound/soc/codecs/cs35l41-spi.c -+++ b/sound/soc/codecs/cs35l41-spi.c -@@ -39,7 +39,9 @@ static int cs35l41_spi_probe(struct spi_device *spi) - return -ENOMEM; - - spi->max_speed_hz = CS35L41_SPI_MAX_FREQ; -- spi_setup(spi); -+ ret = spi_setup(spi); -+ if (ret < 0) -+ return ret; - - spi_set_drvdata(spi, cs35l41); - cs35l41->regmap = devm_regmap_init_spi(spi, regmap_config); -diff --git a/sound/soc/codecs/rt5665.c b/sound/soc/codecs/rt5665.c -index a39de4a7df002c..532d1d6958af3a 100644 ---- a/sound/soc/codecs/rt5665.c -+++ b/sound/soc/codecs/rt5665.c -@@ -31,9 +31,7 @@ - #include "rl6231.h" - #include "rt5665.h" - --#define RT5665_NUM_SUPPLIES 3 -- --static const char *rt5665_supply_names[RT5665_NUM_SUPPLIES] = { -+static const char * const rt5665_supply_names[] = { - "AVDD", - "MICVDD", - "VBAT", -@@ -46,7 +44,6 @@ struct rt5665_priv { - struct gpio_desc *gpiod_ldo1_en; - struct gpio_desc *gpiod_reset; - struct snd_soc_jack *hs_jack; -- struct regulator_bulk_data supplies[RT5665_NUM_SUPPLIES]; - struct delayed_work jack_detect_work; - struct delayed_work calibrate_work; - struct delayed_work jd_check_work; -@@ -4471,8 +4468,6 @@ static void rt5665_remove(struct snd_soc_component *component) - struct rt5665_priv *rt5665 = snd_soc_component_get_drvdata(component); - - regmap_write(rt5665->regmap, RT5665_RESET, 0); -- -- regulator_bulk_disable(ARRAY_SIZE(rt5665->supplies), rt5665->supplies); - } - - #ifdef CONFIG_PM -@@ -4758,7 +4753,7 @@ static int rt5665_i2c_probe(struct i2c_client *i2c) - { - struct rt5665_platform_data *pdata = dev_get_platdata(&i2c->dev); - struct rt5665_priv *rt5665; -- int i, ret; -+ int ret; - unsigned int val; - - rt5665 = devm_kzalloc(&i2c->dev, sizeof(struct rt5665_priv), -@@ -4774,24 +4769,13 @@ static int rt5665_i2c_probe(struct i2c_client *i2c) - else - rt5665_parse_dt(rt5665, &i2c->dev); - -- for (i = 0; i < ARRAY_SIZE(rt5665->supplies); i++) -- rt5665->supplies[i].supply = rt5665_supply_names[i]; -- -- ret = devm_regulator_bulk_get(&i2c->dev, ARRAY_SIZE(rt5665->supplies), -- rt5665->supplies); -+ ret = devm_regulator_bulk_get_enable(&i2c->dev, ARRAY_SIZE(rt5665_supply_names), -+ rt5665_supply_names); - if (ret != 0) { - dev_err(&i2c->dev, "Failed to request supplies: %d\n", ret); - return ret; - } - -- ret = regulator_bulk_enable(ARRAY_SIZE(rt5665->supplies), -- rt5665->supplies); -- if (ret != 0) { -- dev_err(&i2c->dev, "Failed to enable supplies: %d\n", ret); -- return ret; -- } -- -- - rt5665->gpiod_ldo1_en = devm_gpiod_get_optional(&i2c->dev, - "realtek,ldo1-en", - GPIOD_OUT_HIGH); -diff --git a/sound/soc/fsl/imx-card.c b/sound/soc/fsl/imx-card.c -index f8144bf4c90d33..7128bcf3a743e1 100644 ---- a/sound/soc/fsl/imx-card.c -+++ b/sound/soc/fsl/imx-card.c -@@ -742,6 +742,8 @@ static int imx_card_probe(struct platform_device *pdev) - data->dapm_routes[i].sink = - devm_kasprintf(&pdev->dev, GFP_KERNEL, "%d %s", - i + 1, "Playback"); -+ if (!data->dapm_routes[i].sink) -+ return -ENOMEM; - data->dapm_routes[i].source = "CPU-Playback"; - } - } -@@ -759,6 +761,8 @@ static int imx_card_probe(struct platform_device *pdev) - data->dapm_routes[i].source = - devm_kasprintf(&pdev->dev, GFP_KERNEL, "%d %s", - i + 1, "Capture"); -+ if (!data->dapm_routes[i].source) -+ return -ENOMEM; - data->dapm_routes[i].sink = "CPU-Capture"; - } - } -diff --git a/sound/soc/ti/j721e-evm.c b/sound/soc/ti/j721e-evm.c -index 6a969874c92701..5e0bdbd34a8375 100644 ---- a/sound/soc/ti/j721e-evm.c -+++ b/sound/soc/ti/j721e-evm.c -@@ -182,6 +182,8 @@ static int j721e_configure_refclk(struct j721e_priv *priv, - clk_id = J721E_CLK_PARENT_48000; - else if (!(rate % 11025) && priv->pll_rates[J721E_CLK_PARENT_44100]) - clk_id = J721E_CLK_PARENT_44100; -+ else if (!(rate % 11025) && priv->pll_rates[J721E_CLK_PARENT_48000]) -+ clk_id = J721E_CLK_PARENT_48000; - else - return ret; - -diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c -index 736ebceea233f8..a3a190d13db8a0 100644 ---- a/tools/lib/bpf/linker.c -+++ b/tools/lib/bpf/linker.c -@@ -1974,7 +1974,7 @@ static int linker_append_elf_sym(struct bpf_linker *linker, struct src_obj *obj, - - obj->sym_map[src_sym_idx] = dst_sym_idx; - -- if (sym_type == STT_SECTION && dst_sym) { -+ if (sym_type == STT_SECTION && dst_sec) { - dst_sec->sec_sym_idx = dst_sym_idx; - dst_sym->st_value = 0; - } -diff --git a/tools/objtool/check.c b/tools/objtool/check.c -index 6e59e7f578ffe2..9102ad5985cc0f 100644 ---- a/tools/objtool/check.c -+++ b/tools/objtool/check.c -@@ -4089,7 +4089,7 @@ static bool ignore_unreachable_insn(struct objtool_file *file, struct instructio - * It may also insert a UD2 after calling a __noreturn function. - */ - prev_insn = prev_insn_same_sec(file, insn); -- if (prev_insn->dead_end && -+ if (prev_insn && prev_insn->dead_end && - (insn->type == INSN_BUG || - (insn->type == INSN_JUMP_UNCONDITIONAL && - insn->jump_dest && insn->jump_dest->type == INSN_BUG))) -@@ -4511,35 +4511,6 @@ static int validate_sls(struct objtool_file *file) - return warnings; - } - --static bool ignore_noreturn_call(struct instruction *insn) --{ -- struct symbol *call_dest = insn_call_dest(insn); -- -- /* -- * FIXME: hack, we need a real noreturn solution -- * -- * Problem is, exc_double_fault() may or may not return, depending on -- * whether CONFIG_X86_ESPFIX64 is set. But objtool has no visibility -- * to the kernel config. -- * -- * Other potential ways to fix it: -- * -- * - have compiler communicate __noreturn functions somehow -- * - remove CONFIG_X86_ESPFIX64 -- * - read the .config file -- * - add a cmdline option -- * - create a generic objtool annotation format (vs a bunch of custom -- * formats) and annotate it -- */ -- if (!strcmp(call_dest->name, "exc_double_fault")) { -- /* prevent further unreachable warnings for the caller */ -- insn->sym->warned = 1; -- return true; -- } -- -- return false; --} -- - static int validate_reachable_instructions(struct objtool_file *file) - { - struct instruction *insn, *prev_insn; -@@ -4556,7 +4527,7 @@ static int validate_reachable_instructions(struct objtool_file *file) - prev_insn = prev_insn_same_sec(file, insn); - if (prev_insn && prev_insn->dead_end) { - call_dest = insn_call_dest(prev_insn); -- if (call_dest && !ignore_noreturn_call(prev_insn)) { -+ if (call_dest) { - WARN_INSN(insn, "%s() is missing a __noreturn annotation", - call_dest->name); - warnings++; -@@ -4579,6 +4550,8 @@ static int disas_funcs(const char *funcs) - char *cmd; - - cross_compile = getenv("CROSS_COMPILE"); -+ if (!cross_compile) -+ cross_compile = ""; - - objdump_str = "%sobjdump -wdr %s | gawk -M -v _funcs='%s' '" - "BEGIN { split(_funcs, funcs); }" -diff --git a/tools/perf/bench/syscall.c b/tools/perf/bench/syscall.c -index ea4dfc07cbd6b8..e7dc216f717f5a 100644 ---- a/tools/perf/bench/syscall.c -+++ b/tools/perf/bench/syscall.c -@@ -22,8 +22,7 @@ - #define __NR_fork -1 - #endif - --#define LOOPS_DEFAULT 10000000 --static int loops = LOOPS_DEFAULT; -+static int loops; - - static const struct option options[] = { - OPT_INTEGER('l', "loop", &loops, "Specify number of loops"), -@@ -80,6 +79,18 @@ static int bench_syscall_common(int argc, const char **argv, int syscall) - const char *name = NULL; - int i; - -+ switch (syscall) { -+ case __NR_fork: -+ case __NR_execve: -+ /* Limit default loop to 10000 times to save time */ -+ loops = 10000; -+ break; -+ default: -+ loops = 10000000; -+ break; -+ } -+ -+ /* Options -l and --loops override default above */ - argc = parse_options(argc, argv, options, bench_syscall_usage, 0); - - gettimeofday(&start, NULL); -@@ -94,16 +105,9 @@ static int bench_syscall_common(int argc, const char **argv, int syscall) - break; - case __NR_fork: - test_fork(); -- /* Only loop 10000 times to save time */ -- if (i == 10000) -- loops = 10000; - break; - case __NR_execve: - test_execve(); -- /* Only loop 10000 times to save time */ -- if (i == 10000) -- loops = 10000; -- break; - default: - break; - } -diff --git a/tools/perf/tests/shell/coresight/asm_pure_loop/asm_pure_loop.S b/tools/perf/tests/shell/coresight/asm_pure_loop/asm_pure_loop.S -index 75cf084a927d3d..5777600467723f 100644 ---- a/tools/perf/tests/shell/coresight/asm_pure_loop/asm_pure_loop.S -+++ b/tools/perf/tests/shell/coresight/asm_pure_loop/asm_pure_loop.S -@@ -26,3 +26,5 @@ skip: - mov x0, #0 - mov x8, #93 // __NR_exit syscall - svc #0 -+ -+.section .note.GNU-stack, "", @progbits -diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c -index afbd5869f6bff2..9848310cee5f35 100644 ---- a/tools/perf/util/arm-spe.c -+++ b/tools/perf/util/arm-spe.c -@@ -37,6 +37,8 @@ - #include "../../arch/arm64/include/asm/cputype.h" - #define MAX_TIMESTAMP (~0ULL) - -+#define is_ldst_op(op) (!!((op) & ARM_SPE_OP_LDST)) -+ - struct arm_spe { - struct auxtrace auxtrace; - struct auxtrace_queues queues; -@@ -520,6 +522,10 @@ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 m - union perf_mem_data_src data_src = { .mem_op = PERF_MEM_OP_NA }; - bool is_neoverse = is_midr_in_range_list(midr, neoverse_spe); - -+ /* Only synthesize data source for LDST operations */ -+ if (!is_ldst_op(record->op)) -+ return 0; -+ - if (record->op & ARM_SPE_OP_LD) - data_src.mem_op = PERF_MEM_OP_LOAD; - else if (record->op & ARM_SPE_OP_ST) -@@ -619,7 +625,7 @@ static int arm_spe_sample(struct arm_spe_queue *speq) - * When data_src is zero it means the record is not a memory operation, - * skip to synthesize memory sample for this case. - */ -- if (spe->sample_memory && data_src) { -+ if (spe->sample_memory && is_ldst_op(record->op)) { - err = arm_spe__synth_mem_sample(speq, spe->memory_id, data_src); - if (err) - return err; -diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c -index 1eadb4f7c1b9dc..f86a1eb4ea36a5 100644 ---- a/tools/perf/util/evlist.c -+++ b/tools/perf/util/evlist.c -@@ -1362,19 +1362,18 @@ static int evlist__create_syswide_maps(struct evlist *evlist) - */ - cpus = perf_cpu_map__new(NULL); - if (!cpus) -- goto out; -+ return -ENOMEM; - - threads = perf_thread_map__new_dummy(); -- if (!threads) -- goto out_put; -+ if (!threads) { -+ perf_cpu_map__put(cpus); -+ return -ENOMEM; -+ } - - perf_evlist__set_maps(&evlist->core, cpus, threads); -- - perf_thread_map__put(threads); --out_put: - perf_cpu_map__put(cpus); --out: -- return -ENOMEM; -+ return 0; - } - - int evlist__open(struct evlist *evlist) -diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c -index 27393e4327922c..2587c4b463fa88 100644 ---- a/tools/perf/util/pmu.c -+++ b/tools/perf/util/pmu.c -@@ -597,7 +597,7 @@ static int perf_pmu__new_alias(struct perf_pmu *pmu, const char *name, - }; - if (pmu_events_table__find_event(pmu->events_table, pmu, name, - update_alias, &data) == 0) -- pmu->cpu_json_aliases++; -+ pmu->cpu_common_json_aliases++; - } - pmu->sysfs_aliases++; - break; -@@ -1680,9 +1680,10 @@ size_t perf_pmu__num_events(struct perf_pmu *pmu) - if (pmu->cpu_aliases_added) - nr += pmu->cpu_json_aliases; - else if (pmu->events_table) -- nr += pmu_events_table__num_events(pmu->events_table, pmu) - pmu->cpu_json_aliases; -+ nr += pmu_events_table__num_events(pmu->events_table, pmu) - -+ pmu->cpu_common_json_aliases; - else -- assert(pmu->cpu_json_aliases == 0); -+ assert(pmu->cpu_json_aliases == 0 && pmu->cpu_common_json_aliases == 0); - - return pmu->selectable ? nr + 1 : nr; - } -diff --git a/tools/perf/util/pmu.h b/tools/perf/util/pmu.h -index aca4238f06a657..5a03c361cb04ce 100644 ---- a/tools/perf/util/pmu.h -+++ b/tools/perf/util/pmu.h -@@ -124,6 +124,11 @@ struct perf_pmu { - uint32_t cpu_json_aliases; - /** @sys_json_aliases: Number of json event aliases loaded matching the PMU's identifier. */ - uint32_t sys_json_aliases; -+ /** -+ * @cpu_common_json_aliases: Number of json events that overlapped with sysfs when -+ * loading all sysfs events. -+ */ -+ uint32_t cpu_common_json_aliases; - /** @sysfs_aliases_loaded: Are sysfs aliases loaded from disk? */ - bool sysfs_aliases_loaded; - /** -diff --git a/tools/perf/util/pmus.c b/tools/perf/util/pmus.c -index f0577aa7eca885..dda5ba9c73fd9c 100644 ---- a/tools/perf/util/pmus.c -+++ b/tools/perf/util/pmus.c -@@ -587,11 +587,25 @@ char *perf_pmus__default_pmu_name(void) - struct perf_pmu *evsel__find_pmu(const struct evsel *evsel) - { - struct perf_pmu *pmu = evsel->pmu; -+ bool legacy_core_type; - -- if (!pmu) { -- pmu = perf_pmus__find_by_type(evsel->core.attr.type); -- ((struct evsel *)evsel)->pmu = pmu; -+ if (pmu) -+ return pmu; -+ -+ pmu = perf_pmus__find_by_type(evsel->core.attr.type); -+ legacy_core_type = -+ evsel->core.attr.type == PERF_TYPE_HARDWARE || -+ evsel->core.attr.type == PERF_TYPE_HW_CACHE; -+ if (!pmu && legacy_core_type) { -+ if (perf_pmus__supports_extended_type()) { -+ u32 type = evsel->core.attr.config >> PERF_PMU_TYPE_SHIFT; -+ -+ pmu = perf_pmus__find_by_type(type); -+ } else { -+ pmu = perf_pmus__find_core_pmu(); -+ } - } -+ ((struct evsel *)evsel)->pmu = pmu; - return pmu; - } - -diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c -index b01b0e55105638..06a1e09d7349c1 100644 ---- a/tools/perf/util/python.c -+++ b/tools/perf/util/python.c -@@ -238,7 +238,7 @@ struct pyrf_event { - }; - - #define sample_members \ -- sample_member_def(sample_ip, ip, T_ULONGLONG, "event type"), \ -+ sample_member_def(sample_ip, ip, T_ULONGLONG, "event ip"), \ - sample_member_def(sample_pid, pid, T_INT, "event pid"), \ - sample_member_def(sample_tid, tid, T_INT, "event tid"), \ - sample_member_def(sample_time, time, T_ULONGLONG, "event timestamp"), \ -@@ -671,6 +671,11 @@ static PyObject *pyrf_event__new(union perf_event *event) - event->header.type == PERF_RECORD_SWITCH_CPU_WIDE)) - return NULL; - -+ // FIXME this better be dynamic or we need to parse everything -+ // before calling perf_mmap__consume(), including tracepoint fields. -+ if (sizeof(pevent->event) < event->header.size) -+ return NULL; -+ - ptype = pyrf_event__type[event->header.type]; - pevent = PyObject_New(struct pyrf_event, ptype); - if (pevent != NULL) -@@ -1170,20 +1175,22 @@ static PyObject *pyrf_evlist__read_on_cpu(struct pyrf_evlist *pevlist, - - evsel = evlist__event2evsel(evlist, event); - if (!evsel) { -+ Py_DECREF(pyevent); - Py_INCREF(Py_None); - return Py_None; - } - - pevent->evsel = evsel; - -- err = evsel__parse_sample(evsel, event, &pevent->sample); -- -- /* Consume the even only after we parsed it out. */ - perf_mmap__consume(&md->core); - -- if (err) -+ err = evsel__parse_sample(evsel, &pevent->event, &pevent->sample); -+ if (err) { -+ Py_DECREF(pyevent); - return PyErr_Format(PyExc_OSError, - "perf: can't parse sample, err=%d", err); -+ } -+ - return pyevent; - } - end: -diff --git a/tools/perf/util/stat-shadow.c b/tools/perf/util/stat-shadow.c -index 2affa4d45aa21c..56b186d3074532 100644 ---- a/tools/perf/util/stat-shadow.c -+++ b/tools/perf/util/stat-shadow.c -@@ -154,6 +154,7 @@ static double find_stat(const struct evsel *evsel, int aggr_idx, enum stat_type - { - const struct evsel *cur; - int evsel_ctx = evsel_context(evsel); -+ struct perf_pmu *evsel_pmu = evsel__find_pmu(evsel); - - evlist__for_each_entry(evsel->evlist, cur) { - struct perf_stat_aggr *aggr; -@@ -180,7 +181,7 @@ static double find_stat(const struct evsel *evsel, int aggr_idx, enum stat_type - * Except the SW CLOCK events, - * ignore if not the PMU we're looking for. - */ -- if ((type != STAT_NSECS) && (evsel->pmu != cur->pmu)) -+ if ((type != STAT_NSECS) && (evsel_pmu != evsel__find_pmu(cur))) - continue; - - aggr = &cur->stats->aggr[aggr_idx]; -diff --git a/tools/perf/util/units.c b/tools/perf/util/units.c -index 32c39cfe209b3b..4c6a86e1cb54b2 100644 ---- a/tools/perf/util/units.c -+++ b/tools/perf/util/units.c -@@ -64,7 +64,7 @@ unsigned long convert_unit(unsigned long value, char *unit) - - int unit_number__scnprintf(char *buf, size_t size, u64 n) - { -- char unit[4] = "BKMG"; -+ char unit[] = "BKMG"; - int i = 0; - - while (((n / 1024) > 1) && (i < 3)) { -diff --git a/tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c b/tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c -index f79815b7e951b3..fff16cdc93f205 100644 ---- a/tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c -+++ b/tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c -@@ -6,6 +6,10 @@ - #include - #include "bloom_filter_map.skel.h" - -+#ifndef NUMA_NO_NODE -+#define NUMA_NO_NODE (-1) -+#endif -+ - static void test_fail_cases(void) - { - LIBBPF_OPTS(bpf_map_create_opts, opts); -@@ -69,6 +73,7 @@ static void test_success_cases(void) - - /* Create a map */ - opts.map_flags = BPF_F_ZERO_SEED | BPF_F_NUMA_NODE; -+ opts.numa_node = NUMA_NO_NODE; - fd = bpf_map_create(BPF_MAP_TYPE_BLOOM_FILTER, NULL, 0, sizeof(value), 100, &opts); - if (!ASSERT_GE(fd, 0, "bpf_map_create bloom filter success case")) - return; -diff --git a/tools/testing/selftests/bpf/progs/strncmp_bench.c b/tools/testing/selftests/bpf/progs/strncmp_bench.c -index 18373a7df76e6c..f47bf88f8d2a73 100644 ---- a/tools/testing/selftests/bpf/progs/strncmp_bench.c -+++ b/tools/testing/selftests/bpf/progs/strncmp_bench.c -@@ -35,7 +35,10 @@ static __always_inline int local_strncmp(const char *s1, unsigned int sz, - SEC("tp/syscalls/sys_enter_getpgid") - int strncmp_no_helper(void *ctx) - { -- if (local_strncmp(str, cmp_str_len + 1, target) < 0) -+ const char *target_str = target; -+ -+ barrier_var(target_str); -+ if (local_strncmp(str, cmp_str_len + 1, target_str) < 0) - __sync_add_and_fetch(&hits, 1); - return 0; - } -diff --git a/tools/testing/selftests/mm/cow.c b/tools/testing/selftests/mm/cow.c -index 6f2f839904416c..76d37904172db3 100644 ---- a/tools/testing/selftests/mm/cow.c -+++ b/tools/testing/selftests/mm/cow.c -@@ -812,7 +812,7 @@ static void do_run_with_thp(test_fn fn, enum thp_run thp_run) - mremap_size = thpsize / 2; - mremap_mem = mmap(NULL, mremap_size, PROT_NONE, - MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); -- if (mem == MAP_FAILED) { -+ if (mremap_mem == MAP_FAILED) { - ksft_test_result_fail("mmap() failed\n"); - goto munmap; - } diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.087-088.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.087-088.patch deleted file mode 100644 index f8333c4b51..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.087-088.patch +++ /dev/null @@ -1,13715 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/arm/qcom,coresight-tpda.yaml b/Documentation/devicetree/bindings/arm/qcom,coresight-tpda.yaml -index ea3c5db6b52d2d..0f7e1b6ea81e9a 100644 ---- a/Documentation/devicetree/bindings/arm/qcom,coresight-tpda.yaml -+++ b/Documentation/devicetree/bindings/arm/qcom,coresight-tpda.yaml -@@ -55,8 +55,7 @@ properties: - - const: arm,primecell - - reg: -- minItems: 1 -- maxItems: 2 -+ maxItems: 1 - - clocks: - maxItems: 1 -diff --git a/Documentation/devicetree/bindings/arm/qcom,coresight-tpdm.yaml b/Documentation/devicetree/bindings/arm/qcom,coresight-tpdm.yaml -index 3bad47b7b02bb9..0b4afb4078ef81 100644 ---- a/Documentation/devicetree/bindings/arm/qcom,coresight-tpdm.yaml -+++ b/Documentation/devicetree/bindings/arm/qcom,coresight-tpdm.yaml -@@ -41,8 +41,7 @@ properties: - - const: arm,primecell - - reg: -- minItems: 1 -- maxItems: 2 -+ maxItems: 1 - - clocks: - maxItems: 1 -diff --git a/Documentation/devicetree/bindings/media/i2c/st,st-mipid02.yaml b/Documentation/devicetree/bindings/media/i2c/st,st-mipid02.yaml -index b68141264c0e9f..4d40e75b4e1eff 100644 ---- a/Documentation/devicetree/bindings/media/i2c/st,st-mipid02.yaml -+++ b/Documentation/devicetree/bindings/media/i2c/st,st-mipid02.yaml -@@ -71,7 +71,7 @@ properties: - description: - Any lane can be inverted or not. - minItems: 1 -- maxItems: 2 -+ maxItems: 3 - - required: - - data-lanes -diff --git a/Documentation/netlink/specs/rt_link.yaml b/Documentation/netlink/specs/rt_link.yaml -index d86a68f8475ca8..a8a1466adf1796 100644 ---- a/Documentation/netlink/specs/rt_link.yaml -+++ b/Documentation/netlink/specs/rt_link.yaml -@@ -892,11 +892,10 @@ attribute-sets: - - - name: prop-list - type: nest -- nested-attributes: link-attrs -+ nested-attributes: prop-list-link-attrs - - - name: alt-ifname - type: string -- multi-attr: true - - - name: perm-address - type: binary -@@ -931,6 +930,13 @@ attribute-sets: - - - name: gro-ipv4-max-size - type: u32 -+ - -+ name: prop-list-link-attrs -+ subset-of: link-attrs -+ attributes: -+ - -+ name: alt-ifname -+ multi-attr: true - - - name: af-spec-attrs - attributes: -@@ -1193,9 +1199,10 @@ attribute-sets: - type: u32 - - - name: mctp-attrs -+ name-prefix: ifla-mctp- - attributes: - - -- name: mctp-net -+ name: net - type: u32 - - - name: stats-attrs -@@ -1362,7 +1369,6 @@ operations: - - min-mtu - - max-mtu - - prop-list -- - alt-ifname - - perm-address - - proto-down-reason - - parent-dev-name -diff --git a/MAINTAINERS b/MAINTAINERS -index ae4c0cec507360..294d2ce29b7356 100644 ---- a/MAINTAINERS -+++ b/MAINTAINERS -@@ -4784,6 +4784,7 @@ S: Maintained - F: Documentation/admin-guide/module-signing.rst - F: certs/ - F: scripts/sign-file.c -+F: scripts/ssl-common.h - F: tools/certs/ - - CFAG12864B LCD DRIVER -diff --git a/Makefile b/Makefile -index 45f6b7d3d51e26..b1dfe3df7dfc9d 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 87 -+SUBLEVEL = 88 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -@@ -1004,6 +1004,9 @@ ifdef CONFIG_CC_IS_GCC - KBUILD_CFLAGS += -fconserve-stack - endif - -+# Ensure compilers do not transform certain loops into calls to wcslen() -+KBUILD_CFLAGS += -fno-builtin-wcslen -+ - # change __FILE__ to the relative path from the srctree - KBUILD_CPPFLAGS += $(call cc-option,-fmacro-prefix-map=$(srctree)/=) - -diff --git a/arch/arm64/boot/dts/mediatek/mt8173.dtsi b/arch/arm64/boot/dts/mediatek/mt8173.dtsi -index c47d7d900f2836..0582d75349ba77 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8173.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt8173.dtsi -@@ -1246,8 +1246,7 @@ dpi0_out: endpoint { - }; - - pwm0: pwm@1401e000 { -- compatible = "mediatek,mt8173-disp-pwm", -- "mediatek,mt6595-disp-pwm"; -+ compatible = "mediatek,mt8173-disp-pwm"; - reg = <0 0x1401e000 0 0x1000>; - #pwm-cells = <2>; - clocks = <&mmsys CLK_MM_DISP_PWM026M>, -@@ -1257,8 +1256,7 @@ pwm0: pwm@1401e000 { - }; - - pwm1: pwm@1401f000 { -- compatible = "mediatek,mt8173-disp-pwm", -- "mediatek,mt6595-disp-pwm"; -+ compatible = "mediatek,mt8173-disp-pwm"; - reg = <0 0x1401f000 0 0x1000>; - #pwm-cells = <2>; - clocks = <&mmsys CLK_MM_DISP_PWM126M>, -diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h -index 488f8e75134959..2a4e686e633c62 100644 ---- a/arch/arm64/include/asm/cputype.h -+++ b/arch/arm64/include/asm/cputype.h -@@ -75,6 +75,7 @@ - #define ARM_CPU_PART_CORTEX_A76 0xD0B - #define ARM_CPU_PART_NEOVERSE_N1 0xD0C - #define ARM_CPU_PART_CORTEX_A77 0xD0D -+#define ARM_CPU_PART_CORTEX_A76AE 0xD0E - #define ARM_CPU_PART_NEOVERSE_V1 0xD40 - #define ARM_CPU_PART_CORTEX_A78 0xD41 - #define ARM_CPU_PART_CORTEX_A78AE 0xD42 -@@ -119,6 +120,7 @@ - #define QCOM_CPU_PART_KRYO 0x200 - #define QCOM_CPU_PART_KRYO_2XX_GOLD 0x800 - #define QCOM_CPU_PART_KRYO_2XX_SILVER 0x801 -+#define QCOM_CPU_PART_KRYO_3XX_GOLD 0x802 - #define QCOM_CPU_PART_KRYO_3XX_SILVER 0x803 - #define QCOM_CPU_PART_KRYO_4XX_GOLD 0x804 - #define QCOM_CPU_PART_KRYO_4XX_SILVER 0x805 -@@ -158,6 +160,7 @@ - #define MIDR_CORTEX_A76 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A76) - #define MIDR_NEOVERSE_N1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N1) - #define MIDR_CORTEX_A77 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A77) -+#define MIDR_CORTEX_A76AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A76AE) - #define MIDR_NEOVERSE_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V1) - #define MIDR_CORTEX_A78 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78) - #define MIDR_CORTEX_A78AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78AE) -@@ -195,6 +198,7 @@ - #define MIDR_QCOM_KRYO MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO) - #define MIDR_QCOM_KRYO_2XX_GOLD MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO_2XX_GOLD) - #define MIDR_QCOM_KRYO_2XX_SILVER MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO_2XX_SILVER) -+#define MIDR_QCOM_KRYO_3XX_GOLD MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO_3XX_GOLD) - #define MIDR_QCOM_KRYO_3XX_SILVER MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO_3XX_SILVER) - #define MIDR_QCOM_KRYO_4XX_GOLD MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO_4XX_GOLD) - #define MIDR_QCOM_KRYO_4XX_SILVER MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO_4XX_SILVER) -diff --git a/arch/arm64/include/asm/spectre.h b/arch/arm64/include/asm/spectre.h -index 9cc501450486d8..0c2b47673922e3 100644 ---- a/arch/arm64/include/asm/spectre.h -+++ b/arch/arm64/include/asm/spectre.h -@@ -97,7 +97,6 @@ enum mitigation_state arm64_get_meltdown_state(void); - - enum mitigation_state arm64_get_spectre_bhb_state(void); - bool is_spectre_bhb_affected(const struct arm64_cpu_capabilities *entry, int scope); --u8 spectre_bhb_loop_affected(int scope); - void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *__unused); - bool try_emulate_el1_ssbs(struct pt_regs *regs, u32 instr); - -diff --git a/arch/arm64/include/asm/tlbflush.h b/arch/arm64/include/asm/tlbflush.h -index b73baaf8ae47be..d37db2f7a54cf0 100644 ---- a/arch/arm64/include/asm/tlbflush.h -+++ b/arch/arm64/include/asm/tlbflush.h -@@ -369,31 +369,33 @@ static inline void arch_tlbbatch_flush(struct arch_tlbflush_unmap_batch *batch) - #define __flush_tlb_range_op(op, start, pages, stride, \ - asid, tlb_level, tlbi_user) \ - do { \ -+ typeof(start) __flush_start = start; \ -+ typeof(pages) __flush_pages = pages; \ - int num = 0; \ - int scale = 3; \ - unsigned long addr; \ - \ -- while (pages > 0) { \ -+ while (__flush_pages > 0) { \ - if (!system_supports_tlb_range() || \ -- pages == 1) { \ -- addr = __TLBI_VADDR(start, asid); \ -+ __flush_pages == 1) { \ -+ addr = __TLBI_VADDR(__flush_start, asid); \ - __tlbi_level(op, addr, tlb_level); \ - if (tlbi_user) \ - __tlbi_user_level(op, addr, tlb_level); \ -- start += stride; \ -- pages -= stride >> PAGE_SHIFT; \ -+ __flush_start += stride; \ -+ __flush_pages -= stride >> PAGE_SHIFT; \ - continue; \ - } \ - \ -- num = __TLBI_RANGE_NUM(pages, scale); \ -+ num = __TLBI_RANGE_NUM(__flush_pages, scale); \ - if (num >= 0) { \ -- addr = __TLBI_VADDR_RANGE(start, asid, scale, \ -- num, tlb_level); \ -+ addr = __TLBI_VADDR_RANGE(__flush_start, asid, \ -+ scale, num, tlb_level); \ - __tlbi(r##op, addr); \ - if (tlbi_user) \ - __tlbi_user(r##op, addr); \ -- start += __TLBI_RANGE_PAGES(num, scale) << PAGE_SHIFT; \ -- pages -= __TLBI_RANGE_PAGES(num, scale); \ -+ __flush_start += __TLBI_RANGE_PAGES(num, scale) << PAGE_SHIFT; \ -+ __flush_pages -= __TLBI_RANGE_PAGES(num, scale);\ - } \ - scale--; \ - } \ -diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c -index 57503dc4b22faf..ecfbff6991bb5d 100644 ---- a/arch/arm64/kernel/proton-pack.c -+++ b/arch/arm64/kernel/proton-pack.c -@@ -845,52 +845,86 @@ static unsigned long system_bhb_mitigations; - * This must be called with SCOPE_LOCAL_CPU for each type of CPU, before any - * SCOPE_SYSTEM call will give the right answer. - */ --u8 spectre_bhb_loop_affected(int scope) -+static bool is_spectre_bhb_safe(int scope) -+{ -+ static const struct midr_range spectre_bhb_safe_list[] = { -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A35), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A53), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A55), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A510), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A520), -+ MIDR_ALL_VERSIONS(MIDR_BRAHMA_B53), -+ MIDR_ALL_VERSIONS(MIDR_QCOM_KRYO_2XX_SILVER), -+ MIDR_ALL_VERSIONS(MIDR_QCOM_KRYO_3XX_SILVER), -+ MIDR_ALL_VERSIONS(MIDR_QCOM_KRYO_4XX_SILVER), -+ {}, -+ }; -+ static bool all_safe = true; -+ -+ if (scope != SCOPE_LOCAL_CPU) -+ return all_safe; -+ -+ if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_safe_list)) -+ return true; -+ -+ all_safe = false; -+ -+ return false; -+} -+ -+static u8 spectre_bhb_loop_affected(void) - { - u8 k = 0; -- static u8 max_bhb_k; -- -- if (scope == SCOPE_LOCAL_CPU) { -- static const struct midr_range spectre_bhb_k32_list[] = { -- MIDR_ALL_VERSIONS(MIDR_CORTEX_A78), -- MIDR_ALL_VERSIONS(MIDR_CORTEX_A78AE), -- MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C), -- MIDR_ALL_VERSIONS(MIDR_CORTEX_X1), -- MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), -- MIDR_ALL_VERSIONS(MIDR_CORTEX_X2), -- MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), -- MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), -- {}, -- }; -- static const struct midr_range spectre_bhb_k24_list[] = { -- MIDR_ALL_VERSIONS(MIDR_CORTEX_A76), -- MIDR_ALL_VERSIONS(MIDR_CORTEX_A77), -- MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), -- {}, -- }; -- static const struct midr_range spectre_bhb_k11_list[] = { -- MIDR_ALL_VERSIONS(MIDR_AMPERE1), -- {}, -- }; -- static const struct midr_range spectre_bhb_k8_list[] = { -- MIDR_ALL_VERSIONS(MIDR_CORTEX_A72), -- MIDR_ALL_VERSIONS(MIDR_CORTEX_A57), -- {}, -- }; -- -- if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k32_list)) -- k = 32; -- else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k24_list)) -- k = 24; -- else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k11_list)) -- k = 11; -- else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k8_list)) -- k = 8; -- -- max_bhb_k = max(max_bhb_k, k); -- } else { -- k = max_bhb_k; -- } -+ -+ static const struct midr_range spectre_bhb_k132_list[] = { -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X3), -+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2), -+ }; -+ static const struct midr_range spectre_bhb_k38_list[] = { -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A715), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A720), -+ }; -+ static const struct midr_range spectre_bhb_k32_list[] = { -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78AE), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X1), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X2), -+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), -+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), -+ {}, -+ }; -+ static const struct midr_range spectre_bhb_k24_list[] = { -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A76), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A76AE), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A77), -+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), -+ MIDR_ALL_VERSIONS(MIDR_QCOM_KRYO_4XX_GOLD), -+ {}, -+ }; -+ static const struct midr_range spectre_bhb_k11_list[] = { -+ MIDR_ALL_VERSIONS(MIDR_AMPERE1), -+ {}, -+ }; -+ static const struct midr_range spectre_bhb_k8_list[] = { -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A72), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A57), -+ {}, -+ }; -+ -+ if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k132_list)) -+ k = 132; -+ else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k38_list)) -+ k = 38; -+ else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k32_list)) -+ k = 32; -+ else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k24_list)) -+ k = 24; -+ else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k11_list)) -+ k = 11; -+ else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k8_list)) -+ k = 8; - - return k; - } -@@ -916,29 +950,13 @@ static enum mitigation_state spectre_bhb_get_cpu_fw_mitigation_state(void) - } - } - --static bool is_spectre_bhb_fw_affected(int scope) -+static bool has_spectre_bhb_fw_mitigation(void) - { -- static bool system_affected; - enum mitigation_state fw_state; - bool has_smccc = arm_smccc_1_1_get_conduit() != SMCCC_CONDUIT_NONE; -- static const struct midr_range spectre_bhb_firmware_mitigated_list[] = { -- MIDR_ALL_VERSIONS(MIDR_CORTEX_A73), -- MIDR_ALL_VERSIONS(MIDR_CORTEX_A75), -- {}, -- }; -- bool cpu_in_list = is_midr_in_range_list(read_cpuid_id(), -- spectre_bhb_firmware_mitigated_list); -- -- if (scope != SCOPE_LOCAL_CPU) -- return system_affected; - - fw_state = spectre_bhb_get_cpu_fw_mitigation_state(); -- if (cpu_in_list || (has_smccc && fw_state == SPECTRE_MITIGATED)) { -- system_affected = true; -- return true; -- } -- -- return false; -+ return has_smccc && fw_state == SPECTRE_MITIGATED; - } - - static bool supports_ecbhb(int scope) -@@ -954,6 +972,8 @@ static bool supports_ecbhb(int scope) - ID_AA64MMFR1_EL1_ECBHB_SHIFT); - } - -+static u8 max_bhb_k; -+ - bool is_spectre_bhb_affected(const struct arm64_cpu_capabilities *entry, - int scope) - { -@@ -962,16 +982,18 @@ bool is_spectre_bhb_affected(const struct arm64_cpu_capabilities *entry, - if (supports_csv2p3(scope)) - return false; - -- if (supports_clearbhb(scope)) -- return true; -- -- if (spectre_bhb_loop_affected(scope)) -- return true; -+ if (is_spectre_bhb_safe(scope)) -+ return false; - -- if (is_spectre_bhb_fw_affected(scope)) -- return true; -+ /* -+ * At this point the core isn't known to be "safe" so we're going to -+ * assume it's vulnerable. We still need to update `max_bhb_k` though, -+ * but only if we aren't mitigating with clearbhb though. -+ */ -+ if (scope == SCOPE_LOCAL_CPU && !supports_clearbhb(SCOPE_LOCAL_CPU)) -+ max_bhb_k = max(max_bhb_k, spectre_bhb_loop_affected()); - -- return false; -+ return true; - } - - static void this_cpu_set_vectors(enum arm64_bp_harden_el1_vectors slot) -@@ -1002,7 +1024,7 @@ early_param("nospectre_bhb", parse_spectre_bhb_param); - void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *entry) - { - bp_hardening_cb_t cpu_cb; -- enum mitigation_state fw_state, state = SPECTRE_VULNERABLE; -+ enum mitigation_state state = SPECTRE_VULNERABLE; - struct bp_hardening_data *data = this_cpu_ptr(&bp_hardening_data); - - if (!is_spectre_bhb_affected(entry, SCOPE_LOCAL_CPU)) -@@ -1028,7 +1050,7 @@ void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *entry) - this_cpu_set_vectors(EL1_VECTOR_BHB_CLEAR_INSN); - state = SPECTRE_MITIGATED; - set_bit(BHB_INSN, &system_bhb_mitigations); -- } else if (spectre_bhb_loop_affected(SCOPE_LOCAL_CPU)) { -+ } else if (spectre_bhb_loop_affected()) { - /* - * Ensure KVM uses the indirect vector which will have the - * branchy-loop added. A57/A72-r0 will already have selected -@@ -1041,32 +1063,29 @@ void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *entry) - this_cpu_set_vectors(EL1_VECTOR_BHB_LOOP); - state = SPECTRE_MITIGATED; - set_bit(BHB_LOOP, &system_bhb_mitigations); -- } else if (is_spectre_bhb_fw_affected(SCOPE_LOCAL_CPU)) { -- fw_state = spectre_bhb_get_cpu_fw_mitigation_state(); -- if (fw_state == SPECTRE_MITIGATED) { -- /* -- * Ensure KVM uses one of the spectre bp_hardening -- * vectors. The indirect vector doesn't include the EL3 -- * call, so needs upgrading to -- * HYP_VECTOR_SPECTRE_INDIRECT. -- */ -- if (!data->slot || data->slot == HYP_VECTOR_INDIRECT) -- data->slot += 1; -- -- this_cpu_set_vectors(EL1_VECTOR_BHB_FW); -- -- /* -- * The WA3 call in the vectors supersedes the WA1 call -- * made during context-switch. Uninstall any firmware -- * bp_hardening callback. -- */ -- cpu_cb = spectre_v2_get_sw_mitigation_cb(); -- if (__this_cpu_read(bp_hardening_data.fn) != cpu_cb) -- __this_cpu_write(bp_hardening_data.fn, NULL); -- -- state = SPECTRE_MITIGATED; -- set_bit(BHB_FW, &system_bhb_mitigations); -- } -+ } else if (has_spectre_bhb_fw_mitigation()) { -+ /* -+ * Ensure KVM uses one of the spectre bp_hardening -+ * vectors. The indirect vector doesn't include the EL3 -+ * call, so needs upgrading to -+ * HYP_VECTOR_SPECTRE_INDIRECT. -+ */ -+ if (!data->slot || data->slot == HYP_VECTOR_INDIRECT) -+ data->slot += 1; -+ -+ this_cpu_set_vectors(EL1_VECTOR_BHB_FW); -+ -+ /* -+ * The WA3 call in the vectors supersedes the WA1 call -+ * made during context-switch. Uninstall any firmware -+ * bp_hardening callback. -+ */ -+ cpu_cb = spectre_v2_get_sw_mitigation_cb(); -+ if (__this_cpu_read(bp_hardening_data.fn) != cpu_cb) -+ __this_cpu_write(bp_hardening_data.fn, NULL); -+ -+ state = SPECTRE_MITIGATED; -+ set_bit(BHB_FW, &system_bhb_mitigations); - } - - update_mitigation_state(&spectre_bhb_state, state); -@@ -1100,7 +1119,6 @@ void noinstr spectre_bhb_patch_loop_iter(struct alt_instr *alt, - { - u8 rd; - u32 insn; -- u16 loop_count = spectre_bhb_loop_affected(SCOPE_SYSTEM); - - BUG_ON(nr_inst != 1); /* MOV -> MOV */ - -@@ -1109,7 +1127,7 @@ void noinstr spectre_bhb_patch_loop_iter(struct alt_instr *alt, - - insn = le32_to_cpu(*origptr); - rd = aarch64_insn_decode_register(AARCH64_INSN_REGTYPE_RD, insn); -- insn = aarch64_insn_gen_movewide(rd, loop_count, 0, -+ insn = aarch64_insn_gen_movewide(rd, max_bhb_k, 0, - AARCH64_INSN_VARIANT_64BIT, - AARCH64_INSN_MOVEWIDE_ZERO); - *updptr++ = cpu_to_le32(insn); -diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c -index 9818cde948ca9c..fe4314af8eeccc 100644 ---- a/arch/arm64/kvm/arm.c -+++ b/arch/arm64/kvm/arm.c -@@ -391,7 +391,11 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu) - if (err) - return err; - -- return kvm_share_hyp(vcpu, vcpu + 1); -+ err = kvm_share_hyp(vcpu, vcpu + 1); -+ if (err) -+ kvm_vgic_vcpu_destroy(vcpu); -+ -+ return err; - } - - void kvm_arch_vcpu_postcreate(struct kvm_vcpu *vcpu) -diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c -index 38f3fe2e6bf6b0..bc97916a035a64 100644 ---- a/arch/arm64/mm/mmu.c -+++ b/arch/arm64/mm/mmu.c -@@ -1328,7 +1328,8 @@ int arch_add_memory(int nid, u64 start, u64 size, - __remove_pgd_mapping(swapper_pg_dir, - __phys_to_virt(start), size); - else { -- max_pfn = PFN_UP(start + size); -+ /* Address of hotplugged memory can be smaller */ -+ max_pfn = max(max_pfn, PFN_UP(start + size)); - max_low_pfn = max_pfn; - } - -diff --git a/arch/loongarch/kernel/acpi.c b/arch/loongarch/kernel/acpi.c -index 55d6a48c76a821..1f529b13490b3b 100644 ---- a/arch/loongarch/kernel/acpi.c -+++ b/arch/loongarch/kernel/acpi.c -@@ -216,18 +216,6 @@ static __init int setup_node(int pxm) - return acpi_map_pxm_to_node(pxm); - } - --/* -- * Callback for SLIT parsing. pxm_to_node() returns NUMA_NO_NODE for -- * I/O localities since SRAT does not list them. I/O localities are -- * not supported at this point. -- */ --unsigned int numa_distance_cnt; -- --static inline unsigned int get_numa_distances_cnt(struct acpi_table_slit *slit) --{ -- return slit->locality_count; --} -- - void __init numa_set_distance(int from, int to, int distance) - { - if ((u8)distance != distance || (from == to && distance != LOCAL_DISTANCE)) { -diff --git a/arch/mips/dec/prom/init.c b/arch/mips/dec/prom/init.c -index cb12eb211a49e0..8d74d7d6c05b47 100644 ---- a/arch/mips/dec/prom/init.c -+++ b/arch/mips/dec/prom/init.c -@@ -42,7 +42,7 @@ int (*__pmax_close)(int); - * Detect which PROM the DECSTATION has, and set the callback vectors - * appropriately. - */ --void __init which_prom(s32 magic, s32 *prom_vec) -+static void __init which_prom(s32 magic, s32 *prom_vec) - { - /* - * No sign of the REX PROM's magic number means we assume a non-REX -diff --git a/arch/mips/include/asm/ds1287.h b/arch/mips/include/asm/ds1287.h -index 46cfb01f9a14e7..51cb61fd4c0330 100644 ---- a/arch/mips/include/asm/ds1287.h -+++ b/arch/mips/include/asm/ds1287.h -@@ -8,7 +8,7 @@ - #define __ASM_DS1287_H - - extern int ds1287_timer_state(void); --extern void ds1287_set_base_clock(unsigned int clock); -+extern int ds1287_set_base_clock(unsigned int hz); - extern int ds1287_clockevent_init(int irq); - - #endif -diff --git a/arch/mips/kernel/cevt-ds1287.c b/arch/mips/kernel/cevt-ds1287.c -index 9a47fbcd4638a6..de64d6bb7ba36c 100644 ---- a/arch/mips/kernel/cevt-ds1287.c -+++ b/arch/mips/kernel/cevt-ds1287.c -@@ -10,6 +10,7 @@ - #include - #include - -+#include - #include - - int ds1287_timer_state(void) -diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c -index 46b9476d758249..dc294c95da21cb 100644 ---- a/arch/powerpc/kernel/rtas.c -+++ b/arch/powerpc/kernel/rtas.c -@@ -18,6 +18,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -1839,6 +1840,9 @@ SYSCALL_DEFINE1(rtas, struct rtas_args __user *, uargs) - || nargs + nret > ARRAY_SIZE(args.args)) - return -EINVAL; - -+ nargs = array_index_nospec(nargs, ARRAY_SIZE(args.args)); -+ nret = array_index_nospec(nret, ARRAY_SIZE(args.args) - nargs); -+ - /* Copy in args. */ - if (copy_from_user(args.args, uargs->args, - nargs * sizeof(rtas_arg_t)) != 0) -diff --git a/arch/riscv/include/asm/kgdb.h b/arch/riscv/include/asm/kgdb.h -index 46677daf708bd0..cc11c4544cffd1 100644 ---- a/arch/riscv/include/asm/kgdb.h -+++ b/arch/riscv/include/asm/kgdb.h -@@ -19,16 +19,9 @@ - - #ifndef __ASSEMBLY__ - -+void arch_kgdb_breakpoint(void); - extern unsigned long kgdb_compiled_break; - --static inline void arch_kgdb_breakpoint(void) --{ -- asm(".global kgdb_compiled_break\n" -- ".option norvc\n" -- "kgdb_compiled_break: ebreak\n" -- ".option rvc\n"); --} -- - #endif /* !__ASSEMBLY__ */ - - #define DBG_REG_ZERO "zero" -diff --git a/arch/riscv/include/asm/syscall.h b/arch/riscv/include/asm/syscall.h -index 121fff429dce66..eceabf59ae482a 100644 ---- a/arch/riscv/include/asm/syscall.h -+++ b/arch/riscv/include/asm/syscall.h -@@ -62,8 +62,11 @@ static inline void syscall_get_arguments(struct task_struct *task, - unsigned long *args) - { - args[0] = regs->orig_a0; -- args++; -- memcpy(args, ®s->a1, 5 * sizeof(args[0])); -+ args[1] = regs->a1; -+ args[2] = regs->a2; -+ args[3] = regs->a3; -+ args[4] = regs->a4; -+ args[5] = regs->a5; - } - - static inline int syscall_get_arch(struct task_struct *task) -diff --git a/arch/riscv/kernel/kgdb.c b/arch/riscv/kernel/kgdb.c -index 2e0266ae6bd728..9f3db3503dabd6 100644 ---- a/arch/riscv/kernel/kgdb.c -+++ b/arch/riscv/kernel/kgdb.c -@@ -254,6 +254,12 @@ void kgdb_arch_set_pc(struct pt_regs *regs, unsigned long pc) - regs->epc = pc; - } - -+noinline void arch_kgdb_breakpoint(void) -+{ -+ asm(".global kgdb_compiled_break\n" -+ "kgdb_compiled_break: ebreak\n"); -+} -+ - void kgdb_arch_handle_qxfer_pkt(char *remcom_in_buffer, - char *remcom_out_buffer) - { -diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c -index 175184b0592649..f598e0eb3b0a04 100644 ---- a/arch/riscv/kernel/setup.c -+++ b/arch/riscv/kernel/setup.c -@@ -73,6 +73,9 @@ static struct resource bss_res = { .name = "Kernel bss", }; - static struct resource elfcorehdr_res = { .name = "ELF Core hdr", }; - #endif - -+static int num_standard_resources; -+static struct resource *standard_resources; -+ - static int __init add_resource(struct resource *parent, - struct resource *res) - { -@@ -146,7 +149,7 @@ static void __init init_resources(void) - struct resource *res = NULL; - struct resource *mem_res = NULL; - size_t mem_res_sz = 0; -- int num_resources = 0, res_idx = 0; -+ int num_resources = 0, res_idx = 0, non_resv_res = 0; - int ret = 0; - - /* + 1 as memblock_alloc() might increase memblock.reserved.cnt */ -@@ -215,6 +218,7 @@ static void __init init_resources(void) - /* Add /memory regions to the resource tree */ - for_each_mem_region(region) { - res = &mem_res[res_idx--]; -+ non_resv_res++; - - if (unlikely(memblock_is_nomap(region))) { - res->name = "Reserved"; -@@ -232,6 +236,9 @@ static void __init init_resources(void) - goto error; - } - -+ num_standard_resources = non_resv_res; -+ standard_resources = &mem_res[res_idx + 1]; -+ - /* Clean-up any unused pre-allocated resources */ - if (res_idx >= 0) - memblock_free(mem_res, (res_idx + 1) * sizeof(*mem_res)); -@@ -243,6 +250,33 @@ static void __init init_resources(void) - memblock_free(mem_res, mem_res_sz); - } - -+static int __init reserve_memblock_reserved_regions(void) -+{ -+ u64 i, j; -+ -+ for (i = 0; i < num_standard_resources; i++) { -+ struct resource *mem = &standard_resources[i]; -+ phys_addr_t r_start, r_end, mem_size = resource_size(mem); -+ -+ if (!memblock_is_region_reserved(mem->start, mem_size)) -+ continue; -+ -+ for_each_reserved_mem_range(j, &r_start, &r_end) { -+ resource_size_t start, end; -+ -+ start = max(PFN_PHYS(PFN_DOWN(r_start)), mem->start); -+ end = min(PFN_PHYS(PFN_UP(r_end)) - 1, mem->end); -+ -+ if (start > mem->end || end < mem->start) -+ continue; -+ -+ reserve_region_with_split(mem, start, end, "Reserved"); -+ } -+ } -+ -+ return 0; -+} -+arch_initcall(reserve_memblock_reserved_regions); - - static void __init parse_dtb(void) - { -diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h -index 5e41033bf4ca4b..01aaee703c6c57 100644 ---- a/arch/sparc/include/asm/pgtable_64.h -+++ b/arch/sparc/include/asm/pgtable_64.h -@@ -931,7 +931,6 @@ static inline void __set_pte_at(struct mm_struct *mm, unsigned long addr, - static inline void set_ptes(struct mm_struct *mm, unsigned long addr, - pte_t *ptep, pte_t pte, unsigned int nr) - { -- arch_enter_lazy_mmu_mode(); - for (;;) { - __set_pte_at(mm, addr, ptep, pte, 0); - if (--nr == 0) -@@ -940,7 +939,6 @@ static inline void set_ptes(struct mm_struct *mm, unsigned long addr, - pte_val(pte) += PAGE_SIZE; - addr += PAGE_SIZE; - } -- arch_leave_lazy_mmu_mode(); - } - #define set_ptes set_ptes - -diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c -index ef69127d7e5e8b..148e1c85abb259 100644 ---- a/arch/sparc/mm/tlb.c -+++ b/arch/sparc/mm/tlb.c -@@ -52,8 +52,10 @@ void flush_tlb_pending(void) - - void arch_enter_lazy_mmu_mode(void) - { -- struct tlb_batch *tb = this_cpu_ptr(&tlb_batch); -+ struct tlb_batch *tb; - -+ preempt_disable(); -+ tb = this_cpu_ptr(&tlb_batch); - tb->active = 1; - } - -@@ -64,6 +66,7 @@ void arch_leave_lazy_mmu_mode(void) - if (tb->tlb_nr) - flush_tlb_pending(); - tb->active = 0; -+ preempt_enable(); - } - - static void tlb_batch_add_one(struct mm_struct *mm, unsigned long vaddr, -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index a0af6e8d584b02..d874ea22512b5c 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -881,6 +881,7 @@ config INTEL_TDX_GUEST - depends on X86_64 && CPU_SUP_INTEL - depends on X86_X2APIC - depends on EFI_STUB -+ depends on PARAVIRT - select ARCH_HAS_CC_PLATFORM - select X86_MEM_ENCRYPT - select X86_MCE -diff --git a/arch/x86/boot/compressed/mem.c b/arch/x86/boot/compressed/mem.c -index b3c3a4be7471f1..18bb201e4354db 100644 ---- a/arch/x86/boot/compressed/mem.c -+++ b/arch/x86/boot/compressed/mem.c -@@ -34,11 +34,14 @@ static bool early_is_tdx_guest(void) - - void arch_accept_memory(phys_addr_t start, phys_addr_t end) - { -+ static bool sevsnp; -+ - /* Platform-specific memory-acceptance call goes here */ - if (early_is_tdx_guest()) { - if (!tdx_accept_memory(start, end)) - panic("TDX: Failed to accept memory\n"); -- } else if (sev_snp_enabled()) { -+ } else if (sevsnp || (sev_get_status() & MSR_AMD64_SEV_SNP_ENABLED)) { -+ sevsnp = true; - snp_accept_memory(start, end); - } else { - error("Cannot accept memory: unknown platform\n"); -diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c -index 01d61f0609ab4d..5616c3b258060e 100644 ---- a/arch/x86/boot/compressed/sev.c -+++ b/arch/x86/boot/compressed/sev.c -@@ -135,10 +135,7 @@ bool sev_snp_enabled(void) - - static void __page_state_change(unsigned long paddr, enum psc_op op) - { -- u64 val; -- -- if (!sev_snp_enabled()) -- return; -+ u64 val, msr; - - /* - * If private -> shared then invalidate the page before requesting the -@@ -147,6 +144,9 @@ static void __page_state_change(unsigned long paddr, enum psc_op op) - if (op == SNP_PAGE_STATE_SHARED && pvalidate(paddr, RMP_PG_SIZE_4K, 0)) - sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_PVALIDATE); - -+ /* Save the current GHCB MSR value */ -+ msr = sev_es_rd_ghcb_msr(); -+ - /* Issue VMGEXIT to change the page state in RMP table. */ - sev_es_wr_ghcb_msr(GHCB_MSR_PSC_REQ_GFN(paddr >> PAGE_SHIFT, op)); - VMGEXIT(); -@@ -156,6 +156,9 @@ static void __page_state_change(unsigned long paddr, enum psc_op op) - if ((GHCB_RESP_CODE(val) != GHCB_MSR_PSC_RESP) || GHCB_MSR_PSC_RESP_VAL(val)) - sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_PSC); - -+ /* Restore the GHCB MSR value */ -+ sev_es_wr_ghcb_msr(msr); -+ - /* - * Now that page state is changed in the RMP table, validate it so that it is - * consistent with the RMP entry. -@@ -166,11 +169,17 @@ static void __page_state_change(unsigned long paddr, enum psc_op op) - - void snp_set_page_private(unsigned long paddr) - { -+ if (!sev_snp_enabled()) -+ return; -+ - __page_state_change(paddr, SNP_PAGE_STATE_PRIVATE); - } - - void snp_set_page_shared(unsigned long paddr) - { -+ if (!sev_snp_enabled()) -+ return; -+ - __page_state_change(paddr, SNP_PAGE_STATE_SHARED); - } - -@@ -194,56 +203,10 @@ static bool early_setup_ghcb(void) - return true; - } - --static phys_addr_t __snp_accept_memory(struct snp_psc_desc *desc, -- phys_addr_t pa, phys_addr_t pa_end) --{ -- struct psc_hdr *hdr; -- struct psc_entry *e; -- unsigned int i; -- -- hdr = &desc->hdr; -- memset(hdr, 0, sizeof(*hdr)); -- -- e = desc->entries; -- -- i = 0; -- while (pa < pa_end && i < VMGEXIT_PSC_MAX_ENTRY) { -- hdr->end_entry = i; -- -- e->gfn = pa >> PAGE_SHIFT; -- e->operation = SNP_PAGE_STATE_PRIVATE; -- if (IS_ALIGNED(pa, PMD_SIZE) && (pa_end - pa) >= PMD_SIZE) { -- e->pagesize = RMP_PG_SIZE_2M; -- pa += PMD_SIZE; -- } else { -- e->pagesize = RMP_PG_SIZE_4K; -- pa += PAGE_SIZE; -- } -- -- e++; -- i++; -- } -- -- if (vmgexit_psc(boot_ghcb, desc)) -- sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_PSC); -- -- pvalidate_pages(desc); -- -- return pa; --} -- - void snp_accept_memory(phys_addr_t start, phys_addr_t end) - { -- struct snp_psc_desc desc = {}; -- unsigned int i; -- phys_addr_t pa; -- -- if (!boot_ghcb && !early_setup_ghcb()) -- sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_PSC); -- -- pa = start; -- while (pa < end) -- pa = __snp_accept_memory(&desc, pa, end); -+ for (phys_addr_t pa = start; pa < end; pa += PAGE_SIZE) -+ __page_state_change(pa, SNP_PAGE_STATE_PRIVATE); - } - - void sev_es_shutdown_ghcb(void) -diff --git a/arch/x86/boot/compressed/sev.h b/arch/x86/boot/compressed/sev.h -index fc725a981b093b..4e463f33186df4 100644 ---- a/arch/x86/boot/compressed/sev.h -+++ b/arch/x86/boot/compressed/sev.h -@@ -12,11 +12,13 @@ - - bool sev_snp_enabled(void); - void snp_accept_memory(phys_addr_t start, phys_addr_t end); -+u64 sev_get_status(void); - - #else - - static inline bool sev_snp_enabled(void) { return false; } - static inline void snp_accept_memory(phys_addr_t start, phys_addr_t end) { } -+static inline u64 sev_get_status(void) { return 0; } - - #endif - -diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c -index 2f67e196a2ead2..98d0ee9600eb54 100644 ---- a/arch/x86/coco/tdx/tdx.c -+++ b/arch/x86/coco/tdx/tdx.c -@@ -13,6 +13,7 @@ - #include - #include - #include -+#include - #include - #include - -@@ -334,7 +335,7 @@ static int handle_halt(struct ve_info *ve) - return ve_instr_len(ve); - } - --void __cpuidle tdx_safe_halt(void) -+void __cpuidle tdx_halt(void) - { - const bool irq_disabled = false; - -@@ -345,6 +346,16 @@ void __cpuidle tdx_safe_halt(void) - WARN_ONCE(1, "HLT instruction emulation failed\n"); - } - -+static void __cpuidle tdx_safe_halt(void) -+{ -+ tdx_halt(); -+ /* -+ * "__cpuidle" section doesn't support instrumentation, so stick -+ * with raw_* variant that avoids tracing hooks. -+ */ -+ raw_local_irq_enable(); -+} -+ - static int read_msr(struct pt_regs *regs, struct ve_info *ve) - { - struct tdx_hypercall_args args = { -@@ -888,6 +899,19 @@ void __init tdx_early_init(void) - x86_platform.guest.enc_cache_flush_required = tdx_cache_flush_required; - x86_platform.guest.enc_tlb_flush_required = tdx_tlb_flush_required; - -+ /* -+ * Avoid "sti;hlt" execution in TDX guests as HLT induces a #VE that -+ * will enable interrupts before HLT TDCALL invocation if executed -+ * in STI-shadow, possibly resulting in missed wakeup events. -+ * -+ * Modify all possible HLT execution paths to use TDX specific routines -+ * that directly execute TDCALL and toggle the interrupt state as -+ * needed after TDCALL completion. This also reduces HLT related #VEs -+ * in addition to having a reliable halt logic execution. -+ */ -+ pv_ops.irq.safe_halt = tdx_safe_halt; -+ pv_ops.irq.halt = tdx_halt; -+ - /* - * TDX intercepts the RDMSR to read the X2APIC ID in the parallel - * bringup low level code. That raises #VE which cannot be handled -diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c -index dcb1e9b8d86629..7dcf5305d695dc 100644 ---- a/arch/x86/events/intel/ds.c -+++ b/arch/x86/events/intel/ds.c -@@ -1203,8 +1203,10 @@ static u64 pebs_update_adaptive_cfg(struct perf_event *event) - * + precise_ip < 2 for the non event IP - * + For RTM TSX weight we need GPRs for the abort code. - */ -- gprs = (sample_type & PERF_SAMPLE_REGS_INTR) && -- (attr->sample_regs_intr & PEBS_GP_REGS); -+ gprs = ((sample_type & PERF_SAMPLE_REGS_INTR) && -+ (attr->sample_regs_intr & PEBS_GP_REGS)) || -+ ((sample_type & PERF_SAMPLE_REGS_USER) && -+ (attr->sample_regs_user & PEBS_GP_REGS)); - - tsx_weight = (sample_type & PERF_SAMPLE_WEIGHT_TYPE) && - ((attr->config & INTEL_ARCH_EVENT_MASK) == -@@ -1856,7 +1858,7 @@ static void setup_pebs_adaptive_sample_data(struct perf_event *event, - regs->flags &= ~PERF_EFLAGS_EXACT; - } - -- if (sample_type & PERF_SAMPLE_REGS_INTR) -+ if (sample_type & (PERF_SAMPLE_REGS_INTR | PERF_SAMPLE_REGS_USER)) - adaptive_pebs_save_regs(regs, gprs); - } - -diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c -index a8f11e60b98794..091ed4651471ee 100644 ---- a/arch/x86/events/intel/uncore_snbep.c -+++ b/arch/x86/events/intel/uncore_snbep.c -@@ -4882,28 +4882,28 @@ static struct uncore_event_desc snr_uncore_iio_freerunning_events[] = { - INTEL_UNCORE_EVENT_DESC(ioclk, "event=0xff,umask=0x10"), - /* Free-Running IIO BANDWIDTH IN Counters */ - INTEL_UNCORE_EVENT_DESC(bw_in_port0, "event=0xff,umask=0x20"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port0.scale, "3.814697266e-6"), -+ INTEL_UNCORE_EVENT_DESC(bw_in_port0.scale, "3.0517578125e-5"), - INTEL_UNCORE_EVENT_DESC(bw_in_port0.unit, "MiB"), - INTEL_UNCORE_EVENT_DESC(bw_in_port1, "event=0xff,umask=0x21"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port1.scale, "3.814697266e-6"), -+ INTEL_UNCORE_EVENT_DESC(bw_in_port1.scale, "3.0517578125e-5"), - INTEL_UNCORE_EVENT_DESC(bw_in_port1.unit, "MiB"), - INTEL_UNCORE_EVENT_DESC(bw_in_port2, "event=0xff,umask=0x22"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port2.scale, "3.814697266e-6"), -+ INTEL_UNCORE_EVENT_DESC(bw_in_port2.scale, "3.0517578125e-5"), - INTEL_UNCORE_EVENT_DESC(bw_in_port2.unit, "MiB"), - INTEL_UNCORE_EVENT_DESC(bw_in_port3, "event=0xff,umask=0x23"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port3.scale, "3.814697266e-6"), -+ INTEL_UNCORE_EVENT_DESC(bw_in_port3.scale, "3.0517578125e-5"), - INTEL_UNCORE_EVENT_DESC(bw_in_port3.unit, "MiB"), - INTEL_UNCORE_EVENT_DESC(bw_in_port4, "event=0xff,umask=0x24"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port4.scale, "3.814697266e-6"), -+ INTEL_UNCORE_EVENT_DESC(bw_in_port4.scale, "3.0517578125e-5"), - INTEL_UNCORE_EVENT_DESC(bw_in_port4.unit, "MiB"), - INTEL_UNCORE_EVENT_DESC(bw_in_port5, "event=0xff,umask=0x25"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port5.scale, "3.814697266e-6"), -+ INTEL_UNCORE_EVENT_DESC(bw_in_port5.scale, "3.0517578125e-5"), - INTEL_UNCORE_EVENT_DESC(bw_in_port5.unit, "MiB"), - INTEL_UNCORE_EVENT_DESC(bw_in_port6, "event=0xff,umask=0x26"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port6.scale, "3.814697266e-6"), -+ INTEL_UNCORE_EVENT_DESC(bw_in_port6.scale, "3.0517578125e-5"), - INTEL_UNCORE_EVENT_DESC(bw_in_port6.unit, "MiB"), - INTEL_UNCORE_EVENT_DESC(bw_in_port7, "event=0xff,umask=0x27"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port7.scale, "3.814697266e-6"), -+ INTEL_UNCORE_EVENT_DESC(bw_in_port7.scale, "3.0517578125e-5"), - INTEL_UNCORE_EVENT_DESC(bw_in_port7.unit, "MiB"), - { /* end: all zeroes */ }, - }; -@@ -5476,37 +5476,6 @@ static struct freerunning_counters icx_iio_freerunning[] = { - [ICX_IIO_MSR_BW_IN] = { 0xaa0, 0x1, 0x10, 8, 48, icx_iio_bw_freerunning_box_offsets }, - }; - --static struct uncore_event_desc icx_uncore_iio_freerunning_events[] = { -- /* Free-Running IIO CLOCKS Counter */ -- INTEL_UNCORE_EVENT_DESC(ioclk, "event=0xff,umask=0x10"), -- /* Free-Running IIO BANDWIDTH IN Counters */ -- INTEL_UNCORE_EVENT_DESC(bw_in_port0, "event=0xff,umask=0x20"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port0.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port0.unit, "MiB"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port1, "event=0xff,umask=0x21"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port1.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port1.unit, "MiB"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port2, "event=0xff,umask=0x22"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port2.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port2.unit, "MiB"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port3, "event=0xff,umask=0x23"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port3.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port3.unit, "MiB"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port4, "event=0xff,umask=0x24"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port4.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port4.unit, "MiB"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port5, "event=0xff,umask=0x25"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port5.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port5.unit, "MiB"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port6, "event=0xff,umask=0x26"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port6.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port6.unit, "MiB"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port7, "event=0xff,umask=0x27"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port7.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port7.unit, "MiB"), -- { /* end: all zeroes */ }, --}; -- - static struct intel_uncore_type icx_uncore_iio_free_running = { - .name = "iio_free_running", - .num_counters = 9, -@@ -5514,7 +5483,7 @@ static struct intel_uncore_type icx_uncore_iio_free_running = { - .num_freerunning_types = ICX_IIO_FREERUNNING_TYPE_MAX, - .freerunning = icx_iio_freerunning, - .ops = &skx_uncore_iio_freerunning_ops, -- .event_descs = icx_uncore_iio_freerunning_events, -+ .event_descs = snr_uncore_iio_freerunning_events, - .format_group = &skx_uncore_iio_freerunning_format_group, - }; - -@@ -6241,69 +6210,13 @@ static struct freerunning_counters spr_iio_freerunning[] = { - [SPR_IIO_MSR_BW_OUT] = { 0x3808, 0x1, 0x10, 8, 48 }, - }; - --static struct uncore_event_desc spr_uncore_iio_freerunning_events[] = { -- /* Free-Running IIO CLOCKS Counter */ -- INTEL_UNCORE_EVENT_DESC(ioclk, "event=0xff,umask=0x10"), -- /* Free-Running IIO BANDWIDTH IN Counters */ -- INTEL_UNCORE_EVENT_DESC(bw_in_port0, "event=0xff,umask=0x20"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port0.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port0.unit, "MiB"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port1, "event=0xff,umask=0x21"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port1.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port1.unit, "MiB"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port2, "event=0xff,umask=0x22"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port2.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port2.unit, "MiB"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port3, "event=0xff,umask=0x23"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port3.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port3.unit, "MiB"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port4, "event=0xff,umask=0x24"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port4.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port4.unit, "MiB"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port5, "event=0xff,umask=0x25"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port5.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port5.unit, "MiB"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port6, "event=0xff,umask=0x26"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port6.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port6.unit, "MiB"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port7, "event=0xff,umask=0x27"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port7.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_in_port7.unit, "MiB"), -- /* Free-Running IIO BANDWIDTH OUT Counters */ -- INTEL_UNCORE_EVENT_DESC(bw_out_port0, "event=0xff,umask=0x30"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port0.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port0.unit, "MiB"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port1, "event=0xff,umask=0x31"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port1.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port1.unit, "MiB"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port2, "event=0xff,umask=0x32"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port2.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port2.unit, "MiB"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port3, "event=0xff,umask=0x33"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port3.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port3.unit, "MiB"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port4, "event=0xff,umask=0x34"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port4.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port4.unit, "MiB"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port5, "event=0xff,umask=0x35"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port5.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port5.unit, "MiB"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port6, "event=0xff,umask=0x36"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port6.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port6.unit, "MiB"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port7, "event=0xff,umask=0x37"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port7.scale, "3.814697266e-6"), -- INTEL_UNCORE_EVENT_DESC(bw_out_port7.unit, "MiB"), -- { /* end: all zeroes */ }, --}; -- - static struct intel_uncore_type spr_uncore_iio_free_running = { - .name = "iio_free_running", - .num_counters = 17, - .num_freerunning_types = SPR_IIO_FREERUNNING_TYPE_MAX, - .freerunning = spr_iio_freerunning, - .ops = &skx_uncore_iio_freerunning_ops, -- .event_descs = spr_uncore_iio_freerunning_events, -+ .event_descs = snr_uncore_iio_freerunning_events, - .format_group = &skx_uncore_iio_freerunning_format_group, - }; - -diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h -index 8c5ae649d2df82..9acfe2bcf1fd5b 100644 ---- a/arch/x86/include/asm/irqflags.h -+++ b/arch/x86/include/asm/irqflags.h -@@ -56,6 +56,28 @@ static __always_inline void native_halt(void) - - #endif - -+#ifndef CONFIG_PARAVIRT -+#ifndef __ASSEMBLY__ -+/* -+ * Used in the idle loop; sti takes one instruction cycle -+ * to complete: -+ */ -+static __always_inline void arch_safe_halt(void) -+{ -+ native_safe_halt(); -+} -+ -+/* -+ * Used when interrupts are already enabled or to -+ * shutdown the processor: -+ */ -+static __always_inline void halt(void) -+{ -+ native_halt(); -+} -+#endif /* __ASSEMBLY__ */ -+#endif /* CONFIG_PARAVIRT */ -+ - #ifdef CONFIG_PARAVIRT_XXL - #include - #else -@@ -77,24 +99,6 @@ static __always_inline void arch_local_irq_enable(void) - native_irq_enable(); - } - --/* -- * Used in the idle loop; sti takes one instruction cycle -- * to complete: -- */ --static __always_inline void arch_safe_halt(void) --{ -- native_safe_halt(); --} -- --/* -- * Used when interrupts are already enabled or to -- * shutdown the processor: -- */ --static __always_inline void halt(void) --{ -- native_halt(); --} -- - /* - * For spinlocks, etc: - */ -diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h -index 6c8ff12140aea9..d8537e30cee192 100644 ---- a/arch/x86/include/asm/paravirt.h -+++ b/arch/x86/include/asm/paravirt.h -@@ -103,6 +103,16 @@ static inline void notify_page_enc_status_changed(unsigned long pfn, - PVOP_VCALL3(mmu.notify_page_enc_status_changed, pfn, npages, enc); - } - -+static __always_inline void arch_safe_halt(void) -+{ -+ PVOP_VCALL0(irq.safe_halt); -+} -+ -+static inline void halt(void) -+{ -+ PVOP_VCALL0(irq.halt); -+} -+ - #ifdef CONFIG_PARAVIRT_XXL - static inline void load_sp0(unsigned long sp0) - { -@@ -168,16 +178,6 @@ static inline void __write_cr4(unsigned long x) - PVOP_VCALL1(cpu.write_cr4, x); - } - --static __always_inline void arch_safe_halt(void) --{ -- PVOP_VCALL0(irq.safe_halt); --} -- --static inline void halt(void) --{ -- PVOP_VCALL0(irq.halt); --} -- - extern noinstr void pv_native_wbinvd(void); - - static __always_inline void wbinvd(void) -diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h -index 772d03487520e5..4149df559aaeac 100644 ---- a/arch/x86/include/asm/paravirt_types.h -+++ b/arch/x86/include/asm/paravirt_types.h -@@ -130,10 +130,9 @@ struct pv_irq_ops { - struct paravirt_callee_save save_fl; - struct paravirt_callee_save irq_disable; - struct paravirt_callee_save irq_enable; -- -+#endif - void (*safe_halt)(void); - void (*halt)(void); --#endif - } __no_randomize_layout; - - struct pv_mmu_ops { -diff --git a/arch/x86/include/asm/tdx.h b/arch/x86/include/asm/tdx.h -index 603e6d1e9d4aac..c632f09f0c9721 100644 ---- a/arch/x86/include/asm/tdx.h -+++ b/arch/x86/include/asm/tdx.h -@@ -46,7 +46,7 @@ void tdx_get_ve_info(struct ve_info *ve); - - bool tdx_handle_virt_exception(struct pt_regs *regs, struct ve_info *ve); - --void tdx_safe_halt(void); -+void tdx_halt(void); - - bool tdx_early_handle_ve(struct pt_regs *regs); - -@@ -55,7 +55,7 @@ int tdx_mcall_get_report0(u8 *reportdata, u8 *tdreport); - #else - - static inline void tdx_early_init(void) { }; --static inline void tdx_safe_halt(void) { }; -+static inline void tdx_halt(void) { }; - - static inline bool tdx_early_handle_ve(struct pt_regs *regs) { return false; } - -diff --git a/arch/x86/include/asm/xen/hypervisor.h b/arch/x86/include/asm/xen/hypervisor.h -index 64fbd2dbc5b761..a9088250770f2a 100644 ---- a/arch/x86/include/asm/xen/hypervisor.h -+++ b/arch/x86/include/asm/xen/hypervisor.h -@@ -62,11 +62,6 @@ void xen_arch_unregister_cpu(int num); - #ifdef CONFIG_PVH - void __init xen_pvh_init(struct boot_params *boot_params); - void __init mem_map_via_hcall(struct boot_params *boot_params_p); --#ifdef CONFIG_XEN_PVH --void __init xen_reserve_extra_memory(struct boot_params *bootp); --#else --static inline void xen_reserve_extra_memory(struct boot_params *bootp) { } --#endif - #endif - - /* Lazy mode for batching updates / context switch */ -diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c -index 9413fb767c6a71..498f2753777292 100644 ---- a/arch/x86/kernel/cpu/amd.c -+++ b/arch/x86/kernel/cpu/amd.c -@@ -825,7 +825,7 @@ static void init_amd_k8(struct cpuinfo_x86 *c) - * (model = 0x14) and later actually support it. - * (AMD Erratum #110, docId: 25759). - */ -- if (c->x86_model < 0x14 && cpu_has(c, X86_FEATURE_LAHF_LM)) { -+ if (c->x86_model < 0x14 && cpu_has(c, X86_FEATURE_LAHF_LM) && !cpu_has(c, X86_FEATURE_HYPERVISOR)) { - clear_cpu_cap(c, X86_FEATURE_LAHF_LM); - if (!rdmsrl_amd_safe(0xc001100d, &value)) { - value &= ~BIT_64(32); -@@ -1039,6 +1039,16 @@ static void init_amd_zen1(struct cpuinfo_x86 *c) - - pr_notice_once("AMD Zen1 DIV0 bug detected. Disable SMT for full protection.\n"); - setup_force_cpu_bug(X86_BUG_DIV0); -+ -+ /* -+ * Turn off the Instructions Retired free counter on machines that are -+ * susceptible to erratum #1054 "Instructions Retired Performance -+ * Counter May Be Inaccurate". -+ */ -+ if (c->x86_model < 0x30) { -+ msr_clear_bit(MSR_K7_HWCR, MSR_K7_HWCR_IRPERF_EN_BIT); -+ clear_cpu_cap(c, X86_FEATURE_IRPERF); -+ } - } - - static bool cpu_has_zenbleed_microcode(void) -@@ -1185,13 +1195,8 @@ static void init_amd(struct cpuinfo_x86 *c) - if (!cpu_feature_enabled(X86_FEATURE_XENPV)) - set_cpu_bug(c, X86_BUG_SYSRET_SS_ATTRS); - -- /* -- * Turn on the Instructions Retired free counter on machines not -- * susceptible to erratum #1054 "Instructions Retired Performance -- * Counter May Be Inaccurate". -- */ -- if (cpu_has(c, X86_FEATURE_IRPERF) && -- (boot_cpu_has(X86_FEATURE_ZEN1) && c->x86_model > 0x2f)) -+ /* Enable the Instructions Retired free counter */ -+ if (cpu_has(c, X86_FEATURE_IRPERF)) - msr_set_bit(MSR_K7_HWCR, MSR_K7_HWCR_IRPERF_EN_BIT); - - check_null_seg_clears_base(c); -diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c -index 38eeff91109f9b..6c0e0619e6d325 100644 ---- a/arch/x86/kernel/cpu/intel.c -+++ b/arch/x86/kernel/cpu/intel.c -@@ -1168,7 +1168,13 @@ static void __split_lock_reenable(struct work_struct *work) - { - sld_update_msr(true); - } --static DECLARE_DELAYED_WORK(sl_reenable, __split_lock_reenable); -+/* -+ * In order for each CPU to schedule its delayed work independently of the -+ * others, delayed work struct must be per-CPU. This is not required when -+ * sysctl_sld_mitigate is enabled because of the semaphore that limits -+ * the number of simultaneously scheduled delayed works to 1. -+ */ -+static DEFINE_PER_CPU(struct delayed_work, sl_reenable); - - /* - * If a CPU goes offline with pending delayed work to re-enable split lock -@@ -1189,7 +1195,7 @@ static int splitlock_cpu_offline(unsigned int cpu) - - static void split_lock_warn(unsigned long ip) - { -- struct delayed_work *work; -+ struct delayed_work *work = NULL; - int cpu; - - if (!current->reported_split_lock) -@@ -1211,11 +1217,17 @@ static void split_lock_warn(unsigned long ip) - if (down_interruptible(&buslock_sem) == -EINTR) - return; - work = &sl_reenable_unlock; -- } else { -- work = &sl_reenable; - } - - cpu = get_cpu(); -+ -+ if (!work) { -+ work = this_cpu_ptr(&sl_reenable); -+ /* Deferred initialization of per-CPU struct */ -+ if (!work->work.func) -+ INIT_DELAYED_WORK(work, __split_lock_reenable); -+ } -+ - schedule_delayed_work_on(cpu, work, 2); - - /* Disable split lock detection on this CPU to make progress */ -diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c -index 0ee172ce2d2124..ce78e39004e0ea 100644 ---- a/arch/x86/kernel/cpu/microcode/amd.c -+++ b/arch/x86/kernel/cpu/microcode/amd.c -@@ -201,6 +201,12 @@ static bool need_sha_check(u32 cur_rev) - case 0xa70c0: return cur_rev <= 0xa70C009; break; - case 0xaa001: return cur_rev <= 0xaa00116; break; - case 0xaa002: return cur_rev <= 0xaa00218; break; -+ case 0xb0021: return cur_rev <= 0xb002146; break; -+ case 0xb1010: return cur_rev <= 0xb101046; break; -+ case 0xb2040: return cur_rev <= 0xb204031; break; -+ case 0xb4040: return cur_rev <= 0xb404031; break; -+ case 0xb6000: return cur_rev <= 0xb600031; break; -+ case 0xb7000: return cur_rev <= 0xb700031; break; - default: break; - } - -@@ -216,8 +222,7 @@ static bool verify_sha256_digest(u32 patch_id, u32 cur_rev, const u8 *data, unsi - struct sha256_state s; - int i; - -- if (x86_family(bsp_cpuid_1_eax) < 0x17 || -- x86_family(bsp_cpuid_1_eax) > 0x19) -+ if (x86_family(bsp_cpuid_1_eax) < 0x17) - return true; - - if (!need_sha_check(cur_rev)) -diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c -index b66f540de054a7..1f6fb8e85e0f60 100644 ---- a/arch/x86/kernel/e820.c -+++ b/arch/x86/kernel/e820.c -@@ -753,22 +753,21 @@ void __init e820__memory_setup_extended(u64 phys_addr, u32 data_len) - void __init e820__register_nosave_regions(unsigned long limit_pfn) - { - int i; -- unsigned long pfn = 0; -+ u64 last_addr = 0; - - for (i = 0; i < e820_table->nr_entries; i++) { - struct e820_entry *entry = &e820_table->entries[i]; - -- if (pfn < PFN_UP(entry->addr)) -- register_nosave_region(pfn, PFN_UP(entry->addr)); -- -- pfn = PFN_DOWN(entry->addr + entry->size); -- - if (entry->type != E820_TYPE_RAM && entry->type != E820_TYPE_RESERVED_KERN) -- register_nosave_region(PFN_UP(entry->addr), pfn); -+ continue; - -- if (pfn >= limit_pfn) -- break; -+ if (last_addr < entry->addr) -+ register_nosave_region(PFN_DOWN(last_addr), PFN_UP(entry->addr)); -+ -+ last_addr = entry->addr + entry->size; - } -+ -+ register_nosave_region(PFN_DOWN(last_addr), limit_pfn); - } - - #ifdef CONFIG_ACPI -diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c -index 8d51c86caa415f..234851fe0ef8e7 100644 ---- a/arch/x86/kernel/paravirt.c -+++ b/arch/x86/kernel/paravirt.c -@@ -142,6 +142,11 @@ int paravirt_disable_iospace(void) - return request_resource(&ioport_resource, &reserve_ioports); - } - -+static noinstr void pv_native_safe_halt(void) -+{ -+ native_safe_halt(); -+} -+ - #ifdef CONFIG_PARAVIRT_XXL - static noinstr void pv_native_write_cr2(unsigned long val) - { -@@ -162,11 +167,6 @@ noinstr void pv_native_wbinvd(void) - { - native_wbinvd(); - } -- --static noinstr void pv_native_safe_halt(void) --{ -- native_safe_halt(); --} - #endif - - struct pv_info pv_info = { -@@ -224,9 +224,11 @@ struct paravirt_patch_template pv_ops = { - .irq.save_fl = __PV_IS_CALLEE_SAVE(pv_native_save_fl), - .irq.irq_disable = __PV_IS_CALLEE_SAVE(pv_native_irq_disable), - .irq.irq_enable = __PV_IS_CALLEE_SAVE(pv_native_irq_enable), -+#endif /* CONFIG_PARAVIRT_XXL */ -+ -+ /* Irq HLT ops. */ - .irq.safe_halt = pv_native_safe_halt, - .irq.halt = native_halt, --#endif /* CONFIG_PARAVIRT_XXL */ - - /* Mmu ops. */ - .mmu.flush_tlb_user = native_flush_tlb_local, -diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c -index bbe11363550bea..419353904173ff 100644 ---- a/arch/x86/kernel/process.c -+++ b/arch/x86/kernel/process.c -@@ -955,7 +955,7 @@ void select_idle_routine(const struct cpuinfo_x86 *c) - static_call_update(x86_idle, mwait_idle); - } else if (cpu_feature_enabled(X86_FEATURE_TDX_GUEST)) { - pr_info("using TDX aware idle routine\n"); -- static_call_update(x86_idle, tdx_safe_halt); -+ static_call_update(x86_idle, tdx_halt); - } else - static_call_update(x86_idle, default_idle); - } -diff --git a/arch/x86/kernel/signal_32.c b/arch/x86/kernel/signal_32.c -index c12624bc82a31b..983f8f5893a48c 100644 ---- a/arch/x86/kernel/signal_32.c -+++ b/arch/x86/kernel/signal_32.c -@@ -33,25 +33,55 @@ - #include - #include - -+/* -+ * The first GDT descriptor is reserved as 'NULL descriptor'. As bits 0 -+ * and 1 of a segment selector, i.e., the RPL bits, are NOT used to index -+ * GDT, selector values 0~3 all point to the NULL descriptor, thus values -+ * 0, 1, 2 and 3 are all valid NULL selector values. -+ * -+ * However IRET zeros ES, FS, GS, and DS segment registers if any of them -+ * is found to have any nonzero NULL selector value, which can be used by -+ * userspace in pre-FRED systems to spot any interrupt/exception by loading -+ * a nonzero NULL selector and waiting for it to become zero. Before FRED -+ * there was nothing software could do to prevent such an information leak. -+ * -+ * ERETU, the only legit instruction to return to userspace from kernel -+ * under FRED, by design does NOT zero any segment register to avoid this -+ * problem behavior. -+ * -+ * As such, leave NULL selector values 0~3 unchanged. -+ */ -+static inline u16 fixup_rpl(u16 sel) -+{ -+ return sel <= 3 ? sel : sel | 3; -+} -+ - #ifdef CONFIG_IA32_EMULATION - #include - - static inline void reload_segments(struct sigcontext_32 *sc) - { -- unsigned int cur; -+ u16 cur; - -+ /* -+ * Reload fs and gs if they have changed in the signal -+ * handler. This does not handle long fs/gs base changes in -+ * the handler, but does not clobber them at least in the -+ * normal case. -+ */ - savesegment(gs, cur); -- if ((sc->gs | 0x03) != cur) -- load_gs_index(sc->gs | 0x03); -+ if (fixup_rpl(sc->gs) != cur) -+ load_gs_index(fixup_rpl(sc->gs)); - savesegment(fs, cur); -- if ((sc->fs | 0x03) != cur) -- loadsegment(fs, sc->fs | 0x03); -+ if (fixup_rpl(sc->fs) != cur) -+ loadsegment(fs, fixup_rpl(sc->fs)); -+ - savesegment(ds, cur); -- if ((sc->ds | 0x03) != cur) -- loadsegment(ds, sc->ds | 0x03); -+ if (fixup_rpl(sc->ds) != cur) -+ loadsegment(ds, fixup_rpl(sc->ds)); - savesegment(es, cur); -- if ((sc->es | 0x03) != cur) -- loadsegment(es, sc->es | 0x03); -+ if (fixup_rpl(sc->es) != cur) -+ loadsegment(es, fixup_rpl(sc->es)); - } - - #define sigset32_t compat_sigset_t -@@ -105,18 +135,12 @@ static bool ia32_restore_sigcontext(struct pt_regs *regs, - regs->orig_ax = -1; - - #ifdef CONFIG_IA32_EMULATION -- /* -- * Reload fs and gs if they have changed in the signal -- * handler. This does not handle long fs/gs base changes in -- * the handler, but does not clobber them at least in the -- * normal case. -- */ - reload_segments(&sc); - #else -- loadsegment(gs, sc.gs); -- regs->fs = sc.fs; -- regs->es = sc.es; -- regs->ds = sc.ds; -+ loadsegment(gs, fixup_rpl(sc.gs)); -+ regs->fs = fixup_rpl(sc.fs); -+ regs->es = fixup_rpl(sc.es); -+ regs->ds = fixup_rpl(sc.ds); - #endif - - return fpu__restore_sig(compat_ptr(sc.fpstate), 1); -diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c -index 5fb12d9c71befa..a6cffeff75d40b 100644 ---- a/arch/x86/kvm/cpuid.c -+++ b/arch/x86/kvm/cpuid.c -@@ -1011,8 +1011,8 @@ static inline int __do_cpuid_func(struct kvm_cpuid_array *array, u32 function) - } - break; - case 0xa: { /* Architectural Performance Monitoring */ -- union cpuid10_eax eax; -- union cpuid10_edx edx; -+ union cpuid10_eax eax = { }; -+ union cpuid10_edx edx = { }; - - if (!enable_pmu || !static_cpu_has(X86_FEATURE_ARCH_PERFMON)) { - entry->eax = entry->ebx = entry->ecx = entry->edx = 0; -@@ -1028,8 +1028,6 @@ static inline int __do_cpuid_func(struct kvm_cpuid_array *array, u32 function) - - if (kvm_pmu_cap.version) - edx.split.anythread_deprecated = 1; -- edx.split.reserved1 = 0; -- edx.split.reserved2 = 0; - - entry->eax = eax.full; - entry->ebx = kvm_pmu_cap.events_mask; -@@ -1303,7 +1301,7 @@ static inline int __do_cpuid_func(struct kvm_cpuid_array *array, u32 function) - break; - /* AMD Extended Performance Monitoring and Debug */ - case 0x80000022: { -- union cpuid_0x80000022_ebx ebx; -+ union cpuid_0x80000022_ebx ebx = { }; - - entry->ecx = entry->edx = 0; - if (!enable_pmu || !kvm_cpu_cap_has(X86_FEATURE_PERFMON_V2)) { -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index dcd0c12c308e59..2a2dbeb56897d8 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -11396,6 +11396,8 @@ int kvm_arch_vcpu_ioctl_get_mpstate(struct kvm_vcpu *vcpu, - if (kvm_mpx_supported()) - kvm_load_guest_fpu(vcpu); - -+ kvm_vcpu_srcu_read_lock(vcpu); -+ - r = kvm_apic_accept_events(vcpu); - if (r < 0) - goto out; -@@ -11409,6 +11411,8 @@ int kvm_arch_vcpu_ioctl_get_mpstate(struct kvm_vcpu *vcpu, - mp_state->mp_state = vcpu->arch.mp_state; - - out: -+ kvm_vcpu_srcu_read_unlock(vcpu); -+ - if (kvm_mpx_supported()) - kvm_put_guest_fpu(vcpu); - vcpu_put(vcpu); -diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c -index 2d850f6bae701c..525794f1eefb3f 100644 ---- a/arch/x86/mm/pat/set_memory.c -+++ b/arch/x86/mm/pat/set_memory.c -@@ -2374,7 +2374,7 @@ static int __set_pages_np(struct page *page, int numpages) - .pgd = NULL, - .numpages = numpages, - .mask_set = __pgprot(0), -- .mask_clr = __pgprot(_PAGE_PRESENT | _PAGE_RW), -+ .mask_clr = __pgprot(_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY), - .flags = CPA_NO_CHECK_ALIAS }; - - /* -@@ -2453,7 +2453,7 @@ int __init kernel_map_pages_in_pgd(pgd_t *pgd, u64 pfn, unsigned long address, - .pgd = pgd, - .numpages = numpages, - .mask_set = __pgprot(0), -- .mask_clr = __pgprot(~page_flags & (_PAGE_NX|_PAGE_RW)), -+ .mask_clr = __pgprot(~page_flags & (_PAGE_NX|_PAGE_RW|_PAGE_DIRTY)), - .flags = CPA_NO_CHECK_ALIAS, - }; - -@@ -2496,7 +2496,7 @@ int __init kernel_unmap_pages_in_pgd(pgd_t *pgd, unsigned long address, - .pgd = pgd, - .numpages = numpages, - .mask_set = __pgprot(0), -- .mask_clr = __pgprot(_PAGE_PRESENT | _PAGE_RW), -+ .mask_clr = __pgprot(_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY), - .flags = CPA_NO_CHECK_ALIAS, - }; - -diff --git a/arch/x86/platform/pvh/enlighten.c b/arch/x86/platform/pvh/enlighten.c -index a12117f3d4de72..00a92cb2c81474 100644 ---- a/arch/x86/platform/pvh/enlighten.c -+++ b/arch/x86/platform/pvh/enlighten.c -@@ -74,9 +74,6 @@ static void __init init_pvh_bootparams(bool xen_guest) - } else - xen_raw_printk("Warning: Can fit ISA range into e820\n"); - -- if (xen_guest) -- xen_reserve_extra_memory(&pvh_bootparams); -- - pvh_bootparams.hdr.cmd_line_ptr = - pvh_start_info.cmdline_paddr; - -diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c -index 0219f1c90202df..638de313fc4ed5 100644 ---- a/arch/x86/xen/enlighten.c -+++ b/arch/x86/xen/enlighten.c -@@ -75,6 +75,9 @@ EXPORT_SYMBOL(xen_start_flags); - */ - struct shared_info *HYPERVISOR_shared_info = &xen_dummy_shared_info; - -+/* Number of pages released from the initial allocation. */ -+unsigned long xen_released_pages; -+ - static __ref void xen_get_vendor(void) - { - init_cpu_devs(); -@@ -471,6 +474,13 @@ int __init arch_xen_unpopulated_init(struct resource **res) - xen_free_unpopulated_pages(1, &pg); - } - -+ /* -+ * Account for the region being in the physmap but unpopulated. -+ * The value in xen_released_pages is used by the balloon -+ * driver to know how much of the physmap is unpopulated and -+ * set an accurate initial memory target. -+ */ -+ xen_released_pages += xen_extra_mem[i].n_pfns; - /* Zero so region is not also added to the balloon driver. */ - xen_extra_mem[i].n_pfns = 0; - } -diff --git a/arch/x86/xen/enlighten_pvh.c b/arch/x86/xen/enlighten_pvh.c -index 60b358c2f43484..ac0a8adb2c50b1 100644 ---- a/arch/x86/xen/enlighten_pvh.c -+++ b/arch/x86/xen/enlighten_pvh.c -@@ -8,6 +8,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -26,47 +27,6 @@ - bool __ro_after_init xen_pvh; - EXPORT_SYMBOL_GPL(xen_pvh); - --void __init xen_pvh_init(struct boot_params *boot_params) --{ -- xen_pvh = 1; -- xen_domain_type = XEN_HVM_DOMAIN; -- xen_start_flags = pvh_start_info.flags; -- -- if (xen_initial_domain()) -- x86_init.oem.arch_setup = xen_add_preferred_consoles; -- x86_init.oem.banner = xen_banner; -- -- xen_efi_init(boot_params); -- -- if (xen_initial_domain()) { -- struct xen_platform_op op = { -- .cmd = XENPF_get_dom0_console, -- }; -- int ret = HYPERVISOR_platform_op(&op); -- -- if (ret > 0) -- xen_init_vga(&op.u.dom0_console, -- min(ret * sizeof(char), -- sizeof(op.u.dom0_console)), -- &boot_params->screen_info); -- } --} -- --void __init mem_map_via_hcall(struct boot_params *boot_params_p) --{ -- struct xen_memory_map memmap; -- int rc; -- -- memmap.nr_entries = ARRAY_SIZE(boot_params_p->e820_table); -- set_xen_guest_handle(memmap.buffer, boot_params_p->e820_table); -- rc = HYPERVISOR_memory_op(XENMEM_memory_map, &memmap); -- if (rc) { -- xen_raw_printk("XENMEM_memory_map failed (%d)\n", rc); -- BUG(); -- } -- boot_params_p->e820_entries = memmap.nr_entries; --} -- - /* - * Reserve e820 UNUSABLE regions to inflate the memory balloon. - * -@@ -81,8 +41,9 @@ void __init mem_map_via_hcall(struct boot_params *boot_params_p) - * hypervisor should notify us which memory ranges are suitable for creating - * foreign mappings, but that's not yet implemented. - */ --void __init xen_reserve_extra_memory(struct boot_params *bootp) -+static void __init pvh_reserve_extra_memory(void) - { -+ struct boot_params *bootp = &boot_params; - unsigned int i, ram_pages = 0, extra_pages; - - for (i = 0; i < bootp->e820_entries; i++) { -@@ -133,3 +94,51 @@ void __init xen_reserve_extra_memory(struct boot_params *bootp) - xen_add_extra_mem(PFN_UP(e->addr), pages); - } - } -+ -+static void __init pvh_arch_setup(void) -+{ -+ pvh_reserve_extra_memory(); -+ -+ if (xen_initial_domain()) -+ xen_add_preferred_consoles(); -+} -+ -+void __init xen_pvh_init(struct boot_params *boot_params) -+{ -+ xen_pvh = 1; -+ xen_domain_type = XEN_HVM_DOMAIN; -+ xen_start_flags = pvh_start_info.flags; -+ -+ x86_init.oem.arch_setup = pvh_arch_setup; -+ x86_init.oem.banner = xen_banner; -+ -+ xen_efi_init(boot_params); -+ -+ if (xen_initial_domain()) { -+ struct xen_platform_op op = { -+ .cmd = XENPF_get_dom0_console, -+ }; -+ int ret = HYPERVISOR_platform_op(&op); -+ -+ if (ret > 0) -+ xen_init_vga(&op.u.dom0_console, -+ min(ret * sizeof(char), -+ sizeof(op.u.dom0_console)), -+ &boot_params->screen_info); -+ } -+} -+ -+void __init mem_map_via_hcall(struct boot_params *boot_params_p) -+{ -+ struct xen_memory_map memmap; -+ int rc; -+ -+ memmap.nr_entries = ARRAY_SIZE(boot_params_p->e820_table); -+ set_xen_guest_handle(memmap.buffer, boot_params_p->e820_table); -+ rc = HYPERVISOR_memory_op(XENMEM_memory_map, &memmap); -+ if (rc) { -+ xen_raw_printk("XENMEM_memory_map failed (%d)\n", rc); -+ BUG(); -+ } -+ boot_params_p->e820_entries = memmap.nr_entries; -+} -diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c -index dc822124cacb9c..ec3ffb94807d3a 100644 ---- a/arch/x86/xen/setup.c -+++ b/arch/x86/xen/setup.c -@@ -38,9 +38,6 @@ - - #define GB(x) ((uint64_t)(x) * 1024 * 1024 * 1024) - --/* Number of pages released from the initial allocation. */ --unsigned long xen_released_pages; -- - /* Memory map would allow PCI passthrough. */ - bool xen_pv_pci_possible; - -diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c -index 4990a19e601334..74839f6f2e0cb3 100644 ---- a/block/blk-sysfs.c -+++ b/block/blk-sysfs.c -@@ -854,6 +854,8 @@ int blk_register_queue(struct gendisk *disk) - out_debugfs_remove: - blk_debugfs_remove(disk); - mutex_unlock(&q->sysfs_lock); -+ if (queue_is_mq(q)) -+ blk_mq_sysfs_unregister(disk); - out_put_queue_kobj: - kobject_put(&disk->queue_kobj); - mutex_unlock(&q->sysfs_dir_lock); -diff --git a/certs/Makefile b/certs/Makefile -index 799ad7b9e68a0f..67e1f2707c2fad 100644 ---- a/certs/Makefile -+++ b/certs/Makefile -@@ -84,5 +84,5 @@ targets += x509_revocation_list - - hostprogs := extract-cert - --HOSTCFLAGS_extract-cert.o = $(shell $(HOSTPKG_CONFIG) --cflags libcrypto 2> /dev/null) -+HOSTCFLAGS_extract-cert.o = $(shell $(HOSTPKG_CONFIG) --cflags libcrypto 2> /dev/null) -I$(srctree)/scripts - HOSTLDLIBS_extract-cert = $(shell $(HOSTPKG_CONFIG) --libs libcrypto 2> /dev/null || echo -lcrypto) -diff --git a/certs/extract-cert.c b/certs/extract-cert.c -index 70e9ec89d87d36..7d6d468ed6129d 100644 ---- a/certs/extract-cert.c -+++ b/certs/extract-cert.c -@@ -21,14 +21,17 @@ - #include - #include - #include --#include -- --/* -- * OpenSSL 3.0 deprecates the OpenSSL's ENGINE API. -- * -- * Remove this if/when that API is no longer used -- */ --#pragma GCC diagnostic ignored "-Wdeprecated-declarations" -+#if OPENSSL_VERSION_MAJOR >= 3 -+# define USE_PKCS11_PROVIDER -+# include -+# include -+#else -+# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0) -+# define USE_PKCS11_ENGINE -+# include -+# endif -+#endif -+#include "ssl-common.h" - - #define PKEY_ID_PKCS7 2 - -@@ -40,41 +43,6 @@ void format(void) - exit(2); - } - --static void display_openssl_errors(int l) --{ -- const char *file; -- char buf[120]; -- int e, line; -- -- if (ERR_peek_error() == 0) -- return; -- fprintf(stderr, "At main.c:%d:\n", l); -- -- while ((e = ERR_get_error_line(&file, &line))) { -- ERR_error_string(e, buf); -- fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line); -- } --} -- --static void drain_openssl_errors(void) --{ -- const char *file; -- int line; -- -- if (ERR_peek_error() == 0) -- return; -- while (ERR_get_error_line(&file, &line)) {} --} -- --#define ERR(cond, fmt, ...) \ -- do { \ -- bool __cond = (cond); \ -- display_openssl_errors(__LINE__); \ -- if (__cond) { \ -- err(1, fmt, ## __VA_ARGS__); \ -- } \ -- } while(0) -- - static const char *key_pass; - static BIO *wb; - static char *cert_dst; -@@ -94,6 +62,66 @@ static void write_cert(X509 *x509) - fprintf(stderr, "Extracted cert: %s\n", buf); - } - -+static X509 *load_cert_pkcs11(const char *cert_src) -+{ -+ X509 *cert = NULL; -+#ifdef USE_PKCS11_PROVIDER -+ OSSL_STORE_CTX *store; -+ -+ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true)) -+ ERR(1, "OSSL_PROVIDER_try_load(pkcs11)"); -+ if (!OSSL_PROVIDER_try_load(NULL, "default", true)) -+ ERR(1, "OSSL_PROVIDER_try_load(default)"); -+ -+ store = OSSL_STORE_open(cert_src, NULL, NULL, NULL, NULL); -+ ERR(!store, "OSSL_STORE_open"); -+ -+ while (!OSSL_STORE_eof(store)) { -+ OSSL_STORE_INFO *info = OSSL_STORE_load(store); -+ -+ if (!info) { -+ drain_openssl_errors(__LINE__, 0); -+ continue; -+ } -+ if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_CERT) { -+ cert = OSSL_STORE_INFO_get1_CERT(info); -+ ERR(!cert, "OSSL_STORE_INFO_get1_CERT"); -+ } -+ OSSL_STORE_INFO_free(info); -+ if (cert) -+ break; -+ } -+ OSSL_STORE_close(store); -+#elif defined(USE_PKCS11_ENGINE) -+ ENGINE *e; -+ struct { -+ const char *cert_id; -+ X509 *cert; -+ } parms; -+ -+ parms.cert_id = cert_src; -+ parms.cert = NULL; -+ -+ ENGINE_load_builtin_engines(); -+ drain_openssl_errors(__LINE__, 1); -+ e = ENGINE_by_id("pkcs11"); -+ ERR(!e, "Load PKCS#11 ENGINE"); -+ if (ENGINE_init(e)) -+ drain_openssl_errors(__LINE__, 1); -+ else -+ ERR(1, "ENGINE_init"); -+ if (key_pass) -+ ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), "Set PKCS#11 PIN"); -+ ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &parms, NULL, 1); -+ ERR(!parms.cert, "Get X.509 from PKCS#11"); -+ cert = parms.cert; -+#else -+ fprintf(stderr, "no pkcs11 engine/provider available\n"); -+ exit(1); -+#endif -+ return cert; -+} -+ - int main(int argc, char **argv) - { - char *cert_src; -@@ -122,28 +150,10 @@ int main(int argc, char **argv) - fclose(f); - exit(0); - } else if (!strncmp(cert_src, "pkcs11:", 7)) { -- ENGINE *e; -- struct { -- const char *cert_id; -- X509 *cert; -- } parms; -- -- parms.cert_id = cert_src; -- parms.cert = NULL; -+ X509 *cert = load_cert_pkcs11(cert_src); - -- ENGINE_load_builtin_engines(); -- drain_openssl_errors(); -- e = ENGINE_by_id("pkcs11"); -- ERR(!e, "Load PKCS#11 ENGINE"); -- if (ENGINE_init(e)) -- drain_openssl_errors(); -- else -- ERR(1, "ENGINE_init"); -- if (key_pass) -- ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), "Set PKCS#11 PIN"); -- ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &parms, NULL, 1); -- ERR(!parms.cert, "Get X.509 from PKCS#11"); -- write_cert(parms.cert); -+ ERR(!cert, "load_cert_pkcs11 failed"); -+ write_cert(cert); - } else { - BIO *b; - X509 *x509; -diff --git a/drivers/acpi/platform_profile.c b/drivers/acpi/platform_profile.c -index d418462ab79192..89f34310237c36 100644 ---- a/drivers/acpi/platform_profile.c -+++ b/drivers/acpi/platform_profile.c -@@ -22,8 +22,8 @@ static const char * const profile_names[] = { - }; - static_assert(ARRAY_SIZE(profile_names) == PLATFORM_PROFILE_LAST); - --static ssize_t platform_profile_choices_show(struct device *dev, -- struct device_attribute *attr, -+static ssize_t platform_profile_choices_show(struct kobject *kobj, -+ struct kobj_attribute *attr, - char *buf) - { - int len = 0; -@@ -49,8 +49,8 @@ static ssize_t platform_profile_choices_show(struct device *dev, - return len; - } - --static ssize_t platform_profile_show(struct device *dev, -- struct device_attribute *attr, -+static ssize_t platform_profile_show(struct kobject *kobj, -+ struct kobj_attribute *attr, - char *buf) - { - enum platform_profile_option profile = PLATFORM_PROFILE_BALANCED; -@@ -77,8 +77,8 @@ static ssize_t platform_profile_show(struct device *dev, - return sysfs_emit(buf, "%s\n", profile_names[profile]); - } - --static ssize_t platform_profile_store(struct device *dev, -- struct device_attribute *attr, -+static ssize_t platform_profile_store(struct kobject *kobj, -+ struct kobj_attribute *attr, - const char *buf, size_t count) - { - int err, i; -@@ -115,12 +115,12 @@ static ssize_t platform_profile_store(struct device *dev, - return count; - } - --static DEVICE_ATTR_RO(platform_profile_choices); --static DEVICE_ATTR_RW(platform_profile); -+static struct kobj_attribute attr_platform_profile_choices = __ATTR_RO(platform_profile_choices); -+static struct kobj_attribute attr_platform_profile = __ATTR_RW(platform_profile); - - static struct attribute *platform_profile_attrs[] = { -- &dev_attr_platform_profile_choices.attr, -- &dev_attr_platform_profile.attr, -+ &attr_platform_profile_choices.attr, -+ &attr_platform_profile.attr, - NULL - }; - -diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c -index 6e76780fb43083..98104d0b842bd7 100644 ---- a/drivers/ata/ahci.c -+++ b/drivers/ata/ahci.c -@@ -591,6 +591,8 @@ static const struct pci_device_id ahci_pci_tbl[] = { - .driver_data = board_ahci_yes_fbs }, - { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x91a3), - .driver_data = board_ahci_yes_fbs }, -+ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9215), -+ .driver_data = board_ahci_yes_fbs }, - { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9230), - .driver_data = board_ahci_yes_fbs }, - { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9235), -diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c -index 9cc02252218497..3263fc13491e1d 100644 ---- a/drivers/ata/libata-eh.c -+++ b/drivers/ata/libata-eh.c -@@ -1496,8 +1496,15 @@ unsigned int atapi_eh_request_sense(struct ata_device *dev, - tf.flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE; - tf.command = ATA_CMD_PACKET; - -- /* is it pointless to prefer PIO for "safety reasons"? */ -- if (ap->flags & ATA_FLAG_PIO_DMA) { -+ /* -+ * Do not use DMA if the connected device only supports PIO, even if the -+ * port prefers PIO commands via DMA. -+ * -+ * Ideally, we should call atapi_check_dma() to check if it is safe for -+ * the LLD to use DMA for REQUEST_SENSE, but we don't have a qc. -+ * Since we can't check the command, perhaps we should only use pio? -+ */ -+ if ((ap->flags & ATA_FLAG_PIO_DMA) && !(dev->flags & ATA_DFLAG_PIO)) { - tf.protocol = ATAPI_PROT_DMA; - tf.feature |= ATAPI_PKT_DMA; - } else { -diff --git a/drivers/ata/libata-sata.c b/drivers/ata/libata-sata.c -index a701e1538482f0..be72030a500d44 100644 ---- a/drivers/ata/libata-sata.c -+++ b/drivers/ata/libata-sata.c -@@ -1365,6 +1365,8 @@ int ata_eh_read_sense_success_ncq_log(struct ata_link *link) - unsigned int err_mask, tag; - u8 *sense, sk = 0, asc = 0, ascq = 0; - u64 sense_valid, val; -+ u16 extended_sense; -+ bool aux_icc_valid; - int ret = 0; - - err_mask = ata_read_log_page(dev, ATA_LOG_SENSE_NCQ, 0, buf, 2); -@@ -1384,6 +1386,8 @@ int ata_eh_read_sense_success_ncq_log(struct ata_link *link) - - sense_valid = (u64)buf[8] | ((u64)buf[9] << 8) | - ((u64)buf[10] << 16) | ((u64)buf[11] << 24); -+ extended_sense = get_unaligned_le16(&buf[14]); -+ aux_icc_valid = extended_sense & BIT(15); - - ata_qc_for_each_raw(ap, qc, tag) { - if (!(qc->flags & ATA_QCFLAG_EH) || -@@ -1411,6 +1415,17 @@ int ata_eh_read_sense_success_ncq_log(struct ata_link *link) - continue; - } - -+ qc->result_tf.nsect = sense[6]; -+ qc->result_tf.hob_nsect = sense[7]; -+ qc->result_tf.lbal = sense[8]; -+ qc->result_tf.lbam = sense[9]; -+ qc->result_tf.lbah = sense[10]; -+ qc->result_tf.hob_lbal = sense[11]; -+ qc->result_tf.hob_lbam = sense[12]; -+ qc->result_tf.hob_lbah = sense[13]; -+ if (aux_icc_valid) -+ qc->result_tf.auxiliary = get_unaligned_le32(&sense[16]); -+ - /* Set sense without also setting scsicmd->result */ - scsi_build_sense_buffer(dev->flags & ATA_DFLAG_D_SENSE, - qc->scsicmd->sense_buffer, sk, -diff --git a/drivers/ata/pata_pxa.c b/drivers/ata/pata_pxa.c -index 5275c6464f57fc..821bcf20741eae 100644 ---- a/drivers/ata/pata_pxa.c -+++ b/drivers/ata/pata_pxa.c -@@ -223,10 +223,16 @@ static int pxa_ata_probe(struct platform_device *pdev) - - ap->ioaddr.cmd_addr = devm_ioremap(&pdev->dev, cmd_res->start, - resource_size(cmd_res)); -+ if (!ap->ioaddr.cmd_addr) -+ return -ENOMEM; - ap->ioaddr.ctl_addr = devm_ioremap(&pdev->dev, ctl_res->start, - resource_size(ctl_res)); -+ if (!ap->ioaddr.ctl_addr) -+ return -ENOMEM; - ap->ioaddr.bmdma_addr = devm_ioremap(&pdev->dev, dma_res->start, - resource_size(dma_res)); -+ if (!ap->ioaddr.bmdma_addr) -+ return -ENOMEM; - - /* - * Adjust register offsets -diff --git a/drivers/ata/sata_sx4.c b/drivers/ata/sata_sx4.c -index a482741eb181ff..c3042eca6332df 100644 ---- a/drivers/ata/sata_sx4.c -+++ b/drivers/ata/sata_sx4.c -@@ -1117,9 +1117,14 @@ static int pdc20621_prog_dimm0(struct ata_host *host) - mmio += PDC_CHIP0_OFS; - - for (i = 0; i < ARRAY_SIZE(pdc_i2c_read_data); i++) -- pdc20621_i2c_read(host, PDC_DIMM0_SPD_DEV_ADDRESS, -- pdc_i2c_read_data[i].reg, -- &spd0[pdc_i2c_read_data[i].ofs]); -+ if (!pdc20621_i2c_read(host, PDC_DIMM0_SPD_DEV_ADDRESS, -+ pdc_i2c_read_data[i].reg, -+ &spd0[pdc_i2c_read_data[i].ofs])) { -+ dev_err(host->dev, -+ "Failed in i2c read at index %d: device=%#x, reg=%#x\n", -+ i, PDC_DIMM0_SPD_DEV_ADDRESS, pdc_i2c_read_data[i].reg); -+ return -EIO; -+ } - - data |= (spd0[4] - 8) | ((spd0[21] != 0) << 3) | ((spd0[3]-11) << 4); - data |= ((spd0[17] / 4) << 6) | ((spd0[5] / 2) << 7) | -@@ -1284,6 +1289,8 @@ static unsigned int pdc20621_dimm_init(struct ata_host *host) - - /* Programming DIMM0 Module Control Register (index_CID0:80h) */ - size = pdc20621_prog_dimm0(host); -+ if (size < 0) -+ return size; - dev_dbg(host->dev, "Local DIMM Size = %dMB\n", size); - - /* Programming DIMM Module Global Control Register (index_CID0:88h) */ -diff --git a/drivers/base/devres.c b/drivers/base/devres.c -index e9b0d94aeabd90..8a0f000221271f 100644 ---- a/drivers/base/devres.c -+++ b/drivers/base/devres.c -@@ -687,6 +687,13 @@ int devres_release_group(struct device *dev, void *id) - spin_unlock_irqrestore(&dev->devres_lock, flags); - - release_nodes(dev, &todo); -+ } else if (list_empty(&dev->devres_head)) { -+ /* -+ * dev is probably dying via devres_release_all(): groups -+ * have already been removed and are on the process of -+ * being released - don't touch and don't warn. -+ */ -+ spin_unlock_irqrestore(&dev->devres_lock, flags); - } else { - WARN_ON(1); - spin_unlock_irqrestore(&dev->devres_lock, flags); -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index 886c6359903779..8a6c1146df00fd 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -624,19 +624,20 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev, - * dependency. - */ - fput(old_file); -+ dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 0); - if (partscan) - loop_reread_partitions(lo); - - error = 0; - done: -- /* enable and uncork uevent now that we are done */ -- dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 0); -+ kobject_uevent(&disk_to_dev(lo->lo_disk)->kobj, KOBJ_CHANGE); - return error; - - out_err: - loop_global_unlock(lo, is_loop); - out_putf: - fput(file); -+ dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 0); - goto done; - } - -@@ -1104,8 +1105,8 @@ static int loop_configure(struct loop_device *lo, blk_mode_t mode, - if (partscan) - clear_bit(GD_SUPPRESS_PART_SCAN, &lo->lo_disk->state); - -- /* enable and uncork uevent now that we are done */ - dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 0); -+ kobject_uevent(&disk_to_dev(lo->lo_disk)->kobj, KOBJ_CHANGE); - - loop_global_unlock(lo, is_loop); - if (partscan) -diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c -index 892e2540f008ae..5651f40db1736e 100644 ---- a/drivers/bluetooth/btqca.c -+++ b/drivers/bluetooth/btqca.c -@@ -807,6 +807,7 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate, - const char *firmware_name) - { - struct qca_fw_config config = {}; -+ const char *variant = ""; - int err; - u8 rom_ver = 0; - u32 soc_ver; -@@ -901,13 +902,11 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate, - case QCA_WCN3990: - case QCA_WCN3991: - case QCA_WCN3998: -- if (le32_to_cpu(ver.soc_id) == QCA_WCN3991_SOC_ID) { -- snprintf(config.fwname, sizeof(config.fwname), -- "qca/crnv%02xu.bin", rom_ver); -- } else { -- snprintf(config.fwname, sizeof(config.fwname), -- "qca/crnv%02x.bin", rom_ver); -- } -+ if (le32_to_cpu(ver.soc_id) == QCA_WCN3991_SOC_ID) -+ variant = "u"; -+ -+ snprintf(config.fwname, sizeof(config.fwname), -+ "qca/crnv%02x%s.bin", rom_ver, variant); - break; - case QCA_WCN3988: - snprintf(config.fwname, sizeof(config.fwname), -diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c -index 1e7c1f9db9e4b9..7f67e460f7f491 100644 ---- a/drivers/bluetooth/btrtl.c -+++ b/drivers/bluetooth/btrtl.c -@@ -1194,6 +1194,8 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, - rtl_dev_err(hdev, "mandatory config file %s not found", - btrtl_dev->ic_info->cfg_name); - ret = btrtl_dev->cfg_len; -+ if (!ret) -+ ret = -EINVAL; - goto err_free; - } - } -diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c -index 17a2f158a0dfab..70320b8f1aa1c0 100644 ---- a/drivers/bluetooth/hci_ldisc.c -+++ b/drivers/bluetooth/hci_ldisc.c -@@ -102,7 +102,8 @@ static inline struct sk_buff *hci_uart_dequeue(struct hci_uart *hu) - if (!skb) { - percpu_down_read(&hu->proto_lock); - -- if (test_bit(HCI_UART_PROTO_READY, &hu->flags)) -+ if (test_bit(HCI_UART_PROTO_READY, &hu->flags) || -+ test_bit(HCI_UART_PROTO_INIT, &hu->flags)) - skb = hu->proto->dequeue(hu); - - percpu_up_read(&hu->proto_lock); -@@ -124,7 +125,8 @@ int hci_uart_tx_wakeup(struct hci_uart *hu) - if (!percpu_down_read_trylock(&hu->proto_lock)) - return 0; - -- if (!test_bit(HCI_UART_PROTO_READY, &hu->flags)) -+ if (!test_bit(HCI_UART_PROTO_READY, &hu->flags) && -+ !test_bit(HCI_UART_PROTO_INIT, &hu->flags)) - goto no_schedule; - - set_bit(HCI_UART_TX_WAKEUP, &hu->tx_state); -@@ -278,7 +280,8 @@ static int hci_uart_send_frame(struct hci_dev *hdev, struct sk_buff *skb) - - percpu_down_read(&hu->proto_lock); - -- if (!test_bit(HCI_UART_PROTO_READY, &hu->flags)) { -+ if (!test_bit(HCI_UART_PROTO_READY, &hu->flags) && -+ !test_bit(HCI_UART_PROTO_INIT, &hu->flags)) { - percpu_up_read(&hu->proto_lock); - return -EUNATCH; - } -@@ -582,7 +585,8 @@ static void hci_uart_tty_wakeup(struct tty_struct *tty) - if (tty != hu->tty) - return; - -- if (test_bit(HCI_UART_PROTO_READY, &hu->flags)) -+ if (test_bit(HCI_UART_PROTO_READY, &hu->flags) || -+ test_bit(HCI_UART_PROTO_INIT, &hu->flags)) - hci_uart_tx_wakeup(hu); - } - -@@ -608,7 +612,8 @@ static void hci_uart_tty_receive(struct tty_struct *tty, const u8 *data, - - percpu_down_read(&hu->proto_lock); - -- if (!test_bit(HCI_UART_PROTO_READY, &hu->flags)) { -+ if (!test_bit(HCI_UART_PROTO_READY, &hu->flags) && -+ !test_bit(HCI_UART_PROTO_INIT, &hu->flags)) { - percpu_up_read(&hu->proto_lock); - return; - } -@@ -704,12 +709,16 @@ static int hci_uart_set_proto(struct hci_uart *hu, int id) - - hu->proto = p; - -+ set_bit(HCI_UART_PROTO_INIT, &hu->flags); -+ - err = hci_uart_register_dev(hu); - if (err) { - return err; - } - - set_bit(HCI_UART_PROTO_READY, &hu->flags); -+ clear_bit(HCI_UART_PROTO_INIT, &hu->flags); -+ - return 0; - } - -diff --git a/drivers/bluetooth/hci_uart.h b/drivers/bluetooth/hci_uart.h -index 00bf7ae82c5b72..39f39704be41fd 100644 ---- a/drivers/bluetooth/hci_uart.h -+++ b/drivers/bluetooth/hci_uart.h -@@ -89,6 +89,7 @@ struct hci_uart { - #define HCI_UART_REGISTERED 1 - #define HCI_UART_PROTO_READY 2 - #define HCI_UART_NO_SUSPEND_NOTIFIER 3 -+#define HCI_UART_PROTO_INIT 4 - - /* TX states */ - #define HCI_UART_SENDING 1 -diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c -index 28750a40f0ed52..4bfc78f9781ede 100644 ---- a/drivers/bluetooth/hci_vhci.c -+++ b/drivers/bluetooth/hci_vhci.c -@@ -289,18 +289,18 @@ static void vhci_coredump(struct hci_dev *hdev) - - static void vhci_coredump_hdr(struct hci_dev *hdev, struct sk_buff *skb) - { -- char buf[80]; -+ const char *buf; - -- snprintf(buf, sizeof(buf), "Controller Name: vhci_ctrl\n"); -+ buf = "Controller Name: vhci_ctrl\n"; - skb_put_data(skb, buf, strlen(buf)); - -- snprintf(buf, sizeof(buf), "Firmware Version: vhci_fw\n"); -+ buf = "Firmware Version: vhci_fw\n"; - skb_put_data(skb, buf, strlen(buf)); - -- snprintf(buf, sizeof(buf), "Driver: vhci_drv\n"); -+ buf = "Driver: vhci_drv\n"; - skb_put_data(skb, buf, strlen(buf)); - -- snprintf(buf, sizeof(buf), "Vendor: vhci\n"); -+ buf = "Vendor: vhci\n"; - skb_put_data(skb, buf, strlen(buf)); - } - -diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c -index d6653cbcf94a2e..ad1e97222a0f49 100644 ---- a/drivers/bus/mhi/host/main.c -+++ b/drivers/bus/mhi/host/main.c -@@ -1204,11 +1204,16 @@ int mhi_gen_tre(struct mhi_controller *mhi_cntrl, struct mhi_chan *mhi_chan, - struct mhi_ring_element *mhi_tre; - struct mhi_buf_info *buf_info; - int eot, eob, chain, bei; -- int ret; -+ int ret = 0; - - /* Protect accesses for reading and incrementing WP */ - write_lock_bh(&mhi_chan->lock); - -+ if (mhi_chan->ch_state != MHI_CH_STATE_ENABLED) { -+ ret = -ENODEV; -+ goto out; -+ } -+ - buf_ring = &mhi_chan->buf_ring; - tre_ring = &mhi_chan->tre_ring; - -@@ -1226,10 +1231,8 @@ int mhi_gen_tre(struct mhi_controller *mhi_cntrl, struct mhi_chan *mhi_chan, - - if (!info->pre_mapped) { - ret = mhi_cntrl->map_single(mhi_cntrl, buf_info); -- if (ret) { -- write_unlock_bh(&mhi_chan->lock); -- return ret; -- } -+ if (ret) -+ goto out; - } - - eob = !!(flags & MHI_EOB); -@@ -1246,9 +1249,10 @@ int mhi_gen_tre(struct mhi_controller *mhi_cntrl, struct mhi_chan *mhi_chan, - mhi_add_ring_element(mhi_cntrl, tre_ring); - mhi_add_ring_element(mhi_cntrl, buf_ring); - -+out: - write_unlock_bh(&mhi_chan->lock); - -- return 0; -+ return ret; - } - - int mhi_queue_buf(struct mhi_device *mhi_dev, enum dma_data_direction dir, -diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c -index 78999f7f248cb2..70e3fe20fdcf5e 100644 ---- a/drivers/char/tpm/tpm-chip.c -+++ b/drivers/char/tpm/tpm-chip.c -@@ -165,6 +165,11 @@ int tpm_try_get_ops(struct tpm_chip *chip) - goto out_ops; - - mutex_lock(&chip->tpm_mutex); -+ -+ /* tmp_chip_start may issue IO that is denied while suspended */ -+ if (chip->flags & TPM_CHIP_FLAG_SUSPENDED) -+ goto out_lock; -+ - rc = tpm_chip_start(chip); - if (rc) - goto out_lock; -diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c -index c8ea52dfa55678..3a6223cafeb31a 100644 ---- a/drivers/char/tpm/tpm-interface.c -+++ b/drivers/char/tpm/tpm-interface.c -@@ -468,18 +468,11 @@ int tpm_get_random(struct tpm_chip *chip, u8 *out, size_t max) - if (!chip) - return -ENODEV; - -- /* Give back zero bytes, as TPM chip has not yet fully resumed: */ -- if (chip->flags & TPM_CHIP_FLAG_SUSPENDED) { -- rc = 0; -- goto out; -- } -- - if (chip->flags & TPM_CHIP_FLAG_TPM2) - rc = tpm2_get_random(chip, out, max); - else - rc = tpm1_get_random(chip, out, max); - --out: - tpm_put_ops(chip); - return rc; - } -diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c -index f6aa0dfadb93ee..c71e61ccb95a2b 100644 ---- a/drivers/char/tpm/tpm_tis_core.c -+++ b/drivers/char/tpm/tpm_tis_core.c -@@ -114,11 +114,10 @@ static int wait_for_tpm_stat(struct tpm_chip *chip, u8 mask, - return 0; - /* process status changes without irq support */ - do { -+ usleep_range(priv->timeout_min, priv->timeout_max); - status = chip->ops->status(chip); - if ((status & mask) == mask) - return 0; -- usleep_range(priv->timeout_min, -- priv->timeout_max); - } while (time_before(jiffies, stop)); - return -ETIME; - } -@@ -464,7 +463,10 @@ static int tpm_tis_send_data(struct tpm_chip *chip, const u8 *buf, size_t len) - - if (wait_for_tpm_stat(chip, TPM_STS_VALID, chip->timeout_c, - &priv->int_queue, false) < 0) { -- rc = -ETIME; -+ if (test_bit(TPM_TIS_STATUS_VALID_RETRY, &priv->flags)) -+ rc = -EAGAIN; -+ else -+ rc = -ETIME; - goto out_err; - } - status = tpm_tis_status(chip); -@@ -481,7 +483,10 @@ static int tpm_tis_send_data(struct tpm_chip *chip, const u8 *buf, size_t len) - - if (wait_for_tpm_stat(chip, TPM_STS_VALID, chip->timeout_c, - &priv->int_queue, false) < 0) { -- rc = -ETIME; -+ if (test_bit(TPM_TIS_STATUS_VALID_RETRY, &priv->flags)) -+ rc = -EAGAIN; -+ else -+ rc = -ETIME; - goto out_err; - } - status = tpm_tis_status(chip); -@@ -546,9 +551,11 @@ static int tpm_tis_send_main(struct tpm_chip *chip, const u8 *buf, size_t len) - if (rc >= 0) - /* Data transfer done successfully */ - break; -- else if (rc != -EIO) -+ else if (rc != -EAGAIN && rc != -EIO) - /* Data transfer failed, not recoverable */ - return rc; -+ -+ usleep_range(priv->timeout_min, priv->timeout_max); - } - - /* go and do it */ -@@ -1147,6 +1154,9 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, - priv->timeout_max = TIS_TIMEOUT_MAX_ATML; - } - -+ if (priv->manufacturer_id == TPM_VID_IFX) -+ set_bit(TPM_TIS_STATUS_VALID_RETRY, &priv->flags); -+ - if (is_bsw()) { - priv->ilb_base_addr = ioremap(INTEL_LEGACY_BLK_BASE_ADDR, - ILB_REMAP_SIZE); -diff --git a/drivers/char/tpm/tpm_tis_core.h b/drivers/char/tpm/tpm_tis_core.h -index 13e99cf65efe44..369496a6aebf13 100644 ---- a/drivers/char/tpm/tpm_tis_core.h -+++ b/drivers/char/tpm/tpm_tis_core.h -@@ -89,6 +89,7 @@ enum tpm_tis_flags { - TPM_TIS_INVALID_STATUS = 1, - TPM_TIS_DEFAULT_CANCELLATION = 2, - TPM_TIS_IRQ_TESTED = 3, -+ TPM_TIS_STATUS_VALID_RETRY = 4, - }; - - struct tpm_tis_data { -diff --git a/drivers/clk/qcom/clk-branch.c b/drivers/clk/qcom/clk-branch.c -index fc4735f74f0f15..fefbfe7c42e7ea 100644 ---- a/drivers/clk/qcom/clk-branch.c -+++ b/drivers/clk/qcom/clk-branch.c -@@ -27,7 +27,7 @@ static bool clk_branch_in_hwcg_mode(const struct clk_branch *br) - - static bool clk_branch_check_halt(const struct clk_branch *br, bool enabling) - { -- bool invert = (br->halt_check == BRANCH_HALT_ENABLE); -+ bool invert = (br->halt_check & BRANCH_HALT_ENABLE); - u32 val; - - regmap_read(br->clkr.regmap, br->halt_reg, &val); -@@ -43,7 +43,7 @@ static bool clk_branch2_check_halt(const struct clk_branch *br, bool enabling) - { - u32 val; - u32 mask; -- bool invert = (br->halt_check == BRANCH_HALT_ENABLE); -+ bool invert = (br->halt_check & BRANCH_HALT_ENABLE); - - mask = CBCR_NOC_FSM_STATUS; - mask |= CBCR_CLK_OFF; -diff --git a/drivers/clk/qcom/gdsc.c b/drivers/clk/qcom/gdsc.c -index 5358e28122abe4..5a8c93b12efa2b 100644 ---- a/drivers/clk/qcom/gdsc.c -+++ b/drivers/clk/qcom/gdsc.c -@@ -292,6 +292,9 @@ static int gdsc_enable(struct generic_pm_domain *domain) - */ - udelay(1); - -+ if (sc->flags & RETAIN_FF_ENABLE) -+ gdsc_retain_ff_on(sc); -+ - /* Turn on HW trigger mode if supported */ - if (sc->flags & HW_CTRL) { - ret = gdsc_hwctrl(sc, true); -@@ -308,9 +311,6 @@ static int gdsc_enable(struct generic_pm_domain *domain) - udelay(1); - } - -- if (sc->flags & RETAIN_FF_ENABLE) -- gdsc_retain_ff_on(sc); -- - return 0; - } - -@@ -420,13 +420,6 @@ static int gdsc_init(struct gdsc *sc) - goto err_disable_supply; - } - -- /* Turn on HW trigger mode if supported */ -- if (sc->flags & HW_CTRL) { -- ret = gdsc_hwctrl(sc, true); -- if (ret < 0) -- goto err_disable_supply; -- } -- - /* - * Make sure the retain bit is set if the GDSC is already on, - * otherwise we end up turning off the GDSC and destroying all -@@ -434,6 +427,14 @@ static int gdsc_init(struct gdsc *sc) - */ - if (sc->flags & RETAIN_FF_ENABLE) - gdsc_retain_ff_on(sc); -+ -+ /* Turn on HW trigger mode if supported */ -+ if (sc->flags & HW_CTRL) { -+ ret = gdsc_hwctrl(sc, true); -+ if (ret < 0) -+ goto err_disable_supply; -+ } -+ - } else if (sc->flags & ALWAYS_ON) { - /* If ALWAYS_ON GDSCs are not ON, turn them ON */ - gdsc_enable(&sc->pd); -@@ -465,6 +466,23 @@ static int gdsc_init(struct gdsc *sc) - return ret; - } - -+static void gdsc_pm_subdomain_remove(struct gdsc_desc *desc, size_t num) -+{ -+ struct device *dev = desc->dev; -+ struct gdsc **scs = desc->scs; -+ int i; -+ -+ /* Remove subdomains */ -+ for (i = num - 1; i >= 0; i--) { -+ if (!scs[i]) -+ continue; -+ if (scs[i]->parent) -+ pm_genpd_remove_subdomain(scs[i]->parent, &scs[i]->pd); -+ else if (!IS_ERR_OR_NULL(dev->pm_domain)) -+ pm_genpd_remove_subdomain(pd_to_genpd(dev->pm_domain), &scs[i]->pd); -+ } -+} -+ - int gdsc_register(struct gdsc_desc *desc, - struct reset_controller_dev *rcdev, struct regmap *regmap) - { -@@ -509,30 +527,27 @@ int gdsc_register(struct gdsc_desc *desc, - if (!scs[i]) - continue; - if (scs[i]->parent) -- pm_genpd_add_subdomain(scs[i]->parent, &scs[i]->pd); -+ ret = pm_genpd_add_subdomain(scs[i]->parent, &scs[i]->pd); - else if (!IS_ERR_OR_NULL(dev->pm_domain)) -- pm_genpd_add_subdomain(pd_to_genpd(dev->pm_domain), &scs[i]->pd); -+ ret = pm_genpd_add_subdomain(pd_to_genpd(dev->pm_domain), &scs[i]->pd); -+ if (ret) -+ goto err_pm_subdomain_remove; - } - - return of_genpd_add_provider_onecell(dev->of_node, data); -+ -+err_pm_subdomain_remove: -+ gdsc_pm_subdomain_remove(desc, i); -+ -+ return ret; - } - - void gdsc_unregister(struct gdsc_desc *desc) - { -- int i; - struct device *dev = desc->dev; -- struct gdsc **scs = desc->scs; - size_t num = desc->num; - -- /* Remove subdomains */ -- for (i = 0; i < num; i++) { -- if (!scs[i]) -- continue; -- if (scs[i]->parent) -- pm_genpd_remove_subdomain(scs[i]->parent, &scs[i]->pd); -- else if (!IS_ERR_OR_NULL(dev->pm_domain)) -- pm_genpd_remove_subdomain(pd_to_genpd(dev->pm_domain), &scs[i]->pd); -- } -+ gdsc_pm_subdomain_remove(desc, num); - of_genpd_del_provider(dev->of_node); - } - -diff --git a/drivers/clocksource/timer-stm32-lp.c b/drivers/clocksource/timer-stm32-lp.c -index a4c95161cb22c4..193e4f643358bc 100644 ---- a/drivers/clocksource/timer-stm32-lp.c -+++ b/drivers/clocksource/timer-stm32-lp.c -@@ -168,9 +168,7 @@ static int stm32_clkevent_lp_probe(struct platform_device *pdev) - } - - if (of_property_read_bool(pdev->dev.parent->of_node, "wakeup-source")) { -- ret = device_init_wakeup(&pdev->dev, true); -- if (ret) -- goto out_clk_disable; -+ device_set_wakeup_capable(&pdev->dev, true); - - ret = dev_pm_set_wake_irq(&pdev->dev, irq); - if (ret) -diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c -index df445b44e9ec0b..0ac0998152ce81 100644 ---- a/drivers/cpufreq/cpufreq.c -+++ b/drivers/cpufreq/cpufreq.c -@@ -2725,10 +2725,18 @@ EXPORT_SYMBOL(cpufreq_update_policy); - */ - void cpufreq_update_limits(unsigned int cpu) - { -+ struct cpufreq_policy *policy; -+ -+ policy = cpufreq_cpu_get(cpu); -+ if (!policy) -+ return; -+ - if (cpufreq_driver->update_limits) - cpufreq_driver->update_limits(cpu); - else - cpufreq_update_policy(cpu); -+ -+ cpufreq_cpu_put(policy); - } - EXPORT_SYMBOL_GPL(cpufreq_update_limits); - -diff --git a/drivers/crypto/caam/qi.c b/drivers/crypto/caam/qi.c -index 7a3a104557f035..fa5bd64b7407d5 100644 ---- a/drivers/crypto/caam/qi.c -+++ b/drivers/crypto/caam/qi.c -@@ -122,12 +122,12 @@ int caam_qi_enqueue(struct device *qidev, struct caam_drv_req *req) - qm_fd_addr_set64(&fd, addr); - - do { -+ refcount_inc(&req->drv_ctx->refcnt); - ret = qman_enqueue(req->drv_ctx->req_fq, &fd); -- if (likely(!ret)) { -- refcount_inc(&req->drv_ctx->refcnt); -+ if (likely(!ret)) - return 0; -- } - -+ refcount_dec(&req->drv_ctx->refcnt); - if (ret != -EBUSY) - break; - num_retries++; -diff --git a/drivers/crypto/ccp/sp-pci.c b/drivers/crypto/ccp/sp-pci.c -index b6ab56abeb682f..0caa57dafc525a 100644 ---- a/drivers/crypto/ccp/sp-pci.c -+++ b/drivers/crypto/ccp/sp-pci.c -@@ -243,14 +243,17 @@ static bool sp_pci_is_master(struct sp_device *sp) - pdev_new = to_pci_dev(dev_new); - pdev_cur = to_pci_dev(dev_cur); - -- if (pdev_new->bus->number < pdev_cur->bus->number) -- return true; -+ if (pci_domain_nr(pdev_new->bus) != pci_domain_nr(pdev_cur->bus)) -+ return pci_domain_nr(pdev_new->bus) < pci_domain_nr(pdev_cur->bus); - -- if (PCI_SLOT(pdev_new->devfn) < PCI_SLOT(pdev_cur->devfn)) -- return true; -+ if (pdev_new->bus->number != pdev_cur->bus->number) -+ return pdev_new->bus->number < pdev_cur->bus->number; - -- if (PCI_FUNC(pdev_new->devfn) < PCI_FUNC(pdev_cur->devfn)) -- return true; -+ if (PCI_SLOT(pdev_new->devfn) != PCI_SLOT(pdev_cur->devfn)) -+ return PCI_SLOT(pdev_new->devfn) < PCI_SLOT(pdev_cur->devfn); -+ -+ if (PCI_FUNC(pdev_new->devfn) != PCI_FUNC(pdev_cur->devfn)) -+ return PCI_FUNC(pdev_new->devfn) < PCI_FUNC(pdev_cur->devfn); - - return false; - } -diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h -index fc18fd649ed771..5ecb9d3f3e9f94 100644 ---- a/drivers/firmware/efi/libstub/efistub.h -+++ b/drivers/firmware/efi/libstub/efistub.h -@@ -171,7 +171,7 @@ void efi_set_u64_split(u64 data, u32 *lo, u32 *hi) - * the EFI memory map. Other related structures, e.g. x86 e820ext, need - * to factor in this headroom requirement as well. - */ --#define EFI_MMAP_NR_SLACK_SLOTS 8 -+#define EFI_MMAP_NR_SLACK_SLOTS 32 - - typedef struct efi_generic_dev_path efi_device_path_protocol_t; - -diff --git a/drivers/gpio/gpio-tegra186.c b/drivers/gpio/gpio-tegra186.c -index 9130c691a2dd32..58648949f7bab2 100644 ---- a/drivers/gpio/gpio-tegra186.c -+++ b/drivers/gpio/gpio-tegra186.c -@@ -822,6 +822,7 @@ static int tegra186_gpio_probe(struct platform_device *pdev) - struct gpio_irq_chip *irq; - struct tegra_gpio *gpio; - struct device_node *np; -+ struct resource *res; - char **names; - int err; - -@@ -841,19 +842,19 @@ static int tegra186_gpio_probe(struct platform_device *pdev) - gpio->num_banks++; - - /* get register apertures */ -- gpio->secure = devm_platform_ioremap_resource_byname(pdev, "security"); -- if (IS_ERR(gpio->secure)) { -- gpio->secure = devm_platform_ioremap_resource(pdev, 0); -- if (IS_ERR(gpio->secure)) -- return PTR_ERR(gpio->secure); -- } -- -- gpio->base = devm_platform_ioremap_resource_byname(pdev, "gpio"); -- if (IS_ERR(gpio->base)) { -- gpio->base = devm_platform_ioremap_resource(pdev, 1); -- if (IS_ERR(gpio->base)) -- return PTR_ERR(gpio->base); -- } -+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "security"); -+ if (!res) -+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0); -+ gpio->secure = devm_ioremap_resource(&pdev->dev, res); -+ if (IS_ERR(gpio->secure)) -+ return PTR_ERR(gpio->secure); -+ -+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "gpio"); -+ if (!res) -+ res = platform_get_resource(pdev, IORESOURCE_MEM, 1); -+ gpio->base = devm_ioremap_resource(&pdev->dev, res); -+ if (IS_ERR(gpio->base)) -+ return PTR_ERR(gpio->base); - - err = platform_irq_count(pdev); - if (err < 0) -diff --git a/drivers/gpio/gpio-zynq.c b/drivers/gpio/gpio-zynq.c -index 324e942c0650bb..f70b72fe6edf59 100644 ---- a/drivers/gpio/gpio-zynq.c -+++ b/drivers/gpio/gpio-zynq.c -@@ -1018,6 +1018,7 @@ static int zynq_gpio_remove(struct platform_device *pdev) - ret = pm_runtime_get_sync(&pdev->dev); - if (ret < 0) - dev_warn(&pdev->dev, "pm_runtime_get_sync() Failed\n"); -+ device_init_wakeup(&pdev->dev, 0); - gpiochip_remove(&gpio->chip); - clk_disable_unprepare(gpio->clk); - device_set_wakeup_capable(&pdev->dev, 0); -diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig -index ec4abf9ff47b5f..a2b4c97bcb319b 100644 ---- a/drivers/gpu/drm/Kconfig -+++ b/drivers/gpu/drm/Kconfig -@@ -69,6 +69,7 @@ config DRM_USE_DYNAMIC_DEBUG - config DRM_KUNIT_TEST_HELPERS - tristate - depends on DRM && KUNIT -+ select DRM_KMS_HELPER - help - KUnit Helpers for KMS drivers. - -@@ -79,7 +80,6 @@ config DRM_KUNIT_TEST - select DRM_DISPLAY_DP_HELPER - select DRM_DISPLAY_HELPER - select DRM_LIB_RANDOM -- select DRM_KMS_HELPER - select DRM_BUDDY - select DRM_EXPORT_FOR_TESTS if m - select DRM_KUNIT_TEST_HELPERS -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -index 45dd6cbad81e79..10f5a3d0f59163 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -@@ -6015,6 +6015,7 @@ struct dma_fence *amdgpu_device_switch_gang(struct amdgpu_device *adev, - { - struct dma_fence *old = NULL; - -+ dma_fence_get(gang); - do { - dma_fence_put(old); - rcu_read_lock(); -@@ -6024,12 +6025,19 @@ struct dma_fence *amdgpu_device_switch_gang(struct amdgpu_device *adev, - if (old == gang) - break; - -- if (!dma_fence_is_signaled(old)) -+ if (!dma_fence_is_signaled(old)) { -+ dma_fence_put(gang); - return old; -+ } - - } while (cmpxchg((struct dma_fence __force **)&adev->gang_submit, - old, gang) != old); - -+ /* -+ * Drop it once for the exchanged reference in adev and once for the -+ * thread local reference acquired in amdgpu_device_get_gang(). -+ */ -+ dma_fence_put(old); - dma_fence_put(old); - return NULL; - } -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c -index ba3a87cb88ccc9..be4cc4868a748e 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c -@@ -211,7 +211,7 @@ static void amdgpu_dma_buf_unmap(struct dma_buf_attachment *attach, - struct sg_table *sgt, - enum dma_data_direction dir) - { -- if (sgt->sgl->page_link) { -+ if (sg_page(sgt->sgl)) { - dma_unmap_sgtable(attach->dev, sgt, dir, 0); - sg_free_table(sgt); - kfree(sgt); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -index a51ceebb80547e..bacf2e5de2abce 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -@@ -1651,7 +1651,6 @@ static const u16 amdgpu_unsupported_pciidlist[] = { - }; - - static const struct pci_device_id pciidlist[] = { --#ifdef CONFIG_DRM_AMDGPU_SI - {0x1002, 0x6780, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI}, - {0x1002, 0x6784, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI}, - {0x1002, 0x6788, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI}, -@@ -1724,8 +1723,6 @@ static const struct pci_device_id pciidlist[] = { - {0x1002, 0x6665, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|AMD_IS_MOBILITY}, - {0x1002, 0x6667, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|AMD_IS_MOBILITY}, - {0x1002, 0x666F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|AMD_IS_MOBILITY}, --#endif --#ifdef CONFIG_DRM_AMDGPU_CIK - /* Kaveri */ - {0x1002, 0x1304, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|AMD_IS_MOBILITY|AMD_IS_APU}, - {0x1002, 0x1305, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|AMD_IS_APU}, -@@ -1808,7 +1805,6 @@ static const struct pci_device_id pciidlist[] = { - {0x1002, 0x985D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|AMD_IS_MOBILITY|AMD_IS_APU}, - {0x1002, 0x985E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|AMD_IS_MOBILITY|AMD_IS_APU}, - {0x1002, 0x985F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|AMD_IS_MOBILITY|AMD_IS_APU}, --#endif - /* topaz */ - {0x1002, 0x6900, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TOPAZ}, - {0x1002, 0x6901, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TOPAZ}, -@@ -2090,14 +2086,14 @@ static int amdgpu_pci_probe(struct pci_dev *pdev, - return -ENOTSUPP; - } - -+ switch (flags & AMD_ASIC_MASK) { -+ case CHIP_TAHITI: -+ case CHIP_PITCAIRN: -+ case CHIP_VERDE: -+ case CHIP_OLAND: -+ case CHIP_HAINAN: - #ifdef CONFIG_DRM_AMDGPU_SI -- if (!amdgpu_si_support) { -- switch (flags & AMD_ASIC_MASK) { -- case CHIP_TAHITI: -- case CHIP_PITCAIRN: -- case CHIP_VERDE: -- case CHIP_OLAND: -- case CHIP_HAINAN: -+ if (!amdgpu_si_support) { - dev_info(&pdev->dev, - "SI support provided by radeon.\n"); - dev_info(&pdev->dev, -@@ -2105,16 +2101,18 @@ static int amdgpu_pci_probe(struct pci_dev *pdev, - ); - return -ENODEV; - } -- } -+ break; -+#else -+ dev_info(&pdev->dev, "amdgpu is built without SI support.\n"); -+ return -ENODEV; - #endif -+ case CHIP_KAVERI: -+ case CHIP_BONAIRE: -+ case CHIP_HAWAII: -+ case CHIP_KABINI: -+ case CHIP_MULLINS: - #ifdef CONFIG_DRM_AMDGPU_CIK -- if (!amdgpu_cik_support) { -- switch (flags & AMD_ASIC_MASK) { -- case CHIP_KAVERI: -- case CHIP_BONAIRE: -- case CHIP_HAWAII: -- case CHIP_KABINI: -- case CHIP_MULLINS: -+ if (!amdgpu_cik_support) { - dev_info(&pdev->dev, - "CIK support provided by radeon.\n"); - dev_info(&pdev->dev, -@@ -2122,8 +2120,14 @@ static int amdgpu_pci_probe(struct pci_dev *pdev, - ); - return -ENODEV; - } -- } -+ break; -+#else -+ dev_info(&pdev->dev, "amdgpu is built without CIK support.\n"); -+ return -ENODEV; - #endif -+ default: -+ break; -+ } - - adev = devm_drm_dev_alloc(&pdev->dev, &amdgpu_kms_driver, typeof(*adev), ddev); - if (IS_ERR(adev)) -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c -index 8669677662d0c0..35dc926f234e39 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c -@@ -212,6 +212,11 @@ static int set_queue_properties_from_user(struct queue_properties *q_properties, - return -EINVAL; - } - -+ if (args->ring_size < KFD_MIN_QUEUE_RING_SIZE) { -+ args->ring_size = KFD_MIN_QUEUE_RING_SIZE; -+ pr_debug("Size lower. clamped to KFD_MIN_QUEUE_RING_SIZE"); -+ } -+ - if (!access_ok((const void __user *) args->read_pointer_address, - sizeof(uint32_t))) { - pr_err("Can't access read pointer\n"); -@@ -477,6 +482,11 @@ static int kfd_ioctl_update_queue(struct file *filp, struct kfd_process *p, - return -EINVAL; - } - -+ if (args->ring_size < KFD_MIN_QUEUE_RING_SIZE) { -+ args->ring_size = KFD_MIN_QUEUE_RING_SIZE; -+ pr_debug("Size lower. clamped to KFD_MIN_QUEUE_RING_SIZE"); -+ } -+ - properties.queue_address = args->ring_base_address; - properties.queue_size = args->ring_size; - properties.queue_percent = args->queue_percentage & 0xFF; -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c -index 9d0b0bf70ad1ea..2786d47961e075 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c -@@ -1388,6 +1388,11 @@ int kfd_debugfs_hang_hws(struct kfd_node *dev) - return -EINVAL; - } - -+ if (dev->kfd->shared_resources.enable_mes) { -+ dev_err(dev->adev->dev, "Inducing MES hang is not supported\n"); -+ return -EINVAL; -+ } -+ - return dqm_debugfs_hang_hws(dev->dqm); - } - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c -index 64346c71c62a30..a6d08dee74f6ea 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c -@@ -35,6 +35,7 @@ - #include - #include "amdgpu_amdkfd.h" - #include "amdgpu.h" -+#include "amdgpu_reset.h" - - struct mm_struct; - -@@ -1110,6 +1111,17 @@ static void kfd_process_remove_sysfs(struct kfd_process *p) - p->kobj = NULL; - } - -+/* -+ * If any GPU is ongoing reset, wait for reset complete. -+ */ -+static void kfd_process_wait_gpu_reset_complete(struct kfd_process *p) -+{ -+ int i; -+ -+ for (i = 0; i < p->n_pdds; i++) -+ flush_workqueue(p->pdds[i]->dev->adev->reset_domain->wq); -+} -+ - /* No process locking is needed in this function, because the process - * is not findable any more. We must assume that no other thread is - * using it any more, otherwise we couldn't safely free the process -@@ -1123,6 +1135,11 @@ static void kfd_process_wq_release(struct work_struct *work) - kfd_process_dequeue_from_all_devices(p); - pqm_uninit(&p->pqm); - -+ /* -+ * If GPU in reset, user queues may still running, wait for reset complete. -+ */ -+ kfd_process_wait_gpu_reset_complete(p); -+ - /* Signal the eviction fence after user mode queues are - * destroyed. This allows any BOs to be freed without - * triggering pointless evictions or waiting for fences. -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c -index e057c2bc7be424..d11a71e8aa1413 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c -@@ -510,7 +510,7 @@ int pqm_destroy_queue(struct process_queue_manager *pqm, unsigned int qid) - pr_err("Pasid 0x%x destroy queue %d failed, ret %d\n", - pqm->process->pasid, - pqn->q->properties.queue_id, retval); -- if (retval != -ETIME) -+ if (retval != -ETIME && retval != -EIO) - goto err_destroy_queue; - } - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 3696b9112c74e3..28f2b4022d34e3 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -4484,17 +4484,17 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev) - } - } - -+ if (link_cnt > (MAX_PIPES * 2)) { -+ DRM_ERROR( -+ "KMS: Cannot support more than %d display indexes\n", -+ MAX_PIPES * 2); -+ goto fail; -+ } -+ - /* loops over all connectors on the board */ - for (i = 0; i < link_cnt; i++) { - struct dc_link *link = NULL; - -- if (i > AMDGPU_DM_MAX_DISPLAY_INDEX) { -- DRM_ERROR( -- "KMS: Cannot support more than %d display indexes\n", -- AMDGPU_DM_MAX_DISPLAY_INDEX); -- continue; -- } -- - aconnector = kzalloc(sizeof(*aconnector), GFP_KERNEL); - if (!aconnector) - goto fail; -diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h -index cc5e01df151356..88e64b280c90f5 100644 ---- a/drivers/gpu/drm/amd/display/dc/dc.h -+++ b/drivers/gpu/drm/amd/display/dc/dc.h -@@ -1563,7 +1563,9 @@ struct dc_link { - bool dongle_mode_timing_override; - bool blank_stream_on_ocs_change; - bool read_dpcd204h_on_irq_hpd; -+ bool force_dp_ffe_preset; - } wa_flags; -+ union dc_dp_ffe_preset forced_dp_ffe_preset; - struct link_mst_stream_allocation_table mst_stream_alloc_table; - - struct dc_link_status link_status; -diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c -index ff38a85c4fa22d..e71b79f5a66cda 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c -@@ -1930,20 +1930,11 @@ static void delay_cursor_until_vupdate(struct dc *dc, struct pipe_ctx *pipe_ctx) - dc->hwss.get_position(&pipe_ctx, 1, &position); - vpos = position.vertical_count; - -- /* Avoid wraparound calculation issues */ -- vupdate_start += stream->timing.v_total; -- vupdate_end += stream->timing.v_total; -- vpos += stream->timing.v_total; -- - if (vpos <= vupdate_start) { - /* VPOS is in VACTIVE or back porch. */ - lines_to_vupdate = vupdate_start - vpos; -- } else if (vpos > vupdate_end) { -- /* VPOS is in the front porch. */ -- return; - } else { -- /* VPOS is in VUPDATE. */ -- lines_to_vupdate = 0; -+ lines_to_vupdate = stream->timing.v_total - vpos + vupdate_start; - } - - /* Calculate time until VUPDATE in microseconds. */ -@@ -1951,13 +1942,18 @@ static void delay_cursor_until_vupdate(struct dc *dc, struct pipe_ctx *pipe_ctx) - stream->timing.h_total * 10000u / stream->timing.pix_clk_100hz; - us_to_vupdate = lines_to_vupdate * us_per_line; - -+ /* Stall out until the cursor update completes. */ -+ if (vupdate_end < vupdate_start) -+ vupdate_end += stream->timing.v_total; -+ -+ /* Position is in the range of vupdate start and end*/ -+ if (lines_to_vupdate > stream->timing.v_total - vupdate_end + vupdate_start) -+ us_to_vupdate = 0; -+ - /* 70 us is a conservative estimate of cursor update time*/ - if (us_to_vupdate > 70) - return; - -- /* Stall out until the cursor update completes. */ -- if (vupdate_end < vupdate_start) -- vupdate_end += stream->timing.v_total; - us_vupdate = (vupdate_end - vupdate_start + 1) * us_per_line; - udelay(us_to_vupdate + us_vupdate); - } -diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hubp.c -index 39a57bcd78667a..576acf2ce10dd5 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hubp.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hubp.c -@@ -44,7 +44,7 @@ void hubp31_set_unbounded_requesting(struct hubp *hubp, bool enable) - struct dcn20_hubp *hubp2 = TO_DCN20_HUBP(hubp); - - REG_UPDATE(DCHUBP_CNTL, HUBP_UNBOUNDED_REQ_MODE, enable); -- REG_UPDATE(CURSOR_CONTROL, CURSOR_REQ_MODE, enable); -+ REG_UPDATE(CURSOR_CONTROL, CURSOR_REQ_MODE, 1); - } - - void hubp31_soft_reset(struct hubp *hubp, bool reset) -diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c -index 9d1adfc09fb2aa..51e88efee11e4a 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c -+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c -@@ -697,6 +697,8 @@ void override_training_settings( - lt_settings->pre_emphasis = overrides->pre_emphasis; - if (overrides->post_cursor2 != NULL) - lt_settings->post_cursor2 = overrides->post_cursor2; -+ if (link->wa_flags.force_dp_ffe_preset && !dp_is_lttpr_present(link)) -+ lt_settings->ffe_preset = &link->forced_dp_ffe_preset; - if (overrides->ffe_preset != NULL) - lt_settings->ffe_preset = overrides->ffe_preset; - /* Override HW lane settings with BIOS forced values if present */ -diff --git a/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c b/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c -index 86f95a291d65f6..bef6578ac4bfef 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c -@@ -51,6 +51,11 @@ static int amd_powerplay_create(struct amdgpu_device *adev) - hwmgr->adev = adev; - hwmgr->not_vf = !amdgpu_sriov_vf(adev); - hwmgr->device = amdgpu_cgs_create_device(adev); -+ if (!hwmgr->device) { -+ kfree(hwmgr); -+ return -ENOMEM; -+ } -+ - mutex_init(&hwmgr->msg_lock); - hwmgr->chip_family = adev->family; - hwmgr->chip_id = adev->asic_type; -diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c -index a6c3610db23ee6..7209e965dc5247 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c -@@ -267,10 +267,10 @@ int smu7_fan_ctrl_set_fan_speed_rpm(struct pp_hwmgr *hwmgr, uint32_t speed) - if (hwmgr->thermal_controller.fanInfo.bNoFan || - (hwmgr->thermal_controller.fanInfo. - ucTachometerPulsesPerRevolution == 0) || -- speed == 0 || -+ (!speed || speed > UINT_MAX/8) || - (speed < hwmgr->thermal_controller.fanInfo.ulMinRPM) || - (speed > hwmgr->thermal_controller.fanInfo.ulMaxRPM)) -- return 0; -+ return -EINVAL; - - if (PP_CAP(PHM_PlatformCaps_MicrocodeFanControl)) - smu7_fan_ctrl_stop_smc_fan_control(hwmgr); -diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c -index 190af79f3236fd..e93b7c4aa8c941 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c -@@ -307,10 +307,10 @@ int vega10_fan_ctrl_set_fan_speed_rpm(struct pp_hwmgr *hwmgr, uint32_t speed) - int result = 0; - - if (hwmgr->thermal_controller.fanInfo.bNoFan || -- speed == 0 || -+ (!speed || speed > UINT_MAX/8) || - (speed < hwmgr->thermal_controller.fanInfo.ulMinRPM) || - (speed > hwmgr->thermal_controller.fanInfo.ulMaxRPM)) -- return -1; -+ return -EINVAL; - - if (PP_CAP(PHM_PlatformCaps_MicrocodeFanControl)) - result = vega10_fan_ctrl_stop_smc_fan_control(hwmgr); -diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c -index e9737ca8418a52..a1b1c985ca9ac1 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c -@@ -191,7 +191,7 @@ int vega20_fan_ctrl_set_fan_speed_rpm(struct pp_hwmgr *hwmgr, uint32_t speed) - uint32_t tach_period, crystal_clock_freq; - int result = 0; - -- if (!speed) -+ if (!speed || speed > UINT_MAX/8) - return -EINVAL; - - if (PP_CAP(PHM_PlatformCaps_MicrocodeFanControl)) { -diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c -index 4c58c2cd26d886..0cdf3257b19b3b 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c -@@ -1274,6 +1274,9 @@ static int arcturus_set_fan_speed_rpm(struct smu_context *smu, - uint32_t crystal_clock_freq = 2500; - uint32_t tach_period; - -+ if (!speed || speed > UINT_MAX/8) -+ return -EINVAL; -+ - tach_period = 60 * crystal_clock_freq * 10000 / (8 * speed); - WREG32_SOC15(THM, 0, mmCG_TACH_CTRL_ARCT, - REG_SET_FIELD(RREG32_SOC15(THM, 0, mmCG_TACH_CTRL_ARCT), -diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c -index 123c19bb622808..1b726489d86a0f 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c -@@ -1202,7 +1202,7 @@ int smu_v11_0_set_fan_speed_rpm(struct smu_context *smu, - uint32_t crystal_clock_freq = 2500; - uint32_t tach_period; - -- if (speed == 0) -+ if (!speed || speed > UINT_MAX/8) - return -EINVAL; - /* - * To prevent from possible overheat, some ASICs may have requirement -diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c -index c0adfa46ac7896..8504692be47f17 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c -@@ -1227,7 +1227,7 @@ int smu_v13_0_set_fan_speed_rpm(struct smu_context *smu, - uint32_t tach_period; - int ret; - -- if (!speed) -+ if (!speed || speed > UINT_MAX/8) - return -EINVAL; - - ret = smu_v13_0_auto_fan_control(smu, 0); -diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c -index 554d4468aa7c08..f3681970887cc8 100644 ---- a/drivers/gpu/drm/drm_atomic_helper.c -+++ b/drivers/gpu/drm/drm_atomic_helper.c -@@ -1373,7 +1373,7 @@ crtc_set_mode(struct drm_device *dev, struct drm_atomic_state *old_state) - mode = &new_crtc_state->mode; - adjusted_mode = &new_crtc_state->adjusted_mode; - -- if (!new_crtc_state->mode_changed) -+ if (!new_crtc_state->mode_changed && !new_crtc_state->connectors_changed) - continue; - - drm_dbg_atomic(dev, "modeset on [ENCODER:%d:%s]\n", -diff --git a/drivers/gpu/drm/drm_panel.c b/drivers/gpu/drm/drm_panel.c -index cfbe020de54e01..98df4788d096f0 100644 ---- a/drivers/gpu/drm/drm_panel.c -+++ b/drivers/gpu/drm/drm_panel.c -@@ -49,7 +49,7 @@ static LIST_HEAD(panel_list); - * @dev: parent device of the panel - * @funcs: panel operations - * @connector_type: the connector type (DRM_MODE_CONNECTOR_*) corresponding to -- * the panel interface -+ * the panel interface (must NOT be DRM_MODE_CONNECTOR_Unknown) - * - * Initialize the panel structure for subsequent registration with - * drm_panel_add(). -@@ -57,6 +57,9 @@ static LIST_HEAD(panel_list); - void drm_panel_init(struct drm_panel *panel, struct device *dev, - const struct drm_panel_funcs *funcs, int connector_type) - { -+ if (connector_type == DRM_MODE_CONNECTOR_Unknown) -+ DRM_WARN("%s: %s: a valid connector type is required!\n", __func__, dev_name(dev)); -+ - INIT_LIST_HEAD(&panel->list); - INIT_LIST_HEAD(&panel->followers); - mutex_init(&panel->follower_lock); -diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c -index c00f6f16244c0d..036b095c988828 100644 ---- a/drivers/gpu/drm/drm_panel_orientation_quirks.c -+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c -@@ -93,6 +93,12 @@ static const struct drm_dmi_panel_orientation_data onegx1_pro = { - .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, - }; - -+static const struct drm_dmi_panel_orientation_data lcd640x960_leftside_up = { -+ .width = 640, -+ .height = 960, -+ .orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP, -+}; -+ - static const struct drm_dmi_panel_orientation_data lcd720x1280_rightside_up = { - .width = 720, - .height = 1280, -@@ -123,6 +129,12 @@ static const struct drm_dmi_panel_orientation_data lcd1080x1920_rightside_up = { - .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, - }; - -+static const struct drm_dmi_panel_orientation_data lcd1200x1920_leftside_up = { -+ .width = 1200, -+ .height = 1920, -+ .orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP, -+}; -+ - static const struct drm_dmi_panel_orientation_data lcd1200x1920_rightside_up = { - .width = 1200, - .height = 1920, -@@ -184,10 +196,10 @@ static const struct dmi_system_id orientation_data[] = { - DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T103HAF"), - }, - .driver_data = (void *)&lcd800x1280_rightside_up, -- }, { /* AYA NEO AYANEO 2 */ -+ }, { /* AYA NEO AYANEO 2/2S */ - .matches = { - DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYANEO"), -- DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "AYANEO 2"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "AYANEO 2"), - }, - .driver_data = (void *)&lcd1200x1920_rightside_up, - }, { /* AYA NEO 2021 */ -@@ -202,6 +214,18 @@ static const struct dmi_system_id orientation_data[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "AIR"), - }, - .driver_data = (void *)&lcd1080x1920_leftside_up, -+ }, { /* AYA NEO Flip DS Bottom Screen */ -+ .matches = { -+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYANEO"), -+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "FLIP DS"), -+ }, -+ .driver_data = (void *)&lcd640x960_leftside_up, -+ }, { /* AYA NEO Flip KB/DS Top Screen */ -+ .matches = { -+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYANEO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "FLIP"), -+ }, -+ .driver_data = (void *)&lcd1080x1920_leftside_up, - }, { /* AYA NEO Founder */ - .matches = { - DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYA NEO"), -@@ -226,6 +250,12 @@ static const struct dmi_system_id orientation_data[] = { - DMI_MATCH(DMI_BOARD_NAME, "KUN"), - }, - .driver_data = (void *)&lcd1600x2560_rightside_up, -+ }, { /* AYA NEO SLIDE */ -+ .matches = { -+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYANEO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "SLIDE"), -+ }, -+ .driver_data = (void *)&lcd1080x1920_leftside_up, - }, { /* AYN Loki Max */ - .matches = { - DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ayn"), -@@ -315,6 +345,12 @@ static const struct dmi_system_id orientation_data[] = { - DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"), - }, - .driver_data = (void *)&gpd_win2, -+ }, { /* GPD Win 2 (correct DMI strings) */ -+ .matches = { -+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"), -+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "WIN2") -+ }, -+ .driver_data = (void *)&lcd720x1280_rightside_up, - }, { /* GPD Win 3 */ - .matches = { - DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"), -@@ -443,6 +479,12 @@ static const struct dmi_system_id orientation_data[] = { - DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "ONE XPLAYER"), - }, - .driver_data = (void *)&lcd1600x2560_leftside_up, -+ }, { /* OneXPlayer Mini (Intel) */ -+ .matches = { -+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ONE-NETBOOK TECHNOLOGY CO., LTD."), -+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "ONE XPLAYER"), -+ }, -+ .driver_data = (void *)&lcd1200x1920_leftside_up, - }, { /* OrangePi Neo */ - .matches = { - DMI_EXACT_MATCH(DMI_SYS_VENDOR, "OrangePi"), -diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c -index d9bb352b8baab7..0729ab5955171e 100644 ---- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c -+++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c -@@ -1218,7 +1218,8 @@ static int intel_engine_init_tlb_invalidation(struct intel_engine_cs *engine) - num = ARRAY_SIZE(xelpmp_regs); - } - } else { -- if (GRAPHICS_VER_FULL(i915) == IP_VER(12, 71) || -+ if (GRAPHICS_VER_FULL(i915) == IP_VER(12, 74) || -+ GRAPHICS_VER_FULL(i915) == IP_VER(12, 71) || - GRAPHICS_VER_FULL(i915) == IP_VER(12, 70) || - GRAPHICS_VER_FULL(i915) == IP_VER(12, 50) || - GRAPHICS_VER_FULL(i915) == IP_VER(12, 55)) { -diff --git a/drivers/gpu/drm/i915/gt/intel_mocs.c b/drivers/gpu/drm/i915/gt/intel_mocs.c -index 07269ff3be136d..25c1023eb5f9fa 100644 ---- a/drivers/gpu/drm/i915/gt/intel_mocs.c -+++ b/drivers/gpu/drm/i915/gt/intel_mocs.c -@@ -487,7 +487,7 @@ static bool has_mocs(const struct drm_i915_private *i915) - return !IS_DGFX(i915); - } - --static unsigned int get_mocs_settings(const struct drm_i915_private *i915, -+static unsigned int get_mocs_settings(struct drm_i915_private *i915, - struct drm_i915_mocs_table *table) - { - unsigned int flags; -@@ -495,7 +495,7 @@ static unsigned int get_mocs_settings(const struct drm_i915_private *i915, - memset(table, 0, sizeof(struct drm_i915_mocs_table)); - - table->unused_entries_index = I915_MOCS_PTE; -- if (IS_GFX_GT_IP_RANGE(&i915->gt0, IP_VER(12, 70), IP_VER(12, 71))) { -+ if (IS_GFX_GT_IP_RANGE(to_gt(i915), IP_VER(12, 70), IP_VER(12, 74))) { - table->size = ARRAY_SIZE(mtl_mocs_table); - table->table = mtl_mocs_table; - table->n_entries = MTL_NUM_MOCS_ENTRIES; -diff --git a/drivers/gpu/drm/i915/gt/intel_rc6.c b/drivers/gpu/drm/i915/gt/intel_rc6.c -index 6e8c182b2559e7..3c7f4ed51bb05d 100644 ---- a/drivers/gpu/drm/i915/gt/intel_rc6.c -+++ b/drivers/gpu/drm/i915/gt/intel_rc6.c -@@ -117,21 +117,10 @@ static void gen11_rc6_enable(struct intel_rc6 *rc6) - GEN6_RC_CTL_RC6_ENABLE | - GEN6_RC_CTL_EI_MODE(1); - -- /* -- * BSpec 52698 - Render powergating must be off. -- * FIXME BSpec is outdated, disabling powergating for MTL is just -- * temporary wa and should be removed after fixing real cause -- * of forcewake timeouts. -- */ -- if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 71))) -- pg_enable = -- GEN9_MEDIA_PG_ENABLE | -- GEN11_MEDIA_SAMPLER_PG_ENABLE; -- else -- pg_enable = -- GEN9_RENDER_PG_ENABLE | -- GEN9_MEDIA_PG_ENABLE | -- GEN11_MEDIA_SAMPLER_PG_ENABLE; -+ pg_enable = -+ GEN9_RENDER_PG_ENABLE | -+ GEN9_MEDIA_PG_ENABLE | -+ GEN11_MEDIA_SAMPLER_PG_ENABLE; - - if (GRAPHICS_VER(gt->i915) >= 12 && !IS_DG1(gt->i915)) { - for (i = 0; i < I915_MAX_VCS; i++) -diff --git a/drivers/gpu/drm/i915/gt/uc/intel_huc.c b/drivers/gpu/drm/i915/gt/uc/intel_huc.c -index ba9e07fc2b5770..552662953e7a44 100644 ---- a/drivers/gpu/drm/i915/gt/uc/intel_huc.c -+++ b/drivers/gpu/drm/i915/gt/uc/intel_huc.c -@@ -316,6 +316,11 @@ void intel_huc_init_early(struct intel_huc *huc) - } - } - -+void intel_huc_fini_late(struct intel_huc *huc) -+{ -+ delayed_huc_load_fini(huc); -+} -+ - #define HUC_LOAD_MODE_STRING(x) (x ? "GSC" : "legacy") - static int check_huc_loading_mode(struct intel_huc *huc) - { -@@ -413,12 +418,6 @@ int intel_huc_init(struct intel_huc *huc) - - void intel_huc_fini(struct intel_huc *huc) - { -- /* -- * the fence is initialized in init_early, so we need to clean it up -- * even if HuC loading is off. -- */ -- delayed_huc_load_fini(huc); -- - if (huc->heci_pkt) - i915_vma_unpin_and_release(&huc->heci_pkt, 0); - -diff --git a/drivers/gpu/drm/i915/gt/uc/intel_huc.h b/drivers/gpu/drm/i915/gt/uc/intel_huc.h -index ba5cb08e9e7bf1..09aff3148f7ddb 100644 ---- a/drivers/gpu/drm/i915/gt/uc/intel_huc.h -+++ b/drivers/gpu/drm/i915/gt/uc/intel_huc.h -@@ -55,6 +55,7 @@ struct intel_huc { - - int intel_huc_sanitize(struct intel_huc *huc); - void intel_huc_init_early(struct intel_huc *huc); -+void intel_huc_fini_late(struct intel_huc *huc); - int intel_huc_init(struct intel_huc *huc); - void intel_huc_fini(struct intel_huc *huc); - void intel_huc_suspend(struct intel_huc *huc); -diff --git a/drivers/gpu/drm/i915/gt/uc/intel_uc.c b/drivers/gpu/drm/i915/gt/uc/intel_uc.c -index 98b103375b7ab0..c29d187ddad1cd 100644 ---- a/drivers/gpu/drm/i915/gt/uc/intel_uc.c -+++ b/drivers/gpu/drm/i915/gt/uc/intel_uc.c -@@ -145,6 +145,7 @@ void intel_uc_init_late(struct intel_uc *uc) - - void intel_uc_driver_late_release(struct intel_uc *uc) - { -+ intel_huc_fini_late(&uc->huc); - } - - /** -diff --git a/drivers/gpu/drm/i915/gvt/opregion.c b/drivers/gpu/drm/i915/gvt/opregion.c -index d2bed466540ab2..3da476dec1da26 100644 ---- a/drivers/gpu/drm/i915/gvt/opregion.c -+++ b/drivers/gpu/drm/i915/gvt/opregion.c -@@ -222,7 +222,6 @@ int intel_vgpu_init_opregion(struct intel_vgpu *vgpu) - u8 *buf; - struct opregion_header *header; - struct vbt v; -- const char opregion_signature[16] = OPREGION_SIGNATURE; - - gvt_dbg_core("init vgpu%d opregion\n", vgpu->id); - vgpu_opregion(vgpu)->va = (void *)__get_free_pages(GFP_KERNEL | -@@ -236,8 +235,10 @@ int intel_vgpu_init_opregion(struct intel_vgpu *vgpu) - /* emulated opregion with VBT mailbox only */ - buf = (u8 *)vgpu_opregion(vgpu)->va; - header = (struct opregion_header *)buf; -- memcpy(header->signature, opregion_signature, -- sizeof(opregion_signature)); -+ -+ static_assert(sizeof(header->signature) == sizeof(OPREGION_SIGNATURE) - 1); -+ memcpy(header->signature, OPREGION_SIGNATURE, sizeof(header->signature)); -+ - header->size = 0x8; - header->opregion_ver = 0x02000000; - header->mboxes = MBOX_VBT; -diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c -index 7a90a2e32c9f1b..1fde21d8bb59a9 100644 ---- a/drivers/gpu/drm/i915/i915_debugfs.c -+++ b/drivers/gpu/drm/i915/i915_debugfs.c -@@ -144,7 +144,7 @@ static const char *i915_cache_level_str(struct drm_i915_gem_object *obj) - { - struct drm_i915_private *i915 = obj_to_i915(obj); - -- if (IS_GFX_GT_IP_RANGE(to_gt(i915), IP_VER(12, 70), IP_VER(12, 71))) { -+ if (IS_GFX_GT_IP_RANGE(to_gt(i915), IP_VER(12, 70), IP_VER(12, 74))) { - switch (obj->pat_index) { - case 0: return " WB"; - case 1: return " WT"; -diff --git a/drivers/gpu/drm/i915/selftests/i915_selftest.c b/drivers/gpu/drm/i915/selftests/i915_selftest.c -index ee79e0809a6ddf..889281819c5b13 100644 ---- a/drivers/gpu/drm/i915/selftests/i915_selftest.c -+++ b/drivers/gpu/drm/i915/selftests/i915_selftest.c -@@ -23,7 +23,9 @@ - - #include - -+#include "gt/intel_gt.h" - #include "gt/intel_gt_pm.h" -+#include "gt/intel_gt_regs.h" - #include "gt/uc/intel_gsc_fw.h" - - #include "i915_driver.h" -@@ -154,6 +156,30 @@ __wait_gsc_proxy_completed(struct drm_i915_private *i915) - pr_warn(DRIVER_NAME "Timed out waiting for gsc_proxy_completion!\n"); - } - -+static void -+__wait_gsc_huc_load_completed(struct drm_i915_private *i915) -+{ -+ /* this only applies to DG2, so we only care about GT0 */ -+ struct intel_huc *huc = &to_gt(i915)->uc.huc; -+ bool need_to_wait = (IS_ENABLED(CONFIG_INTEL_MEI_PXP) && -+ intel_huc_wait_required(huc)); -+ /* -+ * The GSC and PXP mei bringup depends on the kernel boot ordering, so -+ * to account for the worst case scenario the HuC code waits for up to -+ * 10s for the GSC driver to load and then another 5s for the PXP -+ * component to bind before giving up, even though those steps normally -+ * complete in less than a second from the i915 load. We match that -+ * timeout here, but we expect to bail early due to the fence being -+ * signalled even in a failure case, as it is extremely unlikely that -+ * both components will use their full timeout. -+ */ -+ unsigned long timeout_ms = 15000; -+ -+ if (need_to_wait && -+ wait_for(i915_sw_fence_done(&huc->delayed_load.fence), timeout_ms)) -+ pr_warn(DRIVER_NAME "Timed out waiting for huc load via GSC!\n"); -+} -+ - static int __run_selftests(const char *name, - struct selftest *st, - unsigned int count, -@@ -228,14 +254,32 @@ int i915_mock_selftests(void) - - int i915_live_selftests(struct pci_dev *pdev) - { -+ struct drm_i915_private *i915 = pdev_to_i915(pdev); -+ struct intel_uncore *uncore = &i915->uncore; - int err; -+ u32 pg_enable; -+ intel_wakeref_t wakeref; - - if (!i915_selftest.live) - return 0; - -- __wait_gsc_proxy_completed(pdev_to_i915(pdev)); -+ /* -+ * FIXME Disable render powergating, this is temporary wa and should be removed -+ * after fixing real cause of forcewake timeouts. -+ */ -+ with_intel_runtime_pm(uncore->rpm, wakeref) { -+ if (IS_GFX_GT_IP_RANGE(to_gt(i915), IP_VER(12, 00), IP_VER(12, 74))) { -+ pg_enable = intel_uncore_read(uncore, GEN9_PG_ENABLE); -+ if (pg_enable & GEN9_RENDER_PG_ENABLE) -+ intel_uncore_write_fw(uncore, GEN9_PG_ENABLE, -+ pg_enable & ~GEN9_RENDER_PG_ENABLE); -+ } -+ } -+ -+ __wait_gsc_proxy_completed(i915); -+ __wait_gsc_huc_load_completed(i915); - -- err = run_selftests(live, pdev_to_i915(pdev)); -+ err = run_selftests(live, i915); - if (err) { - i915_selftest.live = err; - return err; -@@ -251,14 +295,16 @@ int i915_live_selftests(struct pci_dev *pdev) - - int i915_perf_selftests(struct pci_dev *pdev) - { -+ struct drm_i915_private *i915 = pdev_to_i915(pdev); - int err; - - if (!i915_selftest.perf) - return 0; - -- __wait_gsc_proxy_completed(pdev_to_i915(pdev)); -+ __wait_gsc_proxy_completed(i915); -+ __wait_gsc_huc_load_completed(i915); - -- err = run_selftests(perf, pdev_to_i915(pdev)); -+ err = run_selftests(perf, i915); - if (err) { - i915_selftest.perf = err; - return err; -diff --git a/drivers/gpu/drm/mediatek/mtk_dpi.c b/drivers/gpu/drm/mediatek/mtk_dpi.c -index bc073a6b367e5b..54fc3f819577e3 100644 ---- a/drivers/gpu/drm/mediatek/mtk_dpi.c -+++ b/drivers/gpu/drm/mediatek/mtk_dpi.c -@@ -127,14 +127,14 @@ struct mtk_dpi_yc_limit { - * @is_ck_de_pol: Support CK/DE polarity. - * @swap_input_support: Support input swap function. - * @support_direct_pin: IP supports direct connection to dpi panels. -- * @input_2pixel: Input pixel of dp_intf is 2 pixel per round, so enable this -- * config to enable this feature. - * @dimension_mask: Mask used for HWIDTH, HPORCH, VSYNC_WIDTH and VSYNC_PORCH - * (no shift). - * @hvsize_mask: Mask of HSIZE and VSIZE mask (no shift). - * @channel_swap_shift: Shift value of channel swap. - * @yuv422_en_bit: Enable bit of yuv422. - * @csc_enable_bit: Enable bit of CSC. -+ * @input_2p_en_bit: Enable bit for input two pixel per round feature. -+ * If present, implies that the feature must be enabled. - * @pixels_per_iter: Quantity of transferred pixels per iteration. - * @edge_cfg_in_mmsys: If the edge configuration for DPI's output needs to be set in MMSYS. - */ -@@ -148,12 +148,12 @@ struct mtk_dpi_conf { - bool is_ck_de_pol; - bool swap_input_support; - bool support_direct_pin; -- bool input_2pixel; - u32 dimension_mask; - u32 hvsize_mask; - u32 channel_swap_shift; - u32 yuv422_en_bit; - u32 csc_enable_bit; -+ u32 input_2p_en_bit; - u32 pixels_per_iter; - bool edge_cfg_in_mmsys; - }; -@@ -471,6 +471,7 @@ static void mtk_dpi_power_off(struct mtk_dpi *dpi) - - mtk_dpi_disable(dpi); - clk_disable_unprepare(dpi->pixel_clk); -+ clk_disable_unprepare(dpi->tvd_clk); - clk_disable_unprepare(dpi->engine_clk); - } - -@@ -487,6 +488,12 @@ static int mtk_dpi_power_on(struct mtk_dpi *dpi) - goto err_refcount; - } - -+ ret = clk_prepare_enable(dpi->tvd_clk); -+ if (ret) { -+ dev_err(dpi->dev, "Failed to enable tvd pll: %d\n", ret); -+ goto err_engine; -+ } -+ - ret = clk_prepare_enable(dpi->pixel_clk); - if (ret) { - dev_err(dpi->dev, "Failed to enable pixel clock: %d\n", ret); -@@ -496,6 +503,8 @@ static int mtk_dpi_power_on(struct mtk_dpi *dpi) - return 0; - - err_pixel: -+ clk_disable_unprepare(dpi->tvd_clk); -+err_engine: - clk_disable_unprepare(dpi->engine_clk); - err_refcount: - dpi->refcount--; -@@ -610,9 +619,9 @@ static int mtk_dpi_set_display_mode(struct mtk_dpi *dpi, - mtk_dpi_dual_edge(dpi); - mtk_dpi_config_disable_edge(dpi); - } -- if (dpi->conf->input_2pixel) { -- mtk_dpi_mask(dpi, DPI_CON, DPINTF_INPUT_2P_EN, -- DPINTF_INPUT_2P_EN); -+ if (dpi->conf->input_2p_en_bit) { -+ mtk_dpi_mask(dpi, DPI_CON, dpi->conf->input_2p_en_bit, -+ dpi->conf->input_2p_en_bit); - } - mtk_dpi_sw_reset(dpi, false); - -@@ -980,12 +989,12 @@ static const struct mtk_dpi_conf mt8195_dpintf_conf = { - .output_fmts = mt8195_output_fmts, - .num_output_fmts = ARRAY_SIZE(mt8195_output_fmts), - .pixels_per_iter = 4, -- .input_2pixel = true, - .dimension_mask = DPINTF_HPW_MASK, - .hvsize_mask = DPINTF_HSIZE_MASK, - .channel_swap_shift = DPINTF_CH_SWAP, - .yuv422_en_bit = DPINTF_YUV422_EN, - .csc_enable_bit = DPINTF_CSC_ENABLE, -+ .input_2p_en_bit = DPINTF_INPUT_2P_EN, - }; - - static int mtk_dpi_probe(struct platform_device *pdev) -diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c -index 9009442b543dda..e7136b7759cb33 100644 ---- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c -+++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c -@@ -1042,49 +1042,50 @@ static void a6xx_gmu_shutdown(struct a6xx_gmu *gmu) - struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu); - struct adreno_gpu *adreno_gpu = &a6xx_gpu->base; - u32 val; -+ int ret; - - /* -- * The GMU may still be in slumber unless the GPU started so check and -- * skip putting it back into slumber if so -+ * GMU firmware's internal power state gets messed up if we send "prepare_slumber" hfi when -+ * oob_gpu handshake wasn't done after the last wake up. So do a dummy handshake here when -+ * required - */ -- val = gmu_read(gmu, REG_A6XX_GPU_GMU_CX_GMU_RPMH_POWER_STATE); -+ if (adreno_gpu->base.needs_hw_init) { -+ if (a6xx_gmu_set_oob(&a6xx_gpu->gmu, GMU_OOB_GPU_SET)) -+ goto force_off; - -- if (val != 0xf) { -- int ret = a6xx_gmu_wait_for_idle(gmu); -+ a6xx_gmu_clear_oob(&a6xx_gpu->gmu, GMU_OOB_GPU_SET); -+ } - -- /* If the GMU isn't responding assume it is hung */ -- if (ret) { -- a6xx_gmu_force_off(gmu); -- return; -- } -+ ret = a6xx_gmu_wait_for_idle(gmu); - -- a6xx_bus_clear_pending_transactions(adreno_gpu, a6xx_gpu->hung); -+ /* If the GMU isn't responding assume it is hung */ -+ if (ret) -+ goto force_off; - -- /* tell the GMU we want to slumber */ -- ret = a6xx_gmu_notify_slumber(gmu); -- if (ret) { -- a6xx_gmu_force_off(gmu); -- return; -- } -+ a6xx_bus_clear_pending_transactions(adreno_gpu, a6xx_gpu->hung); - -- ret = gmu_poll_timeout(gmu, -- REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS, val, -- !(val & A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS_GPUBUSYIGNAHB), -- 100, 10000); -+ /* tell the GMU we want to slumber */ -+ ret = a6xx_gmu_notify_slumber(gmu); -+ if (ret) -+ goto force_off; - -- /* -- * Let the user know we failed to slumber but don't worry too -- * much because we are powering down anyway -- */ -+ ret = gmu_poll_timeout(gmu, -+ REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS, val, -+ !(val & A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS_GPUBUSYIGNAHB), -+ 100, 10000); - -- if (ret) -- DRM_DEV_ERROR(gmu->dev, -- "Unable to slumber GMU: status = 0%x/0%x\n", -- gmu_read(gmu, -- REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS), -- gmu_read(gmu, -- REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS2)); -- } -+ /* -+ * Let the user know we failed to slumber but don't worry too -+ * much because we are powering down anyway -+ */ -+ -+ if (ret) -+ DRM_DEV_ERROR(gmu->dev, -+ "Unable to slumber GMU: status = 0%x/0%x\n", -+ gmu_read(gmu, -+ REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS), -+ gmu_read(gmu, -+ REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS2)); - - /* Turn off HFI */ - a6xx_hfi_stop(gmu); -@@ -1094,6 +1095,11 @@ static void a6xx_gmu_shutdown(struct a6xx_gmu *gmu) - - /* Tell RPMh to power off the GPU */ - a6xx_rpmh_stop(gmu); -+ -+ return; -+ -+force_off: -+ a6xx_gmu_force_off(gmu); - } - - -diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c -index 5d398a422459e1..036ee034397283 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_bo.c -+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c -@@ -144,6 +144,9 @@ nouveau_bo_del_ttm(struct ttm_buffer_object *bo) - nouveau_bo_del_io_reserve_lru(bo); - nv10_bo_put_tile_region(dev, nvbo->tile, NULL); - -+ if (bo->base.import_attach) -+ drm_prime_gem_destroy(&bo->base, bo->sg); -+ - /* - * If nouveau_bo_new() allocated this buffer, the GEM object was never - * initialized, so don't attempt to release it. -diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c -index 7b69e6df57486a..cd97df6903352c 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_gem.c -+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c -@@ -87,9 +87,6 @@ nouveau_gem_object_del(struct drm_gem_object *gem) - return; - } - -- if (gem->import_attach) -- drm_prime_gem_destroy(gem, nvbo->bo.sg); -- - ttm_bo_put(&nvbo->bo); - - pm_runtime_mark_last_busy(dev); -diff --git a/drivers/gpu/drm/sti/Makefile b/drivers/gpu/drm/sti/Makefile -index f203ac5514ae0b..f778a4eee7c9cf 100644 ---- a/drivers/gpu/drm/sti/Makefile -+++ b/drivers/gpu/drm/sti/Makefile -@@ -7,8 +7,6 @@ sti-drm-y := \ - sti_compositor.o \ - sti_crtc.o \ - sti_plane.o \ -- sti_crtc.o \ -- sti_plane.o \ - sti_hdmi.o \ - sti_hdmi_tx3g4c28phy.o \ - sti_dvo.o \ -diff --git a/drivers/gpu/drm/tests/drm_client_modeset_test.c b/drivers/gpu/drm/tests/drm_client_modeset_test.c -index 7516f6cb36e4e3..3e9518d7b8b7eb 100644 ---- a/drivers/gpu/drm/tests/drm_client_modeset_test.c -+++ b/drivers/gpu/drm/tests/drm_client_modeset_test.c -@@ -95,6 +95,9 @@ static void drm_test_pick_cmdline_res_1920_1080_60(struct kunit *test) - expected_mode = drm_mode_find_dmt(priv->drm, 1920, 1080, 60, false); - KUNIT_ASSERT_NOT_NULL(test, expected_mode); - -+ ret = drm_kunit_add_mode_destroy_action(test, expected_mode); -+ KUNIT_ASSERT_EQ(test, ret, 0); -+ - KUNIT_ASSERT_TRUE(test, - drm_mode_parse_command_line_for_connector(cmdline, - connector, -diff --git a/drivers/gpu/drm/tests/drm_cmdline_parser_test.c b/drivers/gpu/drm/tests/drm_cmdline_parser_test.c -index 88f7f518ffb3bc..05dd5cc3b604b3 100644 ---- a/drivers/gpu/drm/tests/drm_cmdline_parser_test.c -+++ b/drivers/gpu/drm/tests/drm_cmdline_parser_test.c -@@ -7,6 +7,7 @@ - #include - - #include -+#include - #include - - static const struct drm_connector no_connector = {}; -@@ -955,8 +956,15 @@ struct drm_cmdline_tv_option_test { - static void drm_test_cmdline_tv_options(struct kunit *test) - { - const struct drm_cmdline_tv_option_test *params = test->param_value; -- const struct drm_display_mode *expected_mode = params->mode_fn(NULL); -+ struct drm_display_mode *expected_mode; - struct drm_cmdline_mode mode = { }; -+ int ret; -+ -+ expected_mode = params->mode_fn(NULL); -+ KUNIT_ASSERT_NOT_NULL(test, expected_mode); -+ -+ ret = drm_kunit_add_mode_destroy_action(test, expected_mode); -+ KUNIT_ASSERT_EQ(test, ret, 0); - - KUNIT_EXPECT_TRUE(test, drm_mode_parse_command_line_for_connector(params->cmdline, - &no_connector, &mode)); -diff --git a/drivers/gpu/drm/tests/drm_kunit_helpers.c b/drivers/gpu/drm/tests/drm_kunit_helpers.c -index bccb33b900f390..04d98f81c52277 100644 ---- a/drivers/gpu/drm/tests/drm_kunit_helpers.c -+++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c -@@ -1,7 +1,10 @@ - // SPDX-License-Identifier: GPL-2.0 - - #include -+#include - #include -+#include -+#include - #include - #include - -@@ -13,6 +16,8 @@ - #define KUNIT_DEVICE_NAME "drm-kunit-mock-device" - - static const struct drm_mode_config_funcs drm_mode_config_funcs = { -+ .atomic_check = drm_atomic_helper_check, -+ .atomic_commit = drm_atomic_helper_commit, - }; - - static int fake_probe(struct platform_device *pdev) -@@ -233,5 +238,213 @@ drm_kunit_helper_atomic_state_alloc(struct kunit *test, - } - EXPORT_SYMBOL_GPL(drm_kunit_helper_atomic_state_alloc); - -+static const uint32_t default_plane_formats[] = { -+ DRM_FORMAT_XRGB8888, -+}; -+ -+static const uint64_t default_plane_modifiers[] = { -+ DRM_FORMAT_MOD_LINEAR, -+ DRM_FORMAT_MOD_INVALID -+}; -+ -+static const struct drm_plane_helper_funcs default_plane_helper_funcs = { -+}; -+ -+static const struct drm_plane_funcs default_plane_funcs = { -+ .atomic_destroy_state = drm_atomic_helper_plane_destroy_state, -+ .atomic_duplicate_state = drm_atomic_helper_plane_duplicate_state, -+ .reset = drm_atomic_helper_plane_reset, -+}; -+ -+/** -+ * drm_kunit_helper_create_primary_plane - Creates a mock primary plane for a KUnit test -+ * @test: The test context object -+ * @drm: The device to alloc the plane for -+ * @funcs: Callbacks for the new plane. Optional. -+ * @helper_funcs: Helpers callbacks for the new plane. Optional. -+ * @formats: array of supported formats (DRM_FORMAT\_\*). Optional. -+ * @num_formats: number of elements in @formats -+ * @modifiers: array of struct drm_format modifiers terminated by -+ * DRM_FORMAT_MOD_INVALID. Optional. -+ * -+ * This allocates and initializes a mock struct &drm_plane meant to be -+ * part of a mock device for a KUnit test. -+ * -+ * Resources will be cleaned up automatically. -+ * -+ * @funcs will default to the default helpers implementations. -+ * @helper_funcs will default to an empty implementation. @formats will -+ * default to XRGB8888 only. @modifiers will default to a linear -+ * modifier only. -+ * -+ * Returns: -+ * A pointer to the new plane, or an ERR_PTR() otherwise. -+ */ -+struct drm_plane * -+drm_kunit_helper_create_primary_plane(struct kunit *test, -+ struct drm_device *drm, -+ const struct drm_plane_funcs *funcs, -+ const struct drm_plane_helper_funcs *helper_funcs, -+ const uint32_t *formats, -+ unsigned int num_formats, -+ const uint64_t *modifiers) -+{ -+ struct drm_plane *plane; -+ -+ if (!funcs) -+ funcs = &default_plane_funcs; -+ -+ if (!helper_funcs) -+ helper_funcs = &default_plane_helper_funcs; -+ -+ if (!formats || !num_formats) { -+ formats = default_plane_formats; -+ num_formats = ARRAY_SIZE(default_plane_formats); -+ } -+ -+ if (!modifiers) -+ modifiers = default_plane_modifiers; -+ -+ plane = __drmm_universal_plane_alloc(drm, -+ sizeof(struct drm_plane), 0, -+ 0, -+ funcs, -+ formats, -+ num_formats, -+ default_plane_modifiers, -+ DRM_PLANE_TYPE_PRIMARY, -+ NULL); -+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, plane); -+ -+ drm_plane_helper_add(plane, helper_funcs); -+ -+ return plane; -+} -+EXPORT_SYMBOL_GPL(drm_kunit_helper_create_primary_plane); -+ -+static const struct drm_crtc_helper_funcs default_crtc_helper_funcs = { -+}; -+ -+static const struct drm_crtc_funcs default_crtc_funcs = { -+ .atomic_destroy_state = drm_atomic_helper_crtc_destroy_state, -+ .atomic_duplicate_state = drm_atomic_helper_crtc_duplicate_state, -+ .reset = drm_atomic_helper_crtc_reset, -+}; -+ -+/** -+ * drm_kunit_helper_create_crtc - Creates a mock CRTC for a KUnit test -+ * @test: The test context object -+ * @drm: The device to alloc the plane for -+ * @primary: Primary plane for CRTC -+ * @cursor: Cursor plane for CRTC. Optional. -+ * @funcs: Callbacks for the new plane. Optional. -+ * @helper_funcs: Helpers callbacks for the new plane. Optional. -+ * -+ * This allocates and initializes a mock struct &drm_crtc meant to be -+ * part of a mock device for a KUnit test. -+ * -+ * Resources will be cleaned up automatically. -+ * -+ * @funcs will default to the default helpers implementations. -+ * @helper_funcs will default to an empty implementation. -+ * -+ * Returns: -+ * A pointer to the new CRTC, or an ERR_PTR() otherwise. -+ */ -+struct drm_crtc * -+drm_kunit_helper_create_crtc(struct kunit *test, -+ struct drm_device *drm, -+ struct drm_plane *primary, -+ struct drm_plane *cursor, -+ const struct drm_crtc_funcs *funcs, -+ const struct drm_crtc_helper_funcs *helper_funcs) -+{ -+ struct drm_crtc *crtc; -+ int ret; -+ -+ if (!funcs) -+ funcs = &default_crtc_funcs; -+ -+ if (!helper_funcs) -+ helper_funcs = &default_crtc_helper_funcs; -+ -+ crtc = drmm_kzalloc(drm, sizeof(*crtc), GFP_KERNEL); -+ KUNIT_ASSERT_NOT_NULL(test, crtc); -+ -+ ret = drmm_crtc_init_with_planes(drm, crtc, -+ primary, -+ cursor, -+ funcs, -+ NULL); -+ KUNIT_ASSERT_EQ(test, ret, 0); -+ -+ drm_crtc_helper_add(crtc, helper_funcs); -+ -+ return crtc; -+} -+EXPORT_SYMBOL_GPL(drm_kunit_helper_create_crtc); -+ -+static void kunit_action_drm_mode_destroy(void *ptr) -+{ -+ struct drm_display_mode *mode = ptr; -+ -+ drm_mode_destroy(NULL, mode); -+} -+ -+/** -+ * drm_kunit_add_mode_destroy_action() - Add a drm_destroy_mode kunit action -+ * @test: The test context object -+ * @mode: The drm_display_mode to destroy eventually -+ * -+ * Registers a kunit action that will destroy the drm_display_mode at -+ * the end of the test. -+ * -+ * If an error occurs, the drm_display_mode will be destroyed. -+ * -+ * Returns: -+ * 0 on success, an error code otherwise. -+ */ -+int drm_kunit_add_mode_destroy_action(struct kunit *test, -+ struct drm_display_mode *mode) -+{ -+ return kunit_add_action_or_reset(test, -+ kunit_action_drm_mode_destroy, -+ mode); -+} -+EXPORT_SYMBOL_GPL(drm_kunit_add_mode_destroy_action); -+ -+/** -+ * drm_kunit_display_mode_from_cea_vic() - return a mode for CEA VIC for a KUnit test -+ * @test: The test context object -+ * @dev: DRM device -+ * @video_code: CEA VIC of the mode -+ * -+ * Creates a new mode matching the specified CEA VIC for a KUnit test. -+ * -+ * Resources will be cleaned up automatically. -+ * -+ * Returns: A new drm_display_mode on success or NULL on failure -+ */ -+struct drm_display_mode * -+drm_kunit_display_mode_from_cea_vic(struct kunit *test, struct drm_device *dev, -+ u8 video_code) -+{ -+ struct drm_display_mode *mode; -+ int ret; -+ -+ mode = drm_display_mode_from_cea_vic(dev, video_code); -+ if (!mode) -+ return NULL; -+ -+ ret = kunit_add_action_or_reset(test, -+ kunit_action_drm_mode_destroy, -+ mode); -+ if (ret) -+ return NULL; -+ -+ return mode; -+} -+EXPORT_SYMBOL_GPL(drm_kunit_display_mode_from_cea_vic); -+ - MODULE_AUTHOR("Maxime Ripard "); - MODULE_LICENSE("GPL"); -diff --git a/drivers/gpu/drm/tests/drm_modes_test.c b/drivers/gpu/drm/tests/drm_modes_test.c -index 1e9f63fbfead35..e23067252d18a7 100644 ---- a/drivers/gpu/drm/tests/drm_modes_test.c -+++ b/drivers/gpu/drm/tests/drm_modes_test.c -@@ -40,6 +40,7 @@ static void drm_test_modes_analog_tv_ntsc_480i(struct kunit *test) - { - struct drm_test_modes_priv *priv = test->priv; - struct drm_display_mode *mode; -+ int ret; - - mode = drm_analog_tv_mode(priv->drm, - DRM_MODE_TV_MODE_NTSC, -@@ -47,6 +48,9 @@ static void drm_test_modes_analog_tv_ntsc_480i(struct kunit *test) - true); - KUNIT_ASSERT_NOT_NULL(test, mode); - -+ ret = drm_kunit_add_mode_destroy_action(test, mode); -+ KUNIT_ASSERT_EQ(test, ret, 0); -+ - KUNIT_EXPECT_EQ(test, drm_mode_vrefresh(mode), 60); - KUNIT_EXPECT_EQ(test, mode->hdisplay, 720); - -@@ -70,6 +74,7 @@ static void drm_test_modes_analog_tv_ntsc_480i_inlined(struct kunit *test) - { - struct drm_test_modes_priv *priv = test->priv; - struct drm_display_mode *expected, *mode; -+ int ret; - - expected = drm_analog_tv_mode(priv->drm, - DRM_MODE_TV_MODE_NTSC, -@@ -77,9 +82,15 @@ static void drm_test_modes_analog_tv_ntsc_480i_inlined(struct kunit *test) - true); - KUNIT_ASSERT_NOT_NULL(test, expected); - -+ ret = drm_kunit_add_mode_destroy_action(test, expected); -+ KUNIT_ASSERT_EQ(test, ret, 0); -+ - mode = drm_mode_analog_ntsc_480i(priv->drm); - KUNIT_ASSERT_NOT_NULL(test, mode); - -+ ret = drm_kunit_add_mode_destroy_action(test, mode); -+ KUNIT_ASSERT_EQ(test, ret, 0); -+ - KUNIT_EXPECT_TRUE(test, drm_mode_equal(expected, mode)); - } - -@@ -87,6 +98,7 @@ static void drm_test_modes_analog_tv_pal_576i(struct kunit *test) - { - struct drm_test_modes_priv *priv = test->priv; - struct drm_display_mode *mode; -+ int ret; - - mode = drm_analog_tv_mode(priv->drm, - DRM_MODE_TV_MODE_PAL, -@@ -94,6 +106,9 @@ static void drm_test_modes_analog_tv_pal_576i(struct kunit *test) - true); - KUNIT_ASSERT_NOT_NULL(test, mode); - -+ ret = drm_kunit_add_mode_destroy_action(test, mode); -+ KUNIT_ASSERT_EQ(test, ret, 0); -+ - KUNIT_EXPECT_EQ(test, drm_mode_vrefresh(mode), 50); - KUNIT_EXPECT_EQ(test, mode->hdisplay, 720); - -@@ -117,6 +132,7 @@ static void drm_test_modes_analog_tv_pal_576i_inlined(struct kunit *test) - { - struct drm_test_modes_priv *priv = test->priv; - struct drm_display_mode *expected, *mode; -+ int ret; - - expected = drm_analog_tv_mode(priv->drm, - DRM_MODE_TV_MODE_PAL, -@@ -124,9 +140,15 @@ static void drm_test_modes_analog_tv_pal_576i_inlined(struct kunit *test) - true); - KUNIT_ASSERT_NOT_NULL(test, expected); - -+ ret = drm_kunit_add_mode_destroy_action(test, expected); -+ KUNIT_ASSERT_EQ(test, ret, 0); -+ - mode = drm_mode_analog_pal_576i(priv->drm); - KUNIT_ASSERT_NOT_NULL(test, mode); - -+ ret = drm_kunit_add_mode_destroy_action(test, mode); -+ KUNIT_ASSERT_EQ(test, ret, 0); -+ - KUNIT_EXPECT_TRUE(test, drm_mode_equal(expected, mode)); - } - -diff --git a/drivers/gpu/drm/tests/drm_probe_helper_test.c b/drivers/gpu/drm/tests/drm_probe_helper_test.c -index 1a2044070a6cb8..2a7984431d47b4 100644 ---- a/drivers/gpu/drm/tests/drm_probe_helper_test.c -+++ b/drivers/gpu/drm/tests/drm_probe_helper_test.c -@@ -98,7 +98,7 @@ drm_test_connector_helper_tv_get_modes_check(struct kunit *test) - struct drm_connector *connector = &priv->connector; - struct drm_cmdline_mode *cmdline = &connector->cmdline_mode; - struct drm_display_mode *mode; -- const struct drm_display_mode *expected; -+ struct drm_display_mode *expected; - size_t len; - int ret; - -@@ -134,6 +134,9 @@ drm_test_connector_helper_tv_get_modes_check(struct kunit *test) - - KUNIT_EXPECT_TRUE(test, drm_mode_equal(mode, expected)); - KUNIT_EXPECT_TRUE(test, mode->type & DRM_MODE_TYPE_PREFERRED); -+ -+ ret = drm_kunit_add_mode_destroy_action(test, expected); -+ KUNIT_ASSERT_EQ(test, ret, 0); - } - - if (params->num_expected_modes >= 2) { -@@ -145,6 +148,9 @@ drm_test_connector_helper_tv_get_modes_check(struct kunit *test) - - KUNIT_EXPECT_TRUE(test, drm_mode_equal(mode, expected)); - KUNIT_EXPECT_FALSE(test, mode->type & DRM_MODE_TYPE_PREFERRED); -+ -+ ret = drm_kunit_add_mode_destroy_action(test, expected); -+ KUNIT_ASSERT_EQ(test, ret, 0); - } - - mutex_unlock(&priv->drm->mode_config.mutex); -diff --git a/drivers/gpu/drm/tiny/repaper.c b/drivers/gpu/drm/tiny/repaper.c -index 13ae148f59b9b5..7796ca579cbd99 100644 ---- a/drivers/gpu/drm/tiny/repaper.c -+++ b/drivers/gpu/drm/tiny/repaper.c -@@ -455,7 +455,7 @@ static void repaper_frame_fixed_repeat(struct repaper_epd *epd, u8 fixed_value, - enum repaper_stage stage) - { - u64 start = local_clock(); -- u64 end = start + (epd->factored_stage_time * 1000 * 1000); -+ u64 end = start + ((u64)epd->factored_stage_time * 1000 * 1000); - - do { - repaper_frame_fixed(epd, fixed_value, stage); -@@ -466,7 +466,7 @@ static void repaper_frame_data_repeat(struct repaper_epd *epd, const u8 *image, - const u8 *mask, enum repaper_stage stage) - { - u64 start = local_clock(); -- u64 end = start + (epd->factored_stage_time * 1000 * 1000); -+ u64 end = start + ((u64)epd->factored_stage_time * 1000 * 1000); - - do { - repaper_frame_data(epd, image, mask, stage); -diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig -index 979ebe69c8e303..ffbeb39341e1a4 100644 ---- a/drivers/hid/Kconfig -+++ b/drivers/hid/Kconfig -@@ -1202,6 +1202,20 @@ config HID_U2FZERO - allow setting the brightness to anything but 1, which will - trigger a single blink and immediately reset back to 0. - -+config HID_UNIVERSAL_PIDFF -+ tristate "universal-pidff: extended USB PID driver compatibility and usage" -+ depends on USB_HID -+ depends on HID_PID -+ help -+ Extended PID support for selected devices. -+ -+ Contains report fixups, extended usable button range and -+ pidff quirk management to extend compatibility with slightly -+ non-compliant USB PID devices and better fuzz/flat values for -+ high precision direct drive devices. -+ -+ Supports Moza Racing, Cammus, VRS, FFBeast and more. -+ - config HID_WACOM - tristate "Wacom Intuos/Graphire tablet support (USB)" - depends on USB_HID -diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile -index f5a06b62b385db..dcb81891c725a9 100644 ---- a/drivers/hid/Makefile -+++ b/drivers/hid/Makefile -@@ -138,6 +138,7 @@ hid-uclogic-objs := hid-uclogic-core.o \ - hid-uclogic-params.o - obj-$(CONFIG_HID_UCLOGIC) += hid-uclogic.o - obj-$(CONFIG_HID_UDRAW_PS3) += hid-udraw-ps3.o -+obj-$(CONFIG_HID_UNIVERSAL_PIDFF) += hid-universal-pidff.o - obj-$(CONFIG_HID_LED) += hid-led.o - obj-$(CONFIG_HID_XIAOMI) += hid-xiaomi.o - obj-$(CONFIG_HID_XINMO) += hid-xinmo.o -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index 09090803f1dd2a..8e721ec3faaff3 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -262,6 +262,10 @@ - #define USB_DEVICE_ID_BTC_EMPREX_REMOTE 0x5578 - #define USB_DEVICE_ID_BTC_EMPREX_REMOTE_2 0x5577 - -+#define USB_VENDOR_ID_CAMMUS 0x3416 -+#define USB_DEVICE_ID_CAMMUS_C5 0x0301 -+#define USB_DEVICE_ID_CAMMUS_C12 0x0302 -+ - #define USB_VENDOR_ID_CANDO 0x2087 - #define USB_DEVICE_ID_CANDO_PIXCIR_MULTI_TOUCH 0x0703 - #define USB_DEVICE_ID_CANDO_MULTI_TOUCH 0x0a01 -@@ -453,6 +457,11 @@ - #define USB_VENDOR_ID_EVISION 0x320f - #define USB_DEVICE_ID_EVISION_ICL01 0x5041 - -+#define USB_VENDOR_ID_FFBEAST 0x045b -+#define USB_DEVICE_ID_FFBEAST_JOYSTICK 0x58f9 -+#define USB_DEVICE_ID_FFBEAST_RUDDER 0x5968 -+#define USB_DEVICE_ID_FFBEAST_WHEEL 0x59d7 -+ - #define USB_VENDOR_ID_FLATFROG 0x25b5 - #define USB_DEVICE_ID_MULTITOUCH_3200 0x0002 - -@@ -812,6 +821,13 @@ - #define I2C_DEVICE_ID_LG_8001 0x8001 - #define I2C_DEVICE_ID_LG_7010 0x7010 - -+#define USB_VENDOR_ID_LITE_STAR 0x11ff -+#define USB_DEVICE_ID_PXN_V10 0x3245 -+#define USB_DEVICE_ID_PXN_V12 0x1212 -+#define USB_DEVICE_ID_PXN_V12_LITE 0x1112 -+#define USB_DEVICE_ID_PXN_V12_LITE_2 0x1211 -+#define USB_DEVICE_LITE_STAR_GT987_FF 0x2141 -+ - #define USB_VENDOR_ID_LOGITECH 0x046d - #define USB_DEVICE_ID_LOGITECH_Z_10_SPK 0x0a07 - #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e -@@ -959,6 +975,18 @@ - #define USB_VENDOR_ID_MONTEREY 0x0566 - #define USB_DEVICE_ID_GENIUS_KB29E 0x3004 - -+#define USB_VENDOR_ID_MOZA 0x346e -+#define USB_DEVICE_ID_MOZA_R3 0x0005 -+#define USB_DEVICE_ID_MOZA_R3_2 0x0015 -+#define USB_DEVICE_ID_MOZA_R5 0x0004 -+#define USB_DEVICE_ID_MOZA_R5_2 0x0014 -+#define USB_DEVICE_ID_MOZA_R9 0x0002 -+#define USB_DEVICE_ID_MOZA_R9_2 0x0012 -+#define USB_DEVICE_ID_MOZA_R12 0x0006 -+#define USB_DEVICE_ID_MOZA_R12_2 0x0016 -+#define USB_DEVICE_ID_MOZA_R16_R21 0x0000 -+#define USB_DEVICE_ID_MOZA_R16_R21_2 0x0010 -+ - #define USB_VENDOR_ID_MSI 0x1770 - #define USB_DEVICE_ID_MSI_GT683R_LED_PANEL 0xff00 - -@@ -1360,6 +1388,9 @@ - #define USB_DEVICE_ID_VELLEMAN_K8061_FIRST 0x8061 - #define USB_DEVICE_ID_VELLEMAN_K8061_LAST 0x8068 - -+#define USB_VENDOR_ID_VRS 0x0483 -+#define USB_DEVICE_ID_VRS_DFP 0xa355 -+ - #define USB_VENDOR_ID_VTL 0x0306 - #define USB_DEVICE_ID_VTL_MULTITOUCH_FF3F 0xff3f - -diff --git a/drivers/hid/hid-universal-pidff.c b/drivers/hid/hid-universal-pidff.c -new file mode 100644 -index 00000000000000..7ef5ab9146b1cf ---- /dev/null -+++ b/drivers/hid/hid-universal-pidff.c -@@ -0,0 +1,197 @@ -+// SPDX-License-Identifier: GPL-2.0-or-later -+/* -+ * HID UNIVERSAL PIDFF -+ * hid-pidff wrapper for PID-enabled devices -+ * Handles device reports, quirks and extends usable button range -+ * -+ * Copyright (c) 2024, 2025 Makarenko Oleg -+ * Copyright (c) 2024, 2025 Tomasz Pakuła -+ */ -+ -+#include -+#include -+#include -+#include -+#include "hid-ids.h" -+ -+#define JOY_RANGE (BTN_DEAD - BTN_JOYSTICK + 1) -+ -+/* -+ * Map buttons manually to extend the default joystick button limit -+ */ -+static int universal_pidff_input_mapping(struct hid_device *hdev, -+ struct hid_input *hi, struct hid_field *field, struct hid_usage *usage, -+ unsigned long **bit, int *max) -+{ -+ if ((usage->hid & HID_USAGE_PAGE) != HID_UP_BUTTON) -+ return 0; -+ -+ if (field->application != HID_GD_JOYSTICK) -+ return 0; -+ -+ int button = ((usage->hid - 1) & HID_USAGE); -+ int code = button + BTN_JOYSTICK; -+ -+ /* Detect the end of JOYSTICK buttons range */ -+ if (code > BTN_DEAD) -+ code = button + KEY_NEXT_FAVORITE - JOY_RANGE; -+ -+ /* -+ * Map overflowing buttons to KEY_RESERVED to not ignore -+ * them and let them still trigger MSC_SCAN -+ */ -+ if (code > KEY_MAX) -+ code = KEY_RESERVED; -+ -+ hid_map_usage(hi, usage, bit, max, EV_KEY, code); -+ hid_dbg(hdev, "Button %d: usage %d", button, code); -+ return 1; -+} -+ -+/* -+ * Check if the device is PID and initialize it -+ * Add quirks after initialisation -+ */ -+static int universal_pidff_probe(struct hid_device *hdev, -+ const struct hid_device_id *id) -+{ -+ int i, error; -+ error = hid_parse(hdev); -+ if (error) { -+ hid_err(hdev, "HID parse failed\n"); -+ goto err; -+ } -+ -+ error = hid_hw_start(hdev, HID_CONNECT_DEFAULT & ~HID_CONNECT_FF); -+ if (error) { -+ hid_err(hdev, "HID hw start failed\n"); -+ goto err; -+ } -+ -+ /* Check if device contains PID usage page */ -+ error = 1; -+ for (i = 0; i < hdev->collection_size; i++) -+ if ((hdev->collection[i].usage & HID_USAGE_PAGE) == HID_UP_PID) { -+ error = 0; -+ hid_dbg(hdev, "PID usage page found\n"); -+ break; -+ } -+ -+ /* -+ * Do not fail as this might be the second "device" -+ * just for additional buttons/axes. Exit cleanly if force -+ * feedback usage page wasn't found (included devices were -+ * tested and confirmed to be USB PID after all). -+ */ -+ if (error) { -+ hid_dbg(hdev, "PID usage page not found in the descriptor\n"); -+ return 0; -+ } -+ -+ /* Check if HID_PID support is enabled */ -+ int (*init_function)(struct hid_device *, __u32); -+ init_function = hid_pidff_init_with_quirks; -+ -+ if (!init_function) { -+ hid_warn(hdev, "HID_PID support not enabled!\n"); -+ return 0; -+ } -+ -+ error = init_function(hdev, id->driver_data); -+ if (error) { -+ hid_warn(hdev, "Error initialising force feedback\n"); -+ goto err; -+ } -+ -+ hid_info(hdev, "Universal pidff driver loaded sucesfully!"); -+ -+ return 0; -+err: -+ return error; -+} -+ -+static int universal_pidff_input_configured(struct hid_device *hdev, -+ struct hid_input *hidinput) -+{ -+ int axis; -+ struct input_dev *input = hidinput->input; -+ -+ if (!input->absinfo) -+ return 0; -+ -+ /* Decrease fuzz and deadzone on available axes */ -+ for (axis = ABS_X; axis <= ABS_BRAKE; axis++) { -+ if (!test_bit(axis, input->absbit)) -+ continue; -+ -+ input_set_abs_params(input, axis, -+ input->absinfo[axis].minimum, -+ input->absinfo[axis].maximum, -+ axis == ABS_X ? 0 : 8, 0); -+ } -+ -+ /* Remove fuzz and deadzone from the second joystick axis */ -+ if (hdev->vendor == USB_VENDOR_ID_FFBEAST && -+ hdev->product == USB_DEVICE_ID_FFBEAST_JOYSTICK) -+ input_set_abs_params(input, ABS_Y, -+ input->absinfo[ABS_Y].minimum, -+ input->absinfo[ABS_Y].maximum, 0, 0); -+ -+ return 0; -+} -+ -+static const struct hid_device_id universal_pidff_devices[] = { -+ { HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R3), -+ .driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R3_2), -+ .driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R5), -+ .driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R5_2), -+ .driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R9), -+ .driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R9_2), -+ .driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R12), -+ .driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R12_2), -+ .driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R16_R21), -+ .driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R16_R21_2), -+ .driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_CAMMUS, USB_DEVICE_ID_CAMMUS_C5) }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_CAMMUS, USB_DEVICE_ID_CAMMUS_C12) }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_VRS, USB_DEVICE_ID_VRS_DFP), -+ .driver_data = HID_PIDFF_QUIRK_PERMISSIVE_CONTROL }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_FFBEAST, USB_DEVICE_ID_FFBEAST_JOYSTICK), }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_FFBEAST, USB_DEVICE_ID_FFBEAST_RUDDER), }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_FFBEAST, USB_DEVICE_ID_FFBEAST_WHEEL) }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_LITE_STAR, USB_DEVICE_ID_PXN_V10), -+ .driver_data = HID_PIDFF_QUIRK_PERIODIC_SINE_ONLY }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_LITE_STAR, USB_DEVICE_ID_PXN_V12), -+ .driver_data = HID_PIDFF_QUIRK_PERIODIC_SINE_ONLY }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_LITE_STAR, USB_DEVICE_ID_PXN_V12_LITE), -+ .driver_data = HID_PIDFF_QUIRK_PERIODIC_SINE_ONLY }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_LITE_STAR, USB_DEVICE_ID_PXN_V12_LITE_2), -+ .driver_data = HID_PIDFF_QUIRK_PERIODIC_SINE_ONLY }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_LITE_STAR, USB_DEVICE_LITE_STAR_GT987_FF), -+ .driver_data = HID_PIDFF_QUIRK_PERIODIC_SINE_ONLY }, -+ { } -+}; -+MODULE_DEVICE_TABLE(hid, universal_pidff_devices); -+ -+static struct hid_driver universal_pidff = { -+ .name = "hid-universal-pidff", -+ .id_table = universal_pidff_devices, -+ .input_mapping = universal_pidff_input_mapping, -+ .probe = universal_pidff_probe, -+ .input_configured = universal_pidff_input_configured -+}; -+module_hid_driver(universal_pidff); -+ -+MODULE_DESCRIPTION("Universal driver for USB PID Force Feedback devices"); -+MODULE_LICENSE("GPL"); -+MODULE_AUTHOR("Makarenko Oleg "); -+MODULE_AUTHOR("Tomasz Pakuła "); -diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c -index 3b4ee21cd81119..25dbed076f5304 100644 ---- a/drivers/hid/usbhid/hid-pidff.c -+++ b/drivers/hid/usbhid/hid-pidff.c -@@ -21,6 +21,7 @@ - #include "usbhid.h" - - #define PID_EFFECTS_MAX 64 -+#define PID_INFINITE 0xffff - - /* Report usage table used to put reports into an array */ - -@@ -136,6 +137,9 @@ static const u8 pidff_block_load_status[] = { 0x8c, 0x8d }; - #define PID_EFFECT_STOP 1 - static const u8 pidff_effect_operation_status[] = { 0x79, 0x7b }; - -+/* Polar direction 90 degrees (North) */ -+#define PIDFF_FIXED_WHEEL_DIRECTION 0x4000 -+ - struct pidff_usage { - struct hid_field *field; - s32 *value; -@@ -184,6 +188,8 @@ struct pidff_device { - int operation_id[sizeof(pidff_effect_operation_status)]; - - int pid_id[PID_EFFECTS_MAX]; -+ -+ u32 quirks; - }; - - /* -@@ -261,10 +267,22 @@ static void pidff_set_envelope_report(struct pidff_device *pidff, - static int pidff_needs_set_envelope(struct ff_envelope *envelope, - struct ff_envelope *old) - { -- return envelope->attack_level != old->attack_level || -- envelope->fade_level != old->fade_level || -+ bool needs_new_envelope; -+ needs_new_envelope = envelope->attack_level != 0 || -+ envelope->fade_level != 0 || -+ envelope->attack_length != 0 || -+ envelope->fade_length != 0; -+ -+ if (!needs_new_envelope) -+ return false; -+ -+ if (!old) -+ return needs_new_envelope; -+ -+ return envelope->attack_level != old->attack_level || -+ envelope->fade_level != old->fade_level || - envelope->attack_length != old->attack_length || -- envelope->fade_length != old->fade_length; -+ envelope->fade_length != old->fade_length; - } - - /* -@@ -301,17 +319,28 @@ static void pidff_set_effect_report(struct pidff_device *pidff, - pidff->block_load[PID_EFFECT_BLOCK_INDEX].value[0]; - pidff->set_effect_type->value[0] = - pidff->create_new_effect_type->value[0]; -- pidff->set_effect[PID_DURATION].value[0] = effect->replay.length; -+ -+ /* Convert infinite length from Linux API (0) -+ to PID standard (NULL) if needed */ -+ pidff->set_effect[PID_DURATION].value[0] = -+ effect->replay.length == 0 ? PID_INFINITE : effect->replay.length; -+ - pidff->set_effect[PID_TRIGGER_BUTTON].value[0] = effect->trigger.button; - pidff->set_effect[PID_TRIGGER_REPEAT_INT].value[0] = - effect->trigger.interval; - pidff->set_effect[PID_GAIN].value[0] = - pidff->set_effect[PID_GAIN].field->logical_maximum; - pidff->set_effect[PID_DIRECTION_ENABLE].value[0] = 1; -- pidff->effect_direction->value[0] = -- pidff_rescale(effect->direction, 0xffff, -- pidff->effect_direction); -- pidff->set_effect[PID_START_DELAY].value[0] = effect->replay.delay; -+ -+ /* Use fixed direction if needed */ -+ pidff->effect_direction->value[0] = pidff_rescale( -+ pidff->quirks & HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION ? -+ PIDFF_FIXED_WHEEL_DIRECTION : effect->direction, -+ 0xffff, pidff->effect_direction); -+ -+ /* Omit setting delay field if it's missing */ -+ if (!(pidff->quirks & HID_PIDFF_QUIRK_MISSING_DELAY)) -+ pidff->set_effect[PID_START_DELAY].value[0] = effect->replay.delay; - - hid_hw_request(pidff->hid, pidff->reports[PID_SET_EFFECT], - HID_REQ_SET_REPORT); -@@ -368,13 +397,19 @@ static int pidff_needs_set_periodic(struct ff_effect *effect, - static void pidff_set_condition_report(struct pidff_device *pidff, - struct ff_effect *effect) - { -- int i; -+ int i, max_axis; -+ -+ /* Devices missing Parameter Block Offset can only have one axis */ -+ max_axis = pidff->quirks & HID_PIDFF_QUIRK_MISSING_PBO ? 1 : 2; - - pidff->set_condition[PID_EFFECT_BLOCK_INDEX].value[0] = - pidff->block_load[PID_EFFECT_BLOCK_INDEX].value[0]; - -- for (i = 0; i < 2; i++) { -- pidff->set_condition[PID_PARAM_BLOCK_OFFSET].value[0] = i; -+ for (i = 0; i < max_axis; i++) { -+ /* Omit Parameter Block Offset if missing */ -+ if (!(pidff->quirks & HID_PIDFF_QUIRK_MISSING_PBO)) -+ pidff->set_condition[PID_PARAM_BLOCK_OFFSET].value[0] = i; -+ - pidff_set_signed(&pidff->set_condition[PID_CP_OFFSET], - effect->u.condition[i].center); - pidff_set_signed(&pidff->set_condition[PID_POS_COEFFICIENT], -@@ -574,11 +609,9 @@ static int pidff_upload_effect(struct input_dev *dev, struct ff_effect *effect, - pidff_set_effect_report(pidff, effect); - if (!old || pidff_needs_set_constant(effect, old)) - pidff_set_constant_force_report(pidff, effect); -- if (!old || -- pidff_needs_set_envelope(&effect->u.constant.envelope, -- &old->u.constant.envelope)) -- pidff_set_envelope_report(pidff, -- &effect->u.constant.envelope); -+ if (pidff_needs_set_envelope(&effect->u.constant.envelope, -+ old ? &old->u.constant.envelope : NULL)) -+ pidff_set_envelope_report(pidff, &effect->u.constant.envelope); - break; - - case FF_PERIODIC: -@@ -604,6 +637,9 @@ static int pidff_upload_effect(struct input_dev *dev, struct ff_effect *effect, - return -EINVAL; - } - -+ if (pidff->quirks & HID_PIDFF_QUIRK_PERIODIC_SINE_ONLY) -+ type_id = PID_SINE; -+ - error = pidff_request_effect_upload(pidff, - pidff->type_id[type_id]); - if (error) -@@ -613,11 +649,9 @@ static int pidff_upload_effect(struct input_dev *dev, struct ff_effect *effect, - pidff_set_effect_report(pidff, effect); - if (!old || pidff_needs_set_periodic(effect, old)) - pidff_set_periodic_report(pidff, effect); -- if (!old || -- pidff_needs_set_envelope(&effect->u.periodic.envelope, -- &old->u.periodic.envelope)) -- pidff_set_envelope_report(pidff, -- &effect->u.periodic.envelope); -+ if (pidff_needs_set_envelope(&effect->u.periodic.envelope, -+ old ? &old->u.periodic.envelope : NULL)) -+ pidff_set_envelope_report(pidff, &effect->u.periodic.envelope); - break; - - case FF_RAMP: -@@ -631,11 +665,9 @@ static int pidff_upload_effect(struct input_dev *dev, struct ff_effect *effect, - pidff_set_effect_report(pidff, effect); - if (!old || pidff_needs_set_ramp(effect, old)) - pidff_set_ramp_force_report(pidff, effect); -- if (!old || -- pidff_needs_set_envelope(&effect->u.ramp.envelope, -- &old->u.ramp.envelope)) -- pidff_set_envelope_report(pidff, -- &effect->u.ramp.envelope); -+ if (pidff_needs_set_envelope(&effect->u.ramp.envelope, -+ old ? &old->u.ramp.envelope : NULL)) -+ pidff_set_envelope_report(pidff, &effect->u.ramp.envelope); - break; - - case FF_SPRING: -@@ -736,7 +768,10 @@ static void pidff_autocenter(struct pidff_device *pidff, u16 magnitude) - pidff->set_effect[PID_TRIGGER_REPEAT_INT].value[0] = 0; - pidff_set(&pidff->set_effect[PID_GAIN], magnitude); - pidff->set_effect[PID_DIRECTION_ENABLE].value[0] = 1; -- pidff->set_effect[PID_START_DELAY].value[0] = 0; -+ -+ /* Omit setting delay field if it's missing */ -+ if (!(pidff->quirks & HID_PIDFF_QUIRK_MISSING_DELAY)) -+ pidff->set_effect[PID_START_DELAY].value[0] = 0; - - hid_hw_request(pidff->hid, pidff->reports[PID_SET_EFFECT], - HID_REQ_SET_REPORT); -@@ -758,7 +793,13 @@ static void pidff_set_autocenter(struct input_dev *dev, u16 magnitude) - static int pidff_find_fields(struct pidff_usage *usage, const u8 *table, - struct hid_report *report, int count, int strict) - { -+ if (!report) { -+ pr_debug("pidff_find_fields, null report\n"); -+ return -1; -+ } -+ - int i, j, k, found; -+ int return_value = 0; - - for (k = 0; k < count; k++) { - found = 0; -@@ -783,12 +824,22 @@ static int pidff_find_fields(struct pidff_usage *usage, const u8 *table, - if (found) - break; - } -- if (!found && strict) { -+ if (!found && table[k] == pidff_set_effect[PID_START_DELAY]) { -+ pr_debug("Delay field not found, but that's OK\n"); -+ pr_debug("Setting MISSING_DELAY quirk\n"); -+ return_value |= HID_PIDFF_QUIRK_MISSING_DELAY; -+ } -+ else if (!found && table[k] == pidff_set_condition[PID_PARAM_BLOCK_OFFSET]) { -+ pr_debug("PBO field not found, but that's OK\n"); -+ pr_debug("Setting MISSING_PBO quirk\n"); -+ return_value |= HID_PIDFF_QUIRK_MISSING_PBO; -+ } -+ else if (!found && strict) { - pr_debug("failed to locate %d\n", k); - return -1; - } - } -- return 0; -+ return return_value; - } - - /* -@@ -871,6 +922,11 @@ static int pidff_reports_ok(struct pidff_device *pidff) - static struct hid_field *pidff_find_special_field(struct hid_report *report, - int usage, int enforce_min) - { -+ if (!report) { -+ pr_debug("pidff_find_special_field, null report\n"); -+ return NULL; -+ } -+ - int i; - - for (i = 0; i < report->maxfield; i++) { -@@ -932,7 +988,8 @@ static int pidff_find_special_fields(struct pidff_device *pidff) - 0x57, 0); - pidff->device_control = - pidff_find_special_field(pidff->reports[PID_DEVICE_CONTROL], -- 0x96, 1); -+ 0x96, !(pidff->quirks & HID_PIDFF_QUIRK_PERMISSIVE_CONTROL)); -+ - pidff->block_load_status = - pidff_find_special_field(pidff->reports[PID_BLOCK_LOAD], - 0x8b, 1); -@@ -1062,12 +1119,19 @@ static int pidff_find_effects(struct pidff_device *pidff, - */ - static int pidff_init_fields(struct pidff_device *pidff, struct input_dev *dev) - { -- int envelope_ok = 0; -+ int status = 0; - -- if (PIDFF_FIND_FIELDS(set_effect, PID_SET_EFFECT, 1)) { -+ /* Save info about the device not having the DELAY ffb field. */ -+ status = PIDFF_FIND_FIELDS(set_effect, PID_SET_EFFECT, 1); -+ if (status == -1) { - hid_err(pidff->hid, "unknown set_effect report layout\n"); - return -ENODEV; - } -+ pidff->quirks |= status; -+ -+ if (status & HID_PIDFF_QUIRK_MISSING_DELAY) -+ hid_dbg(pidff->hid, "Adding MISSING_DELAY quirk\n"); -+ - - PIDFF_FIND_FIELDS(block_load, PID_BLOCK_LOAD, 0); - if (!pidff->block_load[PID_EFFECT_BLOCK_INDEX].value) { -@@ -1085,13 +1149,10 @@ static int pidff_init_fields(struct pidff_device *pidff, struct input_dev *dev) - return -ENODEV; - } - -- if (!PIDFF_FIND_FIELDS(set_envelope, PID_SET_ENVELOPE, 1)) -- envelope_ok = 1; -- - if (pidff_find_special_fields(pidff) || pidff_find_effects(pidff, dev)) - return -ENODEV; - -- if (!envelope_ok) { -+ if (PIDFF_FIND_FIELDS(set_envelope, PID_SET_ENVELOPE, 1)) { - if (test_and_clear_bit(FF_CONSTANT, dev->ffbit)) - hid_warn(pidff->hid, - "has constant effect but no envelope\n"); -@@ -1116,16 +1177,20 @@ static int pidff_init_fields(struct pidff_device *pidff, struct input_dev *dev) - clear_bit(FF_RAMP, dev->ffbit); - } - -- if ((test_bit(FF_SPRING, dev->ffbit) || -- test_bit(FF_DAMPER, dev->ffbit) || -- test_bit(FF_FRICTION, dev->ffbit) || -- test_bit(FF_INERTIA, dev->ffbit)) && -- PIDFF_FIND_FIELDS(set_condition, PID_SET_CONDITION, 1)) { -- hid_warn(pidff->hid, "unknown condition effect layout\n"); -- clear_bit(FF_SPRING, dev->ffbit); -- clear_bit(FF_DAMPER, dev->ffbit); -- clear_bit(FF_FRICTION, dev->ffbit); -- clear_bit(FF_INERTIA, dev->ffbit); -+ if (test_bit(FF_SPRING, dev->ffbit) || -+ test_bit(FF_DAMPER, dev->ffbit) || -+ test_bit(FF_FRICTION, dev->ffbit) || -+ test_bit(FF_INERTIA, dev->ffbit)) { -+ status = PIDFF_FIND_FIELDS(set_condition, PID_SET_CONDITION, 1); -+ -+ if (status < 0) { -+ hid_warn(pidff->hid, "unknown condition effect layout\n"); -+ clear_bit(FF_SPRING, dev->ffbit); -+ clear_bit(FF_DAMPER, dev->ffbit); -+ clear_bit(FF_FRICTION, dev->ffbit); -+ clear_bit(FF_INERTIA, dev->ffbit); -+ } -+ pidff->quirks |= status; - } - - if (test_bit(FF_PERIODIC, dev->ffbit) && -@@ -1222,8 +1287,9 @@ static int pidff_check_autocenter(struct pidff_device *pidff, - - /* - * Check if the device is PID and initialize it -+ * Set initial quirks - */ --int hid_pidff_init(struct hid_device *hid) -+int hid_pidff_init_with_quirks(struct hid_device *hid, __u32 initial_quirks) - { - struct pidff_device *pidff; - struct hid_input *hidinput = list_entry(hid->inputs.next, -@@ -1245,6 +1311,7 @@ int hid_pidff_init(struct hid_device *hid) - return -ENOMEM; - - pidff->hid = hid; -+ pidff->quirks = initial_quirks; - - hid_device_io_start(hid); - -@@ -1311,6 +1378,7 @@ int hid_pidff_init(struct hid_device *hid) - ff->playback = pidff_playback; - - hid_info(dev, "Force feedback for USB HID PID devices by Anssi Hannula \n"); -+ hid_dbg(dev, "Active quirks mask: 0x%x\n", pidff->quirks); - - hid_device_io_stop(hid); - -@@ -1322,3 +1390,14 @@ int hid_pidff_init(struct hid_device *hid) - kfree(pidff); - return error; - } -+EXPORT_SYMBOL_GPL(hid_pidff_init_with_quirks); -+ -+/* -+ * Check if the device is PID and initialize it -+ * Wrapper made to keep the compatibility with old -+ * init function -+ */ -+int hid_pidff_init(struct hid_device *hid) -+{ -+ return hid_pidff_init_with_quirks(hid, 0); -+} -diff --git a/drivers/hsi/clients/ssi_protocol.c b/drivers/hsi/clients/ssi_protocol.c -index da6a7abd584f7f..f8ccb29c63807e 100644 ---- a/drivers/hsi/clients/ssi_protocol.c -+++ b/drivers/hsi/clients/ssi_protocol.c -@@ -401,6 +401,7 @@ static void ssip_reset(struct hsi_client *cl) - del_timer(&ssi->rx_wd); - del_timer(&ssi->tx_wd); - del_timer(&ssi->keep_alive); -+ cancel_work_sync(&ssi->work); - ssi->main_state = 0; - ssi->send_state = 0; - ssi->recv_state = 0; -diff --git a/drivers/i2c/busses/i2c-cros-ec-tunnel.c b/drivers/i2c/busses/i2c-cros-ec-tunnel.c -index 2737fd8abd3249..0cad18ae959eb9 100644 ---- a/drivers/i2c/busses/i2c-cros-ec-tunnel.c -+++ b/drivers/i2c/busses/i2c-cros-ec-tunnel.c -@@ -247,6 +247,9 @@ static int ec_i2c_probe(struct platform_device *pdev) - u32 remote_bus; - int err; - -+ if (!ec) -+ return dev_err_probe(dev, -EPROBE_DEFER, "couldn't find parent EC device\n"); -+ - if (!ec->cmd_xfer) { - dev_err(dev, "Missing sendrecv\n"); - return -EINVAL; -diff --git a/drivers/i2c/i2c-atr.c b/drivers/i2c/i2c-atr.c -index c03196da116351..03caa4ef012f14 100644 ---- a/drivers/i2c/i2c-atr.c -+++ b/drivers/i2c/i2c-atr.c -@@ -8,12 +8,12 @@ - * Originally based on i2c-mux.c - */ - --#include - #include - #include - #include - #include - #include -+#include - #include - #include - -diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c -index c073ee74e3dabb..33254bc338b9c0 100644 ---- a/drivers/i3c/master.c -+++ b/drivers/i3c/master.c -@@ -2512,6 +2512,9 @@ static void i3c_master_unregister_i3c_devs(struct i3c_master_controller *master) - */ - void i3c_master_queue_ibi(struct i3c_dev_desc *dev, struct i3c_ibi_slot *slot) - { -+ if (!dev->ibi || !slot) -+ return; -+ - atomic_inc(&dev->ibi->pending_ibis); - queue_work(dev->common.master->wq, &slot->work); - } -diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c -index 652a666909a552..fa1f12a89158cf 100644 ---- a/drivers/i3c/master/svc-i3c-master.c -+++ b/drivers/i3c/master/svc-i3c-master.c -@@ -376,7 +376,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master, - slot->len < SVC_I3C_FIFO_SIZE) { - mdatactrl = readl(master->regs + SVC_I3C_MDATACTRL); - count = SVC_I3C_MDATACTRL_RXCOUNT(mdatactrl); -- readsl(master->regs + SVC_I3C_MRDATAB, buf, count); -+ readsb(master->regs + SVC_I3C_MRDATAB, buf, count); - slot->len += count; - buf += count; - } -diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c -index 64ace0b968f07f..348527cf1e7bfc 100644 ---- a/drivers/infiniband/core/cma.c -+++ b/drivers/infiniband/core/cma.c -@@ -72,6 +72,8 @@ static const char * const cma_events[] = { - static void cma_iboe_set_mgid(struct sockaddr *addr, union ib_gid *mgid, - enum ib_gid_type gid_type); - -+static void cma_netevent_work_handler(struct work_struct *_work); -+ - const char *__attribute_const__ rdma_event_msg(enum rdma_cm_event_type event) - { - size_t index = event; -@@ -1017,6 +1019,7 @@ __rdma_create_id(struct net *net, rdma_cm_event_handler event_handler, - get_random_bytes(&id_priv->seq_num, sizeof id_priv->seq_num); - id_priv->id.route.addr.dev_addr.net = get_net(net); - id_priv->seq_num &= 0x00ffffff; -+ INIT_WORK(&id_priv->id.net_work, cma_netevent_work_handler); - - rdma_restrack_new(&id_priv->res, RDMA_RESTRACK_CM_ID); - if (parent) -@@ -5211,7 +5214,6 @@ static int cma_netevent_callback(struct notifier_block *self, - if (!memcmp(current_id->id.route.addr.dev_addr.dst_dev_addr, - neigh->ha, ETH_ALEN)) - continue; -- INIT_WORK(¤t_id->id.net_work, cma_netevent_work_handler); - cma_id_get(current_id); - queue_work(cma_wq, ¤t_id->id.net_work); - } -diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c -index e9fa22d31c2332..c48ef608302055 100644 ---- a/drivers/infiniband/core/umem_odp.c -+++ b/drivers/infiniband/core/umem_odp.c -@@ -76,12 +76,14 @@ static inline int ib_init_umem_odp(struct ib_umem_odp *umem_odp, - - npfns = (end - start) >> PAGE_SHIFT; - umem_odp->pfn_list = kvcalloc( -- npfns, sizeof(*umem_odp->pfn_list), GFP_KERNEL); -+ npfns, sizeof(*umem_odp->pfn_list), -+ GFP_KERNEL | __GFP_NOWARN); - if (!umem_odp->pfn_list) - return -ENOMEM; - - umem_odp->dma_list = kvcalloc( -- ndmas, sizeof(*umem_odp->dma_list), GFP_KERNEL); -+ ndmas, sizeof(*umem_odp->dma_list), -+ GFP_KERNEL | __GFP_NOWARN); - if (!umem_odp->dma_list) { - ret = -ENOMEM; - goto out_pfn_list; -diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c -index dcd763dbb636d9..a7e4c951f8fe40 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_main.c -+++ b/drivers/infiniband/hw/hns/hns_roce_main.c -@@ -731,7 +731,7 @@ static int hns_roce_register_device(struct hns_roce_dev *hr_dev) - if (ret) - return ret; - } -- dma_set_max_seg_size(dev, UINT_MAX); -+ dma_set_max_seg_size(dev, SZ_2G); - ret = ib_register_device(ib_dev, "hns_%d", dev); - if (ret) { - dev_err(dev, "ib_register_device failed!\n"); -diff --git a/drivers/infiniband/hw/usnic/usnic_ib_main.c b/drivers/infiniband/hw/usnic/usnic_ib_main.c -index 13b654ddd3cc8d..bcf7d8607d56ef 100644 ---- a/drivers/infiniband/hw/usnic/usnic_ib_main.c -+++ b/drivers/infiniband/hw/usnic/usnic_ib_main.c -@@ -380,7 +380,7 @@ static void *usnic_ib_device_add(struct pci_dev *dev) - if (!us_ibdev) { - usnic_err("Device %s context alloc failed\n", - netdev_name(pci_get_drvdata(dev))); -- return ERR_PTR(-EFAULT); -+ return NULL; - } - - us_ibdev->ufdev = usnic_fwd_dev_alloc(dev); -@@ -500,8 +500,8 @@ static struct usnic_ib_dev *usnic_ib_discover_pf(struct usnic_vnic *vnic) - } - - us_ibdev = usnic_ib_device_add(parent_pci); -- if (IS_ERR_OR_NULL(us_ibdev)) { -- us_ibdev = us_ibdev ? us_ibdev : ERR_PTR(-EFAULT); -+ if (!us_ibdev) { -+ us_ibdev = ERR_PTR(-EFAULT); - goto out; - } - -@@ -569,10 +569,10 @@ static int usnic_ib_pci_probe(struct pci_dev *pdev, - } - - pf = usnic_ib_discover_pf(vf->vnic); -- if (IS_ERR_OR_NULL(pf)) { -- usnic_err("Failed to discover pf of vnic %s with err%ld\n", -- pci_name(pdev), PTR_ERR(pf)); -- err = pf ? PTR_ERR(pf) : -EFAULT; -+ if (IS_ERR(pf)) { -+ err = PTR_ERR(pf); -+ usnic_err("Failed to discover pf of vnic %s with err%d\n", -+ pci_name(pdev), err); - goto out_clean_vnic; - } - -diff --git a/drivers/iommu/iommufd/device.c b/drivers/iommu/iommufd/device.c -index ce78c3671539c7..ff6386fd1e8fec 100644 ---- a/drivers/iommu/iommufd/device.c -+++ b/drivers/iommu/iommufd/device.c -@@ -407,6 +407,17 @@ iommufd_device_do_attach(struct iommufd_device *idev, - return NULL; - } - -+/* Check if idev is attached to igroup->hwpt */ -+static bool iommufd_device_is_attached(struct iommufd_device *idev) -+{ -+ struct iommufd_device *cur; -+ -+ list_for_each_entry(cur, &idev->igroup->device_list, group_item) -+ if (cur == idev) -+ return true; -+ return false; -+} -+ - static struct iommufd_hw_pagetable * - iommufd_device_do_replace(struct iommufd_device *idev, - struct iommufd_hw_pagetable *hwpt) -@@ -424,6 +435,11 @@ iommufd_device_do_replace(struct iommufd_device *idev, - goto err_unlock; - } - -+ if (!iommufd_device_is_attached(idev)) { -+ rc = -EINVAL; -+ goto err_unlock; -+ } -+ - if (hwpt == igroup->hwpt) { - mutex_unlock(&idev->igroup->lock); - return NULL; -@@ -1076,7 +1092,7 @@ int iommufd_access_rw(struct iommufd_access *access, unsigned long iova, - struct io_pagetable *iopt; - struct iopt_area *area; - unsigned long last_iova; -- int rc; -+ int rc = -EINVAL; - - if (!length) - return -EINVAL; -diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c -index de698463e94ad9..06c0770ff894eb 100644 ---- a/drivers/iommu/mtk_iommu.c -+++ b/drivers/iommu/mtk_iommu.c -@@ -1354,15 +1354,6 @@ static int mtk_iommu_probe(struct platform_device *pdev) - platform_set_drvdata(pdev, data); - mutex_init(&data->mutex); - -- ret = iommu_device_sysfs_add(&data->iommu, dev, NULL, -- "mtk-iommu.%pa", &ioaddr); -- if (ret) -- goto out_link_remove; -- -- ret = iommu_device_register(&data->iommu, &mtk_iommu_ops, dev); -- if (ret) -- goto out_sysfs_remove; -- - if (MTK_IOMMU_HAS_FLAG(data->plat_data, SHARE_PGTABLE)) { - list_add_tail(&data->list, data->plat_data->hw_list); - data->hw_list = data->plat_data->hw_list; -@@ -1372,19 +1363,28 @@ static int mtk_iommu_probe(struct platform_device *pdev) - data->hw_list = &data->hw_list_head; - } - -+ ret = iommu_device_sysfs_add(&data->iommu, dev, NULL, -+ "mtk-iommu.%pa", &ioaddr); -+ if (ret) -+ goto out_list_del; -+ -+ ret = iommu_device_register(&data->iommu, &mtk_iommu_ops, dev); -+ if (ret) -+ goto out_sysfs_remove; -+ - if (MTK_IOMMU_IS_TYPE(data->plat_data, MTK_IOMMU_TYPE_MM)) { - ret = component_master_add_with_match(dev, &mtk_iommu_com_ops, match); - if (ret) -- goto out_list_del; -+ goto out_device_unregister; - } - return ret; - --out_list_del: -- list_del(&data->list); -+out_device_unregister: - iommu_device_unregister(&data->iommu); - out_sysfs_remove: - iommu_device_sysfs_remove(&data->iommu); --out_link_remove: -+out_list_del: -+ list_del(&data->list); - if (MTK_IOMMU_IS_TYPE(data->plat_data, MTK_IOMMU_TYPE_MM)) - device_link_remove(data->smicomm_dev, dev); - out_runtime_disable: -diff --git a/drivers/leds/rgb/leds-qcom-lpg.c b/drivers/leds/rgb/leds-qcom-lpg.c -index df469aaa7e6e7e..a41c2b13766dc1 100644 ---- a/drivers/leds/rgb/leds-qcom-lpg.c -+++ b/drivers/leds/rgb/leds-qcom-lpg.c -@@ -311,7 +311,7 @@ static int lpg_calc_freq(struct lpg_channel *chan, uint64_t period) - max_res = LPG_RESOLUTION_9BIT; - } - -- min_period = div64_u64((u64)NSEC_PER_SEC * (1 << pwm_resolution_arr[0]), -+ min_period = div64_u64((u64)NSEC_PER_SEC * ((1 << pwm_resolution_arr[0]) - 1), - clk_rate_arr[clk_len - 1]); - if (period <= min_period) - return -EINVAL; -@@ -332,7 +332,7 @@ static int lpg_calc_freq(struct lpg_channel *chan, uint64_t period) - */ - - for (i = 0; i < pwm_resolution_count; i++) { -- resolution = 1 << pwm_resolution_arr[i]; -+ resolution = (1 << pwm_resolution_arr[i]) - 1; - for (clk_sel = 1; clk_sel < clk_len; clk_sel++) { - u64 numerator = period * clk_rate_arr[clk_sel]; - -@@ -379,7 +379,7 @@ static void lpg_calc_duty(struct lpg_channel *chan, uint64_t duty) - unsigned int clk_rate; - - if (chan->subtype == LPG_SUBTYPE_HI_RES_PWM) { -- max = LPG_RESOLUTION_15BIT - 1; -+ max = BIT(lpg_pwm_resolution_hi_res[chan->pwm_resolution_sel]) - 1; - clk_rate = lpg_clk_rates_hi_res[chan->clk_sel]; - } else { - max = LPG_RESOLUTION_9BIT - 1; -@@ -1060,7 +1060,7 @@ static int lpg_pwm_get_state(struct pwm_chip *chip, struct pwm_device *pwm, - if (ret) - return ret; - -- state->period = DIV_ROUND_UP_ULL((u64)NSEC_PER_SEC * (1 << resolution) * -+ state->period = DIV_ROUND_UP_ULL((u64)NSEC_PER_SEC * ((1 << resolution) - 1) * - pre_div * (1 << m), refclk); - state->duty_cycle = DIV_ROUND_UP_ULL((u64)NSEC_PER_SEC * pwm_value * pre_div * (1 << m), refclk); - } else { -diff --git a/drivers/mailbox/tegra-hsp.c b/drivers/mailbox/tegra-hsp.c -index 694550fdfddddb..5d33cf8ec2ecb9 100644 ---- a/drivers/mailbox/tegra-hsp.c -+++ b/drivers/mailbox/tegra-hsp.c -@@ -1,6 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0-only - /* -- * Copyright (c) 2016-2023, NVIDIA CORPORATION. All rights reserved. -+ * Copyright (c) 2016-2025, NVIDIA CORPORATION. All rights reserved. - */ - - #include -@@ -28,12 +28,6 @@ - #define HSP_INT_FULL_MASK 0xff - - #define HSP_INT_DIMENSIONING 0x380 --#define HSP_nSM_SHIFT 0 --#define HSP_nSS_SHIFT 4 --#define HSP_nAS_SHIFT 8 --#define HSP_nDB_SHIFT 12 --#define HSP_nSI_SHIFT 16 --#define HSP_nINT_MASK 0xf - - #define HSP_DB_TRIGGER 0x0 - #define HSP_DB_ENABLE 0x4 -@@ -97,6 +91,20 @@ struct tegra_hsp_soc { - bool has_per_mb_ie; - bool has_128_bit_mb; - unsigned int reg_stride; -+ -+ /* Shifts for dimensioning register. */ -+ unsigned int si_shift; -+ unsigned int db_shift; -+ unsigned int as_shift; -+ unsigned int ss_shift; -+ unsigned int sm_shift; -+ -+ /* Masks for dimensioning register. */ -+ unsigned int si_mask; -+ unsigned int db_mask; -+ unsigned int as_mask; -+ unsigned int ss_mask; -+ unsigned int sm_mask; - }; - - struct tegra_hsp { -@@ -747,11 +755,11 @@ static int tegra_hsp_probe(struct platform_device *pdev) - return PTR_ERR(hsp->regs); - - value = tegra_hsp_readl(hsp, HSP_INT_DIMENSIONING); -- hsp->num_sm = (value >> HSP_nSM_SHIFT) & HSP_nINT_MASK; -- hsp->num_ss = (value >> HSP_nSS_SHIFT) & HSP_nINT_MASK; -- hsp->num_as = (value >> HSP_nAS_SHIFT) & HSP_nINT_MASK; -- hsp->num_db = (value >> HSP_nDB_SHIFT) & HSP_nINT_MASK; -- hsp->num_si = (value >> HSP_nSI_SHIFT) & HSP_nINT_MASK; -+ hsp->num_sm = (value >> hsp->soc->sm_shift) & hsp->soc->sm_mask; -+ hsp->num_ss = (value >> hsp->soc->ss_shift) & hsp->soc->ss_mask; -+ hsp->num_as = (value >> hsp->soc->as_shift) & hsp->soc->as_mask; -+ hsp->num_db = (value >> hsp->soc->db_shift) & hsp->soc->db_mask; -+ hsp->num_si = (value >> hsp->soc->si_shift) & hsp->soc->si_mask; - - err = platform_get_irq_byname_optional(pdev, "doorbell"); - if (err >= 0) -@@ -917,6 +925,16 @@ static const struct tegra_hsp_soc tegra186_hsp_soc = { - .has_per_mb_ie = false, - .has_128_bit_mb = false, - .reg_stride = 0x100, -+ .si_shift = 16, -+ .db_shift = 12, -+ .as_shift = 8, -+ .ss_shift = 4, -+ .sm_shift = 0, -+ .si_mask = 0xf, -+ .db_mask = 0xf, -+ .as_mask = 0xf, -+ .ss_mask = 0xf, -+ .sm_mask = 0xf, - }; - - static const struct tegra_hsp_soc tegra194_hsp_soc = { -@@ -924,6 +942,16 @@ static const struct tegra_hsp_soc tegra194_hsp_soc = { - .has_per_mb_ie = true, - .has_128_bit_mb = false, - .reg_stride = 0x100, -+ .si_shift = 16, -+ .db_shift = 12, -+ .as_shift = 8, -+ .ss_shift = 4, -+ .sm_shift = 0, -+ .si_mask = 0xf, -+ .db_mask = 0xf, -+ .as_mask = 0xf, -+ .ss_mask = 0xf, -+ .sm_mask = 0xf, - }; - - static const struct tegra_hsp_soc tegra234_hsp_soc = { -@@ -931,6 +959,16 @@ static const struct tegra_hsp_soc tegra234_hsp_soc = { - .has_per_mb_ie = false, - .has_128_bit_mb = true, - .reg_stride = 0x100, -+ .si_shift = 16, -+ .db_shift = 12, -+ .as_shift = 8, -+ .ss_shift = 4, -+ .sm_shift = 0, -+ .si_mask = 0xf, -+ .db_mask = 0xf, -+ .as_mask = 0xf, -+ .ss_mask = 0xf, -+ .sm_mask = 0xf, - }; - - static const struct tegra_hsp_soc tegra264_hsp_soc = { -@@ -938,6 +976,16 @@ static const struct tegra_hsp_soc tegra264_hsp_soc = { - .has_per_mb_ie = false, - .has_128_bit_mb = true, - .reg_stride = 0x1000, -+ .si_shift = 17, -+ .db_shift = 12, -+ .as_shift = 8, -+ .ss_shift = 4, -+ .sm_shift = 0, -+ .si_mask = 0x1f, -+ .db_mask = 0x1f, -+ .as_mask = 0xf, -+ .ss_mask = 0xf, -+ .sm_mask = 0xf, - }; - - static const struct of_device_id tegra_hsp_match[] = { -diff --git a/drivers/md/dm-ebs-target.c b/drivers/md/dm-ebs-target.c -index 66d9622b684dd4..aead2215d780c2 100644 ---- a/drivers/md/dm-ebs-target.c -+++ b/drivers/md/dm-ebs-target.c -@@ -390,6 +390,12 @@ static int ebs_map(struct dm_target *ti, struct bio *bio) - return DM_MAPIO_REMAPPED; - } - -+static void ebs_postsuspend(struct dm_target *ti) -+{ -+ struct ebs_c *ec = ti->private; -+ dm_bufio_client_reset(ec->bufio); -+} -+ - static void ebs_status(struct dm_target *ti, status_type_t type, - unsigned int status_flags, char *result, unsigned int maxlen) - { -@@ -447,6 +453,7 @@ static struct target_type ebs_target = { - .ctr = ebs_ctr, - .dtr = ebs_dtr, - .map = ebs_map, -+ .postsuspend = ebs_postsuspend, - .status = ebs_status, - .io_hints = ebs_io_hints, - .prepare_ioctl = ebs_prepare_ioctl, -diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c -index a36dd749c688e1..eb2b44f4a61f08 100644 ---- a/drivers/md/dm-integrity.c -+++ b/drivers/md/dm-integrity.c -@@ -4594,16 +4594,19 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned int argc, char **argv - - ic->recalc_bitmap = dm_integrity_alloc_page_list(n_bitmap_pages); - if (!ic->recalc_bitmap) { -+ ti->error = "Could not allocate memory for bitmap"; - r = -ENOMEM; - goto bad; - } - ic->may_write_bitmap = dm_integrity_alloc_page_list(n_bitmap_pages); - if (!ic->may_write_bitmap) { -+ ti->error = "Could not allocate memory for bitmap"; - r = -ENOMEM; - goto bad; - } - ic->bbs = kvmalloc_array(ic->n_bitmap_blocks, sizeof(struct bitmap_block_status), GFP_KERNEL); - if (!ic->bbs) { -+ ti->error = "Could not allocate memory for bitmap"; - r = -ENOMEM; - goto bad; - } -diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c -index 3636387ce565ae..6ae97da741bba3 100644 ---- a/drivers/md/dm-verity-target.c -+++ b/drivers/md/dm-verity-target.c -@@ -836,6 +836,13 @@ static int verity_map(struct dm_target *ti, struct bio *bio) - return DM_MAPIO_SUBMITTED; - } - -+static void verity_postsuspend(struct dm_target *ti) -+{ -+ struct dm_verity *v = ti->private; -+ flush_workqueue(v->verify_wq); -+ dm_bufio_client_reset(v->bufio); -+} -+ - /* - * Status: V (valid) or C (corruption found) - */ -@@ -1557,6 +1564,7 @@ static struct target_type verity_target = { - .ctr = verity_ctr, - .dtr = verity_dtr, - .map = verity_map, -+ .postsuspend = verity_postsuspend, - .status = verity_status, - .prepare_ioctl = verity_prepare_ioctl, - .iterate_devices = verity_iterate_devices, -diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c -index deb40a8ba39995..8317e07b326d0d 100644 ---- a/drivers/md/md-bitmap.c -+++ b/drivers/md/md-bitmap.c -@@ -2119,9 +2119,8 @@ int md_bitmap_get_stats(struct bitmap *bitmap, struct md_bitmap_stats *stats) - - if (!bitmap) - return -ENOENT; -- if (bitmap->mddev->bitmap_info.external) -- return -ENOENT; -- if (!bitmap->storage.sb_page) /* no superblock */ -+ if (!bitmap->mddev->bitmap_info.external && -+ !bitmap->storage.sb_page) - return -EINVAL; - sb = kmap_local_page(bitmap->storage.sb_page); - stats->sync_size = le64_to_cpu(sb->sync_size); -diff --git a/drivers/md/md.c b/drivers/md/md.c -index a8ac4afc51d91d..ca7ae3aad2655f 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -649,6 +649,12 @@ static void __mddev_put(struct mddev *mddev) - queue_work(md_misc_wq, &mddev->del_work); - } - -+static void mddev_put_locked(struct mddev *mddev) -+{ -+ if (atomic_dec_and_test(&mddev->active)) -+ __mddev_put(mddev); -+} -+ - void mddev_put(struct mddev *mddev) - { - if (!atomic_dec_and_lock(&mddev->active, &all_mddevs_lock)) -@@ -8417,9 +8423,7 @@ static int md_seq_show(struct seq_file *seq, void *v) - if (mddev == list_last_entry(&all_mddevs, struct mddev, all_mddevs)) - status_unused(seq); - -- if (atomic_dec_and_test(&mddev->active)) -- __mddev_put(mddev); -- -+ mddev_put_locked(mddev); - return 0; - } - -@@ -9699,11 +9703,11 @@ EXPORT_SYMBOL_GPL(rdev_clear_badblocks); - static int md_notify_reboot(struct notifier_block *this, - unsigned long code, void *x) - { -- struct mddev *mddev, *n; -+ struct mddev *mddev; - int need_delay = 0; - - spin_lock(&all_mddevs_lock); -- list_for_each_entry_safe(mddev, n, &all_mddevs, all_mddevs) { -+ list_for_each_entry(mddev, &all_mddevs, all_mddevs) { - if (!mddev_get(mddev)) - continue; - spin_unlock(&all_mddevs_lock); -@@ -9715,8 +9719,8 @@ static int md_notify_reboot(struct notifier_block *this, - mddev_unlock(mddev); - } - need_delay = 1; -- mddev_put(mddev); - spin_lock(&all_mddevs_lock); -+ mddev_put_locked(mddev); - } - spin_unlock(&all_mddevs_lock); - -@@ -10039,7 +10043,7 @@ void md_autostart_arrays(int part) - - static __exit void md_exit(void) - { -- struct mddev *mddev, *n; -+ struct mddev *mddev; - int delay = 1; - - unregister_blkdev(MD_MAJOR,"md"); -@@ -10060,7 +10064,7 @@ static __exit void md_exit(void) - remove_proc_entry("mdstat", NULL); - - spin_lock(&all_mddevs_lock); -- list_for_each_entry_safe(mddev, n, &all_mddevs, all_mddevs) { -+ list_for_each_entry(mddev, &all_mddevs, all_mddevs) { - if (!mddev_get(mddev)) - continue; - spin_unlock(&all_mddevs_lock); -@@ -10072,8 +10076,8 @@ static __exit void md_exit(void) - * the mddev for destruction by a workqueue, and the - * destroy_workqueue() below will wait for that to complete. - */ -- mddev_put(mddev); - spin_lock(&all_mddevs_lock); -+ mddev_put_locked(mddev); - } - spin_unlock(&all_mddevs_lock); - -diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c -index c300fd609ef08c..36b6bf3f8b29fd 100644 ---- a/drivers/md/raid10.c -+++ b/drivers/md/raid10.c -@@ -1756,6 +1756,7 @@ static int raid10_handle_discard(struct mddev *mddev, struct bio *bio) - * The discard bio returns only first r10bio finishes - */ - if (first_copy) { -+ md_account_bio(mddev, &bio); - r10_bio->master_bio = bio; - set_bit(R10BIO_Discard, &r10_bio->state); - first_copy = false; -diff --git a/drivers/media/common/siano/smsdvb-main.c b/drivers/media/common/siano/smsdvb-main.c -index f80caaa333daf5..67c47e3d671d3d 100644 ---- a/drivers/media/common/siano/smsdvb-main.c -+++ b/drivers/media/common/siano/smsdvb-main.c -@@ -1243,6 +1243,8 @@ static int __init smsdvb_module_init(void) - smsdvb_debugfs_register(); - - rc = smscore_register_hotplug(smsdvb_hotplug); -+ if (rc) -+ smsdvb_debugfs_unregister(); - - pr_debug("\n"); - -diff --git a/drivers/media/i2c/adv748x/adv748x.h b/drivers/media/i2c/adv748x/adv748x.h -index 6f90f78f58cfac..6e2cb95e86ca59 100644 ---- a/drivers/media/i2c/adv748x/adv748x.h -+++ b/drivers/media/i2c/adv748x/adv748x.h -@@ -322,7 +322,7 @@ struct adv748x_state { - - /* Free run pattern select */ - #define ADV748X_SDP_FRP 0x14 --#define ADV748X_SDP_FRP_MASK GENMASK(3, 1) -+#define ADV748X_SDP_FRP_MASK GENMASK(2, 0) - - /* Saturation */ - #define ADV748X_SDP_SD_SAT_U 0xe3 /* user_map_rw_reg_e3 */ -diff --git a/drivers/media/i2c/ccs/ccs-core.c b/drivers/media/i2c/ccs/ccs-core.c -index 92ee86ca80a63d..36402612425779 100644 ---- a/drivers/media/i2c/ccs/ccs-core.c -+++ b/drivers/media/i2c/ccs/ccs-core.c -@@ -3651,6 +3651,7 @@ static int ccs_probe(struct i2c_client *client) - out_disable_runtime_pm: - pm_runtime_put_noidle(&client->dev); - pm_runtime_disable(&client->dev); -+ pm_runtime_set_suspended(&client->dev); - - out_media_entity_cleanup: - media_entity_cleanup(&sensor->src->sd.entity); -@@ -3683,9 +3684,10 @@ static void ccs_remove(struct i2c_client *client) - v4l2_async_unregister_subdev(subdev); - - pm_runtime_disable(&client->dev); -- if (!pm_runtime_status_suspended(&client->dev)) -+ if (!pm_runtime_status_suspended(&client->dev)) { - ccs_power_off(&client->dev); -- pm_runtime_set_suspended(&client->dev); -+ pm_runtime_set_suspended(&client->dev); -+ } - - for (i = 0; i < sensor->ssds_used; i++) { - v4l2_device_unregister_subdev(&sensor->ssds[i].sd); -diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c -index a9a8cd148f4fcf..a14e571dc62bc5 100644 ---- a/drivers/media/i2c/imx219.c -+++ b/drivers/media/i2c/imx219.c -@@ -1334,21 +1334,23 @@ static int imx219_probe(struct i2c_client *client) - goto error_media_entity; - } - -+ pm_runtime_set_active(dev); -+ pm_runtime_enable(dev); -+ - ret = v4l2_async_register_subdev_sensor(&imx219->sd); - if (ret < 0) { - dev_err(dev, "failed to register sensor sub-device: %d\n", ret); - goto error_subdev_cleanup; - } - -- /* Enable runtime PM and turn off the device */ -- pm_runtime_set_active(dev); -- pm_runtime_enable(dev); - pm_runtime_idle(dev); - - return 0; - - error_subdev_cleanup: - v4l2_subdev_cleanup(&imx219->sd); -+ pm_runtime_disable(dev); -+ pm_runtime_set_suspended(dev); - - error_media_entity: - media_entity_cleanup(&imx219->sd.entity); -@@ -1373,9 +1375,10 @@ static void imx219_remove(struct i2c_client *client) - imx219_free_controls(imx219); - - pm_runtime_disable(&client->dev); -- if (!pm_runtime_status_suspended(&client->dev)) -+ if (!pm_runtime_status_suspended(&client->dev)) { - imx219_power_off(&client->dev); -- pm_runtime_set_suspended(&client->dev); -+ pm_runtime_set_suspended(&client->dev); -+ } - } - - static const struct of_device_id imx219_dt_ids[] = { -diff --git a/drivers/media/i2c/ov7251.c b/drivers/media/i2c/ov7251.c -index 675fb37a6feaec..2fc52b66154cc4 100644 ---- a/drivers/media/i2c/ov7251.c -+++ b/drivers/media/i2c/ov7251.c -@@ -922,6 +922,8 @@ static int ov7251_set_power_on(struct device *dev) - return ret; - } - -+ usleep_range(1000, 1100); -+ - gpiod_set_value_cansleep(ov7251->enable_gpio, 1); - - /* wait at least 65536 external clock cycles */ -@@ -1675,7 +1677,7 @@ static int ov7251_probe(struct i2c_client *client) - return PTR_ERR(ov7251->analog_regulator); - } - -- ov7251->enable_gpio = devm_gpiod_get(dev, "enable", GPIOD_OUT_HIGH); -+ ov7251->enable_gpio = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW); - if (IS_ERR(ov7251->enable_gpio)) { - dev_err(dev, "cannot get enable gpio\n"); - return PTR_ERR(ov7251->enable_gpio); -diff --git a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c -index 774487fb72a319..93579a7009a7bc 100644 ---- a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c -+++ b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c -@@ -79,8 +79,11 @@ struct mtk_vcodec_fw *mtk_vcodec_fw_scp_init(void *priv, enum mtk_vcodec_fw_use - } - - fw = devm_kzalloc(&plat_dev->dev, sizeof(*fw), GFP_KERNEL); -- if (!fw) -+ if (!fw) { -+ scp_put(scp); - return ERR_PTR(-ENOMEM); -+ } -+ - fw->type = SCP; - fw->ops = &mtk_vcodec_rproc_msg; - fw->scp = scp; -diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_lat_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_lat_if.c -index e393e3e668f8f5..3fe192a1d5a1de 100644 ---- a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_lat_if.c -+++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_lat_if.c -@@ -1189,7 +1189,8 @@ static int vdec_vp9_slice_setup_lat(struct vdec_vp9_slice_instance *instance, - return ret; - } - --static -+/* clang stack usage explodes if this is inlined */ -+static noinline_for_stack - void vdec_vp9_slice_map_counts_eob_coef(unsigned int i, unsigned int j, unsigned int k, - struct vdec_vp9_slice_frame_counts *counts, - struct v4l2_vp9_frame_symbol_counts *counts_helper) -diff --git a/drivers/media/platform/mediatek/vcodec/encoder/venc/venc_h264_if.c b/drivers/media/platform/mediatek/vcodec/encoder/venc/venc_h264_if.c -index f8145998fcaf78..8522f71fc901d5 100644 ---- a/drivers/media/platform/mediatek/vcodec/encoder/venc/venc_h264_if.c -+++ b/drivers/media/platform/mediatek/vcodec/encoder/venc/venc_h264_if.c -@@ -594,7 +594,11 @@ static int h264_enc_init(struct mtk_vcodec_enc_ctx *ctx) - - inst->ctx = ctx; - inst->vpu_inst.ctx = ctx; -- inst->vpu_inst.id = is_ext ? SCP_IPI_VENC_H264 : IPI_VENC_H264; -+ if (is_ext) -+ inst->vpu_inst.id = SCP_IPI_VENC_H264; -+ else -+ inst->vpu_inst.id = IPI_VENC_H264; -+ - inst->hw_base = mtk_vcodec_get_reg_addr(inst->ctx->dev->reg_base, VENC_SYS); - - ret = vpu_enc_init(&inst->vpu_inst); -diff --git a/drivers/media/platform/qcom/venus/hfi_parser.c b/drivers/media/platform/qcom/venus/hfi_parser.c -index c43839539d4dda..8eb9e32031f7f9 100644 ---- a/drivers/media/platform/qcom/venus/hfi_parser.c -+++ b/drivers/media/platform/qcom/venus/hfi_parser.c -@@ -19,6 +19,8 @@ static void init_codecs(struct venus_core *core) - struct hfi_plat_caps *caps = core->caps, *cap; - unsigned long bit; - -+ core->codecs_count = 0; -+ - if (hweight_long(core->dec_codecs) + hweight_long(core->enc_codecs) > MAX_CODEC_NUM) - return; - -@@ -62,7 +64,7 @@ fill_buf_mode(struct hfi_plat_caps *cap, const void *data, unsigned int num) - cap->cap_bufs_mode_dynamic = true; - } - --static void -+static int - parse_alloc_mode(struct venus_core *core, u32 codecs, u32 domain, void *data) - { - struct hfi_buffer_alloc_mode_supported *mode = data; -@@ -70,7 +72,7 @@ parse_alloc_mode(struct venus_core *core, u32 codecs, u32 domain, void *data) - u32 *type; - - if (num_entries > MAX_ALLOC_MODE_ENTRIES) -- return; -+ return -EINVAL; - - type = mode->data; - -@@ -82,6 +84,8 @@ parse_alloc_mode(struct venus_core *core, u32 codecs, u32 domain, void *data) - - type++; - } -+ -+ return sizeof(*mode); - } - - static void fill_profile_level(struct hfi_plat_caps *cap, const void *data, -@@ -96,7 +100,7 @@ static void fill_profile_level(struct hfi_plat_caps *cap, const void *data, - cap->num_pl += num; - } - --static void -+static int - parse_profile_level(struct venus_core *core, u32 codecs, u32 domain, void *data) - { - struct hfi_profile_level_supported *pl = data; -@@ -104,12 +108,14 @@ parse_profile_level(struct venus_core *core, u32 codecs, u32 domain, void *data) - struct hfi_profile_level pl_arr[HFI_MAX_PROFILE_COUNT] = {}; - - if (pl->profile_count > HFI_MAX_PROFILE_COUNT) -- return; -+ return -EINVAL; - - memcpy(pl_arr, proflevel, pl->profile_count * sizeof(*proflevel)); - - for_each_codec(core->caps, ARRAY_SIZE(core->caps), codecs, domain, - fill_profile_level, pl_arr, pl->profile_count); -+ -+ return pl->profile_count * sizeof(*proflevel) + sizeof(u32); - } - - static void -@@ -124,7 +130,7 @@ fill_caps(struct hfi_plat_caps *cap, const void *data, unsigned int num) - cap->num_caps += num; - } - --static void -+static int - parse_caps(struct venus_core *core, u32 codecs, u32 domain, void *data) - { - struct hfi_capabilities *caps = data; -@@ -133,12 +139,14 @@ parse_caps(struct venus_core *core, u32 codecs, u32 domain, void *data) - struct hfi_capability caps_arr[MAX_CAP_ENTRIES] = {}; - - if (num_caps > MAX_CAP_ENTRIES) -- return; -+ return -EINVAL; - - memcpy(caps_arr, cap, num_caps * sizeof(*cap)); - - for_each_codec(core->caps, ARRAY_SIZE(core->caps), codecs, domain, - fill_caps, caps_arr, num_caps); -+ -+ return sizeof(*caps); - } - - static void fill_raw_fmts(struct hfi_plat_caps *cap, const void *fmts, -@@ -153,7 +161,7 @@ static void fill_raw_fmts(struct hfi_plat_caps *cap, const void *fmts, - cap->num_fmts += num_fmts; - } - --static void -+static int - parse_raw_formats(struct venus_core *core, u32 codecs, u32 domain, void *data) - { - struct hfi_uncompressed_format_supported *fmt = data; -@@ -162,7 +170,8 @@ parse_raw_formats(struct venus_core *core, u32 codecs, u32 domain, void *data) - struct raw_formats rawfmts[MAX_FMT_ENTRIES] = {}; - u32 entries = fmt->format_entries; - unsigned int i = 0; -- u32 num_planes; -+ u32 num_planes = 0; -+ u32 size; - - while (entries) { - num_planes = pinfo->num_planes; -@@ -172,7 +181,7 @@ parse_raw_formats(struct venus_core *core, u32 codecs, u32 domain, void *data) - i++; - - if (i >= MAX_FMT_ENTRIES) -- return; -+ return -EINVAL; - - if (pinfo->num_planes > MAX_PLANES) - break; -@@ -184,9 +193,13 @@ parse_raw_formats(struct venus_core *core, u32 codecs, u32 domain, void *data) - - for_each_codec(core->caps, ARRAY_SIZE(core->caps), codecs, domain, - fill_raw_fmts, rawfmts, i); -+ size = fmt->format_entries * (sizeof(*constr) * num_planes + 2 * sizeof(u32)) -+ + 2 * sizeof(u32); -+ -+ return size; - } - --static void parse_codecs(struct venus_core *core, void *data) -+static int parse_codecs(struct venus_core *core, void *data) - { - struct hfi_codec_supported *codecs = data; - -@@ -198,21 +211,27 @@ static void parse_codecs(struct venus_core *core, void *data) - core->dec_codecs &= ~HFI_VIDEO_CODEC_SPARK; - core->enc_codecs &= ~HFI_VIDEO_CODEC_HEVC; - } -+ -+ return sizeof(*codecs); - } - --static void parse_max_sessions(struct venus_core *core, const void *data) -+static int parse_max_sessions(struct venus_core *core, const void *data) - { - const struct hfi_max_sessions_supported *sessions = data; - - core->max_sessions_supported = sessions->max_sessions; -+ -+ return sizeof(*sessions); - } - --static void parse_codecs_mask(u32 *codecs, u32 *domain, void *data) -+static int parse_codecs_mask(u32 *codecs, u32 *domain, void *data) - { - struct hfi_codec_mask_supported *mask = data; - - *codecs = mask->codecs; - *domain = mask->video_domains; -+ -+ return sizeof(*mask); - } - - static void parser_init(struct venus_inst *inst, u32 *codecs, u32 *domain) -@@ -281,8 +300,9 @@ static int hfi_platform_parser(struct venus_core *core, struct venus_inst *inst) - u32 hfi_parser(struct venus_core *core, struct venus_inst *inst, void *buf, - u32 size) - { -- unsigned int words_count = size >> 2; -- u32 *word = buf, *data, codecs = 0, domain = 0; -+ u32 *words = buf, *payload, codecs = 0, domain = 0; -+ u32 *frame_size = buf + size; -+ u32 rem_bytes = size; - int ret; - - ret = hfi_platform_parser(core, inst); -@@ -299,38 +319,66 @@ u32 hfi_parser(struct venus_core *core, struct venus_inst *inst, void *buf, - memset(core->caps, 0, sizeof(core->caps)); - } - -- while (words_count) { -- data = word + 1; -+ while (words < frame_size) { -+ payload = words + 1; - -- switch (*word) { -+ switch (*words) { - case HFI_PROPERTY_PARAM_CODEC_SUPPORTED: -- parse_codecs(core, data); -+ if (rem_bytes <= sizeof(struct hfi_codec_supported)) -+ return HFI_ERR_SYS_INSUFFICIENT_RESOURCES; -+ -+ ret = parse_codecs(core, payload); -+ if (ret < 0) -+ return HFI_ERR_SYS_INSUFFICIENT_RESOURCES; -+ - init_codecs(core); - break; - case HFI_PROPERTY_PARAM_MAX_SESSIONS_SUPPORTED: -- parse_max_sessions(core, data); -+ if (rem_bytes <= sizeof(struct hfi_max_sessions_supported)) -+ return HFI_ERR_SYS_INSUFFICIENT_RESOURCES; -+ -+ ret = parse_max_sessions(core, payload); - break; - case HFI_PROPERTY_PARAM_CODEC_MASK_SUPPORTED: -- parse_codecs_mask(&codecs, &domain, data); -+ if (rem_bytes <= sizeof(struct hfi_codec_mask_supported)) -+ return HFI_ERR_SYS_INSUFFICIENT_RESOURCES; -+ -+ ret = parse_codecs_mask(&codecs, &domain, payload); - break; - case HFI_PROPERTY_PARAM_UNCOMPRESSED_FORMAT_SUPPORTED: -- parse_raw_formats(core, codecs, domain, data); -+ if (rem_bytes <= sizeof(struct hfi_uncompressed_format_supported)) -+ return HFI_ERR_SYS_INSUFFICIENT_RESOURCES; -+ -+ ret = parse_raw_formats(core, codecs, domain, payload); - break; - case HFI_PROPERTY_PARAM_CAPABILITY_SUPPORTED: -- parse_caps(core, codecs, domain, data); -+ if (rem_bytes <= sizeof(struct hfi_capabilities)) -+ return HFI_ERR_SYS_INSUFFICIENT_RESOURCES; -+ -+ ret = parse_caps(core, codecs, domain, payload); - break; - case HFI_PROPERTY_PARAM_PROFILE_LEVEL_SUPPORTED: -- parse_profile_level(core, codecs, domain, data); -+ if (rem_bytes <= sizeof(struct hfi_profile_level_supported)) -+ return HFI_ERR_SYS_INSUFFICIENT_RESOURCES; -+ -+ ret = parse_profile_level(core, codecs, domain, payload); - break; - case HFI_PROPERTY_PARAM_BUFFER_ALLOC_MODE_SUPPORTED: -- parse_alloc_mode(core, codecs, domain, data); -+ if (rem_bytes <= sizeof(struct hfi_buffer_alloc_mode_supported)) -+ return HFI_ERR_SYS_INSUFFICIENT_RESOURCES; -+ -+ ret = parse_alloc_mode(core, codecs, domain, payload); - break; - default: -+ ret = sizeof(u32); - break; - } - -- word++; -- words_count--; -+ if (ret < 0) -+ return HFI_ERR_SYS_INSUFFICIENT_RESOURCES; -+ -+ words += ret / sizeof(u32); -+ rem_bytes -= ret; - } - - if (!core->max_sessions_supported) -diff --git a/drivers/media/platform/qcom/venus/hfi_venus.c b/drivers/media/platform/qcom/venus/hfi_venus.c -index f9437b6412b91c..ab93757fff4b31 100644 ---- a/drivers/media/platform/qcom/venus/hfi_venus.c -+++ b/drivers/media/platform/qcom/venus/hfi_venus.c -@@ -187,6 +187,9 @@ static int venus_write_queue(struct venus_hfi_device *hdev, - /* ensure rd/wr indices's are read from memory */ - rmb(); - -+ if (qsize > IFACEQ_QUEUE_SIZE / 4) -+ return -EINVAL; -+ - if (wr_idx >= rd_idx) - empty_space = qsize - (wr_idx - rd_idx); - else -@@ -255,6 +258,9 @@ static int venus_read_queue(struct venus_hfi_device *hdev, - wr_idx = qhdr->write_idx; - qsize = qhdr->q_size; - -+ if (qsize > IFACEQ_QUEUE_SIZE / 4) -+ return -EINVAL; -+ - /* make sure data is valid before using it */ - rmb(); - -@@ -1035,18 +1041,26 @@ static void venus_sfr_print(struct venus_hfi_device *hdev) - { - struct device *dev = hdev->core->dev; - struct hfi_sfr *sfr = hdev->sfr.kva; -+ u32 size; - void *p; - - if (!sfr) - return; - -- p = memchr(sfr->data, '\0', sfr->buf_size); -+ size = sfr->buf_size; -+ if (!size) -+ return; -+ -+ if (size > ALIGNED_SFR_SIZE) -+ size = ALIGNED_SFR_SIZE; -+ -+ p = memchr(sfr->data, '\0', size); - /* - * SFR isn't guaranteed to be NULL terminated since SYS_ERROR indicates - * that Venus is in the process of crashing. - */ - if (!p) -- sfr->data[sfr->buf_size - 1] = '\0'; -+ sfr->data[size - 1] = '\0'; - - dev_err_ratelimited(dev, "SFR message from FW: %s\n", sfr->data); - } -diff --git a/drivers/media/platform/st/stm32/dma2d/dma2d.c b/drivers/media/platform/st/stm32/dma2d/dma2d.c -index 92f1edee58f899..3c64e91260250e 100644 ---- a/drivers/media/platform/st/stm32/dma2d/dma2d.c -+++ b/drivers/media/platform/st/stm32/dma2d/dma2d.c -@@ -492,7 +492,8 @@ static void device_run(void *prv) - dst->sequence = frm_cap->sequence++; - v4l2_m2m_buf_copy_metadata(src, dst, true); - -- clk_enable(dev->gate); -+ if (clk_enable(dev->gate)) -+ goto end; - - dma2d_config_fg(dev, frm_out, - vb2_dma_contig_plane_dma_addr(&src->vb2_buf, 0)); -diff --git a/drivers/media/rc/streamzap.c b/drivers/media/rc/streamzap.c -index 2ce62fe5d60f5a..d3b48a0dd1f474 100644 ---- a/drivers/media/rc/streamzap.c -+++ b/drivers/media/rc/streamzap.c -@@ -138,39 +138,10 @@ static void sz_push_half_space(struct streamzap_ir *sz, - sz_push_full_space(sz, value & SZ_SPACE_MASK); - } - --/* -- * streamzap_callback - usb IRQ handler callback -- * -- * This procedure is invoked on reception of data from -- * the usb remote. -- */ --static void streamzap_callback(struct urb *urb) -+static void sz_process_ir_data(struct streamzap_ir *sz, int len) - { -- struct streamzap_ir *sz; - unsigned int i; -- int len; -- -- if (!urb) -- return; -- -- sz = urb->context; -- len = urb->actual_length; -- -- switch (urb->status) { -- case -ECONNRESET: -- case -ENOENT: -- case -ESHUTDOWN: -- /* -- * this urb is terminated, clean up. -- * sz might already be invalid at this point -- */ -- dev_err(sz->dev, "urb terminated, status: %d\n", urb->status); -- return; -- default: -- break; -- } - -- dev_dbg(sz->dev, "%s: received urb, len %d\n", __func__, len); - for (i = 0; i < len; i++) { - dev_dbg(sz->dev, "sz->buf_in[%d]: %x\n", - i, (unsigned char)sz->buf_in[i]); -@@ -219,6 +190,43 @@ static void streamzap_callback(struct urb *urb) - } - - ir_raw_event_handle(sz->rdev); -+} -+ -+/* -+ * streamzap_callback - usb IRQ handler callback -+ * -+ * This procedure is invoked on reception of data from -+ * the usb remote. -+ */ -+static void streamzap_callback(struct urb *urb) -+{ -+ struct streamzap_ir *sz; -+ int len; -+ -+ if (!urb) -+ return; -+ -+ sz = urb->context; -+ len = urb->actual_length; -+ -+ switch (urb->status) { -+ case 0: -+ dev_dbg(sz->dev, "%s: received urb, len %d\n", __func__, len); -+ sz_process_ir_data(sz, len); -+ break; -+ case -ECONNRESET: -+ case -ENOENT: -+ case -ESHUTDOWN: -+ /* -+ * this urb is terminated, clean up. -+ * sz might already be invalid at this point -+ */ -+ dev_err(sz->dev, "urb terminated, status: %d\n", urb->status); -+ return; -+ default: -+ break; -+ } -+ - usb_submit_urb(urb, GFP_ATOMIC); - } - -diff --git a/drivers/media/test-drivers/vim2m.c b/drivers/media/test-drivers/vim2m.c -index 3e3b424b486058..8ca6459286ba6e 100644 ---- a/drivers/media/test-drivers/vim2m.c -+++ b/drivers/media/test-drivers/vim2m.c -@@ -1316,9 +1316,6 @@ static int vim2m_probe(struct platform_device *pdev) - vfd->v4l2_dev = &dev->v4l2_dev; - - video_set_drvdata(vfd, dev); -- v4l2_info(&dev->v4l2_dev, -- "Device registered as /dev/video%d\n", vfd->num); -- - platform_set_drvdata(pdev, dev); - - dev->m2m_dev = v4l2_m2m_init(&m2m_ops); -@@ -1345,6 +1342,9 @@ static int vim2m_probe(struct platform_device *pdev) - goto error_m2m; - } - -+ v4l2_info(&dev->v4l2_dev, -+ "Device registered as /dev/video%d\n", vfd->num); -+ - #ifdef CONFIG_MEDIA_CONTROLLER - ret = v4l2_m2m_register_media_controller(dev->m2m_dev, vfd, - MEDIA_ENT_F_PROC_VIDEO_SCALER); -diff --git a/drivers/media/test-drivers/visl/visl-core.c b/drivers/media/test-drivers/visl/visl-core.c -index 9970dc739ca56c..a28bb8ee21e98f 100644 ---- a/drivers/media/test-drivers/visl/visl-core.c -+++ b/drivers/media/test-drivers/visl/visl-core.c -@@ -156,9 +156,15 @@ static const struct visl_ctrl_desc visl_h264_ctrl_descs[] = { - }, - { - .cfg.id = V4L2_CID_STATELESS_H264_DECODE_MODE, -+ .cfg.min = V4L2_STATELESS_H264_DECODE_MODE_SLICE_BASED, -+ .cfg.max = V4L2_STATELESS_H264_DECODE_MODE_FRAME_BASED, -+ .cfg.def = V4L2_STATELESS_H264_DECODE_MODE_SLICE_BASED, - }, - { - .cfg.id = V4L2_CID_STATELESS_H264_START_CODE, -+ .cfg.min = V4L2_STATELESS_H264_START_CODE_NONE, -+ .cfg.max = V4L2_STATELESS_H264_START_CODE_ANNEX_B, -+ .cfg.def = V4L2_STATELESS_H264_START_CODE_NONE, - }, - { - .cfg.id = V4L2_CID_STATELESS_H264_SLICE_PARAMS, -@@ -193,9 +199,15 @@ static const struct visl_ctrl_desc visl_hevc_ctrl_descs[] = { - }, - { - .cfg.id = V4L2_CID_STATELESS_HEVC_DECODE_MODE, -+ .cfg.min = V4L2_STATELESS_HEVC_DECODE_MODE_SLICE_BASED, -+ .cfg.max = V4L2_STATELESS_HEVC_DECODE_MODE_FRAME_BASED, -+ .cfg.def = V4L2_STATELESS_HEVC_DECODE_MODE_SLICE_BASED, - }, - { - .cfg.id = V4L2_CID_STATELESS_HEVC_START_CODE, -+ .cfg.min = V4L2_STATELESS_HEVC_START_CODE_NONE, -+ .cfg.max = V4L2_STATELESS_HEVC_START_CODE_ANNEX_B, -+ .cfg.def = V4L2_STATELESS_HEVC_START_CODE_NONE, - }, - { - .cfg.id = V4L2_CID_STATELESS_HEVC_ENTRY_POINT_OFFSETS, -diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c -index ae2e8bd2b3f73d..02cfa12b9cb902 100644 ---- a/drivers/media/usb/uvc/uvc_driver.c -+++ b/drivers/media/usb/uvc/uvc_driver.c -@@ -3116,6 +3116,15 @@ static const struct usb_device_id uvc_ids[] = { - .bInterfaceProtocol = 0, - .driver_info = UVC_INFO_QUIRK(UVC_QUIRK_PROBE_MINMAX - | UVC_QUIRK_IGNORE_SELECTOR_UNIT) }, -+ /* Actions Microelectronics Co. Display capture-UVC05 */ -+ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE -+ | USB_DEVICE_ID_MATCH_INT_INFO, -+ .idVendor = 0x1de1, -+ .idProduct = 0xf105, -+ .bInterfaceClass = USB_CLASS_VIDEO, -+ .bInterfaceSubClass = 1, -+ .bInterfaceProtocol = 0, -+ .driver_info = UVC_INFO_QUIRK(UVC_QUIRK_DISABLE_AUTOSUSPEND) }, - /* NXP Semiconductors IR VIDEO */ - { .match_flags = USB_DEVICE_ID_MATCH_DEVICE - | USB_DEVICE_ID_MATCH_INT_INFO, -diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c -index 2cf5dcee0ce800..4d05873892c168 100644 ---- a/drivers/media/v4l2-core/v4l2-dv-timings.c -+++ b/drivers/media/v4l2-core/v4l2-dv-timings.c -@@ -764,7 +764,7 @@ bool v4l2_detect_gtf(unsigned int frame_height, - u64 num; - u32 den; - -- num = ((image_width * GTF_D_C_PRIME * (u64)hfreq) - -+ num = (((u64)image_width * GTF_D_C_PRIME * hfreq) - - ((u64)image_width * GTF_D_M_PRIME * 1000)); - den = (hfreq * (100 - GTF_D_C_PRIME) + GTF_D_M_PRIME * 1000) * - (2 * GTF_CELL_GRAN); -@@ -774,7 +774,7 @@ bool v4l2_detect_gtf(unsigned int frame_height, - u64 num; - u32 den; - -- num = ((image_width * GTF_S_C_PRIME * (u64)hfreq) - -+ num = (((u64)image_width * GTF_S_C_PRIME * hfreq) - - ((u64)image_width * GTF_S_M_PRIME * 1000)); - den = (hfreq * (100 - GTF_S_C_PRIME) + GTF_S_M_PRIME * 1000) * - (2 * GTF_CELL_GRAN); -diff --git a/drivers/mfd/ene-kb3930.c b/drivers/mfd/ene-kb3930.c -index fa0ad2f14a3961..9460a67acb0b5e 100644 ---- a/drivers/mfd/ene-kb3930.c -+++ b/drivers/mfd/ene-kb3930.c -@@ -162,7 +162,7 @@ static int kb3930_probe(struct i2c_client *client) - devm_gpiod_get_array_optional(dev, "off", GPIOD_IN); - if (IS_ERR(ddata->off_gpios)) - return PTR_ERR(ddata->off_gpios); -- if (ddata->off_gpios->ndescs < 2) { -+ if (ddata->off_gpios && ddata->off_gpios->ndescs < 2) { - dev_err(dev, "invalid off-gpios property\n"); - return -EINVAL; - } -diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c -index af519088732d9a..c95a2b0b9012c0 100644 ---- a/drivers/misc/pci_endpoint_test.c -+++ b/drivers/misc/pci_endpoint_test.c -@@ -243,7 +243,7 @@ static bool pci_endpoint_test_request_irq(struct pci_endpoint_test *test) - return true; - - fail: -- switch (irq_type) { -+ switch (test->irq_type) { - case IRQ_TYPE_LEGACY: - dev_err(dev, "Failed to request IRQ %d for Legacy\n", - pci_irq_vector(pdev, i)); -@@ -260,6 +260,9 @@ static bool pci_endpoint_test_request_irq(struct pci_endpoint_test *test) - break; - } - -+ test->num_irqs = i; -+ pci_endpoint_test_release_irq(test); -+ - return false; - } - -@@ -708,6 +711,7 @@ static bool pci_endpoint_test_set_irq(struct pci_endpoint_test *test, - if (!pci_endpoint_test_request_irq(test)) - goto err; - -+ irq_type = test->irq_type; - return true; - - err: -diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c -index 02bee7afab37ef..f97caaa829f707 100644 ---- a/drivers/mmc/host/dw_mmc.c -+++ b/drivers/mmc/host/dw_mmc.c -@@ -2574,6 +2574,91 @@ static void dw_mci_pull_data64(struct dw_mci *host, void *buf, int cnt) - } - } - -+static void dw_mci_push_data64_32(struct dw_mci *host, void *buf, int cnt) -+{ -+ struct mmc_data *data = host->data; -+ int init_cnt = cnt; -+ -+ /* try and push anything in the part_buf */ -+ if (unlikely(host->part_buf_count)) { -+ int len = dw_mci_push_part_bytes(host, buf, cnt); -+ -+ buf += len; -+ cnt -= len; -+ -+ if (host->part_buf_count == 8) { -+ mci_fifo_l_writeq(host->fifo_reg, host->part_buf); -+ host->part_buf_count = 0; -+ } -+ } -+#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS -+ if (unlikely((unsigned long)buf & 0x7)) { -+ while (cnt >= 8) { -+ u64 aligned_buf[16]; -+ int len = min(cnt & -8, (int)sizeof(aligned_buf)); -+ int items = len >> 3; -+ int i; -+ /* memcpy from input buffer into aligned buffer */ -+ memcpy(aligned_buf, buf, len); -+ buf += len; -+ cnt -= len; -+ /* push data from aligned buffer into fifo */ -+ for (i = 0; i < items; ++i) -+ mci_fifo_l_writeq(host->fifo_reg, aligned_buf[i]); -+ } -+ } else -+#endif -+ { -+ u64 *pdata = buf; -+ -+ for (; cnt >= 8; cnt -= 8) -+ mci_fifo_l_writeq(host->fifo_reg, *pdata++); -+ buf = pdata; -+ } -+ /* put anything remaining in the part_buf */ -+ if (cnt) { -+ dw_mci_set_part_bytes(host, buf, cnt); -+ /* Push data if we have reached the expected data length */ -+ if ((data->bytes_xfered + init_cnt) == -+ (data->blksz * data->blocks)) -+ mci_fifo_l_writeq(host->fifo_reg, host->part_buf); -+ } -+} -+ -+static void dw_mci_pull_data64_32(struct dw_mci *host, void *buf, int cnt) -+{ -+#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS -+ if (unlikely((unsigned long)buf & 0x7)) { -+ while (cnt >= 8) { -+ /* pull data from fifo into aligned buffer */ -+ u64 aligned_buf[16]; -+ int len = min(cnt & -8, (int)sizeof(aligned_buf)); -+ int items = len >> 3; -+ int i; -+ -+ for (i = 0; i < items; ++i) -+ aligned_buf[i] = mci_fifo_l_readq(host->fifo_reg); -+ -+ /* memcpy from aligned buffer into output buffer */ -+ memcpy(buf, aligned_buf, len); -+ buf += len; -+ cnt -= len; -+ } -+ } else -+#endif -+ { -+ u64 *pdata = buf; -+ -+ for (; cnt >= 8; cnt -= 8) -+ *pdata++ = mci_fifo_l_readq(host->fifo_reg); -+ buf = pdata; -+ } -+ if (cnt) { -+ host->part_buf = mci_fifo_l_readq(host->fifo_reg); -+ dw_mci_pull_final_bytes(host, buf, cnt); -+ } -+} -+ - static void dw_mci_pull_data(struct dw_mci *host, void *buf, int cnt) - { - int len; -@@ -3374,8 +3459,13 @@ int dw_mci_probe(struct dw_mci *host) - width = 16; - host->data_shift = 1; - } else if (i == 2) { -- host->push_data = dw_mci_push_data64; -- host->pull_data = dw_mci_pull_data64; -+ if ((host->quirks & DW_MMC_QUIRK_FIFO64_32)) { -+ host->push_data = dw_mci_push_data64_32; -+ host->pull_data = dw_mci_pull_data64_32; -+ } else { -+ host->push_data = dw_mci_push_data64; -+ host->pull_data = dw_mci_pull_data64; -+ } - width = 64; - host->data_shift = 3; - } else { -diff --git a/drivers/mmc/host/dw_mmc.h b/drivers/mmc/host/dw_mmc.h -index 4ed81f94f7cabd..af16dbb37f2617 100644 ---- a/drivers/mmc/host/dw_mmc.h -+++ b/drivers/mmc/host/dw_mmc.h -@@ -280,6 +280,8 @@ struct dw_mci_board { - - /* Support for longer data read timeout */ - #define DW_MMC_QUIRK_EXTENDED_TMOUT BIT(0) -+/* Force 32-bit access to the FIFO */ -+#define DW_MMC_QUIRK_FIFO64_32 BIT(1) - - #define DW_MMC_240A 0x240a - #define DW_MMC_280A 0x280a -@@ -471,6 +473,31 @@ struct dw_mci_board { - #define mci_fifo_writel(__value, __reg) __raw_writel(__reg, __value) - #define mci_fifo_writeq(__value, __reg) __raw_writeq(__reg, __value) - -+/* -+ * Some dw_mmc devices have 64-bit FIFOs, but expect them to be -+ * accessed using two 32-bit accesses. If such controller is used -+ * with a 64-bit kernel, this has to be done explicitly. -+ */ -+static inline u64 mci_fifo_l_readq(void __iomem *addr) -+{ -+ u64 ans; -+ u32 proxy[2]; -+ -+ proxy[0] = mci_fifo_readl(addr); -+ proxy[1] = mci_fifo_readl(addr + 4); -+ memcpy(&ans, proxy, 8); -+ return ans; -+} -+ -+static inline void mci_fifo_l_writeq(void __iomem *addr, u64 value) -+{ -+ u32 proxy[2]; -+ -+ memcpy(proxy, &value, 8); -+ mci_fifo_writel(addr, proxy[0]); -+ mci_fifo_writel(addr + 4, proxy[1]); -+} -+ - /* Register access macros */ - #define mci_readl(dev, reg) \ - readl_relaxed((dev)->regs + SDMMC_##reg) -diff --git a/drivers/mtd/inftlcore.c b/drivers/mtd/inftlcore.c -index 9739387cff8c91..58c6e1743f5c65 100644 ---- a/drivers/mtd/inftlcore.c -+++ b/drivers/mtd/inftlcore.c -@@ -482,10 +482,11 @@ static inline u16 INFTL_findwriteunit(struct INFTLrecord *inftl, unsigned block) - silly = MAX_LOOPS; - - while (thisEUN <= inftl->lastEUN) { -- inftl_read_oob(mtd, (thisEUN * inftl->EraseSize) + -- blockofs, 8, &retlen, (char *)&bci); -- -- status = bci.Status | bci.Status1; -+ if (inftl_read_oob(mtd, (thisEUN * inftl->EraseSize) + -+ blockofs, 8, &retlen, (char *)&bci) < 0) -+ status = SECTOR_IGNORE; -+ else -+ status = bci.Status | bci.Status1; - pr_debug("INFTL: status of block %d in EUN %d is %x\n", - block , writeEUN, status); - -diff --git a/drivers/mtd/mtdpstore.c b/drivers/mtd/mtdpstore.c -index 7ac8ac90130685..9cf3872e37ae14 100644 ---- a/drivers/mtd/mtdpstore.c -+++ b/drivers/mtd/mtdpstore.c -@@ -417,11 +417,14 @@ static void mtdpstore_notify_add(struct mtd_info *mtd) - } - - longcnt = BITS_TO_LONGS(div_u64(mtd->size, info->kmsg_size)); -- cxt->rmmap = kcalloc(longcnt, sizeof(long), GFP_KERNEL); -- cxt->usedmap = kcalloc(longcnt, sizeof(long), GFP_KERNEL); -+ cxt->rmmap = devm_kcalloc(&mtd->dev, longcnt, sizeof(long), GFP_KERNEL); -+ cxt->usedmap = devm_kcalloc(&mtd->dev, longcnt, sizeof(long), GFP_KERNEL); - - longcnt = BITS_TO_LONGS(div_u64(mtd->size, mtd->erasesize)); -- cxt->badmap = kcalloc(longcnt, sizeof(long), GFP_KERNEL); -+ cxt->badmap = devm_kcalloc(&mtd->dev, longcnt, sizeof(long), GFP_KERNEL); -+ -+ if (!cxt->rmmap || !cxt->usedmap || !cxt->badmap) -+ return; - - /* just support dmesg right now */ - cxt->dev.flags = PSTORE_FLAGS_DMESG; -@@ -527,9 +530,6 @@ static void mtdpstore_notify_remove(struct mtd_info *mtd) - mtdpstore_flush_removed(cxt); - - unregister_pstore_device(&cxt->dev); -- kfree(cxt->badmap); -- kfree(cxt->usedmap); -- kfree(cxt->rmmap); - cxt->mtd = NULL; - cxt->index = -1; - } -diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c -index 085a16148a68d4..03d7e26d495375 100644 ---- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c -+++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c -@@ -2974,7 +2974,7 @@ static int brcmnand_resume(struct device *dev) - brcmnand_save_restore_cs_config(host, 1); - - /* Reset the chip, required by some chips after power-up */ -- nand_reset_op(chip); -+ nand_reset(chip, 0); - } - - return 0; -diff --git a/drivers/mtd/nand/raw/r852.c b/drivers/mtd/nand/raw/r852.c -index ed0cf732d20e40..36cfe03cd4ac3b 100644 ---- a/drivers/mtd/nand/raw/r852.c -+++ b/drivers/mtd/nand/raw/r852.c -@@ -387,6 +387,9 @@ static int r852_wait(struct nand_chip *chip) - static int r852_ready(struct nand_chip *chip) - { - struct r852_device *dev = r852_get_dev(nand_to_mtd(chip)); -+ if (dev->card_unstable) -+ return 0; -+ - return !(r852_read_reg(dev, R852_CARD_STA) & R852_CARD_STA_BUSY); - } - -diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c -index 4a2c9a9134d8c8..cfcda893f1a16d 100644 ---- a/drivers/net/dsa/b53/b53_common.c -+++ b/drivers/net/dsa/b53/b53_common.c -@@ -724,6 +724,15 @@ static void b53_enable_mib(struct b53_device *dev) - b53_write8(dev, B53_MGMT_PAGE, B53_GLOBAL_CONFIG, gc); - } - -+static void b53_enable_stp(struct b53_device *dev) -+{ -+ u8 gc; -+ -+ b53_read8(dev, B53_MGMT_PAGE, B53_GLOBAL_CONFIG, &gc); -+ gc |= GC_RX_BPDU_EN; -+ b53_write8(dev, B53_MGMT_PAGE, B53_GLOBAL_CONFIG, gc); -+} -+ - static u16 b53_default_pvid(struct b53_device *dev) - { - if (is5325(dev) || is5365(dev)) -@@ -863,6 +872,7 @@ static int b53_switch_reset(struct b53_device *dev) - } - - b53_enable_mib(dev); -+ b53_enable_stp(dev); - - return b53_flush_arl(dev, FAST_AGE_STATIC); - } -diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c -index 8b01ee3e684a38..da7260e505a2e4 100644 ---- a/drivers/net/dsa/mv88e6xxx/chip.c -+++ b/drivers/net/dsa/mv88e6xxx/chip.c -@@ -1742,6 +1742,8 @@ static int mv88e6xxx_vtu_get(struct mv88e6xxx_chip *chip, u16 vid, - if (!chip->info->ops->vtu_getnext) - return -EOPNOTSUPP; - -+ memset(entry, 0, sizeof(*entry)); -+ - entry->vid = vid ? vid - 1 : mv88e6xxx_max_vid(chip); - entry->valid = false; - -@@ -1877,7 +1879,16 @@ static int mv88e6xxx_mst_put(struct mv88e6xxx_chip *chip, u8 sid) - struct mv88e6xxx_mst *mst, *tmp; - int err; - -- if (!sid) -+ /* If the SID is zero, it is for a VLAN mapped to the default MSTI, -+ * and mv88e6xxx_stu_setup() made sure it is always present, and thus, -+ * should not be removed here. -+ * -+ * If the chip lacks STU support, numerically the "sid" variable will -+ * happen to also be zero, but we don't want to rely on that fact, so -+ * we explicitly test that first. In that case, there is also nothing -+ * to do here. -+ */ -+ if (!mv88e6xxx_has_stu(chip) || !sid) - return 0; - - list_for_each_entry_safe(mst, tmp, &chip->msts, node) { -@@ -3555,6 +3566,21 @@ static int mv88e6xxx_stats_setup(struct mv88e6xxx_chip *chip) - return mv88e6xxx_g1_stats_clear(chip); - } - -+static int mv88e6320_setup_errata(struct mv88e6xxx_chip *chip) -+{ -+ u16 dummy; -+ int err; -+ -+ /* Workaround for erratum -+ * 3.3 RGMII timing may be out of spec when transmit delay is enabled -+ */ -+ err = mv88e6xxx_port_hidden_write(chip, 0, 0xf, 0x7, 0xe000); -+ if (err) -+ return err; -+ -+ return mv88e6xxx_port_hidden_read(chip, 0, 0xf, 0x7, &dummy); -+} -+ - /* Check if the errata has already been applied. */ - static bool mv88e6390_setup_errata_applied(struct mv88e6xxx_chip *chip) - { -@@ -5005,6 +5031,7 @@ static const struct mv88e6xxx_ops mv88e6290_ops = { - - static const struct mv88e6xxx_ops mv88e6320_ops = { - /* MV88E6XXX_FAMILY_6320 */ -+ .setup_errata = mv88e6320_setup_errata, - .ieee_pri_map = mv88e6085_g1_ieee_pri_map, - .ip_pri_map = mv88e6085_g1_ip_pri_map, - .irl_init_all = mv88e6352_g2_irl_init_all, -@@ -5054,6 +5081,7 @@ static const struct mv88e6xxx_ops mv88e6320_ops = { - - static const struct mv88e6xxx_ops mv88e6321_ops = { - /* MV88E6XXX_FAMILY_6320 */ -+ .setup_errata = mv88e6320_setup_errata, - .ieee_pri_map = mv88e6085_g1_ieee_pri_map, - .ip_pri_map = mv88e6085_g1_ip_pri_map, - .irl_init_all = mv88e6352_g2_irl_init_all, -diff --git a/drivers/net/dsa/mv88e6xxx/devlink.c b/drivers/net/dsa/mv88e6xxx/devlink.c -index a08dab75e0c0c1..f57fde02077d22 100644 ---- a/drivers/net/dsa/mv88e6xxx/devlink.c -+++ b/drivers/net/dsa/mv88e6xxx/devlink.c -@@ -743,7 +743,8 @@ void mv88e6xxx_teardown_devlink_regions_global(struct dsa_switch *ds) - int i; - - for (i = 0; i < ARRAY_SIZE(mv88e6xxx_regions); i++) -- dsa_devlink_region_destroy(chip->regions[i]); -+ if (chip->regions[i]) -+ dsa_devlink_region_destroy(chip->regions[i]); - } - - void mv88e6xxx_teardown_devlink_regions_port(struct dsa_switch *ds, int port) -diff --git a/drivers/net/ethernet/amd/pds_core/debugfs.c b/drivers/net/ethernet/amd/pds_core/debugfs.c -index 4e8579ca1c8c71..51f3f73a839a9d 100644 ---- a/drivers/net/ethernet/amd/pds_core/debugfs.c -+++ b/drivers/net/ethernet/amd/pds_core/debugfs.c -@@ -154,8 +154,9 @@ void pdsc_debugfs_add_qcq(struct pdsc *pdsc, struct pdsc_qcq *qcq) - debugfs_create_u32("index", 0400, intr_dentry, &intr->index); - debugfs_create_u32("vector", 0400, intr_dentry, &intr->vector); - -- intr_ctrl_regset = kzalloc(sizeof(*intr_ctrl_regset), -- GFP_KERNEL); -+ intr_ctrl_regset = devm_kzalloc(pdsc->dev, -+ sizeof(*intr_ctrl_regset), -+ GFP_KERNEL); - if (!intr_ctrl_regset) - return; - intr_ctrl_regset->regs = intr_ctrl_regs; -diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c -index 8477a93cee6bd4..b77897aa06c4f5 100644 ---- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c -+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c -@@ -2273,6 +2273,7 @@ int cxgb4_init_ethtool_filters(struct adapter *adap) - eth_filter->port[i].bmap = bitmap_zalloc(nentries, GFP_KERNEL); - if (!eth_filter->port[i].bmap) { - ret = -ENOMEM; -+ kvfree(eth_filter->port[i].loc_array); - goto free_eth_finfo; - } - } -diff --git a/drivers/net/ethernet/google/gve/gve_ethtool.c b/drivers/net/ethernet/google/gve/gve_ethtool.c -index 233e5946905e7d..22317acf16ba4d 100644 ---- a/drivers/net/ethernet/google/gve/gve_ethtool.c -+++ b/drivers/net/ethernet/google/gve/gve_ethtool.c -@@ -356,7 +356,9 @@ gve_get_ethtool_stats(struct net_device *netdev, - */ - data[i++] = 0; - data[i++] = 0; -- data[i++] = tx->dqo_tx.tail - tx->dqo_tx.head; -+ data[i++] = -+ (tx->dqo_tx.tail - tx->dqo_tx.head) & -+ tx->mask; - } - do { - start = -diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h -index 85cc163965062e..49702169a3d8a6 100644 ---- a/drivers/net/ethernet/intel/igc/igc.h -+++ b/drivers/net/ethernet/intel/igc/igc.h -@@ -266,6 +266,7 @@ struct igc_adapter { - struct timespec64 prev_ptp_time; /* Pre-reset PTP clock */ - ktime_t ptp_reset_start; /* Reset time in clock mono */ - struct system_time_snapshot snapshot; -+ struct mutex ptm_lock; /* Only allow one PTM transaction at a time */ - - char fw_version[32]; - -diff --git a/drivers/net/ethernet/intel/igc/igc_defines.h b/drivers/net/ethernet/intel/igc/igc_defines.h -index a18af5c87cde48..cf8b5ac51caaa7 100644 ---- a/drivers/net/ethernet/intel/igc/igc_defines.h -+++ b/drivers/net/ethernet/intel/igc/igc_defines.h -@@ -562,7 +562,10 @@ - #define IGC_PTM_CTRL_SHRT_CYC(usec) (((usec) & 0x3f) << 2) - #define IGC_PTM_CTRL_PTM_TO(usec) (((usec) & 0xff) << 8) - --#define IGC_PTM_SHORT_CYC_DEFAULT 1 /* Default short cycle interval */ -+/* A short cycle time of 1us theoretically should work, but appears to be too -+ * short in practice. -+ */ -+#define IGC_PTM_SHORT_CYC_DEFAULT 4 /* Default short cycle interval */ - #define IGC_PTM_CYC_TIME_DEFAULT 5 /* Default PTM cycle time */ - #define IGC_PTM_TIMEOUT_DEFAULT 255 /* Default timeout for PTM errors */ - -@@ -581,6 +584,7 @@ - #define IGC_PTM_STAT_T4M1_OVFL BIT(3) /* T4 minus T1 overflow */ - #define IGC_PTM_STAT_ADJUST_1ST BIT(4) /* 1588 timer adjusted during 1st PTM cycle */ - #define IGC_PTM_STAT_ADJUST_CYC BIT(5) /* 1588 timer adjusted during non-1st PTM cycle */ -+#define IGC_PTM_STAT_ALL GENMASK(5, 0) /* Used to clear all status */ - - /* PCIe PTM Cycle Control */ - #define IGC_PTM_CYCLE_CTRL_CYC_TIME(msec) ((msec) & 0x3ff) /* PTM Cycle Time (msec) */ -diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c -index ae93b45cf55e8e..e2f5c4384455e0 100644 ---- a/drivers/net/ethernet/intel/igc/igc_main.c -+++ b/drivers/net/ethernet/intel/igc/igc_main.c -@@ -6951,6 +6951,7 @@ static int igc_probe(struct pci_dev *pdev, - - err_register: - igc_release_hw_control(adapter); -+ igc_ptp_stop(adapter); - err_eeprom: - if (!igc_check_reset_block(hw)) - igc_reset_phy(hw); -diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c -index 928f38792203a6..b6bb01a486d9d8 100644 ---- a/drivers/net/ethernet/intel/igc/igc_ptp.c -+++ b/drivers/net/ethernet/intel/igc/igc_ptp.c -@@ -943,45 +943,62 @@ static void igc_ptm_log_error(struct igc_adapter *adapter, u32 ptm_stat) - } - } - -+/* The PTM lock: adapter->ptm_lock must be held when calling igc_ptm_trigger() */ -+static void igc_ptm_trigger(struct igc_hw *hw) -+{ -+ u32 ctrl; -+ -+ /* To "manually" start the PTM cycle we need to set the -+ * trigger (TRIG) bit -+ */ -+ ctrl = rd32(IGC_PTM_CTRL); -+ ctrl |= IGC_PTM_CTRL_TRIG; -+ wr32(IGC_PTM_CTRL, ctrl); -+ /* Perform flush after write to CTRL register otherwise -+ * transaction may not start -+ */ -+ wrfl(); -+} -+ -+/* The PTM lock: adapter->ptm_lock must be held when calling igc_ptm_reset() */ -+static void igc_ptm_reset(struct igc_hw *hw) -+{ -+ u32 ctrl; -+ -+ ctrl = rd32(IGC_PTM_CTRL); -+ ctrl &= ~IGC_PTM_CTRL_TRIG; -+ wr32(IGC_PTM_CTRL, ctrl); -+ /* Write to clear all status */ -+ wr32(IGC_PTM_STAT, IGC_PTM_STAT_ALL); -+} -+ - static int igc_phc_get_syncdevicetime(ktime_t *device, - struct system_counterval_t *system, - void *ctx) - { -- u32 stat, t2_curr_h, t2_curr_l, ctrl; - struct igc_adapter *adapter = ctx; - struct igc_hw *hw = &adapter->hw; -+ u32 stat, t2_curr_h, t2_curr_l; - int err, count = 100; - ktime_t t1, t2_curr; - -- /* Get a snapshot of system clocks to use as historic value. */ -- ktime_get_snapshot(&adapter->snapshot); -- -+ /* Doing this in a loop because in the event of a -+ * badly timed (ha!) system clock adjustment, we may -+ * get PTM errors from the PCI root, but these errors -+ * are transitory. Repeating the process returns valid -+ * data eventually. -+ */ - do { -- /* Doing this in a loop because in the event of a -- * badly timed (ha!) system clock adjustment, we may -- * get PTM errors from the PCI root, but these errors -- * are transitory. Repeating the process returns valid -- * data eventually. -- */ -+ /* Get a snapshot of system clocks to use as historic value. */ -+ ktime_get_snapshot(&adapter->snapshot); - -- /* To "manually" start the PTM cycle we need to clear and -- * then set again the TRIG bit. -- */ -- ctrl = rd32(IGC_PTM_CTRL); -- ctrl &= ~IGC_PTM_CTRL_TRIG; -- wr32(IGC_PTM_CTRL, ctrl); -- ctrl |= IGC_PTM_CTRL_TRIG; -- wr32(IGC_PTM_CTRL, ctrl); -- -- /* The cycle only starts "for real" when software notifies -- * that it has read the registers, this is done by setting -- * VALID bit. -- */ -- wr32(IGC_PTM_STAT, IGC_PTM_STAT_VALID); -+ igc_ptm_trigger(hw); - - err = readx_poll_timeout(rd32, IGC_PTM_STAT, stat, - stat, IGC_PTM_STAT_SLEEP, - IGC_PTM_STAT_TIMEOUT); -+ igc_ptm_reset(hw); -+ - if (err < 0) { - netdev_err(adapter->netdev, "Timeout reading IGC_PTM_STAT register\n"); - return err; -@@ -990,15 +1007,7 @@ static int igc_phc_get_syncdevicetime(ktime_t *device, - if ((stat & IGC_PTM_STAT_VALID) == IGC_PTM_STAT_VALID) - break; - -- if (stat & ~IGC_PTM_STAT_VALID) { -- /* An error occurred, log it. */ -- igc_ptm_log_error(adapter, stat); -- /* The STAT register is write-1-to-clear (W1C), -- * so write the previous error status to clear it. -- */ -- wr32(IGC_PTM_STAT, stat); -- continue; -- } -+ igc_ptm_log_error(adapter, stat); - } while (--count); - - if (!count) { -@@ -1030,9 +1039,16 @@ static int igc_ptp_getcrosststamp(struct ptp_clock_info *ptp, - { - struct igc_adapter *adapter = container_of(ptp, struct igc_adapter, - ptp_caps); -+ int ret; -+ -+ /* This blocks until any in progress PTM transactions complete */ -+ mutex_lock(&adapter->ptm_lock); - -- return get_device_system_crosststamp(igc_phc_get_syncdevicetime, -- adapter, &adapter->snapshot, cts); -+ ret = get_device_system_crosststamp(igc_phc_get_syncdevicetime, -+ adapter, &adapter->snapshot, cts); -+ mutex_unlock(&adapter->ptm_lock); -+ -+ return ret; - } - - /** -@@ -1109,6 +1125,7 @@ void igc_ptp_init(struct igc_adapter *adapter) - - spin_lock_init(&adapter->ptp_tx_lock); - spin_lock_init(&adapter->tmreg_lock); -+ mutex_init(&adapter->ptm_lock); - - adapter->tstamp_config.rx_filter = HWTSTAMP_FILTER_NONE; - adapter->tstamp_config.tx_type = HWTSTAMP_TX_OFF; -@@ -1121,6 +1138,7 @@ void igc_ptp_init(struct igc_adapter *adapter) - if (IS_ERR(adapter->ptp_clock)) { - adapter->ptp_clock = NULL; - netdev_err(netdev, "ptp_clock_register failed\n"); -+ mutex_destroy(&adapter->ptm_lock); - } else if (adapter->ptp_clock) { - netdev_info(netdev, "PHC added\n"); - adapter->ptp_flags |= IGC_PTP_ENABLED; -@@ -1150,10 +1168,12 @@ static void igc_ptm_stop(struct igc_adapter *adapter) - struct igc_hw *hw = &adapter->hw; - u32 ctrl; - -+ mutex_lock(&adapter->ptm_lock); - ctrl = rd32(IGC_PTM_CTRL); - ctrl &= ~IGC_PTM_CTRL_EN; - - wr32(IGC_PTM_CTRL, ctrl); -+ mutex_unlock(&adapter->ptm_lock); - } - - /** -@@ -1184,13 +1204,18 @@ void igc_ptp_suspend(struct igc_adapter *adapter) - **/ - void igc_ptp_stop(struct igc_adapter *adapter) - { -+ if (!(adapter->ptp_flags & IGC_PTP_ENABLED)) -+ return; -+ - igc_ptp_suspend(adapter); - -+ adapter->ptp_flags &= ~IGC_PTP_ENABLED; - if (adapter->ptp_clock) { - ptp_clock_unregister(adapter->ptp_clock); - netdev_info(adapter->netdev, "PHC removed\n"); - adapter->ptp_flags &= ~IGC_PTP_ENABLED; - } -+ mutex_destroy(&adapter->ptm_lock); - } - - /** -@@ -1202,10 +1227,13 @@ void igc_ptp_stop(struct igc_adapter *adapter) - void igc_ptp_reset(struct igc_adapter *adapter) - { - struct igc_hw *hw = &adapter->hw; -- u32 cycle_ctrl, ctrl; -+ u32 cycle_ctrl, ctrl, stat; - unsigned long flags; - u32 timadj; - -+ if (!(adapter->ptp_flags & IGC_PTP_ENABLED)) -+ return; -+ - /* reset the tstamp_config */ - igc_ptp_set_timestamp_mode(adapter, &adapter->tstamp_config); - -@@ -1227,6 +1255,7 @@ void igc_ptp_reset(struct igc_adapter *adapter) - if (!igc_is_crosststamp_supported(adapter)) - break; - -+ mutex_lock(&adapter->ptm_lock); - wr32(IGC_PCIE_DIG_DELAY, IGC_PCIE_DIG_DELAY_DEFAULT); - wr32(IGC_PCIE_PHY_DELAY, IGC_PCIE_PHY_DELAY_DEFAULT); - -@@ -1237,14 +1266,20 @@ void igc_ptp_reset(struct igc_adapter *adapter) - ctrl = IGC_PTM_CTRL_EN | - IGC_PTM_CTRL_START_NOW | - IGC_PTM_CTRL_SHRT_CYC(IGC_PTM_SHORT_CYC_DEFAULT) | -- IGC_PTM_CTRL_PTM_TO(IGC_PTM_TIMEOUT_DEFAULT) | -- IGC_PTM_CTRL_TRIG; -+ IGC_PTM_CTRL_PTM_TO(IGC_PTM_TIMEOUT_DEFAULT); - - wr32(IGC_PTM_CTRL, ctrl); - - /* Force the first cycle to run. */ -- wr32(IGC_PTM_STAT, IGC_PTM_STAT_VALID); -+ igc_ptm_trigger(hw); -+ -+ if (readx_poll_timeout_atomic(rd32, IGC_PTM_STAT, stat, -+ stat, IGC_PTM_STAT_SLEEP, -+ IGC_PTM_STAT_TIMEOUT)) -+ netdev_err(adapter->netdev, "Timeout reading IGC_PTM_STAT register\n"); - -+ igc_ptm_reset(hw); -+ mutex_unlock(&adapter->ptm_lock); - break; - default: - /* No work to do. */ -diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/qos.c b/drivers/net/ethernet/marvell/octeontx2/nic/qos.c -index 4995a2d54d7d08..37db19584c1431 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/nic/qos.c -+++ b/drivers/net/ethernet/marvell/octeontx2/nic/qos.c -@@ -165,6 +165,11 @@ static void __otx2_qos_txschq_cfg(struct otx2_nic *pfvf, - - otx2_config_sched_shaping(pfvf, node, cfg, &num_regs); - } else if (level == NIX_TXSCH_LVL_TL2) { -+ /* configure parent txschq */ -+ cfg->reg[num_regs] = NIX_AF_TL2X_PARENT(node->schq); -+ cfg->regval[num_regs] = (u64)hw->tx_link << 16; -+ num_regs++; -+ - /* configure link cfg */ - if (level == pfvf->qos.link_cfg_lvl) { - cfg->reg[num_regs] = NIX_AF_TL3_TL2X_LINKX_CFG(node->schq, hw->tx_link); -diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c -index bdc424123ee6cf..c201ea20e40476 100644 ---- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c -+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c -@@ -724,7 +724,7 @@ static void mtk_set_queue_speed(struct mtk_eth *eth, unsigned int idx, - case SPEED_100: - val |= MTK_QTX_SCH_MAX_RATE_EN | - FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 103) | -- FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 3); -+ FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 3) | - FIELD_PREP(MTK_QTX_SCH_MAX_RATE_WEIGHT, 1); - break; - case SPEED_1000: -@@ -747,13 +747,13 @@ static void mtk_set_queue_speed(struct mtk_eth *eth, unsigned int idx, - case SPEED_100: - val |= MTK_QTX_SCH_MAX_RATE_EN | - FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 1) | -- FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 5); -+ FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 5) | - FIELD_PREP(MTK_QTX_SCH_MAX_RATE_WEIGHT, 1); - break; - case SPEED_1000: - val |= MTK_QTX_SCH_MAX_RATE_EN | -- FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 10) | -- FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 5) | -+ FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 1) | -+ FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 6) | - FIELD_PREP(MTK_QTX_SCH_MAX_RATE_WEIGHT, 10); - break; - default: -@@ -3244,7 +3244,7 @@ static int mtk_start_dma(struct mtk_eth *eth) - if (mtk_is_netsys_v2_or_greater(eth)) - val |= MTK_MUTLI_CNT | MTK_RESV_BUF | - MTK_WCOMP_EN | MTK_DMAD_WR_WDONE | -- MTK_CHK_DDONE_EN | MTK_LEAKY_BUCKET_EN; -+ MTK_CHK_DDONE_EN; - else - val |= MTK_RX_BT_32DWORDS; - mtk_w32(eth, val, reg_map->qdma.glo_cfg); -diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c -index 8ffc1fbb036f9f..9c8376b2718916 100644 ---- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c -+++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c -@@ -626,7 +626,7 @@ static int am65_cpsw_nuss_ndo_slave_open(struct net_device *ndev) - /* mac_sl should be configured via phy-link interface */ - am65_cpsw_sl_ctl_reset(port); - -- ret = phylink_of_phy_connect(port->slave.phylink, port->slave.phy_node, 0); -+ ret = phylink_of_phy_connect(port->slave.phylink, port->slave.port_np, 0); - if (ret) - goto error_cleanup; - -@@ -2076,7 +2076,7 @@ static int am65_cpsw_nuss_init_slave_ports(struct am65_cpsw_common *common) - of_property_read_bool(port_np, "ti,mac-only"); - - /* get phy/link info */ -- port->slave.phy_node = port_np; -+ port->slave.port_np = of_node_get(port_np); - ret = of_get_phy_mode(port_np, &port->slave.phy_if); - if (ret) { - dev_err(dev, "%pOF read phy-mode err %d\n", -@@ -2134,6 +2134,17 @@ static void am65_cpsw_nuss_phylink_cleanup(struct am65_cpsw_common *common) - } - } - -+static void am65_cpsw_remove_dt(struct am65_cpsw_common *common) -+{ -+ struct am65_cpsw_port *port; -+ int i; -+ -+ for (i = 0; i < common->port_num; i++) { -+ port = &common->ports[i]; -+ of_node_put(port->slave.port_np); -+ } -+} -+ - static int - am65_cpsw_nuss_init_port_ndev(struct am65_cpsw_common *common, u32 port_idx) - { -@@ -2217,7 +2228,7 @@ am65_cpsw_nuss_init_port_ndev(struct am65_cpsw_common *common, u32 port_idx) - } - - phylink = phylink_create(&port->slave.phylink_config, -- of_node_to_fwnode(port->slave.phy_node), -+ of_node_to_fwnode(port->slave.port_np), - port->slave.phy_if, - &am65_cpsw_phylink_mac_ops); - if (IS_ERR(phylink)) -@@ -3009,6 +3020,7 @@ static int am65_cpsw_nuss_probe(struct platform_device *pdev) - err_free_phylink: - am65_cpsw_nuss_phylink_cleanup(common); - am65_cpts_release(common->cpts); -+ am65_cpsw_remove_dt(common); - err_of_clear: - if (common->mdio_dev) - of_platform_device_destroy(common->mdio_dev, NULL); -@@ -3040,6 +3052,7 @@ static int am65_cpsw_nuss_remove(struct platform_device *pdev) - am65_cpsw_nuss_phylink_cleanup(common); - am65_cpts_release(common->cpts); - am65_cpsw_disable_serdes_phy(common); -+ am65_cpsw_remove_dt(common); - - if (common->mdio_dev) - of_platform_device_destroy(common->mdio_dev, NULL); -diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.h b/drivers/net/ethernet/ti/am65-cpsw-nuss.h -index f3dad2ab9828be..f107198e25721c 100644 ---- a/drivers/net/ethernet/ti/am65-cpsw-nuss.h -+++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.h -@@ -29,7 +29,7 @@ struct am65_cpts; - struct am65_cpsw_slave_data { - bool mac_only; - struct cpsw_sl *mac_sl; -- struct device_node *phy_node; -+ struct device_node *port_np; - phy_interface_t phy_if; - struct phy *ifphy; - struct phy *serdes_phy; -diff --git a/drivers/net/ethernet/ti/icssg/icss_iep.c b/drivers/net/ethernet/ti/icssg/icss_iep.c -index 3f9a030471fe2f..f3315c65151561 100644 ---- a/drivers/net/ethernet/ti/icssg/icss_iep.c -+++ b/drivers/net/ethernet/ti/icssg/icss_iep.c -@@ -476,66 +476,79 @@ static void icss_iep_update_to_next_boundary(struct icss_iep *iep, u64 start_ns) - static int icss_iep_perout_enable_hw(struct icss_iep *iep, - struct ptp_perout_request *req, int on) - { -+ struct timespec64 ts; -+ u64 ns_start; -+ u64 ns_width; - int ret; - u64 cmp; - -+ if (!on) { -+ /* Disable CMP 1 */ -+ regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG, -+ IEP_CMP_CFG_CMP_EN(1), 0); -+ -+ /* clear CMP regs */ -+ regmap_write(iep->map, ICSS_IEP_CMP1_REG0, 0); -+ if (iep->plat_data->flags & ICSS_IEP_64BIT_COUNTER_SUPPORT) -+ regmap_write(iep->map, ICSS_IEP_CMP1_REG1, 0); -+ -+ /* Disable sync */ -+ regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, 0); -+ -+ return 0; -+ } -+ -+ /* Calculate width of the signal for PPS/PEROUT handling */ -+ ts.tv_sec = req->on.sec; -+ ts.tv_nsec = req->on.nsec; -+ ns_width = timespec64_to_ns(&ts); -+ -+ if (req->flags & PTP_PEROUT_PHASE) { -+ ts.tv_sec = req->phase.sec; -+ ts.tv_nsec = req->phase.nsec; -+ ns_start = timespec64_to_ns(&ts); -+ } else { -+ ns_start = 0; -+ } -+ - if (iep->ops && iep->ops->perout_enable) { - ret = iep->ops->perout_enable(iep->clockops_data, req, on, &cmp); - if (ret) - return ret; - -- if (on) { -- /* Configure CMP */ -- regmap_write(iep->map, ICSS_IEP_CMP1_REG0, lower_32_bits(cmp)); -- if (iep->plat_data->flags & ICSS_IEP_64BIT_COUNTER_SUPPORT) -- regmap_write(iep->map, ICSS_IEP_CMP1_REG1, upper_32_bits(cmp)); -- /* Configure SYNC, 1ms pulse width */ -- regmap_write(iep->map, ICSS_IEP_SYNC_PWIDTH_REG, 1000000); -- regmap_write(iep->map, ICSS_IEP_SYNC0_PERIOD_REG, 0); -- regmap_write(iep->map, ICSS_IEP_SYNC_START_REG, 0); -- regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, 0); /* one-shot mode */ -- /* Enable CMP 1 */ -- regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG, -- IEP_CMP_CFG_CMP_EN(1), IEP_CMP_CFG_CMP_EN(1)); -- } else { -- /* Disable CMP 1 */ -- regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG, -- IEP_CMP_CFG_CMP_EN(1), 0); -- -- /* clear regs */ -- regmap_write(iep->map, ICSS_IEP_CMP1_REG0, 0); -- if (iep->plat_data->flags & ICSS_IEP_64BIT_COUNTER_SUPPORT) -- regmap_write(iep->map, ICSS_IEP_CMP1_REG1, 0); -- } -+ /* Configure CMP */ -+ regmap_write(iep->map, ICSS_IEP_CMP1_REG0, lower_32_bits(cmp)); -+ if (iep->plat_data->flags & ICSS_IEP_64BIT_COUNTER_SUPPORT) -+ regmap_write(iep->map, ICSS_IEP_CMP1_REG1, upper_32_bits(cmp)); -+ /* Configure SYNC, based on req on width */ -+ regmap_write(iep->map, ICSS_IEP_SYNC_PWIDTH_REG, -+ div_u64(ns_width, iep->def_inc)); -+ regmap_write(iep->map, ICSS_IEP_SYNC0_PERIOD_REG, 0); -+ regmap_write(iep->map, ICSS_IEP_SYNC_START_REG, -+ div_u64(ns_start, iep->def_inc)); -+ regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, 0); /* one-shot mode */ -+ /* Enable CMP 1 */ -+ regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG, -+ IEP_CMP_CFG_CMP_EN(1), IEP_CMP_CFG_CMP_EN(1)); - } else { -- if (on) { -- u64 start_ns; -- -- iep->period = ((u64)req->period.sec * NSEC_PER_SEC) + -- req->period.nsec; -- start_ns = ((u64)req->period.sec * NSEC_PER_SEC) -- + req->period.nsec; -- icss_iep_update_to_next_boundary(iep, start_ns); -- -- /* Enable Sync in single shot mode */ -- regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, -- IEP_SYNC_CTRL_SYNC_N_EN(0) | IEP_SYNC_CTRL_SYNC_EN); -- /* Enable CMP 1 */ -- regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG, -- IEP_CMP_CFG_CMP_EN(1), IEP_CMP_CFG_CMP_EN(1)); -- } else { -- /* Disable CMP 1 */ -- regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG, -- IEP_CMP_CFG_CMP_EN(1), 0); -- -- /* clear CMP regs */ -- regmap_write(iep->map, ICSS_IEP_CMP1_REG0, 0); -- if (iep->plat_data->flags & ICSS_IEP_64BIT_COUNTER_SUPPORT) -- regmap_write(iep->map, ICSS_IEP_CMP1_REG1, 0); -- -- /* Disable sync */ -- regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, 0); -- } -+ u64 start_ns; -+ -+ iep->period = ((u64)req->period.sec * NSEC_PER_SEC) + -+ req->period.nsec; -+ start_ns = ((u64)req->period.sec * NSEC_PER_SEC) -+ + req->period.nsec; -+ icss_iep_update_to_next_boundary(iep, start_ns); -+ -+ regmap_write(iep->map, ICSS_IEP_SYNC_PWIDTH_REG, -+ div_u64(ns_width, iep->def_inc)); -+ regmap_write(iep->map, ICSS_IEP_SYNC_START_REG, -+ div_u64(ns_start, iep->def_inc)); -+ /* Enable Sync in single shot mode */ -+ regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, -+ IEP_SYNC_CTRL_SYNC_N_EN(0) | IEP_SYNC_CTRL_SYNC_EN); -+ /* Enable CMP 1 */ -+ regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG, -+ IEP_CMP_CFG_CMP_EN(1), IEP_CMP_CFG_CMP_EN(1)); - } - - return 0; -@@ -544,7 +557,41 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep, - static int icss_iep_perout_enable(struct icss_iep *iep, - struct ptp_perout_request *req, int on) - { -- return -EOPNOTSUPP; -+ int ret = 0; -+ -+ if (!on) -+ goto disable; -+ -+ /* Reject requests with unsupported flags */ -+ if (req->flags & ~(PTP_PEROUT_DUTY_CYCLE | -+ PTP_PEROUT_PHASE)) -+ return -EOPNOTSUPP; -+ -+ /* Set default "on" time (1ms) for the signal if not passed by the app */ -+ if (!(req->flags & PTP_PEROUT_DUTY_CYCLE)) { -+ req->on.sec = 0; -+ req->on.nsec = NSEC_PER_MSEC; -+ } -+ -+disable: -+ mutex_lock(&iep->ptp_clk_mutex); -+ -+ if (iep->pps_enabled) { -+ ret = -EBUSY; -+ goto exit; -+ } -+ -+ if (iep->perout_enabled == !!on) -+ goto exit; -+ -+ ret = icss_iep_perout_enable_hw(iep, req, on); -+ if (!ret) -+ iep->perout_enabled = !!on; -+ -+exit: -+ mutex_unlock(&iep->ptp_clk_mutex); -+ -+ return ret; - } - - static int icss_iep_pps_enable(struct icss_iep *iep, int on) -@@ -568,10 +615,13 @@ static int icss_iep_pps_enable(struct icss_iep *iep, int on) - if (on) { - ns = icss_iep_gettime(iep, NULL); - ts = ns_to_timespec64(ns); -+ rq.perout.flags = 0; - rq.perout.period.sec = 1; - rq.perout.period.nsec = 0; - rq.perout.start.sec = ts.tv_sec + 2; - rq.perout.start.nsec = 0; -+ rq.perout.on.sec = 0; -+ rq.perout.on.nsec = NSEC_PER_MSEC; - ret = icss_iep_perout_enable_hw(iep, &rq.perout, on); - } else { - ret = icss_iep_perout_enable_hw(iep, &rq.perout, on); -diff --git a/drivers/net/ethernet/wangxun/libwx/wx_lib.c b/drivers/net/ethernet/wangxun/libwx/wx_lib.c -index c37500aa063791..c019fe964eceaf 100644 ---- a/drivers/net/ethernet/wangxun/libwx/wx_lib.c -+++ b/drivers/net/ethernet/wangxun/libwx/wx_lib.c -@@ -311,7 +311,8 @@ static bool wx_alloc_mapped_page(struct wx_ring *rx_ring, - return true; - - page = page_pool_dev_alloc_pages(rx_ring->page_pool); -- WARN_ON(!page); -+ if (unlikely(!page)) -+ return false; - dma = page_pool_get_dma_addr(page); - - bi->page_dma = dma; -diff --git a/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c b/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c -index a4d63d2f3c5bbe..91f0f23c176a09 100644 ---- a/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c -+++ b/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c -@@ -589,7 +589,7 @@ static int ngbe_probe(struct pci_dev *pdev, - /* setup the private structure */ - err = ngbe_sw_init(wx); - if (err) -- goto err_free_mac_table; -+ goto err_pci_release_regions; - - /* check if flash load is done after hw power up */ - err = wx_check_flash_load(wx, NGBE_SPI_ILDR_STATUS_PERST); -@@ -687,6 +687,7 @@ static int ngbe_probe(struct pci_dev *pdev, - err_clear_interrupt_scheme: - wx_clear_interrupt_scheme(wx); - err_free_mac_table: -+ kfree(wx->rss_key); - kfree(wx->mac_table); - err_pci_release_regions: - pci_release_selected_regions(pdev, -diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c -index e0e4a68cda3ead..dc62f141f40382 100644 ---- a/drivers/net/phy/sfp.c -+++ b/drivers/net/phy/sfp.c -@@ -488,6 +488,8 @@ static const struct sfp_quirk sfp_quirks[] = { - - SFP_QUIRK_F("OEM", "SFP-10G-T", sfp_fixup_rollball_cc), - SFP_QUIRK_M("OEM", "SFP-2.5G-T", sfp_quirk_oem_2_5g), -+ SFP_QUIRK_M("OEM", "SFP-2.5G-BX10-D", sfp_quirk_2500basex), -+ SFP_QUIRK_M("OEM", "SFP-2.5G-BX10-U", sfp_quirk_2500basex), - SFP_QUIRK_F("OEM", "RTSFP-10", sfp_fixup_rollball_cc), - SFP_QUIRK_F("OEM", "RTSFP-10G", sfp_fixup_rollball_cc), - SFP_QUIRK_F("Turris", "RTSFP-10", sfp_fixup_rollball), -diff --git a/drivers/net/ppp/ppp_synctty.c b/drivers/net/ppp/ppp_synctty.c -index 52d05ce4a28198..02e1c5bd1892be 100644 ---- a/drivers/net/ppp/ppp_synctty.c -+++ b/drivers/net/ppp/ppp_synctty.c -@@ -506,6 +506,11 @@ ppp_sync_txmunge(struct syncppp *ap, struct sk_buff *skb) - unsigned char *data; - int islcp; - -+ /* Ensure we can safely access protocol field and LCP code */ -+ if (!pskb_may_pull(skb, 3)) { -+ kfree_skb(skb); -+ return NULL; -+ } - data = skb->data; - proto = get_unaligned_be16(data); - -diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c -index f7cff58fe04493..ec4dcf89cbedd2 100644 ---- a/drivers/net/usb/asix_devices.c -+++ b/drivers/net/usb/asix_devices.c -@@ -1421,6 +1421,19 @@ static const struct driver_info hg20f9_info = { - .data = FLAG_EEPROM_MAC, - }; - -+static const struct driver_info lyconsys_fibergecko100_info = { -+ .description = "LyconSys FiberGecko 100 USB 2.0 to SFP Adapter", -+ .bind = ax88178_bind, -+ .status = asix_status, -+ .link_reset = ax88178_link_reset, -+ .reset = ax88178_link_reset, -+ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR | -+ FLAG_MULTI_PACKET, -+ .rx_fixup = asix_rx_fixup_common, -+ .tx_fixup = asix_tx_fixup, -+ .data = 0x20061201, -+}; -+ - static const struct usb_device_id products [] = { - { - // Linksys USB200M -@@ -1578,6 +1591,10 @@ static const struct usb_device_id products [] = { - // Linux Automation GmbH USB 10Base-T1L - USB_DEVICE(0x33f7, 0x0004), - .driver_info = (unsigned long) &lxausb_t1l_info, -+}, { -+ /* LyconSys FiberGecko 100 */ -+ USB_DEVICE(0x1d2a, 0x0801), -+ .driver_info = (unsigned long) &lyconsys_fibergecko100_info, - }, - { }, // END - }; -diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c -index 6d61052353f078..a04f758b3ba071 100644 ---- a/drivers/net/usb/cdc_ether.c -+++ b/drivers/net/usb/cdc_ether.c -@@ -782,6 +782,13 @@ static const struct usb_device_id products[] = { - .driver_info = 0, - }, - -+/* Lenovo ThinkPad Hybrid USB-C with USB-A Dock (40af0135eu, based on Realtek RTL8153) */ -+{ -+ USB_DEVICE_AND_INTERFACE_INFO(LENOVO_VENDOR_ID, 0xa359, USB_CLASS_COMM, -+ USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE), -+ .driver_info = 0, -+}, -+ - /* Aquantia AQtion USB to 5GbE Controller (based on AQC111U) */ - { - USB_DEVICE_AND_INTERFACE_INFO(AQUANTIA_VENDOR_ID, 0xc101, -diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c -index 3e5998555f9814..bbcefcc7ef8f06 100644 ---- a/drivers/net/usb/r8152.c -+++ b/drivers/net/usb/r8152.c -@@ -784,6 +784,7 @@ enum rtl8152_flags { - #define DEVICE_ID_THINKPAD_USB_C_DONGLE 0x720c - #define DEVICE_ID_THINKPAD_USB_C_DOCK_GEN2 0xa387 - #define DEVICE_ID_THINKPAD_USB_C_DOCK_GEN3 0x3062 -+#define DEVICE_ID_THINKPAD_HYBRID_USB_C_DOCK 0xa359 - - struct tally_counter { - __le64 tx_packets; -@@ -9734,6 +9735,7 @@ static bool rtl8152_supports_lenovo_macpassthru(struct usb_device *udev) - case DEVICE_ID_THINKPAD_USB_C_DOCK_GEN2: - case DEVICE_ID_THINKPAD_USB_C_DOCK_GEN3: - case DEVICE_ID_THINKPAD_USB_C_DONGLE: -+ case DEVICE_ID_THINKPAD_HYBRID_USB_C_DOCK: - return 1; - } - } else if (vendor_id == VENDOR_ID_REALTEK && parent_vendor_id == VENDOR_ID_LENOVO) { -@@ -10011,6 +10013,8 @@ static const struct usb_device_id rtl8152_table[] = { - { USB_DEVICE(VENDOR_ID_MICROSOFT, 0x0927) }, - { USB_DEVICE(VENDOR_ID_MICROSOFT, 0x0c5e) }, - { USB_DEVICE(VENDOR_ID_SAMSUNG, 0xa101) }, -+ -+ /* Lenovo */ - { USB_DEVICE(VENDOR_ID_LENOVO, 0x304f) }, - { USB_DEVICE(VENDOR_ID_LENOVO, 0x3054) }, - { USB_DEVICE(VENDOR_ID_LENOVO, 0x3062) }, -@@ -10021,7 +10025,9 @@ static const struct usb_device_id rtl8152_table[] = { - { USB_DEVICE(VENDOR_ID_LENOVO, 0x720c) }, - { USB_DEVICE(VENDOR_ID_LENOVO, 0x7214) }, - { USB_DEVICE(VENDOR_ID_LENOVO, 0x721e) }, -+ { USB_DEVICE(VENDOR_ID_LENOVO, 0xa359) }, - { USB_DEVICE(VENDOR_ID_LENOVO, 0xa387) }, -+ - { USB_DEVICE(VENDOR_ID_LINKSYS, 0x0041) }, - { USB_DEVICE(VENDOR_ID_NVIDIA, 0x09ff) }, - { USB_DEVICE(VENDOR_ID_TPLINK, 0x0601) }, -diff --git a/drivers/net/usb/r8153_ecm.c b/drivers/net/usb/r8153_ecm.c -index 20b2df8d74ae1b..8d860dacdf49b2 100644 ---- a/drivers/net/usb/r8153_ecm.c -+++ b/drivers/net/usb/r8153_ecm.c -@@ -135,6 +135,12 @@ static const struct usb_device_id products[] = { - USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE), - .driver_info = (unsigned long)&r8153_info, - }, -+/* Lenovo ThinkPad Hybrid USB-C with USB-A Dock (40af0135eu, based on Realtek RTL8153) */ -+{ -+ USB_DEVICE_AND_INTERFACE_INFO(VENDOR_ID_LENOVO, 0xa359, USB_CLASS_COMM, -+ USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE), -+ .driver_info = (unsigned long)&r8153_info, -+}, - - { }, /* END */ - }; -diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c -index f1e57e98bdc60d..35f22a4a16cf20 100644 ---- a/drivers/net/wireless/ath/ath12k/dp_mon.c -+++ b/drivers/net/wireless/ath/ath12k/dp_mon.c -@@ -2571,7 +2571,7 @@ int ath12k_dp_mon_rx_process_stats(struct ath12k *ar, int mac_id, - dest_idx = 0; - move_next: - ath12k_dp_mon_buf_replenish(ab, buf_ring, 1); -- ath12k_hal_srng_src_get_next_entry(ab, srng); -+ ath12k_hal_srng_dst_get_next_entry(ab, srng); - num_buffs_reaped++; - } - -diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c -index 70ad035acac755..8d9315038a75e4 100644 ---- a/drivers/net/wireless/ath/ath12k/dp_rx.c -+++ b/drivers/net/wireless/ath/ath12k/dp_rx.c -@@ -2484,6 +2484,29 @@ static void ath12k_dp_rx_deliver_msdu(struct ath12k *ar, struct napi_struct *nap - ieee80211_rx_napi(ar->hw, pubsta, msdu, napi); - } - -+static bool ath12k_dp_rx_check_nwifi_hdr_len_valid(struct ath12k_base *ab, -+ struct hal_rx_desc *rx_desc, -+ struct sk_buff *msdu) -+{ -+ struct ieee80211_hdr *hdr; -+ u8 decap_type; -+ u32 hdr_len; -+ -+ decap_type = ath12k_dp_rx_h_decap_type(ab, rx_desc); -+ if (decap_type != DP_RX_DECAP_TYPE_NATIVE_WIFI) -+ return true; -+ -+ hdr = (struct ieee80211_hdr *)msdu->data; -+ hdr_len = ieee80211_hdrlen(hdr->frame_control); -+ -+ if ((likely(hdr_len <= DP_MAX_NWIFI_HDR_LEN))) -+ return true; -+ -+ ab->soc_stats.invalid_rbm++; -+ WARN_ON_ONCE(1); -+ return false; -+} -+ - static int ath12k_dp_rx_process_msdu(struct ath12k *ar, - struct sk_buff *msdu, - struct sk_buff_head *msdu_list, -@@ -2542,6 +2565,11 @@ static int ath12k_dp_rx_process_msdu(struct ath12k *ar, - } - } - -+ if (unlikely(!ath12k_dp_rx_check_nwifi_hdr_len_valid(ab, rx_desc, msdu))) { -+ ret = -EINVAL; -+ goto free_out; -+ } -+ - ath12k_dp_rx_h_ppdu(ar, rx_desc, rx_status); - ath12k_dp_rx_h_mpdu(ar, msdu, rx_desc, rx_status); - -@@ -2867,6 +2895,9 @@ static int ath12k_dp_rx_h_verify_tkip_mic(struct ath12k *ar, struct ath12k_peer - RX_FLAG_IV_STRIPPED | RX_FLAG_DECRYPTED; - skb_pull(msdu, hal_rx_desc_sz); - -+ if (unlikely(!ath12k_dp_rx_check_nwifi_hdr_len_valid(ab, rx_desc, msdu))) -+ return -EINVAL; -+ - ath12k_dp_rx_h_ppdu(ar, rx_desc, rxs); - ath12k_dp_rx_h_undecap(ar, msdu, rx_desc, - HAL_ENCRYPT_TYPE_TKIP_MIC, rxs, true); -@@ -3590,6 +3621,9 @@ static int ath12k_dp_rx_h_null_q_desc(struct ath12k *ar, struct sk_buff *msdu, - skb_put(msdu, hal_rx_desc_sz + l3pad_bytes + msdu_len); - skb_pull(msdu, hal_rx_desc_sz + l3pad_bytes); - } -+ if (unlikely(!ath12k_dp_rx_check_nwifi_hdr_len_valid(ab, desc, msdu))) -+ return -EINVAL; -+ - ath12k_dp_rx_h_ppdu(ar, desc, status); - - ath12k_dp_rx_h_mpdu(ar, msdu, desc, status); -@@ -3634,7 +3668,7 @@ static bool ath12k_dp_rx_h_reo_err(struct ath12k *ar, struct sk_buff *msdu, - return drop; - } - --static void ath12k_dp_rx_h_tkip_mic_err(struct ath12k *ar, struct sk_buff *msdu, -+static bool ath12k_dp_rx_h_tkip_mic_err(struct ath12k *ar, struct sk_buff *msdu, - struct ieee80211_rx_status *status) - { - struct ath12k_base *ab = ar->ab; -@@ -3652,6 +3686,9 @@ static void ath12k_dp_rx_h_tkip_mic_err(struct ath12k *ar, struct sk_buff *msdu, - skb_put(msdu, hal_rx_desc_sz + l3pad_bytes + msdu_len); - skb_pull(msdu, hal_rx_desc_sz + l3pad_bytes); - -+ if (unlikely(!ath12k_dp_rx_check_nwifi_hdr_len_valid(ab, desc, msdu))) -+ return true; -+ - ath12k_dp_rx_h_ppdu(ar, desc, status); - - status->flag |= (RX_FLAG_MMIC_STRIPPED | RX_FLAG_MMIC_ERROR | -@@ -3659,6 +3696,7 @@ static void ath12k_dp_rx_h_tkip_mic_err(struct ath12k *ar, struct sk_buff *msdu, - - ath12k_dp_rx_h_undecap(ar, msdu, desc, - HAL_ENCRYPT_TYPE_TKIP_MIC, status, false); -+ return false; - } - - static bool ath12k_dp_rx_h_rxdma_err(struct ath12k *ar, struct sk_buff *msdu, -@@ -3677,7 +3715,7 @@ static bool ath12k_dp_rx_h_rxdma_err(struct ath12k *ar, struct sk_buff *msdu, - case HAL_REO_ENTR_RING_RXDMA_ECODE_TKIP_MIC_ERR: - err_bitmap = ath12k_dp_rx_h_mpdu_err(ab, rx_desc); - if (err_bitmap & HAL_RX_MPDU_ERR_TKIP_MIC) { -- ath12k_dp_rx_h_tkip_mic_err(ar, msdu, status); -+ drop = ath12k_dp_rx_h_tkip_mic_err(ar, msdu, status); - break; - } - fallthrough; -diff --git a/drivers/net/wireless/atmel/at76c50x-usb.c b/drivers/net/wireless/atmel/at76c50x-usb.c -index 447b51cff8f96d..c1a92c7f0f8e88 100644 ---- a/drivers/net/wireless/atmel/at76c50x-usb.c -+++ b/drivers/net/wireless/atmel/at76c50x-usb.c -@@ -2554,7 +2554,7 @@ static void at76_disconnect(struct usb_interface *interface) - - wiphy_info(priv->hw->wiphy, "disconnecting\n"); - at76_delete_device(priv); -- usb_put_dev(priv->udev); -+ usb_put_dev(interface_to_usbdev(interface)); - dev_info(&interface->dev, "disconnected\n"); - } - -diff --git a/drivers/net/wireless/mediatek/mt76/eeprom.c b/drivers/net/wireless/mediatek/mt76/eeprom.c -index 1de3c734e136a4..49e6c866a57fc2 100644 ---- a/drivers/net/wireless/mediatek/mt76/eeprom.c -+++ b/drivers/net/wireless/mediatek/mt76/eeprom.c -@@ -95,6 +95,10 @@ static int mt76_get_of_epprom_from_mtd(struct mt76_dev *dev, void *eep, int offs - - #ifdef CONFIG_NL80211_TESTMODE - dev->test_mtd.name = devm_kstrdup(dev->dev, part, GFP_KERNEL); -+ if (!dev->test_mtd.name) { -+ ret = -ENOMEM; -+ goto out_put_node; -+ } - dev->test_mtd.offset = offset; - #endif - -diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c b/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c -index 55068f3252ef34..d8043099921966 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c -+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c -@@ -21,6 +21,7 @@ static const struct usb_device_id mt76x2u_device_table[] = { - { USB_DEVICE(0x0846, 0x9053) }, /* Netgear A6210 */ - { USB_DEVICE(0x045e, 0x02e6) }, /* XBox One Wireless Adapter */ - { USB_DEVICE(0x045e, 0x02fe) }, /* XBox One Wireless Adapter */ -+ { USB_DEVICE(0x2357, 0x0137) }, /* TP-Link TL-WDN6200 */ - { }, - }; - -diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c -index 535393eca5641c..d1d8fd812cbf6d 100644 ---- a/drivers/net/wireless/realtek/rtw89/core.c -+++ b/drivers/net/wireless/realtek/rtw89/core.c -@@ -3807,6 +3807,8 @@ static int rtw89_chip_efuse_info_setup(struct rtw89_dev *rtwdev) - rtw89_core_setup_phycap(rtwdev); - rtw89_core_setup_rfe_parms(rtwdev); - -+ rtw89_hci_mac_pre_deinit(rtwdev); -+ - rtw89_mac_pwr_off(rtwdev); - - return 0; -diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h -index ee6ae2a0c79815..16aad0f8393ab7 100644 ---- a/drivers/net/wireless/realtek/rtw89/core.h -+++ b/drivers/net/wireless/realtek/rtw89/core.h -@@ -2989,6 +2989,7 @@ struct rtw89_hci_ops { - void (*write32)(struct rtw89_dev *rtwdev, u32 addr, u32 data); - - int (*mac_pre_init)(struct rtw89_dev *rtwdev); -+ int (*mac_pre_deinit)(struct rtw89_dev *rtwdev); - int (*mac_post_init)(struct rtw89_dev *rtwdev); - int (*deinit)(struct rtw89_dev *rtwdev); - -@@ -4515,6 +4516,11 @@ static inline void rtw89_hci_tx_kick_off(struct rtw89_dev *rtwdev, u8 txch) - return rtwdev->hci.ops->tx_kick_off(rtwdev, txch); - } - -+static inline int rtw89_hci_mac_pre_deinit(struct rtw89_dev *rtwdev) -+{ -+ return rtwdev->hci.ops->mac_pre_deinit(rtwdev); -+} -+ - static inline void rtw89_hci_flush_queues(struct rtw89_dev *rtwdev, u32 queues, - bool drop) - { -diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c -index 98af64444d3ebc..30cc6e03c355e8 100644 ---- a/drivers/net/wireless/realtek/rtw89/pci.c -+++ b/drivers/net/wireless/realtek/rtw89/pci.c -@@ -2482,6 +2482,8 @@ static int rtw89_pci_ops_deinit(struct rtw89_dev *rtwdev) - { - const struct rtw89_pci_info *info = rtwdev->pci_info; - -+ rtw89_pci_power_wake(rtwdev, false); -+ - if (rtwdev->chip->chip_id == RTL8852A) { - /* ltr sw trigger */ - rtw89_write32_set(rtwdev, R_AX_LTR_CTRL_0, B_AX_APP_LTR_IDLE); -@@ -2568,6 +2570,13 @@ static int rtw89_pci_ops_mac_pre_init(struct rtw89_dev *rtwdev) - return 0; - } - -+static int rtw89_pci_ops_mac_pre_deinit(struct rtw89_dev *rtwdev) -+{ -+ rtw89_pci_power_wake(rtwdev, false); -+ -+ return 0; -+} -+ - int rtw89_pci_ltr_set(struct rtw89_dev *rtwdev, bool en) - { - u32 val; -@@ -3812,6 +3821,7 @@ static const struct rtw89_hci_ops rtw89_pci_ops = { - .write32 = rtw89_pci_ops_write32, - - .mac_pre_init = rtw89_pci_ops_mac_pre_init, -+ .mac_pre_deinit = rtw89_pci_ops_mac_pre_deinit, - .mac_post_init = rtw89_pci_ops_mac_post_init, - .deinit = rtw89_pci_ops_deinit, - -diff --git a/drivers/net/wireless/ti/wl1251/tx.c b/drivers/net/wireless/ti/wl1251/tx.c -index e9dc3c72bb110c..06dc74cc6cb528 100644 ---- a/drivers/net/wireless/ti/wl1251/tx.c -+++ b/drivers/net/wireless/ti/wl1251/tx.c -@@ -342,8 +342,10 @@ void wl1251_tx_work(struct work_struct *work) - while ((skb = skb_dequeue(&wl->tx_queue))) { - if (!woken_up) { - ret = wl1251_ps_elp_wakeup(wl); -- if (ret < 0) -+ if (ret < 0) { -+ skb_queue_head(&wl->tx_queue, skb); - goto out; -+ } - woken_up = true; - } - -diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c -index c84fadfc63c52c..76cc5b49a5f1ee 100644 ---- a/drivers/ntb/ntb_transport.c -+++ b/drivers/ntb/ntb_transport.c -@@ -1351,7 +1351,7 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev) - qp_count = ilog2(qp_bitmap); - if (nt->use_msi) { - qp_count -= 1; -- nt->msi_db_mask = 1 << qp_count; -+ nt->msi_db_mask = BIT_ULL(qp_count); - ntb_db_clear_mask(ndev, nt->msi_db_mask); - } - -diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c -index c04317a966b387..055b95d2ce9357 100644 ---- a/drivers/nvme/host/rdma.c -+++ b/drivers/nvme/host/rdma.c -@@ -1083,13 +1083,7 @@ static int nvme_rdma_setup_ctrl(struct nvme_rdma_ctrl *ctrl, bool new) - nvme_rdma_free_io_queues(ctrl); - } - destroy_admin: -- nvme_quiesce_admin_queue(&ctrl->ctrl); -- blk_sync_queue(ctrl->ctrl.admin_q); -- nvme_rdma_stop_queue(&ctrl->queues[0]); -- nvme_cancel_admin_tagset(&ctrl->ctrl); -- if (new) -- nvme_remove_admin_tag_set(&ctrl->ctrl); -- nvme_rdma_destroy_admin_queue(ctrl); -+ nvme_rdma_teardown_admin_queue(ctrl, new); - return ret; - } - -diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c -index 8a02ed63b15666..d40d5a4ea932e0 100644 ---- a/drivers/nvme/target/fc.c -+++ b/drivers/nvme/target/fc.c -@@ -173,20 +173,6 @@ struct nvmet_fc_tgt_assoc { - struct rcu_head rcu; - }; - -- --static inline int --nvmet_fc_iodnum(struct nvmet_fc_ls_iod *iodptr) --{ -- return (iodptr - iodptr->tgtport->iod); --} -- --static inline int --nvmet_fc_fodnum(struct nvmet_fc_fcp_iod *fodptr) --{ -- return (fodptr - fodptr->queue->fod); --} -- -- - /* - * Association and Connection IDs: - * -diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c -index e6d4226827b527..4b35bdcac185ff 100644 ---- a/drivers/nvme/target/fcloop.c -+++ b/drivers/nvme/target/fcloop.c -@@ -478,7 +478,7 @@ fcloop_t2h_xmt_ls_rsp(struct nvme_fc_local_port *localport, - if (targetport) { - tport = targetport->private; - spin_lock(&tport->lock); -- list_add_tail(&tport->ls_list, &tls_req->ls_list); -+ list_add_tail(&tls_req->ls_list, &tport->ls_list); - spin_unlock(&tport->lock); - queue_work(nvmet_wq, &tport->ls_work); - } -diff --git a/drivers/of/irq.c b/drivers/of/irq.c -index e54f003c1aaa91..1ec2a198c6692a 100644 ---- a/drivers/of/irq.c -+++ b/drivers/of/irq.c -@@ -16,6 +16,7 @@ - - #define pr_fmt(fmt) "OF: " fmt - -+#include - #include - #include - #include -@@ -38,11 +39,15 @@ - unsigned int irq_of_parse_and_map(struct device_node *dev, int index) - { - struct of_phandle_args oirq; -+ unsigned int ret; - - if (of_irq_parse_one(dev, index, &oirq)) - return 0; - -- return irq_create_of_mapping(&oirq); -+ ret = irq_create_of_mapping(&oirq); -+ of_node_put(oirq.np); -+ -+ return ret; - } - EXPORT_SYMBOL_GPL(irq_of_parse_and_map); - -@@ -165,6 +170,8 @@ const __be32 *of_irq_parse_imap_parent(const __be32 *imap, int len, struct of_ph - * the specifier for each map, and then returns the translated map. - * - * Return: 0 on success and a negative number on error -+ * -+ * Note: refcount of node @out_irq->np is increased by 1 on success. - */ - int of_irq_parse_raw(const __be32 *addr, struct of_phandle_args *out_irq) - { -@@ -310,6 +317,12 @@ int of_irq_parse_raw(const __be32 *addr, struct of_phandle_args *out_irq) - addrsize = (imap - match_array) - intsize; - - if (ipar == newpar) { -+ /* -+ * We got @ipar's refcount, but the refcount was -+ * gotten again by of_irq_parse_imap_parent() via its -+ * alias @newpar. -+ */ -+ of_node_put(ipar); - pr_debug("%pOF interrupt-map entry to self\n", ipar); - return 0; - } -@@ -339,10 +352,12 @@ EXPORT_SYMBOL_GPL(of_irq_parse_raw); - * This function resolves an interrupt for a node by walking the interrupt tree, - * finding which interrupt controller node it is attached to, and returning the - * interrupt specifier that can be used to retrieve a Linux IRQ number. -+ * -+ * Note: refcount of node @out_irq->np is increased by 1 on success. - */ - int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_args *out_irq) - { -- struct device_node *p; -+ struct device_node __free(device_node) *p = NULL; - const __be32 *addr; - u32 intsize; - int i, res, addr_len; -@@ -367,41 +382,33 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar - /* Try the new-style interrupts-extended first */ - res = of_parse_phandle_with_args(device, "interrupts-extended", - "#interrupt-cells", index, out_irq); -- if (!res) -- return of_irq_parse_raw(addr_buf, out_irq); -- -- /* Look for the interrupt parent. */ -- p = of_irq_find_parent(device); -- if (p == NULL) -- return -EINVAL; -+ if (!res) { -+ p = out_irq->np; -+ } else { -+ /* Look for the interrupt parent. */ -+ p = of_irq_find_parent(device); -+ /* Get size of interrupt specifier */ -+ if (!p || of_property_read_u32(p, "#interrupt-cells", &intsize)) -+ return -EINVAL; -+ -+ pr_debug(" parent=%pOF, intsize=%d\n", p, intsize); -+ -+ /* Copy intspec into irq structure */ -+ out_irq->np = p; -+ out_irq->args_count = intsize; -+ for (i = 0; i < intsize; i++) { -+ res = of_property_read_u32_index(device, "interrupts", -+ (index * intsize) + i, -+ out_irq->args + i); -+ if (res) -+ return res; -+ } - -- /* Get size of interrupt specifier */ -- if (of_property_read_u32(p, "#interrupt-cells", &intsize)) { -- res = -EINVAL; -- goto out; -+ pr_debug(" intspec=%d\n", *out_irq->args); - } - -- pr_debug(" parent=%pOF, intsize=%d\n", p, intsize); -- -- /* Copy intspec into irq structure */ -- out_irq->np = p; -- out_irq->args_count = intsize; -- for (i = 0; i < intsize; i++) { -- res = of_property_read_u32_index(device, "interrupts", -- (index * intsize) + i, -- out_irq->args + i); -- if (res) -- goto out; -- } -- -- pr_debug(" intspec=%d\n", *out_irq->args); -- -- - /* Check if there are any interrupt-map translations to process */ -- res = of_irq_parse_raw(addr_buf, out_irq); -- out: -- of_node_put(p); -- return res; -+ return of_irq_parse_raw(addr_buf, out_irq); - } - EXPORT_SYMBOL_GPL(of_irq_parse_one); - -@@ -506,8 +513,10 @@ int of_irq_count(struct device_node *dev) - struct of_phandle_args irq; - int nr = 0; - -- while (of_irq_parse_one(dev, nr, &irq) == 0) -+ while (of_irq_parse_one(dev, nr, &irq) == 0) { -+ of_node_put(irq.np); - nr++; -+ } - - return nr; - } -@@ -624,6 +633,8 @@ void __init of_irq_init(const struct of_device_id *matches) - __func__, desc->dev, desc->dev, - desc->interrupt_parent); - of_node_clear_flag(desc->dev, OF_POPULATED); -+ of_node_put(desc->interrupt_parent); -+ of_node_put(desc->dev); - kfree(desc); - continue; - } -@@ -654,6 +665,7 @@ void __init of_irq_init(const struct of_device_id *matches) - err: - list_for_each_entry_safe(desc, temp_desc, &intc_desc_list, list) { - list_del(&desc->list); -+ of_node_put(desc->interrupt_parent); - of_node_put(desc->dev); - kfree(desc); - } -diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c -index 44d385f5c27cd4..940af934ce1bb8 100644 ---- a/drivers/pci/controller/pcie-brcmstb.c -+++ b/drivers/pci/controller/pcie-brcmstb.c -@@ -1501,7 +1501,7 @@ static struct pci_ops brcm7425_pcie_ops = { - - static int brcm_pcie_probe(struct platform_device *pdev) - { -- struct device_node *np = pdev->dev.of_node, *msi_np; -+ struct device_node *np = pdev->dev.of_node; - struct pci_host_bridge *bridge; - const struct pcie_cfg_data *data; - struct brcm_pcie *pcie; -@@ -1576,9 +1576,14 @@ static int brcm_pcie_probe(struct platform_device *pdev) - goto fail; - } - -- msi_np = of_parse_phandle(pcie->np, "msi-parent", 0); -- if (pci_msi_enabled() && msi_np == pcie->np) { -- ret = brcm_pcie_enable_msi(pcie); -+ if (pci_msi_enabled()) { -+ struct device_node *msi_np = of_parse_phandle(pcie->np, "msi-parent", 0); -+ -+ if (msi_np == pcie->np) -+ ret = brcm_pcie_enable_msi(pcie); -+ -+ of_node_put(msi_np); -+ - if (ret) { - dev_err(pcie->dev, "probe of internal MSI failed"); - goto fail; -diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c -index 5ff2066aa51643..dfa222e02c4da9 100644 ---- a/drivers/pci/controller/vmd.c -+++ b/drivers/pci/controller/vmd.c -@@ -125,7 +125,7 @@ struct vmd_irq_list { - struct vmd_dev { - struct pci_dev *dev; - -- spinlock_t cfg_lock; -+ raw_spinlock_t cfg_lock; - void __iomem *cfgbar; - - int msix_count; -@@ -402,7 +402,7 @@ static int vmd_pci_read(struct pci_bus *bus, unsigned int devfn, int reg, - if (!addr) - return -EFAULT; - -- spin_lock_irqsave(&vmd->cfg_lock, flags); -+ raw_spin_lock_irqsave(&vmd->cfg_lock, flags); - switch (len) { - case 1: - *value = readb(addr); -@@ -417,7 +417,7 @@ static int vmd_pci_read(struct pci_bus *bus, unsigned int devfn, int reg, - ret = -EINVAL; - break; - } -- spin_unlock_irqrestore(&vmd->cfg_lock, flags); -+ raw_spin_unlock_irqrestore(&vmd->cfg_lock, flags); - return ret; - } - -@@ -437,7 +437,7 @@ static int vmd_pci_write(struct pci_bus *bus, unsigned int devfn, int reg, - if (!addr) - return -EFAULT; - -- spin_lock_irqsave(&vmd->cfg_lock, flags); -+ raw_spin_lock_irqsave(&vmd->cfg_lock, flags); - switch (len) { - case 1: - writeb(value, addr); -@@ -455,7 +455,7 @@ static int vmd_pci_write(struct pci_bus *bus, unsigned int devfn, int reg, - ret = -EINVAL; - break; - } -- spin_unlock_irqrestore(&vmd->cfg_lock, flags); -+ raw_spin_unlock_irqrestore(&vmd->cfg_lock, flags); - return ret; - } - -@@ -1020,7 +1020,7 @@ static int vmd_probe(struct pci_dev *dev, const struct pci_device_id *id) - if (features & VMD_FEAT_OFFSET_FIRST_VECTOR) - vmd->first_vec = 1; - -- spin_lock_init(&vmd->cfg_lock); -+ raw_spin_lock_init(&vmd->cfg_lock); - pci_set_drvdata(dev, vmd); - err = vmd_enable_domain(vmd, features); - if (err) -diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c -index bcce569a833956..095fa1910d36db 100644 ---- a/drivers/pci/pci.c -+++ b/drivers/pci/pci.c -@@ -5714,8 +5714,6 @@ static bool pci_bus_resettable(struct pci_bus *bus) - return false; - - list_for_each_entry(dev, &bus->devices, bus_list) { -- if (!pci_reset_supported(dev)) -- return false; - if (dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET || - (dev->subordinate && !pci_bus_resettable(dev->subordinate))) - return false; -@@ -5792,8 +5790,6 @@ static bool pci_slot_resettable(struct pci_slot *slot) - list_for_each_entry(dev, &slot->bus->devices, bus_list) { - if (!dev->slot || dev->slot != slot) - continue; -- if (!pci_reset_supported(dev)) -- return false; - if (dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET || - (dev->subordinate && !pci_bus_resettable(dev->subordinate))) - return false; -diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c -index bcd1ba829e1fc1..8e5d818c29a983 100644 ---- a/drivers/pci/probe.c -+++ b/drivers/pci/probe.c -@@ -1145,7 +1145,10 @@ static struct pci_bus *pci_alloc_child_bus(struct pci_bus *parent, - add_dev: - pci_set_bus_msi_domain(child); - ret = device_register(&child->dev); -- WARN_ON(ret < 0); -+ if (WARN_ON(ret < 0)) { -+ put_device(&child->dev); -+ return NULL; -+ } - - pcibios_add_bus(child); - -diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c -index d712a19e47ac15..b3bb4d62f13dcc 100644 ---- a/drivers/perf/arm_pmu.c -+++ b/drivers/perf/arm_pmu.c -@@ -342,12 +342,10 @@ armpmu_add(struct perf_event *event, int flags) - if (idx < 0) - return idx; - -- /* -- * If there is an event in the counter we are going to use then make -- * sure it is disabled. -- */ -+ /* The newly-allocated counter should be empty */ -+ WARN_ON_ONCE(hw_events->events[idx]); -+ - event->hw.idx = idx; -- armpmu->disable(event); - hw_events->events[idx] = event; - - hwc->state = PERF_HES_STOPPED | PERF_HES_UPTODATE; -diff --git a/drivers/phy/freescale/phy-fsl-imx8m-pcie.c b/drivers/phy/freescale/phy-fsl-imx8m-pcie.c -index e98361dcdeadfe..afd52392cd5301 100644 ---- a/drivers/phy/freescale/phy-fsl-imx8m-pcie.c -+++ b/drivers/phy/freescale/phy-fsl-imx8m-pcie.c -@@ -162,6 +162,16 @@ static int imx8_pcie_phy_power_on(struct phy *phy) - return ret; - } - -+static int imx8_pcie_phy_power_off(struct phy *phy) -+{ -+ struct imx8_pcie_phy *imx8_phy = phy_get_drvdata(phy); -+ -+ reset_control_assert(imx8_phy->reset); -+ reset_control_assert(imx8_phy->perst); -+ -+ return 0; -+} -+ - static int imx8_pcie_phy_init(struct phy *phy) - { - struct imx8_pcie_phy *imx8_phy = phy_get_drvdata(phy); -@@ -182,6 +192,7 @@ static const struct phy_ops imx8_pcie_phy_ops = { - .init = imx8_pcie_phy_init, - .exit = imx8_pcie_phy_exit, - .power_on = imx8_pcie_phy_power_on, -+ .power_off = imx8_pcie_phy_power_off, - .owner = THIS_MODULE, - }; - -diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c -index 115b83e2d8e65a..b252fc22f64e6b 100644 ---- a/drivers/pinctrl/qcom/pinctrl-msm.c -+++ b/drivers/pinctrl/qcom/pinctrl-msm.c -@@ -1040,8 +1040,7 @@ static int msm_gpio_irq_set_type(struct irq_data *d, unsigned int type) - const struct msm_pingroup *g; - u32 intr_target_mask = GENMASK(2, 0); - unsigned long flags; -- bool was_enabled; -- u32 val; -+ u32 val, oldval; - - if (msm_gpio_needs_dual_edge_parent_workaround(d, type)) { - set_bit(d->hwirq, pctrl->dual_edge_irqs); -@@ -1103,8 +1102,7 @@ static int msm_gpio_irq_set_type(struct irq_data *d, unsigned int type) - * internal circuitry of TLMM, toggling the RAW_STATUS - * could cause the INTR_STATUS to be set for EDGE interrupts. - */ -- val = msm_readl_intr_cfg(pctrl, g); -- was_enabled = val & BIT(g->intr_raw_status_bit); -+ val = oldval = msm_readl_intr_cfg(pctrl, g); - val |= BIT(g->intr_raw_status_bit); - if (g->intr_detection_width == 2) { - val &= ~(3 << g->intr_detection_bit); -@@ -1157,9 +1155,11 @@ static int msm_gpio_irq_set_type(struct irq_data *d, unsigned int type) - /* - * The first time we set RAW_STATUS_EN it could trigger an interrupt. - * Clear the interrupt. This is safe because we have -- * IRQCHIP_SET_TYPE_MASKED. -+ * IRQCHIP_SET_TYPE_MASKED. When changing the interrupt type, we could -+ * also still have a non-matching interrupt latched, so clear whenever -+ * making changes to the interrupt configuration. - */ -- if (!was_enabled) -+ if (val != oldval) - msm_ack_intr_status(pctrl, g); - - if (test_bit(d->hwirq, pctrl->dual_edge_irqs)) -diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c -index 761029f39314a6..c2234657051024 100644 ---- a/drivers/platform/x86/asus-laptop.c -+++ b/drivers/platform/x86/asus-laptop.c -@@ -427,11 +427,14 @@ static int asus_pega_lucid_set(struct asus_laptop *asus, int unit, bool enable) - - static int pega_acc_axis(struct asus_laptop *asus, int curr, char *method) - { -+ unsigned long long val = (unsigned long long)curr; -+ acpi_status status; - int i, delta; -- unsigned long long val; -- for (i = 0; i < PEGA_ACC_RETRIES; i++) { -- acpi_evaluate_integer(asus->handle, method, NULL, &val); - -+ for (i = 0; i < PEGA_ACC_RETRIES; i++) { -+ status = acpi_evaluate_integer(asus->handle, method, NULL, &val); -+ if (ACPI_FAILURE(status)) -+ continue; - /* The output is noisy. From reading the ASL - * dissassembly, timeout errors are returned with 1's - * in the high word, and the lack of locking around -diff --git a/drivers/ptp/ptp_ocp.c b/drivers/ptp/ptp_ocp.c -index 13343c31987706..4899fdf9bdf7a2 100644 ---- a/drivers/ptp/ptp_ocp.c -+++ b/drivers/ptp/ptp_ocp.c -@@ -1842,6 +1842,7 @@ ptp_ocp_signal_set(struct ptp_ocp *bp, int gen, struct ptp_ocp_signal *s) - if (!s->start) { - /* roundup() does not work on 32-bit systems */ - s->start = DIV64_U64_ROUND_UP(start_ns, s->period); -+ s->start *= s->period; - s->start = ktime_add(s->start, s->phase); - } - -diff --git a/drivers/pwm/pwm-fsl-ftm.c b/drivers/pwm/pwm-fsl-ftm.c -index b7c6045c5d0898..2c60d67e9a4a4a 100644 ---- a/drivers/pwm/pwm-fsl-ftm.c -+++ b/drivers/pwm/pwm-fsl-ftm.c -@@ -119,6 +119,9 @@ static unsigned int fsl_pwm_ticks_to_ns(struct fsl_pwm_chip *fpc, - unsigned long long exval; - - rate = clk_get_rate(fpc->clk[fpc->period.clk_select]); -+ if (rate >> fpc->period.clk_ps == 0) -+ return 0; -+ - exval = ticks; - exval *= 1000000000UL; - do_div(exval, rate >> fpc->period.clk_ps); -@@ -191,6 +194,9 @@ static unsigned int fsl_pwm_calculate_duty(struct fsl_pwm_chip *fpc, - unsigned int period = fpc->period.mod_period + 1; - unsigned int period_ns = fsl_pwm_ticks_to_ns(fpc, period); - -+ if (!period_ns) -+ return 0; -+ - duty = (unsigned long long)duty_ns * period; - do_div(duty, period_ns); - -diff --git a/drivers/pwm/pwm-mediatek.c b/drivers/pwm/pwm-mediatek.c -index 6adb0ed019066a..6b1a75b6bd12fb 100644 ---- a/drivers/pwm/pwm-mediatek.c -+++ b/drivers/pwm/pwm-mediatek.c -@@ -124,21 +124,25 @@ static int pwm_mediatek_config(struct pwm_chip *chip, struct pwm_device *pwm, - struct pwm_mediatek_chip *pc = to_pwm_mediatek_chip(chip); - u32 clkdiv = 0, cnt_period, cnt_duty, reg_width = PWMDWIDTH, - reg_thres = PWMTHRES; -+ unsigned long clk_rate; - u64 resolution; - int ret; - - ret = pwm_mediatek_clk_enable(chip, pwm); -- - if (ret < 0) - return ret; - -+ clk_rate = clk_get_rate(pc->clk_pwms[pwm->hwpwm]); -+ if (!clk_rate) -+ return -EINVAL; -+ - /* Make sure we use the bus clock and not the 26MHz clock */ - if (pc->soc->has_ck_26m_sel) - writel(0, pc->regs + PWM_CK_26M_SEL); - - /* Using resolution in picosecond gets accuracy higher */ - resolution = (u64)NSEC_PER_SEC * 1000; -- do_div(resolution, clk_get_rate(pc->clk_pwms[pwm->hwpwm])); -+ do_div(resolution, clk_rate); - - cnt_period = DIV_ROUND_CLOSEST_ULL((u64)period_ns * 1000, resolution); - while (cnt_period > 8191) { -diff --git a/drivers/pwm/pwm-rcar.c b/drivers/pwm/pwm-rcar.c -index 5b5f357c44de61..18fa2d40d93650 100644 ---- a/drivers/pwm/pwm-rcar.c -+++ b/drivers/pwm/pwm-rcar.c -@@ -8,6 +8,7 @@ - * - The hardware cannot generate a 0% duty cycle. - */ - -+#include - #include - #include - #include -@@ -103,23 +104,24 @@ static void rcar_pwm_set_clock_control(struct rcar_pwm_chip *rp, - rcar_pwm_write(rp, value, RCAR_PWMCR); - } - --static int rcar_pwm_set_counter(struct rcar_pwm_chip *rp, int div, int duty_ns, -- int period_ns) -+static int rcar_pwm_set_counter(struct rcar_pwm_chip *rp, int div, u64 duty_ns, -+ u64 period_ns) - { -- unsigned long long one_cycle, tmp; /* 0.01 nanoseconds */ -+ unsigned long long tmp; - unsigned long clk_rate = clk_get_rate(rp->clk); - u32 cyc, ph; - -- one_cycle = NSEC_PER_SEC * 100ULL << div; -- do_div(one_cycle, clk_rate); -+ /* div <= 24 == RCAR_PWM_MAX_DIVISION, so the shift doesn't overflow. */ -+ tmp = mul_u64_u64_div_u64(period_ns, clk_rate, (u64)NSEC_PER_SEC << div); -+ if (tmp > FIELD_MAX(RCAR_PWMCNT_CYC0_MASK)) -+ tmp = FIELD_MAX(RCAR_PWMCNT_CYC0_MASK); - -- tmp = period_ns * 100ULL; -- do_div(tmp, one_cycle); -- cyc = (tmp << RCAR_PWMCNT_CYC0_SHIFT) & RCAR_PWMCNT_CYC0_MASK; -+ cyc = FIELD_PREP(RCAR_PWMCNT_CYC0_MASK, tmp); - -- tmp = duty_ns * 100ULL; -- do_div(tmp, one_cycle); -- ph = tmp & RCAR_PWMCNT_PH0_MASK; -+ tmp = mul_u64_u64_div_u64(duty_ns, clk_rate, (u64)NSEC_PER_SEC << div); -+ if (tmp > FIELD_MAX(RCAR_PWMCNT_PH0_MASK)) -+ tmp = FIELD_MAX(RCAR_PWMCNT_PH0_MASK); -+ ph = FIELD_PREP(RCAR_PWMCNT_PH0_MASK, tmp); - - /* Avoid prohibited setting */ - if (cyc == 0 || ph == 0) -diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c -index 73b378837da7bd..e6bcc3171391ce 100644 ---- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c -+++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c -@@ -2501,6 +2501,7 @@ static void prep_ata_v2_hw(struct hisi_hba *hisi_hba, - struct hisi_sas_port *port = to_hisi_sas_port(sas_port); - struct sas_ata_task *ata_task = &task->ata_task; - struct sas_tmf_task *tmf = slot->tmf; -+ int phy_id; - u8 *buf_cmd; - int has_data = 0, hdr_tag = 0; - u32 dw0, dw1 = 0, dw2 = 0; -@@ -2508,10 +2509,14 @@ static void prep_ata_v2_hw(struct hisi_hba *hisi_hba, - /* create header */ - /* dw0 */ - dw0 = port->id << CMD_HDR_PORT_OFF; -- if (parent_dev && dev_is_expander(parent_dev->dev_type)) -+ if (parent_dev && dev_is_expander(parent_dev->dev_type)) { - dw0 |= 3 << CMD_HDR_CMD_OFF; -- else -+ } else { -+ phy_id = device->phy->identify.phy_identifier; -+ dw0 |= (1U << phy_id) << CMD_HDR_PHY_ID_OFF; -+ dw0 |= CMD_HDR_FORCE_PHY_MSK; - dw0 |= 4 << CMD_HDR_CMD_OFF; -+ } - - if (tmf && ata_task->force_phy) { - dw0 |= CMD_HDR_FORCE_PHY_MSK; -diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -index ff5f86867dbf06..596b5426d99535 100644 ---- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -@@ -358,6 +358,10 @@ - #define CMD_HDR_RESP_REPORT_MSK (0x1 << CMD_HDR_RESP_REPORT_OFF) - #define CMD_HDR_TLR_CTRL_OFF 6 - #define CMD_HDR_TLR_CTRL_MSK (0x3 << CMD_HDR_TLR_CTRL_OFF) -+#define CMD_HDR_PHY_ID_OFF 8 -+#define CMD_HDR_PHY_ID_MSK (0x1ff << CMD_HDR_PHY_ID_OFF) -+#define CMD_HDR_FORCE_PHY_OFF 17 -+#define CMD_HDR_FORCE_PHY_MSK (0x1U << CMD_HDR_FORCE_PHY_OFF) - #define CMD_HDR_PORT_OFF 18 - #define CMD_HDR_PORT_MSK (0xf << CMD_HDR_PORT_OFF) - #define CMD_HDR_PRIORITY_OFF 27 -@@ -1425,15 +1429,21 @@ static void prep_ata_v3_hw(struct hisi_hba *hisi_hba, - struct hisi_sas_cmd_hdr *hdr = slot->cmd_hdr; - struct asd_sas_port *sas_port = device->port; - struct hisi_sas_port *port = to_hisi_sas_port(sas_port); -+ int phy_id; - u8 *buf_cmd; - int has_data = 0, hdr_tag = 0; - u32 dw1 = 0, dw2 = 0; - - hdr->dw0 = cpu_to_le32(port->id << CMD_HDR_PORT_OFF); -- if (parent_dev && dev_is_expander(parent_dev->dev_type)) -+ if (parent_dev && dev_is_expander(parent_dev->dev_type)) { - hdr->dw0 |= cpu_to_le32(3 << CMD_HDR_CMD_OFF); -- else -+ } else { -+ phy_id = device->phy->identify.phy_identifier; -+ hdr->dw0 |= cpu_to_le32((1U << phy_id) -+ << CMD_HDR_PHY_ID_OFF); -+ hdr->dw0 |= CMD_HDR_FORCE_PHY_MSK; - hdr->dw0 |= cpu_to_le32(4U << CMD_HDR_CMD_OFF); -+ } - - switch (task->data_dir) { - case DMA_TO_DEVICE: -diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c -index 4cc93cb79b8b0a..dd3630b09aa241 100644 ---- a/drivers/scsi/megaraid/megaraid_sas_base.c -+++ b/drivers/scsi/megaraid/megaraid_sas_base.c -@@ -2101,6 +2101,9 @@ static int megasas_slave_configure(struct scsi_device *sdev) - /* This sdev property may change post OCR */ - megasas_set_dynamic_target_properties(sdev, is_target_prop); - -+ if (!MEGASAS_IS_LOGICAL(sdev)) -+ sdev->no_vpd_size = 1; -+ - mutex_unlock(&instance->reset_mutex); - - return 0; -@@ -3660,8 +3663,10 @@ megasas_complete_cmd(struct megasas_instance *instance, struct megasas_cmd *cmd, - - case MFI_STAT_SCSI_IO_FAILED: - case MFI_STAT_LD_INIT_IN_PROGRESS: -- cmd->scmd->result = -- (DID_ERROR << 16) | hdr->scsi_status; -+ if (hdr->scsi_status == 0xf0) -+ cmd->scmd->result = (DID_ERROR << 16) | SAM_STAT_CHECK_CONDITION; -+ else -+ cmd->scmd->result = (DID_ERROR << 16) | hdr->scsi_status; - break; - - case MFI_STAT_SCSI_DONE_WITH_ERROR: -diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c -index 8a83f3fc2b865e..5ebcb582cf0c7f 100644 ---- a/drivers/scsi/megaraid/megaraid_sas_fusion.c -+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c -@@ -2043,7 +2043,10 @@ map_cmd_status(struct fusion_context *fusion, - - case MFI_STAT_SCSI_IO_FAILED: - case MFI_STAT_LD_INIT_IN_PROGRESS: -- scmd->result = (DID_ERROR << 16) | ext_status; -+ if (ext_status == 0xf0) -+ scmd->result = (DID_ERROR << 16) | SAM_STAT_CHECK_CONDITION; -+ else -+ scmd->result = (DID_ERROR << 16) | ext_status; - break; - - case MFI_STAT_SCSI_DONE_WITH_ERROR: -diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c -index deeb657981a690..0c30fec555475b 100644 ---- a/drivers/scsi/scsi_transport_iscsi.c -+++ b/drivers/scsi/scsi_transport_iscsi.c -@@ -3208,11 +3208,14 @@ iscsi_set_host_param(struct iscsi_transport *transport, - } - - /* see similar check in iscsi_if_set_param() */ -- if (strlen(data) > ev->u.set_host_param.len) -- return -EINVAL; -+ if (strlen(data) > ev->u.set_host_param.len) { -+ err = -EINVAL; -+ goto out; -+ } - - err = transport->set_host_param(shost, ev->u.set_host_param.param, - data, ev->u.set_host_param.len); -+out: - scsi_host_put(shost); - return err; - } -diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c -index bdbe94f30f0706..900322bad4f3be 100644 ---- a/drivers/scsi/st.c -+++ b/drivers/scsi/st.c -@@ -4120,7 +4120,7 @@ static void validate_options(void) - */ - static int __init st_setup(char *str) - { -- int i, len, ints[5]; -+ int i, len, ints[ARRAY_SIZE(parms) + 1]; - char *stp; - - stp = get_options(str, ARRAY_SIZE(ints), ints); -diff --git a/drivers/soc/samsung/exynos-chipid.c b/drivers/soc/samsung/exynos-chipid.c -index 7ba45c4aff971c..1307f6d61c986e 100644 ---- a/drivers/soc/samsung/exynos-chipid.c -+++ b/drivers/soc/samsung/exynos-chipid.c -@@ -130,6 +130,8 @@ static int exynos_chipid_probe(struct platform_device *pdev) - - soc_dev_attr->revision = devm_kasprintf(&pdev->dev, GFP_KERNEL, - "%x", soc_info.revision); -+ if (!soc_dev_attr->revision) -+ return -ENOMEM; - soc_dev_attr->soc_id = product_id_to_soc_id(soc_info.product_id); - if (!soc_dev_attr->soc_id) { - pr_err("Unknown SoC\n"); -diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c -index 08811577d8f8b2..bf9b816637d02e 100644 ---- a/drivers/spi/spi-cadence-quadspi.c -+++ b/drivers/spi/spi-cadence-quadspi.c -@@ -1576,6 +1576,12 @@ static int cqspi_request_mmap_dma(struct cqspi_st *cqspi) - int ret = PTR_ERR(cqspi->rx_chan); - - cqspi->rx_chan = NULL; -+ if (ret == -ENODEV) { -+ /* DMA support is not mandatory */ -+ dev_info(&cqspi->pdev->dev, "No Rx DMA available\n"); -+ return 0; -+ } -+ - return dev_err_probe(&cqspi->pdev->dev, ret, "No Rx DMA available\n"); - } - init_completion(&cqspi->rx_dma_complete); -diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c -index 50290abc07bc23..f110f932ba0543 100644 ---- a/drivers/target/target_core_spc.c -+++ b/drivers/target/target_core_spc.c -@@ -2243,7 +2243,7 @@ spc_emulate_report_supp_op_codes(struct se_cmd *cmd) - response_length += spc_rsoc_encode_command_descriptor( - &buf[response_length], rctd, descr); - } -- put_unaligned_be32(response_length - 3, buf); -+ put_unaligned_be32(response_length - 4, buf); - } else { - response_length = spc_rsoc_encode_one_command_descriptor( - &buf[response_length], rctd, descr, -diff --git a/drivers/thermal/rockchip_thermal.c b/drivers/thermal/rockchip_thermal.c -index 77231a9d28ff10..d306ca9a9902da 100644 ---- a/drivers/thermal/rockchip_thermal.c -+++ b/drivers/thermal/rockchip_thermal.c -@@ -386,6 +386,7 @@ static const struct tsadc_table rk3328_code_table[] = { - {296, -40000}, - {304, -35000}, - {313, -30000}, -+ {322, -25000}, - {331, -20000}, - {340, -15000}, - {349, -10000}, -diff --git a/drivers/ufs/host/ufs-exynos.c b/drivers/ufs/host/ufs-exynos.c -index 268189f01e15bc..d138b66d5e350b 100644 ---- a/drivers/ufs/host/ufs-exynos.c -+++ b/drivers/ufs/host/ufs-exynos.c -@@ -901,6 +901,12 @@ static int exynos_ufs_phy_init(struct exynos_ufs *ufs) - } - - phy_set_bus_width(generic_phy, ufs->avail_ln_rx); -+ -+ if (generic_phy->power_count) { -+ phy_power_off(generic_phy); -+ phy_exit(generic_phy); -+ } -+ - ret = phy_init(generic_phy); - if (ret) { - dev_err(hba->dev, "%s: phy init failed, ret = %d\n", -diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c -index 7c7f388aac96b3..35f4c4482fca33 100644 ---- a/drivers/usb/typec/ucsi/ucsi_ccg.c -+++ b/drivers/usb/typec/ucsi/ucsi_ccg.c -@@ -585,6 +585,10 @@ static int ucsi_ccg_sync_write(struct ucsi *ucsi, unsigned int offset, - uc->has_multiple_dp) { - con_index = (uc->last_cmd_sent >> 16) & - UCSI_CMD_CONNECTOR_MASK; -+ if (con_index == 0) { -+ ret = -EINVAL; -+ goto err_put; -+ } - con = &uc->ucsi->connector[con_index - 1]; - ucsi_ccg_update_set_new_cam_cmd(uc, con, (u64 *)val); - } -@@ -599,6 +603,7 @@ static int ucsi_ccg_sync_write(struct ucsi *ucsi, unsigned int offset, - - err_clear_bit: - clear_bit(DEV_CMD_PENDING, &uc->flags); -+err_put: - pm_runtime_put_sync(uc->dev); - mutex_unlock(&uc->lock); - -diff --git a/drivers/vdpa/mlx5/core/mr.c b/drivers/vdpa/mlx5/core/mr.c -index aa4ab4c847fdcc..16573065693452 100644 ---- a/drivers/vdpa/mlx5/core/mr.c -+++ b/drivers/vdpa/mlx5/core/mr.c -@@ -166,9 +166,12 @@ static void fill_indir(struct mlx5_vdpa_dev *mvdev, struct mlx5_vdpa_mr *mkey, v - klm->bcount = cpu_to_be32(klm_bcount(dmr->end - dmr->start)); - preve = dmr->end; - } else { -+ u64 bcount = min_t(u64, dmr->start - preve, MAX_KLM_SIZE); -+ - klm->key = cpu_to_be32(mvdev->res.null_mkey); -- klm->bcount = cpu_to_be32(klm_bcount(dmr->start - preve)); -- preve = dmr->start; -+ klm->bcount = cpu_to_be32(klm_bcount(bcount)); -+ preve += bcount; -+ - goto again; - } - } -diff --git a/drivers/video/backlight/led_bl.c b/drivers/video/backlight/led_bl.c -index 032f8bddf8721e..0e53e427a91dcb 100644 ---- a/drivers/video/backlight/led_bl.c -+++ b/drivers/video/backlight/led_bl.c -@@ -229,8 +229,11 @@ static void led_bl_remove(struct platform_device *pdev) - backlight_device_unregister(bl); - - led_bl_power_off(priv); -- for (i = 0; i < priv->nb_leds; i++) -+ for (i = 0; i < priv->nb_leds; i++) { -+ mutex_lock(&priv->leds[i]->led_access); - led_sysfs_enable(priv->leds[i]); -+ mutex_unlock(&priv->leds[i]->led_access); -+ } - } - - static const struct of_device_id led_bl_of_match[] = { -diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dispc.c b/drivers/video/fbdev/omap2/omapfb/dss/dispc.c -index 21fef9db90d26a..4f09111f8b57e3 100644 ---- a/drivers/video/fbdev/omap2/omapfb/dss/dispc.c -+++ b/drivers/video/fbdev/omap2/omapfb/dss/dispc.c -@@ -2749,9 +2749,13 @@ int dispc_ovl_setup(enum omap_plane plane, const struct omap_overlay_info *oi, - bool mem_to_mem) - { - int r; -- enum omap_overlay_caps caps = dss_feat_get_overlay_caps(plane); -+ enum omap_overlay_caps caps; - enum omap_channel channel; - -+ if (plane == OMAP_DSS_WB) -+ return -EINVAL; -+ -+ caps = dss_feat_get_overlay_caps(plane); - channel = dispc_ovl_get_channel_out(plane); - - DSSDBG("dispc_ovl_setup %d, pa %pad, pa_uv %pad, sw %d, %d,%d, %dx%d ->" -diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c -index db61bcb3aab176..b0b52fa8fba6da 100644 ---- a/drivers/xen/balloon.c -+++ b/drivers/xen/balloon.c -@@ -671,7 +671,7 @@ void xen_free_ballooned_pages(unsigned int nr_pages, struct page **pages) - } - EXPORT_SYMBOL(xen_free_ballooned_pages); - --static void __init balloon_add_regions(void) -+static int __init balloon_add_regions(void) - { - unsigned long start_pfn, pages; - unsigned long pfn, extra_pfn_end; -@@ -694,26 +694,38 @@ static void __init balloon_add_regions(void) - for (pfn = start_pfn; pfn < extra_pfn_end; pfn++) - balloon_append(pfn_to_page(pfn)); - -- balloon_stats.total_pages += extra_pfn_end - start_pfn; -+ /* -+ * Extra regions are accounted for in the physmap, but need -+ * decreasing from current_pages to balloon down the initial -+ * allocation, because they are already accounted for in -+ * total_pages. -+ */ -+ if (extra_pfn_end - start_pfn >= balloon_stats.current_pages) { -+ WARN(1, "Extra pages underflow current target"); -+ return -ERANGE; -+ } -+ balloon_stats.current_pages -= extra_pfn_end - start_pfn; - } -+ -+ return 0; - } - - static int __init balloon_init(void) - { - struct task_struct *task; -+ int rc; - - if (!xen_domain()) - return -ENODEV; - - pr_info("Initialising balloon driver\n"); - --#ifdef CONFIG_XEN_PV -- balloon_stats.current_pages = xen_pv_domain() -- ? min(xen_start_info->nr_pages - xen_released_pages, max_pfn) -- : get_num_physpages(); --#else -- balloon_stats.current_pages = get_num_physpages(); --#endif -+ if (xen_released_pages >= get_num_physpages()) { -+ WARN(1, "Released pages underflow current target"); -+ return -ERANGE; -+ } -+ -+ balloon_stats.current_pages = get_num_physpages() - xen_released_pages; - balloon_stats.target_pages = balloon_stats.current_pages; - balloon_stats.balloon_low = 0; - balloon_stats.balloon_high = 0; -@@ -730,7 +742,9 @@ static int __init balloon_init(void) - register_sysctl_init("xen/balloon", balloon_table); - #endif - -- balloon_add_regions(); -+ rc = balloon_add_regions(); -+ if (rc) -+ return rc; - - task = kthread_run(balloon_thread, NULL, "xen-balloon"); - if (IS_ERR(task)) { -diff --git a/drivers/xen/xenfs/xensyms.c b/drivers/xen/xenfs/xensyms.c -index b799bc759c15f4..088b7f02c35866 100644 ---- a/drivers/xen/xenfs/xensyms.c -+++ b/drivers/xen/xenfs/xensyms.c -@@ -48,7 +48,7 @@ static int xensyms_next_sym(struct xensyms *xs) - return -ENOMEM; - - set_xen_guest_handle(symdata->name, xs->name); -- symdata->symnum--; /* Rewind */ -+ symdata->symnum = symnum; /* Rewind */ - - ret = HYPERVISOR_platform_op(&xs->op); - if (ret < 0) -@@ -78,7 +78,7 @@ static void *xensyms_next(struct seq_file *m, void *p, loff_t *pos) - { - struct xensyms *xs = m->private; - -- xs->op.u.symdata.symnum = ++(*pos); -+ *pos = xs->op.u.symdata.symnum; - - if (xensyms_next_sym(xs)) - return NULL; -diff --git a/fs/Kconfig b/fs/Kconfig -index 02a9237807a779..85ae4953f2d7b9 100644 ---- a/fs/Kconfig -+++ b/fs/Kconfig -@@ -365,6 +365,7 @@ config GRACE_PERIOD - config LOCKD - tristate - depends on FILE_LOCKING -+ select CRC32 - select GRACE_PERIOD - - config LOCKD_V4 -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index 967c6b5dd0a434..2387210231f236 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -4333,6 +4333,18 @@ void __cold close_ctree(struct btrfs_fs_info *fs_info) - */ - btrfs_flush_workqueue(fs_info->delalloc_workers); - -+ /* -+ * When finishing a compressed write bio we schedule a work queue item -+ * to finish an ordered extent - btrfs_finish_compressed_write_work() -+ * calls btrfs_finish_ordered_extent() which in turns does a call to -+ * btrfs_queue_ordered_fn(), and that queues the ordered extent -+ * completion either in the endio_write_workers work queue or in the -+ * fs_info->endio_freespace_worker work queue. We flush those queues -+ * below, so before we flush them we must flush this queue for the -+ * workers of compressed writes. -+ */ -+ flush_workqueue(fs_info->compressed_write_workers); -+ - /* - * After we parked the cleaner kthread, ordered extents may have - * completed and created new delayed iputs. If one of the async reclaim -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index cedffa567a7584..11c4d69177f0ca 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -1546,6 +1546,7 @@ static noinline int cow_file_range(struct btrfs_inode *inode, - locked_page, - clear_bits, - page_ops); -+ btrfs_qgroup_free_data(inode, NULL, start, cur_alloc_size, NULL); - start += cur_alloc_size; - } - -@@ -1559,6 +1560,7 @@ static noinline int cow_file_range(struct btrfs_inode *inode, - clear_bits |= EXTENT_CLEAR_DATA_RESV; - extent_clear_unlock_delalloc(inode, start, end, locked_page, - clear_bits, page_ops); -+ btrfs_qgroup_free_data(inode, NULL, start, end - start + 1, NULL); - } - return ret; - } -@@ -2222,13 +2224,15 @@ static noinline int run_delalloc_nocow(struct btrfs_inode *inode, - */ - if (cow_start != (u64)-1) - cur_offset = cow_start; -- if (cur_offset < end) -+ if (cur_offset < end) { - extent_clear_unlock_delalloc(inode, cur_offset, end, - locked_page, EXTENT_LOCKED | - EXTENT_DELALLOC | EXTENT_DEFRAG | - EXTENT_DO_ACCOUNTING, PAGE_UNLOCK | - PAGE_START_WRITEBACK | - PAGE_END_WRITEBACK); -+ btrfs_qgroup_free_data(inode, NULL, cur_offset, end - cur_offset + 1, NULL); -+ } - btrfs_free_path(path); - return ret; - } -diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c -index fb4992570c2b59..2045ac3d94c4df 100644 ---- a/fs/btrfs/super.c -+++ b/fs/btrfs/super.c -@@ -1336,8 +1336,7 @@ static int btrfs_show_options(struct seq_file *seq, struct dentry *dentry) - subvol_name = btrfs_get_subvol_name_from_objectid(info, - BTRFS_I(d_inode(dentry))->root->root_key.objectid); - if (!IS_ERR(subvol_name)) { -- seq_puts(seq, ",subvol="); -- seq_escape(seq, subvol_name, " \t\n\\"); -+ seq_show_option(seq, "subvol", subvol_name); - kfree(subvol_name); - } - return 0; -diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c -index c4463c3f2068dd..197dfafbf40139 100644 ---- a/fs/btrfs/zoned.c -+++ b/fs/btrfs/zoned.c -@@ -2006,6 +2006,9 @@ bool btrfs_zone_activate(struct btrfs_block_group *block_group) - physical = map->stripes[i].physical; - zinfo = device->zone_info; - -+ if (!device->bdev) -+ continue; -+ - if (zinfo->max_active_zones == 0) - continue; - -@@ -2165,6 +2168,9 @@ static int do_zone_finish(struct btrfs_block_group *block_group, bool fully_writ - const u64 physical = map->stripes[i].physical; - struct btrfs_zoned_device_info *zinfo = device->zone_info; - -+ if (!device->bdev) -+ continue; -+ - if (zinfo->max_active_zones == 0) - continue; - -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 19d7bcf16ebb88..ddfeaf19bff1ba 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -4692,22 +4692,43 @@ static inline void ext4_inode_set_iversion_queried(struct inode *inode, u64 val) - inode_set_iversion_queried(inode, val); - } - --static const char *check_igot_inode(struct inode *inode, ext4_iget_flags flags) -- -+static int check_igot_inode(struct inode *inode, ext4_iget_flags flags, -+ const char *function, unsigned int line) - { -+ const char *err_str; -+ - if (flags & EXT4_IGET_EA_INODE) { -- if (!(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)) -- return "missing EA_INODE flag"; -+ if (!(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)) { -+ err_str = "missing EA_INODE flag"; -+ goto error; -+ } - if (ext4_test_inode_state(inode, EXT4_STATE_XATTR) || -- EXT4_I(inode)->i_file_acl) -- return "ea_inode with extended attributes"; -+ EXT4_I(inode)->i_file_acl) { -+ err_str = "ea_inode with extended attributes"; -+ goto error; -+ } - } else { -- if ((EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)) -- return "unexpected EA_INODE flag"; -+ if ((EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)) { -+ /* -+ * open_by_handle_at() could provide an old inode number -+ * that has since been reused for an ea_inode; this does -+ * not indicate filesystem corruption -+ */ -+ if (flags & EXT4_IGET_HANDLE) -+ return -ESTALE; -+ err_str = "unexpected EA_INODE flag"; -+ goto error; -+ } -+ } -+ if (is_bad_inode(inode) && !(flags & EXT4_IGET_BAD)) { -+ err_str = "unexpected bad inode w/o EXT4_IGET_BAD"; -+ goto error; - } -- if (is_bad_inode(inode) && !(flags & EXT4_IGET_BAD)) -- return "unexpected bad inode w/o EXT4_IGET_BAD"; -- return NULL; -+ return 0; -+ -+error: -+ ext4_error_inode(inode, function, line, 0, err_str); -+ return -EFSCORRUPTED; - } - - struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, -@@ -4719,7 +4740,6 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, - struct ext4_inode_info *ei; - struct ext4_super_block *es = EXT4_SB(sb)->s_es; - struct inode *inode; -- const char *err_str; - journal_t *journal = EXT4_SB(sb)->s_journal; - long ret; - loff_t size; -@@ -4748,10 +4768,10 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, - if (!inode) - return ERR_PTR(-ENOMEM); - if (!(inode->i_state & I_NEW)) { -- if ((err_str = check_igot_inode(inode, flags)) != NULL) { -- ext4_error_inode(inode, function, line, 0, err_str); -+ ret = check_igot_inode(inode, flags, function, line); -+ if (ret) { - iput(inode); -- return ERR_PTR(-EFSCORRUPTED); -+ return ERR_PTR(ret); - } - return inode; - } -@@ -5023,13 +5043,21 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, - ret = -EFSCORRUPTED; - goto bad_inode; - } -- if ((err_str = check_igot_inode(inode, flags)) != NULL) { -- ext4_error_inode(inode, function, line, 0, err_str); -- ret = -EFSCORRUPTED; -- goto bad_inode; -+ ret = check_igot_inode(inode, flags, function, line); -+ /* -+ * -ESTALE here means there is nothing inherently wrong with the inode, -+ * it's just not an inode we can return for an fhandle lookup. -+ */ -+ if (ret == -ESTALE) { -+ brelse(iloc.bh); -+ unlock_new_inode(inode); -+ iput(inode); -+ return ERR_PTR(-ESTALE); - } -- -+ if (ret) -+ goto bad_inode; - brelse(iloc.bh); -+ - unlock_new_inode(inode); - return inode; - -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index 96a048d3f51bf5..2e4575becd4fbf 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -2041,7 +2041,7 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir, - * split it in half by count; each resulting block will have at least - * half the space free. - */ -- if (i > 0) -+ if (i >= 0) - split = count - move; - else - split = count/2; -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index a4d7af7495b784..751c879271e05e 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -6933,12 +6933,25 @@ static int ext4_release_dquot(struct dquot *dquot) - { - int ret, err; - handle_t *handle; -+ bool freeze_protected = false; -+ -+ /* -+ * Trying to sb_start_intwrite() in a running transaction -+ * can result in a deadlock. Further, running transactions -+ * are already protected from freezing. -+ */ -+ if (!ext4_journal_current_handle()) { -+ sb_start_intwrite(dquot->dq_sb); -+ freeze_protected = true; -+ } - - handle = ext4_journal_start(dquot_to_inode(dquot), EXT4_HT_QUOTA, - EXT4_QUOTA_DEL_BLOCKS(dquot->dq_sb)); - if (IS_ERR(handle)) { - /* Release dquot anyway to avoid endless cycle in dqput() */ - dquot_release(dquot); -+ if (freeze_protected) -+ sb_end_intwrite(dquot->dq_sb); - return PTR_ERR(handle); - } - ret = dquot_release(dquot); -@@ -6949,6 +6962,10 @@ static int ext4_release_dquot(struct dquot *dquot) - err = ext4_journal_stop(handle); - if (!ret) - ret = err; -+ -+ if (freeze_protected) -+ sb_end_intwrite(dquot->dq_sb); -+ - return ret; - } - -diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c -index df5ab1a75fc482..ca22aa9e04b4b1 100644 ---- a/fs/ext4/xattr.c -+++ b/fs/ext4/xattr.c -@@ -1176,15 +1176,24 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent, - { - struct inode *ea_inode; - struct ext4_xattr_entry *entry; -+ struct ext4_iloc iloc; - bool dirty = false; - unsigned int ea_ino; - int err; - int credits; -+ void *end; -+ -+ if (block_csum) -+ end = (void *)bh->b_data + bh->b_size; -+ else { -+ ext4_get_inode_loc(parent, &iloc); -+ end = (void *)ext4_raw_inode(&iloc) + EXT4_SB(parent->i_sb)->s_inode_size; -+ } - - /* One credit for dec ref on ea_inode, one for orphan list addition, */ - credits = 2 + extra_credits; - -- for (entry = first; !IS_LAST_ENTRY(entry); -+ for (entry = first; (void *)entry < end && !IS_LAST_ENTRY(entry); - entry = EXT4_XATTR_NEXT(entry)) { - if (!entry->e_value_inum) - continue; -diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c -index c6317596e695cc..3ec815e615e731 100644 ---- a/fs/f2fs/checkpoint.c -+++ b/fs/f2fs/checkpoint.c -@@ -1327,21 +1327,13 @@ static void update_ckpt_flags(struct f2fs_sb_info *sbi, struct cp_control *cpc) - struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi); - unsigned long flags; - -- if (cpc->reason & CP_UMOUNT) { -- if (le32_to_cpu(ckpt->cp_pack_total_block_count) + -- NM_I(sbi)->nat_bits_blocks > BLKS_PER_SEG(sbi)) { -- clear_ckpt_flags(sbi, CP_NAT_BITS_FLAG); -- f2fs_notice(sbi, "Disable nat_bits due to no space"); -- } else if (!is_set_ckpt_flags(sbi, CP_NAT_BITS_FLAG) && -- f2fs_nat_bitmap_enabled(sbi)) { -- f2fs_enable_nat_bits(sbi); -- set_ckpt_flags(sbi, CP_NAT_BITS_FLAG); -- f2fs_notice(sbi, "Rebuild and enable nat_bits"); -- } -- } -- - spin_lock_irqsave(&sbi->cp_lock, flags); - -+ if ((cpc->reason & CP_UMOUNT) && -+ le32_to_cpu(ckpt->cp_pack_total_block_count) > -+ sbi->blocks_per_seg - NM_I(sbi)->nat_bits_blocks) -+ disable_nat_bits(sbi, false); -+ - if (cpc->reason & CP_TRIMMED) - __set_ckpt_flags(ckpt, CP_TRIMMED_FLAG); - else -@@ -1524,8 +1516,7 @@ static int do_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc) - start_blk = __start_cp_next_addr(sbi); - - /* write nat bits */ -- if ((cpc->reason & CP_UMOUNT) && -- is_set_ckpt_flags(sbi, CP_NAT_BITS_FLAG)) { -+ if (enabled_nat_bits(sbi, cpc)) { - __u64 cp_ver = cur_cp_version(ckpt); - block_t blk; - -diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h -index d28e3df61cc4fd..5f6f159be456ea 100644 ---- a/fs/f2fs/f2fs.h -+++ b/fs/f2fs/f2fs.h -@@ -2197,6 +2197,36 @@ static inline void f2fs_up_write(struct f2fs_rwsem *sem) - #endif - } - -+static inline void disable_nat_bits(struct f2fs_sb_info *sbi, bool lock) -+{ -+ unsigned long flags; -+ unsigned char *nat_bits; -+ -+ /* -+ * In order to re-enable nat_bits we need to call fsck.f2fs by -+ * set_sbi_flag(sbi, SBI_NEED_FSCK). But it may give huge cost, -+ * so let's rely on regular fsck or unclean shutdown. -+ */ -+ -+ if (lock) -+ spin_lock_irqsave(&sbi->cp_lock, flags); -+ __clear_ckpt_flags(F2FS_CKPT(sbi), CP_NAT_BITS_FLAG); -+ nat_bits = NM_I(sbi)->nat_bits; -+ NM_I(sbi)->nat_bits = NULL; -+ if (lock) -+ spin_unlock_irqrestore(&sbi->cp_lock, flags); -+ -+ kvfree(nat_bits); -+} -+ -+static inline bool enabled_nat_bits(struct f2fs_sb_info *sbi, -+ struct cp_control *cpc) -+{ -+ bool set = is_set_ckpt_flags(sbi, CP_NAT_BITS_FLAG); -+ -+ return (cpc) ? (cpc->reason & CP_UMOUNT) && set : set; -+} -+ - static inline void f2fs_lock_op(struct f2fs_sb_info *sbi) - { - f2fs_down_read(&sbi->cp_rwsem); -@@ -3623,7 +3653,6 @@ int f2fs_truncate_inode_blocks(struct inode *inode, pgoff_t from); - int f2fs_truncate_xattr_node(struct inode *inode); - int f2fs_wait_on_node_pages_writeback(struct f2fs_sb_info *sbi, - unsigned int seq_id); --bool f2fs_nat_bitmap_enabled(struct f2fs_sb_info *sbi); - int f2fs_remove_inode_page(struct inode *inode); - struct page *f2fs_new_inode_page(struct inode *inode); - struct page *f2fs_new_node_page(struct dnode_of_data *dn, unsigned int ofs); -@@ -3648,7 +3677,6 @@ int f2fs_recover_xattr_data(struct inode *inode, struct page *page); - int f2fs_recover_inode_page(struct f2fs_sb_info *sbi, struct page *page); - int f2fs_restore_node_summary(struct f2fs_sb_info *sbi, - unsigned int segno, struct f2fs_summary_block *sum); --void f2fs_enable_nat_bits(struct f2fs_sb_info *sbi); - int f2fs_flush_nat_entries(struct f2fs_sb_info *sbi, struct cp_control *cpc); - int f2fs_build_node_manager(struct f2fs_sb_info *sbi); - void f2fs_destroy_node_manager(struct f2fs_sb_info *sbi); -diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c -index 7ad4a924175917..06941705e8939f 100644 ---- a/fs/f2fs/inode.c -+++ b/fs/f2fs/inode.c -@@ -35,10 +35,8 @@ void f2fs_mark_inode_dirty_sync(struct inode *inode, bool sync) - if (f2fs_inode_dirtied(inode, sync)) - return; - -- if (f2fs_is_atomic_file(inode)) { -- set_inode_flag(inode, FI_ATOMIC_DIRTIED); -+ if (f2fs_is_atomic_file(inode)) - return; -- } - - mark_inode_dirty_sync(inode); - } -@@ -764,8 +762,12 @@ void f2fs_update_inode_page(struct inode *inode) - if (err == -ENOENT) - return; - -+ if (err == -EFSCORRUPTED) -+ goto stop_checkpoint; -+ - if (err == -ENOMEM || ++count <= DEFAULT_RETRY_IO_COUNT) - goto retry; -+stop_checkpoint: - f2fs_stop_checkpoint(sbi, false, STOP_CP_REASON_UPDATE_INODE); - return; - } -diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c -index dedba481b66d07..b00d66b953210d 100644 ---- a/fs/f2fs/node.c -+++ b/fs/f2fs/node.c -@@ -1134,7 +1134,14 @@ int f2fs_truncate_inode_blocks(struct inode *inode, pgoff_t from) - trace_f2fs_truncate_inode_blocks_enter(inode, from); - - level = get_node_path(inode, from, offset, noffset); -- if (level < 0) { -+ if (level <= 0) { -+ if (!level) { -+ level = -EFSCORRUPTED; -+ f2fs_err(sbi, "%s: inode ino=%lx has corrupted node block, from:%lu addrs:%u", -+ __func__, inode->i_ino, -+ from, ADDRS_PER_INODE(inode)); -+ set_sbi_flag(sbi, SBI_NEED_FSCK); -+ } - trace_f2fs_truncate_inode_blocks_exit(inode, level); - return level; - } -@@ -2258,24 +2265,6 @@ static void __move_free_nid(struct f2fs_sb_info *sbi, struct free_nid *i, - } - } - --bool f2fs_nat_bitmap_enabled(struct f2fs_sb_info *sbi) --{ -- struct f2fs_nm_info *nm_i = NM_I(sbi); -- unsigned int i; -- bool ret = true; -- -- f2fs_down_read(&nm_i->nat_tree_lock); -- for (i = 0; i < nm_i->nat_blocks; i++) { -- if (!test_bit_le(i, nm_i->nat_block_bitmap)) { -- ret = false; -- break; -- } -- } -- f2fs_up_read(&nm_i->nat_tree_lock); -- -- return ret; --} -- - static void update_free_nid_bitmap(struct f2fs_sb_info *sbi, nid_t nid, - bool set, bool build) - { -@@ -2954,23 +2943,7 @@ static void __adjust_nat_entry_set(struct nat_entry_set *nes, - list_add_tail(&nes->set_list, head); - } - --static void __update_nat_bits(struct f2fs_nm_info *nm_i, unsigned int nat_ofs, -- unsigned int valid) --{ -- if (valid == 0) { -- __set_bit_le(nat_ofs, nm_i->empty_nat_bits); -- __clear_bit_le(nat_ofs, nm_i->full_nat_bits); -- return; -- } -- -- __clear_bit_le(nat_ofs, nm_i->empty_nat_bits); -- if (valid == NAT_ENTRY_PER_BLOCK) -- __set_bit_le(nat_ofs, nm_i->full_nat_bits); -- else -- __clear_bit_le(nat_ofs, nm_i->full_nat_bits); --} -- --static void update_nat_bits(struct f2fs_sb_info *sbi, nid_t start_nid, -+static void __update_nat_bits(struct f2fs_sb_info *sbi, nid_t start_nid, - struct page *page) - { - struct f2fs_nm_info *nm_i = NM_I(sbi); -@@ -2979,7 +2952,7 @@ static void update_nat_bits(struct f2fs_sb_info *sbi, nid_t start_nid, - int valid = 0; - int i = 0; - -- if (!is_set_ckpt_flags(sbi, CP_NAT_BITS_FLAG)) -+ if (!enabled_nat_bits(sbi, NULL)) - return; - - if (nat_index == 0) { -@@ -2990,36 +2963,17 @@ static void update_nat_bits(struct f2fs_sb_info *sbi, nid_t start_nid, - if (le32_to_cpu(nat_blk->entries[i].block_addr) != NULL_ADDR) - valid++; - } -- -- __update_nat_bits(nm_i, nat_index, valid); --} -- --void f2fs_enable_nat_bits(struct f2fs_sb_info *sbi) --{ -- struct f2fs_nm_info *nm_i = NM_I(sbi); -- unsigned int nat_ofs; -- -- f2fs_down_read(&nm_i->nat_tree_lock); -- -- for (nat_ofs = 0; nat_ofs < nm_i->nat_blocks; nat_ofs++) { -- unsigned int valid = 0, nid_ofs = 0; -- -- /* handle nid zero due to it should never be used */ -- if (unlikely(nat_ofs == 0)) { -- valid = 1; -- nid_ofs = 1; -- } -- -- for (; nid_ofs < NAT_ENTRY_PER_BLOCK; nid_ofs++) { -- if (!test_bit_le(nid_ofs, -- nm_i->free_nid_bitmap[nat_ofs])) -- valid++; -- } -- -- __update_nat_bits(nm_i, nat_ofs, valid); -+ if (valid == 0) { -+ __set_bit_le(nat_index, nm_i->empty_nat_bits); -+ __clear_bit_le(nat_index, nm_i->full_nat_bits); -+ return; - } - -- f2fs_up_read(&nm_i->nat_tree_lock); -+ __clear_bit_le(nat_index, nm_i->empty_nat_bits); -+ if (valid == NAT_ENTRY_PER_BLOCK) -+ __set_bit_le(nat_index, nm_i->full_nat_bits); -+ else -+ __clear_bit_le(nat_index, nm_i->full_nat_bits); - } - - static int __flush_nat_entry_set(struct f2fs_sb_info *sbi, -@@ -3038,7 +2992,7 @@ static int __flush_nat_entry_set(struct f2fs_sb_info *sbi, - * #1, flush nat entries to journal in current hot data summary block. - * #2, flush nat entries to nat page. - */ -- if ((cpc->reason & CP_UMOUNT) || -+ if (enabled_nat_bits(sbi, cpc) || - !__has_cursum_space(journal, set->entry_cnt, NAT_JOURNAL)) - to_journal = false; - -@@ -3085,7 +3039,7 @@ static int __flush_nat_entry_set(struct f2fs_sb_info *sbi, - if (to_journal) { - up_write(&curseg->journal_rwsem); - } else { -- update_nat_bits(sbi, start_nid, page); -+ __update_nat_bits(sbi, start_nid, page); - f2fs_put_page(page, 1); - } - -@@ -3116,7 +3070,7 @@ int f2fs_flush_nat_entries(struct f2fs_sb_info *sbi, struct cp_control *cpc) - * during unmount, let's flush nat_bits before checking - * nat_cnt[DIRTY_NAT]. - */ -- if (cpc->reason & CP_UMOUNT) { -+ if (enabled_nat_bits(sbi, cpc)) { - f2fs_down_write(&nm_i->nat_tree_lock); - remove_nats_in_journal(sbi); - f2fs_up_write(&nm_i->nat_tree_lock); -@@ -3132,7 +3086,7 @@ int f2fs_flush_nat_entries(struct f2fs_sb_info *sbi, struct cp_control *cpc) - * entries, remove all entries from journal and merge them - * into nat entry set. - */ -- if (cpc->reason & CP_UMOUNT || -+ if (enabled_nat_bits(sbi, cpc) || - !__has_cursum_space(journal, - nm_i->nat_cnt[DIRTY_NAT], NAT_JOURNAL)) - remove_nats_in_journal(sbi); -@@ -3169,18 +3123,15 @@ static int __get_nat_bitmaps(struct f2fs_sb_info *sbi) - __u64 cp_ver = cur_cp_version(ckpt); - block_t nat_bits_addr; - -+ if (!enabled_nat_bits(sbi, NULL)) -+ return 0; -+ - nm_i->nat_bits_blocks = F2FS_BLK_ALIGN((nat_bits_bytes << 1) + 8); - nm_i->nat_bits = f2fs_kvzalloc(sbi, - nm_i->nat_bits_blocks << F2FS_BLKSIZE_BITS, GFP_KERNEL); - if (!nm_i->nat_bits) - return -ENOMEM; - -- nm_i->full_nat_bits = nm_i->nat_bits + 8; -- nm_i->empty_nat_bits = nm_i->full_nat_bits + nat_bits_bytes; -- -- if (!is_set_ckpt_flags(sbi, CP_NAT_BITS_FLAG)) -- return 0; -- - nat_bits_addr = __start_cp_addr(sbi) + BLKS_PER_SEG(sbi) - - nm_i->nat_bits_blocks; - for (i = 0; i < nm_i->nat_bits_blocks; i++) { -@@ -3197,12 +3148,13 @@ static int __get_nat_bitmaps(struct f2fs_sb_info *sbi) - - cp_ver |= (cur_cp_crc(ckpt) << 32); - if (cpu_to_le64(cp_ver) != *(__le64 *)nm_i->nat_bits) { -- clear_ckpt_flags(sbi, CP_NAT_BITS_FLAG); -- f2fs_notice(sbi, "Disable nat_bits due to incorrect cp_ver (%llu, %llu)", -- cp_ver, le64_to_cpu(*(__le64 *)nm_i->nat_bits)); -+ disable_nat_bits(sbi, true); - return 0; - } - -+ nm_i->full_nat_bits = nm_i->nat_bits + 8; -+ nm_i->empty_nat_bits = nm_i->full_nat_bits + nat_bits_bytes; -+ - f2fs_notice(sbi, "Found nat_bits in checkpoint"); - return 0; - } -@@ -3213,7 +3165,7 @@ static inline void load_free_nid_bitmap(struct f2fs_sb_info *sbi) - unsigned int i = 0; - nid_t nid, last_nid; - -- if (!is_set_ckpt_flags(sbi, CP_NAT_BITS_FLAG)) -+ if (!enabled_nat_bits(sbi, NULL)) - return; - - for (i = 0; i < nm_i->nat_blocks; i++) { -diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c -index aa0e7cc2489ac9..4cc87921aac3ed 100644 ---- a/fs/f2fs/super.c -+++ b/fs/f2fs/super.c -@@ -1499,6 +1499,10 @@ int f2fs_inode_dirtied(struct inode *inode, bool sync) - inc_page_count(sbi, F2FS_DIRTY_IMETA); - } - spin_unlock(&sbi->inode_lock[DIRTY_META]); -+ -+ if (!ret && f2fs_is_atomic_file(inode)) -+ set_inode_flag(inode, FI_ATOMIC_DIRTIED); -+ - return ret; - } - -diff --git a/fs/file.c b/fs/file.c -index a178efc8cf4b5c..f8cf6728c6a03f 100644 ---- a/fs/file.c -+++ b/fs/file.c -@@ -362,17 +362,25 @@ struct files_struct *dup_fd(struct files_struct *oldf, struct fd_range *punch_ho - old_fds = old_fdt->fd; - new_fds = new_fdt->fd; - -+ /* -+ * We may be racing against fd allocation from other threads using this -+ * files_struct, despite holding ->file_lock. -+ * -+ * alloc_fd() might have already claimed a slot, while fd_install() -+ * did not populate it yet. Note the latter operates locklessly, so -+ * the file can show up as we are walking the array below. -+ * -+ * At the same time we know no files will disappear as all other -+ * operations take the lock. -+ * -+ * Instead of trying to placate userspace racing with itself, we -+ * ref the file if we see it and mark the fd slot as unused otherwise. -+ */ - for (i = open_files; i != 0; i--) { -- struct file *f = *old_fds++; -+ struct file *f = rcu_dereference_raw(*old_fds++); - if (f) { - get_file(f); - } else { -- /* -- * The fd may be claimed in the fd bitmap but not yet -- * instantiated in the files array if a sibling thread -- * is partway through open(). So make sure that this -- * fd is available to the new process. -- */ - __clear_open_fd(open_files - i, new_fdt); - } - rcu_assign_pointer(*new_fds++, f); -@@ -625,7 +633,7 @@ static struct file *pick_file(struct files_struct *files, unsigned fd) - return NULL; - - fd = array_index_nospec(fd, fdt->max_fds); -- file = fdt->fd[fd]; -+ file = rcu_dereference_raw(fdt->fd[fd]); - if (file) { - rcu_assign_pointer(fdt->fd[fd], NULL); - __put_unused_fd(files, fd); -@@ -1095,7 +1103,7 @@ __releases(&files->file_lock) - */ - fdt = files_fdtable(files); - fd = array_index_nospec(fd, fdt->max_fds); -- tofree = fdt->fd[fd]; -+ tofree = rcu_dereference_raw(fdt->fd[fd]); - if (!tofree && fd_is_open(fd, fdt)) - goto Ebusy; - get_file(file); -diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c -index d84dacbdce2c9d..a6814bea0e0ad8 100644 ---- a/fs/fuse/virtio_fs.c -+++ b/fs/fuse/virtio_fs.c -@@ -1430,6 +1430,9 @@ static int virtio_fs_get_tree(struct fs_context *fsc) - unsigned int virtqueue_size; - int err = -EIO; - -+ if (!fsc->source) -+ return invalf(fsc, "No source specified"); -+ - /* This gets a reference on virtio_fs object. This ptr gets installed - * in fc->iq->priv. Once fuse_conn is going away, it calls ->put() - * to drop the reference to this object. -diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c -index 6add6ebfef8967..cb823a8a6ba960 100644 ---- a/fs/hfs/bnode.c -+++ b/fs/hfs/bnode.c -@@ -67,6 +67,12 @@ void hfs_bnode_read_key(struct hfs_bnode *node, void *key, int off) - else - key_len = tree->max_key_len + 1; - -+ if (key_len > sizeof(hfs_btree_key) || key_len < 1) { -+ memset(key, 0, sizeof(hfs_btree_key)); -+ pr_err("hfs: Invalid key length: %d\n", key_len); -+ return; -+ } -+ - hfs_bnode_read(node, key, off, key_len); - } - -diff --git a/fs/hfsplus/bnode.c b/fs/hfsplus/bnode.c -index 87974d5e679156..079ea80534f7de 100644 ---- a/fs/hfsplus/bnode.c -+++ b/fs/hfsplus/bnode.c -@@ -67,6 +67,12 @@ void hfs_bnode_read_key(struct hfs_bnode *node, void *key, int off) - else - key_len = tree->max_key_len + 2; - -+ if (key_len > sizeof(hfsplus_btree_key) || key_len < 1) { -+ memset(key, 0, sizeof(hfsplus_btree_key)); -+ pr_err("hfsplus: Invalid key length: %d\n", key_len); -+ return; -+ } -+ - hfs_bnode_read(node, key, off, key_len); - } - -diff --git a/fs/isofs/export.c b/fs/isofs/export.c -index 35768a63fb1d23..421d247fae5230 100644 ---- a/fs/isofs/export.c -+++ b/fs/isofs/export.c -@@ -180,7 +180,7 @@ static struct dentry *isofs_fh_to_parent(struct super_block *sb, - return NULL; - - return isofs_export_iget(sb, -- fh_len > 2 ? ifid->parent_block : 0, -+ fh_len > 3 ? ifid->parent_block : 0, - ifid->parent_offset, - fh_len > 4 ? ifid->parent_generation : 0); - } -diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c -index dfbb8f73861f64..ddde73299d6224 100644 ---- a/fs/jbd2/journal.c -+++ b/fs/jbd2/journal.c -@@ -1914,7 +1914,6 @@ int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, - - /* Log is no longer empty */ - write_lock(&journal->j_state_lock); -- WARN_ON(!sb->s_sequence); - journal->j_flags &= ~JBD2_FLUSHED; - write_unlock(&journal->j_state_lock); - -diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c -index f9009e4f9ffd89..0e1019382cf519 100644 ---- a/fs/jfs/jfs_dmap.c -+++ b/fs/jfs/jfs_dmap.c -@@ -204,6 +204,10 @@ int dbMount(struct inode *ipbmap) - bmp->db_aglevel = le32_to_cpu(dbmp_le->dn_aglevel); - bmp->db_agheight = le32_to_cpu(dbmp_le->dn_agheight); - bmp->db_agwidth = le32_to_cpu(dbmp_le->dn_agwidth); -+ if (!bmp->db_agwidth) { -+ err = -EINVAL; -+ goto err_release_metapage; -+ } - bmp->db_agstart = le32_to_cpu(dbmp_le->dn_agstart); - bmp->db_agl2size = le32_to_cpu(dbmp_le->dn_agl2size); - if (bmp->db_agl2size > L2MAXL2SIZE - L2MAXAG || -@@ -3403,7 +3407,7 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks) - oldl2agsize = bmp->db_agl2size; - - bmp->db_agl2size = l2agsize; -- bmp->db_agsize = 1 << l2agsize; -+ bmp->db_agsize = (s64)1 << l2agsize; - - /* compute new number of AG */ - agno = bmp->db_numag; -@@ -3666,8 +3670,8 @@ void dbFinalizeBmap(struct inode *ipbmap) - * system size is not a multiple of the group size). - */ - inactfree = (inactags && ag_rem) ? -- ((inactags - 1) << bmp->db_agl2size) + ag_rem -- : inactags << bmp->db_agl2size; -+ (((s64)inactags - 1) << bmp->db_agl2size) + ag_rem -+ : ((s64)inactags << bmp->db_agl2size); - - /* determine how many free blocks are in the active - * allocation groups plus the average number of free blocks -diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c -index b30e4cf2f5794c..9a6d504228e7c5 100644 ---- a/fs/jfs/jfs_imap.c -+++ b/fs/jfs/jfs_imap.c -@@ -102,7 +102,7 @@ int diMount(struct inode *ipimap) - * allocate/initialize the in-memory inode map control structure - */ - /* allocate the in-memory inode map control structure. */ -- imap = kmalloc(sizeof(struct inomap), GFP_KERNEL); -+ imap = kzalloc(sizeof(struct inomap), GFP_KERNEL); - if (imap == NULL) - return -ENOMEM; - -@@ -456,7 +456,7 @@ struct inode *diReadSpecial(struct super_block *sb, ino_t inum, int secondary) - dp += inum % 8; /* 8 inodes per 4K page */ - - /* copy on-disk inode to in-memory inode */ -- if ((copy_from_dinode(dp, ip)) != 0) { -+ if ((copy_from_dinode(dp, ip) != 0) || (ip->i_nlink == 0)) { - /* handle bad return by returning NULL for ip */ - set_nlink(ip, 1); /* Don't want iput() deleting it */ - iput(ip); -diff --git a/fs/namespace.c b/fs/namespace.c -index b4385e2413d599..671e266b8fc5d2 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -1869,6 +1869,7 @@ static void warn_mandlock(void) - static int can_umount(const struct path *path, int flags) - { - struct mount *mnt = real_mount(path->mnt); -+ struct super_block *sb = path->dentry->d_sb; - - if (!may_mount()) - return -EPERM; -@@ -1878,7 +1879,7 @@ static int can_umount(const struct path *path, int flags) - return -EINVAL; - if (mnt->mnt.mnt_flags & MNT_LOCKED) /* Check optimistically */ - return -EINVAL; -- if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN)) -+ if (flags & MNT_FORCE && !ns_capable(sb->s_user_ns, CAP_SYS_ADMIN)) - return -EPERM; - return 0; - } -diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig -index 7df2503cef6c30..2d99f5e7a686b0 100644 ---- a/fs/nfs/Kconfig -+++ b/fs/nfs/Kconfig -@@ -2,6 +2,7 @@ - config NFS_FS - tristate "NFS client support" - depends on INET && FILE_LOCKING && MULTIUSER -+ select CRC32 - select LOCKD - select SUNRPC - select NFS_ACL_SUPPORT if NFS_V3_ACL -@@ -194,7 +195,6 @@ config NFS_USE_KERNEL_DNS - config NFS_DEBUG - bool - depends on NFS_FS && SUNRPC_DEBUG -- select CRC32 - default y - - config NFS_DISABLE_UDP_SUPPORT -diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h -index a92b234ae0870b..ca49d999159eb1 100644 ---- a/fs/nfs/internal.h -+++ b/fs/nfs/internal.h -@@ -859,18 +859,11 @@ u64 nfs_timespec_to_change_attr(const struct timespec64 *ts) - return ((u64)ts->tv_sec << 30) + ts->tv_nsec; - } - --#ifdef CONFIG_CRC32 - static inline u32 nfs_stateid_hash(const nfs4_stateid *stateid) - { - return ~crc32_le(0xFFFFFFFF, &stateid->other[0], - NFS4_STATEID_OTHER_SIZE); - } --#else --static inline u32 nfs_stateid_hash(nfs4_stateid *stateid) --{ -- return 0; --} --#endif - - static inline bool nfs_error_is_fatal(int err) - { -diff --git a/fs/nfs/nfs4session.h b/fs/nfs/nfs4session.h -index 351616c61df541..f9c291e2165cd8 100644 ---- a/fs/nfs/nfs4session.h -+++ b/fs/nfs/nfs4session.h -@@ -148,16 +148,12 @@ static inline void nfs4_copy_sessionid(struct nfs4_sessionid *dst, - memcpy(dst->data, src->data, NFS4_MAX_SESSIONID_LEN); - } - --#ifdef CONFIG_CRC32 - /* - * nfs_session_id_hash - calculate the crc32 hash for the session id - * @session - pointer to session - */ - #define nfs_session_id_hash(sess_id) \ - (~crc32_le(0xFFFFFFFF, &(sess_id)->data[0], sizeof((sess_id)->data))) --#else --#define nfs_session_id_hash(session) (0) --#endif - #else /* defined(CONFIG_NFS_V4_1) */ - - static inline int nfs4_init_session(struct nfs_client *clp) -diff --git a/fs/nfsd/Kconfig b/fs/nfsd/Kconfig -index 43b88eaf0673ab..05c10f70456ccd 100644 ---- a/fs/nfsd/Kconfig -+++ b/fs/nfsd/Kconfig -@@ -4,6 +4,7 @@ config NFSD - depends on INET - depends on FILE_LOCKING - depends on FSNOTIFY -+ select CRC32 - select LOCKD - select SUNRPC - select EXPORTFS -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index 140784446ad220..e2875706e6bfd7 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -4938,7 +4938,7 @@ static void nfsd_break_one_deleg(struct nfs4_delegation *dp) - queued = nfsd4_run_cb(&dp->dl_recall); - WARN_ON_ONCE(!queued); - if (!queued) -- nfs4_put_stid(&dp->dl_stid); -+ refcount_dec(&dp->dl_stid.sc_count); - } - - /* Called from break_lease() with flc_lock held. */ -diff --git a/fs/nfsd/nfsfh.h b/fs/nfsd/nfsfh.h -index 40426f899e7601..f1420d3510d2ef 100644 ---- a/fs/nfsd/nfsfh.h -+++ b/fs/nfsd/nfsfh.h -@@ -263,7 +263,6 @@ static inline bool fh_fsid_match(const struct knfsd_fh *fh1, - return true; - } - --#ifdef CONFIG_CRC32 - /** - * knfsd_fh_hash - calculate the crc32 hash for the filehandle - * @fh - pointer to filehandle -@@ -275,12 +274,6 @@ static inline u32 knfsd_fh_hash(const struct knfsd_fh *fh) - { - return ~crc32_le(0xFFFFFFFF, fh->fh_raw, fh->fh_size); - } --#else --static inline u32 knfsd_fh_hash(const struct knfsd_fh *fh) --{ -- return 0; --} --#endif - - /** - * fh_clear_pre_post_attrs - Reset pre/post attributes -diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h -index 981967e507b3e1..23b5c5f9c78231 100644 ---- a/fs/overlayfs/overlayfs.h -+++ b/fs/overlayfs/overlayfs.h -@@ -506,8 +506,6 @@ int ovl_set_metacopy_xattr(struct ovl_fs *ofs, struct dentry *d, - bool ovl_is_metacopy_dentry(struct dentry *dentry); - char *ovl_get_redirect_xattr(struct ovl_fs *ofs, const struct path *path, int padding); - int ovl_ensure_verity_loaded(struct path *path); --int ovl_get_verity_xattr(struct ovl_fs *ofs, const struct path *path, -- u8 *digest_buf, int *buf_length); - int ovl_validate_verity(struct ovl_fs *ofs, - struct path *metapath, - struct path *datapath); -diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c -index 2c056d737c27c3..93ee57bc82ade9 100644 ---- a/fs/overlayfs/super.c -+++ b/fs/overlayfs/super.c -@@ -1180,6 +1180,11 @@ static struct ovl_entry *ovl_get_lowerstack(struct super_block *sb, - return ERR_PTR(-EINVAL); - } - -+ if (ctx->nr == ctx->nr_data) { -+ pr_err("at least one non-data lowerdir is required\n"); -+ return ERR_PTR(-EINVAL); -+ } -+ - err = -EINVAL; - for (i = 0; i < ctx->nr; i++) { - l = &ctx->lower[i]; -diff --git a/fs/smb/client/cifsproto.h b/fs/smb/client/cifsproto.h -index 85b0a30493a638..7f97e54686524b 100644 ---- a/fs/smb/client/cifsproto.h -+++ b/fs/smb/client/cifsproto.h -@@ -158,6 +158,8 @@ extern int cifs_get_writable_path(struct cifs_tcon *tcon, const char *name, - extern struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *, bool); - extern int cifs_get_readable_path(struct cifs_tcon *tcon, const char *name, - struct cifsFileInfo **ret_file); -+extern int cifs_get_hardlink_path(struct cifs_tcon *tcon, struct inode *inode, -+ struct file *file); - extern unsigned int smbCalcSize(void *buf); - extern int decode_negTokenInit(unsigned char *security_blob, int length, - struct TCP_Server_Info *server); -diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c -index 2d2e41ac9e9d83..54aba8d642ee75 100644 ---- a/fs/smb/client/connect.c -+++ b/fs/smb/client/connect.c -@@ -316,7 +316,6 @@ cifs_abort_connection(struct TCP_Server_Info *server) - server->ssocket->flags); - sock_release(server->ssocket); - server->ssocket = NULL; -- put_net(cifs_net_ns(server)); - } - server->sequence_number = 0; - server->session_estab = false; -@@ -1004,13 +1003,9 @@ clean_demultiplex_info(struct TCP_Server_Info *server) - msleep(125); - if (cifs_rdma_enabled(server)) - smbd_destroy(server); -- - if (server->ssocket) { - sock_release(server->ssocket); - server->ssocket = NULL; -- -- /* Release netns reference for the socket. */ -- put_net(cifs_net_ns(server)); - } - - if (!list_empty(&server->pending_mid_q)) { -@@ -1059,7 +1054,6 @@ clean_demultiplex_info(struct TCP_Server_Info *server) - */ - } - -- /* Release netns reference for this server. */ - put_net(cifs_net_ns(server)); - kfree(server->leaf_fullpath); - kfree(server->hostname); -@@ -1731,8 +1725,6 @@ cifs_get_tcp_session(struct smb3_fs_context *ctx, - - tcp_ses->ops = ctx->ops; - tcp_ses->vals = ctx->vals; -- -- /* Grab netns reference for this server. */ - cifs_set_net_ns(tcp_ses, get_net(current->nsproxy->net_ns)); - - tcp_ses->conn_id = atomic_inc_return(&tcpSesNextId); -@@ -1864,7 +1856,6 @@ cifs_get_tcp_session(struct smb3_fs_context *ctx, - out_err_crypto_release: - cifs_crypto_secmech_release(tcp_ses); - -- /* Release netns reference for this server. */ - put_net(cifs_net_ns(tcp_ses)); - - out_err: -@@ -1873,10 +1864,8 @@ cifs_get_tcp_session(struct smb3_fs_context *ctx, - cifs_put_tcp_session(tcp_ses->primary_server, false); - kfree(tcp_ses->hostname); - kfree(tcp_ses->leaf_fullpath); -- if (tcp_ses->ssocket) { -+ if (tcp_ses->ssocket) - sock_release(tcp_ses->ssocket); -- put_net(cifs_net_ns(tcp_ses)); -- } - kfree(tcp_ses); - } - return ERR_PTR(rc); -@@ -2488,6 +2477,8 @@ static int match_tcon(struct cifs_tcon *tcon, struct smb3_fs_context *ctx) - return 0; - if (tcon->nodelete != ctx->nodelete) - return 0; -+ if (tcon->posix_extensions != ctx->linux_ext) -+ return 0; - return 1; - } - -@@ -3138,24 +3129,20 @@ generic_ip_connect(struct TCP_Server_Info *server) - socket = server->ssocket; - } else { - struct net *net = cifs_net_ns(server); -+ struct sock *sk; - -- rc = sock_create_kern(net, sfamily, SOCK_STREAM, IPPROTO_TCP, &server->ssocket); -+ rc = __sock_create(net, sfamily, SOCK_STREAM, -+ IPPROTO_TCP, &server->ssocket, 1); - if (rc < 0) { - cifs_server_dbg(VFS, "Error %d creating socket\n", rc); - return rc; - } - -- /* -- * Grab netns reference for the socket. -- * -- * This reference will be released in several situations: -- * - In the failure path before the cifsd thread is started. -- * - In the all place where server->socket is released, it is -- * also set to NULL. -- * - Ultimately in clean_demultiplex_info(), during the final -- * teardown. -- */ -- get_net(net); -+ sk = server->ssocket->sk; -+ __netns_tracker_free(net, &sk->ns_tracker, false); -+ sk->sk_net_refcnt = 1; -+ get_net_track(net, &sk->ns_tracker, GFP_KERNEL); -+ sock_inuse_add(net, 1); - - /* BB other socket options to set KEEPALIVE, NODELAY? */ - cifs_dbg(FYI, "Socket created\n"); -@@ -3207,7 +3194,6 @@ generic_ip_connect(struct TCP_Server_Info *server) - if (rc < 0) { - cifs_dbg(FYI, "Error %d connecting to server\n", rc); - trace_smb3_connect_err(server->hostname, server->conn_id, &server->dstaddr, rc); -- put_net(cifs_net_ns(server)); - sock_release(socket); - server->ssocket = NULL; - return rc; -diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c -index cb75b95efb7013..d883ed75022c4a 100644 ---- a/fs/smb/client/file.c -+++ b/fs/smb/client/file.c -@@ -816,6 +816,11 @@ int cifs_open(struct inode *inode, struct file *file) - } else { - _cifsFileInfo_put(cfile, true, false); - } -+ } else { -+ /* hard link on the defeered close file */ -+ rc = cifs_get_hardlink_path(tcon, inode, file); -+ if (rc) -+ cifs_close_deferred_file(CIFS_I(inode)); - } - - if (server->oplocks) -@@ -1878,6 +1883,29 @@ cifs_move_llist(struct list_head *source, struct list_head *dest) - list_move(li, dest); - } - -+int -+cifs_get_hardlink_path(struct cifs_tcon *tcon, struct inode *inode, -+ struct file *file) -+{ -+ struct cifsFileInfo *open_file = NULL; -+ struct cifsInodeInfo *cinode = CIFS_I(inode); -+ int rc = 0; -+ -+ spin_lock(&tcon->open_file_lock); -+ spin_lock(&cinode->open_file_lock); -+ -+ list_for_each_entry(open_file, &cinode->openFileList, flist) { -+ if (file->f_flags == open_file->f_flags) { -+ rc = -EINVAL; -+ break; -+ } -+ } -+ -+ spin_unlock(&cinode->open_file_lock); -+ spin_unlock(&tcon->open_file_lock); -+ return rc; -+} -+ - void - cifs_free_llist(struct list_head *llist) - { -diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c -index b90cc918de7a39..d2e291ef104ec0 100644 ---- a/fs/smb/client/fs_context.c -+++ b/fs/smb/client/fs_context.c -@@ -1299,6 +1299,11 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, - ctx->closetimeo = HZ * result.uint_32; - break; - case Opt_echo_interval: -+ if (result.uint_32 < SMB_ECHO_INTERVAL_MIN || -+ result.uint_32 > SMB_ECHO_INTERVAL_MAX) { -+ cifs_errorf(fc, "echo interval is out of bounds\n"); -+ goto cifs_parse_mount_err; -+ } - ctx->echo_interval = result.uint_32; - break; - case Opt_snapshot: -diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c -index b9cf05e0940d07..d93ebd58ecae16 100644 ---- a/fs/smb/client/inode.c -+++ b/fs/smb/client/inode.c -@@ -1145,6 +1145,16 @@ static int reparse_info_to_fattr(struct cifs_open_info_data *data, - cifs_create_junction_fattr(fattr, sb); - goto out; - } -+ /* -+ * If the reparse point is unsupported by the Linux SMB -+ * client then let it process by the SMB server. So mask -+ * the -EOPNOTSUPP error code. This will allow Linux SMB -+ * client to send SMB OPEN request to server. If server -+ * does not support this reparse point too then server -+ * will return error during open the path. -+ */ -+ if (rc == -EOPNOTSUPP) -+ rc = 0; - } - break; - } -diff --git a/fs/smb/client/reparse.c b/fs/smb/client/reparse.c -index bb246ef0458fb5..b6556fe3dfa11a 100644 ---- a/fs/smb/client/reparse.c -+++ b/fs/smb/client/reparse.c -@@ -633,8 +633,6 @@ int parse_reparse_point(struct reparse_data_buffer *buf, - const char *full_path, - bool unicode, struct cifs_open_info_data *data) - { -- struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb); -- - data->reparse.buf = buf; - - /* See MS-FSCC 2.1.2 */ -@@ -658,8 +656,6 @@ int parse_reparse_point(struct reparse_data_buffer *buf, - } - return 0; - default: -- cifs_tcon_dbg(VFS | ONCE, "unhandled reparse tag: 0x%08x\n", -- le32_to_cpu(buf->ReparseTag)); - return -EOPNOTSUPP; - } - } -diff --git a/fs/smb/client/smb2misc.c b/fs/smb/client/smb2misc.c -index 677ef6f99a5be4..fadc5fc274eb28 100644 ---- a/fs/smb/client/smb2misc.c -+++ b/fs/smb/client/smb2misc.c -@@ -816,11 +816,12 @@ smb2_handle_cancelled_close(struct cifs_tcon *tcon, __u64 persistent_fid, - WARN_ONCE(tcon->tc_count < 0, "tcon refcount is negative"); - spin_unlock(&cifs_tcp_ses_lock); - -- if (tcon->ses) -+ if (tcon->ses) { - server = tcon->ses->server; -- -- cifs_server_dbg(FYI, "tid=0x%x: tcon is closing, skipping async close retry of fid %llu %llu\n", -- tcon->tid, persistent_fid, volatile_fid); -+ cifs_server_dbg(FYI, -+ "tid=0x%x: tcon is closing, skipping async close retry of fid %llu %llu\n", -+ tcon->tid, persistent_fid, volatile_fid); -+ } - - return 0; - } -diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c -index 371a5ead86635d..5a5277b4b53b11 100644 ---- a/fs/smb/server/oplock.c -+++ b/fs/smb/server/oplock.c -@@ -129,14 +129,6 @@ static void free_opinfo(struct oplock_info *opinfo) - kfree(opinfo); - } - --static inline void opinfo_free_rcu(struct rcu_head *rcu_head) --{ -- struct oplock_info *opinfo; -- -- opinfo = container_of(rcu_head, struct oplock_info, rcu_head); -- free_opinfo(opinfo); --} -- - struct oplock_info *opinfo_get(struct ksmbd_file *fp) - { - struct oplock_info *opinfo; -@@ -157,8 +149,8 @@ static struct oplock_info *opinfo_get_list(struct ksmbd_inode *ci) - if (list_empty(&ci->m_op_list)) - return NULL; - -- rcu_read_lock(); -- opinfo = list_first_or_null_rcu(&ci->m_op_list, struct oplock_info, -+ down_read(&ci->m_lock); -+ opinfo = list_first_entry(&ci->m_op_list, struct oplock_info, - op_entry); - if (opinfo) { - if (opinfo->conn == NULL || -@@ -171,8 +163,7 @@ static struct oplock_info *opinfo_get_list(struct ksmbd_inode *ci) - } - } - } -- -- rcu_read_unlock(); -+ up_read(&ci->m_lock); - - return opinfo; - } -@@ -185,7 +176,7 @@ void opinfo_put(struct oplock_info *opinfo) - if (!atomic_dec_and_test(&opinfo->refcount)) - return; - -- call_rcu(&opinfo->rcu_head, opinfo_free_rcu); -+ free_opinfo(opinfo); - } - - static void opinfo_add(struct oplock_info *opinfo) -@@ -193,7 +184,7 @@ static void opinfo_add(struct oplock_info *opinfo) - struct ksmbd_inode *ci = opinfo->o_fp->f_ci; - - down_write(&ci->m_lock); -- list_add_rcu(&opinfo->op_entry, &ci->m_op_list); -+ list_add(&opinfo->op_entry, &ci->m_op_list); - up_write(&ci->m_lock); - } - -@@ -207,7 +198,7 @@ static void opinfo_del(struct oplock_info *opinfo) - write_unlock(&lease_list_lock); - } - down_write(&ci->m_lock); -- list_del_rcu(&opinfo->op_entry); -+ list_del(&opinfo->op_entry); - up_write(&ci->m_lock); - } - -@@ -1347,8 +1338,8 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp, - ci = fp->f_ci; - op = opinfo_get(fp); - -- rcu_read_lock(); -- list_for_each_entry_rcu(brk_op, &ci->m_op_list, op_entry) { -+ down_read(&ci->m_lock); -+ list_for_each_entry(brk_op, &ci->m_op_list, op_entry) { - if (brk_op->conn == NULL) - continue; - -@@ -1358,7 +1349,6 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp, - if (ksmbd_conn_releasing(brk_op->conn)) - continue; - -- rcu_read_unlock(); - if (brk_op->is_lease && (brk_op->o_lease->state & - (~(SMB2_LEASE_READ_CACHING_LE | - SMB2_LEASE_HANDLE_CACHING_LE)))) { -@@ -1388,9 +1378,8 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp, - oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE, NULL); - next: - opinfo_put(brk_op); -- rcu_read_lock(); - } -- rcu_read_unlock(); -+ up_read(&ci->m_lock); - - if (op) - opinfo_put(op); -diff --git a/fs/smb/server/oplock.h b/fs/smb/server/oplock.h -index 59554b73f60c26..0fe931485465ac 100644 ---- a/fs/smb/server/oplock.h -+++ b/fs/smb/server/oplock.h -@@ -78,7 +78,6 @@ struct oplock_info { - struct list_head lease_entry; - wait_queue_head_t oplock_q; /* Other server threads */ - wait_queue_head_t oplock_brk; /* oplock breaking wait */ -- struct rcu_head rcu_head; - }; - - struct lease_break_info { -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index 8877f9e900b2fb..d41d67ec5ee51a 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -1599,8 +1599,10 @@ static int krb5_authenticate(struct ksmbd_work *work, - if (prev_sess_id && prev_sess_id != sess->id) - destroy_previous_session(conn, sess->user, prev_sess_id); - -- if (sess->state == SMB2_SESSION_VALID) -+ if (sess->state == SMB2_SESSION_VALID) { - ksmbd_free_user(sess->user); -+ sess->user = NULL; -+ } - - retval = ksmbd_krb5_authenticate(sess, in_blob, in_len, - out_blob, &out_len); -diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c -index 2d7cd7f42f2785..281101fd1f76f1 100644 ---- a/fs/smb/server/transport_ipc.c -+++ b/fs/smb/server/transport_ipc.c -@@ -296,7 +296,11 @@ static int ipc_server_config_on_startup(struct ksmbd_startup_request *req) - server_conf.signing = req->signing; - server_conf.tcp_port = req->tcp_port; - server_conf.ipc_timeout = req->ipc_timeout * HZ; -- server_conf.deadtime = req->deadtime * SMB_ECHO_INTERVAL; -+ if (check_mul_overflow(req->deadtime, SMB_ECHO_INTERVAL, -+ &server_conf.deadtime)) { -+ ret = -EINVAL; -+ goto out; -+ } - server_conf.share_fake_fscaps = req->share_fake_fscaps; - ksmbd_init_domain(req->sub_auth); - -@@ -322,6 +326,7 @@ static int ipc_server_config_on_startup(struct ksmbd_startup_request *req) - ret |= ksmbd_set_work_group(req->work_group); - ret |= ksmbd_tcp_set_interfaces(KSMBD_STARTUP_CONFIG_INTERFACES(req), - req->ifc_list_sz); -+out: - if (ret) { - pr_err("Server configuration error: %s %s %s\n", - req->netbios_name, req->server_string, -diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c -index d0c19ad9d0145c..fa5b7e63eb832e 100644 ---- a/fs/smb/server/vfs.c -+++ b/fs/smb/server/vfs.c -@@ -496,7 +496,8 @@ int ksmbd_vfs_write(struct ksmbd_work *work, struct ksmbd_file *fp, - int err = 0; - - if (work->conn->connection_type) { -- if (!(fp->daccess & (FILE_WRITE_DATA_LE | FILE_APPEND_DATA_LE))) { -+ if (!(fp->daccess & (FILE_WRITE_DATA_LE | FILE_APPEND_DATA_LE)) || -+ S_ISDIR(file_inode(fp->filp)->i_mode)) { - pr_err("no right to write(%pD)\n", fp->filp); - err = -EACCES; - goto out; -diff --git a/fs/udf/inode.c b/fs/udf/inode.c -index e98c198f85b964..2f73119c7ec98a 100644 ---- a/fs/udf/inode.c -+++ b/fs/udf/inode.c -@@ -814,6 +814,7 @@ static int inode_getblk(struct inode *inode, struct udf_map_rq *map) - } - map->oflags = UDF_BLK_MAPPED; - map->pblk = udf_get_lb_pblock(inode->i_sb, &eloc, offset); -+ ret = 0; - goto out_free; - } - -diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c -index 5d3e595f9da96a..5ceb1fa8eb1149 100644 ---- a/fs/userfaultfd.c -+++ b/fs/userfaultfd.c -@@ -451,32 +451,6 @@ vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason) - if (!(vmf->flags & FAULT_FLAG_USER) && (ctx->flags & UFFD_USER_MODE_ONLY)) - goto out; - -- /* -- * If it's already released don't get it. This avoids to loop -- * in __get_user_pages if userfaultfd_release waits on the -- * caller of handle_userfault to release the mmap_lock. -- */ -- if (unlikely(READ_ONCE(ctx->released))) { -- /* -- * Don't return VM_FAULT_SIGBUS in this case, so a non -- * cooperative manager can close the uffd after the -- * last UFFDIO_COPY, without risking to trigger an -- * involuntary SIGBUS if the process was starting the -- * userfaultfd while the userfaultfd was still armed -- * (but after the last UFFDIO_COPY). If the uffd -- * wasn't already closed when the userfault reached -- * this point, that would normally be solved by -- * userfaultfd_must_wait returning 'false'. -- * -- * If we were to return VM_FAULT_SIGBUS here, the non -- * cooperative manager would be instead forced to -- * always call UFFDIO_UNREGISTER before it can safely -- * close the uffd. -- */ -- ret = VM_FAULT_NOPAGE; -- goto out; -- } -- - /* - * Check that we can return VM_FAULT_RETRY. - * -@@ -513,6 +487,31 @@ vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason) - if (vmf->flags & FAULT_FLAG_RETRY_NOWAIT) - goto out; - -+ if (unlikely(READ_ONCE(ctx->released))) { -+ /* -+ * If a concurrent release is detected, do not return -+ * VM_FAULT_SIGBUS or VM_FAULT_NOPAGE, but instead always -+ * return VM_FAULT_RETRY with lock released proactively. -+ * -+ * If we were to return VM_FAULT_SIGBUS here, the non -+ * cooperative manager would be instead forced to -+ * always call UFFDIO_UNREGISTER before it can safely -+ * close the uffd, to avoid involuntary SIGBUS triggered. -+ * -+ * If we were to return VM_FAULT_NOPAGE, it would work for -+ * the fault path, in which the lock will be released -+ * later. However for GUP, faultin_page() does nothing -+ * special on NOPAGE, so GUP would spin retrying without -+ * releasing the mmap read lock, causing possible livelock. -+ * -+ * Here only VM_FAULT_RETRY would make sure the mmap lock -+ * be released immediately, so that the thread concurrently -+ * releasing the userfault would always make progress. -+ */ -+ release_fault_lock(vmf); -+ goto out; -+ } -+ - /* take the reference before dropping the mmap_lock */ - userfaultfd_ctx_get(ctx); - -diff --git a/include/drm/drm_kunit_helpers.h b/include/drm/drm_kunit_helpers.h -index 3ae19892229db2..07e9a451262b66 100644 ---- a/include/drm/drm_kunit_helpers.h -+++ b/include/drm/drm_kunit_helpers.h -@@ -9,7 +9,11 @@ - - #include - -+struct drm_crtc_funcs; -+struct drm_crtc_helper_funcs; - struct drm_device; -+struct drm_plane_funcs; -+struct drm_plane_helper_funcs; - struct kunit; - - struct device *drm_kunit_helper_alloc_device(struct kunit *test); -@@ -99,4 +103,28 @@ drm_kunit_helper_atomic_state_alloc(struct kunit *test, - struct drm_device *drm, - struct drm_modeset_acquire_ctx *ctx); - -+struct drm_plane * -+drm_kunit_helper_create_primary_plane(struct kunit *test, -+ struct drm_device *drm, -+ const struct drm_plane_funcs *funcs, -+ const struct drm_plane_helper_funcs *helper_funcs, -+ const uint32_t *formats, -+ unsigned int num_formats, -+ const uint64_t *modifiers); -+ -+struct drm_crtc * -+drm_kunit_helper_create_crtc(struct kunit *test, -+ struct drm_device *drm, -+ struct drm_plane *primary, -+ struct drm_plane *cursor, -+ const struct drm_crtc_funcs *funcs, -+ const struct drm_crtc_helper_funcs *helper_funcs); -+ -+int drm_kunit_add_mode_destroy_action(struct kunit *test, -+ struct drm_display_mode *mode); -+ -+struct drm_display_mode * -+drm_kunit_display_mode_from_cea_vic(struct kunit *test, struct drm_device *dev, -+ u8 video_code); -+ - #endif // DRM_KUNIT_HELPERS_H_ -diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h -index 1a97277f99b1b8..ae8c46ad92222e 100644 ---- a/include/linux/backing-dev.h -+++ b/include/linux/backing-dev.h -@@ -250,6 +250,7 @@ static inline struct bdi_writeback *inode_to_wb(const struct inode *inode) - { - #ifdef CONFIG_LOCKDEP - WARN_ON_ONCE(debug_locks && -+ (inode->i_sb->s_iflags & SB_I_CGROUPWB) && - (!lockdep_is_held(&inode->i_lock) && - !lockdep_is_held(&inode->i_mapping->i_pages.xa_lock) && - !lockdep_is_held(&inode->i_wb->list_lock))); -diff --git a/include/linux/hid.h b/include/linux/hid.h -index 774cb25dec34c5..38e161a827bde9 100644 ---- a/include/linux/hid.h -+++ b/include/linux/hid.h -@@ -1214,10 +1214,19 @@ void hid_quirks_exit(__u16 bus); - - #ifdef CONFIG_HID_PID - int hid_pidff_init(struct hid_device *hid); -+int hid_pidff_init_with_quirks(struct hid_device *hid, __u32 initial_quirks); - #else - #define hid_pidff_init NULL -+#define hid_pidff_init_with_quirks NULL - #endif - -+/* HID PIDFF quirks */ -+#define HID_PIDFF_QUIRK_MISSING_DELAY BIT(0) -+#define HID_PIDFF_QUIRK_MISSING_PBO BIT(1) -+#define HID_PIDFF_QUIRK_PERMISSIVE_CONTROL BIT(2) -+#define HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION BIT(3) -+#define HID_PIDFF_QUIRK_PERIODIC_SINE_ONLY BIT(4) -+ - #define dbg_hid(fmt, ...) pr_debug("%s: " fmt, __FILE__, ##__VA_ARGS__) - - #define hid_err(hid, fmt, ...) \ -diff --git a/include/linux/nfs.h b/include/linux/nfs.h -index ceb70a926b95e8..095a95c1fae826 100644 ---- a/include/linux/nfs.h -+++ b/include/linux/nfs.h -@@ -46,7 +46,6 @@ enum nfs3_stable_how { - NFS_INVALID_STABLE_HOW = -1 - }; - --#ifdef CONFIG_CRC32 - /** - * nfs_fhandle_hash - calculate the crc32 hash for the filehandle - * @fh - pointer to filehandle -@@ -58,10 +57,4 @@ static inline u32 nfs_fhandle_hash(const struct nfs_fh *fh) - { - return ~crc32_le(0xFFFFFFFF, &fh->data[0], fh->size); - } --#else /* CONFIG_CRC32 */ --static inline u32 nfs_fhandle_hash(const struct nfs_fh *fh) --{ -- return 0; --} --#endif /* CONFIG_CRC32 */ - #endif /* _LINUX_NFS_H */ -diff --git a/include/linux/pgtable.h b/include/linux/pgtable.h -index 3c3a7dede0ef5b..e2c9a0c259df3b 100644 ---- a/include/linux/pgtable.h -+++ b/include/linux/pgtable.h -@@ -194,10 +194,14 @@ static inline int pmd_young(pmd_t pmd) - * hazard could result in the direct mode hypervisor case, since the actual - * write to the page tables may not yet have taken place, so reads though - * a raw PTE pointer after it has been modified are not guaranteed to be -- * up to date. This mode can only be entered and left under the protection of -- * the page table locks for all page tables which may be modified. In the UP -- * case, this is required so that preemption is disabled, and in the SMP case, -- * it must synchronize the delayed page table writes properly on other CPUs. -+ * up to date. -+ * -+ * In the general case, no lock is guaranteed to be held between entry and exit -+ * of the lazy mode. So the implementation must assume preemption may be enabled -+ * and cpu migration is possible; it must take steps to be robust against this. -+ * (In practice, for user PTE updates, the appropriate page table lock(s) are -+ * held, but for kernel PTE updates, no lock is held). Nesting is not permitted -+ * and the mode cannot be used in interrupt context. - */ - #ifndef __HAVE_ARCH_ENTER_LAZY_MMU_MODE - #define arch_enter_lazy_mmu_mode() do {} while (0) -@@ -233,7 +237,6 @@ static inline void set_ptes(struct mm_struct *mm, unsigned long addr, - { - page_table_check_ptes_set(mm, ptep, pte, nr); - -- arch_enter_lazy_mmu_mode(); - for (;;) { - set_pte(ptep, pte); - if (--nr == 0) -@@ -241,7 +244,6 @@ static inline void set_ptes(struct mm_struct *mm, unsigned long addr, - ptep++; - pte = pte_next_pfn(pte); - } -- arch_leave_lazy_mmu_mode(); - } - #endif - #define set_pte_at(mm, addr, ptep, pte) set_ptes(mm, addr, ptep, pte, 1) -diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h -index 3d6cf306cd55e9..0cbbbded033194 100644 ---- a/include/linux/rtnetlink.h -+++ b/include/linux/rtnetlink.h -@@ -130,4 +130,26 @@ extern int ndo_dflt_bridge_getlink(struct sk_buff *skb, u32 pid, u32 seq, - - extern void rtnl_offload_xstats_notify(struct net_device *dev); - -+static inline int rtnl_has_listeners(const struct net *net, u32 group) -+{ -+ struct sock *rtnl = net->rtnl; -+ -+ return netlink_has_listeners(rtnl, group); -+} -+ -+/** -+ * rtnl_notify_needed - check if notification is needed -+ * @net: Pointer to the net namespace -+ * @nlflags: netlink ingress message flags -+ * @group: rtnl group -+ * -+ * Based on the ingress message flags and rtnl group, returns true -+ * if a notification is needed, false otherwise. -+ */ -+static inline bool -+rtnl_notify_needed(const struct net *net, u16 nlflags, u32 group) -+{ -+ return (nlflags & NLM_F_ECHO) || rtnl_has_listeners(net, group); -+} -+ - #endif /* __LINUX_RTNETLINK_H */ -diff --git a/include/linux/tpm.h b/include/linux/tpm.h -index 4ee9d13749adc1..5f4998626a9889 100644 ---- a/include/linux/tpm.h -+++ b/include/linux/tpm.h -@@ -272,6 +272,7 @@ enum tpm2_cc_attrs { - #define TPM_VID_WINBOND 0x1050 - #define TPM_VID_STM 0x104A - #define TPM_VID_ATML 0x1114 -+#define TPM_VID_IFX 0x15D1 - - enum tpm_chip_flags { - TPM_CHIP_FLAG_BOOTSTRAPPED = BIT(0), -diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h -index 5a24d6d8522af9..d943bb454b1769 100644 ---- a/include/net/sctp/structs.h -+++ b/include/net/sctp/structs.h -@@ -778,6 +778,7 @@ struct sctp_transport { - - /* Reference counting. */ - refcount_t refcnt; -+ __u32 dead:1, - /* RTO-Pending : A flag used to track if one of the DATA - * chunks sent to this address is currently being - * used to compute a RTT. If this flag is 0, -@@ -787,7 +788,7 @@ struct sctp_transport { - * calculation completes (i.e. the DATA chunk - * is SACK'd) clear this flag. - */ -- __u32 rto_pending:1, -+ rto_pending:1, - - /* - * hb_sent : a flag that signals that we have a pending -diff --git a/include/net/xdp.h b/include/net/xdp.h -index de08c8e0d13483..b39ac83618a550 100644 ---- a/include/net/xdp.h -+++ b/include/net/xdp.h -@@ -486,7 +486,14 @@ static __always_inline u32 bpf_prog_run_xdp(const struct bpf_prog *prog, - * under local_bh_disable(), which provides the needed RCU protection - * for accessing map entries. - */ -- u32 act = __bpf_prog_run(prog, xdp, BPF_DISPATCHER_FUNC(xdp)); -+ struct bpf_redirect_info *ri = this_cpu_ptr(&bpf_redirect_info); -+ u32 act; -+ -+ if (ri->map_id || ri->map_type) { -+ ri->map_id = 0; -+ ri->map_type = BPF_MAP_TYPE_UNSPEC; -+ } -+ act = __bpf_prog_run(prog, xdp, BPF_DISPATCHER_FUNC(xdp)); - - if (static_branch_unlikely(&bpf_master_redirect_enabled_key)) { - if (act == XDP_TX && netif_is_bond_slave(xdp->rxq->dev)) -diff --git a/include/uapi/linux/kfd_ioctl.h b/include/uapi/linux/kfd_ioctl.h -index cd924c959d7327..1f753e72fa2c24 100644 ---- a/include/uapi/linux/kfd_ioctl.h -+++ b/include/uapi/linux/kfd_ioctl.h -@@ -58,6 +58,8 @@ struct kfd_ioctl_get_version_args { - #define KFD_MAX_QUEUE_PERCENTAGE 100 - #define KFD_MAX_QUEUE_PRIORITY 15 - -+#define KFD_MIN_QUEUE_RING_SIZE 1024 -+ - struct kfd_ioctl_create_queue_args { - __u64 ring_base_address; /* to KFD */ - __u64 write_pointer_address; /* from KFD */ -diff --git a/include/uapi/linux/landlock.h b/include/uapi/linux/landlock.h -index 81d09ef9aa50e9..f82a66361a1ed5 100644 ---- a/include/uapi/linux/landlock.h -+++ b/include/uapi/linux/landlock.h -@@ -38,9 +38,11 @@ struct landlock_ruleset_attr { - * - * - %LANDLOCK_CREATE_RULESET_VERSION: Get the highest supported Landlock ABI - * version. -+ * - %LANDLOCK_CREATE_RULESET_ERRATA: Get a bitmask of fixed issues. - */ - /* clang-format off */ - #define LANDLOCK_CREATE_RULESET_VERSION (1U << 0) -+#define LANDLOCK_CREATE_RULESET_ERRATA (1U << 1) - /* clang-format on */ - - /** -diff --git a/include/xen/interface/xen-mca.h b/include/xen/interface/xen-mca.h -index 464aa6b3a5f928..1c9afbe8cc2600 100644 ---- a/include/xen/interface/xen-mca.h -+++ b/include/xen/interface/xen-mca.h -@@ -372,7 +372,7 @@ struct xen_mce { - #define XEN_MCE_LOG_LEN 32 - - struct xen_mce_log { -- char signature[12]; /* "MACHINECHECK" */ -+ char signature[12] __nonstring; /* "MACHINECHECK" */ - unsigned len; /* = XEN_MCE_LOG_LEN */ - unsigned next; - unsigned flags; -diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c -index 0d9b8a8b42c278..8c6611fe4f4633 100644 ---- a/io_uring/kbuf.c -+++ b/io_uring/kbuf.c -@@ -321,6 +321,8 @@ int io_provide_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe - p->nbufs = tmp; - p->addr = READ_ONCE(sqe->addr); - p->len = READ_ONCE(sqe->len); -+ if (!p->len) -+ return -EINVAL; - - if (check_mul_overflow((unsigned long)p->len, (unsigned long)p->nbufs, - &size)) -diff --git a/io_uring/net.c b/io_uring/net.c -index 1a0e98e19dc0ed..4948a67bbac480 100644 ---- a/io_uring/net.c -+++ b/io_uring/net.c -@@ -1438,6 +1438,8 @@ int io_accept(struct io_kiocb *req, unsigned int issue_flags) - goto retry; - - io_req_set_res(req, ret, 0); -+ if (!(issue_flags & IO_URING_F_MULTISHOT)) -+ return IOU_OK; - return IOU_STOP_MULTISHOT; - } - -diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c -index 3468d8230e5f75..9419a79e8833ff 100644 ---- a/kernel/locking/lockdep.c -+++ b/kernel/locking/lockdep.c -@@ -6141,6 +6141,9 @@ static void zap_class(struct pending_free *pf, struct lock_class *class) - hlist_del_rcu(&class->hash_entry); - WRITE_ONCE(class->key, NULL); - WRITE_ONCE(class->name, NULL); -+ /* Class allocated but not used, -1 in nr_unused_locks */ -+ if (class->usage_mask == 0) -+ debug_atomic_dec(nr_unused_locks); - nr_lock_classes--; - __clear_bit(class - lock_classes, lock_classes_in_use); - if (class - lock_classes == max_lock_class_idx) -diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c -index a49f136014ce6b..259521b179aa11 100644 ---- a/kernel/sched/cpufreq_schedutil.c -+++ b/kernel/sched/cpufreq_schedutil.c -@@ -83,7 +83,7 @@ static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time) - - if (unlikely(sg_policy->limits_changed)) { - sg_policy->limits_changed = false; -- sg_policy->need_freq_update = cpufreq_driver_test_flags(CPUFREQ_NEED_UPDATE_LIMITS); -+ sg_policy->need_freq_update = true; - return true; - } - -@@ -95,10 +95,22 @@ static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time) - static bool sugov_update_next_freq(struct sugov_policy *sg_policy, u64 time, - unsigned int next_freq) - { -- if (sg_policy->need_freq_update) -+ if (sg_policy->need_freq_update) { - sg_policy->need_freq_update = false; -- else if (sg_policy->next_freq == next_freq) -+ /* -+ * The policy limits have changed, but if the return value of -+ * cpufreq_driver_resolve_freq() after applying the new limits -+ * is still equal to the previously selected frequency, the -+ * driver callback need not be invoked unless the driver -+ * specifically wants that to happen on every update of the -+ * policy limits. -+ */ -+ if (sg_policy->next_freq == next_freq && -+ !cpufreq_driver_test_flags(CPUFREQ_NEED_UPDATE_LIMITS)) -+ return false; -+ } else if (sg_policy->next_freq == next_freq) { - return false; -+ } - - sg_policy->next_freq = next_freq; - sg_policy->last_freq_update_time = time; -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 99fdeee3bcd87a..650493ed76cd40 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -5420,9 +5420,10 @@ int register_ftrace_direct(struct ftrace_ops *ops, unsigned long addr) - - /* Make a copy hash to place the new and the old entries in */ - size = hash->count + direct_functions->count; -- if (size > 32) -- size = 32; -- new_hash = alloc_ftrace_hash(fls(size)); -+ size = fls(size); -+ if (size > FTRACE_HASH_MAX_BITS) -+ size = FTRACE_HASH_MAX_BITS; -+ new_hash = alloc_ftrace_hash(size); - if (!new_hash) - goto out_unlock; - -@@ -6325,6 +6326,7 @@ ftrace_graph_set_hash(struct ftrace_hash *hash, char *buffer) - } - } - } -+ cond_resched(); - } while_for_each_ftrace_rec(); - out: - mutex_unlock(&ftrace_lock); -diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c -index 562efd66857267..1a936978c2b1a6 100644 ---- a/kernel/trace/trace_events.c -+++ b/kernel/trace/trace_events.c -@@ -790,7 +790,9 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, - clear_bit(EVENT_FILE_FL_RECORDED_TGID_BIT, &file->flags); - } - -- call->class->reg(call, TRACE_REG_UNREGISTER, file); -+ ret = call->class->reg(call, TRACE_REG_UNREGISTER, file); -+ -+ WARN_ON_ONCE(ret); - } - /* If in SOFT_MODE, just set the SOFT_DISABLE_BIT, else clear it */ - if (file->flags & EVENT_FILE_FL_SOFT_MODE) -diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c -index 0c611b281a5b5f..f50c2ad43f3d82 100644 ---- a/kernel/trace/trace_events_filter.c -+++ b/kernel/trace/trace_events_filter.c -@@ -808,7 +808,7 @@ static __always_inline char *test_string(char *str) - kstr = ubuf->buffer; - - /* For safety, do not trust the string pointer */ -- if (!strncpy_from_kernel_nofault(kstr, str, USTRING_BUF_SIZE)) -+ if (strncpy_from_kernel_nofault(kstr, str, USTRING_BUF_SIZE) < 0) - return NULL; - return kstr; - } -@@ -827,7 +827,7 @@ static __always_inline char *test_ustring(char *str) - - /* user space address? */ - ustr = (char __user *)str; -- if (!strncpy_from_user_nofault(kstr, ustr, USTRING_BUF_SIZE)) -+ if (strncpy_from_user_nofault(kstr, ustr, USTRING_BUF_SIZE) < 0) - return NULL; - - return kstr; -diff --git a/kernel/trace/trace_events_synth.c b/kernel/trace/trace_events_synth.c -index ccd6703ac50b71..794e72dbb12d33 100644 ---- a/kernel/trace/trace_events_synth.c -+++ b/kernel/trace/trace_events_synth.c -@@ -377,7 +377,6 @@ static enum print_line_t print_synth_event(struct trace_iterator *iter, - union trace_synth_field *data = &entry->fields[n_u64]; - - trace_seq_printf(s, print_fmt, se->fields[i]->name, -- STR_VAR_LEN_MAX, - (char *)entry + data->as_dynamic.offset, - i == se->n_fields - 1 ? "" : " "); - n_u64++; -diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c -index 8c73156a7eb94c..606190239c8776 100644 ---- a/kernel/trace/trace_probe.c -+++ b/kernel/trace/trace_probe.c -@@ -769,6 +769,10 @@ static int check_prepare_btf_string_fetch(char *typename, - - #ifdef CONFIG_HAVE_FUNCTION_ARG_ACCESS_API - -+/* -+ * Add the entry code to store the 'argnum'th parameter and return the offset -+ * in the entry data buffer where the data will be stored. -+ */ - static int __store_entry_arg(struct trace_probe *tp, int argnum) - { - struct probe_entry_arg *earg = tp->entry_arg; -@@ -792,6 +796,20 @@ static int __store_entry_arg(struct trace_probe *tp, int argnum) - tp->entry_arg = earg; - } - -+ /* -+ * The entry code array is repeating the pair of -+ * [FETCH_OP_ARG(argnum)][FETCH_OP_ST_EDATA(offset of entry data buffer)] -+ * and the rest of entries are filled with [FETCH_OP_END]. -+ * -+ * To reduce the redundant function parameter fetching, we scan the entry -+ * code array to find the FETCH_OP_ARG which already fetches the 'argnum' -+ * parameter. If it doesn't match, update 'offset' to find the last -+ * offset. -+ * If we find the FETCH_OP_END without matching FETCH_OP_ARG entry, we -+ * will save the entry with FETCH_OP_ARG and FETCH_OP_ST_EDATA, and -+ * return data offset so that caller can find the data offset in the entry -+ * data buffer. -+ */ - offset = 0; - for (i = 0; i < earg->size - 1; i++) { - switch (earg->code[i].op) { -@@ -825,6 +843,16 @@ int traceprobe_get_entry_data_size(struct trace_probe *tp) - if (!earg) - return 0; - -+ /* -+ * earg->code[] array has an operation sequence which is run in -+ * the entry handler. -+ * The sequence stopped by FETCH_OP_END and each data stored in -+ * the entry data buffer by FETCH_OP_ST_EDATA. The FETCH_OP_ST_EDATA -+ * stores the data at the data buffer + its offset, and all data are -+ * "unsigned long" size. The offset must be increased when a data is -+ * stored. Thus we need to find the last FETCH_OP_ST_EDATA in the -+ * code array. -+ */ - for (i = 0; i < earg->size; i++) { - switch (earg->code[i].op) { - case FETCH_OP_END: -diff --git a/lib/sg_split.c b/lib/sg_split.c -index 60a0babebf2efc..0f89aab5c6715b 100644 ---- a/lib/sg_split.c -+++ b/lib/sg_split.c -@@ -88,8 +88,6 @@ static void sg_split_phys(struct sg_splitter *splitters, const int nb_splits) - if (!j) { - out_sg->offset += split->skip_sg0; - out_sg->length -= split->skip_sg0; -- } else { -- out_sg->offset = 0; - } - sg_dma_address(out_sg) = 0; - sg_dma_len(out_sg) = 0; -diff --git a/lib/string.c b/lib/string.c -index be26623953d2e6..d49243af5bf215 100644 ---- a/lib/string.c -+++ b/lib/string.c -@@ -128,6 +128,7 @@ ssize_t strscpy(char *dest, const char *src, size_t count) - if (count == 0 || WARN_ON_ONCE(count > INT_MAX)) - return -E2BIG; - -+#ifndef CONFIG_DCACHE_WORD_ACCESS - #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS - /* - * If src is unaligned, don't cross a page boundary, -@@ -142,12 +143,14 @@ ssize_t strscpy(char *dest, const char *src, size_t count) - /* If src or dest is unaligned, don't do word-at-a-time. */ - if (((long) dest | (long) src) & (sizeof(long) - 1)) - max = 0; -+#endif - #endif - - /* -- * read_word_at_a_time() below may read uninitialized bytes after the -- * trailing zero and use them in comparisons. Disable this optimization -- * under KMSAN to prevent false positive reports. -+ * load_unaligned_zeropad() or read_word_at_a_time() below may read -+ * uninitialized bytes after the trailing zero and use them in -+ * comparisons. Disable this optimization under KMSAN to prevent -+ * false positive reports. - */ - if (IS_ENABLED(CONFIG_KMSAN)) - max = 0; -@@ -155,7 +158,11 @@ ssize_t strscpy(char *dest, const char *src, size_t count) - while (max >= sizeof(unsigned long)) { - unsigned long c, data; - -+#ifdef CONFIG_DCACHE_WORD_ACCESS -+ c = load_unaligned_zeropad(src+res); -+#else - c = read_word_at_a_time(src+res); -+#endif - if (has_zero(c, &data, &constants)) { - data = prep_zero_mask(c, data, &constants); - data = create_zero_mask(data); -diff --git a/lib/zstd/common/portability_macros.h b/lib/zstd/common/portability_macros.h -index 0e3b2c0a527db7..0dde8bf56595ea 100644 ---- a/lib/zstd/common/portability_macros.h -+++ b/lib/zstd/common/portability_macros.h -@@ -55,7 +55,7 @@ - #ifndef DYNAMIC_BMI2 - #if ((defined(__clang__) && __has_attribute(__target__)) \ - || (defined(__GNUC__) \ -- && (__GNUC__ >= 5 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 8)))) \ -+ && (__GNUC__ >= 11))) \ - && (defined(__x86_64__) || defined(_M_X64)) \ - && !defined(__BMI2__) - # define DYNAMIC_BMI2 1 -diff --git a/mm/filemap.c b/mm/filemap.c -index d7c79a69afc88f..05eb77623a1063 100644 ---- a/mm/filemap.c -+++ b/mm/filemap.c -@@ -2256,6 +2256,7 @@ unsigned filemap_get_folios_contig(struct address_space *mapping, - *start = folio->index + nr; - goto out; - } -+ xas_advance(&xas, folio_next_index(folio) - 1); - continue; - put_folio: - folio_put(folio); -diff --git a/mm/gup.c b/mm/gup.c -index 69d259f7bf37ec..29c719b3ab31e1 100644 ---- a/mm/gup.c -+++ b/mm/gup.c -@@ -1871,8 +1871,8 @@ size_t fault_in_safe_writeable(const char __user *uaddr, size_t size) - } while (start != end); - mmap_read_unlock(mm); - -- if (size > (unsigned long)uaddr - start) -- return size - ((unsigned long)uaddr - start); -+ if (size > start - (unsigned long)uaddr) -+ return size - (start - (unsigned long)uaddr); - return 0; - } - EXPORT_SYMBOL(fault_in_safe_writeable); -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index faded25b19be83..7c196b754071bd 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -4695,7 +4695,7 @@ static struct ctl_table hugetlb_table[] = { - { } - }; - --static void hugetlb_sysctl_init(void) -+static void __init hugetlb_sysctl_init(void) - { - register_sysctl_init("vm", hugetlb_table); - } -diff --git a/mm/memory-failure.c b/mm/memory-failure.c -index 9018a1162efc9d..a96840c4158165 100644 ---- a/mm/memory-failure.c -+++ b/mm/memory-failure.c -@@ -869,12 +869,17 @@ static int kill_accessing_process(struct task_struct *p, unsigned long pfn, - mmap_read_lock(p->mm); - ret = walk_page_range(p->mm, 0, TASK_SIZE, &hwpoison_walk_ops, - (void *)&priv); -+ /* -+ * ret = 1 when CMCI wins, regardless of whether try_to_unmap() -+ * succeeds or fails, then kill the process with SIGBUS. -+ * ret = 0 when poison page is a clean page and it's dropped, no -+ * SIGBUS is needed. -+ */ - if (ret == 1 && priv.tk.addr) - kill_proc(&priv.tk, pfn, flags); -- else -- ret = 0; - mmap_read_unlock(p->mm); -- return ret > 0 ? -EHWPOISON : -EFAULT; -+ -+ return ret > 0 ? -EHWPOISON : 0; - } - - static const char *action_name[] = { -diff --git a/mm/memory.c b/mm/memory.c -index d04faa09eaf6cc..8b80db7115e5fe 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -2600,11 +2600,11 @@ static int apply_to_pte_range(struct mm_struct *mm, pmd_t *pmd, - if (fn) { - do { - if (create || !pte_none(ptep_get(pte))) { -- err = fn(pte++, addr, data); -+ err = fn(pte, addr, data); - if (err) - break; - } -- } while (addr += PAGE_SIZE, addr != end); -+ } while (pte++, addr += PAGE_SIZE, addr != end); - } - *mask |= PGTBL_PTE_MODIFIED; - -diff --git a/mm/mremap.c b/mm/mremap.c -index df71010baabe7e..d458ef218a3725 100644 ---- a/mm/mremap.c -+++ b/mm/mremap.c -@@ -599,8 +599,8 @@ static unsigned long move_vma(struct vm_area_struct *vma, - unsigned long vm_flags = vma->vm_flags; - unsigned long new_pgoff; - unsigned long moved_len; -- unsigned long account_start = 0; -- unsigned long account_end = 0; -+ bool account_start = false; -+ bool account_end = false; - unsigned long hiwater_vm; - int err = 0; - bool need_rmap_locks; -@@ -684,9 +684,9 @@ static unsigned long move_vma(struct vm_area_struct *vma, - if (vm_flags & VM_ACCOUNT && !(flags & MREMAP_DONTUNMAP)) { - vm_flags_clear(vma, VM_ACCOUNT); - if (vma->vm_start < old_addr) -- account_start = vma->vm_start; -+ account_start = true; - if (vma->vm_end > old_addr + old_len) -- account_end = vma->vm_end; -+ account_end = true; - } - - /* -@@ -726,7 +726,7 @@ static unsigned long move_vma(struct vm_area_struct *vma, - /* OOM: unable to split vma, just get accounts right */ - if (vm_flags & VM_ACCOUNT && !(flags & MREMAP_DONTUNMAP)) - vm_acct_memory(old_len >> PAGE_SHIFT); -- account_start = account_end = 0; -+ account_start = account_end = false; - } - - if (vm_flags & VM_LOCKED) { -diff --git a/mm/page_vma_mapped.c b/mm/page_vma_mapped.c -index e0b368e545ed00..dcc1ee3d059e92 100644 ---- a/mm/page_vma_mapped.c -+++ b/mm/page_vma_mapped.c -@@ -77,6 +77,7 @@ static bool map_pte(struct page_vma_mapped_walk *pvmw, spinlock_t **ptlp) - * mapped at the @pvmw->pte - * @pvmw: page_vma_mapped_walk struct, includes a pair pte and pfn range - * for checking -+ * @pte_nr: the number of small pages described by @pvmw->pte. - * - * page_vma_mapped_walk() found a place where pfn range is *potentially* - * mapped. check_pte() has to validate this. -@@ -93,7 +94,7 @@ static bool map_pte(struct page_vma_mapped_walk *pvmw, spinlock_t **ptlp) - * Otherwise, return false. - * - */ --static bool check_pte(struct page_vma_mapped_walk *pvmw) -+static bool check_pte(struct page_vma_mapped_walk *pvmw, unsigned long pte_nr) - { - unsigned long pfn; - pte_t ptent = ptep_get(pvmw->pte); -@@ -126,7 +127,11 @@ static bool check_pte(struct page_vma_mapped_walk *pvmw) - pfn = pte_pfn(ptent); - } - -- return (pfn - pvmw->pfn) < pvmw->nr_pages; -+ if ((pfn + pte_nr - 1) < pvmw->pfn) -+ return false; -+ if (pfn > (pvmw->pfn + pvmw->nr_pages - 1)) -+ return false; -+ return true; - } - - /* Returns true if the two ranges overlap. Careful to not overflow. */ -@@ -201,7 +206,7 @@ bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw) - return false; - - pvmw->ptl = huge_pte_lock(hstate, mm, pvmw->pte); -- if (!check_pte(pvmw)) -+ if (!check_pte(pvmw, pages_per_huge_page(hstate))) - return not_found(pvmw); - return true; - } -@@ -283,7 +288,7 @@ bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw) - goto next_pte; - } - this_pte: -- if (check_pte(pvmw)) -+ if (check_pte(pvmw, 1)) - return true; - next_pte: - do { -diff --git a/mm/rmap.c b/mm/rmap.c -index 9f795b93cf40f5..968b85a67b1a11 100644 ---- a/mm/rmap.c -+++ b/mm/rmap.c -@@ -2296,7 +2296,7 @@ static bool folio_make_device_exclusive(struct folio *folio, - * Restrict to anonymous folios for now to avoid potential writeback - * issues. - */ -- if (!folio_test_anon(folio)) -+ if (!folio_test_anon(folio) || folio_test_hugetlb(folio)) - return false; - - rmap_walk(folio, &rwc); -diff --git a/mm/vmscan.c b/mm/vmscan.c -index 49456b72575529..258f5472f1e900 100644 ---- a/mm/vmscan.c -+++ b/mm/vmscan.c -@@ -8115,7 +8115,7 @@ int node_reclaim(struct pglist_data *pgdat, gfp_t gfp_mask, unsigned int order) - return NODE_RECLAIM_NOSCAN; - - ret = __node_reclaim(pgdat, gfp_mask, order); -- clear_bit(PGDAT_RECLAIM_LOCKED, &pgdat->flags); -+ clear_bit_unlock(PGDAT_RECLAIM_LOCKED, &pgdat->flags); - - if (!ret) - count_vm_event(PGSCAN_ZONE_RECLAIM_FAILED); -diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c -index 2a7f1b15714ab9..e9326f322d7a27 100644 ---- a/net/8021q/vlan_dev.c -+++ b/net/8021q/vlan_dev.c -@@ -273,17 +273,6 @@ static int vlan_dev_open(struct net_device *dev) - goto out; - } - -- if (dev->flags & IFF_ALLMULTI) { -- err = dev_set_allmulti(real_dev, 1); -- if (err < 0) -- goto del_unicast; -- } -- if (dev->flags & IFF_PROMISC) { -- err = dev_set_promiscuity(real_dev, 1); -- if (err < 0) -- goto clear_allmulti; -- } -- - ether_addr_copy(vlan->real_dev_addr, real_dev->dev_addr); - - if (vlan->flags & VLAN_FLAG_GVRP) -@@ -297,12 +286,6 @@ static int vlan_dev_open(struct net_device *dev) - netif_carrier_on(dev); - return 0; - --clear_allmulti: -- if (dev->flags & IFF_ALLMULTI) -- dev_set_allmulti(real_dev, -1); --del_unicast: -- if (!ether_addr_equal(dev->dev_addr, real_dev->dev_addr)) -- dev_uc_del(real_dev, dev->dev_addr); - out: - netif_carrier_off(dev); - return err; -@@ -315,10 +298,6 @@ static int vlan_dev_stop(struct net_device *dev) - - dev_mc_unsync(real_dev, dev); - dev_uc_unsync(real_dev, dev); -- if (dev->flags & IFF_ALLMULTI) -- dev_set_allmulti(real_dev, -1); -- if (dev->flags & IFF_PROMISC) -- dev_set_promiscuity(real_dev, -1); - - if (!ether_addr_equal(dev->dev_addr, real_dev->dev_addr)) - dev_uc_del(real_dev, dev->dev_addr); -@@ -490,12 +469,10 @@ static void vlan_dev_change_rx_flags(struct net_device *dev, int change) - { - struct net_device *real_dev = vlan_dev_priv(dev)->real_dev; - -- if (dev->flags & IFF_UP) { -- if (change & IFF_ALLMULTI) -- dev_set_allmulti(real_dev, dev->flags & IFF_ALLMULTI ? 1 : -1); -- if (change & IFF_PROMISC) -- dev_set_promiscuity(real_dev, dev->flags & IFF_PROMISC ? 1 : -1); -- } -+ if (change & IFF_ALLMULTI) -+ dev_set_allmulti(real_dev, dev->flags & IFF_ALLMULTI ? 1 : -1); -+ if (change & IFF_PROMISC) -+ dev_set_promiscuity(real_dev, dev->flags & IFF_PROMISC ? 1 : -1); - } - - static void vlan_dev_set_rx_mode(struct net_device *vlan_dev) -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index 1e689d8c00a509..4029330e29a998 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -6149,11 +6149,12 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr, - * event or send an immediate device found event if the data - * should not be stored for later. - */ -- if (!ext_adv && !has_pending_adv_report(hdev)) { -+ if (!has_pending_adv_report(hdev)) { - /* If the report will trigger a SCAN_REQ store it for - * later merging. - */ -- if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) { -+ if (!ext_adv && (type == LE_ADV_IND || -+ type == LE_ADV_SCAN_IND)) { - store_pending_adv_report(hdev, bdaddr, bdaddr_type, - rssi, flags, data, len); - return; -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index 8d6fc186950334..d4dcdb2370cc98 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -3954,7 +3954,8 @@ static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, - - /* Check if the ACL is secure enough (if not SDP) */ - if (psm != cpu_to_le16(L2CAP_PSM_SDP) && -- !hci_conn_check_link_mode(conn->hcon)) { -+ (!hci_conn_check_link_mode(conn->hcon) || -+ !l2cap_check_enc_key_size(conn->hcon))) { - conn->disc_reason = HCI_ERROR_AUTH_FAILURE; - result = L2CAP_CR_SEC_BLOCK; - goto response; -@@ -7509,8 +7510,24 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) - if (skb->len > len) { - BT_ERR("Frame is too long (len %u, expected len %d)", - skb->len, len); -+ /* PTS test cases L2CAP/COS/CED/BI-14-C and BI-15-C -+ * (Multiple Signaling Command in one PDU, Data -+ * Truncated, BR/EDR) send a C-frame to the IUT with -+ * PDU Length set to 8 and Channel ID set to the -+ * correct signaling channel for the logical link. -+ * The Information payload contains one L2CAP_ECHO_REQ -+ * packet with Data Length set to 0 with 0 octets of -+ * echo data and one invalid command packet due to -+ * data truncated in PDU but present in HCI packet. -+ * -+ * Shorter the socket buffer to the PDU length to -+ * allow to process valid commands from the PDU before -+ * setting the socket unreliable. -+ */ -+ skb->len = len; -+ l2cap_recv_frame(conn, skb); - l2cap_conn_unreliable(conn, ECOMM); -- goto drop; -+ goto unlock; - } - - /* Append fragment into frame (with header) */ -diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c -index be714b4d7b4307..a1c22eab71ffec 100644 ---- a/net/bridge/br_vlan.c -+++ b/net/bridge/br_vlan.c -@@ -715,8 +715,8 @@ static int br_vlan_add_existing(struct net_bridge *br, - u16 flags, bool *changed, - struct netlink_ext_ack *extack) - { -- bool would_change = __vlan_flags_would_change(vlan, flags); - bool becomes_brentry = false; -+ bool would_change = false; - int err; - - if (!br_vlan_is_brentry(vlan)) { -@@ -725,6 +725,8 @@ static int br_vlan_add_existing(struct net_bridge *br, - return -EINVAL; - - becomes_brentry = true; -+ } else { -+ would_change = __vlan_flags_would_change(vlan, flags); - } - - /* Master VLANs that aren't brentries weren't notified before, -diff --git a/net/core/filter.c b/net/core/filter.c -index 84992279f4b10e..39eef3370d800e 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -211,24 +211,36 @@ BPF_CALL_3(bpf_skb_get_nlattr_nest, struct sk_buff *, skb, u32, a, u32, x) - return 0; - } - -+static int bpf_skb_load_helper_convert_offset(const struct sk_buff *skb, int offset) -+{ -+ if (likely(offset >= 0)) -+ return offset; -+ -+ if (offset >= SKF_NET_OFF) -+ return offset - SKF_NET_OFF + skb_network_offset(skb); -+ -+ if (offset >= SKF_LL_OFF && skb_mac_header_was_set(skb)) -+ return offset - SKF_LL_OFF + skb_mac_offset(skb); -+ -+ return INT_MIN; -+} -+ - BPF_CALL_4(bpf_skb_load_helper_8, const struct sk_buff *, skb, const void *, - data, int, headlen, int, offset) - { -- u8 tmp, *ptr; -+ u8 tmp; - const int len = sizeof(tmp); - -- if (offset >= 0) { -- if (headlen - offset >= len) -- return *(u8 *)(data + offset); -- if (!skb_copy_bits(skb, offset, &tmp, sizeof(tmp))) -- return tmp; -- } else { -- ptr = bpf_internal_load_pointer_neg_helper(skb, offset, len); -- if (likely(ptr)) -- return *(u8 *)ptr; -- } -+ offset = bpf_skb_load_helper_convert_offset(skb, offset); -+ if (offset == INT_MIN) -+ return -EFAULT; - -- return -EFAULT; -+ if (headlen - offset >= len) -+ return *(u8 *)(data + offset); -+ if (!skb_copy_bits(skb, offset, &tmp, sizeof(tmp))) -+ return tmp; -+ else -+ return -EFAULT; - } - - BPF_CALL_2(bpf_skb_load_helper_8_no_cache, const struct sk_buff *, skb, -@@ -241,21 +253,19 @@ BPF_CALL_2(bpf_skb_load_helper_8_no_cache, const struct sk_buff *, skb, - BPF_CALL_4(bpf_skb_load_helper_16, const struct sk_buff *, skb, const void *, - data, int, headlen, int, offset) - { -- __be16 tmp, *ptr; -+ __be16 tmp; - const int len = sizeof(tmp); - -- if (offset >= 0) { -- if (headlen - offset >= len) -- return get_unaligned_be16(data + offset); -- if (!skb_copy_bits(skb, offset, &tmp, sizeof(tmp))) -- return be16_to_cpu(tmp); -- } else { -- ptr = bpf_internal_load_pointer_neg_helper(skb, offset, len); -- if (likely(ptr)) -- return get_unaligned_be16(ptr); -- } -+ offset = bpf_skb_load_helper_convert_offset(skb, offset); -+ if (offset == INT_MIN) -+ return -EFAULT; - -- return -EFAULT; -+ if (headlen - offset >= len) -+ return get_unaligned_be16(data + offset); -+ if (!skb_copy_bits(skb, offset, &tmp, sizeof(tmp))) -+ return be16_to_cpu(tmp); -+ else -+ return -EFAULT; - } - - BPF_CALL_2(bpf_skb_load_helper_16_no_cache, const struct sk_buff *, skb, -@@ -268,21 +278,19 @@ BPF_CALL_2(bpf_skb_load_helper_16_no_cache, const struct sk_buff *, skb, - BPF_CALL_4(bpf_skb_load_helper_32, const struct sk_buff *, skb, const void *, - data, int, headlen, int, offset) - { -- __be32 tmp, *ptr; -+ __be32 tmp; - const int len = sizeof(tmp); - -- if (likely(offset >= 0)) { -- if (headlen - offset >= len) -- return get_unaligned_be32(data + offset); -- if (!skb_copy_bits(skb, offset, &tmp, sizeof(tmp))) -- return be32_to_cpu(tmp); -- } else { -- ptr = bpf_internal_load_pointer_neg_helper(skb, offset, len); -- if (likely(ptr)) -- return get_unaligned_be32(ptr); -- } -+ offset = bpf_skb_load_helper_convert_offset(skb, offset); -+ if (offset == INT_MIN) -+ return -EFAULT; - -- return -EFAULT; -+ if (headlen - offset >= len) -+ return get_unaligned_be32(data + offset); -+ if (!skb_copy_bits(skb, offset, &tmp, sizeof(tmp))) -+ return be32_to_cpu(tmp); -+ else -+ return -EFAULT; - } - - BPF_CALL_2(bpf_skb_load_helper_32_no_cache, const struct sk_buff *, skb, -diff --git a/net/core/page_pool.c b/net/core/page_pool.c -index 31f923e7b5c40c..2f2f63c8cf4b07 100644 ---- a/net/core/page_pool.c -+++ b/net/core/page_pool.c -@@ -865,7 +865,13 @@ static void page_pool_release_retry(struct work_struct *wq) - int inflight; - - inflight = page_pool_release(pool); -- if (!inflight) -+ /* In rare cases, a driver bug may cause inflight to go negative. -+ * Don't reschedule release if inflight is 0 or negative. -+ * - If 0, the page_pool has been destroyed -+ * - if negative, we will never recover -+ * in both cases no reschedule is necessary. -+ */ -+ if (inflight <= 0) - return; - - /* Periodic warning */ -diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c -index ccbdb98109f806..07736edc8b6a5d 100644 ---- a/net/dsa/dsa.c -+++ b/net/dsa/dsa.c -@@ -867,6 +867,16 @@ static void dsa_tree_teardown_lags(struct dsa_switch_tree *dst) - kfree(dst->lags); - } - -+static void dsa_tree_teardown_routing_table(struct dsa_switch_tree *dst) -+{ -+ struct dsa_link *dl, *next; -+ -+ list_for_each_entry_safe(dl, next, &dst->rtable, list) { -+ list_del(&dl->list); -+ kfree(dl); -+ } -+} -+ - static int dsa_tree_setup(struct dsa_switch_tree *dst) - { - bool complete; -@@ -884,7 +894,7 @@ static int dsa_tree_setup(struct dsa_switch_tree *dst) - - err = dsa_tree_setup_cpu_ports(dst); - if (err) -- return err; -+ goto teardown_rtable; - - err = dsa_tree_setup_switches(dst); - if (err) -@@ -916,14 +926,14 @@ static int dsa_tree_setup(struct dsa_switch_tree *dst) - dsa_tree_teardown_switches(dst); - teardown_cpu_ports: - dsa_tree_teardown_cpu_ports(dst); -+teardown_rtable: -+ dsa_tree_teardown_routing_table(dst); - - return err; - } - - static void dsa_tree_teardown(struct dsa_switch_tree *dst) - { -- struct dsa_link *dl, *next; -- - if (!dst->setup) - return; - -@@ -937,10 +947,7 @@ static void dsa_tree_teardown(struct dsa_switch_tree *dst) - - dsa_tree_teardown_cpu_ports(dst); - -- list_for_each_entry_safe(dl, next, &dst->rtable, list) { -- list_del(&dl->list); -- kfree(dl); -- } -+ dsa_tree_teardown_routing_table(dst); - - pr_info("DSA: tree %d torn down\n", dst->index); - -@@ -1483,12 +1490,44 @@ static int dsa_switch_parse(struct dsa_switch *ds, struct dsa_chip_data *cd) - - static void dsa_switch_release_ports(struct dsa_switch *ds) - { -+ struct dsa_mac_addr *a, *tmp; - struct dsa_port *dp, *next; -+ struct dsa_vlan *v, *n; - - dsa_switch_for_each_port_safe(dp, next, ds) { -- WARN_ON(!list_empty(&dp->fdbs)); -- WARN_ON(!list_empty(&dp->mdbs)); -- WARN_ON(!list_empty(&dp->vlans)); -+ /* These are either entries that upper layers lost track of -+ * (probably due to bugs), or installed through interfaces -+ * where one does not necessarily have to remove them, like -+ * ndo_dflt_fdb_add(). -+ */ -+ list_for_each_entry_safe(a, tmp, &dp->fdbs, list) { -+ dev_info(ds->dev, -+ "Cleaning up unicast address %pM vid %u from port %d\n", -+ a->addr, a->vid, dp->index); -+ list_del(&a->list); -+ kfree(a); -+ } -+ -+ list_for_each_entry_safe(a, tmp, &dp->mdbs, list) { -+ dev_info(ds->dev, -+ "Cleaning up multicast address %pM vid %u from port %d\n", -+ a->addr, a->vid, dp->index); -+ list_del(&a->list); -+ kfree(a); -+ } -+ -+ /* These are entries that upper layers have lost track of, -+ * probably due to bugs, but also due to dsa_port_do_vlan_del() -+ * having failed and the VLAN entry still lingering on. -+ */ -+ list_for_each_entry_safe(v, n, &dp->vlans, list) { -+ dev_info(ds->dev, -+ "Cleaning up vid %u from port %d\n", -+ v->vid, dp->index); -+ list_del(&v->list); -+ kfree(v); -+ } -+ - list_del(&dp->list); - kfree(dp); - } -diff --git a/net/dsa/tag_8021q.c b/net/dsa/tag_8021q.c -index cbdfc392f7e0d9..a5420421e462ef 100644 ---- a/net/dsa/tag_8021q.c -+++ b/net/dsa/tag_8021q.c -@@ -197,7 +197,7 @@ static int dsa_port_do_tag_8021q_vlan_del(struct dsa_port *dp, u16 vid) - - err = ds->ops->tag_8021q_vlan_del(ds, port, vid); - if (err) { -- refcount_inc(&v->refcount); -+ refcount_set(&v->refcount, 1); - return err; - } - -diff --git a/net/ethtool/netlink.c b/net/ethtool/netlink.c -index c1ad63bee8eade..7a9d8fe78ae9db 100644 ---- a/net/ethtool/netlink.c -+++ b/net/ethtool/netlink.c -@@ -402,7 +402,7 @@ static int ethnl_default_doit(struct sk_buff *skb, struct genl_info *info) - ret = ops->prepare_data(req_info, reply_data, info); - rtnl_unlock(); - if (ret < 0) -- goto err_cleanup; -+ goto err_dev; - ret = ops->reply_size(req_info, reply_data); - if (ret < 0) - goto err_cleanup; -@@ -460,7 +460,7 @@ static int ethnl_default_dump_one(struct sk_buff *skb, struct net_device *dev, - ret = ctx->ops->prepare_data(ctx->req_info, ctx->reply_data, info); - rtnl_unlock(); - if (ret < 0) -- goto out; -+ goto out_cancel; - ret = ethnl_fill_reply_header(skb, dev, ctx->ops->hdr_attr); - if (ret < 0) - goto out; -@@ -469,6 +469,7 @@ static int ethnl_default_dump_one(struct sk_buff *skb, struct net_device *dev, - out: - if (ctx->ops->cleanup_data) - ctx->ops->cleanup_data(ctx->reply_data); -+out_cancel: - ctx->reply_data->dev = NULL; - if (ret < 0) - genlmsg_cancel(skb, ehdr); -@@ -676,7 +677,7 @@ static void ethnl_default_notify(struct net_device *dev, unsigned int cmd, - ethnl_init_reply_data(reply_data, ops, dev); - ret = ops->prepare_data(req_info, reply_data, &info); - if (ret < 0) -- goto err_cleanup; -+ goto err_rep; - ret = ops->reply_size(req_info, reply_data); - if (ret < 0) - goto err_cleanup; -@@ -711,6 +712,7 @@ static void ethnl_default_notify(struct net_device *dev, unsigned int cmd, - err_cleanup: - if (ops->cleanup_data) - ops->cleanup_data(reply_data); -+err_rep: - kfree(reply_data); - kfree(req_info); - return; -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index 2e98531fa51a31..53197087353a7b 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -472,10 +472,10 @@ void fib6_select_path(const struct net *net, struct fib6_result *res, - goto out; - - hash = fl6->mp_hash; -- if (hash <= atomic_read(&first->fib6_nh->fib_nh_upper_bound) && -- rt6_score_route(first->fib6_nh, first->fib6_flags, oif, -- strict) >= 0) { -- match = first; -+ if (hash <= atomic_read(&first->fib6_nh->fib_nh_upper_bound)) { -+ if (rt6_score_route(first->fib6_nh, first->fib6_flags, oif, -+ strict) >= 0) -+ match = first; - goto out; - } - -diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c -index fae701248f0580..eaa4e5c6a5c3ac 100644 ---- a/net/mac80211/iface.c -+++ b/net/mac80211/iface.c -@@ -682,6 +682,9 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do - if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) - ieee80211_txq_remove_vlan(local, sdata); - -+ if (sdata->vif.txq) -+ ieee80211_txq_purge(sdata->local, to_txq_info(sdata->vif.txq)); -+ - sdata->bss = NULL; - - if (local->open_count == 0) -diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c -index 51369072984ee1..c6395551f5df08 100644 ---- a/net/mac80211/mesh_hwmp.c -+++ b/net/mac80211/mesh_hwmp.c -@@ -365,6 +365,12 @@ u32 airtime_link_metric_get(struct ieee80211_local *local, - return (u32)result; - } - -+/* Check that the first metric is at least 10% better than the second one */ -+static bool is_metric_better(u32 x, u32 y) -+{ -+ return (x < y) && (x < (y - x / 10)); -+} -+ - /** - * hwmp_route_info_get - Update routing info to originator and transmitter - * -@@ -456,8 +462,8 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata, - (mpath->sn == orig_sn && - (rcu_access_pointer(mpath->next_hop) != - sta ? -- mult_frac(new_metric, 10, 9) : -- new_metric) >= mpath->metric)) { -+ !is_metric_better(new_metric, mpath->metric) : -+ new_metric >= mpath->metric))) { - process = false; - fresh_info = false; - } -@@ -531,8 +537,8 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata, - if ((mpath->flags & MESH_PATH_FIXED) || - ((mpath->flags & MESH_PATH_ACTIVE) && - ((rcu_access_pointer(mpath->next_hop) != sta ? -- mult_frac(last_hop_metric, 10, 9) : -- last_hop_metric) > mpath->metric))) -+ !is_metric_better(last_hop_metric, mpath->metric) : -+ last_hop_metric > mpath->metric)))) - fresh_info = false; - } else { - mpath = mesh_path_add(sdata, ta); -diff --git a/net/mctp/af_mctp.c b/net/mctp/af_mctp.c -index 28be85d055330b..8032cfba22d1c5 100644 ---- a/net/mctp/af_mctp.c -+++ b/net/mctp/af_mctp.c -@@ -550,6 +550,9 @@ static int mctp_sk_hash(struct sock *sk) - { - struct net *net = sock_net(sk); - -+ /* Bind lookup runs under RCU, remain live during that. */ -+ sock_set_flag(sk, SOCK_RCU_FREE); -+ - mutex_lock(&net->mctp.bind_lock); - sk_add_node_rcu(sk, &net->mctp.binds); - mutex_unlock(&net->mctp.bind_lock); -diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c -index d0f73b9180c7c0..31f6899ef71aac 100644 ---- a/net/mptcp/sockopt.c -+++ b/net/mptcp/sockopt.c -@@ -1388,6 +1388,32 @@ static int mptcp_getsockopt_v4(struct mptcp_sock *msk, int optname, - switch (optname) { - case IP_TOS: - return mptcp_put_int_option(msk, optval, optlen, inet_sk(sk)->tos); -+ case IP_FREEBIND: -+ return mptcp_put_int_option(msk, optval, optlen, -+ inet_test_bit(FREEBIND, sk)); -+ case IP_TRANSPARENT: -+ return mptcp_put_int_option(msk, optval, optlen, -+ inet_test_bit(TRANSPARENT, sk)); -+ } -+ -+ return -EOPNOTSUPP; -+} -+ -+static int mptcp_getsockopt_v6(struct mptcp_sock *msk, int optname, -+ char __user *optval, int __user *optlen) -+{ -+ struct sock *sk = (void *)msk; -+ -+ switch (optname) { -+ case IPV6_V6ONLY: -+ return mptcp_put_int_option(msk, optval, optlen, -+ sk->sk_ipv6only); -+ case IPV6_TRANSPARENT: -+ return mptcp_put_int_option(msk, optval, optlen, -+ inet_test_bit(TRANSPARENT, sk)); -+ case IPV6_FREEBIND: -+ return mptcp_put_int_option(msk, optval, optlen, -+ inet_test_bit(FREEBIND, sk)); - } - - return -EOPNOTSUPP; -@@ -1432,6 +1458,8 @@ int mptcp_getsockopt(struct sock *sk, int level, int optname, - - if (level == SOL_IP) - return mptcp_getsockopt_v4(msk, optname, optval, option); -+ if (level == SOL_IPV6) -+ return mptcp_getsockopt_v6(msk, optname, optval, option); - if (level == SOL_TCP) - return mptcp_getsockopt_sol_tcp(msk, optname, optval, option); - if (level == SOL_MPTCP) -diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c -index b3eeeb948b6132..f4b8ca8be81e8a 100644 ---- a/net/mptcp/subflow.c -+++ b/net/mptcp/subflow.c -@@ -731,8 +731,6 @@ static bool subflow_hmac_valid(const struct request_sock *req, - - subflow_req = mptcp_subflow_rsk(req); - msk = subflow_req->msk; -- if (!msk) -- return false; - - subflow_generate_hmac(msk->remote_key, msk->local_key, - subflow_req->remote_nonce, -@@ -828,12 +826,8 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, - - } else if (subflow_req->mp_join) { - mptcp_get_options(skb, &mp_opt); -- if (!(mp_opt.suboptions & OPTION_MPTCP_MPJ_ACK) || -- !subflow_hmac_valid(req, &mp_opt) || -- !mptcp_can_accept_new_subflow(subflow_req->msk)) { -- SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINACKMAC); -+ if (!(mp_opt.suboptions & OPTION_MPTCP_MPJ_ACK)) - fallback = true; -- } - } - - create_child: -@@ -883,6 +877,17 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, - goto dispose_child; - } - -+ if (!subflow_hmac_valid(req, &mp_opt)) { -+ SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINACKMAC); -+ subflow_add_reset_reason(skb, MPTCP_RST_EPROHIBIT); -+ goto dispose_child; -+ } -+ -+ if (!mptcp_can_accept_new_subflow(owner)) { -+ subflow_add_reset_reason(skb, MPTCP_RST_EPROHIBIT); -+ goto dispose_child; -+ } -+ - /* move the msk reference ownership to the subflow */ - subflow_req->msk = NULL; - ctx->conn = (struct sock *)owner; -diff --git a/net/netfilter/nft_set_pipapo_avx2.c b/net/netfilter/nft_set_pipapo_avx2.c -index b8d3c3213efee5..c15db28c5ebc43 100644 ---- a/net/netfilter/nft_set_pipapo_avx2.c -+++ b/net/netfilter/nft_set_pipapo_avx2.c -@@ -994,8 +994,9 @@ static int nft_pipapo_avx2_lookup_8b_16(unsigned long *map, unsigned long *fill, - NFT_PIPAPO_AVX2_BUCKET_LOAD8(5, lt, 8, pkt[8], bsize); - - NFT_PIPAPO_AVX2_AND(6, 2, 3); -+ NFT_PIPAPO_AVX2_AND(3, 4, 7); - NFT_PIPAPO_AVX2_BUCKET_LOAD8(7, lt, 9, pkt[9], bsize); -- NFT_PIPAPO_AVX2_AND(0, 4, 5); -+ NFT_PIPAPO_AVX2_AND(0, 3, 5); - NFT_PIPAPO_AVX2_BUCKET_LOAD8(1, lt, 10, pkt[10], bsize); - NFT_PIPAPO_AVX2_AND(2, 6, 7); - NFT_PIPAPO_AVX2_BUCKET_LOAD8(3, lt, 11, pkt[11], bsize); -diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c -index 9c13e14034d3b6..089ab1826e1d5e 100644 ---- a/net/openvswitch/flow_netlink.c -+++ b/net/openvswitch/flow_netlink.c -@@ -2862,7 +2862,8 @@ static int validate_set(const struct nlattr *a, - size_t key_len; - - /* There can be only one key in a action */ -- if (nla_total_size(nla_len(ovs_key)) != nla_len(a)) -+ if (!nla_ok(ovs_key, nla_len(a)) || -+ nla_total_size(nla_len(ovs_key)) != nla_len(a)) - return -EINVAL; - - key_len = nla_len(ovs_key); -diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c -index 96c39e9a873c75..7245f39d1e6529 100644 ---- a/net/sched/cls_api.c -+++ b/net/sched/cls_api.c -@@ -1977,6 +1977,7 @@ static int tcf_fill_node(struct net *net, struct sk_buff *skb, - struct tcmsg *tcm; - struct nlmsghdr *nlh; - unsigned char *b = skb_tail_pointer(skb); -+ int ret = -EMSGSIZE; - - nlh = nlmsg_put(skb, portid, seq, event, sizeof(*tcm), flags); - if (!nlh) -@@ -2021,11 +2022,45 @@ static int tcf_fill_node(struct net *net, struct sk_buff *skb, - - return skb->len; - -+cls_op_not_supp: -+ ret = -EOPNOTSUPP; - out_nlmsg_trim: - nla_put_failure: --cls_op_not_supp: - nlmsg_trim(skb, b); -- return -1; -+ return ret; -+} -+ -+static struct sk_buff *tfilter_notify_prep(struct net *net, -+ struct sk_buff *oskb, -+ struct nlmsghdr *n, -+ struct tcf_proto *tp, -+ struct tcf_block *block, -+ struct Qdisc *q, u32 parent, -+ void *fh, int event, -+ u32 portid, bool rtnl_held, -+ struct netlink_ext_ack *extack) -+{ -+ unsigned int size = oskb ? max(NLMSG_GOODSIZE, oskb->len) : NLMSG_GOODSIZE; -+ struct sk_buff *skb; -+ int ret; -+ -+retry: -+ skb = alloc_skb(size, GFP_KERNEL); -+ if (!skb) -+ return ERR_PTR(-ENOBUFS); -+ -+ ret = tcf_fill_node(net, skb, tp, block, q, parent, fh, portid, -+ n->nlmsg_seq, n->nlmsg_flags, event, false, -+ rtnl_held, extack); -+ if (ret <= 0) { -+ kfree_skb(skb); -+ if (ret == -EMSGSIZE) { -+ size += NLMSG_GOODSIZE; -+ goto retry; -+ } -+ return ERR_PTR(-EINVAL); -+ } -+ return skb; - } - - static int tfilter_notify(struct net *net, struct sk_buff *oskb, -@@ -2038,16 +2073,13 @@ static int tfilter_notify(struct net *net, struct sk_buff *oskb, - u32 portid = oskb ? NETLINK_CB(oskb).portid : 0; - int err = 0; - -- skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); -- if (!skb) -- return -ENOBUFS; -+ if (!unicast && !rtnl_notify_needed(net, n->nlmsg_flags, RTNLGRP_TC)) -+ return 0; - -- if (tcf_fill_node(net, skb, tp, block, q, parent, fh, portid, -- n->nlmsg_seq, n->nlmsg_flags, event, -- false, rtnl_held, extack) <= 0) { -- kfree_skb(skb); -- return -EINVAL; -- } -+ skb = tfilter_notify_prep(net, oskb, n, tp, block, q, parent, fh, event, -+ portid, rtnl_held, extack); -+ if (IS_ERR(skb)) -+ return PTR_ERR(skb); - - if (unicast) - err = rtnl_unicast(skb, net, portid); -@@ -2067,16 +2099,14 @@ static int tfilter_del_notify(struct net *net, struct sk_buff *oskb, - u32 portid = oskb ? NETLINK_CB(oskb).portid : 0; - int err; - -- skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); -- if (!skb) -- return -ENOBUFS; -+ if (!rtnl_notify_needed(net, n->nlmsg_flags, RTNLGRP_TC)) -+ return tp->ops->delete(tp, fh, last, rtnl_held, extack); - -- if (tcf_fill_node(net, skb, tp, block, q, parent, fh, portid, -- n->nlmsg_seq, n->nlmsg_flags, RTM_DELTFILTER, -- false, rtnl_held, extack) <= 0) { -+ skb = tfilter_notify_prep(net, oskb, n, tp, block, q, parent, fh, -+ RTM_DELTFILTER, portid, rtnl_held, extack); -+ if (IS_ERR(skb)) { - NL_SET_ERR_MSG(extack, "Failed to build del event notification"); -- kfree_skb(skb); -- return -EINVAL; -+ return PTR_ERR(skb); - } - - err = tp->ops->delete(tp, fh, last, rtnl_held, extack); -@@ -2891,6 +2921,9 @@ static int tc_chain_notify(struct tcf_chain *chain, struct sk_buff *oskb, - struct sk_buff *skb; - int err = 0; - -+ if (!unicast && !rtnl_notify_needed(net, flags, RTNLGRP_TC)) -+ return 0; -+ - skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); - if (!skb) - return -ENOBUFS; -@@ -2920,6 +2953,9 @@ static int tc_chain_notify_delete(const struct tcf_proto_ops *tmplt_ops, - struct net *net = block->net; - struct sk_buff *skb; - -+ if (!rtnl_notify_needed(net, flags, RTNLGRP_TC)) -+ return 0; -+ - skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); - if (!skb) - return -ENOBUFS; -diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c -index d7a4874543de5d..5f2e0681574567 100644 ---- a/net/sched/sch_codel.c -+++ b/net/sched/sch_codel.c -@@ -95,10 +95,7 @@ static struct sk_buff *codel_qdisc_dequeue(struct Qdisc *sch) - &q->stats, qdisc_pkt_len, codel_get_enqueue_time, - drop_func, dequeue_func); - -- /* We cant call qdisc_tree_reduce_backlog() if our qlen is 0, -- * or HTB crashes. Defer it for next round. -- */ -- if (q->stats.drop_count && sch->q.qlen) { -+ if (q->stats.drop_count) { - qdisc_tree_reduce_backlog(sch, q->stats.drop_count, q->stats.drop_len); - q->stats.drop_count = 0; - q->stats.drop_len = 0; -diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c -index 8c4fee0634366e..9330923a624c02 100644 ---- a/net/sched/sch_fq_codel.c -+++ b/net/sched/sch_fq_codel.c -@@ -314,10 +314,8 @@ static struct sk_buff *fq_codel_dequeue(struct Qdisc *sch) - } - qdisc_bstats_update(sch, skb); - flow->deficit -= qdisc_pkt_len(skb); -- /* We cant call qdisc_tree_reduce_backlog() if our qlen is 0, -- * or HTB crashes. Defer it for next round. -- */ -- if (q->cstats.drop_count && sch->q.qlen) { -+ -+ if (q->cstats.drop_count) { - qdisc_tree_reduce_backlog(sch, q->cstats.drop_count, - q->cstats.drop_len); - q->cstats.drop_count = 0; -diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c -index 60754f366ab7bc..002941d35b643c 100644 ---- a/net/sched/sch_sfq.c -+++ b/net/sched/sch_sfq.c -@@ -631,6 +631,15 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt, - struct red_parms *p = NULL; - struct sk_buff *to_free = NULL; - struct sk_buff *tail = NULL; -+ unsigned int maxflows; -+ unsigned int quantum; -+ unsigned int divisor; -+ int perturb_period; -+ u8 headdrop; -+ u8 maxdepth; -+ int limit; -+ u8 flags; -+ - - if (opt->nla_len < nla_attr_size(sizeof(*ctl))) - return -EINVAL; -@@ -652,39 +661,64 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt, - if (!p) - return -ENOMEM; - } -- if (ctl->limit == 1) { -- NL_SET_ERR_MSG_MOD(extack, "invalid limit"); -- return -EINVAL; -- } -+ - sch_tree_lock(sch); -+ -+ limit = q->limit; -+ divisor = q->divisor; -+ headdrop = q->headdrop; -+ maxdepth = q->maxdepth; -+ maxflows = q->maxflows; -+ perturb_period = q->perturb_period; -+ quantum = q->quantum; -+ flags = q->flags; -+ -+ /* update and validate configuration */ - if (ctl->quantum) -- q->quantum = ctl->quantum; -- WRITE_ONCE(q->perturb_period, ctl->perturb_period * HZ); -+ quantum = ctl->quantum; -+ perturb_period = ctl->perturb_period * HZ; - if (ctl->flows) -- q->maxflows = min_t(u32, ctl->flows, SFQ_MAX_FLOWS); -+ maxflows = min_t(u32, ctl->flows, SFQ_MAX_FLOWS); - if (ctl->divisor) { -- q->divisor = ctl->divisor; -- q->maxflows = min_t(u32, q->maxflows, q->divisor); -+ divisor = ctl->divisor; -+ maxflows = min_t(u32, maxflows, divisor); - } - if (ctl_v1) { - if (ctl_v1->depth) -- q->maxdepth = min_t(u32, ctl_v1->depth, SFQ_MAX_DEPTH); -+ maxdepth = min_t(u32, ctl_v1->depth, SFQ_MAX_DEPTH); - if (p) { -- swap(q->red_parms, p); -- red_set_parms(q->red_parms, -+ red_set_parms(p, - ctl_v1->qth_min, ctl_v1->qth_max, - ctl_v1->Wlog, - ctl_v1->Plog, ctl_v1->Scell_log, - NULL, - ctl_v1->max_P); - } -- q->flags = ctl_v1->flags; -- q->headdrop = ctl_v1->headdrop; -+ flags = ctl_v1->flags; -+ headdrop = ctl_v1->headdrop; - } - if (ctl->limit) { -- q->limit = min_t(u32, ctl->limit, q->maxdepth * q->maxflows); -- q->maxflows = min_t(u32, q->maxflows, q->limit); -+ limit = min_t(u32, ctl->limit, maxdepth * maxflows); -+ maxflows = min_t(u32, maxflows, limit); - } -+ if (limit == 1) { -+ sch_tree_unlock(sch); -+ kfree(p); -+ NL_SET_ERR_MSG_MOD(extack, "invalid limit"); -+ return -EINVAL; -+ } -+ -+ /* commit configuration */ -+ q->limit = limit; -+ q->divisor = divisor; -+ q->headdrop = headdrop; -+ q->maxdepth = maxdepth; -+ q->maxflows = maxflows; -+ WRITE_ONCE(q->perturb_period, perturb_period); -+ q->quantum = quantum; -+ q->flags = flags; -+ if (p) -+ swap(q->red_parms, p); - - qlen = sch->q.qlen; - while (sch->q.qlen > q->limit) { -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 108a0745c0c3ca..b84c5e0a76f52d 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -71,8 +71,9 @@ - /* Forward declarations for internal helper functions. */ - static bool sctp_writeable(const struct sock *sk); - static void sctp_wfree(struct sk_buff *skb); --static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, -- size_t msg_len); -+static int sctp_wait_for_sndbuf(struct sctp_association *asoc, -+ struct sctp_transport *transport, -+ long *timeo_p, size_t msg_len); - static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p); - static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p); - static int sctp_wait_for_accept(struct sock *sk, long timeo); -@@ -1827,7 +1828,7 @@ static int sctp_sendmsg_to_asoc(struct sctp_association *asoc, - - if (sctp_wspace(asoc) <= 0 || !sk_wmem_schedule(sk, msg_len)) { - timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT); -- err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len); -+ err = sctp_wait_for_sndbuf(asoc, transport, &timeo, msg_len); - if (err) - goto err; - if (unlikely(sinfo->sinfo_stream >= asoc->stream.outcnt)) { -@@ -9208,8 +9209,9 @@ void sctp_sock_rfree(struct sk_buff *skb) - - - /* Helper function to wait for space in the sndbuf. */ --static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, -- size_t msg_len) -+static int sctp_wait_for_sndbuf(struct sctp_association *asoc, -+ struct sctp_transport *transport, -+ long *timeo_p, size_t msg_len) - { - struct sock *sk = asoc->base.sk; - long current_timeo = *timeo_p; -@@ -9219,7 +9221,9 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, - pr_debug("%s: asoc:%p, timeo:%ld, msg_len:%zu\n", __func__, asoc, - *timeo_p, msg_len); - -- /* Increment the association's refcnt. */ -+ /* Increment the transport and association's refcnt. */ -+ if (transport) -+ sctp_transport_hold(transport); - sctp_association_hold(asoc); - - /* Wait on the association specific sndbuf space. */ -@@ -9228,7 +9232,7 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, - TASK_INTERRUPTIBLE); - if (asoc->base.dead) - goto do_dead; -- if (!*timeo_p) -+ if ((!*timeo_p) || (transport && transport->dead)) - goto do_nonblock; - if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING) - goto do_error; -@@ -9253,7 +9257,9 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, - out: - finish_wait(&asoc->wait, &wait); - -- /* Release the association's refcnt. */ -+ /* Release the transport and association's refcnt. */ -+ if (transport) -+ sctp_transport_put(transport); - sctp_association_put(asoc); - - return err; -diff --git a/net/sctp/transport.c b/net/sctp/transport.c -index 2abe45af98e7c6..31eca29b6cfbfb 100644 ---- a/net/sctp/transport.c -+++ b/net/sctp/transport.c -@@ -117,6 +117,8 @@ struct sctp_transport *sctp_transport_new(struct net *net, - */ - void sctp_transport_free(struct sctp_transport *transport) - { -+ transport->dead = 1; -+ - /* Try to delete the heartbeat timer. */ - if (del_timer(&transport->hb_timer)) - sctp_transport_put(transport); -diff --git a/net/tipc/link.c b/net/tipc/link.c -index d0143823658d58..6c6d8546c57861 100644 ---- a/net/tipc/link.c -+++ b/net/tipc/link.c -@@ -1068,6 +1068,7 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list, - if (unlikely(l->backlog[imp].len >= l->backlog[imp].limit)) { - if (imp == TIPC_SYSTEM_IMPORTANCE) { - pr_warn("%s<%s>, link overflow", link_rst_msg, l->name); -+ __skb_queue_purge(list); - return -ENOBUFS; - } - rc = link_schedule_user(l, hdr); -diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c -index 0a67b93a52ec25..d7dea82bcf5653 100644 ---- a/net/tls/tls_main.c -+++ b/net/tls/tls_main.c -@@ -804,6 +804,11 @@ static int tls_setsockopt(struct sock *sk, int level, int optname, - return do_tls_setsockopt(sk, optname, optval, optlen); - } - -+static int tls_disconnect(struct sock *sk, int flags) -+{ -+ return -EOPNOTSUPP; -+} -+ - struct tls_context *tls_ctx_create(struct sock *sk) - { - struct inet_connection_sock *icsk = inet_csk(sk); -@@ -899,6 +904,7 @@ static void build_protos(struct proto prot[TLS_NUM_CONFIG][TLS_NUM_CONFIG], - prot[TLS_BASE][TLS_BASE] = *base; - prot[TLS_BASE][TLS_BASE].setsockopt = tls_setsockopt; - prot[TLS_BASE][TLS_BASE].getsockopt = tls_getsockopt; -+ prot[TLS_BASE][TLS_BASE].disconnect = tls_disconnect; - prot[TLS_BASE][TLS_BASE].close = tls_sk_proto_close; - - prot[TLS_SW][TLS_BASE] = prot[TLS_BASE][TLS_BASE]; -diff --git a/scripts/sign-file.c b/scripts/sign-file.c -index 3edb156ae52c30..7070245edfc121 100644 ---- a/scripts/sign-file.c -+++ b/scripts/sign-file.c -@@ -27,14 +27,17 @@ - #include - #include - #include --#include -- --/* -- * OpenSSL 3.0 deprecates the OpenSSL's ENGINE API. -- * -- * Remove this if/when that API is no longer used -- */ --#pragma GCC diagnostic ignored "-Wdeprecated-declarations" -+#if OPENSSL_VERSION_MAJOR >= 3 -+# define USE_PKCS11_PROVIDER -+# include -+# include -+#else -+# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0) -+# define USE_PKCS11_ENGINE -+# include -+# endif -+#endif -+#include "ssl-common.h" - - /* - * Use CMS if we have openssl-1.0.0 or newer available - otherwise we have to -@@ -83,41 +86,6 @@ void format(void) - exit(2); - } - --static void display_openssl_errors(int l) --{ -- const char *file; -- char buf[120]; -- int e, line; -- -- if (ERR_peek_error() == 0) -- return; -- fprintf(stderr, "At main.c:%d:\n", l); -- -- while ((e = ERR_get_error_line(&file, &line))) { -- ERR_error_string(e, buf); -- fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line); -- } --} -- --static void drain_openssl_errors(void) --{ -- const char *file; -- int line; -- -- if (ERR_peek_error() == 0) -- return; -- while (ERR_get_error_line(&file, &line)) {} --} -- --#define ERR(cond, fmt, ...) \ -- do { \ -- bool __cond = (cond); \ -- display_openssl_errors(__LINE__); \ -- if (__cond) { \ -- errx(1, fmt, ## __VA_ARGS__); \ -- } \ -- } while(0) -- - static const char *key_pass; - - static int pem_pw_cb(char *buf, int len, int w, void *v) -@@ -139,28 +107,64 @@ static int pem_pw_cb(char *buf, int len, int w, void *v) - return pwlen; - } - --static EVP_PKEY *read_private_key(const char *private_key_name) -+static EVP_PKEY *read_private_key_pkcs11(const char *private_key_name) - { -- EVP_PKEY *private_key; -+ EVP_PKEY *private_key = NULL; -+#ifdef USE_PKCS11_PROVIDER -+ OSSL_STORE_CTX *store; - -+ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true)) -+ ERR(1, "OSSL_PROVIDER_try_load(pkcs11)"); -+ if (!OSSL_PROVIDER_try_load(NULL, "default", true)) -+ ERR(1, "OSSL_PROVIDER_try_load(default)"); -+ -+ store = OSSL_STORE_open(private_key_name, NULL, NULL, NULL, NULL); -+ ERR(!store, "OSSL_STORE_open"); -+ -+ while (!OSSL_STORE_eof(store)) { -+ OSSL_STORE_INFO *info = OSSL_STORE_load(store); -+ -+ if (!info) { -+ drain_openssl_errors(__LINE__, 0); -+ continue; -+ } -+ if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_PKEY) { -+ private_key = OSSL_STORE_INFO_get1_PKEY(info); -+ ERR(!private_key, "OSSL_STORE_INFO_get1_PKEY"); -+ } -+ OSSL_STORE_INFO_free(info); -+ if (private_key) -+ break; -+ } -+ OSSL_STORE_close(store); -+#elif defined(USE_PKCS11_ENGINE) -+ ENGINE *e; -+ -+ ENGINE_load_builtin_engines(); -+ drain_openssl_errors(__LINE__, 1); -+ e = ENGINE_by_id("pkcs11"); -+ ERR(!e, "Load PKCS#11 ENGINE"); -+ if (ENGINE_init(e)) -+ drain_openssl_errors(__LINE__, 1); -+ else -+ ERR(1, "ENGINE_init"); -+ if (key_pass) -+ ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), "Set PKCS#11 PIN"); -+ private_key = ENGINE_load_private_key(e, private_key_name, NULL, NULL); -+ ERR(!private_key, "%s", private_key_name); -+#else -+ fprintf(stderr, "no pkcs11 engine/provider available\n"); -+ exit(1); -+#endif -+ return private_key; -+} -+ -+static EVP_PKEY *read_private_key(const char *private_key_name) -+{ - if (!strncmp(private_key_name, "pkcs11:", 7)) { -- ENGINE *e; -- -- ENGINE_load_builtin_engines(); -- drain_openssl_errors(); -- e = ENGINE_by_id("pkcs11"); -- ERR(!e, "Load PKCS#11 ENGINE"); -- if (ENGINE_init(e)) -- drain_openssl_errors(); -- else -- ERR(1, "ENGINE_init"); -- if (key_pass) -- ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), -- "Set PKCS#11 PIN"); -- private_key = ENGINE_load_private_key(e, private_key_name, -- NULL, NULL); -- ERR(!private_key, "%s", private_key_name); -+ return read_private_key_pkcs11(private_key_name); - } else { -+ EVP_PKEY *private_key; - BIO *b; - - b = BIO_new_file(private_key_name, "rb"); -@@ -169,9 +173,9 @@ static EVP_PKEY *read_private_key(const char *private_key_name) - NULL); - ERR(!private_key, "%s", private_key_name); - BIO_free(b); -- } - -- return private_key; -+ return private_key; -+ } - } - - static X509 *read_x509(const char *x509_name) -@@ -306,7 +310,7 @@ int main(int argc, char **argv) - - /* Digest the module data. */ - OpenSSL_add_all_digests(); -- display_openssl_errors(__LINE__); -+ drain_openssl_errors(__LINE__, 0); - digest_algo = EVP_get_digestbyname(hash_algo); - ERR(!digest_algo, "EVP_get_digestbyname"); - -diff --git a/scripts/ssl-common.h b/scripts/ssl-common.h -new file mode 100644 -index 00000000000000..2db0e181143cf4 ---- /dev/null -+++ b/scripts/ssl-common.h -@@ -0,0 +1,32 @@ -+/* SPDX-License-Identifier: LGPL-2.1+ */ -+/* -+ * SSL helper functions shared by sign-file and extract-cert. -+ */ -+ -+static void drain_openssl_errors(int l, int silent) -+{ -+ const char *file; -+ char buf[120]; -+ int e, line; -+ -+ if (ERR_peek_error() == 0) -+ return; -+ if (!silent) -+ fprintf(stderr, "At main.c:%d:\n", l); -+ -+ while ((e = ERR_peek_error_line(&file, &line))) { -+ ERR_error_string(e, buf); -+ if (!silent) -+ fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line); -+ ERR_get_error(); -+ } -+} -+ -+#define ERR(cond, fmt, ...) \ -+ do { \ -+ bool __cond = (cond); \ -+ drain_openssl_errors(__LINE__, 0); \ -+ if (__cond) { \ -+ errx(1, fmt, ## __VA_ARGS__); \ -+ } \ -+ } while (0) -diff --git a/security/landlock/errata.h b/security/landlock/errata.h -new file mode 100644 -index 00000000000000..fe91ef0e6f72db ---- /dev/null -+++ b/security/landlock/errata.h -@@ -0,0 +1,87 @@ -+/* SPDX-License-Identifier: GPL-2.0-only */ -+/* -+ * Landlock - Errata information -+ * -+ * Copyright © 2025 Microsoft Corporation -+ */ -+ -+#ifndef _SECURITY_LANDLOCK_ERRATA_H -+#define _SECURITY_LANDLOCK_ERRATA_H -+ -+#include -+ -+struct landlock_erratum { -+ const int abi; -+ const u8 number; -+}; -+ -+/* clang-format off */ -+#define LANDLOCK_ERRATUM(NUMBER) \ -+ { \ -+ .abi = LANDLOCK_ERRATA_ABI, \ -+ .number = NUMBER, \ -+ }, -+/* clang-format on */ -+ -+/* -+ * Some fixes may require user space to check if they are applied on the running -+ * kernel before using a specific feature. For instance, this applies when a -+ * restriction was previously too restrictive and is now getting relaxed (for -+ * compatibility or semantic reasons). However, non-visible changes for -+ * legitimate use (e.g. security fixes) do not require an erratum. -+ */ -+static const struct landlock_erratum landlock_errata_init[] __initconst = { -+ -+/* -+ * Only Sparse may not implement __has_include. If a compiler does not -+ * implement __has_include, a warning will be printed at boot time (see -+ * setup.c). -+ */ -+#ifdef __has_include -+ -+#define LANDLOCK_ERRATA_ABI 1 -+#if __has_include("errata/abi-1.h") -+#include "errata/abi-1.h" -+#endif -+#undef LANDLOCK_ERRATA_ABI -+ -+#define LANDLOCK_ERRATA_ABI 2 -+#if __has_include("errata/abi-2.h") -+#include "errata/abi-2.h" -+#endif -+#undef LANDLOCK_ERRATA_ABI -+ -+#define LANDLOCK_ERRATA_ABI 3 -+#if __has_include("errata/abi-3.h") -+#include "errata/abi-3.h" -+#endif -+#undef LANDLOCK_ERRATA_ABI -+ -+#define LANDLOCK_ERRATA_ABI 4 -+#if __has_include("errata/abi-4.h") -+#include "errata/abi-4.h" -+#endif -+#undef LANDLOCK_ERRATA_ABI -+ -+/* -+ * For each new erratum, we need to include all the ABI files up to the impacted -+ * ABI to make all potential future intermediate errata easy to backport. -+ * -+ * If such change involves more than one ABI addition, then it must be in a -+ * dedicated commit with the same Fixes tag as used for the actual fix. -+ * -+ * Each commit creating a new security/landlock/errata/abi-*.h file must have a -+ * Depends-on tag to reference the commit that previously added the line to -+ * include this new file, except if the original Fixes tag is enough. -+ * -+ * Each erratum must be documented in its related ABI file, and a dedicated -+ * commit must update Documentation/userspace-api/landlock.rst to include this -+ * erratum. This commit will not be backported. -+ */ -+ -+#endif -+ -+ {} -+}; -+ -+#endif /* _SECURITY_LANDLOCK_ERRATA_H */ -diff --git a/security/landlock/setup.c b/security/landlock/setup.c -index 0f6113528fa4a8..8b46e8748b8a42 100644 ---- a/security/landlock/setup.c -+++ b/security/landlock/setup.c -@@ -6,11 +6,13 @@ - * Copyright © 2018-2020 ANSSI - */ - -+#include - #include - #include - - #include "common.h" - #include "cred.h" -+#include "errata.h" - #include "fs.h" - #include "ptrace.h" - #include "setup.h" -@@ -24,8 +26,36 @@ struct lsm_blob_sizes landlock_blob_sizes __ro_after_init = { - .lbs_superblock = sizeof(struct landlock_superblock_security), - }; - -+int landlock_errata __ro_after_init; -+ -+static void __init compute_errata(void) -+{ -+ size_t i; -+ -+#ifndef __has_include -+ /* -+ * This is a safeguard to make sure the compiler implements -+ * __has_include (see errata.h). -+ */ -+ WARN_ON_ONCE(1); -+ return; -+#endif -+ -+ for (i = 0; landlock_errata_init[i].number; i++) { -+ const int prev_errata = landlock_errata; -+ -+ if (WARN_ON_ONCE(landlock_errata_init[i].abi > -+ landlock_abi_version)) -+ continue; -+ -+ landlock_errata |= BIT(landlock_errata_init[i].number - 1); -+ WARN_ON_ONCE(prev_errata == landlock_errata); -+ } -+} -+ - static int __init landlock_init(void) - { -+ compute_errata(); - landlock_add_cred_hooks(); - landlock_add_ptrace_hooks(); - landlock_add_fs_hooks(); -diff --git a/security/landlock/setup.h b/security/landlock/setup.h -index 1daffab1ab4bda..420dceca35d271 100644 ---- a/security/landlock/setup.h -+++ b/security/landlock/setup.h -@@ -11,7 +11,10 @@ - - #include - -+extern const int landlock_abi_version; -+ - extern bool landlock_initialized; -+extern int landlock_errata; - - extern struct lsm_blob_sizes landlock_blob_sizes; - -diff --git a/security/landlock/syscalls.c b/security/landlock/syscalls.c -index 336bedaa3af689..eb23df4e836cba 100644 ---- a/security/landlock/syscalls.c -+++ b/security/landlock/syscalls.c -@@ -150,7 +150,9 @@ static const struct file_operations ruleset_fops = { - * the new ruleset. - * @size: Size of the pointed &struct landlock_ruleset_attr (needed for - * backward and forward compatibility). -- * @flags: Supported value: %LANDLOCK_CREATE_RULESET_VERSION. -+ * @flags: Supported value: -+ * - %LANDLOCK_CREATE_RULESET_VERSION -+ * - %LANDLOCK_CREATE_RULESET_ERRATA - * - * This system call enables to create a new Landlock ruleset, and returns the - * related file descriptor on success. -@@ -159,6 +161,10 @@ static const struct file_operations ruleset_fops = { - * 0, then the returned value is the highest supported Landlock ABI version - * (starting at 1). - * -+ * If @flags is %LANDLOCK_CREATE_RULESET_ERRATA and @attr is NULL and @size is -+ * 0, then the returned value is a bitmask of fixed issues for the current -+ * Landlock ABI version. -+ * - * Possible returned errors are: - * - * - %EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time; -@@ -181,9 +187,15 @@ SYSCALL_DEFINE3(landlock_create_ruleset, - return -EOPNOTSUPP; - - if (flags) { -- if ((flags == LANDLOCK_CREATE_RULESET_VERSION) && !attr && -- !size) -- return LANDLOCK_ABI_VERSION; -+ if (attr || size) -+ return -EINVAL; -+ -+ if (flags == LANDLOCK_CREATE_RULESET_VERSION) -+ return landlock_abi_version; -+ -+ if (flags == LANDLOCK_CREATE_RULESET_ERRATA) -+ return landlock_errata; -+ - return -EINVAL; - } - -@@ -213,6 +225,8 @@ SYSCALL_DEFINE3(landlock_create_ruleset, - return ruleset_fd; - } - -+const int landlock_abi_version = LANDLOCK_ABI_VERSION; -+ - /* - * Returns an owned ruleset from a FD. It is thus needed to call - * landlock_put_ruleset() on the return value. -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index d90151910bee90..3a0df631d25d91 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -37,6 +37,7 @@ - #include - #include - #include -+#include - - #ifdef CONFIG_X86 - /* for snoop control */ -@@ -1363,8 +1364,21 @@ static void azx_free(struct azx *chip) - if (use_vga_switcheroo(hda)) { - if (chip->disabled && hda->probe_continued) - snd_hda_unlock_devices(&chip->bus); -- if (hda->vga_switcheroo_registered) -+ if (hda->vga_switcheroo_registered) { - vga_switcheroo_unregister_client(chip->pci); -+ -+ /* Some GPUs don't have sound, and azx_first_init fails, -+ * leaving the device probed but non-functional. As long -+ * as it's probed, the PCI subsystem keeps its runtime -+ * PM status as active. Force it to suspended (as we -+ * actually stop the chip) to allow GPU to suspend via -+ * vga_switcheroo, and print a warning. -+ */ -+ dev_warn(&pci->dev, "GPU sound probed, but not operational: please add a quirk to driver_denylist\n"); -+ pm_runtime_disable(&pci->dev); -+ pm_runtime_set_suspended(&pci->dev); -+ pm_runtime_enable(&pci->dev); -+ } - } - - if (bus->chip_init) { -@@ -2079,6 +2093,27 @@ static const struct pci_device_id driver_denylist[] = { - {} - }; - -+static struct pci_device_id driver_denylist_ideapad_z570[] = { -+ { PCI_DEVICE_SUB(0x10de, 0x0bea, 0x0000, 0x0000) }, /* NVIDIA GF108 HDA */ -+ {} -+}; -+ -+/* DMI-based denylist, to be used when: -+ * - PCI subsystem IDs are zero, impossible to distinguish from valid sound cards. -+ * - Different modifications of the same laptop use different GPU models. -+ */ -+static const struct dmi_system_id driver_denylist_dmi[] = { -+ { -+ /* No HDA in NVIDIA DGPU. BIOS disables it, but quirk_nvidia_hda() reenables. */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_VERSION, "Ideapad Z570"), -+ }, -+ .driver_data = &driver_denylist_ideapad_z570, -+ }, -+ {} -+}; -+ - static const struct hda_controller_ops pci_hda_ops = { - .disable_msi_reset_irq = disable_msi_reset_irq, - .position_check = azx_position_check, -@@ -2089,6 +2124,7 @@ static DECLARE_BITMAP(probed_devs, SNDRV_CARDS); - static int azx_probe(struct pci_dev *pci, - const struct pci_device_id *pci_id) - { -+ const struct dmi_system_id *dmi; - struct snd_card *card; - struct hda_intel *hda; - struct azx *chip; -@@ -2101,6 +2137,12 @@ static int azx_probe(struct pci_dev *pci, - return -ENODEV; - } - -+ dmi = dmi_first_match(driver_denylist_dmi); -+ if (dmi && pci_match_id(dmi->driver_data, pci)) { -+ dev_info(&pci->dev, "Skipping the device on the DMI denylist\n"); -+ return -ENODEV; -+ } -+ - dev = find_first_zero_bit(probed_devs, SNDRV_CARDS); - if (dev >= SNDRV_CARDS) - return -ENODEV; -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 5179061f57b573..2f3f295f2b0cb5 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -10238,6 +10238,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1043, 0x1c33, "ASUS UX5304MA", ALC245_FIXUP_CS35L41_SPI_2), - SND_PCI_QUIRK(0x1043, 0x1c43, "ASUS UX8406MA", ALC245_FIXUP_CS35L41_SPI_2), - SND_PCI_QUIRK(0x1043, 0x1c62, "ASUS GU603", ALC289_FIXUP_ASUS_GA401), -+ SND_PCI_QUIRK(0x1043, 0x1c80, "ASUS VivoBook TP401", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1043, 0x1c92, "ASUS ROG Strix G15", ALC285_FIXUP_ASUS_G533Z_PINS), - SND_PCI_QUIRK(0x1043, 0x1c9f, "ASUS G614JU/JV/JI", ALC285_FIXUP_ASUS_HEADSET_MIC), - SND_PCI_QUIRK(0x1043, 0x1caf, "ASUS G634JY/JZ/JI/JG", ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS), -diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c -index 2981bd1c3530d0..622df58a969421 100644 ---- a/sound/soc/amd/yc/acp6x-mach.c -+++ b/sound/soc/amd/yc/acp6x-mach.c -@@ -339,6 +339,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "83Q3"), - } - }, -+ { -+ .driver_data = &acp6x_card, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "83J2"), -+ } -+ }, - { - .driver_data = &acp6x_card, - .matches = { -@@ -584,6 +591,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { - DMI_MATCH(DMI_PRODUCT_VERSION, "pang13"), - } - }, -+ { -+ .driver_data = &acp6x_card, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "Micro-Star International Co., Ltd."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Bravo 15 C7UCX"), -+ } -+ }, - {} - }; - -diff --git a/sound/soc/codecs/cs42l43-jack.c b/sound/soc/codecs/cs42l43-jack.c -index 9f5f1a92561d1e..0b8e88b19888ec 100644 ---- a/sound/soc/codecs/cs42l43-jack.c -+++ b/sound/soc/codecs/cs42l43-jack.c -@@ -690,6 +690,9 @@ static void cs42l43_clear_jack(struct cs42l43_codec *priv) - CS42L43_PGA_WIDESWING_MODE_EN_MASK, 0); - regmap_update_bits(cs42l43->regmap, CS42L43_STEREO_MIC_CTRL, - CS42L43_JACK_STEREO_CONFIG_MASK, 0); -+ regmap_update_bits(cs42l43->regmap, CS42L43_STEREO_MIC_CLAMP_CTRL, -+ CS42L43_SMIC_HPAMP_CLAMP_DIS_FRC_MASK, -+ CS42L43_SMIC_HPAMP_CLAMP_DIS_FRC_MASK); - regmap_update_bits(cs42l43->regmap, CS42L43_HS2, - CS42L43_HSDET_MODE_MASK | CS42L43_HSDET_MANUAL_MODE_MASK, - 0x2 << CS42L43_HSDET_MODE_SHIFT); -diff --git a/sound/soc/codecs/lpass-wsa-macro.c b/sound/soc/codecs/lpass-wsa-macro.c -index 6ce309980cd10e..e29815535929d5 100644 ---- a/sound/soc/codecs/lpass-wsa-macro.c -+++ b/sound/soc/codecs/lpass-wsa-macro.c -@@ -66,6 +66,10 @@ - #define CDC_WSA_TX_SPKR_PROT_CLK_DISABLE 0 - #define CDC_WSA_TX_SPKR_PROT_PCM_RATE_MASK GENMASK(3, 0) - #define CDC_WSA_TX_SPKR_PROT_PCM_RATE_8K 0 -+#define CDC_WSA_TX_SPKR_PROT_PCM_RATE_16K 1 -+#define CDC_WSA_TX_SPKR_PROT_PCM_RATE_24K 2 -+#define CDC_WSA_TX_SPKR_PROT_PCM_RATE_32K 3 -+#define CDC_WSA_TX_SPKR_PROT_PCM_RATE_48K 4 - #define CDC_WSA_TX0_SPKR_PROT_PATH_CFG0 (0x0248) - #define CDC_WSA_TX1_SPKR_PROT_PATH_CTL (0x0264) - #define CDC_WSA_TX1_SPKR_PROT_PATH_CFG0 (0x0268) -@@ -347,6 +351,7 @@ struct wsa_macro { - int ear_spkr_gain; - int spkr_gain_offset; - int spkr_mode; -+ u32 pcm_rate_vi; - int is_softclip_on[WSA_MACRO_SOFTCLIP_MAX]; - int softclip_clk_users[WSA_MACRO_SOFTCLIP_MAX]; - struct regmap *regmap; -@@ -974,6 +979,7 @@ static int wsa_macro_hw_params(struct snd_pcm_substream *substream, - struct snd_soc_dai *dai) - { - struct snd_soc_component *component = dai->component; -+ struct wsa_macro *wsa = snd_soc_component_get_drvdata(component); - int ret; - - switch (substream->stream) { -@@ -985,6 +991,11 @@ static int wsa_macro_hw_params(struct snd_pcm_substream *substream, - __func__, params_rate(params)); - return ret; - } -+ break; -+ case SNDRV_PCM_STREAM_CAPTURE: -+ if (dai->id == WSA_MACRO_AIF_VI) -+ wsa->pcm_rate_vi = params_rate(params); -+ - break; - default: - break; -@@ -1142,35 +1153,11 @@ static void wsa_macro_mclk_enable(struct wsa_macro *wsa, bool mclk_enable) - } - } - --static int wsa_macro_mclk_event(struct snd_soc_dapm_widget *w, -- struct snd_kcontrol *kcontrol, int event) -+static void wsa_macro_enable_disable_vi_sense(struct snd_soc_component *component, bool enable, -+ u32 tx_reg0, u32 tx_reg1, u32 val) - { -- struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm); -- struct wsa_macro *wsa = snd_soc_component_get_drvdata(component); -- -- wsa_macro_mclk_enable(wsa, event == SND_SOC_DAPM_PRE_PMU); -- return 0; --} -- --static int wsa_macro_enable_vi_feedback(struct snd_soc_dapm_widget *w, -- struct snd_kcontrol *kcontrol, -- int event) --{ -- struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm); -- struct wsa_macro *wsa = snd_soc_component_get_drvdata(component); -- u32 tx_reg0, tx_reg1; -- -- if (test_bit(WSA_MACRO_TX0, &wsa->active_ch_mask[WSA_MACRO_AIF_VI])) { -- tx_reg0 = CDC_WSA_TX0_SPKR_PROT_PATH_CTL; -- tx_reg1 = CDC_WSA_TX1_SPKR_PROT_PATH_CTL; -- } else if (test_bit(WSA_MACRO_TX1, &wsa->active_ch_mask[WSA_MACRO_AIF_VI])) { -- tx_reg0 = CDC_WSA_TX2_SPKR_PROT_PATH_CTL; -- tx_reg1 = CDC_WSA_TX3_SPKR_PROT_PATH_CTL; -- } -- -- switch (event) { -- case SND_SOC_DAPM_POST_PMU: -- /* Enable V&I sensing */ -+ if (enable) { -+ /* Enable V&I sensing */ - snd_soc_component_update_bits(component, tx_reg0, - CDC_WSA_TX_SPKR_PROT_RESET_MASK, - CDC_WSA_TX_SPKR_PROT_RESET); -@@ -1179,10 +1166,10 @@ static int wsa_macro_enable_vi_feedback(struct snd_soc_dapm_widget *w, - CDC_WSA_TX_SPKR_PROT_RESET); - snd_soc_component_update_bits(component, tx_reg0, - CDC_WSA_TX_SPKR_PROT_PCM_RATE_MASK, -- CDC_WSA_TX_SPKR_PROT_PCM_RATE_8K); -+ val); - snd_soc_component_update_bits(component, tx_reg1, - CDC_WSA_TX_SPKR_PROT_PCM_RATE_MASK, -- CDC_WSA_TX_SPKR_PROT_PCM_RATE_8K); -+ val); - snd_soc_component_update_bits(component, tx_reg0, - CDC_WSA_TX_SPKR_PROT_CLK_EN_MASK, - CDC_WSA_TX_SPKR_PROT_CLK_ENABLE); -@@ -1195,9 +1182,7 @@ static int wsa_macro_enable_vi_feedback(struct snd_soc_dapm_widget *w, - snd_soc_component_update_bits(component, tx_reg1, - CDC_WSA_TX_SPKR_PROT_RESET_MASK, - CDC_WSA_TX_SPKR_PROT_NO_RESET); -- break; -- case SND_SOC_DAPM_POST_PMD: -- /* Disable V&I sensing */ -+ } else { - snd_soc_component_update_bits(component, tx_reg0, - CDC_WSA_TX_SPKR_PROT_RESET_MASK, - CDC_WSA_TX_SPKR_PROT_RESET); -@@ -1210,6 +1195,72 @@ static int wsa_macro_enable_vi_feedback(struct snd_soc_dapm_widget *w, - snd_soc_component_update_bits(component, tx_reg1, - CDC_WSA_TX_SPKR_PROT_CLK_EN_MASK, - CDC_WSA_TX_SPKR_PROT_CLK_DISABLE); -+ } -+} -+ -+static void wsa_macro_enable_disable_vi_feedback(struct snd_soc_component *component, -+ bool enable, u32 rate) -+{ -+ struct wsa_macro *wsa = snd_soc_component_get_drvdata(component); -+ -+ if (test_bit(WSA_MACRO_TX0, &wsa->active_ch_mask[WSA_MACRO_AIF_VI])) -+ wsa_macro_enable_disable_vi_sense(component, enable, -+ CDC_WSA_TX0_SPKR_PROT_PATH_CTL, -+ CDC_WSA_TX1_SPKR_PROT_PATH_CTL, rate); -+ -+ if (test_bit(WSA_MACRO_TX1, &wsa->active_ch_mask[WSA_MACRO_AIF_VI])) -+ wsa_macro_enable_disable_vi_sense(component, enable, -+ CDC_WSA_TX2_SPKR_PROT_PATH_CTL, -+ CDC_WSA_TX3_SPKR_PROT_PATH_CTL, rate); -+} -+ -+static int wsa_macro_mclk_event(struct snd_soc_dapm_widget *w, -+ struct snd_kcontrol *kcontrol, int event) -+{ -+ struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm); -+ struct wsa_macro *wsa = snd_soc_component_get_drvdata(component); -+ -+ wsa_macro_mclk_enable(wsa, event == SND_SOC_DAPM_PRE_PMU); -+ return 0; -+} -+ -+static int wsa_macro_enable_vi_feedback(struct snd_soc_dapm_widget *w, -+ struct snd_kcontrol *kcontrol, -+ int event) -+{ -+ struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm); -+ struct wsa_macro *wsa = snd_soc_component_get_drvdata(component); -+ u32 rate_val; -+ -+ switch (wsa->pcm_rate_vi) { -+ case 8000: -+ rate_val = CDC_WSA_TX_SPKR_PROT_PCM_RATE_8K; -+ break; -+ case 16000: -+ rate_val = CDC_WSA_TX_SPKR_PROT_PCM_RATE_16K; -+ break; -+ case 24000: -+ rate_val = CDC_WSA_TX_SPKR_PROT_PCM_RATE_24K; -+ break; -+ case 32000: -+ rate_val = CDC_WSA_TX_SPKR_PROT_PCM_RATE_32K; -+ break; -+ case 48000: -+ rate_val = CDC_WSA_TX_SPKR_PROT_PCM_RATE_48K; -+ break; -+ default: -+ rate_val = CDC_WSA_TX_SPKR_PROT_PCM_RATE_8K; -+ break; -+ } -+ -+ switch (event) { -+ case SND_SOC_DAPM_POST_PMU: -+ /* Enable V&I sensing */ -+ wsa_macro_enable_disable_vi_feedback(component, true, rate_val); -+ break; -+ case SND_SOC_DAPM_POST_PMD: -+ /* Disable V&I sensing */ -+ wsa_macro_enable_disable_vi_feedback(component, false, rate_val); - break; - } - -diff --git a/sound/soc/dwc/dwc-i2s.c b/sound/soc/dwc/dwc-i2s.c -index 9ea4be56d3b709..43edad6c887dcb 100644 ---- a/sound/soc/dwc/dwc-i2s.c -+++ b/sound/soc/dwc/dwc-i2s.c -@@ -199,12 +199,10 @@ static void i2s_start(struct dw_i2s_dev *dev, - else - i2s_write_reg(dev->i2s_base, IRER, 1); - -- /* I2S needs to enable IRQ to make a handshake with DMAC on the JH7110 SoC */ -- if (dev->use_pio || dev->is_jh7110) -- i2s_enable_irqs(dev, substream->stream, config->chan_nr); -- else -+ if (!(dev->use_pio || dev->is_jh7110)) - i2s_enable_dma(dev, substream->stream); - -+ i2s_enable_irqs(dev, substream->stream, config->chan_nr); - i2s_write_reg(dev->i2s_base, CER, 1); - } - -@@ -218,11 +216,12 @@ static void i2s_stop(struct dw_i2s_dev *dev, - else - i2s_write_reg(dev->i2s_base, IRER, 0); - -- if (dev->use_pio || dev->is_jh7110) -- i2s_disable_irqs(dev, substream->stream, 8); -- else -+ if (!(dev->use_pio || dev->is_jh7110)) - i2s_disable_dma(dev, substream->stream); - -+ i2s_disable_irqs(dev, substream->stream, 8); -+ -+ - if (!dev->active) { - i2s_write_reg(dev->i2s_base, CER, 0); - i2s_write_reg(dev->i2s_base, IER, 0); -diff --git a/sound/soc/fsl/fsl_audmix.c b/sound/soc/fsl/fsl_audmix.c -index 0ab2c19621175e..d8e44470f501e7 100644 ---- a/sound/soc/fsl/fsl_audmix.c -+++ b/sound/soc/fsl/fsl_audmix.c -@@ -492,11 +492,17 @@ static int fsl_audmix_probe(struct platform_device *pdev) - goto err_disable_pm; - } - -- priv->pdev = platform_device_register_data(dev, "imx-audmix", 0, NULL, 0); -- if (IS_ERR(priv->pdev)) { -- ret = PTR_ERR(priv->pdev); -- dev_err(dev, "failed to register platform: %d\n", ret); -- goto err_disable_pm; -+ /* -+ * If dais property exist, then register the imx-audmix card driver. -+ * otherwise, it should be linked by audio graph card. -+ */ -+ if (of_find_property(pdev->dev.of_node, "dais", NULL)) { -+ priv->pdev = platform_device_register_data(dev, "imx-audmix", 0, NULL, 0); -+ if (IS_ERR(priv->pdev)) { -+ ret = PTR_ERR(priv->pdev); -+ dev_err(dev, "failed to register platform: %d\n", ret); -+ goto err_disable_pm; -+ } - } - - return 0; -diff --git a/sound/soc/intel/avs/pcm.c b/sound/soc/intel/avs/pcm.c -index bb1e77ac78e047..781019685b941f 100644 ---- a/sound/soc/intel/avs/pcm.c -+++ b/sound/soc/intel/avs/pcm.c -@@ -808,7 +808,8 @@ static int avs_component_probe(struct snd_soc_component *component) - else - mach->tplg_filename = devm_kasprintf(adev->dev, GFP_KERNEL, - "hda-generic-tplg.bin"); -- -+ if (!mach->tplg_filename) -+ return -ENOMEM; - filename = kasprintf(GFP_KERNEL, "%s/%s", component->driver->topology_name_prefix, - mach->tplg_filename); - if (!filename) -diff --git a/sound/soc/qcom/lpass.h b/sound/soc/qcom/lpass.h -index bdfe66ec3314f9..ea12f02eca55f6 100644 ---- a/sound/soc/qcom/lpass.h -+++ b/sound/soc/qcom/lpass.h -@@ -13,10 +13,11 @@ - #include - #include - #include -+#include - #include "lpass-hdmi.h" - - #define LPASS_AHBIX_CLOCK_FREQUENCY 131072000 --#define LPASS_MAX_PORTS (LPASS_CDC_DMA_VA_TX8 + 1) -+#define LPASS_MAX_PORTS (DISPLAY_PORT_RX_7 + 1) - #define LPASS_MAX_MI2S_PORTS (8) - #define LPASS_MAX_DMA_CHANNELS (8) - #define LPASS_MAX_HDMI_DMA_CHANNELS (4) -diff --git a/sound/soc/qcom/qdsp6/q6apm-dai.c b/sound/soc/qcom/qdsp6/q6apm-dai.c -index 739856a00017c5..def05ce58d176e 100644 ---- a/sound/soc/qcom/qdsp6/q6apm-dai.c -+++ b/sound/soc/qcom/qdsp6/q6apm-dai.c -@@ -24,8 +24,8 @@ - #define PLAYBACK_MIN_PERIOD_SIZE 128 - #define CAPTURE_MIN_NUM_PERIODS 2 - #define CAPTURE_MAX_NUM_PERIODS 8 --#define CAPTURE_MAX_PERIOD_SIZE 4096 --#define CAPTURE_MIN_PERIOD_SIZE 320 -+#define CAPTURE_MAX_PERIOD_SIZE 65536 -+#define CAPTURE_MIN_PERIOD_SIZE 6144 - #define BUFFER_BYTES_MAX (PLAYBACK_MAX_NUM_PERIODS * PLAYBACK_MAX_PERIOD_SIZE) - #define BUFFER_BYTES_MIN (PLAYBACK_MIN_NUM_PERIODS * PLAYBACK_MIN_PERIOD_SIZE) - #define COMPR_PLAYBACK_MAX_FRAGMENT_SIZE (128 * 1024) -@@ -380,13 +380,14 @@ static int q6apm_dai_open(struct snd_soc_component *component, - } - } - -- ret = snd_pcm_hw_constraint_step(runtime, 0, SNDRV_PCM_HW_PARAM_PERIOD_BYTES, 32); -+ /* setup 10ms latency to accommodate DSP restrictions */ -+ ret = snd_pcm_hw_constraint_step(runtime, 0, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, 480); - if (ret < 0) { - dev_err(dev, "constraint for period bytes step ret = %d\n", ret); - goto err; - } - -- ret = snd_pcm_hw_constraint_step(runtime, 0, SNDRV_PCM_HW_PARAM_BUFFER_BYTES, 32); -+ ret = snd_pcm_hw_constraint_step(runtime, 0, SNDRV_PCM_HW_PARAM_BUFFER_SIZE, 480); - if (ret < 0) { - dev_err(dev, "constraint for buffer bytes step ret = %d\n", ret); - goto err; -diff --git a/sound/soc/qcom/qdsp6/q6apm.c b/sound/soc/qcom/qdsp6/q6apm.c -index 2a2a5bd98110bc..ca57413cb7847a 100644 ---- a/sound/soc/qcom/qdsp6/q6apm.c -+++ b/sound/soc/qcom/qdsp6/q6apm.c -@@ -494,6 +494,19 @@ int q6apm_read(struct q6apm_graph *graph) - } - EXPORT_SYMBOL_GPL(q6apm_read); - -+int q6apm_get_hw_pointer(struct q6apm_graph *graph, int dir) -+{ -+ struct audioreach_graph_data *data; -+ -+ if (dir == SNDRV_PCM_STREAM_PLAYBACK) -+ data = &graph->rx_data; -+ else -+ data = &graph->tx_data; -+ -+ return (int)atomic_read(&data->hw_ptr); -+} -+EXPORT_SYMBOL_GPL(q6apm_get_hw_pointer); -+ - static int graph_callback(struct gpr_resp_pkt *data, void *priv, int op) - { - struct data_cmd_rsp_rd_sh_mem_ep_data_buffer_done_v2 *rd_done; -@@ -520,7 +533,8 @@ static int graph_callback(struct gpr_resp_pkt *data, void *priv, int op) - done = data->payload; - phys = graph->rx_data.buf[token].phys; - mutex_unlock(&graph->lock); -- -+ /* token numbering starts at 0 */ -+ atomic_set(&graph->rx_data.hw_ptr, token + 1); - if (lower_32_bits(phys) == done->buf_addr_lsw && - upper_32_bits(phys) == done->buf_addr_msw) { - graph->result.opcode = hdr->opcode; -@@ -553,6 +567,8 @@ static int graph_callback(struct gpr_resp_pkt *data, void *priv, int op) - rd_done = data->payload; - phys = graph->tx_data.buf[hdr->token].phys; - mutex_unlock(&graph->lock); -+ /* token numbering starts at 0 */ -+ atomic_set(&graph->tx_data.hw_ptr, hdr->token + 1); - - if (upper_32_bits(phys) == rd_done->buf_addr_msw && - lower_32_bits(phys) == rd_done->buf_addr_lsw) { -diff --git a/sound/soc/qcom/qdsp6/q6apm.h b/sound/soc/qcom/qdsp6/q6apm.h -index f486bd639b9f0d..74fa4fed881bf9 100644 ---- a/sound/soc/qcom/qdsp6/q6apm.h -+++ b/sound/soc/qcom/qdsp6/q6apm.h -@@ -2,6 +2,7 @@ - #ifndef __Q6APM_H__ - #define __Q6APM_H__ - #include -+#include - #include - #include - #include -@@ -78,6 +79,7 @@ struct audioreach_graph_data { - uint32_t num_periods; - uint32_t dsp_buf; - uint32_t mem_map_handle; -+ atomic_t hw_ptr; - }; - - struct audioreach_graph { -@@ -151,4 +153,5 @@ int q6apm_enable_compress_module(struct device *dev, struct q6apm_graph *graph, - int q6apm_remove_initial_silence(struct device *dev, struct q6apm_graph *graph, uint32_t samples); - int q6apm_remove_trailing_silence(struct device *dev, struct q6apm_graph *graph, uint32_t samples); - int q6apm_set_real_module_id(struct device *dev, struct q6apm_graph *graph, uint32_t codec_id); -+int q6apm_get_hw_pointer(struct q6apm_graph *graph, int dir); - #endif /* __APM_GRAPH_ */ -diff --git a/sound/soc/qcom/qdsp6/q6asm-dai.c b/sound/soc/qcom/qdsp6/q6asm-dai.c -index 5e14cd0a38deb6..82ef8fdb914e3b 100644 ---- a/sound/soc/qcom/qdsp6/q6asm-dai.c -+++ b/sound/soc/qcom/qdsp6/q6asm-dai.c -@@ -902,9 +902,7 @@ static int q6asm_dai_compr_set_params(struct snd_soc_component *component, - - if (ret < 0) { - dev_err(dev, "q6asm_open_write failed\n"); -- q6asm_audio_client_free(prtd->audio_client); -- prtd->audio_client = NULL; -- return ret; -+ goto open_err; - } - } - -@@ -913,7 +911,7 @@ static int q6asm_dai_compr_set_params(struct snd_soc_component *component, - prtd->session_id, dir); - if (ret) { - dev_err(dev, "Stream reg failed ret:%d\n", ret); -- return ret; -+ goto q6_err; - } - - ret = __q6asm_dai_compr_set_codec_params(component, stream, -@@ -921,7 +919,7 @@ static int q6asm_dai_compr_set_params(struct snd_soc_component *component, - prtd->stream_id); - if (ret) { - dev_err(dev, "codec param setup failed ret:%d\n", ret); -- return ret; -+ goto q6_err; - } - - ret = q6asm_map_memory_regions(dir, prtd->audio_client, prtd->phys, -@@ -930,12 +928,21 @@ static int q6asm_dai_compr_set_params(struct snd_soc_component *component, - - if (ret < 0) { - dev_err(dev, "Buffer Mapping failed ret:%d\n", ret); -- return -ENOMEM; -+ ret = -ENOMEM; -+ goto q6_err; - } - - prtd->state = Q6ASM_STREAM_RUNNING; - - return 0; -+ -+q6_err: -+ q6asm_cmd(prtd->audio_client, prtd->stream_id, CMD_CLOSE); -+ -+open_err: -+ q6asm_audio_client_free(prtd->audio_client); -+ prtd->audio_client = NULL; -+ return ret; - } - - static int q6asm_dai_compr_set_metadata(struct snd_soc_component *component, -diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c -index cf1e63daad86bf..7afded323150c8 100644 ---- a/sound/soc/sof/topology.c -+++ b/sound/soc/sof/topology.c -@@ -1267,8 +1267,8 @@ static int sof_widget_parse_tokens(struct snd_soc_component *scomp, struct snd_s - struct snd_sof_tuple *new_tuples; - - num_tuples += token_list[object_token_list[i]].count * (num_sets - 1); -- new_tuples = krealloc(swidget->tuples, -- sizeof(*new_tuples) * num_tuples, GFP_KERNEL); -+ new_tuples = krealloc_array(swidget->tuples, -+ num_tuples, sizeof(*new_tuples), GFP_KERNEL); - if (!new_tuples) { - ret = -ENOMEM; - goto err; -diff --git a/sound/usb/midi.c b/sound/usb/midi.c -index 6d861046b582b5..3059f814eb5c2d 100644 ---- a/sound/usb/midi.c -+++ b/sound/usb/midi.c -@@ -489,16 +489,84 @@ static void ch345_broken_sysex_input(struct snd_usb_midi_in_endpoint *ep, - - /* - * CME protocol: like the standard protocol, but SysEx commands are sent as a -- * single USB packet preceded by a 0x0F byte. -+ * single USB packet preceded by a 0x0F byte, as are system realtime -+ * messages and MIDI Active Sensing. -+ * Also, multiple messages can be sent in the same packet. - */ - static void snd_usbmidi_cme_input(struct snd_usb_midi_in_endpoint *ep, - uint8_t *buffer, int buffer_length) - { -- if (buffer_length < 2 || (buffer[0] & 0x0f) != 0x0f) -- snd_usbmidi_standard_input(ep, buffer, buffer_length); -- else -- snd_usbmidi_input_data(ep, buffer[0] >> 4, -- &buffer[1], buffer_length - 1); -+ int remaining = buffer_length; -+ -+ /* -+ * CME send sysex, song position pointer, system realtime -+ * and active sensing using CIN 0x0f, which in the standard -+ * is only intended for single byte unparsed data. -+ * So we need to interpret these here before sending them on. -+ * By default, we assume single byte data, which is true -+ * for system realtime (midi clock, start, stop and continue) -+ * and active sensing, and handle the other (known) cases -+ * separately. -+ * In contrast to the standard, CME does not split sysex -+ * into multiple 4-byte packets, but lumps everything together -+ * into one. In addition, CME can string multiple messages -+ * together in the same packet; pressing the Record button -+ * on an UF6 sends a sysex message directly followed -+ * by a song position pointer in the same packet. -+ * For it to have any reasonable meaning, a sysex message -+ * needs to be at least 3 bytes in length (0xf0, id, 0xf7), -+ * corresponding to a packet size of 4 bytes, and the ones sent -+ * by CME devices are 6 or 7 bytes, making the packet fragments -+ * 7 or 8 bytes long (six or seven bytes plus preceding CN+CIN byte). -+ * For the other types, the packet size is always 4 bytes, -+ * as per the standard, with the data size being 3 for SPP -+ * and 1 for the others. -+ * Thus all packet fragments are at least 4 bytes long, so we can -+ * skip anything that is shorter; this also conveniantly skips -+ * packets with size 0, which CME devices continuously send when -+ * they have nothing better to do. -+ * Another quirk is that sometimes multiple messages are sent -+ * in the same packet. This has been observed for midi clock -+ * and active sensing i.e. 0x0f 0xf8 0x00 0x00 0x0f 0xfe 0x00 0x00, -+ * but also multiple note ons/offs, and control change together -+ * with MIDI clock. Similarly, some sysex messages are followed by -+ * the song position pointer in the same packet, and occasionally -+ * additionally by a midi clock or active sensing. -+ * We handle this by looping over all data and parsing it along the way. -+ */ -+ while (remaining >= 4) { -+ int source_length = 4; /* default */ -+ -+ if ((buffer[0] & 0x0f) == 0x0f) { -+ int data_length = 1; /* default */ -+ -+ if (buffer[1] == 0xf0) { -+ /* Sysex: Find EOX and send on whole message. */ -+ /* To kick off the search, skip the first -+ * two bytes (CN+CIN and SYSEX (0xf0). -+ */ -+ uint8_t *tmp_buf = buffer + 2; -+ int tmp_length = remaining - 2; -+ -+ while (tmp_length > 1 && *tmp_buf != 0xf7) { -+ tmp_buf++; -+ tmp_length--; -+ } -+ data_length = tmp_buf - buffer; -+ source_length = data_length + 1; -+ } else if (buffer[1] == 0xf2) { -+ /* Three byte song position pointer */ -+ data_length = 3; -+ } -+ snd_usbmidi_input_data(ep, buffer[0] >> 4, -+ &buffer[1], data_length); -+ } else { -+ /* normal channel events */ -+ snd_usbmidi_standard_input(ep, buffer, source_length); -+ } -+ buffer += source_length; -+ remaining -= source_length; -+ } - } - - /* -diff --git a/tools/objtool/check.c b/tools/objtool/check.c -index 9102ad5985cc0f..8ba5bcfd5cd572 100644 ---- a/tools/objtool/check.c -+++ b/tools/objtool/check.c -@@ -3926,6 +3926,11 @@ static int validate_unret(struct objtool_file *file, struct instruction *insn) - WARN_INSN(insn, "RET before UNTRAIN"); - return 1; - -+ case INSN_CONTEXT_SWITCH: -+ if (insn_func(insn)) -+ break; -+ return 0; -+ - case INSN_NOP: - if (insn->retpoline_safe) - return 0; -diff --git a/tools/power/cpupower/bench/parse.c b/tools/power/cpupower/bench/parse.c -index e63dc11fa3a533..48e25be6e16356 100644 ---- a/tools/power/cpupower/bench/parse.c -+++ b/tools/power/cpupower/bench/parse.c -@@ -120,6 +120,10 @@ FILE *prepare_output(const char *dirname) - struct config *prepare_default_config() - { - struct config *config = malloc(sizeof(struct config)); -+ if (!config) { -+ perror("malloc"); -+ return NULL; -+ } - - dprintf("loading defaults\n"); - -diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl -index 83d65c2abaf010..3316015757433a 100755 ---- a/tools/testing/ktest/ktest.pl -+++ b/tools/testing/ktest/ktest.pl -@@ -4289,6 +4289,14 @@ if (defined($opt{"LOG_FILE"})) { - if ($opt{"CLEAR_LOG"}) { - unlink $opt{"LOG_FILE"}; - } -+ -+ if (! -e $opt{"LOG_FILE"} && $opt{"LOG_FILE"} =~ m,^(.*/),) { -+ my $dir = $1; -+ if (! -d $dir) { -+ mkpath($dir) or die "Failed to create directories '$dir': $!"; -+ print "\nThe log directory $dir did not exist, so it was created.\n"; -+ } -+ } - open(LOG, ">> $opt{LOG_FILE}") or die "Can't write to $opt{LOG_FILE}"; - LOG->autoflush(1); - } -diff --git a/tools/testing/kunit/qemu_configs/sh.py b/tools/testing/kunit/qemu_configs/sh.py -index 78a474a5b95f3a..f00cb89fdef6aa 100644 ---- a/tools/testing/kunit/qemu_configs/sh.py -+++ b/tools/testing/kunit/qemu_configs/sh.py -@@ -7,7 +7,9 @@ CONFIG_CPU_SUBTYPE_SH7751R=y - CONFIG_MEMORY_START=0x0c000000 - CONFIG_SH_RTS7751R2D=y - CONFIG_RTS7751R2D_PLUS=y --CONFIG_SERIAL_SH_SCI=y''', -+CONFIG_SERIAL_SH_SCI=y -+CONFIG_CMDLINE_EXTEND=y -+''', - qemu_arch='sh4', - kernel_path='arch/sh/boot/zImage', - kernel_command_line='console=ttySC1', -diff --git a/tools/testing/radix-tree/linux.c b/tools/testing/radix-tree/linux.c -index d587a558997f8c..11149bd12a1f79 100644 ---- a/tools/testing/radix-tree/linux.c -+++ b/tools/testing/radix-tree/linux.c -@@ -121,7 +121,7 @@ void kmem_cache_free(struct kmem_cache *cachep, void *objp) - void kmem_cache_free_bulk(struct kmem_cache *cachep, size_t size, void **list) - { - if (kmalloc_verbose) -- pr_debug("Bulk free %p[0-%lu]\n", list, size - 1); -+ pr_debug("Bulk free %p[0-%zu]\n", list, size - 1); - - pthread_mutex_lock(&cachep->lock); - for (int i = 0; i < size; i++) -@@ -139,7 +139,7 @@ int kmem_cache_alloc_bulk(struct kmem_cache *cachep, gfp_t gfp, size_t size, - size_t i; - - if (kmalloc_verbose) -- pr_debug("Bulk alloc %lu\n", size); -+ pr_debug("Bulk alloc %zu\n", size); - - if (!(gfp & __GFP_DIRECT_RECLAIM)) { - if (cachep->non_kernel < size) -diff --git a/tools/testing/selftests/futex/functional/futex_wait_wouldblock.c b/tools/testing/selftests/futex/functional/futex_wait_wouldblock.c -index 7d7a6a06cdb75b..2d8230da906429 100644 ---- a/tools/testing/selftests/futex/functional/futex_wait_wouldblock.c -+++ b/tools/testing/selftests/futex/functional/futex_wait_wouldblock.c -@@ -98,7 +98,7 @@ int main(int argc, char *argv[]) - info("Calling futex_waitv on f1: %u @ %p with val=%u\n", f1, &f1, f1+1); - res = futex_waitv(&waitv, 1, 0, &to, CLOCK_MONOTONIC); - if (!res || errno != EWOULDBLOCK) { -- ksft_test_result_pass("futex_waitv returned: %d %s\n", -+ ksft_test_result_fail("futex_waitv returned: %d %s\n", - res ? errno : res, - res ? strerror(errno) : ""); - ret = RET_FAIL; -diff --git a/tools/testing/selftests/landlock/base_test.c b/tools/testing/selftests/landlock/base_test.c -index 5aa7d2feab100d..b06410bd1aa14e 100644 ---- a/tools/testing/selftests/landlock/base_test.c -+++ b/tools/testing/selftests/landlock/base_test.c -@@ -98,10 +98,54 @@ TEST(abi_version) - ASSERT_EQ(EINVAL, errno); - } - -+/* -+ * Old source trees might not have the set of Kselftest fixes related to kernel -+ * UAPI headers. -+ */ -+#ifndef LANDLOCK_CREATE_RULESET_ERRATA -+#define LANDLOCK_CREATE_RULESET_ERRATA (1U << 1) -+#endif -+ -+TEST(errata) -+{ -+ const struct landlock_ruleset_attr ruleset_attr = { -+ .handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE, -+ }; -+ int errata; -+ -+ errata = landlock_create_ruleset(NULL, 0, -+ LANDLOCK_CREATE_RULESET_ERRATA); -+ /* The errata bitmask will not be backported to tests. */ -+ ASSERT_LE(0, errata); -+ TH_LOG("errata: 0x%x", errata); -+ -+ ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, 0, -+ LANDLOCK_CREATE_RULESET_ERRATA)); -+ ASSERT_EQ(EINVAL, errno); -+ -+ ASSERT_EQ(-1, landlock_create_ruleset(NULL, sizeof(ruleset_attr), -+ LANDLOCK_CREATE_RULESET_ERRATA)); -+ ASSERT_EQ(EINVAL, errno); -+ -+ ASSERT_EQ(-1, -+ landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), -+ LANDLOCK_CREATE_RULESET_ERRATA)); -+ ASSERT_EQ(EINVAL, errno); -+ -+ ASSERT_EQ(-1, landlock_create_ruleset( -+ NULL, 0, -+ LANDLOCK_CREATE_RULESET_VERSION | -+ LANDLOCK_CREATE_RULESET_ERRATA)); -+ ASSERT_EQ(-1, landlock_create_ruleset(NULL, 0, -+ LANDLOCK_CREATE_RULESET_ERRATA | -+ 1 << 31)); -+ ASSERT_EQ(EINVAL, errno); -+} -+ - /* Tests ordering of syscall argument checks. */ - TEST(create_ruleset_checks_ordering) - { -- const int last_flag = LANDLOCK_CREATE_RULESET_VERSION; -+ const int last_flag = LANDLOCK_CREATE_RULESET_ERRATA; - const int invalid_flag = last_flag << 1; - int ruleset_fd; - const struct landlock_ruleset_attr ruleset_attr = { -diff --git a/tools/testing/selftests/mm/charge_reserved_hugetlb.sh b/tools/testing/selftests/mm/charge_reserved_hugetlb.sh -index 8e00276b4e69be..dc3fc438b3d9e1 100755 ---- a/tools/testing/selftests/mm/charge_reserved_hugetlb.sh -+++ b/tools/testing/selftests/mm/charge_reserved_hugetlb.sh -@@ -27,7 +27,7 @@ fi - if [[ $cgroup2 ]]; then - cgroup_path=$(mount -t cgroup2 | head -1 | awk '{print $3}') - if [[ -z "$cgroup_path" ]]; then -- cgroup_path=/dev/cgroup/memory -+ cgroup_path=$(mktemp -d) - mount -t cgroup2 none $cgroup_path - do_umount=1 - fi -@@ -35,7 +35,7 @@ if [[ $cgroup2 ]]; then - else - cgroup_path=$(mount -t cgroup | grep ",hugetlb" | awk '{print $3}') - if [[ -z "$cgroup_path" ]]; then -- cgroup_path=/dev/cgroup/memory -+ cgroup_path=$(mktemp -d) - mount -t cgroup memory,hugetlb $cgroup_path - do_umount=1 - fi -diff --git a/tools/testing/selftests/mm/hugetlb_reparenting_test.sh b/tools/testing/selftests/mm/hugetlb_reparenting_test.sh -index 14d26075c8635f..302f2c7003f034 100755 ---- a/tools/testing/selftests/mm/hugetlb_reparenting_test.sh -+++ b/tools/testing/selftests/mm/hugetlb_reparenting_test.sh -@@ -22,7 +22,7 @@ fi - if [[ $cgroup2 ]]; then - CGROUP_ROOT=$(mount -t cgroup2 | head -1 | awk '{print $3}') - if [[ -z "$CGROUP_ROOT" ]]; then -- CGROUP_ROOT=/dev/cgroup/memory -+ CGROUP_ROOT=$(mktemp -d) - mount -t cgroup2 none $CGROUP_ROOT - do_umount=1 - fi -diff --git a/tools/testing/selftests/net/mptcp/diag.sh b/tools/testing/selftests/net/mptcp/diag.sh -index 7f89623f1080e1..f00c97b2a6b5f6 100755 ---- a/tools/testing/selftests/net/mptcp/diag.sh -+++ b/tools/testing/selftests/net/mptcp/diag.sh -@@ -186,23 +186,6 @@ chk_msk_inuse() - __chk_nr get_msk_inuse $expected "${msg}" 0 - } - --# $1: ns, $2: port --wait_local_port_listen() --{ -- local listener_ns="${1}" -- local port="${2}" -- -- local port_hex i -- -- port_hex="$(printf "%04X" "${port}")" -- for i in $(seq 10); do -- ip netns exec "${listener_ns}" cat /proc/net/tcp | \ -- awk "BEGIN {rc=1} {if (\$2 ~ /:${port_hex}\$/ && \$4 ~ /0A/) {rc=0; exit}} END {exit rc}" && -- break -- sleep 0.1 -- done --} -- - # $1: cestab nr - chk_msk_cestab() - { -@@ -240,7 +223,7 @@ echo "a" | \ - ip netns exec $ns \ - ./mptcp_connect -p 10000 -l -t ${timeout_poll} -w 20 \ - 0.0.0.0 >/dev/null & --wait_local_port_listen $ns 10000 -+mptcp_lib_wait_local_port_listen $ns 10000 - chk_msk_nr 0 "no msk on netns creation" - chk_msk_listen 10000 - -@@ -265,7 +248,7 @@ echo "a" | \ - ip netns exec $ns \ - ./mptcp_connect -p 10001 -l -s TCP -t ${timeout_poll} -w 20 \ - 0.0.0.0 >/dev/null & --wait_local_port_listen $ns 10001 -+mptcp_lib_wait_local_port_listen $ns 10001 - echo "b" | \ - timeout ${timeout_test} \ - ip netns exec $ns \ -@@ -288,7 +271,7 @@ for I in `seq 1 $NR_CLIENTS`; do - ./mptcp_connect -p $((I+10001)) -l -w 20 \ - -t ${timeout_poll} 0.0.0.0 >/dev/null & - done --wait_local_port_listen $ns $((NR_CLIENTS + 10001)) -+mptcp_lib_wait_local_port_listen $ns $((NR_CLIENTS + 10001)) - - for I in `seq 1 $NR_CLIENTS`; do - echo "b" | \ -diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.c b/tools/testing/selftests/net/mptcp/mptcp_connect.c -index d240d02fa443a1..c83a8b47bbdfa5 100644 ---- a/tools/testing/selftests/net/mptcp/mptcp_connect.c -+++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c -@@ -1270,7 +1270,7 @@ int main_loop(void) - - if (cfg_input && cfg_sockopt_types.mptfo) { - fd_in = open(cfg_input, O_RDONLY); -- if (fd < 0) -+ if (fd_in < 0) - xerror("can't open %s:%d", cfg_input, errno); - } - -@@ -1293,13 +1293,13 @@ int main_loop(void) - - if (cfg_input && !cfg_sockopt_types.mptfo) { - fd_in = open(cfg_input, O_RDONLY); -- if (fd < 0) -+ if (fd_in < 0) - xerror("can't open %s:%d", cfg_input, errno); - } - - ret = copyfd_io(fd_in, fd, 1, 0, &winfo); - if (ret) -- return ret; -+ goto out; - - if (cfg_truncate > 0) { - shutdown(fd, SHUT_WR); -@@ -1320,7 +1320,10 @@ int main_loop(void) - close(fd); - } - -- return 0; -+out: -+ if (cfg_input) -+ close(fd_in); -+ return ret; - } - - int parse_proto(const char *proto) -diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.sh b/tools/testing/selftests/net/mptcp/mptcp_connect.sh -index d203d314b7b265..3763ffa214d53f 100755 ---- a/tools/testing/selftests/net/mptcp/mptcp_connect.sh -+++ b/tools/testing/selftests/net/mptcp/mptcp_connect.sh -@@ -342,23 +342,6 @@ do_ping() - return 0 - } - --# $1: ns, $2: port --wait_local_port_listen() --{ -- local listener_ns="${1}" -- local port="${2}" -- -- local port_hex i -- -- port_hex="$(printf "%04X" "${port}")" -- for i in $(seq 10); do -- ip netns exec "${listener_ns}" cat /proc/net/tcp* | \ -- awk "BEGIN {rc=1} {if (\$2 ~ /:${port_hex}\$/ && \$4 ~ /0A/) {rc=0; exit}} END {exit rc}" && -- break -- sleep 0.1 -- done --} -- - do_transfer() - { - local listener_ns="$1" -@@ -448,7 +431,7 @@ do_transfer() - $extra_args $local_addr < "$sin" > "$sout" & - local spid=$! - -- wait_local_port_listen "${listener_ns}" "${port}" -+ mptcp_lib_wait_local_port_listen "${listener_ns}" "${port}" - - local start - start=$(date +%s%3N) -diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh -index 497dc187387f8d..442b7220468afc 100755 ---- a/tools/testing/selftests/net/mptcp/mptcp_join.sh -+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh -@@ -598,24 +598,6 @@ link_failure() - done - } - --# $1: ns, $2: port --wait_local_port_listen() --{ -- local listener_ns="${1}" -- local port="${2}" -- -- local port_hex -- port_hex="$(printf "%04X" "${port}")" -- -- local i -- for i in $(seq 10); do -- ip netns exec "${listener_ns}" cat /proc/net/tcp* | \ -- awk "BEGIN {rc=1} {if (\$2 ~ /:${port_hex}\$/ && \$4 ~ /0A/) {rc=0; exit}} END {exit rc}" && -- break -- sleep 0.1 -- done --} -- - rm_addr_count() - { - mptcp_lib_get_counter "${1}" "MPTcpExtRmAddr" -@@ -1117,7 +1099,7 @@ do_transfer() - fi - local spid=$! - -- wait_local_port_listen "${listener_ns}" "${port}" -+ mptcp_lib_wait_local_port_listen "${listener_ns}" "${port}" - - extra_cl_args="$extra_args $extra_cl_args" - if [ "$test_linkfail" -eq 0 ];then -diff --git a/tools/testing/selftests/net/mptcp/mptcp_lib.sh b/tools/testing/selftests/net/mptcp/mptcp_lib.sh -index d98c89f31afe8a..919f4f1018eb71 100644 ---- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh -+++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh -@@ -274,3 +274,21 @@ mptcp_lib_events() { - ip netns exec "${ns}" ./pm_nl_ctl events >> "${evts}" 2>&1 & - pid=$! - } -+ -+# $1: ns, $2: port -+mptcp_lib_wait_local_port_listen() { -+ local listener_ns="${1}" -+ local port="${2}" -+ -+ local port_hex -+ port_hex="$(printf "%04X" "${port}")" -+ -+ local _ -+ for _ in $(seq 10); do -+ ip netns exec "${listener_ns}" cat /proc/net/tcp* | \ -+ awk "BEGIN {rc=1} {if (\$2 ~ /:${port_hex}\$/ && \$4 ~ /0A/) \ -+ {rc=0; exit}} END {exit rc}" && -+ break -+ sleep 0.1 -+ done -+} -diff --git a/tools/testing/selftests/net/mptcp/simult_flows.sh b/tools/testing/selftests/net/mptcp/simult_flows.sh -index f24bd2bf083111..214a89fce8b803 100755 ---- a/tools/testing/selftests/net/mptcp/simult_flows.sh -+++ b/tools/testing/selftests/net/mptcp/simult_flows.sh -@@ -123,23 +123,6 @@ setup() - grep -q ' kmemleak_init$\| lockdep_init$\| kasan_init$\| prove_locking$' /proc/kallsyms && slack=$((slack+550)) - } - --# $1: ns, $2: port --wait_local_port_listen() --{ -- local listener_ns="${1}" -- local port="${2}" -- -- local port_hex i -- -- port_hex="$(printf "%04X" "${port}")" -- for i in $(seq 10); do -- ip netns exec "${listener_ns}" cat /proc/net/tcp* | \ -- awk "BEGIN {rc=1} {if (\$2 ~ /:${port_hex}\$/ && \$4 ~ /0A/) {rc=0; exit}} END {exit rc}" && -- break -- sleep 0.1 -- done --} -- - do_transfer() - { - local cin=$1 -@@ -179,7 +162,7 @@ do_transfer() - 0.0.0.0 < "$sin" > "$sout" & - local spid=$! - -- wait_local_port_listen "${ns3}" "${port}" -+ mptcp_lib_wait_local_port_listen "${ns3}" "${port}" - - timeout ${timeout_test} \ - ip netns exec ${ns1} \ diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.088-089.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.088-089.patch deleted file mode 100644 index 56b336c431..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.088-089.patch +++ /dev/null @@ -1,6884 +0,0 @@ -diff --git a/Documentation/scheduler/sched-capacity.rst b/Documentation/scheduler/sched-capacity.rst -index e2c1cf7431588e..de414b33dd2abd 100644 ---- a/Documentation/scheduler/sched-capacity.rst -+++ b/Documentation/scheduler/sched-capacity.rst -@@ -39,14 +39,15 @@ per Hz, leading to:: - ------------------- - - Two different capacity values are used within the scheduler. A CPU's --``capacity_orig`` is its maximum attainable capacity, i.e. its maximum --attainable performance level. A CPU's ``capacity`` is its ``capacity_orig`` to --which some loss of available performance (e.g. time spent handling IRQs) is --subtracted. -+``original capacity`` is its maximum attainable capacity, i.e. its maximum -+attainable performance level. This original capacity is returned by -+the function arch_scale_cpu_capacity(). A CPU's ``capacity`` is its ``original -+capacity`` to which some loss of available performance (e.g. time spent -+handling IRQs) is subtracted. - - Note that a CPU's ``capacity`` is solely intended to be used by the CFS class, --while ``capacity_orig`` is class-agnostic. The rest of this document will use --the term ``capacity`` interchangeably with ``capacity_orig`` for the sake of -+while ``original capacity`` is class-agnostic. The rest of this document will use -+the term ``capacity`` interchangeably with ``original capacity`` for the sake of - brevity. - - 1.3 Platform examples -diff --git a/Makefile b/Makefile -index b1dfe3df7dfc9d..23e90df5785c84 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 88 -+SUBLEVEL = 89 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm64/boot/dts/nvidia/tegra234-p3768-0000.dtsi b/arch/arm64/boot/dts/nvidia/tegra234-p3768-0000.dtsi -index 39110c1232e0da..db10b4b46cca9d 100644 ---- a/arch/arm64/boot/dts/nvidia/tegra234-p3768-0000.dtsi -+++ b/arch/arm64/boot/dts/nvidia/tegra234-p3768-0000.dtsi -@@ -196,13 +196,6 @@ key-power { - wakeup-event-action = ; - wakeup-source; - }; -- -- key-suspend { -- label = "Suspend"; -- gpios = <&gpio TEGRA234_MAIN_GPIO(G, 2) GPIO_ACTIVE_LOW>; -- linux,input-type = ; -- linux,code = ; -- }; - }; - - fan: pwm-fan { -diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig -index 623cf80639decc..25aa993abebcea 100644 ---- a/arch/loongarch/Kconfig -+++ b/arch/loongarch/Kconfig -@@ -59,6 +59,7 @@ config LOONGARCH - select ARCH_SUPPORTS_NUMA_BALANCING - select ARCH_USE_BUILTIN_BSWAP - select ARCH_USE_CMPXCHG_LOCKREF -+ select ARCH_USE_MEMTEST - select ARCH_USE_QUEUED_RWLOCKS - select ARCH_USE_QUEUED_SPINLOCKS - select ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT -diff --git a/arch/loongarch/include/asm/ptrace.h b/arch/loongarch/include/asm/ptrace.h -index f3ddaed9ef7f08..a5b63c84f8541a 100644 ---- a/arch/loongarch/include/asm/ptrace.h -+++ b/arch/loongarch/include/asm/ptrace.h -@@ -33,9 +33,9 @@ struct pt_regs { - unsigned long __last[]; - } __aligned(8); - --static inline int regs_irqs_disabled(struct pt_regs *regs) -+static __always_inline bool regs_irqs_disabled(struct pt_regs *regs) - { -- return arch_irqs_disabled_flags(regs->csr_prmd); -+ return !(regs->csr_prmd & CSR_PRMD_PIE); - } - - static inline unsigned long kernel_stack_pointer(struct pt_regs *regs) -diff --git a/arch/loongarch/kernel/traps.c b/arch/loongarch/kernel/traps.c -index d59052c03d9b7e..2b4b99b4e6c94e 100644 ---- a/arch/loongarch/kernel/traps.c -+++ b/arch/loongarch/kernel/traps.c -@@ -527,9 +527,10 @@ asmlinkage void noinstr do_ale(struct pt_regs *regs) - die_if_kernel("Kernel ale access", regs); - force_sig_fault(SIGBUS, BUS_ADRALN, (void __user *)regs->csr_badvaddr); - #else -+ bool pie = regs_irqs_disabled(regs); - unsigned int *pc; - -- if (regs->csr_prmd & CSR_PRMD_PIE) -+ if (!pie) - local_irq_enable(); - - perf_sw_event(PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, regs, regs->csr_badvaddr); -@@ -556,7 +557,7 @@ asmlinkage void noinstr do_ale(struct pt_regs *regs) - die_if_kernel("Kernel ale access", regs); - force_sig_fault(SIGBUS, BUS_ADRALN, (void __user *)regs->csr_badvaddr); - out: -- if (regs->csr_prmd & CSR_PRMD_PIE) -+ if (!pie) - local_irq_disable(); - #endif - irqentry_exit(regs, state); -@@ -588,12 +589,13 @@ static void bug_handler(struct pt_regs *regs) - asmlinkage void noinstr do_bce(struct pt_regs *regs) - { - bool user = user_mode(regs); -+ bool pie = regs_irqs_disabled(regs); - unsigned long era = exception_era(regs); - u64 badv = 0, lower = 0, upper = ULONG_MAX; - union loongarch_instruction insn; - irqentry_state_t state = irqentry_enter(regs); - -- if (regs->csr_prmd & CSR_PRMD_PIE) -+ if (!pie) - local_irq_enable(); - - current->thread.trap_nr = read_csr_excode(); -@@ -659,7 +661,7 @@ asmlinkage void noinstr do_bce(struct pt_regs *regs) - force_sig_bnderr((void __user *)badv, (void __user *)lower, (void __user *)upper); - - out: -- if (regs->csr_prmd & CSR_PRMD_PIE) -+ if (!pie) - local_irq_disable(); - - irqentry_exit(regs, state); -@@ -677,11 +679,12 @@ asmlinkage void noinstr do_bce(struct pt_regs *regs) - asmlinkage void noinstr do_bp(struct pt_regs *regs) - { - bool user = user_mode(regs); -+ bool pie = regs_irqs_disabled(regs); - unsigned int opcode, bcode; - unsigned long era = exception_era(regs); - irqentry_state_t state = irqentry_enter(regs); - -- if (regs->csr_prmd & CSR_PRMD_PIE) -+ if (!pie) - local_irq_enable(); - - if (__get_inst(&opcode, (u32 *)era, user)) -@@ -747,7 +750,7 @@ asmlinkage void noinstr do_bp(struct pt_regs *regs) - } - - out: -- if (regs->csr_prmd & CSR_PRMD_PIE) -+ if (!pie) - local_irq_disable(); - - irqentry_exit(regs, state); -@@ -982,6 +985,7 @@ static void init_restore_lbt(void) - - asmlinkage void noinstr do_lbt(struct pt_regs *regs) - { -+ bool pie = regs_irqs_disabled(regs); - irqentry_state_t state = irqentry_enter(regs); - - /* -@@ -991,7 +995,7 @@ asmlinkage void noinstr do_lbt(struct pt_regs *regs) - * (including the user using 'MOVGR2GCSR' to turn on TM, which - * will not trigger the BTE), we need to check PRMD first. - */ -- if (regs->csr_prmd & CSR_PRMD_PIE) -+ if (!pie) - local_irq_enable(); - - if (!cpu_has_lbt) { -@@ -1005,7 +1009,7 @@ asmlinkage void noinstr do_lbt(struct pt_regs *regs) - preempt_enable(); - - out: -- if (regs->csr_prmd & CSR_PRMD_PIE) -+ if (!pie) - local_irq_disable(); - - irqentry_exit(regs, state); -diff --git a/arch/loongarch/mm/hugetlbpage.c b/arch/loongarch/mm/hugetlbpage.c -index 1e76fcb83093dd..41308429f44612 100644 ---- a/arch/loongarch/mm/hugetlbpage.c -+++ b/arch/loongarch/mm/hugetlbpage.c -@@ -47,7 +47,7 @@ pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr, - pmd = pmd_offset(pud, addr); - } - } -- return (pte_t *) pmd; -+ return pmd_none(pmdp_get(pmd)) ? NULL : (pte_t *) pmd; - } - - int pmd_huge(pmd_t pmd) -diff --git a/arch/loongarch/mm/init.c b/arch/loongarch/mm/init.c -index 4dd53427f65785..a5bf96993bb1a6 100644 ---- a/arch/loongarch/mm/init.c -+++ b/arch/loongarch/mm/init.c -@@ -64,9 +64,6 @@ void __init paging_init(void) - { - unsigned long max_zone_pfns[MAX_NR_ZONES]; - --#ifdef CONFIG_ZONE_DMA -- max_zone_pfns[ZONE_DMA] = MAX_DMA_PFN; --#endif - #ifdef CONFIG_ZONE_DMA32 - max_zone_pfns[ZONE_DMA32] = MAX_DMA32_PFN; - #endif -diff --git a/arch/mips/include/asm/mips-cm.h b/arch/mips/include/asm/mips-cm.h -index 696b40beb774f5..8494466740ccad 100644 ---- a/arch/mips/include/asm/mips-cm.h -+++ b/arch/mips/include/asm/mips-cm.h -@@ -47,6 +47,16 @@ extern phys_addr_t __mips_cm_phys_base(void); - */ - extern int mips_cm_is64; - -+/* -+ * mips_cm_is_l2_hci_broken - determine if HCI is broken -+ * -+ * Some CM reports show that Hardware Cache Initialization is -+ * complete, but in reality it's not the case. They also incorrectly -+ * indicate that Hardware Cache Initialization is supported. This -+ * flags allows warning about this broken feature. -+ */ -+extern bool mips_cm_is_l2_hci_broken; -+ - /** - * mips_cm_error_report - Report CM cache errors - */ -@@ -85,6 +95,18 @@ static inline bool mips_cm_present(void) - #endif - } - -+/** -+ * mips_cm_update_property - update property from the device tree -+ * -+ * Retrieve the properties from the device tree if a CM node exist and -+ * update the internal variable based on this. -+ */ -+#ifdef CONFIG_MIPS_CM -+extern void mips_cm_update_property(void); -+#else -+static inline void mips_cm_update_property(void) {} -+#endif -+ - /** - * mips_cm_has_l2sync - determine whether an L2-only sync region is present - * -diff --git a/arch/mips/kernel/mips-cm.c b/arch/mips/kernel/mips-cm.c -index 3f00788b08718d..4f75160f08949f 100644 ---- a/arch/mips/kernel/mips-cm.c -+++ b/arch/mips/kernel/mips-cm.c -@@ -5,6 +5,7 @@ - */ - - #include -+#include - #include - #include - -@@ -14,6 +15,7 @@ - void __iomem *mips_gcr_base; - void __iomem *mips_cm_l2sync_base; - int mips_cm_is64; -+bool mips_cm_is_l2_hci_broken; - - static char *cm2_tr[8] = { - "mem", "gcr", "gic", "mmio", -@@ -243,6 +245,18 @@ static void mips_cm_probe_l2sync(void) - mips_cm_l2sync_base = ioremap(addr, MIPS_CM_L2SYNC_SIZE); - } - -+void mips_cm_update_property(void) -+{ -+ struct device_node *cm_node; -+ -+ cm_node = of_find_compatible_node(of_root, NULL, "mobileye,eyeq6-cm"); -+ if (!cm_node) -+ return; -+ pr_info("HCI (Hardware Cache Init for the L2 cache) in GCR_L2_RAM_CONFIG from the CM3 is broken"); -+ mips_cm_is_l2_hci_broken = true; -+ of_node_put(cm_node); -+} -+ - int mips_cm_probe(void) - { - phys_addr_t addr; -diff --git a/arch/parisc/kernel/pdt.c b/arch/parisc/kernel/pdt.c -index 0f9b3b5914cf69..b70b67adb855f6 100644 ---- a/arch/parisc/kernel/pdt.c -+++ b/arch/parisc/kernel/pdt.c -@@ -63,6 +63,7 @@ static unsigned long pdt_entry[MAX_PDT_ENTRIES] __page_aligned_bss; - #define PDT_ADDR_PERM_ERR (pdt_type != PDT_PDC ? 2UL : 0UL) - #define PDT_ADDR_SINGLE_ERR 1UL - -+#ifdef CONFIG_PROC_FS - /* report PDT entries via /proc/meminfo */ - void arch_report_meminfo(struct seq_file *m) - { -@@ -74,6 +75,7 @@ void arch_report_meminfo(struct seq_file *m) - seq_printf(m, "PDT_cur_entries: %7lu\n", - pdt_status.pdt_entries); - } -+#endif - - static int get_info_pat_new(void) - { -diff --git a/arch/riscv/include/asm/alternative-macros.h b/arch/riscv/include/asm/alternative-macros.h -index 721ec275ce57e3..231d777d936c2d 100644 ---- a/arch/riscv/include/asm/alternative-macros.h -+++ b/arch/riscv/include/asm/alternative-macros.h -@@ -115,24 +115,19 @@ - \old_c - .endm - --#define _ALTERNATIVE_CFG(old_c, ...) \ -- ALTERNATIVE_CFG old_c -- --#define _ALTERNATIVE_CFG_2(old_c, ...) \ -- ALTERNATIVE_CFG old_c -+#define __ALTERNATIVE_CFG(old_c, ...) ALTERNATIVE_CFG old_c -+#define __ALTERNATIVE_CFG_2(old_c, ...) ALTERNATIVE_CFG old_c - - #else /* !__ASSEMBLY__ */ - --#define __ALTERNATIVE_CFG(old_c) \ -- old_c "\n" -+#define __ALTERNATIVE_CFG(old_c, ...) old_c "\n" -+#define __ALTERNATIVE_CFG_2(old_c, ...) old_c "\n" - --#define _ALTERNATIVE_CFG(old_c, ...) \ -- __ALTERNATIVE_CFG(old_c) -+#endif /* __ASSEMBLY__ */ - --#define _ALTERNATIVE_CFG_2(old_c, ...) \ -- __ALTERNATIVE_CFG(old_c) -+#define _ALTERNATIVE_CFG(old_c, ...) __ALTERNATIVE_CFG(old_c) -+#define _ALTERNATIVE_CFG_2(old_c, ...) __ALTERNATIVE_CFG_2(old_c) - --#endif /* __ASSEMBLY__ */ - #endif /* CONFIG_RISCV_ALTERNATIVE */ - - /* -diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c -index b16352083ff987..f0be263b334ced 100644 ---- a/arch/s390/kvm/intercept.c -+++ b/arch/s390/kvm/intercept.c -@@ -94,7 +94,7 @@ static int handle_validity(struct kvm_vcpu *vcpu) - - vcpu->stat.exit_validity++; - trace_kvm_s390_intercept_validity(vcpu, viwhy); -- KVM_EVENT(3, "validity intercept 0x%x for pid %u (kvm 0x%pK)", viwhy, -+ KVM_EVENT(3, "validity intercept 0x%x for pid %u (kvm 0x%p)", viwhy, - current->pid, vcpu->kvm); - - /* do not warn on invalid runtime instrumentation mode */ -diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c -index efaebba5ee19c7..fe4841104ed924 100644 ---- a/arch/s390/kvm/interrupt.c -+++ b/arch/s390/kvm/interrupt.c -@@ -3161,7 +3161,7 @@ void kvm_s390_gisa_clear(struct kvm *kvm) - if (!gi->origin) - return; - gisa_clear_ipm(gi->origin); -- VM_EVENT(kvm, 3, "gisa 0x%pK cleared", gi->origin); -+ VM_EVENT(kvm, 3, "gisa 0x%p cleared", gi->origin); - } - - void kvm_s390_gisa_init(struct kvm *kvm) -@@ -3178,7 +3178,7 @@ void kvm_s390_gisa_init(struct kvm *kvm) - gi->timer.function = gisa_vcpu_kicker; - memset(gi->origin, 0, sizeof(struct kvm_s390_gisa)); - gi->origin->next_alert = (u32)virt_to_phys(gi->origin); -- VM_EVENT(kvm, 3, "gisa 0x%pK initialized", gi->origin); -+ VM_EVENT(kvm, 3, "gisa 0x%p initialized", gi->origin); - } - - void kvm_s390_gisa_enable(struct kvm *kvm) -@@ -3219,7 +3219,7 @@ void kvm_s390_gisa_destroy(struct kvm *kvm) - process_gib_alert_list(); - hrtimer_cancel(&gi->timer); - gi->origin = NULL; -- VM_EVENT(kvm, 3, "gisa 0x%pK destroyed", gisa); -+ VM_EVENT(kvm, 3, "gisa 0x%p destroyed", gisa); - } - - void kvm_s390_gisa_disable(struct kvm *kvm) -@@ -3468,7 +3468,7 @@ int __init kvm_s390_gib_init(u8 nisc) - } - } - -- KVM_EVENT(3, "gib 0x%pK (nisc=%d) initialized", gib, gib->nisc); -+ KVM_EVENT(3, "gib 0x%p (nisc=%d) initialized", gib, gib->nisc); - goto out; - - out_unreg_gal: -diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c -index 348d030d2660ca..890d850f51f076 100644 ---- a/arch/s390/kvm/kvm-s390.c -+++ b/arch/s390/kvm/kvm-s390.c -@@ -990,7 +990,7 @@ static int kvm_s390_set_mem_control(struct kvm *kvm, struct kvm_device_attr *att - } - mutex_unlock(&kvm->lock); - VM_EVENT(kvm, 3, "SET: max guest address: %lu", new_limit); -- VM_EVENT(kvm, 3, "New guest asce: 0x%pK", -+ VM_EVENT(kvm, 3, "New guest asce: 0x%p", - (void *) kvm->arch.gmap->asce); - break; - } -@@ -3418,7 +3418,7 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type) - kvm_s390_gisa_init(kvm); - INIT_LIST_HEAD(&kvm->arch.pv.need_cleanup); - kvm->arch.pv.set_aside = NULL; -- KVM_EVENT(3, "vm 0x%pK created by pid %u", kvm, current->pid); -+ KVM_EVENT(3, "vm 0x%p created by pid %u", kvm, current->pid); - - return 0; - out_err: -@@ -3481,7 +3481,7 @@ void kvm_arch_destroy_vm(struct kvm *kvm) - kvm_s390_destroy_adapters(kvm); - kvm_s390_clear_float_irqs(kvm); - kvm_s390_vsie_destroy(kvm); -- KVM_EVENT(3, "vm 0x%pK destroyed", kvm); -+ KVM_EVENT(3, "vm 0x%p destroyed", kvm); - } - - /* Section: vcpu related */ -@@ -3602,7 +3602,7 @@ static int sca_switch_to_extended(struct kvm *kvm) - - free_page((unsigned long)old_sca); - -- VM_EVENT(kvm, 2, "Switched to ESCA (0x%pK -> 0x%pK)", -+ VM_EVENT(kvm, 2, "Switched to ESCA (0x%p -> 0x%p)", - old_sca, kvm->arch.sca); - return 0; - } -@@ -3974,7 +3974,7 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu) - goto out_free_sie_block; - } - -- VM_EVENT(vcpu->kvm, 3, "create cpu %d at 0x%pK, sie block at 0x%pK", -+ VM_EVENT(vcpu->kvm, 3, "create cpu %d at 0x%p, sie block at 0x%p", - vcpu->vcpu_id, vcpu, vcpu->arch.sie_block); - trace_kvm_s390_create_vcpu(vcpu->vcpu_id, vcpu, vcpu->arch.sie_block); - -diff --git a/arch/s390/kvm/trace-s390.h b/arch/s390/kvm/trace-s390.h -index 6f0209d45164f0..9c5f546a2e1a3c 100644 ---- a/arch/s390/kvm/trace-s390.h -+++ b/arch/s390/kvm/trace-s390.h -@@ -56,7 +56,7 @@ TRACE_EVENT(kvm_s390_create_vcpu, - __entry->sie_block = sie_block; - ), - -- TP_printk("create cpu %d at 0x%pK, sie block at 0x%pK", -+ TP_printk("create cpu %d at 0x%p, sie block at 0x%p", - __entry->id, __entry->vcpu, __entry->sie_block) - ); - -@@ -255,7 +255,7 @@ TRACE_EVENT(kvm_s390_enable_css, - __entry->kvm = kvm; - ), - -- TP_printk("enabling channel I/O support (kvm @ %pK)\n", -+ TP_printk("enabling channel I/O support (kvm @ %p)\n", - __entry->kvm) - ); - -diff --git a/arch/x86/entry/entry.S b/arch/x86/entry/entry.S -index 2143358d0c4c74..78fd2442b49dcd 100644 ---- a/arch/x86/entry/entry.S -+++ b/arch/x86/entry/entry.S -@@ -16,7 +16,7 @@ - - SYM_FUNC_START(entry_ibpb) - movl $MSR_IA32_PRED_CMD, %ecx -- movl $PRED_CMD_IBPB, %eax -+ movl _ASM_RIP(x86_pred_cmd), %eax - xorl %edx, %edx - wrmsr - -diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c -index 1458ccaa6a0579..ad63bd408cd900 100644 ---- a/arch/x86/events/core.c -+++ b/arch/x86/events/core.c -@@ -623,7 +623,7 @@ int x86_pmu_hw_config(struct perf_event *event) - if (event->attr.type == event->pmu->type) - event->hw.config |= event->attr.config & X86_RAW_EVENT_MASK; - -- if (!event->attr.freq && x86_pmu.limit_period) { -+ if (is_sampling_event(event) && !event->attr.freq && x86_pmu.limit_period) { - s64 left = event->attr.sample_period; - x86_pmu.limit_period(event, &left); - if (left > event->attr.sample_period) -diff --git a/arch/x86/include/asm/asm.h b/arch/x86/include/asm/asm.h -index ca8eed1d496ab4..2bec0c89a95c27 100644 ---- a/arch/x86/include/asm/asm.h -+++ b/arch/x86/include/asm/asm.h -@@ -229,9 +229,6 @@ register unsigned long current_stack_pointer asm(_ASM_SP); - #define _ASM_EXTABLE_UA(from, to) \ - _ASM_EXTABLE_TYPE(from, to, EX_TYPE_UACCESS) - --#define _ASM_EXTABLE_CPY(from, to) \ -- _ASM_EXTABLE_TYPE(from, to, EX_TYPE_COPY) -- - #define _ASM_EXTABLE_FAULT(from, to) \ - _ASM_EXTABLE_TYPE(from, to, EX_TYPE_FAULT) - -diff --git a/arch/x86/include/asm/extable_fixup_types.h b/arch/x86/include/asm/extable_fixup_types.h -index 991e31cfde94cc..afad9c0b07e0c8 100644 ---- a/arch/x86/include/asm/extable_fixup_types.h -+++ b/arch/x86/include/asm/extable_fixup_types.h -@@ -36,7 +36,7 @@ - #define EX_TYPE_DEFAULT 1 - #define EX_TYPE_FAULT 2 - #define EX_TYPE_UACCESS 3 --#define EX_TYPE_COPY 4 -+/* unused, was: #define EX_TYPE_COPY 4 */ - #define EX_TYPE_CLEAR_FS 5 - #define EX_TYPE_FPU_RESTORE 6 - #define EX_TYPE_BPF 7 -diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h -index f81a851c46dca5..652c0137e909f3 100644 ---- a/arch/x86/include/asm/intel-family.h -+++ b/arch/x86/include/asm/intel-family.h -@@ -159,6 +159,8 @@ - #define INTEL_FAM6_GRANITERAPIDS_D 0xAE - #define INTEL_GRANITERAPIDS_D IFM(6, 0xAE) - -+#define INTEL_BARTLETTLAKE IFM(6, 0xD7) /* Raptor Cove */ -+ - /* "Hybrid" Processors (P-Core/E-Core) */ - - #define INTEL_FAM6_LAKEFIELD 0x8A /* Sunny Cove / Tremont */ -diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c -index 7df458a6553eb2..78545f7e9cc6ca 100644 ---- a/arch/x86/kernel/cpu/bugs.c -+++ b/arch/x86/kernel/cpu/bugs.c -@@ -1574,7 +1574,7 @@ static void __init spec_ctrl_disable_kernel_rrsba(void) - rrsba_disabled = true; - } - --static void __init spectre_v2_determine_rsb_fill_type_at_vmexit(enum spectre_v2_mitigation mode) -+static void __init spectre_v2_select_rsb_mitigation(enum spectre_v2_mitigation mode) - { - /* - * Similar to context switches, there are two types of RSB attacks -@@ -1598,27 +1598,30 @@ static void __init spectre_v2_determine_rsb_fill_type_at_vmexit(enum spectre_v2_ - */ - switch (mode) { - case SPECTRE_V2_NONE: -- return; -+ break; - -- case SPECTRE_V2_EIBRS_LFENCE: - case SPECTRE_V2_EIBRS: -+ case SPECTRE_V2_EIBRS_LFENCE: -+ case SPECTRE_V2_EIBRS_RETPOLINE: - if (boot_cpu_has_bug(X86_BUG_EIBRS_PBRSB)) { -- setup_force_cpu_cap(X86_FEATURE_RSB_VMEXIT_LITE); - pr_info("Spectre v2 / PBRSB-eIBRS: Retire a single CALL on VMEXIT\n"); -+ setup_force_cpu_cap(X86_FEATURE_RSB_VMEXIT_LITE); - } -- return; -+ break; - -- case SPECTRE_V2_EIBRS_RETPOLINE: - case SPECTRE_V2_RETPOLINE: - case SPECTRE_V2_LFENCE: - case SPECTRE_V2_IBRS: -+ pr_info("Spectre v2 / SpectreRSB: Filling RSB on context switch and VMEXIT\n"); -+ setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW); - setup_force_cpu_cap(X86_FEATURE_RSB_VMEXIT); -- pr_info("Spectre v2 / SpectreRSB : Filling RSB on VMEXIT\n"); -- return; -- } -+ break; - -- pr_warn_once("Unknown Spectre v2 mode, disabling RSB mitigation at VM exit"); -- dump_stack(); -+ default: -+ pr_warn_once("Unknown Spectre v2 mode, disabling RSB mitigation\n"); -+ dump_stack(); -+ break; -+ } - } - - /* -@@ -1844,10 +1847,7 @@ static void __init spectre_v2_select_mitigation(void) - * - * FIXME: Is this pointless for retbleed-affected AMD? - */ -- setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW); -- pr_info("Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch\n"); -- -- spectre_v2_determine_rsb_fill_type_at_vmexit(mode); -+ spectre_v2_select_rsb_mitigation(mode); - - /* - * Retpoline protects the kernel, but doesn't protect firmware. IBRS -diff --git a/arch/x86/kernel/cpu/mce/severity.c b/arch/x86/kernel/cpu/mce/severity.c -index c4477162c07d13..9c5754229d6ed3 100644 ---- a/arch/x86/kernel/cpu/mce/severity.c -+++ b/arch/x86/kernel/cpu/mce/severity.c -@@ -288,14 +288,12 @@ static noinstr int error_context(struct mce *m, struct pt_regs *regs) - copy_user = is_copy_from_user(regs); - instrumentation_end(); - -- switch (fixup_type) { -- case EX_TYPE_UACCESS: -- case EX_TYPE_COPY: -- if (!copy_user) -- return IN_KERNEL; -- m->kflags |= MCE_IN_KERNEL_COPYIN; -- fallthrough; -+ if (copy_user) { -+ m->kflags |= MCE_IN_KERNEL_COPYIN | MCE_IN_KERNEL_RECOV; -+ return IN_KERNEL_RECOV; -+ } - -+ switch (fixup_type) { - case EX_TYPE_FAULT_MCE_SAFE: - case EX_TYPE_DEFAULT_MCE_SAFE: - m->kflags |= MCE_IN_KERNEL_RECOV; -diff --git a/arch/x86/kernel/i8253.c b/arch/x86/kernel/i8253.c -index 80e262bb627fe1..cb9852ad609893 100644 ---- a/arch/x86/kernel/i8253.c -+++ b/arch/x86/kernel/i8253.c -@@ -46,7 +46,8 @@ bool __init pit_timer_init(void) - * VMMs otherwise steal CPU time just to pointlessly waggle - * the (masked) IRQ. - */ -- clockevent_i8253_disable(); -+ scoped_guard(irq) -+ clockevent_i8253_disable(); - return false; - } - clockevent_i8253_init(true); -diff --git a/arch/x86/kvm/svm/avic.c b/arch/x86/kvm/svm/avic.c -index 4b74ea91f4e6bb..6970b11a6b4c62 100644 ---- a/arch/x86/kvm/svm/avic.c -+++ b/arch/x86/kvm/svm/avic.c -@@ -820,7 +820,7 @@ static int svm_ir_list_add(struct vcpu_svm *svm, struct amd_iommu_pi_data *pi) - * Allocating new amd_iommu_pi_data, which will get - * add to the per-vcpu ir_list. - */ -- ir = kzalloc(sizeof(struct amd_svm_iommu_ir), GFP_KERNEL_ACCOUNT); -+ ir = kzalloc(sizeof(struct amd_svm_iommu_ir), GFP_ATOMIC | __GFP_ACCOUNT); - if (!ir) { - ret = -ENOMEM; - goto out; -@@ -896,6 +896,7 @@ int avic_pi_update_irte(struct kvm *kvm, unsigned int host_irq, - { - struct kvm_kernel_irq_routing_entry *e; - struct kvm_irq_routing_table *irq_rt; -+ bool enable_remapped_mode = true; - int idx, ret = 0; - - if (!kvm_arch_has_assigned_device(kvm) || -@@ -933,6 +934,8 @@ int avic_pi_update_irte(struct kvm *kvm, unsigned int host_irq, - kvm_vcpu_apicv_active(&svm->vcpu)) { - struct amd_iommu_pi_data pi; - -+ enable_remapped_mode = false; -+ - /* Try to enable guest_mode in IRTE */ - pi.base = __sme_set(page_to_phys(svm->avic_backing_page) & - AVIC_HPA_MASK); -@@ -951,33 +954,6 @@ int avic_pi_update_irte(struct kvm *kvm, unsigned int host_irq, - */ - if (!ret && pi.is_guest_mode) - svm_ir_list_add(svm, &pi); -- } else { -- /* Use legacy mode in IRTE */ -- struct amd_iommu_pi_data pi; -- -- /** -- * Here, pi is used to: -- * - Tell IOMMU to use legacy mode for this interrupt. -- * - Retrieve ga_tag of prior interrupt remapping data. -- */ -- pi.prev_ga_tag = 0; -- pi.is_guest_mode = false; -- ret = irq_set_vcpu_affinity(host_irq, &pi); -- -- /** -- * Check if the posted interrupt was previously -- * setup with the guest_mode by checking if the ga_tag -- * was cached. If so, we need to clean up the per-vcpu -- * ir_list. -- */ -- if (!ret && pi.prev_ga_tag) { -- int id = AVIC_GATAG_TO_VCPUID(pi.prev_ga_tag); -- struct kvm_vcpu *vcpu; -- -- vcpu = kvm_get_vcpu_by_id(kvm, id); -- if (vcpu) -- svm_ir_list_del(to_svm(vcpu), &pi); -- } - } - - if (!ret && svm) { -@@ -993,6 +969,34 @@ int avic_pi_update_irte(struct kvm *kvm, unsigned int host_irq, - } - - ret = 0; -+ if (enable_remapped_mode) { -+ /* Use legacy mode in IRTE */ -+ struct amd_iommu_pi_data pi; -+ -+ /** -+ * Here, pi is used to: -+ * - Tell IOMMU to use legacy mode for this interrupt. -+ * - Retrieve ga_tag of prior interrupt remapping data. -+ */ -+ pi.prev_ga_tag = 0; -+ pi.is_guest_mode = false; -+ ret = irq_set_vcpu_affinity(host_irq, &pi); -+ -+ /** -+ * Check if the posted interrupt was previously -+ * setup with the guest_mode by checking if the ga_tag -+ * was cached. If so, we need to clean up the per-vcpu -+ * ir_list. -+ */ -+ if (!ret && pi.prev_ga_tag) { -+ int id = AVIC_GATAG_TO_VCPUID(pi.prev_ga_tag); -+ struct kvm_vcpu *vcpu; -+ -+ vcpu = kvm_get_vcpu_by_id(kvm, id); -+ if (vcpu) -+ svm_ir_list_del(to_svm(vcpu), &pi); -+ } -+ } - out: - srcu_read_unlock(&kvm->irq_srcu, idx); - return ret; -diff --git a/arch/x86/kvm/vmx/posted_intr.c b/arch/x86/kvm/vmx/posted_intr.c -index af662312fd0778..b54e0cb86e5d61 100644 ---- a/arch/x86/kvm/vmx/posted_intr.c -+++ b/arch/x86/kvm/vmx/posted_intr.c -@@ -274,6 +274,7 @@ int vmx_pi_update_irte(struct kvm *kvm, unsigned int host_irq, - { - struct kvm_kernel_irq_routing_entry *e; - struct kvm_irq_routing_table *irq_rt; -+ bool enable_remapped_mode = true; - struct kvm_lapic_irq irq; - struct kvm_vcpu *vcpu; - struct vcpu_data vcpu_info; -@@ -312,21 +313,8 @@ int vmx_pi_update_irte(struct kvm *kvm, unsigned int host_irq, - - kvm_set_msi_irq(kvm, e, &irq); - if (!kvm_intr_is_single_vcpu(kvm, &irq, &vcpu) || -- !kvm_irq_is_postable(&irq)) { -- /* -- * Make sure the IRTE is in remapped mode if -- * we don't handle it in posted mode. -- */ -- ret = irq_set_vcpu_affinity(host_irq, NULL); -- if (ret < 0) { -- printk(KERN_INFO -- "failed to back to remapped mode, irq: %u\n", -- host_irq); -- goto out; -- } -- -+ !kvm_irq_is_postable(&irq)) - continue; -- } - - vcpu_info.pi_desc_addr = __pa(vcpu_to_pi_desc(vcpu)); - vcpu_info.vector = irq.vector; -@@ -334,11 +322,12 @@ int vmx_pi_update_irte(struct kvm *kvm, unsigned int host_irq, - trace_kvm_pi_irte_update(host_irq, vcpu->vcpu_id, e->gsi, - vcpu_info.vector, vcpu_info.pi_desc_addr, set); - -- if (set) -- ret = irq_set_vcpu_affinity(host_irq, &vcpu_info); -- else -- ret = irq_set_vcpu_affinity(host_irq, NULL); -+ if (!set) -+ continue; - -+ enable_remapped_mode = false; -+ -+ ret = irq_set_vcpu_affinity(host_irq, &vcpu_info); - if (ret < 0) { - printk(KERN_INFO "%s: failed to update PI IRTE\n", - __func__); -@@ -346,6 +335,9 @@ int vmx_pi_update_irte(struct kvm *kvm, unsigned int host_irq, - } - } - -+ if (enable_remapped_mode) -+ ret = irq_set_vcpu_affinity(host_irq, NULL); -+ - ret = 0; - out: - srcu_read_unlock(&kvm->irq_srcu, idx); -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 2a2dbeb56897d8..f67fe8a65820c8 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -13297,7 +13297,8 @@ int kvm_arch_update_irqfd_routing(struct kvm *kvm, unsigned int host_irq, - bool kvm_arch_irqfd_route_changed(struct kvm_kernel_irq_routing_entry *old, - struct kvm_kernel_irq_routing_entry *new) - { -- if (new->type != KVM_IRQ_ROUTING_MSI) -+ if (old->type != KVM_IRQ_ROUTING_MSI || -+ new->type != KVM_IRQ_ROUTING_MSI) - return true; - - return !!memcmp(&old->msi, &new->msi, sizeof(new->msi)); -diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c -index 271dcb2deabc31..2354c0156e51c9 100644 ---- a/arch/x86/mm/extable.c -+++ b/arch/x86/mm/extable.c -@@ -163,13 +163,6 @@ static bool ex_handler_uaccess(const struct exception_table_entry *fixup, - return ex_handler_default(fixup, regs); - } - --static bool ex_handler_copy(const struct exception_table_entry *fixup, -- struct pt_regs *regs, int trapnr) --{ -- WARN_ONCE(trapnr == X86_TRAP_GP, "General protection fault in user access. Non-canonical address?"); -- return ex_handler_fault(fixup, regs, trapnr); --} -- - static bool ex_handler_msr(const struct exception_table_entry *fixup, - struct pt_regs *regs, bool wrmsr, bool safe, int reg) - { -@@ -267,8 +260,6 @@ int fixup_exception(struct pt_regs *regs, int trapnr, unsigned long error_code, - return ex_handler_fault(e, regs, trapnr); - case EX_TYPE_UACCESS: - return ex_handler_uaccess(e, regs, trapnr, fault_addr); -- case EX_TYPE_COPY: -- return ex_handler_copy(e, regs, trapnr); - case EX_TYPE_CLEAR_FS: - return ex_handler_clear_fs(e, regs); - case EX_TYPE_FPU_RESTORE: -diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c -index df1794a5e38a57..4872bb082b1935 100644 ---- a/arch/x86/mm/tlb.c -+++ b/arch/x86/mm/tlb.c -@@ -392,9 +392,9 @@ static void cond_mitigation(struct task_struct *next) - prev_mm = this_cpu_read(cpu_tlbstate.last_user_mm_spec); - - /* -- * Avoid user/user BTB poisoning by flushing the branch predictor -- * when switching between processes. This stops one process from -- * doing Spectre-v2 attacks on another. -+ * Avoid user->user BTB/RSB poisoning by flushing them when switching -+ * between processes. This stops one process from doing Spectre-v2 -+ * attacks on another. - * - * Both, the conditional and the always IBPB mode use the mm - * pointer to avoid the IBPB when switching between tasks of the -diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S -index c4365a05ab83b3..fc46b4dfbd7475 100644 ---- a/arch/x86/platform/pvh/head.S -+++ b/arch/x86/platform/pvh/head.S -@@ -100,7 +100,12 @@ SYM_CODE_START_LOCAL(pvh_start_xen) - xor %edx, %edx - wrmsr - -- call xen_prepare_pvh -+ /* Call xen_prepare_pvh() via the kernel virtual mapping */ -+ leaq xen_prepare_pvh(%rip), %rax -+ subq phys_base(%rip), %rax -+ addq $__START_KERNEL_map, %rax -+ ANNOTATE_RETPOLINE_SAFE -+ call *%rax - - /* startup_64 expects boot_params in %rsi. */ - mov $_pa(pvh_bootparams), %rsi -diff --git a/crypto/crypto_null.c b/crypto/crypto_null.c -index 5b84b0f7cc178f..3378670286535a 100644 ---- a/crypto/crypto_null.c -+++ b/crypto/crypto_null.c -@@ -17,10 +17,10 @@ - #include - #include - #include --#include -+#include - #include - --static DEFINE_MUTEX(crypto_default_null_skcipher_lock); -+static DEFINE_SPINLOCK(crypto_default_null_skcipher_lock); - static struct crypto_sync_skcipher *crypto_default_null_skcipher; - static int crypto_default_null_skcipher_refcnt; - -@@ -152,23 +152,32 @@ MODULE_ALIAS_CRYPTO("cipher_null"); - - struct crypto_sync_skcipher *crypto_get_default_null_skcipher(void) - { -+ struct crypto_sync_skcipher *ntfm = NULL; - struct crypto_sync_skcipher *tfm; - -- mutex_lock(&crypto_default_null_skcipher_lock); -+ spin_lock_bh(&crypto_default_null_skcipher_lock); - tfm = crypto_default_null_skcipher; - - if (!tfm) { -- tfm = crypto_alloc_sync_skcipher("ecb(cipher_null)", 0, 0); -- if (IS_ERR(tfm)) -- goto unlock; -- -- crypto_default_null_skcipher = tfm; -+ spin_unlock_bh(&crypto_default_null_skcipher_lock); -+ -+ ntfm = crypto_alloc_sync_skcipher("ecb(cipher_null)", 0, 0); -+ if (IS_ERR(ntfm)) -+ return ntfm; -+ -+ spin_lock_bh(&crypto_default_null_skcipher_lock); -+ tfm = crypto_default_null_skcipher; -+ if (!tfm) { -+ tfm = ntfm; -+ ntfm = NULL; -+ crypto_default_null_skcipher = tfm; -+ } - } - - crypto_default_null_skcipher_refcnt++; -+ spin_unlock_bh(&crypto_default_null_skcipher_lock); - --unlock: -- mutex_unlock(&crypto_default_null_skcipher_lock); -+ crypto_free_sync_skcipher(ntfm); - - return tfm; - } -@@ -176,12 +185,16 @@ EXPORT_SYMBOL_GPL(crypto_get_default_null_skcipher); - - void crypto_put_default_null_skcipher(void) - { -- mutex_lock(&crypto_default_null_skcipher_lock); -+ struct crypto_sync_skcipher *tfm = NULL; -+ -+ spin_lock_bh(&crypto_default_null_skcipher_lock); - if (!--crypto_default_null_skcipher_refcnt) { -- crypto_free_sync_skcipher(crypto_default_null_skcipher); -+ tfm = crypto_default_null_skcipher; - crypto_default_null_skcipher = NULL; - } -- mutex_unlock(&crypto_default_null_skcipher_lock); -+ spin_unlock_bh(&crypto_default_null_skcipher_lock); -+ -+ crypto_free_sync_skcipher(tfm); - } - EXPORT_SYMBOL_GPL(crypto_put_default_null_skcipher); - -diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c -index 115994dfefec1e..77d6af61158936 100644 ---- a/drivers/acpi/ec.c -+++ b/drivers/acpi/ec.c -@@ -2301,6 +2301,34 @@ static const struct dmi_system_id acpi_ec_no_wakeup[] = { - DMI_MATCH(DMI_PRODUCT_FAMILY, "103C_5336AN HP ZHAN 66 Pro"), - }, - }, -+ /* -+ * Lenovo Legion Go S; touchscreen blocks HW sleep when woken up from EC -+ * https://gitlab.freedesktop.org/drm/amd/-/issues/3929 -+ */ -+ { -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "83L3"), -+ } -+ }, -+ { -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "83N6"), -+ } -+ }, -+ { -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "83Q2"), -+ } -+ }, -+ { -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "83Q3"), -+ } -+ }, - { }, - }; - -diff --git a/drivers/acpi/pptt.c b/drivers/acpi/pptt.c -index a35dd0e41c2704..f73ce6e13065dd 100644 ---- a/drivers/acpi/pptt.c -+++ b/drivers/acpi/pptt.c -@@ -229,7 +229,7 @@ static int acpi_pptt_leaf_node(struct acpi_table_header *table_hdr, - node_entry = ACPI_PTR_DIFF(node, table_hdr); - entry = ACPI_ADD_PTR(struct acpi_subtable_header, table_hdr, - sizeof(struct acpi_table_pptt)); -- proc_sz = sizeof(struct acpi_pptt_processor *); -+ proc_sz = sizeof(struct acpi_pptt_processor); - - while ((unsigned long)entry + proc_sz < table_end) { - cpu_node = (struct acpi_pptt_processor *)entry; -@@ -270,7 +270,7 @@ static struct acpi_pptt_processor *acpi_find_processor_node(struct acpi_table_he - table_end = (unsigned long)table_hdr + table_hdr->length; - entry = ACPI_ADD_PTR(struct acpi_subtable_header, table_hdr, - sizeof(struct acpi_table_pptt)); -- proc_sz = sizeof(struct acpi_pptt_processor *); -+ proc_sz = sizeof(struct acpi_pptt_processor); - - /* find the processor structure associated with this cpuid */ - while ((unsigned long)entry + proc_sz < table_end) { -diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c -index 5377d094bf7548..6a1460d35447cc 100644 ---- a/drivers/ata/libata-scsi.c -+++ b/drivers/ata/libata-scsi.c -@@ -2354,8 +2354,8 @@ static unsigned int ata_msense_control_ata_feature(struct ata_device *dev, - */ - put_unaligned_be16(ATA_FEATURE_SUB_MPAGE_LEN - 4, &buf[2]); - -- if (dev->flags & ATA_DFLAG_CDL) -- buf[4] = 0x02; /* Support T2A and T2B pages */ -+ if (dev->flags & ATA_DFLAG_CDL_ENABLED) -+ buf[4] = 0x02; /* T2A and T2B pages enabled */ - else - buf[4] = 0; - -@@ -3764,12 +3764,11 @@ static int ata_mselect_control_spg0(struct ata_queued_cmd *qc, - } - - /* -- * Translate MODE SELECT control mode page, sub-pages f2h (ATA feature mode -+ * Translate MODE SELECT control mode page, sub-page f2h (ATA feature mode - * page) into a SET FEATURES command. - */ --static unsigned int ata_mselect_control_ata_feature(struct ata_queued_cmd *qc, -- const u8 *buf, int len, -- u16 *fp) -+static int ata_mselect_control_ata_feature(struct ata_queued_cmd *qc, -+ const u8 *buf, int len, u16 *fp) - { - struct ata_device *dev = qc->dev; - struct ata_taskfile *tf = &qc->tf; -@@ -3787,17 +3786,27 @@ static unsigned int ata_mselect_control_ata_feature(struct ata_queued_cmd *qc, - /* Check cdl_ctrl */ - switch (buf[0] & 0x03) { - case 0: -- /* Disable CDL */ -+ /* Disable CDL if it is enabled */ -+ if (!(dev->flags & ATA_DFLAG_CDL_ENABLED)) -+ return 0; -+ ata_dev_dbg(dev, "Disabling CDL\n"); - cdl_action = 0; - dev->flags &= ~ATA_DFLAG_CDL_ENABLED; - break; - case 0x02: -- /* Enable CDL T2A/T2B: NCQ priority must be disabled */ -+ /* -+ * Enable CDL if not already enabled. Since this is mutually -+ * exclusive with NCQ priority, allow this only if NCQ priority -+ * is disabled. -+ */ -+ if (dev->flags & ATA_DFLAG_CDL_ENABLED) -+ return 0; - if (dev->flags & ATA_DFLAG_NCQ_PRIO_ENABLED) { - ata_dev_err(dev, - "NCQ priority must be disabled to enable CDL\n"); - return -EINVAL; - } -+ ata_dev_dbg(dev, "Enabling CDL\n"); - cdl_action = 1; - dev->flags |= ATA_DFLAG_CDL_ENABLED; - break; -diff --git a/drivers/auxdisplay/hd44780.c b/drivers/auxdisplay/hd44780.c -index d56a5d508ccd7b..8b690f59df27d6 100644 ---- a/drivers/auxdisplay/hd44780.c -+++ b/drivers/auxdisplay/hd44780.c -@@ -313,13 +313,13 @@ static int hd44780_probe(struct platform_device *pdev) - fail3: - kfree(hd); - fail2: -- kfree(lcd); -+ charlcd_free(lcd); - fail1: - kfree(hdc); - return ret; - } - --static int hd44780_remove(struct platform_device *pdev) -+static void hd44780_remove(struct platform_device *pdev) - { - struct charlcd *lcd = platform_get_drvdata(pdev); - struct hd44780_common *hdc = lcd->drvdata; -@@ -328,8 +328,7 @@ static int hd44780_remove(struct platform_device *pdev) - kfree(hdc->hd44780); - kfree(lcd->drvdata); - -- kfree(lcd); -- return 0; -+ charlcd_free(lcd); - } - - static const struct of_device_id hd44780_of_match[] = { -@@ -340,7 +339,7 @@ MODULE_DEVICE_TABLE(of, hd44780_of_match); - - static struct platform_driver hd44780_driver = { - .probe = hd44780_probe, -- .remove = hd44780_remove, -+ .remove_new = hd44780_remove, - .driver = { - .name = "hd44780", - .of_match_table = hd44780_of_match, -diff --git a/drivers/base/base.h b/drivers/base/base.h -index a8e3d8165232fd..0b491449b022a1 100644 ---- a/drivers/base/base.h -+++ b/drivers/base/base.h -@@ -73,6 +73,7 @@ static inline void subsys_put(struct subsys_private *sp) - kset_put(&sp->subsys); - } - -+struct subsys_private *bus_to_subsys(const struct bus_type *bus); - struct subsys_private *class_to_subsys(const struct class *class); - - struct driver_private { -@@ -179,6 +180,22 @@ int driver_add_groups(struct device_driver *drv, const struct attribute_group ** - void driver_remove_groups(struct device_driver *drv, const struct attribute_group **groups); - void device_driver_detach(struct device *dev); - -+static inline void device_set_driver(struct device *dev, const struct device_driver *drv) -+{ -+ /* -+ * Majority (all?) read accesses to dev->driver happens either -+ * while holding device lock or in bus/driver code that is only -+ * invoked when the device is bound to a driver and there is no -+ * concern of the pointer being changed while it is being read. -+ * However when reading device's uevent file we read driver pointer -+ * without taking device lock (so we do not block there for -+ * arbitrary amount of time). We use WRITE_ONCE() here to prevent -+ * tearing so that READ_ONCE() can safely be used in uevent code. -+ */ -+ // FIXME - this cast should not be needed "soon" -+ WRITE_ONCE(dev->driver, (struct device_driver *)drv); -+} -+ - int devres_release_all(struct device *dev); - void device_block_probing(void); - void device_unblock_probing(void); -diff --git a/drivers/base/bus.c b/drivers/base/bus.c -index d4361ad3b433f5..b97e13a52c3308 100644 ---- a/drivers/base/bus.c -+++ b/drivers/base/bus.c -@@ -57,7 +57,7 @@ static int __must_check bus_rescan_devices_helper(struct device *dev, - * NULL. A call to subsys_put() must be done when finished with the pointer in - * order for it to be properly freed. - */ --static struct subsys_private *bus_to_subsys(const struct bus_type *bus) -+struct subsys_private *bus_to_subsys(const struct bus_type *bus) - { - struct subsys_private *sp = NULL; - struct kobject *kobj; -diff --git a/drivers/base/core.c b/drivers/base/core.c -index 8e2caa9eb5cd41..a192ce5bb8f902 100644 ---- a/drivers/base/core.c -+++ b/drivers/base/core.c -@@ -2570,6 +2570,35 @@ static const char *dev_uevent_name(const struct kobject *kobj) - return NULL; - } - -+/* -+ * Try filling "DRIVER=" uevent variable for a device. Because this -+ * function may race with binding and unbinding the device from a driver, -+ * we need to be careful. Binding is generally safe, at worst we miss the -+ * fact that the device is already bound to a driver (but the driver -+ * information that is delivered through uevents is best-effort, it may -+ * become obsolete as soon as it is generated anyways). Unbinding is more -+ * risky as driver pointer is transitioning to NULL, so READ_ONCE() should -+ * be used to make sure we are dealing with the same pointer, and to -+ * ensure that driver structure is not going to disappear from under us -+ * we take bus' drivers klist lock. The assumption that only registered -+ * driver can be bound to a device, and to unregister a driver bus code -+ * will take the same lock. -+ */ -+static void dev_driver_uevent(const struct device *dev, struct kobj_uevent_env *env) -+{ -+ struct subsys_private *sp = bus_to_subsys(dev->bus); -+ -+ if (sp) { -+ scoped_guard(spinlock, &sp->klist_drivers.k_lock) { -+ struct device_driver *drv = READ_ONCE(dev->driver); -+ if (drv) -+ add_uevent_var(env, "DRIVER=%s", drv->name); -+ } -+ -+ subsys_put(sp); -+ } -+} -+ - static int dev_uevent(const struct kobject *kobj, struct kobj_uevent_env *env) - { - const struct device *dev = kobj_to_dev(kobj); -@@ -2601,8 +2630,8 @@ static int dev_uevent(const struct kobject *kobj, struct kobj_uevent_env *env) - if (dev->type && dev->type->name) - add_uevent_var(env, "DEVTYPE=%s", dev->type->name); - -- if (dev->driver) -- add_uevent_var(env, "DRIVER=%s", dev->driver->name); -+ /* Add "DRIVER=%s" variable if the device is bound to a driver */ -+ dev_driver_uevent(dev, env); - - /* Add common DT information about the device */ - of_device_uevent(dev, env); -@@ -2672,11 +2701,8 @@ static ssize_t uevent_show(struct device *dev, struct device_attribute *attr, - if (!env) - return -ENOMEM; - -- /* Synchronize with really_probe() */ -- device_lock(dev); - /* let the kset specific function add its keys */ - retval = kset->uevent_ops->uevent(&dev->kobj, env); -- device_unlock(dev); - if (retval) - goto out; - -@@ -3691,7 +3717,7 @@ int device_add(struct device *dev) - device_pm_remove(dev); - dpm_sysfs_remove(dev); - DPMError: -- dev->driver = NULL; -+ device_set_driver(dev, NULL); - bus_remove_device(dev); - BusError: - device_remove_attrs(dev); -diff --git a/drivers/base/dd.c b/drivers/base/dd.c -index 0c3725c3eefa46..7e2fb159bb895b 100644 ---- a/drivers/base/dd.c -+++ b/drivers/base/dd.c -@@ -550,7 +550,7 @@ static void device_unbind_cleanup(struct device *dev) - arch_teardown_dma_ops(dev); - kfree(dev->dma_range_map); - dev->dma_range_map = NULL; -- dev->driver = NULL; -+ device_set_driver(dev, NULL); - dev_set_drvdata(dev, NULL); - if (dev->pm_domain && dev->pm_domain->dismiss) - dev->pm_domain->dismiss(dev); -@@ -629,7 +629,7 @@ static int really_probe(struct device *dev, struct device_driver *drv) - } - - re_probe: -- dev->driver = drv; -+ device_set_driver(dev, drv); - - /* If using pinctrl, bind pins now before probing */ - ret = pinctrl_bind_pins(dev); -@@ -1014,7 +1014,7 @@ static int __device_attach(struct device *dev, bool allow_async) - if (ret == 0) - ret = 1; - else { -- dev->driver = NULL; -+ device_set_driver(dev, NULL); - ret = 0; - } - } else { -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index 8a6c1146df00fd..455e2a2b149f4b 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -441,7 +441,7 @@ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd, - cmd->iocb.ki_filp = file; - cmd->iocb.ki_complete = lo_rw_aio_complete; - cmd->iocb.ki_flags = IOCB_DIRECT; -- cmd->iocb.ki_ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_NONE, 0); -+ cmd->iocb.ki_ioprio = req_get_ioprio(rq); - - if (rw == ITER_SOURCE) - ret = call_write_iter(file, &cmd->iocb, &iter); -diff --git a/drivers/char/misc.c b/drivers/char/misc.c -index f7dd455dd0dd3c..dda466f9181acf 100644 ---- a/drivers/char/misc.c -+++ b/drivers/char/misc.c -@@ -315,7 +315,7 @@ static int __init misc_init(void) - goto fail_remove; - - err = -EIO; -- if (register_chrdev(MISC_MAJOR, "misc", &misc_fops)) -+ if (__register_chrdev(MISC_MAJOR, 0, MINORMASK + 1, "misc", &misc_fops)) - goto fail_printk; - return 0; - -diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c -index 796ab9a4e48fa1..80e0f485170a8f 100644 ---- a/drivers/char/virtio_console.c -+++ b/drivers/char/virtio_console.c -@@ -1612,8 +1612,8 @@ static void handle_control_message(struct virtio_device *vdev, - break; - case VIRTIO_CONSOLE_RESIZE: { - struct { -- __u16 rows; -- __u16 cols; -+ __virtio16 rows; -+ __virtio16 cols; - } size; - - if (!is_console_port(port)) -@@ -1621,7 +1621,8 @@ static void handle_control_message(struct virtio_device *vdev, - - memcpy(&size, buf->buf + buf->offset + sizeof(*cpkt), - sizeof(size)); -- set_console_size(port, size.rows, size.cols); -+ set_console_size(port, virtio16_to_cpu(vdev, size.rows), -+ virtio16_to_cpu(vdev, size.cols)); - - port->cons.hvc->irq_requested = 1; - resize_console(port); -diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c -index 5bbd036f5295f5..8474099e2cac19 100644 ---- a/drivers/clk/clk.c -+++ b/drivers/clk/clk.c -@@ -5216,6 +5216,10 @@ of_clk_get_hw_from_clkspec(struct of_phandle_args *clkspec) - if (!clkspec) - return ERR_PTR(-EINVAL); - -+ /* Check if node in clkspec is in disabled/fail state */ -+ if (!of_device_is_available(clkspec->np)) -+ return ERR_PTR(-ENOENT); -+ - mutex_lock(&of_clk_mutex); - list_for_each_entry(provider, &of_clk_providers, link) { - if (provider->node == clkspec->np) { -diff --git a/drivers/clk/renesas/r9a07g043-cpg.c b/drivers/clk/renesas/r9a07g043-cpg.c -index 6c6bc79b2e9cec..865d47800791bd 100644 ---- a/drivers/clk/renesas/r9a07g043-cpg.c -+++ b/drivers/clk/renesas/r9a07g043-cpg.c -@@ -14,6 +14,17 @@ - - #include "rzg2l-cpg.h" - -+/* Specific registers. */ -+#define CPG_PL2SDHI_DSEL (0x218) -+ -+/* Clock select configuration. */ -+#define SEL_SDHI0 SEL_PLL_PACK(CPG_PL2SDHI_DSEL, 0, 2) -+#define SEL_SDHI1 SEL_PLL_PACK(CPG_PL2SDHI_DSEL, 4, 2) -+ -+/* Clock status configuration. */ -+#define SEL_SDHI0_STS SEL_PLL_PACK(CPG_CLKSTATUS, 28, 1) -+#define SEL_SDHI1_STS SEL_PLL_PACK(CPG_CLKSTATUS, 29, 1) -+ - enum clk_ids { - /* Core Clock Outputs exported to DT */ - LAST_DT_CORE_CLK = R9A07G043_CLK_P0_DIV2, -@@ -75,8 +86,12 @@ static const struct clk_div_table dtable_1_32[] = { - - /* Mux clock tables */ - static const char * const sel_pll3_3[] = { ".pll3_533", ".pll3_400" }; -+#ifdef CONFIG_ARM64 - static const char * const sel_pll6_2[] = { ".pll6_250", ".pll5_250" }; --static const char * const sel_shdi[] = { ".clk_533", ".clk_400", ".clk_266" }; -+#endif -+static const char * const sel_sdhi[] = { ".clk_533", ".clk_400", ".clk_266" }; -+ -+static const u32 mtable_sdhi[] = { 1, 2, 3 }; - - static const struct cpg_core_clk r9a07g043_core_clks[] __initconst = { - /* External Clock Inputs */ -@@ -120,11 +135,18 @@ static const struct cpg_core_clk r9a07g043_core_clks[] __initconst = { - DEF_DIV("P2", R9A07G043_CLK_P2, CLK_PLL3_DIV2_4_2, DIVPL3A, dtable_1_32), - DEF_FIXED("M0", R9A07G043_CLK_M0, CLK_PLL3_DIV2_4, 1, 1), - DEF_FIXED("ZT", R9A07G043_CLK_ZT, CLK_PLL3_DIV2_4_2, 1, 1), -+#ifdef CONFIG_ARM64 - DEF_MUX("HP", R9A07G043_CLK_HP, SEL_PLL6_2, sel_pll6_2), -+#endif -+#ifdef CONFIG_RISCV -+ DEF_FIXED("HP", R9A07G043_CLK_HP, CLK_PLL6_250, 1, 1), -+#endif - DEF_FIXED("SPI0", R9A07G043_CLK_SPI0, CLK_DIV_PLL3_C, 1, 2), - DEF_FIXED("SPI1", R9A07G043_CLK_SPI1, CLK_DIV_PLL3_C, 1, 4), -- DEF_SD_MUX("SD0", R9A07G043_CLK_SD0, SEL_SDHI0, sel_shdi), -- DEF_SD_MUX("SD1", R9A07G043_CLK_SD1, SEL_SDHI1, sel_shdi), -+ DEF_SD_MUX("SD0", R9A07G043_CLK_SD0, SEL_SDHI0, SEL_SDHI0_STS, sel_sdhi, -+ mtable_sdhi, 0, rzg2l_cpg_sd_clk_mux_notifier), -+ DEF_SD_MUX("SD1", R9A07G043_CLK_SD1, SEL_SDHI1, SEL_SDHI1_STS, sel_sdhi, -+ mtable_sdhi, 0, rzg2l_cpg_sd_clk_mux_notifier), - DEF_FIXED("SD0_DIV4", CLK_SD0_DIV4, R9A07G043_CLK_SD0, 1, 4), - DEF_FIXED("SD1_DIV4", CLK_SD1_DIV4, R9A07G043_CLK_SD1, 1, 4), - }; -diff --git a/drivers/clk/renesas/r9a07g044-cpg.c b/drivers/clk/renesas/r9a07g044-cpg.c -index c597414a94d8a0..48404cafea3f51 100644 ---- a/drivers/clk/renesas/r9a07g044-cpg.c -+++ b/drivers/clk/renesas/r9a07g044-cpg.c -@@ -15,6 +15,17 @@ - - #include "rzg2l-cpg.h" - -+/* Specific registers. */ -+#define CPG_PL2SDHI_DSEL (0x218) -+ -+/* Clock select configuration. */ -+#define SEL_SDHI0 SEL_PLL_PACK(CPG_PL2SDHI_DSEL, 0, 2) -+#define SEL_SDHI1 SEL_PLL_PACK(CPG_PL2SDHI_DSEL, 4, 2) -+ -+/* Clock status configuration. */ -+#define SEL_SDHI0_STS SEL_PLL_PACK(CPG_CLKSTATUS, 28, 1) -+#define SEL_SDHI1_STS SEL_PLL_PACK(CPG_CLKSTATUS, 29, 1) -+ - enum clk_ids { - /* Core Clock Outputs exported to DT */ - LAST_DT_CORE_CLK = R9A07G054_CLK_DRP_A, -@@ -95,9 +106,11 @@ static const struct clk_div_table dtable_16_128[] = { - static const char * const sel_pll3_3[] = { ".pll3_533", ".pll3_400" }; - static const char * const sel_pll5_4[] = { ".pll5_foutpostdiv", ".pll5_fout1ph0" }; - static const char * const sel_pll6_2[] = { ".pll6_250", ".pll5_250" }; --static const char * const sel_shdi[] = { ".clk_533", ".clk_400", ".clk_266" }; -+static const char * const sel_sdhi[] = { ".clk_533", ".clk_400", ".clk_266" }; - static const char * const sel_gpu2[] = { ".pll6", ".pll3_div2_2" }; - -+static const u32 mtable_sdhi[] = { 1, 2, 3 }; -+ - static const struct { - struct cpg_core_clk common[56]; - #ifdef CONFIG_CLK_R9A07G054 -@@ -163,8 +176,10 @@ static const struct { - DEF_MUX("HP", R9A07G044_CLK_HP, SEL_PLL6_2, sel_pll6_2), - DEF_FIXED("SPI0", R9A07G044_CLK_SPI0, CLK_DIV_PLL3_C, 1, 2), - DEF_FIXED("SPI1", R9A07G044_CLK_SPI1, CLK_DIV_PLL3_C, 1, 4), -- DEF_SD_MUX("SD0", R9A07G044_CLK_SD0, SEL_SDHI0, sel_shdi), -- DEF_SD_MUX("SD1", R9A07G044_CLK_SD1, SEL_SDHI1, sel_shdi), -+ DEF_SD_MUX("SD0", R9A07G044_CLK_SD0, SEL_SDHI0, SEL_SDHI0_STS, sel_sdhi, -+ mtable_sdhi, 0, rzg2l_cpg_sd_clk_mux_notifier), -+ DEF_SD_MUX("SD1", R9A07G044_CLK_SD1, SEL_SDHI1, SEL_SDHI1_STS, sel_sdhi, -+ mtable_sdhi, 0, rzg2l_cpg_sd_clk_mux_notifier), - DEF_FIXED("SD0_DIV4", CLK_SD0_DIV4, R9A07G044_CLK_SD0, 1, 4), - DEF_FIXED("SD1_DIV4", CLK_SD1_DIV4, R9A07G044_CLK_SD1, 1, 4), - DEF_DIV("G", R9A07G044_CLK_G, CLK_SEL_GPU2, DIVGPU, dtable_1_8), -diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c -index f8dbb092b9f1b2..77eefb6ee4538a 100644 ---- a/drivers/clk/renesas/rzg2l-cpg.c -+++ b/drivers/clk/renesas/rzg2l-cpg.c -@@ -56,15 +56,37 @@ - #define GET_REG_SAMPLL_CLK1(val) ((val >> 22) & 0xfff) - #define GET_REG_SAMPLL_CLK2(val) ((val >> 12) & 0xfff) - -+#define CPG_WEN_BIT BIT(16) -+ - #define MAX_VCLK_FREQ (148500000) - --struct sd_hw_data { -+/** -+ * struct clk_hw_data - clock hardware data -+ * @hw: clock hw -+ * @conf: clock configuration (register offset, shift, width) -+ * @sconf: clock status configuration (register offset, shift, width) -+ * @priv: CPG private data structure -+ */ -+struct clk_hw_data { - struct clk_hw hw; - u32 conf; -+ u32 sconf; - struct rzg2l_cpg_priv *priv; - }; - --#define to_sd_hw_data(_hw) container_of(_hw, struct sd_hw_data, hw) -+#define to_clk_hw_data(_hw) container_of(_hw, struct clk_hw_data, hw) -+ -+/** -+ * struct sd_mux_hw_data - SD MUX clock hardware data -+ * @hw_data: clock hw data -+ * @mtable: clock mux table -+ */ -+struct sd_mux_hw_data { -+ struct clk_hw_data hw_data; -+ const u32 *mtable; -+}; -+ -+#define to_sd_mux_hw_data(_hw) container_of(_hw, struct sd_mux_hw_data, hw_data) - - struct rzg2l_pll5_param { - u32 pl5_fracin; -@@ -121,6 +143,76 @@ static void rzg2l_cpg_del_clk_provider(void *data) - of_clk_del_provider(data); - } - -+/* Must be called in atomic context. */ -+static int rzg2l_cpg_wait_clk_update_done(void __iomem *base, u32 conf) -+{ -+ u32 bitmask = GENMASK(GET_WIDTH(conf) - 1, 0) << GET_SHIFT(conf); -+ u32 off = GET_REG_OFFSET(conf); -+ u32 val; -+ -+ return readl_poll_timeout_atomic(base + off, val, !(val & bitmask), 10, 200); -+} -+ -+int rzg2l_cpg_sd_clk_mux_notifier(struct notifier_block *nb, unsigned long event, -+ void *data) -+{ -+ struct clk_notifier_data *cnd = data; -+ struct clk_hw *hw = __clk_get_hw(cnd->clk); -+ struct clk_hw_data *clk_hw_data = to_clk_hw_data(hw); -+ struct rzg2l_cpg_priv *priv = clk_hw_data->priv; -+ u32 off = GET_REG_OFFSET(clk_hw_data->conf); -+ u32 shift = GET_SHIFT(clk_hw_data->conf); -+ const u32 clk_src_266 = 3; -+ unsigned long flags; -+ int ret; -+ -+ if (event != PRE_RATE_CHANGE || (cnd->new_rate / MEGA == 266)) -+ return NOTIFY_DONE; -+ -+ spin_lock_irqsave(&priv->rmw_lock, flags); -+ -+ /* -+ * As per the HW manual, we should not directly switch from 533 MHz to -+ * 400 MHz and vice versa. To change the setting from 2’b01 (533 MHz) -+ * to 2’b10 (400 MHz) or vice versa, Switch to 2’b11 (266 MHz) first, -+ * and then switch to the target setting (2’b01 (533 MHz) or 2’b10 -+ * (400 MHz)). -+ * Setting a value of '0' to the SEL_SDHI0_SET or SEL_SDHI1_SET clock -+ * switching register is prohibited. -+ * The clock mux has 3 input clocks(533 MHz, 400 MHz, and 266 MHz), and -+ * the index to value mapping is done by adding 1 to the index. -+ */ -+ -+ writel((CPG_WEN_BIT | clk_src_266) << shift, priv->base + off); -+ -+ /* Wait for the update done. */ -+ ret = rzg2l_cpg_wait_clk_update_done(priv->base, clk_hw_data->sconf); -+ -+ spin_unlock_irqrestore(&priv->rmw_lock, flags); -+ -+ if (ret) -+ dev_err(priv->dev, "failed to switch to safe clk source\n"); -+ -+ return notifier_from_errno(ret); -+} -+ -+static int rzg2l_register_notifier(struct clk_hw *hw, const struct cpg_core_clk *core, -+ struct rzg2l_cpg_priv *priv) -+{ -+ struct notifier_block *nb; -+ -+ if (!core->notifier) -+ return 0; -+ -+ nb = devm_kzalloc(priv->dev, sizeof(*nb), GFP_KERNEL); -+ if (!nb) -+ return -ENOMEM; -+ -+ nb->notifier_call = core->notifier; -+ -+ return clk_notifier_register(hw->clk, nb); -+} -+ - static struct clk * __init - rzg2l_cpg_div_clk_register(const struct cpg_core_clk *core, - struct clk **clks, -@@ -183,63 +275,44 @@ rzg2l_cpg_mux_clk_register(const struct cpg_core_clk *core, - - static int rzg2l_cpg_sd_clk_mux_set_parent(struct clk_hw *hw, u8 index) - { -- struct sd_hw_data *hwdata = to_sd_hw_data(hw); -- struct rzg2l_cpg_priv *priv = hwdata->priv; -- u32 off = GET_REG_OFFSET(hwdata->conf); -- u32 shift = GET_SHIFT(hwdata->conf); -- const u32 clk_src_266 = 2; -- u32 msk, val, bitmask; -+ struct clk_hw_data *clk_hw_data = to_clk_hw_data(hw); -+ struct sd_mux_hw_data *sd_mux_hw_data = to_sd_mux_hw_data(clk_hw_data); -+ struct rzg2l_cpg_priv *priv = clk_hw_data->priv; -+ u32 off = GET_REG_OFFSET(clk_hw_data->conf); -+ u32 shift = GET_SHIFT(clk_hw_data->conf); - unsigned long flags; -+ u32 val; - int ret; - -- /* -- * As per the HW manual, we should not directly switch from 533 MHz to -- * 400 MHz and vice versa. To change the setting from 2’b01 (533 MHz) -- * to 2’b10 (400 MHz) or vice versa, Switch to 2’b11 (266 MHz) first, -- * and then switch to the target setting (2’b01 (533 MHz) or 2’b10 -- * (400 MHz)). -- * Setting a value of '0' to the SEL_SDHI0_SET or SEL_SDHI1_SET clock -- * switching register is prohibited. -- * The clock mux has 3 input clocks(533 MHz, 400 MHz, and 266 MHz), and -- * the index to value mapping is done by adding 1 to the index. -- */ -- bitmask = (GENMASK(GET_WIDTH(hwdata->conf) - 1, 0) << shift) << 16; -- msk = off ? CPG_CLKSTATUS_SELSDHI1_STS : CPG_CLKSTATUS_SELSDHI0_STS; -+ val = clk_mux_index_to_val(sd_mux_hw_data->mtable, CLK_MUX_ROUND_CLOSEST, index); -+ - spin_lock_irqsave(&priv->rmw_lock, flags); -- if (index != clk_src_266) { -- writel(bitmask | ((clk_src_266 + 1) << shift), priv->base + off); -- -- ret = readl_poll_timeout_atomic(priv->base + CPG_CLKSTATUS, val, -- !(val & msk), 10, -- CPG_SDHI_CLK_SWITCH_STATUS_TIMEOUT_US); -- if (ret) -- goto unlock; -- } - -- writel(bitmask | ((index + 1) << shift), priv->base + off); -+ writel((CPG_WEN_BIT | val) << shift, priv->base + off); -+ -+ /* Wait for the update done. */ -+ ret = rzg2l_cpg_wait_clk_update_done(priv->base, clk_hw_data->sconf); - -- ret = readl_poll_timeout_atomic(priv->base + CPG_CLKSTATUS, val, -- !(val & msk), 10, -- CPG_SDHI_CLK_SWITCH_STATUS_TIMEOUT_US); --unlock: - spin_unlock_irqrestore(&priv->rmw_lock, flags); - - if (ret) -- dev_err(priv->dev, "failed to switch clk source\n"); -+ dev_err(priv->dev, "Failed to switch parent\n"); - - return ret; - } - - static u8 rzg2l_cpg_sd_clk_mux_get_parent(struct clk_hw *hw) - { -- struct sd_hw_data *hwdata = to_sd_hw_data(hw); -- struct rzg2l_cpg_priv *priv = hwdata->priv; -- u32 val = readl(priv->base + GET_REG_OFFSET(hwdata->conf)); -+ struct clk_hw_data *clk_hw_data = to_clk_hw_data(hw); -+ struct sd_mux_hw_data *sd_mux_hw_data = to_sd_mux_hw_data(clk_hw_data); -+ struct rzg2l_cpg_priv *priv = clk_hw_data->priv; -+ u32 val; - -- val >>= GET_SHIFT(hwdata->conf); -- val &= GENMASK(GET_WIDTH(hwdata->conf) - 1, 0); -+ val = readl(priv->base + GET_REG_OFFSET(clk_hw_data->conf)); -+ val >>= GET_SHIFT(clk_hw_data->conf); -+ val &= GENMASK(GET_WIDTH(clk_hw_data->conf) - 1, 0); - -- return val ? val - 1 : 0; -+ return clk_mux_val_to_index(hw, sd_mux_hw_data->mtable, CLK_MUX_ROUND_CLOSEST, val); - } - - static const struct clk_ops rzg2l_cpg_sd_clk_mux_ops = { -@@ -253,31 +326,40 @@ rzg2l_cpg_sd_mux_clk_register(const struct cpg_core_clk *core, - void __iomem *base, - struct rzg2l_cpg_priv *priv) - { -- struct sd_hw_data *clk_hw_data; -+ struct sd_mux_hw_data *sd_mux_hw_data; - struct clk_init_data init; - struct clk_hw *clk_hw; - int ret; - -- clk_hw_data = devm_kzalloc(priv->dev, sizeof(*clk_hw_data), GFP_KERNEL); -- if (!clk_hw_data) -+ sd_mux_hw_data = devm_kzalloc(priv->dev, sizeof(*sd_mux_hw_data), GFP_KERNEL); -+ if (!sd_mux_hw_data) - return ERR_PTR(-ENOMEM); - -- clk_hw_data->priv = priv; -- clk_hw_data->conf = core->conf; -+ sd_mux_hw_data->hw_data.priv = priv; -+ sd_mux_hw_data->hw_data.conf = core->conf; -+ sd_mux_hw_data->hw_data.sconf = core->sconf; -+ sd_mux_hw_data->mtable = core->mtable; - - init.name = GET_SHIFT(core->conf) ? "sd1" : "sd0"; - init.ops = &rzg2l_cpg_sd_clk_mux_ops; -- init.flags = 0; -+ init.flags = core->flag; - init.num_parents = core->num_parents; - init.parent_names = core->parent_names; - -- clk_hw = &clk_hw_data->hw; -+ clk_hw = &sd_mux_hw_data->hw_data.hw; - clk_hw->init = &init; - - ret = devm_clk_hw_register(priv->dev, clk_hw); - if (ret) - return ERR_PTR(ret); - -+ ret = rzg2l_register_notifier(clk_hw, core, priv); -+ if (ret) { -+ dev_err(priv->dev, "Failed to register notifier for %s\n", -+ core->name); -+ return ERR_PTR(ret); -+ } -+ - return clk_hw->clk; - } - -diff --git a/drivers/clk/renesas/rzg2l-cpg.h b/drivers/clk/renesas/rzg2l-cpg.h -index 91e9c2569f801b..e662459cc6d963 100644 ---- a/drivers/clk/renesas/rzg2l-cpg.h -+++ b/drivers/clk/renesas/rzg2l-cpg.h -@@ -9,6 +9,8 @@ - #ifndef __RENESAS_RZG2L_CPG_H__ - #define __RENESAS_RZG2L_CPG_H__ - -+#include -+ - #define CPG_SIPLL5_STBY (0x140) - #define CPG_SIPLL5_CLK1 (0x144) - #define CPG_SIPLL5_CLK3 (0x14C) -@@ -19,7 +21,6 @@ - #define CPG_PL2_DDIV (0x204) - #define CPG_PL3A_DDIV (0x208) - #define CPG_PL6_DDIV (0x210) --#define CPG_PL2SDHI_DSEL (0x218) - #define CPG_CLKSTATUS (0x280) - #define CPG_PL3_SSEL (0x408) - #define CPG_PL6_SSEL (0x414) -@@ -43,8 +44,6 @@ - #define CPG_CLKSTATUS_SELSDHI0_STS BIT(28) - #define CPG_CLKSTATUS_SELSDHI1_STS BIT(29) - --#define CPG_SDHI_CLK_SWITCH_STATUS_TIMEOUT_US 200 -- - /* n = 0/1/2 for PLL1/4/6 */ - #define CPG_SAMPLL_CLK1(n) (0x04 + (16 * n)) - #define CPG_SAMPLL_CLK2(n) (0x08 + (16 * n)) -@@ -69,9 +68,6 @@ - #define SEL_PLL6_2 SEL_PLL_PACK(CPG_PL6_ETH_SSEL, 0, 1) - #define SEL_GPU2 SEL_PLL_PACK(CPG_PL6_SSEL, 12, 1) - --#define SEL_SDHI0 DDIV_PACK(CPG_PL2SDHI_DSEL, 0, 2) --#define SEL_SDHI1 DDIV_PACK(CPG_PL2SDHI_DSEL, 4, 2) -- - #define EXTAL_FREQ_IN_MEGA_HZ (24) - - /** -@@ -90,10 +86,13 @@ struct cpg_core_clk { - unsigned int mult; - unsigned int type; - unsigned int conf; -+ unsigned int sconf; - const struct clk_div_table *dtable; -+ const u32 *mtable; - const char * const *parent_names; -- int flag; -- int mux_flags; -+ notifier_fn_t notifier; -+ u32 flag; -+ u32 mux_flags; - int num_parents; - }; - -@@ -151,10 +150,11 @@ enum clk_types { - .parent_names = _parent_names, \ - .num_parents = ARRAY_SIZE(_parent_names), \ - .mux_flags = CLK_MUX_READ_ONLY) --#define DEF_SD_MUX(_name, _id, _conf, _parent_names) \ -- DEF_TYPE(_name, _id, CLK_TYPE_SD_MUX, .conf = _conf, \ -+#define DEF_SD_MUX(_name, _id, _conf, _sconf, _parent_names, _mtable, _clk_flags, _notifier) \ -+ DEF_TYPE(_name, _id, CLK_TYPE_SD_MUX, .conf = _conf, .sconf = _sconf, \ - .parent_names = _parent_names, \ -- .num_parents = ARRAY_SIZE(_parent_names)) -+ .num_parents = ARRAY_SIZE(_parent_names), \ -+ .mtable = _mtable, .flag = _clk_flags, .notifier = _notifier) - #define DEF_PLL5_FOUTPOSTDIV(_name, _id, _parent) \ - DEF_TYPE(_name, _id, CLK_TYPE_SIPLL5, .parent = _parent) - #define DEF_PLL5_4_MUX(_name, _id, _conf, _parent_names) \ -@@ -273,4 +273,6 @@ extern const struct rzg2l_cpg_info r9a07g044_cpg_info; - extern const struct rzg2l_cpg_info r9a07g054_cpg_info; - extern const struct rzg2l_cpg_info r9a09g011_cpg_info; - -+int rzg2l_cpg_sd_clk_mux_notifier(struct notifier_block *nb, unsigned long event, void *data); -+ - #endif -diff --git a/drivers/comedi/drivers/jr3_pci.c b/drivers/comedi/drivers/jr3_pci.c -index 951c23fa0369ea..75dce1ff24193b 100644 ---- a/drivers/comedi/drivers/jr3_pci.c -+++ b/drivers/comedi/drivers/jr3_pci.c -@@ -758,7 +758,7 @@ static void jr3_pci_detach(struct comedi_device *dev) - struct jr3_pci_dev_private *devpriv = dev->private; - - if (devpriv) -- del_timer_sync(&devpriv->timer); -+ timer_shutdown_sync(&devpriv->timer); - - comedi_pci_detach(dev); - } -diff --git a/drivers/cpufreq/apple-soc-cpufreq.c b/drivers/cpufreq/apple-soc-cpufreq.c -index 021f423705e1b1..9ba6b09775f617 100644 ---- a/drivers/cpufreq/apple-soc-cpufreq.c -+++ b/drivers/cpufreq/apple-soc-cpufreq.c -@@ -103,11 +103,17 @@ static const struct of_device_id apple_soc_cpufreq_of_match[] = { - - static unsigned int apple_soc_cpufreq_get_rate(unsigned int cpu) - { -- struct cpufreq_policy *policy = cpufreq_cpu_get_raw(cpu); -- struct apple_cpu_priv *priv = policy->driver_data; -+ struct cpufreq_policy *policy; -+ struct apple_cpu_priv *priv; - struct cpufreq_frequency_table *p; - unsigned int pstate; - -+ policy = cpufreq_cpu_get_raw(cpu); -+ if (unlikely(!policy)) -+ return 0; -+ -+ priv = policy->driver_data; -+ - if (priv->info->cur_pstate_mask) { - u64 reg = readq_relaxed(priv->reg_base + APPLE_DVFS_STATUS); - -diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c -index c8447ecad797e7..aa34af940cb53b 100644 ---- a/drivers/cpufreq/cppc_cpufreq.c -+++ b/drivers/cpufreq/cppc_cpufreq.c -@@ -773,7 +773,7 @@ static unsigned int cppc_cpufreq_get_rate(unsigned int cpu) - int ret; - - if (!policy) -- return -ENODEV; -+ return 0; - - cpu_data = policy->driver_data; - -diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c -index 079940c69ee0ba..e4989764efe2a8 100644 ---- a/drivers/cpufreq/scmi-cpufreq.c -+++ b/drivers/cpufreq/scmi-cpufreq.c -@@ -33,11 +33,17 @@ static const struct scmi_perf_proto_ops *perf_ops; - - static unsigned int scmi_cpufreq_get_rate(unsigned int cpu) - { -- struct cpufreq_policy *policy = cpufreq_cpu_get_raw(cpu); -- struct scmi_data *priv = policy->driver_data; -+ struct cpufreq_policy *policy; -+ struct scmi_data *priv; - unsigned long rate; - int ret; - -+ policy = cpufreq_cpu_get_raw(cpu); -+ if (unlikely(!policy)) -+ return 0; -+ -+ priv = policy->driver_data; -+ - ret = perf_ops->freq_get(ph, priv->domain_id, &rate, false); - if (ret) - return 0; -diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c -index bfc2e65e1e5022..2aef39bff7d6f5 100644 ---- a/drivers/cpufreq/scpi-cpufreq.c -+++ b/drivers/cpufreq/scpi-cpufreq.c -@@ -29,9 +29,16 @@ static struct scpi_ops *scpi_ops; - - static unsigned int scpi_cpufreq_get_rate(unsigned int cpu) - { -- struct cpufreq_policy *policy = cpufreq_cpu_get_raw(cpu); -- struct scpi_data *priv = policy->driver_data; -- unsigned long rate = clk_get_rate(priv->clk); -+ struct cpufreq_policy *policy; -+ struct scpi_data *priv; -+ unsigned long rate; -+ -+ policy = cpufreq_cpu_get_raw(cpu); -+ if (unlikely(!policy)) -+ return 0; -+ -+ priv = policy->driver_data; -+ rate = clk_get_rate(priv->clk); - - return rate / 1000; - } -diff --git a/drivers/crypto/atmel-sha204a.c b/drivers/crypto/atmel-sha204a.c -index c77f482d2a97e9..5bc809146ffea0 100644 ---- a/drivers/crypto/atmel-sha204a.c -+++ b/drivers/crypto/atmel-sha204a.c -@@ -107,6 +107,12 @@ static int atmel_sha204a_probe(struct i2c_client *client) - i2c_priv->hwrng.name = dev_name(&client->dev); - i2c_priv->hwrng.read = atmel_sha204a_rng_read; - -+ /* -+ * According to review by Bill Cox [1], this HWRNG has very low entropy. -+ * [1] https://www.metzdowd.com/pipermail/cryptography/2014-December/023858.html -+ */ -+ i2c_priv->hwrng.quality = 1; -+ - ret = devm_hwrng_register(&client->dev, &i2c_priv->hwrng); - if (ret) - dev_warn(&client->dev, "failed to register RNG (%d)\n", ret); -diff --git a/drivers/crypto/ccp/sp-pci.c b/drivers/crypto/ccp/sp-pci.c -index 0caa57dafc525a..b1e60542351a66 100644 ---- a/drivers/crypto/ccp/sp-pci.c -+++ b/drivers/crypto/ccp/sp-pci.c -@@ -577,6 +577,7 @@ static const struct pci_device_id sp_pci_table[] = { - { PCI_VDEVICE(AMD, 0x14CA), (kernel_ulong_t)&dev_vdata[5] }, - { PCI_VDEVICE(AMD, 0x15C7), (kernel_ulong_t)&dev_vdata[6] }, - { PCI_VDEVICE(AMD, 0x1649), (kernel_ulong_t)&dev_vdata[6] }, -+ { PCI_VDEVICE(AMD, 0x1134), (kernel_ulong_t)&dev_vdata[7] }, - { PCI_VDEVICE(AMD, 0x17E0), (kernel_ulong_t)&dev_vdata[7] }, - { PCI_VDEVICE(AMD, 0x156E), (kernel_ulong_t)&dev_vdata[8] }, - /* Last entry must be zero */ -diff --git a/drivers/cxl/core/regs.c b/drivers/cxl/core/regs.c -index bab4592db647f7..92ef68849fbea8 100644 ---- a/drivers/cxl/core/regs.c -+++ b/drivers/cxl/core/regs.c -@@ -478,7 +478,6 @@ resource_size_t __rcrb_to_component(struct device *dev, struct cxl_rcrb_info *ri - resource_size_t rcrb = ri->base; - void __iomem *addr; - u32 bar0, bar1; -- u16 cmd; - u32 id; - - if (which == CXL_RCRB_UPSTREAM) -@@ -500,7 +499,6 @@ resource_size_t __rcrb_to_component(struct device *dev, struct cxl_rcrb_info *ri - } - - id = readl(addr + PCI_VENDOR_ID); -- cmd = readw(addr + PCI_COMMAND); - bar0 = readl(addr + PCI_BASE_ADDRESS_0); - bar1 = readl(addr + PCI_BASE_ADDRESS_1); - iounmap(addr); -@@ -515,8 +513,6 @@ resource_size_t __rcrb_to_component(struct device *dev, struct cxl_rcrb_info *ri - dev_err(dev, "Failed to access Downstream Port RCRB\n"); - return CXL_RESOURCE_NONE; - } -- if (!(cmd & PCI_COMMAND_MEMORY)) -- return CXL_RESOURCE_NONE; - /* The RCRB is a Memory Window, and the MEM_TYPE_1M bit is obsolete */ - if (bar0 & (PCI_BASE_ADDRESS_MEM_TYPE_1M | PCI_BASE_ADDRESS_SPACE_IO)) - return CXL_RESOURCE_NONE; -diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c -index d1fcdd1f9aaed3..373282beeb6068 100644 ---- a/drivers/dma-buf/udmabuf.c -+++ b/drivers/dma-buf/udmabuf.c -@@ -214,7 +214,7 @@ static long udmabuf_create(struct miscdevice *device, - if (!ubuf) - return -ENOMEM; - -- pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT; -+ pglimit = ((u64)size_limit_mb * 1024 * 1024) >> PAGE_SHIFT; - for (i = 0; i < head->count; i++) { - if (!IS_ALIGNED(list[i].offset, PAGE_SIZE)) - goto err; -diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c -index ffe621695e472b..78b8a97b236376 100644 ---- a/drivers/dma/dmatest.c -+++ b/drivers/dma/dmatest.c -@@ -827,9 +827,9 @@ static int dmatest_func(void *data) - } else { - dma_async_issue_pending(chan); - -- wait_event_freezable_timeout(thread->done_wait, -- done->done, -- msecs_to_jiffies(params->timeout)); -+ wait_event_timeout(thread->done_wait, -+ done->done, -+ msecs_to_jiffies(params->timeout)); - - status = dma_async_is_tx_complete(chan, cookie, NULL, - NULL); -diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c -index cec9e8f29bbdfe..a0a2a0f75bba46 100644 ---- a/drivers/gpio/gpiolib-of.c -+++ b/drivers/gpio/gpiolib-of.c -@@ -247,6 +247,9 @@ static void of_gpio_set_polarity_by_property(const struct device_node *np, - { "fsl,imx8qm-fec", "phy-reset-gpios", "phy-reset-active-high" }, - { "fsl,s32v234-fec", "phy-reset-gpios", "phy-reset-active-high" }, - #endif -+#if IS_ENABLED(CONFIG_MMC_ATMELMCI) -+ { "atmel,hsmci", "cd-gpios", "cd-inverted" }, -+#endif - #if IS_ENABLED(CONFIG_PCI_IMX6) - { "fsl,imx6q-pcie", "reset-gpio", "reset-gpio-active-high" }, - { "fsl,imx6sx-pcie", "reset-gpio", "reset-gpio-active-high" }, -@@ -272,9 +275,6 @@ static void of_gpio_set_polarity_by_property(const struct device_node *np, - #if IS_ENABLED(CONFIG_REGULATOR_GPIO) - { "regulator-gpio", "enable-gpio", "enable-active-high" }, - { "regulator-gpio", "enable-gpios", "enable-active-high" }, --#endif --#if IS_ENABLED(CONFIG_MMC_ATMELMCI) -- { "atmel,hsmci", "cd-gpios", "cd-inverted" }, - #endif - }; - unsigned int i; -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 28f2b4022d34e3..e6bc590533194d 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -2789,16 +2789,16 @@ static void dm_gpureset_commit_state(struct dc_state *dc_state, - for (k = 0; k < dc_state->stream_count; k++) { - bundle->stream_update.stream = dc_state->streams[k]; - -- for (m = 0; m < dc_state->stream_status->plane_count; m++) { -+ for (m = 0; m < dc_state->stream_status[k].plane_count; m++) { - bundle->surface_updates[m].surface = -- dc_state->stream_status->plane_states[m]; -+ dc_state->stream_status[k].plane_states[m]; - bundle->surface_updates[m].surface->force_full_update = - true; - } - - update_planes_and_stream_adapter(dm->dc, - UPDATE_TYPE_FULL, -- dc_state->stream_status->plane_count, -+ dc_state->stream_status[k].plane_count, - dc_state->streams[k], - &bundle->stream_update, - bundle->surface_updates); -@@ -9590,6 +9590,9 @@ static bool should_reset_plane(struct drm_atomic_state *state, - if (adev->ip_versions[DCE_HWIP][0] < IP_VERSION(3, 2, 0) && state->allow_modeset) - return true; - -+ if (amdgpu_in_reset(adev) && state->allow_modeset) -+ return true; -+ - /* Exit early if we know that we're adding or removing the plane. */ - if (old_plane_state->crtc != new_plane_state->crtc) - return true; -diff --git a/drivers/iio/adc/ad7768-1.c b/drivers/iio/adc/ad7768-1.c -index 70a25949142c0d..74b0c85944bd61 100644 ---- a/drivers/iio/adc/ad7768-1.c -+++ b/drivers/iio/adc/ad7768-1.c -@@ -142,7 +142,7 @@ static const struct iio_chan_spec ad7768_channels[] = { - .channel = 0, - .scan_index = 0, - .scan_type = { -- .sign = 'u', -+ .sign = 's', - .realbits = 24, - .storagebits = 32, - .shift = 8, -@@ -370,12 +370,11 @@ static int ad7768_read_raw(struct iio_dev *indio_dev, - return ret; - - ret = ad7768_scan_direct(indio_dev); -- if (ret >= 0) -- *val = ret; - - iio_device_release_direct_mode(indio_dev); - if (ret < 0) - return ret; -+ *val = sign_extend32(ret, chan->scan_type.realbits - 1); - - return IIO_VAL_INT; - -diff --git a/drivers/infiniband/hw/qib/qib_fs.c b/drivers/infiniband/hw/qib/qib_fs.c -index 11155e0fb8395c..35d777976c2952 100644 ---- a/drivers/infiniband/hw/qib/qib_fs.c -+++ b/drivers/infiniband/hw/qib/qib_fs.c -@@ -55,6 +55,7 @@ static int qibfs_mknod(struct inode *dir, struct dentry *dentry, - struct inode *inode = new_inode(dir->i_sb); - - if (!inode) { -+ dput(dentry); - error = -EPERM; - goto bail; - } -diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c -index 95bd7c25ba6f36..83c5d786686d07 100644 ---- a/drivers/iommu/amd/iommu.c -+++ b/drivers/iommu/amd/iommu.c -@@ -3619,7 +3619,7 @@ static int amd_ir_set_vcpu_affinity(struct irq_data *data, void *vcpu_info) - * we should not modify the IRTE - */ - if (!dev_data || !dev_data->use_vapic) -- return 0; -+ return -EINVAL; - - ir_data->cfg = irqd_cfg(data); - pi_data->ir_data = ir_data; -diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c -index d83c2c85962c37..683e8721e3b498 100644 ---- a/drivers/irqchip/irq-gic-v2m.c -+++ b/drivers/irqchip/irq-gic-v2m.c -@@ -454,7 +454,7 @@ static int __init gicv2m_of_init(struct fwnode_handle *parent_handle, - #ifdef CONFIG_ACPI - static int acpi_num_msi; - --static __init struct fwnode_handle *gicv2m_get_fwnode(struct device *dev) -+static struct fwnode_handle *gicv2m_get_fwnode(struct device *dev) - { - struct v2m_data *data; - -diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c -index 82102a4c5d6883..f8215a8f656a46 100644 ---- a/drivers/mailbox/pcc.c -+++ b/drivers/mailbox/pcc.c -@@ -313,6 +313,10 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p) - int ret; - - pchan = chan->con_priv; -+ -+ if (pcc_chan_reg_read_modify_write(&pchan->plat_irq_ack)) -+ return IRQ_NONE; -+ - if (pchan->type == ACPI_PCCT_TYPE_EXT_PCC_MASTER_SUBSPACE && - !pchan->chan_in_use) - return IRQ_NONE; -@@ -330,13 +334,16 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p) - return IRQ_NONE; - } - -- if (pcc_chan_reg_read_modify_write(&pchan->plat_irq_ack)) -- return IRQ_NONE; -- -+ /* -+ * Clear this flag after updating interrupt ack register and just -+ * before mbox_chan_received_data() which might call pcc_send_data() -+ * where the flag is set again to start new transfer. This is -+ * required to avoid any possible race in updatation of this flag. -+ */ -+ pchan->chan_in_use = false; - mbox_chan_received_data(chan, NULL); - - check_and_ack(pchan, chan); -- pchan->chan_in_use = false; - - return IRQ_HANDLED; - } -diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c -index 1ae37e693de045..d080e21df666d9 100644 ---- a/drivers/mcb/mcb-parse.c -+++ b/drivers/mcb/mcb-parse.c -@@ -101,7 +101,7 @@ static int chameleon_parse_gdd(struct mcb_bus *bus, - - ret = mcb_device_register(bus, mdev); - if (ret < 0) -- goto err; -+ return ret; - - return 0; - -diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index 65309da1dca340..8b25287c89ed6d 100644 ---- a/drivers/md/raid1.c -+++ b/drivers/md/raid1.c -@@ -2061,14 +2061,9 @@ static int fix_sync_read_error(struct r1bio *r1_bio) - if (!rdev_set_badblocks(rdev, sect, s, 0)) - abort = 1; - } -- if (abort) { -- conf->recovery_disabled = -- mddev->recovery_disabled; -- set_bit(MD_RECOVERY_INTR, &mddev->recovery); -- md_done_sync(mddev, r1_bio->sectors, 0); -- put_buf(r1_bio); -+ if (abort) - return 0; -- } -+ - /* Try next page */ - sectors -= s; - sect += s; -@@ -2207,10 +2202,21 @@ static void sync_request_write(struct mddev *mddev, struct r1bio *r1_bio) - int disks = conf->raid_disks * 2; - struct bio *wbio; - -- if (!test_bit(R1BIO_Uptodate, &r1_bio->state)) -- /* ouch - failed to read all of that. */ -- if (!fix_sync_read_error(r1_bio)) -+ if (!test_bit(R1BIO_Uptodate, &r1_bio->state)) { -+ /* -+ * ouch - failed to read all of that. -+ * No need to fix read error for check/repair -+ * because all member disks are read. -+ */ -+ if (test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery) || -+ !fix_sync_read_error(r1_bio)) { -+ conf->recovery_disabled = mddev->recovery_disabled; -+ set_bit(MD_RECOVERY_INTR, &mddev->recovery); -+ md_done_sync(mddev, r1_bio->sectors, 0); -+ put_buf(r1_bio); - return; -+ } -+ } - - if (test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) - process_checks(r1_bio); -diff --git a/drivers/media/test-drivers/vimc/vimc-streamer.c b/drivers/media/test-drivers/vimc/vimc-streamer.c -index 807551a5143b78..15d863f97cbf96 100644 ---- a/drivers/media/test-drivers/vimc/vimc-streamer.c -+++ b/drivers/media/test-drivers/vimc/vimc-streamer.c -@@ -59,6 +59,12 @@ static void vimc_streamer_pipeline_terminate(struct vimc_stream *stream) - continue; - - sd = media_entity_to_v4l2_subdev(ved->ent); -+ /* -+ * Do not call .s_stream() to stop an already -+ * stopped/unstarted subdev. -+ */ -+ if (!v4l2_subdev_is_streaming(sd)) -+ continue; - v4l2_subdev_call(sd, video, s_stream, 0); - } - } -diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c -index a32ef739eb4490..5f115438d07228 100644 ---- a/drivers/media/v4l2-core/v4l2-subdev.c -+++ b/drivers/media/v4l2-core/v4l2-subdev.c -@@ -363,12 +363,8 @@ static int call_s_stream(struct v4l2_subdev *sd, int enable) - * The .s_stream() operation must never be called to start or stop an - * already started or stopped subdev. Catch offenders but don't return - * an error yet to avoid regressions. -- * -- * As .s_stream() is mutually exclusive with the .enable_streams() and -- * .disable_streams() operation, we can use the enabled_streams field -- * to store the subdev streaming state. - */ -- if (WARN_ON(!!sd->enabled_streams == !!enable)) -+ if (WARN_ON(sd->s_stream_enabled == !!enable)) - return 0; - - ret = sd->ops->video->s_stream(sd, enable); -@@ -379,7 +375,7 @@ static int call_s_stream(struct v4l2_subdev *sd, int enable) - } - - if (!ret) { -- sd->enabled_streams = enable ? BIT(0) : 0; -+ sd->s_stream_enabled = enable; - - #if IS_REACHABLE(CONFIG_LEDS_CLASS) - if (!IS_ERR_OR_NULL(sd->privacy_led)) { -@@ -1929,37 +1925,43 @@ static int v4l2_subdev_enable_streams_fallback(struct v4l2_subdev *sd, u32 pad, - u64 streams_mask) - { - struct device *dev = sd->entity.graph_obj.mdev->dev; -- unsigned int i; - int ret; - - /* - * The subdev doesn't implement pad-based stream enable, fall back -- * on the .s_stream() operation. This can only be done for subdevs that -- * have a single source pad, as sd->enabled_streams is global to the -- * subdev. -+ * to the .s_stream() operation. - */ - if (!(sd->entity.pads[pad].flags & MEDIA_PAD_FL_SOURCE)) - return -EOPNOTSUPP; - -- for (i = 0; i < sd->entity.num_pads; ++i) { -- if (i != pad && sd->entity.pads[i].flags & MEDIA_PAD_FL_SOURCE) -- return -EOPNOTSUPP; -- } -+ /* -+ * .s_stream() means there is no streams support, so the only allowed -+ * stream is the implicit stream 0. -+ */ -+ if (streams_mask != BIT_ULL(0)) -+ return -EOPNOTSUPP; -+ -+ /* -+ * We use a 64-bit bitmask for tracking enabled pads, so only subdevices -+ * with 64 pads or less can be supported. -+ */ -+ if (pad >= sizeof(sd->enabled_pads) * BITS_PER_BYTE) -+ return -EOPNOTSUPP; - -- if (sd->enabled_streams & streams_mask) { -- dev_dbg(dev, "set of streams %#llx already enabled on %s:%u\n", -- streams_mask, sd->entity.name, pad); -+ if (sd->enabled_pads & BIT_ULL(pad)) { -+ dev_dbg(dev, "pad %u already enabled on %s\n", -+ pad, sd->entity.name); - return -EALREADY; - } - -- /* Start streaming when the first streams are enabled. */ -- if (!sd->enabled_streams) { -+ /* Start streaming when the first pad is enabled. */ -+ if (!sd->enabled_pads) { - ret = v4l2_subdev_call(sd, video, s_stream, 1); - if (ret) - return ret; - } - -- sd->enabled_streams |= streams_mask; -+ sd->enabled_pads |= BIT_ULL(pad); - - return 0; - } -@@ -2046,37 +2048,43 @@ static int v4l2_subdev_disable_streams_fallback(struct v4l2_subdev *sd, u32 pad, - u64 streams_mask) - { - struct device *dev = sd->entity.graph_obj.mdev->dev; -- unsigned int i; - int ret; - - /* -- * If the subdev doesn't implement pad-based stream enable, fall back -- * on the .s_stream() operation. This can only be done for subdevs that -- * have a single source pad, as sd->enabled_streams is global to the -- * subdev. -+ * If the subdev doesn't implement pad-based stream enable, fall back -+ * to the .s_stream() operation. - */ - if (!(sd->entity.pads[pad].flags & MEDIA_PAD_FL_SOURCE)) - return -EOPNOTSUPP; - -- for (i = 0; i < sd->entity.num_pads; ++i) { -- if (i != pad && sd->entity.pads[i].flags & MEDIA_PAD_FL_SOURCE) -- return -EOPNOTSUPP; -- } -+ /* -+ * .s_stream() means there is no streams support, so the only allowed -+ * stream is the implicit stream 0. -+ */ -+ if (streams_mask != BIT_ULL(0)) -+ return -EOPNOTSUPP; -+ -+ /* -+ * We use a 64-bit bitmask for tracking enabled pads, so only subdevices -+ * with 64 pads or less can be supported. -+ */ -+ if (pad >= sizeof(sd->enabled_pads) * BITS_PER_BYTE) -+ return -EOPNOTSUPP; - -- if ((sd->enabled_streams & streams_mask) != streams_mask) { -- dev_dbg(dev, "set of streams %#llx already disabled on %s:%u\n", -- streams_mask, sd->entity.name, pad); -+ if (!(sd->enabled_pads & BIT_ULL(pad))) { -+ dev_dbg(dev, "pad %u already disabled on %s\n", -+ pad, sd->entity.name); - return -EALREADY; - } - - /* Stop streaming when the last streams are disabled. */ -- if (!(sd->enabled_streams & ~streams_mask)) { -+ if (!(sd->enabled_pads & ~BIT_ULL(pad))) { - ret = v4l2_subdev_call(sd, video, s_stream, 0); - if (ret) - return ret; - } - -- sd->enabled_streams &= ~streams_mask; -+ sd->enabled_pads &= ~BIT_ULL(pad); - - return 0; - } -@@ -2232,6 +2240,31 @@ void v4l2_subdev_notify_event(struct v4l2_subdev *sd, - } - EXPORT_SYMBOL_GPL(v4l2_subdev_notify_event); - -+bool v4l2_subdev_is_streaming(struct v4l2_subdev *sd) -+{ -+ struct v4l2_subdev_state *state; -+ -+ if (!v4l2_subdev_has_op(sd, pad, enable_streams)) -+ return sd->s_stream_enabled; -+ -+ if (!(sd->flags & V4L2_SUBDEV_FL_STREAMS)) -+ return !!sd->enabled_pads; -+ -+ state = v4l2_subdev_get_locked_active_state(sd); -+ -+ for (unsigned int i = 0; i < state->stream_configs.num_configs; ++i) { -+ const struct v4l2_subdev_stream_config *cfg; -+ -+ cfg = &state->stream_configs.configs[i]; -+ -+ if (cfg->enabled) -+ return true; -+ } -+ -+ return false; -+} -+EXPORT_SYMBOL_GPL(v4l2_subdev_is_streaming); -+ - int v4l2_subdev_get_privacy_led(struct v4l2_subdev *sd) - { - #if IS_REACHABLE(CONFIG_LEDS_CLASS) -diff --git a/drivers/misc/lkdtm/perms.c b/drivers/misc/lkdtm/perms.c -index 5b861dbff27e9a..6c24426104ba6f 100644 ---- a/drivers/misc/lkdtm/perms.c -+++ b/drivers/misc/lkdtm/perms.c -@@ -28,6 +28,13 @@ static const unsigned long rodata = 0xAA55AA55; - /* This is marked __ro_after_init, so it should ultimately be .rodata. */ - static unsigned long ro_after_init __ro_after_init = 0x55AA5500; - -+/* -+ * This is a pointer to do_nothing() which is initialized at runtime rather -+ * than build time to avoid objtool IBT validation warnings caused by an -+ * inlined unrolled memcpy() in execute_location(). -+ */ -+static void __ro_after_init *do_nothing_ptr; -+ - /* - * This just returns to the caller. It is designed to be copied into - * non-executable memory regions. -@@ -65,13 +72,12 @@ static noinline __nocfi void execute_location(void *dst, bool write) - { - void (*func)(void); - func_desc_t fdesc; -- void *do_nothing_text = dereference_function_descriptor(do_nothing); - -- pr_info("attempting ok execution at %px\n", do_nothing_text); -+ pr_info("attempting ok execution at %px\n", do_nothing_ptr); - do_nothing(); - - if (write == CODE_WRITE) { -- memcpy(dst, do_nothing_text, EXEC_SIZE); -+ memcpy(dst, do_nothing_ptr, EXEC_SIZE); - flush_icache_range((unsigned long)dst, - (unsigned long)dst + EXEC_SIZE); - } -@@ -267,6 +273,8 @@ static void lkdtm_ACCESS_NULL(void) - - void __init lkdtm_perms_init(void) - { -+ do_nothing_ptr = dereference_function_descriptor(do_nothing); -+ - /* Make sure we can write to __ro_after_init values during __init */ - ro_after_init |= 0xAA; - } -diff --git a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c -index 3c1359d8d4e692..55b892f982e93e 100644 ---- a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c -+++ b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c -@@ -37,6 +37,7 @@ - struct pci1xxxx_gpio { - struct auxiliary_device *aux_dev; - void __iomem *reg_base; -+ raw_spinlock_t wa_lock; - struct gpio_chip gpio; - spinlock_t lock; - int irq_base; -@@ -164,7 +165,7 @@ static void pci1xxxx_gpio_irq_ack(struct irq_data *data) - unsigned long flags; - - spin_lock_irqsave(&priv->lock, flags); -- pci1xxx_assign_bit(priv->reg_base, INTR_STAT_OFFSET(gpio), (gpio % 32), true); -+ writel(BIT(gpio % 32), priv->reg_base + INTR_STAT_OFFSET(gpio)); - spin_unlock_irqrestore(&priv->lock, flags); - } - -@@ -254,6 +255,7 @@ static irqreturn_t pci1xxxx_gpio_irq_handler(int irq, void *dev_id) - struct pci1xxxx_gpio *priv = dev_id; - struct gpio_chip *gc = &priv->gpio; - unsigned long int_status = 0; -+ unsigned long wa_flags; - unsigned long flags; - u8 pincount; - int bit; -@@ -277,7 +279,9 @@ static irqreturn_t pci1xxxx_gpio_irq_handler(int irq, void *dev_id) - writel(BIT(bit), priv->reg_base + INTR_STATUS_OFFSET(gpiobank)); - spin_unlock_irqrestore(&priv->lock, flags); - irq = irq_find_mapping(gc->irq.domain, (bit + (gpiobank * 32))); -- handle_nested_irq(irq); -+ raw_spin_lock_irqsave(&priv->wa_lock, wa_flags); -+ generic_handle_irq(irq); -+ raw_spin_unlock_irqrestore(&priv->wa_lock, wa_flags); - } - } - spin_lock_irqsave(&priv->lock, flags); -diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h -index a4668ddd94551a..4adfa5af162f1d 100644 ---- a/drivers/misc/mei/hw-me-regs.h -+++ b/drivers/misc/mei/hw-me-regs.h -@@ -117,6 +117,7 @@ - - #define MEI_DEV_ID_LNL_M 0xA870 /* Lunar Lake Point M */ - -+#define MEI_DEV_ID_PTL_H 0xE370 /* Panther Lake H */ - #define MEI_DEV_ID_PTL_P 0xE470 /* Panther Lake P */ - - /* -diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c -index 6826cc50d29f36..93b98a7f4c7fd9 100644 ---- a/drivers/misc/mei/pci-me.c -+++ b/drivers/misc/mei/pci-me.c -@@ -124,6 +124,7 @@ static const struct pci_device_id mei_me_pci_tbl[] = { - - {MEI_PCI_DEVICE(MEI_DEV_ID_LNL_M, MEI_ME_PCH15_CFG)}, - -+ {MEI_PCI_DEVICE(MEI_DEV_ID_PTL_H, MEI_ME_PCH15_CFG)}, - {MEI_PCI_DEVICE(MEI_DEV_ID_PTL_P, MEI_ME_PCH15_CFG)}, - - /* required last entry */ -diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c -index 945d08531de376..82808cc373f68b 100644 ---- a/drivers/mmc/host/sdhci-msm.c -+++ b/drivers/mmc/host/sdhci-msm.c -@@ -1866,7 +1866,7 @@ static int sdhci_msm_ice_init(struct sdhci_msm_host *msm_host, - if (!(cqhci_readl(cq_host, CQHCI_CAP) & CQHCI_CAP_CS)) - return 0; - -- ice = of_qcom_ice_get(dev); -+ ice = devm_of_qcom_ice_get(dev); - if (ice == ERR_PTR(-EOPNOTSUPP)) { - dev_warn(dev, "Disabling inline encryption support\n"); - ice = NULL; -diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c -index 90ab2f1058ce0e..2d18a03d927421 100644 ---- a/drivers/net/dsa/mt7530.c -+++ b/drivers/net/dsa/mt7530.c -@@ -2596,6 +2596,9 @@ mt7531_setup_common(struct dsa_switch *ds) - struct mt7530_priv *priv = ds->priv; - int ret, i; - -+ ds->assisted_learning_on_cpu_port = true; -+ ds->mtu_enforcement_ingress = true; -+ - mt753x_trap_frames(priv); - - /* Enable and reset MIB counters */ -@@ -2735,9 +2738,6 @@ mt7531_setup(struct dsa_switch *ds) - - mt7531_setup_common(ds); - -- ds->assisted_learning_on_cpu_port = true; -- ds->mtu_enforcement_ingress = true; -- - return 0; - } - -diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c -index da7260e505a2e4..ef52d1ae27d694 100644 ---- a/drivers/net/dsa/mv88e6xxx/chip.c -+++ b/drivers/net/dsa/mv88e6xxx/chip.c -@@ -5047,6 +5047,7 @@ static const struct mv88e6xxx_ops mv88e6320_ops = { - .port_set_rgmii_delay = mv88e6320_port_set_rgmii_delay, - .port_set_speed_duplex = mv88e6185_port_set_speed_duplex, - .port_tag_remap = mv88e6095_port_tag_remap, -+ .port_set_policy = mv88e6352_port_set_policy, - .port_set_frame_mode = mv88e6351_port_set_frame_mode, - .port_set_ucast_flood = mv88e6352_port_set_ucast_flood, - .port_set_mcast_flood = mv88e6352_port_set_mcast_flood, -@@ -5071,8 +5072,10 @@ static const struct mv88e6xxx_ops mv88e6320_ops = { - .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, - .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, - .reset = mv88e6352_g1_reset, -- .vtu_getnext = mv88e6185_g1_vtu_getnext, -- .vtu_loadpurge = mv88e6185_g1_vtu_loadpurge, -+ .vtu_getnext = mv88e6352_g1_vtu_getnext, -+ .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge, -+ .stu_getnext = mv88e6352_g1_stu_getnext, -+ .stu_loadpurge = mv88e6352_g1_stu_loadpurge, - .gpio_ops = &mv88e6352_gpio_ops, - .avb_ops = &mv88e6352_avb_ops, - .ptp_ops = &mv88e6352_ptp_ops, -@@ -5097,6 +5100,7 @@ static const struct mv88e6xxx_ops mv88e6321_ops = { - .port_set_rgmii_delay = mv88e6320_port_set_rgmii_delay, - .port_set_speed_duplex = mv88e6185_port_set_speed_duplex, - .port_tag_remap = mv88e6095_port_tag_remap, -+ .port_set_policy = mv88e6352_port_set_policy, - .port_set_frame_mode = mv88e6351_port_set_frame_mode, - .port_set_ucast_flood = mv88e6352_port_set_ucast_flood, - .port_set_mcast_flood = mv88e6352_port_set_mcast_flood, -@@ -5120,8 +5124,10 @@ static const struct mv88e6xxx_ops mv88e6321_ops = { - .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, - .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, - .reset = mv88e6352_g1_reset, -- .vtu_getnext = mv88e6185_g1_vtu_getnext, -- .vtu_loadpurge = mv88e6185_g1_vtu_loadpurge, -+ .vtu_getnext = mv88e6352_g1_vtu_getnext, -+ .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge, -+ .stu_getnext = mv88e6352_g1_stu_getnext, -+ .stu_loadpurge = mv88e6352_g1_stu_loadpurge, - .gpio_ops = &mv88e6352_gpio_ops, - .avb_ops = &mv88e6352_avb_ops, - .ptp_ops = &mv88e6352_ptp_ops, -@@ -5713,7 +5719,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { - .global1_addr = 0x1b, - .global2_addr = 0x1c, - .age_time_coeff = 3750, -- .atu_move_port_mask = 0x1f, -+ .atu_move_port_mask = 0xf, - .g1_irqs = 9, - .g2_irqs = 10, - .pvt = true, -@@ -6114,9 +6120,11 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { - .num_databases = 4096, - .num_macs = 8192, - .num_ports = 7, -- .num_internal_phys = 5, -+ .num_internal_phys = 2, -+ .internal_phys_offset = 3, - .num_gpio = 15, - .max_vid = 4095, -+ .max_sid = 63, - .port_base_addr = 0x10, - .phy_base_addr = 0x0, - .global1_addr = 0x1b, -@@ -6139,9 +6147,11 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { - .num_databases = 4096, - .num_macs = 8192, - .num_ports = 7, -- .num_internal_phys = 5, -+ .num_internal_phys = 2, -+ .internal_phys_offset = 3, - .num_gpio = 15, - .max_vid = 4095, -+ .max_sid = 63, - .port_base_addr = 0x10, - .phy_base_addr = 0x0, - .global1_addr = 0x1b, -@@ -6150,6 +6160,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { - .g1_irqs = 8, - .g2_irqs = 10, - .atu_move_port_mask = 0xf, -+ .pvt = true, - .multi_chip = true, - .edsa_support = MV88E6XXX_EDSA_SUPPORTED, - .ptp_support = true, -@@ -6172,7 +6183,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { - .global1_addr = 0x1b, - .global2_addr = 0x1c, - .age_time_coeff = 3750, -- .atu_move_port_mask = 0x1f, -+ .atu_move_port_mask = 0xf, - .g1_irqs = 9, - .g2_irqs = 10, - .pvt = true, -diff --git a/drivers/net/ethernet/amd/pds_core/adminq.c b/drivers/net/ethernet/amd/pds_core/adminq.c -index ea773cfa0af67b..733f133d69e75f 100644 ---- a/drivers/net/ethernet/amd/pds_core/adminq.c -+++ b/drivers/net/ethernet/amd/pds_core/adminq.c -@@ -5,11 +5,6 @@ - - #include "core.h" - --struct pdsc_wait_context { -- struct pdsc_qcq *qcq; -- struct completion wait_completion; --}; -- - static int pdsc_process_notifyq(struct pdsc_qcq *qcq) - { - union pds_core_notifyq_comp *comp; -@@ -110,10 +105,10 @@ void pdsc_process_adminq(struct pdsc_qcq *qcq) - q_info = &q->info[q->tail_idx]; - q->tail_idx = (q->tail_idx + 1) & (q->num_descs - 1); - -- /* Copy out the completion data */ -- memcpy(q_info->dest, comp, sizeof(*comp)); -- -- complete_all(&q_info->wc->wait_completion); -+ if (!completion_done(&q_info->completion)) { -+ memcpy(q_info->dest, comp, sizeof(*comp)); -+ complete(&q_info->completion); -+ } - - if (cq->tail_idx == cq->num_descs - 1) - cq->done_color = !cq->done_color; -@@ -166,8 +161,7 @@ irqreturn_t pdsc_adminq_isr(int irq, void *data) - static int __pdsc_adminq_post(struct pdsc *pdsc, - struct pdsc_qcq *qcq, - union pds_core_adminq_cmd *cmd, -- union pds_core_adminq_comp *comp, -- struct pdsc_wait_context *wc) -+ union pds_core_adminq_comp *comp) - { - struct pdsc_queue *q = &qcq->q; - struct pdsc_q_info *q_info; -@@ -209,9 +203,9 @@ static int __pdsc_adminq_post(struct pdsc *pdsc, - /* Post the request */ - index = q->head_idx; - q_info = &q->info[index]; -- q_info->wc = wc; - q_info->dest = comp; - memcpy(q_info->desc, cmd, sizeof(*cmd)); -+ reinit_completion(&q_info->completion); - - dev_dbg(pdsc->dev, "head_idx %d tail_idx %d\n", - q->head_idx, q->tail_idx); -@@ -235,16 +229,13 @@ int pdsc_adminq_post(struct pdsc *pdsc, - union pds_core_adminq_comp *comp, - bool fast_poll) - { -- struct pdsc_wait_context wc = { -- .wait_completion = -- COMPLETION_INITIALIZER_ONSTACK(wc.wait_completion), -- }; - unsigned long poll_interval = 1; - unsigned long poll_jiffies; - unsigned long time_limit; - unsigned long time_start; - unsigned long time_done; - unsigned long remaining; -+ struct completion *wc; - int err = 0; - int index; - -@@ -254,20 +245,19 @@ int pdsc_adminq_post(struct pdsc *pdsc, - return -ENXIO; - } - -- wc.qcq = &pdsc->adminqcq; -- index = __pdsc_adminq_post(pdsc, &pdsc->adminqcq, cmd, comp, &wc); -+ index = __pdsc_adminq_post(pdsc, &pdsc->adminqcq, cmd, comp); - if (index < 0) { - err = index; - goto err_out; - } - -+ wc = &pdsc->adminqcq.q.info[index].completion; - time_start = jiffies; - time_limit = time_start + HZ * pdsc->devcmd_timeout; - do { - /* Timeslice the actual wait to catch IO errors etc early */ - poll_jiffies = msecs_to_jiffies(poll_interval); -- remaining = wait_for_completion_timeout(&wc.wait_completion, -- poll_jiffies); -+ remaining = wait_for_completion_timeout(wc, poll_jiffies); - if (remaining) - break; - -@@ -296,9 +286,11 @@ int pdsc_adminq_post(struct pdsc *pdsc, - dev_dbg(pdsc->dev, "%s: elapsed %d msecs\n", - __func__, jiffies_to_msecs(time_done - time_start)); - -- /* Check the results */ -- if (time_after_eq(time_done, time_limit)) -+ /* Check the results and clear an un-completed timeout */ -+ if (time_after_eq(time_done, time_limit) && !completion_done(wc)) { - err = -ETIMEDOUT; -+ complete(wc); -+ } - - dev_dbg(pdsc->dev, "read admin queue completion idx %d:\n", index); - dynamic_hex_dump("comp ", DUMP_PREFIX_OFFSET, 16, 1, -diff --git a/drivers/net/ethernet/amd/pds_core/auxbus.c b/drivers/net/ethernet/amd/pds_core/auxbus.c -index fd1a5149c00319..fb7a5403e630db 100644 ---- a/drivers/net/ethernet/amd/pds_core/auxbus.c -+++ b/drivers/net/ethernet/amd/pds_core/auxbus.c -@@ -107,9 +107,6 @@ int pds_client_adminq_cmd(struct pds_auxiliary_dev *padev, - dev_dbg(pf->dev, "%s: %s opcode %d\n", - __func__, dev_name(&padev->aux_dev.dev), req->opcode); - -- if (pf->state) -- return -ENXIO; -- - /* Wrap the client's request */ - cmd.client_request.opcode = PDS_AQ_CMD_CLIENT_CMD; - cmd.client_request.client_id = cpu_to_le16(padev->client_id); -diff --git a/drivers/net/ethernet/amd/pds_core/core.c b/drivers/net/ethernet/amd/pds_core/core.c -index eb73c921dc1ed9..b3fa867c8ccd91 100644 ---- a/drivers/net/ethernet/amd/pds_core/core.c -+++ b/drivers/net/ethernet/amd/pds_core/core.c -@@ -169,8 +169,10 @@ static void pdsc_q_map(struct pdsc_queue *q, void *base, dma_addr_t base_pa) - q->base = base; - q->base_pa = base_pa; - -- for (i = 0, cur = q->info; i < q->num_descs; i++, cur++) -+ for (i = 0, cur = q->info; i < q->num_descs; i++, cur++) { - cur->desc = base + (i * q->desc_size); -+ init_completion(&cur->completion); -+ } - } - - static void pdsc_cq_map(struct pdsc_cq *cq, void *base, dma_addr_t base_pa) -diff --git a/drivers/net/ethernet/amd/pds_core/core.h b/drivers/net/ethernet/amd/pds_core/core.h -index f410f7d132056b..858bebf7977624 100644 ---- a/drivers/net/ethernet/amd/pds_core/core.h -+++ b/drivers/net/ethernet/amd/pds_core/core.h -@@ -96,7 +96,7 @@ struct pdsc_q_info { - unsigned int bytes; - unsigned int nbufs; - struct pdsc_buf_info bufs[PDS_CORE_MAX_FRAGS]; -- struct pdsc_wait_context *wc; -+ struct completion completion; - void *dest; - }; - -diff --git a/drivers/net/ethernet/amd/pds_core/devlink.c b/drivers/net/ethernet/amd/pds_core/devlink.c -index 971d4278280d65..0032e8e3518117 100644 ---- a/drivers/net/ethernet/amd/pds_core/devlink.c -+++ b/drivers/net/ethernet/amd/pds_core/devlink.c -@@ -101,7 +101,7 @@ int pdsc_dl_info_get(struct devlink *dl, struct devlink_info_req *req, - .fw_control.opcode = PDS_CORE_CMD_FW_CONTROL, - .fw_control.oper = PDS_CORE_FW_GET_LIST, - }; -- struct pds_core_fw_list_info fw_list; -+ struct pds_core_fw_list_info fw_list = {}; - struct pdsc *pdsc = devlink_priv(dl); - union pds_core_dev_comp comp; - char buf[32]; -@@ -114,8 +114,6 @@ int pdsc_dl_info_get(struct devlink *dl, struct devlink_info_req *req, - if (!err) - memcpy_fromio(&fw_list, pdsc->cmd_regs->data, sizeof(fw_list)); - mutex_unlock(&pdsc->devcmd_lock); -- if (err && err != -EIO) -- return err; - - listlen = min(fw_list.num_fw_slots, ARRAY_SIZE(fw_list.fw_names)); - for (i = 0; i < listlen; i++) { -diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c -index c201ea20e40476..dc89dbc13b251f 100644 ---- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c -+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c -@@ -3949,11 +3949,27 @@ static int mtk_hw_init(struct mtk_eth *eth, bool reset) - mtk_w32(eth, 0x21021000, MTK_FE_INT_GRP); - - if (mtk_is_netsys_v3_or_greater(eth)) { -- /* PSE should not drop port1, port8 and port9 packets */ -- mtk_w32(eth, 0x00000302, PSE_DROP_CFG); -+ /* PSE dummy page mechanism */ -+ mtk_w32(eth, PSE_DUMMY_WORK_GDM(1) | PSE_DUMMY_WORK_GDM(2) | -+ PSE_DUMMY_WORK_GDM(3) | DUMMY_PAGE_THR, PSE_DUMY_REQ); -+ -+ /* PSE free buffer drop threshold */ -+ mtk_w32(eth, 0x00600009, PSE_IQ_REV(8)); -+ -+ /* PSE should not drop port8, port9 and port13 packets from -+ * WDMA Tx -+ */ -+ mtk_w32(eth, 0x00002300, PSE_DROP_CFG); -+ -+ /* PSE should drop packets to port8, port9 and port13 on WDMA Rx -+ * ring full -+ */ -+ mtk_w32(eth, 0x00002300, PSE_PPE_DROP(0)); -+ mtk_w32(eth, 0x00002300, PSE_PPE_DROP(1)); -+ mtk_w32(eth, 0x00002300, PSE_PPE_DROP(2)); - - /* GDM and CDM Threshold */ -- mtk_w32(eth, 0x00000707, MTK_CDMW0_THRES); -+ mtk_w32(eth, 0x08000707, MTK_CDMW0_THRES); - mtk_w32(eth, 0x00000077, MTK_CDMW1_THRES); - - /* Disable GDM1 RX CRC stripping */ -@@ -3970,7 +3986,7 @@ static int mtk_hw_init(struct mtk_eth *eth, bool reset) - mtk_w32(eth, 0x00000300, PSE_DROP_CFG); - - /* PSE should drop packets to port 8/9 on WDMA Rx ring full */ -- mtk_w32(eth, 0x00000300, PSE_PPE0_DROP); -+ mtk_w32(eth, 0x00000300, PSE_PPE_DROP(0)); - - /* PSE Free Queue Flow Control */ - mtk_w32(eth, 0x01fa01f4, PSE_FQFC_CFG2); -diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.h b/drivers/net/ethernet/mediatek/mtk_eth_soc.h -index 403219d987eff5..d1c7b5f1ee4a9c 100644 ---- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h -+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h -@@ -149,7 +149,15 @@ - #define PSE_FQFC_CFG1 0x100 - #define PSE_FQFC_CFG2 0x104 - #define PSE_DROP_CFG 0x108 --#define PSE_PPE0_DROP 0x110 -+#define PSE_PPE_DROP(x) (0x110 + ((x) * 0x4)) -+ -+/* PSE Last FreeQ Page Request Control */ -+#define PSE_DUMY_REQ 0x10C -+/* PSE_DUMY_REQ is not a typo but actually called like that also in -+ * MediaTek's datasheet -+ */ -+#define PSE_DUMMY_WORK_GDM(x) BIT(16 + (x)) -+#define DUMMY_PAGE_THR 0x1 - - /* PSE Input Queue Reservation Register*/ - #define PSE_IQ_REV(x) (0x140 + (((x) - 1) << 2)) -diff --git a/drivers/net/phy/microchip.c b/drivers/net/phy/microchip.c -index 0b88635f4fbca9..623607fd2cefd3 100644 ---- a/drivers/net/phy/microchip.c -+++ b/drivers/net/phy/microchip.c -@@ -31,47 +31,6 @@ static int lan88xx_write_page(struct phy_device *phydev, int page) - return __phy_write(phydev, LAN88XX_EXT_PAGE_ACCESS, page); - } - --static int lan88xx_phy_config_intr(struct phy_device *phydev) --{ -- int rc; -- -- if (phydev->interrupts == PHY_INTERRUPT_ENABLED) { -- /* unmask all source and clear them before enable */ -- rc = phy_write(phydev, LAN88XX_INT_MASK, 0x7FFF); -- rc = phy_read(phydev, LAN88XX_INT_STS); -- rc = phy_write(phydev, LAN88XX_INT_MASK, -- LAN88XX_INT_MASK_MDINTPIN_EN_ | -- LAN88XX_INT_MASK_LINK_CHANGE_); -- } else { -- rc = phy_write(phydev, LAN88XX_INT_MASK, 0); -- if (rc) -- return rc; -- -- /* Ack interrupts after they have been disabled */ -- rc = phy_read(phydev, LAN88XX_INT_STS); -- } -- -- return rc < 0 ? rc : 0; --} -- --static irqreturn_t lan88xx_handle_interrupt(struct phy_device *phydev) --{ -- int irq_status; -- -- irq_status = phy_read(phydev, LAN88XX_INT_STS); -- if (irq_status < 0) { -- phy_error(phydev); -- return IRQ_NONE; -- } -- -- if (!(irq_status & LAN88XX_INT_STS_LINK_CHANGE_)) -- return IRQ_NONE; -- -- phy_trigger_machine(phydev); -- -- return IRQ_HANDLED; --} -- - static int lan88xx_suspend(struct phy_device *phydev) - { - struct lan88xx_priv *priv = phydev->priv; -@@ -392,8 +351,9 @@ static struct phy_driver microchip_phy_driver[] = { - .config_aneg = lan88xx_config_aneg, - .link_change_notify = lan88xx_link_change_notify, - -- .config_intr = lan88xx_phy_config_intr, -- .handle_interrupt = lan88xx_handle_interrupt, -+ /* Interrupt handling is broken, do not define related -+ * functions to force polling. -+ */ - - .suspend = lan88xx_suspend, - .resume = genphy_resume, -diff --git a/drivers/net/phy/phy_led_triggers.c b/drivers/net/phy/phy_led_triggers.c -index f550576eb9dae7..6f9d8da76c4dfb 100644 ---- a/drivers/net/phy/phy_led_triggers.c -+++ b/drivers/net/phy/phy_led_triggers.c -@@ -91,9 +91,8 @@ int phy_led_triggers_register(struct phy_device *phy) - if (!phy->phy_num_led_triggers) - return 0; - -- phy->led_link_trigger = devm_kzalloc(&phy->mdio.dev, -- sizeof(*phy->led_link_trigger), -- GFP_KERNEL); -+ phy->led_link_trigger = kzalloc(sizeof(*phy->led_link_trigger), -+ GFP_KERNEL); - if (!phy->led_link_trigger) { - err = -ENOMEM; - goto out_clear; -@@ -103,10 +102,9 @@ int phy_led_triggers_register(struct phy_device *phy) - if (err) - goto out_free_link; - -- phy->phy_led_triggers = devm_kcalloc(&phy->mdio.dev, -- phy->phy_num_led_triggers, -- sizeof(struct phy_led_trigger), -- GFP_KERNEL); -+ phy->phy_led_triggers = kcalloc(phy->phy_num_led_triggers, -+ sizeof(struct phy_led_trigger), -+ GFP_KERNEL); - if (!phy->phy_led_triggers) { - err = -ENOMEM; - goto out_unreg_link; -@@ -127,11 +125,11 @@ int phy_led_triggers_register(struct phy_device *phy) - out_unreg: - while (i--) - phy_led_trigger_unregister(&phy->phy_led_triggers[i]); -- devm_kfree(&phy->mdio.dev, phy->phy_led_triggers); -+ kfree(phy->phy_led_triggers); - out_unreg_link: - phy_led_trigger_unregister(phy->led_link_trigger); - out_free_link: -- devm_kfree(&phy->mdio.dev, phy->led_link_trigger); -+ kfree(phy->led_link_trigger); - phy->led_link_trigger = NULL; - out_clear: - phy->phy_num_led_triggers = 0; -@@ -145,8 +143,13 @@ void phy_led_triggers_unregister(struct phy_device *phy) - - for (i = 0; i < phy->phy_num_led_triggers; i++) - phy_led_trigger_unregister(&phy->phy_led_triggers[i]); -+ kfree(phy->phy_led_triggers); -+ phy->phy_led_triggers = NULL; - -- if (phy->led_link_trigger) -+ if (phy->led_link_trigger) { - phy_led_trigger_unregister(phy->led_link_trigger); -+ kfree(phy->led_link_trigger); -+ phy->led_link_trigger = NULL; -+ } - } - EXPORT_SYMBOL_GPL(phy_led_triggers_unregister); -diff --git a/drivers/net/vmxnet3/vmxnet3_xdp.c b/drivers/net/vmxnet3/vmxnet3_xdp.c -index 616ecc38d1726c..5f470499e60024 100644 ---- a/drivers/net/vmxnet3/vmxnet3_xdp.c -+++ b/drivers/net/vmxnet3/vmxnet3_xdp.c -@@ -397,7 +397,7 @@ vmxnet3_process_xdp(struct vmxnet3_adapter *adapter, - - xdp_init_buff(&xdp, PAGE_SIZE, &rq->xdp_rxq); - xdp_prepare_buff(&xdp, page_address(page), rq->page_pool->p.offset, -- rbi->len, false); -+ rcd->len, false); - xdp_buff_clear_frags_flag(&xdp); - - xdp_prog = rcu_dereference(rq->adapter->xdp_bpf_prog); -diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c -index bcb5651f18e0f5..0115f8f5b7245f 100644 ---- a/drivers/net/xen-netfront.c -+++ b/drivers/net/xen-netfront.c -@@ -985,20 +985,27 @@ static u32 xennet_run_xdp(struct netfront_queue *queue, struct page *pdata, - act = bpf_prog_run_xdp(prog, xdp); - switch (act) { - case XDP_TX: -- get_page(pdata); - xdpf = xdp_convert_buff_to_frame(xdp); -+ if (unlikely(!xdpf)) { -+ trace_xdp_exception(queue->info->netdev, prog, act); -+ break; -+ } -+ get_page(pdata); - err = xennet_xdp_xmit(queue->info->netdev, 1, &xdpf, 0); -- if (unlikely(!err)) -+ if (unlikely(err <= 0)) { -+ if (err < 0) -+ trace_xdp_exception(queue->info->netdev, prog, act); - xdp_return_frame_rx_napi(xdpf); -- else if (unlikely(err < 0)) -- trace_xdp_exception(queue->info->netdev, prog, act); -+ } - break; - case XDP_REDIRECT: - get_page(pdata); - err = xdp_do_redirect(queue->info->netdev, xdp, prog); - *need_xdp_flush = true; -- if (unlikely(err)) -+ if (unlikely(err)) { - trace_xdp_exception(queue->info->netdev, prog, act); -+ xdp_return_buff(xdp); -+ } - break; - case XDP_PASS: - case XDP_DROP: -diff --git a/drivers/ntb/hw/amd/ntb_hw_amd.c b/drivers/ntb/hw/amd/ntb_hw_amd.c -index d687e8c2cc78dc..63ceed89b62ef9 100644 ---- a/drivers/ntb/hw/amd/ntb_hw_amd.c -+++ b/drivers/ntb/hw/amd/ntb_hw_amd.c -@@ -1318,6 +1318,7 @@ static const struct pci_device_id amd_ntb_pci_tbl[] = { - { PCI_VDEVICE(AMD, 0x148b), (kernel_ulong_t)&dev_data[1] }, - { PCI_VDEVICE(AMD, 0x14c0), (kernel_ulong_t)&dev_data[1] }, - { PCI_VDEVICE(AMD, 0x14c3), (kernel_ulong_t)&dev_data[1] }, -+ { PCI_VDEVICE(AMD, 0x155a), (kernel_ulong_t)&dev_data[1] }, - { PCI_VDEVICE(HYGON, 0x145b), (kernel_ulong_t)&dev_data[0] }, - { 0, } - }; -diff --git a/drivers/ntb/hw/idt/ntb_hw_idt.c b/drivers/ntb/hw/idt/ntb_hw_idt.c -index 48823b53ede3e9..22aaa60d2d3846 100644 ---- a/drivers/ntb/hw/idt/ntb_hw_idt.c -+++ b/drivers/ntb/hw/idt/ntb_hw_idt.c -@@ -1041,7 +1041,7 @@ static inline char *idt_get_mw_name(enum idt_mw_type mw_type) - static struct idt_mw_cfg *idt_scan_mws(struct idt_ntb_dev *ndev, int port, - unsigned char *mw_cnt) - { -- struct idt_mw_cfg mws[IDT_MAX_NR_MWS], *ret_mws; -+ struct idt_mw_cfg *mws; - const struct idt_ntb_bar *bars; - enum idt_mw_type mw_type; - unsigned char widx, bidx, en_cnt; -@@ -1049,6 +1049,11 @@ static struct idt_mw_cfg *idt_scan_mws(struct idt_ntb_dev *ndev, int port, - int aprt_size; - u32 data; - -+ mws = devm_kcalloc(&ndev->ntb.pdev->dev, IDT_MAX_NR_MWS, -+ sizeof(*mws), GFP_KERNEL); -+ if (!mws) -+ return ERR_PTR(-ENOMEM); -+ - /* Retrieve the array of the BARs registers */ - bars = portdata_tbl[port].bars; - -@@ -1103,16 +1108,7 @@ static struct idt_mw_cfg *idt_scan_mws(struct idt_ntb_dev *ndev, int port, - } - } - -- /* Allocate memory for memory window descriptors */ -- ret_mws = devm_kcalloc(&ndev->ntb.pdev->dev, *mw_cnt, sizeof(*ret_mws), -- GFP_KERNEL); -- if (!ret_mws) -- return ERR_PTR(-ENOMEM); -- -- /* Copy the info of detected memory windows */ -- memcpy(ret_mws, mws, (*mw_cnt)*sizeof(*ret_mws)); -- -- return ret_mws; -+ return mws; - } - - /* -diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c -index f00665ad0c11a3..c6b0637e61debd 100644 ---- a/drivers/nvme/host/core.c -+++ b/drivers/nvme/host/core.c -@@ -3972,6 +3972,15 @@ static void nvme_scan_work(struct work_struct *work) - nvme_scan_ns_sequential(ctrl); - } - mutex_unlock(&ctrl->scan_lock); -+ -+ /* Requeue if we have missed AENs */ -+ if (test_bit(NVME_AER_NOTICE_NS_CHANGED, &ctrl->events)) -+ nvme_queue_scan(ctrl); -+#ifdef CONFIG_NVME_MULTIPATH -+ else if (ctrl->ana_log_buf) -+ /* Re-read the ANA log page to not miss updates */ -+ queue_work(nvme_wq, &ctrl->ana_work); -+#endif - } - - /* -diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c -index 32283301199f01..119afdfe4b91e9 100644 ---- a/drivers/nvme/host/multipath.c -+++ b/drivers/nvme/host/multipath.c -@@ -426,7 +426,7 @@ static bool nvme_available_path(struct nvme_ns_head *head) - struct nvme_ns *ns; - - if (!test_bit(NVME_NSHEAD_DISK_LIVE, &head->flags)) -- return NULL; -+ return false; - - list_for_each_entry_srcu(ns, &head->list, siblings, - srcu_read_lock_held(&head->srcu)) { -diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c -index d40d5a4ea932e0..570c58d2b5a585 100644 ---- a/drivers/nvme/target/fc.c -+++ b/drivers/nvme/target/fc.c -@@ -1030,33 +1030,24 @@ nvmet_fc_alloc_hostport(struct nvmet_fc_tgtport *tgtport, void *hosthandle) - struct nvmet_fc_hostport *newhost, *match = NULL; - unsigned long flags; - -+ /* -+ * Caller holds a reference on tgtport. -+ */ -+ - /* if LLDD not implemented, leave as NULL */ - if (!hosthandle) - return NULL; - -- /* -- * take reference for what will be the newly allocated hostport if -- * we end up using a new allocation -- */ -- if (!nvmet_fc_tgtport_get(tgtport)) -- return ERR_PTR(-EINVAL); -- - spin_lock_irqsave(&tgtport->lock, flags); - match = nvmet_fc_match_hostport(tgtport, hosthandle); - spin_unlock_irqrestore(&tgtport->lock, flags); - -- if (match) { -- /* no new allocation - release reference */ -- nvmet_fc_tgtport_put(tgtport); -+ if (match) - return match; -- } - - newhost = kzalloc(sizeof(*newhost), GFP_KERNEL); -- if (!newhost) { -- /* no new allocation - release reference */ -- nvmet_fc_tgtport_put(tgtport); -+ if (!newhost) - return ERR_PTR(-ENOMEM); -- } - - spin_lock_irqsave(&tgtport->lock, flags); - match = nvmet_fc_match_hostport(tgtport, hosthandle); -@@ -1065,6 +1056,7 @@ nvmet_fc_alloc_hostport(struct nvmet_fc_tgtport *tgtport, void *hosthandle) - kfree(newhost); - newhost = match; - } else { -+ nvmet_fc_tgtport_get(tgtport); - newhost->tgtport = tgtport; - newhost->hosthandle = hosthandle; - INIT_LIST_HEAD(&newhost->host_list); -@@ -1099,7 +1091,8 @@ static void - nvmet_fc_schedule_delete_assoc(struct nvmet_fc_tgt_assoc *assoc) - { - nvmet_fc_tgtport_get(assoc->tgtport); -- queue_work(nvmet_wq, &assoc->del_work); -+ if (!queue_work(nvmet_wq, &assoc->del_work)) -+ nvmet_fc_tgtport_put(assoc->tgtport); - } - - static struct nvmet_fc_tgt_assoc * -diff --git a/drivers/of/resolver.c b/drivers/of/resolver.c -index b278ab4338ceb5..d5c1b2a126a560 100644 ---- a/drivers/of/resolver.c -+++ b/drivers/of/resolver.c -@@ -262,25 +262,22 @@ static int adjust_local_phandle_references(struct device_node *local_fixups, - */ - int of_resolve_phandles(struct device_node *overlay) - { -- struct device_node *child, *local_fixups, *refnode; -- struct device_node *tree_symbols, *overlay_fixups; -+ struct device_node *child, *refnode; -+ struct device_node *overlay_fixups; -+ struct device_node __free(device_node) *local_fixups = NULL; - struct property *prop; - const char *refpath; - phandle phandle, phandle_delta; - int err; - -- tree_symbols = NULL; -- - if (!overlay) { - pr_err("null overlay\n"); -- err = -EINVAL; -- goto out; -+ return -EINVAL; - } - - if (!of_node_check_flag(overlay, OF_DETACHED)) { - pr_err("overlay not detached\n"); -- err = -EINVAL; -- goto out; -+ return -EINVAL; - } - - phandle_delta = live_tree_max_phandle() + 1; -@@ -292,7 +289,7 @@ int of_resolve_phandles(struct device_node *overlay) - - err = adjust_local_phandle_references(local_fixups, overlay, phandle_delta); - if (err) -- goto out; -+ return err; - - overlay_fixups = NULL; - -@@ -301,16 +298,13 @@ int of_resolve_phandles(struct device_node *overlay) - overlay_fixups = child; - } - -- if (!overlay_fixups) { -- err = 0; -- goto out; -- } -+ if (!overlay_fixups) -+ return 0; - -- tree_symbols = of_find_node_by_path("/__symbols__"); -+ struct device_node __free(device_node) *tree_symbols = of_find_node_by_path("/__symbols__"); - if (!tree_symbols) { - pr_err("no symbols in root of device tree.\n"); -- err = -EINVAL; -- goto out; -+ return -EINVAL; - } - - for_each_property_of_node(overlay_fixups, prop) { -@@ -324,14 +318,12 @@ int of_resolve_phandles(struct device_node *overlay) - if (err) { - pr_err("node label '%s' not found in live devicetree symbols table\n", - prop->name); -- goto out; -+ return err; - } - - refnode = of_find_node_by_path(refpath); -- if (!refnode) { -- err = -ENOENT; -- goto out; -- } -+ if (!refnode) -+ return -ENOENT; - - phandle = refnode->phandle; - of_node_put(refnode); -@@ -341,11 +333,8 @@ int of_resolve_phandles(struct device_node *overlay) - break; - } - --out: - if (err) - pr_err("overlay phandle fixup failed: %d\n", err); -- of_node_put(tree_symbols); -- - return err; - } - EXPORT_SYMBOL_GPL(of_resolve_phandles); -diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c -index 8e5d818c29a983..b7cec139d816ba 100644 ---- a/drivers/pci/probe.c -+++ b/drivers/pci/probe.c -@@ -885,6 +885,7 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge) - resource_size_t offset, next_offset; - LIST_HEAD(resources); - struct resource *res, *next_res; -+ bool bus_registered = false; - char addr[64], *fmt; - const char *name; - int err; -@@ -948,6 +949,7 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge) - name = dev_name(&bus->dev); - - err = device_register(&bus->dev); -+ bus_registered = true; - if (err) - goto unregister; - -@@ -1031,12 +1033,15 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge) - unregister: - put_device(&bridge->dev); - device_del(&bridge->dev); -- - free: - #ifdef CONFIG_PCI_DOMAINS_GENERIC - pci_bus_release_domain_nr(bus, parent); - #endif -- kfree(bus); -+ if (bus_registered) -+ put_device(&bus->dev); -+ else -+ kfree(bus); -+ - return err; - } - -diff --git a/drivers/pinctrl/renesas/pinctrl-rza2.c b/drivers/pinctrl/renesas/pinctrl-rza2.c -index c5d733216508e8..df660b7e1300ca 100644 ---- a/drivers/pinctrl/renesas/pinctrl-rza2.c -+++ b/drivers/pinctrl/renesas/pinctrl-rza2.c -@@ -243,6 +243,9 @@ static int rza2_gpio_register(struct rza2_pinctrl_priv *priv) - int ret; - - chip.label = devm_kasprintf(priv->dev, GFP_KERNEL, "%pOFn", np); -+ if (!chip.label) -+ return -ENOMEM; -+ - chip.parent = priv->dev; - chip.ngpio = priv->npins; - -diff --git a/drivers/regulator/rk808-regulator.c b/drivers/regulator/rk808-regulator.c -index 374d80dc6d17ab..bec22a001a5dd5 100644 ---- a/drivers/regulator/rk808-regulator.c -+++ b/drivers/regulator/rk808-regulator.c -@@ -267,8 +267,8 @@ static const unsigned int rk817_buck1_4_ramp_table[] = { - - static int rk806_set_mode_dcdc(struct regulator_dev *rdev, unsigned int mode) - { -- int rid = rdev_get_id(rdev); -- int ctr_bit, reg; -+ unsigned int rid = rdev_get_id(rdev); -+ unsigned int ctr_bit, reg; - - reg = RK806_POWER_FPWM_EN0 + rid / 8; - ctr_bit = rid % 8; -diff --git a/drivers/rtc/rtc-pcf85063.c b/drivers/rtc/rtc-pcf85063.c -index 905986c616559b..73848f764559b4 100644 ---- a/drivers/rtc/rtc-pcf85063.c -+++ b/drivers/rtc/rtc-pcf85063.c -@@ -35,6 +35,7 @@ - #define PCF85063_REG_CTRL1_CAP_SEL BIT(0) - #define PCF85063_REG_CTRL1_STOP BIT(5) - #define PCF85063_REG_CTRL1_EXT_TEST BIT(7) -+#define PCF85063_REG_CTRL1_SWR 0x58 - - #define PCF85063_REG_CTRL2 0x01 - #define PCF85063_CTRL2_AF BIT(6) -@@ -589,7 +590,7 @@ static int pcf85063_probe(struct i2c_client *client) - - i2c_set_clientdata(client, pcf85063); - -- err = regmap_read(pcf85063->regmap, PCF85063_REG_CTRL1, &tmp); -+ err = regmap_read(pcf85063->regmap, PCF85063_REG_SC, &tmp); - if (err) { - dev_err(&client->dev, "RTC chip is not present\n"); - return err; -@@ -599,6 +600,22 @@ static int pcf85063_probe(struct i2c_client *client) - if (IS_ERR(pcf85063->rtc)) - return PTR_ERR(pcf85063->rtc); - -+ /* -+ * If a Power loss is detected, SW reset the device. -+ * From PCF85063A datasheet: -+ * There is a low probability that some devices will have corruption -+ * of the registers after the automatic power-on reset... -+ */ -+ if (tmp & PCF85063_REG_SC_OS) { -+ dev_warn(&client->dev, -+ "POR issue detected, sending a SW reset\n"); -+ err = regmap_write(pcf85063->regmap, PCF85063_REG_CTRL1, -+ PCF85063_REG_CTRL1_SWR); -+ if (err < 0) -+ dev_warn(&client->dev, -+ "SW reset failed, trying to continue\n"); -+ } -+ - err = pcf85063_load_capacitance(pcf85063, client->dev.of_node, - config->force_cap_7000 ? 7000 : 0); - if (err < 0) -diff --git a/drivers/s390/char/sclp_con.c b/drivers/s390/char/sclp_con.c -index e5d947c763ea5d..6a030ba38bf360 100644 ---- a/drivers/s390/char/sclp_con.c -+++ b/drivers/s390/char/sclp_con.c -@@ -263,6 +263,19 @@ static struct console sclp_console = - .index = 0 /* ttyS0 */ - }; - -+/* -+ * Release allocated pages. -+ */ -+static void __init __sclp_console_free_pages(void) -+{ -+ struct list_head *page, *p; -+ -+ list_for_each_safe(page, p, &sclp_con_pages) { -+ list_del(page); -+ free_page((unsigned long)page); -+ } -+} -+ - /* - * called by console_init() in drivers/char/tty_io.c at boot-time. - */ -@@ -282,6 +295,10 @@ sclp_console_init(void) - /* Allocate pages for output buffering */ - for (i = 0; i < sclp_console_pages; i++) { - page = (void *) get_zeroed_page(GFP_KERNEL | GFP_DMA); -+ if (!page) { -+ __sclp_console_free_pages(); -+ return -ENOMEM; -+ } - list_add_tail(page, &sclp_con_pages); - } - sclp_conbuf = NULL; -diff --git a/drivers/s390/char/sclp_tty.c b/drivers/s390/char/sclp_tty.c -index 892c18d2f87e90..d3edacb6ee148b 100644 ---- a/drivers/s390/char/sclp_tty.c -+++ b/drivers/s390/char/sclp_tty.c -@@ -490,6 +490,17 @@ static const struct tty_operations sclp_ops = { - .flush_buffer = sclp_tty_flush_buffer, - }; - -+/* Release allocated pages. */ -+static void __init __sclp_tty_free_pages(void) -+{ -+ struct list_head *page, *p; -+ -+ list_for_each_safe(page, p, &sclp_tty_pages) { -+ list_del(page); -+ free_page((unsigned long)page); -+ } -+} -+ - static int __init - sclp_tty_init(void) - { -@@ -516,6 +527,7 @@ sclp_tty_init(void) - for (i = 0; i < MAX_KMEM_PAGES; i++) { - page = (void *) get_zeroed_page(GFP_KERNEL | GFP_DMA); - if (page == NULL) { -+ __sclp_tty_free_pages(); - tty_driver_kref_put(driver); - return -ENOMEM; - } -diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c -index f78c5f8a49ffac..7e64661d215bd2 100644 ---- a/drivers/scsi/hisi_sas/hisi_sas_main.c -+++ b/drivers/scsi/hisi_sas/hisi_sas_main.c -@@ -911,8 +911,28 @@ static void hisi_sas_phyup_work_common(struct work_struct *work, - container_of(work, typeof(*phy), works[event]); - struct hisi_hba *hisi_hba = phy->hisi_hba; - struct asd_sas_phy *sas_phy = &phy->sas_phy; -+ struct asd_sas_port *sas_port = sas_phy->port; -+ struct hisi_sas_port *port = phy->port; -+ struct device *dev = hisi_hba->dev; -+ struct domain_device *port_dev; - int phy_no = sas_phy->id; - -+ if (!test_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags) && -+ sas_port && port && (port->id != phy->port_id)) { -+ dev_info(dev, "phy%d's hw port id changed from %d to %llu\n", -+ phy_no, port->id, phy->port_id); -+ port_dev = sas_port->port_dev; -+ if (port_dev && !dev_is_expander(port_dev->dev_type)) { -+ /* -+ * Set the device state to gone to block -+ * sending IO to the device. -+ */ -+ set_bit(SAS_DEV_GONE, &port_dev->state); -+ hisi_sas_notify_phy_event(phy, HISI_PHYE_LINK_RESET); -+ return; -+ } -+ } -+ - phy->wait_phyup_cnt = 0; - if (phy->identify.target_port_protocols == SAS_PROTOCOL_SSP) - hisi_hba->hw->sl_notify_ssp(hisi_hba, phy_no); -diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c -index ee2da8e49d4cfb..a9d6dac4133466 100644 ---- a/drivers/scsi/pm8001/pm8001_sas.c -+++ b/drivers/scsi/pm8001/pm8001_sas.c -@@ -719,6 +719,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) - spin_lock_irqsave(&pm8001_ha->lock, flags); - } - PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id); -+ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; - pm8001_free_dev(pm8001_dev); - } else { - pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n"); -diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c -index 22bdce0bc32792..9c0142a010bac1 100644 ---- a/drivers/scsi/scsi.c -+++ b/drivers/scsi/scsi.c -@@ -693,26 +693,23 @@ void scsi_cdl_check(struct scsi_device *sdev) - */ - int scsi_cdl_enable(struct scsi_device *sdev, bool enable) - { -- struct scsi_mode_data data; -- struct scsi_sense_hdr sshdr; -- struct scsi_vpd *vpd; -- bool is_ata = false; - char buf[64]; -+ bool is_ata; - int ret; - - if (!sdev->cdl_supported) - return -EOPNOTSUPP; - - rcu_read_lock(); -- vpd = rcu_dereference(sdev->vpd_pg89); -- if (vpd) -- is_ata = true; -+ is_ata = rcu_dereference(sdev->vpd_pg89); - rcu_read_unlock(); - - /* - * For ATA devices, CDL needs to be enabled with a SET FEATURES command. - */ - if (is_ata) { -+ struct scsi_mode_data data; -+ struct scsi_sense_hdr sshdr; - char *buf_data; - int len; - -@@ -721,16 +718,30 @@ int scsi_cdl_enable(struct scsi_device *sdev, bool enable) - if (ret) - return -EINVAL; - -- /* Enable CDL using the ATA feature page */ -+ /* Enable or disable CDL using the ATA feature page */ - len = min_t(size_t, sizeof(buf), - data.length - data.header_length - - data.block_descriptor_length); - buf_data = buf + data.header_length + - data.block_descriptor_length; -- if (enable) -- buf_data[4] = 0x02; -- else -- buf_data[4] = 0; -+ -+ /* -+ * If we want to enable CDL and CDL is already enabled on the -+ * device, do nothing. This avoids needlessly resetting the CDL -+ * statistics on the device as that is implied by the CDL enable -+ * action. Similar to this, there is no need to do anything if -+ * we want to disable CDL and CDL is already disabled. -+ */ -+ if (enable) { -+ if ((buf_data[4] & 0x03) == 0x02) -+ goto out; -+ buf_data[4] &= ~0x03; -+ buf_data[4] |= 0x02; -+ } else { -+ if ((buf_data[4] & 0x03) == 0x00) -+ goto out; -+ buf_data[4] &= ~0x03; -+ } - - ret = scsi_mode_select(sdev, 1, 0, buf_data, len, 5 * HZ, 3, - &data, &sshdr); -@@ -742,6 +753,7 @@ int scsi_cdl_enable(struct scsi_device *sdev, bool enable) - } - } - -+out: - sdev->cdl_enable = enable; - - return 0; -diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c -index e6dc2c556fde9e..bd75e3ebc14da3 100644 ---- a/drivers/scsi/scsi_lib.c -+++ b/drivers/scsi/scsi_lib.c -@@ -1152,8 +1152,12 @@ EXPORT_SYMBOL_GPL(scsi_alloc_request); - */ - static void scsi_cleanup_rq(struct request *rq) - { -+ struct scsi_cmnd *cmd = blk_mq_rq_to_pdu(rq); -+ -+ cmd->flags = 0; -+ - if (rq->rq_flags & RQF_DONTPREP) { -- scsi_mq_uninit_cmd(blk_mq_rq_to_pdu(rq)); -+ scsi_mq_uninit_cmd(cmd); - rq->rq_flags &= ~RQF_DONTPREP; - } - } -diff --git a/drivers/soc/qcom/ice.c b/drivers/soc/qcom/ice.c -index fbab7fe5c652b9..d6e205e3812a96 100644 ---- a/drivers/soc/qcom/ice.c -+++ b/drivers/soc/qcom/ice.c -@@ -10,6 +10,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -328,6 +329,53 @@ struct qcom_ice *of_qcom_ice_get(struct device *dev) - } - EXPORT_SYMBOL_GPL(of_qcom_ice_get); - -+static void qcom_ice_put(const struct qcom_ice *ice) -+{ -+ struct platform_device *pdev = to_platform_device(ice->dev); -+ -+ if (!platform_get_resource_byname(pdev, IORESOURCE_MEM, "ice")) -+ platform_device_put(pdev); -+} -+ -+static void devm_of_qcom_ice_put(struct device *dev, void *res) -+{ -+ qcom_ice_put(*(struct qcom_ice **)res); -+} -+ -+/** -+ * devm_of_qcom_ice_get() - Devres managed helper to get an ICE instance from -+ * a DT node. -+ * @dev: device pointer for the consumer device. -+ * -+ * This function will provide an ICE instance either by creating one for the -+ * consumer device if its DT node provides the 'ice' reg range and the 'ice' -+ * clock (for legacy DT style). On the other hand, if consumer provides a -+ * phandle via 'qcom,ice' property to an ICE DT, the ICE instance will already -+ * be created and so this function will return that instead. -+ * -+ * Return: ICE pointer on success, NULL if there is no ICE data provided by the -+ * consumer or ERR_PTR() on error. -+ */ -+struct qcom_ice *devm_of_qcom_ice_get(struct device *dev) -+{ -+ struct qcom_ice *ice, **dr; -+ -+ dr = devres_alloc(devm_of_qcom_ice_put, sizeof(*dr), GFP_KERNEL); -+ if (!dr) -+ return ERR_PTR(-ENOMEM); -+ -+ ice = of_qcom_ice_get(dev); -+ if (!IS_ERR_OR_NULL(ice)) { -+ *dr = ice; -+ devres_add(dev, dr); -+ } else { -+ devres_free(dr); -+ } -+ -+ return ice; -+} -+EXPORT_SYMBOL_GPL(devm_of_qcom_ice_get); -+ - static int qcom_ice_probe(struct platform_device *pdev) - { - struct qcom_ice *engine; -diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c -index daa32bde615561..da4442954375b1 100644 ---- a/drivers/spi/spi-imx.c -+++ b/drivers/spi/spi-imx.c -@@ -1614,10 +1614,13 @@ static int spi_imx_transfer_one(struct spi_controller *controller, - struct spi_device *spi, - struct spi_transfer *transfer) - { -+ int ret; - struct spi_imx_data *spi_imx = spi_controller_get_devdata(spi->controller); - unsigned long hz_per_byte, byte_limit; - -- spi_imx_setupxfer(spi, transfer); -+ ret = spi_imx_setupxfer(spi, transfer); -+ if (ret < 0) -+ return ret; - transfer->effective_speed_hz = spi_imx->spi_bus_clk; - - /* flush rxfifo before transfer */ -diff --git a/drivers/spi/spi-tegra210-quad.c b/drivers/spi/spi-tegra210-quad.c -index d1afa4140e8a26..e3c236025a7b3b 100644 ---- a/drivers/spi/spi-tegra210-quad.c -+++ b/drivers/spi/spi-tegra210-quad.c -@@ -1117,9 +1117,9 @@ static int tegra_qspi_combined_seq_xfer(struct tegra_qspi *tqspi, - (&tqspi->xfer_completion, - QSPI_DMA_TIMEOUT); - -- if (WARN_ON(ret == 0)) { -- dev_err(tqspi->dev, "QSPI Transfer failed with timeout: %d\n", -- ret); -+ if (WARN_ON_ONCE(ret == 0)) { -+ dev_err_ratelimited(tqspi->dev, -+ "QSPI Transfer failed with timeout\n"); - if (tqspi->is_curr_dma_xfer && - (tqspi->cur_direction & DATA_DIR_TX)) - dmaengine_terminate_all -diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c -index 7c3310a2b28a41..b92a8a5b2e8c97 100644 ---- a/drivers/thunderbolt/tb.c -+++ b/drivers/thunderbolt/tb.c -@@ -1370,11 +1370,15 @@ static void tb_scan_port(struct tb_port *port) - goto out_rpm_put; - } - -- tb_retimer_scan(port, true); -- - sw = tb_switch_alloc(port->sw->tb, &port->sw->dev, - tb_downstream_route(port)); - if (IS_ERR(sw)) { -+ /* -+ * Make the downstream retimers available even if there -+ * is no router connected. -+ */ -+ tb_retimer_scan(port, true); -+ - /* - * If there is an error accessing the connected switch - * it may be connected to another domain. Also we allow -@@ -1424,6 +1428,14 @@ static void tb_scan_port(struct tb_port *port) - upstream_port = tb_upstream_port(sw); - tb_configure_link(port, upstream_port, sw); - -+ /* -+ * Scan for downstream retimers. We only scan them after the -+ * router has been enumerated to avoid issues with certain -+ * Pluggable devices that expect the host to enumerate them -+ * within certain timeout. -+ */ -+ tb_retimer_scan(port, true); -+ - /* - * CL0s and CL1 are enabled and supported together. - * Silently ignore CLx enabling in case CLx is not supported. -diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c -index 90953e679e386a..76b6429fb9e92e 100644 ---- a/drivers/tty/serial/msm_serial.c -+++ b/drivers/tty/serial/msm_serial.c -@@ -1741,6 +1741,12 @@ msm_serial_early_console_setup_dm(struct earlycon_device *device, - if (!device->port.membase) - return -ENODEV; - -+ /* Disable DM / single-character modes */ -+ msm_write(&device->port, 0, UARTDM_DMEN); -+ msm_write(&device->port, MSM_UART_CR_CMD_RESET_RX, MSM_UART_CR); -+ msm_write(&device->port, MSM_UART_CR_CMD_RESET_TX, MSM_UART_CR); -+ msm_write(&device->port, MSM_UART_CR_TX_ENABLE, MSM_UART_CR); -+ - device->con->write = msm_serial_early_write_dm; - return 0; - } -diff --git a/drivers/tty/serial/sifive.c b/drivers/tty/serial/sifive.c -index d195c5de52e78f..e86b00873d0ea6 100644 ---- a/drivers/tty/serial/sifive.c -+++ b/drivers/tty/serial/sifive.c -@@ -562,8 +562,11 @@ static void sifive_serial_break_ctl(struct uart_port *port, int break_state) - static int sifive_serial_startup(struct uart_port *port) - { - struct sifive_serial_port *ssp = port_to_sifive_serial_port(port); -+ unsigned long flags; - -+ uart_port_lock_irqsave(&ssp->port, &flags); - __ssp_enable_rxwm(ssp); -+ uart_port_unlock_irqrestore(&ssp->port, flags); - - return 0; - } -@@ -571,9 +574,12 @@ static int sifive_serial_startup(struct uart_port *port) - static void sifive_serial_shutdown(struct uart_port *port) - { - struct sifive_serial_port *ssp = port_to_sifive_serial_port(port); -+ unsigned long flags; - -+ uart_port_lock_irqsave(&ssp->port, &flags); - __ssp_disable_rxwm(ssp); - __ssp_disable_txwm(ssp); -+ uart_port_unlock_irqrestore(&ssp->port, flags); - } - - /** -diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c -index da8c1734d33358..411109a5ebbffd 100644 ---- a/drivers/ufs/core/ufs-mcq.c -+++ b/drivers/ufs/core/ufs-mcq.c -@@ -632,13 +632,6 @@ int ufshcd_mcq_abort(struct scsi_cmnd *cmd) - unsigned long flags; - int err; - -- if (!ufshcd_cmd_inflight(lrbp->cmd)) { -- dev_err(hba->dev, -- "%s: skip abort. cmd at tag %d already completed.\n", -- __func__, tag); -- return FAILED; -- } -- - /* Skip task abort in case previous aborts failed and report failure */ - if (lrbp->req_abort_skip) { - dev_err(hba->dev, "%s: skip abort. tag %d failed earlier\n", -@@ -647,6 +640,11 @@ int ufshcd_mcq_abort(struct scsi_cmnd *cmd) - } - - hwq = ufshcd_mcq_req_to_hwq(hba, scsi_cmd_to_rq(cmd)); -+ if (!hwq) { -+ dev_err(hba->dev, "%s: skip abort. cmd at tag %d already completed.\n", -+ __func__, tag); -+ return FAILED; -+ } - - if (ufshcd_mcq_sqe_search(hba, hwq, tag)) { - /* -diff --git a/drivers/ufs/host/ufs-exynos.c b/drivers/ufs/host/ufs-exynos.c -index d138b66d5e350b..f61126189876e9 100644 ---- a/drivers/ufs/host/ufs-exynos.c -+++ b/drivers/ufs/host/ufs-exynos.c -@@ -990,9 +990,14 @@ static int exynos_ufs_pre_link(struct ufs_hba *hba) - exynos_ufs_config_intr(ufs, DFES_DEF_L4_ERRS, UNIPRO_L4); - exynos_ufs_set_unipro_pclk_div(ufs); - -+ exynos_ufs_setup_clocks(hba, true, PRE_CHANGE); -+ - /* unipro */ - exynos_ufs_config_unipro(ufs); - -+ if (ufs->drv_data->pre_link) -+ ufs->drv_data->pre_link(ufs); -+ - /* m-phy */ - exynos_ufs_phy_init(ufs); - if (!(ufs->opts & EXYNOS_UFS_OPT_SKIP_CONFIG_PHY_ATTR)) { -@@ -1000,11 +1005,6 @@ static int exynos_ufs_pre_link(struct ufs_hba *hba) - exynos_ufs_config_phy_cap_attr(ufs); - } - -- exynos_ufs_setup_clocks(hba, true, PRE_CHANGE); -- -- if (ufs->drv_data->pre_link) -- ufs->drv_data->pre_link(ufs); -- - return 0; - } - -diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c -index 51ed40529f9a7b..c6417ef074a478 100644 ---- a/drivers/ufs/host/ufs-qcom.c -+++ b/drivers/ufs/host/ufs-qcom.c -@@ -121,7 +121,7 @@ static int ufs_qcom_ice_init(struct ufs_qcom_host *host) - struct device *dev = hba->dev; - struct qcom_ice *ice; - -- ice = of_qcom_ice_get(dev); -+ ice = devm_of_qcom_ice_get(dev); - if (ice == ERR_PTR(-EOPNOTSUPP)) { - dev_warn(dev, "Disabling inline encryption support\n"); - ice = NULL; -diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c -index b1b46c7c63f8b3..05e8414c31df4c 100644 ---- a/drivers/usb/cdns3/cdns3-gadget.c -+++ b/drivers/usb/cdns3/cdns3-gadget.c -@@ -1962,6 +1962,7 @@ static irqreturn_t cdns3_device_thread_irq_handler(int irq, void *data) - unsigned int bit; - unsigned long reg; - -+ local_bh_disable(); - spin_lock_irqsave(&priv_dev->lock, flags); - - reg = readl(&priv_dev->regs->usb_ists); -@@ -2003,6 +2004,7 @@ static irqreturn_t cdns3_device_thread_irq_handler(int irq, void *data) - irqend: - writel(~0, &priv_dev->regs->ep_ien); - spin_unlock_irqrestore(&priv_dev->lock, flags); -+ local_bh_enable(); - - return ret; - } -diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c -index b3cbca361a9696..73d5b9466676c4 100644 ---- a/drivers/usb/chipidea/ci_hdrc_imx.c -+++ b/drivers/usb/chipidea/ci_hdrc_imx.c -@@ -328,6 +328,13 @@ static int ci_hdrc_imx_notify_event(struct ci_hdrc *ci, unsigned int event) - return ret; - } - -+static void ci_hdrc_imx_disable_regulator(void *arg) -+{ -+ struct ci_hdrc_imx_data *data = arg; -+ -+ regulator_disable(data->hsic_pad_regulator); -+} -+ - static int ci_hdrc_imx_probe(struct platform_device *pdev) - { - struct ci_hdrc_imx_data *data; -@@ -386,6 +393,13 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) - "Failed to enable HSIC pad regulator\n"); - goto err_put; - } -+ ret = devm_add_action_or_reset(dev, -+ ci_hdrc_imx_disable_regulator, data); -+ if (ret) { -+ dev_err(dev, -+ "Failed to add regulator devm action\n"); -+ goto err_put; -+ } - } - } - -@@ -424,11 +438,11 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) - - ret = imx_get_clks(dev); - if (ret) -- goto disable_hsic_regulator; -+ goto qos_remove_request; - - ret = imx_prepare_enable_clks(dev); - if (ret) -- goto disable_hsic_regulator; -+ goto qos_remove_request; - - data->phy = devm_usb_get_phy_by_phandle(dev, "fsl,usbphy", 0); - if (IS_ERR(data->phy)) { -@@ -458,7 +472,11 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) - of_usb_get_phy_mode(np) == USBPHY_INTERFACE_MODE_ULPI) { - pdata.flags |= CI_HDRC_OVERRIDE_PHY_CONTROL; - data->override_phy_control = true; -- usb_phy_init(pdata.usb_phy); -+ ret = usb_phy_init(pdata.usb_phy); -+ if (ret) { -+ dev_err(dev, "Failed to init phy\n"); -+ goto err_clk; -+ } - } - - if (pdata.flags & CI_HDRC_SUPPORTS_RUNTIME_PM) -@@ -467,7 +485,7 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) - ret = imx_usbmisc_init(data->usbmisc_data); - if (ret) { - dev_err(dev, "usbmisc init failed, ret=%d\n", ret); -- goto err_clk; -+ goto phy_shutdown; - } - - data->ci_pdev = ci_hdrc_add_device(dev, -@@ -476,7 +494,7 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) - if (IS_ERR(data->ci_pdev)) { - ret = PTR_ERR(data->ci_pdev); - dev_err_probe(dev, ret, "ci_hdrc_add_device failed\n"); -- goto err_clk; -+ goto phy_shutdown; - } - - if (data->usbmisc_data) { -@@ -510,17 +528,18 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) - - disable_device: - ci_hdrc_remove_device(data->ci_pdev); -+phy_shutdown: -+ if (data->override_phy_control) -+ usb_phy_shutdown(data->phy); - err_clk: - imx_disable_unprepare_clks(dev); --disable_hsic_regulator: -- if (data->hsic_pad_regulator) -- /* don't overwrite original ret (cf. EPROBE_DEFER) */ -- regulator_disable(data->hsic_pad_regulator); -+qos_remove_request: - if (pdata.flags & CI_HDRC_PMQOS) - cpu_latency_qos_remove_request(&data->pm_qos_req); - data->ci_pdev = NULL; - err_put: -- put_device(data->usbmisc_data->dev); -+ if (data->usbmisc_data) -+ put_device(data->usbmisc_data->dev); - return ret; - } - -@@ -541,10 +560,9 @@ static void ci_hdrc_imx_remove(struct platform_device *pdev) - imx_disable_unprepare_clks(&pdev->dev); - if (data->plat_data->flags & CI_HDRC_PMQOS) - cpu_latency_qos_remove_request(&data->pm_qos_req); -- if (data->hsic_pad_regulator) -- regulator_disable(data->hsic_pad_regulator); - } -- put_device(data->usbmisc_data->dev); -+ if (data->usbmisc_data) -+ put_device(data->usbmisc_data->dev); - } - - static void ci_hdrc_imx_shutdown(struct platform_device *pdev) -diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c -index 6830be4419e20a..559c121f092300 100644 ---- a/drivers/usb/class/cdc-wdm.c -+++ b/drivers/usb/class/cdc-wdm.c -@@ -726,7 +726,7 @@ static int wdm_open(struct inode *inode, struct file *file) - rv = -EBUSY; - goto out; - } -- -+ smp_rmb(); /* ordered against wdm_wwan_port_stop() */ - rv = usb_autopm_get_interface(desc->intf); - if (rv < 0) { - dev_err(&desc->intf->dev, "Error autopm - %d\n", rv); -@@ -829,6 +829,7 @@ static struct usb_class_driver wdm_class = { - static int wdm_wwan_port_start(struct wwan_port *port) - { - struct wdm_device *desc = wwan_port_get_drvdata(port); -+ int rv; - - /* The interface is both exposed via the WWAN framework and as a - * legacy usbmisc chardev. If chardev is already open, just fail -@@ -848,7 +849,15 @@ static int wdm_wwan_port_start(struct wwan_port *port) - wwan_port_txon(port); - - /* Start getting events */ -- return usb_submit_urb(desc->validity, GFP_KERNEL); -+ rv = usb_submit_urb(desc->validity, GFP_KERNEL); -+ if (rv < 0) { -+ wwan_port_txoff(port); -+ desc->manage_power(desc->intf, 0); -+ /* this must be last lest we race with chardev open */ -+ clear_bit(WDM_WWAN_IN_USE, &desc->flags); -+ } -+ -+ return rv; - } - - static void wdm_wwan_port_stop(struct wwan_port *port) -@@ -859,8 +868,10 @@ static void wdm_wwan_port_stop(struct wwan_port *port) - poison_urbs(desc); - desc->manage_power(desc->intf, 0); - clear_bit(WDM_READ, &desc->flags); -- clear_bit(WDM_WWAN_IN_USE, &desc->flags); - unpoison_urbs(desc); -+ smp_wmb(); /* ordered against wdm_open() */ -+ /* this must be last lest we open a poisoned device */ -+ clear_bit(WDM_WWAN_IN_USE, &desc->flags); - } - - static void wdm_wwan_port_tx_complete(struct urb *urb) -@@ -868,7 +879,7 @@ static void wdm_wwan_port_tx_complete(struct urb *urb) - struct sk_buff *skb = urb->context; - struct wdm_device *desc = skb_shinfo(skb)->destructor_arg; - -- usb_autopm_put_interface(desc->intf); -+ usb_autopm_put_interface_async(desc->intf); - wwan_port_txon(desc->wwanp); - kfree_skb(skb); - } -@@ -898,7 +909,7 @@ static int wdm_wwan_port_tx(struct wwan_port *port, struct sk_buff *skb) - req->bRequestType = (USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE); - req->bRequest = USB_CDC_SEND_ENCAPSULATED_COMMAND; - req->wValue = 0; -- req->wIndex = desc->inum; -+ req->wIndex = desc->inum; /* already converted */ - req->wLength = cpu_to_le16(skb->len); - - skb_shinfo(skb)->destructor_arg = desc; -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 6926bd639ec6ff..4903c733d37ae7 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -369,6 +369,9 @@ static const struct usb_device_id usb_quirk_list[] = { - { USB_DEVICE(0x0781, 0x5583), .driver_info = USB_QUIRK_NO_LPM }, - { USB_DEVICE(0x0781, 0x5591), .driver_info = USB_QUIRK_NO_LPM }, - -+ /* SanDisk Corp. SanDisk 3.2Gen1 */ -+ { USB_DEVICE(0x0781, 0x55a3), .driver_info = USB_QUIRK_DELAY_INIT }, -+ - /* Realforce 87U Keyboard */ - { USB_DEVICE(0x0853, 0x011b), .driver_info = USB_QUIRK_NO_LPM }, - -@@ -383,6 +386,9 @@ static const struct usb_device_id usb_quirk_list[] = { - { USB_DEVICE(0x0904, 0x6103), .driver_info = - USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL }, - -+ /* Silicon Motion Flash Drive */ -+ { USB_DEVICE(0x090c, 0x1000), .driver_info = USB_QUIRK_DELAY_INIT }, -+ - /* Sound Devices USBPre2 */ - { USB_DEVICE(0x0926, 0x0202), .driver_info = - USB_QUIRK_ENDPOINT_IGNORE }, -@@ -536,6 +542,9 @@ static const struct usb_device_id usb_quirk_list[] = { - { USB_DEVICE(0x2040, 0x7200), .driver_info = - USB_QUIRK_CONFIG_INTF_STRINGS }, - -+ /* VLI disk */ -+ { USB_DEVICE(0x2109, 0x0711), .driver_info = USB_QUIRK_NO_LPM }, -+ - /* Raydium Touchscreen */ - { USB_DEVICE(0x2386, 0x3114), .driver_info = USB_QUIRK_NO_LPM }, - -diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c -index 052852f8014676..54a4ee2b90b7f4 100644 ---- a/drivers/usb/dwc3/dwc3-pci.c -+++ b/drivers/usb/dwc3/dwc3-pci.c -@@ -148,11 +148,21 @@ static const struct property_entry dwc3_pci_intel_byt_properties[] = { - {} - }; - -+/* -+ * Intel Merrifield SoC uses these endpoints for tracing and they cannot -+ * be re-allocated if being used because the side band flow control signals -+ * are hard wired to certain endpoints: -+ * - 1 High BW Bulk IN (IN#1) (RTIT) -+ * - 1 1KB BW Bulk IN (IN#8) + 1 1KB BW Bulk OUT (Run Control) (OUT#8) -+ */ -+static const u8 dwc3_pci_mrfld_reserved_endpoints[] = { 3, 16, 17 }; -+ - static const struct property_entry dwc3_pci_mrfld_properties[] = { - PROPERTY_ENTRY_STRING("dr_mode", "otg"), - PROPERTY_ENTRY_STRING("linux,extcon-name", "mrfld_bcove_pwrsrc"), - PROPERTY_ENTRY_BOOL("snps,dis_u3_susphy_quirk"), - PROPERTY_ENTRY_BOOL("snps,dis_u2_susphy_quirk"), -+ PROPERTY_ENTRY_U8_ARRAY("snps,reserved-endpoints", dwc3_pci_mrfld_reserved_endpoints), - PROPERTY_ENTRY_BOOL("snps,usb2-gadget-lpm-disable"), - PROPERTY_ENTRY_BOOL("linux,sysdev_is_parent"), - {} -diff --git a/drivers/usb/dwc3/dwc3-xilinx.c b/drivers/usb/dwc3/dwc3-xilinx.c -index d19a5d2d65adb9..ae30aa50a58257 100644 ---- a/drivers/usb/dwc3/dwc3-xilinx.c -+++ b/drivers/usb/dwc3/dwc3-xilinx.c -@@ -207,15 +207,13 @@ static int dwc3_xlnx_init_zynqmp(struct dwc3_xlnx *priv_data) - - skip_usb3_phy: - /* ulpi reset via gpio-modepin or gpio-framework driver */ -- reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW); -+ reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH); - if (IS_ERR(reset_gpio)) { - return dev_err_probe(dev, PTR_ERR(reset_gpio), - "Failed to request reset GPIO\n"); - } - - if (reset_gpio) { -- /* Toggle ulpi to reset the phy. */ -- gpiod_set_value_cansleep(reset_gpio, 1); - usleep_range(5000, 10000); - gpiod_set_value_cansleep(reset_gpio, 0); - usleep_range(5000, 10000); -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index fdaace1564f96f..f51d743bb3ecc6 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -548,6 +548,7 @@ static int dwc3_gadget_set_xfer_resource(struct dwc3_ep *dep) - int dwc3_gadget_start_config(struct dwc3 *dwc, unsigned int resource_index) - { - struct dwc3_gadget_ep_cmd_params params; -+ struct dwc3_ep *dep; - u32 cmd; - int i; - int ret; -@@ -564,8 +565,13 @@ int dwc3_gadget_start_config(struct dwc3 *dwc, unsigned int resource_index) - return ret; - - /* Reset resource allocation flags */ -- for (i = resource_index; i < dwc->num_eps && dwc->eps[i]; i++) -- dwc->eps[i]->flags &= ~DWC3_EP_RESOURCE_ALLOCATED; -+ for (i = resource_index; i < dwc->num_eps; i++) { -+ dep = dwc->eps[i]; -+ if (!dep) -+ continue; -+ -+ dep->flags &= ~DWC3_EP_RESOURCE_ALLOCATED; -+ } - - return 0; - } -@@ -752,9 +758,11 @@ void dwc3_gadget_clear_tx_fifos(struct dwc3 *dwc) - - dwc->last_fifo_depth = fifo_depth; - /* Clear existing TXFIFO for all IN eps except ep0 */ -- for (num = 3; num < min_t(int, dwc->num_eps, DWC3_ENDPOINTS_NUM); -- num += 2) { -+ for (num = 3; num < min_t(int, dwc->num_eps, DWC3_ENDPOINTS_NUM); num += 2) { - dep = dwc->eps[num]; -+ if (!dep) -+ continue; -+ - /* Don't change TXFRAMNUM on usb31 version */ - size = DWC3_IP_IS(DWC3) ? 0 : - dwc3_readl(dwc->regs, DWC3_GTXFIFOSIZ(num >> 1)) & -@@ -3670,6 +3678,8 @@ static bool dwc3_gadget_endpoint_trbs_complete(struct dwc3_ep *dep, - - for (i = 0; i < DWC3_ENDPOINTS_NUM; i++) { - dep = dwc->eps[i]; -+ if (!dep) -+ continue; - - if (!(dep->flags & DWC3_EP_ENABLED)) - continue; -@@ -3858,6 +3868,10 @@ static void dwc3_endpoint_interrupt(struct dwc3 *dwc, - u8 epnum = event->endpoint_number; - - dep = dwc->eps[epnum]; -+ if (!dep) { -+ dev_warn(dwc->dev, "spurious event, endpoint %u is not allocated\n", epnum); -+ return; -+ } - - if (!(dep->flags & DWC3_EP_ENABLED)) { - if ((epnum > 1) && !(dep->flags & DWC3_EP_TRANSFER_STARTED)) -@@ -4570,6 +4584,12 @@ static irqreturn_t dwc3_check_event_buf(struct dwc3_event_buffer *evt) - if (!count) - return IRQ_NONE; - -+ if (count > evt->length) { -+ dev_err_ratelimited(dwc->dev, "invalid count(%u) > evt->length(%u)\n", -+ count, evt->length); -+ return IRQ_NONE; -+ } -+ - evt->count = count; - evt->flags |= DWC3_EVENT_PENDING; - -diff --git a/drivers/usb/gadget/udc/aspeed-vhub/dev.c b/drivers/usb/gadget/udc/aspeed-vhub/dev.c -index 573109ca5b7990..a09f72772e6e95 100644 ---- a/drivers/usb/gadget/udc/aspeed-vhub/dev.c -+++ b/drivers/usb/gadget/udc/aspeed-vhub/dev.c -@@ -548,6 +548,9 @@ int ast_vhub_init_dev(struct ast_vhub *vhub, unsigned int idx) - d->vhub = vhub; - d->index = idx; - d->name = devm_kasprintf(parent, GFP_KERNEL, "port%d", idx+1); -+ if (!d->name) -+ return -ENOMEM; -+ - d->regs = vhub->regs + 0x100 + 0x10 * idx; - - ast_vhub_init_ep0(vhub, &d->ep0, d); -diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c -index a219260ad3e6c2..cc1f579f02de1c 100644 ---- a/drivers/usb/host/max3421-hcd.c -+++ b/drivers/usb/host/max3421-hcd.c -@@ -1946,6 +1946,12 @@ max3421_remove(struct spi_device *spi) - usb_put_hcd(hcd); - } - -+static const struct spi_device_id max3421_spi_ids[] = { -+ { "max3421" }, -+ { }, -+}; -+MODULE_DEVICE_TABLE(spi, max3421_spi_ids); -+ - static const struct of_device_id max3421_of_match_table[] = { - { .compatible = "maxim,max3421", }, - {}, -@@ -1955,6 +1961,7 @@ MODULE_DEVICE_TABLE(of, max3421_of_match_table); - static struct spi_driver max3421_driver = { - .probe = max3421_probe, - .remove = max3421_remove, -+ .id_table = max3421_spi_ids, - .driver = { - .name = "max3421-hcd", - .of_match_table = max3421_of_match_table, -diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c -index 900ea0d368e034..9f0a6b27e47cb6 100644 ---- a/drivers/usb/host/ohci-pci.c -+++ b/drivers/usb/host/ohci-pci.c -@@ -165,6 +165,25 @@ static int ohci_quirk_amd700(struct usb_hcd *hcd) - return 0; - } - -+static int ohci_quirk_loongson(struct usb_hcd *hcd) -+{ -+ struct pci_dev *pdev = to_pci_dev(hcd->self.controller); -+ -+ /* -+ * Loongson's LS7A OHCI controller (rev 0x02) has a -+ * flaw. MMIO register with offset 0x60/64 is treated -+ * as legacy PS2-compatible keyboard/mouse interface. -+ * Since OHCI only use 4KB BAR resource, LS7A OHCI's -+ * 32KB BAR is wrapped around (the 2nd 4KB BAR space -+ * is the same as the 1st 4KB internally). So add 4KB -+ * offset (0x1000) to the OHCI registers as a quirk. -+ */ -+ if (pdev->revision == 0x2) -+ hcd->regs += SZ_4K; /* SZ_4K = 0x1000 */ -+ -+ return 0; -+} -+ - static int ohci_quirk_qemu(struct usb_hcd *hcd) - { - struct ohci_hcd *ohci = hcd_to_ohci(hcd); -@@ -224,6 +243,10 @@ static const struct pci_device_id ohci_pci_quirks[] = { - PCI_DEVICE(PCI_VENDOR_ID_ATI, 0x4399), - .driver_data = (unsigned long)ohci_quirk_amd700, - }, -+ { -+ PCI_DEVICE(PCI_VENDOR_ID_LOONGSON, 0x7a24), -+ .driver_data = (unsigned long)ohci_quirk_loongson, -+ }, - { - .vendor = PCI_VENDOR_ID_APPLE, - .device = 0x003f, -diff --git a/drivers/usb/host/xhci-mvebu.c b/drivers/usb/host/xhci-mvebu.c -index 87f1597a0e5ab7..257e4d79971fda 100644 ---- a/drivers/usb/host/xhci-mvebu.c -+++ b/drivers/usb/host/xhci-mvebu.c -@@ -73,13 +73,3 @@ int xhci_mvebu_mbus_init_quirk(struct usb_hcd *hcd) - - return 0; - } -- --int xhci_mvebu_a3700_init_quirk(struct usb_hcd *hcd) --{ -- struct xhci_hcd *xhci = hcd_to_xhci(hcd); -- -- /* Without reset on resume, the HC won't work at all */ -- xhci->quirks |= XHCI_RESET_ON_RESUME; -- -- return 0; --} -diff --git a/drivers/usb/host/xhci-mvebu.h b/drivers/usb/host/xhci-mvebu.h -index 3be021793cc8b0..9d26e22c48422f 100644 ---- a/drivers/usb/host/xhci-mvebu.h -+++ b/drivers/usb/host/xhci-mvebu.h -@@ -12,16 +12,10 @@ struct usb_hcd; - - #if IS_ENABLED(CONFIG_USB_XHCI_MVEBU) - int xhci_mvebu_mbus_init_quirk(struct usb_hcd *hcd); --int xhci_mvebu_a3700_init_quirk(struct usb_hcd *hcd); - #else - static inline int xhci_mvebu_mbus_init_quirk(struct usb_hcd *hcd) - { - return 0; - } -- --static inline int xhci_mvebu_a3700_init_quirk(struct usb_hcd *hcd) --{ -- return 0; --} - #endif - #endif /* __LINUX_XHCI_MVEBU_H */ -diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c -index d68e9abcdc69a6..8832e0cedadaff 100644 ---- a/drivers/usb/host/xhci-plat.c -+++ b/drivers/usb/host/xhci-plat.c -@@ -106,7 +106,7 @@ static const struct xhci_plat_priv xhci_plat_marvell_armada = { - }; - - static const struct xhci_plat_priv xhci_plat_marvell_armada3700 = { -- .init_quirk = xhci_mvebu_a3700_init_quirk, -+ .quirks = XHCI_RESET_ON_RESUME, - }; - - static const struct xhci_plat_priv xhci_plat_brcm = { -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index 4a081685a1953e..cb944396294516 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -1214,16 +1214,19 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id, - * Stopped state, but it will soon change to Running. - * - * Assume this bug on unexpected Stop Endpoint failures. -- * Keep retrying until the EP starts and stops again, on -- * chips where this is known to help. Wait for 100ms. -+ * Keep retrying until the EP starts and stops again. - */ -- if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100))) -- break; - fallthrough; - case EP_STATE_RUNNING: - /* Race, HW handled stop ep cmd before ep was running */ - xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n", - GET_EP_CTX_STATE(ep_ctx)); -+ /* -+ * Don't retry forever if we guessed wrong or a defective HC never starts -+ * the EP or says 'Running' but fails the command. We must give back TDs. -+ */ -+ if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100))) -+ break; - - command = xhci_alloc_command(xhci, false, GFP_ATOMIC); - if (!command) { -@@ -3876,7 +3879,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags, - * enqueue a No Op TRB, this can prevent the Setup and Data Stage - * TRB to be breaked by the Link TRB. - */ -- if (trb_is_link(ep_ring->enqueue + 1)) { -+ if (last_trb_on_seg(ep_ring->enq_seg, ep_ring->enqueue + 1)) { - field = TRB_TYPE(TRB_TR_NOOP) | ep_ring->cycle_state; - queue_trb(xhci, ep_ring, false, 0, 0, - TRB_INTR_TARGET(0), field); -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index b8e2bfd4282809..b583b31ea5e72e 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -1093,6 +1093,8 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 1) }, - { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 2) }, - { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 3) }, -+ /* Abacus Electrics */ -+ { USB_DEVICE(FTDI_VID, ABACUS_OPTICAL_PROBE_PID) }, - { } /* Terminating entry */ - }; - -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index 52be47d684ea66..9acb6f83732763 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -442,6 +442,11 @@ - #define LINX_FUTURE_1_PID 0xF44B /* Linx future device */ - #define LINX_FUTURE_2_PID 0xF44C /* Linx future device */ - -+/* -+ * Abacus Electrics -+ */ -+#define ABACUS_OPTICAL_PROBE_PID 0xf458 /* ABACUS ELECTRICS Optical Probe */ -+ - /* - * Oceanic product ids - */ -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index a9f95bb35bb0f5..5d669511609892 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -611,6 +611,7 @@ static void option_instat_callback(struct urb *urb); - /* Sierra Wireless products */ - #define SIERRA_VENDOR_ID 0x1199 - #define SIERRA_PRODUCT_EM9191 0x90d3 -+#define SIERRA_PRODUCT_EM9291 0x90e3 - - /* UNISOC (Spreadtrum) products */ - #define UNISOC_VENDOR_ID 0x1782 -@@ -2432,6 +2433,8 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) }, - { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) }, - { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0, 0) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9291, 0xff, 0xff, 0x30) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9291, 0xff, 0xff, 0x40) }, - { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) }, - { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, - { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0530, 0xff), /* TCL IK512 MBIM */ -diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c -index 24b8772a345e2f..bac5ab6377ae4b 100644 ---- a/drivers/usb/serial/usb-serial-simple.c -+++ b/drivers/usb/serial/usb-serial-simple.c -@@ -101,6 +101,11 @@ DEVICE(nokia, NOKIA_IDS); - { USB_DEVICE(0x09d7, 0x0100) } /* NovAtel FlexPack GPS */ - DEVICE_N(novatel_gps, NOVATEL_IDS, 3); - -+/* OWON electronic test and measurement equipment driver */ -+#define OWON_IDS() \ -+ { USB_DEVICE(0x5345, 0x1234) } /* HDS200 oscilloscopes and others */ -+DEVICE(owon, OWON_IDS); -+ - /* Siemens USB/MPI adapter */ - #define SIEMENS_IDS() \ - { USB_DEVICE(0x908, 0x0004) } -@@ -135,6 +140,7 @@ static struct usb_serial_driver * const serial_drivers[] = { - &motorola_tetra_device, - &nokia_device, - &novatel_gps_device, -+ &owon_device, - &siemens_mpi_device, - &suunto_device, - &vivopay_device, -@@ -154,6 +160,7 @@ static const struct usb_device_id id_table[] = { - MOTOROLA_TETRA_IDS(), - NOKIA_IDS(), - NOVATEL_IDS(), -+ OWON_IDS(), - SIEMENS_IDS(), - SUUNTO_IDS(), - VIVOPAY_IDS(), -diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h -index 1f8c9b16a0fb85..d460d71b425783 100644 ---- a/drivers/usb/storage/unusual_uas.h -+++ b/drivers/usb/storage/unusual_uas.h -@@ -83,6 +83,13 @@ UNUSUAL_DEV(0x0bc2, 0x331a, 0x0000, 0x9999, - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_NO_REPORT_LUNS), - -+/* Reported-by: Oliver Neukum */ -+UNUSUAL_DEV(0x125f, 0xa94a, 0x0160, 0x0160, -+ "ADATA", -+ "Portable HDD CH94", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_NO_ATA_1X), -+ - /* Reported-by: Benjamin Tissoires */ - UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999, - "Initio Corporation", -diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig -index d43153fec18ea8..af5c214b220699 100644 ---- a/drivers/xen/Kconfig -+++ b/drivers/xen/Kconfig -@@ -278,7 +278,7 @@ config XEN_PRIVCMD_IRQFD - - config XEN_ACPI_PROCESSOR - tristate "Xen ACPI processor" -- depends on XEN && XEN_PV_DOM0 && X86 && ACPI_PROCESSOR && CPU_FREQ -+ depends on XEN && XEN_DOM0 && X86 && ACPI_PROCESSOR && CPU_FREQ - default m - help - This ACPI processor uploads Power Management information to the Xen -diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c -index 68092b64e29eac..e794606e7c780b 100644 ---- a/fs/btrfs/file.c -+++ b/fs/btrfs/file.c -@@ -2225,15 +2225,20 @@ static void btrfs_punch_hole_lock_range(struct inode *inode, - * will always return true. - * So here we need to do extra page alignment for - * filemap_range_has_page(). -+ * -+ * And do not decrease page_lockend right now, as it can be 0. - */ - const u64 page_lockstart = round_up(lockstart, PAGE_SIZE); -- const u64 page_lockend = round_down(lockend + 1, PAGE_SIZE) - 1; -+ const u64 page_lockend = round_down(lockend + 1, PAGE_SIZE); - - while (1) { - truncate_pagecache_range(inode, lockstart, lockend); - - lock_extent(&BTRFS_I(inode)->io_tree, lockstart, lockend, - cached_state); -+ /* The same page or adjacent pages. */ -+ if (page_lockend <= page_lockstart) -+ break; - /* - * We can't have ordered extents in the range, nor dirty/writeback - * pages, because we have locked the inode's VFS lock in exclusive -@@ -2245,7 +2250,7 @@ static void btrfs_punch_hole_lock_range(struct inode *inode, - * we do, unlock the range and retry. - */ - if (!filemap_range_has_page(inode->i_mapping, page_lockstart, -- page_lockend)) -+ page_lockend - 1)) - break; - - unlock_extent(&BTRFS_I(inode)->io_tree, lockstart, lockend, -diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c -index db6977c15c2828..f0befbeb6cb833 100644 ---- a/fs/ceph/inode.c -+++ b/fs/ceph/inode.c -@@ -2319,7 +2319,7 @@ static int fill_fscrypt_truncate(struct inode *inode, - - /* Try to writeback the dirty pagecaches */ - if (issued & (CEPH_CAP_FILE_BUFFER)) { -- loff_t lend = orig_pos + CEPH_FSCRYPT_BLOCK_SHIFT - 1; -+ loff_t lend = orig_pos + CEPH_FSCRYPT_BLOCK_SIZE - 1; - - ret = filemap_write_and_wait_range(inode->i_mapping, - orig_pos, lend); -diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c -index 6fe3c941b56514..4d6ba140276b5f 100644 ---- a/fs/ext4/block_validity.c -+++ b/fs/ext4/block_validity.c -@@ -351,10 +351,9 @@ int ext4_check_blockref(const char *function, unsigned int line, - { - __le32 *bref = p; - unsigned int blk; -+ journal_t *journal = EXT4_SB(inode->i_sb)->s_journal; - -- if (ext4_has_feature_journal(inode->i_sb) && -- (inode->i_ino == -- le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum))) -+ if (journal && inode == journal->j_inode) - return 0; - - while (bref < p+max) { -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index ddfeaf19bff1ba..d3d28e65872027 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -378,10 +378,11 @@ static int __check_block_validity(struct inode *inode, const char *func, - unsigned int line, - struct ext4_map_blocks *map) - { -- if (ext4_has_feature_journal(inode->i_sb) && -- (inode->i_ino == -- le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum))) -+ journal_t *journal = EXT4_SB(inode->i_sb)->s_journal; -+ -+ if (journal && inode == journal->j_inode) - return 0; -+ - if (!ext4_inode_block_valid(inode, map->m_pblk, map->m_len)) { - ext4_error_inode(inode, func, line, map->m_pblk, - "lblock %lu mapped to illegal pblock %llu " -@@ -5478,7 +5479,7 @@ int ext4_setattr(struct mnt_idmap *idmap, struct dentry *dentry, - oldsize & (inode->i_sb->s_blocksize - 1)) { - error = ext4_inode_attach_jinode(inode); - if (error) -- goto err_out; -+ goto out_mmap_sem; - } - - handle = ext4_journal_start(inode, EXT4_HT_INODE, 3); -diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c -index e7e6701806ad26..7ffdf0d037fae0 100644 ---- a/fs/iomap/buffered-io.c -+++ b/fs/iomap/buffered-io.c -@@ -224,7 +224,7 @@ static void iomap_adjust_read_range(struct inode *inode, struct folio *folio, - } - - /* truncate len if we find any trailing uptodate block(s) */ -- for ( ; i <= last; i++) { -+ while (++i <= last) { - if (ifs_block_is_uptodate(ifs, i)) { - plen -= (last - i + 1) * block_size; - last = i - 1; -diff --git a/fs/namespace.c b/fs/namespace.c -index 671e266b8fc5d2..5a885d35efe937 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -2439,56 +2439,62 @@ static struct mountpoint *do_lock_mount(struct path *path, bool beneath) - struct vfsmount *mnt = path->mnt; - struct dentry *dentry; - struct mountpoint *mp = ERR_PTR(-ENOENT); -+ struct path under = {}; - - for (;;) { -- struct mount *m; -+ struct mount *m = real_mount(mnt); - - if (beneath) { -- m = real_mount(mnt); -+ path_put(&under); - read_seqlock_excl(&mount_lock); -- dentry = dget(m->mnt_mountpoint); -+ under.mnt = mntget(&m->mnt_parent->mnt); -+ under.dentry = dget(m->mnt_mountpoint); - read_sequnlock_excl(&mount_lock); -+ dentry = under.dentry; - } else { - dentry = path->dentry; - } - - inode_lock(dentry->d_inode); -- if (unlikely(cant_mount(dentry))) { -- inode_unlock(dentry->d_inode); -- goto out; -- } -- - namespace_lock(); - -- if (beneath && (!is_mounted(mnt) || m->mnt_mountpoint != dentry)) { -+ if (unlikely(cant_mount(dentry) || !is_mounted(mnt))) -+ break; // not to be mounted on -+ -+ if (beneath && unlikely(m->mnt_mountpoint != dentry || -+ &m->mnt_parent->mnt != under.mnt)) { - namespace_unlock(); - inode_unlock(dentry->d_inode); -- goto out; -+ continue; // got moved - } - - mnt = lookup_mnt(path); -- if (likely(!mnt)) -+ if (unlikely(mnt)) { -+ namespace_unlock(); -+ inode_unlock(dentry->d_inode); -+ path_put(path); -+ path->mnt = mnt; -+ path->dentry = dget(mnt->mnt_root); -+ continue; // got overmounted -+ } -+ mp = get_mountpoint(dentry); -+ if (IS_ERR(mp)) - break; -- -- namespace_unlock(); -- inode_unlock(dentry->d_inode); -- if (beneath) -- dput(dentry); -- path_put(path); -- path->mnt = mnt; -- path->dentry = dget(mnt->mnt_root); -- } -- -- mp = get_mountpoint(dentry); -- if (IS_ERR(mp)) { -- namespace_unlock(); -- inode_unlock(dentry->d_inode); -+ if (beneath) { -+ /* -+ * @under duplicates the references that will stay -+ * at least until namespace_unlock(), so the path_put() -+ * below is safe (and OK to do under namespace_lock - -+ * we are not dropping the final references here). -+ */ -+ path_put(&under); -+ } -+ return mp; - } -- --out: -+ namespace_unlock(); -+ inode_unlock(dentry->d_inode); - if (beneath) -- dput(dentry); -- -+ path_put(&under); - return mp; - } - -@@ -2499,14 +2505,11 @@ static inline struct mountpoint *lock_mount(struct path *path) - - static void unlock_mount(struct mountpoint *where) - { -- struct dentry *dentry = where->m_dentry; -- -+ inode_unlock(where->m_dentry->d_inode); - read_seqlock_excl(&mount_lock); - put_mountpoint(where); - read_sequnlock_excl(&mount_lock); -- - namespace_unlock(); -- inode_unlock(dentry->d_inode); - } - - static int graft_tree(struct mount *mnt, struct mount *p, struct mountpoint *mp) -diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c -index 2ecd0303f9421b..4aea458216117f 100644 ---- a/fs/ntfs3/file.c -+++ b/fs/ntfs3/file.c -@@ -335,6 +335,7 @@ static int ntfs_extend(struct inode *inode, loff_t pos, size_t count, - } - - if (extend_init && !is_compressed(ni)) { -+ WARN_ON(ni->i_valid >= pos); - err = ntfs_extend_initialized_size(file, ni, ni->i_valid, pos); - if (err) - goto out; -diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c -index c2a98b2736645d..f04922eb45d4c9 100644 ---- a/fs/smb/client/sess.c -+++ b/fs/smb/client/sess.c -@@ -732,6 +732,22 @@ unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp) - *pbcc_area = bcc_ptr; - } - -+static void -+ascii_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp) -+{ -+ char *bcc_ptr = *pbcc_area; -+ -+ strcpy(bcc_ptr, "Linux version "); -+ bcc_ptr += strlen("Linux version "); -+ strcpy(bcc_ptr, init_utsname()->release); -+ bcc_ptr += strlen(init_utsname()->release) + 1; -+ -+ strcpy(bcc_ptr, CIFS_NETWORK_OPSYS); -+ bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1; -+ -+ *pbcc_area = bcc_ptr; -+} -+ - static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses, - const struct nls_table *nls_cp) - { -@@ -756,6 +772,25 @@ static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses, - *pbcc_area = bcc_ptr; - } - -+static void ascii_domain_string(char **pbcc_area, struct cifs_ses *ses, -+ const struct nls_table *nls_cp) -+{ -+ char *bcc_ptr = *pbcc_area; -+ int len; -+ -+ /* copy domain */ -+ if (ses->domainName != NULL) { -+ len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN); -+ if (WARN_ON_ONCE(len < 0)) -+ len = CIFS_MAX_DOMAINNAME_LEN - 1; -+ bcc_ptr += len; -+ } /* else we send a null domain name so server will default to its own domain */ -+ *bcc_ptr = 0; -+ bcc_ptr++; -+ -+ *pbcc_area = bcc_ptr; -+} -+ - static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses, - const struct nls_table *nls_cp) - { -@@ -801,25 +836,10 @@ static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses, - *bcc_ptr = 0; - bcc_ptr++; /* account for null termination */ - -- /* copy domain */ -- if (ses->domainName != NULL) { -- len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN); -- if (WARN_ON_ONCE(len < 0)) -- len = CIFS_MAX_DOMAINNAME_LEN - 1; -- bcc_ptr += len; -- } /* else we send a null domain name so server will default to its own domain */ -- *bcc_ptr = 0; -- bcc_ptr++; -- - /* BB check for overflow here */ - -- strcpy(bcc_ptr, "Linux version "); -- bcc_ptr += strlen("Linux version "); -- strcpy(bcc_ptr, init_utsname()->release); -- bcc_ptr += strlen(init_utsname()->release) + 1; -- -- strcpy(bcc_ptr, CIFS_NETWORK_OPSYS); -- bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1; -+ ascii_domain_string(&bcc_ptr, ses, nls_cp); -+ ascii_oslm_strings(&bcc_ptr, nls_cp); - - *pbcc_area = bcc_ptr; - } -@@ -1622,7 +1642,7 @@ sess_auth_kerberos(struct sess_data *sess_data) - sess_data->iov[1].iov_len = msg->secblob_len; - pSMB->req.SecurityBlobLength = cpu_to_le16(sess_data->iov[1].iov_len); - -- if (ses->capabilities & CAP_UNICODE) { -+ if (pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) { - /* unicode strings must be word aligned */ - if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) { - *bcc_ptr = 0; -@@ -1631,8 +1651,8 @@ sess_auth_kerberos(struct sess_data *sess_data) - unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp); - unicode_domain_string(&bcc_ptr, ses, sess_data->nls_cp); - } else { -- /* BB: is this right? */ -- ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp); -+ ascii_oslm_strings(&bcc_ptr, sess_data->nls_cp); -+ ascii_domain_string(&bcc_ptr, ses, sess_data->nls_cp); - } - - sess_data->iov[2].iov_len = (long) bcc_ptr - -diff --git a/fs/smb/client/smb1ops.c b/fs/smb/client/smb1ops.c -index bc1bac36c1b291..caa1d852ece49c 100644 ---- a/fs/smb/client/smb1ops.c -+++ b/fs/smb/client/smb1ops.c -@@ -597,6 +597,42 @@ static int cifs_query_path_info(const unsigned int xid, - CIFSSMBClose(xid, tcon, fid.netfid); - } - -+#ifdef CONFIG_CIFS_XATTR -+ /* -+ * For WSL CHR and BLK reparse points it is required to fetch -+ * EA $LXDEV which contains major and minor device numbers. -+ */ -+ if (!rc && data->reparse_point) { -+ struct smb2_file_full_ea_info *ea; -+ -+ ea = (struct smb2_file_full_ea_info *)data->wsl.eas; -+ rc = CIFSSMBQAllEAs(xid, tcon, full_path, SMB2_WSL_XATTR_DEV, -+ &ea->ea_data[SMB2_WSL_XATTR_NAME_LEN + 1], -+ SMB2_WSL_XATTR_DEV_SIZE, cifs_sb); -+ if (rc == SMB2_WSL_XATTR_DEV_SIZE) { -+ ea->next_entry_offset = cpu_to_le32(0); -+ ea->flags = 0; -+ ea->ea_name_length = SMB2_WSL_XATTR_NAME_LEN; -+ ea->ea_value_length = cpu_to_le16(SMB2_WSL_XATTR_DEV_SIZE); -+ memcpy(&ea->ea_data[0], SMB2_WSL_XATTR_DEV, SMB2_WSL_XATTR_NAME_LEN + 1); -+ data->wsl.eas_len = sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 + -+ SMB2_WSL_XATTR_DEV_SIZE; -+ rc = 0; -+ } else if (rc >= 0) { -+ /* It is an error if EA $LXDEV has wrong size. */ -+ rc = -EINVAL; -+ } else { -+ /* -+ * In all other cases ignore error if fetching -+ * of EA $LXDEV failed. It is needed only for -+ * WSL CHR and BLK reparse points and wsl_to_fattr() -+ * handle the case when EA is missing. -+ */ -+ rc = 0; -+ } -+ } -+#endif -+ - return rc; - } - -diff --git a/fs/splice.c b/fs/splice.c -index d983d375ff1130..6f9b06bbb860ac 100644 ---- a/fs/splice.c -+++ b/fs/splice.c -@@ -45,7 +45,7 @@ - * here if set to avoid blocking other users of this pipe if splice is - * being done on it. - */ --static noinline void noinline pipe_clear_nowait(struct file *file) -+static noinline void pipe_clear_nowait(struct file *file) - { - fmode_t fmode = READ_ONCE(file->f_mode); - -diff --git a/include/linux/energy_model.h b/include/linux/energy_model.h -index b9caa01dfac485..adec808b371a11 100644 ---- a/include/linux/energy_model.h -+++ b/include/linux/energy_model.h -@@ -243,7 +243,6 @@ static inline unsigned long em_cpu_energy(struct em_perf_domain *pd, - scale_cpu = arch_scale_cpu_capacity(cpu); - ps = &pd->table[pd->nr_perf_states - 1]; - -- max_util = map_util_perf(max_util); - max_util = min(max_util, allowed_cpu_cap); - freq = map_util_freq(max_util, ps->frequency, scale_cpu); - -diff --git a/include/media/v4l2-subdev.h b/include/media/v4l2-subdev.h -index ab2a7ef61d420f..b4fcd0164048ed 100644 ---- a/include/media/v4l2-subdev.h -+++ b/include/media/v4l2-subdev.h -@@ -1038,10 +1038,11 @@ struct v4l2_subdev_platform_data { - * @active_state: Active state for the subdev (NULL for subdevs tracking the - * state internally). Initialized by calling - * v4l2_subdev_init_finalize(). -- * @enabled_streams: Bitmask of enabled streams used by -- * v4l2_subdev_enable_streams() and -- * v4l2_subdev_disable_streams() helper functions for fallback -- * cases. -+ * @enabled_pads: Bitmask of enabled pads used by v4l2_subdev_enable_streams() -+ * and v4l2_subdev_disable_streams() helper functions for -+ * fallback cases. -+ * @s_stream_enabled: Tracks whether streaming has been enabled with s_stream. -+ * This is only for call_s_stream() internal use. - * - * Each instance of a subdev driver should create this struct, either - * stand-alone or embedded in a larger struct. -@@ -1089,7 +1090,8 @@ struct v4l2_subdev { - * doesn't support it. - */ - struct v4l2_subdev_state *active_state; -- u64 enabled_streams; -+ u64 enabled_pads; -+ bool s_stream_enabled; - }; - - -@@ -1916,4 +1918,17 @@ extern const struct v4l2_subdev_ops v4l2_subdev_call_wrappers; - void v4l2_subdev_notify_event(struct v4l2_subdev *sd, - const struct v4l2_event *ev); - -+/** -+ * v4l2_subdev_is_streaming() - Returns if the subdevice is streaming -+ * @sd: The subdevice -+ * -+ * v4l2_subdev_is_streaming() tells if the subdevice is currently streaming. -+ * "Streaming" here means whether .s_stream() or .enable_streams() has been -+ * successfully called, and the streaming has not yet been disabled. -+ * -+ * If the subdevice implements .enable_streams() this function must be called -+ * while holding the active state lock. -+ */ -+bool v4l2_subdev_is_streaming(struct v4l2_subdev *sd); -+ - #endif /* _V4L2_SUBDEV_H */ -diff --git a/include/soc/qcom/ice.h b/include/soc/qcom/ice.h -index 5870a94599a258..d5f6a228df6594 100644 ---- a/include/soc/qcom/ice.h -+++ b/include/soc/qcom/ice.h -@@ -34,4 +34,6 @@ int qcom_ice_program_key(struct qcom_ice *ice, - int slot); - int qcom_ice_evict_key(struct qcom_ice *ice, int slot); - struct qcom_ice *of_qcom_ice_get(struct device *dev); -+struct qcom_ice *devm_of_qcom_ice_get(struct device *dev); -+ - #endif /* __QCOM_ICE_H__ */ -diff --git a/include/trace/stages/stage3_trace_output.h b/include/trace/stages/stage3_trace_output.h -index c1fb1355d3094b..1e7b0bef95f525 100644 ---- a/include/trace/stages/stage3_trace_output.h -+++ b/include/trace/stages/stage3_trace_output.h -@@ -119,6 +119,14 @@ - trace_print_array_seq(p, array, count, el_size); \ - }) - -+#undef __print_dynamic_array -+#define __print_dynamic_array(array, el_size) \ -+ ({ \ -+ __print_array(__get_dynamic_array(array), \ -+ __get_dynamic_array_len(array) / (el_size), \ -+ (el_size)); \ -+ }) -+ - #undef __print_hex_dump - #define __print_hex_dump(prefix_str, prefix_type, \ - rowsize, groupsize, buf, len, ascii) \ -diff --git a/include/trace/stages/stage7_class_define.h b/include/trace/stages/stage7_class_define.h -index bcb960d16fc0ed..fcd564a590f434 100644 ---- a/include/trace/stages/stage7_class_define.h -+++ b/include/trace/stages/stage7_class_define.h -@@ -22,6 +22,7 @@ - #undef __get_rel_cpumask - #undef __get_rel_sockaddr - #undef __print_array -+#undef __print_dynamic_array - #undef __print_hex_dump - #undef __get_buf - -diff --git a/init/Kconfig b/init/Kconfig -index 1105cb53f391ab..8b630143c720f6 100644 ---- a/init/Kconfig -+++ b/init/Kconfig -@@ -689,7 +689,7 @@ endmenu # "CPU/Task time and stats accounting" - - config CPU_ISOLATION - bool "CPU isolation" -- depends on SMP || COMPILE_TEST -+ depends on SMP - default y - help - Make sure that CPUs running critical tasks are not disturbed by -diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c -index efa7849b82c184..3ce93418e0151d 100644 ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -1247,21 +1247,22 @@ static __cold void io_fallback_tw(struct io_uring_task *tctx, bool sync) - while (node) { - req = container_of(node, struct io_kiocb, io_task_work.node); - node = node->next; -- if (sync && last_ctx != req->ctx) { -+ if (last_ctx != req->ctx) { - if (last_ctx) { -- flush_delayed_work(&last_ctx->fallback_work); -+ if (sync) -+ flush_delayed_work(&last_ctx->fallback_work); - percpu_ref_put(&last_ctx->refs); - } - last_ctx = req->ctx; - percpu_ref_get(&last_ctx->refs); - } -- if (llist_add(&req->io_task_work.node, -- &req->ctx->fallback_llist)) -- schedule_delayed_work(&req->ctx->fallback_work, 1); -+ if (llist_add(&req->io_task_work.node, &last_ctx->fallback_llist)) -+ schedule_delayed_work(&last_ctx->fallback_work, 1); - } - - if (last_ctx) { -- flush_delayed_work(&last_ctx->fallback_work); -+ if (sync) -+ flush_delayed_work(&last_ctx->fallback_work); - percpu_ref_put(&last_ctx->refs); - } - } -@@ -1916,7 +1917,7 @@ struct io_wq_work *io_wq_free_work(struct io_wq_work *work) - struct io_kiocb *req = container_of(work, struct io_kiocb, work); - struct io_kiocb *nxt = NULL; - -- if (req_ref_put_and_test(req)) { -+ if (req_ref_put_and_test_atomic(req)) { - if (req->flags & IO_REQ_LINK_FLAGS) - nxt = io_req_find_next(req); - io_free_req(req); -diff --git a/io_uring/refs.h b/io_uring/refs.h -index 1336de3f2a30aa..21a379b0f22d61 100644 ---- a/io_uring/refs.h -+++ b/io_uring/refs.h -@@ -17,6 +17,13 @@ static inline bool req_ref_inc_not_zero(struct io_kiocb *req) - return atomic_inc_not_zero(&req->refs); - } - -+static inline bool req_ref_put_and_test_atomic(struct io_kiocb *req) -+{ -+ WARN_ON_ONCE(!(data_race(req->flags) & REQ_F_REFCOUNT)); -+ WARN_ON_ONCE(req_ref_zero_or_close_to_overflow(req)); -+ return atomic_dec_and_test(&req->refs); -+} -+ - static inline bool req_ref_put_and_test(struct io_kiocb *req) - { - if (likely(!(req->flags & REQ_F_REFCOUNT))) -diff --git a/kernel/bpf/bpf_cgrp_storage.c b/kernel/bpf/bpf_cgrp_storage.c -index ee1c7b77096e7b..fbbf3b6b9f8353 100644 ---- a/kernel/bpf/bpf_cgrp_storage.c -+++ b/kernel/bpf/bpf_cgrp_storage.c -@@ -162,6 +162,7 @@ BPF_CALL_5(bpf_cgrp_storage_get, struct bpf_map *, map, struct cgroup *, cgroup, - void *, value, u64, flags, gfp_t, gfp_flags) - { - struct bpf_local_storage_data *sdata; -+ bool nobusy; - - WARN_ON_ONCE(!bpf_rcu_lock_held()); - if (flags & ~(BPF_LOCAL_STORAGE_GET_F_CREATE)) -@@ -170,21 +171,21 @@ BPF_CALL_5(bpf_cgrp_storage_get, struct bpf_map *, map, struct cgroup *, cgroup, - if (!cgroup) - return (unsigned long)NULL; - -- if (!bpf_cgrp_storage_trylock()) -- return (unsigned long)NULL; -+ nobusy = bpf_cgrp_storage_trylock(); - -- sdata = cgroup_storage_lookup(cgroup, map, true); -+ sdata = cgroup_storage_lookup(cgroup, map, nobusy); - if (sdata) - goto unlock; - - /* only allocate new storage, when the cgroup is refcounted */ - if (!percpu_ref_is_dying(&cgroup->self.refcnt) && -- (flags & BPF_LOCAL_STORAGE_GET_F_CREATE)) -+ (flags & BPF_LOCAL_STORAGE_GET_F_CREATE) && nobusy) - sdata = bpf_local_storage_update(cgroup, (struct bpf_local_storage_map *)map, - value, BPF_NOEXIST, gfp_flags); - - unlock: -- bpf_cgrp_storage_unlock(); -+ if (nobusy) -+ bpf_cgrp_storage_unlock(); - return IS_ERR_OR_NULL(sdata) ? (unsigned long)NULL : (unsigned long)sdata->data; - } - -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index d6a4102312fadd..e443506b0a65a1 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -20106,6 +20106,33 @@ BTF_ID(func, __rcu_read_unlock) - #endif - BTF_SET_END(btf_id_deny) - -+/* fexit and fmod_ret can't be used to attach to __noreturn functions. -+ * Currently, we must manually list all __noreturn functions here. Once a more -+ * robust solution is implemented, this workaround can be removed. -+ */ -+BTF_SET_START(noreturn_deny) -+#ifdef CONFIG_IA32_EMULATION -+BTF_ID(func, __ia32_sys_exit) -+BTF_ID(func, __ia32_sys_exit_group) -+#endif -+#ifdef CONFIG_KUNIT -+BTF_ID(func, __kunit_abort) -+BTF_ID(func, kunit_try_catch_throw) -+#endif -+#ifdef CONFIG_MODULES -+BTF_ID(func, __module_put_and_kthread_exit) -+#endif -+#ifdef CONFIG_X86_64 -+BTF_ID(func, __x64_sys_exit) -+BTF_ID(func, __x64_sys_exit_group) -+#endif -+BTF_ID(func, do_exit) -+BTF_ID(func, do_group_exit) -+BTF_ID(func, kthread_complete_and_exit) -+BTF_ID(func, kthread_exit) -+BTF_ID(func, make_task_dead) -+BTF_SET_END(noreturn_deny) -+ - static bool can_be_sleepable(struct bpf_prog *prog) - { - if (prog->type == BPF_PROG_TYPE_TRACING) { -@@ -20194,6 +20221,11 @@ static int check_attach_btf_id(struct bpf_verifier_env *env) - } else if (prog->type == BPF_PROG_TYPE_TRACING && - btf_id_set_contains(&btf_id_deny, btf_id)) { - return -EINVAL; -+ } else if ((prog->expected_attach_type == BPF_TRACE_FEXIT || -+ prog->expected_attach_type == BPF_MODIFY_RETURN) && -+ btf_id_set_contains(&noreturn_deny, btf_id)) { -+ verbose(env, "Attaching fexit/fmod_ret to __noreturn functions is rejected.\n"); -+ return -EINVAL; - } - - key = bpf_trampoline_compute_key(tgt_prog, prog->aux->attach_btf, btf_id); -diff --git a/kernel/dma/contiguous.c b/kernel/dma/contiguous.c -index f005c66f378c32..a600819799637b 100644 ---- a/kernel/dma/contiguous.c -+++ b/kernel/dma/contiguous.c -@@ -70,8 +70,7 @@ struct cma *dma_contiguous_default_area; - * Users, who want to set the size of global CMA area for their system - * should use cma= kernel parameter. - */ --static const phys_addr_t size_bytes __initconst = -- (phys_addr_t)CMA_SIZE_MBYTES * SZ_1M; -+#define size_bytes ((phys_addr_t)CMA_SIZE_MBYTES * SZ_1M) - static phys_addr_t size_cmdline __initdata = -1; - static phys_addr_t base_cmdline __initdata; - static phys_addr_t limit_cmdline __initdata; -diff --git a/kernel/events/core.c b/kernel/events/core.c -index b710976fb01b17..987807b1040ae0 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -13419,6 +13419,9 @@ inherit_event(struct perf_event *parent_event, - if (IS_ERR(child_event)) - return child_event; - -+ get_ctx(child_ctx); -+ child_event->ctx = child_ctx; -+ - pmu_ctx = find_get_pmu_context(child_event->pmu, child_ctx, child_event); - if (IS_ERR(pmu_ctx)) { - free_event(child_event); -@@ -13441,8 +13444,6 @@ inherit_event(struct perf_event *parent_event, - return NULL; - } - -- get_ctx(child_ctx); -- - /* - * Make the child state follow the state of the parent event, - * not its attr.disabled bit. We hold the parent's mutex, -@@ -13463,7 +13464,6 @@ inherit_event(struct perf_event *parent_event, - local64_set(&hwc->period_left, sample_period); - } - -- child_event->ctx = child_ctx; - child_event->overflow_handler = parent_event->overflow_handler; - child_event->overflow_handler_context - = parent_event->overflow_handler_context; -diff --git a/kernel/module/Kconfig b/kernel/module/Kconfig -index 33a2e991f60814..b411315ecd3c4b 100644 ---- a/kernel/module/Kconfig -+++ b/kernel/module/Kconfig -@@ -229,6 +229,7 @@ comment "Do not forget to sign required modules with scripts/sign-file" - choice - prompt "Which hash algorithm should modules be signed with?" - depends on MODULE_SIG || IMA_APPRAISE_MODSIG -+ default MODULE_SIG_SHA512 - help - This determines which sort of hashing algorithm will be used during - signature generation. This algorithm _must_ be built into the kernel -diff --git a/kernel/panic.c b/kernel/panic.c -index ef9f9a4e928de6..d7973e97547482 100644 ---- a/kernel/panic.c -+++ b/kernel/panic.c -@@ -763,9 +763,15 @@ device_initcall(register_warn_debugfs); - */ - __visible noinstr void __stack_chk_fail(void) - { -+ unsigned long flags; -+ - instrumentation_begin(); -+ flags = user_access_save(); -+ - panic("stack-protector: Kernel stack is corrupted in: %pB", - __builtin_return_address(0)); -+ -+ user_access_restore(flags); - instrumentation_end(); - } - EXPORT_SYMBOL(__stack_chk_fail); -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 8c5f75af07db0e..760a6c3781cbfc 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -7406,18 +7406,13 @@ int sched_core_idle_cpu(int cpu) - * required to meet deadlines. - */ - unsigned long effective_cpu_util(int cpu, unsigned long util_cfs, -- enum cpu_util_type type, -- struct task_struct *p) -+ unsigned long *min, -+ unsigned long *max) - { -- unsigned long dl_util, util, irq, max; -+ unsigned long util, irq, scale; - struct rq *rq = cpu_rq(cpu); - -- max = arch_scale_cpu_capacity(cpu); -- -- if (!uclamp_is_used() && -- type == FREQUENCY_UTIL && rt_rq_is_runnable(&rq->rt)) { -- return max; -- } -+ scale = arch_scale_cpu_capacity(cpu); - - /* - * Early check to see if IRQ/steal time saturates the CPU, can be -@@ -7425,45 +7420,49 @@ unsigned long effective_cpu_util(int cpu, unsigned long util_cfs, - * update_irq_load_avg(). - */ - irq = cpu_util_irq(rq); -- if (unlikely(irq >= max)) -- return max; -+ if (unlikely(irq >= scale)) { -+ if (min) -+ *min = scale; -+ if (max) -+ *max = scale; -+ return scale; -+ } -+ -+ if (min) { -+ /* -+ * The minimum utilization returns the highest level between: -+ * - the computed DL bandwidth needed with the IRQ pressure which -+ * steals time to the deadline task. -+ * - The minimum performance requirement for CFS and/or RT. -+ */ -+ *min = max(irq + cpu_bw_dl(rq), uclamp_rq_get(rq, UCLAMP_MIN)); -+ -+ /* -+ * When an RT task is runnable and uclamp is not used, we must -+ * ensure that the task will run at maximum compute capacity. -+ */ -+ if (!uclamp_is_used() && rt_rq_is_runnable(&rq->rt)) -+ *min = max(*min, scale); -+ } - - /* - * Because the time spend on RT/DL tasks is visible as 'lost' time to - * CFS tasks and we use the same metric to track the effective - * utilization (PELT windows are synchronized) we can directly add them - * to obtain the CPU's actual utilization. -- * -- * CFS and RT utilization can be boosted or capped, depending on -- * utilization clamp constraints requested by currently RUNNABLE -- * tasks. -- * When there are no CFS RUNNABLE tasks, clamps are released and -- * frequency will be gracefully reduced with the utilization decay. - */ - util = util_cfs + cpu_util_rt(rq); -- if (type == FREQUENCY_UTIL) -- util = uclamp_rq_util_with(rq, util, p); -- -- dl_util = cpu_util_dl(rq); -+ util += cpu_util_dl(rq); - - /* -- * For frequency selection we do not make cpu_util_dl() a permanent part -- * of this sum because we want to use cpu_bw_dl() later on, but we need -- * to check if the CFS+RT+DL sum is saturated (ie. no idle time) such -- * that we select f_max when there is no idle time. -- * -- * NOTE: numerical errors or stop class might cause us to not quite hit -- * saturation when we should -- something for later. -+ * The maximum hint is a soft bandwidth requirement, which can be lower -+ * than the actual utilization because of uclamp_max requirements. - */ -- if (util + dl_util >= max) -- return max; -+ if (max) -+ *max = min(scale, uclamp_rq_get(rq, UCLAMP_MAX)); - -- /* -- * OTOH, for energy computation we need the estimated running time, so -- * include util_dl and ignore dl_bw. -- */ -- if (type == ENERGY_UTIL) -- util += dl_util; -+ if (util >= scale) -+ return scale; - - /* - * There is still idle time; further improve the number by using the -@@ -7474,28 +7473,15 @@ unsigned long effective_cpu_util(int cpu, unsigned long util_cfs, - * U' = irq + --------- * U - * max - */ -- util = scale_irq_capacity(util, irq, max); -+ util = scale_irq_capacity(util, irq, scale); - util += irq; - -- /* -- * Bandwidth required by DEADLINE must always be granted while, for -- * FAIR and RT, we use blocked utilization of IDLE CPUs as a mechanism -- * to gracefully reduce the frequency when no tasks show up for longer -- * periods of time. -- * -- * Ideally we would like to set bw_dl as min/guaranteed freq and util + -- * bw_dl as requested freq. However, cpufreq is not yet ready for such -- * an interface. So, we only do the latter for now. -- */ -- if (type == FREQUENCY_UTIL) -- util += cpu_bw_dl(rq); -- -- return min(max, util); -+ return min(scale, util); - } - - unsigned long sched_cpu_util(int cpu) - { -- return effective_cpu_util(cpu, cpu_util_cfs(cpu), ENERGY_UTIL, NULL); -+ return effective_cpu_util(cpu, cpu_util_cfs(cpu), NULL, NULL); - } - #endif /* CONFIG_SMP */ - -@@ -10048,7 +10034,7 @@ void __init sched_init(void) - #ifdef CONFIG_SMP - rq->sd = NULL; - rq->rd = NULL; -- rq->cpu_capacity = rq->cpu_capacity_orig = SCHED_CAPACITY_SCALE; -+ rq->cpu_capacity = SCHED_CAPACITY_SCALE; - rq->balance_callback = &balance_push_callback; - rq->active_balance = 0; - rq->next_balance = jiffies; -diff --git a/kernel/sched/cpudeadline.c b/kernel/sched/cpudeadline.c -index 57c92d751bcd73..95baa12a10293e 100644 ---- a/kernel/sched/cpudeadline.c -+++ b/kernel/sched/cpudeadline.c -@@ -131,7 +131,7 @@ int cpudl_find(struct cpudl *cp, struct task_struct *p, - if (!dl_task_fits_capacity(p, cpu)) { - cpumask_clear_cpu(cpu, later_mask); - -- cap = capacity_orig_of(cpu); -+ cap = arch_scale_cpu_capacity(cpu); - - if (cap > max_cap || - (cpu == task_cpu(p) && cap == max_cap)) { -diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c -index 259521b179aa11..776be0549162c9 100644 ---- a/kernel/sched/cpufreq_schedutil.c -+++ b/kernel/sched/cpufreq_schedutil.c -@@ -47,7 +47,7 @@ struct sugov_cpu { - u64 last_update; - - unsigned long util; -- unsigned long bw_dl; -+ unsigned long bw_min; - - /* The field below is for single-CPU policies only: */ - #ifdef CONFIG_NO_HZ_COMMON -@@ -81,9 +81,20 @@ static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time) - if (!cpufreq_this_cpu_can_update(sg_policy->policy)) - return false; - -- if (unlikely(sg_policy->limits_changed)) { -- sg_policy->limits_changed = false; -+ if (unlikely(READ_ONCE(sg_policy->limits_changed))) { -+ WRITE_ONCE(sg_policy->limits_changed, false); - sg_policy->need_freq_update = true; -+ -+ /* -+ * The above limits_changed update must occur before the reads -+ * of policy limits in cpufreq_driver_resolve_freq() or a policy -+ * limits update might be missed, so use a memory barrier to -+ * ensure it. -+ * -+ * This pairs with the write memory barrier in sugov_limits(). -+ */ -+ smp_mb(); -+ - return true; - } - -@@ -155,7 +166,6 @@ static unsigned int get_next_freq(struct sugov_policy *sg_policy, - unsigned int freq = arch_scale_freq_invariant() ? - policy->cpuinfo.max_freq : policy->cur; - -- util = map_util_perf(util); - freq = map_util_freq(util, freq, max); - - if (freq == sg_policy->cached_raw_freq && !sg_policy->need_freq_update) -@@ -165,14 +175,30 @@ static unsigned int get_next_freq(struct sugov_policy *sg_policy, - return cpufreq_driver_resolve_freq(policy, freq); - } - -+unsigned long sugov_effective_cpu_perf(int cpu, unsigned long actual, -+ unsigned long min, -+ unsigned long max) -+{ -+ /* Add dvfs headroom to actual utilization */ -+ actual = map_util_perf(actual); -+ /* Actually we don't need to target the max performance */ -+ if (actual < max) -+ max = actual; -+ -+ /* -+ * Ensure at least minimum performance while providing more compute -+ * capacity when possible. -+ */ -+ return max(min, max); -+} -+ - static void sugov_get_util(struct sugov_cpu *sg_cpu) - { -- unsigned long util = cpu_util_cfs_boost(sg_cpu->cpu); -- struct rq *rq = cpu_rq(sg_cpu->cpu); -+ unsigned long min, max, util = cpu_util_cfs_boost(sg_cpu->cpu); - -- sg_cpu->bw_dl = cpu_bw_dl(rq); -- sg_cpu->util = effective_cpu_util(sg_cpu->cpu, util, -- FREQUENCY_UTIL, NULL); -+ util = effective_cpu_util(sg_cpu->cpu, util, &min, &max); -+ sg_cpu->bw_min = min; -+ sg_cpu->util = sugov_effective_cpu_perf(sg_cpu->cpu, util, min, max); - } - - /** -@@ -318,8 +344,8 @@ static inline bool sugov_cpu_is_busy(struct sugov_cpu *sg_cpu) { return false; } - */ - static inline void ignore_dl_rate_limit(struct sugov_cpu *sg_cpu) - { -- if (cpu_bw_dl(cpu_rq(sg_cpu->cpu)) > sg_cpu->bw_dl) -- sg_cpu->sg_policy->limits_changed = true; -+ if (cpu_bw_dl(cpu_rq(sg_cpu->cpu)) > sg_cpu->bw_min) -+ WRITE_ONCE(sg_cpu->sg_policy->limits_changed, true); - } - - static inline bool sugov_update_single_common(struct sugov_cpu *sg_cpu, -@@ -419,8 +445,8 @@ static void sugov_update_single_perf(struct update_util_data *hook, u64 time, - sugov_cpu_is_busy(sg_cpu) && sg_cpu->util < prev_util) - sg_cpu->util = prev_util; - -- cpufreq_driver_adjust_perf(sg_cpu->cpu, map_util_perf(sg_cpu->bw_dl), -- map_util_perf(sg_cpu->util), max_cap); -+ cpufreq_driver_adjust_perf(sg_cpu->cpu, sg_cpu->bw_min, -+ sg_cpu->util, max_cap); - - sg_cpu->sg_policy->last_freq_update_time = time; - } -@@ -829,7 +855,16 @@ static void sugov_limits(struct cpufreq_policy *policy) - mutex_unlock(&sg_policy->work_lock); - } - -- sg_policy->limits_changed = true; -+ /* -+ * The limits_changed update below must take place before the updates -+ * of policy limits in cpufreq_set_policy() or a policy limits update -+ * might be missed, so use a memory barrier to ensure it. -+ * -+ * This pairs with the memory barrier in sugov_should_update_freq(). -+ */ -+ smp_wmb(); -+ -+ WRITE_ONCE(sg_policy->limits_changed, true); - } - - struct cpufreq_governor schedutil_gov = { -diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c -index 6c639e48e49a97..a15cf7969953a5 100644 ---- a/kernel/sched/deadline.c -+++ b/kernel/sched/deadline.c -@@ -132,7 +132,7 @@ static inline unsigned long __dl_bw_capacity(const struct cpumask *mask) - int i; - - for_each_cpu_and(i, mask, cpu_active_mask) -- cap += capacity_orig_of(i); -+ cap += arch_scale_cpu_capacity(i); - - return cap; - } -@@ -144,7 +144,7 @@ static inline unsigned long __dl_bw_capacity(const struct cpumask *mask) - static inline unsigned long dl_bw_capacity(int i) - { - if (!sched_asym_cpucap_active() && -- capacity_orig_of(i) == SCHED_CAPACITY_SCALE) { -+ arch_scale_cpu_capacity(i) == SCHED_CAPACITY_SCALE) { - return dl_bw_cpus(i) << SCHED_CAPACITY_SHIFT; - } else { - RCU_LOCKDEP_WARN(!rcu_read_lock_sched_held(), -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 2808dbdd03847e..268e2a49b964e0 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -4951,7 +4951,7 @@ static inline void util_est_update(struct cfs_rq *cfs_rq, - * To avoid overestimation of actual task utilization, skip updates if - * we cannot grant there is idle time in this CPU. - */ -- if (task_util(p) > capacity_orig_of(cpu_of(rq_of(cfs_rq)))) -+ if (task_util(p) > arch_scale_cpu_capacity(cpu_of(rq_of(cfs_rq)))) - return; - - /* -@@ -4999,14 +4999,14 @@ static inline int util_fits_cpu(unsigned long util, - return fits; - - /* -- * We must use capacity_orig_of() for comparing against uclamp_min and -+ * We must use arch_scale_cpu_capacity() for comparing against uclamp_min and - * uclamp_max. We only care about capacity pressure (by using - * capacity_of()) for comparing against the real util. - * - * If a task is boosted to 1024 for example, we don't want a tiny - * pressure to skew the check whether it fits a CPU or not. - * -- * Similarly if a task is capped to capacity_orig_of(little_cpu), it -+ * Similarly if a task is capped to arch_scale_cpu_capacity(little_cpu), it - * should fit a little cpu even if there's some pressure. - * - * Only exception is for thermal pressure since it has a direct impact -@@ -5018,7 +5018,7 @@ static inline int util_fits_cpu(unsigned long util, - * For uclamp_max, we can tolerate a drop in performance level as the - * goal is to cap the task. So it's okay if it's getting less. - */ -- capacity_orig = capacity_orig_of(cpu); -+ capacity_orig = arch_scale_cpu_capacity(cpu); - capacity_orig_thermal = capacity_orig - arch_scale_thermal_pressure(cpu); - - /* -@@ -7515,7 +7515,7 @@ select_idle_capacity(struct task_struct *p, struct sched_domain *sd, int target) - * Look for the CPU with best capacity. - */ - else if (fits < 0) -- cpu_cap = capacity_orig_of(cpu) - thermal_load_avg(cpu_rq(cpu)); -+ cpu_cap = arch_scale_cpu_capacity(cpu) - thermal_load_avg(cpu_rq(cpu)); - - /* - * First, select CPU which fits better (-1 being better than 0). -@@ -7757,7 +7757,7 @@ cpu_util(int cpu, struct task_struct *p, int dst_cpu, int boost) - util = max(util, util_est); - } - -- return min(util, capacity_orig_of(cpu)); -+ return min(util, arch_scale_cpu_capacity(cpu)); - } - - unsigned long cpu_util_cfs(int cpu) -@@ -7859,7 +7859,7 @@ static inline void eenv_pd_busy_time(struct energy_env *eenv, - for_each_cpu(cpu, pd_cpus) { - unsigned long util = cpu_util(cpu, p, -1, 0); - -- busy_time += effective_cpu_util(cpu, util, ENERGY_UTIL, NULL); -+ busy_time += effective_cpu_util(cpu, util, NULL, NULL); - } - - eenv->pd_busy_time = min(eenv->pd_cap, busy_time); -@@ -7882,7 +7882,7 @@ eenv_pd_max_util(struct energy_env *eenv, struct cpumask *pd_cpus, - for_each_cpu(cpu, pd_cpus) { - struct task_struct *tsk = (cpu == dst_cpu) ? p : NULL; - unsigned long util = cpu_util(cpu, p, dst_cpu, 1); -- unsigned long eff_util; -+ unsigned long eff_util, min, max; - - /* - * Performance domain frequency: utilization clamping -@@ -7891,7 +7891,23 @@ eenv_pd_max_util(struct energy_env *eenv, struct cpumask *pd_cpus, - * NOTE: in case RT tasks are running, by default the - * FREQUENCY_UTIL's utilization can be max OPP. - */ -- eff_util = effective_cpu_util(cpu, util, FREQUENCY_UTIL, tsk); -+ eff_util = effective_cpu_util(cpu, util, &min, &max); -+ -+ /* Task's uclamp can modify min and max value */ -+ if (tsk && uclamp_is_used()) { -+ min = max(min, uclamp_eff_value(p, UCLAMP_MIN)); -+ -+ /* -+ * If there is no active max uclamp constraint, -+ * directly use task's one, otherwise keep max. -+ */ -+ if (uclamp_rq_is_idle(cpu_rq(cpu))) -+ max = uclamp_eff_value(p, UCLAMP_MAX); -+ else -+ max = max(max, uclamp_eff_value(p, UCLAMP_MAX)); -+ } -+ -+ eff_util = sugov_effective_cpu_perf(cpu, eff_util, min, max); - max_util = max(max_util, eff_util); - } - -@@ -9544,8 +9560,6 @@ static void update_cpu_capacity(struct sched_domain *sd, int cpu) - unsigned long capacity = scale_rt_capacity(cpu); - struct sched_group *sdg = sd->groups; - -- cpu_rq(cpu)->cpu_capacity_orig = arch_scale_cpu_capacity(cpu); -- - if (!capacity) - capacity = 1; - -@@ -9621,7 +9635,7 @@ static inline int - check_cpu_capacity(struct rq *rq, struct sched_domain *sd) - { - return ((rq->cpu_capacity * sd->imbalance_pct) < -- (rq->cpu_capacity_orig * 100)); -+ (arch_scale_cpu_capacity(cpu_of(rq)) * 100)); - } - - /* -@@ -9632,7 +9646,7 @@ check_cpu_capacity(struct rq *rq, struct sched_domain *sd) - static inline int check_misfit_status(struct rq *rq, struct sched_domain *sd) - { - return rq->misfit_task_load && -- (rq->cpu_capacity_orig < rq->rd->max_cpu_capacity || -+ (arch_scale_cpu_capacity(rq->cpu) < rq->rd->max_cpu_capacity || - check_cpu_capacity(rq, sd)); - } - -diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c -index b89223a973168f..91b1ee0d81fce4 100644 ---- a/kernel/sched/rt.c -+++ b/kernel/sched/rt.c -@@ -519,7 +519,7 @@ static inline bool rt_task_fits_capacity(struct task_struct *p, int cpu) - min_cap = uclamp_eff_value(p, UCLAMP_MIN); - max_cap = uclamp_eff_value(p, UCLAMP_MAX); - -- cpu_cap = capacity_orig_of(cpu); -+ cpu_cap = arch_scale_cpu_capacity(cpu); - - return cpu_cap >= min(min_cap, max_cap); - } -diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h -index d48c6a292a83db..60dc51f43dd91f 100644 ---- a/kernel/sched/sched.h -+++ b/kernel/sched/sched.h -@@ -1048,7 +1048,6 @@ struct rq { - struct sched_domain __rcu *sd; - - unsigned long cpu_capacity; -- unsigned long cpu_capacity_orig; - - struct balance_callback *balance_callback; - -@@ -2985,29 +2984,14 @@ static inline void cpufreq_update_util(struct rq *rq, unsigned int flags) {} - #endif - - #ifdef CONFIG_SMP --static inline unsigned long capacity_orig_of(int cpu) --{ -- return cpu_rq(cpu)->cpu_capacity_orig; --} -+unsigned long effective_cpu_util(int cpu, unsigned long util_cfs, -+ unsigned long *min, -+ unsigned long *max); - --/** -- * enum cpu_util_type - CPU utilization type -- * @FREQUENCY_UTIL: Utilization used to select frequency -- * @ENERGY_UTIL: Utilization used during energy calculation -- * -- * The utilization signals of all scheduling classes (CFS/RT/DL) and IRQ time -- * need to be aggregated differently depending on the usage made of them. This -- * enum is used within effective_cpu_util() to differentiate the types of -- * utilization expected by the callers, and adjust the aggregation accordingly. -- */ --enum cpu_util_type { -- FREQUENCY_UTIL, -- ENERGY_UTIL, --}; -+unsigned long sugov_effective_cpu_perf(int cpu, unsigned long actual, -+ unsigned long min, -+ unsigned long max); - --unsigned long effective_cpu_util(int cpu, unsigned long util_cfs, -- enum cpu_util_type type, -- struct task_struct *p); - - /* - * Verify the fitness of task @p to run on @cpu taking into account the -diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c -index 2ed884bb362137..c61698cff0f3a8 100644 ---- a/kernel/sched/topology.c -+++ b/kernel/sched/topology.c -@@ -2486,12 +2486,15 @@ build_sched_domains(const struct cpumask *cpu_map, struct sched_domain_attr *att - /* Attach the domains */ - rcu_read_lock(); - for_each_cpu(i, cpu_map) { -+ unsigned long capacity; -+ - rq = cpu_rq(i); - sd = *per_cpu_ptr(d.sd, i); - -+ capacity = arch_scale_cpu_capacity(i); - /* Use READ_ONCE()/WRITE_ONCE() to avoid load/store tearing: */ -- if (rq->cpu_capacity_orig > READ_ONCE(d.rd->max_cpu_capacity)) -- WRITE_ONCE(d.rd->max_cpu_capacity, rq->cpu_capacity_orig); -+ if (capacity > READ_ONCE(d.rd->max_cpu_capacity)) -+ WRITE_ONCE(d.rd->max_cpu_capacity, capacity); - - cpu_attach_domain(sd, d.rd, i); - } -diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c -index 7f2b17fc8ce403..ecdb8c2b2cab21 100644 ---- a/kernel/time/tick-common.c -+++ b/kernel/time/tick-common.c -@@ -495,6 +495,7 @@ void tick_resume(void) - - #ifdef CONFIG_SUSPEND - static DEFINE_RAW_SPINLOCK(tick_freeze_lock); -+static DEFINE_WAIT_OVERRIDE_MAP(tick_freeze_map, LD_WAIT_SLEEP); - static unsigned int tick_freeze_depth; - - /** -@@ -514,9 +515,22 @@ void tick_freeze(void) - if (tick_freeze_depth == num_online_cpus()) { - trace_suspend_resume(TPS("timekeeping_freeze"), - smp_processor_id(), true); -+ /* -+ * All other CPUs have their interrupts disabled and are -+ * suspended to idle. Other tasks have been frozen so there -+ * is no scheduling happening. This means that there is no -+ * concurrency in the system at this point. Therefore it is -+ * okay to acquire a sleeping lock on PREEMPT_RT, such as a -+ * spinlock, because the lock cannot be held by other CPUs -+ * or threads and acquiring it cannot block. -+ * -+ * Inform lockdep about the situation. -+ */ -+ lock_map_acquire_try(&tick_freeze_map); - system_state = SYSTEM_SUSPEND; - sched_clock_suspend(); - timekeeping_suspend(); -+ lock_map_release(&tick_freeze_map); - } else { - tick_suspend_local(); - } -@@ -538,8 +552,16 @@ void tick_unfreeze(void) - raw_spin_lock(&tick_freeze_lock); - - if (tick_freeze_depth == num_online_cpus()) { -+ /* -+ * Similar to tick_freeze(). On resumption the first CPU may -+ * acquire uncontended sleeping locks while other CPUs block on -+ * tick_freeze_lock. -+ */ -+ lock_map_acquire_try(&tick_freeze_map); - timekeeping_resume(); - sched_clock_resume(); -+ lock_map_release(&tick_freeze_map); -+ - system_state = SYSTEM_RUNNING; - trace_suspend_resume(TPS("timekeeping_freeze"), - smp_processor_id(), false); -diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c -index 545393601be8ce..97f660a8ddc73d 100644 ---- a/kernel/trace/bpf_trace.c -+++ b/kernel/trace/bpf_trace.c -@@ -400,7 +400,7 @@ static const struct bpf_func_proto bpf_trace_printk_proto = { - .arg2_type = ARG_CONST_SIZE, - }; - --static void __set_printk_clr_event(void) -+static void __set_printk_clr_event(struct work_struct *work) - { - /* - * This program might be calling bpf_trace_printk, -@@ -413,10 +413,11 @@ static void __set_printk_clr_event(void) - if (trace_set_clr_event("bpf_trace", "bpf_trace_printk", 1)) - pr_warn_ratelimited("could not enable bpf_trace_printk events"); - } -+static DECLARE_WORK(set_printk_work, __set_printk_clr_event); - - const struct bpf_func_proto *bpf_get_trace_printk_proto(void) - { -- __set_printk_clr_event(); -+ schedule_work(&set_printk_work); - return &bpf_trace_printk_proto; - } - -@@ -459,7 +460,7 @@ static const struct bpf_func_proto bpf_trace_vprintk_proto = { - - const struct bpf_func_proto *bpf_get_trace_vprintk_proto(void) - { -- __set_printk_clr_event(); -+ schedule_work(&set_printk_work); - return &bpf_trace_vprintk_proto; - } - -diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c -index 1a936978c2b1a6..5f74e9f9c8a734 100644 ---- a/kernel/trace/trace_events.c -+++ b/kernel/trace/trace_events.c -@@ -470,6 +470,7 @@ static void test_event_printk(struct trace_event_call *call) - case '%': - continue; - case 'p': -+ do_pointer: - /* Find dereferencing fields */ - switch (fmt[i + 1]) { - case 'B': case 'R': case 'r': -@@ -498,6 +499,12 @@ static void test_event_printk(struct trace_event_call *call) - continue; - if (fmt[i + j] == '*') { - star = true; -+ /* Handle %*pbl case */ -+ if (!j && fmt[i + 1] == 'p') { -+ arg++; -+ i++; -+ goto do_pointer; -+ } - continue; - } - if ((fmt[i + j] == 's')) { -diff --git a/lib/test_ubsan.c b/lib/test_ubsan.c -index 2062be1f2e80f6..f90f2b9842ec4f 100644 ---- a/lib/test_ubsan.c -+++ b/lib/test_ubsan.c -@@ -35,18 +35,22 @@ static void test_ubsan_shift_out_of_bounds(void) - - static void test_ubsan_out_of_bounds(void) - { -- volatile int i = 4, j = 5, k = -1; -- volatile char above[4] = { }; /* Protect surrounding memory. */ -- volatile int arr[4]; -- volatile char below[4] = { }; /* Protect surrounding memory. */ -+ int i = 4, j = 4, k = -1; -+ volatile struct { -+ char above[4]; /* Protect surrounding memory. */ -+ int arr[4]; -+ char below[4]; /* Protect surrounding memory. */ -+ } data; - -- above[0] = below[0]; -+ OPTIMIZER_HIDE_VAR(i); -+ OPTIMIZER_HIDE_VAR(j); -+ OPTIMIZER_HIDE_VAR(k); - - UBSAN_TEST(CONFIG_UBSAN_BOUNDS, "above"); -- arr[j] = i; -+ data.arr[j] = i; - - UBSAN_TEST(CONFIG_UBSAN_BOUNDS, "below"); -- arr[k] = i; -+ data.arr[k] = i; - } - - enum ubsan_test_enum { -diff --git a/net/9p/client.c b/net/9p/client.c -index d841d82e908fe3..cf73fe306219a9 100644 ---- a/net/9p/client.c -+++ b/net/9p/client.c -@@ -1547,7 +1547,8 @@ p9_client_read_once(struct p9_fid *fid, u64 offset, struct iov_iter *to, - struct p9_client *clnt = fid->clnt; - struct p9_req_t *req; - int count = iov_iter_count(to); -- int rsize, received, non_zc = 0; -+ u32 rsize, received; -+ bool non_zc = false; - char *dataptr; - - *err = 0; -@@ -1570,7 +1571,7 @@ p9_client_read_once(struct p9_fid *fid, u64 offset, struct iov_iter *to, - 0, 11, "dqd", fid->fid, - offset, rsize); - } else { -- non_zc = 1; -+ non_zc = true; - req = p9_client_rpc(clnt, P9_TREAD, "dqd", fid->fid, offset, - rsize); - } -@@ -1591,11 +1592,11 @@ p9_client_read_once(struct p9_fid *fid, u64 offset, struct iov_iter *to, - return 0; - } - if (rsize < received) { -- pr_err("bogus RREAD count (%d > %d)\n", received, rsize); -+ pr_err("bogus RREAD count (%u > %u)\n", received, rsize); - received = rsize; - } - -- p9_debug(P9_DEBUG_9P, "<<< RREAD count %d\n", received); -+ p9_debug(P9_DEBUG_9P, "<<< RREAD count %u\n", received); - - if (non_zc) { - int n = copy_to_iter(dataptr, received, to); -@@ -1622,9 +1623,9 @@ p9_client_write(struct p9_fid *fid, u64 offset, struct iov_iter *from, int *err) - *err = 0; - - while (iov_iter_count(from)) { -- int count = iov_iter_count(from); -- int rsize = fid->iounit; -- int written; -+ size_t count = iov_iter_count(from); -+ u32 rsize = fid->iounit; -+ u32 written; - - if (!rsize || rsize > clnt->msize - P9_IOHDRSZ) - rsize = clnt->msize - P9_IOHDRSZ; -@@ -1632,7 +1633,7 @@ p9_client_write(struct p9_fid *fid, u64 offset, struct iov_iter *from, int *err) - if (count < rsize) - rsize = count; - -- p9_debug(P9_DEBUG_9P, ">>> TWRITE fid %d offset %llu count %d (/%d)\n", -+ p9_debug(P9_DEBUG_9P, ">>> TWRITE fid %d offset %llu count %u (/%zu)\n", - fid->fid, offset, rsize, count); - - /* Don't bother zerocopy for small IO (< 1024) */ -@@ -1658,11 +1659,11 @@ p9_client_write(struct p9_fid *fid, u64 offset, struct iov_iter *from, int *err) - break; - } - if (rsize < written) { -- pr_err("bogus RWRITE count (%d > %d)\n", written, rsize); -+ pr_err("bogus RWRITE count (%u > %u)\n", written, rsize); - written = rsize; - } - -- p9_debug(P9_DEBUG_9P, "<<< RWRITE count %d\n", written); -+ p9_debug(P9_DEBUG_9P, "<<< RWRITE count %u\n", written); - - p9_req_put(clnt, req); - iov_iter_revert(from, count - written - iov_iter_count(from)); -@@ -2049,7 +2050,8 @@ EXPORT_SYMBOL_GPL(p9_client_xattrcreate); - - int p9_client_readdir(struct p9_fid *fid, char *data, u32 count, u64 offset) - { -- int err, rsize, non_zc = 0; -+ int err, non_zc = 0; -+ u32 rsize; - struct p9_client *clnt; - struct p9_req_t *req; - char *dataptr; -@@ -2058,7 +2060,7 @@ int p9_client_readdir(struct p9_fid *fid, char *data, u32 count, u64 offset) - - iov_iter_kvec(&to, ITER_DEST, &kv, 1, count); - -- p9_debug(P9_DEBUG_9P, ">>> TREADDIR fid %d offset %llu count %d\n", -+ p9_debug(P9_DEBUG_9P, ">>> TREADDIR fid %d offset %llu count %u\n", - fid->fid, offset, count); - - clnt = fid->clnt; -@@ -2093,11 +2095,11 @@ int p9_client_readdir(struct p9_fid *fid, char *data, u32 count, u64 offset) - goto free_and_error; - } - if (rsize < count) { -- pr_err("bogus RREADDIR count (%d > %d)\n", count, rsize); -+ pr_err("bogus RREADDIR count (%u > %u)\n", count, rsize); - count = rsize; - } - -- p9_debug(P9_DEBUG_9P, "<<< RREADDIR count %d\n", count); -+ p9_debug(P9_DEBUG_9P, "<<< RREADDIR count %u\n", count); - - if (non_zc) - memmove(data, dataptr, count); -diff --git a/net/core/lwtunnel.c b/net/core/lwtunnel.c -index 4417a18b3e951a..f63586c9ce0216 100644 ---- a/net/core/lwtunnel.c -+++ b/net/core/lwtunnel.c -@@ -332,6 +332,8 @@ int lwtunnel_output(struct net *net, struct sock *sk, struct sk_buff *skb) - struct dst_entry *dst; - int ret; - -+ local_bh_disable(); -+ - if (dev_xmit_recursion()) { - net_crit_ratelimited("%s(): recursion limit reached on datapath\n", - __func__); -@@ -347,8 +349,10 @@ int lwtunnel_output(struct net *net, struct sock *sk, struct sk_buff *skb) - lwtstate = dst->lwtstate; - - if (lwtstate->type == LWTUNNEL_ENCAP_NONE || -- lwtstate->type > LWTUNNEL_ENCAP_MAX) -- return 0; -+ lwtstate->type > LWTUNNEL_ENCAP_MAX) { -+ ret = 0; -+ goto out; -+ } - - ret = -EOPNOTSUPP; - rcu_read_lock(); -@@ -363,11 +367,13 @@ int lwtunnel_output(struct net *net, struct sock *sk, struct sk_buff *skb) - if (ret == -EOPNOTSUPP) - goto drop; - -- return ret; -+ goto out; - - drop: - kfree_skb(skb); - -+out: -+ local_bh_enable(); - return ret; - } - EXPORT_SYMBOL_GPL(lwtunnel_output); -@@ -379,6 +385,8 @@ int lwtunnel_xmit(struct sk_buff *skb) - struct dst_entry *dst; - int ret; - -+ local_bh_disable(); -+ - if (dev_xmit_recursion()) { - net_crit_ratelimited("%s(): recursion limit reached on datapath\n", - __func__); -@@ -395,8 +403,10 @@ int lwtunnel_xmit(struct sk_buff *skb) - lwtstate = dst->lwtstate; - - if (lwtstate->type == LWTUNNEL_ENCAP_NONE || -- lwtstate->type > LWTUNNEL_ENCAP_MAX) -- return 0; -+ lwtstate->type > LWTUNNEL_ENCAP_MAX) { -+ ret = 0; -+ goto out; -+ } - - ret = -EOPNOTSUPP; - rcu_read_lock(); -@@ -411,11 +421,13 @@ int lwtunnel_xmit(struct sk_buff *skb) - if (ret == -EOPNOTSUPP) - goto drop; - -- return ret; -+ goto out; - - drop: - kfree_skb(skb); - -+out: -+ local_bh_enable(); - return ret; - } - EXPORT_SYMBOL_GPL(lwtunnel_xmit); -@@ -427,6 +439,8 @@ int lwtunnel_input(struct sk_buff *skb) - struct dst_entry *dst; - int ret; - -+ DEBUG_NET_WARN_ON_ONCE(!in_softirq()); -+ - if (dev_xmit_recursion()) { - net_crit_ratelimited("%s(): recursion limit reached on datapath\n", - __func__); -diff --git a/net/core/selftests.c b/net/core/selftests.c -index acb1ee97bbd324..7af99d07762ea0 100644 ---- a/net/core/selftests.c -+++ b/net/core/selftests.c -@@ -100,10 +100,10 @@ static struct sk_buff *net_test_get_skb(struct net_device *ndev, - ehdr->h_proto = htons(ETH_P_IP); - - if (attr->tcp) { -+ memset(thdr, 0, sizeof(*thdr)); - thdr->source = htons(attr->sport); - thdr->dest = htons(attr->dport); - thdr->doff = sizeof(struct tcphdr) / 4; -- thdr->check = 0; - } else { - uhdr->source = htons(attr->sport); - uhdr->dest = htons(attr->dport); -@@ -144,10 +144,18 @@ static struct sk_buff *net_test_get_skb(struct net_device *ndev, - attr->id = net_test_next_id; - shdr->id = net_test_next_id++; - -- if (attr->size) -- skb_put(skb, attr->size); -- if (attr->max_size && attr->max_size > skb->len) -- skb_put(skb, attr->max_size - skb->len); -+ if (attr->size) { -+ void *payload = skb_put(skb, attr->size); -+ -+ memset(payload, 0, attr->size); -+ } -+ -+ if (attr->max_size && attr->max_size > skb->len) { -+ size_t pad_len = attr->max_size - skb->len; -+ void *pad = skb_put(skb, pad_len); -+ -+ memset(pad, 0, pad_len); -+ } - - skb->csum = 0; - skb->ip_summed = CHECKSUM_PARTIAL; -diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c -index 880c5f16b29ccf..371255e624332f 100644 ---- a/net/sched/sch_hfsc.c -+++ b/net/sched/sch_hfsc.c -@@ -958,6 +958,7 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid, - - if (cl != NULL) { - int old_flags; -+ int len = 0; - - if (parentid) { - if (cl->cl_parent && -@@ -988,9 +989,13 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid, - if (usc != NULL) - hfsc_change_usc(cl, usc, cur_time); - -+ if (cl->qdisc->q.qlen != 0) -+ len = qdisc_peek_len(cl->qdisc); -+ /* Check queue length again since some qdisc implementations -+ * (e.g., netem/codel) might empty the queue during the peek -+ * operation. -+ */ - if (cl->qdisc->q.qlen != 0) { -- int len = qdisc_peek_len(cl->qdisc); -- - if (cl->cl_flags & HFSC_RSC) { - if (old_flags & HFSC_RSC) - update_ed(cl, len); -@@ -1633,10 +1638,16 @@ hfsc_dequeue(struct Qdisc *sch) - if (cl->qdisc->q.qlen != 0) { - /* update ed */ - next_len = qdisc_peek_len(cl->qdisc); -- if (realtime) -- update_ed(cl, next_len); -- else -- update_d(cl, next_len); -+ /* Check queue length again since some qdisc implementations -+ * (e.g., netem/codel) might empty the queue during the peek -+ * operation. -+ */ -+ if (cl->qdisc->q.qlen != 0) { -+ if (realtime) -+ update_ed(cl, next_len); -+ else -+ update_d(cl, next_len); -+ } - } else { - /* the class becomes passive */ - eltree_remove(cl); -diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c -index 77a3d016cadec1..ddc3e4e5e18d78 100644 ---- a/net/tipc/monitor.c -+++ b/net/tipc/monitor.c -@@ -716,7 +716,8 @@ void tipc_mon_reinit_self(struct net *net) - if (!mon) - continue; - write_lock_bh(&mon->lock); -- mon->self->addr = tipc_own_addr(net); -+ if (mon->self) -+ mon->self->addr = tipc_own_addr(net); - write_unlock_bh(&mon->lock); - } - } -diff --git a/samples/trace_events/trace-events-sample.h b/samples/trace_events/trace-events-sample.h -index 1c6b843b8c4eeb..06be777b3b14b7 100644 ---- a/samples/trace_events/trace-events-sample.h -+++ b/samples/trace_events/trace-events-sample.h -@@ -302,6 +302,7 @@ TRACE_EVENT(foo_bar, - __bitmask( cpus, num_possible_cpus() ) - __cpumask( cpum ) - __vstring( vstr, fmt, va ) -+ __string_len( lstr, foo, bar / 2 < strlen(foo) ? bar / 2 : strlen(foo) ) - ), - - TP_fast_assign( -@@ -310,12 +311,14 @@ TRACE_EVENT(foo_bar, - memcpy(__get_dynamic_array(list), lst, - __length_of(lst) * sizeof(int)); - __assign_str(str, string); -+ __assign_str(lstr, foo); - __assign_vstr(vstr, fmt, va); - __assign_bitmask(cpus, cpumask_bits(mask), num_possible_cpus()); - __assign_cpumask(cpum, cpumask_bits(mask)); - ), - -- TP_printk("foo %s %d %s %s %s %s (%s) (%s) %s", __entry->foo, __entry->bar, -+ TP_printk("foo %s %d %s %s %s %s %s %s (%s) (%s) %s [%d] %*pbl", -+ __entry->foo, __entry->bar, - - /* - * Notice here the use of some helper functions. This includes: -@@ -359,8 +362,17 @@ TRACE_EVENT(foo_bar, - __print_array(__get_dynamic_array(list), - __get_dynamic_array_len(list) / sizeof(int), - sizeof(int)), -- __get_str(str), __get_bitmask(cpus), __get_cpumask(cpum), -- __get_str(vstr)) -+ -+/* A shortcut is to use __print_dynamic_array for dynamic arrays */ -+ -+ __print_dynamic_array(list, sizeof(int)), -+ -+ __get_str(str), __get_str(lstr), -+ __get_bitmask(cpus), __get_cpumask(cpum), -+ __get_str(vstr), -+ __get_dynamic_array_len(cpus), -+ __get_dynamic_array_len(cpus), -+ __get_dynamic_array(cpus)) - ); - - /* -diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib -index 44f20b1b853a50..4aecfb0a0ef6ae 100644 ---- a/scripts/Makefile.lib -+++ b/scripts/Makefile.lib -@@ -268,7 +268,7 @@ objtool-args-$(CONFIG_SLS) += --sls - objtool-args-$(CONFIG_STACK_VALIDATION) += --stackval - objtool-args-$(CONFIG_HAVE_STATIC_CALL_INLINE) += --static-call - objtool-args-$(CONFIG_HAVE_UACCESS_VALIDATION) += --uaccess --objtool-args-$(CONFIG_GCOV_KERNEL) += --no-unreachable -+objtool-args-$(or $(CONFIG_GCOV_KERNEL),$(CONFIG_KCOV)) += --no-unreachable - objtool-args-$(CONFIG_PREFIX_SYMBOLS) += --prefix=$(CONFIG_FUNCTION_PADDING_BYTES) - - objtool-args = $(objtool-args-y) \ -diff --git a/sound/soc/codecs/wcd934x.c b/sound/soc/codecs/wcd934x.c -index 1b6e376f3833cb..fe222c4b74c006 100644 ---- a/sound/soc/codecs/wcd934x.c -+++ b/sound/soc/codecs/wcd934x.c -@@ -2281,7 +2281,7 @@ static irqreturn_t wcd934x_slim_irq_handler(int irq, void *data) - { - struct wcd934x_codec *wcd = data; - unsigned long status = 0; -- int i, j, port_id; -+ unsigned int i, j, port_id; - unsigned int val, int_val = 0; - irqreturn_t ret = IRQ_NONE; - bool tx; -diff --git a/sound/soc/qcom/apq8016_sbc.c b/sound/soc/qcom/apq8016_sbc.c -index ff9f6a1c95df19..40b6a837f66bbc 100644 ---- a/sound/soc/qcom/apq8016_sbc.c -+++ b/sound/soc/qcom/apq8016_sbc.c -@@ -343,4 +343,4 @@ module_platform_driver(apq8016_sbc_platform_driver); - - MODULE_AUTHOR("Srinivas Kandagatla variant->exit) - drvdata->variant->exit(pdev); -- -- -- return 0; - } - EXPORT_SYMBOL_GPL(asoc_qcom_lpass_cpu_platform_remove); - -@@ -1307,4 +1304,4 @@ void asoc_qcom_lpass_cpu_platform_shutdown(struct platform_device *pdev) - EXPORT_SYMBOL_GPL(asoc_qcom_lpass_cpu_platform_shutdown); - - MODULE_DESCRIPTION("QTi LPASS CPU Driver"); --MODULE_LICENSE("GPL v2"); -+MODULE_LICENSE("GPL"); -diff --git a/sound/soc/qcom/lpass-hdmi.c b/sound/soc/qcom/lpass-hdmi.c -index 24b1a7523adb90..ce753ebc08945a 100644 ---- a/sound/soc/qcom/lpass-hdmi.c -+++ b/sound/soc/qcom/lpass-hdmi.c -@@ -251,4 +251,4 @@ const struct snd_soc_dai_ops asoc_qcom_lpass_hdmi_dai_ops = { - EXPORT_SYMBOL_GPL(asoc_qcom_lpass_hdmi_dai_ops); - - MODULE_DESCRIPTION("QTi LPASS HDMI Driver"); --MODULE_LICENSE("GPL v2"); -+MODULE_LICENSE("GPL"); -diff --git a/sound/soc/qcom/lpass-ipq806x.c b/sound/soc/qcom/lpass-ipq806x.c -index 2c97f295e39400..2a82684c04de45 100644 ---- a/sound/soc/qcom/lpass-ipq806x.c -+++ b/sound/soc/qcom/lpass-ipq806x.c -@@ -172,9 +172,9 @@ static struct platform_driver ipq806x_lpass_cpu_platform_driver = { - .of_match_table = of_match_ptr(ipq806x_lpass_cpu_device_id), - }, - .probe = asoc_qcom_lpass_cpu_platform_probe, -- .remove = asoc_qcom_lpass_cpu_platform_remove, -+ .remove_new = asoc_qcom_lpass_cpu_platform_remove, - }; - module_platform_driver(ipq806x_lpass_cpu_platform_driver); - - MODULE_DESCRIPTION("QTi LPASS CPU Driver"); --MODULE_LICENSE("GPL v2"); -+MODULE_LICENSE("GPL"); -diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c -index 73e3d39bd24c30..f918d9e16dc041 100644 ---- a/sound/soc/qcom/lpass-platform.c -+++ b/sound/soc/qcom/lpass-platform.c -@@ -1383,4 +1383,4 @@ int asoc_qcom_lpass_platform_register(struct platform_device *pdev) - EXPORT_SYMBOL_GPL(asoc_qcom_lpass_platform_register); - - MODULE_DESCRIPTION("QTi LPASS Platform Driver"); --MODULE_LICENSE("GPL v2"); -+MODULE_LICENSE("GPL"); -diff --git a/sound/soc/qcom/lpass-sc7180.c b/sound/soc/qcom/lpass-sc7180.c -index d16c0d83aaad92..98faf82c22568e 100644 ---- a/sound/soc/qcom/lpass-sc7180.c -+++ b/sound/soc/qcom/lpass-sc7180.c -@@ -315,11 +315,11 @@ static struct platform_driver sc7180_lpass_cpu_platform_driver = { - .pm = &sc7180_lpass_pm_ops, - }, - .probe = asoc_qcom_lpass_cpu_platform_probe, -- .remove = asoc_qcom_lpass_cpu_platform_remove, -+ .remove_new = asoc_qcom_lpass_cpu_platform_remove, - .shutdown = asoc_qcom_lpass_cpu_platform_shutdown, - }; - - module_platform_driver(sc7180_lpass_cpu_platform_driver); - - MODULE_DESCRIPTION("SC7180 LPASS CPU DRIVER"); --MODULE_LICENSE("GPL v2"); -+MODULE_LICENSE("GPL"); -diff --git a/sound/soc/qcom/lpass-sc7280.c b/sound/soc/qcom/lpass-sc7280.c -index 6b2eb25ed9390c..97b9053ed3b027 100644 ---- a/sound/soc/qcom/lpass-sc7280.c -+++ b/sound/soc/qcom/lpass-sc7280.c -@@ -445,7 +445,7 @@ static struct platform_driver sc7280_lpass_cpu_platform_driver = { - .pm = &sc7280_lpass_pm_ops, - }, - .probe = asoc_qcom_lpass_cpu_platform_probe, -- .remove = asoc_qcom_lpass_cpu_platform_remove, -+ .remove_new = asoc_qcom_lpass_cpu_platform_remove, - .shutdown = asoc_qcom_lpass_cpu_platform_shutdown, - }; - -diff --git a/sound/soc/qcom/lpass.h b/sound/soc/qcom/lpass.h -index ea12f02eca55f6..5caec24555ea2e 100644 ---- a/sound/soc/qcom/lpass.h -+++ b/sound/soc/qcom/lpass.h -@@ -399,8 +399,8 @@ struct lpass_pcm_data { - }; - - /* register the platform driver from the CPU DAI driver */ --int asoc_qcom_lpass_platform_register(struct platform_device *); --int asoc_qcom_lpass_cpu_platform_remove(struct platform_device *pdev); -+int asoc_qcom_lpass_platform_register(struct platform_device *pdev); -+void asoc_qcom_lpass_cpu_platform_remove(struct platform_device *pdev); - void asoc_qcom_lpass_cpu_platform_shutdown(struct platform_device *pdev); - int asoc_qcom_lpass_cpu_platform_probe(struct platform_device *pdev); - extern const struct snd_soc_dai_ops asoc_qcom_lpass_cpu_dai_ops; -diff --git a/sound/soc/qcom/qdsp6/q6afe.c b/sound/soc/qcom/qdsp6/q6afe.c -index 919e326b9462b3..fcef53b97ff98a 100644 ---- a/sound/soc/qcom/qdsp6/q6afe.c -+++ b/sound/soc/qcom/qdsp6/q6afe.c -@@ -552,13 +552,13 @@ struct q6afe_port { - }; - - struct afe_cmd_remote_lpass_core_hw_vote_request { -- uint32_t hw_block_id; -- char client_name[8]; -+ uint32_t hw_block_id; -+ char client_name[8]; - } __packed; - - struct afe_cmd_remote_lpass_core_hw_devote_request { -- uint32_t hw_block_id; -- uint32_t client_handle; -+ uint32_t hw_block_id; -+ uint32_t client_handle; - } __packed; - - -diff --git a/sound/soc/qcom/qdsp6/q6apm-dai.c b/sound/soc/qcom/qdsp6/q6apm-dai.c -index def05ce58d176e..179f4f7386dd00 100644 ---- a/sound/soc/qcom/qdsp6/q6apm-dai.c -+++ b/sound/soc/qcom/qdsp6/q6apm-dai.c -@@ -64,20 +64,16 @@ struct q6apm_dai_rtd { - phys_addr_t phys; - unsigned int pcm_size; - unsigned int pcm_count; -- unsigned int pos; /* Buffer position */ - unsigned int periods; - unsigned int bytes_sent; - unsigned int bytes_received; - unsigned int copied_total; - uint16_t bits_per_sample; -- uint16_t source; /* Encoding source bit mask */ -- uint16_t session_id; -+ snd_pcm_uframes_t queue_ptr; - bool next_track; - enum stream_state state; - struct q6apm_graph *graph; - spinlock_t lock; -- uint32_t initial_samples_drop; -- uint32_t trailing_samples_drop; - bool notify_on_drain; - }; - -@@ -127,25 +123,16 @@ static void event_handler(uint32_t opcode, uint32_t token, uint32_t *payload, vo - { - struct q6apm_dai_rtd *prtd = priv; - struct snd_pcm_substream *substream = prtd->substream; -- unsigned long flags; - - switch (opcode) { - case APM_CLIENT_EVENT_CMD_EOS_DONE: - prtd->state = Q6APM_STREAM_STOPPED; - break; - case APM_CLIENT_EVENT_DATA_WRITE_DONE: -- spin_lock_irqsave(&prtd->lock, flags); -- prtd->pos += prtd->pcm_count; -- spin_unlock_irqrestore(&prtd->lock, flags); - snd_pcm_period_elapsed(substream); -- if (prtd->state == Q6APM_STREAM_RUNNING) -- q6apm_write_async(prtd->graph, prtd->pcm_count, 0, 0, 0); - - break; - case APM_CLIENT_EVENT_DATA_READ_DONE: -- spin_lock_irqsave(&prtd->lock, flags); -- prtd->pos += prtd->pcm_count; -- spin_unlock_irqrestore(&prtd->lock, flags); - snd_pcm_period_elapsed(substream); - if (prtd->state == Q6APM_STREAM_RUNNING) - q6apm_read(prtd->graph); -@@ -251,7 +238,6 @@ static int q6apm_dai_prepare(struct snd_soc_component *component, - } - - prtd->pcm_count = snd_pcm_lib_period_bytes(substream); -- prtd->pos = 0; - /* rate and channels are sent to audio driver */ - ret = q6apm_graph_media_format_shmem(prtd->graph, &cfg); - if (ret < 0) { -@@ -297,6 +283,27 @@ static int q6apm_dai_prepare(struct snd_soc_component *component, - return 0; - } - -+static int q6apm_dai_ack(struct snd_soc_component *component, struct snd_pcm_substream *substream) -+{ -+ struct snd_pcm_runtime *runtime = substream->runtime; -+ struct q6apm_dai_rtd *prtd = runtime->private_data; -+ int i, ret = 0, avail_periods; -+ -+ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) { -+ avail_periods = (runtime->control->appl_ptr - prtd->queue_ptr)/runtime->period_size; -+ for (i = 0; i < avail_periods; i++) { -+ ret = q6apm_write_async(prtd->graph, prtd->pcm_count, 0, 0, NO_TIMESTAMP); -+ if (ret < 0) { -+ dev_err(component->dev, "Error queuing playback buffer %d\n", ret); -+ return ret; -+ } -+ prtd->queue_ptr += runtime->period_size; -+ } -+ } -+ -+ return ret; -+} -+ - static int q6apm_dai_trigger(struct snd_soc_component *component, - struct snd_pcm_substream *substream, int cmd) - { -@@ -308,9 +315,6 @@ static int q6apm_dai_trigger(struct snd_soc_component *component, - case SNDRV_PCM_TRIGGER_START: - case SNDRV_PCM_TRIGGER_RESUME: - case SNDRV_PCM_TRIGGER_PAUSE_RELEASE: -- /* start writing buffers for playback only as we already queued capture buffers */ -- if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) -- ret = q6apm_write_async(prtd->graph, prtd->pcm_count, 0, 0, 0); - break; - case SNDRV_PCM_TRIGGER_STOP: - /* TODO support be handled via SoftPause Module */ -@@ -432,16 +436,12 @@ static snd_pcm_uframes_t q6apm_dai_pointer(struct snd_soc_component *component, - struct snd_pcm_runtime *runtime = substream->runtime; - struct q6apm_dai_rtd *prtd = runtime->private_data; - snd_pcm_uframes_t ptr; -- unsigned long flags; - -- spin_lock_irqsave(&prtd->lock, flags); -- if (prtd->pos == prtd->pcm_size) -- prtd->pos = 0; -- -- ptr = bytes_to_frames(runtime, prtd->pos); -- spin_unlock_irqrestore(&prtd->lock, flags); -+ ptr = q6apm_get_hw_pointer(prtd->graph, substream->stream) * runtime->period_size; -+ if (ptr) -+ return ptr - 1; - -- return ptr; -+ return 0; - } - - static int q6apm_dai_hw_params(struct snd_soc_component *component, -@@ -656,8 +656,6 @@ static int q6apm_dai_compr_set_params(struct snd_soc_component *component, - prtd->pcm_size = runtime->fragments * runtime->fragment_size; - prtd->bits_per_sample = 16; - -- prtd->pos = 0; -- - if (prtd->next_track != true) { - memcpy(&prtd->codec, codec, sizeof(*codec)); - -@@ -721,14 +719,12 @@ static int q6apm_dai_compr_set_metadata(struct snd_soc_component *component, - - switch (metadata->key) { - case SNDRV_COMPRESS_ENCODER_PADDING: -- prtd->trailing_samples_drop = metadata->value[0]; - q6apm_remove_trailing_silence(component->dev, prtd->graph, -- prtd->trailing_samples_drop); -+ metadata->value[0]); - break; - case SNDRV_COMPRESS_ENCODER_DELAY: -- prtd->initial_samples_drop = metadata->value[0]; - q6apm_remove_initial_silence(component->dev, prtd->graph, -- prtd->initial_samples_drop); -+ metadata->value[0]); - break; - default: - ret = -EINVAL; -@@ -840,6 +836,7 @@ static const struct snd_soc_component_driver q6apm_fe_dai_component = { - .hw_params = q6apm_dai_hw_params, - .pointer = q6apm_dai_pointer, - .trigger = q6apm_dai_trigger, -+ .ack = q6apm_dai_ack, - .compress_ops = &q6apm_dai_compress_ops, - .use_dai_pcm_id = true, - }; -diff --git a/sound/soc/qcom/qdsp6/q6asm.h b/sound/soc/qcom/qdsp6/q6asm.h -index 394604c349432f..a33d92c7bd6bff 100644 ---- a/sound/soc/qcom/qdsp6/q6asm.h -+++ b/sound/soc/qcom/qdsp6/q6asm.h -@@ -36,16 +36,16 @@ enum { - #define ASM_LAST_BUFFER_FLAG BIT(30) - - struct q6asm_flac_cfg { -- u32 sample_rate; -- u32 ext_sample_rate; -- u32 min_frame_size; -- u32 max_frame_size; -- u16 stream_info_present; -- u16 min_blk_size; -- u16 max_blk_size; -- u16 ch_cfg; -- u16 sample_size; -- u16 md5_sum; -+ u32 sample_rate; -+ u32 ext_sample_rate; -+ u32 min_frame_size; -+ u32 max_frame_size; -+ u16 stream_info_present; -+ u16 min_blk_size; -+ u16 max_blk_size; -+ u16 ch_cfg; -+ u16 sample_size; -+ u16 md5_sum; - }; - - struct q6asm_wma_cfg { -diff --git a/sound/soc/qcom/qdsp6/topology.c b/sound/soc/qcom/qdsp6/topology.c -index 130b22a34fb3b5..70572c83e1017d 100644 ---- a/sound/soc/qcom/qdsp6/topology.c -+++ b/sound/soc/qcom/qdsp6/topology.c -@@ -545,6 +545,7 @@ static struct audioreach_module *audioreach_parse_common_tokens(struct q6apm *ap - - if (mod) { - int pn, id = 0; -+ - mod->module_id = module_id; - mod->max_ip_port = max_ip_port; - mod->max_op_port = max_op_port; -@@ -1271,7 +1272,7 @@ int audioreach_tplg_init(struct snd_soc_component *component) - - ret = request_firmware(&fw, tplg_fw_name, dev); - if (ret < 0) { -- dev_err(dev, "tplg firmware loading %s failed %d \n", tplg_fw_name, ret); -+ dev_err(dev, "tplg firmware loading %s failed %d\n", tplg_fw_name, ret); - goto err; - } - -diff --git a/sound/soc/qcom/sc7180.c b/sound/soc/qcom/sc7180.c -index d1fd40e3f7a9d8..1367752f2b63a6 100644 ---- a/sound/soc/qcom/sc7180.c -+++ b/sound/soc/qcom/sc7180.c -@@ -428,4 +428,4 @@ static struct platform_driver sc7180_snd_driver = { - module_platform_driver(sc7180_snd_driver); - - MODULE_DESCRIPTION("sc7180 ASoC Machine Driver"); --MODULE_LICENSE("GPL v2"); -+MODULE_LICENSE("GPL"); -diff --git a/sound/soc/qcom/sc8280xp.c b/sound/soc/qcom/sc8280xp.c -index 6e5f194bc34b06..d5cc967992d161 100644 ---- a/sound/soc/qcom/sc8280xp.c -+++ b/sound/soc/qcom/sc8280xp.c -@@ -174,4 +174,4 @@ static struct platform_driver snd_sc8280xp_driver = { - module_platform_driver(snd_sc8280xp_driver); - MODULE_AUTHOR("Srinivas Kandagatla substreams) - return -ENOMEM; - -+ /* -+ * Initialize critical substream fields early in case we hit an -+ * error path and end up trying to clean up uninitialized structures -+ * elsewhere. -+ */ -+ for (i = 0; i < snd->nsubstreams; ++i) { -+ struct virtio_pcm_substream *vss = &snd->substreams[i]; -+ -+ vss->snd = snd; -+ vss->sid = i; -+ INIT_WORK(&vss->elapsed_period, virtsnd_pcm_period_elapsed); -+ init_waitqueue_head(&vss->msg_empty); -+ spin_lock_init(&vss->lock); -+ } -+ - info = kcalloc(snd->nsubstreams, sizeof(*info), GFP_KERNEL); - if (!info) - return -ENOMEM; -@@ -350,12 +365,6 @@ int virtsnd_pcm_parse_cfg(struct virtio_snd *snd) - struct virtio_pcm_substream *vss = &snd->substreams[i]; - struct virtio_pcm *vpcm; - -- vss->snd = snd; -- vss->sid = i; -- INIT_WORK(&vss->elapsed_period, virtsnd_pcm_period_elapsed); -- init_waitqueue_head(&vss->msg_empty); -- spin_lock_init(&vss->lock); -- - rc = virtsnd_pcm_build_hw(vss, &info[i]); - if (rc) - goto on_exit; -diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c -index 90ae2ea61324cc..174e076e56af2a 100644 ---- a/tools/bpf/bpftool/prog.c -+++ b/tools/bpf/bpftool/prog.c -@@ -1924,6 +1924,7 @@ static int do_loader(int argc, char **argv) - - obj = bpf_object__open_file(file, &open_opts); - if (!obj) { -+ err = -1; - p_err("failed to open object file"); - goto err_close_obj; - } -diff --git a/tools/objtool/check.c b/tools/objtool/check.c -index 8ba5bcfd5cd572..a1b14378bab045 100644 ---- a/tools/objtool/check.c -+++ b/tools/objtool/check.c -@@ -1225,12 +1225,15 @@ static const char *uaccess_safe_builtin[] = { - "__ubsan_handle_load_invalid_value", - /* STACKLEAK */ - "stackleak_track_stack", -+ /* TRACE_BRANCH_PROFILING */ -+ "ftrace_likely_update", -+ /* STACKPROTECTOR */ -+ "__stack_chk_fail", - /* misc */ - "csum_partial_copy_generic", - "copy_mc_fragile", - "copy_mc_fragile_handle_tail", - "copy_mc_enhanced_fast_string", -- "ftrace_likely_update", /* CONFIG_TRACE_BRANCH_PROFILING */ - "rep_stos_alternative", - "rep_movs_alternative", - "__copy_user_nocache", -@@ -1549,6 +1552,8 @@ static int add_jump_destinations(struct objtool_file *file) - unsigned long dest_off; - - for_each_insn(file, insn) { -+ struct symbol *func = insn_func(insn); -+ - if (insn->jump_dest) { - /* - * handle_group_alt() may have previously set -@@ -1572,7 +1577,7 @@ static int add_jump_destinations(struct objtool_file *file) - } else if (reloc->sym->return_thunk) { - add_return_call(file, insn, true); - continue; -- } else if (insn_func(insn)) { -+ } else if (func) { - /* - * External sibling call or internal sibling call with - * STT_FUNC reloc. -@@ -1605,6 +1610,15 @@ static int add_jump_destinations(struct objtool_file *file) - continue; - } - -+ /* -+ * GCOV/KCOV dead code can jump to the end of the -+ * function/section. -+ */ -+ if (file->ignore_unreachables && func && -+ dest_sec == insn->sec && -+ dest_off == func->offset + func->len) -+ continue; -+ - WARN_INSN(insn, "can't find jump dest instruction at %s+0x%lx", - dest_sec->name, dest_off); - return -1; -@@ -1613,8 +1627,7 @@ static int add_jump_destinations(struct objtool_file *file) - /* - * Cross-function jump. - */ -- if (insn_func(insn) && insn_func(jump_dest) && -- insn_func(insn) != insn_func(jump_dest)) { -+ if (func && insn_func(jump_dest) && func != insn_func(jump_dest)) { - - /* - * For GCC 8+, create parent/child links for any cold -@@ -1631,10 +1644,10 @@ static int add_jump_destinations(struct objtool_file *file) - * case where the parent function's only reference to a - * subfunction is through a jump table. - */ -- if (!strstr(insn_func(insn)->name, ".cold") && -+ if (!strstr(func->name, ".cold") && - strstr(insn_func(jump_dest)->name, ".cold")) { -- insn_func(insn)->cfunc = insn_func(jump_dest); -- insn_func(jump_dest)->pfunc = insn_func(insn); -+ func->cfunc = insn_func(jump_dest); -+ insn_func(jump_dest)->pfunc = func; - } - } - -@@ -3569,6 +3582,9 @@ static int validate_branch(struct objtool_file *file, struct symbol *func, - !strncmp(func->name, "__pfx_", 6)) - return 0; - -+ if (file->ignore_unreachables) -+ return 0; -+ - WARN("%s() falls through to next function %s()", - func->name, insn_func(insn)->name); - return 1; -@@ -3788,6 +3804,9 @@ static int validate_branch(struct objtool_file *file, struct symbol *func, - if (!next_insn) { - if (state.cfi.cfa.base == CFI_UNDEFINED) - return 0; -+ if (file->ignore_unreachables) -+ return 0; -+ - WARN("%s: unexpected end of section", sec->name); - return 1; - } -@@ -3940,6 +3959,9 @@ static int validate_unret(struct objtool_file *file, struct instruction *insn) - break; - } - -+ if (insn->dead_end) -+ return 0; -+ - if (!next) { - WARN_INSN(insn, "teh end!"); - return -1; -diff --git a/tools/testing/selftests/mincore/mincore_selftest.c b/tools/testing/selftests/mincore/mincore_selftest.c -index e949a43a614508..efabfcbe0b498c 100644 ---- a/tools/testing/selftests/mincore/mincore_selftest.c -+++ b/tools/testing/selftests/mincore/mincore_selftest.c -@@ -261,9 +261,6 @@ TEST(check_file_mmap) - TH_LOG("No read-ahead pages found in memory"); - } - -- EXPECT_LT(i, vec_size) { -- TH_LOG("Read-ahead pages reached the end of the file"); -- } - /* - * End of the readahead window. The rest of the pages shouldn't - * be in memory. -diff --git a/tools/testing/selftests/ublk/test_stripe_04.sh b/tools/testing/selftests/ublk/test_stripe_04.sh -new file mode 100755 -index 00000000000000..1f2b642381d179 ---- /dev/null -+++ b/tools/testing/selftests/ublk/test_stripe_04.sh -@@ -0,0 +1,24 @@ -+#!/bin/bash -+# SPDX-License-Identifier: GPL-2.0 -+ -+. "$(cd "$(dirname "$0")" && pwd)"/test_common.sh -+ -+TID="stripe_04" -+ERR_CODE=0 -+ -+_prep_test "stripe" "mkfs & mount & umount on zero copy" -+ -+backfile_0=$(_create_backfile 256M) -+backfile_1=$(_create_backfile 256M) -+dev_id=$(_add_ublk_dev -t stripe -z -q 2 "$backfile_0" "$backfile_1") -+_check_add_dev $TID $? "$backfile_0" "$backfile_1" -+ -+_mkfs_mount_test /dev/ublkb"${dev_id}" -+ERR_CODE=$? -+ -+_cleanup_test "stripe" -+ -+_remove_backfile "$backfile_0" -+_remove_backfile "$backfile_1" -+ -+_show_result $TID $ERR_CODE diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.089-090.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.089-090.patch deleted file mode 100644 index ef784cc2c4..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.089-090.patch +++ /dev/null @@ -1,5797 +0,0 @@ -diff --git a/Makefile b/Makefile -index 23e90df5785c84..587a1586e76db8 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 89 -+SUBLEVEL = 90 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm/boot/dts/nxp/imx/imx6ul-imx6ull-opos6ul.dtsi b/arch/arm/boot/dts/nxp/imx/imx6ul-imx6ull-opos6ul.dtsi -index f2386dcb9ff2c0..dda4fa91b2f2cc 100644 ---- a/arch/arm/boot/dts/nxp/imx/imx6ul-imx6ull-opos6ul.dtsi -+++ b/arch/arm/boot/dts/nxp/imx/imx6ul-imx6ull-opos6ul.dtsi -@@ -40,6 +40,9 @@ ethphy1: ethernet-phy@1 { - reg = <1>; - interrupt-parent = <&gpio4>; - interrupts = <16 IRQ_TYPE_LEVEL_LOW>; -+ micrel,led-mode = <1>; -+ clocks = <&clks IMX6UL_CLK_ENET_REF>; -+ clock-names = "rmii-ref"; - status = "okay"; - }; - }; -diff --git a/arch/arm64/boot/dts/st/stm32mp251.dtsi b/arch/arm64/boot/dts/st/stm32mp251.dtsi -index 5268a43218415f..ce5409acae1ce0 100644 ---- a/arch/arm64/boot/dts/st/stm32mp251.dtsi -+++ b/arch/arm64/boot/dts/st/stm32mp251.dtsi -@@ -73,14 +73,13 @@ scmi_reset: protocol@16 { - }; - - intc: interrupt-controller@4ac00000 { -- compatible = "arm,cortex-a7-gic"; -+ compatible = "arm,gic-400"; - #interrupt-cells = <3>; -- #address-cells = <1>; - interrupt-controller; - reg = <0x0 0x4ac10000 0x0 0x1000>, -- <0x0 0x4ac20000 0x0 0x2000>, -- <0x0 0x4ac40000 0x0 0x2000>, -- <0x0 0x4ac60000 0x0 0x2000>; -+ <0x0 0x4ac20000 0x0 0x20000>, -+ <0x0 0x4ac40000 0x0 0x20000>, -+ <0x0 0x4ac60000 0x0 0x20000>; - }; - - psci { -diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c -index ecfbff6991bb5d..edc4c727783d82 100644 ---- a/arch/arm64/kernel/proton-pack.c -+++ b/arch/arm64/kernel/proton-pack.c -@@ -879,10 +879,12 @@ static u8 spectre_bhb_loop_affected(void) - static const struct midr_range spectre_bhb_k132_list[] = { - MIDR_ALL_VERSIONS(MIDR_CORTEX_X3), - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2), -+ {}, - }; - static const struct midr_range spectre_bhb_k38_list[] = { - MIDR_ALL_VERSIONS(MIDR_CORTEX_A715), - MIDR_ALL_VERSIONS(MIDR_CORTEX_A720), -+ {}, - }; - static const struct midr_range spectre_bhb_k32_list[] = { - MIDR_ALL_VERSIONS(MIDR_CORTEX_A78), -diff --git a/arch/parisc/math-emu/driver.c b/arch/parisc/math-emu/driver.c -index 6ce427b58836c5..ecd27b48d61f9d 100644 ---- a/arch/parisc/math-emu/driver.c -+++ b/arch/parisc/math-emu/driver.c -@@ -103,9 +103,19 @@ handle_fpe(struct pt_regs *regs) - - memcpy(regs->fr, frcopy, sizeof regs->fr); - if (signalcode != 0) { -- force_sig_fault(signalcode >> 24, signalcode & 0xffffff, -- (void __user *) regs->iaoq[0]); -- return -1; -+ int sig = signalcode >> 24; -+ -+ if (sig == SIGFPE) { -+ /* -+ * Clear floating point trap bit to avoid trapping -+ * again on the first floating-point instruction in -+ * the userspace signal handler. -+ */ -+ regs->fr[0] &= ~(1ULL << 38); -+ } -+ force_sig_fault(sig, signalcode & 0xffffff, -+ (void __user *) regs->iaoq[0]); -+ return -1; - } - - return signalcode ? -1 : 0; -diff --git a/arch/powerpc/boot/wrapper b/arch/powerpc/boot/wrapper -index 352d7de24018fb..ddb02cf0caaf59 100755 ---- a/arch/powerpc/boot/wrapper -+++ b/arch/powerpc/boot/wrapper -@@ -234,10 +234,8 @@ fi - - # suppress some warnings in recent ld versions - nowarn="-z noexecstack" --if ! ld_is_lld; then -- if [ "$LD_VERSION" -ge "$(echo 2.39 | ld_version)" ]; then -- nowarn="$nowarn --no-warn-rwx-segments" -- fi -+if "${CROSS}ld" -v --no-warn-rwx-segments >/dev/null 2>&1; then -+ nowarn="$nowarn --no-warn-rwx-segments" - fi - - platformo=$object/"$platform".o -diff --git a/arch/powerpc/mm/book3s64/radix_pgtable.c b/arch/powerpc/mm/book3s64/radix_pgtable.c -index c6a4ac766b2bf9..28460e33408084 100644 ---- a/arch/powerpc/mm/book3s64/radix_pgtable.c -+++ b/arch/powerpc/mm/book3s64/radix_pgtable.c -@@ -1056,6 +1056,19 @@ int __meminit radix__vmemmap_populate(unsigned long start, unsigned long end, in - pmd_t *pmd; - pte_t *pte; - -+ /* -+ * Make sure we align the start vmemmap addr so that we calculate -+ * the correct start_pfn in altmap boundary check to decided whether -+ * we should use altmap or RAM based backing memory allocation. Also -+ * the address need to be aligned for set_pte operation. -+ -+ * If the start addr is already PMD_SIZE aligned we will try to use -+ * a pmd mapping. We don't want to be too aggressive here beacause -+ * that will cause more allocations in RAM. So only if the namespace -+ * vmemmap start addr is PMD_SIZE aligned we will use PMD mapping. -+ */ -+ -+ start = ALIGN_DOWN(start, PAGE_SIZE); - for (addr = start; addr < end; addr = next) { - next = pmd_addr_end(addr, end); - -@@ -1081,8 +1094,8 @@ int __meminit radix__vmemmap_populate(unsigned long start, unsigned long end, in - * in altmap block allocation failures, in which case - * we fallback to RAM for vmemmap allocation. - */ -- if (altmap && (!IS_ALIGNED(addr, PMD_SIZE) || -- altmap_cross_boundary(altmap, addr, PMD_SIZE))) { -+ if (!IS_ALIGNED(addr, PMD_SIZE) || (altmap && -+ altmap_cross_boundary(altmap, addr, PMD_SIZE))) { - /* - * make sure we don't create altmap mappings - * covering things outside the device. -diff --git a/arch/riscv/include/asm/patch.h b/arch/riscv/include/asm/patch.h -index 9f5d6e14c40553..7228e266b9a1ae 100644 ---- a/arch/riscv/include/asm/patch.h -+++ b/arch/riscv/include/asm/patch.h -@@ -9,7 +9,7 @@ - int patch_insn_write(void *addr, const void *insn, size_t len); - int patch_text_nosync(void *addr, const void *insns, size_t len); - int patch_text_set_nosync(void *addr, u8 c, size_t len); --int patch_text(void *addr, u32 *insns, int ninsns); -+int patch_text(void *addr, u32 *insns, size_t len); - - extern int riscv_patch_in_stop_machine; - -diff --git a/arch/riscv/kernel/patch.c b/arch/riscv/kernel/patch.c -index 78387d843aa56b..aeda87240dbc1e 100644 ---- a/arch/riscv/kernel/patch.c -+++ b/arch/riscv/kernel/patch.c -@@ -19,7 +19,7 @@ - struct patch_insn { - void *addr; - u32 *insns; -- int ninsns; -+ size_t len; - atomic_t cpu_count; - }; - -@@ -234,14 +234,10 @@ NOKPROBE_SYMBOL(patch_text_nosync); - static int patch_text_cb(void *data) - { - struct patch_insn *patch = data; -- unsigned long len; -- int i, ret = 0; -+ int ret = 0; - - if (atomic_inc_return(&patch->cpu_count) == num_online_cpus()) { -- for (i = 0; ret == 0 && i < patch->ninsns; i++) { -- len = GET_INSN_LENGTH(patch->insns[i]); -- ret = patch_insn_write(patch->addr + i * len, &patch->insns[i], len); -- } -+ ret = patch_insn_write(patch->addr, patch->insns, patch->len); - /* - * Make sure the patching store is effective *before* we - * increment the counter which releases all waiting CPUs -@@ -262,13 +258,13 @@ static int patch_text_cb(void *data) - } - NOKPROBE_SYMBOL(patch_text_cb); - --int patch_text(void *addr, u32 *insns, int ninsns) -+int patch_text(void *addr, u32 *insns, size_t len) - { - int ret; - struct patch_insn patch = { - .addr = addr, - .insns = insns, -- .ninsns = ninsns, -+ .len = len, - .cpu_count = ATOMIC_INIT(0), - }; - -diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c -index 4fbc70e823f0fa..297427ffc4e043 100644 ---- a/arch/riscv/kernel/probes/kprobes.c -+++ b/arch/riscv/kernel/probes/kprobes.c -@@ -23,13 +23,13 @@ post_kprobe_handler(struct kprobe *, struct kprobe_ctlblk *, struct pt_regs *); - - static void __kprobes arch_prepare_ss_slot(struct kprobe *p) - { -+ size_t len = GET_INSN_LENGTH(p->opcode); - u32 insn = __BUG_INSN_32; -- unsigned long offset = GET_INSN_LENGTH(p->opcode); - -- p->ainsn.api.restore = (unsigned long)p->addr + offset; -+ p->ainsn.api.restore = (unsigned long)p->addr + len; - -- patch_text_nosync(p->ainsn.api.insn, &p->opcode, 1); -- patch_text_nosync((void *)p->ainsn.api.insn + offset, &insn, 1); -+ patch_text_nosync(p->ainsn.api.insn, &p->opcode, len); -+ patch_text_nosync((void *)p->ainsn.api.insn + len, &insn, GET_INSN_LENGTH(insn)); - } - - static void __kprobes arch_prepare_simulate(struct kprobe *p) -@@ -116,16 +116,18 @@ void *alloc_insn_page(void) - /* install breakpoint in text */ - void __kprobes arch_arm_kprobe(struct kprobe *p) - { -- u32 insn = (p->opcode & __INSN_LENGTH_MASK) == __INSN_LENGTH_32 ? -- __BUG_INSN_32 : __BUG_INSN_16; -+ size_t len = GET_INSN_LENGTH(p->opcode); -+ u32 insn = len == 4 ? __BUG_INSN_32 : __BUG_INSN_16; - -- patch_text(p->addr, &insn, 1); -+ patch_text(p->addr, &insn, len); - } - - /* remove breakpoint from text */ - void __kprobes arch_disarm_kprobe(struct kprobe *p) - { -- patch_text(p->addr, &p->opcode, 1); -+ size_t len = GET_INSN_LENGTH(p->opcode); -+ -+ patch_text(p->addr, &p->opcode, len); - } - - void __kprobes arch_remove_kprobe(struct kprobe *p) -diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c -index 26eeb397363193..16eb4cd11cbd67 100644 ---- a/arch/riscv/net/bpf_jit_comp64.c -+++ b/arch/riscv/net/bpf_jit_comp64.c -@@ -14,6 +14,7 @@ - #include "bpf_jit.h" - - #define RV_FENTRY_NINSNS 2 -+#define RV_FENTRY_NBYTES (RV_FENTRY_NINSNS * 4) - - #define RV_REG_TCC RV_REG_A6 - #define RV_REG_TCC_SAVED RV_REG_S6 /* Store A6 in S6 if program do calls */ -@@ -681,7 +682,7 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type poke_type, - if (ret) - return ret; - -- if (memcmp(ip, old_insns, RV_FENTRY_NINSNS * 4)) -+ if (memcmp(ip, old_insns, RV_FENTRY_NBYTES)) - return -EFAULT; - - ret = gen_jump_or_nops(new_addr, ip, new_insns, is_call); -@@ -690,8 +691,8 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type poke_type, - - cpus_read_lock(); - mutex_lock(&text_mutex); -- if (memcmp(ip, new_insns, RV_FENTRY_NINSNS * 4)) -- ret = patch_text(ip, new_insns, RV_FENTRY_NINSNS); -+ if (memcmp(ip, new_insns, RV_FENTRY_NBYTES)) -+ ret = patch_text(ip, new_insns, RV_FENTRY_NBYTES); - mutex_unlock(&text_mutex); - cpus_read_unlock(); - -diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c -index 66d5782df18f8c..835c9febb6a854 100644 ---- a/arch/x86/events/intel/core.c -+++ b/arch/x86/events/intel/core.c -@@ -4206,7 +4206,7 @@ static struct perf_guest_switch_msr *intel_guest_get_msrs(int *nr, void *data) - arr[pebs_enable] = (struct perf_guest_switch_msr){ - .msr = MSR_IA32_PEBS_ENABLE, - .host = cpuc->pebs_enabled & ~cpuc->intel_ctrl_guest_mask, -- .guest = pebs_mask & ~cpuc->intel_ctrl_host_mask, -+ .guest = pebs_mask & ~cpuc->intel_ctrl_host_mask & kvm_pmu->pebs_enable, - }; - - if (arr[pebs_enable].host) { -diff --git a/arch/x86/include/asm/kvm-x86-ops.h b/arch/x86/include/asm/kvm-x86-ops.h -index 9b419f0de713cc..e59ded9761663e 100644 ---- a/arch/x86/include/asm/kvm-x86-ops.h -+++ b/arch/x86/include/asm/kvm-x86-ops.h -@@ -48,6 +48,7 @@ KVM_X86_OP(set_idt) - KVM_X86_OP(get_gdt) - KVM_X86_OP(set_gdt) - KVM_X86_OP(sync_dirty_debug_regs) -+KVM_X86_OP(set_dr6) - KVM_X86_OP(set_dr7) - KVM_X86_OP(cache_reg) - KVM_X86_OP(get_rflags) -diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h -index 39672561c6be87..5dfb8cc9616e55 100644 ---- a/arch/x86/include/asm/kvm_host.h -+++ b/arch/x86/include/asm/kvm_host.h -@@ -1595,6 +1595,7 @@ struct kvm_x86_ops { - void (*get_gdt)(struct kvm_vcpu *vcpu, struct desc_ptr *dt); - void (*set_gdt)(struct kvm_vcpu *vcpu, struct desc_ptr *dt); - void (*sync_dirty_debug_regs)(struct kvm_vcpu *vcpu); -+ void (*set_dr6)(struct kvm_vcpu *vcpu, unsigned long value); - void (*set_dr7)(struct kvm_vcpu *vcpu, unsigned long value); - void (*cache_reg)(struct kvm_vcpu *vcpu, enum kvm_reg reg); - unsigned long (*get_rflags)(struct kvm_vcpu *vcpu); -diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c -index 1d06b8fc15a85c..29c1be65cb71a0 100644 ---- a/arch/x86/kvm/svm/svm.c -+++ b/arch/x86/kvm/svm/svm.c -@@ -2014,11 +2014,11 @@ static void new_asid(struct vcpu_svm *svm, struct svm_cpu_data *sd) - svm->asid = sd->next_asid++; - } - --static void svm_set_dr6(struct vcpu_svm *svm, unsigned long value) -+static void svm_set_dr6(struct kvm_vcpu *vcpu, unsigned long value) - { -- struct vmcb *vmcb = svm->vmcb; -+ struct vmcb *vmcb = to_svm(vcpu)->vmcb; - -- if (svm->vcpu.arch.guest_state_protected) -+ if (vcpu->arch.guest_state_protected) - return; - - if (unlikely(value != vmcb->save.dr6)) { -@@ -4220,10 +4220,8 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu) - * Run with all-zero DR6 unless needed, so that we can get the exact cause - * of a #DB. - */ -- if (unlikely(vcpu->arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT)) -- svm_set_dr6(svm, vcpu->arch.dr6); -- else -- svm_set_dr6(svm, DR6_ACTIVE_LOW); -+ if (likely(!(vcpu->arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT))) -+ svm_set_dr6(vcpu, DR6_ACTIVE_LOW); - - clgi(); - kvm_load_guest_xsave_state(vcpu); -@@ -5002,6 +5000,7 @@ static struct kvm_x86_ops svm_x86_ops __initdata = { - .set_idt = svm_set_idt, - .get_gdt = svm_get_gdt, - .set_gdt = svm_set_gdt, -+ .set_dr6 = svm_set_dr6, - .set_dr7 = svm_set_dr7, - .sync_dirty_debug_regs = svm_sync_dirty_debug_regs, - .cache_reg = svm_cache_reg, -diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c -index 52098844290ad4..e5a2c230110ea4 100644 ---- a/arch/x86/kvm/vmx/vmx.c -+++ b/arch/x86/kvm/vmx/vmx.c -@@ -5617,6 +5617,12 @@ static void vmx_sync_dirty_debug_regs(struct kvm_vcpu *vcpu) - set_debugreg(DR6_RESERVED, 6); - } - -+static void vmx_set_dr6(struct kvm_vcpu *vcpu, unsigned long val) -+{ -+ lockdep_assert_irqs_disabled(); -+ set_debugreg(vcpu->arch.dr6, 6); -+} -+ - static void vmx_set_dr7(struct kvm_vcpu *vcpu, unsigned long val) - { - vmcs_writel(GUEST_DR7, val); -@@ -7356,10 +7362,6 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu) - vmx->loaded_vmcs->host_state.cr4 = cr4; - } - -- /* When KVM_DEBUGREG_WONT_EXIT, dr6 is accessible in guest. */ -- if (unlikely(vcpu->arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT)) -- set_debugreg(vcpu->arch.dr6, 6); -- - /* When single-stepping over STI and MOV SS, we must clear the - * corresponding interruptibility bits in the guest state. Otherwise - * vmentry fails as it then expects bit 14 (BS) in pending debug -@@ -8292,6 +8294,7 @@ static struct kvm_x86_ops vmx_x86_ops __initdata = { - .set_idt = vmx_set_idt, - .get_gdt = vmx_get_gdt, - .set_gdt = vmx_set_gdt, -+ .set_dr6 = vmx_set_dr6, - .set_dr7 = vmx_set_dr7, - .sync_dirty_debug_regs = vmx_sync_dirty_debug_regs, - .cache_reg = vmx_cache_reg, -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index f67fe8a65820c8..1eeb01afa40ba9 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -10772,6 +10772,9 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) - set_debugreg(vcpu->arch.eff_db[1], 1); - set_debugreg(vcpu->arch.eff_db[2], 2); - set_debugreg(vcpu->arch.eff_db[3], 3); -+ /* When KVM_DEBUGREG_WONT_EXIT, dr6 is accessible in guest. */ -+ if (unlikely(vcpu->arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT)) -+ static_call(kvm_x86_set_dr6)(vcpu, vcpu->arch.dr6); - } else if (unlikely(hw_breakpoint_active())) { - set_debugreg(0, 7); - } -diff --git a/drivers/base/module.c b/drivers/base/module.c -index a33663d92256d8..955582b34e54af 100644 ---- a/drivers/base/module.c -+++ b/drivers/base/module.c -@@ -42,16 +42,13 @@ int module_add_driver(struct module *mod, struct device_driver *drv) - if (mod) - mk = &mod->mkobj; - else if (drv->mod_name) { -- struct kobject *mkobj; -- -- /* Lookup built-in module entry in /sys/modules */ -- mkobj = kset_find_obj(module_kset, drv->mod_name); -- if (mkobj) { -- mk = container_of(mkobj, struct module_kobject, kobj); -+ /* Lookup or create built-in module entry in /sys/modules */ -+ mk = lookup_or_create_module_kobject(drv->mod_name); -+ if (mk) { - /* remember our module structure */ - drv->p->mkobj = mk; -- /* kset_find_obj took a reference */ -- kobject_put(mkobj); -+ /* lookup_or_create_module_kobject took a reference */ -+ kobject_put(&mk->kobj); - } - } - -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index bc3f63f1ccd863..d6195565ef7aeb 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -3521,22 +3521,16 @@ static void btusb_coredump_qca(struct hci_dev *hdev) - bt_dev_err(hdev, "%s: triggle crash failed (%d)", __func__, err); - } - --/* -- * ==0: not a dump pkt. -- * < 0: fails to handle a dump pkt -- * > 0: otherwise. -- */ -+/* Return: 0 on success, negative errno on failure. */ - static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb) - { -- int ret = 1; -+ int ret = 0; - u8 pkt_type; - u8 *sk_ptr; - unsigned int sk_len; - u16 seqno; - u32 dump_size; - -- struct hci_event_hdr *event_hdr; -- struct hci_acl_hdr *acl_hdr; - struct qca_dump_hdr *dump_hdr; - struct btusb_data *btdata = hci_get_drvdata(hdev); - struct usb_device *udev = btdata->udev; -@@ -3546,30 +3540,14 @@ static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb) - sk_len = skb->len; - - if (pkt_type == HCI_ACLDATA_PKT) { -- acl_hdr = hci_acl_hdr(skb); -- if (le16_to_cpu(acl_hdr->handle) != QCA_MEMDUMP_ACL_HANDLE) -- return 0; - sk_ptr += HCI_ACL_HDR_SIZE; - sk_len -= HCI_ACL_HDR_SIZE; -- event_hdr = (struct hci_event_hdr *)sk_ptr; -- } else { -- event_hdr = hci_event_hdr(skb); - } - -- if ((event_hdr->evt != HCI_VENDOR_PKT) -- || (event_hdr->plen != (sk_len - HCI_EVENT_HDR_SIZE))) -- return 0; -- - sk_ptr += HCI_EVENT_HDR_SIZE; - sk_len -= HCI_EVENT_HDR_SIZE; - - dump_hdr = (struct qca_dump_hdr *)sk_ptr; -- if ((sk_len < offsetof(struct qca_dump_hdr, data)) -- || (dump_hdr->vse_class != QCA_MEMDUMP_VSE_CLASS) -- || (dump_hdr->msg_type != QCA_MEMDUMP_MSG_TYPE)) -- return 0; -- -- /*it is dump pkt now*/ - seqno = le16_to_cpu(dump_hdr->seqno); - if (seqno == 0) { - set_bit(BTUSB_HW_SSR_ACTIVE, &btdata->flags); -@@ -3643,17 +3621,84 @@ static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb) - return ret; - } - -+/* Return: true if the ACL packet is a dump packet, false otherwise. */ -+static bool acl_pkt_is_dump_qca(struct hci_dev *hdev, struct sk_buff *skb) -+{ -+ u8 *sk_ptr; -+ unsigned int sk_len; -+ -+ struct hci_event_hdr *event_hdr; -+ struct hci_acl_hdr *acl_hdr; -+ struct qca_dump_hdr *dump_hdr; -+ -+ sk_ptr = skb->data; -+ sk_len = skb->len; -+ -+ acl_hdr = hci_acl_hdr(skb); -+ if (le16_to_cpu(acl_hdr->handle) != QCA_MEMDUMP_ACL_HANDLE) -+ return false; -+ -+ sk_ptr += HCI_ACL_HDR_SIZE; -+ sk_len -= HCI_ACL_HDR_SIZE; -+ event_hdr = (struct hci_event_hdr *)sk_ptr; -+ -+ if ((event_hdr->evt != HCI_VENDOR_PKT) || -+ (event_hdr->plen != (sk_len - HCI_EVENT_HDR_SIZE))) -+ return false; -+ -+ sk_ptr += HCI_EVENT_HDR_SIZE; -+ sk_len -= HCI_EVENT_HDR_SIZE; -+ -+ dump_hdr = (struct qca_dump_hdr *)sk_ptr; -+ if ((sk_len < offsetof(struct qca_dump_hdr, data)) || -+ (dump_hdr->vse_class != QCA_MEMDUMP_VSE_CLASS) || -+ (dump_hdr->msg_type != QCA_MEMDUMP_MSG_TYPE)) -+ return false; -+ -+ return true; -+} -+ -+/* Return: true if the event packet is a dump packet, false otherwise. */ -+static bool evt_pkt_is_dump_qca(struct hci_dev *hdev, struct sk_buff *skb) -+{ -+ u8 *sk_ptr; -+ unsigned int sk_len; -+ -+ struct hci_event_hdr *event_hdr; -+ struct qca_dump_hdr *dump_hdr; -+ -+ sk_ptr = skb->data; -+ sk_len = skb->len; -+ -+ event_hdr = hci_event_hdr(skb); -+ -+ if ((event_hdr->evt != HCI_VENDOR_PKT) -+ || (event_hdr->plen != (sk_len - HCI_EVENT_HDR_SIZE))) -+ return false; -+ -+ sk_ptr += HCI_EVENT_HDR_SIZE; -+ sk_len -= HCI_EVENT_HDR_SIZE; -+ -+ dump_hdr = (struct qca_dump_hdr *)sk_ptr; -+ if ((sk_len < offsetof(struct qca_dump_hdr, data)) || -+ (dump_hdr->vse_class != QCA_MEMDUMP_VSE_CLASS) || -+ (dump_hdr->msg_type != QCA_MEMDUMP_MSG_TYPE)) -+ return false; -+ -+ return true; -+} -+ - static int btusb_recv_acl_qca(struct hci_dev *hdev, struct sk_buff *skb) - { -- if (handle_dump_pkt_qca(hdev, skb)) -- return 0; -+ if (acl_pkt_is_dump_qca(hdev, skb)) -+ return handle_dump_pkt_qca(hdev, skb); - return hci_recv_frame(hdev, skb); - } - - static int btusb_recv_evt_qca(struct hci_dev *hdev, struct sk_buff *skb) - { -- if (handle_dump_pkt_qca(hdev, skb)) -- return 0; -+ if (evt_pkt_is_dump_qca(hdev, skb)) -+ return handle_dump_pkt_qca(hdev, skb); - return hci_recv_frame(hdev, skb); - } - -diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c -index 0ac0998152ce81..6682f422cadd90 100644 ---- a/drivers/cpufreq/cpufreq.c -+++ b/drivers/cpufreq/cpufreq.c -@@ -534,16 +534,18 @@ void cpufreq_disable_fast_switch(struct cpufreq_policy *policy) - EXPORT_SYMBOL_GPL(cpufreq_disable_fast_switch); - - static unsigned int __resolve_freq(struct cpufreq_policy *policy, -- unsigned int target_freq, unsigned int relation) -+ unsigned int target_freq, -+ unsigned int min, unsigned int max, -+ unsigned int relation) - { - unsigned int idx; - -- target_freq = clamp_val(target_freq, policy->min, policy->max); -+ target_freq = clamp_val(target_freq, min, max); - - if (!policy->freq_table) - return target_freq; - -- idx = cpufreq_frequency_table_target(policy, target_freq, relation); -+ idx = cpufreq_frequency_table_target(policy, target_freq, min, max, relation); - policy->cached_resolved_idx = idx; - policy->cached_target_freq = target_freq; - return policy->freq_table[idx].frequency; -@@ -563,7 +565,21 @@ static unsigned int __resolve_freq(struct cpufreq_policy *policy, - unsigned int cpufreq_driver_resolve_freq(struct cpufreq_policy *policy, - unsigned int target_freq) - { -- return __resolve_freq(policy, target_freq, CPUFREQ_RELATION_LE); -+ unsigned int min = READ_ONCE(policy->min); -+ unsigned int max = READ_ONCE(policy->max); -+ -+ /* -+ * If this function runs in parallel with cpufreq_set_policy(), it may -+ * read policy->min before the update and policy->max after the update -+ * or the other way around, so there is no ordering guarantee. -+ * -+ * Resolve this by always honoring the max (in case it comes from -+ * thermal throttling or similar). -+ */ -+ if (unlikely(min > max)) -+ min = max; -+ -+ return __resolve_freq(policy, target_freq, min, max, CPUFREQ_RELATION_LE); - } - EXPORT_SYMBOL_GPL(cpufreq_driver_resolve_freq); - -@@ -2335,7 +2351,8 @@ int __cpufreq_driver_target(struct cpufreq_policy *policy, - if (cpufreq_disabled()) - return -ENODEV; - -- target_freq = __resolve_freq(policy, target_freq, relation); -+ target_freq = __resolve_freq(policy, target_freq, policy->min, -+ policy->max, relation); - - pr_debug("target for CPU %u: %u kHz, relation %u, requested %u kHz\n", - policy->cpu, target_freq, relation, old_target_freq); -@@ -2625,11 +2642,18 @@ static int cpufreq_set_policy(struct cpufreq_policy *policy, - * Resolve policy min/max to available frequencies. It ensures - * no frequency resolution will neither overshoot the requested maximum - * nor undershoot the requested minimum. -+ * -+ * Avoid storing intermediate values in policy->max or policy->min and -+ * compiler optimizations around them because they may be accessed -+ * concurrently by cpufreq_driver_resolve_freq() during the update. - */ -- policy->min = new_data.min; -- policy->max = new_data.max; -- policy->min = __resolve_freq(policy, policy->min, CPUFREQ_RELATION_L); -- policy->max = __resolve_freq(policy, policy->max, CPUFREQ_RELATION_H); -+ WRITE_ONCE(policy->max, __resolve_freq(policy, new_data.max, -+ new_data.min, new_data.max, -+ CPUFREQ_RELATION_H)); -+ new_data.min = __resolve_freq(policy, new_data.min, new_data.min, -+ new_data.max, CPUFREQ_RELATION_L); -+ WRITE_ONCE(policy->min, new_data.min > policy->max ? policy->max : new_data.min); -+ - trace_cpu_frequency_limits(policy); - - policy->cached_target_freq = UINT_MAX; -diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c -index c52d19d67557f5..65cbd5ecbaf83d 100644 ---- a/drivers/cpufreq/cpufreq_ondemand.c -+++ b/drivers/cpufreq/cpufreq_ondemand.c -@@ -77,7 +77,8 @@ static unsigned int generic_powersave_bias_target(struct cpufreq_policy *policy, - return freq_next; - } - -- index = cpufreq_frequency_table_target(policy, freq_next, relation); -+ index = cpufreq_frequency_table_target(policy, freq_next, policy->min, -+ policy->max, relation); - freq_req = freq_table[index].frequency; - freq_reduc = freq_req * od_tuners->powersave_bias / 1000; - freq_avg = freq_req - freq_reduc; -diff --git a/drivers/cpufreq/freq_table.c b/drivers/cpufreq/freq_table.c -index c17dc51a5a022d..94de089b145394 100644 ---- a/drivers/cpufreq/freq_table.c -+++ b/drivers/cpufreq/freq_table.c -@@ -116,8 +116,8 @@ int cpufreq_generic_frequency_table_verify(struct cpufreq_policy_data *policy) - EXPORT_SYMBOL_GPL(cpufreq_generic_frequency_table_verify); - - int cpufreq_table_index_unsorted(struct cpufreq_policy *policy, -- unsigned int target_freq, -- unsigned int relation) -+ unsigned int target_freq, unsigned int min, -+ unsigned int max, unsigned int relation) - { - struct cpufreq_frequency_table optimal = { - .driver_data = ~0, -@@ -148,7 +148,7 @@ int cpufreq_table_index_unsorted(struct cpufreq_policy *policy, - cpufreq_for_each_valid_entry_idx(pos, table, i) { - freq = pos->frequency; - -- if ((freq < policy->min) || (freq > policy->max)) -+ if (freq < min || freq > max) - continue; - if (freq == target_freq) { - optimal.driver_data = i; -diff --git a/drivers/edac/altera_edac.c b/drivers/edac/altera_edac.c -index 8b31cd54bdb6de..e04fd1a7e9aaea 100644 ---- a/drivers/edac/altera_edac.c -+++ b/drivers/edac/altera_edac.c -@@ -98,7 +98,7 @@ static irqreturn_t altr_sdram_mc_err_handler(int irq, void *dev_id) - if (status & priv->ecc_stat_ce_mask) { - regmap_read(drvdata->mc_vbase, priv->ecc_saddr_offset, - &err_addr); -- if (priv->ecc_uecnt_offset) -+ if (priv->ecc_cecnt_offset) - regmap_read(drvdata->mc_vbase, priv->ecc_cecnt_offset, - &err_count); - edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, err_count, -@@ -1015,9 +1015,6 @@ altr_init_a10_ecc_block(struct device_node *np, u32 irq_mask, - } - } - -- /* Interrupt mode set to every SBERR */ -- regmap_write(ecc_mgr_map, ALTR_A10_ECC_INTMODE_OFST, -- ALTR_A10_ECC_INTMODE); - /* Enable ECC */ - ecc_set_bits(ecc_ctrl_en_mask, (ecc_block_base + - ALTR_A10_ECC_CTRL_OFST)); -@@ -2138,6 +2135,10 @@ static int altr_edac_a10_probe(struct platform_device *pdev) - return PTR_ERR(edac->ecc_mgr_map); - } - -+ /* Set irq mask for DDR SBE to avoid any pending irq before registration */ -+ regmap_write(edac->ecc_mgr_map, A10_SYSMGR_ECC_INTMASK_SET_OFST, -+ (A10_SYSMGR_ECC_INTMASK_SDMMCB | A10_SYSMGR_ECC_INTMASK_DDR0)); -+ - edac->irq_chip.name = pdev->dev.of_node->name; - edac->irq_chip.irq_mask = a10_eccmgr_irq_mask; - edac->irq_chip.irq_unmask = a10_eccmgr_irq_unmask; -diff --git a/drivers/edac/altera_edac.h b/drivers/edac/altera_edac.h -index 3727e72c8c2e70..7248d24c4908d7 100644 ---- a/drivers/edac/altera_edac.h -+++ b/drivers/edac/altera_edac.h -@@ -249,6 +249,8 @@ struct altr_sdram_mc_data { - #define A10_SYSMGR_ECC_INTMASK_SET_OFST 0x94 - #define A10_SYSMGR_ECC_INTMASK_CLR_OFST 0x98 - #define A10_SYSMGR_ECC_INTMASK_OCRAM BIT(1) -+#define A10_SYSMGR_ECC_INTMASK_SDMMCB BIT(16) -+#define A10_SYSMGR_ECC_INTMASK_DDR0 BIT(17) - - #define A10_SYSMGR_ECC_INTSTAT_SERR_OFST 0x9C - #define A10_SYSMGR_ECC_INTSTAT_DERR_OFST 0xA0 -diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c -index 7cd6b1564e8018..7c2db3f017651b 100644 ---- a/drivers/firmware/arm_ffa/driver.c -+++ b/drivers/firmware/arm_ffa/driver.c -@@ -225,7 +225,8 @@ __ffa_partition_info_get(u32 uuid0, u32 uuid1, u32 uuid2, u32 uuid3, - memcpy(buffer + idx, drv_info->rx_buffer + idx * sz, - buf_sz); - -- ffa_rx_release(); -+ if (!(flags & PARTITION_INFO_GET_RETURN_COUNT_ONLY)) -+ ffa_rx_release(); - - mutex_unlock(&drv_info->rx_lock); - -diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c -index dcf774d3edfe4c..51eeaf14367dac 100644 ---- a/drivers/firmware/arm_scmi/bus.c -+++ b/drivers/firmware/arm_scmi/bus.c -@@ -240,6 +240,9 @@ static struct scmi_device *scmi_child_dev_find(struct device *parent, - if (!dev) - return NULL; - -+ /* Drop the refcnt bumped implicitly by device_find_child */ -+ put_device(dev); -+ - return to_scmi_dev(dev); - } - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c -index 2ad9f900a85749..a048022d9865a7 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c -@@ -172,7 +172,10 @@ void hdcp_update_display(struct hdcp_workqueue *hdcp_work, - struct mod_hdcp_display_adjustment display_adjust; - unsigned int conn_index = aconnector->base.index; - -- mutex_lock(&hdcp_w->mutex); -+ guard(mutex)(&hdcp_w->mutex); -+ drm_connector_get(&aconnector->base); -+ if (hdcp_w->aconnector[conn_index]) -+ drm_connector_put(&hdcp_w->aconnector[conn_index]->base); - hdcp_w->aconnector[conn_index] = aconnector; - - memset(&link_adjust, 0, sizeof(link_adjust)); -@@ -209,7 +212,6 @@ void hdcp_update_display(struct hdcp_workqueue *hdcp_work, - mod_hdcp_update_display(&hdcp_w->hdcp, conn_index, &link_adjust, &display_adjust, &hdcp_w->output); - - process_output(hdcp_w); -- mutex_unlock(&hdcp_w->mutex); - } - - static void hdcp_remove_display(struct hdcp_workqueue *hdcp_work, -@@ -220,8 +222,7 @@ static void hdcp_remove_display(struct hdcp_workqueue *hdcp_work, - struct drm_connector_state *conn_state = aconnector->base.state; - unsigned int conn_index = aconnector->base.index; - -- mutex_lock(&hdcp_w->mutex); -- hdcp_w->aconnector[conn_index] = aconnector; -+ guard(mutex)(&hdcp_w->mutex); - - /* the removal of display will invoke auth reset -> hdcp destroy and - * we'd expect the Content Protection (CP) property changed back to -@@ -237,9 +238,11 @@ static void hdcp_remove_display(struct hdcp_workqueue *hdcp_work, - } - - mod_hdcp_remove_display(&hdcp_w->hdcp, aconnector->base.index, &hdcp_w->output); -- -+ if (hdcp_w->aconnector[conn_index]) { -+ drm_connector_put(&hdcp_w->aconnector[conn_index]->base); -+ hdcp_w->aconnector[conn_index] = NULL; -+ } - process_output(hdcp_w); -- mutex_unlock(&hdcp_w->mutex); - } - - void hdcp_reset_display(struct hdcp_workqueue *hdcp_work, unsigned int link_index) -@@ -247,7 +250,7 @@ void hdcp_reset_display(struct hdcp_workqueue *hdcp_work, unsigned int link_inde - struct hdcp_workqueue *hdcp_w = &hdcp_work[link_index]; - unsigned int conn_index; - -- mutex_lock(&hdcp_w->mutex); -+ guard(mutex)(&hdcp_w->mutex); - - mod_hdcp_reset_connection(&hdcp_w->hdcp, &hdcp_w->output); - -@@ -256,11 +259,13 @@ void hdcp_reset_display(struct hdcp_workqueue *hdcp_work, unsigned int link_inde - for (conn_index = 0; conn_index < AMDGPU_DM_MAX_DISPLAY_INDEX; conn_index++) { - hdcp_w->encryption_status[conn_index] = - MOD_HDCP_ENCRYPTION_STATUS_HDCP_OFF; -+ if (hdcp_w->aconnector[conn_index]) { -+ drm_connector_put(&hdcp_w->aconnector[conn_index]->base); -+ hdcp_w->aconnector[conn_index] = NULL; -+ } - } - - process_output(hdcp_w); -- -- mutex_unlock(&hdcp_w->mutex); - } - - void hdcp_handle_cpirq(struct hdcp_workqueue *hdcp_work, unsigned int link_index) -@@ -277,7 +282,7 @@ static void event_callback(struct work_struct *work) - hdcp_work = container_of(to_delayed_work(work), struct hdcp_workqueue, - callback_dwork); - -- mutex_lock(&hdcp_work->mutex); -+ guard(mutex)(&hdcp_work->mutex); - - cancel_delayed_work(&hdcp_work->callback_dwork); - -@@ -285,8 +290,6 @@ static void event_callback(struct work_struct *work) - &hdcp_work->output); - - process_output(hdcp_work); -- -- mutex_unlock(&hdcp_work->mutex); - } - - static void event_property_update(struct work_struct *work) -@@ -323,7 +326,7 @@ static void event_property_update(struct work_struct *work) - continue; - - drm_modeset_lock(&dev->mode_config.connection_mutex, NULL); -- mutex_lock(&hdcp_work->mutex); -+ guard(mutex)(&hdcp_work->mutex); - - if (conn_state->commit) { - ret = wait_for_completion_interruptible_timeout(&conn_state->commit->hw_done, -@@ -355,7 +358,6 @@ static void event_property_update(struct work_struct *work) - drm_hdcp_update_content_protection(connector, - DRM_MODE_CONTENT_PROTECTION_DESIRED); - } -- mutex_unlock(&hdcp_work->mutex); - drm_modeset_unlock(&dev->mode_config.connection_mutex); - } - } -@@ -368,7 +370,7 @@ static void event_property_validate(struct work_struct *work) - struct amdgpu_dm_connector *aconnector; - unsigned int conn_index; - -- mutex_lock(&hdcp_work->mutex); -+ guard(mutex)(&hdcp_work->mutex); - - for (conn_index = 0; conn_index < AMDGPU_DM_MAX_DISPLAY_INDEX; - conn_index++) { -@@ -408,8 +410,6 @@ static void event_property_validate(struct work_struct *work) - schedule_work(&hdcp_work->property_update_work); - } - } -- -- mutex_unlock(&hdcp_work->mutex); - } - - static void event_watchdog_timer(struct work_struct *work) -@@ -420,7 +420,7 @@ static void event_watchdog_timer(struct work_struct *work) - struct hdcp_workqueue, - watchdog_timer_dwork); - -- mutex_lock(&hdcp_work->mutex); -+ guard(mutex)(&hdcp_work->mutex); - - cancel_delayed_work(&hdcp_work->watchdog_timer_dwork); - -@@ -429,8 +429,6 @@ static void event_watchdog_timer(struct work_struct *work) - &hdcp_work->output); - - process_output(hdcp_work); -- -- mutex_unlock(&hdcp_work->mutex); - } - - static void event_cpirq(struct work_struct *work) -@@ -439,13 +437,11 @@ static void event_cpirq(struct work_struct *work) - - hdcp_work = container_of(work, struct hdcp_workqueue, cpirq_work); - -- mutex_lock(&hdcp_work->mutex); -+ guard(mutex)(&hdcp_work->mutex); - - mod_hdcp_process_event(&hdcp_work->hdcp, MOD_HDCP_EVENT_CPIRQ, &hdcp_work->output); - - process_output(hdcp_work); -- -- mutex_unlock(&hdcp_work->mutex); - } - - void hdcp_destroy(struct kobject *kobj, struct hdcp_workqueue *hdcp_work) -@@ -479,7 +475,7 @@ static bool enable_assr(void *handle, struct dc_link *link) - - dtm_cmd = (struct ta_dtm_shared_memory *)psp->dtm_context.context.mem_context.shared_buf; - -- mutex_lock(&psp->dtm_context.mutex); -+ guard(mutex)(&psp->dtm_context.mutex); - memset(dtm_cmd, 0, sizeof(struct ta_dtm_shared_memory)); - - dtm_cmd->cmd_id = TA_DTM_COMMAND__TOPOLOGY_ASSR_ENABLE; -@@ -494,8 +490,6 @@ static bool enable_assr(void *handle, struct dc_link *link) - res = false; - } - -- mutex_unlock(&psp->dtm_context.mutex); -- - return res; - } - -@@ -504,6 +498,7 @@ static void update_config(void *handle, struct cp_psp_stream_config *config) - struct hdcp_workqueue *hdcp_work = handle; - struct amdgpu_dm_connector *aconnector = config->dm_stream_ctx; - int link_index = aconnector->dc_link->link_index; -+ unsigned int conn_index = aconnector->base.index; - struct mod_hdcp_display *display = &hdcp_work[link_index].display; - struct mod_hdcp_link *link = &hdcp_work[link_index].link; - struct hdcp_workqueue *hdcp_w = &hdcp_work[link_index]; -@@ -557,13 +552,14 @@ static void update_config(void *handle, struct cp_psp_stream_config *config) - (!!aconnector->base.state) ? - aconnector->base.state->hdcp_content_type : -1); - -- mutex_lock(&hdcp_w->mutex); -+ guard(mutex)(&hdcp_w->mutex); - - mod_hdcp_add_display(&hdcp_w->hdcp, link, display, &hdcp_w->output); -- -+ drm_connector_get(&aconnector->base); -+ if (hdcp_w->aconnector[conn_index]) -+ drm_connector_put(&hdcp_w->aconnector[conn_index]->base); -+ hdcp_w->aconnector[conn_index] = aconnector; - process_output(hdcp_w); -- mutex_unlock(&hdcp_w->mutex); -- - } - - /** -diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c -index 1d22dba69b2753..b943221b238f87 100644 ---- a/drivers/gpu/drm/drm_file.c -+++ b/drivers/gpu/drm/drm_file.c -@@ -1015,6 +1015,10 @@ void drm_show_fdinfo(struct seq_file *m, struct file *f) - struct drm_file *file = f->private_data; - struct drm_device *dev = file->minor->dev; - struct drm_printer p = drm_seq_file_printer(m); -+ int idx; -+ -+ if (!drm_dev_enter(dev, &idx)) -+ return; - - drm_printf(&p, "drm-driver:\t%s\n", dev->driver->name); - drm_printf(&p, "drm-client-id:\t%llu\n", file->client_id); -@@ -1029,6 +1033,8 @@ void drm_show_fdinfo(struct seq_file *m, struct file *f) - - if (dev->driver->show_fdinfo) - dev->driver->show_fdinfo(&p, file); -+ -+ drm_dev_exit(idx); - } - EXPORT_SYMBOL(drm_show_fdinfo); - -diff --git a/drivers/gpu/drm/i915/pxp/intel_pxp_gsccs.h b/drivers/gpu/drm/i915/pxp/intel_pxp_gsccs.h -index 298ad38e6c7df6..c36d956b9b824f 100644 ---- a/drivers/gpu/drm/i915/pxp/intel_pxp_gsccs.h -+++ b/drivers/gpu/drm/i915/pxp/intel_pxp_gsccs.h -@@ -25,6 +25,7 @@ int intel_pxp_gsccs_init(struct intel_pxp *pxp); - - int intel_pxp_gsccs_create_session(struct intel_pxp *pxp, int arb_session_id); - void intel_pxp_gsccs_end_arb_fw_session(struct intel_pxp *pxp, u32 arb_session_id); -+bool intel_pxp_gsccs_is_ready_for_sessions(struct intel_pxp *pxp); - - #else - static inline void intel_pxp_gsccs_fini(struct intel_pxp *pxp) -@@ -36,8 +37,11 @@ static inline int intel_pxp_gsccs_init(struct intel_pxp *pxp) - return 0; - } - --#endif -+static inline bool intel_pxp_gsccs_is_ready_for_sessions(struct intel_pxp *pxp) -+{ -+ return false; -+} - --bool intel_pxp_gsccs_is_ready_for_sessions(struct intel_pxp *pxp); -+#endif - - #endif /*__INTEL_PXP_GSCCS_H__ */ -diff --git a/drivers/gpu/drm/meson/meson_vclk.c b/drivers/gpu/drm/meson/meson_vclk.c -index 2a942dc6a6dc23..2a82119eb58ed8 100644 ---- a/drivers/gpu/drm/meson/meson_vclk.c -+++ b/drivers/gpu/drm/meson/meson_vclk.c -@@ -790,13 +790,13 @@ meson_vclk_vic_supported_freq(struct meson_drm *priv, unsigned int phy_freq, - FREQ_1000_1001(params[i].pixel_freq)); - DRM_DEBUG_DRIVER("i = %d phy_freq = %d alt = %d\n", - i, params[i].phy_freq, -- FREQ_1000_1001(params[i].phy_freq/1000)*1000); -+ FREQ_1000_1001(params[i].phy_freq/10)*10); - /* Match strict frequency */ - if (phy_freq == params[i].phy_freq && - vclk_freq == params[i].vclk_freq) - return MODE_OK; - /* Match 1000/1001 variant */ -- if (phy_freq == (FREQ_1000_1001(params[i].phy_freq/1000)*1000) && -+ if (phy_freq == (FREQ_1000_1001(params[i].phy_freq/10)*10) && - vclk_freq == FREQ_1000_1001(params[i].vclk_freq)) - return MODE_OK; - } -@@ -1070,7 +1070,7 @@ void meson_vclk_setup(struct meson_drm *priv, unsigned int target, - - for (freq = 0 ; params[freq].pixel_freq ; ++freq) { - if ((phy_freq == params[freq].phy_freq || -- phy_freq == FREQ_1000_1001(params[freq].phy_freq/1000)*1000) && -+ phy_freq == FREQ_1000_1001(params[freq].phy_freq/10)*10) && - (vclk_freq == params[freq].vclk_freq || - vclk_freq == FREQ_1000_1001(params[freq].vclk_freq))) { - if (vclk_freq != params[freq].vclk_freq) -diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c -index 03eacb22648ef7..1bfa312d6fb857 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_fence.c -+++ b/drivers/gpu/drm/nouveau/nouveau_fence.c -@@ -90,7 +90,7 @@ nouveau_fence_context_kill(struct nouveau_fence_chan *fctx, int error) - while (!list_empty(&fctx->pending)) { - fence = list_entry(fctx->pending.next, typeof(*fence), head); - -- if (error) -+ if (error && !dma_fence_is_signaled_locked(&fence->base)) - dma_fence_set_error(&fence->base, error); - - if (nouveau_fence_signal(fence)) -diff --git a/drivers/i2c/busses/i2c-imx-lpi2c.c b/drivers/i2c/busses/i2c-imx-lpi2c.c -index 5d4f04a3c6d322..b44b36bd565ea4 100644 ---- a/drivers/i2c/busses/i2c-imx-lpi2c.c -+++ b/drivers/i2c/busses/i2c-imx-lpi2c.c -@@ -616,9 +616,9 @@ static int lpi2c_imx_probe(struct platform_device *pdev) - return 0; - - rpm_disable: -- pm_runtime_put(&pdev->dev); -- pm_runtime_disable(&pdev->dev); - pm_runtime_dont_use_autosuspend(&pdev->dev); -+ pm_runtime_put_sync(&pdev->dev); -+ pm_runtime_disable(&pdev->dev); - - return ret; - } -diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c -index ef3fae113dd643..2e7a12f306510c 100644 ---- a/drivers/iommu/amd/init.c -+++ b/drivers/iommu/amd/init.c -@@ -3682,6 +3682,14 @@ static int __init parse_ivrs_acpihid(char *str) - while (*uid == '0' && *(uid + 1)) - uid++; - -+ if (strlen(hid) >= ACPIHID_HID_LEN) { -+ pr_err("Invalid command line: hid is too long\n"); -+ return 1; -+ } else if (strlen(uid) >= ACPIHID_UID_LEN) { -+ pr_err("Invalid command line: uid is too long\n"); -+ return 1; -+ } -+ - i = early_acpihid_map_size++; - memcpy(early_acpihid_map[i].hid, hid, strlen(hid)); - memcpy(early_acpihid_map[i].uid, uid, strlen(uid)); -diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c -index 6cecbac0e6babf..f2260f45728e79 100644 ---- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c -+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c -@@ -1443,26 +1443,37 @@ static int arm_smmu_init_l2_strtab(struct arm_smmu_device *smmu, u32 sid) - return 0; - } - -+static int arm_smmu_streams_cmp_key(const void *lhs, const struct rb_node *rhs) -+{ -+ struct arm_smmu_stream *stream_rhs = -+ rb_entry(rhs, struct arm_smmu_stream, node); -+ const u32 *sid_lhs = lhs; -+ -+ if (*sid_lhs < stream_rhs->id) -+ return -1; -+ if (*sid_lhs > stream_rhs->id) -+ return 1; -+ return 0; -+} -+ -+static int arm_smmu_streams_cmp_node(struct rb_node *lhs, -+ const struct rb_node *rhs) -+{ -+ return arm_smmu_streams_cmp_key( -+ &rb_entry(lhs, struct arm_smmu_stream, node)->id, rhs); -+} -+ - static struct arm_smmu_master * - arm_smmu_find_master(struct arm_smmu_device *smmu, u32 sid) - { - struct rb_node *node; -- struct arm_smmu_stream *stream; - - lockdep_assert_held(&smmu->streams_mutex); - -- node = smmu->streams.rb_node; -- while (node) { -- stream = rb_entry(node, struct arm_smmu_stream, node); -- if (stream->id < sid) -- node = node->rb_right; -- else if (stream->id > sid) -- node = node->rb_left; -- else -- return stream->master; -- } -- -- return NULL; -+ node = rb_find(&sid, &smmu->streams, arm_smmu_streams_cmp_key); -+ if (!node) -+ return NULL; -+ return rb_entry(node, struct arm_smmu_stream, node)->master; - } - - /* IRQ and event handlers */ -@@ -2575,8 +2586,6 @@ static int arm_smmu_insert_master(struct arm_smmu_device *smmu, - { - int i; - int ret = 0; -- struct arm_smmu_stream *new_stream, *cur_stream; -- struct rb_node **new_node, *parent_node = NULL; - struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(master->dev); - - master->streams = kcalloc(fwspec->num_ids, sizeof(*master->streams), -@@ -2587,9 +2596,10 @@ static int arm_smmu_insert_master(struct arm_smmu_device *smmu, - - mutex_lock(&smmu->streams_mutex); - for (i = 0; i < fwspec->num_ids; i++) { -+ struct arm_smmu_stream *new_stream = &master->streams[i]; -+ struct rb_node *existing; - u32 sid = fwspec->ids[i]; - -- new_stream = &master->streams[i]; - new_stream->id = sid; - new_stream->master = master; - -@@ -2598,28 +2608,23 @@ static int arm_smmu_insert_master(struct arm_smmu_device *smmu, - break; - - /* Insert into SID tree */ -- new_node = &(smmu->streams.rb_node); -- while (*new_node) { -- cur_stream = rb_entry(*new_node, struct arm_smmu_stream, -- node); -- parent_node = *new_node; -- if (cur_stream->id > new_stream->id) { -- new_node = &((*new_node)->rb_left); -- } else if (cur_stream->id < new_stream->id) { -- new_node = &((*new_node)->rb_right); -- } else { -- dev_warn(master->dev, -- "stream %u already in tree\n", -- cur_stream->id); -- ret = -EINVAL; -- break; -- } -- } -- if (ret) -- break; -+ existing = rb_find_add(&new_stream->node, &smmu->streams, -+ arm_smmu_streams_cmp_node); -+ if (existing) { -+ struct arm_smmu_master *existing_master = -+ rb_entry(existing, struct arm_smmu_stream, node) -+ ->master; -+ -+ /* Bridged PCI devices may end up with duplicated IDs */ -+ if (existing_master == master) -+ continue; - -- rb_link_node(&new_stream->node, parent_node, new_node); -- rb_insert_color(&new_stream->node, &smmu->streams); -+ dev_warn(master->dev, -+ "stream %u already in tree from dev %s\n", sid, -+ dev_name(existing_master->dev)); -+ ret = -EINVAL; -+ break; -+ } - } - - if (ret) { -diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c -index d6381c00bb8ddc..6a745616d85a4b 100644 ---- a/drivers/iommu/intel/iommu.c -+++ b/drivers/iommu/intel/iommu.c -@@ -4855,6 +4855,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e30, quirk_iommu_igfx); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e40, quirk_iommu_igfx); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e90, quirk_iommu_igfx); - -+/* QM57/QS57 integrated gfx malfunctions with dmar */ -+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0044, quirk_iommu_igfx); -+ - /* Broadwell igfx malfunctions with dmar */ - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1606, quirk_iommu_igfx); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x160B, quirk_iommu_igfx); -@@ -4932,7 +4935,6 @@ static void quirk_calpella_no_shadow_gtt(struct pci_dev *dev) - } - } - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0040, quirk_calpella_no_shadow_gtt); --DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0044, quirk_calpella_no_shadow_gtt); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0062, quirk_calpella_no_shadow_gtt); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x006a, quirk_calpella_no_shadow_gtt); - -diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c -index 3f1029c0825e95..f2b3a4e2e54fc8 100644 ---- a/drivers/iommu/iommu.c -+++ b/drivers/iommu/iommu.c -@@ -566,6 +566,18 @@ int iommu_probe_device(struct device *dev) - mutex_lock(&iommu_probe_device_lock); - ret = __iommu_probe_device(dev, NULL); - mutex_unlock(&iommu_probe_device_lock); -+ -+ /* -+ * The dma_configure replay paths need bus_iommu_probe() to -+ * finish before they can call arch_setup_dma_ops() -+ */ -+ if (IS_ENABLED(CONFIG_IOMMU_DMA) && !ret && dev->iommu_group) { -+ mutex_lock(&dev->iommu_group->mutex); -+ if (!dev->iommu_group->default_domain && -+ !dev_iommu_ops(dev)->set_platform_dma_ops) -+ ret = -EPROBE_DEFER; -+ mutex_unlock(&dev->iommu_group->mutex); -+ } - if (ret) - return ret; - -@@ -3149,6 +3161,12 @@ int iommu_device_use_default_domain(struct device *dev) - return 0; - - mutex_lock(&group->mutex); -+ /* We may race against bus_iommu_probe() finalising groups here */ -+ if (IS_ENABLED(CONFIG_IOMMU_DMA) && !group->default_domain && -+ !dev_iommu_ops(dev)->set_platform_dma_ops) { -+ ret = -EPROBE_DEFER; -+ goto unlock_out; -+ } - if (group->owner_cnt) { - if (group->owner || !iommu_is_default_domain(group) || - !xa_empty(&group->pasid_array)) { -diff --git a/drivers/irqchip/irq-qcom-mpm.c b/drivers/irqchip/irq-qcom-mpm.c -index 7124565234a586..0807e4aca933fb 100644 ---- a/drivers/irqchip/irq-qcom-mpm.c -+++ b/drivers/irqchip/irq-qcom-mpm.c -@@ -226,6 +226,9 @@ static int qcom_mpm_alloc(struct irq_domain *domain, unsigned int virq, - if (ret) - return ret; - -+ if (pin == GPIO_NO_WAKE_IRQ) -+ return irq_domain_disconnect_hierarchy(domain, virq); -+ - ret = irq_domain_set_hwirq_and_chip(domain, virq, pin, - &qcom_mpm_chip, priv); - if (ret) -diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c -index 30ddfb21f65818..2d3afeaf886877 100644 ---- a/drivers/md/dm-bufio.c -+++ b/drivers/md/dm-bufio.c -@@ -68,6 +68,8 @@ - #define LIST_DIRTY 1 - #define LIST_SIZE 2 - -+#define SCAN_RESCHED_CYCLE 16 -+ - /*--------------------------------------------------------------*/ - - /* -@@ -2387,7 +2389,12 @@ static void __scan(struct dm_bufio_client *c) - - atomic_long_dec(&c->need_shrink); - freed++; -- cond_resched(); -+ -+ if (unlikely(freed % SCAN_RESCHED_CYCLE == 0)) { -+ dm_bufio_unlock(c); -+ cond_resched(); -+ dm_bufio_lock(c); -+ } - } - } - } -diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c -index eb2b44f4a61f08..1e27a5bce2d942 100644 ---- a/drivers/md/dm-integrity.c -+++ b/drivers/md/dm-integrity.c -@@ -4687,7 +4687,7 @@ static void dm_integrity_dtr(struct dm_target *ti) - BUG_ON(!RB_EMPTY_ROOT(&ic->in_progress)); - BUG_ON(!list_empty(&ic->wait_list)); - -- if (ic->mode == 'B') -+ if (ic->mode == 'B' && ic->bitmap_flush_work.work.func) - cancel_delayed_work_sync(&ic->bitmap_flush_work); - if (ic->metadata_wq) - destroy_workqueue(ic->metadata_wq); -diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c -index fd84e06670e8d7..319bd10548e9ad 100644 ---- a/drivers/md/dm-table.c -+++ b/drivers/md/dm-table.c -@@ -500,8 +500,9 @@ static char **realloc_argv(unsigned int *size, char **old_argv) - gfp = GFP_NOIO; - } - argv = kmalloc_array(new_size, sizeof(*argv), gfp); -- if (argv && old_argv) { -- memcpy(argv, old_argv, *size * sizeof(*argv)); -+ if (argv) { -+ if (old_argv) -+ memcpy(argv, old_argv, *size * sizeof(*argv)); - *size = new_size; - } - -diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c -index c675dec587efb2..597b00e8c9539d 100644 ---- a/drivers/mmc/host/renesas_sdhi_core.c -+++ b/drivers/mmc/host/renesas_sdhi_core.c -@@ -1107,26 +1107,26 @@ int renesas_sdhi_probe(struct platform_device *pdev, - num_irqs = platform_irq_count(pdev); - if (num_irqs < 0) { - ret = num_irqs; -- goto eirq; -+ goto edisclk; - } - - /* There must be at least one IRQ source */ - if (!num_irqs) { - ret = -ENXIO; -- goto eirq; -+ goto edisclk; - } - - for (i = 0; i < num_irqs; i++) { - irq = platform_get_irq(pdev, i); - if (irq < 0) { - ret = irq; -- goto eirq; -+ goto edisclk; - } - - ret = devm_request_irq(&pdev->dev, irq, tmio_mmc_irq, 0, - dev_name(&pdev->dev), host); - if (ret) -- goto eirq; -+ goto edisclk; - } - - ret = tmio_mmc_host_probe(host); -@@ -1138,8 +1138,6 @@ int renesas_sdhi_probe(struct platform_device *pdev, - - return ret; - --eirq: -- tmio_mmc_host_remove(host); - edisclk: - renesas_sdhi_clk_disable(host); - efree: -diff --git a/drivers/net/dsa/ocelot/felix_vsc9959.c b/drivers/net/dsa/ocelot/felix_vsc9959.c -index 8d27933c3733b1..f91f25578f075b 100644 ---- a/drivers/net/dsa/ocelot/felix_vsc9959.c -+++ b/drivers/net/dsa/ocelot/felix_vsc9959.c -@@ -1543,7 +1543,7 @@ static void vsc9959_tas_clock_adjust(struct ocelot *ocelot) - struct tc_taprio_qopt_offload *taprio; - struct ocelot_port *ocelot_port; - struct timespec64 base_ts; -- int port; -+ int i, port; - u32 val; - - mutex_lock(&ocelot->fwd_domain_lock); -@@ -1575,6 +1575,9 @@ static void vsc9959_tas_clock_adjust(struct ocelot *ocelot) - QSYS_PARAM_CFG_REG_3_BASE_TIME_SEC_MSB_M, - QSYS_PARAM_CFG_REG_3); - -+ for (i = 0; i < taprio->num_entries; i++) -+ vsc9959_tas_gcl_set(ocelot, i, &taprio->entries[i]); -+ - ocelot_rmw(ocelot, QSYS_TAS_PARAM_CFG_CTRL_CONFIG_CHANGE, - QSYS_TAS_PARAM_CFG_CTRL_CONFIG_CHANGE, - QSYS_TAS_PARAM_CFG_CTRL); -diff --git a/drivers/net/ethernet/amd/pds_core/auxbus.c b/drivers/net/ethernet/amd/pds_core/auxbus.c -index fb7a5403e630db..889a18962270aa 100644 ---- a/drivers/net/ethernet/amd/pds_core/auxbus.c -+++ b/drivers/net/ethernet/amd/pds_core/auxbus.c -@@ -172,48 +172,57 @@ static struct pds_auxiliary_dev *pdsc_auxbus_dev_register(struct pdsc *cf, - return padev; - } - --int pdsc_auxbus_dev_del(struct pdsc *cf, struct pdsc *pf) -+void pdsc_auxbus_dev_del(struct pdsc *cf, struct pdsc *pf, -+ struct pds_auxiliary_dev **pd_ptr) - { - struct pds_auxiliary_dev *padev; -- int err = 0; -+ -+ if (!*pd_ptr) -+ return; - - mutex_lock(&pf->config_lock); - -- padev = pf->vfs[cf->vf_id].padev; -- if (padev) { -- pds_client_unregister(pf, padev->client_id); -- auxiliary_device_delete(&padev->aux_dev); -- auxiliary_device_uninit(&padev->aux_dev); -- padev->client_id = 0; -- } -- pf->vfs[cf->vf_id].padev = NULL; -+ padev = *pd_ptr; -+ pds_client_unregister(pf, padev->client_id); -+ auxiliary_device_delete(&padev->aux_dev); -+ auxiliary_device_uninit(&padev->aux_dev); -+ *pd_ptr = NULL; - - mutex_unlock(&pf->config_lock); -- return err; - } - --int pdsc_auxbus_dev_add(struct pdsc *cf, struct pdsc *pf) -+int pdsc_auxbus_dev_add(struct pdsc *cf, struct pdsc *pf, -+ enum pds_core_vif_types vt, -+ struct pds_auxiliary_dev **pd_ptr) - { - struct pds_auxiliary_dev *padev; -- enum pds_core_vif_types vt; - char devname[PDS_DEVNAME_LEN]; -+ unsigned long mask; - u16 vt_support; - int client_id; - int err = 0; - -+ if (!cf) -+ return -ENODEV; -+ -+ if (vt >= PDS_DEV_TYPE_MAX) -+ return -EINVAL; -+ - mutex_lock(&pf->config_lock); - -- /* We only support vDPA so far, so it is the only one to -- * be verified that it is available in the Core device and -- * enabled in the devlink param. In the future this might -- * become a loop for several VIF types. -- */ -+ mask = BIT_ULL(PDSC_S_FW_DEAD) | -+ BIT_ULL(PDSC_S_STOPPING_DRIVER); -+ if (cf->state & mask) { -+ dev_err(pf->dev, "%s: can't add dev, VF client in bad state %#lx\n", -+ __func__, cf->state); -+ err = -ENXIO; -+ goto out_unlock; -+ } - - /* Verify that the type is supported and enabled. It is not - * an error if there is no auxbus device support for this - * VF, it just means something else needs to happen with it. - */ -- vt = PDS_DEV_TYPE_VDPA; - vt_support = !!le16_to_cpu(pf->dev_ident.vif_types[vt]); - if (!(vt_support && - pf->viftype_status[vt].supported && -@@ -239,7 +248,7 @@ int pdsc_auxbus_dev_add(struct pdsc *cf, struct pdsc *pf) - err = PTR_ERR(padev); - goto out_unlock; - } -- pf->vfs[cf->vf_id].padev = padev; -+ *pd_ptr = padev; - - out_unlock: - mutex_unlock(&pf->config_lock); -diff --git a/drivers/net/ethernet/amd/pds_core/core.h b/drivers/net/ethernet/amd/pds_core/core.h -index 858bebf7977624..61ee607ee48ace 100644 ---- a/drivers/net/ethernet/amd/pds_core/core.h -+++ b/drivers/net/ethernet/amd/pds_core/core.h -@@ -300,8 +300,11 @@ void pdsc_health_thread(struct work_struct *work); - int pdsc_register_notify(struct notifier_block *nb); - void pdsc_unregister_notify(struct notifier_block *nb); - void pdsc_notify(unsigned long event, void *data); --int pdsc_auxbus_dev_add(struct pdsc *cf, struct pdsc *pf); --int pdsc_auxbus_dev_del(struct pdsc *cf, struct pdsc *pf); -+int pdsc_auxbus_dev_add(struct pdsc *cf, struct pdsc *pf, -+ enum pds_core_vif_types vt, -+ struct pds_auxiliary_dev **pd_ptr); -+void pdsc_auxbus_dev_del(struct pdsc *cf, struct pdsc *pf, -+ struct pds_auxiliary_dev **pd_ptr); - - void pdsc_process_adminq(struct pdsc_qcq *qcq); - void pdsc_work_thread(struct work_struct *work); -diff --git a/drivers/net/ethernet/amd/pds_core/dev.c b/drivers/net/ethernet/amd/pds_core/dev.c -index f0e39ab4004503..e65a1632df505d 100644 ---- a/drivers/net/ethernet/amd/pds_core/dev.c -+++ b/drivers/net/ethernet/amd/pds_core/dev.c -@@ -42,6 +42,8 @@ int pdsc_err_to_errno(enum pds_core_status_code code) - return -ERANGE; - case PDS_RC_BAD_ADDR: - return -EFAULT; -+ case PDS_RC_BAD_PCI: -+ return -ENXIO; - case PDS_RC_EOPCODE: - case PDS_RC_EINTR: - case PDS_RC_DEV_CMD: -@@ -65,7 +67,7 @@ bool pdsc_is_fw_running(struct pdsc *pdsc) - /* Firmware is useful only if the running bit is set and - * fw_status != 0xff (bad PCI read) - */ -- return (pdsc->fw_status != 0xff) && -+ return (pdsc->fw_status != PDS_RC_BAD_PCI) && - (pdsc->fw_status & PDS_CORE_FW_STS_F_RUNNING); - } - -@@ -131,6 +133,7 @@ static int pdsc_devcmd_wait(struct pdsc *pdsc, u8 opcode, int max_seconds) - unsigned long max_wait; - unsigned long duration; - int timeout = 0; -+ bool running; - int done = 0; - int err = 0; - int status; -@@ -139,6 +142,10 @@ static int pdsc_devcmd_wait(struct pdsc *pdsc, u8 opcode, int max_seconds) - max_wait = start_time + (max_seconds * HZ); - - while (!done && !timeout) { -+ running = pdsc_is_fw_running(pdsc); -+ if (!running) -+ break; -+ - done = pdsc_devcmd_done(pdsc); - if (done) - break; -@@ -155,7 +162,7 @@ static int pdsc_devcmd_wait(struct pdsc *pdsc, u8 opcode, int max_seconds) - dev_dbg(dev, "DEVCMD %d %s after %ld secs\n", - opcode, pdsc_devcmd_str(opcode), duration / HZ); - -- if (!done || timeout) { -+ if ((!done || timeout) && running) { - dev_err(dev, "DEVCMD %d %s timeout, done %d timeout %d max_seconds=%d\n", - opcode, pdsc_devcmd_str(opcode), done, timeout, - max_seconds); -diff --git a/drivers/net/ethernet/amd/pds_core/devlink.c b/drivers/net/ethernet/amd/pds_core/devlink.c -index 0032e8e3518117..bee70e46e34c68 100644 ---- a/drivers/net/ethernet/amd/pds_core/devlink.c -+++ b/drivers/net/ethernet/amd/pds_core/devlink.c -@@ -55,8 +55,11 @@ int pdsc_dl_enable_set(struct devlink *dl, u32 id, - for (vf_id = 0; vf_id < pdsc->num_vfs; vf_id++) { - struct pdsc *vf = pdsc->vfs[vf_id].vf; - -- err = ctx->val.vbool ? pdsc_auxbus_dev_add(vf, pdsc) : -- pdsc_auxbus_dev_del(vf, pdsc); -+ if (ctx->val.vbool) -+ err = pdsc_auxbus_dev_add(vf, pdsc, vt_entry->vif_id, -+ &pdsc->vfs[vf_id].padev); -+ else -+ pdsc_auxbus_dev_del(vf, pdsc, &pdsc->vfs[vf_id].padev); - } - - return err; -diff --git a/drivers/net/ethernet/amd/pds_core/main.c b/drivers/net/ethernet/amd/pds_core/main.c -index eddbf0acdde77f..76652e0e5b6d9c 100644 ---- a/drivers/net/ethernet/amd/pds_core/main.c -+++ b/drivers/net/ethernet/amd/pds_core/main.c -@@ -189,7 +189,8 @@ static int pdsc_init_vf(struct pdsc *vf) - devl_unlock(dl); - - pf->vfs[vf->vf_id].vf = vf; -- err = pdsc_auxbus_dev_add(vf, pf); -+ err = pdsc_auxbus_dev_add(vf, pf, PDS_DEV_TYPE_VDPA, -+ &pf->vfs[vf->vf_id].padev); - if (err) { - devl_lock(dl); - devl_unregister(dl); -@@ -415,7 +416,7 @@ static void pdsc_remove(struct pci_dev *pdev) - - pf = pdsc_get_pf_struct(pdsc->pdev); - if (!IS_ERR(pf)) { -- pdsc_auxbus_dev_del(pdsc, pf); -+ pdsc_auxbus_dev_del(pdsc, pf, &pf->vfs[pdsc->vf_id].padev); - pf->vfs[pdsc->vf_id].vf = NULL; - } - } else { -@@ -475,6 +476,15 @@ static void pdsc_reset_prepare(struct pci_dev *pdev) - pdsc_stop_health_thread(pdsc); - pdsc_fw_down(pdsc); - -+ if (pdev->is_virtfn) { -+ struct pdsc *pf; -+ -+ pf = pdsc_get_pf_struct(pdsc->pdev); -+ if (!IS_ERR(pf)) -+ pdsc_auxbus_dev_del(pdsc, pf, -+ &pf->vfs[pdsc->vf_id].padev); -+ } -+ - pdsc_unmap_bars(pdsc); - pci_release_regions(pdev); - pci_disable_device(pdev); -@@ -510,6 +520,15 @@ static void pdsc_reset_done(struct pci_dev *pdev) - - pdsc_fw_up(pdsc); - pdsc_restart_health_thread(pdsc); -+ -+ if (pdev->is_virtfn) { -+ struct pdsc *pf; -+ -+ pf = pdsc_get_pf_struct(pdsc->pdev); -+ if (!IS_ERR(pf)) -+ pdsc_auxbus_dev_add(pdsc, pf, PDS_DEV_TYPE_VDPA, -+ &pf->vfs[pdsc->vf_id].padev); -+ } - } - - static const struct pci_error_handlers pdsc_err_handler = { -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c -index 230726d7b74f63..d41b58fad37bbf 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c -+++ b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c -@@ -373,8 +373,13 @@ static int xgbe_map_rx_buffer(struct xgbe_prv_data *pdata, - } - - /* Set up the header page info */ -- xgbe_set_buffer_data(&rdata->rx.hdr, &ring->rx_hdr_pa, -- XGBE_SKB_ALLOC_SIZE); -+ if (pdata->netdev->features & NETIF_F_RXCSUM) { -+ xgbe_set_buffer_data(&rdata->rx.hdr, &ring->rx_hdr_pa, -+ XGBE_SKB_ALLOC_SIZE); -+ } else { -+ xgbe_set_buffer_data(&rdata->rx.hdr, &ring->rx_hdr_pa, -+ pdata->rx_buf_size); -+ } - - /* Set up the buffer page info */ - xgbe_set_buffer_data(&rdata->rx.buf, &ring->rx_buf_pa, -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c -index f393228d41c7be..f1b0fb02b3cd14 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c -+++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c -@@ -320,6 +320,18 @@ static void xgbe_config_sph_mode(struct xgbe_prv_data *pdata) - XGMAC_IOWRITE_BITS(pdata, MAC_RCR, HDSMS, XGBE_SPH_HDSMS_SIZE); - } - -+static void xgbe_disable_sph_mode(struct xgbe_prv_data *pdata) -+{ -+ unsigned int i; -+ -+ for (i = 0; i < pdata->channel_count; i++) { -+ if (!pdata->channel[i]->rx_ring) -+ break; -+ -+ XGMAC_DMA_IOWRITE_BITS(pdata->channel[i], DMA_CH_CR, SPH, 0); -+ } -+} -+ - static int xgbe_write_rss_reg(struct xgbe_prv_data *pdata, unsigned int type, - unsigned int index, unsigned int val) - { -@@ -3545,8 +3557,12 @@ static int xgbe_init(struct xgbe_prv_data *pdata) - xgbe_config_tx_coalesce(pdata); - xgbe_config_rx_buffer_size(pdata); - xgbe_config_tso_mode(pdata); -- xgbe_config_sph_mode(pdata); -- xgbe_config_rss(pdata); -+ -+ if (pdata->netdev->features & NETIF_F_RXCSUM) { -+ xgbe_config_sph_mode(pdata); -+ xgbe_config_rss(pdata); -+ } -+ - desc_if->wrapper_tx_desc_init(pdata); - desc_if->wrapper_rx_desc_init(pdata); - xgbe_enable_dma_interrupts(pdata); -@@ -3702,5 +3718,9 @@ void xgbe_init_function_ptrs_dev(struct xgbe_hw_if *hw_if) - hw_if->disable_vxlan = xgbe_disable_vxlan; - hw_if->set_vxlan_id = xgbe_set_vxlan_id; - -+ /* For Split Header*/ -+ hw_if->enable_sph = xgbe_config_sph_mode; -+ hw_if->disable_sph = xgbe_disable_sph_mode; -+ - DBGPR("<--xgbe_init_function_ptrs\n"); - } -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c -index 6b73648b377936..34d45cebefb5d3 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c -+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c -@@ -2257,10 +2257,17 @@ static int xgbe_set_features(struct net_device *netdev, - if (ret) - return ret; - -- if ((features & NETIF_F_RXCSUM) && !rxcsum) -+ if ((features & NETIF_F_RXCSUM) && !rxcsum) { -+ hw_if->enable_sph(pdata); -+ hw_if->enable_vxlan(pdata); - hw_if->enable_rx_csum(pdata); -- else if (!(features & NETIF_F_RXCSUM) && rxcsum) -+ schedule_work(&pdata->restart_work); -+ } else if (!(features & NETIF_F_RXCSUM) && rxcsum) { -+ hw_if->disable_sph(pdata); -+ hw_if->disable_vxlan(pdata); - hw_if->disable_rx_csum(pdata); -+ schedule_work(&pdata->restart_work); -+ } - - if ((features & NETIF_F_HW_VLAN_CTAG_RX) && !rxvlan) - hw_if->enable_rx_vlan_stripping(pdata); -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h -index ad136ed493ed1f..173f4dad470f55 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe.h -+++ b/drivers/net/ethernet/amd/xgbe/xgbe.h -@@ -865,6 +865,10 @@ struct xgbe_hw_if { - void (*enable_vxlan)(struct xgbe_prv_data *); - void (*disable_vxlan)(struct xgbe_prv_data *); - void (*set_vxlan_id)(struct xgbe_prv_data *); -+ -+ /* For Split Header */ -+ void (*enable_sph)(struct xgbe_prv_data *pdata); -+ void (*disable_sph)(struct xgbe_prv_data *pdata); - }; - - /* This structure represents implementation specific routines for an -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c -index c067898820360e..32813cdd5aa5cb 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c -@@ -66,20 +66,30 @@ static int bnxt_hwrm_dbg_dma_data(struct bnxt *bp, void *msg, - } - } - -+ if (cmn_req->req_type == -+ cpu_to_le16(HWRM_DBG_COREDUMP_RETRIEVE)) -+ info->dest_buf_size += len; -+ - if (info->dest_buf) { - if ((info->seg_start + off + len) <= - BNXT_COREDUMP_BUF_LEN(info->buf_len)) { -- memcpy(info->dest_buf + off, dma_buf, len); -+ u16 copylen = min_t(u16, len, -+ info->dest_buf_size - off); -+ -+ memcpy(info->dest_buf + off, dma_buf, copylen); -+ if (copylen < len) -+ break; - } else { - rc = -ENOBUFS; -+ if (cmn_req->req_type == -+ cpu_to_le16(HWRM_DBG_COREDUMP_LIST)) { -+ kfree(info->dest_buf); -+ info->dest_buf = NULL; -+ } - break; - } - } - -- if (cmn_req->req_type == -- cpu_to_le16(HWRM_DBG_COREDUMP_RETRIEVE)) -- info->dest_buf_size += len; -- - if (!(cmn_resp->flags & HWRM_DBG_CMN_FLAGS_MORE)) - break; - -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c -index 2e7ddbca9d53b1..dcedafa4d2e14f 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c -@@ -1393,6 +1393,17 @@ static int bnxt_get_regs_len(struct net_device *dev) - return reg_len; - } - -+#define BNXT_PCIE_32B_ENTRY(start, end) \ -+ { offsetof(struct pcie_ctx_hw_stats, start), \ -+ offsetof(struct pcie_ctx_hw_stats, end) } -+ -+static const struct { -+ u16 start; -+ u16 end; -+} bnxt_pcie_32b_entries[] = { -+ BNXT_PCIE_32B_ENTRY(pcie_ltssm_histogram[0], pcie_ltssm_histogram[3]), -+}; -+ - static void bnxt_get_regs(struct net_device *dev, struct ethtool_regs *regs, - void *_p) - { -@@ -1424,12 +1435,27 @@ static void bnxt_get_regs(struct net_device *dev, struct ethtool_regs *regs, - req->pcie_stat_host_addr = cpu_to_le64(hw_pcie_stats_addr); - rc = hwrm_req_send(bp, req); - if (!rc) { -- __le64 *src = (__le64 *)hw_pcie_stats; -- u64 *dst = (u64 *)(_p + BNXT_PXP_REG_LEN); -- int i; -- -- for (i = 0; i < sizeof(*hw_pcie_stats) / sizeof(__le64); i++) -- dst[i] = le64_to_cpu(src[i]); -+ u8 *dst = (u8 *)(_p + BNXT_PXP_REG_LEN); -+ u8 *src = (u8 *)hw_pcie_stats; -+ int i, j; -+ -+ for (i = 0, j = 0; i < sizeof(*hw_pcie_stats); ) { -+ if (i >= bnxt_pcie_32b_entries[j].start && -+ i <= bnxt_pcie_32b_entries[j].end) { -+ u32 *dst32 = (u32 *)(dst + i); -+ -+ *dst32 = le32_to_cpu(*(__le32 *)(src + i)); -+ i += 4; -+ if (i > bnxt_pcie_32b_entries[j].end && -+ j < ARRAY_SIZE(bnxt_pcie_32b_entries) - 1) -+ j++; -+ } else { -+ u64 *dst64 = (u64 *)(dst + i); -+ -+ *dst64 = le64_to_cpu(*(__le64 *)(src + i)); -+ i += 8; -+ } -+ } - } - hwrm_req_drop(bp, req); - } -diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c -index db6615aa921b19..ce46f3ac3b5a18 100644 ---- a/drivers/net/ethernet/dlink/dl2k.c -+++ b/drivers/net/ethernet/dlink/dl2k.c -@@ -352,7 +352,7 @@ parse_eeprom (struct net_device *dev) - eth_hw_addr_set(dev, psrom->mac_addr); - - if (np->chip_id == CHIP_IP1000A) { -- np->led_mode = psrom->led_mode; -+ np->led_mode = le16_to_cpu(psrom->led_mode); - return 0; - } - -diff --git a/drivers/net/ethernet/dlink/dl2k.h b/drivers/net/ethernet/dlink/dl2k.h -index 195dc6cfd8955c..0e33e2eaae9606 100644 ---- a/drivers/net/ethernet/dlink/dl2k.h -+++ b/drivers/net/ethernet/dlink/dl2k.h -@@ -335,7 +335,7 @@ typedef struct t_SROM { - u16 sub_system_id; /* 0x06 */ - u16 pci_base_1; /* 0x08 (IP1000A only) */ - u16 pci_base_2; /* 0x0a (IP1000A only) */ -- u16 led_mode; /* 0x0c (IP1000A only) */ -+ __le16 led_mode; /* 0x0c (IP1000A only) */ - u16 reserved1[9]; /* 0x0e-0x1f */ - u8 mac_addr[6]; /* 0x20-0x25 */ - u8 reserved2[10]; /* 0x26-0x2f */ -diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c -index 2d6b50903c923d..7261838a09db63 100644 ---- a/drivers/net/ethernet/freescale/fec_main.c -+++ b/drivers/net/ethernet/freescale/fec_main.c -@@ -695,7 +695,12 @@ static int fec_enet_txq_submit_skb(struct fec_enet_priv_tx_q *txq, - txq->bd.cur = bdp; - - /* Trigger transmission start */ -- writel(0, txq->bd.reg_desc_active); -+ if (!(fep->quirks & FEC_QUIRK_ERR007885) || -+ !readl(txq->bd.reg_desc_active) || -+ !readl(txq->bd.reg_desc_active) || -+ !readl(txq->bd.reg_desc_active) || -+ !readl(txq->bd.reg_desc_active)) -+ writel(0, txq->bd.reg_desc_active); - - return 0; - } -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c -index 4f385a18d288e4..36206273453f3a 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c -@@ -60,7 +60,7 @@ static struct hns3_dbg_cmd_info hns3_dbg_cmd[] = { - .name = "tm_qset", - .cmd = HNAE3_DBG_CMD_TM_QSET, - .dentry = HNS3_DBG_DENTRY_TM, -- .buf_len = HNS3_DBG_READ_LEN, -+ .buf_len = HNS3_DBG_READ_LEN_1MB, - .init = hns3_dbg_common_file_init, - }, - { -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c -index 801801e8803e9f..0ed01f4d680618 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c -@@ -473,20 +473,14 @@ static void hns3_mask_vector_irq(struct hns3_enet_tqp_vector *tqp_vector, - writel(mask_en, tqp_vector->mask_addr); - } - --static void hns3_vector_enable(struct hns3_enet_tqp_vector *tqp_vector) -+static void hns3_irq_enable(struct hns3_enet_tqp_vector *tqp_vector) - { - napi_enable(&tqp_vector->napi); - enable_irq(tqp_vector->vector_irq); -- -- /* enable vector */ -- hns3_mask_vector_irq(tqp_vector, 1); - } - --static void hns3_vector_disable(struct hns3_enet_tqp_vector *tqp_vector) -+static void hns3_irq_disable(struct hns3_enet_tqp_vector *tqp_vector) - { -- /* disable vector */ -- hns3_mask_vector_irq(tqp_vector, 0); -- - disable_irq(tqp_vector->vector_irq); - napi_disable(&tqp_vector->napi); - cancel_work_sync(&tqp_vector->rx_group.dim.work); -@@ -707,11 +701,42 @@ static int hns3_set_rx_cpu_rmap(struct net_device *netdev) - return 0; - } - -+static void hns3_enable_irqs_and_tqps(struct net_device *netdev) -+{ -+ struct hns3_nic_priv *priv = netdev_priv(netdev); -+ struct hnae3_handle *h = priv->ae_handle; -+ u16 i; -+ -+ for (i = 0; i < priv->vector_num; i++) -+ hns3_irq_enable(&priv->tqp_vector[i]); -+ -+ for (i = 0; i < priv->vector_num; i++) -+ hns3_mask_vector_irq(&priv->tqp_vector[i], 1); -+ -+ for (i = 0; i < h->kinfo.num_tqps; i++) -+ hns3_tqp_enable(h->kinfo.tqp[i]); -+} -+ -+static void hns3_disable_irqs_and_tqps(struct net_device *netdev) -+{ -+ struct hns3_nic_priv *priv = netdev_priv(netdev); -+ struct hnae3_handle *h = priv->ae_handle; -+ u16 i; -+ -+ for (i = 0; i < h->kinfo.num_tqps; i++) -+ hns3_tqp_disable(h->kinfo.tqp[i]); -+ -+ for (i = 0; i < priv->vector_num; i++) -+ hns3_mask_vector_irq(&priv->tqp_vector[i], 0); -+ -+ for (i = 0; i < priv->vector_num; i++) -+ hns3_irq_disable(&priv->tqp_vector[i]); -+} -+ - static int hns3_nic_net_up(struct net_device *netdev) - { - struct hns3_nic_priv *priv = netdev_priv(netdev); - struct hnae3_handle *h = priv->ae_handle; -- int i, j; - int ret; - - ret = hns3_nic_reset_all_ring(h); -@@ -720,23 +745,13 @@ static int hns3_nic_net_up(struct net_device *netdev) - - clear_bit(HNS3_NIC_STATE_DOWN, &priv->state); - -- /* enable the vectors */ -- for (i = 0; i < priv->vector_num; i++) -- hns3_vector_enable(&priv->tqp_vector[i]); -- -- /* enable rcb */ -- for (j = 0; j < h->kinfo.num_tqps; j++) -- hns3_tqp_enable(h->kinfo.tqp[j]); -+ hns3_enable_irqs_and_tqps(netdev); - - /* start the ae_dev */ - ret = h->ae_algo->ops->start ? h->ae_algo->ops->start(h) : 0; - if (ret) { - set_bit(HNS3_NIC_STATE_DOWN, &priv->state); -- while (j--) -- hns3_tqp_disable(h->kinfo.tqp[j]); -- -- for (j = i - 1; j >= 0; j--) -- hns3_vector_disable(&priv->tqp_vector[j]); -+ hns3_disable_irqs_and_tqps(netdev); - } - - return ret; -@@ -823,17 +838,9 @@ static void hns3_reset_tx_queue(struct hnae3_handle *h) - static void hns3_nic_net_down(struct net_device *netdev) - { - struct hns3_nic_priv *priv = netdev_priv(netdev); -- struct hnae3_handle *h = hns3_get_handle(netdev); - const struct hnae3_ae_ops *ops; -- int i; - -- /* disable vectors */ -- for (i = 0; i < priv->vector_num; i++) -- hns3_vector_disable(&priv->tqp_vector[i]); -- -- /* disable rcb */ -- for (i = 0; i < h->kinfo.num_tqps; i++) -- hns3_tqp_disable(h->kinfo.tqp[i]); -+ hns3_disable_irqs_and_tqps(netdev); - - /* stop ae_dev */ - ops = priv->ae_handle->ae_algo->ops; -@@ -5870,8 +5877,6 @@ int hns3_set_channels(struct net_device *netdev, - void hns3_external_lb_prepare(struct net_device *ndev, bool if_running) - { - struct hns3_nic_priv *priv = netdev_priv(ndev); -- struct hnae3_handle *h = priv->ae_handle; -- int i; - - if (!if_running) - return; -@@ -5882,11 +5887,7 @@ void hns3_external_lb_prepare(struct net_device *ndev, bool if_running) - netif_carrier_off(ndev); - netif_tx_disable(ndev); - -- for (i = 0; i < priv->vector_num; i++) -- hns3_vector_disable(&priv->tqp_vector[i]); -- -- for (i = 0; i < h->kinfo.num_tqps; i++) -- hns3_tqp_disable(h->kinfo.tqp[i]); -+ hns3_disable_irqs_and_tqps(ndev); - - /* delay ring buffer clearing to hns3_reset_notify_uninit_enet - * during reset process, because driver may not be able -@@ -5902,7 +5903,6 @@ void hns3_external_lb_restore(struct net_device *ndev, bool if_running) - { - struct hns3_nic_priv *priv = netdev_priv(ndev); - struct hnae3_handle *h = priv->ae_handle; -- int i; - - if (!if_running) - return; -@@ -5918,11 +5918,7 @@ void hns3_external_lb_restore(struct net_device *ndev, bool if_running) - - clear_bit(HNS3_NIC_STATE_DOWN, &priv->state); - -- for (i = 0; i < priv->vector_num; i++) -- hns3_vector_enable(&priv->tqp_vector[i]); -- -- for (i = 0; i < h->kinfo.num_tqps; i++) -- hns3_tqp_enable(h->kinfo.tqp[i]); -+ hns3_enable_irqs_and_tqps(ndev); - - netif_tx_wake_all_queues(ndev); - -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c -index ddc691424c8163..9a806ac727cf5b 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c -@@ -440,6 +440,13 @@ static int hclge_ptp_create_clock(struct hclge_dev *hdev) - ptp->info.settime64 = hclge_ptp_settime; - - ptp->info.n_alarm = 0; -+ -+ spin_lock_init(&ptp->lock); -+ ptp->io_base = hdev->hw.hw.io_base + HCLGE_PTP_REG_OFFSET; -+ ptp->ts_cfg.rx_filter = HWTSTAMP_FILTER_NONE; -+ ptp->ts_cfg.tx_type = HWTSTAMP_TX_OFF; -+ hdev->ptp = ptp; -+ - ptp->clock = ptp_clock_register(&ptp->info, &hdev->pdev->dev); - if (IS_ERR(ptp->clock)) { - dev_err(&hdev->pdev->dev, -@@ -451,12 +458,6 @@ static int hclge_ptp_create_clock(struct hclge_dev *hdev) - return -ENODEV; - } - -- spin_lock_init(&ptp->lock); -- ptp->io_base = hdev->hw.hw.io_base + HCLGE_PTP_REG_OFFSET; -- ptp->ts_cfg.rx_filter = HWTSTAMP_FILTER_NONE; -- ptp->ts_cfg.tx_type = HWTSTAMP_TX_OFF; -- hdev->ptp = ptp; -- - return 0; - } - -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c -index 69bfcfb148def4..1ba0b57c7a72d7 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c -@@ -1257,9 +1257,8 @@ static void hclgevf_sync_vlan_filter(struct hclgevf_dev *hdev) - rtnl_unlock(); - } - --static int hclgevf_en_hw_strip_rxvtag(struct hnae3_handle *handle, bool enable) -+static int hclgevf_en_hw_strip_rxvtag_cmd(struct hclgevf_dev *hdev, bool enable) - { -- struct hclgevf_dev *hdev = hclgevf_ae_get_hdev(handle); - struct hclge_vf_to_pf_msg send_msg; - - hclgevf_build_send_msg(&send_msg, HCLGE_MBX_SET_VLAN, -@@ -1268,6 +1267,19 @@ static int hclgevf_en_hw_strip_rxvtag(struct hnae3_handle *handle, bool enable) - return hclgevf_send_mbx_msg(hdev, &send_msg, false, NULL, 0); - } - -+static int hclgevf_en_hw_strip_rxvtag(struct hnae3_handle *handle, bool enable) -+{ -+ struct hclgevf_dev *hdev = hclgevf_ae_get_hdev(handle); -+ int ret; -+ -+ ret = hclgevf_en_hw_strip_rxvtag_cmd(hdev, enable); -+ if (ret) -+ return ret; -+ -+ hdev->rxvtag_strip_en = enable; -+ return 0; -+} -+ - static int hclgevf_reset_tqp(struct hnae3_handle *handle) - { - #define HCLGEVF_RESET_ALL_QUEUE_DONE 1U -@@ -2143,12 +2155,13 @@ static int hclgevf_rss_init_hw(struct hclgevf_dev *hdev) - tc_valid, tc_size); - } - --static int hclgevf_init_vlan_config(struct hclgevf_dev *hdev) -+static int hclgevf_init_vlan_config(struct hclgevf_dev *hdev, -+ bool rxvtag_strip_en) - { - struct hnae3_handle *nic = &hdev->nic; - int ret; - -- ret = hclgevf_en_hw_strip_rxvtag(nic, true); -+ ret = hclgevf_en_hw_strip_rxvtag(nic, rxvtag_strip_en); - if (ret) { - dev_err(&hdev->pdev->dev, - "failed to enable rx vlan offload, ret = %d\n", ret); -@@ -2815,7 +2828,7 @@ static int hclgevf_reset_hdev(struct hclgevf_dev *hdev) - if (ret) - return ret; - -- ret = hclgevf_init_vlan_config(hdev); -+ ret = hclgevf_init_vlan_config(hdev, hdev->rxvtag_strip_en); - if (ret) { - dev_err(&hdev->pdev->dev, - "failed(%d) to initialize VLAN config\n", ret); -@@ -2928,7 +2941,7 @@ static int hclgevf_init_hdev(struct hclgevf_dev *hdev) - goto err_config; - } - -- ret = hclgevf_init_vlan_config(hdev); -+ ret = hclgevf_init_vlan_config(hdev, true); - if (ret) { - dev_err(&hdev->pdev->dev, - "failed(%d) to initialize VLAN config\n", ret); -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h -index cccef32284616b..0208425ab594f5 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h -@@ -253,6 +253,7 @@ struct hclgevf_dev { - int *vector_irq; - - bool gro_en; -+ bool rxvtag_strip_en; - - unsigned long vlan_del_fail_bmap[BITS_TO_LONGS(VLAN_N_VID)]; - -diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c -index 3ca5f44dea26eb..88c1acd5e8f05d 100644 ---- a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c -+++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c -@@ -1824,6 +1824,11 @@ int ice_vc_add_fdir_fltr(struct ice_vf *vf, u8 *msg) - pf = vf->pf; - dev = ice_pf_to_dev(pf); - vf_vsi = ice_get_vf_vsi(vf); -+ if (!vf_vsi) { -+ dev_err(dev, "Can not get FDIR vf_vsi for VF %u\n", vf->vf_id); -+ v_ret = VIRTCHNL_STATUS_ERR_PARAM; -+ goto err_exit; -+ } - - #define ICE_VF_MAX_FDIR_FILTERS 128 - if (!ice_fdir_num_avail_fltr(&pf->hw, vf_vsi) || -diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c -index b6bb01a486d9d8..a82af96e6bd12f 100644 ---- a/drivers/net/ethernet/intel/igc/igc_ptp.c -+++ b/drivers/net/ethernet/intel/igc/igc_ptp.c -@@ -1237,6 +1237,8 @@ void igc_ptp_reset(struct igc_adapter *adapter) - /* reset the tstamp_config */ - igc_ptp_set_timestamp_mode(adapter, &adapter->tstamp_config); - -+ mutex_lock(&adapter->ptm_lock); -+ - spin_lock_irqsave(&adapter->tmreg_lock, flags); - - switch (adapter->hw.mac.type) { -@@ -1255,7 +1257,6 @@ void igc_ptp_reset(struct igc_adapter *adapter) - if (!igc_is_crosststamp_supported(adapter)) - break; - -- mutex_lock(&adapter->ptm_lock); - wr32(IGC_PCIE_DIG_DELAY, IGC_PCIE_DIG_DELAY_DEFAULT); - wr32(IGC_PCIE_PHY_DELAY, IGC_PCIE_PHY_DELAY_DEFAULT); - -@@ -1279,7 +1280,6 @@ void igc_ptp_reset(struct igc_adapter *adapter) - netdev_err(adapter->netdev, "Timeout reading IGC_PTM_STAT register\n"); - - igc_ptm_reset(hw); -- mutex_unlock(&adapter->ptm_lock); - break; - default: - /* No work to do. */ -@@ -1296,5 +1296,7 @@ void igc_ptp_reset(struct igc_adapter *adapter) - out: - spin_unlock_irqrestore(&adapter->tmreg_lock, flags); - -+ mutex_unlock(&adapter->ptm_lock); -+ - wrfl(); - } -diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c -index 6f1fe7e283d4eb..7a30095b3486f3 100644 ---- a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c -+++ b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c -@@ -917,7 +917,7 @@ static void octep_hb_timeout_task(struct work_struct *work) - miss_cnt); - rtnl_lock(); - if (netif_running(oct->netdev)) -- octep_stop(oct->netdev); -+ dev_close(oct->netdev); - rtnl_unlock(); - } - -diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c -index dc89dbc13b251f..d2ec8f642c2fa0 100644 ---- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c -+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c -@@ -2180,14 +2180,18 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget, - ring->data[idx] = new_data; - rxd->rxd1 = (unsigned int)dma_addr; - release_desc: -+ if (MTK_HAS_CAPS(eth->soc->caps, MTK_36BIT_DMA)) { -+ if (unlikely(dma_addr == DMA_MAPPING_ERROR)) -+ addr64 = FIELD_GET(RX_DMA_ADDR64_MASK, -+ rxd->rxd2); -+ else -+ addr64 = RX_DMA_PREP_ADDR64(dma_addr); -+ } -+ - if (MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628)) - rxd->rxd2 = RX_DMA_LSO; - else -- rxd->rxd2 = RX_DMA_PREP_PLEN0(ring->buf_size); -- -- if (MTK_HAS_CAPS(eth->soc->caps, MTK_36BIT_DMA) && -- likely(dma_addr != DMA_MAPPING_ERROR)) -- rxd->rxd2 |= RX_DMA_PREP_ADDR64(dma_addr); -+ rxd->rxd2 = RX_DMA_PREP_PLEN0(ring->buf_size) | addr64; - - ring->calc_idx = idx; - done++; -diff --git a/drivers/net/ethernet/mediatek/mtk_star_emac.c b/drivers/net/ethernet/mediatek/mtk_star_emac.c -index 25989c79c92e61..c2ab87828d8589 100644 ---- a/drivers/net/ethernet/mediatek/mtk_star_emac.c -+++ b/drivers/net/ethernet/mediatek/mtk_star_emac.c -@@ -1163,6 +1163,7 @@ static int mtk_star_tx_poll(struct napi_struct *napi, int budget) - struct net_device *ndev = priv->ndev; - unsigned int head = ring->head; - unsigned int entry = ring->tail; -+ unsigned long flags; - - while (entry != head && count < (MTK_STAR_RING_NUM_DESCS - 1)) { - ret = mtk_star_tx_complete_one(priv); -@@ -1182,9 +1183,9 @@ static int mtk_star_tx_poll(struct napi_struct *napi, int budget) - netif_wake_queue(ndev); - - if (napi_complete(napi)) { -- spin_lock(&priv->lock); -+ spin_lock_irqsave(&priv->lock, flags); - mtk_star_enable_dma_irq(priv, false, true); -- spin_unlock(&priv->lock); -+ spin_unlock_irqrestore(&priv->lock, flags); - } - - return 0; -@@ -1341,16 +1342,16 @@ static int mtk_star_rx(struct mtk_star_priv *priv, int budget) - static int mtk_star_rx_poll(struct napi_struct *napi, int budget) - { - struct mtk_star_priv *priv; -+ unsigned long flags; - int work_done = 0; - - priv = container_of(napi, struct mtk_star_priv, rx_napi); - - work_done = mtk_star_rx(priv, budget); -- if (work_done < budget) { -- napi_complete_done(napi, work_done); -- spin_lock(&priv->lock); -+ if (work_done < budget && napi_complete_done(napi, work_done)) { -+ spin_lock_irqsave(&priv->lock, flags); - mtk_star_enable_dma_irq(priv, true, false); -- spin_unlock(&priv->lock); -+ spin_unlock_irqrestore(&priv->lock, flags); - } - - return work_done; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -index 7eba3a5bb97cae..326c72b3df8671 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -@@ -3499,7 +3499,9 @@ int esw_offloads_enable(struct mlx5_eswitch *esw) - int err; - - mutex_init(&esw->offloads.termtbl_mutex); -- mlx5_rdma_enable_roce(esw->dev); -+ err = mlx5_rdma_enable_roce(esw->dev); -+ if (err) -+ goto err_roce; - - err = mlx5_esw_host_number_init(esw); - if (err) -@@ -3560,6 +3562,7 @@ int esw_offloads_enable(struct mlx5_eswitch *esw) - esw_offloads_metadata_uninit(esw); - err_metadata: - mlx5_rdma_disable_roce(esw->dev); -+err_roce: - mutex_destroy(&esw->offloads.termtbl_mutex); - return err; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/rdma.c b/drivers/net/ethernet/mellanox/mlx5/core/rdma.c -index a42f6cd99b7448..5c552b71e371c5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/rdma.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/rdma.c -@@ -118,8 +118,8 @@ static void mlx5_rdma_make_default_gid(struct mlx5_core_dev *dev, union ib_gid * - - static int mlx5_rdma_add_roce_addr(struct mlx5_core_dev *dev) - { -+ u8 mac[ETH_ALEN] = {}; - union ib_gid gid; -- u8 mac[ETH_ALEN]; - - mlx5_rdma_make_default_gid(dev, &gid); - return mlx5_core_roce_gid_set(dev, 0, -@@ -140,17 +140,17 @@ void mlx5_rdma_disable_roce(struct mlx5_core_dev *dev) - mlx5_nic_vport_disable_roce(dev); - } - --void mlx5_rdma_enable_roce(struct mlx5_core_dev *dev) -+int mlx5_rdma_enable_roce(struct mlx5_core_dev *dev) - { - int err; - - if (!MLX5_CAP_GEN(dev, roce)) -- return; -+ return 0; - - err = mlx5_nic_vport_enable_roce(dev); - if (err) { - mlx5_core_err(dev, "Failed to enable RoCE: %d\n", err); -- return; -+ return err; - } - - err = mlx5_rdma_add_roce_addr(dev); -@@ -165,10 +165,11 @@ void mlx5_rdma_enable_roce(struct mlx5_core_dev *dev) - goto del_roce_addr; - } - -- return; -+ return err; - - del_roce_addr: - mlx5_rdma_del_roce_addr(dev); - disable_roce: - mlx5_nic_vport_disable_roce(dev); -+ return err; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/rdma.h b/drivers/net/ethernet/mellanox/mlx5/core/rdma.h -index 750cff2a71a4bb..3d9e76c3d42fb1 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/rdma.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/rdma.h -@@ -8,12 +8,12 @@ - - #ifdef CONFIG_MLX5_ESWITCH - --void mlx5_rdma_enable_roce(struct mlx5_core_dev *dev); -+int mlx5_rdma_enable_roce(struct mlx5_core_dev *dev); - void mlx5_rdma_disable_roce(struct mlx5_core_dev *dev); - - #else /* CONFIG_MLX5_ESWITCH */ - --static inline void mlx5_rdma_enable_roce(struct mlx5_core_dev *dev) {} -+static inline int mlx5_rdma_enable_roce(struct mlx5_core_dev *dev) { return 0; } - static inline void mlx5_rdma_disable_roce(struct mlx5_core_dev *dev) {} - - #endif /* CONFIG_MLX5_ESWITCH */ -diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c -index 92010bfe5e4133..5d2ceff72784f2 100644 ---- a/drivers/net/ethernet/microchip/lan743x_main.c -+++ b/drivers/net/ethernet/microchip/lan743x_main.c -@@ -1949,6 +1949,7 @@ static void lan743x_tx_frame_add_lso(struct lan743x_tx *tx, - if (nr_frags <= 0) { - tx->frame_data0 |= TX_DESC_DATA0_LS_; - tx->frame_data0 |= TX_DESC_DATA0_IOC_; -+ tx->frame_last = tx->frame_first; - } - tx_descriptor = &tx->ring_cpu_ptr[tx->frame_tail]; - tx_descriptor->data0 = cpu_to_le32(tx->frame_data0); -@@ -2018,6 +2019,7 @@ static int lan743x_tx_frame_add_fragment(struct lan743x_tx *tx, - tx->frame_first = 0; - tx->frame_data0 = 0; - tx->frame_tail = 0; -+ tx->frame_last = 0; - return -ENOMEM; - } - -@@ -2058,16 +2060,18 @@ static void lan743x_tx_frame_end(struct lan743x_tx *tx, - TX_DESC_DATA0_DTYPE_DATA_) { - tx->frame_data0 |= TX_DESC_DATA0_LS_; - tx->frame_data0 |= TX_DESC_DATA0_IOC_; -+ tx->frame_last = tx->frame_tail; - } - -- tx_descriptor = &tx->ring_cpu_ptr[tx->frame_tail]; -- buffer_info = &tx->buffer_info[tx->frame_tail]; -+ tx_descriptor = &tx->ring_cpu_ptr[tx->frame_last]; -+ buffer_info = &tx->buffer_info[tx->frame_last]; - buffer_info->skb = skb; - if (time_stamp) - buffer_info->flags |= TX_BUFFER_INFO_FLAG_TIMESTAMP_REQUESTED; - if (ignore_sync) - buffer_info->flags |= TX_BUFFER_INFO_FLAG_IGNORE_SYNC; - -+ tx_descriptor = &tx->ring_cpu_ptr[tx->frame_tail]; - tx_descriptor->data0 = cpu_to_le32(tx->frame_data0); - tx->frame_tail = lan743x_tx_next_index(tx, tx->frame_tail); - tx->last_tail = tx->frame_tail; -diff --git a/drivers/net/ethernet/microchip/lan743x_main.h b/drivers/net/ethernet/microchip/lan743x_main.h -index 3b2c6046eb3ad5..b6c83c68241e63 100644 ---- a/drivers/net/ethernet/microchip/lan743x_main.h -+++ b/drivers/net/ethernet/microchip/lan743x_main.h -@@ -974,6 +974,7 @@ struct lan743x_tx { - u32 frame_first; - u32 frame_data0; - u32 frame_tail; -+ u32 frame_last; - - struct lan743x_tx_buffer_info *buffer_info; - -diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c -index f6aa5d6b6597e0..252d8e6f18c3cc 100644 ---- a/drivers/net/ethernet/mscc/ocelot.c -+++ b/drivers/net/ethernet/mscc/ocelot.c -@@ -453,9 +453,158 @@ static u16 ocelot_vlan_unaware_pvid(struct ocelot *ocelot, - return VLAN_N_VID - bridge_num - 1; - } - -+/** -+ * ocelot_update_vlan_reclassify_rule() - Make switch aware only to bridge VLAN TPID -+ * -+ * @ocelot: Switch private data structure -+ * @port: Index of ingress port -+ * -+ * IEEE 802.1Q-2018 clauses "5.5 C-VLAN component conformance" and "5.6 S-VLAN -+ * component conformance" suggest that a C-VLAN component should only recognize -+ * and filter on C-Tags, and an S-VLAN component should only recognize and -+ * process based on C-Tags. -+ * -+ * In Linux, as per commit 1a0b20b25732 ("Merge branch 'bridge-next'"), C-VLAN -+ * components are largely represented by a bridge with vlan_protocol 802.1Q, -+ * and S-VLAN components by a bridge with vlan_protocol 802.1ad. -+ * -+ * Currently the driver only offloads vlan_protocol 802.1Q, but the hardware -+ * design is non-conformant, because the switch assigns each frame to a VLAN -+ * based on an entirely different question, as detailed in figure "Basic VLAN -+ * Classification Flow" from its manual and reproduced below. -+ * -+ * Set TAG_TYPE, PCP, DEI, VID to port-default values in VLAN_CFG register -+ * if VLAN_AWARE_ENA[port] and frame has outer tag then: -+ * if VLAN_INNER_TAG_ENA[port] and frame has inner tag then: -+ * TAG_TYPE = (Frame.InnerTPID <> 0x8100) -+ * Set PCP, DEI, VID to values from inner VLAN header -+ * else: -+ * TAG_TYPE = (Frame.OuterTPID <> 0x8100) -+ * Set PCP, DEI, VID to values from outer VLAN header -+ * if VID == 0 then: -+ * VID = VLAN_CFG.VLAN_VID -+ * -+ * Summarized, the switch will recognize both 802.1Q and 802.1ad TPIDs as VLAN -+ * "with equal rights", and just set the TAG_TYPE bit to 0 (if 802.1Q) or to 1 -+ * (if 802.1ad). It will classify based on whichever of the tags is "outer", no -+ * matter what TPID that may have (or "inner", if VLAN_INNER_TAG_ENA[port]). -+ * -+ * In the VLAN Table, the TAG_TYPE information is not accessible - just the -+ * classified VID is - so it is as if each VLAN Table entry is for 2 VLANs: -+ * C-VLAN X, and S-VLAN X. -+ * -+ * Whereas the Linux bridge behavior is to only filter on frames with a TPID -+ * equal to the vlan_protocol, and treat everything else as VLAN-untagged. -+ * -+ * Consider an ingress packet tagged with 802.1ad VID=3 and 802.1Q VID=5, -+ * received on a bridge vlan_filtering=1 vlan_protocol=802.1Q port. This frame -+ * should be treated as 802.1Q-untagged, and classified to the PVID of that -+ * bridge port. Not to VID=3, and not to VID=5. -+ * -+ * The VCAP IS1 TCAM has everything we need to overwrite the choices made in -+ * the basic VLAN classification pipeline: it can match on TAG_TYPE in the key, -+ * and it can modify the classified VID in the action. Thus, for each port -+ * under a vlan_filtering bridge, we can insert a rule in VCAP IS1 lookup 0 to -+ * match on 802.1ad tagged frames and modify their classified VID to the 802.1Q -+ * PVID of the port. This effectively makes it appear to the outside world as -+ * if those packets were processed as VLAN-untagged. -+ * -+ * The rule needs to be updated each time the bridge PVID changes, and needs -+ * to be deleted if the bridge PVID is deleted, or if the port becomes -+ * VLAN-unaware. -+ */ -+static int ocelot_update_vlan_reclassify_rule(struct ocelot *ocelot, int port) -+{ -+ unsigned long cookie = OCELOT_VCAP_IS1_VLAN_RECLASSIFY(ocelot, port); -+ struct ocelot_vcap_block *block_vcap_is1 = &ocelot->block[VCAP_IS1]; -+ struct ocelot_port *ocelot_port = ocelot->ports[port]; -+ const struct ocelot_bridge_vlan *pvid_vlan; -+ struct ocelot_vcap_filter *filter; -+ int err, val, pcp, dei; -+ bool vid_replace_ena; -+ u16 vid; -+ -+ pvid_vlan = ocelot_port->pvid_vlan; -+ vid_replace_ena = ocelot_port->vlan_aware && pvid_vlan; -+ -+ filter = ocelot_vcap_block_find_filter_by_id(block_vcap_is1, cookie, -+ false); -+ if (!vid_replace_ena) { -+ /* If the reclassification filter doesn't need to exist, delete -+ * it if it was previously installed, and exit doing nothing -+ * otherwise. -+ */ -+ if (filter) -+ return ocelot_vcap_filter_del(ocelot, filter); -+ -+ return 0; -+ } -+ -+ /* The reclassification rule must apply. See if it already exists -+ * or if it must be created. -+ */ -+ -+ /* Treating as VLAN-untagged means using as classified VID equal to -+ * the bridge PVID, and PCP/DEI set to the port default QoS values. -+ */ -+ vid = pvid_vlan->vid; -+ val = ocelot_read_gix(ocelot, ANA_PORT_QOS_CFG, port); -+ pcp = ANA_PORT_QOS_CFG_QOS_DEFAULT_VAL_X(val); -+ dei = !!(val & ANA_PORT_QOS_CFG_DP_DEFAULT_VAL); -+ -+ if (filter) { -+ bool changed = false; -+ -+ /* Filter exists, just update it */ -+ if (filter->action.vid != vid) { -+ filter->action.vid = vid; -+ changed = true; -+ } -+ if (filter->action.pcp != pcp) { -+ filter->action.pcp = pcp; -+ changed = true; -+ } -+ if (filter->action.dei != dei) { -+ filter->action.dei = dei; -+ changed = true; -+ } -+ -+ if (!changed) -+ return 0; -+ -+ return ocelot_vcap_filter_replace(ocelot, filter); -+ } -+ -+ /* Filter doesn't exist, create it */ -+ filter = kzalloc(sizeof(*filter), GFP_KERNEL); -+ if (!filter) -+ return -ENOMEM; -+ -+ filter->key_type = OCELOT_VCAP_KEY_ANY; -+ filter->ingress_port_mask = BIT(port); -+ filter->vlan.tpid = OCELOT_VCAP_BIT_1; -+ filter->prio = 1; -+ filter->id.cookie = cookie; -+ filter->id.tc_offload = false; -+ filter->block_id = VCAP_IS1; -+ filter->type = OCELOT_VCAP_FILTER_OFFLOAD; -+ filter->lookup = 0; -+ filter->action.vid_replace_ena = true; -+ filter->action.pcp_dei_ena = true; -+ filter->action.vid = vid; -+ filter->action.pcp = pcp; -+ filter->action.dei = dei; -+ -+ err = ocelot_vcap_filter_add(ocelot, filter, NULL); -+ if (err) -+ kfree(filter); -+ -+ return err; -+} -+ - /* Default vlan to clasify for untagged frames (may be zero) */ --static void ocelot_port_set_pvid(struct ocelot *ocelot, int port, -- const struct ocelot_bridge_vlan *pvid_vlan) -+static int ocelot_port_set_pvid(struct ocelot *ocelot, int port, -+ const struct ocelot_bridge_vlan *pvid_vlan) - { - struct ocelot_port *ocelot_port = ocelot->ports[port]; - u16 pvid = ocelot_vlan_unaware_pvid(ocelot, ocelot_port->bridge); -@@ -475,15 +624,23 @@ static void ocelot_port_set_pvid(struct ocelot *ocelot, int port, - * happens automatically), but also 802.1p traffic which gets - * classified to VLAN 0, but that is always in our RX filter, so it - * would get accepted were it not for this setting. -+ * -+ * Also, we only support the bridge 802.1Q VLAN protocol, so -+ * 802.1ad-tagged frames (carrying S-Tags) should be considered -+ * 802.1Q-untagged, and also dropped. - */ - if (!pvid_vlan && ocelot_port->vlan_aware) - val = ANA_PORT_DROP_CFG_DROP_PRIO_S_TAGGED_ENA | -- ANA_PORT_DROP_CFG_DROP_PRIO_C_TAGGED_ENA; -+ ANA_PORT_DROP_CFG_DROP_PRIO_C_TAGGED_ENA | -+ ANA_PORT_DROP_CFG_DROP_S_TAGGED_ENA; - - ocelot_rmw_gix(ocelot, val, - ANA_PORT_DROP_CFG_DROP_PRIO_S_TAGGED_ENA | -- ANA_PORT_DROP_CFG_DROP_PRIO_C_TAGGED_ENA, -+ ANA_PORT_DROP_CFG_DROP_PRIO_C_TAGGED_ENA | -+ ANA_PORT_DROP_CFG_DROP_S_TAGGED_ENA, - ANA_PORT_DROP_CFG, port); -+ -+ return ocelot_update_vlan_reclassify_rule(ocelot, port); - } - - static struct ocelot_bridge_vlan *ocelot_bridge_vlan_find(struct ocelot *ocelot, -@@ -631,7 +788,10 @@ int ocelot_port_vlan_filtering(struct ocelot *ocelot, int port, - ANA_PORT_VLAN_CFG_VLAN_POP_CNT_M, - ANA_PORT_VLAN_CFG, port); - -- ocelot_port_set_pvid(ocelot, port, ocelot_port->pvid_vlan); -+ err = ocelot_port_set_pvid(ocelot, port, ocelot_port->pvid_vlan); -+ if (err) -+ return err; -+ - ocelot_port_manage_port_tag(ocelot, port); - - return 0; -@@ -670,6 +830,7 @@ EXPORT_SYMBOL(ocelot_vlan_prepare); - int ocelot_vlan_add(struct ocelot *ocelot, int port, u16 vid, bool pvid, - bool untagged) - { -+ struct ocelot_port *ocelot_port = ocelot->ports[port]; - int err; - - /* Ignore VID 0 added to our RX filter by the 8021q module, since -@@ -684,9 +845,17 @@ int ocelot_vlan_add(struct ocelot *ocelot, int port, u16 vid, bool pvid, - return err; - - /* Default ingress vlan classification */ -- if (pvid) -- ocelot_port_set_pvid(ocelot, port, -- ocelot_bridge_vlan_find(ocelot, vid)); -+ if (pvid) { -+ err = ocelot_port_set_pvid(ocelot, port, -+ ocelot_bridge_vlan_find(ocelot, vid)); -+ if (err) -+ return err; -+ } else if (ocelot_port->pvid_vlan && -+ ocelot_bridge_vlan_find(ocelot, vid) == ocelot_port->pvid_vlan) { -+ err = ocelot_port_set_pvid(ocelot, port, NULL); -+ if (err) -+ return err; -+ } - - /* Untagged egress vlan clasification */ - ocelot_port_manage_port_tag(ocelot, port); -@@ -712,8 +881,11 @@ int ocelot_vlan_del(struct ocelot *ocelot, int port, u16 vid) - return err; - - /* Ingress */ -- if (del_pvid) -- ocelot_port_set_pvid(ocelot, port, NULL); -+ if (del_pvid) { -+ err = ocelot_port_set_pvid(ocelot, port, NULL); -+ if (err) -+ return err; -+ } - - /* Egress */ - ocelot_port_manage_port_tag(ocelot, port); -@@ -2607,7 +2779,7 @@ int ocelot_port_set_default_prio(struct ocelot *ocelot, int port, u8 prio) - ANA_PORT_QOS_CFG, - port); - -- return 0; -+ return ocelot_update_vlan_reclassify_rule(ocelot, port); - } - EXPORT_SYMBOL_GPL(ocelot_port_set_default_prio); - -diff --git a/drivers/net/ethernet/mscc/ocelot_vcap.c b/drivers/net/ethernet/mscc/ocelot_vcap.c -index 73cdec5ca6a34d..5734b86aed5b53 100644 ---- a/drivers/net/ethernet/mscc/ocelot_vcap.c -+++ b/drivers/net/ethernet/mscc/ocelot_vcap.c -@@ -695,6 +695,7 @@ static void is1_entry_set(struct ocelot *ocelot, int ix, - vcap_key_bit_set(vcap, &data, VCAP_IS1_HK_L2_MC, filter->dmac_mc); - vcap_key_bit_set(vcap, &data, VCAP_IS1_HK_L2_BC, filter->dmac_bc); - vcap_key_bit_set(vcap, &data, VCAP_IS1_HK_VLAN_TAGGED, tag->tagged); -+ vcap_key_bit_set(vcap, &data, VCAP_IS1_HK_TPID, tag->tpid); - vcap_key_set(vcap, &data, VCAP_IS1_HK_VID, - tag->vid.value, tag->vid.mask); - vcap_key_set(vcap, &data, VCAP_IS1_HK_PCP, -diff --git a/drivers/net/ethernet/vertexcom/mse102x.c b/drivers/net/ethernet/vertexcom/mse102x.c -index 8f67c39f479eef..060a566bc6aae1 100644 ---- a/drivers/net/ethernet/vertexcom/mse102x.c -+++ b/drivers/net/ethernet/vertexcom/mse102x.c -@@ -6,6 +6,7 @@ - - #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt - -+#include - #include - #include - #include -@@ -33,7 +34,7 @@ - #define CMD_CTR (0x2 << CMD_SHIFT) - - #define CMD_MASK GENMASK(15, CMD_SHIFT) --#define LEN_MASK GENMASK(CMD_SHIFT - 1, 0) -+#define LEN_MASK GENMASK(CMD_SHIFT - 2, 0) - - #define DET_CMD_LEN 4 - #define DET_SOF_LEN 2 -@@ -262,7 +263,7 @@ static int mse102x_tx_frame_spi(struct mse102x_net *mse, struct sk_buff *txp, - } - - static int mse102x_rx_frame_spi(struct mse102x_net *mse, u8 *buff, -- unsigned int frame_len) -+ unsigned int frame_len, bool drop) - { - struct mse102x_net_spi *mses = to_mse102x_spi(mse); - struct spi_transfer *xfer = &mses->spi_xfer; -@@ -280,6 +281,9 @@ static int mse102x_rx_frame_spi(struct mse102x_net *mse, u8 *buff, - netdev_err(mse->ndev, "%s: spi_sync() failed: %d\n", - __func__, ret); - mse->stats.xfer_err++; -+ } else if (drop) { -+ netdev_dbg(mse->ndev, "%s: Drop frame\n", __func__); -+ ret = -EINVAL; - } else if (*sof != cpu_to_be16(DET_SOF)) { - netdev_dbg(mse->ndev, "%s: SPI start of frame is invalid (0x%04x)\n", - __func__, *sof); -@@ -307,6 +311,7 @@ static void mse102x_rx_pkt_spi(struct mse102x_net *mse) - struct sk_buff *skb; - unsigned int rxalign; - unsigned int rxlen; -+ bool drop = false; - __be16 rx = 0; - u16 cmd_resp; - u8 *rxpkt; -@@ -329,7 +334,8 @@ static void mse102x_rx_pkt_spi(struct mse102x_net *mse) - net_dbg_ratelimited("%s: Unexpected response (0x%04x)\n", - __func__, cmd_resp); - mse->stats.invalid_rts++; -- return; -+ drop = true; -+ goto drop; - } - - net_dbg_ratelimited("%s: Unexpected response to first CMD\n", -@@ -337,12 +343,20 @@ static void mse102x_rx_pkt_spi(struct mse102x_net *mse) - } - - rxlen = cmd_resp & LEN_MASK; -- if (!rxlen) { -- net_dbg_ratelimited("%s: No frame length defined\n", __func__); -+ if (rxlen < ETH_ZLEN || rxlen > VLAN_ETH_FRAME_LEN) { -+ net_dbg_ratelimited("%s: Invalid frame length: %d\n", __func__, -+ rxlen); - mse->stats.invalid_len++; -- return; -+ drop = true; - } - -+ /* In case of a invalid CMD_RTS, the frame must be consumed anyway. -+ * So assume the maximum possible frame length. -+ */ -+drop: -+ if (drop) -+ rxlen = VLAN_ETH_FRAME_LEN; -+ - rxalign = ALIGN(rxlen + DET_SOF_LEN + DET_DFT_LEN, 4); - skb = netdev_alloc_skb_ip_align(mse->ndev, rxalign); - if (!skb) -@@ -353,7 +367,7 @@ static void mse102x_rx_pkt_spi(struct mse102x_net *mse) - * They are copied, but ignored. - */ - rxpkt = skb_put(skb, rxlen) - DET_SOF_LEN; -- if (mse102x_rx_frame_spi(mse, rxpkt, rxlen)) { -+ if (mse102x_rx_frame_spi(mse, rxpkt, rxlen, drop)) { - mse->ndev->stats.rx_errors++; - dev_kfree_skb(skb); - return; -@@ -509,6 +523,7 @@ static irqreturn_t mse102x_irq(int irq, void *_mse) - static int mse102x_net_open(struct net_device *ndev) - { - struct mse102x_net *mse = netdev_priv(ndev); -+ struct mse102x_net_spi *mses = to_mse102x_spi(mse); - int ret; - - ret = request_threaded_irq(ndev->irq, NULL, mse102x_irq, IRQF_ONESHOT, -@@ -524,6 +539,13 @@ static int mse102x_net_open(struct net_device *ndev) - - netif_carrier_on(ndev); - -+ /* The SPI interrupt can stuck in case of pending packet(s). -+ * So poll for possible packet(s) to re-arm the interrupt. -+ */ -+ mutex_lock(&mses->lock); -+ mse102x_rx_pkt_spi(mse); -+ mutex_unlock(&mses->lock); -+ - netif_dbg(mse, ifup, ndev, "network device up\n"); - - return 0; -diff --git a/drivers/net/mdio/mdio-mux-meson-gxl.c b/drivers/net/mdio/mdio-mux-meson-gxl.c -index 76188575ca1fcf..19153d44800a94 100644 ---- a/drivers/net/mdio/mdio-mux-meson-gxl.c -+++ b/drivers/net/mdio/mdio-mux-meson-gxl.c -@@ -17,6 +17,7 @@ - #define REG2_LEDACT GENMASK(23, 22) - #define REG2_LEDLINK GENMASK(25, 24) - #define REG2_DIV4SEL BIT(27) -+#define REG2_REVERSED BIT(28) - #define REG2_ADCBYPASS BIT(30) - #define REG2_CLKINSEL BIT(31) - #define ETH_REG3 0x4 -@@ -65,7 +66,7 @@ static void gxl_enable_internal_mdio(struct gxl_mdio_mux *priv) - * The only constraint is that it must match the one in - * drivers/net/phy/meson-gxl.c to properly match the PHY. - */ -- writel(FIELD_PREP(REG2_PHYID, EPHY_GXL_ID), -+ writel(REG2_REVERSED | FIELD_PREP(REG2_PHYID, EPHY_GXL_ID), - priv->regs + ETH_REG2); - - /* Enable the internal phy */ -diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c -index bb0bf141587274..7b3739b29c8f72 100644 ---- a/drivers/net/usb/rndis_host.c -+++ b/drivers/net/usb/rndis_host.c -@@ -630,16 +630,6 @@ static const struct driver_info zte_rndis_info = { - .tx_fixup = rndis_tx_fixup, - }; - --static const struct driver_info wwan_rndis_info = { -- .description = "Mobile Broadband RNDIS device", -- .flags = FLAG_WWAN | FLAG_POINTTOPOINT | FLAG_FRAMING_RN | FLAG_NO_SETINT, -- .bind = rndis_bind, -- .unbind = rndis_unbind, -- .status = rndis_status, -- .rx_fixup = rndis_rx_fixup, -- .tx_fixup = rndis_tx_fixup, --}; -- - /*-------------------------------------------------------------------------*/ - - static const struct usb_device_id products [] = { -@@ -676,11 +666,9 @@ static const struct usb_device_id products [] = { - USB_INTERFACE_INFO(USB_CLASS_WIRELESS_CONTROLLER, 1, 3), - .driver_info = (unsigned long) &rndis_info, - }, { -- /* Mobile Broadband Modem, seen in Novatel Verizon USB730L and -- * Telit FN990A (RNDIS) -- */ -+ /* Novatel Verizon USB730L */ - USB_INTERFACE_INFO(USB_CLASS_MISC, 4, 1), -- .driver_info = (unsigned long)&wwan_rndis_info, -+ .driver_info = (unsigned long) &rndis_info, - }, - { }, // END - }; -diff --git a/drivers/net/vxlan/vxlan_vnifilter.c b/drivers/net/vxlan/vxlan_vnifilter.c -index 6e6e9f05509ab0..06d19e90eadb59 100644 ---- a/drivers/net/vxlan/vxlan_vnifilter.c -+++ b/drivers/net/vxlan/vxlan_vnifilter.c -@@ -627,7 +627,11 @@ static void vxlan_vni_delete_group(struct vxlan_dev *vxlan, - * default dst remote_ip previously added for this vni - */ - if (!vxlan_addr_any(&vninode->remote_ip) || -- !vxlan_addr_any(&dst->remote_ip)) -+ !vxlan_addr_any(&dst->remote_ip)) { -+ u32 hash_index = fdb_head_index(vxlan, all_zeros_mac, -+ vninode->vni); -+ -+ spin_lock_bh(&vxlan->hash_lock[hash_index]); - __vxlan_fdb_delete(vxlan, all_zeros_mac, - (vxlan_addr_any(&vninode->remote_ip) ? - dst->remote_ip : vninode->remote_ip), -@@ -635,6 +639,8 @@ static void vxlan_vni_delete_group(struct vxlan_dev *vxlan, - vninode->vni, vninode->vni, - dst->remote_ifindex, - true); -+ spin_unlock_bh(&vxlan->hash_lock[hash_index]); -+ } - - if (vxlan->dev->flags & IFF_UP) { - if (vxlan_addr_multicast(&vninode->remote_ip) && -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c -index 2178675ae1a44d..6f64a05debd2cb 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c -@@ -903,14 +903,16 @@ brcmf_usb_dl_writeimage(struct brcmf_usbdev_info *devinfo, u8 *fw, int fwlen) - } - - /* 1) Prepare USB boot loader for runtime image */ -- brcmf_usb_dl_cmd(devinfo, DL_START, &state, sizeof(state)); -+ err = brcmf_usb_dl_cmd(devinfo, DL_START, &state, sizeof(state)); -+ if (err) -+ goto fail; - - rdlstate = le32_to_cpu(state.state); - rdlbytes = le32_to_cpu(state.bytes); - - /* 2) Check we are in the Waiting state */ - if (rdlstate != DL_WAITING) { -- brcmf_err("Failed to DL_START\n"); -+ brcmf_err("Invalid DL state: %u\n", rdlstate); - err = -EINVAL; - goto fail; - } -diff --git a/drivers/net/wireless/purelifi/plfxlc/mac.c b/drivers/net/wireless/purelifi/plfxlc/mac.c -index 506d2f31efb5af..7ebc0df0944cb5 100644 ---- a/drivers/net/wireless/purelifi/plfxlc/mac.c -+++ b/drivers/net/wireless/purelifi/plfxlc/mac.c -@@ -103,7 +103,6 @@ int plfxlc_mac_init_hw(struct ieee80211_hw *hw) - void plfxlc_mac_release(struct plfxlc_mac *mac) - { - plfxlc_chip_release(&mac->chip); -- lockdep_assert_held(&mac->lock); - } - - int plfxlc_op_start(struct ieee80211_hw *hw) -diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c -index a763df0200ab46..fdde38903ebcd5 100644 ---- a/drivers/nvme/host/pci.c -+++ b/drivers/nvme/host/pci.c -@@ -3377,7 +3377,7 @@ static pci_ers_result_t nvme_slot_reset(struct pci_dev *pdev) - - dev_info(dev->ctrl.device, "restart after slot reset\n"); - pci_restore_state(pdev); -- if (!nvme_try_sched_reset(&dev->ctrl)) -+ if (nvme_try_sched_reset(&dev->ctrl)) - nvme_unquiesce_io_queues(&dev->ctrl); - return PCI_ERS_RESULT_RECOVERED; - } -diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c -index 84db7f4f861cb1..5b76670f34be29 100644 ---- a/drivers/nvme/host/tcp.c -+++ b/drivers/nvme/host/tcp.c -@@ -1710,7 +1710,7 @@ static void __nvme_tcp_stop_queue(struct nvme_tcp_queue *queue) - cancel_work_sync(&queue->io_work); - } - --static void nvme_tcp_stop_queue(struct nvme_ctrl *nctrl, int qid) -+static void nvme_tcp_stop_queue_nowait(struct nvme_ctrl *nctrl, int qid) - { - struct nvme_tcp_ctrl *ctrl = to_tcp_ctrl(nctrl); - struct nvme_tcp_queue *queue = &ctrl->queues[qid]; -@@ -1724,6 +1724,31 @@ static void nvme_tcp_stop_queue(struct nvme_ctrl *nctrl, int qid) - mutex_unlock(&queue->queue_lock); - } - -+static void nvme_tcp_wait_queue(struct nvme_ctrl *nctrl, int qid) -+{ -+ struct nvme_tcp_ctrl *ctrl = to_tcp_ctrl(nctrl); -+ struct nvme_tcp_queue *queue = &ctrl->queues[qid]; -+ int timeout = 100; -+ -+ while (timeout > 0) { -+ if (!test_bit(NVME_TCP_Q_ALLOCATED, &queue->flags) || -+ !sk_wmem_alloc_get(queue->sock->sk)) -+ return; -+ msleep(2); -+ timeout -= 2; -+ } -+ dev_warn(nctrl->device, -+ "qid %d: timeout draining sock wmem allocation expired\n", -+ qid); -+} -+ -+static void nvme_tcp_stop_queue(struct nvme_ctrl *nctrl, int qid) -+{ -+ nvme_tcp_stop_queue_nowait(nctrl, qid); -+ nvme_tcp_wait_queue(nctrl, qid); -+} -+ -+ - static void nvme_tcp_setup_sock_ops(struct nvme_tcp_queue *queue) - { - write_lock_bh(&queue->sock->sk->sk_callback_lock); -@@ -1790,7 +1815,9 @@ static void nvme_tcp_stop_io_queues(struct nvme_ctrl *ctrl) - int i; - - for (i = 1; i < ctrl->queue_count; i++) -- nvme_tcp_stop_queue(ctrl, i); -+ nvme_tcp_stop_queue_nowait(ctrl, i); -+ for (i = 1; i < ctrl->queue_count; i++) -+ nvme_tcp_wait_queue(ctrl, i); - } - - static int nvme_tcp_start_io_queues(struct nvme_ctrl *ctrl, -diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c -index 822a750b064b27..cedfbd4258631d 100644 ---- a/drivers/pci/controller/dwc/pci-imx6.c -+++ b/drivers/pci/controller/dwc/pci-imx6.c -@@ -1283,7 +1283,8 @@ static int imx6_pcie_probe(struct platform_device *pdev) - case IMX8MQ_EP: - if (dbi_base->start == IMX8MQ_PCIE2_BASE_ADDR) - imx6_pcie->controller_id = 1; -- -+ fallthrough; -+ case IMX7D: - imx6_pcie->pciephy_reset = devm_reset_control_get_exclusive(dev, - "pciephy"); - if (IS_ERR(imx6_pcie->pciephy_reset)) { -diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c -index 70907e8f3ea96d..946a546cd9dd01 100644 ---- a/drivers/platform/x86/amd/pmc/pmc.c -+++ b/drivers/platform/x86/amd/pmc/pmc.c -@@ -823,10 +823,9 @@ static void amd_pmc_s2idle_check(void) - struct smu_metrics table; - int rc; - -- /* CZN: Ensure that future s0i3 entry attempts at least 10ms passed */ -- if (pdev->cpu_id == AMD_CPU_ID_CZN && !get_metrics_table(pdev, &table) && -- table.s0i3_last_entry_status) -- usleep_range(10000, 20000); -+ /* Avoid triggering OVP */ -+ if (!get_metrics_table(pdev, &table) && table.s0i3_last_entry_status) -+ msleep(2500); - - /* Dump the IdleMask before we add to the STB */ - amd_pmc_idlemask_read(pdev, pdev->dev, NULL); -diff --git a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c -index a3b25253b6fdeb..2c9c5cc7d854ed 100644 ---- a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c -+++ b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c -@@ -121,15 +121,13 @@ static int uncore_event_cpu_online(unsigned int cpu) - { - struct uncore_data *data; - int target; -+ int ret; - - /* Check if there is an online cpu in the package for uncore MSR */ - target = cpumask_any_and(&uncore_cpu_mask, topology_die_cpumask(cpu)); - if (target < nr_cpu_ids) - return 0; - -- /* Use this CPU on this die as a control CPU */ -- cpumask_set_cpu(cpu, &uncore_cpu_mask); -- - data = uncore_get_instance(cpu); - if (!data) - return 0; -@@ -138,7 +136,14 @@ static int uncore_event_cpu_online(unsigned int cpu) - data->die_id = topology_die_id(cpu); - data->domain_id = UNCORE_DOMAIN_ID_INVALID; - -- return uncore_freq_add_entry(data, cpu); -+ ret = uncore_freq_add_entry(data, cpu); -+ if (ret) -+ return ret; -+ -+ /* Use this CPU on this die as a control CPU */ -+ cpumask_set_cpu(cpu, &uncore_cpu_mask); -+ -+ return 0; - } - - static int uncore_event_cpu_offline(unsigned int cpu) -diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c -index 460f232dad508b..147d7052794f77 100644 ---- a/drivers/spi/spi-tegra114.c -+++ b/drivers/spi/spi-tegra114.c -@@ -728,9 +728,9 @@ static int tegra_spi_set_hw_cs_timing(struct spi_device *spi) - u32 inactive_cycles; - u8 cs_state; - -- if (setup->unit != SPI_DELAY_UNIT_SCK || -- hold->unit != SPI_DELAY_UNIT_SCK || -- inactive->unit != SPI_DELAY_UNIT_SCK) { -+ if ((setup->unit && setup->unit != SPI_DELAY_UNIT_SCK) || -+ (hold->unit && hold->unit != SPI_DELAY_UNIT_SCK) || -+ (inactive->unit && inactive->unit != SPI_DELAY_UNIT_SCK)) { - dev_err(&spi->dev, - "Invalid delay unit %d, should be SPI_DELAY_UNIT_SCK\n", - SPI_DELAY_UNIT_SCK); -diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c -index 99baa60ef50fe9..15a8402ee8a17a 100644 ---- a/drivers/usb/host/xhci-debugfs.c -+++ b/drivers/usb/host/xhci-debugfs.c -@@ -693,7 +693,7 @@ void xhci_debugfs_init(struct xhci_hcd *xhci) - "command-ring", - xhci->debugfs_root); - -- xhci_debugfs_create_ring_dir(xhci, &xhci->interrupter->event_ring, -+ xhci_debugfs_create_ring_dir(xhci, &xhci->interrupters[0]->event_ring, - "event-ring", - xhci->debugfs_root); - -diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index 0df5d807a77e8f..a2b6a922077ee3 100644 ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -1880,9 +1880,10 @@ int xhci_bus_resume(struct usb_hcd *hcd) - int slot_id; - int sret; - u32 next_state; -- u32 temp, portsc; -+ u32 portsc; - struct xhci_hub *rhub; - struct xhci_port **ports; -+ bool disabled_irq = false; - - rhub = xhci_get_rhub(hcd); - ports = rhub->ports; -@@ -1898,17 +1899,20 @@ int xhci_bus_resume(struct usb_hcd *hcd) - return -ESHUTDOWN; - } - -- /* delay the irqs */ -- temp = readl(&xhci->op_regs->command); -- temp &= ~CMD_EIE; -- writel(temp, &xhci->op_regs->command); -- - /* bus specific resume for ports we suspended at bus_suspend */ -- if (hcd->speed >= HCD_USB3) -+ if (hcd->speed >= HCD_USB3) { - next_state = XDEV_U0; -- else -+ } else { - next_state = XDEV_RESUME; -- -+ if (bus_state->bus_suspended) { -+ /* -+ * prevent port event interrupts from interfering -+ * with usb2 port resume process -+ */ -+ xhci_disable_interrupter(xhci->interrupters[0]); -+ disabled_irq = true; -+ } -+ } - port_index = max_ports; - while (port_index--) { - portsc = readl(ports[port_index]->addr); -@@ -1977,11 +1981,9 @@ int xhci_bus_resume(struct usb_hcd *hcd) - (void) readl(&xhci->op_regs->command); - - bus_state->next_statechange = jiffies + msecs_to_jiffies(5); -- /* re-enable irqs */ -- temp = readl(&xhci->op_regs->command); -- temp |= CMD_EIE; -- writel(temp, &xhci->op_regs->command); -- temp = readl(&xhci->op_regs->command); -+ /* re-enable interrupter */ -+ if (disabled_irq) -+ xhci_enable_interrupter(xhci->interrupters[0]); - - spin_unlock_irqrestore(&xhci->lock, flags); - return 0; -diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c -index fbc486546b8533..22cca89efbfd72 100644 ---- a/drivers/usb/host/xhci-mem.c -+++ b/drivers/usb/host/xhci-mem.c -@@ -29,6 +29,7 @@ - static struct xhci_segment *xhci_segment_alloc(struct xhci_hcd *xhci, - unsigned int cycle_state, - unsigned int max_packet, -+ unsigned int num, - gfp_t flags) - { - struct xhci_segment *seg; -@@ -60,6 +61,7 @@ static struct xhci_segment *xhci_segment_alloc(struct xhci_hcd *xhci, - for (i = 0; i < TRBS_PER_SEGMENT; i++) - seg->trbs[i].link.control = cpu_to_le32(TRB_CYCLE); - } -+ seg->num = num; - seg->dma = dma; - seg->next = NULL; - -@@ -316,6 +318,7 @@ void xhci_initialize_ring_info(struct xhci_ring *ring, - */ - ring->num_trbs_free = ring->num_segs * (TRBS_PER_SEGMENT - 1) - 1; - } -+EXPORT_SYMBOL_GPL(xhci_initialize_ring_info); - - /* Allocate segments and link them for a ring */ - static int xhci_alloc_segments_for_ring(struct xhci_hcd *xhci, -@@ -324,6 +327,7 @@ static int xhci_alloc_segments_for_ring(struct xhci_hcd *xhci, - enum xhci_ring_type type, unsigned int max_packet, gfp_t flags) - { - struct xhci_segment *prev; -+ unsigned int num = 0; - bool chain_links; - - /* Set chain bit for 0.95 hosts, and for isoc rings on AMD 0.96 host */ -@@ -331,16 +335,17 @@ static int xhci_alloc_segments_for_ring(struct xhci_hcd *xhci, - (type == TYPE_ISOC && - (xhci->quirks & XHCI_AMD_0x96_HOST))); - -- prev = xhci_segment_alloc(xhci, cycle_state, max_packet, flags); -+ prev = xhci_segment_alloc(xhci, cycle_state, max_packet, num, flags); - if (!prev) - return -ENOMEM; -- num_segs--; -+ num++; - - *first = prev; -- while (num_segs > 0) { -+ while (num < num_segs) { - struct xhci_segment *next; - -- next = xhci_segment_alloc(xhci, cycle_state, max_packet, flags); -+ next = xhci_segment_alloc(xhci, cycle_state, max_packet, num, -+ flags); - if (!next) { - prev = *first; - while (prev) { -@@ -353,7 +358,7 @@ static int xhci_alloc_segments_for_ring(struct xhci_hcd *xhci, - xhci_link_segments(prev, next, type, chain_links); - - prev = next; -- num_segs--; -+ num++; - } - xhci_link_segments(prev, *first, type, chain_links); - *last = prev; -@@ -1799,23 +1804,13 @@ int xhci_alloc_erst(struct xhci_hcd *xhci, - } - - static void --xhci_free_interrupter(struct xhci_hcd *xhci, struct xhci_interrupter *ir) -+xhci_remove_interrupter(struct xhci_hcd *xhci, struct xhci_interrupter *ir) - { -- struct device *dev = xhci_to_hcd(xhci)->self.sysdev; -- size_t erst_size; -- u64 tmp64; - u32 tmp; - - if (!ir) - return; - -- erst_size = sizeof(struct xhci_erst_entry) * ir->erst.num_entries; -- if (ir->erst.entries) -- dma_free_coherent(dev, erst_size, -- ir->erst.entries, -- ir->erst.erst_dma_addr); -- ir->erst.entries = NULL; -- - /* - * Clean out interrupter registers except ERSTBA. Clearing either the - * low or high 32 bits of ERSTBA immediately causes the controller to -@@ -1826,19 +1821,60 @@ xhci_free_interrupter(struct xhci_hcd *xhci, struct xhci_interrupter *ir) - tmp &= ERST_SIZE_MASK; - writel(tmp, &ir->ir_set->erst_size); - -- tmp64 = xhci_read_64(xhci, &ir->ir_set->erst_dequeue); -- tmp64 &= (u64) ERST_PTR_MASK; -- xhci_write_64(xhci, tmp64, &ir->ir_set->erst_dequeue); -+ xhci_write_64(xhci, ERST_EHB, &ir->ir_set->erst_dequeue); - } -+} - -- /* free interrrupter event ring */ -+static void -+xhci_free_interrupter(struct xhci_hcd *xhci, struct xhci_interrupter *ir) -+{ -+ struct device *dev = xhci_to_hcd(xhci)->self.sysdev; -+ size_t erst_size; -+ -+ if (!ir) -+ return; -+ -+ erst_size = sizeof(struct xhci_erst_entry) * ir->erst.num_entries; -+ if (ir->erst.entries) -+ dma_free_coherent(dev, erst_size, -+ ir->erst.entries, -+ ir->erst.erst_dma_addr); -+ ir->erst.entries = NULL; -+ -+ /* free interrupter event ring */ - if (ir->event_ring) - xhci_ring_free(xhci, ir->event_ring); -+ - ir->event_ring = NULL; - - kfree(ir); - } - -+void xhci_remove_secondary_interrupter(struct usb_hcd *hcd, struct xhci_interrupter *ir) -+{ -+ struct xhci_hcd *xhci = hcd_to_xhci(hcd); -+ unsigned int intr_num; -+ -+ spin_lock_irq(&xhci->lock); -+ -+ /* interrupter 0 is primary interrupter, don't touch it */ -+ if (!ir || !ir->intr_num || ir->intr_num >= xhci->max_interrupters) { -+ xhci_dbg(xhci, "Invalid secondary interrupter, can't remove\n"); -+ spin_unlock_irq(&xhci->lock); -+ return; -+ } -+ -+ intr_num = ir->intr_num; -+ -+ xhci_remove_interrupter(xhci, ir); -+ xhci->interrupters[intr_num] = NULL; -+ -+ spin_unlock_irq(&xhci->lock); -+ -+ xhci_free_interrupter(xhci, ir); -+} -+EXPORT_SYMBOL_GPL(xhci_remove_secondary_interrupter); -+ - void xhci_mem_cleanup(struct xhci_hcd *xhci) - { - struct device *dev = xhci_to_hcd(xhci)->self.sysdev; -@@ -1846,9 +1882,14 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci) - - cancel_delayed_work_sync(&xhci->cmd_timer); - -- xhci_free_interrupter(xhci, xhci->interrupter); -- xhci->interrupter = NULL; -- xhci_dbg_trace(xhci, trace_xhci_dbg_init, "Freed primary event ring"); -+ for (i = 0; xhci->interrupters && i < xhci->max_interrupters; i++) { -+ if (xhci->interrupters[i]) { -+ xhci_remove_interrupter(xhci, xhci->interrupters[i]); -+ xhci_free_interrupter(xhci, xhci->interrupters[i]); -+ xhci->interrupters[i] = NULL; -+ } -+ } -+ xhci_dbg_trace(xhci, trace_xhci_dbg_init, "Freed interrupters"); - - if (xhci->cmd_ring) - xhci_ring_free(xhci, xhci->cmd_ring); -@@ -1918,6 +1959,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci) - for (i = 0; i < xhci->num_port_caps; i++) - kfree(xhci->port_caps[i].psi); - kfree(xhci->port_caps); -+ kfree(xhci->interrupters); - xhci->num_port_caps = 0; - - xhci->usb2_rhub.ports = NULL; -@@ -1926,6 +1968,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci) - xhci->rh_bw = NULL; - xhci->ext_caps = NULL; - xhci->port_caps = NULL; -+ xhci->interrupters = NULL; - - xhci->page_size = 0; - xhci->page_shift = 0; -@@ -1935,7 +1978,6 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci) - - static void xhci_set_hc_event_deq(struct xhci_hcd *xhci, struct xhci_interrupter *ir) - { -- u64 temp; - dma_addr_t deq; - - deq = xhci_trb_virt_to_dma(ir->event_ring->deq_seg, -@@ -1943,15 +1985,12 @@ static void xhci_set_hc_event_deq(struct xhci_hcd *xhci, struct xhci_interrupter - if (!deq) - xhci_warn(xhci, "WARN something wrong with SW event ring dequeue ptr.\n"); - /* Update HC event ring dequeue pointer */ -- temp = xhci_read_64(xhci, &ir->ir_set->erst_dequeue); -- temp &= ERST_PTR_MASK; - /* Don't clear the EHB bit (which is RW1C) because - * there might be more events to service. - */ -- temp &= ~ERST_EHB; - xhci_dbg_trace(xhci, trace_xhci_dbg_init, - "// Write event ring dequeue pointer, preserving EHB bit"); -- xhci_write_64(xhci, ((u64) deq & (u64) ~ERST_PTR_MASK) | temp, -+ xhci_write_64(xhci, ((u64) deq & (u64) ~ERST_PTR_MASK), - &ir->ir_set->erst_dequeue); - } - -@@ -2236,18 +2275,24 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags) - } - - static struct xhci_interrupter * --xhci_alloc_interrupter(struct xhci_hcd *xhci, gfp_t flags) -+xhci_alloc_interrupter(struct xhci_hcd *xhci, unsigned int segs, gfp_t flags) - { - struct device *dev = xhci_to_hcd(xhci)->self.sysdev; - struct xhci_interrupter *ir; -+ unsigned int max_segs; - int ret; - -+ if (!segs) -+ segs = ERST_DEFAULT_SEGS; -+ -+ max_segs = BIT(HCS_ERST_MAX(xhci->hcs_params2)); -+ segs = min(segs, max_segs); -+ - ir = kzalloc_node(sizeof(*ir), flags, dev_to_node(dev)); - if (!ir) - return NULL; - -- ir->event_ring = xhci_ring_alloc(xhci, ERST_NUM_SEGS, 1, TYPE_EVENT, -- 0, flags); -+ ir->event_ring = xhci_ring_alloc(xhci, segs, 1, TYPE_EVENT, 0, flags); - if (!ir->event_ring) { - xhci_warn(xhci, "Failed to allocate interrupter event ring\n"); - kfree(ir); -@@ -2278,12 +2323,19 @@ xhci_add_interrupter(struct xhci_hcd *xhci, struct xhci_interrupter *ir, - return -EINVAL; - } - -+ if (xhci->interrupters[intr_num]) { -+ xhci_warn(xhci, "Interrupter %d\n already set up", intr_num); -+ return -EINVAL; -+ } -+ -+ xhci->interrupters[intr_num] = ir; -+ ir->intr_num = intr_num; - ir->ir_set = &xhci->run_regs->ir_set[intr_num]; - - /* set ERST count with the number of entries in the segment table */ - erst_size = readl(&ir->ir_set->erst_size); - erst_size &= ERST_SIZE_MASK; -- erst_size |= ERST_NUM_SEGS; -+ erst_size |= ir->event_ring->num_segs; - writel(erst_size, &ir->ir_set->erst_size); - - erst_base = xhci_read_64(xhci, &ir->ir_set->erst_base); -@@ -2300,10 +2352,58 @@ xhci_add_interrupter(struct xhci_hcd *xhci, struct xhci_interrupter *ir, - return 0; - } - -+struct xhci_interrupter * -+xhci_create_secondary_interrupter(struct usb_hcd *hcd, unsigned int segs, -+ u32 imod_interval) -+{ -+ struct xhci_hcd *xhci = hcd_to_xhci(hcd); -+ struct xhci_interrupter *ir; -+ unsigned int i; -+ int err = -ENOSPC; -+ -+ if (!xhci->interrupters || xhci->max_interrupters <= 1) -+ return NULL; -+ -+ ir = xhci_alloc_interrupter(xhci, segs, GFP_KERNEL); -+ if (!ir) -+ return NULL; -+ -+ spin_lock_irq(&xhci->lock); -+ -+ /* Find available secondary interrupter, interrupter 0 is reserved for primary */ -+ for (i = 1; i < xhci->max_interrupters; i++) { -+ if (xhci->interrupters[i] == NULL) { -+ err = xhci_add_interrupter(xhci, ir, i); -+ break; -+ } -+ } -+ -+ spin_unlock_irq(&xhci->lock); -+ -+ if (err) { -+ xhci_warn(xhci, "Failed to add secondary interrupter, max interrupters %d\n", -+ xhci->max_interrupters); -+ xhci_free_interrupter(xhci, ir); -+ return NULL; -+ } -+ -+ err = xhci_set_interrupter_moderation(ir, imod_interval); -+ if (err) -+ xhci_warn(xhci, "Failed to set interrupter %d moderation to %uns\n", -+ i, imod_interval); -+ -+ xhci_dbg(xhci, "Add secondary interrupter %d, max interrupters %d\n", -+ i, xhci->max_interrupters); -+ -+ return ir; -+} -+EXPORT_SYMBOL_GPL(xhci_create_secondary_interrupter); -+ - int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags) - { -- dma_addr_t dma; -+ struct xhci_interrupter *ir; - struct device *dev = xhci_to_hcd(xhci)->self.sysdev; -+ dma_addr_t dma; - unsigned int val, val2; - u64 val_64; - u32 page_size, temp; -@@ -2428,11 +2528,14 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags) - /* Allocate and set up primary interrupter 0 with an event ring. */ - xhci_dbg_trace(xhci, trace_xhci_dbg_init, - "Allocating primary event ring"); -- xhci->interrupter = xhci_alloc_interrupter(xhci, flags); -- if (!xhci->interrupter) -+ xhci->interrupters = kcalloc_node(xhci->max_interrupters, sizeof(*xhci->interrupters), -+ flags, dev_to_node(dev)); -+ -+ ir = xhci_alloc_interrupter(xhci, 0, flags); -+ if (!ir) - goto fail; - -- if (xhci_add_interrupter(xhci, xhci->interrupter, 0)) -+ if (xhci_add_interrupter(xhci, ir, 0)) - goto fail; - - xhci->isoc_bei_interval = AVOID_BEI_INTERVAL_MAX; -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index cb944396294516..5a53280fa2edfd 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -3167,7 +3167,7 @@ static void xhci_update_erst_dequeue(struct xhci_hcd *xhci, - return; - - /* Update HC event ring dequeue pointer */ -- temp_64 &= ERST_DESI_MASK; -+ temp_64 = ir->event_ring->deq_seg->num & ERST_DESI_MASK; - temp_64 |= ((u64) deq & (u64) ~ERST_PTR_MASK); - } - -@@ -3225,7 +3225,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) - writel(status, &xhci->op_regs->status); - - /* This is the handler of the primary interrupter */ -- ir = xhci->interrupter; -+ ir = xhci->interrupters[0]; - if (!hcd->msi_enabled) { - u32 irq_pending; - irq_pending = readl(&ir->ir_set->irq_pending); -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index 70e6c240a5409f..ce38cd2435c8c3 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -297,7 +297,7 @@ static void xhci_zero_64b_regs(struct xhci_hcd *xhci) - xhci_info(xhci, "Fault detected\n"); - } - --static int xhci_enable_interrupter(struct xhci_interrupter *ir) -+int xhci_enable_interrupter(struct xhci_interrupter *ir) - { - u32 iman; - -@@ -310,7 +310,7 @@ static int xhci_enable_interrupter(struct xhci_interrupter *ir) - return 0; - } - --static int xhci_disable_interrupter(struct xhci_interrupter *ir) -+int xhci_disable_interrupter(struct xhci_interrupter *ir) - { - u32 iman; - -@@ -323,6 +323,23 @@ static int xhci_disable_interrupter(struct xhci_interrupter *ir) - return 0; - } - -+/* interrupt moderation interval imod_interval in nanoseconds */ -+int xhci_set_interrupter_moderation(struct xhci_interrupter *ir, -+ u32 imod_interval) -+{ -+ u32 imod; -+ -+ if (!ir || !ir->ir_set || imod_interval > U16_MAX * 250) -+ return -EINVAL; -+ -+ imod = readl(&ir->ir_set->irq_control); -+ imod &= ~ER_IRQ_INTERVAL_MASK; -+ imod |= (imod_interval / 250) & ER_IRQ_INTERVAL_MASK; -+ writel(imod, &ir->ir_set->irq_control); -+ -+ return 0; -+} -+ - static void compliance_mode_recovery(struct timer_list *t) - { - struct xhci_hcd *xhci; -@@ -457,7 +474,7 @@ static int xhci_init(struct usb_hcd *hcd) - - static int xhci_run_finished(struct xhci_hcd *xhci) - { -- struct xhci_interrupter *ir = xhci->interrupter; -+ struct xhci_interrupter *ir = xhci->interrupters[0]; - unsigned long flags; - u32 temp; - -@@ -505,11 +522,10 @@ static int xhci_run_finished(struct xhci_hcd *xhci) - */ - int xhci_run(struct usb_hcd *hcd) - { -- u32 temp; - u64 temp_64; - int ret; - struct xhci_hcd *xhci = hcd_to_xhci(hcd); -- struct xhci_interrupter *ir = xhci->interrupter; -+ struct xhci_interrupter *ir = xhci->interrupters[0]; - /* Start the xHCI host controller running only after the USB 2.0 roothub - * is setup. - */ -@@ -525,12 +541,7 @@ int xhci_run(struct usb_hcd *hcd) - xhci_dbg_trace(xhci, trace_xhci_dbg_init, - "ERST deq = 64'h%0lx", (long unsigned int) temp_64); - -- xhci_dbg_trace(xhci, trace_xhci_dbg_init, -- "// Set the interrupt modulation register"); -- temp = readl(&ir->ir_set->irq_control); -- temp &= ~ER_IRQ_INTERVAL_MASK; -- temp |= (xhci->imod_interval / 250) & ER_IRQ_INTERVAL_MASK; -- writel(temp, &ir->ir_set->irq_control); -+ xhci_set_interrupter_moderation(ir, xhci->imod_interval); - - if (xhci->quirks & XHCI_NEC_HOST) { - struct xhci_command *command; -@@ -573,7 +584,7 @@ void xhci_stop(struct usb_hcd *hcd) - { - u32 temp; - struct xhci_hcd *xhci = hcd_to_xhci(hcd); -- struct xhci_interrupter *ir = xhci->interrupter; -+ struct xhci_interrupter *ir = xhci->interrupters[0]; - - mutex_lock(&xhci->mutex); - -@@ -669,36 +680,51 @@ EXPORT_SYMBOL_GPL(xhci_shutdown); - #ifdef CONFIG_PM - static void xhci_save_registers(struct xhci_hcd *xhci) - { -- struct xhci_interrupter *ir = xhci->interrupter; -+ struct xhci_interrupter *ir; -+ unsigned int i; - - xhci->s3.command = readl(&xhci->op_regs->command); - xhci->s3.dev_nt = readl(&xhci->op_regs->dev_notification); - xhci->s3.dcbaa_ptr = xhci_read_64(xhci, &xhci->op_regs->dcbaa_ptr); - xhci->s3.config_reg = readl(&xhci->op_regs->config_reg); - -- if (!ir) -- return; -+ /* save both primary and all secondary interrupters */ -+ /* fixme, shold we lock to prevent race with remove secondary interrupter? */ -+ for (i = 0; i < xhci->max_interrupters; i++) { -+ ir = xhci->interrupters[i]; -+ if (!ir) -+ continue; - -- ir->s3_erst_size = readl(&ir->ir_set->erst_size); -- ir->s3_erst_base = xhci_read_64(xhci, &ir->ir_set->erst_base); -- ir->s3_erst_dequeue = xhci_read_64(xhci, &ir->ir_set->erst_dequeue); -- ir->s3_irq_pending = readl(&ir->ir_set->irq_pending); -- ir->s3_irq_control = readl(&ir->ir_set->irq_control); -+ ir->s3_erst_size = readl(&ir->ir_set->erst_size); -+ ir->s3_erst_base = xhci_read_64(xhci, &ir->ir_set->erst_base); -+ ir->s3_erst_dequeue = xhci_read_64(xhci, &ir->ir_set->erst_dequeue); -+ ir->s3_irq_pending = readl(&ir->ir_set->irq_pending); -+ ir->s3_irq_control = readl(&ir->ir_set->irq_control); -+ } - } - - static void xhci_restore_registers(struct xhci_hcd *xhci) - { -- struct xhci_interrupter *ir = xhci->interrupter; -+ struct xhci_interrupter *ir; -+ unsigned int i; - - writel(xhci->s3.command, &xhci->op_regs->command); - writel(xhci->s3.dev_nt, &xhci->op_regs->dev_notification); - xhci_write_64(xhci, xhci->s3.dcbaa_ptr, &xhci->op_regs->dcbaa_ptr); - writel(xhci->s3.config_reg, &xhci->op_regs->config_reg); -- writel(ir->s3_erst_size, &ir->ir_set->erst_size); -- xhci_write_64(xhci, ir->s3_erst_base, &ir->ir_set->erst_base); -- xhci_write_64(xhci, ir->s3_erst_dequeue, &ir->ir_set->erst_dequeue); -- writel(ir->s3_irq_pending, &ir->ir_set->irq_pending); -- writel(ir->s3_irq_control, &ir->ir_set->irq_control); -+ -+ /* FIXME should we lock to protect against freeing of interrupters */ -+ for (i = 0; i < xhci->max_interrupters; i++) { -+ ir = xhci->interrupters[i]; -+ if (!ir) -+ continue; -+ -+ writel(ir->s3_erst_size, &ir->ir_set->erst_size); -+ xhci_write_64(xhci, ir->s3_erst_base, &ir->ir_set->erst_base); -+ xhci_write_64(xhci, ir->s3_erst_dequeue, &ir->ir_set->erst_dequeue); -+ writel(ir->s3_irq_pending, &ir->ir_set->irq_pending); -+ writel(ir->s3_irq_control, &ir->ir_set->irq_control); -+ } - } - - static void xhci_set_cmd_ring_deq(struct xhci_hcd *xhci) -@@ -1061,7 +1087,7 @@ int xhci_resume(struct xhci_hcd *xhci, pm_message_t msg) - xhci_dbg(xhci, "// Disabling event ring interrupts\n"); - temp = readl(&xhci->op_regs->status); - writel((temp & ~0x1fff) | STS_EINT, &xhci->op_regs->status); -- xhci_disable_interrupter(xhci->interrupter); -+ xhci_disable_interrupter(xhci->interrupters[0]); - - xhci_dbg(xhci, "cleaning up memory\n"); - xhci_mem_cleanup(xhci); -diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h -index df87e8bcb7d246..74bdd035d756a4 100644 ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -1293,6 +1293,7 @@ struct xhci_segment { - union xhci_trb *trbs; - /* private to HCD */ - struct xhci_segment *next; -+ unsigned int num; - dma_addr_t dma; - /* Max packet sized bounce buffer for td-fragmant alignment */ - dma_addr_t bounce_dma; -@@ -1422,12 +1423,8 @@ struct urb_priv { - struct xhci_td td[]; - }; - --/* -- * Each segment table entry is 4*32bits long. 1K seems like an ok size: -- * (1K bytes * 8bytes/bit) / (4*32 bits) = 64 segment entries in the table, -- * meaning 64 ring segments. -- * Initial allocated size of the ERST, in number of entries */ --#define ERST_NUM_SEGS 1 -+/* Number of Event Ring segments to allocate, when amount is not specified. (spec allows 32k) */ -+#define ERST_DEFAULT_SEGS 2 - /* Poll every 60 seconds */ - #define POLL_TIMEOUT 60 - /* Stop endpoint command timeout (secs) for URB cancellation watchdog timer */ -@@ -1552,7 +1549,7 @@ struct xhci_hcd { - struct reset_control *reset; - /* data structures */ - struct xhci_device_context_array *dcbaa; -- struct xhci_interrupter *interrupter; -+ struct xhci_interrupter **interrupters; - struct xhci_ring *cmd_ring; - unsigned int cmd_ring_state; - #define CMD_RING_STATE_RUNNING (1 << 0) -@@ -1869,6 +1866,11 @@ struct xhci_container_ctx *xhci_alloc_container_ctx(struct xhci_hcd *xhci, - int type, gfp_t flags); - void xhci_free_container_ctx(struct xhci_hcd *xhci, - struct xhci_container_ctx *ctx); -+struct xhci_interrupter * -+xhci_create_secondary_interrupter(struct usb_hcd *hcd, unsigned int segs, -+ u32 imod_interval); -+void xhci_remove_secondary_interrupter(struct usb_hcd -+ *hcd, struct xhci_interrupter *ir); - - /* xHCI host controller glue */ - typedef void (*xhci_get_quirks_t)(struct device *, struct xhci_hcd *); -@@ -1904,6 +1906,10 @@ int xhci_alloc_tt_info(struct xhci_hcd *xhci, - struct xhci_virt_device *virt_dev, - struct usb_device *hdev, - struct usb_tt *tt, gfp_t mem_flags); -+int xhci_set_interrupter_moderation(struct xhci_interrupter *ir, -+ u32 imod_interval); -+int xhci_enable_interrupter(struct xhci_interrupter *ir); -+int xhci_disable_interrupter(struct xhci_interrupter *ir); - - /* xHCI ring, segment, TRB, and TD functions */ - dma_addr_t xhci_trb_virt_to_dma(struct xhci_segment *seg, union xhci_trb *trb); -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 11c4d69177f0ca..48d2579236729d 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -2058,12 +2058,13 @@ static noinline int run_delalloc_nocow(struct btrfs_inode *inode, - - /* - * If the found extent starts after requested offset, then -- * adjust extent_end to be right before this extent begins -+ * adjust cur_offset to be right before this extent begins. - */ - if (found_key.offset > cur_offset) { -- extent_end = found_key.offset; -- extent_type = 0; -- goto must_cow; -+ if (cow_start == (u64)-1) -+ cow_start = cur_offset; -+ cur_offset = found_key.offset; -+ goto next_slot; - } - - /* -diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c -index 0af3535e08f308..4536b6fcfa0256 100644 ---- a/fs/smb/client/smb2pdu.c -+++ b/fs/smb/client/smb2pdu.c -@@ -2932,6 +2932,7 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, - req->CreateContextsOffset = cpu_to_le32( - sizeof(struct smb2_create_req) + - iov[1].iov_len); -+ le32_add_cpu(&req->CreateContextsLength, iov[n_iov-1].iov_len); - pc_buf = iov[n_iov-1].iov_base; - } - -diff --git a/fs/smb/server/auth.c b/fs/smb/server/auth.c -index 5345d2417c7fc9..f4b20b80af0620 100644 ---- a/fs/smb/server/auth.c -+++ b/fs/smb/server/auth.c -@@ -546,7 +546,19 @@ int ksmbd_krb5_authenticate(struct ksmbd_session *sess, char *in_blob, - retval = -ENOMEM; - goto out; - } -- sess->user = user; -+ -+ if (!sess->user) { -+ /* First successful authentication */ -+ sess->user = user; -+ } else { -+ if (!ksmbd_compare_user(sess->user, user)) { -+ ksmbd_debug(AUTH, "different user tried to reuse session\n"); -+ retval = -EPERM; -+ ksmbd_free_user(user); -+ goto out; -+ } -+ ksmbd_free_user(user); -+ } - - memcpy(sess->sess_key, resp->payload, resp->session_key_len); - memcpy(out_blob, resp->payload + resp->session_key_len, -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index d41d67ec5ee51a..13750a5e5ba02e 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -1599,11 +1599,6 @@ static int krb5_authenticate(struct ksmbd_work *work, - if (prev_sess_id && prev_sess_id != sess->id) - destroy_previous_session(conn, sess->user, prev_sess_id); - -- if (sess->state == SMB2_SESSION_VALID) { -- ksmbd_free_user(sess->user); -- sess->user = NULL; -- } -- - retval = ksmbd_krb5_authenticate(sess, in_blob, in_len, - out_blob, &out_len); - if (retval) { -diff --git a/include/linux/bpf.h b/include/linux/bpf.h -index 035e627f94f62d..17de12a98f858a 100644 ---- a/include/linux/bpf.h -+++ b/include/linux/bpf.h -@@ -1430,6 +1430,7 @@ struct bpf_prog_aux { - bool sleepable; - bool tail_call_reachable; - bool xdp_has_frags; -+ bool changes_pkt_data; - /* BTF_KIND_FUNC_PROTO for valid attach_btf_id */ - const struct btf_type *attach_func_proto; - /* function name for valid attach_btf_id */ -diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h -index 92919d52f7e1b2..32e89758176be8 100644 ---- a/include/linux/bpf_verifier.h -+++ b/include/linux/bpf_verifier.h -@@ -573,6 +573,7 @@ struct bpf_subprog_info { - bool tail_call_reachable; - bool has_ld_abs; - bool is_async_cb; -+ bool changes_pkt_data; - }; - - struct bpf_verifier_env; -diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h -index 9ca4211c063f39..184a84dd467ec7 100644 ---- a/include/linux/cpufreq.h -+++ b/include/linux/cpufreq.h -@@ -787,8 +787,8 @@ int cpufreq_frequency_table_verify(struct cpufreq_policy_data *policy, - int cpufreq_generic_frequency_table_verify(struct cpufreq_policy_data *policy); - - int cpufreq_table_index_unsorted(struct cpufreq_policy *policy, -- unsigned int target_freq, -- unsigned int relation); -+ unsigned int target_freq, unsigned int min, -+ unsigned int max, unsigned int relation); - int cpufreq_frequency_table_get_index(struct cpufreq_policy *policy, - unsigned int freq); - -@@ -853,12 +853,12 @@ static inline int cpufreq_table_find_index_dl(struct cpufreq_policy *policy, - return best; - } - --/* Works only on sorted freq-tables */ --static inline int cpufreq_table_find_index_l(struct cpufreq_policy *policy, -- unsigned int target_freq, -- bool efficiencies) -+static inline int find_index_l(struct cpufreq_policy *policy, -+ unsigned int target_freq, -+ unsigned int min, unsigned int max, -+ bool efficiencies) - { -- target_freq = clamp_val(target_freq, policy->min, policy->max); -+ target_freq = clamp_val(target_freq, min, max); - - if (policy->freq_table_sorted == CPUFREQ_TABLE_SORTED_ASCENDING) - return cpufreq_table_find_index_al(policy, target_freq, -@@ -868,6 +868,14 @@ static inline int cpufreq_table_find_index_l(struct cpufreq_policy *policy, - efficiencies); - } - -+/* Works only on sorted freq-tables */ -+static inline int cpufreq_table_find_index_l(struct cpufreq_policy *policy, -+ unsigned int target_freq, -+ bool efficiencies) -+{ -+ return find_index_l(policy, target_freq, policy->min, policy->max, efficiencies); -+} -+ - /* Find highest freq at or below target in a table in ascending order */ - static inline int cpufreq_table_find_index_ah(struct cpufreq_policy *policy, - unsigned int target_freq, -@@ -921,12 +929,12 @@ static inline int cpufreq_table_find_index_dh(struct cpufreq_policy *policy, - return best; - } - --/* Works only on sorted freq-tables */ --static inline int cpufreq_table_find_index_h(struct cpufreq_policy *policy, -- unsigned int target_freq, -- bool efficiencies) -+static inline int find_index_h(struct cpufreq_policy *policy, -+ unsigned int target_freq, -+ unsigned int min, unsigned int max, -+ bool efficiencies) - { -- target_freq = clamp_val(target_freq, policy->min, policy->max); -+ target_freq = clamp_val(target_freq, min, max); - - if (policy->freq_table_sorted == CPUFREQ_TABLE_SORTED_ASCENDING) - return cpufreq_table_find_index_ah(policy, target_freq, -@@ -936,6 +944,14 @@ static inline int cpufreq_table_find_index_h(struct cpufreq_policy *policy, - efficiencies); - } - -+/* Works only on sorted freq-tables */ -+static inline int cpufreq_table_find_index_h(struct cpufreq_policy *policy, -+ unsigned int target_freq, -+ bool efficiencies) -+{ -+ return find_index_h(policy, target_freq, policy->min, policy->max, efficiencies); -+} -+ - /* Find closest freq to target in a table in ascending order */ - static inline int cpufreq_table_find_index_ac(struct cpufreq_policy *policy, - unsigned int target_freq, -@@ -1006,12 +1022,12 @@ static inline int cpufreq_table_find_index_dc(struct cpufreq_policy *policy, - return best; - } - --/* Works only on sorted freq-tables */ --static inline int cpufreq_table_find_index_c(struct cpufreq_policy *policy, -- unsigned int target_freq, -- bool efficiencies) -+static inline int find_index_c(struct cpufreq_policy *policy, -+ unsigned int target_freq, -+ unsigned int min, unsigned int max, -+ bool efficiencies) - { -- target_freq = clamp_val(target_freq, policy->min, policy->max); -+ target_freq = clamp_val(target_freq, min, max); - - if (policy->freq_table_sorted == CPUFREQ_TABLE_SORTED_ASCENDING) - return cpufreq_table_find_index_ac(policy, target_freq, -@@ -1021,7 +1037,17 @@ static inline int cpufreq_table_find_index_c(struct cpufreq_policy *policy, - efficiencies); - } - --static inline bool cpufreq_is_in_limits(struct cpufreq_policy *policy, int idx) -+/* Works only on sorted freq-tables */ -+static inline int cpufreq_table_find_index_c(struct cpufreq_policy *policy, -+ unsigned int target_freq, -+ bool efficiencies) -+{ -+ return find_index_c(policy, target_freq, policy->min, policy->max, efficiencies); -+} -+ -+static inline bool cpufreq_is_in_limits(struct cpufreq_policy *policy, -+ unsigned int min, unsigned int max, -+ int idx) - { - unsigned int freq; - -@@ -1030,11 +1056,13 @@ static inline bool cpufreq_is_in_limits(struct cpufreq_policy *policy, int idx) - - freq = policy->freq_table[idx].frequency; - -- return freq == clamp_val(freq, policy->min, policy->max); -+ return freq == clamp_val(freq, min, max); - } - - static inline int cpufreq_frequency_table_target(struct cpufreq_policy *policy, - unsigned int target_freq, -+ unsigned int min, -+ unsigned int max, - unsigned int relation) - { - bool efficiencies = policy->efficiencies_available && -@@ -1045,29 +1073,26 @@ static inline int cpufreq_frequency_table_target(struct cpufreq_policy *policy, - relation &= ~CPUFREQ_RELATION_E; - - if (unlikely(policy->freq_table_sorted == CPUFREQ_TABLE_UNSORTED)) -- return cpufreq_table_index_unsorted(policy, target_freq, -- relation); -+ return cpufreq_table_index_unsorted(policy, target_freq, min, -+ max, relation); - retry: - switch (relation) { - case CPUFREQ_RELATION_L: -- idx = cpufreq_table_find_index_l(policy, target_freq, -- efficiencies); -+ idx = find_index_l(policy, target_freq, min, max, efficiencies); - break; - case CPUFREQ_RELATION_H: -- idx = cpufreq_table_find_index_h(policy, target_freq, -- efficiencies); -+ idx = find_index_h(policy, target_freq, min, max, efficiencies); - break; - case CPUFREQ_RELATION_C: -- idx = cpufreq_table_find_index_c(policy, target_freq, -- efficiencies); -+ idx = find_index_c(policy, target_freq, min, max, efficiencies); - break; - default: - WARN_ON_ONCE(1); - return 0; - } - -- /* Limit frequency index to honor policy->min/max */ -- if (!cpufreq_is_in_limits(policy, idx) && efficiencies) { -+ /* Limit frequency index to honor min and max */ -+ if (!cpufreq_is_in_limits(policy, min, max, idx) && efficiencies) { - efficiencies = false; - goto retry; - } -diff --git a/include/linux/filter.h b/include/linux/filter.h -index 5090e940ba3e46..adf65eacade062 100644 ---- a/include/linux/filter.h -+++ b/include/linux/filter.h -@@ -915,7 +915,7 @@ bool bpf_jit_needs_zext(void); - bool bpf_jit_supports_subprog_tailcalls(void); - bool bpf_jit_supports_kfunc_call(void); - bool bpf_jit_supports_far_kfunc_call(void); --bool bpf_helper_changes_pkt_data(void *func); -+bool bpf_helper_changes_pkt_data(enum bpf_func_id func_id); - - static inline bool bpf_dump_raw_ok(const struct cred *cred) - { -diff --git a/include/linux/module.h b/include/linux/module.h -index a98e188cf37b81..f2a8624eef1eca 100644 ---- a/include/linux/module.h -+++ b/include/linux/module.h -@@ -162,6 +162,8 @@ extern void cleanup_module(void); - #define __INITRODATA_OR_MODULE __INITRODATA - #endif /*CONFIG_MODULES*/ - -+struct module_kobject *lookup_or_create_module_kobject(const char *name); -+ - /* Generic info of form tag = "info" */ - #define MODULE_INFO(tag, info) __MODULE_INFO(tag, tag, info) - -diff --git a/include/linux/pds/pds_core_if.h b/include/linux/pds/pds_core_if.h -index e838a2b90440ca..17a87c1a55d7c7 100644 ---- a/include/linux/pds/pds_core_if.h -+++ b/include/linux/pds/pds_core_if.h -@@ -79,6 +79,7 @@ enum pds_core_status_code { - PDS_RC_EVFID = 31, /* VF ID does not exist */ - PDS_RC_BAD_FW = 32, /* FW file is invalid or corrupted */ - PDS_RC_ECLIENT = 33, /* No such client id */ -+ PDS_RC_BAD_PCI = 255, /* Broken PCI when reading status */ - }; - - /** -diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h -index 5f11f987334190..f7d392d849be56 100644 ---- a/include/linux/skbuff.h -+++ b/include/linux/skbuff.h -@@ -685,6 +685,11 @@ typedef unsigned int sk_buff_data_t; - typedef unsigned char *sk_buff_data_t; - #endif - -+enum skb_tstamp_type { -+ SKB_CLOCK_REALTIME, -+ SKB_CLOCK_MONOTONIC, -+}; -+ - /** - * DOC: Basic sk_buff geometry - * -@@ -804,10 +809,8 @@ typedef unsigned char *sk_buff_data_t; - * @dst_pending_confirm: need to confirm neighbour - * @decrypted: Decrypted SKB - * @slow_gro: state present at GRO time, slower prepare step required -- * @mono_delivery_time: When set, skb->tstamp has the -- * delivery_time in mono clock base (i.e. EDT). Otherwise, the -- * skb->tstamp has the (rcv) timestamp at ingress and -- * delivery_time at egress. -+ * @tstamp_type: When set, skb->tstamp has the -+ * delivery_time clock base of skb->tstamp. - * @napi_id: id of the NAPI struct this skb came from - * @sender_cpu: (aka @napi_id) source CPU in XPS - * @alloc_cpu: CPU which did the skb allocation. -@@ -935,7 +938,7 @@ struct sk_buff { - /* private: */ - __u8 __mono_tc_offset[0]; - /* public: */ -- __u8 mono_delivery_time:1; /* See SKB_MONO_DELIVERY_TIME_MASK */ -+ __u8 tstamp_type:1; /* See skb_tstamp_type */ - #ifdef CONFIG_NET_XGRESS - __u8 tc_at_ingress:1; /* See TC_AT_INGRESS_MASK */ - __u8 tc_skip_classify:1; -@@ -4189,7 +4192,7 @@ static inline void skb_get_new_timestampns(const struct sk_buff *skb, - static inline void __net_timestamp(struct sk_buff *skb) - { - skb->tstamp = ktime_get_real(); -- skb->mono_delivery_time = 0; -+ skb->tstamp_type = SKB_CLOCK_REALTIME; - } - - static inline ktime_t net_timedelta(ktime_t t) -@@ -4198,10 +4201,33 @@ static inline ktime_t net_timedelta(ktime_t t) - } - - static inline void skb_set_delivery_time(struct sk_buff *skb, ktime_t kt, -- bool mono) -+ u8 tstamp_type) - { - skb->tstamp = kt; -- skb->mono_delivery_time = kt && mono; -+ -+ if (kt) -+ skb->tstamp_type = tstamp_type; -+ else -+ skb->tstamp_type = SKB_CLOCK_REALTIME; -+} -+ -+static inline void skb_set_delivery_type_by_clockid(struct sk_buff *skb, -+ ktime_t kt, clockid_t clockid) -+{ -+ u8 tstamp_type = SKB_CLOCK_REALTIME; -+ -+ switch (clockid) { -+ case CLOCK_REALTIME: -+ break; -+ case CLOCK_MONOTONIC: -+ tstamp_type = SKB_CLOCK_MONOTONIC; -+ break; -+ default: -+ WARN_ON_ONCE(1); -+ kt = 0; -+ } -+ -+ skb_set_delivery_time(skb, kt, tstamp_type); - } - - DECLARE_STATIC_KEY_FALSE(netstamp_needed_key); -@@ -4211,8 +4237,8 @@ DECLARE_STATIC_KEY_FALSE(netstamp_needed_key); - */ - static inline void skb_clear_delivery_time(struct sk_buff *skb) - { -- if (skb->mono_delivery_time) { -- skb->mono_delivery_time = 0; -+ if (skb->tstamp_type) { -+ skb->tstamp_type = SKB_CLOCK_REALTIME; - if (static_branch_unlikely(&netstamp_needed_key)) - skb->tstamp = ktime_get_real(); - else -@@ -4222,7 +4248,7 @@ static inline void skb_clear_delivery_time(struct sk_buff *skb) - - static inline void skb_clear_tstamp(struct sk_buff *skb) - { -- if (skb->mono_delivery_time) -+ if (skb->tstamp_type) - return; - - skb->tstamp = 0; -@@ -4230,7 +4256,7 @@ static inline void skb_clear_tstamp(struct sk_buff *skb) - - static inline ktime_t skb_tstamp(const struct sk_buff *skb) - { -- if (skb->mono_delivery_time) -+ if (skb->tstamp_type) - return 0; - - return skb->tstamp; -@@ -4238,7 +4264,7 @@ static inline ktime_t skb_tstamp(const struct sk_buff *skb) - - static inline ktime_t skb_tstamp_cond(const struct sk_buff *skb, bool cond) - { -- if (!skb->mono_delivery_time && skb->tstamp) -+ if (skb->tstamp_type != SKB_CLOCK_MONOTONIC && skb->tstamp) - return skb->tstamp; - - if (static_branch_unlikely(&netstamp_needed_key) || cond) -diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h -index 153960663ce4c2..5af6eb14c5db15 100644 ---- a/include/net/inet_frag.h -+++ b/include/net/inet_frag.h -@@ -76,7 +76,7 @@ struct frag_v6_compare_key { - * @stamp: timestamp of the last received fragment - * @len: total length of the original datagram - * @meat: length of received fragments so far -- * @mono_delivery_time: stamp has a mono delivery time (EDT) -+ * @tstamp_type: stamp has a mono delivery time (EDT) - * @flags: fragment queue flags - * @max_size: maximum received fragment size - * @fqdir: pointer to struct fqdir -@@ -97,7 +97,7 @@ struct inet_frag_queue { - ktime_t stamp; - int len; - int meat; -- u8 mono_delivery_time; -+ u8 tstamp_type; - __u8 flags; - u16 max_size; - struct fqdir *fqdir; -diff --git a/include/soc/mscc/ocelot_vcap.h b/include/soc/mscc/ocelot_vcap.h -index c601a4598b0da8..eb19668a06db17 100644 ---- a/include/soc/mscc/ocelot_vcap.h -+++ b/include/soc/mscc/ocelot_vcap.h -@@ -13,6 +13,7 @@ - */ - #define OCELOT_VCAP_ES0_TAG_8021Q_RXVLAN(ocelot, port, upstream) ((upstream) << 16 | (port)) - #define OCELOT_VCAP_IS1_TAG_8021Q_TXVLAN(ocelot, port) (port) -+#define OCELOT_VCAP_IS1_VLAN_RECLASSIFY(ocelot, port) ((ocelot)->num_phys_ports + (port)) - #define OCELOT_VCAP_IS2_TAG_8021Q_TXVLAN(ocelot, port) (port) - #define OCELOT_VCAP_IS2_MRP_REDIRECT(ocelot, port) ((ocelot)->num_phys_ports + (port)) - #define OCELOT_VCAP_IS2_MRP_TRAP(ocelot) ((ocelot)->num_phys_ports * 2) -@@ -499,6 +500,7 @@ struct ocelot_vcap_key_vlan { - struct ocelot_vcap_u8 pcp; /* PCP (3 bit) */ - enum ocelot_vcap_bit dei; /* DEI */ - enum ocelot_vcap_bit tagged; /* Tagged/untagged frame */ -+ enum ocelot_vcap_bit tpid; - }; - - struct ocelot_vcap_key_etype { -diff --git a/include/sound/ump_convert.h b/include/sound/ump_convert.h -index d099ae27f8491a..682499b871eac4 100644 ---- a/include/sound/ump_convert.h -+++ b/include/sound/ump_convert.h -@@ -19,7 +19,7 @@ struct ump_cvt_to_ump_bank { - /* context for converting from MIDI1 byte stream to UMP packet */ - struct ump_cvt_to_ump { - /* MIDI1 intermediate buffer */ -- unsigned char buf[4]; -+ unsigned char buf[6]; /* up to 6 bytes for SysEx */ - int len; - int cmd_bytes; - -diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c -index 02f327f05fd619..81fd1bb9941644 100644 ---- a/kernel/bpf/core.c -+++ b/kernel/bpf/core.c -@@ -2893,7 +2893,7 @@ void __weak bpf_jit_compile(struct bpf_prog *prog) - { - } - --bool __weak bpf_helper_changes_pkt_data(void *func) -+bool __weak bpf_helper_changes_pkt_data(enum bpf_func_id func_id) - { - return false; - } -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index e443506b0a65a1..756e179a1efe3e 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -2636,16 +2636,36 @@ static int cmp_subprogs(const void *a, const void *b) - ((struct bpf_subprog_info *)b)->start; - } - -+/* Find subprogram that contains instruction at 'off' */ -+static struct bpf_subprog_info *find_containing_subprog(struct bpf_verifier_env *env, int off) -+{ -+ struct bpf_subprog_info *vals = env->subprog_info; -+ int l, r, m; -+ -+ if (off >= env->prog->len || off < 0 || env->subprog_cnt == 0) -+ return NULL; -+ -+ l = 0; -+ r = env->subprog_cnt - 1; -+ while (l < r) { -+ m = l + (r - l + 1) / 2; -+ if (vals[m].start <= off) -+ l = m; -+ else -+ r = m - 1; -+ } -+ return &vals[l]; -+} -+ -+/* Find subprogram that starts exactly at 'off' */ - static int find_subprog(struct bpf_verifier_env *env, int off) - { - struct bpf_subprog_info *p; - -- p = bsearch(&off, env->subprog_info, env->subprog_cnt, -- sizeof(env->subprog_info[0]), cmp_subprogs); -- if (!p) -+ p = find_containing_subprog(env, off); -+ if (!p || p->start != off) - return -ENOENT; - return p - env->subprog_info; -- - } - - static int add_subprog(struct bpf_verifier_env *env, int off) -@@ -9344,6 +9364,8 @@ static int check_func_call(struct bpf_verifier_env *env, struct bpf_insn *insn, - - if (env->log.level & BPF_LOG_LEVEL) - verbose(env, "Func#%d is global and valid. Skipping.\n", subprog); -+ if (env->subprog_info[subprog].changes_pkt_data) -+ clear_all_pkt_pointers(env); - clear_caller_saved_regs(env, caller->regs); - - /* All global functions return a 64-bit SCALAR_VALUE */ -@@ -9987,7 +10009,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn - } - - /* With LD_ABS/IND some JITs save/restore skb from r1. */ -- changes_data = bpf_helper_changes_pkt_data(fn->func); -+ changes_data = bpf_helper_changes_pkt_data(func_id); - if (changes_data && fn->arg1_type != ARG_PTR_TO_CTX) { - verbose(env, "kernel subsystem misconfigured func %s#%d: r1 != ctx\n", - func_id_name(func_id), func_id); -@@ -15094,6 +15116,29 @@ static int check_return_code(struct bpf_verifier_env *env) - return 0; - } - -+static void mark_subprog_changes_pkt_data(struct bpf_verifier_env *env, int off) -+{ -+ struct bpf_subprog_info *subprog; -+ -+ subprog = find_containing_subprog(env, off); -+ subprog->changes_pkt_data = true; -+} -+ -+/* 't' is an index of a call-site. -+ * 'w' is a callee entry point. -+ * Eventually this function would be called when env->cfg.insn_state[w] == EXPLORED. -+ * Rely on DFS traversal order and absence of recursive calls to guarantee that -+ * callee's change_pkt_data marks would be correct at that moment. -+ */ -+static void merge_callee_effects(struct bpf_verifier_env *env, int t, int w) -+{ -+ struct bpf_subprog_info *caller, *callee; -+ -+ caller = find_containing_subprog(env, t); -+ callee = find_containing_subprog(env, w); -+ caller->changes_pkt_data |= callee->changes_pkt_data; -+} -+ - /* non-recursive DFS pseudo code - * 1 procedure DFS-iterative(G,v): - * 2 label v as discovered -@@ -15227,6 +15272,7 @@ static int visit_func_call_insn(int t, struct bpf_insn *insns, - bool visit_callee) - { - int ret, insn_sz; -+ int w; - - insn_sz = bpf_is_ldimm64(&insns[t]) ? 2 : 1; - ret = push_insn(t, t + insn_sz, FALLTHROUGH, env); -@@ -15238,8 +15284,10 @@ static int visit_func_call_insn(int t, struct bpf_insn *insns, - mark_jmp_point(env, t + insn_sz); - - if (visit_callee) { -+ w = t + insns[t].imm + 1; - mark_prune_point(env, t); -- ret = push_insn(t, t + insns[t].imm + 1, BRANCH, env); -+ merge_callee_effects(env, t, w); -+ ret = push_insn(t, w, BRANCH, env); - } - return ret; - } -@@ -15291,6 +15339,8 @@ static int visit_insn(int t, struct bpf_verifier_env *env) - mark_prune_point(env, t); - mark_jmp_point(env, t); - } -+ if (bpf_helper_call(insn) && bpf_helper_changes_pkt_data(insn->imm)) -+ mark_subprog_changes_pkt_data(env, t); - if (insn->src_reg == BPF_PSEUDO_KFUNC_CALL) { - struct bpf_kfunc_call_arg_meta meta; - -@@ -15412,6 +15462,7 @@ static int check_cfg(struct bpf_verifier_env *env) - } - } - ret = 0; /* cfg looks good */ -+ env->prog->aux->changes_pkt_data = env->subprog_info[0].changes_pkt_data; - - err_free: - kvfree(insn_state); -@@ -18572,6 +18623,7 @@ static int jit_subprogs(struct bpf_verifier_env *env) - } - func[i]->aux->num_exentries = num_exentries; - func[i]->aux->tail_call_reachable = env->subprog_info[i].tail_call_reachable; -+ func[i]->aux->changes_pkt_data = env->subprog_info[i].changes_pkt_data; - func[i] = bpf_int_jit_compile(func[i]); - if (!func[i]->jited) { - err = -ENOTSUPP; -@@ -19856,6 +19908,7 @@ int bpf_check_attach_target(struct bpf_verifier_log *log, - } - if (tgt_prog) { - struct bpf_prog_aux *aux = tgt_prog->aux; -+ bool tgt_changes_pkt_data; - - if (bpf_prog_is_dev_bound(prog->aux) && - !bpf_prog_dev_bound_match(prog, tgt_prog)) { -@@ -19884,6 +19937,14 @@ int bpf_check_attach_target(struct bpf_verifier_log *log, - "Extension programs should be JITed\n"); - return -EINVAL; - } -+ tgt_changes_pkt_data = aux->func -+ ? aux->func[subprog]->aux->changes_pkt_data -+ : aux->changes_pkt_data; -+ if (prog->aux->changes_pkt_data && !tgt_changes_pkt_data) { -+ bpf_log(log, -+ "Extension program changes packet data, while original does not\n"); -+ return -EINVAL; -+ } - } - if (!tgt_prog->jited) { - bpf_log(log, "Can attach to only JITed progs\n"); -@@ -20343,10 +20404,6 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr, __u3 - if (ret < 0) - goto skip_full_check; - -- ret = check_attach_btf_id(env); -- if (ret) -- goto skip_full_check; -- - ret = resolve_pseudo_ldimm64(env); - if (ret < 0) - goto skip_full_check; -@@ -20361,6 +20418,10 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr, __u3 - if (ret < 0) - goto skip_full_check; - -+ ret = check_attach_btf_id(env); -+ if (ret) -+ goto skip_full_check; -+ - ret = do_check_subprogs(env); - ret = ret ?: do_check_main(env); - -diff --git a/kernel/params.c b/kernel/params.c -index 2d4a0564697e83..c7aed3c51cd538 100644 ---- a/kernel/params.c -+++ b/kernel/params.c -@@ -759,7 +759,7 @@ void destroy_params(const struct kernel_param *params, unsigned num) - params[i].ops->free(params[i].arg); - } - --static struct module_kobject * __init locate_module_kobject(const char *name) -+struct module_kobject __modinit * lookup_or_create_module_kobject(const char *name) - { - struct module_kobject *mk; - struct kobject *kobj; -@@ -801,7 +801,7 @@ static void __init kernel_add_sysfs_param(const char *name, - struct module_kobject *mk; - int err; - -- mk = locate_module_kobject(name); -+ mk = lookup_or_create_module_kobject(name); - if (!mk) - return; - -@@ -872,7 +872,7 @@ static void __init version_sysfs_builtin(void) - int err; - - for (vattr = __start___modver; vattr < __stop___modver; vattr++) { -- mk = locate_module_kobject(vattr->module_name); -+ mk = lookup_or_create_module_kobject(vattr->module_name); - if (mk) { - err = sysfs_create_file(&mk->kobj, &vattr->mattr.attr); - WARN_ON_ONCE(err); -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index a41c99350a5bf7..95868c31573007 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -7027,13 +7027,14 @@ static ssize_t tracing_splice_read_pipe(struct file *filp, - /* Copy the data into the page, so we can start over. */ - ret = trace_seq_to_buffer(&iter->seq, - page_address(spd.pages[i]), -- trace_seq_used(&iter->seq)); -+ min((size_t)trace_seq_used(&iter->seq), -+ PAGE_SIZE)); - if (ret < 0) { - __free_page(spd.pages[i]); - break; - } - spd.partial[i].offset = 0; -- spd.partial[i].len = trace_seq_used(&iter->seq); -+ spd.partial[i].len = ret; - - trace_seq_init(&iter->seq); - } -diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c -index 2b948d35fb59ea..448ee37ae2450a 100644 ---- a/kernel/trace/trace_output.c -+++ b/kernel/trace/trace_output.c -@@ -950,11 +950,12 @@ enum print_line_t print_event_fields(struct trace_iterator *iter, - struct trace_event_call *call; - struct list_head *head; - -+ lockdep_assert_held_read(&trace_event_sem); -+ - /* ftrace defined events have separate call structures */ - if (event->type <= __TRACE_LAST_TYPE) { - bool found = false; - -- down_read(&trace_event_sem); - list_for_each_entry(call, &ftrace_events, list) { - if (call->event.type == event->type) { - found = true; -@@ -964,7 +965,6 @@ enum print_line_t print_event_fields(struct trace_iterator *iter, - if (call->event.type > __TRACE_LAST_TYPE) - break; - } -- up_read(&trace_event_sem); - if (!found) { - trace_seq_printf(&iter->seq, "UNKNOWN TYPE %d\n", event->type); - goto out; -diff --git a/mm/memblock.c b/mm/memblock.c -index e8a2a1537d6a85..047dce35cf6e0e 100644 ---- a/mm/memblock.c -+++ b/mm/memblock.c -@@ -2122,11 +2122,14 @@ static void __init memmap_init_reserved_pages(void) - struct memblock_region *region; - phys_addr_t start, end; - int nid; -+ unsigned long max_reserved; - - /* - * set nid on all reserved pages and also treat struct - * pages for the NOMAP regions as PageReserved - */ -+repeat: -+ max_reserved = memblock.reserved.max; - for_each_mem_region(region) { - nid = memblock_get_region_node(region); - start = region->base; -@@ -2135,8 +2138,15 @@ static void __init memmap_init_reserved_pages(void) - if (memblock_is_nomap(region)) - reserve_bootmem_region(start, end, nid); - -- memblock_set_node(start, end, &memblock.reserved, nid); -+ memblock_set_node(start, region->size, &memblock.reserved, nid); - } -+ /* -+ * 'max' is changed means memblock.reserved has been doubled its -+ * array, which may result a new reserved region before current -+ * 'start'. Now we should repeat the procedure to set its node id. -+ */ -+ if (max_reserved != memblock.reserved.max) -+ goto repeat; - - /* initialize struct pages for the reserved regions */ - for_each_reserved_mem_region(region) { -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index d4dcdb2370cc98..72ee41b894a520 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -7386,6 +7386,9 @@ static int l2cap_recv_frag(struct l2cap_conn *conn, struct sk_buff *skb, - return -ENOMEM; - /* Init rx_len */ - conn->rx_len = len; -+ -+ skb_set_delivery_time(conn->rx_skb, skb->tstamp, -+ skb->tstamp_type); - } - - /* Copy as much as the rx_skb can hold */ -diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c -index 6ef04f9fe481be..4fbfbafdfa0274 100644 ---- a/net/bridge/netfilter/nf_conntrack_bridge.c -+++ b/net/bridge/netfilter/nf_conntrack_bridge.c -@@ -32,7 +32,7 @@ static int nf_br_ip_fragment(struct net *net, struct sock *sk, - struct sk_buff *)) - { - int frag_max_size = BR_INPUT_SKB_CB(skb)->frag_max_size; -- bool mono_delivery_time = skb->mono_delivery_time; -+ u8 tstamp_type = skb->tstamp_type; - unsigned int hlen, ll_rs, mtu; - ktime_t tstamp = skb->tstamp; - struct ip_frag_state state; -@@ -82,7 +82,7 @@ static int nf_br_ip_fragment(struct net *net, struct sock *sk, - if (iter.frag) - ip_fraglist_prepare(skb, &iter); - -- skb_set_delivery_time(skb, tstamp, mono_delivery_time); -+ skb_set_delivery_time(skb, tstamp, tstamp_type); - err = output(net, sk, data, skb); - if (err || !iter.frag) - break; -@@ -113,7 +113,7 @@ static int nf_br_ip_fragment(struct net *net, struct sock *sk, - goto blackhole; - } - -- skb_set_delivery_time(skb2, tstamp, mono_delivery_time); -+ skb_set_delivery_time(skb2, tstamp, tstamp_type); - err = output(net, sk, data, skb2); - if (err) - goto blackhole; -diff --git a/net/core/dev.c b/net/core/dev.c -index c31a7f7bedf3db..4006fd164b7bc7 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -2189,7 +2189,7 @@ EXPORT_SYMBOL(net_disable_timestamp); - static inline void net_timestamp_set(struct sk_buff *skb) - { - skb->tstamp = 0; -- skb->mono_delivery_time = 0; -+ skb->tstamp_type = SKB_CLOCK_REALTIME; - if (static_branch_unlikely(&netstamp_needed_key)) - skb->tstamp = ktime_get_real(); - } -diff --git a/net/core/filter.c b/net/core/filter.c -index 39eef3370d800e..066277b91a1be8 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -7734,13 +7734,13 @@ BPF_CALL_3(bpf_skb_set_tstamp, struct sk_buff *, skb, - if (!tstamp) - return -EINVAL; - skb->tstamp = tstamp; -- skb->mono_delivery_time = 1; -+ skb->tstamp_type = SKB_CLOCK_MONOTONIC; - break; - case BPF_SKB_TSTAMP_UNSPEC: - if (tstamp) - return -EINVAL; - skb->tstamp = 0; -- skb->mono_delivery_time = 0; -+ skb->tstamp_type = SKB_CLOCK_REALTIME; - break; - default: - return -EINVAL; -@@ -7868,42 +7868,37 @@ static const struct bpf_func_proto bpf_tcp_raw_check_syncookie_ipv6_proto = { - - #endif /* CONFIG_INET */ - --bool bpf_helper_changes_pkt_data(void *func) --{ -- if (func == bpf_skb_vlan_push || -- func == bpf_skb_vlan_pop || -- func == bpf_skb_store_bytes || -- func == bpf_skb_change_proto || -- func == bpf_skb_change_head || -- func == sk_skb_change_head || -- func == bpf_skb_change_tail || -- func == sk_skb_change_tail || -- func == bpf_skb_adjust_room || -- func == sk_skb_adjust_room || -- func == bpf_skb_pull_data || -- func == sk_skb_pull_data || -- func == bpf_clone_redirect || -- func == bpf_l3_csum_replace || -- func == bpf_l4_csum_replace || -- func == bpf_xdp_adjust_head || -- func == bpf_xdp_adjust_meta || -- func == bpf_msg_pull_data || -- func == bpf_msg_push_data || -- func == bpf_msg_pop_data || -- func == bpf_xdp_adjust_tail || --#if IS_ENABLED(CONFIG_IPV6_SEG6_BPF) -- func == bpf_lwt_seg6_store_bytes || -- func == bpf_lwt_seg6_adjust_srh || -- func == bpf_lwt_seg6_action || --#endif --#ifdef CONFIG_INET -- func == bpf_sock_ops_store_hdr_opt || --#endif -- func == bpf_lwt_in_push_encap || -- func == bpf_lwt_xmit_push_encap) -+bool bpf_helper_changes_pkt_data(enum bpf_func_id func_id) -+{ -+ switch (func_id) { -+ case BPF_FUNC_clone_redirect: -+ case BPF_FUNC_l3_csum_replace: -+ case BPF_FUNC_l4_csum_replace: -+ case BPF_FUNC_lwt_push_encap: -+ case BPF_FUNC_lwt_seg6_action: -+ case BPF_FUNC_lwt_seg6_adjust_srh: -+ case BPF_FUNC_lwt_seg6_store_bytes: -+ case BPF_FUNC_msg_pop_data: -+ case BPF_FUNC_msg_pull_data: -+ case BPF_FUNC_msg_push_data: -+ case BPF_FUNC_skb_adjust_room: -+ case BPF_FUNC_skb_change_head: -+ case BPF_FUNC_skb_change_proto: -+ case BPF_FUNC_skb_change_tail: -+ case BPF_FUNC_skb_pull_data: -+ case BPF_FUNC_skb_store_bytes: -+ case BPF_FUNC_skb_vlan_pop: -+ case BPF_FUNC_skb_vlan_push: -+ case BPF_FUNC_store_hdr_opt: -+ case BPF_FUNC_xdp_adjust_head: -+ case BPF_FUNC_xdp_adjust_meta: -+ case BPF_FUNC_xdp_adjust_tail: -+ /* tail-called program could call any of the above */ -+ case BPF_FUNC_tail_call: - return true; -- -- return false; -+ default: -+ return false; -+ } - } - - const struct bpf_func_proto bpf_event_output_data_proto __weak; -@@ -9443,7 +9438,7 @@ static struct bpf_insn *bpf_convert_tstamp_read(const struct bpf_prog *prog, - TC_AT_INGRESS_MASK | SKB_MONO_DELIVERY_TIME_MASK); - *insn++ = BPF_JMP32_IMM(BPF_JNE, tmp_reg, - TC_AT_INGRESS_MASK | SKB_MONO_DELIVERY_TIME_MASK, 2); -- /* skb->tc_at_ingress && skb->mono_delivery_time, -+ /* skb->tc_at_ingress && skb->tstamp_type, - * read 0 as the (rcv) timestamp. - */ - *insn++ = BPF_MOV64_IMM(value_reg, 0); -@@ -9468,7 +9463,7 @@ static struct bpf_insn *bpf_convert_tstamp_write(const struct bpf_prog *prog, - * the bpf prog is aware the tstamp could have delivery time. - * Thus, write skb->tstamp as is if tstamp_type_access is true. - * Otherwise, writing at ingress will have to clear the -- * mono_delivery_time bit also. -+ * skb->tstamp_type bit also. - */ - if (!prog->tstamp_type_access) { - __u8 tmp_reg = BPF_REG_AX; -@@ -9478,7 +9473,7 @@ static struct bpf_insn *bpf_convert_tstamp_write(const struct bpf_prog *prog, - *insn++ = BPF_JMP32_IMM(BPF_JSET, tmp_reg, TC_AT_INGRESS_MASK, 1); - /* goto */ - *insn++ = BPF_JMP_A(2); -- /* : mono_delivery_time */ -+ /* : skb->tstamp_type */ - *insn++ = BPF_ALU32_IMM(BPF_AND, tmp_reg, ~SKB_MONO_DELIVERY_TIME_MASK); - *insn++ = BPF_STX_MEM(BPF_B, skb_reg, tmp_reg, SKB_BF_MONO_TC_OFFSET); - } -diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c -index 6dd960ec558cf6..ba0455ad770193 100644 ---- a/net/ieee802154/6lowpan/reassembly.c -+++ b/net/ieee802154/6lowpan/reassembly.c -@@ -130,7 +130,7 @@ static int lowpan_frag_queue(struct lowpan_frag_queue *fq, - goto err; - - fq->q.stamp = skb->tstamp; -- fq->q.mono_delivery_time = skb->mono_delivery_time; -+ fq->q.tstamp_type = skb->tstamp_type; - if (frag_type == LOWPAN_DISPATCH_FRAG1) - fq->q.flags |= INET_FRAG_FIRST_IN; - -diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c -index c88c9034d63004..496308c0238485 100644 ---- a/net/ipv4/inet_fragment.c -+++ b/net/ipv4/inet_fragment.c -@@ -619,7 +619,7 @@ void inet_frag_reasm_finish(struct inet_frag_queue *q, struct sk_buff *head, - skb_mark_not_on_list(head); - head->prev = NULL; - head->tstamp = q->stamp; -- head->mono_delivery_time = q->mono_delivery_time; -+ head->tstamp_type = q->tstamp_type; - - if (sk) - refcount_add(sum_truesize - head_truesize, &sk->sk_wmem_alloc); -diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c -index 877d1e03150c77..484edc8513e4b7 100644 ---- a/net/ipv4/ip_fragment.c -+++ b/net/ipv4/ip_fragment.c -@@ -360,7 +360,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) - qp->iif = dev->ifindex; - - qp->q.stamp = skb->tstamp; -- qp->q.mono_delivery_time = skb->mono_delivery_time; -+ qp->q.tstamp_type = skb->tstamp_type; - qp->q.meat += skb->len; - qp->ecn |= ecn; - add_frag_mem_limit(qp->q.fqdir, skb->truesize); -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index 765bd3f2a84089..b8cfe6afc84b88 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -764,7 +764,7 @@ int ip_do_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, - { - struct iphdr *iph; - struct sk_buff *skb2; -- bool mono_delivery_time = skb->mono_delivery_time; -+ u8 tstamp_type = skb->tstamp_type; - struct rtable *rt = skb_rtable(skb); - unsigned int mtu, hlen, ll_rs; - struct ip_fraglist_iter iter; -@@ -856,7 +856,7 @@ int ip_do_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, - } - } - -- skb_set_delivery_time(skb, tstamp, mono_delivery_time); -+ skb_set_delivery_time(skb, tstamp, tstamp_type); - err = output(net, sk, skb); - - if (!err) -@@ -912,7 +912,7 @@ int ip_do_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, - /* - * Put this fragment into the sending queue. - */ -- skb_set_delivery_time(skb2, tstamp, mono_delivery_time); -+ skb_set_delivery_time(skb2, tstamp, tstamp_type); - err = output(net, sk, skb2); - if (err) - goto fail; -@@ -1648,7 +1648,8 @@ void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb, - arg->csumoffset) = csum_fold(csum_add(nskb->csum, - arg->csum)); - nskb->ip_summed = CHECKSUM_NONE; -- nskb->mono_delivery_time = !!transmit_time; -+ if (transmit_time) -+ nskb->tstamp_type = SKB_CLOCK_MONOTONIC; - if (txhash) - skb_set_hash(nskb, txhash, PKT_HASH_TYPE_L4); - ip_push_pending_frames(sk, &fl4); -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index 3771ed22c2f56f..560273e7f77365 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -1266,7 +1266,7 @@ static int __tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, - tp = tcp_sk(sk); - prior_wstamp = tp->tcp_wstamp_ns; - tp->tcp_wstamp_ns = max(tp->tcp_wstamp_ns, tp->tcp_clock_cache); -- skb_set_delivery_time(skb, tp->tcp_wstamp_ns, true); -+ skb_set_delivery_time(skb, tp->tcp_wstamp_ns, SKB_CLOCK_MONOTONIC); - if (clone_it) { - oskb = skb; - -@@ -1607,7 +1607,7 @@ int tcp_fragment(struct sock *sk, enum tcp_queue tcp_queue, - - skb_split(skb, buff, len); - -- skb_set_delivery_time(buff, skb->tstamp, true); -+ skb_set_delivery_time(buff, skb->tstamp, SKB_CLOCK_MONOTONIC); - tcp_fragment_tstamp(skb, buff); - - old_factor = tcp_skb_pcount(skb); -@@ -2703,7 +2703,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle, - if (unlikely(tp->repair) && tp->repair_queue == TCP_SEND_QUEUE) { - /* "skb_mstamp_ns" is used as a start point for the retransmit timer */ - tp->tcp_wstamp_ns = tp->tcp_clock_cache; -- skb_set_delivery_time(skb, tp->tcp_wstamp_ns, true); -+ skb_set_delivery_time(skb, tp->tcp_wstamp_ns, SKB_CLOCK_MONOTONIC); - list_move_tail(&skb->tcp_tsorted_anchor, &tp->tsorted_sent_queue); - tcp_init_tso_segs(skb, mss_now); - goto repair; /* Skip network transmission */ -@@ -3688,11 +3688,11 @@ struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst, - #ifdef CONFIG_SYN_COOKIES - if (unlikely(synack_type == TCP_SYNACK_COOKIE && ireq->tstamp_ok)) - skb_set_delivery_time(skb, cookie_init_timestamp(req, now), -- true); -+ SKB_CLOCK_MONOTONIC); - else - #endif - { -- skb_set_delivery_time(skb, now, true); -+ skb_set_delivery_time(skb, now, SKB_CLOCK_MONOTONIC); - if (!tcp_rsk(req)->snt_synack) /* Timestamp first SYNACK */ - tcp_rsk(req)->snt_synack = tcp_skb_timestamp_us(skb); - } -@@ -3741,7 +3741,7 @@ struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst, - bpf_skops_write_hdr_opt((struct sock *)sk, skb, req, syn_skb, - synack_type, &opts); - -- skb_set_delivery_time(skb, now, true); -+ skb_set_delivery_time(skb, now, SKB_CLOCK_MONOTONIC); - tcp_add_tx_delay(skb, tp); - - return skb; -@@ -3923,7 +3923,7 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) - - err = tcp_transmit_skb(sk, syn_data, 1, sk->sk_allocation); - -- skb_set_delivery_time(syn, syn_data->skb_mstamp_ns, true); -+ skb_set_delivery_time(syn, syn_data->skb_mstamp_ns, SKB_CLOCK_MONOTONIC); - - /* Now full SYN+DATA was cloned and sent (or not), - * remove the SYN from the original skb (syn_data) -diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c -index 2ab16139c197b3..132cfc3b2c847b 100644 ---- a/net/ipv4/udp_offload.c -+++ b/net/ipv4/udp_offload.c -@@ -247,6 +247,62 @@ static struct sk_buff *__udpv4_gso_segment_list_csum(struct sk_buff *segs) - return segs; - } - -+static void __udpv6_gso_segment_csum(struct sk_buff *seg, -+ struct in6_addr *oldip, -+ const struct in6_addr *newip, -+ __be16 *oldport, __be16 newport) -+{ -+ struct udphdr *uh = udp_hdr(seg); -+ -+ if (ipv6_addr_equal(oldip, newip) && *oldport == newport) -+ return; -+ -+ if (uh->check) { -+ inet_proto_csum_replace16(&uh->check, seg, oldip->s6_addr32, -+ newip->s6_addr32, true); -+ -+ inet_proto_csum_replace2(&uh->check, seg, *oldport, newport, -+ false); -+ if (!uh->check) -+ uh->check = CSUM_MANGLED_0; -+ } -+ -+ *oldip = *newip; -+ *oldport = newport; -+} -+ -+static struct sk_buff *__udpv6_gso_segment_list_csum(struct sk_buff *segs) -+{ -+ const struct ipv6hdr *iph; -+ const struct udphdr *uh; -+ struct ipv6hdr *iph2; -+ struct sk_buff *seg; -+ struct udphdr *uh2; -+ -+ seg = segs; -+ uh = udp_hdr(seg); -+ iph = ipv6_hdr(seg); -+ uh2 = udp_hdr(seg->next); -+ iph2 = ipv6_hdr(seg->next); -+ -+ if (!(*(const u32 *)&uh->source ^ *(const u32 *)&uh2->source) && -+ ipv6_addr_equal(&iph->saddr, &iph2->saddr) && -+ ipv6_addr_equal(&iph->daddr, &iph2->daddr)) -+ return segs; -+ -+ while ((seg = seg->next)) { -+ uh2 = udp_hdr(seg); -+ iph2 = ipv6_hdr(seg); -+ -+ __udpv6_gso_segment_csum(seg, &iph2->saddr, &iph->saddr, -+ &uh2->source, uh->source); -+ __udpv6_gso_segment_csum(seg, &iph2->daddr, &iph->daddr, -+ &uh2->dest, uh->dest); -+ } -+ -+ return segs; -+} -+ - static struct sk_buff *__udp_gso_segment_list(struct sk_buff *skb, - netdev_features_t features, - bool is_ipv6) -@@ -259,7 +315,10 @@ static struct sk_buff *__udp_gso_segment_list(struct sk_buff *skb, - - udp_hdr(skb)->len = htons(sizeof(struct udphdr) + mss); - -- return is_ipv6 ? skb : __udpv4_gso_segment_list_csum(skb); -+ if (is_ipv6) -+ return __udpv6_gso_segment_list_csum(skb); -+ else -+ return __udpv4_gso_segment_list_csum(skb); - } - - struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb, -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index cd89a2b35dfb56..c86d5dca29df01 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -864,7 +864,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, - struct rt6_info *rt = dst_rt6_info(skb_dst(skb)); - struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ? - inet6_sk(skb->sk) : NULL; -- bool mono_delivery_time = skb->mono_delivery_time; -+ u8 tstamp_type = skb->tstamp_type; - struct ip6_frag_state state; - unsigned int mtu, hlen, nexthdr_offset; - ktime_t tstamp = skb->tstamp; -@@ -958,7 +958,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, - if (iter.frag) - ip6_fraglist_prepare(skb, &iter); - -- skb_set_delivery_time(skb, tstamp, mono_delivery_time); -+ skb_set_delivery_time(skb, tstamp, tstamp_type); - err = output(net, sk, skb); - if (!err) - IP6_INC_STATS(net, ip6_dst_idev(&rt->dst), -@@ -1019,7 +1019,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, - /* - * Put this fragment into the sending queue. - */ -- skb_set_delivery_time(frag, tstamp, mono_delivery_time); -+ skb_set_delivery_time(frag, tstamp, tstamp_type); - err = output(net, sk, frag); - if (err) - goto fail; -diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c -index 857713d7a38a54..7c4af48d529e1e 100644 ---- a/net/ipv6/netfilter.c -+++ b/net/ipv6/netfilter.c -@@ -126,7 +126,7 @@ int br_ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, - struct sk_buff *)) - { - int frag_max_size = BR_INPUT_SKB_CB(skb)->frag_max_size; -- bool mono_delivery_time = skb->mono_delivery_time; -+ u8 tstamp_type = skb->tstamp_type; - ktime_t tstamp = skb->tstamp; - struct ip6_frag_state state; - u8 *prevhdr, nexthdr = 0; -@@ -192,7 +192,7 @@ int br_ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, - if (iter.frag) - ip6_fraglist_prepare(skb, &iter); - -- skb_set_delivery_time(skb, tstamp, mono_delivery_time); -+ skb_set_delivery_time(skb, tstamp, tstamp_type); - err = output(net, sk, data, skb); - if (err || !iter.frag) - break; -@@ -225,7 +225,7 @@ int br_ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, - goto blackhole; - } - -- skb_set_delivery_time(skb2, tstamp, mono_delivery_time); -+ skb_set_delivery_time(skb2, tstamp, tstamp_type); - err = output(net, sk, data, skb2); - if (err) - goto blackhole; -diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c -index c78b13ea5b196a..82e51b2ec4f512 100644 ---- a/net/ipv6/netfilter/nf_conntrack_reasm.c -+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c -@@ -268,7 +268,7 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb, - fq->iif = dev->ifindex; - - fq->q.stamp = skb->tstamp; -- fq->q.mono_delivery_time = skb->mono_delivery_time; -+ fq->q.tstamp_type = skb->tstamp_type; - fq->q.meat += skb->len; - fq->ecn |= ecn; - if (payload_len > fq->q.max_size) -diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c -index 2af98edef87ee0..cb219d4bdf25ed 100644 ---- a/net/ipv6/reassembly.c -+++ b/net/ipv6/reassembly.c -@@ -198,7 +198,7 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb, - fq->iif = dev->ifindex; - - fq->q.stamp = skb->tstamp; -- fq->q.mono_delivery_time = skb->mono_delivery_time; -+ fq->q.tstamp_type = skb->tstamp_type; - fq->q.meat += skb->len; - fq->ecn |= ecn; - add_frag_mem_limit(fq->q.fqdir, skb->truesize); -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index f285e52b8b8579..624ab1424eba7d 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -934,7 +934,7 @@ static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 - mark = inet_twsk(sk)->tw_mark; - else - mark = READ_ONCE(sk->sk_mark); -- skb_set_delivery_time(buff, tcp_transmit_time(sk), true); -+ skb_set_delivery_time(buff, tcp_transmit_time(sk), SKB_CLOCK_MONOTONIC); - } - if (txhash) { - /* autoflowlabel/skb_get_hash_flowi6 rely on buff->hash */ -diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c -index b0455fda7d0baf..ac87fcff4795e8 100644 ---- a/net/sched/act_bpf.c -+++ b/net/sched/act_bpf.c -@@ -54,8 +54,8 @@ TC_INDIRECT_SCOPE int tcf_bpf_act(struct sk_buff *skb, - bpf_compute_data_pointers(skb); - filter_res = bpf_prog_run(filter, skb); - } -- if (unlikely(!skb->tstamp && skb->mono_delivery_time)) -- skb->mono_delivery_time = 0; -+ if (unlikely(!skb->tstamp && skb->tstamp_type)) -+ skb->tstamp_type = SKB_CLOCK_REALTIME; - if (skb_sk_is_prefetched(skb) && filter_res != TC_ACT_OK) - skb_orphan(skb); - -diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c -index 382c7a71f81f2d..db7151c6b70b79 100644 ---- a/net/sched/cls_bpf.c -+++ b/net/sched/cls_bpf.c -@@ -104,8 +104,8 @@ TC_INDIRECT_SCOPE int cls_bpf_classify(struct sk_buff *skb, - bpf_compute_data_pointers(skb); - filter_res = bpf_prog_run(prog->filter, skb); - } -- if (unlikely(!skb->tstamp && skb->mono_delivery_time)) -- skb->mono_delivery_time = 0; -+ if (unlikely(!skb->tstamp && skb->tstamp_type)) -+ skb->tstamp_type = SKB_CLOCK_REALTIME; - - if (prog->exts_integrated) { - res->class = 0; -diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c -index 19901e77cd3b7f..9b36955e32b142 100644 ---- a/net/sched/sch_drr.c -+++ b/net/sched/sch_drr.c -@@ -35,6 +35,11 @@ struct drr_sched { - struct Qdisc_class_hash clhash; - }; - -+static bool cl_is_active(struct drr_class *cl) -+{ -+ return !list_empty(&cl->alist); -+} -+ - static struct drr_class *drr_find_class(struct Qdisc *sch, u32 classid) - { - struct drr_sched *q = qdisc_priv(sch); -@@ -105,6 +110,7 @@ static int drr_change_class(struct Qdisc *sch, u32 classid, u32 parentid, - return -ENOBUFS; - - gnet_stats_basic_sync_init(&cl->bstats); -+ INIT_LIST_HEAD(&cl->alist); - cl->common.classid = classid; - cl->quantum = quantum; - cl->qdisc = qdisc_create_dflt(sch->dev_queue, -@@ -229,7 +235,7 @@ static void drr_qlen_notify(struct Qdisc *csh, unsigned long arg) - { - struct drr_class *cl = (struct drr_class *)arg; - -- list_del(&cl->alist); -+ list_del_init(&cl->alist); - } - - static int drr_dump_class(struct Qdisc *sch, unsigned long arg, -@@ -336,7 +342,6 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch, - struct drr_sched *q = qdisc_priv(sch); - struct drr_class *cl; - int err = 0; -- bool first; - - cl = drr_classify(skb, sch, &err); - if (cl == NULL) { -@@ -346,7 +351,6 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch, - return err; - } - -- first = !cl->qdisc->q.qlen; - err = qdisc_enqueue(skb, cl->qdisc, to_free); - if (unlikely(err != NET_XMIT_SUCCESS)) { - if (net_xmit_drop_count(err)) { -@@ -356,7 +360,7 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch, - return err; - } - -- if (first) { -+ if (!cl_is_active(cl)) { - list_add_tail(&cl->alist, &q->active); - cl->deficit = cl->quantum; - } -@@ -390,7 +394,7 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch) - if (unlikely(skb == NULL)) - goto out; - if (cl->qdisc->q.qlen == 0) -- list_del(&cl->alist); -+ list_del_init(&cl->alist); - - bstats_update(&cl->bstats, skb); - qdisc_bstats_update(sch, skb); -@@ -431,7 +435,7 @@ static void drr_reset_qdisc(struct Qdisc *sch) - for (i = 0; i < q->clhash.hashsize; i++) { - hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) { - if (cl->qdisc->q.qlen) -- list_del(&cl->alist); -+ list_del_init(&cl->alist); - qdisc_reset(cl->qdisc); - } - } -diff --git a/net/sched/sch_ets.c b/net/sched/sch_ets.c -index 9fd70462b41d5a..9da86db4d2c2fe 100644 ---- a/net/sched/sch_ets.c -+++ b/net/sched/sch_ets.c -@@ -74,6 +74,11 @@ static const struct nla_policy ets_class_policy[TCA_ETS_MAX + 1] = { - [TCA_ETS_QUANTA_BAND] = { .type = NLA_U32 }, - }; - -+static bool cl_is_active(struct ets_class *cl) -+{ -+ return !list_empty(&cl->alist); -+} -+ - static int ets_quantum_parse(struct Qdisc *sch, const struct nlattr *attr, - unsigned int *quantum, - struct netlink_ext_ack *extack) -@@ -293,7 +298,7 @@ static void ets_class_qlen_notify(struct Qdisc *sch, unsigned long arg) - * to remove them. - */ - if (!ets_class_is_strict(q, cl) && sch->q.qlen) -- list_del(&cl->alist); -+ list_del_init(&cl->alist); - } - - static int ets_class_dump(struct Qdisc *sch, unsigned long arg, -@@ -416,7 +421,6 @@ static int ets_qdisc_enqueue(struct sk_buff *skb, struct Qdisc *sch, - struct ets_sched *q = qdisc_priv(sch); - struct ets_class *cl; - int err = 0; -- bool first; - - cl = ets_classify(skb, sch, &err); - if (!cl) { -@@ -426,7 +430,6 @@ static int ets_qdisc_enqueue(struct sk_buff *skb, struct Qdisc *sch, - return err; - } - -- first = !cl->qdisc->q.qlen; - err = qdisc_enqueue(skb, cl->qdisc, to_free); - if (unlikely(err != NET_XMIT_SUCCESS)) { - if (net_xmit_drop_count(err)) { -@@ -436,7 +439,7 @@ static int ets_qdisc_enqueue(struct sk_buff *skb, struct Qdisc *sch, - return err; - } - -- if (first && !ets_class_is_strict(q, cl)) { -+ if (!cl_is_active(cl) && !ets_class_is_strict(q, cl)) { - list_add_tail(&cl->alist, &q->active); - cl->deficit = cl->quantum; - } -@@ -488,7 +491,7 @@ static struct sk_buff *ets_qdisc_dequeue(struct Qdisc *sch) - if (unlikely(!skb)) - goto out; - if (cl->qdisc->q.qlen == 0) -- list_del(&cl->alist); -+ list_del_init(&cl->alist); - return ets_qdisc_dequeue_skb(sch, skb); - } - -@@ -657,7 +660,7 @@ static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt, - } - for (i = q->nbands; i < oldbands; i++) { - if (i >= q->nstrict && q->classes[i].qdisc->q.qlen) -- list_del(&q->classes[i].alist); -+ list_del_init(&q->classes[i].alist); - qdisc_tree_flush_backlog(q->classes[i].qdisc); - } - q->nstrict = nstrict; -@@ -713,7 +716,7 @@ static void ets_qdisc_reset(struct Qdisc *sch) - - for (band = q->nstrict; band < q->nbands; band++) { - if (q->classes[band].qdisc->q.qlen) -- list_del(&q->classes[band].alist); -+ list_del_init(&q->classes[band].alist); - } - for (band = 0; band < q->nbands; band++) - qdisc_reset(q->classes[band].qdisc); -diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c -index 371255e624332f..5d9cccfac4a155 100644 ---- a/net/sched/sch_hfsc.c -+++ b/net/sched/sch_hfsc.c -@@ -203,7 +203,10 @@ eltree_insert(struct hfsc_class *cl) - static inline void - eltree_remove(struct hfsc_class *cl) - { -- rb_erase(&cl->el_node, &cl->sched->eligible); -+ if (!RB_EMPTY_NODE(&cl->el_node)) { -+ rb_erase(&cl->el_node, &cl->sched->eligible); -+ RB_CLEAR_NODE(&cl->el_node); -+ } - } - - static inline void -@@ -1224,7 +1227,8 @@ hfsc_qlen_notify(struct Qdisc *sch, unsigned long arg) - /* vttree is now handled in update_vf() so that update_vf(cl, 0, 0) - * needs to be called explicitly to remove a class from vttree. - */ -- update_vf(cl, 0, 0); -+ if (cl->cl_nactive) -+ update_vf(cl, 0, 0); - if (cl->cl_flags & HFSC_RSC) - eltree_remove(cl); - } -@@ -1566,7 +1570,7 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free) - return err; - } - -- if (first) { -+ if (first && !cl->cl_nactive) { - if (cl->cl_flags & HFSC_RSC) - init_ed(cl, len); - if (cl->cl_flags & HFSC_FSC) -diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c -index 19035ef8387fed..9a3f7ea80b34b9 100644 ---- a/net/sched/sch_htb.c -+++ b/net/sched/sch_htb.c -@@ -1485,6 +1485,8 @@ static void htb_qlen_notify(struct Qdisc *sch, unsigned long arg) - { - struct htb_class *cl = (struct htb_class *)arg; - -+ if (!cl->prio_activity) -+ return; - htb_deactivate(qdisc_priv(sch), cl); - } - -diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c -index 546c10adcacdea..5e557b960bde33 100644 ---- a/net/sched/sch_qfq.c -+++ b/net/sched/sch_qfq.c -@@ -202,6 +202,11 @@ struct qfq_sched { - */ - enum update_reason {enqueue, requeue}; - -+static bool cl_is_active(struct qfq_class *cl) -+{ -+ return !list_empty(&cl->alist); -+} -+ - static struct qfq_class *qfq_find_class(struct Qdisc *sch, u32 classid) - { - struct qfq_sched *q = qdisc_priv(sch); -@@ -347,7 +352,7 @@ static void qfq_deactivate_class(struct qfq_sched *q, struct qfq_class *cl) - struct qfq_aggregate *agg = cl->agg; - - -- list_del(&cl->alist); /* remove from RR queue of the aggregate */ -+ list_del_init(&cl->alist); /* remove from RR queue of the aggregate */ - if (list_empty(&agg->active)) /* agg is now inactive */ - qfq_deactivate_agg(q, agg); - } -@@ -477,6 +482,7 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, - gnet_stats_basic_sync_init(&cl->bstats); - cl->common.classid = classid; - cl->deficit = lmax; -+ INIT_LIST_HEAD(&cl->alist); - - cl->qdisc = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops, - classid, NULL); -@@ -985,7 +991,7 @@ static struct sk_buff *agg_dequeue(struct qfq_aggregate *agg, - cl->deficit -= (int) len; - - if (cl->qdisc->q.qlen == 0) /* no more packets, remove from list */ -- list_del(&cl->alist); -+ list_del_init(&cl->alist); - else if (cl->deficit < qdisc_pkt_len(cl->qdisc->ops->peek(cl->qdisc))) { - cl->deficit += agg->lmax; - list_move_tail(&cl->alist, &agg->active); -@@ -1217,7 +1223,6 @@ static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch, - struct qfq_class *cl; - struct qfq_aggregate *agg; - int err = 0; -- bool first; - - cl = qfq_classify(skb, sch, &err); - if (cl == NULL) { -@@ -1239,7 +1244,6 @@ static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch, - } - - gso_segs = skb_is_gso(skb) ? skb_shinfo(skb)->gso_segs : 1; -- first = !cl->qdisc->q.qlen; - err = qdisc_enqueue(skb, cl->qdisc, to_free); - if (unlikely(err != NET_XMIT_SUCCESS)) { - pr_debug("qfq_enqueue: enqueue failed %d\n", err); -@@ -1255,8 +1259,8 @@ static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch, - ++sch->q.qlen; - - agg = cl->agg; -- /* if the queue was not empty, then done here */ -- if (!first) { -+ /* if the class is active, then done here */ -+ if (cl_is_active(cl)) { - if (unlikely(skb == cl->qdisc->ops->peek(cl->qdisc)) && - list_first_entry(&agg->active, struct qfq_class, alist) - == cl && cl->deficit < len) -@@ -1418,6 +1422,8 @@ static void qfq_qlen_notify(struct Qdisc *sch, unsigned long arg) - struct qfq_sched *q = qdisc_priv(sch); - struct qfq_class *cl = (struct qfq_class *)arg; - -+ if (list_empty(&cl->alist)) -+ return; - qfq_deactivate_class(q, cl); - } - -diff --git a/sound/soc/codecs/ak4613.c b/sound/soc/codecs/ak4613.c -index 619a817ee91cb8..4c1318ce8ae58f 100644 ---- a/sound/soc/codecs/ak4613.c -+++ b/sound/soc/codecs/ak4613.c -@@ -840,14 +840,14 @@ static void ak4613_parse_of(struct ak4613_priv *priv, - /* Input 1 - 2 */ - for (i = 0; i < 2; i++) { - snprintf(prop, sizeof(prop), "asahi-kasei,in%d-single-end", i + 1); -- if (!of_get_property(np, prop, NULL)) -+ if (!of_property_read_bool(np, prop)) - priv->ic |= 1 << i; - } - - /* Output 1 - 6 */ - for (i = 0; i < 6; i++) { - snprintf(prop, sizeof(prop), "asahi-kasei,out%d-single-end", i + 1); -- if (!of_get_property(np, prop, NULL)) -+ if (!of_property_read_bool(np, prop)) - priv->oc |= 1 << i; - } - -diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c -index e65fe3a7c3e42c..7eea70eea68b47 100644 ---- a/sound/soc/soc-core.c -+++ b/sound/soc/soc-core.c -@@ -2935,7 +2935,7 @@ int snd_soc_of_parse_pin_switches(struct snd_soc_card *card, const char *prop) - unsigned int i, nb_controls; - int ret; - -- if (!of_property_read_bool(dev->of_node, prop)) -+ if (!of_property_present(dev->of_node, prop)) - return 0; - - strings = devm_kcalloc(dev, nb_controls_max, -@@ -3009,23 +3009,17 @@ int snd_soc_of_parse_tdm_slot(struct device_node *np, - if (rx_mask) - snd_soc_of_get_slot_mask(np, "dai-tdm-slot-rx-mask", rx_mask); - -- if (of_property_read_bool(np, "dai-tdm-slot-num")) { -- ret = of_property_read_u32(np, "dai-tdm-slot-num", &val); -- if (ret) -- return ret; -- -- if (slots) -- *slots = val; -- } -- -- if (of_property_read_bool(np, "dai-tdm-slot-width")) { -- ret = of_property_read_u32(np, "dai-tdm-slot-width", &val); -- if (ret) -- return ret; -+ ret = of_property_read_u32(np, "dai-tdm-slot-num", &val); -+ if (ret && ret != -EINVAL) -+ return ret; -+ if (!ret && slots) -+ *slots = val; - -- if (slot_width) -- *slot_width = val; -- } -+ ret = of_property_read_u32(np, "dai-tdm-slot-width", &val); -+ if (ret && ret != -EINVAL) -+ return ret; -+ if (!ret && slot_width) -+ *slot_width = val; - - return 0; - } -@@ -3249,10 +3243,10 @@ unsigned int snd_soc_daifmt_parse_format(struct device_node *np, - * SND_SOC_DAIFMT_INV_MASK area - */ - snprintf(prop, sizeof(prop), "%sbitclock-inversion", prefix); -- bit = !!of_get_property(np, prop, NULL); -+ bit = of_property_read_bool(np, prop); - - snprintf(prop, sizeof(prop), "%sframe-inversion", prefix); -- frame = !!of_get_property(np, prop, NULL); -+ frame = of_property_read_bool(np, prop); - - switch ((bit << 4) + frame) { - case 0x11: -@@ -3289,12 +3283,12 @@ unsigned int snd_soc_daifmt_parse_clock_provider_raw(struct device_node *np, - * check "[prefix]frame-master" - */ - snprintf(prop, sizeof(prop), "%sbitclock-master", prefix); -- bit = !!of_get_property(np, prop, NULL); -+ bit = of_property_present(np, prop); - if (bit && bitclkmaster) - *bitclkmaster = of_parse_phandle(np, prop, 0); - - snprintf(prop, sizeof(prop), "%sframe-master", prefix); -- frame = !!of_get_property(np, prop, NULL); -+ frame = of_property_present(np, prop); - if (frame && framemaster) - *framemaster = of_parse_phandle(np, prop, 0); - -diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c -index 60248a6820aacc..30e93f9aad7624 100644 ---- a/sound/soc/soc-pcm.c -+++ b/sound/soc/soc-pcm.c -@@ -1534,10 +1534,13 @@ static int dpcm_add_paths(struct snd_soc_pcm_runtime *fe, int stream, - /* - * Filter for systems with 'component_chaining' enabled. - * This helps to avoid unnecessary re-configuration of an -- * already active BE on such systems. -+ * already active BE on such systems and ensures the BE DAI -+ * widget is powered ON after hw_params() BE DAI callback. - */ - if (fe->card->component_chaining && - (be->dpcm[stream].state != SND_SOC_DPCM_STATE_NEW) && -+ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_OPEN) && -+ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_PARAMS) && - (be->dpcm[stream].state != SND_SOC_DPCM_STATE_CLOSE)) - continue; - -diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c -index 68aa174be12d71..f71f6ff3e2b0f7 100644 ---- a/sound/usb/endpoint.c -+++ b/sound/usb/endpoint.c -@@ -926,14 +926,21 @@ static int endpoint_set_interface(struct snd_usb_audio *chip, - { - int altset = set ? ep->altsetting : 0; - int err; -+ int retries = 0; -+ const int max_retries = 5; - - if (ep->iface_ref->altset == altset) - return 0; - - usb_audio_dbg(chip, "Setting usb interface %d:%d for EP 0x%x\n", - ep->iface, altset, ep->ep_num); -+retry: - err = usb_set_interface(chip->dev, ep->iface, altset); - if (err < 0) { -+ if (err == -EPROTO && ++retries <= max_retries) { -+ msleep(5 * (1 << (retries - 1))); -+ goto retry; -+ } - usb_audio_err_ratelimited( - chip, "%d:%d: usb_set_interface failed (%d)\n", - ep->iface, altset, err); -diff --git a/sound/usb/format.c b/sound/usb/format.c -index 3b3a5ea6fcbfc0..f33d25a4e4cc7c 100644 ---- a/sound/usb/format.c -+++ b/sound/usb/format.c -@@ -263,7 +263,8 @@ static int parse_audio_format_rates_v1(struct snd_usb_audio *chip, struct audiof - } - - /* Jabra Evolve 65 headset */ -- if (chip->usb_id == USB_ID(0x0b0e, 0x030b)) { -+ if (chip->usb_id == USB_ID(0x0b0e, 0x030b) || -+ chip->usb_id == USB_ID(0x0b0e, 0x030c)) { - /* only 48kHz for playback while keeping 16kHz for capture */ - if (fp->nr_rates != 1) - return set_fixed_rate(fp, 48000, SNDRV_PCM_RATE_48000); -diff --git a/tools/testing/selftests/bpf/prog_tests/changes_pkt_data.c b/tools/testing/selftests/bpf/prog_tests/changes_pkt_data.c -new file mode 100644 -index 00000000000000..7526de3790814c ---- /dev/null -+++ b/tools/testing/selftests/bpf/prog_tests/changes_pkt_data.c -@@ -0,0 +1,107 @@ -+// SPDX-License-Identifier: GPL-2.0 -+#include "bpf/libbpf.h" -+#include "changes_pkt_data_freplace.skel.h" -+#include "changes_pkt_data.skel.h" -+#include -+ -+static void print_verifier_log(const char *log) -+{ -+ if (env.verbosity >= VERBOSE_VERY) -+ fprintf(stdout, "VERIFIER LOG:\n=============\n%s=============\n", log); -+} -+ -+static void test_aux(const char *main_prog_name, -+ const char *to_be_replaced, -+ const char *replacement, -+ bool expect_load) -+{ -+ struct changes_pkt_data_freplace *freplace = NULL; -+ struct bpf_program *freplace_prog = NULL; -+ struct bpf_program *main_prog = NULL; -+ LIBBPF_OPTS(bpf_object_open_opts, opts); -+ struct changes_pkt_data *main = NULL; -+ char log[16*1024]; -+ int err; -+ -+ opts.kernel_log_buf = log; -+ opts.kernel_log_size = sizeof(log); -+ if (env.verbosity >= VERBOSE_SUPER) -+ opts.kernel_log_level = 1 | 2 | 4; -+ main = changes_pkt_data__open_opts(&opts); -+ if (!ASSERT_OK_PTR(main, "changes_pkt_data__open")) -+ goto out; -+ main_prog = bpf_object__find_program_by_name(main->obj, main_prog_name); -+ if (!ASSERT_OK_PTR(main_prog, "main_prog")) -+ goto out; -+ bpf_program__set_autoload(main_prog, true); -+ err = changes_pkt_data__load(main); -+ print_verifier_log(log); -+ if (!ASSERT_OK(err, "changes_pkt_data__load")) -+ goto out; -+ freplace = changes_pkt_data_freplace__open_opts(&opts); -+ if (!ASSERT_OK_PTR(freplace, "changes_pkt_data_freplace__open")) -+ goto out; -+ freplace_prog = bpf_object__find_program_by_name(freplace->obj, replacement); -+ if (!ASSERT_OK_PTR(freplace_prog, "freplace_prog")) -+ goto out; -+ bpf_program__set_autoload(freplace_prog, true); -+ bpf_program__set_autoattach(freplace_prog, true); -+ bpf_program__set_attach_target(freplace_prog, -+ bpf_program__fd(main_prog), -+ to_be_replaced); -+ err = changes_pkt_data_freplace__load(freplace); -+ print_verifier_log(log); -+ if (expect_load) { -+ ASSERT_OK(err, "changes_pkt_data_freplace__load"); -+ } else { -+ ASSERT_ERR(err, "changes_pkt_data_freplace__load"); -+ ASSERT_HAS_SUBSTR(log, "Extension program changes packet data", "error log"); -+ } -+ -+out: -+ changes_pkt_data_freplace__destroy(freplace); -+ changes_pkt_data__destroy(main); -+} -+ -+/* There are two global subprograms in both changes_pkt_data.skel.h: -+ * - one changes packet data; -+ * - another does not. -+ * It is ok to freplace subprograms that change packet data with those -+ * that either do or do not. It is only ok to freplace subprograms -+ * that do not change packet data with those that do not as well. -+ * The below tests check outcomes for each combination of such freplace. -+ * Also test a case when main subprogram itself is replaced and is a single -+ * subprogram in a program. -+ */ -+void test_changes_pkt_data_freplace(void) -+{ -+ struct { -+ const char *main; -+ const char *to_be_replaced; -+ bool changes; -+ } mains[] = { -+ { "main_with_subprogs", "changes_pkt_data", true }, -+ { "main_with_subprogs", "does_not_change_pkt_data", false }, -+ { "main_changes", "main_changes", true }, -+ { "main_does_not_change", "main_does_not_change", false }, -+ }; -+ struct { -+ const char *func; -+ bool changes; -+ } replacements[] = { -+ { "changes_pkt_data", true }, -+ { "does_not_change_pkt_data", false } -+ }; -+ char buf[64]; -+ -+ for (int i = 0; i < ARRAY_SIZE(mains); ++i) { -+ for (int j = 0; j < ARRAY_SIZE(replacements); ++j) { -+ snprintf(buf, sizeof(buf), "%s_with_%s", -+ mains[i].to_be_replaced, replacements[j].func); -+ if (!test__start_subtest(buf)) -+ continue; -+ test_aux(mains[i].main, mains[i].to_be_replaced, replacements[j].func, -+ mains[i].changes || !replacements[j].changes); -+ } -+ } -+} -diff --git a/tools/testing/selftests/bpf/progs/changes_pkt_data.c b/tools/testing/selftests/bpf/progs/changes_pkt_data.c -new file mode 100644 -index 00000000000000..43cada48b28ad4 ---- /dev/null -+++ b/tools/testing/selftests/bpf/progs/changes_pkt_data.c -@@ -0,0 +1,39 @@ -+// SPDX-License-Identifier: GPL-2.0 -+ -+#include -+#include -+ -+__noinline -+long changes_pkt_data(struct __sk_buff *sk) -+{ -+ return bpf_skb_pull_data(sk, 0); -+} -+ -+__noinline __weak -+long does_not_change_pkt_data(struct __sk_buff *sk) -+{ -+ return 0; -+} -+ -+SEC("?tc") -+int main_with_subprogs(struct __sk_buff *sk) -+{ -+ changes_pkt_data(sk); -+ does_not_change_pkt_data(sk); -+ return 0; -+} -+ -+SEC("?tc") -+int main_changes(struct __sk_buff *sk) -+{ -+ bpf_skb_pull_data(sk, 0); -+ return 0; -+} -+ -+SEC("?tc") -+int main_does_not_change(struct __sk_buff *sk) -+{ -+ return 0; -+} -+ -+char _license[] SEC("license") = "GPL"; -diff --git a/tools/testing/selftests/bpf/progs/changes_pkt_data_freplace.c b/tools/testing/selftests/bpf/progs/changes_pkt_data_freplace.c -new file mode 100644 -index 00000000000000..f9a622705f1b3b ---- /dev/null -+++ b/tools/testing/selftests/bpf/progs/changes_pkt_data_freplace.c -@@ -0,0 +1,18 @@ -+// SPDX-License-Identifier: GPL-2.0 -+ -+#include -+#include -+ -+SEC("?freplace") -+long changes_pkt_data(struct __sk_buff *sk) -+{ -+ return bpf_skb_pull_data(sk, 0); -+} -+ -+SEC("?freplace") -+long does_not_change_pkt_data(struct __sk_buff *sk) -+{ -+ return 0; -+} -+ -+char _license[] SEC("license") = "GPL"; -diff --git a/tools/testing/selftests/bpf/progs/verifier_sock.c b/tools/testing/selftests/bpf/progs/verifier_sock.c -index ee76b51005abe7..3c8f6646e33dae 100644 ---- a/tools/testing/selftests/bpf/progs/verifier_sock.c -+++ b/tools/testing/selftests/bpf/progs/verifier_sock.c -@@ -50,6 +50,13 @@ struct { - __uint(map_flags, BPF_F_NO_PREALLOC); - } sk_storage_map SEC(".maps"); - -+struct { -+ __uint(type, BPF_MAP_TYPE_PROG_ARRAY); -+ __uint(max_entries, 1); -+ __uint(key_size, sizeof(__u32)); -+ __uint(value_size, sizeof(__u32)); -+} jmp_table SEC(".maps"); -+ - SEC("cgroup/skb") - __description("skb->sk: no NULL check") - __failure __msg("invalid mem access 'sock_common_or_null'") -@@ -977,4 +984,53 @@ l1_%=: r0 = *(u8*)(r7 + 0); \ - : __clobber_all); - } - -+__noinline -+long skb_pull_data2(struct __sk_buff *sk, __u32 len) -+{ -+ return bpf_skb_pull_data(sk, len); -+} -+ -+__noinline -+long skb_pull_data1(struct __sk_buff *sk, __u32 len) -+{ -+ return skb_pull_data2(sk, len); -+} -+ -+/* global function calls bpf_skb_pull_data(), which invalidates packet -+ * pointers established before global function call. -+ */ -+SEC("tc") -+__failure __msg("invalid mem access") -+int invalidate_pkt_pointers_from_global_func(struct __sk_buff *sk) -+{ -+ int *p = (void *)(long)sk->data; -+ -+ if ((void *)(p + 1) > (void *)(long)sk->data_end) -+ return TCX_DROP; -+ skb_pull_data1(sk, 0); -+ *p = 42; /* this is unsafe */ -+ return TCX_PASS; -+} -+ -+__noinline -+int tail_call(struct __sk_buff *sk) -+{ -+ bpf_tail_call_static(sk, &jmp_table, 0); -+ return 0; -+} -+ -+/* Tail calls invalidate packet pointers. */ -+SEC("tc") -+__failure __msg("invalid mem access") -+int invalidate_pkt_pointers_by_tail_call(struct __sk_buff *sk) -+{ -+ int *p = (void *)(long)sk->data; -+ -+ if ((void *)(p + 1) > (void *)(long)sk->data_end) -+ return TCX_DROP; -+ tail_call(sk); -+ *p = 42; /* this is unsafe */ -+ return TCX_PASS; -+} -+ - char _license[] SEC("license") = "GPL"; diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.090-091.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.090-091.patch deleted file mode 100644 index 8cffc8d8b2..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.090-091.patch +++ /dev/null @@ -1,4952 +0,0 @@ -diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu -index 657bdee28d845a..0426ec112155ec 100644 ---- a/Documentation/ABI/testing/sysfs-devices-system-cpu -+++ b/Documentation/ABI/testing/sysfs-devices-system-cpu -@@ -514,6 +514,7 @@ Description: information about CPUs heterogeneity. - - What: /sys/devices/system/cpu/vulnerabilities - /sys/devices/system/cpu/vulnerabilities/gather_data_sampling -+ /sys/devices/system/cpu/vulnerabilities/indirect_target_selection - /sys/devices/system/cpu/vulnerabilities/itlb_multihit - /sys/devices/system/cpu/vulnerabilities/l1tf - /sys/devices/system/cpu/vulnerabilities/mds -diff --git a/Documentation/admin-guide/hw-vuln/index.rst b/Documentation/admin-guide/hw-vuln/index.rst -index ff0b440ef2dc90..d2caa390395e5b 100644 ---- a/Documentation/admin-guide/hw-vuln/index.rst -+++ b/Documentation/admin-guide/hw-vuln/index.rst -@@ -22,3 +22,4 @@ are configurable at compile, boot or run time. - srso - gather_data_sampling - reg-file-data-sampling -+ indirect-target-selection -diff --git a/Documentation/admin-guide/hw-vuln/indirect-target-selection.rst b/Documentation/admin-guide/hw-vuln/indirect-target-selection.rst -new file mode 100644 -index 00000000000000..d9ca64108d2332 ---- /dev/null -+++ b/Documentation/admin-guide/hw-vuln/indirect-target-selection.rst -@@ -0,0 +1,168 @@ -+.. SPDX-License-Identifier: GPL-2.0 -+ -+Indirect Target Selection (ITS) -+=============================== -+ -+ITS is a vulnerability in some Intel CPUs that support Enhanced IBRS and were -+released before Alder Lake. ITS may allow an attacker to control the prediction -+of indirect branches and RETs located in the lower half of a cacheline. -+ -+ITS is assigned CVE-2024-28956 with a CVSS score of 4.7 (Medium). -+ -+Scope of Impact -+--------------- -+- **eIBRS Guest/Host Isolation**: Indirect branches in KVM/kernel may still be -+ predicted with unintended target corresponding to a branch in the guest. -+ -+- **Intra-Mode BTI**: In-kernel training such as through cBPF or other native -+ gadgets. -+ -+- **Indirect Branch Prediction Barrier (IBPB)**: After an IBPB, indirect -+ branches may still be predicted with targets corresponding to direct branches -+ executed prior to the IBPB. This is fixed by the IPU 2025.1 microcode, which -+ should be available via distro updates. Alternatively microcode can be -+ obtained from Intel's github repository [#f1]_. -+ -+Affected CPUs -+------------- -+Below is the list of ITS affected CPUs [#f2]_ [#f3]_: -+ -+ ======================== ============ ==================== =============== -+ Common name Family_Model eIBRS Intra-mode BTI -+ Guest/Host Isolation -+ ======================== ============ ==================== =============== -+ SKYLAKE_X (step >= 6) 06_55H Affected Affected -+ ICELAKE_X 06_6AH Not affected Affected -+ ICELAKE_D 06_6CH Not affected Affected -+ ICELAKE_L 06_7EH Not affected Affected -+ TIGERLAKE_L 06_8CH Not affected Affected -+ TIGERLAKE 06_8DH Not affected Affected -+ KABYLAKE_L (step >= 12) 06_8EH Affected Affected -+ KABYLAKE (step >= 13) 06_9EH Affected Affected -+ COMETLAKE 06_A5H Affected Affected -+ COMETLAKE_L 06_A6H Affected Affected -+ ROCKETLAKE 06_A7H Not affected Affected -+ ======================== ============ ==================== =============== -+ -+- All affected CPUs enumerate Enhanced IBRS feature. -+- IBPB isolation is affected on all ITS affected CPUs, and need a microcode -+ update for mitigation. -+- None of the affected CPUs enumerate BHI_CTRL which was introduced in Golden -+ Cove (Alder Lake and Sapphire Rapids). This can help guests to determine the -+ host's affected status. -+- Intel Atom CPUs are not affected by ITS. -+ -+Mitigation -+---------- -+As only the indirect branches and RETs that have their last byte of instruction -+in the lower half of the cacheline are vulnerable to ITS, the basic idea behind -+the mitigation is to not allow indirect branches in the lower half. -+ -+This is achieved by relying on existing retpoline support in the kernel, and in -+compilers. ITS-vulnerable retpoline sites are runtime patched to point to newly -+added ITS-safe thunks. These safe thunks consists of indirect branch in the -+second half of the cacheline. Not all retpoline sites are patched to thunks, if -+a retpoline site is evaluated to be ITS-safe, it is replaced with an inline -+indirect branch. -+ -+Dynamic thunks -+~~~~~~~~~~~~~~ -+From a dynamically allocated pool of safe-thunks, each vulnerable site is -+replaced with a new thunk, such that they get a unique address. This could -+improve the branch prediction accuracy. Also, it is a defense-in-depth measure -+against aliasing. -+ -+Note, for simplicity, indirect branches in eBPF programs are always replaced -+with a jump to a static thunk in __x86_indirect_its_thunk_array. If required, -+in future this can be changed to use dynamic thunks. -+ -+All vulnerable RETs are replaced with a static thunk, they do not use dynamic -+thunks. This is because RETs get their prediction from RSB mostly that does not -+depend on source address. RETs that underflow RSB may benefit from dynamic -+thunks. But, RETs significantly outnumber indirect branches, and any benefit -+from a unique source address could be outweighed by the increased icache -+footprint and iTLB pressure. -+ -+Retpoline -+~~~~~~~~~ -+Retpoline sequence also mitigates ITS-unsafe indirect branches. For this -+reason, when retpoline is enabled, ITS mitigation only relocates the RETs to -+safe thunks. Unless user requested the RSB-stuffing mitigation. -+ -+RSB Stuffing -+~~~~~~~~~~~~ -+RSB-stuffing via Call Depth Tracking is a mitigation for Retbleed RSB-underflow -+attacks. And it also mitigates RETs that are vulnerable to ITS. -+ -+Mitigation in guests -+^^^^^^^^^^^^^^^^^^^^ -+All guests deploy ITS mitigation by default, irrespective of eIBRS enumeration -+and Family/Model of the guest. This is because eIBRS feature could be hidden -+from a guest. One exception to this is when a guest enumerates BHI_DIS_S, which -+indicates that the guest is running on an unaffected host. -+ -+To prevent guests from unnecessarily deploying the mitigation on unaffected -+platforms, Intel has defined ITS_NO bit(62) in MSR IA32_ARCH_CAPABILITIES. When -+a guest sees this bit set, it should not enumerate the ITS bug. Note, this bit -+is not set by any hardware, but is **intended for VMMs to synthesize** it for -+guests as per the host's affected status. -+ -+Mitigation options -+^^^^^^^^^^^^^^^^^^ -+The ITS mitigation can be controlled using the "indirect_target_selection" -+kernel parameter. The available options are: -+ -+ ======== =================================================================== -+ on (default) Deploy the "Aligned branch/return thunks" mitigation. -+ If spectre_v2 mitigation enables retpoline, aligned-thunks are only -+ deployed for the affected RET instructions. Retpoline mitigates -+ indirect branches. -+ -+ off Disable ITS mitigation. -+ -+ vmexit Equivalent to "=on" if the CPU is affected by guest/host isolation -+ part of ITS. Otherwise, mitigation is not deployed. This option is -+ useful when host userspace is not in the threat model, and only -+ attacks from guest to host are considered. -+ -+ stuff Deploy RSB-fill mitigation when retpoline is also deployed. -+ Otherwise, deploy the default mitigation. When retpoline mitigation -+ is enabled, RSB-stuffing via Call-Depth-Tracking also mitigates -+ ITS. -+ -+ force Force the ITS bug and deploy the default mitigation. -+ ======== =================================================================== -+ -+Sysfs reporting -+--------------- -+ -+The sysfs file showing ITS mitigation status is: -+ -+ /sys/devices/system/cpu/vulnerabilities/indirect_target_selection -+ -+Note, microcode mitigation status is not reported in this file. -+ -+The possible values in this file are: -+ -+.. list-table:: -+ -+ * - Not affected -+ - The processor is not vulnerable. -+ * - Vulnerable -+ - System is vulnerable and no mitigation has been applied. -+ * - Vulnerable, KVM: Not affected -+ - System is vulnerable to intra-mode BTI, but not affected by eIBRS -+ guest/host isolation. -+ * - Mitigation: Aligned branch/return thunks -+ - The mitigation is enabled, affected indirect branches and RETs are -+ relocated to safe thunks. -+ * - Mitigation: Retpolines, Stuffing RSB -+ - The mitigation is enabled using retpoline and RSB stuffing. -+ -+References -+---------- -+.. [#f1] Microcode repository - https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files -+ -+.. [#f2] Affected Processors list - https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.html -+ -+.. [#f3] Affected Processors list (machine readable) - https://github.com/intel/Intel-affected-processor-list -diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt -index 184f2f96f6a547..f95734ceb82b86 100644 ---- a/Documentation/admin-guide/kernel-parameters.txt -+++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -2060,6 +2060,23 @@ - different crypto accelerators. This option can be used - to achieve best performance for particular HW. - -+ indirect_target_selection= [X86,Intel] Mitigation control for Indirect -+ Target Selection(ITS) bug in Intel CPUs. Updated -+ microcode is also required for a fix in IBPB. -+ -+ on: Enable mitigation (default). -+ off: Disable mitigation. -+ force: Force the ITS bug and deploy default -+ mitigation. -+ vmexit: Only deploy mitigation if CPU is affected by -+ guest/host isolation part of ITS. -+ stuff: Deploy RSB-fill mitigation when retpoline is -+ also deployed. Otherwise, deploy the default -+ mitigation. -+ -+ For details see: -+ Documentation/admin-guide/hw-vuln/indirect-target-selection.rst -+ - init= [KNL] - Format: - Run specified binary instead of /sbin/init as init -@@ -3331,6 +3348,7 @@ - expose users to several CPU vulnerabilities. - Equivalent to: if nokaslr then kpti=0 [ARM64] - gather_data_sampling=off [X86] -+ indirect_target_selection=off [X86] - kvm.nx_huge_pages=off [X86] - l1tf=off [X86] - mds=off [X86] -diff --git a/Makefile b/Makefile -index 587a1586e76db8..a6a1942e2d00a9 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 90 -+SUBLEVEL = 91 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi -index 6c48fa4b0d0c4f..6457d2c377017a 100644 ---- a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi -+++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi -@@ -148,6 +148,19 @@ reg_usdhc2_vmmc: regulator-usdhc2 { - startup-delay-us = <20000>; - }; - -+ reg_usdhc2_vqmmc: regulator-usdhc2-vqmmc { -+ compatible = "regulator-gpio"; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&pinctrl_usdhc2_vsel>; -+ gpios = <&gpio1 4 GPIO_ACTIVE_HIGH>; -+ regulator-max-microvolt = <3300000>; -+ regulator-min-microvolt = <1800000>; -+ states = <1800000 0x1>, -+ <3300000 0x0>; -+ regulator-name = "PMIC_USDHC_VSELECT"; -+ vin-supply = <®_nvcc_sd>; -+ }; -+ - reserved-memory { - #address-cells = <2>; - #size-cells = <2>; -@@ -266,7 +279,7 @@ &gpio1 { - "SODIMM_19", - "", - "", -- "", -+ "PMIC_USDHC_VSELECT", - "", - "", - "", -@@ -787,6 +800,7 @@ &usdhc2 { - pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_cd>; - pinctrl-3 = <&pinctrl_usdhc2_sleep>, <&pinctrl_usdhc2_cd_sleep>; - vmmc-supply = <®_usdhc2_vmmc>; -+ vqmmc-supply = <®_usdhc2_vqmmc>; - }; - - &wdog1 { -@@ -1209,13 +1223,17 @@ pinctrl_usdhc2_pwr_en: usdhc2pwrengrp { - ; /* SODIMM 76 */ - }; - -+ pinctrl_usdhc2_vsel: usdhc2vselgrp { -+ fsl,pins = -+ ; /* PMIC_USDHC_VSELECT */ -+ }; -+ - /* - * Note: Due to ERR050080 we use discrete external on-module resistors pulling-up to the - * on-module +V3.3_1.8_SD (LDO5) rail and explicitly disable the internal pull-ups here. - */ - pinctrl_usdhc2: usdhc2grp { - fsl,pins = -- , - , /* SODIMM 78 */ - , /* SODIMM 74 */ - , /* SODIMM 80 */ -@@ -1226,7 +1244,6 @@ pinctrl_usdhc2: usdhc2grp { - - pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp { - fsl,pins = -- , - , - , - , -@@ -1237,7 +1254,6 @@ pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp { - - pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp { - fsl,pins = -- , - , - , - , -@@ -1249,7 +1265,6 @@ pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp { - /* Avoid backfeeding with removed card power */ - pinctrl_usdhc2_sleep: usdhc2slpgrp { - fsl,pins = -- , - , - , - , -diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h -index 2a4e686e633c62..8a6b7feca3e428 100644 ---- a/arch/arm64/include/asm/cputype.h -+++ b/arch/arm64/include/asm/cputype.h -@@ -81,6 +81,7 @@ - #define ARM_CPU_PART_CORTEX_A78AE 0xD42 - #define ARM_CPU_PART_CORTEX_X1 0xD44 - #define ARM_CPU_PART_CORTEX_A510 0xD46 -+#define ARM_CPU_PART_CORTEX_X1C 0xD4C - #define ARM_CPU_PART_CORTEX_A520 0xD80 - #define ARM_CPU_PART_CORTEX_A710 0xD47 - #define ARM_CPU_PART_CORTEX_A715 0xD4D -@@ -166,6 +167,7 @@ - #define MIDR_CORTEX_A78AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78AE) - #define MIDR_CORTEX_X1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1) - #define MIDR_CORTEX_A510 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A510) -+#define MIDR_CORTEX_X1C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C) - #define MIDR_CORTEX_A520 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A520) - #define MIDR_CORTEX_A710 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A710) - #define MIDR_CORTEX_A715 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A715) -diff --git a/arch/arm64/include/asm/insn.h b/arch/arm64/include/asm/insn.h -index 0ccf51afde31a6..12c0278294e3f6 100644 ---- a/arch/arm64/include/asm/insn.h -+++ b/arch/arm64/include/asm/insn.h -@@ -687,6 +687,7 @@ u32 aarch64_insn_gen_cas(enum aarch64_insn_register result, - } - #endif - u32 aarch64_insn_gen_dmb(enum aarch64_insn_mb_type type); -+u32 aarch64_insn_gen_dsb(enum aarch64_insn_mb_type type); - - s32 aarch64_get_branch_offset(u32 insn); - u32 aarch64_set_branch_offset(u32 insn, s32 offset); -diff --git a/arch/arm64/include/asm/spectre.h b/arch/arm64/include/asm/spectre.h -index 0c2b47673922e3..32475d19c15f44 100644 ---- a/arch/arm64/include/asm/spectre.h -+++ b/arch/arm64/include/asm/spectre.h -@@ -97,6 +97,9 @@ enum mitigation_state arm64_get_meltdown_state(void); - - enum mitigation_state arm64_get_spectre_bhb_state(void); - bool is_spectre_bhb_affected(const struct arm64_cpu_capabilities *entry, int scope); -+extern bool __nospectre_bhb; -+u8 get_spectre_bhb_loop_value(void); -+bool is_spectre_bhb_fw_mitigated(void); - void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *__unused); - bool try_emulate_el1_ssbs(struct pt_regs *regs, u32 instr); - -diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c -index edc4c727783d82..28c48bc9c09538 100644 ---- a/arch/arm64/kernel/proton-pack.c -+++ b/arch/arm64/kernel/proton-pack.c -@@ -891,6 +891,7 @@ static u8 spectre_bhb_loop_affected(void) - MIDR_ALL_VERSIONS(MIDR_CORTEX_A78AE), - MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C), - MIDR_ALL_VERSIONS(MIDR_CORTEX_X1), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X1C), - MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), - MIDR_ALL_VERSIONS(MIDR_CORTEX_X2), - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), -@@ -998,6 +999,11 @@ bool is_spectre_bhb_affected(const struct arm64_cpu_capabilities *entry, - return true; - } - -+u8 get_spectre_bhb_loop_value(void) -+{ -+ return max_bhb_k; -+} -+ - static void this_cpu_set_vectors(enum arm64_bp_harden_el1_vectors slot) - { - const char *v = arm64_get_bp_hardening_vector(slot); -@@ -1015,7 +1021,7 @@ static void this_cpu_set_vectors(enum arm64_bp_harden_el1_vectors slot) - isb(); - } - --static bool __read_mostly __nospectre_bhb; -+bool __read_mostly __nospectre_bhb; - static int __init parse_spectre_bhb_param(char *str) - { - __nospectre_bhb = true; -@@ -1093,6 +1099,11 @@ void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *entry) - update_mitigation_state(&spectre_bhb_state, state); - } - -+bool is_spectre_bhb_fw_mitigated(void) -+{ -+ return test_bit(BHB_FW, &system_bhb_mitigations); -+} -+ - /* Patched to NOP when enabled */ - void noinstr spectre_bhb_patch_loop_mitigation_enable(struct alt_instr *alt, - __le32 *origptr, -diff --git a/arch/arm64/lib/insn.c b/arch/arm64/lib/insn.c -index a635ab83fee359..7232b1e70a125f 100644 ---- a/arch/arm64/lib/insn.c -+++ b/arch/arm64/lib/insn.c -@@ -5,6 +5,7 @@ - * - * Copyright (C) 2014-2016 Zi Shen Lim - */ -+#include - #include - #include - #include -@@ -1471,43 +1472,41 @@ u32 aarch64_insn_gen_extr(enum aarch64_insn_variant variant, - return aarch64_insn_encode_register(AARCH64_INSN_REGTYPE_RM, insn, Rm); - } - --u32 aarch64_insn_gen_dmb(enum aarch64_insn_mb_type type) -+static u32 __get_barrier_crm_val(enum aarch64_insn_mb_type type) - { -- u32 opt; -- u32 insn; -- - switch (type) { - case AARCH64_INSN_MB_SY: -- opt = 0xf; -- break; -+ return 0xf; - case AARCH64_INSN_MB_ST: -- opt = 0xe; -- break; -+ return 0xe; - case AARCH64_INSN_MB_LD: -- opt = 0xd; -- break; -+ return 0xd; - case AARCH64_INSN_MB_ISH: -- opt = 0xb; -- break; -+ return 0xb; - case AARCH64_INSN_MB_ISHST: -- opt = 0xa; -- break; -+ return 0xa; - case AARCH64_INSN_MB_ISHLD: -- opt = 0x9; -- break; -+ return 0x9; - case AARCH64_INSN_MB_NSH: -- opt = 0x7; -- break; -+ return 0x7; - case AARCH64_INSN_MB_NSHST: -- opt = 0x6; -- break; -+ return 0x6; - case AARCH64_INSN_MB_NSHLD: -- opt = 0x5; -- break; -+ return 0x5; - default: -- pr_err("%s: unknown dmb type %d\n", __func__, type); -+ pr_err("%s: unknown barrier type %d\n", __func__, type); - return AARCH64_BREAK_FAULT; - } -+} -+ -+u32 aarch64_insn_gen_dmb(enum aarch64_insn_mb_type type) -+{ -+ u32 opt; -+ u32 insn; -+ -+ opt = __get_barrier_crm_val(type); -+ if (opt == AARCH64_BREAK_FAULT) -+ return AARCH64_BREAK_FAULT; - - insn = aarch64_insn_get_dmb_value(); - insn &= ~GENMASK(11, 8); -@@ -1515,3 +1514,18 @@ u32 aarch64_insn_gen_dmb(enum aarch64_insn_mb_type type) - - return insn; - } -+ -+u32 aarch64_insn_gen_dsb(enum aarch64_insn_mb_type type) -+{ -+ u32 opt, insn; -+ -+ opt = __get_barrier_crm_val(type); -+ if (opt == AARCH64_BREAK_FAULT) -+ return AARCH64_BREAK_FAULT; -+ -+ insn = aarch64_insn_get_dsb_base_value(); -+ insn &= ~GENMASK(11, 8); -+ insn |= (opt << 8); -+ -+ return insn; -+} -diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c -index 5074bd1d37b5f6..75523c1be07350 100644 ---- a/arch/arm64/net/bpf_jit_comp.c -+++ b/arch/arm64/net/bpf_jit_comp.c -@@ -7,6 +7,7 @@ - - #define pr_fmt(fmt) "bpf_jit: " fmt - -+#include - #include - #include - #include -@@ -17,6 +18,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -653,7 +655,51 @@ static void build_plt(struct jit_ctx *ctx) - plt->target = (u64)&dummy_tramp; - } - --static void build_epilogue(struct jit_ctx *ctx) -+/* Clobbers BPF registers 1-4, aka x0-x3 */ -+static void __maybe_unused build_bhb_mitigation(struct jit_ctx *ctx) -+{ -+ const u8 r1 = bpf2a64[BPF_REG_1]; /* aka x0 */ -+ u8 k = get_spectre_bhb_loop_value(); -+ -+ if (!IS_ENABLED(CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY) || -+ cpu_mitigations_off() || __nospectre_bhb || -+ arm64_get_spectre_v2_state() == SPECTRE_VULNERABLE) -+ return; -+ -+ if (capable(CAP_SYS_ADMIN)) -+ return; -+ -+ if (supports_clearbhb(SCOPE_SYSTEM)) { -+ emit(aarch64_insn_gen_hint(AARCH64_INSN_HINT_CLEARBHB), ctx); -+ return; -+ } -+ -+ if (k) { -+ emit_a64_mov_i64(r1, k, ctx); -+ emit(A64_B(1), ctx); -+ emit(A64_SUBS_I(true, r1, r1, 1), ctx); -+ emit(A64_B_(A64_COND_NE, -2), ctx); -+ emit(aarch64_insn_gen_dsb(AARCH64_INSN_MB_ISH), ctx); -+ emit(aarch64_insn_get_isb_value(), ctx); -+ } -+ -+ if (is_spectre_bhb_fw_mitigated()) { -+ emit(A64_ORR_I(false, r1, AARCH64_INSN_REG_ZR, -+ ARM_SMCCC_ARCH_WORKAROUND_3), ctx); -+ switch (arm_smccc_1_1_get_conduit()) { -+ case SMCCC_CONDUIT_HVC: -+ emit(aarch64_insn_get_hvc_value(), ctx); -+ break; -+ case SMCCC_CONDUIT_SMC: -+ emit(aarch64_insn_get_smc_value(), ctx); -+ break; -+ default: -+ pr_err_once("Firmware mitigation enabled with unknown conduit\n"); -+ } -+ } -+} -+ -+static void build_epilogue(struct jit_ctx *ctx, bool was_classic) - { - const u8 r0 = bpf2a64[BPF_REG_0]; - const u8 r6 = bpf2a64[BPF_REG_6]; -@@ -675,10 +721,13 @@ static void build_epilogue(struct jit_ctx *ctx) - emit(A64_POP(r8, r9, A64_SP), ctx); - emit(A64_POP(r6, r7, A64_SP), ctx); - -+ if (was_classic) -+ build_bhb_mitigation(ctx); -+ - /* Restore FP/LR registers */ - emit(A64_POP(A64_FP, A64_LR, A64_SP), ctx); - -- /* Set return value */ -+ /* Move the return value from bpf:r0 (aka x7) to x0 */ - emit(A64_MOV(1, A64_R(0), r0), ctx); - - /* Authenticate lr */ -@@ -1586,7 +1635,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) - } - - ctx.epilogue_offset = ctx.idx; -- build_epilogue(&ctx); -+ build_epilogue(&ctx, was_classic); - build_plt(&ctx); - - extable_align = __alignof__(struct exception_table_entry); -@@ -1622,7 +1671,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) - goto out_off; - } - -- build_epilogue(&ctx); -+ build_epilogue(&ctx, was_classic); - build_plt(&ctx); - - /* 3. Extra pass to validate JITed code. */ -diff --git a/arch/mips/include/asm/ptrace.h b/arch/mips/include/asm/ptrace.h -index 4a2b40ce39e091..841612913f0d1b 100644 ---- a/arch/mips/include/asm/ptrace.h -+++ b/arch/mips/include/asm/ptrace.h -@@ -65,7 +65,8 @@ static inline void instruction_pointer_set(struct pt_regs *regs, - - /* Query offset/name of register from its name/offset */ - extern int regs_query_register_offset(const char *name); --#define MAX_REG_OFFSET (offsetof(struct pt_regs, __last)) -+#define MAX_REG_OFFSET \ -+ (offsetof(struct pt_regs, __last) - sizeof(unsigned long)) - - /** - * regs_get_register() - get register value from its offset -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index d874ea22512b5c..4372657ab0d6fa 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -2610,6 +2610,17 @@ config MITIGATION_SPECTRE_BHI - indirect branches. - See - -+config MITIGATION_ITS -+ bool "Enable Indirect Target Selection mitigation" -+ depends on CPU_SUP_INTEL && X86_64 -+ depends on RETPOLINE && RETHUNK -+ default y -+ help -+ Enable Indirect Target Selection (ITS) mitigation. ITS is a bug in -+ BPU on some Intel CPUs that may allow Spectre V2 style attacks. If -+ disabled, mitigation cannot be enabled via cmdline. -+ See -+ - endif - - config ARCH_HAS_ADD_PAGES -diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S -index 2192b6c33ea009..1f9e508ac075c3 100644 ---- a/arch/x86/entry/entry_64.S -+++ b/arch/x86/entry/entry_64.S -@@ -1569,7 +1569,9 @@ SYM_CODE_END(rewind_stack_and_make_dead) - * ORC to unwind properly. - * - * The alignment is for performance and not for safety, and may be safely -- * refactored in the future if needed. -+ * refactored in the future if needed. The .skips are for safety, to ensure -+ * that all RETs are in the second half of a cacheline to mitigate Indirect -+ * Target Selection, rather than taking the slowpath via its_return_thunk. - */ - SYM_FUNC_START(clear_bhb_loop) - push %rbp -@@ -1579,10 +1581,22 @@ SYM_FUNC_START(clear_bhb_loop) - call 1f - jmp 5f - .align 64, 0xcc -+ /* -+ * Shift instructions so that the RET is in the upper half of the -+ * cacheline and don't take the slowpath to its_return_thunk. -+ */ -+ .skip 32 - (.Lret1 - 1f), 0xcc - ANNOTATE_INTRA_FUNCTION_CALL - 1: call 2f -- RET -+.Lret1: RET - .align 64, 0xcc -+ /* -+ * As above shift instructions for RET at .Lret2 as well. -+ * -+ * This should be ideally be: .skip 32 - (.Lret2 - 2f), 0xcc -+ * but some Clang versions (e.g. 18) don't like this. -+ */ -+ .skip 32 - 18, 0xcc - 2: movl $5, %eax - 3: jmp 4f - nop -@@ -1590,7 +1604,7 @@ SYM_FUNC_START(clear_bhb_loop) - jnz 3b - sub $1, %ecx - jnz 1b -- RET -+.Lret2: RET - 5: lfence - pop %rbp - RET -diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h -index cb9ce0f9e78e05..6740b839153a04 100644 ---- a/arch/x86/include/asm/alternative.h -+++ b/arch/x86/include/asm/alternative.h -@@ -5,6 +5,7 @@ - #include - #include - #include -+#include - - #define ALT_FLAGS_SHIFT 16 - -@@ -130,6 +131,37 @@ static __always_inline int x86_call_depth_emit_accounting(u8 **pprog, - } - #endif - -+#ifdef CONFIG_MITIGATION_ITS -+extern void its_init_mod(struct module *mod); -+extern void its_fini_mod(struct module *mod); -+extern void its_free_mod(struct module *mod); -+extern u8 *its_static_thunk(int reg); -+#else /* CONFIG_MITIGATION_ITS */ -+static inline void its_init_mod(struct module *mod) { } -+static inline void its_fini_mod(struct module *mod) { } -+static inline void its_free_mod(struct module *mod) { } -+static inline u8 *its_static_thunk(int reg) -+{ -+ WARN_ONCE(1, "ITS not compiled in"); -+ -+ return NULL; -+} -+#endif -+ -+#if defined(CONFIG_RETHUNK) && defined(CONFIG_OBJTOOL) -+extern bool cpu_wants_rethunk(void); -+extern bool cpu_wants_rethunk_at(void *addr); -+#else -+static __always_inline bool cpu_wants_rethunk(void) -+{ -+ return false; -+} -+static __always_inline bool cpu_wants_rethunk_at(void *addr) -+{ -+ return false; -+} -+#endif -+ - #ifdef CONFIG_SMP - extern void alternatives_smp_module_add(struct module *mod, char *name, - void *locks, void *locks_end, -diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h -index 55d18eef6775a6..8a2482651a6f1e 100644 ---- a/arch/x86/include/asm/cpufeatures.h -+++ b/arch/x86/include/asm/cpufeatures.h -@@ -468,6 +468,7 @@ - #define X86_FEATURE_BHI_CTRL (21*32+ 2) /* "" BHI_DIS_S HW control available */ - #define X86_FEATURE_CLEAR_BHB_HW (21*32+ 3) /* "" BHI_DIS_S HW control enabled */ - #define X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT (21*32+ 4) /* "" Clear branch history at vmexit using SW loop */ -+#define X86_FEATURE_INDIRECT_THUNK_ITS (21*32 + 5) /* "" Use thunk for indirect branches in lower half of cacheline */ - - /* - * BUG word(s) -@@ -518,4 +519,6 @@ - #define X86_BUG_RFDS X86_BUG(1*32 + 2) /* CPU is vulnerable to Register File Data Sampling */ - #define X86_BUG_BHI X86_BUG(1*32 + 3) /* CPU is affected by Branch History Injection */ - #define X86_BUG_IBPB_NO_RET X86_BUG(1*32 + 4) /* "ibpb_no_ret" IBPB omits return target predictions */ -+#define X86_BUG_ITS X86_BUG(1*32 + 5) /* CPU is affected by Indirect Target Selection */ -+#define X86_BUG_ITS_NATIVE_ONLY X86_BUG(1*32 + 6) /* CPU is affected by ITS, VMX is not affected */ - #endif /* _ASM_X86_CPUFEATURES_H */ -diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h -index 0ee6ed0ff2bf20..79c35947e20cb7 100644 ---- a/arch/x86/include/asm/microcode.h -+++ b/arch/x86/include/asm/microcode.h -@@ -17,10 +17,12 @@ struct ucode_cpu_info { - void load_ucode_bsp(void); - void load_ucode_ap(void); - void microcode_bsp_resume(void); -+bool __init microcode_loader_disabled(void); - #else - static inline void load_ucode_bsp(void) { } - static inline void load_ucode_ap(void) { } - static inline void microcode_bsp_resume(void) { } -+static inline bool __init microcode_loader_disabled(void) { return false; } - #endif - - extern unsigned long initrd_start_early; -diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h -index 623bb48774d44c..9fbad4cb971bff 100644 ---- a/arch/x86/include/asm/msr-index.h -+++ b/arch/x86/include/asm/msr-index.h -@@ -180,6 +180,14 @@ - * VERW clears CPU Register - * File. - */ -+#define ARCH_CAP_ITS_NO BIT_ULL(62) /* -+ * Not susceptible to -+ * Indirect Target Selection. -+ * This bit is not set by -+ * HW, but is synthesized by -+ * VMMs for guests to know -+ * their affected status. -+ */ - - #define ARCH_CAP_XAPIC_DISABLE BIT(21) /* - * IA32_XAPIC_DISABLE_STATUS MSR -diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h -index ee642d26e30457..bc4fa6d09d29d9 100644 ---- a/arch/x86/include/asm/nospec-branch.h -+++ b/arch/x86/include/asm/nospec-branch.h -@@ -219,9 +219,8 @@ - .endm - - /* -- * Equivalent to -mindirect-branch-cs-prefix; emit the 5 byte jmp/call -- * to the retpoline thunk with a CS prefix when the register requires -- * a RAX prefix byte to encode. Also see apply_retpolines(). -+ * Emits a conditional CS prefix that is compatible with -+ * -mindirect-branch-cs-prefix. - */ - .macro __CS_PREFIX reg:req - .irp rs,r8,r9,r10,r11,r12,r13,r14,r15 -@@ -365,10 +364,14 @@ - ".long 999b\n\t" \ - ".popsection\n\t" - -+#define ITS_THUNK_SIZE 64 -+ - typedef u8 retpoline_thunk_t[RETPOLINE_THUNK_SIZE]; -+typedef u8 its_thunk_t[ITS_THUNK_SIZE]; - extern retpoline_thunk_t __x86_indirect_thunk_array[]; - extern retpoline_thunk_t __x86_indirect_call_thunk_array[]; - extern retpoline_thunk_t __x86_indirect_jump_thunk_array[]; -+extern its_thunk_t __x86_indirect_its_thunk_array[]; - - #ifdef CONFIG_RETHUNK - extern void __x86_return_thunk(void); -@@ -392,6 +395,12 @@ static inline void srso_return_thunk(void) {} - static inline void srso_alias_return_thunk(void) {} - #endif - -+#ifdef CONFIG_MITIGATION_ITS -+extern void its_return_thunk(void); -+#else -+static inline void its_return_thunk(void) {} -+#endif -+ - extern void retbleed_return_thunk(void); - extern void srso_return_thunk(void); - extern void srso_alias_return_thunk(void); -@@ -412,11 +421,6 @@ extern void (*x86_return_thunk)(void); - #ifdef CONFIG_CALL_DEPTH_TRACKING - extern void __x86_return_skl(void); - --static inline void x86_set_skl_return_thunk(void) --{ -- x86_return_thunk = &__x86_return_skl; --} -- - #define CALL_DEPTH_ACCOUNT \ - ALTERNATIVE("", \ - __stringify(INCREMENT_CALL_DEPTH), \ -@@ -429,7 +433,6 @@ DECLARE_PER_CPU(u64, __x86_stuffs_count); - DECLARE_PER_CPU(u64, __x86_ctxsw_count); - #endif - #else --static inline void x86_set_skl_return_thunk(void) {} - - #define CALL_DEPTH_ACCOUNT "" - -@@ -454,20 +457,23 @@ static inline void x86_set_skl_return_thunk(void) {} - - #ifdef CONFIG_X86_64 - -+/* -+ * Emits a conditional CS prefix that is compatible with -+ * -mindirect-branch-cs-prefix. -+ */ -+#define __CS_PREFIX(reg) \ -+ ".irp rs,r8,r9,r10,r11,r12,r13,r14,r15\n" \ -+ ".ifc \\rs," reg "\n" \ -+ ".byte 0x2e\n" \ -+ ".endif\n" \ -+ ".endr\n" -+ - /* - * Inline asm uses the %V modifier which is only in newer GCC - * which is ensured when CONFIG_RETPOLINE is defined. - */ --# define CALL_NOSPEC \ -- ALTERNATIVE_2( \ -- ANNOTATE_RETPOLINE_SAFE \ -- "call *%[thunk_target]\n", \ -- "call __x86_indirect_thunk_%V[thunk_target]\n", \ -- X86_FEATURE_RETPOLINE, \ -- "lfence;\n" \ -- ANNOTATE_RETPOLINE_SAFE \ -- "call *%[thunk_target]\n", \ -- X86_FEATURE_RETPOLINE_LFENCE) -+#define CALL_NOSPEC __CS_PREFIX("%V[thunk_target]") \ -+ "call __x86_indirect_thunk_%V[thunk_target]\n" - - # define THUNK_TARGET(addr) [thunk_target] "r" (addr) - -diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c -index aae7456ece0700..4817e424d69658 100644 ---- a/arch/x86/kernel/alternative.c -+++ b/arch/x86/kernel/alternative.c -@@ -18,6 +18,8 @@ - #include - #include - #include -+#include -+#include - #include - #include - #include -@@ -30,6 +32,8 @@ - #include - #include - #include -+#include -+#include - - int __read_mostly alternatives_patched; - -@@ -123,6 +127,135 @@ const unsigned char * const x86_nops[ASM_NOP_MAX+1] = - #endif - }; - -+#ifdef CONFIG_MITIGATION_ITS -+ -+#ifdef CONFIG_MODULES -+static struct module *its_mod; -+static void *its_page; -+static unsigned int its_offset; -+ -+/* Initialize a thunk with the "jmp *reg; int3" instructions. */ -+static void *its_init_thunk(void *thunk, int reg) -+{ -+ u8 *bytes = thunk; -+ int i = 0; -+ -+ if (reg >= 8) { -+ bytes[i++] = 0x41; /* REX.B prefix */ -+ reg -= 8; -+ } -+ bytes[i++] = 0xff; -+ bytes[i++] = 0xe0 + reg; /* jmp *reg */ -+ bytes[i++] = 0xcc; -+ -+ return thunk; -+} -+ -+void its_init_mod(struct module *mod) -+{ -+ if (!cpu_feature_enabled(X86_FEATURE_INDIRECT_THUNK_ITS)) -+ return; -+ -+ mutex_lock(&text_mutex); -+ its_mod = mod; -+ its_page = NULL; -+} -+ -+void its_fini_mod(struct module *mod) -+{ -+ if (!cpu_feature_enabled(X86_FEATURE_INDIRECT_THUNK_ITS)) -+ return; -+ -+ WARN_ON_ONCE(its_mod != mod); -+ -+ its_mod = NULL; -+ its_page = NULL; -+ mutex_unlock(&text_mutex); -+ -+ for (int i = 0; i < mod->its_num_pages; i++) { -+ void *page = mod->its_page_array[i]; -+ set_memory_rox((unsigned long)page, 1); -+ } -+} -+ -+void its_free_mod(struct module *mod) -+{ -+ if (!cpu_feature_enabled(X86_FEATURE_INDIRECT_THUNK_ITS)) -+ return; -+ -+ for (int i = 0; i < mod->its_num_pages; i++) { -+ void *page = mod->its_page_array[i]; -+ module_memfree(page); -+ } -+ kfree(mod->its_page_array); -+} -+ -+DEFINE_FREE(its_execmem, void *, if (_T) module_memfree(_T)); -+ -+static void *its_alloc(void) -+{ -+ void *page __free(its_execmem) = module_alloc(PAGE_SIZE); -+ -+ if (!page) -+ return NULL; -+ -+ if (its_mod) { -+ void *tmp = krealloc(its_mod->its_page_array, -+ (its_mod->its_num_pages+1) * sizeof(void *), -+ GFP_KERNEL); -+ if (!tmp) -+ return NULL; -+ -+ its_mod->its_page_array = tmp; -+ its_mod->its_page_array[its_mod->its_num_pages++] = page; -+ } -+ -+ return no_free_ptr(page); -+} -+ -+static void *its_allocate_thunk(int reg) -+{ -+ int size = 3 + (reg / 8); -+ void *thunk; -+ -+ if (!its_page || (its_offset + size - 1) >= PAGE_SIZE) { -+ its_page = its_alloc(); -+ if (!its_page) { -+ pr_err("ITS page allocation failed\n"); -+ return NULL; -+ } -+ memset(its_page, INT3_INSN_OPCODE, PAGE_SIZE); -+ its_offset = 32; -+ } -+ -+ /* -+ * If the indirect branch instruction will be in the lower half -+ * of a cacheline, then update the offset to reach the upper half. -+ */ -+ if ((its_offset + size - 1) % 64 < 32) -+ its_offset = ((its_offset - 1) | 0x3F) + 33; -+ -+ thunk = its_page + its_offset; -+ its_offset += size; -+ -+ set_memory_rw((unsigned long)its_page, 1); -+ thunk = its_init_thunk(thunk, reg); -+ set_memory_rox((unsigned long)its_page, 1); -+ -+ return thunk; -+} -+ -+#else /* CONFIG_MODULES */ -+ -+static void *its_allocate_thunk(int reg) -+{ -+ return NULL; -+} -+ -+#endif /* CONFIG_MODULES */ -+ -+#endif /* CONFIG_MITIGATION_ITS */ -+ - /* - * Fill the buffer with a single effective instruction of size @len. - * -@@ -521,7 +654,8 @@ static int emit_indirect(int op, int reg, u8 *bytes) - return i; - } - --static int emit_call_track_retpoline(void *addr, struct insn *insn, int reg, u8 *bytes) -+static int __emit_trampoline(void *addr, struct insn *insn, u8 *bytes, -+ void *call_dest, void *jmp_dest) - { - u8 op = insn->opcode.bytes[0]; - int i = 0; -@@ -542,7 +676,7 @@ static int emit_call_track_retpoline(void *addr, struct insn *insn, int reg, u8 - switch (op) { - case CALL_INSN_OPCODE: - __text_gen_insn(bytes+i, op, addr+i, -- __x86_indirect_call_thunk_array[reg], -+ call_dest, - CALL_INSN_SIZE); - i += CALL_INSN_SIZE; - break; -@@ -550,7 +684,7 @@ static int emit_call_track_retpoline(void *addr, struct insn *insn, int reg, u8 - case JMP32_INSN_OPCODE: - clang_jcc: - __text_gen_insn(bytes+i, op, addr+i, -- __x86_indirect_jump_thunk_array[reg], -+ jmp_dest, - JMP32_INSN_SIZE); - i += JMP32_INSN_SIZE; - break; -@@ -565,6 +699,39 @@ static int emit_call_track_retpoline(void *addr, struct insn *insn, int reg, u8 - return i; - } - -+static int emit_call_track_retpoline(void *addr, struct insn *insn, int reg, u8 *bytes) -+{ -+ return __emit_trampoline(addr, insn, bytes, -+ __x86_indirect_call_thunk_array[reg], -+ __x86_indirect_jump_thunk_array[reg]); -+} -+ -+#ifdef CONFIG_MITIGATION_ITS -+static int emit_its_trampoline(void *addr, struct insn *insn, int reg, u8 *bytes) -+{ -+ u8 *thunk = __x86_indirect_its_thunk_array[reg]; -+ u8 *tmp = its_allocate_thunk(reg); -+ -+ if (tmp) -+ thunk = tmp; -+ -+ return __emit_trampoline(addr, insn, bytes, thunk, thunk); -+} -+ -+/* Check if an indirect branch is at ITS-unsafe address */ -+static bool cpu_wants_indirect_its_thunk_at(unsigned long addr, int reg) -+{ -+ if (!cpu_feature_enabled(X86_FEATURE_INDIRECT_THUNK_ITS)) -+ return false; -+ -+ /* Indirect branch opcode is 2 or 3 bytes depending on reg */ -+ addr += 1 + reg / 8; -+ -+ /* Lower-half of the cacheline? */ -+ return !(addr & 0x20); -+} -+#endif -+ - /* - * Rewrite the compiler generated retpoline thunk calls. - * -@@ -639,6 +806,15 @@ static int patch_retpoline(void *addr, struct insn *insn, u8 *bytes) - bytes[i++] = 0xe8; /* LFENCE */ - } - -+#ifdef CONFIG_MITIGATION_ITS -+ /* -+ * Check if the address of last byte of emitted-indirect is in -+ * lower-half of the cacheline. Such branches need ITS mitigation. -+ */ -+ if (cpu_wants_indirect_its_thunk_at((unsigned long)addr + i, reg)) -+ return emit_its_trampoline(addr, insn, reg, bytes); -+#endif -+ - ret = emit_indirect(op, reg, bytes + i); - if (ret < 0) - return ret; -@@ -710,6 +886,21 @@ void __init_or_module noinline apply_retpolines(s32 *start, s32 *end) - - #ifdef CONFIG_RETHUNK - -+bool cpu_wants_rethunk(void) -+{ -+ return cpu_feature_enabled(X86_FEATURE_RETHUNK); -+} -+ -+bool cpu_wants_rethunk_at(void *addr) -+{ -+ if (!cpu_feature_enabled(X86_FEATURE_RETHUNK)) -+ return false; -+ if (x86_return_thunk != its_return_thunk) -+ return true; -+ -+ return !((unsigned long)addr & 0x20); -+} -+ - /* - * Rewrite the compiler generated return thunk tail-calls. - * -@@ -726,7 +917,7 @@ static int patch_return(void *addr, struct insn *insn, u8 *bytes) - int i = 0; - - /* Patch the custom return thunks... */ -- if (cpu_feature_enabled(X86_FEATURE_RETHUNK)) { -+ if (cpu_wants_rethunk_at(addr)) { - i = JMP32_INSN_SIZE; - __text_gen_insn(bytes, JMP32_INSN_OPCODE, addr, x86_return_thunk, i); - } else { -@@ -743,7 +934,7 @@ void __init_or_module noinline apply_returns(s32 *start, s32 *end) - { - s32 *s; - -- if (cpu_feature_enabled(X86_FEATURE_RETHUNK)) -+ if (cpu_wants_rethunk()) - static_call_force_reinit(); - - for (s = start; s < end; s++) { -@@ -1258,6 +1449,13 @@ static void __apply_fineibt(s32 *start_retpoline, s32 *end_retpoline, - static void poison_cfi(void *addr) { } - #endif - -+u8 *its_static_thunk(int reg) -+{ -+ u8 *thunk = __x86_indirect_its_thunk_array[reg]; -+ -+ return thunk; -+} -+ - #endif - - void apply_fineibt(s32 *start_retpoline, s32 *end_retpoline, -@@ -1575,6 +1773,8 @@ static noinline void __init alt_reloc_selftest(void) - - void __init alternative_instructions(void) - { -+ u64 ibt; -+ - int3_selftest(); - - /* -@@ -1612,6 +1812,9 @@ void __init alternative_instructions(void) - */ - paravirt_set_cap(); - -+ /* Keep CET-IBT disabled until caller/callee are patched */ -+ ibt = ibt_save(/*disable*/ true); -+ - /* - * First patch paravirt functions, such that we overwrite the indirect - * call with the direct call. -@@ -1645,6 +1848,8 @@ void __init alternative_instructions(void) - */ - apply_seal_endbr(__ibt_endbr_seal, __ibt_endbr_seal_end); - -+ ibt_restore(ibt); -+ - #ifdef CONFIG_SMP - /* Patch to UP if other cpus not imminent. */ - if (!noreplace_smp && (num_present_cpus() == 1 || setup_max_cpus <= 1)) { -diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c -index 78545f7e9cc6ca..07b45bbf6348de 100644 ---- a/arch/x86/kernel/cpu/bugs.c -+++ b/arch/x86/kernel/cpu/bugs.c -@@ -49,6 +49,7 @@ static void __init srbds_select_mitigation(void); - static void __init l1d_flush_select_mitigation(void); - static void __init srso_select_mitigation(void); - static void __init gds_select_mitigation(void); -+static void __init its_select_mitigation(void); - - /* The base value of the SPEC_CTRL MSR without task-specific bits set */ - u64 x86_spec_ctrl_base; -@@ -67,6 +68,14 @@ static DEFINE_MUTEX(spec_ctrl_mutex); - - void (*x86_return_thunk)(void) __ro_after_init = __x86_return_thunk; - -+static void __init set_return_thunk(void *thunk) -+{ -+ if (x86_return_thunk != __x86_return_thunk) -+ pr_warn("x86/bugs: return thunk changed\n"); -+ -+ x86_return_thunk = thunk; -+} -+ - /* Update SPEC_CTRL MSR and its cached copy unconditionally */ - static void update_spec_ctrl(u64 val) - { -@@ -175,6 +184,7 @@ void __init cpu_select_mitigations(void) - */ - srso_select_mitigation(); - gds_select_mitigation(); -+ its_select_mitigation(); - } - - /* -@@ -1102,7 +1112,7 @@ static void __init retbleed_select_mitigation(void) - setup_force_cpu_cap(X86_FEATURE_RETHUNK); - setup_force_cpu_cap(X86_FEATURE_UNRET); - -- x86_return_thunk = retbleed_return_thunk; -+ set_return_thunk(retbleed_return_thunk); - - if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD && - boot_cpu_data.x86_vendor != X86_VENDOR_HYGON) -@@ -1136,7 +1146,9 @@ static void __init retbleed_select_mitigation(void) - case RETBLEED_MITIGATION_STUFF: - setup_force_cpu_cap(X86_FEATURE_RETHUNK); - setup_force_cpu_cap(X86_FEATURE_CALL_DEPTH); -- x86_set_skl_return_thunk(); -+#ifdef CONFIG_CALL_DEPTH_TRACKING -+ set_return_thunk(&__x86_return_skl); -+#endif - break; - - default: -@@ -1170,6 +1182,146 @@ static void __init retbleed_select_mitigation(void) - pr_info("%s\n", retbleed_strings[retbleed_mitigation]); - } - -+#undef pr_fmt -+#define pr_fmt(fmt) "ITS: " fmt -+ -+enum its_mitigation_cmd { -+ ITS_CMD_OFF, -+ ITS_CMD_ON, -+ ITS_CMD_VMEXIT, -+ ITS_CMD_RSB_STUFF, -+}; -+ -+enum its_mitigation { -+ ITS_MITIGATION_OFF, -+ ITS_MITIGATION_VMEXIT_ONLY, -+ ITS_MITIGATION_ALIGNED_THUNKS, -+ ITS_MITIGATION_RETPOLINE_STUFF, -+}; -+ -+static const char * const its_strings[] = { -+ [ITS_MITIGATION_OFF] = "Vulnerable", -+ [ITS_MITIGATION_VMEXIT_ONLY] = "Mitigation: Vulnerable, KVM: Not affected", -+ [ITS_MITIGATION_ALIGNED_THUNKS] = "Mitigation: Aligned branch/return thunks", -+ [ITS_MITIGATION_RETPOLINE_STUFF] = "Mitigation: Retpolines, Stuffing RSB", -+}; -+ -+static enum its_mitigation its_mitigation __ro_after_init = ITS_MITIGATION_ALIGNED_THUNKS; -+ -+static enum its_mitigation_cmd its_cmd __ro_after_init = -+ IS_ENABLED(CONFIG_MITIGATION_ITS) ? ITS_CMD_ON : ITS_CMD_OFF; -+ -+static int __init its_parse_cmdline(char *str) -+{ -+ if (!str) -+ return -EINVAL; -+ -+ if (!IS_ENABLED(CONFIG_MITIGATION_ITS)) { -+ pr_err("Mitigation disabled at compile time, ignoring option (%s)", str); -+ return 0; -+ } -+ -+ if (!strcmp(str, "off")) { -+ its_cmd = ITS_CMD_OFF; -+ } else if (!strcmp(str, "on")) { -+ its_cmd = ITS_CMD_ON; -+ } else if (!strcmp(str, "force")) { -+ its_cmd = ITS_CMD_ON; -+ setup_force_cpu_bug(X86_BUG_ITS); -+ } else if (!strcmp(str, "vmexit")) { -+ its_cmd = ITS_CMD_VMEXIT; -+ } else if (!strcmp(str, "stuff")) { -+ its_cmd = ITS_CMD_RSB_STUFF; -+ } else { -+ pr_err("Ignoring unknown indirect_target_selection option (%s).", str); -+ } -+ -+ return 0; -+} -+early_param("indirect_target_selection", its_parse_cmdline); -+ -+static void __init its_select_mitigation(void) -+{ -+ enum its_mitigation_cmd cmd = its_cmd; -+ -+ if (!boot_cpu_has_bug(X86_BUG_ITS) || cpu_mitigations_off()) { -+ its_mitigation = ITS_MITIGATION_OFF; -+ return; -+ } -+ -+ /* Retpoline+CDT mitigates ITS, bail out */ -+ if (boot_cpu_has(X86_FEATURE_RETPOLINE) && -+ boot_cpu_has(X86_FEATURE_CALL_DEPTH)) { -+ its_mitigation = ITS_MITIGATION_RETPOLINE_STUFF; -+ goto out; -+ } -+ -+ /* Exit early to avoid irrelevant warnings */ -+ if (cmd == ITS_CMD_OFF) { -+ its_mitigation = ITS_MITIGATION_OFF; -+ goto out; -+ } -+ if (spectre_v2_enabled == SPECTRE_V2_NONE) { -+ pr_err("WARNING: Spectre-v2 mitigation is off, disabling ITS\n"); -+ its_mitigation = ITS_MITIGATION_OFF; -+ goto out; -+ } -+ if (!IS_ENABLED(CONFIG_RETPOLINE) || !IS_ENABLED(CONFIG_RETHUNK)) { -+ pr_err("WARNING: ITS mitigation depends on retpoline and rethunk support\n"); -+ its_mitigation = ITS_MITIGATION_OFF; -+ goto out; -+ } -+ if (IS_ENABLED(CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B)) { -+ pr_err("WARNING: ITS mitigation is not compatible with CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B\n"); -+ its_mitigation = ITS_MITIGATION_OFF; -+ goto out; -+ } -+ if (boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE)) { -+ pr_err("WARNING: ITS mitigation is not compatible with lfence mitigation\n"); -+ its_mitigation = ITS_MITIGATION_OFF; -+ goto out; -+ } -+ -+ if (cmd == ITS_CMD_RSB_STUFF && -+ (!boot_cpu_has(X86_FEATURE_RETPOLINE) || !IS_ENABLED(CONFIG_CALL_DEPTH_TRACKING))) { -+ pr_err("RSB stuff mitigation not supported, using default\n"); -+ cmd = ITS_CMD_ON; -+ } -+ -+ switch (cmd) { -+ case ITS_CMD_OFF: -+ its_mitigation = ITS_MITIGATION_OFF; -+ break; -+ case ITS_CMD_VMEXIT: -+ if (boot_cpu_has_bug(X86_BUG_ITS_NATIVE_ONLY)) { -+ its_mitigation = ITS_MITIGATION_VMEXIT_ONLY; -+ goto out; -+ } -+ fallthrough; -+ case ITS_CMD_ON: -+ its_mitigation = ITS_MITIGATION_ALIGNED_THUNKS; -+ if (!boot_cpu_has(X86_FEATURE_RETPOLINE)) -+ setup_force_cpu_cap(X86_FEATURE_INDIRECT_THUNK_ITS); -+ setup_force_cpu_cap(X86_FEATURE_RETHUNK); -+ set_return_thunk(its_return_thunk); -+ break; -+ case ITS_CMD_RSB_STUFF: -+ its_mitigation = ITS_MITIGATION_RETPOLINE_STUFF; -+ setup_force_cpu_cap(X86_FEATURE_RETHUNK); -+ setup_force_cpu_cap(X86_FEATURE_CALL_DEPTH); -+#ifdef CONFIG_CALL_DEPTH_TRACKING -+ set_return_thunk(&__x86_return_skl); -+#endif -+ if (retbleed_mitigation == RETBLEED_MITIGATION_NONE) { -+ retbleed_mitigation = RETBLEED_MITIGATION_STUFF; -+ pr_info("Retbleed mitigation updated to stuffing\n"); -+ } -+ break; -+ } -+out: -+ pr_info("%s\n", its_strings[its_mitigation]); -+} -+ - #undef pr_fmt - #define pr_fmt(fmt) "Spectre V2 : " fmt - -@@ -1677,10 +1829,11 @@ static void __init bhi_select_mitigation(void) - return; - } - -- if (spec_ctrl_bhi_dis()) -+ if (!IS_ENABLED(CONFIG_X86_64)) - return; - -- if (!IS_ENABLED(CONFIG_X86_64)) -+ /* Mitigate in hardware if supported */ -+ if (spec_ctrl_bhi_dis()) - return; - - /* Mitigate KVM by default */ -@@ -2606,10 +2759,10 @@ static void __init srso_select_mitigation(void) - - if (boot_cpu_data.x86 == 0x19) { - setup_force_cpu_cap(X86_FEATURE_SRSO_ALIAS); -- x86_return_thunk = srso_alias_return_thunk; -+ set_return_thunk(srso_alias_return_thunk); - } else { - setup_force_cpu_cap(X86_FEATURE_SRSO); -- x86_return_thunk = srso_return_thunk; -+ set_return_thunk(srso_return_thunk); - } - if (has_microcode) - srso_mitigation = SRSO_MITIGATION_SAFE_RET; -@@ -2793,6 +2946,11 @@ static ssize_t rfds_show_state(char *buf) - return sysfs_emit(buf, "%s\n", rfds_strings[rfds_mitigation]); - } - -+static ssize_t its_show_state(char *buf) -+{ -+ return sysfs_emit(buf, "%s\n", its_strings[its_mitigation]); -+} -+ - static char *stibp_state(void) - { - if (spectre_v2_in_eibrs_mode(spectre_v2_enabled) && -@@ -2975,6 +3133,9 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr - case X86_BUG_RFDS: - return rfds_show_state(buf); - -+ case X86_BUG_ITS: -+ return its_show_state(buf); -+ - default: - break; - } -@@ -3054,4 +3215,9 @@ ssize_t cpu_show_reg_file_data_sampling(struct device *dev, struct device_attrib - { - return cpu_show_common(dev, attr, buf, X86_BUG_RFDS); - } -+ -+ssize_t cpu_show_indirect_target_selection(struct device *dev, struct device_attribute *attr, char *buf) -+{ -+ return cpu_show_common(dev, attr, buf, X86_BUG_ITS); -+} - #endif -diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index a844110691f978..067e31fb9e165d 100644 ---- a/arch/x86/kernel/cpu/common.c -+++ b/arch/x86/kernel/cpu/common.c -@@ -1272,6 +1272,10 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = { - #define GDS BIT(6) - /* CPU is affected by Register File Data Sampling */ - #define RFDS BIT(7) -+/* CPU is affected by Indirect Target Selection */ -+#define ITS BIT(8) -+/* CPU is affected by Indirect Target Selection, but guest-host isolation is not affected */ -+#define ITS_NATIVE_ONLY BIT(9) - - static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = { - VULNBL_INTEL_STEPPINGS(IVYBRIDGE, X86_STEPPING_ANY, SRBDS), -@@ -1283,22 +1287,25 @@ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = { - VULNBL_INTEL_STEPPINGS(BROADWELL_G, X86_STEPPING_ANY, SRBDS), - VULNBL_INTEL_STEPPINGS(BROADWELL_X, X86_STEPPING_ANY, MMIO), - VULNBL_INTEL_STEPPINGS(BROADWELL, X86_STEPPING_ANY, SRBDS), -- VULNBL_INTEL_STEPPINGS(SKYLAKE_X, X86_STEPPING_ANY, MMIO | RETBLEED | GDS), -+ VULNBL_INTEL_STEPPINGS(SKYLAKE_X, X86_STEPPINGS(0x0, 0x5), MMIO | RETBLEED | GDS), -+ VULNBL_INTEL_STEPPINGS(SKYLAKE_X, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | ITS), - VULNBL_INTEL_STEPPINGS(SKYLAKE_L, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS), - VULNBL_INTEL_STEPPINGS(SKYLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS), -- VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS), -- VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS), -+ VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPINGS(0x0, 0xb), MMIO | RETBLEED | GDS | SRBDS), -+ VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS | ITS), -+ VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPINGS(0x0, 0xc), MMIO | RETBLEED | GDS | SRBDS), -+ VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS | ITS), - VULNBL_INTEL_STEPPINGS(CANNONLAKE_L, X86_STEPPING_ANY, RETBLEED), -- VULNBL_INTEL_STEPPINGS(ICELAKE_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS), -- VULNBL_INTEL_STEPPINGS(ICELAKE_D, X86_STEPPING_ANY, MMIO | GDS), -- VULNBL_INTEL_STEPPINGS(ICELAKE_X, X86_STEPPING_ANY, MMIO | GDS), -- VULNBL_INTEL_STEPPINGS(COMETLAKE, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS), -- VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPINGS(0x0, 0x0), MMIO | RETBLEED), -- VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS), -- VULNBL_INTEL_STEPPINGS(TIGERLAKE_L, X86_STEPPING_ANY, GDS), -- VULNBL_INTEL_STEPPINGS(TIGERLAKE, X86_STEPPING_ANY, GDS), -+ VULNBL_INTEL_STEPPINGS(ICELAKE_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS | ITS | ITS_NATIVE_ONLY), -+ VULNBL_INTEL_STEPPINGS(ICELAKE_D, X86_STEPPING_ANY, MMIO | GDS | ITS | ITS_NATIVE_ONLY), -+ VULNBL_INTEL_STEPPINGS(ICELAKE_X, X86_STEPPING_ANY, MMIO | GDS | ITS | ITS_NATIVE_ONLY), -+ VULNBL_INTEL_STEPPINGS(COMETLAKE, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS | ITS), -+ VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPINGS(0x0, 0x0), MMIO | RETBLEED | ITS), -+ VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS | ITS), -+ VULNBL_INTEL_STEPPINGS(TIGERLAKE_L, X86_STEPPING_ANY, GDS | ITS | ITS_NATIVE_ONLY), -+ VULNBL_INTEL_STEPPINGS(TIGERLAKE, X86_STEPPING_ANY, GDS | ITS | ITS_NATIVE_ONLY), - VULNBL_INTEL_STEPPINGS(LAKEFIELD, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED), -- VULNBL_INTEL_STEPPINGS(ROCKETLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS), -+ VULNBL_INTEL_STEPPINGS(ROCKETLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | ITS | ITS_NATIVE_ONLY), - VULNBL_INTEL_STEPPINGS(ALDERLAKE, X86_STEPPING_ANY, RFDS), - VULNBL_INTEL_STEPPINGS(ALDERLAKE_L, X86_STEPPING_ANY, RFDS), - VULNBL_INTEL_STEPPINGS(RAPTORLAKE, X86_STEPPING_ANY, RFDS), -@@ -1362,6 +1369,32 @@ static bool __init vulnerable_to_rfds(u64 x86_arch_cap_msr) - return cpu_matches(cpu_vuln_blacklist, RFDS); - } - -+static bool __init vulnerable_to_its(u64 x86_arch_cap_msr) -+{ -+ /* The "immunity" bit trumps everything else: */ -+ if (x86_arch_cap_msr & ARCH_CAP_ITS_NO) -+ return false; -+ if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL) -+ return false; -+ -+ /* None of the affected CPUs have BHI_CTRL */ -+ if (boot_cpu_has(X86_FEATURE_BHI_CTRL)) -+ return false; -+ -+ /* -+ * If a VMM did not expose ITS_NO, assume that a guest could -+ * be running on a vulnerable hardware or may migrate to such -+ * hardware. -+ */ -+ if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) -+ return true; -+ -+ if (cpu_matches(cpu_vuln_blacklist, ITS)) -+ return true; -+ -+ return false; -+} -+ - static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c) - { - u64 x86_arch_cap_msr = x86_read_arch_cap_msr(); -@@ -1476,9 +1509,12 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c) - if (vulnerable_to_rfds(x86_arch_cap_msr)) - setup_force_cpu_bug(X86_BUG_RFDS); - -- /* When virtualized, eIBRS could be hidden, assume vulnerable */ -- if (!(x86_arch_cap_msr & ARCH_CAP_BHI_NO) && -- !cpu_matches(cpu_vuln_whitelist, NO_BHI) && -+ /* -+ * Intel parts with eIBRS are vulnerable to BHI attacks. Parts with -+ * BHI_NO still need to use the BHI mitigation to prevent Intra-mode -+ * attacks. When virtualized, eIBRS could be hidden, assume vulnerable. -+ */ -+ if (!cpu_matches(cpu_vuln_whitelist, NO_BHI) && - (boot_cpu_has(X86_FEATURE_IBRS_ENHANCED) || - boot_cpu_has(X86_FEATURE_HYPERVISOR))) - setup_force_cpu_bug(X86_BUG_BHI); -@@ -1486,6 +1522,12 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c) - if (cpu_has(c, X86_FEATURE_AMD_IBPB) && !cpu_has(c, X86_FEATURE_AMD_IBPB_RET)) - setup_force_cpu_bug(X86_BUG_IBPB_NO_RET); - -+ if (vulnerable_to_its(x86_arch_cap_msr)) { -+ setup_force_cpu_bug(X86_BUG_ITS); -+ if (cpu_matches(cpu_vuln_blacklist, ITS_NATIVE_ONLY)) -+ setup_force_cpu_bug(X86_BUG_ITS_NATIVE_ONLY); -+ } -+ - if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN)) - return; - -diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c -index ce78e39004e0ea..9b0570f769eb3d 100644 ---- a/arch/x86/kernel/cpu/microcode/amd.c -+++ b/arch/x86/kernel/cpu/microcode/amd.c -@@ -1102,15 +1102,17 @@ static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t siz - - static int __init save_microcode_in_initrd(void) - { -- unsigned int cpuid_1_eax = native_cpuid_eax(1); - struct cpuinfo_x86 *c = &boot_cpu_data; - struct cont_desc desc = { 0 }; -+ unsigned int cpuid_1_eax; - enum ucode_state ret; - struct cpio_data cp; - -- if (dis_ucode_ldr || c->x86_vendor != X86_VENDOR_AMD || c->x86 < 0x10) -+ if (microcode_loader_disabled() || c->x86_vendor != X86_VENDOR_AMD || c->x86 < 0x10) - return 0; - -+ cpuid_1_eax = native_cpuid_eax(1); -+ - if (!find_blobs_in_containers(&cp)) - return -EINVAL; - -diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c -index c15c7b862bec1c..5b47c320f17a6d 100644 ---- a/arch/x86/kernel/cpu/microcode/core.c -+++ b/arch/x86/kernel/cpu/microcode/core.c -@@ -43,8 +43,8 @@ - - #define DRIVER_VERSION "2.2" - --static struct microcode_ops *microcode_ops; --bool dis_ucode_ldr = true; -+static struct microcode_ops *microcode_ops; -+static bool dis_ucode_ldr = false; - - bool force_minrev = IS_ENABLED(CONFIG_MICROCODE_LATE_FORCE_MINREV); - module_param(force_minrev, bool, S_IRUSR | S_IWUSR); -@@ -91,6 +91,9 @@ static bool amd_check_current_patch_level(void) - u32 lvl, dummy, i; - u32 *levels; - -+ if (x86_cpuid_vendor() != X86_VENDOR_AMD) -+ return false; -+ - native_rdmsr(MSR_AMD64_PATCH_LEVEL, lvl, dummy); - - levels = final_levels; -@@ -102,27 +105,29 @@ static bool amd_check_current_patch_level(void) - return false; - } - --static bool __init check_loader_disabled_bsp(void) -+bool __init microcode_loader_disabled(void) - { -- static const char *__dis_opt_str = "dis_ucode_ldr"; -- const char *cmdline = boot_command_line; -- const char *option = __dis_opt_str; -+ if (dis_ucode_ldr) -+ return true; - - /* -- * CPUID(1).ECX[31]: reserved for hypervisor use. This is still not -- * completely accurate as xen pv guests don't see that CPUID bit set but -- * that's good enough as they don't land on the BSP path anyway. -+ * Disable when: -+ * -+ * 1) The CPU does not support CPUID. -+ * -+ * 2) Bit 31 in CPUID[1]:ECX is clear -+ * The bit is reserved for hypervisor use. This is still not -+ * completely accurate as XEN PV guests don't see that CPUID bit -+ * set, but that's good enough as they don't land on the BSP -+ * path anyway. -+ * -+ * 3) Certain AMD patch levels are not allowed to be -+ * overwritten. - */ -- if (native_cpuid_ecx(1) & BIT(31)) -- return true; -- -- if (x86_cpuid_vendor() == X86_VENDOR_AMD) { -- if (amd_check_current_patch_level()) -- return true; -- } -- -- if (cmdline_find_option_bool(cmdline, option) <= 0) -- dis_ucode_ldr = false; -+ if (!have_cpuid_p() || -+ native_cpuid_ecx(1) & BIT(31) || -+ amd_check_current_patch_level()) -+ dis_ucode_ldr = true; - - return dis_ucode_ldr; - } -@@ -132,7 +137,10 @@ void __init load_ucode_bsp(void) - unsigned int cpuid_1_eax; - bool intel = true; - -- if (!have_cpuid_p()) -+ if (cmdline_find_option_bool(boot_command_line, "dis_ucode_ldr") > 0) -+ dis_ucode_ldr = true; -+ -+ if (microcode_loader_disabled()) - return; - - cpuid_1_eax = native_cpuid_eax(1); -@@ -153,9 +161,6 @@ void __init load_ucode_bsp(void) - return; - } - -- if (check_loader_disabled_bsp()) -- return; -- - if (intel) - load_ucode_intel_bsp(&early_data); - else -@@ -166,6 +171,11 @@ void load_ucode_ap(void) - { - unsigned int cpuid_1_eax; - -+ /* -+ * Can't use microcode_loader_disabled() here - .init section -+ * hell. It doesn't have to either - the BSP variant must've -+ * parsed cmdline already anyway. -+ */ - if (dis_ucode_ldr) - return; - -@@ -817,7 +827,7 @@ static int __init microcode_init(void) - struct cpuinfo_x86 *c = &boot_cpu_data; - int error; - -- if (dis_ucode_ldr) -+ if (microcode_loader_disabled()) - return -EINVAL; - - if (c->x86_vendor == X86_VENDOR_INTEL) -diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c -index 9d7baf2573bcde..4e5a71796fbdb1 100644 ---- a/arch/x86/kernel/cpu/microcode/intel.c -+++ b/arch/x86/kernel/cpu/microcode/intel.c -@@ -389,7 +389,7 @@ static int __init save_builtin_microcode(void) - if (xchg(&ucode_patch_va, NULL) != UCODE_BSP_LOADED) - return 0; - -- if (dis_ucode_ldr || boot_cpu_data.x86_vendor != X86_VENDOR_INTEL) -+ if (microcode_loader_disabled() || boot_cpu_data.x86_vendor != X86_VENDOR_INTEL) - return 0; - - uci.mc = get_microcode_blob(&uci, true); -diff --git a/arch/x86/kernel/cpu/microcode/internal.h b/arch/x86/kernel/cpu/microcode/internal.h -index 21776c529fa97a..54f2b9582a7cec 100644 ---- a/arch/x86/kernel/cpu/microcode/internal.h -+++ b/arch/x86/kernel/cpu/microcode/internal.h -@@ -94,7 +94,6 @@ static inline unsigned int x86_cpuid_family(void) - return x86_family(eax); - } - --extern bool dis_ucode_ldr; - extern bool force_minrev; - - #ifdef CONFIG_CPU_SUP_AMD -diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c -index 12df54ff0e8171..50f8c8a8483be2 100644 ---- a/arch/x86/kernel/ftrace.c -+++ b/arch/x86/kernel/ftrace.c -@@ -363,7 +363,7 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size) - goto fail; - - ip = trampoline + size; -- if (cpu_feature_enabled(X86_FEATURE_RETHUNK)) -+ if (cpu_wants_rethunk_at(ip)) - __text_gen_insn(ip, JMP32_INSN_OPCODE, ip, x86_return_thunk, JMP32_INSN_SIZE); - else - memcpy(ip, retq, sizeof(retq)); -diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c -index de001b2146abf3..375f2d7f1762d4 100644 ---- a/arch/x86/kernel/head32.c -+++ b/arch/x86/kernel/head32.c -@@ -145,10 +145,6 @@ void __init __no_stack_protector mk_early_pgtbl_32(void) - *ptr = (unsigned long)ptep + PAGE_OFFSET; - - #ifdef CONFIG_MICROCODE_INITRD32 -- /* Running on a hypervisor? */ -- if (native_cpuid_ecx(1) & BIT(31)) -- return; -- - params = (struct boot_params *)__pa_nodebug(&boot_params); - if (!params->hdr.ramdisk_size || !params->hdr.ramdisk_image) - return; -diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c -index 5f71a0cf4399a5..cfb7163cf90e95 100644 ---- a/arch/x86/kernel/module.c -+++ b/arch/x86/kernel/module.c -@@ -312,6 +312,9 @@ int module_finalize(const Elf_Ehdr *hdr, - void *pseg = (void *)para->sh_addr; - apply_paravirt(pseg, pseg + para->sh_size); - } -+ -+ its_init_mod(me); -+ - if (retpolines || cfi) { - void *rseg = NULL, *cseg = NULL; - unsigned int rsize = 0, csize = 0; -@@ -332,6 +335,9 @@ int module_finalize(const Elf_Ehdr *hdr, - void *rseg = (void *)retpolines->sh_addr; - apply_retpolines(rseg, rseg + retpolines->sh_size); - } -+ -+ its_fini_mod(me); -+ - if (returns) { - void *rseg = (void *)returns->sh_addr; - apply_returns(rseg, rseg + returns->sh_size); -@@ -379,4 +385,5 @@ int module_finalize(const Elf_Ehdr *hdr, - void module_arch_cleanup(struct module *mod) - { - alternatives_smp_module_del(mod); -+ its_free_mod(mod); - } -diff --git a/arch/x86/kernel/static_call.c b/arch/x86/kernel/static_call.c -index 07961b362e2a0c..bcea882e022f50 100644 ---- a/arch/x86/kernel/static_call.c -+++ b/arch/x86/kernel/static_call.c -@@ -81,7 +81,7 @@ static void __ref __static_call_transform(void *insn, enum insn_type type, - break; - - case RET: -- if (cpu_feature_enabled(X86_FEATURE_RETHUNK)) -+ if (cpu_wants_rethunk_at(insn)) - code = text_gen_insn(JMP32_INSN_OPCODE, insn, x86_return_thunk); - else - code = &retinsn; -@@ -90,7 +90,7 @@ static void __ref __static_call_transform(void *insn, enum insn_type type, - case JCC: - if (!func) { - func = __static_call_return; -- if (cpu_feature_enabled(X86_FEATURE_RETHUNK)) -+ if (cpu_wants_rethunk()) - func = x86_return_thunk; - } - -diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S -index 60eb8baa44d7b7..c57d5df1abc603 100644 ---- a/arch/x86/kernel/vmlinux.lds.S -+++ b/arch/x86/kernel/vmlinux.lds.S -@@ -541,4 +541,14 @@ INIT_PER_CPU(irq_stack_backing_store); - "SRSO function pair won't alias"); - #endif - -+#if defined(CONFIG_MITIGATION_ITS) && !defined(CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B) -+. = ASSERT(__x86_indirect_its_thunk_rax & 0x20, "__x86_indirect_thunk_rax not in second half of cacheline"); -+. = ASSERT(((__x86_indirect_its_thunk_rcx - __x86_indirect_its_thunk_rax) % 64) == 0, "Indirect thunks are not cacheline apart"); -+. = ASSERT(__x86_indirect_its_thunk_array == __x86_indirect_its_thunk_rax, "Gap in ITS thunk array"); -+#endif -+ -+#if defined(CONFIG_MITIGATION_ITS) && !defined(CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B) -+. = ASSERT(its_return_thunk & 0x20, "its_return_thunk not in second half of cacheline"); -+#endif -+ - #endif /* CONFIG_X86_64 */ -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 1eeb01afa40ba9..55185670e0e566 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -1621,7 +1621,7 @@ static bool kvm_is_immutable_feature_msr(u32 msr) - ARCH_CAP_PSCHANGE_MC_NO | ARCH_CAP_TSX_CTRL_MSR | ARCH_CAP_TAA_NO | \ - ARCH_CAP_SBDR_SSDP_NO | ARCH_CAP_FBSDP_NO | ARCH_CAP_PSDP_NO | \ - ARCH_CAP_FB_CLEAR | ARCH_CAP_RRSBA | ARCH_CAP_PBRSB_NO | ARCH_CAP_GDS_NO | \ -- ARCH_CAP_RFDS_NO | ARCH_CAP_RFDS_CLEAR | ARCH_CAP_BHI_NO) -+ ARCH_CAP_RFDS_NO | ARCH_CAP_RFDS_CLEAR | ARCH_CAP_BHI_NO | ARCH_CAP_ITS_NO) - - static u64 kvm_get_arch_capabilities(void) - { -@@ -1655,6 +1655,8 @@ static u64 kvm_get_arch_capabilities(void) - data |= ARCH_CAP_MDS_NO; - if (!boot_cpu_has_bug(X86_BUG_RFDS)) - data |= ARCH_CAP_RFDS_NO; -+ if (!boot_cpu_has_bug(X86_BUG_ITS)) -+ data |= ARCH_CAP_ITS_NO; - - if (!boot_cpu_has(X86_FEATURE_RTM)) { - /* -diff --git a/arch/x86/lib/retpoline.S b/arch/x86/lib/retpoline.S -index ffa51f392e17a3..91ce427d5af191 100644 ---- a/arch/x86/lib/retpoline.S -+++ b/arch/x86/lib/retpoline.S -@@ -360,6 +360,45 @@ SYM_FUNC_END(__x86_return_skl) - - #endif /* CONFIG_CALL_DEPTH_TRACKING */ - -+#ifdef CONFIG_MITIGATION_ITS -+ -+.macro ITS_THUNK reg -+ -+SYM_INNER_LABEL(__x86_indirect_its_thunk_\reg, SYM_L_GLOBAL) -+ UNWIND_HINT_UNDEFINED -+ ANNOTATE_NOENDBR -+ ANNOTATE_RETPOLINE_SAFE -+ jmp *%\reg -+ int3 -+ .align 32, 0xcc /* fill to the end of the line */ -+ .skip 32, 0xcc /* skip to the next upper half */ -+.endm -+ -+/* ITS mitigation requires thunks be aligned to upper half of cacheline */ -+.align 64, 0xcc -+.skip 32, 0xcc -+SYM_CODE_START(__x86_indirect_its_thunk_array) -+ -+#define GEN(reg) ITS_THUNK reg -+#include -+#undef GEN -+ -+ .align 64, 0xcc -+SYM_CODE_END(__x86_indirect_its_thunk_array) -+ -+.align 64, 0xcc -+.skip 32, 0xcc -+SYM_CODE_START(its_return_thunk) -+ UNWIND_HINT_FUNC -+ ANNOTATE_NOENDBR -+ ANNOTATE_UNRET_SAFE -+ ret -+ int3 -+SYM_CODE_END(its_return_thunk) -+EXPORT_SYMBOL(its_return_thunk) -+ -+#endif /* CONFIG_MITIGATION_ITS */ -+ - /* - * This function name is magical and is used by -mfunction-return=thunk-extern - * for the compiler to generate JMPs to it. -diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c -index 4872bb082b1935..20ce6a1bd6c57d 100644 ---- a/arch/x86/mm/tlb.c -+++ b/arch/x86/mm/tlb.c -@@ -630,7 +630,11 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, - - choose_new_asid(next, next_tlb_gen, &new_asid, &need_flush); - -- /* Let nmi_uaccess_okay() know that we're changing CR3. */ -+ /* -+ * Indicate that CR3 is about to change. nmi_uaccess_okay() -+ * and others are sensitive to the window where mm_cpumask(), -+ * CR3 and cpu_tlbstate.loaded_mm are not all in sync. -+ */ - this_cpu_write(cpu_tlbstate.loaded_mm, LOADED_MM_SWITCHING); - barrier(); - } -@@ -900,8 +904,16 @@ static void flush_tlb_func(void *info) - - static bool should_flush_tlb(int cpu, void *data) - { -+ struct mm_struct *loaded_mm = per_cpu(cpu_tlbstate.loaded_mm, cpu); - struct flush_tlb_info *info = data; - -+ /* -+ * Order the 'loaded_mm' and 'is_lazy' against their -+ * write ordering in switch_mm_irqs_off(). Ensure -+ * 'is_lazy' is at least as new as 'loaded_mm'. -+ */ -+ smp_rmb(); -+ - /* Lazy TLB will get flushed at the next context switch. */ - if (per_cpu(cpu_tlbstate_shared.is_lazy, cpu)) - return false; -@@ -910,8 +922,15 @@ static bool should_flush_tlb(int cpu, void *data) - if (!info->mm) - return true; - -+ /* -+ * While switching, the remote CPU could have state from -+ * either the prev or next mm. Assume the worst and flush. -+ */ -+ if (loaded_mm == LOADED_MM_SWITCHING) -+ return true; -+ - /* The target mm is loaded, and the CPU is not lazy. */ -- if (per_cpu(cpu_tlbstate.loaded_mm, cpu) == info->mm) -+ if (loaded_mm == info->mm) - return true; - - /* In cpumask, but not the loaded mm? Periodically remove by flushing. */ -diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c -index a50c99e9b5c01f..07592eef253c21 100644 ---- a/arch/x86/net/bpf_jit_comp.c -+++ b/arch/x86/net/bpf_jit_comp.c -@@ -37,6 +37,8 @@ static u8 *emit_code(u8 *ptr, u32 bytes, unsigned int len) - #define EMIT2(b1, b2) EMIT((b1) + ((b2) << 8), 2) - #define EMIT3(b1, b2, b3) EMIT((b1) + ((b2) << 8) + ((b3) << 16), 3) - #define EMIT4(b1, b2, b3, b4) EMIT((b1) + ((b2) << 8) + ((b3) << 16) + ((b4) << 24), 4) -+#define EMIT5(b1, b2, b3, b4, b5) \ -+ do { EMIT1(b1); EMIT4(b2, b3, b4, b5); } while (0) - - #define EMIT1_off32(b1, off) \ - do { EMIT1(b1); EMIT(off, 4); } while (0) -@@ -470,7 +472,11 @@ static void emit_indirect_jump(u8 **pprog, int reg, u8 *ip) - { - u8 *prog = *pprog; - -- if (cpu_feature_enabled(X86_FEATURE_RETPOLINE_LFENCE)) { -+ if (IS_ENABLED(CONFIG_MITIGATION_ITS) && -+ cpu_feature_enabled(X86_FEATURE_INDIRECT_THUNK_ITS)) { -+ OPTIMIZER_HIDE_VAR(reg); -+ emit_jump(&prog, its_static_thunk(reg), ip); -+ } else if (cpu_feature_enabled(X86_FEATURE_RETPOLINE_LFENCE)) { - EMIT_LFENCE(); - EMIT2(0xFF, 0xE0 + reg); - } else if (cpu_feature_enabled(X86_FEATURE_RETPOLINE)) { -@@ -492,7 +498,7 @@ static void emit_return(u8 **pprog, u8 *ip) - { - u8 *prog = *pprog; - -- if (cpu_feature_enabled(X86_FEATURE_RETHUNK)) { -+ if (cpu_wants_rethunk()) { - emit_jump(&prog, x86_return_thunk, ip); - } else { - EMIT1(0xC3); /* ret */ -@@ -1072,6 +1078,48 @@ static void emit_shiftx(u8 **pprog, u32 dst_reg, u8 src_reg, bool is64, u8 op) - #define RESTORE_TAIL_CALL_CNT(stack) \ - EMIT3_off32(0x48, 0x8B, 0x85, -round_up(stack, 8) - 8) - -+static int emit_spectre_bhb_barrier(u8 **pprog, u8 *ip, -+ struct bpf_prog *bpf_prog) -+{ -+ u8 *prog = *pprog; -+ u8 *func; -+ -+ if (cpu_feature_enabled(X86_FEATURE_CLEAR_BHB_LOOP)) { -+ /* The clearing sequence clobbers eax and ecx. */ -+ EMIT1(0x50); /* push rax */ -+ EMIT1(0x51); /* push rcx */ -+ ip += 2; -+ -+ func = (u8 *)clear_bhb_loop; -+ ip += x86_call_depth_emit_accounting(&prog, func); -+ -+ if (emit_call(&prog, func, ip)) -+ return -EINVAL; -+ EMIT1(0x59); /* pop rcx */ -+ EMIT1(0x58); /* pop rax */ -+ } -+ /* Insert IBHF instruction */ -+ if ((cpu_feature_enabled(X86_FEATURE_CLEAR_BHB_LOOP) && -+ cpu_feature_enabled(X86_FEATURE_HYPERVISOR)) || -+ cpu_feature_enabled(X86_FEATURE_CLEAR_BHB_HW)) { -+ /* -+ * Add an Indirect Branch History Fence (IBHF). IBHF acts as a -+ * fence preventing branch history from before the fence from -+ * affecting indirect branches after the fence. This is -+ * specifically used in cBPF jitted code to prevent Intra-mode -+ * BHI attacks. The IBHF instruction is designed to be a NOP on -+ * hardware that doesn't need or support it. The REP and REX.W -+ * prefixes are required by the microcode, and they also ensure -+ * that the NOP is unlikely to be used in existing code. -+ * -+ * IBHF is not a valid instruction in 32-bit mode. -+ */ -+ EMIT5(0xF3, 0x48, 0x0F, 0x1E, 0xF8); /* ibhf */ -+ } -+ *pprog = prog; -+ return 0; -+} -+ - static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image, u8 *rw_image, - int oldproglen, struct jit_context *ctx, bool jmp_padding) - { -@@ -1945,6 +1993,15 @@ st: if (is_imm8(insn->off)) - seen_exit = true; - /* Update cleanup_addr */ - ctx->cleanup_addr = proglen; -+ -+ if (bpf_prog_was_classic(bpf_prog) && -+ !capable(CAP_SYS_ADMIN)) { -+ u8 *ip = image + addrs[i - 1]; -+ -+ if (emit_spectre_bhb_barrier(&prog, ip, bpf_prog)) -+ return -EINVAL; -+ } -+ - pop_callee_regs(&prog, callee_regs_used); - EMIT1(0xC9); /* leave */ - emit_return(&prog, image + addrs[i - 1] + (prog - temp)); -diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c -index ef427ee787a99b..a5cfc1bfad51fb 100644 ---- a/drivers/base/cpu.c -+++ b/drivers/base/cpu.c -@@ -566,6 +566,7 @@ CPU_SHOW_VULN_FALLBACK(retbleed); - CPU_SHOW_VULN_FALLBACK(spec_rstack_overflow); - CPU_SHOW_VULN_FALLBACK(gds); - CPU_SHOW_VULN_FALLBACK(reg_file_data_sampling); -+CPU_SHOW_VULN_FALLBACK(indirect_target_selection); - - static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); - static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL); -@@ -581,6 +582,7 @@ static DEVICE_ATTR(retbleed, 0444, cpu_show_retbleed, NULL); - static DEVICE_ATTR(spec_rstack_overflow, 0444, cpu_show_spec_rstack_overflow, NULL); - static DEVICE_ATTR(gather_data_sampling, 0444, cpu_show_gds, NULL); - static DEVICE_ATTR(reg_file_data_sampling, 0444, cpu_show_reg_file_data_sampling, NULL); -+static DEVICE_ATTR(indirect_target_selection, 0444, cpu_show_indirect_target_selection, NULL); - - static struct attribute *cpu_root_vulnerabilities_attrs[] = { - &dev_attr_meltdown.attr, -@@ -597,6 +599,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = { - &dev_attr_spec_rstack_overflow.attr, - &dev_attr_gather_data_sampling.attr, - &dev_attr_reg_file_data_sampling.attr, -+ &dev_attr_indirect_target_selection.attr, - NULL - }; - -diff --git a/drivers/clocksource/i8253.c b/drivers/clocksource/i8253.c -index 39f7c2d736d169..b603c25f3dfaac 100644 ---- a/drivers/clocksource/i8253.c -+++ b/drivers/clocksource/i8253.c -@@ -103,7 +103,7 @@ int __init clocksource_i8253_init(void) - #ifdef CONFIG_CLKEVT_I8253 - void clockevent_i8253_disable(void) - { -- raw_spin_lock(&i8253_lock); -+ guard(raw_spinlock_irqsave)(&i8253_lock); - - /* - * Writing the MODE register should stop the counter, according to -@@ -132,8 +132,6 @@ void clockevent_i8253_disable(void) - outb_p(0, PIT_CH0); - - outb_p(0x30, PIT_MODE); -- -- raw_spin_unlock(&i8253_lock); - } - - static int pit_shutdown(struct clock_event_device *evt) -diff --git a/drivers/gpu/drm/amd/amdgpu/hdp_v4_0.c b/drivers/gpu/drm/amd/amdgpu/hdp_v4_0.c -index 30210613dc5c47..2f3054ed7b1b5b 100644 ---- a/drivers/gpu/drm/amd/amdgpu/hdp_v4_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/hdp_v4_0.c -@@ -42,7 +42,12 @@ static void hdp_v4_0_flush_hdp(struct amdgpu_device *adev, - { - if (!ring || !ring->funcs->emit_wreg) { - WREG32((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0); -- RREG32((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2); -+ /* We just need to read back a register to post the write. -+ * Reading back the remapped register causes problems on -+ * some platforms so just read back the memory size register. -+ */ -+ if (adev->nbio.funcs->get_memsize) -+ adev->nbio.funcs->get_memsize(adev); - } else { - amdgpu_ring_emit_wreg(ring, (adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0); - } -diff --git a/drivers/gpu/drm/amd/amdgpu/hdp_v5_0.c b/drivers/gpu/drm/amd/amdgpu/hdp_v5_0.c -index d3962d46908811..40705e13ca567b 100644 ---- a/drivers/gpu/drm/amd/amdgpu/hdp_v5_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/hdp_v5_0.c -@@ -33,7 +33,12 @@ static void hdp_v5_0_flush_hdp(struct amdgpu_device *adev, - { - if (!ring || !ring->funcs->emit_wreg) { - WREG32((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0); -- RREG32((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2); -+ /* We just need to read back a register to post the write. -+ * Reading back the remapped register causes problems on -+ * some platforms so just read back the memory size register. -+ */ -+ if (adev->nbio.funcs->get_memsize) -+ adev->nbio.funcs->get_memsize(adev); - } else { - amdgpu_ring_emit_wreg(ring, (adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0); - } -diff --git a/drivers/gpu/drm/amd/amdgpu/hdp_v5_2.c b/drivers/gpu/drm/amd/amdgpu/hdp_v5_2.c -index f52552c5fa27b6..6b9f2e1d9d690d 100644 ---- a/drivers/gpu/drm/amd/amdgpu/hdp_v5_2.c -+++ b/drivers/gpu/drm/amd/amdgpu/hdp_v5_2.c -@@ -34,7 +34,17 @@ static void hdp_v5_2_flush_hdp(struct amdgpu_device *adev, - if (!ring || !ring->funcs->emit_wreg) { - WREG32_NO_KIQ((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, - 0); -- RREG32_NO_KIQ((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2); -+ if (amdgpu_sriov_vf(adev)) { -+ /* this is fine because SR_IOV doesn't remap the register */ -+ RREG32_NO_KIQ((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2); -+ } else { -+ /* We just need to read back a register to post the write. -+ * Reading back the remapped register causes problems on -+ * some platforms so just read back the memory size register. -+ */ -+ if (adev->nbio.funcs->get_memsize) -+ adev->nbio.funcs->get_memsize(adev); -+ } - } else { - amdgpu_ring_emit_wreg(ring, - (adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, -diff --git a/drivers/gpu/drm/amd/amdgpu/hdp_v6_0.c b/drivers/gpu/drm/amd/amdgpu/hdp_v6_0.c -index b6d71ec1debf9a..0d0c568f383931 100644 ---- a/drivers/gpu/drm/amd/amdgpu/hdp_v6_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/hdp_v6_0.c -@@ -33,7 +33,12 @@ static void hdp_v6_0_flush_hdp(struct amdgpu_device *adev, - { - if (!ring || !ring->funcs->emit_wreg) { - WREG32((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0); -- RREG32((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2); -+ /* We just need to read back a register to post the write. -+ * Reading back the remapped register causes problems on -+ * some platforms so just read back the memory size register. -+ */ -+ if (adev->nbio.funcs->get_memsize) -+ adev->nbio.funcs->get_memsize(adev); - } else { - amdgpu_ring_emit_wreg(ring, (adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0); - } -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index e6bc590533194d..f6017be8f9957e 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -610,15 +610,21 @@ static void dm_crtc_high_irq(void *interrupt_params) - spin_lock_irqsave(&adev_to_drm(adev)->event_lock, flags); - - if (acrtc->dm_irq_params.stream && -- acrtc->dm_irq_params.vrr_params.supported && -- acrtc->dm_irq_params.freesync_config.state == -- VRR_STATE_ACTIVE_VARIABLE) { -+ acrtc->dm_irq_params.vrr_params.supported) { -+ bool replay_en = acrtc->dm_irq_params.stream->link->replay_settings.replay_feature_enabled; -+ bool psr_en = acrtc->dm_irq_params.stream->link->psr_settings.psr_feature_enabled; -+ bool fs_active_var_en = acrtc->dm_irq_params.freesync_config.state == VRR_STATE_ACTIVE_VARIABLE; -+ - mod_freesync_handle_v_update(adev->dm.freesync_module, - acrtc->dm_irq_params.stream, - &acrtc->dm_irq_params.vrr_params); - -- dc_stream_adjust_vmin_vmax(adev->dm.dc, acrtc->dm_irq_params.stream, -- &acrtc->dm_irq_params.vrr_params.adjust); -+ /* update vmin_vmax only if freesync is enabled, or only if PSR and REPLAY are disabled */ -+ if (fs_active_var_en || (!fs_active_var_en && !replay_en && !psr_en)) { -+ dc_stream_adjust_vmin_vmax(adev->dm.dc, -+ acrtc->dm_irq_params.stream, -+ &acrtc->dm_irq_params.vrr_params.adjust); -+ } - } - - /* -@@ -11049,7 +11055,7 @@ int amdgpu_dm_process_dmub_aux_transfer_sync( - * Transient states before tunneling is enabled could - * lead to this error. We can ignore this for now. - */ -- if (p_notify->result != AUX_RET_ERROR_PROTOCOL_ERROR) { -+ if (p_notify->result == AUX_RET_ERROR_PROTOCOL_ERROR) { - DRM_WARN("DPIA AUX failed on 0x%x(%d), error %d\n", - payload->address, payload->length, - p_notify->result); -@@ -11058,22 +11064,14 @@ int amdgpu_dm_process_dmub_aux_transfer_sync( - goto out; - } - -+ payload->reply[0] = adev->dm.dmub_notify->aux_reply.command & 0xF; -+ if (adev->dm.dmub_notify->aux_reply.command & 0xF0) -+ /* The reply is stored in the top nibble of the command. */ -+ payload->reply[0] = (adev->dm.dmub_notify->aux_reply.command >> 4) & 0xF; - -- payload->reply[0] = adev->dm.dmub_notify->aux_reply.command; -- if (!payload->write && p_notify->aux_reply.length && -- (payload->reply[0] == AUX_TRANSACTION_REPLY_AUX_ACK)) { -- -- if (payload->length != p_notify->aux_reply.length) { -- DRM_WARN("invalid read length %d from DPIA AUX 0x%x(%d)!\n", -- p_notify->aux_reply.length, -- payload->address, payload->length); -- *operation_result = AUX_RET_ERROR_INVALID_REPLY; -- goto out; -- } -- -+ if (!payload->write && p_notify->aux_reply.length) - memcpy(payload->data, p_notify->aux_reply.data, - p_notify->aux_reply.length); -- } - - /* success */ - ret = p_notify->aux_reply.length; -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -index 5858e288b3fd66..c0cacd501c83eb 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -@@ -48,6 +48,9 @@ - - #define PEAK_FACTOR_X1000 1006 - -+/* -+ * This function handles both native AUX and I2C-Over-AUX transactions. -+ */ - static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux, - struct drm_dp_aux_msg *msg) - { -@@ -84,15 +87,25 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux, - if (adev->dm.aux_hpd_discon_quirk) { - if (msg->address == DP_SIDEBAND_MSG_DOWN_REQ_BASE && - operation_result == AUX_RET_ERROR_HPD_DISCON) { -- result = 0; -+ result = msg->size; - operation_result = AUX_RET_SUCCESS; - } - } - -- if (payload.write && result >= 0) -- result = msg->size; -+ /* -+ * result equals to 0 includes the cases of AUX_DEFER/I2C_DEFER -+ */ -+ if (payload.write && result >= 0) { -+ if (result) { -+ /*one byte indicating partially written bytes. Force 0 to retry*/ -+ drm_info(adev_to_drm(adev), "amdgpu: AUX partially written\n"); -+ result = 0; -+ } else if (!payload.reply[0]) -+ /*I2C_ACK|AUX_ACK*/ -+ result = msg->size; -+ } - -- if (result < 0) -+ if (result < 0) { - switch (operation_result) { - case AUX_RET_SUCCESS: - break; -@@ -111,6 +124,13 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux, - break; - } - -+ drm_info(adev_to_drm(adev), "amdgpu: DP AUX transfer fail:%d\n", operation_result); -+ } -+ -+ if (payload.reply[0]) -+ drm_info(adev_to_drm(adev), "amdgpu: AUX reply command not ACK: 0x%02x.", -+ payload.reply[0]); -+ - return result; - } - -diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c -index 37fe54c34b141c..0d69098eddd90f 100644 ---- a/drivers/gpu/drm/panel/panel-simple.c -+++ b/drivers/gpu/drm/panel/panel-simple.c -@@ -979,27 +979,28 @@ static const struct panel_desc auo_g070vvn01 = { - }, - }; - --static const struct drm_display_mode auo_g101evn010_mode = { -- .clock = 68930, -- .hdisplay = 1280, -- .hsync_start = 1280 + 82, -- .hsync_end = 1280 + 82 + 2, -- .htotal = 1280 + 82 + 2 + 84, -- .vdisplay = 800, -- .vsync_start = 800 + 8, -- .vsync_end = 800 + 8 + 2, -- .vtotal = 800 + 8 + 2 + 6, -+static const struct display_timing auo_g101evn010_timing = { -+ .pixelclock = { 64000000, 68930000, 85000000 }, -+ .hactive = { 1280, 1280, 1280 }, -+ .hfront_porch = { 8, 64, 256 }, -+ .hback_porch = { 8, 64, 256 }, -+ .hsync_len = { 40, 168, 767 }, -+ .vactive = { 800, 800, 800 }, -+ .vfront_porch = { 4, 8, 100 }, -+ .vback_porch = { 4, 8, 100 }, -+ .vsync_len = { 8, 16, 223 }, - }; - - static const struct panel_desc auo_g101evn010 = { -- .modes = &auo_g101evn010_mode, -- .num_modes = 1, -+ .timings = &auo_g101evn010_timing, -+ .num_timings = 1, - .bpc = 6, - .size = { - .width = 216, - .height = 135, - }, - .bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG, -+ .bus_flags = DRM_BUS_FLAG_DE_HIGH, - .connector_type = DRM_MODE_CONNECTOR_LVDS, - }; - -diff --git a/drivers/gpu/drm/v3d/v3d_sched.c b/drivers/gpu/drm/v3d/v3d_sched.c -index 5b729013fd26f5..41493cf3d03b81 100644 ---- a/drivers/gpu/drm/v3d/v3d_sched.c -+++ b/drivers/gpu/drm/v3d/v3d_sched.c -@@ -289,11 +289,16 @@ v3d_gpu_reset_for_timeout(struct v3d_dev *v3d, struct drm_sched_job *sched_job) - return DRM_GPU_SCHED_STAT_NOMINAL; - } - --/* If the current address or return address have changed, then the GPU -- * has probably made progress and we should delay the reset. This -- * could fail if the GPU got in an infinite loop in the CL, but that -- * is pretty unlikely outside of an i-g-t testcase. -- */ -+static void -+v3d_sched_skip_reset(struct drm_sched_job *sched_job) -+{ -+ struct drm_gpu_scheduler *sched = sched_job->sched; -+ -+ spin_lock(&sched->job_list_lock); -+ list_add(&sched_job->list, &sched->pending_list); -+ spin_unlock(&sched->job_list_lock); -+} -+ - static enum drm_gpu_sched_stat - v3d_cl_job_timedout(struct drm_sched_job *sched_job, enum v3d_queue q, - u32 *timedout_ctca, u32 *timedout_ctra) -@@ -303,9 +308,16 @@ v3d_cl_job_timedout(struct drm_sched_job *sched_job, enum v3d_queue q, - u32 ctca = V3D_CORE_READ(0, V3D_CLE_CTNCA(q)); - u32 ctra = V3D_CORE_READ(0, V3D_CLE_CTNRA(q)); - -+ /* If the current address or return address have changed, then the GPU -+ * has probably made progress and we should delay the reset. This -+ * could fail if the GPU got in an infinite loop in the CL, but that -+ * is pretty unlikely outside of an i-g-t testcase. -+ */ - if (*timedout_ctca != ctca || *timedout_ctra != ctra) { - *timedout_ctca = ctca; - *timedout_ctra = ctra; -+ -+ v3d_sched_skip_reset(sched_job); - return DRM_GPU_SCHED_STAT_NOMINAL; - } - -@@ -345,11 +357,13 @@ v3d_csd_job_timedout(struct drm_sched_job *sched_job) - struct v3d_dev *v3d = job->base.v3d; - u32 batches = V3D_CORE_READ(0, V3D_CSD_CURRENT_CFG4); - -- /* If we've made progress, skip reset and let the timer get -- * rearmed. -+ /* If we've made progress, skip reset, add the job to the pending -+ * list, and let the timer get rearmed. - */ - if (job->timedout_batches != batches) { - job->timedout_batches = batches; -+ -+ v3d_sched_skip_reset(sched_job); - return DRM_GPU_SCHED_STAT_NOMINAL; - } - -diff --git a/drivers/iio/accel/adis16201.c b/drivers/iio/accel/adis16201.c -index d054721859b3b5..99b05548b7bdbb 100644 ---- a/drivers/iio/accel/adis16201.c -+++ b/drivers/iio/accel/adis16201.c -@@ -211,9 +211,9 @@ static const struct iio_chan_spec adis16201_channels[] = { - BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 14), - ADIS_AUX_ADC_CHAN(ADIS16201_AUX_ADC_REG, ADIS16201_SCAN_AUX_ADC, 0, 12), - ADIS_INCLI_CHAN(X, ADIS16201_XINCL_OUT_REG, ADIS16201_SCAN_INCLI_X, -- BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 14), -+ BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 12), - ADIS_INCLI_CHAN(Y, ADIS16201_YINCL_OUT_REG, ADIS16201_SCAN_INCLI_Y, -- BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 14), -+ BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 12), - IIO_CHAN_SOFT_TIMESTAMP(7) - }; - -diff --git a/drivers/iio/accel/adxl355_core.c b/drivers/iio/accel/adxl355_core.c -index 0c9225d18fb29b..4973e8da5399d7 100644 ---- a/drivers/iio/accel/adxl355_core.c -+++ b/drivers/iio/accel/adxl355_core.c -@@ -231,7 +231,7 @@ struct adxl355_data { - u8 transf_buf[3]; - struct { - u8 buf[14]; -- s64 ts; -+ aligned_s64 ts; - } buffer; - } __aligned(IIO_DMA_MINALIGN); - }; -diff --git a/drivers/iio/accel/adxl367.c b/drivers/iio/accel/adxl367.c -index 484fe2e9fb1742..3a55475691de39 100644 ---- a/drivers/iio/accel/adxl367.c -+++ b/drivers/iio/accel/adxl367.c -@@ -620,18 +620,14 @@ static int _adxl367_set_odr(struct adxl367_state *st, enum adxl367_odr odr) - if (ret) - return ret; - -+ st->odr = odr; -+ - /* Activity timers depend on ODR */ - ret = _adxl367_set_act_time_ms(st, st->act_time_ms); - if (ret) - return ret; - -- ret = _adxl367_set_inact_time_ms(st, st->inact_time_ms); -- if (ret) -- return ret; -- -- st->odr = odr; -- -- return 0; -+ return _adxl367_set_inact_time_ms(st, st->inact_time_ms); - } - - static int adxl367_set_odr(struct iio_dev *indio_dev, enum adxl367_odr odr) -diff --git a/drivers/iio/adc/ad7606_spi.c b/drivers/iio/adc/ad7606_spi.c -index 287a0591533b6a..67c96572cecc40 100644 ---- a/drivers/iio/adc/ad7606_spi.c -+++ b/drivers/iio/adc/ad7606_spi.c -@@ -127,7 +127,7 @@ static int ad7606_spi_reg_read(struct ad7606_state *st, unsigned int addr) - { - .tx_buf = &st->d16[0], - .len = 2, -- .cs_change = 0, -+ .cs_change = 1, - }, { - .rx_buf = &st->d16[1], - .len = 2, -diff --git a/drivers/iio/adc/dln2-adc.c b/drivers/iio/adc/dln2-adc.c -index 97d162a3cba4ea..49a2588e7431ed 100644 ---- a/drivers/iio/adc/dln2-adc.c -+++ b/drivers/iio/adc/dln2-adc.c -@@ -483,7 +483,7 @@ static irqreturn_t dln2_adc_trigger_h(int irq, void *p) - struct iio_dev *indio_dev = pf->indio_dev; - struct { - __le16 values[DLN2_ADC_MAX_CHANNELS]; -- int64_t timestamp_space; -+ aligned_s64 timestamp_space; - } data; - struct dln2_adc_get_all_vals dev_data; - struct dln2_adc *dln2 = iio_priv(indio_dev); -diff --git a/drivers/iio/adc/rockchip_saradc.c b/drivers/iio/adc/rockchip_saradc.c -index 929cba215d99ab..7b4eb4a200df81 100644 ---- a/drivers/iio/adc/rockchip_saradc.c -+++ b/drivers/iio/adc/rockchip_saradc.c -@@ -485,15 +485,6 @@ static int rockchip_saradc_probe(struct platform_device *pdev) - if (info->reset) - rockchip_saradc_reset_controller(info->reset); - -- /* -- * Use a default value for the converter clock. -- * This may become user-configurable in the future. -- */ -- ret = clk_set_rate(info->clk, info->data->clk_rate); -- if (ret < 0) -- return dev_err_probe(&pdev->dev, ret, -- "failed to set adc clk rate\n"); -- - ret = regulator_enable(info->vref); - if (ret < 0) - return dev_err_probe(&pdev->dev, ret, -@@ -520,6 +511,14 @@ static int rockchip_saradc_probe(struct platform_device *pdev) - if (IS_ERR(info->clk)) - return dev_err_probe(&pdev->dev, PTR_ERR(info->clk), - "failed to get adc clock\n"); -+ /* -+ * Use a default value for the converter clock. -+ * This may become user-configurable in the future. -+ */ -+ ret = clk_set_rate(info->clk, info->data->clk_rate); -+ if (ret < 0) -+ return dev_err_probe(&pdev->dev, ret, -+ "failed to set adc clk rate\n"); - - platform_set_drvdata(pdev, indio_dev); - -diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c -index 066fe561c5e88d..b8119fa4768eb8 100644 ---- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c -+++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c -@@ -370,6 +370,9 @@ int st_lsm6dsx_read_fifo(struct st_lsm6dsx_hw *hw) - if (fifo_status & cpu_to_le16(ST_LSM6DSX_FIFO_EMPTY_MASK)) - return 0; - -+ if (!pattern_len) -+ pattern_len = ST_LSM6DSX_SAMPLE_SIZE; -+ - fifo_len = (le16_to_cpu(fifo_status) & fifo_diff_mask) * - ST_LSM6DSX_CHAN_SIZE; - fifo_len = (fifo_len / pattern_len) * pattern_len; -@@ -601,6 +604,9 @@ int st_lsm6dsx_read_tagged_fifo(struct st_lsm6dsx_hw *hw) - if (!fifo_len) - return 0; - -+ if (!pattern_len) -+ pattern_len = ST_LSM6DSX_TAGGED_SAMPLE_SIZE; -+ - for (read_len = 0; read_len < fifo_len; read_len += pattern_len) { - err = st_lsm6dsx_read_block(hw, - ST_LSM6DSX_REG_FIFO_OUT_TAG_ADDR, -diff --git a/drivers/iio/temperature/maxim_thermocouple.c b/drivers/iio/temperature/maxim_thermocouple.c -index c28a7a6dea5f12..555a61e2f3fdd1 100644 ---- a/drivers/iio/temperature/maxim_thermocouple.c -+++ b/drivers/iio/temperature/maxim_thermocouple.c -@@ -121,9 +121,9 @@ static const struct maxim_thermocouple_chip maxim_thermocouple_chips[] = { - struct maxim_thermocouple_data { - struct spi_device *spi; - const struct maxim_thermocouple_chip *chip; -+ char tc_type; - - u8 buffer[16] __aligned(IIO_DMA_MINALIGN); -- char tc_type; - }; - - static int maxim_thermocouple_read(struct maxim_thermocouple_data *data, -diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c -index b91467c8e6c402..c65321964131cf 100644 ---- a/drivers/input/joystick/xpad.c -+++ b/drivers/input/joystick/xpad.c -@@ -77,12 +77,13 @@ - * xbox d-pads should map to buttons, as is required for DDR pads - * but we map them to axes when possible to simplify things - */ --#define MAP_DPAD_TO_BUTTONS (1 << 0) --#define MAP_TRIGGERS_TO_BUTTONS (1 << 1) --#define MAP_STICKS_TO_NULL (1 << 2) --#define MAP_SELECT_BUTTON (1 << 3) --#define MAP_PADDLES (1 << 4) --#define MAP_PROFILE_BUTTON (1 << 5) -+#define MAP_DPAD_TO_BUTTONS BIT(0) -+#define MAP_TRIGGERS_TO_BUTTONS BIT(1) -+#define MAP_STICKS_TO_NULL BIT(2) -+#define MAP_SHARE_BUTTON BIT(3) -+#define MAP_PADDLES BIT(4) -+#define MAP_PROFILE_BUTTON BIT(5) -+#define MAP_SHARE_OFFSET BIT(6) - - #define DANCEPAD_MAP_CONFIG (MAP_DPAD_TO_BUTTONS | \ - MAP_TRIGGERS_TO_BUTTONS | MAP_STICKS_TO_NULL) -@@ -135,7 +136,7 @@ static const struct xpad_device { - { 0x03f0, 0x048D, "HyperX Clutch", 0, XTYPE_XBOX360 }, /* wireless */ - { 0x03f0, 0x0495, "HyperX Clutch Gladiate", 0, XTYPE_XBOXONE }, - { 0x03f0, 0x07A0, "HyperX Clutch Gladiate RGB", 0, XTYPE_XBOXONE }, -- { 0x03f0, 0x08B6, "HyperX Clutch Gladiate", 0, XTYPE_XBOXONE }, /* v2 */ -+ { 0x03f0, 0x08B6, "HyperX Clutch Gladiate", MAP_SHARE_BUTTON, XTYPE_XBOXONE }, /* v2 */ - { 0x03f0, 0x09B4, "HyperX Clutch Tanto", 0, XTYPE_XBOXONE }, - { 0x044f, 0x0f00, "Thrustmaster Wheel", 0, XTYPE_XBOX }, - { 0x044f, 0x0f03, "Thrustmaster Wheel", 0, XTYPE_XBOX }, -@@ -159,7 +160,7 @@ static const struct xpad_device { - { 0x045e, 0x0719, "Xbox 360 Wireless Receiver", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W }, - { 0x045e, 0x0b00, "Microsoft X-Box One Elite 2 pad", MAP_PADDLES, XTYPE_XBOXONE }, - { 0x045e, 0x0b0a, "Microsoft X-Box Adaptive Controller", MAP_PROFILE_BUTTON, XTYPE_XBOXONE }, -- { 0x045e, 0x0b12, "Microsoft Xbox Series S|X Controller", MAP_SELECT_BUTTON, XTYPE_XBOXONE }, -+ { 0x045e, 0x0b12, "Microsoft Xbox Series S|X Controller", MAP_SHARE_BUTTON | MAP_SHARE_OFFSET, XTYPE_XBOXONE }, - { 0x046d, 0xc21d, "Logitech Gamepad F310", 0, XTYPE_XBOX360 }, - { 0x046d, 0xc21e, "Logitech Gamepad F510", 0, XTYPE_XBOX360 }, - { 0x046d, 0xc21f, "Logitech Gamepad F710", 0, XTYPE_XBOX360 }, -@@ -205,13 +206,13 @@ static const struct xpad_device { - { 0x0738, 0x9871, "Mad Catz Portable Drum", 0, XTYPE_XBOX360 }, - { 0x0738, 0xb726, "Mad Catz Xbox controller - MW2", 0, XTYPE_XBOX360 }, - { 0x0738, 0xb738, "Mad Catz MVC2TE Stick 2", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -- { 0x0738, 0xbeef, "Mad Catz JOYTECH NEO SE Advanced GamePad", XTYPE_XBOX360 }, -+ { 0x0738, 0xbeef, "Mad Catz JOYTECH NEO SE Advanced GamePad", 0, XTYPE_XBOX360 }, - { 0x0738, 0xcb02, "Saitek Cyborg Rumble Pad - PC/Xbox 360", 0, XTYPE_XBOX360 }, - { 0x0738, 0xcb03, "Saitek P3200 Rumble Pad - PC/Xbox 360", 0, XTYPE_XBOX360 }, - { 0x0738, 0xcb29, "Saitek Aviator Stick AV8R02", 0, XTYPE_XBOX360 }, - { 0x0738, 0xf738, "Super SFIV FightStick TE S", 0, XTYPE_XBOX360 }, - { 0x07ff, 0xffff, "Mad Catz GamePad", 0, XTYPE_XBOX360 }, -- { 0x0b05, 0x1a38, "ASUS ROG RAIKIRI", 0, XTYPE_XBOXONE }, -+ { 0x0b05, 0x1a38, "ASUS ROG RAIKIRI", MAP_SHARE_BUTTON, XTYPE_XBOXONE }, - { 0x0b05, 0x1abb, "ASUS ROG RAIKIRI PRO", 0, XTYPE_XBOXONE }, - { 0x0c12, 0x0005, "Intec wireless", 0, XTYPE_XBOX }, - { 0x0c12, 0x8801, "Nyko Xbox Controller", 0, XTYPE_XBOX }, -@@ -240,7 +241,7 @@ static const struct xpad_device { - { 0x0e6f, 0x0146, "Rock Candy Wired Controller for Xbox One", 0, XTYPE_XBOXONE }, - { 0x0e6f, 0x0147, "PDP Marvel Xbox One Controller", 0, XTYPE_XBOXONE }, - { 0x0e6f, 0x015c, "PDP Xbox One Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, -- { 0x0e6f, 0x015d, "PDP Mirror's Edge Official Wired Controller for Xbox One", XTYPE_XBOXONE }, -+ { 0x0e6f, 0x015d, "PDP Mirror's Edge Official Wired Controller for Xbox One", 0, XTYPE_XBOXONE }, - { 0x0e6f, 0x0161, "PDP Xbox One Controller", 0, XTYPE_XBOXONE }, - { 0x0e6f, 0x0162, "PDP Xbox One Controller", 0, XTYPE_XBOXONE }, - { 0x0e6f, 0x0163, "PDP Xbox One Controller", 0, XTYPE_XBOXONE }, -@@ -386,10 +387,11 @@ static const struct xpad_device { - { 0x2dc8, 0x3106, "8BitDo Ultimate Wireless / Pro 2 Wired Controller", 0, XTYPE_XBOX360 }, - { 0x2dc8, 0x3109, "8BitDo Ultimate Wireless Bluetooth", 0, XTYPE_XBOX360 }, - { 0x2dc8, 0x310a, "8BitDo Ultimate 2C Wireless Controller", 0, XTYPE_XBOX360 }, -+ { 0x2dc8, 0x310b, "8BitDo Ultimate 2 Wireless Controller", 0, XTYPE_XBOX360 }, - { 0x2dc8, 0x6001, "8BitDo SN30 Pro", 0, XTYPE_XBOX360 }, - { 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE }, - { 0x2e24, 0x1688, "Hyperkin X91 X-Box One pad", 0, XTYPE_XBOXONE }, -- { 0x2e95, 0x0504, "SCUF Gaming Controller", MAP_SELECT_BUTTON, XTYPE_XBOXONE }, -+ { 0x2e95, 0x0504, "SCUF Gaming Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE }, - { 0x31e3, 0x1100, "Wooting One", 0, XTYPE_XBOX360 }, - { 0x31e3, 0x1200, "Wooting Two", 0, XTYPE_XBOX360 }, - { 0x31e3, 0x1210, "Wooting Lekker", 0, XTYPE_XBOX360 }, -@@ -1025,7 +1027,7 @@ static void xpad360w_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned cha - * The report format was gleaned from - * https://github.com/kylelemons/xbox/blob/master/xbox.go - */ --static void xpadone_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned char *data) -+static void xpadone_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned char *data, u32 len) - { - struct input_dev *dev = xpad->dev; - bool do_sync = false; -@@ -1066,8 +1068,12 @@ static void xpadone_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned char - /* menu/view buttons */ - input_report_key(dev, BTN_START, data[4] & BIT(2)); - input_report_key(dev, BTN_SELECT, data[4] & BIT(3)); -- if (xpad->mapping & MAP_SELECT_BUTTON) -- input_report_key(dev, KEY_RECORD, data[22] & BIT(0)); -+ if (xpad->mapping & MAP_SHARE_BUTTON) { -+ if (xpad->mapping & MAP_SHARE_OFFSET) -+ input_report_key(dev, KEY_RECORD, data[len - 26] & BIT(0)); -+ else -+ input_report_key(dev, KEY_RECORD, data[len - 18] & BIT(0)); -+ } - - /* buttons A,B,X,Y */ - input_report_key(dev, BTN_A, data[4] & BIT(4)); -@@ -1215,7 +1221,7 @@ static void xpad_irq_in(struct urb *urb) - xpad360w_process_packet(xpad, 0, xpad->idata); - break; - case XTYPE_XBOXONE: -- xpadone_process_packet(xpad, 0, xpad->idata); -+ xpadone_process_packet(xpad, 0, xpad->idata, urb->actual_length); - break; - default: - xpad_process_packet(xpad, 0, xpad->idata); -@@ -1972,7 +1978,7 @@ static int xpad_init_input(struct usb_xpad *xpad) - xpad->xtype == XTYPE_XBOXONE) { - for (i = 0; xpad360_btn[i] >= 0; i++) - input_set_capability(input_dev, EV_KEY, xpad360_btn[i]); -- if (xpad->mapping & MAP_SELECT_BUTTON) -+ if (xpad->mapping & MAP_SHARE_BUTTON) - input_set_capability(input_dev, EV_KEY, KEY_RECORD); - } else { - for (i = 0; xpad_btn[i] >= 0; i++) -diff --git a/drivers/input/keyboard/mtk-pmic-keys.c b/drivers/input/keyboard/mtk-pmic-keys.c -index 4364c3401ff1c6..486ca8ff86f830 100644 ---- a/drivers/input/keyboard/mtk-pmic-keys.c -+++ b/drivers/input/keyboard/mtk-pmic-keys.c -@@ -147,8 +147,8 @@ static void mtk_pmic_keys_lp_reset_setup(struct mtk_pmic_keys *keys, - u32 value, mask; - int error; - -- kregs_home = keys->keys[MTK_PMIC_HOMEKEY_INDEX].regs; -- kregs_pwr = keys->keys[MTK_PMIC_PWRKEY_INDEX].regs; -+ kregs_home = ®s->keys_regs[MTK_PMIC_HOMEKEY_INDEX]; -+ kregs_pwr = ®s->keys_regs[MTK_PMIC_PWRKEY_INDEX]; - - error = of_property_read_u32(keys->dev->of_node, "power-off-time-sec", - &long_press_debounce); -diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c -index 26677432ac8361..3ca6642601c7d5 100644 ---- a/drivers/input/mouse/synaptics.c -+++ b/drivers/input/mouse/synaptics.c -@@ -163,6 +163,7 @@ static const char * const topbuttonpad_pnp_ids[] = { - - static const char * const smbus_pnp_ids[] = { - /* all of the topbuttonpad_pnp_ids are valid, we just add some extras */ -+ "DLL060d", /* Dell Precision M3800 */ - "LEN0048", /* X1 Carbon 3 */ - "LEN0046", /* X250 */ - "LEN0049", /* Yoga 11e */ -@@ -189,11 +190,15 @@ static const char * const smbus_pnp_ids[] = { - "LEN2054", /* E480 */ - "LEN2055", /* E580 */ - "LEN2068", /* T14 Gen 1 */ -+ "SYN1221", /* TUXEDO InfinityBook Pro 14 v5 */ -+ "SYN3003", /* HP EliteBook 850 G1 */ - "SYN3015", /* HP EliteBook 840 G2 */ - "SYN3052", /* HP EliteBook 840 G4 */ - "SYN3221", /* HP 15-ay000 */ - "SYN323d", /* HP Spectre X360 13-w013dx */ - "SYN3257", /* HP Envy 13-ad105ng */ -+ "TOS01f6", /* Dynabook Portege X30L-G */ -+ "TOS0213", /* Dynabook Portege X30-D */ - NULL - }; - -diff --git a/drivers/input/touchscreen/cyttsp5.c b/drivers/input/touchscreen/cyttsp5.c -index db5a885ecd7285..a74b34d8df2a22 100644 ---- a/drivers/input/touchscreen/cyttsp5.c -+++ b/drivers/input/touchscreen/cyttsp5.c -@@ -580,7 +580,7 @@ static int cyttsp5_power_control(struct cyttsp5 *ts, bool on) - int rc; - - SET_CMD_REPORT_TYPE(cmd[0], 0); -- SET_CMD_REPORT_ID(cmd[0], HID_POWER_SLEEP); -+ SET_CMD_REPORT_ID(cmd[0], state); - SET_CMD_OPCODE(cmd[1], HID_CMD_SET_POWER); - - rc = cyttsp5_write(ts, HID_COMMAND_REG, cmd, sizeof(cmd)); -@@ -865,13 +865,16 @@ static int cyttsp5_probe(struct device *dev, struct regmap *regmap, int irq, - ts->input->phys = ts->phys; - input_set_drvdata(ts->input, ts); - -- /* Reset the gpio to be in a reset state */ -+ /* Assert gpio to be in a reset state */ - ts->reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH); - if (IS_ERR(ts->reset_gpio)) { - error = PTR_ERR(ts->reset_gpio); - dev_err(dev, "Failed to request reset gpio, error %d\n", error); - return error; - } -+ -+ fsleep(10); /* Ensure long-enough reset pulse (minimum 10us). */ -+ - gpiod_set_value_cansleep(ts->reset_gpio, 0); - - /* Need a delay to have device up */ -diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c -index 319bd10548e9ad..7a33da2dd64b12 100644 ---- a/drivers/md/dm-table.c -+++ b/drivers/md/dm-table.c -@@ -1242,7 +1242,7 @@ static int dm_keyslot_evict(struct blk_crypto_profile *profile, - - t = dm_get_live_table(md, &srcu_idx); - if (!t) -- return 0; -+ goto put_live_table; - - for (unsigned int i = 0; i < t->num_targets; i++) { - struct dm_target *ti = dm_table_get_target(t, i); -@@ -1253,6 +1253,7 @@ static int dm_keyslot_evict(struct blk_crypto_profile *profile, - (void *)key); - } - -+put_live_table: - dm_put_live_table(md, srcu_idx); - return 0; - } -diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c -index 2a258986eed02b..ba7f7de25c8529 100644 ---- a/drivers/net/can/m_can/m_can.c -+++ b/drivers/net/can/m_can/m_can.c -@@ -2125,9 +2125,9 @@ EXPORT_SYMBOL_GPL(m_can_class_register); - - void m_can_class_unregister(struct m_can_classdev *cdev) - { -+ unregister_candev(cdev->net); - if (cdev->is_peripheral) - can_rx_offload_del(&cdev->offload); -- unregister_candev(cdev->net); - } - EXPORT_SYMBOL_GPL(m_can_class_unregister); - -diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c -index 6fecfe4cd08041..21ae3a89924e97 100644 ---- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c -+++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c -@@ -75,6 +75,24 @@ static const struct can_bittiming_const mcp251xfd_data_bittiming_const = { - .brp_inc = 1, - }; - -+/* The datasheet of the mcp2518fd (DS20006027B) specifies a range of -+ * [-64,63] for TDCO, indicating a relative TDCO. -+ * -+ * Manual tests have shown, that using a relative TDCO configuration -+ * results in bus off, while an absolute configuration works. -+ * -+ * For TDCO use the max value (63) from the data sheet, but 0 as the -+ * minimum. -+ */ -+static const struct can_tdc_const mcp251xfd_tdc_const = { -+ .tdcv_min = 0, -+ .tdcv_max = 63, -+ .tdco_min = 0, -+ .tdco_max = 63, -+ .tdcf_min = 0, -+ .tdcf_max = 0, -+}; -+ - static const char *__mcp251xfd_get_model_str(enum mcp251xfd_model model) - { - switch (model) { -@@ -510,8 +528,7 @@ static int mcp251xfd_set_bittiming(const struct mcp251xfd_priv *priv) - { - const struct can_bittiming *bt = &priv->can.bittiming; - const struct can_bittiming *dbt = &priv->can.data_bittiming; -- u32 val = 0; -- s8 tdco; -+ u32 tdcmod, val = 0; - int err; - - /* CAN Control Register -@@ -575,11 +592,16 @@ static int mcp251xfd_set_bittiming(const struct mcp251xfd_priv *priv) - return err; - - /* Transmitter Delay Compensation */ -- tdco = clamp_t(int, dbt->brp * (dbt->prop_seg + dbt->phase_seg1), -- -64, 63); -- val = FIELD_PREP(MCP251XFD_REG_TDC_TDCMOD_MASK, -- MCP251XFD_REG_TDC_TDCMOD_AUTO) | -- FIELD_PREP(MCP251XFD_REG_TDC_TDCO_MASK, tdco); -+ if (priv->can.ctrlmode & CAN_CTRLMODE_TDC_AUTO) -+ tdcmod = MCP251XFD_REG_TDC_TDCMOD_AUTO; -+ else if (priv->can.ctrlmode & CAN_CTRLMODE_TDC_MANUAL) -+ tdcmod = MCP251XFD_REG_TDC_TDCMOD_MANUAL; -+ else -+ tdcmod = MCP251XFD_REG_TDC_TDCMOD_DISABLED; -+ -+ val = FIELD_PREP(MCP251XFD_REG_TDC_TDCMOD_MASK, tdcmod) | -+ FIELD_PREP(MCP251XFD_REG_TDC_TDCV_MASK, priv->can.tdc.tdcv) | -+ FIELD_PREP(MCP251XFD_REG_TDC_TDCO_MASK, priv->can.tdc.tdco); - - return regmap_write(priv->map_reg, MCP251XFD_REG_TDC, val); - } -@@ -2083,10 +2105,12 @@ static int mcp251xfd_probe(struct spi_device *spi) - priv->can.do_get_berr_counter = mcp251xfd_get_berr_counter; - priv->can.bittiming_const = &mcp251xfd_bittiming_const; - priv->can.data_bittiming_const = &mcp251xfd_data_bittiming_const; -+ priv->can.tdc_const = &mcp251xfd_tdc_const; - priv->can.ctrlmode_supported = CAN_CTRLMODE_LOOPBACK | - CAN_CTRLMODE_LISTENONLY | CAN_CTRLMODE_BERR_REPORTING | - CAN_CTRLMODE_FD | CAN_CTRLMODE_FD_NON_ISO | -- CAN_CTRLMODE_CC_LEN8_DLC; -+ CAN_CTRLMODE_CC_LEN8_DLC | CAN_CTRLMODE_TDC_AUTO | -+ CAN_CTRLMODE_TDC_MANUAL; - set_bit(MCP251XFD_FLAGS_DOWN, priv->flags); - priv->ndev = ndev; - priv->spi = spi; -@@ -2179,8 +2203,8 @@ static void mcp251xfd_remove(struct spi_device *spi) - struct mcp251xfd_priv *priv = spi_get_drvdata(spi); - struct net_device *ndev = priv->ndev; - -- can_rx_offload_del(&priv->offload); - mcp251xfd_unregister(priv); -+ can_rx_offload_del(&priv->offload); - spi->max_speed_hz = priv->spi_max_speed_hz_orig; - free_candev(ndev); - } -diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c -index cfcda893f1a16d..d2ff2c2fcbbfc4 100644 ---- a/drivers/net/dsa/b53/b53_common.c -+++ b/drivers/net/dsa/b53/b53_common.c -@@ -373,15 +373,17 @@ static void b53_enable_vlan(struct b53_device *dev, int port, bool enable, - b53_read8(dev, B53_VLAN_PAGE, B53_VLAN_CTRL5, &vc5); - } - -+ vc1 &= ~VC1_RX_MCST_FWD_EN; -+ - if (enable) { - vc0 |= VC0_VLAN_EN | VC0_VID_CHK_EN | VC0_VID_HASH_VID; -- vc1 |= VC1_RX_MCST_UNTAG_EN | VC1_RX_MCST_FWD_EN; -+ vc1 |= VC1_RX_MCST_UNTAG_EN; - vc4 &= ~VC4_ING_VID_CHECK_MASK; - if (enable_filtering) { - vc4 |= VC4_ING_VID_VIO_DROP << VC4_ING_VID_CHECK_S; - vc5 |= VC5_DROP_VTABLE_MISS; - } else { -- vc4 |= VC4_ING_VID_VIO_FWD << VC4_ING_VID_CHECK_S; -+ vc4 |= VC4_NO_ING_VID_CHK << VC4_ING_VID_CHECK_S; - vc5 &= ~VC5_DROP_VTABLE_MISS; - } - -@@ -393,7 +395,7 @@ static void b53_enable_vlan(struct b53_device *dev, int port, bool enable, - - } else { - vc0 &= ~(VC0_VLAN_EN | VC0_VID_CHK_EN | VC0_VID_HASH_VID); -- vc1 &= ~(VC1_RX_MCST_UNTAG_EN | VC1_RX_MCST_FWD_EN); -+ vc1 &= ~VC1_RX_MCST_UNTAG_EN; - vc4 &= ~VC4_ING_VID_CHECK_MASK; - vc5 &= ~VC5_DROP_VTABLE_MISS; - -@@ -1519,12 +1521,21 @@ int b53_vlan_add(struct dsa_switch *ds, int port, - bool untagged = vlan->flags & BRIDGE_VLAN_INFO_UNTAGGED; - bool pvid = vlan->flags & BRIDGE_VLAN_INFO_PVID; - struct b53_vlan *vl; -+ u16 old_pvid, new_pvid; - int err; - - err = b53_vlan_prepare(ds, port, vlan); - if (err) - return err; - -+ b53_read16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(port), &old_pvid); -+ if (pvid) -+ new_pvid = vlan->vid; -+ else if (!pvid && vlan->vid == old_pvid) -+ new_pvid = b53_default_pvid(dev); -+ else -+ new_pvid = old_pvid; -+ - vl = &dev->vlans[vlan->vid]; - - b53_get_vlan_entry(dev, vlan->vid, vl); -@@ -1541,10 +1552,10 @@ int b53_vlan_add(struct dsa_switch *ds, int port, - b53_set_vlan_entry(dev, vlan->vid, vl); - b53_fast_age_vlan(dev, vlan->vid); - -- if (pvid && !dsa_is_cpu_port(ds, port)) { -+ if (!dsa_is_cpu_port(ds, port) && new_pvid != old_pvid) { - b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(port), -- vlan->vid); -- b53_fast_age_vlan(dev, vlan->vid); -+ new_pvid); -+ b53_fast_age_vlan(dev, old_pvid); - } - - return 0; -@@ -1956,7 +1967,7 @@ EXPORT_SYMBOL(b53_br_join); - void b53_br_leave(struct dsa_switch *ds, int port, struct dsa_bridge bridge) - { - struct b53_device *dev = ds->priv; -- struct b53_vlan *vl = &dev->vlans[0]; -+ struct b53_vlan *vl; - s8 cpu_port = dsa_to_port(ds, port)->cpu_dp->index; - unsigned int i; - u16 pvlan, reg, pvid; -@@ -1982,6 +1993,7 @@ void b53_br_leave(struct dsa_switch *ds, int port, struct dsa_bridge bridge) - dev->ports[port].vlan_ctl_mask = pvlan; - - pvid = b53_default_pvid(dev); -+ vl = &dev->vlans[pvid]; - - /* Make this port join all VLANs without VLAN entries */ - if (is58xx(dev)) { -@@ -1990,12 +2002,12 @@ void b53_br_leave(struct dsa_switch *ds, int port, struct dsa_bridge bridge) - if (!(reg & BIT(cpu_port))) - reg |= BIT(cpu_port); - b53_write16(dev, B53_VLAN_PAGE, B53_JOIN_ALL_VLAN_EN, reg); -- } else { -- b53_get_vlan_entry(dev, pvid, vl); -- vl->members |= BIT(port) | BIT(cpu_port); -- vl->untag |= BIT(port) | BIT(cpu_port); -- b53_set_vlan_entry(dev, pvid, vl); - } -+ -+ b53_get_vlan_entry(dev, pvid, vl); -+ vl->members |= BIT(port) | BIT(cpu_port); -+ vl->untag |= BIT(port) | BIT(cpu_port); -+ b53_set_vlan_entry(dev, pvid, vl); - } - EXPORT_SYMBOL(b53_br_leave); - -diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c -index d2ec8f642c2fa0..c6ccfbd4226570 100644 ---- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c -+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c -@@ -3117,11 +3117,19 @@ static int mtk_dma_init(struct mtk_eth *eth) - static void mtk_dma_free(struct mtk_eth *eth) - { - const struct mtk_soc_data *soc = eth->soc; -- int i; -+ int i, j, txqs = 1; -+ -+ if (MTK_HAS_CAPS(eth->soc->caps, MTK_QDMA)) -+ txqs = MTK_QDMA_NUM_QUEUES; -+ -+ for (i = 0; i < MTK_MAX_DEVS; i++) { -+ if (!eth->netdev[i]) -+ continue; -+ -+ for (j = 0; j < txqs; j++) -+ netdev_tx_reset_subqueue(eth->netdev[i], j); -+ } - -- for (i = 0; i < MTK_MAX_DEVS; i++) -- if (eth->netdev[i]) -- netdev_reset_queue(eth->netdev[i]); - if (!MTK_HAS_CAPS(soc->caps, MTK_SRAM) && eth->scratch_ring) { - dma_free_coherent(eth->dma_dev, - MTK_QDMA_RING_SIZE * soc->txrx.txd_size, -diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c -index c6b0637e61debd..6e2d0fda3ba4aa 100644 ---- a/drivers/nvme/host/core.c -+++ b/drivers/nvme/host/core.c -@@ -4156,7 +4156,8 @@ static void nvme_fw_act_work(struct work_struct *work) - msleep(100); - } - -- if (!nvme_change_ctrl_state(ctrl, NVME_CTRL_LIVE)) -+ if (!nvme_change_ctrl_state(ctrl, NVME_CTRL_CONNECTING) || -+ !nvme_change_ctrl_state(ctrl, NVME_CTRL_LIVE)) - return; - - nvme_unquiesce_io_queues(ctrl); -diff --git a/drivers/staging/axis-fifo/axis-fifo.c b/drivers/staging/axis-fifo/axis-fifo.c -index 727b956aa23172..f667b3b62f1883 100644 ---- a/drivers/staging/axis-fifo/axis-fifo.c -+++ b/drivers/staging/axis-fifo/axis-fifo.c -@@ -398,16 +398,14 @@ static ssize_t axis_fifo_read(struct file *f, char __user *buf, - - bytes_available = ioread32(fifo->base_addr + XLLF_RLR_OFFSET); - if (!bytes_available) { -- dev_err(fifo->dt_device, "received a packet of length 0 - fifo core will be reset\n"); -- reset_ip_core(fifo); -+ dev_err(fifo->dt_device, "received a packet of length 0\n"); - ret = -EIO; - goto end_unlock; - } - - if (bytes_available > len) { -- dev_err(fifo->dt_device, "user read buffer too small (available bytes=%zu user buffer bytes=%zu) - fifo core will be reset\n", -+ dev_err(fifo->dt_device, "user read buffer too small (available bytes=%zu user buffer bytes=%zu)\n", - bytes_available, len); -- reset_ip_core(fifo); - ret = -EINVAL; - goto end_unlock; - } -@@ -416,8 +414,7 @@ static ssize_t axis_fifo_read(struct file *f, char __user *buf, - /* this probably can't happen unless IP - * registers were previously mishandled - */ -- dev_err(fifo->dt_device, "received a packet that isn't word-aligned - fifo core will be reset\n"); -- reset_ip_core(fifo); -+ dev_err(fifo->dt_device, "received a packet that isn't word-aligned\n"); - ret = -EIO; - goto end_unlock; - } -@@ -438,7 +435,6 @@ static ssize_t axis_fifo_read(struct file *f, char __user *buf, - - if (copy_to_user(buf + copied * sizeof(u32), tmp_buf, - copy * sizeof(u32))) { -- reset_ip_core(fifo); - ret = -EFAULT; - goto end_unlock; - } -@@ -547,7 +543,6 @@ static ssize_t axis_fifo_write(struct file *f, const char __user *buf, - - if (copy_from_user(tmp_buf, buf + copied * sizeof(u32), - copy * sizeof(u32))) { -- reset_ip_core(fifo); - ret = -EFAULT; - goto end_unlock; - } -@@ -780,9 +775,6 @@ static int axis_fifo_parse_dt(struct axis_fifo *fifo) - goto end; - } - -- /* IP sets TDFV to fifo depth - 4 so we will do the same */ -- fifo->tx_fifo_depth -= 4; -- - ret = get_dts_property(fifo, "xlnx,use-rx-data", &fifo->has_rx_fifo); - if (ret) { - dev_err(fifo->dt_device, "missing xlnx,use-rx-data property\n"); -diff --git a/drivers/staging/iio/adc/ad7816.c b/drivers/staging/iio/adc/ad7816.c -index 6c14d7bcdd6750..081b17f498638b 100644 ---- a/drivers/staging/iio/adc/ad7816.c -+++ b/drivers/staging/iio/adc/ad7816.c -@@ -136,7 +136,7 @@ static ssize_t ad7816_store_mode(struct device *dev, - struct iio_dev *indio_dev = dev_to_iio_dev(dev); - struct ad7816_chip_info *chip = iio_priv(indio_dev); - -- if (strcmp(buf, "full")) { -+ if (strcmp(buf, "full") == 0) { - gpiod_set_value(chip->rdwr_pin, 1); - chip->mode = AD7816_FULL; - } else { -diff --git a/drivers/usb/cdns3/cdnsp-gadget.c b/drivers/usb/cdns3/cdnsp-gadget.c -index 4b67749edb9974..601a60a2802240 100644 ---- a/drivers/usb/cdns3/cdnsp-gadget.c -+++ b/drivers/usb/cdns3/cdnsp-gadget.c -@@ -138,6 +138,26 @@ static void cdnsp_clear_port_change_bit(struct cdnsp_device *pdev, - (portsc & PORT_CHANGE_BITS), port_regs); - } - -+static void cdnsp_set_apb_timeout_value(struct cdnsp_device *pdev) -+{ -+ struct cdns *cdns = dev_get_drvdata(pdev->dev); -+ __le32 __iomem *reg; -+ void __iomem *base; -+ u32 offset = 0; -+ u32 val; -+ -+ if (!cdns->override_apb_timeout) -+ return; -+ -+ base = &pdev->cap_regs->hc_capbase; -+ offset = cdnsp_find_next_ext_cap(base, offset, D_XEC_PRE_REGS_CAP); -+ reg = base + offset + REG_CHICKEN_BITS_3_OFFSET; -+ -+ val = le32_to_cpu(readl(reg)); -+ val = CHICKEN_APB_TIMEOUT_SET(val, cdns->override_apb_timeout); -+ writel(cpu_to_le32(val), reg); -+} -+ - static void cdnsp_set_chicken_bits_2(struct cdnsp_device *pdev, u32 bit) - { - __le32 __iomem *reg; -@@ -1776,6 +1796,8 @@ static void cdnsp_get_rev_cap(struct cdnsp_device *pdev) - reg += cdnsp_find_next_ext_cap(reg, 0, RTL_REV_CAP); - pdev->rev_cap = reg; - -+ pdev->rtl_revision = readl(&pdev->rev_cap->rtl_revision); -+ - dev_info(pdev->dev, "Rev: %08x/%08x, eps: %08x, buff: %08x/%08x\n", - readl(&pdev->rev_cap->ctrl_revision), - readl(&pdev->rev_cap->rtl_revision), -@@ -1801,6 +1823,15 @@ static int cdnsp_gen_setup(struct cdnsp_device *pdev) - pdev->hci_version = HC_VERSION(pdev->hcc_params); - pdev->hcc_params = readl(&pdev->cap_regs->hcc_params); - -+ /* -+ * Override the APB timeout value to give the controller more time for -+ * enabling UTMI clock and synchronizing APB and UTMI clock domains. -+ * This fix is platform specific and is required to fixes issue with -+ * reading incorrect value from PORTSC register after resuming -+ * from L1 state. -+ */ -+ cdnsp_set_apb_timeout_value(pdev); -+ - cdnsp_get_rev_cap(pdev); - - /* Make sure the Device Controller is halted. */ -diff --git a/drivers/usb/cdns3/cdnsp-gadget.h b/drivers/usb/cdns3/cdnsp-gadget.h -index 9a5577a772af62..ed84dbb9fd6fbc 100644 ---- a/drivers/usb/cdns3/cdnsp-gadget.h -+++ b/drivers/usb/cdns3/cdnsp-gadget.h -@@ -520,6 +520,9 @@ struct cdnsp_rev_cap { - #define REG_CHICKEN_BITS_2_OFFSET 0x48 - #define CHICKEN_XDMA_2_TP_CACHE_DIS BIT(28) - -+#define REG_CHICKEN_BITS_3_OFFSET 0x4C -+#define CHICKEN_APB_TIMEOUT_SET(p, val) (((p) & ~GENMASK(21, 0)) | (val)) -+ - /* XBUF Extended Capability ID. */ - #define XBUF_CAP_ID 0xCB - #define XBUF_RX_TAG_MASK_0_OFFSET 0x1C -@@ -1359,6 +1362,7 @@ struct cdnsp_port { - * @rev_cap: Controller Capabilities Registers. - * @hcs_params1: Cached register copies of read-only HCSPARAMS1 - * @hcc_params: Cached register copies of read-only HCCPARAMS1 -+ * @rtl_revision: Cached controller rtl revision. - * @setup: Temporary buffer for setup packet. - * @ep0_preq: Internal allocated request used during enumeration. - * @ep0_stage: ep0 stage during enumeration process. -@@ -1413,6 +1417,8 @@ struct cdnsp_device { - __u32 hcs_params1; - __u32 hcs_params3; - __u32 hcc_params; -+ #define RTL_REVISION_NEW_LPM 0x2700 -+ __u32 rtl_revision; - /* Lock used in interrupt thread context. */ - spinlock_t lock; - struct usb_ctrlrequest setup; -diff --git a/drivers/usb/cdns3/cdnsp-pci.c b/drivers/usb/cdns3/cdnsp-pci.c -index 0725668ffea4c8..159c2eae26608c 100644 ---- a/drivers/usb/cdns3/cdnsp-pci.c -+++ b/drivers/usb/cdns3/cdnsp-pci.c -@@ -33,6 +33,8 @@ - #define CDNS_DRD_ID 0x0100 - #define CDNS_DRD_IF (PCI_CLASS_SERIAL_USB << 8 | 0x80) - -+#define CHICKEN_APB_TIMEOUT_VALUE 0x1C20 -+ - static struct pci_dev *cdnsp_get_second_fun(struct pci_dev *pdev) - { - /* -@@ -144,6 +146,14 @@ static int cdnsp_pci_probe(struct pci_dev *pdev, - cdnsp->otg_irq = pdev->irq; - } - -+ /* -+ * Cadence PCI based platform require some longer timeout for APB -+ * to fixes domain clock synchronization issue after resuming -+ * controller from L1 state. -+ */ -+ cdnsp->override_apb_timeout = CHICKEN_APB_TIMEOUT_VALUE; -+ pci_set_drvdata(pdev, cdnsp); -+ - if (pci_is_enabled(func)) { - cdnsp->dev = dev; - cdnsp->gadget_init = cdnsp_gadget_init; -@@ -153,8 +163,6 @@ static int cdnsp_pci_probe(struct pci_dev *pdev, - goto free_cdnsp; - } - -- pci_set_drvdata(pdev, cdnsp); -- - device_wakeup_enable(&pdev->dev); - if (pci_dev_run_wake(pdev)) - pm_runtime_put_noidle(&pdev->dev); -diff --git a/drivers/usb/cdns3/cdnsp-ring.c b/drivers/usb/cdns3/cdnsp-ring.c -index 1d18d5002ef01d..080a3f17a35dd7 100644 ---- a/drivers/usb/cdns3/cdnsp-ring.c -+++ b/drivers/usb/cdns3/cdnsp-ring.c -@@ -308,7 +308,8 @@ static bool cdnsp_ring_ep_doorbell(struct cdnsp_device *pdev, - - writel(db_value, reg_addr); - -- cdnsp_force_l0_go(pdev); -+ if (pdev->rtl_revision < RTL_REVISION_NEW_LPM) -+ cdnsp_force_l0_go(pdev); - - /* Doorbell was set. */ - return true; -diff --git a/drivers/usb/cdns3/core.h b/drivers/usb/cdns3/core.h -index 57d47348dc193b..ac30ee21309d02 100644 ---- a/drivers/usb/cdns3/core.h -+++ b/drivers/usb/cdns3/core.h -@@ -79,6 +79,8 @@ struct cdns3_platform_data { - * @pdata: platform data from glue layer - * @lock: spinlock structure - * @xhci_plat_data: xhci private data structure pointer -+ * @override_apb_timeout: hold value of APB timeout. For value 0 the default -+ * value in CHICKEN_BITS_3 will be preserved. - * @gadget_init: pointer to gadget initialization function - */ - struct cdns { -@@ -117,6 +119,7 @@ struct cdns { - struct cdns3_platform_data *pdata; - spinlock_t lock; - struct xhci_plat_priv *xhci_plat_data; -+ u32 override_apb_timeout; - - int (*gadget_init)(struct cdns *cdns); - }; -diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c -index c2e666e82857c1..2f92905e05cad0 100644 ---- a/drivers/usb/class/usbtmc.c -+++ b/drivers/usb/class/usbtmc.c -@@ -482,6 +482,7 @@ static int usbtmc_get_stb(struct usbtmc_file_data *file_data, __u8 *stb) - u8 *buffer; - u8 tag; - int rv; -+ long wait_rv; - - dev_dbg(dev, "Enter ioctl_read_stb iin_ep_present: %d\n", - data->iin_ep_present); -@@ -511,16 +512,17 @@ static int usbtmc_get_stb(struct usbtmc_file_data *file_data, __u8 *stb) - } - - if (data->iin_ep_present) { -- rv = wait_event_interruptible_timeout( -+ wait_rv = wait_event_interruptible_timeout( - data->waitq, - atomic_read(&data->iin_data_valid) != 0, - file_data->timeout); -- if (rv < 0) { -- dev_dbg(dev, "wait interrupted %d\n", rv); -+ if (wait_rv < 0) { -+ dev_dbg(dev, "wait interrupted %ld\n", wait_rv); -+ rv = wait_rv; - goto exit; - } - -- if (rv == 0) { -+ if (wait_rv == 0) { - dev_dbg(dev, "wait timed out\n"); - rv = -ETIMEDOUT; - goto exit; -@@ -539,6 +541,8 @@ static int usbtmc_get_stb(struct usbtmc_file_data *file_data, __u8 *stb) - - dev_dbg(dev, "stb:0x%02x received %d\n", (unsigned int)*stb, rv); - -+ rv = 0; -+ - exit: - /* bump interrupt bTag */ - data->iin_bTag += 1; -@@ -602,9 +606,9 @@ static int usbtmc488_ioctl_wait_srq(struct usbtmc_file_data *file_data, - { - struct usbtmc_device_data *data = file_data->data; - struct device *dev = &data->intf->dev; -- int rv; - u32 timeout; - unsigned long expire; -+ long wait_rv; - - if (!data->iin_ep_present) { - dev_dbg(dev, "no interrupt endpoint present\n"); -@@ -618,25 +622,24 @@ static int usbtmc488_ioctl_wait_srq(struct usbtmc_file_data *file_data, - - mutex_unlock(&data->io_mutex); - -- rv = wait_event_interruptible_timeout( -- data->waitq, -- atomic_read(&file_data->srq_asserted) != 0 || -- atomic_read(&file_data->closing), -- expire); -+ wait_rv = wait_event_interruptible_timeout( -+ data->waitq, -+ atomic_read(&file_data->srq_asserted) != 0 || -+ atomic_read(&file_data->closing), -+ expire); - - mutex_lock(&data->io_mutex); - - /* Note! disconnect or close could be called in the meantime */ - if (atomic_read(&file_data->closing) || data->zombie) -- rv = -ENODEV; -+ return -ENODEV; - -- if (rv < 0) { -- /* dev can be invalid now! */ -- pr_debug("%s - wait interrupted %d\n", __func__, rv); -- return rv; -+ if (wait_rv < 0) { -+ dev_dbg(dev, "%s - wait interrupted %ld\n", __func__, wait_rv); -+ return wait_rv; - } - -- if (rv == 0) { -+ if (wait_rv == 0) { - dev_dbg(dev, "%s - wait timed out\n", __func__); - return -ETIMEDOUT; - } -@@ -830,6 +833,7 @@ static ssize_t usbtmc_generic_read(struct usbtmc_file_data *file_data, - unsigned long expire; - int bufcount = 1; - int again = 0; -+ long wait_rv; - - /* mutex already locked */ - -@@ -942,19 +946,24 @@ static ssize_t usbtmc_generic_read(struct usbtmc_file_data *file_data, - if (!(flags & USBTMC_FLAG_ASYNC)) { - dev_dbg(dev, "%s: before wait time %lu\n", - __func__, expire); -- retval = wait_event_interruptible_timeout( -+ wait_rv = wait_event_interruptible_timeout( - file_data->wait_bulk_in, - usbtmc_do_transfer(file_data), - expire); - -- dev_dbg(dev, "%s: wait returned %d\n", -- __func__, retval); -+ dev_dbg(dev, "%s: wait returned %ld\n", -+ __func__, wait_rv); -+ -+ if (wait_rv < 0) { -+ retval = wait_rv; -+ goto error; -+ } - -- if (retval <= 0) { -- if (retval == 0) -- retval = -ETIMEDOUT; -+ if (wait_rv == 0) { -+ retval = -ETIMEDOUT; - goto error; - } -+ - } - - urb = usb_get_from_anchor(&file_data->in_anchor); -@@ -1380,7 +1389,10 @@ static ssize_t usbtmc_read(struct file *filp, char __user *buf, - if (!buffer) - return -ENOMEM; - -- mutex_lock(&data->io_mutex); -+ retval = mutex_lock_interruptible(&data->io_mutex); -+ if (retval < 0) -+ goto exit_nolock; -+ - if (data->zombie) { - retval = -ENODEV; - goto exit; -@@ -1503,6 +1515,7 @@ static ssize_t usbtmc_read(struct file *filp, char __user *buf, - - exit: - mutex_unlock(&data->io_mutex); -+exit_nolock: - kfree(buffer); - return retval; - } -diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c -index 69ce7d384ba8bb..4f326988be867c 100644 ---- a/drivers/usb/gadget/composite.c -+++ b/drivers/usb/gadget/composite.c -@@ -2011,15 +2011,13 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) - - if (f->get_status) { - status = f->get_status(f); -+ - if (status < 0) - break; -- } else { -- /* Set D0 and D1 bits based on func wakeup capability */ -- if (f->config->bmAttributes & USB_CONFIG_ATT_WAKEUP) { -- status |= USB_INTRF_STAT_FUNC_RW_CAP; -- if (f->func_wakeup_armed) -- status |= USB_INTRF_STAT_FUNC_RW; -- } -+ -+ /* if D5 is not set, then device is not wakeup capable */ -+ if (!(f->config->bmAttributes & USB_CONFIG_ATT_WAKEUP)) -+ status &= ~(USB_INTRF_STAT_FUNC_RW_CAP | USB_INTRF_STAT_FUNC_RW); - } - - put_unaligned_le16(status & 0x0000ffff, req->buf); -diff --git a/drivers/usb/gadget/function/f_ecm.c b/drivers/usb/gadget/function/f_ecm.c -index f55f60639e4251..2afc30de54ce2d 100644 ---- a/drivers/usb/gadget/function/f_ecm.c -+++ b/drivers/usb/gadget/function/f_ecm.c -@@ -892,6 +892,12 @@ static void ecm_resume(struct usb_function *f) - gether_resume(&ecm->port); - } - -+static int ecm_get_status(struct usb_function *f) -+{ -+ return (f->func_wakeup_armed ? USB_INTRF_STAT_FUNC_RW : 0) | -+ USB_INTRF_STAT_FUNC_RW_CAP; -+} -+ - static void ecm_free(struct usb_function *f) - { - struct f_ecm *ecm; -@@ -960,6 +966,7 @@ static struct usb_function *ecm_alloc(struct usb_function_instance *fi) - ecm->port.func.disable = ecm_disable; - ecm->port.func.free_func = ecm_free; - ecm->port.func.suspend = ecm_suspend; -+ ecm->port.func.get_status = ecm_get_status; - ecm->port.func.resume = ecm_resume; - - return &ecm->port.func; -diff --git a/drivers/usb/gadget/udc/tegra-xudc.c b/drivers/usb/gadget/udc/tegra-xudc.c -index 7aa46d426f31b2..9bb54da8a6ae15 100644 ---- a/drivers/usb/gadget/udc/tegra-xudc.c -+++ b/drivers/usb/gadget/udc/tegra-xudc.c -@@ -1749,6 +1749,10 @@ static int __tegra_xudc_ep_disable(struct tegra_xudc_ep *ep) - val = xudc_readl(xudc, CTRL); - val &= ~CTRL_RUN; - xudc_writel(xudc, val, CTRL); -+ -+ val = xudc_readl(xudc, ST); -+ if (val & ST_RC) -+ xudc_writel(xudc, ST_RC, ST); - } - - dev_info(xudc->dev, "ep %u disabled\n", ep->index); -diff --git a/drivers/usb/host/uhci-platform.c b/drivers/usb/host/uhci-platform.c -index 3dec5dd3a0d5ca..712389599d468c 100644 ---- a/drivers/usb/host/uhci-platform.c -+++ b/drivers/usb/host/uhci-platform.c -@@ -121,7 +121,7 @@ static int uhci_hcd_platform_probe(struct platform_device *pdev) - } - - /* Get and enable clock if any specified */ -- uhci->clk = devm_clk_get(&pdev->dev, NULL); -+ uhci->clk = devm_clk_get_optional(&pdev->dev, NULL); - if (IS_ERR(uhci->clk)) { - ret = PTR_ERR(uhci->clk); - goto err_rmr; -diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c -index 76f228e7443cb6..89b3079194d7b3 100644 ---- a/drivers/usb/host/xhci-tegra.c -+++ b/drivers/usb/host/xhci-tegra.c -@@ -1363,6 +1363,7 @@ static void tegra_xhci_id_work(struct work_struct *work) - tegra->otg_usb3_port = tegra_xusb_padctl_get_usb3_companion(tegra->padctl, - tegra->otg_usb2_port); - -+ pm_runtime_get_sync(tegra->dev); - if (tegra->host_mode) { - /* switch to host mode */ - if (tegra->otg_usb3_port >= 0) { -@@ -1392,6 +1393,7 @@ static void tegra_xhci_id_work(struct work_struct *work) - } - - tegra_xhci_set_port_power(tegra, true, true); -+ pm_runtime_mark_last_busy(tegra->dev); - - } else { - if (tegra->otg_usb3_port >= 0) -@@ -1399,6 +1401,7 @@ static void tegra_xhci_id_work(struct work_struct *work) - - tegra_xhci_set_port_power(tegra, true, false); - } -+ pm_runtime_put_autosuspend(tegra->dev); - } - - #if IS_ENABLED(CONFIG_PM) || IS_ENABLED(CONFIG_PM_SLEEP) -diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c -index 790aadab72a31b..bfcbccb400c3a8 100644 ---- a/drivers/usb/typec/tcpm/tcpm.c -+++ b/drivers/usb/typec/tcpm/tcpm.c -@@ -5102,7 +5102,7 @@ static void _tcpm_cc_change(struct tcpm_port *port, enum typec_cc_status cc1, - case SNK_TRY_WAIT_DEBOUNCE: - if (!tcpm_port_is_sink(port)) { - port->max_wait = 0; -- tcpm_set_state(port, SRC_TRYWAIT, 0); -+ tcpm_set_state(port, SRC_TRYWAIT, PD_T_PD_DEBOUNCE); - } - break; - case SRC_TRY_WAIT: -diff --git a/drivers/usb/typec/ucsi/displayport.c b/drivers/usb/typec/ucsi/displayport.c -index 2431febc461516..8c19081c325542 100644 ---- a/drivers/usb/typec/ucsi/displayport.c -+++ b/drivers/usb/typec/ucsi/displayport.c -@@ -296,6 +296,8 @@ void ucsi_displayport_remove_partner(struct typec_altmode *alt) - if (!dp) - return; - -+ cancel_work_sync(&dp->work); -+ - dp->data.conf = 0; - dp->data.status = 0; - dp->initialized = false; -diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c -index 0b3bd9a7575e5f..5770f3b374ece3 100644 ---- a/drivers/xen/swiotlb-xen.c -+++ b/drivers/xen/swiotlb-xen.c -@@ -216,6 +216,7 @@ static dma_addr_t xen_swiotlb_map_page(struct device *dev, struct page *page, - * buffering it. - */ - if (dma_capable(dev, dev_addr, size, true) && -+ !dma_kmalloc_needs_bounce(dev, size, dir) && - !range_straddles_page_boundary(phys, size) && - !xen_arch_need_swiotlb(dev, phys, dev_addr) && - !is_swiotlb_force_bounce(dev)) -diff --git a/drivers/xen/xenbus/xenbus.h b/drivers/xen/xenbus/xenbus.h -index 2754bdfadcb89c..4ba73320694a4c 100644 ---- a/drivers/xen/xenbus/xenbus.h -+++ b/drivers/xen/xenbus/xenbus.h -@@ -77,6 +77,7 @@ enum xb_req_state { - struct xb_req_data { - struct list_head list; - wait_queue_head_t wq; -+ struct kref kref; - struct xsd_sockmsg msg; - uint32_t caller_req_id; - enum xsd_sockmsg_type type; -@@ -103,6 +104,7 @@ int xb_init_comms(void); - void xb_deinit_comms(void); - int xs_watch_msg(struct xs_watch_event *event); - void xs_request_exit(struct xb_req_data *req); -+void xs_free_req(struct kref *kref); - - int xenbus_match(struct device *_dev, struct device_driver *_drv); - int xenbus_dev_probe(struct device *_dev); -diff --git a/drivers/xen/xenbus/xenbus_comms.c b/drivers/xen/xenbus/xenbus_comms.c -index e5fda0256feb3d..82df2da1b880b8 100644 ---- a/drivers/xen/xenbus/xenbus_comms.c -+++ b/drivers/xen/xenbus/xenbus_comms.c -@@ -309,8 +309,8 @@ static int process_msg(void) - virt_wmb(); - req->state = xb_req_state_got_reply; - req->cb(req); -- } else -- kfree(req); -+ } -+ kref_put(&req->kref, xs_free_req); - } - - mutex_unlock(&xs_response_mutex); -@@ -386,14 +386,13 @@ static int process_writes(void) - state.req->msg.type = XS_ERROR; - state.req->err = err; - list_del(&state.req->list); -- if (state.req->state == xb_req_state_aborted) -- kfree(state.req); -- else { -+ if (state.req->state != xb_req_state_aborted) { - /* write err, then update state */ - virt_wmb(); - state.req->state = xb_req_state_got_reply; - wake_up(&state.req->wq); - } -+ kref_put(&state.req->kref, xs_free_req); - - mutex_unlock(&xb_write_mutex); - -diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c -index 0792fda49a15f3..c495cff3da308b 100644 ---- a/drivers/xen/xenbus/xenbus_dev_frontend.c -+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c -@@ -406,7 +406,7 @@ void xenbus_dev_queue_reply(struct xb_req_data *req) - mutex_unlock(&u->reply_mutex); - - kfree(req->body); -- kfree(req); -+ kref_put(&req->kref, xs_free_req); - - kref_put(&u->kref, xenbus_file_free); - -diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c -index 028a182bcc9e83..f84c87ee283958 100644 ---- a/drivers/xen/xenbus/xenbus_xs.c -+++ b/drivers/xen/xenbus/xenbus_xs.c -@@ -112,6 +112,12 @@ static void xs_suspend_exit(void) - wake_up_all(&xs_state_enter_wq); - } - -+void xs_free_req(struct kref *kref) -+{ -+ struct xb_req_data *req = container_of(kref, struct xb_req_data, kref); -+ kfree(req); -+} -+ - static uint32_t xs_request_enter(struct xb_req_data *req) - { - uint32_t rq_id; -@@ -237,6 +243,12 @@ static void xs_send(struct xb_req_data *req, struct xsd_sockmsg *msg) - req->caller_req_id = req->msg.req_id; - req->msg.req_id = xs_request_enter(req); - -+ /* -+ * Take 2nd ref. One for this thread, and the second for the -+ * xenbus_thread. -+ */ -+ kref_get(&req->kref); -+ - mutex_lock(&xb_write_mutex); - list_add_tail(&req->list, &xb_write_list); - notify = list_is_singular(&xb_write_list); -@@ -261,8 +273,8 @@ static void *xs_wait_for_reply(struct xb_req_data *req, struct xsd_sockmsg *msg) - if (req->state == xb_req_state_queued || - req->state == xb_req_state_wait_reply) - req->state = xb_req_state_aborted; -- else -- kfree(req); -+ -+ kref_put(&req->kref, xs_free_req); - mutex_unlock(&xb_write_mutex); - - return ret; -@@ -291,6 +303,7 @@ int xenbus_dev_request_and_reply(struct xsd_sockmsg *msg, void *par) - req->cb = xenbus_dev_queue_reply; - req->par = par; - req->user_req = true; -+ kref_init(&req->kref); - - xs_send(req, msg); - -@@ -319,6 +332,7 @@ static void *xs_talkv(struct xenbus_transaction t, - req->num_vecs = num_vecs; - req->cb = xs_wake_up; - req->user_req = false; -+ kref_init(&req->kref); - - msg.req_id = 0; - msg.tx_id = t.id; -diff --git a/fs/namespace.c b/fs/namespace.c -index 5a885d35efe937..450f4198b8cdd8 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -633,7 +633,7 @@ int __legitimize_mnt(struct vfsmount *bastard, unsigned seq) - return 0; - mnt = real_mount(bastard); - mnt_add_count(mnt, 1); -- smp_mb(); // see mntput_no_expire() -+ smp_mb(); // see mntput_no_expire() and do_umount() - if (likely(!read_seqretry(&mount_lock, seq))) - return 0; - if (bastard->mnt_flags & MNT_SYNC_UMOUNT) { -@@ -1786,6 +1786,7 @@ static int do_umount(struct mount *mnt, int flags) - umount_tree(mnt, UMOUNT_PROPAGATE); - retval = 0; - } else { -+ smp_mb(); // paired with __legitimize_mnt() - shrink_submounts(mnt); - retval = -EBUSY; - if (!propagate_mount_busy(mnt, 2)) { -diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c -index cbe3c12ff5f75c..b246e53271114d 100644 ---- a/fs/ocfs2/journal.c -+++ b/fs/ocfs2/journal.c -@@ -174,7 +174,7 @@ int ocfs2_recovery_init(struct ocfs2_super *osb) - struct ocfs2_recovery_map *rm; - - mutex_init(&osb->recovery_lock); -- osb->disable_recovery = 0; -+ osb->recovery_state = OCFS2_REC_ENABLED; - osb->recovery_thread_task = NULL; - init_waitqueue_head(&osb->recovery_event); - -@@ -190,31 +190,53 @@ int ocfs2_recovery_init(struct ocfs2_super *osb) - return 0; - } - --/* we can't grab the goofy sem lock from inside wait_event, so we use -- * memory barriers to make sure that we'll see the null task before -- * being woken up */ - static int ocfs2_recovery_thread_running(struct ocfs2_super *osb) - { -- mb(); - return osb->recovery_thread_task != NULL; - } - --void ocfs2_recovery_exit(struct ocfs2_super *osb) -+static void ocfs2_recovery_disable(struct ocfs2_super *osb, -+ enum ocfs2_recovery_state state) - { -- struct ocfs2_recovery_map *rm; -- -- /* disable any new recovery threads and wait for any currently -- * running ones to exit. Do this before setting the vol_state. */ - mutex_lock(&osb->recovery_lock); -- osb->disable_recovery = 1; -+ /* -+ * If recovery thread is not running, we can directly transition to -+ * final state. -+ */ -+ if (!ocfs2_recovery_thread_running(osb)) { -+ osb->recovery_state = state + 1; -+ goto out_lock; -+ } -+ osb->recovery_state = state; -+ /* Wait for recovery thread to acknowledge state transition */ -+ wait_event_cmd(osb->recovery_event, -+ !ocfs2_recovery_thread_running(osb) || -+ osb->recovery_state >= state + 1, -+ mutex_unlock(&osb->recovery_lock), -+ mutex_lock(&osb->recovery_lock)); -+out_lock: - mutex_unlock(&osb->recovery_lock); -- wait_event(osb->recovery_event, !ocfs2_recovery_thread_running(osb)); - -- /* At this point, we know that no more recovery threads can be -- * launched, so wait for any recovery completion work to -- * complete. */ -+ /* -+ * At this point we know that no more recovery work can be queued so -+ * wait for any recovery completion work to complete. -+ */ - if (osb->ocfs2_wq) - flush_workqueue(osb->ocfs2_wq); -+} -+ -+void ocfs2_recovery_disable_quota(struct ocfs2_super *osb) -+{ -+ ocfs2_recovery_disable(osb, OCFS2_REC_QUOTA_WANT_DISABLE); -+} -+ -+void ocfs2_recovery_exit(struct ocfs2_super *osb) -+{ -+ struct ocfs2_recovery_map *rm; -+ -+ /* disable any new recovery threads and wait for any currently -+ * running ones to exit. Do this before setting the vol_state. */ -+ ocfs2_recovery_disable(osb, OCFS2_REC_WANT_DISABLE); - - /* - * Now that recovery is shut down, and the osb is about to be -@@ -1472,6 +1494,18 @@ static int __ocfs2_recovery_thread(void *arg) - } - } - restart: -+ if (quota_enabled) { -+ mutex_lock(&osb->recovery_lock); -+ /* Confirm that recovery thread will no longer recover quotas */ -+ if (osb->recovery_state == OCFS2_REC_QUOTA_WANT_DISABLE) { -+ osb->recovery_state = OCFS2_REC_QUOTA_DISABLED; -+ wake_up(&osb->recovery_event); -+ } -+ if (osb->recovery_state >= OCFS2_REC_QUOTA_DISABLED) -+ quota_enabled = 0; -+ mutex_unlock(&osb->recovery_lock); -+ } -+ - status = ocfs2_super_lock(osb, 1); - if (status < 0) { - mlog_errno(status); -@@ -1569,27 +1603,29 @@ static int __ocfs2_recovery_thread(void *arg) - - ocfs2_free_replay_slots(osb); - osb->recovery_thread_task = NULL; -- mb(); /* sync with ocfs2_recovery_thread_running */ -+ if (osb->recovery_state == OCFS2_REC_WANT_DISABLE) -+ osb->recovery_state = OCFS2_REC_DISABLED; - wake_up(&osb->recovery_event); - - mutex_unlock(&osb->recovery_lock); - -- if (quota_enabled) -- kfree(rm_quota); -+ kfree(rm_quota); - - return status; - } - - void ocfs2_recovery_thread(struct ocfs2_super *osb, int node_num) - { -+ int was_set = -1; -+ - mutex_lock(&osb->recovery_lock); -+ if (osb->recovery_state < OCFS2_REC_WANT_DISABLE) -+ was_set = ocfs2_recovery_map_set(osb, node_num); - - trace_ocfs2_recovery_thread(node_num, osb->node_num, -- osb->disable_recovery, osb->recovery_thread_task, -- osb->disable_recovery ? -- -1 : ocfs2_recovery_map_set(osb, node_num)); -+ osb->recovery_state, osb->recovery_thread_task, was_set); - -- if (osb->disable_recovery) -+ if (osb->recovery_state >= OCFS2_REC_WANT_DISABLE) - goto out; - - if (osb->recovery_thread_task) -diff --git a/fs/ocfs2/journal.h b/fs/ocfs2/journal.h -index e3c3a35dc5e0e7..6397170f302f22 100644 ---- a/fs/ocfs2/journal.h -+++ b/fs/ocfs2/journal.h -@@ -148,6 +148,7 @@ void ocfs2_wait_for_recovery(struct ocfs2_super *osb); - - int ocfs2_recovery_init(struct ocfs2_super *osb); - void ocfs2_recovery_exit(struct ocfs2_super *osb); -+void ocfs2_recovery_disable_quota(struct ocfs2_super *osb); - - int ocfs2_compute_replay_slots(struct ocfs2_super *osb); - void ocfs2_free_replay_slots(struct ocfs2_super *osb); -diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h -index 8fe826143d7bf4..5e3ebbab698ad1 100644 ---- a/fs/ocfs2/ocfs2.h -+++ b/fs/ocfs2/ocfs2.h -@@ -308,6 +308,21 @@ enum ocfs2_journal_trigger_type { - void ocfs2_initialize_journal_triggers(struct super_block *sb, - struct ocfs2_triggers triggers[]); - -+enum ocfs2_recovery_state { -+ OCFS2_REC_ENABLED = 0, -+ OCFS2_REC_QUOTA_WANT_DISABLE, -+ /* -+ * Must be OCFS2_REC_QUOTA_WANT_DISABLE + 1 for -+ * ocfs2_recovery_disable_quota() to work. -+ */ -+ OCFS2_REC_QUOTA_DISABLED, -+ OCFS2_REC_WANT_DISABLE, -+ /* -+ * Must be OCFS2_REC_WANT_DISABLE + 1 for ocfs2_recovery_exit() to work -+ */ -+ OCFS2_REC_DISABLED, -+}; -+ - struct ocfs2_journal; - struct ocfs2_slot_info; - struct ocfs2_recovery_map; -@@ -370,7 +385,7 @@ struct ocfs2_super - struct ocfs2_recovery_map *recovery_map; - struct ocfs2_replay_map *replay_map; - struct task_struct *recovery_thread_task; -- int disable_recovery; -+ enum ocfs2_recovery_state recovery_state; - wait_queue_head_t checkpoint_event; - struct ocfs2_journal *journal; - unsigned long osb_commit_interval; -diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c -index 4b4fa58cd32ff0..0ca8975a1df479 100644 ---- a/fs/ocfs2/quota_local.c -+++ b/fs/ocfs2/quota_local.c -@@ -453,8 +453,7 @@ struct ocfs2_quota_recovery *ocfs2_begin_quota_recovery( - - /* Sync changes in local quota file into global quota file and - * reinitialize local quota file. -- * The function expects local quota file to be already locked and -- * s_umount locked in shared mode. */ -+ * The function expects local quota file to be already locked. */ - static int ocfs2_recover_local_quota_file(struct inode *lqinode, - int type, - struct ocfs2_quota_recovery *rec) -@@ -585,7 +584,6 @@ int ocfs2_finish_quota_recovery(struct ocfs2_super *osb, - { - unsigned int ino[OCFS2_MAXQUOTAS] = { LOCAL_USER_QUOTA_SYSTEM_INODE, - LOCAL_GROUP_QUOTA_SYSTEM_INODE }; -- struct super_block *sb = osb->sb; - struct ocfs2_local_disk_dqinfo *ldinfo; - struct buffer_head *bh; - handle_t *handle; -@@ -597,7 +595,6 @@ int ocfs2_finish_quota_recovery(struct ocfs2_super *osb, - printk(KERN_NOTICE "ocfs2: Finishing quota recovery on device (%s) for " - "slot %u\n", osb->dev_str, slot_num); - -- down_read(&sb->s_umount); - for (type = 0; type < OCFS2_MAXQUOTAS; type++) { - if (list_empty(&(rec->r_list[type]))) - continue; -@@ -674,7 +671,6 @@ int ocfs2_finish_quota_recovery(struct ocfs2_super *osb, - break; - } - out: -- up_read(&sb->s_umount); - kfree(rec); - return status; - } -@@ -840,8 +836,7 @@ static int ocfs2_local_free_info(struct super_block *sb, int type) - ocfs2_release_local_quota_bitmaps(&oinfo->dqi_chunk); - - /* -- * s_umount held in exclusive mode protects us against racing with -- * recovery thread... -+ * ocfs2_dismount_volume() has already aborted quota recovery... - */ - if (oinfo->dqi_rec) { - ocfs2_free_quota_recovery(oinfo->dqi_rec); -diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c -index 84fa585c6513a5..e585e77cdc88e1 100644 ---- a/fs/ocfs2/super.c -+++ b/fs/ocfs2/super.c -@@ -1870,6 +1870,9 @@ static void ocfs2_dismount_volume(struct super_block *sb, int mnt_err) - /* Orphan scan should be stopped as early as possible */ - ocfs2_orphan_scan_stop(osb); - -+ /* Stop quota recovery so that we can disable quotas */ -+ ocfs2_recovery_disable_quota(osb); -+ - ocfs2_disable_quotas(osb); - - /* All dquots should be freed by now */ -diff --git a/fs/smb/client/cached_dir.c b/fs/smb/client/cached_dir.c -index 9c0ef4195b5829..74979466729535 100644 ---- a/fs/smb/client/cached_dir.c -+++ b/fs/smb/client/cached_dir.c -@@ -29,7 +29,6 @@ static struct cached_fid *find_or_create_cached_dir(struct cached_fids *cfids, - { - struct cached_fid *cfid; - -- spin_lock(&cfids->cfid_list_lock); - list_for_each_entry(cfid, &cfids->entries, entry) { - if (!strcmp(cfid->path, path)) { - /* -@@ -38,25 +37,20 @@ static struct cached_fid *find_or_create_cached_dir(struct cached_fids *cfids, - * being deleted due to a lease break. - */ - if (!cfid->time || !cfid->has_lease) { -- spin_unlock(&cfids->cfid_list_lock); - return NULL; - } - kref_get(&cfid->refcount); -- spin_unlock(&cfids->cfid_list_lock); - return cfid; - } - } - if (lookup_only) { -- spin_unlock(&cfids->cfid_list_lock); - return NULL; - } - if (cfids->num_entries >= max_cached_dirs) { -- spin_unlock(&cfids->cfid_list_lock); - return NULL; - } - cfid = init_cached_dir(path); - if (cfid == NULL) { -- spin_unlock(&cfids->cfid_list_lock); - return NULL; - } - cfid->cfids = cfids; -@@ -74,7 +68,6 @@ static struct cached_fid *find_or_create_cached_dir(struct cached_fids *cfids, - */ - cfid->has_lease = true; - -- spin_unlock(&cfids->cfid_list_lock); - return cfid; - } - -@@ -185,8 +178,10 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, - if (!utf16_path) - return -ENOMEM; - -+ spin_lock(&cfids->cfid_list_lock); - cfid = find_or_create_cached_dir(cfids, path, lookup_only, tcon->max_cached_dirs); - if (cfid == NULL) { -+ spin_unlock(&cfids->cfid_list_lock); - kfree(utf16_path); - return -ENOENT; - } -@@ -195,7 +190,6 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, - * Otherwise, it is either a new entry or laundromat worker removed it - * from @cfids->entries. Caller will put last reference if the latter. - */ -- spin_lock(&cfids->cfid_list_lock); - if (cfid->has_lease && cfid->time) { - spin_unlock(&cfids->cfid_list_lock); - *ret_cfid = cfid; -diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c -index 5a5277b4b53b11..72294764d4c20c 100644 ---- a/fs/smb/server/oplock.c -+++ b/fs/smb/server/oplock.c -@@ -1496,7 +1496,7 @@ struct lease_ctx_info *parse_lease_state(void *open_req) - - if (le16_to_cpu(cc->DataOffset) + le32_to_cpu(cc->DataLength) < - sizeof(struct create_lease_v2) - 4) -- return NULL; -+ goto err_out; - - memcpy(lreq->lease_key, lc->lcontext.LeaseKey, SMB2_LEASE_KEY_SIZE); - lreq->req_state = lc->lcontext.LeaseState; -@@ -1512,7 +1512,7 @@ struct lease_ctx_info *parse_lease_state(void *open_req) - - if (le16_to_cpu(cc->DataOffset) + le32_to_cpu(cc->DataLength) < - sizeof(struct create_lease)) -- return NULL; -+ goto err_out; - - memcpy(lreq->lease_key, lc->lcontext.LeaseKey, SMB2_LEASE_KEY_SIZE); - lreq->req_state = lc->lcontext.LeaseState; -@@ -1521,6 +1521,9 @@ struct lease_ctx_info *parse_lease_state(void *open_req) - lreq->version = 1; - } - return lreq; -+err_out: -+ kfree(lreq); -+ return NULL; - } - - /** -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index 13750a5e5ba02e..9bd817427a345a 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -632,6 +632,11 @@ smb2_get_name(const char *src, const int maxlen, struct nls_table *local_nls) - return name; - } - -+ if (*name == '\0') { -+ kfree(name); -+ return ERR_PTR(-EINVAL); -+ } -+ - if (*name == '\\') { - pr_err("not allow directory name included leading slash\n"); - kfree(name); -diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c -index fa5b7e63eb832e..f6616d687365a3 100644 ---- a/fs/smb/server/vfs.c -+++ b/fs/smb/server/vfs.c -@@ -443,6 +443,13 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos, - goto out; - } - -+ if (v_len <= *pos) { -+ pr_err("stream write position %lld is out of bounds (stream length: %zd)\n", -+ *pos, v_len); -+ err = -EINVAL; -+ goto out; -+ } -+ - if (v_len < size) { - wbuf = kvzalloc(size, GFP_KERNEL); - if (!wbuf) { -diff --git a/fs/smb/server/vfs_cache.c b/fs/smb/server/vfs_cache.c -index 271a23abc82fdd..002f0864abee62 100644 ---- a/fs/smb/server/vfs_cache.c -+++ b/fs/smb/server/vfs_cache.c -@@ -644,21 +644,40 @@ __close_file_table_ids(struct ksmbd_file_table *ft, - bool (*skip)(struct ksmbd_tree_connect *tcon, - struct ksmbd_file *fp)) - { -- unsigned int id; -- struct ksmbd_file *fp; -- int num = 0; -+ struct ksmbd_file *fp; -+ unsigned int id = 0; -+ int num = 0; -+ -+ while (1) { -+ write_lock(&ft->lock); -+ fp = idr_get_next(ft->idr, &id); -+ if (!fp) { -+ write_unlock(&ft->lock); -+ break; -+ } - -- idr_for_each_entry(ft->idr, fp, id) { -- if (skip(tcon, fp)) -+ if (skip(tcon, fp) || -+ !atomic_dec_and_test(&fp->refcount)) { -+ id++; -+ write_unlock(&ft->lock); - continue; -+ } - - set_close_state_blocked_works(fp); -+ idr_remove(ft->idr, fp->volatile_id); -+ fp->volatile_id = KSMBD_NO_FID; -+ write_unlock(&ft->lock); -+ -+ down_write(&fp->f_ci->m_lock); -+ list_del_init(&fp->node); -+ up_write(&fp->f_ci->m_lock); - -- if (!atomic_dec_and_test(&fp->refcount)) -- continue; - __ksmbd_close_fd(ft, fp); -+ - num++; -+ id++; - } -+ - return num; - } - -diff --git a/include/linux/cpu.h b/include/linux/cpu.h -index a7d91a167a8b64..20db7fc0651f3c 100644 ---- a/include/linux/cpu.h -+++ b/include/linux/cpu.h -@@ -77,6 +77,8 @@ extern ssize_t cpu_show_gds(struct device *dev, - struct device_attribute *attr, char *buf); - extern ssize_t cpu_show_reg_file_data_sampling(struct device *dev, - struct device_attribute *attr, char *buf); -+extern ssize_t cpu_show_indirect_target_selection(struct device *dev, -+ struct device_attribute *attr, char *buf); - - extern __printf(4, 5) - struct device *cpu_device_create(struct device *parent, void *drvdata, -diff --git a/include/linux/module.h b/include/linux/module.h -index f2a8624eef1eca..f58d1eb260fa9e 100644 ---- a/include/linux/module.h -+++ b/include/linux/module.h -@@ -572,6 +572,11 @@ struct module { - atomic_t refcnt; - #endif - -+#ifdef CONFIG_MITIGATION_ITS -+ int its_num_pages; -+ void **its_page_array; -+#endif -+ - #ifdef CONFIG_CONSTRUCTORS - /* Constructor functions. */ - ctor_fn_t *ctors; -diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index 337a9d1c558f3c..0b0a172337dbac 100644 ---- a/include/linux/netdevice.h -+++ b/include/linux/netdevice.h -@@ -3614,6 +3614,17 @@ static inline void netdev_tx_reset_queue(struct netdev_queue *q) - #endif - } - -+/** -+ * netdev_tx_reset_subqueue - reset the BQL stats and state of a netdev queue -+ * @dev: network device -+ * @qid: stack index of the queue to reset -+ */ -+static inline void netdev_tx_reset_subqueue(const struct net_device *dev, -+ u32 qid) -+{ -+ netdev_tx_reset_queue(netdev_get_tx_queue(dev, qid)); -+} -+ - /** - * netdev_reset_queue - reset the packets and bytes count of a network device - * @dev_queue: network device -@@ -3623,7 +3634,7 @@ static inline void netdev_tx_reset_queue(struct netdev_queue *q) - */ - static inline void netdev_reset_queue(struct net_device *dev_queue) - { -- netdev_tx_reset_queue(netdev_get_tx_queue(dev_queue, 0)); -+ netdev_tx_reset_subqueue(dev_queue, 0); - } - - /** -diff --git a/include/linux/types.h b/include/linux/types.h -index 253168bb3fe15c..78d87c751ff58c 100644 ---- a/include/linux/types.h -+++ b/include/linux/types.h -@@ -115,8 +115,9 @@ typedef u64 u_int64_t; - typedef s64 int64_t; - #endif - --/* this is a special 64bit data type that is 8-byte aligned */ -+/* These are the special 64-bit data types that are 8-byte aligned */ - #define aligned_u64 __aligned_u64 -+#define aligned_s64 __aligned_s64 - #define aligned_be64 __aligned_be64 - #define aligned_le64 __aligned_le64 - -diff --git a/include/uapi/linux/types.h b/include/uapi/linux/types.h -index 6375a06840520d..48b933938877d9 100644 ---- a/include/uapi/linux/types.h -+++ b/include/uapi/linux/types.h -@@ -53,6 +53,7 @@ typedef __u32 __bitwise __wsum; - * No conversions are necessary between 32-bit user-space and a 64-bit kernel. - */ - #define __aligned_u64 __u64 __attribute__((aligned(8))) -+#define __aligned_s64 __s64 __attribute__((aligned(8))) - #define __aligned_be64 __be64 __attribute__((aligned(8))) - #define __aligned_le64 __le64 __attribute__((aligned(8))) - -diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c -index 3ce93418e0151d..db592fa549b738 100644 ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -422,24 +422,6 @@ static struct io_kiocb *__io_prep_linked_timeout(struct io_kiocb *req) - return req->link; - } - --static inline struct io_kiocb *io_prep_linked_timeout(struct io_kiocb *req) --{ -- if (likely(!(req->flags & REQ_F_ARM_LTIMEOUT))) -- return NULL; -- return __io_prep_linked_timeout(req); --} -- --static noinline void __io_arm_ltimeout(struct io_kiocb *req) --{ -- io_queue_linked_timeout(__io_prep_linked_timeout(req)); --} -- --static inline void io_arm_ltimeout(struct io_kiocb *req) --{ -- if (unlikely(req->flags & REQ_F_ARM_LTIMEOUT)) -- __io_arm_ltimeout(req); --} -- - static void io_prep_async_work(struct io_kiocb *req) - { - const struct io_issue_def *def = &io_issue_defs[req->opcode]; -@@ -493,7 +475,6 @@ static void io_prep_async_link(struct io_kiocb *req) - - static void io_queue_iowq(struct io_kiocb *req) - { -- struct io_kiocb *link = io_prep_linked_timeout(req); - struct io_uring_task *tctx = req->task->io_uring; - - BUG_ON(!tctx); -@@ -518,8 +499,6 @@ static void io_queue_iowq(struct io_kiocb *req) - - trace_io_uring_queue_async_work(req, io_wq_is_hashed(&req->work)); - io_wq_enqueue(tctx->io_wq, &req->work); -- if (link) -- io_queue_linked_timeout(link); - } - - static __cold void io_queue_deferred(struct io_ring_ctx *ctx) -@@ -940,6 +919,14 @@ static bool __io_post_aux_cqe(struct io_ring_ctx *ctx, u64 user_data, s32 res, u - { - bool filled; - -+ /* -+ * If multishot has already posted deferred completions, ensure that -+ * those are flushed first before posting this one. If not, CQEs -+ * could get reordered. -+ */ -+ if (!wq_list_empty(&ctx->submit_state.compl_reqs)) -+ __io_submit_flush_completions(ctx); -+ - io_cq_lock(ctx); - filled = io_fill_cqe_aux(ctx, user_data, res, cflags); - if (!filled && allow_overflow) -@@ -1863,17 +1850,24 @@ static bool io_assign_file(struct io_kiocb *req, const struct io_issue_def *def, - return !!req->file; - } - -+#define REQ_ISSUE_SLOW_FLAGS (REQ_F_CREDS | REQ_F_ARM_LTIMEOUT) -+ - static int io_issue_sqe(struct io_kiocb *req, unsigned int issue_flags) - { - const struct io_issue_def *def = &io_issue_defs[req->opcode]; - const struct cred *creds = NULL; -+ struct io_kiocb *link = NULL; - int ret; - - if (unlikely(!io_assign_file(req, def, issue_flags))) - return -EBADF; - -- if (unlikely((req->flags & REQ_F_CREDS) && req->creds != current_cred())) -- creds = override_creds(req->creds); -+ if (unlikely(req->flags & REQ_ISSUE_SLOW_FLAGS)) { -+ if ((req->flags & REQ_F_CREDS) && req->creds != current_cred()) -+ creds = override_creds(req->creds); -+ if (req->flags & REQ_F_ARM_LTIMEOUT) -+ link = __io_prep_linked_timeout(req); -+ } - - if (!def->audit_skip) - audit_uring_entry(req->opcode); -@@ -1883,8 +1877,12 @@ static int io_issue_sqe(struct io_kiocb *req, unsigned int issue_flags) - if (!def->audit_skip) - audit_uring_exit(!ret, ret); - -- if (creds) -- revert_creds(creds); -+ if (unlikely(creds || link)) { -+ if (creds) -+ revert_creds(creds); -+ if (link) -+ io_queue_linked_timeout(link); -+ } - - if (ret == IOU_OK) { - if (issue_flags & IO_URING_F_COMPLETE_DEFER) -@@ -1939,8 +1937,6 @@ void io_wq_submit_work(struct io_wq_work *work) - else - req_ref_get(req); - -- io_arm_ltimeout(req); -- - /* either cancelled or io-wq is dying, so don't touch tctx->iowq */ - if (work->flags & IO_WQ_WORK_CANCEL) { - fail: -@@ -2036,15 +2032,11 @@ struct file *io_file_get_normal(struct io_kiocb *req, int fd) - static void io_queue_async(struct io_kiocb *req, int ret) - __must_hold(&req->ctx->uring_lock) - { -- struct io_kiocb *linked_timeout; -- - if (ret != -EAGAIN || (req->flags & REQ_F_NOWAIT)) { - io_req_defer_failed(req, ret); - return; - } - -- linked_timeout = io_prep_linked_timeout(req); -- - switch (io_arm_poll_handler(req, 0)) { - case IO_APOLL_READY: - io_kbuf_recycle(req, 0); -@@ -2057,9 +2049,6 @@ static void io_queue_async(struct io_kiocb *req, int ret) - case IO_APOLL_OK: - break; - } -- -- if (linked_timeout) -- io_queue_linked_timeout(linked_timeout); - } - - static inline void io_queue_sqe(struct io_kiocb *req) -@@ -2073,9 +2062,7 @@ static inline void io_queue_sqe(struct io_kiocb *req) - * We async punt it if the file wasn't marked NOWAIT, or if the file - * doesn't support non-blocking read/write attempts - */ -- if (likely(!ret)) -- io_arm_ltimeout(req); -- else -+ if (unlikely(ret)) - io_queue_async(req, ret); - } - -diff --git a/kernel/params.c b/kernel/params.c -index c7aed3c51cd538..e39ac5420cd6dc 100644 ---- a/kernel/params.c -+++ b/kernel/params.c -@@ -945,7 +945,9 @@ struct kset *module_kset; - static void module_kobj_release(struct kobject *kobj) - { - struct module_kobject *mk = to_module_kobject(kobj); -- complete(mk->kobj_completion); -+ -+ if (mk->kobj_completion) -+ complete(mk->kobj_completion); - } - - const struct kobj_type module_ktype = { -diff --git a/net/can/gw.c b/net/can/gw.c -index 37528826935e74..e65500c52bf5c7 100644 ---- a/net/can/gw.c -+++ b/net/can/gw.c -@@ -130,7 +130,7 @@ struct cgw_job { - u32 handled_frames; - u32 dropped_frames; - u32 deleted_frames; -- struct cf_mod mod; -+ struct cf_mod __rcu *cf_mod; - union { - /* CAN frame data source */ - struct net_device *dev; -@@ -459,6 +459,7 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data) - struct cgw_job *gwj = (struct cgw_job *)data; - struct canfd_frame *cf; - struct sk_buff *nskb; -+ struct cf_mod *mod; - int modidx = 0; - - /* process strictly Classic CAN or CAN FD frames */ -@@ -506,7 +507,8 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data) - * When there is at least one modification function activated, - * we need to copy the skb as we want to modify skb->data. - */ -- if (gwj->mod.modfunc[0]) -+ mod = rcu_dereference(gwj->cf_mod); -+ if (mod->modfunc[0]) - nskb = skb_copy(skb, GFP_ATOMIC); - else - nskb = skb_clone(skb, GFP_ATOMIC); -@@ -529,8 +531,8 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data) - cf = (struct canfd_frame *)nskb->data; - - /* perform preprocessed modification functions if there are any */ -- while (modidx < MAX_MODFUNCTIONS && gwj->mod.modfunc[modidx]) -- (*gwj->mod.modfunc[modidx++])(cf, &gwj->mod); -+ while (modidx < MAX_MODFUNCTIONS && mod->modfunc[modidx]) -+ (*mod->modfunc[modidx++])(cf, mod); - - /* Has the CAN frame been modified? */ - if (modidx) { -@@ -546,11 +548,11 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data) - } - - /* check for checksum updates */ -- if (gwj->mod.csumfunc.crc8) -- (*gwj->mod.csumfunc.crc8)(cf, &gwj->mod.csum.crc8); -+ if (mod->csumfunc.crc8) -+ (*mod->csumfunc.crc8)(cf, &mod->csum.crc8); - -- if (gwj->mod.csumfunc.xor) -- (*gwj->mod.csumfunc.xor)(cf, &gwj->mod.csum.xor); -+ if (mod->csumfunc.xor) -+ (*mod->csumfunc.xor)(cf, &mod->csum.xor); - } - - /* clear the skb timestamp if not configured the other way */ -@@ -581,9 +583,20 @@ static void cgw_job_free_rcu(struct rcu_head *rcu_head) - { - struct cgw_job *gwj = container_of(rcu_head, struct cgw_job, rcu); - -+ /* cgw_job::cf_mod is always accessed from the same cgw_job object within -+ * the same RCU read section. Once cgw_job is scheduled for removal, -+ * cf_mod can also be removed without mandating an additional grace period. -+ */ -+ kfree(rcu_access_pointer(gwj->cf_mod)); - kmem_cache_free(cgw_cache, gwj); - } - -+/* Return cgw_job::cf_mod with RTNL protected section */ -+static struct cf_mod *cgw_job_cf_mod(struct cgw_job *gwj) -+{ -+ return rcu_dereference_protected(gwj->cf_mod, rtnl_is_locked()); -+} -+ - static int cgw_notifier(struct notifier_block *nb, - unsigned long msg, void *ptr) - { -@@ -616,6 +629,7 @@ static int cgw_put_job(struct sk_buff *skb, struct cgw_job *gwj, int type, - { - struct rtcanmsg *rtcan; - struct nlmsghdr *nlh; -+ struct cf_mod *mod; - - nlh = nlmsg_put(skb, pid, seq, type, sizeof(*rtcan), flags); - if (!nlh) -@@ -650,82 +664,83 @@ static int cgw_put_job(struct sk_buff *skb, struct cgw_job *gwj, int type, - goto cancel; - } - -+ mod = cgw_job_cf_mod(gwj); - if (gwj->flags & CGW_FLAGS_CAN_FD) { - struct cgw_fdframe_mod mb; - -- if (gwj->mod.modtype.and) { -- memcpy(&mb.cf, &gwj->mod.modframe.and, sizeof(mb.cf)); -- mb.modtype = gwj->mod.modtype.and; -+ if (mod->modtype.and) { -+ memcpy(&mb.cf, &mod->modframe.and, sizeof(mb.cf)); -+ mb.modtype = mod->modtype.and; - if (nla_put(skb, CGW_FDMOD_AND, sizeof(mb), &mb) < 0) - goto cancel; - } - -- if (gwj->mod.modtype.or) { -- memcpy(&mb.cf, &gwj->mod.modframe.or, sizeof(mb.cf)); -- mb.modtype = gwj->mod.modtype.or; -+ if (mod->modtype.or) { -+ memcpy(&mb.cf, &mod->modframe.or, sizeof(mb.cf)); -+ mb.modtype = mod->modtype.or; - if (nla_put(skb, CGW_FDMOD_OR, sizeof(mb), &mb) < 0) - goto cancel; - } - -- if (gwj->mod.modtype.xor) { -- memcpy(&mb.cf, &gwj->mod.modframe.xor, sizeof(mb.cf)); -- mb.modtype = gwj->mod.modtype.xor; -+ if (mod->modtype.xor) { -+ memcpy(&mb.cf, &mod->modframe.xor, sizeof(mb.cf)); -+ mb.modtype = mod->modtype.xor; - if (nla_put(skb, CGW_FDMOD_XOR, sizeof(mb), &mb) < 0) - goto cancel; - } - -- if (gwj->mod.modtype.set) { -- memcpy(&mb.cf, &gwj->mod.modframe.set, sizeof(mb.cf)); -- mb.modtype = gwj->mod.modtype.set; -+ if (mod->modtype.set) { -+ memcpy(&mb.cf, &mod->modframe.set, sizeof(mb.cf)); -+ mb.modtype = mod->modtype.set; - if (nla_put(skb, CGW_FDMOD_SET, sizeof(mb), &mb) < 0) - goto cancel; - } - } else { - struct cgw_frame_mod mb; - -- if (gwj->mod.modtype.and) { -- memcpy(&mb.cf, &gwj->mod.modframe.and, sizeof(mb.cf)); -- mb.modtype = gwj->mod.modtype.and; -+ if (mod->modtype.and) { -+ memcpy(&mb.cf, &mod->modframe.and, sizeof(mb.cf)); -+ mb.modtype = mod->modtype.and; - if (nla_put(skb, CGW_MOD_AND, sizeof(mb), &mb) < 0) - goto cancel; - } - -- if (gwj->mod.modtype.or) { -- memcpy(&mb.cf, &gwj->mod.modframe.or, sizeof(mb.cf)); -- mb.modtype = gwj->mod.modtype.or; -+ if (mod->modtype.or) { -+ memcpy(&mb.cf, &mod->modframe.or, sizeof(mb.cf)); -+ mb.modtype = mod->modtype.or; - if (nla_put(skb, CGW_MOD_OR, sizeof(mb), &mb) < 0) - goto cancel; - } - -- if (gwj->mod.modtype.xor) { -- memcpy(&mb.cf, &gwj->mod.modframe.xor, sizeof(mb.cf)); -- mb.modtype = gwj->mod.modtype.xor; -+ if (mod->modtype.xor) { -+ memcpy(&mb.cf, &mod->modframe.xor, sizeof(mb.cf)); -+ mb.modtype = mod->modtype.xor; - if (nla_put(skb, CGW_MOD_XOR, sizeof(mb), &mb) < 0) - goto cancel; - } - -- if (gwj->mod.modtype.set) { -- memcpy(&mb.cf, &gwj->mod.modframe.set, sizeof(mb.cf)); -- mb.modtype = gwj->mod.modtype.set; -+ if (mod->modtype.set) { -+ memcpy(&mb.cf, &mod->modframe.set, sizeof(mb.cf)); -+ mb.modtype = mod->modtype.set; - if (nla_put(skb, CGW_MOD_SET, sizeof(mb), &mb) < 0) - goto cancel; - } - } - -- if (gwj->mod.uid) { -- if (nla_put_u32(skb, CGW_MOD_UID, gwj->mod.uid) < 0) -+ if (mod->uid) { -+ if (nla_put_u32(skb, CGW_MOD_UID, mod->uid) < 0) - goto cancel; - } - -- if (gwj->mod.csumfunc.crc8) { -+ if (mod->csumfunc.crc8) { - if (nla_put(skb, CGW_CS_CRC8, CGW_CS_CRC8_LEN, -- &gwj->mod.csum.crc8) < 0) -+ &mod->csum.crc8) < 0) - goto cancel; - } - -- if (gwj->mod.csumfunc.xor) { -+ if (mod->csumfunc.xor) { - if (nla_put(skb, CGW_CS_XOR, CGW_CS_XOR_LEN, -- &gwj->mod.csum.xor) < 0) -+ &mod->csum.xor) < 0) - goto cancel; - } - -@@ -1059,7 +1074,7 @@ static int cgw_create_job(struct sk_buff *skb, struct nlmsghdr *nlh, - struct net *net = sock_net(skb->sk); - struct rtcanmsg *r; - struct cgw_job *gwj; -- struct cf_mod mod; -+ struct cf_mod *mod; - struct can_can_gw ccgw; - u8 limhops = 0; - int err = 0; -@@ -1078,37 +1093,48 @@ static int cgw_create_job(struct sk_buff *skb, struct nlmsghdr *nlh, - if (r->gwtype != CGW_TYPE_CAN_CAN) - return -EINVAL; - -- err = cgw_parse_attr(nlh, &mod, CGW_TYPE_CAN_CAN, &ccgw, &limhops); -+ mod = kmalloc(sizeof(*mod), GFP_KERNEL); -+ if (!mod) -+ return -ENOMEM; -+ -+ err = cgw_parse_attr(nlh, mod, CGW_TYPE_CAN_CAN, &ccgw, &limhops); - if (err < 0) -- return err; -+ goto out_free_cf; - -- if (mod.uid) { -+ if (mod->uid) { - ASSERT_RTNL(); - - /* check for updating an existing job with identical uid */ - hlist_for_each_entry(gwj, &net->can.cgw_list, list) { -- if (gwj->mod.uid != mod.uid) -+ struct cf_mod *old_cf; -+ -+ old_cf = cgw_job_cf_mod(gwj); -+ if (old_cf->uid != mod->uid) - continue; - - /* interfaces & filters must be identical */ -- if (memcmp(&gwj->ccgw, &ccgw, sizeof(ccgw))) -- return -EINVAL; -+ if (memcmp(&gwj->ccgw, &ccgw, sizeof(ccgw))) { -+ err = -EINVAL; -+ goto out_free_cf; -+ } - -- /* update modifications with disabled softirq & quit */ -- local_bh_disable(); -- memcpy(&gwj->mod, &mod, sizeof(mod)); -- local_bh_enable(); -+ rcu_assign_pointer(gwj->cf_mod, mod); -+ kfree_rcu_mightsleep(old_cf); - return 0; - } - } - - /* ifindex == 0 is not allowed for job creation */ -- if (!ccgw.src_idx || !ccgw.dst_idx) -- return -ENODEV; -+ if (!ccgw.src_idx || !ccgw.dst_idx) { -+ err = -ENODEV; -+ goto out_free_cf; -+ } - - gwj = kmem_cache_alloc(cgw_cache, GFP_KERNEL); -- if (!gwj) -- return -ENOMEM; -+ if (!gwj) { -+ err = -ENOMEM; -+ goto out_free_cf; -+ } - - gwj->handled_frames = 0; - gwj->dropped_frames = 0; -@@ -1118,7 +1144,7 @@ static int cgw_create_job(struct sk_buff *skb, struct nlmsghdr *nlh, - gwj->limit_hops = limhops; - - /* insert already parsed information */ -- memcpy(&gwj->mod, &mod, sizeof(mod)); -+ RCU_INIT_POINTER(gwj->cf_mod, mod); - memcpy(&gwj->ccgw, &ccgw, sizeof(ccgw)); - - err = -ENODEV; -@@ -1152,9 +1178,11 @@ static int cgw_create_job(struct sk_buff *skb, struct nlmsghdr *nlh, - if (!err) - hlist_add_head_rcu(&gwj->list, &net->can.cgw_list); - out: -- if (err) -+ if (err) { - kmem_cache_free(cgw_cache, gwj); -- -+out_free_cf: -+ kfree(mod); -+ } - return err; - } - -@@ -1214,19 +1242,22 @@ static int cgw_remove_job(struct sk_buff *skb, struct nlmsghdr *nlh, - - /* remove only the first matching entry */ - hlist_for_each_entry_safe(gwj, nx, &net->can.cgw_list, list) { -+ struct cf_mod *cf_mod; -+ - if (gwj->flags != r->flags) - continue; - - if (gwj->limit_hops != limhops) - continue; - -+ cf_mod = cgw_job_cf_mod(gwj); - /* we have a match when uid is enabled and identical */ -- if (gwj->mod.uid || mod.uid) { -- if (gwj->mod.uid != mod.uid) -+ if (cf_mod->uid || mod.uid) { -+ if (cf_mod->uid != mod.uid) - continue; - } else { - /* no uid => check for identical modifications */ -- if (memcmp(&gwj->mod, &mod, sizeof(mod))) -+ if (memcmp(cf_mod, &mod, sizeof(mod))) - continue; - } - -diff --git a/net/core/filter.c b/net/core/filter.c -index 066277b91a1be8..5143c8a9e52cab 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -2507,6 +2507,7 @@ int skb_do_redirect(struct sk_buff *skb) - goto out_drop; - skb->dev = dev; - dev_sw_netstats_rx_add(dev, skb->len); -+ skb_scrub_packet(skb, false); - return -EAGAIN; - } - return flags & BPF_F_NEIGH ? -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index bb9add46e382a6..231fa4dc6cde4a 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -3189,16 +3189,13 @@ static void add_v4_addrs(struct inet6_dev *idev) - struct in6_addr addr; - struct net_device *dev; - struct net *net = dev_net(idev->dev); -- int scope, plen, offset = 0; -+ int scope, plen; - u32 pflags = 0; - - ASSERT_RTNL(); - - memset(&addr, 0, sizeof(struct in6_addr)); -- /* in case of IP6GRE the dev_addr is an IPv6 and therefore we use only the last 4 bytes */ -- if (idev->dev->addr_len == sizeof(struct in6_addr)) -- offset = sizeof(struct in6_addr) - 4; -- memcpy(&addr.s6_addr32[3], idev->dev->dev_addr + offset, 4); -+ memcpy(&addr.s6_addr32[3], idev->dev->dev_addr, 4); - - if (!(idev->dev->flags & IFF_POINTOPOINT) && idev->dev->type == ARPHRD_SIT) { - scope = IPV6_ADDR_COMPATv4; -@@ -3508,7 +3505,13 @@ static void addrconf_gre_config(struct net_device *dev) - return; - } - -- if (dev->type == ARPHRD_ETHER) { -+ /* Generate the IPv6 link-local address using addrconf_addr_gen(), -+ * unless we have an IPv4 GRE device not bound to an IP address and -+ * which is in EUI64 mode (as __ipv6_isatap_ifid() would fail in this -+ * case). Such devices fall back to add_v4_addrs() instead. -+ */ -+ if (!(dev->type == ARPHRD_IPGRE && *(__be32 *)dev->dev_addr == 0 && -+ idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_EUI64)) { - addrconf_addr_gen(idev, true); - return; - } -diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h -index 20aad81fcad7e6..c2d88b1b06b872 100644 ---- a/net/netfilter/ipset/ip_set_hash_gen.h -+++ b/net/netfilter/ipset/ip_set_hash_gen.h -@@ -63,7 +63,7 @@ struct hbucket { - #define ahash_sizeof_regions(htable_bits) \ - (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region)) - #define ahash_region(n, htable_bits) \ -- ((n) % ahash_numof_locks(htable_bits)) -+ ((n) / jhash_size(HTABLE_REGION_BITS)) - #define ahash_bucket_start(h, htable_bits) \ - ((htable_bits) < HTABLE_REGION_BITS ? 0 \ - : (h) * jhash_size(HTABLE_REGION_BITS)) -diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c -index 5cd511162bc038..0103c4a4d10a55 100644 ---- a/net/netfilter/ipvs/ip_vs_xmit.c -+++ b/net/netfilter/ipvs/ip_vs_xmit.c -@@ -119,13 +119,12 @@ __mtu_check_toobig_v6(const struct sk_buff *skb, u32 mtu) - return false; - } - --/* Get route to daddr, update *saddr, optionally bind route to saddr */ -+/* Get route to daddr, optionally bind route to saddr */ - static struct rtable *do_output_route4(struct net *net, __be32 daddr, -- int rt_mode, __be32 *saddr) -+ int rt_mode, __be32 *ret_saddr) - { - struct flowi4 fl4; - struct rtable *rt; -- bool loop = false; - - memset(&fl4, 0, sizeof(fl4)); - fl4.daddr = daddr; -@@ -135,23 +134,17 @@ static struct rtable *do_output_route4(struct net *net, __be32 daddr, - retry: - rt = ip_route_output_key(net, &fl4); - if (IS_ERR(rt)) { -- /* Invalid saddr ? */ -- if (PTR_ERR(rt) == -EINVAL && *saddr && -- rt_mode & IP_VS_RT_MODE_CONNECT && !loop) { -- *saddr = 0; -- flowi4_update_output(&fl4, 0, daddr, 0); -- goto retry; -- } - IP_VS_DBG_RL("ip_route_output error, dest: %pI4\n", &daddr); - return NULL; -- } else if (!*saddr && rt_mode & IP_VS_RT_MODE_CONNECT && fl4.saddr) { -+ } -+ if (rt_mode & IP_VS_RT_MODE_CONNECT && fl4.saddr) { - ip_rt_put(rt); -- *saddr = fl4.saddr; - flowi4_update_output(&fl4, 0, daddr, fl4.saddr); -- loop = true; -+ rt_mode = 0; - goto retry; - } -- *saddr = fl4.saddr; -+ if (ret_saddr) -+ *ret_saddr = fl4.saddr; - return rt; - } - -@@ -344,19 +337,15 @@ __ip_vs_get_out_rt(struct netns_ipvs *ipvs, int skb_af, struct sk_buff *skb, - if (ret_saddr) - *ret_saddr = dest_dst->dst_saddr.ip; - } else { -- __be32 saddr = htonl(INADDR_ANY); -- - noref = 0; - - /* For such unconfigured boxes avoid many route lookups - * for performance reasons because we do not remember saddr - */ - rt_mode &= ~IP_VS_RT_MODE_CONNECT; -- rt = do_output_route4(net, daddr, rt_mode, &saddr); -+ rt = do_output_route4(net, daddr, rt_mode, ret_saddr); - if (!rt) - goto err_unreach; -- if (ret_saddr) -- *ret_saddr = saddr; - } - - local = (rt->rt_flags & RTCF_LOCAL) ? 1 : 0; -diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c -index 6c5afb4ad67bb6..10c646b32b9d08 100644 ---- a/net/openvswitch/actions.c -+++ b/net/openvswitch/actions.c -@@ -959,8 +959,7 @@ static int output_userspace(struct datapath *dp, struct sk_buff *skb, - upcall.cmd = OVS_PACKET_CMD_ACTION; - upcall.mru = OVS_CB(skb)->mru; - -- for (a = nla_data(attr), rem = nla_len(attr); rem > 0; -- a = nla_next(a, &rem)) { -+ nla_for_each_nested(a, attr, rem) { - switch (nla_type(a)) { - case OVS_USERSPACE_ATTR_USERDATA: - upcall.userdata = a; -diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c -index 9a3f7ea80b34b9..716da8c6b3def3 100644 ---- a/net/sched/sch_htb.c -+++ b/net/sched/sch_htb.c -@@ -348,7 +348,8 @@ static void htb_add_to_wait_tree(struct htb_sched *q, - */ - static inline void htb_next_rb_node(struct rb_node **n) - { -- *n = rb_next(*n); -+ if (*n) -+ *n = rb_next(*n); - } - - /** -@@ -609,8 +610,8 @@ static inline void htb_activate(struct htb_sched *q, struct htb_class *cl) - */ - static inline void htb_deactivate(struct htb_sched *q, struct htb_class *cl) - { -- WARN_ON(!cl->prio_activity); -- -+ if (!cl->prio_activity) -+ return; - htb_deactivate_prios(q, cl); - cl->prio_activity = 0; - } -@@ -1485,8 +1486,6 @@ static void htb_qlen_notify(struct Qdisc *sch, unsigned long arg) - { - struct htb_class *cl = (struct htb_class *)arg; - -- if (!cl->prio_activity) -- return; - htb_deactivate(qdisc_priv(sch), cl); - } - -@@ -1740,8 +1739,7 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg, - if (cl->parent) - cl->parent->children--; - -- if (cl->prio_activity) -- htb_deactivate(q, cl); -+ htb_deactivate(q, cl); - - if (cl->cmode != HTB_CAN_SEND) - htb_safe_rb_erase(&cl->pq_node, -@@ -1949,8 +1947,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid, - /* turn parent into inner node */ - qdisc_purge_queue(parent->leaf.q); - parent_qdisc = parent->leaf.q; -- if (parent->prio_activity) -- htb_deactivate(q, parent); -+ htb_deactivate(q, parent); - - /* remove from evt list because of level change */ - if (parent->cmode != HTB_CAN_SEND) { -diff --git a/net/wireless/scan.c b/net/wireless/scan.c -index ce622a287abc6b..6db8c9a2a7a2b8 100644 ---- a/net/wireless/scan.c -+++ b/net/wireless/scan.c -@@ -2511,7 +2511,7 @@ cfg80211_defrag_mle(const struct element *mle, const u8 *ie, size_t ielen, - /* Required length for first defragmentation */ - buf_len = mle->datalen - 1; - for_each_element(elem, mle->data + mle->datalen, -- ielen - sizeof(*mle) + mle->datalen) { -+ ie + ielen - mle->data - mle->datalen) { - if (elem->id != WLAN_EID_FRAGMENT) - break; - diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.091-092.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.091-092.patch deleted file mode 100644 index 08903ea07d..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.091-092.patch +++ /dev/null @@ -1,4627 +0,0 @@ -diff --git a/Makefile b/Makefile -index a6a1942e2d00a9..51d975b3555195 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 91 -+SUBLEVEL = 92 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c -index 75523c1be07350..d8012d1a2e152d 100644 ---- a/arch/arm64/net/bpf_jit_comp.c -+++ b/arch/arm64/net/bpf_jit_comp.c -@@ -2001,7 +2001,11 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im, - emit(A64_STR64I(A64_R(20), A64_SP, regs_off + 8), ctx); - - if (flags & BPF_TRAMP_F_CALL_ORIG) { -- emit_addr_mov_i64(A64_R(0), (const u64)im, ctx); -+ /* for the first pass, assume the worst case */ -+ if (!ctx->image) -+ ctx->idx += 4; -+ else -+ emit_a64_mov_i64(A64_R(0), (const u64)im, ctx); - emit_call((const u64)__bpf_tramp_enter, ctx); - } - -@@ -2045,7 +2049,11 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im, - - if (flags & BPF_TRAMP_F_CALL_ORIG) { - im->ip_epilogue = ctx->image + ctx->idx; -- emit_addr_mov_i64(A64_R(0), (const u64)im, ctx); -+ /* for the first pass, assume the worst case */ -+ if (!ctx->image) -+ ctx->idx += 4; -+ else -+ emit_a64_mov_i64(A64_R(0), (const u64)im, ctx); - emit_call((const u64)__bpf_tramp_exit, ctx); - } - -diff --git a/arch/loongarch/Makefile b/arch/loongarch/Makefile -index 81e8089c9c4f18..9c6aff9376ec0b 100644 ---- a/arch/loongarch/Makefile -+++ b/arch/loongarch/Makefile -@@ -43,7 +43,7 @@ endif - - ifdef CONFIG_64BIT - ld-emul = $(64bit-emul) --cflags-y += -mabi=lp64s -+cflags-y += -mabi=lp64s -mcmodel=normal - endif - - cflags-y += -pipe -msoft-float -diff --git a/arch/loongarch/include/asm/ptrace.h b/arch/loongarch/include/asm/ptrace.h -index a5b63c84f8541a..e5d21e836d993c 100644 ---- a/arch/loongarch/include/asm/ptrace.h -+++ b/arch/loongarch/include/asm/ptrace.h -@@ -55,7 +55,7 @@ static inline void instruction_pointer_set(struct pt_regs *regs, unsigned long v - - /* Query offset/name of register from its name/offset */ - extern int regs_query_register_offset(const char *name); --#define MAX_REG_OFFSET (offsetof(struct pt_regs, __last)) -+#define MAX_REG_OFFSET (offsetof(struct pt_regs, __last) - sizeof(unsigned long)) - - /** - * regs_get_register() - get register value from its offset -diff --git a/arch/loongarch/include/asm/uprobes.h b/arch/loongarch/include/asm/uprobes.h -index c8f59983f702df..d01b6704e1d8e6 100644 ---- a/arch/loongarch/include/asm/uprobes.h -+++ b/arch/loongarch/include/asm/uprobes.h -@@ -15,7 +15,6 @@ typedef u32 uprobe_opcode_t; - #define UPROBE_XOLBP_INSN larch_insn_gen_break(BRK_UPROBE_XOLBP) - - struct arch_uprobe { -- unsigned long resume_era; - u32 insn[2]; - u32 ixol[2]; - bool simulate; -diff --git a/arch/loongarch/kernel/kfpu.c b/arch/loongarch/kernel/kfpu.c -index ec5b28e570c963..4c476904227f95 100644 ---- a/arch/loongarch/kernel/kfpu.c -+++ b/arch/loongarch/kernel/kfpu.c -@@ -18,11 +18,28 @@ static unsigned int euen_mask = CSR_EUEN_FPEN; - static DEFINE_PER_CPU(bool, in_kernel_fpu); - static DEFINE_PER_CPU(unsigned int, euen_current); - -+static inline void fpregs_lock(void) -+{ -+ if (IS_ENABLED(CONFIG_PREEMPT_RT)) -+ preempt_disable(); -+ else -+ local_bh_disable(); -+} -+ -+static inline void fpregs_unlock(void) -+{ -+ if (IS_ENABLED(CONFIG_PREEMPT_RT)) -+ preempt_enable(); -+ else -+ local_bh_enable(); -+} -+ - void kernel_fpu_begin(void) - { - unsigned int *euen_curr; - -- preempt_disable(); -+ if (!irqs_disabled()) -+ fpregs_lock(); - - WARN_ON(this_cpu_read(in_kernel_fpu)); - -@@ -73,7 +90,8 @@ void kernel_fpu_end(void) - - this_cpu_write(in_kernel_fpu, false); - -- preempt_enable(); -+ if (!irqs_disabled()) -+ fpregs_unlock(); - } - EXPORT_SYMBOL_GPL(kernel_fpu_end); - -diff --git a/arch/loongarch/kernel/time.c b/arch/loongarch/kernel/time.c -index e7015f7b70e37c..a3732f754b5d8f 100644 ---- a/arch/loongarch/kernel/time.c -+++ b/arch/loongarch/kernel/time.c -@@ -110,7 +110,7 @@ static unsigned long __init get_loops_per_jiffy(void) - return lpj; - } - --static long init_offset __nosavedata; -+static long init_offset; - - void save_counter(void) - { -diff --git a/arch/loongarch/kernel/uprobes.c b/arch/loongarch/kernel/uprobes.c -index 87abc7137b738e..6022eb0f71dbce 100644 ---- a/arch/loongarch/kernel/uprobes.c -+++ b/arch/loongarch/kernel/uprobes.c -@@ -42,7 +42,6 @@ int arch_uprobe_pre_xol(struct arch_uprobe *auprobe, struct pt_regs *regs) - utask->autask.saved_trap_nr = current->thread.trap_nr; - current->thread.trap_nr = UPROBE_TRAP_NR; - instruction_pointer_set(regs, utask->xol_vaddr); -- user_enable_single_step(current); - - return 0; - } -@@ -53,13 +52,7 @@ int arch_uprobe_post_xol(struct arch_uprobe *auprobe, struct pt_regs *regs) - - WARN_ON_ONCE(current->thread.trap_nr != UPROBE_TRAP_NR); - current->thread.trap_nr = utask->autask.saved_trap_nr; -- -- if (auprobe->simulate) -- instruction_pointer_set(regs, auprobe->resume_era); -- else -- instruction_pointer_set(regs, utask->vaddr + LOONGARCH_INSN_SIZE); -- -- user_disable_single_step(current); -+ instruction_pointer_set(regs, utask->vaddr + LOONGARCH_INSN_SIZE); - - return 0; - } -@@ -70,7 +63,6 @@ void arch_uprobe_abort_xol(struct arch_uprobe *auprobe, struct pt_regs *regs) - - current->thread.trap_nr = utask->autask.saved_trap_nr; - instruction_pointer_set(regs, utask->vaddr); -- user_disable_single_step(current); - } - - bool arch_uprobe_xol_was_trapped(struct task_struct *t) -@@ -90,7 +82,6 @@ bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs) - - insn.word = auprobe->insn[0]; - arch_simulate_insn(insn, regs); -- auprobe->resume_era = regs->csr_era; - - return true; - } -diff --git a/arch/loongarch/power/hibernate.c b/arch/loongarch/power/hibernate.c -index 1e0590542f987c..e7b7346592cb2a 100644 ---- a/arch/loongarch/power/hibernate.c -+++ b/arch/loongarch/power/hibernate.c -@@ -2,6 +2,7 @@ - #include - #include - #include -+#include - #include - #include - -@@ -14,6 +15,7 @@ struct pt_regs saved_regs; - - void save_processor_state(void) - { -+ save_counter(); - saved_crmd = csr_read32(LOONGARCH_CSR_CRMD); - saved_prmd = csr_read32(LOONGARCH_CSR_PRMD); - saved_euen = csr_read32(LOONGARCH_CSR_EUEN); -@@ -26,6 +28,7 @@ void save_processor_state(void) - - void restore_processor_state(void) - { -+ sync_counter(); - csr_write32(saved_crmd, LOONGARCH_CSR_CRMD); - csr_write32(saved_prmd, LOONGARCH_CSR_PRMD); - csr_write32(saved_euen, LOONGARCH_CSR_EUEN); -diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c -index 4817e424d69658..8e6cad42b296ee 100644 ---- a/arch/x86/kernel/alternative.c -+++ b/arch/x86/kernel/alternative.c -@@ -730,7 +730,15 @@ static bool cpu_wants_indirect_its_thunk_at(unsigned long addr, int reg) - /* Lower-half of the cacheline? */ - return !(addr & 0x20); - } --#endif -+ -+u8 *its_static_thunk(int reg) -+{ -+ u8 *thunk = __x86_indirect_its_thunk_array[reg]; -+ -+ return thunk; -+} -+ -+#endif /* CONFIG_MITIGATION_ITS */ - - /* - * Rewrite the compiler generated retpoline thunk calls. -@@ -1449,13 +1457,6 @@ static void __apply_fineibt(s32 *start_retpoline, s32 *end_retpoline, - static void poison_cfi(void *addr) { } - #endif - --u8 *its_static_thunk(int reg) --{ -- u8 *thunk = __x86_indirect_its_thunk_array[reg]; -- -- return thunk; --} -- - #endif - - void apply_fineibt(s32 *start_retpoline, s32 *end_retpoline, -diff --git a/arch/x86/kvm/smm.c b/arch/x86/kvm/smm.c -index b42111a24cc28d..8e38c51359d05a 100644 ---- a/arch/x86/kvm/smm.c -+++ b/arch/x86/kvm/smm.c -@@ -131,6 +131,7 @@ void kvm_smm_changed(struct kvm_vcpu *vcpu, bool entering_smm) - - kvm_mmu_reset_context(vcpu); - } -+EXPORT_SYMBOL_GPL(kvm_smm_changed); - - void process_smi(struct kvm_vcpu *vcpu) - { -diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c -index 29c1be65cb71a0..c84a1451f194c4 100644 ---- a/arch/x86/kvm/svm/svm.c -+++ b/arch/x86/kvm/svm/svm.c -@@ -2211,12 +2211,6 @@ static int shutdown_interception(struct kvm_vcpu *vcpu) - struct kvm_run *kvm_run = vcpu->run; - struct vcpu_svm *svm = to_svm(vcpu); - -- /* -- * The VM save area has already been encrypted so it -- * cannot be reinitialized - just terminate. -- */ -- if (sev_es_guest(vcpu->kvm)) -- return -EINVAL; - - /* - * VMCB is undefined after a SHUTDOWN intercept. INIT the vCPU to put -@@ -2225,9 +2219,18 @@ static int shutdown_interception(struct kvm_vcpu *vcpu) - * userspace. At a platform view, INIT is acceptable behavior as - * there exist bare metal platforms that automatically INIT the CPU - * in response to shutdown. -+ * -+ * The VM save area for SEV-ES guests has already been encrypted so it -+ * cannot be reinitialized, i.e. synthesizing INIT is futile. - */ -- clear_page(svm->vmcb); -- kvm_vcpu_reset(vcpu, true); -+ if (!sev_es_guest(vcpu->kvm)) { -+ clear_page(svm->vmcb); -+#ifdef CONFIG_KVM_SMM -+ if (is_smm(vcpu)) -+ kvm_smm_changed(vcpu, false); -+#endif -+ kvm_vcpu_reset(vcpu, true); -+ } - - kvm_run->exit_reason = KVM_EXIT_SHUTDOWN; - return 0; -diff --git a/block/bio.c b/block/bio.c -index 4a8e7616995718..b197abbaebc464 100644 ---- a/block/bio.c -+++ b/block/bio.c -@@ -600,7 +600,7 @@ struct bio *bio_kmalloc(unsigned short nr_vecs, gfp_t gfp_mask) - { - struct bio *bio; - -- if (nr_vecs > UIO_MAXIOV) -+ if (nr_vecs > BIO_MAX_INLINE_VECS) - return NULL; - return kmalloc(struct_size(bio, bi_inline_vecs, nr_vecs), gfp_mask); - } -diff --git a/drivers/acpi/pptt.c b/drivers/acpi/pptt.c -index f73ce6e13065dd..54676e3d82dd59 100644 ---- a/drivers/acpi/pptt.c -+++ b/drivers/acpi/pptt.c -@@ -231,16 +231,18 @@ static int acpi_pptt_leaf_node(struct acpi_table_header *table_hdr, - sizeof(struct acpi_table_pptt)); - proc_sz = sizeof(struct acpi_pptt_processor); - -- while ((unsigned long)entry + proc_sz < table_end) { -+ /* ignore subtable types that are smaller than a processor node */ -+ while ((unsigned long)entry + proc_sz <= table_end) { - cpu_node = (struct acpi_pptt_processor *)entry; -+ - if (entry->type == ACPI_PPTT_TYPE_PROCESSOR && - cpu_node->parent == node_entry) - return 0; - if (entry->length == 0) - return 0; -+ - entry = ACPI_ADD_PTR(struct acpi_subtable_header, entry, - entry->length); -- - } - return 1; - } -@@ -273,15 +275,18 @@ static struct acpi_pptt_processor *acpi_find_processor_node(struct acpi_table_he - proc_sz = sizeof(struct acpi_pptt_processor); - - /* find the processor structure associated with this cpuid */ -- while ((unsigned long)entry + proc_sz < table_end) { -+ while ((unsigned long)entry + proc_sz <= table_end) { - cpu_node = (struct acpi_pptt_processor *)entry; - - if (entry->length == 0) { - pr_warn("Invalid zero length subtable\n"); - break; - } -+ /* entry->length may not equal proc_sz, revalidate the processor structure length */ - if (entry->type == ACPI_PPTT_TYPE_PROCESSOR && - acpi_cpu_id == cpu_node->acpi_processor_id && -+ (unsigned long)entry + entry->length <= table_end && -+ entry->length == proc_sz + cpu_node->number_of_priv_resources * sizeof(u32) && - acpi_pptt_leaf_node(table_hdr, cpu_node)) { - return (struct acpi_pptt_processor *)entry; - } -diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c -index a4274d8c7faaf3..f0d0c5a6d5127a 100644 ---- a/drivers/bluetooth/btnxpuart.c -+++ b/drivers/bluetooth/btnxpuart.c -@@ -601,8 +601,10 @@ static int nxp_download_firmware(struct hci_dev *hdev) - &nxpdev->tx_state), - msecs_to_jiffies(60000)); - -- release_firmware(nxpdev->fw); -- memset(nxpdev->fw_name, 0, sizeof(nxpdev->fw_name)); -+ if (nxpdev->fw && strlen(nxpdev->fw_name)) { -+ release_firmware(nxpdev->fw); -+ memset(nxpdev->fw_name, 0, sizeof(nxpdev->fw_name)); -+ } - - if (err == 0) { - bt_dev_err(hdev, "FW Download Timeout. offset: %d", -diff --git a/drivers/char/tpm/tpm_tis_core.h b/drivers/char/tpm/tpm_tis_core.h -index 369496a6aebf13..27e61ddfb62298 100644 ---- a/drivers/char/tpm/tpm_tis_core.h -+++ b/drivers/char/tpm/tpm_tis_core.h -@@ -54,7 +54,7 @@ enum tis_int_flags { - enum tis_defaults { - TIS_MEM_LEN = 0x5000, - TIS_SHORT_TIMEOUT = 750, /* ms */ -- TIS_LONG_TIMEOUT = 2000, /* 2 sec */ -+ TIS_LONG_TIMEOUT = 4000, /* 4 secs */ - TIS_TIMEOUT_MIN_ATML = 14700, /* usecs */ - TIS_TIMEOUT_MAX_ATML = 15000, /* usecs */ - }; -diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c -index eb8b733065b24d..9093f751f1336a 100644 ---- a/drivers/dma-buf/dma-resv.c -+++ b/drivers/dma-buf/dma-resv.c -@@ -313,8 +313,9 @@ void dma_resv_add_fence(struct dma_resv *obj, struct dma_fence *fence, - count++; - - dma_resv_list_set(fobj, i, fence, usage); -- /* pointer update must be visible before we extend the num_fences */ -- smp_store_mb(fobj->num_fences, count); -+ /* fence update must be visible before we extend the num_fences */ -+ smp_wmb(); -+ fobj->num_fences = count; - } - EXPORT_SYMBOL(dma_resv_add_fence); - -diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c -index 78b8a97b236376..ffe621695e472b 100644 ---- a/drivers/dma/dmatest.c -+++ b/drivers/dma/dmatest.c -@@ -827,9 +827,9 @@ static int dmatest_func(void *data) - } else { - dma_async_issue_pending(chan); - -- wait_event_timeout(thread->done_wait, -- done->done, -- msecs_to_jiffies(params->timeout)); -+ wait_event_freezable_timeout(thread->done_wait, -+ done->done, -+ msecs_to_jiffies(params->timeout)); - - status = dma_async_is_tx_complete(chan, cookie, NULL, - NULL); -diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c -index 786afb256b6e0d..92e86ae9db29d7 100644 ---- a/drivers/dma/idxd/init.c -+++ b/drivers/dma/idxd/init.c -@@ -145,6 +145,25 @@ static void idxd_cleanup_interrupts(struct idxd_device *idxd) - pci_free_irq_vectors(pdev); - } - -+static void idxd_clean_wqs(struct idxd_device *idxd) -+{ -+ struct idxd_wq *wq; -+ struct device *conf_dev; -+ int i; -+ -+ for (i = 0; i < idxd->max_wqs; i++) { -+ wq = idxd->wqs[i]; -+ if (idxd->hw.wq_cap.op_config) -+ bitmap_free(wq->opcap_bmap); -+ kfree(wq->wqcfg); -+ conf_dev = wq_confdev(wq); -+ put_device(conf_dev); -+ kfree(wq); -+ } -+ bitmap_free(idxd->wq_enable_map); -+ kfree(idxd->wqs); -+} -+ - static int idxd_setup_wqs(struct idxd_device *idxd) - { - struct device *dev = &idxd->pdev->dev; -@@ -159,8 +178,8 @@ static int idxd_setup_wqs(struct idxd_device *idxd) - - idxd->wq_enable_map = bitmap_zalloc_node(idxd->max_wqs, GFP_KERNEL, dev_to_node(dev)); - if (!idxd->wq_enable_map) { -- kfree(idxd->wqs); -- return -ENOMEM; -+ rc = -ENOMEM; -+ goto err_bitmap; - } - - for (i = 0; i < idxd->max_wqs; i++) { -@@ -179,10 +198,8 @@ static int idxd_setup_wqs(struct idxd_device *idxd) - conf_dev->bus = &dsa_bus_type; - conf_dev->type = &idxd_wq_device_type; - rc = dev_set_name(conf_dev, "wq%d.%d", idxd->id, wq->id); -- if (rc < 0) { -- put_device(conf_dev); -+ if (rc < 0) - goto err; -- } - - mutex_init(&wq->wq_lock); - init_waitqueue_head(&wq->err_queue); -@@ -193,7 +210,6 @@ static int idxd_setup_wqs(struct idxd_device *idxd) - wq->enqcmds_retries = IDXD_ENQCMDS_RETRIES; - wq->wqcfg = kzalloc_node(idxd->wqcfg_size, GFP_KERNEL, dev_to_node(dev)); - if (!wq->wqcfg) { -- put_device(conf_dev); - rc = -ENOMEM; - goto err; - } -@@ -201,9 +217,8 @@ static int idxd_setup_wqs(struct idxd_device *idxd) - if (idxd->hw.wq_cap.op_config) { - wq->opcap_bmap = bitmap_zalloc(IDXD_MAX_OPCAP_BITS, GFP_KERNEL); - if (!wq->opcap_bmap) { -- put_device(conf_dev); - rc = -ENOMEM; -- goto err; -+ goto err_opcap_bmap; - } - bitmap_copy(wq->opcap_bmap, idxd->opcap_bmap, IDXD_MAX_OPCAP_BITS); - } -@@ -214,15 +229,46 @@ static int idxd_setup_wqs(struct idxd_device *idxd) - - return 0; - -- err: -+err_opcap_bmap: -+ kfree(wq->wqcfg); -+ -+err: -+ put_device(conf_dev); -+ kfree(wq); -+ - while (--i >= 0) { - wq = idxd->wqs[i]; -+ if (idxd->hw.wq_cap.op_config) -+ bitmap_free(wq->opcap_bmap); -+ kfree(wq->wqcfg); - conf_dev = wq_confdev(wq); - put_device(conf_dev); -+ kfree(wq); -+ - } -+ bitmap_free(idxd->wq_enable_map); -+ -+err_bitmap: -+ kfree(idxd->wqs); -+ - return rc; - } - -+static void idxd_clean_engines(struct idxd_device *idxd) -+{ -+ struct idxd_engine *engine; -+ struct device *conf_dev; -+ int i; -+ -+ for (i = 0; i < idxd->max_engines; i++) { -+ engine = idxd->engines[i]; -+ conf_dev = engine_confdev(engine); -+ put_device(conf_dev); -+ kfree(engine); -+ } -+ kfree(idxd->engines); -+} -+ - static int idxd_setup_engines(struct idxd_device *idxd) - { - struct idxd_engine *engine; -@@ -253,6 +299,7 @@ static int idxd_setup_engines(struct idxd_device *idxd) - rc = dev_set_name(conf_dev, "engine%d.%d", idxd->id, engine->id); - if (rc < 0) { - put_device(conf_dev); -+ kfree(engine); - goto err; - } - -@@ -266,10 +313,26 @@ static int idxd_setup_engines(struct idxd_device *idxd) - engine = idxd->engines[i]; - conf_dev = engine_confdev(engine); - put_device(conf_dev); -+ kfree(engine); - } -+ kfree(idxd->engines); -+ - return rc; - } - -+static void idxd_clean_groups(struct idxd_device *idxd) -+{ -+ struct idxd_group *group; -+ int i; -+ -+ for (i = 0; i < idxd->max_groups; i++) { -+ group = idxd->groups[i]; -+ put_device(group_confdev(group)); -+ kfree(group); -+ } -+ kfree(idxd->groups); -+} -+ - static int idxd_setup_groups(struct idxd_device *idxd) - { - struct device *dev = &idxd->pdev->dev; -@@ -300,6 +363,7 @@ static int idxd_setup_groups(struct idxd_device *idxd) - rc = dev_set_name(conf_dev, "group%d.%d", idxd->id, group->id); - if (rc < 0) { - put_device(conf_dev); -+ kfree(group); - goto err; - } - -@@ -324,20 +388,18 @@ static int idxd_setup_groups(struct idxd_device *idxd) - while (--i >= 0) { - group = idxd->groups[i]; - put_device(group_confdev(group)); -+ kfree(group); - } -+ kfree(idxd->groups); -+ - return rc; - } - - static void idxd_cleanup_internals(struct idxd_device *idxd) - { -- int i; -- -- for (i = 0; i < idxd->max_groups; i++) -- put_device(group_confdev(idxd->groups[i])); -- for (i = 0; i < idxd->max_engines; i++) -- put_device(engine_confdev(idxd->engines[i])); -- for (i = 0; i < idxd->max_wqs; i++) -- put_device(wq_confdev(idxd->wqs[i])); -+ idxd_clean_groups(idxd); -+ idxd_clean_engines(idxd); -+ idxd_clean_wqs(idxd); - destroy_workqueue(idxd->wq); - } - -@@ -380,7 +442,7 @@ static int idxd_init_evl(struct idxd_device *idxd) - static int idxd_setup_internals(struct idxd_device *idxd) - { - struct device *dev = &idxd->pdev->dev; -- int rc, i; -+ int rc; - - init_waitqueue_head(&idxd->cmd_waitq); - -@@ -411,14 +473,11 @@ static int idxd_setup_internals(struct idxd_device *idxd) - err_evl: - destroy_workqueue(idxd->wq); - err_wkq_create: -- for (i = 0; i < idxd->max_groups; i++) -- put_device(group_confdev(idxd->groups[i])); -+ idxd_clean_groups(idxd); - err_group: -- for (i = 0; i < idxd->max_engines; i++) -- put_device(engine_confdev(idxd->engines[i])); -+ idxd_clean_engines(idxd); - err_engine: -- for (i = 0; i < idxd->max_wqs; i++) -- put_device(wq_confdev(idxd->wqs[i])); -+ idxd_clean_wqs(idxd); - err_wqs: - return rc; - } -@@ -518,6 +577,17 @@ static void idxd_read_caps(struct idxd_device *idxd) - idxd->hw.iaa_cap.bits = ioread64(idxd->reg_base + IDXD_IAACAP_OFFSET); - } - -+static void idxd_free(struct idxd_device *idxd) -+{ -+ if (!idxd) -+ return; -+ -+ put_device(idxd_confdev(idxd)); -+ bitmap_free(idxd->opcap_bmap); -+ ida_free(&idxd_ida, idxd->id); -+ kfree(idxd); -+} -+ - static struct idxd_device *idxd_alloc(struct pci_dev *pdev, struct idxd_driver_data *data) - { - struct device *dev = &pdev->dev; -@@ -535,28 +605,34 @@ static struct idxd_device *idxd_alloc(struct pci_dev *pdev, struct idxd_driver_d - idxd_dev_set_type(&idxd->idxd_dev, idxd->data->type); - idxd->id = ida_alloc(&idxd_ida, GFP_KERNEL); - if (idxd->id < 0) -- return NULL; -+ goto err_ida; - - idxd->opcap_bmap = bitmap_zalloc_node(IDXD_MAX_OPCAP_BITS, GFP_KERNEL, dev_to_node(dev)); -- if (!idxd->opcap_bmap) { -- ida_free(&idxd_ida, idxd->id); -- return NULL; -- } -+ if (!idxd->opcap_bmap) -+ goto err_opcap; - - device_initialize(conf_dev); - conf_dev->parent = dev; - conf_dev->bus = &dsa_bus_type; - conf_dev->type = idxd->data->dev_type; - rc = dev_set_name(conf_dev, "%s%d", idxd->data->name_prefix, idxd->id); -- if (rc < 0) { -- put_device(conf_dev); -- return NULL; -- } -+ if (rc < 0) -+ goto err_name; - - spin_lock_init(&idxd->dev_lock); - spin_lock_init(&idxd->cmd_lock); - - return idxd; -+ -+err_name: -+ put_device(conf_dev); -+ bitmap_free(idxd->opcap_bmap); -+err_opcap: -+ ida_free(&idxd_ida, idxd->id); -+err_ida: -+ kfree(idxd); -+ -+ return NULL; - } - - static int idxd_enable_system_pasid(struct idxd_device *idxd) -@@ -778,7 +854,7 @@ static int idxd_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) - err: - pci_iounmap(pdev, idxd->reg_base); - err_iomap: -- put_device(idxd_confdev(idxd)); -+ idxd_free(idxd); - err_idxd_alloc: - pci_disable_device(pdev); - return rc; -@@ -815,7 +891,6 @@ static void idxd_shutdown(struct pci_dev *pdev) - static void idxd_remove(struct pci_dev *pdev) - { - struct idxd_device *idxd = pci_get_drvdata(pdev); -- struct idxd_irq_entry *irq_entry; - - idxd_unregister_devices(idxd); - /* -@@ -828,20 +903,12 @@ static void idxd_remove(struct pci_dev *pdev) - get_device(idxd_confdev(idxd)); - device_unregister(idxd_confdev(idxd)); - idxd_shutdown(pdev); -- if (device_pasid_enabled(idxd)) -- idxd_disable_system_pasid(idxd); - idxd_device_remove_debugfs(idxd); -- -- irq_entry = idxd_get_ie(idxd, 0); -- free_irq(irq_entry->vector, irq_entry); -- pci_free_irq_vectors(pdev); -+ idxd_cleanup(idxd); - pci_iounmap(pdev, idxd->reg_base); -- if (device_user_pasid_enabled(idxd)) -- idxd_disable_sva(pdev); -- pci_disable_device(pdev); -- destroy_workqueue(idxd->wq); -- perfmon_pmu_remove(idxd); - put_device(idxd_confdev(idxd)); -+ idxd_free(idxd); -+ pci_disable_device(pdev); - } - - static struct pci_driver idxd_pci_driver = { -diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c -index 02a1ab04f498e5..418e1774af1e5e 100644 ---- a/drivers/dma/ti/k3-udma.c -+++ b/drivers/dma/ti/k3-udma.c -@@ -1091,8 +1091,11 @@ static void udma_check_tx_completion(struct work_struct *work) - u32 residue_diff; - ktime_t time_diff; - unsigned long delay; -+ unsigned long flags; - - while (1) { -+ spin_lock_irqsave(&uc->vc.lock, flags); -+ - if (uc->desc) { - /* Get previous residue and time stamp */ - residue_diff = uc->tx_drain.residue; -@@ -1127,6 +1130,8 @@ static void udma_check_tx_completion(struct work_struct *work) - break; - } - -+ spin_unlock_irqrestore(&uc->vc.lock, flags); -+ - usleep_range(ktime_to_us(delay), - ktime_to_us(delay) + 10); - continue; -@@ -1143,6 +1148,8 @@ static void udma_check_tx_completion(struct work_struct *work) - - break; - } -+ -+ spin_unlock_irqrestore(&uc->vc.lock, flags); - } - - static irqreturn_t udma_ring_irq_handler(int irq, void *data) -@@ -4214,7 +4221,6 @@ static struct dma_chan *udma_of_xlate(struct of_phandle_args *dma_spec, - struct of_dma *ofdma) - { - struct udma_dev *ud = ofdma->of_dma_data; -- dma_cap_mask_t mask = ud->ddev.cap_mask; - struct udma_filter_param filter_param; - struct dma_chan *chan; - -@@ -4246,7 +4252,7 @@ static struct dma_chan *udma_of_xlate(struct of_phandle_args *dma_spec, - } - } - -- chan = __dma_request_channel(&mask, udma_dma_filter_fn, &filter_param, -+ chan = __dma_request_channel(&ud->ddev.cap_mask, udma_dma_filter_fn, &filter_param, - ofdma->of_node); - if (!chan) { - dev_err(ud->dev, "get channel fail in %s.\n", __func__); -diff --git a/drivers/firmware/arm_scmi/Kconfig b/drivers/firmware/arm_scmi/Kconfig -index ea0f5083ac47f1..9a41c1c91f71af 100644 ---- a/drivers/firmware/arm_scmi/Kconfig -+++ b/drivers/firmware/arm_scmi/Kconfig -@@ -55,6 +55,20 @@ config ARM_SCMI_RAW_MODE_SUPPORT_COEX - operate normally, thing which could make an SCMI test suite using the - SCMI Raw mode support unreliable. If unsure, say N. - -+config ARM_SCMI_DEBUG_COUNTERS -+ bool "Enable SCMI communication debug metrics tracking" -+ select ARM_SCMI_NEED_DEBUGFS -+ depends on DEBUG_FS -+ default n -+ help -+ Enables tracking of some key communication metrics for debug -+ purposes. It may track metrics like how many messages were sent -+ or received, were there any failures, what kind of failures, ..etc. -+ -+ Enable this option to create a new debugfs directory which contains -+ such useful debug counters. This can be helpful for debugging and -+ SCMI monitoring. -+ - config ARM_SCMI_HAVE_TRANSPORT - bool - help -diff --git a/drivers/firmware/arm_scmi/common.h b/drivers/firmware/arm_scmi/common.h -index 039f686f4580d1..6c223487121544 100644 ---- a/drivers/firmware/arm_scmi/common.h -+++ b/drivers/firmware/arm_scmi/common.h -@@ -303,6 +303,41 @@ extern const struct scmi_desc scmi_optee_desc; - - void scmi_rx_callback(struct scmi_chan_info *cinfo, u32 msg_hdr, void *priv); - -+enum debug_counters { -+ SENT_OK, -+ SENT_FAIL, -+ SENT_FAIL_POLLING_UNSUPPORTED, -+ SENT_FAIL_CHANNEL_NOT_FOUND, -+ RESPONSE_OK, -+ NOTIFICATION_OK, -+ DELAYED_RESPONSE_OK, -+ XFERS_RESPONSE_TIMEOUT, -+ XFERS_RESPONSE_POLLED_TIMEOUT, -+ RESPONSE_POLLED_OK, -+ ERR_MSG_UNEXPECTED, -+ ERR_MSG_INVALID, -+ ERR_MSG_NOMEM, -+ ERR_PROTOCOL, -+ SCMI_DEBUG_COUNTERS_LAST -+}; -+ -+static inline void scmi_inc_count(atomic_t *arr, int stat) -+{ -+ if (IS_ENABLED(CONFIG_ARM_SCMI_DEBUG_COUNTERS)) -+ atomic_inc(&arr[stat]); -+} -+ -+enum scmi_bad_msg { -+ MSG_UNEXPECTED = -1, -+ MSG_INVALID = -2, -+ MSG_UNKNOWN = -3, -+ MSG_NOMEM = -4, -+ MSG_MBOX_SPURIOUS = -5, -+}; -+ -+void scmi_bad_message_trace(struct scmi_chan_info *cinfo, u32 msg_hdr, -+ enum scmi_bad_msg err); -+ - /* shmem related declarations */ - struct scmi_shared_mem; - -diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c -index efa9698c876a09..65d1e66a347d75 100644 ---- a/drivers/firmware/arm_scmi/driver.c -+++ b/drivers/firmware/arm_scmi/driver.c -@@ -108,12 +108,14 @@ struct scmi_protocol_instance { - * @name: Name of this SCMI instance - * @type: Type of this SCMI instance - * @is_atomic: Flag to state if the transport of this instance is atomic -+ * @counters: An array of atomic_c's used for tracking statistics (if enabled) - */ - struct scmi_debug_info { - struct dentry *top_dentry; - const char *name; - const char *type; - bool is_atomic; -+ atomic_t counters[SCMI_DEBUG_COUNTERS_LAST]; - }; - - /** -@@ -687,6 +689,45 @@ scmi_xfer_lookup_unlocked(struct scmi_xfers_info *minfo, u16 xfer_id) - return xfer ?: ERR_PTR(-EINVAL); - } - -+/** -+ * scmi_bad_message_trace - A helper to trace weird messages -+ * -+ * @cinfo: A reference to the channel descriptor on which the message was -+ * received -+ * @msg_hdr: Message header to track -+ * @err: A specific error code used as a status value in traces. -+ * -+ * This helper can be used to trace any kind of weird, incomplete, unexpected, -+ * timed-out message that arrives and as such, can be traced only referring to -+ * the header content, since the payload is missing/unreliable. -+ */ -+void scmi_bad_message_trace(struct scmi_chan_info *cinfo, u32 msg_hdr, -+ enum scmi_bad_msg err) -+{ -+ char *tag; -+ struct scmi_info *info = handle_to_scmi_info(cinfo->handle); -+ -+ switch (MSG_XTRACT_TYPE(msg_hdr)) { -+ case MSG_TYPE_COMMAND: -+ tag = "!RESP"; -+ break; -+ case MSG_TYPE_DELAYED_RESP: -+ tag = "!DLYD"; -+ break; -+ case MSG_TYPE_NOTIFICATION: -+ tag = "!NOTI"; -+ break; -+ default: -+ tag = "!UNKN"; -+ break; -+ } -+ -+ trace_scmi_msg_dump(info->id, cinfo->id, -+ MSG_XTRACT_PROT_ID(msg_hdr), -+ MSG_XTRACT_ID(msg_hdr), tag, -+ MSG_XTRACT_TOKEN(msg_hdr), err, NULL, 0); -+} -+ - /** - * scmi_msg_response_validate - Validate message type against state of related - * xfer -@@ -813,6 +854,10 @@ scmi_xfer_command_acquire(struct scmi_chan_info *cinfo, u32 msg_hdr) - "Message for %d type %d is not expected!\n", - xfer_id, msg_type); - spin_unlock_irqrestore(&minfo->xfer_lock, flags); -+ -+ scmi_bad_message_trace(cinfo, msg_hdr, MSG_UNEXPECTED); -+ scmi_inc_count(info->dbg->counters, ERR_MSG_UNEXPECTED); -+ - return xfer; - } - refcount_inc(&xfer->users); -@@ -837,6 +882,11 @@ scmi_xfer_command_acquire(struct scmi_chan_info *cinfo, u32 msg_hdr) - dev_err(cinfo->dev, - "Invalid message type:%d for %d - HDR:0x%X state:%d\n", - msg_type, xfer_id, msg_hdr, xfer->state); -+ -+ scmi_bad_message_trace(cinfo, msg_hdr, MSG_INVALID); -+ scmi_inc_count(info->dbg->counters, ERR_MSG_INVALID); -+ -+ - /* On error the refcount incremented above has to be dropped */ - __scmi_xfer_put(minfo, xfer); - xfer = ERR_PTR(-EINVAL); -@@ -878,6 +928,10 @@ static void scmi_handle_notification(struct scmi_chan_info *cinfo, - if (IS_ERR(xfer)) { - dev_err(dev, "failed to get free message slot (%ld)\n", - PTR_ERR(xfer)); -+ -+ scmi_bad_message_trace(cinfo, msg_hdr, MSG_NOMEM); -+ scmi_inc_count(info->dbg->counters, ERR_MSG_NOMEM); -+ - scmi_clear_channel(info, cinfo); - return; - } -@@ -892,6 +946,7 @@ static void scmi_handle_notification(struct scmi_chan_info *cinfo, - trace_scmi_msg_dump(info->id, cinfo->id, xfer->hdr.protocol_id, - xfer->hdr.id, "NOTI", xfer->hdr.seq, - xfer->hdr.status, xfer->rx.buf, xfer->rx.len); -+ scmi_inc_count(info->dbg->counters, NOTIFICATION_OK); - - scmi_notify(cinfo->handle, xfer->hdr.protocol_id, - xfer->hdr.id, xfer->rx.buf, xfer->rx.len, ts); -@@ -951,8 +1006,10 @@ static void scmi_handle_response(struct scmi_chan_info *cinfo, - if (xfer->hdr.type == MSG_TYPE_DELAYED_RESP) { - scmi_clear_channel(info, cinfo); - complete(xfer->async_done); -+ scmi_inc_count(info->dbg->counters, DELAYED_RESPONSE_OK); - } else { - complete(&xfer->done); -+ scmi_inc_count(info->dbg->counters, RESPONSE_OK); - } - - if (IS_ENABLED(CONFIG_ARM_SCMI_RAW_MODE_SUPPORT)) { -@@ -997,6 +1054,7 @@ void scmi_rx_callback(struct scmi_chan_info *cinfo, u32 msg_hdr, void *priv) - break; - default: - WARN_ONCE(1, "received unknown msg_type:%d\n", msg_type); -+ scmi_bad_message_trace(cinfo, msg_hdr, MSG_UNKNOWN); - break; - } - } -@@ -1017,7 +1075,8 @@ static void xfer_put(const struct scmi_protocol_handle *ph, - } - - static bool scmi_xfer_done_no_timeout(struct scmi_chan_info *cinfo, -- struct scmi_xfer *xfer, ktime_t stop) -+ struct scmi_xfer *xfer, ktime_t stop, -+ bool *ooo) - { - struct scmi_info *info = handle_to_scmi_info(cinfo->handle); - -@@ -1026,7 +1085,7 @@ static bool scmi_xfer_done_no_timeout(struct scmi_chan_info *cinfo, - * in case of out-of-order receptions of delayed responses - */ - return info->desc->ops->poll_done(cinfo, xfer) || -- try_wait_for_completion(&xfer->done) || -+ (*ooo = try_wait_for_completion(&xfer->done)) || - ktime_after(ktime_get(), stop); - } - -@@ -1035,6 +1094,7 @@ static int scmi_wait_for_reply(struct device *dev, const struct scmi_desc *desc, - struct scmi_xfer *xfer, unsigned int timeout_ms) - { - int ret = 0; -+ struct scmi_info *info = handle_to_scmi_info(cinfo->handle); - - if (xfer->hdr.poll_completion) { - /* -@@ -1042,26 +1102,27 @@ static int scmi_wait_for_reply(struct device *dev, const struct scmi_desc *desc, - * itself to support synchronous commands replies. - */ - if (!desc->sync_cmds_completed_on_ret) { -+ bool ooo = false; -+ - /* - * Poll on xfer using transport provided .poll_done(); - * assumes no completion interrupt was available. - */ - ktime_t stop = ktime_add_ms(ktime_get(), timeout_ms); - -- spin_until_cond(scmi_xfer_done_no_timeout(cinfo, -- xfer, stop)); -- if (ktime_after(ktime_get(), stop)) { -+ spin_until_cond(scmi_xfer_done_no_timeout(cinfo, xfer, -+ stop, &ooo)); -+ if (!ooo && !info->desc->ops->poll_done(cinfo, xfer)) { - dev_err(dev, - "timed out in resp(caller: %pS) - polling\n", - (void *)_RET_IP_); - ret = -ETIMEDOUT; -+ scmi_inc_count(info->dbg->counters, XFERS_RESPONSE_POLLED_TIMEOUT); - } - } - - if (!ret) { - unsigned long flags; -- struct scmi_info *info = -- handle_to_scmi_info(cinfo->handle); - - /* - * Do not fetch_response if an out-of-order delayed -@@ -1081,6 +1142,7 @@ static int scmi_wait_for_reply(struct device *dev, const struct scmi_desc *desc, - "RESP" : "resp", - xfer->hdr.seq, xfer->hdr.status, - xfer->rx.buf, xfer->rx.len); -+ scmi_inc_count(info->dbg->counters, RESPONSE_POLLED_OK); - - if (IS_ENABLED(CONFIG_ARM_SCMI_RAW_MODE_SUPPORT)) { - struct scmi_info *info = -@@ -1098,6 +1160,7 @@ static int scmi_wait_for_reply(struct device *dev, const struct scmi_desc *desc, - dev_err(dev, "timed out in resp(caller: %pS)\n", - (void *)_RET_IP_); - ret = -ETIMEDOUT; -+ scmi_inc_count(info->dbg->counters, XFERS_RESPONSE_TIMEOUT); - } - } - -@@ -1181,13 +1244,15 @@ static int do_xfer(const struct scmi_protocol_handle *ph, - !is_transport_polling_capable(info->desc)) { - dev_warn_once(dev, - "Polling mode is not supported by transport.\n"); -+ scmi_inc_count(info->dbg->counters, SENT_FAIL_POLLING_UNSUPPORTED); - return -EINVAL; - } - - cinfo = idr_find(&info->tx_idr, pi->proto->id); -- if (unlikely(!cinfo)) -+ if (unlikely(!cinfo)) { -+ scmi_inc_count(info->dbg->counters, SENT_FAIL_CHANNEL_NOT_FOUND); - return -EINVAL; -- -+ } - /* True ONLY if also supported by transport. */ - if (is_polling_enabled(cinfo, info->desc)) - xfer->hdr.poll_completion = true; -@@ -1219,16 +1284,20 @@ static int do_xfer(const struct scmi_protocol_handle *ph, - ret = info->desc->ops->send_message(cinfo, xfer); - if (ret < 0) { - dev_dbg(dev, "Failed to send message %d\n", ret); -+ scmi_inc_count(info->dbg->counters, SENT_FAIL); - return ret; - } - - trace_scmi_msg_dump(info->id, cinfo->id, xfer->hdr.protocol_id, - xfer->hdr.id, "CMND", xfer->hdr.seq, - xfer->hdr.status, xfer->tx.buf, xfer->tx.len); -+ scmi_inc_count(info->dbg->counters, SENT_OK); - - ret = scmi_wait_for_message_response(cinfo, xfer); -- if (!ret && xfer->hdr.status) -+ if (!ret && xfer->hdr.status) { - ret = scmi_to_linux_errno(xfer->hdr.status); -+ scmi_inc_count(info->dbg->counters, ERR_PROTOCOL); -+ } - - if (info->desc->ops->mark_txdone) - info->desc->ops->mark_txdone(cinfo, ret, xfer); -diff --git a/drivers/firmware/arm_scmi/mailbox.c b/drivers/firmware/arm_scmi/mailbox.c -index 8e513f70b75d4c..f1d5e3fba35e07 100644 ---- a/drivers/firmware/arm_scmi/mailbox.c -+++ b/drivers/firmware/arm_scmi/mailbox.c -@@ -58,6 +58,9 @@ static void rx_callback(struct mbox_client *cl, void *m) - */ - if (cl->knows_txdone && !shmem_channel_free(smbox->shmem)) { - dev_warn(smbox->cinfo->dev, "Ignoring spurious A2P IRQ !\n"); -+ scmi_bad_message_trace(smbox->cinfo, -+ shmem_read_header(smbox->shmem), -+ MSG_MBOX_SPURIOUS); - return; - } - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h -index d59e8536192ca9..c5d706a4c7b4a7 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h -@@ -788,6 +788,7 @@ struct amdgpu_device { - bool need_swiotlb; - bool accel_working; - struct notifier_block acpi_nb; -+ struct notifier_block pm_nb; - struct amdgpu_i2c_chan *i2c_bus[AMDGPU_MAX_I2C_BUS]; - struct debugfs_blob_wrapper debugfs_vbios_blob; - struct debugfs_blob_wrapper debugfs_discovery_blob; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -index 10f5a3d0f59163..f8058dd5356a13 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -@@ -141,6 +141,10 @@ const char *amdgpu_asic_name[] = { - "LAST", - }; - -+static inline void amdgpu_device_stop_pending_resets(struct amdgpu_device *adev); -+static int amdgpu_device_pm_notifier(struct notifier_block *nb, unsigned long mode, -+ void *data); -+ - /** - * DOC: pcie_replay_count - * -@@ -3920,6 +3924,11 @@ int amdgpu_device_init(struct amdgpu_device *adev, - - amdgpu_device_check_iommu_direct_map(adev); - -+ adev->pm_nb.notifier_call = amdgpu_device_pm_notifier; -+ r = register_pm_notifier(&adev->pm_nb); -+ if (r) -+ goto failed; -+ - return 0; - - release_ras_con: -@@ -3981,6 +3990,8 @@ void amdgpu_device_fini_hw(struct amdgpu_device *adev) - flush_delayed_work(&adev->delayed_init_work); - adev->shutdown = true; - -+ unregister_pm_notifier(&adev->pm_nb); -+ - /* make sure IB test finished before entering exclusive mode - * to avoid preemption on IB test - */ -@@ -4107,6 +4118,33 @@ static int amdgpu_device_evict_resources(struct amdgpu_device *adev) - /* - * Suspend & resume. - */ -+/** -+ * amdgpu_device_pm_notifier - Notification block for Suspend/Hibernate events -+ * @nb: notifier block -+ * @mode: suspend mode -+ * @data: data -+ * -+ * This function is called when the system is about to suspend or hibernate. -+ * It is used to set the appropriate flags so that eviction can be optimized -+ * in the pm prepare callback. -+ */ -+static int amdgpu_device_pm_notifier(struct notifier_block *nb, unsigned long mode, -+ void *data) -+{ -+ struct amdgpu_device *adev = container_of(nb, struct amdgpu_device, pm_nb); -+ -+ switch (mode) { -+ case PM_HIBERNATION_PREPARE: -+ adev->in_s4 = true; -+ break; -+ case PM_POST_HIBERNATION: -+ adev->in_s4 = false; -+ break; -+ } -+ -+ return NOTIFY_DONE; -+} -+ - /** - * amdgpu_device_prepare - prepare for device suspend - * -@@ -4551,6 +4589,8 @@ static int amdgpu_device_reset_sriov(struct amdgpu_device *adev, - retry: - amdgpu_amdkfd_pre_reset(adev); - -+ amdgpu_device_stop_pending_resets(adev); -+ - if (from_hypervisor) - r = amdgpu_virt_request_full_gpu(adev, true); - else -@@ -5347,11 +5387,12 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev, - tmp_adev->asic_reset_res = r; - } - -- /* -- * Drop all pending non scheduler resets. Scheduler resets -- * were already dropped during drm_sched_stop -- */ -- amdgpu_device_stop_pending_resets(tmp_adev); -+ if (!amdgpu_sriov_vf(tmp_adev)) -+ /* -+ * Drop all pending non scheduler resets. Scheduler resets -+ * were already dropped during drm_sched_stop -+ */ -+ amdgpu_device_stop_pending_resets(tmp_adev); - } - - /* Actual ASIC resets if needed.*/ -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -index bacf2e5de2abce..940411f8e99be0 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -@@ -2463,7 +2463,6 @@ static int amdgpu_pmops_freeze(struct device *dev) - struct amdgpu_device *adev = drm_to_adev(drm_dev); - int r; - -- adev->in_s4 = true; - r = amdgpu_device_suspend(drm_dev, true); - if (r) - return r; -@@ -2476,13 +2475,8 @@ static int amdgpu_pmops_freeze(struct device *dev) - static int amdgpu_pmops_thaw(struct device *dev) - { - struct drm_device *drm_dev = dev_get_drvdata(dev); -- struct amdgpu_device *adev = drm_to_adev(drm_dev); -- int r; -- -- r = amdgpu_device_resume(drm_dev, true); -- adev->in_s4 = false; - -- return r; -+ return amdgpu_device_resume(drm_dev, true); - } - - static int amdgpu_pmops_poweroff(struct device *dev) -@@ -2495,9 +2489,6 @@ static int amdgpu_pmops_poweroff(struct device *dev) - static int amdgpu_pmops_restore(struct device *dev) - { - struct drm_device *drm_dev = dev_get_drvdata(dev); -- struct amdgpu_device *adev = drm_to_adev(drm_dev); -- -- adev->in_s4 = false; - - return amdgpu_device_resume(drm_dev, true); - } -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c -index 22575422ca7ec1..7cb4b4118335a6 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c -@@ -32,6 +32,7 @@ - - #include "amdgpu.h" - #include "amdgpu_ras.h" -+#include "amdgpu_reset.h" - #include "vi.h" - #include "soc15.h" - #include "nv.h" -@@ -468,7 +469,7 @@ static int amdgpu_virt_read_pf2vf_data(struct amdgpu_device *adev) - return -EINVAL; - - if (pf2vf_info->size > 1024) { -- DRM_ERROR("invalid pf2vf message size\n"); -+ dev_err(adev->dev, "invalid pf2vf message size: 0x%x\n", pf2vf_info->size); - return -EINVAL; - } - -@@ -479,7 +480,9 @@ static int amdgpu_virt_read_pf2vf_data(struct amdgpu_device *adev) - adev->virt.fw_reserve.p_pf2vf, pf2vf_info->size, - adev->virt.fw_reserve.checksum_key, checksum); - if (checksum != checkval) { -- DRM_ERROR("invalid pf2vf message\n"); -+ dev_err(adev->dev, -+ "invalid pf2vf message: header checksum=0x%x calculated checksum=0x%x\n", -+ checksum, checkval); - return -EINVAL; - } - -@@ -493,7 +496,9 @@ static int amdgpu_virt_read_pf2vf_data(struct amdgpu_device *adev) - adev->virt.fw_reserve.p_pf2vf, pf2vf_info->size, - 0, checksum); - if (checksum != checkval) { -- DRM_ERROR("invalid pf2vf message\n"); -+ dev_err(adev->dev, -+ "invalid pf2vf message: header checksum=0x%x calculated checksum=0x%x\n", -+ checksum, checkval); - return -EINVAL; - } - -@@ -529,7 +534,7 @@ static int amdgpu_virt_read_pf2vf_data(struct amdgpu_device *adev) - ((struct amd_sriov_msg_pf2vf_info *)pf2vf_info)->uuid; - break; - default: -- DRM_ERROR("invalid pf2vf version\n"); -+ dev_err(adev->dev, "invalid pf2vf version: 0x%x\n", pf2vf_info->version); - return -EINVAL; - } - -@@ -628,8 +633,21 @@ static void amdgpu_virt_update_vf2pf_work_item(struct work_struct *work) - int ret; - - ret = amdgpu_virt_read_pf2vf_data(adev); -- if (ret) -+ if (ret) { -+ adev->virt.vf2pf_update_retry_cnt++; -+ if ((adev->virt.vf2pf_update_retry_cnt >= AMDGPU_VF2PF_UPDATE_MAX_RETRY_LIMIT) && -+ amdgpu_sriov_runtime(adev) && !amdgpu_in_reset(adev)) { -+ if (amdgpu_reset_domain_schedule(adev->reset_domain, -+ &adev->virt.flr_work)) -+ return; -+ else -+ dev_err(adev->dev, "Failed to queue work! at %s", __func__); -+ } -+ - goto out; -+ } -+ -+ adev->virt.vf2pf_update_retry_cnt = 0; - amdgpu_virt_write_vf2pf_data(adev); - - out: -@@ -650,6 +668,7 @@ void amdgpu_virt_init_data_exchange(struct amdgpu_device *adev) - adev->virt.fw_reserve.p_pf2vf = NULL; - adev->virt.fw_reserve.p_vf2pf = NULL; - adev->virt.vf2pf_update_interval_ms = 0; -+ adev->virt.vf2pf_update_retry_cnt = 0; - - if (adev->mman.fw_vram_usage_va && adev->mman.drv_vram_usage_va) { - DRM_WARN("Currently fw_vram and drv_vram should not have values at the same time!"); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h -index 23b6efa9d25df8..891713757a8f5a 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h -@@ -51,6 +51,8 @@ - /* tonga/fiji use this offset */ - #define mmBIF_IOV_FUNC_IDENTIFIER 0x1503 - -+#define AMDGPU_VF2PF_UPDATE_MAX_RETRY_LIMIT 30 -+ - enum amdgpu_sriov_vf_mode { - SRIOV_VF_MODE_BARE_METAL = 0, - SRIOV_VF_MODE_ONE_VF, -@@ -253,6 +255,7 @@ struct amdgpu_virt { - /* vf2pf message */ - struct delayed_work vf2pf_work; - uint32_t vf2pf_update_interval_ms; -+ int vf2pf_update_retry_cnt; - - /* multimedia bandwidth config */ - bool is_mm_bw_enabled; -diff --git a/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c b/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c -index 63725b2ebc0373..37ac6d8ff81362 100644 ---- a/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c -+++ b/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c -@@ -276,6 +276,8 @@ static void xgpu_ai_mailbox_flr_work(struct work_struct *work) - timeout -= 10; - } while (timeout > 1); - -+ dev_warn(adev->dev, "waiting IDH_FLR_NOTIFICATION_CMPL timeout\n"); -+ - flr_done: - atomic_set(&adev->reset_domain->in_gpu_reset, 0); - up_write(&adev->reset_domain->sem); -diff --git a/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c b/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c -index 6a68ee946f1cc3..96edd5d11326dd 100644 ---- a/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c -+++ b/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c -@@ -298,6 +298,8 @@ static void xgpu_nv_mailbox_flr_work(struct work_struct *work) - timeout -= 10; - } while (timeout > 1); - -+ dev_warn(adev->dev, "waiting IDH_FLR_NOTIFICATION_CMPL timeout\n"); -+ - flr_done: - atomic_set(&adev->reset_domain->in_gpu_reset, 0); - up_write(&adev->reset_domain->sem); -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index f6017be8f9957e..bcf0dc05c76765 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -11069,7 +11069,8 @@ int amdgpu_dm_process_dmub_aux_transfer_sync( - /* The reply is stored in the top nibble of the command. */ - payload->reply[0] = (adev->dm.dmub_notify->aux_reply.command >> 4) & 0xF; - -- if (!payload->write && p_notify->aux_reply.length) -+ /*write req may receive a byte indicating partially written number as well*/ -+ if (p_notify->aux_reply.length) - memcpy(payload->data, p_notify->aux_reply.data, - p_notify->aux_reply.length); - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -index c0cacd501c83eb..2698e5c74ddfda 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -@@ -59,6 +59,7 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux, - enum aux_return_code_type operation_result; - struct amdgpu_device *adev; - struct ddc_service *ddc; -+ uint8_t copy[16]; - - if (WARN_ON(msg->size > 16)) - return -E2BIG; -@@ -74,6 +75,11 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux, - (msg->request & DP_AUX_I2C_WRITE_STATUS_UPDATE) != 0; - payload.defer_delay = 0; - -+ if (payload.write) { -+ memcpy(copy, msg->buffer, msg->size); -+ payload.data = copy; -+ } -+ - result = dc_link_aux_transfer_raw(TO_DM_AUX(aux)->ddc_service, &payload, - &operation_result); - -@@ -97,9 +103,9 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux, - */ - if (payload.write && result >= 0) { - if (result) { -- /*one byte indicating partially written bytes. Force 0 to retry*/ -- drm_info(adev_to_drm(adev), "amdgpu: AUX partially written\n"); -- result = 0; -+ /*one byte indicating partially written bytes*/ -+ drm_dbg_dp(adev_to_drm(adev), "amdgpu: AUX partially written\n"); -+ result = payload.data[0]; - } else if (!payload.reply[0]) - /*I2C_ACK|AUX_ACK*/ - result = msg->size; -@@ -124,11 +130,11 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux, - break; - } - -- drm_info(adev_to_drm(adev), "amdgpu: DP AUX transfer fail:%d\n", operation_result); -+ drm_dbg_dp(adev_to_drm(adev), "amdgpu: DP AUX transfer fail:%d\n", operation_result); - } - - if (payload.reply[0]) -- drm_info(adev_to_drm(adev), "amdgpu: AUX reply command not ACK: 0x%02x.", -+ drm_dbg_dp(adev_to_drm(adev), "amdgpu: AUX reply command not ACK: 0x%02x.", - payload.reply[0]); - - return result; -diff --git a/drivers/hid/hid-thrustmaster.c b/drivers/hid/hid-thrustmaster.c -index 3b81468a1df297..0bf70664c35ee1 100644 ---- a/drivers/hid/hid-thrustmaster.c -+++ b/drivers/hid/hid-thrustmaster.c -@@ -174,6 +174,7 @@ static void thrustmaster_interrupts(struct hid_device *hdev) - u8 ep_addr[2] = {b_ep, 0}; - - if (!usb_check_int_endpoints(usbif, ep_addr)) { -+ kfree(send_buf); - hid_err(hdev, "Unexpected non-int endpoint\n"); - return; - } -diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c -index ad74cbc9a0aa59..45de01dea4b1c0 100644 ---- a/drivers/hid/hid-uclogic-core.c -+++ b/drivers/hid/hid-uclogic-core.c -@@ -142,11 +142,12 @@ static int uclogic_input_configured(struct hid_device *hdev, - suffix = "System Control"; - break; - } -- } -- -- if (suffix) -+ } else { - hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL, - "%s %s", hdev->name, suffix); -+ if (!hi->input->name) -+ return -ENOMEM; -+ } - - return 0; - } -diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c -index 47e1bd8de9fcf0..53026356475ac1 100644 ---- a/drivers/hv/channel.c -+++ b/drivers/hv/channel.c -@@ -1113,68 +1113,10 @@ int vmbus_sendpacket(struct vmbus_channel *channel, void *buffer, - EXPORT_SYMBOL(vmbus_sendpacket); - - /* -- * vmbus_sendpacket_pagebuffer - Send a range of single-page buffer -- * packets using a GPADL Direct packet type. This interface allows you -- * to control notifying the host. This will be useful for sending -- * batched data. Also the sender can control the send flags -- * explicitly. -- */ --int vmbus_sendpacket_pagebuffer(struct vmbus_channel *channel, -- struct hv_page_buffer pagebuffers[], -- u32 pagecount, void *buffer, u32 bufferlen, -- u64 requestid) --{ -- int i; -- struct vmbus_channel_packet_page_buffer desc; -- u32 descsize; -- u32 packetlen; -- u32 packetlen_aligned; -- struct kvec bufferlist[3]; -- u64 aligned_data = 0; -- -- if (pagecount > MAX_PAGE_BUFFER_COUNT) -- return -EINVAL; -- -- /* -- * Adjust the size down since vmbus_channel_packet_page_buffer is the -- * largest size we support -- */ -- descsize = sizeof(struct vmbus_channel_packet_page_buffer) - -- ((MAX_PAGE_BUFFER_COUNT - pagecount) * -- sizeof(struct hv_page_buffer)); -- packetlen = descsize + bufferlen; -- packetlen_aligned = ALIGN(packetlen, sizeof(u64)); -- -- /* Setup the descriptor */ -- desc.type = VM_PKT_DATA_USING_GPA_DIRECT; -- desc.flags = VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED; -- desc.dataoffset8 = descsize >> 3; /* in 8-bytes granularity */ -- desc.length8 = (u16)(packetlen_aligned >> 3); -- desc.transactionid = VMBUS_RQST_ERROR; /* will be updated in hv_ringbuffer_write() */ -- desc.reserved = 0; -- desc.rangecount = pagecount; -- -- for (i = 0; i < pagecount; i++) { -- desc.range[i].len = pagebuffers[i].len; -- desc.range[i].offset = pagebuffers[i].offset; -- desc.range[i].pfn = pagebuffers[i].pfn; -- } -- -- bufferlist[0].iov_base = &desc; -- bufferlist[0].iov_len = descsize; -- bufferlist[1].iov_base = buffer; -- bufferlist[1].iov_len = bufferlen; -- bufferlist[2].iov_base = &aligned_data; -- bufferlist[2].iov_len = (packetlen_aligned - packetlen); -- -- return hv_ringbuffer_write(channel, bufferlist, 3, requestid, NULL); --} --EXPORT_SYMBOL_GPL(vmbus_sendpacket_pagebuffer); -- --/* -- * vmbus_sendpacket_multipagebuffer - Send a multi-page buffer packet -+ * vmbus_sendpacket_mpb_desc - Send one or more multi-page buffer packets - * using a GPADL Direct packet type. -- * The buffer includes the vmbus descriptor. -+ * The desc argument must include space for the VMBus descriptor. The -+ * rangecount field must already be set. - */ - int vmbus_sendpacket_mpb_desc(struct vmbus_channel *channel, - struct vmbus_packet_mpb_array *desc, -@@ -1196,7 +1138,6 @@ int vmbus_sendpacket_mpb_desc(struct vmbus_channel *channel, - desc->length8 = (u16)(packetlen_aligned >> 3); - desc->transactionid = VMBUS_RQST_ERROR; /* will be updated in hv_ringbuffer_write() */ - desc->reserved = 0; -- desc->rangecount = 1; - - bufferlist[0].iov_base = desc; - bufferlist[0].iov_len = desc_size; -diff --git a/drivers/iio/adc/ad7266.c b/drivers/iio/adc/ad7266.c -index 98648c679a55c1..2ace3aafe49788 100644 ---- a/drivers/iio/adc/ad7266.c -+++ b/drivers/iio/adc/ad7266.c -@@ -44,7 +44,7 @@ struct ad7266_state { - */ - struct { - __be16 sample[2]; -- s64 timestamp; -+ aligned_s64 timestamp; - } data __aligned(IIO_DMA_MINALIGN); - }; - -diff --git a/drivers/iio/adc/ad7768-1.c b/drivers/iio/adc/ad7768-1.c -index 74b0c85944bd61..967f06cd3f94e7 100644 ---- a/drivers/iio/adc/ad7768-1.c -+++ b/drivers/iio/adc/ad7768-1.c -@@ -169,7 +169,7 @@ struct ad7768_state { - union { - struct { - __be32 chan; -- s64 timestamp; -+ aligned_s64 timestamp; - } scan; - __be32 d32; - u8 d8[2]; -diff --git a/drivers/iio/chemical/sps30.c b/drivers/iio/chemical/sps30.c -index 814ce0aad1cccd..4085a36cd1db75 100644 ---- a/drivers/iio/chemical/sps30.c -+++ b/drivers/iio/chemical/sps30.c -@@ -108,7 +108,7 @@ static irqreturn_t sps30_trigger_handler(int irq, void *p) - int ret; - struct { - s32 data[4]; /* PM1, PM2P5, PM4, PM10 */ -- s64 ts; -+ aligned_s64 ts; - } scan; - - mutex_lock(&state->lock); -diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c -index fec87c9030abdc..fffd144d509eb0 100644 ---- a/drivers/infiniband/sw/rxe/rxe_cq.c -+++ b/drivers/infiniband/sw/rxe/rxe_cq.c -@@ -56,11 +56,8 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe, - - err = do_mmap_info(rxe, uresp ? &uresp->mi : NULL, udata, - cq->queue->buf, cq->queue->buf_size, &cq->queue->ip); -- if (err) { -- vfree(cq->queue->buf); -- kfree(cq->queue); -+ if (err) - return err; -- } - - cq->is_user = uresp; - -diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c -index 1a367e64bc3b1d..843e50b5a0ec57 100644 ---- a/drivers/net/dsa/sja1105/sja1105_main.c -+++ b/drivers/net/dsa/sja1105/sja1105_main.c -@@ -2076,6 +2076,7 @@ static void sja1105_bridge_stp_state_set(struct dsa_switch *ds, int port, - switch (state) { - case BR_STATE_DISABLED: - case BR_STATE_BLOCKING: -+ case BR_STATE_LISTENING: - /* From UM10944 description of DRPDTAG (why put this there?): - * "Management traffic flows to the port regardless of the state - * of the INGRESS flag". So BPDUs are still be allowed to pass. -@@ -2085,11 +2086,6 @@ static void sja1105_bridge_stp_state_set(struct dsa_switch *ds, int port, - mac[port].egress = false; - mac[port].dyn_learn = false; - break; -- case BR_STATE_LISTENING: -- mac[port].ingress = true; -- mac[port].egress = false; -- mac[port].dyn_learn = false; -- break; - case BR_STATE_LEARNING: - mac[port].ingress = true; - mac[port].egress = false; -diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c -index 4325d0ace1f268..6f45f4d9fba71f 100644 ---- a/drivers/net/ethernet/cadence/macb_main.c -+++ b/drivers/net/ethernet/cadence/macb_main.c -@@ -1016,22 +1016,15 @@ static void macb_update_stats(struct macb *bp) - - static int macb_halt_tx(struct macb *bp) - { -- unsigned long halt_time, timeout; -- u32 status; -+ u32 status; - - macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(THALT)); - -- timeout = jiffies + usecs_to_jiffies(MACB_HALT_TIMEOUT); -- do { -- halt_time = jiffies; -- status = macb_readl(bp, TSR); -- if (!(status & MACB_BIT(TGO))) -- return 0; -- -- udelay(250); -- } while (time_before(halt_time, timeout)); -- -- return -ETIMEDOUT; -+ /* Poll TSR until TGO is cleared or timeout. */ -+ return read_poll_timeout_atomic(macb_readl, status, -+ !(status & MACB_BIT(TGO)), -+ 250, MACB_HALT_TIMEOUT, false, -+ bp, TSR); - } - - static void macb_tx_unmap(struct macb *bp, struct macb_tx_skb *tx_skb, int budget) -diff --git a/drivers/net/ethernet/engleder/tsnep_hw.h b/drivers/net/ethernet/engleder/tsnep_hw.h -index 55e1caf193a69d..64c97eb66f6715 100644 ---- a/drivers/net/ethernet/engleder/tsnep_hw.h -+++ b/drivers/net/ethernet/engleder/tsnep_hw.h -@@ -181,6 +181,8 @@ struct tsnep_gcl_operation { - #define TSNEP_DESC_SIZE 256 - #define TSNEP_DESC_SIZE_DATA_AFTER 2048 - #define TSNEP_DESC_OFFSET 128 -+#define TSNEP_DESC_SIZE_DATA_AFTER_INLINE (64 - sizeof(struct tsnep_tx_desc) + \ -+ sizeof_field(struct tsnep_tx_desc, tx)) - #define TSNEP_DESC_OWNER_COUNTER_MASK 0xC0000000 - #define TSNEP_DESC_OWNER_COUNTER_SHIFT 30 - #define TSNEP_DESC_LENGTH_MASK 0x00003FFF -diff --git a/drivers/net/ethernet/engleder/tsnep_main.c b/drivers/net/ethernet/engleder/tsnep_main.c -index 4f36b29d66c860..215ae6745932ae 100644 ---- a/drivers/net/ethernet/engleder/tsnep_main.c -+++ b/drivers/net/ethernet/engleder/tsnep_main.c -@@ -51,12 +51,24 @@ - #define TSNEP_COALESCE_USECS_MAX ((ECM_INT_DELAY_MASK >> ECM_INT_DELAY_SHIFT) * \ - ECM_INT_DELAY_BASE_US + ECM_INT_DELAY_BASE_US - 1) - --#define TSNEP_TX_TYPE_SKB BIT(0) --#define TSNEP_TX_TYPE_SKB_FRAG BIT(1) --#define TSNEP_TX_TYPE_XDP_TX BIT(2) --#define TSNEP_TX_TYPE_XDP_NDO BIT(3) --#define TSNEP_TX_TYPE_XDP (TSNEP_TX_TYPE_XDP_TX | TSNEP_TX_TYPE_XDP_NDO) --#define TSNEP_TX_TYPE_XSK BIT(4) -+/* mapping type */ -+#define TSNEP_TX_TYPE_MAP BIT(0) -+#define TSNEP_TX_TYPE_MAP_PAGE BIT(1) -+#define TSNEP_TX_TYPE_INLINE BIT(2) -+/* buffer type */ -+#define TSNEP_TX_TYPE_SKB BIT(8) -+#define TSNEP_TX_TYPE_SKB_MAP (TSNEP_TX_TYPE_SKB | TSNEP_TX_TYPE_MAP) -+#define TSNEP_TX_TYPE_SKB_INLINE (TSNEP_TX_TYPE_SKB | TSNEP_TX_TYPE_INLINE) -+#define TSNEP_TX_TYPE_SKB_FRAG BIT(9) -+#define TSNEP_TX_TYPE_SKB_FRAG_MAP_PAGE (TSNEP_TX_TYPE_SKB_FRAG | TSNEP_TX_TYPE_MAP_PAGE) -+#define TSNEP_TX_TYPE_SKB_FRAG_INLINE (TSNEP_TX_TYPE_SKB_FRAG | TSNEP_TX_TYPE_INLINE) -+#define TSNEP_TX_TYPE_XDP_TX BIT(10) -+#define TSNEP_TX_TYPE_XDP_NDO BIT(11) -+#define TSNEP_TX_TYPE_XDP_NDO_MAP_PAGE (TSNEP_TX_TYPE_XDP_NDO | TSNEP_TX_TYPE_MAP_PAGE) -+#define TSNEP_TX_TYPE_XDP (TSNEP_TX_TYPE_XDP_TX | TSNEP_TX_TYPE_XDP_NDO) -+#define TSNEP_TX_TYPE_XSK BIT(12) -+#define TSNEP_TX_TYPE_TSTAMP BIT(13) -+#define TSNEP_TX_TYPE_SKB_TSTAMP (TSNEP_TX_TYPE_SKB | TSNEP_TX_TYPE_TSTAMP) - - #define TSNEP_XDP_TX BIT(0) - #define TSNEP_XDP_REDIRECT BIT(1) -@@ -375,8 +387,7 @@ static void tsnep_tx_activate(struct tsnep_tx *tx, int index, int length, - if (entry->skb) { - entry->properties = length & TSNEP_DESC_LENGTH_MASK; - entry->properties |= TSNEP_DESC_INTERRUPT_FLAG; -- if ((entry->type & TSNEP_TX_TYPE_SKB) && -- (skb_shinfo(entry->skb)->tx_flags & SKBTX_IN_PROGRESS)) -+ if ((entry->type & TSNEP_TX_TYPE_SKB_TSTAMP) == TSNEP_TX_TYPE_SKB_TSTAMP) - entry->properties |= TSNEP_DESC_EXTENDED_WRITEBACK_FLAG; - - /* toggle user flag to prevent false acknowledge -@@ -416,6 +427,8 @@ static void tsnep_tx_activate(struct tsnep_tx *tx, int index, int length, - entry->properties |= TSNEP_TX_DESC_OWNER_USER_FLAG; - entry->desc->more_properties = - __cpu_to_le32(entry->len & TSNEP_DESC_LENGTH_MASK); -+ if (entry->type & TSNEP_TX_TYPE_INLINE) -+ entry->properties |= TSNEP_TX_DESC_DATA_AFTER_DESC_FLAG; - - /* descriptor properties shall be written last, because valid data is - * signaled there -@@ -433,39 +446,83 @@ static int tsnep_tx_desc_available(struct tsnep_tx *tx) - return tx->read - tx->write - 1; - } - --static int tsnep_tx_map(struct sk_buff *skb, struct tsnep_tx *tx, int count) -+static int tsnep_tx_map_frag(skb_frag_t *frag, struct tsnep_tx_entry *entry, -+ struct device *dmadev, dma_addr_t *dma) -+{ -+ unsigned int len; -+ int mapped; -+ -+ len = skb_frag_size(frag); -+ if (likely(len > TSNEP_DESC_SIZE_DATA_AFTER_INLINE)) { -+ *dma = skb_frag_dma_map(dmadev, frag, 0, len, DMA_TO_DEVICE); -+ if (dma_mapping_error(dmadev, *dma)) -+ return -ENOMEM; -+ entry->type = TSNEP_TX_TYPE_SKB_FRAG_MAP_PAGE; -+ mapped = 1; -+ } else { -+ void *fragdata = skb_frag_address_safe(frag); -+ -+ if (likely(fragdata)) { -+ memcpy(&entry->desc->tx, fragdata, len); -+ } else { -+ struct page *page = skb_frag_page(frag); -+ -+ fragdata = kmap_local_page(page); -+ memcpy(&entry->desc->tx, fragdata + skb_frag_off(frag), -+ len); -+ kunmap_local(fragdata); -+ } -+ entry->type = TSNEP_TX_TYPE_SKB_FRAG_INLINE; -+ mapped = 0; -+ } -+ -+ return mapped; -+} -+ -+static int tsnep_tx_map(struct sk_buff *skb, struct tsnep_tx *tx, int count, -+ bool do_tstamp) - { - struct device *dmadev = tx->adapter->dmadev; - struct tsnep_tx_entry *entry; - unsigned int len; -- dma_addr_t dma; - int map_len = 0; -- int i; -+ dma_addr_t dma; -+ int i, mapped; - - for (i = 0; i < count; i++) { - entry = &tx->entry[(tx->write + i) & TSNEP_RING_MASK]; - - if (!i) { - len = skb_headlen(skb); -- dma = dma_map_single(dmadev, skb->data, len, -- DMA_TO_DEVICE); -+ if (likely(len > TSNEP_DESC_SIZE_DATA_AFTER_INLINE)) { -+ dma = dma_map_single(dmadev, skb->data, len, -+ DMA_TO_DEVICE); -+ if (dma_mapping_error(dmadev, dma)) -+ return -ENOMEM; -+ entry->type = TSNEP_TX_TYPE_SKB_MAP; -+ mapped = 1; -+ } else { -+ memcpy(&entry->desc->tx, skb->data, len); -+ entry->type = TSNEP_TX_TYPE_SKB_INLINE; -+ mapped = 0; -+ } - -- entry->type = TSNEP_TX_TYPE_SKB; -+ if (do_tstamp) -+ entry->type |= TSNEP_TX_TYPE_TSTAMP; - } else { -- len = skb_frag_size(&skb_shinfo(skb)->frags[i - 1]); -- dma = skb_frag_dma_map(dmadev, -- &skb_shinfo(skb)->frags[i - 1], -- 0, len, DMA_TO_DEVICE); -+ skb_frag_t *frag = &skb_shinfo(skb)->frags[i - 1]; - -- entry->type = TSNEP_TX_TYPE_SKB_FRAG; -+ len = skb_frag_size(frag); -+ mapped = tsnep_tx_map_frag(frag, entry, dmadev, &dma); -+ if (mapped < 0) -+ return mapped; - } -- if (dma_mapping_error(dmadev, dma)) -- return -ENOMEM; - - entry->len = len; -- dma_unmap_addr_set(entry, dma, dma); -- -- entry->desc->tx = __cpu_to_le64(dma); -+ if (likely(mapped)) { -+ dma_unmap_addr_set(entry, dma, dma); -+ entry->desc->tx = __cpu_to_le64(dma); -+ } - - map_len += len; - } -@@ -484,13 +541,12 @@ static int tsnep_tx_unmap(struct tsnep_tx *tx, int index, int count) - entry = &tx->entry[(index + i) & TSNEP_RING_MASK]; - - if (entry->len) { -- if (entry->type & TSNEP_TX_TYPE_SKB) -+ if (entry->type & TSNEP_TX_TYPE_MAP) - dma_unmap_single(dmadev, - dma_unmap_addr(entry, dma), - dma_unmap_len(entry, len), - DMA_TO_DEVICE); -- else if (entry->type & -- (TSNEP_TX_TYPE_SKB_FRAG | TSNEP_TX_TYPE_XDP_NDO)) -+ else if (entry->type & TSNEP_TX_TYPE_MAP_PAGE) - dma_unmap_page(dmadev, - dma_unmap_addr(entry, dma), - dma_unmap_len(entry, len), -@@ -506,11 +562,12 @@ static int tsnep_tx_unmap(struct tsnep_tx *tx, int index, int count) - static netdev_tx_t tsnep_xmit_frame_ring(struct sk_buff *skb, - struct tsnep_tx *tx) - { -- int count = 1; - struct tsnep_tx_entry *entry; -+ bool do_tstamp = false; -+ int count = 1; - int length; -- int i; - int retval; -+ int i; - - if (skb_shinfo(skb)->nr_frags > 0) - count += skb_shinfo(skb)->nr_frags; -@@ -527,7 +584,13 @@ static netdev_tx_t tsnep_xmit_frame_ring(struct sk_buff *skb, - entry = &tx->entry[tx->write]; - entry->skb = skb; - -- retval = tsnep_tx_map(skb, tx, count); -+ if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) && -+ tx->adapter->hwtstamp_config.tx_type == HWTSTAMP_TX_ON) { -+ skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS; -+ do_tstamp = true; -+ } -+ -+ retval = tsnep_tx_map(skb, tx, count, do_tstamp); - if (retval < 0) { - tsnep_tx_unmap(tx, tx->write, count); - dev_kfree_skb_any(entry->skb); -@@ -539,9 +602,6 @@ static netdev_tx_t tsnep_xmit_frame_ring(struct sk_buff *skb, - } - length = retval; - -- if (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) -- skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS; -- - for (i = 0; i < count; i++) - tsnep_tx_activate(tx, (tx->write + i) & TSNEP_RING_MASK, length, - i == count - 1); -@@ -586,7 +646,7 @@ static int tsnep_xdp_tx_map(struct xdp_frame *xdpf, struct tsnep_tx *tx, - if (dma_mapping_error(dmadev, dma)) - return -ENOMEM; - -- entry->type = TSNEP_TX_TYPE_XDP_NDO; -+ entry->type = TSNEP_TX_TYPE_XDP_NDO_MAP_PAGE; - } else { - page = unlikely(frag) ? skb_frag_page(frag) : - virt_to_page(xdpf->data); -@@ -792,8 +852,7 @@ static bool tsnep_tx_poll(struct tsnep_tx *tx, int napi_budget) - - length = tsnep_tx_unmap(tx, tx->read, count); - -- if ((entry->type & TSNEP_TX_TYPE_SKB) && -- (skb_shinfo(entry->skb)->tx_flags & SKBTX_IN_PROGRESS) && -+ if (((entry->type & TSNEP_TX_TYPE_SKB_TSTAMP) == TSNEP_TX_TYPE_SKB_TSTAMP) && - (__le32_to_cpu(entry->desc_wb->properties) & - TSNEP_DESC_EXTENDED_WRITEBACK_FLAG)) { - struct skb_shared_hwtstamps hwtstamps; -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c -index 52792546fe00dd..339be6950c0395 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c -@@ -707,6 +707,11 @@ int cgx_get_rx_stats(void *cgxd, int lmac_id, int idx, u64 *rx_stat) - - if (!is_lmac_valid(cgx, lmac_id)) - return -ENODEV; -+ -+ /* pass lmac as 0 for CGX_CMR_RX_STAT9-12 */ -+ if (idx >= CGX_RX_STAT_GLOBAL_INDEX) -+ lmac_id = 0; -+ - *rx_stat = cgx_read(cgx, lmac_id, CGXX_CMRX_RX_STAT0 + (idx * 8)); - return 0; - } -diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c -index 6cc7a78968fc1c..74953f67a2bf9c 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c -+++ b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c -@@ -533,7 +533,8 @@ static int cn10k_mcs_write_tx_secy(struct otx2_nic *pfvf, - if (sw_tx_sc->encrypt) - sectag_tci |= (MCS_TCI_E | MCS_TCI_C); - -- policy = FIELD_PREP(MCS_TX_SECY_PLCY_MTU, secy->netdev->mtu); -+ policy = FIELD_PREP(MCS_TX_SECY_PLCY_MTU, -+ pfvf->netdev->mtu + OTX2_ETH_HLEN); - /* Write SecTag excluding AN bits(1..0) */ - policy |= FIELD_PREP(MCS_TX_SECY_PLCY_ST_TCI, sectag_tci >> 2); - policy |= FIELD_PREP(MCS_TX_SECY_PLCY_ST_OFFSET, tag_offset); -diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c -index c6ccfbd4226570..cb8efc952dfda9 100644 ---- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c -+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c -@@ -4628,7 +4628,7 @@ static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np) - } - - if (mtk_is_netsys_v3_or_greater(mac->hw) && -- MTK_HAS_CAPS(mac->hw->soc->caps, MTK_ESW_BIT) && -+ MTK_HAS_CAPS(mac->hw->soc->caps, MTK_ESW) && - id == MTK_GMAC1_ID) { - mac->phylink_config.mac_capabilities = MAC_ASYM_PAUSE | - MAC_SYM_PAUSE | -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 8a892614015cd9..d9dc7280302eb7 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -4136,6 +4136,10 @@ static netdev_features_t mlx5e_fix_uplink_rep_features(struct net_device *netdev - if (netdev->features & NETIF_F_HW_VLAN_CTAG_FILTER) - netdev_warn(netdev, "Disabling HW_VLAN CTAG FILTERING, not supported in switchdev mode\n"); - -+ features &= ~NETIF_F_HW_MACSEC; -+ if (netdev->features & NETIF_F_HW_MACSEC) -+ netdev_warn(netdev, "Disabling HW MACsec offload, not supported in switchdev mode\n"); -+ - return features; - } - -diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c -index d15aa6b25a8884..0534b10e29c5c4 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c -@@ -3013,6 +3013,9 @@ static int mlxsw_sp_neigh_rif_made_sync(struct mlxsw_sp *mlxsw_sp, - .rif = rif, - }; - -+ if (!mlxsw_sp_dev_lower_is_port(mlxsw_sp_rif_dev(rif))) -+ return 0; -+ - neigh_for_each(&arp_tbl, mlxsw_sp_neigh_rif_made_sync_each, &rms); - if (rms.err) - goto err_arp; -diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c -index 99df00c30b8c6c..b5d744d2586f72 100644 ---- a/drivers/net/ethernet/qlogic/qede/qede_main.c -+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c -@@ -203,7 +203,7 @@ static struct pci_driver qede_pci_driver = { - }; - - static struct qed_eth_cb_ops qede_ll_ops = { -- { -+ .common = { - #ifdef CONFIG_RFS_ACCEL - .arfs_filter_op = qede_arfs_filter_op, - #endif -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c -index 28d24d59efb84f..d57b976b904095 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c -@@ -1484,8 +1484,11 @@ static int qlcnic_sriov_channel_cfg_cmd(struct qlcnic_adapter *adapter, u8 cmd_o - } - - cmd_op = (cmd.rsp.arg[0] & 0xff); -- if (cmd.rsp.arg[0] >> 25 == 2) -- return 2; -+ if (cmd.rsp.arg[0] >> 25 == 2) { -+ ret = 2; -+ goto out; -+ } -+ - if (cmd_op == QLCNIC_BC_CMD_CHANNEL_INIT) - set_bit(QLC_BC_VF_STATE, &vf->state); - else -diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h -index 810977952f950b..4c12067b07f05e 100644 ---- a/drivers/net/hyperv/hyperv_net.h -+++ b/drivers/net/hyperv/hyperv_net.h -@@ -158,7 +158,6 @@ struct hv_netvsc_packet { - u8 cp_partial; /* partial copy into send buffer */ - - u8 rmsg_size; /* RNDIS header and PPI size */ -- u8 rmsg_pgcnt; /* page count of RNDIS header and PPI */ - u8 page_buf_cnt; - - u16 q_idx; -@@ -893,6 +892,18 @@ struct nvsp_message { - sizeof(struct nvsp_message)) - #define NETVSC_MIN_IN_MSG_SIZE sizeof(struct vmpacket_descriptor) - -+/* Maximum # of contiguous data ranges that can make up a trasmitted packet. -+ * Typically it's the max SKB fragments plus 2 for the rndis packet and the -+ * linear portion of the SKB. But if MAX_SKB_FRAGS is large, the value may -+ * need to be limited to MAX_PAGE_BUFFER_COUNT, which is the max # of entries -+ * in a GPA direct packet sent to netvsp over VMBus. -+ */ -+#if MAX_SKB_FRAGS + 2 < MAX_PAGE_BUFFER_COUNT -+#define MAX_DATA_RANGES (MAX_SKB_FRAGS + 2) -+#else -+#define MAX_DATA_RANGES MAX_PAGE_BUFFER_COUNT -+#endif -+ - /* Estimated requestor size: - * out_ring_size/min_out_msg_size + in_ring_size/min_in_msg_size - */ -diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c -index b2f27e505f76c6..61584b40cb0386 100644 ---- a/drivers/net/hyperv/netvsc.c -+++ b/drivers/net/hyperv/netvsc.c -@@ -945,8 +945,7 @@ static void netvsc_copy_to_send_buf(struct netvsc_device *net_device, - + pend_size; - int i; - u32 padding = 0; -- u32 page_count = packet->cp_partial ? packet->rmsg_pgcnt : -- packet->page_buf_cnt; -+ u32 page_count = packet->cp_partial ? 1 : packet->page_buf_cnt; - u32 remain; - - /* Add padding */ -@@ -1047,6 +1046,42 @@ static int netvsc_dma_map(struct hv_device *hv_dev, - return 0; - } - -+/* Build an "array" of mpb entries describing the data to be transferred -+ * over VMBus. After the desc header fields, each "array" entry is variable -+ * size, and each entry starts after the end of the previous entry. The -+ * "offset" and "len" fields for each entry imply the size of the entry. -+ * -+ * The pfns are in HV_HYP_PAGE_SIZE, because all communication with Hyper-V -+ * uses that granularity, even if the system page size of the guest is larger. -+ * Each entry in the input "pb" array must describe a contiguous range of -+ * guest physical memory so that the pfns are sequential if the range crosses -+ * a page boundary. The offset field must be < HV_HYP_PAGE_SIZE. -+ */ -+static inline void netvsc_build_mpb_array(struct hv_page_buffer *pb, -+ u32 page_buffer_count, -+ struct vmbus_packet_mpb_array *desc, -+ u32 *desc_size) -+{ -+ struct hv_mpb_array *mpb_entry = &desc->range; -+ int i, j; -+ -+ for (i = 0; i < page_buffer_count; i++) { -+ u32 offset = pb[i].offset; -+ u32 len = pb[i].len; -+ -+ mpb_entry->offset = offset; -+ mpb_entry->len = len; -+ -+ for (j = 0; j < HVPFN_UP(offset + len); j++) -+ mpb_entry->pfn_array[j] = pb[i].pfn + j; -+ -+ mpb_entry = (struct hv_mpb_array *)&mpb_entry->pfn_array[j]; -+ } -+ -+ desc->rangecount = page_buffer_count; -+ *desc_size = (char *)mpb_entry - (char *)desc; -+} -+ - static inline int netvsc_send_pkt( - struct hv_device *device, - struct hv_netvsc_packet *packet, -@@ -1089,8 +1124,11 @@ static inline int netvsc_send_pkt( - - packet->dma_range = NULL; - if (packet->page_buf_cnt) { -+ struct vmbus_channel_packet_page_buffer desc; -+ u32 desc_size; -+ - if (packet->cp_partial) -- pb += packet->rmsg_pgcnt; -+ pb++; - - ret = netvsc_dma_map(ndev_ctx->device_ctx, packet, pb); - if (ret) { -@@ -1098,11 +1136,12 @@ static inline int netvsc_send_pkt( - goto exit; - } - -- ret = vmbus_sendpacket_pagebuffer(out_channel, -- pb, packet->page_buf_cnt, -- &nvmsg, sizeof(nvmsg), -- req_id); -- -+ netvsc_build_mpb_array(pb, packet->page_buf_cnt, -+ (struct vmbus_packet_mpb_array *)&desc, -+ &desc_size); -+ ret = vmbus_sendpacket_mpb_desc(out_channel, -+ (struct vmbus_packet_mpb_array *)&desc, -+ desc_size, &nvmsg, sizeof(nvmsg), req_id); - if (ret) - netvsc_dma_unmap(ndev_ctx->device_ctx, packet); - } else { -@@ -1251,7 +1290,7 @@ int netvsc_send(struct net_device *ndev, - packet->send_buf_index = section_index; - - if (packet->cp_partial) { -- packet->page_buf_cnt -= packet->rmsg_pgcnt; -+ packet->page_buf_cnt--; - packet->total_data_buflen = msd_len + packet->rmsg_size; - } else { - packet->page_buf_cnt = 0; -diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c -index 8698d2db3dc8e1..ce6ac26131b347 100644 ---- a/drivers/net/hyperv/netvsc_drv.c -+++ b/drivers/net/hyperv/netvsc_drv.c -@@ -325,43 +325,10 @@ static u16 netvsc_select_queue(struct net_device *ndev, struct sk_buff *skb, - return txq; - } - --static u32 fill_pg_buf(unsigned long hvpfn, u32 offset, u32 len, -- struct hv_page_buffer *pb) --{ -- int j = 0; -- -- hvpfn += offset >> HV_HYP_PAGE_SHIFT; -- offset = offset & ~HV_HYP_PAGE_MASK; -- -- while (len > 0) { -- unsigned long bytes; -- -- bytes = HV_HYP_PAGE_SIZE - offset; -- if (bytes > len) -- bytes = len; -- pb[j].pfn = hvpfn; -- pb[j].offset = offset; -- pb[j].len = bytes; -- -- offset += bytes; -- len -= bytes; -- -- if (offset == HV_HYP_PAGE_SIZE && len) { -- hvpfn++; -- offset = 0; -- j++; -- } -- } -- -- return j + 1; --} -- - static u32 init_page_array(void *hdr, u32 len, struct sk_buff *skb, - struct hv_netvsc_packet *packet, - struct hv_page_buffer *pb) - { -- u32 slots_used = 0; -- char *data = skb->data; - int frags = skb_shinfo(skb)->nr_frags; - int i; - -@@ -370,28 +337,27 @@ static u32 init_page_array(void *hdr, u32 len, struct sk_buff *skb, - * 2. skb linear data - * 3. skb fragment data - */ -- slots_used += fill_pg_buf(virt_to_hvpfn(hdr), -- offset_in_hvpage(hdr), -- len, -- &pb[slots_used]); - -+ pb[0].offset = offset_in_hvpage(hdr); -+ pb[0].len = len; -+ pb[0].pfn = virt_to_hvpfn(hdr); - packet->rmsg_size = len; -- packet->rmsg_pgcnt = slots_used; - -- slots_used += fill_pg_buf(virt_to_hvpfn(data), -- offset_in_hvpage(data), -- skb_headlen(skb), -- &pb[slots_used]); -+ pb[1].offset = offset_in_hvpage(skb->data); -+ pb[1].len = skb_headlen(skb); -+ pb[1].pfn = virt_to_hvpfn(skb->data); - - for (i = 0; i < frags; i++) { - skb_frag_t *frag = skb_shinfo(skb)->frags + i; -+ struct hv_page_buffer *cur_pb = &pb[i + 2]; -+ u64 pfn = page_to_hvpfn(skb_frag_page(frag)); -+ u32 offset = skb_frag_off(frag); - -- slots_used += fill_pg_buf(page_to_hvpfn(skb_frag_page(frag)), -- skb_frag_off(frag), -- skb_frag_size(frag), -- &pb[slots_used]); -+ cur_pb->offset = offset_in_hvpage(offset); -+ cur_pb->len = skb_frag_size(frag); -+ cur_pb->pfn = pfn + (offset >> HV_HYP_PAGE_SHIFT); - } -- return slots_used; -+ return frags + 2; - } - - static int count_skb_frag_slots(struct sk_buff *skb) -@@ -482,7 +448,7 @@ static int netvsc_xmit(struct sk_buff *skb, struct net_device *net, bool xdp_tx) - struct net_device *vf_netdev; - u32 rndis_msg_size; - u32 hash; -- struct hv_page_buffer pb[MAX_PAGE_BUFFER_COUNT]; -+ struct hv_page_buffer pb[MAX_DATA_RANGES]; - - /* If VF is present and up then redirect packets to it. - * Skip the VF if it is marked down or has no carrier. -diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c -index af95947a87c552..09144f0ec2aa4f 100644 ---- a/drivers/net/hyperv/rndis_filter.c -+++ b/drivers/net/hyperv/rndis_filter.c -@@ -226,8 +226,7 @@ static int rndis_filter_send_request(struct rndis_device *dev, - struct rndis_request *req) - { - struct hv_netvsc_packet *packet; -- struct hv_page_buffer page_buf[2]; -- struct hv_page_buffer *pb = page_buf; -+ struct hv_page_buffer pb; - int ret; - - /* Setup the packet to send it */ -@@ -236,27 +235,14 @@ static int rndis_filter_send_request(struct rndis_device *dev, - packet->total_data_buflen = req->request_msg.msg_len; - packet->page_buf_cnt = 1; - -- pb[0].pfn = virt_to_phys(&req->request_msg) >> -- HV_HYP_PAGE_SHIFT; -- pb[0].len = req->request_msg.msg_len; -- pb[0].offset = offset_in_hvpage(&req->request_msg); -- -- /* Add one page_buf when request_msg crossing page boundary */ -- if (pb[0].offset + pb[0].len > HV_HYP_PAGE_SIZE) { -- packet->page_buf_cnt++; -- pb[0].len = HV_HYP_PAGE_SIZE - -- pb[0].offset; -- pb[1].pfn = virt_to_phys((void *)&req->request_msg -- + pb[0].len) >> HV_HYP_PAGE_SHIFT; -- pb[1].offset = 0; -- pb[1].len = req->request_msg.msg_len - -- pb[0].len; -- } -+ pb.pfn = virt_to_phys(&req->request_msg) >> HV_HYP_PAGE_SHIFT; -+ pb.len = req->request_msg.msg_len; -+ pb.offset = offset_in_hvpage(&req->request_msg); - - trace_rndis_send(dev->ndev, 0, &req->request_msg); - - rcu_read_lock_bh(); -- ret = netvsc_send(dev->ndev, packet, NULL, pb, NULL, false); -+ ret = netvsc_send(dev->ndev, packet, NULL, &pb, NULL, false); - rcu_read_unlock_bh(); - - return ret; -diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c -index cd048659706436..b7e100710601a5 100644 ---- a/drivers/net/wireless/mediatek/mt76/dma.c -+++ b/drivers/net/wireless/mediatek/mt76/dma.c -@@ -957,6 +957,7 @@ void mt76_dma_cleanup(struct mt76_dev *dev) - int i; - - mt76_worker_disable(&dev->tx_worker); -+ napi_disable(&dev->tx_napi); - netif_napi_del(&dev->tx_napi); - - for (i = 0; i < ARRAY_SIZE(dev->phys); i++) { -diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c -index fdde38903ebcd5..1e5c8220e365ca 100644 ---- a/drivers/nvme/host/pci.c -+++ b/drivers/nvme/host/pci.c -@@ -386,7 +386,7 @@ static bool nvme_dbbuf_update_and_check_event(u16 value, __le32 *dbbuf_db, - * as it only leads to a small amount of wasted memory for the lifetime of - * the I/O. - */ --static int nvme_pci_npages_prp(void) -+static __always_inline int nvme_pci_npages_prp(void) - { - unsigned max_bytes = (NVME_MAX_KB_SZ * 1024) + NVME_CTRL_PAGE_SIZE; - unsigned nprps = DIV_ROUND_UP(max_bytes, NVME_CTRL_PAGE_SIZE); -@@ -1107,7 +1107,9 @@ static void nvme_poll_irqdisable(struct nvme_queue *nvmeq) - WARN_ON_ONCE(test_bit(NVMEQ_POLLED, &nvmeq->flags)); - - disable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)); -+ spin_lock(&nvmeq->cq_poll_lock); - nvme_poll_cq(nvmeq, NULL); -+ spin_unlock(&nvmeq->cq_poll_lock); - enable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)); - } - -diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c -index 6387c0d34c551c..aa578be2bcb6df 100644 ---- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c -+++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c -@@ -101,7 +101,6 @@ struct rcar_gen3_phy { - struct rcar_gen3_chan *ch; - u32 int_enable_bits; - bool initialized; -- bool otg_initialized; - bool powered; - }; - -@@ -309,16 +308,15 @@ static bool rcar_gen3_is_any_rphy_initialized(struct rcar_gen3_chan *ch) - return false; - } - --static bool rcar_gen3_needs_init_otg(struct rcar_gen3_chan *ch) -+static bool rcar_gen3_is_any_otg_rphy_initialized(struct rcar_gen3_chan *ch) - { -- int i; -- -- for (i = 0; i < NUM_OF_PHYS; i++) { -- if (ch->rphys[i].otg_initialized) -- return false; -+ for (enum rcar_gen3_phy_index i = PHY_INDEX_BOTH_HC; i <= PHY_INDEX_EHCI; -+ i++) { -+ if (ch->rphys[i].initialized) -+ return true; - } - -- return true; -+ return false; - } - - static bool rcar_gen3_are_all_rphys_power_off(struct rcar_gen3_chan *ch) -@@ -340,7 +338,7 @@ static ssize_t role_store(struct device *dev, struct device_attribute *attr, - bool is_b_device; - enum phy_mode cur_mode, new_mode; - -- if (!ch->is_otg_channel || !rcar_gen3_is_any_rphy_initialized(ch)) -+ if (!ch->is_otg_channel || !rcar_gen3_is_any_otg_rphy_initialized(ch)) - return -EIO; - - if (sysfs_streq(buf, "host")) -@@ -378,7 +376,7 @@ static ssize_t role_show(struct device *dev, struct device_attribute *attr, - { - struct rcar_gen3_chan *ch = dev_get_drvdata(dev); - -- if (!ch->is_otg_channel || !rcar_gen3_is_any_rphy_initialized(ch)) -+ if (!ch->is_otg_channel || !rcar_gen3_is_any_otg_rphy_initialized(ch)) - return -EIO; - - return sprintf(buf, "%s\n", rcar_gen3_is_host(ch) ? "host" : -@@ -391,6 +389,9 @@ static void rcar_gen3_init_otg(struct rcar_gen3_chan *ch) - void __iomem *usb2_base = ch->base; - u32 val; - -+ if (!ch->is_otg_channel || rcar_gen3_is_any_otg_rphy_initialized(ch)) -+ return; -+ - /* Should not use functions of read-modify-write a register */ - val = readl(usb2_base + USB2_LINECTRL1); - val = (val & ~USB2_LINECTRL1_DP_RPD) | USB2_LINECTRL1_DPRPD_EN | -@@ -451,16 +452,16 @@ static int rcar_gen3_phy_usb2_init(struct phy *p) - val = readl(usb2_base + USB2_INT_ENABLE); - val |= USB2_INT_ENABLE_UCOM_INTEN | rphy->int_enable_bits; - writel(val, usb2_base + USB2_INT_ENABLE); -- writel(USB2_SPD_RSM_TIMSET_INIT, usb2_base + USB2_SPD_RSM_TIMSET); -- writel(USB2_OC_TIMSET_INIT, usb2_base + USB2_OC_TIMSET); -- -- /* Initialize otg part */ -- if (channel->is_otg_channel) { -- if (rcar_gen3_needs_init_otg(channel)) -- rcar_gen3_init_otg(channel); -- rphy->otg_initialized = true; -+ -+ if (!rcar_gen3_is_any_rphy_initialized(channel)) { -+ writel(USB2_SPD_RSM_TIMSET_INIT, usb2_base + USB2_SPD_RSM_TIMSET); -+ writel(USB2_OC_TIMSET_INIT, usb2_base + USB2_OC_TIMSET); - } - -+ /* Initialize otg part (only if we initialize a PHY with IRQs). */ -+ if (rphy->int_enable_bits) -+ rcar_gen3_init_otg(channel); -+ - rphy->initialized = true; - - return 0; -@@ -475,9 +476,6 @@ static int rcar_gen3_phy_usb2_exit(struct phy *p) - - rphy->initialized = false; - -- if (channel->is_otg_channel) -- rphy->otg_initialized = false; -- - val = readl(usb2_base + USB2_INT_ENABLE); - val &= ~rphy->int_enable_bits; - if (!rcar_gen3_is_any_rphy_initialized(channel)) -diff --git a/drivers/phy/tegra/xusb-tegra186.c b/drivers/phy/tegra/xusb-tegra186.c -index fae6242aa730e0..23a23f2d64e586 100644 ---- a/drivers/phy/tegra/xusb-tegra186.c -+++ b/drivers/phy/tegra/xusb-tegra186.c -@@ -237,6 +237,8 @@ - #define DATA0_VAL_PD BIT(1) - #define USE_XUSB_AO BIT(4) - -+#define TEGRA_UTMI_PAD_MAX 4 -+ - #define TEGRA186_LANE(_name, _offset, _shift, _mask, _type) \ - { \ - .name = _name, \ -@@ -269,7 +271,7 @@ struct tegra186_xusb_padctl { - - /* UTMI bias and tracking */ - struct clk *usb2_trk_clk; -- unsigned int bias_pad_enable; -+ DECLARE_BITMAP(utmi_pad_enabled, TEGRA_UTMI_PAD_MAX); - - /* padctl context */ - struct tegra186_xusb_padctl_context context; -@@ -603,12 +605,8 @@ static void tegra186_utmi_bias_pad_power_on(struct tegra_xusb_padctl *padctl) - u32 value; - int err; - -- mutex_lock(&padctl->lock); -- -- if (priv->bias_pad_enable++ > 0) { -- mutex_unlock(&padctl->lock); -+ if (!bitmap_empty(priv->utmi_pad_enabled, TEGRA_UTMI_PAD_MAX)) - return; -- } - - err = clk_prepare_enable(priv->usb2_trk_clk); - if (err < 0) -@@ -658,8 +656,6 @@ static void tegra186_utmi_bias_pad_power_on(struct tegra_xusb_padctl *padctl) - } else { - clk_disable_unprepare(priv->usb2_trk_clk); - } -- -- mutex_unlock(&padctl->lock); - } - - static void tegra186_utmi_bias_pad_power_off(struct tegra_xusb_padctl *padctl) -@@ -667,17 +663,8 @@ static void tegra186_utmi_bias_pad_power_off(struct tegra_xusb_padctl *padctl) - struct tegra186_xusb_padctl *priv = to_tegra186_xusb_padctl(padctl); - u32 value; - -- mutex_lock(&padctl->lock); -- -- if (WARN_ON(priv->bias_pad_enable == 0)) { -- mutex_unlock(&padctl->lock); -- return; -- } -- -- if (--priv->bias_pad_enable > 0) { -- mutex_unlock(&padctl->lock); -+ if (!bitmap_empty(priv->utmi_pad_enabled, TEGRA_UTMI_PAD_MAX)) - return; -- } - - value = padctl_readl(padctl, XUSB_PADCTL_USB2_BIAS_PAD_CTL1); - value |= USB2_PD_TRK; -@@ -690,13 +677,13 @@ static void tegra186_utmi_bias_pad_power_off(struct tegra_xusb_padctl *padctl) - clk_disable_unprepare(priv->usb2_trk_clk); - } - -- mutex_unlock(&padctl->lock); - } - - static void tegra186_utmi_pad_power_on(struct phy *phy) - { - struct tegra_xusb_lane *lane = phy_get_drvdata(phy); - struct tegra_xusb_padctl *padctl = lane->pad->padctl; -+ struct tegra186_xusb_padctl *priv = to_tegra186_xusb_padctl(padctl); - struct tegra_xusb_usb2_port *port; - struct device *dev = padctl->dev; - unsigned int index = lane->index; -@@ -705,9 +692,16 @@ static void tegra186_utmi_pad_power_on(struct phy *phy) - if (!phy) - return; - -+ mutex_lock(&padctl->lock); -+ if (test_bit(index, priv->utmi_pad_enabled)) { -+ mutex_unlock(&padctl->lock); -+ return; -+ } -+ - port = tegra_xusb_find_usb2_port(padctl, index); - if (!port) { - dev_err(dev, "no port found for USB2 lane %u\n", index); -+ mutex_unlock(&padctl->lock); - return; - } - -@@ -724,18 +718,28 @@ static void tegra186_utmi_pad_power_on(struct phy *phy) - value = padctl_readl(padctl, XUSB_PADCTL_USB2_OTG_PADX_CTL1(index)); - value &= ~USB2_OTG_PD_DR; - padctl_writel(padctl, value, XUSB_PADCTL_USB2_OTG_PADX_CTL1(index)); -+ -+ set_bit(index, priv->utmi_pad_enabled); -+ mutex_unlock(&padctl->lock); - } - - static void tegra186_utmi_pad_power_down(struct phy *phy) - { - struct tegra_xusb_lane *lane = phy_get_drvdata(phy); - struct tegra_xusb_padctl *padctl = lane->pad->padctl; -+ struct tegra186_xusb_padctl *priv = to_tegra186_xusb_padctl(padctl); - unsigned int index = lane->index; - u32 value; - - if (!phy) - return; - -+ mutex_lock(&padctl->lock); -+ if (!test_bit(index, priv->utmi_pad_enabled)) { -+ mutex_unlock(&padctl->lock); -+ return; -+ } -+ - dev_dbg(padctl->dev, "power down UTMI pad %u\n", index); - - value = padctl_readl(padctl, XUSB_PADCTL_USB2_OTG_PADX_CTL0(index)); -@@ -748,7 +752,11 @@ static void tegra186_utmi_pad_power_down(struct phy *phy) - - udelay(2); - -+ clear_bit(index, priv->utmi_pad_enabled); -+ - tegra186_utmi_bias_pad_power_off(padctl); -+ -+ mutex_unlock(&padctl->lock); - } - - static int tegra186_xusb_padctl_vbus_override(struct tegra_xusb_padctl *padctl, -diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c -index 983a6e6173bd21..3a04a56ca52de9 100644 ---- a/drivers/phy/tegra/xusb.c -+++ b/drivers/phy/tegra/xusb.c -@@ -548,16 +548,16 @@ static int tegra_xusb_port_init(struct tegra_xusb_port *port, - - err = dev_set_name(&port->dev, "%s-%u", name, index); - if (err < 0) -- goto unregister; -+ goto put_device; - - err = device_add(&port->dev); - if (err < 0) -- goto unregister; -+ goto put_device; - - return 0; - --unregister: -- device_unregister(&port->dev); -+put_device: -+ put_device(&port->dev); - return err; - } - -diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c -index b4f49720c87f62..2e3f6fc67c568d 100644 ---- a/drivers/platform/x86/amd/pmc/pmc-quirks.c -+++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c -@@ -217,6 +217,13 @@ static const struct dmi_system_id fwbug_list[] = { - DMI_MATCH(DMI_BIOS_VERSION, "03.05"), - } - }, -+ { -+ .ident = "MECHREVO Wujie 14X (GX4HRXL)", -+ .driver_data = &quirk_spurious_8042, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_NAME, "WUJIE14-GX4HRXL"), -+ } -+ }, - {} - }; - -diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c -index 222e429931ef9e..2c894ea8aa8174 100644 ---- a/drivers/platform/x86/asus-wmi.c -+++ b/drivers/platform/x86/asus-wmi.c -@@ -4404,7 +4404,8 @@ static int asus_wmi_add(struct platform_device *pdev) - goto fail_leds; - - asus_wmi_get_devstate(asus, ASUS_WMI_DEVID_WLAN, &result); -- if (result & (ASUS_WMI_DSTS_PRESENCE_BIT | ASUS_WMI_DSTS_USER_BIT)) -+ if ((result & (ASUS_WMI_DSTS_PRESENCE_BIT | ASUS_WMI_DSTS_USER_BIT)) == -+ (ASUS_WMI_DSTS_PRESENCE_BIT | ASUS_WMI_DSTS_USER_BIT)) - asus->driver->wlan_ctrl_by_user = 1; - - if (!(asus->driver->wlan_ctrl_by_user && ashs_present())) { -diff --git a/drivers/regulator/max20086-regulator.c b/drivers/regulator/max20086-regulator.c -index 32f47b896fd1e2..ebfbcadbca5295 100644 ---- a/drivers/regulator/max20086-regulator.c -+++ b/drivers/regulator/max20086-regulator.c -@@ -132,7 +132,7 @@ static int max20086_regulators_register(struct max20086 *chip) - - static int max20086_parse_regulators_dt(struct max20086 *chip, bool *boot_on) - { -- struct of_regulator_match matches[MAX20086_MAX_REGULATORS] = { }; -+ struct of_regulator_match *matches; - struct device_node *node; - unsigned int i; - int ret; -@@ -143,6 +143,11 @@ static int max20086_parse_regulators_dt(struct max20086 *chip, bool *boot_on) - return -ENODEV; - } - -+ matches = devm_kcalloc(chip->dev, chip->info->num_outputs, -+ sizeof(*matches), GFP_KERNEL); -+ if (!matches) -+ return -ENOMEM; -+ - for (i = 0; i < chip->info->num_outputs; ++i) - matches[i].name = max20086_output_names[i]; - -diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c -index 203df5e53b1a84..9bbabae253e53b 100644 ---- a/drivers/scsi/sd_zbc.c -+++ b/drivers/scsi/sd_zbc.c -@@ -202,6 +202,7 @@ static void *sd_zbc_alloc_report_buffer(struct scsi_disk *sdkp, - unsigned int nr_zones, size_t *buflen) - { - struct request_queue *q = sdkp->disk->queue; -+ unsigned int max_segments; - size_t bufsize; - void *buf; - -@@ -213,12 +214,15 @@ static void *sd_zbc_alloc_report_buffer(struct scsi_disk *sdkp, - * Furthermore, since the report zone command cannot be split, make - * sure that the allocated buffer can always be mapped by limiting the - * number of pages allocated to the HBA max segments limit. -+ * Since max segments can be larger than the max inline bio vectors, -+ * further limit the allocated buffer to BIO_MAX_INLINE_VECS. - */ - nr_zones = min(nr_zones, sdkp->zone_info.nr_zones); - bufsize = roundup((nr_zones + 1) * 64, SECTOR_SIZE); - bufsize = min_t(size_t, bufsize, - queue_max_hw_sectors(q) << SECTOR_SHIFT); -- bufsize = min_t(size_t, bufsize, queue_max_segments(q) << PAGE_SHIFT); -+ max_segments = min(BIO_MAX_INLINE_VECS, queue_max_segments(q)); -+ bufsize = min_t(size_t, bufsize, max_segments << PAGE_SHIFT); - - while (bufsize >= SECTOR_SIZE) { - buf = kvzalloc(bufsize, GFP_KERNEL | __GFP_NORETRY); -diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c -index b8186feccdf5aa..48b0ca92b44fb3 100644 ---- a/drivers/scsi/storvsc_drv.c -+++ b/drivers/scsi/storvsc_drv.c -@@ -1819,6 +1819,7 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) - return SCSI_MLQUEUE_DEVICE_BUSY; - } - -+ payload->rangecount = 1; - payload->range.len = length; - payload->range.offset = offset_in_hvpg; - -diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c -index bbf2015d8e5cce..69b6c87c5525e0 100644 ---- a/drivers/spi/spi-loopback-test.c -+++ b/drivers/spi/spi-loopback-test.c -@@ -421,7 +421,7 @@ MODULE_LICENSE("GPL"); - static void spi_test_print_hex_dump(char *pre, const void *ptr, size_t len) - { - /* limit the hex_dump */ -- if (len < 1024) { -+ if (len <= 1024) { - print_hex_dump(KERN_INFO, pre, - DUMP_PREFIX_OFFSET, 16, 1, - ptr, len, 0); -diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c -index 147d7052794f77..8d7ce4c556aa1d 100644 ---- a/drivers/spi/spi-tegra114.c -+++ b/drivers/spi/spi-tegra114.c -@@ -728,9 +728,9 @@ static int tegra_spi_set_hw_cs_timing(struct spi_device *spi) - u32 inactive_cycles; - u8 cs_state; - -- if ((setup->unit && setup->unit != SPI_DELAY_UNIT_SCK) || -- (hold->unit && hold->unit != SPI_DELAY_UNIT_SCK) || -- (inactive->unit && inactive->unit != SPI_DELAY_UNIT_SCK)) { -+ if ((setup->value && setup->unit != SPI_DELAY_UNIT_SCK) || -+ (hold->value && hold->unit != SPI_DELAY_UNIT_SCK) || -+ (inactive->value && inactive->unit != SPI_DELAY_UNIT_SCK)) { - dev_err(&spi->dev, - "Invalid delay unit %d, should be SPI_DELAY_UNIT_SCK\n", - SPI_DELAY_UNIT_SCK); -diff --git a/drivers/usb/gadget/function/f_midi2.c b/drivers/usb/gadget/function/f_midi2.c -index b7dada064890bd..90536f47906c33 100644 ---- a/drivers/usb/gadget/function/f_midi2.c -+++ b/drivers/usb/gadget/function/f_midi2.c -@@ -475,7 +475,7 @@ static void reply_ump_stream_ep_info(struct f_midi2_ep *ep) - /* reply a UMP EP device info */ - static void reply_ump_stream_ep_device(struct f_midi2_ep *ep) - { -- struct snd_ump_stream_msg_devince_info rep = { -+ struct snd_ump_stream_msg_device_info rep = { - .type = UMP_MSG_TYPE_STREAM, - .status = UMP_STREAM_MSG_STATUS_DEVICE_INFO, - .manufacture_id = ep->info.manufacturer, -diff --git a/drivers/usb/typec/ucsi/displayport.c b/drivers/usb/typec/ucsi/displayport.c -index 8c19081c325542..e3b5fa3b5f955d 100644 ---- a/drivers/usb/typec/ucsi/displayport.c -+++ b/drivers/usb/typec/ucsi/displayport.c -@@ -54,7 +54,8 @@ static int ucsi_displayport_enter(struct typec_altmode *alt, u32 *vdo) - u8 cur = 0; - int ret; - -- mutex_lock(&dp->con->lock); -+ if (!ucsi_con_mutex_lock(dp->con)) -+ return -ENOTCONN; - - if (!dp->override && dp->initialized) { - const struct typec_altmode *p = typec_altmode_get_partner(alt); -@@ -100,7 +101,7 @@ static int ucsi_displayport_enter(struct typec_altmode *alt, u32 *vdo) - schedule_work(&dp->work); - ret = 0; - err_unlock: -- mutex_unlock(&dp->con->lock); -+ ucsi_con_mutex_unlock(dp->con); - - return ret; - } -@@ -112,7 +113,8 @@ static int ucsi_displayport_exit(struct typec_altmode *alt) - u64 command; - int ret = 0; - -- mutex_lock(&dp->con->lock); -+ if (!ucsi_con_mutex_lock(dp->con)) -+ return -ENOTCONN; - - if (!dp->override) { - const struct typec_altmode *p = typec_altmode_get_partner(alt); -@@ -144,7 +146,7 @@ static int ucsi_displayport_exit(struct typec_altmode *alt) - schedule_work(&dp->work); - - out_unlock: -- mutex_unlock(&dp->con->lock); -+ ucsi_con_mutex_unlock(dp->con); - - return ret; - } -@@ -202,20 +204,21 @@ static int ucsi_displayport_vdm(struct typec_altmode *alt, - int cmd = PD_VDO_CMD(header); - int svdm_version; - -- mutex_lock(&dp->con->lock); -+ if (!ucsi_con_mutex_lock(dp->con)) -+ return -ENOTCONN; - - if (!dp->override && dp->initialized) { - const struct typec_altmode *p = typec_altmode_get_partner(alt); - - dev_warn(&p->dev, - "firmware doesn't support alternate mode overriding\n"); -- mutex_unlock(&dp->con->lock); -+ ucsi_con_mutex_unlock(dp->con); - return -EOPNOTSUPP; - } - - svdm_version = typec_altmode_get_svdm_version(alt); - if (svdm_version < 0) { -- mutex_unlock(&dp->con->lock); -+ ucsi_con_mutex_unlock(dp->con); - return svdm_version; - } - -@@ -259,7 +262,7 @@ static int ucsi_displayport_vdm(struct typec_altmode *alt, - break; - } - -- mutex_unlock(&dp->con->lock); -+ ucsi_con_mutex_unlock(dp->con); - - return 0; - } -diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c -index 29a04d6795012d..ea98bc5674940d 100644 ---- a/drivers/usb/typec/ucsi/ucsi.c -+++ b/drivers/usb/typec/ucsi/ucsi.c -@@ -1559,6 +1559,40 @@ void ucsi_set_drvdata(struct ucsi *ucsi, void *data) - } - EXPORT_SYMBOL_GPL(ucsi_set_drvdata); - -+/** -+ * ucsi_con_mutex_lock - Acquire the connector mutex -+ * @con: The connector interface to lock -+ * -+ * Returns true on success, false if the connector is disconnected -+ */ -+bool ucsi_con_mutex_lock(struct ucsi_connector *con) -+{ -+ bool mutex_locked = false; -+ bool connected = true; -+ -+ while (connected && !mutex_locked) { -+ mutex_locked = mutex_trylock(&con->lock) != 0; -+ connected = con->status.flags & UCSI_CONSTAT_CONNECTED; -+ if (connected && !mutex_locked) -+ msleep(20); -+ } -+ -+ connected = connected && con->partner; -+ if (!connected && mutex_locked) -+ mutex_unlock(&con->lock); -+ -+ return connected; -+} -+ -+/** -+ * ucsi_con_mutex_unlock - Release the connector mutex -+ * @con: The connector interface to unlock -+ */ -+void ucsi_con_mutex_unlock(struct ucsi_connector *con) -+{ -+ mutex_unlock(&con->lock); -+} -+ - /** - * ucsi_create - Allocate UCSI instance - * @dev: Device interface to the PPM (Platform Policy Manager) -diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h -index 921ef0e115cffc..3bb23a2ea547ac 100644 ---- a/drivers/usb/typec/ucsi/ucsi.h -+++ b/drivers/usb/typec/ucsi/ucsi.h -@@ -79,6 +79,8 @@ int ucsi_register(struct ucsi *ucsi); - void ucsi_unregister(struct ucsi *ucsi); - void *ucsi_get_drvdata(struct ucsi *ucsi); - void ucsi_set_drvdata(struct ucsi *ucsi, void *data); -+bool ucsi_con_mutex_lock(struct ucsi_connector *con); -+void ucsi_con_mutex_unlock(struct ucsi_connector *con); - - void ucsi_connector_change(struct ucsi *ucsi, u8 num); - -diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c -index fb2c8d14327ae1..3ff7d2e47c7e90 100644 ---- a/fs/binfmt_elf.c -+++ b/fs/binfmt_elf.c -@@ -110,25 +110,6 @@ static struct linux_binfmt elf_format = { - - #define BAD_ADDR(x) (unlikely((unsigned long)(x) >= TASK_SIZE)) - --static int set_brk(unsigned long start, unsigned long end, int prot) --{ -- start = ELF_PAGEALIGN(start); -- end = ELF_PAGEALIGN(end); -- if (end > start) { -- /* -- * Map the last of the bss segment. -- * If the header is requesting these pages to be -- * executable, honour that (ppc32 needs this). -- */ -- int error = vm_brk_flags(start, end - start, -- prot & PROT_EXEC ? VM_EXEC : 0); -- if (error) -- return error; -- } -- current->mm->start_brk = current->mm->brk = end; -- return 0; --} -- - /* We need to explicitly zero any fractional pages - after the data section (i.e. bss). This would - contain the junk from the file that should not -@@ -406,6 +387,51 @@ static unsigned long elf_map(struct file *filep, unsigned long addr, - return(map_addr); - } - -+static unsigned long elf_load(struct file *filep, unsigned long addr, -+ const struct elf_phdr *eppnt, int prot, int type, -+ unsigned long total_size) -+{ -+ unsigned long zero_start, zero_end; -+ unsigned long map_addr; -+ -+ if (eppnt->p_filesz) { -+ map_addr = elf_map(filep, addr, eppnt, prot, type, total_size); -+ if (BAD_ADDR(map_addr)) -+ return map_addr; -+ if (eppnt->p_memsz > eppnt->p_filesz) { -+ zero_start = map_addr + ELF_PAGEOFFSET(eppnt->p_vaddr) + -+ eppnt->p_filesz; -+ zero_end = map_addr + ELF_PAGEOFFSET(eppnt->p_vaddr) + -+ eppnt->p_memsz; -+ -+ /* Zero the end of the last mapped page */ -+ padzero(zero_start); -+ } -+ } else { -+ map_addr = zero_start = ELF_PAGESTART(addr); -+ zero_end = zero_start + ELF_PAGEOFFSET(eppnt->p_vaddr) + -+ eppnt->p_memsz; -+ } -+ if (eppnt->p_memsz > eppnt->p_filesz) { -+ /* -+ * Map the last of the segment. -+ * If the header is requesting these pages to be -+ * executable, honour that (ppc32 needs this). -+ */ -+ int error; -+ -+ zero_start = ELF_PAGEALIGN(zero_start); -+ zero_end = ELF_PAGEALIGN(zero_end); -+ -+ error = vm_brk_flags(zero_start, zero_end - zero_start, -+ prot & PROT_EXEC ? VM_EXEC : 0); -+ if (error) -+ map_addr = error; -+ } -+ return map_addr; -+} -+ -+ - static unsigned long total_mapping_size(const struct elf_phdr *phdr, int nr) - { - elf_addr_t min_addr = -1; -@@ -828,8 +854,8 @@ static int load_elf_binary(struct linux_binprm *bprm) - unsigned long error; - struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL; - struct elf_phdr *elf_property_phdata = NULL; -- unsigned long elf_bss, elf_brk; -- int bss_prot = 0; -+ unsigned long elf_brk; -+ bool brk_moved = false; - int retval, i; - unsigned long elf_entry; - unsigned long e_entry; -@@ -1021,7 +1047,6 @@ static int load_elf_binary(struct linux_binprm *bprm) - if (retval < 0) - goto out_free_dentry; - -- elf_bss = 0; - elf_brk = 0; - - start_code = ~0UL; -@@ -1041,33 +1066,6 @@ static int load_elf_binary(struct linux_binprm *bprm) - if (elf_ppnt->p_type != PT_LOAD) - continue; - -- if (unlikely (elf_brk > elf_bss)) { -- unsigned long nbyte; -- -- /* There was a PT_LOAD segment with p_memsz > p_filesz -- before this one. Map anonymous pages, if needed, -- and clear the area. */ -- retval = set_brk(elf_bss + load_bias, -- elf_brk + load_bias, -- bss_prot); -- if (retval) -- goto out_free_dentry; -- nbyte = ELF_PAGEOFFSET(elf_bss); -- if (nbyte) { -- nbyte = ELF_MIN_ALIGN - nbyte; -- if (nbyte > elf_brk - elf_bss) -- nbyte = elf_brk - elf_bss; -- if (clear_user((void __user *)elf_bss + -- load_bias, nbyte)) { -- /* -- * This bss-zeroing can fail if the ELF -- * file specifies odd protections. So -- * we don't check the return value -- */ -- } -- } -- } -- - elf_prot = make_prot(elf_ppnt->p_flags, &arch_state, - !!interpreter, false); - -@@ -1095,15 +1093,49 @@ static int load_elf_binary(struct linux_binprm *bprm) - * Header for ET_DYN binaries to calculate the - * randomization (load_bias) for all the LOAD - * Program Headers. -+ */ -+ -+ /* -+ * Calculate the entire size of the ELF mapping -+ * (total_size), used for the initial mapping, -+ * due to load_addr_set which is set to true later -+ * once the initial mapping is performed. -+ * -+ * Note that this is only sensible when the LOAD -+ * segments are contiguous (or overlapping). If -+ * used for LOADs that are far apart, this would -+ * cause the holes between LOADs to be mapped, -+ * running the risk of having the mapping fail, -+ * as it would be larger than the ELF file itself. -+ * -+ * As a result, only ET_DYN does this, since -+ * some ET_EXEC (e.g. ia64) may have large virtual -+ * memory holes between LOADs. -+ * -+ */ -+ total_size = total_mapping_size(elf_phdata, -+ elf_ex->e_phnum); -+ if (!total_size) { -+ retval = -EINVAL; -+ goto out_free_dentry; -+ } -+ -+ /* Calculate any requested alignment. */ -+ alignment = maximum_alignment(elf_phdata, elf_ex->e_phnum); -+ -+ /** -+ * DOC: PIE handling - * -- * There are effectively two types of ET_DYN -- * binaries: programs (i.e. PIE: ET_DYN with INTERP) -- * and loaders (ET_DYN without INTERP, since they -- * _are_ the ELF interpreter). The loaders must -- * be loaded away from programs since the program -- * may otherwise collide with the loader (especially -- * for ET_EXEC which does not have a randomized -- * position). For example to handle invocations of -+ * There are effectively two types of ET_DYN ELF -+ * binaries: programs (i.e. PIE: ET_DYN with -+ * PT_INTERP) and loaders (i.e. static PIE: ET_DYN -+ * without PT_INTERP, usually the ELF interpreter -+ * itself). Loaders must be loaded away from programs -+ * since the program may otherwise collide with the -+ * loader (especially for ET_EXEC which does not have -+ * a randomized position). -+ * -+ * For example, to handle invocations of - * "./ld.so someprog" to test out a new version of - * the loader, the subsequent program that the - * loader loads must avoid the loader itself, so -@@ -1116,17 +1148,49 @@ static int load_elf_binary(struct linux_binprm *bprm) - * ELF_ET_DYN_BASE and loaders are loaded into the - * independently randomized mmap region (0 load_bias - * without MAP_FIXED nor MAP_FIXED_NOREPLACE). -+ * -+ * See below for "brk" handling details, which is -+ * also affected by program vs loader and ASLR. - */ - if (interpreter) { -+ /* On ET_DYN with PT_INTERP, we do the ASLR. */ - load_bias = ELF_ET_DYN_BASE; - if (current->flags & PF_RANDOMIZE) - load_bias += arch_mmap_rnd(); -- alignment = maximum_alignment(elf_phdata, elf_ex->e_phnum); -+ /* Adjust alignment as requested. */ - if (alignment) - load_bias &= ~(alignment - 1); - elf_flags |= MAP_FIXED_NOREPLACE; -- } else -- load_bias = 0; -+ } else { -+ /* -+ * For ET_DYN without PT_INTERP, we rely on -+ * the architectures's (potentially ASLR) mmap -+ * base address (via a load_bias of 0). -+ * -+ * When a large alignment is requested, we -+ * must do the allocation at address "0" right -+ * now to discover where things will load so -+ * that we can adjust the resulting alignment. -+ * In this case (load_bias != 0), we can use -+ * MAP_FIXED_NOREPLACE to make sure the mapping -+ * doesn't collide with anything. -+ */ -+ if (alignment > ELF_MIN_ALIGN) { -+ load_bias = elf_load(bprm->file, 0, elf_ppnt, -+ elf_prot, elf_flags, total_size); -+ if (BAD_ADDR(load_bias)) { -+ retval = IS_ERR_VALUE(load_bias) ? -+ PTR_ERR((void*)load_bias) : -EINVAL; -+ goto out_free_dentry; -+ } -+ vm_munmap(load_bias, total_size); -+ /* Adjust alignment as requested. */ -+ if (alignment) -+ load_bias &= ~(alignment - 1); -+ elf_flags |= MAP_FIXED_NOREPLACE; -+ } else -+ load_bias = 0; -+ } - - /* - * Since load_bias is used for all subsequent loading -@@ -1136,34 +1200,9 @@ static int load_elf_binary(struct linux_binprm *bprm) - * is then page aligned. - */ - load_bias = ELF_PAGESTART(load_bias - vaddr); -- -- /* -- * Calculate the entire size of the ELF mapping -- * (total_size), used for the initial mapping, -- * due to load_addr_set which is set to true later -- * once the initial mapping is performed. -- * -- * Note that this is only sensible when the LOAD -- * segments are contiguous (or overlapping). If -- * used for LOADs that are far apart, this would -- * cause the holes between LOADs to be mapped, -- * running the risk of having the mapping fail, -- * as it would be larger than the ELF file itself. -- * -- * As a result, only ET_DYN does this, since -- * some ET_EXEC (e.g. ia64) may have large virtual -- * memory holes between LOADs. -- * -- */ -- total_size = total_mapping_size(elf_phdata, -- elf_ex->e_phnum); -- if (!total_size) { -- retval = -EINVAL; -- goto out_free_dentry; -- } - } - -- error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, -+ error = elf_load(bprm->file, load_bias + vaddr, elf_ppnt, - elf_prot, elf_flags, total_size); - if (BAD_ADDR(error)) { - retval = IS_ERR_VALUE(error) ? -@@ -1211,41 +1250,23 @@ static int load_elf_binary(struct linux_binprm *bprm) - - k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz; - -- if (k > elf_bss) -- elf_bss = k; - if ((elf_ppnt->p_flags & PF_X) && end_code < k) - end_code = k; - if (end_data < k) - end_data = k; - k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz; -- if (k > elf_brk) { -- bss_prot = elf_prot; -+ if (k > elf_brk) - elf_brk = k; -- } - } - - e_entry = elf_ex->e_entry + load_bias; - phdr_addr += load_bias; -- elf_bss += load_bias; - elf_brk += load_bias; - start_code += load_bias; - end_code += load_bias; - start_data += load_bias; - end_data += load_bias; - -- /* Calling set_brk effectively mmaps the pages that we need -- * for the bss and break sections. We must do this before -- * mapping in the interpreter, to make sure it doesn't wind -- * up getting placed where the bss needs to go. -- */ -- retval = set_brk(elf_bss, elf_brk, bss_prot); -- if (retval) -- goto out_free_dentry; -- if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) { -- retval = -EFAULT; /* Nobody gets to see this, but.. */ -- goto out_free_dentry; -- } -- - if (interpreter) { - elf_entry = load_elf_interp(interp_elf_ex, - interpreter, -@@ -1301,24 +1322,44 @@ static int load_elf_binary(struct linux_binprm *bprm) - mm->end_data = end_data; - mm->start_stack = bprm->p; - -- if ((current->flags & PF_RANDOMIZE) && (snapshot_randomize_va_space > 1)) { -+ /** -+ * DOC: "brk" handling -+ * -+ * For architectures with ELF randomization, when executing a -+ * loader directly (i.e. static PIE: ET_DYN without PT_INTERP), -+ * move the brk area out of the mmap region and into the unused -+ * ELF_ET_DYN_BASE region. Since "brk" grows up it may collide -+ * early with the stack growing down or other regions being put -+ * into the mmap region by the kernel (e.g. vdso). -+ * -+ * In the CONFIG_COMPAT_BRK case, though, everything is turned -+ * off because we're not allowed to move the brk at all. -+ */ -+ if (!IS_ENABLED(CONFIG_COMPAT_BRK) && -+ IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) && -+ elf_ex->e_type == ET_DYN && !interpreter) { -+ elf_brk = ELF_ET_DYN_BASE; -+ /* This counts as moving the brk, so let brk(2) know. */ -+ brk_moved = true; -+ } -+ mm->start_brk = mm->brk = ELF_PAGEALIGN(elf_brk); -+ -+ if ((current->flags & PF_RANDOMIZE) && snapshot_randomize_va_space > 1) { - /* -- * For architectures with ELF randomization, when executing -- * a loader directly (i.e. no interpreter listed in ELF -- * headers), move the brk area out of the mmap region -- * (since it grows up, and may collide early with the stack -- * growing down), and into the unused ELF_ET_DYN_BASE region. -+ * If we didn't move the brk to ELF_ET_DYN_BASE (above), -+ * leave a gap between .bss and brk. - */ -- if (IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) && -- elf_ex->e_type == ET_DYN && !interpreter) { -- mm->brk = mm->start_brk = ELF_ET_DYN_BASE; -- } -+ if (!brk_moved) -+ mm->brk = mm->start_brk = mm->brk + PAGE_SIZE; - - mm->brk = mm->start_brk = arch_randomize_brk(mm); -+ brk_moved = true; -+ } -+ - #ifdef compat_brk_randomized -+ if (brk_moved) - current->brk_randomized = 1; - #endif -- } - - if (current->personality & MMAP_PAGE_ZERO) { - /* Why this, you ask??? Well SVr4 maps page 0 as read-only, -diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c -index af03a1c6ba768c..ef77d420851040 100644 ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -164,6 +164,14 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, - ei = btrfs_item_ptr(leaf, path->slots[0], - struct btrfs_extent_item); - num_refs = btrfs_extent_refs(leaf, ei); -+ if (unlikely(num_refs == 0)) { -+ ret = -EUCLEAN; -+ btrfs_err(fs_info, -+ "unexpected zero reference count for extent item (%llu %u %llu)", -+ key.objectid, key.type, key.offset); -+ btrfs_abort_transaction(trans, ret); -+ goto out_free; -+ } - extent_flags = btrfs_extent_flags(leaf, ei); - } else { - ret = -EUCLEAN; -@@ -177,8 +185,6 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, - - goto out_free; - } -- -- BUG_ON(num_refs == 0); - } else { - num_refs = 0; - extent_flags = 0; -@@ -208,10 +214,19 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, - goto search_again; - } - spin_lock(&head->lock); -- if (head->extent_op && head->extent_op->update_flags) -+ if (head->extent_op && head->extent_op->update_flags) { - extent_flags |= head->extent_op->flags_to_set; -- else -- BUG_ON(num_refs == 0); -+ } else if (unlikely(num_refs == 0)) { -+ spin_unlock(&head->lock); -+ mutex_unlock(&head->mutex); -+ spin_unlock(&delayed_refs->lock); -+ ret = -EUCLEAN; -+ btrfs_err(fs_info, -+ "unexpected zero reference count for extent %llu (%s)", -+ bytenr, metadata ? "metadata" : "data"); -+ btrfs_abort_transaction(trans, ret); -+ goto out_free; -+ } - - num_refs += head->ref_mod; - spin_unlock(&head->lock); -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 4b12e45f575394..c140427e322ced 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -6880,10 +6880,18 @@ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl, - struct nfs4_unlockdata *p; - struct nfs4_state *state = lsp->ls_state; - struct inode *inode = state->inode; -+ struct nfs_lock_context *l_ctx; - - p = kzalloc(sizeof(*p), GFP_KERNEL); - if (p == NULL) - return NULL; -+ l_ctx = nfs_get_lock_context(ctx); -+ if (!IS_ERR(l_ctx)) { -+ p->l_ctx = l_ctx; -+ } else { -+ kfree(p); -+ return NULL; -+ } - p->arg.fh = NFS_FH(inode); - p->arg.fl = &p->fl; - p->arg.seqid = seqid; -@@ -6891,7 +6899,6 @@ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl, - p->lsp = lsp; - /* Ensure we don't close file until we're done freeing locks! */ - p->ctx = get_nfs_open_context(ctx); -- p->l_ctx = nfs_get_lock_context(ctx); - locks_init_lock(&p->fl); - locks_copy_lock(&p->fl, fl); - p->server = NFS_SERVER(inode); -diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c -index fe83c681e3fe03..73aa5a63afe3fb 100644 ---- a/fs/nfs/pnfs.c -+++ b/fs/nfs/pnfs.c -@@ -732,6 +732,14 @@ pnfs_mark_matching_lsegs_invalid(struct pnfs_layout_hdr *lo, - return remaining; - } - -+static void pnfs_reset_return_info(struct pnfs_layout_hdr *lo) -+{ -+ struct pnfs_layout_segment *lseg; -+ -+ list_for_each_entry(lseg, &lo->plh_return_segs, pls_list) -+ pnfs_set_plh_return_info(lo, lseg->pls_range.iomode, 0); -+} -+ - static void - pnfs_free_returned_lsegs(struct pnfs_layout_hdr *lo, - struct list_head *free_me, -@@ -1180,6 +1188,7 @@ void pnfs_layoutreturn_free_lsegs(struct pnfs_layout_hdr *lo, - pnfs_mark_matching_lsegs_invalid(lo, &freeme, range, seq); - pnfs_free_returned_lsegs(lo, &freeme, range, seq); - pnfs_set_layout_stateid(lo, stateid, NULL, true); -+ pnfs_reset_return_info(lo); - } else - pnfs_mark_layout_stateid_invalid(lo, &freeme); - out_unlock: -diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c -index 4536b6fcfa0256..3e88e8b3c16ec2 100644 ---- a/fs/smb/client/smb2pdu.c -+++ b/fs/smb/client/smb2pdu.c -@@ -2979,7 +2979,7 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, - /* Eventually save off posix specific response info and timestaps */ - - err_free_rsp_buf: -- free_rsp_buf(resp_buftype, rsp); -+ free_rsp_buf(resp_buftype, rsp_iov.iov_base); - kfree(pc_buf); - err_free_req: - cifs_small_buf_release(req); -diff --git a/fs/udf/truncate.c b/fs/udf/truncate.c -index 4f33a4a4888613..b4071c9cf8c951 100644 ---- a/fs/udf/truncate.c -+++ b/fs/udf/truncate.c -@@ -115,7 +115,7 @@ void udf_truncate_tail_extent(struct inode *inode) - } - /* This inode entry is in-memory only and thus we don't have to mark - * the inode dirty */ -- if (ret == 0) -+ if (ret >= 0) - iinfo->i_lenExtents = inode->i_size; - brelse(epos.bh); - } -diff --git a/fs/xattr.c b/fs/xattr.c -index c20046548f218e..5fed22c22a2be8 100644 ---- a/fs/xattr.c -+++ b/fs/xattr.c -@@ -1291,6 +1291,15 @@ static bool xattr_is_trusted(const char *name) - return !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN); - } - -+static bool xattr_is_maclabel(const char *name) -+{ -+ const char *suffix = name + XATTR_SECURITY_PREFIX_LEN; -+ -+ return !strncmp(name, XATTR_SECURITY_PREFIX, -+ XATTR_SECURITY_PREFIX_LEN) && -+ security_ismaclabel(suffix); -+} -+ - /** - * simple_xattr_list - list all xattr objects - * @inode: inode from which to get the xattrs -@@ -1323,6 +1332,17 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs, - if (err) - return err; - -+ err = security_inode_listsecurity(inode, buffer, remaining_size); -+ if (err < 0) -+ return err; -+ -+ if (buffer) { -+ if (remaining_size < err) -+ return -ERANGE; -+ buffer += err; -+ } -+ remaining_size -= err; -+ - read_lock(&xattrs->lock); - for (rbp = rb_first(&xattrs->rb_root); rbp; rbp = rb_next(rbp)) { - xattr = rb_entry(rbp, struct simple_xattr, rb_node); -@@ -1331,6 +1351,10 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs, - if (!trusted && xattr_is_trusted(xattr->name)) - continue; - -+ /* skip MAC labels; these are provided by LSM above */ -+ if (xattr_is_maclabel(xattr->name)) -+ continue; -+ - err = xattr_list_one(&buffer, &remaining_size, xattr->name); - if (err) - break; -diff --git a/include/linux/bio.h b/include/linux/bio.h -index 0286bada25ce72..b893418c3cc022 100644 ---- a/include/linux/bio.h -+++ b/include/linux/bio.h -@@ -11,6 +11,7 @@ - #include - - #define BIO_MAX_VECS 256U -+#define BIO_MAX_INLINE_VECS UIO_MAXIOV - - struct queue_limits; - -diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h -index 3e7fc905478984..b5bf5315ca8c10 100644 ---- a/include/linux/hyperv.h -+++ b/include/linux/hyperv.h -@@ -1224,13 +1224,6 @@ extern int vmbus_sendpacket(struct vmbus_channel *channel, - enum vmbus_packet_type type, - u32 flags); - --extern int vmbus_sendpacket_pagebuffer(struct vmbus_channel *channel, -- struct hv_page_buffer pagebuffers[], -- u32 pagecount, -- void *buffer, -- u32 bufferlen, -- u64 requestid); -- - extern int vmbus_sendpacket_mpb_desc(struct vmbus_channel *channel, - struct vmbus_packet_mpb_array *mpb, - u32 desc_size, -diff --git a/include/linux/tpm.h b/include/linux/tpm.h -index 5f4998626a9889..bf8a4ec8a01c1f 100644 ---- a/include/linux/tpm.h -+++ b/include/linux/tpm.h -@@ -181,7 +181,7 @@ enum tpm2_const { - - enum tpm2_timeouts { - TPM2_TIMEOUT_A = 750, -- TPM2_TIMEOUT_B = 2000, -+ TPM2_TIMEOUT_B = 4000, - TPM2_TIMEOUT_C = 200, - TPM2_TIMEOUT_D = 30, - TPM2_DURATION_SHORT = 20, -diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h -index 4ec2a948ae3dbb..3287988a6a9878 100644 ---- a/include/net/sch_generic.h -+++ b/include/net/sch_generic.h -@@ -1029,6 +1029,21 @@ static inline struct sk_buff *__qdisc_dequeue_head(struct qdisc_skb_head *qh) - return skb; - } - -+static inline struct sk_buff *qdisc_dequeue_internal(struct Qdisc *sch, bool direct) -+{ -+ struct sk_buff *skb; -+ -+ skb = __skb_dequeue(&sch->gso_skb); -+ if (skb) { -+ sch->q.qlen--; -+ return skb; -+ } -+ if (direct) -+ return __qdisc_dequeue_head(&sch->q); -+ else -+ return sch->dequeue(sch); -+} -+ - static inline struct sk_buff *qdisc_dequeue_head(struct Qdisc *sch) - { - struct sk_buff *skb = __qdisc_dequeue_head(&sch->q); -diff --git a/include/sound/ump_msg.h b/include/sound/ump_msg.h -index 72f60ddfea7535..9556b4755a1ed8 100644 ---- a/include/sound/ump_msg.h -+++ b/include/sound/ump_msg.h -@@ -604,7 +604,7 @@ struct snd_ump_stream_msg_ep_info { - } __packed; - - /* UMP Stream Message: Device Info Notification (128bit) */ --struct snd_ump_stream_msg_devince_info { -+struct snd_ump_stream_msg_device_info { - #ifdef __BIG_ENDIAN_BITFIELD - /* 0 */ - u32 type:4; -@@ -754,7 +754,7 @@ struct snd_ump_stream_msg_fb_name { - union snd_ump_stream_msg { - struct snd_ump_stream_msg_ep_discovery ep_discovery; - struct snd_ump_stream_msg_ep_info ep_info; -- struct snd_ump_stream_msg_devince_info device_info; -+ struct snd_ump_stream_msg_device_info device_info; - struct snd_ump_stream_msg_stream_cfg stream_cfg; - struct snd_ump_stream_msg_fb_discovery fb_discovery; - struct snd_ump_stream_msg_fb_info fb_info; -diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c -index 3646426c69e253..ad8b62202bdc46 100644 ---- a/kernel/cgroup/cpuset.c -+++ b/kernel/cgroup/cpuset.c -@@ -1229,9 +1229,11 @@ static void update_tasks_cpumask(struct cpuset *cs, struct cpumask *new_cpus) - - if (top_cs) { - /* -- * Percpu kthreads in top_cpuset are ignored -+ * PF_NO_SETAFFINITY tasks are ignored. -+ * All per cpu kthreads should have PF_NO_SETAFFINITY -+ * flag set, see kthread_set_per_cpu(). - */ -- if (kthread_is_per_cpu(task)) -+ if (task->flags & PF_NO_SETAFFINITY) - continue; - cpumask_andnot(new_cpus, possible_mask, cs->subparts_cpus); - } else { -diff --git a/kernel/trace/trace_dynevent.c b/kernel/trace/trace_dynevent.c -index 4376887e0d8aab..c9b0533407edeb 100644 ---- a/kernel/trace/trace_dynevent.c -+++ b/kernel/trace/trace_dynevent.c -@@ -16,7 +16,7 @@ - #include "trace_output.h" /* for trace_event_sem */ - #include "trace_dynevent.h" - --static DEFINE_MUTEX(dyn_event_ops_mutex); -+DEFINE_MUTEX(dyn_event_ops_mutex); - static LIST_HEAD(dyn_event_ops_list); - - bool trace_event_dyn_try_get_ref(struct trace_event_call *dyn_call) -@@ -125,6 +125,20 @@ int dyn_event_release(const char *raw_command, struct dyn_event_operations *type - return ret; - } - -+/* -+ * Locked version of event creation. The event creation must be protected by -+ * dyn_event_ops_mutex because of protecting trace_probe_log. -+ */ -+int dyn_event_create(const char *raw_command, struct dyn_event_operations *type) -+{ -+ int ret; -+ -+ mutex_lock(&dyn_event_ops_mutex); -+ ret = type->create(raw_command); -+ mutex_unlock(&dyn_event_ops_mutex); -+ return ret; -+} -+ - static int create_dyn_event(const char *raw_command) - { - struct dyn_event_operations *ops; -diff --git a/kernel/trace/trace_dynevent.h b/kernel/trace/trace_dynevent.h -index 936477a111d3e7..beee3f8d754444 100644 ---- a/kernel/trace/trace_dynevent.h -+++ b/kernel/trace/trace_dynevent.h -@@ -100,6 +100,7 @@ void *dyn_event_seq_next(struct seq_file *m, void *v, loff_t *pos); - void dyn_event_seq_stop(struct seq_file *m, void *v); - int dyn_events_release_all(struct dyn_event_operations *type); - int dyn_event_release(const char *raw_command, struct dyn_event_operations *type); -+int dyn_event_create(const char *raw_command, struct dyn_event_operations *type); - - /* - * for_each_dyn_event - iterate over the dyn_event list -diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c -index 76abc9a45f971a..2c233c0d38fa95 100644 ---- a/kernel/trace/trace_events_trigger.c -+++ b/kernel/trace/trace_events_trigger.c -@@ -1554,7 +1554,7 @@ stacktrace_trigger(struct event_trigger_data *data, - struct trace_event_file *file = data->private_data; - - if (file) -- __trace_stack(file->tr, tracing_gen_ctx(), STACK_SKIP); -+ __trace_stack(file->tr, tracing_gen_ctx_dec(), STACK_SKIP); - else - trace_dump_stack(STACK_SKIP); - } -diff --git a/kernel/trace/trace_functions.c b/kernel/trace/trace_functions.c -index 69e92c7359fb9a..44ae51d1dc45d8 100644 ---- a/kernel/trace/trace_functions.c -+++ b/kernel/trace/trace_functions.c -@@ -561,11 +561,7 @@ ftrace_traceoff(unsigned long ip, unsigned long parent_ip, - - static __always_inline void trace_stack(struct trace_array *tr) - { -- unsigned int trace_ctx; -- -- trace_ctx = tracing_gen_ctx(); -- -- __trace_stack(tr, trace_ctx, FTRACE_STACK_SKIP); -+ __trace_stack(tr, tracing_gen_ctx_dec(), FTRACE_STACK_SKIP); - } - - static void -diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c -index 508c10414a9343..46491f3c1569cd 100644 ---- a/kernel/trace/trace_kprobe.c -+++ b/kernel/trace/trace_kprobe.c -@@ -1004,7 +1004,7 @@ static int create_or_delete_trace_kprobe(const char *raw_command) - if (raw_command[0] == '-') - return dyn_event_release(raw_command, &trace_kprobe_ops); - -- ret = trace_kprobe_create(raw_command); -+ ret = dyn_event_create(raw_command, &trace_kprobe_ops); - return ret == -ECANCELED ? -EINVAL : ret; - } - -diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c -index 606190239c8776..694f32d843d90c 100644 ---- a/kernel/trace/trace_probe.c -+++ b/kernel/trace/trace_probe.c -@@ -153,9 +153,12 @@ static const struct fetch_type *find_fetch_type(const char *type, unsigned long - } - - static struct trace_probe_log trace_probe_log; -+extern struct mutex dyn_event_ops_mutex; - - void trace_probe_log_init(const char *subsystem, int argc, const char **argv) - { -+ lockdep_assert_held(&dyn_event_ops_mutex); -+ - trace_probe_log.subsystem = subsystem; - trace_probe_log.argc = argc; - trace_probe_log.argv = argv; -@@ -164,11 +167,15 @@ void trace_probe_log_init(const char *subsystem, int argc, const char **argv) - - void trace_probe_log_clear(void) - { -+ lockdep_assert_held(&dyn_event_ops_mutex); -+ - memset(&trace_probe_log, 0, sizeof(trace_probe_log)); - } - - void trace_probe_log_set_index(int index) - { -+ lockdep_assert_held(&dyn_event_ops_mutex); -+ - trace_probe_log.index = index; - } - -@@ -177,6 +184,8 @@ void __trace_probe_log_err(int offset, int err_type) - char *command, *p; - int i, len = 0, pos = 0; - -+ lockdep_assert_held(&dyn_event_ops_mutex); -+ - if (!trace_probe_log.argv) - return; - -diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c -index 79f8da7e3cd492..ecf04e81ddf705 100644 ---- a/kernel/trace/trace_uprobe.c -+++ b/kernel/trace/trace_uprobe.c -@@ -730,7 +730,7 @@ static int create_or_delete_trace_uprobe(const char *raw_command) - if (raw_command[0] == '-') - return dyn_event_release(raw_command, &trace_uprobe_ops); - -- ret = trace_uprobe_create(raw_command); -+ ret = dyn_event_create(raw_command, &trace_uprobe_ops); - return ret == -ECANCELED ? -EINVAL : ret; - } - -diff --git a/mm/memblock.c b/mm/memblock.c -index 047dce35cf6e0e..0695284232f3c6 100644 ---- a/mm/memblock.c -+++ b/mm/memblock.c -@@ -460,7 +460,14 @@ static int __init_memblock memblock_double_array(struct memblock_type *type, - min(new_area_start, memblock.current_limit), - new_alloc_size, PAGE_SIZE); - -- new_array = addr ? __va(addr) : NULL; -+ if (addr) { -+ /* The memory may not have been accepted, yet. */ -+ accept_memory(addr, addr + new_alloc_size); -+ -+ new_array = __va(addr); -+ } else { -+ new_array = NULL; -+ } - } - if (!addr) { - pr_err("memblock: Failed to double %s array from %ld to %ld entries !\n", -diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c -index 9beed7c71a8e91..aab16690545207 100644 ---- a/mm/memory_hotplug.c -+++ b/mm/memory_hotplug.c -@@ -1735,8 +1735,12 @@ static void do_migrate_range(unsigned long start_pfn, unsigned long end_pfn) - if (PageHWPoison(page)) { - if (WARN_ON(folio_test_lru(folio))) - folio_isolate_lru(folio); -- if (folio_mapped(folio)) -+ if (folio_mapped(folio)) { -+ folio_lock(folio); - try_to_unmap(folio, TTU_IGNORE_MLOCK); -+ folio_unlock(folio); -+ } -+ - continue; - } - -diff --git a/mm/migrate.c b/mm/migrate.c -index 1004b1def1c201..4ed47088521746 100644 ---- a/mm/migrate.c -+++ b/mm/migrate.c -@@ -1504,6 +1504,7 @@ struct migrate_pages_stats { - int nr_thp_succeeded; /* THP migrated successfully */ - int nr_thp_failed; /* THP failed to be migrated */ - int nr_thp_split; /* THP split before migrating */ -+ int nr_split; /* Large folio (include THP) split before migrating */ - }; - - /* -@@ -1623,6 +1624,7 @@ static int migrate_pages_batch(struct list_head *from, - int nr_retry_pages = 0; - int pass = 0; - bool is_thp = false; -+ bool is_large = false; - struct folio *folio, *folio2, *dst = NULL, *dst2; - int rc, rc_saved = 0, nr_pages; - LIST_HEAD(unmap_folios); -@@ -1638,7 +1640,8 @@ static int migrate_pages_batch(struct list_head *from, - nr_retry_pages = 0; - - list_for_each_entry_safe(folio, folio2, from, lru) { -- is_thp = folio_test_large(folio) && folio_test_pmd_mappable(folio); -+ is_large = folio_test_large(folio); -+ is_thp = is_large && folio_test_pmd_mappable(folio); - nr_pages = folio_nr_pages(folio); - - cond_resched(); -@@ -1658,6 +1661,7 @@ static int migrate_pages_batch(struct list_head *from, - stats->nr_thp_failed++; - if (!try_split_folio(folio, split_folios)) { - stats->nr_thp_split++; -+ stats->nr_split++; - continue; - } - stats->nr_failed_pages += nr_pages; -@@ -1686,11 +1690,12 @@ static int migrate_pages_batch(struct list_head *from, - nr_failed++; - stats->nr_thp_failed += is_thp; - /* Large folio NUMA faulting doesn't split to retry. */ -- if (folio_test_large(folio) && !nosplit) { -+ if (is_large && !nosplit) { - int ret = try_split_folio(folio, split_folios); - - if (!ret) { - stats->nr_thp_split += is_thp; -+ stats->nr_split += is_large; - break; - } else if (reason == MR_LONGTERM_PIN && - ret == -EAGAIN) { -@@ -1836,6 +1841,7 @@ static int migrate_pages_sync(struct list_head *from, new_folio_t get_new_folio, - stats->nr_succeeded += astats.nr_succeeded; - stats->nr_thp_succeeded += astats.nr_thp_succeeded; - stats->nr_thp_split += astats.nr_thp_split; -+ stats->nr_split += astats.nr_split; - if (rc < 0) { - stats->nr_failed_pages += astats.nr_failed_pages; - stats->nr_thp_failed += astats.nr_thp_failed; -@@ -1843,7 +1849,11 @@ static int migrate_pages_sync(struct list_head *from, new_folio_t get_new_folio, - return rc; - } - stats->nr_thp_failed += astats.nr_thp_split; -- nr_failed += astats.nr_thp_split; -+ /* -+ * Do not count rc, as pages will be retried below. -+ * Count nr_split only, since it includes nr_thp_split. -+ */ -+ nr_failed += astats.nr_split; - /* - * Fall back to migrate all failed folios one by one synchronously. All - * failed folios except split THPs will be retried, so their failure -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index bc62bb2a3b132e..74737c35082b45 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -303,7 +303,6 @@ EXPORT_SYMBOL(nr_online_nodes); - static bool page_contains_unaccepted(struct page *page, unsigned int order); - static void accept_page(struct page *page, unsigned int order); - static bool cond_accept_memory(struct zone *zone, unsigned int order); --static inline bool has_unaccepted_memory(void); - static bool __free_unaccepted(struct page *page); - - int page_group_by_mobility_disabled __read_mostly; -@@ -6586,9 +6585,6 @@ bool has_managed_dma(void) - - #ifdef CONFIG_UNACCEPTED_MEMORY - --/* Counts number of zones with unaccepted pages. */ --static DEFINE_STATIC_KEY_FALSE(zones_with_unaccepted_pages); -- - static bool lazy_accept = true; - - static int __init accept_memory_parse(char *p) -@@ -6624,7 +6620,6 @@ static bool try_to_accept_memory_one(struct zone *zone) - { - unsigned long flags; - struct page *page; -- bool last; - - spin_lock_irqsave(&zone->lock, flags); - page = list_first_entry_or_null(&zone->unaccepted_pages, -@@ -6635,7 +6630,6 @@ static bool try_to_accept_memory_one(struct zone *zone) - } - - list_del(&page->lru); -- last = list_empty(&zone->unaccepted_pages); - - __mod_zone_freepage_state(zone, -MAX_ORDER_NR_PAGES, MIGRATE_MOVABLE); - __mod_zone_page_state(zone, NR_UNACCEPTED, -MAX_ORDER_NR_PAGES); -@@ -6645,9 +6639,6 @@ static bool try_to_accept_memory_one(struct zone *zone) - - __free_pages_ok(page, MAX_ORDER, FPI_TO_TAIL); - -- if (last) -- static_branch_dec(&zones_with_unaccepted_pages); -- - return true; - } - -@@ -6656,9 +6647,6 @@ static bool cond_accept_memory(struct zone *zone, unsigned int order) - long to_accept, wmark; - bool ret = false; - -- if (!has_unaccepted_memory()) -- return false; -- - if (list_empty(&zone->unaccepted_pages)) - return false; - -@@ -6688,30 +6676,20 @@ static bool cond_accept_memory(struct zone *zone, unsigned int order) - return ret; - } - --static inline bool has_unaccepted_memory(void) --{ -- return static_branch_unlikely(&zones_with_unaccepted_pages); --} -- - static bool __free_unaccepted(struct page *page) - { - struct zone *zone = page_zone(page); - unsigned long flags; -- bool first = false; - - if (!lazy_accept) - return false; - - spin_lock_irqsave(&zone->lock, flags); -- first = list_empty(&zone->unaccepted_pages); - list_add_tail(&page->lru, &zone->unaccepted_pages); - __mod_zone_freepage_state(zone, MAX_ORDER_NR_PAGES, MIGRATE_MOVABLE); - __mod_zone_page_state(zone, NR_UNACCEPTED, MAX_ORDER_NR_PAGES); - spin_unlock_irqrestore(&zone->lock, flags); - -- if (first) -- static_branch_inc(&zones_with_unaccepted_pages); -- - return true; - } - -@@ -6731,11 +6709,6 @@ static bool cond_accept_memory(struct zone *zone, unsigned int order) - return false; - } - --static inline bool has_unaccepted_memory(void) --{ -- return false; --} -- - static bool __free_unaccepted(struct page *page) - { - BUILD_BUG(); -diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c -index 29e420e9754bb3..589c3a481e4c10 100644 ---- a/net/bluetooth/mgmt.c -+++ b/net/bluetooth/mgmt.c -@@ -7605,11 +7605,16 @@ static void add_device_complete(struct hci_dev *hdev, void *data, int err) - struct mgmt_cp_add_device *cp = cmd->param; - - if (!err) { -+ struct hci_conn_params *params; -+ -+ params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, -+ le_addr_type(cp->addr.type)); -+ - device_added(cmd->sk, hdev, &cp->addr.bdaddr, cp->addr.type, - cp->action); - device_flags_changed(NULL, hdev, &cp->addr.bdaddr, - cp->addr.type, hdev->conn_flags, -- PTR_UINT(cmd->user_data)); -+ params ? params->flags : 0); - } - - mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_ADD_DEVICE, -@@ -7712,8 +7717,6 @@ static int add_device(struct sock *sk, struct hci_dev *hdev, - goto unlock; - } - -- cmd->user_data = UINT_PTR(current_flags); -- - err = hci_cmd_sync_queue(hdev, add_device_sync, cmd, - add_device_complete); - if (err < 0) { -diff --git a/net/mac80211/main.c b/net/mac80211/main.c -index d1046f495e63ff..3a6fff98748b86 100644 ---- a/net/mac80211/main.c -+++ b/net/mac80211/main.c -@@ -1186,10 +1186,12 @@ int ieee80211_register_hw(struct ieee80211_hw *hw) - return -EINVAL; - } - -- local->int_scan_req = kzalloc(sizeof(*local->int_scan_req) + -- sizeof(void *) * channels, GFP_KERNEL); -+ local->int_scan_req = kzalloc(struct_size(local->int_scan_req, -+ channels, channels), -+ GFP_KERNEL); - if (!local->int_scan_req) - return -ENOMEM; -+ local->int_scan_req->n_channels = channels; - - eth_broadcast_addr(local->int_scan_req->bssid); - -diff --git a/net/mctp/device.c b/net/mctp/device.c -index 85cc5f31f1e7c0..8d1386601bbe06 100644 ---- a/net/mctp/device.c -+++ b/net/mctp/device.c -@@ -20,8 +20,7 @@ - #include - - struct mctp_dump_cb { -- int h; -- int idx; -+ unsigned long ifindex; - size_t a_idx; - }; - -@@ -115,43 +114,36 @@ static int mctp_dump_addrinfo(struct sk_buff *skb, struct netlink_callback *cb) - { - struct mctp_dump_cb *mcb = (void *)cb->ctx; - struct net *net = sock_net(skb->sk); -- struct hlist_head *head; - struct net_device *dev; - struct ifaddrmsg *hdr; - struct mctp_dev *mdev; -- int ifindex; -- int idx = 0, rc; -- -- hdr = nlmsg_data(cb->nlh); -- // filter by ifindex if requested -- ifindex = hdr->ifa_index; -+ int ifindex = 0, rc; -+ -+ /* Filter by ifindex if a header is provided */ -+ if (cb->nlh->nlmsg_len >= nlmsg_msg_size(sizeof(*hdr))) { -+ hdr = nlmsg_data(cb->nlh); -+ ifindex = hdr->ifa_index; -+ } else { -+ if (cb->strict_check) { -+ NL_SET_ERR_MSG(cb->extack, "mctp: Invalid header for addr dump request"); -+ return -EINVAL; -+ } -+ } - - rcu_read_lock(); -- for (; mcb->h < NETDEV_HASHENTRIES; mcb->h++, mcb->idx = 0) { -- idx = 0; -- head = &net->dev_index_head[mcb->h]; -- hlist_for_each_entry_rcu(dev, head, index_hlist) { -- if (idx >= mcb->idx && -- (ifindex == 0 || ifindex == dev->ifindex)) { -- mdev = __mctp_dev_get(dev); -- if (mdev) { -- rc = mctp_dump_dev_addrinfo(mdev, -- skb, cb); -- mctp_dev_put(mdev); -- // Error indicates full buffer, this -- // callback will get retried. -- if (rc < 0) -- goto out; -- } -- } -- idx++; -- // reset for next iteration -- mcb->a_idx = 0; -- } -+ for_each_netdev_dump(net, dev, mcb->ifindex) { -+ if (ifindex && ifindex != dev->ifindex) -+ continue; -+ mdev = __mctp_dev_get(dev); -+ if (!mdev) -+ continue; -+ rc = mctp_dump_dev_addrinfo(mdev, skb, cb); -+ mctp_dev_put(mdev); -+ if (rc < 0) -+ break; -+ mcb->a_idx = 0; - } --out: - rcu_read_unlock(); -- mcb->idx = idx; - - return skb->len; - } -@@ -525,9 +517,12 @@ static struct notifier_block mctp_dev_nb = { - }; - - static const struct rtnl_msg_handler mctp_device_rtnl_msg_handlers[] = { -- {THIS_MODULE, PF_MCTP, RTM_NEWADDR, mctp_rtm_newaddr, NULL, 0}, -- {THIS_MODULE, PF_MCTP, RTM_DELADDR, mctp_rtm_deladdr, NULL, 0}, -- {THIS_MODULE, PF_MCTP, RTM_GETADDR, NULL, mctp_dump_addrinfo, 0}, -+ {.owner = THIS_MODULE, .protocol = PF_MCTP, .msgtype = RTM_NEWADDR, -+ .doit = mctp_rtm_newaddr}, -+ {.owner = THIS_MODULE, .protocol = PF_MCTP, .msgtype = RTM_DELADDR, -+ .doit = mctp_rtm_deladdr}, -+ {.owner = THIS_MODULE, .protocol = PF_MCTP, .msgtype = RTM_GETADDR, -+ .dumpit = mctp_dump_addrinfo}, - }; - - int __init mctp_device_init(void) -diff --git a/net/mctp/route.c b/net/mctp/route.c -index d3c1f54386efc1..009ba5edbd5254 100644 ---- a/net/mctp/route.c -+++ b/net/mctp/route.c -@@ -274,8 +274,10 @@ static void mctp_flow_prepare_output(struct sk_buff *skb, struct mctp_dev *dev) - - key = flow->key; - -- if (WARN_ON(key->dev && key->dev != dev)) -+ if (key->dev) { -+ WARN_ON(key->dev != dev); - return; -+ } - - mctp_dev_set_key(dev, key); - } -diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c -index 5f2e0681574567..63c02040b426ae 100644 ---- a/net/sched/sch_codel.c -+++ b/net/sched/sch_codel.c -@@ -168,7 +168,7 @@ static int codel_change(struct Qdisc *sch, struct nlattr *opt, - - qlen = sch->q.qlen; - while (sch->q.qlen > sch->limit) { -- struct sk_buff *skb = __qdisc_dequeue_head(&sch->q); -+ struct sk_buff *skb = qdisc_dequeue_internal(sch, true); - - dropped += qdisc_pkt_len(skb); - qdisc_qstats_backlog_dec(sch, skb); -diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c -index f59a2cb2c803d7..91f5ef6be0f231 100644 ---- a/net/sched/sch_fq.c -+++ b/net/sched/sch_fq.c -@@ -901,7 +901,7 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt, - sch_tree_lock(sch); - } - while (sch->q.qlen > sch->limit) { -- struct sk_buff *skb = fq_dequeue(sch); -+ struct sk_buff *skb = qdisc_dequeue_internal(sch, false); - - if (!skb) - break; -diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c -index 9330923a624c02..47b5a056165cb0 100644 ---- a/net/sched/sch_fq_codel.c -+++ b/net/sched/sch_fq_codel.c -@@ -431,7 +431,7 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt, - - while (sch->q.qlen > sch->limit || - q->memory_usage > q->memory_limit) { -- struct sk_buff *skb = fq_codel_dequeue(sch); -+ struct sk_buff *skb = qdisc_dequeue_internal(sch, false); - - q->cstats.drop_len += qdisc_pkt_len(skb); - rtnl_kfree_skbs(skb, skb); -diff --git a/net/sched/sch_fq_pie.c b/net/sched/sch_fq_pie.c -index 68e6acd0f130d9..607c580d75e4b6 100644 ---- a/net/sched/sch_fq_pie.c -+++ b/net/sched/sch_fq_pie.c -@@ -357,7 +357,7 @@ static int fq_pie_change(struct Qdisc *sch, struct nlattr *opt, - - /* Drop excess packets if new limit is lower */ - while (sch->q.qlen > sch->limit) { -- struct sk_buff *skb = fq_pie_qdisc_dequeue(sch); -+ struct sk_buff *skb = qdisc_dequeue_internal(sch, false); - - len_dropped += qdisc_pkt_len(skb); - num_dropped += 1; -diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c -index d26cd436cbe31b..83fc44f20e31cb 100644 ---- a/net/sched/sch_hhf.c -+++ b/net/sched/sch_hhf.c -@@ -560,7 +560,7 @@ static int hhf_change(struct Qdisc *sch, struct nlattr *opt, - qlen = sch->q.qlen; - prev_backlog = sch->qstats.backlog; - while (sch->q.qlen > sch->limit) { -- struct sk_buff *skb = hhf_dequeue(sch); -+ struct sk_buff *skb = qdisc_dequeue_internal(sch, false); - - rtnl_kfree_skbs(skb, skb); - } -diff --git a/net/sched/sch_pie.c b/net/sched/sch_pie.c -index 2da6250ec34636..48c5ab8ec143c1 100644 ---- a/net/sched/sch_pie.c -+++ b/net/sched/sch_pie.c -@@ -190,7 +190,7 @@ static int pie_change(struct Qdisc *sch, struct nlattr *opt, - /* Drop excess packets if new limit is lower */ - qlen = sch->q.qlen; - while (sch->q.qlen > sch->limit) { -- struct sk_buff *skb = __qdisc_dequeue_head(&sch->q); -+ struct sk_buff *skb = qdisc_dequeue_internal(sch, true); - - dropped += qdisc_pkt_len(skb); - qdisc_qstats_backlog_dec(sch, skb); -diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c -index fd73be940f4607..77a76634014a5a 100644 ---- a/net/sctp/sysctl.c -+++ b/net/sctp/sysctl.c -@@ -529,6 +529,8 @@ static int proc_sctp_do_auth(struct ctl_table *ctl, int write, - return ret; - } - -+static DEFINE_MUTEX(sctp_sysctl_mutex); -+ - static int proc_sctp_do_udp_port(struct ctl_table *ctl, int write, - void *buffer, size_t *lenp, loff_t *ppos) - { -@@ -553,6 +555,7 @@ static int proc_sctp_do_udp_port(struct ctl_table *ctl, int write, - if (new_value > max || new_value < min) - return -EINVAL; - -+ mutex_lock(&sctp_sysctl_mutex); - net->sctp.udp_port = new_value; - sctp_udp_sock_stop(net); - if (new_value) { -@@ -565,6 +568,7 @@ static int proc_sctp_do_udp_port(struct ctl_table *ctl, int write, - lock_sock(sk); - sctp_sk(sk)->udp_port = htons(net->sctp.udp_port); - release_sock(sk); -+ mutex_unlock(&sctp_sysctl_mutex); - } - - return ret; -diff --git a/net/tls/tls_strp.c b/net/tls/tls_strp.c -index 5df08d848b5c9c..1852fac3e72b76 100644 ---- a/net/tls/tls_strp.c -+++ b/net/tls/tls_strp.c -@@ -395,7 +395,6 @@ static int tls_strp_read_copy(struct tls_strparser *strp, bool qshort) - return 0; - - shinfo = skb_shinfo(strp->anchor); -- shinfo->frag_list = NULL; - - /* If we don't know the length go max plus page for cipher overhead */ - need_spc = strp->stm.full_len ?: TLS_MAX_PAYLOAD_SIZE + PAGE_SIZE; -@@ -411,6 +410,8 @@ static int tls_strp_read_copy(struct tls_strparser *strp, bool qshort) - page, 0, 0); - } - -+ shinfo->frag_list = NULL; -+ - strp->copy_mode = 1; - strp->stm.offset = 0; - -diff --git a/samples/ftrace/sample-trace-array.c b/samples/ftrace/sample-trace-array.c -index d0ee9001c7b376..aaa8fa92e24d52 100644 ---- a/samples/ftrace/sample-trace-array.c -+++ b/samples/ftrace/sample-trace-array.c -@@ -112,7 +112,7 @@ static int __init sample_trace_array_init(void) - /* - * If context specific per-cpu buffers havent already been allocated. - */ -- trace_printk_init_buffers(); -+ trace_array_init_printk(tr); - - simple_tsk = kthread_run(simple_thread, NULL, "sample-instance"); - if (IS_ERR(simple_tsk)) { -diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c -index 6195fe9dda1799..49f6763c3250dd 100644 ---- a/sound/core/seq/seq_clientmgr.c -+++ b/sound/core/seq/seq_clientmgr.c -@@ -736,15 +736,21 @@ static int snd_seq_deliver_single_event(struct snd_seq_client *client, - */ - static int __deliver_to_subscribers(struct snd_seq_client *client, - struct snd_seq_event *event, -- struct snd_seq_client_port *src_port, -- int atomic, int hop) -+ int port, int atomic, int hop) - { -+ struct snd_seq_client_port *src_port; - struct snd_seq_subscribers *subs; - int err, result = 0, num_ev = 0; - union __snd_seq_event event_saved; - size_t saved_size; - struct snd_seq_port_subs_info *grp; - -+ if (port < 0) -+ return 0; -+ src_port = snd_seq_port_use_ptr(client, port); -+ if (!src_port) -+ return 0; -+ - /* save original event record */ - saved_size = snd_seq_event_packet_size(event); - memcpy(&event_saved, event, saved_size); -@@ -780,6 +786,7 @@ static int __deliver_to_subscribers(struct snd_seq_client *client, - read_unlock(&grp->list_lock); - else - up_read(&grp->list_mutex); -+ snd_seq_port_unlock(src_port); - memcpy(event, &event_saved, saved_size); - return (result < 0) ? result : num_ev; - } -@@ -788,25 +795,32 @@ static int deliver_to_subscribers(struct snd_seq_client *client, - struct snd_seq_event *event, - int atomic, int hop) - { -- struct snd_seq_client_port *src_port; -- int ret = 0, ret2; -- -- src_port = snd_seq_port_use_ptr(client, event->source.port); -- if (src_port) { -- ret = __deliver_to_subscribers(client, event, src_port, atomic, hop); -- snd_seq_port_unlock(src_port); -- } -- -- if (client->ump_endpoint_port < 0 || -- event->source.port == client->ump_endpoint_port) -- return ret; -+ int ret; -+#if IS_ENABLED(CONFIG_SND_SEQ_UMP) -+ int ret2; -+#endif - -- src_port = snd_seq_port_use_ptr(client, client->ump_endpoint_port); -- if (!src_port) -+ ret = __deliver_to_subscribers(client, event, -+ event->source.port, atomic, hop); -+#if IS_ENABLED(CONFIG_SND_SEQ_UMP) -+ if (!snd_seq_client_is_ump(client) || client->ump_endpoint_port < 0) - return ret; -- ret2 = __deliver_to_subscribers(client, event, src_port, atomic, hop); -- snd_seq_port_unlock(src_port); -- return ret2 < 0 ? ret2 : ret; -+ /* If it's an event from EP port (and with a UMP group), -+ * deliver to subscribers of the corresponding UMP group port, too. -+ * Or, if it's from non-EP port, deliver to subscribers of EP port, too. -+ */ -+ if (event->source.port == client->ump_endpoint_port) -+ ret2 = __deliver_to_subscribers(client, event, -+ snd_seq_ump_group_port(event), -+ atomic, hop); -+ else -+ ret2 = __deliver_to_subscribers(client, event, -+ client->ump_endpoint_port, -+ atomic, hop); -+ if (ret2 < 0) -+ return ret2; -+#endif -+ return ret; - } - - /* deliver an event to the destination port(s). -diff --git a/sound/core/seq/seq_ump_convert.c b/sound/core/seq/seq_ump_convert.c -index 4dd540cbb1cbbc..83a27362b7a066 100644 ---- a/sound/core/seq/seq_ump_convert.c -+++ b/sound/core/seq/seq_ump_convert.c -@@ -1284,3 +1284,21 @@ int snd_seq_deliver_to_ump(struct snd_seq_client *source, - else - return cvt_to_ump_midi1(dest, dest_port, event, atomic, hop); - } -+ -+/* return the UMP group-port number of the event; -+ * return -1 if groupless or non-UMP event -+ */ -+int snd_seq_ump_group_port(const struct snd_seq_event *event) -+{ -+ const struct snd_seq_ump_event *ump_ev = -+ (const struct snd_seq_ump_event *)event; -+ unsigned char type; -+ -+ if (!snd_seq_ev_is_ump(event)) -+ return -1; -+ type = ump_message_type(ump_ev->ump[0]); -+ if (ump_is_groupless_msg(type)) -+ return -1; -+ /* group-port number starts from 1 */ -+ return ump_message_group(ump_ev->ump[0]) + 1; -+} -diff --git a/sound/core/seq/seq_ump_convert.h b/sound/core/seq/seq_ump_convert.h -index 6c146d8032804f..4abf0a7637d701 100644 ---- a/sound/core/seq/seq_ump_convert.h -+++ b/sound/core/seq/seq_ump_convert.h -@@ -18,5 +18,6 @@ int snd_seq_deliver_to_ump(struct snd_seq_client *source, - struct snd_seq_client_port *dest_port, - struct snd_seq_event *event, - int atomic, int hop); -+int snd_seq_ump_group_port(const struct snd_seq_event *event); - - #endif /* __SEQ_UMP_CONVERT_H */ -diff --git a/sound/pci/es1968.c b/sound/pci/es1968.c -index 4bc0f53c223b79..bc9203da35fb6f 100644 ---- a/sound/pci/es1968.c -+++ b/sound/pci/es1968.c -@@ -1569,7 +1569,7 @@ static int snd_es1968_capture_open(struct snd_pcm_substream *substream) - struct snd_pcm_runtime *runtime = substream->runtime; - struct es1968 *chip = snd_pcm_substream_chip(substream); - struct esschan *es; -- int apu1, apu2; -+ int err, apu1, apu2; - - apu1 = snd_es1968_alloc_apu_pair(chip, ESM_APU_PCM_CAPTURE); - if (apu1 < 0) -@@ -1613,7 +1613,9 @@ static int snd_es1968_capture_open(struct snd_pcm_substream *substream) - runtime->hw = snd_es1968_capture; - runtime->hw.buffer_bytes_max = runtime->hw.period_bytes_max = - calc_available_memory_size(chip) - 1024; /* keep MIXBUF size */ -- snd_pcm_hw_constraint_pow2(runtime, 0, SNDRV_PCM_HW_PARAM_BUFFER_BYTES); -+ err = snd_pcm_hw_constraint_pow2(runtime, 0, SNDRV_PCM_HW_PARAM_BUFFER_BYTES); -+ if (err < 0) -+ return err; - - spin_lock_irq(&chip->substream_lock); - list_add(&es->list, &chip->substream_list); -diff --git a/sound/sh/Kconfig b/sound/sh/Kconfig -index b75fbb3236a7b9..f5fa09d740b4c9 100644 ---- a/sound/sh/Kconfig -+++ b/sound/sh/Kconfig -@@ -14,7 +14,7 @@ if SND_SUPERH - - config SND_AICA - tristate "Dreamcast Yamaha AICA sound" -- depends on SH_DREAMCAST -+ depends on SH_DREAMCAST && SH_DMA_API - select SND_PCM - select G2_DMA - help -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index d9d4c5922a50bb..0b8b20550ab381 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -2140,6 +2140,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { - QUIRK_FLAG_CTL_MSG_DELAY_1M), - DEVICE_FLG(0x0c45, 0x6340, /* Sonix HD USB Camera */ - QUIRK_FLAG_GET_SAMPLE_RATE), -+ DEVICE_FLG(0x0c45, 0x636b, /* Microdia JP001 USB Camera */ -+ QUIRK_FLAG_GET_SAMPLE_RATE), - DEVICE_FLG(0x0d8c, 0x0014, /* USB Audio Device */ - QUIRK_FLAG_CTL_MSG_DELAY_1M), - DEVICE_FLG(0x0ecb, 0x205c, /* JBL Quantum610 Wireless */ -@@ -2148,6 +2150,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { - QUIRK_FLAG_FIXED_RATE), - DEVICE_FLG(0x0fd9, 0x0008, /* Hauppauge HVR-950Q */ - QUIRK_FLAG_SHARE_MEDIA_DEVICE | QUIRK_FLAG_ALIGN_TRANSFER), -+ DEVICE_FLG(0x1101, 0x0003, /* Audioengine D1 */ -+ QUIRK_FLAG_GET_SAMPLE_RATE), - DEVICE_FLG(0x1224, 0x2a25, /* Jieli Technology USB PHY 2.0 */ - QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16), - DEVICE_FLG(0x1395, 0x740a, /* Sennheiser DECT */ -diff --git a/tools/net/ynl/ethtool.py b/tools/net/ynl/ethtool.py -index 6c9f7e31250cdb..ffd8eb6d190483 100755 ---- a/tools/net/ynl/ethtool.py -+++ b/tools/net/ynl/ethtool.py -@@ -320,20 +320,37 @@ def main(): - return - - if args.show_time_stamping: -- tsinfo = dumpit(ynl, args, 'tsinfo-get') -+ req = { -+ 'header': { -+ 'flags': 'stats', -+ }, -+ } -+ -+ tsinfo = dumpit(ynl, args, 'tsinfo-get', req) - - print(f'Time stamping parameters for {args.device}:') - - print('Capabilities:') - [print(f'\t{v}') for v in bits_to_dict(tsinfo['timestamping'])] - -- print(f'PTP Hardware Clock: {tsinfo["phc-index"]}') -+ print(f'PTP Hardware Clock: {tsinfo.get("phc-index", "none")}') -+ -+ if 'tx-types' in tsinfo: -+ print('Hardware Transmit Timestamp Modes:') -+ [print(f'\t{v}') for v in bits_to_dict(tsinfo['tx-types'])] -+ else: -+ print('Hardware Transmit Timestamp Modes: none') -+ -+ if 'rx-filters' in tsinfo: -+ print('Hardware Receive Filter Modes:') -+ [print(f'\t{v}') for v in bits_to_dict(tsinfo['rx-filters'])] -+ else: -+ print('Hardware Receive Filter Modes: none') - -- print('Hardware Transmit Timestamp Modes:') -- [print(f'\t{v}') for v in bits_to_dict(tsinfo['tx-types'])] -+ if 'stats' in tsinfo and tsinfo['stats']: -+ print('Statistics:') -+ [print(f'\t{k}: {v}') for k, v in tsinfo['stats'].items()] - -- print('Hardware Receive Filter Modes:') -- [print(f'\t{v}') for v in bits_to_dict(tsinfo['rx-filters'])] - return - - print(f'Settings for {args.device}:') -diff --git a/tools/testing/selftests/exec/Makefile b/tools/testing/selftests/exec/Makefile -index a0b8688b083694..a705493c04bb73 100644 ---- a/tools/testing/selftests/exec/Makefile -+++ b/tools/testing/selftests/exec/Makefile -@@ -3,8 +3,13 @@ CFLAGS = -Wall - CFLAGS += -Wno-nonnull - CFLAGS += -D_GNU_SOURCE - -+ALIGNS := 0x1000 0x200000 0x1000000 -+ALIGN_PIES := $(patsubst %,load_address.%,$(ALIGNS)) -+ALIGN_STATIC_PIES := $(patsubst %,load_address.static.%,$(ALIGNS)) -+ALIGNMENT_TESTS := $(ALIGN_PIES) $(ALIGN_STATIC_PIES) -+ - TEST_PROGS := binfmt_script.py --TEST_GEN_PROGS := execveat load_address_4096 load_address_2097152 load_address_16777216 non-regular -+TEST_GEN_PROGS := execveat non-regular $(ALIGNMENT_TESTS) - TEST_GEN_FILES := execveat.symlink execveat.denatured script subdir - # Makefile is a run-time dependency, since it's accessed by the execveat test - TEST_FILES := Makefile -@@ -28,9 +33,9 @@ $(OUTPUT)/execveat.symlink: $(OUTPUT)/execveat - $(OUTPUT)/execveat.denatured: $(OUTPUT)/execveat - cp $< $@ - chmod -x $@ --$(OUTPUT)/load_address_4096: load_address.c -- $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=0x1000 -pie -static $< -o $@ --$(OUTPUT)/load_address_2097152: load_address.c -- $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=0x200000 -pie -static $< -o $@ --$(OUTPUT)/load_address_16777216: load_address.c -- $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=0x1000000 -pie -static $< -o $@ -+$(OUTPUT)/load_address.0x%: load_address.c -+ $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=$(lastword $(subst ., ,$@)) \ -+ -fPIE -pie $< -o $@ -+$(OUTPUT)/load_address.static.0x%: load_address.c -+ $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=$(lastword $(subst ., ,$@)) \ -+ -fPIE -static-pie $< -o $@ -diff --git a/tools/testing/selftests/exec/load_address.c b/tools/testing/selftests/exec/load_address.c -index d487c2f6a61509..8257fddba8c8db 100644 ---- a/tools/testing/selftests/exec/load_address.c -+++ b/tools/testing/selftests/exec/load_address.c -@@ -5,10 +5,13 @@ - #include - #include - #include -+#include -+#include "../kselftest.h" - - struct Statistics { - unsigned long long load_address; - unsigned long long alignment; -+ bool interp; - }; - - int ExtractStatistics(struct dl_phdr_info *info, size_t size, void *data) -@@ -25,11 +28,20 @@ int ExtractStatistics(struct dl_phdr_info *info, size_t size, void *data) - stats->alignment = 0; - - for (i = 0; i < info->dlpi_phnum; i++) { -+ unsigned long long align; -+ -+ if (info->dlpi_phdr[i].p_type == PT_INTERP) { -+ stats->interp = true; -+ continue; -+ } -+ - if (info->dlpi_phdr[i].p_type != PT_LOAD) - continue; - -- if (info->dlpi_phdr[i].p_align > stats->alignment) -- stats->alignment = info->dlpi_phdr[i].p_align; -+ align = info->dlpi_phdr[i].p_align; -+ -+ if (align > stats->alignment) -+ stats->alignment = align; - } - - return 1; // Terminate dl_iterate_phdr. -@@ -37,32 +49,57 @@ int ExtractStatistics(struct dl_phdr_info *info, size_t size, void *data) - - int main(int argc, char **argv) - { -- struct Statistics extracted; -- unsigned long long misalign; -+ struct Statistics extracted = { }; -+ unsigned long long misalign, pow2; -+ bool interp_needed; -+ char buf[1024]; -+ FILE *maps; - int ret; - -- ret = dl_iterate_phdr(ExtractStatistics, &extracted); -- if (ret != 1) { -- fprintf(stderr, "FAILED\n"); -- return 1; -- } -+ ksft_print_header(); -+ ksft_set_plan(4); - -- if (extracted.alignment == 0) { -- fprintf(stderr, "No alignment found\n"); -- return 1; -- } else if (extracted.alignment & (extracted.alignment - 1)) { -- fprintf(stderr, "Alignment is not a power of 2\n"); -- return 1; -+ /* Dump maps file for debugging reference. */ -+ maps = fopen("/proc/self/maps", "r"); -+ if (!maps) -+ ksft_exit_fail_msg("FAILED: /proc/self/maps: %s\n", strerror(errno)); -+ while (fgets(buf, sizeof(buf), maps)) { -+ ksft_print_msg("%s", buf); - } -+ fclose(maps); -+ -+ /* Walk the program headers. */ -+ ret = dl_iterate_phdr(ExtractStatistics, &extracted); -+ if (ret != 1) -+ ksft_exit_fail_msg("FAILED: dl_iterate_phdr\n"); -+ -+ /* Report our findings. */ -+ ksft_print_msg("load_address=%#llx alignment=%#llx\n", -+ extracted.load_address, extracted.alignment); -+ -+ /* If we're named with ".static." we expect no INTERP. */ -+ interp_needed = strstr(argv[0], ".static.") == NULL; -+ -+ /* Were we built as expected? */ -+ ksft_test_result(interp_needed == extracted.interp, -+ "%s INTERP program header %s\n", -+ interp_needed ? "Wanted" : "Unwanted", -+ extracted.interp ? "seen" : "missing"); - -+ /* Did we find an alignment? */ -+ ksft_test_result(extracted.alignment != 0, -+ "Alignment%s found\n", extracted.alignment ? "" : " NOT"); -+ -+ /* Is the alignment sane? */ -+ pow2 = extracted.alignment & (extracted.alignment - 1); -+ ksft_test_result(pow2 == 0, -+ "Alignment is%s a power of 2: %#llx\n", -+ pow2 == 0 ? "" : " NOT", extracted.alignment); -+ -+ /* Is the load address aligned? */ - misalign = extracted.load_address & (extracted.alignment - 1); -- if (misalign) { -- printf("alignment = %llu, load_address = %llu\n", -- extracted.alignment, extracted.load_address); -- fprintf(stderr, "FAILED\n"); -- return 1; -- } -+ ksft_test_result(misalign == 0, "Load Address is %saligned (%#llx)\n", -+ misalign ? "MIS" : "", misalign); - -- fprintf(stderr, "PASS\n"); -- return 0; -+ ksft_finished(); - } -diff --git a/tools/testing/selftests/mm/compaction_test.c b/tools/testing/selftests/mm/compaction_test.c -index 309b3750e57e13..38fec412206b9a 100644 ---- a/tools/testing/selftests/mm/compaction_test.c -+++ b/tools/testing/selftests/mm/compaction_test.c -@@ -89,6 +89,8 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) - int compaction_index = 0; - char initial_nr_hugepages[20] = {0}; - char nr_hugepages[20] = {0}; -+ char target_nr_hugepages[24] = {0}; -+ int slen; - - /* We want to test with 80% of available memory. Else, OOM killer comes - in to play */ -@@ -119,11 +121,18 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) - - lseek(fd, 0, SEEK_SET); - -- /* Request a large number of huge pages. The Kernel will allocate -- as much as it can */ -- if (write(fd, "100000", (6*sizeof(char))) != (6*sizeof(char))) { -- ksft_print_msg("Failed to write 100000 to /proc/sys/vm/nr_hugepages: %s\n", -- strerror(errno)); -+ /* -+ * Request huge pages for about half of the free memory. The Kernel -+ * will allocate as much as it can, and we expect it will get at least 1/3 -+ */ -+ nr_hugepages_ul = mem_free / hugepage_size / 2; -+ snprintf(target_nr_hugepages, sizeof(target_nr_hugepages), -+ "%lu", nr_hugepages_ul); -+ -+ slen = strlen(target_nr_hugepages); -+ if (write(fd, target_nr_hugepages, slen) != slen) { -+ ksft_print_msg("Failed to write %lu to /proc/sys/vm/nr_hugepages: %s\n", -+ nr_hugepages_ul, strerror(errno)); - goto close_fd; - } - diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.092-093.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.092-093.patch deleted file mode 100644 index 24359d6adb..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.092-093.patch +++ /dev/null @@ -1,20602 +0,0 @@ -diff --git a/Documentation/ABI/stable/sysfs-driver-dma-idxd b/Documentation/ABI/stable/sysfs-driver-dma-idxd -index 825e619250bf2e..f2ec42949a54d7 100644 ---- a/Documentation/ABI/stable/sysfs-driver-dma-idxd -+++ b/Documentation/ABI/stable/sysfs-driver-dma-idxd -@@ -270,6 +270,12 @@ Description: Shows the operation capability bits displayed in bitmap format - correlates to the operations allowed. It's visible only - on platforms that support the capability. - -+What: /sys/bus/dsa/devices/wq./driver_name -+Date: Sept 8, 2023 -+KernelVersion: 6.7.0 -+Contact: dmaengine@vger.kernel.org -+Description: Name of driver to be bounded to the wq. -+ - What: /sys/bus/dsa/devices/engine./group_id - Date: Oct 25, 2019 - KernelVersion: 5.6.0 -diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt -index f95734ceb82b86..315a817e338042 100644 ---- a/Documentation/admin-guide/kernel-parameters.txt -+++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -5978,6 +5978,8 @@ - - Selecting 'on' will also enable the mitigation - against user space to user space task attacks. -+ Selecting specific mitigation does not force enable -+ user mitigations. - - Selecting 'off' will disable both the kernel and - the user space protections. -diff --git a/Documentation/driver-api/serial/driver.rst b/Documentation/driver-api/serial/driver.rst -index 84b43061c11be2..60434f2b028637 100644 ---- a/Documentation/driver-api/serial/driver.rst -+++ b/Documentation/driver-api/serial/driver.rst -@@ -103,4 +103,4 @@ Some helpers are provided in order to set/get modem control lines via GPIO. - .. kernel-doc:: drivers/tty/serial/serial_mctrl_gpio.c - :identifiers: mctrl_gpio_init mctrl_gpio_free mctrl_gpio_to_gpiod - mctrl_gpio_set mctrl_gpio_get mctrl_gpio_enable_ms -- mctrl_gpio_disable_ms -+ mctrl_gpio_disable_ms_sync mctrl_gpio_disable_ms_no_sync -diff --git a/Documentation/hwmon/dell-smm-hwmon.rst b/Documentation/hwmon/dell-smm-hwmon.rst -index d8f1d6859b964b..1c12fbba440bca 100644 ---- a/Documentation/hwmon/dell-smm-hwmon.rst -+++ b/Documentation/hwmon/dell-smm-hwmon.rst -@@ -32,12 +32,12 @@ Temperature sensors and fans can be queried and set via the standard - =============================== ======= ======================================= - Name Perm Description - =============================== ======= ======================================= --fan[1-3]_input RO Fan speed in RPM. --fan[1-3]_label RO Fan label. --fan[1-3]_min RO Minimal Fan speed in RPM --fan[1-3]_max RO Maximal Fan speed in RPM --fan[1-3]_target RO Expected Fan speed in RPM --pwm[1-3] RW Control the fan PWM duty-cycle. -+fan[1-4]_input RO Fan speed in RPM. -+fan[1-4]_label RO Fan label. -+fan[1-4]_min RO Minimal Fan speed in RPM -+fan[1-4]_max RO Maximal Fan speed in RPM -+fan[1-4]_target RO Expected Fan speed in RPM -+pwm[1-4] RW Control the fan PWM duty-cycle. - pwm1_enable WO Enable or disable automatic BIOS fan - control (not supported on all laptops, - see below for details). -@@ -93,7 +93,7 @@ Again, when you find new codes, we'd be happy to have your patches! - --------------------------- - - The driver also exports the fans as thermal cooling devices with --``type`` set to ``dell-smm-fan[1-3]``. This allows for easy fan control -+``type`` set to ``dell-smm-fan[1-4]``. This allows for easy fan control - using one of the thermal governors. - - Module parameters -diff --git a/Makefile b/Makefile -index 51d975b3555195..c9a1e2286b3a79 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 92 -+SUBLEVEL = 93 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm/boot/dts/nvidia/tegra114.dtsi b/arch/arm/boot/dts/nvidia/tegra114.dtsi -index 86f14e2fd29f3a..6c057b50695140 100644 ---- a/arch/arm/boot/dts/nvidia/tegra114.dtsi -+++ b/arch/arm/boot/dts/nvidia/tegra114.dtsi -@@ -139,7 +139,7 @@ dsib: dsi@54400000 { - reg = <0x54400000 0x00040000>; - clocks = <&tegra_car TEGRA114_CLK_DSIB>, - <&tegra_car TEGRA114_CLK_DSIBLP>, -- <&tegra_car TEGRA114_CLK_PLL_D2_OUT0>; -+ <&tegra_car TEGRA114_CLK_PLL_D_OUT0>; - clock-names = "dsi", "lp", "parent"; - resets = <&tegra_car 82>; - reset-names = "dsi"; -diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c -index 22ecaf09d00f96..f635ad29511f6a 100644 ---- a/arch/arm/mach-at91/pm.c -+++ b/arch/arm/mach-at91/pm.c -@@ -538,11 +538,12 @@ extern u32 at91_pm_suspend_in_sram_sz; - - static int at91_suspend_finish(unsigned long val) - { -- unsigned char modified_gray_code[] = { -- 0x00, 0x01, 0x02, 0x03, 0x06, 0x07, 0x04, 0x05, 0x0c, 0x0d, -- 0x0e, 0x0f, 0x0a, 0x0b, 0x08, 0x09, 0x18, 0x19, 0x1a, 0x1b, -- 0x1e, 0x1f, 0x1c, 0x1d, 0x14, 0x15, 0x16, 0x17, 0x12, 0x13, -- 0x10, 0x11, -+ /* SYNOPSYS workaround to fix a bug in the calibration logic */ -+ unsigned char modified_fix_code[] = { -+ 0x00, 0x01, 0x01, 0x06, 0x07, 0x0c, 0x06, 0x07, 0x0b, 0x18, -+ 0x0a, 0x0b, 0x0c, 0x0d, 0x0d, 0x0a, 0x13, 0x13, 0x12, 0x13, -+ 0x14, 0x15, 0x15, 0x12, 0x18, 0x19, 0x19, 0x1e, 0x1f, 0x14, -+ 0x1e, 0x1f, - }; - unsigned int tmp, index; - int i; -@@ -553,25 +554,25 @@ static int at91_suspend_finish(unsigned long val) - * restore the ZQ0SR0 with the value saved here. But the - * calibration is buggy and restoring some values from ZQ0SR0 - * is forbidden and risky thus we need to provide processed -- * values for these (modified gray code values). -+ * values for these. - */ - tmp = readl(soc_pm.data.ramc_phy + DDR3PHY_ZQ0SR0); - - /* Store pull-down output impedance select. */ - index = (tmp >> DDR3PHY_ZQ0SR0_PDO_OFF) & 0x1f; -- soc_pm.bu->ddr_phy_calibration[0] = modified_gray_code[index]; -+ soc_pm.bu->ddr_phy_calibration[0] = modified_fix_code[index] << DDR3PHY_ZQ0SR0_PDO_OFF; - - /* Store pull-up output impedance select. */ - index = (tmp >> DDR3PHY_ZQ0SR0_PUO_OFF) & 0x1f; -- soc_pm.bu->ddr_phy_calibration[0] |= modified_gray_code[index]; -+ soc_pm.bu->ddr_phy_calibration[0] |= modified_fix_code[index] << DDR3PHY_ZQ0SR0_PUO_OFF; - - /* Store pull-down on-die termination impedance select. */ - index = (tmp >> DDR3PHY_ZQ0SR0_PDODT_OFF) & 0x1f; -- soc_pm.bu->ddr_phy_calibration[0] |= modified_gray_code[index]; -+ soc_pm.bu->ddr_phy_calibration[0] |= modified_fix_code[index] << DDR3PHY_ZQ0SR0_PDODT_OFF; - - /* Store pull-up on-die termination impedance select. */ - index = (tmp >> DDR3PHY_ZQ0SRO_PUODT_OFF) & 0x1f; -- soc_pm.bu->ddr_phy_calibration[0] |= modified_gray_code[index]; -+ soc_pm.bu->ddr_phy_calibration[0] |= modified_fix_code[index] << DDR3PHY_ZQ0SRO_PUODT_OFF; - - /* - * The 1st 8 words of memory might get corrupted in the process -diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts -index 381d58cea092d9..c854c7e3105196 100644 ---- a/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts -+++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts -@@ -151,28 +151,12 @@ &pio { - vcc-pg-supply = <®_aldo1>; - }; - --&r_ir { -- linux,rc-map-name = "rc-beelink-gs1"; -- status = "okay"; --}; -- --&r_pio { -- /* -- * FIXME: We can't add that supply for now since it would -- * create a circular dependency between pinctrl, the regulator -- * and the RSB Bus. -- * -- * vcc-pl-supply = <®_aldo1>; -- */ -- vcc-pm-supply = <®_aldo1>; --}; -- --&r_rsb { -+&r_i2c { - status = "okay"; - -- axp805: pmic@745 { -+ axp805: pmic@36 { - compatible = "x-powers,axp805", "x-powers,axp806"; -- reg = <0x745>; -+ reg = <0x36>; - interrupt-parent = <&r_intc>; - interrupts = ; - interrupt-controller; -@@ -290,6 +274,22 @@ sw { - }; - }; - -+&r_ir { -+ linux,rc-map-name = "rc-beelink-gs1"; -+ status = "okay"; -+}; -+ -+&r_pio { -+ /* -+ * PL0 and PL1 are used for PMIC I2C -+ * don't enable the pl-supply else -+ * it will fail at boot -+ * -+ * vcc-pl-supply = <®_aldo1>; -+ */ -+ vcc-pm-supply = <®_aldo1>; -+}; -+ - &spdif { - pinctrl-names = "default"; - pinctrl-0 = <&spdif_tx_pin>; -diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-3.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-3.dts -index 6fc65e8db22068..8c476e089185b5 100644 ---- a/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-3.dts -+++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-3.dts -@@ -175,16 +175,12 @@ &pio { - vcc-pg-supply = <®_vcc_wifi_io>; - }; - --&r_ir { -- status = "okay"; --}; -- --&r_rsb { -+&r_i2c { - status = "okay"; - -- axp805: pmic@745 { -+ axp805: pmic@36 { - compatible = "x-powers,axp805", "x-powers,axp806"; -- reg = <0x745>; -+ reg = <0x36>; - interrupt-parent = <&r_intc>; - interrupts = ; - interrupt-controller; -@@ -295,6 +291,10 @@ sw { - }; - }; - -+&r_ir { -+ status = "okay"; -+}; -+ - &rtc { - clocks = <&ext_osc32k>; - }; -diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi.dtsi -index 92745128fcfebd..4ec4996592befb 100644 ---- a/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi.dtsi -+++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi.dtsi -@@ -112,20 +112,12 @@ &pio { - vcc-pg-supply = <®_aldo1>; - }; - --&r_ir { -- status = "okay"; --}; -- --&r_pio { -- vcc-pm-supply = <®_bldo3>; --}; -- --&r_rsb { -+&r_i2c { - status = "okay"; - -- axp805: pmic@745 { -+ axp805: pmic@36 { - compatible = "x-powers,axp805", "x-powers,axp806"; -- reg = <0x745>; -+ reg = <0x36>; - interrupt-parent = <&r_intc>; - interrupts = ; - interrupt-controller; -@@ -240,6 +232,14 @@ sw { - }; - }; - -+&r_ir { -+ status = "okay"; -+}; -+ -+&r_pio { -+ vcc-pm-supply = <®_bldo3>; -+}; -+ - &rtc { - clocks = <&ext_osc32k>; - }; -diff --git a/arch/arm64/boot/dts/marvell/armada-3720-uDPU.dtsi b/arch/arm64/boot/dts/marvell/armada-3720-uDPU.dtsi -index 3f79923376fb28..37244e8816d9e8 100644 ---- a/arch/arm64/boot/dts/marvell/armada-3720-uDPU.dtsi -+++ b/arch/arm64/boot/dts/marvell/armada-3720-uDPU.dtsi -@@ -26,6 +26,8 @@ memory@0 { - - leds { - compatible = "gpio-leds"; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&spi_quad_pins>; - - led-power1 { - label = "udpu:green:power"; -@@ -82,8 +84,6 @@ &sdhci0 { - - &spi0 { - status = "okay"; -- pinctrl-names = "default"; -- pinctrl-0 = <&spi_quad_pins>; - - flash@0 { - compatible = "jedec,spi-nor"; -@@ -108,6 +108,10 @@ partition@180000 { - }; - }; - -+&spi_quad_pins { -+ function = "gpio"; -+}; -+ - &pinctrl_nb { - i2c2_recovery_pins: i2c2-recovery-pins { - groups = "i2c2"; -diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi -index b4a1108c2dd74f..0639f5ce1bd9e4 100644 ---- a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi -+++ b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi -@@ -1635,7 +1635,7 @@ vdd_1v8_dis: regulator-vdd-1v8-dis { - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; - regulator-always-on; -- gpio = <&exp1 14 GPIO_ACTIVE_HIGH>; -+ gpio = <&exp1 9 GPIO_ACTIVE_HIGH>; - enable-active-high; - vin-supply = <&vdd_1v8>; - }; -diff --git a/arch/arm64/boot/dts/nvidia/tegra234-p3740-0002+p3701-0008.dts b/arch/arm64/boot/dts/nvidia/tegra234-p3740-0002+p3701-0008.dts -index bac611d735c589..2fa48972b2a91f 100644 ---- a/arch/arm64/boot/dts/nvidia/tegra234-p3740-0002+p3701-0008.dts -+++ b/arch/arm64/boot/dts/nvidia/tegra234-p3740-0002+p3701-0008.dts -@@ -102,6 +102,16 @@ pcie@14160000 { - }; - - pcie@141a0000 { -+ reg = <0x00 0x141a0000 0x0 0x00020000 /* appl registers (128K) */ -+ 0x00 0x3a000000 0x0 0x00040000 /* configuration space (256K) */ -+ 0x00 0x3a040000 0x0 0x00040000 /* iATU_DMA reg space (256K) */ -+ 0x00 0x3a080000 0x0 0x00040000 /* DBI reg space (256K) */ -+ 0x2e 0x20000000 0x0 0x10000000>; /* ECAM (256MB) */ -+ -+ ranges = <0x81000000 0x00 0x3a100000 0x00 0x3a100000 0x0 0x00100000 /* downstream I/O (1MB) */ -+ 0x82000000 0x00 0x40000000 0x2e 0x30000000 0x0 0x08000000 /* non-prefetchable memory (128MB) */ -+ 0xc3000000 0x28 0x00000000 0x28 0x00000000 0x6 0x20000000>; /* prefetchable memory (25088MB) */ -+ - status = "okay"; - vddio-pex-ctl-supply = <&vdd_1v8_ls>; - phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>, -diff --git a/arch/arm64/boot/dts/qcom/ipq9574.dtsi b/arch/arm64/boot/dts/qcom/ipq9574.dtsi -index 8a72ad4afd0320..82e4fd5eb388ff 100644 ---- a/arch/arm64/boot/dts/qcom/ipq9574.dtsi -+++ b/arch/arm64/boot/dts/qcom/ipq9574.dtsi -@@ -231,6 +231,8 @@ cryptobam: dma-controller@704000 { - interrupts = ; - #dma-cells = <1>; - qcom,ee = <1>; -+ qcom,num-ees = <4>; -+ num-channels = <16>; - qcom,controlled-remotely; - }; - -diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi -index 2a4d950ac02bfe..5376c0a00fab65 100644 ---- a/arch/arm64/boot/dts/qcom/sm8350.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi -@@ -442,7 +442,7 @@ cdsp_secure_heap: memory@80c00000 { - no-map; - }; - -- pil_camera_mem: mmeory@85200000 { -+ pil_camera_mem: memory@85200000 { - reg = <0x0 0x85200000 0x0 0x500000>; - no-map; - }; -diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi -index 3b4d7882300897..c1ed39cac8c5b7 100644 ---- a/arch/arm64/boot/dts/qcom/sm8450.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi -@@ -4233,6 +4233,8 @@ cryptobam: dma-controller@1dc4000 { - interrupts = ; - #dma-cells = <1>; - qcom,ee = <0>; -+ qcom,num-ees = <4>; -+ num-channels = <16>; - qcom,controlled-remotely; - iommus = <&apps_smmu 0x584 0x11>, - <&apps_smmu 0x588 0x0>, -diff --git a/arch/arm64/boot/dts/qcom/sm8550.dtsi b/arch/arm64/boot/dts/qcom/sm8550.dtsi -index bc9a1fca2db3ae..c14c6f8583d548 100644 ---- a/arch/arm64/boot/dts/qcom/sm8550.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm8550.dtsi -@@ -1866,6 +1866,8 @@ cryptobam: dma-controller@1dc4000 { - interrupts = ; - #dma-cells = <1>; - qcom,ee = <0>; -+ qcom,num-ees = <4>; -+ num-channels = <20>; - qcom,controlled-remotely; - iommus = <&apps_smmu 0x480 0x0>, - <&apps_smmu 0x481 0x0>; -diff --git a/arch/arm64/boot/dts/ti/k3-am68-sk-base-board.dts b/arch/arm64/boot/dts/ti/k3-am68-sk-base-board.dts -index 5df5946687b348..2e92f4174b3cf0 100644 ---- a/arch/arm64/boot/dts/ti/k3-am68-sk-base-board.dts -+++ b/arch/arm64/boot/dts/ti/k3-am68-sk-base-board.dts -@@ -43,6 +43,17 @@ vusb_main: regulator-vusb-main5v0 { - regulator-boot-on; - }; - -+ vsys_5v0: regulator-vsys5v0 { -+ /* Output of LM61460 */ -+ compatible = "regulator-fixed"; -+ regulator-name = "vsys_5v0"; -+ regulator-min-microvolt = <5000000>; -+ regulator-max-microvolt = <5000000>; -+ vin-supply = <&vusb_main>; -+ regulator-always-on; -+ regulator-boot-on; -+ }; -+ - vsys_3v3: regulator-vsys3v3 { - /* Output of LM5141 */ - compatible = "regulator-fixed"; -@@ -75,7 +86,7 @@ vdd_sd_dv: regulator-tlv71033 { - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <3300000>; - regulator-boot-on; -- vin-supply = <&vsys_3v3>; -+ vin-supply = <&vsys_5v0>; - gpios = <&main_gpio0 49 GPIO_ACTIVE_HIGH>; - states = <1800000 0x0>, - <3300000 0x1>; -diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-clk-ccf.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp-clk-ccf.dtsi -index ccaca29200bb93..995bd8ce9d43af 100644 ---- a/arch/arm64/boot/dts/xilinx/zynqmp-clk-ccf.dtsi -+++ b/arch/arm64/boot/dts/xilinx/zynqmp-clk-ccf.dtsi -@@ -10,39 +10,44 @@ - - #include - / { -- pss_ref_clk: pss_ref_clk { -+ pss_ref_clk: pss-ref-clk { - bootph-all; - compatible = "fixed-clock"; - #clock-cells = <0>; - clock-frequency = <33333333>; -+ clock-output-names = "pss_ref_clk"; - }; - -- video_clk: video_clk { -+ video_clk: video-clk { - bootph-all; - compatible = "fixed-clock"; - #clock-cells = <0>; - clock-frequency = <27000000>; -+ clock-output-names = "video_clk"; - }; - -- pss_alt_ref_clk: pss_alt_ref_clk { -+ pss_alt_ref_clk: pss-alt-ref-clk { - bootph-all; - compatible = "fixed-clock"; - #clock-cells = <0>; - clock-frequency = <0>; -+ clock-output-names = "pss_alt_ref_clk"; - }; - -- gt_crx_ref_clk: gt_crx_ref_clk { -+ gt_crx_ref_clk: gt-crx-ref-clk { - bootph-all; - compatible = "fixed-clock"; - #clock-cells = <0>; - clock-frequency = <108000000>; -+ clock-output-names = "gt_crx_ref_clk"; - }; - -- aux_ref_clk: aux_ref_clk { -+ aux_ref_clk: aux-ref-clk { - bootph-all; - compatible = "fixed-clock"; - #clock-cells = <0>; - clock-frequency = <27000000>; -+ clock-output-names = "aux_ref_clk"; - }; - }; - -diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h -index 8a6b7feca3e428..d92a0203e5a93d 100644 ---- a/arch/arm64/include/asm/cputype.h -+++ b/arch/arm64/include/asm/cputype.h -@@ -132,6 +132,7 @@ - #define FUJITSU_CPU_PART_A64FX 0x001 - - #define HISI_CPU_PART_TSV110 0xD01 -+#define HISI_CPU_PART_HIP09 0xD02 - - #define APPLE_CPU_PART_M1_ICESTORM 0x022 - #define APPLE_CPU_PART_M1_FIRESTORM 0x023 -@@ -208,6 +209,7 @@ - #define MIDR_NVIDIA_CARMEL MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_CARMEL) - #define MIDR_FUJITSU_A64FX MIDR_CPU_MODEL(ARM_CPU_IMP_FUJITSU, FUJITSU_CPU_PART_A64FX) - #define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110) -+#define MIDR_HISI_HIP09 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_HIP09) - #define MIDR_APPLE_M1_ICESTORM MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM) - #define MIDR_APPLE_M1_FIRESTORM MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM) - #define MIDR_APPLE_M1_ICESTORM_PRO MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM_PRO) -diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h -index 07bdf5dd8ebef5..0212129b13d074 100644 ---- a/arch/arm64/include/asm/pgtable.h -+++ b/arch/arm64/include/asm/pgtable.h -@@ -679,7 +679,8 @@ static inline unsigned long pmd_page_vaddr(pmd_t pmd) - pr_err("%s:%d: bad pmd %016llx.\n", __FILE__, __LINE__, pmd_val(e)) - - #define pud_none(pud) (!pud_val(pud)) --#define pud_bad(pud) (!pud_table(pud)) -+#define pud_bad(pud) ((pud_val(pud) & PUD_TYPE_MASK) != \ -+ PUD_TYPE_TABLE) - #define pud_present(pud) pte_present(pud_pte(pud)) - #define pud_leaf(pud) (pud_present(pud) && !pud_table(pud)) - #define pud_valid(pud) pte_valid(pud_pte(pud)) -diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c -index 28c48bc9c09538..2c81e0efaf378e 100644 ---- a/arch/arm64/kernel/proton-pack.c -+++ b/arch/arm64/kernel/proton-pack.c -@@ -904,6 +904,7 @@ static u8 spectre_bhb_loop_affected(void) - MIDR_ALL_VERSIONS(MIDR_CORTEX_A77), - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), - MIDR_ALL_VERSIONS(MIDR_QCOM_KRYO_4XX_GOLD), -+ MIDR_ALL_VERSIONS(MIDR_HISI_HIP09), - {}, - }; - static const struct midr_range spectre_bhb_k11_list[] = { -diff --git a/arch/mips/include/asm/ftrace.h b/arch/mips/include/asm/ftrace.h -index db497a8167da29..e3212f44446fa9 100644 ---- a/arch/mips/include/asm/ftrace.h -+++ b/arch/mips/include/asm/ftrace.h -@@ -87,4 +87,20 @@ struct dyn_arch_ftrace { - #endif /* CONFIG_DYNAMIC_FTRACE */ - #endif /* __ASSEMBLY__ */ - #endif /* CONFIG_FUNCTION_TRACER */ -+ -+#ifdef CONFIG_FTRACE_SYSCALLS -+#ifndef __ASSEMBLY__ -+/* -+ * Some syscall entry functions on mips start with "__sys_" (fork and clone, -+ * for instance). We should also match the sys_ variant with those. -+ */ -+#define ARCH_HAS_SYSCALL_MATCH_SYM_NAME -+static inline bool arch_syscall_match_sym_name(const char *sym, -+ const char *name) -+{ -+ return !strcmp(sym, name) || -+ (!strncmp(sym, "__sys_", 6) && !strcmp(sym + 6, name + 4)); -+} -+#endif /* __ASSEMBLY__ */ -+#endif /* CONFIG_FTRACE_SYSCALLS */ - #endif /* _ASM_MIPS_FTRACE_H */ -diff --git a/arch/mips/kernel/pm-cps.c b/arch/mips/kernel/pm-cps.c -index 9bf60d7d44d362..a7bcf2b814c865 100644 ---- a/arch/mips/kernel/pm-cps.c -+++ b/arch/mips/kernel/pm-cps.c -@@ -56,10 +56,7 @@ static DEFINE_PER_CPU_ALIGNED(u32*, ready_count); - /* Indicates online CPUs coupled with the current CPU */ - static DEFINE_PER_CPU_ALIGNED(cpumask_t, online_coupled); - --/* -- * Used to synchronize entry to deep idle states. Actually per-core rather -- * than per-CPU. -- */ -+/* Used to synchronize entry to deep idle states */ - static DEFINE_PER_CPU_ALIGNED(atomic_t, pm_barrier); - - /* Saved CPU state across the CPS_PM_POWER_GATED state */ -@@ -118,9 +115,10 @@ int cps_pm_enter_state(enum cps_pm_state state) - cps_nc_entry_fn entry; - struct core_boot_config *core_cfg; - struct vpe_boot_config *vpe_cfg; -+ atomic_t *barrier; - - /* Check that there is an entry function for this state */ -- entry = per_cpu(nc_asm_enter, core)[state]; -+ entry = per_cpu(nc_asm_enter, cpu)[state]; - if (!entry) - return -EINVAL; - -@@ -156,7 +154,7 @@ int cps_pm_enter_state(enum cps_pm_state state) - smp_mb__after_atomic(); - - /* Create a non-coherent mapping of the core ready_count */ -- core_ready_count = per_cpu(ready_count, core); -+ core_ready_count = per_cpu(ready_count, cpu); - nc_addr = kmap_noncoherent(virt_to_page(core_ready_count), - (unsigned long)core_ready_count); - nc_addr += ((unsigned long)core_ready_count & ~PAGE_MASK); -@@ -164,7 +162,8 @@ int cps_pm_enter_state(enum cps_pm_state state) - - /* Ensure ready_count is zero-initialised before the assembly runs */ - WRITE_ONCE(*nc_core_ready_count, 0); -- coupled_barrier(&per_cpu(pm_barrier, core), online); -+ barrier = &per_cpu(pm_barrier, cpumask_first(&cpu_sibling_map[cpu])); -+ coupled_barrier(barrier, online); - - /* Run the generated entry code */ - left = entry(online, nc_core_ready_count); -@@ -635,12 +634,14 @@ static void *cps_gen_entry_code(unsigned cpu, enum cps_pm_state state) - - static int cps_pm_online_cpu(unsigned int cpu) - { -- enum cps_pm_state state; -- unsigned core = cpu_core(&cpu_data[cpu]); -+ unsigned int sibling, core; - void *entry_fn, *core_rc; -+ enum cps_pm_state state; -+ -+ core = cpu_core(&cpu_data[cpu]); - - for (state = CPS_PM_NC_WAIT; state < CPS_PM_STATE_COUNT; state++) { -- if (per_cpu(nc_asm_enter, core)[state]) -+ if (per_cpu(nc_asm_enter, cpu)[state]) - continue; - if (!test_bit(state, state_support)) - continue; -@@ -652,16 +653,19 @@ static int cps_pm_online_cpu(unsigned int cpu) - clear_bit(state, state_support); - } - -- per_cpu(nc_asm_enter, core)[state] = entry_fn; -+ for_each_cpu(sibling, &cpu_sibling_map[cpu]) -+ per_cpu(nc_asm_enter, sibling)[state] = entry_fn; - } - -- if (!per_cpu(ready_count, core)) { -+ if (!per_cpu(ready_count, cpu)) { - core_rc = kmalloc(sizeof(u32), GFP_KERNEL); - if (!core_rc) { - pr_err("Failed allocate core %u ready_count\n", core); - return -ENOMEM; - } -- per_cpu(ready_count, core) = core_rc; -+ -+ for_each_cpu(sibling, &cpu_sibling_map[cpu]) -+ per_cpu(ready_count, sibling) = core_rc; - } - - return 0; -diff --git a/arch/powerpc/include/asm/mmzone.h b/arch/powerpc/include/asm/mmzone.h -index da827d2d08666e..f2c4457c94c397 100644 ---- a/arch/powerpc/include/asm/mmzone.h -+++ b/arch/powerpc/include/asm/mmzone.h -@@ -35,6 +35,7 @@ extern cpumask_var_t node_to_cpumask_map[]; - #ifdef CONFIG_MEMORY_HOTPLUG - extern unsigned long max_pfn; - u64 memory_hotplug_max(void); -+u64 hot_add_drconf_memory_max(void); - #else - #define memory_hotplug_max() memblock_end_of_DRAM() - #endif -diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c -index a6090896f74979..ac669e58e20230 100644 ---- a/arch/powerpc/kernel/prom_init.c -+++ b/arch/powerpc/kernel/prom_init.c -@@ -2974,11 +2974,11 @@ static void __init fixup_device_tree_pmac(void) - char type[8]; - phandle node; - -- // Some pmacs are missing #size-cells on escc nodes -+ // Some pmacs are missing #size-cells on escc or i2s nodes - for (node = 0; prom_next_node(&node); ) { - type[0] = '\0'; - prom_getprop(node, "device_type", type, sizeof(type)); -- if (prom_strcmp(type, "escc")) -+ if (prom_strcmp(type, "escc") && prom_strcmp(type, "i2s")) - continue; - - if (prom_getproplen(node, "#size-cells") != PROM_ERROR) -diff --git a/arch/powerpc/mm/book3s64/radix_pgtable.c b/arch/powerpc/mm/book3s64/radix_pgtable.c -index 28460e33408084..aff3b37e32d64e 100644 ---- a/arch/powerpc/mm/book3s64/radix_pgtable.c -+++ b/arch/powerpc/mm/book3s64/radix_pgtable.c -@@ -912,7 +912,7 @@ int __meminit radix__vmemmap_create_mapping(unsigned long start, - return 0; - } - -- -+#ifdef CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP - bool vmemmap_can_optimize(struct vmem_altmap *altmap, struct dev_pagemap *pgmap) - { - if (radix_enabled()) -@@ -920,6 +920,7 @@ bool vmemmap_can_optimize(struct vmem_altmap *altmap, struct dev_pagemap *pgmap) - - return false; - } -+#endif - - int __meminit vmemmap_check_pmd(pmd_t *pmdp, int node, - unsigned long addr, unsigned long next) -diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c -index f6c4ace3b22197..65a9df0b9e5a09 100644 ---- a/arch/powerpc/mm/numa.c -+++ b/arch/powerpc/mm/numa.c -@@ -1342,7 +1342,7 @@ int hot_add_scn_to_nid(unsigned long scn_addr) - return nid; - } - --static u64 hot_add_drconf_memory_max(void) -+u64 hot_add_drconf_memory_max(void) - { - struct device_node *memory = NULL; - struct device_node *dn = NULL; -diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c -index 10b946e9c6e756..4bb84dc4393fca 100644 ---- a/arch/powerpc/perf/core-book3s.c -+++ b/arch/powerpc/perf/core-book3s.c -@@ -2229,6 +2229,10 @@ static struct pmu power_pmu = { - #define PERF_SAMPLE_ADDR_TYPE (PERF_SAMPLE_ADDR | \ - PERF_SAMPLE_PHYS_ADDR | \ - PERF_SAMPLE_DATA_PAGE_SIZE) -+ -+#define SIER_TYPE_SHIFT 15 -+#define SIER_TYPE_MASK (0x7ull << SIER_TYPE_SHIFT) -+ - /* - * A counter has overflowed; update its count and record - * things if requested. Note that interrupts are hard-disabled -@@ -2297,6 +2301,22 @@ static void record_and_restart(struct perf_event *event, unsigned long val, - is_kernel_addr(mfspr(SPRN_SIAR))) - record = 0; - -+ /* -+ * SIER[46-48] presents instruction type of the sampled instruction. -+ * In ISA v3.0 and before values "0" and "7" are considered reserved. -+ * In ISA v3.1, value "7" has been used to indicate "larx/stcx". -+ * Drop the sample if "type" has reserved values for this field with a -+ * ISA version check. -+ */ -+ if (event->attr.sample_type & PERF_SAMPLE_DATA_SRC && -+ ppmu->get_mem_data_src) { -+ val = (regs->dar & SIER_TYPE_MASK) >> SIER_TYPE_SHIFT; -+ if (val == 0 || (val == 7 && !cpu_has_feature(CPU_FTR_ARCH_31))) { -+ record = 0; -+ atomic64_inc(&event->lost_samples); -+ } -+ } -+ - /* - * Finally record data if requested. - */ -diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c -index 56301b2bc8ae87..031a2b63c171dc 100644 ---- a/arch/powerpc/perf/isa207-common.c -+++ b/arch/powerpc/perf/isa207-common.c -@@ -321,8 +321,10 @@ void isa207_get_mem_data_src(union perf_mem_data_src *dsrc, u32 flags, - - sier = mfspr(SPRN_SIER); - val = (sier & ISA207_SIER_TYPE_MASK) >> ISA207_SIER_TYPE_SHIFT; -- if (val != 1 && val != 2 && !(val == 7 && cpu_has_feature(CPU_FTR_ARCH_31))) -+ if (val != 1 && val != 2 && !(val == 7 && cpu_has_feature(CPU_FTR_ARCH_31))) { -+ dsrc->val = 0; - return; -+ } - - idx = (sier & ISA207_SIER_LDST_MASK) >> ISA207_SIER_LDST_SHIFT; - sub_idx = (sier & ISA207_SIER_DATA_SRC_MASK) >> ISA207_SIER_DATA_SRC_SHIFT; -diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c -index b1e6d275cda9eb..bf02f94a973dbd 100644 ---- a/arch/powerpc/platforms/pseries/iommu.c -+++ b/arch/powerpc/platforms/pseries/iommu.c -@@ -1183,17 +1183,13 @@ static LIST_HEAD(failed_ddw_pdn_list); - - static phys_addr_t ddw_memory_hotplug_max(void) - { -- resource_size_t max_addr = memory_hotplug_max(); -- struct device_node *memory; -+ resource_size_t max_addr; - -- for_each_node_by_type(memory, "memory") { -- struct resource res; -- -- if (of_address_to_resource(memory, 0, &res)) -- continue; -- -- max_addr = max_t(resource_size_t, max_addr, res.end + 1); -- } -+#if defined(CONFIG_NUMA) && defined(CONFIG_MEMORY_HOTPLUG) -+ max_addr = hot_add_drconf_memory_max(); -+#else -+ max_addr = memblock_end_of_DRAM(); -+#endif - - return max_addr; - } -@@ -1471,7 +1467,7 @@ static bool enable_ddw(struct pci_dev *dev, struct device_node *pdn) - window->direct = true; - - /* DDW maps the whole partition, so enable direct DMA mapping */ -- ret = walk_system_ram_range(0, memblock_end_of_DRAM() >> PAGE_SHIFT, -+ ret = walk_system_ram_range(0, ddw_memory_hotplug_max() >> PAGE_SHIFT, - win64->value, tce_setrange_multi_pSeriesLP_walk); - if (ret) { - dev_info(&dev->dev, "failed to map DMA window for %pOF: %d\n", -@@ -1658,11 +1654,17 @@ static int iommu_mem_notifier(struct notifier_block *nb, unsigned long action, - struct memory_notify *arg = data; - int ret = 0; - -+ /* This notifier can get called when onlining persistent memory as well. -+ * TCEs are not pre-mapped for persistent memory. Persistent memory will -+ * always be above ddw_memory_hotplug_max() -+ */ -+ - switch (action) { - case MEM_GOING_ONLINE: - spin_lock(&dma_win_list_lock); - list_for_each_entry(window, &dma_win_list, list) { -- if (window->direct) { -+ if (window->direct && (arg->start_pfn << PAGE_SHIFT) < -+ ddw_memory_hotplug_max()) { - ret |= tce_setrange_multi_pSeriesLP(arg->start_pfn, - arg->nr_pages, window->prop); - } -@@ -1674,7 +1676,8 @@ static int iommu_mem_notifier(struct notifier_block *nb, unsigned long action, - case MEM_OFFLINE: - spin_lock(&dma_win_list_lock); - list_for_each_entry(window, &dma_win_list, list) { -- if (window->direct) { -+ if (window->direct && (arg->start_pfn << PAGE_SHIFT) < -+ ddw_memory_hotplug_max()) { - ret |= tce_clearrange_multi_pSeriesLP(arg->start_pfn, - arg->nr_pages, window->prop); - } -diff --git a/arch/riscv/include/asm/page.h b/arch/riscv/include/asm/page.h -index 4d1f58848129e8..dbb9d0d0f405e1 100644 ---- a/arch/riscv/include/asm/page.h -+++ b/arch/riscv/include/asm/page.h -@@ -26,12 +26,9 @@ - * When not using MMU this corresponds to the first free page in - * physical memory (aligned on a page boundary). - */ --#ifdef CONFIG_64BIT - #ifdef CONFIG_MMU -+#ifdef CONFIG_64BIT - #define PAGE_OFFSET kernel_map.page_offset --#else --#define PAGE_OFFSET _AC(CONFIG_PAGE_OFFSET, UL) --#endif - /* - * By default, CONFIG_PAGE_OFFSET value corresponds to SV57 address space so - * define the PAGE_OFFSET value for SV48 and SV39. -@@ -41,6 +38,9 @@ - #else - #define PAGE_OFFSET _AC(CONFIG_PAGE_OFFSET, UL) - #endif /* CONFIG_64BIT */ -+#else -+#define PAGE_OFFSET ((unsigned long)phys_ram_base) -+#endif /* CONFIG_MMU */ - - #ifndef __ASSEMBLY__ - -@@ -97,11 +97,7 @@ typedef struct page *pgtable_t; - #define MIN_MEMBLOCK_ADDR 0 - #endif - --#ifdef CONFIG_MMU - #define ARCH_PFN_OFFSET (PFN_DOWN((unsigned long)phys_ram_base)) --#else --#define ARCH_PFN_OFFSET (PAGE_OFFSET >> PAGE_SHIFT) --#endif /* CONFIG_MMU */ - - struct kernel_mapping { - unsigned long page_offset; -diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h -index f540b2625714d0..332a6bf72b1d54 100644 ---- a/arch/riscv/include/asm/pgtable.h -+++ b/arch/riscv/include/asm/pgtable.h -@@ -12,7 +12,7 @@ - #include - - #ifndef CONFIG_MMU --#define KERNEL_LINK_ADDR PAGE_OFFSET -+#define KERNEL_LINK_ADDR _AC(CONFIG_PAGE_OFFSET, UL) - #define KERN_VIRT_SIZE (UL(-1)) - #else - -diff --git a/arch/s390/hypfs/hypfs_diag_fs.c b/arch/s390/hypfs/hypfs_diag_fs.c -index 00a6d370a28032..280266a74f378d 100644 ---- a/arch/s390/hypfs/hypfs_diag_fs.c -+++ b/arch/s390/hypfs/hypfs_diag_fs.c -@@ -208,6 +208,8 @@ static int hypfs_create_cpu_files(struct dentry *cpus_dir, void *cpu_info) - snprintf(buffer, TMP_SIZE, "%d", cpu_info__cpu_addr(diag204_get_info_type(), - cpu_info)); - cpu_dir = hypfs_mkdir(cpus_dir, buffer); -+ if (IS_ERR(cpu_dir)) -+ return PTR_ERR(cpu_dir); - rc = hypfs_create_u64(cpu_dir, "mgmtime", - cpu_info__acc_time(diag204_get_info_type(), cpu_info) - - cpu_info__lp_time(diag204_get_info_type(), cpu_info)); -diff --git a/arch/um/Makefile b/arch/um/Makefile -index 34957dcb88b9c3..744c5d0bdeb8fc 100644 ---- a/arch/um/Makefile -+++ b/arch/um/Makefile -@@ -151,5 +151,6 @@ MRPROPER_FILES += $(HOST_DIR)/include/generated - archclean: - @find . \( -name '*.bb' -o -name '*.bbg' -o -name '*.da' \ - -o -name '*.gcov' \) -type f -print | xargs rm -f -+ $(Q)$(MAKE) -f $(srctree)/Makefile ARCH=$(HEADER_ARCH) clean - - export HEADER_ARCH SUBARCH USER_CFLAGS CFLAGS_NO_HARDENING DEV_NULL_PATH -diff --git a/arch/um/kernel/mem.c b/arch/um/kernel/mem.c -index 38d5a71a579bcb..f6c766b2bdf5e4 100644 ---- a/arch/um/kernel/mem.c -+++ b/arch/um/kernel/mem.c -@@ -68,6 +68,7 @@ void __init mem_init(void) - map_memory(brk_end, __pa(brk_end), uml_reserved - brk_end, 1, 1, 0); - memblock_free((void *)brk_end, uml_reserved - brk_end); - uml_reserved = brk_end; -+ min_low_pfn = PFN_UP(__pa(uml_reserved)); - - /* this will put all low memory onto the freelists */ - memblock_free_all(); -diff --git a/arch/x86/Makefile b/arch/x86/Makefile -index c83582b5a010de..6d593fb85a9e93 100644 ---- a/arch/x86/Makefile -+++ b/arch/x86/Makefile -@@ -43,7 +43,7 @@ endif - - # How to compile the 16-bit code. Note we always compile for -march=i386; - # that way we can complain to the user if the CPU is insufficient. --REALMODE_CFLAGS := -m16 -g -Os -DDISABLE_BRANCH_PROFILING -D__DISABLE_EXPORTS \ -+REALMODE_CFLAGS := -std=gnu11 -m16 -g -Os -DDISABLE_BRANCH_PROFILING -D__DISABLE_EXPORTS \ - -Wall -Wstrict-prototypes -march=i386 -mregparm=3 \ - -fno-strict-aliasing -fomit-frame-pointer -fno-pic \ - -mno-mmx -mno-sse $(call cc-option,-fcf-protection=none) -diff --git a/arch/x86/boot/genimage.sh b/arch/x86/boot/genimage.sh -index c9299aeb7333e6..3882ead513f742 100644 ---- a/arch/x86/boot/genimage.sh -+++ b/arch/x86/boot/genimage.sh -@@ -22,6 +22,7 @@ - # This script requires: - # bash - # syslinux -+# genisoimage - # mtools (for fdimage* and hdimage) - # edk2/OVMF (for hdimage) - # -@@ -251,7 +252,9 @@ geniso() { - cp "$isolinux" "$ldlinux" "$tmp_dir" - cp "$FBZIMAGE" "$tmp_dir"/linux - echo default linux "$KCMDLINE" > "$tmp_dir"/isolinux.cfg -- cp "${FDINITRDS[@]}" "$tmp_dir"/ -+ if [ ${#FDINITRDS[@]} -gt 0 ]; then -+ cp "${FDINITRDS[@]}" "$tmp_dir"/ -+ fi - genisoimage -J -r -appid 'LINUX_BOOT' -input-charset=utf-8 \ - -quiet -o "$FIMAGE" -b isolinux.bin \ - -c boot.cat -no-emul-boot -boot-load-size 4 \ -diff --git a/arch/x86/entry/entry.S b/arch/x86/entry/entry.S -index 78fd2442b49dcd..ad292c0d971a3f 100644 ---- a/arch/x86/entry/entry.S -+++ b/arch/x86/entry/entry.S -@@ -59,7 +59,7 @@ EXPORT_SYMBOL_GPL(mds_verw_sel); - * entirely in the C code, and use an alias emitted by the linker script - * instead. - */ --#ifdef CONFIG_STACKPROTECTOR -+#if defined(CONFIG_STACKPROTECTOR) && defined(CONFIG_SMP) - EXPORT_SYMBOL(__ref_stack_chk_guard); - #endif - #endif -diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c -index f483874fa20f19..fac3d97111b098 100644 ---- a/arch/x86/events/amd/ibs.c -+++ b/arch/x86/events/amd/ibs.c -@@ -272,7 +272,7 @@ static int perf_ibs_init(struct perf_event *event) - { - struct hw_perf_event *hwc = &event->hw; - struct perf_ibs *perf_ibs; -- u64 max_cnt, config; -+ u64 config; - int ret; - - perf_ibs = get_ibs_pmu(event->attr.type); -@@ -306,10 +306,19 @@ static int perf_ibs_init(struct perf_event *event) - if (!hwc->sample_period) - hwc->sample_period = 0x10; - } else { -- max_cnt = config & perf_ibs->cnt_mask; -+ u64 period = 0; -+ -+ if (perf_ibs == &perf_ibs_op) { -+ period = (config & IBS_OP_MAX_CNT) << 4; -+ if (ibs_caps & IBS_CAPS_OPCNTEXT) -+ period |= config & IBS_OP_MAX_CNT_EXT_MASK; -+ } else { -+ period = (config & IBS_FETCH_MAX_CNT) << 4; -+ } -+ - config &= ~perf_ibs->cnt_mask; -- event->attr.sample_period = max_cnt << 4; -- hwc->sample_period = event->attr.sample_period; -+ event->attr.sample_period = period; -+ hwc->sample_period = period; - } - - if (!hwc->sample_period) -@@ -1219,7 +1228,8 @@ static __init int perf_ibs_op_init(void) - if (ibs_caps & IBS_CAPS_OPCNTEXT) { - perf_ibs_op.max_period |= IBS_OP_MAX_CNT_EXT_MASK; - perf_ibs_op.config_mask |= IBS_OP_MAX_CNT_EXT_MASK; -- perf_ibs_op.cnt_mask |= IBS_OP_MAX_CNT_EXT_MASK; -+ perf_ibs_op.cnt_mask |= (IBS_OP_MAX_CNT_EXT_MASK | -+ IBS_OP_CUR_CNT_EXT_MASK); - } - - if (ibs_caps & IBS_CAPS_ZEN4) -diff --git a/arch/x86/include/asm/bug.h b/arch/x86/include/asm/bug.h -index 806649c7f23dc6..9a0f29be1a9ea6 100644 ---- a/arch/x86/include/asm/bug.h -+++ b/arch/x86/include/asm/bug.h -@@ -22,8 +22,9 @@ - #define SECOND_BYTE_OPCODE_UD2 0x0b - - #define BUG_NONE 0xffff --#define BUG_UD1 0xfffe --#define BUG_UD2 0xfffd -+#define BUG_UD2 0xfffe -+#define BUG_UD1 0xfffd -+#define BUG_UD1_UBSAN 0xfffc - - #ifdef CONFIG_GENERIC_BUG - -diff --git a/arch/x86/include/asm/ibt.h b/arch/x86/include/asm/ibt.h -index 1e59581d500ca9..b778ae6e67ee8c 100644 ---- a/arch/x86/include/asm/ibt.h -+++ b/arch/x86/include/asm/ibt.h -@@ -41,7 +41,7 @@ - _ASM_PTR fname "\n\t" \ - ".popsection\n\t" - --static inline __attribute_const__ u32 gen_endbr(void) -+static __always_inline __attribute_const__ u32 gen_endbr(void) - { - u32 endbr; - -@@ -56,7 +56,7 @@ static inline __attribute_const__ u32 gen_endbr(void) - return endbr; - } - --static inline __attribute_const__ u32 gen_endbr_poison(void) -+static __always_inline __attribute_const__ u32 gen_endbr_poison(void) - { - /* - * 4 byte NOP that isn't NOP4 (in fact it is OSP NOP3), such that it -diff --git a/arch/x86/include/asm/nmi.h b/arch/x86/include/asm/nmi.h -index 5c5f1e56c4048d..6f3d145670a957 100644 ---- a/arch/x86/include/asm/nmi.h -+++ b/arch/x86/include/asm/nmi.h -@@ -59,6 +59,8 @@ int __register_nmi_handler(unsigned int, struct nmiaction *); - - void unregister_nmi_handler(unsigned int, const char *); - -+void set_emergency_nmi_handler(unsigned int type, nmi_handler_t handler); -+ - void stop_nmi(void); - void restart_nmi(void); - void local_touch_nmi(void); -diff --git a/arch/x86/include/asm/perf_event.h b/arch/x86/include/asm/perf_event.h -index 384e8a7db4827b..ba2a3935dc624d 100644 ---- a/arch/x86/include/asm/perf_event.h -+++ b/arch/x86/include/asm/perf_event.h -@@ -501,6 +501,7 @@ struct pebs_xmm { - */ - #define IBS_OP_CUR_CNT (0xFFF80ULL<<32) - #define IBS_OP_CUR_CNT_RAND (0x0007FULL<<32) -+#define IBS_OP_CUR_CNT_EXT_MASK (0x7FULL<<52) - #define IBS_OP_CNT_CTL (1ULL<<19) - #define IBS_OP_VAL (1ULL<<18) - #define IBS_OP_ENABLE (1ULL<<17) -diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c -index 07b45bbf6348de..e9c4bcb38f4586 100644 ---- a/arch/x86/kernel/cpu/bugs.c -+++ b/arch/x86/kernel/cpu/bugs.c -@@ -1442,9 +1442,13 @@ static __ro_after_init enum spectre_v2_mitigation_cmd spectre_v2_cmd; - static enum spectre_v2_user_cmd __init - spectre_v2_parse_user_cmdline(void) - { -+ enum spectre_v2_user_cmd mode; - char arg[20]; - int ret, i; - -+ mode = IS_ENABLED(CONFIG_MITIGATION_SPECTRE_V2) ? -+ SPECTRE_V2_USER_CMD_AUTO : SPECTRE_V2_USER_CMD_NONE; -+ - switch (spectre_v2_cmd) { - case SPECTRE_V2_CMD_NONE: - return SPECTRE_V2_USER_CMD_NONE; -@@ -1457,7 +1461,7 @@ spectre_v2_parse_user_cmdline(void) - ret = cmdline_find_option(boot_command_line, "spectre_v2_user", - arg, sizeof(arg)); - if (ret < 0) -- return SPECTRE_V2_USER_CMD_AUTO; -+ return mode; - - for (i = 0; i < ARRAY_SIZE(v2_user_options); i++) { - if (match_option(arg, ret, v2_user_options[i].option)) { -@@ -1467,8 +1471,8 @@ spectre_v2_parse_user_cmdline(void) - } - } - -- pr_err("Unknown user space protection option (%s). Switching to AUTO select\n", arg); -- return SPECTRE_V2_USER_CMD_AUTO; -+ pr_err("Unknown user space protection option (%s). Switching to default\n", arg); -+ return mode; - } - - static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode) -diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c -index 6da2cfa23c2939..35fd5f1444fdb4 100644 ---- a/arch/x86/kernel/nmi.c -+++ b/arch/x86/kernel/nmi.c -@@ -39,8 +39,12 @@ - #define CREATE_TRACE_POINTS - #include - -+/* -+ * An emergency handler can be set in any context including NMI -+ */ - struct nmi_desc { - raw_spinlock_t lock; -+ nmi_handler_t emerg_handler; - struct list_head head; - }; - -@@ -131,9 +135,22 @@ static void nmi_check_duration(struct nmiaction *action, u64 duration) - static int nmi_handle(unsigned int type, struct pt_regs *regs) - { - struct nmi_desc *desc = nmi_to_desc(type); -+ nmi_handler_t ehandler; - struct nmiaction *a; - int handled=0; - -+ /* -+ * Call the emergency handler, if set -+ * -+ * In the case of crash_nmi_callback() emergency handler, it will -+ * return in the case of the crashing CPU to enable it to complete -+ * other necessary crashing actions ASAP. Other handlers in the -+ * linked list won't need to be run. -+ */ -+ ehandler = desc->emerg_handler; -+ if (ehandler) -+ return ehandler(type, regs); -+ - rcu_read_lock(); - - /* -@@ -223,6 +240,31 @@ void unregister_nmi_handler(unsigned int type, const char *name) - } - EXPORT_SYMBOL_GPL(unregister_nmi_handler); - -+/** -+ * set_emergency_nmi_handler - Set emergency handler -+ * @type: NMI type -+ * @handler: the emergency handler to be stored -+ * -+ * Set an emergency NMI handler which, if set, will preempt all the other -+ * handlers in the linked list. If a NULL handler is passed in, it will clear -+ * it. It is expected that concurrent calls to this function will not happen -+ * or the system is screwed beyond repair. -+ */ -+void set_emergency_nmi_handler(unsigned int type, nmi_handler_t handler) -+{ -+ struct nmi_desc *desc = nmi_to_desc(type); -+ -+ if (WARN_ON_ONCE(desc->emerg_handler == handler)) -+ return; -+ desc->emerg_handler = handler; -+ -+ /* -+ * Ensure the emergency handler is visible to other CPUs before -+ * function return -+ */ -+ smp_wmb(); -+} -+ - static void - pci_serr_error(unsigned char reason, struct pt_regs *regs) - { -diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c -index 830425e6d38e2f..456e61070a730b 100644 ---- a/arch/x86/kernel/reboot.c -+++ b/arch/x86/kernel/reboot.c -@@ -908,15 +908,11 @@ void nmi_shootdown_cpus(nmi_shootdown_cb callback) - shootdown_callback = callback; - - atomic_set(&waiting_for_crash_ipi, num_online_cpus() - 1); -- /* Would it be better to replace the trap vector here? */ -- if (register_nmi_handler(NMI_LOCAL, crash_nmi_callback, -- NMI_FLAG_FIRST, "crash")) -- return; /* Return what? */ -+ - /* -- * Ensure the new callback function is set before sending -- * out the NMI -+ * Set emergency handler to preempt other handlers. - */ -- wmb(); -+ set_emergency_nmi_handler(NMI_LOCAL, crash_nmi_callback); - - apic_send_IPI_allbutself(NMI_VECTOR); - -diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c -index d8d9bc5a9b3280..8718d58dd0fbea 100644 ---- a/arch/x86/kernel/traps.c -+++ b/arch/x86/kernel/traps.c -@@ -92,10 +92,17 @@ __always_inline int is_valid_bugaddr(unsigned long addr) - - /* - * Check for UD1 or UD2, accounting for Address Size Override Prefixes. -- * If it's a UD1, get the ModRM byte to pass along to UBSan. -+ * If it's a UD1, further decode to determine its use: -+ * -+ * UBSan{0}: 67 0f b9 00 ud1 (%eax),%eax -+ * UBSan{10}: 67 0f b9 40 10 ud1 0x10(%eax),%eax -+ * static_call: 0f b9 cc ud1 %esp,%ecx -+ * -+ * Notably UBSAN uses EAX, static_call uses ECX. - */ --__always_inline int decode_bug(unsigned long addr, u32 *imm) -+__always_inline int decode_bug(unsigned long addr, s32 *imm, int *len) - { -+ unsigned long start = addr; - u8 v; - - if (addr < TASK_SIZE_MAX) -@@ -108,24 +115,42 @@ __always_inline int decode_bug(unsigned long addr, u32 *imm) - return BUG_NONE; - - v = *(u8 *)(addr++); -- if (v == SECOND_BYTE_OPCODE_UD2) -+ if (v == SECOND_BYTE_OPCODE_UD2) { -+ *len = addr - start; - return BUG_UD2; -+ } - -- if (!IS_ENABLED(CONFIG_UBSAN_TRAP) || v != SECOND_BYTE_OPCODE_UD1) -+ if (v != SECOND_BYTE_OPCODE_UD1) - return BUG_NONE; - -- /* Retrieve the immediate (type value) for the UBSAN UD1 */ -- v = *(u8 *)(addr++); -- if (X86_MODRM_RM(v) == 4) -- addr++; -- - *imm = 0; -- if (X86_MODRM_MOD(v) == 1) -- *imm = *(u8 *)addr; -- else if (X86_MODRM_MOD(v) == 2) -- *imm = *(u32 *)addr; -- else -- WARN_ONCE(1, "Unexpected MODRM_MOD: %u\n", X86_MODRM_MOD(v)); -+ v = *(u8 *)(addr++); /* ModRM */ -+ -+ if (X86_MODRM_MOD(v) != 3 && X86_MODRM_RM(v) == 4) -+ addr++; /* SIB */ -+ -+ /* Decode immediate, if present */ -+ switch (X86_MODRM_MOD(v)) { -+ case 0: if (X86_MODRM_RM(v) == 5) -+ addr += 4; /* RIP + disp32 */ -+ break; -+ -+ case 1: *imm = *(s8 *)addr; -+ addr += 1; -+ break; -+ -+ case 2: *imm = *(s32 *)addr; -+ addr += 4; -+ break; -+ -+ case 3: break; -+ } -+ -+ /* record instruction length */ -+ *len = addr - start; -+ -+ if (X86_MODRM_REG(v) == 0) /* EAX */ -+ return BUG_UD1_UBSAN; - - return BUG_UD1; - } -@@ -256,10 +281,10 @@ static inline void handle_invalid_op(struct pt_regs *regs) - static noinstr bool handle_bug(struct pt_regs *regs) - { - bool handled = false; -- int ud_type; -- u32 imm; -+ int ud_type, ud_len; -+ s32 ud_imm; - -- ud_type = decode_bug(regs->ip, &imm); -+ ud_type = decode_bug(regs->ip, &ud_imm, &ud_len); - if (ud_type == BUG_NONE) - return handled; - -@@ -279,15 +304,28 @@ static noinstr bool handle_bug(struct pt_regs *regs) - */ - if (regs->flags & X86_EFLAGS_IF) - raw_local_irq_enable(); -- if (ud_type == BUG_UD2) { -+ -+ switch (ud_type) { -+ case BUG_UD2: - if (report_bug(regs->ip, regs) == BUG_TRAP_TYPE_WARN || - handle_cfi_failure(regs) == BUG_TRAP_TYPE_WARN) { -- regs->ip += LEN_UD2; -+ regs->ip += ud_len; - handled = true; - } -- } else if (IS_ENABLED(CONFIG_UBSAN_TRAP)) { -- pr_crit("%s at %pS\n", report_ubsan_failure(regs, imm), (void *)regs->ip); -+ break; -+ -+ case BUG_UD1_UBSAN: -+ if (IS_ENABLED(CONFIG_UBSAN_TRAP)) { -+ pr_crit("%s at %pS\n", -+ report_ubsan_failure(regs, ud_imm), -+ (void *)regs->ip); -+ } -+ break; -+ -+ default: -+ break; - } -+ - if (regs->flags & X86_EFLAGS_IF) - raw_local_irq_disable(); - instrumentation_end(); -diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c -index 71d29dd7ad761e..6cbb5974e4f9ea 100644 ---- a/arch/x86/mm/init.c -+++ b/arch/x86/mm/init.c -@@ -644,8 +644,13 @@ static void __init memory_map_top_down(unsigned long map_start, - */ - addr = memblock_phys_alloc_range(PMD_SIZE, PMD_SIZE, map_start, - map_end); -- memblock_phys_free(addr, PMD_SIZE); -- real_end = addr + PMD_SIZE; -+ if (!addr) { -+ pr_warn("Failed to release memory for alloc_low_pages()"); -+ real_end = max(map_start, ALIGN_DOWN(map_end, PMD_SIZE)); -+ } else { -+ memblock_phys_free(addr, PMD_SIZE); -+ real_end = addr + PMD_SIZE; -+ } - - /* step_size need to be small so pgt_buf from BRK could cover it */ - step_size = PMD_SIZE; -diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c -index aa69353da49f24..11eb93e13ce175 100644 ---- a/arch/x86/mm/init_64.c -+++ b/arch/x86/mm/init_64.c -@@ -959,9 +959,18 @@ int add_pages(int nid, unsigned long start_pfn, unsigned long nr_pages, - ret = __add_pages(nid, start_pfn, nr_pages, params); - WARN_ON_ONCE(ret); - -- /* update max_pfn, max_low_pfn and high_memory */ -- update_end_of_memory_vars(start_pfn << PAGE_SHIFT, -- nr_pages << PAGE_SHIFT); -+ /* -+ * Special case: add_pages() is called by memremap_pages() for adding device -+ * private pages. Do not bump up max_pfn in the device private path, -+ * because max_pfn changes affect dma_addressing_limited(). -+ * -+ * dma_addressing_limited() returning true when max_pfn is the device's -+ * addressable memory can force device drivers to use bounce buffers -+ * and impact their performance negatively: -+ */ -+ if (!params->pgmap) -+ /* update max_pfn, max_low_pfn and high_memory */ -+ update_end_of_memory_vars(start_pfn << PAGE_SHIFT, nr_pages << PAGE_SHIFT); - - return ret; - } -diff --git a/arch/x86/mm/kaslr.c b/arch/x86/mm/kaslr.c -index 230f1dee4f0954..e0b0ec0f824574 100644 ---- a/arch/x86/mm/kaslr.c -+++ b/arch/x86/mm/kaslr.c -@@ -109,8 +109,14 @@ void __init kernel_randomize_memory(void) - memory_tb = DIV_ROUND_UP(max_pfn << PAGE_SHIFT, 1UL << TB_SHIFT) + - CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING; - -- /* Adapt physical memory region size based on available memory */ -- if (memory_tb < kaslr_regions[0].size_tb) -+ /* -+ * Adapt physical memory region size based on available memory, -+ * except when CONFIG_PCI_P2PDMA is enabled. P2PDMA exposes the -+ * device BAR space assuming the direct map space is large enough -+ * for creating a ZONE_DEVICE mapping in the direct map corresponding -+ * to the physical BAR address. -+ */ -+ if (!IS_ENABLED(CONFIG_PCI_P2PDMA) && (memory_tb < kaslr_regions[0].size_tb)) - kaslr_regions[0].size_tb = memory_tb; - - /* -diff --git a/arch/x86/um/os-Linux/mcontext.c b/arch/x86/um/os-Linux/mcontext.c -index 49c3744cac371b..81b9d1f9f4e68b 100644 ---- a/arch/x86/um/os-Linux/mcontext.c -+++ b/arch/x86/um/os-Linux/mcontext.c -@@ -26,7 +26,6 @@ void get_regs_from_mc(struct uml_pt_regs *regs, mcontext_t *mc) - COPY(RIP); - COPY2(EFLAGS, EFL); - COPY2(CS, CSGSFS); -- regs->gp[CS / sizeof(unsigned long)] &= 0xffff; -- regs->gp[CS / sizeof(unsigned long)] |= 3; -+ regs->gp[SS / sizeof(unsigned long)] = mc->gregs[REG_CSGSFS] >> 48; - #endif - } -diff --git a/crypto/ahash.c b/crypto/ahash.c -index 709ef094079913..6168f3532f552a 100644 ---- a/crypto/ahash.c -+++ b/crypto/ahash.c -@@ -427,6 +427,7 @@ static int crypto_ahash_init_tfm(struct crypto_tfm *tfm) - hash->setkey = ahash_nosetkey; - - crypto_ahash_set_statesize(hash, alg->halg.statesize); -+ crypto_ahash_set_reqsize(hash, alg->reqsize); - - if (tfm->__crt_alg->cra_type != &crypto_ahash_type) - return crypto_init_shash_ops_async(tfm); -@@ -599,6 +600,9 @@ static int ahash_prepare_alg(struct ahash_alg *alg) - if (alg->halg.statesize == 0) - return -EINVAL; - -+ if (alg->reqsize && alg->reqsize < alg->halg.statesize) -+ return -EINVAL; -+ - err = hash_prepare_alg(&alg->halg); - if (err) - return err; -diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c -index e24c829d7a0154..5ab7441734b8e0 100644 ---- a/crypto/algif_hash.c -+++ b/crypto/algif_hash.c -@@ -265,10 +265,6 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags, - goto out_free_state; - - err = crypto_ahash_import(&ctx2->req, state); -- if (err) { -- sock_orphan(sk2); -- sock_put(sk2); -- } - - out_free_state: - kfree_sensitive(state); -diff --git a/crypto/lzo-rle.c b/crypto/lzo-rle.c -index 0631d975bfac11..0abc2d87f04200 100644 ---- a/crypto/lzo-rle.c -+++ b/crypto/lzo-rle.c -@@ -55,7 +55,7 @@ static int __lzorle_compress(const u8 *src, unsigned int slen, - size_t tmp_len = *dlen; /* size_t(ulong) <-> uint on 64 bit */ - int err; - -- err = lzorle1x_1_compress(src, slen, dst, &tmp_len, ctx); -+ err = lzorle1x_1_compress_safe(src, slen, dst, &tmp_len, ctx); - - if (err != LZO_E_OK) - return -EINVAL; -diff --git a/crypto/lzo.c b/crypto/lzo.c -index ebda132dd22bf5..8338851c7406a3 100644 ---- a/crypto/lzo.c -+++ b/crypto/lzo.c -@@ -55,7 +55,7 @@ static int __lzo_compress(const u8 *src, unsigned int slen, - size_t tmp_len = *dlen; /* size_t(ulong) <-> uint on 64 bit */ - int err; - -- err = lzo1x_1_compress(src, slen, dst, &tmp_len, ctx); -+ err = lzo1x_1_compress_safe(src, slen, dst, &tmp_len, ctx); - - if (err != LZO_E_OK) - return -EINVAL; -diff --git a/crypto/skcipher.c b/crypto/skcipher.c -index 7b275716cf4e3a..acc879ed6031a9 100644 ---- a/crypto/skcipher.c -+++ b/crypto/skcipher.c -@@ -811,6 +811,7 @@ struct crypto_sync_skcipher *crypto_alloc_sync_skcipher( - - /* Only sync algorithms allowed. */ - mask |= CRYPTO_ALG_ASYNC | CRYPTO_ALG_SKCIPHER_REQSIZE_LARGE; -+ type &= ~(CRYPTO_ALG_ASYNC | CRYPTO_ALG_SKCIPHER_REQSIZE_LARGE); - - tfm = crypto_alloc_tfm(alg_name, &crypto_skcipher_type, type, mask); - -diff --git a/drivers/accel/qaic/qaic_drv.c b/drivers/accel/qaic/qaic_drv.c -index b5de82e6eb4d56..e69bfb30b44e07 100644 ---- a/drivers/accel/qaic/qaic_drv.c -+++ b/drivers/accel/qaic/qaic_drv.c -@@ -400,7 +400,7 @@ static int init_pci(struct qaic_device *qdev, struct pci_dev *pdev) - int bars; - int ret; - -- bars = pci_select_bars(pdev, IORESOURCE_MEM); -+ bars = pci_select_bars(pdev, IORESOURCE_MEM) & 0x3f; - - /* make sure the device has the expected BARs */ - if (bars != (BIT(0) | BIT(2) | BIT(4))) { -diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig -index cee82b473dc509..648228831f5e87 100644 ---- a/drivers/acpi/Kconfig -+++ b/drivers/acpi/Kconfig -@@ -438,7 +438,7 @@ config ACPI_SBS - the modules will be called sbs and sbshc. - - config ACPI_HED -- tristate "Hardware Error Device" -+ bool "Hardware Error Device" - help - This driver supports the Hardware Error Device (PNP0C33), - which is used to report some hardware errors notified via -diff --git a/drivers/acpi/acpi_pnp.c b/drivers/acpi/acpi_pnp.c -index 01abf26764b00c..3f5a1840f57330 100644 ---- a/drivers/acpi/acpi_pnp.c -+++ b/drivers/acpi/acpi_pnp.c -@@ -355,8 +355,10 @@ static bool acpi_pnp_match(const char *idstr, const struct acpi_device_id **matc - * device represented by it. - */ - static const struct acpi_device_id acpi_nonpnp_device_ids[] = { -+ {"INT3F0D"}, - {"INTC1080"}, - {"INTC1081"}, -+ {"INTC1099"}, - {""}, - }; - -diff --git a/drivers/acpi/hed.c b/drivers/acpi/hed.c -index 46c6f8c35b4368..2e01eaa8d8cd51 100644 ---- a/drivers/acpi/hed.c -+++ b/drivers/acpi/hed.c -@@ -80,7 +80,12 @@ static struct acpi_driver acpi_hed_driver = { - .remove = acpi_hed_remove, - }, - }; --module_acpi_driver(acpi_hed_driver); -+ -+static int __init acpi_hed_driver_init(void) -+{ -+ return acpi_bus_register_driver(&acpi_hed_driver); -+} -+subsys_initcall(acpi_hed_driver_init); - - MODULE_AUTHOR("Huang Ying"); - MODULE_DESCRIPTION("ACPI Hardware Error Device Driver"); -diff --git a/drivers/auxdisplay/charlcd.c b/drivers/auxdisplay/charlcd.c -index 6d309e4971b617..e243291a7e77c9 100644 ---- a/drivers/auxdisplay/charlcd.c -+++ b/drivers/auxdisplay/charlcd.c -@@ -594,18 +594,19 @@ static int charlcd_init(struct charlcd *lcd) - return 0; - } - --struct charlcd *charlcd_alloc(void) -+struct charlcd *charlcd_alloc(unsigned int drvdata_size) - { - struct charlcd_priv *priv; - struct charlcd *lcd; - -- priv = kzalloc(sizeof(*priv), GFP_KERNEL); -+ priv = kzalloc(sizeof(*priv) + drvdata_size, GFP_KERNEL); - if (!priv) - return NULL; - - priv->esc_seq.len = -1; - - lcd = &priv->lcd; -+ lcd->drvdata = priv->drvdata; - - return lcd; - } -diff --git a/drivers/auxdisplay/charlcd.h b/drivers/auxdisplay/charlcd.h -index eed80063a6d20d..4bbf106b2dd8a2 100644 ---- a/drivers/auxdisplay/charlcd.h -+++ b/drivers/auxdisplay/charlcd.h -@@ -49,7 +49,7 @@ struct charlcd { - unsigned long y; - } addr; - -- void *drvdata; -+ void *drvdata; /* Set by charlcd_alloc() */ - }; - - /** -@@ -93,7 +93,8 @@ struct charlcd_ops { - }; - - void charlcd_backlight(struct charlcd *lcd, enum charlcd_onoff on); --struct charlcd *charlcd_alloc(void); -+ -+struct charlcd *charlcd_alloc(unsigned int drvdata_size); - void charlcd_free(struct charlcd *lcd); - - int charlcd_register(struct charlcd *lcd); -diff --git a/drivers/auxdisplay/hd44780.c b/drivers/auxdisplay/hd44780.c -index 8b690f59df27d6..ebaf0ff518f4c2 100644 ---- a/drivers/auxdisplay/hd44780.c -+++ b/drivers/auxdisplay/hd44780.c -@@ -226,7 +226,7 @@ static int hd44780_probe(struct platform_device *pdev) - if (!hdc) - return -ENOMEM; - -- lcd = charlcd_alloc(); -+ lcd = charlcd_alloc(0); - if (!lcd) - goto fail1; - -diff --git a/drivers/auxdisplay/lcd2s.c b/drivers/auxdisplay/lcd2s.c -index 6422be0dfe20e6..0ecf6a9469f24c 100644 ---- a/drivers/auxdisplay/lcd2s.c -+++ b/drivers/auxdisplay/lcd2s.c -@@ -307,7 +307,7 @@ static int lcd2s_i2c_probe(struct i2c_client *i2c) - if (err < 0) - return err; - -- lcd = charlcd_alloc(); -+ lcd = charlcd_alloc(0); - if (!lcd) - return -ENOMEM; - -diff --git a/drivers/auxdisplay/panel.c b/drivers/auxdisplay/panel.c -index eba04c0de7eb3f..0f3999b665e70f 100644 ---- a/drivers/auxdisplay/panel.c -+++ b/drivers/auxdisplay/panel.c -@@ -835,7 +835,7 @@ static void lcd_init(void) - if (!hdc) - return; - -- charlcd = charlcd_alloc(); -+ charlcd = charlcd_alloc(0); - if (!charlcd) { - kfree(hdc); - return; -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index d6195565ef7aeb..e0dd6988960883 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -3525,9 +3525,8 @@ static void btusb_coredump_qca(struct hci_dev *hdev) - static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb) - { - int ret = 0; -+ unsigned int skip = 0; - u8 pkt_type; -- u8 *sk_ptr; -- unsigned int sk_len; - u16 seqno; - u32 dump_size; - -@@ -3536,18 +3535,13 @@ static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb) - struct usb_device *udev = btdata->udev; - - pkt_type = hci_skb_pkt_type(skb); -- sk_ptr = skb->data; -- sk_len = skb->len; -+ skip = sizeof(struct hci_event_hdr); -+ if (pkt_type == HCI_ACLDATA_PKT) -+ skip += sizeof(struct hci_acl_hdr); - -- if (pkt_type == HCI_ACLDATA_PKT) { -- sk_ptr += HCI_ACL_HDR_SIZE; -- sk_len -= HCI_ACL_HDR_SIZE; -- } -- -- sk_ptr += HCI_EVENT_HDR_SIZE; -- sk_len -= HCI_EVENT_HDR_SIZE; -+ skb_pull(skb, skip); -+ dump_hdr = (struct qca_dump_hdr *)skb->data; - -- dump_hdr = (struct qca_dump_hdr *)sk_ptr; - seqno = le16_to_cpu(dump_hdr->seqno); - if (seqno == 0) { - set_bit(BTUSB_HW_SSR_ACTIVE, &btdata->flags); -@@ -3567,16 +3561,15 @@ static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb) - - btdata->qca_dump.ram_dump_size = dump_size; - btdata->qca_dump.ram_dump_seqno = 0; -- sk_ptr += offsetof(struct qca_dump_hdr, data0); -- sk_len -= offsetof(struct qca_dump_hdr, data0); -+ -+ skb_pull(skb, offsetof(struct qca_dump_hdr, data0)); - - usb_disable_autosuspend(udev); - bt_dev_info(hdev, "%s memdump size(%u)\n", - (pkt_type == HCI_ACLDATA_PKT) ? "ACL" : "event", - dump_size); - } else { -- sk_ptr += offsetof(struct qca_dump_hdr, data); -- sk_len -= offsetof(struct qca_dump_hdr, data); -+ skb_pull(skb, offsetof(struct qca_dump_hdr, data)); - } - - if (!btdata->qca_dump.ram_dump_size) { -@@ -3596,7 +3589,6 @@ static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb) - return ret; - } - -- skb_pull(skb, skb->len - sk_len); - hci_devcd_append(hdev, skb); - btdata->qca_dump.ram_dump_seqno++; - if (seqno == QCA_LAST_SEQUENCE_NUM) { -@@ -3624,68 +3616,58 @@ static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb) - /* Return: true if the ACL packet is a dump packet, false otherwise. */ - static bool acl_pkt_is_dump_qca(struct hci_dev *hdev, struct sk_buff *skb) - { -- u8 *sk_ptr; -- unsigned int sk_len; -- - struct hci_event_hdr *event_hdr; - struct hci_acl_hdr *acl_hdr; - struct qca_dump_hdr *dump_hdr; -+ struct sk_buff *clone = skb_clone(skb, GFP_ATOMIC); -+ bool is_dump = false; - -- sk_ptr = skb->data; -- sk_len = skb->len; -- -- acl_hdr = hci_acl_hdr(skb); -- if (le16_to_cpu(acl_hdr->handle) != QCA_MEMDUMP_ACL_HANDLE) -+ if (!clone) - return false; - -- sk_ptr += HCI_ACL_HDR_SIZE; -- sk_len -= HCI_ACL_HDR_SIZE; -- event_hdr = (struct hci_event_hdr *)sk_ptr; -- -- if ((event_hdr->evt != HCI_VENDOR_PKT) || -- (event_hdr->plen != (sk_len - HCI_EVENT_HDR_SIZE))) -- return false; -+ acl_hdr = skb_pull_data(clone, sizeof(*acl_hdr)); -+ if (!acl_hdr || (le16_to_cpu(acl_hdr->handle) != QCA_MEMDUMP_ACL_HANDLE)) -+ goto out; - -- sk_ptr += HCI_EVENT_HDR_SIZE; -- sk_len -= HCI_EVENT_HDR_SIZE; -+ event_hdr = skb_pull_data(clone, sizeof(*event_hdr)); -+ if (!event_hdr || (event_hdr->evt != HCI_VENDOR_PKT)) -+ goto out; - -- dump_hdr = (struct qca_dump_hdr *)sk_ptr; -- if ((sk_len < offsetof(struct qca_dump_hdr, data)) || -- (dump_hdr->vse_class != QCA_MEMDUMP_VSE_CLASS) || -- (dump_hdr->msg_type != QCA_MEMDUMP_MSG_TYPE)) -- return false; -+ dump_hdr = skb_pull_data(clone, sizeof(*dump_hdr)); -+ if (!dump_hdr || (dump_hdr->vse_class != QCA_MEMDUMP_VSE_CLASS) || -+ (dump_hdr->msg_type != QCA_MEMDUMP_MSG_TYPE)) -+ goto out; - -- return true; -+ is_dump = true; -+out: -+ consume_skb(clone); -+ return is_dump; - } - - /* Return: true if the event packet is a dump packet, false otherwise. */ - static bool evt_pkt_is_dump_qca(struct hci_dev *hdev, struct sk_buff *skb) - { -- u8 *sk_ptr; -- unsigned int sk_len; -- - struct hci_event_hdr *event_hdr; - struct qca_dump_hdr *dump_hdr; -+ struct sk_buff *clone = skb_clone(skb, GFP_ATOMIC); -+ bool is_dump = false; - -- sk_ptr = skb->data; -- sk_len = skb->len; -- -- event_hdr = hci_event_hdr(skb); -- -- if ((event_hdr->evt != HCI_VENDOR_PKT) -- || (event_hdr->plen != (sk_len - HCI_EVENT_HDR_SIZE))) -+ if (!clone) - return false; - -- sk_ptr += HCI_EVENT_HDR_SIZE; -- sk_len -= HCI_EVENT_HDR_SIZE; -+ event_hdr = skb_pull_data(clone, sizeof(*event_hdr)); -+ if (!event_hdr || (event_hdr->evt != HCI_VENDOR_PKT)) -+ goto out; - -- dump_hdr = (struct qca_dump_hdr *)sk_ptr; -- if ((sk_len < offsetof(struct qca_dump_hdr, data)) || -- (dump_hdr->vse_class != QCA_MEMDUMP_VSE_CLASS) || -- (dump_hdr->msg_type != QCA_MEMDUMP_MSG_TYPE)) -- return false; -+ dump_hdr = skb_pull_data(clone, sizeof(*dump_hdr)); -+ if (!dump_hdr || (dump_hdr->vse_class != QCA_MEMDUMP_VSE_CLASS) || -+ (dump_hdr->msg_type != QCA_MEMDUMP_MSG_TYPE)) -+ goto out; - -- return true; -+ is_dump = true; -+out: -+ consume_skb(clone); -+ return is_dump; - } - - static int btusb_recv_acl_qca(struct hci_dev *hdev, struct sk_buff *skb) -diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c -index 38c456540d1b98..337144570fafa2 100644 ---- a/drivers/clk/clk-s2mps11.c -+++ b/drivers/clk/clk-s2mps11.c -@@ -137,6 +137,8 @@ static int s2mps11_clk_probe(struct platform_device *pdev) - if (!clk_data) - return -ENOMEM; - -+ clk_data->num = S2MPS11_CLKS_NUM; -+ - switch (hwid) { - case S2MPS11X: - s2mps11_reg = S2MPS11_REG_RTC_CTRL; -@@ -186,7 +188,6 @@ static int s2mps11_clk_probe(struct platform_device *pdev) - clk_data->hws[i] = &s2mps11_clks[i].hw; - } - -- clk_data->num = S2MPS11_CLKS_NUM; - of_clk_add_hw_provider(s2mps11_clks->clk_np, of_clk_hw_onecell_get, - clk_data); - -diff --git a/drivers/clk/imx/clk-imx8mp.c b/drivers/clk/imx/clk-imx8mp.c -index 747f5397692e5f..2a0804dd4b8462 100644 ---- a/drivers/clk/imx/clk-imx8mp.c -+++ b/drivers/clk/imx/clk-imx8mp.c -@@ -8,6 +8,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -406,11 +407,151 @@ static const char * const imx8mp_clkout_sels[] = {"audio_pll1_out", "audio_pll2_ - static struct clk_hw **hws; - static struct clk_hw_onecell_data *clk_hw_data; - -+struct imx8mp_clock_constraints { -+ unsigned int clkid; -+ u32 maxrate; -+}; -+ -+/* -+ * Below tables are taken from IMX8MPCEC Rev. 2.1, 07/2023 -+ * Table 13. Maximum frequency of modules. -+ * Probable typos fixed are marked with a comment. -+ */ -+static const struct imx8mp_clock_constraints imx8mp_clock_common_constraints[] = { -+ { IMX8MP_CLK_A53_DIV, 1000 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_ENET_AXI, 266666667 }, /* Datasheet claims 266MHz */ -+ { IMX8MP_CLK_NAND_USDHC_BUS, 266666667 }, /* Datasheet claims 266MHz */ -+ { IMX8MP_CLK_MEDIA_APB, 200 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_HDMI_APB, 133333333 }, /* Datasheet claims 133MHz */ -+ { IMX8MP_CLK_ML_AXI, 800 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_AHB, 133333333 }, -+ { IMX8MP_CLK_IPG_ROOT, 66666667 }, -+ { IMX8MP_CLK_AUDIO_AHB, 400 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_MEDIA_DISP2_PIX, 170 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_DRAM_ALT, 666666667 }, -+ { IMX8MP_CLK_DRAM_APB, 200 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_CAN1, 80 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_CAN2, 80 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_PCIE_AUX, 10 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_I2C5, 66666667 }, /* Datasheet claims 66MHz */ -+ { IMX8MP_CLK_I2C6, 66666667 }, /* Datasheet claims 66MHz */ -+ { IMX8MP_CLK_SAI1, 66666667 }, /* Datasheet claims 66MHz */ -+ { IMX8MP_CLK_SAI2, 66666667 }, /* Datasheet claims 66MHz */ -+ { IMX8MP_CLK_SAI3, 66666667 }, /* Datasheet claims 66MHz */ -+ { IMX8MP_CLK_SAI5, 66666667 }, /* Datasheet claims 66MHz */ -+ { IMX8MP_CLK_SAI6, 66666667 }, /* Datasheet claims 66MHz */ -+ { IMX8MP_CLK_ENET_QOS, 125 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_ENET_QOS_TIMER, 200 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_ENET_REF, 125 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_ENET_TIMER, 125 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_ENET_PHY_REF, 125 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_NAND, 500 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_QSPI, 400 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_USDHC1, 400 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_USDHC2, 400 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_I2C1, 66666667 }, /* Datasheet claims 66MHz */ -+ { IMX8MP_CLK_I2C2, 66666667 }, /* Datasheet claims 66MHz */ -+ { IMX8MP_CLK_I2C3, 66666667 }, /* Datasheet claims 66MHz */ -+ { IMX8MP_CLK_I2C4, 66666667 }, /* Datasheet claims 66MHz */ -+ { IMX8MP_CLK_UART1, 80 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_UART2, 80 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_UART3, 80 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_UART4, 80 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_ECSPI1, 80 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_ECSPI2, 80 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_PWM1, 66666667 }, /* Datasheet claims 66MHz */ -+ { IMX8MP_CLK_PWM2, 66666667 }, /* Datasheet claims 66MHz */ -+ { IMX8MP_CLK_PWM3, 66666667 }, /* Datasheet claims 66MHz */ -+ { IMX8MP_CLK_PWM4, 66666667 }, /* Datasheet claims 66MHz */ -+ { IMX8MP_CLK_GPT1, 100 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_GPT2, 100 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_GPT3, 100 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_GPT4, 100 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_GPT5, 100 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_GPT6, 100 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_WDOG, 66666667 }, /* Datasheet claims 66MHz */ -+ { IMX8MP_CLK_IPP_DO_CLKO1, 200 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_IPP_DO_CLKO2, 200 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_HDMI_REF_266M, 266 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_USDHC3, 400 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_MEDIA_MIPI_PHY1_REF, 300 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_MEDIA_DISP1_PIX, 250 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_MEDIA_CAM2_PIX, 277 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_MEDIA_LDB, 595 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_MEDIA_MIPI_TEST_BYTE, 200 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_ECSPI3, 80 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_PDM, 200 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_SAI7, 66666667 }, /* Datasheet claims 66MHz */ -+ { IMX8MP_CLK_MAIN_AXI, 400 * HZ_PER_MHZ }, -+ { /* Sentinel */ } -+}; -+ -+static const struct imx8mp_clock_constraints imx8mp_clock_nominal_constraints[] = { -+ { IMX8MP_CLK_M7_CORE, 600 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_ML_CORE, 800 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_GPU3D_CORE, 800 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_GPU3D_SHADER_CORE, 800 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_GPU2D_CORE, 800 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_AUDIO_AXI_SRC, 600 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_HSIO_AXI, 400 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_MEDIA_ISP, 400 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_VPU_BUS, 600 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_MEDIA_AXI, 400 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_HDMI_AXI, 400 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_GPU_AXI, 600 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_GPU_AHB, 300 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_NOC, 800 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_NOC_IO, 600 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_ML_AHB, 300 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_VPU_G1, 600 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_VPU_G2, 500 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_MEDIA_CAM1_PIX, 400 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_VPU_VC8000E, 400 * HZ_PER_MHZ }, /* Datasheet claims 500MHz */ -+ { IMX8MP_CLK_DRAM_CORE, 800 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_GIC, 400 * HZ_PER_MHZ }, -+ { /* Sentinel */ } -+}; -+ -+static const struct imx8mp_clock_constraints imx8mp_clock_overdrive_constraints[] = { -+ { IMX8MP_CLK_M7_CORE, 800 * HZ_PER_MHZ}, -+ { IMX8MP_CLK_ML_CORE, 1000 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_GPU3D_CORE, 1000 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_GPU3D_SHADER_CORE, 1000 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_GPU2D_CORE, 1000 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_AUDIO_AXI_SRC, 800 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_HSIO_AXI, 500 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_MEDIA_ISP, 500 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_VPU_BUS, 800 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_MEDIA_AXI, 500 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_HDMI_AXI, 500 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_GPU_AXI, 800 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_GPU_AHB, 400 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_NOC, 1000 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_NOC_IO, 800 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_ML_AHB, 400 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_VPU_G1, 800 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_VPU_G2, 700 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_MEDIA_CAM1_PIX, 500 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_VPU_VC8000E, 500 * HZ_PER_MHZ }, /* Datasheet claims 400MHz */ -+ { IMX8MP_CLK_DRAM_CORE, 1000 * HZ_PER_MHZ }, -+ { IMX8MP_CLK_GIC, 500 * HZ_PER_MHZ }, -+ { /* Sentinel */ } -+}; -+ -+static void imx8mp_clocks_apply_constraints(const struct imx8mp_clock_constraints constraints[]) -+{ -+ const struct imx8mp_clock_constraints *constr; -+ -+ for (constr = constraints; constr->clkid; constr++) -+ clk_hw_set_rate_range(hws[constr->clkid], 0, constr->maxrate); -+} -+ - static int imx8mp_clocks_probe(struct platform_device *pdev) - { - struct device *dev = &pdev->dev; - struct device_node *np; - void __iomem *anatop_base, *ccm_base; -+ const char *opmode; - int err; - - np = of_find_compatible_node(NULL, NULL, "fsl,imx8mp-anatop"); -@@ -715,6 +856,16 @@ static int imx8mp_clocks_probe(struct platform_device *pdev) - - imx_check_clk_hws(hws, IMX8MP_CLK_END); - -+ imx8mp_clocks_apply_constraints(imx8mp_clock_common_constraints); -+ -+ err = of_property_read_string(np, "fsl,operating-mode", &opmode); -+ if (!err) { -+ if (!strcmp(opmode, "nominal")) -+ imx8mp_clocks_apply_constraints(imx8mp_clock_nominal_constraints); -+ else if (!strcmp(opmode, "overdrive")) -+ imx8mp_clocks_apply_constraints(imx8mp_clock_overdrive_constraints); -+ } -+ - err = of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_hw_data); - if (err < 0) { - dev_err(dev, "failed to register hws for i.MX8MP\n"); -diff --git a/drivers/clk/qcom/Kconfig b/drivers/clk/qcom/Kconfig -index 1de1661037b1b1..95cbea8d380c37 100644 ---- a/drivers/clk/qcom/Kconfig -+++ b/drivers/clk/qcom/Kconfig -@@ -148,7 +148,7 @@ config IPQ_GCC_4019 - - config IPQ_GCC_5018 - tristate "IPQ5018 Global Clock Controller" -- depends on ARM64 || COMPILE_TEST -+ depends on ARM || ARM64 || COMPILE_TEST - help - Support for global clock controller on ipq5018 devices. - Say Y if you want to use peripheral devices such as UART, SPI, -diff --git a/drivers/clk/qcom/camcc-sm8250.c b/drivers/clk/qcom/camcc-sm8250.c -index 9b32c56a5bc5af..e29706d7828707 100644 ---- a/drivers/clk/qcom/camcc-sm8250.c -+++ b/drivers/clk/qcom/camcc-sm8250.c -@@ -411,7 +411,7 @@ static struct clk_rcg2 cam_cc_bps_clk_src = { - .parent_data = cam_cc_parent_data_0, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -433,7 +433,7 @@ static struct clk_rcg2 cam_cc_camnoc_axi_clk_src = { - .parent_data = cam_cc_parent_data_0, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -454,7 +454,7 @@ static struct clk_rcg2 cam_cc_cci_0_clk_src = { - .parent_data = cam_cc_parent_data_0, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -469,7 +469,7 @@ static struct clk_rcg2 cam_cc_cci_1_clk_src = { - .parent_data = cam_cc_parent_data_0, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -490,7 +490,7 @@ static struct clk_rcg2 cam_cc_cphy_rx_clk_src = { - .parent_data = cam_cc_parent_data_0, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -511,7 +511,7 @@ static struct clk_rcg2 cam_cc_csi0phytimer_clk_src = { - .parent_data = cam_cc_parent_data_0, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -526,7 +526,7 @@ static struct clk_rcg2 cam_cc_csi1phytimer_clk_src = { - .parent_data = cam_cc_parent_data_0, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -556,7 +556,7 @@ static struct clk_rcg2 cam_cc_csi3phytimer_clk_src = { - .parent_data = cam_cc_parent_data_0, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -571,7 +571,7 @@ static struct clk_rcg2 cam_cc_csi4phytimer_clk_src = { - .parent_data = cam_cc_parent_data_0, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -586,7 +586,7 @@ static struct clk_rcg2 cam_cc_csi5phytimer_clk_src = { - .parent_data = cam_cc_parent_data_0, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -611,7 +611,7 @@ static struct clk_rcg2 cam_cc_fast_ahb_clk_src = { - .parent_data = cam_cc_parent_data_0, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -634,7 +634,7 @@ static struct clk_rcg2 cam_cc_fd_core_clk_src = { - .parent_data = cam_cc_parent_data_0, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -649,7 +649,7 @@ static struct clk_rcg2 cam_cc_icp_clk_src = { - .parent_data = cam_cc_parent_data_0, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -673,7 +673,7 @@ static struct clk_rcg2 cam_cc_ife_0_clk_src = { - .parent_data = cam_cc_parent_data_2, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_2), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -710,7 +710,7 @@ static struct clk_rcg2 cam_cc_ife_0_csid_clk_src = { - .parent_data = cam_cc_parent_data_0, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -734,7 +734,7 @@ static struct clk_rcg2 cam_cc_ife_1_clk_src = { - .parent_data = cam_cc_parent_data_3, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_3), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -749,7 +749,7 @@ static struct clk_rcg2 cam_cc_ife_1_csid_clk_src = { - .parent_data = cam_cc_parent_data_0, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -771,7 +771,7 @@ static struct clk_rcg2 cam_cc_ife_lite_clk_src = { - .parent_data = cam_cc_parent_data_0, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -786,7 +786,7 @@ static struct clk_rcg2 cam_cc_ife_lite_csid_clk_src = { - .parent_data = cam_cc_parent_data_0, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -810,7 +810,7 @@ static struct clk_rcg2 cam_cc_ipe_0_clk_src = { - .parent_data = cam_cc_parent_data_4, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_4), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -825,7 +825,7 @@ static struct clk_rcg2 cam_cc_jpeg_clk_src = { - .parent_data = cam_cc_parent_data_0, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -847,7 +847,7 @@ static struct clk_rcg2 cam_cc_mclk0_clk_src = { - .parent_data = cam_cc_parent_data_1, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_1), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -862,7 +862,7 @@ static struct clk_rcg2 cam_cc_mclk1_clk_src = { - .parent_data = cam_cc_parent_data_1, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_1), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -877,7 +877,7 @@ static struct clk_rcg2 cam_cc_mclk2_clk_src = { - .parent_data = cam_cc_parent_data_1, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_1), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -892,7 +892,7 @@ static struct clk_rcg2 cam_cc_mclk3_clk_src = { - .parent_data = cam_cc_parent_data_1, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_1), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -907,7 +907,7 @@ static struct clk_rcg2 cam_cc_mclk4_clk_src = { - .parent_data = cam_cc_parent_data_1, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_1), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -922,7 +922,7 @@ static struct clk_rcg2 cam_cc_mclk5_clk_src = { - .parent_data = cam_cc_parent_data_1, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_1), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -@@ -993,7 +993,7 @@ static struct clk_rcg2 cam_cc_slow_ahb_clk_src = { - .parent_data = cam_cc_parent_data_0, - .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), - .flags = CLK_SET_RATE_PARENT, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_shared_ops, - }, - }; - -diff --git a/drivers/clk/qcom/clk-alpha-pll.c b/drivers/clk/qcom/clk-alpha-pll.c -index 80aadafffacdb1..732ca46703ba30 100644 ---- a/drivers/clk/qcom/clk-alpha-pll.c -+++ b/drivers/clk/qcom/clk-alpha-pll.c -@@ -645,14 +645,19 @@ clk_alpha_pll_recalc_rate(struct clk_hw *hw, unsigned long parent_rate) - struct clk_alpha_pll *pll = to_clk_alpha_pll(hw); - u32 alpha_width = pll_alpha_width(pll); - -- regmap_read(pll->clkr.regmap, PLL_L_VAL(pll), &l); -+ if (regmap_read(pll->clkr.regmap, PLL_L_VAL(pll), &l)) -+ return 0; -+ -+ if (regmap_read(pll->clkr.regmap, PLL_USER_CTL(pll), &ctl)) -+ return 0; - -- regmap_read(pll->clkr.regmap, PLL_USER_CTL(pll), &ctl); - if (ctl & PLL_ALPHA_EN) { -- regmap_read(pll->clkr.regmap, PLL_ALPHA_VAL(pll), &low); -+ if (regmap_read(pll->clkr.regmap, PLL_ALPHA_VAL(pll), &low)) -+ return 0; - if (alpha_width > 32) { -- regmap_read(pll->clkr.regmap, PLL_ALPHA_VAL_U(pll), -- &high); -+ if (regmap_read(pll->clkr.regmap, PLL_ALPHA_VAL_U(pll), -+ &high)) -+ return 0; - a = (u64)high << 32 | low; - } else { - a = low & GENMASK(alpha_width - 1, 0); -@@ -844,8 +849,11 @@ alpha_pll_huayra_recalc_rate(struct clk_hw *hw, unsigned long parent_rate) - struct clk_alpha_pll *pll = to_clk_alpha_pll(hw); - u32 l, alpha = 0, ctl, alpha_m, alpha_n; - -- regmap_read(pll->clkr.regmap, PLL_L_VAL(pll), &l); -- regmap_read(pll->clkr.regmap, PLL_USER_CTL(pll), &ctl); -+ if (regmap_read(pll->clkr.regmap, PLL_L_VAL(pll), &l)) -+ return 0; -+ -+ if (regmap_read(pll->clkr.regmap, PLL_USER_CTL(pll), &ctl)) -+ return 0; - - if (ctl & PLL_ALPHA_EN) { - regmap_read(pll->clkr.regmap, PLL_ALPHA_VAL(pll), &alpha); -@@ -1039,8 +1047,11 @@ clk_trion_pll_recalc_rate(struct clk_hw *hw, unsigned long parent_rate) - struct clk_alpha_pll *pll = to_clk_alpha_pll(hw); - u32 l, frac, alpha_width = pll_alpha_width(pll); - -- regmap_read(pll->clkr.regmap, PLL_L_VAL(pll), &l); -- regmap_read(pll->clkr.regmap, PLL_ALPHA_VAL(pll), &frac); -+ if (regmap_read(pll->clkr.regmap, PLL_L_VAL(pll), &l)) -+ return 0; -+ -+ if (regmap_read(pll->clkr.regmap, PLL_ALPHA_VAL(pll), &frac)) -+ return 0; - - return alpha_pll_calc_rate(parent_rate, l, frac, alpha_width); - } -@@ -1098,7 +1109,8 @@ clk_alpha_pll_postdiv_recalc_rate(struct clk_hw *hw, unsigned long parent_rate) - struct clk_alpha_pll_postdiv *pll = to_clk_alpha_pll_postdiv(hw); - u32 ctl; - -- regmap_read(pll->clkr.regmap, PLL_USER_CTL(pll), &ctl); -+ if (regmap_read(pll->clkr.regmap, PLL_USER_CTL(pll), &ctl)) -+ return 0; - - ctl >>= PLL_POST_DIV_SHIFT; - ctl &= PLL_POST_DIV_MASK(pll); -@@ -1314,8 +1326,11 @@ static unsigned long alpha_pll_fabia_recalc_rate(struct clk_hw *hw, - struct clk_alpha_pll *pll = to_clk_alpha_pll(hw); - u32 l, frac, alpha_width = pll_alpha_width(pll); - -- regmap_read(pll->clkr.regmap, PLL_L_VAL(pll), &l); -- regmap_read(pll->clkr.regmap, PLL_FRAC(pll), &frac); -+ if (regmap_read(pll->clkr.regmap, PLL_L_VAL(pll), &l)) -+ return 0; -+ -+ if (regmap_read(pll->clkr.regmap, PLL_FRAC(pll), &frac)) -+ return 0; - - return alpha_pll_calc_rate(parent_rate, l, frac, alpha_width); - } -@@ -1465,7 +1480,8 @@ clk_trion_pll_postdiv_recalc_rate(struct clk_hw *hw, unsigned long parent_rate) - struct regmap *regmap = pll->clkr.regmap; - u32 i, div = 1, val; - -- regmap_read(regmap, PLL_USER_CTL(pll), &val); -+ if (regmap_read(regmap, PLL_USER_CTL(pll), &val)) -+ return 0; - - val >>= pll->post_div_shift; - val &= PLL_POST_DIV_MASK(pll); -@@ -2339,9 +2355,12 @@ static unsigned long alpha_pll_lucid_evo_recalc_rate(struct clk_hw *hw, - struct regmap *regmap = pll->clkr.regmap; - u32 l, frac; - -- regmap_read(regmap, PLL_L_VAL(pll), &l); -+ if (regmap_read(regmap, PLL_L_VAL(pll), &l)) -+ return 0; - l &= LUCID_EVO_PLL_L_VAL_MASK; -- regmap_read(regmap, PLL_ALPHA_VAL(pll), &frac); -+ -+ if (regmap_read(regmap, PLL_ALPHA_VAL(pll), &frac)) -+ return 0; - - return alpha_pll_calc_rate(parent_rate, l, frac, pll_alpha_width(pll)); - } -@@ -2416,7 +2435,8 @@ static unsigned long clk_rivian_evo_pll_recalc_rate(struct clk_hw *hw, - struct clk_alpha_pll *pll = to_clk_alpha_pll(hw); - u32 l; - -- regmap_read(pll->clkr.regmap, PLL_L_VAL(pll), &l); -+ if (regmap_read(pll->clkr.regmap, PLL_L_VAL(pll), &l)) -+ return 0; - - return parent_rate * l; - } -diff --git a/drivers/clk/sunxi-ng/ccu-sun20i-d1.c b/drivers/clk/sunxi-ng/ccu-sun20i-d1.c -index f95c3615ca7727..98f107e96317ec 100644 ---- a/drivers/clk/sunxi-ng/ccu-sun20i-d1.c -+++ b/drivers/clk/sunxi-ng/ccu-sun20i-d1.c -@@ -412,19 +412,23 @@ static const struct clk_parent_data mmc0_mmc1_parents[] = { - { .hw = &pll_periph0_2x_clk.common.hw }, - { .hw = &pll_audio1_div2_clk.common.hw }, - }; --static SUNXI_CCU_MP_DATA_WITH_MUX_GATE(mmc0_clk, "mmc0", mmc0_mmc1_parents, 0x830, -- 0, 4, /* M */ -- 8, 2, /* P */ -- 24, 3, /* mux */ -- BIT(31), /* gate */ -- 0); -- --static SUNXI_CCU_MP_DATA_WITH_MUX_GATE(mmc1_clk, "mmc1", mmc0_mmc1_parents, 0x834, -- 0, 4, /* M */ -- 8, 2, /* P */ -- 24, 3, /* mux */ -- BIT(31), /* gate */ -- 0); -+static SUNXI_CCU_MP_DATA_WITH_MUX_GATE_POSTDIV(mmc0_clk, "mmc0", -+ mmc0_mmc1_parents, 0x830, -+ 0, 4, /* M */ -+ 8, 2, /* P */ -+ 24, 3, /* mux */ -+ BIT(31), /* gate */ -+ 2, /* post-div */ -+ 0); -+ -+static SUNXI_CCU_MP_DATA_WITH_MUX_GATE_POSTDIV(mmc1_clk, "mmc1", -+ mmc0_mmc1_parents, 0x834, -+ 0, 4, /* M */ -+ 8, 2, /* P */ -+ 24, 3, /* mux */ -+ BIT(31), /* gate */ -+ 2, /* post-div */ -+ 0); - - static const struct clk_parent_data mmc2_parents[] = { - { .fw_name = "hosc" }, -@@ -433,12 +437,14 @@ static const struct clk_parent_data mmc2_parents[] = { - { .hw = &pll_periph0_800M_clk.common.hw }, - { .hw = &pll_audio1_div2_clk.common.hw }, - }; --static SUNXI_CCU_MP_DATA_WITH_MUX_GATE(mmc2_clk, "mmc2", mmc2_parents, 0x838, -- 0, 4, /* M */ -- 8, 2, /* P */ -- 24, 3, /* mux */ -- BIT(31), /* gate */ -- 0); -+static SUNXI_CCU_MP_DATA_WITH_MUX_GATE_POSTDIV(mmc2_clk, "mmc2", mmc2_parents, -+ 0x838, -+ 0, 4, /* M */ -+ 8, 2, /* P */ -+ 24, 3, /* mux */ -+ BIT(31), /* gate */ -+ 2, /* post-div */ -+ 0); - - static SUNXI_CCU_GATE_HWS(bus_mmc0_clk, "bus-mmc0", psi_ahb_hws, - 0x84c, BIT(0), 0); -diff --git a/drivers/clk/sunxi-ng/ccu_mp.h b/drivers/clk/sunxi-ng/ccu_mp.h -index 6e50f3728fb5f1..7d836a9fb3db34 100644 ---- a/drivers/clk/sunxi-ng/ccu_mp.h -+++ b/drivers/clk/sunxi-ng/ccu_mp.h -@@ -52,6 +52,28 @@ struct ccu_mp { - } \ - } - -+#define SUNXI_CCU_MP_DATA_WITH_MUX_GATE_POSTDIV(_struct, _name, _parents, \ -+ _reg, \ -+ _mshift, _mwidth, \ -+ _pshift, _pwidth, \ -+ _muxshift, _muxwidth, \ -+ _gate, _postdiv, _flags)\ -+ struct ccu_mp _struct = { \ -+ .enable = _gate, \ -+ .m = _SUNXI_CCU_DIV(_mshift, _mwidth), \ -+ .p = _SUNXI_CCU_DIV(_pshift, _pwidth), \ -+ .mux = _SUNXI_CCU_MUX(_muxshift, _muxwidth), \ -+ .fixed_post_div = _postdiv, \ -+ .common = { \ -+ .reg = _reg, \ -+ .features = CCU_FEATURE_FIXED_POSTDIV, \ -+ .hw.init = CLK_HW_INIT_PARENTS_DATA(_name, \ -+ _parents, \ -+ &ccu_mp_ops, \ -+ _flags), \ -+ } \ -+ } -+ - #define SUNXI_CCU_MP_WITH_MUX_GATE(_struct, _name, _parents, _reg, \ - _mshift, _mwidth, \ - _pshift, _pwidth, \ -diff --git a/drivers/clocksource/mips-gic-timer.c b/drivers/clocksource/mips-gic-timer.c -index b3ae38f3672052..39c70b5ac44c96 100644 ---- a/drivers/clocksource/mips-gic-timer.c -+++ b/drivers/clocksource/mips-gic-timer.c -@@ -114,6 +114,9 @@ static void gic_update_frequency(void *data) - - static int gic_starting_cpu(unsigned int cpu) - { -+ /* Ensure the GIC counter is running */ -+ clear_gic_config(GIC_CONFIG_COUNTSTOP); -+ - gic_clockevent_cpu_init(cpu, this_cpu_ptr(&gic_clockevent_device)); - return 0; - } -@@ -248,9 +251,6 @@ static int __init gic_clocksource_of_init(struct device_node *node) - pr_warn("Unable to register clock notifier\n"); - } - -- /* And finally start the counter */ -- clear_gic_config(GIC_CONFIG_COUNTSTOP); -- - /* - * It's safe to use the MIPS GIC timer as a sched clock source only if - * its ticks are stable, which is true on either the platforms with -diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c -index 09becf14653b58..c58c1defd74588 100644 ---- a/drivers/cpufreq/cpufreq-dt-platdev.c -+++ b/drivers/cpufreq/cpufreq-dt-platdev.c -@@ -165,6 +165,7 @@ static const struct of_device_id blocklist[] __initconst = { - { .compatible = "qcom,sm8350", }, - { .compatible = "qcom,sm8450", }, - { .compatible = "qcom,sm8550", }, -+ { .compatible = "qcom,sm8650", }, - - { .compatible = "st,stih407", }, - { .compatible = "st,stih410", }, -diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c -index 7b8fcfa55038bc..4e5b6f9a56d1b2 100644 ---- a/drivers/cpufreq/tegra186-cpufreq.c -+++ b/drivers/cpufreq/tegra186-cpufreq.c -@@ -73,11 +73,18 @@ static int tegra186_cpufreq_init(struct cpufreq_policy *policy) - { - struct tegra186_cpufreq_data *data = cpufreq_get_driver_data(); - unsigned int cluster = data->cpus[policy->cpu].bpmp_cluster_id; -+ u32 cpu; - - policy->freq_table = data->clusters[cluster].table; - policy->cpuinfo.transition_latency = 300 * 1000; - policy->driver_data = NULL; - -+ /* set same policy for all cpus in a cluster */ -+ for (cpu = 0; cpu < ARRAY_SIZE(tegra186_cpus); cpu++) { -+ if (data->cpus[cpu].bpmp_cluster_id == cluster) -+ cpumask_set_cpu(cpu, policy->cpus); -+ } -+ - return 0; - } - -diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c -index b96e3da0fedd01..edd9a8fb9878d6 100644 ---- a/drivers/cpuidle/governors/menu.c -+++ b/drivers/cpuidle/governors/menu.c -@@ -246,8 +246,19 @@ static unsigned int get_typical_interval(struct menu_device *data) - * This can deal with workloads that have long pauses interspersed - * with sporadic activity with a bunch of short pauses. - */ -- if ((divisor * 4) <= INTERVALS * 3) -+ if (divisor * 4 <= INTERVALS * 3) { -+ /* -+ * If there are sufficiently many data points still under -+ * consideration after the outliers have been eliminated, -+ * returning without a prediction would be a mistake because it -+ * is likely that the next interval will not exceed the current -+ * maximum, so return the latter in that case. -+ */ -+ if (divisor >= INTERVALS / 2) -+ return max; -+ - return UINT_MAX; -+ } - - thresh = max - 1; - goto again; -diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptvf_reqmgr.c b/drivers/crypto/marvell/octeontx2/otx2_cptvf_reqmgr.c -index 811ded72ce5fbd..798bb40fed68df 100644 ---- a/drivers/crypto/marvell/octeontx2/otx2_cptvf_reqmgr.c -+++ b/drivers/crypto/marvell/octeontx2/otx2_cptvf_reqmgr.c -@@ -410,9 +410,10 @@ static int cpt_process_ccode(struct otx2_cptlfs_info *lfs, - break; - } - -- dev_err(&pdev->dev, -- "Request failed with software error code 0x%x\n", -- cpt_status->s.uc_compcode); -+ pr_debug("Request failed with software error code 0x%x: algo = %s driver = %s\n", -+ cpt_status->s.uc_compcode, -+ info->req->areq->tfm->__crt_alg->cra_name, -+ info->req->areq->tfm->__crt_alg->cra_driver_name); - otx2_cpt_dump_sg_list(pdev, info->req); - break; - } -diff --git a/drivers/dma/fsl-edma-main.c b/drivers/dma/fsl-edma-main.c -index cc9923ab686dcd..eccbcf67951fbe 100644 ---- a/drivers/dma/fsl-edma-main.c -+++ b/drivers/dma/fsl-edma-main.c -@@ -58,7 +58,7 @@ static irqreturn_t fsl_edma3_tx_handler(int irq, void *dev_id) - - intr = edma_readl_chreg(fsl_chan, ch_int); - if (!intr) -- return IRQ_HANDLED; -+ return IRQ_NONE; - - edma_writel_chreg(fsl_chan, 1, ch_int); - -diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c -index c18633ad8455fa..7e3a67f9f0a654 100644 ---- a/drivers/dma/idxd/cdev.c -+++ b/drivers/dma/idxd/cdev.c -@@ -225,7 +225,7 @@ static int idxd_cdev_open(struct inode *inode, struct file *filp) - struct idxd_wq *wq; - struct device *dev, *fdev; - int rc = 0; -- struct iommu_sva *sva; -+ struct iommu_sva *sva = NULL; - unsigned int pasid; - struct idxd_cdev *idxd_cdev; - -@@ -322,7 +322,7 @@ static int idxd_cdev_open(struct inode *inode, struct file *filp) - if (device_user_pasid_enabled(idxd)) - idxd_xa_pasid_remove(ctx); - failed_get_pasid: -- if (device_user_pasid_enabled(idxd)) -+ if (device_user_pasid_enabled(idxd) && !IS_ERR_OR_NULL(sva)) - iommu_sva_unbind_device(sva); - failed: - mutex_unlock(&wq->wq_lock); -@@ -412,6 +412,9 @@ static int idxd_cdev_mmap(struct file *filp, struct vm_area_struct *vma) - if (!idxd->user_submission_safe && !capable(CAP_SYS_RAWIO)) - return -EPERM; - -+ if (current->mm != ctx->mm) -+ return -EPERM; -+ - rc = check_vma(wq, vma, __func__); - if (rc < 0) - return rc; -@@ -478,6 +481,9 @@ static ssize_t idxd_cdev_write(struct file *filp, const char __user *buf, size_t - ssize_t written = 0; - int i; - -+ if (current->mm != ctx->mm) -+ return -EPERM; -+ - for (i = 0; i < len/sizeof(struct dsa_hw_desc); i++) { - int rc = idxd_submit_user_descriptor(ctx, udesc + i); - -@@ -498,6 +504,9 @@ static __poll_t idxd_cdev_poll(struct file *filp, - struct idxd_device *idxd = wq->idxd; - __poll_t out = 0; - -+ if (current->mm != ctx->mm) -+ return POLLNVAL; -+ - poll_wait(filp, &wq->err_queue, wait); - spin_lock(&idxd->dev_lock); - if (idxd->sw_err.valid) -@@ -584,6 +593,7 @@ void idxd_wq_del_cdev(struct idxd_wq *wq) - - static int idxd_user_drv_probe(struct idxd_dev *idxd_dev) - { -+ struct device *dev = &idxd_dev->conf_dev; - struct idxd_wq *wq = idxd_dev_to_wq(idxd_dev); - struct idxd_device *idxd = wq->idxd; - int rc; -@@ -611,6 +621,12 @@ static int idxd_user_drv_probe(struct idxd_dev *idxd_dev) - - mutex_lock(&wq->wq_lock); - -+ if (!idxd_wq_driver_name_match(wq, dev)) { -+ idxd->cmd_status = IDXD_SCMD_WQ_NO_DRV_NAME; -+ rc = -ENODEV; -+ goto wq_err; -+ } -+ - wq->wq = create_workqueue(dev_name(wq_confdev(wq))); - if (!wq->wq) { - rc = -ENOMEM; -diff --git a/drivers/dma/idxd/dma.c b/drivers/dma/idxd/dma.c -index 07623fb0f52fc2..47a01893cfdbf9 100644 ---- a/drivers/dma/idxd/dma.c -+++ b/drivers/dma/idxd/dma.c -@@ -306,6 +306,12 @@ static int idxd_dmaengine_drv_probe(struct idxd_dev *idxd_dev) - return -ENXIO; - - mutex_lock(&wq->wq_lock); -+ if (!idxd_wq_driver_name_match(wq, dev)) { -+ idxd->cmd_status = IDXD_SCMD_WQ_NO_DRV_NAME; -+ rc = -ENODEV; -+ goto err; -+ } -+ - wq->type = IDXD_WQT_KERNEL; - - rc = drv_enable_wq(wq); -diff --git a/drivers/dma/idxd/idxd.h b/drivers/dma/idxd/idxd.h -index bea10c5cdb76bb..fcbb8caea89952 100644 ---- a/drivers/dma/idxd/idxd.h -+++ b/drivers/dma/idxd/idxd.h -@@ -159,6 +159,8 @@ struct idxd_cdev { - int minor; - }; - -+#define DRIVER_NAME_SIZE 128 -+ - #define IDXD_ALLOCATED_BATCH_SIZE 128U - #define WQ_NAME_SIZE 1024 - #define WQ_TYPE_SIZE 10 -@@ -227,6 +229,8 @@ struct idxd_wq { - /* Lock to protect upasid_xa access. */ - struct mutex uc_lock; - struct xarray upasid_xa; -+ -+ char driver_name[DRIVER_NAME_SIZE + 1]; - }; - - struct idxd_engine { -@@ -648,6 +652,11 @@ static inline void idxd_wqcfg_set_max_batch_shift(int idxd_type, union wqcfg *wq - wqcfg->max_batch_shift = max_batch_shift; - } - -+static inline int idxd_wq_driver_name_match(struct idxd_wq *wq, struct device *dev) -+{ -+ return (strncmp(wq->driver_name, dev->driver->name, strlen(dev->driver->name)) == 0); -+} -+ - int __must_check __idxd_driver_register(struct idxd_device_driver *idxd_drv, - struct module *module, const char *mod_name); - #define idxd_driver_register(driver) \ -diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c -index 1fd5a93045f79e..3a5ce477a81ad6 100644 ---- a/drivers/dma/idxd/sysfs.c -+++ b/drivers/dma/idxd/sysfs.c -@@ -1282,6 +1282,39 @@ static ssize_t wq_op_config_store(struct device *dev, struct device_attribute *a - static struct device_attribute dev_attr_wq_op_config = - __ATTR(op_config, 0644, wq_op_config_show, wq_op_config_store); - -+static ssize_t wq_driver_name_show(struct device *dev, struct device_attribute *attr, char *buf) -+{ -+ struct idxd_wq *wq = confdev_to_wq(dev); -+ -+ return sysfs_emit(buf, "%s\n", wq->driver_name); -+} -+ -+static ssize_t wq_driver_name_store(struct device *dev, struct device_attribute *attr, -+ const char *buf, size_t count) -+{ -+ struct idxd_wq *wq = confdev_to_wq(dev); -+ char *input, *pos; -+ -+ if (wq->state != IDXD_WQ_DISABLED) -+ return -EPERM; -+ -+ if (strlen(buf) > DRIVER_NAME_SIZE || strlen(buf) == 0) -+ return -EINVAL; -+ -+ input = kstrndup(buf, count, GFP_KERNEL); -+ if (!input) -+ return -ENOMEM; -+ -+ pos = strim(input); -+ memset(wq->driver_name, 0, DRIVER_NAME_SIZE + 1); -+ sprintf(wq->driver_name, "%s", pos); -+ kfree(input); -+ return count; -+} -+ -+static struct device_attribute dev_attr_wq_driver_name = -+ __ATTR(driver_name, 0644, wq_driver_name_show, wq_driver_name_store); -+ - static struct attribute *idxd_wq_attributes[] = { - &dev_attr_wq_clients.attr, - &dev_attr_wq_state.attr, -@@ -1301,6 +1334,7 @@ static struct attribute *idxd_wq_attributes[] = { - &dev_attr_wq_occupancy.attr, - &dev_attr_wq_enqcmds_retries.attr, - &dev_attr_wq_op_config.attr, -+ &dev_attr_wq_driver_name.attr, - NULL, - }; - -diff --git a/drivers/edac/ie31200_edac.c b/drivers/edac/ie31200_edac.c -index 56be8ef40f376b..e3635fba63b493 100644 ---- a/drivers/edac/ie31200_edac.c -+++ b/drivers/edac/ie31200_edac.c -@@ -405,10 +405,9 @@ static int ie31200_probe1(struct pci_dev *pdev, int dev_idx) - int i, j, ret; - struct mem_ctl_info *mci = NULL; - struct edac_mc_layer layers[2]; -- struct dimm_data dimm_info[IE31200_CHANNELS][IE31200_DIMMS_PER_CHANNEL]; - void __iomem *window; - struct ie31200_priv *priv; -- u32 addr_decode, mad_offset; -+ u32 addr_decode[IE31200_CHANNELS], mad_offset; - - /* - * Kaby Lake, Coffee Lake seem to work like Skylake. Please re-visit -@@ -466,19 +465,10 @@ static int ie31200_probe1(struct pci_dev *pdev, int dev_idx) - mad_offset = IE31200_MAD_DIMM_0_OFFSET; - } - -- /* populate DIMM info */ - for (i = 0; i < IE31200_CHANNELS; i++) { -- addr_decode = readl(window + mad_offset + -+ addr_decode[i] = readl(window + mad_offset + - (i * 4)); -- edac_dbg(0, "addr_decode: 0x%x\n", addr_decode); -- for (j = 0; j < IE31200_DIMMS_PER_CHANNEL; j++) { -- populate_dimm_info(&dimm_info[i][j], addr_decode, j, -- skl); -- edac_dbg(0, "size: 0x%x, rank: %d, width: %d\n", -- dimm_info[i][j].size, -- dimm_info[i][j].dual_rank, -- dimm_info[i][j].x16_width); -- } -+ edac_dbg(0, "addr_decode: 0x%x\n", addr_decode[i]); - } - - /* -@@ -489,14 +479,22 @@ static int ie31200_probe1(struct pci_dev *pdev, int dev_idx) - */ - for (i = 0; i < IE31200_DIMMS_PER_CHANNEL; i++) { - for (j = 0; j < IE31200_CHANNELS; j++) { -+ struct dimm_data dimm_info; - struct dimm_info *dimm; - unsigned long nr_pages; - -- nr_pages = IE31200_PAGES(dimm_info[j][i].size, skl); -+ populate_dimm_info(&dimm_info, addr_decode[j], i, -+ skl); -+ edac_dbg(0, "size: 0x%x, rank: %d, width: %d\n", -+ dimm_info.size, -+ dimm_info.dual_rank, -+ dimm_info.x16_width); -+ -+ nr_pages = IE31200_PAGES(dimm_info.size, skl); - if (nr_pages == 0) - continue; - -- if (dimm_info[j][i].dual_rank) { -+ if (dimm_info.dual_rank) { - nr_pages = nr_pages / 2; - dimm = edac_get_dimm(mci, (i * 2) + 1, j, 0); - dimm->nr_pages = nr_pages; -diff --git a/drivers/firmware/arm_ffa/bus.c b/drivers/firmware/arm_ffa/bus.c -index 7865438b36960d..d885e1381072ac 100644 ---- a/drivers/firmware/arm_ffa/bus.c -+++ b/drivers/firmware/arm_ffa/bus.c -@@ -191,6 +191,7 @@ struct ffa_device *ffa_device_register(const uuid_t *uuid, int vm_id, - dev = &ffa_dev->dev; - dev->bus = &ffa_bus_type; - dev->release = ffa_release_device; -+ dev->dma_mask = &dev->coherent_dma_mask; - dev_set_name(&ffa_dev->dev, "arm-ffa-%d", id); - - ffa_dev->id = id; -diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c -index 7c2db3f017651b..488f8345dd1b63 100644 ---- a/drivers/firmware/arm_ffa/driver.c -+++ b/drivers/firmware/arm_ffa/driver.c -@@ -121,6 +121,14 @@ static int ffa_version_check(u32 *version) - return -EOPNOTSUPP; - } - -+ if (FFA_MAJOR_VERSION(ver.a0) > FFA_MAJOR_VERSION(FFA_DRIVER_VERSION)) { -+ pr_err("Incompatible v%d.%d! Latest supported v%d.%d\n", -+ FFA_MAJOR_VERSION(ver.a0), FFA_MINOR_VERSION(ver.a0), -+ FFA_MAJOR_VERSION(FFA_DRIVER_VERSION), -+ FFA_MINOR_VERSION(FFA_DRIVER_VERSION)); -+ return -EINVAL; -+ } -+ - if (ver.a0 < FFA_MIN_VERSION) { - pr_err("Incompatible v%d.%d! Earliest supported v%d.%d\n", - FFA_MAJOR_VERSION(ver.a0), FFA_MINOR_VERSION(ver.a0), -diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c -index 51eeaf14367dac..e1b949aedf9e08 100644 ---- a/drivers/firmware/arm_scmi/bus.c -+++ b/drivers/firmware/arm_scmi/bus.c -@@ -42,7 +42,7 @@ static atomic_t scmi_syspower_registered = ATOMIC_INIT(0); - * This helper let an SCMI driver request specific devices identified by the - * @id_table to be created for each active SCMI instance. - * -- * The requested device name MUST NOT be already existent for any protocol; -+ * The requested device name MUST NOT be already existent for this protocol; - * at first the freshly requested @id_table is annotated in the IDR table - * @scmi_requested_devices and then the requested device is advertised to any - * registered party via the @scmi_requested_devices_nh notification chain. -@@ -52,7 +52,6 @@ static atomic_t scmi_syspower_registered = ATOMIC_INIT(0); - static int scmi_protocol_device_request(const struct scmi_device_id *id_table) - { - int ret = 0; -- unsigned int id = 0; - struct list_head *head, *phead = NULL; - struct scmi_requested_dev *rdev; - -@@ -67,19 +66,13 @@ static int scmi_protocol_device_request(const struct scmi_device_id *id_table) - } - - /* -- * Search for the matching protocol rdev list and then search -- * of any existent equally named device...fails if any duplicate found. -+ * Find the matching protocol rdev list and then search of any -+ * existent equally named device...fails if any duplicate found. - */ - mutex_lock(&scmi_requested_devices_mtx); -- idr_for_each_entry(&scmi_requested_devices, head, id) { -- if (!phead) { -- /* A list found registered in the IDR is never empty */ -- rdev = list_first_entry(head, struct scmi_requested_dev, -- node); -- if (rdev->id_table->protocol_id == -- id_table->protocol_id) -- phead = head; -- } -+ phead = idr_find(&scmi_requested_devices, id_table->protocol_id); -+ if (phead) { -+ head = phead; - list_for_each_entry(rdev, head, node) { - if (!strcmp(rdev->id_table->name, id_table->name)) { - pr_err("Ignoring duplicate request [%d] %s\n", -diff --git a/drivers/fpga/altera-cvp.c b/drivers/fpga/altera-cvp.c -index 4ffb9da537d82c..5295ff90482bc6 100644 ---- a/drivers/fpga/altera-cvp.c -+++ b/drivers/fpga/altera-cvp.c -@@ -52,7 +52,7 @@ - /* V2 Defines */ - #define VSE_CVP_TX_CREDITS 0x49 /* 8bit */ - --#define V2_CREDIT_TIMEOUT_US 20000 -+#define V2_CREDIT_TIMEOUT_US 40000 - #define V2_CHECK_CREDIT_US 10 - #define V2_POLL_TIMEOUT_US 1000000 - #define V2_USER_TIMEOUT_US 500000 -diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c -index b882b26ab5007b..faadbe66b23e71 100644 ---- a/drivers/gpio/gpio-pca953x.c -+++ b/drivers/gpio/gpio-pca953x.c -@@ -10,6 +10,7 @@ - - #include - #include -+#include - #include - #include - #include -@@ -519,12 +520,10 @@ static int pca953x_gpio_direction_input(struct gpio_chip *gc, unsigned off) - struct pca953x_chip *chip = gpiochip_get_data(gc); - u8 dirreg = chip->recalc_addr(chip, chip->regs->direction, off); - u8 bit = BIT(off % BANK_SZ); -- int ret; - -- mutex_lock(&chip->i2c_lock); -- ret = regmap_write_bits(chip->regmap, dirreg, bit, bit); -- mutex_unlock(&chip->i2c_lock); -- return ret; -+ guard(mutex)(&chip->i2c_lock); -+ -+ return regmap_write_bits(chip->regmap, dirreg, bit, bit); - } - - static int pca953x_gpio_direction_output(struct gpio_chip *gc, -@@ -536,17 +535,15 @@ static int pca953x_gpio_direction_output(struct gpio_chip *gc, - u8 bit = BIT(off % BANK_SZ); - int ret; - -- mutex_lock(&chip->i2c_lock); -+ guard(mutex)(&chip->i2c_lock); -+ - /* set output level */ - ret = regmap_write_bits(chip->regmap, outreg, bit, val ? bit : 0); - if (ret) -- goto exit; -+ return ret; - - /* then direction */ -- ret = regmap_write_bits(chip->regmap, dirreg, bit, 0); --exit: -- mutex_unlock(&chip->i2c_lock); -- return ret; -+ return regmap_write_bits(chip->regmap, dirreg, bit, 0); - } - - static int pca953x_gpio_get_value(struct gpio_chip *gc, unsigned off) -@@ -557,9 +554,8 @@ static int pca953x_gpio_get_value(struct gpio_chip *gc, unsigned off) - u32 reg_val; - int ret; - -- mutex_lock(&chip->i2c_lock); -- ret = regmap_read(chip->regmap, inreg, ®_val); -- mutex_unlock(&chip->i2c_lock); -+ scoped_guard(mutex, &chip->i2c_lock) -+ ret = regmap_read(chip->regmap, inreg, ®_val); - if (ret < 0) - return ret; - -@@ -572,9 +568,9 @@ static void pca953x_gpio_set_value(struct gpio_chip *gc, unsigned off, int val) - u8 outreg = chip->recalc_addr(chip, chip->regs->output, off); - u8 bit = BIT(off % BANK_SZ); - -- mutex_lock(&chip->i2c_lock); -+ guard(mutex)(&chip->i2c_lock); -+ - regmap_write_bits(chip->regmap, outreg, bit, val ? bit : 0); -- mutex_unlock(&chip->i2c_lock); - } - - static int pca953x_gpio_get_direction(struct gpio_chip *gc, unsigned off) -@@ -585,9 +581,8 @@ static int pca953x_gpio_get_direction(struct gpio_chip *gc, unsigned off) - u32 reg_val; - int ret; - -- mutex_lock(&chip->i2c_lock); -- ret = regmap_read(chip->regmap, dirreg, ®_val); -- mutex_unlock(&chip->i2c_lock); -+ scoped_guard(mutex, &chip->i2c_lock) -+ ret = regmap_read(chip->regmap, dirreg, ®_val); - if (ret < 0) - return ret; - -@@ -604,9 +599,8 @@ static int pca953x_gpio_get_multiple(struct gpio_chip *gc, - DECLARE_BITMAP(reg_val, MAX_LINE); - int ret; - -- mutex_lock(&chip->i2c_lock); -- ret = pca953x_read_regs(chip, chip->regs->input, reg_val); -- mutex_unlock(&chip->i2c_lock); -+ scoped_guard(mutex, &chip->i2c_lock) -+ ret = pca953x_read_regs(chip, chip->regs->input, reg_val); - if (ret) - return ret; - -@@ -621,16 +615,15 @@ static void pca953x_gpio_set_multiple(struct gpio_chip *gc, - DECLARE_BITMAP(reg_val, MAX_LINE); - int ret; - -- mutex_lock(&chip->i2c_lock); -+ guard(mutex)(&chip->i2c_lock); -+ - ret = pca953x_read_regs(chip, chip->regs->output, reg_val); - if (ret) -- goto exit; -+ return; - - bitmap_replace(reg_val, reg_val, bits, mask, gc->ngpio); - - pca953x_write_regs(chip, chip->regs->output, reg_val); --exit: -- mutex_unlock(&chip->i2c_lock); - } - - static int pca953x_gpio_set_pull_up_down(struct pca953x_chip *chip, -@@ -638,7 +631,6 @@ static int pca953x_gpio_set_pull_up_down(struct pca953x_chip *chip, - unsigned long config) - { - enum pin_config_param param = pinconf_to_config_param(config); -- - u8 pull_en_reg = chip->recalc_addr(chip, PCAL953X_PULL_EN, offset); - u8 pull_sel_reg = chip->recalc_addr(chip, PCAL953X_PULL_SEL, offset); - u8 bit = BIT(offset % BANK_SZ); -@@ -651,7 +643,7 @@ static int pca953x_gpio_set_pull_up_down(struct pca953x_chip *chip, - if (!(chip->driver_data & PCA_PCAL)) - return -ENOTSUPP; - -- mutex_lock(&chip->i2c_lock); -+ guard(mutex)(&chip->i2c_lock); - - /* Configure pull-up/pull-down */ - if (param == PIN_CONFIG_BIAS_PULL_UP) -@@ -661,17 +653,13 @@ static int pca953x_gpio_set_pull_up_down(struct pca953x_chip *chip, - else - ret = 0; - if (ret) -- goto exit; -+ return ret; - - /* Disable/Enable pull-up/pull-down */ - if (param == PIN_CONFIG_BIAS_DISABLE) -- ret = regmap_write_bits(chip->regmap, pull_en_reg, bit, 0); -+ return regmap_write_bits(chip->regmap, pull_en_reg, bit, 0); - else -- ret = regmap_write_bits(chip->regmap, pull_en_reg, bit, bit); -- --exit: -- mutex_unlock(&chip->i2c_lock); -- return ret; -+ return regmap_write_bits(chip->regmap, pull_en_reg, bit, bit); - } - - static int pca953x_gpio_set_config(struct gpio_chip *gc, unsigned int offset, -@@ -883,10 +871,8 @@ static irqreturn_t pca953x_irq_handler(int irq, void *devid) - - bitmap_zero(pending, MAX_LINE); - -- mutex_lock(&chip->i2c_lock); -- ret = pca953x_irq_pending(chip, pending); -- mutex_unlock(&chip->i2c_lock); -- -+ scoped_guard(mutex, &chip->i2c_lock) -+ ret = pca953x_irq_pending(chip, pending); - if (ret) { - ret = 0; - -@@ -1168,9 +1154,9 @@ static int pca953x_probe(struct i2c_client *client) - } - - #ifdef CONFIG_PM_SLEEP --static int pca953x_regcache_sync(struct device *dev) -+static int pca953x_regcache_sync(struct pca953x_chip *chip) - { -- struct pca953x_chip *chip = dev_get_drvdata(dev); -+ struct device *dev = &chip->client->dev; - int ret; - u8 regaddr; - -@@ -1217,13 +1203,38 @@ static int pca953x_regcache_sync(struct device *dev) - return 0; - } - -+static int pca953x_restore_context(struct pca953x_chip *chip) -+{ -+ int ret; -+ -+ guard(mutex)(&chip->i2c_lock); -+ -+ if (chip->client->irq > 0) -+ enable_irq(chip->client->irq); -+ regcache_cache_only(chip->regmap, false); -+ regcache_mark_dirty(chip->regmap); -+ ret = pca953x_regcache_sync(chip); -+ if (ret) -+ return ret; -+ -+ return regcache_sync(chip->regmap); -+} -+ -+static void pca953x_save_context(struct pca953x_chip *chip) -+{ -+ guard(mutex)(&chip->i2c_lock); -+ -+ /* Disable IRQ to prevent early triggering while regmap "cache only" is on */ -+ if (chip->client->irq > 0) -+ disable_irq(chip->client->irq); -+ regcache_cache_only(chip->regmap, true); -+} -+ - static int pca953x_suspend(struct device *dev) - { - struct pca953x_chip *chip = dev_get_drvdata(dev); - -- mutex_lock(&chip->i2c_lock); -- regcache_cache_only(chip->regmap, true); -- mutex_unlock(&chip->i2c_lock); -+ pca953x_save_context(chip); - - if (atomic_read(&chip->wakeup_path)) - device_set_wakeup_path(dev); -@@ -1246,17 +1257,7 @@ static int pca953x_resume(struct device *dev) - } - } - -- mutex_lock(&chip->i2c_lock); -- regcache_cache_only(chip->regmap, false); -- regcache_mark_dirty(chip->regmap); -- ret = pca953x_regcache_sync(dev); -- if (ret) { -- mutex_unlock(&chip->i2c_lock); -- return ret; -- } -- -- ret = regcache_sync(chip->regmap); -- mutex_unlock(&chip->i2c_lock); -+ ret = pca953x_restore_context(chip); - if (ret) { - dev_err(dev, "Failed to restore register map: %d\n", ret); - return ret; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c -index be4cc4868a748e..493e18bcea069e 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c -@@ -43,6 +43,29 @@ - #include - #include - -+static const struct dma_buf_attach_ops amdgpu_dma_buf_attach_ops; -+ -+/** -+ * dma_buf_attach_adev - Helper to get adev of an attachment -+ * -+ * @attach: attachment -+ * -+ * Returns: -+ * A struct amdgpu_device * if the attaching device is an amdgpu device or -+ * partition, NULL otherwise. -+ */ -+static struct amdgpu_device *dma_buf_attach_adev(struct dma_buf_attachment *attach) -+{ -+ if (attach->importer_ops == &amdgpu_dma_buf_attach_ops) { -+ struct drm_gem_object *obj = attach->importer_priv; -+ struct amdgpu_bo *bo = gem_to_amdgpu_bo(obj); -+ -+ return amdgpu_ttm_adev(bo->tbo.bdev); -+ } -+ -+ return NULL; -+} -+ - /** - * amdgpu_dma_buf_attach - &dma_buf_ops.attach implementation - * -@@ -54,12 +77,14 @@ - static int amdgpu_dma_buf_attach(struct dma_buf *dmabuf, - struct dma_buf_attachment *attach) - { -+ struct amdgpu_device *attach_adev = dma_buf_attach_adev(attach); - struct drm_gem_object *obj = dmabuf->priv; - struct amdgpu_bo *bo = gem_to_amdgpu_bo(obj); - struct amdgpu_device *adev = amdgpu_ttm_adev(bo->tbo.bdev); - int r; - -- if (pci_p2pdma_distance(adev->pdev, attach->dev, false) < 0) -+ if (!amdgpu_dmabuf_is_xgmi_accessible(attach_adev, bo) && -+ pci_p2pdma_distance(adev->pdev, attach->dev, false) < 0) - attach->peer2peer = false; - - r = pm_runtime_get_sync(adev_to_drm(adev)->dev); -@@ -482,6 +507,9 @@ bool amdgpu_dmabuf_is_xgmi_accessible(struct amdgpu_device *adev, - struct drm_gem_object *obj = &bo->tbo.base; - struct drm_gem_object *gobj; - -+ if (!adev) -+ return false; -+ - if (obj->import_attach) { - struct dma_buf *dma_buf = obj->import_attach->dmabuf; - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c -index 6a24e8ceb94493..ffa5e72a84ebcb 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c -@@ -43,7 +43,7 @@ - #include "amdgpu_securedisplay.h" - #include "amdgpu_atomfirmware.h" - --#define AMD_VBIOS_FILE_MAX_SIZE_B (1024*1024*3) -+#define AMD_VBIOS_FILE_MAX_SIZE_B (1024*1024*16) - - static int psp_load_smu_fw(struct psp_context *psp); - static int psp_rap_terminate(struct psp_context *psp); -@@ -506,7 +506,6 @@ static int psp_sw_fini(void *handle) - { - struct amdgpu_device *adev = (struct amdgpu_device *)handle; - struct psp_context *psp = &adev->psp; -- struct psp_gfx_cmd_resp *cmd = psp->cmd; - - psp_memory_training_fini(psp); - -@@ -516,8 +515,8 @@ static int psp_sw_fini(void *handle) - amdgpu_ucode_release(&psp->cap_fw); - amdgpu_ucode_release(&psp->toc_fw); - -- kfree(cmd); -- cmd = NULL; -+ kfree(psp->cmd); -+ psp->cmd = NULL; - - psp_free_shared_bufs(psp); - -diff --git a/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c b/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c -index 66c6bab75f8a58..0d3d00681edac5 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c -@@ -92,12 +92,12 @@ static void gfxhub_v1_0_init_system_aperture_regs(struct amdgpu_device *adev) - { - uint64_t value; - -- /* Program the AGP BAR */ -- WREG32_SOC15_RLC(GC, 0, mmMC_VM_AGP_BASE, 0); -- WREG32_SOC15_RLC(GC, 0, mmMC_VM_AGP_BOT, adev->gmc.agp_start >> 24); -- WREG32_SOC15_RLC(GC, 0, mmMC_VM_AGP_TOP, adev->gmc.agp_end >> 24); -- - if (!amdgpu_sriov_vf(adev) || adev->asic_type <= CHIP_VEGA10) { -+ /* Program the AGP BAR */ -+ WREG32_SOC15_RLC(GC, 0, mmMC_VM_AGP_BASE, 0); -+ WREG32_SOC15_RLC(GC, 0, mmMC_VM_AGP_BOT, adev->gmc.agp_start >> 24); -+ WREG32_SOC15_RLC(GC, 0, mmMC_VM_AGP_TOP, adev->gmc.agp_end >> 24); -+ - /* Program the system aperture low logical page number. */ - WREG32_SOC15_RLC(GC, 0, mmMC_VM_SYSTEM_APERTURE_LOW_ADDR, - min(adev->gmc.fb_start, adev->gmc.agp_start) >> 18); -diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_7.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_7.c -index 9086f2fdfaf422..553f4f24f5adeb 100644 ---- a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_7.c -+++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_7.c -@@ -172,6 +172,30 @@ static void mmhub_v1_7_init_tlb_regs(struct amdgpu_device *adev) - WREG32_SOC15(MMHUB, 0, regMC_VM_MX_L1_TLB_CNTL, tmp); - } - -+/* Set snoop bit for SDMA so that SDMA writes probe-invalidates RW lines */ -+static void mmhub_v1_7_init_snoop_override_regs(struct amdgpu_device *adev) -+{ -+ uint32_t tmp; -+ int i; -+ uint32_t distance = regDAGB1_WRCLI_GPU_SNOOP_OVERRIDE - -+ regDAGB0_WRCLI_GPU_SNOOP_OVERRIDE; -+ -+ for (i = 0; i < 5; i++) { /* DAGB instances */ -+ tmp = RREG32_SOC15_OFFSET(MMHUB, 0, -+ regDAGB0_WRCLI_GPU_SNOOP_OVERRIDE, i * distance); -+ tmp |= (1 << 15); /* SDMA client is BIT15 */ -+ WREG32_SOC15_OFFSET(MMHUB, 0, -+ regDAGB0_WRCLI_GPU_SNOOP_OVERRIDE, i * distance, tmp); -+ -+ tmp = RREG32_SOC15_OFFSET(MMHUB, 0, -+ regDAGB0_WRCLI_GPU_SNOOP_OVERRIDE_VALUE, i * distance); -+ tmp |= (1 << 15); -+ WREG32_SOC15_OFFSET(MMHUB, 0, -+ regDAGB0_WRCLI_GPU_SNOOP_OVERRIDE_VALUE, i * distance, tmp); -+ } -+ -+} -+ - static void mmhub_v1_7_init_cache_regs(struct amdgpu_device *adev) - { - uint32_t tmp; -@@ -337,6 +361,7 @@ static int mmhub_v1_7_gart_enable(struct amdgpu_device *adev) - mmhub_v1_7_init_system_aperture_regs(adev); - mmhub_v1_7_init_tlb_regs(adev); - mmhub_v1_7_init_cache_regs(adev); -+ mmhub_v1_7_init_snoop_override_regs(adev); - - mmhub_v1_7_enable_system_domain(adev); - mmhub_v1_7_disable_identity_aperture(adev); -diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_8.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_8.c -index 3d8e579d5c4e8a..c7bdccff785b71 100644 ---- a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_8.c -+++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_8.c -@@ -213,6 +213,32 @@ static void mmhub_v1_8_init_tlb_regs(struct amdgpu_device *adev) - } - } - -+/* Set snoop bit for SDMA so that SDMA writes probe-invalidates RW lines */ -+static void mmhub_v1_8_init_snoop_override_regs(struct amdgpu_device *adev) -+{ -+ uint32_t tmp, inst_mask; -+ int i, j; -+ uint32_t distance = regDAGB1_WRCLI_GPU_SNOOP_OVERRIDE - -+ regDAGB0_WRCLI_GPU_SNOOP_OVERRIDE; -+ -+ inst_mask = adev->aid_mask; -+ for_each_inst(i, inst_mask) { -+ for (j = 0; j < 5; j++) { /* DAGB instances */ -+ tmp = RREG32_SOC15_OFFSET(MMHUB, i, -+ regDAGB0_WRCLI_GPU_SNOOP_OVERRIDE, j * distance); -+ tmp |= (1 << 15); /* SDMA client is BIT15 */ -+ WREG32_SOC15_OFFSET(MMHUB, i, -+ regDAGB0_WRCLI_GPU_SNOOP_OVERRIDE, j * distance, tmp); -+ -+ tmp = RREG32_SOC15_OFFSET(MMHUB, i, -+ regDAGB0_WRCLI_GPU_SNOOP_OVERRIDE_VALUE, j * distance); -+ tmp |= (1 << 15); -+ WREG32_SOC15_OFFSET(MMHUB, i, -+ regDAGB0_WRCLI_GPU_SNOOP_OVERRIDE_VALUE, j * distance, tmp); -+ } -+ } -+} -+ - static void mmhub_v1_8_init_cache_regs(struct amdgpu_device *adev) - { - uint32_t tmp, inst_mask; -@@ -418,6 +444,7 @@ static int mmhub_v1_8_gart_enable(struct amdgpu_device *adev) - mmhub_v1_8_init_system_aperture_regs(adev); - mmhub_v1_8_init_tlb_regs(adev); - mmhub_v1_8_init_cache_regs(adev); -+ mmhub_v1_8_init_snoop_override_regs(adev); - - mmhub_v1_8_enable_system_domain(adev); - mmhub_v1_8_disable_identity_aperture(adev); -diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c -index 5718e4d40e6665..9713cb59d1c14f 100644 ---- a/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c -+++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c -@@ -198,6 +198,36 @@ static void mmhub_v9_4_init_tlb_regs(struct amdgpu_device *adev, int hubid) - hubid * MMHUB_INSTANCE_REGISTER_OFFSET, tmp); - } - -+/* Set snoop bit for SDMA so that SDMA writes probe-invalidates RW lines */ -+static void mmhub_v9_4_init_snoop_override_regs(struct amdgpu_device *adev, int hubid) -+{ -+ uint32_t tmp; -+ int i; -+ uint32_t distance = mmDAGB1_WRCLI_GPU_SNOOP_OVERRIDE - -+ mmDAGB0_WRCLI_GPU_SNOOP_OVERRIDE; -+ uint32_t huboffset = hubid * MMHUB_INSTANCE_REGISTER_OFFSET; -+ -+ for (i = 0; i < 5 - (2 * hubid); i++) { -+ /* DAGB instances 0 to 4 are in hub0 and 5 to 7 are in hub1 */ -+ tmp = RREG32_SOC15_OFFSET(MMHUB, 0, -+ mmDAGB0_WRCLI_GPU_SNOOP_OVERRIDE, -+ huboffset + i * distance); -+ tmp |= (1 << 15); /* SDMA client is BIT15 */ -+ WREG32_SOC15_OFFSET(MMHUB, 0, -+ mmDAGB0_WRCLI_GPU_SNOOP_OVERRIDE, -+ huboffset + i * distance, tmp); -+ -+ tmp = RREG32_SOC15_OFFSET(MMHUB, 0, -+ mmDAGB0_WRCLI_GPU_SNOOP_OVERRIDE_VALUE, -+ huboffset + i * distance); -+ tmp |= (1 << 15); -+ WREG32_SOC15_OFFSET(MMHUB, 0, -+ mmDAGB0_WRCLI_GPU_SNOOP_OVERRIDE_VALUE, -+ huboffset + i * distance, tmp); -+ } -+ -+} -+ - static void mmhub_v9_4_init_cache_regs(struct amdgpu_device *adev, int hubid) - { - uint32_t tmp; -@@ -392,6 +422,7 @@ static int mmhub_v9_4_gart_enable(struct amdgpu_device *adev) - if (!amdgpu_sriov_vf(adev)) - mmhub_v9_4_init_cache_regs(adev, i); - -+ mmhub_v9_4_init_snoop_override_regs(adev, i); - mmhub_v9_4_enable_system_domain(adev, i); - if (!amdgpu_sriov_vf(adev)) - mmhub_v9_4_disable_identity_aperture(adev, i); -diff --git a/drivers/gpu/drm/amd/amdgpu/nv.c b/drivers/gpu/drm/amd/amdgpu/nv.c -index 7910c463ae3855..82709e692f4cc0 100644 ---- a/drivers/gpu/drm/amd/amdgpu/nv.c -+++ b/drivers/gpu/drm/amd/amdgpu/nv.c -@@ -142,23 +142,23 @@ static struct amdgpu_video_codec_info sriov_sc_video_codecs_encode_array[] = { - }; - - static struct amdgpu_video_codec_info sriov_sc_video_codecs_decode_array_vcn0[] = { -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 1920, 1088, 3)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 1920, 1088, 5)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 16384, 16384, 0)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_AV1, 8192, 4352, 0)}, - }; - - static struct amdgpu_video_codec_info sriov_sc_video_codecs_decode_array_vcn1[] = { -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 1920, 1088, 3)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 1920, 1088, 5)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 16384, 16384, 0)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)}, - }; - -diff --git a/drivers/gpu/drm/amd/amdgpu/soc21.c b/drivers/gpu/drm/amd/amdgpu/soc21.c -index 4712ffc0a482c8..7819f5d584f597 100644 ---- a/drivers/gpu/drm/amd/amdgpu/soc21.c -+++ b/drivers/gpu/drm/amd/amdgpu/soc21.c -@@ -117,23 +117,17 @@ static struct amdgpu_video_codecs sriov_vcn_4_0_0_video_codecs_encode_vcn1 = { - }; - - static struct amdgpu_video_codec_info sriov_vcn_4_0_0_video_codecs_decode_array_vcn0[] = { -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 16384, 16384, 0)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_AV1, 8192, 4352, 0)}, - }; - - static struct amdgpu_video_codec_info sriov_vcn_4_0_0_video_codecs_decode_array_vcn1[] = { -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)}, -- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)}, -+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 16384, 16384, 0)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)}, - }; - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c -index 4d9a406925e189..fd4a75073364c7 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c -@@ -2147,14 +2147,6 @@ static int destroy_queue_cpsch(struct device_queue_manager *dqm, - return retval; - } - --/* -- * Low bits must be 0000/FFFF as required by HW, high bits must be 0 to -- * stay in user mode. -- */ --#define APE1_FIXED_BITS_MASK 0xFFFF80000000FFFFULL --/* APE1 limit is inclusive and 64K aligned. */ --#define APE1_LIMIT_ALIGNMENT 0xFFFF -- - static bool set_cache_memory_policy(struct device_queue_manager *dqm, - struct qcm_process_device *qpd, - enum cache_policy default_policy, -@@ -2169,34 +2161,6 @@ static bool set_cache_memory_policy(struct device_queue_manager *dqm, - - dqm_lock(dqm); - -- if (alternate_aperture_size == 0) { -- /* base > limit disables APE1 */ -- qpd->sh_mem_ape1_base = 1; -- qpd->sh_mem_ape1_limit = 0; -- } else { -- /* -- * In FSA64, APE1_Base[63:0] = { 16{SH_MEM_APE1_BASE[31]}, -- * SH_MEM_APE1_BASE[31:0], 0x0000 } -- * APE1_Limit[63:0] = { 16{SH_MEM_APE1_LIMIT[31]}, -- * SH_MEM_APE1_LIMIT[31:0], 0xFFFF } -- * Verify that the base and size parameters can be -- * represented in this format and convert them. -- * Additionally restrict APE1 to user-mode addresses. -- */ -- -- uint64_t base = (uintptr_t)alternate_aperture_base; -- uint64_t limit = base + alternate_aperture_size - 1; -- -- if (limit <= base || (base & APE1_FIXED_BITS_MASK) != 0 || -- (limit & APE1_FIXED_BITS_MASK) != APE1_LIMIT_ALIGNMENT) { -- retval = false; -- goto out; -- } -- -- qpd->sh_mem_ape1_base = base >> 16; -- qpd->sh_mem_ape1_limit = limit >> 16; -- } -- - retval = dqm->asic_ops.set_cache_memory_policy( - dqm, - qpd, -@@ -2205,6 +2169,9 @@ static bool set_cache_memory_policy(struct device_queue_manager *dqm, - alternate_aperture_base, - alternate_aperture_size); - -+ if (retval) -+ goto out; -+ - if ((dqm->sched_policy == KFD_SCHED_POLICY_NO_HWS) && (qpd->vmid != 0)) - program_sh_mem_settings(dqm, qpd); - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_cik.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_cik.c -index d4d95c7f2e5d40..32bedef912b3b2 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_cik.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_cik.c -@@ -27,6 +27,14 @@ - #include "oss/oss_2_4_sh_mask.h" - #include "gca/gfx_7_2_sh_mask.h" - -+/* -+ * Low bits must be 0000/FFFF as required by HW, high bits must be 0 to -+ * stay in user mode. -+ */ -+#define APE1_FIXED_BITS_MASK 0xFFFF80000000FFFFULL -+/* APE1 limit is inclusive and 64K aligned. */ -+#define APE1_LIMIT_ALIGNMENT 0xFFFF -+ - static bool set_cache_memory_policy_cik(struct device_queue_manager *dqm, - struct qcm_process_device *qpd, - enum cache_policy default_policy, -@@ -84,6 +92,36 @@ static bool set_cache_memory_policy_cik(struct device_queue_manager *dqm, - { - uint32_t default_mtype; - uint32_t ape1_mtype; -+ unsigned int temp; -+ bool retval = true; -+ -+ if (alternate_aperture_size == 0) { -+ /* base > limit disables APE1 */ -+ qpd->sh_mem_ape1_base = 1; -+ qpd->sh_mem_ape1_limit = 0; -+ } else { -+ /* -+ * In FSA64, APE1_Base[63:0] = { 16{SH_MEM_APE1_BASE[31]}, -+ * SH_MEM_APE1_BASE[31:0], 0x0000 } -+ * APE1_Limit[63:0] = { 16{SH_MEM_APE1_LIMIT[31]}, -+ * SH_MEM_APE1_LIMIT[31:0], 0xFFFF } -+ * Verify that the base and size parameters can be -+ * represented in this format and convert them. -+ * Additionally restrict APE1 to user-mode addresses. -+ */ -+ -+ uint64_t base = (uintptr_t)alternate_aperture_base; -+ uint64_t limit = base + alternate_aperture_size - 1; -+ -+ if (limit <= base || (base & APE1_FIXED_BITS_MASK) != 0 || -+ (limit & APE1_FIXED_BITS_MASK) != APE1_LIMIT_ALIGNMENT) { -+ retval = false; -+ goto out; -+ } -+ -+ qpd->sh_mem_ape1_base = base >> 16; -+ qpd->sh_mem_ape1_limit = limit >> 16; -+ } - - default_mtype = (default_policy == cache_policy_coherent) ? - MTYPE_NONCACHED : -@@ -97,37 +135,22 @@ static bool set_cache_memory_policy_cik(struct device_queue_manager *dqm, - | ALIGNMENT_MODE(SH_MEM_ALIGNMENT_MODE_UNALIGNED) - | DEFAULT_MTYPE(default_mtype) - | APE1_MTYPE(ape1_mtype); -- -- return true; --} -- --static int update_qpd_cik(struct device_queue_manager *dqm, -- struct qcm_process_device *qpd) --{ -- struct kfd_process_device *pdd; -- unsigned int temp; -- -- pdd = qpd_to_pdd(qpd); -- -- /* check if sh_mem_config register already configured */ -- if (qpd->sh_mem_config == 0) { -- qpd->sh_mem_config = -- ALIGNMENT_MODE(SH_MEM_ALIGNMENT_MODE_UNALIGNED) | -- DEFAULT_MTYPE(MTYPE_NONCACHED) | -- APE1_MTYPE(MTYPE_NONCACHED); -- qpd->sh_mem_ape1_limit = 0; -- qpd->sh_mem_ape1_base = 0; -- } -- - /* On dGPU we're always in GPUVM64 addressing mode with 64-bit - * aperture addresses. - */ -- temp = get_sh_mem_bases_nybble_64(pdd); -+ temp = get_sh_mem_bases_nybble_64(qpd_to_pdd(qpd)); - qpd->sh_mem_bases = compute_sh_mem_bases_64bit(temp); - - pr_debug("is32bit process: %d sh_mem_bases nybble: 0x%X and register 0x%X\n", - qpd->pqm->process->is_32bit_user_mode, temp, qpd->sh_mem_bases); - -+out: -+ return retval; -+} -+ -+static int update_qpd_cik(struct device_queue_manager *dqm, -+ struct qcm_process_device *qpd) -+{ - return 0; - } - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_vi.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_vi.c -index b291ee0fab9439..320518f418903d 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_vi.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_vi.c -@@ -27,6 +27,14 @@ - #include "gca/gfx_8_0_sh_mask.h" - #include "oss/oss_3_0_sh_mask.h" - -+/* -+ * Low bits must be 0000/FFFF as required by HW, high bits must be 0 to -+ * stay in user mode. -+ */ -+#define APE1_FIXED_BITS_MASK 0xFFFF80000000FFFFULL -+/* APE1 limit is inclusive and 64K aligned. */ -+#define APE1_LIMIT_ALIGNMENT 0xFFFF -+ - static bool set_cache_memory_policy_vi(struct device_queue_manager *dqm, - struct qcm_process_device *qpd, - enum cache_policy default_policy, -@@ -85,6 +93,36 @@ static bool set_cache_memory_policy_vi(struct device_queue_manager *dqm, - { - uint32_t default_mtype; - uint32_t ape1_mtype; -+ unsigned int temp; -+ bool retval = true; -+ -+ if (alternate_aperture_size == 0) { -+ /* base > limit disables APE1 */ -+ qpd->sh_mem_ape1_base = 1; -+ qpd->sh_mem_ape1_limit = 0; -+ } else { -+ /* -+ * In FSA64, APE1_Base[63:0] = { 16{SH_MEM_APE1_BASE[31]}, -+ * SH_MEM_APE1_BASE[31:0], 0x0000 } -+ * APE1_Limit[63:0] = { 16{SH_MEM_APE1_LIMIT[31]}, -+ * SH_MEM_APE1_LIMIT[31:0], 0xFFFF } -+ * Verify that the base and size parameters can be -+ * represented in this format and convert them. -+ * Additionally restrict APE1 to user-mode addresses. -+ */ -+ -+ uint64_t base = (uintptr_t)alternate_aperture_base; -+ uint64_t limit = base + alternate_aperture_size - 1; -+ -+ if (limit <= base || (base & APE1_FIXED_BITS_MASK) != 0 || -+ (limit & APE1_FIXED_BITS_MASK) != APE1_LIMIT_ALIGNMENT) { -+ retval = false; -+ goto out; -+ } -+ -+ qpd->sh_mem_ape1_base = base >> 16; -+ qpd->sh_mem_ape1_limit = limit >> 16; -+ } - - default_mtype = (default_policy == cache_policy_coherent) ? - MTYPE_UC : -@@ -100,40 +138,21 @@ static bool set_cache_memory_policy_vi(struct device_queue_manager *dqm, - default_mtype << SH_MEM_CONFIG__DEFAULT_MTYPE__SHIFT | - ape1_mtype << SH_MEM_CONFIG__APE1_MTYPE__SHIFT; - -- return true; --} -- --static int update_qpd_vi(struct device_queue_manager *dqm, -- struct qcm_process_device *qpd) --{ -- struct kfd_process_device *pdd; -- unsigned int temp; -- -- pdd = qpd_to_pdd(qpd); -- -- /* check if sh_mem_config register already configured */ -- if (qpd->sh_mem_config == 0) { -- qpd->sh_mem_config = -- SH_MEM_ALIGNMENT_MODE_UNALIGNED << -- SH_MEM_CONFIG__ALIGNMENT_MODE__SHIFT | -- MTYPE_UC << -- SH_MEM_CONFIG__DEFAULT_MTYPE__SHIFT | -- MTYPE_UC << -- SH_MEM_CONFIG__APE1_MTYPE__SHIFT; -- -- qpd->sh_mem_ape1_limit = 0; -- qpd->sh_mem_ape1_base = 0; -- } -- - /* On dGPU we're always in GPUVM64 addressing mode with 64-bit - * aperture addresses. - */ -- temp = get_sh_mem_bases_nybble_64(pdd); -+ temp = get_sh_mem_bases_nybble_64(qpd_to_pdd(qpd)); - qpd->sh_mem_bases = compute_sh_mem_bases_64bit(temp); - - pr_debug("sh_mem_bases nybble: 0x%X and register 0x%X\n", - temp, qpd->sh_mem_bases); -+out: -+ return retval; -+} - -+static int update_qpd_vi(struct device_queue_manager *dqm, -+ struct qcm_process_device *qpd) -+{ - return 0; - } - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c -index a6d08dee74f6ea..93740b8fc3f44b 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c -@@ -812,6 +812,14 @@ struct kfd_process *kfd_create_process(struct task_struct *thread) - return ERR_PTR(-EINVAL); - } - -+ /* If the process just called exec(3), it is possible that the -+ * cleanup of the kfd_process (following the release of the mm -+ * of the old process image) is still in the cleanup work queue. -+ * Make sure to drain any job before trying to recreate any -+ * resource for this process. -+ */ -+ flush_workqueue(kfd_process_wq); -+ - /* - * take kfd processes mutex before starting of process creation - * so there won't be a case where two threads of the same process -@@ -830,14 +838,6 @@ struct kfd_process *kfd_create_process(struct task_struct *thread) - if (process) { - pr_debug("Process already found\n"); - } else { -- /* If the process just called exec(3), it is possible that the -- * cleanup of the kfd_process (following the release of the mm -- * of the old process image) is still in the cleanup work queue. -- * Make sure to drain any job before trying to recreate any -- * resource for this process. -- */ -- flush_workqueue(kfd_process_wq); -- - process = create_process(thread); - if (IS_ERR(process)) - goto out; -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index bcf0dc05c76765..9189864c236a7e 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -2896,11 +2896,6 @@ static int dm_resume(void *handle) - - return 0; - } -- -- /* leave display off for S4 sequence */ -- if (adev->in_s4) -- return 0; -- - /* Recreate dc_state - DC invalidates it when setting power state to S3. */ - dc_release_state(dm_state->context); - dm_state->context = dc_create_state(dm->dc); -@@ -7474,7 +7469,7 @@ static int amdgpu_dm_i2c_xfer(struct i2c_adapter *i2c_adap, - int i; - int result = -EIO; - -- if (!ddc_service->ddc_pin || !ddc_service->ddc_pin->hw_info.hw_supported) -+ if (!ddc_service->ddc_pin) - return result; - - cmd.payloads = kcalloc(num, sizeof(struct i2c_payload), GFP_KERNEL); -diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c -index d4d3f58a613f7a..327776eeb9f3ec 100644 ---- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c -@@ -130,7 +130,7 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base, - struct clk_mgr_internal *clk_mgr = TO_CLK_MGR_INTERNAL(clk_mgr_base); - struct dc_clocks *new_clocks = &context->bw_ctx.bw.dcn.clk; - struct dc *dc = clk_mgr_base->ctx->dc; -- int display_count; -+ int display_count = 0; - bool update_dppclk = false; - bool update_dispclk = false; - bool dpp_clock_lowered = false; -@@ -194,8 +194,6 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base, - // workaround: Limit dppclk to 100Mhz to avoid lower eDP panel switch to plus 4K monitor underflow. - if (new_clocks->dppclk_khz < MIN_DPP_DISP_CLK) - new_clocks->dppclk_khz = MIN_DPP_DISP_CLK; -- if (new_clocks->dispclk_khz < MIN_DPP_DISP_CLK) -- new_clocks->dispclk_khz = MIN_DPP_DISP_CLK; - - if (should_set_clock(safe_to_lower, new_clocks->dppclk_khz, clk_mgr->base.clks.dppclk_khz)) { - if (clk_mgr->base.clks.dppclk_khz > new_clocks->dppclk_khz) -@@ -204,15 +202,19 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base, - update_dppclk = true; - } - -- if (should_set_clock(safe_to_lower, new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz)) { -- /* No need to apply the w/a if we haven't taken over from bios yet */ -- if (clk_mgr_base->clks.dispclk_khz) -- dcn315_disable_otg_wa(clk_mgr_base, context, true); -+ if (should_set_clock(safe_to_lower, new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz) && -+ (new_clocks->dispclk_khz > 0 || (safe_to_lower && display_count == 0))) { -+ int requested_dispclk_khz = new_clocks->dispclk_khz; - -+ dcn315_disable_otg_wa(clk_mgr_base, context, true); -+ -+ /* Clamp the requested clock to PMFW based on their limit. */ -+ if (dc->debug.min_disp_clk_khz > 0 && requested_dispclk_khz < dc->debug.min_disp_clk_khz) -+ requested_dispclk_khz = dc->debug.min_disp_clk_khz; -+ -+ dcn315_smu_set_dispclk(clk_mgr, requested_dispclk_khz); - clk_mgr_base->clks.dispclk_khz = new_clocks->dispclk_khz; -- dcn315_smu_set_dispclk(clk_mgr, clk_mgr_base->clks.dispclk_khz); -- if (clk_mgr_base->clks.dispclk_khz) -- dcn315_disable_otg_wa(clk_mgr_base, context, false); -+ dcn315_disable_otg_wa(clk_mgr_base, context, false); - - update_dispclk = true; - } -diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c -index a13ead3d21e310..f95e5e767eb1a6 100644 ---- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c -@@ -140,7 +140,7 @@ static void dcn316_update_clocks(struct clk_mgr *clk_mgr_base, - struct clk_mgr_internal *clk_mgr = TO_CLK_MGR_INTERNAL(clk_mgr_base); - struct dc_clocks *new_clocks = &context->bw_ctx.bw.dcn.clk; - struct dc *dc = clk_mgr_base->ctx->dc; -- int display_count; -+ int display_count = 0; - bool update_dppclk = false; - bool update_dispclk = false; - bool dpp_clock_lowered = false; -@@ -201,8 +201,6 @@ static void dcn316_update_clocks(struct clk_mgr *clk_mgr_base, - // workaround: Limit dppclk to 100Mhz to avoid lower eDP panel switch to plus 4K monitor underflow. - if (new_clocks->dppclk_khz < 100000) - new_clocks->dppclk_khz = 100000; -- if (new_clocks->dispclk_khz < 100000) -- new_clocks->dispclk_khz = 100000; - - if (should_set_clock(safe_to_lower, new_clocks->dppclk_khz, clk_mgr->base.clks.dppclk_khz)) { - if (clk_mgr->base.clks.dppclk_khz > new_clocks->dppclk_khz) -@@ -211,11 +209,18 @@ static void dcn316_update_clocks(struct clk_mgr *clk_mgr_base, - update_dppclk = true; - } - -- if (should_set_clock(safe_to_lower, new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz)) { -+ if (should_set_clock(safe_to_lower, new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz) && -+ (new_clocks->dispclk_khz > 0 || (safe_to_lower && display_count == 0))) { -+ int requested_dispclk_khz = new_clocks->dispclk_khz; -+ - dcn316_disable_otg_wa(clk_mgr_base, context, safe_to_lower, true); - -+ /* Clamp the requested clock to PMFW based on their limit. */ -+ if (dc->debug.min_disp_clk_khz > 0 && requested_dispclk_khz < dc->debug.min_disp_clk_khz) -+ requested_dispclk_khz = dc->debug.min_disp_clk_khz; -+ -+ dcn316_smu_set_dispclk(clk_mgr, requested_dispclk_khz); - clk_mgr_base->clks.dispclk_khz = new_clocks->dispclk_khz; -- dcn316_smu_set_dispclk(clk_mgr, clk_mgr_base->clks.dispclk_khz); - dcn316_disable_otg_wa(clk_mgr_base, context, safe_to_lower, false); - - update_dispclk = true; -diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c -index c2efe18ceacd07..640d010b52bec3 100644 ---- a/drivers/gpu/drm/amd/display/dc/core/dc.c -+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c -@@ -266,6 +266,7 @@ static bool create_links( - link->link_id.type = OBJECT_TYPE_CONNECTOR; - link->link_id.id = CONNECTOR_ID_VIRTUAL; - link->link_id.enum_id = ENUM_ID_1; -+ link->psr_settings.psr_version = DC_PSR_VERSION_UNSUPPORTED; - link->link_enc = kzalloc(sizeof(*link->link_enc), GFP_KERNEL); - - if (!link->link_enc) { -diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c -index 7b5c1498941dd6..d389eeb264a79e 100644 ---- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c -+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c -@@ -1066,7 +1066,8 @@ void dce110_edp_backlight_control( - DC_LOG_DC("edp_receiver_ready_T9 skipped\n"); - } - -- if (!enable && link->dpcd_sink_ext_caps.bits.oled) { -+ if (!enable) { -+ /*follow oem panel config's requirement*/ - pre_T11_delay += link->panel_config.pps.extra_pre_t11_ms; - msleep(pre_T11_delay); - } -diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c -index 50dc834046446a..4ce45f1bdac0fe 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c -@@ -392,11 +392,6 @@ bool dpp3_get_optimal_number_of_taps( - int min_taps_y, min_taps_c; - enum lb_memory_config lb_config; - -- if (scl_data->viewport.width > scl_data->h_active && -- dpp->ctx->dc->debug.max_downscale_src_width != 0 && -- scl_data->viewport.width > dpp->ctx->dc->debug.max_downscale_src_width) -- return false; -- - /* - * Set default taps if none are provided - * From programming guide: taps = min{ ceil(2*H_RATIO,1), 8} for downscaling -@@ -434,6 +429,12 @@ bool dpp3_get_optimal_number_of_taps( - else - scl_data->taps.h_taps_c = in_taps->h_taps_c; - -+ // Avoid null data in the scl data with this early return, proceed non-adaptive calcualtion first -+ if (scl_data->viewport.width > scl_data->h_active && -+ dpp->ctx->dc->debug.max_downscale_src_width != 0 && -+ scl_data->viewport.width > dpp->ctx->dc->debug.max_downscale_src_width) -+ return false; -+ - /*Ensure we can support the requested number of vtaps*/ - min_taps_y = dc_fixpt_ceil(scl_data->ratios.vert); - min_taps_c = dc_fixpt_ceil(scl_data->ratios.vert_c); -diff --git a/drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c b/drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c -index 597fa0364a3a9b..d1601d61f05adc 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c -@@ -1692,7 +1692,7 @@ static int dcn315_populate_dml_pipes_from_context( - pipes[pipe_cnt].dout.dsc_input_bpc = 0; - DC_FP_START(); - dcn31_zero_pipe_dcc_fraction(pipes, pipe_cnt); -- if (pixel_rate_crb && !pipe->top_pipe && !pipe->prev_odm_pipe) { -+ if (pixel_rate_crb) { - int bpp = source_format_to_bpp(pipes[pipe_cnt].pipe.src.source_format); - /* Ceil to crb segment size */ - int approx_det_segs_required_for_pstate = dcn_get_approx_det_segs_required_for_pstate( -@@ -1749,28 +1749,26 @@ static int dcn315_populate_dml_pipes_from_context( - continue; - } - -- if (!pipe->top_pipe && !pipe->prev_odm_pipe) { -- bool split_required = pipe->stream->timing.pix_clk_100hz >= dcn_get_max_non_odm_pix_rate_100hz(&dc->dml.soc) -- || (pipe->plane_state && pipe->plane_state->src_rect.width > 5120); -- -- if (remaining_det_segs > MIN_RESERVED_DET_SEGS && crb_pipes != 0) -- pipes[pipe_cnt].pipe.src.det_size_override += (remaining_det_segs - MIN_RESERVED_DET_SEGS) / crb_pipes + -- (crb_idx < (remaining_det_segs - MIN_RESERVED_DET_SEGS) % crb_pipes ? 1 : 0); -- if (pipes[pipe_cnt].pipe.src.det_size_override > 2 * DCN3_15_MAX_DET_SEGS) { -- /* Clamp to 2 pipe split max det segments */ -- remaining_det_segs += pipes[pipe_cnt].pipe.src.det_size_override - 2 * (DCN3_15_MAX_DET_SEGS); -- pipes[pipe_cnt].pipe.src.det_size_override = 2 * DCN3_15_MAX_DET_SEGS; -- } -- if (pipes[pipe_cnt].pipe.src.det_size_override > DCN3_15_MAX_DET_SEGS || split_required) { -- /* If we are splitting we must have an even number of segments */ -- remaining_det_segs += pipes[pipe_cnt].pipe.src.det_size_override % 2; -- pipes[pipe_cnt].pipe.src.det_size_override -= pipes[pipe_cnt].pipe.src.det_size_override % 2; -- } -- /* Convert segments into size for DML use */ -- pipes[pipe_cnt].pipe.src.det_size_override *= DCN3_15_CRB_SEGMENT_SIZE_KB; -- -- crb_idx++; -+ bool split_required = pipe->stream->timing.pix_clk_100hz >= dcn_get_max_non_odm_pix_rate_100hz(&dc->dml.soc) -+ || (pipe->plane_state && pipe->plane_state->src_rect.width > 5120); -+ -+ if (remaining_det_segs > MIN_RESERVED_DET_SEGS && crb_pipes != 0) -+ pipes[pipe_cnt].pipe.src.det_size_override += (remaining_det_segs - MIN_RESERVED_DET_SEGS) / crb_pipes + -+ (crb_idx < (remaining_det_segs - MIN_RESERVED_DET_SEGS) % crb_pipes ? 1 : 0); -+ if (pipes[pipe_cnt].pipe.src.det_size_override > 2 * DCN3_15_MAX_DET_SEGS) { -+ /* Clamp to 2 pipe split max det segments */ -+ remaining_det_segs += pipes[pipe_cnt].pipe.src.det_size_override - 2 * (DCN3_15_MAX_DET_SEGS); -+ pipes[pipe_cnt].pipe.src.det_size_override = 2 * DCN3_15_MAX_DET_SEGS; -+ } -+ if (pipes[pipe_cnt].pipe.src.det_size_override > DCN3_15_MAX_DET_SEGS || split_required) { -+ /* If we are splitting we must have an even number of segments */ -+ remaining_det_segs += pipes[pipe_cnt].pipe.src.det_size_override % 2; -+ pipes[pipe_cnt].pipe.src.det_size_override -= pipes[pipe_cnt].pipe.src.det_size_override % 2; - } -+ /* Convert segments into size for DML use */ -+ pipes[pipe_cnt].pipe.src.det_size_override *= DCN3_15_CRB_SEGMENT_SIZE_KB; -+ -+ crb_idx++; - pipe_cnt++; - } - } -diff --git a/drivers/gpu/drm/amd/display/dc/inc/core_types.h b/drivers/gpu/drm/amd/display/dc/inc/core_types.h -index eaad1260bfd180..4b284ce669ae52 100644 ---- a/drivers/gpu/drm/amd/display/dc/inc/core_types.h -+++ b/drivers/gpu/drm/amd/display/dc/inc/core_types.h -@@ -532,7 +532,7 @@ struct dc_state { - */ - struct bw_context bw_ctx; - -- struct block_sequence block_sequence[50]; -+ struct block_sequence block_sequence[100]; - unsigned int block_sequence_steps; - struct dc_dmub_cmd dc_dmub_cmd[10]; - unsigned int dmub_cmd_count; -diff --git a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c -index 4901e27f678bcf..9b470812d96a5f 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c -+++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c -@@ -145,6 +145,7 @@ void link_blank_dp_stream(struct dc_link *link, bool hw_init) - void link_set_all_streams_dpms_off_for_link(struct dc_link *link) - { - struct pipe_ctx *pipes[MAX_PIPES]; -+ struct dc_stream_state *streams[MAX_PIPES]; - struct dc_state *state = link->dc->current_state; - uint8_t count; - int i; -@@ -157,10 +158,18 @@ void link_set_all_streams_dpms_off_for_link(struct dc_link *link) - - link_get_master_pipes_with_dpms_on(link, state, &count, pipes); - -+ /* The subsequent call to dc_commit_updates_for_stream for a full update -+ * will release the current state and swap to a new state. Releasing the -+ * current state results in the stream pointers in the pipe_ctx structs -+ * to be zero'd. Hence, cache all streams prior to dc_commit_updates_for_stream. -+ */ -+ for (i = 0; i < count; i++) -+ streams[i] = pipes[i]->stream; -+ - for (i = 0; i < count; i++) { -- stream_update.stream = pipes[i]->stream; -+ stream_update.stream = streams[i]; - dc_commit_updates_for_stream(link->ctx->dc, NULL, 0, -- pipes[i]->stream, &stream_update, -+ streams[i], &stream_update, - state); - } - -diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c -index 3d589072fe307e..adf0ef8b70e4b1 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c -+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c -@@ -239,21 +239,21 @@ static uint32_t intersect_frl_link_bw_support( - { - uint32_t supported_bw_in_kbps = max_supported_frl_bw_in_kbps; - -- // HDMI_ENCODED_LINK_BW bits are only valid if HDMI Link Configuration bit is 1 (FRL mode) -- if (hdmi_encoded_link_bw.bits.FRL_MODE) { -- if (hdmi_encoded_link_bw.bits.BW_48Gbps) -- supported_bw_in_kbps = 48000000; -- else if (hdmi_encoded_link_bw.bits.BW_40Gbps) -- supported_bw_in_kbps = 40000000; -- else if (hdmi_encoded_link_bw.bits.BW_32Gbps) -- supported_bw_in_kbps = 32000000; -- else if (hdmi_encoded_link_bw.bits.BW_24Gbps) -- supported_bw_in_kbps = 24000000; -- else if (hdmi_encoded_link_bw.bits.BW_18Gbps) -- supported_bw_in_kbps = 18000000; -- else if (hdmi_encoded_link_bw.bits.BW_9Gbps) -- supported_bw_in_kbps = 9000000; -- } -+ /* Skip checking FRL_MODE bit, as certain PCON will clear -+ * it despite supporting the link BW indicated in the other bits. -+ */ -+ if (hdmi_encoded_link_bw.bits.BW_48Gbps) -+ supported_bw_in_kbps = 48000000; -+ else if (hdmi_encoded_link_bw.bits.BW_40Gbps) -+ supported_bw_in_kbps = 40000000; -+ else if (hdmi_encoded_link_bw.bits.BW_32Gbps) -+ supported_bw_in_kbps = 32000000; -+ else if (hdmi_encoded_link_bw.bits.BW_24Gbps) -+ supported_bw_in_kbps = 24000000; -+ else if (hdmi_encoded_link_bw.bits.BW_18Gbps) -+ supported_bw_in_kbps = 18000000; -+ else if (hdmi_encoded_link_bw.bits.BW_9Gbps) -+ supported_bw_in_kbps = 9000000; - - return supported_bw_in_kbps; - } -@@ -920,6 +920,9 @@ bool link_decide_link_settings(struct dc_stream_state *stream, - * TODO: add MST specific link training routine - */ - decide_mst_link_settings(link, link_setting); -+ } else if (stream->signal == SIGNAL_TYPE_VIRTUAL) { -+ link_setting->lane_count = LANE_COUNT_FOUR; -+ link_setting->link_rate = LINK_RATE_HIGH3; - } else if (link->connector_signal == SIGNAL_TYPE_EDP) { - /* enable edp link optimization for DSC eDP case */ - if (stream->timing.flags.DSC) { -diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_phy.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_phy.c -index 9bde0c8bf914a6..f01a3df584552f 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_phy.c -+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_phy.c -@@ -74,7 +74,8 @@ void dp_disable_link_phy(struct dc_link *link, - struct dc *dc = link->ctx->dc; - - if (!link->wa_flags.dp_keep_receiver_powered && -- !link->skip_implict_edp_power_control) -+ !link->skip_implict_edp_power_control && -+ link->type != dc_connection_none) - dpcd_write_rx_power_ctrl(link, false); - - dc->hwss.disable_link_output(link, link_res, signal); -@@ -159,8 +160,9 @@ enum dc_status dp_set_fec_ready(struct dc_link *link, const struct link_resource - } else { - if (link->fec_state == dc_link_fec_ready) { - fec_config = 0; -- core_link_write_dpcd(link, DP_FEC_CONFIGURATION, -- &fec_config, sizeof(fec_config)); -+ if (link->type != dc_connection_none) -+ core_link_write_dpcd(link, DP_FEC_CONFIGURATION, -+ &fec_config, sizeof(fec_config)); - - link_enc->funcs->fec_set_ready(link_enc, false); - link->fec_state = dc_link_fec_not_ready; -diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_8b_10b.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_8b_10b.c -index 2b4c15b0b40708..52261e7c11c0b4 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_8b_10b.c -+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_8b_10b.c -@@ -36,7 +36,8 @@ - link->ctx->logger - - static int32_t get_cr_training_aux_rd_interval(struct dc_link *link, -- const struct dc_link_settings *link_settings) -+ const struct dc_link_settings *link_settings, -+ enum lttpr_mode lttpr_mode) - { - union training_aux_rd_interval training_rd_interval; - uint32_t wait_in_micro_secs = 100; -@@ -49,6 +50,8 @@ static int32_t get_cr_training_aux_rd_interval(struct dc_link *link, - DP_TRAINING_AUX_RD_INTERVAL, - (uint8_t *)&training_rd_interval, - sizeof(training_rd_interval)); -+ if (lttpr_mode != LTTPR_MODE_NON_TRANSPARENT) -+ wait_in_micro_secs = 400; - if (training_rd_interval.bits.TRAINIG_AUX_RD_INTERVAL) - wait_in_micro_secs = training_rd_interval.bits.TRAINIG_AUX_RD_INTERVAL * 4000; - } -@@ -110,7 +113,6 @@ void decide_8b_10b_training_settings( - */ - lt_settings->link_settings.link_spread = link->dp_ss_off ? - LINK_SPREAD_DISABLED : LINK_SPREAD_05_DOWNSPREAD_30KHZ; -- lt_settings->cr_pattern_time = get_cr_training_aux_rd_interval(link, link_setting); - lt_settings->eq_pattern_time = get_eq_training_aux_rd_interval(link, link_setting); - lt_settings->pattern_for_cr = decide_cr_training_pattern(link_setting); - lt_settings->pattern_for_eq = decide_eq_training_pattern(link, link_setting); -@@ -119,6 +121,7 @@ void decide_8b_10b_training_settings( - lt_settings->disallow_per_lane_settings = true; - lt_settings->always_match_dpcd_with_hw_lane_settings = true; - lt_settings->lttpr_mode = dp_decide_8b_10b_lttpr_mode(link); -+ lt_settings->cr_pattern_time = get_cr_training_aux_rd_interval(link, link_setting, lt_settings->lttpr_mode); - dp_hw_to_dpcd_lane_settings(lt_settings, lt_settings->hw_lane_settings, lt_settings->dpcd_lane_settings); - } - -diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c -index 13104d000b9e09..d4d92da153ece2 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c -+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c -@@ -662,6 +662,18 @@ bool edp_setup_psr(struct dc_link *link, - if (!link) - return false; - -+ //Clear PSR cfg -+ memset(&psr_configuration, 0, sizeof(psr_configuration)); -+ dm_helpers_dp_write_dpcd( -+ link->ctx, -+ link, -+ DP_PSR_EN_CFG, -+ &psr_configuration.raw, -+ sizeof(psr_configuration.raw)); -+ -+ if (link->psr_settings.psr_version == DC_PSR_VERSION_UNSUPPORTED) -+ return false; -+ - dc = link->ctx->dc; - dmcu = dc->res_pool->dmcu; - psr = dc->res_pool->psr; -@@ -672,9 +684,6 @@ bool edp_setup_psr(struct dc_link *link, - if (!dc_get_edp_link_panel_inst(dc, link, &panel_inst)) - return false; - -- -- memset(&psr_configuration, 0, sizeof(psr_configuration)); -- - psr_configuration.bits.ENABLE = 1; - psr_configuration.bits.CRC_VERIFICATION = 1; - psr_configuration.bits.FRAME_CAPTURE_INDICATION = -@@ -938,6 +947,16 @@ bool edp_setup_replay(struct dc_link *link, const struct dc_stream_state *stream - if (!link) - return false; - -+ //Clear Replay config -+ dm_helpers_dp_write_dpcd(link->ctx, link, -+ DP_SINK_PR_ENABLE_AND_CONFIGURATION, -+ (uint8_t *)&(replay_config.raw), sizeof(uint8_t)); -+ -+ if (!(link->replay_settings.config.replay_supported)) -+ return false; -+ -+ link->replay_settings.config.replay_error_status.raw = 0; -+ - dc = link->ctx->dc; - - replay = dc->res_pool->replay; -diff --git a/drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_9_4_1_offset.h b/drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_9_4_1_offset.h -index c488d4a50cf46a..b2252deabc17a4 100644 ---- a/drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_9_4_1_offset.h -+++ b/drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_9_4_1_offset.h -@@ -203,6 +203,10 @@ - #define mmDAGB0_WR_DATA_CREDIT_BASE_IDX 1 - #define mmDAGB0_WR_MISC_CREDIT 0x0058 - #define mmDAGB0_WR_MISC_CREDIT_BASE_IDX 1 -+#define mmDAGB0_WRCLI_GPU_SNOOP_OVERRIDE 0x005b -+#define mmDAGB0_WRCLI_GPU_SNOOP_OVERRIDE_BASE_IDX 1 -+#define mmDAGB0_WRCLI_GPU_SNOOP_OVERRIDE_VALUE 0x005c -+#define mmDAGB0_WRCLI_GPU_SNOOP_OVERRIDE_VALUE_BASE_IDX 1 - #define mmDAGB0_WRCLI_ASK_PENDING 0x005d - #define mmDAGB0_WRCLI_ASK_PENDING_BASE_IDX 1 - #define mmDAGB0_WRCLI_GO_PENDING 0x005e -@@ -455,6 +459,10 @@ - #define mmDAGB1_WR_DATA_CREDIT_BASE_IDX 1 - #define mmDAGB1_WR_MISC_CREDIT 0x00d8 - #define mmDAGB1_WR_MISC_CREDIT_BASE_IDX 1 -+#define mmDAGB1_WRCLI_GPU_SNOOP_OVERRIDE 0x00db -+#define mmDAGB1_WRCLI_GPU_SNOOP_OVERRIDE_BASE_IDX 1 -+#define mmDAGB1_WRCLI_GPU_SNOOP_OVERRIDE_VALUE 0x00dc -+#define mmDAGB1_WRCLI_GPU_SNOOP_OVERRIDE_VALUE_BASE_IDX 1 - #define mmDAGB1_WRCLI_ASK_PENDING 0x00dd - #define mmDAGB1_WRCLI_ASK_PENDING_BASE_IDX 1 - #define mmDAGB1_WRCLI_GO_PENDING 0x00de -@@ -707,6 +715,10 @@ - #define mmDAGB2_WR_DATA_CREDIT_BASE_IDX 1 - #define mmDAGB2_WR_MISC_CREDIT 0x0158 - #define mmDAGB2_WR_MISC_CREDIT_BASE_IDX 1 -+#define mmDAGB2_WRCLI_GPU_SNOOP_OVERRIDE 0x015b -+#define mmDAGB2_WRCLI_GPU_SNOOP_OVERRIDE_BASE_IDX 1 -+#define mmDAGB2_WRCLI_GPU_SNOOP_OVERRIDE_VALUE 0x015c -+#define mmDAGB2_WRCLI_GPU_SNOOP_OVERRIDE_VALUE_BASE_IDX 1 - #define mmDAGB2_WRCLI_ASK_PENDING 0x015d - #define mmDAGB2_WRCLI_ASK_PENDING_BASE_IDX 1 - #define mmDAGB2_WRCLI_GO_PENDING 0x015e -@@ -959,6 +971,10 @@ - #define mmDAGB3_WR_DATA_CREDIT_BASE_IDX 1 - #define mmDAGB3_WR_MISC_CREDIT 0x01d8 - #define mmDAGB3_WR_MISC_CREDIT_BASE_IDX 1 -+#define mmDAGB3_WRCLI_GPU_SNOOP_OVERRIDE 0x01db -+#define mmDAGB3_WRCLI_GPU_SNOOP_OVERRIDE_BASE_IDX 1 -+#define mmDAGB3_WRCLI_GPU_SNOOP_OVERRIDE_VALUE 0x01dc -+#define mmDAGB3_WRCLI_GPU_SNOOP_OVERRIDE_VALUE_BASE_IDX 1 - #define mmDAGB3_WRCLI_ASK_PENDING 0x01dd - #define mmDAGB3_WRCLI_ASK_PENDING_BASE_IDX 1 - #define mmDAGB3_WRCLI_GO_PENDING 0x01de -@@ -1211,6 +1227,10 @@ - #define mmDAGB4_WR_DATA_CREDIT_BASE_IDX 1 - #define mmDAGB4_WR_MISC_CREDIT 0x0258 - #define mmDAGB4_WR_MISC_CREDIT_BASE_IDX 1 -+#define mmDAGB4_WRCLI_GPU_SNOOP_OVERRIDE 0x025b -+#define mmDAGB4_WRCLI_GPU_SNOOP_OVERRIDE_BASE_IDX 1 -+#define mmDAGB4_WRCLI_GPU_SNOOP_OVERRIDE_VALUE 0x025c -+#define mmDAGB4_WRCLI_GPU_SNOOP_OVERRIDE_VALUE_BASE_IDX 1 - #define mmDAGB4_WRCLI_ASK_PENDING 0x025d - #define mmDAGB4_WRCLI_ASK_PENDING_BASE_IDX 1 - #define mmDAGB4_WRCLI_GO_PENDING 0x025e -@@ -4793,6 +4813,10 @@ - #define mmDAGB5_WR_DATA_CREDIT_BASE_IDX 1 - #define mmDAGB5_WR_MISC_CREDIT 0x3058 - #define mmDAGB5_WR_MISC_CREDIT_BASE_IDX 1 -+#define mmDAGB5_WRCLI_GPU_SNOOP_OVERRIDE 0x305b -+#define mmDAGB5_WRCLI_GPU_SNOOP_OVERRIDE_BASE_IDX 1 -+#define mmDAGB5_WRCLI_GPU_SNOOP_OVERRIDE_VALUE 0x305c -+#define mmDAGB5_WRCLI_GPU_SNOOP_OVERRIDE_VALUE_BASE_IDX 1 - #define mmDAGB5_WRCLI_ASK_PENDING 0x305d - #define mmDAGB5_WRCLI_ASK_PENDING_BASE_IDX 1 - #define mmDAGB5_WRCLI_GO_PENDING 0x305e -@@ -5045,6 +5069,10 @@ - #define mmDAGB6_WR_DATA_CREDIT_BASE_IDX 1 - #define mmDAGB6_WR_MISC_CREDIT 0x30d8 - #define mmDAGB6_WR_MISC_CREDIT_BASE_IDX 1 -+#define mmDAGB6_WRCLI_GPU_SNOOP_OVERRIDE 0x30db -+#define mmDAGB6_WRCLI_GPU_SNOOP_OVERRIDE_BASE_IDX 1 -+#define mmDAGB6_WRCLI_GPU_SNOOP_OVERRIDE_VALUE 0x30dc -+#define mmDAGB6_WRCLI_GPU_SNOOP_OVERRIDE_VALUE_BASE_IDX 1 - #define mmDAGB6_WRCLI_ASK_PENDING 0x30dd - #define mmDAGB6_WRCLI_ASK_PENDING_BASE_IDX 1 - #define mmDAGB6_WRCLI_GO_PENDING 0x30de -@@ -5297,6 +5325,10 @@ - #define mmDAGB7_WR_DATA_CREDIT_BASE_IDX 1 - #define mmDAGB7_WR_MISC_CREDIT 0x3158 - #define mmDAGB7_WR_MISC_CREDIT_BASE_IDX 1 -+#define mmDAGB7_WRCLI_GPU_SNOOP_OVERRIDE 0x315b -+#define mmDAGB7_WRCLI_GPU_SNOOP_OVERRIDE_BASE_IDX 1 -+#define mmDAGB7_WRCLI_GPU_SNOOP_OVERRIDE_VALUE 0x315c -+#define mmDAGB7_WRCLI_GPU_SNOOP_OVERRIDE_VALUE_BASE_IDX 1 - #define mmDAGB7_WRCLI_ASK_PENDING 0x315d - #define mmDAGB7_WRCLI_ASK_PENDING_BASE_IDX 1 - #define mmDAGB7_WRCLI_GO_PENDING 0x315e -diff --git a/drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_9_4_1_sh_mask.h b/drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_9_4_1_sh_mask.h -index 2969fbf282b7d0..5069d2fd467f2b 100644 ---- a/drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_9_4_1_sh_mask.h -+++ b/drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_9_4_1_sh_mask.h -@@ -1532,6 +1532,12 @@ - //DAGB0_WRCLI_DBUS_GO_PENDING - #define DAGB0_WRCLI_DBUS_GO_PENDING__BUSY__SHIFT 0x0 - #define DAGB0_WRCLI_DBUS_GO_PENDING__BUSY_MASK 0xFFFFFFFFL -+//DAGB0_WRCLI_GPU_SNOOP_OVERRIDE -+#define DAGB0_WRCLI_GPU_SNOOP_OVERRIDE__ENABLE__SHIFT 0x0 -+#define DAGB0_WRCLI_GPU_SNOOP_OVERRIDE__ENABLE_MASK 0xFFFFFFFFL -+//DAGB0_WRCLI_GPU_SNOOP_OVERRIDE_VALUE -+#define DAGB0_WRCLI_GPU_SNOOP_OVERRIDE_VALUE__ENABLE__SHIFT 0x0 -+#define DAGB0_WRCLI_GPU_SNOOP_OVERRIDE_VALUE__ENABLE_MASK 0xFFFFFFFFL - //DAGB0_DAGB_DLY - #define DAGB0_DAGB_DLY__DLY__SHIFT 0x0 - #define DAGB0_DAGB_DLY__CLI__SHIFT 0x8 -@@ -3207,6 +3213,12 @@ - //DAGB1_WRCLI_DBUS_GO_PENDING - #define DAGB1_WRCLI_DBUS_GO_PENDING__BUSY__SHIFT 0x0 - #define DAGB1_WRCLI_DBUS_GO_PENDING__BUSY_MASK 0xFFFFFFFFL -+//DAGB1_WRCLI_GPU_SNOOP_OVERRIDE -+#define DAGB1_WRCLI_GPU_SNOOP_OVERRIDE__ENABLE__SHIFT 0x0 -+#define DAGB1_WRCLI_GPU_SNOOP_OVERRIDE__ENABLE_MASK 0xFFFFFFFFL -+//DAGB1_WRCLI_GPU_SNOOP_OVERRIDE_VALUE -+#define DAGB1_WRCLI_GPU_SNOOP_OVERRIDE_VALUE__ENABLE__SHIFT 0x0 -+#define DAGB1_WRCLI_GPU_SNOOP_OVERRIDE_VALUE__ENABLE_MASK 0xFFFFFFFFL - //DAGB1_DAGB_DLY - #define DAGB1_DAGB_DLY__DLY__SHIFT 0x0 - #define DAGB1_DAGB_DLY__CLI__SHIFT 0x8 -@@ -4882,6 +4894,12 @@ - //DAGB2_WRCLI_DBUS_GO_PENDING - #define DAGB2_WRCLI_DBUS_GO_PENDING__BUSY__SHIFT 0x0 - #define DAGB2_WRCLI_DBUS_GO_PENDING__BUSY_MASK 0xFFFFFFFFL -+//DAGB2_WRCLI_GPU_SNOOP_OVERRIDE -+#define DAGB2_WRCLI_GPU_SNOOP_OVERRIDE__ENABLE__SHIFT 0x0 -+#define DAGB2_WRCLI_GPU_SNOOP_OVERRIDE__ENABLE_MASK 0xFFFFFFFFL -+//DAGB2_WRCLI_GPU_SNOOP_OVERRIDE_VALUE -+#define DAGB2_WRCLI_GPU_SNOOP_OVERRIDE_VALUE__ENABLE__SHIFT 0x0 -+#define DAGB2_WRCLI_GPU_SNOOP_OVERRIDE_VALUE__ENABLE_MASK 0xFFFFFFFFL - //DAGB2_DAGB_DLY - #define DAGB2_DAGB_DLY__DLY__SHIFT 0x0 - #define DAGB2_DAGB_DLY__CLI__SHIFT 0x8 -@@ -6557,6 +6575,12 @@ - //DAGB3_WRCLI_DBUS_GO_PENDING - #define DAGB3_WRCLI_DBUS_GO_PENDING__BUSY__SHIFT 0x0 - #define DAGB3_WRCLI_DBUS_GO_PENDING__BUSY_MASK 0xFFFFFFFFL -+//DAGB3_WRCLI_GPU_SNOOP_OVERRIDE -+#define DAGB3_WRCLI_GPU_SNOOP_OVERRIDE__ENABLE__SHIFT 0x0 -+#define DAGB3_WRCLI_GPU_SNOOP_OVERRIDE__ENABLE_MASK 0xFFFFFFFFL -+//DAGB3_WRCLI_GPU_SNOOP_OVERRIDE_VALUE -+#define DAGB3_WRCLI_GPU_SNOOP_OVERRIDE_VALUE__ENABLE__SHIFT 0x0 -+#define DAGB3_WRCLI_GPU_SNOOP_OVERRIDE_VALUE__ENABLE_MASK 0xFFFFFFFFL - //DAGB3_DAGB_DLY - #define DAGB3_DAGB_DLY__DLY__SHIFT 0x0 - #define DAGB3_DAGB_DLY__CLI__SHIFT 0x8 -@@ -8232,6 +8256,12 @@ - //DAGB4_WRCLI_DBUS_GO_PENDING - #define DAGB4_WRCLI_DBUS_GO_PENDING__BUSY__SHIFT 0x0 - #define DAGB4_WRCLI_DBUS_GO_PENDING__BUSY_MASK 0xFFFFFFFFL -+//DAGB4_WRCLI_GPU_SNOOP_OVERRIDE -+#define DAGB4_WRCLI_GPU_SNOOP_OVERRIDE__ENABLE__SHIFT 0x0 -+#define DAGB4_WRCLI_GPU_SNOOP_OVERRIDE__ENABLE_MASK 0xFFFFFFFFL -+//DAGB4_WRCLI_GPU_SNOOP_OVERRIDE_VALUE -+#define DAGB4_WRCLI_GPU_SNOOP_OVERRIDE_VALUE__ENABLE__SHIFT 0x0 -+#define DAGB4_WRCLI_GPU_SNOOP_OVERRIDE_VALUE__ENABLE_MASK 0xFFFFFFFFL - //DAGB4_DAGB_DLY - #define DAGB4_DAGB_DLY__DLY__SHIFT 0x0 - #define DAGB4_DAGB_DLY__CLI__SHIFT 0x8 -@@ -28737,6 +28767,12 @@ - //DAGB5_WRCLI_DBUS_GO_PENDING - #define DAGB5_WRCLI_DBUS_GO_PENDING__BUSY__SHIFT 0x0 - #define DAGB5_WRCLI_DBUS_GO_PENDING__BUSY_MASK 0xFFFFFFFFL -+//DAGB5_WRCLI_GPU_SNOOP_OVERRIDE -+#define DAGB5_WRCLI_GPU_SNOOP_OVERRIDE__ENABLE__SHIFT 0x0 -+#define DAGB5_WRCLI_GPU_SNOOP_OVERRIDE__ENABLE_MASK 0xFFFFFFFFL -+//DAGB5_WRCLI_GPU_SNOOP_OVERRIDE_VALUE -+#define DAGB5_WRCLI_GPU_SNOOP_OVERRIDE_VALUE__ENABLE__SHIFT 0x0 -+#define DAGB5_WRCLI_GPU_SNOOP_OVERRIDE_VALUE__ENABLE_MASK 0xFFFFFFFFL - //DAGB5_DAGB_DLY - #define DAGB5_DAGB_DLY__DLY__SHIFT 0x0 - #define DAGB5_DAGB_DLY__CLI__SHIFT 0x8 -@@ -30412,6 +30448,12 @@ - //DAGB6_WRCLI_DBUS_GO_PENDING - #define DAGB6_WRCLI_DBUS_GO_PENDING__BUSY__SHIFT 0x0 - #define DAGB6_WRCLI_DBUS_GO_PENDING__BUSY_MASK 0xFFFFFFFFL -+//DAGB6_WRCLI_GPU_SNOOP_OVERRIDE -+#define DAGB6_WRCLI_GPU_SNOOP_OVERRIDE__ENABLE__SHIFT 0x0 -+#define DAGB6_WRCLI_GPU_SNOOP_OVERRIDE__ENABLE_MASK 0xFFFFFFFFL -+//DAGB6_WRCLI_GPU_SNOOP_OVERRIDE_VALUE -+#define DAGB6_WRCLI_GPU_SNOOP_OVERRIDE_VALUE__ENABLE__SHIFT 0x0 -+#define DAGB6_WRCLI_GPU_SNOOP_OVERRIDE_VALUE__ENABLE_MASK 0xFFFFFFFFL - //DAGB6_DAGB_DLY - #define DAGB6_DAGB_DLY__DLY__SHIFT 0x0 - #define DAGB6_DAGB_DLY__CLI__SHIFT 0x8 -@@ -32087,6 +32129,12 @@ - //DAGB7_WRCLI_DBUS_GO_PENDING - #define DAGB7_WRCLI_DBUS_GO_PENDING__BUSY__SHIFT 0x0 - #define DAGB7_WRCLI_DBUS_GO_PENDING__BUSY_MASK 0xFFFFFFFFL -+//DAGB7_WRCLI_GPU_SNOOP_OVERRIDE -+#define DAGB7_WRCLI_GPU_SNOOP_OVERRIDE__ENABLE__SHIFT 0x0 -+#define DAGB7_WRCLI_GPU_SNOOP_OVERRIDE__ENABLE_MASK 0xFFFFFFFFL -+//DAGB7_WRCLI_GPU_SNOOP_OVERRIDE_VALUE -+#define DAGB7_WRCLI_GPU_SNOOP_OVERRIDE_VALUE__ENABLE__SHIFT 0x0 -+#define DAGB7_WRCLI_GPU_SNOOP_OVERRIDE_VALUE__ENABLE_MASK 0xFFFFFFFFL - //DAGB7_DAGB_DLY - #define DAGB7_DAGB_DLY__DLY__SHIFT 0x0 - #define DAGB7_DAGB_DLY__CLI__SHIFT 0x8 -diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c -index 3de0f457fff6ab..5f58da6ebaadb4 100644 ---- a/drivers/gpu/drm/ast/ast_mode.c -+++ b/drivers/gpu/drm/ast/ast_mode.c -@@ -132,7 +132,7 @@ static bool ast_get_vbios_mode_info(const struct drm_format_info *format, - return false; - } - -- switch (mode->crtc_hdisplay) { -+ switch (mode->hdisplay) { - case 640: - vbios_mode->enh_table = &res_640x480[refresh_rate_index]; - break; -@@ -146,7 +146,7 @@ static bool ast_get_vbios_mode_info(const struct drm_format_info *format, - vbios_mode->enh_table = &res_1152x864[refresh_rate_index]; - break; - case 1280: -- if (mode->crtc_vdisplay == 800) -+ if (mode->vdisplay == 800) - vbios_mode->enh_table = &res_1280x800[refresh_rate_index]; - else - vbios_mode->enh_table = &res_1280x1024[refresh_rate_index]; -@@ -158,7 +158,7 @@ static bool ast_get_vbios_mode_info(const struct drm_format_info *format, - vbios_mode->enh_table = &res_1440x900[refresh_rate_index]; - break; - case 1600: -- if (mode->crtc_vdisplay == 900) -+ if (mode->vdisplay == 900) - vbios_mode->enh_table = &res_1600x900[refresh_rate_index]; - else - vbios_mode->enh_table = &res_1600x1200[refresh_rate_index]; -@@ -167,7 +167,7 @@ static bool ast_get_vbios_mode_info(const struct drm_format_info *format, - vbios_mode->enh_table = &res_1680x1050[refresh_rate_index]; - break; - case 1920: -- if (mode->crtc_vdisplay == 1080) -+ if (mode->vdisplay == 1080) - vbios_mode->enh_table = &res_1920x1080[refresh_rate_index]; - else - vbios_mode->enh_table = &res_1920x1200[refresh_rate_index]; -@@ -211,6 +211,7 @@ static bool ast_get_vbios_mode_info(const struct drm_format_info *format, - hborder = (vbios_mode->enh_table->flags & HBorder) ? 8 : 0; - vborder = (vbios_mode->enh_table->flags & VBorder) ? 8 : 0; - -+ adjusted_mode->crtc_hdisplay = vbios_mode->enh_table->hde; - adjusted_mode->crtc_htotal = vbios_mode->enh_table->ht; - adjusted_mode->crtc_hblank_start = vbios_mode->enh_table->hde + hborder; - adjusted_mode->crtc_hblank_end = vbios_mode->enh_table->ht - hborder; -@@ -220,6 +221,7 @@ static bool ast_get_vbios_mode_info(const struct drm_format_info *format, - vbios_mode->enh_table->hfp + - vbios_mode->enh_table->hsync); - -+ adjusted_mode->crtc_vdisplay = vbios_mode->enh_table->vde; - adjusted_mode->crtc_vtotal = vbios_mode->enh_table->vt; - adjusted_mode->crtc_vblank_start = vbios_mode->enh_table->vde + vborder; - adjusted_mode->crtc_vblank_end = vbios_mode->enh_table->vt - vborder; -diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c b/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c -index 8f786592143b6c..24e1e11acf6978 100644 ---- a/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c -+++ b/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c -@@ -244,7 +244,9 @@ static const struct hdmi_codec_pdata codec_data = { - .ops = &adv7511_codec_ops, - .max_i2s_channels = 2, - .i2s = 1, -+ .no_i2s_capture = 1, - .spdif = 1, -+ .no_spdif_capture = 1, - }; - - int adv7511_audio_init(struct device *dev, struct adv7511 *adv7511) -diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c -index f3681970887cc8..1aa59586c8f81a 100644 ---- a/drivers/gpu/drm/drm_atomic_helper.c -+++ b/drivers/gpu/drm/drm_atomic_helper.c -@@ -573,6 +573,30 @@ mode_valid(struct drm_atomic_state *state) - return 0; - } - -+static int drm_atomic_check_valid_clones(struct drm_atomic_state *state, -+ struct drm_crtc *crtc) -+{ -+ struct drm_encoder *drm_enc; -+ struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state, -+ crtc); -+ -+ drm_for_each_encoder_mask(drm_enc, crtc->dev, crtc_state->encoder_mask) { -+ if (!drm_enc->possible_clones) { -+ DRM_DEBUG("enc%d possible_clones is 0\n", drm_enc->base.id); -+ continue; -+ } -+ -+ if ((crtc_state->encoder_mask & drm_enc->possible_clones) != -+ crtc_state->encoder_mask) { -+ DRM_DEBUG("crtc%d failed valid clone check for mask 0x%x\n", -+ crtc->base.id, crtc_state->encoder_mask); -+ return -EINVAL; -+ } -+ } -+ -+ return 0; -+} -+ - /** - * drm_atomic_helper_check_modeset - validate state object for modeset changes - * @dev: DRM device -@@ -744,6 +768,10 @@ drm_atomic_helper_check_modeset(struct drm_device *dev, - ret = drm_atomic_add_affected_planes(state, crtc); - if (ret != 0) - return ret; -+ -+ ret = drm_atomic_check_valid_clones(state, crtc); -+ if (ret != 0) -+ return ret; - } - - /* -diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c -index ad872c61aac0e3..c6e6e4766c8bf6 100644 ---- a/drivers/gpu/drm/drm_edid.c -+++ b/drivers/gpu/drm/drm_edid.c -@@ -6471,6 +6471,7 @@ static void drm_reset_display_info(struct drm_connector *connector) - info->has_hdmi_infoframe = false; - info->rgb_quant_range_selectable = false; - memset(&info->hdmi, 0, sizeof(info->hdmi)); -+ memset(&connector->hdr_sink_metadata, 0, sizeof(connector->hdr_sink_metadata)); - - info->edid_hdmi_rgb444_dc_modes = 0; - info->edid_hdmi_ycbcr444_dc_modes = 0; -diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c -index 44a948b80ee14e..deb93f78ce3442 100644 ---- a/drivers/gpu/drm/drm_gem.c -+++ b/drivers/gpu/drm/drm_gem.c -@@ -322,7 +322,7 @@ int drm_gem_dumb_map_offset(struct drm_file *file, struct drm_device *dev, - return -ENOENT; - - /* Don't allow imported objects to be mapped */ -- if (obj->import_attach) { -+ if (drm_gem_is_imported(obj)) { - ret = -EINVAL; - goto out; - } -@@ -1155,7 +1155,7 @@ void drm_gem_print_info(struct drm_printer *p, unsigned int indent, - drm_vma_node_start(&obj->vma_node)); - drm_printf_indent(p, indent, "size=%zu\n", obj->size); - drm_printf_indent(p, indent, "imported=%s\n", -- str_yes_no(obj->import_attach)); -+ str_yes_no(drm_gem_is_imported(obj))); - - if (obj->funcs->print_info) - obj->funcs->print_info(p, indent, obj); -diff --git a/drivers/gpu/drm/mediatek/mtk_dpi.c b/drivers/gpu/drm/mediatek/mtk_dpi.c -index 54fc3f819577e3..6391afdf202e27 100644 ---- a/drivers/gpu/drm/mediatek/mtk_dpi.c -+++ b/drivers/gpu/drm/mediatek/mtk_dpi.c -@@ -410,12 +410,13 @@ static void mtk_dpi_config_swap_input(struct mtk_dpi *dpi, bool enable) - - static void mtk_dpi_config_2n_h_fre(struct mtk_dpi *dpi) - { -- mtk_dpi_mask(dpi, dpi->conf->reg_h_fre_con, H_FRE_2N, H_FRE_2N); -+ if (dpi->conf->reg_h_fre_con) -+ mtk_dpi_mask(dpi, dpi->conf->reg_h_fre_con, H_FRE_2N, H_FRE_2N); - } - - static void mtk_dpi_config_disable_edge(struct mtk_dpi *dpi) - { -- if (dpi->conf->edge_sel_en) -+ if (dpi->conf->edge_sel_en && dpi->conf->reg_h_fre_con) - mtk_dpi_mask(dpi, dpi->conf->reg_h_fre_con, 0, EDGE_SEL_EN); - } - -diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c -index 94fe2f3836a9a3..53b3b24d7d7c05 100644 ---- a/drivers/gpu/drm/panel/panel-edp.c -+++ b/drivers/gpu/drm/panel/panel-edp.c -@@ -1923,6 +1923,7 @@ static const struct edp_panel_entry edp_panels[] = { - EDP_PANEL_ENTRY('S', 'H', 'P', 0x1523, &sharp_lq140m1jw46.delay, "LQ140M1JW46"), - EDP_PANEL_ENTRY('S', 'H', 'P', 0x154c, &delay_200_500_p2e100, "LQ116M1JW10"), - -+ EDP_PANEL_ENTRY('S', 'T', 'A', 0x0004, &delay_200_500_e200, "116KHD024006"), - EDP_PANEL_ENTRY('S', 'T', 'A', 0x0100, &delay_100_500_e200, "2081116HHD028001-51D"), - - { /* sentinal */ } -diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c -index d8f8c37c326c43..0193d10867dd2f 100644 ---- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c -+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c -@@ -1290,10 +1290,8 @@ static void vop2_plane_atomic_update(struct drm_plane *plane, - - rb_swap = vop2_win_rb_swap(fb->format->format); - vop2_win_write(win, VOP2_WIN_RB_SWAP, rb_swap); -- if (!vop2_cluster_window(win)) { -- uv_swap = vop2_win_uv_swap(fb->format->format); -- vop2_win_write(win, VOP2_WIN_UV_SWAP, uv_swap); -- } -+ uv_swap = vop2_win_uv_swap(fb->format->format); -+ vop2_win_write(win, VOP2_WIN_UV_SWAP, uv_swap); - - if (fb->format->is_yuv) { - vop2_win_write(win, VOP2_WIN_UV_VIR, DIV_ROUND_UP(fb->pitches[1], 4)); -diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c -index ffbbe9d527d324..0e8ea990118844 100644 ---- a/drivers/gpu/drm/v3d/v3d_drv.c -+++ b/drivers/gpu/drm/v3d/v3d_drv.c -@@ -226,11 +226,21 @@ static int v3d_platform_drm_probe(struct platform_device *pdev) - if (ret) - return ret; - -+ v3d->clk = devm_clk_get_optional(dev, NULL); -+ if (IS_ERR(v3d->clk)) -+ return dev_err_probe(dev, PTR_ERR(v3d->clk), "Failed to get V3D clock\n"); -+ -+ ret = clk_prepare_enable(v3d->clk); -+ if (ret) { -+ dev_err(&pdev->dev, "Couldn't enable the V3D clock\n"); -+ return ret; -+ } -+ - mmu_debug = V3D_READ(V3D_MMU_DEBUG_INFO); - mask = DMA_BIT_MASK(30 + V3D_GET_FIELD(mmu_debug, V3D_MMU_PA_WIDTH)); - ret = dma_set_mask_and_coherent(dev, mask); - if (ret) -- return ret; -+ goto clk_disable; - - v3d->va_width = 30 + V3D_GET_FIELD(mmu_debug, V3D_MMU_VA_WIDTH); - -@@ -245,28 +255,29 @@ static int v3d_platform_drm_probe(struct platform_device *pdev) - ret = PTR_ERR(v3d->reset); - - if (ret == -EPROBE_DEFER) -- return ret; -+ goto clk_disable; - - v3d->reset = NULL; - ret = map_regs(v3d, &v3d->bridge_regs, "bridge"); - if (ret) { - dev_err(dev, - "Failed to get reset control or bridge regs\n"); -- return ret; -+ goto clk_disable; - } - } - - if (v3d->ver < 41) { - ret = map_regs(v3d, &v3d->gca_regs, "gca"); - if (ret) -- return ret; -+ goto clk_disable; - } - - v3d->mmu_scratch = dma_alloc_wc(dev, 4096, &v3d->mmu_scratch_paddr, - GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO); - if (!v3d->mmu_scratch) { - dev_err(dev, "Failed to allocate MMU scratch page\n"); -- return -ENOMEM; -+ ret = -ENOMEM; -+ goto clk_disable; - } - - ret = v3d_gem_init(drm); -@@ -289,6 +300,8 @@ static int v3d_platform_drm_probe(struct platform_device *pdev) - v3d_gem_destroy(drm); - dma_free: - dma_free_wc(dev, 4096, v3d->mmu_scratch, v3d->mmu_scratch_paddr); -+clk_disable: -+ clk_disable_unprepare(v3d->clk); - return ret; - } - -@@ -303,6 +316,8 @@ static void v3d_platform_drm_remove(struct platform_device *pdev) - - dma_free_wc(v3d->drm.dev, 4096, v3d->mmu_scratch, - v3d->mmu_scratch_paddr); -+ -+ clk_disable_unprepare(v3d->clk); - } - - static struct platform_driver v3d_platform_driver = { -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index 8e721ec3faaff3..a8665d57094b22 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -41,6 +41,10 @@ - #define USB_VENDOR_ID_ACTIONSTAR 0x2101 - #define USB_DEVICE_ID_ACTIONSTAR_1011 0x1011 - -+#define USB_VENDOR_ID_ADATA_XPG 0x125f -+#define USB_VENDOR_ID_ADATA_XPG_WL_GAMING_MOUSE 0x7505 -+#define USB_VENDOR_ID_ADATA_XPG_WL_GAMING_MOUSE_DONGLE 0x7506 -+ - #define USB_VENDOR_ID_ADS_TECH 0x06e1 - #define USB_DEVICE_ID_ADS_TECH_RADIO_SI470X 0xa155 - -diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c -index 5d7a418ccdbecf..73979643315bfd 100644 ---- a/drivers/hid/hid-quirks.c -+++ b/drivers/hid/hid-quirks.c -@@ -27,6 +27,8 @@ - static const struct hid_device_id hid_quirks[] = { - { HID_USB_DEVICE(USB_VENDOR_ID_AASHIMA, USB_DEVICE_ID_AASHIMA_GAMEPAD), HID_QUIRK_BADPAD }, - { HID_USB_DEVICE(USB_VENDOR_ID_AASHIMA, USB_DEVICE_ID_AASHIMA_PREDATOR), HID_QUIRK_BADPAD }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_ADATA_XPG, USB_VENDOR_ID_ADATA_XPG_WL_GAMING_MOUSE), HID_QUIRK_ALWAYS_POLL }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_ADATA_XPG, USB_VENDOR_ID_ADATA_XPG_WL_GAMING_MOUSE_DONGLE), HID_QUIRK_ALWAYS_POLL }, - { HID_USB_DEVICE(USB_VENDOR_ID_AFATECH, USB_DEVICE_ID_AFATECH_AF9016), HID_QUIRK_FULLSPEED_INTERVAL }, - { HID_USB_DEVICE(USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS), HID_QUIRK_NOGET }, - { HID_USB_DEVICE(USB_VENDOR_ID_AKAI_09E8, USB_DEVICE_ID_AKAI_09E8_MIDIMIX), HID_QUIRK_NO_INIT_REPORTS }, -diff --git a/drivers/hid/usbhid/usbkbd.c b/drivers/hid/usbhid/usbkbd.c -index c439ed2f16dbca..af6bc76dbf6493 100644 ---- a/drivers/hid/usbhid/usbkbd.c -+++ b/drivers/hid/usbhid/usbkbd.c -@@ -160,7 +160,7 @@ static int usb_kbd_event(struct input_dev *dev, unsigned int type, - return -1; - - spin_lock_irqsave(&kbd->leds_lock, flags); -- kbd->newleds = (!!test_bit(LED_KANA, dev->led) << 3) | (!!test_bit(LED_COMPOSE, dev->led) << 3) | -+ kbd->newleds = (!!test_bit(LED_KANA, dev->led) << 4) | (!!test_bit(LED_COMPOSE, dev->led) << 3) | - (!!test_bit(LED_SCROLLL, dev->led) << 2) | (!!test_bit(LED_CAPSL, dev->led) << 1) | - (!!test_bit(LED_NUML, dev->led)); - -diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c -index 44aaf9b9191d41..8d94ecc3cc468c 100644 ---- a/drivers/hwmon/dell-smm-hwmon.c -+++ b/drivers/hwmon/dell-smm-hwmon.c -@@ -67,7 +67,7 @@ - #define I8K_POWER_BATTERY 0x01 - - #define DELL_SMM_NO_TEMP 10 --#define DELL_SMM_NO_FANS 3 -+#define DELL_SMM_NO_FANS 4 - - struct dell_smm_data { - struct mutex i8k_mutex; /* lock for sensors writes */ -@@ -940,11 +940,14 @@ static const struct hwmon_channel_info * const dell_smm_info[] = { - HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MIN | HWMON_F_MAX | - HWMON_F_TARGET, - HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MIN | HWMON_F_MAX | -+ HWMON_F_TARGET, -+ HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MIN | HWMON_F_MAX | - HWMON_F_TARGET - ), - HWMON_CHANNEL_INFO(pwm, - HWMON_PWM_INPUT | HWMON_PWM_ENABLE, - HWMON_PWM_INPUT, -+ HWMON_PWM_INPUT, - HWMON_PWM_INPUT - ), - NULL -diff --git a/drivers/hwmon/gpio-fan.c b/drivers/hwmon/gpio-fan.c -index d92c536be9af78..b779240328d59f 100644 ---- a/drivers/hwmon/gpio-fan.c -+++ b/drivers/hwmon/gpio-fan.c -@@ -393,7 +393,12 @@ static int gpio_fan_set_cur_state(struct thermal_cooling_device *cdev, - if (state >= fan_data->num_speed) - return -EINVAL; - -+ mutex_lock(&fan_data->lock); -+ - set_fan_speed(fan_data, state); -+ -+ mutex_unlock(&fan_data->lock); -+ - return 0; - } - -@@ -489,7 +494,11 @@ MODULE_DEVICE_TABLE(of, of_gpio_fan_match); - - static void gpio_fan_stop(void *data) - { -+ struct gpio_fan_data *fan_data = data; -+ -+ mutex_lock(&fan_data->lock); - set_fan_speed(data, 0); -+ mutex_unlock(&fan_data->lock); - } - - static int gpio_fan_probe(struct platform_device *pdev) -@@ -562,7 +571,9 @@ static int gpio_fan_suspend(struct device *dev) - - if (fan_data->gpios) { - fan_data->resume_speed = fan_data->speed_index; -+ mutex_lock(&fan_data->lock); - set_fan_speed(fan_data, 0); -+ mutex_unlock(&fan_data->lock); - } - - return 0; -@@ -572,8 +583,11 @@ static int gpio_fan_resume(struct device *dev) - { - struct gpio_fan_data *fan_data = dev_get_drvdata(dev); - -- if (fan_data->gpios) -+ if (fan_data->gpios) { -+ mutex_lock(&fan_data->lock); - set_fan_speed(fan_data, fan_data->resume_speed); -+ mutex_unlock(&fan_data->lock); -+ } - - return 0; - } -diff --git a/drivers/hwmon/xgene-hwmon.c b/drivers/hwmon/xgene-hwmon.c -index 207084d55044a1..6768dbf3903906 100644 ---- a/drivers/hwmon/xgene-hwmon.c -+++ b/drivers/hwmon/xgene-hwmon.c -@@ -111,7 +111,7 @@ struct xgene_hwmon_dev { - - phys_addr_t comm_base_addr; - void *pcc_comm_addr; -- u64 usecs_lat; -+ unsigned int usecs_lat; - }; - - /* -diff --git a/drivers/hwtracing/intel_th/Kconfig b/drivers/hwtracing/intel_th/Kconfig -index 4b6359326ede99..4f7d2b6d79e294 100644 ---- a/drivers/hwtracing/intel_th/Kconfig -+++ b/drivers/hwtracing/intel_th/Kconfig -@@ -60,6 +60,7 @@ config INTEL_TH_STH - - config INTEL_TH_MSU - tristate "Intel(R) Trace Hub Memory Storage Unit" -+ depends on MMU - help - Memory Storage Unit (MSU) trace output device enables - storing STP traces to system memory. It supports single -diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c -index 9621efe0e95c4d..54629458fb710c 100644 ---- a/drivers/hwtracing/intel_th/msu.c -+++ b/drivers/hwtracing/intel_th/msu.c -@@ -19,6 +19,7 @@ - #include - #include - #include -+#include - - #ifdef CONFIG_X86 - #include -@@ -965,7 +966,6 @@ static void msc_buffer_contig_free(struct msc *msc) - for (off = 0; off < msc->nr_pages << PAGE_SHIFT; off += PAGE_SIZE) { - struct page *page = virt_to_page(msc->base + off); - -- page->mapping = NULL; - __free_page(page); - } - -@@ -1147,9 +1147,6 @@ static void __msc_buffer_win_free(struct msc *msc, struct msc_window *win) - int i; - - for_each_sg(win->sgt->sgl, sg, win->nr_segs, i) { -- struct page *page = msc_sg_page(sg); -- -- page->mapping = NULL; - dma_free_coherent(msc_dev(win->msc)->parent->parent, PAGE_SIZE, - sg_virt(sg), sg_dma_address(sg)); - } -@@ -1584,22 +1581,10 @@ static void msc_mmap_close(struct vm_area_struct *vma) - { - struct msc_iter *iter = vma->vm_file->private_data; - struct msc *msc = iter->msc; -- unsigned long pg; - - if (!atomic_dec_and_mutex_lock(&msc->mmap_count, &msc->buf_mutex)) - return; - -- /* drop page _refcounts */ -- for (pg = 0; pg < msc->nr_pages; pg++) { -- struct page *page = msc_buffer_get_page(msc, pg); -- -- if (WARN_ON_ONCE(!page)) -- continue; -- -- if (page->mapping) -- page->mapping = NULL; -- } -- - /* last mapping -- drop user_count */ - atomic_dec(&msc->user_count); - mutex_unlock(&msc->buf_mutex); -@@ -1609,16 +1594,14 @@ static vm_fault_t msc_mmap_fault(struct vm_fault *vmf) - { - struct msc_iter *iter = vmf->vma->vm_file->private_data; - struct msc *msc = iter->msc; -+ struct page *page; - -- vmf->page = msc_buffer_get_page(msc, vmf->pgoff); -- if (!vmf->page) -+ page = msc_buffer_get_page(msc, vmf->pgoff); -+ if (!page) - return VM_FAULT_SIGBUS; - -- get_page(vmf->page); -- vmf->page->mapping = vmf->vma->vm_file->f_mapping; -- vmf->page->index = vmf->pgoff; -- -- return 0; -+ get_page(page); -+ return vmf_insert_mixed(vmf->vma, vmf->address, page_to_pfn_t(page)); - } - - static const struct vm_operations_struct msc_mmap_ops = { -@@ -1659,7 +1642,7 @@ static int intel_th_msc_mmap(struct file *file, struct vm_area_struct *vma) - atomic_dec(&msc->user_count); - - vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); -- vm_flags_set(vma, VM_DONTEXPAND | VM_DONTCOPY); -+ vm_flags_set(vma, VM_DONTEXPAND | VM_DONTCOPY | VM_MIXEDMAP); - vma->vm_ops = &msc_mmap_ops; - return ret; - } -diff --git a/drivers/i2c/busses/i2c-designware-common.c b/drivers/i2c/busses/i2c-designware-common.c -index ced2fb4aeda8d3..79e083aab08e0c 100644 ---- a/drivers/i2c/busses/i2c-designware-common.c -+++ b/drivers/i2c/busses/i2c-designware-common.c -@@ -669,6 +669,7 @@ void i2c_dw_disable(struct dw_i2c_dev *dev) - - i2c_dw_release_lock(dev); - } -+EXPORT_SYMBOL_GPL(i2c_dw_disable); - - MODULE_DESCRIPTION("Synopsys DesignWare I2C bus adapter core"); - MODULE_LICENSE("GPL"); -diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h -index 5eb130c1d67195..e93870a0f9a459 100644 ---- a/drivers/i2c/busses/i2c-designware-core.h -+++ b/drivers/i2c/busses/i2c-designware-core.h -@@ -238,7 +238,6 @@ struct reset_control; - * @semaphore_idx: Index of table with semaphore type attached to the bus. It's - * -1 if there is no semaphore. - * @shared_with_punit: true if this bus is shared with the SoCs PUNIT -- * @disable: function to disable the controller - * @init: function to initialize the I2C hardware - * @set_sda_hold_time: callback to retrieve IP specific SDA hold timing - * @mode: operation mode - DW_IC_MASTER or DW_IC_SLAVE -@@ -295,7 +294,6 @@ struct dw_i2c_dev { - void (*release_lock)(void); - int semaphore_idx; - bool shared_with_punit; -- void (*disable)(struct dw_i2c_dev *dev); - int (*init)(struct dw_i2c_dev *dev); - int (*set_sda_hold_time)(struct dw_i2c_dev *dev); - int mode; -@@ -305,6 +303,7 @@ struct dw_i2c_dev { - #define ACCESS_INTR_MASK BIT(0) - #define ACCESS_NO_IRQ_SUSPEND BIT(1) - #define ARBITRATION_SEMAPHORE BIT(2) -+#define ACCESS_POLLING BIT(3) - - #define MODEL_MSCC_OCELOT BIT(8) - #define MODEL_BAIKAL_BT1 BIT(9) -@@ -339,7 +338,6 @@ int i2c_dw_wait_bus_not_busy(struct dw_i2c_dev *dev); - int i2c_dw_handle_tx_abort(struct dw_i2c_dev *dev); - int i2c_dw_set_fifo_size(struct dw_i2c_dev *dev); - u32 i2c_dw_func(struct i2c_adapter *adap); --void i2c_dw_disable(struct dw_i2c_dev *dev); - - static inline void __i2c_dw_enable(struct dw_i2c_dev *dev) - { -@@ -354,6 +352,7 @@ static inline void __i2c_dw_disable_nowait(struct dw_i2c_dev *dev) - } - - void __i2c_dw_disable(struct dw_i2c_dev *dev); -+void i2c_dw_disable(struct dw_i2c_dev *dev); - - extern void i2c_dw_configure_master(struct dw_i2c_dev *dev); - extern int i2c_dw_probe_master(struct dw_i2c_dev *dev); -diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c -index 579c668cb78a6d..51f5491648c077 100644 ---- a/drivers/i2c/busses/i2c-designware-master.c -+++ b/drivers/i2c/busses/i2c-designware-master.c -@@ -991,31 +991,6 @@ static int i2c_dw_init_recovery_info(struct dw_i2c_dev *dev) - return 0; - } - --static int i2c_dw_poll_adap_quirk(struct dw_i2c_dev *dev) --{ -- struct i2c_adapter *adap = &dev->adapter; -- int ret; -- -- pm_runtime_get_noresume(dev->dev); -- ret = i2c_add_numbered_adapter(adap); -- if (ret) -- dev_err(dev->dev, "Failed to add adapter: %d\n", ret); -- pm_runtime_put_noidle(dev->dev); -- -- return ret; --} -- --static bool i2c_dw_is_model_poll(struct dw_i2c_dev *dev) --{ -- switch (dev->flags & MODEL_MASK) { -- case MODEL_AMD_NAVI_GPU: -- case MODEL_WANGXUN_SP: -- return true; -- default: -- return false; -- } --} -- - int i2c_dw_probe_master(struct dw_i2c_dev *dev) - { - struct i2c_adapter *adap = &dev->adapter; -@@ -1026,7 +1001,6 @@ int i2c_dw_probe_master(struct dw_i2c_dev *dev) - init_completion(&dev->cmd_complete); - - dev->init = i2c_dw_init_master; -- dev->disable = i2c_dw_disable; - - ret = i2c_dw_init_regmap(dev); - if (ret) -@@ -1071,9 +1045,6 @@ int i2c_dw_probe_master(struct dw_i2c_dev *dev) - adap->dev.parent = dev->dev; - i2c_set_adapdata(adap, dev); - -- if (i2c_dw_is_model_poll(dev)) -- return i2c_dw_poll_adap_quirk(dev); -- - if (dev->flags & ACCESS_NO_IRQ_SUSPEND) { - irq_flags = IRQF_NO_SUSPEND; - } else { -@@ -1087,12 +1058,14 @@ int i2c_dw_probe_master(struct dw_i2c_dev *dev) - regmap_write(dev->map, DW_IC_INTR_MASK, 0); - i2c_dw_release_lock(dev); - -- ret = devm_request_irq(dev->dev, dev->irq, i2c_dw_isr, irq_flags, -- dev_name(dev->dev), dev); -- if (ret) { -- dev_err(dev->dev, "failure requesting irq %i: %d\n", -- dev->irq, ret); -- return ret; -+ if (!(dev->flags & ACCESS_POLLING)) { -+ ret = devm_request_irq(dev->dev, dev->irq, i2c_dw_isr, -+ irq_flags, dev_name(dev->dev), dev); -+ if (ret) { -+ dev_err(dev->dev, "failure requesting irq %i: %d\n", -+ dev->irq, ret); -+ return ret; -+ } - } - - ret = i2c_dw_init_recovery_info(dev); -diff --git a/drivers/i2c/busses/i2c-designware-pcidrv.c b/drivers/i2c/busses/i2c-designware-pcidrv.c -index 61d7a27aa07018..b85f1e4ed13bc8 100644 ---- a/drivers/i2c/busses/i2c-designware-pcidrv.c -+++ b/drivers/i2c/busses/i2c-designware-pcidrv.c -@@ -154,7 +154,7 @@ static int navi_amd_setup(struct pci_dev *pdev, struct dw_pci_controller *c) - { - struct dw_i2c_dev *dev = dev_get_drvdata(&pdev->dev); - -- dev->flags |= MODEL_AMD_NAVI_GPU; -+ dev->flags |= MODEL_AMD_NAVI_GPU | ACCESS_POLLING; - dev->timings.bus_freq_hz = I2C_MAX_STANDARD_MODE_FREQ; - return 0; - } -@@ -198,7 +198,7 @@ static int __maybe_unused i2c_dw_pci_runtime_suspend(struct device *dev) - { - struct dw_i2c_dev *i_dev = dev_get_drvdata(dev); - -- i_dev->disable(i_dev); -+ i2c_dw_disable(i_dev); - return 0; - } - -@@ -248,6 +248,7 @@ static const struct software_node dgpu_node = { - static int i2c_dw_pci_probe(struct pci_dev *pdev, - const struct pci_device_id *id) - { -+ struct device *device = &pdev->dev; - struct dw_i2c_dev *dev; - struct i2c_adapter *adap; - int r; -@@ -256,25 +257,22 @@ static int i2c_dw_pci_probe(struct pci_dev *pdev, - struct i2c_timings *t; - - if (id->driver_data >= ARRAY_SIZE(dw_pci_controllers)) -- return dev_err_probe(&pdev->dev, -EINVAL, -- "Invalid driver data %ld\n", -+ return dev_err_probe(device, -EINVAL, "Invalid driver data %ld\n", - id->driver_data); - - controller = &dw_pci_controllers[id->driver_data]; - - r = pcim_enable_device(pdev); - if (r) -- return dev_err_probe(&pdev->dev, r, -- "Failed to enable I2C PCI device\n"); -+ return dev_err_probe(device, r, "Failed to enable I2C PCI device\n"); - - pci_set_master(pdev); - - r = pcim_iomap_regions(pdev, 1 << 0, pci_name(pdev)); - if (r) -- return dev_err_probe(&pdev->dev, r, -- "I/O memory remapping failed\n"); -+ return dev_err_probe(device, r, "I/O memory remapping failed\n"); - -- dev = devm_kzalloc(&pdev->dev, sizeof(*dev), GFP_KERNEL); -+ dev = devm_kzalloc(device, sizeof(*dev), GFP_KERNEL); - if (!dev) - return -ENOMEM; - -@@ -284,7 +282,7 @@ static int i2c_dw_pci_probe(struct pci_dev *pdev, - - dev->get_clk_rate_khz = controller->get_clk_rate_khz; - dev->base = pcim_iomap_table(pdev)[0]; -- dev->dev = &pdev->dev; -+ dev->dev = device; - dev->irq = pci_irq_vector(pdev, 0); - dev->flags |= controller->flags; - -@@ -337,15 +335,17 @@ static int i2c_dw_pci_probe(struct pci_dev *pdev, - - if ((dev->flags & MODEL_MASK) == MODEL_AMD_NAVI_GPU) { - dev->slave = i2c_new_ccgx_ucsi(&dev->adapter, dev->irq, &dgpu_node); -- if (IS_ERR(dev->slave)) -- return dev_err_probe(dev->dev, PTR_ERR(dev->slave), -+ if (IS_ERR(dev->slave)) { -+ i2c_del_adapter(&dev->adapter); -+ return dev_err_probe(device, PTR_ERR(dev->slave), - "register UCSI failed\n"); -+ } - } - -- pm_runtime_set_autosuspend_delay(&pdev->dev, 1000); -- pm_runtime_use_autosuspend(&pdev->dev); -- pm_runtime_put_autosuspend(&pdev->dev); -- pm_runtime_allow(&pdev->dev); -+ pm_runtime_set_autosuspend_delay(device, 1000); -+ pm_runtime_use_autosuspend(device); -+ pm_runtime_put_autosuspend(device); -+ pm_runtime_allow(device); - - return 0; - } -@@ -353,10 +353,12 @@ static int i2c_dw_pci_probe(struct pci_dev *pdev, - static void i2c_dw_pci_remove(struct pci_dev *pdev) - { - struct dw_i2c_dev *dev = pci_get_drvdata(pdev); -+ struct device *device = &pdev->dev; -+ -+ i2c_dw_disable(dev); - -- dev->disable(dev); -- pm_runtime_forbid(&pdev->dev); -- pm_runtime_get_noresume(&pdev->dev); -+ pm_runtime_forbid(device); -+ pm_runtime_get_noresume(device); - - i2c_del_adapter(&dev->adapter); - devm_free_irq(&pdev->dev, dev->irq, dev); -diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c -index 855b698e99c080..f3245a68563095 100644 ---- a/drivers/i2c/busses/i2c-designware-platdrv.c -+++ b/drivers/i2c/busses/i2c-designware-platdrv.c -@@ -275,6 +275,7 @@ static void i2c_dw_remove_lock_support(struct dw_i2c_dev *dev) - - static int dw_i2c_plat_probe(struct platform_device *pdev) - { -+ struct device *device = &pdev->dev; - struct i2c_adapter *adap; - struct dw_i2c_dev *dev; - struct i2c_timings *t; -@@ -284,15 +285,15 @@ static int dw_i2c_plat_probe(struct platform_device *pdev) - if (irq < 0) - return irq; - -- dev = devm_kzalloc(&pdev->dev, sizeof(struct dw_i2c_dev), GFP_KERNEL); -+ dev = devm_kzalloc(device, sizeof(*dev), GFP_KERNEL); - if (!dev) - return -ENOMEM; - -- dev->flags = (uintptr_t)device_get_match_data(&pdev->dev); -- if (device_property_present(&pdev->dev, "wx,i2c-snps-model")) -- dev->flags = MODEL_WANGXUN_SP; -+ dev->flags = (uintptr_t)device_get_match_data(device); -+ if (device_property_present(device, "wx,i2c-snps-model")) -+ dev->flags = MODEL_WANGXUN_SP | ACCESS_POLLING; - -- dev->dev = &pdev->dev; -+ dev->dev = device; - dev->irq = irq; - platform_set_drvdata(pdev, dev); - -@@ -300,7 +301,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev) - if (ret) - return ret; - -- dev->rst = devm_reset_control_get_optional_exclusive(&pdev->dev, NULL); -+ dev->rst = devm_reset_control_get_optional_exclusive(device, NULL); - if (IS_ERR(dev->rst)) - return PTR_ERR(dev->rst); - -@@ -328,13 +329,13 @@ static int dw_i2c_plat_probe(struct platform_device *pdev) - i2c_dw_configure(dev); - - /* Optional interface clock */ -- dev->pclk = devm_clk_get_optional(&pdev->dev, "pclk"); -+ dev->pclk = devm_clk_get_optional(device, "pclk"); - if (IS_ERR(dev->pclk)) { - ret = PTR_ERR(dev->pclk); - goto exit_reset; - } - -- dev->clk = devm_clk_get_optional(&pdev->dev, NULL); -+ dev->clk = devm_clk_get_optional(device, NULL); - if (IS_ERR(dev->clk)) { - ret = PTR_ERR(dev->clk); - goto exit_reset; -@@ -363,28 +364,24 @@ static int dw_i2c_plat_probe(struct platform_device *pdev) - adap->dev.of_node = pdev->dev.of_node; - adap->nr = -1; - -- if (dev->flags & ACCESS_NO_IRQ_SUSPEND) { -- dev_pm_set_driver_flags(&pdev->dev, -- DPM_FLAG_SMART_PREPARE); -- } else { -- dev_pm_set_driver_flags(&pdev->dev, -- DPM_FLAG_SMART_PREPARE | -- DPM_FLAG_SMART_SUSPEND); -- } -+ if (dev->flags & ACCESS_NO_IRQ_SUSPEND) -+ dev_pm_set_driver_flags(device, DPM_FLAG_SMART_PREPARE); -+ else -+ dev_pm_set_driver_flags(device, DPM_FLAG_SMART_PREPARE | DPM_FLAG_SMART_SUSPEND); - -- device_enable_async_suspend(&pdev->dev); -+ device_enable_async_suspend(device); - - /* The code below assumes runtime PM to be disabled. */ -- WARN_ON(pm_runtime_enabled(&pdev->dev)); -+ WARN_ON(pm_runtime_enabled(device)); - -- pm_runtime_set_autosuspend_delay(&pdev->dev, 1000); -- pm_runtime_use_autosuspend(&pdev->dev); -- pm_runtime_set_active(&pdev->dev); -+ pm_runtime_set_autosuspend_delay(device, 1000); -+ pm_runtime_use_autosuspend(device); -+ pm_runtime_set_active(device); - - if (dev->shared_with_punit) -- pm_runtime_get_noresume(&pdev->dev); -+ pm_runtime_get_noresume(device); - -- pm_runtime_enable(&pdev->dev); -+ pm_runtime_enable(device); - - ret = i2c_dw_probe(dev); - if (ret) -@@ -402,15 +399,16 @@ static int dw_i2c_plat_probe(struct platform_device *pdev) - static void dw_i2c_plat_remove(struct platform_device *pdev) - { - struct dw_i2c_dev *dev = platform_get_drvdata(pdev); -+ struct device *device = &pdev->dev; - -- pm_runtime_get_sync(&pdev->dev); -+ pm_runtime_get_sync(device); - - i2c_del_adapter(&dev->adapter); - -- dev->disable(dev); -+ i2c_dw_disable(dev); - -- pm_runtime_dont_use_autosuspend(&pdev->dev); -- pm_runtime_put_sync(&pdev->dev); -+ pm_runtime_dont_use_autosuspend(device); -+ pm_runtime_put_sync(device); - dw_i2c_plat_pm_cleanup(dev); - - i2c_dw_remove_lock_support(dev); -@@ -436,7 +434,7 @@ static int dw_i2c_plat_runtime_suspend(struct device *dev) - if (i_dev->shared_with_punit) - return 0; - -- i_dev->disable(i_dev); -+ i2c_dw_disable(i_dev); - i2c_dw_prepare_clk(i_dev, false); - - return 0; -diff --git a/drivers/i2c/busses/i2c-designware-slave.c b/drivers/i2c/busses/i2c-designware-slave.c -index 78e2c47e3d7da7..345b532a2b455d 100644 ---- a/drivers/i2c/busses/i2c-designware-slave.c -+++ b/drivers/i2c/busses/i2c-designware-slave.c -@@ -88,7 +88,7 @@ static int i2c_dw_unreg_slave(struct i2c_client *slave) - struct dw_i2c_dev *dev = i2c_get_adapdata(slave->adapter); - - regmap_write(dev->map, DW_IC_INTR_MASK, 0); -- dev->disable(dev); -+ i2c_dw_disable(dev); - synchronize_irq(dev->irq); - dev->slave = NULL; - pm_runtime_put(dev->dev); -@@ -235,7 +235,6 @@ int i2c_dw_probe_slave(struct dw_i2c_dev *dev) - int ret; - - dev->init = i2c_dw_init_slave; -- dev->disable = i2c_dw_disable; - - ret = i2c_dw_init_regmap(dev); - if (ret) -diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c -index 3bd406470940fb..affdd94f06aaf0 100644 ---- a/drivers/i2c/busses/i2c-pxa.c -+++ b/drivers/i2c/busses/i2c-pxa.c -@@ -1504,7 +1504,10 @@ static int i2c_pxa_probe(struct platform_device *dev) - i2c->adap.name); - } - -- clk_prepare_enable(i2c->clk); -+ ret = clk_prepare_enable(i2c->clk); -+ if (ret) -+ return dev_err_probe(&dev->dev, ret, -+ "failed to enable clock\n"); - - if (i2c->use_pio) { - i2c->adap.algo = &i2c_pxa_pio_algorithm; -diff --git a/drivers/i2c/busses/i2c-qup.c b/drivers/i2c/busses/i2c-qup.c -index 598102d16677a1..ee92a315f074fe 100644 ---- a/drivers/i2c/busses/i2c-qup.c -+++ b/drivers/i2c/busses/i2c-qup.c -@@ -14,6 +14,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -150,6 +151,8 @@ - /* TAG length for DATA READ in RX FIFO */ - #define READ_RX_TAGS_LEN 2 - -+#define QUP_BUS_WIDTH 8 -+ - static unsigned int scl_freq; - module_param_named(scl_freq, scl_freq, uint, 0444); - MODULE_PARM_DESC(scl_freq, "SCL frequency override"); -@@ -227,6 +230,7 @@ struct qup_i2c_dev { - int irq; - struct clk *clk; - struct clk *pclk; -+ struct icc_path *icc_path; - struct i2c_adapter adap; - - int clk_ctl; -@@ -255,6 +259,10 @@ struct qup_i2c_dev { - /* To configure when bus is in run state */ - u32 config_run; - -+ /* bandwidth votes */ -+ u32 src_clk_freq; -+ u32 cur_bw_clk_freq; -+ - /* dma parameters */ - bool is_dma; - /* To check if the current transfer is using DMA */ -@@ -453,6 +461,23 @@ static int qup_i2c_bus_active(struct qup_i2c_dev *qup, int len) - return ret; - } - -+static int qup_i2c_vote_bw(struct qup_i2c_dev *qup, u32 clk_freq) -+{ -+ u32 needed_peak_bw; -+ int ret; -+ -+ if (qup->cur_bw_clk_freq == clk_freq) -+ return 0; -+ -+ needed_peak_bw = Bps_to_icc(clk_freq * QUP_BUS_WIDTH); -+ ret = icc_set_bw(qup->icc_path, 0, needed_peak_bw); -+ if (ret) -+ return ret; -+ -+ qup->cur_bw_clk_freq = clk_freq; -+ return 0; -+} -+ - static void qup_i2c_write_tx_fifo_v1(struct qup_i2c_dev *qup) - { - struct qup_i2c_block *blk = &qup->blk; -@@ -840,6 +865,10 @@ static int qup_i2c_bam_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, - int ret = 0; - int idx = 0; - -+ ret = qup_i2c_vote_bw(qup, qup->src_clk_freq); -+ if (ret) -+ return ret; -+ - enable_irq(qup->irq); - ret = qup_i2c_req_dma(qup); - -@@ -1645,6 +1674,7 @@ static void qup_i2c_disable_clocks(struct qup_i2c_dev *qup) - config = readl(qup->base + QUP_CONFIG); - config |= QUP_CLOCK_AUTO_GATE; - writel(config, qup->base + QUP_CONFIG); -+ qup_i2c_vote_bw(qup, 0); - clk_disable_unprepare(qup->pclk); - } - -@@ -1745,6 +1775,11 @@ static int qup_i2c_probe(struct platform_device *pdev) - goto fail_dma; - } - qup->is_dma = true; -+ -+ qup->icc_path = devm_of_icc_get(&pdev->dev, NULL); -+ if (IS_ERR(qup->icc_path)) -+ return dev_err_probe(&pdev->dev, PTR_ERR(qup->icc_path), -+ "failed to get interconnect path\n"); - } - - nodma: -@@ -1793,6 +1828,7 @@ static int qup_i2c_probe(struct platform_device *pdev) - qup_i2c_enable_clocks(qup); - src_clk_freq = clk_get_rate(qup->clk); - } -+ qup->src_clk_freq = src_clk_freq; - - /* - * Bootloaders might leave a pending interrupt on certain QUP's, -diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c -index fa1f12a89158cf..d1630d47ef6fcf 100644 ---- a/drivers/i3c/master/svc-i3c-master.c -+++ b/drivers/i3c/master/svc-i3c-master.c -@@ -503,6 +503,8 @@ static void svc_i3c_master_ibi_work(struct work_struct *work) - queue_work(master->base.wq, &master->hj_work); - break; - case SVC_I3C_MSTATUS_IBITYPE_MASTER_REQUEST: -+ svc_i3c_master_emit_stop(master); -+ break; - default: - break; - } -@@ -840,6 +842,8 @@ static int svc_i3c_master_do_daa_locked(struct svc_i3c_master *master, - u32 reg; - int ret, i; - -+ svc_i3c_master_flush_fifo(master); -+ - while (true) { - /* Enter/proceed with DAA */ - writel(SVC_I3C_MCTRL_REQUEST_PROC_DAA | -diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c -index 07c571c7b69992..c5b68639476058 100644 ---- a/drivers/infiniband/core/umem.c -+++ b/drivers/infiniband/core/umem.c -@@ -80,9 +80,12 @@ unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem, - unsigned long pgsz_bitmap, - unsigned long virt) - { -- struct scatterlist *sg; -+ unsigned long curr_len = 0; -+ dma_addr_t curr_base = ~0; - unsigned long va, pgoff; -+ struct scatterlist *sg; - dma_addr_t mask; -+ dma_addr_t end; - int i; - - umem->iova = va = virt; -@@ -107,17 +110,30 @@ unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem, - pgoff = umem->address & ~PAGE_MASK; - - for_each_sgtable_dma_sg(&umem->sgt_append.sgt, sg, i) { -- /* Walk SGL and reduce max page size if VA/PA bits differ -- * for any address. -+ /* If the current entry is physically contiguous with the previous -+ * one, no need to take its start addresses into consideration. - */ -- mask |= (sg_dma_address(sg) + pgoff) ^ va; -+ if (check_add_overflow(curr_base, curr_len, &end) || -+ end != sg_dma_address(sg)) { -+ -+ curr_base = sg_dma_address(sg); -+ curr_len = 0; -+ -+ /* Reduce max page size if VA/PA bits differ */ -+ mask |= (curr_base + pgoff) ^ va; -+ -+ /* The alignment of any VA matching a discontinuity point -+ * in the physical memory sets the maximum possible page -+ * size as this must be a starting point of a new page that -+ * needs to be aligned. -+ */ -+ if (i != 0) -+ mask |= va; -+ } -+ -+ curr_len += sg_dma_len(sg); - va += sg_dma_len(sg) - pgoff; -- /* Except for the last entry, the ending iova alignment sets -- * the maximum possible page size as the low bits of the iova -- * must be zero when starting the next chunk. -- */ -- if (i != (umem->sgt_append.sgt.nents - 1)) -- mask |= va; -+ - pgoff = 0; - } - -diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c -index c6053e82ecf6f3..33e2fe0facd529 100644 ---- a/drivers/infiniband/core/uverbs_cmd.c -+++ b/drivers/infiniband/core/uverbs_cmd.c -@@ -718,8 +718,8 @@ static int ib_uverbs_reg_mr(struct uverbs_attr_bundle *attrs) - goto err_free; - - pd = uobj_get_obj_read(pd, UVERBS_OBJECT_PD, cmd.pd_handle, attrs); -- if (!pd) { -- ret = -EINVAL; -+ if (IS_ERR(pd)) { -+ ret = PTR_ERR(pd); - goto err_free; - } - -@@ -809,8 +809,8 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs) - if (cmd.flags & IB_MR_REREG_PD) { - new_pd = uobj_get_obj_read(pd, UVERBS_OBJECT_PD, cmd.pd_handle, - attrs); -- if (!new_pd) { -- ret = -EINVAL; -+ if (IS_ERR(new_pd)) { -+ ret = PTR_ERR(new_pd); - goto put_uobjs; - } - } else { -@@ -919,8 +919,8 @@ static int ib_uverbs_alloc_mw(struct uverbs_attr_bundle *attrs) - return PTR_ERR(uobj); - - pd = uobj_get_obj_read(pd, UVERBS_OBJECT_PD, cmd.pd_handle, attrs); -- if (!pd) { -- ret = -EINVAL; -+ if (IS_ERR(pd)) { -+ ret = PTR_ERR(pd); - goto err_free; - } - -@@ -1127,8 +1127,8 @@ static int ib_uverbs_resize_cq(struct uverbs_attr_bundle *attrs) - return ret; - - cq = uobj_get_obj_read(cq, UVERBS_OBJECT_CQ, cmd.cq_handle, attrs); -- if (!cq) -- return -EINVAL; -+ if (IS_ERR(cq)) -+ return PTR_ERR(cq); - - ret = cq->device->ops.resize_cq(cq, cmd.cqe, &attrs->driver_udata); - if (ret) -@@ -1189,8 +1189,8 @@ static int ib_uverbs_poll_cq(struct uverbs_attr_bundle *attrs) - return ret; - - cq = uobj_get_obj_read(cq, UVERBS_OBJECT_CQ, cmd.cq_handle, attrs); -- if (!cq) -- return -EINVAL; -+ if (IS_ERR(cq)) -+ return PTR_ERR(cq); - - /* we copy a struct ib_uverbs_poll_cq_resp to user space */ - header_ptr = attrs->ucore.outbuf; -@@ -1238,8 +1238,8 @@ static int ib_uverbs_req_notify_cq(struct uverbs_attr_bundle *attrs) - return ret; - - cq = uobj_get_obj_read(cq, UVERBS_OBJECT_CQ, cmd.cq_handle, attrs); -- if (!cq) -- return -EINVAL; -+ if (IS_ERR(cq)) -+ return PTR_ERR(cq); - - ib_req_notify_cq(cq, cmd.solicited_only ? - IB_CQ_SOLICITED : IB_CQ_NEXT_COMP); -@@ -1321,8 +1321,8 @@ static int create_qp(struct uverbs_attr_bundle *attrs, - ind_tbl = uobj_get_obj_read(rwq_ind_table, - UVERBS_OBJECT_RWQ_IND_TBL, - cmd->rwq_ind_tbl_handle, attrs); -- if (!ind_tbl) { -- ret = -EINVAL; -+ if (IS_ERR(ind_tbl)) { -+ ret = PTR_ERR(ind_tbl); - goto err_put; - } - -@@ -1360,8 +1360,10 @@ static int create_qp(struct uverbs_attr_bundle *attrs, - if (cmd->is_srq) { - srq = uobj_get_obj_read(srq, UVERBS_OBJECT_SRQ, - cmd->srq_handle, attrs); -- if (!srq || srq->srq_type == IB_SRQT_XRC) { -- ret = -EINVAL; -+ if (IS_ERR(srq) || -+ srq->srq_type == IB_SRQT_XRC) { -+ ret = IS_ERR(srq) ? PTR_ERR(srq) : -+ -EINVAL; - goto err_put; - } - } -@@ -1371,23 +1373,29 @@ static int create_qp(struct uverbs_attr_bundle *attrs, - rcq = uobj_get_obj_read( - cq, UVERBS_OBJECT_CQ, - cmd->recv_cq_handle, attrs); -- if (!rcq) { -- ret = -EINVAL; -+ if (IS_ERR(rcq)) { -+ ret = PTR_ERR(rcq); - goto err_put; - } - } - } - } - -- if (has_sq) -+ if (has_sq) { - scq = uobj_get_obj_read(cq, UVERBS_OBJECT_CQ, - cmd->send_cq_handle, attrs); -+ if (IS_ERR(scq)) { -+ ret = PTR_ERR(scq); -+ goto err_put; -+ } -+ } -+ - if (!ind_tbl && cmd->qp_type != IB_QPT_XRC_INI) - rcq = rcq ?: scq; - pd = uobj_get_obj_read(pd, UVERBS_OBJECT_PD, cmd->pd_handle, - attrs); -- if (!pd || (!scq && has_sq)) { -- ret = -EINVAL; -+ if (IS_ERR(pd)) { -+ ret = PTR_ERR(pd); - goto err_put; - } - -@@ -1482,18 +1490,18 @@ static int create_qp(struct uverbs_attr_bundle *attrs, - err_put: - if (!IS_ERR(xrcd_uobj)) - uobj_put_read(xrcd_uobj); -- if (pd) -+ if (!IS_ERR_OR_NULL(pd)) - uobj_put_obj_read(pd); -- if (scq) -+ if (!IS_ERR_OR_NULL(scq)) - rdma_lookup_put_uobject(&scq->uobject->uevent.uobject, - UVERBS_LOOKUP_READ); -- if (rcq && rcq != scq) -+ if (!IS_ERR_OR_NULL(rcq) && rcq != scq) - rdma_lookup_put_uobject(&rcq->uobject->uevent.uobject, - UVERBS_LOOKUP_READ); -- if (srq) -+ if (!IS_ERR_OR_NULL(srq)) - rdma_lookup_put_uobject(&srq->uobject->uevent.uobject, - UVERBS_LOOKUP_READ); -- if (ind_tbl) -+ if (!IS_ERR_OR_NULL(ind_tbl)) - uobj_put_obj_read(ind_tbl); - - uobj_alloc_abort(&obj->uevent.uobject, attrs); -@@ -1655,8 +1663,8 @@ static int ib_uverbs_query_qp(struct uverbs_attr_bundle *attrs) - } - - qp = uobj_get_obj_read(qp, UVERBS_OBJECT_QP, cmd.qp_handle, attrs); -- if (!qp) { -- ret = -EINVAL; -+ if (IS_ERR(qp)) { -+ ret = PTR_ERR(qp); - goto out; - } - -@@ -1761,8 +1769,8 @@ static int modify_qp(struct uverbs_attr_bundle *attrs, - - qp = uobj_get_obj_read(qp, UVERBS_OBJECT_QP, cmd->base.qp_handle, - attrs); -- if (!qp) { -- ret = -EINVAL; -+ if (IS_ERR(qp)) { -+ ret = PTR_ERR(qp); - goto out; - } - -@@ -2027,8 +2035,8 @@ static int ib_uverbs_post_send(struct uverbs_attr_bundle *attrs) - return -ENOMEM; - - qp = uobj_get_obj_read(qp, UVERBS_OBJECT_QP, cmd.qp_handle, attrs); -- if (!qp) { -- ret = -EINVAL; -+ if (IS_ERR(qp)) { -+ ret = PTR_ERR(qp); - goto out; - } - -@@ -2065,9 +2073,9 @@ static int ib_uverbs_post_send(struct uverbs_attr_bundle *attrs) - - ud->ah = uobj_get_obj_read(ah, UVERBS_OBJECT_AH, - user_wr->wr.ud.ah, attrs); -- if (!ud->ah) { -+ if (IS_ERR(ud->ah)) { -+ ret = PTR_ERR(ud->ah); - kfree(ud); -- ret = -EINVAL; - goto out_put; - } - ud->remote_qpn = user_wr->wr.ud.remote_qpn; -@@ -2304,8 +2312,8 @@ static int ib_uverbs_post_recv(struct uverbs_attr_bundle *attrs) - return PTR_ERR(wr); - - qp = uobj_get_obj_read(qp, UVERBS_OBJECT_QP, cmd.qp_handle, attrs); -- if (!qp) { -- ret = -EINVAL; -+ if (IS_ERR(qp)) { -+ ret = PTR_ERR(qp); - goto out; - } - -@@ -2355,8 +2363,8 @@ static int ib_uverbs_post_srq_recv(struct uverbs_attr_bundle *attrs) - return PTR_ERR(wr); - - srq = uobj_get_obj_read(srq, UVERBS_OBJECT_SRQ, cmd.srq_handle, attrs); -- if (!srq) { -- ret = -EINVAL; -+ if (IS_ERR(srq)) { -+ ret = PTR_ERR(srq); - goto out; - } - -@@ -2412,8 +2420,8 @@ static int ib_uverbs_create_ah(struct uverbs_attr_bundle *attrs) - } - - pd = uobj_get_obj_read(pd, UVERBS_OBJECT_PD, cmd.pd_handle, attrs); -- if (!pd) { -- ret = -EINVAL; -+ if (IS_ERR(pd)) { -+ ret = PTR_ERR(pd); - goto err; - } - -@@ -2482,8 +2490,8 @@ static int ib_uverbs_attach_mcast(struct uverbs_attr_bundle *attrs) - return ret; - - qp = uobj_get_obj_read(qp, UVERBS_OBJECT_QP, cmd.qp_handle, attrs); -- if (!qp) -- return -EINVAL; -+ if (IS_ERR(qp)) -+ return PTR_ERR(qp); - - obj = qp->uobject; - -@@ -2532,8 +2540,8 @@ static int ib_uverbs_detach_mcast(struct uverbs_attr_bundle *attrs) - return ret; - - qp = uobj_get_obj_read(qp, UVERBS_OBJECT_QP, cmd.qp_handle, attrs); -- if (!qp) -- return -EINVAL; -+ if (IS_ERR(qp)) -+ return PTR_ERR(qp); - - obj = qp->uobject; - mutex_lock(&obj->mcast_lock); -@@ -2667,8 +2675,8 @@ static int kern_spec_to_ib_spec_action(struct uverbs_attr_bundle *attrs, - UVERBS_OBJECT_FLOW_ACTION, - kern_spec->action.handle, - attrs); -- if (!ib_spec->action.act) -- return -EINVAL; -+ if (IS_ERR(ib_spec->action.act)) -+ return PTR_ERR(ib_spec->action.act); - ib_spec->action.size = - sizeof(struct ib_flow_spec_action_handle); - flow_resources_add(uflow_res, -@@ -2685,8 +2693,8 @@ static int kern_spec_to_ib_spec_action(struct uverbs_attr_bundle *attrs, - UVERBS_OBJECT_COUNTERS, - kern_spec->flow_count.handle, - attrs); -- if (!ib_spec->flow_count.counters) -- return -EINVAL; -+ if (IS_ERR(ib_spec->flow_count.counters)) -+ return PTR_ERR(ib_spec->flow_count.counters); - ib_spec->flow_count.size = - sizeof(struct ib_flow_spec_action_count); - flow_resources_add(uflow_res, -@@ -2904,14 +2912,14 @@ static int ib_uverbs_ex_create_wq(struct uverbs_attr_bundle *attrs) - return PTR_ERR(obj); - - pd = uobj_get_obj_read(pd, UVERBS_OBJECT_PD, cmd.pd_handle, attrs); -- if (!pd) { -- err = -EINVAL; -+ if (IS_ERR(pd)) { -+ err = PTR_ERR(pd); - goto err_uobj; - } - - cq = uobj_get_obj_read(cq, UVERBS_OBJECT_CQ, cmd.cq_handle, attrs); -- if (!cq) { -- err = -EINVAL; -+ if (IS_ERR(cq)) { -+ err = PTR_ERR(cq); - goto err_put_pd; - } - -@@ -3012,8 +3020,8 @@ static int ib_uverbs_ex_modify_wq(struct uverbs_attr_bundle *attrs) - return -EINVAL; - - wq = uobj_get_obj_read(wq, UVERBS_OBJECT_WQ, cmd.wq_handle, attrs); -- if (!wq) -- return -EINVAL; -+ if (IS_ERR(wq)) -+ return PTR_ERR(wq); - - if (cmd.attr_mask & IB_WQ_FLAGS) { - wq_attr.flags = cmd.flags; -@@ -3096,8 +3104,8 @@ static int ib_uverbs_ex_create_rwq_ind_table(struct uverbs_attr_bundle *attrs) - num_read_wqs++) { - wq = uobj_get_obj_read(wq, UVERBS_OBJECT_WQ, - wqs_handles[num_read_wqs], attrs); -- if (!wq) { -- err = -EINVAL; -+ if (IS_ERR(wq)) { -+ err = PTR_ERR(wq); - goto put_wqs; - } - -@@ -3252,8 +3260,8 @@ static int ib_uverbs_ex_create_flow(struct uverbs_attr_bundle *attrs) - } - - qp = uobj_get_obj_read(qp, UVERBS_OBJECT_QP, cmd.qp_handle, attrs); -- if (!qp) { -- err = -EINVAL; -+ if (IS_ERR(qp)) { -+ err = PTR_ERR(qp); - goto err_uobj; - } - -@@ -3399,15 +3407,15 @@ static int __uverbs_create_xsrq(struct uverbs_attr_bundle *attrs, - if (ib_srq_has_cq(cmd->srq_type)) { - attr.ext.cq = uobj_get_obj_read(cq, UVERBS_OBJECT_CQ, - cmd->cq_handle, attrs); -- if (!attr.ext.cq) { -- ret = -EINVAL; -+ if (IS_ERR(attr.ext.cq)) { -+ ret = PTR_ERR(attr.ext.cq); - goto err_put_xrcd; - } - } - - pd = uobj_get_obj_read(pd, UVERBS_OBJECT_PD, cmd->pd_handle, attrs); -- if (!pd) { -- ret = -EINVAL; -+ if (IS_ERR(pd)) { -+ ret = PTR_ERR(pd); - goto err_put_cq; - } - -@@ -3514,8 +3522,8 @@ static int ib_uverbs_modify_srq(struct uverbs_attr_bundle *attrs) - return ret; - - srq = uobj_get_obj_read(srq, UVERBS_OBJECT_SRQ, cmd.srq_handle, attrs); -- if (!srq) -- return -EINVAL; -+ if (IS_ERR(srq)) -+ return PTR_ERR(srq); - - attr.max_wr = cmd.max_wr; - attr.srq_limit = cmd.srq_limit; -@@ -3542,8 +3550,8 @@ static int ib_uverbs_query_srq(struct uverbs_attr_bundle *attrs) - return ret; - - srq = uobj_get_obj_read(srq, UVERBS_OBJECT_SRQ, cmd.srq_handle, attrs); -- if (!srq) -- return -EINVAL; -+ if (IS_ERR(srq)) -+ return PTR_ERR(srq); - - ret = ib_query_srq(srq, &attr); - -@@ -3668,8 +3676,8 @@ static int ib_uverbs_ex_modify_cq(struct uverbs_attr_bundle *attrs) - return -EOPNOTSUPP; - - cq = uobj_get_obj_read(cq, UVERBS_OBJECT_CQ, cmd.cq_handle, attrs); -- if (!cq) -- return -EINVAL; -+ if (IS_ERR(cq)) -+ return PTR_ERR(cq); - - ret = rdma_set_cq_moderation(cq, cmd.attr.cq_count, cmd.attr.cq_period); - -diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c -index ba05de0380e96e..6567d437512808 100644 ---- a/drivers/infiniband/core/verbs.c -+++ b/drivers/infiniband/core/verbs.c -@@ -3029,22 +3029,23 @@ EXPORT_SYMBOL(__rdma_block_iter_start); - bool __rdma_block_iter_next(struct ib_block_iter *biter) - { - unsigned int block_offset; -- unsigned int sg_delta; -+ unsigned int delta; - - if (!biter->__sg_nents || !biter->__sg) - return false; - - biter->__dma_addr = sg_dma_address(biter->__sg) + biter->__sg_advance; - block_offset = biter->__dma_addr & (BIT_ULL(biter->__pg_bit) - 1); -- sg_delta = BIT_ULL(biter->__pg_bit) - block_offset; -+ delta = BIT_ULL(biter->__pg_bit) - block_offset; - -- if (sg_dma_len(biter->__sg) - biter->__sg_advance > sg_delta) { -- biter->__sg_advance += sg_delta; -- } else { -+ while (biter->__sg_nents && biter->__sg && -+ sg_dma_len(biter->__sg) - biter->__sg_advance <= delta) { -+ delta -= sg_dma_len(biter->__sg) - biter->__sg_advance; - biter->__sg_advance = 0; - biter->__sg = sg_next(biter->__sg); - biter->__sg_nents--; - } -+ biter->__sg_advance += delta; - - return true; - } -diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c -index c65321964131cf..e6fed973ea7411 100644 ---- a/drivers/input/joystick/xpad.c -+++ b/drivers/input/joystick/xpad.c -@@ -289,6 +289,8 @@ static const struct xpad_device { - { 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 }, - { 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 }, - { 0x10f5, 0x7005, "Turtle Beach Recon Controller", 0, XTYPE_XBOXONE }, -+ { 0x10f5, 0x7008, "Turtle Beach Recon Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE }, -+ { 0x10f5, 0x7073, "Turtle Beach Stealth Ultra Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE }, - { 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 }, - { 0x11ff, 0x0511, "PXN V900", 0, XTYPE_XBOX360 }, - { 0x1209, 0x2882, "Ardwiino Controller", 0, XTYPE_XBOX360 }, -@@ -353,6 +355,7 @@ static const struct xpad_device { - { 0x1ee9, 0x1590, "ZOTAC Gaming Zone", 0, XTYPE_XBOX360 }, - { 0x20d6, 0x2001, "BDA Xbox Series X Wired Controller", 0, XTYPE_XBOXONE }, - { 0x20d6, 0x2009, "PowerA Enhanced Wired Controller for Xbox Series X|S", 0, XTYPE_XBOXONE }, -+ { 0x20d6, 0x2064, "PowerA Wired Controller for Xbox", MAP_SHARE_BUTTON, XTYPE_XBOXONE }, - { 0x20d6, 0x281f, "PowerA Wired Controller For Xbox 360", 0, XTYPE_XBOX360 }, - { 0x24c6, 0x5000, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, - { 0x24c6, 0x5300, "PowerA MINI PROEX Controller", 0, XTYPE_XBOX360 }, -diff --git a/drivers/iommu/amd/io_pgtable_v2.c b/drivers/iommu/amd/io_pgtable_v2.c -index cbf0c46015125a..6c0777a3c57b79 100644 ---- a/drivers/iommu/amd/io_pgtable_v2.c -+++ b/drivers/iommu/amd/io_pgtable_v2.c -@@ -259,7 +259,7 @@ static int iommu_v2_map_pages(struct io_pgtable_ops *ops, unsigned long iova, - pte = v2_alloc_pte(pdom->nid, pdom->iop.pgd, - iova, map_size, gfp, &updated); - if (!pte) { -- ret = -EINVAL; -+ ret = -ENOMEM; - goto out; - } - -diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c -index 2da969fc899004..3f7fcf1801a97a 100644 ---- a/drivers/iommu/dma-iommu.c -+++ b/drivers/iommu/dma-iommu.c -@@ -1716,7 +1716,7 @@ int iommu_dma_prepare_msi(struct msi_desc *desc, phys_addr_t msi_addr) - static DEFINE_MUTEX(msi_prepare_lock); /* see below */ - - if (!domain || !domain->iova_cookie) { -- desc->iommu_cookie = NULL; -+ msi_desc_set_iommu_msi_iova(desc, 0, 0); - return 0; - } - -@@ -1728,11 +1728,12 @@ int iommu_dma_prepare_msi(struct msi_desc *desc, phys_addr_t msi_addr) - mutex_lock(&msi_prepare_lock); - msi_page = iommu_dma_get_msi_page(dev, msi_addr, domain); - mutex_unlock(&msi_prepare_lock); -- -- msi_desc_set_iommu_cookie(desc, msi_page); -- - if (!msi_page) - return -ENOMEM; -+ -+ msi_desc_set_iommu_msi_iova( -+ desc, msi_page->iova, -+ ilog2(cookie_msi_granule(domain->iova_cookie))); - return 0; - } - -@@ -1743,18 +1744,15 @@ int iommu_dma_prepare_msi(struct msi_desc *desc, phys_addr_t msi_addr) - */ - void iommu_dma_compose_msi_msg(struct msi_desc *desc, struct msi_msg *msg) - { -- struct device *dev = msi_desc_to_dev(desc); -- const struct iommu_domain *domain = iommu_get_domain_for_dev(dev); -- const struct iommu_dma_msi_page *msi_page; -+#ifdef CONFIG_IRQ_MSI_IOMMU -+ if (desc->iommu_msi_shift) { -+ u64 msi_iova = desc->iommu_msi_iova << desc->iommu_msi_shift; - -- msi_page = msi_desc_get_iommu_cookie(desc); -- -- if (!domain || !domain->iova_cookie || WARN_ON(!msi_page)) -- return; -- -- msg->address_hi = upper_32_bits(msi_page->iova); -- msg->address_lo &= cookie_msi_granule(domain->iova_cookie) - 1; -- msg->address_lo += lower_32_bits(msi_page->iova); -+ msg->address_hi = upper_32_bits(msi_iova); -+ msg->address_lo = lower_32_bits(msi_iova) | -+ (msg->address_lo & ((1 << desc->iommu_msi_shift) - 1)); -+ } -+#endif - } - - static int iommu_dma_init(void) -diff --git a/drivers/leds/rgb/leds-pwm-multicolor.c b/drivers/leds/rgb/leds-pwm-multicolor.c -index e1a81e0109e8a5..c0aa34b1d0e2dc 100644 ---- a/drivers/leds/rgb/leds-pwm-multicolor.c -+++ b/drivers/leds/rgb/leds-pwm-multicolor.c -@@ -135,8 +135,11 @@ static int led_pwm_mc_probe(struct platform_device *pdev) - - /* init the multicolor's LED class device */ - cdev = &priv->mc_cdev.led_cdev; -- fwnode_property_read_u32(mcnode, "max-brightness", -+ ret = fwnode_property_read_u32(mcnode, "max-brightness", - &cdev->max_brightness); -+ if (ret) -+ goto release_mcnode; -+ - cdev->flags = LED_CORE_SUSPENDRESUME; - cdev->brightness_set_blocking = led_pwm_mc_set; - -diff --git a/drivers/leds/trigger/ledtrig-netdev.c b/drivers/leds/trigger/ledtrig-netdev.c -index 79719fc8a08fb4..f8912fa60c4988 100644 ---- a/drivers/leds/trigger/ledtrig-netdev.c -+++ b/drivers/leds/trigger/ledtrig-netdev.c -@@ -54,6 +54,7 @@ struct led_netdev_data { - unsigned int last_activity; - - unsigned long mode; -+ unsigned long blink_delay; - int link_speed; - u8 duplex; - -@@ -69,6 +70,10 @@ static void set_baseline_state(struct led_netdev_data *trigger_data) - /* Already validated, hw control is possible with the requested mode */ - if (trigger_data->hw_control) { - led_cdev->hw_control_set(led_cdev, trigger_data->mode); -+ if (led_cdev->blink_set) { -+ led_cdev->blink_set(led_cdev, &trigger_data->blink_delay, -+ &trigger_data->blink_delay); -+ } - - return; - } -@@ -386,10 +391,11 @@ static ssize_t interval_store(struct device *dev, - size_t size) - { - struct led_netdev_data *trigger_data = led_trigger_get_drvdata(dev); -+ struct led_classdev *led_cdev = trigger_data->led_cdev; - unsigned long value; - int ret; - -- if (trigger_data->hw_control) -+ if (trigger_data->hw_control && !led_cdev->blink_set) - return -EINVAL; - - ret = kstrtoul(buf, 0, &value); -@@ -398,9 +404,13 @@ static ssize_t interval_store(struct device *dev, - - /* impose some basic bounds on the timer interval */ - if (value >= 5 && value <= 10000) { -- cancel_delayed_work_sync(&trigger_data->work); -+ if (trigger_data->hw_control) { -+ trigger_data->blink_delay = value; -+ } else { -+ cancel_delayed_work_sync(&trigger_data->work); - -- atomic_set(&trigger_data->interval, msecs_to_jiffies(value)); -+ atomic_set(&trigger_data->interval, msecs_to_jiffies(value)); -+ } - set_baseline_state(trigger_data); /* resets timer */ - } - -diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c -index ebff3baf304515..f13d705f7861af 100644 ---- a/drivers/mailbox/mailbox.c -+++ b/drivers/mailbox/mailbox.c -@@ -415,11 +415,12 @@ struct mbox_chan *mbox_request_channel(struct mbox_client *cl, int index) - - mutex_lock(&con_mutex); - -- if (of_parse_phandle_with_args(dev->of_node, "mboxes", -- "#mbox-cells", index, &spec)) { -+ ret = of_parse_phandle_with_args(dev->of_node, "mboxes", "#mbox-cells", -+ index, &spec); -+ if (ret) { - dev_dbg(dev, "%s: can't parse \"mboxes\" property\n", __func__); - mutex_unlock(&con_mutex); -- return ERR_PTR(-ENODEV); -+ return ERR_PTR(ret); - } - - chan = ERR_PTR(-EPROBE_DEFER); -diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c -index f8215a8f656a46..49254d99a8ad68 100644 ---- a/drivers/mailbox/pcc.c -+++ b/drivers/mailbox/pcc.c -@@ -419,8 +419,12 @@ int pcc_mbox_ioremap(struct mbox_chan *chan) - return -1; - pchan_info = chan->con_priv; - pcc_mbox_chan = &pchan_info->chan; -- pcc_mbox_chan->shmem = ioremap(pcc_mbox_chan->shmem_base_addr, -- pcc_mbox_chan->shmem_size); -+ -+ pcc_mbox_chan->shmem = acpi_os_ioremap(pcc_mbox_chan->shmem_base_addr, -+ pcc_mbox_chan->shmem_size); -+ if (!pcc_mbox_chan->shmem) -+ return -ENXIO; -+ - return 0; - } - EXPORT_SYMBOL_GPL(pcc_mbox_ioremap); -diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c -index c5851c9f7ec041..0d002d50329da9 100644 ---- a/drivers/md/dm-cache-target.c -+++ b/drivers/md/dm-cache-target.c -@@ -2903,6 +2903,27 @@ static dm_cblock_t get_cache_dev_size(struct cache *cache) - return to_cblock(size); - } - -+static bool can_resume(struct cache *cache) -+{ -+ /* -+ * Disallow retrying the resume operation for devices that failed the -+ * first resume attempt, as the failure leaves the policy object partially -+ * initialized. Retrying could trigger BUG_ON when loading cache mappings -+ * into the incomplete policy object. -+ */ -+ if (cache->sized && !cache->loaded_mappings) { -+ if (get_cache_mode(cache) != CM_WRITE) -+ DMERR("%s: unable to resume a failed-loaded cache, please check metadata.", -+ cache_device_name(cache)); -+ else -+ DMERR("%s: unable to resume cache due to missing proper cache table reload", -+ cache_device_name(cache)); -+ return false; -+ } -+ -+ return true; -+} -+ - static bool can_resize(struct cache *cache, dm_cblock_t new_size) - { - if (from_cblock(new_size) > from_cblock(cache->cache_size)) { -@@ -2951,6 +2972,9 @@ static int cache_preresume(struct dm_target *ti) - struct cache *cache = ti->private; - dm_cblock_t csize = get_cache_dev_size(cache); - -+ if (!can_resume(cache)) -+ return -EINVAL; -+ - /* - * Check to see if the cache has resized. - */ -diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c -index 7a33da2dd64b12..bf2ade89c8c2dc 100644 ---- a/drivers/md/dm-table.c -+++ b/drivers/md/dm-table.c -@@ -669,6 +669,10 @@ int dm_table_add_target(struct dm_table *t, const char *type, - DMERR("%s: zero-length target", dm_device_name(t->md)); - return -EINVAL; - } -+ if (start + len < start || start + len > LLONG_MAX >> SECTOR_SHIFT) { -+ DMERR("%s: too large device", dm_device_name(t->md)); -+ return -EINVAL; -+ } - - ti->type = dm_get_target_type(type); - if (!ti->type) { -diff --git a/drivers/md/dm.c b/drivers/md/dm.c -index 5dd0a42463a2b8..9ea868bd0d1293 100644 ---- a/drivers/md/dm.c -+++ b/drivers/md/dm.c -@@ -1536,14 +1536,18 @@ static void __send_empty_flush(struct clone_info *ci) - { - struct dm_table *t = ci->map; - struct bio flush_bio; -+ blk_opf_t opf = REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC; -+ -+ if ((ci->io->orig_bio->bi_opf & (REQ_IDLE | REQ_SYNC)) == -+ (REQ_IDLE | REQ_SYNC)) -+ opf |= REQ_IDLE; - - /* - * Use an on-stack bio for this, it's safe since we don't - * need to reference it after submit. It's just used as - * the basis for the clone(s). - */ -- bio_init(&flush_bio, ci->io->md->disk->part0, NULL, 0, -- REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC); -+ bio_init(&flush_bio, ci->io->md->disk->part0, NULL, 0, opf); - - ci->bio = &flush_bio; - ci->sector_count = 0; -diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c -index 99ba925e8ec8e6..114ac0c263fb2b 100644 ---- a/drivers/media/i2c/adv7180.c -+++ b/drivers/media/i2c/adv7180.c -@@ -194,6 +194,7 @@ struct adv7180_state; - #define ADV7180_FLAG_V2 BIT(1) - #define ADV7180_FLAG_MIPI_CSI2 BIT(2) - #define ADV7180_FLAG_I2P BIT(3) -+#define ADV7180_FLAG_TEST_PATTERN BIT(4) - - struct adv7180_chip_info { - unsigned int flags; -@@ -673,11 +674,15 @@ static int adv7180_init_controls(struct adv7180_state *state) - ADV7180_HUE_MAX, 1, ADV7180_HUE_DEF); - v4l2_ctrl_new_custom(&state->ctrl_hdl, &adv7180_ctrl_fast_switch, NULL); - -- v4l2_ctrl_new_std_menu_items(&state->ctrl_hdl, &adv7180_ctrl_ops, -- V4L2_CID_TEST_PATTERN, -- ARRAY_SIZE(test_pattern_menu) - 1, -- 0, ARRAY_SIZE(test_pattern_menu) - 1, -- test_pattern_menu); -+ if (state->chip_info->flags & ADV7180_FLAG_TEST_PATTERN) { -+ v4l2_ctrl_new_std_menu_items(&state->ctrl_hdl, -+ &adv7180_ctrl_ops, -+ V4L2_CID_TEST_PATTERN, -+ ARRAY_SIZE(test_pattern_menu) - 1, -+ 0, -+ ARRAY_SIZE(test_pattern_menu) - 1, -+ test_pattern_menu); -+ } - - state->sd.ctrl_handler = &state->ctrl_hdl; - if (state->ctrl_hdl.error) { -@@ -1209,7 +1214,7 @@ static const struct adv7180_chip_info adv7182_info = { - }; - - static const struct adv7180_chip_info adv7280_info = { -- .flags = ADV7180_FLAG_V2 | ADV7180_FLAG_I2P, -+ .flags = ADV7180_FLAG_V2 | ADV7180_FLAG_I2P | ADV7180_FLAG_TEST_PATTERN, - .valid_input_mask = BIT(ADV7182_INPUT_CVBS_AIN1) | - BIT(ADV7182_INPUT_CVBS_AIN2) | - BIT(ADV7182_INPUT_CVBS_AIN3) | -@@ -1223,7 +1228,8 @@ static const struct adv7180_chip_info adv7280_info = { - }; - - static const struct adv7180_chip_info adv7280_m_info = { -- .flags = ADV7180_FLAG_V2 | ADV7180_FLAG_MIPI_CSI2 | ADV7180_FLAG_I2P, -+ .flags = ADV7180_FLAG_V2 | ADV7180_FLAG_MIPI_CSI2 | ADV7180_FLAG_I2P | -+ ADV7180_FLAG_TEST_PATTERN, - .valid_input_mask = BIT(ADV7182_INPUT_CVBS_AIN1) | - BIT(ADV7182_INPUT_CVBS_AIN2) | - BIT(ADV7182_INPUT_CVBS_AIN3) | -@@ -1244,7 +1250,8 @@ static const struct adv7180_chip_info adv7280_m_info = { - }; - - static const struct adv7180_chip_info adv7281_info = { -- .flags = ADV7180_FLAG_V2 | ADV7180_FLAG_MIPI_CSI2, -+ .flags = ADV7180_FLAG_V2 | ADV7180_FLAG_MIPI_CSI2 | -+ ADV7180_FLAG_TEST_PATTERN, - .valid_input_mask = BIT(ADV7182_INPUT_CVBS_AIN1) | - BIT(ADV7182_INPUT_CVBS_AIN2) | - BIT(ADV7182_INPUT_CVBS_AIN7) | -@@ -1259,7 +1266,8 @@ static const struct adv7180_chip_info adv7281_info = { - }; - - static const struct adv7180_chip_info adv7281_m_info = { -- .flags = ADV7180_FLAG_V2 | ADV7180_FLAG_MIPI_CSI2, -+ .flags = ADV7180_FLAG_V2 | ADV7180_FLAG_MIPI_CSI2 | -+ ADV7180_FLAG_TEST_PATTERN, - .valid_input_mask = BIT(ADV7182_INPUT_CVBS_AIN1) | - BIT(ADV7182_INPUT_CVBS_AIN2) | - BIT(ADV7182_INPUT_CVBS_AIN3) | -@@ -1279,7 +1287,8 @@ static const struct adv7180_chip_info adv7281_m_info = { - }; - - static const struct adv7180_chip_info adv7281_ma_info = { -- .flags = ADV7180_FLAG_V2 | ADV7180_FLAG_MIPI_CSI2, -+ .flags = ADV7180_FLAG_V2 | ADV7180_FLAG_MIPI_CSI2 | -+ ADV7180_FLAG_TEST_PATTERN, - .valid_input_mask = BIT(ADV7182_INPUT_CVBS_AIN1) | - BIT(ADV7182_INPUT_CVBS_AIN2) | - BIT(ADV7182_INPUT_CVBS_AIN3) | -@@ -1304,7 +1313,7 @@ static const struct adv7180_chip_info adv7281_ma_info = { - }; - - static const struct adv7180_chip_info adv7282_info = { -- .flags = ADV7180_FLAG_V2 | ADV7180_FLAG_I2P, -+ .flags = ADV7180_FLAG_V2 | ADV7180_FLAG_I2P | ADV7180_FLAG_TEST_PATTERN, - .valid_input_mask = BIT(ADV7182_INPUT_CVBS_AIN1) | - BIT(ADV7182_INPUT_CVBS_AIN2) | - BIT(ADV7182_INPUT_CVBS_AIN7) | -@@ -1319,7 +1328,8 @@ static const struct adv7180_chip_info adv7282_info = { - }; - - static const struct adv7180_chip_info adv7282_m_info = { -- .flags = ADV7180_FLAG_V2 | ADV7180_FLAG_MIPI_CSI2 | ADV7180_FLAG_I2P, -+ .flags = ADV7180_FLAG_V2 | ADV7180_FLAG_MIPI_CSI2 | ADV7180_FLAG_I2P | -+ ADV7180_FLAG_TEST_PATTERN, - .valid_input_mask = BIT(ADV7182_INPUT_CVBS_AIN1) | - BIT(ADV7182_INPUT_CVBS_AIN2) | - BIT(ADV7182_INPUT_CVBS_AIN3) | -diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c -index a14e571dc62bc5..a3d5a8a7c660b0 100644 ---- a/drivers/media/i2c/imx219.c -+++ b/drivers/media/i2c/imx219.c -@@ -77,7 +77,7 @@ - #define IMX219_VTS_30FPS_640x480 0x06e3 - #define IMX219_VTS_MAX 0xffff - --#define IMX219_VBLANK_MIN 4 -+#define IMX219_VBLANK_MIN 32 - - /*Frame Length Line*/ - #define IMX219_FLL_MIN 0x08a6 -diff --git a/drivers/media/i2c/tc358746.c b/drivers/media/i2c/tc358746.c -index 566f5eaddd572e..b12a6bd42102e9 100644 ---- a/drivers/media/i2c/tc358746.c -+++ b/drivers/media/i2c/tc358746.c -@@ -460,24 +460,20 @@ static int tc358746_apply_misc_config(struct tc358746 *tc358746) - return err; - } - --/* Use MHz as base so the div needs no u64 */ --static u32 tc358746_cfg_to_cnt(unsigned int cfg_val, -- unsigned int clk_mhz, -- unsigned int time_base) -+static u32 tc358746_cfg_to_cnt(unsigned long cfg_val, unsigned long clk_hz, -+ unsigned long long time_base) - { -- return DIV_ROUND_UP(cfg_val * clk_mhz, time_base); -+ return div64_u64((u64)cfg_val * clk_hz + time_base - 1, time_base); - } - --static u32 tc358746_ps_to_cnt(unsigned int cfg_val, -- unsigned int clk_mhz) -+static u32 tc358746_ps_to_cnt(unsigned long cfg_val, unsigned long clk_hz) - { -- return tc358746_cfg_to_cnt(cfg_val, clk_mhz, USEC_PER_SEC); -+ return tc358746_cfg_to_cnt(cfg_val, clk_hz, PSEC_PER_SEC); - } - --static u32 tc358746_us_to_cnt(unsigned int cfg_val, -- unsigned int clk_mhz) -+static u32 tc358746_us_to_cnt(unsigned long cfg_val, unsigned long clk_hz) - { -- return tc358746_cfg_to_cnt(cfg_val, clk_mhz, 1); -+ return tc358746_cfg_to_cnt(cfg_val, clk_hz, USEC_PER_SEC); - } - - static int tc358746_apply_dphy_config(struct tc358746 *tc358746) -@@ -492,7 +488,6 @@ static int tc358746_apply_dphy_config(struct tc358746 *tc358746) - - /* The hs_byte_clk is also called SYSCLK in the excel sheet */ - hs_byte_clk = cfg->hs_clk_rate / 8; -- hs_byte_clk /= HZ_PER_MHZ; - hf_clk = hs_byte_clk / 2; - - val = tc358746_us_to_cnt(cfg->init, hf_clk) - 1; -diff --git a/drivers/media/platform/qcom/camss/camss-csid.c b/drivers/media/platform/qcom/camss/camss-csid.c -index 6360314f04a636..b90e2e690f3aa1 100644 ---- a/drivers/media/platform/qcom/camss/camss-csid.c -+++ b/drivers/media/platform/qcom/camss/camss-csid.c -@@ -239,11 +239,13 @@ static int csid_set_stream(struct v4l2_subdev *sd, int enable) - int ret; - - if (enable) { -- ret = v4l2_ctrl_handler_setup(&csid->ctrls); -- if (ret < 0) { -- dev_err(csid->camss->dev, -- "could not sync v4l2 controls: %d\n", ret); -- return ret; -+ if (csid->testgen.nmodes != CSID_PAYLOAD_MODE_DISABLED) { -+ ret = v4l2_ctrl_handler_setup(&csid->ctrls); -+ if (ret < 0) { -+ dev_err(csid->camss->dev, -+ "could not sync v4l2 controls: %d\n", ret); -+ return ret; -+ } - } - - if (!csid->testgen.enabled && -@@ -318,7 +320,8 @@ static void csid_try_format(struct csid_device *csid, - break; - - case MSM_CSID_PAD_SRC: -- if (csid->testgen_mode->cur.val == 0) { -+ if (csid->testgen.nmodes == CSID_PAYLOAD_MODE_DISABLED || -+ csid->testgen_mode->cur.val == 0) { - /* Test generator is disabled, */ - /* keep pad formats in sync */ - u32 code = fmt->code; -@@ -368,7 +371,8 @@ static int csid_enum_mbus_code(struct v4l2_subdev *sd, - - code->code = csid->formats[code->index].code; - } else { -- if (csid->testgen_mode->cur.val == 0) { -+ if (csid->testgen.nmodes == CSID_PAYLOAD_MODE_DISABLED || -+ csid->testgen_mode->cur.val == 0) { - struct v4l2_mbus_framefmt *sink_fmt; - - sink_fmt = __csid_get_format(csid, sd_state, -@@ -750,7 +754,8 @@ static int csid_link_setup(struct media_entity *entity, - - /* If test generator is enabled */ - /* do not allow a link from CSIPHY to CSID */ -- if (csid->testgen_mode->cur.val != 0) -+ if (csid->testgen.nmodes != CSID_PAYLOAD_MODE_DISABLED && -+ csid->testgen_mode->cur.val != 0) - return -EBUSY; - - sd = media_entity_to_v4l2_subdev(remote->entity); -@@ -843,24 +848,27 @@ int msm_csid_register_entity(struct csid_device *csid, - MSM_CSID_NAME, csid->id); - v4l2_set_subdevdata(sd, csid); - -- ret = v4l2_ctrl_handler_init(&csid->ctrls, 1); -- if (ret < 0) { -- dev_err(dev, "Failed to init ctrl handler: %d\n", ret); -- return ret; -- } -+ if (csid->testgen.nmodes != CSID_PAYLOAD_MODE_DISABLED) { -+ ret = v4l2_ctrl_handler_init(&csid->ctrls, 1); -+ if (ret < 0) { -+ dev_err(dev, "Failed to init ctrl handler: %d\n", ret); -+ return ret; -+ } - -- csid->testgen_mode = v4l2_ctrl_new_std_menu_items(&csid->ctrls, -- &csid_ctrl_ops, V4L2_CID_TEST_PATTERN, -- csid->testgen.nmodes, 0, 0, -- csid->testgen.modes); -+ csid->testgen_mode = -+ v4l2_ctrl_new_std_menu_items(&csid->ctrls, -+ &csid_ctrl_ops, V4L2_CID_TEST_PATTERN, -+ csid->testgen.nmodes, 0, 0, -+ csid->testgen.modes); - -- if (csid->ctrls.error) { -- dev_err(dev, "Failed to init ctrl: %d\n", csid->ctrls.error); -- ret = csid->ctrls.error; -- goto free_ctrl; -- } -+ if (csid->ctrls.error) { -+ dev_err(dev, "Failed to init ctrl: %d\n", csid->ctrls.error); -+ ret = csid->ctrls.error; -+ goto free_ctrl; -+ } - -- csid->subdev.ctrl_handler = &csid->ctrls; -+ csid->subdev.ctrl_handler = &csid->ctrls; -+ } - - ret = csid_init_formats(sd, NULL); - if (ret < 0) { -@@ -891,7 +899,8 @@ int msm_csid_register_entity(struct csid_device *csid, - media_cleanup: - media_entity_cleanup(&sd->entity); - free_ctrl: -- v4l2_ctrl_handler_free(&csid->ctrls); -+ if (csid->testgen.nmodes != CSID_PAYLOAD_MODE_DISABLED) -+ v4l2_ctrl_handler_free(&csid->ctrls); - - return ret; - } -@@ -904,5 +913,6 @@ void msm_csid_unregister_entity(struct csid_device *csid) - { - v4l2_device_unregister_subdev(&csid->subdev); - media_entity_cleanup(&csid->subdev.entity); -- v4l2_ctrl_handler_free(&csid->ctrls); -+ if (csid->testgen.nmodes != CSID_PAYLOAD_MODE_DISABLED) -+ v4l2_ctrl_handler_free(&csid->ctrls); - } -diff --git a/drivers/media/platform/st/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/st/sti/c8sectpfe/c8sectpfe-core.c -index 5dc1f908b49bd6..9aa484126a0dd6 100644 ---- a/drivers/media/platform/st/sti/c8sectpfe/c8sectpfe-core.c -+++ b/drivers/media/platform/st/sti/c8sectpfe/c8sectpfe-core.c -@@ -806,13 +806,12 @@ static int c8sectpfe_probe(struct platform_device *pdev) - } - tsin->i2c_adapter = - of_find_i2c_adapter_by_node(i2c_bus); -+ of_node_put(i2c_bus); - if (!tsin->i2c_adapter) { - dev_err(&pdev->dev, "No i2c adapter found\n"); -- of_node_put(i2c_bus); - ret = -ENODEV; - goto err_node_put; - } -- of_node_put(i2c_bus); - - /* Acquire reset GPIO and activate it */ - tsin->rst_gpio = devm_fwnode_gpiod_get(dev, -diff --git a/drivers/media/test-drivers/vivid/vivid-kthread-cap.c b/drivers/media/test-drivers/vivid/vivid-kthread-cap.c -index 42048727d7ff35..b8cdffc9a1e9e9 100644 ---- a/drivers/media/test-drivers/vivid/vivid-kthread-cap.c -+++ b/drivers/media/test-drivers/vivid/vivid-kthread-cap.c -@@ -765,9 +765,14 @@ static int vivid_thread_vid_cap(void *data) - next_jiffies_since_start = jiffies_since_start; - - wait_jiffies = next_jiffies_since_start - jiffies_since_start; -- while (time_is_after_jiffies(cur_jiffies + wait_jiffies) && -- !kthread_should_stop()) -- schedule(); -+ if (!time_is_after_jiffies(cur_jiffies + wait_jiffies)) -+ continue; -+ -+ wait_queue_head_t wait; -+ -+ init_waitqueue_head(&wait); -+ wait_event_interruptible_timeout(wait, kthread_should_stop(), -+ cur_jiffies + wait_jiffies - jiffies); - } - dprintk(dev, 1, "Video Capture Thread End\n"); - return 0; -diff --git a/drivers/media/test-drivers/vivid/vivid-kthread-out.c b/drivers/media/test-drivers/vivid/vivid-kthread-out.c -index fac6208b51da84..015a7b166a1e61 100644 ---- a/drivers/media/test-drivers/vivid/vivid-kthread-out.c -+++ b/drivers/media/test-drivers/vivid/vivid-kthread-out.c -@@ -235,9 +235,14 @@ static int vivid_thread_vid_out(void *data) - next_jiffies_since_start = jiffies_since_start; - - wait_jiffies = next_jiffies_since_start - jiffies_since_start; -- while (time_is_after_jiffies(cur_jiffies + wait_jiffies) && -- !kthread_should_stop()) -- schedule(); -+ if (!time_is_after_jiffies(cur_jiffies + wait_jiffies)) -+ continue; -+ -+ wait_queue_head_t wait; -+ -+ init_waitqueue_head(&wait); -+ wait_event_interruptible_timeout(wait, kthread_should_stop(), -+ cur_jiffies + wait_jiffies - jiffies); - } - dprintk(dev, 1, "Video Output Thread End\n"); - return 0; -diff --git a/drivers/media/test-drivers/vivid/vivid-kthread-touch.c b/drivers/media/test-drivers/vivid/vivid-kthread-touch.c -index fa711ee36a3fbc..c862689786b69c 100644 ---- a/drivers/media/test-drivers/vivid/vivid-kthread-touch.c -+++ b/drivers/media/test-drivers/vivid/vivid-kthread-touch.c -@@ -135,9 +135,14 @@ static int vivid_thread_touch_cap(void *data) - next_jiffies_since_start = jiffies_since_start; - - wait_jiffies = next_jiffies_since_start - jiffies_since_start; -- while (time_is_after_jiffies(cur_jiffies + wait_jiffies) && -- !kthread_should_stop()) -- schedule(); -+ if (!time_is_after_jiffies(cur_jiffies + wait_jiffies)) -+ continue; -+ -+ wait_queue_head_t wait; -+ -+ init_waitqueue_head(&wait); -+ wait_event_interruptible_timeout(wait, kthread_should_stop(), -+ cur_jiffies + wait_jiffies - jiffies); - } - dprintk(dev, 1, "Touch Capture Thread End\n"); - return 0; -diff --git a/drivers/media/test-drivers/vivid/vivid-sdr-cap.c b/drivers/media/test-drivers/vivid/vivid-sdr-cap.c -index a81f26b769883f..1dd59c710dae74 100644 ---- a/drivers/media/test-drivers/vivid/vivid-sdr-cap.c -+++ b/drivers/media/test-drivers/vivid/vivid-sdr-cap.c -@@ -206,9 +206,14 @@ static int vivid_thread_sdr_cap(void *data) - next_jiffies_since_start = jiffies_since_start; - - wait_jiffies = next_jiffies_since_start - jiffies_since_start; -- while (time_is_after_jiffies(cur_jiffies + wait_jiffies) && -- !kthread_should_stop()) -- schedule(); -+ if (!time_is_after_jiffies(cur_jiffies + wait_jiffies)) -+ continue; -+ -+ wait_queue_head_t wait; -+ -+ init_waitqueue_head(&wait); -+ wait_event_interruptible_timeout(wait, kthread_should_stop(), -+ cur_jiffies + wait_jiffies - jiffies); - } - dprintk(dev, 1, "SDR Capture Thread End\n"); - return 0; -diff --git a/drivers/media/usb/cx231xx/cx231xx-417.c b/drivers/media/usb/cx231xx/cx231xx-417.c -index c5e21785fafe28..02343e88cc618c 100644 ---- a/drivers/media/usb/cx231xx/cx231xx-417.c -+++ b/drivers/media/usb/cx231xx/cx231xx-417.c -@@ -1722,6 +1722,8 @@ static void cx231xx_video_dev_init( - vfd->lock = &dev->lock; - vfd->release = video_device_release_empty; - vfd->ctrl_handler = &dev->mpeg_ctrl_handler.hdl; -+ vfd->device_caps = V4L2_CAP_READWRITE | V4L2_CAP_STREAMING | -+ V4L2_CAP_VIDEO_CAPTURE; - video_set_drvdata(vfd, dev); - if (dev->tuner_type == TUNER_ABSENT) { - v4l2_disable_ioctl(vfd, VIDIOC_G_FREQUENCY); -diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c -index 028c4a5049af97..5926a9dfb0b1f8 100644 ---- a/drivers/media/usb/uvc/uvc_ctrl.c -+++ b/drivers/media/usb/uvc/uvc_ctrl.c -@@ -815,6 +815,25 @@ static inline void uvc_clear_bit(u8 *data, int bit) - data[bit >> 3] &= ~(1 << (bit & 7)); - } - -+static s32 uvc_menu_to_v4l2_menu(struct uvc_control_mapping *mapping, s32 val) -+{ -+ unsigned int i; -+ -+ for (i = 0; BIT(i) <= mapping->menu_mask; ++i) { -+ u32 menu_value; -+ -+ if (!test_bit(i, &mapping->menu_mask)) -+ continue; -+ -+ menu_value = uvc_mapping_get_menu_value(mapping, i); -+ -+ if (menu_value == val) -+ return i; -+ } -+ -+ return val; -+} -+ - /* - * Extract the bit string specified by mapping->offset and mapping->size - * from the little-endian data stored at 'data' and return the result as -@@ -849,6 +868,16 @@ static s32 uvc_get_le_value(struct uvc_control_mapping *mapping, - if (mapping->data_type == UVC_CTRL_DATA_TYPE_SIGNED) - value |= -(value & (1 << (mapping->size - 1))); - -+ /* If it is a menu, convert from uvc to v4l2. */ -+ if (mapping->v4l2_type != V4L2_CTRL_TYPE_MENU) -+ return value; -+ -+ switch (query) { -+ case UVC_GET_CUR: -+ case UVC_GET_DEF: -+ return uvc_menu_to_v4l2_menu(mapping, value); -+ } -+ - return value; - } - -@@ -1013,32 +1042,6 @@ static int uvc_ctrl_populate_cache(struct uvc_video_chain *chain, - return 0; - } - --static s32 __uvc_ctrl_get_value(struct uvc_control_mapping *mapping, -- const u8 *data) --{ -- s32 value = mapping->get(mapping, UVC_GET_CUR, data); -- -- if (mapping->v4l2_type == V4L2_CTRL_TYPE_MENU) { -- unsigned int i; -- -- for (i = 0; BIT(i) <= mapping->menu_mask; ++i) { -- u32 menu_value; -- -- if (!test_bit(i, &mapping->menu_mask)) -- continue; -- -- menu_value = uvc_mapping_get_menu_value(mapping, i); -- -- if (menu_value == value) { -- value = i; -- break; -- } -- } -- } -- -- return value; --} -- - static int __uvc_ctrl_load_cur(struct uvc_video_chain *chain, - struct uvc_control *ctrl) - { -@@ -1089,8 +1092,8 @@ static int __uvc_ctrl_get(struct uvc_video_chain *chain, - if (ret < 0) - return ret; - -- *value = __uvc_ctrl_get_value(mapping, -- uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT)); -+ *value = mapping->get(mapping, UVC_GET_CUR, -+ uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT)); - - return 0; - } -@@ -1240,7 +1243,6 @@ static int __uvc_query_v4l2_ctrl(struct uvc_video_chain *chain, - { - struct uvc_control_mapping *master_map = NULL; - struct uvc_control *master_ctrl = NULL; -- unsigned int i; - - memset(v4l2_ctrl, 0, sizeof(*v4l2_ctrl)); - v4l2_ctrl->id = mapping->id; -@@ -1283,21 +1285,6 @@ static int __uvc_query_v4l2_ctrl(struct uvc_video_chain *chain, - v4l2_ctrl->minimum = ffs(mapping->menu_mask) - 1; - v4l2_ctrl->maximum = fls(mapping->menu_mask) - 1; - v4l2_ctrl->step = 1; -- -- for (i = 0; BIT(i) <= mapping->menu_mask; ++i) { -- u32 menu_value; -- -- if (!test_bit(i, &mapping->menu_mask)) -- continue; -- -- menu_value = uvc_mapping_get_menu_value(mapping, i); -- -- if (menu_value == v4l2_ctrl->default_value) { -- v4l2_ctrl->default_value = i; -- break; -- } -- } -- - return 0; - - case V4L2_CTRL_TYPE_BOOLEAN: -@@ -1580,7 +1567,7 @@ void uvc_ctrl_status_event(struct uvc_video_chain *chain, - uvc_ctrl_set_handle(handle, ctrl, NULL); - - list_for_each_entry(mapping, &ctrl->info.mappings, list) { -- s32 value = __uvc_ctrl_get_value(mapping, data); -+ s32 value = mapping->get(mapping, UVC_GET_CUR, data); - - /* - * handle may be NULL here if the device sends auto-update -diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c -index 7bcd706281daf3..cb7d9fb589fca9 100644 ---- a/drivers/media/usb/uvc/uvc_v4l2.c -+++ b/drivers/media/usb/uvc/uvc_v4l2.c -@@ -106,6 +106,12 @@ static int uvc_ioctl_xu_ctrl_map(struct uvc_video_chain *chain, - struct uvc_control_mapping *map; - int ret; - -+ if (xmap->data_type > UVC_CTRL_DATA_TYPE_BITMASK) { -+ uvc_dbg(chain->dev, CONTROL, -+ "Unsupported UVC data type %u\n", xmap->data_type); -+ return -EINVAL; -+ } -+ - map = kzalloc(sizeof(*map), GFP_KERNEL); - if (map == NULL) - return -ENOMEM; -diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c -index 5f115438d07228..cb3ad72a3e54a6 100644 ---- a/drivers/media/v4l2-core/v4l2-subdev.c -+++ b/drivers/media/v4l2-core/v4l2-subdev.c -@@ -351,6 +351,8 @@ static int call_enum_dv_timings(struct v4l2_subdev *sd, - static int call_get_mbus_config(struct v4l2_subdev *sd, unsigned int pad, - struct v4l2_mbus_config *config) - { -+ memset(config, 0, sizeof(*config)); -+ - return check_pad(sd, pad) ? : - sd->ops->pad->get_mbus_config(sd, pad, config); - } -diff --git a/drivers/mfd/tps65219.c b/drivers/mfd/tps65219.c -index 0e0c42e4fdfc75..72a5f51fe32a52 100644 ---- a/drivers/mfd/tps65219.c -+++ b/drivers/mfd/tps65219.c -@@ -228,7 +228,6 @@ static struct regmap_irq_chip tps65219_irq_chip = { - static int tps65219_probe(struct i2c_client *client) - { - struct tps65219 *tps; -- unsigned int chipid; - bool pwr_button; - int ret; - -@@ -253,12 +252,6 @@ static int tps65219_probe(struct i2c_client *client) - if (ret) - return ret; - -- ret = regmap_read(tps->regmap, TPS65219_REG_TI_DEV_ID, &chipid); -- if (ret) { -- dev_err(tps->dev, "Failed to read device ID: %d\n", ret); -- return ret; -- } -- - ret = devm_mfd_add_devices(tps->dev, PLATFORM_DEVID_AUTO, - tps65219_cells, ARRAY_SIZE(tps65219_cells), - NULL, 0, regmap_irq_get_domain(tps->irq_data)); -diff --git a/drivers/mmc/host/dw_mmc-exynos.c b/drivers/mmc/host/dw_mmc-exynos.c -index 698408e8bad035..381a61adf06eee 100644 ---- a/drivers/mmc/host/dw_mmc-exynos.c -+++ b/drivers/mmc/host/dw_mmc-exynos.c -@@ -28,6 +28,8 @@ enum dw_mci_exynos_type { - DW_MCI_TYPE_EXYNOS5420_SMU, - DW_MCI_TYPE_EXYNOS7, - DW_MCI_TYPE_EXYNOS7_SMU, -+ DW_MCI_TYPE_EXYNOS7870, -+ DW_MCI_TYPE_EXYNOS7870_SMU, - DW_MCI_TYPE_ARTPEC8, - }; - -@@ -70,6 +72,12 @@ static struct dw_mci_exynos_compatible { - }, { - .compatible = "samsung,exynos7-dw-mshc-smu", - .ctrl_type = DW_MCI_TYPE_EXYNOS7_SMU, -+ }, { -+ .compatible = "samsung,exynos7870-dw-mshc", -+ .ctrl_type = DW_MCI_TYPE_EXYNOS7870, -+ }, { -+ .compatible = "samsung,exynos7870-dw-mshc-smu", -+ .ctrl_type = DW_MCI_TYPE_EXYNOS7870_SMU, - }, { - .compatible = "axis,artpec8-dw-mshc", - .ctrl_type = DW_MCI_TYPE_ARTPEC8, -@@ -86,6 +94,8 @@ static inline u8 dw_mci_exynos_get_ciu_div(struct dw_mci *host) - return EXYNOS4210_FIXED_CIU_CLK_DIV; - else if (priv->ctrl_type == DW_MCI_TYPE_EXYNOS7 || - priv->ctrl_type == DW_MCI_TYPE_EXYNOS7_SMU || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870 || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870_SMU || - priv->ctrl_type == DW_MCI_TYPE_ARTPEC8) - return SDMMC_CLKSEL_GET_DIV(mci_readl(host, CLKSEL64)) + 1; - else -@@ -101,7 +111,8 @@ static void dw_mci_exynos_config_smu(struct dw_mci *host) - * set for non-ecryption mode at this time. - */ - if (priv->ctrl_type == DW_MCI_TYPE_EXYNOS5420_SMU || -- priv->ctrl_type == DW_MCI_TYPE_EXYNOS7_SMU) { -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7_SMU || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870_SMU) { - mci_writel(host, MPSBEGIN0, 0); - mci_writel(host, MPSEND0, SDMMC_ENDING_SEC_NR_MAX); - mci_writel(host, MPSCTRL0, SDMMC_MPSCTRL_SECURE_WRITE_BIT | -@@ -127,6 +138,12 @@ static int dw_mci_exynos_priv_init(struct dw_mci *host) - DQS_CTRL_GET_RD_DELAY(priv->saved_strobe_ctrl); - } - -+ if (priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870 || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870_SMU) { -+ /* Quirk needed for certain Exynos SoCs */ -+ host->quirks |= DW_MMC_QUIRK_FIFO64_32; -+ } -+ - if (priv->ctrl_type == DW_MCI_TYPE_ARTPEC8) { - /* Quirk needed for the ARTPEC-8 SoC */ - host->quirks |= DW_MMC_QUIRK_EXTENDED_TMOUT; -@@ -144,6 +161,8 @@ static void dw_mci_exynos_set_clksel_timing(struct dw_mci *host, u32 timing) - - if (priv->ctrl_type == DW_MCI_TYPE_EXYNOS7 || - priv->ctrl_type == DW_MCI_TYPE_EXYNOS7_SMU || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870 || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870_SMU || - priv->ctrl_type == DW_MCI_TYPE_ARTPEC8) - clksel = mci_readl(host, CLKSEL64); - else -@@ -153,6 +172,8 @@ static void dw_mci_exynos_set_clksel_timing(struct dw_mci *host, u32 timing) - - if (priv->ctrl_type == DW_MCI_TYPE_EXYNOS7 || - priv->ctrl_type == DW_MCI_TYPE_EXYNOS7_SMU || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870 || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870_SMU || - priv->ctrl_type == DW_MCI_TYPE_ARTPEC8) - mci_writel(host, CLKSEL64, clksel); - else -@@ -223,6 +244,8 @@ static int dw_mci_exynos_resume_noirq(struct device *dev) - - if (priv->ctrl_type == DW_MCI_TYPE_EXYNOS7 || - priv->ctrl_type == DW_MCI_TYPE_EXYNOS7_SMU || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870 || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870_SMU || - priv->ctrl_type == DW_MCI_TYPE_ARTPEC8) - clksel = mci_readl(host, CLKSEL64); - else -@@ -231,6 +254,8 @@ static int dw_mci_exynos_resume_noirq(struct device *dev) - if (clksel & SDMMC_CLKSEL_WAKEUP_INT) { - if (priv->ctrl_type == DW_MCI_TYPE_EXYNOS7 || - priv->ctrl_type == DW_MCI_TYPE_EXYNOS7_SMU || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870 || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870_SMU || - priv->ctrl_type == DW_MCI_TYPE_ARTPEC8) - mci_writel(host, CLKSEL64, clksel); - else -@@ -410,6 +435,8 @@ static inline u8 dw_mci_exynos_get_clksmpl(struct dw_mci *host) - - if (priv->ctrl_type == DW_MCI_TYPE_EXYNOS7 || - priv->ctrl_type == DW_MCI_TYPE_EXYNOS7_SMU || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870 || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870_SMU || - priv->ctrl_type == DW_MCI_TYPE_ARTPEC8) - return SDMMC_CLKSEL_CCLK_SAMPLE(mci_readl(host, CLKSEL64)); - else -@@ -423,6 +450,8 @@ static inline void dw_mci_exynos_set_clksmpl(struct dw_mci *host, u8 sample) - - if (priv->ctrl_type == DW_MCI_TYPE_EXYNOS7 || - priv->ctrl_type == DW_MCI_TYPE_EXYNOS7_SMU || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870 || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870_SMU || - priv->ctrl_type == DW_MCI_TYPE_ARTPEC8) - clksel = mci_readl(host, CLKSEL64); - else -@@ -430,6 +459,8 @@ static inline void dw_mci_exynos_set_clksmpl(struct dw_mci *host, u8 sample) - clksel = SDMMC_CLKSEL_UP_SAMPLE(clksel, sample); - if (priv->ctrl_type == DW_MCI_TYPE_EXYNOS7 || - priv->ctrl_type == DW_MCI_TYPE_EXYNOS7_SMU || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870 || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870_SMU || - priv->ctrl_type == DW_MCI_TYPE_ARTPEC8) - mci_writel(host, CLKSEL64, clksel); - else -@@ -444,6 +475,8 @@ static inline u8 dw_mci_exynos_move_next_clksmpl(struct dw_mci *host) - - if (priv->ctrl_type == DW_MCI_TYPE_EXYNOS7 || - priv->ctrl_type == DW_MCI_TYPE_EXYNOS7_SMU || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870 || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870_SMU || - priv->ctrl_type == DW_MCI_TYPE_ARTPEC8) - clksel = mci_readl(host, CLKSEL64); - else -@@ -454,6 +487,8 @@ static inline u8 dw_mci_exynos_move_next_clksmpl(struct dw_mci *host) - - if (priv->ctrl_type == DW_MCI_TYPE_EXYNOS7 || - priv->ctrl_type == DW_MCI_TYPE_EXYNOS7_SMU || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870 || -+ priv->ctrl_type == DW_MCI_TYPE_EXYNOS7870_SMU || - priv->ctrl_type == DW_MCI_TYPE_ARTPEC8) - mci_writel(host, CLKSEL64, clksel); - else -@@ -633,6 +668,10 @@ static const struct of_device_id dw_mci_exynos_match[] = { - .data = &exynos_drv_data, }, - { .compatible = "samsung,exynos7-dw-mshc-smu", - .data = &exynos_drv_data, }, -+ { .compatible = "samsung,exynos7870-dw-mshc", -+ .data = &exynos_drv_data, }, -+ { .compatible = "samsung,exynos7870-dw-mshc-smu", -+ .data = &exynos_drv_data, }, - { .compatible = "axis,artpec8-dw-mshc", - .data = &artpec_drv_data, }, - {}, -diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c -index 6b351810a301c9..dbfe0a5324eaf0 100644 ---- a/drivers/mmc/host/sdhci-pci-core.c -+++ b/drivers/mmc/host/sdhci-pci-core.c -@@ -608,8 +608,12 @@ static void sdhci_intel_set_power(struct sdhci_host *host, unsigned char mode, - - sdhci_set_power(host, mode, vdd); - -- if (mode == MMC_POWER_OFF) -+ if (mode == MMC_POWER_OFF) { -+ if (slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_APL_SD || -+ slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_BYT_SD) -+ usleep_range(15000, 17500); - return; -+ } - - /* - * Bus power might not enable after D3 -> D0 transition due to the -diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c -index 9796a3cb3ca62c..f32429ff905ff6 100644 ---- a/drivers/mmc/host/sdhci.c -+++ b/drivers/mmc/host/sdhci.c -@@ -2035,10 +2035,15 @@ void sdhci_set_clock(struct sdhci_host *host, unsigned int clock) - - host->mmc->actual_clock = 0; - -- sdhci_writew(host, 0, SDHCI_CLOCK_CONTROL); -+ clk = sdhci_readw(host, SDHCI_CLOCK_CONTROL); -+ if (clk & SDHCI_CLOCK_CARD_EN) -+ sdhci_writew(host, clk & ~SDHCI_CLOCK_CARD_EN, -+ SDHCI_CLOCK_CONTROL); - -- if (clock == 0) -+ if (clock == 0) { -+ sdhci_writew(host, 0, SDHCI_CLOCK_CONTROL); - return; -+ } - - clk = sdhci_calc_clk(host, clock, &host->mmc->actual_clock); - sdhci_enable_clk(host, clk); -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 7eb62fe55947fe..56c241246d1af4 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -2469,7 +2469,7 @@ static int __bond_release_one(struct net_device *bond_dev, - - RCU_INIT_POINTER(bond->current_arp_slave, NULL); - -- if (!all && (!bond->params.fail_over_mac || -+ if (!all && (bond->params.fail_over_mac != BOND_FOM_ACTIVE || - BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP)) { - if (ether_addr_equal_64bits(bond_dev->dev_addr, slave->perm_hwaddr) && - bond_has_slaves(bond)) -diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c -index 7f405bcf11c23e..603680792f1ff6 100644 ---- a/drivers/net/can/c_can/c_can_platform.c -+++ b/drivers/net/can/c_can/c_can_platform.c -@@ -333,7 +333,7 @@ static int c_can_plat_probe(struct platform_device *pdev) - /* Check if we need custom RAMINIT via syscon. Mostly for TI - * platforms. Only supported with DT boot. - */ -- if (np && of_property_read_bool(np, "syscon-raminit")) { -+ if (np && of_property_present(np, "syscon-raminit")) { - u32 id; - struct c_can_raminit *raminit = &priv->raminit_sys; - -diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c -index c490b4ba065ba4..73b448cd00f29f 100644 ---- a/drivers/net/can/kvaser_pciefd.c -+++ b/drivers/net/can/kvaser_pciefd.c -@@ -1137,7 +1137,7 @@ static int kvaser_pciefd_handle_data_packet(struct kvaser_pciefd *pcie, - skb = alloc_canfd_skb(priv->dev, &cf); - if (!skb) { - priv->dev->stats.rx_dropped++; -- return -ENOMEM; -+ return 0; - } - - cf->len = can_fd_dlc2len(dlc); -@@ -1149,7 +1149,7 @@ static int kvaser_pciefd_handle_data_packet(struct kvaser_pciefd *pcie, - skb = alloc_can_skb(priv->dev, (struct can_frame **)&cf); - if (!skb) { - priv->dev->stats.rx_dropped++; -- return -ENOMEM; -+ return 0; - } - can_frame_set_cc_len((struct can_frame *)cf, dlc, priv->ctrlmode); - } -@@ -1167,7 +1167,9 @@ static int kvaser_pciefd_handle_data_packet(struct kvaser_pciefd *pcie, - priv->dev->stats.rx_packets++; - kvaser_pciefd_set_skb_timestamp(pcie, skb, p->timestamp); - -- return netif_rx(skb); -+ netif_rx(skb); -+ -+ return 0; - } - - static void kvaser_pciefd_change_state(struct kvaser_pciefd_can *can, -@@ -1580,24 +1582,28 @@ static int kvaser_pciefd_read_buffer(struct kvaser_pciefd *pcie, int dma_buf) - return res; - } - --static u32 kvaser_pciefd_receive_irq(struct kvaser_pciefd *pcie) -+static void kvaser_pciefd_receive_irq(struct kvaser_pciefd *pcie) - { -+ void __iomem *srb_cmd_reg = KVASER_PCIEFD_SRB_ADDR(pcie) + KVASER_PCIEFD_SRB_CMD_REG; - u32 irq = ioread32(KVASER_PCIEFD_SRB_ADDR(pcie) + KVASER_PCIEFD_SRB_IRQ_REG); - -- if (irq & KVASER_PCIEFD_SRB_IRQ_DPD0) -+ iowrite32(irq, KVASER_PCIEFD_SRB_ADDR(pcie) + KVASER_PCIEFD_SRB_IRQ_REG); -+ -+ if (irq & KVASER_PCIEFD_SRB_IRQ_DPD0) { - kvaser_pciefd_read_buffer(pcie, 0); -+ iowrite32(KVASER_PCIEFD_SRB_CMD_RDB0, srb_cmd_reg); /* Rearm buffer */ -+ } - -- if (irq & KVASER_PCIEFD_SRB_IRQ_DPD1) -+ if (irq & KVASER_PCIEFD_SRB_IRQ_DPD1) { - kvaser_pciefd_read_buffer(pcie, 1); -+ iowrite32(KVASER_PCIEFD_SRB_CMD_RDB1, srb_cmd_reg); /* Rearm buffer */ -+ } - - if (irq & KVASER_PCIEFD_SRB_IRQ_DOF0 || - irq & KVASER_PCIEFD_SRB_IRQ_DOF1 || - irq & KVASER_PCIEFD_SRB_IRQ_DUF0 || - irq & KVASER_PCIEFD_SRB_IRQ_DUF1) - dev_err(&pcie->pci->dev, "DMA IRQ error 0x%08X\n", irq); -- -- iowrite32(irq, KVASER_PCIEFD_SRB_ADDR(pcie) + KVASER_PCIEFD_SRB_IRQ_REG); -- return irq; - } - - static void kvaser_pciefd_transmit_irq(struct kvaser_pciefd_can *can) -@@ -1625,29 +1631,22 @@ static irqreturn_t kvaser_pciefd_irq_handler(int irq, void *dev) - struct kvaser_pciefd *pcie = (struct kvaser_pciefd *)dev; - const struct kvaser_pciefd_irq_mask *irq_mask = pcie->driver_data->irq_mask; - u32 pci_irq = ioread32(KVASER_PCIEFD_PCI_IRQ_ADDR(pcie)); -- u32 srb_irq = 0; -- u32 srb_release = 0; - int i; - - if (!(pci_irq & irq_mask->all)) - return IRQ_NONE; - -+ iowrite32(0, KVASER_PCIEFD_PCI_IEN_ADDR(pcie)); -+ - if (pci_irq & irq_mask->kcan_rx0) -- srb_irq = kvaser_pciefd_receive_irq(pcie); -+ kvaser_pciefd_receive_irq(pcie); - - for (i = 0; i < pcie->nr_channels; i++) { - if (pci_irq & irq_mask->kcan_tx[i]) - kvaser_pciefd_transmit_irq(pcie->can[i]); - } - -- if (srb_irq & KVASER_PCIEFD_SRB_IRQ_DPD0) -- srb_release |= KVASER_PCIEFD_SRB_CMD_RDB0; -- -- if (srb_irq & KVASER_PCIEFD_SRB_IRQ_DPD1) -- srb_release |= KVASER_PCIEFD_SRB_CMD_RDB1; -- -- if (srb_release) -- iowrite32(srb_release, KVASER_PCIEFD_SRB_ADDR(pcie) + KVASER_PCIEFD_SRB_CMD_REG); -+ iowrite32(irq_mask->all, KVASER_PCIEFD_PCI_IEN_ADDR(pcie)); - - return IRQ_HANDLED; - } -@@ -1667,13 +1666,22 @@ static void kvaser_pciefd_teardown_can_ctrls(struct kvaser_pciefd *pcie) - } - } - -+static void kvaser_pciefd_disable_irq_srcs(struct kvaser_pciefd *pcie) -+{ -+ unsigned int i; -+ -+ /* Masking PCI_IRQ is insufficient as running ISR will unmask it */ -+ iowrite32(0, KVASER_PCIEFD_SRB_ADDR(pcie) + KVASER_PCIEFD_SRB_IEN_REG); -+ for (i = 0; i < pcie->nr_channels; ++i) -+ iowrite32(0, pcie->can[i]->reg_base + KVASER_PCIEFD_KCAN_IEN_REG); -+} -+ - static int kvaser_pciefd_probe(struct pci_dev *pdev, - const struct pci_device_id *id) - { - int err; - struct kvaser_pciefd *pcie; - const struct kvaser_pciefd_irq_mask *irq_mask; -- void __iomem *irq_en_base; - - pcie = devm_kzalloc(&pdev->dev, sizeof(*pcie), GFP_KERNEL); - if (!pcie) -@@ -1726,8 +1734,7 @@ static int kvaser_pciefd_probe(struct pci_dev *pdev, - KVASER_PCIEFD_SRB_ADDR(pcie) + KVASER_PCIEFD_SRB_IEN_REG); - - /* Enable PCI interrupts */ -- irq_en_base = KVASER_PCIEFD_PCI_IEN_ADDR(pcie); -- iowrite32(irq_mask->all, irq_en_base); -+ iowrite32(irq_mask->all, KVASER_PCIEFD_PCI_IEN_ADDR(pcie)); - /* Ready the DMA buffers */ - iowrite32(KVASER_PCIEFD_SRB_CMD_RDB0, - KVASER_PCIEFD_SRB_ADDR(pcie) + KVASER_PCIEFD_SRB_CMD_REG); -@@ -1741,8 +1748,7 @@ static int kvaser_pciefd_probe(struct pci_dev *pdev, - return 0; - - err_free_irq: -- /* Disable PCI interrupts */ -- iowrite32(0, irq_en_base); -+ kvaser_pciefd_disable_irq_srcs(pcie); - free_irq(pcie->pci->irq, pcie); - - err_teardown_can_ctrls: -@@ -1762,35 +1768,25 @@ static int kvaser_pciefd_probe(struct pci_dev *pdev, - return err; - } - --static void kvaser_pciefd_remove_all_ctrls(struct kvaser_pciefd *pcie) --{ -- int i; -- -- for (i = 0; i < pcie->nr_channels; i++) { -- struct kvaser_pciefd_can *can = pcie->can[i]; -- -- if (can) { -- iowrite32(0, can->reg_base + KVASER_PCIEFD_KCAN_IEN_REG); -- unregister_candev(can->can.dev); -- del_timer(&can->bec_poll_timer); -- kvaser_pciefd_pwm_stop(can); -- free_candev(can->can.dev); -- } -- } --} -- - static void kvaser_pciefd_remove(struct pci_dev *pdev) - { - struct kvaser_pciefd *pcie = pci_get_drvdata(pdev); -+ unsigned int i; - -- kvaser_pciefd_remove_all_ctrls(pcie); -+ for (i = 0; i < pcie->nr_channels; ++i) { -+ struct kvaser_pciefd_can *can = pcie->can[i]; - -- /* Disable interrupts */ -- iowrite32(0, KVASER_PCIEFD_SRB_ADDR(pcie) + KVASER_PCIEFD_SRB_CTRL_REG); -- iowrite32(0, KVASER_PCIEFD_PCI_IEN_ADDR(pcie)); -+ unregister_candev(can->can.dev); -+ del_timer(&can->bec_poll_timer); -+ kvaser_pciefd_pwm_stop(can); -+ } - -+ kvaser_pciefd_disable_irq_srcs(pcie); - free_irq(pcie->pci->irq, pcie); - -+ for (i = 0; i < pcie->nr_channels; ++i) -+ free_candev(pcie->can[i]->can.dev); -+ - pci_iounmap(pdev, pcie->reg_base); - pci_release_regions(pdev); - pci_disable_device(pdev); -diff --git a/drivers/net/can/slcan/slcan-core.c b/drivers/net/can/slcan/slcan-core.c -index 24c6622d36bd85..58ff2ec1d9757e 100644 ---- a/drivers/net/can/slcan/slcan-core.c -+++ b/drivers/net/can/slcan/slcan-core.c -@@ -71,12 +71,21 @@ MODULE_AUTHOR("Dario Binacchi "); - #define SLCAN_CMD_LEN 1 - #define SLCAN_SFF_ID_LEN 3 - #define SLCAN_EFF_ID_LEN 8 -+#define SLCAN_DATA_LENGTH_LEN 1 -+#define SLCAN_ERROR_LEN 1 - #define SLCAN_STATE_LEN 1 - #define SLCAN_STATE_BE_RXCNT_LEN 3 - #define SLCAN_STATE_BE_TXCNT_LEN 3 --#define SLCAN_STATE_FRAME_LEN (1 + SLCAN_CMD_LEN + \ -- SLCAN_STATE_BE_RXCNT_LEN + \ -- SLCAN_STATE_BE_TXCNT_LEN) -+#define SLCAN_STATE_MSG_LEN (SLCAN_CMD_LEN + \ -+ SLCAN_STATE_LEN + \ -+ SLCAN_STATE_BE_RXCNT_LEN + \ -+ SLCAN_STATE_BE_TXCNT_LEN) -+#define SLCAN_ERROR_MSG_LEN_MIN (SLCAN_CMD_LEN + \ -+ SLCAN_ERROR_LEN + \ -+ SLCAN_DATA_LENGTH_LEN) -+#define SLCAN_FRAME_MSG_LEN_MIN (SLCAN_CMD_LEN + \ -+ SLCAN_SFF_ID_LEN + \ -+ SLCAN_DATA_LENGTH_LEN) - struct slcan { - struct can_priv can; - -@@ -176,6 +185,9 @@ static void slcan_bump_frame(struct slcan *sl) - u32 tmpid; - char *cmd = sl->rbuff; - -+ if (sl->rcount < SLCAN_FRAME_MSG_LEN_MIN) -+ return; -+ - skb = alloc_can_skb(sl->dev, &cf); - if (unlikely(!skb)) { - sl->dev->stats.rx_dropped++; -@@ -281,7 +293,7 @@ static void slcan_bump_state(struct slcan *sl) - return; - } - -- if (state == sl->can.state || sl->rcount < SLCAN_STATE_FRAME_LEN) -+ if (state == sl->can.state || sl->rcount != SLCAN_STATE_MSG_LEN) - return; - - cmd += SLCAN_STATE_BE_RXCNT_LEN + SLCAN_CMD_LEN + 1; -@@ -328,6 +340,9 @@ static void slcan_bump_err(struct slcan *sl) - bool rx_errors = false, tx_errors = false, rx_over_errors = false; - int i, len; - -+ if (sl->rcount < SLCAN_ERROR_MSG_LEN_MIN) -+ return; -+ - /* get len from sanitized ASCII value */ - len = cmd[1]; - if (len >= '0' && len < '9') -@@ -456,8 +471,7 @@ static void slcan_bump(struct slcan *sl) - static void slcan_unesc(struct slcan *sl, unsigned char s) - { - if ((s == '\r') || (s == '\a')) { /* CR or BEL ends the pdu */ -- if (!test_and_clear_bit(SLF_ERROR, &sl->flags) && -- sl->rcount > 4) -+ if (!test_and_clear_bit(SLF_ERROR, &sl->flags)) - slcan_bump(sl); - - sl->rcount = 0; -diff --git a/drivers/net/ethernet/amd/pds_core/core.c b/drivers/net/ethernet/amd/pds_core/core.c -index b3fa867c8ccd91..c2ef55cff6b3ec 100644 ---- a/drivers/net/ethernet/amd/pds_core/core.c -+++ b/drivers/net/ethernet/amd/pds_core/core.c -@@ -413,10 +413,7 @@ int pdsc_setup(struct pdsc *pdsc, bool init) - if (err) - return err; - -- /* Scale the descriptor ring length based on number of CPUs and VFs */ -- numdescs = max_t(int, PDSC_ADMINQ_MIN_LENGTH, num_online_cpus()); -- numdescs += 2 * pci_sriov_get_totalvfs(pdsc->pdev); -- numdescs = roundup_pow_of_two(numdescs); -+ numdescs = PDSC_ADMINQ_MAX_LENGTH; - err = pdsc_qcq_alloc(pdsc, PDS_CORE_QTYPE_ADMINQ, 0, "adminq", - PDS_CORE_QCQ_F_CORE | PDS_CORE_QCQ_F_INTR, - numdescs, -diff --git a/drivers/net/ethernet/amd/pds_core/core.h b/drivers/net/ethernet/amd/pds_core/core.h -index 61ee607ee48ace..42137140850314 100644 ---- a/drivers/net/ethernet/amd/pds_core/core.h -+++ b/drivers/net/ethernet/amd/pds_core/core.h -@@ -16,7 +16,7 @@ - - #define PDSC_WATCHDOG_SECS 5 - #define PDSC_QUEUE_NAME_MAX_SZ 16 --#define PDSC_ADMINQ_MIN_LENGTH 16 /* must be a power of two */ -+#define PDSC_ADMINQ_MAX_LENGTH 16 /* must be a power of two */ - #define PDSC_NOTIFYQ_LENGTH 64 /* must be a power of two */ - #define PDSC_TEARDOWN_RECOVERY false - #define PDSC_TEARDOWN_REMOVING true -diff --git a/drivers/net/ethernet/apm/xgene-v2/main.c b/drivers/net/ethernet/apm/xgene-v2/main.c -index 379d19d18dbed0..5808e3c73a8f43 100644 ---- a/drivers/net/ethernet/apm/xgene-v2/main.c -+++ b/drivers/net/ethernet/apm/xgene-v2/main.c -@@ -9,8 +9,6 @@ - - #include "main.h" - --static const struct acpi_device_id xge_acpi_match[]; -- - static int xge_get_resources(struct xge_pdata *pdata) - { - struct platform_device *pdev; -@@ -733,7 +731,7 @@ MODULE_DEVICE_TABLE(acpi, xge_acpi_match); - static struct platform_driver xge_driver = { - .driver = { - .name = "xgene-enet-v2", -- .acpi_match_table = ACPI_PTR(xge_acpi_match), -+ .acpi_match_table = xge_acpi_match, - }, - .probe = xge_probe, - .remove = xge_remove, -diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c -index 8feb7d4226bb58..0c09d82dbf00d4 100644 ---- a/drivers/net/ethernet/freescale/enetc/enetc.c -+++ b/drivers/net/ethernet/freescale/enetc/enetc.c -@@ -1572,6 +1572,16 @@ static void enetc_xdp_drop(struct enetc_bdr *rx_ring, int rx_ring_first, - } - } - -+static void enetc_bulk_flip_buff(struct enetc_bdr *rx_ring, int rx_ring_first, -+ int rx_ring_last) -+{ -+ while (rx_ring_first != rx_ring_last) { -+ enetc_flip_rx_buff(rx_ring, -+ &rx_ring->rx_swbd[rx_ring_first]); -+ enetc_bdr_idx_inc(rx_ring, &rx_ring_first); -+ } -+} -+ - static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring, - struct napi_struct *napi, int work_limit, - struct bpf_prog *prog) -@@ -1687,11 +1697,7 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring, - enetc_xdp_drop(rx_ring, orig_i, i); - rx_ring->stats.xdp_redirect_failures++; - } else { -- while (orig_i != i) { -- enetc_flip_rx_buff(rx_ring, -- &rx_ring->rx_swbd[orig_i]); -- enetc_bdr_idx_inc(rx_ring, &orig_i); -- } -+ enetc_bulk_flip_buff(rx_ring, orig_i, i); - xdp_redirect_frm_cnt++; - rx_ring->stats.xdp_redirect++; - } -diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c -index 7261838a09db63..291c88a76a27f4 100644 ---- a/drivers/net/ethernet/freescale/fec_main.c -+++ b/drivers/net/ethernet/freescale/fec_main.c -@@ -1079,6 +1079,29 @@ static void fec_enet_enable_ring(struct net_device *ndev) - } - } - -+/* Whack a reset. We should wait for this. -+ * For i.MX6SX SOC, enet use AXI bus, we use disable MAC -+ * instead of reset MAC itself. -+ */ -+static void fec_ctrl_reset(struct fec_enet_private *fep, bool allow_wol) -+{ -+ u32 val; -+ -+ if (!allow_wol || !(fep->wol_flag & FEC_WOL_FLAG_SLEEP_ON)) { -+ if (fep->quirks & FEC_QUIRK_HAS_MULTI_QUEUES || -+ ((fep->quirks & FEC_QUIRK_NO_HARD_RESET) && fep->link)) { -+ writel(0, fep->hwp + FEC_ECNTRL); -+ } else { -+ writel(FEC_ECR_RESET, fep->hwp + FEC_ECNTRL); -+ udelay(10); -+ } -+ } else { -+ val = readl(fep->hwp + FEC_ECNTRL); -+ val |= (FEC_ECR_MAGICEN | FEC_ECR_SLEEP); -+ writel(val, fep->hwp + FEC_ECNTRL); -+ } -+} -+ - /* - * This function is called to start or restart the FEC during a link - * change, transmit timeout, or to reconfigure the FEC. The network -@@ -1095,17 +1118,7 @@ fec_restart(struct net_device *ndev) - if (fep->bufdesc_ex) - fec_ptp_save_state(fep); - -- /* Whack a reset. We should wait for this. -- * For i.MX6SX SOC, enet use AXI bus, we use disable MAC -- * instead of reset MAC itself. -- */ -- if (fep->quirks & FEC_QUIRK_HAS_MULTI_QUEUES || -- ((fep->quirks & FEC_QUIRK_NO_HARD_RESET) && fep->link)) { -- writel(0, fep->hwp + FEC_ECNTRL); -- } else { -- writel(1, fep->hwp + FEC_ECNTRL); -- udelay(10); -- } -+ fec_ctrl_reset(fep, false); - - /* - * enet-mac reset will reset mac address registers too, -@@ -1359,22 +1372,7 @@ fec_stop(struct net_device *ndev) - if (fep->bufdesc_ex) - fec_ptp_save_state(fep); - -- /* Whack a reset. We should wait for this. -- * For i.MX6SX SOC, enet use AXI bus, we use disable MAC -- * instead of reset MAC itself. -- */ -- if (!(fep->wol_flag & FEC_WOL_FLAG_SLEEP_ON)) { -- if (fep->quirks & FEC_QUIRK_HAS_MULTI_QUEUES) { -- writel(0, fep->hwp + FEC_ECNTRL); -- } else { -- writel(FEC_ECR_RESET, fep->hwp + FEC_ECNTRL); -- udelay(10); -- } -- } else { -- val = readl(fep->hwp + FEC_ECNTRL); -- val |= (FEC_ECR_MAGICEN | FEC_ECR_SLEEP); -- writel(val, fep->hwp + FEC_ECNTRL); -- } -+ fec_ctrl_reset(fep, true); - writel(fep->phy_speed, fep->hwp + FEC_MII_SPEED); - writel(FEC_DEFAULT_IMASK, fep->hwp + FEC_IMASK); - -diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c -index 39b5f24be7e4fc..dd58b2372dc0c7 100644 ---- a/drivers/net/ethernet/intel/ice/ice_ethtool.c -+++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c -@@ -3329,8 +3329,7 @@ static u32 ice_get_combined_cnt(struct ice_vsi *vsi) - ice_for_each_q_vector(vsi, q_idx) { - struct ice_q_vector *q_vector = vsi->q_vectors[q_idx]; - -- if (q_vector->rx.rx_ring && q_vector->tx.tx_ring) -- combined++; -+ combined += min(q_vector->num_ring_tx, q_vector->num_ring_rx); - } - - return combined; -diff --git a/drivers/net/ethernet/intel/ice/ice_irq.c b/drivers/net/ethernet/intel/ice/ice_irq.c -index ad82ff7d199570..09f9c7ba52795b 100644 ---- a/drivers/net/ethernet/intel/ice/ice_irq.c -+++ b/drivers/net/ethernet/intel/ice/ice_irq.c -@@ -45,7 +45,7 @@ static void ice_free_irq_res(struct ice_pf *pf, u16 index) - /** - * ice_get_irq_res - get an interrupt resource - * @pf: board private structure -- * @dyn_only: force entry to be dynamically allocated -+ * @dyn_allowed: allow entry to be dynamically allocated - * - * Allocate new irq entry in the free slot of the tracker. Since xarray - * is used, always allocate new entry at the lowest possible index. Set -@@ -53,11 +53,12 @@ static void ice_free_irq_res(struct ice_pf *pf, u16 index) - * - * Returns allocated irq entry or NULL on failure. - */ --static struct ice_irq_entry *ice_get_irq_res(struct ice_pf *pf, bool dyn_only) -+static struct ice_irq_entry *ice_get_irq_res(struct ice_pf *pf, -+ bool dyn_allowed) - { -- struct xa_limit limit = { .max = pf->irq_tracker.num_entries, -+ struct xa_limit limit = { .max = pf->irq_tracker.num_entries - 1, - .min = 0 }; -- unsigned int num_static = pf->irq_tracker.num_static; -+ unsigned int num_static = pf->irq_tracker.num_static - 1; - struct ice_irq_entry *entry; - unsigned int index; - int ret; -@@ -66,9 +67,9 @@ static struct ice_irq_entry *ice_get_irq_res(struct ice_pf *pf, bool dyn_only) - if (!entry) - return NULL; - -- /* skip preallocated entries if the caller says so */ -- if (dyn_only) -- limit.min = num_static; -+ /* only already allocated if the caller says so */ -+ if (!dyn_allowed) -+ limit.max = num_static; - - ret = xa_alloc(&pf->irq_tracker.entries, &index, entry, limit, - GFP_KERNEL); -@@ -78,7 +79,7 @@ static struct ice_irq_entry *ice_get_irq_res(struct ice_pf *pf, bool dyn_only) - entry = NULL; - } else { - entry->index = index; -- entry->dynamic = index >= num_static; -+ entry->dynamic = index > num_static; - } - - return entry; -@@ -272,7 +273,7 @@ int ice_init_interrupt_scheme(struct ice_pf *pf) - /** - * ice_alloc_irq - Allocate new interrupt vector - * @pf: board private structure -- * @dyn_only: force dynamic allocation of the interrupt -+ * @dyn_allowed: allow dynamic allocation of the interrupt - * - * Allocate new interrupt vector for a given owner id. - * return struct msi_map with interrupt details and track -@@ -285,20 +286,20 @@ int ice_init_interrupt_scheme(struct ice_pf *pf) - * interrupt will be allocated with pci_msix_alloc_irq_at. - * - * Some callers may only support dynamically allocated interrupts. -- * This is indicated with dyn_only flag. -+ * This is indicated with dyn_allowed flag. - * - * On failure, return map with negative .index. The caller - * is expected to check returned map index. - * - */ --struct msi_map ice_alloc_irq(struct ice_pf *pf, bool dyn_only) -+struct msi_map ice_alloc_irq(struct ice_pf *pf, bool dyn_allowed) - { - int sriov_base_vector = pf->sriov_base_vector; - struct msi_map map = { .index = -ENOENT }; - struct device *dev = ice_pf_to_dev(pf); - struct ice_irq_entry *entry; - -- entry = ice_get_irq_res(pf, dyn_only); -+ entry = ice_get_irq_res(pf, dyn_allowed); - if (!entry) - return map; - -diff --git a/drivers/net/ethernet/intel/ice/ice_lag.c b/drivers/net/ethernet/intel/ice/ice_lag.c -index 4e675c7c199fa1..4db0b770420e65 100644 ---- a/drivers/net/ethernet/intel/ice/ice_lag.c -+++ b/drivers/net/ethernet/intel/ice/ice_lag.c -@@ -1229,12 +1229,18 @@ static void ice_lag_changeupper_event(struct ice_lag *lag, void *ptr) - */ - if (!primary_lag) { - lag->primary = true; -+ if (!ice_is_switchdev_running(lag->pf)) -+ return; -+ - /* Configure primary's SWID to be shared */ - ice_lag_primary_swid(lag, true); - primary_lag = lag; - } else { - u16 swid; - -+ if (!ice_is_switchdev_running(primary_lag->pf)) -+ return; -+ - swid = primary_lag->pf->hw.port_info->sw_id; - ice_lag_set_swid(swid, lag, true); - ice_lag_add_prune_list(primary_lag, lag->pf); -diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c -index 1fc4805353eb58..a6a290514e5484 100644 ---- a/drivers/net/ethernet/intel/ice/ice_lib.c -+++ b/drivers/net/ethernet/intel/ice/ice_lib.c -@@ -587,6 +587,8 @@ ice_vsi_alloc_def(struct ice_vsi *vsi, struct ice_channel *ch) - return -ENOMEM; - } - -+ vsi->irq_dyn_alloc = pci_msix_can_alloc_dyn(vsi->back->pdev); -+ - switch (vsi->type) { - case ICE_VSI_SWITCHDEV_CTRL: - /* Setup eswitch MSIX irq handler for VSI */ -diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl.c b/drivers/net/ethernet/intel/ice/ice_virtchnl.c -index e709b10a29761b..1edcf930318315 100644 ---- a/drivers/net/ethernet/intel/ice/ice_virtchnl.c -+++ b/drivers/net/ethernet/intel/ice/ice_virtchnl.c -@@ -3769,7 +3769,6 @@ static int ice_vc_repr_add_mac(struct ice_vf *vf, u8 *msg) - } - - ice_vfhw_mac_add(vf, &al->list[i]); -- vf->num_mac++; - break; - } - -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c -index 339be6950c0395..6302990e9a5ff8 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c -@@ -66,8 +66,18 @@ static int cgx_fwi_link_change(struct cgx *cgx, int lmac_id, bool en); - /* Supported devices */ - static const struct pci_device_id cgx_id_table[] = { - { PCI_DEVICE(PCI_VENDOR_ID_CAVIUM, PCI_DEVID_OCTEONTX2_CGX) }, -- { PCI_DEVICE(PCI_VENDOR_ID_CAVIUM, PCI_DEVID_CN10K_RPM) }, -- { PCI_DEVICE(PCI_VENDOR_ID_CAVIUM, PCI_DEVID_CN10KB_RPM) }, -+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_CAVIUM, PCI_DEVID_CN10K_RPM, -+ PCI_ANY_ID, PCI_SUBSYS_DEVID_CN10K_A) }, -+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_CAVIUM, PCI_DEVID_CN10K_RPM, -+ PCI_ANY_ID, PCI_SUBSYS_DEVID_CNF10K_A) }, -+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_CAVIUM, PCI_DEVID_CN10K_RPM, -+ PCI_ANY_ID, PCI_SUBSYS_DEVID_CNF10K_B) }, -+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_CAVIUM, PCI_DEVID_CN10KB_RPM, -+ PCI_ANY_ID, PCI_SUBSYS_DEVID_CN10K_B) }, -+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_CAVIUM, PCI_DEVID_CN10KB_RPM, -+ PCI_ANY_ID, PCI_SUBSYS_DEVID_CN20KA) }, -+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_CAVIUM, PCI_DEVID_CN10KB_RPM, -+ PCI_ANY_ID, PCI_SUBSYS_DEVID_CNF20KA) }, - { 0, } /* end of table */ - }; - -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h -index a607c7294b0c59..9fbc071ef29b0c 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h -@@ -30,6 +30,8 @@ - #define PCI_SUBSYS_DEVID_CNF10K_A 0xBA00 - #define PCI_SUBSYS_DEVID_CNF10K_B 0xBC00 - #define PCI_SUBSYS_DEVID_CN10K_B 0xBD00 -+#define PCI_SUBSYS_DEVID_CN20KA 0xC220 -+#define PCI_SUBSYS_DEVID_CNF20KA 0xC320 - - /* PCI BAR nos */ - #define PCI_AF_REG_BAR_NUM 0 -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c -index 0e74c5a2231e63..1e4cd4f7d0cfd4 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c -@@ -13,19 +13,26 @@ - /* RVU LMTST */ - #define LMT_TBL_OP_READ 0 - #define LMT_TBL_OP_WRITE 1 --#define LMT_MAP_TABLE_SIZE (128 * 1024) - #define LMT_MAPTBL_ENTRY_SIZE 16 -+#define LMT_MAX_VFS 256 -+ -+#define LMT_MAP_ENTRY_ENA BIT_ULL(20) -+#define LMT_MAP_ENTRY_LINES GENMASK_ULL(18, 16) - - /* Function to perform operations (read/write) on lmtst map table */ - static int lmtst_map_table_ops(struct rvu *rvu, u32 index, u64 *val, - int lmt_tbl_op) - { - void __iomem *lmt_map_base; -- u64 tbl_base; -+ u64 tbl_base, cfg; -+ int pfs, vfs; - - tbl_base = rvu_read64(rvu, BLKADDR_APR, APR_AF_LMT_MAP_BASE); -+ cfg = rvu_read64(rvu, BLKADDR_APR, APR_AF_LMT_CFG); -+ vfs = 1 << (cfg & 0xF); -+ pfs = 1 << ((cfg >> 4) & 0x7); - -- lmt_map_base = ioremap_wc(tbl_base, LMT_MAP_TABLE_SIZE); -+ lmt_map_base = ioremap_wc(tbl_base, pfs * vfs * LMT_MAPTBL_ENTRY_SIZE); - if (!lmt_map_base) { - dev_err(rvu->dev, "Failed to setup lmt map table mapping!!\n"); - return -ENOMEM; -@@ -35,6 +42,13 @@ static int lmtst_map_table_ops(struct rvu *rvu, u32 index, u64 *val, - *val = readq(lmt_map_base + index); - } else { - writeq((*val), (lmt_map_base + index)); -+ -+ cfg = FIELD_PREP(LMT_MAP_ENTRY_ENA, 0x1); -+ /* 2048 LMTLINES */ -+ cfg |= FIELD_PREP(LMT_MAP_ENTRY_LINES, 0x6); -+ -+ writeq(cfg, (lmt_map_base + (index + 8))); -+ - /* Flushing the AP interceptor cache to make APR_LMT_MAP_ENTRY_S - * changes effective. Write 1 for flush and read is being used as a - * barrier and sets up a data dependency. Write to 0 after a write -@@ -52,7 +66,7 @@ static int lmtst_map_table_ops(struct rvu *rvu, u32 index, u64 *val, - #define LMT_MAP_TBL_W1_OFF 8 - static u32 rvu_get_lmtst_tbl_index(struct rvu *rvu, u16 pcifunc) - { -- return ((rvu_get_pf(pcifunc) * rvu->hw->total_vfs) + -+ return ((rvu_get_pf(pcifunc) * LMT_MAX_VFS) + - (pcifunc & RVU_PFVF_FUNC_MASK)) * LMT_MAPTBL_ENTRY_SIZE; - } - -@@ -69,7 +83,7 @@ static int rvu_get_lmtaddr(struct rvu *rvu, u16 pcifunc, - - mutex_lock(&rvu->rsrc_lock); - rvu_write64(rvu, BLKADDR_RVUM, RVU_AF_SMMU_ADDR_REQ, iova); -- pf = rvu_get_pf(pcifunc) & 0x1F; -+ pf = rvu_get_pf(pcifunc) & RVU_PFVF_PF_MASK; - val = BIT_ULL(63) | BIT_ULL(14) | BIT_ULL(13) | pf << 8 | - ((pcifunc & RVU_PFVF_FUNC_MASK) & 0xFF); - rvu_write64(rvu, BLKADDR_RVUM, RVU_AF_SMMU_TXN_REQ, val); -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c -index feca86e429df20..56dab11833b533 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c -@@ -580,6 +580,7 @@ static ssize_t rvu_dbg_lmtst_map_table_display(struct file *filp, - u64 lmt_addr, val, tbl_base; - int pf, vf, num_vfs, hw_vfs; - void __iomem *lmt_map_base; -+ int apr_pfs, apr_vfs; - int buf_size = 10240; - size_t off = 0; - int index = 0; -@@ -595,8 +596,12 @@ static ssize_t rvu_dbg_lmtst_map_table_display(struct file *filp, - return -ENOMEM; - - tbl_base = rvu_read64(rvu, BLKADDR_APR, APR_AF_LMT_MAP_BASE); -+ val = rvu_read64(rvu, BLKADDR_APR, APR_AF_LMT_CFG); -+ apr_vfs = 1 << (val & 0xF); -+ apr_pfs = 1 << ((val >> 4) & 0x7); - -- lmt_map_base = ioremap_wc(tbl_base, 128 * 1024); -+ lmt_map_base = ioremap_wc(tbl_base, apr_pfs * apr_vfs * -+ LMT_MAPTBL_ENTRY_SIZE); - if (!lmt_map_base) { - dev_err(rvu->dev, "Failed to setup lmt map table mapping!!\n"); - kfree(buf); -@@ -618,7 +623,7 @@ static ssize_t rvu_dbg_lmtst_map_table_display(struct file *filp, - off += scnprintf(&buf[off], buf_size - 1 - off, "PF%d \t\t\t", - pf); - -- index = pf * rvu->hw->total_vfs * LMT_MAPTBL_ENTRY_SIZE; -+ index = pf * apr_vfs * LMT_MAPTBL_ENTRY_SIZE; - off += scnprintf(&buf[off], buf_size - 1 - off, " 0x%llx\t\t", - (tbl_base + index)); - lmt_addr = readq(lmt_map_base + index); -@@ -631,7 +636,7 @@ static ssize_t rvu_dbg_lmtst_map_table_display(struct file *filp, - /* Reading num of VFs per PF */ - rvu_get_pf_numvfs(rvu, pf, &num_vfs, &hw_vfs); - for (vf = 0; vf < num_vfs; vf++) { -- index = (pf * rvu->hw->total_vfs * 16) + -+ index = (pf * apr_vfs * LMT_MAPTBL_ENTRY_SIZE) + - ((vf + 1) * LMT_MAPTBL_ENTRY_SIZE); - off += scnprintf(&buf[off], buf_size - 1 - off, - "PF%d:VF%d \t\t", pf, vf); -diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c -index 47adccf7a77765..1999918ca500fa 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c -+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c -@@ -988,6 +988,7 @@ static int otx2_cq_init(struct otx2_nic *pfvf, u16 qidx) - int err, pool_id, non_xdp_queues; - struct nix_aq_enq_req *aq; - struct otx2_cq_queue *cq; -+ struct otx2_pool *pool; - - cq = &qset->cq[qidx]; - cq->cq_idx = qidx; -@@ -996,8 +997,13 @@ static int otx2_cq_init(struct otx2_nic *pfvf, u16 qidx) - cq->cq_type = CQ_RX; - cq->cint_idx = qidx; - cq->cqe_cnt = qset->rqe_cnt; -- if (pfvf->xdp_prog) -+ if (pfvf->xdp_prog) { -+ pool = &qset->pool[qidx]; - xdp_rxq_info_reg(&cq->xdp_rxq, pfvf->netdev, qidx, 0); -+ xdp_rxq_info_reg_mem_model(&cq->xdp_rxq, -+ MEM_TYPE_PAGE_POOL, -+ pool->page_pool); -+ } - } else if (qidx < non_xdp_queues) { - cq->cq_type = CQ_TX; - cq->cint_idx = qidx - pfvf->hw.rx_queues; -diff --git a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c -index a4efbeb1620841..889fd26843e608 100644 ---- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c -+++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c -@@ -34,8 +34,10 @@ struct mtk_flow_data { - u16 vlan_in; - - struct { -- u16 id; -- __be16 proto; -+ struct { -+ u16 id; -+ __be16 proto; -+ } vlans[2]; - u8 num; - } vlan; - struct { -@@ -330,18 +332,19 @@ mtk_flow_offload_replace(struct mtk_eth *eth, struct flow_cls_offload *f, - case FLOW_ACTION_CSUM: - break; - case FLOW_ACTION_VLAN_PUSH: -- if (data.vlan.num == 1 || -+ if (data.vlan.num + data.pppoe.num == 2 || - act->vlan.proto != htons(ETH_P_8021Q)) - return -EOPNOTSUPP; - -- data.vlan.id = act->vlan.vid; -- data.vlan.proto = act->vlan.proto; -+ data.vlan.vlans[data.vlan.num].id = act->vlan.vid; -+ data.vlan.vlans[data.vlan.num].proto = act->vlan.proto; - data.vlan.num++; - break; - case FLOW_ACTION_VLAN_POP: - break; - case FLOW_ACTION_PPPOE_PUSH: -- if (data.pppoe.num == 1) -+ if (data.pppoe.num == 1 || -+ data.vlan.num == 2) - return -EOPNOTSUPP; - - data.pppoe.sid = act->pppoe.sid; -@@ -431,12 +434,9 @@ mtk_flow_offload_replace(struct mtk_eth *eth, struct flow_cls_offload *f, - if (offload_type == MTK_PPE_PKT_TYPE_BRIDGE) - foe.bridge.vlan = data.vlan_in; - -- if (data.vlan.num == 1) { -- if (data.vlan.proto != htons(ETH_P_8021Q)) -- return -EOPNOTSUPP; -+ for (i = 0; i < data.vlan.num; i++) -+ mtk_foe_entry_set_vlan(eth, &foe, data.vlan.vlans[i].id); - -- mtk_foe_entry_set_vlan(eth, &foe, data.vlan.id); -- } - if (data.pppoe.num == 1) - mtk_foe_entry_set_pppoe(eth, &foe, data.pppoe.sid); - -diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c -index b330020dc0d674..f2bded847e61d1 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/alloc.c -+++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c -@@ -682,9 +682,9 @@ static struct mlx4_db_pgdir *mlx4_alloc_db_pgdir(struct device *dma_device) - } - - static int mlx4_alloc_db_from_pgdir(struct mlx4_db_pgdir *pgdir, -- struct mlx4_db *db, int order) -+ struct mlx4_db *db, unsigned int order) - { -- int o; -+ unsigned int o; - int i; - - for (o = order; o <= 1; ++o) { -@@ -712,7 +712,7 @@ static int mlx4_alloc_db_from_pgdir(struct mlx4_db_pgdir *pgdir, - return 0; - } - --int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, int order) -+int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, unsigned int order) - { - struct mlx4_priv *priv = mlx4_priv(dev); - struct mlx4_db_pgdir *pgdir; -diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c -index 65cb63f6c46587..61a0fd8424a2c5 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c -+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c -@@ -450,6 +450,8 @@ int mlx4_en_process_tx_cq(struct net_device *dev, - - if (unlikely(!priv->port_up)) - return 0; -+ if (unlikely(!napi_budget) && cq->type == TX_XDP) -+ return 0; - - netdev_txq_bql_complete_prefetchw(ring->tx_queue); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index 20a6bc1a234f4e..9cf33ae48c216f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -93,8 +93,6 @@ struct page_pool; - #define MLX5_MPWRQ_DEF_LOG_STRIDE_SZ(mdev) \ - MLX5_MPWRQ_LOG_STRIDE_SZ(mdev, order_base_2(MLX5E_RX_MAX_HEAD)) - --#define MLX5_MPWRQ_MAX_LOG_WQE_SZ 18 -- - /* Keep in sync with mlx5e_mpwrq_log_wqe_sz. - * These are theoretical maximums, which can be further restricted by - * capabilities. These values are used for static resource allocations and -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -index 775010e94cb7c6..dcd5db907f1028 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -@@ -9,6 +9,9 @@ - #include - #include - -+#define MLX5_MPWRQ_MAX_LOG_WQE_SZ 18 -+#define MLX5_REP_MPWRQ_MAX_LOG_WQE_SZ 17 -+ - static u8 mlx5e_mpwrq_min_page_shift(struct mlx5_core_dev *mdev) - { - u8 min_page_shift = MLX5_CAP_GEN_2(mdev, log_min_mkey_entity_size); -@@ -102,18 +105,22 @@ u8 mlx5e_mpwrq_log_wqe_sz(struct mlx5_core_dev *mdev, u8 page_shift, - enum mlx5e_mpwrq_umr_mode umr_mode) - { - u8 umr_entry_size = mlx5e_mpwrq_umr_entry_size(umr_mode); -- u8 max_pages_per_wqe, max_log_mpwqe_size; -+ u8 max_pages_per_wqe, max_log_wqe_size_calc; -+ u8 max_log_wqe_size_cap; - u16 max_wqe_size; - - /* Keep in sync with MLX5_MPWRQ_MAX_PAGES_PER_WQE. */ - max_wqe_size = mlx5e_get_max_sq_aligned_wqebbs(mdev) * MLX5_SEND_WQE_BB; - max_pages_per_wqe = ALIGN_DOWN(max_wqe_size - sizeof(struct mlx5e_umr_wqe), - MLX5_UMR_FLEX_ALIGNMENT) / umr_entry_size; -- max_log_mpwqe_size = ilog2(max_pages_per_wqe) + page_shift; -+ max_log_wqe_size_calc = ilog2(max_pages_per_wqe) + page_shift; -+ -+ WARN_ON_ONCE(max_log_wqe_size_calc < MLX5E_ORDER2_MAX_PACKET_MTU); - -- WARN_ON_ONCE(max_log_mpwqe_size < MLX5E_ORDER2_MAX_PACKET_MTU); -+ max_log_wqe_size_cap = mlx5_core_is_ecpf(mdev) ? -+ MLX5_REP_MPWRQ_MAX_LOG_WQE_SZ : MLX5_MPWRQ_MAX_LOG_WQE_SZ; - -- return min_t(u8, max_log_mpwqe_size, MLX5_MPWRQ_MAX_LOG_WQE_SZ); -+ return min_t(u8, max_log_wqe_size_calc, max_log_wqe_size_cap); - } - - u8 mlx5e_mpwrq_pages_per_wqe(struct mlx5_core_dev *mdev, u8 page_shift, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index d9dc7280302eb7..5c6f01abdcb91d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -3627,8 +3627,11 @@ static int mlx5e_setup_tc_mqprio(struct mlx5e_priv *priv, - /* MQPRIO is another toplevel qdisc that can't be attached - * simultaneously with the offloaded HTB. - */ -- if (WARN_ON(mlx5e_selq_is_htb_enabled(&priv->selq))) -- return -EINVAL; -+ if (mlx5e_selq_is_htb_enabled(&priv->selq)) { -+ NL_SET_ERR_MSG_MOD(mqprio->extack, -+ "MQPRIO cannot be configured when HTB offload is enabled."); -+ return -EOPNOTSUPP; -+ } - - switch (mqprio->mode) { - case TC_MQPRIO_MODE_DCB: -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -index 751d3ffcd2f6ce..851c499faa7954 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -@@ -63,6 +63,7 @@ - #define MLX5E_REP_PARAMS_DEF_LOG_SQ_SIZE \ - max(0x7, MLX5E_PARAMS_MINIMUM_LOG_SQ_SIZE) - #define MLX5E_REP_PARAMS_DEF_NUM_CHANNELS 1 -+#define MLX5E_REP_PARAMS_DEF_LOG_RQ_SIZE 0x8 - - static const char mlx5e_rep_driver_name[] = "mlx5e_rep"; - -@@ -798,6 +799,8 @@ static void mlx5e_build_rep_params(struct net_device *netdev) - - /* RQ */ - mlx5e_build_rq_params(mdev, params); -+ if (!mlx5e_is_uplink_rep(priv) && mlx5_core_is_ecpf(mdev)) -+ params->log_rq_mtu_frames = MLX5E_REP_PARAMS_DEF_LOG_RQ_SIZE; - - /* If netdev is already registered (e.g. move from nic profile to uplink, - * RTNL lock must be held before triggering netdev notifiers. -@@ -829,6 +832,8 @@ static void mlx5e_build_rep_netdev(struct net_device *netdev, - netdev->ethtool_ops = &mlx5e_rep_ethtool_ops; - - netdev->watchdog_timeo = 15 * HZ; -+ if (mlx5_core_is_ecpf(mdev)) -+ netdev->tx_queue_len = 1 << MLX5E_REP_PARAMS_DEF_LOG_SQ_SIZE; - - #if IS_ENABLED(CONFIG_MLX5_CLS_ACT) - netdev->hw_features |= NETIF_F_HW_TC; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c -index 08a75654f5f188..c170503b3aace1 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c -@@ -165,6 +165,9 @@ mlx5e_test_loopback_validate(struct sk_buff *skb, - struct udphdr *udph; - struct iphdr *iph; - -+ if (skb_linearize(skb)) -+ goto out; -+ - /* We are only going to peek, no need to clone the SKB */ - if (MLX5E_TEST_PKT_SIZE - ETH_HLEN > skb_headlen(skb)) - goto out; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c -index 8587cd572da536..bdb825aa872688 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c -@@ -96,7 +96,7 @@ static int esw_create_legacy_fdb_table(struct mlx5_eswitch *esw) - if (!flow_group_in) - return -ENOMEM; - -- ft_attr.max_fte = POOL_NEXT_SIZE; -+ ft_attr.max_fte = MLX5_FS_MAX_POOL_SIZE; - ft_attr.prio = LEGACY_FDB_PRIO; - fdb = mlx5_create_flow_table(root_ns, &ft_attr); - if (IS_ERR(fdb)) { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/events.c b/drivers/net/ethernet/mellanox/mlx5/core/events.c -index 3ec892d51f57d2..e7143d32b22119 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/events.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/events.c -@@ -163,11 +163,16 @@ static int temp_warn(struct notifier_block *nb, unsigned long type, void *data) - u64 value_msb; - - value_lsb = be64_to_cpu(eqe->data.temp_warning.sensor_warning_lsb); -+ /* bit 1-63 are not supported for NICs, -+ * hence read only bit 0 (asic) from lsb. -+ */ -+ value_lsb &= 0x1; - value_msb = be64_to_cpu(eqe->data.temp_warning.sensor_warning_msb); - -- mlx5_core_warn(events->dev, -- "High temperature on sensors with bit set %llx %llx", -- value_msb, value_lsb); -+ if (net_ratelimit()) -+ mlx5_core_warn(events->dev, -+ "High temperature on sensors with bit set %llx %llx", -+ value_msb, value_lsb); - - return NOTIFY_OK; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_ft_pool.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_ft_pool.c -index c14590acc77260..f6abfd00d7e68c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_ft_pool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_ft_pool.c -@@ -50,10 +50,12 @@ mlx5_ft_pool_get_avail_sz(struct mlx5_core_dev *dev, enum fs_flow_table_type tab - int i, found_i = -1; - - for (i = ARRAY_SIZE(FT_POOLS) - 1; i >= 0; i--) { -- if (dev->priv.ft_pool->ft_left[i] && FT_POOLS[i] >= desired_size && -+ if (dev->priv.ft_pool->ft_left[i] && -+ (FT_POOLS[i] >= desired_size || -+ desired_size == MLX5_FS_MAX_POOL_SIZE) && - FT_POOLS[i] <= max_ft_size) { - found_i = i; -- if (desired_size != POOL_NEXT_SIZE) -+ if (desired_size != MLX5_FS_MAX_POOL_SIZE) - break; - } - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_ft_pool.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_ft_pool.h -index 25f4274b372b56..173e312db7204f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_ft_pool.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_ft_pool.h -@@ -7,8 +7,6 @@ - #include - #include "fs_core.h" - --#define POOL_NEXT_SIZE 0 -- - int mlx5_ft_pool_init(struct mlx5_core_dev *dev); - void mlx5_ft_pool_destroy(struct mlx5_core_dev *dev); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c -index d798834c4e755d..3ac8043f76dacc 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/health.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c -@@ -833,6 +833,7 @@ static void poll_health(struct timer_list *t) - health->prev = count; - if (health->miss_counter == MAX_MISSES) { - mlx5_core_err(dev, "device's health compromised - reached miss count\n"); -+ health->synd = ioread8(&h->synd); - print_health_info(dev); - queue_work(health->wq, &health->report_work); - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c -index 711d14dea2485f..d313cb7f0ed88c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c -@@ -161,7 +161,8 @@ mlx5_chains_create_table(struct mlx5_fs_chains *chains, - ft_attr.flags |= (MLX5_FLOW_TABLE_TUNNEL_EN_REFORMAT | - MLX5_FLOW_TABLE_TUNNEL_EN_DECAP); - -- sz = (chain == mlx5_chains_get_nf_ft_chain(chains)) ? FT_TBL_SZ : POOL_NEXT_SIZE; -+ sz = (chain == mlx5_chains_get_nf_ft_chain(chains)) ? -+ FT_TBL_SZ : MLX5_FS_MAX_POOL_SIZE; - ft_attr.max_fte = sz; - - /* We use chains_default_ft(chains) as the table's next_ft till -diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c -index 5d2ceff72784f2..f971d60484f065 100644 ---- a/drivers/net/ethernet/microchip/lan743x_main.c -+++ b/drivers/net/ethernet/microchip/lan743x_main.c -@@ -3259,6 +3259,7 @@ static int lan743x_hardware_init(struct lan743x_adapter *adapter, - struct pci_dev *pdev) - { - struct lan743x_tx *tx; -+ u32 sgmii_ctl; - int index; - int ret; - -@@ -3271,6 +3272,15 @@ static int lan743x_hardware_init(struct lan743x_adapter *adapter, - spin_lock_init(&adapter->eth_syslock_spinlock); - mutex_init(&adapter->sgmii_rw_lock); - pci11x1x_set_rfe_rd_fifo_threshold(adapter); -+ sgmii_ctl = lan743x_csr_read(adapter, SGMII_CTL); -+ if (adapter->is_sgmii_en) { -+ sgmii_ctl |= SGMII_CTL_SGMII_ENABLE_; -+ sgmii_ctl &= ~SGMII_CTL_SGMII_POWER_DN_; -+ } else { -+ sgmii_ctl &= ~SGMII_CTL_SGMII_ENABLE_; -+ sgmii_ctl |= SGMII_CTL_SGMII_POWER_DN_; -+ } -+ lan743x_csr_write(adapter, SGMII_CTL, sgmii_ctl); - } else { - adapter->max_tx_channels = LAN743X_MAX_TX_CHANNELS; - adapter->used_tx_channels = LAN743X_USED_TX_CHANNELS; -@@ -3319,7 +3329,6 @@ static int lan743x_hardware_init(struct lan743x_adapter *adapter, - - static int lan743x_mdiobus_init(struct lan743x_adapter *adapter) - { -- u32 sgmii_ctl; - int ret; - - adapter->mdiobus = devm_mdiobus_alloc(&adapter->pdev->dev); -@@ -3331,10 +3340,6 @@ static int lan743x_mdiobus_init(struct lan743x_adapter *adapter) - adapter->mdiobus->priv = (void *)adapter; - if (adapter->is_pci11x1x) { - if (adapter->is_sgmii_en) { -- sgmii_ctl = lan743x_csr_read(adapter, SGMII_CTL); -- sgmii_ctl |= SGMII_CTL_SGMII_ENABLE_; -- sgmii_ctl &= ~SGMII_CTL_SGMII_POWER_DN_; -- lan743x_csr_write(adapter, SGMII_CTL, sgmii_ctl); - netif_dbg(adapter, drv, adapter->netdev, - "SGMII operation\n"); - adapter->mdiobus->read = lan743x_mdiobus_read_c22; -@@ -3345,10 +3350,6 @@ static int lan743x_mdiobus_init(struct lan743x_adapter *adapter) - netif_dbg(adapter, drv, adapter->netdev, - "lan743x-mdiobus-c45\n"); - } else { -- sgmii_ctl = lan743x_csr_read(adapter, SGMII_CTL); -- sgmii_ctl &= ~SGMII_CTL_SGMII_ENABLE_; -- sgmii_ctl |= SGMII_CTL_SGMII_POWER_DN_; -- lan743x_csr_write(adapter, SGMII_CTL, sgmii_ctl); - netif_dbg(adapter, drv, adapter->netdev, - "RGMII operation\n"); - // Only C22 support when RGMII I/F -diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c -index ae014e21eb6056..9ed965d61e3554 100644 ---- a/drivers/net/ethernet/microsoft/mana/gdma_main.c -+++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c -@@ -1036,7 +1036,7 @@ static u32 mana_gd_write_client_oob(const struct gdma_wqe_request *wqe_req, - header->inline_oob_size_div4 = client_oob_size / sizeof(u32); - - if (oob_in_sgl) { -- WARN_ON_ONCE(!pad_data || wqe_req->num_sge < 2); -+ WARN_ON_ONCE(wqe_req->num_sge < 2); - - header->client_oob_in_sgl = 1; - -diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c -index 7e5258b2c4290b..5af932a5e70c44 100644 ---- a/drivers/net/ethernet/realtek/r8169_main.c -+++ b/drivers/net/ethernet/realtek/r8169_main.c -@@ -5125,6 +5125,7 @@ static int r8169_mdio_register(struct rtl8169_private *tp) - new_bus->priv = tp; - new_bus->parent = &pdev->dev; - new_bus->irq[0] = PHY_MAC_INTERRUPT; -+ new_bus->phy_mask = GENMASK(31, 1); - snprintf(new_bus->id, MII_BUS_ID_SIZE, "r8169-%x-%x", - pci_domain_nr(pdev->bus), pci_dev_id(pdev)); - -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c -index 63998d65fef8eb..9377b05bfc71e1 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c -@@ -966,7 +966,7 @@ static int sun8i_dwmac_set_syscon(struct device *dev, - /* of_mdio_parse_addr returns a valid (0 ~ 31) PHY - * address. No need to mask it again. - */ -- reg |= 1 << H3_EPHY_ADDR_SHIFT; -+ reg |= ret << H3_EPHY_ADDR_SHIFT; - } else { - /* For SoCs without internal PHY the PHY selection bit should be - * set to 0 (external PHY). -diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c -index 9c8376b2718916..c379a958380ce0 100644 ---- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c -+++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c -@@ -2095,7 +2095,7 @@ static int am65_cpsw_nuss_init_slave_ports(struct am65_cpsw_common *common) - port->slave.mac_addr); - if (!is_valid_ether_addr(port->slave.mac_addr)) { - eth_random_addr(port->slave.mac_addr); -- dev_err(dev, "Use random MAC address\n"); -+ dev_info(dev, "Use random MAC address\n"); - } - } - } -diff --git a/drivers/net/ethernet/ti/cpsw_new.c b/drivers/net/ethernet/ti/cpsw_new.c -index 9061dca97fcbfd..1c1d4806c119b8 100644 ---- a/drivers/net/ethernet/ti/cpsw_new.c -+++ b/drivers/net/ethernet/ti/cpsw_new.c -@@ -1416,6 +1416,7 @@ static int cpsw_create_ports(struct cpsw_common *cpsw) - ndev->netdev_ops = &cpsw_netdev_ops; - ndev->ethtool_ops = &cpsw_ethtool_ops; - SET_NETDEV_DEV(ndev, dev); -+ ndev->dev.of_node = slave_data->slave_node; - - if (!napi_ndev) { - /* CPSW Host port CPDMA interface is shared between -diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c -index 0a0ad3d77557f9..587643a371de3c 100644 ---- a/drivers/net/ieee802154/ca8210.c -+++ b/drivers/net/ieee802154/ca8210.c -@@ -1446,8 +1446,7 @@ static u8 mcps_data_request( - command.pdata.data_req.src_addr_mode = src_addr_mode; - command.pdata.data_req.dst.mode = dst_address_mode; - if (dst_address_mode != MAC_MODE_NO_ADDR) { -- command.pdata.data_req.dst.pan_id[0] = LS_BYTE(dst_pan_id); -- command.pdata.data_req.dst.pan_id[1] = MS_BYTE(dst_pan_id); -+ put_unaligned_le16(dst_pan_id, command.pdata.data_req.dst.pan_id); - if (dst_address_mode == MAC_MODE_SHORT_ADDR) { - command.pdata.data_req.dst.address[0] = LS_BYTE( - dst_addr->short_address -@@ -1795,12 +1794,12 @@ static int ca8210_skb_rx( - } - hdr.source.mode = data_ind[0]; - dev_dbg(&priv->spi->dev, "srcAddrMode: %#03x\n", hdr.source.mode); -- hdr.source.pan_id = *(u16 *)&data_ind[1]; -+ hdr.source.pan_id = cpu_to_le16(get_unaligned_le16(&data_ind[1])); - dev_dbg(&priv->spi->dev, "srcPanId: %#06x\n", hdr.source.pan_id); - memcpy(&hdr.source.extended_addr, &data_ind[3], 8); - hdr.dest.mode = data_ind[11]; - dev_dbg(&priv->spi->dev, "dstAddrMode: %#03x\n", hdr.dest.mode); -- hdr.dest.pan_id = *(u16 *)&data_ind[12]; -+ hdr.dest.pan_id = cpu_to_le16(get_unaligned_le16(&data_ind[12])); - dev_dbg(&priv->spi->dev, "dstPanId: %#06x\n", hdr.dest.pan_id); - memcpy(&hdr.dest.extended_addr, &data_ind[14], 8); - -@@ -1927,7 +1926,7 @@ static int ca8210_skb_tx( - status = mcps_data_request( - header.source.mode, - header.dest.mode, -- header.dest.pan_id, -+ le16_to_cpu(header.dest.pan_id), - (union macaddr *)&header.dest.extended_addr, - skb->len - mac_len, - &skb->data[mac_len], -diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c -index b5f012619e42da..800e8b9eb4532b 100644 ---- a/drivers/net/phy/phylink.c -+++ b/drivers/net/phy/phylink.c -@@ -1718,7 +1718,7 @@ bool phylink_expects_phy(struct phylink *pl) - { - if (pl->cfg_link_an_mode == MLO_AN_FIXED || - (pl->cfg_link_an_mode == MLO_AN_INBAND && -- phy_interface_mode_is_8023z(pl->link_config.interface))) -+ phy_interface_mode_is_8023z(pl->link_interface))) - return false; - return true; - } -diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c -index bbcefcc7ef8f06..1e85cfe524e875 100644 ---- a/drivers/net/usb/r8152.c -+++ b/drivers/net/usb/r8152.c -@@ -10032,6 +10032,7 @@ static const struct usb_device_id rtl8152_table[] = { - { USB_DEVICE(VENDOR_ID_NVIDIA, 0x09ff) }, - { USB_DEVICE(VENDOR_ID_TPLINK, 0x0601) }, - { USB_DEVICE(VENDOR_ID_DLINK, 0xb301) }, -+ { USB_DEVICE(VENDOR_ID_DELL, 0xb097) }, - { USB_DEVICE(VENDOR_ID_ASUS, 0x1976) }, - {} - }; -diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c -index 64db3e98a1b664..2ed879a0abc6ce 100644 ---- a/drivers/net/vxlan/vxlan_core.c -+++ b/drivers/net/vxlan/vxlan_core.c -@@ -227,9 +227,9 @@ static int vxlan_fdb_info(struct sk_buff *skb, struct vxlan_dev *vxlan, - be32_to_cpu(fdb->vni))) - goto nla_put_failure; - -- ci.ndm_used = jiffies_to_clock_t(now - fdb->used); -+ ci.ndm_used = jiffies_to_clock_t(now - READ_ONCE(fdb->used)); - ci.ndm_confirmed = 0; -- ci.ndm_updated = jiffies_to_clock_t(now - fdb->updated); -+ ci.ndm_updated = jiffies_to_clock_t(now - READ_ONCE(fdb->updated)); - ci.ndm_refcnt = 0; - - if (nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci)) -@@ -435,8 +435,8 @@ static struct vxlan_fdb *vxlan_find_mac(struct vxlan_dev *vxlan, - struct vxlan_fdb *f; - - f = __vxlan_find_mac(vxlan, mac, vni); -- if (f && f->used != jiffies) -- f->used = jiffies; -+ if (f && READ_ONCE(f->used) != jiffies) -+ WRITE_ONCE(f->used, jiffies); - - return f; - } -@@ -1010,12 +1010,12 @@ static int vxlan_fdb_update_existing(struct vxlan_dev *vxlan, - !(f->flags & NTF_VXLAN_ADDED_BY_USER)) { - if (f->state != state) { - f->state = state; -- f->updated = jiffies; -+ WRITE_ONCE(f->updated, jiffies); - notify = 1; - } - if (f->flags != fdb_flags) { - f->flags = fdb_flags; -- f->updated = jiffies; -+ WRITE_ONCE(f->updated, jiffies); - notify = 1; - } - } -@@ -1049,7 +1049,7 @@ static int vxlan_fdb_update_existing(struct vxlan_dev *vxlan, - } - - if (ndm_flags & NTF_USE) -- f->used = jiffies; -+ WRITE_ONCE(f->used, jiffies); - - if (notify) { - if (rd == NULL) -@@ -1478,7 +1478,7 @@ static bool vxlan_snoop(struct net_device *dev, - src_mac, &rdst->remote_ip.sa, &src_ip->sa); - - rdst->remote_ip = *src_ip; -- f->updated = jiffies; -+ WRITE_ONCE(f->updated, jiffies); - vxlan_fdb_notify(vxlan, f, rdst, RTM_NEWNEIGH, true, NULL); - } else { - u32 hash_index = fdb_head_index(vxlan, src_mac, vni); -@@ -2920,7 +2920,7 @@ static void vxlan_cleanup(struct timer_list *t) - if (f->flags & NTF_EXT_LEARNED) - continue; - -- timeout = f->used + vxlan->cfg.age_interval * HZ; -+ timeout = READ_ONCE(f->used) + vxlan->cfg.age_interval * HZ; - if (time_before_eq(timeout, jiffies)) { - netdev_dbg(vxlan->dev, - "garbage collect %pM\n", -@@ -4240,6 +4240,7 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[], - struct netlink_ext_ack *extack) - { - struct vxlan_dev *vxlan = netdev_priv(dev); -+ bool rem_ip_changed, change_igmp; - struct net_device *lowerdev; - struct vxlan_config conf; - struct vxlan_rdst *dst; -@@ -4263,8 +4264,13 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[], - if (err) - return err; - -+ rem_ip_changed = !vxlan_addr_equal(&conf.remote_ip, &dst->remote_ip); -+ change_igmp = vxlan->dev->flags & IFF_UP && -+ (rem_ip_changed || -+ dst->remote_ifindex != conf.remote_ifindex); -+ - /* handle default dst entry */ -- if (!vxlan_addr_equal(&conf.remote_ip, &dst->remote_ip)) { -+ if (rem_ip_changed) { - u32 hash_index = fdb_head_index(vxlan, all_zeros_mac, conf.vni); - - spin_lock_bh(&vxlan->hash_lock[hash_index]); -@@ -4308,6 +4314,9 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[], - } - } - -+ if (change_igmp && vxlan_addr_multicast(&dst->remote_ip)) -+ err = vxlan_multicast_leave(vxlan); -+ - if (conf.age_interval != vxlan->cfg.age_interval) - mod_timer(&vxlan->age_timer, jiffies); - -@@ -4315,7 +4324,12 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[], - if (lowerdev && lowerdev != dst->remote_dev) - dst->remote_dev = lowerdev; - vxlan_config_apply(dev, &conf, lowerdev, vxlan->net, true); -- return 0; -+ -+ if (!err && change_igmp && -+ vxlan_addr_multicast(&dst->remote_ip)) -+ err = vxlan_multicast_join(vxlan); -+ -+ return err; - } - - static void vxlan_dellink(struct net_device *dev, struct list_head *head) -diff --git a/drivers/net/wireless/ath/ath12k/core.h b/drivers/net/wireless/ath/ath12k/core.h -index 33f4706af880d1..18dfd7aab610c9 100644 ---- a/drivers/net/wireless/ath/ath12k/core.h -+++ b/drivers/net/wireless/ath/ath12k/core.h -@@ -125,6 +125,7 @@ struct ath12k_ext_irq_grp { - u32 num_irq; - u32 grp_id; - u64 timestamp; -+ bool napi_enabled; - struct napi_struct napi; - struct net_device napi_ndev; - }; -diff --git a/drivers/net/wireless/ath/ath12k/dp_tx.c b/drivers/net/wireless/ath/ath12k/dp_tx.c -index e025e4d0e7678f..474e0d4d406ea1 100644 ---- a/drivers/net/wireless/ath/ath12k/dp_tx.c -+++ b/drivers/net/wireless/ath/ath12k/dp_tx.c -@@ -118,7 +118,7 @@ static void ath12k_hal_tx_cmd_ext_desc_setup(struct ath12k_base *ab, void *cmd, - le32_encode_bits(ti->data_len, - HAL_TX_MSDU_EXT_INFO1_BUF_LEN); - -- tcl_ext_cmd->info1 = le32_encode_bits(1, HAL_TX_MSDU_EXT_INFO1_EXTN_OVERRIDE) | -+ tcl_ext_cmd->info1 |= le32_encode_bits(1, HAL_TX_MSDU_EXT_INFO1_EXTN_OVERRIDE) | - le32_encode_bits(ti->encap_type, - HAL_TX_MSDU_EXT_INFO1_ENCAP_TYPE) | - le32_encode_bits(ti->encrypt_type, -@@ -422,13 +422,13 @@ ath12k_dp_tx_process_htt_tx_complete(struct ath12k_base *ab, - - switch (wbm_status) { - case HAL_WBM_REL_HTT_TX_COMP_STATUS_OK: -- case HAL_WBM_REL_HTT_TX_COMP_STATUS_DROP: -- case HAL_WBM_REL_HTT_TX_COMP_STATUS_TTL: - ts.acked = (wbm_status == HAL_WBM_REL_HTT_TX_COMP_STATUS_OK); - ts.ack_rssi = le32_get_bits(status_desc->info2, - HTT_TX_WBM_COMP_INFO2_ACK_RSSI); - ath12k_dp_tx_htt_tx_complete_buf(ab, msdu, tx_ring, &ts); - break; -+ case HAL_WBM_REL_HTT_TX_COMP_STATUS_DROP: -+ case HAL_WBM_REL_HTT_TX_COMP_STATUS_TTL: - case HAL_WBM_REL_HTT_TX_COMP_STATUS_REINJ: - case HAL_WBM_REL_HTT_TX_COMP_STATUS_INSPECT: - ath12k_dp_tx_free_txbuf(ab, msdu, mac_id, tx_ring); -diff --git a/drivers/net/wireless/ath/ath12k/hal_desc.h b/drivers/net/wireless/ath/ath12k/hal_desc.h -index 6c17adc6d60b56..1bb840c2bef577 100644 ---- a/drivers/net/wireless/ath/ath12k/hal_desc.h -+++ b/drivers/net/wireless/ath/ath12k/hal_desc.h -@@ -2918,7 +2918,7 @@ struct hal_mon_buf_ring { - - #define HAL_MON_DEST_COOKIE_BUF_ID GENMASK(17, 0) - --#define HAL_MON_DEST_INFO0_END_OFFSET GENMASK(15, 0) -+#define HAL_MON_DEST_INFO0_END_OFFSET GENMASK(11, 0) - #define HAL_MON_DEST_INFO0_FLUSH_DETECTED BIT(16) - #define HAL_MON_DEST_INFO0_END_OF_PPDU BIT(17) - #define HAL_MON_DEST_INFO0_INITIATOR BIT(18) -diff --git a/drivers/net/wireless/ath/ath12k/pci.c b/drivers/net/wireless/ath/ath12k/pci.c -index 041a9602f0e15f..5fd80f90ecafed 100644 ---- a/drivers/net/wireless/ath/ath12k/pci.c -+++ b/drivers/net/wireless/ath/ath12k/pci.c -@@ -442,8 +442,11 @@ static void __ath12k_pci_ext_irq_disable(struct ath12k_base *ab) - - ath12k_pci_ext_grp_disable(irq_grp); - -- napi_synchronize(&irq_grp->napi); -- napi_disable(&irq_grp->napi); -+ if (irq_grp->napi_enabled) { -+ napi_synchronize(&irq_grp->napi); -+ napi_disable(&irq_grp->napi); -+ irq_grp->napi_enabled = false; -+ } - } - } - -@@ -976,7 +979,11 @@ void ath12k_pci_ext_irq_enable(struct ath12k_base *ab) - for (i = 0; i < ATH12K_EXT_IRQ_GRP_NUM_MAX; i++) { - struct ath12k_ext_irq_grp *irq_grp = &ab->ext_irq_grp[i]; - -- napi_enable(&irq_grp->napi); -+ if (!irq_grp->napi_enabled) { -+ napi_enable(&irq_grp->napi); -+ irq_grp->napi_enabled = true; -+ } -+ - ath12k_pci_ext_grp_enable(irq_grp); - } - } -diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c -index c977dfbae0a464..d87d5980325e8f 100644 ---- a/drivers/net/wireless/ath/ath12k/wmi.c -+++ b/drivers/net/wireless/ath/ath12k/wmi.c -@@ -2115,8 +2115,8 @@ void ath12k_wmi_start_scan_init(struct ath12k *ar, - arg->dwell_time_active = 50; - arg->dwell_time_active_2g = 0; - arg->dwell_time_passive = 150; -- arg->dwell_time_active_6g = 40; -- arg->dwell_time_passive_6g = 30; -+ arg->dwell_time_active_6g = 70; -+ arg->dwell_time_passive_6g = 70; - arg->min_rest_time = 50; - arg->max_rest_time = 500; - arg->repeat_probe_time = 0; -diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c -index 4f00400c7ffb83..58386906598a73 100644 ---- a/drivers/net/wireless/ath/ath9k/init.c -+++ b/drivers/net/wireless/ath/ath9k/init.c -@@ -691,7 +691,9 @@ static int ath9k_of_init(struct ath_softc *sc) - ah->ah_flags |= AH_NO_EEP_SWAP; - } - -- of_get_mac_address(np, common->macaddr); -+ ret = of_get_mac_address(np, common->macaddr); -+ if (ret == -EPROBE_DEFER) -+ return ret; - - return 0; - } -diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c -index a97ed7cbe4d140..d588e4cd808d8e 100644 ---- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c -+++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c -@@ -1,6 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause - /* -- * Copyright (C) 2018-2024 Intel Corporation -+ * Copyright (C) 2018-2025 Intel Corporation - */ - #include - #include "iwl-drv.h" -@@ -1382,15 +1382,15 @@ void _iwl_dbg_tlv_time_point(struct iwl_fw_runtime *fwrt, - switch (tp_id) { - case IWL_FW_INI_TIME_POINT_EARLY: - iwl_dbg_tlv_init_cfg(fwrt); -- iwl_dbg_tlv_apply_config(fwrt, conf_list); - iwl_dbg_tlv_update_drams(fwrt); - iwl_dbg_tlv_tp_trigger(fwrt, sync, trig_list, tp_data, NULL); -+ iwl_dbg_tlv_apply_config(fwrt, conf_list); - break; - case IWL_FW_INI_TIME_POINT_AFTER_ALIVE: - iwl_dbg_tlv_apply_buffers(fwrt); - iwl_dbg_tlv_send_hcmds(fwrt, hcmd_list); -- iwl_dbg_tlv_apply_config(fwrt, conf_list); - iwl_dbg_tlv_tp_trigger(fwrt, sync, trig_list, tp_data, NULL); -+ iwl_dbg_tlv_apply_config(fwrt, conf_list); - break; - case IWL_FW_INI_TIME_POINT_PERIODIC: - iwl_dbg_tlv_set_periodic_trigs(fwrt); -@@ -1400,14 +1400,14 @@ void _iwl_dbg_tlv_time_point(struct iwl_fw_runtime *fwrt, - case IWL_FW_INI_TIME_POINT_MISSED_BEACONS: - case IWL_FW_INI_TIME_POINT_FW_DHC_NOTIFICATION: - iwl_dbg_tlv_send_hcmds(fwrt, hcmd_list); -- iwl_dbg_tlv_apply_config(fwrt, conf_list); - iwl_dbg_tlv_tp_trigger(fwrt, sync, trig_list, tp_data, - iwl_dbg_tlv_check_fw_pkt); -+ iwl_dbg_tlv_apply_config(fwrt, conf_list); - break; - default: - iwl_dbg_tlv_send_hcmds(fwrt, hcmd_list); -- iwl_dbg_tlv_apply_config(fwrt, conf_list); - iwl_dbg_tlv_tp_trigger(fwrt, sync, trig_list, tp_data, NULL); -+ iwl_dbg_tlv_apply_config(fwrt, conf_list); - break; - } - } -diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c -index 4a2de79f2e864b..c01a9a6f06a4d0 100644 ---- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c -+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c -@@ -580,6 +580,8 @@ static const struct iwl_dev_info iwl_dev_info_table[] = { - IWL_DEV_INFO(0x7A70, 0x1692, iwlax411_2ax_cfg_so_gf4_a0, iwl_ax411_killer_1690i_name), - IWL_DEV_INFO(0x7AF0, 0x1691, iwlax411_2ax_cfg_so_gf4_a0, iwl_ax411_killer_1690s_name), - IWL_DEV_INFO(0x7AF0, 0x1692, iwlax411_2ax_cfg_so_gf4_a0, iwl_ax411_killer_1690i_name), -+ IWL_DEV_INFO(0x7F70, 0x1691, iwlax411_2ax_cfg_so_gf4_a0, iwl_ax411_killer_1690s_name), -+ IWL_DEV_INFO(0x7F70, 0x1692, iwlax411_2ax_cfg_so_gf4_a0, iwl_ax411_killer_1690i_name), - - IWL_DEV_INFO(0x271C, 0x0214, iwl9260_2ac_cfg, iwl9260_1_name), - IWL_DEV_INFO(0x7E40, 0x1691, iwl_cfg_ma, iwl_ax411_killer_1690s_name), -diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h -index 8b620d4fed4390..df0ea638370b56 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt76.h -+++ b/drivers/net/wireless/mediatek/mt76/mt76.h -@@ -439,6 +439,7 @@ struct mt76_hw_cap { - #define MT_DRV_RX_DMA_HDR BIT(3) - #define MT_DRV_HW_MGMT_TXQ BIT(4) - #define MT_DRV_AMSDU_OFFLOAD BIT(5) -+#define MT_DRV_IGNORE_TXS_FAILED BIT(6) - - struct mt76_driver_ops { - u32 drv_flags; -diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac3_mac.h b/drivers/net/wireless/mediatek/mt76/mt76_connac3_mac.h -index 87bfa441a93743..4979012d5abfa0 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt76_connac3_mac.h -+++ b/drivers/net/wireless/mediatek/mt76/mt76_connac3_mac.h -@@ -280,6 +280,9 @@ enum tx_mgnt_type { - #define MT_TXFREE_INFO_COUNT GENMASK(27, 24) - #define MT_TXFREE_INFO_STAT GENMASK(29, 28) - -+#define MT_TXS_HDR_SIZE 4 /* Unit: DW */ -+#define MT_TXS_SIZE 12 /* Unit: DW */ -+ - #define MT_TXS0_BW GENMASK(31, 29) - #define MT_TXS0_TID GENMASK(28, 26) - #define MT_TXS0_AMPDU BIT(25) -diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c b/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c -index 9277ff38b7a228..57ae362dad50b7 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c -+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c -@@ -152,7 +152,8 @@ mt76x0e_probe(struct pci_dev *pdev, const struct pci_device_id *id) - static const struct mt76_driver_ops drv_ops = { - .txwi_size = sizeof(struct mt76x02_txwi), - .drv_flags = MT_DRV_TX_ALIGNED4_SKBS | -- MT_DRV_SW_RX_AIRTIME, -+ MT_DRV_SW_RX_AIRTIME | -+ MT_DRV_IGNORE_TXS_FAILED, - .survey_flags = SURVEY_INFO_TIME_TX, - .update_survey = mt76x02_update_channel, - .tx_prepare_skb = mt76x02_tx_prepare_skb, -diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c -index 0422c332354a13..520fd46227a7b8 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c -+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c -@@ -210,7 +210,8 @@ static int mt76x0u_probe(struct usb_interface *usb_intf, - const struct usb_device_id *id) - { - static const struct mt76_driver_ops drv_ops = { -- .drv_flags = MT_DRV_SW_RX_AIRTIME, -+ .drv_flags = MT_DRV_SW_RX_AIRTIME | -+ MT_DRV_IGNORE_TXS_FAILED, - .survey_flags = SURVEY_INFO_TIME_TX, - .update_survey = mt76x02_update_channel, - .tx_prepare_skb = mt76x02u_tx_prepare_skb, -diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c b/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c -index df85ebc6e1df07..7e2475b3c278e0 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c -+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c -@@ -22,7 +22,8 @@ mt76x2e_probe(struct pci_dev *pdev, const struct pci_device_id *id) - static const struct mt76_driver_ops drv_ops = { - .txwi_size = sizeof(struct mt76x02_txwi), - .drv_flags = MT_DRV_TX_ALIGNED4_SKBS | -- MT_DRV_SW_RX_AIRTIME, -+ MT_DRV_SW_RX_AIRTIME | -+ MT_DRV_IGNORE_TXS_FAILED, - .survey_flags = SURVEY_INFO_TIME_TX, - .update_survey = mt76x02_update_channel, - .tx_prepare_skb = mt76x02_tx_prepare_skb, -diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c b/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c -index d8043099921966..70d3895762b4cd 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c -+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c -@@ -29,7 +29,8 @@ static int mt76x2u_probe(struct usb_interface *intf, - const struct usb_device_id *id) - { - static const struct mt76_driver_ops drv_ops = { -- .drv_flags = MT_DRV_SW_RX_AIRTIME, -+ .drv_flags = MT_DRV_SW_RX_AIRTIME | -+ MT_DRV_IGNORE_TXS_FAILED, - .survey_flags = SURVEY_INFO_TIME_TX, - .update_survey = mt76x02_update_channel, - .tx_prepare_skb = mt76x02u_tx_prepare_skb, -diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c -index 73d46ec1181ae8..35d9673ec0d8fc 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c -@@ -1354,7 +1354,7 @@ bool mt7996_rx_check(struct mt76_dev *mdev, void *data, int len) - mt7996_mac_tx_free(dev, data, len); - return false; - case PKT_TYPE_TXS: -- for (rxd += 4; rxd + 8 <= end; rxd += 8) -+ for (rxd += MT_TXS_HDR_SIZE; rxd + MT_TXS_SIZE <= end; rxd += MT_TXS_SIZE) - mt7996_mac_add_txs(dev, rxd); - return false; - case PKT_TYPE_RX_FW_MONITOR: -@@ -1391,7 +1391,7 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q, - mt7996_mcu_rx_event(dev, skb); - break; - case PKT_TYPE_TXS: -- for (rxd += 4; rxd + 8 <= end; rxd += 8) -+ for (rxd += MT_TXS_HDR_SIZE; rxd + MT_TXS_SIZE <= end; rxd += MT_TXS_SIZE) - mt7996_mac_add_txs(dev, rxd); - dev_kfree_skb(skb); - break; -diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c -index 1809b03292c3d9..47cdccdbed6aaf 100644 ---- a/drivers/net/wireless/mediatek/mt76/tx.c -+++ b/drivers/net/wireless/mediatek/mt76/tx.c -@@ -100,7 +100,8 @@ __mt76_tx_status_skb_done(struct mt76_dev *dev, struct sk_buff *skb, u8 flags, - return; - - /* Tx status can be unreliable. if it fails, mark the frame as ACKed */ -- if (flags & MT_TX_CB_TXS_FAILED) { -+ if (flags & MT_TX_CB_TXS_FAILED && -+ (dev->drv->drv_flags & MT_DRV_IGNORE_TXS_FAILED)) { - info->status.rates[0].count = 0; - info->status.rates[0].idx = -1; - info->flags |= IEEE80211_TX_STAT_ACK; -diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c -index 6e47dde9389092..05e77d2bda3738 100644 ---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c -+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c -@@ -900,9 +900,10 @@ rtl8xxxu_writeN(struct rtl8xxxu_priv *priv, u16 addr, u8 *buf, u16 len) - return len; - - write_error: -- dev_info(&udev->dev, -- "%s: Failed to write block at addr: %04x size: %04x\n", -- __func__, addr, blocksize); -+ if (rtl8xxxu_debug & RTL8XXXU_DEBUG_REG_WRITE) -+ dev_info(&udev->dev, -+ "%s: Failed to write block at addr: %04x size: %04x\n", -+ __func__, addr, blocksize); - return -EAGAIN; - } - -@@ -4073,8 +4074,14 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw) - */ - rtl8xxxu_write16(priv, REG_TRXFF_BNDY + 2, fops->trxff_boundary); - -- ret = rtl8xxxu_download_firmware(priv); -- dev_dbg(dev, "%s: download_firmware %i\n", __func__, ret); -+ for (int retry = 5; retry >= 0 ; retry--) { -+ ret = rtl8xxxu_download_firmware(priv); -+ dev_dbg(dev, "%s: download_firmware %i\n", __func__, ret); -+ if (ret != -EAGAIN) -+ break; -+ if (retry) -+ dev_dbg(dev, "%s: retry firmware download\n", __func__); -+ } - if (ret) - goto exit; - ret = rtl8xxxu_start_firmware(priv); -diff --git a/drivers/net/wireless/realtek/rtw88/mac.c b/drivers/net/wireless/realtek/rtw88/mac.c -index 0c1c1ff31085cf..929182424b8b87 100644 ---- a/drivers/net/wireless/realtek/rtw88/mac.c -+++ b/drivers/net/wireless/realtek/rtw88/mac.c -@@ -783,7 +783,8 @@ static int __rtw_download_firmware(struct rtw_dev *rtwdev, - if (!check_firmware_size(data, size)) - return -EINVAL; - -- if (!ltecoex_read_reg(rtwdev, 0x38, <ecoex_bckp)) -+ if (rtwdev->chip->ltecoex_addr && -+ !ltecoex_read_reg(rtwdev, 0x38, <ecoex_bckp)) - return -EBUSY; - - wlan_cpu_enable(rtwdev, false); -@@ -801,7 +802,8 @@ static int __rtw_download_firmware(struct rtw_dev *rtwdev, - - wlan_cpu_enable(rtwdev, true); - -- if (!ltecoex_reg_write(rtwdev, 0x38, ltecoex_bckp)) { -+ if (rtwdev->chip->ltecoex_addr && -+ !ltecoex_reg_write(rtwdev, 0x38, ltecoex_bckp)) { - ret = -EBUSY; - goto dlfw_fail; - } -diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c -index b90ea6c88b15d9..0d0b5123b5fe28 100644 ---- a/drivers/net/wireless/realtek/rtw88/main.c -+++ b/drivers/net/wireless/realtek/rtw88/main.c -@@ -1544,6 +1544,7 @@ static void rtw_init_ht_cap(struct rtw_dev *rtwdev, - { - const struct rtw_chip_info *chip = rtwdev->chip; - struct rtw_efuse *efuse = &rtwdev->efuse; -+ int i; - - ht_cap->ht_supported = true; - ht_cap->cap = 0; -@@ -1563,25 +1564,20 @@ static void rtw_init_ht_cap(struct rtw_dev *rtwdev, - ht_cap->ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K; - ht_cap->ampdu_density = chip->ampdu_density; - ht_cap->mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED; -- if (efuse->hw_cap.nss > 1) { -- ht_cap->mcs.rx_mask[0] = 0xFF; -- ht_cap->mcs.rx_mask[1] = 0xFF; -- ht_cap->mcs.rx_mask[4] = 0x01; -- ht_cap->mcs.rx_highest = cpu_to_le16(300); -- } else { -- ht_cap->mcs.rx_mask[0] = 0xFF; -- ht_cap->mcs.rx_mask[1] = 0x00; -- ht_cap->mcs.rx_mask[4] = 0x01; -- ht_cap->mcs.rx_highest = cpu_to_le16(150); -- } -+ -+ for (i = 0; i < efuse->hw_cap.nss; i++) -+ ht_cap->mcs.rx_mask[i] = 0xFF; -+ ht_cap->mcs.rx_mask[4] = 0x01; -+ ht_cap->mcs.rx_highest = cpu_to_le16(150 * efuse->hw_cap.nss); - } - - static void rtw_init_vht_cap(struct rtw_dev *rtwdev, - struct ieee80211_sta_vht_cap *vht_cap) - { - struct rtw_efuse *efuse = &rtwdev->efuse; -- u16 mcs_map; -+ u16 mcs_map = 0; - __le16 highest; -+ int i; - - if (efuse->hw_cap.ptcl != EFUSE_HW_CAP_IGNORE && - efuse->hw_cap.ptcl != EFUSE_HW_CAP_PTCL_VHT) -@@ -1604,21 +1600,15 @@ static void rtw_init_vht_cap(struct rtw_dev *rtwdev, - if (rtw_chip_has_rx_ldpc(rtwdev)) - vht_cap->cap |= IEEE80211_VHT_CAP_RXLDPC; - -- mcs_map = IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 | -- IEEE80211_VHT_MCS_NOT_SUPPORTED << 4 | -- IEEE80211_VHT_MCS_NOT_SUPPORTED << 6 | -- IEEE80211_VHT_MCS_NOT_SUPPORTED << 8 | -- IEEE80211_VHT_MCS_NOT_SUPPORTED << 10 | -- IEEE80211_VHT_MCS_NOT_SUPPORTED << 12 | -- IEEE80211_VHT_MCS_NOT_SUPPORTED << 14; -- if (efuse->hw_cap.nss > 1) { -- highest = cpu_to_le16(780); -- mcs_map |= IEEE80211_VHT_MCS_SUPPORT_0_9 << 2; -- } else { -- highest = cpu_to_le16(390); -- mcs_map |= IEEE80211_VHT_MCS_NOT_SUPPORTED << 2; -+ for (i = 0; i < 8; i++) { -+ if (i < efuse->hw_cap.nss) -+ mcs_map |= IEEE80211_VHT_MCS_SUPPORT_0_9 << (i * 2); -+ else -+ mcs_map |= IEEE80211_VHT_MCS_NOT_SUPPORTED << (i * 2); - } - -+ highest = cpu_to_le16(390 * efuse->hw_cap.nss); -+ - vht_cap->vht_mcs.rx_mcs_map = cpu_to_le16(mcs_map); - vht_cap->vht_mcs.tx_mcs_map = cpu_to_le16(mcs_map); - vht_cap->vht_mcs.rx_highest = highest; -diff --git a/drivers/net/wireless/realtek/rtw88/reg.h b/drivers/net/wireless/realtek/rtw88/reg.h -index 7c6c11d50ff30f..0e76bc07bddef3 100644 ---- a/drivers/net/wireless/realtek/rtw88/reg.h -+++ b/drivers/net/wireless/realtek/rtw88/reg.h -@@ -108,6 +108,7 @@ - #define BIT_SHIFT_ROM_PGE 16 - #define BIT_FW_INIT_RDY BIT(15) - #define BIT_FW_DW_RDY BIT(14) -+#define BIT_CPU_CLK_SEL (BIT(12) | BIT(13)) - #define BIT_RPWM_TOGGLE BIT(7) - #define BIT_RAM_DL_SEL BIT(7) /* legacy only */ - #define BIT_DMEM_CHKSUM_OK BIT(6) -@@ -125,7 +126,7 @@ - BIT_CHECK_SUM_OK) - #define FW_READY_LEGACY (BIT_MCUFWDL_RDY | BIT_FWDL_CHK_RPT | \ - BIT_WINTINI_RDY | BIT_RAM_DL_SEL) --#define FW_READY_MASK 0xffff -+#define FW_READY_MASK (0xffff & ~BIT_CPU_CLK_SEL) - - #define REG_MCU_TST_CFG 0x84 - #define VAL_FW_TRIGGER 0x1 -diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822b.c b/drivers/net/wireless/realtek/rtw88/rtw8822b.c -index 3017a9760da8dc..99318a82b43f4b 100644 ---- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c -+++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c -@@ -975,11 +975,11 @@ static void rtw8822b_query_rx_desc(struct rtw_dev *rtwdev, u8 *rx_desc, - } - - static void --rtw8822b_set_tx_power_index_by_rate(struct rtw_dev *rtwdev, u8 path, u8 rs) -+rtw8822b_set_tx_power_index_by_rate(struct rtw_dev *rtwdev, u8 path, -+ u8 rs, u32 *phy_pwr_idx) - { - struct rtw_hal *hal = &rtwdev->hal; - static const u32 offset_txagc[2] = {0x1d00, 0x1d80}; -- static u32 phy_pwr_idx; - u8 rate, rate_idx, pwr_index, shift; - int j; - -@@ -987,12 +987,12 @@ rtw8822b_set_tx_power_index_by_rate(struct rtw_dev *rtwdev, u8 path, u8 rs) - rate = rtw_rate_section[rs][j]; - pwr_index = hal->tx_pwr_tbl[path][rate]; - shift = rate & 0x3; -- phy_pwr_idx |= ((u32)pwr_index << (shift * 8)); -+ *phy_pwr_idx |= ((u32)pwr_index << (shift * 8)); - if (shift == 0x3) { - rate_idx = rate & 0xfc; - rtw_write32(rtwdev, offset_txagc[path] + rate_idx, -- phy_pwr_idx); -- phy_pwr_idx = 0; -+ *phy_pwr_idx); -+ *phy_pwr_idx = 0; - } - } - } -@@ -1000,11 +1000,13 @@ rtw8822b_set_tx_power_index_by_rate(struct rtw_dev *rtwdev, u8 path, u8 rs) - static void rtw8822b_set_tx_power_index(struct rtw_dev *rtwdev) - { - struct rtw_hal *hal = &rtwdev->hal; -+ u32 phy_pwr_idx = 0; - int rs, path; - - for (path = 0; path < hal->rf_path_num; path++) { - for (rs = 0; rs < RTW_RATE_SECTION_MAX; rs++) -- rtw8822b_set_tx_power_index_by_rate(rtwdev, path, rs); -+ rtw8822b_set_tx_power_index_by_rate(rtwdev, path, rs, -+ &phy_pwr_idx); - } - } - -diff --git a/drivers/net/wireless/realtek/rtw88/util.c b/drivers/net/wireless/realtek/rtw88/util.c -index e222d3c01a77ec..66819f69440550 100644 ---- a/drivers/net/wireless/realtek/rtw88/util.c -+++ b/drivers/net/wireless/realtek/rtw88/util.c -@@ -101,7 +101,8 @@ void rtw_desc_to_mcsrate(u16 rate, u8 *mcs, u8 *nss) - *nss = 4; - *mcs = rate - DESC_RATEVHT4SS_MCS0; - } else if (rate >= DESC_RATEMCS0 && -- rate <= DESC_RATEMCS15) { -+ rate <= DESC_RATEMCS31) { -+ *nss = 0; - *mcs = rate - DESC_RATEMCS0; - } - } -diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c -index a8e2efae6e5260..89b0a7970508e2 100644 ---- a/drivers/net/wireless/realtek/rtw89/fw.c -+++ b/drivers/net/wireless/realtek/rtw89/fw.c -@@ -755,7 +755,6 @@ static int __rtw89_fw_download_hdr(struct rtw89_dev *rtwdev, const u8 *fw, u32 l - ret = rtw89_h2c_tx(rtwdev, skb, false); - if (ret) { - rtw89_err(rtwdev, "failed to send h2c\n"); -- ret = -1; - goto fail; - } - -@@ -816,7 +815,6 @@ static int __rtw89_fw_download_main(struct rtw89_dev *rtwdev, - ret = rtw89_h2c_tx(rtwdev, skb, true); - if (ret) { - rtw89_err(rtwdev, "failed to send h2c\n"); -- ret = -1; - goto fail; - } - -diff --git a/drivers/net/wireless/realtek/rtw89/regd.c b/drivers/net/wireless/realtek/rtw89/regd.c -index 9e2328db186560..91f0895d9f5404 100644 ---- a/drivers/net/wireless/realtek/rtw89/regd.c -+++ b/drivers/net/wireless/realtek/rtw89/regd.c -@@ -451,6 +451,7 @@ void rtw89_regd_notifier(struct wiphy *wiphy, struct regulatory_request *request - struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy); - struct rtw89_dev *rtwdev = hw->priv; - -+ wiphy_lock(wiphy); - mutex_lock(&rtwdev->mutex); - rtw89_leave_ps_mode(rtwdev); - -@@ -468,6 +469,7 @@ void rtw89_regd_notifier(struct wiphy *wiphy, struct regulatory_request *request - - exit: - mutex_unlock(&rtwdev->mutex); -+ wiphy_unlock(wiphy); - } - - static void __rtw89_reg_6ghz_power_recalc(struct rtw89_dev *rtwdev) -diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c -index 01b17b8f4ff9dc..45165cf3e824e6 100644 ---- a/drivers/net/wireless/realtek/rtw89/ser.c -+++ b/drivers/net/wireless/realtek/rtw89/ser.c -@@ -156,9 +156,11 @@ static void ser_state_run(struct rtw89_ser *ser, u8 evt) - rtw89_debug(rtwdev, RTW89_DBG_SER, "ser: %s receive %s\n", - ser_st_name(ser), ser_ev_name(ser, evt)); - -+ wiphy_lock(rtwdev->hw->wiphy); - mutex_lock(&rtwdev->mutex); - rtw89_leave_lps(rtwdev); - mutex_unlock(&rtwdev->mutex); -+ wiphy_unlock(rtwdev->hw->wiphy); - - ser->st_tbl[ser->state].st_func(ser, evt); - } -@@ -676,9 +678,11 @@ static void ser_l2_reset_st_hdl(struct rtw89_ser *ser, u8 evt) - - switch (evt) { - case SER_EV_STATE_IN: -+ wiphy_lock(rtwdev->hw->wiphy); - mutex_lock(&rtwdev->mutex); - ser_l2_reset_st_pre_hdl(ser); - mutex_unlock(&rtwdev->mutex); -+ wiphy_unlock(rtwdev->hw->wiphy); - - ieee80211_restart_hw(rtwdev->hw); - ser_set_alarm(ser, SER_RECFG_TIMEOUT, SER_EV_L2_RECFG_TIMEOUT); -diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c -index 082253a3a95607..04f4a049599a1a 100644 ---- a/drivers/nvdimm/label.c -+++ b/drivers/nvdimm/label.c -@@ -442,7 +442,8 @@ int nd_label_data_init(struct nvdimm_drvdata *ndd) - if (ndd->data) - return 0; - -- if (ndd->nsarea.status || ndd->nsarea.max_xfer == 0) { -+ if (ndd->nsarea.status || ndd->nsarea.max_xfer == 0 || -+ ndd->nsarea.config_size == 0) { - dev_dbg(ndd->dev, "failed to init config data area: (%u:%u)\n", - ndd->nsarea.max_xfer, ndd->nsarea.config_size); - return -ENXIO; -diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c -index 1e5c8220e365ca..97ab91a479d112 100644 ---- a/drivers/nvme/host/pci.c -+++ b/drivers/nvme/host/pci.c -@@ -3429,6 +3429,9 @@ static const struct pci_device_id nvme_id_table[] = { - .driver_data = NVME_QUIRK_BOGUS_NID, }, - { PCI_DEVICE(0x1217, 0x8760), /* O2 Micro 64GB Steam Deck */ - .driver_data = NVME_QUIRK_DMAPOOL_ALIGN_512, }, -+ { PCI_DEVICE(0x126f, 0x1001), /* Silicon Motion generic */ -+ .driver_data = NVME_QUIRK_NO_DEEPEST_PS | -+ NVME_QUIRK_IGNORE_DEV_SUBNQN, }, - { PCI_DEVICE(0x126f, 0x2262), /* Silicon Motion generic */ - .driver_data = NVME_QUIRK_NO_DEEPEST_PS | - NVME_QUIRK_BOGUS_NID, }, -@@ -3452,6 +3455,9 @@ static const struct pci_device_id nvme_id_table[] = { - NVME_QUIRK_IGNORE_DEV_SUBNQN, }, - { PCI_DEVICE(0x15b7, 0x5008), /* Sandisk SN530 */ - .driver_data = NVME_QUIRK_BROKEN_MSI }, -+ { PCI_DEVICE(0x15b7, 0x5009), /* Sandisk SN550 */ -+ .driver_data = NVME_QUIRK_BROKEN_MSI | -+ NVME_QUIRK_NO_DEEPEST_PS }, - { PCI_DEVICE(0x1987, 0x5012), /* Phison E12 */ - .driver_data = NVME_QUIRK_BOGUS_NID, }, - { PCI_DEVICE(0x1987, 0x5016), /* Phison E16 */ -@@ -3535,6 +3541,8 @@ static const struct pci_device_id nvme_id_table[] = { - .driver_data = NVME_QUIRK_NO_DEEPEST_PS, }, - { PCI_DEVICE(0x1e49, 0x0041), /* ZHITAI TiPro7000 NVMe SSD */ - .driver_data = NVME_QUIRK_NO_DEEPEST_PS, }, -+ { PCI_DEVICE(0x025e, 0xf1ac), /* SOLIDIGM P44 pro SSDPFKKW020X7 */ -+ .driver_data = NVME_QUIRK_NO_DEEPEST_PS, }, - { PCI_DEVICE(0xc0a9, 0x540a), /* Crucial P2 */ - .driver_data = NVME_QUIRK_BOGUS_NID, }, - { PCI_DEVICE(0x1d97, 0x2263), /* Lexar NM610 */ -diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c -index a0af659a4c4a21..6a539c3b8b530e 100644 ---- a/drivers/nvme/target/tcp.c -+++ b/drivers/nvme/target/tcp.c -@@ -1456,6 +1456,9 @@ static void nvmet_tcp_restore_socket_callbacks(struct nvmet_tcp_queue *queue) - { - struct socket *sock = queue->sock; - -+ if (!queue->state_change) -+ return; -+ - write_lock_bh(&sock->sk->sk_callback_lock); - sock->sk->sk_data_ready = queue->data_ready; - sock->sk->sk_state_change = queue->state_change; -diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c -index 3ea94bc26e8003..dd00cc09ae5ec5 100644 ---- a/drivers/nvmem/core.c -+++ b/drivers/nvmem/core.c -@@ -456,9 +456,11 @@ static int nvmem_cell_info_to_nvmem_cell_entry_nodup(struct nvmem_device *nvmem, - cell->nbits = info->nbits; - cell->np = info->np; - -- if (cell->nbits) -+ if (cell->nbits) { - cell->bytes = DIV_ROUND_UP(cell->nbits + cell->bit_offset, - BITS_PER_BYTE); -+ cell->raw_len = ALIGN(cell->bytes, nvmem->word_size); -+ } - - if (!IS_ALIGNED(cell->offset, nvmem->stride)) { - dev_err(&nvmem->dev, -@@ -467,6 +469,18 @@ static int nvmem_cell_info_to_nvmem_cell_entry_nodup(struct nvmem_device *nvmem, - return -EINVAL; - } - -+ if (!IS_ALIGNED(cell->raw_len, nvmem->word_size)) { -+ dev_err(&nvmem->dev, -+ "cell %s raw len %zd unaligned to nvmem word size %d\n", -+ cell->name ?: "", cell->raw_len, -+ nvmem->word_size); -+ -+ if (info->raw_len) -+ return -EINVAL; -+ -+ cell->raw_len = ALIGN(cell->raw_len, nvmem->word_size); -+ } -+ - return 0; - } - -diff --git a/drivers/nvmem/qfprom.c b/drivers/nvmem/qfprom.c -index 6c554040c6e67d..7b0621fdbc82e2 100644 ---- a/drivers/nvmem/qfprom.c -+++ b/drivers/nvmem/qfprom.c -@@ -321,19 +321,32 @@ static int qfprom_reg_read(void *context, - unsigned int reg, void *_val, size_t bytes) - { - struct qfprom_priv *priv = context; -- u8 *val = _val; -- int i = 0, words = bytes; -+ u32 *val = _val; - void __iomem *base = priv->qfpcorrected; -+ int words = DIV_ROUND_UP(bytes, sizeof(u32)); -+ int i; - - if (read_raw_data && priv->qfpraw) - base = priv->qfpraw; - -- while (words--) -- *val++ = readb(base + reg + i++); -+ for (i = 0; i < words; i++) -+ *val++ = readl(base + reg + i * sizeof(u32)); - - return 0; - } - -+/* Align reads to word boundary */ -+static void qfprom_fixup_dt_cell_info(struct nvmem_device *nvmem, -+ struct nvmem_cell_info *cell) -+{ -+ unsigned int byte_offset = cell->offset % sizeof(u32); -+ -+ cell->bit_offset += byte_offset * BITS_PER_BYTE; -+ cell->offset -= byte_offset; -+ if (byte_offset && !cell->nbits) -+ cell->nbits = cell->bytes * BITS_PER_BYTE; -+} -+ - static void qfprom_runtime_disable(void *data) - { - pm_runtime_disable(data); -@@ -358,10 +371,11 @@ static int qfprom_probe(struct platform_device *pdev) - struct nvmem_config econfig = { - .name = "qfprom", - .add_legacy_fixed_of_cells = true, -- .stride = 1, -- .word_size = 1, -+ .stride = 4, -+ .word_size = 4, - .id = NVMEM_DEVID_AUTO, - .reg_read = qfprom_reg_read, -+ .fixup_dt_cell_info = qfprom_fixup_dt_cell_info, - }; - struct device *dev = &pdev->dev; - struct resource *res; -diff --git a/drivers/nvmem/rockchip-otp.c b/drivers/nvmem/rockchip-otp.c -index 7107d68a2f8c75..c6684ab14e742e 100644 ---- a/drivers/nvmem/rockchip-otp.c -+++ b/drivers/nvmem/rockchip-otp.c -@@ -59,7 +59,6 @@ - #define RK3588_OTPC_AUTO_EN 0x08 - #define RK3588_OTPC_INT_ST 0x84 - #define RK3588_OTPC_DOUT0 0x20 --#define RK3588_NO_SECURE_OFFSET 0x300 - #define RK3588_NBYTES 4 - #define RK3588_BURST_NUM 1 - #define RK3588_BURST_SHIFT 8 -@@ -69,6 +68,7 @@ - - struct rockchip_data { - int size; -+ int read_offset; - const char * const *clks; - int num_clks; - nvmem_reg_read_t reg_read; -@@ -196,7 +196,7 @@ static int rk3588_otp_read(void *context, unsigned int offset, - addr_start = round_down(offset, RK3588_NBYTES) / RK3588_NBYTES; - addr_end = round_up(offset + bytes, RK3588_NBYTES) / RK3588_NBYTES; - addr_len = addr_end - addr_start; -- addr_start += RK3588_NO_SECURE_OFFSET; -+ addr_start += otp->data->read_offset / RK3588_NBYTES; - - buf = kzalloc(array_size(addr_len, RK3588_NBYTES), GFP_KERNEL); - if (!buf) -@@ -273,12 +273,21 @@ static const struct rockchip_data px30_data = { - .reg_read = px30_otp_read, - }; - -+static const struct rockchip_data rk3576_data = { -+ .size = 0x100, -+ .read_offset = 0x700, -+ .clks = px30_otp_clocks, -+ .num_clks = ARRAY_SIZE(px30_otp_clocks), -+ .reg_read = rk3588_otp_read, -+}; -+ - static const char * const rk3588_otp_clocks[] = { - "otp", "apb_pclk", "phy", "arb", - }; - - static const struct rockchip_data rk3588_data = { - .size = 0x400, -+ .read_offset = 0xc00, - .clks = rk3588_otp_clocks, - .num_clks = ARRAY_SIZE(rk3588_otp_clocks), - .reg_read = rk3588_otp_read, -@@ -293,6 +302,10 @@ static const struct of_device_id rockchip_otp_match[] = { - .compatible = "rockchip,rk3308-otp", - .data = &px30_data, - }, -+ { -+ .compatible = "rockchip,rk3576-otp", -+ .data = &rk3576_data, -+ }, - { - .compatible = "rockchip,rk3588-otp", - .data = &rk3588_data, -diff --git a/drivers/pci/Kconfig b/drivers/pci/Kconfig -index e9ae66cc4189b1..a3927daebeb024 100644 ---- a/drivers/pci/Kconfig -+++ b/drivers/pci/Kconfig -@@ -180,6 +180,12 @@ config PCI_P2PDMA - P2P DMA transactions must be between devices behind the same root - port. - -+ Enabling this option will reduce the entropy of x86 KASLR memory -+ regions. For example - on a 46 bit system, the entropy goes down -+ from 16 bits to 15 bits. The actual reduction in entropy depends -+ on the physical address bits, on processor features, kernel config -+ (5 level page table) and physical memory present on the system. -+ - If unsure, say N. - - config PCI_LABEL -diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c -index f2e5feba552678..26ad643fb42484 100644 ---- a/drivers/pci/controller/dwc/pcie-designware-ep.c -+++ b/drivers/pci/controller/dwc/pcie-designware-ep.c -@@ -281,7 +281,7 @@ static int dw_pcie_find_index(struct dw_pcie_ep *ep, phys_addr_t addr, - u32 index; - struct dw_pcie *pci = to_dw_pcie_from_ep(ep); - -- for (index = 0; index < pci->num_ob_windows; index++) { -+ for_each_set_bit(index, ep->ob_window_map, pci->num_ob_windows) { - if (ep->outbound_addr[index] != addr) - continue; - *atu_index = index; -diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c -index 940af934ce1bb8..9bcf4c68058eb3 100644 ---- a/drivers/pci/controller/pcie-brcmstb.c -+++ b/drivers/pci/controller/pcie-brcmstb.c -@@ -284,8 +284,8 @@ static int brcm_pcie_encode_ibar_size(u64 size) - if (log2_in >= 12 && log2_in <= 15) - /* Covers 4KB to 32KB (inclusive) */ - return (log2_in - 12) + 0x1c; -- else if (log2_in >= 16 && log2_in <= 35) -- /* Covers 64KB to 32GB, (inclusive) */ -+ else if (log2_in >= 16 && log2_in <= 36) -+ /* Covers 64KB to 64GB, (inclusive) */ - return log2_in - 15; - /* Something is awry so disable */ - return 0; -@@ -1632,3 +1632,4 @@ module_platform_driver(brcm_pcie_driver); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Broadcom STB PCIe RC driver"); - MODULE_AUTHOR("Broadcom"); -+MODULE_SOFTDEP("pre: irq_bcm2712_mip"); -diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c -index dfa222e02c4da9..ad82feff0405ee 100644 ---- a/drivers/pci/controller/vmd.c -+++ b/drivers/pci/controller/vmd.c -@@ -17,6 +17,8 @@ - #include - #include - -+#include -+ - #include - - #define VMD_CFGBAR 0 -@@ -981,6 +983,24 @@ static int vmd_probe(struct pci_dev *dev, const struct pci_device_id *id) - struct vmd_dev *vmd; - int err; - -+ if (xen_domain()) { -+ /* -+ * Xen doesn't have knowledge about devices in the VMD bus -+ * because the config space of devices behind the VMD bridge is -+ * not known to Xen, and hence Xen cannot discover or configure -+ * them in any way. -+ * -+ * Bypass of MSI remapping won't work in that case as direct -+ * write by Linux to the MSI entries won't result in functional -+ * interrupts, as Xen is the entity that manages the host -+ * interrupt controller and must configure interrupts. However -+ * multiplexing of interrupts by the VMD bridge will work under -+ * Xen, so force the usage of that mode which must always be -+ * supported by VMD bridges. -+ */ -+ features &= ~VMD_FEAT_CAN_BYPASS_MSI_REMAP; -+ } -+ - if (resource_size(&dev->resource[VMD_CFGBAR]) < (1 << 20)) - return -ENOMEM; - -diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c -index fba402f4f6330d..3f40be417856e0 100644 ---- a/drivers/pci/setup-bus.c -+++ b/drivers/pci/setup-bus.c -@@ -802,11 +802,9 @@ static resource_size_t calculate_iosize(resource_size_t size, - size = (size & 0xff) + ((size & ~0xffUL) << 2); - #endif - size = size + size1; -- if (size < old_size) -- size = old_size; - -- size = ALIGN(max(size, add_size) + children_add_size, align); -- return size; -+ size = max(size, add_size) + children_add_size; -+ return ALIGN(max(size, old_size), align); - } - - static resource_size_t calculate_memsize(resource_size_t size, -diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c -index 7bd1733d797703..77aa37de59880f 100644 ---- a/drivers/perf/arm-cmn.c -+++ b/drivers/perf/arm-cmn.c -@@ -684,8 +684,8 @@ static umode_t arm_cmn_event_attr_is_visible(struct kobject *kobj, - - if ((chan == 5 && cmn->rsp_vc_num < 2) || - (chan == 6 && cmn->dat_vc_num < 2) || -- (chan == 7 && cmn->snp_vc_num < 2) || -- (chan == 8 && cmn->req_vc_num < 2)) -+ (chan == 7 && cmn->req_vc_num < 2) || -+ (chan == 8 && cmn->snp_vc_num < 2)) - return 0; - } - -@@ -841,8 +841,8 @@ static umode_t arm_cmn_event_attr_is_visible(struct kobject *kobj, - _CMN_EVENT_XP(pub_##_name, (_event) | (4 << 5)), \ - _CMN_EVENT_XP(rsp2_##_name, (_event) | (5 << 5)), \ - _CMN_EVENT_XP(dat2_##_name, (_event) | (6 << 5)), \ -- _CMN_EVENT_XP(snp2_##_name, (_event) | (7 << 5)), \ -- _CMN_EVENT_XP(req2_##_name, (_event) | (8 << 5)) -+ _CMN_EVENT_XP(req2_##_name, (_event) | (7 << 5)), \ -+ _CMN_EVENT_XP(snp2_##_name, (_event) | (8 << 5)) - - #define CMN_EVENT_XP_DAT(_name, _event) \ - _CMN_EVENT_XP_PORT(dat_##_name, (_event) | (3 << 5)), \ -@@ -2443,6 +2443,7 @@ static int arm_cmn_probe(struct platform_device *pdev) - - cmn->dev = &pdev->dev; - cmn->part = (unsigned long)device_get_match_data(cmn->dev); -+ cmn->cpu = cpumask_local_spread(0, dev_to_node(cmn->dev)); - platform_set_drvdata(pdev, cmn); - - if (cmn->part == PART_CMN600 && has_acpi_companion(cmn->dev)) { -@@ -2470,7 +2471,6 @@ static int arm_cmn_probe(struct platform_device *pdev) - if (err) - return err; - -- cmn->cpu = cpumask_local_spread(0, dev_to_node(cmn->dev)); - cmn->pmu = (struct pmu) { - .module = THIS_MODULE, - .attr_groups = arm_cmn_attr_groups, -diff --git a/drivers/perf/arm_pmuv3.c b/drivers/perf/arm_pmuv3.c -index 0e8f54168cb641..0858e6096453ef 100644 ---- a/drivers/perf/arm_pmuv3.c -+++ b/drivers/perf/arm_pmuv3.c -@@ -751,10 +751,10 @@ static void armv8pmu_start(struct arm_pmu *cpu_pmu) - else - armv8pmu_disable_user_access(); - -+ kvm_vcpu_pmu_resync_el0(); -+ - /* Enable all counters */ - armv8pmu_pmcr_write(armv8pmu_pmcr_read() | ARMV8_PMU_PMCR_E); -- -- kvm_vcpu_pmu_resync_el0(); - } - - static void armv8pmu_stop(struct arm_pmu *cpu_pmu) -diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c -index a892e1d7e2d024..9417372a015547 100644 ---- a/drivers/phy/phy-core.c -+++ b/drivers/phy/phy-core.c -@@ -400,13 +400,14 @@ EXPORT_SYMBOL_GPL(phy_power_off); - - int phy_set_mode_ext(struct phy *phy, enum phy_mode mode, int submode) - { -- int ret; -+ int ret = 0; - -- if (!phy || !phy->ops->set_mode) -+ if (!phy) - return 0; - - mutex_lock(&phy->mutex); -- ret = phy->ops->set_mode(phy, mode, submode); -+ if (phy->ops->set_mode) -+ ret = phy->ops->set_mode(phy, mode, submode); - if (!ret) - phy->attrs.mode = mode; - mutex_unlock(&phy->mutex); -diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c -index aa578be2bcb6df..9a6391361a0bed 100644 ---- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c -+++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c -@@ -9,6 +9,7 @@ - * Copyright (C) 2014 Cogent Embedded, Inc. - */ - -+#include - #include - #include - #include -@@ -19,12 +20,14 @@ - #include - #include - #include -+#include - #include - #include - #include - - /******* USB2.0 Host registers (original offset is +0x200) *******/ - #define USB2_INT_ENABLE 0x000 -+#define USB2_AHB_BUS_CTR 0x008 - #define USB2_USBCTR 0x00c - #define USB2_SPD_RSM_TIMSET 0x10c - #define USB2_OC_TIMSET 0x110 -@@ -40,6 +43,10 @@ - #define USB2_INT_ENABLE_USBH_INTB_EN BIT(2) /* For EHCI */ - #define USB2_INT_ENABLE_USBH_INTA_EN BIT(1) /* For OHCI */ - -+/* AHB_BUS_CTR */ -+#define USB2_AHB_BUS_CTR_MBL_MASK GENMASK(1, 0) -+#define USB2_AHB_BUS_CTR_MBL_INCR4 2 -+ - /* USBCTR */ - #define USB2_USBCTR_DIRPD BIT(2) - #define USB2_USBCTR_PLL_RST BIT(1) -@@ -110,10 +117,10 @@ struct rcar_gen3_chan { - struct extcon_dev *extcon; - struct rcar_gen3_phy rphys[NUM_OF_PHYS]; - struct regulator *vbus; -+ struct reset_control *rstc; - struct work_struct work; -- struct mutex lock; /* protects rphys[...].powered */ -+ spinlock_t lock; /* protects access to hardware and driver data structure. */ - enum usb_dr_mode dr_mode; -- int irq; - u32 obint_enable_bits; - bool extcon_host; - bool is_otg_channel; -@@ -124,6 +131,7 @@ struct rcar_gen3_chan { - struct rcar_gen3_phy_drv_data { - const struct phy_ops *phy_usb2_ops; - bool no_adp_ctrl; -+ bool init_bus; - }; - - /* -@@ -338,6 +346,8 @@ static ssize_t role_store(struct device *dev, struct device_attribute *attr, - bool is_b_device; - enum phy_mode cur_mode, new_mode; - -+ guard(spinlock_irqsave)(&ch->lock); -+ - if (!ch->is_otg_channel || !rcar_gen3_is_any_otg_rphy_initialized(ch)) - return -EIO; - -@@ -405,7 +415,7 @@ static void rcar_gen3_init_otg(struct rcar_gen3_chan *ch) - val = readl(usb2_base + USB2_ADPCTRL); - writel(val | USB2_ADPCTRL_IDPULLUP, usb2_base + USB2_ADPCTRL); - } -- msleep(20); -+ mdelay(20); - - writel(0xffffffff, usb2_base + USB2_OBINTSTA); - writel(ch->obint_enable_bits, usb2_base + USB2_OBINTEN); -@@ -417,16 +427,27 @@ static irqreturn_t rcar_gen3_phy_usb2_irq(int irq, void *_ch) - { - struct rcar_gen3_chan *ch = _ch; - void __iomem *usb2_base = ch->base; -- u32 status = readl(usb2_base + USB2_OBINTSTA); -+ struct device *dev = ch->dev; - irqreturn_t ret = IRQ_NONE; -+ u32 status; -+ -+ pm_runtime_get_noresume(dev); -+ -+ if (pm_runtime_suspended(dev)) -+ goto rpm_put; - -- if (status & ch->obint_enable_bits) { -- dev_vdbg(ch->dev, "%s: %08x\n", __func__, status); -- writel(ch->obint_enable_bits, usb2_base + USB2_OBINTSTA); -- rcar_gen3_device_recognition(ch); -- ret = IRQ_HANDLED; -+ scoped_guard(spinlock, &ch->lock) { -+ status = readl(usb2_base + USB2_OBINTSTA); -+ if (status & ch->obint_enable_bits) { -+ dev_vdbg(dev, "%s: %08x\n", __func__, status); -+ writel(ch->obint_enable_bits, usb2_base + USB2_OBINTSTA); -+ rcar_gen3_device_recognition(ch); -+ ret = IRQ_HANDLED; -+ } - } - -+rpm_put: -+ pm_runtime_put_noidle(dev); - return ret; - } - -@@ -436,17 +457,8 @@ static int rcar_gen3_phy_usb2_init(struct phy *p) - struct rcar_gen3_chan *channel = rphy->ch; - void __iomem *usb2_base = channel->base; - u32 val; -- int ret; - -- if (!rcar_gen3_is_any_rphy_initialized(channel) && channel->irq >= 0) { -- INIT_WORK(&channel->work, rcar_gen3_phy_usb2_work); -- ret = request_irq(channel->irq, rcar_gen3_phy_usb2_irq, -- IRQF_SHARED, dev_name(channel->dev), channel); -- if (ret < 0) { -- dev_err(channel->dev, "No irq handler (%d)\n", channel->irq); -- return ret; -- } -- } -+ guard(spinlock_irqsave)(&channel->lock); - - /* Initialize USB2 part */ - val = readl(usb2_base + USB2_INT_ENABLE); -@@ -474,6 +486,8 @@ static int rcar_gen3_phy_usb2_exit(struct phy *p) - void __iomem *usb2_base = channel->base; - u32 val; - -+ guard(spinlock_irqsave)(&channel->lock); -+ - rphy->initialized = false; - - val = readl(usb2_base + USB2_INT_ENABLE); -@@ -482,9 +496,6 @@ static int rcar_gen3_phy_usb2_exit(struct phy *p) - val &= ~USB2_INT_ENABLE_UCOM_INTEN; - writel(val, usb2_base + USB2_INT_ENABLE); - -- if (channel->irq >= 0 && !rcar_gen3_is_any_rphy_initialized(channel)) -- free_irq(channel->irq, channel); -- - return 0; - } - -@@ -496,16 +507,17 @@ static int rcar_gen3_phy_usb2_power_on(struct phy *p) - u32 val; - int ret = 0; - -- mutex_lock(&channel->lock); -- if (!rcar_gen3_are_all_rphys_power_off(channel)) -- goto out; -- - if (channel->vbus) { - ret = regulator_enable(channel->vbus); - if (ret) -- goto out; -+ return ret; - } - -+ guard(spinlock_irqsave)(&channel->lock); -+ -+ if (!rcar_gen3_are_all_rphys_power_off(channel)) -+ goto out; -+ - val = readl(usb2_base + USB2_USBCTR); - val |= USB2_USBCTR_PLL_RST; - writel(val, usb2_base + USB2_USBCTR); -@@ -515,7 +527,6 @@ static int rcar_gen3_phy_usb2_power_on(struct phy *p) - out: - /* The powered flag should be set for any other phys anyway */ - rphy->powered = true; -- mutex_unlock(&channel->lock); - - return 0; - } -@@ -526,18 +537,20 @@ static int rcar_gen3_phy_usb2_power_off(struct phy *p) - struct rcar_gen3_chan *channel = rphy->ch; - int ret = 0; - -- mutex_lock(&channel->lock); -- rphy->powered = false; -+ scoped_guard(spinlock_irqsave, &channel->lock) { -+ rphy->powered = false; - -- if (!rcar_gen3_are_all_rphys_power_off(channel)) -- goto out; -+ if (rcar_gen3_are_all_rphys_power_off(channel)) { -+ u32 val = readl(channel->base + USB2_USBCTR); -+ -+ val |= USB2_USBCTR_PLL_RST; -+ writel(val, channel->base + USB2_USBCTR); -+ } -+ } - - if (channel->vbus) - ret = regulator_disable(channel->vbus); - --out: -- mutex_unlock(&channel->lock); -- - return ret; - } - -@@ -645,13 +658,42 @@ static enum usb_dr_mode rcar_gen3_get_dr_mode(struct device_node *np) - return candidate; - } - -+static int rcar_gen3_phy_usb2_init_bus(struct rcar_gen3_chan *channel) -+{ -+ struct device *dev = channel->dev; -+ int ret; -+ u32 val; -+ -+ channel->rstc = devm_reset_control_array_get_shared(dev); -+ if (IS_ERR(channel->rstc)) -+ return PTR_ERR(channel->rstc); -+ -+ ret = pm_runtime_resume_and_get(dev); -+ if (ret) -+ return ret; -+ -+ ret = reset_control_deassert(channel->rstc); -+ if (ret) -+ goto rpm_put; -+ -+ val = readl(channel->base + USB2_AHB_BUS_CTR); -+ val &= ~USB2_AHB_BUS_CTR_MBL_MASK; -+ val |= USB2_AHB_BUS_CTR_MBL_INCR4; -+ writel(val, channel->base + USB2_AHB_BUS_CTR); -+ -+rpm_put: -+ pm_runtime_put(dev); -+ -+ return ret; -+} -+ - static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev) - { - const struct rcar_gen3_phy_drv_data *phy_data; - struct device *dev = &pdev->dev; - struct rcar_gen3_chan *channel; - struct phy_provider *provider; -- int ret = 0, i; -+ int ret = 0, i, irq; - - if (!dev->of_node) { - dev_err(dev, "This driver needs device tree\n"); -@@ -667,8 +709,6 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev) - return PTR_ERR(channel->base); - - channel->obint_enable_bits = USB2_OBINT_BITS; -- /* get irq number here and request_irq for OTG in phy_init */ -- channel->irq = platform_get_irq_optional(pdev, 0); - channel->dr_mode = rcar_gen3_get_dr_mode(dev->of_node); - if (channel->dr_mode != USB_DR_MODE_UNKNOWN) { - channel->is_otg_channel = true; -@@ -698,11 +738,20 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev) - goto error; - } - -+ platform_set_drvdata(pdev, channel); -+ channel->dev = dev; -+ -+ if (phy_data->init_bus) { -+ ret = rcar_gen3_phy_usb2_init_bus(channel); -+ if (ret) -+ goto error; -+ } -+ - channel->soc_no_adp_ctrl = phy_data->no_adp_ctrl; - if (phy_data->no_adp_ctrl) - channel->obint_enable_bits = USB2_OBINT_IDCHG_EN; - -- mutex_init(&channel->lock); -+ spin_lock_init(&channel->lock); - for (i = 0; i < NUM_OF_PHYS; i++) { - channel->rphys[i].phy = devm_phy_create(dev, NULL, - phy_data->phy_usb2_ops); -@@ -725,8 +774,19 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev) - channel->vbus = NULL; - } - -- platform_set_drvdata(pdev, channel); -- channel->dev = dev; -+ irq = platform_get_irq_optional(pdev, 0); -+ if (irq < 0 && irq != -ENXIO) { -+ ret = irq; -+ goto error; -+ } else if (irq > 0) { -+ INIT_WORK(&channel->work, rcar_gen3_phy_usb2_work); -+ ret = devm_request_irq(dev, irq, rcar_gen3_phy_usb2_irq, -+ IRQF_SHARED, dev_name(dev), channel); -+ if (ret < 0) { -+ dev_err(dev, "Failed to request irq (%d)\n", irq); -+ goto error; -+ } -+ } - - provider = devm_of_phy_provider_register(dev, rcar_gen3_phy_usb2_xlate); - if (IS_ERR(provider)) { -@@ -754,6 +814,7 @@ static void rcar_gen3_phy_usb2_remove(struct platform_device *pdev) - if (channel->is_otg_channel) - device_remove_file(&pdev->dev, &dev_attr_role); - -+ reset_control_assert(channel->rstc); - pm_runtime_disable(&pdev->dev); - }; - -diff --git a/drivers/phy/starfive/phy-jh7110-usb.c b/drivers/phy/starfive/phy-jh7110-usb.c -index 633912f8a05d04..bf52b41110db8e 100644 ---- a/drivers/phy/starfive/phy-jh7110-usb.c -+++ b/drivers/phy/starfive/phy-jh7110-usb.c -@@ -16,6 +16,8 @@ - #include - - #define USB_125M_CLK_RATE 125000000 -+#define USB_CLK_MODE_OFF 0x0 -+#define USB_CLK_MODE_RX_NORMAL_PWR BIT(1) - #define USB_LS_KEEPALIVE_OFF 0x4 - #define USB_LS_KEEPALIVE_ENABLE BIT(4) - -@@ -68,6 +70,7 @@ static int jh7110_usb2_phy_init(struct phy *_phy) - { - struct jh7110_usb2_phy *phy = phy_get_drvdata(_phy); - int ret; -+ unsigned int val; - - ret = clk_set_rate(phy->usb_125m_clk, USB_125M_CLK_RATE); - if (ret) -@@ -77,6 +80,10 @@ static int jh7110_usb2_phy_init(struct phy *_phy) - if (ret) - return ret; - -+ val = readl(phy->regs + USB_CLK_MODE_OFF); -+ val |= USB_CLK_MODE_RX_NORMAL_PWR; -+ writel(val, phy->regs + USB_CLK_MODE_OFF); -+ - return 0; - } - -diff --git a/drivers/pinctrl/bcm/pinctrl-bcm281xx.c b/drivers/pinctrl/bcm/pinctrl-bcm281xx.c -index cf6efa9c0364a1..a039b490cdb8e6 100644 ---- a/drivers/pinctrl/bcm/pinctrl-bcm281xx.c -+++ b/drivers/pinctrl/bcm/pinctrl-bcm281xx.c -@@ -72,7 +72,7 @@ static enum bcm281xx_pin_type hdmi_pin = BCM281XX_PIN_TYPE_HDMI; - struct bcm281xx_pin_function { - const char *name; - const char * const *groups; -- const unsigned ngroups; -+ const unsigned int ngroups; - }; - - /* -@@ -84,10 +84,10 @@ struct bcm281xx_pinctrl_data { - - /* List of all pins */ - const struct pinctrl_pin_desc *pins; -- const unsigned npins; -+ const unsigned int npins; - - const struct bcm281xx_pin_function *functions; -- const unsigned nfunctions; -+ const unsigned int nfunctions; - - struct regmap *regmap; - }; -@@ -941,7 +941,7 @@ static struct bcm281xx_pinctrl_data bcm281xx_pinctrl = { - }; - - static inline enum bcm281xx_pin_type pin_type_get(struct pinctrl_dev *pctldev, -- unsigned pin) -+ unsigned int pin) - { - struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev); - -@@ -985,7 +985,7 @@ static int bcm281xx_pinctrl_get_groups_count(struct pinctrl_dev *pctldev) - } - - static const char *bcm281xx_pinctrl_get_group_name(struct pinctrl_dev *pctldev, -- unsigned group) -+ unsigned int group) - { - struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev); - -@@ -993,9 +993,9 @@ static const char *bcm281xx_pinctrl_get_group_name(struct pinctrl_dev *pctldev, - } - - static int bcm281xx_pinctrl_get_group_pins(struct pinctrl_dev *pctldev, -- unsigned group, -+ unsigned int group, - const unsigned **pins, -- unsigned *num_pins) -+ unsigned int *num_pins) - { - struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev); - -@@ -1007,7 +1007,7 @@ static int bcm281xx_pinctrl_get_group_pins(struct pinctrl_dev *pctldev, - - static void bcm281xx_pinctrl_pin_dbg_show(struct pinctrl_dev *pctldev, - struct seq_file *s, -- unsigned offset) -+ unsigned int offset) - { - seq_printf(s, " %s", dev_name(pctldev->dev)); - } -@@ -1029,7 +1029,7 @@ static int bcm281xx_pinctrl_get_fcns_count(struct pinctrl_dev *pctldev) - } - - static const char *bcm281xx_pinctrl_get_fcn_name(struct pinctrl_dev *pctldev, -- unsigned function) -+ unsigned int function) - { - struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev); - -@@ -1037,9 +1037,9 @@ static const char *bcm281xx_pinctrl_get_fcn_name(struct pinctrl_dev *pctldev, - } - - static int bcm281xx_pinctrl_get_fcn_groups(struct pinctrl_dev *pctldev, -- unsigned function, -+ unsigned int function, - const char * const **groups, -- unsigned * const num_groups) -+ unsigned int * const num_groups) - { - struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev); - -@@ -1050,8 +1050,8 @@ static int bcm281xx_pinctrl_get_fcn_groups(struct pinctrl_dev *pctldev, - } - - static int bcm281xx_pinmux_set(struct pinctrl_dev *pctldev, -- unsigned function, -- unsigned group) -+ unsigned int function, -+ unsigned int group) - { - struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev); - const struct bcm281xx_pin_function *f = &pdata->functions[function]; -@@ -1082,7 +1082,7 @@ static const struct pinmux_ops bcm281xx_pinctrl_pinmux_ops = { - }; - - static int bcm281xx_pinctrl_pin_config_get(struct pinctrl_dev *pctldev, -- unsigned pin, -+ unsigned int pin, - unsigned long *config) - { - return -ENOTSUPP; -@@ -1091,9 +1091,9 @@ static int bcm281xx_pinctrl_pin_config_get(struct pinctrl_dev *pctldev, - - /* Goes through the configs and update register val/mask */ - static int bcm281xx_std_pin_update(struct pinctrl_dev *pctldev, -- unsigned pin, -+ unsigned int pin, - unsigned long *configs, -- unsigned num_configs, -+ unsigned int num_configs, - u32 *val, - u32 *mask) - { -@@ -1207,9 +1207,9 @@ static const u16 bcm281xx_pullup_map[] = { - - /* Goes through the configs and update register val/mask */ - static int bcm281xx_i2c_pin_update(struct pinctrl_dev *pctldev, -- unsigned pin, -+ unsigned int pin, - unsigned long *configs, -- unsigned num_configs, -+ unsigned int num_configs, - u32 *val, - u32 *mask) - { -@@ -1277,9 +1277,9 @@ static int bcm281xx_i2c_pin_update(struct pinctrl_dev *pctldev, - - /* Goes through the configs and update register val/mask */ - static int bcm281xx_hdmi_pin_update(struct pinctrl_dev *pctldev, -- unsigned pin, -+ unsigned int pin, - unsigned long *configs, -- unsigned num_configs, -+ unsigned int num_configs, - u32 *val, - u32 *mask) - { -@@ -1321,9 +1321,9 @@ static int bcm281xx_hdmi_pin_update(struct pinctrl_dev *pctldev, - } - - static int bcm281xx_pinctrl_pin_config_set(struct pinctrl_dev *pctldev, -- unsigned pin, -+ unsigned int pin, - unsigned long *configs, -- unsigned num_configs) -+ unsigned int num_configs) - { - struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev); - enum bcm281xx_pin_type pin_type; -diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c -index 5ee746cb81f591..6520b88db1105b 100644 ---- a/drivers/pinctrl/devicetree.c -+++ b/drivers/pinctrl/devicetree.c -@@ -143,10 +143,14 @@ static int dt_to_map_one_config(struct pinctrl *p, - pctldev = get_pinctrl_dev_from_of_node(np_pctldev); - if (pctldev) - break; -- /* Do not defer probing of hogs (circular loop) */ -+ /* -+ * Do not defer probing of hogs (circular loop) -+ * -+ * Return 1 to let the caller catch the case. -+ */ - if (np_pctldev == p->dev->of_node) { - of_node_put(np_pctldev); -- return -ENODEV; -+ return 1; - } - } - of_node_put(np_pctldev); -@@ -265,6 +269,8 @@ int pinctrl_dt_to_map(struct pinctrl *p, struct pinctrl_dev *pctldev) - ret = dt_to_map_one_config(p, pctldev, statename, - np_config); - of_node_put(np_config); -+ if (ret == 1) -+ continue; - if (ret < 0) - goto err; - } -diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c -index 524424ee6c4e71..5cc00fdc48d840 100644 ---- a/drivers/pinctrl/meson/pinctrl-meson.c -+++ b/drivers/pinctrl/meson/pinctrl-meson.c -@@ -486,7 +486,7 @@ static int meson_pinconf_get(struct pinctrl_dev *pcdev, unsigned int pin, - case PIN_CONFIG_BIAS_PULL_DOWN: - case PIN_CONFIG_BIAS_PULL_UP: - if (meson_pinconf_get_pull(pc, pin) == param) -- arg = 1; -+ arg = 60000; - else - return -EINVAL; - break; -diff --git a/drivers/pinctrl/qcom/pinctrl-apq8064.c b/drivers/pinctrl/qcom/pinctrl-apq8064.c -index 20c3b902504451..a18df416229993 100644 ---- a/drivers/pinctrl/qcom/pinctrl-apq8064.c -+++ b/drivers/pinctrl/qcom/pinctrl-apq8064.c -@@ -629,7 +629,7 @@ static struct platform_driver apq8064_pinctrl_driver = { - .of_match_table = apq8064_pinctrl_of_match, - }, - .probe = apq8064_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init apq8064_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-apq8084.c b/drivers/pinctrl/qcom/pinctrl-apq8084.c -index 3fc0a40762b631..afada80e52a235 100644 ---- a/drivers/pinctrl/qcom/pinctrl-apq8084.c -+++ b/drivers/pinctrl/qcom/pinctrl-apq8084.c -@@ -1207,7 +1207,7 @@ static struct platform_driver apq8084_pinctrl_driver = { - .of_match_table = apq8084_pinctrl_of_match, - }, - .probe = apq8084_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init apq8084_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-ipq4019.c b/drivers/pinctrl/qcom/pinctrl-ipq4019.c -index 1f7944dd829d1b..cb13576ad6cfb4 100644 ---- a/drivers/pinctrl/qcom/pinctrl-ipq4019.c -+++ b/drivers/pinctrl/qcom/pinctrl-ipq4019.c -@@ -710,7 +710,7 @@ static struct platform_driver ipq4019_pinctrl_driver = { - .of_match_table = ipq4019_pinctrl_of_match, - }, - .probe = ipq4019_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init ipq4019_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-ipq5018.c b/drivers/pinctrl/qcom/pinctrl-ipq5018.c -index e2951f81c3eeb3..68f65b57003e91 100644 ---- a/drivers/pinctrl/qcom/pinctrl-ipq5018.c -+++ b/drivers/pinctrl/qcom/pinctrl-ipq5018.c -@@ -754,7 +754,7 @@ static struct platform_driver ipq5018_pinctrl_driver = { - .of_match_table = ipq5018_pinctrl_of_match, - }, - .probe = ipq5018_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init ipq5018_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-ipq5332.c b/drivers/pinctrl/qcom/pinctrl-ipq5332.c -index 625f8014051f6a..88217511897088 100644 ---- a/drivers/pinctrl/qcom/pinctrl-ipq5332.c -+++ b/drivers/pinctrl/qcom/pinctrl-ipq5332.c -@@ -834,7 +834,7 @@ static struct platform_driver ipq5332_pinctrl_driver = { - .of_match_table = ipq5332_pinctrl_of_match, - }, - .probe = ipq5332_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init ipq5332_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-ipq6018.c b/drivers/pinctrl/qcom/pinctrl-ipq6018.c -index 0ad08647dbcdf0..ac330d8712b5cb 100644 ---- a/drivers/pinctrl/qcom/pinctrl-ipq6018.c -+++ b/drivers/pinctrl/qcom/pinctrl-ipq6018.c -@@ -1080,7 +1080,7 @@ static struct platform_driver ipq6018_pinctrl_driver = { - .of_match_table = ipq6018_pinctrl_of_match, - }, - .probe = ipq6018_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init ipq6018_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-ipq8064.c b/drivers/pinctrl/qcom/pinctrl-ipq8064.c -index e2bb94e86aef6e..e10e1bc4c91131 100644 ---- a/drivers/pinctrl/qcom/pinctrl-ipq8064.c -+++ b/drivers/pinctrl/qcom/pinctrl-ipq8064.c -@@ -631,7 +631,7 @@ static struct platform_driver ipq8064_pinctrl_driver = { - .of_match_table = ipq8064_pinctrl_of_match, - }, - .probe = ipq8064_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init ipq8064_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-ipq8074.c b/drivers/pinctrl/qcom/pinctrl-ipq8074.c -index 337f3a1c92c192..fee32c1d1d3e9a 100644 ---- a/drivers/pinctrl/qcom/pinctrl-ipq8074.c -+++ b/drivers/pinctrl/qcom/pinctrl-ipq8074.c -@@ -1041,7 +1041,7 @@ static struct platform_driver ipq8074_pinctrl_driver = { - .of_match_table = ipq8074_pinctrl_of_match, - }, - .probe = ipq8074_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init ipq8074_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-ipq9574.c b/drivers/pinctrl/qcom/pinctrl-ipq9574.c -index e2491617b2364a..20ab59cb621bc3 100644 ---- a/drivers/pinctrl/qcom/pinctrl-ipq9574.c -+++ b/drivers/pinctrl/qcom/pinctrl-ipq9574.c -@@ -799,7 +799,7 @@ static struct platform_driver ipq9574_pinctrl_driver = { - .of_match_table = ipq9574_pinctrl_of_match, - }, - .probe = ipq9574_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init ipq9574_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-mdm9607.c b/drivers/pinctrl/qcom/pinctrl-mdm9607.c -index e7cd3ef1cf3e81..415d24e16267d0 100644 ---- a/drivers/pinctrl/qcom/pinctrl-mdm9607.c -+++ b/drivers/pinctrl/qcom/pinctrl-mdm9607.c -@@ -1059,7 +1059,7 @@ static struct platform_driver mdm9607_pinctrl_driver = { - .of_match_table = mdm9607_pinctrl_of_match, - }, - .probe = mdm9607_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init mdm9607_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-mdm9615.c b/drivers/pinctrl/qcom/pinctrl-mdm9615.c -index 0a2ae383d3d57b..3f2eafea0b2467 100644 ---- a/drivers/pinctrl/qcom/pinctrl-mdm9615.c -+++ b/drivers/pinctrl/qcom/pinctrl-mdm9615.c -@@ -446,7 +446,7 @@ static struct platform_driver mdm9615_pinctrl_driver = { - .of_match_table = mdm9615_pinctrl_of_match, - }, - .probe = mdm9615_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init mdm9615_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c -index b252fc22f64e6b..ed70767ca0f0c9 100644 ---- a/drivers/pinctrl/qcom/pinctrl-msm.c -+++ b/drivers/pinctrl/qcom/pinctrl-msm.c -@@ -43,7 +43,6 @@ - * @pctrl: pinctrl handle. - * @chip: gpiochip handle. - * @desc: pin controller descriptor -- * @restart_nb: restart notifier block. - * @irq: parent irq for the TLMM irq_chip. - * @intr_target_use_scm: route irq to application cpu using scm calls - * @lock: Spinlock to protect register resources as well -@@ -63,7 +62,6 @@ struct msm_pinctrl { - struct pinctrl_dev *pctrl; - struct gpio_chip chip; - struct pinctrl_desc desc; -- struct notifier_block restart_nb; - - int irq; - -@@ -1424,10 +1422,9 @@ static int msm_gpio_init(struct msm_pinctrl *pctrl) - return 0; - } - --static int msm_ps_hold_restart(struct notifier_block *nb, unsigned long action, -- void *data) -+static int msm_ps_hold_restart(struct sys_off_data *data) - { -- struct msm_pinctrl *pctrl = container_of(nb, struct msm_pinctrl, restart_nb); -+ struct msm_pinctrl *pctrl = data->cb_data; - - writel(0, pctrl->regs[0] + PS_HOLD_OFFSET); - mdelay(1000); -@@ -1438,7 +1435,11 @@ static struct msm_pinctrl *poweroff_pctrl; - - static void msm_ps_hold_poweroff(void) - { -- msm_ps_hold_restart(&poweroff_pctrl->restart_nb, 0, NULL); -+ struct sys_off_data data = { -+ .cb_data = poweroff_pctrl, -+ }; -+ -+ msm_ps_hold_restart(&data); - } - - static void msm_pinctrl_setup_pm_reset(struct msm_pinctrl *pctrl) -@@ -1448,9 +1449,11 @@ static void msm_pinctrl_setup_pm_reset(struct msm_pinctrl *pctrl) - - for (i = 0; i < pctrl->soc->nfunctions; i++) - if (!strcmp(func[i].name, "ps_hold")) { -- pctrl->restart_nb.notifier_call = msm_ps_hold_restart; -- pctrl->restart_nb.priority = 128; -- if (register_restart_handler(&pctrl->restart_nb)) -+ if (devm_register_sys_off_handler(pctrl->dev, -+ SYS_OFF_MODE_RESTART, -+ 128, -+ msm_ps_hold_restart, -+ pctrl)) - dev_err(pctrl->dev, - "failed to setup restart handler.\n"); - poweroff_pctrl = pctrl; -@@ -1547,15 +1550,11 @@ int msm_pinctrl_probe(struct platform_device *pdev, - } - EXPORT_SYMBOL(msm_pinctrl_probe); - --int msm_pinctrl_remove(struct platform_device *pdev) -+void msm_pinctrl_remove(struct platform_device *pdev) - { - struct msm_pinctrl *pctrl = platform_get_drvdata(pdev); - - gpiochip_remove(&pctrl->chip); -- -- unregister_restart_handler(&pctrl->restart_nb); -- -- return 0; - } - EXPORT_SYMBOL(msm_pinctrl_remove); - -diff --git a/drivers/pinctrl/qcom/pinctrl-msm.h b/drivers/pinctrl/qcom/pinctrl-msm.h -index 1d2f2e904da190..4968d08a384da9 100644 ---- a/drivers/pinctrl/qcom/pinctrl-msm.h -+++ b/drivers/pinctrl/qcom/pinctrl-msm.h -@@ -166,6 +166,6 @@ extern const struct dev_pm_ops msm_pinctrl_dev_pm_ops; - - int msm_pinctrl_probe(struct platform_device *pdev, - const struct msm_pinctrl_soc_data *soc_data); --int msm_pinctrl_remove(struct platform_device *pdev); -+void msm_pinctrl_remove(struct platform_device *pdev); - - #endif -diff --git a/drivers/pinctrl/qcom/pinctrl-msm8226.c b/drivers/pinctrl/qcom/pinctrl-msm8226.c -index 994619840a706c..90b4004e7faf18 100644 ---- a/drivers/pinctrl/qcom/pinctrl-msm8226.c -+++ b/drivers/pinctrl/qcom/pinctrl-msm8226.c -@@ -638,7 +638,7 @@ static struct platform_driver msm8226_pinctrl_driver = { - .of_match_table = msm8226_pinctrl_of_match, - }, - .probe = msm8226_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init msm8226_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-msm8660.c b/drivers/pinctrl/qcom/pinctrl-msm8660.c -index 999a5f867eb508..dba6d531b4a146 100644 ---- a/drivers/pinctrl/qcom/pinctrl-msm8660.c -+++ b/drivers/pinctrl/qcom/pinctrl-msm8660.c -@@ -981,7 +981,7 @@ static struct platform_driver msm8660_pinctrl_driver = { - .of_match_table = msm8660_pinctrl_of_match, - }, - .probe = msm8660_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init msm8660_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-msm8909.c b/drivers/pinctrl/qcom/pinctrl-msm8909.c -index 756856d20d6b5f..14b17ba9f9061a 100644 ---- a/drivers/pinctrl/qcom/pinctrl-msm8909.c -+++ b/drivers/pinctrl/qcom/pinctrl-msm8909.c -@@ -929,7 +929,7 @@ static struct platform_driver msm8909_pinctrl_driver = { - .of_match_table = msm8909_pinctrl_of_match, - }, - .probe = msm8909_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init msm8909_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-msm8916.c b/drivers/pinctrl/qcom/pinctrl-msm8916.c -index cea5c54f92fec1..184dcf8422735b 100644 ---- a/drivers/pinctrl/qcom/pinctrl-msm8916.c -+++ b/drivers/pinctrl/qcom/pinctrl-msm8916.c -@@ -969,7 +969,7 @@ static struct platform_driver msm8916_pinctrl_driver = { - .of_match_table = msm8916_pinctrl_of_match, - }, - .probe = msm8916_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init msm8916_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-msm8953.c b/drivers/pinctrl/qcom/pinctrl-msm8953.c -index 998351bdfee136..c2253821ae8d36 100644 ---- a/drivers/pinctrl/qcom/pinctrl-msm8953.c -+++ b/drivers/pinctrl/qcom/pinctrl-msm8953.c -@@ -1816,7 +1816,7 @@ static struct platform_driver msm8953_pinctrl_driver = { - .of_match_table = msm8953_pinctrl_of_match, - }, - .probe = msm8953_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init msm8953_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-msm8960.c b/drivers/pinctrl/qcom/pinctrl-msm8960.c -index ebe230b3b437cc..6b9148d226e9b8 100644 ---- a/drivers/pinctrl/qcom/pinctrl-msm8960.c -+++ b/drivers/pinctrl/qcom/pinctrl-msm8960.c -@@ -1246,7 +1246,7 @@ static struct platform_driver msm8960_pinctrl_driver = { - .of_match_table = msm8960_pinctrl_of_match, - }, - .probe = msm8960_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init msm8960_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-msm8976.c b/drivers/pinctrl/qcom/pinctrl-msm8976.c -index c30d80e4e98ca6..9a951888e8a1b1 100644 ---- a/drivers/pinctrl/qcom/pinctrl-msm8976.c -+++ b/drivers/pinctrl/qcom/pinctrl-msm8976.c -@@ -1096,7 +1096,7 @@ static struct platform_driver msm8976_pinctrl_driver = { - .of_match_table = msm8976_pinctrl_of_match, - }, - .probe = msm8976_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init msm8976_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-msm8994.c b/drivers/pinctrl/qcom/pinctrl-msm8994.c -index b1a6759ab4a5e7..1ed1dd32d6c795 100644 ---- a/drivers/pinctrl/qcom/pinctrl-msm8994.c -+++ b/drivers/pinctrl/qcom/pinctrl-msm8994.c -@@ -1343,7 +1343,7 @@ static struct platform_driver msm8994_pinctrl_driver = { - .of_match_table = msm8994_pinctrl_of_match, - }, - .probe = msm8994_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init msm8994_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-msm8996.c b/drivers/pinctrl/qcom/pinctrl-msm8996.c -index 46cc0b49dbab52..5f0e7f78fd5178 100644 ---- a/drivers/pinctrl/qcom/pinctrl-msm8996.c -+++ b/drivers/pinctrl/qcom/pinctrl-msm8996.c -@@ -1906,7 +1906,7 @@ static struct platform_driver msm8996_pinctrl_driver = { - .of_match_table = msm8996_pinctrl_of_match, - }, - .probe = msm8996_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init msm8996_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-msm8998.c b/drivers/pinctrl/qcom/pinctrl-msm8998.c -index b7cbf32b3125a9..4aaf45e54f3a79 100644 ---- a/drivers/pinctrl/qcom/pinctrl-msm8998.c -+++ b/drivers/pinctrl/qcom/pinctrl-msm8998.c -@@ -1535,7 +1535,7 @@ static struct platform_driver msm8998_pinctrl_driver = { - .of_match_table = msm8998_pinctrl_of_match, - }, - .probe = msm8998_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init msm8998_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-msm8x74.c b/drivers/pinctrl/qcom/pinctrl-msm8x74.c -index d5fe62992849c9..58b4f6f31ae6ae 100644 ---- a/drivers/pinctrl/qcom/pinctrl-msm8x74.c -+++ b/drivers/pinctrl/qcom/pinctrl-msm8x74.c -@@ -1071,7 +1071,7 @@ static struct platform_driver msm8x74_pinctrl_driver = { - .of_match_table = msm8x74_pinctrl_of_match, - }, - .probe = msm8x74_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init msm8x74_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-qcm2290.c b/drivers/pinctrl/qcom/pinctrl-qcm2290.c -index ba699eac9ee8b2..f5c1c427b44e91 100644 ---- a/drivers/pinctrl/qcom/pinctrl-qcm2290.c -+++ b/drivers/pinctrl/qcom/pinctrl-qcm2290.c -@@ -1113,7 +1113,7 @@ static struct platform_driver qcm2290_pinctrl_driver = { - .of_match_table = qcm2290_pinctrl_of_match, - }, - .probe = qcm2290_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init qcm2290_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-qcs404.c b/drivers/pinctrl/qcom/pinctrl-qcs404.c -index ae7224012f8aa0..9a875b7dc9989c 100644 ---- a/drivers/pinctrl/qcom/pinctrl-qcs404.c -+++ b/drivers/pinctrl/qcom/pinctrl-qcs404.c -@@ -1644,7 +1644,7 @@ static struct platform_driver qcs404_pinctrl_driver = { - .of_match_table = qcs404_pinctrl_of_match, - }, - .probe = qcs404_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init qcs404_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-qdf2xxx.c b/drivers/pinctrl/qcom/pinctrl-qdf2xxx.c -index b5808fcfb13cde..4d2f6f495163bc 100644 ---- a/drivers/pinctrl/qcom/pinctrl-qdf2xxx.c -+++ b/drivers/pinctrl/qcom/pinctrl-qdf2xxx.c -@@ -145,7 +145,7 @@ static struct platform_driver qdf2xxx_pinctrl_driver = { - .acpi_match_table = qdf2xxx_acpi_ids, - }, - .probe = qdf2xxx_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init qdf2xxx_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-qdu1000.c b/drivers/pinctrl/qcom/pinctrl-qdu1000.c -index 47bc529ef550d2..da4f940bc8d4e8 100644 ---- a/drivers/pinctrl/qcom/pinctrl-qdu1000.c -+++ b/drivers/pinctrl/qcom/pinctrl-qdu1000.c -@@ -1248,7 +1248,7 @@ static struct platform_driver qdu1000_tlmm_driver = { - .of_match_table = qdu1000_tlmm_of_match, - }, - .probe = qdu1000_tlmm_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init qdu1000_tlmm_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-sa8775p.c b/drivers/pinctrl/qcom/pinctrl-sa8775p.c -index 8fdea25d8d67e1..5459c0c681a23f 100644 ---- a/drivers/pinctrl/qcom/pinctrl-sa8775p.c -+++ b/drivers/pinctrl/qcom/pinctrl-sa8775p.c -@@ -1530,7 +1530,7 @@ static struct platform_driver sa8775p_pinctrl_driver = { - .of_match_table = sa8775p_pinctrl_of_match, - }, - .probe = sa8775p_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init sa8775p_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-sc7180.c b/drivers/pinctrl/qcom/pinctrl-sc7180.c -index 6eb0c73791c0bc..c27aaa599b917a 100644 ---- a/drivers/pinctrl/qcom/pinctrl-sc7180.c -+++ b/drivers/pinctrl/qcom/pinctrl-sc7180.c -@@ -1159,7 +1159,7 @@ static struct platform_driver sc7180_pinctrl_driver = { - .of_match_table = sc7180_pinctrl_of_match, - }, - .probe = sc7180_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init sc7180_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-sc7280.c b/drivers/pinctrl/qcom/pinctrl-sc7280.c -index 0c10eeb60b55e7..c2db663e396eb4 100644 ---- a/drivers/pinctrl/qcom/pinctrl-sc7280.c -+++ b/drivers/pinctrl/qcom/pinctrl-sc7280.c -@@ -1505,7 +1505,7 @@ static struct platform_driver sc7280_pinctrl_driver = { - .of_match_table = sc7280_pinctrl_of_match, - }, - .probe = sc7280_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init sc7280_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-sc8180x.c b/drivers/pinctrl/qcom/pinctrl-sc8180x.c -index d6a79ad41a40a8..cfa7c8be9770c9 100644 ---- a/drivers/pinctrl/qcom/pinctrl-sc8180x.c -+++ b/drivers/pinctrl/qcom/pinctrl-sc8180x.c -@@ -1720,7 +1720,7 @@ static struct platform_driver sc8180x_pinctrl_driver = { - .acpi_match_table = sc8180x_pinctrl_acpi_match, - }, - .probe = sc8180x_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init sc8180x_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-sc8280xp.c b/drivers/pinctrl/qcom/pinctrl-sc8280xp.c -index 96f4fb5a5d297f..4b1c49697698de 100644 ---- a/drivers/pinctrl/qcom/pinctrl-sc8280xp.c -+++ b/drivers/pinctrl/qcom/pinctrl-sc8280xp.c -@@ -1926,7 +1926,7 @@ static struct platform_driver sc8280xp_pinctrl_driver = { - .of_match_table = sc8280xp_pinctrl_of_match, - }, - .probe = sc8280xp_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init sc8280xp_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-sdm660.c b/drivers/pinctrl/qcom/pinctrl-sdm660.c -index c2e0d5c034acf6..b0c29a24b09b5a 100644 ---- a/drivers/pinctrl/qcom/pinctrl-sdm660.c -+++ b/drivers/pinctrl/qcom/pinctrl-sdm660.c -@@ -1428,7 +1428,7 @@ static struct platform_driver sdm660_pinctrl_driver = { - .of_match_table = sdm660_pinctrl_of_match, - }, - .probe = sdm660_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init sdm660_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-sdm670.c b/drivers/pinctrl/qcom/pinctrl-sdm670.c -index cc3cce077de4e6..1e694a966953ac 100644 ---- a/drivers/pinctrl/qcom/pinctrl-sdm670.c -+++ b/drivers/pinctrl/qcom/pinctrl-sdm670.c -@@ -1318,7 +1318,7 @@ static struct platform_driver sdm670_pinctrl_driver = { - .of_match_table = sdm670_pinctrl_of_match, - }, - .probe = sdm670_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init sdm670_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-sdm845.c b/drivers/pinctrl/qcom/pinctrl-sdm845.c -index cc05c415ed1551..3f3265e0018d66 100644 ---- a/drivers/pinctrl/qcom/pinctrl-sdm845.c -+++ b/drivers/pinctrl/qcom/pinctrl-sdm845.c -@@ -1351,7 +1351,7 @@ static struct platform_driver sdm845_pinctrl_driver = { - .acpi_match_table = ACPI_PTR(sdm845_pinctrl_acpi_match), - }, - .probe = sdm845_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init sdm845_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-sdx55.c b/drivers/pinctrl/qcom/pinctrl-sdx55.c -index 8826db9d21d04c..c88b8bfcacb6a7 100644 ---- a/drivers/pinctrl/qcom/pinctrl-sdx55.c -+++ b/drivers/pinctrl/qcom/pinctrl-sdx55.c -@@ -990,7 +990,7 @@ static struct platform_driver sdx55_pinctrl_driver = { - .of_match_table = sdx55_pinctrl_of_match, - }, - .probe = sdx55_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init sdx55_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-sdx65.c b/drivers/pinctrl/qcom/pinctrl-sdx65.c -index f6f319c997fc7a..bd44ec0fcab43c 100644 ---- a/drivers/pinctrl/qcom/pinctrl-sdx65.c -+++ b/drivers/pinctrl/qcom/pinctrl-sdx65.c -@@ -939,7 +939,7 @@ static struct platform_driver sdx65_pinctrl_driver = { - .of_match_table = sdx65_pinctrl_of_match, - }, - .probe = sdx65_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init sdx65_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-sdx75.c b/drivers/pinctrl/qcom/pinctrl-sdx75.c -index 3cfe8c7f04df81..396f6fc779a2e5 100644 ---- a/drivers/pinctrl/qcom/pinctrl-sdx75.c -+++ b/drivers/pinctrl/qcom/pinctrl-sdx75.c -@@ -1124,7 +1124,7 @@ static struct platform_driver sdx75_pinctrl_driver = { - .of_match_table = sdx75_pinctrl_of_match, - }, - .probe = sdx75_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init sdx75_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-sm6115.c b/drivers/pinctrl/qcom/pinctrl-sm6115.c -index 2a06025f488584..87057089b2b649 100644 ---- a/drivers/pinctrl/qcom/pinctrl-sm6115.c -+++ b/drivers/pinctrl/qcom/pinctrl-sm6115.c -@@ -895,7 +895,7 @@ static struct platform_driver sm6115_tlmm_driver = { - .of_match_table = sm6115_tlmm_of_match, - }, - .probe = sm6115_tlmm_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init sm6115_tlmm_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-sm6125.c b/drivers/pinctrl/qcom/pinctrl-sm6125.c -index d5e2b896954c22..e07339ba72bcac 100644 ---- a/drivers/pinctrl/qcom/pinctrl-sm6125.c -+++ b/drivers/pinctrl/qcom/pinctrl-sm6125.c -@@ -1249,7 +1249,7 @@ static struct platform_driver sm6125_tlmm_driver = { - .of_match_table = sm6125_tlmm_of_match, - }, - .probe = sm6125_tlmm_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init sm6125_tlmm_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-sm6350.c b/drivers/pinctrl/qcom/pinctrl-sm6350.c -index f3828c07b13450..4aeb1ba43ee3d4 100644 ---- a/drivers/pinctrl/qcom/pinctrl-sm6350.c -+++ b/drivers/pinctrl/qcom/pinctrl-sm6350.c -@@ -1373,7 +1373,7 @@ static struct platform_driver sm6350_tlmm_driver = { - .of_match_table = sm6350_tlmm_of_match, - }, - .probe = sm6350_tlmm_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init sm6350_tlmm_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-sm6375.c b/drivers/pinctrl/qcom/pinctrl-sm6375.c -index c82c8516932ea2..d86630d7125c2a 100644 ---- a/drivers/pinctrl/qcom/pinctrl-sm6375.c -+++ b/drivers/pinctrl/qcom/pinctrl-sm6375.c -@@ -1516,7 +1516,7 @@ static struct platform_driver sm6375_tlmm_driver = { - .of_match_table = sm6375_tlmm_of_match, - }, - .probe = sm6375_tlmm_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init sm6375_tlmm_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-sm7150.c b/drivers/pinctrl/qcom/pinctrl-sm7150.c -index edb5984cd35190..b9f067de8ef0e4 100644 ---- a/drivers/pinctrl/qcom/pinctrl-sm7150.c -+++ b/drivers/pinctrl/qcom/pinctrl-sm7150.c -@@ -1254,7 +1254,7 @@ static struct platform_driver sm7150_tlmm_driver = { - .of_match_table = sm7150_tlmm_of_match, - }, - .probe = sm7150_tlmm_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init sm7150_tlmm_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-sm8150.c b/drivers/pinctrl/qcom/pinctrl-sm8150.c -index 01aea9c70b7a78..f8f5bee74f1dc0 100644 ---- a/drivers/pinctrl/qcom/pinctrl-sm8150.c -+++ b/drivers/pinctrl/qcom/pinctrl-sm8150.c -@@ -1542,7 +1542,7 @@ static struct platform_driver sm8150_pinctrl_driver = { - .of_match_table = sm8150_pinctrl_of_match, - }, - .probe = sm8150_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init sm8150_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-sm8250.c b/drivers/pinctrl/qcom/pinctrl-sm8250.c -index e9961a49ff9811..54fda77bf2968c 100644 ---- a/drivers/pinctrl/qcom/pinctrl-sm8250.c -+++ b/drivers/pinctrl/qcom/pinctrl-sm8250.c -@@ -1351,7 +1351,7 @@ static struct platform_driver sm8250_pinctrl_driver = { - .of_match_table = sm8250_pinctrl_of_match, - }, - .probe = sm8250_pinctrl_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init sm8250_pinctrl_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-sm8350.c b/drivers/pinctrl/qcom/pinctrl-sm8350.c -index 9c69458bd91091..ac7f2820f2cbfb 100644 ---- a/drivers/pinctrl/qcom/pinctrl-sm8350.c -+++ b/drivers/pinctrl/qcom/pinctrl-sm8350.c -@@ -1642,7 +1642,7 @@ static struct platform_driver sm8350_tlmm_driver = { - .of_match_table = sm8350_tlmm_of_match, - }, - .probe = sm8350_tlmm_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init sm8350_tlmm_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-sm8450.c b/drivers/pinctrl/qcom/pinctrl-sm8450.c -index d11bb1ee9e3d8d..61728671169527 100644 ---- a/drivers/pinctrl/qcom/pinctrl-sm8450.c -+++ b/drivers/pinctrl/qcom/pinctrl-sm8450.c -@@ -1677,7 +1677,7 @@ static struct platform_driver sm8450_tlmm_driver = { - .of_match_table = sm8450_tlmm_of_match, - }, - .probe = sm8450_tlmm_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init sm8450_tlmm_init(void) -diff --git a/drivers/pinctrl/qcom/pinctrl-sm8550.c b/drivers/pinctrl/qcom/pinctrl-sm8550.c -index 3c847d9cb5d93b..9184e0183755da 100644 ---- a/drivers/pinctrl/qcom/pinctrl-sm8550.c -+++ b/drivers/pinctrl/qcom/pinctrl-sm8550.c -@@ -1762,7 +1762,7 @@ static struct platform_driver sm8550_tlmm_driver = { - .of_match_table = sm8550_tlmm_of_match, - }, - .probe = sm8550_tlmm_probe, -- .remove = msm_pinctrl_remove, -+ .remove_new = msm_pinctrl_remove, - }; - - static int __init sm8550_tlmm_init(void) -diff --git a/drivers/pinctrl/tegra/pinctrl-tegra.c b/drivers/pinctrl/tegra/pinctrl-tegra.c -index 7c12a3470642c3..637b89ebe0e455 100644 ---- a/drivers/pinctrl/tegra/pinctrl-tegra.c -+++ b/drivers/pinctrl/tegra/pinctrl-tegra.c -@@ -280,8 +280,8 @@ static int tegra_pinctrl_set_mux(struct pinctrl_dev *pctldev, - return 0; - } - --static const struct tegra_pingroup *tegra_pinctrl_get_group(struct pinctrl_dev *pctldev, -- unsigned int offset) -+static int tegra_pinctrl_get_group_index(struct pinctrl_dev *pctldev, -+ unsigned int offset) - { - struct tegra_pmx *pmx = pinctrl_dev_get_drvdata(pctldev); - unsigned int group, num_pins, j; -@@ -294,12 +294,35 @@ static const struct tegra_pingroup *tegra_pinctrl_get_group(struct pinctrl_dev * - continue; - for (j = 0; j < num_pins; j++) { - if (offset == pins[j]) -- return &pmx->soc->groups[group]; -+ return group; - } - } - -- dev_err(pctldev->dev, "Pingroup not found for pin %u\n", offset); -- return NULL; -+ return -EINVAL; -+} -+ -+static const struct tegra_pingroup *tegra_pinctrl_get_group(struct pinctrl_dev *pctldev, -+ unsigned int offset, -+ int group_index) -+{ -+ struct tegra_pmx *pmx = pinctrl_dev_get_drvdata(pctldev); -+ -+ if (group_index < 0 || group_index >= pmx->soc->ngroups) -+ return NULL; -+ -+ return &pmx->soc->groups[group_index]; -+} -+ -+static struct tegra_pingroup_config *tegra_pinctrl_get_group_config(struct pinctrl_dev *pctldev, -+ unsigned int offset, -+ int group_index) -+{ -+ struct tegra_pmx *pmx = pinctrl_dev_get_drvdata(pctldev); -+ -+ if (group_index < 0) -+ return NULL; -+ -+ return &pmx->pingroup_configs[group_index]; - } - - static int tegra_pinctrl_gpio_request_enable(struct pinctrl_dev *pctldev, -@@ -308,12 +331,15 @@ static int tegra_pinctrl_gpio_request_enable(struct pinctrl_dev *pctldev, - { - struct tegra_pmx *pmx = pinctrl_dev_get_drvdata(pctldev); - const struct tegra_pingroup *group; -+ struct tegra_pingroup_config *config; -+ int group_index; - u32 value; - - if (!pmx->soc->sfsel_in_mux) - return 0; - -- group = tegra_pinctrl_get_group(pctldev, offset); -+ group_index = tegra_pinctrl_get_group_index(pctldev, offset); -+ group = tegra_pinctrl_get_group(pctldev, offset, group_index); - - if (!group) - return -EINVAL; -@@ -321,7 +347,11 @@ static int tegra_pinctrl_gpio_request_enable(struct pinctrl_dev *pctldev, - if (group->mux_reg < 0 || group->sfsel_bit < 0) - return -EINVAL; - -+ config = tegra_pinctrl_get_group_config(pctldev, offset, group_index); -+ if (!config) -+ return -EINVAL; - value = pmx_readl(pmx, group->mux_bank, group->mux_reg); -+ config->is_sfsel = (value & BIT(group->sfsel_bit)) != 0; - value &= ~BIT(group->sfsel_bit); - pmx_writel(pmx, value, group->mux_bank, group->mux_reg); - -@@ -334,12 +364,15 @@ static void tegra_pinctrl_gpio_disable_free(struct pinctrl_dev *pctldev, - { - struct tegra_pmx *pmx = pinctrl_dev_get_drvdata(pctldev); - const struct tegra_pingroup *group; -+ struct tegra_pingroup_config *config; -+ int group_index; - u32 value; - - if (!pmx->soc->sfsel_in_mux) - return; - -- group = tegra_pinctrl_get_group(pctldev, offset); -+ group_index = tegra_pinctrl_get_group_index(pctldev, offset); -+ group = tegra_pinctrl_get_group(pctldev, offset, group_index); - - if (!group) - return; -@@ -347,8 +380,12 @@ static void tegra_pinctrl_gpio_disable_free(struct pinctrl_dev *pctldev, - if (group->mux_reg < 0 || group->sfsel_bit < 0) - return; - -+ config = tegra_pinctrl_get_group_config(pctldev, offset, group_index); -+ if (!config) -+ return; - value = pmx_readl(pmx, group->mux_bank, group->mux_reg); -- value |= BIT(group->sfsel_bit); -+ if (config->is_sfsel) -+ value |= BIT(group->sfsel_bit); - pmx_writel(pmx, value, group->mux_bank, group->mux_reg); - } - -@@ -785,6 +822,12 @@ int tegra_pinctrl_probe(struct platform_device *pdev, - pmx->dev = &pdev->dev; - pmx->soc = soc_data; - -+ pmx->pingroup_configs = devm_kcalloc(&pdev->dev, -+ pmx->soc->ngroups, sizeof(*pmx->pingroup_configs), -+ GFP_KERNEL); -+ if (!pmx->pingroup_configs) -+ return -ENOMEM; -+ - /* - * Each mux group will appear in 4 functions' list of groups. - * This over-allocates slightly, since not all groups are mux groups. -diff --git a/drivers/pinctrl/tegra/pinctrl-tegra.h b/drivers/pinctrl/tegra/pinctrl-tegra.h -index b3289bdf727d82..b97136685f7a88 100644 ---- a/drivers/pinctrl/tegra/pinctrl-tegra.h -+++ b/drivers/pinctrl/tegra/pinctrl-tegra.h -@@ -8,6 +8,10 @@ - #ifndef __PINMUX_TEGRA_H__ - #define __PINMUX_TEGRA_H__ - -+struct tegra_pingroup_config { -+ bool is_sfsel; -+}; -+ - struct tegra_pmx { - struct device *dev; - struct pinctrl_dev *pctl; -@@ -21,6 +25,8 @@ struct tegra_pmx { - int nbanks; - void __iomem **regs; - u32 *backup_regs; -+ /* Array of size soc->ngroups */ -+ struct tegra_pingroup_config *pingroup_configs; - }; - - enum tegra_pinconf_param { -diff --git a/drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c b/drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c -index 230e6ee966366a..d8f1bf5e58a0f4 100644 ---- a/drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c -+++ b/drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c -@@ -45,7 +45,7 @@ static ssize_t current_password_store(struct kobject *kobj, - int length; - - length = strlen(buf); -- if (buf[length-1] == '\n') -+ if (length && buf[length - 1] == '\n') - length--; - - /* firmware does verifiation of min/max password length, -diff --git a/drivers/platform/x86/fujitsu-laptop.c b/drivers/platform/x86/fujitsu-laptop.c -index 085e044e888e4e..d7ef4f046d99b5 100644 ---- a/drivers/platform/x86/fujitsu-laptop.c -+++ b/drivers/platform/x86/fujitsu-laptop.c -@@ -17,13 +17,13 @@ - /* - * fujitsu-laptop.c - Fujitsu laptop support, providing access to additional - * features made available on a range of Fujitsu laptops including the -- * P2xxx/P5xxx/S6xxx/S7xxx series. -+ * P2xxx/P5xxx/S2xxx/S6xxx/S7xxx series. - * - * This driver implements a vendor-specific backlight control interface for - * Fujitsu laptops and provides support for hotkeys present on certain Fujitsu - * laptops. - * -- * This driver has been tested on a Fujitsu Lifebook S6410, S7020 and -+ * This driver has been tested on a Fujitsu Lifebook S2110, S6410, S7020 and - * P8010. It should work on most P-series and S-series Lifebooks, but - * YMMV. - * -@@ -102,7 +102,11 @@ - #define KEY2_CODE 0x411 - #define KEY3_CODE 0x412 - #define KEY4_CODE 0x413 --#define KEY5_CODE 0x420 -+#define KEY5_CODE 0x414 -+#define KEY6_CODE 0x415 -+#define KEY7_CODE 0x416 -+#define KEY8_CODE 0x417 -+#define KEY9_CODE 0x420 - - /* Hotkey ringbuffer limits */ - #define MAX_HOTKEY_RINGBUFFER_SIZE 100 -@@ -450,7 +454,7 @@ static const struct key_entry keymap_default[] = { - { KE_KEY, KEY2_CODE, { KEY_PROG2 } }, - { KE_KEY, KEY3_CODE, { KEY_PROG3 } }, - { KE_KEY, KEY4_CODE, { KEY_PROG4 } }, -- { KE_KEY, KEY5_CODE, { KEY_RFKILL } }, -+ { KE_KEY, KEY9_CODE, { KEY_RFKILL } }, - /* Soft keys read from status flags */ - { KE_KEY, FLAG_RFKILL, { KEY_RFKILL } }, - { KE_KEY, FLAG_TOUCHPAD_TOGGLE, { KEY_TOUCHPAD_TOGGLE } }, -@@ -474,6 +478,18 @@ static const struct key_entry keymap_p8010[] = { - { KE_END, 0 } - }; - -+static const struct key_entry keymap_s2110[] = { -+ { KE_KEY, KEY1_CODE, { KEY_PROG1 } }, /* "A" */ -+ { KE_KEY, KEY2_CODE, { KEY_PROG2 } }, /* "B" */ -+ { KE_KEY, KEY3_CODE, { KEY_WWW } }, /* "Internet" */ -+ { KE_KEY, KEY4_CODE, { KEY_EMAIL } }, /* "E-mail" */ -+ { KE_KEY, KEY5_CODE, { KEY_STOPCD } }, -+ { KE_KEY, KEY6_CODE, { KEY_PLAYPAUSE } }, -+ { KE_KEY, KEY7_CODE, { KEY_PREVIOUSSONG } }, -+ { KE_KEY, KEY8_CODE, { KEY_NEXTSONG } }, -+ { KE_END, 0 } -+}; -+ - static const struct key_entry *keymap = keymap_default; - - static int fujitsu_laptop_dmi_keymap_override(const struct dmi_system_id *id) -@@ -511,6 +527,15 @@ static const struct dmi_system_id fujitsu_laptop_dmi_table[] = { - }, - .driver_data = (void *)keymap_p8010 - }, -+ { -+ .callback = fujitsu_laptop_dmi_keymap_override, -+ .ident = "Fujitsu LifeBook S2110", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK S2110"), -+ }, -+ .driver_data = (void *)keymap_s2110 -+ }, - {} - }; - -diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c -index cde5f845cf2557..8de0d3232e48c5 100644 ---- a/drivers/platform/x86/thinkpad_acpi.c -+++ b/drivers/platform/x86/thinkpad_acpi.c -@@ -212,6 +212,7 @@ enum tpacpi_hkey_event_t { - /* Thermal events */ - TP_HKEY_EV_ALARM_BAT_HOT = 0x6011, /* battery too hot */ - TP_HKEY_EV_ALARM_BAT_XHOT = 0x6012, /* battery critically hot */ -+ TP_HKEY_EV_ALARM_BAT_LIM_CHANGE = 0x6013, /* battery charge limit changed*/ - TP_HKEY_EV_ALARM_SENSOR_HOT = 0x6021, /* sensor too hot */ - TP_HKEY_EV_ALARM_SENSOR_XHOT = 0x6022, /* sensor critically hot */ - TP_HKEY_EV_THM_TABLE_CHANGED = 0x6030, /* windows; thermal table changed */ -@@ -3942,6 +3943,10 @@ static bool hotkey_notify_6xxx(const u32 hkey, - pr_alert("THERMAL EMERGENCY: battery is extremely hot!\n"); - /* recommended action: immediate sleep/hibernate */ - break; -+ case TP_HKEY_EV_ALARM_BAT_LIM_CHANGE: -+ pr_debug("Battery Info: battery charge threshold changed\n"); -+ /* User changed charging threshold. No action needed */ -+ return true; - case TP_HKEY_EV_ALARM_SENSOR_HOT: - pr_crit("THERMAL ALARM: a sensor reports something is too hot!\n"); - /* recommended action: warn user through gui, that */ -@@ -11315,6 +11320,8 @@ static int __must_check __init get_thinkpad_model_data( - tp->vendor = PCI_VENDOR_ID_IBM; - else if (dmi_name_in_vendors("LENOVO")) - tp->vendor = PCI_VENDOR_ID_LENOVO; -+ else if (dmi_name_in_vendors("NEC")) -+ tp->vendor = PCI_VENDOR_ID_LENOVO; - else - return 0; - -diff --git a/drivers/pmdomain/imx/gpcv2.c b/drivers/pmdomain/imx/gpcv2.c -index 13fce2b134f60a..84d68c805cac85 100644 ---- a/drivers/pmdomain/imx/gpcv2.c -+++ b/drivers/pmdomain/imx/gpcv2.c -@@ -1350,7 +1350,7 @@ static int imx_pgc_domain_probe(struct platform_device *pdev) - } - - if (IS_ENABLED(CONFIG_LOCKDEP) && -- of_property_read_bool(domain->dev->of_node, "power-domains")) -+ of_property_present(domain->dev->of_node, "power-domains")) - lockdep_set_subclass(&domain->genpd.mlock, 1); - - ret = of_genpd_add_provider_simple(domain->dev->of_node, -diff --git a/drivers/regulator/ad5398.c b/drivers/regulator/ad5398.c -index 40f7dba42b5ad7..404cbe32711e73 100644 ---- a/drivers/regulator/ad5398.c -+++ b/drivers/regulator/ad5398.c -@@ -14,6 +14,7 @@ - #include - #include - #include -+#include - - #define AD5398_CURRENT_EN_MASK 0x8000 - -@@ -221,15 +222,20 @@ static int ad5398_probe(struct i2c_client *client) - const struct ad5398_current_data_format *df = - (struct ad5398_current_data_format *)id->driver_data; - -- if (!init_data) -- return -EINVAL; -- - chip = devm_kzalloc(&client->dev, sizeof(*chip), GFP_KERNEL); - if (!chip) - return -ENOMEM; - - config.dev = &client->dev; -+ if (client->dev.of_node) -+ init_data = of_get_regulator_init_data(&client->dev, -+ client->dev.of_node, -+ &ad5398_reg); -+ if (!init_data) -+ return -EINVAL; -+ - config.init_data = init_data; -+ config.of_node = client->dev.of_node; - config.driver_data = chip; - - chip->client = client; -diff --git a/drivers/remoteproc/qcom_wcnss.c b/drivers/remoteproc/qcom_wcnss.c -index 90de22c81da976..37174b544113f8 100644 ---- a/drivers/remoteproc/qcom_wcnss.c -+++ b/drivers/remoteproc/qcom_wcnss.c -@@ -117,10 +117,10 @@ static const struct wcnss_data pronto_v1_data = { - .pmu_offset = 0x1004, - .spare_offset = 0x1088, - -- .pd_names = { "mx", "cx" }, -+ .pd_names = { "cx", "mx" }, - .vregs = (struct wcnss_vreg_info[]) { -- { "vddmx", 950000, 1150000, 0 }, - { "vddcx", .super_turbo = true}, -+ { "vddmx", 950000, 1150000, 0 }, - { "vddpx", 1800000, 1800000, 0 }, - }, - .num_pd_vregs = 2, -@@ -131,10 +131,10 @@ static const struct wcnss_data pronto_v2_data = { - .pmu_offset = 0x1004, - .spare_offset = 0x1088, - -- .pd_names = { "mx", "cx" }, -+ .pd_names = { "cx", "mx" }, - .vregs = (struct wcnss_vreg_info[]) { -- { "vddmx", 1287500, 1287500, 0 }, - { "vddcx", .super_turbo = true }, -+ { "vddmx", 1287500, 1287500, 0 }, - { "vddpx", 1800000, 1800000, 0 }, - }, - .num_pd_vregs = 2, -@@ -397,8 +397,17 @@ static irqreturn_t wcnss_stop_ack_interrupt(int irq, void *dev) - static int wcnss_init_pds(struct qcom_wcnss *wcnss, - const char * const pd_names[WCNSS_MAX_PDS]) - { -+ struct device *dev = wcnss->dev; - int i, ret; - -+ /* Handle single power domain */ -+ if (dev->pm_domain) { -+ wcnss->pds[0] = dev; -+ wcnss->num_pds = 1; -+ pm_runtime_enable(dev); -+ return 0; -+ } -+ - for (i = 0; i < WCNSS_MAX_PDS; i++) { - if (!pd_names[i]) - break; -@@ -418,8 +427,15 @@ static int wcnss_init_pds(struct qcom_wcnss *wcnss, - - static void wcnss_release_pds(struct qcom_wcnss *wcnss) - { -+ struct device *dev = wcnss->dev; - int i; - -+ /* Handle single power domain */ -+ if (wcnss->num_pds == 1 && dev->pm_domain) { -+ pm_runtime_disable(dev); -+ return; -+ } -+ - for (i = 0; i < wcnss->num_pds; i++) - dev_pm_domain_detach(wcnss->pds[i], false); - } -@@ -437,10 +453,14 @@ static int wcnss_init_regulators(struct qcom_wcnss *wcnss, - * the regulators for the power domains. For old device trees we need to - * reserve extra space to manage them through the regulator interface. - */ -- if (wcnss->num_pds) -- info += num_pd_vregs; -- else -+ if (wcnss->num_pds) { -+ info += wcnss->num_pds; -+ /* Handle single power domain case */ -+ if (wcnss->num_pds < num_pd_vregs) -+ num_vregs += num_pd_vregs - wcnss->num_pds; -+ } else { - num_vregs += num_pd_vregs; -+ } - - bulk = devm_kcalloc(wcnss->dev, - num_vregs, sizeof(struct regulator_bulk_data), -diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c -index 506b7d1c239701..0c78451960926d 100644 ---- a/drivers/rtc/rtc-ds1307.c -+++ b/drivers/rtc/rtc-ds1307.c -@@ -1802,10 +1802,8 @@ static int ds1307_probe(struct i2c_client *client) - * For some variants, be sure alarms can trigger when we're - * running on Vbackup (BBSQI/BBSQW) - */ -- if (want_irq || ds1307_can_wakeup_device) { -+ if (want_irq || ds1307_can_wakeup_device) - regs[0] |= DS1337_BIT_INTCN | chip->bbsqi_bit; -- regs[0] &= ~(DS1337_BIT_A2IE | DS1337_BIT_A1IE); -- } - - regmap_write(ds1307->regmap, DS1337_REG_CONTROL, - regs[0]); -diff --git a/drivers/rtc/rtc-rv3032.c b/drivers/rtc/rtc-rv3032.c -index 35b2e36b426a0d..cb01038a2e27fe 100644 ---- a/drivers/rtc/rtc-rv3032.c -+++ b/drivers/rtc/rtc-rv3032.c -@@ -69,7 +69,7 @@ - #define RV3032_CLKOUT2_FD_MSK GENMASK(6, 5) - #define RV3032_CLKOUT2_OS BIT(7) - --#define RV3032_CTRL1_EERD BIT(3) -+#define RV3032_CTRL1_EERD BIT(2) - #define RV3032_CTRL1_WADA BIT(5) - - #define RV3032_CTRL2_STOP BIT(0) -diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c -index d6ea2fd4c2a02b..d4151f519e8b22 100644 ---- a/drivers/s390/crypto/vfio_ap_ops.c -+++ b/drivers/s390/crypto/vfio_ap_ops.c -@@ -834,48 +834,66 @@ static void vfio_ap_mdev_remove(struct mdev_device *mdev) - vfio_put_device(&matrix_mdev->vdev); - } - --#define MDEV_SHARING_ERR "Userspace may not re-assign queue %02lx.%04lx " \ -- "already assigned to %s" -+#define MDEV_SHARING_ERR "Userspace may not assign queue %02lx.%04lx to mdev: already assigned to %s" - --static void vfio_ap_mdev_log_sharing_err(struct ap_matrix_mdev *matrix_mdev, -- unsigned long *apm, -- unsigned long *aqm) -+#define MDEV_IN_USE_ERR "Can not reserve queue %02lx.%04lx for host driver: in use by mdev" -+ -+static void vfio_ap_mdev_log_sharing_err(struct ap_matrix_mdev *assignee, -+ struct ap_matrix_mdev *assigned_to, -+ unsigned long *apm, unsigned long *aqm) - { - unsigned long apid, apqi; -- const struct device *dev = mdev_dev(matrix_mdev->mdev); -- const char *mdev_name = dev_name(dev); - -- for_each_set_bit_inv(apid, apm, AP_DEVICES) -+ for_each_set_bit_inv(apid, apm, AP_DEVICES) { -+ for_each_set_bit_inv(apqi, aqm, AP_DOMAINS) { -+ dev_warn(mdev_dev(assignee->mdev), MDEV_SHARING_ERR, -+ apid, apqi, dev_name(mdev_dev(assigned_to->mdev))); -+ } -+ } -+} -+ -+static void vfio_ap_mdev_log_in_use_err(struct ap_matrix_mdev *assignee, -+ unsigned long *apm, unsigned long *aqm) -+{ -+ unsigned long apid, apqi; -+ -+ for_each_set_bit_inv(apid, apm, AP_DEVICES) { - for_each_set_bit_inv(apqi, aqm, AP_DOMAINS) -- dev_warn(dev, MDEV_SHARING_ERR, apid, apqi, mdev_name); -+ dev_warn(mdev_dev(assignee->mdev), MDEV_IN_USE_ERR, apid, apqi); -+ } - } - - /** - * vfio_ap_mdev_verify_no_sharing - verify APQNs are not shared by matrix mdevs - * -+ * @assignee: the matrix mdev to which @mdev_apm and @mdev_aqm are being -+ * assigned; or, NULL if this function was called by the AP bus -+ * driver in_use callback to verify none of the APQNs being reserved -+ * for the host device driver are in use by a vfio_ap mediated device - * @mdev_apm: mask indicating the APIDs of the APQNs to be verified - * @mdev_aqm: mask indicating the APQIs of the APQNs to be verified - * -- * Verifies that each APQN derived from the Cartesian product of a bitmap of -- * AP adapter IDs and AP queue indexes is not configured for any matrix -- * mediated device. AP queue sharing is not allowed. -+ * Verifies that each APQN derived from the Cartesian product of APIDs -+ * represented by the bits set in @mdev_apm and the APQIs of the bits set in -+ * @mdev_aqm is not assigned to a mediated device other than the mdev to which -+ * the APQN is being assigned (@assignee). AP queue sharing is not allowed. - * - * Return: 0 if the APQNs are not shared; otherwise return -EADDRINUSE. - */ --static int vfio_ap_mdev_verify_no_sharing(unsigned long *mdev_apm, -+static int vfio_ap_mdev_verify_no_sharing(struct ap_matrix_mdev *assignee, -+ unsigned long *mdev_apm, - unsigned long *mdev_aqm) - { -- struct ap_matrix_mdev *matrix_mdev; -+ struct ap_matrix_mdev *assigned_to; - DECLARE_BITMAP(apm, AP_DEVICES); - DECLARE_BITMAP(aqm, AP_DOMAINS); - -- list_for_each_entry(matrix_mdev, &matrix_dev->mdev_list, node) { -+ list_for_each_entry(assigned_to, &matrix_dev->mdev_list, node) { - /* -- * If the input apm and aqm are fields of the matrix_mdev -- * object, then move on to the next matrix_mdev. -+ * If the mdev to which the mdev_apm and mdev_aqm is being -+ * assigned is the same as the mdev being verified - */ -- if (mdev_apm == matrix_mdev->matrix.apm && -- mdev_aqm == matrix_mdev->matrix.aqm) -+ if (assignee == assigned_to) - continue; - - memset(apm, 0, sizeof(apm)); -@@ -885,15 +903,16 @@ static int vfio_ap_mdev_verify_no_sharing(unsigned long *mdev_apm, - * We work on full longs, as we can only exclude the leftover - * bits in non-inverse order. The leftover is all zeros. - */ -- if (!bitmap_and(apm, mdev_apm, matrix_mdev->matrix.apm, -- AP_DEVICES)) -+ if (!bitmap_and(apm, mdev_apm, assigned_to->matrix.apm, AP_DEVICES)) - continue; - -- if (!bitmap_and(aqm, mdev_aqm, matrix_mdev->matrix.aqm, -- AP_DOMAINS)) -+ if (!bitmap_and(aqm, mdev_aqm, assigned_to->matrix.aqm, AP_DOMAINS)) - continue; - -- vfio_ap_mdev_log_sharing_err(matrix_mdev, apm, aqm); -+ if (assignee) -+ vfio_ap_mdev_log_sharing_err(assignee, assigned_to, apm, aqm); -+ else -+ vfio_ap_mdev_log_in_use_err(assigned_to, apm, aqm); - - return -EADDRINUSE; - } -@@ -922,7 +941,8 @@ static int vfio_ap_mdev_validate_masks(struct ap_matrix_mdev *matrix_mdev) - matrix_mdev->matrix.aqm)) - return -EADDRNOTAVAIL; - -- return vfio_ap_mdev_verify_no_sharing(matrix_mdev->matrix.apm, -+ return vfio_ap_mdev_verify_no_sharing(matrix_mdev, -+ matrix_mdev->matrix.apm, - matrix_mdev->matrix.aqm); - } - -@@ -2271,7 +2291,7 @@ int vfio_ap_mdev_resource_in_use(unsigned long *apm, unsigned long *aqm) - - mutex_lock(&matrix_dev->guests_lock); - mutex_lock(&matrix_dev->mdevs_lock); -- ret = vfio_ap_mdev_verify_no_sharing(apm, aqm); -+ ret = vfio_ap_mdev_verify_no_sharing(NULL, apm, aqm); - mutex_unlock(&matrix_dev->mdevs_lock); - mutex_unlock(&matrix_dev->guests_lock); - -diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c -index 0ad8a10002ce36..5c9bc8af3c2df8 100644 ---- a/drivers/scsi/lpfc/lpfc_hbadisc.c -+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c -@@ -5646,6 +5646,7 @@ static struct lpfc_nodelist * - __lpfc_findnode_did(struct lpfc_vport *vport, uint32_t did) - { - struct lpfc_nodelist *ndlp; -+ struct lpfc_nodelist *np = NULL; - uint32_t data1; - - list_for_each_entry(ndlp, &vport->fc_nodes, nlp_listp) { -@@ -5660,14 +5661,20 @@ __lpfc_findnode_did(struct lpfc_vport *vport, uint32_t did) - ndlp, ndlp->nlp_DID, - ndlp->nlp_flag, data1, ndlp->nlp_rpi, - ndlp->active_rrqs_xri_bitmap); -- return ndlp; -+ -+ /* Check for new or potentially stale node */ -+ if (ndlp->nlp_state != NLP_STE_UNUSED_NODE) -+ return ndlp; -+ np = ndlp; - } - } - -- /* FIND node did NOT FOUND */ -- lpfc_printf_vlog(vport, KERN_INFO, LOG_NODE, -- "0932 FIND node did x%x NOT FOUND.\n", did); -- return NULL; -+ if (!np) -+ /* FIND node did NOT FOUND */ -+ lpfc_printf_vlog(vport, KERN_INFO, LOG_NODE, -+ "0932 FIND node did x%x NOT FOUND.\n", did); -+ -+ return np; - } - - struct lpfc_nodelist * -diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c -index 424b39a8155cb9..7c8e0e1d36da9b 100644 ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -13180,6 +13180,7 @@ lpfc_sli4_enable_msi(struct lpfc_hba *phba) - eqhdl = lpfc_get_eq_hdl(0); - rc = pci_irq_vector(phba->pcidev, 0); - if (rc < 0) { -+ free_irq(phba->pcidev->irq, phba); - pci_free_irq_vectors(phba->pcidev); - lpfc_printf_log(phba, KERN_WARNING, LOG_INIT, - "0496 MSI pci_irq_vec failed (%d)\n", rc); -@@ -13260,6 +13261,7 @@ lpfc_sli4_enable_intr(struct lpfc_hba *phba, uint32_t cfg_mode) - eqhdl = lpfc_get_eq_hdl(0); - retval = pci_irq_vector(phba->pcidev, 0); - if (retval < 0) { -+ free_irq(phba->pcidev->irq, phba); - lpfc_printf_log(phba, KERN_WARNING, LOG_INIT, - "0502 INTR pci_irq_vec failed (%d)\n", - retval); -diff --git a/drivers/scsi/mpi3mr/mpi3mr_fw.c b/drivers/scsi/mpi3mr/mpi3mr_fw.c -index 0d148c39ebcc98..60714a6c26375e 100644 ---- a/drivers/scsi/mpi3mr/mpi3mr_fw.c -+++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c -@@ -174,6 +174,9 @@ static void mpi3mr_print_event_data(struct mpi3mr_ioc *mrioc, - char *desc = NULL; - u16 event; - -+ if (!(mrioc->logging_level & MPI3_DEBUG_EVENT)) -+ return; -+ - event = event_reply->event; - - switch (event) { -diff --git a/drivers/scsi/mpt3sas/mpt3sas_ctl.c b/drivers/scsi/mpt3sas/mpt3sas_ctl.c -index e289f18fc76437..daef90ee431f52 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_ctl.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_ctl.c -@@ -679,6 +679,7 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg, - size_t data_in_sz = 0; - long ret; - u16 device_handle = MPT3SAS_INVALID_DEVICE_HANDLE; -+ int tm_ret; - - issue_reset = 0; - -@@ -1120,18 +1121,25 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg, - if (pcie_device && (!ioc->tm_custom_handling) && - (!(mpt3sas_scsih_is_pcie_scsi_device( - pcie_device->device_info)))) -- mpt3sas_scsih_issue_locked_tm(ioc, -+ tm_ret = mpt3sas_scsih_issue_locked_tm(ioc, - le16_to_cpu(mpi_request->FunctionDependent1), - 0, 0, 0, - MPI2_SCSITASKMGMT_TASKTYPE_TARGET_RESET, 0, - 0, pcie_device->reset_timeout, - MPI26_SCSITASKMGMT_MSGFLAGS_PROTOCOL_LVL_RST_PCIE); - else -- mpt3sas_scsih_issue_locked_tm(ioc, -+ tm_ret = mpt3sas_scsih_issue_locked_tm(ioc, - le16_to_cpu(mpi_request->FunctionDependent1), - 0, 0, 0, - MPI2_SCSITASKMGMT_TASKTYPE_TARGET_RESET, 0, - 0, 30, MPI2_SCSITASKMGMT_MSGFLAGS_LINK_RESET); -+ -+ if (tm_ret != SUCCESS) { -+ ioc_info(ioc, -+ "target reset failed, issue hard reset: handle (0x%04x)\n", -+ le16_to_cpu(mpi_request->FunctionDependent1)); -+ mpt3sas_base_hard_reset_handler(ioc, FORCE_BIG_HAMMER); -+ } - } else - mpt3sas_base_hard_reset_handler(ioc, FORCE_BIG_HAMMER); - } -diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c -index 900322bad4f3be..f9ab45c4bb40d5 100644 ---- a/drivers/scsi/st.c -+++ b/drivers/scsi/st.c -@@ -953,7 +953,6 @@ static void reset_state(struct scsi_tape *STp) - STp->partition = find_partition(STp); - if (STp->partition < 0) - STp->partition = 0; -- STp->new_partition = STp->partition; - } - } - -@@ -2895,7 +2894,6 @@ static int st_int_ioctl(struct scsi_tape *STp, unsigned int cmd_in, unsigned lon - timeout = STp->long_timeout * 8; - - DEBC_printk(STp, "Erasing tape.\n"); -- fileno = blkno = at_sm = 0; - break; - case MTSETBLK: /* Set block length */ - case MTSETDENSITY: /* Set tape density */ -@@ -2928,14 +2926,17 @@ static int st_int_ioctl(struct scsi_tape *STp, unsigned int cmd_in, unsigned lon - if (cmd_in == MTSETDENSITY) { - (STp->buffer)->b_data[4] = arg; - STp->density_changed = 1; /* At least we tried ;-) */ -+ STp->changed_density = arg; - } else if (cmd_in == SET_DENS_AND_BLK) - (STp->buffer)->b_data[4] = arg >> 24; - else - (STp->buffer)->b_data[4] = STp->density; - if (cmd_in == MTSETBLK || cmd_in == SET_DENS_AND_BLK) { - ltmp = arg & MT_ST_BLKSIZE_MASK; -- if (cmd_in == MTSETBLK) -+ if (cmd_in == MTSETBLK) { - STp->blksize_changed = 1; /* At least we tried ;-) */ -+ STp->changed_blksize = arg; -+ } - } else - ltmp = STp->block_size; - (STp->buffer)->b_data[9] = (ltmp >> 16); -@@ -3082,7 +3083,9 @@ static int st_int_ioctl(struct scsi_tape *STp, unsigned int cmd_in, unsigned lon - cmd_in == MTSETDRVBUFFER || - cmd_in == SET_DENS_AND_BLK) { - if (cmdstatp->sense_hdr.sense_key == ILLEGAL_REQUEST && -- !(STp->use_pf & PF_TESTED)) { -+ cmdstatp->sense_hdr.asc == 0x24 && -+ (STp->device)->scsi_level <= SCSI_2 && -+ !(STp->use_pf & PF_TESTED)) { - /* Try the other possible state of Page Format if not - already tried */ - STp->use_pf = (STp->use_pf ^ USE_PF) | PF_TESTED; -@@ -3634,9 +3637,25 @@ static long st_ioctl(struct file *file, unsigned int cmd_in, unsigned long arg) - retval = (-EIO); - goto out; - } -- reset_state(STp); -+ reset_state(STp); /* Clears pos_unknown */ - /* remove this when the midlevel properly clears was_reset */ - STp->device->was_reset = 0; -+ -+ /* Fix the device settings after reset, ignore errors */ -+ if (mtc.mt_op == MTREW || mtc.mt_op == MTSEEK || -+ mtc.mt_op == MTEOM) { -+ if (STp->can_partitions) { -+ /* STp->new_partition contains the -+ * latest partition set -+ */ -+ STp->partition = 0; -+ switch_partition(STp); -+ } -+ if (STp->density_changed) -+ st_int_ioctl(STp, MTSETDENSITY, STp->changed_density); -+ if (STp->blksize_changed) -+ st_int_ioctl(STp, MTSETBLK, STp->changed_blksize); -+ } - } - - if (mtc.mt_op != MTNOP && mtc.mt_op != MTSETBLK && -diff --git a/drivers/scsi/st.h b/drivers/scsi/st.h -index 1aaaf5369a40fc..6d31b894ee84cc 100644 ---- a/drivers/scsi/st.h -+++ b/drivers/scsi/st.h -@@ -165,6 +165,7 @@ struct scsi_tape { - unsigned char compression_changed; - unsigned char drv_buffer; - unsigned char density; -+ unsigned char changed_density; - unsigned char door_locked; - unsigned char autorew_dev; /* auto-rewind device */ - unsigned char rew_at_close; /* rewind necessary at close */ -@@ -172,6 +173,7 @@ struct scsi_tape { - unsigned char cleaning_req; /* cleaning requested? */ - unsigned char first_tur; /* first TEST UNIT READY */ - int block_size; -+ int changed_blksize; - int min_block; - int max_block; - int recover_count; /* From tape opening */ -diff --git a/drivers/soc/apple/rtkit-internal.h b/drivers/soc/apple/rtkit-internal.h -index 24bd619ec5e487..1da1dfd9cb199c 100644 ---- a/drivers/soc/apple/rtkit-internal.h -+++ b/drivers/soc/apple/rtkit-internal.h -@@ -48,6 +48,7 @@ struct apple_rtkit { - - struct apple_rtkit_shmem ioreport_buffer; - struct apple_rtkit_shmem crashlog_buffer; -+ struct apple_rtkit_shmem oslog_buffer; - - struct apple_rtkit_shmem syslog_buffer; - char *syslog_msg_buffer; -diff --git a/drivers/soc/apple/rtkit.c b/drivers/soc/apple/rtkit.c -index d9f19dc99da5e8..2c37216f423d20 100644 ---- a/drivers/soc/apple/rtkit.c -+++ b/drivers/soc/apple/rtkit.c -@@ -66,8 +66,9 @@ enum { - #define APPLE_RTKIT_SYSLOG_MSG_SIZE GENMASK_ULL(31, 24) - - #define APPLE_RTKIT_OSLOG_TYPE GENMASK_ULL(63, 56) --#define APPLE_RTKIT_OSLOG_INIT 1 --#define APPLE_RTKIT_OSLOG_ACK 3 -+#define APPLE_RTKIT_OSLOG_BUFFER_REQUEST 1 -+#define APPLE_RTKIT_OSLOG_SIZE GENMASK_ULL(55, 36) -+#define APPLE_RTKIT_OSLOG_IOVA GENMASK_ULL(35, 0) - - #define APPLE_RTKIT_MIN_SUPPORTED_VERSION 11 - #define APPLE_RTKIT_MAX_SUPPORTED_VERSION 12 -@@ -256,15 +257,21 @@ static int apple_rtkit_common_rx_get_buffer(struct apple_rtkit *rtk, - struct apple_rtkit_shmem *buffer, - u8 ep, u64 msg) - { -- size_t n_4kpages = FIELD_GET(APPLE_RTKIT_BUFFER_REQUEST_SIZE, msg); - u64 reply; - int err; - -+ /* The different size vs. IOVA shifts look odd but are indeed correct this way */ -+ if (ep == APPLE_RTKIT_EP_OSLOG) { -+ buffer->size = FIELD_GET(APPLE_RTKIT_OSLOG_SIZE, msg); -+ buffer->iova = FIELD_GET(APPLE_RTKIT_OSLOG_IOVA, msg) << 12; -+ } else { -+ buffer->size = FIELD_GET(APPLE_RTKIT_BUFFER_REQUEST_SIZE, msg) << 12; -+ buffer->iova = FIELD_GET(APPLE_RTKIT_BUFFER_REQUEST_IOVA, msg); -+ } -+ - buffer->buffer = NULL; - buffer->iomem = NULL; - buffer->is_mapped = false; -- buffer->iova = FIELD_GET(APPLE_RTKIT_BUFFER_REQUEST_IOVA, msg); -- buffer->size = n_4kpages << 12; - - dev_dbg(rtk->dev, "RTKit: buffer request for 0x%zx bytes at %pad\n", - buffer->size, &buffer->iova); -@@ -289,11 +296,21 @@ static int apple_rtkit_common_rx_get_buffer(struct apple_rtkit *rtk, - } - - if (!buffer->is_mapped) { -- reply = FIELD_PREP(APPLE_RTKIT_SYSLOG_TYPE, -- APPLE_RTKIT_BUFFER_REQUEST); -- reply |= FIELD_PREP(APPLE_RTKIT_BUFFER_REQUEST_SIZE, n_4kpages); -- reply |= FIELD_PREP(APPLE_RTKIT_BUFFER_REQUEST_IOVA, -- buffer->iova); -+ /* oslog uses different fields and needs a shifted IOVA instead of size */ -+ if (ep == APPLE_RTKIT_EP_OSLOG) { -+ reply = FIELD_PREP(APPLE_RTKIT_OSLOG_TYPE, -+ APPLE_RTKIT_OSLOG_BUFFER_REQUEST); -+ reply |= FIELD_PREP(APPLE_RTKIT_OSLOG_SIZE, buffer->size); -+ reply |= FIELD_PREP(APPLE_RTKIT_OSLOG_IOVA, -+ buffer->iova >> 12); -+ } else { -+ reply = FIELD_PREP(APPLE_RTKIT_SYSLOG_TYPE, -+ APPLE_RTKIT_BUFFER_REQUEST); -+ reply |= FIELD_PREP(APPLE_RTKIT_BUFFER_REQUEST_SIZE, -+ buffer->size >> 12); -+ reply |= FIELD_PREP(APPLE_RTKIT_BUFFER_REQUEST_IOVA, -+ buffer->iova); -+ } - apple_rtkit_send_message(rtk, ep, reply, NULL, false); - } - -@@ -487,25 +504,18 @@ static void apple_rtkit_syslog_rx(struct apple_rtkit *rtk, u64 msg) - } - } - --static void apple_rtkit_oslog_rx_init(struct apple_rtkit *rtk, u64 msg) --{ -- u64 ack; -- -- dev_dbg(rtk->dev, "RTKit: oslog init: msg: 0x%llx\n", msg); -- ack = FIELD_PREP(APPLE_RTKIT_OSLOG_TYPE, APPLE_RTKIT_OSLOG_ACK); -- apple_rtkit_send_message(rtk, APPLE_RTKIT_EP_OSLOG, ack, NULL, false); --} -- - static void apple_rtkit_oslog_rx(struct apple_rtkit *rtk, u64 msg) - { - u8 type = FIELD_GET(APPLE_RTKIT_OSLOG_TYPE, msg); - - switch (type) { -- case APPLE_RTKIT_OSLOG_INIT: -- apple_rtkit_oslog_rx_init(rtk, msg); -+ case APPLE_RTKIT_OSLOG_BUFFER_REQUEST: -+ apple_rtkit_common_rx_get_buffer(rtk, &rtk->oslog_buffer, -+ APPLE_RTKIT_EP_OSLOG, msg); - break; - default: -- dev_warn(rtk->dev, "RTKit: Unknown oslog message: %llx\n", msg); -+ dev_warn(rtk->dev, "RTKit: Unknown oslog message: %llx\n", -+ msg); - } - } - -@@ -744,7 +754,7 @@ struct apple_rtkit *apple_rtkit_init(struct device *dev, void *cookie, - rtk->mbox_cl.rx_callback = &apple_rtkit_rx; - rtk->mbox_cl.tx_done = &apple_rtkit_tx_done; - -- rtk->wq = alloc_ordered_workqueue("rtkit-%s", WQ_MEM_RECLAIM, -+ rtk->wq = alloc_ordered_workqueue("rtkit-%s", WQ_HIGHPRI | WQ_MEM_RECLAIM, - dev_name(rtk->dev)); - if (!rtk->wq) { - ret = -ENOMEM; -@@ -787,6 +797,7 @@ int apple_rtkit_reinit(struct apple_rtkit *rtk) - - apple_rtkit_free_buffer(rtk, &rtk->ioreport_buffer); - apple_rtkit_free_buffer(rtk, &rtk->crashlog_buffer); -+ apple_rtkit_free_buffer(rtk, &rtk->oslog_buffer); - apple_rtkit_free_buffer(rtk, &rtk->syslog_buffer); - - kfree(rtk->syslog_msg_buffer); -@@ -967,6 +978,7 @@ void apple_rtkit_free(struct apple_rtkit *rtk) - - apple_rtkit_free_buffer(rtk, &rtk->ioreport_buffer); - apple_rtkit_free_buffer(rtk, &rtk->crashlog_buffer); -+ apple_rtkit_free_buffer(rtk, &rtk->oslog_buffer); - apple_rtkit_free_buffer(rtk, &rtk->syslog_buffer); - - kfree(rtk->syslog_msg_buffer); -diff --git a/drivers/soc/ti/k3-socinfo.c b/drivers/soc/ti/k3-socinfo.c -index 6ea9b8c7d335c0..7a3bdef5a7c0da 100644 ---- a/drivers/soc/ti/k3-socinfo.c -+++ b/drivers/soc/ti/k3-socinfo.c -@@ -63,6 +63,12 @@ k3_chipinfo_partno_to_names(unsigned int partno, - return -EINVAL; - } - -+static const struct regmap_config k3_chipinfo_regmap_cfg = { -+ .reg_bits = 32, -+ .val_bits = 32, -+ .reg_stride = 4, -+}; -+ - static int k3_chipinfo_probe(struct platform_device *pdev) - { - struct device_node *node = pdev->dev.of_node; -@@ -70,13 +76,18 @@ static int k3_chipinfo_probe(struct platform_device *pdev) - struct device *dev = &pdev->dev; - struct soc_device *soc_dev; - struct regmap *regmap; -+ void __iomem *base; - u32 partno_id; - u32 variant; - u32 jtag_id; - u32 mfg; - int ret; - -- regmap = device_node_to_regmap(node); -+ base = devm_platform_ioremap_resource(pdev, 0); -+ if (IS_ERR(base)) -+ return PTR_ERR(base); -+ -+ regmap = regmap_init_mmio(dev, base, &k3_chipinfo_regmap_cfg); - if (IS_ERR(regmap)) - return PTR_ERR(regmap); - -diff --git a/drivers/soundwire/amd_manager.c b/drivers/soundwire/amd_manager.c -index 79173ab540a6bf..31b203ebbae0ca 100644 ---- a/drivers/soundwire/amd_manager.c -+++ b/drivers/soundwire/amd_manager.c -@@ -1138,6 +1138,7 @@ static int __maybe_unused amd_suspend(struct device *dev) - amd_sdw_wake_enable(amd_manager, false); - return amd_sdw_clock_stop(amd_manager); - } else if (amd_manager->power_mode_mask & AMD_SDW_POWER_OFF_MODE) { -+ amd_sdw_wake_enable(amd_manager, false); - /* - * As per hardware programming sequence on AMD platforms, - * clock stop should be invoked first before powering-off -@@ -1165,6 +1166,7 @@ static int __maybe_unused amd_suspend_runtime(struct device *dev) - amd_sdw_wake_enable(amd_manager, true); - return amd_sdw_clock_stop(amd_manager); - } else if (amd_manager->power_mode_mask & AMD_SDW_POWER_OFF_MODE) { -+ amd_sdw_wake_enable(amd_manager, true); - ret = amd_sdw_clock_stop(amd_manager); - if (ret) - return ret; -diff --git a/drivers/soundwire/bus.c b/drivers/soundwire/bus.c -index e7553c38be59d6..767942f19adb6a 100644 ---- a/drivers/soundwire/bus.c -+++ b/drivers/soundwire/bus.c -@@ -121,6 +121,10 @@ int sdw_bus_master_add(struct sdw_bus *bus, struct device *parent, - set_bit(SDW_GROUP13_DEV_NUM, bus->assigned); - set_bit(SDW_MASTER_DEV_NUM, bus->assigned); - -+ ret = sdw_irq_create(bus, fwnode); -+ if (ret) -+ return ret; -+ - /* - * SDW is an enumerable bus, but devices can be powered off. So, - * they won't be able to report as present. -@@ -137,6 +141,7 @@ int sdw_bus_master_add(struct sdw_bus *bus, struct device *parent, - - if (ret < 0) { - dev_err(bus->dev, "Finding slaves failed:%d\n", ret); -+ sdw_irq_delete(bus); - return ret; - } - -@@ -155,10 +160,6 @@ int sdw_bus_master_add(struct sdw_bus *bus, struct device *parent, - bus->params.curr_bank = SDW_BANK0; - bus->params.next_bank = SDW_BANK1; - -- ret = sdw_irq_create(bus, fwnode); -- if (ret) -- return ret; -- - return 0; - } - EXPORT_SYMBOL(sdw_bus_master_add); -diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c -index bcb0de864d34db..7dd94369abb47c 100644 ---- a/drivers/spi/spi-fsl-dspi.c -+++ b/drivers/spi/spi-fsl-dspi.c -@@ -1,7 +1,7 @@ - // SPDX-License-Identifier: GPL-2.0+ - // - // Copyright 2013 Freescale Semiconductor, Inc. --// Copyright 2020 NXP -+// Copyright 2020-2025 NXP - // - // Freescale DSPI driver - // This file contains a driver for the Freescale DSPI -@@ -62,6 +62,7 @@ - #define SPI_SR_TFIWF BIT(18) - #define SPI_SR_RFDF BIT(17) - #define SPI_SR_CMDFFF BIT(16) -+#define SPI_SR_TXRXS BIT(30) - #define SPI_SR_CLEAR (SPI_SR_TCFQF | \ - SPI_SR_TFUF | SPI_SR_TFFF | \ - SPI_SR_CMDTCF | SPI_SR_SPEF | \ -@@ -926,9 +927,20 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr, - struct spi_transfer *transfer; - bool cs = false; - int status = 0; -+ u32 val = 0; -+ bool cs_change = false; - - message->actual_length = 0; - -+ /* Put DSPI in running mode if halted. */ -+ regmap_read(dspi->regmap, SPI_MCR, &val); -+ if (val & SPI_MCR_HALT) { -+ regmap_update_bits(dspi->regmap, SPI_MCR, SPI_MCR_HALT, 0); -+ while (regmap_read(dspi->regmap, SPI_SR, &val) >= 0 && -+ !(val & SPI_SR_TXRXS)) -+ ; -+ } -+ - list_for_each_entry(transfer, &message->transfers, transfer_list) { - dspi->cur_transfer = transfer; - dspi->cur_msg = message; -@@ -958,6 +970,7 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr, - dspi->tx_cmd |= SPI_PUSHR_CMD_CONT; - } - -+ cs_change = transfer->cs_change; - dspi->tx = transfer->tx_buf; - dspi->rx = transfer->rx_buf; - dspi->len = transfer->len; -@@ -967,6 +980,8 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr, - SPI_MCR_CLR_TXF | SPI_MCR_CLR_RXF, - SPI_MCR_CLR_TXF | SPI_MCR_CLR_RXF); - -+ regmap_write(dspi->regmap, SPI_SR, SPI_SR_CLEAR); -+ - spi_take_timestamp_pre(dspi->ctlr, dspi->cur_transfer, - dspi->progress, !dspi->irq); - -@@ -993,6 +1008,15 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr, - dspi_deassert_cs(spi, &cs); - } - -+ if (status || !cs_change) { -+ /* Put DSPI in stop mode */ -+ regmap_update_bits(dspi->regmap, SPI_MCR, -+ SPI_MCR_HALT, SPI_MCR_HALT); -+ while (regmap_read(dspi->regmap, SPI_SR, &val) >= 0 && -+ val & SPI_SR_TXRXS) -+ ; -+ } -+ - message->status = status; - spi_finalize_current_message(ctlr); - -@@ -1163,6 +1187,20 @@ static int dspi_resume(struct device *dev) - - static SIMPLE_DEV_PM_OPS(dspi_pm, dspi_suspend, dspi_resume); - -+static const struct regmap_range dspi_yes_ranges[] = { -+ regmap_reg_range(SPI_MCR, SPI_MCR), -+ regmap_reg_range(SPI_TCR, SPI_CTAR(3)), -+ regmap_reg_range(SPI_SR, SPI_TXFR3), -+ regmap_reg_range(SPI_RXFR0, SPI_RXFR3), -+ regmap_reg_range(SPI_CTARE(0), SPI_CTARE(3)), -+ regmap_reg_range(SPI_SREX, SPI_SREX), -+}; -+ -+static const struct regmap_access_table dspi_access_table = { -+ .yes_ranges = dspi_yes_ranges, -+ .n_yes_ranges = ARRAY_SIZE(dspi_yes_ranges), -+}; -+ - static const struct regmap_range dspi_volatile_ranges[] = { - regmap_reg_range(SPI_MCR, SPI_TCR), - regmap_reg_range(SPI_SR, SPI_SR), -@@ -1180,6 +1218,8 @@ static const struct regmap_config dspi_regmap_config = { - .reg_stride = 4, - .max_register = 0x88, - .volatile_table = &dspi_volatile_table, -+ .rd_table = &dspi_access_table, -+ .wr_table = &dspi_access_table, - }; - - static const struct regmap_range dspi_xspi_volatile_ranges[] = { -@@ -1201,6 +1241,8 @@ static const struct regmap_config dspi_xspi_regmap_config[] = { - .reg_stride = 4, - .max_register = 0x13c, - .volatile_table = &dspi_xspi_volatile_table, -+ .rd_table = &dspi_access_table, -+ .wr_table = &dspi_access_table, - }, - { - .name = "pushr", -@@ -1223,6 +1265,8 @@ static int dspi_init(struct fsl_dspi *dspi) - if (!spi_controller_is_target(dspi->ctlr)) - mcr |= SPI_MCR_HOST; - -+ mcr |= SPI_MCR_HALT; -+ - regmap_write(dspi->regmap, SPI_MCR, mcr); - regmap_write(dspi->regmap, SPI_SR, SPI_SR_CLEAR); - -diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c -index 1f374cf4d6f65c..1615f935c8f03f 100644 ---- a/drivers/spi/spi-rockchip.c -+++ b/drivers/spi/spi-rockchip.c -@@ -542,7 +542,7 @@ static int rockchip_spi_config(struct rockchip_spi *rs, - cr0 |= (spi->mode & 0x3U) << CR0_SCPH_OFFSET; - if (spi->mode & SPI_LSB_FIRST) - cr0 |= CR0_FBM_LSB << CR0_FBM_OFFSET; -- if (spi->mode & SPI_CS_HIGH) -+ if ((spi->mode & SPI_CS_HIGH) && !(spi_get_csgpiod(spi, 0))) - cr0 |= BIT(spi_get_chipselect(spi, 0)) << CR0_SOI_OFFSET; - - if (xfer->rx_buf && xfer->tx_buf) -diff --git a/drivers/spi/spi-sun4i.c b/drivers/spi/spi-sun4i.c -index b8947265d329e4..5b2cb225a41983 100644 ---- a/drivers/spi/spi-sun4i.c -+++ b/drivers/spi/spi-sun4i.c -@@ -263,6 +263,9 @@ static int sun4i_spi_transfer_one(struct spi_master *master, - else - reg |= SUN4I_CTL_DHB; - -+ /* Now that the settings are correct, enable the interface */ -+ reg |= SUN4I_CTL_ENABLE; -+ - sun4i_spi_write(sspi, SUN4I_CTL_REG, reg); - - /* Ensure that we have a parent clock fast enough */ -@@ -403,7 +406,7 @@ static int sun4i_spi_runtime_resume(struct device *dev) - } - - sun4i_spi_write(sspi, SUN4I_CTL_REG, -- SUN4I_CTL_ENABLE | SUN4I_CTL_MASTER | SUN4I_CTL_TP); -+ SUN4I_CTL_MASTER | SUN4I_CTL_TP); - - return 0; - -diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c -index 3503e6c0a5c983..b5deb4fe3b8324 100644 ---- a/drivers/spi/spi-zynqmp-gqspi.c -+++ b/drivers/spi/spi-zynqmp-gqspi.c -@@ -799,7 +799,6 @@ static void zynqmp_process_dma_irq(struct zynqmp_qspi *xqspi) - static irqreturn_t zynqmp_qspi_irq(int irq, void *dev_id) - { - struct zynqmp_qspi *xqspi = (struct zynqmp_qspi *)dev_id; -- irqreturn_t ret = IRQ_NONE; - u32 status, mask, dma_status = 0; - - status = zynqmp_gqspi_read(xqspi, GQSPI_ISR_OFST); -@@ -814,27 +813,24 @@ static irqreturn_t zynqmp_qspi_irq(int irq, void *dev_id) - dma_status); - } - -- if (mask & GQSPI_ISR_TXNOT_FULL_MASK) { -+ if (!mask && !dma_status) -+ return IRQ_NONE; -+ -+ if (mask & GQSPI_ISR_TXNOT_FULL_MASK) - zynqmp_qspi_filltxfifo(xqspi, GQSPI_TX_FIFO_FILL); -- ret = IRQ_HANDLED; -- } - -- if (dma_status & GQSPI_QSPIDMA_DST_I_STS_DONE_MASK) { -+ if (dma_status & GQSPI_QSPIDMA_DST_I_STS_DONE_MASK) - zynqmp_process_dma_irq(xqspi); -- ret = IRQ_HANDLED; -- } else if (!(mask & GQSPI_IER_RXEMPTY_MASK) && -- (mask & GQSPI_IER_GENFIFOEMPTY_MASK)) { -+ else if (!(mask & GQSPI_IER_RXEMPTY_MASK) && -+ (mask & GQSPI_IER_GENFIFOEMPTY_MASK)) - zynqmp_qspi_readrxfifo(xqspi, GQSPI_RX_FIFO_FILL); -- ret = IRQ_HANDLED; -- } - - if (xqspi->bytes_to_receive == 0 && xqspi->bytes_to_transfer == 0 && - ((status & GQSPI_IRQ_MASK) == GQSPI_IRQ_MASK)) { - zynqmp_gqspi_write(xqspi, GQSPI_IDR_OFST, GQSPI_ISR_IDR_MASK); - complete(&xqspi->data_completion); -- ret = IRQ_HANDLED; - } -- return ret; -+ return IRQ_HANDLED; - } - - /** -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index b516c2893420bc..b756d4cfecfe93 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -4323,8 +4323,8 @@ int iscsit_close_connection( - spin_unlock(&iscsit_global->ts_bitmap_lock); - - iscsit_stop_timers_for_cmds(conn); -- iscsit_stop_nopin_response_timer(conn); - iscsit_stop_nopin_timer(conn); -+ iscsit_stop_nopin_response_timer(conn); - - if (conn->conn_transport->iscsit_wait_conn) - conn->conn_transport->iscsit_wait_conn(conn); -diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c -index f110f932ba0543..675f774be1d30e 100644 ---- a/drivers/target/target_core_spc.c -+++ b/drivers/target/target_core_spc.c -@@ -2151,8 +2151,10 @@ spc_rsoc_get_descr(struct se_cmd *cmd, struct target_opcode_descriptor **opcode) - if (descr->serv_action_valid) - return TCM_INVALID_CDB_FIELD; - -- if (!descr->enabled || descr->enabled(descr, cmd)) -+ if (!descr->enabled || descr->enabled(descr, cmd)) { - *opcode = descr; -+ return TCM_NO_SENSE; -+ } - break; - case 0x2: - /* -@@ -2166,8 +2168,10 @@ spc_rsoc_get_descr(struct se_cmd *cmd, struct target_opcode_descriptor **opcode) - if (descr->serv_action_valid && - descr->service_action == requested_sa) { - if (!descr->enabled || descr->enabled(descr, -- cmd)) -+ cmd)) { - *opcode = descr; -+ return TCM_NO_SENSE; -+ } - } else if (!descr->serv_action_valid) - return TCM_INVALID_CDB_FIELD; - break; -@@ -2180,13 +2184,15 @@ spc_rsoc_get_descr(struct se_cmd *cmd, struct target_opcode_descriptor **opcode) - */ - if (descr->service_action == requested_sa) - if (!descr->enabled || descr->enabled(descr, -- cmd)) -+ cmd)) { - *opcode = descr; -+ return TCM_NO_SENSE; -+ } - break; - } - } - -- return 0; -+ return TCM_NO_SENSE; - } - - static sense_reason_t -diff --git a/drivers/thermal/intel/x86_pkg_temp_thermal.c b/drivers/thermal/intel/x86_pkg_temp_thermal.c -index 61c3d450ee605a..2e06b26be4ef69 100644 ---- a/drivers/thermal/intel/x86_pkg_temp_thermal.c -+++ b/drivers/thermal/intel/x86_pkg_temp_thermal.c -@@ -331,6 +331,7 @@ static int pkg_temp_thermal_device_add(unsigned int cpu) - tj_max = intel_tcc_get_tjmax(cpu); - if (tj_max < 0) - return tj_max; -+ tj_max *= 1000; - - zonedev = kzalloc(sizeof(*zonedev), GFP_KERNEL); - if (!zonedev) -diff --git a/drivers/thermal/qoriq_thermal.c b/drivers/thermal/qoriq_thermal.c -index 404f01cca4dab5..ff8657afb31d3c 100644 ---- a/drivers/thermal/qoriq_thermal.c -+++ b/drivers/thermal/qoriq_thermal.c -@@ -18,6 +18,7 @@ - #define SITES_MAX 16 - #define TMR_DISABLE 0x0 - #define TMR_ME 0x80000000 -+#define TMR_CMD BIT(29) - #define TMR_ALPF 0x0c000000 - #define TMR_ALPF_V2 0x03000000 - #define TMTMIR_DEFAULT 0x0000000f -@@ -356,6 +357,12 @@ static int __maybe_unused qoriq_tmu_suspend(struct device *dev) - if (ret) - return ret; - -+ if (data->ver > TMU_VER1) { -+ ret = regmap_set_bits(data->regmap, REGS_TMR, TMR_CMD); -+ if (ret) -+ return ret; -+ } -+ - clk_disable_unprepare(data->clk); - - return 0; -@@ -370,6 +377,12 @@ static int __maybe_unused qoriq_tmu_resume(struct device *dev) - if (ret) - return ret; - -+ if (data->ver > TMU_VER1) { -+ ret = regmap_clear_bits(data->regmap, REGS_TMR, TMR_CMD); -+ if (ret) -+ return ret; -+ } -+ - /* Enable monitoring */ - return regmap_update_bits(data->regmap, REGS_TMR, TMR_ME, TMR_ME); - } -diff --git a/drivers/thunderbolt/retimer.c b/drivers/thunderbolt/retimer.c -index 2ee8c5ebca7c3c..43146c0685dfa7 100644 ---- a/drivers/thunderbolt/retimer.c -+++ b/drivers/thunderbolt/retimer.c -@@ -89,9 +89,11 @@ static int tb_retimer_nvm_add(struct tb_retimer *rt) - if (ret) - goto err_nvm; - -- ret = tb_nvm_add_non_active(nvm, nvm_write); -- if (ret) -- goto err_nvm; -+ if (!rt->no_nvm_upgrade) { -+ ret = tb_nvm_add_non_active(nvm, nvm_write); -+ if (ret) -+ goto err_nvm; -+ } - - rt->nvm = nvm; - return 0; -diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c -index c2778300e15100..d5ad6cae6b652b 100644 ---- a/drivers/tty/serial/8250/8250_port.c -+++ b/drivers/tty/serial/8250/8250_port.c -@@ -1676,7 +1676,7 @@ static void serial8250_disable_ms(struct uart_port *port) - if (up->bugs & UART_BUG_NOMSR) - return; - -- mctrl_gpio_disable_ms(up->gpios); -+ mctrl_gpio_disable_ms_no_sync(up->gpios); - - up->ier &= ~UART_IER_MSI; - serial_port_out(port, UART_IER, up->ier); -diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c -index bcca5627afaca8..85559d9b35d830 100644 ---- a/drivers/tty/serial/atmel_serial.c -+++ b/drivers/tty/serial/atmel_serial.c -@@ -698,7 +698,7 @@ static void atmel_disable_ms(struct uart_port *port) - - atmel_port->ms_irq_enabled = false; - -- mctrl_gpio_disable_ms(atmel_port->gpios); -+ mctrl_gpio_disable_ms_no_sync(atmel_port->gpios); - - if (!mctrl_gpio_to_gpiod(atmel_port->gpios, UART_GPIO_CTS)) - idr |= ATMEL_US_CTSIC; -diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c -index 349d4849ba5e3b..04809b781f45be 100644 ---- a/drivers/tty/serial/imx.c -+++ b/drivers/tty/serial/imx.c -@@ -1597,7 +1597,7 @@ static void imx_uart_shutdown(struct uart_port *port) - imx_uart_dma_exit(sport); - } - -- mctrl_gpio_disable_ms(sport->gpios); -+ mctrl_gpio_disable_ms_sync(sport->gpios); - - spin_lock_irqsave(&sport->port.lock, flags); - ucr2 = imx_uart_readl(sport, UCR2); -diff --git a/drivers/tty/serial/serial_mctrl_gpio.c b/drivers/tty/serial/serial_mctrl_gpio.c -index 7d5aaa8d422b19..d5fb293dd5a93c 100644 ---- a/drivers/tty/serial/serial_mctrl_gpio.c -+++ b/drivers/tty/serial/serial_mctrl_gpio.c -@@ -322,11 +322,7 @@ void mctrl_gpio_enable_ms(struct mctrl_gpios *gpios) - } - EXPORT_SYMBOL_GPL(mctrl_gpio_enable_ms); - --/** -- * mctrl_gpio_disable_ms - disable irqs and handling of changes to the ms lines -- * @gpios: gpios to disable -- */ --void mctrl_gpio_disable_ms(struct mctrl_gpios *gpios) -+static void mctrl_gpio_disable_ms(struct mctrl_gpios *gpios, bool sync) - { - enum mctrl_gpio_idx i; - -@@ -342,10 +338,34 @@ void mctrl_gpio_disable_ms(struct mctrl_gpios *gpios) - if (!gpios->irq[i]) - continue; - -- disable_irq(gpios->irq[i]); -+ if (sync) -+ disable_irq(gpios->irq[i]); -+ else -+ disable_irq_nosync(gpios->irq[i]); - } - } --EXPORT_SYMBOL_GPL(mctrl_gpio_disable_ms); -+ -+/** -+ * mctrl_gpio_disable_ms_sync - disable irqs and handling of changes to the ms -+ * lines, and wait for any pending IRQ to be processed -+ * @gpios: gpios to disable -+ */ -+void mctrl_gpio_disable_ms_sync(struct mctrl_gpios *gpios) -+{ -+ mctrl_gpio_disable_ms(gpios, true); -+} -+EXPORT_SYMBOL_GPL(mctrl_gpio_disable_ms_sync); -+ -+/** -+ * mctrl_gpio_disable_ms_no_sync - disable irqs and handling of changes to the -+ * ms lines, and return immediately -+ * @gpios: gpios to disable -+ */ -+void mctrl_gpio_disable_ms_no_sync(struct mctrl_gpios *gpios) -+{ -+ mctrl_gpio_disable_ms(gpios, false); -+} -+EXPORT_SYMBOL_GPL(mctrl_gpio_disable_ms_no_sync); - - void mctrl_gpio_enable_irq_wake(struct mctrl_gpios *gpios) - { -diff --git a/drivers/tty/serial/serial_mctrl_gpio.h b/drivers/tty/serial/serial_mctrl_gpio.h -index fc76910fb105a3..79e97838ebe567 100644 ---- a/drivers/tty/serial/serial_mctrl_gpio.h -+++ b/drivers/tty/serial/serial_mctrl_gpio.h -@@ -87,9 +87,16 @@ void mctrl_gpio_free(struct device *dev, struct mctrl_gpios *gpios); - void mctrl_gpio_enable_ms(struct mctrl_gpios *gpios); - - /* -- * Disable gpio interrupts to report status line changes. -+ * Disable gpio interrupts to report status line changes, and block until -+ * any corresponding IRQ is processed - */ --void mctrl_gpio_disable_ms(struct mctrl_gpios *gpios); -+void mctrl_gpio_disable_ms_sync(struct mctrl_gpios *gpios); -+ -+/* -+ * Disable gpio interrupts to report status line changes, and return -+ * immediately -+ */ -+void mctrl_gpio_disable_ms_no_sync(struct mctrl_gpios *gpios); - - /* - * Enable gpio wakeup interrupts to enable wake up source. -@@ -148,7 +155,11 @@ static inline void mctrl_gpio_enable_ms(struct mctrl_gpios *gpios) - { - } - --static inline void mctrl_gpio_disable_ms(struct mctrl_gpios *gpios) -+static inline void mctrl_gpio_disable_ms_sync(struct mctrl_gpios *gpios) -+{ -+} -+ -+static inline void mctrl_gpio_disable_ms_no_sync(struct mctrl_gpios *gpios) - { - } - -diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c -index 4350a69d97d7ac..61d8f50676b1bd 100644 ---- a/drivers/tty/serial/sh-sci.c -+++ b/drivers/tty/serial/sh-sci.c -@@ -104,6 +104,20 @@ struct plat_sci_reg { - u8 offset, size; - }; - -+struct sci_suspend_regs { -+ u16 scdl; -+ u16 sccks; -+ u16 scsmr; -+ u16 scscr; -+ u16 scfcr; -+ u16 scsptr; -+ u16 hssrr; -+ u16 scpcr; -+ u16 scpdr; -+ u8 scbrr; -+ u8 semr; -+}; -+ - struct sci_port_params { - const struct plat_sci_reg regs[SCIx_NR_REGS]; - unsigned int fifosize; -@@ -134,6 +148,8 @@ struct sci_port { - struct dma_chan *chan_tx; - struct dma_chan *chan_rx; - -+ struct reset_control *rstc; -+ - #ifdef CONFIG_SERIAL_SH_SCI_DMA - struct dma_chan *chan_tx_saved; - struct dma_chan *chan_rx_saved; -@@ -153,6 +169,7 @@ struct sci_port { - int rx_trigger; - struct timer_list rx_fifo_timer; - int rx_fifo_timeout; -+ struct sci_suspend_regs suspend_regs; - u16 hscif_tot; - - bool has_rtscts; -@@ -2237,7 +2254,7 @@ static void sci_shutdown(struct uart_port *port) - dev_dbg(port->dev, "%s(%d)\n", __func__, port->line); - - s->autorts = false; -- mctrl_gpio_disable_ms(to_sci_port(port)->gpios); -+ mctrl_gpio_disable_ms_sync(to_sci_port(port)->gpios); - - spin_lock_irqsave(&port->lock, flags); - sci_stop_rx(port); -@@ -3325,6 +3342,7 @@ static struct plat_sci_port *sci_parse_dt(struct platform_device *pdev, - } - - sp = &sci_ports[id]; -+ sp->rstc = rstc; - *dev_id = id; - - p->type = SCI_OF_TYPE(data); -@@ -3473,13 +3491,77 @@ static int sci_probe(struct platform_device *dev) - return 0; - } - -+static void sci_console_save(struct sci_port *s) -+{ -+ struct sci_suspend_regs *regs = &s->suspend_regs; -+ struct uart_port *port = &s->port; -+ -+ if (sci_getreg(port, SCDL)->size) -+ regs->scdl = sci_serial_in(port, SCDL); -+ if (sci_getreg(port, SCCKS)->size) -+ regs->sccks = sci_serial_in(port, SCCKS); -+ if (sci_getreg(port, SCSMR)->size) -+ regs->scsmr = sci_serial_in(port, SCSMR); -+ if (sci_getreg(port, SCSCR)->size) -+ regs->scscr = sci_serial_in(port, SCSCR); -+ if (sci_getreg(port, SCFCR)->size) -+ regs->scfcr = sci_serial_in(port, SCFCR); -+ if (sci_getreg(port, SCSPTR)->size) -+ regs->scsptr = sci_serial_in(port, SCSPTR); -+ if (sci_getreg(port, SCBRR)->size) -+ regs->scbrr = sci_serial_in(port, SCBRR); -+ if (sci_getreg(port, HSSRR)->size) -+ regs->hssrr = sci_serial_in(port, HSSRR); -+ if (sci_getreg(port, SCPCR)->size) -+ regs->scpcr = sci_serial_in(port, SCPCR); -+ if (sci_getreg(port, SCPDR)->size) -+ regs->scpdr = sci_serial_in(port, SCPDR); -+ if (sci_getreg(port, SEMR)->size) -+ regs->semr = sci_serial_in(port, SEMR); -+} -+ -+static void sci_console_restore(struct sci_port *s) -+{ -+ struct sci_suspend_regs *regs = &s->suspend_regs; -+ struct uart_port *port = &s->port; -+ -+ if (sci_getreg(port, SCDL)->size) -+ sci_serial_out(port, SCDL, regs->scdl); -+ if (sci_getreg(port, SCCKS)->size) -+ sci_serial_out(port, SCCKS, regs->sccks); -+ if (sci_getreg(port, SCSMR)->size) -+ sci_serial_out(port, SCSMR, regs->scsmr); -+ if (sci_getreg(port, SCSCR)->size) -+ sci_serial_out(port, SCSCR, regs->scscr); -+ if (sci_getreg(port, SCFCR)->size) -+ sci_serial_out(port, SCFCR, regs->scfcr); -+ if (sci_getreg(port, SCSPTR)->size) -+ sci_serial_out(port, SCSPTR, regs->scsptr); -+ if (sci_getreg(port, SCBRR)->size) -+ sci_serial_out(port, SCBRR, regs->scbrr); -+ if (sci_getreg(port, HSSRR)->size) -+ sci_serial_out(port, HSSRR, regs->hssrr); -+ if (sci_getreg(port, SCPCR)->size) -+ sci_serial_out(port, SCPCR, regs->scpcr); -+ if (sci_getreg(port, SCPDR)->size) -+ sci_serial_out(port, SCPDR, regs->scpdr); -+ if (sci_getreg(port, SEMR)->size) -+ sci_serial_out(port, SEMR, regs->semr); -+} -+ - static __maybe_unused int sci_suspend(struct device *dev) - { - struct sci_port *sport = dev_get_drvdata(dev); - -- if (sport) -+ if (sport) { - uart_suspend_port(&sci_uart_driver, &sport->port); - -+ if (!console_suspend_enabled && uart_console(&sport->port)) -+ sci_console_save(sport); -+ else -+ return reset_control_assert(sport->rstc); -+ } -+ - return 0; - } - -@@ -3487,8 +3569,18 @@ static __maybe_unused int sci_resume(struct device *dev) - { - struct sci_port *sport = dev_get_drvdata(dev); - -- if (sport) -+ if (sport) { -+ if (!console_suspend_enabled && uart_console(&sport->port)) { -+ sci_console_restore(sport); -+ } else { -+ int ret = reset_control_deassert(sport->rstc); -+ -+ if (ret) -+ return ret; -+ } -+ - uart_resume_port(&sci_uart_driver, &sport->port); -+ } - - return 0; - } -diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c -index 9ef90bb30a47eb..b58422ae156c93 100644 ---- a/drivers/tty/serial/stm32-usart.c -+++ b/drivers/tty/serial/stm32-usart.c -@@ -952,7 +952,7 @@ static void stm32_usart_enable_ms(struct uart_port *port) - - static void stm32_usart_disable_ms(struct uart_port *port) - { -- mctrl_gpio_disable_ms(to_stm32_port(port)->gpios); -+ mctrl_gpio_disable_ms_sync(to_stm32_port(port)->gpios); - } - - /* Transmit stop */ -diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c -index cb5611cbf45474..2346a1fc72b56e 100644 ---- a/drivers/ufs/core/ufshcd.c -+++ b/drivers/ufs/core/ufshcd.c -@@ -257,6 +257,7 @@ static const struct ufs_dev_quirk ufs_fixups[] = { - .model = UFS_ANY_MODEL, - .quirk = UFS_DEVICE_QUIRK_DELAY_BEFORE_LPM | - UFS_DEVICE_QUIRK_HOST_PA_TACTIVATE | -+ UFS_DEVICE_QUIRK_PA_HIBER8TIME | - UFS_DEVICE_QUIRK_RECOVERY_FROM_DL_NAC_ERRORS }, - { .wmanufacturerid = UFS_VENDOR_SKHYNIX, - .model = UFS_ANY_MODEL, -@@ -8459,6 +8460,31 @@ static int ufshcd_quirk_tune_host_pa_tactivate(struct ufs_hba *hba) - return ret; - } - -+/** -+ * ufshcd_quirk_override_pa_h8time - Ensures proper adjustment of PA_HIBERN8TIME. -+ * @hba: per-adapter instance -+ * -+ * Some UFS devices require specific adjustments to the PA_HIBERN8TIME parameter -+ * to ensure proper hibernation timing. This function retrieves the current -+ * PA_HIBERN8TIME value and increments it by 100us. -+ */ -+static void ufshcd_quirk_override_pa_h8time(struct ufs_hba *hba) -+{ -+ u32 pa_h8time; -+ int ret; -+ -+ ret = ufshcd_dme_get(hba, UIC_ARG_MIB(PA_HIBERN8TIME), &pa_h8time); -+ if (ret) { -+ dev_err(hba->dev, "Failed to get PA_HIBERN8TIME: %d\n", ret); -+ return; -+ } -+ -+ /* Increment by 1 to increase hibernation time by 100 µs */ -+ ret = ufshcd_dme_set(hba, UIC_ARG_MIB(PA_HIBERN8TIME), pa_h8time + 1); -+ if (ret) -+ dev_err(hba->dev, "Failed updating PA_HIBERN8TIME: %d\n", ret); -+} -+ - static void ufshcd_tune_unipro_params(struct ufs_hba *hba) - { - if (ufshcd_is_unipro_pa_params_tuning_req(hba)) { -@@ -8474,6 +8500,9 @@ static void ufshcd_tune_unipro_params(struct ufs_hba *hba) - - if (hba->dev_quirks & UFS_DEVICE_QUIRK_HOST_PA_TACTIVATE) - ufshcd_quirk_tune_host_pa_tactivate(hba); -+ -+ if (hba->dev_quirks & UFS_DEVICE_QUIRK_PA_HIBER8TIME) -+ ufshcd_quirk_override_pa_h8time(hba); - } - - static void ufshcd_clear_dbg_ufs_stats(struct ufs_hba *hba) -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index 5a53280fa2edfd..44352df58c9e4e 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -1180,7 +1180,14 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id, - */ - switch (GET_EP_CTX_STATE(ep_ctx)) { - case EP_STATE_HALTED: -- xhci_dbg(xhci, "Stop ep completion raced with stall, reset ep\n"); -+ xhci_dbg(xhci, "Stop ep completion raced with stall\n"); -+ /* -+ * If the halt happened before Stop Endpoint failed, its transfer event -+ * should have already been handled and Reset Endpoint should be pending. -+ */ -+ if (ep->ep_state & EP_HALTED) -+ goto reset_done; -+ - if (ep->ep_state & EP_HAS_STREAMS) { - reset_type = EP_SOFT_RESET; - } else { -@@ -1191,8 +1198,11 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id, - } - /* reset ep, reset handler cleans up cancelled tds */ - err = xhci_handle_halted_endpoint(xhci, ep, td, reset_type); -+ xhci_dbg(xhci, "Stop ep completion resetting ep, status %d\n", err); - if (err) - break; -+reset_done: -+ /* Reset EP handler will clean up cancelled TDs */ - ep->ep_state &= ~EP_STOP_CMD_PENDING; - return; - case EP_STATE_STOPPED: -diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c -index b56aae3f7be378..9b8b70ffde5a0a 100644 ---- a/drivers/vdpa/mlx5/net/mlx5_vnet.c -+++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c -@@ -3420,6 +3420,9 @@ static int mlx5_vdpa_dev_add(struct vdpa_mgmt_dev *v_mdev, const char *name, - ndev->mvdev.max_vqs = max_vqs; - mvdev = &ndev->mvdev; - mvdev->mdev = mdev; -+ /* cpu_to_mlx5vdpa16() below depends on this flag */ -+ mvdev->actual_features = -+ (device_features & BIT_ULL(VIRTIO_F_VERSION_1)); - - ndev->vqs = kcalloc(max_vqs, sizeof(*ndev->vqs), GFP_KERNEL); - ndev->event_cbs = kcalloc(max_vqs + 1, sizeof(*ndev->event_cbs), GFP_KERNEL); -diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c -index a2ad4f7c716bf3..d9eb8733a324b7 100644 ---- a/drivers/vfio/pci/vfio_pci_config.c -+++ b/drivers/vfio/pci/vfio_pci_config.c -@@ -1813,7 +1813,8 @@ int vfio_config_init(struct vfio_pci_core_device *vdev) - cpu_to_le16(PCI_COMMAND_MEMORY); - } - -- if (!IS_ENABLED(CONFIG_VFIO_PCI_INTX) || vdev->nointx) -+ if (!IS_ENABLED(CONFIG_VFIO_PCI_INTX) || vdev->nointx || -+ vdev->pdev->irq == IRQ_NOTCONNECTED) - vconfig[PCI_INTERRUPT_PIN] = 0; - - ret = vfio_cap_init(vdev); -diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c -index a8f259bc2f4d0c..fa168b43423954 100644 ---- a/drivers/vfio/pci/vfio_pci_core.c -+++ b/drivers/vfio/pci/vfio_pci_core.c -@@ -731,15 +731,7 @@ EXPORT_SYMBOL_GPL(vfio_pci_core_finish_enable); - static int vfio_pci_get_irq_count(struct vfio_pci_core_device *vdev, int irq_type) - { - if (irq_type == VFIO_PCI_INTX_IRQ_INDEX) { -- u8 pin; -- -- if (!IS_ENABLED(CONFIG_VFIO_PCI_INTX) || -- vdev->nointx || vdev->pdev->is_virtfn) -- return 0; -- -- pci_read_config_byte(vdev->pdev, PCI_INTERRUPT_PIN, &pin); -- -- return pin ? 1 : 0; -+ return vdev->vconfig[PCI_INTERRUPT_PIN] ? 1 : 0; - } else if (irq_type == VFIO_PCI_MSI_IRQ_INDEX) { - u8 pos; - u16 flags; -diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c -index 620134041b4881..c4322faca2bd5b 100644 ---- a/drivers/vfio/pci/vfio_pci_intrs.c -+++ b/drivers/vfio/pci/vfio_pci_intrs.c -@@ -269,7 +269,7 @@ static int vfio_intx_enable(struct vfio_pci_core_device *vdev, - if (!is_irq_none(vdev)) - return -EINVAL; - -- if (!pdev->irq) -+ if (!pdev->irq || pdev->irq == IRQ_NOTCONNECTED) - return -ENODEV; - - name = kasprintf(GFP_KERNEL_ACCOUNT, "vfio-intx(%s)", pci_name(pdev)); -diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c -index 8d8a22504d71fc..66235151115740 100644 ---- a/drivers/vhost/scsi.c -+++ b/drivers/vhost/scsi.c -@@ -560,6 +560,9 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) - int ret; - - llnode = llist_del_all(&svq->completion_list); -+ -+ mutex_lock(&svq->vq.mutex); -+ - llist_for_each_entry_safe(cmd, t, llnode, tvc_completion_list) { - se_cmd = &cmd->tvc_se_cmd; - -@@ -593,6 +596,8 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) - vhost_scsi_release_cmd_res(se_cmd); - } - -+ mutex_unlock(&svq->vq.mutex); -+ - if (signal) - vhost_signal(&svq->vs->dev, &svq->vq); - } -@@ -746,7 +751,7 @@ vhost_scsi_copy_iov_to_sgl(struct vhost_scsi_cmd *cmd, struct iov_iter *iter, - size_t len = iov_iter_count(iter); - unsigned int nbytes = 0; - struct page *page; -- int i; -+ int i, ret; - - if (cmd->tvc_data_direction == DMA_FROM_DEVICE) { - cmd->saved_iter_addr = dup_iter(&cmd->saved_iter, iter, -@@ -759,6 +764,7 @@ vhost_scsi_copy_iov_to_sgl(struct vhost_scsi_cmd *cmd, struct iov_iter *iter, - page = alloc_page(GFP_KERNEL); - if (!page) { - i--; -+ ret = -ENOMEM; - goto err; - } - -@@ -766,8 +772,10 @@ vhost_scsi_copy_iov_to_sgl(struct vhost_scsi_cmd *cmd, struct iov_iter *iter, - sg_set_page(&sg[i], page, nbytes, 0); - - if (cmd->tvc_data_direction == DMA_TO_DEVICE && -- copy_page_from_iter(page, 0, nbytes, iter) != nbytes) -+ copy_page_from_iter(page, 0, nbytes, iter) != nbytes) { -+ ret = -EFAULT; - goto err; -+ } - - len -= nbytes; - } -@@ -782,7 +790,7 @@ vhost_scsi_copy_iov_to_sgl(struct vhost_scsi_cmd *cmd, struct iov_iter *iter, - for (; i >= 0; i--) - __free_page(sg_page(&sg[i])); - kfree(cmd->saved_iter_addr); -- return -ENOMEM; -+ return ret; - } - - static int -@@ -1221,9 +1229,9 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) - " %d\n", cmd, exp_data_len, prot_bytes, data_direction); - - if (data_direction != DMA_NONE) { -- if (unlikely(vhost_scsi_mapal(cmd, prot_bytes, -- &prot_iter, exp_data_len, -- &data_iter))) { -+ ret = vhost_scsi_mapal(cmd, prot_bytes, &prot_iter, -+ exp_data_len, &data_iter); -+ if (unlikely(ret)) { - vq_err(vq, "Failed to map iov to sgl\n"); - vhost_scsi_release_cmd_res(&cmd->tvc_se_cmd); - goto err; -@@ -1301,8 +1309,11 @@ static void vhost_scsi_tmf_resp_work(struct vhost_work *work) - resp_code = VIRTIO_SCSI_S_FUNCTION_REJECTED; - } - -+ mutex_lock(&tmf->svq->vq.mutex); - vhost_scsi_send_tmf_resp(tmf->vhost, &tmf->svq->vq, tmf->in_iovs, - tmf->vq_desc, &tmf->resp_iov, resp_code); -+ mutex_unlock(&tmf->svq->vq.mutex); -+ - vhost_scsi_release_tmf_res(tmf); - } - -diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c -index 8587c9da067003..42e681a78136ab 100644 ---- a/drivers/video/fbdev/core/bitblit.c -+++ b/drivers/video/fbdev/core/bitblit.c -@@ -59,12 +59,11 @@ static void bit_bmove(struct vc_data *vc, struct fb_info *info, int sy, - } - - static void bit_clear(struct vc_data *vc, struct fb_info *info, int sy, -- int sx, int height, int width) -+ int sx, int height, int width, int fg, int bg) - { -- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; - struct fb_fillrect region; - -- region.color = attr_bgcol_ec(bgshift, vc, info); -+ region.color = bg; - region.dx = sx * vc->vc_font.width; - region.dy = sy * vc->vc_font.height; - region.width = width * vc->vc_font.width; -diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c -index 405d587450ef84..7a6f9a3cb3ba34 100644 ---- a/drivers/video/fbdev/core/fbcon.c -+++ b/drivers/video/fbdev/core/fbcon.c -@@ -1240,7 +1240,7 @@ static void fbcon_clear(struct vc_data *vc, int sy, int sx, int height, - { - struct fb_info *info = fbcon_info_from_console(vc->vc_num); - struct fbcon_ops *ops = info->fbcon_par; -- -+ int fg, bg; - struct fbcon_display *p = &fb_display[vc->vc_num]; - u_int y_break; - -@@ -1261,16 +1261,18 @@ static void fbcon_clear(struct vc_data *vc, int sy, int sx, int height, - fbcon_clear_margins(vc, 0); - } - -+ fg = get_color(vc, info, vc->vc_video_erase_char, 1); -+ bg = get_color(vc, info, vc->vc_video_erase_char, 0); - /* Split blits that cross physical y_wrap boundary */ - - y_break = p->vrows - p->yscroll; - if (sy < y_break && sy + height - 1 >= y_break) { - u_int b = y_break - sy; -- ops->clear(vc, info, real_y(p, sy), sx, b, width); -+ ops->clear(vc, info, real_y(p, sy), sx, b, width, fg, bg); - ops->clear(vc, info, real_y(p, sy + b), sx, height - b, -- width); -+ width, fg, bg); - } else -- ops->clear(vc, info, real_y(p, sy), sx, height, width); -+ ops->clear(vc, info, real_y(p, sy), sx, height, width, fg, bg); - } - - static void fbcon_putcs(struct vc_data *vc, const unsigned short *s, -diff --git a/drivers/video/fbdev/core/fbcon.h b/drivers/video/fbdev/core/fbcon.h -index 0eaf54a2115167..25691d4b027bfc 100644 ---- a/drivers/video/fbdev/core/fbcon.h -+++ b/drivers/video/fbdev/core/fbcon.h -@@ -55,7 +55,7 @@ struct fbcon_ops { - void (*bmove)(struct vc_data *vc, struct fb_info *info, int sy, - int sx, int dy, int dx, int height, int width); - void (*clear)(struct vc_data *vc, struct fb_info *info, int sy, -- int sx, int height, int width); -+ int sx, int height, int width, int fb, int bg); - void (*putcs)(struct vc_data *vc, struct fb_info *info, - const unsigned short *s, int count, int yy, int xx, - int fg, int bg); -@@ -116,42 +116,6 @@ static inline int mono_col(const struct fb_info *info) - return (~(0xfff << max_len)) & 0xff; - } - --static inline int attr_col_ec(int shift, struct vc_data *vc, -- struct fb_info *info, int is_fg) --{ -- int is_mono01; -- int col; -- int fg; -- int bg; -- -- if (!vc) -- return 0; -- -- if (vc->vc_can_do_color) -- return is_fg ? attr_fgcol(shift,vc->vc_video_erase_char) -- : attr_bgcol(shift,vc->vc_video_erase_char); -- -- if (!info) -- return 0; -- -- col = mono_col(info); -- is_mono01 = info->fix.visual == FB_VISUAL_MONO01; -- -- if (attr_reverse(vc->vc_video_erase_char)) { -- fg = is_mono01 ? col : 0; -- bg = is_mono01 ? 0 : col; -- } -- else { -- fg = is_mono01 ? 0 : col; -- bg = is_mono01 ? col : 0; -- } -- -- return is_fg ? fg : bg; --} -- --#define attr_bgcol_ec(bgshift, vc, info) attr_col_ec(bgshift, vc, info, 0) --#define attr_fgcol_ec(fgshift, vc, info) attr_col_ec(fgshift, vc, info, 1) -- - /* - * Scroll Method - */ -diff --git a/drivers/video/fbdev/core/fbcon_ccw.c b/drivers/video/fbdev/core/fbcon_ccw.c -index 2789ace7963427..9f4d65478554ad 100644 ---- a/drivers/video/fbdev/core/fbcon_ccw.c -+++ b/drivers/video/fbdev/core/fbcon_ccw.c -@@ -78,14 +78,13 @@ static void ccw_bmove(struct vc_data *vc, struct fb_info *info, int sy, - } - - static void ccw_clear(struct vc_data *vc, struct fb_info *info, int sy, -- int sx, int height, int width) -+ int sx, int height, int width, int fg, int bg) - { - struct fbcon_ops *ops = info->fbcon_par; - struct fb_fillrect region; -- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; - u32 vyres = GETVYRES(ops->p, info); - -- region.color = attr_bgcol_ec(bgshift,vc,info); -+ region.color = bg; - region.dx = sy * vc->vc_font.height; - region.dy = vyres - ((sx + width) * vc->vc_font.width); - region.height = width * vc->vc_font.width; -diff --git a/drivers/video/fbdev/core/fbcon_cw.c b/drivers/video/fbdev/core/fbcon_cw.c -index 86a254c1b2b7b6..b18e31886da102 100644 ---- a/drivers/video/fbdev/core/fbcon_cw.c -+++ b/drivers/video/fbdev/core/fbcon_cw.c -@@ -63,14 +63,13 @@ static void cw_bmove(struct vc_data *vc, struct fb_info *info, int sy, - } - - static void cw_clear(struct vc_data *vc, struct fb_info *info, int sy, -- int sx, int height, int width) -+ int sx, int height, int width, int fg, int bg) - { - struct fbcon_ops *ops = info->fbcon_par; - struct fb_fillrect region; -- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; - u32 vxres = GETVXRES(ops->p, info); - -- region.color = attr_bgcol_ec(bgshift,vc,info); -+ region.color = bg; - region.dx = vxres - ((sy + height) * vc->vc_font.height); - region.dy = sx * vc->vc_font.width; - region.height = width * vc->vc_font.width; -diff --git a/drivers/video/fbdev/core/fbcon_ud.c b/drivers/video/fbdev/core/fbcon_ud.c -index 23bc045769d088..b6b074cfd9dc08 100644 ---- a/drivers/video/fbdev/core/fbcon_ud.c -+++ b/drivers/video/fbdev/core/fbcon_ud.c -@@ -64,15 +64,14 @@ static void ud_bmove(struct vc_data *vc, struct fb_info *info, int sy, - } - - static void ud_clear(struct vc_data *vc, struct fb_info *info, int sy, -- int sx, int height, int width) -+ int sx, int height, int width, int fg, int bg) - { - struct fbcon_ops *ops = info->fbcon_par; - struct fb_fillrect region; -- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; - u32 vyres = GETVYRES(ops->p, info); - u32 vxres = GETVXRES(ops->p, info); - -- region.color = attr_bgcol_ec(bgshift,vc,info); -+ region.color = bg; - region.dy = vyres - ((sy + height) * vc->vc_font.height); - region.dx = vxres - ((sx + width) * vc->vc_font.width); - region.width = width * vc->vc_font.width; -diff --git a/drivers/video/fbdev/core/tileblit.c b/drivers/video/fbdev/core/tileblit.c -index 2768eff247ba46..b3aa0c6620c7d1 100644 ---- a/drivers/video/fbdev/core/tileblit.c -+++ b/drivers/video/fbdev/core/tileblit.c -@@ -32,16 +32,14 @@ static void tile_bmove(struct vc_data *vc, struct fb_info *info, int sy, - } - - static void tile_clear(struct vc_data *vc, struct fb_info *info, int sy, -- int sx, int height, int width) -+ int sx, int height, int width, int fg, int bg) - { - struct fb_tilerect rect; -- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; -- int fgshift = (vc->vc_hi_font_mask) ? 9 : 8; - - rect.index = vc->vc_video_erase_char & - ((vc->vc_hi_font_mask) ? 0x1ff : 0xff); -- rect.fg = attr_fgcol_ec(fgshift, vc, info); -- rect.bg = attr_bgcol_ec(bgshift, vc, info); -+ rect.fg = fg; -+ rect.bg = bg; - rect.sx = sx; - rect.sy = sy; - rect.width = width; -@@ -76,7 +74,42 @@ static void tile_putcs(struct vc_data *vc, struct fb_info *info, - static void tile_clear_margins(struct vc_data *vc, struct fb_info *info, - int color, int bottom_only) - { -- return; -+ unsigned int cw = vc->vc_font.width; -+ unsigned int ch = vc->vc_font.height; -+ unsigned int rw = info->var.xres - (vc->vc_cols*cw); -+ unsigned int bh = info->var.yres - (vc->vc_rows*ch); -+ unsigned int rs = info->var.xres - rw; -+ unsigned int bs = info->var.yres - bh; -+ unsigned int vwt = info->var.xres_virtual / cw; -+ unsigned int vht = info->var.yres_virtual / ch; -+ struct fb_tilerect rect; -+ -+ rect.index = vc->vc_video_erase_char & -+ ((vc->vc_hi_font_mask) ? 0x1ff : 0xff); -+ rect.fg = color; -+ rect.bg = color; -+ -+ if ((int) rw > 0 && !bottom_only) { -+ rect.sx = (info->var.xoffset + rs + cw - 1) / cw; -+ rect.sy = 0; -+ rect.width = (rw + cw - 1) / cw; -+ rect.height = vht; -+ if (rect.width + rect.sx > vwt) -+ rect.width = vwt - rect.sx; -+ if (rect.sx < vwt) -+ info->tileops->fb_tilefill(info, &rect); -+ } -+ -+ if ((int) bh > 0) { -+ rect.sx = info->var.xoffset / cw; -+ rect.sy = (info->var.yoffset + bs) / ch; -+ rect.width = rs / cw; -+ rect.height = (bh + ch - 1) / ch; -+ if (rect.height + rect.sy > vht) -+ rect.height = vht - rect.sy; -+ if (rect.sy < vht) -+ info->tileops->fb_tilefill(info, &rect); -+ } - } - - static void tile_cursor(struct vc_data *vc, struct fb_info *info, int mode, -diff --git a/drivers/video/fbdev/fsl-diu-fb.c b/drivers/video/fbdev/fsl-diu-fb.c -index 0bced82fa4940d..8cf1268a4e5545 100644 ---- a/drivers/video/fbdev/fsl-diu-fb.c -+++ b/drivers/video/fbdev/fsl-diu-fb.c -@@ -1827,6 +1827,7 @@ static void fsl_diu_remove(struct platform_device *pdev) - int i; - - data = dev_get_drvdata(&pdev->dev); -+ device_remove_file(&pdev->dev, &data->dev_attr); - disable_lcdc(&data->fsl_diu_info[0]); - - free_irq(data->irq, data->diu_reg); -diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c -index 80669e05bf0ee4..c5f04234d9511a 100644 ---- a/drivers/virtio/virtio_ring.c -+++ b/drivers/virtio/virtio_ring.c -@@ -2530,7 +2530,7 @@ bool virtqueue_enable_cb_delayed(struct virtqueue *_vq) - struct vring_virtqueue *vq = to_vvq(_vq); - - if (vq->event_triggered) -- vq->event_triggered = false; -+ data_race(vq->event_triggered = false); - - return vq->packed_ring ? virtqueue_enable_cb_delayed_packed(_vq) : - virtqueue_enable_cb_delayed_split(_vq); -diff --git a/drivers/watchdog/aspeed_wdt.c b/drivers/watchdog/aspeed_wdt.c -index b72a858bbac702..001b2c9311254c 100644 ---- a/drivers/watchdog/aspeed_wdt.c -+++ b/drivers/watchdog/aspeed_wdt.c -@@ -11,21 +11,30 @@ - #include - #include - #include -+#include - #include - #include - #include - #include -+#include - #include - - static bool nowayout = WATCHDOG_NOWAYOUT; - module_param(nowayout, bool, 0); - MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" - __MODULE_STRING(WATCHDOG_NOWAYOUT) ")"); -+struct aspeed_wdt_scu { -+ const char *compatible; -+ u32 reset_status_reg; -+ u32 wdt_reset_mask; -+ u32 wdt_reset_mask_shift; -+}; - - struct aspeed_wdt_config { - u32 ext_pulse_width_mask; - u32 irq_shift; - u32 irq_mask; -+ struct aspeed_wdt_scu scu; - }; - - struct aspeed_wdt { -@@ -39,18 +48,36 @@ static const struct aspeed_wdt_config ast2400_config = { - .ext_pulse_width_mask = 0xff, - .irq_shift = 0, - .irq_mask = 0, -+ .scu = { -+ .compatible = "aspeed,ast2400-scu", -+ .reset_status_reg = 0x3c, -+ .wdt_reset_mask = 0x1, -+ .wdt_reset_mask_shift = 1, -+ }, - }; - - static const struct aspeed_wdt_config ast2500_config = { - .ext_pulse_width_mask = 0xfffff, - .irq_shift = 12, - .irq_mask = GENMASK(31, 12), -+ .scu = { -+ .compatible = "aspeed,ast2500-scu", -+ .reset_status_reg = 0x3c, -+ .wdt_reset_mask = 0x1, -+ .wdt_reset_mask_shift = 2, -+ }, - }; - - static const struct aspeed_wdt_config ast2600_config = { - .ext_pulse_width_mask = 0xfffff, - .irq_shift = 0, - .irq_mask = GENMASK(31, 10), -+ .scu = { -+ .compatible = "aspeed,ast2600-scu", -+ .reset_status_reg = 0x74, -+ .wdt_reset_mask = 0xf, -+ .wdt_reset_mask_shift = 16, -+ }, - }; - - static const struct of_device_id aspeed_wdt_of_table[] = { -@@ -211,6 +238,56 @@ static int aspeed_wdt_restart(struct watchdog_device *wdd, - return 0; - } - -+static void aspeed_wdt_update_bootstatus(struct platform_device *pdev, -+ struct aspeed_wdt *wdt) -+{ -+ const struct resource *res; -+ struct aspeed_wdt_scu scu = wdt->cfg->scu; -+ struct regmap *scu_base; -+ u32 reset_mask_width; -+ u32 reset_mask_shift; -+ u32 idx = 0; -+ u32 status; -+ int ret; -+ -+ if (!of_device_is_compatible(pdev->dev.of_node, "aspeed,ast2400-wdt")) { -+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0); -+ idx = ((intptr_t)wdt->base & 0x00000fff) / (uintptr_t)resource_size(res); -+ } -+ -+ scu_base = syscon_regmap_lookup_by_compatible(scu.compatible); -+ if (IS_ERR(scu_base)) { -+ wdt->wdd.bootstatus = WDIOS_UNKNOWN; -+ return; -+ } -+ -+ ret = regmap_read(scu_base, scu.reset_status_reg, &status); -+ if (ret) { -+ wdt->wdd.bootstatus = WDIOS_UNKNOWN; -+ return; -+ } -+ -+ reset_mask_width = hweight32(scu.wdt_reset_mask); -+ reset_mask_shift = scu.wdt_reset_mask_shift + -+ reset_mask_width * idx; -+ -+ if (status & (scu.wdt_reset_mask << reset_mask_shift)) -+ wdt->wdd.bootstatus = WDIOF_CARDRESET; -+ -+ /* clear wdt reset event flag */ -+ if (of_device_is_compatible(pdev->dev.of_node, "aspeed,ast2400-wdt") || -+ of_device_is_compatible(pdev->dev.of_node, "aspeed,ast2500-wdt")) { -+ ret = regmap_read(scu_base, scu.reset_status_reg, &status); -+ if (!ret) { -+ status &= ~(scu.wdt_reset_mask << reset_mask_shift); -+ regmap_write(scu_base, scu.reset_status_reg, status); -+ } -+ } else { -+ regmap_write(scu_base, scu.reset_status_reg, -+ scu.wdt_reset_mask << reset_mask_shift); -+ } -+} -+ - /* access_cs0 shows if cs0 is accessible, hence the reverted bit */ - static ssize_t access_cs0_show(struct device *dev, - struct device_attribute *attr, char *buf) -@@ -447,10 +524,10 @@ static int aspeed_wdt_probe(struct platform_device *pdev) - writel(duration - 1, wdt->base + WDT_RESET_WIDTH); - } - -+ aspeed_wdt_update_bootstatus(pdev, wdt); -+ - status = readl(wdt->base + WDT_TIMEOUT_STATUS); - if (status & WDT_TIMEOUT_STATUS_BOOT_SECONDARY) { -- wdt->wdd.bootstatus = WDIOF_CARDRESET; -- - if (of_device_is_compatible(np, "aspeed,ast2400-wdt") || - of_device_is_compatible(np, "aspeed,ast2500-wdt")) - wdt->wdd.groups = bswitch_groups; -diff --git a/drivers/xen/platform-pci.c b/drivers/xen/platform-pci.c -index 544d3f9010b92a..1db82da56db62b 100644 ---- a/drivers/xen/platform-pci.c -+++ b/drivers/xen/platform-pci.c -@@ -26,6 +26,8 @@ - - #define DRV_NAME "xen-platform-pci" - -+#define PCI_DEVICE_ID_XEN_PLATFORM_XS61 0x0002 -+ - static unsigned long platform_mmio; - static unsigned long platform_mmio_alloc; - static unsigned long platform_mmiolen; -@@ -174,6 +176,8 @@ static int platform_pci_probe(struct pci_dev *pdev, - static const struct pci_device_id platform_pci_tbl[] = { - {PCI_VENDOR_ID_XEN, PCI_DEVICE_ID_XEN_PLATFORM, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, -+ {PCI_VENDOR_ID_XEN, PCI_DEVICE_ID_XEN_PLATFORM_XS61, -+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, - {0,} - }; - -diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c -index 25164d56c9d995..d3b6908110c6f0 100644 ---- a/drivers/xen/xenbus/xenbus_probe.c -+++ b/drivers/xen/xenbus/xenbus_probe.c -@@ -966,9 +966,15 @@ static int __init xenbus_init(void) - if (xen_pv_domain()) - xen_store_domain_type = XS_PV; - if (xen_hvm_domain()) -+ { - xen_store_domain_type = XS_HVM; -- if (xen_hvm_domain() && xen_initial_domain()) -- xen_store_domain_type = XS_LOCAL; -+ err = hvm_get_parameter(HVM_PARAM_STORE_EVTCHN, &v); -+ if (err) -+ goto out_error; -+ xen_store_evtchn = (int)v; -+ if (!v && xen_initial_domain()) -+ xen_store_domain_type = XS_LOCAL; -+ } - if (xen_pv_domain() && !xen_start_info->store_evtchn) - xen_store_domain_type = XS_LOCAL; - if (xen_pv_domain() && xen_start_info->store_evtchn) -@@ -987,10 +993,6 @@ static int __init xenbus_init(void) - xen_store_interface = gfn_to_virt(xen_store_gfn); - break; - case XS_HVM: -- err = hvm_get_parameter(HVM_PARAM_STORE_EVTCHN, &v); -- if (err) -- goto out_error; -- xen_store_evtchn = (int)v; - err = hvm_get_parameter(HVM_PARAM_STORE_PFN, &v); - if (err) - goto out_error; -diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c -index 434cf3d5f4cf18..226e6434a58a94 100644 ---- a/fs/btrfs/block-group.c -+++ b/fs/btrfs/block-group.c -@@ -1885,6 +1885,17 @@ void btrfs_reclaim_bgs_work(struct work_struct *work) - up_write(&space_info->groups_sem); - goto next; - } -+ -+ /* -+ * Cache the zone_unusable value before turning the block group -+ * to read only. As soon as the block group is read only it's -+ * zone_unusable value gets moved to the block group's read-only -+ * bytes and isn't available for calculations anymore. We also -+ * cache it before unlocking the block group, to prevent races -+ * (reports from KCSAN and such tools) with tasks updating it. -+ */ -+ zone_unusable = bg->zone_unusable; -+ - spin_unlock(&bg->lock); - - /* -@@ -1900,13 +1911,6 @@ void btrfs_reclaim_bgs_work(struct work_struct *work) - goto next; - } - -- /* -- * Cache the zone_unusable value before turning the block group -- * to read only. As soon as the blog group is read only it's -- * zone_unusable value gets moved to the block group's read-only -- * bytes and isn't available for calculations anymore. -- */ -- zone_unusable = bg->zone_unusable; - ret = inc_block_group_ro(bg, 0); - up_write(&space_info->groups_sem); - if (ret < 0) -diff --git a/fs/btrfs/discard.c b/fs/btrfs/discard.c -index 944a7340f6a449..3981c941f5b556 100644 ---- a/fs/btrfs/discard.c -+++ b/fs/btrfs/discard.c -@@ -167,13 +167,7 @@ static bool remove_from_discard_list(struct btrfs_discard_ctl *discard_ctl, - block_group->discard_eligible_time = 0; - queued = !list_empty(&block_group->discard_list); - list_del_init(&block_group->discard_list); -- /* -- * If the block group is currently running in the discard workfn, we -- * don't want to deref it, since it's still being used by the workfn. -- * The workfn will notice this case and deref the block group when it is -- * finished. -- */ -- if (queued && !running) -+ if (queued) - btrfs_put_block_group(block_group); - - spin_unlock(&discard_ctl->lock); -@@ -260,9 +254,10 @@ static struct btrfs_block_group *peek_discard_list( - block_group->discard_cursor = block_group->start; - block_group->discard_state = BTRFS_DISCARD_EXTENTS; - } -- discard_ctl->block_group = block_group; - } - if (block_group) { -+ btrfs_get_block_group(block_group); -+ discard_ctl->block_group = block_group; - *discard_state = block_group->discard_state; - *discard_index = block_group->discard_index; - } -@@ -493,9 +488,20 @@ static void btrfs_discard_workfn(struct work_struct *work) - - block_group = peek_discard_list(discard_ctl, &discard_state, - &discard_index, now); -- if (!block_group || !btrfs_run_discard_work(discard_ctl)) -+ if (!block_group) - return; -+ if (!btrfs_run_discard_work(discard_ctl)) { -+ spin_lock(&discard_ctl->lock); -+ btrfs_put_block_group(block_group); -+ discard_ctl->block_group = NULL; -+ spin_unlock(&discard_ctl->lock); -+ return; -+ } - if (now < block_group->discard_eligible_time) { -+ spin_lock(&discard_ctl->lock); -+ btrfs_put_block_group(block_group); -+ discard_ctl->block_group = NULL; -+ spin_unlock(&discard_ctl->lock); - btrfs_discard_schedule_work(discard_ctl, false); - return; - } -@@ -547,15 +553,7 @@ static void btrfs_discard_workfn(struct work_struct *work) - spin_lock(&discard_ctl->lock); - discard_ctl->prev_discard = trimmed; - discard_ctl->prev_discard_time = now; -- /* -- * If the block group was removed from the discard list while it was -- * running in this workfn, then we didn't deref it, since this function -- * still owned that reference. But we set the discard_ctl->block_group -- * back to NULL, so we can use that condition to know that now we need -- * to deref the block_group. -- */ -- if (discard_ctl->block_group == NULL) -- btrfs_put_block_group(block_group); -+ btrfs_put_block_group(block_group); - discard_ctl->block_group = NULL; - __btrfs_discard_schedule_work(discard_ctl, now, false); - spin_unlock(&discard_ctl->lock); -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index 2387210231f236..34a30d61b470c3 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -4313,6 +4313,14 @@ void __cold close_ctree(struct btrfs_fs_info *fs_info) - /* clear out the rbtree of defraggable inodes */ - btrfs_cleanup_defrag_inodes(fs_info); - -+ /* -+ * Handle the error fs first, as it will flush and wait for all ordered -+ * extents. This will generate delayed iputs, thus we want to handle -+ * it first. -+ */ -+ if (unlikely(BTRFS_FS_ERROR(fs_info))) -+ btrfs_error_commit_super(fs_info); -+ - /* - * Wait for any fixup workers to complete. - * If we don't wait for them here and they are still running by the time -@@ -4333,6 +4341,19 @@ void __cold close_ctree(struct btrfs_fs_info *fs_info) - */ - btrfs_flush_workqueue(fs_info->delalloc_workers); - -+ /* -+ * We can have ordered extents getting their last reference dropped from -+ * the fs_info->workers queue because for async writes for data bios we -+ * queue a work for that queue, at btrfs_wq_submit_bio(), that runs -+ * run_one_async_done() which calls btrfs_bio_end_io() in case the bio -+ * has an error, and that later function can do the final -+ * btrfs_put_ordered_extent() on the ordered extent attached to the bio, -+ * which adds a delayed iput for the inode. So we must flush the queue -+ * so that we don't have delayed iputs after committing the current -+ * transaction below and stopping the cleaner and transaction kthreads. -+ */ -+ btrfs_flush_workqueue(fs_info->workers); -+ - /* - * When finishing a compressed write bio we schedule a work queue item - * to finish an ordered extent - btrfs_finish_compressed_write_work() -@@ -4402,9 +4423,6 @@ void __cold close_ctree(struct btrfs_fs_info *fs_info) - btrfs_err(fs_info, "commit super ret %d", ret); - } - -- if (BTRFS_FS_ERROR(fs_info)) -- btrfs_error_commit_super(fs_info); -- - kthread_stop(fs_info->transaction_kthread); - kthread_stop(fs_info->cleaner_kthread); - -@@ -4541,10 +4559,6 @@ static void btrfs_error_commit_super(struct btrfs_fs_info *fs_info) - /* cleanup FS via transaction */ - btrfs_cleanup_transaction(fs_info); - -- mutex_lock(&fs_info->cleaner_mutex); -- btrfs_run_delayed_iputs(fs_info); -- mutex_unlock(&fs_info->cleaner_mutex); -- - down_write(&fs_info->cleanup_work_sem); - up_write(&fs_info->cleanup_work_sem); - } -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index b2ae50dcca0fe0..ed08d8e5639f59 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -3565,10 +3565,10 @@ struct extent_buffer *find_extent_buffer(struct btrfs_fs_info *fs_info, - return eb; - } - --#ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS - struct extent_buffer *alloc_test_extent_buffer(struct btrfs_fs_info *fs_info, - u64 start) - { -+#ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS - struct extent_buffer *eb, *exists = NULL; - int ret; - -@@ -3604,8 +3604,11 @@ struct extent_buffer *alloc_test_extent_buffer(struct btrfs_fs_info *fs_info, - free_eb: - btrfs_release_extent_buffer(eb); - return exists; --} -+#else -+ /* Stub to avoid linker error when compiled with optimizations turned off. */ -+ return NULL; - #endif -+} - - static struct extent_buffer *grab_extent_buffer( - struct btrfs_fs_info *fs_info, struct page *page) -diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c -index 537e184b4b1dfc..474758c878fcab 100644 ---- a/fs/btrfs/relocation.c -+++ b/fs/btrfs/relocation.c -@@ -2931,6 +2931,7 @@ static int relocate_one_page(struct inode *inode, struct file_ra_state *ra, - int ret; - - ASSERT(page_index <= last_index); -+again: - page = find_lock_page(inode->i_mapping, page_index); - if (!page) { - page_cache_sync_readahead(inode->i_mapping, ra, NULL, -@@ -2952,6 +2953,11 @@ static int relocate_one_page(struct inode *inode, struct file_ra_state *ra, - ret = -EIO; - goto release_page; - } -+ if (page->mapping != inode->i_mapping) { -+ unlock_page(page); -+ put_page(page); -+ goto again; -+ } - } - - /* -diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c -index 6be092bb814fdc..da49bdb70375b6 100644 ---- a/fs/btrfs/scrub.c -+++ b/fs/btrfs/scrub.c -@@ -1538,8 +1538,8 @@ static int scrub_find_fill_first_stripe(struct btrfs_block_group *bg, - u64 extent_gen; - int ret; - -- if (unlikely(!extent_root)) { -- btrfs_err(fs_info, "no valid extent root for scrub"); -+ if (unlikely(!extent_root || !csum_root)) { -+ btrfs_err(fs_info, "no valid extent or csum root for scrub"); - return -EUCLEAN; - } - memset(stripe->sectors, 0, sizeof(struct scrub_sector_verification) * -diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c -index aa1e6d88a72c7c..e2ead36e5be422 100644 ---- a/fs/btrfs/send.c -+++ b/fs/btrfs/send.c -@@ -487,10 +487,8 @@ static int fs_path_ensure_buf(struct fs_path *p, int len) - if (p->buf_len >= len) - return 0; - -- if (len > PATH_MAX) { -- WARN_ON(1); -- return -ENOMEM; -- } -+ if (WARN_ON(len > PATH_MAX)) -+ return -ENAMETOOLONG; - - path_len = p->end - p->start; - old_buf_len = p->buf_len; -diff --git a/fs/coredump.c b/fs/coredump.c -index 9d235fa14ab98f..d3a4f5dc2e362a 100644 ---- a/fs/coredump.c -+++ b/fs/coredump.c -@@ -42,6 +42,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -56,6 +57,13 @@ - static bool dump_vma_snapshot(struct coredump_params *cprm); - static void free_vma_snapshot(struct coredump_params *cprm); - -+/* -+ * File descriptor number for the pidfd for the thread-group leader of -+ * the coredumping task installed into the usermode helper's file -+ * descriptor table. -+ */ -+#define COREDUMP_PIDFD_NUMBER 3 -+ - static int core_uses_pid; - static unsigned int core_pipe_limit; - static char core_pattern[CORENAME_MAX_SIZE] = "core"; -@@ -332,6 +340,27 @@ static int format_corename(struct core_name *cn, struct coredump_params *cprm, - case 'C': - err = cn_printf(cn, "%d", cprm->cpu); - break; -+ /* pidfd number */ -+ case 'F': { -+ /* -+ * Installing a pidfd only makes sense if -+ * we actually spawn a usermode helper. -+ */ -+ if (!ispipe) -+ break; -+ -+ /* -+ * Note that we'll install a pidfd for the -+ * thread-group leader. We know that task -+ * linkage hasn't been removed yet and even if -+ * this @current isn't the actual thread-group -+ * leader we know that the thread-group leader -+ * cannot be reaped until @current has exited. -+ */ -+ cprm->pid = task_tgid(current); -+ err = cn_printf(cn, "%d", COREDUMP_PIDFD_NUMBER); -+ break; -+ } - default: - break; - } -@@ -488,7 +517,7 @@ static void wait_for_dump_helpers(struct file *file) - } - - /* -- * umh_pipe_setup -+ * umh_coredump_setup - * helper function to customize the process used - * to collect the core in userspace. Specifically - * it sets up a pipe and installs it as fd 0 (stdin) -@@ -498,21 +527,61 @@ static void wait_for_dump_helpers(struct file *file) - * is a special value that we use to trap recursive - * core dumps - */ --static int umh_pipe_setup(struct subprocess_info *info, struct cred *new) -+static int umh_coredump_setup(struct subprocess_info *info, struct cred *new) - { - struct file *files[2]; -+ struct file *pidfs_file = NULL; - struct coredump_params *cp = (struct coredump_params *)info->data; -- int err = create_pipe_files(files, 0); -+ int err; -+ -+ if (cp->pid) { -+ int fd; -+ -+ fd = pidfd_prepare(cp->pid, 0, &pidfs_file); -+ if (fd < 0) -+ return fd; -+ -+ /* -+ * We don't care about the fd. We also cannot simply -+ * replace it below because dup2() will refuse to close -+ * this file descriptor if its in a larval state. So -+ * close it! -+ */ -+ put_unused_fd(fd); -+ -+ /* -+ * Usermode helpers are childen of either -+ * system_unbound_wq or of kthreadd. So we know that -+ * we're starting off with a clean file descriptor -+ * table. So we should always be able to use -+ * COREDUMP_PIDFD_NUMBER as our file descriptor value. -+ */ -+ err = replace_fd(COREDUMP_PIDFD_NUMBER, pidfs_file, 0); -+ if (err < 0) -+ goto out_fail; -+ -+ pidfs_file = NULL; -+ } -+ -+ err = create_pipe_files(files, 0); - if (err) -- return err; -+ goto out_fail; - - cp->file = files[1]; - - err = replace_fd(0, files[0], 0); - fput(files[0]); -+ if (err < 0) -+ goto out_fail; -+ - /* and disallow core files too */ - current->signal->rlim[RLIMIT_CORE] = (struct rlimit){1, 1}; - -+ err = 0; -+ -+out_fail: -+ if (pidfs_file) -+ fput(pidfs_file); - return err; - } - -@@ -589,7 +658,7 @@ void do_coredump(const kernel_siginfo_t *siginfo) - } - - if (cprm.limit == 1) { -- /* See umh_pipe_setup() which sets RLIMIT_CORE = 1. -+ /* See umh_coredump_setup() which sets RLIMIT_CORE = 1. - * - * Normally core limits are irrelevant to pipes, since - * we're not writing to the file system, but we use -@@ -634,7 +703,7 @@ void do_coredump(const kernel_siginfo_t *siginfo) - retval = -ENOMEM; - sub_info = call_usermodehelper_setup(helper_argv[0], - helper_argv, NULL, GFP_KERNEL, -- umh_pipe_setup, NULL, &cprm); -+ umh_coredump_setup, NULL, &cprm); - if (sub_info) - retval = call_usermodehelper_exec(sub_info, - UMH_WAIT_EXEC); -diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c -index 0618af36f5506b..3c9ab6461579c9 100644 ---- a/fs/dlm/lowcomms.c -+++ b/fs/dlm/lowcomms.c -@@ -1826,8 +1826,8 @@ static int dlm_tcp_listen_validate(void) - { - /* We don't support multi-homed hosts */ - if (dlm_local_count > 1) { -- log_print("TCP protocol can't handle multi-homed hosts, try SCTP"); -- return -EINVAL; -+ log_print("Detect multi-homed hosts but use only the first IP address."); -+ log_print("Try SCTP, if you want to enable multi-link."); - } - - return 0; -diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c -index 396474e9e2bffe..3a2dfc59fb40fc 100644 ---- a/fs/ext4/balloc.c -+++ b/fs/ext4/balloc.c -@@ -641,8 +641,8 @@ static int ext4_has_free_clusters(struct ext4_sb_info *sbi, - /* Hm, nope. Are (enough) root reserved clusters available? */ - if (uid_eq(sbi->s_resuid, current_fsuid()) || - (!gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) && in_group_p(sbi->s_resgid)) || -- capable(CAP_SYS_RESOURCE) || -- (flags & EXT4_MB_USE_ROOT_BLOCKS)) { -+ (flags & EXT4_MB_USE_ROOT_BLOCKS) || -+ capable(CAP_SYS_RESOURCE)) { - - if (free_clusters >= (nclusters + dirty_clusters + - resv_clusters)) -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index 60455c84a93742..81fe87fcbfa068 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -273,7 +273,8 @@ struct ext4_system_blocks { - /* - * Flags for ext4_io_end->flags - */ --#define EXT4_IO_END_UNWRITTEN 0x0001 -+#define EXT4_IO_END_UNWRITTEN 0x0001 -+#define EXT4_IO_END_FAILED 0x0002 - - struct ext4_io_end_vec { - struct list_head list; /* list of io_end_vec */ -@@ -2994,6 +2995,8 @@ extern int ext4_inode_attach_jinode(struct inode *inode); - extern int ext4_can_truncate(struct inode *inode); - extern int ext4_truncate(struct inode *); - extern int ext4_break_layouts(struct inode *); -+extern int ext4_truncate_page_cache_block_range(struct inode *inode, -+ loff_t start, loff_t end); - extern int ext4_punch_hole(struct file *file, loff_t offset, loff_t length); - extern void ext4_set_inode_flags(struct inode *, bool init); - extern int ext4_alloc_da_blocks(struct inode *inode); -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index 32218ac7f50fe2..39e3661a80c433 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -4660,22 +4660,13 @@ static long ext4_zero_range(struct file *file, loff_t offset, - goto out_mutex; - } - -- /* -- * For journalled data we need to write (and checkpoint) pages -- * before discarding page cache to avoid inconsitent data on -- * disk in case of crash before zeroing trans is committed. -- */ -- if (ext4_should_journal_data(inode)) { -- ret = filemap_write_and_wait_range(mapping, start, -- end - 1); -- if (ret) { -- filemap_invalidate_unlock(mapping); -- goto out_mutex; -- } -+ /* Now release the pages and zero block aligned part of pages */ -+ ret = ext4_truncate_page_cache_block_range(inode, start, end); -+ if (ret) { -+ filemap_invalidate_unlock(mapping); -+ goto out_mutex; - } - -- /* Now release the pages and zero block aligned part of pages */ -- truncate_pagecache_range(inode, start, end - 1); - inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode)); - - ret = ext4_alloc_file_blocks(file, lblk, max_blocks, new_size, -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index d3d28e65872027..86245e27be18db 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -31,6 +31,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -3892,6 +3893,68 @@ int ext4_update_disksize_before_punch(struct inode *inode, loff_t offset, - return ret; - } - -+static inline void ext4_truncate_folio(struct inode *inode, -+ loff_t start, loff_t end) -+{ -+ unsigned long blocksize = i_blocksize(inode); -+ struct folio *folio; -+ -+ /* Nothing to be done if no complete block needs to be truncated. */ -+ if (round_up(start, blocksize) >= round_down(end, blocksize)) -+ return; -+ -+ folio = filemap_lock_folio(inode->i_mapping, start >> PAGE_SHIFT); -+ if (IS_ERR(folio)) -+ return; -+ -+ if (folio_mkclean(folio)) -+ folio_mark_dirty(folio); -+ folio_unlock(folio); -+ folio_put(folio); -+} -+ -+int ext4_truncate_page_cache_block_range(struct inode *inode, -+ loff_t start, loff_t end) -+{ -+ unsigned long blocksize = i_blocksize(inode); -+ int ret; -+ -+ /* -+ * For journalled data we need to write (and checkpoint) pages -+ * before discarding page cache to avoid inconsitent data on disk -+ * in case of crash before freeing or unwritten converting trans -+ * is committed. -+ */ -+ if (ext4_should_journal_data(inode)) { -+ ret = filemap_write_and_wait_range(inode->i_mapping, start, -+ end - 1); -+ if (ret) -+ return ret; -+ goto truncate_pagecache; -+ } -+ -+ /* -+ * If the block size is less than the page size, the file's mapped -+ * blocks within one page could be freed or converted to unwritten. -+ * So it's necessary to remove writable userspace mappings, and then -+ * ext4_page_mkwrite() can be called during subsequent write access -+ * to these partial folios. -+ */ -+ if (!IS_ALIGNED(start | end, PAGE_SIZE) && -+ blocksize < PAGE_SIZE && start < inode->i_size) { -+ loff_t page_boundary = round_up(start, PAGE_SIZE); -+ -+ ext4_truncate_folio(inode, start, min(page_boundary, end)); -+ if (end > page_boundary) -+ ext4_truncate_folio(inode, -+ round_down(end, PAGE_SIZE), end); -+ } -+ -+truncate_pagecache: -+ truncate_pagecache_range(inode, start, end - 1); -+ return 0; -+} -+ - static void ext4_wait_dax_page(struct inode *inode) - { - filemap_invalidate_unlock(inode->i_mapping); -@@ -3946,17 +4009,6 @@ int ext4_punch_hole(struct file *file, loff_t offset, loff_t length) - - trace_ext4_punch_hole(inode, offset, length, 0); - -- /* -- * Write out all dirty pages to avoid race conditions -- * Then release them. -- */ -- if (mapping_tagged(mapping, PAGECACHE_TAG_DIRTY)) { -- ret = filemap_write_and_wait_range(mapping, offset, -- offset + length - 1); -- if (ret) -- return ret; -- } -- - inode_lock(inode); - - /* No need to punch hole beyond i_size */ -@@ -4018,8 +4070,11 @@ int ext4_punch_hole(struct file *file, loff_t offset, loff_t length) - ret = ext4_update_disksize_before_punch(inode, offset, length); - if (ret) - goto out_dio; -- truncate_pagecache_range(inode, first_block_offset, -- last_block_offset); -+ -+ ret = ext4_truncate_page_cache_block_range(inode, -+ first_block_offset, last_block_offset + 1); -+ if (ret) -+ goto out_dio; - } - - if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) -diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c -index 7ab4f5a9bf5b87..7287dbfe13f120 100644 ---- a/fs/ext4/page-io.c -+++ b/fs/ext4/page-io.c -@@ -181,14 +181,25 @@ static int ext4_end_io_end(ext4_io_end_t *io_end) - "list->prev 0x%p\n", - io_end, inode->i_ino, io_end->list.next, io_end->list.prev); - -- io_end->handle = NULL; /* Following call will use up the handle */ -- ret = ext4_convert_unwritten_io_end_vec(handle, io_end); -+ /* -+ * Do not convert the unwritten extents if data writeback fails, -+ * or stale data may be exposed. -+ */ -+ io_end->handle = NULL; /* Following call will use up the handle */ -+ if (unlikely(io_end->flag & EXT4_IO_END_FAILED)) { -+ ret = -EIO; -+ if (handle) -+ jbd2_journal_free_reserved(handle); -+ } else { -+ ret = ext4_convert_unwritten_io_end_vec(handle, io_end); -+ } - if (ret < 0 && !ext4_forced_shutdown(inode->i_sb)) { - ext4_msg(inode->i_sb, KERN_EMERG, - "failed to convert unwritten extents to written " - "extents -- potential data loss! " - "(inode %lu, error %d)", inode->i_ino, ret); - } -+ - ext4_clear_io_unwritten_flag(io_end); - ext4_release_io_end(io_end); - return ret; -@@ -344,6 +355,7 @@ static void ext4_end_bio(struct bio *bio) - bio->bi_status, inode->i_ino, - (unsigned long long) - bi_sector >> (inode->i_blkbits - 9)); -+ io_end->flag |= EXT4_IO_END_FAILED; - mapping_set_error(inode->i_mapping, - blk_status_to_errno(bio->bi_status)); - } -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 751c879271e05e..d2b58f940aab5e 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -2821,6 +2821,13 @@ static int ext4_check_opt_consistency(struct fs_context *fc, - } - - if (is_remount) { -+ if (!sbi->s_journal && -+ ctx_test_mount_opt(ctx, EXT4_MOUNT_DATA_ERR_ABORT)) { -+ ext4_msg(NULL, KERN_WARNING, -+ "Remounting fs w/o journal so ignoring data_err option"); -+ ctx_clear_mount_opt(ctx, EXT4_MOUNT_DATA_ERR_ABORT); -+ } -+ - if (ctx_test_mount_opt(ctx, EXT4_MOUNT_DAX_ALWAYS) && - (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA)) { - ext4_msg(NULL, KERN_ERR, "can't mount with " -@@ -5421,6 +5428,11 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb) - "data=, fs mounted w/o journal"); - goto failed_mount3a; - } -+ if (test_opt(sb, DATA_ERR_ABORT)) { -+ ext4_msg(sb, KERN_ERR, -+ "can't mount with data_err=abort, fs mounted w/o journal"); -+ goto failed_mount3a; -+ } - sbi->s_def_mount_opt &= ~EXT4_MOUNT_JOURNAL_CHECKSUM; - clear_opt(sb, JOURNAL_CHECKSUM); - clear_opt(sb, DATA_FLAGS); -@@ -6771,6 +6783,7 @@ static int ext4_reconfigure(struct fs_context *fc) - { - struct super_block *sb = fc->root->d_sb; - int ret; -+ bool old_ro = sb_rdonly(sb); - - fc->s_fs_info = EXT4_SB(sb); - -@@ -6782,9 +6795,9 @@ static int ext4_reconfigure(struct fs_context *fc) - if (ret < 0) - return ret; - -- ext4_msg(sb, KERN_INFO, "re-mounted %pU %s. Quota mode: %s.", -- &sb->s_uuid, sb_rdonly(sb) ? "ro" : "r/w", -- ext4_quota_mode(sb)); -+ ext4_msg(sb, KERN_INFO, "re-mounted %pU%s.", -+ &sb->s_uuid, -+ (old_ro != sb_rdonly(sb)) ? (sb_rdonly(sb) ? " ro" : " r/w") : ""); - - return 0; - } -diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c -index 180feefc4a9ceb..c4b0661888a159 100644 ---- a/fs/f2fs/sysfs.c -+++ b/fs/f2fs/sysfs.c -@@ -61,6 +61,12 @@ struct f2fs_attr { - int id; - }; - -+struct f2fs_base_attr { -+ struct attribute attr; -+ ssize_t (*show)(struct f2fs_base_attr *a, char *buf); -+ ssize_t (*store)(struct f2fs_base_attr *a, const char *buf, size_t len); -+}; -+ - static ssize_t f2fs_sbi_show(struct f2fs_attr *a, - struct f2fs_sb_info *sbi, char *buf); - -@@ -791,6 +797,25 @@ static void f2fs_sb_release(struct kobject *kobj) - complete(&sbi->s_kobj_unregister); - } - -+static ssize_t f2fs_base_attr_show(struct kobject *kobj, -+ struct attribute *attr, char *buf) -+{ -+ struct f2fs_base_attr *a = container_of(attr, -+ struct f2fs_base_attr, attr); -+ -+ return a->show ? a->show(a, buf) : 0; -+} -+ -+static ssize_t f2fs_base_attr_store(struct kobject *kobj, -+ struct attribute *attr, -+ const char *buf, size_t len) -+{ -+ struct f2fs_base_attr *a = container_of(attr, -+ struct f2fs_base_attr, attr); -+ -+ return a->store ? a->store(a, buf, len) : 0; -+} -+ - /* - * Note that there are three feature list entries: - * 1) /sys/fs/f2fs/features -@@ -809,14 +834,13 @@ static void f2fs_sb_release(struct kobject *kobj) - * please add new on-disk feature in this list only. - * - ref. F2FS_SB_FEATURE_RO_ATTR() - */ --static ssize_t f2fs_feature_show(struct f2fs_attr *a, -- struct f2fs_sb_info *sbi, char *buf) -+static ssize_t f2fs_feature_show(struct f2fs_base_attr *a, char *buf) - { - return sysfs_emit(buf, "supported\n"); - } - - #define F2FS_FEATURE_RO_ATTR(_name) \ --static struct f2fs_attr f2fs_attr_##_name = { \ -+static struct f2fs_base_attr f2fs_base_attr_##_name = { \ - .attr = {.name = __stringify(_name), .mode = 0444 }, \ - .show = f2fs_feature_show, \ - } -@@ -1166,37 +1190,38 @@ static struct attribute *f2fs_attrs[] = { - }; - ATTRIBUTE_GROUPS(f2fs); - -+#define BASE_ATTR_LIST(name) (&f2fs_base_attr_##name.attr) - static struct attribute *f2fs_feat_attrs[] = { - #ifdef CONFIG_FS_ENCRYPTION -- ATTR_LIST(encryption), -- ATTR_LIST(test_dummy_encryption_v2), -+ BASE_ATTR_LIST(encryption), -+ BASE_ATTR_LIST(test_dummy_encryption_v2), - #if IS_ENABLED(CONFIG_UNICODE) -- ATTR_LIST(encrypted_casefold), -+ BASE_ATTR_LIST(encrypted_casefold), - #endif - #endif /* CONFIG_FS_ENCRYPTION */ - #ifdef CONFIG_BLK_DEV_ZONED -- ATTR_LIST(block_zoned), -+ BASE_ATTR_LIST(block_zoned), - #endif -- ATTR_LIST(atomic_write), -- ATTR_LIST(extra_attr), -- ATTR_LIST(project_quota), -- ATTR_LIST(inode_checksum), -- ATTR_LIST(flexible_inline_xattr), -- ATTR_LIST(quota_ino), -- ATTR_LIST(inode_crtime), -- ATTR_LIST(lost_found), -+ BASE_ATTR_LIST(atomic_write), -+ BASE_ATTR_LIST(extra_attr), -+ BASE_ATTR_LIST(project_quota), -+ BASE_ATTR_LIST(inode_checksum), -+ BASE_ATTR_LIST(flexible_inline_xattr), -+ BASE_ATTR_LIST(quota_ino), -+ BASE_ATTR_LIST(inode_crtime), -+ BASE_ATTR_LIST(lost_found), - #ifdef CONFIG_FS_VERITY -- ATTR_LIST(verity), -+ BASE_ATTR_LIST(verity), - #endif -- ATTR_LIST(sb_checksum), -+ BASE_ATTR_LIST(sb_checksum), - #if IS_ENABLED(CONFIG_UNICODE) -- ATTR_LIST(casefold), -+ BASE_ATTR_LIST(casefold), - #endif -- ATTR_LIST(readonly), -+ BASE_ATTR_LIST(readonly), - #ifdef CONFIG_F2FS_FS_COMPRESSION -- ATTR_LIST(compression), -+ BASE_ATTR_LIST(compression), - #endif -- ATTR_LIST(pin_file), -+ BASE_ATTR_LIST(pin_file), - NULL, - }; - ATTRIBUTE_GROUPS(f2fs_feat); -@@ -1263,9 +1288,14 @@ static struct kset f2fs_kset = { - .kobj = {.ktype = &f2fs_ktype}, - }; - -+static const struct sysfs_ops f2fs_feat_attr_ops = { -+ .show = f2fs_base_attr_show, -+ .store = f2fs_base_attr_store, -+}; -+ - static const struct kobj_type f2fs_feat_ktype = { - .default_groups = f2fs_feat_groups, -- .sysfs_ops = &f2fs_attr_ops, -+ .sysfs_ops = &f2fs_feat_attr_ops, - }; - - static struct kobject f2fs_feat = { -diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c -index e4d6cc0d2332a4..82951a535d2d4d 100644 ---- a/fs/fuse/dir.c -+++ b/fs/fuse/dir.c -@@ -1121,6 +1121,8 @@ static int fuse_link(struct dentry *entry, struct inode *newdir, - else if (err == -EINTR) - fuse_invalidate_attr(inode); - -+ if (err == -ENOSYS) -+ err = -EPERM; - return err; - } - -diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c -index 2c0908a3021026..687670075d2256 100644 ---- a/fs/gfs2/glock.c -+++ b/fs/gfs2/glock.c -@@ -853,11 +853,12 @@ static void run_queue(struct gfs2_glock *gl, const int nonblock) - __releases(&gl->gl_lockref.lock) - __acquires(&gl->gl_lockref.lock) - { -- struct gfs2_holder *gh = NULL; -+ struct gfs2_holder *gh; - - if (test_and_set_bit(GLF_LOCK, &gl->gl_flags)) - return; - -+ /* While a demote is in progress, the GLF_LOCK flag must be set. */ - GLOCK_BUG_ON(gl, test_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags)); - - if (test_bit(GLF_DEMOTE, &gl->gl_flags) && -@@ -869,18 +870,22 @@ __acquires(&gl->gl_lockref.lock) - set_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags); - GLOCK_BUG_ON(gl, gl->gl_demote_state == LM_ST_EXCLUSIVE); - gl->gl_target = gl->gl_demote_state; -+ do_xmote(gl, NULL, gl->gl_target); -+ return; - } else { - if (test_bit(GLF_DEMOTE, &gl->gl_flags)) - gfs2_demote_wake(gl); - if (do_promote(gl)) - goto out_unlock; - gh = find_first_waiter(gl); -+ if (!gh) -+ goto out_unlock; - gl->gl_target = gh->gh_state; - if (!(gh->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB))) - do_error(gl, 0); /* Fail queued try locks */ -+ do_xmote(gl, gh, gl->gl_target); -+ return; - } -- do_xmote(gl, gh, gl->gl_target); -- return; - - out_sched: - clear_bit(GLF_LOCK, &gl->gl_flags); -diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c -index 421c0d360836e0..19ec3253748331 100644 ---- a/fs/jbd2/recovery.c -+++ b/fs/jbd2/recovery.c -@@ -286,21 +286,22 @@ static int fc_do_one_pass(journal_t *journal, - int jbd2_journal_recover(journal_t *journal) - { - int err, err2; -- journal_superblock_t * sb; -- - struct recovery_info info; - errseq_t wb_err; - struct address_space *mapping; - - memset(&info, 0, sizeof(info)); -- sb = journal->j_superblock; - - /* - * The journal superblock's s_start field (the current log head) - * is always zero if, and only if, the journal was cleanly -- * unmounted. -+ * unmounted. We use its in-memory version j_tail here because -+ * jbd2_journal_wipe() could have updated it without updating journal -+ * superblock. - */ -- if (!sb->s_start) { -+ if (!journal->j_tail) { -+ journal_superblock_t *sb = journal->j_superblock; -+ - jbd2_debug(1, "No recovery required, last transaction %d, head block %u\n", - be32_to_cpu(sb->s_sequence), be32_to_cpu(sb->s_head)); - journal->j_transaction_sequence = be32_to_cpu(sb->s_sequence) + 1; -diff --git a/fs/namespace.c b/fs/namespace.c -index 450f4198b8cdd8..ef3b2ae2957ec3 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -636,12 +636,8 @@ int __legitimize_mnt(struct vfsmount *bastard, unsigned seq) - smp_mb(); // see mntput_no_expire() and do_umount() - if (likely(!read_seqretry(&mount_lock, seq))) - return 0; -- if (bastard->mnt_flags & MNT_SYNC_UMOUNT) { -- mnt_add_count(mnt, -1); -- return 1; -- } - lock_mount_hash(); -- if (unlikely(bastard->mnt_flags & MNT_DOOMED)) { -+ if (unlikely(bastard->mnt_flags & (MNT_SYNC_UMOUNT | MNT_DOOMED))) { - mnt_add_count(mnt, -1); - unlock_mount_hash(); - return 1; -diff --git a/fs/nfs/client.c b/fs/nfs/client.c -index 62607d52bfa5e7..aa09f930eeaf7e 100644 ---- a/fs/nfs/client.c -+++ b/fs/nfs/client.c -@@ -1080,6 +1080,8 @@ struct nfs_server *nfs_create_server(struct fs_context *fc) - if (server->namelen == 0 || server->namelen > NFS2_MAXNAMLEN) - server->namelen = NFS2_MAXNAMLEN; - } -+ /* Linux 'subtree_check' borkenness mandates this setting */ -+ server->fh_expire_type = NFS_FH_VOL_RENAME; - - if (!(fattr->valid & NFS_ATTR_FATTR)) { - error = ctx->nfs_mod->rpc_ops->getattr(server, ctx->mntfh, -diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c -index 55cfa1c4e0a65d..bbd582d8a7dc93 100644 ---- a/fs/nfs/delegation.c -+++ b/fs/nfs/delegation.c -@@ -297,7 +297,8 @@ nfs_start_delegation_return_locked(struct nfs_inode *nfsi) - if (delegation == NULL) - goto out; - spin_lock(&delegation->lock); -- if (!test_and_set_bit(NFS_DELEGATION_RETURNING, &delegation->flags)) { -+ if (delegation->inode && -+ !test_and_set_bit(NFS_DELEGATION_RETURNING, &delegation->flags)) { - clear_bit(NFS_DELEGATION_RETURN_DELAYED, &delegation->flags); - /* Refcount matched in nfs_end_delegation_return() */ - ret = nfs_get_delegation(delegation); -diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c -index 39f7549afcf5bd..38918638423596 100644 ---- a/fs/nfs/dir.c -+++ b/fs/nfs/dir.c -@@ -2642,6 +2642,18 @@ nfs_unblock_rename(struct rpc_task *task, struct nfs_renamedata *data) - unblock_revalidate(new_dentry); - } - -+static bool nfs_rename_is_unsafe_cross_dir(struct dentry *old_dentry, -+ struct dentry *new_dentry) -+{ -+ struct nfs_server *server = NFS_SB(old_dentry->d_sb); -+ -+ if (old_dentry->d_parent != new_dentry->d_parent) -+ return false; -+ if (server->fh_expire_type & NFS_FH_RENAME_UNSAFE) -+ return !(server->fh_expire_type & NFS_FH_NOEXPIRE_WITH_OPEN); -+ return true; -+} -+ - /* - * RENAME - * FIXME: Some nfsds, like the Linux user space nfsd, may generate a -@@ -2729,7 +2741,8 @@ int nfs_rename(struct mnt_idmap *idmap, struct inode *old_dir, - - } - -- if (S_ISREG(old_inode->i_mode)) -+ if (S_ISREG(old_inode->i_mode) && -+ nfs_rename_is_unsafe_cross_dir(old_dentry, new_dentry)) - nfs_sync_inode(old_inode); - task = nfs_async_rename(old_dir, new_dir, old_dentry, new_dentry, - must_unblock ? nfs_unblock_rename : NULL); -diff --git a/fs/nfs/filelayout/filelayoutdev.c b/fs/nfs/filelayout/filelayoutdev.c -index acf4b88889dc38..d5f1fbfd9a0c7f 100644 ---- a/fs/nfs/filelayout/filelayoutdev.c -+++ b/fs/nfs/filelayout/filelayoutdev.c -@@ -75,6 +75,7 @@ nfs4_fl_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev, - struct page *scratch; - struct list_head dsaddrs; - struct nfs4_pnfs_ds_addr *da; -+ struct net *net = server->nfs_client->cl_net; - - /* set up xdr stream */ - scratch = alloc_page(gfp_flags); -@@ -158,8 +159,7 @@ nfs4_fl_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev, - - mp_count = be32_to_cpup(p); /* multipath count */ - for (j = 0; j < mp_count; j++) { -- da = nfs4_decode_mp_ds_addr(server->nfs_client->cl_net, -- &stream, gfp_flags); -+ da = nfs4_decode_mp_ds_addr(net, &stream, gfp_flags); - if (da) - list_add_tail(&da->da_node, &dsaddrs); - } -@@ -169,7 +169,7 @@ nfs4_fl_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev, - goto out_err_free_deviceid; - } - -- dsaddr->ds_list[i] = nfs4_pnfs_ds_add(&dsaddrs, gfp_flags); -+ dsaddr->ds_list[i] = nfs4_pnfs_ds_add(net, &dsaddrs, gfp_flags); - if (!dsaddr->ds_list[i]) - goto out_err_drain_dsaddrs; - -diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c -index 2b3c5eea1f1345..0bc537de1b2958 100644 ---- a/fs/nfs/flexfilelayout/flexfilelayout.c -+++ b/fs/nfs/flexfilelayout/flexfilelayout.c -@@ -1255,6 +1255,7 @@ static void ff_layout_io_track_ds_error(struct pnfs_layout_segment *lseg, - case -ECONNRESET: - case -EHOSTDOWN: - case -EHOSTUNREACH: -+ case -ENETDOWN: - case -ENETUNREACH: - case -EADDRINUSE: - case -ENOBUFS: -diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c -index e028f5a0ef5f65..d21c5ecfbf1cc3 100644 ---- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c -+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c -@@ -49,6 +49,7 @@ nfs4_ff_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev, - struct nfs4_pnfs_ds_addr *da; - struct nfs4_ff_layout_ds *new_ds = NULL; - struct nfs4_ff_ds_version *ds_versions = NULL; -+ struct net *net = server->nfs_client->cl_net; - u32 mp_count; - u32 version_count; - __be32 *p; -@@ -80,8 +81,7 @@ nfs4_ff_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev, - - for (i = 0; i < mp_count; i++) { - /* multipath ds */ -- da = nfs4_decode_mp_ds_addr(server->nfs_client->cl_net, -- &stream, gfp_flags); -+ da = nfs4_decode_mp_ds_addr(net, &stream, gfp_flags); - if (da) - list_add_tail(&da->da_node, &dsaddrs); - } -@@ -149,7 +149,7 @@ nfs4_ff_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev, - new_ds->ds_versions = ds_versions; - new_ds->ds_versions_cnt = version_count; - -- new_ds->ds = nfs4_pnfs_ds_add(&dsaddrs, gfp_flags); -+ new_ds->ds = nfs4_pnfs_ds_add(net, &dsaddrs, gfp_flags); - if (!new_ds->ds) - goto out_err_drain_dsaddrs; - -diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c -index 56bbf59bda3cf6..06230baaa554e7 100644 ---- a/fs/nfs/inode.c -+++ b/fs/nfs/inode.c -@@ -74,6 +74,8 @@ nfs_fattr_to_ino_t(struct nfs_fattr *fattr) - - int nfs_wait_bit_killable(struct wait_bit_key *key, int mode) - { -+ if (unlikely(nfs_current_task_exiting())) -+ return -EINTR; - schedule(); - if (signal_pending_state(mode, current)) - return -ERESTARTSYS; -diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h -index ca49d999159eb1..c29ad2e1d41635 100644 ---- a/fs/nfs/internal.h -+++ b/fs/nfs/internal.h -@@ -865,6 +865,11 @@ static inline u32 nfs_stateid_hash(const nfs4_stateid *stateid) - NFS4_STATEID_OTHER_SIZE); - } - -+static inline bool nfs_current_task_exiting(void) -+{ -+ return (current->flags & PF_EXITING) != 0; -+} -+ - static inline bool nfs_error_is_fatal(int err) - { - switch (err) { -diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c -index 4bf208a0a8e994..715753f41fb072 100644 ---- a/fs/nfs/nfs3proc.c -+++ b/fs/nfs/nfs3proc.c -@@ -39,7 +39,7 @@ nfs3_rpc_wrapper(struct rpc_clnt *clnt, struct rpc_message *msg, int flags) - __set_current_state(TASK_KILLABLE|TASK_FREEZABLE_UNSAFE); - schedule_timeout(NFS_JUKEBOX_RETRY_TIME); - res = -ERESTARTSYS; -- } while (!fatal_signal_pending(current)); -+ } while (!fatal_signal_pending(current) && !nfs_current_task_exiting()); - return res; - } - -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index c140427e322ced..1b94a55215e7de 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -422,6 +422,8 @@ static int nfs4_delay_killable(long *timeout) - { - might_sleep(); - -+ if (unlikely(nfs_current_task_exiting())) -+ return -EINTR; - __set_current_state(TASK_KILLABLE|TASK_FREEZABLE_UNSAFE); - schedule_timeout(nfs4_update_delay(timeout)); - if (!__fatal_signal_pending(current)) -@@ -433,6 +435,8 @@ static int nfs4_delay_interruptible(long *timeout) - { - might_sleep(); - -+ if (unlikely(nfs_current_task_exiting())) -+ return -EINTR; - __set_current_state(TASK_INTERRUPTIBLE|TASK_FREEZABLE_UNSAFE); - schedule_timeout(nfs4_update_delay(timeout)); - if (!signal_pending(current)) -@@ -1712,7 +1716,8 @@ static void nfs_set_open_stateid_locked(struct nfs4_state *state, - rcu_read_unlock(); - trace_nfs4_open_stateid_update_wait(state->inode, stateid, 0); - -- if (!fatal_signal_pending(current)) { -+ if (!fatal_signal_pending(current) && -+ !nfs_current_task_exiting()) { - if (schedule_timeout(5*HZ) == 0) - status = -EAGAIN; - else -@@ -3494,7 +3499,7 @@ static bool nfs4_refresh_open_old_stateid(nfs4_stateid *dst, - write_sequnlock(&state->seqlock); - trace_nfs4_close_stateid_update_wait(state->inode, dst, 0); - -- if (fatal_signal_pending(current)) -+ if (fatal_signal_pending(current) || nfs_current_task_exiting()) - status = -EINTR; - else - if (schedule_timeout(5*HZ) != 0) -diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c -index 794bb4aa588d39..9fc71dc090c254 100644 ---- a/fs/nfs/nfs4state.c -+++ b/fs/nfs/nfs4state.c -@@ -2741,7 +2741,15 @@ static void nfs4_state_manager(struct nfs_client *clp) - pr_warn_ratelimited("NFS: state manager%s%s failed on NFSv4 server %s" - " with error %d\n", section_sep, section, - clp->cl_hostname, -status); -- ssleep(1); -+ switch (status) { -+ case -ENETDOWN: -+ case -ENETUNREACH: -+ nfs_mark_client_ready(clp, -EIO); -+ break; -+ default: -+ ssleep(1); -+ break; -+ } - out_drain: - memalloc_nofs_restore(memflags); - nfs4_end_drain_session(clp); -diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h -index d886c8226d8fec..79996d7dad0f76 100644 ---- a/fs/nfs/pnfs.h -+++ b/fs/nfs/pnfs.h -@@ -59,6 +59,7 @@ struct nfs4_pnfs_ds { - struct list_head ds_node; /* nfs4_pnfs_dev_hlist dev_dslist */ - char *ds_remotestr; /* comma sep list of addrs */ - struct list_head ds_addrs; -+ const struct net *ds_net; - struct nfs_client *ds_clp; - refcount_t ds_count; - unsigned long ds_state; -@@ -405,7 +406,8 @@ int pnfs_generic_commit_pagelist(struct inode *inode, - int pnfs_generic_scan_commit_lists(struct nfs_commit_info *cinfo, int max); - void pnfs_generic_write_commit_done(struct rpc_task *task, void *data); - void nfs4_pnfs_ds_put(struct nfs4_pnfs_ds *ds); --struct nfs4_pnfs_ds *nfs4_pnfs_ds_add(struct list_head *dsaddrs, -+struct nfs4_pnfs_ds *nfs4_pnfs_ds_add(const struct net *net, -+ struct list_head *dsaddrs, - gfp_t gfp_flags); - void nfs4_pnfs_v3_ds_connect_unload(void); - int nfs4_pnfs_ds_connect(struct nfs_server *mds_srv, struct nfs4_pnfs_ds *ds, -diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c -index 88e061bd711b74..1b317c44da126b 100644 ---- a/fs/nfs/pnfs_nfs.c -+++ b/fs/nfs/pnfs_nfs.c -@@ -651,12 +651,12 @@ _same_data_server_addrs_locked(const struct list_head *dsaddrs1, - * Lookup DS by addresses. nfs4_ds_cache_lock is held - */ - static struct nfs4_pnfs_ds * --_data_server_lookup_locked(const struct list_head *dsaddrs) -+_data_server_lookup_locked(const struct net *net, const struct list_head *dsaddrs) - { - struct nfs4_pnfs_ds *ds; - - list_for_each_entry(ds, &nfs4_data_server_cache, ds_node) -- if (_same_data_server_addrs_locked(&ds->ds_addrs, dsaddrs)) -+ if (ds->ds_net == net && _same_data_server_addrs_locked(&ds->ds_addrs, dsaddrs)) - return ds; - return NULL; - } -@@ -763,7 +763,7 @@ nfs4_pnfs_remotestr(struct list_head *dsaddrs, gfp_t gfp_flags) - * uncached and return cached struct nfs4_pnfs_ds. - */ - struct nfs4_pnfs_ds * --nfs4_pnfs_ds_add(struct list_head *dsaddrs, gfp_t gfp_flags) -+nfs4_pnfs_ds_add(const struct net *net, struct list_head *dsaddrs, gfp_t gfp_flags) - { - struct nfs4_pnfs_ds *tmp_ds, *ds = NULL; - char *remotestr; -@@ -781,13 +781,14 @@ nfs4_pnfs_ds_add(struct list_head *dsaddrs, gfp_t gfp_flags) - remotestr = nfs4_pnfs_remotestr(dsaddrs, gfp_flags); - - spin_lock(&nfs4_ds_cache_lock); -- tmp_ds = _data_server_lookup_locked(dsaddrs); -+ tmp_ds = _data_server_lookup_locked(net, dsaddrs); - if (tmp_ds == NULL) { - INIT_LIST_HEAD(&ds->ds_addrs); - list_splice_init(dsaddrs, &ds->ds_addrs); - ds->ds_remotestr = remotestr; - refcount_set(&ds->ds_count, 1); - INIT_LIST_HEAD(&ds->ds_node); -+ ds->ds_net = net; - ds->ds_clp = NULL; - list_add(&ds->ds_node, &nfs4_data_server_cache); - dprintk("%s add new data server %s\n", __func__, -diff --git a/fs/orangefs/inode.c b/fs/orangefs/inode.c -index 0859122684425f..dd4dc70e4aaab7 100644 ---- a/fs/orangefs/inode.c -+++ b/fs/orangefs/inode.c -@@ -23,9 +23,9 @@ static int orangefs_writepage_locked(struct page *page, - struct orangefs_write_range *wr = NULL; - struct iov_iter iter; - struct bio_vec bv; -- size_t len, wlen; -+ size_t wlen; - ssize_t ret; -- loff_t off; -+ loff_t len, off; - - set_page_writeback(page); - -@@ -92,8 +92,7 @@ static int orangefs_writepages_work(struct orangefs_writepages *ow, - struct orangefs_write_range *wrp, wr; - struct iov_iter iter; - ssize_t ret; -- size_t len; -- loff_t off; -+ loff_t len, off; - int i; - - len = i_size_read(inode); -diff --git a/fs/pstore/inode.c b/fs/pstore/inode.c -index 7dbbf3b6d98d3c..a1c97cd2720a68 100644 ---- a/fs/pstore/inode.c -+++ b/fs/pstore/inode.c -@@ -264,7 +264,7 @@ static void parse_options(char *options) - static int pstore_show_options(struct seq_file *m, struct dentry *root) - { - if (kmsg_bytes != CONFIG_PSTORE_DEFAULT_KMSG_BYTES) -- seq_printf(m, ",kmsg_bytes=%lu", kmsg_bytes); -+ seq_printf(m, ",kmsg_bytes=%u", kmsg_bytes); - return 0; - } - -diff --git a/fs/pstore/internal.h b/fs/pstore/internal.h -index 801d6c0b170c3a..a0fc511969100c 100644 ---- a/fs/pstore/internal.h -+++ b/fs/pstore/internal.h -@@ -6,7 +6,7 @@ - #include - #include - --extern unsigned long kmsg_bytes; -+extern unsigned int kmsg_bytes; - - #ifdef CONFIG_PSTORE_FTRACE - extern void pstore_register_ftrace(void); -@@ -35,7 +35,7 @@ static inline void pstore_unregister_pmsg(void) {} - - extern struct pstore_info *psinfo; - --extern void pstore_set_kmsg_bytes(int); -+extern void pstore_set_kmsg_bytes(unsigned int bytes); - extern void pstore_get_records(int); - extern void pstore_get_backend_records(struct pstore_info *psi, - struct dentry *root, int quiet); -diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c -index 03425928d2fb3c..ef62389212b608 100644 ---- a/fs/pstore/platform.c -+++ b/fs/pstore/platform.c -@@ -92,8 +92,8 @@ module_param(compress, charp, 0444); - MODULE_PARM_DESC(compress, "compression to use"); - - /* How much of the kernel log to snapshot */ --unsigned long kmsg_bytes = CONFIG_PSTORE_DEFAULT_KMSG_BYTES; --module_param(kmsg_bytes, ulong, 0444); -+unsigned int kmsg_bytes = CONFIG_PSTORE_DEFAULT_KMSG_BYTES; -+module_param(kmsg_bytes, uint, 0444); - MODULE_PARM_DESC(kmsg_bytes, "amount of kernel log to snapshot (in bytes)"); - - static void *compress_workspace; -@@ -107,9 +107,9 @@ static void *compress_workspace; - static char *big_oops_buf; - static size_t max_compressed_size; - --void pstore_set_kmsg_bytes(int bytes) -+void pstore_set_kmsg_bytes(unsigned int bytes) - { -- kmsg_bytes = bytes; -+ WRITE_ONCE(kmsg_bytes, bytes); - } - - /* Tag each group of saved records with a sequence number */ -@@ -278,6 +278,7 @@ static void pstore_dump(struct kmsg_dumper *dumper, - enum kmsg_dump_reason reason) - { - struct kmsg_dump_iter iter; -+ unsigned int remaining = READ_ONCE(kmsg_bytes); - unsigned long total = 0; - const char *why; - unsigned int part = 1; -@@ -300,7 +301,7 @@ static void pstore_dump(struct kmsg_dumper *dumper, - kmsg_dump_rewind(&iter); - - oopscount++; -- while (total < kmsg_bytes) { -+ while (total < remaining) { - char *dst; - size_t dst_size; - int header_size; -diff --git a/fs/smb/client/cifsacl.c b/fs/smb/client/cifsacl.c -index db9076da2182ad..bf32bc22ebd69f 100644 ---- a/fs/smb/client/cifsacl.c -+++ b/fs/smb/client/cifsacl.c -@@ -811,7 +811,23 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - return; - - for (i = 0; i < num_aces; ++i) { -+ if (end_of_acl - acl_base < acl_size) -+ break; -+ - ppace[i] = (struct smb_ace *) (acl_base + acl_size); -+ acl_base = (char *)ppace[i]; -+ acl_size = offsetof(struct smb_ace, sid) + -+ offsetof(struct smb_sid, sub_auth); -+ -+ if (end_of_acl - acl_base < acl_size || -+ ppace[i]->sid.num_subauth == 0 || -+ ppace[i]->sid.num_subauth > SID_MAX_SUB_AUTHORITIES || -+ (end_of_acl - acl_base < -+ acl_size + sizeof(__le32) * ppace[i]->sid.num_subauth) || -+ (le16_to_cpu(ppace[i]->size) < -+ acl_size + sizeof(__le32) * ppace[i]->sid.num_subauth)) -+ break; -+ - #ifdef CONFIG_CIFS_DEBUG2 - dump_ace(ppace[i], end_of_acl); - #endif -@@ -855,7 +871,6 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - (void *)ppace[i], - sizeof(struct smb_ace)); */ - -- acl_base = (char *)ppace[i]; - acl_size = le16_to_cpu(ppace[i]->size); - } - -diff --git a/fs/smb/client/cifspdu.h b/fs/smb/client/cifspdu.h -index c46d418c1c0c3e..ca33f6cd6a8004 100644 ---- a/fs/smb/client/cifspdu.h -+++ b/fs/smb/client/cifspdu.h -@@ -1226,10 +1226,9 @@ typedef struct smb_com_query_information_rsp { - typedef struct smb_com_setattr_req { - struct smb_hdr hdr; /* wct = 8 */ - __le16 attr; -- __le16 time_low; -- __le16 time_high; -+ __le32 last_write_time; - __le16 reserved[5]; /* must be zero */ -- __u16 ByteCount; -+ __le16 ByteCount; - __u8 BufferFormat; /* 4 = ASCII */ - unsigned char fileName[]; - } __attribute__((packed)) SETATTR_REQ; -diff --git a/fs/smb/client/cifsproto.h b/fs/smb/client/cifsproto.h -index 7f97e54686524b..c6d325666b5cd8 100644 ---- a/fs/smb/client/cifsproto.h -+++ b/fs/smb/client/cifsproto.h -@@ -31,6 +31,9 @@ extern void cifs_small_buf_release(void *); - extern void free_rsp_buf(int, void *); - extern int smb_send(struct TCP_Server_Info *, struct smb_hdr *, - unsigned int /* length */); -+extern int smb_send_kvec(struct TCP_Server_Info *server, -+ struct msghdr *msg, -+ size_t *sent); - extern unsigned int _get_xid(void); - extern void _free_xid(unsigned int); - #define get_xid() \ -@@ -395,6 +398,10 @@ extern int CIFSSMBQFSUnixInfo(const unsigned int xid, struct cifs_tcon *tcon); - extern int CIFSSMBQFSPosixInfo(const unsigned int xid, struct cifs_tcon *tcon, - struct kstatfs *FSData); - -+extern int SMBSetInformation(const unsigned int xid, struct cifs_tcon *tcon, -+ const char *fileName, __le32 attributes, __le64 write_time, -+ const struct nls_table *nls_codepage, -+ struct cifs_sb_info *cifs_sb); - extern int CIFSSMBSetPathInfo(const unsigned int xid, struct cifs_tcon *tcon, - const char *fileName, const FILE_BASIC_INFO *data, - const struct nls_table *nls_codepage, -diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c -index 769950adb7763b..b91184ebce02c5 100644 ---- a/fs/smb/client/cifssmb.c -+++ b/fs/smb/client/cifssmb.c -@@ -5157,6 +5157,63 @@ CIFSSMBSetFileSize(const unsigned int xid, struct cifs_tcon *tcon, - return rc; - } - -+int -+SMBSetInformation(const unsigned int xid, struct cifs_tcon *tcon, -+ const char *fileName, __le32 attributes, __le64 write_time, -+ const struct nls_table *nls_codepage, -+ struct cifs_sb_info *cifs_sb) -+{ -+ SETATTR_REQ *pSMB; -+ SETATTR_RSP *pSMBr; -+ struct timespec64 ts; -+ int bytes_returned; -+ int name_len; -+ int rc; -+ -+ cifs_dbg(FYI, "In %s path %s\n", __func__, fileName); -+ -+retry: -+ rc = smb_init(SMB_COM_SETATTR, 8, tcon, (void **) &pSMB, -+ (void **) &pSMBr); -+ if (rc) -+ return rc; -+ -+ if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) { -+ name_len = -+ cifsConvertToUTF16((__le16 *) pSMB->fileName, -+ fileName, PATH_MAX, nls_codepage, -+ cifs_remap(cifs_sb)); -+ name_len++; /* trailing null */ -+ name_len *= 2; -+ } else { -+ name_len = copy_path_name(pSMB->fileName, fileName); -+ } -+ /* Only few attributes can be set by this command, others are not accepted by Win9x. */ -+ pSMB->attr = cpu_to_le16(le32_to_cpu(attributes) & -+ (ATTR_READONLY | ATTR_HIDDEN | ATTR_SYSTEM | ATTR_ARCHIVE)); -+ /* Zero write time value (in both NT and SETATTR formats) means to not change it. */ -+ if (le64_to_cpu(write_time) != 0) { -+ ts = cifs_NTtimeToUnix(write_time); -+ pSMB->last_write_time = cpu_to_le32(ts.tv_sec); -+ } -+ pSMB->BufferFormat = 0x04; -+ name_len++; /* account for buffer type byte */ -+ inc_rfc1001_len(pSMB, (__u16)name_len); -+ pSMB->ByteCount = cpu_to_le16(name_len); -+ -+ rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB, -+ (struct smb_hdr *) pSMBr, &bytes_returned, 0); -+ if (rc) -+ cifs_dbg(FYI, "Send error in %s = %d\n", __func__, rc); -+ -+ cifs_buf_release(pSMB); -+ -+ if (rc == -EAGAIN) -+ goto retry; -+ -+ return rc; -+} -+ - /* Some legacy servers such as NT4 require that the file times be set on - an open handle, rather than by pathname - this is awkward due to - potential access conflicts on the open, but it is unavoidable for these -diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c -index 54aba8d642ee75..3faaee33ad4558 100644 ---- a/fs/smb/client/connect.c -+++ b/fs/smb/client/connect.c -@@ -3051,8 +3051,10 @@ ip_rfc1001_connect(struct TCP_Server_Info *server) - * sessinit is sent but no second negprot - */ - struct rfc1002_session_packet req = {}; -- struct smb_hdr *smb_buf = (struct smb_hdr *)&req; -+ struct msghdr msg = {}; -+ struct kvec iov = {}; - unsigned int len; -+ size_t sent; - - req.trailer.session_req.called_len = sizeof(req.trailer.session_req.called_name); - -@@ -3081,10 +3083,18 @@ ip_rfc1001_connect(struct TCP_Server_Info *server) - * As per rfc1002, @len must be the number of bytes that follows the - * length field of a rfc1002 session request payload. - */ -- len = sizeof(req) - offsetof(struct rfc1002_session_packet, trailer.session_req); -+ len = sizeof(req.trailer.session_req); -+ req.type = RFC1002_SESSION_REQUEST; -+ req.flags = 0; -+ req.length = cpu_to_be16(len); -+ len += offsetof(typeof(req), trailer.session_req); -+ iov.iov_base = &req; -+ iov.iov_len = len; -+ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, &iov, 1, len); -+ rc = smb_send_kvec(server, &msg, &sent); -+ if (rc < 0 || len != sent) -+ return (rc == -EINTR || rc == -EAGAIN) ? rc : -ECONNABORTED; - -- smb_buf->smb_buf_length = cpu_to_be32((RFC1002_SESSION_REQUEST << 24) | len); -- rc = smb_send(server, smb_buf, len); - /* - * RFC1001 layer in at least one server requires very short break before - * negprot presumably because not expecting negprot to follow so fast. -@@ -3093,7 +3103,7 @@ ip_rfc1001_connect(struct TCP_Server_Info *server) - */ - usleep_range(1000, 2000); - -- return rc; -+ return 0; - } - - static int -@@ -3946,11 +3956,13 @@ int - cifs_negotiate_protocol(const unsigned int xid, struct cifs_ses *ses, - struct TCP_Server_Info *server) - { -+ bool in_retry = false; - int rc = 0; - - if (!server->ops->need_neg || !server->ops->negotiate) - return -ENOSYS; - -+retry: - /* only send once per connect */ - spin_lock(&server->srv_lock); - if (server->tcpStatus != CifsGood && -@@ -3970,6 +3982,14 @@ cifs_negotiate_protocol(const unsigned int xid, struct cifs_ses *ses, - spin_unlock(&server->srv_lock); - - rc = server->ops->negotiate(xid, ses, server); -+ if (rc == -EAGAIN) { -+ /* Allow one retry attempt */ -+ if (!in_retry) { -+ in_retry = true; -+ goto retry; -+ } -+ rc = -EHOSTDOWN; -+ } - if (rc == 0) { - spin_lock(&server->srv_lock); - if (server->tcpStatus == CifsInNegotiate) -diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c -index d2e291ef104ec0..137d03781d5268 100644 ---- a/fs/smb/client/fs_context.c -+++ b/fs/smb/client/fs_context.c -@@ -1249,6 +1249,7 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, - case Opt_rsize: - ctx->rsize = result.uint_32; - ctx->got_rsize = true; -+ ctx->vol_rsize = ctx->rsize; - break; - case Opt_wsize: - ctx->wsize = result.uint_32; -@@ -1264,6 +1265,7 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, - ctx->wsize, PAGE_SIZE); - } - } -+ ctx->vol_wsize = ctx->wsize; - break; - case Opt_acregmax: - if (result.uint_32 > CIFS_MAX_ACTIMEO / HZ) { -diff --git a/fs/smb/client/fs_context.h b/fs/smb/client/fs_context.h -index bbd2063ab838d3..d0a2043ea44682 100644 ---- a/fs/smb/client/fs_context.h -+++ b/fs/smb/client/fs_context.h -@@ -253,6 +253,9 @@ struct smb3_fs_context { - bool use_client_guid:1; - /* reuse existing guid for multichannel */ - u8 client_guid[SMB2_CLIENT_GUID_SIZE]; -+ /* User-specified original r/wsize value */ -+ unsigned int vol_rsize; -+ unsigned int vol_wsize; - unsigned int bsize; - unsigned int rasize; - unsigned int rsize; -diff --git a/fs/smb/client/link.c b/fs/smb/client/link.c -index d86da949a91905..007da0a699cb0a 100644 ---- a/fs/smb/client/link.c -+++ b/fs/smb/client/link.c -@@ -257,7 +257,7 @@ cifs_query_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, - struct cifs_open_parms oparms; - struct cifs_io_parms io_parms = {0}; - int buf_type = CIFS_NO_BUFFER; -- FILE_ALL_INFO file_info; -+ struct cifs_open_info_data query_data; - - oparms = (struct cifs_open_parms) { - .tcon = tcon, -@@ -269,11 +269,11 @@ cifs_query_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, - .fid = &fid, - }; - -- rc = CIFS_open(xid, &oparms, &oplock, &file_info); -+ rc = tcon->ses->server->ops->open(xid, &oparms, &oplock, &query_data); - if (rc) - return rc; - -- if (file_info.EndOfFile != cpu_to_le64(CIFS_MF_SYMLINK_FILE_SIZE)) { -+ if (query_data.fi.EndOfFile != cpu_to_le64(CIFS_MF_SYMLINK_FILE_SIZE)) { - rc = -ENOENT; - /* it's not a symlink */ - goto out; -@@ -312,7 +312,7 @@ cifs_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, - .fid = &fid, - }; - -- rc = CIFS_open(xid, &oparms, &oplock, NULL); -+ rc = tcon->ses->server->ops->open(xid, &oparms, &oplock, NULL); - if (rc) - return rc; - -diff --git a/fs/smb/client/readdir.c b/fs/smb/client/readdir.c -index 75929a0a56f969..e616be8196deda 100644 ---- a/fs/smb/client/readdir.c -+++ b/fs/smb/client/readdir.c -@@ -733,7 +733,10 @@ find_cifs_entry(const unsigned int xid, struct cifs_tcon *tcon, loff_t pos, - else - cifs_buf_release(cfile->srch_inf. - ntwrk_buf_start); -+ /* Reset all pointers to the network buffer to prevent stale references */ - cfile->srch_inf.ntwrk_buf_start = NULL; -+ cfile->srch_inf.srch_entries_start = NULL; -+ cfile->srch_inf.last_entry = NULL; - } - rc = initiate_cifs_search(xid, file, full_path); - if (rc) { -@@ -756,11 +759,11 @@ find_cifs_entry(const unsigned int xid, struct cifs_tcon *tcon, loff_t pos, - rc = server->ops->query_dir_next(xid, tcon, &cfile->fid, - search_flags, - &cfile->srch_inf); -+ if (rc) -+ return -ENOENT; - /* FindFirst/Next set last_entry to NULL on malformed reply */ - if (cfile->srch_inf.last_entry) - cifs_save_resume_key(cfile->srch_inf.last_entry, cfile); -- if (rc) -- return -ENOENT; - } - if (index_to_find < cfile->srch_inf.index_of_last_entry) { - /* we found the buffer that contains the entry */ -diff --git a/fs/smb/client/smb1ops.c b/fs/smb/client/smb1ops.c -index caa1d852ece49c..e62d9cc592e0c8 100644 ---- a/fs/smb/client/smb1ops.c -+++ b/fs/smb/client/smb1ops.c -@@ -426,13 +426,6 @@ cifs_negotiate(const unsigned int xid, - { - int rc; - rc = CIFSSMBNegotiate(xid, ses, server); -- if (rc == -EAGAIN) { -- /* retry only once on 1st time connection */ -- set_credits(server, 1); -- rc = CIFSSMBNegotiate(xid, ses, server); -- if (rc == -EAGAIN) -- rc = -EHOSTDOWN; -- } - return rc; - } - -@@ -444,8 +437,8 @@ cifs_negotiate_wsize(struct cifs_tcon *tcon, struct smb3_fs_context *ctx) - unsigned int wsize; - - /* start with specified wsize, or default */ -- if (ctx->wsize) -- wsize = ctx->wsize; -+ if (ctx->got_wsize) -+ wsize = ctx->vol_wsize; - else if (tcon->unix_ext && (unix_cap & CIFS_UNIX_LARGE_WRITE_CAP)) - wsize = CIFS_DEFAULT_IOSIZE; - else -@@ -497,7 +490,7 @@ cifs_negotiate_rsize(struct cifs_tcon *tcon, struct smb3_fs_context *ctx) - else - defsize = server->maxBuf - sizeof(READ_RSP); - -- rsize = ctx->rsize ? ctx->rsize : defsize; -+ rsize = ctx->got_rsize ? ctx->vol_rsize : defsize; - - /* - * no CAP_LARGE_READ_X? Then MS-CIFS states that we must limit this to -@@ -548,24 +541,104 @@ static int cifs_query_path_info(const unsigned int xid, - const char *full_path, - struct cifs_open_info_data *data) - { -- int rc; -+ int rc = -EOPNOTSUPP; - FILE_ALL_INFO fi = {}; -+ struct cifs_search_info search_info = {}; -+ bool non_unicode_wildcard = false; - - data->symlink = false; - data->adjust_tz = false; - -- /* could do find first instead but this returns more info */ -- rc = CIFSSMBQPathInfo(xid, tcon, full_path, &fi, 0 /* not legacy */, cifs_sb->local_nls, -- cifs_remap(cifs_sb)); - /* -- * BB optimize code so we do not make the above call when server claims -- * no NT SMB support and the above call failed at least once - set flag -- * in tcon or mount. -+ * First try CIFSSMBQPathInfo() function which returns more info -+ * (NumberOfLinks) than CIFSFindFirst() fallback function. -+ * Some servers like Win9x do not support SMB_QUERY_FILE_ALL_INFO over -+ * TRANS2_QUERY_PATH_INFORMATION, but supports it with filehandle over -+ * TRANS2_QUERY_FILE_INFORMATION (function CIFSSMBQFileInfo(). But SMB -+ * Open command on non-NT servers works only for files, does not work -+ * for directories. And moreover Win9x SMB server returns bogus data in -+ * SMB_QUERY_FILE_ALL_INFO Attributes field. So for non-NT servers, -+ * do not even use CIFSSMBQPathInfo() or CIFSSMBQFileInfo() function. -+ */ -+ if (tcon->ses->capabilities & CAP_NT_SMBS) -+ rc = CIFSSMBQPathInfo(xid, tcon, full_path, &fi, 0 /* not legacy */, -+ cifs_sb->local_nls, cifs_remap(cifs_sb)); -+ -+ /* -+ * Non-UNICODE variant of fallback functions below expands wildcards, -+ * so they cannot be used for querying paths with wildcard characters. - */ -- if ((rc == -EOPNOTSUPP) || (rc == -EINVAL)) { -+ if (rc && !(tcon->ses->capabilities & CAP_UNICODE) && strpbrk(full_path, "*?\"><")) -+ non_unicode_wildcard = true; -+ -+ /* -+ * Then fallback to CIFSFindFirst() which works also with non-NT servers -+ * but does not does not provide NumberOfLinks. -+ */ -+ if ((rc == -EOPNOTSUPP || rc == -EINVAL) && -+ !non_unicode_wildcard) { -+ if (!(tcon->ses->capabilities & tcon->ses->server->vals->cap_nt_find)) -+ search_info.info_level = SMB_FIND_FILE_INFO_STANDARD; -+ else -+ search_info.info_level = SMB_FIND_FILE_FULL_DIRECTORY_INFO; -+ rc = CIFSFindFirst(xid, tcon, full_path, cifs_sb, NULL, -+ CIFS_SEARCH_CLOSE_ALWAYS | CIFS_SEARCH_CLOSE_AT_END, -+ &search_info, false); -+ if (rc == 0) { -+ if (!(tcon->ses->capabilities & tcon->ses->server->vals->cap_nt_find)) { -+ FIND_FILE_STANDARD_INFO *di; -+ int offset = tcon->ses->server->timeAdj; -+ -+ di = (FIND_FILE_STANDARD_INFO *)search_info.srch_entries_start; -+ fi.CreationTime = cpu_to_le64(cifs_UnixTimeToNT(cnvrtDosUnixTm( -+ di->CreationDate, di->CreationTime, offset))); -+ fi.LastAccessTime = cpu_to_le64(cifs_UnixTimeToNT(cnvrtDosUnixTm( -+ di->LastAccessDate, di->LastAccessTime, offset))); -+ fi.LastWriteTime = cpu_to_le64(cifs_UnixTimeToNT(cnvrtDosUnixTm( -+ di->LastWriteDate, di->LastWriteTime, offset))); -+ fi.ChangeTime = fi.LastWriteTime; -+ fi.Attributes = cpu_to_le32(le16_to_cpu(di->Attributes)); -+ fi.AllocationSize = cpu_to_le64(le32_to_cpu(di->AllocationSize)); -+ fi.EndOfFile = cpu_to_le64(le32_to_cpu(di->DataSize)); -+ } else { -+ FILE_FULL_DIRECTORY_INFO *di; -+ -+ di = (FILE_FULL_DIRECTORY_INFO *)search_info.srch_entries_start; -+ fi.CreationTime = di->CreationTime; -+ fi.LastAccessTime = di->LastAccessTime; -+ fi.LastWriteTime = di->LastWriteTime; -+ fi.ChangeTime = di->ChangeTime; -+ fi.Attributes = di->ExtFileAttributes; -+ fi.AllocationSize = di->AllocationSize; -+ fi.EndOfFile = di->EndOfFile; -+ fi.EASize = di->EaSize; -+ } -+ fi.NumberOfLinks = cpu_to_le32(1); -+ fi.DeletePending = 0; -+ fi.Directory = !!(le32_to_cpu(fi.Attributes) & ATTR_DIRECTORY); -+ cifs_buf_release(search_info.ntwrk_buf_start); -+ } else if (!full_path[0]) { -+ /* -+ * CIFSFindFirst() does not work on root path if the -+ * root path was exported on the server from the top -+ * level path (drive letter). -+ */ -+ rc = -EOPNOTSUPP; -+ } -+ } -+ -+ /* -+ * If everything failed then fallback to the legacy SMB command -+ * SMB_COM_QUERY_INFORMATION which works with all servers, but -+ * provide just few information. -+ */ -+ if ((rc == -EOPNOTSUPP || rc == -EINVAL) && !non_unicode_wildcard) { - rc = SMBQueryInformation(xid, tcon, full_path, &fi, cifs_sb->local_nls, - cifs_remap(cifs_sb)); - data->adjust_tz = true; -+ } else if ((rc == -EOPNOTSUPP || rc == -EINVAL) && non_unicode_wildcard) { -+ /* Path with non-UNICODE wildcard character cannot exist. */ -+ rc = -ENOENT; - } - - if (!rc) { -@@ -662,6 +735,13 @@ static int cifs_query_file_info(const unsigned int xid, struct cifs_tcon *tcon, - int rc; - FILE_ALL_INFO fi = {}; - -+ /* -+ * CIFSSMBQFileInfo() for non-NT servers returns bogus data in -+ * Attributes fields. So do not use this command for non-NT servers. -+ */ -+ if (!(tcon->ses->capabilities & CAP_NT_SMBS)) -+ return -EOPNOTSUPP; -+ - if (cfile->symlink_target) { - data->symlink_target = kstrdup(cfile->symlink_target, GFP_KERNEL); - if (!data->symlink_target) -@@ -832,6 +912,9 @@ smb_set_file_info(struct inode *inode, const char *full_path, - struct cifs_fid fid; - struct cifs_open_parms oparms; - struct cifsFileInfo *open_file; -+ FILE_BASIC_INFO new_buf; -+ struct cifs_open_info_data query_data; -+ __le64 write_time = buf->LastWriteTime; - struct cifsInodeInfo *cinode = CIFS_I(inode); - struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb); - struct tcon_link *tlink = NULL; -@@ -839,20 +922,58 @@ smb_set_file_info(struct inode *inode, const char *full_path, - - /* if the file is already open for write, just use that fileid */ - open_file = find_writable_file(cinode, FIND_WR_FSUID_ONLY); -+ - if (open_file) { - fid.netfid = open_file->fid.netfid; - netpid = open_file->pid; - tcon = tlink_tcon(open_file->tlink); -- goto set_via_filehandle; -+ } else { -+ tlink = cifs_sb_tlink(cifs_sb); -+ if (IS_ERR(tlink)) { -+ rc = PTR_ERR(tlink); -+ tlink = NULL; -+ goto out; -+ } -+ tcon = tlink_tcon(tlink); - } - -- tlink = cifs_sb_tlink(cifs_sb); -- if (IS_ERR(tlink)) { -- rc = PTR_ERR(tlink); -- tlink = NULL; -- goto out; -+ /* -+ * Non-NT servers interprets zero time value in SMB_SET_FILE_BASIC_INFO -+ * over TRANS2_SET_FILE_INFORMATION as a valid time value. NT servers -+ * interprets zero time value as do not change existing value on server. -+ * API of ->set_file_info() callback expects that zero time value has -+ * the NT meaning - do not change. Therefore if server is non-NT and -+ * some time values in "buf" are zero, then fetch missing time values. -+ */ -+ if (!(tcon->ses->capabilities & CAP_NT_SMBS) && -+ (!buf->CreationTime || !buf->LastAccessTime || -+ !buf->LastWriteTime || !buf->ChangeTime)) { -+ rc = cifs_query_path_info(xid, tcon, cifs_sb, full_path, &query_data); -+ if (rc) { -+ if (open_file) { -+ cifsFileInfo_put(open_file); -+ open_file = NULL; -+ } -+ goto out; -+ } -+ /* -+ * Original write_time from buf->LastWriteTime is preserved -+ * as SMBSetInformation() interprets zero as do not change. -+ */ -+ new_buf = *buf; -+ buf = &new_buf; -+ if (!buf->CreationTime) -+ buf->CreationTime = query_data.fi.CreationTime; -+ if (!buf->LastAccessTime) -+ buf->LastAccessTime = query_data.fi.LastAccessTime; -+ if (!buf->LastWriteTime) -+ buf->LastWriteTime = query_data.fi.LastWriteTime; -+ if (!buf->ChangeTime) -+ buf->ChangeTime = query_data.fi.ChangeTime; - } -- tcon = tlink_tcon(tlink); -+ -+ if (open_file) -+ goto set_via_filehandle; - - rc = CIFSSMBSetPathInfo(xid, tcon, full_path, buf, cifs_sb->local_nls, - cifs_sb); -@@ -873,8 +994,45 @@ smb_set_file_info(struct inode *inode, const char *full_path, - .fid = &fid, - }; - -- cifs_dbg(FYI, "calling SetFileInfo since SetPathInfo for times not supported by this server\n"); -- rc = CIFS_open(xid, &oparms, &oplock, NULL); -+ if (S_ISDIR(inode->i_mode) && !(tcon->ses->capabilities & CAP_NT_SMBS)) { -+ /* Opening directory path is not possible on non-NT servers. */ -+ rc = -EOPNOTSUPP; -+ } else { -+ /* -+ * Use cifs_open_file() instead of CIFS_open() as the -+ * cifs_open_file() selects the correct function which -+ * works also on non-NT servers. -+ */ -+ rc = cifs_open_file(xid, &oparms, &oplock, NULL); -+ /* -+ * Opening path for writing on non-NT servers is not -+ * possible when the read-only attribute is already set. -+ * Non-NT server in this case returns -EACCES. For those -+ * servers the only possible way how to clear the read-only -+ * bit is via SMB_COM_SETATTR command. -+ */ -+ if (rc == -EACCES && -+ (cinode->cifsAttrs & ATTR_READONLY) && -+ le32_to_cpu(buf->Attributes) != 0 && /* 0 = do not change attrs */ -+ !(le32_to_cpu(buf->Attributes) & ATTR_READONLY) && -+ !(tcon->ses->capabilities & CAP_NT_SMBS)) -+ rc = -EOPNOTSUPP; -+ } -+ -+ /* Fallback to SMB_COM_SETATTR command when absolutelty needed. */ -+ if (rc == -EOPNOTSUPP) { -+ cifs_dbg(FYI, "calling SetInformation since SetPathInfo for attrs/times not supported by this server\n"); -+ rc = SMBSetInformation(xid, tcon, full_path, -+ buf->Attributes != 0 ? buf->Attributes : cpu_to_le32(cinode->cifsAttrs), -+ write_time, -+ cifs_sb->local_nls, cifs_sb); -+ if (rc == 0) -+ cinode->cifsAttrs = le32_to_cpu(buf->Attributes); -+ else -+ rc = -EACCES; -+ goto out; -+ } -+ - if (rc != 0) { - if (rc == -EIO) - rc = -EINVAL; -@@ -882,6 +1040,7 @@ smb_set_file_info(struct inode *inode, const char *full_path, - } - - netpid = current->tgid; -+ cifs_dbg(FYI, "calling SetFileInfo since SetPathInfo for attrs/times not supported by this server\n"); - - set_via_filehandle: - rc = CIFSSMBSetFileInfo(xid, tcon, buf, fid.netfid, netpid); -@@ -892,6 +1051,21 @@ smb_set_file_info(struct inode *inode, const char *full_path, - CIFSSMBClose(xid, tcon, fid.netfid); - else - cifsFileInfo_put(open_file); -+ -+ /* -+ * Setting the read-only bit is not honered on non-NT servers when done -+ * via open-semantics. So for setting it, use SMB_COM_SETATTR command. -+ * This command works only after the file is closed, so use it only when -+ * operation was called without the filehandle. -+ */ -+ if (open_file == NULL && -+ !(tcon->ses->capabilities & CAP_NT_SMBS) && -+ le32_to_cpu(buf->Attributes) & ATTR_READONLY) { -+ SMBSetInformation(xid, tcon, full_path, -+ buf->Attributes, -+ 0 /* do not change write time */, -+ cifs_sb->local_nls, cifs_sb); -+ } - out: - if (tlink != NULL) - cifs_put_tlink(tlink); -diff --git a/fs/smb/client/smb2file.c b/fs/smb/client/smb2file.c -index db9c807115c605..d7f2835e0b1cc1 100644 ---- a/fs/smb/client/smb2file.c -+++ b/fs/smb/client/smb2file.c -@@ -107,16 +107,25 @@ int smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms, __u32 - int err_buftype = CIFS_NO_BUFFER; - struct cifs_fid *fid = oparms->fid; - struct network_resiliency_req nr_ioctl_req; -+ bool retry_without_read_attributes = false; - - smb2_path = cifs_convert_path_to_utf16(oparms->path, oparms->cifs_sb); - if (smb2_path == NULL) - return -ENOMEM; - -- oparms->desired_access |= FILE_READ_ATTRIBUTES; -+ if (!(oparms->desired_access & FILE_READ_ATTRIBUTES)) { -+ oparms->desired_access |= FILE_READ_ATTRIBUTES; -+ retry_without_read_attributes = true; -+ } - smb2_oplock = SMB2_OPLOCK_LEVEL_BATCH; - - rc = SMB2_open(xid, oparms, smb2_path, &smb2_oplock, smb2_data, NULL, &err_iov, - &err_buftype); -+ if (rc == -EACCES && retry_without_read_attributes) { -+ oparms->desired_access &= ~FILE_READ_ATTRIBUTES; -+ rc = SMB2_open(xid, oparms, smb2_path, &smb2_oplock, smb2_data, NULL, &err_iov, -+ &err_buftype); -+ } - if (rc && data) { - struct smb2_hdr *hdr = err_iov.iov_base; - -diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c -index b809a616728f27..4e3eacbec96d14 100644 ---- a/fs/smb/client/smb2ops.c -+++ b/fs/smb/client/smb2ops.c -@@ -428,12 +428,20 @@ smb2_negotiate(const unsigned int xid, - server->CurrentMid = 0; - spin_unlock(&server->mid_lock); - rc = SMB2_negotiate(xid, ses, server); -- /* BB we probably don't need to retry with modern servers */ -- if (rc == -EAGAIN) -- rc = -EHOSTDOWN; - return rc; - } - -+static inline unsigned int -+prevent_zero_iosize(unsigned int size, const char *type) -+{ -+ if (size == 0) { -+ cifs_dbg(VFS, "SMB: Zero %ssize calculated, using minimum value %u\n", -+ type, CIFS_MIN_DEFAULT_IOSIZE); -+ return CIFS_MIN_DEFAULT_IOSIZE; -+ } -+ return size; -+} -+ - static unsigned int - smb2_negotiate_wsize(struct cifs_tcon *tcon, struct smb3_fs_context *ctx) - { -@@ -441,12 +449,12 @@ smb2_negotiate_wsize(struct cifs_tcon *tcon, struct smb3_fs_context *ctx) - unsigned int wsize; - - /* start with specified wsize, or default */ -- wsize = ctx->wsize ? ctx->wsize : CIFS_DEFAULT_IOSIZE; -+ wsize = ctx->got_wsize ? ctx->vol_wsize : CIFS_DEFAULT_IOSIZE; - wsize = min_t(unsigned int, wsize, server->max_write); - if (!(server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU)) - wsize = min_t(unsigned int, wsize, SMB2_MAX_BUFFER_SIZE); - -- return wsize; -+ return prevent_zero_iosize(wsize, "w"); - } - - static unsigned int -@@ -456,7 +464,7 @@ smb3_negotiate_wsize(struct cifs_tcon *tcon, struct smb3_fs_context *ctx) - unsigned int wsize; - - /* start with specified wsize, or default */ -- wsize = ctx->wsize ? ctx->wsize : SMB3_DEFAULT_IOSIZE; -+ wsize = ctx->got_wsize ? ctx->vol_wsize : SMB3_DEFAULT_IOSIZE; - wsize = min_t(unsigned int, wsize, server->max_write); - #ifdef CONFIG_CIFS_SMB_DIRECT - if (server->rdma) { -@@ -478,7 +486,7 @@ smb3_negotiate_wsize(struct cifs_tcon *tcon, struct smb3_fs_context *ctx) - if (!(server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU)) - wsize = min_t(unsigned int, wsize, SMB2_MAX_BUFFER_SIZE); - -- return wsize; -+ return prevent_zero_iosize(wsize, "w"); - } - - static unsigned int -@@ -488,13 +496,13 @@ smb2_negotiate_rsize(struct cifs_tcon *tcon, struct smb3_fs_context *ctx) - unsigned int rsize; - - /* start with specified rsize, or default */ -- rsize = ctx->rsize ? ctx->rsize : CIFS_DEFAULT_IOSIZE; -+ rsize = ctx->got_rsize ? ctx->vol_rsize : CIFS_DEFAULT_IOSIZE; - rsize = min_t(unsigned int, rsize, server->max_read); - - if (!(server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU)) - rsize = min_t(unsigned int, rsize, SMB2_MAX_BUFFER_SIZE); - -- return rsize; -+ return prevent_zero_iosize(rsize, "r"); - } - - static unsigned int -@@ -504,7 +512,7 @@ smb3_negotiate_rsize(struct cifs_tcon *tcon, struct smb3_fs_context *ctx) - unsigned int rsize; - - /* start with specified rsize, or default */ -- rsize = ctx->rsize ? ctx->rsize : SMB3_DEFAULT_IOSIZE; -+ rsize = ctx->got_rsize ? ctx->vol_rsize : SMB3_DEFAULT_IOSIZE; - rsize = min_t(unsigned int, rsize, server->max_read); - #ifdef CONFIG_CIFS_SMB_DIRECT - if (server->rdma) { -@@ -527,7 +535,7 @@ smb3_negotiate_rsize(struct cifs_tcon *tcon, struct smb3_fs_context *ctx) - if (!(server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU)) - rsize = min_t(unsigned int, rsize, SMB2_MAX_BUFFER_SIZE); - -- return rsize; -+ return prevent_zero_iosize(rsize, "r"); - } - - /* -diff --git a/fs/smb/client/transport.c b/fs/smb/client/transport.c -index ddf1a3aafee5c6..2269963e500819 100644 ---- a/fs/smb/client/transport.c -+++ b/fs/smb/client/transport.c -@@ -178,7 +178,7 @@ delete_mid(struct mid_q_entry *mid) - * Our basic "send data to server" function. Should be called with srv_mutex - * held. The caller is responsible for handling the results. - */ --static int -+int - smb_send_kvec(struct TCP_Server_Info *server, struct msghdr *smb_msg, - size_t *sent) - { -diff --git a/fs/smb/common/smb2pdu.h b/fs/smb/common/smb2pdu.h -index c3ee42188d252e..1af827ae757e0d 100644 ---- a/fs/smb/common/smb2pdu.h -+++ b/fs/smb/common/smb2pdu.h -@@ -95,6 +95,9 @@ - */ - #define SMB3_DEFAULT_IOSIZE (4 * 1024 * 1024) - -+/* According to MS-SMB2 specification The minimum recommended value is 65536.*/ -+#define CIFS_MIN_DEFAULT_IOSIZE (65536) -+ - /* - * SMB2 Header Definition - * -diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c -index 72294764d4c20c..e564432643ea30 100644 ---- a/fs/smb/server/oplock.c -+++ b/fs/smb/server/oplock.c -@@ -146,12 +146,9 @@ static struct oplock_info *opinfo_get_list(struct ksmbd_inode *ci) - { - struct oplock_info *opinfo; - -- if (list_empty(&ci->m_op_list)) -- return NULL; -- - down_read(&ci->m_lock); -- opinfo = list_first_entry(&ci->m_op_list, struct oplock_info, -- op_entry); -+ opinfo = list_first_entry_or_null(&ci->m_op_list, struct oplock_info, -+ op_entry); - if (opinfo) { - if (opinfo->conn == NULL || - !atomic_inc_not_zero(&opinfo->refcount)) -diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c -index f6616d687365a3..3bbf2382706056 100644 ---- a/fs/smb/server/vfs.c -+++ b/fs/smb/server/vfs.c -@@ -426,10 +426,15 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos, - ksmbd_debug(VFS, "write stream data pos : %llu, count : %zd\n", - *pos, count); - -+ if (*pos >= XATTR_SIZE_MAX) { -+ pr_err("stream write position %lld is out of bounds\n", *pos); -+ return -EINVAL; -+ } -+ - size = *pos + count; - if (size > XATTR_SIZE_MAX) { - size = XATTR_SIZE_MAX; -- count = (*pos + count) - XATTR_SIZE_MAX; -+ count = XATTR_SIZE_MAX - *pos; - } - - v_len = ksmbd_vfs_getcasexattr(idmap, -@@ -443,13 +448,6 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos, - goto out; - } - -- if (v_len <= *pos) { -- pr_err("stream write position %lld is out of bounds (stream length: %zd)\n", -- *pos, v_len); -- err = -EINVAL; -- goto out; -- } -- - if (v_len < size) { - wbuf = kvzalloc(size, GFP_KERNEL); - if (!wbuf) { -diff --git a/include/crypto/hash.h b/include/crypto/hash.h -index f7c2a22cd776da..c0d472fdc82e6c 100644 ---- a/include/crypto/hash.h -+++ b/include/crypto/hash.h -@@ -153,6 +153,7 @@ struct ahash_request { - * This is a counterpart to @init_tfm, used to remove - * various changes set in @init_tfm. - * @clone_tfm: Copy transform into new object, may allocate memory. -+ * @reqsize: Size of the request context. - * @halg: see struct hash_alg_common - */ - struct ahash_alg { -@@ -169,6 +170,8 @@ struct ahash_alg { - void (*exit_tfm)(struct crypto_ahash *tfm); - int (*clone_tfm)(struct crypto_ahash *dst, struct crypto_ahash *src); - -+ unsigned int reqsize; -+ - struct hash_alg_common halg; - }; - -diff --git a/include/drm/drm_atomic.h b/include/drm/drm_atomic.h -index 9a022caacf9361..f3e7e3e5078dbc 100644 ---- a/include/drm/drm_atomic.h -+++ b/include/drm/drm_atomic.h -@@ -372,8 +372,27 @@ struct drm_atomic_state { - * - * Allow full modeset. This is used by the ATOMIC IOCTL handler to - * implement the DRM_MODE_ATOMIC_ALLOW_MODESET flag. Drivers should -- * never consult this flag, instead looking at the output of -- * drm_atomic_crtc_needs_modeset(). -+ * generally not consult this flag, but instead look at the output of -+ * drm_atomic_crtc_needs_modeset(). The detailed rules are: -+ * -+ * - Drivers must not consult @allow_modeset in the atomic commit path. -+ * Use drm_atomic_crtc_needs_modeset() instead. -+ * -+ * - Drivers must consult @allow_modeset before adding unrelated struct -+ * drm_crtc_state to this commit by calling -+ * drm_atomic_get_crtc_state(). See also the warning in the -+ * documentation for that function. -+ * -+ * - Drivers must never change this flag, it is under the exclusive -+ * control of userspace. -+ * -+ * - Drivers may consult @allow_modeset in the atomic check path, if -+ * they have the choice between an optimal hardware configuration -+ * which requires a modeset, and a less optimal configuration which -+ * can be committed without a modeset. An example would be suboptimal -+ * scanout FIFO allocation resulting in increased idle power -+ * consumption. This allows userspace to avoid flickering and delays -+ * for the normal composition loop at reasonable cost. - */ - bool allow_modeset : 1; - /** -diff --git a/include/drm/drm_gem.h b/include/drm/drm_gem.h -index 7c2ec139c464ad..a578068169f19a 100644 ---- a/include/drm/drm_gem.h -+++ b/include/drm/drm_gem.h -@@ -35,6 +35,7 @@ - */ - - #include -+#include - #include - #include - #include -@@ -557,6 +558,18 @@ static inline bool drm_gem_object_is_shared_for_memory_stats(struct drm_gem_obje - return (obj->handle_count > 1) || obj->dma_buf; - } - -+/** -+ * drm_gem_is_imported() - Tests if GEM object's buffer has been imported -+ * @obj: the GEM object -+ * -+ * Returns: -+ * True if the GEM object's buffer has been imported, false otherwise -+ */ -+static inline bool drm_gem_is_imported(const struct drm_gem_object *obj) -+{ -+ return !!obj->import_attach; -+} -+ - #ifdef CONFIG_LOCKDEP - /** - * drm_gem_gpuva_set_lock() - Set the lock protecting accesses to the gpuva list. -diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h -index d4f2c8706042cd..2331cd8174fe3f 100644 ---- a/include/linux/bpf-cgroup.h -+++ b/include/linux/bpf-cgroup.h -@@ -106,6 +106,7 @@ struct bpf_prog_list { - struct bpf_prog *prog; - struct bpf_cgroup_link *link; - struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE]; -+ u32 flags; - }; - - int cgroup_bpf_inherit(struct cgroup *cgrp); -diff --git a/include/linux/coredump.h b/include/linux/coredump.h -index d3eba436015087..c1b4c8c70caebd 100644 ---- a/include/linux/coredump.h -+++ b/include/linux/coredump.h -@@ -28,6 +28,7 @@ struct coredump_params { - int vma_count; - size_t vma_data_size; - struct core_vma_metadata *vma_meta; -+ struct pid *pid; - }; - - /* -diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h -index f0ccca16a0aca1..608e8296ba206a 100644 ---- a/include/linux/dma-mapping.h -+++ b/include/linux/dma-mapping.h -@@ -600,10 +600,14 @@ static inline int dma_mmap_wc(struct device *dev, - #else - #define DEFINE_DMA_UNMAP_ADDR(ADDR_NAME) - #define DEFINE_DMA_UNMAP_LEN(LEN_NAME) --#define dma_unmap_addr(PTR, ADDR_NAME) (0) --#define dma_unmap_addr_set(PTR, ADDR_NAME, VAL) do { } while (0) --#define dma_unmap_len(PTR, LEN_NAME) (0) --#define dma_unmap_len_set(PTR, LEN_NAME, VAL) do { } while (0) -+#define dma_unmap_addr(PTR, ADDR_NAME) \ -+ ({ typeof(PTR) __p __maybe_unused = PTR; 0; }) -+#define dma_unmap_addr_set(PTR, ADDR_NAME, VAL) \ -+ do { typeof(PTR) __p __maybe_unused = PTR; } while (0) -+#define dma_unmap_len(PTR, LEN_NAME) \ -+ ({ typeof(PTR) __p __maybe_unused = PTR; 0; }) -+#define dma_unmap_len_set(PTR, LEN_NAME, VAL) \ -+ do { typeof(PTR) __p __maybe_unused = PTR; } while (0) - #endif - - #endif /* _LINUX_DMA_MAPPING_H */ -diff --git a/include/linux/highmem.h b/include/linux/highmem.h -index 75607d4ba26cb7..714966d5701e00 100644 ---- a/include/linux/highmem.h -+++ b/include/linux/highmem.h -@@ -448,7 +448,7 @@ static inline void memcpy_from_folio(char *to, struct folio *folio, - const char *from = kmap_local_folio(folio, offset); - size_t chunk = len; - -- if (folio_test_highmem(folio) && -+ if (folio_test_partial_kmap(folio) && - chunk > PAGE_SIZE - offset_in_page(offset)) - chunk = PAGE_SIZE - offset_in_page(offset); - memcpy(to, from, chunk); -@@ -469,7 +469,7 @@ static inline void memcpy_to_folio(struct folio *folio, size_t offset, - char *to = kmap_local_folio(folio, offset); - size_t chunk = len; - -- if (folio_test_highmem(folio) && -+ if (folio_test_partial_kmap(folio) && - chunk > PAGE_SIZE - offset_in_page(offset)) - chunk = PAGE_SIZE - offset_in_page(offset); - memcpy(to, from, chunk); -@@ -501,7 +501,7 @@ static inline size_t memcpy_from_file_folio(char *to, struct folio *folio, - size_t offset = offset_in_folio(folio, pos); - char *from = kmap_local_folio(folio, offset); - -- if (folio_test_highmem(folio)) { -+ if (folio_test_partial_kmap(folio)) { - offset = offset_in_page(offset); - len = min_t(size_t, len, PAGE_SIZE - offset); - } else -diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h -index 8f77bb0f4ae0ca..05f8b7d7d1e968 100644 ---- a/include/linux/hrtimer.h -+++ b/include/linux/hrtimer.h -@@ -237,6 +237,7 @@ struct hrtimer_cpu_base { - ktime_t softirq_expires_next; - struct hrtimer *softirq_next_timer; - struct hrtimer_clock_base clock_base[HRTIMER_MAX_CLOCK_BASES]; -+ call_single_data_t csd; - } ____cacheline_aligned; - - static inline void hrtimer_set_expires(struct hrtimer *timer, ktime_t time) -diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h -index af8a771a053c51..d79851c5fabd86 100644 ---- a/include/linux/ipv6.h -+++ b/include/linux/ipv6.h -@@ -199,6 +199,7 @@ struct inet6_cork { - struct ipv6_txoptions *opt; - u8 hop_limit; - u8 tclass; -+ u8 dontfrag:1; - }; - - /* struct ipv6_pinfo - ipv6 private area */ -diff --git a/include/linux/lzo.h b/include/linux/lzo.h -index e95c7d1092b286..4d30e3624acd23 100644 ---- a/include/linux/lzo.h -+++ b/include/linux/lzo.h -@@ -24,10 +24,18 @@ - int lzo1x_1_compress(const unsigned char *src, size_t src_len, - unsigned char *dst, size_t *dst_len, void *wrkmem); - -+/* Same as above but does not write more than dst_len to dst. */ -+int lzo1x_1_compress_safe(const unsigned char *src, size_t src_len, -+ unsigned char *dst, size_t *dst_len, void *wrkmem); -+ - /* This requires 'wrkmem' of size LZO1X_1_MEM_COMPRESS */ - int lzorle1x_1_compress(const unsigned char *src, size_t src_len, - unsigned char *dst, size_t *dst_len, void *wrkmem); - -+/* Same as above but does not write more than dst_len to dst. */ -+int lzorle1x_1_compress_safe(const unsigned char *src, size_t src_len, -+ unsigned char *dst, size_t *dst_len, void *wrkmem); -+ - /* safe decompression with overrun testing */ - int lzo1x_decompress_safe(const unsigned char *src, size_t src_len, - unsigned char *dst, size_t *dst_len); -diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h -index 27f42f713c891c..86f0f2a25a3d63 100644 ---- a/include/linux/mlx4/device.h -+++ b/include/linux/mlx4/device.h -@@ -1135,7 +1135,7 @@ int mlx4_write_mtt(struct mlx4_dev *dev, struct mlx4_mtt *mtt, - int mlx4_buf_write_mtt(struct mlx4_dev *dev, struct mlx4_mtt *mtt, - struct mlx4_buf *buf); - --int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, int order); -+int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, unsigned int order); - void mlx4_db_free(struct mlx4_dev *dev, struct mlx4_db *db); - - int mlx4_alloc_hwq_res(struct mlx4_dev *dev, struct mlx4_hwq_resources *wqres, -diff --git a/include/linux/mlx5/fs.h b/include/linux/mlx5/fs.h -index 3fb428ce7d1c7c..b6b9a4dfa4fb92 100644 ---- a/include/linux/mlx5/fs.h -+++ b/include/linux/mlx5/fs.h -@@ -40,6 +40,8 @@ - - #define MLX5_SET_CFG(p, f, v) MLX5_SET(create_flow_group_in, p, f, v) - -+#define MLX5_FS_MAX_POOL_SIZE BIT(30) -+ - enum mlx5_flow_destination_type { - MLX5_FLOW_DESTINATION_TYPE_NONE, - MLX5_FLOW_DESTINATION_TYPE_VPORT, -diff --git a/include/linux/msi.h b/include/linux/msi.h -index ddace8c34dcf95..2cf15cf5d060ad 100644 ---- a/include/linux/msi.h -+++ b/include/linux/msi.h -@@ -171,6 +171,10 @@ struct msi_desc_data { - * @dev: Pointer to the device which uses this descriptor - * @msg: The last set MSI message cached for reuse - * @affinity: Optional pointer to a cpu affinity mask for this descriptor -+ * @iommu_msi_iova: Optional shifted IOVA from the IOMMU to override the msi_addr. -+ * Only used if iommu_msi_shift != 0 -+ * @iommu_msi_shift: Indicates how many bits of the original address should be -+ * preserved when using iommu_msi_iova. - * @sysfs_attr: Pointer to sysfs device attribute - * - * @write_msi_msg: Callback that may be called when the MSI message -@@ -189,7 +193,8 @@ struct msi_desc { - struct msi_msg msg; - struct irq_affinity_desc *affinity; - #ifdef CONFIG_IRQ_MSI_IOMMU -- const void *iommu_cookie; -+ u64 iommu_msi_iova : 58; -+ u64 iommu_msi_shift : 6; - #endif - #ifdef CONFIG_SYSFS - struct device_attribute *sysfs_attrs; -@@ -306,28 +311,14 @@ struct msi_desc *msi_next_desc(struct device *dev, unsigned int domid, - - #define msi_desc_to_dev(desc) ((desc)->dev) - --#ifdef CONFIG_IRQ_MSI_IOMMU --static inline const void *msi_desc_get_iommu_cookie(struct msi_desc *desc) --{ -- return desc->iommu_cookie; --} -- --static inline void msi_desc_set_iommu_cookie(struct msi_desc *desc, -- const void *iommu_cookie) --{ -- desc->iommu_cookie = iommu_cookie; --} --#else --static inline const void *msi_desc_get_iommu_cookie(struct msi_desc *desc) -+static inline void msi_desc_set_iommu_msi_iova(struct msi_desc *desc, u64 msi_iova, -+ unsigned int msi_shift) - { -- return NULL; --} -- --static inline void msi_desc_set_iommu_cookie(struct msi_desc *desc, -- const void *iommu_cookie) --{ --} -+#ifdef CONFIG_IRQ_MSI_IOMMU -+ desc->iommu_msi_iova = msi_iova >> msi_shift; -+ desc->iommu_msi_shift = msi_shift; - #endif -+} - - int msi_domain_insert_msi_desc(struct device *dev, unsigned int domid, - struct msi_desc *init_desc); -diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h -index 86d96e00c2e3de..374b1b208bd89e 100644 ---- a/include/linux/nfs_fs_sb.h -+++ b/include/linux/nfs_fs_sb.h -@@ -199,6 +199,15 @@ struct nfs_server { - char *fscache_uniq; /* Uniquifier (or NULL) */ - #endif - -+ /* The following #defines numerically match the NFSv4 equivalents */ -+#define NFS_FH_NOEXPIRE_WITH_OPEN (0x1) -+#define NFS_FH_VOLATILE_ANY (0x2) -+#define NFS_FH_VOL_MIGRATION (0x4) -+#define NFS_FH_VOL_RENAME (0x8) -+#define NFS_FH_RENAME_UNSAFE (NFS_FH_VOLATILE_ANY | NFS_FH_VOL_RENAME) -+ u32 fh_expire_type; /* V4 bitmask representing file -+ handle volatility type for -+ this filesystem */ - u32 pnfs_blksize; /* layout_blksize attr */ - #if IS_ENABLED(CONFIG_NFS_V4) - u32 attr_bitmask[3];/* V4 bitmask representing the set -@@ -222,9 +231,6 @@ struct nfs_server { - u32 acl_bitmask; /* V4 bitmask representing the ACEs - that are supported on this - filesystem */ -- u32 fh_expire_type; /* V4 bitmask representing file -- handle volatility type for -- this filesystem */ - struct pnfs_layoutdriver_type *pnfs_curr_ld; /* Active layout driver */ - struct rpc_wait_queue roc_rpcwaitq; - void *pnfs_ld_data; /* per mount point data */ -diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h -index a77f3a7d21d12f..36d0961f1672fd 100644 ---- a/include/linux/page-flags.h -+++ b/include/linux/page-flags.h -@@ -551,6 +551,13 @@ PAGEFLAG(Readahead, readahead, PF_NO_COMPOUND) - PAGEFLAG_FALSE(HighMem, highmem) - #endif - -+/* Does kmap_local_folio() only allow access to one page of the folio? */ -+#ifdef CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP -+#define folio_test_partial_kmap(f) true -+#else -+#define folio_test_partial_kmap(f) folio_test_highmem(f) -+#endif -+ - #ifdef CONFIG_SWAP - static __always_inline bool folio_test_swapcache(struct folio *folio) - { -diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h -index fcb834dd75c240..90c782749b0558 100644 ---- a/include/linux/perf_event.h -+++ b/include/linux/perf_event.h -@@ -1016,7 +1016,13 @@ struct perf_output_handle { - struct perf_buffer *rb; - unsigned long wakeup; - unsigned long size; -- u64 aux_flags; -+ union { -+ u64 flags; /* perf_output*() */ -+ u64 aux_flags; /* perf_aux_output*() */ -+ struct { -+ u64 skip_read : 1; -+ }; -+ }; - union { - void *addr; - unsigned long head; -diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h -index 72da69cc5764f3..27531a0b3a6e72 100644 ---- a/include/linux/rcupdate.h -+++ b/include/linux/rcupdate.h -@@ -97,9 +97,9 @@ static inline void __rcu_read_lock(void) - - static inline void __rcu_read_unlock(void) - { -- preempt_enable(); - if (IS_ENABLED(CONFIG_RCU_STRICT_GRACE_PERIOD)) - rcu_read_unlock_strict(); -+ preempt_enable(); - } - - static inline int rcu_preempt_depth(void) -diff --git a/include/linux/rcutree.h b/include/linux/rcutree.h -index 126f6b418f6afc..559f758bf2eaa8 100644 ---- a/include/linux/rcutree.h -+++ b/include/linux/rcutree.h -@@ -104,7 +104,7 @@ extern int rcu_scheduler_active; - void rcu_end_inkernel_boot(void); - bool rcu_inkernel_boot_has_ended(void); - bool rcu_is_watching(void); --#ifndef CONFIG_PREEMPTION -+#ifndef CONFIG_PREEMPT_RCU - void rcu_all_qs(void); - #endif - -diff --git a/include/linux/trace.h b/include/linux/trace.h -index fdcd76b7be83d7..7eaad857dee04f 100644 ---- a/include/linux/trace.h -+++ b/include/linux/trace.h -@@ -72,8 +72,8 @@ static inline int unregister_ftrace_export(struct trace_export *export) - static inline void trace_printk_init_buffers(void) - { - } --static inline int trace_array_printk(struct trace_array *tr, unsigned long ip, -- const char *fmt, ...) -+static inline __printf(3, 4) -+int trace_array_printk(struct trace_array *tr, unsigned long ip, const char *fmt, ...) - { - return 0; - } -diff --git a/include/linux/trace_seq.h b/include/linux/trace_seq.h -index 3691e0e76a1a20..62147eecf931da 100644 ---- a/include/linux/trace_seq.h -+++ b/include/linux/trace_seq.h -@@ -79,8 +79,8 @@ extern __printf(2, 3) - void trace_seq_printf(struct trace_seq *s, const char *fmt, ...); - extern __printf(2, 0) - void trace_seq_vprintf(struct trace_seq *s, const char *fmt, va_list args); --extern void --trace_seq_bprintf(struct trace_seq *s, const char *fmt, const u32 *binary); -+extern __printf(2, 0) -+void trace_seq_bprintf(struct trace_seq *s, const char *fmt, const u32 *binary); - extern int trace_print_seq(struct seq_file *m, struct trace_seq *s); - extern int trace_seq_to_user(struct trace_seq *s, char __user *ubuf, - int cnt); -@@ -104,8 +104,8 @@ static inline __printf(2, 3) - void trace_seq_printf(struct trace_seq *s, const char *fmt, ...) - { - } --static inline void --trace_seq_bprintf(struct trace_seq *s, const char *fmt, const u32 *binary) -+static inline __printf(2, 0) -+void trace_seq_bprintf(struct trace_seq *s, const char *fmt, const u32 *binary) - { - } - -diff --git a/include/linux/usb/r8152.h b/include/linux/usb/r8152.h -index 33a4c146dc19c4..2ca60828f28bb6 100644 ---- a/include/linux/usb/r8152.h -+++ b/include/linux/usb/r8152.h -@@ -30,6 +30,7 @@ - #define VENDOR_ID_NVIDIA 0x0955 - #define VENDOR_ID_TPLINK 0x2357 - #define VENDOR_ID_DLINK 0x2001 -+#define VENDOR_ID_DELL 0x413c - #define VENDOR_ID_ASUS 0x0b05 - - #if IS_REACHABLE(CONFIG_USB_RTL8152) -diff --git a/include/media/v4l2-subdev.h b/include/media/v4l2-subdev.h -index b4fcd0164048ed..0740dfc6c04881 100644 ---- a/include/media/v4l2-subdev.h -+++ b/include/media/v4l2-subdev.h -@@ -822,7 +822,9 @@ struct v4l2_subdev_state { - * possible configuration from the remote end, likely calling - * this operation as close as possible to stream on time. The - * operation shall fail if the pad index it has been called on -- * is not valid or in case of unrecoverable failures. -+ * is not valid or in case of unrecoverable failures. The -+ * config argument has been memset to 0 just before calling -+ * the op. - * - * @set_routing: enable or disable data connection routes described in the - * subdevice routing table. -diff --git a/include/net/af_unix.h b/include/net/af_unix.h -index 77bf30203d3cf6..b6eedf7650da59 100644 ---- a/include/net/af_unix.h -+++ b/include/net/af_unix.h -@@ -8,21 +8,46 @@ - #include - #include - --void unix_inflight(struct user_struct *user, struct file *fp); --void unix_notinflight(struct user_struct *user, struct file *fp); --void unix_destruct_scm(struct sk_buff *skb); --void io_uring_destruct_scm(struct sk_buff *skb); -+#if IS_ENABLED(CONFIG_UNIX) -+struct unix_sock *unix_get_socket(struct file *filp); -+#else -+static inline struct unix_sock *unix_get_socket(struct file *filp) -+{ -+ return NULL; -+} -+#endif -+ -+extern unsigned int unix_tot_inflight; -+void unix_add_edges(struct scm_fp_list *fpl, struct unix_sock *receiver); -+void unix_del_edges(struct scm_fp_list *fpl); -+void unix_update_edges(struct unix_sock *receiver); -+int unix_prepare_fpl(struct scm_fp_list *fpl); -+void unix_destroy_fpl(struct scm_fp_list *fpl); - void unix_gc(void); --void wait_for_unix_gc(void); --struct sock *unix_get_socket(struct file *filp); -+void wait_for_unix_gc(struct scm_fp_list *fpl); -+ -+struct unix_vertex { -+ struct list_head edges; -+ struct list_head entry; -+ struct list_head scc_entry; -+ unsigned long out_degree; -+ unsigned long index; -+ unsigned long scc_index; -+}; -+ -+struct unix_edge { -+ struct unix_sock *predecessor; -+ struct unix_sock *successor; -+ struct list_head vertex_entry; -+ struct list_head stack_entry; -+}; -+ - struct sock *unix_peer_get(struct sock *sk); - - #define UNIX_HASH_MOD (256 - 1) - #define UNIX_HASH_SIZE (256 * 2) - #define UNIX_HASH_BITS 8 - --extern unsigned int unix_tot_inflight; -- - struct unix_address { - refcount_t refcnt; - int len; -@@ -42,6 +67,7 @@ struct unix_skb_parms { - - struct scm_stat { - atomic_t nr_fds; -+ unsigned long nr_unix_fds; - }; - - #define UNIXCB(skb) (*(struct unix_skb_parms *)&((skb)->cb)) -@@ -54,12 +80,9 @@ struct unix_sock { - struct path path; - struct mutex iolock, bindlock; - struct sock *peer; -- struct list_head link; -- unsigned long inflight; -+ struct sock *listener; -+ struct unix_vertex *vertex; - spinlock_t lock; -- unsigned long gc_flags; --#define UNIX_GC_CANDIDATE 0 --#define UNIX_GC_MAYBE_CYCLE 1 - struct socket_wq peer_wq; - wait_queue_entry_t peer_wake; - struct scm_stat scm_stat; -diff --git a/include/net/scm.h b/include/net/scm.h -index e8c76b4be2fe71..059e287745dc39 100644 ---- a/include/net/scm.h -+++ b/include/net/scm.h -@@ -22,9 +22,20 @@ struct scm_creds { - kgid_t gid; - }; - -+#ifdef CONFIG_UNIX -+struct unix_edge; -+#endif -+ - struct scm_fp_list { - short count; -+ short count_unix; - short max; -+#ifdef CONFIG_UNIX -+ bool inflight; -+ bool dead; -+ struct list_head vertices; -+ struct unix_edge *edges; -+#endif - struct user_struct *user; - struct file *fp[SCM_MAX_FD]; - }; -diff --git a/include/net/xfrm.h b/include/net/xfrm.h -index b33d27e42cff38..fd550c0b563450 100644 ---- a/include/net/xfrm.h -+++ b/include/net/xfrm.h -@@ -228,7 +228,6 @@ struct xfrm_state { - - /* Data for encapsulator */ - struct xfrm_encap_tmpl *encap; -- struct sock __rcu *encap_sk; - - /* Data for care-of address */ - xfrm_address_t *coaddr; -diff --git a/include/rdma/uverbs_std_types.h b/include/rdma/uverbs_std_types.h -index fe05121169589f..555ea3d142a46b 100644 ---- a/include/rdma/uverbs_std_types.h -+++ b/include/rdma/uverbs_std_types.h -@@ -34,7 +34,7 @@ - static inline void *_uobj_get_obj_read(struct ib_uobject *uobj) - { - if (IS_ERR(uobj)) -- return NULL; -+ return ERR_CAST(uobj); - return uobj->object; - } - #define uobj_get_obj_read(_object, _type, _id, _attrs) \ -diff --git a/include/sound/hda_codec.h b/include/sound/hda_codec.h -index 5497dc9c396a5a..b58dc869cf77eb 100644 ---- a/include/sound/hda_codec.h -+++ b/include/sound/hda_codec.h -@@ -196,6 +196,7 @@ struct hda_codec { - /* beep device */ - struct hda_beep *beep; - unsigned int beep_mode; -+ bool beep_just_power_on; - - /* widget capabilities cache */ - u32 *wcaps; -diff --git a/include/sound/pcm.h b/include/sound/pcm.h -index 2a815373dac1d9..ed4449cbdf8033 100644 ---- a/include/sound/pcm.h -+++ b/include/sound/pcm.h -@@ -1427,6 +1427,8 @@ int snd_pcm_lib_mmap_iomem(struct snd_pcm_substream *substream, struct vm_area_s - #define snd_pcm_lib_mmap_iomem NULL - #endif - -+void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime); -+ - /** - * snd_pcm_limit_isa_dma_size - Get the max size fitting with ISA DMA transfer - * @dma: DMA number -diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h -index 3c4d5ef6d44636..8ea1674069fe81 100644 ---- a/include/trace/events/btrfs.h -+++ b/include/trace/events/btrfs.h -@@ -1956,7 +1956,7 @@ DECLARE_EVENT_CLASS(btrfs__prelim_ref, - TP_PROTO(const struct btrfs_fs_info *fs_info, - const struct prelim_ref *oldref, - const struct prelim_ref *newref, u64 tree_size), -- TP_ARGS(fs_info, newref, oldref, tree_size), -+ TP_ARGS(fs_info, oldref, newref, tree_size), - - TP_STRUCT__entry_btrfs( - __field( u64, root_id ) -diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h -index 431bc700bcfb93..c7f904a72af217 100644 ---- a/include/uapi/linux/bpf.h -+++ b/include/uapi/linux/bpf.h -@@ -1140,6 +1140,7 @@ enum bpf_perf_event_type { - #define BPF_F_BEFORE (1U << 3) - #define BPF_F_AFTER (1U << 4) - #define BPF_F_ID (1U << 5) -+#define BPF_F_PREORDER (1U << 6) - #define BPF_F_LINK BPF_F_LINK /* 1 << 13 */ - - /* If BPF_F_STRICT_ALIGNMENT is used in BPF_PROG_LOAD command, the -diff --git a/include/uapi/linux/idxd.h b/include/uapi/linux/idxd.h -index 606b52e88ce335..3d1987e1bb2dd6 100644 ---- a/include/uapi/linux/idxd.h -+++ b/include/uapi/linux/idxd.h -@@ -31,6 +31,7 @@ enum idxd_scmd_stat { - IDXD_SCMD_WQ_IRQ_ERR = 0x80100000, - IDXD_SCMD_WQ_USER_NO_IOMMU = 0x80110000, - IDXD_SCMD_DEV_EVL_ERR = 0x80120000, -+ IDXD_SCMD_WQ_NO_DRV_NAME = 0x80200000, - }; - - #define IDXD_SCMD_SOFTERR_MASK 0x80000000 -diff --git a/include/ufs/ufs_quirks.h b/include/ufs/ufs_quirks.h -index 41ff44dfa1db3f..f52de5ed1b3b6e 100644 ---- a/include/ufs/ufs_quirks.h -+++ b/include/ufs/ufs_quirks.h -@@ -107,4 +107,10 @@ struct ufs_dev_quirk { - */ - #define UFS_DEVICE_QUIRK_DELAY_AFTER_LPM (1 << 11) - -+/* -+ * Some ufs devices may need more time to be in hibern8 before exiting. -+ * Enable this quirk to give it an additional 100us. -+ */ -+#define UFS_DEVICE_QUIRK_PA_HIBER8TIME (1 << 12) -+ - #endif /* UFS_QUIRKS_H_ */ -diff --git a/io_uring/fdinfo.c b/io_uring/fdinfo.c -index 976e9500f6518c..a26cf840e623d6 100644 ---- a/io_uring/fdinfo.c -+++ b/io_uring/fdinfo.c -@@ -81,11 +81,11 @@ __cold void io_uring_show_fdinfo(struct seq_file *m, struct file *f) - seq_printf(m, "SqMask:\t0x%x\n", sq_mask); - seq_printf(m, "SqHead:\t%u\n", sq_head); - seq_printf(m, "SqTail:\t%u\n", sq_tail); -- seq_printf(m, "CachedSqHead:\t%u\n", ctx->cached_sq_head); -+ seq_printf(m, "CachedSqHead:\t%u\n", data_race(ctx->cached_sq_head)); - seq_printf(m, "CqMask:\t0x%x\n", cq_mask); - seq_printf(m, "CqHead:\t%u\n", cq_head); - seq_printf(m, "CqTail:\t%u\n", cq_tail); -- seq_printf(m, "CachedCqTail:\t%u\n", ctx->cached_cq_tail); -+ seq_printf(m, "CachedCqTail:\t%u\n", data_race(ctx->cached_cq_tail)); - seq_printf(m, "SQEs:\t%u\n", sq_tail - sq_head); - sq_entries = min(sq_tail - sq_head, ctx->sq_entries); - for (i = 0; i < sq_entries; i++) { -diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c -index db592fa549b738..43b46098279a16 100644 ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -701,6 +701,7 @@ static void __io_cqring_overflow_flush(struct io_ring_ctx *ctx) - * to care for a non-real case. - */ - if (need_resched()) { -+ ctx->cqe_sentinel = ctx->cqe_cached; - io_cq_unlock_post(ctx); - mutex_unlock(&ctx->uring_lock); - cond_resched(); -diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c -index cf2eb0895d403c..684fb450ad086f 100644 ---- a/kernel/bpf/cgroup.c -+++ b/kernel/bpf/cgroup.c -@@ -369,7 +369,7 @@ static struct bpf_prog *prog_list_prog(struct bpf_prog_list *pl) - /* count number of elements in the list. - * it's slow but the list cannot be long - */ --static u32 prog_list_length(struct hlist_head *head) -+static u32 prog_list_length(struct hlist_head *head, int *preorder_cnt) - { - struct bpf_prog_list *pl; - u32 cnt = 0; -@@ -377,6 +377,8 @@ static u32 prog_list_length(struct hlist_head *head) - hlist_for_each_entry(pl, head, node) { - if (!prog_list_prog(pl)) - continue; -+ if (preorder_cnt && (pl->flags & BPF_F_PREORDER)) -+ (*preorder_cnt)++; - cnt++; - } - return cnt; -@@ -400,7 +402,7 @@ static bool hierarchy_allows_attach(struct cgroup *cgrp, - - if (flags & BPF_F_ALLOW_MULTI) - return true; -- cnt = prog_list_length(&p->bpf.progs[atype]); -+ cnt = prog_list_length(&p->bpf.progs[atype], NULL); - WARN_ON_ONCE(cnt > 1); - if (cnt == 1) - return !!(flags & BPF_F_ALLOW_OVERRIDE); -@@ -423,12 +425,12 @@ static int compute_effective_progs(struct cgroup *cgrp, - struct bpf_prog_array *progs; - struct bpf_prog_list *pl; - struct cgroup *p = cgrp; -- int cnt = 0; -+ int i, j, cnt = 0, preorder_cnt = 0, fstart, bstart, init_bstart; - - /* count number of effective programs by walking parents */ - do { - if (cnt == 0 || (p->bpf.flags[atype] & BPF_F_ALLOW_MULTI)) -- cnt += prog_list_length(&p->bpf.progs[atype]); -+ cnt += prog_list_length(&p->bpf.progs[atype], &preorder_cnt); - p = cgroup_parent(p); - } while (p); - -@@ -439,20 +441,34 @@ static int compute_effective_progs(struct cgroup *cgrp, - /* populate the array with effective progs */ - cnt = 0; - p = cgrp; -+ fstart = preorder_cnt; -+ bstart = preorder_cnt - 1; - do { - if (cnt > 0 && !(p->bpf.flags[atype] & BPF_F_ALLOW_MULTI)) - continue; - -+ init_bstart = bstart; - hlist_for_each_entry(pl, &p->bpf.progs[atype], node) { - if (!prog_list_prog(pl)) - continue; - -- item = &progs->items[cnt]; -+ if (pl->flags & BPF_F_PREORDER) { -+ item = &progs->items[bstart]; -+ bstart--; -+ } else { -+ item = &progs->items[fstart]; -+ fstart++; -+ } - item->prog = prog_list_prog(pl); - bpf_cgroup_storages_assign(item->cgroup_storage, - pl->storage); - cnt++; - } -+ -+ /* reverse pre-ordering progs at this cgroup level */ -+ for (i = bstart + 1, j = init_bstart; i < j; i++, j--) -+ swap(progs->items[i], progs->items[j]); -+ - } while ((p = cgroup_parent(p))); - - *array = progs; -@@ -663,7 +679,7 @@ static int __cgroup_bpf_attach(struct cgroup *cgrp, - */ - return -EPERM; - -- if (prog_list_length(progs) >= BPF_CGROUP_MAX_PROGS) -+ if (prog_list_length(progs, NULL) >= BPF_CGROUP_MAX_PROGS) - return -E2BIG; - - pl = find_attach_entry(progs, prog, link, replace_prog, -@@ -698,6 +714,7 @@ static int __cgroup_bpf_attach(struct cgroup *cgrp, - - pl->prog = prog; - pl->link = link; -+ pl->flags = flags; - bpf_cgroup_storages_assign(pl->storage, storage); - cgrp->bpf.flags[atype] = saved_flags; - -@@ -1073,7 +1090,7 @@ static int __cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr, - lockdep_is_held(&cgroup_mutex)); - total_cnt += bpf_prog_array_length(effective); - } else { -- total_cnt += prog_list_length(&cgrp->bpf.progs[atype]); -+ total_cnt += prog_list_length(&cgrp->bpf.progs[atype], NULL); - } - } - -@@ -1105,7 +1122,7 @@ static int __cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr, - u32 id; - - progs = &cgrp->bpf.progs[atype]; -- cnt = min_t(int, prog_list_length(progs), total_cnt); -+ cnt = min_t(int, prog_list_length(progs, NULL), total_cnt); - i = 0; - hlist_for_each_entry(pl, progs, node) { - prog = prog_list_prog(pl); -diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c -index fc34f72702cc40..8a3eadf17f785d 100644 ---- a/kernel/bpf/hashtab.c -+++ b/kernel/bpf/hashtab.c -@@ -2212,7 +2212,7 @@ static long bpf_for_each_hash_elem(struct bpf_map *map, bpf_callback_t callback_ - b = &htab->buckets[i]; - rcu_read_lock(); - head = &b->head; -- hlist_nulls_for_each_entry_rcu(elem, n, head, hash_node) { -+ hlist_nulls_for_each_entry_safe(elem, n, head, hash_node) { - key = elem->key; - if (is_percpu) { - /* current cpu value for percpu map */ -diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c -index f089a616301119..b66349f892f25e 100644 ---- a/kernel/bpf/syscall.c -+++ b/kernel/bpf/syscall.c -@@ -3900,7 +3900,8 @@ static int bpf_prog_attach_check_attach_type(const struct bpf_prog *prog, - #define BPF_F_ATTACH_MASK_BASE \ - (BPF_F_ALLOW_OVERRIDE | \ - BPF_F_ALLOW_MULTI | \ -- BPF_F_REPLACE) -+ BPF_F_REPLACE | \ -+ BPF_F_PREORDER) - - #define BPF_F_ATTACH_MASK_MPROG \ - (BPF_F_REPLACE | \ -@@ -4442,6 +4443,8 @@ static int bpf_prog_get_info_by_fd(struct file *file, - info.recursion_misses = stats.misses; - - info.verified_insns = prog->aux->verified_insns; -+ if (prog->aux->btf) -+ info.btf_id = btf_obj_id(prog->aux->btf); - - if (!bpf_capable()) { - info.jited_prog_len = 0; -@@ -4588,8 +4591,6 @@ static int bpf_prog_get_info_by_fd(struct file *file, - } - } - -- if (prog->aux->btf) -- info.btf_id = btf_obj_id(prog->aux->btf); - info.attach_btf_id = prog->aux->attach_btf_id; - if (attach_btf) - info.attach_btf_obj_id = btf_obj_id(attach_btf); -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index 756e179a1efe3e..1f9ae600e4455c 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -16014,12 +16014,16 @@ static void clean_verifier_state(struct bpf_verifier_env *env, - static void clean_live_states(struct bpf_verifier_env *env, int insn, - struct bpf_verifier_state *cur) - { -+ struct bpf_verifier_state *loop_entry; - struct bpf_verifier_state_list *sl; - - sl = *explored_state(env, insn); - while (sl) { - if (sl->state.branches) - goto next; -+ loop_entry = get_loop_entry(&sl->state); -+ if (loop_entry && loop_entry->branches) -+ goto next; - if (sl->state.insn_idx != insn || - !same_callsites(&sl->state, cur)) - goto next; -diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c -index 3ccf80dfa587a3..e8ef062f6ca058 100644 ---- a/kernel/cgroup/cgroup.c -+++ b/kernel/cgroup/cgroup.c -@@ -90,7 +90,7 @@ - DEFINE_MUTEX(cgroup_mutex); - DEFINE_SPINLOCK(css_set_lock); - --#ifdef CONFIG_PROVE_RCU -+#if (defined CONFIG_PROVE_RCU || defined CONFIG_LOCKDEP) - EXPORT_SYMBOL_GPL(cgroup_mutex); - EXPORT_SYMBOL_GPL(css_set_lock); - #endif -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 987807b1040ae0..5dd6424e62fa89 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -1163,6 +1163,12 @@ static void perf_assert_pmu_disabled(struct pmu *pmu) - WARN_ON_ONCE(*this_cpu_ptr(pmu->pmu_disable_count) == 0); - } - -+static inline void perf_pmu_read(struct perf_event *event) -+{ -+ if (event->state == PERF_EVENT_STATE_ACTIVE) -+ event->pmu->read(event); -+} -+ - static void get_ctx(struct perf_event_context *ctx) - { - refcount_inc(&ctx->refcount); -@@ -3397,8 +3403,7 @@ static void __perf_event_sync_stat(struct perf_event *event, - * we know the event must be on the current CPU, therefore we - * don't need to use it. - */ -- if (event->state == PERF_EVENT_STATE_ACTIVE) -- event->pmu->read(event); -+ perf_pmu_read(event); - - perf_event_update_time(event); - -@@ -4524,15 +4529,8 @@ static void __perf_event_read(void *info) - - pmu->read(event); - -- for_each_sibling_event(sub, event) { -- if (sub->state == PERF_EVENT_STATE_ACTIVE) { -- /* -- * Use sibling's PMU rather than @event's since -- * sibling could be on different (eg: software) PMU. -- */ -- sub->pmu->read(sub); -- } -- } -+ for_each_sibling_event(sub, event) -+ perf_pmu_read(sub); - - data->ret = pmu->commit_txn(pmu); - -@@ -7297,9 +7295,8 @@ static void perf_output_read_group(struct perf_output_handle *handle, - if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) - values[n++] = running; - -- if ((leader != event) && -- (leader->state == PERF_EVENT_STATE_ACTIVE)) -- leader->pmu->read(leader); -+ if ((leader != event) && !handle->skip_read) -+ perf_pmu_read(leader); - - values[n++] = perf_event_count(leader); - if (read_format & PERF_FORMAT_ID) -@@ -7312,9 +7309,8 @@ static void perf_output_read_group(struct perf_output_handle *handle, - for_each_sibling_event(sub, leader) { - n = 0; - -- if ((sub != event) && -- (sub->state == PERF_EVENT_STATE_ACTIVE)) -- sub->pmu->read(sub); -+ if ((sub != event) && !handle->skip_read) -+ perf_pmu_read(sub); - - values[n++] = perf_event_count(sub); - if (read_format & PERF_FORMAT_ID) -@@ -7369,6 +7365,9 @@ void perf_output_sample(struct perf_output_handle *handle, - { - u64 sample_type = data->type; - -+ if (data->sample_flags & PERF_SAMPLE_READ) -+ handle->skip_read = 1; -+ - perf_output_put(handle, *header); - - if (sample_type & PERF_SAMPLE_IDENTIFIER) -diff --git a/kernel/events/hw_breakpoint.c b/kernel/events/hw_breakpoint.c -index 6c2cb4e4f48dab..8f3f624419aa92 100644 ---- a/kernel/events/hw_breakpoint.c -+++ b/kernel/events/hw_breakpoint.c -@@ -950,9 +950,10 @@ static int hw_breakpoint_event_init(struct perf_event *bp) - return -ENOENT; - - /* -- * no branch sampling for breakpoint events -+ * Check if breakpoint type is supported before proceeding. -+ * Also, no branch sampling for breakpoint events. - */ -- if (has_branch_stack(bp)) -+ if (!hw_breakpoint_slots_cached(find_slot_idx(bp->attr.bp_type)) || has_branch_stack(bp)) - return -EOPNOTSUPP; - - err = register_perf_hw_breakpoint(bp); -diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c -index 52de76ef8723b8..dc1193b779c080 100644 ---- a/kernel/events/ring_buffer.c -+++ b/kernel/events/ring_buffer.c -@@ -181,6 +181,7 @@ __perf_output_begin(struct perf_output_handle *handle, - - handle->rb = rb; - handle->event = event; -+ handle->flags = 0; - - have_lost = local_read(&rb->lost); - if (unlikely(have_lost)) { -diff --git a/kernel/fork.c b/kernel/fork.c -index 97f433fb4b5ef4..7966c9a1c163d1 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -518,10 +518,6 @@ struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig) - vma_numab_state_init(new); - dup_anon_vma_name(orig, new); - -- /* track_pfn_copy() will later take care of copying internal state. */ -- if (unlikely(new->vm_flags & VM_PFNMAP)) -- untrack_pfn_clear(new); -- - return new; - } - -@@ -715,6 +711,11 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, - tmp = vm_area_dup(mpnt); - if (!tmp) - goto fail_nomem; -+ -+ /* track_pfn_copy() will later take care of copying internal state. */ -+ if (unlikely(tmp->vm_flags & VM_PFNMAP)) -+ untrack_pfn_clear(tmp); -+ - retval = vma_dup_policy(mpnt, tmp); - if (retval) - goto fail_nomem_policy; -diff --git a/kernel/padata.c b/kernel/padata.c -index 071d8cad807871..93cd7704ab63e6 100644 ---- a/kernel/padata.c -+++ b/kernel/padata.c -@@ -358,7 +358,8 @@ static void padata_reorder(struct parallel_data *pd) - * To avoid UAF issue, add pd ref here, and put pd ref after reorder_work finish. - */ - padata_get_pd(pd); -- queue_work(pinst->serial_wq, &pd->reorder_work); -+ if (!queue_work(pinst->serial_wq, &pd->reorder_work)) -+ padata_put_pd(pd); - } - } - -diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c -index dcdf449615bdac..51c43e0f9b29b5 100644 ---- a/kernel/printk/printk.c -+++ b/kernel/printk/printk.c -@@ -3119,7 +3119,12 @@ void console_unblank(void) - */ - cookie = console_srcu_read_lock(); - for_each_console_srcu(c) { -- if ((console_srcu_read_flags(c) & CON_ENABLED) && c->unblank) { -+ short flags = console_srcu_read_flags(c); -+ -+ if (flags & CON_SUSPENDED) -+ continue; -+ -+ if ((flags & CON_ENABLED) && c->unblank) { - found_unblank = true; - break; - } -@@ -3156,7 +3161,12 @@ void console_unblank(void) - - cookie = console_srcu_read_lock(); - for_each_console_srcu(c) { -- if ((console_srcu_read_flags(c) & CON_ENABLED) && c->unblank) -+ short flags = console_srcu_read_flags(c); -+ -+ if (flags & CON_SUSPENDED) -+ continue; -+ -+ if ((flags & CON_ENABLED) && c->unblank) - c->unblank(); - } - console_srcu_read_unlock(cookie); -diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h -index 41021080ad258d..94b715139f52d9 100644 ---- a/kernel/rcu/tree_plugin.h -+++ b/kernel/rcu/tree_plugin.h -@@ -821,8 +821,17 @@ void rcu_read_unlock_strict(void) - { - struct rcu_data *rdp; - -- if (irqs_disabled() || preempt_count() || !rcu_state.gp_kthread) -+ if (irqs_disabled() || in_atomic_preempt_off() || !rcu_state.gp_kthread) - return; -+ -+ /* -+ * rcu_report_qs_rdp() can only be invoked with a stable rdp and -+ * from the local CPU. -+ * -+ * The in_atomic_preempt_off() check ensures that we come here holding -+ * the last preempt_count (which will get dropped once we return to -+ * __rcu_read_unlock(). -+ */ - rdp = this_cpu_ptr(&rcu_data); - rdp->cpu_no_qs.b.norm = false; - rcu_report_qs_rdp(rdp); -@@ -963,13 +972,16 @@ static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp) - */ - static void rcu_flavor_sched_clock_irq(int user) - { -- if (user || rcu_is_cpu_rrupt_from_idle()) { -+ if (user || rcu_is_cpu_rrupt_from_idle() || -+ (IS_ENABLED(CONFIG_PREEMPT_COUNT) && -+ (preempt_count() == HARDIRQ_OFFSET))) { - - /* - * Get here if this CPU took its interrupt from user -- * mode or from the idle loop, and if this is not a -- * nested interrupt. In this case, the CPU is in -- * a quiescent state, so note it. -+ * mode, from the idle loop without this being a nested -+ * interrupt, or while not holding the task preempt count -+ * (with PREEMPT_COUNT=y). In this case, the CPU is in a -+ * quiescent state, so note it. - * - * No memory barrier is required here because rcu_qs() - * references only CPU-local variables that other CPUs -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 268e2a49b964e0..6ce3028e6e852f 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -73,10 +73,10 @@ unsigned int sysctl_sched_tunable_scaling = SCHED_TUNABLESCALING_LOG; - /* - * Minimal preemption granularity for CPU-bound tasks: - * -- * (default: 0.75 msec * (1 + ilog(ncpus)), units: nanoseconds) -+ * (default: 0.70 msec * (1 + ilog(ncpus)), units: nanoseconds) - */ --unsigned int sysctl_sched_base_slice = 750000ULL; --static unsigned int normalized_sysctl_sched_base_slice = 750000ULL; -+unsigned int sysctl_sched_base_slice = 700000ULL; -+static unsigned int normalized_sysctl_sched_base_slice = 700000ULL; - - /* - * After fork, child runs first. If set to 0 (default) then -diff --git a/kernel/softirq.c b/kernel/softirq.c -index f24d80cf20bd35..d9e37f3fa13039 100644 ---- a/kernel/softirq.c -+++ b/kernel/softirq.c -@@ -125,6 +125,18 @@ static DEFINE_PER_CPU(struct softirq_ctrl, softirq_ctrl) = { - .lock = INIT_LOCAL_LOCK(softirq_ctrl.lock), - }; - -+#ifdef CONFIG_DEBUG_LOCK_ALLOC -+static struct lock_class_key bh_lock_key; -+struct lockdep_map bh_lock_map = { -+ .name = "local_bh", -+ .key = &bh_lock_key, -+ .wait_type_outer = LD_WAIT_FREE, -+ .wait_type_inner = LD_WAIT_CONFIG, /* PREEMPT_RT makes BH preemptible. */ -+ .lock_type = LD_LOCK_PERCPU, -+}; -+EXPORT_SYMBOL_GPL(bh_lock_map); -+#endif -+ - /** - * local_bh_blocked() - Check for idle whether BH processing is blocked - * -@@ -147,6 +159,8 @@ void __local_bh_disable_ip(unsigned long ip, unsigned int cnt) - - WARN_ON_ONCE(in_hardirq()); - -+ lock_map_acquire_read(&bh_lock_map); -+ - /* First entry of a task into a BH disabled section? */ - if (!current->softirq_disable_cnt) { - if (preemptible()) { -@@ -210,6 +224,8 @@ void __local_bh_enable_ip(unsigned long ip, unsigned int cnt) - WARN_ON_ONCE(in_hardirq()); - lockdep_assert_irqs_enabled(); - -+ lock_map_release(&bh_lock_map); -+ - local_irq_save(flags); - curcnt = __this_cpu_read(softirq_ctrl.cnt); - -@@ -260,6 +276,8 @@ static inline void ksoftirqd_run_begin(void) - /* Counterpart to ksoftirqd_run_begin() */ - static inline void ksoftirqd_run_end(void) - { -+ /* pairs with the lock_map_acquire_read() in ksoftirqd_run_begin() */ -+ lock_map_release(&bh_lock_map); - __local_bh_enable(SOFTIRQ_OFFSET, true); - WARN_ON_ONCE(in_interrupt()); - local_irq_enable(); -diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c -index 877535b06e73aa..6d9da768604d68 100644 ---- a/kernel/time/hrtimer.c -+++ b/kernel/time/hrtimer.c -@@ -58,6 +58,8 @@ - #define HRTIMER_ACTIVE_SOFT (HRTIMER_ACTIVE_HARD << MASK_SHIFT) - #define HRTIMER_ACTIVE_ALL (HRTIMER_ACTIVE_SOFT | HRTIMER_ACTIVE_HARD) - -+static void retrigger_next_event(void *arg); -+ - /* - * The timer bases: - * -@@ -111,7 +113,8 @@ DEFINE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases) = - .clockid = CLOCK_TAI, - .get_time = &ktime_get_clocktai, - }, -- } -+ }, -+ .csd = CSD_INIT(retrigger_next_event, NULL) - }; - - static const int hrtimer_clock_to_base_table[MAX_CLOCKS] = { -@@ -124,6 +127,14 @@ static const int hrtimer_clock_to_base_table[MAX_CLOCKS] = { - [CLOCK_TAI] = HRTIMER_BASE_TAI, - }; - -+static inline bool hrtimer_base_is_online(struct hrtimer_cpu_base *base) -+{ -+ if (!IS_ENABLED(CONFIG_HOTPLUG_CPU)) -+ return true; -+ else -+ return likely(base->online); -+} -+ - /* - * Functions and macros which are different for UP/SMP systems are kept in a - * single place -@@ -178,27 +189,54 @@ struct hrtimer_clock_base *lock_hrtimer_base(const struct hrtimer *timer, - } - - /* -- * We do not migrate the timer when it is expiring before the next -- * event on the target cpu. When high resolution is enabled, we cannot -- * reprogram the target cpu hardware and we would cause it to fire -- * late. To keep it simple, we handle the high resolution enabled and -- * disabled case similar. -+ * Check if the elected target is suitable considering its next -+ * event and the hotplug state of the current CPU. -+ * -+ * If the elected target is remote and its next event is after the timer -+ * to queue, then a remote reprogram is necessary. However there is no -+ * guarantee the IPI handling the operation would arrive in time to meet -+ * the high resolution deadline. In this case the local CPU becomes a -+ * preferred target, unless it is offline. -+ * -+ * High and low resolution modes are handled the same way for simplicity. - * - * Called with cpu_base->lock of target cpu held. - */ --static int --hrtimer_check_target(struct hrtimer *timer, struct hrtimer_clock_base *new_base) -+static bool hrtimer_suitable_target(struct hrtimer *timer, struct hrtimer_clock_base *new_base, -+ struct hrtimer_cpu_base *new_cpu_base, -+ struct hrtimer_cpu_base *this_cpu_base) - { - ktime_t expires; - -+ /* -+ * The local CPU clockevent can be reprogrammed. Also get_target_base() -+ * guarantees it is online. -+ */ -+ if (new_cpu_base == this_cpu_base) -+ return true; -+ -+ /* -+ * The offline local CPU can't be the default target if the -+ * next remote target event is after this timer. Keep the -+ * elected new base. An IPI will we issued to reprogram -+ * it as a last resort. -+ */ -+ if (!hrtimer_base_is_online(this_cpu_base)) -+ return true; -+ - expires = ktime_sub(hrtimer_get_expires(timer), new_base->offset); -- return expires < new_base->cpu_base->expires_next; -+ -+ return expires >= new_base->cpu_base->expires_next; - } - --static inline --struct hrtimer_cpu_base *get_target_base(struct hrtimer_cpu_base *base, -- int pinned) -+static inline struct hrtimer_cpu_base *get_target_base(struct hrtimer_cpu_base *base, int pinned) - { -+ if (!hrtimer_base_is_online(base)) { -+ int cpu = cpumask_any_and(cpu_online_mask, housekeeping_cpumask(HK_TYPE_TIMER)); -+ -+ return &per_cpu(hrtimer_bases, cpu); -+ } -+ - #if defined(CONFIG_SMP) && defined(CONFIG_NO_HZ_COMMON) - if (static_branch_likely(&timers_migration_enabled) && !pinned) - return &per_cpu(hrtimer_bases, get_nohz_timer_target()); -@@ -249,8 +287,8 @@ switch_hrtimer_base(struct hrtimer *timer, struct hrtimer_clock_base *base, - raw_spin_unlock(&base->cpu_base->lock); - raw_spin_lock(&new_base->cpu_base->lock); - -- if (new_cpu_base != this_cpu_base && -- hrtimer_check_target(timer, new_base)) { -+ if (!hrtimer_suitable_target(timer, new_base, new_cpu_base, -+ this_cpu_base)) { - raw_spin_unlock(&new_base->cpu_base->lock); - raw_spin_lock(&base->cpu_base->lock); - new_cpu_base = this_cpu_base; -@@ -259,8 +297,7 @@ switch_hrtimer_base(struct hrtimer *timer, struct hrtimer_clock_base *base, - } - WRITE_ONCE(timer->base, new_base); - } else { -- if (new_cpu_base != this_cpu_base && -- hrtimer_check_target(timer, new_base)) { -+ if (!hrtimer_suitable_target(timer, new_base, new_cpu_base, this_cpu_base)) { - new_cpu_base = this_cpu_base; - goto again; - } -@@ -720,8 +757,6 @@ static inline int hrtimer_is_hres_enabled(void) - return hrtimer_hres_enabled; - } - --static void retrigger_next_event(void *arg); -- - /* - * Switch to high resolution mode - */ -@@ -1208,6 +1243,7 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, - u64 delta_ns, const enum hrtimer_mode mode, - struct hrtimer_clock_base *base) - { -+ struct hrtimer_cpu_base *this_cpu_base = this_cpu_ptr(&hrtimer_bases); - struct hrtimer_clock_base *new_base; - bool force_local, first; - -@@ -1219,9 +1255,15 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, - * and enforce reprogramming after it is queued no matter whether - * it is the new first expiring timer again or not. - */ -- force_local = base->cpu_base == this_cpu_ptr(&hrtimer_bases); -+ force_local = base->cpu_base == this_cpu_base; - force_local &= base->cpu_base->next_timer == timer; - -+ /* -+ * Don't force local queuing if this enqueue happens on a unplugged -+ * CPU after hrtimer_cpu_dying() has been invoked. -+ */ -+ force_local &= this_cpu_base->online; -+ - /* - * Remove an active timer from the queue. In case it is not queued - * on the current CPU, make sure that remove_hrtimer() updates the -@@ -1251,8 +1293,27 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, - } - - first = enqueue_hrtimer(timer, new_base, mode); -- if (!force_local) -- return first; -+ if (!force_local) { -+ /* -+ * If the current CPU base is online, then the timer is -+ * never queued on a remote CPU if it would be the first -+ * expiring timer there. -+ */ -+ if (hrtimer_base_is_online(this_cpu_base)) -+ return first; -+ -+ /* -+ * Timer was enqueued remote because the current base is -+ * already offline. If the timer is the first to expire, -+ * kick the remote CPU to reprogram the clock event. -+ */ -+ if (first) { -+ struct hrtimer_cpu_base *new_cpu_base = new_base->cpu_base; -+ -+ smp_call_function_single_async(new_cpu_base->cpu, &new_cpu_base->csd); -+ } -+ return 0; -+ } - - /* - * Timer was forced to stay on the current CPU to avoid -diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c -index b924f0f096fa44..7534069f603334 100644 ---- a/kernel/time/posix-timers.c -+++ b/kernel/time/posix-timers.c -@@ -118,6 +118,7 @@ static int posix_timer_add(struct k_itimer *timer) - return id; - } - spin_unlock(&hash_lock); -+ cond_resched(); - } - /* POSIX return code when no timer ID could be allocated */ - return -EAGAIN; -diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c -index ed7d6ad694fba6..20a5e6962b6967 100644 ---- a/kernel/time/timer_list.c -+++ b/kernel/time/timer_list.c -@@ -46,7 +46,7 @@ static void - print_timer(struct seq_file *m, struct hrtimer *taddr, struct hrtimer *timer, - int idx, u64 now) - { -- SEQ_printf(m, " #%d: <%pK>, %ps", idx, taddr, timer->function); -+ SEQ_printf(m, " #%d: <%p>, %ps", idx, taddr, timer->function); - SEQ_printf(m, ", S:%02x", timer->state); - SEQ_printf(m, "\n"); - SEQ_printf(m, " # expires at %Lu-%Lu nsecs [in %Ld to %Ld nsecs]\n", -@@ -98,7 +98,7 @@ print_active_timers(struct seq_file *m, struct hrtimer_clock_base *base, - static void - print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now) - { -- SEQ_printf(m, " .base: %pK\n", base); -+ SEQ_printf(m, " .base: %p\n", base); - SEQ_printf(m, " .index: %d\n", base->index); - - SEQ_printf(m, " .resolution: %u nsecs\n", hrtimer_resolution); -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 95868c31573007..43d19b69c635b2 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -3487,10 +3487,9 @@ int trace_vbprintk(unsigned long ip, const char *fmt, va_list args) - } - EXPORT_SYMBOL_GPL(trace_vbprintk); - --__printf(3, 0) --static int --__trace_array_vprintk(struct trace_buffer *buffer, -- unsigned long ip, const char *fmt, va_list args) -+static __printf(3, 0) -+int __trace_array_vprintk(struct trace_buffer *buffer, -+ unsigned long ip, const char *fmt, va_list args) - { - struct trace_event_call *call = &event_print; - struct ring_buffer_event *event; -@@ -3543,7 +3542,6 @@ __trace_array_vprintk(struct trace_buffer *buffer, - return len; - } - --__printf(3, 0) - int trace_array_vprintk(struct trace_array *tr, - unsigned long ip, const char *fmt, va_list args) - { -@@ -3573,7 +3571,6 @@ int trace_array_vprintk(struct trace_array *tr, - * Note, trace_array_init_printk() must be called on @tr before this - * can be used. - */ --__printf(3, 0) - int trace_array_printk(struct trace_array *tr, - unsigned long ip, const char *fmt, ...) - { -@@ -3618,7 +3615,6 @@ int trace_array_init_printk(struct trace_array *tr) - } - EXPORT_SYMBOL_GPL(trace_array_init_printk); - --__printf(3, 4) - int trace_array_printk_buf(struct trace_buffer *buffer, - unsigned long ip, const char *fmt, ...) - { -@@ -3634,7 +3630,6 @@ int trace_array_printk_buf(struct trace_buffer *buffer, - return ret; - } - --__printf(2, 0) - int trace_vprintk(unsigned long ip, const char *fmt, va_list args) - { - return trace_array_vprintk(&global_trace, ip, fmt, args); -diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h -index db0d2641125e7e..faf892aecdf490 100644 ---- a/kernel/trace/trace.h -+++ b/kernel/trace/trace.h -@@ -800,13 +800,15 @@ static inline void __init disable_tracing_selftest(const char *reason) - - extern void *head_page(struct trace_array_cpu *data); - extern unsigned long long ns2usecs(u64 nsec); --extern int --trace_vbprintk(unsigned long ip, const char *fmt, va_list args); --extern int --trace_vprintk(unsigned long ip, const char *fmt, va_list args); --extern int --trace_array_vprintk(struct trace_array *tr, -- unsigned long ip, const char *fmt, va_list args); -+ -+__printf(2, 0) -+int trace_vbprintk(unsigned long ip, const char *fmt, va_list args); -+__printf(2, 0) -+int trace_vprintk(unsigned long ip, const char *fmt, va_list args); -+__printf(3, 0) -+int trace_array_vprintk(struct trace_array *tr, -+ unsigned long ip, const char *fmt, va_list args); -+__printf(3, 4) - int trace_array_printk_buf(struct trace_buffer *buffer, - unsigned long ip, const char *fmt, ...); - void trace_printk_seq(struct trace_seq *s); -diff --git a/lib/dynamic_queue_limits.c b/lib/dynamic_queue_limits.c -index fde0aa24414800..a75a9ca46b5940 100644 ---- a/lib/dynamic_queue_limits.c -+++ b/lib/dynamic_queue_limits.c -@@ -116,7 +116,7 @@ EXPORT_SYMBOL(dql_completed); - void dql_reset(struct dql *dql) - { - /* Reset all dynamic values */ -- dql->limit = 0; -+ dql->limit = dql->min_limit; - dql->num_queued = 0; - dql->num_completed = 0; - dql->last_obj_cnt = 0; -diff --git a/lib/lzo/Makefile b/lib/lzo/Makefile -index 2f58fafbbdddc0..fc7b2b7ef4b20e 100644 ---- a/lib/lzo/Makefile -+++ b/lib/lzo/Makefile -@@ -1,5 +1,5 @@ - # SPDX-License-Identifier: GPL-2.0-only --lzo_compress-objs := lzo1x_compress.o -+lzo_compress-objs := lzo1x_compress.o lzo1x_compress_safe.o - lzo_decompress-objs := lzo1x_decompress_safe.o - - obj-$(CONFIG_LZO_COMPRESS) += lzo_compress.o -diff --git a/lib/lzo/lzo1x_compress.c b/lib/lzo/lzo1x_compress.c -index 9d31e7126606ac..f00dff9b9d4e1b 100644 ---- a/lib/lzo/lzo1x_compress.c -+++ b/lib/lzo/lzo1x_compress.c -@@ -18,11 +18,22 @@ - #include - #include "lzodefs.h" - --static noinline size_t --lzo1x_1_do_compress(const unsigned char *in, size_t in_len, -- unsigned char *out, size_t *out_len, -- size_t ti, void *wrkmem, signed char *state_offset, -- const unsigned char bitstream_version) -+#undef LZO_UNSAFE -+ -+#ifndef LZO_SAFE -+#define LZO_UNSAFE 1 -+#define LZO_SAFE(name) name -+#define HAVE_OP(x) 1 -+#endif -+ -+#define NEED_OP(x) if (!HAVE_OP(x)) goto output_overrun -+ -+static noinline int -+LZO_SAFE(lzo1x_1_do_compress)(const unsigned char *in, size_t in_len, -+ unsigned char **out, unsigned char *op_end, -+ size_t *tp, void *wrkmem, -+ signed char *state_offset, -+ const unsigned char bitstream_version) - { - const unsigned char *ip; - unsigned char *op; -@@ -30,8 +41,9 @@ lzo1x_1_do_compress(const unsigned char *in, size_t in_len, - const unsigned char * const ip_end = in + in_len - 20; - const unsigned char *ii; - lzo_dict_t * const dict = (lzo_dict_t *) wrkmem; -+ size_t ti = *tp; - -- op = out; -+ op = *out; - ip = in; - ii = ip; - ip += ti < 4 ? 4 - ti : 0; -@@ -116,25 +128,32 @@ lzo1x_1_do_compress(const unsigned char *in, size_t in_len, - if (t != 0) { - if (t <= 3) { - op[*state_offset] |= t; -+ NEED_OP(4); - COPY4(op, ii); - op += t; - } else if (t <= 16) { -+ NEED_OP(17); - *op++ = (t - 3); - COPY8(op, ii); - COPY8(op + 8, ii + 8); - op += t; - } else { - if (t <= 18) { -+ NEED_OP(1); - *op++ = (t - 3); - } else { - size_t tt = t - 18; -+ NEED_OP(1); - *op++ = 0; - while (unlikely(tt > 255)) { - tt -= 255; -+ NEED_OP(1); - *op++ = 0; - } -+ NEED_OP(1); - *op++ = tt; - } -+ NEED_OP(t); - do { - COPY8(op, ii); - COPY8(op + 8, ii + 8); -@@ -151,6 +170,7 @@ lzo1x_1_do_compress(const unsigned char *in, size_t in_len, - if (unlikely(run_length)) { - ip += run_length; - run_length -= MIN_ZERO_RUN_LENGTH; -+ NEED_OP(4); - put_unaligned_le32((run_length << 21) | 0xfffc18 - | (run_length & 0x7), op); - op += 4; -@@ -243,10 +263,12 @@ lzo1x_1_do_compress(const unsigned char *in, size_t in_len, - ip += m_len; - if (m_len <= M2_MAX_LEN && m_off <= M2_MAX_OFFSET) { - m_off -= 1; -+ NEED_OP(2); - *op++ = (((m_len - 1) << 5) | ((m_off & 7) << 2)); - *op++ = (m_off >> 3); - } else if (m_off <= M3_MAX_OFFSET) { - m_off -= 1; -+ NEED_OP(1); - if (m_len <= M3_MAX_LEN) - *op++ = (M3_MARKER | (m_len - 2)); - else { -@@ -254,14 +276,18 @@ lzo1x_1_do_compress(const unsigned char *in, size_t in_len, - *op++ = M3_MARKER | 0; - while (unlikely(m_len > 255)) { - m_len -= 255; -+ NEED_OP(1); - *op++ = 0; - } -+ NEED_OP(1); - *op++ = (m_len); - } -+ NEED_OP(2); - *op++ = (m_off << 2); - *op++ = (m_off >> 6); - } else { - m_off -= 0x4000; -+ NEED_OP(1); - if (m_len <= M4_MAX_LEN) - *op++ = (M4_MARKER | ((m_off >> 11) & 8) - | (m_len - 2)); -@@ -282,11 +308,14 @@ lzo1x_1_do_compress(const unsigned char *in, size_t in_len, - m_len -= M4_MAX_LEN; - *op++ = (M4_MARKER | ((m_off >> 11) & 8)); - while (unlikely(m_len > 255)) { -+ NEED_OP(1); - m_len -= 255; - *op++ = 0; - } -+ NEED_OP(1); - *op++ = (m_len); - } -+ NEED_OP(2); - *op++ = (m_off << 2); - *op++ = (m_off >> 6); - } -@@ -295,14 +324,20 @@ lzo1x_1_do_compress(const unsigned char *in, size_t in_len, - ii = ip; - goto next; - } -- *out_len = op - out; -- return in_end - (ii - ti); -+ *out = op; -+ *tp = in_end - (ii - ti); -+ return LZO_E_OK; -+ -+output_overrun: -+ return LZO_E_OUTPUT_OVERRUN; - } - --static int lzogeneric1x_1_compress(const unsigned char *in, size_t in_len, -- unsigned char *out, size_t *out_len, -- void *wrkmem, const unsigned char bitstream_version) -+static int LZO_SAFE(lzogeneric1x_1_compress)( -+ const unsigned char *in, size_t in_len, -+ unsigned char *out, size_t *out_len, -+ void *wrkmem, const unsigned char bitstream_version) - { -+ unsigned char * const op_end = out + *out_len; - const unsigned char *ip = in; - unsigned char *op = out; - unsigned char *data_start; -@@ -326,14 +361,18 @@ static int lzogeneric1x_1_compress(const unsigned char *in, size_t in_len, - while (l > 20) { - size_t ll = min_t(size_t, l, m4_max_offset + 1); - uintptr_t ll_end = (uintptr_t) ip + ll; -+ int err; -+ - if ((ll_end + ((t + ll) >> 5)) <= ll_end) - break; - BUILD_BUG_ON(D_SIZE * sizeof(lzo_dict_t) > LZO1X_1_MEM_COMPRESS); - memset(wrkmem, 0, D_SIZE * sizeof(lzo_dict_t)); -- t = lzo1x_1_do_compress(ip, ll, op, out_len, t, wrkmem, -- &state_offset, bitstream_version); -+ err = LZO_SAFE(lzo1x_1_do_compress)( -+ ip, ll, &op, op_end, &t, wrkmem, -+ &state_offset, bitstream_version); -+ if (err != LZO_E_OK) -+ return err; - ip += ll; -- op += *out_len; - l -= ll; - } - t += l; -@@ -342,20 +381,26 @@ static int lzogeneric1x_1_compress(const unsigned char *in, size_t in_len, - const unsigned char *ii = in + in_len - t; - - if (op == data_start && t <= 238) { -+ NEED_OP(1); - *op++ = (17 + t); - } else if (t <= 3) { - op[state_offset] |= t; - } else if (t <= 18) { -+ NEED_OP(1); - *op++ = (t - 3); - } else { - size_t tt = t - 18; -+ NEED_OP(1); - *op++ = 0; - while (tt > 255) { - tt -= 255; -+ NEED_OP(1); - *op++ = 0; - } -+ NEED_OP(1); - *op++ = tt; - } -+ NEED_OP(t); - if (t >= 16) do { - COPY8(op, ii); - COPY8(op + 8, ii + 8); -@@ -368,31 +413,38 @@ static int lzogeneric1x_1_compress(const unsigned char *in, size_t in_len, - } while (--t > 0); - } - -+ NEED_OP(3); - *op++ = M4_MARKER | 1; - *op++ = 0; - *op++ = 0; - - *out_len = op - out; - return LZO_E_OK; -+ -+output_overrun: -+ return LZO_E_OUTPUT_OVERRUN; - } - --int lzo1x_1_compress(const unsigned char *in, size_t in_len, -- unsigned char *out, size_t *out_len, -- void *wrkmem) -+int LZO_SAFE(lzo1x_1_compress)(const unsigned char *in, size_t in_len, -+ unsigned char *out, size_t *out_len, -+ void *wrkmem) - { -- return lzogeneric1x_1_compress(in, in_len, out, out_len, wrkmem, 0); -+ return LZO_SAFE(lzogeneric1x_1_compress)( -+ in, in_len, out, out_len, wrkmem, 0); - } - --int lzorle1x_1_compress(const unsigned char *in, size_t in_len, -- unsigned char *out, size_t *out_len, -- void *wrkmem) -+int LZO_SAFE(lzorle1x_1_compress)(const unsigned char *in, size_t in_len, -+ unsigned char *out, size_t *out_len, -+ void *wrkmem) - { -- return lzogeneric1x_1_compress(in, in_len, out, out_len, -- wrkmem, LZO_VERSION); -+ return LZO_SAFE(lzogeneric1x_1_compress)( -+ in, in_len, out, out_len, wrkmem, LZO_VERSION); - } - --EXPORT_SYMBOL_GPL(lzo1x_1_compress); --EXPORT_SYMBOL_GPL(lzorle1x_1_compress); -+EXPORT_SYMBOL_GPL(LZO_SAFE(lzo1x_1_compress)); -+EXPORT_SYMBOL_GPL(LZO_SAFE(lzorle1x_1_compress)); - -+#ifndef LZO_UNSAFE - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("LZO1X-1 Compressor"); -+#endif -diff --git a/lib/lzo/lzo1x_compress_safe.c b/lib/lzo/lzo1x_compress_safe.c -new file mode 100644 -index 00000000000000..371c9f84949281 ---- /dev/null -+++ b/lib/lzo/lzo1x_compress_safe.c -@@ -0,0 +1,18 @@ -+// SPDX-License-Identifier: GPL-2.0-only -+/* -+ * LZO1X Compressor from LZO -+ * -+ * Copyright (C) 1996-2012 Markus F.X.J. Oberhumer -+ * -+ * The full LZO package can be found at: -+ * http://www.oberhumer.com/opensource/lzo/ -+ * -+ * Changed for Linux kernel use by: -+ * Nitin Gupta -+ * Richard Purdie -+ */ -+ -+#define LZO_SAFE(name) name##_safe -+#define HAVE_OP(x) ((size_t)(op_end - op) >= (size_t)(x)) -+ -+#include "lzo1x_compress.c" -diff --git a/mm/memcontrol.c b/mm/memcontrol.c -index 9bf5a69e20d87a..2d2cada8a8a4c8 100644 ---- a/mm/memcontrol.c -+++ b/mm/memcontrol.c -@@ -1266,7 +1266,6 @@ void mem_cgroup_scan_tasks(struct mem_cgroup *memcg, - { - struct mem_cgroup *iter; - int ret = 0; -- int i = 0; - - BUG_ON(mem_cgroup_is_root(memcg)); - -@@ -1276,10 +1275,9 @@ void mem_cgroup_scan_tasks(struct mem_cgroup *memcg, - - css_task_iter_start(&iter->css, CSS_TASK_ITER_PROCS, &it); - while (!ret && (task = css_task_iter_next(&it))) { -- /* Avoid potential softlockup warning */ -- if ((++i & 1023) == 0) -- cond_resched(); - ret = fn(task, arg); -+ /* Avoid potential softlockup warning */ -+ cond_resched(); - } - css_task_iter_end(&it); - if (ret) { -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 74737c35082b45..44011ebecddf01 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -4038,6 +4038,14 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - } - - retry: -+ /* -+ * Deal with possible cpuset update races or zonelist updates to avoid -+ * infinite retries. -+ */ -+ if (check_retry_cpuset(cpuset_mems_cookie, ac) || -+ check_retry_zonelist(zonelist_iter_cookie)) -+ goto restart; -+ - /* Ensure kswapd doesn't accidentally go to sleep as long as we loop */ - if (alloc_flags & ALLOC_KSWAPD) - wake_all_kswapds(order, gfp_mask, ac); -diff --git a/net/Makefile b/net/Makefile -index 4c4dc535453dff..45f3fbaae644e1 100644 ---- a/net/Makefile -+++ b/net/Makefile -@@ -17,7 +17,7 @@ obj-$(CONFIG_NETFILTER) += netfilter/ - obj-$(CONFIG_INET) += ipv4/ - obj-$(CONFIG_TLS) += tls/ - obj-$(CONFIG_XFRM) += xfrm/ --obj-$(CONFIG_UNIX_SCM) += unix/ -+obj-$(CONFIG_UNIX) += unix/ - obj-y += ipv6/ - obj-$(CONFIG_BPFILTER) += bpfilter/ - obj-$(CONFIG_PACKET) += packet/ -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index 72ee41b894a520..1c54e812ef1f78 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -1411,7 +1411,8 @@ static void l2cap_request_info(struct l2cap_conn *conn) - sizeof(req), &req); - } - --static bool l2cap_check_enc_key_size(struct hci_conn *hcon) -+static bool l2cap_check_enc_key_size(struct hci_conn *hcon, -+ struct l2cap_chan *chan) - { - /* The minimum encryption key size needs to be enforced by the - * host stack before establishing any L2CAP connections. The -@@ -1425,7 +1426,7 @@ static bool l2cap_check_enc_key_size(struct hci_conn *hcon) - int min_key_size = hcon->hdev->min_enc_key_size; - - /* On FIPS security level, key size must be 16 bytes */ -- if (hcon->sec_level == BT_SECURITY_FIPS) -+ if (chan->sec_level == BT_SECURITY_FIPS) - min_key_size = 16; - - return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) || -@@ -1453,7 +1454,7 @@ static void l2cap_do_start(struct l2cap_chan *chan) - !__l2cap_no_conn_pending(chan)) - return; - -- if (l2cap_check_enc_key_size(conn->hcon)) -+ if (l2cap_check_enc_key_size(conn->hcon, chan)) - l2cap_start_connection(chan); - else - __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); -@@ -1528,7 +1529,7 @@ static void l2cap_conn_start(struct l2cap_conn *conn) - continue; - } - -- if (l2cap_check_enc_key_size(conn->hcon)) -+ if (l2cap_check_enc_key_size(conn->hcon, chan)) - l2cap_start_connection(chan); - else - l2cap_chan_close(chan, ECONNREFUSED); -@@ -3955,7 +3956,7 @@ static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, - /* Check if the ACL is secure enough (if not SDP) */ - if (psm != cpu_to_le16(L2CAP_PSM_SDP) && - (!hci_conn_check_link_mode(conn->hcon) || -- !l2cap_check_enc_key_size(conn->hcon))) { -+ !l2cap_check_enc_key_size(conn->hcon, pchan))) { - conn->disc_reason = HCI_ERROR_AUTH_FAILURE; - result = L2CAP_CR_SEC_BLOCK; - goto response; -@@ -7323,7 +7324,7 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) - } - - if (chan->state == BT_CONNECT) { -- if (!status && l2cap_check_enc_key_size(hcon)) -+ if (!status && l2cap_check_enc_key_size(hcon, chan)) - l2cap_start_connection(chan); - else - __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); -@@ -7333,7 +7334,7 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) - struct l2cap_conn_rsp rsp; - __u16 res, stat; - -- if (!status && l2cap_check_enc_key_size(hcon)) { -+ if (!status && l2cap_check_enc_key_size(hcon, chan)) { - if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { - res = L2CAP_CR_PEND; - stat = L2CAP_CS_AUTHOR_PEND; -diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c -index 7305f5f8215cac..96bea0c8408fec 100644 ---- a/net/bridge/br_mdb.c -+++ b/net/bridge/br_mdb.c -@@ -1030,7 +1030,7 @@ static int br_mdb_add_group(const struct br_mdb_config *cfg, - - /* host join */ - if (!port) { -- if (mp->host_joined) { -+ if (mp->host_joined && !(cfg->nlflags & NLM_F_REPLACE)) { - NL_SET_ERR_MSG_MOD(extack, "Group is already joined by host"); - return -EEXIST; - } -diff --git a/net/bridge/br_nf_core.c b/net/bridge/br_nf_core.c -index 98aea5485aaef4..a8c67035e23c00 100644 ---- a/net/bridge/br_nf_core.c -+++ b/net/bridge/br_nf_core.c -@@ -65,17 +65,14 @@ static struct dst_ops fake_dst_ops = { - * ipt_REJECT needs it. Future netfilter modules might - * require us to fill additional fields. - */ --static const u32 br_dst_default_metrics[RTAX_MAX] = { -- [RTAX_MTU - 1] = 1500, --}; -- - void br_netfilter_rtable_init(struct net_bridge *br) - { - struct rtable *rt = &br->fake_rtable; - - rcuref_init(&rt->dst.__rcuref, 1); - rt->dst.dev = br->dev; -- dst_init_metrics(&rt->dst, br_dst_default_metrics, true); -+ dst_init_metrics(&rt->dst, br->metrics, false); -+ dst_metric_set(&rt->dst, RTAX_MTU, br->dev->mtu); - rt->dst.flags = DST_NOXFRM | DST_FAKE_RTABLE; - rt->dst.ops = &fake_dst_ops; - } -diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h -index 72d80fd943a8a2..9197b511e45972 100644 ---- a/net/bridge/br_private.h -+++ b/net/bridge/br_private.h -@@ -502,6 +502,7 @@ struct net_bridge { - struct rtable fake_rtable; - struct rt6_info fake_rt6_info; - }; -+ u32 metrics[RTAX_MAX]; - #endif - u16 group_fwd_mask; - u16 group_fwd_mask_required; -diff --git a/net/can/bcm.c b/net/can/bcm.c -index a1f5db0fd5d4fd..75653584f31b94 100644 ---- a/net/can/bcm.c -+++ b/net/can/bcm.c -@@ -58,6 +58,7 @@ - #include - #include - #include -+#include - #include - #include - -@@ -120,6 +121,7 @@ struct bcm_op { - struct canfd_frame last_sframe; - struct sock *sk; - struct net_device *rx_reg_dev; -+ spinlock_t bcm_tx_lock; /* protect currframe/count in runtime updates */ - }; - - struct bcm_sock { -@@ -205,7 +207,9 @@ static int bcm_proc_show(struct seq_file *m, void *v) - seq_printf(m, " / bound %s", bcm_proc_getifname(net, ifname, bo->ifindex)); - seq_printf(m, " <<<\n"); - -- list_for_each_entry(op, &bo->rx_ops, list) { -+ rcu_read_lock(); -+ -+ list_for_each_entry_rcu(op, &bo->rx_ops, list) { - - unsigned long reduction; - -@@ -261,6 +265,9 @@ static int bcm_proc_show(struct seq_file *m, void *v) - seq_printf(m, "# sent %ld\n", op->frames_abs); - } - seq_putc(m, '\n'); -+ -+ rcu_read_unlock(); -+ - return 0; - } - #endif /* CONFIG_PROC_FS */ -@@ -273,13 +280,18 @@ static void bcm_can_tx(struct bcm_op *op) - { - struct sk_buff *skb; - struct net_device *dev; -- struct canfd_frame *cf = op->frames + op->cfsiz * op->currframe; -+ struct canfd_frame *cf; - int err; - - /* no target device? => exit */ - if (!op->ifindex) - return; - -+ /* read currframe under lock protection */ -+ spin_lock_bh(&op->bcm_tx_lock); -+ cf = op->frames + op->cfsiz * op->currframe; -+ spin_unlock_bh(&op->bcm_tx_lock); -+ - dev = dev_get_by_index(sock_net(op->sk), op->ifindex); - if (!dev) { - /* RFC: should this bcm_op remove itself here? */ -@@ -300,6 +312,10 @@ static void bcm_can_tx(struct bcm_op *op) - skb->dev = dev; - can_skb_set_owner(skb, op->sk); - err = can_send(skb, 1); -+ -+ /* update currframe and count under lock protection */ -+ spin_lock_bh(&op->bcm_tx_lock); -+ - if (!err) - op->frames_abs++; - -@@ -308,6 +324,11 @@ static void bcm_can_tx(struct bcm_op *op) - /* reached last frame? */ - if (op->currframe >= op->nframes) - op->currframe = 0; -+ -+ if (op->count > 0) -+ op->count--; -+ -+ spin_unlock_bh(&op->bcm_tx_lock); - out: - dev_put(dev); - } -@@ -404,7 +425,7 @@ static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer) - struct bcm_msg_head msg_head; - - if (op->kt_ival1 && (op->count > 0)) { -- op->count--; -+ bcm_can_tx(op); - if (!op->count && (op->flags & TX_COUNTEVT)) { - - /* create notification to user */ -@@ -419,7 +440,6 @@ static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer) - - bcm_send_to_user(op, &msg_head, NULL, 0); - } -- bcm_can_tx(op); - - } else if (op->kt_ival2) { - bcm_can_tx(op); -@@ -801,7 +821,7 @@ static int bcm_delete_rx_op(struct list_head *ops, struct bcm_msg_head *mh, - REGMASK(op->can_id), - bcm_rx_handler, op); - -- list_del(&op->list); -+ list_del_rcu(&op->list); - bcm_remove_op(op); - return 1; /* done */ - } -@@ -821,7 +841,7 @@ static int bcm_delete_tx_op(struct list_head *ops, struct bcm_msg_head *mh, - list_for_each_entry_safe(op, n, ops, list) { - if ((op->can_id == mh->can_id) && (op->ifindex == ifindex) && - (op->flags & CAN_FD_FRAME) == (mh->flags & CAN_FD_FRAME)) { -- list_del(&op->list); -+ list_del_rcu(&op->list); - bcm_remove_op(op); - return 1; /* done */ - } -@@ -914,6 +934,27 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, - } - op->flags = msg_head->flags; - -+ /* only lock for unlikely count/nframes/currframe changes */ -+ if (op->nframes != msg_head->nframes || -+ op->flags & TX_RESET_MULTI_IDX || -+ op->flags & SETTIMER) { -+ -+ spin_lock_bh(&op->bcm_tx_lock); -+ -+ if (op->nframes != msg_head->nframes || -+ op->flags & TX_RESET_MULTI_IDX) { -+ /* potentially update changed nframes */ -+ op->nframes = msg_head->nframes; -+ /* restart multiple frame transmission */ -+ op->currframe = 0; -+ } -+ -+ if (op->flags & SETTIMER) -+ op->count = msg_head->count; -+ -+ spin_unlock_bh(&op->bcm_tx_lock); -+ } -+ - } else { - /* insert new BCM operation for the given can_id */ - -@@ -921,9 +962,14 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, - if (!op) - return -ENOMEM; - -+ spin_lock_init(&op->bcm_tx_lock); - op->can_id = msg_head->can_id; - op->cfsiz = CFSIZ(msg_head->flags); - op->flags = msg_head->flags; -+ op->nframes = msg_head->nframes; -+ -+ if (op->flags & SETTIMER) -+ op->count = msg_head->count; - - /* create array for CAN frames and copy the data */ - if (msg_head->nframes > 1) { -@@ -982,22 +1028,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, - - } /* if ((op = bcm_find_op(&bo->tx_ops, msg_head->can_id, ifindex))) */ - -- if (op->nframes != msg_head->nframes) { -- op->nframes = msg_head->nframes; -- /* start multiple frame transmission with index 0 */ -- op->currframe = 0; -- } -- -- /* check flags */ -- -- if (op->flags & TX_RESET_MULTI_IDX) { -- /* start multiple frame transmission with index 0 */ -- op->currframe = 0; -- } -- - if (op->flags & SETTIMER) { - /* set timer values */ -- op->count = msg_head->count; - op->ival1 = msg_head->ival1; - op->ival2 = msg_head->ival2; - op->kt_ival1 = bcm_timeval_to_ktime(msg_head->ival1); -@@ -1014,11 +1046,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, - op->flags |= TX_ANNOUNCE; - } - -- if (op->flags & TX_ANNOUNCE) { -+ if (op->flags & TX_ANNOUNCE) - bcm_can_tx(op); -- if (op->count) -- op->count--; -- } - - if (op->flags & STARTTIMER) - bcm_tx_start_timer(op); -@@ -1234,7 +1263,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, - bcm_rx_handler, op, "bcm", sk); - if (err) { - /* this bcm rx op is broken -> remove it */ -- list_del(&op->list); -+ list_del_rcu(&op->list); - bcm_remove_op(op); - return err; - } -diff --git a/net/core/pktgen.c b/net/core/pktgen.c -index 359e24c3f22cab..6afea369ca2132 100644 ---- a/net/core/pktgen.c -+++ b/net/core/pktgen.c -@@ -897,6 +897,10 @@ static ssize_t get_labels(const char __user *buffer, struct pktgen_dev *pkt_dev) - pkt_dev->nr_labels = 0; - do { - __u32 tmp; -+ -+ if (n >= MAX_MPLS_LABELS) -+ return -E2BIG; -+ - len = hex32_arg(&buffer[i], 8, &tmp); - if (len <= 0) - return len; -@@ -908,8 +912,6 @@ static ssize_t get_labels(const char __user *buffer, struct pktgen_dev *pkt_dev) - return -EFAULT; - i++; - n++; -- if (n >= MAX_MPLS_LABELS) -- return -E2BIG; - } while (c == ','); - - pkt_dev->nr_labels = n; -@@ -1875,8 +1877,8 @@ static ssize_t pktgen_thread_write(struct file *file, - i = len; - - /* Read variable name */ -- -- len = strn_len(&user_buffer[i], sizeof(name) - 1); -+ max = min(sizeof(name) - 1, count - i); -+ len = strn_len(&user_buffer[i], max); - if (len < 0) - return len; - -@@ -1906,7 +1908,8 @@ static ssize_t pktgen_thread_write(struct file *file, - if (!strcmp(name, "add_device")) { - char f[32]; - memset(f, 0, 32); -- len = strn_len(&user_buffer[i], sizeof(f) - 1); -+ max = min(sizeof(f) - 1, count - i); -+ len = strn_len(&user_buffer[i], max); - if (len < 0) { - ret = len; - goto out; -diff --git a/net/core/scm.c b/net/core/scm.c -index 737917c7ac6276..431bfb3ea39290 100644 ---- a/net/core/scm.c -+++ b/net/core/scm.c -@@ -36,6 +36,7 @@ - #include - #include - #include -+#include - - - /* -@@ -85,8 +86,15 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) - return -ENOMEM; - *fplp = fpl; - fpl->count = 0; -+ fpl->count_unix = 0; - fpl->max = SCM_MAX_FD; - fpl->user = NULL; -+#if IS_ENABLED(CONFIG_UNIX) -+ fpl->inflight = false; -+ fpl->dead = false; -+ fpl->edges = NULL; -+ INIT_LIST_HEAD(&fpl->vertices); -+#endif - } - fpp = &fpl->fp[fpl->count]; - -@@ -109,6 +117,9 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) - fput(file); - return -EINVAL; - } -+ if (unix_get_socket(file)) -+ fpl->count_unix++; -+ - *fpp++ = file; - fpl->count++; - } -@@ -371,8 +382,14 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl) - if (new_fpl) { - for (i = 0; i < fpl->count; i++) - get_file(fpl->fp[i]); -+ - new_fpl->max = new_fpl->count; - new_fpl->user = get_uid(fpl->user); -+#if IS_ENABLED(CONFIG_UNIX) -+ new_fpl->inflight = false; -+ new_fpl->edges = NULL; -+ INIT_LIST_HEAD(&new_fpl->vertices); -+#endif - } - return new_fpl; - } -diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c -index eeace9b509cec7..49fd664f50fc01 100644 ---- a/net/ipv4/esp4.c -+++ b/net/ipv4/esp4.c -@@ -118,47 +118,16 @@ static void esp_ssg_unref(struct xfrm_state *x, void *tmp, struct sk_buff *skb) - } - - #ifdef CONFIG_INET_ESPINTCP --struct esp_tcp_sk { -- struct sock *sk; -- struct rcu_head rcu; --}; -- --static void esp_free_tcp_sk(struct rcu_head *head) --{ -- struct esp_tcp_sk *esk = container_of(head, struct esp_tcp_sk, rcu); -- -- sock_put(esk->sk); -- kfree(esk); --} -- - static struct sock *esp_find_tcp_sk(struct xfrm_state *x) - { - struct xfrm_encap_tmpl *encap = x->encap; - struct net *net = xs_net(x); -- struct esp_tcp_sk *esk; - __be16 sport, dport; -- struct sock *nsk; - struct sock *sk; - -- sk = rcu_dereference(x->encap_sk); -- if (sk && sk->sk_state == TCP_ESTABLISHED) -- return sk; -- - spin_lock_bh(&x->lock); - sport = encap->encap_sport; - dport = encap->encap_dport; -- nsk = rcu_dereference_protected(x->encap_sk, -- lockdep_is_held(&x->lock)); -- if (sk && sk == nsk) { -- esk = kmalloc(sizeof(*esk), GFP_ATOMIC); -- if (!esk) { -- spin_unlock_bh(&x->lock); -- return ERR_PTR(-ENOMEM); -- } -- RCU_INIT_POINTER(x->encap_sk, NULL); -- esk->sk = sk; -- call_rcu(&esk->rcu, esp_free_tcp_sk); -- } - spin_unlock_bh(&x->lock); - - sk = inet_lookup_established(net, net->ipv4.tcp_death_row.hashinfo, x->id.daddr.a4, -@@ -171,20 +140,6 @@ static struct sock *esp_find_tcp_sk(struct xfrm_state *x) - return ERR_PTR(-EINVAL); - } - -- spin_lock_bh(&x->lock); -- nsk = rcu_dereference_protected(x->encap_sk, -- lockdep_is_held(&x->lock)); -- if (encap->encap_sport != sport || -- encap->encap_dport != dport) { -- sock_put(sk); -- sk = nsk ?: ERR_PTR(-EREMCHG); -- } else if (sk == nsk) { -- sock_put(sk); -- } else { -- rcu_assign_pointer(x->encap_sk, sk); -- } -- spin_unlock_bh(&x->lock); -- - return sk; - } - -@@ -207,6 +162,8 @@ static int esp_output_tcp_finish(struct xfrm_state *x, struct sk_buff *skb) - err = espintcp_push_skb(sk, skb); - bh_unlock_sock(sk); - -+ sock_put(sk); -+ - out: - rcu_read_unlock(); - return err; -@@ -391,6 +348,8 @@ static struct ip_esp_hdr *esp_output_tcp_encap(struct xfrm_state *x, - if (IS_ERR(sk)) - return ERR_CAST(sk); - -+ sock_put(sk); -+ - *lenp = htons(len); - esph = (struct ip_esp_hdr *)(lenp + 1); - -diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c -index 90ce87ffed4617..7993ff46de23ca 100644 ---- a/net/ipv4/fib_frontend.c -+++ b/net/ipv4/fib_frontend.c -@@ -829,19 +829,33 @@ static int rtm_to_fib_config(struct net *net, struct sk_buff *skb, - } - } - -+ if (cfg->fc_dst_len > 32) { -+ NL_SET_ERR_MSG(extack, "Invalid prefix length"); -+ err = -EINVAL; -+ goto errout; -+ } -+ -+ if (cfg->fc_dst_len < 32 && (ntohl(cfg->fc_dst) << cfg->fc_dst_len)) { -+ NL_SET_ERR_MSG(extack, "Invalid prefix for given prefix length"); -+ err = -EINVAL; -+ goto errout; -+ } -+ - if (cfg->fc_nh_id) { - if (cfg->fc_oif || cfg->fc_gw_family || - cfg->fc_encap || cfg->fc_mp) { - NL_SET_ERR_MSG(extack, - "Nexthop specification and nexthop id are mutually exclusive"); -- return -EINVAL; -+ err = -EINVAL; -+ goto errout; - } - } - - if (has_gw && has_via) { - NL_SET_ERR_MSG(extack, - "Nexthop configuration can not contain both GATEWAY and VIA"); -- return -EINVAL; -+ err = -EINVAL; -+ goto errout; - } - - if (!cfg->fc_table) -diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c -index 513f475c6a534e..298a9944a3d1e8 100644 ---- a/net/ipv4/fib_rules.c -+++ b/net/ipv4/fib_rules.c -@@ -222,9 +222,9 @@ static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb, - struct nlattr **tb, - struct netlink_ext_ack *extack) - { -- struct net *net = sock_net(skb->sk); -+ struct fib4_rule *rule4 = (struct fib4_rule *)rule; -+ struct net *net = rule->fr_net; - int err = -EINVAL; -- struct fib4_rule *rule4 = (struct fib4_rule *) rule; - - if (!inet_validate_dscp(frh->tos)) { - NL_SET_ERR_MSG(extack, -diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c -index 77b97c48da5ea8..fa54b36b241ac0 100644 ---- a/net/ipv4/fib_trie.c -+++ b/net/ipv4/fib_trie.c -@@ -1192,22 +1192,6 @@ static int fib_insert_alias(struct trie *t, struct key_vector *tp, - return 0; - } - --static bool fib_valid_key_len(u32 key, u8 plen, struct netlink_ext_ack *extack) --{ -- if (plen > KEYLENGTH) { -- NL_SET_ERR_MSG(extack, "Invalid prefix length"); -- return false; -- } -- -- if ((plen < KEYLENGTH) && (key << plen)) { -- NL_SET_ERR_MSG(extack, -- "Invalid prefix for given prefix length"); -- return false; -- } -- -- return true; --} -- - static void fib_remove_alias(struct trie *t, struct key_vector *tp, - struct key_vector *l, struct fib_alias *old); - -@@ -1228,9 +1212,6 @@ int fib_table_insert(struct net *net, struct fib_table *tb, - - key = ntohl(cfg->fc_dst); - -- if (!fib_valid_key_len(key, plen, extack)) -- return -EINVAL; -- - pr_debug("Insert table=%u %08x/%d\n", tb->tb_id, key, plen); - - fi = fib_create_info(cfg, extack); -@@ -1723,9 +1704,6 @@ int fib_table_delete(struct net *net, struct fib_table *tb, - - key = ntohl(cfg->fc_dst); - -- if (!fib_valid_key_len(key, plen, extack)) -- return -EINVAL; -- - l = fib_find_node(t, &tp, key); - if (!l) - return -ESRCH; -diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c -index 7967ff7e02f794..60e81f6b1c6d4e 100644 ---- a/net/ipv4/inet_hashtables.c -+++ b/net/ipv4/inet_hashtables.c -@@ -1231,22 +1231,37 @@ int inet_ehash_locks_alloc(struct inet_hashinfo *hashinfo) - { - unsigned int locksz = sizeof(spinlock_t); - unsigned int i, nblocks = 1; -+ spinlock_t *ptr = NULL; - -- if (locksz != 0) { -- /* allocate 2 cache lines or at least one spinlock per cpu */ -- nblocks = max(2U * L1_CACHE_BYTES / locksz, 1U); -- nblocks = roundup_pow_of_two(nblocks * num_possible_cpus()); -+ if (locksz == 0) -+ goto set_mask; - -- /* no more locks than number of hash buckets */ -- nblocks = min(nblocks, hashinfo->ehash_mask + 1); -+ /* Allocate 2 cache lines or at least one spinlock per cpu. */ -+ nblocks = max(2U * L1_CACHE_BYTES / locksz, 1U) * num_possible_cpus(); - -- hashinfo->ehash_locks = kvmalloc_array(nblocks, locksz, GFP_KERNEL); -- if (!hashinfo->ehash_locks) -- return -ENOMEM; -+ /* At least one page per NUMA node. */ -+ nblocks = max(nblocks, num_online_nodes() * PAGE_SIZE / locksz); -+ -+ nblocks = roundup_pow_of_two(nblocks); -+ -+ /* No more locks than number of hash buckets. */ -+ nblocks = min(nblocks, hashinfo->ehash_mask + 1); - -- for (i = 0; i < nblocks; i++) -- spin_lock_init(&hashinfo->ehash_locks[i]); -+ if (num_online_nodes() > 1) { -+ /* Use vmalloc() to allow NUMA policy to spread pages -+ * on all available nodes if desired. -+ */ -+ ptr = vmalloc_array(nblocks, locksz); -+ } -+ if (!ptr) { -+ ptr = kvmalloc_array(nblocks, locksz, GFP_KERNEL); -+ if (!ptr) -+ return -ENOMEM; - } -+ for (i = 0; i < nblocks; i++) -+ spin_lock_init(&ptr[i]); -+ hashinfo->ehash_locks = ptr; -+set_mask: - hashinfo->ehash_locks_mask = nblocks - 1; - return 0; - } -diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c -index 890c15510b4210..f261e29adc7c2e 100644 ---- a/net/ipv4/ip_gre.c -+++ b/net/ipv4/ip_gre.c -@@ -140,7 +140,6 @@ static int ipgre_err(struct sk_buff *skb, u32 info, - const struct iphdr *iph; - const int type = icmp_hdr(skb)->type; - const int code = icmp_hdr(skb)->code; -- unsigned int data_len = 0; - struct ip_tunnel *t; - - if (tpi->proto == htons(ETH_P_TEB)) -@@ -181,7 +180,6 @@ static int ipgre_err(struct sk_buff *skb, u32 info, - case ICMP_TIME_EXCEEDED: - if (code != ICMP_EXC_TTL) - return 0; -- data_len = icmp_hdr(skb)->un.reserved[1] * 4; /* RFC 4884 4.1 */ - break; - - case ICMP_REDIRECT: -@@ -189,10 +187,16 @@ static int ipgre_err(struct sk_buff *skb, u32 info, - } - - #if IS_ENABLED(CONFIG_IPV6) -- if (tpi->proto == htons(ETH_P_IPV6) && -- !ip6_err_gen_icmpv6_unreach(skb, iph->ihl * 4 + tpi->hdr_len, -- type, data_len)) -- return 0; -+ if (tpi->proto == htons(ETH_P_IPV6)) { -+ unsigned int data_len = 0; -+ -+ if (type == ICMP_TIME_EXCEEDED) -+ data_len = icmp_hdr(skb)->un.reserved[1] * 4; /* RFC 4884 4.1 */ -+ -+ if (!ip6_err_gen_icmpv6_unreach(skb, iph->ihl * 4 + tpi->hdr_len, -+ type, data_len)) -+ return 0; -+ } - #endif - - if (t->parms.iph.daddr == 0 || -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index 10d38ec0ff5acd..a172248b667837 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -425,6 +425,20 @@ static bool tcp_ecn_rcv_ecn_echo(const struct tcp_sock *tp, const struct tcphdr - return false; - } - -+static void tcp_count_delivered_ce(struct tcp_sock *tp, u32 ecn_count) -+{ -+ tp->delivered_ce += ecn_count; -+} -+ -+/* Updates the delivered and delivered_ce counts */ -+static void tcp_count_delivered(struct tcp_sock *tp, u32 delivered, -+ bool ece_ack) -+{ -+ tp->delivered += delivered; -+ if (ece_ack) -+ tcp_count_delivered_ce(tp, delivered); -+} -+ - /* Buffer size and advertised window tuning. - * - * 1. Tuning sk->sk_sndbuf, when connection enters established state. -@@ -1137,15 +1151,6 @@ void tcp_mark_skb_lost(struct sock *sk, struct sk_buff *skb) - } - } - --/* Updates the delivered and delivered_ce counts */ --static void tcp_count_delivered(struct tcp_sock *tp, u32 delivered, -- bool ece_ack) --{ -- tp->delivered += delivered; -- if (ece_ack) -- tp->delivered_ce += delivered; --} -- - /* This procedure tags the retransmission queue when SACKs arrive. - * - * We have three tag bits: SACKED(S), RETRANS(R) and LOST(L). -@@ -3816,12 +3821,23 @@ static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag) - } - } - --static inline void tcp_in_ack_event(struct sock *sk, u32 flags) -+static void tcp_in_ack_event(struct sock *sk, int flag) - { - const struct inet_connection_sock *icsk = inet_csk(sk); - -- if (icsk->icsk_ca_ops->in_ack_event) -- icsk->icsk_ca_ops->in_ack_event(sk, flags); -+ if (icsk->icsk_ca_ops->in_ack_event) { -+ u32 ack_ev_flags = 0; -+ -+ if (flag & FLAG_WIN_UPDATE) -+ ack_ev_flags |= CA_ACK_WIN_UPDATE; -+ if (flag & FLAG_SLOWPATH) { -+ ack_ev_flags |= CA_ACK_SLOWPATH; -+ if (flag & FLAG_ECE) -+ ack_ev_flags |= CA_ACK_ECE; -+ } -+ -+ icsk->icsk_ca_ops->in_ack_event(sk, ack_ev_flags); -+ } - } - - /* Congestion control has updated the cwnd already. So if we're in -@@ -3938,12 +3954,8 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) - tcp_snd_una_update(tp, ack); - flag |= FLAG_WIN_UPDATE; - -- tcp_in_ack_event(sk, CA_ACK_WIN_UPDATE); -- - NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPHPACKS); - } else { -- u32 ack_ev_flags = CA_ACK_SLOWPATH; -- - if (ack_seq != TCP_SKB_CB(skb)->end_seq) - flag |= FLAG_DATA; - else -@@ -3955,19 +3967,12 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) - flag |= tcp_sacktag_write_queue(sk, skb, prior_snd_una, - &sack_state); - -- if (tcp_ecn_rcv_ecn_echo(tp, tcp_hdr(skb))) { -+ if (tcp_ecn_rcv_ecn_echo(tp, tcp_hdr(skb))) - flag |= FLAG_ECE; -- ack_ev_flags |= CA_ACK_ECE; -- } - - if (sack_state.sack_delivered) - tcp_count_delivered(tp, sack_state.sack_delivered, - flag & FLAG_ECE); -- -- if (flag & FLAG_WIN_UPDATE) -- ack_ev_flags |= CA_ACK_WIN_UPDATE; -- -- tcp_in_ack_event(sk, ack_ev_flags); - } - - /* This is a deviation from RFC3168 since it states that: -@@ -3994,6 +3999,8 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) - - tcp_rack_update_reo_wnd(sk, &rs); - -+ tcp_in_ack_event(sk, flag); -+ - if (tp->tlp_high_seq) - tcp_process_tlp_ack(sk, ack, flag); - -@@ -4025,6 +4032,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) - return 1; - - no_queue: -+ tcp_in_ack_event(sk, flag); - /* If data was DSACKed, see if we can undo a cwnd reduction. */ - if (flag & FLAG_DSACKING_ACK) { - tcp_fastretrans_alert(sk, prior_snd_una, num_dupack, &flag, -diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c -index 62bb9651133c4d..7e4c8628cf9835 100644 ---- a/net/ipv6/esp6.c -+++ b/net/ipv6/esp6.c -@@ -135,47 +135,16 @@ static void esp_ssg_unref(struct xfrm_state *x, void *tmp, struct sk_buff *skb) - } - - #ifdef CONFIG_INET6_ESPINTCP --struct esp_tcp_sk { -- struct sock *sk; -- struct rcu_head rcu; --}; -- --static void esp_free_tcp_sk(struct rcu_head *head) --{ -- struct esp_tcp_sk *esk = container_of(head, struct esp_tcp_sk, rcu); -- -- sock_put(esk->sk); -- kfree(esk); --} -- - static struct sock *esp6_find_tcp_sk(struct xfrm_state *x) - { - struct xfrm_encap_tmpl *encap = x->encap; - struct net *net = xs_net(x); -- struct esp_tcp_sk *esk; - __be16 sport, dport; -- struct sock *nsk; - struct sock *sk; - -- sk = rcu_dereference(x->encap_sk); -- if (sk && sk->sk_state == TCP_ESTABLISHED) -- return sk; -- - spin_lock_bh(&x->lock); - sport = encap->encap_sport; - dport = encap->encap_dport; -- nsk = rcu_dereference_protected(x->encap_sk, -- lockdep_is_held(&x->lock)); -- if (sk && sk == nsk) { -- esk = kmalloc(sizeof(*esk), GFP_ATOMIC); -- if (!esk) { -- spin_unlock_bh(&x->lock); -- return ERR_PTR(-ENOMEM); -- } -- RCU_INIT_POINTER(x->encap_sk, NULL); -- esk->sk = sk; -- call_rcu(&esk->rcu, esp_free_tcp_sk); -- } - spin_unlock_bh(&x->lock); - - sk = __inet6_lookup_established(net, net->ipv4.tcp_death_row.hashinfo, &x->id.daddr.in6, -@@ -188,20 +157,6 @@ static struct sock *esp6_find_tcp_sk(struct xfrm_state *x) - return ERR_PTR(-EINVAL); - } - -- spin_lock_bh(&x->lock); -- nsk = rcu_dereference_protected(x->encap_sk, -- lockdep_is_held(&x->lock)); -- if (encap->encap_sport != sport || -- encap->encap_dport != dport) { -- sock_put(sk); -- sk = nsk ?: ERR_PTR(-EREMCHG); -- } else if (sk == nsk) { -- sock_put(sk); -- } else { -- rcu_assign_pointer(x->encap_sk, sk); -- } -- spin_unlock_bh(&x->lock); -- - return sk; - } - -@@ -224,6 +179,8 @@ static int esp_output_tcp_finish(struct xfrm_state *x, struct sk_buff *skb) - err = espintcp_push_skb(sk, skb); - bh_unlock_sock(sk); - -+ sock_put(sk); -+ - out: - rcu_read_unlock(); - return err; -@@ -427,6 +384,8 @@ static struct ip_esp_hdr *esp6_output_tcp_encap(struct xfrm_state *x, - if (IS_ERR(sk)) - return ERR_CAST(sk); - -+ sock_put(sk); -+ - *lenp = htons(len); - esph = (struct ip_esp_hdr *)(lenp + 1); - -diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c -index 6eeab21512ba98..e0f0c5f8cccdaa 100644 ---- a/net/ipv6/fib6_rules.c -+++ b/net/ipv6/fib6_rules.c -@@ -350,9 +350,9 @@ static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb, - struct nlattr **tb, - struct netlink_ext_ack *extack) - { -+ struct fib6_rule *rule6 = (struct fib6_rule *)rule; -+ struct net *net = rule->fr_net; - int err = -EINVAL; -- struct net *net = sock_net(skb->sk); -- struct fib6_rule *rule6 = (struct fib6_rule *) rule; - - if (!inet_validate_dscp(frh->tos)) { - NL_SET_ERR_MSG(extack, -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index c86d5dca29df01..28777b14224048 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -1452,6 +1452,7 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork, - } - v6_cork->hop_limit = ipc6->hlimit; - v6_cork->tclass = ipc6->tclass; -+ v6_cork->dontfrag = ipc6->dontfrag; - if (rt->dst.flags & DST_XFRM_TUNNEL) - mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ? - READ_ONCE(rt->dst.dev->mtu) : dst_mtu(&rt->dst); -@@ -1485,7 +1486,7 @@ static int __ip6_append_data(struct sock *sk, - int getfrag(void *from, char *to, int offset, - int len, int odd, struct sk_buff *skb), - void *from, size_t length, int transhdrlen, -- unsigned int flags, struct ipcm6_cookie *ipc6) -+ unsigned int flags) - { - struct sk_buff *skb, *skb_prev = NULL; - struct inet_cork *cork = &cork_full->base; -@@ -1541,7 +1542,7 @@ static int __ip6_append_data(struct sock *sk, - if (headersize + transhdrlen > mtu) - goto emsgsize; - -- if (cork->length + length > mtu - headersize && ipc6->dontfrag && -+ if (cork->length + length > mtu - headersize && v6_cork->dontfrag && - (sk->sk_protocol == IPPROTO_UDP || - sk->sk_protocol == IPPROTO_ICMPV6 || - sk->sk_protocol == IPPROTO_RAW)) { -@@ -1913,7 +1914,7 @@ int ip6_append_data(struct sock *sk, - - return __ip6_append_data(sk, &sk->sk_write_queue, &inet->cork, - &np->cork, sk_page_frag(sk), getfrag, -- from, length, transhdrlen, flags, ipc6); -+ from, length, transhdrlen, flags); - } - EXPORT_SYMBOL_GPL(ip6_append_data); - -@@ -2118,7 +2119,7 @@ struct sk_buff *ip6_make_skb(struct sock *sk, - err = __ip6_append_data(sk, &queue, cork, &v6_cork, - ¤t->task_frag, getfrag, from, - length + exthdrlen, transhdrlen + exthdrlen, -- flags, ipc6); -+ flags); - if (err) { - __ip6_flush_pending_frames(sk, &queue, cork, &v6_cork); - return ERR_PTR(err); -diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c -index cc25fec44f8502..19f3de3c24ef1c 100644 ---- a/net/llc/af_llc.c -+++ b/net/llc/af_llc.c -@@ -888,15 +888,15 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, - if (sk->sk_type != SOCK_STREAM) - goto copy_uaddr; - -+ /* Partial read */ -+ if (used + offset < skb_len) -+ continue; -+ - if (!(flags & MSG_PEEK)) { - skb_unlink(skb, &sk->sk_receive_queue); - kfree_skb(skb); - *seq = 0; - } -- -- /* Partial read */ -- if (used + offset < skb_len) -- continue; - } while (len > 0); - - out: -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index 42e2c84ed2484a..2c7e139efd532f 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -2959,7 +2959,8 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata, - if (tx) - ieee80211_flush_queues(local, sdata, false); - -- drv_mgd_complete_tx(sdata->local, sdata, &info); -+ if (tx || frame_buf) -+ drv_mgd_complete_tx(sdata->local, sdata, &info); - - /* clear AP addr only after building the needed mgmt frames */ - eth_zero_addr(sdata->deflink.u.mgd.bssid); -@@ -7821,7 +7822,6 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata, - ieee80211_report_disconnect(sdata, frame_buf, - sizeof(frame_buf), true, - req->reason_code, false); -- drv_mgd_complete_tx(sdata->local, sdata, &info); - return 0; - } - -diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c -index 559665467b04dd..1d5de1d9f008d8 100644 ---- a/net/netfilter/nf_conntrack_standalone.c -+++ b/net/netfilter/nf_conntrack_standalone.c -@@ -621,7 +621,9 @@ static struct ctl_table nf_ct_sysctl_table[] = { - .data = &nf_conntrack_max, - .maxlen = sizeof(int), - .mode = 0644, -- .proc_handler = proc_dointvec, -+ .proc_handler = proc_dointvec_minmax, -+ .extra1 = SYSCTL_ZERO, -+ .extra2 = SYSCTL_INT_MAX, - }, - [NF_SYSCTL_CT_COUNT] = { - .procname = "nf_conntrack_count", -@@ -657,7 +659,9 @@ static struct ctl_table nf_ct_sysctl_table[] = { - .data = &nf_ct_expect_max, - .maxlen = sizeof(int), - .mode = 0644, -- .proc_handler = proc_dointvec, -+ .proc_handler = proc_dointvec_minmax, -+ .extra1 = SYSCTL_ONE, -+ .extra2 = SYSCTL_INT_MAX, - }, - [NF_SYSCTL_CT_ACCT] = { - .procname = "nf_conntrack_acct", -@@ -951,7 +955,9 @@ static struct ctl_table nf_ct_netfilter_table[] = { - .data = &nf_conntrack_max, - .maxlen = sizeof(int), - .mode = 0644, -- .proc_handler = proc_dointvec, -+ .proc_handler = proc_dointvec_minmax, -+ .extra1 = SYSCTL_ZERO, -+ .extra2 = SYSCTL_INT_MAX, - }, - { } - }; -diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c -index 5d9cccfac4a155..afcb83d469ff60 100644 ---- a/net/sched/sch_hfsc.c -+++ b/net/sched/sch_hfsc.c -@@ -175,6 +175,11 @@ struct hfsc_sched { - - #define HT_INFINITY 0xffffffffffffffffULL /* infinite time value */ - -+static bool cl_in_el_or_vttree(struct hfsc_class *cl) -+{ -+ return ((cl->cl_flags & HFSC_FSC) && cl->cl_nactive) || -+ ((cl->cl_flags & HFSC_RSC) && !RB_EMPTY_NODE(&cl->el_node)); -+} - - /* - * eligible tree holds backlogged classes being sorted by their eligible times. -@@ -1040,6 +1045,8 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid, - if (cl == NULL) - return -ENOBUFS; - -+ RB_CLEAR_NODE(&cl->el_node); -+ - err = tcf_block_get(&cl->block, &cl->filter_list, sch, extack); - if (err) { - kfree(cl); -@@ -1570,7 +1577,10 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free) - return err; - } - -- if (first && !cl->cl_nactive) { -+ sch->qstats.backlog += len; -+ sch->q.qlen++; -+ -+ if (first && !cl_in_el_or_vttree(cl)) { - if (cl->cl_flags & HFSC_RSC) - init_ed(cl, len); - if (cl->cl_flags & HFSC_FSC) -@@ -1585,9 +1595,6 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free) - - } - -- sch->qstats.backlog += len; -- sch->q.qlen++; -- - return NET_XMIT_SUCCESS; - } - -diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c -index dbcc72b43d0c08..d44d7f427fc948 100644 ---- a/net/smc/smc_pnet.c -+++ b/net/smc/smc_pnet.c -@@ -1084,14 +1084,16 @@ static void smc_pnet_find_roce_by_pnetid(struct net_device *ndev, - struct smc_init_info *ini) - { - u8 ndev_pnetid[SMC_MAX_PNETID_LEN]; -+ struct net_device *base_ndev; - struct net *net; - -- ndev = pnet_find_base_ndev(ndev); -+ base_ndev = pnet_find_base_ndev(ndev); - net = dev_net(ndev); -- if (smc_pnetid_by_dev_port(ndev->dev.parent, ndev->dev_port, -+ if (smc_pnetid_by_dev_port(base_ndev->dev.parent, base_ndev->dev_port, - ndev_pnetid) && -+ smc_pnet_find_ndev_pnetid_by_table(base_ndev, ndev_pnetid) && - smc_pnet_find_ndev_pnetid_by_table(ndev, ndev_pnetid)) { -- smc_pnet_find_rdma_dev(ndev, ini); -+ smc_pnet_find_rdma_dev(base_ndev, ini); - return; /* pnetid could not be determined */ - } - _smc_pnet_find_roce_by_pnetid(ndev_pnetid, ini, NULL, net); -diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c -index 142ee6554848a6..4ffb2bcaf3648e 100644 ---- a/net/sunrpc/clnt.c -+++ b/net/sunrpc/clnt.c -@@ -275,9 +275,6 @@ static struct rpc_xprt *rpc_clnt_set_transport(struct rpc_clnt *clnt, - old = rcu_dereference_protected(clnt->cl_xprt, - lockdep_is_held(&clnt->cl_lock)); - -- if (!xprt_bound(xprt)) -- clnt->cl_autobind = 1; -- - clnt->cl_timeout = timeout; - rcu_assign_pointer(clnt->cl_xprt, xprt); - spin_unlock(&clnt->cl_lock); -diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c -index 102c3818bc54d4..53bcca365fb1cd 100644 ---- a/net/sunrpc/rpcb_clnt.c -+++ b/net/sunrpc/rpcb_clnt.c -@@ -820,9 +820,10 @@ static void rpcb_getport_done(struct rpc_task *child, void *data) - } - - trace_rpcb_setport(child, map->r_status, map->r_port); -- xprt->ops->set_port(xprt, map->r_port); -- if (map->r_port) -+ if (map->r_port) { -+ xprt->ops->set_port(xprt, map->r_port); - xprt_set_bound(xprt); -+ } - } - - /* -diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c -index 9b45fbdc90cabe..73bc39281ef5f5 100644 ---- a/net/sunrpc/sched.c -+++ b/net/sunrpc/sched.c -@@ -276,6 +276,8 @@ EXPORT_SYMBOL_GPL(rpc_destroy_wait_queue); - - static int rpc_wait_bit_killable(struct wait_bit_key *key, int mode) - { -+ if (unlikely(current->flags & PF_EXITING)) -+ return -EINTR; - schedule(); - if (signal_pending_state(mode, current)) - return -ERESTARTSYS; -diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c -index c524421ec65252..8584893b478510 100644 ---- a/net/tipc/crypto.c -+++ b/net/tipc/crypto.c -@@ -817,12 +817,16 @@ static int tipc_aead_encrypt(struct tipc_aead *aead, struct sk_buff *skb, - goto exit; - } - -+ /* Get net to avoid freed tipc_crypto when delete namespace */ -+ get_net(aead->crypto->net); -+ - /* Now, do encrypt */ - rc = crypto_aead_encrypt(req); - if (rc == -EINPROGRESS || rc == -EBUSY) - return rc; - - tipc_bearer_put(b); -+ put_net(aead->crypto->net); - - exit: - kfree(ctx); -@@ -860,6 +864,7 @@ static void tipc_aead_encrypt_done(void *data, int err) - kfree(tx_ctx); - tipc_bearer_put(b); - tipc_aead_put(aead); -+ put_net(net); - } - - /** -diff --git a/net/unix/Kconfig b/net/unix/Kconfig -index 28b232f281ab16..8b5d04210d7cf1 100644 ---- a/net/unix/Kconfig -+++ b/net/unix/Kconfig -@@ -16,11 +16,6 @@ config UNIX - - Say Y unless you know what you are doing. - --config UNIX_SCM -- bool -- depends on UNIX -- default y -- - config AF_UNIX_OOB - bool - depends on UNIX -diff --git a/net/unix/Makefile b/net/unix/Makefile -index 20491825b4d0da..4ddd125c4642c7 100644 ---- a/net/unix/Makefile -+++ b/net/unix/Makefile -@@ -11,5 +11,3 @@ unix-$(CONFIG_BPF_SYSCALL) += unix_bpf.o - - obj-$(CONFIG_UNIX_DIAG) += unix_diag.o - unix_diag-y := diag.o -- --obj-$(CONFIG_UNIX_SCM) += scm.o -diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index ab23c8d72122b2..236a2cd2bc93d2 100644 ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -117,8 +117,6 @@ - #include - #include - --#include "scm.h" -- - static atomic_long_t unix_nr_socks; - static struct hlist_head bsd_socket_buckets[UNIX_HASH_SIZE / 2]; - static spinlock_t bsd_socket_locks[UNIX_HASH_SIZE / 2]; -@@ -980,11 +978,11 @@ static struct sock *unix_create1(struct net *net, struct socket *sock, int kern, - sk->sk_max_ack_backlog = READ_ONCE(net->unx.sysctl_max_dgram_qlen); - sk->sk_destruct = unix_sock_destructor; - u = unix_sk(sk); -- u->inflight = 0; -+ u->listener = NULL; -+ u->vertex = NULL; - u->path.dentry = NULL; - u->path.mnt = NULL; - spin_lock_init(&u->lock); -- INIT_LIST_HEAD(&u->link); - mutex_init(&u->iolock); /* single task reading lock */ - mutex_init(&u->bindlock); /* single task binding lock */ - init_waitqueue_head(&u->peer_wait); -@@ -1583,6 +1581,7 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr, - newsk->sk_type = sk->sk_type; - init_peercred(newsk); - newu = unix_sk(newsk); -+ newu->listener = other; - RCU_INIT_POINTER(newsk->sk_wq, &newu->peer_wq); - otheru = unix_sk(other); - -@@ -1678,8 +1677,8 @@ static int unix_accept(struct socket *sock, struct socket *newsock, int flags, - bool kern) - { - struct sock *sk = sock->sk; -- struct sock *tsk; - struct sk_buff *skb; -+ struct sock *tsk; - int err; - - err = -EOPNOTSUPP; -@@ -1709,6 +1708,7 @@ static int unix_accept(struct socket *sock, struct socket *newsock, int flags, - - /* attach accepted sock to socket */ - unix_state_lock(tsk); -+ unix_update_edges(unix_sk(tsk)); - newsock->state = SS_CONNECTED; - unix_sock_inherit_flags(sock, newsock); - sock_graft(tsk, newsock); -@@ -1752,51 +1752,65 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int peer) - return err; - } - -+/* The "user->unix_inflight" variable is protected by the garbage -+ * collection lock, and we just read it locklessly here. If you go -+ * over the limit, there might be a tiny race in actually noticing -+ * it across threads. Tough. -+ */ -+static inline bool too_many_unix_fds(struct task_struct *p) -+{ -+ struct user_struct *user = current_user(); -+ -+ if (unlikely(READ_ONCE(user->unix_inflight) > task_rlimit(p, RLIMIT_NOFILE))) -+ return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN); -+ return false; -+} -+ -+static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) -+{ -+ if (too_many_unix_fds(current)) -+ return -ETOOMANYREFS; -+ -+ /* Need to duplicate file references for the sake of garbage -+ * collection. Otherwise a socket in the fps might become a -+ * candidate for GC while the skb is not yet queued. -+ */ -+ UNIXCB(skb).fp = scm_fp_dup(scm->fp); -+ if (!UNIXCB(skb).fp) -+ return -ENOMEM; -+ -+ if (unix_prepare_fpl(UNIXCB(skb).fp)) -+ return -ENOMEM; -+ -+ return 0; -+} -+ -+static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb) -+{ -+ scm->fp = UNIXCB(skb).fp; -+ UNIXCB(skb).fp = NULL; -+ -+ unix_destroy_fpl(scm->fp); -+} -+ - static void unix_peek_fds(struct scm_cookie *scm, struct sk_buff *skb) - { - scm->fp = scm_fp_dup(UNIXCB(skb).fp); -+} - -- /* -- * Garbage collection of unix sockets starts by selecting a set of -- * candidate sockets which have reference only from being in flight -- * (total_refs == inflight_refs). This condition is checked once during -- * the candidate collection phase, and candidates are marked as such, so -- * that non-candidates can later be ignored. While inflight_refs is -- * protected by unix_gc_lock, total_refs (file count) is not, hence this -- * is an instantaneous decision. -- * -- * Once a candidate, however, the socket must not be reinstalled into a -- * file descriptor while the garbage collection is in progress. -- * -- * If the above conditions are met, then the directed graph of -- * candidates (*) does not change while unix_gc_lock is held. -- * -- * Any operations that changes the file count through file descriptors -- * (dup, close, sendmsg) does not change the graph since candidates are -- * not installed in fds. -- * -- * Dequeing a candidate via recvmsg would install it into an fd, but -- * that takes unix_gc_lock to decrement the inflight count, so it's -- * serialized with garbage collection. -- * -- * MSG_PEEK is special in that it does not change the inflight count, -- * yet does install the socket into an fd. The following lock/unlock -- * pair is to ensure serialization with garbage collection. It must be -- * done between incrementing the file count and installing the file into -- * an fd. -- * -- * If garbage collection starts after the barrier provided by the -- * lock/unlock, then it will see the elevated refcount and not mark this -- * as a candidate. If a garbage collection is already in progress -- * before the file count was incremented, then the lock/unlock pair will -- * ensure that garbage collection is finished before progressing to -- * installing the fd. -- * -- * (*) A -> B where B is on the queue of A or B is on the queue of C -- * which is on the queue of listening socket A. -- */ -- spin_lock(&unix_gc_lock); -- spin_unlock(&unix_gc_lock); -+static void unix_destruct_scm(struct sk_buff *skb) -+{ -+ struct scm_cookie scm; -+ -+ memset(&scm, 0, sizeof(scm)); -+ scm.pid = UNIXCB(skb).pid; -+ if (UNIXCB(skb).fp) -+ unix_detach_fds(&scm, skb); -+ -+ /* Alas, it calls VFS */ -+ /* So fscking what? fput() had been SMP-safe since the last Summer */ -+ scm_destroy(&scm); -+ sock_wfree(skb); - } - - static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds) -@@ -1855,8 +1869,10 @@ static void scm_stat_add(struct sock *sk, struct sk_buff *skb) - struct scm_fp_list *fp = UNIXCB(skb).fp; - struct unix_sock *u = unix_sk(sk); - -- if (unlikely(fp && fp->count)) -+ if (unlikely(fp && fp->count)) { - atomic_add(fp->count, &u->scm_stat.nr_fds); -+ unix_add_edges(fp, u); -+ } - } - - static void scm_stat_del(struct sock *sk, struct sk_buff *skb) -@@ -1864,8 +1880,10 @@ static void scm_stat_del(struct sock *sk, struct sk_buff *skb) - struct scm_fp_list *fp = UNIXCB(skb).fp; - struct unix_sock *u = unix_sk(sk); - -- if (unlikely(fp && fp->count)) -+ if (unlikely(fp && fp->count)) { - atomic_sub(fp->count, &u->scm_stat.nr_fds); -+ unix_del_edges(fp); -+ } - } - - /* -@@ -1885,11 +1903,12 @@ static int unix_dgram_sendmsg(struct socket *sock, struct msghdr *msg, - long timeo; - int err; - -- wait_for_unix_gc(); - err = scm_send(sock, msg, &scm, false); - if (err < 0) - return err; - -+ wait_for_unix_gc(scm.fp); -+ - err = -EOPNOTSUPP; - if (msg->msg_flags&MSG_OOB) - goto out; -@@ -2157,11 +2176,12 @@ static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg, - bool fds_sent = false; - int data_len; - -- wait_for_unix_gc(); - err = scm_send(sock, msg, &scm, false); - if (err < 0) - return err; - -+ wait_for_unix_gc(scm.fp); -+ - err = -EOPNOTSUPP; - if (msg->msg_flags & MSG_OOB) { - #if IS_ENABLED(CONFIG_AF_UNIX_OOB) -diff --git a/net/unix/garbage.c b/net/unix/garbage.c -index 2a758531e10271..23efb78fe9ef4b 100644 ---- a/net/unix/garbage.c -+++ b/net/unix/garbage.c -@@ -81,278 +81,551 @@ - #include - #include - --#include "scm.h" -+struct unix_sock *unix_get_socket(struct file *filp) -+{ -+ struct inode *inode = file_inode(filp); -+ -+ /* Socket ? */ -+ if (S_ISSOCK(inode->i_mode) && !(filp->f_mode & FMODE_PATH)) { -+ struct socket *sock = SOCKET_I(inode); -+ const struct proto_ops *ops; -+ struct sock *sk = sock->sk; - --/* Internal data structures and random procedures: */ -+ ops = READ_ONCE(sock->ops); - --static LIST_HEAD(gc_candidates); --static DECLARE_WAIT_QUEUE_HEAD(unix_gc_wait); -+ /* PF_UNIX ? */ -+ if (sk && ops && ops->family == PF_UNIX) -+ return unix_sk(sk); -+ } - --static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *), -- struct sk_buff_head *hitlist) -+ return NULL; -+} -+ -+static struct unix_vertex *unix_edge_successor(struct unix_edge *edge) - { -- struct sk_buff *skb; -- struct sk_buff *next; -- -- spin_lock(&x->sk_receive_queue.lock); -- skb_queue_walk_safe(&x->sk_receive_queue, skb, next) { -- /* Do we have file descriptors ? */ -- if (UNIXCB(skb).fp) { -- bool hit = false; -- /* Process the descriptors of this socket */ -- int nfd = UNIXCB(skb).fp->count; -- struct file **fp = UNIXCB(skb).fp->fp; -- -- while (nfd--) { -- /* Get the socket the fd matches if it indeed does so */ -- struct sock *sk = unix_get_socket(*fp++); -- -- if (sk) { -- struct unix_sock *u = unix_sk(sk); -- -- /* Ignore non-candidates, they could -- * have been added to the queues after -- * starting the garbage collection -- */ -- if (test_bit(UNIX_GC_CANDIDATE, &u->gc_flags)) { -- hit = true; -- -- func(u); -- } -- } -- } -- if (hit && hitlist != NULL) { -- __skb_unlink(skb, &x->sk_receive_queue); -- __skb_queue_tail(hitlist, skb); -- } -- } -+ /* If an embryo socket has a fd, -+ * the listener indirectly holds the fd's refcnt. -+ */ -+ if (edge->successor->listener) -+ return unix_sk(edge->successor->listener)->vertex; -+ -+ return edge->successor->vertex; -+} -+ -+static bool unix_graph_maybe_cyclic; -+static bool unix_graph_grouped; -+ -+static void unix_update_graph(struct unix_vertex *vertex) -+{ -+ /* If the receiver socket is not inflight, no cyclic -+ * reference could be formed. -+ */ -+ if (!vertex) -+ return; -+ -+ unix_graph_maybe_cyclic = true; -+ unix_graph_grouped = false; -+} -+ -+static LIST_HEAD(unix_unvisited_vertices); -+ -+enum unix_vertex_index { -+ UNIX_VERTEX_INDEX_MARK1, -+ UNIX_VERTEX_INDEX_MARK2, -+ UNIX_VERTEX_INDEX_START, -+}; -+ -+static unsigned long unix_vertex_unvisited_index = UNIX_VERTEX_INDEX_MARK1; -+ -+static void unix_add_edge(struct scm_fp_list *fpl, struct unix_edge *edge) -+{ -+ struct unix_vertex *vertex = edge->predecessor->vertex; -+ -+ if (!vertex) { -+ vertex = list_first_entry(&fpl->vertices, typeof(*vertex), entry); -+ vertex->index = unix_vertex_unvisited_index; -+ vertex->out_degree = 0; -+ INIT_LIST_HEAD(&vertex->edges); -+ INIT_LIST_HEAD(&vertex->scc_entry); -+ -+ list_move_tail(&vertex->entry, &unix_unvisited_vertices); -+ edge->predecessor->vertex = vertex; - } -- spin_unlock(&x->sk_receive_queue.lock); -+ -+ vertex->out_degree++; -+ list_add_tail(&edge->vertex_entry, &vertex->edges); -+ -+ unix_update_graph(unix_edge_successor(edge)); - } - --static void scan_children(struct sock *x, void (*func)(struct unix_sock *), -- struct sk_buff_head *hitlist) -+static void unix_del_edge(struct scm_fp_list *fpl, struct unix_edge *edge) - { -- if (x->sk_state != TCP_LISTEN) { -- scan_inflight(x, func, hitlist); -- } else { -- struct sk_buff *skb; -- struct sk_buff *next; -- struct unix_sock *u; -- LIST_HEAD(embryos); -+ struct unix_vertex *vertex = edge->predecessor->vertex; - -- /* For a listening socket collect the queued embryos -- * and perform a scan on them as well. -- */ -- spin_lock(&x->sk_receive_queue.lock); -- skb_queue_walk_safe(&x->sk_receive_queue, skb, next) { -- u = unix_sk(skb->sk); -+ if (!fpl->dead) -+ unix_update_graph(unix_edge_successor(edge)); - -- /* An embryo cannot be in-flight, so it's safe -- * to use the list link. -- */ -- BUG_ON(!list_empty(&u->link)); -- list_add_tail(&u->link, &embryos); -- } -- spin_unlock(&x->sk_receive_queue.lock); -+ list_del(&edge->vertex_entry); -+ vertex->out_degree--; - -- while (!list_empty(&embryos)) { -- u = list_entry(embryos.next, struct unix_sock, link); -- scan_inflight(&u->sk, func, hitlist); -- list_del_init(&u->link); -- } -+ if (!vertex->out_degree) { -+ edge->predecessor->vertex = NULL; -+ list_move_tail(&vertex->entry, &fpl->vertices); - } - } - --static void dec_inflight(struct unix_sock *usk) -+static void unix_free_vertices(struct scm_fp_list *fpl) - { -- usk->inflight--; -+ struct unix_vertex *vertex, *next_vertex; -+ -+ list_for_each_entry_safe(vertex, next_vertex, &fpl->vertices, entry) { -+ list_del(&vertex->entry); -+ kfree(vertex); -+ } - } - --static void inc_inflight(struct unix_sock *usk) -+static DEFINE_SPINLOCK(unix_gc_lock); -+unsigned int unix_tot_inflight; -+ -+void unix_add_edges(struct scm_fp_list *fpl, struct unix_sock *receiver) - { -- usk->inflight++; -+ int i = 0, j = 0; -+ -+ spin_lock(&unix_gc_lock); -+ -+ if (!fpl->count_unix) -+ goto out; -+ -+ do { -+ struct unix_sock *inflight = unix_get_socket(fpl->fp[j++]); -+ struct unix_edge *edge; -+ -+ if (!inflight) -+ continue; -+ -+ edge = fpl->edges + i++; -+ edge->predecessor = inflight; -+ edge->successor = receiver; -+ -+ unix_add_edge(fpl, edge); -+ } while (i < fpl->count_unix); -+ -+ receiver->scm_stat.nr_unix_fds += fpl->count_unix; -+ WRITE_ONCE(unix_tot_inflight, unix_tot_inflight + fpl->count_unix); -+out: -+ WRITE_ONCE(fpl->user->unix_inflight, fpl->user->unix_inflight + fpl->count); -+ -+ spin_unlock(&unix_gc_lock); -+ -+ fpl->inflight = true; -+ -+ unix_free_vertices(fpl); - } - --static void inc_inflight_move_tail(struct unix_sock *u) -+void unix_del_edges(struct scm_fp_list *fpl) - { -- u->inflight++; -+ struct unix_sock *receiver; -+ int i = 0; -+ -+ spin_lock(&unix_gc_lock); - -- /* If this still might be part of a cycle, move it to the end -- * of the list, so that it's checked even if it was already -- * passed over -+ if (!fpl->count_unix) -+ goto out; -+ -+ do { -+ struct unix_edge *edge = fpl->edges + i++; -+ -+ unix_del_edge(fpl, edge); -+ } while (i < fpl->count_unix); -+ -+ if (!fpl->dead) { -+ receiver = fpl->edges[0].successor; -+ receiver->scm_stat.nr_unix_fds -= fpl->count_unix; -+ } -+ WRITE_ONCE(unix_tot_inflight, unix_tot_inflight - fpl->count_unix); -+out: -+ WRITE_ONCE(fpl->user->unix_inflight, fpl->user->unix_inflight - fpl->count); -+ -+ spin_unlock(&unix_gc_lock); -+ -+ fpl->inflight = false; -+} -+ -+void unix_update_edges(struct unix_sock *receiver) -+{ -+ /* nr_unix_fds is only updated under unix_state_lock(). -+ * If it's 0 here, the embryo socket is not part of the -+ * inflight graph, and GC will not see it, so no lock needed. - */ -- if (test_bit(UNIX_GC_MAYBE_CYCLE, &u->gc_flags)) -- list_move_tail(&u->link, &gc_candidates); -+ if (!receiver->scm_stat.nr_unix_fds) { -+ receiver->listener = NULL; -+ } else { -+ spin_lock(&unix_gc_lock); -+ unix_update_graph(unix_sk(receiver->listener)->vertex); -+ receiver->listener = NULL; -+ spin_unlock(&unix_gc_lock); -+ } - } - --static bool gc_in_progress; --#define UNIX_INFLIGHT_TRIGGER_GC 16000 -+int unix_prepare_fpl(struct scm_fp_list *fpl) -+{ -+ struct unix_vertex *vertex; -+ int i; -+ -+ if (!fpl->count_unix) -+ return 0; -+ -+ for (i = 0; i < fpl->count_unix; i++) { -+ vertex = kmalloc(sizeof(*vertex), GFP_KERNEL); -+ if (!vertex) -+ goto err; -+ -+ list_add(&vertex->entry, &fpl->vertices); -+ } -+ -+ fpl->edges = kvmalloc_array(fpl->count_unix, sizeof(*fpl->edges), -+ GFP_KERNEL_ACCOUNT); -+ if (!fpl->edges) -+ goto err; -+ -+ return 0; - --void wait_for_unix_gc(void) -+err: -+ unix_free_vertices(fpl); -+ return -ENOMEM; -+} -+ -+void unix_destroy_fpl(struct scm_fp_list *fpl) - { -- /* If number of inflight sockets is insane, -- * force a garbage collect right now. -- * Paired with the WRITE_ONCE() in unix_inflight(), -- * unix_notinflight() and gc_in_progress(). -- */ -- if (READ_ONCE(unix_tot_inflight) > UNIX_INFLIGHT_TRIGGER_GC && -- !READ_ONCE(gc_in_progress)) -- unix_gc(); -- wait_event(unix_gc_wait, !READ_ONCE(gc_in_progress)); -+ if (fpl->inflight) -+ unix_del_edges(fpl); -+ -+ kvfree(fpl->edges); -+ unix_free_vertices(fpl); - } - --/* The external entry point: unix_gc() */ --void unix_gc(void) -+static bool unix_vertex_dead(struct unix_vertex *vertex) - { -- struct sk_buff *next_skb, *skb; -+ struct unix_edge *edge; - struct unix_sock *u; -- struct unix_sock *next; -- struct sk_buff_head hitlist; -- struct list_head cursor; -- LIST_HEAD(not_cycle_list); -+ long total_ref; - -- spin_lock(&unix_gc_lock); -+ list_for_each_entry(edge, &vertex->edges, vertex_entry) { -+ struct unix_vertex *next_vertex = unix_edge_successor(edge); - -- /* Avoid a recursive GC. */ -- if (gc_in_progress) -- goto out; -+ /* The vertex's fd can be received by a non-inflight socket. */ -+ if (!next_vertex) -+ return false; - -- /* Paired with READ_ONCE() in wait_for_unix_gc(). */ -- WRITE_ONCE(gc_in_progress, true); -+ /* The vertex's fd can be received by an inflight socket in -+ * another SCC. -+ */ -+ if (next_vertex->scc_index != vertex->scc_index) -+ return false; -+ } - -- /* First, select candidates for garbage collection. Only -- * in-flight sockets are considered, and from those only ones -- * which don't have any external reference. -- * -- * Holding unix_gc_lock will protect these candidates from -- * being detached, and hence from gaining an external -- * reference. Since there are no possible receivers, all -- * buffers currently on the candidates' queues stay there -- * during the garbage collection. -- * -- * We also know that no new candidate can be added onto the -- * receive queues. Other, non candidate sockets _can_ be -- * added to queue, so we must make sure only to touch -- * candidates. -- * -- * Embryos, though never candidates themselves, affect which -- * candidates are reachable by the garbage collector. Before -- * being added to a listener's queue, an embryo may already -- * receive data carrying SCM_RIGHTS, potentially making the -- * passed socket a candidate that is not yet reachable by the -- * collector. It becomes reachable once the embryo is -- * enqueued. Therefore, we must ensure that no SCM-laden -- * embryo appears in a (candidate) listener's queue between -- * consecutive scan_children() calls. -- */ -- list_for_each_entry_safe(u, next, &gc_inflight_list, link) { -- struct sock *sk = &u->sk; -- long total_refs; -- -- total_refs = file_count(sk->sk_socket->file); -- -- BUG_ON(!u->inflight); -- BUG_ON(total_refs < u->inflight); -- if (total_refs == u->inflight) { -- list_move_tail(&u->link, &gc_candidates); -- __set_bit(UNIX_GC_CANDIDATE, &u->gc_flags); -- __set_bit(UNIX_GC_MAYBE_CYCLE, &u->gc_flags); -- -- if (sk->sk_state == TCP_LISTEN) { -- unix_state_lock_nested(sk, U_LOCK_GC_LISTENER); -- unix_state_unlock(sk); -+ /* No receiver exists out of the same SCC. */ -+ -+ edge = list_first_entry(&vertex->edges, typeof(*edge), vertex_entry); -+ u = edge->predecessor; -+ total_ref = file_count(u->sk.sk_socket->file); -+ -+ /* If not close()d, total_ref > out_degree. */ -+ if (total_ref != vertex->out_degree) -+ return false; -+ -+ return true; -+} -+ -+enum unix_recv_queue_lock_class { -+ U_RECVQ_LOCK_NORMAL, -+ U_RECVQ_LOCK_EMBRYO, -+}; -+ -+static void unix_collect_queue(struct unix_sock *u, struct sk_buff_head *hitlist) -+{ -+ skb_queue_splice_init(&u->sk.sk_receive_queue, hitlist); -+ -+#if IS_ENABLED(CONFIG_AF_UNIX_OOB) -+ if (u->oob_skb) { -+ WARN_ON_ONCE(skb_unref(u->oob_skb)); -+ u->oob_skb = NULL; -+ } -+#endif -+} -+ -+static void unix_collect_skb(struct list_head *scc, struct sk_buff_head *hitlist) -+{ -+ struct unix_vertex *vertex; -+ -+ list_for_each_entry_reverse(vertex, scc, scc_entry) { -+ struct sk_buff_head *queue; -+ struct unix_edge *edge; -+ struct unix_sock *u; -+ -+ edge = list_first_entry(&vertex->edges, typeof(*edge), vertex_entry); -+ u = edge->predecessor; -+ queue = &u->sk.sk_receive_queue; -+ -+ spin_lock(&queue->lock); -+ -+ if (u->sk.sk_state == TCP_LISTEN) { -+ struct sk_buff *skb; -+ -+ skb_queue_walk(queue, skb) { -+ struct sk_buff_head *embryo_queue = &skb->sk->sk_receive_queue; -+ -+ /* listener -> embryo order, the inversion never happens. */ -+ spin_lock_nested(&embryo_queue->lock, U_RECVQ_LOCK_EMBRYO); -+ unix_collect_queue(unix_sk(skb->sk), hitlist); -+ spin_unlock(&embryo_queue->lock); - } -+ } else { -+ unix_collect_queue(u, hitlist); - } -+ -+ spin_unlock(&queue->lock); - } -+} - -- /* Now remove all internal in-flight reference to children of -- * the candidates. -- */ -- list_for_each_entry(u, &gc_candidates, link) -- scan_children(&u->sk, dec_inflight, NULL); -+static bool unix_scc_cyclic(struct list_head *scc) -+{ -+ struct unix_vertex *vertex; -+ struct unix_edge *edge; - -- /* Restore the references for children of all candidates, -- * which have remaining references. Do this recursively, so -- * only those remain, which form cyclic references. -- * -- * Use a "cursor" link, to make the list traversal safe, even -- * though elements might be moved about. -+ /* SCC containing multiple vertices ? */ -+ if (!list_is_singular(scc)) -+ return true; -+ -+ vertex = list_first_entry(scc, typeof(*vertex), scc_entry); -+ -+ /* Self-reference or a embryo-listener circle ? */ -+ list_for_each_entry(edge, &vertex->edges, vertex_entry) { -+ if (unix_edge_successor(edge) == vertex) -+ return true; -+ } -+ -+ return false; -+} -+ -+static LIST_HEAD(unix_visited_vertices); -+static unsigned long unix_vertex_grouped_index = UNIX_VERTEX_INDEX_MARK2; -+ -+static void __unix_walk_scc(struct unix_vertex *vertex, unsigned long *last_index, -+ struct sk_buff_head *hitlist) -+{ -+ LIST_HEAD(vertex_stack); -+ struct unix_edge *edge; -+ LIST_HEAD(edge_stack); -+ -+next_vertex: -+ /* Push vertex to vertex_stack and mark it as on-stack -+ * (index >= UNIX_VERTEX_INDEX_START). -+ * The vertex will be popped when finalising SCC later. - */ -- list_add(&cursor, &gc_candidates); -- while (cursor.next != &gc_candidates) { -- u = list_entry(cursor.next, struct unix_sock, link); -+ list_add(&vertex->scc_entry, &vertex_stack); -+ -+ vertex->index = *last_index; -+ vertex->scc_index = *last_index; -+ (*last_index)++; -+ -+ /* Explore neighbour vertices (receivers of the current vertex's fd). */ -+ list_for_each_entry(edge, &vertex->edges, vertex_entry) { -+ struct unix_vertex *next_vertex = unix_edge_successor(edge); -+ -+ if (!next_vertex) -+ continue; -+ -+ if (next_vertex->index == unix_vertex_unvisited_index) { -+ /* Iterative deepening depth first search -+ * -+ * 1. Push a forward edge to edge_stack and set -+ * the successor to vertex for the next iteration. -+ */ -+ list_add(&edge->stack_entry, &edge_stack); - -- /* Move cursor to after the current position. */ -- list_move(&cursor, &u->link); -+ vertex = next_vertex; -+ goto next_vertex; - -- if (u->inflight) { -- list_move_tail(&u->link, ¬_cycle_list); -- __clear_bit(UNIX_GC_MAYBE_CYCLE, &u->gc_flags); -- scan_children(&u->sk, inc_inflight_move_tail, NULL); -+ /* 2. Pop the edge directed to the current vertex -+ * and restore the ancestor for backtracking. -+ */ -+prev_vertex: -+ edge = list_first_entry(&edge_stack, typeof(*edge), stack_entry); -+ list_del_init(&edge->stack_entry); -+ -+ next_vertex = vertex; -+ vertex = edge->predecessor->vertex; -+ -+ /* If the successor has a smaller scc_index, two vertices -+ * are in the same SCC, so propagate the smaller scc_index -+ * to skip SCC finalisation. -+ */ -+ vertex->scc_index = min(vertex->scc_index, next_vertex->scc_index); -+ } else if (next_vertex->index != unix_vertex_grouped_index) { -+ /* Loop detected by a back/cross edge. -+ * -+ * The successor is on vertex_stack, so two vertices are in -+ * the same SCC. If the successor has a smaller *scc_index*, -+ * propagate it to skip SCC finalisation. -+ */ -+ vertex->scc_index = min(vertex->scc_index, next_vertex->scc_index); -+ } else { -+ /* The successor was already grouped as another SCC */ - } - } -- list_del(&cursor); - -- /* Now gc_candidates contains only garbage. Restore original -- * inflight counters for these as well, and remove the skbuffs -- * which are creating the cycle(s). -- */ -- skb_queue_head_init(&hitlist); -- list_for_each_entry(u, &gc_candidates, link) { -- scan_children(&u->sk, inc_inflight, &hitlist); -+ if (vertex->index == vertex->scc_index) { -+ struct unix_vertex *v; -+ struct list_head scc; -+ bool scc_dead = true; - --#if IS_ENABLED(CONFIG_AF_UNIX_OOB) -- if (u->oob_skb) { -- kfree_skb(u->oob_skb); -- u->oob_skb = NULL; -+ /* SCC finalised. -+ * -+ * If the scc_index was not updated, all the vertices above on -+ * vertex_stack are in the same SCC. Group them using scc_entry. -+ */ -+ __list_cut_position(&scc, &vertex_stack, &vertex->scc_entry); -+ -+ list_for_each_entry_reverse(v, &scc, scc_entry) { -+ /* Don't restart DFS from this vertex in unix_walk_scc(). */ -+ list_move_tail(&v->entry, &unix_visited_vertices); -+ -+ /* Mark vertex as off-stack. */ -+ v->index = unix_vertex_grouped_index; -+ -+ if (scc_dead) -+ scc_dead = unix_vertex_dead(v); - } --#endif -+ -+ if (scc_dead) -+ unix_collect_skb(&scc, hitlist); -+ else if (!unix_graph_maybe_cyclic) -+ unix_graph_maybe_cyclic = unix_scc_cyclic(&scc); -+ -+ list_del(&scc); - } - -- /* not_cycle_list contains those sockets which do not make up a -- * cycle. Restore these to the inflight list. -+ /* Need backtracking ? */ -+ if (!list_empty(&edge_stack)) -+ goto prev_vertex; -+} -+ -+static void unix_walk_scc(struct sk_buff_head *hitlist) -+{ -+ unsigned long last_index = UNIX_VERTEX_INDEX_START; -+ -+ unix_graph_maybe_cyclic = false; -+ -+ /* Visit every vertex exactly once. -+ * __unix_walk_scc() moves visited vertices to unix_visited_vertices. - */ -- while (!list_empty(¬_cycle_list)) { -- u = list_entry(not_cycle_list.next, struct unix_sock, link); -- __clear_bit(UNIX_GC_CANDIDATE, &u->gc_flags); -- list_move_tail(&u->link, &gc_inflight_list); -+ while (!list_empty(&unix_unvisited_vertices)) { -+ struct unix_vertex *vertex; -+ -+ vertex = list_first_entry(&unix_unvisited_vertices, typeof(*vertex), entry); -+ __unix_walk_scc(vertex, &last_index, hitlist); - } - -- spin_unlock(&unix_gc_lock); -+ list_replace_init(&unix_visited_vertices, &unix_unvisited_vertices); -+ swap(unix_vertex_unvisited_index, unix_vertex_grouped_index); - -- /* We need io_uring to clean its registered files, ignore all io_uring -- * originated skbs. It's fine as io_uring doesn't keep references to -- * other io_uring instances and so killing all other files in the cycle -- * will put all io_uring references forcing it to go through normal -- * release.path eventually putting registered files. -- */ -- skb_queue_walk_safe(&hitlist, skb, next_skb) { -- if (skb->destructor == io_uring_destruct_scm) { -- __skb_unlink(skb, &hitlist); -- skb_queue_tail(&skb->sk->sk_receive_queue, skb); -+ unix_graph_grouped = true; -+} -+ -+static void unix_walk_scc_fast(struct sk_buff_head *hitlist) -+{ -+ unix_graph_maybe_cyclic = false; -+ -+ while (!list_empty(&unix_unvisited_vertices)) { -+ struct unix_vertex *vertex; -+ struct list_head scc; -+ bool scc_dead = true; -+ -+ vertex = list_first_entry(&unix_unvisited_vertices, typeof(*vertex), entry); -+ list_add(&scc, &vertex->scc_entry); -+ -+ list_for_each_entry_reverse(vertex, &scc, scc_entry) { -+ list_move_tail(&vertex->entry, &unix_visited_vertices); -+ -+ if (scc_dead) -+ scc_dead = unix_vertex_dead(vertex); - } -+ -+ if (scc_dead) -+ unix_collect_skb(&scc, hitlist); -+ else if (!unix_graph_maybe_cyclic) -+ unix_graph_maybe_cyclic = unix_scc_cyclic(&scc); -+ -+ list_del(&scc); - } - -- /* Here we are. Hitlist is filled. Die. */ -- __skb_queue_purge(&hitlist); -+ list_replace_init(&unix_visited_vertices, &unix_unvisited_vertices); -+} -+ -+static bool gc_in_progress; -+ -+static void __unix_gc(struct work_struct *work) -+{ -+ struct sk_buff_head hitlist; -+ struct sk_buff *skb; - - spin_lock(&unix_gc_lock); - -- /* There could be io_uring registered files, just push them back to -- * the inflight list -- */ -- list_for_each_entry_safe(u, next, &gc_candidates, link) -- list_move_tail(&u->link, &gc_inflight_list); -+ if (!unix_graph_maybe_cyclic) { -+ spin_unlock(&unix_gc_lock); -+ goto skip_gc; -+ } -+ -+ __skb_queue_head_init(&hitlist); -+ -+ if (unix_graph_grouped) -+ unix_walk_scc_fast(&hitlist); -+ else -+ unix_walk_scc(&hitlist); - -- /* All candidates should have been detached by now. */ -- BUG_ON(!list_empty(&gc_candidates)); -+ spin_unlock(&unix_gc_lock); -+ -+ skb_queue_walk(&hitlist, skb) { -+ if (UNIXCB(skb).fp) -+ UNIXCB(skb).fp->dead = true; -+ } - -- /* Paired with READ_ONCE() in wait_for_unix_gc(). */ -+ __skb_queue_purge(&hitlist); -+skip_gc: - WRITE_ONCE(gc_in_progress, false); -+} - -- wake_up(&unix_gc_wait); -+static DECLARE_WORK(unix_gc_work, __unix_gc); - -- out: -- spin_unlock(&unix_gc_lock); -+void unix_gc(void) -+{ -+ WRITE_ONCE(gc_in_progress, true); -+ queue_work(system_unbound_wq, &unix_gc_work); -+} -+ -+#define UNIX_INFLIGHT_TRIGGER_GC 16000 -+#define UNIX_INFLIGHT_SANE_USER (SCM_MAX_FD * 8) -+ -+void wait_for_unix_gc(struct scm_fp_list *fpl) -+{ -+ /* If number of inflight sockets is insane, -+ * force a garbage collect right now. -+ * -+ * Paired with the WRITE_ONCE() in unix_inflight(), -+ * unix_notinflight(), and __unix_gc(). -+ */ -+ if (READ_ONCE(unix_tot_inflight) > UNIX_INFLIGHT_TRIGGER_GC && -+ !READ_ONCE(gc_in_progress)) -+ unix_gc(); -+ -+ /* Penalise users who want to send AF_UNIX sockets -+ * but whose sockets have not been received yet. -+ */ -+ if (!fpl || !fpl->count_unix || -+ READ_ONCE(fpl->user->unix_inflight) < UNIX_INFLIGHT_SANE_USER) -+ return; -+ -+ if (READ_ONCE(gc_in_progress)) -+ flush_work(&unix_gc_work); - } -diff --git a/net/unix/scm.c b/net/unix/scm.c -deleted file mode 100644 -index e92f2fad64105d..00000000000000 ---- a/net/unix/scm.c -+++ /dev/null -@@ -1,161 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include -- --#include "scm.h" -- --unsigned int unix_tot_inflight; --EXPORT_SYMBOL(unix_tot_inflight); -- --LIST_HEAD(gc_inflight_list); --EXPORT_SYMBOL(gc_inflight_list); -- --DEFINE_SPINLOCK(unix_gc_lock); --EXPORT_SYMBOL(unix_gc_lock); -- --struct sock *unix_get_socket(struct file *filp) --{ -- struct sock *u_sock = NULL; -- struct inode *inode = file_inode(filp); -- -- /* Socket ? */ -- if (S_ISSOCK(inode->i_mode) && !(filp->f_mode & FMODE_PATH)) { -- struct socket *sock = SOCKET_I(inode); -- const struct proto_ops *ops = READ_ONCE(sock->ops); -- struct sock *s = sock->sk; -- -- /* PF_UNIX ? */ -- if (s && ops && ops->family == PF_UNIX) -- u_sock = s; -- } -- -- return u_sock; --} --EXPORT_SYMBOL(unix_get_socket); -- --/* Keep the number of times in flight count for the file -- * descriptor if it is for an AF_UNIX socket. -- */ --void unix_inflight(struct user_struct *user, struct file *fp) --{ -- struct sock *s = unix_get_socket(fp); -- -- spin_lock(&unix_gc_lock); -- -- if (s) { -- struct unix_sock *u = unix_sk(s); -- -- if (!u->inflight) { -- BUG_ON(!list_empty(&u->link)); -- list_add_tail(&u->link, &gc_inflight_list); -- } else { -- BUG_ON(list_empty(&u->link)); -- } -- u->inflight++; -- /* Paired with READ_ONCE() in wait_for_unix_gc() */ -- WRITE_ONCE(unix_tot_inflight, unix_tot_inflight + 1); -- } -- WRITE_ONCE(user->unix_inflight, user->unix_inflight + 1); -- spin_unlock(&unix_gc_lock); --} -- --void unix_notinflight(struct user_struct *user, struct file *fp) --{ -- struct sock *s = unix_get_socket(fp); -- -- spin_lock(&unix_gc_lock); -- -- if (s) { -- struct unix_sock *u = unix_sk(s); -- -- BUG_ON(!u->inflight); -- BUG_ON(list_empty(&u->link)); -- -- u->inflight--; -- if (!u->inflight) -- list_del_init(&u->link); -- /* Paired with READ_ONCE() in wait_for_unix_gc() */ -- WRITE_ONCE(unix_tot_inflight, unix_tot_inflight - 1); -- } -- WRITE_ONCE(user->unix_inflight, user->unix_inflight - 1); -- spin_unlock(&unix_gc_lock); --} -- --/* -- * The "user->unix_inflight" variable is protected by the garbage -- * collection lock, and we just read it locklessly here. If you go -- * over the limit, there might be a tiny race in actually noticing -- * it across threads. Tough. -- */ --static inline bool too_many_unix_fds(struct task_struct *p) --{ -- struct user_struct *user = current_user(); -- -- if (unlikely(READ_ONCE(user->unix_inflight) > task_rlimit(p, RLIMIT_NOFILE))) -- return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN); -- return false; --} -- --int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) --{ -- int i; -- -- if (too_many_unix_fds(current)) -- return -ETOOMANYREFS; -- -- /* -- * Need to duplicate file references for the sake of garbage -- * collection. Otherwise a socket in the fps might become a -- * candidate for GC while the skb is not yet queued. -- */ -- UNIXCB(skb).fp = scm_fp_dup(scm->fp); -- if (!UNIXCB(skb).fp) -- return -ENOMEM; -- -- for (i = scm->fp->count - 1; i >= 0; i--) -- unix_inflight(scm->fp->user, scm->fp->fp[i]); -- return 0; --} --EXPORT_SYMBOL(unix_attach_fds); -- --void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb) --{ -- int i; -- -- scm->fp = UNIXCB(skb).fp; -- UNIXCB(skb).fp = NULL; -- -- for (i = scm->fp->count-1; i >= 0; i--) -- unix_notinflight(scm->fp->user, scm->fp->fp[i]); --} --EXPORT_SYMBOL(unix_detach_fds); -- --void unix_destruct_scm(struct sk_buff *skb) --{ -- struct scm_cookie scm; -- -- memset(&scm, 0, sizeof(scm)); -- scm.pid = UNIXCB(skb).pid; -- if (UNIXCB(skb).fp) -- unix_detach_fds(&scm, skb); -- -- /* Alas, it calls VFS */ -- /* So fscking what? fput() had been SMP-safe since the last Summer */ -- scm_destroy(&scm); -- sock_wfree(skb); --} --EXPORT_SYMBOL(unix_destruct_scm); -- --void io_uring_destruct_scm(struct sk_buff *skb) --{ -- unix_destruct_scm(skb); --} --EXPORT_SYMBOL(io_uring_destruct_scm); -diff --git a/net/unix/scm.h b/net/unix/scm.h -deleted file mode 100644 -index 5a255a477f1609..00000000000000 ---- a/net/unix/scm.h -+++ /dev/null -@@ -1,10 +0,0 @@ --#ifndef NET_UNIX_SCM_H --#define NET_UNIX_SCM_H -- --extern struct list_head gc_inflight_list; --extern spinlock_t unix_gc_lock; -- --int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb); --void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb); -- --#endif -diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c -index 68b3f9e7edffd4..2edb0f868c5738 100644 ---- a/net/xfrm/xfrm_policy.c -+++ b/net/xfrm/xfrm_policy.c -@@ -1603,6 +1603,9 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl) - struct xfrm_policy *delpol; - struct hlist_head *chain; - -+ /* Sanitize mark before store */ -+ policy->mark.v &= policy->mark.m; -+ - spin_lock_bh(&net->xfrm.xfrm_policy_lock); - chain = policy_hash_bysel(net, &policy->selector, policy->family, dir); - if (chain) -diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c -index 8a6e8656d014f2..86029cf5358c7a 100644 ---- a/net/xfrm/xfrm_state.c -+++ b/net/xfrm/xfrm_state.c -@@ -754,9 +754,6 @@ int __xfrm_state_delete(struct xfrm_state *x) - net->xfrm.state_num--; - spin_unlock(&net->xfrm.xfrm_state_lock); - -- if (x->encap_sk) -- sock_put(rcu_dereference_raw(x->encap_sk)); -- - xfrm_dev_state_delete(x); - - /* All xfrm_state objects are created by xfrm_state_alloc. -@@ -1478,6 +1475,9 @@ static void __xfrm_state_insert(struct xfrm_state *x) - - list_add(&x->km.all, &net->xfrm.state_all); - -+ /* Sanitize mark before store */ -+ x->mark.v &= x->mark.m; -+ - h = xfrm_dst_hash(net, &x->id.daddr, &x->props.saddr, - x->props.reqid, x->props.family); - XFRM_STATE_INSERT(bydst, &x->bydst, net->xfrm.state_bydst + h, -diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile -index 3fa16412db15ca..927d72659173e0 100644 ---- a/samples/bpf/Makefile -+++ b/samples/bpf/Makefile -@@ -392,7 +392,7 @@ $(obj)/%.o: $(src)/%.c - @echo " CLANG-bpf " $@ - $(Q)$(CLANG) $(NOSTDINC_FLAGS) $(LINUXINCLUDE) $(BPF_EXTRA_CFLAGS) \ - -I$(obj) -I$(srctree)/tools/testing/selftests/bpf/ \ -- -I$(LIBBPF_INCLUDE) \ -+ -I$(LIBBPF_INCLUDE) $(CLANG_SYS_INCLUDES) \ - -D__KERNEL__ -D__BPF_TRACING__ -Wno-unused-value -Wno-pointer-sign \ - -D__TARGET_ARCH_$(SRCARCH) -Wno-compare-distinct-pointer-types \ - -Wno-gnu-variable-sized-type-not-at-end \ -diff --git a/scripts/config b/scripts/config -index ff88e2faefd35c..ea475c07de283e 100755 ---- a/scripts/config -+++ b/scripts/config -@@ -32,6 +32,7 @@ commands: - Disable option directly after other option - --module-after|-M beforeopt option - Turn option into module directly after other option -+ --refresh Refresh the config using old settings - - commands can be repeated multiple times - -@@ -124,16 +125,22 @@ undef_var() { - txt_delete "^# $name is not set" "$FN" - } - --if [ "$1" = "--file" ]; then -- FN="$2" -- if [ "$FN" = "" ] ; then -- usage -+FN=.config -+CMDS=() -+while [[ $# -gt 0 ]]; do -+ if [ "$1" = "--file" ]; then -+ if [ "$2" = "" ]; then -+ usage -+ fi -+ FN="$2" -+ shift 2 -+ else -+ CMDS+=("$1") -+ shift - fi -- shift 2 --else -- FN=.config --fi -+done - -+set -- "${CMDS[@]}" - if [ "$1" = "" ] ; then - usage - fi -@@ -217,9 +224,8 @@ while [ "$1" != "" ] ; do - set_var "${CONFIG_}$B" "${CONFIG_}$B=m" "${CONFIG_}$A" - ;; - -- # undocumented because it ignores --file (fixme) - --refresh) -- yes "" | make oldconfig -+ yes "" | make oldconfig KCONFIG_CONFIG=$FN - ;; - - *) -diff --git a/scripts/kconfig/merge_config.sh b/scripts/kconfig/merge_config.sh -index 0b7952471c18f6..79c09b378be816 100755 ---- a/scripts/kconfig/merge_config.sh -+++ b/scripts/kconfig/merge_config.sh -@@ -112,8 +112,8 @@ INITFILE=$1 - shift; - - if [ ! -r "$INITFILE" ]; then -- echo "The base file '$INITFILE' does not exist. Exit." >&2 -- exit 1 -+ echo "The base file '$INITFILE' does not exist. Creating one..." >&2 -+ touch "$INITFILE" - fi - - MERGE_LIST=$* -diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c -index 98308a2bdef6e0..068edb0d79f736 100644 ---- a/security/integrity/ima/ima_main.c -+++ b/security/integrity/ima/ima_main.c -@@ -235,7 +235,9 @@ static int process_measurement(struct file *file, const struct cred *cred, - &allowed_algos); - violation_check = ((func == FILE_CHECK || func == MMAP_CHECK || - func == MMAP_CHECK_REQPROT) && -- (ima_policy_flag & IMA_MEASURE)); -+ (ima_policy_flag & IMA_MEASURE) && -+ ((action & IMA_MEASURE) || -+ (file->f_mode & FMODE_WRITE))); - if (!action && !violation_check) - return 0; - -diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c -index 5dd1e164f9b13d..1e35c9f807b2b6 100644 ---- a/security/smack/smackfs.c -+++ b/security/smack/smackfs.c -@@ -830,7 +830,7 @@ static int smk_open_cipso(struct inode *inode, struct file *file) - static ssize_t smk_set_cipso(struct file *file, const char __user *buf, - size_t count, loff_t *ppos, int format) - { -- struct netlbl_lsm_catmap *old_cat, *new_cat = NULL; -+ struct netlbl_lsm_catmap *old_cat; - struct smack_known *skp; - struct netlbl_lsm_secattr ncats; - char mapcatset[SMK_CIPSOLEN]; -@@ -917,22 +917,15 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, - - smack_catset_bit(cat, mapcatset); - } -- ncats.flags = 0; -- if (catlen == 0) { -- ncats.attr.mls.cat = NULL; -- ncats.attr.mls.lvl = maplevel; -- new_cat = netlbl_catmap_alloc(GFP_ATOMIC); -- if (new_cat) -- new_cat->next = ncats.attr.mls.cat; -- ncats.attr.mls.cat = new_cat; -- skp->smk_netlabel.flags &= ~(1U << 3); -- rc = 0; -- } else { -- rc = smk_netlbl_mls(maplevel, mapcatset, &ncats, SMK_CIPSOLEN); -- } -+ -+ rc = smk_netlbl_mls(maplevel, mapcatset, &ncats, SMK_CIPSOLEN); - if (rc >= 0) { - old_cat = skp->smk_netlabel.attr.mls.cat; - rcu_assign_pointer(skp->smk_netlabel.attr.mls.cat, ncats.attr.mls.cat); -+ if (ncats.attr.mls.cat) -+ skp->smk_netlabel.flags |= NETLBL_SECATTR_MLS_CAT; -+ else -+ skp->smk_netlabel.flags &= ~(u32)NETLBL_SECATTR_MLS_CAT; - skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl; - synchronize_rcu(); - netlbl_catmap_free(old_cat); -diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c -index 728c211142d145..471de2d1b37ad1 100644 ---- a/sound/core/oss/pcm_oss.c -+++ b/sound/core/oss/pcm_oss.c -@@ -1085,8 +1085,7 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) - runtime->oss.params = 0; - runtime->oss.prepare = 1; - runtime->oss.buffer_used = 0; -- if (runtime->dma_area) -- snd_pcm_format_set_silence(runtime->format, runtime->dma_area, bytes_to_samples(runtime, runtime->dma_bytes)); -+ snd_pcm_runtime_buffer_set_silence(runtime); - - runtime->oss.period_frames = snd_pcm_alsa_frames(substream, oss_period_size); - -diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c -index e40de64ec85cb5..31fc20350fd96e 100644 ---- a/sound/core/pcm_native.c -+++ b/sound/core/pcm_native.c -@@ -703,6 +703,17 @@ static void snd_pcm_buffer_access_unlock(struct snd_pcm_runtime *runtime) - atomic_inc(&runtime->buffer_accessing); - } - -+/* fill the PCM buffer with the current silence format; called from pcm_oss.c */ -+void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime) -+{ -+ snd_pcm_buffer_access_lock(runtime); -+ if (runtime->dma_area) -+ snd_pcm_format_set_silence(runtime->format, runtime->dma_area, -+ bytes_to_samples(runtime, runtime->dma_bytes)); -+ snd_pcm_buffer_access_unlock(runtime); -+} -+EXPORT_SYMBOL_GPL(snd_pcm_runtime_buffer_set_silence); -+ - #if IS_ENABLED(CONFIG_SND_PCM_OSS) - #define is_oss_stream(substream) ((substream)->oss.oss) - #else -diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c -index 49f6763c3250dd..31428cdc0f63d7 100644 ---- a/sound/core/seq/seq_clientmgr.c -+++ b/sound/core/seq/seq_clientmgr.c -@@ -1169,8 +1169,7 @@ static __poll_t snd_seq_poll(struct file *file, poll_table * wait) - if (snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_OUTPUT) { - - /* check if data is available in the pool */ -- if (!snd_seq_write_pool_allocated(client) || -- snd_seq_pool_poll_wait(client->pool, file, wait)) -+ if (snd_seq_pool_poll_wait(client->pool, file, wait)) - mask |= EPOLLOUT | EPOLLWRNORM; - } - -@@ -2584,8 +2583,6 @@ int snd_seq_kernel_client_write_poll(int clientid, struct file *file, poll_table - if (client == NULL) - return -ENXIO; - -- if (! snd_seq_write_pool_allocated(client)) -- return 1; - if (snd_seq_pool_poll_wait(client->pool, file, wait)) - return 1; - return 0; -diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c -index b603bb93f89603..692860deec0c3d 100644 ---- a/sound/core/seq/seq_memory.c -+++ b/sound/core/seq/seq_memory.c -@@ -429,6 +429,7 @@ int snd_seq_pool_poll_wait(struct snd_seq_pool *pool, struct file *file, - poll_table *wait) - { - poll_wait(file, &pool->output_sleep, wait); -+ guard(spinlock_irq)(&pool->lock); - return snd_seq_output_ok(pool); - } - -diff --git a/sound/pci/hda/hda_beep.c b/sound/pci/hda/hda_beep.c -index e63621bcb21427..1a684e47d4d189 100644 ---- a/sound/pci/hda/hda_beep.c -+++ b/sound/pci/hda/hda_beep.c -@@ -31,8 +31,9 @@ static void generate_tone(struct hda_beep *beep, int tone) - beep->power_hook(beep, true); - beep->playing = 1; - } -- snd_hda_codec_write(codec, beep->nid, 0, -- AC_VERB_SET_BEEP_CONTROL, tone); -+ if (!codec->beep_just_power_on) -+ snd_hda_codec_write(codec, beep->nid, 0, -+ AC_VERB_SET_BEEP_CONTROL, tone); - if (!tone && beep->playing) { - beep->playing = 0; - if (beep->power_hook) -@@ -212,10 +213,12 @@ int snd_hda_attach_beep_device(struct hda_codec *codec, int nid) - struct hda_beep *beep; - int err; - -- if (!snd_hda_get_bool_hint(codec, "beep")) -- return 0; /* disabled explicitly by hints */ -- if (codec->beep_mode == HDA_BEEP_MODE_OFF) -- return 0; /* disabled by module option */ -+ if (!codec->beep_just_power_on) { -+ if (!snd_hda_get_bool_hint(codec, "beep")) -+ return 0; /* disabled explicitly by hints */ -+ if (codec->beep_mode == HDA_BEEP_MODE_OFF) -+ return 0; /* disabled by module option */ -+ } - - beep = kzalloc(sizeof(*beep), GFP_KERNEL); - if (beep == NULL) -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 2f3f295f2b0cb5..440b934cdc284a 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -24,6 +24,7 @@ - #include - #include "hda_local.h" - #include "hda_auto_parser.h" -+#include "hda_beep.h" - #include "hda_jack.h" - #include "hda_generic.h" - #include "hda_component.h" -@@ -6789,6 +6790,41 @@ static void alc285_fixup_hp_spectre_x360_eb1(struct hda_codec *codec, - } - } - -+/* GPIO1 = amplifier on/off */ -+static void alc285_fixup_hp_spectre_x360_df1(struct hda_codec *codec, -+ const struct hda_fixup *fix, -+ int action) -+{ -+ struct alc_spec *spec = codec->spec; -+ static const hda_nid_t conn[] = { 0x02 }; -+ static const struct hda_pintbl pincfgs[] = { -+ { 0x14, 0x90170110 }, /* front/high speakers */ -+ { 0x17, 0x90170130 }, /* back/bass speakers */ -+ { } -+ }; -+ -+ // enable mute led -+ alc285_fixup_hp_mute_led_coefbit(codec, fix, action); -+ -+ switch (action) { -+ case HDA_FIXUP_ACT_PRE_PROBE: -+ /* needed for amp of back speakers */ -+ spec->gpio_mask |= 0x01; -+ spec->gpio_dir |= 0x01; -+ snd_hda_apply_pincfgs(codec, pincfgs); -+ /* share DAC to have unified volume control */ -+ snd_hda_override_conn_list(codec, 0x14, ARRAY_SIZE(conn), conn); -+ snd_hda_override_conn_list(codec, 0x17, ARRAY_SIZE(conn), conn); -+ break; -+ case HDA_FIXUP_ACT_INIT: -+ /* need to toggle GPIO to enable the amp of back speakers */ -+ alc_update_gpio_data(codec, 0x01, true); -+ msleep(100); -+ alc_update_gpio_data(codec, 0x01, false); -+ break; -+ } -+} -+ - static void alc285_fixup_hp_spectre_x360(struct hda_codec *codec, - const struct hda_fixup *fix, int action) - { -@@ -6861,6 +6897,30 @@ static void alc285_fixup_hp_envy_x360(struct hda_codec *codec, - } - } - -+static void alc285_fixup_hp_beep(struct hda_codec *codec, -+ const struct hda_fixup *fix, int action) -+{ -+ if (action == HDA_FIXUP_ACT_PRE_PROBE) { -+ codec->beep_just_power_on = true; -+ } else if (action == HDA_FIXUP_ACT_INIT) { -+#ifdef CONFIG_SND_HDA_INPUT_BEEP -+ /* -+ * Just enable loopback to internal speaker and headphone jack. -+ * Disable amplification to get about the same beep volume as -+ * was on pure BIOS setup before loading the driver. -+ */ -+ alc_update_coef_idx(codec, 0x36, 0x7070, BIT(13)); -+ -+ snd_hda_enable_beep_device(codec, 1); -+ -+#if !IS_ENABLED(CONFIG_INPUT_PCSPKR) -+ dev_warn_once(hda_codec_dev(codec), -+ "enable CONFIG_INPUT_PCSPKR to get PC beeps\n"); -+#endif -+#endif -+ } -+} -+ - /* for hda_fixup_thinkpad_acpi() */ - #include "thinkpad_helper.c" - -@@ -7376,6 +7436,7 @@ enum { - ALC280_FIXUP_HP_9480M, - ALC245_FIXUP_HP_X360_AMP, - ALC285_FIXUP_HP_SPECTRE_X360_EB1, -+ ALC285_FIXUP_HP_SPECTRE_X360_DF1, - ALC285_FIXUP_HP_ENVY_X360, - ALC288_FIXUP_DELL_HEADSET_MODE, - ALC288_FIXUP_DELL1_MIC_NO_PRESENCE, -@@ -7477,6 +7538,7 @@ enum { - ALC285_FIXUP_HP_GPIO_LED, - ALC285_FIXUP_HP_MUTE_LED, - ALC285_FIXUP_HP_SPECTRE_X360_MUTE_LED, -+ ALC285_FIXUP_HP_BEEP_MICMUTE_LED, - ALC236_FIXUP_HP_MUTE_LED_COEFBIT2, - ALC236_FIXUP_HP_GPIO_LED, - ALC236_FIXUP_HP_MUTE_LED, -@@ -9064,6 +9126,12 @@ static const struct hda_fixup alc269_fixups[] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc285_fixup_hp_spectre_x360_mute_led, - }, -+ [ALC285_FIXUP_HP_BEEP_MICMUTE_LED] = { -+ .type = HDA_FIXUP_FUNC, -+ .v.func = alc285_fixup_hp_beep, -+ .chained = true, -+ .chain_id = ALC285_FIXUP_HP_MUTE_LED, -+ }, - [ALC236_FIXUP_HP_MUTE_LED_COEFBIT2] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc236_fixup_hp_mute_led_coefbit2, -@@ -9407,6 +9475,10 @@ static const struct hda_fixup alc269_fixups[] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc285_fixup_hp_spectre_x360_eb1 - }, -+ [ALC285_FIXUP_HP_SPECTRE_X360_DF1] = { -+ .type = HDA_FIXUP_FUNC, -+ .v.func = alc285_fixup_hp_spectre_x360_df1 -+ }, - [ALC285_FIXUP_HP_ENVY_X360] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc285_fixup_hp_envy_x360, -@@ -10006,6 +10078,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x86c1, "HP Laptop 15-da3001TU", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), - SND_PCI_QUIRK(0x103c, 0x86c7, "HP Envy AiO 32", ALC274_FIXUP_HP_ENVY_GPIO), - SND_PCI_QUIRK(0x103c, 0x86e7, "HP Spectre x360 15-eb0xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1), -+ SND_PCI_QUIRK(0x103c, 0x863e, "HP Spectre x360 15-df1xxx", ALC285_FIXUP_HP_SPECTRE_X360_DF1), - SND_PCI_QUIRK(0x103c, 0x86e8, "HP Spectre x360 15-eb0xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1), - SND_PCI_QUIRK(0x103c, 0x86f9, "HP Spectre x360 13-aw0xxx", ALC285_FIXUP_HP_SPECTRE_X360_MUTE_LED), - SND_PCI_QUIRK(0x103c, 0x8716, "HP Elite Dragonfly G2 Notebook PC", ALC285_FIXUP_HP_GPIO_AMP_INIT), -@@ -10016,7 +10089,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x8730, "HP ProBook 445 G7", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), - SND_PCI_QUIRK(0x103c, 0x8735, "HP ProBook 435 G7", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), - SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_AMP_INIT), -- SND_PCI_QUIRK(0x103c, 0x8760, "HP", ALC285_FIXUP_HP_MUTE_LED), -+ SND_PCI_QUIRK(0x103c, 0x8760, "HP EliteBook 8{4,5}5 G7", ALC285_FIXUP_HP_BEEP_MICMUTE_LED), - SND_PCI_QUIRK(0x103c, 0x876e, "HP ENVY x360 Convertible 13-ay0xxx", ALC245_FIXUP_HP_X360_MUTE_LEDS), - SND_PCI_QUIRK(0x103c, 0x877a, "HP", ALC285_FIXUP_HP_MUTE_LED), - SND_PCI_QUIRK(0x103c, 0x877d, "HP", ALC236_FIXUP_HP_MUTE_LED), -@@ -10501,6 +10574,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x17aa, 0x38f9, "Thinkbook 16P Gen5", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x17aa, 0x38fa, "Thinkbook 16P Gen5", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), -+ SND_PCI_QUIRK(0x17aa, 0x390d, "Lenovo Yoga Pro 7 14ASP10", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN), - SND_PCI_QUIRK(0x17aa, 0x3913, "Lenovo 145", ALC236_FIXUP_LENOVO_INV_DMIC), - SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), - SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI), -@@ -10754,6 +10828,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { - {.id = ALC295_FIXUP_HP_OMEN, .name = "alc295-hp-omen"}, - {.id = ALC285_FIXUP_HP_SPECTRE_X360, .name = "alc285-hp-spectre-x360"}, - {.id = ALC285_FIXUP_HP_SPECTRE_X360_EB1, .name = "alc285-hp-spectre-x360-eb1"}, -+ {.id = ALC285_FIXUP_HP_SPECTRE_X360_DF1, .name = "alc285-hp-spectre-x360-df1"}, - {.id = ALC285_FIXUP_HP_ENVY_X360, .name = "alc285-hp-envy-x360"}, - {.id = ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP, .name = "alc287-ideapad-bass-spk-amp"}, - {.id = ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN, .name = "alc287-yoga9-bass-spk-pin"}, -diff --git a/sound/soc/codecs/cs42l43-jack.c b/sound/soc/codecs/cs42l43-jack.c -index 0b8e88b19888ec..6d8455c1bee6d8 100644 ---- a/sound/soc/codecs/cs42l43-jack.c -+++ b/sound/soc/codecs/cs42l43-jack.c -@@ -642,6 +642,10 @@ static int cs42l43_run_type_detect(struct cs42l43_codec *priv) - - reinit_completion(&priv->type_detect); - -+ regmap_update_bits(cs42l43->regmap, CS42L43_STEREO_MIC_CLAMP_CTRL, -+ CS42L43_SMIC_HPAMP_CLAMP_DIS_FRC_VAL_MASK, -+ CS42L43_SMIC_HPAMP_CLAMP_DIS_FRC_VAL_MASK); -+ - cs42l43_start_hs_bias(priv, true); - regmap_update_bits(cs42l43->regmap, CS42L43_HS2, - CS42L43_HSDET_MODE_MASK, 0x3 << CS42L43_HSDET_MODE_SHIFT); -@@ -653,6 +657,9 @@ static int cs42l43_run_type_detect(struct cs42l43_codec *priv) - CS42L43_HSDET_MODE_MASK, 0x2 << CS42L43_HSDET_MODE_SHIFT); - cs42l43_stop_hs_bias(priv); - -+ regmap_update_bits(cs42l43->regmap, CS42L43_STEREO_MIC_CLAMP_CTRL, -+ CS42L43_SMIC_HPAMP_CLAMP_DIS_FRC_VAL_MASK, 0); -+ - if (!time_left) - return -ETIMEDOUT; - -diff --git a/sound/soc/codecs/mt6359-accdet.h b/sound/soc/codecs/mt6359-accdet.h -index c234f2f4276a12..78ada3a5bfae55 100644 ---- a/sound/soc/codecs/mt6359-accdet.h -+++ b/sound/soc/codecs/mt6359-accdet.h -@@ -123,6 +123,15 @@ struct mt6359_accdet { - struct workqueue_struct *jd_workqueue; - }; - -+#if IS_ENABLED(CONFIG_SND_SOC_MT6359_ACCDET) - int mt6359_accdet_enable_jack_detect(struct snd_soc_component *component, - struct snd_soc_jack *jack); -+#else -+static inline int -+mt6359_accdet_enable_jack_detect(struct snd_soc_component *component, -+ struct snd_soc_jack *jack) -+{ -+ return -EOPNOTSUPP; -+} -+#endif - #endif -diff --git a/sound/soc/codecs/pcm3168a.c b/sound/soc/codecs/pcm3168a.c -index 9d6431338fb715..329549936bd5c3 100644 ---- a/sound/soc/codecs/pcm3168a.c -+++ b/sound/soc/codecs/pcm3168a.c -@@ -494,9 +494,9 @@ static int pcm3168a_hw_params(struct snd_pcm_substream *substream, - } - break; - case 24: -- if (provider_mode || (format == SND_SOC_DAIFMT_DSP_A) || -- (format == SND_SOC_DAIFMT_DSP_B)) { -- dev_err(component->dev, "24-bit slots not supported in provider mode, or consumer mode using DSP\n"); -+ if (!provider_mode && ((format == SND_SOC_DAIFMT_DSP_A) || -+ (format == SND_SOC_DAIFMT_DSP_B))) { -+ dev_err(component->dev, "24-bit slots not supported in consumer mode using DSP\n"); - return -EINVAL; - } - break; -diff --git a/sound/soc/codecs/rt722-sdca-sdw.c b/sound/soc/codecs/rt722-sdca-sdw.c -index c382cb6be60256..c0bb1b4b2dcb59 100644 ---- a/sound/soc/codecs/rt722-sdca-sdw.c -+++ b/sound/soc/codecs/rt722-sdca-sdw.c -@@ -28,9 +28,50 @@ static bool rt722_sdca_readable_register(struct device *dev, unsigned int reg) - 0): - case SDW_SDCA_CTL(FUNC_NUM_JACK_CODEC, RT722_SDCA_ENT_GE49, RT722_SDCA_CTL_DETECTED_MODE, - 0): -- case SDW_SDCA_CTL(FUNC_NUM_HID, RT722_SDCA_ENT_HID01, RT722_SDCA_CTL_HIDTX_CURRENT_OWNER, -- 0) ... SDW_SDCA_CTL(FUNC_NUM_HID, RT722_SDCA_ENT_HID01, -- RT722_SDCA_CTL_HIDTX_MESSAGE_LENGTH, 0): -+ case SDW_SDCA_CTL(FUNC_NUM_JACK_CODEC, RT722_SDCA_ENT_XU03, RT722_SDCA_CTL_SELECTED_MODE, -+ 0): -+ case SDW_SDCA_CTL(FUNC_NUM_JACK_CODEC, RT722_SDCA_ENT_USER_FU05, -+ RT722_SDCA_CTL_FU_MUTE, CH_L) ... -+ SDW_SDCA_CTL(FUNC_NUM_JACK_CODEC, RT722_SDCA_ENT_USER_FU05, -+ RT722_SDCA_CTL_FU_MUTE, CH_R): -+ case SDW_SDCA_CTL(FUNC_NUM_JACK_CODEC, RT722_SDCA_ENT_XU0D, -+ RT722_SDCA_CTL_SELECTED_MODE, 0): -+ case SDW_SDCA_CTL(FUNC_NUM_JACK_CODEC, RT722_SDCA_ENT_USER_FU0F, -+ RT722_SDCA_CTL_FU_MUTE, CH_L) ... -+ SDW_SDCA_CTL(FUNC_NUM_JACK_CODEC, RT722_SDCA_ENT_USER_FU0F, -+ RT722_SDCA_CTL_FU_MUTE, CH_R): -+ case SDW_SDCA_CTL(FUNC_NUM_JACK_CODEC, RT722_SDCA_ENT_PDE40, -+ RT722_SDCA_CTL_REQ_POWER_STATE, 0): -+ case SDW_SDCA_CTL(FUNC_NUM_JACK_CODEC, RT722_SDCA_ENT_PDE12, -+ RT722_SDCA_CTL_REQ_POWER_STATE, 0): -+ case SDW_SDCA_CTL(FUNC_NUM_JACK_CODEC, RT722_SDCA_ENT_CS01, -+ RT722_SDCA_CTL_SAMPLE_FREQ_INDEX, 0): -+ case SDW_SDCA_CTL(FUNC_NUM_JACK_CODEC, RT722_SDCA_ENT_CS11, -+ RT722_SDCA_CTL_SAMPLE_FREQ_INDEX, 0): -+ case SDW_SDCA_CTL(FUNC_NUM_MIC_ARRAY, RT722_SDCA_ENT_USER_FU1E, -+ RT722_SDCA_CTL_FU_MUTE, CH_01) ... -+ SDW_SDCA_CTL(FUNC_NUM_MIC_ARRAY, RT722_SDCA_ENT_USER_FU1E, -+ RT722_SDCA_CTL_FU_MUTE, CH_04): -+ case SDW_SDCA_CTL(FUNC_NUM_MIC_ARRAY, RT722_SDCA_ENT_IT26, -+ RT722_SDCA_CTL_VENDOR_DEF, 0): -+ case SDW_SDCA_CTL(FUNC_NUM_MIC_ARRAY, RT722_SDCA_ENT_PDE2A, -+ RT722_SDCA_CTL_REQ_POWER_STATE, 0): -+ case SDW_SDCA_CTL(FUNC_NUM_MIC_ARRAY, RT722_SDCA_ENT_CS1F, -+ RT722_SDCA_CTL_SAMPLE_FREQ_INDEX, 0): -+ case SDW_SDCA_CTL(FUNC_NUM_HID, RT722_SDCA_ENT_HID01, -+ RT722_SDCA_CTL_HIDTX_CURRENT_OWNER, 0) ... -+ SDW_SDCA_CTL(FUNC_NUM_HID, RT722_SDCA_ENT_HID01, -+ RT722_SDCA_CTL_HIDTX_MESSAGE_LENGTH, 0): -+ case SDW_SDCA_CTL(FUNC_NUM_AMP, RT722_SDCA_ENT_USER_FU06, -+ RT722_SDCA_CTL_FU_MUTE, CH_L) ... -+ SDW_SDCA_CTL(FUNC_NUM_AMP, RT722_SDCA_ENT_USER_FU06, -+ RT722_SDCA_CTL_FU_MUTE, CH_R): -+ case SDW_SDCA_CTL(FUNC_NUM_AMP, RT722_SDCA_ENT_OT23, -+ RT722_SDCA_CTL_VENDOR_DEF, CH_08): -+ case SDW_SDCA_CTL(FUNC_NUM_AMP, RT722_SDCA_ENT_PDE23, -+ RT722_SDCA_CTL_REQ_POWER_STATE, 0): -+ case SDW_SDCA_CTL(FUNC_NUM_AMP, RT722_SDCA_ENT_CS31, -+ RT722_SDCA_CTL_SAMPLE_FREQ_INDEX, 0): - case RT722_BUF_ADDR_HID1 ... RT722_BUF_ADDR_HID2: - return true; - default: -@@ -74,6 +115,7 @@ static bool rt722_sdca_mbq_readable_register(struct device *dev, unsigned int re - case 0x5600000 ... 0x5600007: - case 0x5700000 ... 0x5700004: - case 0x5800000 ... 0x5800004: -+ case 0x5810000: - case 0x5b00003: - case 0x5c00011: - case 0x5d00006: -@@ -81,6 +123,7 @@ static bool rt722_sdca_mbq_readable_register(struct device *dev, unsigned int re - case 0x5f00030: - case 0x6100000 ... 0x6100051: - case 0x6100055 ... 0x6100057: -+ case 0x6100060: - case 0x6100062: - case 0x6100064 ... 0x6100065: - case 0x6100067: -diff --git a/sound/soc/codecs/tas2764.c b/sound/soc/codecs/tas2764.c -index e87a07eee97377..72d6356b898148 100644 ---- a/sound/soc/codecs/tas2764.c -+++ b/sound/soc/codecs/tas2764.c -@@ -182,33 +182,6 @@ static SOC_ENUM_SINGLE_DECL( - static const struct snd_kcontrol_new tas2764_asi1_mux = - SOC_DAPM_ENUM("ASI1 Source", tas2764_ASI1_src_enum); - --static int tas2764_dac_event(struct snd_soc_dapm_widget *w, -- struct snd_kcontrol *kcontrol, int event) --{ -- struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm); -- struct tas2764_priv *tas2764 = snd_soc_component_get_drvdata(component); -- int ret; -- -- switch (event) { -- case SND_SOC_DAPM_POST_PMU: -- tas2764->dac_powered = true; -- ret = tas2764_update_pwr_ctrl(tas2764); -- break; -- case SND_SOC_DAPM_PRE_PMD: -- tas2764->dac_powered = false; -- ret = tas2764_update_pwr_ctrl(tas2764); -- break; -- default: -- dev_err(tas2764->dev, "Unsupported event\n"); -- return -EINVAL; -- } -- -- if (ret < 0) -- return ret; -- -- return 0; --} -- - static const struct snd_kcontrol_new isense_switch = - SOC_DAPM_SINGLE("Switch", TAS2764_PWR_CTRL, TAS2764_ISENSE_POWER_EN, 1, 1); - static const struct snd_kcontrol_new vsense_switch = -@@ -221,8 +194,7 @@ static const struct snd_soc_dapm_widget tas2764_dapm_widgets[] = { - 1, &isense_switch), - SND_SOC_DAPM_SWITCH("VSENSE", TAS2764_PWR_CTRL, TAS2764_VSENSE_POWER_EN, - 1, &vsense_switch), -- SND_SOC_DAPM_DAC_E("DAC", NULL, SND_SOC_NOPM, 0, 0, tas2764_dac_event, -- SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD), -+ SND_SOC_DAPM_DAC("DAC", NULL, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_OUTPUT("OUT"), - SND_SOC_DAPM_SIGGEN("VMON"), - SND_SOC_DAPM_SIGGEN("IMON") -@@ -243,9 +215,28 @@ static int tas2764_mute(struct snd_soc_dai *dai, int mute, int direction) - { - struct tas2764_priv *tas2764 = - snd_soc_component_get_drvdata(dai->component); -+ int ret; -+ -+ if (!mute) { -+ tas2764->dac_powered = true; -+ ret = tas2764_update_pwr_ctrl(tas2764); -+ if (ret) -+ return ret; -+ } - - tas2764->unmuted = !mute; -- return tas2764_update_pwr_ctrl(tas2764); -+ ret = tas2764_update_pwr_ctrl(tas2764); -+ if (ret) -+ return ret; -+ -+ if (mute) { -+ tas2764->dac_powered = false; -+ ret = tas2764_update_pwr_ctrl(tas2764); -+ if (ret) -+ return ret; -+ } -+ -+ return 0; - } - - static int tas2764_set_bitwidth(struct tas2764_priv *tas2764, int bitwidth) -@@ -636,6 +627,7 @@ static const struct reg_default tas2764_reg_defaults[] = { - { TAS2764_TDM_CFG2, 0x0a }, - { TAS2764_TDM_CFG3, 0x10 }, - { TAS2764_TDM_CFG5, 0x42 }, -+ { TAS2764_INT_CLK_CFG, 0x19 }, - }; - - static const struct regmap_range_cfg tas2764_regmap_ranges[] = { -@@ -653,6 +645,7 @@ static const struct regmap_range_cfg tas2764_regmap_ranges[] = { - static bool tas2764_volatile_register(struct device *dev, unsigned int reg) - { - switch (reg) { -+ case TAS2764_SW_RST: - case TAS2764_INT_LTCH0 ... TAS2764_INT_LTCH4: - case TAS2764_INT_CLK_CFG: - return true; -diff --git a/sound/soc/fsl/imx-card.c b/sound/soc/fsl/imx-card.c -index 7128bcf3a743e1..bb304de5cc38a3 100644 ---- a/sound/soc/fsl/imx-card.c -+++ b/sound/soc/fsl/imx-card.c -@@ -517,7 +517,7 @@ static int imx_card_parse_of(struct imx_card_data *data) - if (!card->dai_link) - return -ENOMEM; - -- data->link_data = devm_kcalloc(dev, num_links, sizeof(*link), GFP_KERNEL); -+ data->link_data = devm_kcalloc(dev, num_links, sizeof(*link_data), GFP_KERNEL); - if (!data->link_data) - return -ENOMEM; - -diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c -index ce80adc30fe946..6a85e8fdcae646 100644 ---- a/sound/soc/intel/boards/bytcr_rt5640.c -+++ b/sound/soc/intel/boards/bytcr_rt5640.c -@@ -576,6 +576,19 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { - BYT_RT5640_SSP0_AIF2 | - BYT_RT5640_MCLK_EN), - }, -+ { /* Acer Aspire SW3-013 */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire SW3-013"), -+ }, -+ .driver_data = (void *)(BYT_RT5640_DMIC1_MAP | -+ BYT_RT5640_JD_SRC_JD2_IN4N | -+ BYT_RT5640_OVCD_TH_2000UA | -+ BYT_RT5640_OVCD_SF_0P75 | -+ BYT_RT5640_DIFF_MIC | -+ BYT_RT5640_SSP0_AIF1 | -+ BYT_RT5640_MCLK_EN), -+ }, - { - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "Acer"), -diff --git a/sound/soc/mediatek/mt8188/mt8188-afe-clk.c b/sound/soc/mediatek/mt8188/mt8188-afe-clk.c -index e69c1bb2cb2395..7f411b85778237 100644 ---- a/sound/soc/mediatek/mt8188/mt8188-afe-clk.c -+++ b/sound/soc/mediatek/mt8188/mt8188-afe-clk.c -@@ -58,7 +58,15 @@ static const char *aud_clks[MT8188_CLK_NUM] = { - [MT8188_CLK_AUD_ADC] = "aud_adc", - [MT8188_CLK_AUD_DAC_HIRES] = "aud_dac_hires", - [MT8188_CLK_AUD_A1SYS_HP] = "aud_a1sys_hp", -+ [MT8188_CLK_AUD_AFE_DMIC1] = "aud_afe_dmic1", -+ [MT8188_CLK_AUD_AFE_DMIC2] = "aud_afe_dmic2", -+ [MT8188_CLK_AUD_AFE_DMIC3] = "aud_afe_dmic3", -+ [MT8188_CLK_AUD_AFE_DMIC4] = "aud_afe_dmic4", - [MT8188_CLK_AUD_ADC_HIRES] = "aud_adc_hires", -+ [MT8188_CLK_AUD_DMIC_HIRES1] = "aud_dmic_hires1", -+ [MT8188_CLK_AUD_DMIC_HIRES2] = "aud_dmic_hires2", -+ [MT8188_CLK_AUD_DMIC_HIRES3] = "aud_dmic_hires3", -+ [MT8188_CLK_AUD_DMIC_HIRES4] = "aud_dmic_hires4", - [MT8188_CLK_AUD_I2SIN] = "aud_i2sin", - [MT8188_CLK_AUD_TDM_IN] = "aud_tdm_in", - [MT8188_CLK_AUD_I2S_OUT] = "aud_i2s_out", -diff --git a/sound/soc/mediatek/mt8188/mt8188-afe-clk.h b/sound/soc/mediatek/mt8188/mt8188-afe-clk.h -index ec53c171c170a8..c6c78d684f3ee1 100644 ---- a/sound/soc/mediatek/mt8188/mt8188-afe-clk.h -+++ b/sound/soc/mediatek/mt8188/mt8188-afe-clk.h -@@ -54,7 +54,15 @@ enum { - MT8188_CLK_AUD_ADC, - MT8188_CLK_AUD_DAC_HIRES, - MT8188_CLK_AUD_A1SYS_HP, -+ MT8188_CLK_AUD_AFE_DMIC1, -+ MT8188_CLK_AUD_AFE_DMIC2, -+ MT8188_CLK_AUD_AFE_DMIC3, -+ MT8188_CLK_AUD_AFE_DMIC4, - MT8188_CLK_AUD_ADC_HIRES, -+ MT8188_CLK_AUD_DMIC_HIRES1, -+ MT8188_CLK_AUD_DMIC_HIRES2, -+ MT8188_CLK_AUD_DMIC_HIRES3, -+ MT8188_CLK_AUD_DMIC_HIRES4, - MT8188_CLK_AUD_I2SIN, - MT8188_CLK_AUD_TDM_IN, - MT8188_CLK_AUD_I2S_OUT, -diff --git a/sound/soc/mediatek/mt8188/mt8188-afe-pcm.c b/sound/soc/mediatek/mt8188/mt8188-afe-pcm.c -index 11f30b183520ff..4a304bffef8bab 100644 ---- a/sound/soc/mediatek/mt8188/mt8188-afe-pcm.c -+++ b/sound/soc/mediatek/mt8188/mt8188-afe-pcm.c -@@ -2855,10 +2855,6 @@ static bool mt8188_is_volatile_reg(struct device *dev, unsigned int reg) - case AFE_DMIC3_SRC_DEBUG_MON0: - case AFE_DMIC3_UL_SRC_MON0: - case AFE_DMIC3_UL_SRC_MON1: -- case DMIC_GAIN1_CUR: -- case DMIC_GAIN2_CUR: -- case DMIC_GAIN3_CUR: -- case DMIC_GAIN4_CUR: - case ETDM_IN1_MONITOR: - case ETDM_IN2_MONITOR: - case ETDM_OUT1_MONITOR: -diff --git a/sound/soc/qcom/sm8250.c b/sound/soc/qcom/sm8250.c -index 88a7169336d61f..580eb20b0771a8 100644 ---- a/sound/soc/qcom/sm8250.c -+++ b/sound/soc/qcom/sm8250.c -@@ -7,6 +7,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -39,9 +40,11 @@ static int sm8250_be_hw_params_fixup(struct snd_soc_pcm_runtime *rtd, - SNDRV_PCM_HW_PARAM_RATE); - struct snd_interval *channels = hw_param_interval(params, - SNDRV_PCM_HW_PARAM_CHANNELS); -+ struct snd_mask *fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT); - - rate->min = rate->max = 48000; - channels->min = channels->max = 2; -+ snd_mask_set_format(fmt, SNDRV_PCM_FORMAT_S16_LE); - - return 0; - } -diff --git a/sound/soc/soc-dai.c b/sound/soc/soc-dai.c -index 9a828e55c4f9e7..507743c87e402d 100644 ---- a/sound/soc/soc-dai.c -+++ b/sound/soc/soc-dai.c -@@ -275,10 +275,11 @@ int snd_soc_dai_set_tdm_slot(struct snd_soc_dai *dai, - - if (dai->driver->ops && - dai->driver->ops->xlate_tdm_slot_mask) -- dai->driver->ops->xlate_tdm_slot_mask(slots, -- &tx_mask, &rx_mask); -+ ret = dai->driver->ops->xlate_tdm_slot_mask(slots, &tx_mask, &rx_mask); - else -- snd_soc_xlate_tdm_slot_mask(slots, &tx_mask, &rx_mask); -+ ret = snd_soc_xlate_tdm_slot_mask(slots, &tx_mask, &rx_mask); -+ if (ret) -+ goto err; - - for_each_pcm_streams(stream) - snd_soc_dai_tdm_mask_set(dai, stream, *tdm_mask[stream]); -@@ -287,6 +288,7 @@ int snd_soc_dai_set_tdm_slot(struct snd_soc_dai *dai, - dai->driver->ops->set_tdm_slot) - ret = dai->driver->ops->set_tdm_slot(dai, tx_mask, rx_mask, - slots, slot_width); -+err: - return soc_dai_ret(dai, ret); - } - EXPORT_SYMBOL_GPL(snd_soc_dai_set_tdm_slot); -diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c -index b4cfc34d00ee63..eff1355cc3df00 100644 ---- a/sound/soc/soc-ops.c -+++ b/sound/soc/soc-ops.c -@@ -638,6 +638,33 @@ int snd_soc_get_volsw_range(struct snd_kcontrol *kcontrol, - } - EXPORT_SYMBOL_GPL(snd_soc_get_volsw_range); - -+static int snd_soc_clip_to_platform_max(struct snd_kcontrol *kctl) -+{ -+ struct soc_mixer_control *mc = (struct soc_mixer_control *)kctl->private_value; -+ struct snd_ctl_elem_value uctl; -+ int ret; -+ -+ if (!mc->platform_max) -+ return 0; -+ -+ ret = kctl->get(kctl, &uctl); -+ if (ret < 0) -+ return ret; -+ -+ if (uctl.value.integer.value[0] > mc->platform_max) -+ uctl.value.integer.value[0] = mc->platform_max; -+ -+ if (snd_soc_volsw_is_stereo(mc) && -+ uctl.value.integer.value[1] > mc->platform_max) -+ uctl.value.integer.value[1] = mc->platform_max; -+ -+ ret = kctl->put(kctl, &uctl); -+ if (ret < 0) -+ return ret; -+ -+ return 0; -+} -+ - /** - * snd_soc_limit_volume - Set new limit to an existing volume control. - * -@@ -662,7 +689,7 @@ int snd_soc_limit_volume(struct snd_soc_card *card, - struct soc_mixer_control *mc = (struct soc_mixer_control *)kctl->private_value; - if (max <= mc->max - mc->min) { - mc->platform_max = max; -- ret = 0; -+ ret = snd_soc_clip_to_platform_max(kctl); - } - } - return ret; -diff --git a/sound/soc/sof/ipc4-control.c b/sound/soc/sof/ipc4-control.c -index b4cdcec33e1209..84145209dec493 100644 ---- a/sound/soc/sof/ipc4-control.c -+++ b/sound/soc/sof/ipc4-control.c -@@ -483,6 +483,14 @@ static int sof_ipc4_bytes_ext_put(struct snd_sof_control *scontrol, - return -EINVAL; - } - -+ /* Check header id */ -+ if (header.numid != SOF_CTRL_CMD_BINARY) { -+ dev_err_ratelimited(scomp->dev, -+ "Incorrect numid for bytes put %d\n", -+ header.numid); -+ return -EINVAL; -+ } -+ - /* Verify the ABI header first */ - if (copy_from_user(&abi_hdr, tlvd->tlv, sizeof(abi_hdr))) - return -EFAULT; -@@ -565,7 +573,8 @@ static int _sof_ipc4_bytes_ext_get(struct snd_sof_control *scontrol, - if (data_size > size) - return -ENOSPC; - -- header.numid = scontrol->comp_id; -+ /* Set header id and length */ -+ header.numid = SOF_CTRL_CMD_BINARY; - header.length = data_size; - - if (copy_to_user(tlvd, &header, sizeof(struct snd_ctl_tlv))) -diff --git a/sound/soc/sof/ipc4-pcm.c b/sound/soc/sof/ipc4-pcm.c -index e8acf60c27a743..bb5df0d214e367 100644 ---- a/sound/soc/sof/ipc4-pcm.c -+++ b/sound/soc/sof/ipc4-pcm.c -@@ -621,7 +621,8 @@ static int sof_ipc4_pcm_setup(struct snd_sof_dev *sdev, struct snd_sof_pcm *spcm - return -ENOMEM; - } - -- if (!support_info) -+ /* Delay reporting is only supported on playback */ -+ if (!support_info || stream == SNDRV_PCM_STREAM_CAPTURE) - continue; - - stream_info = kzalloc(sizeof(*stream_info), GFP_KERNEL); -diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c -index 7afded323150c8..c18a1fdd40ee38 100644 ---- a/sound/soc/sof/topology.c -+++ b/sound/soc/sof/topology.c -@@ -1057,7 +1057,7 @@ static int sof_connect_dai_widget(struct snd_soc_component *scomp, - struct snd_sof_dai *dai) - { - struct snd_soc_card *card = scomp->card; -- struct snd_soc_pcm_runtime *rtd; -+ struct snd_soc_pcm_runtime *rtd, *full, *partial; - struct snd_soc_dai *cpu_dai; - int stream; - int i; -@@ -1074,12 +1074,22 @@ static int sof_connect_dai_widget(struct snd_soc_component *scomp, - else - goto end; - -+ full = NULL; -+ partial = NULL; - list_for_each_entry(rtd, &card->rtd_list, list) { - /* does stream match DAI link ? */ -- if (!rtd->dai_link->stream_name || -- !strstr(rtd->dai_link->stream_name, w->sname)) -- continue; -+ if (rtd->dai_link->stream_name) { -+ if (!strcmp(rtd->dai_link->stream_name, w->sname)) { -+ full = rtd; -+ break; -+ } else if (strstr(rtd->dai_link->stream_name, w->sname)) { -+ partial = rtd; -+ } -+ } -+ } - -+ rtd = full ? full : partial; -+ if (rtd) { - for_each_rtd_cpu_dais(rtd, i, cpu_dai) { - /* - * Please create DAI widget in the right order -diff --git a/sound/soc/sunxi/sun4i-codec.c b/sound/soc/sunxi/sun4i-codec.c -index f0a5fd90110182..0d7758cc84c638 100644 ---- a/sound/soc/sunxi/sun4i-codec.c -+++ b/sound/soc/sunxi/sun4i-codec.c -@@ -25,6 +25,7 @@ - #include - - #include -+#include - #include - #include - #include -@@ -239,6 +240,7 @@ struct sun4i_codec { - struct clk *clk_module; - struct reset_control *rst; - struct gpio_desc *gpio_pa; -+ struct gpio_desc *gpio_hp; - - /* ADC_FIFOC register is at different offset on different SoCs */ - struct regmap_field *reg_adc_fifoc; -@@ -1277,6 +1279,49 @@ static struct snd_soc_dai_driver dummy_cpu_dai = { - .ops = &dummy_dai_ops, - }; - -+static struct snd_soc_jack sun4i_headphone_jack; -+ -+static struct snd_soc_jack_pin sun4i_headphone_jack_pins[] = { -+ { .pin = "Headphone", .mask = SND_JACK_HEADPHONE }, -+}; -+ -+static struct snd_soc_jack_gpio sun4i_headphone_jack_gpio = { -+ .name = "hp-det", -+ .report = SND_JACK_HEADPHONE, -+ .debounce_time = 150, -+}; -+ -+static int sun4i_codec_machine_init(struct snd_soc_pcm_runtime *rtd) -+{ -+ struct snd_soc_card *card = rtd->card; -+ struct sun4i_codec *scodec = snd_soc_card_get_drvdata(card); -+ int ret; -+ -+ if (scodec->gpio_hp) { -+ ret = snd_soc_card_jack_new_pins(card, "Headphone Jack", -+ SND_JACK_HEADPHONE, -+ &sun4i_headphone_jack, -+ sun4i_headphone_jack_pins, -+ ARRAY_SIZE(sun4i_headphone_jack_pins)); -+ if (ret) { -+ dev_err(rtd->dev, -+ "Headphone jack creation failed: %d\n", ret); -+ return ret; -+ } -+ -+ sun4i_headphone_jack_gpio.desc = scodec->gpio_hp; -+ ret = snd_soc_jack_add_gpios(&sun4i_headphone_jack, 1, -+ &sun4i_headphone_jack_gpio); -+ -+ if (ret) { -+ dev_err(rtd->dev, "Headphone GPIO not added: %d\n", ret); -+ return ret; -+ } -+ } -+ -+ return 0; -+} -+ - static struct snd_soc_dai_link *sun4i_codec_create_link(struct device *dev, - int *num_links) - { -@@ -1302,6 +1347,7 @@ static struct snd_soc_dai_link *sun4i_codec_create_link(struct device *dev, - link->codecs->name = dev_name(dev); - link->platforms->name = dev_name(dev); - link->dai_fmt = SND_SOC_DAIFMT_I2S; -+ link->init = sun4i_codec_machine_init; - - *num_links = 1; - -@@ -1742,6 +1788,13 @@ static int sun4i_codec_probe(struct platform_device *pdev) - return ret; - } - -+ scodec->gpio_hp = devm_gpiod_get_optional(&pdev->dev, "hp-det", GPIOD_IN); -+ if (IS_ERR(scodec->gpio_hp)) { -+ ret = PTR_ERR(scodec->gpio_hp); -+ dev_err_probe(&pdev->dev, ret, "Failed to get hp-det gpio\n"); -+ return ret; -+ } -+ - /* reg_field setup */ - scodec->reg_adc_fifoc = devm_regmap_field_alloc(&pdev->dev, - scodec->regmap, -diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c -index 9b75639434b815..0a764426d93586 100644 ---- a/tools/bpf/bpftool/common.c -+++ b/tools/bpf/bpftool/common.c -@@ -461,10 +461,11 @@ int get_fd_type(int fd) - p_err("can't read link type: %s", strerror(errno)); - return -1; - } -- if (n == sizeof(path)) { -+ if (n == sizeof(buf)) { - p_err("can't read link type: path too long!"); - return -1; - } -+ buf[n] = '\0'; - - if (strstr(buf, "bpf-map")) - return BPF_OBJ_MAP; -diff --git a/tools/build/Makefile.build b/tools/build/Makefile.build -index fac42486a8cf0b..27f4ee9cb4db4a 100644 ---- a/tools/build/Makefile.build -+++ b/tools/build/Makefile.build -@@ -141,6 +141,10 @@ objprefix := $(subst ./,,$(OUTPUT)$(dir)/) - obj-y := $(addprefix $(objprefix),$(obj-y)) - subdir-obj-y := $(addprefix $(objprefix),$(subdir-obj-y)) - -+# Separate out test log files from real build objects. -+test-y := $(filter %_log, $(obj-y)) -+obj-y := $(filter-out %_log, $(obj-y)) -+ - # Final '$(obj)-in.o' object - in-target := $(objprefix)$(obj)-in.o - -@@ -151,7 +155,7 @@ $(subdir-y): - - $(sort $(subdir-obj-y)): $(subdir-y) ; - --$(in-target): $(obj-y) FORCE -+$(in-target): $(obj-y) $(test-y) FORCE - $(call rule_mkdir) - $(call if_changed,$(host)ld_multi) - -diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h -index 977ec094bc2a6c..2a90f04a4160db 100644 ---- a/tools/include/uapi/linux/bpf.h -+++ b/tools/include/uapi/linux/bpf.h -@@ -1140,6 +1140,7 @@ enum bpf_perf_event_type { - #define BPF_F_BEFORE (1U << 3) - #define BPF_F_AFTER (1U << 4) - #define BPF_F_ID (1U << 5) -+#define BPF_F_PREORDER (1U << 6) - #define BPF_F_LINK BPF_F_LINK /* 1 << 13 */ - - /* If BPF_F_STRICT_ALIGNMENT is used in BPF_PROG_LOAD command, the -diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c -index 2fad178949efe9..fa2abe56e845d9 100644 ---- a/tools/lib/bpf/libbpf.c -+++ b/tools/lib/bpf/libbpf.c -@@ -1802,7 +1802,7 @@ static int set_kcfg_value_str(struct extern_desc *ext, char *ext_val, - } - - len = strlen(value); -- if (value[len - 1] != '"') { -+ if (len < 2 || value[len - 1] != '"') { - pr_warn("extern (kcfg) '%s': invalid string config '%s'\n", - ext->name, value); - return -EINVAL; -diff --git a/tools/net/ynl/lib/ynl.c b/tools/net/ynl/lib/ynl.c -index ae61ae5b02bf88..0871f86c6b6666 100644 ---- a/tools/net/ynl/lib/ynl.c -+++ b/tools/net/ynl/lib/ynl.c -@@ -368,7 +368,7 @@ int ynl_attr_validate(struct ynl_parse_arg *yarg, const struct nlattr *attr) - "Invalid attribute (binary %s)", policy->name); - return -1; - case YNL_PT_NUL_STR: -- if ((!policy->len || len <= policy->len) && !data[len - 1]) -+ if (len && (!policy->len || len <= policy->len) && !data[len - 1]) - break; - yerr(yarg->ys, YNL_ERROR_ATTR_INVALID, - "Invalid attribute (string %s)", policy->name); -diff --git a/tools/objtool/check.c b/tools/objtool/check.c -index a1b14378bab045..f8e676a6e6f8e9 100644 ---- a/tools/objtool/check.c -+++ b/tools/objtool/check.c -@@ -3287,7 +3287,7 @@ static int handle_insn_ops(struct instruction *insn, - if (update_cfi_state(insn, next_insn, &state->cfi, op)) - return 1; - -- if (!insn->alt_group) -+ if (!opts.uaccess || !insn->alt_group) - continue; - - if (op->dest.type == OP_DEST_PUSHF) { -@@ -3754,6 +3754,9 @@ static int validate_branch(struct objtool_file *file, struct symbol *func, - return 0; - - case INSN_STAC: -+ if (!opts.uaccess) -+ break; -+ - if (state.uaccess) { - WARN_INSN(insn, "recursive UACCESS enable"); - return 1; -@@ -3763,6 +3766,9 @@ static int validate_branch(struct objtool_file *file, struct symbol *func, - break; - - case INSN_CLAC: -+ if (!opts.uaccess) -+ break; -+ - if (!state.uaccess && func) { - WARN_INSN(insn, "redundant UACCESS disable"); - return 1; -@@ -4238,7 +4244,8 @@ static int validate_symbol(struct objtool_file *file, struct section *sec, - if (!insn || insn->ignore || insn->visited) - return 0; - -- state->uaccess = sym->uaccess_safe; -+ if (opts.uaccess) -+ state->uaccess = sym->uaccess_safe; - - ret = validate_branch(file, insn_func(insn), insn, *state); - if (ret) -@@ -4685,8 +4692,10 @@ int check(struct objtool_file *file) - init_cfi_state(&force_undefined_cfi); - force_undefined_cfi.force_undefined = true; - -- if (!cfi_hash_alloc(1UL << (file->elf->symbol_bits - 3))) -+ if (!cfi_hash_alloc(1UL << (file->elf->symbol_bits - 3))) { -+ ret = -1; - goto out; -+ } - - cfi_hash_add(&init_cfi); - cfi_hash_add(&func_cfi); -@@ -4703,7 +4712,7 @@ int check(struct objtool_file *file) - if (opts.retpoline) { - ret = validate_retpoline(file); - if (ret < 0) -- return ret; -+ goto out; - warnings += ret; - } - -@@ -4739,7 +4748,7 @@ int check(struct objtool_file *file) - */ - ret = validate_unrets(file); - if (ret < 0) -- return ret; -+ goto out; - warnings += ret; - } - -@@ -4802,7 +4811,7 @@ int check(struct objtool_file *file) - if (opts.prefix) { - ret = add_prefix_symbols(file); - if (ret < 0) -- return ret; -+ goto out; - warnings += ret; - } - -diff --git a/tools/testing/kunit/qemu_configs/x86_64.py b/tools/testing/kunit/qemu_configs/x86_64.py -index dc794907686304..4a6bf4e048f5b0 100644 ---- a/tools/testing/kunit/qemu_configs/x86_64.py -+++ b/tools/testing/kunit/qemu_configs/x86_64.py -@@ -7,4 +7,6 @@ CONFIG_SERIAL_8250_CONSOLE=y''', - qemu_arch='x86_64', - kernel_path='arch/x86/boot/bzImage', - kernel_command_line='console=ttyS0', -- extra_qemu_params=[]) -+ # qboot is faster than SeaBIOS and doesn't mess up -+ # the terminal. -+ extra_qemu_params=['-bios', 'qboot.rom']) -diff --git a/tools/testing/selftests/bpf/prog_tests/sockmap_ktls.c b/tools/testing/selftests/bpf/prog_tests/sockmap_ktls.c -index 2d0796314862ac..0a99fd404f6dc0 100644 ---- a/tools/testing/selftests/bpf/prog_tests/sockmap_ktls.c -+++ b/tools/testing/selftests/bpf/prog_tests/sockmap_ktls.c -@@ -68,7 +68,6 @@ static void test_sockmap_ktls_disconnect_after_delete(int family, int map) - goto close_cli; - - err = disconnect(cli); -- ASSERT_OK(err, "disconnect"); - - close_cli: - close(cli); -diff --git a/tools/testing/selftests/net/forwarding/bridge_mdb.sh b/tools/testing/selftests/net/forwarding/bridge_mdb.sh -index a3678dfe5848a2..c151374ddf0402 100755 ---- a/tools/testing/selftests/net/forwarding/bridge_mdb.sh -+++ b/tools/testing/selftests/net/forwarding/bridge_mdb.sh -@@ -149,7 +149,7 @@ cfg_test_host_common() - check_err $? "Failed to add $name host entry" - - bridge mdb replace dev br0 port br0 grp $grp $state vid 10 &> /dev/null -- check_fail $? "Managed to replace $name host entry" -+ check_err $? "Failed to replace $name host entry" - - bridge mdb del dev br0 port br0 grp $grp $state vid 10 - bridge mdb get dev br0 grp $grp vid 10 &> /dev/null -diff --git a/tools/testing/selftests/net/gro.sh b/tools/testing/selftests/net/gro.sh -index 342ad27f631b15..e771f5f7faa26a 100755 ---- a/tools/testing/selftests/net/gro.sh -+++ b/tools/testing/selftests/net/gro.sh -@@ -95,5 +95,6 @@ trap cleanup EXIT - if [[ "${test}" == "all" ]]; then - run_all_tests - else -- run_test "${proto}" "${test}" -+ exit_code=$(run_test "${proto}" "${test}") -+ exit $exit_code - fi; diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.093-094.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.093-094.patch deleted file mode 100644 index 50d5603c3f..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.093-094.patch +++ /dev/null @@ -1,12510 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/phy/fsl,imx8mq-usb-phy.yaml b/Documentation/devicetree/bindings/phy/fsl,imx8mq-usb-phy.yaml -index dc3a3f709feaa6..bac4d0b51d8a1b 100644 ---- a/Documentation/devicetree/bindings/phy/fsl,imx8mq-usb-phy.yaml -+++ b/Documentation/devicetree/bindings/phy/fsl,imx8mq-usb-phy.yaml -@@ -58,8 +58,7 @@ properties: - fsl,phy-tx-vboost-level-microvolt: - description: - Adjust the boosted transmit launch pk-pk differential amplitude -- minimum: 880 -- maximum: 1120 -+ enum: [844, 1008, 1156] - - fsl,phy-comp-dis-tune-percent: - description: -diff --git a/Documentation/devicetree/bindings/regulator/mediatek,mt6357-regulator.yaml b/Documentation/devicetree/bindings/regulator/mediatek,mt6357-regulator.yaml -index 6327bb2f6ee080..698266c09e2535 100644 ---- a/Documentation/devicetree/bindings/regulator/mediatek,mt6357-regulator.yaml -+++ b/Documentation/devicetree/bindings/regulator/mediatek,mt6357-regulator.yaml -@@ -33,7 +33,7 @@ patternProperties: - - "^ldo-v(camio18|aud28|aux18|io18|io28|rf12|rf18|cn18|cn28|fe28)$": - type: object -- $ref: fixed-regulator.yaml# -+ $ref: regulator.yaml# - unevaluatedProperties: false - description: - Properties for single fixed LDO regulator. -@@ -112,7 +112,6 @@ examples: - regulator-enable-ramp-delay = <220>; - }; - mt6357_vfe28_reg: ldo-vfe28 { -- compatible = "regulator-fixed"; - regulator-name = "vfe28"; - regulator-min-microvolt = <2800000>; - regulator-max-microvolt = <2800000>; -@@ -125,14 +124,12 @@ examples: - regulator-enable-ramp-delay = <110>; - }; - mt6357_vrf18_reg: ldo-vrf18 { -- compatible = "regulator-fixed"; - regulator-name = "vrf18"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; - regulator-enable-ramp-delay = <110>; - }; - mt6357_vrf12_reg: ldo-vrf12 { -- compatible = "regulator-fixed"; - regulator-name = "vrf12"; - regulator-min-microvolt = <1200000>; - regulator-max-microvolt = <1200000>; -@@ -157,14 +154,12 @@ examples: - regulator-enable-ramp-delay = <264>; - }; - mt6357_vcn28_reg: ldo-vcn28 { -- compatible = "regulator-fixed"; - regulator-name = "vcn28"; - regulator-min-microvolt = <2800000>; - regulator-max-microvolt = <2800000>; - regulator-enable-ramp-delay = <264>; - }; - mt6357_vcn18_reg: ldo-vcn18 { -- compatible = "regulator-fixed"; - regulator-name = "vcn18"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; -@@ -183,7 +178,6 @@ examples: - regulator-enable-ramp-delay = <264>; - }; - mt6357_vcamio_reg: ldo-vcamio18 { -- compatible = "regulator-fixed"; - regulator-name = "vcamio"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; -@@ -212,28 +206,24 @@ examples: - regulator-always-on; - }; - mt6357_vaux18_reg: ldo-vaux18 { -- compatible = "regulator-fixed"; - regulator-name = "vaux18"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; - regulator-enable-ramp-delay = <264>; - }; - mt6357_vaud28_reg: ldo-vaud28 { -- compatible = "regulator-fixed"; - regulator-name = "vaud28"; - regulator-min-microvolt = <2800000>; - regulator-max-microvolt = <2800000>; - regulator-enable-ramp-delay = <264>; - }; - mt6357_vio28_reg: ldo-vio28 { -- compatible = "regulator-fixed"; - regulator-name = "vio28"; - regulator-min-microvolt = <2800000>; - regulator-max-microvolt = <2800000>; - regulator-enable-ramp-delay = <264>; - }; - mt6357_vio18_reg: ldo-vio18 { -- compatible = "regulator-fixed"; - regulator-name = "vio18"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; -diff --git a/Documentation/devicetree/bindings/usb/cypress,hx3.yaml b/Documentation/devicetree/bindings/usb/cypress,hx3.yaml -index 47add0d85fb891..02349bbb0d46ff 100644 ---- a/Documentation/devicetree/bindings/usb/cypress,hx3.yaml -+++ b/Documentation/devicetree/bindings/usb/cypress,hx3.yaml -@@ -14,9 +14,22 @@ allOf: - - properties: - compatible: -- enum: -- - usb4b4,6504 -- - usb4b4,6506 -+ oneOf: -+ - enum: -+ - usb4b4,6504 -+ - usb4b4,6506 -+ - items: -+ - enum: -+ - usb4b4,6500 -+ - usb4b4,6508 -+ - const: usb4b4,6504 -+ - items: -+ - enum: -+ - usb4b4,6502 -+ - usb4b4,6503 -+ - usb4b4,6507 -+ - usb4b4,650a -+ - const: usb4b4,6506 - - reg: true - -diff --git a/Documentation/devicetree/bindings/vendor-prefixes.yaml b/Documentation/devicetree/bindings/vendor-prefixes.yaml -index dc275ab60e5344..7376a924e9aca1 100644 ---- a/Documentation/devicetree/bindings/vendor-prefixes.yaml -+++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml -@@ -773,6 +773,8 @@ patternProperties: - description: Linux-specific binding - "^linx,.*": - description: Linx Technologies -+ "^liontron,.*": -+ description: Shenzhen Liontron Technology Co., Ltd - "^liteon,.*": - description: LITE-ON Technology Corp. - "^litex,.*": -diff --git a/Makefile b/Makefile -index c9a1e2286b3a79..9625d9072c7781 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 93 -+SUBLEVEL = 94 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm/boot/dts/microchip/at91sam9263ek.dts b/arch/arm/boot/dts/microchip/at91sam9263ek.dts -index ce8baff6a9f4e0..e42e1a75a715db 100644 ---- a/arch/arm/boot/dts/microchip/at91sam9263ek.dts -+++ b/arch/arm/boot/dts/microchip/at91sam9263ek.dts -@@ -152,7 +152,7 @@ nand_controller: nand-controller { - nand@3 { - reg = <0x3 0x0 0x800000>; - rb-gpios = <&pioA 22 GPIO_ACTIVE_HIGH>; -- cs-gpios = <&pioA 15 GPIO_ACTIVE_HIGH>; -+ cs-gpios = <&pioD 15 GPIO_ACTIVE_HIGH>; - nand-bus-width = <8>; - nand-ecc-mode = "soft"; - nand-on-flash-bbt; -diff --git a/arch/arm/boot/dts/microchip/tny_a9263.dts b/arch/arm/boot/dts/microchip/tny_a9263.dts -index 62b7d9f9a926c5..c8b6318aaa838c 100644 ---- a/arch/arm/boot/dts/microchip/tny_a9263.dts -+++ b/arch/arm/boot/dts/microchip/tny_a9263.dts -@@ -64,7 +64,7 @@ nand_controller: nand-controller { - nand@3 { - reg = <0x3 0x0 0x800000>; - rb-gpios = <&pioA 22 GPIO_ACTIVE_HIGH>; -- cs-gpios = <&pioA 15 GPIO_ACTIVE_HIGH>; -+ cs-gpios = <&pioD 15 GPIO_ACTIVE_HIGH>; - nand-bus-width = <8>; - nand-ecc-mode = "soft"; - nand-on-flash-bbt; -diff --git a/arch/arm/boot/dts/microchip/usb_a9263.dts b/arch/arm/boot/dts/microchip/usb_a9263.dts -index 45745915b2e160..454176ce6d3fff 100644 ---- a/arch/arm/boot/dts/microchip/usb_a9263.dts -+++ b/arch/arm/boot/dts/microchip/usb_a9263.dts -@@ -58,7 +58,7 @@ usb1: gadget@fff78000 { - }; - - spi0: spi@fffa4000 { -- cs-gpios = <&pioB 15 GPIO_ACTIVE_HIGH>; -+ cs-gpios = <&pioA 5 GPIO_ACTIVE_LOW>; - status = "okay"; - flash@0 { - compatible = "atmel,at45", "atmel,dataflash"; -@@ -84,7 +84,7 @@ nand_controller: nand-controller { - nand@3 { - reg = <0x3 0x0 0x800000>; - rb-gpios = <&pioA 22 GPIO_ACTIVE_HIGH>; -- cs-gpios = <&pioA 15 GPIO_ACTIVE_HIGH>; -+ cs-gpios = <&pioD 15 GPIO_ACTIVE_HIGH>; - nand-bus-width = <8>; - nand-ecc-mode = "soft"; - nand-on-flash-bbt; -diff --git a/arch/arm/boot/dts/qcom/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom/qcom-apq8064.dtsi -index 950adb63af7016..b8f160cfe8e156 100644 ---- a/arch/arm/boot/dts/qcom/qcom-apq8064.dtsi -+++ b/arch/arm/boot/dts/qcom/qcom-apq8064.dtsi -@@ -213,12 +213,6 @@ sleep_clk: sleep_clk { - }; - }; - -- sfpb_mutex: hwmutex { -- compatible = "qcom,sfpb-mutex"; -- syscon = <&sfpb_wrapper_mutex 0x604 0x4>; -- #hwlock-cells = <1>; -- }; -- - smem { - compatible = "qcom,smem"; - memory-region = <&smem_region>; -@@ -322,9 +316,10 @@ tlmm_pinmux: pinctrl@800000 { - pinctrl-0 = <&ps_hold>; - }; - -- sfpb_wrapper_mutex: syscon@1200000 { -- compatible = "syscon"; -- reg = <0x01200000 0x8000>; -+ sfpb_mutex: hwmutex@1200600 { -+ compatible = "qcom,sfpb-mutex"; -+ reg = <0x01200600 0x100>; -+ #hwlock-cells = <1>; - }; - - intc: interrupt-controller@2000000 { -@@ -343,6 +338,8 @@ timer@200a000 { - <1 3 0x301>; - reg = <0x0200a000 0x100>; - clock-frequency = <27000000>; -+ clocks = <&sleep_clk>; -+ clock-names = "sleep"; - cpu-offset = <0x80000>; - }; - -diff --git a/arch/arm/mach-aspeed/Kconfig b/arch/arm/mach-aspeed/Kconfig -index 080019aa6fcd89..fcf287edd0e5e6 100644 ---- a/arch/arm/mach-aspeed/Kconfig -+++ b/arch/arm/mach-aspeed/Kconfig -@@ -2,7 +2,6 @@ - menuconfig ARCH_ASPEED - bool "Aspeed BMC architectures" - depends on (CPU_LITTLE_ENDIAN && ARCH_MULTI_V5) || ARCH_MULTI_V6 || ARCH_MULTI_V7 -- select SRAM - select WATCHDOG - select ASPEED_WATCHDOG - select MFD_SYSCON -diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig -index 658c6a61ab6fb8..4ecba0690938c3 100644 ---- a/arch/arm64/Kconfig -+++ b/arch/arm64/Kconfig -@@ -304,9 +304,9 @@ config ARCH_MMAP_RND_BITS_MAX - default 24 if ARM64_VA_BITS=39 - default 27 if ARM64_VA_BITS=42 - default 30 if ARM64_VA_BITS=47 -- default 29 if ARM64_VA_BITS=48 && ARM64_64K_PAGES -- default 31 if ARM64_VA_BITS=48 && ARM64_16K_PAGES -- default 33 if ARM64_VA_BITS=48 -+ default 29 if (ARM64_VA_BITS=48 || ARM64_VA_BITS=52) && ARM64_64K_PAGES -+ default 31 if (ARM64_VA_BITS=48 || ARM64_VA_BITS=52) && ARM64_16K_PAGES -+ default 33 if (ARM64_VA_BITS=48 || ARM64_VA_BITS=52) - default 14 if ARM64_64K_PAGES - default 16 if ARM64_16K_PAGES - default 18 -diff --git a/arch/arm64/boot/dts/freescale/imx8mm-beacon-kit.dts b/arch/arm64/boot/dts/freescale/imx8mm-beacon-kit.dts -index 905c98cb080d2f..a6e6860bf01843 100644 ---- a/arch/arm64/boot/dts/freescale/imx8mm-beacon-kit.dts -+++ b/arch/arm64/boot/dts/freescale/imx8mm-beacon-kit.dts -@@ -124,6 +124,7 @@ &sai5 { - assigned-clock-parents = <&clk IMX8MM_AUDIO_PLL1_OUT>; - assigned-clock-rates = <24576000>; - #sound-dai-cells = <0>; -+ fsl,sai-mclk-direction-output; - status = "okay"; - }; - -diff --git a/arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi -index f264102bdb2748..8ab0e45f2ad31c 100644 ---- a/arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi -+++ b/arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi -@@ -231,6 +231,7 @@ eeprom@50 { - rtc: rtc@51 { - compatible = "nxp,pcf85263"; - reg = <0x51>; -+ quartz-load-femtofarads = <12500>; - }; - }; - -diff --git a/arch/arm64/boot/dts/freescale/imx8mn-beacon-kit.dts b/arch/arm64/boot/dts/freescale/imx8mn-beacon-kit.dts -index 35b8d2060cd99a..dfa08be33a4f20 100644 ---- a/arch/arm64/boot/dts/freescale/imx8mn-beacon-kit.dts -+++ b/arch/arm64/boot/dts/freescale/imx8mn-beacon-kit.dts -@@ -126,6 +126,7 @@ &sai5 { - assigned-clock-parents = <&clk IMX8MN_AUDIO_PLL1_OUT>; - assigned-clock-rates = <24576000>; - #sound-dai-cells = <0>; -+ fsl,sai-mclk-direction-output; - status = "okay"; - }; - -diff --git a/arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi -index 90073b16536f40..1760062e6ffcfd 100644 ---- a/arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi -+++ b/arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi -@@ -240,6 +240,7 @@ eeprom@50 { - rtc: rtc@51 { - compatible = "nxp,pcf85263"; - reg = <0x51>; -+ quartz-load-femtofarads = <12500>; - }; - }; - -diff --git a/arch/arm64/boot/dts/freescale/imx8mp-beacon-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-beacon-som.dtsi -index e5da9080478084..24380f8a008501 100644 ---- a/arch/arm64/boot/dts/freescale/imx8mp-beacon-som.dtsi -+++ b/arch/arm64/boot/dts/freescale/imx8mp-beacon-som.dtsi -@@ -192,6 +192,7 @@ eeprom@50 { - rtc: rtc@51 { - compatible = "nxp,pcf85263"; - reg = <0x51>; -+ quartz-load-femtofarads = <12500>; - }; - }; - -diff --git a/arch/arm64/boot/dts/mediatek/mt6357.dtsi b/arch/arm64/boot/dts/mediatek/mt6357.dtsi -index 5fafa842d312f3..dca4e5c3d8e210 100644 ---- a/arch/arm64/boot/dts/mediatek/mt6357.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt6357.dtsi -@@ -60,7 +60,6 @@ mt6357_vpa_reg: buck-vpa { - }; - - mt6357_vfe28_reg: ldo-vfe28 { -- compatible = "regulator-fixed"; - regulator-name = "vfe28"; - regulator-min-microvolt = <2800000>; - regulator-max-microvolt = <2800000>; -@@ -75,7 +74,6 @@ mt6357_vxo22_reg: ldo-vxo22 { - }; - - mt6357_vrf18_reg: ldo-vrf18 { -- compatible = "regulator-fixed"; - regulator-name = "vrf18"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; -@@ -83,7 +81,6 @@ mt6357_vrf18_reg: ldo-vrf18 { - }; - - mt6357_vrf12_reg: ldo-vrf12 { -- compatible = "regulator-fixed"; - regulator-name = "vrf12"; - regulator-min-microvolt = <1200000>; - regulator-max-microvolt = <1200000>; -@@ -112,7 +109,6 @@ mt6357_vcn33_wifi_reg: ldo-vcn33-wifi { - }; - - mt6357_vcn28_reg: ldo-vcn28 { -- compatible = "regulator-fixed"; - regulator-name = "vcn28"; - regulator-min-microvolt = <2800000>; - regulator-max-microvolt = <2800000>; -@@ -120,7 +116,6 @@ mt6357_vcn28_reg: ldo-vcn28 { - }; - - mt6357_vcn18_reg: ldo-vcn18 { -- compatible = "regulator-fixed"; - regulator-name = "vcn18"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; -@@ -142,7 +137,6 @@ mt6357_vcamd_reg: ldo-vcamd { - }; - - mt6357_vcamio_reg: ldo-vcamio18 { -- compatible = "regulator-fixed"; - regulator-name = "vcamio"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; -@@ -175,7 +169,6 @@ mt6357_vsram_proc_reg: ldo-vsram-proc { - }; - - mt6357_vaux18_reg: ldo-vaux18 { -- compatible = "regulator-fixed"; - regulator-name = "vaux18"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; -@@ -183,7 +176,6 @@ mt6357_vaux18_reg: ldo-vaux18 { - }; - - mt6357_vaud28_reg: ldo-vaud28 { -- compatible = "regulator-fixed"; - regulator-name = "vaud28"; - regulator-min-microvolt = <2800000>; - regulator-max-microvolt = <2800000>; -@@ -191,7 +183,6 @@ mt6357_vaud28_reg: ldo-vaud28 { - }; - - mt6357_vio28_reg: ldo-vio28 { -- compatible = "regulator-fixed"; - regulator-name = "vio28"; - regulator-min-microvolt = <2800000>; - regulator-max-microvolt = <2800000>; -@@ -199,7 +190,6 @@ mt6357_vio28_reg: ldo-vio28 { - }; - - mt6357_vio18_reg: ldo-vio18 { -- compatible = "regulator-fixed"; - regulator-name = "vio18"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; -diff --git a/arch/arm64/boot/dts/mediatek/mt6359.dtsi b/arch/arm64/boot/dts/mediatek/mt6359.dtsi -index 8e1b8c85c6ede9..779d6dfb55c003 100644 ---- a/arch/arm64/boot/dts/mediatek/mt6359.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt6359.dtsi -@@ -18,6 +18,8 @@ mt6359codec: mt6359codec { - }; - - regulators { -+ compatible = "mediatek,mt6359-regulator"; -+ - mt6359_vs1_buck_reg: buck_vs1 { - regulator-name = "vs1"; - regulator-min-microvolt = <800000>; -@@ -296,7 +298,7 @@ mt6359_vsram_others_sshub_ldo: ldo_vsram_others_sshub { - }; - }; - -- mt6359rtc: mt6359rtc { -+ mt6359rtc: rtc { - compatible = "mediatek,mt6358-rtc"; - }; - }; -diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi -index 7ba30209ba9a9a..22604d3abde3bd 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi -@@ -617,22 +617,6 @@ power-domain@MT8195_POWER_DOMAIN_VPPSYS0 { - #size-cells = <0>; - #power-domain-cells = <1>; - -- power-domain@MT8195_POWER_DOMAIN_VDEC1 { -- reg = ; -- clocks = <&vdecsys CLK_VDEC_LARB1>; -- clock-names = "vdec1-0"; -- mediatek,infracfg = <&infracfg_ao>; -- #power-domain-cells = <0>; -- }; -- -- power-domain@MT8195_POWER_DOMAIN_VENC_CORE1 { -- reg = ; -- clocks = <&vencsys_core1 CLK_VENC_CORE1_LARB>; -- clock-names = "venc1-larb"; -- mediatek,infracfg = <&infracfg_ao>; -- #power-domain-cells = <0>; -- }; -- - power-domain@MT8195_POWER_DOMAIN_VDOSYS0 { - reg = ; - clocks = <&topckgen CLK_TOP_CFG_VDO0>, -@@ -678,15 +662,25 @@ power-domain@MT8195_POWER_DOMAIN_VDEC0 { - clocks = <&vdecsys_soc CLK_VDEC_SOC_LARB1>; - clock-names = "vdec0-0"; - mediatek,infracfg = <&infracfg_ao>; -+ #address-cells = <1>; -+ #size-cells = <0>; - #power-domain-cells = <0>; -- }; - -- power-domain@MT8195_POWER_DOMAIN_VDEC2 { -- reg = ; -- clocks = <&vdecsys_core1 CLK_VDEC_CORE1_LARB1>; -- clock-names = "vdec2-0"; -- mediatek,infracfg = <&infracfg_ao>; -- #power-domain-cells = <0>; -+ power-domain@MT8195_POWER_DOMAIN_VDEC1 { -+ reg = ; -+ clocks = <&vdecsys CLK_VDEC_LARB1>; -+ clock-names = "vdec1-0"; -+ mediatek,infracfg = <&infracfg_ao>; -+ #power-domain-cells = <0>; -+ }; -+ -+ power-domain@MT8195_POWER_DOMAIN_VDEC2 { -+ reg = ; -+ clocks = <&vdecsys_core1 CLK_VDEC_CORE1_LARB1>; -+ clock-names = "vdec2-0"; -+ mediatek,infracfg = <&infracfg_ao>; -+ #power-domain-cells = <0>; -+ }; - }; - - power-domain@MT8195_POWER_DOMAIN_VENC { -@@ -694,7 +688,17 @@ power-domain@MT8195_POWER_DOMAIN_VENC { - clocks = <&vencsys CLK_VENC_LARB>; - clock-names = "venc0-larb"; - mediatek,infracfg = <&infracfg_ao>; -+ #address-cells = <1>; -+ #size-cells = <0>; - #power-domain-cells = <0>; -+ -+ power-domain@MT8195_POWER_DOMAIN_VENC_CORE1 { -+ reg = ; -+ clocks = <&vencsys_core1 CLK_VENC_CORE1_LARB>; -+ clock-names = "venc1-larb"; -+ mediatek,infracfg = <&infracfg_ao>; -+ #power-domain-cells = <0>; -+ }; - }; - - power-domain@MT8195_POWER_DOMAIN_VDOSYS1 { -diff --git a/arch/arm64/boot/dts/nvidia/tegra186.dtsi b/arch/arm64/boot/dts/nvidia/tegra186.dtsi -index 2b3bb5d0af17bd..f0b7949df92c05 100644 ---- a/arch/arm64/boot/dts/nvidia/tegra186.dtsi -+++ b/arch/arm64/boot/dts/nvidia/tegra186.dtsi -@@ -621,9 +621,7 @@ uartb: serial@3110000 { - reg-shift = <2>; - interrupts = ; - clocks = <&bpmp TEGRA186_CLK_UARTB>; -- clock-names = "serial"; - resets = <&bpmp TEGRA186_RESET_UARTB>; -- reset-names = "serial"; - status = "disabled"; - }; - -@@ -633,9 +631,7 @@ uartd: serial@3130000 { - reg-shift = <2>; - interrupts = ; - clocks = <&bpmp TEGRA186_CLK_UARTD>; -- clock-names = "serial"; - resets = <&bpmp TEGRA186_RESET_UARTD>; -- reset-names = "serial"; - status = "disabled"; - }; - -@@ -645,9 +641,7 @@ uarte: serial@3140000 { - reg-shift = <2>; - interrupts = ; - clocks = <&bpmp TEGRA186_CLK_UARTE>; -- clock-names = "serial"; - resets = <&bpmp TEGRA186_RESET_UARTE>; -- reset-names = "serial"; - status = "disabled"; - }; - -@@ -657,9 +651,7 @@ uartf: serial@3150000 { - reg-shift = <2>; - interrupts = ; - clocks = <&bpmp TEGRA186_CLK_UARTF>; -- clock-names = "serial"; - resets = <&bpmp TEGRA186_RESET_UARTF>; -- reset-names = "serial"; - status = "disabled"; - }; - -@@ -1236,9 +1228,7 @@ uartc: serial@c280000 { - reg-shift = <2>; - interrupts = ; - clocks = <&bpmp TEGRA186_CLK_UARTC>; -- clock-names = "serial"; - resets = <&bpmp TEGRA186_RESET_UARTC>; -- reset-names = "serial"; - status = "disabled"; - }; - -@@ -1248,9 +1238,7 @@ uartg: serial@c290000 { - reg-shift = <2>; - interrupts = ; - clocks = <&bpmp TEGRA186_CLK_UARTG>; -- clock-names = "serial"; - resets = <&bpmp TEGRA186_RESET_UARTG>; -- reset-names = "serial"; - status = "disabled"; - }; - -diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi -index 33f92b77cd9d9e..c3695077478514 100644 ---- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi -+++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi -@@ -766,9 +766,7 @@ uartd: serial@3130000 { - reg-shift = <2>; - interrupts = ; - clocks = <&bpmp TEGRA194_CLK_UARTD>; -- clock-names = "serial"; - resets = <&bpmp TEGRA194_RESET_UARTD>; -- reset-names = "serial"; - status = "disabled"; - }; - -@@ -778,9 +776,7 @@ uarte: serial@3140000 { - reg-shift = <2>; - interrupts = ; - clocks = <&bpmp TEGRA194_CLK_UARTE>; -- clock-names = "serial"; - resets = <&bpmp TEGRA194_RESET_UARTE>; -- reset-names = "serial"; - status = "disabled"; - }; - -@@ -790,9 +786,7 @@ uartf: serial@3150000 { - reg-shift = <2>; - interrupts = ; - clocks = <&bpmp TEGRA194_CLK_UARTF>; -- clock-names = "serial"; - resets = <&bpmp TEGRA194_RESET_UARTF>; -- reset-names = "serial"; - status = "disabled"; - }; - -@@ -817,9 +811,7 @@ uarth: serial@3170000 { - reg-shift = <2>; - interrupts = ; - clocks = <&bpmp TEGRA194_CLK_UARTH>; -- clock-names = "serial"; - resets = <&bpmp TEGRA194_RESET_UARTH>; -- reset-names = "serial"; - status = "disabled"; - }; - -@@ -1616,9 +1608,7 @@ uartc: serial@c280000 { - reg-shift = <2>; - interrupts = ; - clocks = <&bpmp TEGRA194_CLK_UARTC>; -- clock-names = "serial"; - resets = <&bpmp TEGRA194_RESET_UARTC>; -- reset-names = "serial"; - status = "disabled"; - }; - -@@ -1628,9 +1618,7 @@ uartg: serial@c290000 { - reg-shift = <2>; - interrupts = ; - clocks = <&bpmp TEGRA194_CLK_UARTG>; -- clock-names = "serial"; - resets = <&bpmp TEGRA194_RESET_UARTG>; -- reset-names = "serial"; - status = "disabled"; - }; - -diff --git a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts -index 5c2894fcfa4a08..5498e84bfead01 100644 ---- a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts -+++ b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts -@@ -985,9 +985,6 @@ &sound { - "VA DMIC0", "MIC BIAS1", - "VA DMIC1", "MIC BIAS1", - "VA DMIC2", "MIC BIAS3", -- "VA DMIC0", "VA MIC BIAS1", -- "VA DMIC1", "VA MIC BIAS1", -- "VA DMIC2", "VA MIC BIAS3", - "TX SWR_ADC1", "ADC2_OUTPUT"; - - wcd-playback-dai-link { -diff --git a/arch/arm64/boot/dts/qcom/sda660-inforce-ifc6560.dts b/arch/arm64/boot/dts/qcom/sda660-inforce-ifc6560.dts -index 2ed39d402d3f6a..d687cfadee6a16 100644 ---- a/arch/arm64/boot/dts/qcom/sda660-inforce-ifc6560.dts -+++ b/arch/arm64/boot/dts/qcom/sda660-inforce-ifc6560.dts -@@ -155,6 +155,7 @@ &blsp1_dma { - * BAM DMA interconnects support is in place. - */ - /delete-property/ clocks; -+ /delete-property/ clock-names; - }; - - &blsp1_uart2 { -@@ -167,6 +168,7 @@ &blsp2_dma { - * BAM DMA interconnects support is in place. - */ - /delete-property/ clocks; -+ /delete-property/ clock-names; - }; - - &blsp2_uart1 { -diff --git a/arch/arm64/boot/dts/qcom/sdm660-xiaomi-lavender.dts b/arch/arm64/boot/dts/qcom/sdm660-xiaomi-lavender.dts -index 3c47410ba94c0b..8221da390e1aa6 100644 ---- a/arch/arm64/boot/dts/qcom/sdm660-xiaomi-lavender.dts -+++ b/arch/arm64/boot/dts/qcom/sdm660-xiaomi-lavender.dts -@@ -107,6 +107,7 @@ &qusb2phy0 { - status = "okay"; - - vdd-supply = <&vreg_l1b_0p925>; -+ vdda-pll-supply = <&vreg_l10a_1p8>; - vdda-phy-dpdm-supply = <&vreg_l7b_3p125>; - }; - -@@ -404,6 +405,8 @@ &sdhc_1 { - &sdhc_2 { - status = "okay"; - -+ cd-gpios = <&tlmm 54 GPIO_ACTIVE_HIGH>; -+ - vmmc-supply = <&vreg_l5b_2p95>; - vqmmc-supply = <&vreg_l2b_2p95>; - }; -diff --git a/arch/arm64/boot/dts/qcom/sdm845-samsung-starqltechn.dts b/arch/arm64/boot/dts/qcom/sdm845-samsung-starqltechn.dts -index d37a433130b98f..5948b401165ce9 100644 ---- a/arch/arm64/boot/dts/qcom/sdm845-samsung-starqltechn.dts -+++ b/arch/arm64/boot/dts/qcom/sdm845-samsung-starqltechn.dts -@@ -135,8 +135,6 @@ vdda_pll_cc_ebi23: - vdda_sp_sensor: - vdda_ufs1_core: - vdda_ufs2_core: -- vdda_usb1_ss_core: -- vdda_usb2_ss_core: - vreg_l1a_0p875: ldo1 { - regulator-min-microvolt = <880000>; - regulator-max-microvolt = <880000>; -@@ -157,6 +155,7 @@ vreg_l3a_1p0: ldo3 { - regulator-initial-mode = ; - }; - -+ vdda_usb1_ss_core: - vdd_wcss_cx: - vdd_wcss_mx: - vdda_wcss_pll: -@@ -383,8 +382,8 @@ &ufs_mem_phy { - }; - - &sdhc_2 { -- pinctrl-names = "default"; - pinctrl-0 = <&sdc2_clk_state &sdc2_cmd_state &sdc2_data_state &sd_card_det_n_state>; -+ pinctrl-names = "default"; - cd-gpios = <&tlmm 126 GPIO_ACTIVE_LOW>; - vmmc-supply = <&vreg_l21a_2p95>; - vqmmc-supply = <&vddpx_2>; -@@ -418,16 +417,9 @@ &usb_1_qmpphy { - status = "okay"; - }; - --&wifi { -- vdd-0.8-cx-mx-supply = <&vreg_l5a_0p8>; -- vdd-1.8-xo-supply = <&vreg_l7a_1p8>; -- vdd-1.3-rfa-supply = <&vreg_l17a_1p3>; -- vdd-3.3-ch0-supply = <&vreg_l25a_3p3>; -- status = "okay"; --}; -- - &tlmm { -- gpio-reserved-ranges = <0 4>, <27 4>, <81 4>, <85 4>; -+ gpio-reserved-ranges = <27 4>, /* SPI (eSE - embedded Secure Element) */ -+ <85 4>; /* SPI (fingerprint reader) */ - - sdc2_clk_state: sdc2-clk-state { - pins = "sdc2_clk"; -diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi -index 21bbffc4e5a284..c9a7d1b75c658d 100644 ---- a/arch/arm64/boot/dts/qcom/sm8250.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi -@@ -601,7 +601,7 @@ cpu7_opp8: opp-1632000000 { - }; - - cpu7_opp9: opp-1747200000 { -- opp-hz = /bits/ 64 <1708800000>; -+ opp-hz = /bits/ 64 <1747200000>; - opp-peak-kBps = <5412000 42393600>; - }; - -diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi -index 5376c0a00fab65..215782b1970df9 100644 ---- a/arch/arm64/boot/dts/qcom/sm8350.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi -@@ -1754,11 +1754,11 @@ cryptobam: dma-controller@1dc4000 { - interrupts = ; - #dma-cells = <1>; - qcom,ee = <0>; -+ qcom,num-ees = <4>; -+ num-channels = <16>; - qcom,controlled-remotely; - iommus = <&apps_smmu 0x594 0x0011>, - <&apps_smmu 0x596 0x0011>; -- /* FIXME: Probing BAM DMA causes some abort and system hang */ -- status = "fail"; - }; - - crypto: crypto@1dfa000 { -@@ -1770,8 +1770,6 @@ crypto: crypto@1dfa000 { - <&apps_smmu 0x596 0x0011>; - interconnects = <&aggre2_noc MASTER_CRYPTO 0 &mc_virt SLAVE_EBI1 0>; - interconnect-names = "memory"; -- /* FIXME: dependency BAM DMA is disabled */ -- status = "disabled"; - }; - - ipa: ipa@1e40000 { -diff --git a/arch/arm64/boot/dts/renesas/r8a779g0-white-hawk-ard-audio-da7212.dtso b/arch/arm64/boot/dts/renesas/r8a779g0-white-hawk-ard-audio-da7212.dtso -index e6f53377ecd90c..99f62574bc3c2a 100644 ---- a/arch/arm64/boot/dts/renesas/r8a779g0-white-hawk-ard-audio-da7212.dtso -+++ b/arch/arm64/boot/dts/renesas/r8a779g0-white-hawk-ard-audio-da7212.dtso -@@ -108,7 +108,7 @@ sound_clk_pins: sound-clk { - }; - - tpu0_pins: tpu0 { -- groups = "tpu_to0_a"; -+ groups = "tpu_to0_b"; - function = "tpu"; - }; - }; -diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts b/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts -index 115c14c0a3c68c..396a6636073b51 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts -+++ b/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts -@@ -251,14 +251,6 @@ &uart2 { - status = "okay"; - }; - --&usb_host0_ehci { -- status = "okay"; --}; -- --&usb_host0_ohci { -- status = "okay"; --}; -- - &vopb { - status = "okay"; - }; -diff --git a/arch/arm64/boot/dts/rockchip/rk3568-nanopi-r5s.dtsi b/arch/arm64/boot/dts/rockchip/rk3568-nanopi-r5s.dtsi -index 93189f83064006..c30354268c8f5e 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3568-nanopi-r5s.dtsi -+++ b/arch/arm64/boot/dts/rockchip/rk3568-nanopi-r5s.dtsi -@@ -486,9 +486,12 @@ &saradc { - &sdhci { - bus-width = <8>; - max-frequency = <200000000>; -+ mmc-hs200-1_8v; - non-removable; - pinctrl-names = "default"; -- pinctrl-0 = <&emmc_bus8 &emmc_clk &emmc_cmd>; -+ pinctrl-0 = <&emmc_bus8 &emmc_clk &emmc_cmd &emmc_datastrobe>; -+ vmmc-supply = <&vcc_3v3>; -+ vqmmc-supply = <&vcc_1v8>; - status = "okay"; - }; - -diff --git a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi -index 57befcce93b976..0523bd0da80c72 100644 ---- a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi -+++ b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi -@@ -436,6 +436,8 @@ sdhci0: mmc@4f80000 { - interrupts = ; - mmc-ddr-1_8v; - mmc-hs200-1_8v; -+ ti,clkbuf-sel = <0x7>; -+ ti,trm-icp = <0x8>; - ti,otap-del-sel-legacy = <0x0>; - ti,otap-del-sel-mmc-hs = <0x0>; - ti,otap-del-sel-sd-hs = <0x0>; -@@ -446,8 +448,9 @@ sdhci0: mmc@4f80000 { - ti,otap-del-sel-ddr50 = <0x5>; - ti,otap-del-sel-ddr52 = <0x5>; - ti,otap-del-sel-hs200 = <0x5>; -- ti,otap-del-sel-hs400 = <0x0>; -- ti,trm-icp = <0x8>; -+ ti,itap-del-sel-legacy = <0xa>; -+ ti,itap-del-sel-mmc-hs = <0x1>; -+ ti,itap-del-sel-ddr52 = <0x0>; - dma-coherent; - }; - -@@ -458,18 +461,22 @@ sdhci1: mmc@4fa0000 { - clocks = <&k3_clks 48 0>, <&k3_clks 48 1>; - clock-names = "clk_ahb", "clk_xin"; - interrupts = ; -+ ti,clkbuf-sel = <0x7>; -+ ti,trm-icp = <0x8>; - ti,otap-del-sel-legacy = <0x0>; - ti,otap-del-sel-mmc-hs = <0x0>; - ti,otap-del-sel-sd-hs = <0x0>; -- ti,otap-del-sel-sdr12 = <0x0>; -- ti,otap-del-sel-sdr25 = <0x0>; -+ ti,otap-del-sel-sdr12 = <0xf>; -+ ti,otap-del-sel-sdr25 = <0xf>; - ti,otap-del-sel-sdr50 = <0x8>; - ti,otap-del-sel-sdr104 = <0x7>; - ti,otap-del-sel-ddr50 = <0x4>; - ti,otap-del-sel-ddr52 = <0x4>; - ti,otap-del-sel-hs200 = <0x7>; -- ti,clkbuf-sel = <0x7>; -- ti,trm-icp = <0x8>; -+ ti,itap-del-sel-legacy = <0xa>; -+ ti,itap-del-sel-sd-hs = <0x1>; -+ ti,itap-del-sel-sdr12 = <0xa>; -+ ti,itap-del-sel-sdr25 = <0x1>; - dma-coherent; - }; - -diff --git a/arch/arm64/boot/dts/ti/k3-j721e-common-proc-board.dts b/arch/arm64/boot/dts/ti/k3-j721e-common-proc-board.dts -index fe5207ac7d85d1..90ae8e948671d6 100644 ---- a/arch/arm64/boot/dts/ti/k3-j721e-common-proc-board.dts -+++ b/arch/arm64/boot/dts/ti/k3-j721e-common-proc-board.dts -@@ -557,6 +557,7 @@ &usb1 { - &ospi1 { - pinctrl-names = "default"; - pinctrl-0 = <&mcu_fss0_ospi1_pins_default>; -+ status = "okay"; - - flash@0 { - compatible = "jedec,spi-nor"; -diff --git a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts -index ccacb65683b5b0..952d2c72628ef4 100644 ---- a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts -+++ b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts -@@ -183,6 +183,17 @@ vsys_3v3: fixedregulator-vsys3v3 { - regulator-boot-on; - }; - -+ vsys_5v0: fixedregulator-vsys5v0 { -+ /* Output of LM61460 */ -+ compatible = "regulator-fixed"; -+ regulator-name = "vsys_5v0"; -+ regulator-min-microvolt = <5000000>; -+ regulator-max-microvolt = <5000000>; -+ vin-supply = <&vusb_main>; -+ regulator-always-on; -+ regulator-boot-on; -+ }; -+ - vdd_mmc1: fixedregulator-sd { - compatible = "regulator-fixed"; - pinctrl-names = "default"; -@@ -210,6 +221,56 @@ vdd_sd_dv_alt: gpio-regulator-tps659411 { - <3300000 0x1>; - }; - -+ vdd_sd_dv: gpio-regulator-TLV71033 { -+ compatible = "regulator-gpio"; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&vdd_sd_dv_pins_default>; -+ regulator-name = "tlv71033"; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <3300000>; -+ regulator-boot-on; -+ vin-supply = <&vsys_5v0>; -+ gpios = <&main_gpio0 118 GPIO_ACTIVE_HIGH>; -+ states = <1800000 0x0>, -+ <3300000 0x1>; -+ }; -+ -+ transceiver1: can-phy1 { -+ compatible = "ti,tcan1042"; -+ #phy-cells = <0>; -+ max-bitrate = <5000000>; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&mcu_mcan0_gpio_pins_default>; -+ standby-gpios = <&wkup_gpio0 3 GPIO_ACTIVE_HIGH>; -+ }; -+ -+ transceiver2: can-phy2 { -+ compatible = "ti,tcan1042"; -+ #phy-cells = <0>; -+ max-bitrate = <5000000>; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&main_mcan0_gpio_pins_default>; -+ standby-gpios = <&main_gpio0 65 GPIO_ACTIVE_HIGH>; -+ }; -+ -+ transceiver3: can-phy3 { -+ compatible = "ti,tcan1042"; -+ #phy-cells = <0>; -+ max-bitrate = <5000000>; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&main_mcan5_gpio_pins_default>; -+ standby-gpios = <&main_gpio0 66 GPIO_ACTIVE_HIGH>; -+ }; -+ -+ transceiver4: can-phy4 { -+ compatible = "ti,tcan1042"; -+ #phy-cells = <0>; -+ max-bitrate = <5000000>; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&main_mcan9_gpio_pins_default>; -+ standby-gpios = <&main_gpio0 67 GPIO_ACTIVE_HIGH>; -+ }; -+ - dp_pwr_3v3: fixedregulator-dp-prw { - compatible = "regulator-fixed"; - regulator-name = "dp-pwr"; -@@ -286,6 +347,15 @@ tfp410_out: endpoint { - }; - }; - }; -+ -+ csi_mux: mux-controller { -+ compatible = "gpio-mux"; -+ #mux-state-cells = <1>; -+ mux-gpios = <&main_gpio0 88 GPIO_ACTIVE_HIGH>; -+ idle-state = <0>; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&main_csi_mux_sel_pins_default>; -+ }; - }; - - &main_pmx0 { -@@ -352,6 +422,51 @@ J721E_IOPAD(0x214, PIN_OUTPUT, 4) /* (V4) MCAN1_TX.USB1_DRVVBUS */ - >; - }; - -+ main_csi_mux_sel_pins_default: main-csi-mux-sel-default-pins { -+ pinctrl-single,pins = < -+ J721E_IOPAD(0x164, PIN_OUTPUT, 7) /* (V29) RGMII5_TD2 */ -+ >; -+ }; -+ -+ main_mcan0_pins_default: main-mcan0-default-pins { -+ pinctrl-single,pins = < -+ J721E_IOPAD(0x208, PIN_INPUT, 0) /* (W5) MCAN0_RX */ -+ J721E_IOPAD(0x20c, PIN_OUTPUT, 0) /* (W6) MCAN0_TX */ -+ >; -+ }; -+ -+ main_mcan0_gpio_pins_default: main-mcan0-gpio-default-pins { -+ pinctrl-single,pins = < -+ J721E_IOPAD(0x108, PIN_INPUT, 7) /* (AD27) PRG0_PRU1_GPO2.GPIO0_65 */ -+ >; -+ }; -+ -+ main_mcan5_pins_default: main-mcan5-default-pins { -+ pinctrl-single,pins = < -+ J721E_IOPAD(0x050, PIN_INPUT, 6) /* (AE21) PRG1_PRU0_GPO18.MCAN5_RX */ -+ J721E_IOPAD(0x04c, PIN_OUTPUT, 6) /* (AJ21) PRG1_PRU0_GPO17.MCAN5_TX */ -+ >; -+ }; -+ -+ main_mcan5_gpio_pins_default: main-mcan5-gpio-default-pins { -+ pinctrl-single,pins = < -+ J721E_IOPAD(0x10c, PIN_INPUT, 7) /* (AC25) PRG0_PRU1_GPO3.GPIO0_66 */ -+ >; -+ }; -+ -+ main_mcan9_pins_default: main-mcan9-default-pins { -+ pinctrl-single,pins = < -+ J721E_IOPAD(0x0d0, PIN_INPUT, 6) /* (AC27) PRG0_PRU0_GPO8.MCAN9_RX */ -+ J721E_IOPAD(0x0cc, PIN_OUTPUT, 6) /* (AC28) PRG0_PRU0_GPO7.MCAN9_TX */ -+ >; -+ }; -+ -+ main_mcan9_gpio_pins_default: main-mcan9-gpio-default-pins { -+ pinctrl-single,pins = < -+ J721E_IOPAD(0x110, PIN_INPUT, 7) /* (AD29) PRG0_PRU1_GPO4.GPIO0_67 */ -+ >; -+ }; -+ - dp0_pins_default: dp0-default-pins { - pinctrl-single,pins = < - J721E_IOPAD(0x1c4, PIN_INPUT, 5) /* SPI0_CS1.DP0_HPD */ -@@ -511,6 +626,12 @@ J721E_WKUP_IOPAD(0xd4, PIN_OUTPUT, 7) /* (G26) WKUP_GPIO0_9 */ - >; - }; - -+ vdd_sd_dv_pins_default: vdd-sd-dv-default-pins { -+ pinctrl-single,pins = < -+ J721E_IOPAD(0x1dc, PIN_OUTPUT, 7) /* (Y1) SPI1_CLK.GPIO0_118 */ -+ >; -+ }; -+ - wkup_uart0_pins_default: wkup-uart0-default-pins { - pinctrl-single,pins = < - J721E_WKUP_IOPAD(0xa0, PIN_INPUT, 0) /* (J29) WKUP_UART0_RXD */ -@@ -534,6 +655,19 @@ J721E_WKUP_IOPAD(0xfc, PIN_INPUT_PULLUP, 0) /* (H24) WKUP_I2C0_SDA */ - >; - }; - -+ mcu_mcan0_pins_default: mcu-mcan0-default-pins { -+ pinctrl-single,pins = < -+ J721E_WKUP_IOPAD(0x0ac, PIN_INPUT, 0) /* (C29) MCU_MCAN0_RX */ -+ J721E_WKUP_IOPAD(0x0a8, PIN_OUTPUT, 0) /* (D29) MCU_MCAN0_TX */ -+ >; -+ }; -+ -+ mcu_mcan0_gpio_pins_default: mcu-mcan0-gpio-default-pins { -+ pinctrl-single,pins = < -+ J721E_WKUP_IOPAD(0x0bc, PIN_INPUT, 7) /* (F27) WKUP_GPIO0_3 */ -+ >; -+ }; -+ - /* Reset for M.2 M Key slot on PCIe1 */ - mkey_reset_pins_default: mkey-reset-pns-default-pins { - pinctrl-single,pins = < -@@ -707,14 +841,14 @@ i2c-mux@70 { - reg = <0x70>; - - /* CSI0 I2C */ -- i2c@0 { -+ cam0_i2c: i2c@0 { - #address-cells = <1>; - #size-cells = <0>; - reg = <0>; - }; - - /* CSI1 I2C */ -- i2c@1 { -+ cam1_i2c: i2c@1 { - #address-cells = <1>; - #size-cells = <0>; - reg = <1>; -@@ -942,6 +1076,34 @@ &pcie1_rc { - num-lanes = <2>; - }; - -+&mcu_mcan0 { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&mcu_mcan0_pins_default>; -+ phys = <&transceiver1>; -+ status = "okay"; -+}; -+ -+&main_mcan0 { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&main_mcan0_pins_default>; -+ phys = <&transceiver2>; -+ status = "okay"; -+}; -+ -+&main_mcan5 { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&main_mcan5_pins_default>; -+ phys = <&transceiver3>; -+ status = "okay"; -+}; -+ -+&main_mcan9 { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&main_mcan9_pins_default>; -+ phys = <&transceiver4>; -+ status = "okay"; -+}; -+ - &ufs_wrapper { - status = "disabled"; - }; -diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig -index 60af93c04b45a7..a4fc913d1e4943 100644 ---- a/arch/arm64/configs/defconfig -+++ b/arch/arm64/configs/defconfig -@@ -1412,6 +1412,9 @@ CONFIG_PHY_HISTB_COMBPHY=y - CONFIG_PHY_HISI_INNO_USB2=y - CONFIG_PHY_MVEBU_CP110_COMPHY=y - CONFIG_PHY_MTK_TPHY=y -+CONFIG_PHY_MTK_HDMI=m -+CONFIG_PHY_MTK_MIPI_DSI=m -+CONFIG_PHY_MTK_DP=m - CONFIG_PHY_QCOM_EDP=m - CONFIG_PHY_QCOM_EUSB2_REPEATER=m - CONFIG_PHY_QCOM_PCIE2=m -diff --git a/arch/arm64/include/asm/esr.h b/arch/arm64/include/asm/esr.h -index 1cdae1b4f03bee..b04575ea3a355e 100644 ---- a/arch/arm64/include/asm/esr.h -+++ b/arch/arm64/include/asm/esr.h -@@ -366,12 +366,14 @@ - /* - * ISS values for SME traps - */ -- --#define ESR_ELx_SME_ISS_SME_DISABLED 0 --#define ESR_ELx_SME_ISS_ILL 1 --#define ESR_ELx_SME_ISS_SM_DISABLED 2 --#define ESR_ELx_SME_ISS_ZA_DISABLED 3 --#define ESR_ELx_SME_ISS_ZT_DISABLED 4 -+#define ESR_ELx_SME_ISS_SMTC_MASK GENMASK(2, 0) -+#define ESR_ELx_SME_ISS_SMTC(esr) ((esr) & ESR_ELx_SME_ISS_SMTC_MASK) -+ -+#define ESR_ELx_SME_ISS_SMTC_SME_DISABLED 0 -+#define ESR_ELx_SME_ISS_SMTC_ILL 1 -+#define ESR_ELx_SME_ISS_SMTC_SM_DISABLED 2 -+#define ESR_ELx_SME_ISS_SMTC_ZA_DISABLED 3 -+#define ESR_ELx_SME_ISS_SMTC_ZT_DISABLED 4 - - /* ISS field definitions for MOPS exceptions */ - #define ESR_ELx_MOPS_ISS_MEM_INST (UL(1) << 24) -diff --git a/arch/arm64/include/asm/fpsimd.h b/arch/arm64/include/asm/fpsimd.h -index 7415c63b41874d..c4840ea6d137f0 100644 ---- a/arch/arm64/include/asm/fpsimd.h -+++ b/arch/arm64/include/asm/fpsimd.h -@@ -6,6 +6,7 @@ - #define __ASM_FP_H - - #include -+#include - #include - #include - #include -@@ -69,6 +70,8 @@ struct cpu_fp_state { - enum fp_type to_save; - }; - -+DECLARE_PER_CPU(struct cpu_fp_state, fpsimd_last_state); -+ - extern void fpsimd_bind_state_to_cpu(struct cpu_fp_state *fp_state); - - extern void fpsimd_flush_task_state(struct task_struct *target); -diff --git a/arch/arm64/kernel/entry-common.c b/arch/arm64/kernel/entry-common.c -index 0fc94207e69a8e..5e8204d250b437 100644 ---- a/arch/arm64/kernel/entry-common.c -+++ b/arch/arm64/kernel/entry-common.c -@@ -359,20 +359,16 @@ static bool cortex_a76_erratum_1463225_debug_handler(struct pt_regs *regs) - * As per the ABI exit SME streaming mode and clear the SVE state not - * shared with FPSIMD on syscall entry. - */ --static inline void fp_user_discard(void) -+static inline void fpsimd_syscall_enter(void) - { -- /* -- * If SME is active then exit streaming mode. If ZA is active -- * then flush the SVE registers but leave userspace access to -- * both SVE and SME enabled, otherwise disable SME for the -- * task and fall through to disabling SVE too. This means -- * that after a syscall we never have any streaming mode -- * register state to track, if this changes the KVM code will -- * need updating. -- */ -+ /* Ensure PSTATE.SM is clear, but leave PSTATE.ZA as-is. */ - if (system_supports_sme()) - sme_smstop_sm(); - -+ /* -+ * The CPU is not in streaming mode. If non-streaming SVE is not -+ * supported, there is no SVE state that needs to be discarded. -+ */ - if (!system_supports_sve()) - return; - -@@ -382,6 +378,33 @@ static inline void fp_user_discard(void) - sve_vq_minus_one = sve_vq_from_vl(task_get_sve_vl(current)) - 1; - sve_flush_live(true, sve_vq_minus_one); - } -+ -+ /* -+ * Any live non-FPSIMD SVE state has been zeroed. Allow -+ * fpsimd_save_user_state() to lazily discard SVE state until either -+ * the live state is unbound or fpsimd_syscall_exit() is called. -+ */ -+ __this_cpu_write(fpsimd_last_state.to_save, FP_STATE_FPSIMD); -+} -+ -+static __always_inline void fpsimd_syscall_exit(void) -+{ -+ if (!system_supports_sve()) -+ return; -+ -+ /* -+ * The current task's user FPSIMD/SVE/SME state is now bound to this -+ * CPU. The fpsimd_last_state.to_save value is either: -+ * -+ * - FP_STATE_FPSIMD, if the state has not been reloaded on this CPU -+ * since fpsimd_syscall_enter(). -+ * -+ * - FP_STATE_CURRENT, if the state has been reloaded on this CPU at -+ * any point. -+ * -+ * Reset this to FP_STATE_CURRENT to stop lazy discarding. -+ */ -+ __this_cpu_write(fpsimd_last_state.to_save, FP_STATE_CURRENT); - } - - UNHANDLED(el1t, 64, sync) -@@ -673,10 +696,11 @@ static void noinstr el0_svc(struct pt_regs *regs) - { - enter_from_user_mode(regs); - cortex_a76_erratum_1463225_svc_handler(); -- fp_user_discard(); -+ fpsimd_syscall_enter(); - local_daif_restore(DAIF_PROCCTX); - do_el0_svc(regs); - exit_to_user_mode(regs); -+ fpsimd_syscall_exit(); - } - - static void noinstr el0_fpac(struct pt_regs *regs, unsigned long esr) -diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c -index bd4f6c6ee0f318..a1e0cc5353fb12 100644 ---- a/arch/arm64/kernel/fpsimd.c -+++ b/arch/arm64/kernel/fpsimd.c -@@ -119,7 +119,7 @@ - * whatever is in the FPSIMD registers is not saved to memory, but discarded. - */ - --static DEFINE_PER_CPU(struct cpu_fp_state, fpsimd_last_state); -+DEFINE_PER_CPU(struct cpu_fp_state, fpsimd_last_state); - - __ro_after_init struct vl_info vl_info[ARM64_VEC_MAX] = { - #ifdef CONFIG_ARM64_SVE -@@ -473,12 +473,15 @@ static void fpsimd_save(void) - return; - - /* -- * If a task is in a syscall the ABI allows us to only -- * preserve the state shared with FPSIMD so don't bother -- * saving the full SVE state in that case. -+ * Save SVE state if it is live. -+ * -+ * The syscall ABI discards live SVE state at syscall entry. When -+ * entering a syscall, fpsimd_syscall_enter() sets to_save to -+ * FP_STATE_FPSIMD to allow the SVE state to be lazily discarded until -+ * either new SVE state is loaded+bound or fpsimd_syscall_exit() is -+ * called prior to a return to userspace. - */ -- if ((last->to_save == FP_STATE_CURRENT && test_thread_flag(TIF_SVE) && -- !in_syscall(current_pt_regs())) || -+ if ((last->to_save == FP_STATE_CURRENT && test_thread_flag(TIF_SVE)) || - last->to_save == FP_STATE_SVE) { - save_sve_regs = true; - save_ffr = true; -@@ -1514,7 +1517,7 @@ void do_sme_acc(unsigned long esr, struct pt_regs *regs) - * If this not a trap due to SME being disabled then something - * is being used in the wrong mode, report as SIGILL. - */ -- if (ESR_ELx_ISS(esr) != ESR_ELx_SME_ISS_SME_DISABLED) { -+ if (ESR_ELx_SME_ISS_SMTC(esr) != ESR_ELx_SME_ISS_SMTC_SME_DISABLED) { - force_signal_inject(SIGILL, ILL_ILLOPC, regs->pc, 0); - return; - } -@@ -1538,6 +1541,8 @@ void do_sme_acc(unsigned long esr, struct pt_regs *regs) - sme_set_vq(vq_minus_one); - - fpsimd_bind_task_to_cpu(); -+ } else { -+ fpsimd_flush_task_state(current); - } - - put_cpu_fpsimd_context(); -@@ -1803,7 +1808,7 @@ void fpsimd_update_current_state(struct user_fpsimd_state const *state) - get_cpu_fpsimd_context(); - - current->thread.uw.fpsimd_state = *state; -- if (test_thread_flag(TIF_SVE)) -+ if (current->thread.fp_type == FP_STATE_SVE) - fpsimd_to_sve(current); - - task_fpsimd_load(); -diff --git a/arch/arm64/xen/hypercall.S b/arch/arm64/xen/hypercall.S -index 9d01361696a145..ae551b8571374f 100644 ---- a/arch/arm64/xen/hypercall.S -+++ b/arch/arm64/xen/hypercall.S -@@ -83,7 +83,26 @@ HYPERCALL3(vcpu_op); - HYPERCALL1(platform_op_raw); - HYPERCALL2(multicall); - HYPERCALL2(vm_assist); --HYPERCALL3(dm_op); -+ -+SYM_FUNC_START(HYPERVISOR_dm_op) -+ mov x16, #__HYPERVISOR_dm_op; \ -+ /* -+ * dm_op hypercalls are issued by the userspace. The kernel needs to -+ * enable access to TTBR0_EL1 as the hypervisor would issue stage 1 -+ * translations to user memory via AT instructions. Since AT -+ * instructions are not affected by the PAN bit (ARMv8.1), we only -+ * need the explicit uaccess_enable/disable if the TTBR0 PAN emulation -+ * is enabled (it implies that hardware UAO and PAN disabled). -+ */ -+ uaccess_ttbr0_enable x6, x7, x8 -+ hvc XEN_IMM -+ -+ /* -+ * Disable userspace access from kernel once the hyp call completed. -+ */ -+ uaccess_ttbr0_disable x6, x7 -+ ret -+SYM_FUNC_END(HYPERVISOR_dm_op); - - SYM_FUNC_START(privcmd_call) - mov x16, x0 -diff --git a/arch/m68k/mac/config.c b/arch/m68k/mac/config.c -index 382f656c29eaee..9f5603e01a6889 100644 ---- a/arch/m68k/mac/config.c -+++ b/arch/m68k/mac/config.c -@@ -801,7 +801,7 @@ static void __init mac_identify(void) - } - - macintosh_config = mac_data_table; -- for (m = macintosh_config; m->ident != -1; m++) { -+ for (m = &mac_data_table[1]; m->ident != -1; m++) { - if (m->ident == model) { - macintosh_config = m; - break; -diff --git a/arch/mips/boot/dts/loongson/loongson64c_4core_ls7a.dts b/arch/mips/boot/dts/loongson/loongson64c_4core_ls7a.dts -index c7ea4f1c0bb21f..6c277ab83d4b94 100644 ---- a/arch/mips/boot/dts/loongson/loongson64c_4core_ls7a.dts -+++ b/arch/mips/boot/dts/loongson/loongson64c_4core_ls7a.dts -@@ -29,6 +29,7 @@ msi: msi-controller@2ff00000 { - compatible = "loongson,pch-msi-1.0"; - reg = <0 0x2ff00000 0 0x8>; - interrupt-controller; -+ #interrupt-cells = <1>; - msi-controller; - loongson,msi-base-vec = <64>; - loongson,msi-num-vecs = <64>; -diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile -index 2919433be35574..b7629122680b1e 100644 ---- a/arch/powerpc/kernel/Makefile -+++ b/arch/powerpc/kernel/Makefile -@@ -165,7 +165,7 @@ endif - - obj64-$(CONFIG_PPC_TRANSACTIONAL_MEM) += tm.o - --ifneq ($(CONFIG_XMON)$(CONFIG_KEXEC_CORE)(CONFIG_PPC_BOOK3S),) -+ifneq ($(CONFIG_XMON)$(CONFIG_KEXEC_CORE)$(CONFIG_PPC_BOOK3S),) - obj-y += ppc_save_regs.o - endif - -diff --git a/arch/powerpc/kexec/crash.c b/arch/powerpc/kexec/crash.c -index ef5c2d25ec3976..61552bbb1ea8a3 100644 ---- a/arch/powerpc/kexec/crash.c -+++ b/arch/powerpc/kexec/crash.c -@@ -356,7 +356,10 @@ void default_machine_crash_shutdown(struct pt_regs *regs) - if (TRAP(regs) == INTERRUPT_SYSTEM_RESET) - is_via_system_reset = 1; - -- crash_smp_send_stop(); -+ if (IS_ENABLED(CONFIG_SMP)) -+ crash_smp_send_stop(); -+ else -+ crash_kexec_prepare(); - - crash_save_cpu(regs, crashing_cpu); - -diff --git a/arch/powerpc/platforms/book3s/vas-api.c b/arch/powerpc/platforms/book3s/vas-api.c -index 0b6365d85d1171..dc6f75d3ac6ef7 100644 ---- a/arch/powerpc/platforms/book3s/vas-api.c -+++ b/arch/powerpc/platforms/book3s/vas-api.c -@@ -521,6 +521,15 @@ static int coproc_mmap(struct file *fp, struct vm_area_struct *vma) - return -EINVAL; - } - -+ /* -+ * Map complete page to the paste address. So the user -+ * space should pass 0ULL to the offset parameter. -+ */ -+ if (vma->vm_pgoff) { -+ pr_debug("Page offset unsupported to map paste address\n"); -+ return -EINVAL; -+ } -+ - /* Ensure instance has an open send window */ - if (!txwin) { - pr_err("No send window open?\n"); -diff --git a/arch/powerpc/platforms/powernv/memtrace.c b/arch/powerpc/platforms/powernv/memtrace.c -index 877720c645151f..35471b679638a8 100644 ---- a/arch/powerpc/platforms/powernv/memtrace.c -+++ b/arch/powerpc/platforms/powernv/memtrace.c -@@ -48,11 +48,15 @@ static ssize_t memtrace_read(struct file *filp, char __user *ubuf, - static int memtrace_mmap(struct file *filp, struct vm_area_struct *vma) - { - struct memtrace_entry *ent = filp->private_data; -+ unsigned long ent_nrpages = ent->size >> PAGE_SHIFT; -+ unsigned long vma_nrpages = vma_pages(vma); - -- if (ent->size < vma->vm_end - vma->vm_start) -+ /* The requested page offset should be within object's page count */ -+ if (vma->vm_pgoff >= ent_nrpages) - return -EINVAL; - -- if (vma->vm_pgoff << PAGE_SHIFT >= ent->size) -+ /* The requested mapping range should remain within the bounds */ -+ if (vma_nrpages > ent_nrpages - vma->vm_pgoff) - return -EINVAL; - - vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); -diff --git a/arch/riscv/kvm/vcpu_sbi.c b/arch/riscv/kvm/vcpu_sbi.c -index be43278109f4e8..a71d33cd81d3d1 100644 ---- a/arch/riscv/kvm/vcpu_sbi.c -+++ b/arch/riscv/kvm/vcpu_sbi.c -@@ -103,9 +103,9 @@ void kvm_riscv_vcpu_sbi_system_reset(struct kvm_vcpu *vcpu, - struct kvm_vcpu *tmp; - - kvm_for_each_vcpu(i, tmp, vcpu->kvm) { -- spin_lock(&vcpu->arch.mp_state_lock); -+ spin_lock(&tmp->arch.mp_state_lock); - WRITE_ONCE(tmp->arch.mp_state.mp_state, KVM_MP_STATE_STOPPED); -- spin_unlock(&vcpu->arch.mp_state_lock); -+ spin_unlock(&tmp->arch.mp_state_lock); - } - kvm_make_all_cpus_request(vcpu->kvm, KVM_REQ_SLEEP); - -diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c -index 62ee557d4b4996..a40c7ff91caf03 100644 ---- a/arch/s390/net/bpf_jit_comp.c -+++ b/arch/s390/net/bpf_jit_comp.c -@@ -587,17 +587,15 @@ static void bpf_jit_prologue(struct bpf_jit *jit, struct bpf_prog *fp, - } - /* Setup stack and backchain */ - if (is_first_pass(jit) || (jit->seen & SEEN_STACK)) { -- if (is_first_pass(jit) || (jit->seen & SEEN_FUNC)) -- /* lgr %w1,%r15 (backchain) */ -- EMIT4(0xb9040000, REG_W1, REG_15); -+ /* lgr %w1,%r15 (backchain) */ -+ EMIT4(0xb9040000, REG_W1, REG_15); - /* la %bfp,STK_160_UNUSED(%r15) (BPF frame pointer) */ - EMIT4_DISP(0x41000000, BPF_REG_FP, REG_15, STK_160_UNUSED); - /* aghi %r15,-STK_OFF */ - EMIT4_IMM(0xa70b0000, REG_15, -(STK_OFF + stack_depth)); -- if (is_first_pass(jit) || (jit->seen & SEEN_FUNC)) -- /* stg %w1,152(%r15) (backchain) */ -- EMIT6_DISP_LH(0xe3000000, 0x0024, REG_W1, REG_0, -- REG_15, 152); -+ /* stg %w1,152(%r15) (backchain) */ -+ EMIT6_DISP_LH(0xe3000000, 0x0024, REG_W1, REG_0, -+ REG_15, 152); - } - } - -diff --git a/arch/x86/include/asm/mwait.h b/arch/x86/include/asm/mwait.h -index bae83810505bf5..a541411d9226ef 100644 ---- a/arch/x86/include/asm/mwait.h -+++ b/arch/x86/include/asm/mwait.h -@@ -108,13 +108,10 @@ static __always_inline void __sti_mwait(unsigned long eax, unsigned long ecx) - static __always_inline void mwait_idle_with_hints(unsigned long eax, unsigned long ecx) - { - if (static_cpu_has_bug(X86_BUG_MONITOR) || !current_set_polling_and_test()) { -- if (static_cpu_has_bug(X86_BUG_CLFLUSH_MONITOR)) { -- mb(); -- clflush((void *)¤t_thread_info()->flags); -- mb(); -- } -+ const void *addr = ¤t_thread_info()->flags; - -- __monitor((void *)¤t_thread_info()->flags, 0, 0); -+ alternative_input("", "clflush (%[addr])", X86_BUG_CLFLUSH_MONITOR, [addr] "a" (addr)); -+ __monitor(addr, 0, 0); - - if (!need_resched()) { - if (ecx & 1) { -diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index 067e31fb9e165d..b6e43dad577a3c 100644 ---- a/arch/x86/kernel/cpu/common.c -+++ b/arch/x86/kernel/cpu/common.c -@@ -1066,17 +1066,18 @@ void get_cpu_cap(struct cpuinfo_x86 *c) - c->x86_capability[CPUID_D_1_EAX] = eax; - } - -- /* AMD-defined flags: level 0x80000001 */ -+ /* -+ * Check if extended CPUID leaves are implemented: Max extended -+ * CPUID leaf must be in the 0x80000001-0x8000ffff range. -+ */ - eax = cpuid_eax(0x80000000); -- c->extended_cpuid_level = eax; -+ c->extended_cpuid_level = ((eax & 0xffff0000) == 0x80000000) ? eax : 0; - -- if ((eax & 0xffff0000) == 0x80000000) { -- if (eax >= 0x80000001) { -- cpuid(0x80000001, &eax, &ebx, &ecx, &edx); -+ if (c->extended_cpuid_level >= 0x80000001) { -+ cpuid(0x80000001, &eax, &ebx, &ecx, &edx); - -- c->x86_capability[CPUID_8000_0001_ECX] = ecx; -- c->x86_capability[CPUID_8000_0001_EDX] = edx; -- } -+ c->x86_capability[CPUID_8000_0001_ECX] = ecx; -+ c->x86_capability[CPUID_8000_0001_EDX] = edx; - } - - if (c->extended_cpuid_level >= 0x80000007) { -diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c -index 5b47c320f17a6d..fc539346599cb1 100644 ---- a/arch/x86/kernel/cpu/microcode/core.c -+++ b/arch/x86/kernel/cpu/microcode/core.c -@@ -703,6 +703,8 @@ static int load_late_locked(void) - return load_late_stop_cpus(true); - case UCODE_NFOUND: - return -ENOENT; -+ case UCODE_OK: -+ return 0; - default: - return -EBADFD; - } -diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c -index 2d6aa5d2e3d77e..6839440a4b31e3 100644 ---- a/arch/x86/kernel/cpu/mtrr/generic.c -+++ b/arch/x86/kernel/cpu/mtrr/generic.c -@@ -582,7 +582,7 @@ static void get_fixed_ranges(mtrr_type *frs) - - void mtrr_save_fixed_ranges(void *info) - { -- if (boot_cpu_has(X86_FEATURE_MTRR)) -+ if (mtrr_state.have_fixed) - get_fixed_ranges(mtrr_state.fixed_ranges); - } - -diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c -index e2fab3ceb09fb7..9a101150376db7 100644 ---- a/arch/x86/kernel/ioport.c -+++ b/arch/x86/kernel/ioport.c -@@ -33,8 +33,9 @@ void io_bitmap_share(struct task_struct *tsk) - set_tsk_thread_flag(tsk, TIF_IO_BITMAP); - } - --static void task_update_io_bitmap(struct task_struct *tsk) -+static void task_update_io_bitmap(void) - { -+ struct task_struct *tsk = current; - struct thread_struct *t = &tsk->thread; - - if (t->iopl_emul == 3 || t->io_bitmap) { -@@ -54,7 +55,12 @@ void io_bitmap_exit(struct task_struct *tsk) - struct io_bitmap *iobm = tsk->thread.io_bitmap; - - tsk->thread.io_bitmap = NULL; -- task_update_io_bitmap(tsk); -+ /* -+ * Don't touch the TSS when invoked on a failed fork(). TSS -+ * reflects the state of @current and not the state of @tsk. -+ */ -+ if (tsk == current) -+ task_update_io_bitmap(); - if (iobm && refcount_dec_and_test(&iobm->refcnt)) - kfree(iobm); - } -@@ -192,8 +198,7 @@ SYSCALL_DEFINE1(iopl, unsigned int, level) - } - - t->iopl_emul = level; -- task_update_io_bitmap(current); -- -+ task_update_io_bitmap(); - return 0; - } - -diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c -index 419353904173ff..33c235e9d0d3fb 100644 ---- a/arch/x86/kernel/process.c -+++ b/arch/x86/kernel/process.c -@@ -180,6 +180,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) - frame->ret_addr = (unsigned long) ret_from_fork_asm; - p->thread.sp = (unsigned long) fork_frame; - p->thread.io_bitmap = NULL; -+ clear_tsk_thread_flag(p, TIF_IO_BITMAP); - p->thread.iopl_warn = 0; - memset(p->thread.ptrace_bps, 0, sizeof(p->thread.ptrace_bps)); - -@@ -468,6 +469,11 @@ void native_tss_update_io_bitmap(void) - } else { - struct io_bitmap *iobm = t->io_bitmap; - -+ if (WARN_ON_ONCE(!iobm)) { -+ clear_thread_flag(TIF_IO_BITMAP); -+ native_tss_invalidate_io_bitmap(); -+ } -+ - /* - * Only copy bitmap data when the sequence number differs. The - * update time is accounted to the incoming task. -@@ -923,13 +929,10 @@ static int prefer_mwait_c1_over_halt(const struct cpuinfo_x86 *c) - static __cpuidle void mwait_idle(void) - { - if (!current_set_polling_and_test()) { -- if (this_cpu_has(X86_BUG_CLFLUSH_MONITOR)) { -- mb(); /* quirk */ -- clflush((void *)¤t_thread_info()->flags); -- mb(); /* quirk */ -- } -+ const void *addr = ¤t_thread_info()->flags; - -- __monitor((void *)¤t_thread_info()->flags, 0, 0); -+ alternative_input("", "clflush (%[addr])", X86_BUG_CLFLUSH_MONITOR, [addr] "a" (addr)); -+ __monitor(addr, 0, 0); - if (!need_resched()) { - __sti_mwait(0, 0); - raw_local_irq_disable(); -diff --git a/crypto/lrw.c b/crypto/lrw.c -index 59260aefed2807..5536ec7bf18f14 100644 ---- a/crypto/lrw.c -+++ b/crypto/lrw.c -@@ -322,7 +322,7 @@ static int lrw_create(struct crypto_template *tmpl, struct rtattr **tb) - - err = crypto_grab_skcipher(spawn, skcipher_crypto_instance(inst), - cipher_name, 0, mask); -- if (err == -ENOENT) { -+ if (err == -ENOENT && memcmp(cipher_name, "ecb(", 4)) { - err = -ENAMETOOLONG; - if (snprintf(ecb_name, CRYPTO_MAX_ALG_NAME, "ecb(%s)", - cipher_name) >= CRYPTO_MAX_ALG_NAME) -@@ -356,7 +356,7 @@ static int lrw_create(struct crypto_template *tmpl, struct rtattr **tb) - /* Alas we screwed up the naming so we have to mangle the - * cipher name. - */ -- if (!strncmp(cipher_name, "ecb(", 4)) { -+ if (!memcmp(cipher_name, "ecb(", 4)) { - int len; - - len = strscpy(ecb_name, cipher_name + 4, sizeof(ecb_name)); -diff --git a/crypto/xts.c b/crypto/xts.c -index 038f60dd512d9f..97fd0fb8757c23 100644 ---- a/crypto/xts.c -+++ b/crypto/xts.c -@@ -363,7 +363,7 @@ static int xts_create(struct crypto_template *tmpl, struct rtattr **tb) - - err = crypto_grab_skcipher(&ctx->spawn, skcipher_crypto_instance(inst), - cipher_name, 0, mask); -- if (err == -ENOENT) { -+ if (err == -ENOENT && memcmp(cipher_name, "ecb(", 4)) { - err = -ENAMETOOLONG; - if (snprintf(name, CRYPTO_MAX_ALG_NAME, "ecb(%s)", - cipher_name) >= CRYPTO_MAX_ALG_NAME) -@@ -397,7 +397,7 @@ static int xts_create(struct crypto_template *tmpl, struct rtattr **tb) - /* Alas we screwed up the naming so we have to mangle the - * cipher name. - */ -- if (!strncmp(cipher_name, "ecb(", 4)) { -+ if (!memcmp(cipher_name, "ecb(", 4)) { - int len; - - len = strscpy(name, cipher_name + 4, sizeof(name)); -diff --git a/drivers/acpi/acpica/exserial.c b/drivers/acpi/acpica/exserial.c -index 5241f4c01c7655..89a4ac447a2bea 100644 ---- a/drivers/acpi/acpica/exserial.c -+++ b/drivers/acpi/acpica/exserial.c -@@ -201,6 +201,12 @@ acpi_ex_read_serial_bus(union acpi_operand_object *obj_desc, - function = ACPI_READ; - break; - -+ case ACPI_ADR_SPACE_FIXED_HARDWARE: -+ -+ buffer_length = ACPI_FFH_INPUT_BUFFER_SIZE; -+ function = ACPI_READ; -+ break; -+ - default: - return_ACPI_STATUS(AE_AML_INVALID_SPACE_ID); - } -diff --git a/drivers/acpi/apei/Kconfig b/drivers/acpi/apei/Kconfig -index 6b18f8bc7be353..71e0d64a7792e9 100644 ---- a/drivers/acpi/apei/Kconfig -+++ b/drivers/acpi/apei/Kconfig -@@ -23,6 +23,7 @@ config ACPI_APEI_GHES - select ACPI_HED - select IRQ_WORK - select GENERIC_ALLOCATOR -+ select ARM_SDE_INTERFACE if ARM64 - help - Generic Hardware Error Source provides a way to report - platform hardware errors (such as that from chipset). It -diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c -index 3aadc632d7dd53..2abf20736702c0 100644 ---- a/drivers/acpi/apei/ghes.c -+++ b/drivers/acpi/apei/ghes.c -@@ -1523,7 +1523,7 @@ void __init acpi_ghes_init(void) - { - int rc; - -- sdei_init(); -+ acpi_sdei_init(); - - if (acpi_disabled) - return; -diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c -index ed02a2a9970aa3..10d531427ba77d 100644 ---- a/drivers/acpi/cppc_acpi.c -+++ b/drivers/acpi/cppc_acpi.c -@@ -461,7 +461,7 @@ bool cppc_allow_fast_switch(void) - struct cpc_desc *cpc_ptr; - int cpu; - -- for_each_possible_cpu(cpu) { -+ for_each_present_cpu(cpu) { - cpc_ptr = per_cpu(cpc_desc_ptr, cpu); - desired_reg = &cpc_ptr->cpc_regs[DESIRED_PERF]; - if (!CPC_IN_SYSTEM_MEMORY(desired_reg) && -diff --git a/drivers/acpi/osi.c b/drivers/acpi/osi.c -index d4405e1ca9b971..ae9620757865b1 100644 ---- a/drivers/acpi/osi.c -+++ b/drivers/acpi/osi.c -@@ -42,7 +42,6 @@ static struct acpi_osi_entry - osi_setup_entries[OSI_STRING_ENTRIES_MAX] __initdata = { - {"Module Device", true}, - {"Processor Device", true}, -- {"3.0 _SCP Extensions", true}, - {"Processor Aggregator Device", true}, - }; - -diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c -index d9d339b8b57108..d1dae47f3534b8 100644 ---- a/drivers/base/power/domain.c -+++ b/drivers/base/power/domain.c -@@ -2856,7 +2856,7 @@ struct device *genpd_dev_pm_attach_by_id(struct device *dev, - /* Verify that the index is within a valid range. */ - num_domains = of_count_phandle_with_args(dev->of_node, "power-domains", - "#power-domain-cells"); -- if (index >= num_domains) -+ if (num_domains < 0 || index >= num_domains) - return NULL; - - /* Allocate and register device on the genpd bus. */ -diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c -index 343d3c966e7a7b..baa31194cf20d5 100644 ---- a/drivers/base/power/main.c -+++ b/drivers/base/power/main.c -@@ -897,6 +897,8 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async) - if (!dev->power.is_suspended) - goto Complete; - -+ dev->power.is_suspended = false; -+ - if (dev->power.direct_complete) { - /* Match the pm_runtime_disable() in __device_suspend(). */ - pm_runtime_enable(dev); -@@ -952,7 +954,6 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async) - - End: - error = dpm_run_callback(callback, dev, state, info); -- dev->power.is_suspended = false; - - device_unlock(dev); - dpm_watchdog_clear(&wd); -diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c -index 7a552387129ef0..9c6f79d8605329 100644 ---- a/drivers/bluetooth/hci_qca.c -+++ b/drivers/bluetooth/hci_qca.c -@@ -2307,14 +2307,14 @@ static int qca_serdev_probe(struct serdev_device *serdev) - - qcadev->bt_en = devm_gpiod_get_optional(&serdev->dev, "enable", - GPIOD_OUT_LOW); -- if (IS_ERR(qcadev->bt_en) && -- (data->soc_type == QCA_WCN6750 || -- data->soc_type == QCA_WCN6855)) { -- dev_err(&serdev->dev, "failed to acquire BT_EN gpio\n"); -- return PTR_ERR(qcadev->bt_en); -- } -+ if (IS_ERR(qcadev->bt_en)) -+ return dev_err_probe(&serdev->dev, -+ PTR_ERR(qcadev->bt_en), -+ "failed to acquire BT_EN gpio\n"); - -- if (!qcadev->bt_en) -+ if (!qcadev->bt_en && -+ (data->soc_type == QCA_WCN6750 || -+ data->soc_type == QCA_WCN6855)) - power_ctrl_enabled = false; - - qcadev->sw_ctrl = devm_gpiod_get_optional(&serdev->dev, "swctrl", -diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c -index 2f6d5002e43d58..b405ee330af1fc 100644 ---- a/drivers/bus/fsl-mc/fsl-mc-bus.c -+++ b/drivers/bus/fsl-mc/fsl-mc-bus.c -@@ -905,8 +905,10 @@ int fsl_mc_device_add(struct fsl_mc_obj_desc *obj_desc, - - error_cleanup_dev: - kfree(mc_dev->regions); -- kfree(mc_bus); -- kfree(mc_dev); -+ if (mc_bus) -+ kfree(mc_bus); -+ else -+ kfree(mc_dev); - - return error; - } -diff --git a/drivers/clk/bcm/clk-raspberrypi.c b/drivers/clk/bcm/clk-raspberrypi.c -index 4d411408e4afef..cc4ca336ac13a3 100644 ---- a/drivers/clk/bcm/clk-raspberrypi.c -+++ b/drivers/clk/bcm/clk-raspberrypi.c -@@ -271,6 +271,8 @@ static struct clk_hw *raspberrypi_clk_register(struct raspberrypi_clk *rpi, - init.name = devm_kasprintf(rpi->dev, GFP_KERNEL, - "fw-clk-%s", - rpi_firmware_clk_names[id]); -+ if (!init.name) -+ return ERR_PTR(-ENOMEM); - init.ops = &raspberrypi_firmware_clk_ops; - init.flags = CLK_GET_RATE_NOCACHE; - -diff --git a/drivers/clk/qcom/camcc-sm6350.c b/drivers/clk/qcom/camcc-sm6350.c -index acba9f99d960c7..eca36bd3ba5c94 100644 ---- a/drivers/clk/qcom/camcc-sm6350.c -+++ b/drivers/clk/qcom/camcc-sm6350.c -@@ -1694,6 +1694,9 @@ static struct clk_branch camcc_sys_tmr_clk = { - - static struct gdsc bps_gdsc = { - .gdscr = 0x6004, -+ .en_rest_wait_val = 0x2, -+ .en_few_wait_val = 0x2, -+ .clk_dis_wait_val = 0xf, - .pd = { - .name = "bps_gdsc", - }, -@@ -1703,6 +1706,9 @@ static struct gdsc bps_gdsc = { - - static struct gdsc ipe_0_gdsc = { - .gdscr = 0x7004, -+ .en_rest_wait_val = 0x2, -+ .en_few_wait_val = 0x2, -+ .clk_dis_wait_val = 0xf, - .pd = { - .name = "ipe_0_gdsc", - }, -@@ -1712,6 +1718,9 @@ static struct gdsc ipe_0_gdsc = { - - static struct gdsc ife_0_gdsc = { - .gdscr = 0x9004, -+ .en_rest_wait_val = 0x2, -+ .en_few_wait_val = 0x2, -+ .clk_dis_wait_val = 0xf, - .pd = { - .name = "ife_0_gdsc", - }, -@@ -1720,6 +1729,9 @@ static struct gdsc ife_0_gdsc = { - - static struct gdsc ife_1_gdsc = { - .gdscr = 0xa004, -+ .en_rest_wait_val = 0x2, -+ .en_few_wait_val = 0x2, -+ .clk_dis_wait_val = 0xf, - .pd = { - .name = "ife_1_gdsc", - }, -@@ -1728,6 +1740,9 @@ static struct gdsc ife_1_gdsc = { - - static struct gdsc ife_2_gdsc = { - .gdscr = 0xb004, -+ .en_rest_wait_val = 0x2, -+ .en_few_wait_val = 0x2, -+ .clk_dis_wait_val = 0xf, - .pd = { - .name = "ife_2_gdsc", - }, -@@ -1736,6 +1751,9 @@ static struct gdsc ife_2_gdsc = { - - static struct gdsc titan_top_gdsc = { - .gdscr = 0x14004, -+ .en_rest_wait_val = 0x2, -+ .en_few_wait_val = 0x2, -+ .clk_dis_wait_val = 0xf, - .pd = { - .name = "titan_top_gdsc", - }, -diff --git a/drivers/clk/qcom/dispcc-sm6350.c b/drivers/clk/qcom/dispcc-sm6350.c -index ddacb4f76eca5f..ea98a63746f0f1 100644 ---- a/drivers/clk/qcom/dispcc-sm6350.c -+++ b/drivers/clk/qcom/dispcc-sm6350.c -@@ -680,6 +680,9 @@ static struct clk_branch disp_cc_xo_clk = { - - static struct gdsc mdss_gdsc = { - .gdscr = 0x1004, -+ .en_rest_wait_val = 0x2, -+ .en_few_wait_val = 0x2, -+ .clk_dis_wait_val = 0xf, - .pd = { - .name = "mdss_gdsc", - }, -diff --git a/drivers/clk/qcom/gcc-msm8939.c b/drivers/clk/qcom/gcc-msm8939.c -index b45f97c07eeb6f..e4a44377b75f74 100644 ---- a/drivers/clk/qcom/gcc-msm8939.c -+++ b/drivers/clk/qcom/gcc-msm8939.c -@@ -432,7 +432,7 @@ static const struct parent_map gcc_xo_gpll0_gpll1a_gpll6_sleep_map[] = { - { P_XO, 0 }, - { P_GPLL0, 1 }, - { P_GPLL1_AUX, 2 }, -- { P_GPLL6, 2 }, -+ { P_GPLL6, 3 }, - { P_SLEEP_CLK, 6 }, - }; - -@@ -1100,7 +1100,7 @@ static struct clk_rcg2 jpeg0_clk_src = { - }; - - static const struct freq_tbl ftbl_gcc_camss_mclk0_1_clk[] = { -- F(24000000, P_GPLL0, 1, 1, 45), -+ F(24000000, P_GPLL6, 1, 1, 45), - F(66670000, P_GPLL0, 12, 0, 0), - { } - }; -diff --git a/drivers/clk/qcom/gcc-sm6350.c b/drivers/clk/qcom/gcc-sm6350.c -index 428cd99dcdcbe5..4031613c6236fb 100644 ---- a/drivers/clk/qcom/gcc-sm6350.c -+++ b/drivers/clk/qcom/gcc-sm6350.c -@@ -2320,6 +2320,9 @@ static struct clk_branch gcc_video_xo_clk = { - - static struct gdsc usb30_prim_gdsc = { - .gdscr = 0x1a004, -+ .en_rest_wait_val = 0x2, -+ .en_few_wait_val = 0x2, -+ .clk_dis_wait_val = 0xf, - .pd = { - .name = "usb30_prim_gdsc", - }, -@@ -2328,6 +2331,9 @@ static struct gdsc usb30_prim_gdsc = { - - static struct gdsc ufs_phy_gdsc = { - .gdscr = 0x3a004, -+ .en_rest_wait_val = 0x2, -+ .en_few_wait_val = 0x2, -+ .clk_dis_wait_val = 0xf, - .pd = { - .name = "ufs_phy_gdsc", - }, -diff --git a/drivers/clk/qcom/gpucc-sm6350.c b/drivers/clk/qcom/gpucc-sm6350.c -index 0bcbba2a294365..86c8ad5b55bac4 100644 ---- a/drivers/clk/qcom/gpucc-sm6350.c -+++ b/drivers/clk/qcom/gpucc-sm6350.c -@@ -412,6 +412,9 @@ static struct clk_branch gpu_cc_gx_vsense_clk = { - static struct gdsc gpu_cx_gdsc = { - .gdscr = 0x106c, - .gds_hw_ctrl = 0x1540, -+ .en_rest_wait_val = 0x2, -+ .en_few_wait_val = 0x2, -+ .clk_dis_wait_val = 0x8, - .pd = { - .name = "gpu_cx_gdsc", - }, -@@ -422,6 +425,9 @@ static struct gdsc gpu_cx_gdsc = { - static struct gdsc gpu_gx_gdsc = { - .gdscr = 0x100c, - .clamp_io_ctrl = 0x1508, -+ .en_rest_wait_val = 0x2, -+ .en_few_wait_val = 0x2, -+ .clk_dis_wait_val = 0x2, - .pd = { - .name = "gpu_gx_gdsc", - .power_on = gdsc_gx_do_nothing_enable, -diff --git a/drivers/counter/interrupt-cnt.c b/drivers/counter/interrupt-cnt.c -index 229473855c5b38..bc762ba87a19b6 100644 ---- a/drivers/counter/interrupt-cnt.c -+++ b/drivers/counter/interrupt-cnt.c -@@ -3,12 +3,14 @@ - * Copyright (c) 2021 Pengutronix, Oleksij Rempel - */ - -+#include - #include - #include - #include - #include - #include - #include -+#include - #include - #include - -@@ -19,6 +21,7 @@ struct interrupt_cnt_priv { - struct gpio_desc *gpio; - int irq; - bool enabled; -+ struct mutex lock; - struct counter_signal signals; - struct counter_synapse synapses; - struct counter_count cnts; -@@ -41,6 +44,8 @@ static int interrupt_cnt_enable_read(struct counter_device *counter, - { - struct interrupt_cnt_priv *priv = counter_priv(counter); - -+ guard(mutex)(&priv->lock); -+ - *enable = priv->enabled; - - return 0; -@@ -51,6 +56,8 @@ static int interrupt_cnt_enable_write(struct counter_device *counter, - { - struct interrupt_cnt_priv *priv = counter_priv(counter); - -+ guard(mutex)(&priv->lock); -+ - if (priv->enabled == enable) - return 0; - -@@ -227,6 +234,8 @@ static int interrupt_cnt_probe(struct platform_device *pdev) - if (ret) - return ret; - -+ mutex_init(&priv->lock); -+ - ret = devm_counter_add(dev, counter); - if (ret < 0) - return dev_err_probe(dev, ret, "Failed to add counter\n"); -diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c -index 0615e7fa20ad7e..0bfced81cc17e1 100644 ---- a/drivers/cpufreq/acpi-cpufreq.c -+++ b/drivers/cpufreq/acpi-cpufreq.c -@@ -659,7 +659,7 @@ static u64 get_max_boost_ratio(unsigned int cpu, u64 *nominal_freq) - nominal_perf = perf_caps.nominal_perf; - - if (nominal_freq) -- *nominal_freq = perf_caps.nominal_freq; -+ *nominal_freq = perf_caps.nominal_freq * 1000; - - if (!highest_perf || !nominal_perf) { - pr_debug("CPU%d: highest or nominal performance missing\n", cpu); -diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c -index d2cf9619018b1a..70434601f99bed 100644 ---- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c -+++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c -@@ -275,13 +275,16 @@ static int sun8i_ce_cipher_prepare(struct crypto_engine *engine, void *async_req - } else { - if (nr_sgs > 0) - dma_unmap_sg(ce->dev, areq->src, ns, DMA_TO_DEVICE); -- dma_unmap_sg(ce->dev, areq->dst, nd, DMA_FROM_DEVICE); -+ -+ if (nr_sgd > 0) -+ dma_unmap_sg(ce->dev, areq->dst, nd, DMA_FROM_DEVICE); - } - - theend_iv: - if (areq->iv && ivsize > 0) { -- if (rctx->addr_iv) -+ if (!dma_mapping_error(ce->dev, rctx->addr_iv)) - dma_unmap_single(ce->dev, rctx->addr_iv, rctx->ivlen, DMA_TO_DEVICE); -+ - offset = areq->cryptlen - ivsize; - if (rctx->op_dir & CE_DECRYPTION) { - memcpy(areq->iv, chan->backup_iv, ivsize); -diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c -index d358334e598115..ebc857ed10e11e 100644 ---- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c -+++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c -@@ -343,9 +343,8 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq) - u32 common; - u64 byte_count; - __le32 *bf; -- void *buf = NULL; -+ void *buf, *result; - int j, i, todo; -- void *result = NULL; - u64 bs; - int digestsize; - dma_addr_t addr_res, addr_pad; -@@ -365,14 +364,14 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq) - buf = kzalloc(bs * 2, GFP_KERNEL | GFP_DMA); - if (!buf) { - err = -ENOMEM; -- goto theend; -+ goto err_out; - } - bf = (__le32 *)buf; - - result = kzalloc(digestsize, GFP_KERNEL | GFP_DMA); - if (!result) { - err = -ENOMEM; -- goto theend; -+ goto err_free_buf; - } - - flow = rctx->flow; -@@ -398,7 +397,7 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq) - if (nr_sgs <= 0 || nr_sgs > MAX_SG) { - dev_err(ce->dev, "Invalid sg number %d\n", nr_sgs); - err = -EINVAL; -- goto theend; -+ goto err_free_result; - } - - len = areq->nbytes; -@@ -411,7 +410,7 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq) - if (len > 0) { - dev_err(ce->dev, "remaining len %d\n", len); - err = -EINVAL; -- goto theend; -+ goto err_unmap_src; - } - addr_res = dma_map_single(ce->dev, result, digestsize, DMA_FROM_DEVICE); - cet->t_dst[0].addr = cpu_to_le32(addr_res); -@@ -419,7 +418,7 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq) - if (dma_mapping_error(ce->dev, addr_res)) { - dev_err(ce->dev, "DMA map dest\n"); - err = -EINVAL; -- goto theend; -+ goto err_unmap_src; - } - - byte_count = areq->nbytes; -@@ -441,7 +440,7 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq) - } - if (!j) { - err = -EINVAL; -- goto theend; -+ goto err_unmap_result; - } - - addr_pad = dma_map_single(ce->dev, buf, j * 4, DMA_TO_DEVICE); -@@ -450,7 +449,7 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq) - if (dma_mapping_error(ce->dev, addr_pad)) { - dev_err(ce->dev, "DMA error on padding SG\n"); - err = -EINVAL; -- goto theend; -+ goto err_unmap_result; - } - - if (ce->variant->hash_t_dlen_in_bits) -@@ -463,16 +462,25 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq) - err = sun8i_ce_run_task(ce, flow, crypto_ahash_alg_name(tfm)); - - dma_unmap_single(ce->dev, addr_pad, j * 4, DMA_TO_DEVICE); -- dma_unmap_sg(ce->dev, areq->src, ns, DMA_TO_DEVICE); -+ -+err_unmap_result: - dma_unmap_single(ce->dev, addr_res, digestsize, DMA_FROM_DEVICE); -+ if (!err) -+ memcpy(areq->result, result, algt->alg.hash.base.halg.digestsize); - -+err_unmap_src: -+ dma_unmap_sg(ce->dev, areq->src, ns, DMA_TO_DEVICE); - -- memcpy(areq->result, result, algt->alg.hash.base.halg.digestsize); --theend: -- kfree(buf); -+err_free_result: - kfree(result); -+ -+err_free_buf: -+ kfree(buf); -+ -+err_out: - local_bh_disable(); - crypto_finalize_hash_request(engine, breq, err); - local_bh_enable(); -+ - return 0; - } -diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h -index 93d4985def87a7..65cc1278ee1555 100644 ---- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h -+++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h -@@ -293,8 +293,8 @@ struct sun8i_ce_hash_tfm_ctx { - * @flow: the flow to use for this request - */ - struct sun8i_ce_hash_reqctx { -- struct ahash_request fallback_req; - int flow; -+ struct ahash_request fallback_req; // keep at the end - }; - - /* -diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c -index 7fa359725ec75f..9b18fb46a2c89f 100644 ---- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c -+++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c -@@ -141,7 +141,7 @@ static int sun8i_ss_setup_ivs(struct skcipher_request *areq) - - /* we need to copy all IVs from source in case DMA is bi-directionnal */ - while (sg && len) { -- if (sg_dma_len(sg) == 0) { -+ if (sg->length == 0) { - sg = sg_next(sg); - continue; - } -diff --git a/drivers/crypto/marvell/cesa/cipher.c b/drivers/crypto/marvell/cesa/cipher.c -index 0f37dfd42d8509..3876e3ce822f44 100644 ---- a/drivers/crypto/marvell/cesa/cipher.c -+++ b/drivers/crypto/marvell/cesa/cipher.c -@@ -459,6 +459,9 @@ static int mv_cesa_skcipher_queue_req(struct skcipher_request *req, - struct mv_cesa_skcipher_req *creq = skcipher_request_ctx(req); - struct mv_cesa_engine *engine; - -+ if (!req->cryptlen) -+ return 0; -+ - ret = mv_cesa_skcipher_req_init(req, tmpl); - if (ret) - return ret; -diff --git a/drivers/crypto/marvell/cesa/hash.c b/drivers/crypto/marvell/cesa/hash.c -index f150861ceaf695..6815eddc906812 100644 ---- a/drivers/crypto/marvell/cesa/hash.c -+++ b/drivers/crypto/marvell/cesa/hash.c -@@ -663,7 +663,7 @@ static int mv_cesa_ahash_dma_req_init(struct ahash_request *req) - if (ret) - goto err_free_tdma; - -- if (iter.src.sg) { -+ if (iter.base.len > iter.src.op_offset) { - /* - * Add all the new data, inserting an operation block and - * launch command between each full SRAM block-worth of -diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c -index 418e1774af1e5e..d99cf81358c54e 100644 ---- a/drivers/dma/ti/k3-udma.c -+++ b/drivers/dma/ti/k3-udma.c -@@ -5537,7 +5537,8 @@ static int udma_probe(struct platform_device *pdev) - uc->config.dir = DMA_MEM_TO_MEM; - uc->name = devm_kasprintf(dev, GFP_KERNEL, "%s chan%d", - dev_name(dev), i); -- -+ if (!uc->name) -+ return -ENOMEM; - vchan_init(&uc->vc, &ud->ddev); - /* Use custom vchan completion handling */ - tasklet_setup(&uc->vc.task, udma_vchan_complete); -diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c -index 67a46abe07da9e..068597e8fce95a 100644 ---- a/drivers/edac/i10nm_base.c -+++ b/drivers/edac/i10nm_base.c -@@ -99,7 +99,7 @@ static u32 offsets_demand2_spr[] = {0x22c70, 0x22d80, 0x22f18, 0x22d58, 0x22c64, - static u32 offsets_demand_spr_hbm0[] = {0x2a54, 0x2a60, 0x2b10, 0x2a58, 0x2a5c, 0x0ee0}; - static u32 offsets_demand_spr_hbm1[] = {0x2e54, 0x2e60, 0x2f10, 0x2e58, 0x2e5c, 0x0fb0}; - --static void __enable_retry_rd_err_log(struct skx_imc *imc, int chan, bool enable, -+static void __enable_retry_rd_err_log(struct skx_imc *imc, int chan, bool enable, u32 *rrl_ctl, - u32 *offsets_scrub, u32 *offsets_demand, - u32 *offsets_demand2) - { -@@ -112,10 +112,10 @@ static void __enable_retry_rd_err_log(struct skx_imc *imc, int chan, bool enable - - if (enable) { - /* Save default configurations */ -- imc->chan[chan].retry_rd_err_log_s = s; -- imc->chan[chan].retry_rd_err_log_d = d; -+ rrl_ctl[0] = s; -+ rrl_ctl[1] = d; - if (offsets_demand2) -- imc->chan[chan].retry_rd_err_log_d2 = d2; -+ rrl_ctl[2] = d2; - - s &= ~RETRY_RD_ERR_LOG_NOOVER_UC; - s |= RETRY_RD_ERR_LOG_EN; -@@ -129,25 +129,25 @@ static void __enable_retry_rd_err_log(struct skx_imc *imc, int chan, bool enable - } - } else { - /* Restore default configurations */ -- if (imc->chan[chan].retry_rd_err_log_s & RETRY_RD_ERR_LOG_UC) -+ if (rrl_ctl[0] & RETRY_RD_ERR_LOG_UC) - s |= RETRY_RD_ERR_LOG_UC; -- if (imc->chan[chan].retry_rd_err_log_s & RETRY_RD_ERR_LOG_NOOVER) -+ if (rrl_ctl[0] & RETRY_RD_ERR_LOG_NOOVER) - s |= RETRY_RD_ERR_LOG_NOOVER; -- if (!(imc->chan[chan].retry_rd_err_log_s & RETRY_RD_ERR_LOG_EN)) -+ if (!(rrl_ctl[0] & RETRY_RD_ERR_LOG_EN)) - s &= ~RETRY_RD_ERR_LOG_EN; -- if (imc->chan[chan].retry_rd_err_log_d & RETRY_RD_ERR_LOG_UC) -+ if (rrl_ctl[1] & RETRY_RD_ERR_LOG_UC) - d |= RETRY_RD_ERR_LOG_UC; -- if (imc->chan[chan].retry_rd_err_log_d & RETRY_RD_ERR_LOG_NOOVER) -+ if (rrl_ctl[1] & RETRY_RD_ERR_LOG_NOOVER) - d |= RETRY_RD_ERR_LOG_NOOVER; -- if (!(imc->chan[chan].retry_rd_err_log_d & RETRY_RD_ERR_LOG_EN)) -+ if (!(rrl_ctl[1] & RETRY_RD_ERR_LOG_EN)) - d &= ~RETRY_RD_ERR_LOG_EN; - - if (offsets_demand2) { -- if (imc->chan[chan].retry_rd_err_log_d2 & RETRY_RD_ERR_LOG_UC) -+ if (rrl_ctl[2] & RETRY_RD_ERR_LOG_UC) - d2 |= RETRY_RD_ERR_LOG_UC; -- if (!(imc->chan[chan].retry_rd_err_log_d2 & RETRY_RD_ERR_LOG_NOOVER)) -+ if (!(rrl_ctl[2] & RETRY_RD_ERR_LOG_NOOVER)) - d2 &= ~RETRY_RD_ERR_LOG_NOOVER; -- if (!(imc->chan[chan].retry_rd_err_log_d2 & RETRY_RD_ERR_LOG_EN)) -+ if (!(rrl_ctl[2] & RETRY_RD_ERR_LOG_EN)) - d2 &= ~RETRY_RD_ERR_LOG_EN; - } - } -@@ -161,6 +161,7 @@ static void __enable_retry_rd_err_log(struct skx_imc *imc, int chan, bool enable - static void enable_retry_rd_err_log(bool enable) - { - int i, j, imc_num, chan_num; -+ struct skx_channel *chan; - struct skx_imc *imc; - struct skx_dev *d; - -@@ -175,8 +176,9 @@ static void enable_retry_rd_err_log(bool enable) - if (!imc->mbase) - continue; - -+ chan = d->imc[i].chan; - for (j = 0; j < chan_num; j++) -- __enable_retry_rd_err_log(imc, j, enable, -+ __enable_retry_rd_err_log(imc, j, enable, chan[j].rrl_ctl[0], - res_cfg->offsets_scrub, - res_cfg->offsets_demand, - res_cfg->offsets_demand2); -@@ -190,12 +192,13 @@ static void enable_retry_rd_err_log(bool enable) - if (!imc->mbase || !imc->hbm_mc) - continue; - -+ chan = d->imc[i].chan; - for (j = 0; j < chan_num; j++) { -- __enable_retry_rd_err_log(imc, j, enable, -+ __enable_retry_rd_err_log(imc, j, enable, chan[j].rrl_ctl[0], - res_cfg->offsets_scrub_hbm0, - res_cfg->offsets_demand_hbm0, - NULL); -- __enable_retry_rd_err_log(imc, j, enable, -+ __enable_retry_rd_err_log(imc, j, enable, chan[j].rrl_ctl[1], - res_cfg->offsets_scrub_hbm1, - res_cfg->offsets_demand_hbm1, - NULL); -diff --git a/drivers/edac/skx_common.c b/drivers/edac/skx_common.c -index d47f0055217e43..9e43aed72bd9fa 100644 ---- a/drivers/edac/skx_common.c -+++ b/drivers/edac/skx_common.c -@@ -115,6 +115,7 @@ EXPORT_SYMBOL_GPL(skx_adxl_get); - - void skx_adxl_put(void) - { -+ adxl_component_count = 0; - kfree(adxl_values); - kfree(adxl_msg); - } -diff --git a/drivers/edac/skx_common.h b/drivers/edac/skx_common.h -index 5acfef8fd3d362..2ea4d1d1fbef26 100644 ---- a/drivers/edac/skx_common.h -+++ b/drivers/edac/skx_common.h -@@ -80,6 +80,9 @@ - */ - #define MCACOD_EXT_MEM_ERR 0x280 - -+/* Max RRL register sets per {,sub-,pseudo-}channel. */ -+#define NUM_RRL_SET 3 -+ - /* - * Each cpu socket contains some pci devices that provide global - * information, and also some that are local to each of the two -@@ -118,9 +121,11 @@ struct skx_dev { - struct skx_channel { - struct pci_dev *cdev; - struct pci_dev *edev; -- u32 retry_rd_err_log_s; -- u32 retry_rd_err_log_d; -- u32 retry_rd_err_log_d2; -+ /* -+ * Two groups of RRL control registers per channel to save default RRL -+ * settings of two {sub-,pseudo-}channels in Linux RRL control mode. -+ */ -+ u32 rrl_ctl[2][NUM_RRL_SET]; - struct skx_dimm { - u8 close_pg; - u8 bank_xor_enable; -diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig -index 3f2f22e47bfa1a..8ecffdce94b166 100644 ---- a/drivers/firmware/Kconfig -+++ b/drivers/firmware/Kconfig -@@ -40,7 +40,6 @@ config ARM_SCPI_POWER_DOMAIN - config ARM_SDE_INTERFACE - bool "ARM Software Delegated Exception Interface (SDEI)" - depends on ARM64 -- depends on ACPI_APEI_GHES - help - The Software Delegated Exception Interface (SDEI) is an ARM - standard for registering callbacks from the platform firmware -diff --git a/drivers/firmware/arm_sdei.c b/drivers/firmware/arm_sdei.c -index 3e8051fe829657..71e2a9a89f6ada 100644 ---- a/drivers/firmware/arm_sdei.c -+++ b/drivers/firmware/arm_sdei.c -@@ -1062,13 +1062,12 @@ static bool __init sdei_present_acpi(void) - return true; - } - --void __init sdei_init(void) -+void __init acpi_sdei_init(void) - { - struct platform_device *pdev; - int ret; - -- ret = platform_driver_register(&sdei_driver); -- if (ret || !sdei_present_acpi()) -+ if (!sdei_present_acpi()) - return; - - pdev = platform_device_register_simple(sdei_driver.driver.name, -@@ -1081,6 +1080,12 @@ void __init sdei_init(void) - } - } - -+static int __init sdei_init(void) -+{ -+ return platform_driver_register(&sdei_driver); -+} -+arch_initcall(sdei_init); -+ - int sdei_event_handler(struct pt_regs *regs, - struct sdei_registered_event *arg) - { -diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c -index 3dc2f9aaf08db0..492d09b6048bd5 100644 ---- a/drivers/firmware/efi/libstub/efi-stub-helper.c -+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c -@@ -561,6 +561,7 @@ efi_status_t efi_load_initrd_cmdline(efi_loaded_image_t *image, - * @image: EFI loaded image protocol - * @soft_limit: preferred address for loading the initrd - * @hard_limit: upper limit address for loading the initrd -+ * @out: pointer to store the address of the initrd table - * - * Return: status code - */ -diff --git a/drivers/firmware/psci/psci.c b/drivers/firmware/psci/psci.c -index 2328ca58bba61f..d6701d81cf6807 100644 ---- a/drivers/firmware/psci/psci.c -+++ b/drivers/firmware/psci/psci.c -@@ -759,8 +759,10 @@ int __init psci_dt_init(void) - - np = of_find_matching_node_and_match(NULL, psci_of_match, &matched_np); - -- if (!np || !of_device_is_available(np)) -+ if (!np || !of_device_is_available(np)) { -+ of_node_put(np); - return -ENODEV; -+ } - - init_fn = (psci_initcall_t)matched_np->data; - ret = init_fn(np); -diff --git a/drivers/fpga/tests/fpga-mgr-test.c b/drivers/fpga/tests/fpga-mgr-test.c -index 6acec55b60ce9a..bfe25c0c0c1c38 100644 ---- a/drivers/fpga/tests/fpga-mgr-test.c -+++ b/drivers/fpga/tests/fpga-mgr-test.c -@@ -253,6 +253,7 @@ static void fpga_mgr_test_img_load_sgt(struct kunit *test) - img_buf = init_test_buffer(test, IMAGE_SIZE); - - sgt = kunit_kzalloc(test, sizeof(*sgt), GFP_KERNEL); -+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, sgt); - ret = sg_alloc_table(sgt, 1, GFP_KERNEL); - KUNIT_ASSERT_EQ(test, ret, 0); - sg_init_one(sgt->sgl, img_buf, IMAGE_SIZE); -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 9189864c236a7e..d4edddaa23dd3e 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -610,21 +610,15 @@ static void dm_crtc_high_irq(void *interrupt_params) - spin_lock_irqsave(&adev_to_drm(adev)->event_lock, flags); - - if (acrtc->dm_irq_params.stream && -- acrtc->dm_irq_params.vrr_params.supported) { -- bool replay_en = acrtc->dm_irq_params.stream->link->replay_settings.replay_feature_enabled; -- bool psr_en = acrtc->dm_irq_params.stream->link->psr_settings.psr_feature_enabled; -- bool fs_active_var_en = acrtc->dm_irq_params.freesync_config.state == VRR_STATE_ACTIVE_VARIABLE; -- -+ acrtc->dm_irq_params.vrr_params.supported && -+ acrtc->dm_irq_params.freesync_config.state == -+ VRR_STATE_ACTIVE_VARIABLE) { - mod_freesync_handle_v_update(adev->dm.freesync_module, - acrtc->dm_irq_params.stream, - &acrtc->dm_irq_params.vrr_params); - -- /* update vmin_vmax only if freesync is enabled, or only if PSR and REPLAY are disabled */ -- if (fs_active_var_en || (!fs_active_var_en && !replay_en && !psr_en)) { -- dc_stream_adjust_vmin_vmax(adev->dm.dc, -- acrtc->dm_irq_params.stream, -- &acrtc->dm_irq_params.vrr_params.adjust); -- } -+ dc_stream_adjust_vmin_vmax(adev->dm.dc, acrtc->dm_irq_params.stream, -+ &acrtc->dm_irq_params.vrr_params.adjust); - } - - /* -diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c -index 1fbd23922082ae..7e37354a03411d 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c -@@ -144,6 +144,10 @@ int atomctrl_initialize_mc_reg_table( - vram_info = (ATOM_VRAM_INFO_HEADER_V2_1 *) - smu_atom_get_data_table(hwmgr->adev, - GetIndexIntoMasterTable(DATA, VRAM_Info), &size, &frev, &crev); -+ if (!vram_info) { -+ pr_err("Could not retrieve the VramInfo table!"); -+ return -EINVAL; -+ } - - if (module_index >= vram_info->ucNumOfVRAMModule) { - pr_err("Invalid VramInfo table."); -@@ -181,6 +185,10 @@ int atomctrl_initialize_mc_reg_table_v2_2( - vram_info = (ATOM_VRAM_INFO_HEADER_V2_2 *) - smu_atom_get_data_table(hwmgr->adev, - GetIndexIntoMasterTable(DATA, VRAM_Info), &size, &frev, &crev); -+ if (!vram_info) { -+ pr_err("Could not retrieve the VramInfo table!"); -+ return -EINVAL; -+ } - - if (module_index >= vram_info->ucNumOfVRAMModule) { - pr_err("Invalid VramInfo table."); -diff --git a/drivers/gpu/drm/bridge/lontium-lt9611uxc.c b/drivers/gpu/drm/bridge/lontium-lt9611uxc.c -index c41ffd0bc04941..d458a4f37ac8fa 100644 ---- a/drivers/gpu/drm/bridge/lontium-lt9611uxc.c -+++ b/drivers/gpu/drm/bridge/lontium-lt9611uxc.c -@@ -962,7 +962,11 @@ static int lt9611uxc_probe(struct i2c_client *client) - } - } - -- return lt9611uxc_audio_init(dev, lt9611uxc); -+ ret = lt9611uxc_audio_init(dev, lt9611uxc); -+ if (ret) -+ goto err_remove_bridge; -+ -+ return 0; - - err_remove_bridge: - free_irq(client->irq, lt9611uxc); -diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c -index 8b41a07c3641f5..ef4fa70119de1a 100644 ---- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c -+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c -@@ -431,7 +431,7 @@ static int mtk_drm_kms_init(struct drm_device *drm) - - ret = drmm_mode_config_init(drm); - if (ret) -- goto put_mutex_dev; -+ return ret; - - drm->mode_config.min_width = 64; - drm->mode_config.min_height = 64; -@@ -449,8 +449,11 @@ static int mtk_drm_kms_init(struct drm_device *drm) - for (i = 0; i < private->data->mmsys_dev_num; i++) { - drm->dev_private = private->all_drm_private[i]; - ret = component_bind_all(private->all_drm_private[i]->dev, drm); -- if (ret) -- goto put_mutex_dev; -+ if (ret) { -+ while (--i >= 0) -+ component_unbind_all(private->all_drm_private[i]->dev, drm); -+ return ret; -+ } - } - - /* -@@ -532,9 +535,6 @@ static int mtk_drm_kms_init(struct drm_device *drm) - err_component_unbind: - for (i = 0; i < private->data->mmsys_dev_num; i++) - component_unbind_all(private->all_drm_private[i]->dev, drm); --put_mutex_dev: -- for (i = 0; i < private->data->mmsys_dev_num; i++) -- put_device(private->all_drm_private[i]->mutex_dev); - - return ret; - } -@@ -608,8 +608,10 @@ static int mtk_drm_bind(struct device *dev) - return 0; - - drm = drm_dev_alloc(&mtk_drm_driver, dev); -- if (IS_ERR(drm)) -- return PTR_ERR(drm); -+ if (IS_ERR(drm)) { -+ ret = PTR_ERR(drm); -+ goto err_put_dev; -+ } - - private->drm_master = true; - drm->dev_private = private; -@@ -635,18 +637,31 @@ static int mtk_drm_bind(struct device *dev) - drm_dev_put(drm); - for (i = 0; i < private->data->mmsys_dev_num; i++) - private->all_drm_private[i]->drm = NULL; -+err_put_dev: -+ for (i = 0; i < private->data->mmsys_dev_num; i++) { -+ /* For device_find_child in mtk_drm_get_all_priv() */ -+ put_device(private->all_drm_private[i]->dev); -+ } -+ put_device(private->mutex_dev); - return ret; - } - - static void mtk_drm_unbind(struct device *dev) - { - struct mtk_drm_private *private = dev_get_drvdata(dev); -+ int i; - - /* for multi mmsys dev, unregister drm dev in mmsys master */ - if (private->drm_master) { - drm_dev_unregister(private->drm); - mtk_drm_kms_deinit(private->drm); - drm_dev_put(private->drm); -+ -+ for (i = 0; i < private->data->mmsys_dev_num; i++) { -+ /* For device_find_child in mtk_drm_get_all_priv() */ -+ put_device(private->all_drm_private[i]->dev); -+ } -+ put_device(private->mutex_dev); - } - private->mtk_drm_bound = false; - private->drm_master = false; -diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c -index 095f634ff7c799..27441e57163004 100644 ---- a/drivers/gpu/drm/meson/meson_drv.c -+++ b/drivers/gpu/drm/meson/meson_drv.c -@@ -168,7 +168,7 @@ static const struct meson_drm_soc_attr meson_drm_soc_attrs[] = { - /* S805X/S805Y HDMI PLL won't lock for HDMI PHY freq > 1,65GHz */ - { - .limits = { -- .max_hdmi_phy_freq = 1650000, -+ .max_hdmi_phy_freq = 1650000000, - }, - .attrs = (const struct soc_device_attribute []) { - { .soc_id = "GXL (S805*)", }, -diff --git a/drivers/gpu/drm/meson/meson_drv.h b/drivers/gpu/drm/meson/meson_drv.h -index 3f9345c14f31c1..be4b0e4df6e13e 100644 ---- a/drivers/gpu/drm/meson/meson_drv.h -+++ b/drivers/gpu/drm/meson/meson_drv.h -@@ -37,7 +37,7 @@ struct meson_drm_match_data { - }; - - struct meson_drm_soc_limits { -- unsigned int max_hdmi_phy_freq; -+ unsigned long long max_hdmi_phy_freq; - }; - - struct meson_drm { -diff --git a/drivers/gpu/drm/meson/meson_encoder_hdmi.c b/drivers/gpu/drm/meson/meson_encoder_hdmi.c -index c4686568c9ca5d..0b7e8e0ba4fc13 100644 ---- a/drivers/gpu/drm/meson/meson_encoder_hdmi.c -+++ b/drivers/gpu/drm/meson/meson_encoder_hdmi.c -@@ -70,12 +70,12 @@ static void meson_encoder_hdmi_set_vclk(struct meson_encoder_hdmi *encoder_hdmi, - { - struct meson_drm *priv = encoder_hdmi->priv; - int vic = drm_match_cea_mode(mode); -- unsigned int phy_freq; -- unsigned int vclk_freq; -- unsigned int venc_freq; -- unsigned int hdmi_freq; -+ unsigned long long phy_freq; -+ unsigned long long vclk_freq; -+ unsigned long long venc_freq; -+ unsigned long long hdmi_freq; - -- vclk_freq = mode->clock; -+ vclk_freq = mode->clock * 1000ULL; - - /* For 420, pixel clock is half unlike venc clock */ - if (encoder_hdmi->output_bus_fmt == MEDIA_BUS_FMT_UYYVYY8_0_5X24) -@@ -107,7 +107,8 @@ static void meson_encoder_hdmi_set_vclk(struct meson_encoder_hdmi *encoder_hdmi, - if (mode->flags & DRM_MODE_FLAG_DBLCLK) - venc_freq /= 2; - -- dev_dbg(priv->dev, "vclk:%d phy=%d venc=%d hdmi=%d enci=%d\n", -+ dev_dbg(priv->dev, -+ "phy:%lluHz vclk=%lluHz venc=%lluHz hdmi=%lluHz enci=%d\n", - phy_freq, vclk_freq, venc_freq, hdmi_freq, - priv->venc.hdmi_use_enci); - -@@ -122,10 +123,11 @@ static enum drm_mode_status meson_encoder_hdmi_mode_valid(struct drm_bridge *bri - struct meson_encoder_hdmi *encoder_hdmi = bridge_to_meson_encoder_hdmi(bridge); - struct meson_drm *priv = encoder_hdmi->priv; - bool is_hdmi2_sink = display_info->hdmi.scdc.supported; -- unsigned int phy_freq; -- unsigned int vclk_freq; -- unsigned int venc_freq; -- unsigned int hdmi_freq; -+ unsigned long long clock = mode->clock * 1000ULL; -+ unsigned long long phy_freq; -+ unsigned long long vclk_freq; -+ unsigned long long venc_freq; -+ unsigned long long hdmi_freq; - int vic = drm_match_cea_mode(mode); - enum drm_mode_status status; - -@@ -144,12 +146,12 @@ static enum drm_mode_status meson_encoder_hdmi_mode_valid(struct drm_bridge *bri - if (status != MODE_OK) - return status; - -- return meson_vclk_dmt_supported_freq(priv, mode->clock); -+ return meson_vclk_dmt_supported_freq(priv, clock); - /* Check against supported VIC modes */ - } else if (!meson_venc_hdmi_supported_vic(vic)) - return MODE_BAD; - -- vclk_freq = mode->clock; -+ vclk_freq = clock; - - /* For 420, pixel clock is half unlike venc clock */ - if (drm_mode_is_420_only(display_info, mode) || -@@ -179,7 +181,8 @@ static enum drm_mode_status meson_encoder_hdmi_mode_valid(struct drm_bridge *bri - if (mode->flags & DRM_MODE_FLAG_DBLCLK) - venc_freq /= 2; - -- dev_dbg(priv->dev, "%s: vclk:%d phy=%d venc=%d hdmi=%d\n", -+ dev_dbg(priv->dev, -+ "%s: vclk:%lluHz phy=%lluHz venc=%lluHz hdmi=%lluHz\n", - __func__, phy_freq, vclk_freq, venc_freq, hdmi_freq); - - return meson_vclk_vic_supported_freq(priv, phy_freq, vclk_freq); -diff --git a/drivers/gpu/drm/meson/meson_vclk.c b/drivers/gpu/drm/meson/meson_vclk.c -index 2a82119eb58ed8..dfe0c28a0f054c 100644 ---- a/drivers/gpu/drm/meson/meson_vclk.c -+++ b/drivers/gpu/drm/meson/meson_vclk.c -@@ -110,7 +110,7 @@ - #define HDMI_PLL_LOCK BIT(31) - #define HDMI_PLL_LOCK_G12A (3 << 30) - --#define FREQ_1000_1001(_freq) DIV_ROUND_CLOSEST(_freq * 1000, 1001) -+#define FREQ_1000_1001(_freq) DIV_ROUND_CLOSEST_ULL((_freq) * 1000ULL, 1001ULL) - - /* VID PLL Dividers */ - enum { -@@ -360,11 +360,11 @@ enum { - }; - - struct meson_vclk_params { -- unsigned int pll_freq; -- unsigned int phy_freq; -- unsigned int vclk_freq; -- unsigned int venc_freq; -- unsigned int pixel_freq; -+ unsigned long long pll_freq; -+ unsigned long long phy_freq; -+ unsigned long long vclk_freq; -+ unsigned long long venc_freq; -+ unsigned long long pixel_freq; - unsigned int pll_od1; - unsigned int pll_od2; - unsigned int pll_od3; -@@ -372,11 +372,11 @@ struct meson_vclk_params { - unsigned int vclk_div; - } params[] = { - [MESON_VCLK_HDMI_ENCI_54000] = { -- .pll_freq = 4320000, -- .phy_freq = 270000, -- .vclk_freq = 54000, -- .venc_freq = 54000, -- .pixel_freq = 54000, -+ .pll_freq = 4320000000, -+ .phy_freq = 270000000, -+ .vclk_freq = 54000000, -+ .venc_freq = 54000000, -+ .pixel_freq = 54000000, - .pll_od1 = 4, - .pll_od2 = 4, - .pll_od3 = 1, -@@ -384,11 +384,11 @@ struct meson_vclk_params { - .vclk_div = 1, - }, - [MESON_VCLK_HDMI_DDR_54000] = { -- .pll_freq = 4320000, -- .phy_freq = 270000, -- .vclk_freq = 54000, -- .venc_freq = 54000, -- .pixel_freq = 27000, -+ .pll_freq = 4320000000, -+ .phy_freq = 270000000, -+ .vclk_freq = 54000000, -+ .venc_freq = 54000000, -+ .pixel_freq = 27000000, - .pll_od1 = 4, - .pll_od2 = 4, - .pll_od3 = 1, -@@ -396,11 +396,11 @@ struct meson_vclk_params { - .vclk_div = 1, - }, - [MESON_VCLK_HDMI_DDR_148500] = { -- .pll_freq = 2970000, -- .phy_freq = 742500, -- .vclk_freq = 148500, -- .venc_freq = 148500, -- .pixel_freq = 74250, -+ .pll_freq = 2970000000, -+ .phy_freq = 742500000, -+ .vclk_freq = 148500000, -+ .venc_freq = 148500000, -+ .pixel_freq = 74250000, - .pll_od1 = 4, - .pll_od2 = 1, - .pll_od3 = 1, -@@ -408,11 +408,11 @@ struct meson_vclk_params { - .vclk_div = 1, - }, - [MESON_VCLK_HDMI_74250] = { -- .pll_freq = 2970000, -- .phy_freq = 742500, -- .vclk_freq = 74250, -- .venc_freq = 74250, -- .pixel_freq = 74250, -+ .pll_freq = 2970000000, -+ .phy_freq = 742500000, -+ .vclk_freq = 74250000, -+ .venc_freq = 74250000, -+ .pixel_freq = 74250000, - .pll_od1 = 2, - .pll_od2 = 2, - .pll_od3 = 2, -@@ -420,11 +420,11 @@ struct meson_vclk_params { - .vclk_div = 1, - }, - [MESON_VCLK_HDMI_148500] = { -- .pll_freq = 2970000, -- .phy_freq = 1485000, -- .vclk_freq = 148500, -- .venc_freq = 148500, -- .pixel_freq = 148500, -+ .pll_freq = 2970000000, -+ .phy_freq = 1485000000, -+ .vclk_freq = 148500000, -+ .venc_freq = 148500000, -+ .pixel_freq = 148500000, - .pll_od1 = 1, - .pll_od2 = 2, - .pll_od3 = 2, -@@ -432,11 +432,11 @@ struct meson_vclk_params { - .vclk_div = 1, - }, - [MESON_VCLK_HDMI_297000] = { -- .pll_freq = 5940000, -- .phy_freq = 2970000, -- .venc_freq = 297000, -- .vclk_freq = 297000, -- .pixel_freq = 297000, -+ .pll_freq = 5940000000, -+ .phy_freq = 2970000000, -+ .venc_freq = 297000000, -+ .vclk_freq = 297000000, -+ .pixel_freq = 297000000, - .pll_od1 = 2, - .pll_od2 = 1, - .pll_od3 = 1, -@@ -444,11 +444,11 @@ struct meson_vclk_params { - .vclk_div = 2, - }, - [MESON_VCLK_HDMI_594000] = { -- .pll_freq = 5940000, -- .phy_freq = 5940000, -- .venc_freq = 594000, -- .vclk_freq = 594000, -- .pixel_freq = 594000, -+ .pll_freq = 5940000000, -+ .phy_freq = 5940000000, -+ .venc_freq = 594000000, -+ .vclk_freq = 594000000, -+ .pixel_freq = 594000000, - .pll_od1 = 1, - .pll_od2 = 1, - .pll_od3 = 2, -@@ -456,11 +456,11 @@ struct meson_vclk_params { - .vclk_div = 1, - }, - [MESON_VCLK_HDMI_594000_YUV420] = { -- .pll_freq = 5940000, -- .phy_freq = 2970000, -- .venc_freq = 594000, -- .vclk_freq = 594000, -- .pixel_freq = 297000, -+ .pll_freq = 5940000000, -+ .phy_freq = 2970000000, -+ .venc_freq = 594000000, -+ .vclk_freq = 594000000, -+ .pixel_freq = 297000000, - .pll_od1 = 2, - .pll_od2 = 1, - .pll_od3 = 1, -@@ -617,16 +617,16 @@ static void meson_hdmi_pll_set_params(struct meson_drm *priv, unsigned int m, - 3 << 20, pll_od_to_reg(od3) << 20); - } - --#define XTAL_FREQ 24000 -+#define XTAL_FREQ (24 * 1000 * 1000) - - static unsigned int meson_hdmi_pll_get_m(struct meson_drm *priv, -- unsigned int pll_freq) -+ unsigned long long pll_freq) - { - /* The GXBB PLL has a /2 pre-multiplier */ - if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_GXBB)) -- pll_freq /= 2; -+ pll_freq = DIV_ROUND_DOWN_ULL(pll_freq, 2); - -- return pll_freq / XTAL_FREQ; -+ return DIV_ROUND_DOWN_ULL(pll_freq, XTAL_FREQ); - } - - #define HDMI_FRAC_MAX_GXBB 4096 -@@ -635,12 +635,13 @@ static unsigned int meson_hdmi_pll_get_m(struct meson_drm *priv, - - static unsigned int meson_hdmi_pll_get_frac(struct meson_drm *priv, - unsigned int m, -- unsigned int pll_freq) -+ unsigned long long pll_freq) - { -- unsigned int parent_freq = XTAL_FREQ; -+ unsigned long long parent_freq = XTAL_FREQ; - unsigned int frac_max = HDMI_FRAC_MAX_GXL; - unsigned int frac_m; - unsigned int frac; -+ u32 remainder; - - /* The GXBB PLL has a /2 pre-multiplier and a larger FRAC width */ - if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_GXBB)) { -@@ -652,11 +653,11 @@ static unsigned int meson_hdmi_pll_get_frac(struct meson_drm *priv, - frac_max = HDMI_FRAC_MAX_G12A; - - /* We can have a perfect match !*/ -- if (pll_freq / m == parent_freq && -- pll_freq % m == 0) -+ if (div_u64_rem(pll_freq, m, &remainder) == parent_freq && -+ remainder == 0) - return 0; - -- frac = div_u64((u64)pll_freq * (u64)frac_max, parent_freq); -+ frac = mul_u64_u64_div_u64(pll_freq, frac_max, parent_freq); - frac_m = m * frac_max; - if (frac_m > frac) - return frac_max; -@@ -666,7 +667,7 @@ static unsigned int meson_hdmi_pll_get_frac(struct meson_drm *priv, - } - - static bool meson_hdmi_pll_validate_params(struct meson_drm *priv, -- unsigned int m, -+ unsigned long long m, - unsigned int frac) - { - if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_GXBB)) { -@@ -694,7 +695,7 @@ static bool meson_hdmi_pll_validate_params(struct meson_drm *priv, - } - - static bool meson_hdmi_pll_find_params(struct meson_drm *priv, -- unsigned int freq, -+ unsigned long long freq, - unsigned int *m, - unsigned int *frac, - unsigned int *od) -@@ -706,7 +707,7 @@ static bool meson_hdmi_pll_find_params(struct meson_drm *priv, - continue; - *frac = meson_hdmi_pll_get_frac(priv, *m, freq * *od); - -- DRM_DEBUG_DRIVER("PLL params for %dkHz: m=%x frac=%x od=%d\n", -+ DRM_DEBUG_DRIVER("PLL params for %lluHz: m=%x frac=%x od=%d\n", - freq, *m, *frac, *od); - - if (meson_hdmi_pll_validate_params(priv, *m, *frac)) -@@ -718,7 +719,7 @@ static bool meson_hdmi_pll_find_params(struct meson_drm *priv, - - /* pll_freq is the frequency after the OD dividers */ - enum drm_mode_status --meson_vclk_dmt_supported_freq(struct meson_drm *priv, unsigned int freq) -+meson_vclk_dmt_supported_freq(struct meson_drm *priv, unsigned long long freq) - { - unsigned int od, m, frac; - -@@ -741,7 +742,7 @@ EXPORT_SYMBOL_GPL(meson_vclk_dmt_supported_freq); - - /* pll_freq is the frequency after the OD dividers */ - static void meson_hdmi_pll_generic_set(struct meson_drm *priv, -- unsigned int pll_freq) -+ unsigned long long pll_freq) - { - unsigned int od, m, frac, od1, od2, od3; - -@@ -756,7 +757,7 @@ static void meson_hdmi_pll_generic_set(struct meson_drm *priv, - od1 = od / od2; - } - -- DRM_DEBUG_DRIVER("PLL params for %dkHz: m=%x frac=%x od=%d/%d/%d\n", -+ DRM_DEBUG_DRIVER("PLL params for %lluHz: m=%x frac=%x od=%d/%d/%d\n", - pll_freq, m, frac, od1, od2, od3); - - meson_hdmi_pll_set_params(priv, m, frac, od1, od2, od3); -@@ -764,17 +765,48 @@ static void meson_hdmi_pll_generic_set(struct meson_drm *priv, - return; - } - -- DRM_ERROR("Fatal, unable to find parameters for PLL freq %d\n", -+ DRM_ERROR("Fatal, unable to find parameters for PLL freq %lluHz\n", - pll_freq); - } - -+static bool meson_vclk_freqs_are_matching_param(unsigned int idx, -+ unsigned long long phy_freq, -+ unsigned long long vclk_freq) -+{ -+ DRM_DEBUG_DRIVER("i = %d vclk_freq = %lluHz alt = %lluHz\n", -+ idx, params[idx].vclk_freq, -+ FREQ_1000_1001(params[idx].vclk_freq)); -+ DRM_DEBUG_DRIVER("i = %d phy_freq = %lluHz alt = %lluHz\n", -+ idx, params[idx].phy_freq, -+ FREQ_1000_1001(params[idx].phy_freq)); -+ -+ /* Match strict frequency */ -+ if (phy_freq == params[idx].phy_freq && -+ vclk_freq == params[idx].vclk_freq) -+ return true; -+ -+ /* Match 1000/1001 variant: vclk deviation has to be less than 1kHz -+ * (drm EDID is defined in 1kHz steps, so everything smaller must be -+ * rounding error) and the PHY freq deviation has to be less than -+ * 10kHz (as the TMDS clock is 10 times the pixel clock, so anything -+ * smaller must be rounding error as well). -+ */ -+ if (abs(vclk_freq - FREQ_1000_1001(params[idx].vclk_freq)) < 1000 && -+ abs(phy_freq - FREQ_1000_1001(params[idx].phy_freq)) < 10000) -+ return true; -+ -+ /* no match */ -+ return false; -+} -+ - enum drm_mode_status --meson_vclk_vic_supported_freq(struct meson_drm *priv, unsigned int phy_freq, -- unsigned int vclk_freq) -+meson_vclk_vic_supported_freq(struct meson_drm *priv, -+ unsigned long long phy_freq, -+ unsigned long long vclk_freq) - { - int i; - -- DRM_DEBUG_DRIVER("phy_freq = %d vclk_freq = %d\n", -+ DRM_DEBUG_DRIVER("phy_freq = %lluHz vclk_freq = %lluHz\n", - phy_freq, vclk_freq); - - /* Check against soc revision/package limits */ -@@ -785,19 +817,7 @@ meson_vclk_vic_supported_freq(struct meson_drm *priv, unsigned int phy_freq, - } - - for (i = 0 ; params[i].pixel_freq ; ++i) { -- DRM_DEBUG_DRIVER("i = %d pixel_freq = %d alt = %d\n", -- i, params[i].pixel_freq, -- FREQ_1000_1001(params[i].pixel_freq)); -- DRM_DEBUG_DRIVER("i = %d phy_freq = %d alt = %d\n", -- i, params[i].phy_freq, -- FREQ_1000_1001(params[i].phy_freq/10)*10); -- /* Match strict frequency */ -- if (phy_freq == params[i].phy_freq && -- vclk_freq == params[i].vclk_freq) -- return MODE_OK; -- /* Match 1000/1001 variant */ -- if (phy_freq == (FREQ_1000_1001(params[i].phy_freq/10)*10) && -- vclk_freq == FREQ_1000_1001(params[i].vclk_freq)) -+ if (meson_vclk_freqs_are_matching_param(i, phy_freq, vclk_freq)) - return MODE_OK; - } - -@@ -805,8 +825,9 @@ meson_vclk_vic_supported_freq(struct meson_drm *priv, unsigned int phy_freq, - } - EXPORT_SYMBOL_GPL(meson_vclk_vic_supported_freq); - --static void meson_vclk_set(struct meson_drm *priv, unsigned int pll_base_freq, -- unsigned int od1, unsigned int od2, unsigned int od3, -+static void meson_vclk_set(struct meson_drm *priv, -+ unsigned long long pll_base_freq, unsigned int od1, -+ unsigned int od2, unsigned int od3, - unsigned int vid_pll_div, unsigned int vclk_div, - unsigned int hdmi_tx_div, unsigned int venc_div, - bool hdmi_use_enci, bool vic_alternate_clock) -@@ -826,15 +847,15 @@ static void meson_vclk_set(struct meson_drm *priv, unsigned int pll_base_freq, - meson_hdmi_pll_generic_set(priv, pll_base_freq); - } else if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_GXBB)) { - switch (pll_base_freq) { -- case 2970000: -+ case 2970000000: - m = 0x3d; - frac = vic_alternate_clock ? 0xd02 : 0xe00; - break; -- case 4320000: -+ case 4320000000: - m = vic_alternate_clock ? 0x59 : 0x5a; - frac = vic_alternate_clock ? 0xe8f : 0; - break; -- case 5940000: -+ case 5940000000: - m = 0x7b; - frac = vic_alternate_clock ? 0xa05 : 0xc00; - break; -@@ -844,15 +865,15 @@ static void meson_vclk_set(struct meson_drm *priv, unsigned int pll_base_freq, - } else if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_GXM) || - meson_vpu_is_compatible(priv, VPU_COMPATIBLE_GXL)) { - switch (pll_base_freq) { -- case 2970000: -+ case 2970000000: - m = 0x7b; - frac = vic_alternate_clock ? 0x281 : 0x300; - break; -- case 4320000: -+ case 4320000000: - m = vic_alternate_clock ? 0xb3 : 0xb4; - frac = vic_alternate_clock ? 0x347 : 0; - break; -- case 5940000: -+ case 5940000000: - m = 0xf7; - frac = vic_alternate_clock ? 0x102 : 0x200; - break; -@@ -861,15 +882,15 @@ static void meson_vclk_set(struct meson_drm *priv, unsigned int pll_base_freq, - meson_hdmi_pll_set_params(priv, m, frac, od1, od2, od3); - } else if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_G12A)) { - switch (pll_base_freq) { -- case 2970000: -+ case 2970000000: - m = 0x7b; - frac = vic_alternate_clock ? 0x140b4 : 0x18000; - break; -- case 4320000: -+ case 4320000000: - m = vic_alternate_clock ? 0xb3 : 0xb4; - frac = vic_alternate_clock ? 0x1a3ee : 0; - break; -- case 5940000: -+ case 5940000000: - m = 0xf7; - frac = vic_alternate_clock ? 0x8148 : 0x10000; - break; -@@ -1025,14 +1046,14 @@ static void meson_vclk_set(struct meson_drm *priv, unsigned int pll_base_freq, - } - - void meson_vclk_setup(struct meson_drm *priv, unsigned int target, -- unsigned int phy_freq, unsigned int vclk_freq, -- unsigned int venc_freq, unsigned int dac_freq, -+ unsigned long long phy_freq, unsigned long long vclk_freq, -+ unsigned long long venc_freq, unsigned long long dac_freq, - bool hdmi_use_enci) - { - bool vic_alternate_clock = false; -- unsigned int freq; -- unsigned int hdmi_tx_div; -- unsigned int venc_div; -+ unsigned long long freq; -+ unsigned long long hdmi_tx_div; -+ unsigned long long venc_div; - - if (target == MESON_VCLK_TARGET_CVBS) { - meson_venci_cvbs_clock_config(priv); -@@ -1052,27 +1073,25 @@ void meson_vclk_setup(struct meson_drm *priv, unsigned int target, - return; - } - -- hdmi_tx_div = vclk_freq / dac_freq; -+ hdmi_tx_div = DIV_ROUND_DOWN_ULL(vclk_freq, dac_freq); - - if (hdmi_tx_div == 0) { -- pr_err("Fatal Error, invalid HDMI-TX freq %d\n", -+ pr_err("Fatal Error, invalid HDMI-TX freq %lluHz\n", - dac_freq); - return; - } - -- venc_div = vclk_freq / venc_freq; -+ venc_div = DIV_ROUND_DOWN_ULL(vclk_freq, venc_freq); - - if (venc_div == 0) { -- pr_err("Fatal Error, invalid HDMI venc freq %d\n", -+ pr_err("Fatal Error, invalid HDMI venc freq %lluHz\n", - venc_freq); - return; - } - - for (freq = 0 ; params[freq].pixel_freq ; ++freq) { -- if ((phy_freq == params[freq].phy_freq || -- phy_freq == FREQ_1000_1001(params[freq].phy_freq/10)*10) && -- (vclk_freq == params[freq].vclk_freq || -- vclk_freq == FREQ_1000_1001(params[freq].vclk_freq))) { -+ if (meson_vclk_freqs_are_matching_param(freq, phy_freq, -+ vclk_freq)) { - if (vclk_freq != params[freq].vclk_freq) - vic_alternate_clock = true; - else -@@ -1098,7 +1117,8 @@ void meson_vclk_setup(struct meson_drm *priv, unsigned int target, - } - - if (!params[freq].pixel_freq) { -- pr_err("Fatal Error, invalid HDMI vclk freq %d\n", vclk_freq); -+ pr_err("Fatal Error, invalid HDMI vclk freq %lluHz\n", -+ vclk_freq); - return; - } - -diff --git a/drivers/gpu/drm/meson/meson_vclk.h b/drivers/gpu/drm/meson/meson_vclk.h -index 60617aaf18dd1c..7ac55744e57494 100644 ---- a/drivers/gpu/drm/meson/meson_vclk.h -+++ b/drivers/gpu/drm/meson/meson_vclk.h -@@ -20,17 +20,18 @@ enum { - }; - - /* 27MHz is the CVBS Pixel Clock */ --#define MESON_VCLK_CVBS 27000 -+#define MESON_VCLK_CVBS (27 * 1000 * 1000) - - enum drm_mode_status --meson_vclk_dmt_supported_freq(struct meson_drm *priv, unsigned int freq); -+meson_vclk_dmt_supported_freq(struct meson_drm *priv, unsigned long long freq); - enum drm_mode_status --meson_vclk_vic_supported_freq(struct meson_drm *priv, unsigned int phy_freq, -- unsigned int vclk_freq); -+meson_vclk_vic_supported_freq(struct meson_drm *priv, -+ unsigned long long phy_freq, -+ unsigned long long vclk_freq); - - void meson_vclk_setup(struct meson_drm *priv, unsigned int target, -- unsigned int phy_freq, unsigned int vclk_freq, -- unsigned int venc_freq, unsigned int dac_freq, -+ unsigned long long phy_freq, unsigned long long vclk_freq, -+ unsigned long long venc_freq, unsigned long long dac_freq, - bool hdmi_use_enci); - - #endif /* __MESON_VCLK_H */ -diff --git a/drivers/gpu/drm/renesas/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/renesas/rcar-du/rcar_du_kms.c -index 70d8ad065bfa1d..4c8fe83dd6101b 100644 ---- a/drivers/gpu/drm/renesas/rcar-du/rcar_du_kms.c -+++ b/drivers/gpu/drm/renesas/rcar-du/rcar_du_kms.c -@@ -705,7 +705,7 @@ static int rcar_du_vsps_init(struct rcar_du_device *rcdu) - ret = of_parse_phandle_with_fixed_args(np, vsps_prop_name, - cells, i, &args); - if (ret < 0) -- goto error; -+ goto done; - - /* - * Add the VSP to the list or update the corresponding existing -@@ -743,13 +743,11 @@ static int rcar_du_vsps_init(struct rcar_du_device *rcdu) - vsp->dev = rcdu; - - ret = rcar_du_vsp_init(vsp, vsps[i].np, vsps[i].crtcs_mask); -- if (ret < 0) -- goto error; -+ if (ret) -+ goto done; - } - -- return 0; -- --error: -+done: - for (i = 0; i < ARRAY_SIZE(vsps); ++i) - of_node_put(vsps[i].np); - -diff --git a/drivers/gpu/drm/tegra/rgb.c b/drivers/gpu/drm/tegra/rgb.c -index d6424abd3c45d3..8930460ba62823 100644 ---- a/drivers/gpu/drm/tegra/rgb.c -+++ b/drivers/gpu/drm/tegra/rgb.c -@@ -190,6 +190,11 @@ static const struct drm_encoder_helper_funcs tegra_rgb_encoder_helper_funcs = { - .atomic_check = tegra_rgb_encoder_atomic_check, - }; - -+static void tegra_dc_of_node_put(void *data) -+{ -+ of_node_put(data); -+} -+ - int tegra_dc_rgb_probe(struct tegra_dc *dc) - { - struct device_node *np; -@@ -197,7 +202,14 @@ int tegra_dc_rgb_probe(struct tegra_dc *dc) - int err; - - np = of_get_child_by_name(dc->dev->of_node, "rgb"); -- if (!np || !of_device_is_available(np)) -+ if (!np) -+ return -ENODEV; -+ -+ err = devm_add_action_or_reset(dc->dev, tegra_dc_of_node_put, np); -+ if (err < 0) -+ return err; -+ -+ if (!of_device_is_available(np)) - return -ENODEV; - - rgb = devm_kzalloc(dc->dev, sizeof(*rgb), GFP_KERNEL); -diff --git a/drivers/gpu/drm/vc4/tests/vc4_mock_output.c b/drivers/gpu/drm/vc4/tests/vc4_mock_output.c -index e70d7c3076acf1..f0ddc223c1f839 100644 ---- a/drivers/gpu/drm/vc4/tests/vc4_mock_output.c -+++ b/drivers/gpu/drm/vc4/tests/vc4_mock_output.c -@@ -75,24 +75,30 @@ int vc4_mock_atomic_add_output(struct kunit *test, - int ret; - - encoder = vc4_find_encoder_by_type(drm, type); -- KUNIT_ASSERT_NOT_ERR_OR_NULL(test, encoder); -+ if (!encoder) -+ return -ENODEV; - - crtc = vc4_find_crtc_for_encoder(test, drm, encoder); -- KUNIT_ASSERT_NOT_ERR_OR_NULL(test, crtc); -+ if (!crtc) -+ return -ENODEV; - - output = encoder_to_vc4_dummy_output(encoder); - conn = &output->connector; - conn_state = drm_atomic_get_connector_state(state, conn); -- KUNIT_ASSERT_NOT_ERR_OR_NULL(test, conn_state); -+ if (IS_ERR(conn_state)) -+ return PTR_ERR(conn_state); - - ret = drm_atomic_set_crtc_for_connector(conn_state, crtc); -- KUNIT_EXPECT_EQ(test, ret, 0); -+ if (ret) -+ return ret; - - crtc_state = drm_atomic_get_crtc_state(state, crtc); -- KUNIT_ASSERT_NOT_ERR_OR_NULL(test, crtc_state); -+ if (IS_ERR(crtc_state)) -+ return PTR_ERR(crtc_state); - - ret = drm_atomic_set_mode_for_crtc(crtc_state, &default_mode); -- KUNIT_EXPECT_EQ(test, ret, 0); -+ if (ret) -+ return ret; - - crtc_state->active = true; - -@@ -113,26 +119,32 @@ int vc4_mock_atomic_del_output(struct kunit *test, - int ret; - - encoder = vc4_find_encoder_by_type(drm, type); -- KUNIT_ASSERT_NOT_ERR_OR_NULL(test, encoder); -+ if (!encoder) -+ return -ENODEV; - - crtc = vc4_find_crtc_for_encoder(test, drm, encoder); -- KUNIT_ASSERT_NOT_ERR_OR_NULL(test, crtc); -+ if (!crtc) -+ return -ENODEV; - - crtc_state = drm_atomic_get_crtc_state(state, crtc); -- KUNIT_ASSERT_NOT_ERR_OR_NULL(test, crtc_state); -+ if (IS_ERR(crtc_state)) -+ return PTR_ERR(crtc_state); - - crtc_state->active = false; - - ret = drm_atomic_set_mode_for_crtc(crtc_state, NULL); -- KUNIT_ASSERT_EQ(test, ret, 0); -+ if (ret) -+ return ret; - - output = encoder_to_vc4_dummy_output(encoder); - conn = &output->connector; - conn_state = drm_atomic_get_connector_state(state, conn); -- KUNIT_ASSERT_NOT_ERR_OR_NULL(test, conn_state); -+ if (IS_ERR(conn_state)) -+ return PTR_ERR(conn_state); - - ret = drm_atomic_set_crtc_for_connector(conn_state, NULL); -- KUNIT_ASSERT_EQ(test, ret, 0); -+ if (ret) -+ return ret; - - return 0; - } -diff --git a/drivers/gpu/drm/vkms/vkms_crtc.c b/drivers/gpu/drm/vkms/vkms_crtc.c -index 61e500b8c9da23..894c484f99e950 100644 ---- a/drivers/gpu/drm/vkms/vkms_crtc.c -+++ b/drivers/gpu/drm/vkms/vkms_crtc.c -@@ -201,7 +201,7 @@ static int vkms_crtc_atomic_check(struct drm_crtc *crtc, - i++; - } - -- vkms_state->active_planes = kcalloc(i, sizeof(plane), GFP_KERNEL); -+ vkms_state->active_planes = kcalloc(i, sizeof(*vkms_state->active_planes), GFP_KERNEL); - if (!vkms_state->active_planes) - return -ENOMEM; - vkms_state->num_active_planes = i; -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -index 5fef0b31c11798..b129ce873af3f2 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -@@ -4083,6 +4083,23 @@ static int vmw_execbuf_tie_context(struct vmw_private *dev_priv, - return 0; - } - -+/* -+ * DMA fence callback to remove a seqno_waiter -+ */ -+struct seqno_waiter_rm_context { -+ struct dma_fence_cb base; -+ struct vmw_private *dev_priv; -+}; -+ -+static void seqno_waiter_rm_cb(struct dma_fence *f, struct dma_fence_cb *cb) -+{ -+ struct seqno_waiter_rm_context *ctx = -+ container_of(cb, struct seqno_waiter_rm_context, base); -+ -+ vmw_seqno_waiter_remove(ctx->dev_priv); -+ kfree(ctx); -+} -+ - int vmw_execbuf_process(struct drm_file *file_priv, - struct vmw_private *dev_priv, - void __user *user_commands, void *kernel_commands, -@@ -4263,6 +4280,15 @@ int vmw_execbuf_process(struct drm_file *file_priv, - } else { - /* Link the fence with the FD created earlier */ - fd_install(out_fence_fd, sync_file->file); -+ struct seqno_waiter_rm_context *ctx = -+ kmalloc(sizeof(*ctx), GFP_KERNEL); -+ ctx->dev_priv = dev_priv; -+ vmw_seqno_waiter_add(dev_priv); -+ if (dma_fence_add_callback(&fence->base, &ctx->base, -+ seqno_waiter_rm_cb) < 0) { -+ vmw_seqno_waiter_remove(dev_priv); -+ kfree(ctx); -+ } - } - } - -diff --git a/drivers/hid/hid-hyperv.c b/drivers/hid/hid-hyperv.c -index 0fb210e40a4127..9eafff0b6ea4c3 100644 ---- a/drivers/hid/hid-hyperv.c -+++ b/drivers/hid/hid-hyperv.c -@@ -192,7 +192,7 @@ static void mousevsc_on_receive_device_info(struct mousevsc_dev *input_device, - goto cleanup; - - input_device->report_desc_size = le16_to_cpu( -- desc->desc[0].wDescriptorLength); -+ desc->rpt_desc.wDescriptorLength); - if (input_device->report_desc_size == 0) { - input_device->dev_info_status = -EINVAL; - goto cleanup; -@@ -210,7 +210,7 @@ static void mousevsc_on_receive_device_info(struct mousevsc_dev *input_device, - - memcpy(input_device->report_desc, - ((unsigned char *)desc) + desc->bLength, -- le16_to_cpu(desc->desc[0].wDescriptorLength)); -+ le16_to_cpu(desc->rpt_desc.wDescriptorLength)); - - /* Send the ack */ - memset(&ack, 0, sizeof(struct mousevsc_prt_msg)); -diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c -index 257dd73e37bf57..a8e8da002b9bbd 100644 ---- a/drivers/hid/usbhid/hid-core.c -+++ b/drivers/hid/usbhid/hid-core.c -@@ -982,12 +982,11 @@ static int usbhid_parse(struct hid_device *hid) - struct usb_host_interface *interface = intf->cur_altsetting; - struct usb_device *dev = interface_to_usbdev (intf); - struct hid_descriptor *hdesc; -+ struct hid_class_descriptor *hcdesc; - u32 quirks = 0; - unsigned int rsize = 0; - char *rdesc; -- int ret, n; -- int num_descriptors; -- size_t offset = offsetof(struct hid_descriptor, desc); -+ int ret; - - quirks = hid_lookup_quirk(hid); - -@@ -1009,20 +1008,19 @@ static int usbhid_parse(struct hid_device *hid) - return -ENODEV; - } - -- if (hdesc->bLength < sizeof(struct hid_descriptor)) { -- dbg_hid("hid descriptor is too short\n"); -+ if (!hdesc->bNumDescriptors || -+ hdesc->bLength != sizeof(*hdesc) + -+ (hdesc->bNumDescriptors - 1) * sizeof(*hcdesc)) { -+ dbg_hid("hid descriptor invalid, bLen=%hhu bNum=%hhu\n", -+ hdesc->bLength, hdesc->bNumDescriptors); - return -EINVAL; - } - - hid->version = le16_to_cpu(hdesc->bcdHID); - hid->country = hdesc->bCountryCode; - -- num_descriptors = min_t(int, hdesc->bNumDescriptors, -- (hdesc->bLength - offset) / sizeof(struct hid_class_descriptor)); -- -- for (n = 0; n < num_descriptors; n++) -- if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT) -- rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength); -+ if (hdesc->rpt_desc.bDescriptorType == HID_DT_REPORT) -+ rsize = le16_to_cpu(hdesc->rpt_desc.wDescriptorLength); - - if (!rsize || rsize > HID_MAX_DESCRIPTOR_SIZE) { - dbg_hid("weird size of report descriptor (%u)\n", rsize); -@@ -1050,6 +1048,11 @@ static int usbhid_parse(struct hid_device *hid) - goto err; - } - -+ if (hdesc->bNumDescriptors > 1) -+ hid_warn(intf, -+ "%u unsupported optional hid class descriptors\n", -+ (int)(hdesc->bNumDescriptors - 1)); -+ - hid->quirks |= quirks; - - return 0; -diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c -index f20b864c1bb201..ce2f14a62754ee 100644 ---- a/drivers/hwmon/asus-ec-sensors.c -+++ b/drivers/hwmon/asus-ec-sensors.c -@@ -888,6 +888,10 @@ static int asus_ec_hwmon_read_string(struct device *dev, - { - struct ec_sensors_data *state = dev_get_drvdata(dev); - int sensor_index = find_ec_sensor_index(state, type, channel); -+ -+ if (sensor_index < 0) -+ return sensor_index; -+ - *str = get_sensor_info(state, sensor_index)->label; - - return 0; -diff --git a/drivers/hwtracing/coresight/coresight-config.h b/drivers/hwtracing/coresight/coresight-config.h -index 6ba01397574182..84cdde6f0e4db2 100644 ---- a/drivers/hwtracing/coresight/coresight-config.h -+++ b/drivers/hwtracing/coresight/coresight-config.h -@@ -228,7 +228,7 @@ struct cscfg_feature_csdev { - * @feats_csdev:references to the device features to enable. - */ - struct cscfg_config_csdev { -- const struct cscfg_config_desc *config_desc; -+ struct cscfg_config_desc *config_desc; - struct coresight_device *csdev; - bool enabled; - struct list_head node; -diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c -index 11138a9762b015..30a561d874819b 100644 ---- a/drivers/hwtracing/coresight/coresight-syscfg.c -+++ b/drivers/hwtracing/coresight/coresight-syscfg.c -@@ -867,6 +867,25 @@ void cscfg_csdev_reset_feats(struct coresight_device *csdev) - } - EXPORT_SYMBOL_GPL(cscfg_csdev_reset_feats); - -+static bool cscfg_config_desc_get(struct cscfg_config_desc *config_desc) -+{ -+ if (!atomic_fetch_inc(&config_desc->active_cnt)) { -+ /* must ensure that config cannot be unloaded in use */ -+ if (unlikely(cscfg_owner_get(config_desc->load_owner))) { -+ atomic_dec(&config_desc->active_cnt); -+ return false; -+ } -+ } -+ -+ return true; -+} -+ -+static void cscfg_config_desc_put(struct cscfg_config_desc *config_desc) -+{ -+ if (!atomic_dec_return(&config_desc->active_cnt)) -+ cscfg_owner_put(config_desc->load_owner); -+} -+ - /* - * This activate configuration for either perf or sysfs. Perf can have multiple - * active configs, selected per event, sysfs is limited to one. -@@ -890,22 +909,17 @@ static int _cscfg_activate_config(unsigned long cfg_hash) - if (config_desc->available == false) - return -EBUSY; - -- /* must ensure that config cannot be unloaded in use */ -- err = cscfg_owner_get(config_desc->load_owner); -- if (err) -+ if (!cscfg_config_desc_get(config_desc)) { -+ err = -EINVAL; - break; -+ } -+ - /* - * increment the global active count - control changes to - * active configurations - */ - atomic_inc(&cscfg_mgr->sys_active_cnt); - -- /* -- * mark the descriptor as active so enable config on a -- * device instance will use it -- */ -- atomic_inc(&config_desc->active_cnt); -- - err = 0; - dev_dbg(cscfg_device(), "Activate config %s.\n", config_desc->name); - break; -@@ -920,9 +934,8 @@ static void _cscfg_deactivate_config(unsigned long cfg_hash) - - list_for_each_entry(config_desc, &cscfg_mgr->config_desc_list, item) { - if ((unsigned long)config_desc->event_ea->var == cfg_hash) { -- atomic_dec(&config_desc->active_cnt); - atomic_dec(&cscfg_mgr->sys_active_cnt); -- cscfg_owner_put(config_desc->load_owner); -+ cscfg_config_desc_put(config_desc); - dev_dbg(cscfg_device(), "Deactivate config %s.\n", config_desc->name); - break; - } -@@ -1047,7 +1060,7 @@ int cscfg_csdev_enable_active_config(struct coresight_device *csdev, - unsigned long cfg_hash, int preset) - { - struct cscfg_config_csdev *config_csdev_active = NULL, *config_csdev_item; -- const struct cscfg_config_desc *config_desc; -+ struct cscfg_config_desc *config_desc; - unsigned long flags; - int err = 0; - -@@ -1062,8 +1075,8 @@ int cscfg_csdev_enable_active_config(struct coresight_device *csdev, - spin_lock_irqsave(&csdev->cscfg_csdev_lock, flags); - list_for_each_entry(config_csdev_item, &csdev->config_csdev_list, node) { - config_desc = config_csdev_item->config_desc; -- if ((atomic_read(&config_desc->active_cnt)) && -- ((unsigned long)config_desc->event_ea->var == cfg_hash)) { -+ if (((unsigned long)config_desc->event_ea->var == cfg_hash) && -+ cscfg_config_desc_get(config_desc)) { - config_csdev_active = config_csdev_item; - csdev->active_cscfg_ctxt = (void *)config_csdev_active; - break; -@@ -1097,7 +1110,11 @@ int cscfg_csdev_enable_active_config(struct coresight_device *csdev, - err = -EBUSY; - spin_unlock_irqrestore(&csdev->cscfg_csdev_lock, flags); - } -+ -+ if (err) -+ cscfg_config_desc_put(config_desc); - } -+ - return err; - } - EXPORT_SYMBOL_GPL(cscfg_csdev_enable_active_config); -@@ -1136,8 +1153,10 @@ void cscfg_csdev_disable_active_config(struct coresight_device *csdev) - spin_unlock_irqrestore(&csdev->cscfg_csdev_lock, flags); - - /* true if there was an enabled active config */ -- if (config_csdev) -+ if (config_csdev) { - cscfg_csdev_disable_config(config_csdev); -+ cscfg_config_desc_put(config_csdev->config_desc); -+ } - } - EXPORT_SYMBOL_GPL(cscfg_csdev_disable_active_config); - -diff --git a/drivers/iio/adc/ad7124.c b/drivers/iio/adc/ad7124.c -index 0e6baf017bfd1e..f631351eef97b9 100644 ---- a/drivers/iio/adc/ad7124.c -+++ b/drivers/iio/adc/ad7124.c -@@ -300,9 +300,9 @@ static int ad7124_get_3db_filter_freq(struct ad7124_state *st, - - switch (st->channels[channel].cfg.filter_type) { - case AD7124_SINC3_FILTER: -- return DIV_ROUND_CLOSEST(fadc * 230, 1000); -+ return DIV_ROUND_CLOSEST(fadc * 272, 1000); - case AD7124_SINC4_FILTER: -- return DIV_ROUND_CLOSEST(fadc * 262, 1000); -+ return DIV_ROUND_CLOSEST(fadc * 230, 1000); - default: - return -EINVAL; - } -diff --git a/drivers/iio/filter/admv8818.c b/drivers/iio/filter/admv8818.c -index d85b7d3de86604..cc8ce0fe74e7c6 100644 ---- a/drivers/iio/filter/admv8818.c -+++ b/drivers/iio/filter/admv8818.c -@@ -14,6 +14,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -70,6 +71,16 @@ - #define ADMV8818_HPF_WR0_MSK GENMASK(7, 4) - #define ADMV8818_LPF_WR0_MSK GENMASK(3, 0) - -+#define ADMV8818_BAND_BYPASS 0 -+#define ADMV8818_BAND_MIN 1 -+#define ADMV8818_BAND_MAX 4 -+#define ADMV8818_BAND_CORNER_LOW 0 -+#define ADMV8818_BAND_CORNER_HIGH 1 -+ -+#define ADMV8818_STATE_MIN 0 -+#define ADMV8818_STATE_MAX 15 -+#define ADMV8818_NUM_STATES 16 -+ - enum { - ADMV8818_BW_FREQ, - ADMV8818_CENTER_FREQ -@@ -90,20 +101,24 @@ struct admv8818_state { - struct mutex lock; - unsigned int filter_mode; - u64 cf_hz; -+ u64 lpf_margin_hz; -+ u64 hpf_margin_hz; - }; - --static const unsigned long long freq_range_hpf[4][2] = { -+static const unsigned long long freq_range_hpf[5][2] = { -+ {0ULL, 0ULL}, /* bypass */ - {1750000000ULL, 3550000000ULL}, - {3400000000ULL, 7250000000ULL}, - {6600000000, 12000000000}, - {12500000000, 19900000000} - }; - --static const unsigned long long freq_range_lpf[4][2] = { -+static const unsigned long long freq_range_lpf[5][2] = { -+ {U64_MAX, U64_MAX}, /* bypass */ - {2050000000ULL, 3850000000ULL}, - {3350000000ULL, 7250000000ULL}, - {7000000000, 13000000000}, -- {12550000000, 18500000000} -+ {12550000000, 18850000000} - }; - - static const struct regmap_config admv8818_regmap_config = { -@@ -121,44 +136,59 @@ static const char * const admv8818_modes[] = { - - static int __admv8818_hpf_select(struct admv8818_state *st, u64 freq) - { -- unsigned int hpf_step = 0, hpf_band = 0, i, j; -- u64 freq_step; -- int ret; -+ int band, state, ret; -+ unsigned int hpf_state = ADMV8818_STATE_MIN, hpf_band = ADMV8818_BAND_BYPASS; -+ u64 freq_error, min_freq_error, freq_corner, freq_step; - -- if (freq < freq_range_hpf[0][0]) -+ if (freq < freq_range_hpf[ADMV8818_BAND_MIN][ADMV8818_BAND_CORNER_LOW]) - goto hpf_write; - -- if (freq > freq_range_hpf[3][1]) { -- hpf_step = 15; -- hpf_band = 4; -- -+ if (freq >= freq_range_hpf[ADMV8818_BAND_MAX][ADMV8818_BAND_CORNER_HIGH]) { -+ hpf_state = ADMV8818_STATE_MAX; -+ hpf_band = ADMV8818_BAND_MAX; - goto hpf_write; - } - -- for (i = 0; i < 4; i++) { -- freq_step = div_u64((freq_range_hpf[i][1] - -- freq_range_hpf[i][0]), 15); -+ /* Close HPF frequency gap between 12 and 12.5 GHz */ -+ if (freq >= 12000ULL * HZ_PER_MHZ && freq < 12500ULL * HZ_PER_MHZ) { -+ hpf_state = ADMV8818_STATE_MAX; -+ hpf_band = 3; -+ goto hpf_write; -+ } - -- if (freq > freq_range_hpf[i][0] && -- (freq < freq_range_hpf[i][1] + freq_step)) { -- hpf_band = i + 1; -+ min_freq_error = U64_MAX; -+ for (band = ADMV8818_BAND_MIN; band <= ADMV8818_BAND_MAX; band++) { -+ /* -+ * This (and therefore all other ranges) have a corner -+ * frequency higher than the target frequency. -+ */ -+ if (freq_range_hpf[band][ADMV8818_BAND_CORNER_LOW] > freq) -+ break; - -- for (j = 1; j <= 16; j++) { -- if (freq < (freq_range_hpf[i][0] + (freq_step * j))) { -- hpf_step = j - 1; -- break; -- } -+ freq_step = freq_range_hpf[band][ADMV8818_BAND_CORNER_HIGH] - -+ freq_range_hpf[band][ADMV8818_BAND_CORNER_LOW]; -+ freq_step = div_u64(freq_step, ADMV8818_NUM_STATES - 1); -+ -+ for (state = ADMV8818_STATE_MIN; state <= ADMV8818_STATE_MAX; state++) { -+ freq_corner = freq_range_hpf[band][ADMV8818_BAND_CORNER_LOW] + -+ freq_step * state; -+ -+ /* -+ * This (and therefore all other states) have a corner -+ * frequency higher than the target frequency. -+ */ -+ if (freq_corner > freq) -+ break; -+ -+ freq_error = freq - freq_corner; -+ if (freq_error < min_freq_error) { -+ min_freq_error = freq_error; -+ hpf_state = state; -+ hpf_band = band; - } -- break; - } - } - -- /* Close HPF frequency gap between 12 and 12.5 GHz */ -- if (freq >= 12000 * HZ_PER_MHZ && freq <= 12500 * HZ_PER_MHZ) { -- hpf_band = 3; -- hpf_step = 15; -- } -- - hpf_write: - ret = regmap_update_bits(st->regmap, ADMV8818_REG_WR0_SW, - ADMV8818_SW_IN_SET_WR0_MSK | -@@ -170,7 +200,7 @@ static int __admv8818_hpf_select(struct admv8818_state *st, u64 freq) - - return regmap_update_bits(st->regmap, ADMV8818_REG_WR0_FILTER, - ADMV8818_HPF_WR0_MSK, -- FIELD_PREP(ADMV8818_HPF_WR0_MSK, hpf_step)); -+ FIELD_PREP(ADMV8818_HPF_WR0_MSK, hpf_state)); - } - - static int admv8818_hpf_select(struct admv8818_state *st, u64 freq) -@@ -186,31 +216,52 @@ static int admv8818_hpf_select(struct admv8818_state *st, u64 freq) - - static int __admv8818_lpf_select(struct admv8818_state *st, u64 freq) - { -- unsigned int lpf_step = 0, lpf_band = 0, i, j; -- u64 freq_step; -- int ret; -+ int band, state, ret; -+ unsigned int lpf_state = ADMV8818_STATE_MIN, lpf_band = ADMV8818_BAND_BYPASS; -+ u64 freq_error, min_freq_error, freq_corner, freq_step; - -- if (freq > freq_range_lpf[3][1]) -+ if (freq > freq_range_lpf[ADMV8818_BAND_MAX][ADMV8818_BAND_CORNER_HIGH]) - goto lpf_write; - -- if (freq < freq_range_lpf[0][0]) { -- lpf_band = 1; -- -+ if (freq < freq_range_lpf[ADMV8818_BAND_MIN][ADMV8818_BAND_CORNER_LOW]) { -+ lpf_state = ADMV8818_STATE_MIN; -+ lpf_band = ADMV8818_BAND_MIN; - goto lpf_write; - } - -- for (i = 0; i < 4; i++) { -- if (freq > freq_range_lpf[i][0] && freq < freq_range_lpf[i][1]) { -- lpf_band = i + 1; -- freq_step = div_u64((freq_range_lpf[i][1] - freq_range_lpf[i][0]), 15); -+ min_freq_error = U64_MAX; -+ for (band = ADMV8818_BAND_MAX; band >= ADMV8818_BAND_MIN; --band) { -+ /* -+ * At this point the highest corner frequency of -+ * all remaining ranges is below the target. -+ * LPF corner should be >= the target. -+ */ -+ if (freq > freq_range_lpf[band][ADMV8818_BAND_CORNER_HIGH]) -+ break; -+ -+ freq_step = freq_range_lpf[band][ADMV8818_BAND_CORNER_HIGH] - -+ freq_range_lpf[band][ADMV8818_BAND_CORNER_LOW]; -+ freq_step = div_u64(freq_step, ADMV8818_NUM_STATES - 1); -+ -+ for (state = ADMV8818_STATE_MAX; state >= ADMV8818_STATE_MIN; --state) { -+ -+ freq_corner = freq_range_lpf[band][ADMV8818_BAND_CORNER_LOW] + -+ state * freq_step; - -- for (j = 0; j <= 15; j++) { -- if (freq < (freq_range_lpf[i][0] + (freq_step * j))) { -- lpf_step = j; -- break; -- } -+ /* -+ * At this point all other states in range will -+ * place the corner frequency below the target -+ * LPF corner should >= the target. -+ */ -+ if (freq > freq_corner) -+ break; -+ -+ freq_error = freq_corner - freq; -+ if (freq_error < min_freq_error) { -+ min_freq_error = freq_error; -+ lpf_state = state; -+ lpf_band = band; - } -- break; - } - } - -@@ -225,7 +276,7 @@ static int __admv8818_lpf_select(struct admv8818_state *st, u64 freq) - - return regmap_update_bits(st->regmap, ADMV8818_REG_WR0_FILTER, - ADMV8818_LPF_WR0_MSK, -- FIELD_PREP(ADMV8818_LPF_WR0_MSK, lpf_step)); -+ FIELD_PREP(ADMV8818_LPF_WR0_MSK, lpf_state)); - } - - static int admv8818_lpf_select(struct admv8818_state *st, u64 freq) -@@ -242,16 +293,28 @@ static int admv8818_lpf_select(struct admv8818_state *st, u64 freq) - static int admv8818_rfin_band_select(struct admv8818_state *st) - { - int ret; -+ u64 hpf_corner_target, lpf_corner_target; - - st->cf_hz = clk_get_rate(st->clkin); - -+ /* Check for underflow */ -+ if (st->cf_hz > st->hpf_margin_hz) -+ hpf_corner_target = st->cf_hz - st->hpf_margin_hz; -+ else -+ hpf_corner_target = 0; -+ -+ /* Check for overflow */ -+ lpf_corner_target = st->cf_hz + st->lpf_margin_hz; -+ if (lpf_corner_target < st->cf_hz) -+ lpf_corner_target = U64_MAX; -+ - mutex_lock(&st->lock); - -- ret = __admv8818_hpf_select(st, st->cf_hz); -+ ret = __admv8818_hpf_select(st, hpf_corner_target); - if (ret) - goto exit; - -- ret = __admv8818_lpf_select(st, st->cf_hz); -+ ret = __admv8818_lpf_select(st, lpf_corner_target); - exit: - mutex_unlock(&st->lock); - return ret; -@@ -278,8 +341,11 @@ static int __admv8818_read_hpf_freq(struct admv8818_state *st, u64 *hpf_freq) - - hpf_state = FIELD_GET(ADMV8818_HPF_WR0_MSK, data); - -- *hpf_freq = div_u64(freq_range_hpf[hpf_band - 1][1] - freq_range_hpf[hpf_band - 1][0], 15); -- *hpf_freq = freq_range_hpf[hpf_band - 1][0] + (*hpf_freq * hpf_state); -+ *hpf_freq = freq_range_hpf[hpf_band][ADMV8818_BAND_CORNER_HIGH] - -+ freq_range_hpf[hpf_band][ADMV8818_BAND_CORNER_LOW]; -+ *hpf_freq = div_u64(*hpf_freq, ADMV8818_NUM_STATES - 1); -+ *hpf_freq = freq_range_hpf[hpf_band][ADMV8818_BAND_CORNER_LOW] + -+ (*hpf_freq * hpf_state); - - return ret; - } -@@ -316,8 +382,11 @@ static int __admv8818_read_lpf_freq(struct admv8818_state *st, u64 *lpf_freq) - - lpf_state = FIELD_GET(ADMV8818_LPF_WR0_MSK, data); - -- *lpf_freq = div_u64(freq_range_lpf[lpf_band - 1][1] - freq_range_lpf[lpf_band - 1][0], 15); -- *lpf_freq = freq_range_lpf[lpf_band - 1][0] + (*lpf_freq * lpf_state); -+ *lpf_freq = freq_range_lpf[lpf_band][ADMV8818_BAND_CORNER_HIGH] - -+ freq_range_lpf[lpf_band][ADMV8818_BAND_CORNER_LOW]; -+ *lpf_freq = div_u64(*lpf_freq, ADMV8818_NUM_STATES - 1); -+ *lpf_freq = freq_range_lpf[lpf_band][ADMV8818_BAND_CORNER_LOW] + -+ (*lpf_freq * lpf_state); - - return ret; - } -@@ -333,6 +402,19 @@ static int admv8818_read_lpf_freq(struct admv8818_state *st, u64 *lpf_freq) - return ret; - } - -+static int admv8818_write_raw_get_fmt(struct iio_dev *indio_dev, -+ struct iio_chan_spec const *chan, -+ long mask) -+{ -+ switch (mask) { -+ case IIO_CHAN_INFO_LOW_PASS_FILTER_3DB_FREQUENCY: -+ case IIO_CHAN_INFO_HIGH_PASS_FILTER_3DB_FREQUENCY: -+ return IIO_VAL_INT_64; -+ default: -+ return -EINVAL; -+ } -+} -+ - static int admv8818_write_raw(struct iio_dev *indio_dev, - struct iio_chan_spec const *chan, - int val, int val2, long info) -@@ -341,6 +423,9 @@ static int admv8818_write_raw(struct iio_dev *indio_dev, - - u64 freq = ((u64)val2 << 32 | (u32)val); - -+ if ((s64)freq < 0) -+ return -EINVAL; -+ - switch (info) { - case IIO_CHAN_INFO_LOW_PASS_FILTER_3DB_FREQUENCY: - return admv8818_lpf_select(st, freq); -@@ -502,6 +587,7 @@ static int admv8818_set_mode(struct iio_dev *indio_dev, - - static const struct iio_info admv8818_info = { - .write_raw = admv8818_write_raw, -+ .write_raw_get_fmt = admv8818_write_raw_get_fmt, - .read_raw = admv8818_read_raw, - .debugfs_reg_access = &admv8818_reg_access, - }; -@@ -641,6 +727,32 @@ static int admv8818_clk_setup(struct admv8818_state *st) - return devm_add_action_or_reset(&spi->dev, admv8818_clk_notifier_unreg, st); - } - -+static int admv8818_read_properties(struct admv8818_state *st) -+{ -+ struct spi_device *spi = st->spi; -+ u32 mhz; -+ int ret; -+ -+ ret = device_property_read_u32(&spi->dev, "adi,lpf-margin-mhz", &mhz); -+ if (ret == 0) -+ st->lpf_margin_hz = (u64)mhz * HZ_PER_MHZ; -+ else if (ret == -EINVAL) -+ st->lpf_margin_hz = 0; -+ else -+ return ret; -+ -+ -+ ret = device_property_read_u32(&spi->dev, "adi,hpf-margin-mhz", &mhz); -+ if (ret == 0) -+ st->hpf_margin_hz = (u64)mhz * HZ_PER_MHZ; -+ else if (ret == -EINVAL) -+ st->hpf_margin_hz = 0; -+ else if (ret < 0) -+ return ret; -+ -+ return 0; -+} -+ - static int admv8818_probe(struct spi_device *spi) - { - struct iio_dev *indio_dev; -@@ -672,6 +784,10 @@ static int admv8818_probe(struct spi_device *spi) - - mutex_init(&st->lock); - -+ ret = admv8818_read_properties(st); -+ if (ret) -+ return ret; -+ - ret = admv8818_init(st); - if (ret) - return ret; -diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c -index 07fb8d3c037f00..d45e3909dafe1d 100644 ---- a/drivers/infiniband/core/cm.c -+++ b/drivers/infiniband/core/cm.c -@@ -166,7 +166,7 @@ struct cm_port { - struct cm_device { - struct kref kref; - struct list_head list; -- spinlock_t mad_agent_lock; -+ rwlock_t mad_agent_lock; - struct ib_device *ib_device; - u8 ack_delay; - int going_down; -@@ -284,7 +284,7 @@ static struct ib_mad_send_buf *cm_alloc_msg(struct cm_id_private *cm_id_priv) - if (!cm_id_priv->av.port) - return ERR_PTR(-EINVAL); - -- spin_lock(&cm_id_priv->av.port->cm_dev->mad_agent_lock); -+ read_lock(&cm_id_priv->av.port->cm_dev->mad_agent_lock); - mad_agent = cm_id_priv->av.port->mad_agent; - if (!mad_agent) { - m = ERR_PTR(-EINVAL); -@@ -315,7 +315,7 @@ static struct ib_mad_send_buf *cm_alloc_msg(struct cm_id_private *cm_id_priv) - m->context[0] = cm_id_priv; - - out: -- spin_unlock(&cm_id_priv->av.port->cm_dev->mad_agent_lock); -+ read_unlock(&cm_id_priv->av.port->cm_dev->mad_agent_lock); - return m; - } - -@@ -1294,10 +1294,10 @@ static __be64 cm_form_tid(struct cm_id_private *cm_id_priv) - if (!cm_id_priv->av.port) - return cpu_to_be64(low_tid); - -- spin_lock(&cm_id_priv->av.port->cm_dev->mad_agent_lock); -+ read_lock(&cm_id_priv->av.port->cm_dev->mad_agent_lock); - if (cm_id_priv->av.port->mad_agent) - hi_tid = ((u64)cm_id_priv->av.port->mad_agent->hi_tid) << 32; -- spin_unlock(&cm_id_priv->av.port->cm_dev->mad_agent_lock); -+ read_unlock(&cm_id_priv->av.port->cm_dev->mad_agent_lock); - return cpu_to_be64(hi_tid | low_tid); - } - -@@ -4374,7 +4374,7 @@ static int cm_add_one(struct ib_device *ib_device) - return -ENOMEM; - - kref_init(&cm_dev->kref); -- spin_lock_init(&cm_dev->mad_agent_lock); -+ rwlock_init(&cm_dev->mad_agent_lock); - cm_dev->ib_device = ib_device; - cm_dev->ack_delay = ib_device->attrs.local_ca_ack_delay; - cm_dev->going_down = 0; -@@ -4490,9 +4490,9 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data) - * The above ensures no call paths from the work are running, - * the remaining paths all take the mad_agent_lock. - */ -- spin_lock(&cm_dev->mad_agent_lock); -+ write_lock(&cm_dev->mad_agent_lock); - port->mad_agent = NULL; -- spin_unlock(&cm_dev->mad_agent_lock); -+ write_unlock(&cm_dev->mad_agent_lock); - ib_unregister_mad_agent(mad_agent); - ib_port_unregister_client_groups(ib_device, i, - cm_counter_groups); -diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c -index 348527cf1e7bfc..a5ceae2e075ad6 100644 ---- a/drivers/infiniband/core/cma.c -+++ b/drivers/infiniband/core/cma.c -@@ -5215,7 +5215,8 @@ static int cma_netevent_callback(struct notifier_block *self, - neigh->ha, ETH_ALEN)) - continue; - cma_id_get(current_id); -- queue_work(cma_wq, ¤t_id->id.net_work); -+ if (!queue_work(cma_wq, ¤t_id->id.net_work)) -+ cma_id_put(current_id); - } - out: - spin_unlock_irqrestore(&id_table_lock, flags); -diff --git a/drivers/infiniband/hw/hns/hns_roce_ah.c b/drivers/infiniband/hw/hns/hns_roce_ah.c -index 3df032ddda1891..e99890e0c8c37b 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_ah.c -+++ b/drivers/infiniband/hw/hns/hns_roce_ah.c -@@ -33,7 +33,6 @@ - #include - #include - #include --#include "hnae3.h" - #include "hns_roce_device.h" - #include "hns_roce_hw_v2.h" - -diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -index aded0a7f42838d..9d23d4b5c1285f 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -@@ -42,7 +42,6 @@ - #include - #include - --#include "hnae3.h" - #include "hns_roce_common.h" - #include "hns_roce_device.h" - #include "hns_roce_cmd.h" -diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h -index b8e17721f6fdea..7875283eb9d631 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h -+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h -@@ -34,6 +34,7 @@ - #define _HNS_ROCE_HW_V2_H - - #include -+#include "hnae3.h" - - #define HNS_ROCE_V2_MAX_RC_INL_INN_SZ 32 - #define HNS_ROCE_V2_MTT_ENTRY_SZ 64 -diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c -index a7e4c951f8fe40..5f39a25064d10d 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_main.c -+++ b/drivers/infiniband/hw/hns/hns_roce_main.c -@@ -37,7 +37,6 @@ - #include - #include - #include --#include "hnae3.h" - #include "hns_roce_common.h" - #include "hns_roce_device.h" - #include "hns_roce_hem.h" -diff --git a/drivers/infiniband/hw/hns/hns_roce_restrack.c b/drivers/infiniband/hw/hns/hns_roce_restrack.c -index 081a01de305535..1fb5e246836479 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_restrack.c -+++ b/drivers/infiniband/hw/hns/hns_roce_restrack.c -@@ -4,7 +4,6 @@ - #include - #include - #include --#include "hnae3.h" - #include "hns_roce_common.h" - #include "hns_roce_device.h" - #include "hns_roce_hw_v2.h" -diff --git a/drivers/infiniband/hw/mlx5/qpc.c b/drivers/infiniband/hw/mlx5/qpc.c -index d9cf6982d645ed..9de9bea1025e26 100644 ---- a/drivers/infiniband/hw/mlx5/qpc.c -+++ b/drivers/infiniband/hw/mlx5/qpc.c -@@ -21,8 +21,10 @@ mlx5_get_rsc(struct mlx5_qp_table *table, u32 rsn) - spin_lock_irqsave(&table->lock, flags); - - common = radix_tree_lookup(&table->tree, rsn); -- if (common) -+ if (common && !common->invalid) - refcount_inc(&common->refcount); -+ else -+ common = NULL; - - spin_unlock_irqrestore(&table->lock, flags); - -@@ -178,6 +180,18 @@ static int create_resource_common(struct mlx5_ib_dev *dev, - return 0; - } - -+static void modify_resource_common_state(struct mlx5_ib_dev *dev, -+ struct mlx5_core_qp *qp, -+ bool invalid) -+{ -+ struct mlx5_qp_table *table = &dev->qp_table; -+ unsigned long flags; -+ -+ spin_lock_irqsave(&table->lock, flags); -+ qp->common.invalid = invalid; -+ spin_unlock_irqrestore(&table->lock, flags); -+} -+ - static void destroy_resource_common(struct mlx5_ib_dev *dev, - struct mlx5_core_qp *qp) - { -@@ -604,8 +618,20 @@ int mlx5_core_create_rq_tracked(struct mlx5_ib_dev *dev, u32 *in, int inlen, - int mlx5_core_destroy_rq_tracked(struct mlx5_ib_dev *dev, - struct mlx5_core_qp *rq) - { -+ int ret; -+ -+ /* The rq destruction can be called again in case it fails, hence we -+ * mark the common resource as invalid and only once FW destruction -+ * is completed successfully we actually destroy the resources. -+ */ -+ modify_resource_common_state(dev, rq, true); -+ ret = destroy_rq_tracked(dev, rq->qpn, rq->uid); -+ if (ret) { -+ modify_resource_common_state(dev, rq, false); -+ return ret; -+ } - destroy_resource_common(dev, rq); -- return destroy_rq_tracked(dev, rq->qpn, rq->uid); -+ return 0; - } - - static void destroy_sq_tracked(struct mlx5_ib_dev *dev, u32 sqn, u16 uid) -diff --git a/drivers/input/rmi4/rmi_f34.c b/drivers/input/rmi4/rmi_f34.c -index 0d9a5756e3f593..cae1e416649214 100644 ---- a/drivers/input/rmi4/rmi_f34.c -+++ b/drivers/input/rmi4/rmi_f34.c -@@ -4,6 +4,7 @@ - * Copyright (C) 2016 Zodiac Inflight Innovations - */ - -+#include "linux/device.h" - #include - #include - #include -@@ -298,39 +299,30 @@ static int rmi_f34_update_firmware(struct f34_data *f34, - return ret; - } - --static int rmi_f34_status(struct rmi_function *fn) --{ -- struct f34_data *f34 = dev_get_drvdata(&fn->dev); -- -- /* -- * The status is the percentage complete, or once complete, -- * zero for success or a negative return code. -- */ -- return f34->update_status; --} -- - static ssize_t rmi_driver_bootloader_id_show(struct device *dev, - struct device_attribute *dattr, - char *buf) - { - struct rmi_driver_data *data = dev_get_drvdata(dev); -- struct rmi_function *fn = data->f34_container; -+ struct rmi_function *fn; - struct f34_data *f34; - -- if (fn) { -- f34 = dev_get_drvdata(&fn->dev); -- -- if (f34->bl_version == 5) -- return sysfs_emit(buf, "%c%c\n", -- f34->bootloader_id[0], -- f34->bootloader_id[1]); -- else -- return sysfs_emit(buf, "V%d.%d\n", -- f34->bootloader_id[1], -- f34->bootloader_id[0]); -- } -+ fn = data->f34_container; -+ if (!fn) -+ return -ENODEV; - -- return 0; -+ f34 = dev_get_drvdata(&fn->dev); -+ if (!f34) -+ return -ENODEV; -+ -+ if (f34->bl_version == 5) -+ return sysfs_emit(buf, "%c%c\n", -+ f34->bootloader_id[0], -+ f34->bootloader_id[1]); -+ else -+ return sysfs_emit(buf, "V%d.%d\n", -+ f34->bootloader_id[1], -+ f34->bootloader_id[0]); - } - - static DEVICE_ATTR(bootloader_id, 0444, rmi_driver_bootloader_id_show, NULL); -@@ -343,13 +335,16 @@ static ssize_t rmi_driver_configuration_id_show(struct device *dev, - struct rmi_function *fn = data->f34_container; - struct f34_data *f34; - -- if (fn) { -- f34 = dev_get_drvdata(&fn->dev); -+ fn = data->f34_container; -+ if (!fn) -+ return -ENODEV; - -- return sysfs_emit(buf, "%s\n", f34->configuration_id); -- } -+ f34 = dev_get_drvdata(&fn->dev); -+ if (!f34) -+ return -ENODEV; - -- return 0; -+ -+ return sysfs_emit(buf, "%s\n", f34->configuration_id); - } - - static DEVICE_ATTR(configuration_id, 0444, -@@ -365,10 +360,14 @@ static int rmi_firmware_update(struct rmi_driver_data *data, - - if (!data->f34_container) { - dev_warn(dev, "%s: No F34 present!\n", __func__); -- return -EINVAL; -+ return -ENODEV; - } - - f34 = dev_get_drvdata(&data->f34_container->dev); -+ if (!f34) { -+ dev_warn(dev, "%s: No valid F34 present!\n", __func__); -+ return -ENODEV; -+ } - - if (f34->bl_version >= 7) { - if (data->pdt_props & HAS_BSR) { -@@ -494,10 +493,18 @@ static ssize_t rmi_driver_update_fw_status_show(struct device *dev, - char *buf) - { - struct rmi_driver_data *data = dev_get_drvdata(dev); -- int update_status = 0; -+ struct f34_data *f34; -+ int update_status = -ENODEV; - -- if (data->f34_container) -- update_status = rmi_f34_status(data->f34_container); -+ /* -+ * The status is the percentage complete, or once complete, -+ * zero for success or a negative return code. -+ */ -+ if (data->f34_container) { -+ f34 = dev_get_drvdata(&data->f34_container->dev); -+ if (f34) -+ update_status = f34->update_status; -+ } - - return sysfs_emit(buf, "%d\n", update_status); - } -@@ -517,33 +524,21 @@ static const struct attribute_group rmi_firmware_attr_group = { - .attrs = rmi_firmware_attrs, - }; - --static int rmi_f34_probe(struct rmi_function *fn) -+static int rmi_f34v5_probe(struct f34_data *f34) - { -- struct f34_data *f34; -- unsigned char f34_queries[9]; -+ struct rmi_function *fn = f34->fn; -+ u8 f34_queries[9]; - bool has_config_id; -- u8 version = fn->fd.function_version; -- int ret; -- -- f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL); -- if (!f34) -- return -ENOMEM; -- -- f34->fn = fn; -- dev_set_drvdata(&fn->dev, f34); -- -- /* v5 code only supported version 0, try V7 probe */ -- if (version > 0) -- return rmi_f34v7_probe(f34); -+ int error; - - f34->bl_version = 5; - -- ret = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr, -- f34_queries, sizeof(f34_queries)); -- if (ret) { -+ error = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr, -+ f34_queries, sizeof(f34_queries)); -+ if (error) { - dev_err(&fn->dev, "%s: Failed to query properties\n", - __func__); -- return ret; -+ return error; - } - - snprintf(f34->bootloader_id, sizeof(f34->bootloader_id), -@@ -569,11 +564,11 @@ static int rmi_f34_probe(struct rmi_function *fn) - f34->v5.config_blocks); - - if (has_config_id) { -- ret = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr, -- f34_queries, sizeof(f34_queries)); -- if (ret) { -+ error = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr, -+ f34_queries, sizeof(f34_queries)); -+ if (error) { - dev_err(&fn->dev, "Failed to read F34 config ID\n"); -- return ret; -+ return error; - } - - snprintf(f34->configuration_id, sizeof(f34->configuration_id), -@@ -582,12 +577,34 @@ static int rmi_f34_probe(struct rmi_function *fn) - f34_queries[2], f34_queries[3]); - - rmi_dbg(RMI_DEBUG_FN, &fn->dev, "Configuration ID: %s\n", -- f34->configuration_id); -+ f34->configuration_id); - } - - return 0; - } - -+static int rmi_f34_probe(struct rmi_function *fn) -+{ -+ struct f34_data *f34; -+ u8 version = fn->fd.function_version; -+ int error; -+ -+ f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL); -+ if (!f34) -+ return -ENOMEM; -+ -+ f34->fn = fn; -+ -+ /* v5 code only supported version 0 */ -+ error = version == 0 ? rmi_f34v5_probe(f34) : rmi_f34v7_probe(f34); -+ if (error) -+ return error; -+ -+ dev_set_drvdata(&fn->dev, f34); -+ -+ return 0; -+} -+ - int rmi_f34_create_sysfs(struct rmi_device *rmi_dev) - { - return sysfs_create_group(&rmi_dev->dev.kobj, &rmi_firmware_attr_group); -diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig -index d57c5adf932e36..20aa5ed80aa387 100644 ---- a/drivers/iommu/Kconfig -+++ b/drivers/iommu/Kconfig -@@ -191,7 +191,6 @@ source "drivers/iommu/iommufd/Kconfig" - config IRQ_REMAP - bool "Support for Interrupt Remapping" - depends on X86_64 && X86_IO_APIC && PCI_MSI && ACPI -- select DMAR_TABLE if INTEL_IOMMU - help - Supports Interrupt remapping for IO-APIC and MSI devices. - To use x2apic mode in the CPU's which support x2APIC enhancements or -diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c -index f2b3a4e2e54fc8..3fa5699b9ff191 100644 ---- a/drivers/iommu/iommu.c -+++ b/drivers/iommu/iommu.c -@@ -2382,6 +2382,7 @@ static size_t iommu_pgsize(struct iommu_domain *domain, unsigned long iova, - unsigned int pgsize_idx, pgsize_idx_next; - unsigned long pgsizes; - size_t offset, pgsize, pgsize_next; -+ size_t offset_end; - unsigned long addr_merge = paddr | iova; - - /* Page sizes supported by the hardware and small enough for @size */ -@@ -2422,7 +2423,8 @@ static size_t iommu_pgsize(struct iommu_domain *domain, unsigned long iova, - * If size is big enough to accommodate the larger page, reduce - * the number of smaller pages. - */ -- if (offset + pgsize_next <= size) -+ if (!check_add_overflow(offset, pgsize_next, &offset_end) && -+ offset_end <= size) - size = offset; - - out_set_count: -diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c -index dc491dc771d712..ada679f4fca671 100644 ---- a/drivers/md/dm-flakey.c -+++ b/drivers/md/dm-flakey.c -@@ -47,14 +47,15 @@ enum feature_flag_bits { - }; - - struct per_bio_data { -- bool bio_submitted; -+ bool bio_can_corrupt; -+ struct bvec_iter saved_iter; - }; - - static int parse_features(struct dm_arg_set *as, struct flakey_c *fc, - struct dm_target *ti) - { -- int r; -- unsigned int argc; -+ int r = 0; -+ unsigned int argc = 0; - const char *arg_name; - - static const struct dm_arg _args[] = { -@@ -65,14 +66,13 @@ static int parse_features(struct dm_arg_set *as, struct flakey_c *fc, - {0, PROBABILITY_BASE, "Invalid random corrupt argument"}, - }; - -- /* No feature arguments supplied. */ -- if (!as->argc) -- return 0; -- -- r = dm_read_arg_group(_args, as, &argc, &ti->error); -- if (r) -+ if (as->argc && (r = dm_read_arg_group(_args, as, &argc, &ti->error))) - return r; - -+ /* No feature arguments supplied. */ -+ if (!argc) -+ goto error_all_io; -+ - while (argc) { - arg_name = dm_shift_arg(as); - argc--; -@@ -217,6 +217,7 @@ static int parse_features(struct dm_arg_set *as, struct flakey_c *fc, - if (!fc->corrupt_bio_byte && !test_bit(ERROR_READS, &fc->flags) && - !test_bit(DROP_WRITES, &fc->flags) && !test_bit(ERROR_WRITES, &fc->flags) && - !fc->random_read_corrupt && !fc->random_write_corrupt) { -+error_all_io: - set_bit(ERROR_WRITES, &fc->flags); - set_bit(ERROR_READS, &fc->flags); - } -@@ -339,7 +340,8 @@ static void flakey_map_bio(struct dm_target *ti, struct bio *bio) - } - - static void corrupt_bio_common(struct bio *bio, unsigned int corrupt_bio_byte, -- unsigned char corrupt_bio_value) -+ unsigned char corrupt_bio_value, -+ struct bvec_iter start) - { - struct bvec_iter iter; - struct bio_vec bvec; -@@ -348,7 +350,7 @@ static void corrupt_bio_common(struct bio *bio, unsigned int corrupt_bio_byte, - * Overwrite the Nth byte of the bio's data, on whichever page - * it falls. - */ -- bio_for_each_segment(bvec, bio, iter) { -+ __bio_for_each_segment(bvec, bio, iter, start) { - if (bio_iter_len(bio, iter) > corrupt_bio_byte) { - unsigned char *segment = bvec_kmap_local(&bvec); - segment[corrupt_bio_byte] = corrupt_bio_value; -@@ -357,36 +359,31 @@ static void corrupt_bio_common(struct bio *bio, unsigned int corrupt_bio_byte, - "(rw=%c bi_opf=%u bi_sector=%llu size=%u)\n", - bio, corrupt_bio_value, corrupt_bio_byte, - (bio_data_dir(bio) == WRITE) ? 'w' : 'r', bio->bi_opf, -- (unsigned long long)bio->bi_iter.bi_sector, -- bio->bi_iter.bi_size); -+ (unsigned long long)start.bi_sector, -+ start.bi_size); - break; - } - corrupt_bio_byte -= bio_iter_len(bio, iter); - } - } - --static void corrupt_bio_data(struct bio *bio, struct flakey_c *fc) -+static void corrupt_bio_data(struct bio *bio, struct flakey_c *fc, -+ struct bvec_iter start) - { - unsigned int corrupt_bio_byte = fc->corrupt_bio_byte - 1; - -- if (!bio_has_data(bio)) -- return; -- -- corrupt_bio_common(bio, corrupt_bio_byte, fc->corrupt_bio_value); -+ corrupt_bio_common(bio, corrupt_bio_byte, fc->corrupt_bio_value, start); - } - --static void corrupt_bio_random(struct bio *bio) -+static void corrupt_bio_random(struct bio *bio, struct bvec_iter start) - { - unsigned int corrupt_byte; - unsigned char corrupt_value; - -- if (!bio_has_data(bio)) -- return; -- -- corrupt_byte = get_random_u32() % bio->bi_iter.bi_size; -+ corrupt_byte = get_random_u32() % start.bi_size; - corrupt_value = get_random_u8(); - -- corrupt_bio_common(bio, corrupt_byte, corrupt_value); -+ corrupt_bio_common(bio, corrupt_byte, corrupt_value, start); - } - - static void clone_free(struct bio *clone) -@@ -481,7 +478,7 @@ static int flakey_map(struct dm_target *ti, struct bio *bio) - unsigned int elapsed; - struct per_bio_data *pb = dm_per_bio_data(bio, sizeof(struct per_bio_data)); - -- pb->bio_submitted = false; -+ pb->bio_can_corrupt = false; - - if (op_is_zone_mgmt(bio_op(bio))) - goto map_bio; -@@ -490,10 +487,11 @@ static int flakey_map(struct dm_target *ti, struct bio *bio) - elapsed = (jiffies - fc->start_time) / HZ; - if (elapsed % (fc->up_interval + fc->down_interval) >= fc->up_interval) { - bool corrupt_fixed, corrupt_random; -- /* -- * Flag this bio as submitted while down. -- */ -- pb->bio_submitted = true; -+ -+ if (bio_has_data(bio)) { -+ pb->bio_can_corrupt = true; -+ pb->saved_iter = bio->bi_iter; -+ } - - /* - * Error reads if neither corrupt_bio_byte or drop_writes or error_writes are set. -@@ -516,6 +514,8 @@ static int flakey_map(struct dm_target *ti, struct bio *bio) - return DM_MAPIO_SUBMITTED; - } - -+ if (!pb->bio_can_corrupt) -+ goto map_bio; - /* - * Corrupt matching writes. - */ -@@ -535,9 +535,11 @@ static int flakey_map(struct dm_target *ti, struct bio *bio) - struct bio *clone = clone_bio(ti, fc, bio); - if (clone) { - if (corrupt_fixed) -- corrupt_bio_data(clone, fc); -+ corrupt_bio_data(clone, fc, -+ clone->bi_iter); - if (corrupt_random) -- corrupt_bio_random(clone); -+ corrupt_bio_random(clone, -+ clone->bi_iter); - submit_bio(clone); - return DM_MAPIO_SUBMITTED; - } -@@ -559,21 +561,21 @@ static int flakey_end_io(struct dm_target *ti, struct bio *bio, - if (op_is_zone_mgmt(bio_op(bio))) - return DM_ENDIO_DONE; - -- if (!*error && pb->bio_submitted && (bio_data_dir(bio) == READ)) { -+ if (!*error && pb->bio_can_corrupt && (bio_data_dir(bio) == READ)) { - if (fc->corrupt_bio_byte) { - if ((fc->corrupt_bio_rw == READ) && - all_corrupt_bio_flags_match(bio, fc)) { - /* - * Corrupt successful matching READs while in down state. - */ -- corrupt_bio_data(bio, fc); -+ corrupt_bio_data(bio, fc, pb->saved_iter); - } - } - if (fc->random_read_corrupt) { - u64 rnd = get_random_u64(); - u32 rem = do_div(rnd, PROBABILITY_BASE); - if (rem < fc->random_read_corrupt) -- corrupt_bio_random(bio); -+ corrupt_bio_random(bio, pb->saved_iter); - } - if (test_bit(ERROR_READS, &fc->flags)) { - /* -diff --git a/drivers/md/dm.c b/drivers/md/dm.c -index 9ea868bd0d1293..44424554e6b52a 100644 ---- a/drivers/md/dm.c -+++ b/drivers/md/dm.c -@@ -2195,21 +2195,29 @@ static struct dm_table *__bind(struct mapped_device *md, struct dm_table *t, - struct queue_limits *limits) - { - struct dm_table *old_map; -- sector_t size; -+ sector_t size, old_size; - int ret; - - lockdep_assert_held(&md->suspend_lock); - - size = dm_table_get_size(t); - -+ old_size = dm_get_size(md); -+ set_capacity(md->disk, size); -+ -+ ret = dm_table_set_restrictions(t, md->queue, limits); -+ if (ret) { -+ set_capacity(md->disk, old_size); -+ old_map = ERR_PTR(ret); -+ goto out; -+ } -+ - /* - * Wipe any geometry if the size of the table changed. - */ -- if (size != dm_get_size(md)) -+ if (size != old_size) - memset(&md->geometry, 0, sizeof(md->geometry)); - -- set_capacity(md->disk, size); -- - dm_table_event_callback(t, event_callback, md); - - if (dm_table_request_based(t)) { -@@ -2227,10 +2235,10 @@ static struct dm_table *__bind(struct mapped_device *md, struct dm_table *t, - * requests in the queue may refer to bio from the old bioset, - * so you must walk through the queue to unprep. - */ -- if (!md->mempools) { -+ if (!md->mempools) - md->mempools = t->mempools; -- t->mempools = NULL; -- } -+ else -+ dm_free_md_mempools(t->mempools); - } else { - /* - * The md may already have mempools that need changing. -@@ -2239,14 +2247,8 @@ static struct dm_table *__bind(struct mapped_device *md, struct dm_table *t, - */ - dm_free_md_mempools(md->mempools); - md->mempools = t->mempools; -- t->mempools = NULL; -- } -- -- ret = dm_table_set_restrictions(t, md->queue, limits); -- if (ret) { -- old_map = ERR_PTR(ret); -- goto out; - } -+ t->mempools = NULL; - - old_map = rcu_dereference_protected(md->map, lockdep_is_held(&md->suspend_lock)); - rcu_assign_pointer(md->map, (void *)t); -diff --git a/drivers/mfd/exynos-lpass.c b/drivers/mfd/exynos-lpass.c -index 1506d8d352b19b..5e39d91b728fc3 100644 ---- a/drivers/mfd/exynos-lpass.c -+++ b/drivers/mfd/exynos-lpass.c -@@ -141,7 +141,6 @@ static int exynos_lpass_remove(struct platform_device *pdev) - { - struct exynos_lpass *lpass = platform_get_drvdata(pdev); - -- exynos_lpass_disable(lpass); - pm_runtime_disable(&pdev->dev); - if (!pm_runtime_status_suspended(&pdev->dev)) - exynos_lpass_disable(lpass); -diff --git a/drivers/mfd/stmpe-spi.c b/drivers/mfd/stmpe-spi.c -index 792236f56399af..b9cc85ea2c4019 100644 ---- a/drivers/mfd/stmpe-spi.c -+++ b/drivers/mfd/stmpe-spi.c -@@ -129,7 +129,7 @@ static const struct spi_device_id stmpe_spi_id[] = { - { "stmpe2403", STMPE2403 }, - { } - }; --MODULE_DEVICE_TABLE(spi, stmpe_id); -+MODULE_DEVICE_TABLE(spi, stmpe_spi_id); - - static struct spi_driver stmpe_spi_driver = { - .driver = { -diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c -index abe79f6fd2a79b..b64944367ac533 100644 ---- a/drivers/misc/vmw_vmci/vmci_host.c -+++ b/drivers/misc/vmw_vmci/vmci_host.c -@@ -227,6 +227,7 @@ static int drv_cp_harray_to_user(void __user *user_buf_uva, - static int vmci_host_setup_notify(struct vmci_ctx *context, - unsigned long uva) - { -+ struct page *page; - int retval; - - if (context->notify_page) { -@@ -243,13 +244,11 @@ static int vmci_host_setup_notify(struct vmci_ctx *context, - /* - * Lock physical page backing a given user VA. - */ -- retval = get_user_pages_fast(uva, 1, FOLL_WRITE, &context->notify_page); -- if (retval != 1) { -- context->notify_page = NULL; -+ retval = get_user_pages_fast(uva, 1, FOLL_WRITE, &page); -+ if (retval != 1) - return VMCI_ERROR_GENERIC; -- } -- if (context->notify_page == NULL) -- return VMCI_ERROR_UNAVAILABLE; -+ -+ context->notify_page = page; - - /* - * Map the locked page and set up notify pointer. -diff --git a/drivers/mtd/nand/ecc-mxic.c b/drivers/mtd/nand/ecc-mxic.c -index 47e10945b8d271..63cb206269dd9d 100644 ---- a/drivers/mtd/nand/ecc-mxic.c -+++ b/drivers/mtd/nand/ecc-mxic.c -@@ -614,7 +614,7 @@ static int mxic_ecc_finish_io_req_external(struct nand_device *nand, - { - struct mxic_ecc_engine *mxic = nand_to_mxic(nand); - struct mxic_ecc_ctx *ctx = nand_to_ecc_ctx(nand); -- int nents, step, ret; -+ int nents, step, ret = 0; - - if (req->mode == MTD_OPS_RAW) - return 0; -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 56c241246d1af4..85ab6925716272 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -2040,15 +2040,26 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev, - * set the master's mac address to that of the first slave - */ - memcpy(ss.__data, bond_dev->dev_addr, bond_dev->addr_len); -- ss.ss_family = slave_dev->type; -- res = dev_set_mac_address(slave_dev, (struct sockaddr *)&ss, -- extack); -- if (res) { -- slave_err(bond_dev, slave_dev, "Error %d calling set_mac_address\n", res); -- goto err_restore_mtu; -- } -+ } else if (bond->params.fail_over_mac == BOND_FOM_FOLLOW && -+ BOND_MODE(bond) == BOND_MODE_ACTIVEBACKUP && -+ memcmp(slave_dev->dev_addr, bond_dev->dev_addr, bond_dev->addr_len) == 0) { -+ /* Set slave to random address to avoid duplicate mac -+ * address in later fail over. -+ */ -+ eth_random_addr(ss.__data); -+ } else { -+ goto skip_mac_set; - } - -+ ss.ss_family = slave_dev->type; -+ res = dev_set_mac_address(slave_dev, (struct sockaddr *)&ss, extack); -+ if (res) { -+ slave_err(bond_dev, slave_dev, "Error %d calling set_mac_address\n", res); -+ goto err_restore_mtu; -+ } -+ -+skip_mac_set: -+ - /* set no_addrconf flag before open to prevent IPv6 addrconf */ - slave_dev->priv_flags |= IFF_NO_ADDRCONF; - -diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c -index d2ff2c2fcbbfc4..004d2c988ff097 100644 ---- a/drivers/net/dsa/b53/b53_common.c -+++ b/drivers/net/dsa/b53/b53_common.c -@@ -1237,24 +1237,7 @@ static void b53_adjust_63xx_rgmii(struct dsa_switch *ds, int port, - off = B53_RGMII_CTRL_P(port); - - b53_read8(dev, B53_CTRL_PAGE, off, &rgmii_ctrl); -- -- switch (interface) { -- case PHY_INTERFACE_MODE_RGMII_ID: -- rgmii_ctrl |= (RGMII_CTRL_DLL_RXC | RGMII_CTRL_DLL_TXC); -- break; -- case PHY_INTERFACE_MODE_RGMII_RXID: -- rgmii_ctrl &= ~(RGMII_CTRL_DLL_TXC); -- rgmii_ctrl |= RGMII_CTRL_DLL_RXC; -- break; -- case PHY_INTERFACE_MODE_RGMII_TXID: -- rgmii_ctrl &= ~(RGMII_CTRL_DLL_RXC); -- rgmii_ctrl |= RGMII_CTRL_DLL_TXC; -- break; -- case PHY_INTERFACE_MODE_RGMII: -- default: -- rgmii_ctrl &= ~(RGMII_CTRL_DLL_RXC | RGMII_CTRL_DLL_TXC); -- break; -- } -+ rgmii_ctrl &= ~(RGMII_CTRL_DLL_RXC | RGMII_CTRL_DLL_TXC); - - if (port != dev->imp_port) { - if (is63268(dev)) -@@ -1394,6 +1377,10 @@ static void b53_phylink_get_caps(struct dsa_switch *ds, int port, - __set_bit(PHY_INTERFACE_MODE_MII, config->supported_interfaces); - __set_bit(PHY_INTERFACE_MODE_REVMII, config->supported_interfaces); - -+ /* BCM63xx RGMII ports support RGMII */ -+ if (is63xx(dev) && in_range(port, B53_63XX_RGMII0, 4)) -+ phy_interface_set_rgmii(config->supported_interfaces); -+ - config->mac_capabilities = MAC_ASYM_PAUSE | MAC_SYM_PAUSE | - MAC_10 | MAC_100; - -diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c -index 8cd098fe88ef26..b4745d94cbbdbf 100644 ---- a/drivers/net/ethernet/google/gve/gve_main.c -+++ b/drivers/net/ethernet/google/gve/gve_main.c -@@ -1992,7 +1992,7 @@ void gve_handle_report_stats(struct gve_priv *priv) - }; - stats[stats_idx++] = (struct stats) { - .stat_name = cpu_to_be32(RX_BUFFERS_POSTED), -- .value = cpu_to_be64(priv->rx[0].fill_cnt), -+ .value = cpu_to_be64(priv->rx[idx].fill_cnt), - .queue_id = cpu_to_be32(idx), - }; - } -diff --git a/drivers/net/ethernet/google/gve/gve_tx_dqo.c b/drivers/net/ethernet/google/gve/gve_tx_dqo.c -index 89b62b8d16e14b..857749fef37cf2 100644 ---- a/drivers/net/ethernet/google/gve/gve_tx_dqo.c -+++ b/drivers/net/ethernet/google/gve/gve_tx_dqo.c -@@ -716,6 +716,9 @@ static int gve_tx_add_skb_dqo(struct gve_tx_ring *tx, - s16 completion_tag; - - pkt = gve_alloc_pending_packet(tx); -+ if (!pkt) -+ return -ENOMEM; -+ - pkt->skb = skb; - completion_tag = pkt - tx->dqo.pending_packets; - -diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -index d5509bc16d0d57..80036942dc764a 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -@@ -1552,8 +1552,8 @@ static void i40e_cleanup_reset_vf(struct i40e_vf *vf) - * @vf: pointer to the VF structure - * @flr: VFLR was issued or not - * -- * Returns true if the VF is in reset, resets successfully, or resets -- * are disabled and false otherwise. -+ * Return: True if reset was performed successfully or if resets are disabled. -+ * False if reset is already in progress. - **/ - bool i40e_reset_vf(struct i40e_vf *vf, bool flr) - { -@@ -1572,7 +1572,7 @@ bool i40e_reset_vf(struct i40e_vf *vf, bool flr) - - /* If VF is being reset already we don't need to continue. */ - if (test_and_set_bit(I40E_VF_STATE_RESETTING, &vf->vf_states)) -- return true; -+ return false; - - i40e_trigger_vf_reset(vf, flr); - -@@ -4332,7 +4332,10 @@ int i40e_vc_process_vflr_event(struct i40e_pf *pf) - reg = rd32(hw, I40E_GLGEN_VFLRSTAT(reg_idx)); - if (reg & BIT(bit_idx)) - /* i40e_reset_vf will clear the bit in GLGEN_VFLRSTAT */ -- i40e_reset_vf(vf, true); -+ if (!i40e_reset_vf(vf, true)) { -+ /* At least one VF did not finish resetting, retry next time */ -+ set_bit(__I40E_VFLR_EVENT_PENDING, pf->state); -+ } - } - - return 0; -diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c -index 0ae7bdfff83fb2..e1a68fb5e9fff0 100644 ---- a/drivers/net/ethernet/intel/ice/ice_main.c -+++ b/drivers/net/ethernet/intel/ice/ice_main.c -@@ -2650,6 +2650,27 @@ static void ice_vsi_assign_bpf_prog(struct ice_vsi *vsi, struct bpf_prog *prog) - bpf_prog_put(old_prog); - } - -+/** -+ * ice_unmap_xdp_rings - Unmap XDP rings from interrupt vectors -+ * @vsi: the VSI with XDP rings being unmapped -+ */ -+static void ice_unmap_xdp_rings(struct ice_vsi *vsi) -+{ -+ int v_idx; -+ -+ ice_for_each_q_vector(vsi, v_idx) { -+ struct ice_q_vector *q_vector = vsi->q_vectors[v_idx]; -+ struct ice_tx_ring *ring; -+ -+ ice_for_each_tx_ring(ring, q_vector->tx) -+ if (!ring->tx_buf || !ice_ring_is_xdp(ring)) -+ break; -+ -+ /* restore the value of last node prior to XDP setup */ -+ q_vector->tx.tx_ring = ring; -+ } -+} -+ - /** - * ice_prepare_xdp_rings - Allocate, configure and setup Tx rings for XDP - * @vsi: VSI to bring up Tx rings used by XDP -@@ -2749,7 +2770,7 @@ int ice_prepare_xdp_rings(struct ice_vsi *vsi, struct bpf_prog *prog, - if (status) { - dev_err(dev, "Failed VSI LAN queue config for XDP, error: %d\n", - status); -- goto clear_xdp_rings; -+ goto unmap_xdp_rings; - } - - /* assign the prog only when it's not already present on VSI; -@@ -2765,6 +2786,8 @@ int ice_prepare_xdp_rings(struct ice_vsi *vsi, struct bpf_prog *prog, - ice_vsi_assign_bpf_prog(vsi, prog); - - return 0; -+unmap_xdp_rings: -+ ice_unmap_xdp_rings(vsi); - clear_xdp_rings: - ice_for_each_xdp_txq(vsi, i) - if (vsi->xdp_rings[i]) { -@@ -2781,6 +2804,8 @@ int ice_prepare_xdp_rings(struct ice_vsi *vsi, struct bpf_prog *prog, - mutex_unlock(&pf->avail_q_mutex); - - devm_kfree(dev, vsi->xdp_rings); -+ vsi->xdp_rings = NULL; -+ - return -ENOMEM; - } - -@@ -2796,7 +2821,7 @@ int ice_destroy_xdp_rings(struct ice_vsi *vsi, enum ice_xdp_cfg cfg_type) - { - u16 max_txqs[ICE_MAX_TRAFFIC_CLASS] = { 0 }; - struct ice_pf *pf = vsi->back; -- int i, v_idx; -+ int i; - - /* q_vectors are freed in reset path so there's no point in detaching - * rings -@@ -2804,17 +2829,7 @@ int ice_destroy_xdp_rings(struct ice_vsi *vsi, enum ice_xdp_cfg cfg_type) - if (cfg_type == ICE_XDP_CFG_PART) - goto free_qmap; - -- ice_for_each_q_vector(vsi, v_idx) { -- struct ice_q_vector *q_vector = vsi->q_vectors[v_idx]; -- struct ice_tx_ring *ring; -- -- ice_for_each_tx_ring(ring, q_vector->tx) -- if (!ring->tx_buf || !ice_ring_is_xdp(ring)) -- break; -- -- /* restore the value of last node prior to XDP setup */ -- q_vector->tx.tx_ring = ring; -- } -+ ice_unmap_xdp_rings(vsi); - - free_qmap: - mutex_lock(&pf->avail_q_mutex); -@@ -2956,11 +2971,14 @@ ice_xdp_setup_prog(struct ice_vsi *vsi, struct bpf_prog *prog, - xdp_ring_err = ice_vsi_determine_xdp_res(vsi); - if (xdp_ring_err) { - NL_SET_ERR_MSG_MOD(extack, "Not enough Tx resources for XDP"); -+ goto resume_if; - } else { - xdp_ring_err = ice_prepare_xdp_rings(vsi, prog, - ICE_XDP_CFG_FULL); -- if (xdp_ring_err) -+ if (xdp_ring_err) { - NL_SET_ERR_MSG_MOD(extack, "Setting up XDP Tx resources failed"); -+ goto resume_if; -+ } - } - xdp_features_set_redirect_target(vsi->netdev, true); - /* reallocate Rx queues that are used for zero-copy */ -@@ -2978,6 +2996,7 @@ ice_xdp_setup_prog(struct ice_vsi *vsi, struct bpf_prog *prog, - NL_SET_ERR_MSG_MOD(extack, "Freeing XDP Rx resources failed"); - } - -+resume_if: - if (if_running) - ret = ice_up(vsi); - -diff --git a/drivers/net/ethernet/intel/ice/ice_sched.c b/drivers/net/ethernet/intel/ice/ice_sched.c -index 908bcd07380333..c2de166f055150 100644 ---- a/drivers/net/ethernet/intel/ice/ice_sched.c -+++ b/drivers/net/ethernet/intel/ice/ice_sched.c -@@ -84,6 +84,27 @@ ice_sched_find_node_by_teid(struct ice_sched_node *start_node, u32 teid) - return NULL; - } - -+/** -+ * ice_sched_find_next_vsi_node - find the next node for a given VSI -+ * @vsi_node: VSI support node to start search with -+ * -+ * Return: Next VSI support node, or NULL. -+ * -+ * The function returns a pointer to the next node from the VSI layer -+ * assigned to the given VSI, or NULL if there is no such a node. -+ */ -+static struct ice_sched_node * -+ice_sched_find_next_vsi_node(struct ice_sched_node *vsi_node) -+{ -+ unsigned int vsi_handle = vsi_node->vsi_handle; -+ -+ while ((vsi_node = vsi_node->sibling) != NULL) -+ if (vsi_node->vsi_handle == vsi_handle) -+ break; -+ -+ return vsi_node; -+} -+ - /** - * ice_aqc_send_sched_elem_cmd - send scheduling elements cmd - * @hw: pointer to the HW struct -@@ -1096,8 +1117,10 @@ ice_sched_add_nodes_to_layer(struct ice_port_info *pi, - if (parent->num_children < max_child_nodes) { - new_num_nodes = max_child_nodes - parent->num_children; - } else { -- /* This parent is full, try the next sibling */ -- parent = parent->sibling; -+ /* This parent is full, -+ * try the next available sibling. -+ */ -+ parent = ice_sched_find_next_vsi_node(parent); - /* Don't modify the first node TEID memory if the - * first node was added already in the above call. - * Instead send some temp memory for all other -@@ -1538,12 +1561,23 @@ ice_sched_get_free_qparent(struct ice_port_info *pi, u16 vsi_handle, u8 tc, - /* get the first queue group node from VSI sub-tree */ - qgrp_node = ice_sched_get_first_node(pi, vsi_node, qgrp_layer); - while (qgrp_node) { -+ struct ice_sched_node *next_vsi_node; -+ - /* make sure the qgroup node is part of the VSI subtree */ - if (ice_sched_find_node_in_subtree(pi->hw, vsi_node, qgrp_node)) - if (qgrp_node->num_children < max_children && - qgrp_node->owner == owner) - break; - qgrp_node = qgrp_node->sibling; -+ if (qgrp_node) -+ continue; -+ -+ next_vsi_node = ice_sched_find_next_vsi_node(vsi_node); -+ if (!next_vsi_node) -+ break; -+ -+ vsi_node = next_vsi_node; -+ qgrp_node = ice_sched_get_first_node(pi, vsi_node, qgrp_layer); - } - - /* Select the best queue group */ -@@ -1614,16 +1648,16 @@ ice_sched_get_agg_node(struct ice_port_info *pi, struct ice_sched_node *tc_node, - /** - * ice_sched_calc_vsi_child_nodes - calculate number of VSI child nodes - * @hw: pointer to the HW struct -- * @num_qs: number of queues -+ * @num_new_qs: number of new queues that will be added to the tree - * @num_nodes: num nodes array - * - * This function calculates the number of VSI child nodes based on the - * number of queues. - */ - static void --ice_sched_calc_vsi_child_nodes(struct ice_hw *hw, u16 num_qs, u16 *num_nodes) -+ice_sched_calc_vsi_child_nodes(struct ice_hw *hw, u16 num_new_qs, u16 *num_nodes) - { -- u16 num = num_qs; -+ u16 num = num_new_qs; - u8 i, qgl, vsil; - - qgl = ice_sched_get_qgrp_layer(hw); -@@ -1789,7 +1823,11 @@ ice_sched_add_vsi_support_nodes(struct ice_port_info *pi, u16 vsi_handle, - if (!parent) - return -EIO; - -- if (i == vsil) -+ /* Do not modify the VSI handle for already existing VSI nodes, -+ * (if no new VSI node was added to the tree). -+ * Assign the VSI handle only to newly added VSI nodes. -+ */ -+ if (i == vsil && num_added) - parent->vsi_handle = vsi_handle; - } - -@@ -1822,6 +1860,41 @@ ice_sched_add_vsi_to_topo(struct ice_port_info *pi, u16 vsi_handle, u8 tc) - num_nodes); - } - -+/** -+ * ice_sched_recalc_vsi_support_nodes - recalculate VSI support nodes count -+ * @hw: pointer to the HW struct -+ * @vsi_node: pointer to the leftmost VSI node that needs to be extended -+ * @new_numqs: new number of queues that has to be handled by the VSI -+ * @new_num_nodes: pointer to nodes count table to modify the VSI layer entry -+ * -+ * This function recalculates the number of supported nodes that need to -+ * be added after adding more Tx queues for a given VSI. -+ * The number of new VSI support nodes that shall be added will be saved -+ * to the @new_num_nodes table for the VSI layer. -+ */ -+static void -+ice_sched_recalc_vsi_support_nodes(struct ice_hw *hw, -+ struct ice_sched_node *vsi_node, -+ unsigned int new_numqs, u16 *new_num_nodes) -+{ -+ u32 vsi_nodes_cnt = 1; -+ u32 max_queue_cnt = 1; -+ u32 qgl, vsil; -+ -+ qgl = ice_sched_get_qgrp_layer(hw); -+ vsil = ice_sched_get_vsi_layer(hw); -+ -+ for (u32 i = vsil; i <= qgl; i++) -+ max_queue_cnt *= hw->max_children[i]; -+ -+ while ((vsi_node = ice_sched_find_next_vsi_node(vsi_node)) != NULL) -+ vsi_nodes_cnt++; -+ -+ if (new_numqs > (max_queue_cnt * vsi_nodes_cnt)) -+ new_num_nodes[vsil] = DIV_ROUND_UP(new_numqs, max_queue_cnt) - -+ vsi_nodes_cnt; -+} -+ - /** - * ice_sched_update_vsi_child_nodes - update VSI child nodes - * @pi: port information structure -@@ -1873,15 +1946,25 @@ ice_sched_update_vsi_child_nodes(struct ice_port_info *pi, u16 vsi_handle, - return status; - } - -- if (new_numqs) -- ice_sched_calc_vsi_child_nodes(hw, new_numqs, new_num_nodes); -- /* Keep the max number of queue configuration all the time. Update the -- * tree only if number of queues > previous number of queues. This may -+ ice_sched_recalc_vsi_support_nodes(hw, vsi_node, -+ new_numqs, new_num_nodes); -+ ice_sched_calc_vsi_child_nodes(hw, new_numqs - prev_numqs, -+ new_num_nodes); -+ -+ /* Never decrease the number of queues in the tree. Update the tree -+ * only if number of queues > previous number of queues. This may - * leave some extra nodes in the tree if number of queues < previous - * number but that wouldn't harm anything. Removing those extra nodes - * may complicate the code if those nodes are part of SRL or - * individually rate limited. -+ * Also, add the required VSI support nodes if the existing ones cannot -+ * handle the requested new number of queues. - */ -+ status = ice_sched_add_vsi_support_nodes(pi, vsi_handle, tc_node, -+ new_num_nodes); -+ if (status) -+ return status; -+ - status = ice_sched_add_vsi_child_nodes(pi, vsi_handle, tc_node, - new_num_nodes, owner); - if (status) -@@ -2022,6 +2105,58 @@ static bool ice_sched_is_leaf_node_present(struct ice_sched_node *node) - return (node->info.data.elem_type == ICE_AQC_ELEM_TYPE_LEAF); - } - -+/** -+ * ice_sched_rm_vsi_subtree - remove all nodes assigned to a given VSI -+ * @pi: port information structure -+ * @vsi_node: pointer to the leftmost node of the VSI to be removed -+ * @owner: LAN or RDMA -+ * @tc: TC number -+ * -+ * Return: Zero in case of success, or -EBUSY if the VSI has leaf nodes in TC. -+ * -+ * This function removes all the VSI support nodes associated with a given VSI -+ * and its LAN or RDMA children nodes from the scheduler tree. -+ */ -+static int -+ice_sched_rm_vsi_subtree(struct ice_port_info *pi, -+ struct ice_sched_node *vsi_node, u8 owner, u8 tc) -+{ -+ u16 vsi_handle = vsi_node->vsi_handle; -+ bool all_vsi_nodes_removed = true; -+ int j = 0; -+ -+ while (vsi_node) { -+ struct ice_sched_node *next_vsi_node; -+ -+ if (ice_sched_is_leaf_node_present(vsi_node)) { -+ ice_debug(pi->hw, ICE_DBG_SCHED, "VSI has leaf nodes in TC %d\n", tc); -+ return -EBUSY; -+ } -+ while (j < vsi_node->num_children) { -+ if (vsi_node->children[j]->owner == owner) -+ ice_free_sched_node(pi, vsi_node->children[j]); -+ else -+ j++; -+ } -+ -+ next_vsi_node = ice_sched_find_next_vsi_node(vsi_node); -+ -+ /* remove the VSI if it has no children */ -+ if (!vsi_node->num_children) -+ ice_free_sched_node(pi, vsi_node); -+ else -+ all_vsi_nodes_removed = false; -+ -+ vsi_node = next_vsi_node; -+ } -+ -+ /* clean up aggregator related VSI info if any */ -+ if (all_vsi_nodes_removed) -+ ice_sched_rm_agg_vsi_info(pi, vsi_handle); -+ -+ return 0; -+} -+ - /** - * ice_sched_rm_vsi_cfg - remove the VSI and its children nodes - * @pi: port information structure -@@ -2048,7 +2183,6 @@ ice_sched_rm_vsi_cfg(struct ice_port_info *pi, u16 vsi_handle, u8 owner) - - ice_for_each_traffic_class(i) { - struct ice_sched_node *vsi_node, *tc_node; -- u8 j = 0; - - tc_node = ice_sched_get_tc_node(pi, i); - if (!tc_node) -@@ -2058,31 +2192,12 @@ ice_sched_rm_vsi_cfg(struct ice_port_info *pi, u16 vsi_handle, u8 owner) - if (!vsi_node) - continue; - -- if (ice_sched_is_leaf_node_present(vsi_node)) { -- ice_debug(pi->hw, ICE_DBG_SCHED, "VSI has leaf nodes in TC %d\n", i); -- status = -EBUSY; -+ status = ice_sched_rm_vsi_subtree(pi, vsi_node, owner, i); -+ if (status) - goto exit_sched_rm_vsi_cfg; -- } -- while (j < vsi_node->num_children) { -- if (vsi_node->children[j]->owner == owner) { -- ice_free_sched_node(pi, vsi_node->children[j]); - -- /* reset the counter again since the num -- * children will be updated after node removal -- */ -- j = 0; -- } else { -- j++; -- } -- } -- /* remove the VSI if it has no children */ -- if (!vsi_node->num_children) { -- ice_free_sched_node(pi, vsi_node); -- vsi_ctx->sched.vsi_node[i] = NULL; -+ vsi_ctx->sched.vsi_node[i] = NULL; - -- /* clean up aggregator related VSI info if any */ -- ice_sched_rm_agg_vsi_info(pi, vsi_handle); -- } - if (owner == ICE_SCHED_NODE_OWNER_LAN) - vsi_ctx->sched.max_lanq[i] = 0; - else -diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/qos.c b/drivers/net/ethernet/marvell/octeontx2/nic/qos.c -index 37db19584c1431..92861f102590fe 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/nic/qos.c -+++ b/drivers/net/ethernet/marvell/octeontx2/nic/qos.c -@@ -1560,6 +1560,7 @@ static int otx2_qos_leaf_del_last(struct otx2_nic *pfvf, u16 classid, bool force - if (!node->is_static) - dwrr_del_node = true; - -+ WRITE_ONCE(node->qid, OTX2_QOS_QID_INNER); - /* destroy the leaf node */ - otx2_qos_disable_sq(pfvf, qid); - otx2_qos_destroy_node(pfvf, node); -@@ -1604,9 +1605,6 @@ static int otx2_qos_leaf_del_last(struct otx2_nic *pfvf, u16 classid, bool force - } - kfree(new_cfg); - -- /* update tx_real_queues */ -- otx2_qos_update_tx_netdev_queues(pfvf); -- - return 0; - } - -diff --git a/drivers/net/ethernet/mediatek/mtk_star_emac.c b/drivers/net/ethernet/mediatek/mtk_star_emac.c -index c2ab87828d8589..5eb7a97e7eb177 100644 ---- a/drivers/net/ethernet/mediatek/mtk_star_emac.c -+++ b/drivers/net/ethernet/mediatek/mtk_star_emac.c -@@ -1468,6 +1468,8 @@ static __maybe_unused int mtk_star_suspend(struct device *dev) - if (netif_running(ndev)) - mtk_star_disable(ndev); - -+ netif_device_detach(ndev); -+ - clk_bulk_disable_unprepare(MTK_STAR_NCLKS, priv->clks); - - return 0; -@@ -1492,6 +1494,8 @@ static __maybe_unused int mtk_star_resume(struct device *dev) - clk_bulk_disable_unprepare(MTK_STAR_NCLKS, priv->clks); - } - -+ netif_device_attach(ndev); -+ - return ret; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx4/en_clock.c b/drivers/net/ethernet/mellanox/mlx4/en_clock.c -index 9e3b761820881e..2d5b86207e0795 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/en_clock.c -+++ b/drivers/net/ethernet/mellanox/mlx4/en_clock.c -@@ -249,7 +249,7 @@ static const struct ptp_clock_info mlx4_en_ptp_clock_info = { - static u32 freq_to_shift(u16 freq) - { - u32 freq_khz = freq * 1000; -- u64 max_val_cycles = freq_khz * 1000 * MLX4_EN_WRAP_AROUND_SEC; -+ u64 max_val_cycles = freq_khz * 1000ULL * MLX4_EN_WRAP_AROUND_SEC; - u64 max_val_cycles_rounded = 1ULL << fls64(max_val_cycles - 1); - /* calculate max possible multiplier in order to fit in 64bit */ - u64 max_mul = div64_u64(ULLONG_MAX, max_val_cycles_rounded); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -index 463c23ae0ad1ec..5161bf51fa110c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -@@ -1093,7 +1093,7 @@ mlx5e_ipsec_build_accel_pol_attrs(struct mlx5e_ipsec_pol_entry *pol_entry, - static int mlx5e_xfrm_add_policy(struct xfrm_policy *x, - struct netlink_ext_ack *extack) - { -- struct net_device *netdev = x->xdo.real_dev; -+ struct net_device *netdev = x->xdo.dev; - struct mlx5e_ipsec_pol_entry *pol_entry; - struct mlx5e_priv *priv; - int err; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -index dc9b157a449935..2be9c69daad5fe 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -@@ -1915,9 +1915,8 @@ mlx5e_tc_add_fdb_flow(struct mlx5e_priv *priv, - return err; - } - --static bool mlx5_flow_has_geneve_opt(struct mlx5e_tc_flow *flow) -+static bool mlx5_flow_has_geneve_opt(struct mlx5_flow_spec *spec) - { -- struct mlx5_flow_spec *spec = &flow->attr->parse_attr->spec; - void *headers_v = MLX5_ADDR_OF(fte_match_param, - spec->match_value, - misc_parameters_3); -@@ -1956,7 +1955,7 @@ static void mlx5e_tc_del_fdb_flow(struct mlx5e_priv *priv, - } - complete_all(&flow->del_hw_done); - -- if (mlx5_flow_has_geneve_opt(flow)) -+ if (mlx5_flow_has_geneve_opt(&attr->parse_attr->spec)) - mlx5_geneve_tlv_option_del(priv->mdev->geneve); - - if (flow->decap_route) -@@ -2456,12 +2455,13 @@ static int parse_tunnel_attr(struct mlx5e_priv *priv, - - err = mlx5e_tc_tun_parse(filter_dev, priv, tmp_spec, f, match_level); - if (err) { -- kvfree(tmp_spec); - NL_SET_ERR_MSG_MOD(extack, "Failed to parse tunnel attributes"); - netdev_warn(priv->netdev, "Failed to parse tunnel attributes"); -- return err; -+ } else { -+ err = mlx5e_tc_set_attr_rx_tun(flow, tmp_spec); - } -- err = mlx5e_tc_set_attr_rx_tun(flow, tmp_spec); -+ if (mlx5_flow_has_geneve_opt(tmp_spec)) -+ mlx5_geneve_tlv_option_del(priv->mdev->geneve); - kvfree(tmp_spec); - if (err) - return err; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -index f6022c135ec023..914b380fd3eeb5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -@@ -1295,12 +1295,15 @@ mlx5_eswitch_enable_pf_vf_vports(struct mlx5_eswitch *esw, - ret = mlx5_eswitch_load_pf_vf_vport(esw, MLX5_VPORT_ECPF, enabled_events); - if (ret) - goto ecpf_err; -- if (mlx5_core_ec_sriov_enabled(esw->dev)) { -- ret = mlx5_eswitch_load_ec_vf_vports(esw, esw->esw_funcs.num_ec_vfs, -- enabled_events); -- if (ret) -- goto ec_vf_err; -- } -+ } -+ -+ /* Enable ECVF vports */ -+ if (mlx5_core_ec_sriov_enabled(esw->dev)) { -+ ret = mlx5_eswitch_load_ec_vf_vports(esw, -+ esw->esw_funcs.num_ec_vfs, -+ enabled_events); -+ if (ret) -+ goto ec_vf_err; - } - - /* Enable VF vports */ -@@ -1331,9 +1334,11 @@ void mlx5_eswitch_disable_pf_vf_vports(struct mlx5_eswitch *esw) - { - mlx5_eswitch_unload_vf_vports(esw, esw->esw_funcs.num_vfs); - -+ if (mlx5_core_ec_sriov_enabled(esw->dev)) -+ mlx5_eswitch_unload_ec_vf_vports(esw, -+ esw->esw_funcs.num_ec_vfs); -+ - if (mlx5_ecpf_vport_exists(esw->dev)) { -- if (mlx5_core_ec_sriov_enabled(esw->dev)) -- mlx5_eswitch_unload_ec_vf_vports(esw, esw->esw_funcs.num_vfs); - mlx5_eswitch_unload_pf_vf_vport(esw, MLX5_VPORT_ECPF); - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -index d2dc375f5e49cb..5f35a6fc030544 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -@@ -1984,6 +1984,7 @@ try_add_to_existing_fg(struct mlx5_flow_table *ft, - struct mlx5_flow_handle *rule; - struct match_list *iter; - bool take_write = false; -+ bool try_again = false; - struct fs_fte *fte; - u64 version = 0; - int err; -@@ -2043,6 +2044,7 @@ try_add_to_existing_fg(struct mlx5_flow_table *ft, - nested_down_write_ref_node(&g->node, FS_LOCK_PARENT); - - if (!g->node.active) { -+ try_again = true; - up_write_ref_node(&g->node, false); - continue; - } -@@ -2064,7 +2066,8 @@ try_add_to_existing_fg(struct mlx5_flow_table *ft, - tree_put_node(&fte->node, false); - return rule; - } -- rule = ERR_PTR(-ENOENT); -+ err = try_again ? -EAGAIN : -ENOENT; -+ rule = ERR_PTR(err); - out: - kmem_cache_free(steering->ftes_cache, fte); - return rule; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c -index dcf58efac159cf..e0581c6f9cecd5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c -@@ -291,7 +291,7 @@ static void free_4k(struct mlx5_core_dev *dev, u64 addr, u32 function) - static int alloc_system_page(struct mlx5_core_dev *dev, u32 function) - { - struct device *device = mlx5_core_dma_dev(dev); -- int nid = dev_to_node(device); -+ int nid = dev->priv.numa_node; - struct page *page; - u64 zero_addr = 1; - u64 addr; -diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c -index f971d60484f065..781440d5756f34 100644 ---- a/drivers/net/ethernet/microchip/lan743x_main.c -+++ b/drivers/net/ethernet/microchip/lan743x_main.c -@@ -1373,7 +1373,7 @@ static int lan743x_mac_set_mtu(struct lan743x_adapter *adapter, int new_mtu) - } - - /* PHY */ --static int lan743x_phy_reset(struct lan743x_adapter *adapter) -+static int lan743x_hw_reset_phy(struct lan743x_adapter *adapter) - { - u32 data; - -@@ -1407,7 +1407,7 @@ static void lan743x_phy_update_flowcontrol(struct lan743x_adapter *adapter, - - static int lan743x_phy_init(struct lan743x_adapter *adapter) - { -- return lan743x_phy_reset(adapter); -+ return lan743x_hw_reset_phy(adapter); - } - - static void lan743x_phy_link_status_change(struct net_device *netdev) -diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_main.c b/drivers/net/ethernet/microchip/lan966x/lan966x_main.c -index c3f6c10bc23936..b424e75fd40c46 100644 ---- a/drivers/net/ethernet/microchip/lan966x/lan966x_main.c -+++ b/drivers/net/ethernet/microchip/lan966x/lan966x_main.c -@@ -353,6 +353,11 @@ static void lan966x_ifh_set_rew_op(void *ifh, u64 rew_op) - lan966x_ifh_set(ifh, rew_op, IFH_POS_REW_CMD, IFH_WID_REW_CMD); - } - -+static void lan966x_ifh_set_oam_type(void *ifh, u64 oam_type) -+{ -+ lan966x_ifh_set(ifh, oam_type, IFH_POS_PDU_TYPE, IFH_WID_PDU_TYPE); -+} -+ - static void lan966x_ifh_set_timestamp(void *ifh, u64 timestamp) - { - lan966x_ifh_set(ifh, timestamp, IFH_POS_TIMESTAMP, IFH_WID_TIMESTAMP); -@@ -380,6 +385,7 @@ static netdev_tx_t lan966x_port_xmit(struct sk_buff *skb, - return err; - - lan966x_ifh_set_rew_op(ifh, LAN966X_SKB_CB(skb)->rew_op); -+ lan966x_ifh_set_oam_type(ifh, LAN966X_SKB_CB(skb)->pdu_type); - lan966x_ifh_set_timestamp(ifh, LAN966X_SKB_CB(skb)->ts_id); - } - -@@ -875,6 +881,7 @@ static int lan966x_probe_port(struct lan966x *lan966x, u32 p, - lan966x_vlan_port_set_vlan_aware(port, 0); - lan966x_vlan_port_set_vid(port, HOST_PVID, false, false); - lan966x_vlan_port_apply(port); -+ lan966x_vlan_port_rew_host(port); - - return 0; - } -diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_main.h b/drivers/net/ethernet/microchip/lan966x/lan966x_main.h -index caa9e0533c96b3..5a16d76eb000d6 100644 ---- a/drivers/net/ethernet/microchip/lan966x/lan966x_main.h -+++ b/drivers/net/ethernet/microchip/lan966x/lan966x_main.h -@@ -74,6 +74,10 @@ - #define IFH_REW_OP_ONE_STEP_PTP 0x3 - #define IFH_REW_OP_TWO_STEP_PTP 0x4 - -+#define IFH_PDU_TYPE_NONE 0 -+#define IFH_PDU_TYPE_IPV4 7 -+#define IFH_PDU_TYPE_IPV6 8 -+ - #define FDMA_RX_DCB_MAX_DBS 1 - #define FDMA_TX_DCB_MAX_DBS 1 - #define FDMA_DCB_INFO_DATAL(x) ((x) & GENMASK(15, 0)) -@@ -306,6 +310,7 @@ struct lan966x_phc { - - struct lan966x_skb_cb { - u8 rew_op; -+ u8 pdu_type; - u16 ts_id; - unsigned long jiffies; - }; -@@ -544,6 +549,7 @@ void lan966x_vlan_port_apply(struct lan966x_port *port); - bool lan966x_vlan_cpu_member_cpu_vlan_mask(struct lan966x *lan966x, u16 vid); - void lan966x_vlan_port_set_vlan_aware(struct lan966x_port *port, - bool vlan_aware); -+void lan966x_vlan_port_rew_host(struct lan966x_port *port); - int lan966x_vlan_port_set_vid(struct lan966x_port *port, - u16 vid, - bool pvid, -diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c b/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c -index 63905bb5a63a83..87e5e81d40dc68 100644 ---- a/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c -+++ b/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c -@@ -322,34 +322,55 @@ void lan966x_ptp_hwtstamp_get(struct lan966x_port *port, - *cfg = phc->hwtstamp_config; - } - --static int lan966x_ptp_classify(struct lan966x_port *port, struct sk_buff *skb) -+static void lan966x_ptp_classify(struct lan966x_port *port, struct sk_buff *skb, -+ u8 *rew_op, u8 *pdu_type) - { - struct ptp_header *header; - u8 msgtype; - int type; - -- if (port->ptp_tx_cmd == IFH_REW_OP_NOOP) -- return IFH_REW_OP_NOOP; -+ if (port->ptp_tx_cmd == IFH_REW_OP_NOOP) { -+ *rew_op = IFH_REW_OP_NOOP; -+ *pdu_type = IFH_PDU_TYPE_NONE; -+ return; -+ } - - type = ptp_classify_raw(skb); -- if (type == PTP_CLASS_NONE) -- return IFH_REW_OP_NOOP; -+ if (type == PTP_CLASS_NONE) { -+ *rew_op = IFH_REW_OP_NOOP; -+ *pdu_type = IFH_PDU_TYPE_NONE; -+ return; -+ } - - header = ptp_parse_header(skb, type); -- if (!header) -- return IFH_REW_OP_NOOP; -+ if (!header) { -+ *rew_op = IFH_REW_OP_NOOP; -+ *pdu_type = IFH_PDU_TYPE_NONE; -+ return; -+ } - -- if (port->ptp_tx_cmd == IFH_REW_OP_TWO_STEP_PTP) -- return IFH_REW_OP_TWO_STEP_PTP; -+ if (type & PTP_CLASS_L2) -+ *pdu_type = IFH_PDU_TYPE_NONE; -+ if (type & PTP_CLASS_IPV4) -+ *pdu_type = IFH_PDU_TYPE_IPV4; -+ if (type & PTP_CLASS_IPV6) -+ *pdu_type = IFH_PDU_TYPE_IPV6; -+ -+ if (port->ptp_tx_cmd == IFH_REW_OP_TWO_STEP_PTP) { -+ *rew_op = IFH_REW_OP_TWO_STEP_PTP; -+ return; -+ } - - /* If it is sync and run 1 step then set the correct operation, - * otherwise run as 2 step - */ - msgtype = ptp_get_msgtype(header, type); -- if ((msgtype & 0xf) == 0) -- return IFH_REW_OP_ONE_STEP_PTP; -+ if ((msgtype & 0xf) == 0) { -+ *rew_op = IFH_REW_OP_ONE_STEP_PTP; -+ return; -+ } - -- return IFH_REW_OP_TWO_STEP_PTP; -+ *rew_op = IFH_REW_OP_TWO_STEP_PTP; - } - - static void lan966x_ptp_txtstamp_old_release(struct lan966x_port *port) -@@ -374,10 +395,12 @@ int lan966x_ptp_txtstamp_request(struct lan966x_port *port, - { - struct lan966x *lan966x = port->lan966x; - unsigned long flags; -+ u8 pdu_type; - u8 rew_op; - -- rew_op = lan966x_ptp_classify(port, skb); -+ lan966x_ptp_classify(port, skb, &rew_op, &pdu_type); - LAN966X_SKB_CB(skb)->rew_op = rew_op; -+ LAN966X_SKB_CB(skb)->pdu_type = pdu_type; - - if (rew_op != IFH_REW_OP_TWO_STEP_PTP) - return 0; -diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_switchdev.c b/drivers/net/ethernet/microchip/lan966x/lan966x_switchdev.c -index 1c88120eb291a2..bcb4db76b75cd5 100644 ---- a/drivers/net/ethernet/microchip/lan966x/lan966x_switchdev.c -+++ b/drivers/net/ethernet/microchip/lan966x/lan966x_switchdev.c -@@ -297,6 +297,7 @@ static void lan966x_port_bridge_leave(struct lan966x_port *port, - lan966x_vlan_port_set_vlan_aware(port, false); - lan966x_vlan_port_set_vid(port, HOST_PVID, false, false); - lan966x_vlan_port_apply(port); -+ lan966x_vlan_port_rew_host(port); - } - - int lan966x_port_changeupper(struct net_device *dev, -diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_vlan.c b/drivers/net/ethernet/microchip/lan966x/lan966x_vlan.c -index 3c44660128daed..ffb245fb7d6786 100644 ---- a/drivers/net/ethernet/microchip/lan966x/lan966x_vlan.c -+++ b/drivers/net/ethernet/microchip/lan966x/lan966x_vlan.c -@@ -149,6 +149,27 @@ void lan966x_vlan_port_set_vlan_aware(struct lan966x_port *port, - port->vlan_aware = vlan_aware; - } - -+/* When the interface is in host mode, the interface should not be vlan aware -+ * but it should insert all the tags that it gets from the network stack. -+ * The tags are not in the data of the frame but actually in the skb and the ifh -+ * is configured already to get this tag. So what we need to do is to update the -+ * rewriter to insert the vlan tag for all frames which have a vlan tag -+ * different than 0. -+ */ -+void lan966x_vlan_port_rew_host(struct lan966x_port *port) -+{ -+ struct lan966x *lan966x = port->lan966x; -+ u32 val; -+ -+ /* Tag all frames except when VID=0*/ -+ val = REW_TAG_CFG_TAG_CFG_SET(2); -+ -+ /* Update only some bits in the register */ -+ lan_rmw(val, -+ REW_TAG_CFG_TAG_CFG, -+ lan966x, REW_TAG_CFG(port->chip_port)); -+} -+ - void lan966x_vlan_port_apply(struct lan966x_port *port) - { - struct lan966x *lan966x = port->lan966x; -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index d3d5c01f6dcbaa..615d25a0e46be5 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -842,6 +842,11 @@ int stmmac_init_tstamp_counter(struct stmmac_priv *priv, u32 systime_flags) - if (!(priv->dma_cap.time_stamp || priv->dma_cap.atime_stamp)) - return -EOPNOTSUPP; - -+ if (!priv->plat->clk_ptp_rate) { -+ netdev_err(priv->dev, "Invalid PTP clock rate"); -+ return -EINVAL; -+ } -+ - stmmac_config_hw_tstamping(priv, priv->ptpaddr, systime_flags); - priv->systime_flags = systime_flags; - -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c -index 4d570efd9d4bbe..6c684f6ee84be9 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c -@@ -419,6 +419,7 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) - struct device_node *np = pdev->dev.of_node; - struct plat_stmmacenet_data *plat; - struct stmmac_dma_cfg *dma_cfg; -+ static int bus_id = -ENODEV; - int phy_mode; - void *ret; - int rc; -@@ -454,8 +455,14 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) - of_property_read_u32(np, "max-speed", &plat->max_speed); - - plat->bus_id = of_alias_get_id(np, "ethernet"); -- if (plat->bus_id < 0) -- plat->bus_id = 0; -+ if (plat->bus_id < 0) { -+ if (bus_id < 0) -+ bus_id = of_alias_get_highest_id("ethernet"); -+ /* No ethernet alias found, init at -1 so first bus_id is 0 */ -+ if (bus_id < 0) -+ bus_id = -1; -+ plat->bus_id = ++bus_id; -+ } - - /* Default to phy auto-detection */ - plat->phy_addr = -1; -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c -index a04bb2e42c4ee1..80ecbd73333d9c 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c -@@ -295,7 +295,7 @@ void stmmac_ptp_register(struct stmmac_priv *priv) - - /* Calculate the clock domain crossing (CDC) error if necessary */ - priv->plat->cdc_error_adj = 0; -- if (priv->plat->has_gmac4 && priv->plat->clk_ptp_rate) -+ if (priv->plat->has_gmac4) - priv->plat->cdc_error_adj = (2 * NSEC_PER_SEC) / priv->plat->clk_ptp_rate; - - stmmac_ptp_clock_ops.n_per_out = priv->dma_cap.pps_out_num; -diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c -index 7c96493a367bff..767053d6c6b6f9 100644 ---- a/drivers/net/macsec.c -+++ b/drivers/net/macsec.c -@@ -243,15 +243,39 @@ static sci_t make_sci(const u8 *addr, __be16 port) - return sci; - } - --static sci_t macsec_frame_sci(struct macsec_eth_header *hdr, bool sci_present) -+static sci_t macsec_active_sci(struct macsec_secy *secy) - { -- sci_t sci; -+ struct macsec_rx_sc *rx_sc = rcu_dereference_bh(secy->rx_sc); -+ -+ /* Case single RX SC */ -+ if (rx_sc && !rcu_dereference_bh(rx_sc->next)) -+ return (rx_sc->active) ? rx_sc->sci : 0; -+ /* Case no RX SC or multiple */ -+ else -+ return 0; -+} -+ -+static sci_t macsec_frame_sci(struct macsec_eth_header *hdr, bool sci_present, -+ struct macsec_rxh_data *rxd) -+{ -+ struct macsec_dev *macsec; -+ sci_t sci = 0; - -- if (sci_present) -+ /* SC = 1 */ -+ if (sci_present) { - memcpy(&sci, hdr->secure_channel_id, - sizeof(hdr->secure_channel_id)); -- else -+ /* SC = 0; ES = 0 */ -+ } else if ((!(hdr->tci_an & (MACSEC_TCI_ES | MACSEC_TCI_SC))) && -+ (list_is_singular(&rxd->secys))) { -+ /* Only one SECY should exist on this scenario */ -+ macsec = list_first_or_null_rcu(&rxd->secys, struct macsec_dev, -+ secys); -+ if (macsec) -+ return macsec_active_sci(&macsec->secy); -+ } else { - sci = make_sci(hdr->eth.h_source, MACSEC_PORT_ES); -+ } - - return sci; - } -@@ -1105,7 +1129,7 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) - struct macsec_rxh_data *rxd; - struct macsec_dev *macsec; - unsigned int len; -- sci_t sci; -+ sci_t sci = 0; - u32 hdr_pn; - bool cbit; - struct pcpu_rx_sc_stats *rxsc_stats; -@@ -1152,11 +1176,14 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) - - macsec_skb_cb(skb)->has_sci = !!(hdr->tci_an & MACSEC_TCI_SC); - macsec_skb_cb(skb)->assoc_num = hdr->tci_an & MACSEC_AN_MASK; -- sci = macsec_frame_sci(hdr, macsec_skb_cb(skb)->has_sci); - - rcu_read_lock(); - rxd = macsec_data_rcu(skb->dev); - -+ sci = macsec_frame_sci(hdr, macsec_skb_cb(skb)->has_sci, rxd); -+ if (!sci) -+ goto drop_nosc; -+ - list_for_each_entry_rcu(macsec, &rxd->secys, secys) { - struct macsec_rx_sc *sc = find_rx_sc(&macsec->secy, sci); - -@@ -1279,6 +1306,7 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) - macsec_rxsa_put(rx_sa); - drop_nosa: - macsec_rxsc_put(rx_sc); -+drop_nosc: - rcu_read_unlock(); - drop_direct: - kfree_skb(skb); -diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c -index 25dcaa49ab8be9..e02706b7cc1ed6 100644 ---- a/drivers/net/phy/mdio_bus.c -+++ b/drivers/net/phy/mdio_bus.c -@@ -850,6 +850,9 @@ int __mdiobus_read(struct mii_bus *bus, int addr, u32 regnum) - - lockdep_assert_held_once(&bus->mdio_lock); - -+ if (addr >= PHY_MAX_ADDR) -+ return -ENXIO; -+ - if (bus->read) - retval = bus->read(bus, addr, regnum); - else -@@ -879,6 +882,9 @@ int __mdiobus_write(struct mii_bus *bus, int addr, u32 regnum, u16 val) - - lockdep_assert_held_once(&bus->mdio_lock); - -+ if (addr >= PHY_MAX_ADDR) -+ return -ENXIO; -+ - if (bus->write) - err = bus->write(bus, addr, regnum, val); - else -@@ -940,6 +946,9 @@ int __mdiobus_c45_read(struct mii_bus *bus, int addr, int devad, u32 regnum) - - lockdep_assert_held_once(&bus->mdio_lock); - -+ if (addr >= PHY_MAX_ADDR) -+ return -ENXIO; -+ - if (bus->read_c45) - retval = bus->read_c45(bus, addr, devad, regnum); - else -@@ -971,6 +980,9 @@ int __mdiobus_c45_write(struct mii_bus *bus, int addr, int devad, u32 regnum, - - lockdep_assert_held_once(&bus->mdio_lock); - -+ if (addr >= PHY_MAX_ADDR) -+ return -ENXIO; -+ - if (bus->write_c45) - err = bus->write_c45(bus, addr, devad, regnum, val); - else -diff --git a/drivers/net/phy/mscc/mscc_ptp.c b/drivers/net/phy/mscc/mscc_ptp.c -index cf728bfd83e22c..7e7ce79eadffb9 100644 ---- a/drivers/net/phy/mscc/mscc_ptp.c -+++ b/drivers/net/phy/mscc/mscc_ptp.c -@@ -943,7 +943,9 @@ static int vsc85xx_ip1_conf(struct phy_device *phydev, enum ts_blk blk, - /* UDP checksum offset in IPv4 packet - * according to: https://tools.ietf.org/html/rfc768 - */ -- val |= IP1_NXT_PROT_UDP_CHKSUM_OFF(26) | IP1_NXT_PROT_UDP_CHKSUM_CLEAR; -+ val |= IP1_NXT_PROT_UDP_CHKSUM_OFF(26); -+ if (enable) -+ val |= IP1_NXT_PROT_UDP_CHKSUM_CLEAR; - vsc85xx_ts_write_csr(phydev, blk, MSCC_ANA_IP1_NXT_PROT_UDP_CHKSUM, - val); - -@@ -1165,18 +1167,24 @@ static void vsc85xx_txtstamp(struct mii_timestamper *mii_ts, - container_of(mii_ts, struct vsc8531_private, mii_ts); - - if (!vsc8531->ptp->configured) -- return; -+ goto out; - -- if (vsc8531->ptp->tx_type == HWTSTAMP_TX_OFF) { -- kfree_skb(skb); -- return; -- } -+ if (vsc8531->ptp->tx_type == HWTSTAMP_TX_OFF) -+ goto out; -+ -+ if (vsc8531->ptp->tx_type == HWTSTAMP_TX_ONESTEP_SYNC) -+ if (ptp_msg_is_sync(skb, type)) -+ goto out; - - skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS; - - mutex_lock(&vsc8531->ts_lock); - __skb_queue_tail(&vsc8531->ptp->tx_queue, skb); - mutex_unlock(&vsc8531->ts_lock); -+ return; -+ -+out: -+ kfree_skb(skb); - } - - static bool vsc85xx_rxtstamp(struct mii_timestamper *mii_ts, -diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c -index ec2a3d16b1a2da..cde0e80474a1de 100644 ---- a/drivers/net/phy/phy_device.c -+++ b/drivers/net/phy/phy_device.c -@@ -1806,8 +1806,10 @@ void phy_detach(struct phy_device *phydev) - struct module *ndev_owner = NULL; - struct mii_bus *bus; - -- if (phydev->devlink) -+ if (phydev->devlink) { - device_link_del(phydev->devlink); -+ phydev->devlink = NULL; -+ } - - if (phydev->sysfs_links) { - if (dev) -diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c -index 284375f662f1e0..3ebb1f84d30255 100644 ---- a/drivers/net/usb/aqc111.c -+++ b/drivers/net/usb/aqc111.c -@@ -30,11 +30,14 @@ static int aqc111_read_cmd_nopm(struct usbnet *dev, u8 cmd, u16 value, - ret = usbnet_read_cmd_nopm(dev, cmd, USB_DIR_IN | USB_TYPE_VENDOR | - USB_RECIP_DEVICE, value, index, data, size); - -- if (unlikely(ret < 0)) -+ if (unlikely(ret < size)) { - netdev_warn(dev->net, - "Failed to read(0x%x) reg index 0x%04x: %d\n", - cmd, index, ret); - -+ ret = ret < 0 ? ret : -ENODATA; -+ } -+ - return ret; - } - -@@ -46,11 +49,14 @@ static int aqc111_read_cmd(struct usbnet *dev, u8 cmd, u16 value, - ret = usbnet_read_cmd(dev, cmd, USB_DIR_IN | USB_TYPE_VENDOR | - USB_RECIP_DEVICE, value, index, data, size); - -- if (unlikely(ret < 0)) -+ if (unlikely(ret < size)) { - netdev_warn(dev->net, - "Failed to read(0x%x) reg index 0x%04x: %d\n", - cmd, index, ret); - -+ ret = ret < 0 ? ret : -ENODATA; -+ } -+ - return ret; - } - -diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c -index beebe09eb88ff3..afd78324f3aa39 100644 ---- a/drivers/net/vmxnet3/vmxnet3_drv.c -+++ b/drivers/net/vmxnet3/vmxnet3_drv.c -@@ -1499,6 +1499,30 @@ vmxnet3_get_hdr_len(struct vmxnet3_adapter *adapter, struct sk_buff *skb, - return (hlen + (hdr.tcp->doff << 2)); - } - -+static void -+vmxnet3_lro_tunnel(struct sk_buff *skb, __be16 ip_proto) -+{ -+ struct udphdr *uh = NULL; -+ -+ if (ip_proto == htons(ETH_P_IP)) { -+ struct iphdr *iph = (struct iphdr *)skb->data; -+ -+ if (iph->protocol == IPPROTO_UDP) -+ uh = (struct udphdr *)(iph + 1); -+ } else { -+ struct ipv6hdr *iph = (struct ipv6hdr *)skb->data; -+ -+ if (iph->nexthdr == IPPROTO_UDP) -+ uh = (struct udphdr *)(iph + 1); -+ } -+ if (uh) { -+ if (uh->check) -+ skb_shinfo(skb)->gso_type |= SKB_GSO_UDP_TUNNEL_CSUM; -+ else -+ skb_shinfo(skb)->gso_type |= SKB_GSO_UDP_TUNNEL; -+ } -+} -+ - static int - vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq, - struct vmxnet3_adapter *adapter, int quota) -@@ -1803,6 +1827,8 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq, - if (segCnt != 0 && mss != 0) { - skb_shinfo(skb)->gso_type = rcd->v4 ? - SKB_GSO_TCPV4 : SKB_GSO_TCPV6; -+ if (encap_lro) -+ vmxnet3_lro_tunnel(skb, skb->protocol); - skb_shinfo(skb)->gso_size = mss; - skb_shinfo(skb)->gso_segs = segCnt; - } else if ((segCnt != 0 || skb->len > mtu) && !encap_lro) { -diff --git a/drivers/net/wireguard/device.c b/drivers/net/wireguard/device.c -index deb9636b0ecf8f..f98e0f027a0542 100644 ---- a/drivers/net/wireguard/device.c -+++ b/drivers/net/wireguard/device.c -@@ -369,6 +369,7 @@ static int wg_newlink(struct net *src_net, struct net_device *dev, - if (ret < 0) - goto err_free_handshake_queue; - -+ dev_set_threaded(dev, true); - ret = register_netdevice(dev); - if (ret < 0) - goto err_uninit_ratelimiter; -diff --git a/drivers/net/wireless/ath/ath10k/snoc.c b/drivers/net/wireless/ath/ath10k/snoc.c -index 2c39bad7ebfb9a..1d06d4125992da 100644 ---- a/drivers/net/wireless/ath/ath10k/snoc.c -+++ b/drivers/net/wireless/ath/ath10k/snoc.c -@@ -937,7 +937,9 @@ static int ath10k_snoc_hif_start(struct ath10k *ar) - - dev_set_threaded(&ar->napi_dev, true); - ath10k_core_napi_enable(ar); -- ath10k_snoc_irq_enable(ar); -+ /* IRQs are left enabled when we restart due to a firmware crash */ -+ if (!test_bit(ATH10K_SNOC_FLAG_RECOVERY, &ar_snoc->flags)) -+ ath10k_snoc_irq_enable(ar); - ath10k_snoc_rx_post(ar); - - clear_bit(ATH10K_SNOC_FLAG_RECOVERY, &ar_snoc->flags); -diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c -index fc7c4564a715cf..609d8387c41f3e 100644 ---- a/drivers/net/wireless/ath/ath11k/core.c -+++ b/drivers/net/wireless/ath/ath11k/core.c -@@ -748,6 +748,7 @@ void ath11k_fw_stats_init(struct ath11k *ar) - INIT_LIST_HEAD(&ar->fw_stats.bcn); - - init_completion(&ar->fw_stats_complete); -+ init_completion(&ar->fw_stats_done); - } - - void ath11k_fw_stats_free(struct ath11k_fw_stats *stats) -@@ -1637,6 +1638,20 @@ int ath11k_core_qmi_firmware_ready(struct ath11k_base *ab) - { - int ret; - -+ switch (ath11k_crypto_mode) { -+ case ATH11K_CRYPT_MODE_SW: -+ set_bit(ATH11K_FLAG_HW_CRYPTO_DISABLED, &ab->dev_flags); -+ set_bit(ATH11K_FLAG_RAW_MODE, &ab->dev_flags); -+ break; -+ case ATH11K_CRYPT_MODE_HW: -+ clear_bit(ATH11K_FLAG_HW_CRYPTO_DISABLED, &ab->dev_flags); -+ clear_bit(ATH11K_FLAG_RAW_MODE, &ab->dev_flags); -+ break; -+ default: -+ ath11k_info(ab, "invalid crypto_mode: %d\n", ath11k_crypto_mode); -+ return -EINVAL; -+ } -+ - ret = ath11k_core_start_firmware(ab, ab->fw_mode); - if (ret) { - ath11k_err(ab, "failed to start firmware: %d\n", ret); -@@ -1655,20 +1670,6 @@ int ath11k_core_qmi_firmware_ready(struct ath11k_base *ab) - goto err_firmware_stop; - } - -- switch (ath11k_crypto_mode) { -- case ATH11K_CRYPT_MODE_SW: -- set_bit(ATH11K_FLAG_HW_CRYPTO_DISABLED, &ab->dev_flags); -- set_bit(ATH11K_FLAG_RAW_MODE, &ab->dev_flags); -- break; -- case ATH11K_CRYPT_MODE_HW: -- clear_bit(ATH11K_FLAG_HW_CRYPTO_DISABLED, &ab->dev_flags); -- clear_bit(ATH11K_FLAG_RAW_MODE, &ab->dev_flags); -- break; -- default: -- ath11k_info(ab, "invalid crypto_mode: %d\n", ath11k_crypto_mode); -- return -EINVAL; -- } -- - if (ath11k_frame_mode == ATH11K_HW_TXRX_RAW) - set_bit(ATH11K_FLAG_RAW_MODE, &ab->dev_flags); - -@@ -1742,6 +1743,7 @@ static int ath11k_core_reconfigure_on_crash(struct ath11k_base *ab) - void ath11k_core_halt(struct ath11k *ar) - { - struct ath11k_base *ab = ar->ab; -+ struct list_head *pos, *n; - - lockdep_assert_held(&ar->conf_mutex); - -@@ -1756,7 +1758,12 @@ void ath11k_core_halt(struct ath11k *ar) - - rcu_assign_pointer(ab->pdevs_active[ar->pdev_idx], NULL); - synchronize_rcu(); -- INIT_LIST_HEAD(&ar->arvifs); -+ -+ spin_lock_bh(&ar->data_lock); -+ list_for_each_safe(pos, n, &ar->arvifs) -+ list_del_init(pos); -+ spin_unlock_bh(&ar->data_lock); -+ - idr_init(&ar->txmgmt_idr); - } - -diff --git a/drivers/net/wireless/ath/ath11k/core.h b/drivers/net/wireless/ath/ath11k/core.h -index b0444776248376..555deafd8399ac 100644 ---- a/drivers/net/wireless/ath/ath11k/core.h -+++ b/drivers/net/wireless/ath/ath11k/core.h -@@ -550,6 +550,8 @@ struct ath11k_fw_stats { - struct list_head pdevs; - struct list_head vdevs; - struct list_head bcn; -+ u32 num_vdev_recvd; -+ u32 num_bcn_recvd; - }; - - struct ath11k_dbg_htt_stats { -@@ -732,7 +734,7 @@ struct ath11k { - u8 alpha2[REG_ALPHA2_LEN + 1]; - struct ath11k_fw_stats fw_stats; - struct completion fw_stats_complete; -- bool fw_stats_done; -+ struct completion fw_stats_done; - - /* protected by conf_mutex */ - bool ps_state_enable; -diff --git a/drivers/net/wireless/ath/ath11k/debugfs.c b/drivers/net/wireless/ath/ath11k/debugfs.c -index 8cda73b78ebf41..50bc17127e68a3 100644 ---- a/drivers/net/wireless/ath/ath11k/debugfs.c -+++ b/drivers/net/wireless/ath/ath11k/debugfs.c -@@ -1,7 +1,7 @@ - // SPDX-License-Identifier: BSD-3-Clause-Clear - /* - * Copyright (c) 2018-2020 The Linux Foundation. All rights reserved. -- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved. -+ * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include -@@ -96,9 +96,10 @@ void ath11k_debugfs_add_dbring_entry(struct ath11k *ar, - static void ath11k_debugfs_fw_stats_reset(struct ath11k *ar) - { - spin_lock_bh(&ar->data_lock); -- ar->fw_stats_done = false; - ath11k_fw_stats_pdevs_free(&ar->fw_stats.pdevs); - ath11k_fw_stats_vdevs_free(&ar->fw_stats.vdevs); -+ ar->fw_stats.num_vdev_recvd = 0; -+ ar->fw_stats.num_bcn_recvd = 0; - spin_unlock_bh(&ar->data_lock); - } - -@@ -106,15 +107,14 @@ void ath11k_debugfs_fw_stats_process(struct ath11k *ar, struct ath11k_fw_stats * - { - struct ath11k_base *ab = ar->ab; - struct ath11k_pdev *pdev; -- bool is_end; -- static unsigned int num_vdev, num_bcn; -+ bool is_end = true; - size_t total_vdevs_started = 0; - int i; - - /* WMI_REQUEST_PDEV_STAT request has been already processed */ - - if (stats->stats_id == WMI_REQUEST_RSSI_PER_CHAIN_STAT) { -- ar->fw_stats_done = true; -+ complete(&ar->fw_stats_done); - return; - } - -@@ -132,15 +132,16 @@ void ath11k_debugfs_fw_stats_process(struct ath11k *ar, struct ath11k_fw_stats * - total_vdevs_started += ar->num_started_vdevs; - } - -- is_end = ((++num_vdev) == total_vdevs_started); -+ if (total_vdevs_started) -+ is_end = ((++ar->fw_stats.num_vdev_recvd) == -+ total_vdevs_started); - - list_splice_tail_init(&stats->vdevs, - &ar->fw_stats.vdevs); - -- if (is_end) { -- ar->fw_stats_done = true; -- num_vdev = 0; -- } -+ if (is_end) -+ complete(&ar->fw_stats_done); -+ - return; - } - -@@ -152,15 +153,15 @@ void ath11k_debugfs_fw_stats_process(struct ath11k *ar, struct ath11k_fw_stats * - /* Mark end until we reached the count of all started VDEVs - * within the PDEV - */ -- is_end = ((++num_bcn) == ar->num_started_vdevs); -+ if (ar->num_started_vdevs) -+ is_end = ((++ar->fw_stats.num_bcn_recvd) == -+ ar->num_started_vdevs); - - list_splice_tail_init(&stats->bcn, - &ar->fw_stats.bcn); - -- if (is_end) { -- ar->fw_stats_done = true; -- num_bcn = 0; -- } -+ if (is_end) -+ complete(&ar->fw_stats_done); - } - } - -@@ -168,21 +169,15 @@ static int ath11k_debugfs_fw_stats_request(struct ath11k *ar, - struct stats_request_params *req_param) - { - struct ath11k_base *ab = ar->ab; -- unsigned long timeout, time_left; -+ unsigned long time_left; - int ret; - - lockdep_assert_held(&ar->conf_mutex); - -- /* FW stats can get split when exceeding the stats data buffer limit. -- * In that case, since there is no end marking for the back-to-back -- * received 'update stats' event, we keep a 3 seconds timeout in case, -- * fw_stats_done is not marked yet -- */ -- timeout = jiffies + msecs_to_jiffies(3 * 1000); -- - ath11k_debugfs_fw_stats_reset(ar); - - reinit_completion(&ar->fw_stats_complete); -+ reinit_completion(&ar->fw_stats_done); - - ret = ath11k_wmi_send_stats_request_cmd(ar, req_param); - -@@ -193,21 +188,18 @@ static int ath11k_debugfs_fw_stats_request(struct ath11k *ar, - } - - time_left = wait_for_completion_timeout(&ar->fw_stats_complete, 1 * HZ); -- - if (!time_left) - return -ETIMEDOUT; - -- for (;;) { -- if (time_after(jiffies, timeout)) -- break; -+ /* FW stats can get split when exceeding the stats data buffer limit. -+ * In that case, since there is no end marking for the back-to-back -+ * received 'update stats' event, we keep a 3 seconds timeout in case, -+ * fw_stats_done is not marked yet -+ */ -+ time_left = wait_for_completion_timeout(&ar->fw_stats_done, 3 * HZ); -+ if (!time_left) -+ return -ETIMEDOUT; - -- spin_lock_bh(&ar->data_lock); -- if (ar->fw_stats_done) { -- spin_unlock_bh(&ar->data_lock); -- break; -- } -- spin_unlock_bh(&ar->data_lock); -- } - return 0; - } - -@@ -980,7 +972,7 @@ int ath11k_debugfs_pdev_create(struct ath11k_base *ab) - debugfs_create_file("simulate_fw_crash", 0600, ab->debugfs_soc, ab, - &fops_simulate_fw_crash); - -- debugfs_create_file("soc_dp_stats", 0600, ab->debugfs_soc, ab, -+ debugfs_create_file("soc_dp_stats", 0400, ab->debugfs_soc, ab, - &fops_soc_dp_stats); - - if (ab->hw_params.sram_dump.start != 0) -diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c -index 4247c0f840a482..9df3f6449f7689 100644 ---- a/drivers/net/wireless/ath/ath11k/mac.c -+++ b/drivers/net/wireless/ath/ath11k/mac.c -@@ -9010,11 +9010,13 @@ static int ath11k_fw_stats_request(struct ath11k *ar, - lockdep_assert_held(&ar->conf_mutex); - - spin_lock_bh(&ar->data_lock); -- ar->fw_stats_done = false; - ath11k_fw_stats_pdevs_free(&ar->fw_stats.pdevs); -+ ar->fw_stats.num_vdev_recvd = 0; -+ ar->fw_stats.num_bcn_recvd = 0; - spin_unlock_bh(&ar->data_lock); - - reinit_completion(&ar->fw_stats_complete); -+ reinit_completion(&ar->fw_stats_done); - - ret = ath11k_wmi_send_stats_request_cmd(ar, req_param); - if (ret) { -diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c -index 2cc13e60f422f7..9a829b8282420a 100644 ---- a/drivers/net/wireless/ath/ath11k/wmi.c -+++ b/drivers/net/wireless/ath/ath11k/wmi.c -@@ -8183,7 +8183,7 @@ static void ath11k_update_stats_event(struct ath11k_base *ab, struct sk_buff *sk - */ - if (stats.stats_id == WMI_REQUEST_PDEV_STAT) { - list_splice_tail_init(&stats.pdevs, &ar->fw_stats.pdevs); -- ar->fw_stats_done = true; -+ complete(&ar->fw_stats_done); - goto complete; - } - -diff --git a/drivers/net/wireless/ath/ath12k/core.c b/drivers/net/wireless/ath/ath12k/core.c -index 3df8059d55129b..1b07a183aaedc0 100644 ---- a/drivers/net/wireless/ath/ath12k/core.c -+++ b/drivers/net/wireless/ath/ath12k/core.c -@@ -657,6 +657,7 @@ static int ath12k_core_reconfigure_on_crash(struct ath12k_base *ab) - - void ath12k_core_halt(struct ath12k *ar) - { -+ struct list_head *pos, *n; - struct ath12k_base *ab = ar->ab; - - lockdep_assert_held(&ar->conf_mutex); -@@ -671,7 +672,12 @@ void ath12k_core_halt(struct ath12k *ar) - - rcu_assign_pointer(ab->pdevs_active[ar->pdev_idx], NULL); - synchronize_rcu(); -- INIT_LIST_HEAD(&ar->arvifs); -+ -+ spin_lock_bh(&ar->data_lock); -+ list_for_each_safe(pos, n, &ar->arvifs) -+ list_del_init(pos); -+ spin_unlock_bh(&ar->data_lock); -+ - idr_init(&ar->txmgmt_idr); - } - -diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c -index 8d9315038a75e4..56dda76d066c31 100644 ---- a/drivers/net/wireless/ath/ath12k/dp_rx.c -+++ b/drivers/net/wireless/ath/ath12k/dp_rx.c -@@ -3683,6 +3683,15 @@ static bool ath12k_dp_rx_h_tkip_mic_err(struct ath12k *ar, struct sk_buff *msdu, - - l3pad_bytes = ath12k_dp_rx_h_l3pad(ab, desc); - msdu_len = ath12k_dp_rx_h_msdu_len(ab, desc); -+ -+ if ((hal_rx_desc_sz + l3pad_bytes + msdu_len) > DP_RX_BUFFER_SIZE) { -+ ath12k_dbg(ab, ATH12K_DBG_DATA, -+ "invalid msdu len in tkip mic err %u\n", msdu_len); -+ ath12k_dbg_dump(ab, ATH12K_DBG_DATA, NULL, "", desc, -+ sizeof(*desc)); -+ return true; -+ } -+ - skb_put(msdu, hal_rx_desc_sz + l3pad_bytes + msdu_len); - skb_pull(msdu, hal_rx_desc_sz + l3pad_bytes); - -diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c -index d87d5980325e8f..a0ac2f350934f9 100644 ---- a/drivers/net/wireless/ath/ath12k/wmi.c -+++ b/drivers/net/wireless/ath/ath12k/wmi.c -@@ -2066,7 +2066,7 @@ int ath12k_wmi_send_peer_assoc_cmd(struct ath12k *ar, - - for (i = 0; i < arg->peer_eht_mcs_count; i++) { - eht_mcs = ptr; -- eht_mcs->tlv_header = ath12k_wmi_tlv_cmd_hdr(WMI_TAG_HE_RATE_SET, -+ eht_mcs->tlv_header = ath12k_wmi_tlv_cmd_hdr(WMI_TAG_EHT_RATE_SET, - sizeof(*eht_mcs)); - - eht_mcs->rx_mcs_set = cpu_to_le32(arg->peer_eht_rx_mcs_set[i]); -@@ -4128,6 +4128,7 @@ static int ath12k_service_ready_ext_event(struct ath12k_base *ab, - return 0; - - err: -+ kfree(svc_rdy_ext.mac_phy_caps); - ath12k_wmi_free_dbring_caps(ab); - return ret; - } -diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c -index 533471e694007e..18c7654bc539d1 100644 ---- a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c -+++ b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c -@@ -290,6 +290,9 @@ void ath9k_htc_swba(struct ath9k_htc_priv *priv, - struct ath_common *common = ath9k_hw_common(priv->ah); - int slot; - -+ if (!priv->cur_beacon_conf.enable_beacon) -+ return; -+ - if (swba->beacon_pending != 0) { - priv->beacon.bmisscnt++; - if (priv->beacon.bmisscnt > BSTUCK_THRESHOLD) { -diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c -index 7db436d908a39b..f4850c6daeb728 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c -@@ -755,6 +755,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr, - wed->wlan.base = devm_ioremap(dev->mt76.dev, - pci_resource_start(pci_dev, 0), - pci_resource_len(pci_dev, 0)); -+ if (!wed->wlan.base) -+ return -ENOMEM; -+ - wed->wlan.phy_base = pci_resource_start(pci_dev, 0); - wed->wlan.wpdma_int = pci_resource_start(pci_dev, 0) + - MT_INT_WED_SOURCE_CSR; -@@ -782,6 +785,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr, - wed->wlan.bus_type = MTK_WED_BUS_AXI; - wed->wlan.base = devm_ioremap(dev->mt76.dev, res->start, - resource_size(res)); -+ if (!wed->wlan.base) -+ return -ENOMEM; -+ - wed->wlan.phy_base = res->start; - wed->wlan.wpdma_int = res->start + MT_INT_SOURCE_CSR; - wed->wlan.wpdma_mask = res->start + MT_INT_MASK_CSR; -diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/dma.c b/drivers/net/wireless/mediatek/mt76/mt7996/dma.c -index 586e247a1e0648..04c9fd0e6b002a 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7996/dma.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7996/dma.c -@@ -300,7 +300,7 @@ int mt7996_dma_init(struct mt7996_dev *dev) - ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_MCU], - MT_RXQ_ID(MT_RXQ_MCU), - MT7996_RX_MCU_RING_SIZE, -- MT_RX_BUF_SIZE, -+ MT7996_RX_MCU_BUF_SIZE, - MT_RXQ_RING_BASE(MT_RXQ_MCU)); - if (ret) - return ret; -@@ -309,7 +309,7 @@ int mt7996_dma_init(struct mt7996_dev *dev) - ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_MCU_WA], - MT_RXQ_ID(MT_RXQ_MCU_WA), - MT7996_RX_MCU_RING_SIZE_WA, -- MT_RX_BUF_SIZE, -+ MT7996_RX_MCU_BUF_SIZE, - MT_RXQ_RING_BASE(MT_RXQ_MCU_WA)); - if (ret) - return ret; -diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c -index 0a701dcb8a92c5..375a3d6f4b384b 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c -@@ -735,6 +735,9 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band, - u8_encode_bits(IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_11454, - IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK); - -+ eht_cap_elem->mac_cap_info[1] |= -+ IEEE80211_EHT_MAC_CAP1_MAX_AMPDU_LEN_MASK; -+ - eht_cap_elem->phy_cap_info[0] = - IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI | - IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER | -diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h -index 25bb3656123141..7d2074e2b635ec 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h -+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h -@@ -27,6 +27,9 @@ - #define MT7996_RX_RING_SIZE 1536 - #define MT7996_RX_MCU_RING_SIZE 512 - #define MT7996_RX_MCU_RING_SIZE_WA 1024 -+/* scatter-gather of mcu event is not supported in connac3 */ -+#define MT7996_RX_MCU_BUF_SIZE (2048 + \ -+ SKB_DATA_ALIGN(sizeof(struct skb_shared_info))) - - #define MT7996_FIRMWARE_WA "mediatek/mt7996/mt7996_wa.bin" - #define MT7996_FIRMWARE_WM "mediatek/mt7996/mt7996_wm.bin" -diff --git a/drivers/net/wireless/realtek/rtw88/coex.c b/drivers/net/wireless/realtek/rtw88/coex.c -index d35f26919806a7..c45c7b596ffe92 100644 ---- a/drivers/net/wireless/realtek/rtw88/coex.c -+++ b/drivers/net/wireless/realtek/rtw88/coex.c -@@ -309,7 +309,7 @@ static void rtw_coex_tdma_timer_base(struct rtw_dev *rtwdev, u8 type) - { - struct rtw_coex *coex = &rtwdev->coex; - struct rtw_coex_stat *coex_stat = &coex->stat; -- u8 para[2] = {0}; -+ u8 para[6] = {}; - u8 times; - u16 tbtt_interval = coex_stat->wl_beacon_interval; - -diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822c.c b/drivers/net/wireless/realtek/rtw88/rtw8822c.c -index 3fe5c70ce731be..f9b2527fbeee56 100644 ---- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c -+++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c -@@ -3991,7 +3991,8 @@ static void rtw8822c_dpk_cal_coef1(struct rtw_dev *rtwdev) - rtw_write32(rtwdev, REG_NCTL0, 0x00001148); - rtw_write32(rtwdev, REG_NCTL0, 0x00001149); - -- check_hw_ready(rtwdev, 0x2d9c, MASKBYTE0, 0x55); -+ if (!check_hw_ready(rtwdev, 0x2d9c, MASKBYTE0, 0x55)) -+ rtw_warn(rtwdev, "DPK stuck, performance may be suboptimal"); - - rtw_write8(rtwdev, 0x1b10, 0x0); - rtw_write32_mask(rtwdev, REG_NCTL0, BIT_SUBPAGE, 0x0000000c); -diff --git a/drivers/net/wireless/realtek/rtw88/sdio.c b/drivers/net/wireless/realtek/rtw88/sdio.c -index 9043569935796b..832a427279b40a 100644 ---- a/drivers/net/wireless/realtek/rtw88/sdio.c -+++ b/drivers/net/wireless/realtek/rtw88/sdio.c -@@ -718,10 +718,7 @@ static u8 rtw_sdio_get_tx_qsel(struct rtw_dev *rtwdev, struct sk_buff *skb, - case RTW_TX_QUEUE_H2C: - return TX_DESC_QSEL_H2C; - case RTW_TX_QUEUE_MGMT: -- if (rtw_chip_wcpu_11n(rtwdev)) -- return TX_DESC_QSEL_HIGH; -- else -- return TX_DESC_QSEL_MGMT; -+ return TX_DESC_QSEL_MGMT; - case RTW_TX_QUEUE_HI0: - return TX_DESC_QSEL_HIGH; - default: -@@ -1226,10 +1223,7 @@ static void rtw_sdio_process_tx_queue(struct rtw_dev *rtwdev, - return; - } - -- if (queue <= RTW_TX_QUEUE_VO) -- rtw_sdio_indicate_tx_status(rtwdev, skb); -- else -- dev_kfree_skb_any(skb); -+ rtw_sdio_indicate_tx_status(rtwdev, skb); - } - - static void rtw_sdio_tx_handler(struct work_struct *work) -diff --git a/drivers/net/wwan/t7xx/t7xx_netdev.c b/drivers/net/wwan/t7xx/t7xx_netdev.c -index 3ef4a8a4f8fdbc..d879424093b782 100644 ---- a/drivers/net/wwan/t7xx/t7xx_netdev.c -+++ b/drivers/net/wwan/t7xx/t7xx_netdev.c -@@ -296,7 +296,7 @@ static int t7xx_ccmni_wwan_newlink(void *ctxt, struct net_device *dev, u32 if_id - ccmni->ctlb = ctlb; - ccmni->dev = dev; - atomic_set(&ccmni->usage, 0); -- ctlb->ccmni_inst[if_id] = ccmni; -+ WRITE_ONCE(ctlb->ccmni_inst[if_id], ccmni); - - ret = register_netdevice(dev); - if (ret) -@@ -318,6 +318,7 @@ static void t7xx_ccmni_wwan_dellink(void *ctxt, struct net_device *dev, struct l - if (WARN_ON(ctlb->ccmni_inst[if_id] != ccmni)) - return; - -+ WRITE_ONCE(ctlb->ccmni_inst[if_id], NULL); - unregister_netdevice(dev); - } - -@@ -413,7 +414,7 @@ static void t7xx_ccmni_recv_skb(struct t7xx_ccmni_ctrl *ccmni_ctlb, struct sk_bu - - skb_cb = T7XX_SKB_CB(skb); - netif_id = skb_cb->netif_idx; -- ccmni = ccmni_ctlb->ccmni_inst[netif_id]; -+ ccmni = READ_ONCE(ccmni_ctlb->ccmni_inst[netif_id]); - if (!ccmni) { - dev_kfree_skb(skb); - return; -@@ -435,7 +436,7 @@ static void t7xx_ccmni_recv_skb(struct t7xx_ccmni_ctrl *ccmni_ctlb, struct sk_bu - - static void t7xx_ccmni_queue_tx_irq_notify(struct t7xx_ccmni_ctrl *ctlb, int qno) - { -- struct t7xx_ccmni *ccmni = ctlb->ccmni_inst[0]; -+ struct t7xx_ccmni *ccmni = READ_ONCE(ctlb->ccmni_inst[0]); - struct netdev_queue *net_queue; - - if (netif_running(ccmni->dev) && atomic_read(&ccmni->usage) > 0) { -@@ -447,7 +448,7 @@ static void t7xx_ccmni_queue_tx_irq_notify(struct t7xx_ccmni_ctrl *ctlb, int qno - - static void t7xx_ccmni_queue_tx_full_notify(struct t7xx_ccmni_ctrl *ctlb, int qno) - { -- struct t7xx_ccmni *ccmni = ctlb->ccmni_inst[0]; -+ struct t7xx_ccmni *ccmni = READ_ONCE(ctlb->ccmni_inst[0]); - struct netdev_queue *net_queue; - - if (atomic_read(&ccmni->usage) > 0) { -@@ -465,7 +466,7 @@ static void t7xx_ccmni_queue_state_notify(struct t7xx_pci_dev *t7xx_dev, - if (ctlb->md_sta != MD_STATE_READY) - return; - -- if (!ctlb->ccmni_inst[0]) { -+ if (!READ_ONCE(ctlb->ccmni_inst[0])) { - dev_warn(&t7xx_dev->pdev->dev, "No netdev registered yet\n"); - return; - } -diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c -index 4b35bdcac185ff..aeeb7455fc2e7d 100644 ---- a/drivers/nvme/target/fcloop.c -+++ b/drivers/nvme/target/fcloop.c -@@ -613,12 +613,13 @@ fcloop_fcp_recv_work(struct work_struct *work) - { - struct fcloop_fcpreq *tfcp_req = - container_of(work, struct fcloop_fcpreq, fcp_rcv_work); -- struct nvmefc_fcp_req *fcpreq = tfcp_req->fcpreq; -+ struct nvmefc_fcp_req *fcpreq; - unsigned long flags; - int ret = 0; - bool aborted = false; - - spin_lock_irqsave(&tfcp_req->reqlock, flags); -+ fcpreq = tfcp_req->fcpreq; - switch (tfcp_req->inistate) { - case INI_IO_START: - tfcp_req->inistate = INI_IO_ACTIVE; -@@ -633,16 +634,19 @@ fcloop_fcp_recv_work(struct work_struct *work) - } - spin_unlock_irqrestore(&tfcp_req->reqlock, flags); - -- if (unlikely(aborted)) -- ret = -ECANCELED; -- else { -- if (likely(!check_for_drop(tfcp_req))) -- ret = nvmet_fc_rcv_fcp_req(tfcp_req->tport->targetport, -- &tfcp_req->tgt_fcp_req, -- fcpreq->cmdaddr, fcpreq->cmdlen); -- else -- pr_info("%s: dropped command ********\n", __func__); -+ if (unlikely(aborted)) { -+ /* the abort handler will call fcloop_call_host_done */ -+ return; -+ } -+ -+ if (unlikely(check_for_drop(tfcp_req))) { -+ pr_info("%s: dropped command ********\n", __func__); -+ return; - } -+ -+ ret = nvmet_fc_rcv_fcp_req(tfcp_req->tport->targetport, -+ &tfcp_req->tgt_fcp_req, -+ fcpreq->cmdaddr, fcpreq->cmdlen); - if (ret) - fcloop_call_host_done(fcpreq, tfcp_req, ret); - } -@@ -657,9 +661,10 @@ fcloop_fcp_abort_recv_work(struct work_struct *work) - unsigned long flags; - - spin_lock_irqsave(&tfcp_req->reqlock, flags); -- fcpreq = tfcp_req->fcpreq; - switch (tfcp_req->inistate) { - case INI_IO_ABORTED: -+ fcpreq = tfcp_req->fcpreq; -+ tfcp_req->fcpreq = NULL; - break; - case INI_IO_COMPLETED: - completed = true; -@@ -681,10 +686,6 @@ fcloop_fcp_abort_recv_work(struct work_struct *work) - nvmet_fc_rcv_fcp_abort(tfcp_req->tport->targetport, - &tfcp_req->tgt_fcp_req); - -- spin_lock_irqsave(&tfcp_req->reqlock, flags); -- tfcp_req->fcpreq = NULL; -- spin_unlock_irqrestore(&tfcp_req->reqlock, flags); -- - fcloop_call_host_done(fcpreq, tfcp_req, -ECANCELED); - /* call_host_done releases reference for abort downcall */ - } -diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c -index 8af95e9da7cec6..741e10a575ec75 100644 ---- a/drivers/pci/controller/cadence/pcie-cadence-host.c -+++ b/drivers/pci/controller/cadence/pcie-cadence-host.c -@@ -570,14 +570,5 @@ int cdns_pcie_host_setup(struct cdns_pcie_rc *rc) - if (!bridge->ops) - bridge->ops = &cdns_pcie_host_ops; - -- ret = pci_host_probe(bridge); -- if (ret < 0) -- goto err_init; -- -- return 0; -- -- err_init: -- pm_runtime_put_sync(dev); -- -- return ret; -+ return pci_host_probe(bridge); - } -diff --git a/drivers/pci/controller/pcie-apple.c b/drivers/pci/controller/pcie-apple.c -index f7a248393a8f16..7e6bd63a6425e6 100644 ---- a/drivers/pci/controller/pcie-apple.c -+++ b/drivers/pci/controller/pcie-apple.c -@@ -541,7 +541,7 @@ static int apple_pcie_setup_port(struct apple_pcie *pcie, - rmw_set(PORT_APPCLK_EN, port->base + PORT_APPCLK); - - /* Assert PERST# before setting up the clock */ -- gpiod_set_value(reset, 1); -+ gpiod_set_value_cansleep(reset, 1); - - ret = apple_pcie_setup_refclk(pcie, port); - if (ret < 0) -@@ -552,7 +552,7 @@ static int apple_pcie_setup_port(struct apple_pcie *pcie, - - /* Deassert PERST# */ - rmw_set(PORT_PERST_OFF, port->base + PORT_PERST); -- gpiod_set_value(reset, 0); -+ gpiod_set_value_cansleep(reset, 0); - - /* Wait for 100ms after PERST# deassertion (PCIe r5.0, 6.6.1) */ - msleep(100); -diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c -index 095fa1910d36db..503304aba9eac1 100644 ---- a/drivers/pci/pci.c -+++ b/drivers/pci/pci.c -@@ -5221,7 +5221,7 @@ int pci_bridge_wait_for_secondary_bus(struct pci_dev *dev, char *reset_type) - delay); - if (!pcie_wait_for_link_delay(dev, true, delay)) { - /* Did not train, no need to wait any further */ -- pci_info(dev, "Data Link Layer Link Active not set in 1000 msec\n"); -+ pci_info(dev, "Data Link Layer Link Active not set in %d msec\n", delay); - return -ENOTTY; - } - -diff --git a/drivers/pci/pcie/dpc.c b/drivers/pci/pcie/dpc.c -index a5cec2a4e057d1..3c3ecb9cf57afb 100644 ---- a/drivers/pci/pcie/dpc.c -+++ b/drivers/pci/pcie/dpc.c -@@ -263,7 +263,7 @@ static int dpc_get_aer_uncorrect_severity(struct pci_dev *dev, - void dpc_process_error(struct pci_dev *pdev) - { - u16 cap = pdev->dpc_cap, status, source, reason, ext_reason; -- struct aer_err_info info; -+ struct aer_err_info info = {}; - - pci_read_config_word(pdev, cap + PCI_EXP_DPC_STATUS, &status); - pci_read_config_word(pdev, cap + PCI_EXP_DPC_SOURCE_ID, &source); -diff --git a/drivers/perf/amlogic/meson_ddr_pmu_core.c b/drivers/perf/amlogic/meson_ddr_pmu_core.c -index bbc7285fd934a3..5f8699612a9ad1 100644 ---- a/drivers/perf/amlogic/meson_ddr_pmu_core.c -+++ b/drivers/perf/amlogic/meson_ddr_pmu_core.c -@@ -510,7 +510,7 @@ int meson_ddr_pmu_create(struct platform_device *pdev) - - fmt_attr_fill(pmu->info.hw_info->fmt_attr); - -- pmu->cpu = smp_processor_id(); -+ pmu->cpu = raw_smp_processor_id(); - - name = devm_kasprintf(&pdev->dev, GFP_KERNEL, DDR_PERF_DEV_NAME); - if (!name) -diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-usb.c b/drivers/phy/qualcomm/phy-qcom-qmp-usb.c -index c697d01b2a2a1e..5072bca0af7c5d 100644 ---- a/drivers/phy/qualcomm/phy-qcom-qmp-usb.c -+++ b/drivers/phy/qualcomm/phy-qcom-qmp-usb.c -@@ -2044,12 +2044,16 @@ static void __iomem *qmp_usb_iomap(struct device *dev, struct device_node *np, - int index, bool exclusive) - { - struct resource res; -+ void __iomem *mem; - - if (!exclusive) { - if (of_address_to_resource(np, index, &res)) - return IOMEM_ERR_PTR(-EINVAL); - -- return devm_ioremap(dev, res.start, resource_size(&res)); -+ mem = devm_ioremap(dev, res.start, resource_size(&res)); -+ if (!mem) -+ return IOMEM_ERR_PTR(-ENOMEM); -+ return mem; - } - - return devm_of_iomap(dev, np, index, NULL); -diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c -index c34719b7506da6..1a39fd97a9005a 100644 ---- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c -+++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c -@@ -417,20 +417,22 @@ static int armada_37xx_gpio_direction_output(struct gpio_chip *chip, - unsigned int offset, int value) - { - struct armada_37xx_pinctrl *info = gpiochip_get_data(chip); -- unsigned int reg = OUTPUT_EN; -+ unsigned int en_offset = offset; -+ unsigned int reg = OUTPUT_VAL; - unsigned int mask, val, ret; - - armada_37xx_update_reg(®, &offset); - mask = BIT(offset); -+ val = value ? mask : 0; - -- ret = regmap_update_bits(info->regmap, reg, mask, mask); -- -+ ret = regmap_update_bits(info->regmap, reg, mask, val); - if (ret) - return ret; - -- reg = OUTPUT_VAL; -- val = value ? mask : 0; -- regmap_update_bits(info->regmap, reg, mask, val); -+ reg = OUTPUT_EN; -+ armada_37xx_update_reg(®, &en_offset); -+ -+ regmap_update_bits(info->regmap, reg, mask, mask); - - return 0; - } -diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c -index d7b66928a4e50d..3c09f743b68c2e 100644 ---- a/drivers/pinctrl/pinctrl-at91.c -+++ b/drivers/pinctrl/pinctrl-at91.c -@@ -1825,12 +1825,16 @@ static int at91_gpio_probe(struct platform_device *pdev) - struct at91_gpio_chip *at91_chip = NULL; - struct gpio_chip *chip; - struct pinctrl_gpio_range *range; -+ int alias_idx; - int ret = 0; - int irq, i; -- int alias_idx = of_alias_get_id(np, "gpio"); - uint32_t ngpio; - char **names; - -+ alias_idx = of_alias_get_id(np, "gpio"); -+ if (alias_idx < 0) -+ return alias_idx; -+ - BUG_ON(alias_idx >= ARRAY_SIZE(gpio_chips)); - if (gpio_chips[alias_idx]) - return dev_err_probe(dev, -EBUSY, "%d slot is occupied.\n", alias_idx); -diff --git a/drivers/pinctrl/qcom/pinctrl-qcm2290.c b/drivers/pinctrl/qcom/pinctrl-qcm2290.c -index f5c1c427b44e91..61b7c22e963c2c 100644 ---- a/drivers/pinctrl/qcom/pinctrl-qcm2290.c -+++ b/drivers/pinctrl/qcom/pinctrl-qcm2290.c -@@ -165,6 +165,10 @@ static const struct pinctrl_pin_desc qcm2290_pins[] = { - PINCTRL_PIN(62, "GPIO_62"), - PINCTRL_PIN(63, "GPIO_63"), - PINCTRL_PIN(64, "GPIO_64"), -+ PINCTRL_PIN(65, "GPIO_65"), -+ PINCTRL_PIN(66, "GPIO_66"), -+ PINCTRL_PIN(67, "GPIO_67"), -+ PINCTRL_PIN(68, "GPIO_68"), - PINCTRL_PIN(69, "GPIO_69"), - PINCTRL_PIN(70, "GPIO_70"), - PINCTRL_PIN(71, "GPIO_71"), -@@ -179,12 +183,17 @@ static const struct pinctrl_pin_desc qcm2290_pins[] = { - PINCTRL_PIN(80, "GPIO_80"), - PINCTRL_PIN(81, "GPIO_81"), - PINCTRL_PIN(82, "GPIO_82"), -+ PINCTRL_PIN(83, "GPIO_83"), -+ PINCTRL_PIN(84, "GPIO_84"), -+ PINCTRL_PIN(85, "GPIO_85"), - PINCTRL_PIN(86, "GPIO_86"), - PINCTRL_PIN(87, "GPIO_87"), - PINCTRL_PIN(88, "GPIO_88"), - PINCTRL_PIN(89, "GPIO_89"), - PINCTRL_PIN(90, "GPIO_90"), - PINCTRL_PIN(91, "GPIO_91"), -+ PINCTRL_PIN(92, "GPIO_92"), -+ PINCTRL_PIN(93, "GPIO_93"), - PINCTRL_PIN(94, "GPIO_94"), - PINCTRL_PIN(95, "GPIO_95"), - PINCTRL_PIN(96, "GPIO_96"), -diff --git a/drivers/power/reset/at91-reset.c b/drivers/power/reset/at91-reset.c -index aa9b012d3d00b8..bafe4cc6fafdcb 100644 ---- a/drivers/power/reset/at91-reset.c -+++ b/drivers/power/reset/at91-reset.c -@@ -129,12 +129,11 @@ static int at91_reset(struct notifier_block *this, unsigned long mode, - " str %4, [%0, %6]\n\t" - /* Disable SDRAM1 accesses */ - "1: tst %1, #0\n\t" -- " beq 2f\n\t" - " strne %3, [%1, #" __stringify(AT91_DDRSDRC_RTR) "]\n\t" - /* Power down SDRAM1 */ - " strne %4, [%1, %6]\n\t" - /* Reset CPU */ -- "2: str %5, [%2, #" __stringify(AT91_RSTC_CR) "]\n\t" -+ " str %5, [%2, #" __stringify(AT91_RSTC_CR) "]\n\t" - - " b .\n\t" - : -@@ -145,7 +144,7 @@ static int at91_reset(struct notifier_block *this, unsigned long mode, - "r" cpu_to_le32(AT91_DDRSDRC_LPCB_POWER_DOWN), - "r" (reset->data->reset_args), - "r" (reset->ramc_lpr) -- : "r4"); -+ ); - - return NOTIFY_DONE; - } -diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h -index b8d4f61f14be4f..d0eb4555720eba 100644 ---- a/drivers/ptp/ptp_private.h -+++ b/drivers/ptp/ptp_private.h -@@ -89,17 +89,7 @@ static inline int queue_cnt(const struct timestamp_event_queue *q) - /* Check if ptp virtual clock is in use */ - static inline bool ptp_vclock_in_use(struct ptp_clock *ptp) - { -- bool in_use = false; -- -- if (mutex_lock_interruptible(&ptp->n_vclocks_mux)) -- return true; -- -- if (!ptp->is_virtual_clock && ptp->n_vclocks) -- in_use = true; -- -- mutex_unlock(&ptp->n_vclocks_mux); -- -- return in_use; -+ return !ptp->is_virtual_clock; - } - - /* Check if ptp clock shall be free running */ -diff --git a/drivers/regulator/max20086-regulator.c b/drivers/regulator/max20086-regulator.c -index ebfbcadbca5295..1cf04d1efb3313 100644 ---- a/drivers/regulator/max20086-regulator.c -+++ b/drivers/regulator/max20086-regulator.c -@@ -5,6 +5,7 @@ - // Copyright (C) 2022 Laurent Pinchart - // Copyright (C) 2018 Avnet, Inc. - -+#include - #include - #include - #include -@@ -133,11 +134,11 @@ static int max20086_regulators_register(struct max20086 *chip) - static int max20086_parse_regulators_dt(struct max20086 *chip, bool *boot_on) - { - struct of_regulator_match *matches; -- struct device_node *node; - unsigned int i; - int ret; - -- node = of_get_child_by_name(chip->dev->of_node, "regulators"); -+ struct device_node *node __free(device_node) = -+ of_get_child_by_name(chip->dev->of_node, "regulators"); - if (!node) { - dev_err(chip->dev, "regulators node not found\n"); - return -ENODEV; -@@ -153,7 +154,6 @@ static int max20086_parse_regulators_dt(struct max20086 *chip, bool *boot_on) - - ret = of_regulator_match(chip->dev, node, matches, - chip->info->num_outputs); -- of_node_put(node); - if (ret < 0) { - dev_err(chip->dev, "Failed to match regulators\n"); - return -EINVAL; -diff --git a/drivers/remoteproc/qcom_wcnss_iris.c b/drivers/remoteproc/qcom_wcnss_iris.c -index dd36fd077911af..1e197f7734742b 100644 ---- a/drivers/remoteproc/qcom_wcnss_iris.c -+++ b/drivers/remoteproc/qcom_wcnss_iris.c -@@ -197,6 +197,7 @@ struct qcom_iris *qcom_iris_probe(struct device *parent, bool *use_48mhz_xo) - - err_device_del: - device_del(&iris->dev); -+ put_device(&iris->dev); - - return ERR_PTR(ret); - } -@@ -204,4 +205,5 @@ struct qcom_iris *qcom_iris_probe(struct device *parent, bool *use_48mhz_xo) - void qcom_iris_remove(struct qcom_iris *iris) - { - device_del(&iris->dev); -+ put_device(&iris->dev); - } -diff --git a/drivers/remoteproc/ti_k3_r5_remoteproc.c b/drivers/remoteproc/ti_k3_r5_remoteproc.c -index 5491b1b17ca368..37005640c784c0 100644 ---- a/drivers/remoteproc/ti_k3_r5_remoteproc.c -+++ b/drivers/remoteproc/ti_k3_r5_remoteproc.c -@@ -194,10 +194,6 @@ static void k3_r5_rproc_mbox_callback(struct mbox_client *client, void *data) - const char *name = kproc->rproc->name; - u32 msg = omap_mbox_message(data); - -- /* Do not forward message from a detached core */ -- if (kproc->rproc->state == RPROC_DETACHED) -- return; -- - dev_dbg(dev, "mbox msg: 0x%x\n", msg); - - switch (msg) { -@@ -233,10 +229,6 @@ static void k3_r5_rproc_kick(struct rproc *rproc, int vqid) - mbox_msg_t msg = (mbox_msg_t)vqid; - int ret; - -- /* Do not forward message to a detached core */ -- if (kproc->rproc->state == RPROC_DETACHED) -- return; -- - /* send the index of the triggered virtqueue in the mailbox payload */ - ret = mbox_send_message(kproc->mbox, (void *)msg); - if (ret < 0) -diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c -index 43f601c84b4fcb..79d35ab43729ea 100644 ---- a/drivers/rpmsg/qcom_smd.c -+++ b/drivers/rpmsg/qcom_smd.c -@@ -746,7 +746,7 @@ static int __qcom_smd_send(struct qcom_smd_channel *channel, const void *data, - __le32 hdr[5] = { cpu_to_le32(len), }; - int tlen = sizeof(hdr) + len; - unsigned long flags; -- int ret; -+ int ret = 0; - - /* Word aligned channels only accept word size aligned data */ - if (channel->info_word && len % 4) -diff --git a/drivers/rtc/class.c b/drivers/rtc/class.c -index edfd942f8c5494..af10850fbac2e7 100644 ---- a/drivers/rtc/class.c -+++ b/drivers/rtc/class.c -@@ -323,7 +323,7 @@ static void rtc_device_get_offset(struct rtc_device *rtc) - * - * Otherwise the offset seconds should be 0. - */ -- if (rtc->start_secs > rtc->range_max || -+ if ((rtc->start_secs >= 0 && rtc->start_secs > rtc->range_max) || - rtc->start_secs + range_secs - 1 < rtc->range_min) - rtc->offset_secs = rtc->start_secs - rtc->range_min; - else if (rtc->start_secs > rtc->range_min) -diff --git a/drivers/rtc/lib.c b/drivers/rtc/lib.c -index fe361652727a3f..13b5b1f2046510 100644 ---- a/drivers/rtc/lib.c -+++ b/drivers/rtc/lib.c -@@ -46,24 +46,38 @@ EXPORT_SYMBOL(rtc_year_days); - * rtc_time64_to_tm - converts time64_t to rtc_time. - * - * @time: The number of seconds since 01-01-1970 00:00:00. -- * (Must be positive.) -+ * Works for values since at least 1900 - * @tm: Pointer to the struct rtc_time. - */ - void rtc_time64_to_tm(time64_t time, struct rtc_time *tm) - { -- unsigned int secs; -- int days; -+ int days, secs; - - u64 u64tmp; - u32 u32tmp, udays, century, day_of_century, year_of_century, year, - day_of_year, month, day; - bool is_Jan_or_Feb, is_leap_year; - -- /* time must be positive */ -+ /* -+ * Get days and seconds while preserving the sign to -+ * handle negative time values (dates before 1970-01-01) -+ */ - days = div_s64_rem(time, 86400, &secs); - -+ /* -+ * We need 0 <= secs < 86400 which isn't given for negative -+ * values of time. Fixup accordingly. -+ */ -+ if (secs < 0) { -+ days -= 1; -+ secs += 86400; -+ } -+ - /* day of the week, 1970-01-01 was a Thursday */ - tm->tm_wday = (days + 4) % 7; -+ /* Ensure tm_wday is always positive */ -+ if (tm->tm_wday < 0) -+ tm->tm_wday += 7; - - /* - * The following algorithm is, basically, Proposition 6.3 of Neri -@@ -93,7 +107,7 @@ void rtc_time64_to_tm(time64_t time, struct rtc_time *tm) - * thus, is slightly different from [1]. - */ - -- udays = ((u32) days) + 719468; -+ udays = days + 719468; - - u32tmp = 4 * udays + 3; - century = u32tmp / 146097; -diff --git a/drivers/rtc/rtc-loongson.c b/drivers/rtc/rtc-loongson.c -index 90e9d97a86b487..c9d5b91a6544d1 100644 ---- a/drivers/rtc/rtc-loongson.c -+++ b/drivers/rtc/rtc-loongson.c -@@ -129,6 +129,14 @@ static u32 loongson_rtc_handler(void *id) - { - struct loongson_rtc_priv *priv = (struct loongson_rtc_priv *)id; - -+ rtc_update_irq(priv->rtcdev, 1, RTC_AF | RTC_IRQF); -+ -+ /* -+ * The TOY_MATCH0_REG should be cleared 0 here, -+ * otherwise the interrupt cannot be cleared. -+ */ -+ regmap_write(priv->regmap, TOY_MATCH0_REG, 0); -+ - spin_lock(&priv->lock); - /* Disable RTC alarm wakeup and interrupt */ - writel(readl(priv->pm_base + PM1_EN_REG) & ~RTC_EN, -diff --git a/drivers/rtc/rtc-sh.c b/drivers/rtc/rtc-sh.c -index cd146b5741431f..341b1b776e1a39 100644 ---- a/drivers/rtc/rtc-sh.c -+++ b/drivers/rtc/rtc-sh.c -@@ -485,9 +485,15 @@ static int __init sh_rtc_probe(struct platform_device *pdev) - return -ENOENT; - } - -- rtc->periodic_irq = ret; -- rtc->carry_irq = platform_get_irq(pdev, 1); -- rtc->alarm_irq = platform_get_irq(pdev, 2); -+ if (!pdev->dev.of_node) { -+ rtc->periodic_irq = ret; -+ rtc->carry_irq = platform_get_irq(pdev, 1); -+ rtc->alarm_irq = platform_get_irq(pdev, 2); -+ } else { -+ rtc->alarm_irq = ret; -+ rtc->periodic_irq = platform_get_irq(pdev, 1); -+ rtc->carry_irq = platform_get_irq(pdev, 2); -+ } - - res = platform_get_resource(pdev, IORESOURCE_IO, 0); - if (!res) -diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c -index 7e64661d215bd2..3ad58250bf6b21 100644 ---- a/drivers/scsi/hisi_sas/hisi_sas_main.c -+++ b/drivers/scsi/hisi_sas/hisi_sas_main.c -@@ -1844,33 +1844,14 @@ static int hisi_sas_I_T_nexus_reset(struct domain_device *device) - } - hisi_sas_dereg_device(hisi_hba, device); - -- rc = hisi_sas_debug_I_T_nexus_reset(device); -- if (rc == TMF_RESP_FUNC_COMPLETE && dev_is_sata(device)) { -- struct sas_phy *local_phy; -- -+ if (dev_is_sata(device)) { - rc = hisi_sas_softreset_ata_disk(device); -- switch (rc) { -- case -ECOMM: -- rc = -ENODEV; -- break; -- case TMF_RESP_FUNC_FAILED: -- case -EMSGSIZE: -- case -EIO: -- local_phy = sas_get_local_phy(device); -- rc = sas_phy_enable(local_phy, 0); -- if (!rc) { -- local_phy->enabled = 0; -- dev_err(dev, "Disabled local phy of ATA disk %016llx due to softreset fail (%d)\n", -- SAS_ADDR(device->sas_addr), rc); -- rc = -ENODEV; -- } -- sas_put_local_phy(local_phy); -- break; -- default: -- break; -- } -+ if (rc == TMF_RESP_FUNC_FAILED) -+ dev_err(dev, "ata disk %016llx reset (%d)\n", -+ SAS_ADDR(device->sas_addr), rc); - } - -+ rc = hisi_sas_debug_I_T_nexus_reset(device); - if ((rc == TMF_RESP_FUNC_COMPLETE) || (rc == -ENODEV)) - hisi_sas_release_task(hisi_hba, device); - -diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c -index 9a81d14aef6b99..17b19b39699a31 100644 ---- a/drivers/scsi/qedf/qedf_main.c -+++ b/drivers/scsi/qedf/qedf_main.c -@@ -699,7 +699,7 @@ static u32 qedf_get_login_failures(void *cookie) - } - - static struct qed_fcoe_cb_ops qedf_cb_ops = { -- { -+ .common = { - .link_update = qedf_link_update, - .bw_update = qedf_bw_update, - .schedule_recovery_handler = qedf_schedule_recovery_handler, -diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c -index 0c30fec555475b..f2c31e74d8ed06 100644 ---- a/drivers/scsi/scsi_transport_iscsi.c -+++ b/drivers/scsi/scsi_transport_iscsi.c -@@ -3525,7 +3525,7 @@ static int iscsi_new_flashnode(struct iscsi_transport *transport, - pr_err("%s could not find host no %u\n", - __func__, ev->u.new_flashnode.host_no); - err = -ENODEV; -- goto put_host; -+ goto exit_new_fnode; - } - - index = transport->new_flashnode(shost, data, len); -@@ -3535,7 +3535,6 @@ static int iscsi_new_flashnode(struct iscsi_transport *transport, - else - err = -EIO; - --put_host: - scsi_host_put(shost); - - exit_new_fnode: -@@ -3560,7 +3559,7 @@ static int iscsi_del_flashnode(struct iscsi_transport *transport, - pr_err("%s could not find host no %u\n", - __func__, ev->u.del_flashnode.host_no); - err = -ENODEV; -- goto put_host; -+ goto exit_del_fnode; - } - - idx = ev->u.del_flashnode.flashnode_idx; -@@ -3602,7 +3601,7 @@ static int iscsi_login_flashnode(struct iscsi_transport *transport, - pr_err("%s could not find host no %u\n", - __func__, ev->u.login_flashnode.host_no); - err = -ENODEV; -- goto put_host; -+ goto exit_login_fnode; - } - - idx = ev->u.login_flashnode.flashnode_idx; -@@ -3654,7 +3653,7 @@ static int iscsi_logout_flashnode(struct iscsi_transport *transport, - pr_err("%s could not find host no %u\n", - __func__, ev->u.logout_flashnode.host_no); - err = -ENODEV; -- goto put_host; -+ goto exit_logout_fnode; - } - - idx = ev->u.logout_flashnode.flashnode_idx; -@@ -3704,7 +3703,7 @@ static int iscsi_logout_flashnode_sid(struct iscsi_transport *transport, - pr_err("%s could not find host no %u\n", - __func__, ev->u.logout_flashnode.host_no); - err = -ENODEV; -- goto put_host; -+ goto exit_logout_sid; - } - - session = iscsi_session_lookup(ev->u.logout_flashnode_sid.sid); -diff --git a/drivers/soc/aspeed/aspeed-lpc-snoop.c b/drivers/soc/aspeed/aspeed-lpc-snoop.c -index 773dbcbc03a6cd..0f2ffee321dd9c 100644 ---- a/drivers/soc/aspeed/aspeed-lpc-snoop.c -+++ b/drivers/soc/aspeed/aspeed-lpc-snoop.c -@@ -166,7 +166,7 @@ static int aspeed_lpc_snoop_config_irq(struct aspeed_lpc_snoop *lpc_snoop, - int rc; - - lpc_snoop->irq = platform_get_irq(pdev, 0); -- if (!lpc_snoop->irq) -+ if (lpc_snoop->irq < 0) - return -ENODEV; - - rc = devm_request_irq(dev, lpc_snoop->irq, -@@ -200,11 +200,15 @@ static int aspeed_lpc_enable_snoop(struct aspeed_lpc_snoop *lpc_snoop, - lpc_snoop->chan[channel].miscdev.minor = MISC_DYNAMIC_MINOR; - lpc_snoop->chan[channel].miscdev.name = - devm_kasprintf(dev, GFP_KERNEL, "%s%d", DEVICE_NAME, channel); -+ if (!lpc_snoop->chan[channel].miscdev.name) { -+ rc = -ENOMEM; -+ goto err_free_fifo; -+ } - lpc_snoop->chan[channel].miscdev.fops = &snoop_fops; - lpc_snoop->chan[channel].miscdev.parent = dev; - rc = misc_register(&lpc_snoop->chan[channel].miscdev); - if (rc) -- return rc; -+ goto err_free_fifo; - - /* Enable LPC snoop channel at requested port */ - switch (channel) { -@@ -221,7 +225,8 @@ static int aspeed_lpc_enable_snoop(struct aspeed_lpc_snoop *lpc_snoop, - hicrb_en = HICRB_ENSNP1D; - break; - default: -- return -EINVAL; -+ rc = -EINVAL; -+ goto err_misc_deregister; - } - - regmap_update_bits(lpc_snoop->regmap, HICR5, hicr5_en, hicr5_en); -@@ -231,6 +236,12 @@ static int aspeed_lpc_enable_snoop(struct aspeed_lpc_snoop *lpc_snoop, - regmap_update_bits(lpc_snoop->regmap, HICRB, - hicrb_en, hicrb_en); - -+ return 0; -+ -+err_misc_deregister: -+ misc_deregister(&lpc_snoop->chan[channel].miscdev); -+err_free_fifo: -+ kfifo_free(&lpc_snoop->chan[channel].fifo); - return rc; - } - -diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c -index 1ca857c2a4aa31..8df12efeea21c7 100644 ---- a/drivers/spi/spi-bcm63xx-hsspi.c -+++ b/drivers/spi/spi-bcm63xx-hsspi.c -@@ -745,7 +745,7 @@ static int bcm63xx_hsspi_probe(struct platform_device *pdev) - if (IS_ERR(clk)) - return PTR_ERR(clk); - -- reset = devm_reset_control_get_optional_exclusive(dev, NULL); -+ reset = devm_reset_control_get_optional_shared(dev, NULL); - if (IS_ERR(reset)) - return PTR_ERR(reset); - -diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c -index ef3a7226db125c..a95badb7b71146 100644 ---- a/drivers/spi/spi-bcm63xx.c -+++ b/drivers/spi/spi-bcm63xx.c -@@ -523,7 +523,7 @@ static int bcm63xx_spi_probe(struct platform_device *pdev) - return PTR_ERR(clk); - } - -- reset = devm_reset_control_get_optional_exclusive(dev, NULL); -+ reset = devm_reset_control_get_optional_shared(dev, NULL); - if (IS_ERR(reset)) - return PTR_ERR(reset); - -diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c -index 6f12e4fb2e2e18..65c11909659c6b 100644 ---- a/drivers/spi/spi-sh-msiof.c -+++ b/drivers/spi/spi-sh-msiof.c -@@ -918,6 +918,7 @@ static int sh_msiof_transfer_one(struct spi_controller *ctlr, - void *rx_buf = t->rx_buf; - unsigned int len = t->len; - unsigned int bits = t->bits_per_word; -+ unsigned int max_wdlen = 256; - unsigned int bytes_per_word; - unsigned int words; - int n; -@@ -931,17 +932,17 @@ static int sh_msiof_transfer_one(struct spi_controller *ctlr, - if (!spi_controller_is_target(p->ctlr)) - sh_msiof_spi_set_clk_regs(p, t); - -+ if (tx_buf) -+ max_wdlen = min(max_wdlen, p->tx_fifo_size); -+ if (rx_buf) -+ max_wdlen = min(max_wdlen, p->rx_fifo_size); -+ - while (ctlr->dma_tx && len > 15) { - /* - * DMA supports 32-bit words only, hence pack 8-bit and 16-bit - * words, with byte resp. word swapping. - */ -- unsigned int l = 0; -- -- if (tx_buf) -- l = min(round_down(len, 4), p->tx_fifo_size * 4); -- if (rx_buf) -- l = min(round_down(len, 4), p->rx_fifo_size * 4); -+ unsigned int l = min(round_down(len, 4), max_wdlen * 4); - - if (bits <= 8) { - copy32 = copy_bswap32; -diff --git a/drivers/spi/spi-tegra210-quad.c b/drivers/spi/spi-tegra210-quad.c -index e3c236025a7b3b..e9afebd724237b 100644 ---- a/drivers/spi/spi-tegra210-quad.c -+++ b/drivers/spi/spi-tegra210-quad.c -@@ -134,7 +134,7 @@ - #define QSPI_COMMAND_VALUE_SET(X) (((x) & 0xFF) << 0) - - #define QSPI_CMB_SEQ_CMD_CFG 0x1a0 --#define QSPI_COMMAND_X1_X2_X4(x) (((x) & 0x3) << 13) -+#define QSPI_COMMAND_X1_X2_X4(x) ((((x) >> 1) & 0x3) << 13) - #define QSPI_COMMAND_X1_X2_X4_MASK (0x03 << 13) - #define QSPI_COMMAND_SDR_DDR BIT(12) - #define QSPI_COMMAND_SIZE_SET(x) (((x) & 0xFF) << 0) -@@ -147,7 +147,7 @@ - #define QSPI_ADDRESS_VALUE_SET(X) (((x) & 0xFFFF) << 0) - - #define QSPI_CMB_SEQ_ADDR_CFG 0x1ac --#define QSPI_ADDRESS_X1_X2_X4(x) (((x) & 0x3) << 13) -+#define QSPI_ADDRESS_X1_X2_X4(x) ((((x) >> 1) & 0x3) << 13) - #define QSPI_ADDRESS_X1_X2_X4_MASK (0x03 << 13) - #define QSPI_ADDRESS_SDR_DDR BIT(12) - #define QSPI_ADDRESS_SIZE_SET(x) (((x) & 0xFF) << 0) -@@ -1036,10 +1036,6 @@ static u32 tegra_qspi_addr_config(bool is_ddr, u8 bus_width, u8 len) - { - u32 addr_config = 0; - -- /* Extract Address configuration and value */ -- is_ddr = 0; //Only SDR mode supported -- bus_width = 0; //X1 mode -- - if (is_ddr) - addr_config |= QSPI_ADDRESS_SDR_DDR; - else -@@ -1079,13 +1075,13 @@ static int tegra_qspi_combined_seq_xfer(struct tegra_qspi *tqspi, - switch (transfer_phase) { - case CMD_TRANSFER: - /* X1 SDR mode */ -- cmd_config = tegra_qspi_cmd_config(false, 0, -+ cmd_config = tegra_qspi_cmd_config(false, xfer->tx_nbits, - xfer->len); - cmd_value = *((const u8 *)(xfer->tx_buf)); - break; - case ADDR_TRANSFER: - /* X1 SDR mode */ -- addr_config = tegra_qspi_addr_config(false, 0, -+ addr_config = tegra_qspi_addr_config(false, xfer->tx_nbits, - xfer->len); - address_value = *((const u32 *)(xfer->tx_buf)); - break; -@@ -1163,26 +1159,22 @@ static int tegra_qspi_combined_seq_xfer(struct tegra_qspi *tqspi, - ret = -EIO; - goto exit; - } -- if (!xfer->cs_change) { -- tegra_qspi_transfer_end(spi); -- spi_transfer_delay_exec(xfer); -- } - break; - default: - ret = -EINVAL; - goto exit; - } - msg->actual_length += xfer->len; -+ if (!xfer->cs_change && transfer_phase == DATA_TRANSFER) { -+ tegra_qspi_transfer_end(spi); -+ spi_transfer_delay_exec(xfer); -+ } - transfer_phase++; - } - ret = 0; - - exit: - msg->status = ret; -- if (ret < 0) { -- tegra_qspi_transfer_end(spi); -- spi_transfer_delay_exec(xfer); -- } - - return ret; - } -diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c -index ac398b5a973604..a1d941b0be00b7 100644 ---- a/drivers/staging/media/rkvdec/rkvdec.c -+++ b/drivers/staging/media/rkvdec/rkvdec.c -@@ -213,8 +213,14 @@ static int rkvdec_enum_framesizes(struct file *file, void *priv, - if (!fmt) - return -EINVAL; - -- fsize->type = V4L2_FRMSIZE_TYPE_STEPWISE; -- fsize->stepwise = fmt->frmsize; -+ fsize->type = V4L2_FRMSIZE_TYPE_CONTINUOUS; -+ fsize->stepwise.min_width = 1; -+ fsize->stepwise.max_width = fmt->frmsize.max_width; -+ fsize->stepwise.step_width = 1; -+ fsize->stepwise.min_height = 1; -+ fsize->stepwise.max_height = fmt->frmsize.max_height; -+ fsize->stepwise.step_height = 1; -+ - return 0; - } - -diff --git a/drivers/thunderbolt/ctl.c b/drivers/thunderbolt/ctl.c -index d997a4c545f796..a60d7afc041f41 100644 ---- a/drivers/thunderbolt/ctl.c -+++ b/drivers/thunderbolt/ctl.c -@@ -143,6 +143,11 @@ static void tb_cfg_request_dequeue(struct tb_cfg_request *req) - struct tb_ctl *ctl = req->ctl; - - mutex_lock(&ctl->request_queue_lock); -+ if (!test_bit(TB_CFG_REQUEST_ACTIVE, &req->flags)) { -+ mutex_unlock(&ctl->request_queue_lock); -+ return; -+ } -+ - list_del(&req->list); - clear_bit(TB_CFG_REQUEST_ACTIVE, &req->flags); - if (test_bit(TB_CFG_REQUEST_CANCELED, &req->flags)) -diff --git a/drivers/thunderbolt/usb4.c b/drivers/thunderbolt/usb4.c -index 8db9bd32f47384..e445516290f912 100644 ---- a/drivers/thunderbolt/usb4.c -+++ b/drivers/thunderbolt/usb4.c -@@ -442,10 +442,10 @@ int usb4_switch_set_wake(struct tb_switch *sw, unsigned int flags) - bool configured = val & PORT_CS_19_PC; - usb4 = port->usb4; - -- if (((flags & TB_WAKE_ON_CONNECT) | -+ if (((flags & TB_WAKE_ON_CONNECT) && - device_may_wakeup(&usb4->dev)) && !configured) - val |= PORT_CS_19_WOC; -- if (((flags & TB_WAKE_ON_DISCONNECT) | -+ if (((flags & TB_WAKE_ON_DISCONNECT) && - device_may_wakeup(&usb4->dev)) && configured) - val |= PORT_CS_19_WOD; - if ((flags & TB_WAKE_ON_USB4) && configured) -diff --git a/drivers/tty/serial/jsm/jsm_tty.c b/drivers/tty/serial/jsm/jsm_tty.c -index 222afc270c88d6..1bee624bd484cb 100644 ---- a/drivers/tty/serial/jsm/jsm_tty.c -+++ b/drivers/tty/serial/jsm/jsm_tty.c -@@ -451,6 +451,7 @@ int jsm_uart_port_init(struct jsm_board *brd) - if (!brd->channels[i]) - continue; - -+ brd->channels[i]->uart_port.dev = &brd->pci_dev->dev; - brd->channels[i]->uart_port.irq = brd->irq; - brd->channels[i]->uart_port.uartclk = 14745600; - brd->channels[i]->uart_port.type = PORT_JSM; -diff --git a/drivers/tty/serial/milbeaut_usio.c b/drivers/tty/serial/milbeaut_usio.c -index 70a910085e9375..9de3883a4e0b03 100644 ---- a/drivers/tty/serial/milbeaut_usio.c -+++ b/drivers/tty/serial/milbeaut_usio.c -@@ -522,7 +522,10 @@ static int mlb_usio_probe(struct platform_device *pdev) - } - port->membase = devm_ioremap(&pdev->dev, res->start, - resource_size(res)); -- -+ if (!port->membase) { -+ ret = -ENOMEM; -+ goto failed; -+ } - ret = platform_get_irq_byname(pdev, "rx"); - mlb_usio_irq[index][RX] = ret; - -diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c -index 61d8f50676b1bd..be7e57e1d1e36a 100644 ---- a/drivers/tty/serial/sh-sci.c -+++ b/drivers/tty/serial/sh-sci.c -@@ -174,6 +174,7 @@ struct sci_port { - - bool has_rtscts; - bool autorts; -+ bool tx_occurred; - }; - - #define SCI_NPORTS CONFIG_SERIAL_SH_SCI_NR_UARTS -@@ -182,6 +183,7 @@ static struct sci_port sci_ports[SCI_NPORTS]; - static unsigned long sci_ports_in_use; - static struct uart_driver sci_uart_driver; - static bool sci_uart_earlycon; -+static bool sci_uart_earlycon_dev_probing; - - static inline struct sci_port * - to_sci_port(struct uart_port *uart) -@@ -838,6 +840,7 @@ static void sci_transmit_chars(struct uart_port *port) - { - struct circ_buf *xmit = &port->state->xmit; - unsigned int stopped = uart_tx_stopped(port); -+ struct sci_port *s = to_sci_port(port); - unsigned short status; - unsigned short ctrl; - int count; -@@ -874,6 +877,7 @@ static void sci_transmit_chars(struct uart_port *port) - } - - serial_port_out(port, SCxTDR, c); -+ s->tx_occurred = true; - - port->icount.tx++; - } while (--count > 0); -@@ -1230,6 +1234,8 @@ static void sci_dma_tx_complete(void *arg) - if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) - uart_write_wakeup(port); - -+ s->tx_occurred = true; -+ - if (!uart_circ_empty(xmit)) { - s->cookie_tx = 0; - schedule_work(&s->work_tx); -@@ -1719,6 +1725,19 @@ static void sci_flush_buffer(struct uart_port *port) - s->cookie_tx = -EINVAL; - } - } -+ -+static void sci_dma_check_tx_occurred(struct sci_port *s) -+{ -+ struct dma_tx_state state; -+ enum dma_status status; -+ -+ if (!s->chan_tx) -+ return; -+ -+ status = dmaengine_tx_status(s->chan_tx, s->cookie_tx, &state); -+ if (status == DMA_COMPLETE || status == DMA_IN_PROGRESS) -+ s->tx_occurred = true; -+} - #else /* !CONFIG_SERIAL_SH_SCI_DMA */ - static inline void sci_request_dma(struct uart_port *port) - { -@@ -1728,6 +1747,10 @@ static inline void sci_free_dma(struct uart_port *port) - { - } - -+static void sci_dma_check_tx_occurred(struct sci_port *s) -+{ -+} -+ - #define sci_flush_buffer NULL - #endif /* !CONFIG_SERIAL_SH_SCI_DMA */ - -@@ -2064,6 +2087,12 @@ static unsigned int sci_tx_empty(struct uart_port *port) - { - unsigned short status = serial_port_in(port, SCxSR); - unsigned short in_tx_fifo = sci_txfill(port); -+ struct sci_port *s = to_sci_port(port); -+ -+ sci_dma_check_tx_occurred(s); -+ -+ if (!s->tx_occurred) -+ return TIOCSER_TEMT; - - return (status & SCxSR_TEND(port)) && !in_tx_fifo ? TIOCSER_TEMT : 0; - } -@@ -2234,6 +2263,7 @@ static int sci_startup(struct uart_port *port) - - dev_dbg(port->dev, "%s(%d)\n", __func__, port->line); - -+ s->tx_occurred = false; - sci_request_dma(port); - - ret = sci_request_irq(s); -@@ -3014,10 +3044,6 @@ static int sci_init_single(struct platform_device *dev, - ret = sci_init_clocks(sci_port, &dev->dev); - if (ret < 0) - return ret; -- -- port->dev = &dev->dev; -- -- pm_runtime_enable(&dev->dev); - } - - port->type = p->type; -@@ -3047,11 +3073,6 @@ static int sci_init_single(struct platform_device *dev, - return 0; - } - --static void sci_cleanup_single(struct sci_port *port) --{ -- pm_runtime_disable(port->port.dev); --} -- - #if defined(CONFIG_SERIAL_SH_SCI_CONSOLE) || \ - defined(CONFIG_SERIAL_SH_SCI_EARLYCON) - static void serial_console_putchar(struct uart_port *port, unsigned char ch) -@@ -3221,8 +3242,6 @@ static int sci_remove(struct platform_device *dev) - sci_ports_in_use &= ~BIT(port->port.line); - uart_remove_one_port(&sci_uart_driver, &port->port); - -- sci_cleanup_single(port); -- - if (port->port.fifosize > 1) - device_remove_file(&dev->dev, &dev_attr_rx_fifo_trigger); - if (type == PORT_SCIFA || type == PORT_SCIFB || type == PORT_HSCIF) -@@ -3356,7 +3375,8 @@ static struct plat_sci_port *sci_parse_dt(struct platform_device *pdev, - static int sci_probe_single(struct platform_device *dev, - unsigned int index, - struct plat_sci_port *p, -- struct sci_port *sciport) -+ struct sci_port *sciport, -+ struct resource *sci_res) - { - int ret; - -@@ -3385,6 +3405,11 @@ static int sci_probe_single(struct platform_device *dev, - if (ret) - return ret; - -+ sciport->port.dev = &dev->dev; -+ ret = devm_pm_runtime_enable(&dev->dev); -+ if (ret) -+ return ret; -+ - sciport->gpios = mctrl_gpio_init(&sciport->port, 0); - if (IS_ERR(sciport->gpios)) - return PTR_ERR(sciport->gpios); -@@ -3398,13 +3423,15 @@ static int sci_probe_single(struct platform_device *dev, - sciport->port.flags |= UPF_HARD_FLOW; - } - -- ret = uart_add_one_port(&sci_uart_driver, &sciport->port); -- if (ret) { -- sci_cleanup_single(sciport); -- return ret; -+ if (sci_uart_earlycon && sci_ports[0].port.mapbase == sci_res->start) { -+ /* -+ * Skip cleanup the sci_port[0] in early_console_exit(), this -+ * port is the same as the earlycon one. -+ */ -+ sci_uart_earlycon_dev_probing = true; - } - -- return 0; -+ return uart_add_one_port(&sci_uart_driver, &sciport->port); - } - - static int sci_probe(struct platform_device *dev) -@@ -3462,7 +3489,7 @@ static int sci_probe(struct platform_device *dev) - - platform_set_drvdata(dev, sp); - -- ret = sci_probe_single(dev, dev_id, p, sp); -+ ret = sci_probe_single(dev, dev_id, p, sp, res); - if (ret) - return ret; - -@@ -3619,6 +3646,22 @@ sh_early_platform_init_buffer("earlyprintk", &sci_driver, - #ifdef CONFIG_SERIAL_SH_SCI_EARLYCON - static struct plat_sci_port port_cfg; - -+static int early_console_exit(struct console *co) -+{ -+ struct sci_port *sci_port = &sci_ports[0]; -+ -+ /* -+ * Clean the slot used by earlycon. A new SCI device might -+ * map to this slot. -+ */ -+ if (!sci_uart_earlycon_dev_probing) { -+ memset(sci_port, 0, sizeof(*sci_port)); -+ sci_uart_earlycon = false; -+ } -+ -+ return 0; -+} -+ - static int __init early_console_setup(struct earlycon_device *device, - int type) - { -@@ -3638,6 +3681,8 @@ static int __init early_console_setup(struct earlycon_device *device, - SCSCR_RE | SCSCR_TE | port_cfg.scscr); - - device->con->write = serial_console_write; -+ device->con->exit = early_console_exit; -+ - return 0; - } - static int __init sci_early_console_setup(struct earlycon_device *device, -diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c -index 8c685b5014044b..5b21b60547da1f 100644 ---- a/drivers/tty/vt/vt_ioctl.c -+++ b/drivers/tty/vt/vt_ioctl.c -@@ -1105,8 +1105,6 @@ long vt_compat_ioctl(struct tty_struct *tty, - case VT_WAITACTIVE: - case VT_RELDISP: - case VT_DISALLOCATE: -- case VT_RESIZE: -- case VT_RESIZEX: - return vt_ioctl(tty, cmd, arg); - - /* -diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c -index 411109a5ebbffd..14864cfc242238 100644 ---- a/drivers/ufs/core/ufs-mcq.c -+++ b/drivers/ufs/core/ufs-mcq.c -@@ -629,7 +629,6 @@ int ufshcd_mcq_abort(struct scsi_cmnd *cmd) - int tag = scsi_cmd_to_rq(cmd)->tag; - struct ufshcd_lrb *lrbp = &hba->lrb[tag]; - struct ufs_hw_queue *hwq; -- unsigned long flags; - int err; - - /* Skip task abort in case previous aborts failed and report failure */ -@@ -668,10 +667,5 @@ int ufshcd_mcq_abort(struct scsi_cmnd *cmd) - return FAILED; - } - -- spin_lock_irqsave(&hwq->cq_lock, flags); -- if (ufshcd_cmd_inflight(lrbp->cmd)) -- ufshcd_release_scsi_cmd(hba, lrbp); -- spin_unlock_irqrestore(&hwq->cq_lock, flags); -- - return SUCCESS; - } -diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c -index 2346a1fc72b56e..9dabc03675b00a 100644 ---- a/drivers/ufs/core/ufshcd.c -+++ b/drivers/ufs/core/ufshcd.c -@@ -6500,9 +6500,14 @@ static void ufshcd_err_handler(struct work_struct *work) - up(&hba->host_sem); - return; - } -- ufshcd_set_eh_in_progress(hba); - spin_unlock_irqrestore(hba->host->host_lock, flags); -+ - ufshcd_err_handling_prepare(hba); -+ -+ spin_lock_irqsave(hba->host->host_lock, flags); -+ ufshcd_set_eh_in_progress(hba); -+ spin_unlock_irqrestore(hba->host->host_lock, flags); -+ - /* Complete requests that have door-bell cleared by h/w */ - ufshcd_complete_requests(hba, false); - spin_lock_irqsave(hba->host->host_lock, flags); -diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c -index c6417ef074a478..c94824c999ccd9 100644 ---- a/drivers/ufs/host/ufs-qcom.c -+++ b/drivers/ufs/host/ufs-qcom.c -@@ -453,10 +453,9 @@ static int ufs_qcom_power_up_sequence(struct ufs_hba *hba) - dev_warn(hba->dev, "%s: host reset returned %d\n", - __func__, ret); - -- if (phy->power_count) { -+ if (phy->power_count) - phy_power_off(phy); -- phy_exit(phy); -- } -+ - - /* phy initialization - calibrate the phy */ - ret = phy_init(phy); -diff --git a/drivers/usb/cdns3/cdnsp-gadget.c b/drivers/usb/cdns3/cdnsp-gadget.c -index 601a60a2802240..132885fbb98f67 100644 ---- a/drivers/usb/cdns3/cdnsp-gadget.c -+++ b/drivers/usb/cdns3/cdnsp-gadget.c -@@ -28,7 +28,8 @@ - unsigned int cdnsp_port_speed(unsigned int port_status) - { - /*Detect gadget speed based on PORTSC register*/ -- if (DEV_SUPERSPEEDPLUS(port_status)) -+ if (DEV_SUPERSPEEDPLUS(port_status) || -+ DEV_SSP_GEN1x2(port_status) || DEV_SSP_GEN2x2(port_status)) - return USB_SPEED_SUPER_PLUS; - else if (DEV_SUPERSPEED(port_status)) - return USB_SPEED_SUPER; -@@ -546,6 +547,7 @@ int cdnsp_wait_for_cmd_compl(struct cdnsp_device *pdev) - dma_addr_t cmd_deq_dma; - union cdnsp_trb *event; - u32 cycle_state; -+ u32 retry = 10; - int ret, val; - u64 cmd_dma; - u32 flags; -@@ -577,8 +579,23 @@ int cdnsp_wait_for_cmd_compl(struct cdnsp_device *pdev) - flags = le32_to_cpu(event->event_cmd.flags); - - /* Check the owner of the TRB. */ -- if ((flags & TRB_CYCLE) != cycle_state) -+ if ((flags & TRB_CYCLE) != cycle_state) { -+ /* -+ * Give some extra time to get chance controller -+ * to finish command before returning error code. -+ * Checking CMD_RING_BUSY is not sufficient because -+ * this bit is cleared to '0' when the Command -+ * Descriptor has been executed by controller -+ * and not when command completion event has -+ * be added to event ring. -+ */ -+ if (retry--) { -+ udelay(20); -+ continue; -+ } -+ - return -EINVAL; -+ } - - cmd_dma = le64_to_cpu(event->event_cmd.cmd_trb); - -diff --git a/drivers/usb/cdns3/cdnsp-gadget.h b/drivers/usb/cdns3/cdnsp-gadget.h -index ed84dbb9fd6fbc..909cee01772a70 100644 ---- a/drivers/usb/cdns3/cdnsp-gadget.h -+++ b/drivers/usb/cdns3/cdnsp-gadget.h -@@ -285,11 +285,15 @@ struct cdnsp_port_regs { - #define XDEV_HS (0x3 << 10) - #define XDEV_SS (0x4 << 10) - #define XDEV_SSP (0x5 << 10) -+#define XDEV_SSP1x2 (0x6 << 10) -+#define XDEV_SSP2x2 (0x7 << 10) - #define DEV_UNDEFSPEED(p) (((p) & DEV_SPEED_MASK) == (0x0 << 10)) - #define DEV_FULLSPEED(p) (((p) & DEV_SPEED_MASK) == XDEV_FS) - #define DEV_HIGHSPEED(p) (((p) & DEV_SPEED_MASK) == XDEV_HS) - #define DEV_SUPERSPEED(p) (((p) & DEV_SPEED_MASK) == XDEV_SS) - #define DEV_SUPERSPEEDPLUS(p) (((p) & DEV_SPEED_MASK) == XDEV_SSP) -+#define DEV_SSP_GEN1x2(p) (((p) & DEV_SPEED_MASK) == XDEV_SSP1x2) -+#define DEV_SSP_GEN2x2(p) (((p) & DEV_SPEED_MASK) == XDEV_SSP2x2) - #define DEV_SUPERSPEED_ANY(p) (((p) & DEV_SPEED_MASK) >= XDEV_SS) - #define DEV_PORT_SPEED(p) (((p) >> 10) & 0x0f) - /* Port Link State Write Strobe - set this when changing link state */ -diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c -index 2f92905e05cad0..ee45f3c74aecb5 100644 ---- a/drivers/usb/class/usbtmc.c -+++ b/drivers/usb/class/usbtmc.c -@@ -483,6 +483,7 @@ static int usbtmc_get_stb(struct usbtmc_file_data *file_data, __u8 *stb) - u8 tag; - int rv; - long wait_rv; -+ unsigned long expire; - - dev_dbg(dev, "Enter ioctl_read_stb iin_ep_present: %d\n", - data->iin_ep_present); -@@ -512,10 +513,11 @@ static int usbtmc_get_stb(struct usbtmc_file_data *file_data, __u8 *stb) - } - - if (data->iin_ep_present) { -+ expire = msecs_to_jiffies(file_data->timeout); - wait_rv = wait_event_interruptible_timeout( - data->waitq, - atomic_read(&data->iin_data_valid) != 0, -- file_data->timeout); -+ expire); - if (wait_rv < 0) { - dev_dbg(dev, "wait interrupted %ld\n", wait_rv); - rv = wait_rv; -@@ -563,14 +565,15 @@ static int usbtmc488_ioctl_read_stb(struct usbtmc_file_data *file_data, - - rv = usbtmc_get_stb(file_data, &stb); - -- if (rv > 0) { -- srq_asserted = atomic_xchg(&file_data->srq_asserted, -- srq_asserted); -- if (srq_asserted) -- stb |= 0x40; /* Set RQS bit */ -+ if (rv < 0) -+ return rv; -+ -+ srq_asserted = atomic_xchg(&file_data->srq_asserted, srq_asserted); -+ if (srq_asserted) -+ stb |= 0x40; /* Set RQS bit */ -+ -+ rv = put_user(stb, (__u8 __user *)arg); - -- rv = put_user(stb, (__u8 __user *)arg); -- } - return rv; - - } -@@ -2199,7 +2202,7 @@ static long usbtmc_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - - case USBTMC_IOCTL_GET_STB: - retval = usbtmc_get_stb(file_data, &tmp_byte); -- if (retval > 0) -+ if (!retval) - retval = put_user(tmp_byte, (__u8 __user *)arg); - break; - -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 760283a541b41b..855356752380b6 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -6103,6 +6103,7 @@ static int usb_reset_and_verify_device(struct usb_device *udev) - struct usb_hub *parent_hub; - struct usb_hcd *hcd = bus_to_hcd(udev->bus); - struct usb_device_descriptor descriptor; -+ struct usb_interface *intf; - struct usb_host_bos *bos; - int i, j, ret = 0; - int port1 = udev->portnum; -@@ -6160,6 +6161,18 @@ static int usb_reset_and_verify_device(struct usb_device *udev) - if (!udev->actconfig) - goto done; - -+ /* -+ * Some devices can't handle setting default altsetting 0 with a -+ * Set-Interface request. Disable host-side endpoints of those -+ * interfaces here. Enable and reset them back after host has set -+ * its internal endpoint structures during usb_hcd_alloc_bandwith() -+ */ -+ for (i = 0; i < udev->actconfig->desc.bNumInterfaces; i++) { -+ intf = udev->actconfig->interface[i]; -+ if (intf->cur_altsetting->desc.bAlternateSetting == 0) -+ usb_disable_interface(udev, intf, true); -+ } -+ - mutex_lock(hcd->bandwidth_mutex); - ret = usb_hcd_alloc_bandwidth(udev, udev->actconfig, NULL, NULL); - if (ret < 0) { -@@ -6191,12 +6204,11 @@ static int usb_reset_and_verify_device(struct usb_device *udev) - */ - for (i = 0; i < udev->actconfig->desc.bNumInterfaces; i++) { - struct usb_host_config *config = udev->actconfig; -- struct usb_interface *intf = config->interface[i]; - struct usb_interface_descriptor *desc; - -+ intf = config->interface[i]; - desc = &intf->cur_altsetting->desc; - if (desc->bAlternateSetting == 0) { -- usb_disable_interface(udev, intf, true); - usb_enable_interface(udev, intf, true); - ret = 0; - } else { -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 4903c733d37ae7..c979ecd0169a2d 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -372,6 +372,9 @@ static const struct usb_device_id usb_quirk_list[] = { - /* SanDisk Corp. SanDisk 3.2Gen1 */ - { USB_DEVICE(0x0781, 0x55a3), .driver_info = USB_QUIRK_DELAY_INIT }, - -+ /* SanDisk Extreme 55AE */ -+ { USB_DEVICE(0x0781, 0x55ae), .driver_info = USB_QUIRK_NO_LPM }, -+ - /* Realforce 87U Keyboard */ - { USB_DEVICE(0x0853, 0x011b), .driver_info = USB_QUIRK_NO_LPM }, - -diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c -index 2db01e03bfbf0b..2f1ec03d17d6db 100644 ---- a/drivers/usb/gadget/function/f_hid.c -+++ b/drivers/usb/gadget/function/f_hid.c -@@ -118,8 +118,8 @@ static struct hid_descriptor hidg_desc = { - .bcdHID = cpu_to_le16(0x0101), - .bCountryCode = 0x00, - .bNumDescriptors = 0x1, -- /*.desc[0].bDescriptorType = DYNAMIC */ -- /*.desc[0].wDescriptorLenght = DYNAMIC */ -+ /*.rpt_desc.bDescriptorType = DYNAMIC */ -+ /*.rpt_desc.wDescriptorLength = DYNAMIC */ - }; - - /* Super-Speed Support */ -@@ -728,8 +728,8 @@ static int hidg_setup(struct usb_function *f, - struct hid_descriptor hidg_desc_copy = hidg_desc; - - VDBG(cdev, "USB_REQ_GET_DESCRIPTOR: HID\n"); -- hidg_desc_copy.desc[0].bDescriptorType = HID_DT_REPORT; -- hidg_desc_copy.desc[0].wDescriptorLength = -+ hidg_desc_copy.rpt_desc.bDescriptorType = HID_DT_REPORT; -+ hidg_desc_copy.rpt_desc.wDescriptorLength = - cpu_to_le16(hidg->report_desc_length); - - length = min_t(unsigned short, length, -@@ -970,8 +970,8 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f) - * We can use hidg_desc struct here but we should not relay - * that its content won't change after returning from this function. - */ -- hidg_desc.desc[0].bDescriptorType = HID_DT_REPORT; -- hidg_desc.desc[0].wDescriptorLength = -+ hidg_desc.rpt_desc.bDescriptorType = HID_DT_REPORT; -+ hidg_desc.rpt_desc.wDescriptorLength = - cpu_to_le16(hidg->report_desc_length); - - hidg_hs_in_ep_desc.bEndpointAddress = -diff --git a/drivers/usb/renesas_usbhs/common.c b/drivers/usb/renesas_usbhs/common.c -index 205820544f6f9e..b720899725e537 100644 ---- a/drivers/usb/renesas_usbhs/common.c -+++ b/drivers/usb/renesas_usbhs/common.c -@@ -674,10 +674,29 @@ static int usbhs_probe(struct platform_device *pdev) - INIT_DELAYED_WORK(&priv->notify_hotplug_work, usbhsc_notify_hotplug); - spin_lock_init(usbhs_priv_to_lock(priv)); - -+ /* -+ * Acquire clocks and enable power management (PM) early in the -+ * probe process, as the driver accesses registers during -+ * initialization. Ensure the device is active before proceeding. -+ */ -+ pm_runtime_enable(dev); -+ -+ ret = usbhsc_clk_get(dev, priv); -+ if (ret) -+ goto probe_pm_disable; -+ -+ ret = pm_runtime_resume_and_get(dev); -+ if (ret) -+ goto probe_clk_put; -+ -+ ret = usbhsc_clk_prepare_enable(priv); -+ if (ret) -+ goto probe_pm_put; -+ - /* call pipe and module init */ - ret = usbhs_pipe_probe(priv); - if (ret < 0) -- return ret; -+ goto probe_clk_dis_unprepare; - - ret = usbhs_fifo_probe(priv); - if (ret < 0) -@@ -694,10 +713,6 @@ static int usbhs_probe(struct platform_device *pdev) - if (ret) - goto probe_fail_rst; - -- ret = usbhsc_clk_get(dev, priv); -- if (ret) -- goto probe_fail_clks; -- - /* - * deviece reset here because - * USB device might be used in boot loader. -@@ -710,7 +725,7 @@ static int usbhs_probe(struct platform_device *pdev) - if (ret) { - dev_warn(dev, "USB function not selected (GPIO)\n"); - ret = -ENOTSUPP; -- goto probe_end_mod_exit; -+ goto probe_assert_rest; - } - } - -@@ -724,14 +739,19 @@ static int usbhs_probe(struct platform_device *pdev) - ret = usbhs_platform_call(priv, hardware_init, pdev); - if (ret < 0) { - dev_err(dev, "platform init failed.\n"); -- goto probe_end_mod_exit; -+ goto probe_assert_rest; - } - - /* reset phy for connection */ - usbhs_platform_call(priv, phy_reset, pdev); - -- /* power control */ -- pm_runtime_enable(dev); -+ /* -+ * Disable the clocks that were enabled earlier in the probe path, -+ * and let the driver handle the clocks beyond this point. -+ */ -+ usbhsc_clk_disable_unprepare(priv); -+ pm_runtime_put(dev); -+ - if (!usbhs_get_dparam(priv, runtime_pwctrl)) { - usbhsc_power_ctrl(priv, 1); - usbhs_mod_autonomy_mode(priv); -@@ -748,9 +768,7 @@ static int usbhs_probe(struct platform_device *pdev) - - return ret; - --probe_end_mod_exit: -- usbhsc_clk_put(priv); --probe_fail_clks: -+probe_assert_rest: - reset_control_assert(priv->rsts); - probe_fail_rst: - usbhs_mod_remove(priv); -@@ -758,6 +776,14 @@ static int usbhs_probe(struct platform_device *pdev) - usbhs_fifo_remove(priv); - probe_end_pipe_exit: - usbhs_pipe_remove(priv); -+probe_clk_dis_unprepare: -+ usbhsc_clk_disable_unprepare(priv); -+probe_pm_put: -+ pm_runtime_put(dev); -+probe_clk_put: -+ usbhsc_clk_put(priv); -+probe_pm_disable: -+ pm_runtime_disable(dev); - - dev_info(dev, "probe failed (%d)\n", ret); - -diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c -index 8e327fcb222f73..1ba2287d4d456f 100644 ---- a/drivers/usb/serial/pl2303.c -+++ b/drivers/usb/serial/pl2303.c -@@ -457,6 +457,8 @@ static int pl2303_detect_type(struct usb_serial *serial) - case 0x605: - case 0x700: /* GR */ - case 0x705: -+ case 0x905: /* GT-2AB */ -+ case 0x1005: /* GC-Q20 */ - return TYPE_HXN; - } - break; -diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h -index d460d71b425783..1477e31d776327 100644 ---- a/drivers/usb/storage/unusual_uas.h -+++ b/drivers/usb/storage/unusual_uas.h -@@ -52,6 +52,13 @@ UNUSUAL_DEV(0x059f, 0x1061, 0x0000, 0x9999, - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_NO_REPORT_OPCODES | US_FL_NO_SAME), - -+/* Reported-by: Zhihong Zhou */ -+UNUSUAL_DEV(0x0781, 0x55e8, 0x0000, 0x9999, -+ "SanDisk", -+ "", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_IGNORE_UAS), -+ - /* Reported-by: Hongling Zeng */ - UNUSUAL_DEV(0x090c, 0x2000, 0x0000, 0x9999, - "Hiksemi", -diff --git a/drivers/usb/typec/tcpm/tcpci_maxim_core.c b/drivers/usb/typec/tcpm/tcpci_maxim_core.c -index 9454b12a073c96..e460b956ab7123 100644 ---- a/drivers/usb/typec/tcpm/tcpci_maxim_core.c -+++ b/drivers/usb/typec/tcpm/tcpci_maxim_core.c -@@ -145,7 +145,8 @@ static void process_rx(struct max_tcpci_chip *chip, u16 status) - return; - } - -- if (count > sizeof(struct pd_message) || count + 1 > TCPC_RECEIVE_BUFFER_LEN) { -+ if (count > sizeof(struct pd_message) + 1 || -+ count + 1 > TCPC_RECEIVE_BUFFER_LEN) { - dev_err(chip->dev, "Invalid TCPC_RX_BYTE_CNT %d\n", count); - return; - } -diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h -index 3bb23a2ea547ac..7706f4e951258b 100644 ---- a/drivers/usb/typec/ucsi/ucsi.h -+++ b/drivers/usb/typec/ucsi/ucsi.h -@@ -302,7 +302,7 @@ struct ucsi_debugfs_entry { - u64 low; - u64 high; - } response; -- u32 status; -+ int status; - struct dentry *dentry; - }; - -diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c -index 4d27465c8f1a89..712b178c42aae5 100644 ---- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c -+++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c -@@ -350,6 +350,32 @@ static int vf_qm_func_stop(struct hisi_qm *qm) - return hisi_qm_mb(qm, QM_MB_CMD_PAUSE_QM, 0, 0, 0); - } - -+static int vf_qm_version_check(struct acc_vf_data *vf_data, struct device *dev) -+{ -+ switch (vf_data->acc_magic) { -+ case ACC_DEV_MAGIC_V2: -+ if (vf_data->major_ver != ACC_DRV_MAJOR_VER) { -+ dev_info(dev, "migration driver version<%u.%u> not match!\n", -+ vf_data->major_ver, vf_data->minor_ver); -+ return -EINVAL; -+ } -+ break; -+ case ACC_DEV_MAGIC_V1: -+ /* Correct dma address */ -+ vf_data->eqe_dma = vf_data->qm_eqc_dw[QM_XQC_ADDR_HIGH]; -+ vf_data->eqe_dma <<= QM_XQC_ADDR_OFFSET; -+ vf_data->eqe_dma |= vf_data->qm_eqc_dw[QM_XQC_ADDR_LOW]; -+ vf_data->aeqe_dma = vf_data->qm_aeqc_dw[QM_XQC_ADDR_HIGH]; -+ vf_data->aeqe_dma <<= QM_XQC_ADDR_OFFSET; -+ vf_data->aeqe_dma |= vf_data->qm_aeqc_dw[QM_XQC_ADDR_LOW]; -+ break; -+ default: -+ return -EINVAL; -+ } -+ -+ return 0; -+} -+ - static int vf_qm_check_match(struct hisi_acc_vf_core_device *hisi_acc_vdev, - struct hisi_acc_vf_migration_file *migf) - { -@@ -363,7 +389,8 @@ static int vf_qm_check_match(struct hisi_acc_vf_core_device *hisi_acc_vdev, - if (migf->total_length < QM_MATCH_SIZE || hisi_acc_vdev->match_done) - return 0; - -- if (vf_data->acc_magic != ACC_DEV_MAGIC) { -+ ret = vf_qm_version_check(vf_data, dev); -+ if (ret) { - dev_err(dev, "failed to match ACC_DEV_MAGIC\n"); - return -EINVAL; - } -@@ -399,13 +426,6 @@ static int vf_qm_check_match(struct hisi_acc_vf_core_device *hisi_acc_vdev, - return -EINVAL; - } - -- ret = qm_write_regs(vf_qm, QM_VF_STATE, &vf_data->vf_qm_state, 1); -- if (ret) { -- dev_err(dev, "failed to write QM_VF_STATE\n"); -- return ret; -- } -- -- hisi_acc_vdev->vf_qm_state = vf_data->vf_qm_state; - hisi_acc_vdev->match_done = true; - return 0; - } -@@ -418,7 +438,9 @@ static int vf_qm_get_match_data(struct hisi_acc_vf_core_device *hisi_acc_vdev, - int vf_id = hisi_acc_vdev->vf_id; - int ret; - -- vf_data->acc_magic = ACC_DEV_MAGIC; -+ vf_data->acc_magic = ACC_DEV_MAGIC_V2; -+ vf_data->major_ver = ACC_DRV_MAJOR_VER; -+ vf_data->minor_ver = ACC_DRV_MINOR_VER; - /* Save device id */ - vf_data->dev_id = hisi_acc_vdev->vf_dev->device; - -@@ -441,6 +463,19 @@ static int vf_qm_get_match_data(struct hisi_acc_vf_core_device *hisi_acc_vdev, - return 0; - } - -+static void vf_qm_xeqc_save(struct hisi_qm *qm, -+ struct hisi_acc_vf_migration_file *migf) -+{ -+ struct acc_vf_data *vf_data = &migf->vf_data; -+ u16 eq_head, aeq_head; -+ -+ eq_head = vf_data->qm_eqc_dw[0] & 0xFFFF; -+ qm_db(qm, 0, QM_DOORBELL_CMD_EQ, eq_head, 0); -+ -+ aeq_head = vf_data->qm_aeqc_dw[0] & 0xFFFF; -+ qm_db(qm, 0, QM_DOORBELL_CMD_AEQ, aeq_head, 0); -+} -+ - static int vf_qm_load_data(struct hisi_acc_vf_core_device *hisi_acc_vdev, - struct hisi_acc_vf_migration_file *migf) - { -@@ -456,6 +491,20 @@ static int vf_qm_load_data(struct hisi_acc_vf_core_device *hisi_acc_vdev, - if (migf->total_length < sizeof(struct acc_vf_data)) - return -EINVAL; - -+ if (!vf_data->eqe_dma || !vf_data->aeqe_dma || -+ !vf_data->sqc_dma || !vf_data->cqc_dma) { -+ dev_info(dev, "resume dma addr is NULL!\n"); -+ hisi_acc_vdev->vf_qm_state = QM_NOT_READY; -+ return 0; -+ } -+ -+ ret = qm_write_regs(qm, QM_VF_STATE, &vf_data->vf_qm_state, 1); -+ if (ret) { -+ dev_err(dev, "failed to write QM_VF_STATE\n"); -+ return -EINVAL; -+ } -+ hisi_acc_vdev->vf_qm_state = vf_data->vf_qm_state; -+ - qm->eqe_dma = vf_data->eqe_dma; - qm->aeqe_dma = vf_data->aeqe_dma; - qm->sqc_dma = vf_data->sqc_dma; -@@ -516,12 +565,12 @@ static int vf_qm_state_save(struct hisi_acc_vf_core_device *hisi_acc_vdev, - return -EINVAL; - - /* Every reg is 32 bit, the dma address is 64 bit. */ -- vf_data->eqe_dma = vf_data->qm_eqc_dw[1]; -+ vf_data->eqe_dma = vf_data->qm_eqc_dw[QM_XQC_ADDR_HIGH]; - vf_data->eqe_dma <<= QM_XQC_ADDR_OFFSET; -- vf_data->eqe_dma |= vf_data->qm_eqc_dw[0]; -- vf_data->aeqe_dma = vf_data->qm_aeqc_dw[1]; -+ vf_data->eqe_dma |= vf_data->qm_eqc_dw[QM_XQC_ADDR_LOW]; -+ vf_data->aeqe_dma = vf_data->qm_aeqc_dw[QM_XQC_ADDR_HIGH]; - vf_data->aeqe_dma <<= QM_XQC_ADDR_OFFSET; -- vf_data->aeqe_dma |= vf_data->qm_aeqc_dw[0]; -+ vf_data->aeqe_dma |= vf_data->qm_aeqc_dw[QM_XQC_ADDR_LOW]; - - /* Through SQC_BT/CQC_BT to get sqc and cqc address */ - ret = qm_get_sqc(vf_qm, &vf_data->sqc_dma); -@@ -537,6 +586,9 @@ static int vf_qm_state_save(struct hisi_acc_vf_core_device *hisi_acc_vdev, - } - - migf->total_length = sizeof(struct acc_vf_data); -+ /* Save eqc and aeqc interrupt information */ -+ vf_qm_xeqc_save(vf_qm, migf); -+ - return 0; - } - -@@ -1352,6 +1404,7 @@ static int hisi_acc_vfio_pci_migrn_init_dev(struct vfio_device *core_vdev) - hisi_acc_vdev->vf_id = pci_iov_vf_id(pdev) + 1; - hisi_acc_vdev->pf_qm = pf_qm; - hisi_acc_vdev->vf_dev = pdev; -+ hisi_acc_vdev->vf_qm_state = QM_NOT_READY; - mutex_init(&hisi_acc_vdev->state_mutex); - - core_vdev->migration_flags = VFIO_MIGRATION_STOP_COPY | VFIO_MIGRATION_PRE_COPY; -diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.h b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.h -index dcabfeec6ca19d..f1d8fe86b6eb26 100644 ---- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.h -+++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.h -@@ -38,6 +38,9 @@ - #define QM_REG_ADDR_OFFSET 0x0004 - - #define QM_XQC_ADDR_OFFSET 32U -+#define QM_XQC_ADDR_LOW 0x1 -+#define QM_XQC_ADDR_HIGH 0x2 -+ - #define QM_VF_AEQ_INT_MASK 0x0004 - #define QM_VF_EQ_INT_MASK 0x000c - #define QM_IFC_INT_SOURCE_V 0x0020 -@@ -49,10 +52,15 @@ - #define QM_EQC_DW0 0X8000 - #define QM_AEQC_DW0 0X8020 - -+#define ACC_DRV_MAJOR_VER 1 -+#define ACC_DRV_MINOR_VER 0 -+ -+#define ACC_DEV_MAGIC_V1 0XCDCDCDCDFEEDAACC -+#define ACC_DEV_MAGIC_V2 0xAACCFEEDDECADEDE -+ - struct acc_vf_data { - #define QM_MATCH_SIZE offsetofend(struct acc_vf_data, qm_rsv_state) - /* QM match information */ --#define ACC_DEV_MAGIC 0XCDCDCDCDFEEDAACC - u64 acc_magic; - u32 qp_num; - u32 dev_id; -@@ -60,7 +68,9 @@ struct acc_vf_data { - u32 qp_base; - u32 vf_qm_state; - /* QM reserved match information */ -- u32 qm_rsv_state[3]; -+ u16 major_ver; -+ u16 minor_ver; -+ u32 qm_rsv_state[2]; - - /* QM RW regs */ - u32 aeq_int_mask; -diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c -index eacd6ec04de5a4..5fe7aed3672eea 100644 ---- a/drivers/vfio/vfio_iommu_type1.c -+++ b/drivers/vfio/vfio_iommu_type1.c -@@ -294,7 +294,7 @@ static int vfio_dma_bitmap_alloc_all(struct vfio_iommu *iommu, size_t pgsize) - struct rb_node *p; - - for (p = rb_prev(n); p; p = rb_prev(p)) { -- struct vfio_dma *dma = rb_entry(n, -+ struct vfio_dma *dma = rb_entry(p, - struct vfio_dma, node); - - vfio_dma_bitmap_free(dma); -diff --git a/drivers/video/backlight/qcom-wled.c b/drivers/video/backlight/qcom-wled.c -index 10129095a4c178..b19e5f73de8bb4 100644 ---- a/drivers/video/backlight/qcom-wled.c -+++ b/drivers/video/backlight/qcom-wled.c -@@ -1406,9 +1406,11 @@ static int wled_configure(struct wled *wled) - wled->ctrl_addr = be32_to_cpu(*prop_addr); - - rc = of_property_read_string(dev->of_node, "label", &wled->name); -- if (rc) -+ if (rc) { - wled->name = devm_kasprintf(dev, GFP_KERNEL, "%pOFn", dev->of_node); -- -+ if (!wled->name) -+ return -ENOMEM; -+ } - switch (wled->version) { - case 3: - u32_opts = wled3_opts; -diff --git a/drivers/video/fbdev/core/fbcvt.c b/drivers/video/fbdev/core/fbcvt.c -index 64843464c66135..cd3821bd82e566 100644 ---- a/drivers/video/fbdev/core/fbcvt.c -+++ b/drivers/video/fbdev/core/fbcvt.c -@@ -312,7 +312,7 @@ int fb_find_mode_cvt(struct fb_videomode *mode, int margins, int rb) - cvt.f_refresh = cvt.refresh; - cvt.interlace = 1; - -- if (!cvt.xres || !cvt.yres || !cvt.refresh) { -+ if (!cvt.xres || !cvt.yres || !cvt.refresh || cvt.f_refresh > INT_MAX) { - printk(KERN_INFO "fbcvt: Invalid input parameters\n"); - return 1; - } -diff --git a/drivers/watchdog/exar_wdt.c b/drivers/watchdog/exar_wdt.c -index 7c61ff34327116..c2e3bb08df899a 100644 ---- a/drivers/watchdog/exar_wdt.c -+++ b/drivers/watchdog/exar_wdt.c -@@ -221,7 +221,7 @@ static const struct watchdog_info exar_wdt_info = { - .options = WDIOF_KEEPALIVEPING | - WDIOF_SETTIMEOUT | - WDIOF_MAGICCLOSE, -- .identity = "Exar/MaxLinear XR28V38x Watchdog", -+ .identity = "Exar XR28V38x Watchdog", - }; - - static const struct watchdog_ops exar_wdt_ops = { -diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c -index b0b52fa8fba6da..204ec1bcbd526a 100644 ---- a/drivers/xen/balloon.c -+++ b/drivers/xen/balloon.c -@@ -696,15 +696,18 @@ static int __init balloon_add_regions(void) - - /* - * Extra regions are accounted for in the physmap, but need -- * decreasing from current_pages to balloon down the initial -- * allocation, because they are already accounted for in -- * total_pages. -+ * decreasing from current_pages and target_pages to balloon -+ * down the initial allocation, because they are already -+ * accounted for in total_pages. - */ -- if (extra_pfn_end - start_pfn >= balloon_stats.current_pages) { -+ pages = extra_pfn_end - start_pfn; -+ if (pages >= balloon_stats.current_pages || -+ pages >= balloon_stats.target_pages) { - WARN(1, "Extra pages underflow current target"); - return -ERANGE; - } -- balloon_stats.current_pages -= extra_pfn_end - start_pfn; -+ balloon_stats.current_pages -= pages; -+ balloon_stats.target_pages -= pages; - } - - return 0; -diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c -index da49bdb70375b6..7632d652a1257d 100644 ---- a/fs/btrfs/scrub.c -+++ b/fs/btrfs/scrub.c -@@ -153,12 +153,14 @@ struct scrub_stripe { - unsigned int init_nr_io_errors; - unsigned int init_nr_csum_errors; - unsigned int init_nr_meta_errors; -+ unsigned int init_nr_meta_gen_errors; - - /* - * The following error bitmaps are all for the current status. - * Every time we submit a new read, these bitmaps may be updated. - * -- * error_bitmap = io_error_bitmap | csum_error_bitmap | meta_error_bitmap; -+ * error_bitmap = io_error_bitmap | csum_error_bitmap | -+ * meta_error_bitmap | meta_generation_bitmap; - * - * IO and csum errors can happen for both metadata and data. - */ -@@ -166,6 +168,7 @@ struct scrub_stripe { - unsigned long io_error_bitmap; - unsigned long csum_error_bitmap; - unsigned long meta_error_bitmap; -+ unsigned long meta_gen_error_bitmap; - - /* For writeback (repair or replace) error reporting. */ - unsigned long write_error_bitmap; -@@ -617,7 +620,7 @@ static void scrub_verify_one_metadata(struct scrub_stripe *stripe, int sector_nr - memcpy(on_disk_csum, header->csum, fs_info->csum_size); - - if (logical != btrfs_stack_header_bytenr(header)) { -- bitmap_set(&stripe->csum_error_bitmap, sector_nr, sectors_per_tree); -+ bitmap_set(&stripe->meta_error_bitmap, sector_nr, sectors_per_tree); - bitmap_set(&stripe->error_bitmap, sector_nr, sectors_per_tree); - btrfs_warn_rl(fs_info, - "tree block %llu mirror %u has bad bytenr, has %llu want %llu", -@@ -673,7 +676,7 @@ static void scrub_verify_one_metadata(struct scrub_stripe *stripe, int sector_nr - } - if (stripe->sectors[sector_nr].generation != - btrfs_stack_header_generation(header)) { -- bitmap_set(&stripe->meta_error_bitmap, sector_nr, sectors_per_tree); -+ bitmap_set(&stripe->meta_gen_error_bitmap, sector_nr, sectors_per_tree); - bitmap_set(&stripe->error_bitmap, sector_nr, sectors_per_tree); - btrfs_warn_rl(fs_info, - "tree block %llu mirror %u has bad generation, has %llu want %llu", -@@ -685,6 +688,7 @@ static void scrub_verify_one_metadata(struct scrub_stripe *stripe, int sector_nr - bitmap_clear(&stripe->error_bitmap, sector_nr, sectors_per_tree); - bitmap_clear(&stripe->csum_error_bitmap, sector_nr, sectors_per_tree); - bitmap_clear(&stripe->meta_error_bitmap, sector_nr, sectors_per_tree); -+ bitmap_clear(&stripe->meta_gen_error_bitmap, sector_nr, sectors_per_tree); - } - - static void scrub_verify_one_sector(struct scrub_stripe *stripe, int sector_nr) -@@ -973,8 +977,22 @@ static void scrub_stripe_report_errors(struct scrub_ctx *sctx, - if (__ratelimit(&rs) && dev) - scrub_print_common_warning("header error", dev, false, - stripe->logical, physical); -+ if (test_bit(sector_nr, &stripe->meta_gen_error_bitmap)) -+ if (__ratelimit(&rs) && dev) -+ scrub_print_common_warning("generation error", dev, false, -+ stripe->logical, physical); - } - -+ /* Update the device stats. */ -+ for (int i = 0; i < stripe->init_nr_io_errors; i++) -+ btrfs_dev_stat_inc_and_print(stripe->dev, BTRFS_DEV_STAT_READ_ERRS); -+ for (int i = 0; i < stripe->init_nr_csum_errors; i++) -+ btrfs_dev_stat_inc_and_print(stripe->dev, BTRFS_DEV_STAT_CORRUPTION_ERRS); -+ /* Generation mismatch error is based on each metadata, not each block. */ -+ for (int i = 0; i < stripe->init_nr_meta_gen_errors; -+ i += (fs_info->nodesize >> fs_info->sectorsize_bits)) -+ btrfs_dev_stat_inc_and_print(stripe->dev, BTRFS_DEV_STAT_GENERATION_ERRS); -+ - spin_lock(&sctx->stat_lock); - sctx->stat.data_extents_scrubbed += stripe->nr_data_extents; - sctx->stat.tree_extents_scrubbed += stripe->nr_meta_extents; -@@ -983,7 +1001,8 @@ static void scrub_stripe_report_errors(struct scrub_ctx *sctx, - sctx->stat.no_csum += nr_nodatacsum_sectors; - sctx->stat.read_errors += stripe->init_nr_io_errors; - sctx->stat.csum_errors += stripe->init_nr_csum_errors; -- sctx->stat.verify_errors += stripe->init_nr_meta_errors; -+ sctx->stat.verify_errors += stripe->init_nr_meta_errors + -+ stripe->init_nr_meta_gen_errors; - sctx->stat.uncorrectable_errors += - bitmap_weight(&stripe->error_bitmap, stripe->nr_sectors); - sctx->stat.corrected_errors += nr_repaired_sectors; -@@ -1029,6 +1048,8 @@ static void scrub_stripe_read_repair_worker(struct work_struct *work) - stripe->nr_sectors); - stripe->init_nr_meta_errors = bitmap_weight(&stripe->meta_error_bitmap, - stripe->nr_sectors); -+ stripe->init_nr_meta_gen_errors = bitmap_weight(&stripe->meta_gen_error_bitmap, -+ stripe->nr_sectors); - - if (bitmap_empty(&stripe->init_error_bitmap, stripe->nr_sectors)) - goto out; -@@ -1143,6 +1164,9 @@ static void scrub_write_endio(struct btrfs_bio *bbio) - bitmap_set(&stripe->write_error_bitmap, sector_nr, - bio_size >> fs_info->sectorsize_bits); - spin_unlock_irqrestore(&stripe->write_error_lock, flags); -+ for (int i = 0; i < (bio_size >> fs_info->sectorsize_bits); i++) -+ btrfs_dev_stat_inc_and_print(stripe->dev, -+ BTRFS_DEV_STAT_WRITE_ERRS); - } - bio_put(&bbio->bio); - -@@ -1505,10 +1529,12 @@ static void scrub_stripe_reset_bitmaps(struct scrub_stripe *stripe) - stripe->init_nr_io_errors = 0; - stripe->init_nr_csum_errors = 0; - stripe->init_nr_meta_errors = 0; -+ stripe->init_nr_meta_gen_errors = 0; - stripe->error_bitmap = 0; - stripe->io_error_bitmap = 0; - stripe->csum_error_bitmap = 0; - stripe->meta_error_bitmap = 0; -+ stripe->meta_gen_error_bitmap = 0; - } - - /* -diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c -index acd0764b0286c8..a123bb26acd8bd 100644 ---- a/fs/f2fs/data.c -+++ b/fs/f2fs/data.c -@@ -54,8 +54,8 @@ bool f2fs_is_cp_guaranteed(struct page *page) - struct inode *inode; - struct f2fs_sb_info *sbi; - -- if (!mapping) -- return false; -+ if (fscrypt_is_bounce_page(page)) -+ return page_private_gcing(fscrypt_pagecache_page(page)); - - inode = mapping->host; - sbi = F2FS_I_SB(inode); -diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h -index 5f6f159be456ea..911c4c64d729d3 100644 ---- a/fs/f2fs/f2fs.h -+++ b/fs/f2fs/f2fs.h -@@ -2474,8 +2474,14 @@ static inline void dec_valid_block_count(struct f2fs_sb_info *sbi, - blkcnt_t sectors = count << F2FS_LOG_SECTORS_PER_BLOCK; - - spin_lock(&sbi->stat_lock); -- f2fs_bug_on(sbi, sbi->total_valid_block_count < (block_t) count); -- sbi->total_valid_block_count -= (block_t)count; -+ if (unlikely(sbi->total_valid_block_count < count)) { -+ f2fs_warn(sbi, "Inconsistent total_valid_block_count:%u, ino:%lu, count:%u", -+ sbi->total_valid_block_count, inode->i_ino, count); -+ sbi->total_valid_block_count = 0; -+ set_sbi_flag(sbi, SBI_NEED_FSCK); -+ } else { -+ sbi->total_valid_block_count -= count; -+ } - if (sbi->reserved_blocks && - sbi->current_reserved_blocks < sbi->reserved_blocks) - sbi->current_reserved_blocks = min(sbi->reserved_blocks, -diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c -index 2e08e1fdf485c7..4d6f0a6365fe19 100644 ---- a/fs/f2fs/namei.c -+++ b/fs/f2fs/namei.c -@@ -411,7 +411,7 @@ static int f2fs_link(struct dentry *old_dentry, struct inode *dir, - - if (is_inode_flag_set(dir, FI_PROJ_INHERIT) && - (!projid_eq(F2FS_I(dir)->i_projid, -- F2FS_I(old_dentry->d_inode)->i_projid))) -+ F2FS_I(inode)->i_projid))) - return -EXDEV; - - err = f2fs_dquot_initialize(dir); -@@ -905,7 +905,7 @@ static int f2fs_rename(struct mnt_idmap *idmap, struct inode *old_dir, - - if (is_inode_flag_set(new_dir, FI_PROJ_INHERIT) && - (!projid_eq(F2FS_I(new_dir)->i_projid, -- F2FS_I(old_dentry->d_inode)->i_projid))) -+ F2FS_I(old_inode)->i_projid))) - return -EXDEV; - - /* -@@ -1101,10 +1101,10 @@ static int f2fs_cross_rename(struct inode *old_dir, struct dentry *old_dentry, - - if ((is_inode_flag_set(new_dir, FI_PROJ_INHERIT) && - !projid_eq(F2FS_I(new_dir)->i_projid, -- F2FS_I(old_dentry->d_inode)->i_projid)) || -- (is_inode_flag_set(new_dir, FI_PROJ_INHERIT) && -+ F2FS_I(old_inode)->i_projid)) || -+ (is_inode_flag_set(old_dir, FI_PROJ_INHERIT) && - !projid_eq(F2FS_I(old_dir)->i_projid, -- F2FS_I(new_dentry->d_inode)->i_projid))) -+ F2FS_I(new_inode)->i_projid))) - return -EXDEV; - - err = f2fs_dquot_initialize(old_dir); -diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c -index 4cc87921aac3ed..6b3cafbe98672e 100644 ---- a/fs/f2fs/super.c -+++ b/fs/f2fs/super.c -@@ -1849,9 +1849,9 @@ static int f2fs_statfs(struct dentry *dentry, struct kstatfs *buf) - buf->f_fsid = u64_to_fsid(id); - - #ifdef CONFIG_QUOTA -- if (is_inode_flag_set(dentry->d_inode, FI_PROJ_INHERIT) && -+ if (is_inode_flag_set(d_inode(dentry), FI_PROJ_INHERIT) && - sb_has_quota_limits_enabled(sb, PRJQUOTA)) { -- f2fs_statfs_project(sb, F2FS_I(dentry->d_inode)->i_projid, buf); -+ f2fs_statfs_project(sb, F2FS_I(d_inode(dentry))->i_projid, buf); - } - #endif - return 0; -diff --git a/fs/filesystems.c b/fs/filesystems.c -index 58b9067b2391ce..95e5256821a534 100644 ---- a/fs/filesystems.c -+++ b/fs/filesystems.c -@@ -156,15 +156,19 @@ static int fs_index(const char __user * __name) - static int fs_name(unsigned int index, char __user * buf) - { - struct file_system_type * tmp; -- int len, res; -+ int len, res = -EINVAL; - - read_lock(&file_systems_lock); -- for (tmp = file_systems; tmp; tmp = tmp->next, index--) -- if (index <= 0 && try_module_get(tmp->owner)) -+ for (tmp = file_systems; tmp; tmp = tmp->next, index--) { -+ if (index == 0) { -+ if (try_module_get(tmp->owner)) -+ res = 0; - break; -+ } -+ } - read_unlock(&file_systems_lock); -- if (!tmp) -- return -EINVAL; -+ if (res) -+ return res; - - /* OK, we got the reference, so we can safely block */ - len = strlen(tmp->name) + 1; -diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c -index 29085643ad104e..1cb5ce63fbf697 100644 ---- a/fs/gfs2/inode.c -+++ b/fs/gfs2/inode.c -@@ -658,7 +658,8 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry, - if (!IS_ERR(inode)) { - if (S_ISDIR(inode->i_mode)) { - iput(inode); -- inode = ERR_PTR(-EISDIR); -+ inode = NULL; -+ error = -EISDIR; - goto fail_gunlock; - } - d_instantiate(dentry, inode); -diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c -index b068ed32d7b32d..f6e2a4523f7e66 100644 ---- a/fs/kernfs/dir.c -+++ b/fs/kernfs/dir.c -@@ -1560,8 +1560,9 @@ void kernfs_break_active_protection(struct kernfs_node *kn) - * invoked before finishing the kernfs operation. Note that while this - * function restores the active reference, it doesn't and can't actually - * restore the active protection - @kn may already or be in the process of -- * being removed. Once kernfs_break_active_protection() is invoked, that -- * protection is irreversibly gone for the kernfs operation instance. -+ * being drained and removed. Once kernfs_break_active_protection() is -+ * invoked, that protection is irreversibly gone for the kernfs operation -+ * instance. - * - * While this function may be called at any point after - * kernfs_break_active_protection() is invoked, its most useful location -diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c -index 332d08d2fe0d56..6b90fea6cca209 100644 ---- a/fs/kernfs/file.c -+++ b/fs/kernfs/file.c -@@ -820,8 +820,9 @@ bool kernfs_should_drain_open_files(struct kernfs_node *kn) - /* - * @kn being deactivated guarantees that @kn->attr.open can't change - * beneath us making the lockless test below safe. -+ * Callers post kernfs_unbreak_active_protection may be counted in -+ * kn->active by now, do not WARN_ON because of them. - */ -- WARN_ON_ONCE(atomic_read(&kn->active) != KN_DEACTIVATED_BIAS); - - rcu_read_lock(); - on = rcu_dereference(kn->attr.open); -diff --git a/fs/namespace.c b/fs/namespace.c -index ef3b2ae2957ec3..eab9185e228584 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -2557,6 +2557,10 @@ static int do_change_type(struct path *path, int ms_flags) - return -EINVAL; - - namespace_lock(); -+ if (!check_mnt(mnt)) { -+ err = -EINVAL; -+ goto out_unlock; -+ } - if (type == MS_SHARED) { - err = invent_group_ids(mnt, recurse); - if (err) -@@ -2995,7 +2999,7 @@ static int do_set_group(struct path *from_path, struct path *to_path) - if (IS_MNT_SLAVE(from)) { - struct mount *m = from->mnt_master; - -- list_add(&to->mnt_slave, &m->mnt_slave_list); -+ list_add(&to->mnt_slave, &from->mnt_slave); - to->mnt_master = m; - } - -@@ -3020,18 +3024,25 @@ static int do_set_group(struct path *from_path, struct path *to_path) - * Check if path is overmounted, i.e., if there's a mount on top of - * @path->mnt with @path->dentry as mountpoint. - * -- * Context: This function expects namespace_lock() to be held. -+ * Context: namespace_sem must be held at least shared. -+ * MUST NOT be called under lock_mount_hash() (there one should just -+ * call __lookup_mnt() and check if it returns NULL). - * Return: If path is overmounted true is returned, false if not. - */ - static inline bool path_overmounted(const struct path *path) - { -+ unsigned seq = read_seqbegin(&mount_lock); -+ bool no_child; -+ - rcu_read_lock(); -- if (unlikely(__lookup_mnt(path->mnt, path->dentry))) { -- rcu_read_unlock(); -- return true; -- } -+ no_child = !__lookup_mnt(path->mnt, path->dentry); - rcu_read_unlock(); -- return false; -+ if (need_seqretry(&mount_lock, seq)) { -+ read_seqlock_excl(&mount_lock); -+ no_child = !__lookup_mnt(path->mnt, path->dentry); -+ read_sequnlock_excl(&mount_lock); -+ } -+ return unlikely(!no_child); - } - - /** -diff --git a/fs/nfs/super.c b/fs/nfs/super.c -index e1bcad5906ae7b..4e72ee57fc8fc2 100644 ---- a/fs/nfs/super.c -+++ b/fs/nfs/super.c -@@ -1020,6 +1020,16 @@ int nfs_reconfigure(struct fs_context *fc) - - sync_filesystem(sb); - -+ /* -+ * The SB_RDONLY flag has been removed from the superblock during -+ * mounts to prevent interference between different filesystems. -+ * Similarly, it is also necessary to ignore the SB_RDONLY flag -+ * during reconfiguration; otherwise, it may also result in the -+ * creation of redundant superblocks when mounting a directory with -+ * different rw and ro flags multiple times. -+ */ -+ fc->sb_flags_mask &= ~SB_RDONLY; -+ - /* - * Userspace mount programs that send binary options generally send - * them populated with default values. We have no way to know which -@@ -1277,8 +1287,17 @@ int nfs_get_tree_common(struct fs_context *fc) - if (IS_ERR(server)) - return PTR_ERR(server); - -+ /* -+ * When NFS_MOUNT_UNSHARED is not set, NFS forces the sharing of a -+ * superblock among each filesystem that mounts sub-directories -+ * belonging to a single exported root path. -+ * To prevent interference between different filesystems, the -+ * SB_RDONLY flag should be removed from the superblock. -+ */ - if (server->flags & NFS_MOUNT_UNSHARED) - compare_super = NULL; -+ else -+ fc->sb_flags &= ~SB_RDONLY; - - /* -o noac implies -o sync */ - if (server->flags & NFS_MOUNT_NOAC) -diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c -index dbd27a44632fa9..5e70a3478afe09 100644 ---- a/fs/nilfs2/btree.c -+++ b/fs/nilfs2/btree.c -@@ -2094,11 +2094,13 @@ static int nilfs_btree_propagate(struct nilfs_bmap *btree, - - ret = nilfs_btree_do_lookup(btree, path, key, NULL, level + 1, 0); - if (ret < 0) { -- if (unlikely(ret == -ENOENT)) -+ if (unlikely(ret == -ENOENT)) { - nilfs_crit(btree->b_inode->i_sb, - "writing node/leaf block does not appear in b-tree (ino=%lu) at key=%llu, level=%d", - btree->b_inode->i_ino, - (unsigned long long)key, level); -+ ret = -EINVAL; -+ } - goto out; - } - -diff --git a/fs/nilfs2/direct.c b/fs/nilfs2/direct.c -index 893ab36824cc2b..2d8dc6b35b5477 100644 ---- a/fs/nilfs2/direct.c -+++ b/fs/nilfs2/direct.c -@@ -273,6 +273,9 @@ static int nilfs_direct_propagate(struct nilfs_bmap *bmap, - dat = nilfs_bmap_get_dat(bmap); - key = nilfs_bmap_data_get_key(bmap, bh); - ptr = nilfs_direct_get_ptr(bmap, key); -+ if (ptr == NILFS_BMAP_INVALID_PTR) -+ return -EINVAL; -+ - if (!buffer_nilfs_volatile(bh)) { - oldreq.pr_entry_nr = ptr; - newreq.pr_entry_nr = ptr; -diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c -index 28aae6ea1e615e..191b91ffadbb21 100644 ---- a/fs/ntfs3/index.c -+++ b/fs/ntfs3/index.c -@@ -2184,6 +2184,10 @@ static int indx_get_entry_to_replace(struct ntfs_index *indx, - - e = hdr_first_de(&n->index->ihdr); - fnd_push(fnd, n, e); -+ if (!e) { -+ err = -EINVAL; -+ goto out; -+ } - - if (!de_is_last(e)) { - /* -@@ -2205,6 +2209,10 @@ static int indx_get_entry_to_replace(struct ntfs_index *indx, - - n = fnd->nodes[level]; - te = hdr_first_de(&n->index->ihdr); -+ if (!te) { -+ err = -EINVAL; -+ goto out; -+ } - /* Copy the candidate entry into the replacement entry buffer. */ - re = kmalloc(le16_to_cpu(te->size) + sizeof(u64), GFP_NOFS); - if (!re) { -diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c -index 0ca8975a1df479..c7bda48b5fb21c 100644 ---- a/fs/ocfs2/quota_local.c -+++ b/fs/ocfs2/quota_local.c -@@ -671,7 +671,7 @@ int ocfs2_finish_quota_recovery(struct ocfs2_super *osb, - break; - } - out: -- kfree(rec); -+ ocfs2_free_quota_recovery(rec); - return status; - } - -diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c -index b91184ebce02c5..c36ab20050c16d 100644 ---- a/fs/smb/client/cifssmb.c -+++ b/fs/smb/client/cifssmb.c -@@ -2738,10 +2738,10 @@ int cifs_query_reparse_point(const unsigned int xid, - - io_req->TotalParameterCount = 0; - io_req->TotalDataCount = 0; -- io_req->MaxParameterCount = cpu_to_le32(2); -+ io_req->MaxParameterCount = cpu_to_le32(0); - /* BB find exact data count max from sess structure BB */ - io_req->MaxDataCount = cpu_to_le32(CIFSMaxBufSize & 0xFFFFFF00); -- io_req->MaxSetupCount = 4; -+ io_req->MaxSetupCount = 1; - io_req->Reserved = 0; - io_req->ParameterOffset = 0; - io_req->DataCount = 0; -@@ -2768,6 +2768,22 @@ int cifs_query_reparse_point(const unsigned int xid, - goto error; - } - -+ /* SetupCount must be 1, otherwise offset to ByteCount is incorrect. */ -+ if (io_rsp->SetupCount != 1) { -+ rc = -EIO; -+ goto error; -+ } -+ -+ /* -+ * ReturnedDataLen is output length of executed IOCTL. -+ * DataCount is output length transferred over network. -+ * Check that we have full FSCTL_GET_REPARSE_POINT buffer. -+ */ -+ if (data_count != le16_to_cpu(io_rsp->ReturnedDataLen)) { -+ rc = -EIO; -+ goto error; -+ } -+ - end = 2 + get_bcc(&io_rsp->hdr) + (__u8 *)&io_rsp->ByteCount; - start = (__u8 *)&io_rsp->hdr.Protocol + data_offset; - if (start >= end) { -diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c -index 22e812808e5cf9..3a27d4268b3c4a 100644 ---- a/fs/squashfs/super.c -+++ b/fs/squashfs/super.c -@@ -202,6 +202,11 @@ static int squashfs_fill_super(struct super_block *sb, struct fs_context *fc) - msblk->panic_on_errors = (opts->errors == Opt_errors_panic); - - msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); -+ if (!msblk->devblksize) { -+ errorf(fc, "squashfs: unable to set blocksize\n"); -+ return -EINVAL; -+ } -+ - msblk->devblksize_log2 = ffz(~msblk->devblksize); - - mutex_init(&msblk->meta_index_mutex); -diff --git a/include/linux/arm_sdei.h b/include/linux/arm_sdei.h -index 255701e1251b4a..f652a5028b5907 100644 ---- a/include/linux/arm_sdei.h -+++ b/include/linux/arm_sdei.h -@@ -46,12 +46,12 @@ int sdei_unregister_ghes(struct ghes *ghes); - /* For use by arch code when CPU hotplug notifiers are not appropriate. */ - int sdei_mask_local_cpu(void); - int sdei_unmask_local_cpu(void); --void __init sdei_init(void); -+void __init acpi_sdei_init(void); - void sdei_handler_abort(void); - #else - static inline int sdei_mask_local_cpu(void) { return 0; } - static inline int sdei_unmask_local_cpu(void) { return 0; } --static inline void sdei_init(void) { } -+static inline void acpi_sdei_init(void) { } - static inline void sdei_handler_abort(void) { } - #endif /* CONFIG_ARM_SDE_INTERFACE */ - -diff --git a/include/linux/bio.h b/include/linux/bio.h -index b893418c3cc022..f193aef4fac08d 100644 ---- a/include/linux/bio.h -+++ b/include/linux/bio.h -@@ -294,7 +294,7 @@ static inline void bio_first_folio(struct folio_iter *fi, struct bio *bio, - - fi->folio = page_folio(bvec->bv_page); - fi->offset = bvec->bv_offset + -- PAGE_SIZE * (bvec->bv_page - &fi->folio->page); -+ PAGE_SIZE * folio_page_idx(fi->folio, bvec->bv_page); - fi->_seg_count = bvec->bv_len; - fi->length = min(folio_size(fi->folio) - fi->offset, fi->_seg_count); - fi->_next = folio_next(fi->folio); -diff --git a/include/linux/bvec.h b/include/linux/bvec.h -index bd1e361b351c5a..99ab7b2bba27cd 100644 ---- a/include/linux/bvec.h -+++ b/include/linux/bvec.h -@@ -57,9 +57,12 @@ static inline void bvec_set_page(struct bio_vec *bv, struct page *page, - * @offset: offset into the folio - */ - static inline void bvec_set_folio(struct bio_vec *bv, struct folio *folio, -- unsigned int len, unsigned int offset) -+ size_t len, size_t offset) - { -- bvec_set_page(bv, &folio->page, len, offset); -+ unsigned long nr = offset / PAGE_SIZE; -+ -+ WARN_ON_ONCE(len > UINT_MAX); -+ bvec_set_page(bv, folio_page(folio, nr), len, offset % PAGE_SIZE); - } - - /** -diff --git a/include/linux/hid.h b/include/linux/hid.h -index 38e161a827bde9..5d37e2349fae81 100644 ---- a/include/linux/hid.h -+++ b/include/linux/hid.h -@@ -736,8 +736,9 @@ struct hid_descriptor { - __le16 bcdHID; - __u8 bCountryCode; - __u8 bNumDescriptors; -+ struct hid_class_descriptor rpt_desc; - -- struct hid_class_descriptor desc[1]; -+ struct hid_class_descriptor opt_descs[]; - } __attribute__ ((packed)); - - #define HID_DEVICE(b, g, ven, prod) \ -diff --git a/include/linux/io_uring_types.h b/include/linux/io_uring_types.h -index 0fadef2983e01b..dad2f9e4d53d66 100644 ---- a/include/linux/io_uring_types.h -+++ b/include/linux/io_uring_types.h -@@ -416,6 +416,7 @@ enum { - /* keep async read/write and isreg together and in order */ - REQ_F_SUPPORT_NOWAIT_BIT, - REQ_F_ISREG_BIT, -+ REQ_F_CAN_POLL_BIT, - - /* not a real bit, just to check we're not overflowing the space */ - __REQ_F_LAST_BIT, -@@ -483,6 +484,8 @@ enum { - REQ_F_CLEAR_POLLIN = BIT(REQ_F_CLEAR_POLLIN_BIT), - /* hashed into ->cancel_hash_locked, protected by ->uring_lock */ - REQ_F_HASH_LOCKED = BIT(REQ_F_HASH_LOCKED_BIT), -+ /* file is pollable */ -+ REQ_F_CAN_POLL = BIT(REQ_F_CAN_POLL_BIT), - }; - - typedef void (*io_req_tw_func_t)(struct io_kiocb *req, struct io_tw_state *ts); -diff --git a/include/linux/mdio.h b/include/linux/mdio.h -index 8fa23bdcedbf98..0bca1a960853f4 100644 ---- a/include/linux/mdio.h -+++ b/include/linux/mdio.h -@@ -44,10 +44,7 @@ struct mdio_device { - unsigned int reset_deassert_delay; - }; - --static inline struct mdio_device *to_mdio_device(const struct device *dev) --{ -- return container_of(dev, struct mdio_device, dev); --} -+#define to_mdio_device(__dev) container_of_const(__dev, struct mdio_device, dev) - - /* struct mdio_driver_common: Common to all MDIO drivers */ - struct mdio_driver_common { -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index 69d844b34da0d3..696a2227869fb3 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -390,6 +390,7 @@ struct mlx5_core_rsc_common { - enum mlx5_res_type res; - refcount_t refcount; - struct completion free; -+ bool invalid; - }; - - struct mlx5_uars_page { -diff --git a/include/linux/phy.h b/include/linux/phy.h -index 5aa30ee9981047..a57e799b1de185 100644 ---- a/include/linux/phy.h -+++ b/include/linux/phy.h -@@ -766,10 +766,7 @@ struct phy_device { - /* Generic phy_device::dev_flags */ - #define PHY_F_NO_IRQ 0x80000000 - --static inline struct phy_device *to_phy_device(const struct device *dev) --{ -- return container_of(to_mdio_device(dev), struct phy_device, mdio); --} -+#define to_phy_device(__dev) container_of_const(to_mdio_device(__dev), struct phy_device, mdio) - - /** - * struct phy_tdr_config - Configuration of a TDR raw test -diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h -index e9214ccfde2d72..d63af08c6cdc2b 100644 ---- a/include/net/bluetooth/hci_core.h -+++ b/include/net/bluetooth/hci_core.h -@@ -542,6 +542,7 @@ struct hci_dev { - struct hci_conn_hash conn_hash; - - struct list_head mesh_pending; -+ struct mutex mgmt_pending_lock; - struct list_head mgmt_pending; - struct list_head reject_list; - struct list_head accept_list; -@@ -2305,7 +2306,6 @@ void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, - u8 instance); - void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, - u8 instance); --void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle); - int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip); - void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle, - bdaddr_t *bdaddr, u8 addr_type); -diff --git a/include/net/sock.h b/include/net/sock.h -index dc625f94ee37b7..e15bea43b2ecd1 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -3043,8 +3043,11 @@ int sock_ioctl_inout(struct sock *sk, unsigned int cmd, - int sk_ioctl(struct sock *sk, unsigned int cmd, void __user *arg); - static inline bool sk_is_readable(struct sock *sk) - { -- if (sk->sk_prot->sock_is_readable) -- return sk->sk_prot->sock_is_readable(sk); -+ const struct proto *prot = READ_ONCE(sk->sk_prot); -+ -+ if (prot->sock_is_readable) -+ return prot->sock_is_readable(sk); -+ - return false; - } - #endif /* _SOCK_H */ -diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c -index 43b46098279a16..ff1a93d405e99e 100644 ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -920,14 +920,6 @@ static bool __io_post_aux_cqe(struct io_ring_ctx *ctx, u64 user_data, s32 res, u - { - bool filled; - -- /* -- * If multishot has already posted deferred completions, ensure that -- * those are flushed first before posting this one. If not, CQEs -- * could get reordered. -- */ -- if (!wq_list_empty(&ctx->submit_state.compl_reqs)) -- __io_submit_flush_completions(ctx); -- - io_cq_lock(ctx); - filled = io_fill_cqe_aux(ctx, user_data, res, cflags); - if (!filled && allow_overflow) -@@ -1953,7 +1945,7 @@ void io_wq_submit_work(struct io_wq_work *work) - if (req->flags & REQ_F_FORCE_ASYNC) { - bool opcode_poll = def->pollin || def->pollout; - -- if (opcode_poll && file_can_poll(req->file)) { -+ if (opcode_poll && io_file_can_poll(req)) { - needs_poll = true; - issue_flags |= IO_URING_F_NONBLOCK; - } -diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h -index 0ffec66deee7f1..59f5f71037ffe1 100644 ---- a/io_uring/io_uring.h -+++ b/io_uring/io_uring.h -@@ -5,6 +5,7 @@ - #include - #include - #include -+#include - #include - #include - #include "io-wq.h" -@@ -410,4 +411,15 @@ static inline size_t uring_sqe_size(struct io_ring_ctx *ctx) - return 2 * sizeof(struct io_uring_sqe); - return sizeof(struct io_uring_sqe); - } -+ -+static inline bool io_file_can_poll(struct io_kiocb *req) -+{ -+ if (req->flags & REQ_F_CAN_POLL) -+ return true; -+ if (file_can_poll(req->file)) { -+ req->flags |= REQ_F_CAN_POLL; -+ return true; -+ } -+ return false; -+} - #endif -diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c -index 8c6611fe4f4633..addd7c97365727 100644 ---- a/io_uring/kbuf.c -+++ b/io_uring/kbuf.c -@@ -148,8 +148,7 @@ static void __user *io_ring_buffer_select(struct io_kiocb *req, size_t *len, - req->buf_list = bl; - req->buf_index = buf->bid; - -- if (issue_flags & IO_URING_F_UNLOCKED || -- (req->file && !file_can_poll(req->file))) { -+ if (issue_flags & IO_URING_F_UNLOCKED || !io_file_can_poll(req)) { - /* - * If we came in unlocked, we have no choice but to consume the - * buffer here, otherwise nothing ensures that the buffer won't -diff --git a/io_uring/poll.c b/io_uring/poll.c -index cf8e86bc96deb5..2390bf5f1710b4 100644 ---- a/io_uring/poll.c -+++ b/io_uring/poll.c -@@ -717,7 +717,7 @@ int io_arm_poll_handler(struct io_kiocb *req, unsigned issue_flags) - - if (!def->pollin && !def->pollout) - return IO_APOLL_ABORTED; -- if (!file_can_poll(req->file)) -+ if (!io_file_can_poll(req)) - return IO_APOLL_ABORTED; - if (!(req->flags & REQ_F_APOLL_MULTISHOT)) - mask |= EPOLLONESHOT; -diff --git a/io_uring/rw.c b/io_uring/rw.c -index 75b001febb4d28..4ff3442ac2eeea 100644 ---- a/io_uring/rw.c -+++ b/io_uring/rw.c -@@ -28,9 +28,19 @@ struct io_rw { - rwf_t flags; - }; - --static inline bool io_file_supports_nowait(struct io_kiocb *req) -+static bool io_file_supports_nowait(struct io_kiocb *req, __poll_t mask) - { -- return req->flags & REQ_F_SUPPORT_NOWAIT; -+ /* If FMODE_NOWAIT is set for a file, we're golden */ -+ if (req->flags & REQ_F_SUPPORT_NOWAIT) -+ return true; -+ /* No FMODE_NOWAIT, if we can poll, check the status */ -+ if (io_file_can_poll(req)) { -+ struct poll_table_struct pt = { ._key = mask }; -+ -+ return vfs_poll(req->file, &pt) & mask; -+ } -+ /* No FMODE_NOWAIT support, and file isn't pollable. Tough luck. */ -+ return false; - } - - #ifdef CONFIG_COMPAT -@@ -629,7 +639,7 @@ static bool io_rw_should_retry(struct io_kiocb *req) - * just use poll if we can, and don't attempt if the fs doesn't - * support callback based unlocks - */ -- if (file_can_poll(req->file) || !(req->file->f_mode & FMODE_BUF_RASYNC)) -+ if (io_file_can_poll(req) || !(req->file->f_mode & FMODE_BUF_RASYNC)) - return false; - - wait->wait.func = io_async_buf_func; -@@ -685,8 +695,8 @@ static int io_rw_init_file(struct io_kiocb *req, fmode_t mode) - * supports async. Otherwise it's impossible to use O_NONBLOCK files - * reliably. If not, or it IOCB_NOWAIT is set, don't retry. - */ -- if ((kiocb->ki_flags & IOCB_NOWAIT) || -- ((file->f_flags & O_NONBLOCK) && !io_file_supports_nowait(req))) -+ if (kiocb->ki_flags & IOCB_NOWAIT || -+ ((file->f_flags & O_NONBLOCK && !(req->flags & REQ_F_SUPPORT_NOWAIT)))) - req->flags |= REQ_F_NOWAIT; - - if (ctx->flags & IORING_SETUP_IOPOLL) { -@@ -752,7 +762,7 @@ static int __io_read(struct io_kiocb *req, unsigned int issue_flags) - - if (force_nonblock) { - /* If the file doesn't support async, just async punt */ -- if (unlikely(!io_file_supports_nowait(req))) { -+ if (unlikely(!io_file_supports_nowait(req, EPOLLIN))) { - ret = io_setup_async_rw(req, iovec, s, true); - return ret ?: -EAGAIN; - } -@@ -783,7 +793,7 @@ static int __io_read(struct io_kiocb *req, unsigned int issue_flags) - if (ret == -EAGAIN || (req->flags & REQ_F_REISSUE)) { - req->flags &= ~REQ_F_REISSUE; - /* if we can poll, just do that */ -- if (req->opcode == IORING_OP_READ && file_can_poll(req->file)) -+ if (req->opcode == IORING_OP_READ && io_file_can_poll(req)) - return -EAGAIN; - /* IOPOLL retry should happen for io-wq threads */ - if (!force_nonblock && !(req->ctx->flags & IORING_SETUP_IOPOLL)) -@@ -927,7 +937,7 @@ int io_write(struct io_kiocb *req, unsigned int issue_flags) - - if (force_nonblock) { - /* If the file doesn't support async, just async punt */ -- if (unlikely(!io_file_supports_nowait(req))) -+ if (unlikely(!io_file_supports_nowait(req, EPOLLOUT))) - goto copy_iov; - - /* File path supports NOWAIT for non-direct_IO only for block devices. */ -diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c -index 81fd1bb9941644..5eaaf95048abc1 100644 ---- a/kernel/bpf/core.c -+++ b/kernel/bpf/core.c -@@ -2258,8 +2258,8 @@ static unsigned int __bpf_prog_ret0_warn(const void *ctx, - } - #endif - --bool bpf_prog_map_compatible(struct bpf_map *map, -- const struct bpf_prog *fp) -+static bool __bpf_prog_map_compatible(struct bpf_map *map, -+ const struct bpf_prog *fp) - { - enum bpf_prog_type prog_type = resolve_prog_type(fp); - bool ret; -@@ -2268,14 +2268,6 @@ bool bpf_prog_map_compatible(struct bpf_map *map, - if (fp->kprobe_override) - return false; - -- /* XDP programs inserted into maps are not guaranteed to run on -- * a particular netdev (and can run outside driver context entirely -- * in the case of devmap and cpumap). Until device checks -- * are implemented, prohibit adding dev-bound programs to program maps. -- */ -- if (bpf_prog_is_dev_bound(aux)) -- return false; -- - spin_lock(&map->owner.lock); - if (!map->owner.type) { - /* There's no owner yet where we could check for -@@ -2309,6 +2301,19 @@ bool bpf_prog_map_compatible(struct bpf_map *map, - return ret; - } - -+bool bpf_prog_map_compatible(struct bpf_map *map, const struct bpf_prog *fp) -+{ -+ /* XDP programs inserted into maps are not guaranteed to run on -+ * a particular netdev (and can run outside driver context entirely -+ * in the case of devmap and cpumap). Until device checks -+ * are implemented, prohibit adding dev-bound programs to program maps. -+ */ -+ if (bpf_prog_is_dev_bound(fp->aux)) -+ return false; -+ -+ return __bpf_prog_map_compatible(map, fp); -+} -+ - static int bpf_check_tail_call(const struct bpf_prog *fp) - { - struct bpf_prog_aux *aux = fp->aux; -@@ -2321,7 +2326,7 @@ static int bpf_check_tail_call(const struct bpf_prog *fp) - if (!map_type_contains_progs(map)) - continue; - -- if (!bpf_prog_map_compatible(map, fp)) { -+ if (!__bpf_prog_map_compatible(map, fp)) { - ret = -EINVAL; - goto out; - } -@@ -2359,7 +2364,7 @@ struct bpf_prog *bpf_prog_select_runtime(struct bpf_prog *fp, int *err) - /* In case of BPF to BPF calls, verifier did all the prep - * work with regards to JITing, etc. - */ -- bool jit_needed = false; -+ bool jit_needed = fp->jit_requested; - - if (fp->bpf_func) - goto finalize; -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 5dd6424e62fa89..563f39518f7fe6 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -5913,6 +5913,9 @@ static int perf_event_set_output(struct perf_event *event, - static int perf_event_set_filter(struct perf_event *event, void __user *arg); - static int perf_copy_attr(struct perf_event_attr __user *uattr, - struct perf_event_attr *attr); -+static int __perf_event_set_bpf_prog(struct perf_event *event, -+ struct bpf_prog *prog, -+ u64 bpf_cookie); - - static long _perf_ioctl(struct perf_event *event, unsigned int cmd, unsigned long arg) - { -@@ -5981,7 +5984,7 @@ static long _perf_ioctl(struct perf_event *event, unsigned int cmd, unsigned lon - if (IS_ERR(prog)) - return PTR_ERR(prog); - -- err = perf_event_set_bpf_prog(event, prog, 0); -+ err = __perf_event_set_bpf_prog(event, prog, 0); - if (err) { - bpf_prog_put(prog); - return err; -@@ -9553,14 +9556,14 @@ __perf_event_account_interrupt(struct perf_event *event, int throttle) - hwc->interrupts = 1; - } else { - hwc->interrupts++; -- if (unlikely(throttle && -- hwc->interrupts > max_samples_per_tick)) { -- __this_cpu_inc(perf_throttled_count); -- tick_dep_set_cpu(smp_processor_id(), TICK_DEP_BIT_PERF_EVENTS); -- hwc->interrupts = MAX_INTERRUPTS; -- perf_log_throttle(event, 0); -- ret = 1; -- } -+ } -+ -+ if (unlikely(throttle && hwc->interrupts >= max_samples_per_tick)) { -+ __this_cpu_inc(perf_throttled_count); -+ tick_dep_set_cpu(smp_processor_id(), TICK_DEP_BIT_PERF_EVENTS); -+ hwc->interrupts = MAX_INTERRUPTS; -+ perf_log_throttle(event, 0); -+ ret = 1; - } - - if (event->attr.freq) { -@@ -10583,8 +10586,9 @@ static inline bool perf_event_is_tracing(struct perf_event *event) - return false; - } - --int perf_event_set_bpf_prog(struct perf_event *event, struct bpf_prog *prog, -- u64 bpf_cookie) -+static int __perf_event_set_bpf_prog(struct perf_event *event, -+ struct bpf_prog *prog, -+ u64 bpf_cookie) - { - bool is_kprobe, is_uprobe, is_tracepoint, is_syscall_tp; - -@@ -10622,6 +10626,20 @@ int perf_event_set_bpf_prog(struct perf_event *event, struct bpf_prog *prog, - return perf_event_attach_bpf_prog(event, prog, bpf_cookie); - } - -+int perf_event_set_bpf_prog(struct perf_event *event, -+ struct bpf_prog *prog, -+ u64 bpf_cookie) -+{ -+ struct perf_event_context *ctx; -+ int ret; -+ -+ ctx = perf_event_ctx_lock(event); -+ ret = __perf_event_set_bpf_prog(event, prog, bpf_cookie); -+ perf_event_ctx_unlock(event, ctx); -+ -+ return ret; -+} -+ - void perf_event_free_bpf_prog(struct perf_event *event) - { - if (!perf_event_is_tracing(event)) { -@@ -10641,7 +10659,15 @@ static void perf_event_free_filter(struct perf_event *event) - { - } - --int perf_event_set_bpf_prog(struct perf_event *event, struct bpf_prog *prog, -+static int __perf_event_set_bpf_prog(struct perf_event *event, -+ struct bpf_prog *prog, -+ u64 bpf_cookie) -+{ -+ return -ENOENT; -+} -+ -+int perf_event_set_bpf_prog(struct perf_event *event, -+ struct bpf_prog *prog, - u64 bpf_cookie) - { - return -ENOENT; -diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c -index c2fc58938dee5d..76dcf2e28427f2 100644 ---- a/kernel/power/hibernate.c -+++ b/kernel/power/hibernate.c -@@ -80,6 +80,11 @@ void hibernate_release(void) - atomic_inc(&hibernate_atomic); - } - -+bool hibernation_in_progress(void) -+{ -+ return !atomic_read(&hibernate_atomic); -+} -+ - bool hibernation_available(void) - { - return nohibernate == 0 && -diff --git a/kernel/power/main.c b/kernel/power/main.c -index f6425ae3e8b055..a3543bd2d25afc 100644 ---- a/kernel/power/main.c -+++ b/kernel/power/main.c -@@ -585,7 +585,8 @@ bool pm_debug_messages_on __read_mostly; - - bool pm_debug_messages_should_print(void) - { -- return pm_debug_messages_on && pm_suspend_target_state != PM_SUSPEND_ON; -+ return pm_debug_messages_on && (hibernation_in_progress() || -+ pm_suspend_target_state != PM_SUSPEND_ON); - } - EXPORT_SYMBOL_GPL(pm_debug_messages_should_print); - -diff --git a/kernel/power/power.h b/kernel/power/power.h -index a98f95e309a338..62a7cb452a4be6 100644 ---- a/kernel/power/power.h -+++ b/kernel/power/power.h -@@ -66,10 +66,14 @@ extern void enable_restore_image_protection(void); - static inline void enable_restore_image_protection(void) {} - #endif /* CONFIG_STRICT_KERNEL_RWX */ - -+extern bool hibernation_in_progress(void); -+ - #else /* !CONFIG_HIBERNATION */ - - static inline void hibernate_reserved_size_init(void) {} - static inline void hibernate_image_size_init(void) {} -+ -+static inline bool hibernation_in_progress(void) { return false; } - #endif /* !CONFIG_HIBERNATION */ - - #define power_attr(_name) \ -diff --git a/kernel/power/wakelock.c b/kernel/power/wakelock.c -index 52571dcad768b9..4e941999a53ba6 100644 ---- a/kernel/power/wakelock.c -+++ b/kernel/power/wakelock.c -@@ -49,6 +49,9 @@ ssize_t pm_show_wakelocks(char *buf, bool show_active) - len += sysfs_emit_at(buf, len, "%s ", wl->name); - } - -+ if (len > 0) -+ --len; -+ - len += sysfs_emit_at(buf, len, "\n"); - - mutex_unlock(&wakelocks_lock); -diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c -index fda08520c75c58..1fb3b7a0ed5d27 100644 ---- a/kernel/rcu/tree.c -+++ b/kernel/rcu/tree.c -@@ -754,6 +754,10 @@ static int dyntick_save_progress_counter(struct rcu_data *rdp) - return 0; - } - -+#ifndef arch_irq_stat_cpu -+#define arch_irq_stat_cpu(cpu) 0 -+#endif -+ - /* - * Returns positive if the specified CPU has passed through a quiescent state - * by virtue of being in or having passed through an dynticks idle state since -@@ -889,9 +893,9 @@ static int rcu_implicit_dynticks_qs(struct rcu_data *rdp) - rsrp->cputime_irq = kcpustat_field(kcsp, CPUTIME_IRQ, cpu); - rsrp->cputime_softirq = kcpustat_field(kcsp, CPUTIME_SOFTIRQ, cpu); - rsrp->cputime_system = kcpustat_field(kcsp, CPUTIME_SYSTEM, cpu); -- rsrp->nr_hardirqs = kstat_cpu_irqs_sum(rdp->cpu); -- rsrp->nr_softirqs = kstat_cpu_softirqs_sum(rdp->cpu); -- rsrp->nr_csw = nr_context_switches_cpu(rdp->cpu); -+ rsrp->nr_hardirqs = kstat_cpu_irqs_sum(cpu) + arch_irq_stat_cpu(cpu); -+ rsrp->nr_softirqs = kstat_cpu_softirqs_sum(cpu); -+ rsrp->nr_csw = nr_context_switches_cpu(cpu); - rsrp->jiffies = jiffies; - rsrp->gp_seq = rdp->gp_seq; - } -diff --git a/kernel/rcu/tree.h b/kernel/rcu/tree.h -index 9eb43b501ff5c8..ac8cc756920ddf 100644 ---- a/kernel/rcu/tree.h -+++ b/kernel/rcu/tree.h -@@ -169,7 +169,7 @@ struct rcu_snap_record { - u64 cputime_irq; /* Accumulated cputime of hard irqs */ - u64 cputime_softirq;/* Accumulated cputime of soft irqs */ - u64 cputime_system; /* Accumulated cputime of kernel tasks */ -- unsigned long nr_hardirqs; /* Accumulated number of hard irqs */ -+ u64 nr_hardirqs; /* Accumulated number of hard irqs */ - unsigned int nr_softirqs; /* Accumulated number of soft irqs */ - unsigned long long nr_csw; /* Accumulated number of task switches */ - unsigned long jiffies; /* Track jiffies value */ -diff --git a/kernel/rcu/tree_stall.h b/kernel/rcu/tree_stall.h -index 11a1fac3a58985..aab91040b83b16 100644 ---- a/kernel/rcu/tree_stall.h -+++ b/kernel/rcu/tree_stall.h -@@ -452,8 +452,8 @@ static void print_cpu_stat_info(int cpu) - rsr.cputime_system = kcpustat_field(kcsp, CPUTIME_SYSTEM, cpu); - - pr_err("\t hardirqs softirqs csw/system\n"); -- pr_err("\t number: %8ld %10d %12lld\n", -- kstat_cpu_irqs_sum(cpu) - rsrp->nr_hardirqs, -+ pr_err("\t number: %8lld %10d %12lld\n", -+ kstat_cpu_irqs_sum(cpu) + arch_irq_stat_cpu(cpu) - rsrp->nr_hardirqs, - kstat_cpu_softirqs_sum(cpu) - rsrp->nr_softirqs, - nr_context_switches_cpu(cpu) - rsrp->nr_csw); - pr_err("\tcputime: %8lld %10lld %12lld ==> %d(ms)\n", -diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c -index e9c6f9d0e42ce4..9af1f2a72a0ab3 100644 ---- a/kernel/time/posix-cpu-timers.c -+++ b/kernel/time/posix-cpu-timers.c -@@ -1437,6 +1437,15 @@ void run_posix_cpu_timers(void) - - lockdep_assert_irqs_disabled(); - -+ /* -+ * Ensure that release_task(tsk) can't happen while -+ * handle_posix_cpu_timers() is running. Otherwise, a concurrent -+ * posix_cpu_timer_del() may fail to lock_task_sighand(tsk) and -+ * miss timer->it.cpu.firing != 0. -+ */ -+ if (tsk->exit_state) -+ return; -+ - /* - * If the actual expiry is deferred to task work context and the - * work is already scheduled there is no point to do anything here. -diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c -index 97f660a8ddc73d..8903db0b596026 100644 ---- a/kernel/trace/bpf_trace.c -+++ b/kernel/trace/bpf_trace.c -@@ -1834,7 +1834,7 @@ static struct pt_regs *get_bpf_raw_tp_regs(void) - struct bpf_raw_tp_regs *tp_regs = this_cpu_ptr(&bpf_raw_tp_regs); - int nest_level = this_cpu_inc_return(bpf_raw_tp_nest_level); - -- if (WARN_ON_ONCE(nest_level > ARRAY_SIZE(tp_regs->regs))) { -+ if (nest_level > ARRAY_SIZE(tp_regs->regs)) { - this_cpu_dec(bpf_raw_tp_nest_level); - return ERR_PTR(-EBUSY); - } -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 43d19b69c635b2..946350c98b5396 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -7023,7 +7023,7 @@ static ssize_t tracing_splice_read_pipe(struct file *filp, - ret = trace_seq_to_buffer(&iter->seq, - page_address(spd.pages[i]), - min((size_t)trace_seq_used(&iter->seq), -- PAGE_SIZE)); -+ (size_t)PAGE_SIZE)); - if (ret < 0) { - __free_page(spd.pages[i]); - break; -diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h -index faf892aecdf490..e3afb830fbcc7b 100644 ---- a/kernel/trace/trace.h -+++ b/kernel/trace/trace.h -@@ -1643,6 +1643,9 @@ extern int event_enable_register_trigger(char *glob, - extern void event_enable_unregister_trigger(char *glob, - struct event_trigger_data *test, - struct trace_event_file *file); -+extern struct event_trigger_data * -+trigger_data_alloc(struct event_command *cmd_ops, char *cmd, char *param, -+ void *private_data); - extern void trigger_data_free(struct event_trigger_data *data); - extern int event_trigger_init(struct event_trigger_data *data); - extern int trace_event_trigger_enable_disable(struct trace_event_file *file, -@@ -1669,11 +1672,6 @@ extern bool event_trigger_check_remove(const char *glob); - extern bool event_trigger_empty_param(const char *param); - extern int event_trigger_separate_filter(char *param_and_filter, char **param, - char **filter, bool param_required); --extern struct event_trigger_data * --event_trigger_alloc(struct event_command *cmd_ops, -- char *cmd, -- char *param, -- void *private_data); - extern int event_trigger_parse_num(char *trigger, - struct event_trigger_data *trigger_data); - extern int event_trigger_set_filter(struct event_command *cmd_ops, -diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c -index e6f9cbc622c759..88985aefb71ff8 100644 ---- a/kernel/trace/trace_events_hist.c -+++ b/kernel/trace/trace_events_hist.c -@@ -5257,17 +5257,94 @@ hist_trigger_actions(struct hist_trigger_data *hist_data, - } - } - -+/* -+ * The hist_pad structure is used to save information to create -+ * a histogram from the histogram trigger. It's too big to store -+ * on the stack, so when the histogram trigger is initialized -+ * a percpu array of 4 hist_pad structures is allocated. -+ * This will cover every context from normal, softirq, irq and NMI -+ * in the very unlikely event that a tigger happens at each of -+ * these contexts and interrupts a currently active trigger. -+ */ -+struct hist_pad { -+ unsigned long entries[HIST_STACKTRACE_DEPTH]; -+ u64 var_ref_vals[TRACING_MAP_VARS_MAX]; -+ char compound_key[HIST_KEY_SIZE_MAX]; -+}; -+ -+static struct hist_pad __percpu *hist_pads; -+static DEFINE_PER_CPU(int, hist_pad_cnt); -+static refcount_t hist_pad_ref; -+ -+/* One hist_pad for every context (normal, softirq, irq, NMI) */ -+#define MAX_HIST_CNT 4 -+ -+static int alloc_hist_pad(void) -+{ -+ lockdep_assert_held(&event_mutex); -+ -+ if (refcount_read(&hist_pad_ref)) { -+ refcount_inc(&hist_pad_ref); -+ return 0; -+ } -+ -+ hist_pads = __alloc_percpu(sizeof(struct hist_pad) * MAX_HIST_CNT, -+ __alignof__(struct hist_pad)); -+ if (!hist_pads) -+ return -ENOMEM; -+ -+ refcount_set(&hist_pad_ref, 1); -+ return 0; -+} -+ -+static void free_hist_pad(void) -+{ -+ lockdep_assert_held(&event_mutex); -+ -+ if (!refcount_dec_and_test(&hist_pad_ref)) -+ return; -+ -+ free_percpu(hist_pads); -+ hist_pads = NULL; -+} -+ -+static struct hist_pad *get_hist_pad(void) -+{ -+ struct hist_pad *hist_pad; -+ int cnt; -+ -+ if (WARN_ON_ONCE(!hist_pads)) -+ return NULL; -+ -+ preempt_disable(); -+ -+ hist_pad = per_cpu_ptr(hist_pads, smp_processor_id()); -+ -+ if (this_cpu_read(hist_pad_cnt) == MAX_HIST_CNT) { -+ preempt_enable(); -+ return NULL; -+ } -+ -+ cnt = this_cpu_inc_return(hist_pad_cnt) - 1; -+ -+ return &hist_pad[cnt]; -+} -+ -+static void put_hist_pad(void) -+{ -+ this_cpu_dec(hist_pad_cnt); -+ preempt_enable(); -+} -+ - static void event_hist_trigger(struct event_trigger_data *data, - struct trace_buffer *buffer, void *rec, - struct ring_buffer_event *rbe) - { - struct hist_trigger_data *hist_data = data->private_data; - bool use_compound_key = (hist_data->n_keys > 1); -- unsigned long entries[HIST_STACKTRACE_DEPTH]; -- u64 var_ref_vals[TRACING_MAP_VARS_MAX]; -- char compound_key[HIST_KEY_SIZE_MAX]; - struct tracing_map_elt *elt = NULL; - struct hist_field *key_field; -+ struct hist_pad *hist_pad; - u64 field_contents; - void *key = NULL; - unsigned int i; -@@ -5275,12 +5352,18 @@ static void event_hist_trigger(struct event_trigger_data *data, - if (unlikely(!rbe)) - return; - -- memset(compound_key, 0, hist_data->key_size); -+ hist_pad = get_hist_pad(); -+ if (!hist_pad) -+ return; -+ -+ memset(hist_pad->compound_key, 0, hist_data->key_size); - - for_each_hist_key_field(i, hist_data) { - key_field = hist_data->fields[i]; - - if (key_field->flags & HIST_FIELD_FL_STACKTRACE) { -+ unsigned long *entries = hist_pad->entries; -+ - memset(entries, 0, HIST_STACKTRACE_SIZE); - if (key_field->field) { - unsigned long *stack, n_entries; -@@ -5304,26 +5387,31 @@ static void event_hist_trigger(struct event_trigger_data *data, - } - - if (use_compound_key) -- add_to_key(compound_key, key, key_field, rec); -+ add_to_key(hist_pad->compound_key, key, key_field, rec); - } - - if (use_compound_key) -- key = compound_key; -+ key = hist_pad->compound_key; - - if (hist_data->n_var_refs && -- !resolve_var_refs(hist_data, key, var_ref_vals, false)) -- return; -+ !resolve_var_refs(hist_data, key, hist_pad->var_ref_vals, false)) -+ goto out; - - elt = tracing_map_insert(hist_data->map, key); - if (!elt) -- return; -+ goto out; - -- hist_trigger_elt_update(hist_data, elt, buffer, rec, rbe, var_ref_vals); -+ hist_trigger_elt_update(hist_data, elt, buffer, rec, rbe, hist_pad->var_ref_vals); - -- if (resolve_var_refs(hist_data, key, var_ref_vals, true)) -- hist_trigger_actions(hist_data, elt, buffer, rec, rbe, key, var_ref_vals); -+ if (resolve_var_refs(hist_data, key, hist_pad->var_ref_vals, true)) { -+ hist_trigger_actions(hist_data, elt, buffer, rec, rbe, -+ key, hist_pad->var_ref_vals); -+ } - - hist_poll_wakeup(); -+ -+ out: -+ put_hist_pad(); - } - - static void hist_trigger_stacktrace_print(struct seq_file *m, -@@ -6168,6 +6256,9 @@ static int event_hist_trigger_init(struct event_trigger_data *data) - { - struct hist_trigger_data *hist_data = data->private_data; - -+ if (alloc_hist_pad() < 0) -+ return -ENOMEM; -+ - if (!data->ref && hist_data->attrs->name) - save_named_trigger(hist_data->attrs->name, data); - -@@ -6212,6 +6303,7 @@ static void event_hist_trigger_free(struct event_trigger_data *data) - - destroy_hist_data(hist_data); - } -+ free_hist_pad(); - } - - static struct event_trigger_ops event_hist_trigger_ops = { -@@ -6227,9 +6319,7 @@ static int event_hist_trigger_named_init(struct event_trigger_data *data) - - save_named_trigger(data->named_data->name, data); - -- event_hist_trigger_init(data->named_data); -- -- return 0; -+ return event_hist_trigger_init(data->named_data); - } - - static void event_hist_trigger_named_free(struct event_trigger_data *data) -@@ -6716,7 +6806,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops, - return PTR_ERR(hist_data); - } - -- trigger_data = event_trigger_alloc(cmd_ops, cmd, param, hist_data); -+ trigger_data = trigger_data_alloc(cmd_ops, cmd, param, hist_data); - if (!trigger_data) { - ret = -ENOMEM; - goto out_free; -diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c -index 2c233c0d38fa95..fe079ff82ef1bf 100644 ---- a/kernel/trace/trace_events_trigger.c -+++ b/kernel/trace/trace_events_trigger.c -@@ -809,7 +809,7 @@ int event_trigger_separate_filter(char *param_and_filter, char **param, - } - - /** -- * event_trigger_alloc - allocate and init event_trigger_data for a trigger -+ * trigger_data_alloc - allocate and init event_trigger_data for a trigger - * @cmd_ops: The event_command operations for the trigger - * @cmd: The cmd string - * @param: The param string -@@ -820,14 +820,14 @@ int event_trigger_separate_filter(char *param_and_filter, char **param, - * trigger_ops to assign to the event_trigger_data. @private_data can - * also be passed in and associated with the event_trigger_data. - * -- * Use event_trigger_free() to free an event_trigger_data object. -+ * Use trigger_data_free() to free an event_trigger_data object. - * - * Return: The trigger_data object success, NULL otherwise - */ --struct event_trigger_data *event_trigger_alloc(struct event_command *cmd_ops, -- char *cmd, -- char *param, -- void *private_data) -+struct event_trigger_data *trigger_data_alloc(struct event_command *cmd_ops, -+ char *cmd, -+ char *param, -+ void *private_data) - { - struct event_trigger_data *trigger_data; - struct event_trigger_ops *trigger_ops; -@@ -994,13 +994,13 @@ event_trigger_parse(struct event_command *cmd_ops, - return ret; - - ret = -ENOMEM; -- trigger_data = event_trigger_alloc(cmd_ops, cmd, param, file); -+ trigger_data = trigger_data_alloc(cmd_ops, cmd, param, file); - if (!trigger_data) - goto out; - - if (remove) { - event_trigger_unregister(cmd_ops, file, glob+1, trigger_data); -- kfree(trigger_data); -+ trigger_data_free(trigger_data); - ret = 0; - goto out; - } -@@ -1027,7 +1027,7 @@ event_trigger_parse(struct event_command *cmd_ops, - - out_free: - event_trigger_reset_filter(cmd_ops, trigger_data); -- kfree(trigger_data); -+ trigger_data_free(trigger_data); - goto out; - } - -@@ -1787,7 +1787,7 @@ int event_enable_trigger_parse(struct event_command *cmd_ops, - enable_data->enable = enable; - enable_data->file = event_enable_file; - -- trigger_data = event_trigger_alloc(cmd_ops, cmd, param, enable_data); -+ trigger_data = trigger_data_alloc(cmd_ops, cmd, param, enable_data); - if (!trigger_data) { - kfree(enable_data); - goto out; -diff --git a/lib/kunit/static_stub.c b/lib/kunit/static_stub.c -index 92b2cccd5e7633..484fd85251b415 100644 ---- a/lib/kunit/static_stub.c -+++ b/lib/kunit/static_stub.c -@@ -96,7 +96,7 @@ void __kunit_activate_static_stub(struct kunit *test, - - /* If the replacement address is NULL, deactivate the stub. */ - if (!replacement_addr) { -- kunit_deactivate_static_stub(test, replacement_addr); -+ kunit_deactivate_static_stub(test, real_fn_addr); - return; - } - -diff --git a/mm/kasan/report.c b/mm/kasan/report.c -index ecced40e510320..465e6a53b3bf25 100644 ---- a/mm/kasan/report.c -+++ b/mm/kasan/report.c -@@ -538,7 +538,7 @@ void kasan_report_invalid_free(void *ptr, unsigned long ip, enum kasan_report_ty - - start_report(&flags, true); - -- memset(&info, 0, sizeof(info)); -+ __memset(&info, 0, sizeof(info)); - info.type = type; - info.access_addr = ptr; - info.access_size = 0; -@@ -576,7 +576,7 @@ bool kasan_report(const void *addr, size_t size, bool is_write, - - start_report(&irq_flags, true); - -- memset(&info, 0, sizeof(info)); -+ __memset(&info, 0, sizeof(info)); - info.type = KASAN_REPORT_ACCESS; - info.access_addr = addr; - info.access_size = size; -diff --git a/mm/kasan/shadow.c b/mm/kasan/shadow.c -index dd772f9d0f0802..d687f09a7ae37f 100644 ---- a/mm/kasan/shadow.c -+++ b/mm/kasan/shadow.c -@@ -324,7 +324,7 @@ static int kasan_populate_vmalloc_pte(pte_t *ptep, unsigned long addr, - if (!page) - return -ENOMEM; - -- memset((void *)page, KASAN_VMALLOC_INVALID, PAGE_SIZE); -+ __memset((void *)page, KASAN_VMALLOC_INVALID, PAGE_SIZE); - pte = pfn_pte(PFN_DOWN(__pa(page)), PAGE_KERNEL); - - spin_lock(&init_mm.page_table_lock); -diff --git a/net/bluetooth/eir.c b/net/bluetooth/eir.c -index 1bc51e2b05a347..3e1713673ecc93 100644 ---- a/net/bluetooth/eir.c -+++ b/net/bluetooth/eir.c -@@ -366,17 +366,19 @@ u8 eir_create_scan_rsp(struct hci_dev *hdev, u8 instance, u8 *ptr) - - void *eir_get_service_data(u8 *eir, size_t eir_len, u16 uuid, size_t *len) - { -- while ((eir = eir_get_data(eir, eir_len, EIR_SERVICE_DATA, len))) { -+ size_t dlen; -+ -+ while ((eir = eir_get_data(eir, eir_len, EIR_SERVICE_DATA, &dlen))) { - u16 value = get_unaligned_le16(eir); - - if (uuid == value) { - if (len) -- *len -= 2; -+ *len = dlen - 2; - return &eir[2]; - } - -- eir += *len; -- eir_len -= *len; -+ eir += dlen; -+ eir_len -= dlen; - } - - return NULL; -diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c -index 30519d47e8a695..32f7bd0e891689 100644 ---- a/net/bluetooth/hci_core.c -+++ b/net/bluetooth/hci_core.c -@@ -1862,10 +1862,8 @@ void hci_free_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor) - if (monitor->handle) - idr_remove(&hdev->adv_monitors_idr, monitor->handle); - -- if (monitor->state != ADV_MONITOR_STATE_NOT_REGISTERED) { -+ if (monitor->state != ADV_MONITOR_STATE_NOT_REGISTERED) - hdev->adv_monitors_cnt--; -- mgmt_adv_monitor_removed(hdev, monitor->handle); -- } - - kfree(monitor); - } -@@ -2492,6 +2490,7 @@ struct hci_dev *hci_alloc_dev_priv(int sizeof_priv) - - mutex_init(&hdev->lock); - mutex_init(&hdev->req_lock); -+ mutex_init(&hdev->mgmt_pending_lock); - - ida_init(&hdev->unset_handle_ida); - -@@ -3380,23 +3379,18 @@ static void hci_link_tx_to(struct hci_dev *hdev, __u8 type) - - bt_dev_err(hdev, "link tx timeout"); - -- rcu_read_lock(); -+ hci_dev_lock(hdev); - - /* Kill stalled connections */ -- list_for_each_entry_rcu(c, &h->list, list) { -+ list_for_each_entry(c, &h->list, list) { - if (c->type == type && c->sent) { - bt_dev_err(hdev, "killing stalled connection %pMR", - &c->dst); -- /* hci_disconnect might sleep, so, we have to release -- * the RCU read lock before calling it. -- */ -- rcu_read_unlock(); - hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM); -- rcu_read_lock(); - } - } - -- rcu_read_unlock(); -+ hci_dev_unlock(hdev); - } - - static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type, -diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c -index d6f40806ee5126..e92bc4ceb5adda 100644 ---- a/net/bluetooth/hci_sync.c -+++ b/net/bluetooth/hci_sync.c -@@ -1586,7 +1586,8 @@ static int hci_enable_per_advertising_sync(struct hci_dev *hdev, u8 instance) - static int hci_adv_bcast_annoucement(struct hci_dev *hdev, struct adv_info *adv) - { - u8 bid[3]; -- u8 ad[4 + 3]; -+ u8 ad[HCI_MAX_EXT_AD_LENGTH]; -+ u8 len; - - /* Skip if NULL adv as instance 0x00 is used for general purpose - * advertising so it cannot used for the likes of Broadcast Announcement -@@ -1612,8 +1613,10 @@ static int hci_adv_bcast_annoucement(struct hci_dev *hdev, struct adv_info *adv) - - /* Generate Broadcast ID */ - get_random_bytes(bid, sizeof(bid)); -- eir_append_service_data(ad, 0, 0x1852, bid, sizeof(bid)); -- hci_set_adv_instance_data(hdev, adv->instance, sizeof(ad), ad, 0, NULL); -+ len = eir_append_service_data(ad, 0, 0x1852, bid, sizeof(bid)); -+ memcpy(ad + len, adv->adv_data, adv->adv_data_len); -+ hci_set_adv_instance_data(hdev, adv->instance, len + adv->adv_data_len, -+ ad, 0, NULL); - - return hci_update_adv_data_sync(hdev, adv->instance); - } -@@ -1630,8 +1633,15 @@ int hci_start_per_adv_sync(struct hci_dev *hdev, u8 instance, u8 data_len, - - if (instance) { - adv = hci_find_adv_instance(hdev, instance); -- /* Create an instance if that could not be found */ -- if (!adv) { -+ if (adv) { -+ /* Turn it into periodic advertising */ -+ adv->periodic = true; -+ adv->per_adv_data_len = data_len; -+ if (data) -+ memcpy(adv->per_adv_data, data, data_len); -+ adv->flags = flags; -+ } else if (!adv) { -+ /* Create an instance if that could not be found */ - adv = hci_add_per_instance(hdev, instance, flags, - data_len, data, - sync_interval, -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index 1c54e812ef1f78..2744ad11687c65 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -4833,7 +4833,8 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn, - - if (!smp_sufficient_security(conn->hcon, pchan->sec_level, - SMP_ALLOW_STK)) { -- result = L2CAP_CR_LE_AUTHENTICATION; -+ result = pchan->sec_level == BT_SECURITY_MEDIUM ? -+ L2CAP_CR_LE_ENCRYPTION : L2CAP_CR_LE_AUTHENTICATION; - chan = NULL; - goto response_unlock; - } -diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c -index 589c3a481e4c10..853d217cabc917 100644 ---- a/net/bluetooth/mgmt.c -+++ b/net/bluetooth/mgmt.c -@@ -1433,22 +1433,17 @@ static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) - - send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); - -- list_del(&cmd->list); -- - if (match->sk == NULL) { - match->sk = cmd->sk; - sock_hold(match->sk); - } -- -- mgmt_pending_free(cmd); - } - - static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) - { - u8 *status = data; - -- mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status); -- mgmt_pending_remove(cmd); -+ mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, *status); - } - - static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) -@@ -1462,8 +1457,6 @@ static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) - - if (cmd->cmd_complete) { - cmd->cmd_complete(cmd, match->mgmt_status); -- mgmt_pending_remove(cmd); -- - return; - } - -@@ -1472,13 +1465,13 @@ static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) - - static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) - { -- return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, -+ return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, - cmd->param, cmd->param_len); - } - - static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) - { -- return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, -+ return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, - cmd->param, sizeof(struct mgmt_addr_info)); - } - -@@ -1518,7 +1511,7 @@ static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data, - - if (err) { - u8 mgmt_err = mgmt_status(err); -- mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); -+ mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); - hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); - goto done; - } -@@ -1693,7 +1686,7 @@ static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data, - - if (err) { - u8 mgmt_err = mgmt_status(err); -- mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); -+ mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); - goto done; - } - -@@ -1930,8 +1923,8 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) - new_settings(hdev, NULL); - } - -- mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp, -- &mgmt_err); -+ mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, true, -+ cmd_status_rsp, &mgmt_err); - return; - } - -@@ -1941,7 +1934,7 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) - changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); - } - -- mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match); -+ mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, true, settings_rsp, &match); - - if (changed) - new_settings(hdev, match.sk); -@@ -2061,12 +2054,12 @@ static void set_le_complete(struct hci_dev *hdev, void *data, int err) - bt_dev_dbg(hdev, "err %d", err); - - if (status) { -- mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp, -- &status); -+ mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, true, cmd_status_rsp, -+ &status); - return; - } - -- mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match); -+ mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, true, settings_rsp, &match); - - new_settings(hdev, match.sk); - -@@ -2125,7 +2118,7 @@ static void set_mesh_complete(struct hci_dev *hdev, void *data, int err) - struct sock *sk = cmd->sk; - - if (status) { -- mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev, -+ mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev, true, - cmd_status_rsp, &status); - return; - } -@@ -2566,7 +2559,7 @@ static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err) - - bt_dev_dbg(hdev, "err %d", err); - -- mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, -+ mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, - mgmt_status(err), hdev->dev_class, 3); - - mgmt_pending_free(cmd); -@@ -3354,7 +3347,7 @@ static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) - bacpy(&rp.addr.bdaddr, &conn->dst); - rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); - -- err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, -+ err = mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_PAIR_DEVICE, - status, &rp, sizeof(rp)); - - /* So we don't get further callbacks for this connection */ -@@ -5165,24 +5158,14 @@ static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, - mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); - } - --void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle) -+static void mgmt_adv_monitor_removed(struct sock *sk, struct hci_dev *hdev, -+ __le16 handle) - { - struct mgmt_ev_adv_monitor_removed ev; -- struct mgmt_pending_cmd *cmd; -- struct sock *sk_skip = NULL; -- struct mgmt_cp_remove_adv_monitor *cp; -- -- cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev); -- if (cmd) { -- cp = cmd->param; -- -- if (cp->monitor_handle) -- sk_skip = cmd->sk; -- } - -- ev.monitor_handle = cpu_to_le16(handle); -+ ev.monitor_handle = handle; - -- mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip); -+ mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk); - } - - static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, -@@ -5253,7 +5236,7 @@ static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, - hci_update_passive_scan(hdev); - } - -- mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, -+ mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, - mgmt_status(status), &rp, sizeof(rp)); - mgmt_pending_remove(cmd); - -@@ -5284,8 +5267,7 @@ static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, - - if (pending_find(MGMT_OP_SET_LE, hdev) || - pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || -- pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) || -- pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) { -+ pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { - status = MGMT_STATUS_BUSY; - goto unlock; - } -@@ -5455,8 +5437,7 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, - struct mgmt_pending_cmd *cmd = data; - struct mgmt_cp_remove_adv_monitor *cp; - -- if (status == -ECANCELED || -- cmd != pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) -+ if (status == -ECANCELED) - return; - - hci_dev_lock(hdev); -@@ -5465,12 +5446,14 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, - - rp.monitor_handle = cp->monitor_handle; - -- if (!status) -+ if (!status) { -+ mgmt_adv_monitor_removed(cmd->sk, hdev, cp->monitor_handle); - hci_update_passive_scan(hdev); -+ } - -- mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, -+ mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, - mgmt_status(status), &rp, sizeof(rp)); -- mgmt_pending_remove(cmd); -+ mgmt_pending_free(cmd); - - hci_dev_unlock(hdev); - bt_dev_dbg(hdev, "remove monitor %d complete, status %d", -@@ -5480,10 +5463,6 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, - static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data) - { - struct mgmt_pending_cmd *cmd = data; -- -- if (cmd != pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) -- return -ECANCELED; -- - struct mgmt_cp_remove_adv_monitor *cp = cmd->param; - u16 handle = __le16_to_cpu(cp->monitor_handle); - -@@ -5502,14 +5481,13 @@ static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, - hci_dev_lock(hdev); - - if (pending_find(MGMT_OP_SET_LE, hdev) || -- pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) || - pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || - pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { - status = MGMT_STATUS_BUSY; - goto unlock; - } - -- cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); -+ cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); - if (!cmd) { - status = MGMT_STATUS_NO_RESOURCES; - goto unlock; -@@ -5519,7 +5497,7 @@ static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, - mgmt_remove_adv_monitor_complete); - - if (err) { -- mgmt_pending_remove(cmd); -+ mgmt_pending_free(cmd); - - if (err == -ENOMEM) - status = MGMT_STATUS_NO_RESOURCES; -@@ -5872,7 +5850,7 @@ static void start_discovery_complete(struct hci_dev *hdev, void *data, int err) - cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev)) - return; - -- mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), -+ mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err), - cmd->param, 1); - mgmt_pending_remove(cmd); - -@@ -6110,7 +6088,7 @@ static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) - - bt_dev_dbg(hdev, "err %d", err); - -- mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), -+ mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err), - cmd->param, 1); - mgmt_pending_remove(cmd); - -@@ -6335,7 +6313,7 @@ static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) - u8 status = mgmt_status(err); - - if (status) { -- mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, -+ mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, true, - cmd_status_rsp, &status); - return; - } -@@ -6345,7 +6323,7 @@ static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) - else - hci_dev_clear_flag(hdev, HCI_ADVERTISING); - -- mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp, -+ mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, true, settings_rsp, - &match); - - new_settings(hdev, match.sk); -@@ -6689,7 +6667,7 @@ static void set_bredr_complete(struct hci_dev *hdev, void *data, int err) - */ - hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); - -- mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); -+ mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); - } else { - send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); - new_settings(hdev, cmd->sk); -@@ -6826,7 +6804,7 @@ static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err) - if (err) { - u8 mgmt_err = mgmt_status(err); - -- mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); -+ mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); - goto done; - } - -@@ -7273,7 +7251,7 @@ static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err) - rp.max_tx_power = HCI_TX_POWER_INVALID; - } - -- mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status, -+ mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_GET_CONN_INFO, status, - &rp, sizeof(rp)); - - mgmt_pending_free(cmd); -@@ -7433,7 +7411,7 @@ static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err) - } - - complete: -- mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp, -+ mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, &rp, - sizeof(rp)); - - mgmt_pending_free(cmd); -@@ -8637,10 +8615,10 @@ static void add_advertising_complete(struct hci_dev *hdev, void *data, int err) - rp.instance = cp->instance; - - if (err) -- mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, -+ mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, - mgmt_status(err)); - else -- mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, -+ mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, - mgmt_status(err), &rp, sizeof(rp)); - - add_adv_complete(hdev, cmd->sk, cp->instance, err); -@@ -8828,10 +8806,10 @@ static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data, - - hci_remove_adv_instance(hdev, cp->instance); - -- mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, -+ mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, - mgmt_status(err)); - } else { -- mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, -+ mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, - mgmt_status(err), &rp, sizeof(rp)); - } - -@@ -8979,10 +8957,10 @@ static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err) - rp.instance = cp->instance; - - if (err) -- mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, -+ mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, - mgmt_status(err)); - else -- mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, -+ mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, - mgmt_status(err), &rp, sizeof(rp)); - - mgmt_pending_free(cmd); -@@ -9141,10 +9119,10 @@ static void remove_advertising_complete(struct hci_dev *hdev, void *data, - rp.instance = cp->instance; - - if (err) -- mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, -+ mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, - mgmt_status(err)); - else -- mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, -+ mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, - MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); - - mgmt_pending_free(cmd); -@@ -9415,7 +9393,7 @@ void mgmt_index_removed(struct hci_dev *hdev) - if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) - return; - -- mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &match); -+ mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match); - - if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { - mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, -@@ -9453,7 +9431,8 @@ void mgmt_power_on(struct hci_dev *hdev, int err) - hci_update_passive_scan(hdev); - } - -- mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); -+ mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp, -+ &match); - - new_settings(hdev, match.sk); - -@@ -9468,7 +9447,8 @@ void __mgmt_power_off(struct hci_dev *hdev) - struct cmd_lookup match = { NULL, hdev }; - u8 zero_cod[] = { 0, 0, 0 }; - -- mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); -+ mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp, -+ &match); - - /* If the power off is because of hdev unregistration let - * use the appropriate INVALID_INDEX status. Otherwise use -@@ -9482,7 +9462,7 @@ void __mgmt_power_off(struct hci_dev *hdev) - else - match.mgmt_status = MGMT_STATUS_NOT_POWERED; - -- mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &match); -+ mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match); - - if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { - mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, -@@ -9723,7 +9703,6 @@ static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) - device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); - - cmd->cmd_complete(cmd, 0); -- mgmt_pending_remove(cmd); - } - - bool mgmt_powering_down(struct hci_dev *hdev) -@@ -9776,8 +9755,8 @@ void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, - struct mgmt_cp_disconnect *cp; - struct mgmt_pending_cmd *cmd; - -- mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, -- hdev); -+ mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, true, -+ unpair_device_rsp, hdev); - - cmd = pending_find(MGMT_OP_DISCONNECT, hdev); - if (!cmd) -@@ -9970,7 +9949,7 @@ void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) - - if (status) { - u8 mgmt_err = mgmt_status(status); -- mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, -+ mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true, - cmd_status_rsp, &mgmt_err); - return; - } -@@ -9980,8 +9959,8 @@ void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) - else - changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); - -- mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp, -- &match); -+ mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true, -+ settings_rsp, &match); - - if (changed) - new_settings(hdev, match.sk); -@@ -10005,9 +9984,12 @@ void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, - { - struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; - -- mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match); -- mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match); -- mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match); -+ mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, false, sk_lookup, -+ &match); -+ mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, false, sk_lookup, -+ &match); -+ mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, false, sk_lookup, -+ &match); - - if (!status) { - mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, -diff --git a/net/bluetooth/mgmt_util.c b/net/bluetooth/mgmt_util.c -index 0115f783bde805..4ba500c377a4c0 100644 ---- a/net/bluetooth/mgmt_util.c -+++ b/net/bluetooth/mgmt_util.c -@@ -217,47 +217,47 @@ int mgmt_cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status, - struct mgmt_pending_cmd *mgmt_pending_find(unsigned short channel, u16 opcode, - struct hci_dev *hdev) - { -- struct mgmt_pending_cmd *cmd; -+ struct mgmt_pending_cmd *cmd, *tmp; -+ -+ mutex_lock(&hdev->mgmt_pending_lock); - -- list_for_each_entry(cmd, &hdev->mgmt_pending, list) { -+ list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) { - if (hci_sock_get_channel(cmd->sk) != channel) - continue; -- if (cmd->opcode == opcode) -- return cmd; -- } - -- return NULL; --} -- --struct mgmt_pending_cmd *mgmt_pending_find_data(unsigned short channel, -- u16 opcode, -- struct hci_dev *hdev, -- const void *data) --{ -- struct mgmt_pending_cmd *cmd; -- -- list_for_each_entry(cmd, &hdev->mgmt_pending, list) { -- if (cmd->user_data != data) -- continue; -- if (cmd->opcode == opcode) -+ if (cmd->opcode == opcode) { -+ mutex_unlock(&hdev->mgmt_pending_lock); - return cmd; -+ } - } - -+ mutex_unlock(&hdev->mgmt_pending_lock); -+ - return NULL; - } - --void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev, -+void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev, bool remove, - void (*cb)(struct mgmt_pending_cmd *cmd, void *data), - void *data) - { - struct mgmt_pending_cmd *cmd, *tmp; - -+ mutex_lock(&hdev->mgmt_pending_lock); -+ - list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) { - if (opcode > 0 && cmd->opcode != opcode) - continue; - -+ if (remove) -+ list_del(&cmd->list); -+ - cb(cmd, data); -+ -+ if (remove) -+ mgmt_pending_free(cmd); - } -+ -+ mutex_unlock(&hdev->mgmt_pending_lock); - } - - struct mgmt_pending_cmd *mgmt_pending_new(struct sock *sk, u16 opcode, -@@ -271,7 +271,7 @@ struct mgmt_pending_cmd *mgmt_pending_new(struct sock *sk, u16 opcode, - return NULL; - - cmd->opcode = opcode; -- cmd->index = hdev->id; -+ cmd->hdev = hdev; - - cmd->param = kmemdup(data, len, GFP_KERNEL); - if (!cmd->param) { -@@ -297,7 +297,9 @@ struct mgmt_pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode, - if (!cmd) - return NULL; - -+ mutex_lock(&hdev->mgmt_pending_lock); - list_add_tail(&cmd->list, &hdev->mgmt_pending); -+ mutex_unlock(&hdev->mgmt_pending_lock); - - return cmd; - } -@@ -311,7 +313,10 @@ void mgmt_pending_free(struct mgmt_pending_cmd *cmd) - - void mgmt_pending_remove(struct mgmt_pending_cmd *cmd) - { -+ mutex_lock(&cmd->hdev->mgmt_pending_lock); - list_del(&cmd->list); -+ mutex_unlock(&cmd->hdev->mgmt_pending_lock); -+ - mgmt_pending_free(cmd); - } - -@@ -321,7 +326,7 @@ void mgmt_mesh_foreach(struct hci_dev *hdev, - { - struct mgmt_mesh_tx *mesh_tx, *tmp; - -- list_for_each_entry_safe(mesh_tx, tmp, &hdev->mgmt_pending, list) { -+ list_for_each_entry_safe(mesh_tx, tmp, &hdev->mesh_pending, list) { - if (!sk || mesh_tx->sk == sk) - cb(mesh_tx, data); - } -diff --git a/net/bluetooth/mgmt_util.h b/net/bluetooth/mgmt_util.h -index bdf978605d5a85..024e51dd693756 100644 ---- a/net/bluetooth/mgmt_util.h -+++ b/net/bluetooth/mgmt_util.h -@@ -33,7 +33,7 @@ struct mgmt_mesh_tx { - struct mgmt_pending_cmd { - struct list_head list; - u16 opcode; -- int index; -+ struct hci_dev *hdev; - void *param; - size_t param_len; - struct sock *sk; -@@ -54,11 +54,7 @@ int mgmt_cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status, - - struct mgmt_pending_cmd *mgmt_pending_find(unsigned short channel, u16 opcode, - struct hci_dev *hdev); --struct mgmt_pending_cmd *mgmt_pending_find_data(unsigned short channel, -- u16 opcode, -- struct hci_dev *hdev, -- const void *data); --void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev, -+void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev, bool remove, - void (*cb)(struct mgmt_pending_cmd *cmd, void *data), - void *data); - struct mgmt_pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode, -diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c -index 4fbfbafdfa0274..4b4a396d972259 100644 ---- a/net/bridge/netfilter/nf_conntrack_bridge.c -+++ b/net/bridge/netfilter/nf_conntrack_bridge.c -@@ -60,19 +60,19 @@ static int nf_br_ip_fragment(struct net *net, struct sock *sk, - struct ip_fraglist_iter iter; - struct sk_buff *frag; - -- if (first_len - hlen > mtu || -- skb_headroom(skb) < ll_rs) -+ if (first_len - hlen > mtu) - goto blackhole; - -- if (skb_cloned(skb)) -+ if (skb_cloned(skb) || -+ skb_headroom(skb) < ll_rs) - goto slow_path; - - skb_walk_frags(skb, frag) { -- if (frag->len > mtu || -- skb_headroom(frag) < hlen + ll_rs) -+ if (frag->len > mtu) - goto blackhole; - -- if (skb_shared(frag)) -+ if (skb_shared(frag) || -+ skb_headroom(frag) < hlen + ll_rs) - goto slow_path; - } - -diff --git a/net/core/skmsg.c b/net/core/skmsg.c -index b9b941c487c8a7..2076db464e9360 100644 ---- a/net/core/skmsg.c -+++ b/net/core/skmsg.c -@@ -529,16 +529,22 @@ static int sk_psock_skb_ingress_enqueue(struct sk_buff *skb, - u32 off, u32 len, - struct sk_psock *psock, - struct sock *sk, -- struct sk_msg *msg) -+ struct sk_msg *msg, -+ bool take_ref) - { - int num_sge, copied; - -+ /* skb_to_sgvec will fail when the total number of fragments in -+ * frag_list and frags exceeds MAX_MSG_FRAGS. For example, the -+ * caller may aggregate multiple skbs. -+ */ - num_sge = skb_to_sgvec(skb, msg->sg.data, off, len); - if (num_sge < 0) { - /* skb linearize may fail with ENOMEM, but lets simply try again - * later if this happens. Under memory pressure we don't want to - * drop the skb. We need to linearize the skb so that the mapping - * in skb_to_sgvec can not error. -+ * Note that skb_linearize requires the skb not to be shared. - */ - if (skb_linearize(skb)) - return -EAGAIN; -@@ -555,7 +561,7 @@ static int sk_psock_skb_ingress_enqueue(struct sk_buff *skb, - msg->sg.start = 0; - msg->sg.size = copied; - msg->sg.end = num_sge; -- msg->skb = skb; -+ msg->skb = take_ref ? skb_get(skb) : skb; - - sk_psock_queue_msg(psock, msg); - sk_psock_data_ready(sk, psock); -@@ -563,7 +569,7 @@ static int sk_psock_skb_ingress_enqueue(struct sk_buff *skb, - } - - static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb, -- u32 off, u32 len); -+ u32 off, u32 len, bool take_ref); - - static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb, - u32 off, u32 len) -@@ -577,7 +583,7 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb, - * correctly. - */ - if (unlikely(skb->sk == sk)) -- return sk_psock_skb_ingress_self(psock, skb, off, len); -+ return sk_psock_skb_ingress_self(psock, skb, off, len, true); - msg = sk_psock_create_ingress_msg(sk, skb); - if (!msg) - return -EAGAIN; -@@ -589,7 +595,7 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb, - * into user buffers. - */ - skb_set_owner_r(skb, sk); -- err = sk_psock_skb_ingress_enqueue(skb, off, len, psock, sk, msg); -+ err = sk_psock_skb_ingress_enqueue(skb, off, len, psock, sk, msg, true); - if (err < 0) - kfree(msg); - return err; -@@ -600,7 +606,7 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb, - * because the skb is already accounted for here. - */ - static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb, -- u32 off, u32 len) -+ u32 off, u32 len, bool take_ref) - { - struct sk_msg *msg = alloc_sk_msg(GFP_ATOMIC); - struct sock *sk = psock->sk; -@@ -609,7 +615,7 @@ static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb - if (unlikely(!msg)) - return -EAGAIN; - skb_set_owner_r(skb, sk); -- err = sk_psock_skb_ingress_enqueue(skb, off, len, psock, sk, msg); -+ err = sk_psock_skb_ingress_enqueue(skb, off, len, psock, sk, msg, take_ref); - if (err < 0) - kfree(msg); - return err; -@@ -618,18 +624,13 @@ static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb - static int sk_psock_handle_skb(struct sk_psock *psock, struct sk_buff *skb, - u32 off, u32 len, bool ingress) - { -- int err = 0; -- - if (!ingress) { - if (!sock_writeable(psock->sk)) - return -EAGAIN; - return skb_send_sock(psock->sk, skb, off, len); - } -- skb_get(skb); -- err = sk_psock_skb_ingress(psock, skb, off, len); -- if (err < 0) -- kfree_skb(skb); -- return err; -+ -+ return sk_psock_skb_ingress(psock, skb, off, len); - } - - static void sk_psock_skb_state(struct sk_psock *psock, -@@ -654,12 +655,14 @@ static void sk_psock_backlog(struct work_struct *work) - bool ingress; - int ret; - -+ /* Increment the psock refcnt to synchronize with close(fd) path in -+ * sock_map_close(), ensuring we wait for backlog thread completion -+ * before sk_socket freed. If refcnt increment fails, it indicates -+ * sock_map_close() completed with sk_socket potentially already freed. -+ */ -+ if (!sk_psock_get(psock->sk)) -+ return; - mutex_lock(&psock->work_mutex); -- if (unlikely(state->len)) { -- len = state->len; -- off = state->off; -- } -- - while ((skb = skb_peek(&psock->ingress_skb))) { - len = skb->len; - off = 0; -@@ -669,6 +672,13 @@ static void sk_psock_backlog(struct work_struct *work) - off = stm->offset; - len = stm->full_len; - } -+ -+ /* Resume processing from previous partial state */ -+ if (unlikely(state->len)) { -+ len = state->len; -+ off = state->off; -+ } -+ - ingress = skb_bpf_ingress(skb); - skb_bpf_redirect_clear(skb); - do { -@@ -696,11 +706,14 @@ static void sk_psock_backlog(struct work_struct *work) - len -= ret; - } while (len); - -+ /* The entire skb sent, clear state */ -+ sk_psock_skb_state(psock, state, 0, 0); - skb = skb_dequeue(&psock->ingress_skb); - kfree_skb(skb); - } - end: - mutex_unlock(&psock->work_mutex); -+ sk_psock_put(psock->sk, psock); - } - - struct sk_psock *sk_psock_init(struct sock *sk, int node) -@@ -1013,7 +1026,7 @@ static int sk_psock_verdict_apply(struct sk_psock *psock, struct sk_buff *skb, - off = stm->offset; - len = stm->full_len; - } -- err = sk_psock_skb_ingress_self(psock, skb, off, len); -+ err = sk_psock_skb_ingress_self(psock, skb, off, len, false); - } - if (err < 0) { - spin_lock_bh(&psock->ingress_lock); -diff --git a/net/dsa/tag_brcm.c b/net/dsa/tag_brcm.c -index cacdafb41200e5..146c1dbd15a93f 100644 ---- a/net/dsa/tag_brcm.c -+++ b/net/dsa/tag_brcm.c -@@ -257,7 +257,7 @@ static struct sk_buff *brcm_leg_tag_rcv(struct sk_buff *skb, - int source_port; - u8 *brcm_tag; - -- if (unlikely(!pskb_may_pull(skb, BRCM_LEG_PORT_ID))) -+ if (unlikely(!pskb_may_pull(skb, BRCM_LEG_TAG_LEN + VLAN_HLEN))) - return NULL; - - brcm_tag = dsa_etype_header_pos_rx(skb); -diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c -index 132cfc3b2c847b..3870b59f540048 100644 ---- a/net/ipv4/udp_offload.c -+++ b/net/ipv4/udp_offload.c -@@ -332,6 +332,7 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb, - bool copy_dtor; - __sum16 check; - __be16 newlen; -+ int ret = 0; - - mss = skb_shinfo(gso_skb)->gso_size; - if (gso_skb->len <= sizeof(*uh) + mss) -@@ -354,6 +355,10 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb, - if (skb_pagelen(gso_skb) - sizeof(*uh) == skb_shinfo(gso_skb)->gso_size) - return __udp_gso_segment_list(gso_skb, features, is_ipv6); - -+ ret = __skb_linearize(gso_skb); -+ if (ret) -+ return ERR_PTR(ret); -+ - /* Setup csum, as fraglist skips this in udp4_gro_receive. */ - gso_skb->csum_start = skb_transport_header(gso_skb) - gso_skb->head; - gso_skb->csum_offset = offsetof(struct udphdr, check); -diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c -index 7c4af48d529e1e..606aae4e78a9a4 100644 ---- a/net/ipv6/netfilter.c -+++ b/net/ipv6/netfilter.c -@@ -163,20 +163,20 @@ int br_ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, - struct ip6_fraglist_iter iter; - struct sk_buff *frag2; - -- if (first_len - hlen > mtu || -- skb_headroom(skb) < (hroom + sizeof(struct frag_hdr))) -+ if (first_len - hlen > mtu) - goto blackhole; - -- if (skb_cloned(skb)) -+ if (skb_cloned(skb) || -+ skb_headroom(skb) < (hroom + sizeof(struct frag_hdr))) - goto slow_path; - - skb_walk_frags(skb, frag2) { -- if (frag2->len > mtu || -- skb_headroom(frag2) < (hlen + hroom + sizeof(struct frag_hdr))) -+ if (frag2->len > mtu) - goto blackhole; - - /* Partially cloned skb? */ -- if (skb_shared(frag2)) -+ if (skb_shared(frag2) || -+ skb_headroom(frag2) < (hlen + hroom + sizeof(struct frag_hdr))) - goto slow_path; - } - -diff --git a/net/ipv6/netfilter/nft_fib_ipv6.c b/net/ipv6/netfilter/nft_fib_ipv6.c -index c9f1634b3838ae..a89ce0fbfe4b12 100644 ---- a/net/ipv6/netfilter/nft_fib_ipv6.c -+++ b/net/ipv6/netfilter/nft_fib_ipv6.c -@@ -158,6 +158,7 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs, - { - const struct nft_fib *priv = nft_expr_priv(expr); - int noff = skb_network_offset(pkt->skb); -+ const struct net_device *found = NULL; - const struct net_device *oif = NULL; - u32 *dest = ®s->data[priv->dreg]; - struct ipv6hdr *iph, _iph; -@@ -202,11 +203,15 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs, - if (rt->rt6i_flags & (RTF_REJECT | RTF_ANYCAST | RTF_LOCAL)) - goto put_rt_err; - -- if (oif && oif != rt->rt6i_idev->dev && -- l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) != oif->ifindex) -- goto put_rt_err; -+ if (!oif) { -+ found = rt->rt6i_idev->dev; -+ } else { -+ if (oif == rt->rt6i_idev->dev || -+ l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) == oif->ifindex) -+ found = oif; -+ } - -- nft_fib_store_result(dest, priv, rt->rt6i_idev->dev); -+ nft_fib_store_result(dest, priv, found); - put_rt_err: - ip6_rt_put(rt); - } -diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c -index c434940131b1d0..7f295b9c13744d 100644 ---- a/net/ipv6/seg6_local.c -+++ b/net/ipv6/seg6_local.c -@@ -1638,10 +1638,8 @@ static const struct nla_policy seg6_local_policy[SEG6_LOCAL_MAX + 1] = { - [SEG6_LOCAL_SRH] = { .type = NLA_BINARY }, - [SEG6_LOCAL_TABLE] = { .type = NLA_U32 }, - [SEG6_LOCAL_VRFTABLE] = { .type = NLA_U32 }, -- [SEG6_LOCAL_NH4] = { .type = NLA_BINARY, -- .len = sizeof(struct in_addr) }, -- [SEG6_LOCAL_NH6] = { .type = NLA_BINARY, -- .len = sizeof(struct in6_addr) }, -+ [SEG6_LOCAL_NH4] = NLA_POLICY_EXACT_LEN(sizeof(struct in_addr)), -+ [SEG6_LOCAL_NH6] = NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)), - [SEG6_LOCAL_IIF] = { .type = NLA_U32 }, - [SEG6_LOCAL_OIF] = { .type = NLA_U32 }, - [SEG6_LOCAL_BPF] = { .type = NLA_NESTED }, -diff --git a/net/ncsi/internal.h b/net/ncsi/internal.h -index 4e0842df5234ea..2c260f33b55cc5 100644 ---- a/net/ncsi/internal.h -+++ b/net/ncsi/internal.h -@@ -143,16 +143,15 @@ struct ncsi_channel_vlan_filter { - }; - - struct ncsi_channel_stats { -- u32 hnc_cnt_hi; /* Counter cleared */ -- u32 hnc_cnt_lo; /* Counter cleared */ -- u32 hnc_rx_bytes; /* Rx bytes */ -- u32 hnc_tx_bytes; /* Tx bytes */ -- u32 hnc_rx_uc_pkts; /* Rx UC packets */ -- u32 hnc_rx_mc_pkts; /* Rx MC packets */ -- u32 hnc_rx_bc_pkts; /* Rx BC packets */ -- u32 hnc_tx_uc_pkts; /* Tx UC packets */ -- u32 hnc_tx_mc_pkts; /* Tx MC packets */ -- u32 hnc_tx_bc_pkts; /* Tx BC packets */ -+ u64 hnc_cnt; /* Counter cleared */ -+ u64 hnc_rx_bytes; /* Rx bytes */ -+ u64 hnc_tx_bytes; /* Tx bytes */ -+ u64 hnc_rx_uc_pkts; /* Rx UC packets */ -+ u64 hnc_rx_mc_pkts; /* Rx MC packets */ -+ u64 hnc_rx_bc_pkts; /* Rx BC packets */ -+ u64 hnc_tx_uc_pkts; /* Tx UC packets */ -+ u64 hnc_tx_mc_pkts; /* Tx MC packets */ -+ u64 hnc_tx_bc_pkts; /* Tx BC packets */ - u32 hnc_fcs_err; /* FCS errors */ - u32 hnc_align_err; /* Alignment errors */ - u32 hnc_false_carrier; /* False carrier detection */ -@@ -181,7 +180,7 @@ struct ncsi_channel_stats { - u32 hnc_tx_1023_frames; /* Tx 512-1023 bytes frames */ - u32 hnc_tx_1522_frames; /* Tx 1024-1522 bytes frames */ - u32 hnc_tx_9022_frames; /* Tx 1523-9022 bytes frames */ -- u32 hnc_rx_valid_bytes; /* Rx valid bytes */ -+ u64 hnc_rx_valid_bytes; /* Rx valid bytes */ - u32 hnc_rx_runt_pkts; /* Rx error runt packets */ - u32 hnc_rx_jabber_pkts; /* Rx error jabber packets */ - u32 ncsi_rx_cmds; /* Rx NCSI commands */ -diff --git a/net/ncsi/ncsi-pkt.h b/net/ncsi/ncsi-pkt.h -index f2f3b5c1b94126..24edb273797240 100644 ---- a/net/ncsi/ncsi-pkt.h -+++ b/net/ncsi/ncsi-pkt.h -@@ -252,16 +252,15 @@ struct ncsi_rsp_gp_pkt { - /* Get Controller Packet Statistics */ - struct ncsi_rsp_gcps_pkt { - struct ncsi_rsp_pkt_hdr rsp; /* Response header */ -- __be32 cnt_hi; /* Counter cleared */ -- __be32 cnt_lo; /* Counter cleared */ -- __be32 rx_bytes; /* Rx bytes */ -- __be32 tx_bytes; /* Tx bytes */ -- __be32 rx_uc_pkts; /* Rx UC packets */ -- __be32 rx_mc_pkts; /* Rx MC packets */ -- __be32 rx_bc_pkts; /* Rx BC packets */ -- __be32 tx_uc_pkts; /* Tx UC packets */ -- __be32 tx_mc_pkts; /* Tx MC packets */ -- __be32 tx_bc_pkts; /* Tx BC packets */ -+ __be64 cnt; /* Counter cleared */ -+ __be64 rx_bytes; /* Rx bytes */ -+ __be64 tx_bytes; /* Tx bytes */ -+ __be64 rx_uc_pkts; /* Rx UC packets */ -+ __be64 rx_mc_pkts; /* Rx MC packets */ -+ __be64 rx_bc_pkts; /* Rx BC packets */ -+ __be64 tx_uc_pkts; /* Tx UC packets */ -+ __be64 tx_mc_pkts; /* Tx MC packets */ -+ __be64 tx_bc_pkts; /* Tx BC packets */ - __be32 fcs_err; /* FCS errors */ - __be32 align_err; /* Alignment errors */ - __be32 false_carrier; /* False carrier detection */ -@@ -290,11 +289,11 @@ struct ncsi_rsp_gcps_pkt { - __be32 tx_1023_frames; /* Tx 512-1023 bytes frames */ - __be32 tx_1522_frames; /* Tx 1024-1522 bytes frames */ - __be32 tx_9022_frames; /* Tx 1523-9022 bytes frames */ -- __be32 rx_valid_bytes; /* Rx valid bytes */ -+ __be64 rx_valid_bytes; /* Rx valid bytes */ - __be32 rx_runt_pkts; /* Rx error runt packets */ - __be32 rx_jabber_pkts; /* Rx error jabber packets */ - __be32 checksum; /* Checksum */ --}; -+} __packed __aligned(4); - - /* Get NCSI Statistics */ - struct ncsi_rsp_gns_pkt { -diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c -index 4a8ce2949faeac..8668888c5a2f99 100644 ---- a/net/ncsi/ncsi-rsp.c -+++ b/net/ncsi/ncsi-rsp.c -@@ -926,16 +926,15 @@ static int ncsi_rsp_handler_gcps(struct ncsi_request *nr) - - /* Update HNC's statistics */ - ncs = &nc->stats; -- ncs->hnc_cnt_hi = ntohl(rsp->cnt_hi); -- ncs->hnc_cnt_lo = ntohl(rsp->cnt_lo); -- ncs->hnc_rx_bytes = ntohl(rsp->rx_bytes); -- ncs->hnc_tx_bytes = ntohl(rsp->tx_bytes); -- ncs->hnc_rx_uc_pkts = ntohl(rsp->rx_uc_pkts); -- ncs->hnc_rx_mc_pkts = ntohl(rsp->rx_mc_pkts); -- ncs->hnc_rx_bc_pkts = ntohl(rsp->rx_bc_pkts); -- ncs->hnc_tx_uc_pkts = ntohl(rsp->tx_uc_pkts); -- ncs->hnc_tx_mc_pkts = ntohl(rsp->tx_mc_pkts); -- ncs->hnc_tx_bc_pkts = ntohl(rsp->tx_bc_pkts); -+ ncs->hnc_cnt = be64_to_cpu(rsp->cnt); -+ ncs->hnc_rx_bytes = be64_to_cpu(rsp->rx_bytes); -+ ncs->hnc_tx_bytes = be64_to_cpu(rsp->tx_bytes); -+ ncs->hnc_rx_uc_pkts = be64_to_cpu(rsp->rx_uc_pkts); -+ ncs->hnc_rx_mc_pkts = be64_to_cpu(rsp->rx_mc_pkts); -+ ncs->hnc_rx_bc_pkts = be64_to_cpu(rsp->rx_bc_pkts); -+ ncs->hnc_tx_uc_pkts = be64_to_cpu(rsp->tx_uc_pkts); -+ ncs->hnc_tx_mc_pkts = be64_to_cpu(rsp->tx_mc_pkts); -+ ncs->hnc_tx_bc_pkts = be64_to_cpu(rsp->tx_bc_pkts); - ncs->hnc_fcs_err = ntohl(rsp->fcs_err); - ncs->hnc_align_err = ntohl(rsp->align_err); - ncs->hnc_false_carrier = ntohl(rsp->false_carrier); -@@ -964,7 +963,7 @@ static int ncsi_rsp_handler_gcps(struct ncsi_request *nr) - ncs->hnc_tx_1023_frames = ntohl(rsp->tx_1023_frames); - ncs->hnc_tx_1522_frames = ntohl(rsp->tx_1522_frames); - ncs->hnc_tx_9022_frames = ntohl(rsp->tx_9022_frames); -- ncs->hnc_rx_valid_bytes = ntohl(rsp->rx_valid_bytes); -+ ncs->hnc_rx_valid_bytes = be64_to_cpu(rsp->rx_valid_bytes); - ncs->hnc_rx_runt_pkts = ntohl(rsp->rx_runt_pkts); - ncs->hnc_rx_jabber_pkts = ntohl(rsp->rx_jabber_pkts); - -diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c -index ccca6e3848bcc8..9df883d79acc92 100644 ---- a/net/netfilter/nf_nat_core.c -+++ b/net/netfilter/nf_nat_core.c -@@ -248,7 +248,7 @@ static noinline bool - nf_nat_used_tuple_new(const struct nf_conntrack_tuple *tuple, - const struct nf_conn *ignored_ct) - { -- static const unsigned long uses_nat = IPS_NAT_MASK | IPS_SEQ_ADJUST_BIT; -+ static const unsigned long uses_nat = IPS_NAT_MASK | IPS_SEQ_ADJUST; - const struct nf_conntrack_tuple_hash *thash; - const struct nf_conntrack_zone *zone; - struct nf_conn *ct; -@@ -287,8 +287,14 @@ nf_nat_used_tuple_new(const struct nf_conntrack_tuple *tuple, - zone = nf_ct_zone(ignored_ct); - - thash = nf_conntrack_find_get(net, zone, tuple); -- if (unlikely(!thash)) /* clashing entry went away */ -- return false; -+ if (unlikely(!thash)) { -+ struct nf_conntrack_tuple reply; -+ -+ nf_ct_invert_tuple(&reply, tuple); -+ thash = nf_conntrack_find_get(net, zone, &reply); -+ if (!thash) /* clashing entry went away */ -+ return false; -+ } - - ct = nf_ct_tuplehash_to_ctrack(thash); - -diff --git a/net/netfilter/nft_quota.c b/net/netfilter/nft_quota.c -index 9b2d7463d3d326..df0798da2329b9 100644 ---- a/net/netfilter/nft_quota.c -+++ b/net/netfilter/nft_quota.c -@@ -19,10 +19,16 @@ struct nft_quota { - }; - - static inline bool nft_overquota(struct nft_quota *priv, -- const struct sk_buff *skb) -+ const struct sk_buff *skb, -+ bool *report) - { -- return atomic64_add_return(skb->len, priv->consumed) >= -- atomic64_read(&priv->quota); -+ u64 consumed = atomic64_add_return(skb->len, priv->consumed); -+ u64 quota = atomic64_read(&priv->quota); -+ -+ if (report) -+ *report = consumed >= quota; -+ -+ return consumed > quota; - } - - static inline bool nft_quota_invert(struct nft_quota *priv) -@@ -34,7 +40,7 @@ static inline void nft_quota_do_eval(struct nft_quota *priv, - struct nft_regs *regs, - const struct nft_pktinfo *pkt) - { -- if (nft_overquota(priv, pkt->skb) ^ nft_quota_invert(priv)) -+ if (nft_overquota(priv, pkt->skb, NULL) ^ nft_quota_invert(priv)) - regs->verdict.code = NFT_BREAK; - } - -@@ -51,13 +57,13 @@ static void nft_quota_obj_eval(struct nft_object *obj, - const struct nft_pktinfo *pkt) - { - struct nft_quota *priv = nft_obj_data(obj); -- bool overquota; -+ bool overquota, report; - -- overquota = nft_overquota(priv, pkt->skb); -+ overquota = nft_overquota(priv, pkt->skb, &report); - if (overquota ^ nft_quota_invert(priv)) - regs->verdict.code = NFT_BREAK; - -- if (overquota && -+ if (report && - !test_and_set_bit(NFT_QUOTA_DEPLETED_BIT, &priv->flags)) - nft_obj_notify(nft_net(pkt), obj->key.table, obj, 0, 0, - NFT_MSG_NEWOBJ, 0, nft_pf(pkt), 0, GFP_ATOMIC); -diff --git a/net/netfilter/nft_set_pipapo_avx2.c b/net/netfilter/nft_set_pipapo_avx2.c -index c15db28c5ebc43..be7c16c79f711e 100644 ---- a/net/netfilter/nft_set_pipapo_avx2.c -+++ b/net/netfilter/nft_set_pipapo_avx2.c -@@ -1113,6 +1113,25 @@ bool nft_pipapo_avx2_estimate(const struct nft_set_desc *desc, u32 features, - return true; - } - -+/** -+ * pipapo_resmap_init_avx2() - Initialise result map before first use -+ * @m: Matching data, including mapping table -+ * @res_map: Result map -+ * -+ * Like pipapo_resmap_init() but do not set start map bits covered by the first field. -+ */ -+static inline void pipapo_resmap_init_avx2(const struct nft_pipapo_match *m, unsigned long *res_map) -+{ -+ const struct nft_pipapo_field *f = m->f; -+ int i; -+ -+ /* Starting map doesn't need to be set to all-ones for this implementation, -+ * but we do need to zero the remaining bits, if any. -+ */ -+ for (i = f->bsize; i < m->bsize_max; i++) -+ res_map[i] = 0ul; -+} -+ - /** - * nft_pipapo_avx2_lookup() - Lookup function for AVX2 implementation - * @net: Network namespace -@@ -1171,7 +1190,7 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set, - res = scratch->map + (map_index ? m->bsize_max : 0); - fill = scratch->map + (map_index ? 0 : m->bsize_max); - -- /* Starting map doesn't need to be set for this implementation */ -+ pipapo_resmap_init_avx2(m, res); - - nft_pipapo_avx2_prepare(); - -diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c -index d499eb3f4f2978..3e3ae29dde3359 100644 ---- a/net/netfilter/nft_tunnel.c -+++ b/net/netfilter/nft_tunnel.c -@@ -617,10 +617,10 @@ static int nft_tunnel_opts_dump(struct sk_buff *skb, - struct geneve_opt *opt; - int offset = 0; - -- inner = nla_nest_start_noflag(skb, NFTA_TUNNEL_KEY_OPTS_GENEVE); -- if (!inner) -- goto failure; - while (opts->len > offset) { -+ inner = nla_nest_start_noflag(skb, NFTA_TUNNEL_KEY_OPTS_GENEVE); -+ if (!inner) -+ goto failure; - opt = (struct geneve_opt *)(opts->u.data + offset); - if (nla_put_be16(skb, NFTA_TUNNEL_KEY_GENEVE_CLASS, - opt->opt_class) || -@@ -630,8 +630,8 @@ static int nft_tunnel_opts_dump(struct sk_buff *skb, - opt->length * 4, opt->opt_data)) - goto inner_failure; - offset += sizeof(*opt) + opt->length * 4; -+ nla_nest_end(skb, inner); - } -- nla_nest_end(skb, inner); - } - nla_nest_end(skb, nest); - return 0; -diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c -index 27511c90a26f40..daef0eeaea2c7a 100644 ---- a/net/netlabel/netlabel_kapi.c -+++ b/net/netlabel/netlabel_kapi.c -@@ -1140,6 +1140,11 @@ int netlbl_conn_setattr(struct sock *sk, - break; - #if IS_ENABLED(CONFIG_IPV6) - case AF_INET6: -+ if (sk->sk_family != AF_INET6) { -+ ret_val = -EAFNOSUPPORT; -+ goto conn_setattr_return; -+ } -+ - addr6 = (struct sockaddr_in6 *)addr; - entry = netlbl_domhsh_getentry_af6(secattr->domain, - &addr6->sin6_addr); -diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c -index 8a848ce72e2910..b80bd3a9077397 100644 ---- a/net/openvswitch/flow.c -+++ b/net/openvswitch/flow.c -@@ -788,7 +788,7 @@ static int key_extract_l3l4(struct sk_buff *skb, struct sw_flow_key *key) - memset(&key->ipv4, 0, sizeof(key->ipv4)); - } - } else if (eth_p_mpls(key->eth.type)) { -- u8 label_count = 1; -+ size_t label_count = 1; - - memset(&key->mpls, 0, sizeof(key->mpls)); - skb_set_inner_network_header(skb, skb->mac_len); -diff --git a/net/sched/sch_ets.c b/net/sched/sch_ets.c -index 9da86db4d2c2fe..3ee46f6e005da0 100644 ---- a/net/sched/sch_ets.c -+++ b/net/sched/sch_ets.c -@@ -661,7 +661,7 @@ static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt, - for (i = q->nbands; i < oldbands; i++) { - if (i >= q->nstrict && q->classes[i].qdisc->q.qlen) - list_del_init(&q->classes[i].alist); -- qdisc_tree_flush_backlog(q->classes[i].qdisc); -+ qdisc_purge_queue(q->classes[i].qdisc); - } - q->nstrict = nstrict; - memcpy(q->prio2band, priomap, sizeof(priomap)); -diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c -index fdc5ef52c3ee92..fdd9caa41e80fb 100644 ---- a/net/sched/sch_prio.c -+++ b/net/sched/sch_prio.c -@@ -211,7 +211,7 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt, - memcpy(q->prio2band, qopt->priomap, TC_PRIO_MAX+1); - - for (i = q->bands; i < oldbands; i++) -- qdisc_tree_flush_backlog(q->queues[i]); -+ qdisc_purge_queue(q->queues[i]); - - for (i = oldbands; i < q->bands; i++) { - q->queues[i] = queues[i]; -diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c -index 16277b6a0238da..3c6b4460cf2c0c 100644 ---- a/net/sched/sch_red.c -+++ b/net/sched/sch_red.c -@@ -283,7 +283,7 @@ static int __red_change(struct Qdisc *sch, struct nlattr **tb, - q->userbits = userbits; - q->limit = ctl->limit; - if (child) { -- qdisc_tree_flush_backlog(q->qdisc); -+ qdisc_purge_queue(q->qdisc); - old_child = q->qdisc; - q->qdisc = child; - } -diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c -index 002941d35b643c..d564675a8be4d7 100644 ---- a/net/sched/sch_sfq.c -+++ b/net/sched/sch_sfq.c -@@ -310,7 +310,10 @@ static unsigned int sfq_drop(struct Qdisc *sch, struct sk_buff **to_free) - /* It is difficult to believe, but ALL THE SLOTS HAVE LENGTH 1. */ - x = q->tail->next; - slot = &q->slots[x]; -- q->tail->next = slot->next; -+ if (slot->next == x) -+ q->tail = NULL; /* no more active slots */ -+ else -+ q->tail->next = slot->next; - q->ht[slot->hash] = SFQ_EMPTY_SLOT; - goto drop; - } -diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c -index f92174008499bb..61dd5c8f23101d 100644 ---- a/net/sched/sch_tbf.c -+++ b/net/sched/sch_tbf.c -@@ -452,7 +452,7 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt, - - sch_tree_lock(sch); - if (child) { -- qdisc_tree_flush_backlog(q->qdisc); -+ qdisc_purge_queue(q->qdisc); - old = q->qdisc; - q->qdisc = child; - } -diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c -index 8584893b478510..79f91b6ca8c847 100644 ---- a/net/tipc/crypto.c -+++ b/net/tipc/crypto.c -@@ -818,7 +818,11 @@ static int tipc_aead_encrypt(struct tipc_aead *aead, struct sk_buff *skb, - } - - /* Get net to avoid freed tipc_crypto when delete namespace */ -- get_net(aead->crypto->net); -+ if (!maybe_get_net(aead->crypto->net)) { -+ tipc_bearer_put(b); -+ rc = -ENODEV; -+ goto exit; -+ } - - /* Now, do encrypt */ - rc = crypto_aead_encrypt(req); -diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c -index 6e30fe879d538e..4a9a3aed5d6d41 100644 ---- a/net/tls/tls_sw.c -+++ b/net/tls/tls_sw.c -@@ -908,6 +908,13 @@ static int bpf_exec_tx_verdict(struct sk_msg *msg, struct sock *sk, - &msg_redir, send, flags); - lock_sock(sk); - if (err < 0) { -+ /* Regardless of whether the data represented by -+ * msg_redir is sent successfully, we have already -+ * uncharged it via sk_msg_return_zero(). The -+ * msg->sg.size represents the remaining unprocessed -+ * data, which needs to be uncharged here. -+ */ -+ sk_mem_uncharge(sk, msg->sg.size); - *copied -= sk_msg_free_nocharge(sk, &msg_redir); - msg->sg.size = 0; - } -@@ -1120,9 +1127,13 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, - num_async++; - else if (ret == -ENOMEM) - goto wait_for_memory; -- else if (ctx->open_rec && ret == -ENOSPC) -+ else if (ctx->open_rec && ret == -ENOSPC) { -+ if (msg_pl->cork_bytes) { -+ ret = 0; -+ goto send_end; -+ } - goto rollback_iter; -- else if (ret != -EAGAIN) -+ } else if (ret != -EAGAIN) - goto send_end; - } - continue; -diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c -index 04dc0c8a837076..7188d3592dde4e 100644 ---- a/net/xfrm/xfrm_device.c -+++ b/net/xfrm/xfrm_device.c -@@ -371,7 +371,6 @@ int xfrm_dev_policy_add(struct net *net, struct xfrm_policy *xp, - - xdo->dev = dev; - netdev_tracker_alloc(dev, &xdo->dev_tracker, GFP_ATOMIC); -- xdo->real_dev = dev; - xdo->type = XFRM_DEV_OFFLOAD_PACKET; - switch (dir) { - case XFRM_POLICY_IN: -@@ -393,7 +392,6 @@ int xfrm_dev_policy_add(struct net *net, struct xfrm_policy *xp, - err = dev->xfrmdev_ops->xdo_dev_policy_add(xp, extack); - if (err) { - xdo->dev = NULL; -- xdo->real_dev = NULL; - xdo->type = XFRM_DEV_OFFLOAD_UNSPECIFIED; - xdo->dir = 0; - netdev_put(dev, &xdo->dev_tracker); -diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c -index 86029cf5358c7a..d2bd5bddfb05d8 100644 ---- a/net/xfrm/xfrm_state.c -+++ b/net/xfrm/xfrm_state.c -@@ -1326,7 +1326,6 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, - xso->type = XFRM_DEV_OFFLOAD_PACKET; - xso->dir = xdo->dir; - xso->dev = xdo->dev; -- xso->real_dev = xdo->real_dev; - xso->flags = XFRM_DEV_OFFLOAD_FLAG_ACQ; - netdev_hold(xso->dev, &xso->dev_tracker, GFP_ATOMIC); - error = xso->dev->xfrmdev_ops->xdo_dev_state_add(x, NULL); -@@ -1334,7 +1333,6 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, - xso->dir = 0; - netdev_put(xso->dev, &xso->dev_tracker); - xso->dev = NULL; -- xso->real_dev = NULL; - xso->type = XFRM_DEV_OFFLOAD_UNSPECIFIED; - x->km.state = XFRM_STATE_DEAD; - to_put = x; -diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn -index 0ea3281a92e1eb..570f64e2ddf107 100644 ---- a/scripts/Makefile.extrawarn -+++ b/scripts/Makefile.extrawarn -@@ -29,6 +29,18 @@ KBUILD_CFLAGS-$(CONFIG_CC_NO_ARRAY_BOUNDS) += -Wno-array-bounds - ifdef CONFIG_CC_IS_CLANG - # The kernel builds with '-std=gnu11' so use of GNU extensions is acceptable. - KBUILD_CFLAGS += -Wno-gnu -+ -+# Clang may emit a warning when a const variable, such as the dummy variables -+# in typecheck(), or const member of an aggregate type are not initialized, -+# which can result in unexpected behavior. However, in many audited cases of -+# the "field" variant of the warning, this is intentional because the field is -+# never used within a particular call path, the field is within a union with -+# other non-const members, or the containing object is not const so the field -+# can be modified via memcpy() / memset(). While the variable warning also gets -+# disabled with this same switch, there should not be too much coverage lost -+# because -Wuninitialized will still flag when an uninitialized const variable -+# is used. -+KBUILD_CFLAGS += $(call cc-disable-warning, default-const-init-unsafe) - else - - # gcc inanely warns about local variables called 'main' -diff --git a/scripts/gcc-plugins/gcc-common.h b/scripts/gcc-plugins/gcc-common.h -index 1ae39b9f4a95ef..90e83d62adb547 100644 ---- a/scripts/gcc-plugins/gcc-common.h -+++ b/scripts/gcc-plugins/gcc-common.h -@@ -128,6 +128,38 @@ static inline tree build_const_char_string(int len, const char *str) - return cstr; - } - -+static inline void __add_type_attr(tree type, const char *attr, tree args) -+{ -+ tree oldattr; -+ -+ if (type == NULL_TREE) -+ return; -+ oldattr = lookup_attribute(attr, TYPE_ATTRIBUTES(type)); -+ if (oldattr != NULL_TREE) { -+ gcc_assert(TREE_VALUE(oldattr) == args || TREE_VALUE(TREE_VALUE(oldattr)) == TREE_VALUE(args)); -+ return; -+ } -+ -+ TYPE_ATTRIBUTES(type) = copy_list(TYPE_ATTRIBUTES(type)); -+ TYPE_ATTRIBUTES(type) = tree_cons(get_identifier(attr), args, TYPE_ATTRIBUTES(type)); -+} -+ -+static inline void add_type_attr(tree type, const char *attr, tree args) -+{ -+ tree main_variant = TYPE_MAIN_VARIANT(type); -+ -+ __add_type_attr(TYPE_CANONICAL(type), attr, args); -+ __add_type_attr(TYPE_CANONICAL(main_variant), attr, args); -+ __add_type_attr(main_variant, attr, args); -+ -+ for (type = TYPE_NEXT_VARIANT(main_variant); type; type = TYPE_NEXT_VARIANT(type)) { -+ if (!lookup_attribute(attr, TYPE_ATTRIBUTES(type))) -+ TYPE_ATTRIBUTES(type) = TYPE_ATTRIBUTES(main_variant); -+ -+ __add_type_attr(TYPE_CANONICAL(type), attr, args); -+ } -+} -+ - #define PASS_INFO(NAME, REF, ID, POS) \ - struct register_pass_info NAME##_pass_info = { \ - .pass = make_##NAME##_pass(), \ -diff --git a/scripts/gcc-plugins/randomize_layout_plugin.c b/scripts/gcc-plugins/randomize_layout_plugin.c -index 746ff2d272f256..e70eef049ada66 100644 ---- a/scripts/gcc-plugins/randomize_layout_plugin.c -+++ b/scripts/gcc-plugins/randomize_layout_plugin.c -@@ -77,6 +77,9 @@ static tree handle_randomize_layout_attr(tree *node, tree name, tree args, int f - - if (TYPE_P(*node)) { - type = *node; -+ } else if (TREE_CODE(*node) == FIELD_DECL) { -+ *no_add_attrs = false; -+ return NULL_TREE; - } else { - gcc_assert(TREE_CODE(*node) == TYPE_DECL); - type = TREE_TYPE(*node); -@@ -348,35 +351,18 @@ static int relayout_struct(tree type) - - shuffle(type, (tree *)newtree, shuffle_length); - -- /* -- * set up a bogus anonymous struct field designed to error out on unnamed struct initializers -- * as gcc provides no other way to detect such code -- */ -- list = make_node(FIELD_DECL); -- TREE_CHAIN(list) = newtree[0]; -- TREE_TYPE(list) = void_type_node; -- DECL_SIZE(list) = bitsize_zero_node; -- DECL_NONADDRESSABLE_P(list) = 1; -- DECL_FIELD_BIT_OFFSET(list) = bitsize_zero_node; -- DECL_SIZE_UNIT(list) = size_zero_node; -- DECL_FIELD_OFFSET(list) = size_zero_node; -- DECL_CONTEXT(list) = type; -- // to satisfy the constify plugin -- TREE_READONLY(list) = 1; -- - for (i = 0; i < num_fields - 1; i++) - TREE_CHAIN(newtree[i]) = newtree[i+1]; - TREE_CHAIN(newtree[num_fields - 1]) = NULL_TREE; - -+ add_type_attr(type, "randomize_performed", NULL_TREE); -+ add_type_attr(type, "designated_init", NULL_TREE); -+ if (has_flexarray) -+ add_type_attr(type, "has_flexarray", NULL_TREE); -+ - main_variant = TYPE_MAIN_VARIANT(type); -- for (variant = main_variant; variant; variant = TYPE_NEXT_VARIANT(variant)) { -- TYPE_FIELDS(variant) = list; -- TYPE_ATTRIBUTES(variant) = copy_list(TYPE_ATTRIBUTES(variant)); -- TYPE_ATTRIBUTES(variant) = tree_cons(get_identifier("randomize_performed"), NULL_TREE, TYPE_ATTRIBUTES(variant)); -- TYPE_ATTRIBUTES(variant) = tree_cons(get_identifier("designated_init"), NULL_TREE, TYPE_ATTRIBUTES(variant)); -- if (has_flexarray) -- TYPE_ATTRIBUTES(type) = tree_cons(get_identifier("has_flexarray"), NULL_TREE, TYPE_ATTRIBUTES(type)); -- } -+ for (variant = main_variant; variant; variant = TYPE_NEXT_VARIANT(variant)) -+ TYPE_FIELDS(variant) = newtree[0]; - - /* - * force a re-layout of the main variant -@@ -444,10 +430,8 @@ static void randomize_type(tree type) - if (lookup_attribute("randomize_layout", TYPE_ATTRIBUTES(TYPE_MAIN_VARIANT(type))) || is_pure_ops_struct(type)) - relayout_struct(type); - -- for (variant = TYPE_MAIN_VARIANT(type); variant; variant = TYPE_NEXT_VARIANT(variant)) { -- TYPE_ATTRIBUTES(type) = copy_list(TYPE_ATTRIBUTES(type)); -- TYPE_ATTRIBUTES(type) = tree_cons(get_identifier("randomize_considered"), NULL_TREE, TYPE_ATTRIBUTES(type)); -- } -+ add_type_attr(type, "randomize_considered", NULL_TREE); -+ - #ifdef __DEBUG_PLUGIN - fprintf(stderr, "Marking randomize_considered on struct %s\n", ORIG_TYPE_NAME(type)); - #ifdef __DEBUG_VERBOSE -diff --git a/sound/soc/apple/mca.c b/sound/soc/apple/mca.c -index ce77934f3eef31..0e96caa607fb8c 100644 ---- a/sound/soc/apple/mca.c -+++ b/sound/soc/apple/mca.c -@@ -464,6 +464,28 @@ static int mca_configure_serdes(struct mca_cluster *cl, int serdes_unit, - return -EINVAL; - } - -+static int mca_fe_startup(struct snd_pcm_substream *substream, -+ struct snd_soc_dai *dai) -+{ -+ struct mca_cluster *cl = mca_dai_to_cluster(dai); -+ unsigned int mask, nchannels; -+ -+ if (cl->tdm_slots) { -+ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) -+ mask = cl->tdm_tx_mask; -+ else -+ mask = cl->tdm_rx_mask; -+ -+ nchannels = hweight32(mask); -+ } else { -+ nchannels = 2; -+ } -+ -+ return snd_pcm_hw_constraint_minmax(substream->runtime, -+ SNDRV_PCM_HW_PARAM_CHANNELS, -+ 1, nchannels); -+} -+ - static int mca_fe_set_tdm_slot(struct snd_soc_dai *dai, unsigned int tx_mask, - unsigned int rx_mask, int slots, int slot_width) - { -@@ -680,6 +702,7 @@ static int mca_fe_hw_params(struct snd_pcm_substream *substream, - } - - static const struct snd_soc_dai_ops mca_fe_ops = { -+ .startup = mca_fe_startup, - .set_fmt = mca_fe_set_fmt, - .set_bclk_ratio = mca_set_bclk_ratio, - .set_tdm_slot = mca_fe_set_tdm_slot, -diff --git a/sound/soc/codecs/hda.c b/sound/soc/codecs/hda.c -index d57b043d6bfefe..42aca0a63c441e 100644 ---- a/sound/soc/codecs/hda.c -+++ b/sound/soc/codecs/hda.c -@@ -150,7 +150,7 @@ int hda_codec_probe_complete(struct hda_codec *codec) - ret = snd_hda_codec_build_controls(codec); - if (ret < 0) { - dev_err(&hdev->dev, "unable to create controls %d\n", ret); -- goto out; -+ return ret; - } - - /* Bus suspended codecs as it does not manage their pm */ -@@ -158,7 +158,7 @@ int hda_codec_probe_complete(struct hda_codec *codec) - /* rpm was forbidden in snd_hda_codec_device_new() */ - snd_hda_codec_set_power_save(codec, 2000); - snd_hda_codec_register(codec); --out: -+ - /* Complement pm_runtime_get_sync(bus) in probe */ - pm_runtime_mark_last_busy(bus->dev); - pm_runtime_put_autosuspend(bus->dev); -diff --git a/sound/soc/codecs/tas2764.c b/sound/soc/codecs/tas2764.c -index 72d6356b898148..054c6f860675a1 100644 ---- a/sound/soc/codecs/tas2764.c -+++ b/sound/soc/codecs/tas2764.c -@@ -542,7 +542,7 @@ static int tas2764_codec_probe(struct snd_soc_component *component) - tas2764_reset(tas2764); - - if (tas2764->irq) { -- ret = snd_soc_component_write(tas2764->component, TAS2764_INT_MASK0, 0xff); -+ ret = snd_soc_component_write(tas2764->component, TAS2764_INT_MASK0, 0x00); - if (ret < 0) - return ret; - -diff --git a/sound/soc/intel/avs/debugfs.c b/sound/soc/intel/avs/debugfs.c -index bdd388ec01eaf7..26d0c3a5a9542d 100644 ---- a/sound/soc/intel/avs/debugfs.c -+++ b/sound/soc/intel/avs/debugfs.c -@@ -371,7 +371,10 @@ static ssize_t trace_control_write(struct file *file, const char __user *from, s - return ret; - - num_elems = *array; -- resource_mask = array[1]; -+ if (!num_elems) { -+ ret = -EINVAL; -+ goto free_array; -+ } - - /* - * Disable if just resource mask is provided - no log priority flags. -@@ -379,6 +382,7 @@ static ssize_t trace_control_write(struct file *file, const char __user *from, s - * Enable input format: mask, prio1, .., prioN - * Where 'N' equals number of bits set in the 'mask'. - */ -+ resource_mask = array[1]; - if (num_elems == 1) { - ret = disable_logs(adev, resource_mask); - } else { -diff --git a/sound/soc/intel/avs/ipc.c b/sound/soc/intel/avs/ipc.c -index 74f676fdfba29d..afd472906ede4c 100644 ---- a/sound/soc/intel/avs/ipc.c -+++ b/sound/soc/intel/avs/ipc.c -@@ -169,7 +169,9 @@ static void avs_dsp_exception_caught(struct avs_dev *adev, union avs_notify_msg - - dev_crit(adev->dev, "communication severed, rebooting dsp..\n"); - -- cancel_delayed_work_sync(&ipc->d0ix_work); -+ /* Avoid deadlock as the exception may be the response to SET_D0IX. */ -+ if (current_work() != &ipc->d0ix_work.work) -+ cancel_delayed_work_sync(&ipc->d0ix_work); - ipc->in_d0ix = false; - /* Re-enabled on recovery completion. */ - pm_runtime_disable(adev->dev); -diff --git a/sound/soc/sof/ipc4-pcm.c b/sound/soc/sof/ipc4-pcm.c -index bb5df0d214e367..a29632423ccda1 100644 ---- a/sound/soc/sof/ipc4-pcm.c -+++ b/sound/soc/sof/ipc4-pcm.c -@@ -615,7 +615,8 @@ static int sof_ipc4_pcm_setup(struct snd_sof_dev *sdev, struct snd_sof_pcm *spcm - - /* allocate memory for max number of pipeline IDs */ - pipeline_list->pipelines = kcalloc(ipc4_data->max_num_pipelines, -- sizeof(struct snd_sof_widget *), GFP_KERNEL); -+ sizeof(*pipeline_list->pipelines), -+ GFP_KERNEL); - if (!pipeline_list->pipelines) { - sof_ipc4_pcm_free(sdev, spcm); - return -ENOMEM; -diff --git a/sound/soc/ti/omap-hdmi.c b/sound/soc/ti/omap-hdmi.c -index 0a731b21e5a58d..72fabf22a02ee7 100644 ---- a/sound/soc/ti/omap-hdmi.c -+++ b/sound/soc/ti/omap-hdmi.c -@@ -361,17 +361,20 @@ static int omap_hdmi_audio_probe(struct platform_device *pdev) - if (!card->dai_link) - return -ENOMEM; - -- compnent = devm_kzalloc(dev, sizeof(*compnent), GFP_KERNEL); -+ compnent = devm_kzalloc(dev, 2 * sizeof(*compnent), GFP_KERNEL); - if (!compnent) - return -ENOMEM; -- card->dai_link->cpus = compnent; -+ card->dai_link->cpus = &compnent[0]; - card->dai_link->num_cpus = 1; - card->dai_link->codecs = &asoc_dummy_dlc; - card->dai_link->num_codecs = 1; -+ card->dai_link->platforms = &compnent[1]; -+ card->dai_link->num_platforms = 1; - - card->dai_link->name = card->name; - card->dai_link->stream_name = card->name; - card->dai_link->cpus->dai_name = dev_name(ad->dssdev); -+ card->dai_link->platforms->name = dev_name(ad->dssdev); - card->num_links = 1; - card->dev = dev; - -diff --git a/sound/usb/implicit.c b/sound/usb/implicit.c -index 4727043fd74580..77f06da93151e8 100644 ---- a/sound/usb/implicit.c -+++ b/sound/usb/implicit.c -@@ -57,6 +57,7 @@ static const struct snd_usb_implicit_fb_match playback_implicit_fb_quirks[] = { - IMPLICIT_FB_FIXED_DEV(0x31e9, 0x0002, 0x81, 2), /* Solid State Logic SSL2+ */ - IMPLICIT_FB_FIXED_DEV(0x0499, 0x172f, 0x81, 2), /* Steinberg UR22C */ - IMPLICIT_FB_FIXED_DEV(0x0d9a, 0x00df, 0x81, 2), /* RTX6001 */ -+ IMPLICIT_FB_FIXED_DEV(0x19f7, 0x000a, 0x84, 3), /* RODE AI-1 */ - IMPLICIT_FB_FIXED_DEV(0x22f0, 0x0006, 0x81, 3), /* Allen&Heath Qu-16 */ - IMPLICIT_FB_FIXED_DEV(0x1686, 0xf029, 0x82, 2), /* Zoom UAC-2 */ - IMPLICIT_FB_FIXED_DEV(0x2466, 0x8003, 0x86, 2), /* Fractal Audio Axe-Fx II */ -diff --git a/tools/arch/x86/kcpuid/kcpuid.c b/tools/arch/x86/kcpuid/kcpuid.c -index b7965dfff33a9a..8c2644f3497e64 100644 ---- a/tools/arch/x86/kcpuid/kcpuid.c -+++ b/tools/arch/x86/kcpuid/kcpuid.c -@@ -1,11 +1,12 @@ - // SPDX-License-Identifier: GPL-2.0 - #define _GNU_SOURCE - --#include -+#include -+#include - #include -+#include - #include - #include --#include - - #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0])) - #define min(a, b) (((a) < (b)) ? (a) : (b)) -@@ -156,14 +157,14 @@ static bool cpuid_store(struct cpuid_range *range, u32 f, int subleaf, - if (!func->leafs) { - func->leafs = malloc(sizeof(struct subleaf)); - if (!func->leafs) -- perror("malloc func leaf"); -+ err(EXIT_FAILURE, NULL); - - func->nr = 1; - } else { - s = func->nr; - func->leafs = realloc(func->leafs, (s + 1) * sizeof(*leaf)); - if (!func->leafs) -- perror("realloc f->leafs"); -+ err(EXIT_FAILURE, NULL); - - func->nr++; - } -@@ -222,7 +223,7 @@ struct cpuid_range *setup_cpuid_range(u32 input_eax) - - range = malloc(sizeof(struct cpuid_range)); - if (!range) -- perror("malloc range"); -+ err(EXIT_FAILURE, NULL); - - if (input_eax & 0x80000000) - range->is_ext = true; -@@ -231,7 +232,7 @@ struct cpuid_range *setup_cpuid_range(u32 input_eax) - - range->funcs = malloc(sizeof(struct cpuid_func) * idx_func); - if (!range->funcs) -- perror("malloc range->funcs"); -+ err(EXIT_FAILURE, NULL); - - range->nr = idx_func; - memset(range->funcs, 0, sizeof(struct cpuid_func) * idx_func); -@@ -387,8 +388,8 @@ static int parse_line(char *line) - return 0; - - err_exit: -- printf("Warning: wrong line format:\n"); -- printf("\tline[%d]: %s\n", flines, line); -+ warnx("Wrong line format:\n" -+ "\tline[%d]: %s", flines, line); - return -1; - } - -@@ -410,10 +411,8 @@ static void parse_text(void) - file = fopen("./cpuid.csv", "r"); - } - -- if (!file) { -- printf("Fail to open '%s'\n", filename); -- return; -- } -+ if (!file) -+ err(EXIT_FAILURE, "%s", filename); - - while (1) { - ret = getline(&line, &len, file); -@@ -521,7 +520,7 @@ static inline struct cpuid_func *index_to_func(u32 index) - func_idx = index & 0xffff; - - if ((func_idx + 1) > (u32)range->nr) { -- printf("ERR: invalid input index (0x%x)\n", index); -+ warnx("Invalid input index (0x%x)", index); - return NULL; - } - return &range->funcs[func_idx]; -@@ -553,7 +552,7 @@ static void show_info(void) - return; - } - -- printf("ERR: invalid input subleaf (0x%x)\n", user_sub); -+ warnx("Invalid input subleaf (0x%x)", user_sub); - } - - show_func(func); -@@ -584,15 +583,15 @@ static void setup_platform_cpuid(void) - - static void usage(void) - { -- printf("kcpuid [-abdfhr] [-l leaf] [-s subleaf]\n" -- "\t-a|--all Show both bit flags and complex bit fields info\n" -- "\t-b|--bitflags Show boolean flags only\n" -- "\t-d|--detail Show details of the flag/fields (default)\n" -- "\t-f|--flags Specify the cpuid csv file\n" -- "\t-h|--help Show usage info\n" -- "\t-l|--leaf=index Specify the leaf you want to check\n" -- "\t-r|--raw Show raw cpuid data\n" -- "\t-s|--subleaf=sub Specify the subleaf you want to check\n" -+ warnx("kcpuid [-abdfhr] [-l leaf] [-s subleaf]\n" -+ "\t-a|--all Show both bit flags and complex bit fields info\n" -+ "\t-b|--bitflags Show boolean flags only\n" -+ "\t-d|--detail Show details of the flag/fields (default)\n" -+ "\t-f|--flags Specify the CPUID CSV file\n" -+ "\t-h|--help Show usage info\n" -+ "\t-l|--leaf=index Specify the leaf you want to check\n" -+ "\t-r|--raw Show raw CPUID data\n" -+ "\t-s|--subleaf=sub Specify the subleaf you want to check" - ); - } - -@@ -643,7 +642,7 @@ static int parse_options(int argc, char *argv[]) - user_sub = strtoul(optarg, NULL, 0); - break; - default: -- printf("%s: Invalid option '%c'\n", argv[0], optopt); -+ warnx("Invalid option '%c'", optopt); - return -1; - } - -diff --git a/tools/bpf/resolve_btfids/Makefile b/tools/bpf/resolve_btfids/Makefile -index 4b8079f294f65b..b0072e64b01023 100644 ---- a/tools/bpf/resolve_btfids/Makefile -+++ b/tools/bpf/resolve_btfids/Makefile -@@ -19,7 +19,7 @@ endif - - # Overrides for the prepare step libraries. - HOST_OVERRIDES := AR="$(HOSTAR)" CC="$(HOSTCC)" LD="$(HOSTLD)" ARCH="$(HOSTARCH)" \ -- CROSS_COMPILE="" EXTRA_CFLAGS="$(HOSTCFLAGS)" -+ CROSS_COMPILE="" CLANG_CROSS_FLAGS="" EXTRA_CFLAGS="$(HOSTCFLAGS)" - - RM ?= rm - HOSTCC ?= gcc -diff --git a/tools/lib/bpf/bpf_core_read.h b/tools/lib/bpf/bpf_core_read.h -index e2b9e8415c0446..b3fc384595a9f3 100644 ---- a/tools/lib/bpf/bpf_core_read.h -+++ b/tools/lib/bpf/bpf_core_read.h -@@ -312,7 +312,13 @@ enum bpf_enum_value_kind { - #define ___arrow10(a, b, c, d, e, f, g, h, i, j) a->b->c->d->e->f->g->h->i->j - #define ___arrow(...) ___apply(___arrow, ___narg(__VA_ARGS__))(__VA_ARGS__) - -+#if defined(__clang__) && (__clang_major__ >= 19) -+#define ___type(...) __typeof_unqual__(___arrow(__VA_ARGS__)) -+#elif defined(__GNUC__) && (__GNUC__ >= 14) -+#define ___type(...) __typeof_unqual__(___arrow(__VA_ARGS__)) -+#else - #define ___type(...) typeof(___arrow(__VA_ARGS__)) -+#endif - - #define ___read(read_fn, dst, src_type, src, accessor) \ - read_fn((void *)(dst), sizeof(*(dst)), &((src_type)(src))->accessor) -diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c -index fa2abe56e845d9..5dc2e555533586 100644 ---- a/tools/lib/bpf/libbpf.c -+++ b/tools/lib/bpf/libbpf.c -@@ -246,7 +246,7 @@ void libbpf_print(enum libbpf_print_level level, const char *format, ...) - old_errno = errno; - - va_start(args, format); -- __libbpf_pr(level, format, args); -+ print_fn(level, format, args); - va_end(args); - - errno = old_errno; -@@ -838,7 +838,7 @@ bpf_object__add_programs(struct bpf_object *obj, Elf_Data *sec_data, - return -LIBBPF_ERRNO__FORMAT; - } - -- if (sec_off + prog_sz > sec_sz) { -+ if (sec_off + prog_sz > sec_sz || sec_off + prog_sz < sec_off) { - pr_warn("sec '%s': program at offset %zu crosses section boundary\n", - sec_name, sec_off); - return -LIBBPF_ERRNO__FORMAT; -@@ -12453,7 +12453,6 @@ struct perf_buffer *perf_buffer__new(int map_fd, size_t page_cnt, - attr.config = PERF_COUNT_SW_BPF_OUTPUT; - attr.type = PERF_TYPE_SOFTWARE; - attr.sample_type = PERF_SAMPLE_RAW; -- attr.sample_period = sample_period; - attr.wakeup_events = sample_period; - - p.attr = &attr; -diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c -index a3a190d13db8a0..e1b3136643aa86 100644 ---- a/tools/lib/bpf/linker.c -+++ b/tools/lib/bpf/linker.c -@@ -1187,7 +1187,7 @@ static int linker_append_sec_data(struct bpf_linker *linker, struct src_obj *obj - } else { - if (!secs_match(dst_sec, src_sec)) { - pr_warn("ELF sections %s are incompatible\n", src_sec->sec_name); -- return -1; -+ return -EINVAL; - } - - /* "license" and "version" sections are deduped */ -@@ -2034,7 +2034,7 @@ static int linker_append_elf_relos(struct bpf_linker *linker, struct src_obj *ob - } - } else if (!secs_match(dst_sec, src_sec)) { - pr_warn("sections %s are not compatible\n", src_sec->sec_name); -- return -1; -+ return -EINVAL; - } - - /* shdr->sh_link points to SYMTAB */ -diff --git a/tools/lib/bpf/nlattr.c b/tools/lib/bpf/nlattr.c -index 975e265eab3bfe..06663f9ea581f9 100644 ---- a/tools/lib/bpf/nlattr.c -+++ b/tools/lib/bpf/nlattr.c -@@ -63,16 +63,16 @@ static int validate_nla(struct nlattr *nla, int maxtype, - minlen = nla_attr_minlen[pt->type]; - - if (libbpf_nla_len(nla) < minlen) -- return -1; -+ return -EINVAL; - - if (pt->maxlen && libbpf_nla_len(nla) > pt->maxlen) -- return -1; -+ return -EINVAL; - - if (pt->type == LIBBPF_NLA_STRING) { - char *data = libbpf_nla_data(nla); - - if (data[libbpf_nla_len(nla) - 1] != '\0') -- return -1; -+ return -EINVAL; - } - - return 0; -@@ -118,19 +118,18 @@ int libbpf_nla_parse(struct nlattr *tb[], int maxtype, struct nlattr *head, - if (policy) { - err = validate_nla(nla, maxtype, policy); - if (err < 0) -- goto errout; -+ return err; - } - -- if (tb[type]) -+ if (tb[type]) { - pr_warn("Attribute of type %#x found multiple times in message, " - "previous attribute is being ignored.\n", type); -+ } - - tb[type] = nla; - } - -- err = 0; --errout: -- return err; -+ return 0; - } - - /** -diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config -index d66b52407e19c6..9da9f878f50f7b 100644 ---- a/tools/perf/Makefile.config -+++ b/tools/perf/Makefile.config -@@ -554,6 +554,8 @@ ifndef NO_LIBELF - ifeq ($(feature-libdebuginfod), 1) - CFLAGS += -DHAVE_DEBUGINFOD_SUPPORT - EXTLIBS += -ldebuginfod -+ else -+ $(warning No elfutils/debuginfod.h found, no debuginfo server support, please install libdebuginfod-dev/elfutils-debuginfod-client-devel or equivalent) - endif - endif - -diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c -index b94ae33a343c2a..81f77c0505fde0 100644 ---- a/tools/perf/builtin-record.c -+++ b/tools/perf/builtin-record.c -@@ -3427,7 +3427,7 @@ static struct option __record_options[] = { - "sample selected machine registers on interrupt," - " use '-I?' to list register names", parse_intr_regs), - OPT_CALLBACK_OPTARG(0, "user-regs", &record.opts.sample_user_regs, NULL, "any register", -- "sample selected machine registers on interrupt," -+ "sample selected machine registers in user space," - " use '--user-regs=?' to list register names", parse_user_regs), - OPT_BOOLEAN(0, "running-time", &record.opts.running_time, - "Record running/enabled time of read (:S) events"), -diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c -index 12bdbf3ecc6ae4..7ee3285af10c99 100644 ---- a/tools/perf/builtin-trace.c -+++ b/tools/perf/builtin-trace.c -@@ -2586,8 +2586,8 @@ errno_print: { - else if (sc->fmt->errpid) { - struct thread *child = machine__find_thread(trace->host, ret, ret); - -+ fprintf(trace->output, "%ld", ret); - if (child != NULL) { -- fprintf(trace->output, "%ld", ret); - if (thread__comm_set(child)) - fprintf(trace->output, " (%s)", thread__comm_str(child)); - thread__put(child); -@@ -3589,10 +3589,13 @@ static int trace__set_filter_loop_pids(struct trace *trace) - if (!strcmp(thread__comm_str(parent), "sshd") || - strstarts(thread__comm_str(parent), "gnome-terminal")) { - pids[nr++] = thread__tid(parent); -+ thread__put(parent); - break; - } -+ thread__put(thread); - thread = parent; - } -+ thread__put(thread); - - err = evlist__append_tp_filter_pids(trace->evlist, nr, pids); - if (!err && trace->filter_pids.map) -diff --git a/tools/perf/scripts/python/exported-sql-viewer.py b/tools/perf/scripts/python/exported-sql-viewer.py -index 13f2d8a8161096..99742013676b3d 100755 ---- a/tools/perf/scripts/python/exported-sql-viewer.py -+++ b/tools/perf/scripts/python/exported-sql-viewer.py -@@ -680,7 +680,10 @@ class CallGraphModelBase(TreeModel): - s = value.replace("%", "\%") - s = s.replace("_", "\_") - # Translate * and ? into SQL LIKE pattern characters % and _ -- trans = string.maketrans("*?", "%_") -+ if sys.version_info[0] == 3: -+ trans = str.maketrans("*?", "%_") -+ else: -+ trans = string.maketrans("*?", "%_") - match = " LIKE '" + str(s).translate(trans) + "'" - else: - match = " GLOB '" + str(value) + "'" -diff --git a/tools/perf/tests/switch-tracking.c b/tools/perf/tests/switch-tracking.c -index e52b031bedc5a9..2c7bdf4fd55edd 100644 ---- a/tools/perf/tests/switch-tracking.c -+++ b/tools/perf/tests/switch-tracking.c -@@ -258,7 +258,7 @@ static int compar(const void *a, const void *b) - const struct event_node *nodeb = b; - s64 cmp = nodea->event_time - nodeb->event_time; - -- return cmp; -+ return cmp < 0 ? -1 : (cmp > 0 ? 1 : 0); - } - - static int process_events(struct evlist *evlist, -diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c -index bb59d27642ccf2..a53a0257a4bca2 100644 ---- a/tools/perf/ui/browsers/hists.c -+++ b/tools/perf/ui/browsers/hists.c -@@ -3239,10 +3239,10 @@ static int evsel__hists_browse(struct evsel *evsel, int nr_events, const char *h - /* - * No need to set actions->dso here since - * it's just to remove the current filter. -- * Ditto for thread below. - */ - do_zoom_dso(browser, actions); - } else if (top == &browser->hists->thread_filter) { -+ actions->thread = thread; - do_zoom_thread(browser, actions); - } else if (top == &browser->hists->socket_filter) { - do_zoom_socket(browser, actions); -diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c -index 4db9a098f59262..e9f97c0c335827 100644 ---- a/tools/perf/util/intel-pt.c -+++ b/tools/perf/util/intel-pt.c -@@ -127,6 +127,7 @@ struct intel_pt { - - bool single_pebs; - bool sample_pebs; -+ int pebs_data_src_fmt; - struct evsel *pebs_evsel; - - u64 evt_sample_type; -@@ -175,6 +176,7 @@ enum switch_state { - struct intel_pt_pebs_event { - struct evsel *evsel; - u64 id; -+ int data_src_fmt; - }; - - struct intel_pt_queue { -@@ -2232,7 +2234,146 @@ static void intel_pt_add_lbrs(struct branch_stack *br_stack, - } - } - --static int intel_pt_do_synth_pebs_sample(struct intel_pt_queue *ptq, struct evsel *evsel, u64 id) -+#define P(a, b) PERF_MEM_S(a, b) -+#define OP_LH (P(OP, LOAD) | P(LVL, HIT)) -+#define LEVEL(x) P(LVLNUM, x) -+#define REM P(REMOTE, REMOTE) -+#define SNOOP_NONE_MISS (P(SNOOP, NONE) | P(SNOOP, MISS)) -+ -+#define PERF_PEBS_DATA_SOURCE_GRT_MAX 0x10 -+#define PERF_PEBS_DATA_SOURCE_GRT_MASK (PERF_PEBS_DATA_SOURCE_GRT_MAX - 1) -+ -+/* Based on kernel __intel_pmu_pebs_data_source_grt() and pebs_data_source */ -+static const u64 pebs_data_source_grt[PERF_PEBS_DATA_SOURCE_GRT_MAX] = { -+ P(OP, LOAD) | P(LVL, MISS) | LEVEL(L3) | P(SNOOP, NA), /* L3 miss|SNP N/A */ -+ OP_LH | P(LVL, L1) | LEVEL(L1) | P(SNOOP, NONE), /* L1 hit|SNP None */ -+ OP_LH | P(LVL, LFB) | LEVEL(LFB) | P(SNOOP, NONE), /* LFB/MAB hit|SNP None */ -+ OP_LH | P(LVL, L2) | LEVEL(L2) | P(SNOOP, NONE), /* L2 hit|SNP None */ -+ OP_LH | P(LVL, L3) | LEVEL(L3) | P(SNOOP, NONE), /* L3 hit|SNP None */ -+ OP_LH | P(LVL, L3) | LEVEL(L3) | P(SNOOP, HIT), /* L3 hit|SNP Hit */ -+ OP_LH | P(LVL, L3) | LEVEL(L3) | P(SNOOP, HITM), /* L3 hit|SNP HitM */ -+ OP_LH | P(LVL, L3) | LEVEL(L3) | P(SNOOP, HITM), /* L3 hit|SNP HitM */ -+ OP_LH | P(LVL, L3) | LEVEL(L3) | P(SNOOPX, FWD), /* L3 hit|SNP Fwd */ -+ OP_LH | P(LVL, REM_CCE1) | REM | LEVEL(L3) | P(SNOOP, HITM), /* Remote L3 hit|SNP HitM */ -+ OP_LH | P(LVL, LOC_RAM) | LEVEL(RAM) | P(SNOOP, HIT), /* RAM hit|SNP Hit */ -+ OP_LH | P(LVL, REM_RAM1) | REM | LEVEL(L3) | P(SNOOP, HIT), /* Remote L3 hit|SNP Hit */ -+ OP_LH | P(LVL, LOC_RAM) | LEVEL(RAM) | SNOOP_NONE_MISS, /* RAM hit|SNP None or Miss */ -+ OP_LH | P(LVL, REM_RAM1) | LEVEL(RAM) | REM | SNOOP_NONE_MISS, /* Remote RAM hit|SNP None or Miss */ -+ OP_LH | P(LVL, IO) | LEVEL(NA) | P(SNOOP, NONE), /* I/O hit|SNP None */ -+ OP_LH | P(LVL, UNC) | LEVEL(NA) | P(SNOOP, NONE), /* Uncached hit|SNP None */ -+}; -+ -+/* Based on kernel __intel_pmu_pebs_data_source_cmt() and pebs_data_source */ -+static const u64 pebs_data_source_cmt[PERF_PEBS_DATA_SOURCE_GRT_MAX] = { -+ P(OP, LOAD) | P(LVL, MISS) | LEVEL(L3) | P(SNOOP, NA), /* L3 miss|SNP N/A */ -+ OP_LH | P(LVL, L1) | LEVEL(L1) | P(SNOOP, NONE), /* L1 hit|SNP None */ -+ OP_LH | P(LVL, LFB) | LEVEL(LFB) | P(SNOOP, NONE), /* LFB/MAB hit|SNP None */ -+ OP_LH | P(LVL, L2) | LEVEL(L2) | P(SNOOP, NONE), /* L2 hit|SNP None */ -+ OP_LH | P(LVL, L3) | LEVEL(L3) | P(SNOOP, NONE), /* L3 hit|SNP None */ -+ OP_LH | P(LVL, L3) | LEVEL(L3) | P(SNOOP, MISS), /* L3 hit|SNP Hit */ -+ OP_LH | P(LVL, L3) | LEVEL(L3) | P(SNOOP, HIT), /* L3 hit|SNP HitM */ -+ OP_LH | P(LVL, L3) | LEVEL(L3) | P(SNOOPX, FWD), /* L3 hit|SNP HitM */ -+ OP_LH | P(LVL, L3) | LEVEL(L3) | P(SNOOP, HITM), /* L3 hit|SNP Fwd */ -+ OP_LH | P(LVL, REM_CCE1) | REM | LEVEL(L3) | P(SNOOP, HITM), /* Remote L3 hit|SNP HitM */ -+ OP_LH | P(LVL, LOC_RAM) | LEVEL(RAM) | P(SNOOP, NONE), /* RAM hit|SNP Hit */ -+ OP_LH | LEVEL(RAM) | REM | P(SNOOP, NONE), /* Remote L3 hit|SNP Hit */ -+ OP_LH | LEVEL(RAM) | REM | P(SNOOPX, FWD), /* RAM hit|SNP None or Miss */ -+ OP_LH | LEVEL(RAM) | REM | P(SNOOP, HITM), /* Remote RAM hit|SNP None or Miss */ -+ OP_LH | P(LVL, IO) | LEVEL(NA) | P(SNOOP, NONE), /* I/O hit|SNP None */ -+ OP_LH | P(LVL, UNC) | LEVEL(NA) | P(SNOOP, NONE), /* Uncached hit|SNP None */ -+}; -+ -+/* Based on kernel pebs_set_tlb_lock() */ -+static inline void pebs_set_tlb_lock(u64 *val, bool tlb, bool lock) -+{ -+ /* -+ * TLB access -+ * 0 = did not miss 2nd level TLB -+ * 1 = missed 2nd level TLB -+ */ -+ if (tlb) -+ *val |= P(TLB, MISS) | P(TLB, L2); -+ else -+ *val |= P(TLB, HIT) | P(TLB, L1) | P(TLB, L2); -+ -+ /* locked prefix */ -+ if (lock) -+ *val |= P(LOCK, LOCKED); -+} -+ -+/* Based on kernel __grt_latency_data() */ -+static u64 intel_pt_grt_latency_data(u8 dse, bool tlb, bool lock, bool blk, -+ const u64 *pebs_data_source) -+{ -+ u64 val; -+ -+ dse &= PERF_PEBS_DATA_SOURCE_GRT_MASK; -+ val = pebs_data_source[dse]; -+ -+ pebs_set_tlb_lock(&val, tlb, lock); -+ -+ if (blk) -+ val |= P(BLK, DATA); -+ else -+ val |= P(BLK, NA); -+ -+ return val; -+} -+ -+/* Default value for data source */ -+#define PERF_MEM_NA (PERF_MEM_S(OP, NA) |\ -+ PERF_MEM_S(LVL, NA) |\ -+ PERF_MEM_S(SNOOP, NA) |\ -+ PERF_MEM_S(LOCK, NA) |\ -+ PERF_MEM_S(TLB, NA) |\ -+ PERF_MEM_S(LVLNUM, NA)) -+ -+enum DATA_SRC_FORMAT { -+ DATA_SRC_FORMAT_ERR = -1, -+ DATA_SRC_FORMAT_NA = 0, -+ DATA_SRC_FORMAT_GRT = 1, -+ DATA_SRC_FORMAT_CMT = 2, -+}; -+ -+/* Based on kernel grt_latency_data() and cmt_latency_data */ -+static u64 intel_pt_get_data_src(u64 mem_aux_info, int data_src_fmt) -+{ -+ switch (data_src_fmt) { -+ case DATA_SRC_FORMAT_GRT: { -+ union { -+ u64 val; -+ struct { -+ unsigned int dse:4; -+ unsigned int locked:1; -+ unsigned int stlb_miss:1; -+ unsigned int fwd_blk:1; -+ unsigned int reserved:25; -+ }; -+ } x = {.val = mem_aux_info}; -+ return intel_pt_grt_latency_data(x.dse, x.stlb_miss, x.locked, x.fwd_blk, -+ pebs_data_source_grt); -+ } -+ case DATA_SRC_FORMAT_CMT: { -+ union { -+ u64 val; -+ struct { -+ unsigned int dse:5; -+ unsigned int locked:1; -+ unsigned int stlb_miss:1; -+ unsigned int fwd_blk:1; -+ unsigned int reserved:24; -+ }; -+ } x = {.val = mem_aux_info}; -+ return intel_pt_grt_latency_data(x.dse, x.stlb_miss, x.locked, x.fwd_blk, -+ pebs_data_source_cmt); -+ } -+ default: -+ return PERF_MEM_NA; -+ } -+} -+ -+static int intel_pt_do_synth_pebs_sample(struct intel_pt_queue *ptq, struct evsel *evsel, -+ u64 id, int data_src_fmt) - { - const struct intel_pt_blk_items *items = &ptq->state->items; - struct perf_sample sample = { .ip = 0, }; -@@ -2350,6 +2491,18 @@ static int intel_pt_do_synth_pebs_sample(struct intel_pt_queue *ptq, struct evse - } - } - -+ if (sample_type & PERF_SAMPLE_DATA_SRC) { -+ if (items->has_mem_aux_info && data_src_fmt) { -+ if (data_src_fmt < 0) { -+ pr_err("Intel PT missing data_src info\n"); -+ return -1; -+ } -+ sample.data_src = intel_pt_get_data_src(items->mem_aux_info, data_src_fmt); -+ } else { -+ sample.data_src = PERF_MEM_NA; -+ } -+ } -+ - if (sample_type & PERF_SAMPLE_TRANSACTION && items->has_tsx_aux_info) { - u64 ax = items->has_rax ? items->rax : 0; - /* Refer kernel's intel_hsw_transaction() */ -@@ -2368,9 +2521,10 @@ static int intel_pt_synth_single_pebs_sample(struct intel_pt_queue *ptq) - { - struct intel_pt *pt = ptq->pt; - struct evsel *evsel = pt->pebs_evsel; -+ int data_src_fmt = pt->pebs_data_src_fmt; - u64 id = evsel->core.id[0]; - -- return intel_pt_do_synth_pebs_sample(ptq, evsel, id); -+ return intel_pt_do_synth_pebs_sample(ptq, evsel, id, data_src_fmt); - } - - static int intel_pt_synth_pebs_sample(struct intel_pt_queue *ptq) -@@ -2395,7 +2549,7 @@ static int intel_pt_synth_pebs_sample(struct intel_pt_queue *ptq) - hw_id); - return intel_pt_synth_single_pebs_sample(ptq); - } -- err = intel_pt_do_synth_pebs_sample(ptq, pe->evsel, pe->id); -+ err = intel_pt_do_synth_pebs_sample(ptq, pe->evsel, pe->id, pe->data_src_fmt); - if (err) - return err; - } -@@ -3355,6 +3509,49 @@ static int intel_pt_process_itrace_start(struct intel_pt *pt, - event->itrace_start.tid); - } - -+/* -+ * Events with data_src are identified by L1_Hit_Indication -+ * refer https://github.com/intel/perfmon -+ */ -+static int intel_pt_data_src_fmt(struct intel_pt *pt, struct evsel *evsel) -+{ -+ struct perf_env *env = pt->machine->env; -+ int fmt = DATA_SRC_FORMAT_NA; -+ -+ if (!env->cpuid) -+ return DATA_SRC_FORMAT_ERR; -+ -+ /* -+ * PEBS-via-PT is only supported on E-core non-hybrid. Of those only -+ * Gracemont and Crestmont have data_src. Check for: -+ * Alderlake N (Gracemont) -+ * Sierra Forest (Crestmont) -+ * Grand Ridge (Crestmont) -+ */ -+ -+ if (!strncmp(env->cpuid, "GenuineIntel,6,190,", 19)) -+ fmt = DATA_SRC_FORMAT_GRT; -+ -+ if (!strncmp(env->cpuid, "GenuineIntel,6,175,", 19) || -+ !strncmp(env->cpuid, "GenuineIntel,6,182,", 19)) -+ fmt = DATA_SRC_FORMAT_CMT; -+ -+ if (fmt == DATA_SRC_FORMAT_NA) -+ return fmt; -+ -+ /* -+ * Only data_src events are: -+ * mem-loads event=0xd0,umask=0x5 -+ * mem-stores event=0xd0,umask=0x6 -+ */ -+ if (evsel->core.attr.type == PERF_TYPE_RAW && -+ ((evsel->core.attr.config & 0xffff) == 0x5d0 || -+ (evsel->core.attr.config & 0xffff) == 0x6d0)) -+ return fmt; -+ -+ return DATA_SRC_FORMAT_NA; -+} -+ - static int intel_pt_process_aux_output_hw_id(struct intel_pt *pt, - union perf_event *event, - struct perf_sample *sample) -@@ -3375,6 +3572,7 @@ static int intel_pt_process_aux_output_hw_id(struct intel_pt *pt, - - ptq->pebs[hw_id].evsel = evsel; - ptq->pebs[hw_id].id = sample->id; -+ ptq->pebs[hw_id].data_src_fmt = intel_pt_data_src_fmt(pt, evsel); - - return 0; - } -@@ -3946,6 +4144,7 @@ static void intel_pt_setup_pebs_events(struct intel_pt *pt) - } - pt->single_pebs = true; - pt->sample_pebs = true; -+ pt->pebs_data_src_fmt = intel_pt_data_src_fmt(pt, evsel); - pt->pebs_evsel = evsel; - } - } -diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_nf.c b/tools/testing/selftests/bpf/prog_tests/bpf_nf.c -index b30ff6b3b81ae3..f80660c00a1a75 100644 ---- a/tools/testing/selftests/bpf/prog_tests/bpf_nf.c -+++ b/tools/testing/selftests/bpf/prog_tests/bpf_nf.c -@@ -63,6 +63,12 @@ static void test_bpf_nf_ct(int mode) - .repeat = 1, - ); - -+ if (SYS_NOFAIL("iptables-legacy --version")) { -+ fprintf(stdout, "Missing required iptables-legacy tool\n"); -+ test__skip(); -+ return; -+ } -+ - skel = test_bpf_nf__open_and_load(); - if (!ASSERT_OK_PTR(skel, "test_bpf_nf__open_and_load")) - return; -diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c -index cacf6507f69055..15325ca35f1e2b 100644 ---- a/tools/testing/selftests/seccomp/seccomp_bpf.c -+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c -@@ -3154,12 +3154,15 @@ TEST(syscall_restart) - ret = get_syscall(_metadata, child_pid); - #if defined(__arm__) - /* -- * FIXME: - * - native ARM registers do NOT expose true syscall. - * - compat ARM registers on ARM64 DO expose true syscall. -+ * - values of utsbuf.machine include 'armv8l' or 'armb8b' -+ * for ARM64 running in compat mode. - */ - ASSERT_EQ(0, uname(&utsbuf)); -- if (strncmp(utsbuf.machine, "arm", 3) == 0) { -+ if ((strncmp(utsbuf.machine, "arm", 3) == 0) && -+ (strncmp(utsbuf.machine, "armv8l", 6) != 0) && -+ (strncmp(utsbuf.machine, "armv8b", 6) != 0)) { - EXPECT_EQ(__NR_nanosleep, ret); - } else - #endif diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.094-095.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.094-095.patch deleted file mode 100644 index 6650311ac2..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.094-095.patch +++ /dev/null @@ -1,9067 +0,0 @@ -diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt -index 315a817e338042..f95734ceb82b86 100644 ---- a/Documentation/admin-guide/kernel-parameters.txt -+++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -5978,8 +5978,6 @@ - - Selecting 'on' will also enable the mitigation - against user space to user space task attacks. -- Selecting specific mitigation does not force enable -- user mitigations. - - Selecting 'off' will disable both the kernel and - the user space protections. -diff --git a/Documentation/devicetree/bindings/i2c/nvidia,tegra20-i2c.yaml b/Documentation/devicetree/bindings/i2c/nvidia,tegra20-i2c.yaml -index 424a4fc218b66b..2cb311ddd912a9 100644 ---- a/Documentation/devicetree/bindings/i2c/nvidia,tegra20-i2c.yaml -+++ b/Documentation/devicetree/bindings/i2c/nvidia,tegra20-i2c.yaml -@@ -103,7 +103,10 @@ properties: - - resets: - items: -- - description: module reset -+ - description: -+ Module reset. This property is optional for controllers in Tegra194, -+ Tegra234 etc where an internal software reset is available as an -+ alternative. - - reset-names: - items: -@@ -119,6 +122,13 @@ properties: - - const: rx - - const: tx - -+required: -+ - compatible -+ - reg -+ - interrupts -+ - clocks -+ - clock-names -+ - allOf: - - $ref: /schemas/i2c/i2c-controller.yaml - - if: -@@ -172,6 +182,18 @@ allOf: - items: - - description: phandle to the VENC power domain - -+ - if: -+ not: -+ properties: -+ compatible: -+ contains: -+ enum: -+ - nvidia,tegra194-i2c -+ then: -+ required: -+ - resets -+ - reset-names -+ - unevaluatedProperties: false - - examples: -diff --git a/Makefile b/Makefile -index 9625d9072c7781..679dff5e165c07 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 94 -+SUBLEVEL = 95 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm/boot/dts/ti/omap/am335x-bone-common.dtsi b/arch/arm/boot/dts/ti/omap/am335x-bone-common.dtsi -index 96451c8a815ccd..27e73e745e25f2 100644 ---- a/arch/arm/boot/dts/ti/omap/am335x-bone-common.dtsi -+++ b/arch/arm/boot/dts/ti/omap/am335x-bone-common.dtsi -@@ -385,7 +385,7 @@ ethphy0: ethernet-phy@0 { - /* Support GPIO reset on revision C3 boards */ - reset-gpios = <&gpio1 8 GPIO_ACTIVE_LOW>; - reset-assert-us = <300>; -- reset-deassert-us = <6500>; -+ reset-deassert-us = <50000>; - }; - }; - -diff --git a/arch/arm/mach-omap2/clockdomain.h b/arch/arm/mach-omap2/clockdomain.h -index c36fb27212615a..86a2f9e5d0ef9d 100644 ---- a/arch/arm/mach-omap2/clockdomain.h -+++ b/arch/arm/mach-omap2/clockdomain.h -@@ -48,6 +48,7 @@ - #define CLKDM_NO_AUTODEPS (1 << 4) - #define CLKDM_ACTIVE_WITH_MPU (1 << 5) - #define CLKDM_MISSING_IDLE_REPORTING (1 << 6) -+#define CLKDM_STANDBY_FORCE_WAKEUP BIT(7) - - #define CLKDM_CAN_HWSUP (CLKDM_CAN_ENABLE_AUTO | CLKDM_CAN_DISABLE_AUTO) - #define CLKDM_CAN_SWSUP (CLKDM_CAN_FORCE_SLEEP | CLKDM_CAN_FORCE_WAKEUP) -diff --git a/arch/arm/mach-omap2/clockdomains33xx_data.c b/arch/arm/mach-omap2/clockdomains33xx_data.c -index 87f4e927eb1830..c05a3c07d44863 100644 ---- a/arch/arm/mach-omap2/clockdomains33xx_data.c -+++ b/arch/arm/mach-omap2/clockdomains33xx_data.c -@@ -19,7 +19,7 @@ static struct clockdomain l4ls_am33xx_clkdm = { - .pwrdm = { .name = "per_pwrdm" }, - .cm_inst = AM33XX_CM_PER_MOD, - .clkdm_offs = AM33XX_CM_PER_L4LS_CLKSTCTRL_OFFSET, -- .flags = CLKDM_CAN_SWSUP, -+ .flags = CLKDM_CAN_SWSUP | CLKDM_STANDBY_FORCE_WAKEUP, - }; - - static struct clockdomain l3s_am33xx_clkdm = { -diff --git a/arch/arm/mach-omap2/cm33xx.c b/arch/arm/mach-omap2/cm33xx.c -index c824d4e3db632c..aaee67d097915c 100644 ---- a/arch/arm/mach-omap2/cm33xx.c -+++ b/arch/arm/mach-omap2/cm33xx.c -@@ -20,6 +20,9 @@ - #include "cm-regbits-34xx.h" - #include "cm-regbits-33xx.h" - #include "prm33xx.h" -+#if IS_ENABLED(CONFIG_SUSPEND) -+#include -+#endif - - /* - * CLKCTRL_IDLEST_*: possible values for the CM_*_CLKCTRL.IDLEST bitfield: -@@ -328,8 +331,17 @@ static int am33xx_clkdm_clk_disable(struct clockdomain *clkdm) - { - bool hwsup = false; - -+#if IS_ENABLED(CONFIG_SUSPEND) -+ /* -+ * In case of standby, Don't put the l4ls clk domain to sleep. -+ * Since CM3 PM FW doesn't wake-up/enable the l4ls clk domain -+ * upon wake-up, CM3 PM FW fails to wake-up th MPU. -+ */ -+ if (pm_suspend_target_state == PM_SUSPEND_STANDBY && -+ (clkdm->flags & CLKDM_STANDBY_FORCE_WAKEUP)) -+ return 0; -+#endif - hwsup = am33xx_cm_is_clkdm_in_hwsup(clkdm->cm_inst, clkdm->clkdm_offs); -- - if (!hwsup && (clkdm->flags & CLKDM_CAN_FORCE_SLEEP)) - am33xx_clkdm_sleep(clkdm); - -diff --git a/arch/arm/mach-omap2/pmic-cpcap.c b/arch/arm/mach-omap2/pmic-cpcap.c -index 668dc84fd31e04..527cf4b7e37874 100644 ---- a/arch/arm/mach-omap2/pmic-cpcap.c -+++ b/arch/arm/mach-omap2/pmic-cpcap.c -@@ -264,7 +264,11 @@ int __init omap4_cpcap_init(void) - - static int __init cpcap_late_init(void) - { -- omap4_vc_set_pmic_signaling(PWRDM_POWER_RET); -+ if (!of_find_compatible_node(NULL, NULL, "motorola,cpcap")) -+ return 0; -+ -+ if (soc_is_omap443x() || soc_is_omap446x() || soc_is_omap447x()) -+ omap4_vc_set_pmic_signaling(PWRDM_POWER_RET); - - return 0; - } -diff --git a/arch/arm/mm/ioremap.c b/arch/arm/mm/ioremap.c -index 1c5aeba9bc27f3..7801c5bb775d90 100644 ---- a/arch/arm/mm/ioremap.c -+++ b/arch/arm/mm/ioremap.c -@@ -515,7 +515,5 @@ void __init early_ioremap_init(void) - bool arch_memremap_can_ram_remap(resource_size_t offset, size_t size, - unsigned long flags) - { -- unsigned long pfn = PHYS_PFN(offset); -- -- return memblock_is_map_memory(pfn); -+ return memblock_is_map_memory(offset); - } -diff --git a/arch/arm64/include/asm/tlbflush.h b/arch/arm64/include/asm/tlbflush.h -index d37db2f7a54cf0..6eeb56b6fac13e 100644 ---- a/arch/arm64/include/asm/tlbflush.h -+++ b/arch/arm64/include/asm/tlbflush.h -@@ -311,13 +311,14 @@ static inline void arch_tlbbatch_add_pending(struct arch_tlbflush_unmap_batch *b - } - - /* -- * If mprotect/munmap/etc occurs during TLB batched flushing, we need to -- * synchronise all the TLBI issued with a DSB to avoid the race mentioned in -- * flush_tlb_batched_pending(). -+ * If mprotect/munmap/etc occurs during TLB batched flushing, we need to ensure -+ * all the previously issued TLBIs targeting mm have completed. But since we -+ * can be executing on a remote CPU, a DSB cannot guarantee this like it can -+ * for arch_tlbbatch_flush(). Our only option is to flush the entire mm. - */ - static inline void arch_flush_tlb_batched_pending(struct mm_struct *mm) - { -- dsb(ish); -+ flush_tlb_mm(mm); - } - - /* -diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c -index a26293e0cc555d..c30f5a70bd18f4 100644 ---- a/arch/arm64/kernel/ptrace.c -+++ b/arch/arm64/kernel/ptrace.c -@@ -139,7 +139,7 @@ unsigned long regs_get_kernel_stack_nth(struct pt_regs *regs, unsigned int n) - - addr += n; - if (regs_within_kernel_stack(regs, (unsigned long)addr)) -- return *addr; -+ return READ_ONCE_NOCHECK(*addr); - else - return 0; - } -diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c -index bc97916a035a64..c8e83fe1cd5a73 100644 ---- a/arch/arm64/mm/mmu.c -+++ b/arch/arm64/mm/mmu.c -@@ -1253,7 +1253,8 @@ int pud_free_pmd_page(pud_t *pudp, unsigned long addr) - next = addr; - end = addr + PUD_SIZE; - do { -- pmd_free_pte_page(pmdp, next); -+ if (pmd_present(pmdp_get(pmdp))) -+ pmd_free_pte_page(pmdp, next); - } while (pmdp++, next += PMD_SIZE, next != end); - - pud_clear(pudp); -diff --git a/arch/loongarch/include/asm/irqflags.h b/arch/loongarch/include/asm/irqflags.h -index 319a8c616f1f5b..003172b8406be7 100644 ---- a/arch/loongarch/include/asm/irqflags.h -+++ b/arch/loongarch/include/asm/irqflags.h -@@ -14,40 +14,48 @@ - static inline void arch_local_irq_enable(void) - { - u32 flags = CSR_CRMD_IE; -+ register u32 mask asm("t0") = CSR_CRMD_IE; -+ - __asm__ __volatile__( - "csrxchg %[val], %[mask], %[reg]\n\t" - : [val] "+r" (flags) -- : [mask] "r" (CSR_CRMD_IE), [reg] "i" (LOONGARCH_CSR_CRMD) -+ : [mask] "r" (mask), [reg] "i" (LOONGARCH_CSR_CRMD) - : "memory"); - } - - static inline void arch_local_irq_disable(void) - { - u32 flags = 0; -+ register u32 mask asm("t0") = CSR_CRMD_IE; -+ - __asm__ __volatile__( - "csrxchg %[val], %[mask], %[reg]\n\t" - : [val] "+r" (flags) -- : [mask] "r" (CSR_CRMD_IE), [reg] "i" (LOONGARCH_CSR_CRMD) -+ : [mask] "r" (mask), [reg] "i" (LOONGARCH_CSR_CRMD) - : "memory"); - } - - static inline unsigned long arch_local_irq_save(void) - { - u32 flags = 0; -+ register u32 mask asm("t0") = CSR_CRMD_IE; -+ - __asm__ __volatile__( - "csrxchg %[val], %[mask], %[reg]\n\t" - : [val] "+r" (flags) -- : [mask] "r" (CSR_CRMD_IE), [reg] "i" (LOONGARCH_CSR_CRMD) -+ : [mask] "r" (mask), [reg] "i" (LOONGARCH_CSR_CRMD) - : "memory"); - return flags; - } - - static inline void arch_local_irq_restore(unsigned long flags) - { -+ register u32 mask asm("t0") = CSR_CRMD_IE; -+ - __asm__ __volatile__( - "csrxchg %[val], %[mask], %[reg]\n\t" - : [val] "+r" (flags) -- : [mask] "r" (CSR_CRMD_IE), [reg] "i" (LOONGARCH_CSR_CRMD) -+ : [mask] "r" (mask), [reg] "i" (LOONGARCH_CSR_CRMD) - : "memory"); - } - -diff --git a/arch/loongarch/mm/hugetlbpage.c b/arch/loongarch/mm/hugetlbpage.c -index 41308429f44612..58277fd9fb2f0e 100644 ---- a/arch/loongarch/mm/hugetlbpage.c -+++ b/arch/loongarch/mm/hugetlbpage.c -@@ -47,7 +47,8 @@ pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr, - pmd = pmd_offset(pud, addr); - } - } -- return pmd_none(pmdp_get(pmd)) ? NULL : (pte_t *) pmd; -+ -+ return (!pmd || pmd_none(pmdp_get(pmd))) ? NULL : (pte_t *) pmd; - } - - int pmd_huge(pmd_t pmd) -diff --git a/arch/mips/vdso/Makefile b/arch/mips/vdso/Makefile -index eb56581f6d734f..0a3249647401d4 100644 ---- a/arch/mips/vdso/Makefile -+++ b/arch/mips/vdso/Makefile -@@ -30,6 +30,7 @@ endif - # offsets. - cflags-vdso := $(ccflags-vdso) \ - $(filter -W%,$(filter-out -Wa$(comma)%,$(KBUILD_CFLAGS))) \ -+ $(filter -std=%,$(KBUILD_CFLAGS)) \ - -O3 -g -fPIC -fno-strict-aliasing -fno-common -fno-builtin -G 0 \ - -mrelax-pic-calls $(call cc-option, -mexplicit-relocs) \ - -fno-stack-protector -fno-jump-tables -DDISABLE_BRANCH_PROFILING \ -diff --git a/arch/parisc/boot/compressed/Makefile b/arch/parisc/boot/compressed/Makefile -index a294a1b58ee7ed..9fba12b70d1b31 100644 ---- a/arch/parisc/boot/compressed/Makefile -+++ b/arch/parisc/boot/compressed/Makefile -@@ -22,6 +22,7 @@ KBUILD_CFLAGS += -fno-PIE -mno-space-regs -mdisable-fpregs -Os - ifndef CONFIG_64BIT - KBUILD_CFLAGS += -mfast-indirect-calls - endif -+KBUILD_CFLAGS += -std=gnu11 - - LDFLAGS_vmlinux := -X -e startup --as-needed -T - $(obj)/vmlinux: $(obj)/vmlinux.lds $(addprefix $(obj)/, $(OBJECTS)) $(LIBGCC) FORCE -diff --git a/arch/parisc/kernel/unaligned.c b/arch/parisc/kernel/unaligned.c -index a8e75e5b884a70..e673c71e16d97a 100644 ---- a/arch/parisc/kernel/unaligned.c -+++ b/arch/parisc/kernel/unaligned.c -@@ -24,7 +24,7 @@ - #define DPRINTF(fmt, args...) - #endif - --#define RFMT "%#08lx" -+#define RFMT "0x%08lx" - - /* 1111 1100 0000 0000 0001 0011 1100 0000 */ - #define OPCODE1(a,b,c) ((a)<<26|(b)<<12|(c)<<6) -diff --git a/arch/powerpc/include/asm/ppc_asm.h b/arch/powerpc/include/asm/ppc_asm.h -index e7792aa135105a..fa792653286659 100644 ---- a/arch/powerpc/include/asm/ppc_asm.h -+++ b/arch/powerpc/include/asm/ppc_asm.h -@@ -183,7 +183,7 @@ - /* - * Used to name C functions called from asm - */ --#ifdef CONFIG_PPC_KERNEL_PCREL -+#if defined(__powerpc64__) && defined(CONFIG_PPC_KERNEL_PCREL) - #define CFUNC(name) name@notoc - #else - #define CFUNC(name) name -diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c -index ab316e155ea9f5..2e286bba2f6456 100644 ---- a/arch/powerpc/kernel/eeh.c -+++ b/arch/powerpc/kernel/eeh.c -@@ -1516,6 +1516,8 @@ int eeh_pe_configure(struct eeh_pe *pe) - /* Invalid PE ? */ - if (!pe) - return -ENODEV; -+ else -+ ret = eeh_ops->configure_bridge(pe); - - return ret; - } -diff --git a/arch/powerpc/kernel/vdso/Makefile b/arch/powerpc/kernel/vdso/Makefile -index d5defff8472da7..47a9533a4dc1d6 100644 ---- a/arch/powerpc/kernel/vdso/Makefile -+++ b/arch/powerpc/kernel/vdso/Makefile -@@ -50,7 +50,7 @@ ldflags-$(CONFIG_LD_ORPHAN_WARN) += -Wl,--orphan-handling=$(CONFIG_LD_ORPHAN_WAR - ldflags-y += $(filter-out $(CC_AUTO_VAR_INIT_ZERO_ENABLER) $(CC_FLAGS_FTRACE) -Wa$(comma)%, $(KBUILD_CFLAGS)) - - CC32FLAGS := -m32 --CC32FLAGSREMOVE := -mcmodel=medium -mabi=elfv1 -mabi=elfv2 -mcall-aixdesc -+CC32FLAGSREMOVE := -mcmodel=medium -mabi=elfv1 -mabi=elfv2 -mcall-aixdesc -mpcrel - ifdef CONFIG_CC_IS_CLANG - # This flag is supported by clang for 64-bit but not 32-bit so it will cause - # an unused command line flag warning for this file. -diff --git a/arch/powerpc/platforms/pseries/msi.c b/arch/powerpc/platforms/pseries/msi.c -index 423ee1d5bd9440..fdcf10cd4d1270 100644 ---- a/arch/powerpc/platforms/pseries/msi.c -+++ b/arch/powerpc/platforms/pseries/msi.c -@@ -519,7 +519,12 @@ static struct msi_domain_info pseries_msi_domain_info = { - - static void pseries_msi_compose_msg(struct irq_data *data, struct msi_msg *msg) - { -- __pci_read_msi_msg(irq_data_get_msi_desc(data), msg); -+ struct pci_dev *dev = msi_desc_to_pci_dev(irq_data_get_msi_desc(data)); -+ -+ if (dev->current_state == PCI_D0) -+ __pci_read_msi_msg(irq_data_get_msi_desc(data), msg); -+ else -+ get_cached_msi_msg(data->irq, msg); - } - - static struct irq_chip pseries_msi_irq_chip = { -diff --git a/arch/riscv/kvm/vcpu_sbi_replace.c b/arch/riscv/kvm/vcpu_sbi_replace.c -index 87ec68ed52d762..36f5386c60db75 100644 ---- a/arch/riscv/kvm/vcpu_sbi_replace.c -+++ b/arch/riscv/kvm/vcpu_sbi_replace.c -@@ -103,7 +103,7 @@ static int kvm_sbi_ext_rfence_handler(struct kvm_vcpu *vcpu, struct kvm_run *run - kvm_riscv_vcpu_pmu_incr_fw(vcpu, SBI_PMU_FW_FENCE_I_SENT); - break; - case SBI_EXT_RFENCE_REMOTE_SFENCE_VMA: -- if (cp->a2 == 0 && cp->a3 == 0) -+ if ((cp->a2 == 0 && cp->a3 == 0) || cp->a3 == -1UL) - kvm_riscv_hfence_vvma_all(vcpu->kvm, hbase, hmask); - else - kvm_riscv_hfence_vvma_gva(vcpu->kvm, hbase, hmask, -@@ -111,7 +111,7 @@ static int kvm_sbi_ext_rfence_handler(struct kvm_vcpu *vcpu, struct kvm_run *run - kvm_riscv_vcpu_pmu_incr_fw(vcpu, SBI_PMU_FW_HFENCE_VVMA_SENT); - break; - case SBI_EXT_RFENCE_REMOTE_SFENCE_VMA_ASID: -- if (cp->a2 == 0 && cp->a3 == 0) -+ if ((cp->a2 == 0 && cp->a3 == 0) || cp->a3 == -1UL) - kvm_riscv_hfence_vvma_asid_all(vcpu->kvm, - hbase, hmask, cp->a4); - else -@@ -127,9 +127,9 @@ static int kvm_sbi_ext_rfence_handler(struct kvm_vcpu *vcpu, struct kvm_run *run - case SBI_EXT_RFENCE_REMOTE_HFENCE_VVMA_ASID: - /* - * Until nested virtualization is implemented, the -- * SBI HFENCE calls should be treated as NOPs -+ * SBI HFENCE calls should return not supported -+ * hence fallthrough. - */ -- break; - default: - retdata->err_val = SBI_ERR_NOT_SUPPORTED; - } -diff --git a/arch/s390/kvm/gaccess.c b/arch/s390/kvm/gaccess.c -index 090dc38334336b..969a5e15691923 100644 ---- a/arch/s390/kvm/gaccess.c -+++ b/arch/s390/kvm/gaccess.c -@@ -490,7 +490,7 @@ enum prot_type { - PROT_TYPE_DAT = 3, - PROT_TYPE_IEP = 4, - /* Dummy value for passing an initialized value when code != PGM_PROTECTION */ -- PROT_NONE, -+ PROT_TYPE_DUMMY, - }; - - static int trans_exc_ending(struct kvm_vcpu *vcpu, int code, unsigned long gva, u8 ar, -@@ -506,7 +506,7 @@ static int trans_exc_ending(struct kvm_vcpu *vcpu, int code, unsigned long gva, - switch (code) { - case PGM_PROTECTION: - switch (prot) { -- case PROT_NONE: -+ case PROT_TYPE_DUMMY: - /* We should never get here, acts like termination */ - WARN_ON_ONCE(1); - break; -@@ -976,7 +976,7 @@ static int guest_range_to_gpas(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, - gpa = kvm_s390_real_to_abs(vcpu, ga); - if (kvm_is_error_gpa(vcpu->kvm, gpa)) { - rc = PGM_ADDRESSING; -- prot = PROT_NONE; -+ prot = PROT_TYPE_DUMMY; - } - } - if (rc) -@@ -1134,7 +1134,7 @@ int access_guest_with_key(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, - if (rc == PGM_PROTECTION) - prot = PROT_TYPE_KEYC; - else -- prot = PROT_NONE; -+ prot = PROT_TYPE_DUMMY; - rc = trans_exc_ending(vcpu, rc, ga, ar, mode, prot, terminate); - } - out_unlock: -diff --git a/arch/s390/pci/pci_mmio.c b/arch/s390/pci/pci_mmio.c -index a90499c087f0c5..2ee7b5a5016c7d 100644 ---- a/arch/s390/pci/pci_mmio.c -+++ b/arch/s390/pci/pci_mmio.c -@@ -223,7 +223,7 @@ static inline int __pcilg_mio_inuser( - [ioaddr_len] "+&d" (ioaddr_len.pair), - [cc] "+d" (cc), [val] "=d" (val), - [dst] "+a" (dst), [cnt] "+d" (cnt), [tmp] "=d" (tmp), -- [shift] "+d" (shift) -+ [shift] "+a" (shift) - :: "cc", "memory"); - - /* did we write everything to the user space buffer? */ -diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c -index e9c4bcb38f4586..07b45bbf6348de 100644 ---- a/arch/x86/kernel/cpu/bugs.c -+++ b/arch/x86/kernel/cpu/bugs.c -@@ -1442,13 +1442,9 @@ static __ro_after_init enum spectre_v2_mitigation_cmd spectre_v2_cmd; - static enum spectre_v2_user_cmd __init - spectre_v2_parse_user_cmdline(void) - { -- enum spectre_v2_user_cmd mode; - char arg[20]; - int ret, i; - -- mode = IS_ENABLED(CONFIG_MITIGATION_SPECTRE_V2) ? -- SPECTRE_V2_USER_CMD_AUTO : SPECTRE_V2_USER_CMD_NONE; -- - switch (spectre_v2_cmd) { - case SPECTRE_V2_CMD_NONE: - return SPECTRE_V2_USER_CMD_NONE; -@@ -1461,7 +1457,7 @@ spectre_v2_parse_user_cmdline(void) - ret = cmdline_find_option(boot_command_line, "spectre_v2_user", - arg, sizeof(arg)); - if (ret < 0) -- return mode; -+ return SPECTRE_V2_USER_CMD_AUTO; - - for (i = 0; i < ARRAY_SIZE(v2_user_options); i++) { - if (match_option(arg, ret, v2_user_options[i].option)) { -@@ -1471,8 +1467,8 @@ spectre_v2_parse_user_cmdline(void) - } - } - -- pr_err("Unknown user space protection option (%s). Switching to default\n", arg); -- return mode; -+ pr_err("Unknown user space protection option (%s). Switching to AUTO select\n", arg); -+ return SPECTRE_V2_USER_CMD_AUTO; - } - - static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode) -diff --git a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c -index c7f8c3200e8d7f..0db6eeeeb67205 100644 ---- a/arch/x86/kernel/cpu/sgx/main.c -+++ b/arch/x86/kernel/cpu/sgx/main.c -@@ -718,6 +718,8 @@ int arch_memory_failure(unsigned long pfn, int flags) - goto out; - } - -+ sgx_unmark_page_reclaimable(page); -+ - /* - * TBD: Add additional plumbing to enable pre-emptive - * action for asynchronous poison notification. Until -diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c -index c84a1451f194c4..86c50747e15837 100644 ---- a/arch/x86/kvm/svm/svm.c -+++ b/arch/x86/kvm/svm/svm.c -@@ -1503,7 +1503,7 @@ static void svm_clear_current_vmcb(struct vmcb *vmcb) - { - int i; - -- for_each_online_cpu(i) -+ for_each_possible_cpu(i) - cmpxchg(per_cpu_ptr(&svm_data.current_vmcb, i), vmcb, NULL); - } - -diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c -index e5a2c230110ea4..e7f3b70f9114ae 100644 ---- a/arch/x86/kvm/vmx/vmx.c -+++ b/arch/x86/kvm/vmx/vmx.c -@@ -787,8 +787,11 @@ static void vmx_emergency_disable(void) - return; - - list_for_each_entry(v, &per_cpu(loaded_vmcss_on_cpu, cpu), -- loaded_vmcss_on_cpu_link) -+ loaded_vmcss_on_cpu_link) { - vmcs_clear(v->vmcs); -+ if (v->shadow_vmcs) -+ vmcs_clear(v->shadow_vmcs); -+ } - - kvm_cpu_vmxoff(); - } -diff --git a/drivers/acpi/acpica/dsutils.c b/drivers/acpi/acpica/dsutils.c -index fb9ed5e1da89dc..2bdae8a25e084d 100644 ---- a/drivers/acpi/acpica/dsutils.c -+++ b/drivers/acpi/acpica/dsutils.c -@@ -668,6 +668,8 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state, - union acpi_parse_object *arguments[ACPI_OBJ_NUM_OPERANDS]; - u32 arg_count = 0; - u32 index = walk_state->num_operands; -+ u32 prev_num_operands = walk_state->num_operands; -+ u32 new_num_operands; - u32 i; - - ACPI_FUNCTION_TRACE_PTR(ds_create_operands, first_arg); -@@ -696,6 +698,7 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state, - - /* Create the interpreter arguments, in reverse order */ - -+ new_num_operands = index; - index--; - for (i = 0; i < arg_count; i++) { - arg = arguments[index]; -@@ -720,7 +723,11 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state, - * pop everything off of the operand stack and delete those - * objects - */ -- acpi_ds_obj_stack_pop_and_delete(arg_count, walk_state); -+ walk_state->num_operands = i; -+ acpi_ds_obj_stack_pop_and_delete(new_num_operands, walk_state); -+ -+ /* Restore operand count */ -+ walk_state->num_operands = prev_num_operands; - - ACPI_EXCEPTION((AE_INFO, status, "While creating Arg %u", index)); - return_ACPI_STATUS(status); -diff --git a/drivers/acpi/acpica/psobject.c b/drivers/acpi/acpica/psobject.c -index 54471083ba545e..0bce1baaa62b32 100644 ---- a/drivers/acpi/acpica/psobject.c -+++ b/drivers/acpi/acpica/psobject.c -@@ -636,7 +636,8 @@ acpi_status - acpi_ps_complete_final_op(struct acpi_walk_state *walk_state, - union acpi_parse_object *op, acpi_status status) - { -- acpi_status status2; -+ acpi_status return_status = status; -+ u8 ascending = TRUE; - - ACPI_FUNCTION_TRACE_PTR(ps_complete_final_op, walk_state); - -@@ -650,7 +651,7 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state, - op)); - do { - if (op) { -- if (walk_state->ascending_callback != NULL) { -+ if (ascending && walk_state->ascending_callback != NULL) { - walk_state->op = op; - walk_state->op_info = - acpi_ps_get_opcode_info(op->common. -@@ -672,49 +673,26 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state, - } - - if (status == AE_CTRL_TERMINATE) { -- status = AE_OK; -- -- /* Clean up */ -- do { -- if (op) { -- status2 = -- acpi_ps_complete_this_op -- (walk_state, op); -- if (ACPI_FAILURE -- (status2)) { -- return_ACPI_STATUS -- (status2); -- } -- } -- -- acpi_ps_pop_scope(& -- (walk_state-> -- parser_state), -- &op, -- &walk_state-> -- arg_types, -- &walk_state-> -- arg_count); -- -- } while (op); -- -- return_ACPI_STATUS(status); -+ ascending = FALSE; -+ return_status = AE_CTRL_TERMINATE; - } - - else if (ACPI_FAILURE(status)) { - - /* First error is most important */ - -- (void) -- acpi_ps_complete_this_op(walk_state, -- op); -- return_ACPI_STATUS(status); -+ ascending = FALSE; -+ return_status = status; - } - } - -- status2 = acpi_ps_complete_this_op(walk_state, op); -- if (ACPI_FAILURE(status2)) { -- return_ACPI_STATUS(status2); -+ status = acpi_ps_complete_this_op(walk_state, op); -+ if (ACPI_FAILURE(status)) { -+ ascending = FALSE; -+ if (ACPI_SUCCESS(return_status) || -+ return_status == AE_CTRL_TERMINATE) { -+ return_status = status; -+ } - } - } - -@@ -724,5 +702,5 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state, - - } while (op); - -- return_ACPI_STATUS(status); -+ return_ACPI_STATUS(return_status); - } -diff --git a/drivers/acpi/acpica/utprint.c b/drivers/acpi/acpica/utprint.c -index 42b30b9f93128e..7fad03c5252c35 100644 ---- a/drivers/acpi/acpica/utprint.c -+++ b/drivers/acpi/acpica/utprint.c -@@ -333,11 +333,8 @@ int vsnprintf(char *string, acpi_size size, const char *format, va_list args) - - pos = string; - -- if (size != ACPI_UINT32_MAX) { -- end = string + size; -- } else { -- end = ACPI_CAST_PTR(char, ACPI_UINT32_MAX); -- } -+ size = ACPI_MIN(size, ACPI_PTR_DIFF(ACPI_MAX_PTR, string)); -+ end = string + size; - - for (; *format; ++format) { - if (*format != '%') { -diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c -index e3cbaf3c3bbc15..cd3cbb7a36f855 100644 ---- a/drivers/acpi/battery.c -+++ b/drivers/acpi/battery.c -@@ -243,10 +243,23 @@ static int acpi_battery_get_property(struct power_supply *psy, - break; - case POWER_SUPPLY_PROP_CURRENT_NOW: - case POWER_SUPPLY_PROP_POWER_NOW: -- if (battery->rate_now == ACPI_BATTERY_VALUE_UNKNOWN) -+ if (battery->rate_now == ACPI_BATTERY_VALUE_UNKNOWN) { - ret = -ENODEV; -- else -- val->intval = battery->rate_now * 1000; -+ break; -+ } -+ -+ val->intval = battery->rate_now * 1000; -+ /* -+ * When discharging, the current should be reported as a -+ * negative number as per the power supply class interface -+ * definition. -+ */ -+ if (psp == POWER_SUPPLY_PROP_CURRENT_NOW && -+ (battery->state & ACPI_BATTERY_STATE_DISCHARGING) && -+ acpi_battery_handle_discharging(battery) -+ == POWER_SUPPLY_STATUS_DISCHARGING) -+ val->intval = -val->intval; -+ - break; - case POWER_SUPPLY_PROP_CHARGE_FULL_DESIGN: - case POWER_SUPPLY_PROP_ENERGY_FULL_DESIGN: -diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c -index a4aa53b7e2bb30..645464f02363f3 100644 ---- a/drivers/acpi/bus.c -+++ b/drivers/acpi/bus.c -@@ -1396,8 +1396,10 @@ static int __init acpi_init(void) - } - - acpi_kobj = kobject_create_and_add("acpi", firmware_kobj); -- if (!acpi_kobj) -- pr_debug("%s: kset create error\n", __func__); -+ if (!acpi_kobj) { -+ pr_err("Failed to register kobject\n"); -+ return -ENOMEM; -+ } - - init_prmt(); - acpi_init_pcc(); -diff --git a/drivers/ata/pata_via.c b/drivers/ata/pata_via.c -index 696b99720dcbda..d82728a01832b5 100644 ---- a/drivers/ata/pata_via.c -+++ b/drivers/ata/pata_via.c -@@ -368,7 +368,8 @@ static unsigned int via_mode_filter(struct ata_device *dev, unsigned int mask) - } - - if (dev->class == ATA_DEV_ATAPI && -- dmi_check_system(no_atapi_dma_dmi_table)) { -+ (dmi_check_system(no_atapi_dma_dmi_table) || -+ config->id == PCI_DEVICE_ID_VIA_6415)) { - ata_dev_warn(dev, "controller locks up on ATAPI DMA, forcing PIO\n"); - mask &= ATA_MASK_PIO; - } -diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c -index 96bea1ab1eccf4..ff558908897f3e 100644 ---- a/drivers/atm/atmtcp.c -+++ b/drivers/atm/atmtcp.c -@@ -288,7 +288,9 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb) - struct sk_buff *new_skb; - int result = 0; - -- if (!skb->len) return 0; -+ if (skb->len < sizeof(struct atmtcp_hdr)) -+ goto done; -+ - dev = vcc->dev_data; - hdr = (struct atmtcp_hdr *) skb->data; - if (hdr->length == ATMTCP_HDR_MAGIC) { -diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c -index 0af26cf8c0059f..0d43bf5b6cecbf 100644 ---- a/drivers/base/power/runtime.c -+++ b/drivers/base/power/runtime.c -@@ -1001,7 +1001,7 @@ static enum hrtimer_restart pm_suspend_timer_fn(struct hrtimer *timer) - * If 'expires' is after the current time, we've been called - * too early. - */ -- if (expires > 0 && expires < ktime_get_mono_fast_ns()) { -+ if (expires > 0 && expires <= ktime_get_mono_fast_ns()) { - dev->power.timer_expires = 0; - rpm_suspend(dev, dev->power.timer_autosuspends ? - (RPM_ASYNC | RPM_AUTO) : RPM_ASYNC); -diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c -index 079bd14bdedc7c..a7a3e3b66bb5ed 100644 ---- a/drivers/base/swnode.c -+++ b/drivers/base/swnode.c -@@ -518,7 +518,7 @@ software_node_get_reference_args(const struct fwnode_handle *fwnode, - if (prop->is_inline) - return -EINVAL; - -- if (index * sizeof(*ref) >= prop->length) -+ if ((index + 1) * sizeof(*ref) > prop->length) - return -ENOENT; - - ref_array = prop->pointer; -diff --git a/drivers/block/aoe/aoedev.c b/drivers/block/aoe/aoedev.c -index 3523dd82d7a002..280679bde3a506 100644 ---- a/drivers/block/aoe/aoedev.c -+++ b/drivers/block/aoe/aoedev.c -@@ -198,6 +198,7 @@ aoedev_downdev(struct aoedev *d) - { - struct aoetgt *t, **tt, **te; - struct list_head *head, *pos, *nx; -+ struct request *rq, *rqnext; - int i; - - d->flags &= ~DEVFL_UP; -@@ -223,6 +224,13 @@ aoedev_downdev(struct aoedev *d) - /* clean out the in-process request (if any) */ - aoe_failip(d); - -+ /* clean out any queued block requests */ -+ list_for_each_entry_safe(rq, rqnext, &d->rq_list, queuelist) { -+ list_del_init(&rq->queuelist); -+ blk_mq_start_request(rq); -+ blk_mq_end_request(rq, BLK_STS_IOERR); -+ } -+ - /* fast fail all pending I/O */ - if (d->blkq) { - /* UP is cleared, freeze+quiesce to insure all are errored */ -diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c -index 95095500f93afb..df3e5aab4b5ac9 100644 ---- a/drivers/block/ublk_drv.c -+++ b/drivers/block/ublk_drv.c -@@ -2323,6 +2323,9 @@ static int ublk_ctrl_add_dev(struct io_uring_cmd *cmd) - if (copy_from_user(&info, argp, sizeof(info))) - return -EFAULT; - -+ if (info.queue_depth > UBLK_MAX_QUEUE_DEPTH || info.nr_hw_queues > UBLK_MAX_NR_QUEUES) -+ return -EINVAL; -+ - if (capable(CAP_SYS_ADMIN)) - info.flags &= ~UBLK_F_UNPRIVILEGED_DEV; - else if (!(info.flags & UBLK_F_UNPRIVILEGED_DEV)) -diff --git a/drivers/bus/fsl-mc/fsl-mc-uapi.c b/drivers/bus/fsl-mc/fsl-mc-uapi.c -index 9c4c1395fcdbf2..a376ec66165348 100644 ---- a/drivers/bus/fsl-mc/fsl-mc-uapi.c -+++ b/drivers/bus/fsl-mc/fsl-mc-uapi.c -@@ -275,13 +275,13 @@ static struct fsl_mc_cmd_desc fsl_mc_accepted_cmds[] = { - .size = 8, - }, - [DPSW_GET_TAILDROP] = { -- .cmdid_value = 0x0A80, -+ .cmdid_value = 0x0A90, - .cmdid_mask = 0xFFF0, - .token = true, - .size = 14, - }, - [DPSW_SET_TAILDROP] = { -- .cmdid_value = 0x0A90, -+ .cmdid_value = 0x0A80, - .cmdid_mask = 0xFFF0, - .token = true, - .size = 24, -diff --git a/drivers/bus/fsl-mc/mc-io.c b/drivers/bus/fsl-mc/mc-io.c -index 95b10a6cf3073f..8b7a34f4db94bb 100644 ---- a/drivers/bus/fsl-mc/mc-io.c -+++ b/drivers/bus/fsl-mc/mc-io.c -@@ -214,12 +214,19 @@ int __must_check fsl_mc_portal_allocate(struct fsl_mc_device *mc_dev, - if (error < 0) - goto error_cleanup_resource; - -- dpmcp_dev->consumer_link = device_link_add(&mc_dev->dev, -- &dpmcp_dev->dev, -- DL_FLAG_AUTOREMOVE_CONSUMER); -- if (!dpmcp_dev->consumer_link) { -- error = -EINVAL; -- goto error_cleanup_mc_io; -+ /* If the DPRC device itself tries to allocate a portal (usually for -+ * UAPI interaction), don't add a device link between them since the -+ * DPMCP device is an actual child device of the DPRC and a reverse -+ * dependency is not allowed. -+ */ -+ if (mc_dev != mc_bus_dev) { -+ dpmcp_dev->consumer_link = device_link_add(&mc_dev->dev, -+ &dpmcp_dev->dev, -+ DL_FLAG_AUTOREMOVE_CONSUMER); -+ if (!dpmcp_dev->consumer_link) { -+ error = -EINVAL; -+ goto error_cleanup_mc_io; -+ } - } - - *new_mc_io = mc_io; -diff --git a/drivers/bus/fsl-mc/mc-sys.c b/drivers/bus/fsl-mc/mc-sys.c -index f2052cd0a05178..b22c59d57c8f0a 100644 ---- a/drivers/bus/fsl-mc/mc-sys.c -+++ b/drivers/bus/fsl-mc/mc-sys.c -@@ -19,7 +19,7 @@ - /* - * Timeout in milliseconds to wait for the completion of an MC command - */ --#define MC_CMD_COMPLETION_TIMEOUT_MS 500 -+#define MC_CMD_COMPLETION_TIMEOUT_MS 15000 - - /* - * usleep_range() min and max values used to throttle down polling -diff --git a/drivers/bus/mhi/ep/ring.c b/drivers/bus/mhi/ep/ring.c -index ba9f696d1aa80e..fedf26392e8d29 100644 ---- a/drivers/bus/mhi/ep/ring.c -+++ b/drivers/bus/mhi/ep/ring.c -@@ -131,19 +131,23 @@ int mhi_ep_ring_add_element(struct mhi_ep_ring *ring, struct mhi_ring_element *e - } - - old_offset = ring->rd_offset; -- mhi_ep_ring_inc_index(ring); - - dev_dbg(dev, "Adding an element to ring at offset (%zu)\n", ring->rd_offset); -+ buf_info.host_addr = ring->rbase + (old_offset * sizeof(*el)); -+ buf_info.dev_addr = el; -+ buf_info.size = sizeof(*el); -+ -+ ret = mhi_cntrl->write_sync(mhi_cntrl, &buf_info); -+ if (ret) -+ return ret; -+ -+ mhi_ep_ring_inc_index(ring); - - /* Update rp in ring context */ - rp = cpu_to_le64(ring->rd_offset * sizeof(*el) + ring->rbase); - memcpy_toio((void __iomem *) &ring->ring_ctx->generic.rp, &rp, sizeof(u64)); - -- buf_info.host_addr = ring->rbase + (old_offset * sizeof(*el)); -- buf_info.dev_addr = el; -- buf_info.size = sizeof(*el); -- -- return mhi_cntrl->write_sync(mhi_cntrl, &buf_info); -+ return ret; - } - - void mhi_ep_ring_init(struct mhi_ep_ring *ring, enum mhi_ep_ring_type type, u32 id) -diff --git a/drivers/bus/mhi/host/pm.c b/drivers/bus/mhi/host/pm.c -index 27f8a40f288cfd..e48bf44c785c9b 100644 ---- a/drivers/bus/mhi/host/pm.c -+++ b/drivers/bus/mhi/host/pm.c -@@ -586,6 +586,7 @@ static void mhi_pm_sys_error_transition(struct mhi_controller *mhi_cntrl) - struct mhi_cmd *mhi_cmd; - struct mhi_event_ctxt *er_ctxt; - struct device *dev = &mhi_cntrl->mhi_dev->dev; -+ bool reset_device = false; - int ret, i; - - dev_dbg(dev, "Transitioning from PM state: %s to: %s\n", -@@ -614,8 +615,23 @@ static void mhi_pm_sys_error_transition(struct mhi_controller *mhi_cntrl) - /* Wake up threads waiting for state transition */ - wake_up_all(&mhi_cntrl->state_event); - -- /* Trigger MHI RESET so that the device will not access host memory */ - if (MHI_REG_ACCESS_VALID(prev_state)) { -+ /* -+ * If the device is in PBL or SBL, it will only respond to -+ * RESET if the device is in SYSERR state. SYSERR might -+ * already be cleared at this point. -+ */ -+ enum mhi_state cur_state = mhi_get_mhi_state(mhi_cntrl); -+ enum mhi_ee_type cur_ee = mhi_get_exec_env(mhi_cntrl); -+ -+ if (cur_state == MHI_STATE_SYS_ERR) -+ reset_device = true; -+ else if (cur_ee != MHI_EE_PBL && cur_ee != MHI_EE_SBL) -+ reset_device = true; -+ } -+ -+ /* Trigger MHI RESET so that the device will not access host memory */ -+ if (reset_device) { - u32 in_reset = -1; - unsigned long timeout = msecs_to_jiffies(mhi_cntrl->timeout_ms); - -diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c -index 65163312dab8ac..46d7410f6f0fce 100644 ---- a/drivers/bus/ti-sysc.c -+++ b/drivers/bus/ti-sysc.c -@@ -667,51 +667,6 @@ static int sysc_parse_and_check_child_range(struct sysc *ddata) - return 0; - } - --/* Interconnect instances to probe before l4_per instances */ --static struct resource early_bus_ranges[] = { -- /* am3/4 l4_wkup */ -- { .start = 0x44c00000, .end = 0x44c00000 + 0x300000, }, -- /* omap4/5 and dra7 l4_cfg */ -- { .start = 0x4a000000, .end = 0x4a000000 + 0x300000, }, -- /* omap4 l4_wkup */ -- { .start = 0x4a300000, .end = 0x4a300000 + 0x30000, }, -- /* omap5 and dra7 l4_wkup without dra7 dcan segment */ -- { .start = 0x4ae00000, .end = 0x4ae00000 + 0x30000, }, --}; -- --static atomic_t sysc_defer = ATOMIC_INIT(10); -- --/** -- * sysc_defer_non_critical - defer non_critical interconnect probing -- * @ddata: device driver data -- * -- * We want to probe l4_cfg and l4_wkup interconnect instances before any -- * l4_per instances as l4_per instances depend on resources on l4_cfg and -- * l4_wkup interconnects. -- */ --static int sysc_defer_non_critical(struct sysc *ddata) --{ -- struct resource *res; -- int i; -- -- if (!atomic_read(&sysc_defer)) -- return 0; -- -- for (i = 0; i < ARRAY_SIZE(early_bus_ranges); i++) { -- res = &early_bus_ranges[i]; -- if (ddata->module_pa >= res->start && -- ddata->module_pa <= res->end) { -- atomic_set(&sysc_defer, 0); -- -- return 0; -- } -- } -- -- atomic_dec_if_positive(&sysc_defer); -- -- return -EPROBE_DEFER; --} -- - static struct device_node *stdout_path; - - static void sysc_init_stdout_path(struct sysc *ddata) -@@ -937,10 +892,6 @@ static int sysc_map_and_check_registers(struct sysc *ddata) - if (error) - return error; - -- error = sysc_defer_non_critical(ddata); -- if (error) -- return error; -- - sysc_check_children(ddata); - - if (!of_property_present(np, "reg")) -diff --git a/drivers/clk/meson/g12a.c b/drivers/clk/meson/g12a.c -index 233ce4a4c1c2f1..69018efbf7f47b 100644 ---- a/drivers/clk/meson/g12a.c -+++ b/drivers/clk/meson/g12a.c -@@ -3971,6 +3971,7 @@ static const struct clk_parent_data spicc_sclk_parent_data[] = { - { .hw = &g12a_clk81.hw }, - { .hw = &g12a_fclk_div4.hw }, - { .hw = &g12a_fclk_div3.hw }, -+ { .hw = &g12a_fclk_div2.hw }, - { .hw = &g12a_fclk_div5.hw }, - { .hw = &g12a_fclk_div7.hw }, - }; -diff --git a/drivers/clk/rockchip/clk-rk3036.c b/drivers/clk/rockchip/clk-rk3036.c -index d644bc155ec6e5..f5f27535087a30 100644 ---- a/drivers/clk/rockchip/clk-rk3036.c -+++ b/drivers/clk/rockchip/clk-rk3036.c -@@ -431,6 +431,7 @@ static const char *const rk3036_critical_clocks[] __initconst = { - "hclk_peri", - "pclk_peri", - "pclk_ddrupctl", -+ "ddrphy", - }; - - static void __init rk3036_clk_init(struct device_node *np) -diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c -index e4989764efe2a8..6ff77003a96eac 100644 ---- a/drivers/cpufreq/scmi-cpufreq.c -+++ b/drivers/cpufreq/scmi-cpufreq.c -@@ -299,6 +299,40 @@ static struct cpufreq_driver scmi_cpufreq_driver = { - .register_em = scmi_cpufreq_register_em, - }; - -+static bool scmi_dev_used_by_cpus(struct device *scmi_dev) -+{ -+ struct device_node *scmi_np = dev_of_node(scmi_dev); -+ struct device_node *cpu_np, *np; -+ struct device *cpu_dev; -+ int cpu, idx; -+ -+ if (!scmi_np) -+ return false; -+ -+ for_each_possible_cpu(cpu) { -+ cpu_dev = get_cpu_device(cpu); -+ if (!cpu_dev) -+ continue; -+ -+ cpu_np = dev_of_node(cpu_dev); -+ -+ np = of_parse_phandle(cpu_np, "clocks", 0); -+ of_node_put(np); -+ -+ if (np == scmi_np) -+ return true; -+ -+ idx = of_property_match_string(cpu_np, "power-domain-names", "perf"); -+ np = of_parse_phandle(cpu_np, "power-domains", idx); -+ of_node_put(np); -+ -+ if (np == scmi_np) -+ return true; -+ } -+ -+ return false; -+} -+ - static int scmi_cpufreq_probe(struct scmi_device *sdev) - { - int ret; -@@ -307,7 +341,7 @@ static int scmi_cpufreq_probe(struct scmi_device *sdev) - - handle = sdev->handle; - -- if (!handle) -+ if (!handle || !scmi_dev_used_by_cpus(dev)) - return -ENODEV; - - perf_ops = handle->devm_protocol_get(sdev, SCMI_PROTOCOL_PERF, &ph); -diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c -index 4e5b6f9a56d1b2..7b8fcfa55038bc 100644 ---- a/drivers/cpufreq/tegra186-cpufreq.c -+++ b/drivers/cpufreq/tegra186-cpufreq.c -@@ -73,18 +73,11 @@ static int tegra186_cpufreq_init(struct cpufreq_policy *policy) - { - struct tegra186_cpufreq_data *data = cpufreq_get_driver_data(); - unsigned int cluster = data->cpus[policy->cpu].bpmp_cluster_id; -- u32 cpu; - - policy->freq_table = data->clusters[cluster].table; - policy->cpuinfo.transition_latency = 300 * 1000; - policy->driver_data = NULL; - -- /* set same policy for all cpus in a cluster */ -- for (cpu = 0; cpu < ARRAY_SIZE(tegra186_cpus); cpu++) { -- if (data->cpus[cpu].bpmp_cluster_id == cluster) -- cpumask_set_cpu(cpu, policy->cpus); -- } -- - return 0; - } - -diff --git a/drivers/crypto/marvell/cesa/cesa.c b/drivers/crypto/marvell/cesa/cesa.c -index b61e35b932e590..76f34b81258dc3 100644 ---- a/drivers/crypto/marvell/cesa/cesa.c -+++ b/drivers/crypto/marvell/cesa/cesa.c -@@ -94,7 +94,7 @@ static int mv_cesa_std_process(struct mv_cesa_engine *engine, u32 status) - - static int mv_cesa_int_process(struct mv_cesa_engine *engine, u32 status) - { -- if (engine->chain.first && engine->chain.last) -+ if (engine->chain_hw.first && engine->chain_hw.last) - return mv_cesa_tdma_process(engine, status); - - return mv_cesa_std_process(engine, status); -diff --git a/drivers/crypto/marvell/cesa/cesa.h b/drivers/crypto/marvell/cesa/cesa.h -index d215a6bed6bc7b..50ca1039fdaa7a 100644 ---- a/drivers/crypto/marvell/cesa/cesa.h -+++ b/drivers/crypto/marvell/cesa/cesa.h -@@ -440,8 +440,10 @@ struct mv_cesa_dev { - * SRAM - * @queue: fifo of the pending crypto requests - * @load: engine load counter, useful for load balancing -- * @chain: list of the current tdma descriptors being processed -- * by this engine. -+ * @chain_hw: list of the current tdma descriptors being processed -+ * by the hardware. -+ * @chain_sw: list of the current tdma descriptors that will be -+ * submitted to the hardware. - * @complete_queue: fifo of the processed requests by the engine - * - * Structure storing CESA engine information. -@@ -463,7 +465,8 @@ struct mv_cesa_engine { - struct gen_pool *pool; - struct crypto_queue queue; - atomic_t load; -- struct mv_cesa_tdma_chain chain; -+ struct mv_cesa_tdma_chain chain_hw; -+ struct mv_cesa_tdma_chain chain_sw; - struct list_head complete_queue; - int irq; - }; -diff --git a/drivers/crypto/marvell/cesa/tdma.c b/drivers/crypto/marvell/cesa/tdma.c -index 388a06e180d64a..243305354420c1 100644 ---- a/drivers/crypto/marvell/cesa/tdma.c -+++ b/drivers/crypto/marvell/cesa/tdma.c -@@ -38,6 +38,15 @@ void mv_cesa_dma_step(struct mv_cesa_req *dreq) - { - struct mv_cesa_engine *engine = dreq->engine; - -+ spin_lock_bh(&engine->lock); -+ if (engine->chain_sw.first == dreq->chain.first) { -+ engine->chain_sw.first = NULL; -+ engine->chain_sw.last = NULL; -+ } -+ engine->chain_hw.first = dreq->chain.first; -+ engine->chain_hw.last = dreq->chain.last; -+ spin_unlock_bh(&engine->lock); -+ - writel_relaxed(0, engine->regs + CESA_SA_CFG); - - mv_cesa_set_int_mask(engine, CESA_SA_INT_ACC0_IDMA_DONE); -@@ -96,25 +105,27 @@ void mv_cesa_dma_prepare(struct mv_cesa_req *dreq, - void mv_cesa_tdma_chain(struct mv_cesa_engine *engine, - struct mv_cesa_req *dreq) - { -- if (engine->chain.first == NULL && engine->chain.last == NULL) { -- engine->chain.first = dreq->chain.first; -- engine->chain.last = dreq->chain.last; -- } else { -- struct mv_cesa_tdma_desc *last; -+ struct mv_cesa_tdma_desc *last = engine->chain_sw.last; - -- last = engine->chain.last; -+ /* -+ * Break the DMA chain if the request being queued needs the IV -+ * regs to be set before lauching the request. -+ */ -+ if (!last || dreq->chain.first->flags & CESA_TDMA_SET_STATE) -+ engine->chain_sw.first = dreq->chain.first; -+ else { - last->next = dreq->chain.first; -- engine->chain.last = dreq->chain.last; -- -- /* -- * Break the DMA chain if the CESA_TDMA_BREAK_CHAIN is set on -- * the last element of the current chain, or if the request -- * being queued needs the IV regs to be set before lauching -- * the request. -- */ -- if (!(last->flags & CESA_TDMA_BREAK_CHAIN) && -- !(dreq->chain.first->flags & CESA_TDMA_SET_STATE)) -- last->next_dma = cpu_to_le32(dreq->chain.first->cur_dma); -+ last->next_dma = cpu_to_le32(dreq->chain.first->cur_dma); -+ } -+ last = dreq->chain.last; -+ engine->chain_sw.last = last; -+ /* -+ * Break the DMA chain if the CESA_TDMA_BREAK_CHAIN is set on -+ * the last element of the current chain. -+ */ -+ if (last->flags & CESA_TDMA_BREAK_CHAIN) { -+ engine->chain_sw.first = NULL; -+ engine->chain_sw.last = NULL; - } - } - -@@ -127,7 +138,7 @@ int mv_cesa_tdma_process(struct mv_cesa_engine *engine, u32 status) - - tdma_cur = readl(engine->regs + CESA_TDMA_CUR); - -- for (tdma = engine->chain.first; tdma; tdma = next) { -+ for (tdma = engine->chain_hw.first; tdma; tdma = next) { - spin_lock_bh(&engine->lock); - next = tdma->next; - spin_unlock_bh(&engine->lock); -@@ -149,12 +160,12 @@ int mv_cesa_tdma_process(struct mv_cesa_engine *engine, u32 status) - &backlog); - - /* Re-chaining to the next request */ -- engine->chain.first = tdma->next; -+ engine->chain_hw.first = tdma->next; - tdma->next = NULL; - - /* If this is the last request, clear the chain */ -- if (engine->chain.first == NULL) -- engine->chain.last = NULL; -+ if (engine->chain_hw.first == NULL) -+ engine->chain_hw.last = NULL; - spin_unlock_bh(&engine->lock); - - ctx = crypto_tfm_ctx(req->tfm); -diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c -index 373282beeb6068..980975ffc55d3c 100644 ---- a/drivers/dma-buf/udmabuf.c -+++ b/drivers/dma-buf/udmabuf.c -@@ -161,8 +161,7 @@ static int begin_cpu_udmabuf(struct dma_buf *buf, - ubuf->sg = NULL; - } - } else { -- dma_sync_sg_for_cpu(dev, ubuf->sg->sgl, ubuf->sg->nents, -- direction); -+ dma_sync_sgtable_for_cpu(dev, ubuf->sg, direction); - } - - return ret; -@@ -177,7 +176,7 @@ static int end_cpu_udmabuf(struct dma_buf *buf, - if (!ubuf->sg) - return -EINVAL; - -- dma_sync_sg_for_device(dev, ubuf->sg->sgl, ubuf->sg->nents, direction); -+ dma_sync_sgtable_for_device(dev, ubuf->sg, direction); - return 0; - } - -diff --git a/drivers/edac/altera_edac.c b/drivers/edac/altera_edac.c -index e04fd1a7e9aaea..54ec894150939a 100644 ---- a/drivers/edac/altera_edac.c -+++ b/drivers/edac/altera_edac.c -@@ -1756,9 +1756,9 @@ altr_edac_a10_device_trig(struct file *file, const char __user *user_buf, - - local_irq_save(flags); - if (trig_type == ALTR_UE_TRIGGER_CHAR) -- writel(priv->ue_set_mask, set_addr); -+ writew(priv->ue_set_mask, set_addr); - else -- writel(priv->ce_set_mask, set_addr); -+ writew(priv->ce_set_mask, set_addr); - - /* Ensure the interrupt test bits are set */ - wmb(); -@@ -1788,7 +1788,7 @@ altr_edac_a10_device_trig2(struct file *file, const char __user *user_buf, - - local_irq_save(flags); - if (trig_type == ALTR_UE_TRIGGER_CHAR) { -- writel(priv->ue_set_mask, set_addr); -+ writew(priv->ue_set_mask, set_addr); - } else { - /* Setup read/write of 4 bytes */ - writel(ECC_WORD_WRITE, drvdata->base + ECC_BLK_DBYTECTRL_OFST); -diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c -index 9cd86390a16747..10119cf27ffde5 100644 ---- a/drivers/edac/amd64_edac.c -+++ b/drivers/edac/amd64_edac.c -@@ -4130,6 +4130,7 @@ static int per_family_init(struct amd64_pvt *pvt) - break; - case 0x70 ... 0x7f: - pvt->ctl_name = "F19h_M70h"; -+ pvt->max_mcs = 4; - pvt->flags.zn_regs_v2 = 1; - break; - case 0xa0 ... 0xaf: -diff --git a/drivers/gpio/gpio-mlxbf3.c b/drivers/gpio/gpio-mlxbf3.c -index 10ea71273c8915..9875e34bde72a4 100644 ---- a/drivers/gpio/gpio-mlxbf3.c -+++ b/drivers/gpio/gpio-mlxbf3.c -@@ -190,7 +190,9 @@ static int mlxbf3_gpio_probe(struct platform_device *pdev) - struct mlxbf3_gpio_context *gs; - struct gpio_irq_chip *girq; - struct gpio_chip *gc; -+ char *colon_ptr; - int ret, irq; -+ long num; - - gs = devm_kzalloc(dev, sizeof(*gs), GFP_KERNEL); - if (!gs) -@@ -227,25 +229,39 @@ static int mlxbf3_gpio_probe(struct platform_device *pdev) - gc->owner = THIS_MODULE; - gc->add_pin_ranges = mlxbf3_gpio_add_pin_ranges; - -- irq = platform_get_irq(pdev, 0); -- if (irq >= 0) { -- girq = &gs->gc.irq; -- gpio_irq_chip_set_chip(girq, &gpio_mlxbf3_irqchip); -- girq->default_type = IRQ_TYPE_NONE; -- /* This will let us handle the parent IRQ in the driver */ -- girq->num_parents = 0; -- girq->parents = NULL; -- girq->parent_handler = NULL; -- girq->handler = handle_bad_irq; -- -- /* -- * Directly request the irq here instead of passing -- * a flow-handler because the irq is shared. -- */ -- ret = devm_request_irq(dev, irq, mlxbf3_gpio_irq_handler, -- IRQF_SHARED, dev_name(dev), gs); -- if (ret) -- return dev_err_probe(dev, ret, "failed to request IRQ"); -+ colon_ptr = strchr(dev_name(dev), ':'); -+ if (!colon_ptr) { -+ dev_err(dev, "invalid device name format\n"); -+ return -EINVAL; -+ } -+ -+ ret = kstrtol(++colon_ptr, 16, &num); -+ if (ret) { -+ dev_err(dev, "invalid device instance\n"); -+ return ret; -+ } -+ -+ if (!num) { -+ irq = platform_get_irq(pdev, 0); -+ if (irq >= 0) { -+ girq = &gs->gc.irq; -+ gpio_irq_chip_set_chip(girq, &gpio_mlxbf3_irqchip); -+ girq->default_type = IRQ_TYPE_NONE; -+ /* This will let us handle the parent IRQ in the driver */ -+ girq->num_parents = 0; -+ girq->parents = NULL; -+ girq->parent_handler = NULL; -+ girq->handler = handle_bad_irq; -+ -+ /* -+ * Directly request the irq here instead of passing -+ * a flow-handler because the irq is shared. -+ */ -+ ret = devm_request_irq(dev, irq, mlxbf3_gpio_irq_handler, -+ IRQF_SHARED, dev_name(dev), gs); -+ if (ret) -+ return dev_err_probe(dev, ret, "failed to request IRQ"); -+ } - } - - platform_set_drvdata(pdev, gs); -diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c -index a0a2a0f75bba46..c1e83b2926ae4d 100644 ---- a/drivers/gpio/gpiolib-of.c -+++ b/drivers/gpio/gpiolib-of.c -@@ -203,6 +203,15 @@ static void of_gpio_try_fixup_polarity(const struct device_node *np, - */ - { "lantiq,pci-xway", "gpio-reset", false }, - #endif -+#if IS_ENABLED(CONFIG_REGULATOR_S5M8767) -+ /* -+ * According to S5M8767, the DVS and DS pin are -+ * active-high signals. However, exynos5250-spring.dts use -+ * active-low setting. -+ */ -+ { "samsung,s5m8767-pmic", "s5m8767,pmic-buck-dvs-gpios", true }, -+ { "samsung,s5m8767-pmic", "s5m8767,pmic-buck-ds-gpios", true }, -+#endif - #if IS_ENABLED(CONFIG_TOUCHSCREEN_TSC2005) - /* - * DTS for Nokia N900 incorrectly specified "active high" -diff --git a/drivers/gpu/drm/i915/i915_pmu.c b/drivers/gpu/drm/i915/i915_pmu.c -index 7b1076b5e748c5..33ab82c334a881 100644 ---- a/drivers/gpu/drm/i915/i915_pmu.c -+++ b/drivers/gpu/drm/i915/i915_pmu.c -@@ -105,7 +105,7 @@ static u32 config_mask(const u64 config) - { - unsigned int bit = config_bit(config); - -- if (__builtin_constant_p(config)) -+ if (__builtin_constant_p(bit)) - BUILD_BUG_ON(bit > - BITS_PER_TYPE(typeof_member(struct i915_pmu, - enable)) - 1); -@@ -114,7 +114,7 @@ static u32 config_mask(const u64 config) - BITS_PER_TYPE(typeof_member(struct i915_pmu, - enable)) - 1); - -- return BIT(config_bit(config)); -+ return BIT(bit); - } - - static bool is_engine_event(struct perf_event *event) -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c -index 20c8b9af7a2199..2cda9bbf68f965 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c -@@ -93,17 +93,21 @@ static void drm_mode_to_intf_timing_params( - timing->vsync_polarity = 0; - } - -- /* for DP/EDP, Shift timings to align it to bottom right */ -- if (phys_enc->hw_intf->cap->type == INTF_DP) { -+ timing->wide_bus_en = dpu_encoder_is_widebus_enabled(phys_enc->parent); -+ timing->compression_en = dpu_encoder_is_dsc_enabled(phys_enc->parent); -+ -+ /* -+ * For DP/EDP, Shift timings to align it to bottom right. -+ * wide_bus_en is set for everything excluding SDM845 & -+ * porch changes cause DisplayPort failure and HDMI tearing. -+ */ -+ if (phys_enc->hw_intf->cap->type == INTF_DP && timing->wide_bus_en) { - timing->h_back_porch += timing->h_front_porch; - timing->h_front_porch = 0; - timing->v_back_porch += timing->v_front_porch; - timing->v_front_porch = 0; - } - -- timing->wide_bus_en = dpu_encoder_is_widebus_enabled(phys_enc->parent); -- timing->compression_en = dpu_encoder_is_dsc_enabled(phys_enc->parent); -- - /* - * for DP, divide the horizonal parameters by 2 when - * widebus is enabled -diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_10nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_10nm.c -index 27b592c776a300..1c111969342a77 100644 ---- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_10nm.c -+++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_10nm.c -@@ -716,6 +716,13 @@ static int dsi_pll_10nm_init(struct msm_dsi_phy *phy) - /* TODO: Remove this when we have proper display handover support */ - msm_dsi_phy_pll_save_state(phy); - -+ /* -+ * Store also proper vco_current_rate, because its value will be used in -+ * dsi_10nm_pll_restore_state(). -+ */ -+ if (!dsi_pll_10nm_vco_recalc_rate(&pll_10nm->clk_hw, VCO_REF_CLK_RATE)) -+ pll_10nm->vco_current_rate = pll_10nm->phy->cfg->min_pll_rate; -+ - return 0; - } - -diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c -index 91b5ecc5753808..4e6f305c9e504d 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_backlight.c -+++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c -@@ -42,7 +42,7 @@ - #include "nouveau_acpi.h" - - static struct ida bl_ida; --#define BL_NAME_SIZE 15 // 12 for name + 2 for digits + 1 for '\0' -+#define BL_NAME_SIZE 24 // 12 for name + 11 for digits + 1 for '\0' - - static bool - nouveau_get_backlight_name(char backlight_name[BL_NAME_SIZE], -diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c -index f001ae880e1dbe..27306c17b0c4e4 100644 ---- a/drivers/hv/connection.c -+++ b/drivers/hv/connection.c -@@ -206,11 +206,20 @@ int vmbus_connect(void) - INIT_LIST_HEAD(&vmbus_connection.chn_list); - mutex_init(&vmbus_connection.channel_mutex); - -+ /* -+ * The following Hyper-V interrupt and monitor pages can be used by -+ * UIO for mapping to user-space, so they should always be allocated on -+ * system page boundaries. The system page size must be >= the Hyper-V -+ * page size. -+ */ -+ BUILD_BUG_ON(PAGE_SIZE < HV_HYP_PAGE_SIZE); -+ - /* - * Setup the vmbus event connection for channel interrupt - * abstraction stuff - */ -- vmbus_connection.int_page = hv_alloc_hyperv_zeroed_page(); -+ vmbus_connection.int_page = -+ (void *)__get_free_page(GFP_KERNEL | __GFP_ZERO); - if (vmbus_connection.int_page == NULL) { - ret = -ENOMEM; - goto cleanup; -@@ -225,8 +234,8 @@ int vmbus_connect(void) - * Setup the monitor notification facility. The 1st page for - * parent->child and the 2nd page for child->parent - */ -- vmbus_connection.monitor_pages[0] = hv_alloc_hyperv_page(); -- vmbus_connection.monitor_pages[1] = hv_alloc_hyperv_page(); -+ vmbus_connection.monitor_pages[0] = (void *)__get_free_page(GFP_KERNEL); -+ vmbus_connection.monitor_pages[1] = (void *)__get_free_page(GFP_KERNEL); - if ((vmbus_connection.monitor_pages[0] == NULL) || - (vmbus_connection.monitor_pages[1] == NULL)) { - ret = -ENOMEM; -@@ -342,21 +351,23 @@ void vmbus_disconnect(void) - destroy_workqueue(vmbus_connection.work_queue); - - if (vmbus_connection.int_page) { -- hv_free_hyperv_page(vmbus_connection.int_page); -+ free_page((unsigned long)vmbus_connection.int_page); - vmbus_connection.int_page = NULL; - } - - if (vmbus_connection.monitor_pages[0]) { - if (!set_memory_encrypted( - (unsigned long)vmbus_connection.monitor_pages[0], 1)) -- hv_free_hyperv_page(vmbus_connection.monitor_pages[0]); -+ free_page((unsigned long) -+ vmbus_connection.monitor_pages[0]); - vmbus_connection.monitor_pages[0] = NULL; - } - - if (vmbus_connection.monitor_pages[1]) { - if (!set_memory_encrypted( - (unsigned long)vmbus_connection.monitor_pages[1], 1)) -- hv_free_hyperv_page(vmbus_connection.monitor_pages[1]); -+ free_page((unsigned long) -+ vmbus_connection.monitor_pages[1]); - vmbus_connection.monitor_pages[1] = NULL; - } - } -diff --git a/drivers/hwmon/ftsteutates.c b/drivers/hwmon/ftsteutates.c -index b74a2665e73321..27e5dd94b04f2c 100644 ---- a/drivers/hwmon/ftsteutates.c -+++ b/drivers/hwmon/ftsteutates.c -@@ -423,13 +423,16 @@ static int fts_read(struct device *dev, enum hwmon_sensor_types type, u32 attr, - break; - case hwmon_pwm: - switch (attr) { -- case hwmon_pwm_auto_channels_temp: -- if (data->fan_source[channel] == FTS_FAN_SOURCE_INVALID) -+ case hwmon_pwm_auto_channels_temp: { -+ u8 fan_source = data->fan_source[channel]; -+ -+ if (fan_source == FTS_FAN_SOURCE_INVALID || fan_source >= BITS_PER_LONG) - *val = 0; - else -- *val = BIT(data->fan_source[channel]); -+ *val = BIT(fan_source); - - return 0; -+ } - default: - break; - } -diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c -index dd690f700d4990..483f79b394298f 100644 ---- a/drivers/hwmon/occ/common.c -+++ b/drivers/hwmon/occ/common.c -@@ -459,12 +459,10 @@ static ssize_t occ_show_power_1(struct device *dev, - return sysfs_emit(buf, "%llu\n", val); - } - --static u64 occ_get_powr_avg(u64 *accum, u32 *samples) -+static u64 occ_get_powr_avg(u64 accum, u32 samples) - { -- u64 divisor = get_unaligned_be32(samples); -- -- return (divisor == 0) ? 0 : -- div64_u64(get_unaligned_be64(accum) * 1000000ULL, divisor); -+ return (samples == 0) ? 0 : -+ mul_u64_u32_div(accum, 1000000UL, samples); - } - - static ssize_t occ_show_power_2(struct device *dev, -@@ -489,8 +487,8 @@ static ssize_t occ_show_power_2(struct device *dev, - get_unaligned_be32(&power->sensor_id), - power->function_id, power->apss_channel); - case 1: -- val = occ_get_powr_avg(&power->accumulator, -- &power->update_tag); -+ val = occ_get_powr_avg(get_unaligned_be64(&power->accumulator), -+ get_unaligned_be32(&power->update_tag)); - break; - case 2: - val = (u64)get_unaligned_be32(&power->update_tag) * -@@ -527,8 +525,8 @@ static ssize_t occ_show_power_a0(struct device *dev, - return sysfs_emit(buf, "%u_system\n", - get_unaligned_be32(&power->sensor_id)); - case 1: -- val = occ_get_powr_avg(&power->system.accumulator, -- &power->system.update_tag); -+ val = occ_get_powr_avg(get_unaligned_be64(&power->system.accumulator), -+ get_unaligned_be32(&power->system.update_tag)); - break; - case 2: - val = (u64)get_unaligned_be32(&power->system.update_tag) * -@@ -541,8 +539,8 @@ static ssize_t occ_show_power_a0(struct device *dev, - return sysfs_emit(buf, "%u_proc\n", - get_unaligned_be32(&power->sensor_id)); - case 5: -- val = occ_get_powr_avg(&power->proc.accumulator, -- &power->proc.update_tag); -+ val = occ_get_powr_avg(get_unaligned_be64(&power->proc.accumulator), -+ get_unaligned_be32(&power->proc.update_tag)); - break; - case 6: - val = (u64)get_unaligned_be32(&power->proc.update_tag) * -@@ -555,8 +553,8 @@ static ssize_t occ_show_power_a0(struct device *dev, - return sysfs_emit(buf, "%u_vdd\n", - get_unaligned_be32(&power->sensor_id)); - case 9: -- val = occ_get_powr_avg(&power->vdd.accumulator, -- &power->vdd.update_tag); -+ val = occ_get_powr_avg(get_unaligned_be64(&power->vdd.accumulator), -+ get_unaligned_be32(&power->vdd.update_tag)); - break; - case 10: - val = (u64)get_unaligned_be32(&power->vdd.update_tag) * -@@ -569,8 +567,8 @@ static ssize_t occ_show_power_a0(struct device *dev, - return sysfs_emit(buf, "%u_vdn\n", - get_unaligned_be32(&power->sensor_id)); - case 13: -- val = occ_get_powr_avg(&power->vdn.accumulator, -- &power->vdn.update_tag); -+ val = occ_get_powr_avg(get_unaligned_be64(&power->vdn.accumulator), -+ get_unaligned_be32(&power->vdn.update_tag)); - break; - case 14: - val = (u64)get_unaligned_be32(&power->vdn.update_tag) * -@@ -747,29 +745,30 @@ static ssize_t occ_show_extended(struct device *dev, - } - - /* -- * Some helper macros to make it easier to define an occ_attribute. Since these -- * are dynamically allocated, we shouldn't use the existing kernel macros which -+ * A helper to make it easier to define an occ_attribute. Since these -+ * are dynamically allocated, we cannot use the existing kernel macros which - * stringify the name argument. - */ --#define ATTR_OCC(_name, _mode, _show, _store) { \ -- .attr = { \ -- .name = _name, \ -- .mode = VERIFY_OCTAL_PERMISSIONS(_mode), \ -- }, \ -- .show = _show, \ -- .store = _store, \ --} -- --#define SENSOR_ATTR_OCC(_name, _mode, _show, _store, _nr, _index) { \ -- .dev_attr = ATTR_OCC(_name, _mode, _show, _store), \ -- .index = _index, \ -- .nr = _nr, \ -+static void occ_init_attribute(struct occ_attribute *attr, int mode, -+ ssize_t (*show)(struct device *dev, struct device_attribute *attr, char *buf), -+ ssize_t (*store)(struct device *dev, struct device_attribute *attr, -+ const char *buf, size_t count), -+ int nr, int index, const char *fmt, ...) -+{ -+ va_list args; -+ -+ va_start(args, fmt); -+ vsnprintf(attr->name, sizeof(attr->name), fmt, args); -+ va_end(args); -+ -+ attr->sensor.dev_attr.attr.name = attr->name; -+ attr->sensor.dev_attr.attr.mode = mode; -+ attr->sensor.dev_attr.show = show; -+ attr->sensor.dev_attr.store = store; -+ attr->sensor.index = index; -+ attr->sensor.nr = nr; - } - --#define OCC_INIT_ATTR(_name, _mode, _show, _store, _nr, _index) \ -- ((struct sensor_device_attribute_2) \ -- SENSOR_ATTR_OCC(_name, _mode, _show, _store, _nr, _index)) -- - /* - * Allocate and instatiate sensor_device_attribute_2s. It's most efficient to - * use our own instead of the built-in hwmon attribute types. -@@ -855,14 +854,15 @@ static int occ_setup_sensor_attrs(struct occ *occ) - sensors->extended.num_sensors = 0; - } - -- occ->attrs = devm_kzalloc(dev, sizeof(*occ->attrs) * num_attrs, -+ occ->attrs = devm_kcalloc(dev, num_attrs, sizeof(*occ->attrs), - GFP_KERNEL); - if (!occ->attrs) - return -ENOMEM; - - /* null-terminated list */ -- occ->group.attrs = devm_kzalloc(dev, sizeof(*occ->group.attrs) * -- num_attrs + 1, GFP_KERNEL); -+ occ->group.attrs = devm_kcalloc(dev, num_attrs + 1, -+ sizeof(*occ->group.attrs), -+ GFP_KERNEL); - if (!occ->group.attrs) - return -ENOMEM; - -@@ -872,43 +872,33 @@ static int occ_setup_sensor_attrs(struct occ *occ) - s = i + 1; - temp = ((struct temp_sensor_2 *)sensors->temp.data) + i; - -- snprintf(attr->name, sizeof(attr->name), "temp%d_label", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, show_temp, NULL, -- 0, i); -+ occ_init_attribute(attr, 0444, show_temp, NULL, -+ 0, i, "temp%d_label", s); - attr++; - - if (sensors->temp.version == 2 && - temp->fru_type == OCC_FRU_TYPE_VRM) { -- snprintf(attr->name, sizeof(attr->name), -- "temp%d_alarm", s); -+ occ_init_attribute(attr, 0444, show_temp, NULL, -+ 1, i, "temp%d_alarm", s); - } else { -- snprintf(attr->name, sizeof(attr->name), -- "temp%d_input", s); -+ occ_init_attribute(attr, 0444, show_temp, NULL, -+ 1, i, "temp%d_input", s); - } - -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, show_temp, NULL, -- 1, i); - attr++; - - if (sensors->temp.version > 1) { -- snprintf(attr->name, sizeof(attr->name), -- "temp%d_fru_type", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, -- show_temp, NULL, 2, i); -+ occ_init_attribute(attr, 0444, show_temp, NULL, -+ 2, i, "temp%d_fru_type", s); - attr++; - -- snprintf(attr->name, sizeof(attr->name), -- "temp%d_fault", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, -- show_temp, NULL, 3, i); -+ occ_init_attribute(attr, 0444, show_temp, NULL, -+ 3, i, "temp%d_fault", s); - attr++; - - if (sensors->temp.version == 0x10) { -- snprintf(attr->name, sizeof(attr->name), -- "temp%d_max", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, -- show_temp, NULL, -- 4, i); -+ occ_init_attribute(attr, 0444, show_temp, NULL, -+ 4, i, "temp%d_max", s); - attr++; - } - } -@@ -917,14 +907,12 @@ static int occ_setup_sensor_attrs(struct occ *occ) - for (i = 0; i < sensors->freq.num_sensors; ++i) { - s = i + 1; - -- snprintf(attr->name, sizeof(attr->name), "freq%d_label", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, show_freq, NULL, -- 0, i); -+ occ_init_attribute(attr, 0444, show_freq, NULL, -+ 0, i, "freq%d_label", s); - attr++; - -- snprintf(attr->name, sizeof(attr->name), "freq%d_input", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, show_freq, NULL, -- 1, i); -+ occ_init_attribute(attr, 0444, show_freq, NULL, -+ 1, i, "freq%d_input", s); - attr++; - } - -@@ -940,32 +928,24 @@ static int occ_setup_sensor_attrs(struct occ *occ) - s = (i * 4) + 1; - - for (j = 0; j < 4; ++j) { -- snprintf(attr->name, sizeof(attr->name), -- "power%d_label", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, -- show_power, NULL, -- nr++, i); -+ occ_init_attribute(attr, 0444, show_power, -+ NULL, nr++, i, -+ "power%d_label", s); - attr++; - -- snprintf(attr->name, sizeof(attr->name), -- "power%d_average", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, -- show_power, NULL, -- nr++, i); -+ occ_init_attribute(attr, 0444, show_power, -+ NULL, nr++, i, -+ "power%d_average", s); - attr++; - -- snprintf(attr->name, sizeof(attr->name), -- "power%d_average_interval", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, -- show_power, NULL, -- nr++, i); -+ occ_init_attribute(attr, 0444, show_power, -+ NULL, nr++, i, -+ "power%d_average_interval", s); - attr++; - -- snprintf(attr->name, sizeof(attr->name), -- "power%d_input", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, -- show_power, NULL, -- nr++, i); -+ occ_init_attribute(attr, 0444, show_power, -+ NULL, nr++, i, -+ "power%d_input", s); - attr++; - - s++; -@@ -977,28 +957,20 @@ static int occ_setup_sensor_attrs(struct occ *occ) - for (i = 0; i < sensors->power.num_sensors; ++i) { - s = i + 1; - -- snprintf(attr->name, sizeof(attr->name), -- "power%d_label", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, -- show_power, NULL, 0, i); -+ occ_init_attribute(attr, 0444, show_power, NULL, -+ 0, i, "power%d_label", s); - attr++; - -- snprintf(attr->name, sizeof(attr->name), -- "power%d_average", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, -- show_power, NULL, 1, i); -+ occ_init_attribute(attr, 0444, show_power, NULL, -+ 1, i, "power%d_average", s); - attr++; - -- snprintf(attr->name, sizeof(attr->name), -- "power%d_average_interval", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, -- show_power, NULL, 2, i); -+ occ_init_attribute(attr, 0444, show_power, NULL, -+ 2, i, "power%d_average_interval", s); - attr++; - -- snprintf(attr->name, sizeof(attr->name), -- "power%d_input", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, -- show_power, NULL, 3, i); -+ occ_init_attribute(attr, 0444, show_power, NULL, -+ 3, i, "power%d_input", s); - attr++; - } - -@@ -1006,56 +978,43 @@ static int occ_setup_sensor_attrs(struct occ *occ) - } - - if (sensors->caps.num_sensors >= 1) { -- snprintf(attr->name, sizeof(attr->name), "power%d_label", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, show_caps, NULL, -- 0, 0); -+ occ_init_attribute(attr, 0444, show_caps, NULL, -+ 0, 0, "power%d_label", s); - attr++; - -- snprintf(attr->name, sizeof(attr->name), "power%d_cap", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, show_caps, NULL, -- 1, 0); -+ occ_init_attribute(attr, 0444, show_caps, NULL, -+ 1, 0, "power%d_cap", s); - attr++; - -- snprintf(attr->name, sizeof(attr->name), "power%d_input", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, show_caps, NULL, -- 2, 0); -+ occ_init_attribute(attr, 0444, show_caps, NULL, -+ 2, 0, "power%d_input", s); - attr++; - -- snprintf(attr->name, sizeof(attr->name), -- "power%d_cap_not_redundant", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, show_caps, NULL, -- 3, 0); -+ occ_init_attribute(attr, 0444, show_caps, NULL, -+ 3, 0, "power%d_cap_not_redundant", s); - attr++; - -- snprintf(attr->name, sizeof(attr->name), "power%d_cap_max", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, show_caps, NULL, -- 4, 0); -+ occ_init_attribute(attr, 0444, show_caps, NULL, -+ 4, 0, "power%d_cap_max", s); - attr++; - -- snprintf(attr->name, sizeof(attr->name), "power%d_cap_min", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, show_caps, NULL, -- 5, 0); -+ occ_init_attribute(attr, 0444, show_caps, NULL, -+ 5, 0, "power%d_cap_min", s); - attr++; - -- snprintf(attr->name, sizeof(attr->name), "power%d_cap_user", -- s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0644, show_caps, -- occ_store_caps_user, 6, 0); -+ occ_init_attribute(attr, 0644, show_caps, occ_store_caps_user, -+ 6, 0, "power%d_cap_user", s); - attr++; - - if (sensors->caps.version > 1) { -- snprintf(attr->name, sizeof(attr->name), -- "power%d_cap_user_source", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, -- show_caps, NULL, 7, 0); -+ occ_init_attribute(attr, 0444, show_caps, NULL, -+ 7, 0, "power%d_cap_user_source", s); - attr++; - - if (sensors->caps.version > 2) { -- snprintf(attr->name, sizeof(attr->name), -- "power%d_cap_min_soft", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, -- show_caps, NULL, -- 8, 0); -+ occ_init_attribute(attr, 0444, show_caps, NULL, -+ 8, 0, -+ "power%d_cap_min_soft", s); - attr++; - } - } -@@ -1064,19 +1023,16 @@ static int occ_setup_sensor_attrs(struct occ *occ) - for (i = 0; i < sensors->extended.num_sensors; ++i) { - s = i + 1; - -- snprintf(attr->name, sizeof(attr->name), "extn%d_label", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, -- occ_show_extended, NULL, 0, i); -+ occ_init_attribute(attr, 0444, occ_show_extended, NULL, -+ 0, i, "extn%d_label", s); - attr++; - -- snprintf(attr->name, sizeof(attr->name), "extn%d_flags", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, -- occ_show_extended, NULL, 1, i); -+ occ_init_attribute(attr, 0444, occ_show_extended, NULL, -+ 1, i, "extn%d_flags", s); - attr++; - -- snprintf(attr->name, sizeof(attr->name), "extn%d_input", s); -- attr->sensor = OCC_INIT_ATTR(attr->name, 0444, -- occ_show_extended, NULL, 2, i); -+ occ_init_attribute(attr, 0444, occ_show_extended, NULL, -+ 2, i, "extn%d_input", s); - attr++; - } - -diff --git a/drivers/i2c/busses/i2c-designware-slave.c b/drivers/i2c/busses/i2c-designware-slave.c -index 345b532a2b455d..ea4c4955fe2646 100644 ---- a/drivers/i2c/busses/i2c-designware-slave.c -+++ b/drivers/i2c/busses/i2c-designware-slave.c -@@ -91,7 +91,7 @@ static int i2c_dw_unreg_slave(struct i2c_client *slave) - i2c_dw_disable(dev); - synchronize_irq(dev->irq); - dev->slave = NULL; -- pm_runtime_put(dev->dev); -+ pm_runtime_put_sync_suspend(dev->dev); - - return 0; - } -diff --git a/drivers/i2c/busses/i2c-npcm7xx.c b/drivers/i2c/busses/i2c-npcm7xx.c -index 91f508d50e7ab4..5b3987460976e3 100644 ---- a/drivers/i2c/busses/i2c-npcm7xx.c -+++ b/drivers/i2c/busses/i2c-npcm7xx.c -@@ -1971,10 +1971,14 @@ static int npcm_i2c_init_module(struct npcm_i2c *bus, enum i2c_mode mode, - - /* Check HW is OK: SDA and SCL should be high at this point. */ - if ((npcm_i2c_get_SDA(&bus->adap) == 0) || (npcm_i2c_get_SCL(&bus->adap) == 0)) { -- dev_err(bus->dev, "I2C%d init fail: lines are low\n", bus->num); -- dev_err(bus->dev, "SDA=%d SCL=%d\n", npcm_i2c_get_SDA(&bus->adap), -- npcm_i2c_get_SCL(&bus->adap)); -- return -ENXIO; -+ dev_warn(bus->dev, " I2C%d SDA=%d SCL=%d, attempting to recover\n", bus->num, -+ npcm_i2c_get_SDA(&bus->adap), npcm_i2c_get_SCL(&bus->adap)); -+ if (npcm_i2c_recovery_tgclk(&bus->adap)) { -+ dev_err(bus->dev, "I2C%d init fail: SDA=%d SCL=%d\n", -+ bus->num, npcm_i2c_get_SDA(&bus->adap), -+ npcm_i2c_get_SCL(&bus->adap)); -+ return -ENXIO; -+ } - } - - npcm_i2c_int_enable(bus, true); -diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c -index 91be04b534fe61..08a81daedc115e 100644 ---- a/drivers/i2c/busses/i2c-tegra.c -+++ b/drivers/i2c/busses/i2c-tegra.c -@@ -1397,6 +1397,11 @@ static int tegra_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], - ret = tegra_i2c_xfer_msg(i2c_dev, &msgs[i], MSG_END_CONTINUE); - if (ret) - break; -+ -+ /* Validate message length before proceeding */ -+ if (msgs[i].buf[0] == 0 || msgs[i].buf[0] > I2C_SMBUS_BLOCK_MAX) -+ break; -+ - /* Set the msg length from first byte */ - msgs[i].len += msgs[i].buf[0]; - dev_dbg(i2c_dev->dev, "reading %d bytes\n", msgs[i].len); -diff --git a/drivers/iio/accel/fxls8962af-core.c b/drivers/iio/accel/fxls8962af-core.c -index be8a15cb945fdf..17820b2c3a1dec 100644 ---- a/drivers/iio/accel/fxls8962af-core.c -+++ b/drivers/iio/accel/fxls8962af-core.c -@@ -20,6 +20,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -434,8 +435,16 @@ static int fxls8962af_read_raw(struct iio_dev *indio_dev, - *val = FXLS8962AF_TEMP_CENTER_VAL; - return IIO_VAL_INT; - case IIO_CHAN_INFO_SCALE: -- *val = 0; -- return fxls8962af_read_full_scale(data, val2); -+ switch (chan->type) { -+ case IIO_TEMP: -+ *val = MILLIDEGREE_PER_DEGREE; -+ return IIO_VAL_INT; -+ case IIO_ACCEL: -+ *val = 0; -+ return fxls8962af_read_full_scale(data, val2); -+ default: -+ return -EINVAL; -+ } - case IIO_CHAN_INFO_SAMP_FREQ: - return fxls8962af_read_samp_freq(data, val, val2); - default: -@@ -734,9 +743,11 @@ static const struct iio_event_spec fxls8962af_event[] = { - .type = IIO_TEMP, \ - .address = FXLS8962AF_TEMP_OUT, \ - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) | \ -+ BIT(IIO_CHAN_INFO_SCALE) | \ - BIT(IIO_CHAN_INFO_OFFSET),\ - .scan_index = -1, \ - .scan_type = { \ -+ .sign = 's', \ - .realbits = 8, \ - .storagebits = 8, \ - }, \ -diff --git a/drivers/iio/adc/ad7606_spi.c b/drivers/iio/adc/ad7606_spi.c -index 67c96572cecc40..df48464a115d03 100644 ---- a/drivers/iio/adc/ad7606_spi.c -+++ b/drivers/iio/adc/ad7606_spi.c -@@ -151,7 +151,7 @@ static int ad7606_spi_reg_write(struct ad7606_state *st, - struct spi_device *spi = to_spi_device(st->dev); - - st->d16[0] = cpu_to_be16((st->bops->rd_wr_cmd(addr, 1) << 8) | -- (val & 0x1FF)); -+ (val & 0xFF)); - - return spi_write(spi, &st->d16[0], sizeof(st->d16[0])); - } -diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_temp.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_temp.c -index 213cce1c31110e..91f0f381082bda 100644 ---- a/drivers/iio/imu/inv_icm42600/inv_icm42600_temp.c -+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_temp.c -@@ -67,16 +67,18 @@ int inv_icm42600_temp_read_raw(struct iio_dev *indio_dev, - return IIO_VAL_INT; - /* - * T°C = (temp / 132.48) + 25 -- * Tm°C = 1000 * ((temp * 100 / 13248) + 25) -+ * Tm°C = 1000 * ((temp / 132.48) + 25) -+ * Tm°C = 7.548309 * temp + 25000 -+ * Tm°C = (temp + 3312) * 7.548309 - * scale: 100000 / 13248 ~= 7.548309 -- * offset: 25000 -+ * offset: 3312 - */ - case IIO_CHAN_INFO_SCALE: - *val = 7; - *val2 = 548309; - return IIO_VAL_INT_PLUS_MICRO; - case IIO_CHAN_INFO_OFFSET: -- *val = 25000; -+ *val = 3312; - return IIO_VAL_INT; - default: - return -EINVAL; -diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c -index 3e4941754b48d0..ce41f235af253c 100644 ---- a/drivers/infiniband/core/iwcm.c -+++ b/drivers/infiniband/core/iwcm.c -@@ -367,12 +367,9 @@ EXPORT_SYMBOL(iw_cm_disconnect); - /* - * CM_ID <-- DESTROYING - * -- * Clean up all resources associated with the connection and release -- * the initial reference taken by iw_create_cm_id. -- * -- * Returns true if and only if the last cm_id_priv reference has been dropped. -+ * Clean up all resources associated with the connection. - */ --static bool destroy_cm_id(struct iw_cm_id *cm_id) -+static void destroy_cm_id(struct iw_cm_id *cm_id) - { - struct iwcm_id_private *cm_id_priv; - struct ib_qp *qp; -@@ -441,20 +438,22 @@ static bool destroy_cm_id(struct iw_cm_id *cm_id) - iwpm_remove_mapinfo(&cm_id->local_addr, &cm_id->m_local_addr); - iwpm_remove_mapping(&cm_id->local_addr, RDMA_NL_IWCM); - } -- -- return iwcm_deref_id(cm_id_priv); - } - - /* -- * This function is only called by the application thread and cannot -- * be called by the event thread. The function will wait for all -- * references to be released on the cm_id and then kfree the cm_id -- * object. -+ * Destroy cm_id. If the cm_id still has other references, wait for all -+ * references to be released on the cm_id and then release the initial -+ * reference taken by iw_create_cm_id. - */ - void iw_destroy_cm_id(struct iw_cm_id *cm_id) - { -- if (!destroy_cm_id(cm_id)) -+ struct iwcm_id_private *cm_id_priv; -+ -+ cm_id_priv = container_of(cm_id, struct iwcm_id_private, id); -+ destroy_cm_id(cm_id); -+ if (refcount_read(&cm_id_priv->refcount) > 1) - flush_workqueue(iwcm_wq); -+ iwcm_deref_id(cm_id_priv); - } - EXPORT_SYMBOL(iw_destroy_cm_id); - -@@ -1037,8 +1036,10 @@ static void cm_work_handler(struct work_struct *_work) - - if (!test_bit(IWCM_F_DROP_EVENTS, &cm_id_priv->flags)) { - ret = process_event(cm_id_priv, &levent); -- if (ret) -- WARN_ON_ONCE(destroy_cm_id(&cm_id_priv->id)); -+ if (ret) { -+ destroy_cm_id(&cm_id_priv->id); -+ WARN_ON_ONCE(iwcm_deref_id(cm_id_priv)); -+ } - } else - pr_debug("dropping event %d\n", levent.event); - if (iwcm_deref_id(cm_id_priv)) -diff --git a/drivers/input/keyboard/gpio_keys.c b/drivers/input/keyboard/gpio_keys.c -index 2e7c2c046e675f..c5f4207fddce92 100644 ---- a/drivers/input/keyboard/gpio_keys.c -+++ b/drivers/input/keyboard/gpio_keys.c -@@ -455,6 +455,8 @@ static enum hrtimer_restart gpio_keys_irq_timer(struct hrtimer *t) - release_timer); - struct input_dev *input = bdata->input; - -+ guard(spinlock_irqsave)(&bdata->lock); -+ - if (bdata->key_pressed) { - input_report_key(input, *bdata->code, 0); - input_sync(input); -diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c -index 180d90e46061e7..5cfe9b56978da0 100644 ---- a/drivers/input/misc/ims-pcu.c -+++ b/drivers/input/misc/ims-pcu.c -@@ -845,6 +845,12 @@ static int ims_pcu_flash_firmware(struct ims_pcu *pcu, - addr = be32_to_cpu(rec->addr) / 2; - len = be16_to_cpu(rec->len); - -+ if (len > sizeof(pcu->cmd_buf) - 1 - sizeof(*fragment)) { -+ dev_err(pcu->dev, -+ "Invalid record length in firmware: %d\n", len); -+ return -EINVAL; -+ } -+ - fragment = (void *)&pcu->cmd_buf[1]; - put_unaligned_le32(addr, &fragment->addr); - fragment->len = len; -diff --git a/drivers/input/misc/sparcspkr.c b/drivers/input/misc/sparcspkr.c -index e5dd84725c6e74..d715fd736426d1 100644 ---- a/drivers/input/misc/sparcspkr.c -+++ b/drivers/input/misc/sparcspkr.c -@@ -75,9 +75,14 @@ static int bbc_spkr_event(struct input_dev *dev, unsigned int type, unsigned int - return -1; - - switch (code) { -- case SND_BELL: if (value) value = 1000; -- case SND_TONE: break; -- default: return -1; -+ case SND_BELL: -+ if (value) -+ value = 1000; -+ break; -+ case SND_TONE: -+ break; -+ default: -+ return -1; - } - - if (value > 20 && value < 32767) -@@ -113,9 +118,14 @@ static int grover_spkr_event(struct input_dev *dev, unsigned int type, unsigned - return -1; - - switch (code) { -- case SND_BELL: if (value) value = 1000; -- case SND_TONE: break; -- default: return -1; -+ case SND_BELL: -+ if (value) -+ value = 1000; -+ break; -+ case SND_TONE: -+ break; -+ default: -+ return -1; - } - - if (value > 20 && value < 32767) -diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c -index 83c5d786686d07..a5d6d786dba523 100644 ---- a/drivers/iommu/amd/iommu.c -+++ b/drivers/iommu/amd/iommu.c -@@ -780,6 +780,14 @@ int amd_iommu_register_ga_log_notifier(int (*notifier)(u32)) - { - iommu_ga_log_notifier = notifier; - -+ /* -+ * Ensure all in-flight IRQ handlers run to completion before returning -+ * to the caller, e.g. to ensure module code isn't unloaded while it's -+ * being executed in the IRQ handler. -+ */ -+ if (!notifier) -+ synchronize_rcu(); -+ - return 0; - } - EXPORT_SYMBOL(amd_iommu_register_ga_log_notifier); -diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c -index 9511dae5b556a9..94b6c43dfa5cbd 100644 ---- a/drivers/md/dm-raid1.c -+++ b/drivers/md/dm-raid1.c -@@ -133,10 +133,9 @@ static void queue_bio(struct mirror_set *ms, struct bio *bio, int rw) - spin_lock_irqsave(&ms->lock, flags); - should_wake = !(bl->head); - bio_list_add(bl, bio); -- spin_unlock_irqrestore(&ms->lock, flags); -- - if (should_wake) - wakeup_mirrord(ms); -+ spin_unlock_irqrestore(&ms->lock, flags); - } - - static void dispatch_bios(void *context, struct bio_list *bio_list) -@@ -646,9 +645,9 @@ static void write_callback(unsigned long error, void *context) - if (!ms->failures.head) - should_wake = 1; - bio_list_add(&ms->failures, bio); -- spin_unlock_irqrestore(&ms->lock, flags); - if (should_wake) - wakeup_mirrord(ms); -+ spin_unlock_irqrestore(&ms->lock, flags); - } - - static void do_write(struct mirror_set *ms, struct bio *bio) -diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c -index 6a7a17c489c998..8007e2e2197295 100644 ---- a/drivers/md/dm-verity-fec.c -+++ b/drivers/md/dm-verity-fec.c -@@ -624,6 +624,10 @@ int verity_fec_parse_opt_args(struct dm_arg_set *as, struct dm_verity *v, - (*argc)--; - - if (!strcasecmp(arg_name, DM_VERITY_OPT_FEC_DEV)) { -+ if (v->fec->dev) { -+ ti->error = "FEC device already specified"; -+ return -EINVAL; -+ } - r = dm_get_device(ti, arg_value, BLK_OPEN_READ, &v->fec->dev); - if (r) { - ti->error = "FEC device lookup failed"; -diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c -index 6ae97da741bba3..60e74c0e02f1ab 100644 ---- a/drivers/md/dm-verity-target.c -+++ b/drivers/md/dm-verity-target.c -@@ -1043,6 +1043,9 @@ static int verity_alloc_most_once(struct dm_verity *v) - { - struct dm_target *ti = v->ti; - -+ if (v->validated_blocks) -+ return 0; -+ - /* the bitset can only handle INT_MAX blocks */ - if (v->data_blocks > INT_MAX) { - ti->error = "device too large to use check_at_most_once"; -@@ -1066,6 +1069,9 @@ static int verity_alloc_zero_digest(struct dm_verity *v) - struct ahash_request *req; - u8 *zero_data; - -+ if (v->zero_digest) -+ return 0; -+ - v->zero_digest = kmalloc(v->digest_size, GFP_KERNEL); - - if (!v->zero_digest) -@@ -1405,7 +1411,7 @@ static int verity_ctr(struct dm_target *ti, unsigned int argc, char **argv) - goto bad; - } - -- /* Root hash signature is a optional parameter*/ -+ /* Root hash signature is an optional parameter */ - r = verity_verify_root_hash(root_hash_digest_to_validate, - strlen(root_hash_digest_to_validate), - verify_args.sig, -diff --git a/drivers/md/dm-verity-verify-sig.c b/drivers/md/dm-verity-verify-sig.c -index 4836508ea50c07..1ced2ef255f325 100644 ---- a/drivers/md/dm-verity-verify-sig.c -+++ b/drivers/md/dm-verity-verify-sig.c -@@ -71,9 +71,14 @@ int verity_verify_sig_parse_opt_args(struct dm_arg_set *as, - const char *arg_name) - { - struct dm_target *ti = v->ti; -- int ret = 0; -+ int ret; - const char *sig_key = NULL; - -+ if (v->signature_key_desc) { -+ ti->error = DM_VERITY_VERIFY_ERR("root_hash_sig_key_desc already specified"); -+ return -EINVAL; -+ } -+ - if (!*argc) { - ti->error = DM_VERITY_VERIFY_ERR("Signature key not specified"); - return -EINVAL; -@@ -83,14 +88,18 @@ int verity_verify_sig_parse_opt_args(struct dm_arg_set *as, - (*argc)--; - - ret = verity_verify_get_sig_from_key(sig_key, sig_opts); -- if (ret < 0) -+ if (ret < 0) { - ti->error = DM_VERITY_VERIFY_ERR("Invalid key specified"); -+ return ret; -+ } - - v->signature_key_desc = kstrdup(sig_key, GFP_KERNEL); -- if (!v->signature_key_desc) -+ if (!v->signature_key_desc) { -+ ti->error = DM_VERITY_VERIFY_ERR("Could not allocate memory for signature key"); - return -ENOMEM; -+ } - -- return ret; -+ return 0; - } - - /* -diff --git a/drivers/media/common/videobuf2/videobuf2-dma-sg.c b/drivers/media/common/videobuf2/videobuf2-dma-sg.c -index 6975a71d740f6d..a5aa6a2a028cb2 100644 ---- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c -+++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c -@@ -469,7 +469,7 @@ vb2_dma_sg_dmabuf_ops_begin_cpu_access(struct dma_buf *dbuf, - struct vb2_dma_sg_buf *buf = dbuf->priv; - struct sg_table *sgt = buf->dma_sgt; - -- dma_sync_sg_for_cpu(buf->dev, sgt->sgl, sgt->nents, buf->dma_dir); -+ dma_sync_sgtable_for_cpu(buf->dev, sgt, buf->dma_dir); - return 0; - } - -@@ -480,7 +480,7 @@ vb2_dma_sg_dmabuf_ops_end_cpu_access(struct dma_buf *dbuf, - struct vb2_dma_sg_buf *buf = dbuf->priv; - struct sg_table *sgt = buf->dma_sgt; - -- dma_sync_sg_for_device(buf->dev, sgt->sgl, sgt->nents, buf->dma_dir); -+ dma_sync_sgtable_for_device(buf->dev, sgt, buf->dma_dir); - return 0; - } - -diff --git a/drivers/media/i2c/ccs-pll.c b/drivers/media/i2c/ccs-pll.c -index cf8858cb13d4ce..611c9823be8578 100644 ---- a/drivers/media/i2c/ccs-pll.c -+++ b/drivers/media/i2c/ccs-pll.c -@@ -312,6 +312,11 @@ __ccs_pll_calculate_vt_tree(struct device *dev, - dev_dbg(dev, "more_mul2: %u\n", more_mul); - - pll_fr->pll_multiplier = mul * more_mul; -+ if (pll_fr->pll_multiplier > lim_fr->max_pll_multiplier) { -+ dev_dbg(dev, "pll multiplier %u too high\n", -+ pll_fr->pll_multiplier); -+ return -EINVAL; -+ } - - if (pll_fr->pll_multiplier * pll_fr->pll_ip_clk_freq_hz > - lim_fr->max_pll_op_clk_freq_hz) -@@ -397,6 +402,8 @@ static int ccs_pll_calculate_vt_tree(struct device *dev, - min_pre_pll_clk_div = max_t(u16, min_pre_pll_clk_div, - pll->ext_clk_freq_hz / - lim_fr->max_pll_ip_clk_freq_hz); -+ if (!(pll->flags & CCS_PLL_FLAG_EXT_IP_PLL_DIVIDER)) -+ min_pre_pll_clk_div = clk_div_even(min_pre_pll_clk_div); - - dev_dbg(dev, "vt min/max_pre_pll_clk_div: %u,%u\n", - min_pre_pll_clk_div, max_pre_pll_clk_div); -@@ -792,7 +799,7 @@ int ccs_pll_calculate(struct device *dev, const struct ccs_pll_limits *lim, - op_lim_fr->min_pre_pll_clk_div, op_lim_fr->max_pre_pll_clk_div); - max_op_pre_pll_clk_div = - min_t(u16, op_lim_fr->max_pre_pll_clk_div, -- clk_div_even(pll->ext_clk_freq_hz / -+ DIV_ROUND_UP(pll->ext_clk_freq_hz, - op_lim_fr->min_pll_ip_clk_freq_hz)); - min_op_pre_pll_clk_div = - max_t(u16, op_lim_fr->min_pre_pll_clk_div, -@@ -815,6 +822,8 @@ int ccs_pll_calculate(struct device *dev, const struct ccs_pll_limits *lim, - one_or_more( - DIV_ROUND_UP(op_lim_fr->max_pll_op_clk_freq_hz, - pll->ext_clk_freq_hz)))); -+ if (!(pll->flags & CCS_PLL_FLAG_EXT_IP_PLL_DIVIDER)) -+ min_op_pre_pll_clk_div = clk_div_even(min_op_pre_pll_clk_div); - dev_dbg(dev, "pll_op check: min / max op_pre_pll_clk_div: %u / %u\n", - min_op_pre_pll_clk_div, max_op_pre_pll_clk_div); - -diff --git a/drivers/media/i2c/ds90ub913.c b/drivers/media/i2c/ds90ub913.c -index ae33d1ecf835df..6ec960d7914e9a 100644 ---- a/drivers/media/i2c/ds90ub913.c -+++ b/drivers/media/i2c/ds90ub913.c -@@ -453,10 +453,10 @@ static int ub913_set_fmt(struct v4l2_subdev *sd, - if (!fmt) - return -EINVAL; - -- format->format.code = finfo->outcode; -- - *fmt = format->format; - -+ fmt->code = finfo->outcode; -+ - return 0; - } - -diff --git a/drivers/media/i2c/ov5675.c b/drivers/media/i2c/ov5675.c -index c499e7e93c54b9..92c3e7951ee727 100644 ---- a/drivers/media/i2c/ov5675.c -+++ b/drivers/media/i2c/ov5675.c -@@ -1339,11 +1339,8 @@ static int ov5675_probe(struct i2c_client *client) - return -ENOMEM; - - ret = ov5675_get_hwcfg(ov5675, &client->dev); -- if (ret) { -- dev_err(&client->dev, "failed to get HW configuration: %d", -- ret); -+ if (ret) - return ret; -- } - - v4l2_i2c_subdev_init(&ov5675->sd, client, &ov5675_subdev_ops); - -diff --git a/drivers/media/i2c/ov8856.c b/drivers/media/i2c/ov8856.c -index f053c3a7676a09..8c93fe6285f809 100644 ---- a/drivers/media/i2c/ov8856.c -+++ b/drivers/media/i2c/ov8856.c -@@ -2323,8 +2323,8 @@ static int ov8856_get_hwcfg(struct ov8856 *ov8856, struct device *dev) - if (!is_acpi_node(fwnode)) { - ov8856->xvclk = devm_clk_get(dev, "xvclk"); - if (IS_ERR(ov8856->xvclk)) { -- dev_err(dev, "could not get xvclk clock (%pe)\n", -- ov8856->xvclk); -+ dev_err_probe(dev, PTR_ERR(ov8856->xvclk), -+ "could not get xvclk clock\n"); - return PTR_ERR(ov8856->xvclk); - } - -@@ -2429,11 +2429,8 @@ static int ov8856_probe(struct i2c_client *client) - return -ENOMEM; - - ret = ov8856_get_hwcfg(ov8856, &client->dev); -- if (ret) { -- dev_err(&client->dev, "failed to get HW configuration: %d", -- ret); -+ if (ret) - return ret; -- } - - v4l2_i2c_subdev_init(&ov8856->sd, client, &ov8856_subdev_ops); - -diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c -index 21836dd6ef85a3..bbf56016f70a22 100644 ---- a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c -+++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c -@@ -821,7 +821,7 @@ static int vdec_hevc_slice_setup_core_buffer(struct vdec_hevc_slice_inst *inst, - inst->vsi_core->fb.y.dma_addr = y_fb_dma; - inst->vsi_core->fb.y.size = ctx->picinfo.fb_sz[0]; - inst->vsi_core->fb.c.dma_addr = c_fb_dma; -- inst->vsi_core->fb.y.size = ctx->picinfo.fb_sz[1]; -+ inst->vsi_core->fb.c.size = ctx->picinfo.fb_sz[1]; - - inst->vsi_core->dec.vdec_fb_va = (unsigned long)fb; - -diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c -index 092d83b7e79549..dc3e0d2928104c 100644 ---- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c -+++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c -@@ -752,6 +752,32 @@ static int mxc_get_free_slot(struct mxc_jpeg_slot_data *slot_data) - return -1; - } - -+static void mxc_jpeg_free_slot_data(struct mxc_jpeg_dev *jpeg) -+{ -+ /* free descriptor for decoding/encoding phase */ -+ dma_free_coherent(jpeg->dev, sizeof(struct mxc_jpeg_desc), -+ jpeg->slot_data.desc, -+ jpeg->slot_data.desc_handle); -+ jpeg->slot_data.desc = NULL; -+ jpeg->slot_data.desc_handle = 0; -+ -+ /* free descriptor for encoder configuration phase / decoder DHT */ -+ dma_free_coherent(jpeg->dev, sizeof(struct mxc_jpeg_desc), -+ jpeg->slot_data.cfg_desc, -+ jpeg->slot_data.cfg_desc_handle); -+ jpeg->slot_data.cfg_desc_handle = 0; -+ jpeg->slot_data.cfg_desc = NULL; -+ -+ /* free configuration stream */ -+ dma_free_coherent(jpeg->dev, MXC_JPEG_MAX_CFG_STREAM, -+ jpeg->slot_data.cfg_stream_vaddr, -+ jpeg->slot_data.cfg_stream_handle); -+ jpeg->slot_data.cfg_stream_vaddr = NULL; -+ jpeg->slot_data.cfg_stream_handle = 0; -+ -+ jpeg->slot_data.used = false; -+} -+ - static bool mxc_jpeg_alloc_slot_data(struct mxc_jpeg_dev *jpeg) - { - struct mxc_jpeg_desc *desc; -@@ -794,30 +820,11 @@ static bool mxc_jpeg_alloc_slot_data(struct mxc_jpeg_dev *jpeg) - return true; - err: - dev_err(jpeg->dev, "Could not allocate descriptors for slot %d", jpeg->slot_data.slot); -+ mxc_jpeg_free_slot_data(jpeg); - - return false; - } - --static void mxc_jpeg_free_slot_data(struct mxc_jpeg_dev *jpeg) --{ -- /* free descriptor for decoding/encoding phase */ -- dma_free_coherent(jpeg->dev, sizeof(struct mxc_jpeg_desc), -- jpeg->slot_data.desc, -- jpeg->slot_data.desc_handle); -- -- /* free descriptor for encoder configuration phase / decoder DHT */ -- dma_free_coherent(jpeg->dev, sizeof(struct mxc_jpeg_desc), -- jpeg->slot_data.cfg_desc, -- jpeg->slot_data.cfg_desc_handle); -- -- /* free configuration stream */ -- dma_free_coherent(jpeg->dev, MXC_JPEG_MAX_CFG_STREAM, -- jpeg->slot_data.cfg_stream_vaddr, -- jpeg->slot_data.cfg_stream_handle); -- -- jpeg->slot_data.used = false; --} -- - static void mxc_jpeg_check_and_set_last_buffer(struct mxc_jpeg_ctx *ctx, - struct vb2_v4l2_buffer *src_buf, - struct vb2_v4l2_buffer *dst_buf) -@@ -1913,9 +1920,19 @@ static void mxc_jpeg_buf_queue(struct vb2_buffer *vb) - jpeg_src_buf = vb2_to_mxc_buf(vb); - jpeg_src_buf->jpeg_parse_error = false; - ret = mxc_jpeg_parse(ctx, vb); -- if (ret) -+ if (ret) { - jpeg_src_buf->jpeg_parse_error = true; - -+ /* -+ * if the capture queue is not setup, the device_run() won't be scheduled, -+ * need to drop the error buffer, so that the decoding can continue -+ */ -+ if (!vb2_is_streaming(v4l2_m2m_get_dst_vq(ctx->fh.m2m_ctx))) { -+ v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_ERROR); -+ return; -+ } -+ } -+ - end: - v4l2_m2m_buf_queue(ctx->fh.m2m_ctx, vbuf); - } -diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c -index 9745d6219a1667..cd6c52e9d158a7 100644 ---- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c -+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c -@@ -43,6 +43,7 @@ struct mxc_isi_m2m_ctx_queue_data { - struct v4l2_pix_format_mplane format; - const struct mxc_isi_format_info *info; - u32 sequence; -+ bool streaming; - }; - - struct mxc_isi_m2m_ctx { -@@ -486,15 +487,18 @@ static int mxc_isi_m2m_streamon(struct file *file, void *fh, - enum v4l2_buf_type type) - { - struct mxc_isi_m2m_ctx *ctx = to_isi_m2m_ctx(fh); -+ struct mxc_isi_m2m_ctx_queue_data *q = mxc_isi_m2m_ctx_qdata(ctx, type); - const struct v4l2_pix_format_mplane *out_pix = &ctx->queues.out.format; - const struct v4l2_pix_format_mplane *cap_pix = &ctx->queues.cap.format; - const struct mxc_isi_format_info *cap_info = ctx->queues.cap.info; - const struct mxc_isi_format_info *out_info = ctx->queues.out.info; - struct mxc_isi_m2m *m2m = ctx->m2m; - bool bypass; -- - int ret; - -+ if (q->streaming) -+ return 0; -+ - mutex_lock(&m2m->lock); - - if (m2m->usage_count == INT_MAX) { -@@ -547,6 +551,8 @@ static int mxc_isi_m2m_streamon(struct file *file, void *fh, - goto unchain; - } - -+ q->streaming = true; -+ - return 0; - - unchain: -@@ -569,10 +575,14 @@ static int mxc_isi_m2m_streamoff(struct file *file, void *fh, - enum v4l2_buf_type type) - { - struct mxc_isi_m2m_ctx *ctx = to_isi_m2m_ctx(fh); -+ struct mxc_isi_m2m_ctx_queue_data *q = mxc_isi_m2m_ctx_qdata(ctx, type); - struct mxc_isi_m2m *m2m = ctx->m2m; - - v4l2_m2m_ioctl_streamoff(file, fh, type); - -+ if (!q->streaming) -+ return 0; -+ - mutex_lock(&m2m->lock); - - /* -@@ -598,6 +608,8 @@ static int mxc_isi_m2m_streamoff(struct file *file, void *fh, - - mutex_unlock(&m2m->lock); - -+ q->streaming = false; -+ - return 0; - } - -diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c -index b570eb8c37568f..47ce3365451d37 100644 ---- a/drivers/media/platform/qcom/venus/core.c -+++ b/drivers/media/platform/qcom/venus/core.c -@@ -348,7 +348,7 @@ static int venus_probe(struct platform_device *pdev) - - ret = v4l2_device_register(dev, &core->v4l2_dev); - if (ret) -- goto err_core_deinit; -+ goto err_hfi_destroy; - - platform_set_drvdata(pdev, core); - -@@ -380,24 +380,24 @@ static int venus_probe(struct platform_device *pdev) - - ret = venus_enumerate_codecs(core, VIDC_SESSION_TYPE_DEC); - if (ret) -- goto err_venus_shutdown; -+ goto err_core_deinit; - - ret = venus_enumerate_codecs(core, VIDC_SESSION_TYPE_ENC); - if (ret) -- goto err_venus_shutdown; -+ goto err_core_deinit; - - ret = pm_runtime_put_sync(dev); - if (ret) { - pm_runtime_get_noresume(dev); -- goto err_dev_unregister; -+ goto err_core_deinit; - } - - venus_dbgfs_init(core); - - return 0; - --err_dev_unregister: -- v4l2_device_unregister(&core->v4l2_dev); -+err_core_deinit: -+ hfi_core_deinit(core, false); - err_venus_shutdown: - venus_shutdown(core); - err_firmware_deinit: -@@ -408,9 +408,9 @@ static int venus_probe(struct platform_device *pdev) - pm_runtime_put_noidle(dev); - pm_runtime_disable(dev); - pm_runtime_set_suspended(dev); -+ v4l2_device_unregister(&core->v4l2_dev); -+err_hfi_destroy: - hfi_destroy(core); --err_core_deinit: -- hfi_core_deinit(core, false); - err_core_put: - if (core->pm_ops->core_put) - core->pm_ops->core_put(core); -diff --git a/drivers/media/platform/ti/davinci/vpif.c b/drivers/media/platform/ti/davinci/vpif.c -index 63cdfed37bc9bc..fa9679abf7a483 100644 ---- a/drivers/media/platform/ti/davinci/vpif.c -+++ b/drivers/media/platform/ti/davinci/vpif.c -@@ -505,7 +505,7 @@ static int vpif_probe(struct platform_device *pdev) - pdev_display = kzalloc(sizeof(*pdev_display), GFP_KERNEL); - if (!pdev_display) { - ret = -ENOMEM; -- goto err_put_pdev_capture; -+ goto err_del_pdev_capture; - } - - pdev_display->name = "vpif_display"; -@@ -528,6 +528,8 @@ static int vpif_probe(struct platform_device *pdev) - - err_put_pdev_display: - platform_device_put(pdev_display); -+err_del_pdev_capture: -+ platform_device_del(pdev_capture); - err_put_pdev_capture: - platform_device_put(pdev_capture); - err_put_rpm: -diff --git a/drivers/media/platform/ti/omap3isp/ispccdc.c b/drivers/media/platform/ti/omap3isp/ispccdc.c -index 2fe42aa9180049..6eb387ea1dae10 100644 ---- a/drivers/media/platform/ti/omap3isp/ispccdc.c -+++ b/drivers/media/platform/ti/omap3isp/ispccdc.c -@@ -446,8 +446,8 @@ static int ccdc_lsc_config(struct isp_ccdc_device *ccdc, - if (ret < 0) - goto done; - -- dma_sync_sg_for_cpu(isp->dev, req->table.sgt.sgl, -- req->table.sgt.nents, DMA_TO_DEVICE); -+ dma_sync_sgtable_for_cpu(isp->dev, &req->table.sgt, -+ DMA_TO_DEVICE); - - if (copy_from_user(req->table.addr, config->lsc, - req->config.size)) { -@@ -455,8 +455,8 @@ static int ccdc_lsc_config(struct isp_ccdc_device *ccdc, - goto done; - } - -- dma_sync_sg_for_device(isp->dev, req->table.sgt.sgl, -- req->table.sgt.nents, DMA_TO_DEVICE); -+ dma_sync_sgtable_for_device(isp->dev, &req->table.sgt, -+ DMA_TO_DEVICE); - } - - spin_lock_irqsave(&ccdc->lsc.req_lock, flags); -diff --git a/drivers/media/platform/ti/omap3isp/ispstat.c b/drivers/media/platform/ti/omap3isp/ispstat.c -index 68cf68dbcace28..dc496ca9748a6c 100644 ---- a/drivers/media/platform/ti/omap3isp/ispstat.c -+++ b/drivers/media/platform/ti/omap3isp/ispstat.c -@@ -161,8 +161,7 @@ static void isp_stat_buf_sync_for_device(struct ispstat *stat, - if (ISP_STAT_USES_DMAENGINE(stat)) - return; - -- dma_sync_sg_for_device(stat->isp->dev, buf->sgt.sgl, -- buf->sgt.nents, DMA_FROM_DEVICE); -+ dma_sync_sgtable_for_device(stat->isp->dev, &buf->sgt, DMA_FROM_DEVICE); - } - - static void isp_stat_buf_sync_for_cpu(struct ispstat *stat, -@@ -171,8 +170,7 @@ static void isp_stat_buf_sync_for_cpu(struct ispstat *stat, - if (ISP_STAT_USES_DMAENGINE(stat)) - return; - -- dma_sync_sg_for_cpu(stat->isp->dev, buf->sgt.sgl, -- buf->sgt.nents, DMA_FROM_DEVICE); -+ dma_sync_sgtable_for_cpu(stat->isp->dev, &buf->sgt, DMA_FROM_DEVICE); - } - - static void isp_stat_buf_clear(struct ispstat *stat) -diff --git a/drivers/media/test-drivers/vidtv/vidtv_channel.c b/drivers/media/test-drivers/vidtv/vidtv_channel.c -index 7838e62727128f..f3023e91b3ebc8 100644 ---- a/drivers/media/test-drivers/vidtv/vidtv_channel.c -+++ b/drivers/media/test-drivers/vidtv/vidtv_channel.c -@@ -497,7 +497,7 @@ int vidtv_channel_si_init(struct vidtv_mux *m) - vidtv_psi_sdt_table_destroy(m->si.sdt); - free_pat: - vidtv_psi_pat_table_destroy(m->si.pat); -- return 0; -+ return -EINVAL; - } - - void vidtv_channel_si_destroy(struct vidtv_mux *m) -diff --git a/drivers/media/test-drivers/vivid/vivid-vid-cap.c b/drivers/media/test-drivers/vivid/vivid-vid-cap.c -index 9443dbb04699a3..0ab47fb8696bd0 100644 ---- a/drivers/media/test-drivers/vivid/vivid-vid-cap.c -+++ b/drivers/media/test-drivers/vivid/vivid-vid-cap.c -@@ -954,8 +954,8 @@ int vivid_vid_cap_s_selection(struct file *file, void *fh, struct v4l2_selection - if (dev->has_compose_cap) { - v4l2_rect_set_min_size(compose, &min_rect); - v4l2_rect_set_max_size(compose, &max_rect); -- v4l2_rect_map_inside(compose, &fmt); - } -+ v4l2_rect_map_inside(compose, &fmt); - dev->fmt_cap_rect = fmt; - tpg_s_buf_height(&dev->tpg, fmt.height); - } else if (dev->has_compose_cap) { -diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c -index 1d98d3465e28d4..ce52c936cb9310 100644 ---- a/drivers/media/usb/dvb-usb/cxusb.c -+++ b/drivers/media/usb/dvb-usb/cxusb.c -@@ -119,9 +119,8 @@ static void cxusb_gpio_tuner(struct dvb_usb_device *d, int onoff) - - o[0] = GPIO_TUNER; - o[1] = onoff; -- cxusb_ctrl_msg(d, CMD_GPIO_WRITE, o, 2, &i, 1); - -- if (i != 0x01) -+ if (!cxusb_ctrl_msg(d, CMD_GPIO_WRITE, o, 2, &i, 1) && i != 0x01) - dev_info(&d->udev->dev, "gpio_write failed.\n"); - - st->gpio_write_state[GPIO_TUNER] = onoff; -diff --git a/drivers/media/usb/gspca/stv06xx/stv06xx_hdcs.c b/drivers/media/usb/gspca/stv06xx/stv06xx_hdcs.c -index 5a47dcbf1c8e55..303b055fefea98 100644 ---- a/drivers/media/usb/gspca/stv06xx/stv06xx_hdcs.c -+++ b/drivers/media/usb/gspca/stv06xx/stv06xx_hdcs.c -@@ -520,12 +520,13 @@ static int hdcs_init(struct sd *sd) - static int hdcs_dump(struct sd *sd) - { - u16 reg, val; -+ int err = 0; - - pr_info("Dumping sensor registers:\n"); - -- for (reg = HDCS_IDENT; reg <= HDCS_ROWEXPH; reg++) { -- stv06xx_read_sensor(sd, reg, &val); -+ for (reg = HDCS_IDENT; reg <= HDCS_ROWEXPH && !err; reg++) { -+ err = stv06xx_read_sensor(sd, reg, &val); - pr_info("reg 0x%02x = 0x%02x\n", reg, val); - } -- return 0; -+ return (err < 0) ? err : 0; - } -diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c -index 5926a9dfb0b1f8..59e21746f55073 100644 ---- a/drivers/media/usb/uvc/uvc_ctrl.c -+++ b/drivers/media/usb/uvc/uvc_ctrl.c -@@ -1642,7 +1642,9 @@ static bool uvc_ctrl_xctrls_has_control(const struct v4l2_ext_control *xctrls, - } - - static void uvc_ctrl_send_events(struct uvc_fh *handle, -- const struct v4l2_ext_control *xctrls, unsigned int xctrls_count) -+ struct uvc_entity *entity, -+ const struct v4l2_ext_control *xctrls, -+ unsigned int xctrls_count) - { - struct uvc_control_mapping *mapping; - struct uvc_control *ctrl; -@@ -1653,6 +1655,9 @@ static void uvc_ctrl_send_events(struct uvc_fh *handle, - u32 changes = V4L2_EVENT_CTRL_CH_VALUE; - - ctrl = uvc_find_control(handle->chain, xctrls[i].id, &mapping); -+ if (ctrl->entity != entity) -+ continue; -+ - if (ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS) - /* Notification will be sent from an Interrupt event. */ - continue; -@@ -1783,12 +1788,17 @@ int uvc_ctrl_begin(struct uvc_video_chain *chain) - return mutex_lock_interruptible(&chain->ctrl_mutex) ? -ERESTARTSYS : 0; - } - -+/* -+ * Returns the number of uvc controls that have been correctly set, or a -+ * negative number if there has been an error. -+ */ - static int uvc_ctrl_commit_entity(struct uvc_device *dev, - struct uvc_fh *handle, - struct uvc_entity *entity, - int rollback, - struct uvc_control **err_ctrl) - { -+ unsigned int processed_ctrls = 0; - struct uvc_control *ctrl; - unsigned int i; - int ret; -@@ -1823,6 +1833,9 @@ static int uvc_ctrl_commit_entity(struct uvc_device *dev, - else - ret = 0; - -+ if (!ret) -+ processed_ctrls++; -+ - if (rollback || ret < 0) - memcpy(uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT), - uvc_ctrl_data(ctrl, UVC_CTRL_DATA_BACKUP), -@@ -1841,7 +1854,7 @@ static int uvc_ctrl_commit_entity(struct uvc_device *dev, - uvc_ctrl_set_handle(handle, ctrl, handle); - } - -- return 0; -+ return processed_ctrls; - } - - static int uvc_ctrl_find_ctrl_idx(struct uvc_entity *entity, -@@ -1883,11 +1896,13 @@ int __uvc_ctrl_commit(struct uvc_fh *handle, int rollback, - uvc_ctrl_find_ctrl_idx(entity, ctrls, - err_ctrl); - goto done; -+ } else if (ret > 0 && !rollback) { -+ uvc_ctrl_send_events(handle, entity, -+ ctrls->controls, ctrls->count); - } - } - -- if (!rollback) -- uvc_ctrl_send_events(handle, ctrls->controls, ctrls->count); -+ ret = 0; - done: - mutex_unlock(&chain->ctrl_mutex); - return ret; -diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c -index 02cfa12b9cb902..76f18557f37bd4 100644 ---- a/drivers/media/usb/uvc/uvc_driver.c -+++ b/drivers/media/usb/uvc/uvc_driver.c -@@ -2217,13 +2217,16 @@ static int uvc_probe(struct usb_interface *intf, - #endif - - /* Parse the Video Class control descriptor. */ -- if (uvc_parse_control(dev) < 0) { -+ ret = uvc_parse_control(dev); -+ if (ret < 0) { -+ ret = -ENODEV; - uvc_dbg(dev, PROBE, "Unable to parse UVC descriptors\n"); - goto error; - } - - /* Parse the associated GPIOs. */ -- if (uvc_gpio_parse(dev) < 0) { -+ ret = uvc_gpio_parse(dev); -+ if (ret < 0) { - uvc_dbg(dev, PROBE, "Unable to parse UVC GPIOs\n"); - goto error; - } -@@ -2249,24 +2252,32 @@ static int uvc_probe(struct usb_interface *intf, - } - - /* Register the V4L2 device. */ -- if (v4l2_device_register(&intf->dev, &dev->vdev) < 0) -+ ret = v4l2_device_register(&intf->dev, &dev->vdev); -+ if (ret < 0) - goto error; - - /* Scan the device for video chains. */ -- if (uvc_scan_device(dev) < 0) -+ if (uvc_scan_device(dev) < 0) { -+ ret = -ENODEV; - goto error; -+ } - - /* Initialize controls. */ -- if (uvc_ctrl_init_device(dev) < 0) -+ if (uvc_ctrl_init_device(dev) < 0) { -+ ret = -ENODEV; - goto error; -+ } - - /* Register video device nodes. */ -- if (uvc_register_chains(dev) < 0) -+ if (uvc_register_chains(dev) < 0) { -+ ret = -ENODEV; - goto error; -+ } - - #ifdef CONFIG_MEDIA_CONTROLLER - /* Register the media device node */ -- if (media_device_register(&dev->mdev) < 0) -+ ret = media_device_register(&dev->mdev); -+ if (ret < 0) - goto error; - #endif - /* Save our data pointer in the interface data. */ -@@ -2300,7 +2311,7 @@ static int uvc_probe(struct usb_interface *intf, - error: - uvc_unregister_video(dev); - kref_put(&dev->ref, uvc_delete); -- return -ENODEV; -+ return ret; - } - - static void uvc_disconnect(struct usb_interface *intf) -diff --git a/drivers/media/v4l2-core/v4l2-dev.c b/drivers/media/v4l2-core/v4l2-dev.c -index 77bbf276ae89df..c4d3d110c5007e 100644 ---- a/drivers/media/v4l2-core/v4l2-dev.c -+++ b/drivers/media/v4l2-core/v4l2-dev.c -@@ -1033,25 +1033,25 @@ int __video_register_device(struct video_device *vdev, - vdev->dev.class = &video_class; - vdev->dev.devt = MKDEV(VIDEO_MAJOR, vdev->minor); - vdev->dev.parent = vdev->dev_parent; -+ vdev->dev.release = v4l2_device_release; - dev_set_name(&vdev->dev, "%s%d", name_base, vdev->num); -+ -+ /* Increase v4l2_device refcount */ -+ v4l2_device_get(vdev->v4l2_dev); -+ - mutex_lock(&videodev_lock); - ret = device_register(&vdev->dev); - if (ret < 0) { - mutex_unlock(&videodev_lock); - pr_err("%s: device_register failed\n", __func__); -- goto cleanup; -+ put_device(&vdev->dev); -+ return ret; - } -- /* Register the release callback that will be called when the last -- reference to the device goes away. */ -- vdev->dev.release = v4l2_device_release; - - if (nr != -1 && nr != vdev->num && warn_if_nr_in_use) - pr_warn("%s: requested %s%d, got %s\n", __func__, - name_base, nr, video_device_node_name(vdev)); - -- /* Increase v4l2_device refcount */ -- v4l2_device_get(vdev->v4l2_dev); -- - /* Part 5: Register the entity. */ - ret = video_register_media_controller(vdev); - -diff --git a/drivers/mmc/core/card.h b/drivers/mmc/core/card.h -index 8476754b1b170c..fe0b2fa3bb89dc 100644 ---- a/drivers/mmc/core/card.h -+++ b/drivers/mmc/core/card.h -@@ -86,6 +86,7 @@ struct mmc_fixup { - #define CID_MANFID_MICRON 0x13 - #define CID_MANFID_SAMSUNG 0x15 - #define CID_MANFID_APACER 0x27 -+#define CID_MANFID_SWISSBIT 0x5D - #define CID_MANFID_KINGSTON 0x70 - #define CID_MANFID_HYNIX 0x90 - #define CID_MANFID_KINGSTON_SD 0x9F -@@ -291,4 +292,9 @@ static inline int mmc_card_broken_sd_poweroff_notify(const struct mmc_card *c) - return c->quirks & MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY; - } - -+static inline int mmc_card_no_uhs_ddr50_tuning(const struct mmc_card *c) -+{ -+ return c->quirks & MMC_QUIRK_NO_UHS_DDR50_TUNING; -+} -+ - #endif -diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h -index 89b512905be140..7f893bafaa607d 100644 ---- a/drivers/mmc/core/quirks.h -+++ b/drivers/mmc/core/quirks.h -@@ -34,6 +34,16 @@ static const struct mmc_fixup __maybe_unused mmc_sd_fixups[] = { - MMC_QUIRK_BROKEN_SD_CACHE | MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY, - EXT_CSD_REV_ANY), - -+ /* -+ * Swissbit series S46-u cards throw I/O errors during tuning requests -+ * after the initial tuning request expectedly times out. This has -+ * only been observed on cards manufactured on 01/2019 that are using -+ * Bay Trail host controllers. -+ */ -+ _FIXUP_EXT("0016G", CID_MANFID_SWISSBIT, 0x5342, 2019, 1, -+ 0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd, -+ MMC_QUIRK_NO_UHS_DDR50_TUNING, EXT_CSD_REV_ANY), -+ - END_FIXUP - }; - -diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c -index f02c3e5eb5c851..a06f3011e2b58c 100644 ---- a/drivers/mmc/core/sd.c -+++ b/drivers/mmc/core/sd.c -@@ -618,6 +618,29 @@ static int sd_set_current_limit(struct mmc_card *card, u8 *status) - return 0; - } - -+/* -+ * Determine if the card should tune or not. -+ */ -+static bool mmc_sd_use_tuning(struct mmc_card *card) -+{ -+ /* -+ * SPI mode doesn't define CMD19 and tuning is only valid for SDR50 and -+ * SDR104 mode SD-cards. Note that tuning is mandatory for SDR104. -+ */ -+ if (mmc_host_is_spi(card->host)) -+ return false; -+ -+ switch (card->host->ios.timing) { -+ case MMC_TIMING_UHS_SDR50: -+ case MMC_TIMING_UHS_SDR104: -+ return true; -+ case MMC_TIMING_UHS_DDR50: -+ return !mmc_card_no_uhs_ddr50_tuning(card); -+ } -+ -+ return false; -+} -+ - /* - * UHS-I specific initialization procedure - */ -@@ -661,14 +684,7 @@ static int mmc_sd_init_uhs_card(struct mmc_card *card) - if (err) - goto out; - -- /* -- * SPI mode doesn't define CMD19 and tuning is only valid for SDR50 and -- * SDR104 mode SD-cards. Note that tuning is mandatory for SDR104. -- */ -- if (!mmc_host_is_spi(card->host) && -- (card->host->ios.timing == MMC_TIMING_UHS_SDR50 || -- card->host->ios.timing == MMC_TIMING_UHS_DDR50 || -- card->host->ios.timing == MMC_TIMING_UHS_SDR104)) { -+ if (mmc_sd_use_tuning(card)) { - err = mmc_execute_tuning(card); - - /* -diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c -index b8cff9240b286c..beafca6ba0df4d 100644 ---- a/drivers/mtd/nand/raw/qcom_nandc.c -+++ b/drivers/mtd/nand/raw/qcom_nandc.c -@@ -2917,7 +2917,7 @@ static int qcom_param_page_type_exec(struct nand_chip *chip, const struct nand_ - write_reg_dma(nandc, NAND_DEV_CMD1, 1, NAND_BAM_NEXT_SGL); - } - -- nandc->buf_count = len; -+ nandc->buf_count = 512; - memset(nandc->data_buffer, 0xff, nandc->buf_count); - - config_nand_single_cw_page_read(chip, false, 0); -diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c -index 9abf38049d35f3..4469618ee60331 100644 ---- a/drivers/mtd/nand/raw/sunxi_nand.c -+++ b/drivers/mtd/nand/raw/sunxi_nand.c -@@ -817,6 +817,7 @@ static int sunxi_nfc_hw_ecc_read_chunk(struct nand_chip *nand, - if (ret) - return ret; - -+ sunxi_nfc_randomizer_config(nand, page, false); - sunxi_nfc_randomizer_enable(nand); - writel(NFC_DATA_TRANS | NFC_DATA_SWAP_METHOD | NFC_ECC_OP, - nfc->regs + NFC_REG_CMD); -@@ -1049,6 +1050,7 @@ static int sunxi_nfc_hw_ecc_write_chunk(struct nand_chip *nand, - if (ret) - return ret; - -+ sunxi_nfc_randomizer_config(nand, page, false); - sunxi_nfc_randomizer_enable(nand); - sunxi_nfc_hw_ecc_set_prot_oob_bytes(nand, oob, 0, bbm, page); - -diff --git a/drivers/net/can/m_can/tcan4x5x-core.c b/drivers/net/can/m_can/tcan4x5x-core.c -index ae8c42f5debd4d..4d440ecfc211c1 100644 ---- a/drivers/net/can/m_can/tcan4x5x-core.c -+++ b/drivers/net/can/m_can/tcan4x5x-core.c -@@ -385,10 +385,11 @@ static int tcan4x5x_can_probe(struct spi_device *spi) - priv = cdev_to_priv(mcan_class); - - priv->power = devm_regulator_get_optional(&spi->dev, "vsup"); -- if (PTR_ERR(priv->power) == -EPROBE_DEFER) { -- ret = -EPROBE_DEFER; -- goto out_m_can_class_free_dev; -- } else { -+ if (IS_ERR(priv->power)) { -+ if (PTR_ERR(priv->power) == -EPROBE_DEFER) { -+ ret = -EPROBE_DEFER; -+ goto out_m_can_class_free_dev; -+ } - priv->power = NULL; - } - -diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_main.c b/drivers/net/ethernet/aquantia/atlantic/aq_main.c -index 0b2a52199914b7..75d436c9069689 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/aq_main.c -+++ b/drivers/net/ethernet/aquantia/atlantic/aq_main.c -@@ -123,7 +123,6 @@ static netdev_tx_t aq_ndev_start_xmit(struct sk_buff *skb, struct net_device *nd - } - #endif - -- skb_tx_timestamp(skb); - return aq_nic_xmit(aq_nic, skb); - } - -diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c -index c9b0d57696a487..07392174f6437e 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c -+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c -@@ -898,6 +898,8 @@ int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb) - - frags = aq_nic_map_skb(self, skb, ring); - -+ skb_tx_timestamp(skb); -+ - if (likely(frags)) { - err = self->aq_hw_ops->hw_ring_tx_xmit(self->aq_hw, - ring, frags); -diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c -index 6f45f4d9fba71f..534e7f7bca4c2f 100644 ---- a/drivers/net/ethernet/cadence/macb_main.c -+++ b/drivers/net/ethernet/cadence/macb_main.c -@@ -5070,7 +5070,11 @@ static int macb_probe(struct platform_device *pdev) - - #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT - if (GEM_BFEXT(DAW64, gem_readl(bp, DCFG6))) { -- dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(44)); -+ err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(44)); -+ if (err) { -+ dev_err(&pdev->dev, "failed to set DMA mask\n"); -+ goto err_out_free_netdev; -+ } - bp->hw_dma_cap |= HW_DMA_CAP_64B; - } - #endif -diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c -index 5af98fba74803e..fce2ff1e1d8348 100644 ---- a/drivers/net/ethernet/cortina/gemini.c -+++ b/drivers/net/ethernet/cortina/gemini.c -@@ -1148,6 +1148,7 @@ static int gmac_map_tx_bufs(struct net_device *netdev, struct sk_buff *skb, - struct gmac_txdesc *txd; - skb_frag_t *skb_frag; - dma_addr_t mapping; -+ bool tcp = false; - void *buffer; - u16 mss; - int ret; -@@ -1155,6 +1156,13 @@ static int gmac_map_tx_bufs(struct net_device *netdev, struct sk_buff *skb, - word1 = skb->len; - word3 = SOF_BIT; - -+ /* Determine if we are doing TCP */ -+ if (skb->protocol == htons(ETH_P_IP)) -+ tcp = (ip_hdr(skb)->protocol == IPPROTO_TCP); -+ else -+ /* IPv6 */ -+ tcp = (ipv6_hdr(skb)->nexthdr == IPPROTO_TCP); -+ - mss = skb_shinfo(skb)->gso_size; - if (mss) { - /* This means we are dealing with TCP and skb->len is the -@@ -1167,8 +1175,26 @@ static int gmac_map_tx_bufs(struct net_device *netdev, struct sk_buff *skb, - mss, skb->len); - word1 |= TSS_MTU_ENABLE_BIT; - word3 |= mss; -+ } else if (tcp) { -+ /* Even if we are not using TSO, use the hardware offloader -+ * for transferring the TCP frame: this hardware has partial -+ * TCP awareness (called TOE - TCP Offload Engine) and will -+ * according to the datasheet put packets belonging to the -+ * same TCP connection in the same queue for the TOE/TSO -+ * engine to process. The engine will deal with chopping -+ * up frames that exceed ETH_DATA_LEN which the -+ * checksumming engine cannot handle (see below) into -+ * manageable chunks. It flawlessly deals with quite big -+ * frames and frames containing custom DSA EtherTypes. -+ */ -+ mss = netdev->mtu + skb_tcp_all_headers(skb); -+ mss = min(mss, skb->len); -+ netdev_dbg(netdev, "TOE/TSO len %04x mtu %04x mss %04x\n", -+ skb->len, netdev->mtu, mss); -+ word1 |= TSS_MTU_ENABLE_BIT; -+ word3 |= mss; - } else if (skb->len >= ETH_FRAME_LEN) { -- /* Hardware offloaded checksumming isn't working on frames -+ /* Hardware offloaded checksumming isn't working on non-TCP frames - * bigger than 1514 bytes. A hypothesis about this is that the - * checksum buffer is only 1518 bytes, so when the frames get - * bigger they get truncated, or the last few bytes get -@@ -1185,21 +1211,16 @@ static int gmac_map_tx_bufs(struct net_device *netdev, struct sk_buff *skb, - } - - if (skb->ip_summed == CHECKSUM_PARTIAL) { -- int tcp = 0; -- - /* We do not switch off the checksumming on non TCP/UDP - * frames: as is shown from tests, the checksumming engine - * is smart enough to see that a frame is not actually TCP - * or UDP and then just pass it through without any changes - * to the frame. - */ -- if (skb->protocol == htons(ETH_P_IP)) { -+ if (skb->protocol == htons(ETH_P_IP)) - word1 |= TSS_IP_CHKSUM_BIT; -- tcp = ip_hdr(skb)->protocol == IPPROTO_TCP; -- } else { /* IPv6 */ -+ else - word1 |= TSS_IPV6_ENABLE_BIT; -- tcp = ipv6_hdr(skb)->nexthdr == IPPROTO_TCP; -- } - - word1 |= tcp ? TSS_TCP_CHKSUM_BIT : TSS_UDP_CHKSUM_BIT; - } -diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c -index ce46f3ac3b5a18..fad5a72d3b1671 100644 ---- a/drivers/net/ethernet/dlink/dl2k.c -+++ b/drivers/net/ethernet/dlink/dl2k.c -@@ -146,6 +146,8 @@ rio_probe1 (struct pci_dev *pdev, const struct pci_device_id *ent) - np->ioaddr = ioaddr; - np->chip_id = chip_idx; - np->pdev = pdev; -+ -+ spin_lock_init(&np->stats_lock); - spin_lock_init (&np->tx_lock); - spin_lock_init (&np->rx_lock); - -@@ -866,7 +868,6 @@ tx_error (struct net_device *dev, int tx_status) - frame_id = (tx_status & 0xffff0000); - printk (KERN_ERR "%s: Transmit error, TxStatus %4.4x, FrameId %d.\n", - dev->name, tx_status, frame_id); -- dev->stats.tx_errors++; - /* Ttransmit Underrun */ - if (tx_status & 0x10) { - dev->stats.tx_fifo_errors++; -@@ -903,9 +904,15 @@ tx_error (struct net_device *dev, int tx_status) - rio_set_led_mode(dev); - /* Let TxStartThresh stay default value */ - } -+ -+ spin_lock(&np->stats_lock); - /* Maximum Collisions */ - if (tx_status & 0x08) - dev->stats.collisions++; -+ -+ dev->stats.tx_errors++; -+ spin_unlock(&np->stats_lock); -+ - /* Restart the Tx */ - dw32(MACCtrl, dr16(MACCtrl) | TxEnable); - } -@@ -1074,7 +1081,9 @@ get_stats (struct net_device *dev) - int i; - #endif - unsigned int stat_reg; -+ unsigned long flags; - -+ spin_lock_irqsave(&np->stats_lock, flags); - /* All statistics registers need to be acknowledged, - else statistic overflow could cause problems */ - -@@ -1124,6 +1133,9 @@ get_stats (struct net_device *dev) - dr16(TCPCheckSumErrors); - dr16(UDPCheckSumErrors); - dr16(IPCheckSumErrors); -+ -+ spin_unlock_irqrestore(&np->stats_lock, flags); -+ - return &dev->stats; - } - -diff --git a/drivers/net/ethernet/dlink/dl2k.h b/drivers/net/ethernet/dlink/dl2k.h -index 0e33e2eaae9606..56aff2f0bdbfa0 100644 ---- a/drivers/net/ethernet/dlink/dl2k.h -+++ b/drivers/net/ethernet/dlink/dl2k.h -@@ -372,6 +372,8 @@ struct netdev_private { - struct pci_dev *pdev; - void __iomem *ioaddr; - void __iomem *eeprom_addr; -+ // To ensure synchronization when stats are updated. -+ spinlock_t stats_lock; - spinlock_t tx_lock; - spinlock_t rx_lock; - unsigned int rx_buf_sz; /* Based on MTU+slack. */ -diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c -index 51b8377edd1d04..a89aa4ac0a064a 100644 ---- a/drivers/net/ethernet/emulex/benet/be_cmds.c -+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c -@@ -1609,7 +1609,7 @@ int be_cmd_get_stats(struct be_adapter *adapter, struct be_dma_mem *nonemb_cmd) - /* version 1 of the cmd is not supported only by BE2 */ - if (BE2_chip(adapter)) - hdr->version = 0; -- if (BE3_chip(adapter) || lancer_chip(adapter)) -+ else if (BE3_chip(adapter) || lancer_chip(adapter)) - hdr->version = 1; - else - hdr->version = 2; -diff --git a/drivers/net/ethernet/faraday/Kconfig b/drivers/net/ethernet/faraday/Kconfig -index c699bd6bcbb938..474073c7f94d74 100644 ---- a/drivers/net/ethernet/faraday/Kconfig -+++ b/drivers/net/ethernet/faraday/Kconfig -@@ -31,6 +31,7 @@ config FTGMAC100 - depends on ARM || COMPILE_TEST - depends on !64BIT || BROKEN - select PHYLIB -+ select FIXED_PHY - select MDIO_ASPEED if MACH_ASPEED_G6 - select CRC32 - help -diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c -index 721c098f2bb1b2..7e4fea0e186b6e 100644 ---- a/drivers/net/ethernet/intel/e1000e/netdev.c -+++ b/drivers/net/ethernet/intel/e1000e/netdev.c -@@ -3540,9 +3540,6 @@ s32 e1000e_get_base_timinca(struct e1000_adapter *adapter, u32 *timinca) - case e1000_pch_cnp: - case e1000_pch_tgp: - case e1000_pch_adp: -- case e1000_pch_mtp: -- case e1000_pch_lnp: -- case e1000_pch_ptp: - case e1000_pch_nvp: - if (er32(TSYNCRXCTL) & E1000_TSYNCRXCTL_SYSCFI) { - /* Stable 24MHz frequency */ -@@ -3558,6 +3555,17 @@ s32 e1000e_get_base_timinca(struct e1000_adapter *adapter, u32 *timinca) - adapter->cc.shift = shift; - } - break; -+ case e1000_pch_mtp: -+ case e1000_pch_lnp: -+ case e1000_pch_ptp: -+ /* System firmware can misreport this value, so set it to a -+ * stable 38400KHz frequency. -+ */ -+ incperiod = INCPERIOD_38400KHZ; -+ incvalue = INCVALUE_38400KHZ; -+ shift = INCVALUE_SHIFT_38400KHZ; -+ adapter->cc.shift = shift; -+ break; - case e1000_82574: - case e1000_82583: - /* Stable 25MHz frequency */ -diff --git a/drivers/net/ethernet/intel/e1000e/ptp.c b/drivers/net/ethernet/intel/e1000e/ptp.c -index bbcfd529399b0f..d039dea48ca324 100644 ---- a/drivers/net/ethernet/intel/e1000e/ptp.c -+++ b/drivers/net/ethernet/intel/e1000e/ptp.c -@@ -294,15 +294,17 @@ void e1000e_ptp_init(struct e1000_adapter *adapter) - case e1000_pch_cnp: - case e1000_pch_tgp: - case e1000_pch_adp: -- case e1000_pch_mtp: -- case e1000_pch_lnp: -- case e1000_pch_ptp: - case e1000_pch_nvp: - if (er32(TSYNCRXCTL) & E1000_TSYNCRXCTL_SYSCFI) - adapter->ptp_clock_info.max_adj = MAX_PPB_24MHZ; - else - adapter->ptp_clock_info.max_adj = MAX_PPB_38400KHZ; - break; -+ case e1000_pch_mtp: -+ case e1000_pch_lnp: -+ case e1000_pch_ptp: -+ adapter->ptp_clock_info.max_adj = MAX_PPB_38400KHZ; -+ break; - case e1000_82574: - case e1000_82583: - adapter->ptp_clock_info.max_adj = MAX_PPB_25MHZ; -diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c -index 4d7caa11997199..5d46a8e5376dac 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_common.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_common.c -@@ -1067,10 +1067,11 @@ int i40e_pf_reset(struct i40e_hw *hw) - void i40e_clear_hw(struct i40e_hw *hw) - { - u32 num_queues, base_queue; -- u32 num_pf_int; -- u32 num_vf_int; -+ s32 num_pf_int; -+ s32 num_vf_int; - u32 num_vfs; -- u32 i, j; -+ s32 i; -+ u32 j; - u32 val; - u32 eol = 0x7ff; - -diff --git a/drivers/net/ethernet/intel/ice/ice_arfs.c b/drivers/net/ethernet/intel/ice/ice_arfs.c -index d7e0116f67737b..7036070bc0208b 100644 ---- a/drivers/net/ethernet/intel/ice/ice_arfs.c -+++ b/drivers/net/ethernet/intel/ice/ice_arfs.c -@@ -376,6 +376,50 @@ ice_arfs_is_perfect_flow_set(struct ice_hw *hw, __be16 l3_proto, u8 l4_proto) - return false; - } - -+/** -+ * ice_arfs_cmp - Check if aRFS filter matches this flow. -+ * @fltr_info: filter info of the saved ARFS entry. -+ * @fk: flow dissector keys. -+ * @n_proto: One of htons(ETH_P_IP) or htons(ETH_P_IPV6). -+ * @ip_proto: One of IPPROTO_TCP or IPPROTO_UDP. -+ * -+ * Since this function assumes limited values for n_proto and ip_proto, it -+ * is meant to be called only from ice_rx_flow_steer(). -+ * -+ * Return: -+ * * true - fltr_info refers to the same flow as fk. -+ * * false - fltr_info and fk refer to different flows. -+ */ -+static bool -+ice_arfs_cmp(const struct ice_fdir_fltr *fltr_info, const struct flow_keys *fk, -+ __be16 n_proto, u8 ip_proto) -+{ -+ /* Determine if the filter is for IPv4 or IPv6 based on flow_type, -+ * which is one of ICE_FLTR_PTYPE_NONF_IPV{4,6}_{TCP,UDP}. -+ */ -+ bool is_v4 = fltr_info->flow_type == ICE_FLTR_PTYPE_NONF_IPV4_TCP || -+ fltr_info->flow_type == ICE_FLTR_PTYPE_NONF_IPV4_UDP; -+ -+ /* Following checks are arranged in the quickest and most discriminative -+ * fields first for early failure. -+ */ -+ if (is_v4) -+ return n_proto == htons(ETH_P_IP) && -+ fltr_info->ip.v4.src_port == fk->ports.src && -+ fltr_info->ip.v4.dst_port == fk->ports.dst && -+ fltr_info->ip.v4.src_ip == fk->addrs.v4addrs.src && -+ fltr_info->ip.v4.dst_ip == fk->addrs.v4addrs.dst && -+ fltr_info->ip.v4.proto == ip_proto; -+ -+ return fltr_info->ip.v6.src_port == fk->ports.src && -+ fltr_info->ip.v6.dst_port == fk->ports.dst && -+ fltr_info->ip.v6.proto == ip_proto && -+ !memcmp(&fltr_info->ip.v6.src_ip, &fk->addrs.v6addrs.src, -+ sizeof(struct in6_addr)) && -+ !memcmp(&fltr_info->ip.v6.dst_ip, &fk->addrs.v6addrs.dst, -+ sizeof(struct in6_addr)); -+} -+ - /** - * ice_rx_flow_steer - steer the Rx flow to where application is being run - * @netdev: ptr to the netdev being adjusted -@@ -447,6 +491,10 @@ ice_rx_flow_steer(struct net_device *netdev, const struct sk_buff *skb, - continue; - - fltr_info = &arfs_entry->fltr_info; -+ -+ if (!ice_arfs_cmp(fltr_info, &fk, n_proto, ip_proto)) -+ continue; -+ - ret = fltr_info->fltr_id; - - if (fltr_info->q_index == rxq_idx || -diff --git a/drivers/net/ethernet/intel/ice/ice_switch.c b/drivers/net/ethernet/intel/ice/ice_switch.c -index 19f730a68fa21c..ac004ef1d724d3 100644 ---- a/drivers/net/ethernet/intel/ice/ice_switch.c -+++ b/drivers/net/ethernet/intel/ice/ice_switch.c -@@ -3024,7 +3024,7 @@ ice_add_update_vsi_list(struct ice_hw *hw, - u16 vsi_handle_arr[2]; - - /* A rule already exists with the new VSI being added */ -- if (cur_fltr->fwd_id.hw_vsi_id == new_fltr->fwd_id.hw_vsi_id) -+ if (cur_fltr->vsi_handle == new_fltr->vsi_handle) - return -EEXIST; - - vsi_handle_arr[0] = cur_fltr->vsi_handle; -@@ -5991,7 +5991,7 @@ ice_adv_add_update_vsi_list(struct ice_hw *hw, - - /* A rule already exists with the new VSI being added */ - if (test_bit(vsi_handle, m_entry->vsi_list_info->vsi_map)) -- return 0; -+ return -EEXIST; - - /* Update the previously created VSI list set with - * the new VSI ID passed in -diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c -index 7417087b6db597..a2807a1e4f4a62 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c -+++ b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c -@@ -352,9 +352,12 @@ int cn10k_free_matchall_ipolicer(struct otx2_nic *pfvf) - mutex_lock(&pfvf->mbox.lock); - - /* Remove RQ's policer mapping */ -- for (qidx = 0; qidx < hw->rx_queues; qidx++) -- cn10k_map_unmap_rq_policer(pfvf, qidx, -- hw->matchall_ipolicer, false); -+ for (qidx = 0; qidx < hw->rx_queues; qidx++) { -+ rc = cn10k_map_unmap_rq_policer(pfvf, qidx, hw->matchall_ipolicer, false); -+ if (rc) -+ dev_warn(pfvf->dev, "Failed to unmap RQ %d's policer (error %d).", -+ qidx, rc); -+ } - - rc = cn10k_free_leaf_profile(pfvf, hw->matchall_ipolicer); - -diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c -index 164a13272faa2f..07dced3c2b1c00 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c -@@ -1916,6 +1916,7 @@ static int mlx4_en_get_ts_info(struct net_device *dev, - if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS) { - info->so_timestamping |= - SOF_TIMESTAMPING_TX_HARDWARE | -+ SOF_TIMESTAMPING_TX_SOFTWARE | - SOF_TIMESTAMPING_RX_HARDWARE | - SOF_TIMESTAMPING_RAW_HARDWARE; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c -index 21753f32786850..06b5265b6e6db2 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c -@@ -444,19 +444,22 @@ int mlx5_query_nic_vport_node_guid(struct mlx5_core_dev *mdev, u64 *node_guid) - { - u32 *out; - int outlen = MLX5_ST_SZ_BYTES(query_nic_vport_context_out); -+ int err; - - out = kvzalloc(outlen, GFP_KERNEL); - if (!out) - return -ENOMEM; - -- mlx5_query_nic_vport_context(mdev, 0, out); -+ err = mlx5_query_nic_vport_context(mdev, 0, out); -+ if (err) -+ goto out; - - *node_guid = MLX5_GET64(query_nic_vport_context_out, out, - nic_vport_context.node_guid); -- -+out: - kvfree(out); - -- return 0; -+ return err; - } - EXPORT_SYMBOL_GPL(mlx5_query_nic_vport_node_guid); - -@@ -498,19 +501,22 @@ int mlx5_query_nic_vport_qkey_viol_cntr(struct mlx5_core_dev *mdev, - { - u32 *out; - int outlen = MLX5_ST_SZ_BYTES(query_nic_vport_context_out); -+ int err; - - out = kvzalloc(outlen, GFP_KERNEL); - if (!out) - return -ENOMEM; - -- mlx5_query_nic_vport_context(mdev, 0, out); -+ err = mlx5_query_nic_vport_context(mdev, 0, out); -+ if (err) -+ goto out; - - *qkey_viol_cntr = MLX5_GET(query_nic_vport_context_out, out, - nic_vport_context.qkey_violation_counter); -- -+out: - kvfree(out); - -- return 0; -+ return err; - } - EXPORT_SYMBOL_GPL(mlx5_query_nic_vport_qkey_viol_cntr); - -diff --git a/drivers/net/ethernet/microchip/lan743x_ethtool.c b/drivers/net/ethernet/microchip/lan743x_ethtool.c -index 72b3092d35f712..39a58c3578a028 100644 ---- a/drivers/net/ethernet/microchip/lan743x_ethtool.c -+++ b/drivers/net/ethernet/microchip/lan743x_ethtool.c -@@ -18,6 +18,8 @@ - #define EEPROM_MAC_OFFSET (0x01) - #define MAX_EEPROM_SIZE (512) - #define MAX_OTP_SIZE (1024) -+#define MAX_HS_OTP_SIZE (8 * 1024) -+#define MAX_HS_EEPROM_SIZE (64 * 1024) - #define OTP_INDICATOR_1 (0xF3) - #define OTP_INDICATOR_2 (0xF7) - -@@ -272,6 +274,9 @@ static int lan743x_hs_otp_read(struct lan743x_adapter *adapter, u32 offset, - int ret; - int i; - -+ if (offset + length > MAX_HS_OTP_SIZE) -+ return -EINVAL; -+ - ret = lan743x_hs_syslock_acquire(adapter, LOCK_TIMEOUT_MAX_CNT); - if (ret < 0) - return ret; -@@ -320,6 +325,9 @@ static int lan743x_hs_otp_write(struct lan743x_adapter *adapter, u32 offset, - int ret; - int i; - -+ if (offset + length > MAX_HS_OTP_SIZE) -+ return -EINVAL; -+ - ret = lan743x_hs_syslock_acquire(adapter, LOCK_TIMEOUT_MAX_CNT); - if (ret < 0) - return ret; -@@ -497,6 +505,9 @@ static int lan743x_hs_eeprom_read(struct lan743x_adapter *adapter, - u32 val; - int i; - -+ if (offset + length > MAX_HS_EEPROM_SIZE) -+ return -EINVAL; -+ - retval = lan743x_hs_syslock_acquire(adapter, LOCK_TIMEOUT_MAX_CNT); - if (retval < 0) - return retval; -@@ -539,6 +550,9 @@ static int lan743x_hs_eeprom_write(struct lan743x_adapter *adapter, - u32 val; - int i; - -+ if (offset + length > MAX_HS_EEPROM_SIZE) -+ return -EINVAL; -+ - retval = lan743x_hs_syslock_acquire(adapter, LOCK_TIMEOUT_MAX_CNT); - if (retval < 0) - return retval; -@@ -604,9 +618,9 @@ static int lan743x_ethtool_get_eeprom_len(struct net_device *netdev) - struct lan743x_adapter *adapter = netdev_priv(netdev); - - if (adapter->flags & LAN743X_ADAPTER_FLAG_OTP) -- return MAX_OTP_SIZE; -+ return adapter->is_pci11x1x ? MAX_HS_OTP_SIZE : MAX_OTP_SIZE; - -- return MAX_EEPROM_SIZE; -+ return adapter->is_pci11x1x ? MAX_HS_EEPROM_SIZE : MAX_EEPROM_SIZE; - } - - static int lan743x_ethtool_get_eeprom(struct net_device *netdev, -diff --git a/drivers/net/ethernet/microchip/lan743x_ptp.c b/drivers/net/ethernet/microchip/lan743x_ptp.c -index 39e1066ecd5ff0..47f2531198f62a 100644 ---- a/drivers/net/ethernet/microchip/lan743x_ptp.c -+++ b/drivers/net/ethernet/microchip/lan743x_ptp.c -@@ -58,7 +58,7 @@ int lan743x_gpio_init(struct lan743x_adapter *adapter) - static void lan743x_ptp_wait_till_cmd_done(struct lan743x_adapter *adapter, - u32 bit_mask) - { -- int timeout = 1000; -+ int timeout = PTP_CMD_CTL_TIMEOUT_CNT; - u32 data = 0; - - while (timeout && -diff --git a/drivers/net/ethernet/microchip/lan743x_ptp.h b/drivers/net/ethernet/microchip/lan743x_ptp.h -index e26d4eff713361..225e8232474d73 100644 ---- a/drivers/net/ethernet/microchip/lan743x_ptp.h -+++ b/drivers/net/ethernet/microchip/lan743x_ptp.h -@@ -18,9 +18,10 @@ - */ - #define LAN743X_PTP_N_EVENT_CHAN 2 - #define LAN743X_PTP_N_PEROUT LAN743X_PTP_N_EVENT_CHAN --#define LAN743X_PTP_N_EXTTS 4 --#define LAN743X_PTP_N_PPS 0 - #define PCI11X1X_PTP_IO_MAX_CHANNELS 8 -+#define LAN743X_PTP_N_EXTTS PCI11X1X_PTP_IO_MAX_CHANNELS -+#define LAN743X_PTP_N_PPS 0 -+#define PTP_CMD_CTL_TIMEOUT_CNT 50 - - struct lan743x_adapter; - -diff --git a/drivers/net/ethernet/pensando/ionic/ionic_main.c b/drivers/net/ethernet/pensando/ionic/ionic_main.c -index 3ca6893d1bf26a..2869922cffe2e1 100644 ---- a/drivers/net/ethernet/pensando/ionic/ionic_main.c -+++ b/drivers/net/ethernet/pensando/ionic/ionic_main.c -@@ -464,9 +464,9 @@ static int __ionic_dev_cmd_wait(struct ionic *ionic, unsigned long max_seconds, - unsigned long start_time; - unsigned long max_wait; - unsigned long duration; -- int done = 0; - bool fw_up; - int opcode; -+ bool done; - int err; - - /* Wait for dev cmd to complete, retrying if we get EAGAIN, -@@ -474,6 +474,7 @@ static int __ionic_dev_cmd_wait(struct ionic *ionic, unsigned long max_seconds, - */ - max_wait = jiffies + (max_seconds * HZ); - try_again: -+ done = false; - opcode = idev->opcode; - start_time = jiffies; - for (fw_up = ionic_is_fw_running(idev); -diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c -index c379a958380ce0..28cc23736a69bb 100644 ---- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c -+++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c -@@ -2089,7 +2089,9 @@ static int am65_cpsw_nuss_init_slave_ports(struct am65_cpsw_common *common) - goto of_node_put; - - ret = of_get_mac_address(port_np, port->slave.mac_addr); -- if (ret) { -+ if (ret == -EPROBE_DEFER) { -+ goto of_node_put; -+ } else if (ret) { - am65_cpsw_am654_get_efuse_macid(port_np, - port->port_id, - port->slave.mac_addr); -@@ -2949,6 +2951,16 @@ static int am65_cpsw_nuss_probe(struct platform_device *pdev) - return ret; - } - -+ am65_cpsw_nuss_get_ver(common); -+ -+ ret = am65_cpsw_nuss_init_host_p(common); -+ if (ret) -+ goto err_pm_clear; -+ -+ ret = am65_cpsw_nuss_init_slave_ports(common); -+ if (ret) -+ goto err_pm_clear; -+ - node = of_get_child_by_name(dev->of_node, "mdio"); - if (!node) { - dev_warn(dev, "MDIO node not found\n"); -@@ -2965,16 +2977,6 @@ static int am65_cpsw_nuss_probe(struct platform_device *pdev) - } - of_node_put(node); - -- am65_cpsw_nuss_get_ver(common); -- -- ret = am65_cpsw_nuss_init_host_p(common); -- if (ret) -- goto err_of_clear; -- -- ret = am65_cpsw_nuss_init_slave_ports(common); -- if (ret) -- goto err_of_clear; -- - /* init common data */ - ale_params.dev = dev; - ale_params.ale_ageout = AM65_CPSW_ALE_AGEOUT_DEFAULT; -diff --git a/drivers/net/ethernet/vertexcom/mse102x.c b/drivers/net/ethernet/vertexcom/mse102x.c -index 060a566bc6aae1..c902f8761d5d4d 100644 ---- a/drivers/net/ethernet/vertexcom/mse102x.c -+++ b/drivers/net/ethernet/vertexcom/mse102x.c -@@ -306,7 +306,7 @@ static void mse102x_dump_packet(const char *msg, int len, const char *data) - data, len, true); - } - --static void mse102x_rx_pkt_spi(struct mse102x_net *mse) -+static irqreturn_t mse102x_rx_pkt_spi(struct mse102x_net *mse) - { - struct sk_buff *skb; - unsigned int rxalign; -@@ -327,7 +327,7 @@ static void mse102x_rx_pkt_spi(struct mse102x_net *mse) - mse102x_tx_cmd_spi(mse, CMD_CTR); - ret = mse102x_rx_cmd_spi(mse, (u8 *)&rx); - if (ret) -- return; -+ return IRQ_NONE; - - cmd_resp = be16_to_cpu(rx); - if ((cmd_resp & CMD_MASK) != CMD_RTS) { -@@ -360,7 +360,7 @@ static void mse102x_rx_pkt_spi(struct mse102x_net *mse) - rxalign = ALIGN(rxlen + DET_SOF_LEN + DET_DFT_LEN, 4); - skb = netdev_alloc_skb_ip_align(mse->ndev, rxalign); - if (!skb) -- return; -+ return IRQ_NONE; - - /* 2 bytes Start of frame (before ethernet header) - * 2 bytes Data frame tail (after ethernet frame) -@@ -370,7 +370,7 @@ static void mse102x_rx_pkt_spi(struct mse102x_net *mse) - if (mse102x_rx_frame_spi(mse, rxpkt, rxlen, drop)) { - mse->ndev->stats.rx_errors++; - dev_kfree_skb(skb); -- return; -+ return IRQ_HANDLED; - } - - if (netif_msg_pktdata(mse)) -@@ -381,6 +381,8 @@ static void mse102x_rx_pkt_spi(struct mse102x_net *mse) - - mse->ndev->stats.rx_packets++; - mse->ndev->stats.rx_bytes += rxlen; -+ -+ return IRQ_HANDLED; - } - - static int mse102x_tx_pkt_spi(struct mse102x_net *mse, struct sk_buff *txb, -@@ -512,12 +514,13 @@ static irqreturn_t mse102x_irq(int irq, void *_mse) - { - struct mse102x_net *mse = _mse; - struct mse102x_net_spi *mses = to_mse102x_spi(mse); -+ irqreturn_t ret; - - mutex_lock(&mses->lock); -- mse102x_rx_pkt_spi(mse); -+ ret = mse102x_rx_pkt_spi(mse); - mutex_unlock(&mses->lock); - -- return IRQ_HANDLED; -+ return ret; - } - - static int mse102x_net_open(struct net_device *ndev) -diff --git a/drivers/net/usb/asix.h b/drivers/net/usb/asix.h -index 74162190bccc10..8531b804021aa4 100644 ---- a/drivers/net/usb/asix.h -+++ b/drivers/net/usb/asix.h -@@ -224,7 +224,6 @@ int asix_write_rx_ctl(struct usbnet *dev, u16 mode, int in_pm); - - u16 asix_read_medium_status(struct usbnet *dev, int in_pm); - int asix_write_medium_mode(struct usbnet *dev, u16 mode, int in_pm); --void asix_adjust_link(struct net_device *netdev); - - int asix_write_gpio(struct usbnet *dev, u16 value, int sleep, int in_pm); - -diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c -index 72ffc89b477ad8..7fd763917ae2cf 100644 ---- a/drivers/net/usb/asix_common.c -+++ b/drivers/net/usb/asix_common.c -@@ -414,28 +414,6 @@ int asix_write_medium_mode(struct usbnet *dev, u16 mode, int in_pm) - return ret; - } - --/* set MAC link settings according to information from phylib */ --void asix_adjust_link(struct net_device *netdev) --{ -- struct phy_device *phydev = netdev->phydev; -- struct usbnet *dev = netdev_priv(netdev); -- u16 mode = 0; -- -- if (phydev->link) { -- mode = AX88772_MEDIUM_DEFAULT; -- -- if (phydev->duplex == DUPLEX_HALF) -- mode &= ~AX_MEDIUM_FD; -- -- if (phydev->speed != SPEED_100) -- mode &= ~AX_MEDIUM_PS; -- } -- -- asix_write_medium_mode(dev, mode, 0); -- phy_print_status(phydev); -- usbnet_link_change(dev, phydev->link, 0); --} -- - int asix_write_gpio(struct usbnet *dev, u16 value, int sleep, int in_pm) - { - int ret; -diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c -index ec4dcf89cbedd2..119295f5f3b351 100644 ---- a/drivers/net/usb/asix_devices.c -+++ b/drivers/net/usb/asix_devices.c -@@ -752,7 +752,6 @@ static void ax88772_mac_link_down(struct phylink_config *config, - struct usbnet *dev = netdev_priv(to_net_dev(config->dev)); - - asix_write_medium_mode(dev, 0, 0); -- usbnet_link_change(dev, false, false); - } - - static void ax88772_mac_link_up(struct phylink_config *config, -@@ -783,7 +782,6 @@ static void ax88772_mac_link_up(struct phylink_config *config, - m |= AX_MEDIUM_RFC; - - asix_write_medium_mode(dev, m, 0); -- usbnet_link_change(dev, true, false); - } - - static const struct phylink_mac_ops ax88772_phylink_mac_ops = { -@@ -1350,10 +1348,9 @@ static const struct driver_info ax88772_info = { - .description = "ASIX AX88772 USB 2.0 Ethernet", - .bind = ax88772_bind, - .unbind = ax88772_unbind, -- .status = asix_status, - .reset = ax88772_reset, - .stop = ax88772_stop, -- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR | FLAG_MULTI_PACKET, -+ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_MULTI_PACKET, - .rx_fixup = asix_rx_fixup_common, - .tx_fixup = asix_tx_fixup, - }; -@@ -1362,11 +1359,9 @@ static const struct driver_info ax88772b_info = { - .description = "ASIX AX88772B USB 2.0 Ethernet", - .bind = ax88772_bind, - .unbind = ax88772_unbind, -- .status = asix_status, - .reset = ax88772_reset, - .stop = ax88772_stop, -- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR | -- FLAG_MULTI_PACKET, -+ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_MULTI_PACKET, - .rx_fixup = asix_rx_fixup_common, - .tx_fixup = asix_tx_fixup, - .data = FLAG_EEPROM_MAC, -@@ -1376,11 +1371,9 @@ static const struct driver_info lxausb_t1l_info = { - .description = "Linux Automation GmbH USB 10Base-T1L", - .bind = ax88772_bind, - .unbind = ax88772_unbind, -- .status = asix_status, - .reset = ax88772_reset, - .stop = ax88772_stop, -- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR | -- FLAG_MULTI_PACKET, -+ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_MULTI_PACKET, - .rx_fixup = asix_rx_fixup_common, - .tx_fixup = asix_tx_fixup, - .data = FLAG_EEPROM_MAC, -@@ -1412,10 +1405,8 @@ static const struct driver_info hg20f9_info = { - .description = "HG20F9 USB 2.0 Ethernet", - .bind = ax88772_bind, - .unbind = ax88772_unbind, -- .status = asix_status, - .reset = ax88772_reset, -- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR | -- FLAG_MULTI_PACKET, -+ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_MULTI_PACKET, - .rx_fixup = asix_rx_fixup_common, - .tx_fixup = asix_tx_fixup, - .data = FLAG_EEPROM_MAC, -diff --git a/drivers/net/usb/ch9200.c b/drivers/net/usb/ch9200.c -index f69d9b902da04a..a206ffa76f1b93 100644 ---- a/drivers/net/usb/ch9200.c -+++ b/drivers/net/usb/ch9200.c -@@ -178,6 +178,7 @@ static int ch9200_mdio_read(struct net_device *netdev, int phy_id, int loc) - { - struct usbnet *dev = netdev_priv(netdev); - unsigned char buff[2]; -+ int ret; - - netdev_dbg(netdev, "%s phy_id:%02x loc:%02x\n", - __func__, phy_id, loc); -@@ -185,8 +186,10 @@ static int ch9200_mdio_read(struct net_device *netdev, int phy_id, int loc) - if (phy_id != 0) - return -ENODEV; - -- control_read(dev, REQUEST_READ, 0, loc * 2, buff, 0x02, -- CONTROL_TIMEOUT_MS); -+ ret = control_read(dev, REQUEST_READ, 0, loc * 2, buff, 0x02, -+ CONTROL_TIMEOUT_MS); -+ if (ret < 0) -+ return ret; - - return (buff[0] | buff[1] << 8); - } -diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c -index 2ed879a0abc6ce..1b6b6acd34894b 100644 ---- a/drivers/net/vxlan/vxlan_core.c -+++ b/drivers/net/vxlan/vxlan_core.c -@@ -606,10 +606,10 @@ static int vxlan_fdb_append(struct vxlan_fdb *f, - if (rd == NULL) - return -ENOMEM; - -- if (dst_cache_init(&rd->dst_cache, GFP_ATOMIC)) { -- kfree(rd); -- return -ENOMEM; -- } -+ /* The driver can work correctly without a dst cache, so do not treat -+ * dst cache initialization errors as fatal. -+ */ -+ dst_cache_init(&rd->dst_cache, GFP_ATOMIC | __GFP_NOWARN); - - rd->remote_ip = *ip; - rd->remote_port = port; -diff --git a/drivers/net/wireless/ath/ath11k/ce.c b/drivers/net/wireless/ath/ath11k/ce.c -index e66e86bdec20ff..9d8efec46508a1 100644 ---- a/drivers/net/wireless/ath/ath11k/ce.c -+++ b/drivers/net/wireless/ath/ath11k/ce.c -@@ -393,11 +393,10 @@ static int ath11k_ce_completed_recv_next(struct ath11k_ce_pipe *pipe, - goto err; - } - -+ /* Make sure descriptor is read after the head pointer. */ -+ dma_rmb(); -+ - *nbytes = ath11k_hal_ce_dst_status_get_length(desc); -- if (*nbytes == 0) { -- ret = -EIO; -- goto err; -- } - - *skb = pipe->dest_ring->skb[sw_index]; - pipe->dest_ring->skb[sw_index] = NULL; -@@ -430,8 +429,8 @@ static void ath11k_ce_recv_process_cb(struct ath11k_ce_pipe *pipe) - dma_unmap_single(ab->dev, ATH11K_SKB_RXCB(skb)->paddr, - max_nbytes, DMA_FROM_DEVICE); - -- if (unlikely(max_nbytes < nbytes)) { -- ath11k_warn(ab, "rxed more than expected (nbytes %d, max %d)", -+ if (unlikely(max_nbytes < nbytes || nbytes == 0)) { -+ ath11k_warn(ab, "unexpected rx length (nbytes %d, max %d)", - nbytes, max_nbytes); - dev_kfree_skb_any(skb); - continue; -diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c -index 609d8387c41f3e..0e8ff839cae234 100644 ---- a/drivers/net/wireless/ath/ath11k/core.c -+++ b/drivers/net/wireless/ath/ath11k/core.c -@@ -704,6 +704,52 @@ static const struct ath11k_hw_params ath11k_hw_params[] = { - }, - }; - -+static const struct dmi_system_id ath11k_pm_quirk_table[] = { -+ { -+ .driver_data = (void *)ATH11K_PM_WOW, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "21J4"), -+ }, -+ }, -+ { -+ .driver_data = (void *)ATH11K_PM_WOW, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "21K4"), -+ }, -+ }, -+ { -+ .driver_data = (void *)ATH11K_PM_WOW, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "21K6"), -+ }, -+ }, -+ { -+ .driver_data = (void *)ATH11K_PM_WOW, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "21K8"), -+ }, -+ }, -+ { -+ .driver_data = (void *)ATH11K_PM_WOW, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "21KA"), -+ }, -+ }, -+ { -+ .driver_data = (void *)ATH11K_PM_WOW, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "21F9"), -+ }, -+ }, -+ {} -+}; -+ - static inline struct ath11k_pdev *ath11k_core_get_single_pdev(struct ath11k_base *ab) - { - WARN_ON(!ab->hw_params.single_pdev_only); -@@ -2018,8 +2064,17 @@ EXPORT_SYMBOL(ath11k_core_pre_init); - - int ath11k_core_init(struct ath11k_base *ab) - { -+ const struct dmi_system_id *dmi_id; - int ret; - -+ dmi_id = dmi_first_match(ath11k_pm_quirk_table); -+ if (dmi_id) -+ ab->pm_policy = (kernel_ulong_t)dmi_id->driver_data; -+ else -+ ab->pm_policy = ATH11K_PM_DEFAULT; -+ -+ ath11k_dbg(ab, ATH11K_DBG_BOOT, "pm policy %u\n", ab->pm_policy); -+ - ret = ath11k_core_soc_create(ab); - if (ret) { - ath11k_err(ab, "failed to create soc core: %d\n", ret); -diff --git a/drivers/net/wireless/ath/ath11k/core.h b/drivers/net/wireless/ath/ath11k/core.h -index 555deafd8399ac..812a174f74c0b3 100644 ---- a/drivers/net/wireless/ath/ath11k/core.h -+++ b/drivers/net/wireless/ath/ath11k/core.h -@@ -842,6 +842,11 @@ struct ath11k_msi_config { - u16 hw_rev; - }; - -+enum ath11k_pm_policy { -+ ATH11K_PM_DEFAULT, -+ ATH11K_PM_WOW, -+}; -+ - /* Master structure to hold the hw data which may be used in core module */ - struct ath11k_base { - enum ath11k_hw_rev hw_rev; -@@ -994,6 +999,8 @@ struct ath11k_base { - } testmode; - #endif - -+ enum ath11k_pm_policy pm_policy; -+ - /* must be last */ - u8 drv_priv[] __aligned(sizeof(void *)); - }; -diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c -index 4c70366ac56eb0..2b7bee66647286 100644 ---- a/drivers/net/wireless/ath/ath11k/dp_rx.c -+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c -@@ -2649,7 +2649,7 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id, - struct ath11k *ar; - struct hal_reo_dest_ring *desc; - enum hal_reo_dest_ring_push_reason push_reason; -- u32 cookie; -+ u32 cookie, info0, rx_msdu_info0, rx_mpdu_info0; - int i; - - for (i = 0; i < MAX_RADIOS; i++) -@@ -2662,11 +2662,14 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id, - try_again: - ath11k_hal_srng_access_begin(ab, srng); - -+ /* Make sure descriptor is read after the head pointer. */ -+ dma_rmb(); -+ - while (likely(desc = - (struct hal_reo_dest_ring *)ath11k_hal_srng_dst_get_next_entry(ab, - srng))) { - cookie = FIELD_GET(BUFFER_ADDR_INFO1_SW_COOKIE, -- desc->buf_addr_info.info1); -+ READ_ONCE(desc->buf_addr_info.info1)); - buf_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_BUF_ID, - cookie); - mac_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_PDEV_ID, cookie); -@@ -2695,8 +2698,9 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id, - - num_buffs_reaped[mac_id]++; - -+ info0 = READ_ONCE(desc->info0); - push_reason = FIELD_GET(HAL_REO_DEST_RING_INFO0_PUSH_REASON, -- desc->info0); -+ info0); - if (unlikely(push_reason != - HAL_REO_DEST_RING_PUSH_REASON_ROUTING_INSTRUCTION)) { - dev_kfree_skb_any(msdu); -@@ -2704,18 +2708,21 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id, - continue; - } - -- rxcb->is_first_msdu = !!(desc->rx_msdu_info.info0 & -+ rx_msdu_info0 = READ_ONCE(desc->rx_msdu_info.info0); -+ rx_mpdu_info0 = READ_ONCE(desc->rx_mpdu_info.info0); -+ -+ rxcb->is_first_msdu = !!(rx_msdu_info0 & - RX_MSDU_DESC_INFO0_FIRST_MSDU_IN_MPDU); -- rxcb->is_last_msdu = !!(desc->rx_msdu_info.info0 & -+ rxcb->is_last_msdu = !!(rx_msdu_info0 & - RX_MSDU_DESC_INFO0_LAST_MSDU_IN_MPDU); -- rxcb->is_continuation = !!(desc->rx_msdu_info.info0 & -+ rxcb->is_continuation = !!(rx_msdu_info0 & - RX_MSDU_DESC_INFO0_MSDU_CONTINUATION); - rxcb->peer_id = FIELD_GET(RX_MPDU_DESC_META_DATA_PEER_ID, -- desc->rx_mpdu_info.meta_data); -+ READ_ONCE(desc->rx_mpdu_info.meta_data)); - rxcb->seq_no = FIELD_GET(RX_MPDU_DESC_INFO0_SEQ_NUM, -- desc->rx_mpdu_info.info0); -+ rx_mpdu_info0); - rxcb->tid = FIELD_GET(HAL_REO_DEST_RING_INFO0_RX_QUEUE_NUM, -- desc->info0); -+ info0); - - rxcb->mac_id = mac_id; - __skb_queue_tail(&msdu_list[mac_id], msdu); -diff --git a/drivers/net/wireless/ath/ath11k/hal.c b/drivers/net/wireless/ath/ath11k/hal.c -index ae5f7e401e21b7..f32fa104ded9de 100644 ---- a/drivers/net/wireless/ath/ath11k/hal.c -+++ b/drivers/net/wireless/ath/ath11k/hal.c -@@ -601,7 +601,7 @@ u32 ath11k_hal_ce_dst_status_get_length(void *buf) - (struct hal_ce_srng_dst_status_desc *)buf; - u32 len; - -- len = FIELD_GET(HAL_CE_DST_STATUS_DESC_FLAGS_LEN, desc->flags); -+ len = FIELD_GET(HAL_CE_DST_STATUS_DESC_FLAGS_LEN, READ_ONCE(desc->flags)); - desc->flags &= ~HAL_CE_DST_STATUS_DESC_FLAGS_LEN; - - return len; -@@ -802,7 +802,7 @@ void ath11k_hal_srng_access_begin(struct ath11k_base *ab, struct hal_srng *srng) - srng->u.src_ring.cached_tp = - *(volatile u32 *)srng->u.src_ring.tp_addr; - } else { -- srng->u.dst_ring.cached_hp = *srng->u.dst_ring.hp_addr; -+ srng->u.dst_ring.cached_hp = READ_ONCE(*srng->u.dst_ring.hp_addr); - - /* Try to prefetch the next descriptor in the ring */ - if (srng->flags & HAL_SRNG_FLAGS_CACHED) -diff --git a/drivers/net/wireless/ath/ath11k/qmi.c b/drivers/net/wireless/ath/ath11k/qmi.c -index fa46e645009cf6..91e31f30d2c80f 100644 ---- a/drivers/net/wireless/ath/ath11k/qmi.c -+++ b/drivers/net/wireless/ath/ath11k/qmi.c -@@ -1989,6 +1989,15 @@ static int ath11k_qmi_alloc_target_mem_chunk(struct ath11k_base *ab) - chunk->prev_size == chunk->size) - continue; - -+ if (ab->qmi.mem_seg_count <= ATH11K_QMI_FW_MEM_REQ_SEGMENT_CNT) { -+ ath11k_dbg(ab, ATH11K_DBG_QMI, -+ "size/type mismatch (current %d %u) (prev %d %u), try later with small size\n", -+ chunk->size, chunk->type, -+ chunk->prev_size, chunk->prev_type); -+ ab->qmi.target_mem_delayed = true; -+ return 0; -+ } -+ - /* cannot reuse the existing chunk */ - dma_free_coherent(ab->dev, chunk->prev_size, - chunk->vaddr, chunk->paddr); -diff --git a/drivers/net/wireless/ath/ath12k/ce.c b/drivers/net/wireless/ath/ath12k/ce.c -index be0d669d31fcce..740586fe49d1f9 100644 ---- a/drivers/net/wireless/ath/ath12k/ce.c -+++ b/drivers/net/wireless/ath/ath12k/ce.c -@@ -343,11 +343,10 @@ static int ath12k_ce_completed_recv_next(struct ath12k_ce_pipe *pipe, - goto err; - } - -+ /* Make sure descriptor is read after the head pointer. */ -+ dma_rmb(); -+ - *nbytes = ath12k_hal_ce_dst_status_get_length(desc); -- if (*nbytes == 0) { -- ret = -EIO; -- goto err; -- } - - *skb = pipe->dest_ring->skb[sw_index]; - pipe->dest_ring->skb[sw_index] = NULL; -@@ -380,8 +379,8 @@ static void ath12k_ce_recv_process_cb(struct ath12k_ce_pipe *pipe) - dma_unmap_single(ab->dev, ATH12K_SKB_RXCB(skb)->paddr, - max_nbytes, DMA_FROM_DEVICE); - -- if (unlikely(max_nbytes < nbytes)) { -- ath12k_warn(ab, "rxed more than expected (nbytes %d, max %d)", -+ if (unlikely(max_nbytes < nbytes || nbytes == 0)) { -+ ath12k_warn(ab, "unexpected rx length (nbytes %d, max %d)", - nbytes, max_nbytes); - dev_kfree_skb_any(skb); - continue; -diff --git a/drivers/net/wireless/ath/ath12k/ce.h b/drivers/net/wireless/ath/ath12k/ce.h -index 857bc5f9e946a9..f9547a3945e44b 100644 ---- a/drivers/net/wireless/ath/ath12k/ce.h -+++ b/drivers/net/wireless/ath/ath12k/ce.h -@@ -1,7 +1,7 @@ - /* SPDX-License-Identifier: BSD-3-Clause-Clear */ - /* - * Copyright (c) 2018-2021 The Linux Foundation. All rights reserved. -- * Copyright (c) 2021-2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved. -+ * Copyright (c) 2021-2022, 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #ifndef ATH12K_CE_H -@@ -39,8 +39,8 @@ - #define PIPEDIR_INOUT_H2H 4 /* bidirectional, host to host */ - - /* CE address/mask */ --#define CE_HOST_IE_ADDRESS 0x00A1803C --#define CE_HOST_IE_2_ADDRESS 0x00A18040 -+#define CE_HOST_IE_ADDRESS 0x75804C -+#define CE_HOST_IE_2_ADDRESS 0x758050 - #define CE_HOST_IE_3_ADDRESS CE_HOST_IE_ADDRESS - - #define CE_HOST_IE_3_SHIFT 0xC -diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c -index 35f22a4a16cf20..69bf75ebd7518a 100644 ---- a/drivers/net/wireless/ath/ath12k/dp_mon.c -+++ b/drivers/net/wireless/ath/ath12k/dp_mon.c -@@ -1077,6 +1077,8 @@ static void ath12k_dp_mon_rx_deliver_msdu(struct ath12k *ar, struct napi_struct - bool is_mcbc = rxcb->is_mcbc; - bool is_eapol_tkip = rxcb->is_eapol; - -+ status->link_valid = 0; -+ - if ((status->encoding == RX_ENC_HE) && !(status->flag & RX_FLAG_RADIOTAP_HE) && - !(status->flag & RX_FLAG_SKIP_MONITOR)) { - he = skb_push(msdu, sizeof(known)); -diff --git a/drivers/net/wireless/ath/ath12k/hal.c b/drivers/net/wireless/ath/ath12k/hal.c -index 0b5a91ab0df49c..169e16c6ed650f 100644 ---- a/drivers/net/wireless/ath/ath12k/hal.c -+++ b/drivers/net/wireless/ath/ath12k/hal.c -@@ -1565,7 +1565,7 @@ u32 ath12k_hal_ce_dst_status_get_length(struct hal_ce_srng_dst_status_desc *desc - { - u32 len; - -- len = le32_get_bits(desc->flags, HAL_CE_DST_STATUS_DESC_FLAGS_LEN); -+ len = le32_get_bits(READ_ONCE(desc->flags), HAL_CE_DST_STATUS_DESC_FLAGS_LEN); - desc->flags &= ~cpu_to_le32(HAL_CE_DST_STATUS_DESC_FLAGS_LEN); - - return len; -@@ -1734,7 +1734,7 @@ void ath12k_hal_srng_access_begin(struct ath12k_base *ab, struct hal_srng *srng) - srng->u.src_ring.cached_tp = - *(volatile u32 *)srng->u.src_ring.tp_addr; - else -- srng->u.dst_ring.cached_hp = *srng->u.dst_ring.hp_addr; -+ srng->u.dst_ring.cached_hp = READ_ONCE(*srng->u.dst_ring.hp_addr); - } - - /* Update cached ring head/tail pointers to HW. ath12k_hal_srng_access_begin() -diff --git a/drivers/net/wireless/ath/ath12k/hal_desc.h b/drivers/net/wireless/ath/ath12k/hal_desc.h -index 1bb840c2bef577..5fd9232ad101ee 100644 ---- a/drivers/net/wireless/ath/ath12k/hal_desc.h -+++ b/drivers/net/wireless/ath/ath12k/hal_desc.h -@@ -683,7 +683,7 @@ enum hal_rx_msdu_desc_reo_dest_ind { - #define RX_MSDU_DESC_INFO0_DECAP_FORMAT GENMASK(30, 29) - - #define HAL_RX_MSDU_PKT_LENGTH_GET(val) \ -- (u32_get_bits((val), RX_MSDU_DESC_INFO0_MSDU_LENGTH)) -+ (le32_get_bits((val), RX_MSDU_DESC_INFO0_MSDU_LENGTH)) - - struct rx_msdu_desc { - __le32 info0; -diff --git a/drivers/net/wireless/ath/ath12k/pci.c b/drivers/net/wireless/ath/ath12k/pci.c -index 5fd80f90ecafed..7dfbabf0637d23 100644 ---- a/drivers/net/wireless/ath/ath12k/pci.c -+++ b/drivers/net/wireless/ath/ath12k/pci.c -@@ -1153,6 +1153,9 @@ void ath12k_pci_power_down(struct ath12k_base *ab) - { - struct ath12k_pci *ab_pci = ath12k_pci_priv(ab); - -+ if (!test_bit(ATH12K_PCI_FLAG_INIT_DONE, &ab_pci->flags)) -+ return; -+ - /* restore aspm in case firmware bootup fails */ - ath12k_pci_aspm_restore(ab_pci); - -diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c -index a0ac2f350934f9..958ac4ed5c3491 100644 ---- a/drivers/net/wireless/ath/ath12k/wmi.c -+++ b/drivers/net/wireless/ath/ath12k/wmi.c -@@ -951,14 +951,24 @@ int ath12k_wmi_vdev_down(struct ath12k *ar, u8 vdev_id) - static void ath12k_wmi_put_wmi_channel(struct ath12k_wmi_channel_params *chan, - struct wmi_vdev_start_req_arg *arg) - { -+ u32 center_freq1 = arg->band_center_freq1; -+ - memset(chan, 0, sizeof(*chan)); - - chan->mhz = cpu_to_le32(arg->freq); -- chan->band_center_freq1 = cpu_to_le32(arg->band_center_freq1); -- if (arg->mode == MODE_11AC_VHT80_80) -+ chan->band_center_freq1 = cpu_to_le32(center_freq1); -+ if (arg->mode == MODE_11BE_EHT160) { -+ if (arg->freq > center_freq1) -+ chan->band_center_freq1 = cpu_to_le32(center_freq1 + 40); -+ else -+ chan->band_center_freq1 = cpu_to_le32(center_freq1 - 40); -+ -+ chan->band_center_freq2 = cpu_to_le32(center_freq1); -+ } else if (arg->mode == MODE_11BE_EHT80_80) { - chan->band_center_freq2 = cpu_to_le32(arg->band_center_freq2); -- else -+ } else { - chan->band_center_freq2 = 0; -+ } - - chan->info |= le32_encode_bits(arg->mode, WMI_CHAN_INFO_MODE); - if (arg->passive) -@@ -5503,7 +5513,7 @@ static int ath12k_reg_chan_list_event(struct ath12k_base *ab, struct sk_buff *sk - goto fallback; - } - -- spin_lock(&ab->base_lock); -+ spin_lock_bh(&ab->base_lock); - if (test_bit(ATH12K_FLAG_REGISTERED, &ab->dev_flags)) { - /* Once mac is registered, ar is valid and all CC events from - * fw is considered to be received due to user requests -@@ -5527,7 +5537,7 @@ static int ath12k_reg_chan_list_event(struct ath12k_base *ab, struct sk_buff *sk - ab->default_regd[pdev_idx] = regd; - } - ab->dfs_region = reg_info->dfs_region; -- spin_unlock(&ab->base_lock); -+ spin_unlock_bh(&ab->base_lock); - - goto mem_free; - -diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c -index a5265997b5767c..debac4699687e1 100644 ---- a/drivers/net/wireless/ath/carl9170/usb.c -+++ b/drivers/net/wireless/ath/carl9170/usb.c -@@ -438,14 +438,21 @@ static void carl9170_usb_rx_complete(struct urb *urb) - - if (atomic_read(&ar->rx_anch_urbs) == 0) { - /* -- * The system is too slow to cope with -- * the enormous workload. We have simply -- * run out of active rx urbs and this -- * unfortunately leads to an unpredictable -- * device. -+ * At this point, either the system is too slow to -+ * cope with the enormous workload (so we have simply -+ * run out of active rx urbs and this unfortunately -+ * leads to an unpredictable device), or the device -+ * is not fully functional after an unsuccessful -+ * firmware loading attempts (so it doesn't pass -+ * ieee80211_register_hw() and there is no internal -+ * workqueue at all). - */ - -- ieee80211_queue_work(ar->hw, &ar->ping_work); -+ if (ar->registered) -+ ieee80211_queue_work(ar->hw, &ar->ping_work); -+ else -+ pr_warn_once("device %s is not registered\n", -+ dev_name(&ar->udev->dev)); - } - } else { - /* -diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c -index d594694206b33a..906f2790f56197 100644 ---- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c -+++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c -@@ -44,6 +44,8 @@ - IWL_QU_C_HR_B_FW_PRE "-" __stringify(api) ".ucode" - #define IWL_QU_B_JF_B_MODULE_FIRMWARE(api) \ - IWL_QU_B_JF_B_FW_PRE "-" __stringify(api) ".ucode" -+#define IWL_QU_C_JF_B_MODULE_FIRMWARE(api) \ -+ IWL_QU_C_JF_B_FW_PRE "-" __stringify(api) ".ucode" - #define IWL_CC_A_MODULE_FIRMWARE(api) \ - IWL_CC_A_FW_PRE "-" __stringify(api) ".ucode" - -@@ -423,6 +425,7 @@ const struct iwl_cfg iwl_cfg_quz_a0_hr_b0 = { - MODULE_FIRMWARE(IWL_QU_B_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); - MODULE_FIRMWARE(IWL_QU_C_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); - MODULE_FIRMWARE(IWL_QU_B_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); -+MODULE_FIRMWARE(IWL_QU_C_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); - MODULE_FIRMWARE(IWL_QUZ_A_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); - MODULE_FIRMWARE(IWL_QUZ_A_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); - MODULE_FIRMWARE(IWL_CC_A_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); -diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c -index e9807fcca6ad10..5c2e8d28839765 100644 ---- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c -+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c -@@ -2701,6 +2701,8 @@ static ssize_t iwl_dbgfs_rx_queue_read(struct file *file, - for (i = 0; i < trans->num_rx_queues && pos < bufsz; i++) { - struct iwl_rxq *rxq = &trans_pcie->rxq[i]; - -+ spin_lock_bh(&rxq->lock); -+ - pos += scnprintf(buf + pos, bufsz - pos, "queue#: %2d\n", - i); - pos += scnprintf(buf + pos, bufsz - pos, "\tread: %u\n", -@@ -2721,6 +2723,7 @@ static ssize_t iwl_dbgfs_rx_queue_read(struct file *file, - pos += scnprintf(buf + pos, bufsz - pos, - "\tclosed_rb_num: Not Allocated\n"); - } -+ spin_unlock_bh(&rxq->lock); - } - ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos); - kfree(buf); -@@ -3385,8 +3388,11 @@ iwl_trans_pcie_dump_data(struct iwl_trans *trans, - /* Dump RBs is supported only for pre-9000 devices (1 queue) */ - struct iwl_rxq *rxq = &trans_pcie->rxq[0]; - /* RBs */ -+ spin_lock_bh(&rxq->lock); - num_rbs = iwl_get_closed_rb_stts(trans, rxq); - num_rbs = (num_rbs - rxq->read) & RX_QUEUE_MASK; -+ spin_unlock_bh(&rxq->lock); -+ - len += num_rbs * (sizeof(*data) + - sizeof(struct iwl_fw_error_dump_rb) + - (PAGE_SIZE << trans_pcie->rx_page_order)); -diff --git a/drivers/net/wireless/intersil/p54/fwio.c b/drivers/net/wireless/intersil/p54/fwio.c -index b52cce38115d0a..06e5df90b43ece 100644 ---- a/drivers/net/wireless/intersil/p54/fwio.c -+++ b/drivers/net/wireless/intersil/p54/fwio.c -@@ -231,6 +231,7 @@ int p54_download_eeprom(struct p54_common *priv, void *buf, - - mutex_lock(&priv->eeprom_mutex); - priv->eeprom = buf; -+ priv->eeprom_slice_size = len; - eeprom_hdr = skb_put(skb, eeprom_hdr_size + len); - - if (priv->fw_var < 0x509) { -@@ -253,6 +254,7 @@ int p54_download_eeprom(struct p54_common *priv, void *buf, - ret = -EBUSY; - } - priv->eeprom = NULL; -+ priv->eeprom_slice_size = 0; - mutex_unlock(&priv->eeprom_mutex); - return ret; - } -diff --git a/drivers/net/wireless/intersil/p54/p54.h b/drivers/net/wireless/intersil/p54/p54.h -index 3356ea708d8163..97fc863fef810f 100644 ---- a/drivers/net/wireless/intersil/p54/p54.h -+++ b/drivers/net/wireless/intersil/p54/p54.h -@@ -258,6 +258,7 @@ struct p54_common { - - /* eeprom handling */ - void *eeprom; -+ size_t eeprom_slice_size; - struct completion eeprom_comp; - struct mutex eeprom_mutex; - }; -diff --git a/drivers/net/wireless/intersil/p54/txrx.c b/drivers/net/wireless/intersil/p54/txrx.c -index 8414aa208655f6..2deb1bb54f24bd 100644 ---- a/drivers/net/wireless/intersil/p54/txrx.c -+++ b/drivers/net/wireless/intersil/p54/txrx.c -@@ -496,14 +496,19 @@ static void p54_rx_eeprom_readback(struct p54_common *priv, - return ; - - if (priv->fw_var >= 0x509) { -- memcpy(priv->eeprom, eeprom->v2.data, -- le16_to_cpu(eeprom->v2.len)); -+ if (le16_to_cpu(eeprom->v2.len) != priv->eeprom_slice_size) -+ return; -+ -+ memcpy(priv->eeprom, eeprom->v2.data, priv->eeprom_slice_size); - } else { -- memcpy(priv->eeprom, eeprom->v1.data, -- le16_to_cpu(eeprom->v1.len)); -+ if (le16_to_cpu(eeprom->v1.len) != priv->eeprom_slice_size) -+ return; -+ -+ memcpy(priv->eeprom, eeprom->v1.data, priv->eeprom_slice_size); - } - - priv->eeprom = NULL; -+ priv->eeprom_slice_size = 0; - tmp = p54_find_and_unlink_skb(priv, hdr->req_id); - dev_kfree_skb_any(tmp); - complete(&priv->eeprom_comp); -diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c b/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c -index 70d3895762b4cd..00248e2b21ea70 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c -+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c -@@ -17,6 +17,8 @@ static const struct usb_device_id mt76x2u_device_table[] = { - { USB_DEVICE(0x057c, 0x8503) }, /* Avm FRITZ!WLAN AC860 */ - { USB_DEVICE(0x7392, 0xb711) }, /* Edimax EW 7722 UAC */ - { USB_DEVICE(0x0e8d, 0x7632) }, /* HC-M7662BU1 */ -+ { USB_DEVICE(0x0471, 0x2126) }, /* LiteOn WN4516R module, nonstandard USB connector */ -+ { USB_DEVICE(0x0471, 0x7600) }, /* LiteOn WN4519R module, nonstandard USB connector */ - { USB_DEVICE(0x2c4e, 0x0103) }, /* Mercury UD13 */ - { USB_DEVICE(0x0846, 0x9053) }, /* Netgear A6210 */ - { USB_DEVICE(0x045e, 0x02e6) }, /* XBox One Wireless Adapter */ -diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c b/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c -index 33a14365ec9b98..3b556281151158 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c -+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c -@@ -191,6 +191,7 @@ int mt76x2u_register_device(struct mt76x02_dev *dev) - { - struct ieee80211_hw *hw = mt76_hw(dev); - struct mt76_usb *usb = &dev->mt76.usb; -+ bool vht; - int err; - - INIT_DELAYED_WORK(&dev->cal_work, mt76x2u_phy_calibrate); -@@ -217,7 +218,17 @@ int mt76x2u_register_device(struct mt76x02_dev *dev) - - /* check hw sg support in order to enable AMSDU */ - hw->max_tx_fragments = dev->mt76.usb.sg_en ? MT_TX_SG_MAX_SIZE : 1; -- err = mt76_register_device(&dev->mt76, true, mt76x02_rates, -+ switch (dev->mt76.rev) { -+ case 0x76320044: -+ /* these ASIC revisions do not support VHT */ -+ vht = false; -+ break; -+ default: -+ vht = true; -+ break; -+ } -+ -+ err = mt76_register_device(&dev->mt76, vht, mt76x02_rates, - ARRAY_SIZE(mt76x02_rates)); - if (err) - goto fail; -diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c -index 31ef58e2a3d2a3..8e2ec395633171 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c -@@ -83,6 +83,11 @@ mt7921_init_he_caps(struct mt792x_phy *phy, enum nl80211_band band, - he_cap_elem->phy_cap_info[9] |= - IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU | - IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU; -+ -+ if (is_mt7922(phy->mt76->dev)) { -+ he_cap_elem->phy_cap_info[0] |= -+ IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G; -+ } - break; - case NL80211_IFTYPE_STATION: - he_cap_elem->mac_cap_info[1] |= -diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c -index 35d9673ec0d8fc..8fa16f95e6a7b3 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c -@@ -650,6 +650,14 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, struct sk_buff *skb) - status->last_amsdu = amsdu_info == MT_RXD4_LAST_AMSDU_FRAME; - } - -+ /* IEEE 802.11 fragmentation can only be applied to unicast frames. -+ * Hence, drop fragments with multicast/broadcast RA. -+ * This check fixes vulnerabilities, like CVE-2020-26145. -+ */ -+ if ((ieee80211_has_morefrags(fc) || seq_ctrl & IEEE80211_SCTL_FRAG) && -+ FIELD_GET(MT_RXD3_NORMAL_ADDR_TYPE, rxd3) != MT_RXD3_NORMAL_U2M) -+ return -EINVAL; -+ - hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad; - if (hdr_trans && ieee80211_has_morefrags(fc)) { - if (mt7996_reverse_frag0_hdr_trans(skb, hdr_gap)) -diff --git a/drivers/net/wireless/purelifi/plfxlc/usb.c b/drivers/net/wireless/purelifi/plfxlc/usb.c -index 311676c1ece0ac..8151bc5e00ccc8 100644 ---- a/drivers/net/wireless/purelifi/plfxlc/usb.c -+++ b/drivers/net/wireless/purelifi/plfxlc/usb.c -@@ -503,8 +503,10 @@ int plfxlc_usb_wreq_async(struct plfxlc_usb *usb, const u8 *buffer, - (void *)buffer, buffer_len, complete_fn, context); - - r = usb_submit_urb(urb, GFP_ATOMIC); -- if (r) -+ if (r) { -+ usb_free_urb(urb); - dev_err(&udev->dev, "Async write submit failed (%d)\n", r); -+ } - - return r; - } -diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c -index 3abd0c4c954bc1..3645f212021f92 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/pci.c -+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c -@@ -155,6 +155,16 @@ static void _rtl_pci_update_default_setting(struct ieee80211_hw *hw) - if (rtlpriv->rtlhal.hw_type == HARDWARE_TYPE_RTL8192SE && - init_aspm == 0x43) - ppsc->support_aspm = false; -+ -+ /* RTL8723BE found on some ASUSTek laptops, such as F441U and -+ * X555UQ with subsystem ID 11ad:1723 are known to output large -+ * amounts of PCIe AER errors during and after boot up, causing -+ * heavy lags, poor network throughput, and occasional lock-ups. -+ */ -+ if (rtlpriv->rtlhal.hw_type == HARDWARE_TYPE_RTL8723BE && -+ (rtlpci->pdev->subsystem_vendor == 0x11ad && -+ rtlpci->pdev->subsystem_device == 0x1723)) -+ ppsc->support_aspm = false; - } - - static bool _rtl_pci_platform_switch_device_pci_aspm( -diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c -index 8f1d653282b7ec..eba3a2ee747f9c 100644 ---- a/drivers/net/wireless/realtek/rtw88/usb.c -+++ b/drivers/net/wireless/realtek/rtw88/usb.c -@@ -133,7 +133,7 @@ static void rtw_usb_write(struct rtw_dev *rtwdev, u32 addr, u32 val, int len) - - ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), - RTW_USB_CMD_REQ, RTW_USB_CMD_WRITE, -- addr, 0, data, len, 30000); -+ addr, 0, data, len, 500); - if (ret < 0 && ret != -ENODEV && count++ < 4) - rtw_err(rtwdev, "write register 0x%x failed with %d\n", - addr, ret); -diff --git a/drivers/net/wireless/realtek/rtw89/cam.c b/drivers/net/wireless/realtek/rtw89/cam.c -index f5301c2bbf133d..9a0ffaddb83606 100644 ---- a/drivers/net/wireless/realtek/rtw89/cam.c -+++ b/drivers/net/wireless/realtek/rtw89/cam.c -@@ -6,6 +6,7 @@ - #include "debug.h" - #include "fw.h" - #include "mac.h" -+#include "ps.h" - - static struct sk_buff * - rtw89_cam_get_sec_key_cmd(struct rtw89_dev *rtwdev, -@@ -333,9 +334,11 @@ int rtw89_cam_sec_key_add(struct rtw89_dev *rtwdev, - - switch (key->cipher) { - case WLAN_CIPHER_SUITE_WEP40: -+ rtw89_leave_ips_by_hwflags(rtwdev); - hw_key_type = RTW89_SEC_KEY_TYPE_WEP40; - break; - case WLAN_CIPHER_SUITE_WEP104: -+ rtw89_leave_ips_by_hwflags(rtwdev); - hw_key_type = RTW89_SEC_KEY_TYPE_WEP104; - break; - case WLAN_CIPHER_SUITE_CCMP: -diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c -index 30cc6e03c355e8..33b2543ee4d230 100644 ---- a/drivers/net/wireless/realtek/rtw89/pci.c -+++ b/drivers/net/wireless/realtek/rtw89/pci.c -@@ -1822,22 +1822,87 @@ static int rtw89_write16_mdio_clr(struct rtw89_dev *rtwdev, u8 addr, u16 mask, u - return 0; - } - -+static int rtw89_dbi_write8(struct rtw89_dev *rtwdev, u16 addr, u8 data) -+{ -+ u16 addr_2lsb = addr & B_AX_DBI_2LSB; -+ u16 write_addr; -+ u8 flag; -+ int ret; -+ -+ write_addr = addr & B_AX_DBI_ADDR_MSK; -+ write_addr |= u16_encode_bits(BIT(addr_2lsb), B_AX_DBI_WREN_MSK); -+ rtw89_write8(rtwdev, R_AX_DBI_WDATA + addr_2lsb, data); -+ rtw89_write16(rtwdev, R_AX_DBI_FLAG, write_addr); -+ rtw89_write8(rtwdev, R_AX_DBI_FLAG + 2, B_AX_DBI_WFLAG >> 16); -+ -+ ret = read_poll_timeout_atomic(rtw89_read8, flag, !flag, 10, -+ 10 * RTW89_PCI_WR_RETRY_CNT, false, -+ rtwdev, R_AX_DBI_FLAG + 2); -+ if (ret) -+ rtw89_err(rtwdev, "failed to write DBI register, addr=0x%X\n", -+ addr); -+ -+ return ret; -+} -+ -+static int rtw89_dbi_read8(struct rtw89_dev *rtwdev, u16 addr, u8 *value) -+{ -+ u16 read_addr = addr & B_AX_DBI_ADDR_MSK; -+ u8 flag; -+ int ret; -+ -+ rtw89_write16(rtwdev, R_AX_DBI_FLAG, read_addr); -+ rtw89_write8(rtwdev, R_AX_DBI_FLAG + 2, B_AX_DBI_RFLAG >> 16); -+ -+ ret = read_poll_timeout_atomic(rtw89_read8, flag, !flag, 10, -+ 10 * RTW89_PCI_WR_RETRY_CNT, false, -+ rtwdev, R_AX_DBI_FLAG + 2); -+ if (ret) { -+ rtw89_err(rtwdev, "failed to read DBI register, addr=0x%X\n", -+ addr); -+ return ret; -+ } -+ -+ read_addr = R_AX_DBI_RDATA + (addr & 3); -+ *value = rtw89_read8(rtwdev, read_addr); -+ -+ return 0; -+} -+ - static int rtw89_pci_write_config_byte(struct rtw89_dev *rtwdev, u16 addr, - u8 data) - { - struct rtw89_pci *rtwpci = (struct rtw89_pci *)rtwdev->priv; -+ enum rtw89_core_chip_id chip_id = rtwdev->chip->chip_id; - struct pci_dev *pdev = rtwpci->pdev; -+ int ret; -+ -+ ret = pci_write_config_byte(pdev, addr, data); -+ if (!ret) -+ return 0; - -- return pci_write_config_byte(pdev, addr, data); -+ if (chip_id == RTL8852A || chip_id == RTL8852B || chip_id == RTL8851B) -+ ret = rtw89_dbi_write8(rtwdev, addr, data); -+ -+ return ret; - } - - static int rtw89_pci_read_config_byte(struct rtw89_dev *rtwdev, u16 addr, - u8 *value) - { - struct rtw89_pci *rtwpci = (struct rtw89_pci *)rtwdev->priv; -+ enum rtw89_core_chip_id chip_id = rtwdev->chip->chip_id; - struct pci_dev *pdev = rtwpci->pdev; -+ int ret; - -- return pci_read_config_byte(pdev, addr, value); -+ ret = pci_read_config_byte(pdev, addr, value); -+ if (!ret) -+ return 0; -+ -+ if (chip_id == RTL8852A || chip_id == RTL8852B || chip_id == RTL8851B) -+ ret = rtw89_dbi_read8(rtwdev, addr, value); -+ -+ return ret; - } - - static int rtw89_pci_config_byte_set(struct rtw89_dev *rtwdev, u16 addr, -diff --git a/drivers/net/wireless/realtek/rtw89/pci.h b/drivers/net/wireless/realtek/rtw89/pci.h -index 4259b79b138fb4..119c0608b91a8a 100644 ---- a/drivers/net/wireless/realtek/rtw89/pci.h -+++ b/drivers/net/wireless/realtek/rtw89/pci.h -@@ -42,6 +42,7 @@ - #define B_AX_DBI_WFLAG BIT(16) - #define B_AX_DBI_WREN_MSK GENMASK(15, 12) - #define B_AX_DBI_ADDR_MSK GENMASK(11, 2) -+#define B_AX_DBI_2LSB GENMASK(1, 0) - #define R_AX_DBI_WDATA 0x1094 - #define R_AX_DBI_RDATA 0x1098 - -diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c -index d86a1bd7aab089..f5f48f7e6d26e3 100644 ---- a/drivers/net/wireless/virtual/mac80211_hwsim.c -+++ b/drivers/net/wireless/virtual/mac80211_hwsim.c -@@ -1201,6 +1201,11 @@ static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw, - /* MLD not supported here */ - u32 bcn_int = data->link_data[0].beacon_int; - u64 delta = abs(tsf - now); -+ struct ieee80211_bss_conf *conf; -+ -+ conf = link_conf_dereference_protected(vif, data->link_data[0].link_id); -+ if (conf && !conf->enable_beacon) -+ return; - - /* adjust after beaconing with new timestamp at old TBTT */ - if (tsf > now) { -diff --git a/drivers/pci/controller/cadence/pcie-cadence-ep.c b/drivers/pci/controller/cadence/pcie-cadence-ep.c -index a87dab9abba26f..08fb16918043f4 100644 ---- a/drivers/pci/controller/cadence/pcie-cadence-ep.c -+++ b/drivers/pci/controller/cadence/pcie-cadence-ep.c -@@ -294,13 +294,14 @@ static int cdns_pcie_ep_set_msix(struct pci_epc *epc, u8 fn, u8 vfn, - struct cdns_pcie *pcie = &ep->pcie; - u32 cap = CDNS_PCIE_EP_FUNC_MSIX_CAP_OFFSET; - u32 val, reg; -+ u16 actual_interrupts = interrupts + 1; - - fn = cdns_pcie_get_fn_from_vfn(pcie, fn, vfn); - - reg = cap + PCI_MSIX_FLAGS; - val = cdns_pcie_ep_fn_readw(pcie, fn, reg); - val &= ~PCI_MSIX_FLAGS_QSIZE; -- val |= interrupts; -+ val |= interrupts; /* 0's based value */ - cdns_pcie_ep_fn_writew(pcie, fn, reg, val); - - /* Set MSIX BAR and offset */ -@@ -310,7 +311,7 @@ static int cdns_pcie_ep_set_msix(struct pci_epc *epc, u8 fn, u8 vfn, - - /* Set PBA BAR and offset. BAR must match MSIX BAR */ - reg = cap + PCI_MSIX_PBA; -- val = (offset + (interrupts * PCI_MSIX_ENTRY_SIZE)) | bir; -+ val = (offset + (actual_interrupts * PCI_MSIX_ENTRY_SIZE)) | bir; - cdns_pcie_ep_fn_writel(pcie, fn, reg, val); - - return 0; -diff --git a/drivers/pci/controller/dwc/pcie-dw-rockchip.c b/drivers/pci/controller/dwc/pcie-dw-rockchip.c -index 9b1256da096cb6..8af7a837a0612c 100644 ---- a/drivers/pci/controller/dwc/pcie-dw-rockchip.c -+++ b/drivers/pci/controller/dwc/pcie-dw-rockchip.c -@@ -275,8 +275,8 @@ static int rockchip_pcie_phy_init(struct rockchip_pcie *rockchip) - - static void rockchip_pcie_phy_deinit(struct rockchip_pcie *rockchip) - { -- phy_exit(rockchip->phy); - phy_power_off(rockchip->phy); -+ phy_exit(rockchip->phy); - } - - static const struct dw_pcie_ops dw_pcie_ops = { -diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c -index 503304aba9eac1..4541dfbf0e1b63 100644 ---- a/drivers/pci/pci.c -+++ b/drivers/pci/pci.c -@@ -5823,7 +5823,8 @@ static void pci_slot_unlock(struct pci_slot *slot) - continue; - if (dev->subordinate) - pci_bus_unlock(dev->subordinate); -- pci_dev_unlock(dev); -+ else -+ pci_dev_unlock(dev); - } - } - -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index 70f484b811dea7..d67ea16e69e6ac 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -4988,6 +4988,18 @@ static int pci_quirk_brcm_acs(struct pci_dev *dev, u16 acs_flags) - PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF); - } - -+static int pci_quirk_loongson_acs(struct pci_dev *dev, u16 acs_flags) -+{ -+ /* -+ * Loongson PCIe Root Ports don't advertise an ACS capability, but -+ * they do not allow peer-to-peer transactions between Root Ports. -+ * Allow each Root Port to be in a separate IOMMU group by masking -+ * SV/RR/CR/UF bits. -+ */ -+ return pci_acs_ctrl_enabled(acs_flags, -+ PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF); -+} -+ - /* - * Wangxun 40G/25G/10G/1G NICs have no ACS capability, but on - * multi-function devices, the hardware isolates the functions by -@@ -5121,6 +5133,17 @@ static const struct pci_dev_acs_enabled { - { PCI_VENDOR_ID_BROADCOM, 0x1762, pci_quirk_mf_endpoint_acs }, - { PCI_VENDOR_ID_BROADCOM, 0x1763, pci_quirk_mf_endpoint_acs }, - { PCI_VENDOR_ID_BROADCOM, 0xD714, pci_quirk_brcm_acs }, -+ /* Loongson PCIe Root Ports */ -+ { PCI_VENDOR_ID_LOONGSON, 0x3C09, pci_quirk_loongson_acs }, -+ { PCI_VENDOR_ID_LOONGSON, 0x3C19, pci_quirk_loongson_acs }, -+ { PCI_VENDOR_ID_LOONGSON, 0x3C29, pci_quirk_loongson_acs }, -+ { PCI_VENDOR_ID_LOONGSON, 0x7A09, pci_quirk_loongson_acs }, -+ { PCI_VENDOR_ID_LOONGSON, 0x7A19, pci_quirk_loongson_acs }, -+ { PCI_VENDOR_ID_LOONGSON, 0x7A29, pci_quirk_loongson_acs }, -+ { PCI_VENDOR_ID_LOONGSON, 0x7A39, pci_quirk_loongson_acs }, -+ { PCI_VENDOR_ID_LOONGSON, 0x7A49, pci_quirk_loongson_acs }, -+ { PCI_VENDOR_ID_LOONGSON, 0x7A59, pci_quirk_loongson_acs }, -+ { PCI_VENDOR_ID_LOONGSON, 0x7A69, pci_quirk_loongson_acs }, - /* Amazon Annapurna Labs */ - { PCI_VENDOR_ID_AMAZON_ANNAPURNA_LABS, 0x0031, pci_quirk_al_acs }, - /* Zhaoxin multi-function devices */ -diff --git a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c -index adc6394626ce83..f914f016b3d2ce 100644 ---- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c -+++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c -@@ -95,12 +95,12 @@ static u32 phy_tx_preemp_amp_tune_from_property(u32 microamp) - static u32 phy_tx_vboost_level_from_property(u32 microvolt) - { - switch (microvolt) { -- case 0 ... 960: -- return 0; -- case 961 ... 1160: -- return 2; -- default: -+ case 1156: -+ return 5; -+ case 844: - return 3; -+ default: -+ return 4; - } - } - -diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c -index 1a39fd97a9005a..ef87a6045e073a 100644 ---- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c -+++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c -@@ -358,9 +358,7 @@ static int armada_37xx_pmx_set_by_name(struct pinctrl_dev *pctldev, - - val = grp->val[func]; - -- regmap_update_bits(info->regmap, reg, mask, val); -- -- return 0; -+ return regmap_update_bits(info->regmap, reg, mask, val); - } - - static int armada_37xx_pmx_set(struct pinctrl_dev *pctldev, -@@ -402,10 +400,13 @@ static int armada_37xx_gpio_get_direction(struct gpio_chip *chip, - struct armada_37xx_pinctrl *info = gpiochip_get_data(chip); - unsigned int reg = OUTPUT_EN; - unsigned int val, mask; -+ int ret; - - armada_37xx_update_reg(®, &offset); - mask = BIT(offset); -- regmap_read(info->regmap, reg, &val); -+ ret = regmap_read(info->regmap, reg, &val); -+ if (ret) -+ return ret; - - if (val & mask) - return GPIO_LINE_DIRECTION_OUT; -@@ -442,11 +443,14 @@ static int armada_37xx_gpio_get(struct gpio_chip *chip, unsigned int offset) - struct armada_37xx_pinctrl *info = gpiochip_get_data(chip); - unsigned int reg = INPUT_VAL; - unsigned int val, mask; -+ int ret; - - armada_37xx_update_reg(®, &offset); - mask = BIT(offset); - -- regmap_read(info->regmap, reg, &val); -+ ret = regmap_read(info->regmap, reg, &val); -+ if (ret) -+ return ret; - - return (val & mask) != 0; - } -@@ -471,16 +475,17 @@ static int armada_37xx_pmx_gpio_set_direction(struct pinctrl_dev *pctldev, - { - struct armada_37xx_pinctrl *info = pinctrl_dev_get_drvdata(pctldev); - struct gpio_chip *chip = range->gc; -+ int ret; - - dev_dbg(info->dev, "gpio_direction for pin %u as %s-%d to %s\n", - offset, range->name, offset, input ? "input" : "output"); - - if (input) -- armada_37xx_gpio_direction_input(chip, offset); -+ ret = armada_37xx_gpio_direction_input(chip, offset); - else -- armada_37xx_gpio_direction_output(chip, offset, 0); -+ ret = armada_37xx_gpio_direction_output(chip, offset, 0); - -- return 0; -+ return ret; - } - - static int armada_37xx_gpio_request_enable(struct pinctrl_dev *pctldev, -diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c -index fd97b6ee2a8d11..ca45c1f36a89bd 100644 ---- a/drivers/pinctrl/pinctrl-mcp23s08.c -+++ b/drivers/pinctrl/pinctrl-mcp23s08.c -@@ -612,6 +612,14 @@ int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev, - - mcp->reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW); - -+ /* -+ * Reset the chip - we don't really know what state it's in, so reset -+ * all pins to input first to prevent surprises. -+ */ -+ ret = mcp_write(mcp, MCP_IODIR, mcp->chip.ngpio == 16 ? 0xFFFF : 0xFF); -+ if (ret < 0) -+ return ret; -+ - /* verify MCP_IOCON.SEQOP = 0, so sequential reads work, - * and MCP_IOCON.HAEN = 1, so we work with all chips. - */ -diff --git a/drivers/platform/loongarch/loongson-laptop.c b/drivers/platform/loongarch/loongson-laptop.c -index 99203584949daa..5fcfa3a7970b75 100644 ---- a/drivers/platform/loongarch/loongson-laptop.c -+++ b/drivers/platform/loongarch/loongson-laptop.c -@@ -56,8 +56,7 @@ static struct input_dev *generic_inputdev; - static acpi_handle hotkey_handle; - static struct key_entry hotkey_keycode_map[GENERIC_HOTKEY_MAP_MAX]; - --int loongson_laptop_turn_on_backlight(void); --int loongson_laptop_turn_off_backlight(void); -+static bool bl_powered; - static int loongson_laptop_backlight_update(struct backlight_device *bd); - - /* 2. ACPI Helpers and device model */ -@@ -354,16 +353,42 @@ static int ec_backlight_level(u8 level) - return level; - } - -+static int ec_backlight_set_power(bool state) -+{ -+ int status; -+ union acpi_object arg0 = { ACPI_TYPE_INTEGER }; -+ struct acpi_object_list args = { 1, &arg0 }; -+ -+ arg0.integer.value = state; -+ status = acpi_evaluate_object(NULL, "\\BLSW", &args, NULL); -+ if (ACPI_FAILURE(status)) { -+ pr_info("Loongson lvds error: 0x%x\n", status); -+ return -EIO; -+ } -+ -+ return 0; -+} -+ - static int loongson_laptop_backlight_update(struct backlight_device *bd) - { -- int lvl = ec_backlight_level(bd->props.brightness); -+ bool target_powered = !backlight_is_blank(bd); -+ int ret = 0, lvl = ec_backlight_level(bd->props.brightness); - - if (lvl < 0) - return -EIO; -+ - if (ec_set_brightness(lvl)) - return -EIO; - -- return 0; -+ if (target_powered != bl_powered) { -+ ret = ec_backlight_set_power(target_powered); -+ if (ret < 0) -+ return ret; -+ -+ bl_powered = target_powered; -+ } -+ -+ return ret; - } - - static int loongson_laptop_get_brightness(struct backlight_device *bd) -@@ -384,7 +409,7 @@ static const struct backlight_ops backlight_laptop_ops = { - - static int laptop_backlight_register(void) - { -- int status = 0; -+ int status = 0, ret; - struct backlight_properties props; - - memset(&props, 0, sizeof(props)); -@@ -392,44 +417,20 @@ static int laptop_backlight_register(void) - if (!acpi_evalf(hotkey_handle, &status, "ECLL", "d")) - return -EIO; - -- props.brightness = 1; -+ ret = ec_backlight_set_power(true); -+ if (ret) -+ return ret; -+ -+ bl_powered = true; -+ - props.max_brightness = status; -+ props.brightness = ec_get_brightness(); -+ props.power = FB_BLANK_UNBLANK; - props.type = BACKLIGHT_PLATFORM; - - backlight_device_register("loongson_laptop", - NULL, NULL, &backlight_laptop_ops, &props); - -- return 0; --} -- --int loongson_laptop_turn_on_backlight(void) --{ -- int status; -- union acpi_object arg0 = { ACPI_TYPE_INTEGER }; -- struct acpi_object_list args = { 1, &arg0 }; -- -- arg0.integer.value = 1; -- status = acpi_evaluate_object(NULL, "\\BLSW", &args, NULL); -- if (ACPI_FAILURE(status)) { -- pr_info("Loongson lvds error: 0x%x\n", status); -- return -ENODEV; -- } -- -- return 0; --} -- --int loongson_laptop_turn_off_backlight(void) --{ -- int status; -- union acpi_object arg0 = { ACPI_TYPE_INTEGER }; -- struct acpi_object_list args = { 1, &arg0 }; -- -- arg0.integer.value = 0; -- status = acpi_evaluate_object(NULL, "\\BLSW", &args, NULL); -- if (ACPI_FAILURE(status)) { -- pr_info("Loongson lvds error: 0x%x\n", status); -- return -ENODEV; -- } - - return 0; - } -@@ -611,11 +612,17 @@ static int __init generic_acpi_laptop_init(void) - - static void __exit generic_acpi_laptop_exit(void) - { -+ int i; -+ - if (generic_inputdev) { -- if (input_device_registered) -- input_unregister_device(generic_inputdev); -- else -+ if (!input_device_registered) { - input_free_device(generic_inputdev); -+ } else { -+ input_unregister_device(generic_inputdev); -+ -+ for (i = 0; i < ARRAY_SIZE(generic_sub_drivers); i++) -+ generic_subdriver_exit(&generic_sub_drivers[i]); -+ } - } - } - -diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c -index 946a546cd9dd01..af5cc8aa7988c1 100644 ---- a/drivers/platform/x86/amd/pmc/pmc.c -+++ b/drivers/platform/x86/amd/pmc/pmc.c -@@ -332,6 +332,8 @@ static int amd_pmc_setup_smu_logging(struct amd_pmc_dev *dev) - return -ENOMEM; - } - -+ memset_io(dev->smu_virt_addr, 0, sizeof(struct smu_metrics)); -+ - /* Start the logging */ - amd_pmc_send_cmd(dev, 0, NULL, SMU_MSG_LOG_RESET, false); - amd_pmc_send_cmd(dev, 0, NULL, SMU_MSG_LOG_START, false); -diff --git a/drivers/platform/x86/dell/dell_rbu.c b/drivers/platform/x86/dell/dell_rbu.c -index 9f51e0fcab04e1..fee20866b41e41 100644 ---- a/drivers/platform/x86/dell/dell_rbu.c -+++ b/drivers/platform/x86/dell/dell_rbu.c -@@ -292,7 +292,7 @@ static int packet_read_list(char *data, size_t * pread_length) - remaining_bytes = *pread_length; - bytes_read = rbu_data.packet_read_count; - -- list_for_each_entry(newpacket, (&packet_data_head.list)->next, list) { -+ list_for_each_entry(newpacket, &packet_data_head.list, list) { - bytes_copied = do_packet_read(pdest, newpacket, - remaining_bytes, bytes_read, &temp_count); - remaining_bytes -= bytes_copied; -@@ -315,14 +315,14 @@ static void packet_empty_list(void) - { - struct packet_data *newpacket, *tmp; - -- list_for_each_entry_safe(newpacket, tmp, (&packet_data_head.list)->next, list) { -+ list_for_each_entry_safe(newpacket, tmp, &packet_data_head.list, list) { - list_del(&newpacket->list); - - /* - * zero out the RBU packet memory before freeing - * to make sure there are no stale RBU packets left in memory - */ -- memset(newpacket->data, 0, rbu_data.packetsize); -+ memset(newpacket->data, 0, newpacket->length); - set_memory_wb((unsigned long)newpacket->data, - 1 << newpacket->ordernum); - free_pages((unsigned long) newpacket->data, -diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c -index 88eefccb6ed276..50013af0537c36 100644 ---- a/drivers/platform/x86/ideapad-laptop.c -+++ b/drivers/platform/x86/ideapad-laptop.c -@@ -1101,6 +1101,9 @@ static const struct key_entry ideapad_keymap[] = { - { KE_KEY, 0x27 | IDEAPAD_WMI_KEY, { KEY_HELP } }, - /* Refresh Rate Toggle */ - { KE_KEY, 0x0a | IDEAPAD_WMI_KEY, { KEY_DISPLAYTOGGLE } }, -+ /* Specific to some newer models */ -+ { KE_KEY, 0x3e | IDEAPAD_WMI_KEY, { KEY_MICMUTE } }, -+ { KE_KEY, 0x3f | IDEAPAD_WMI_KEY, { KEY_RFKILL } }, - - { KE_END }, - }; -diff --git a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c -index 10502216454824..5be3b26876151c 100644 ---- a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c -+++ b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c -@@ -269,10 +269,13 @@ static int uncore_probe(struct auxiliary_device *auxdev, const struct auxiliary_ - - /* Get the package ID from the TPMI core */ - plat_info = tpmi_get_platform_data(auxdev); -- if (plat_info) -- pkg = plat_info->package_id; -- else -+ if (unlikely(!plat_info)) { - dev_info(&auxdev->dev, "Platform information is NULL\n"); -+ ret = -ENODEV; -+ goto err_rem_common; -+ } -+ -+ pkg = plat_info->package_id; - - for (i = 0; i < num_resources; ++i) { - struct tpmi_uncore_power_domain_info *pd_info; -diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c -index 23c87365675742..e51fa2c694bc6d 100644 ---- a/drivers/power/supply/bq27xxx_battery.c -+++ b/drivers/power/supply/bq27xxx_battery.c -@@ -2044,7 +2044,7 @@ static int bq27xxx_battery_get_property(struct power_supply *psy, - mutex_unlock(&di->lock); - - if (psp != POWER_SUPPLY_PROP_PRESENT && di->cache.flags < 0) -- return -ENODEV; -+ return di->cache.flags; - - switch (psp) { - case POWER_SUPPLY_PROP_STATUS: -diff --git a/drivers/power/supply/bq27xxx_battery_i2c.c b/drivers/power/supply/bq27xxx_battery_i2c.c -index 886e0a8e2abd1e..8877fa333cd02e 100644 ---- a/drivers/power/supply/bq27xxx_battery_i2c.c -+++ b/drivers/power/supply/bq27xxx_battery_i2c.c -@@ -6,6 +6,7 @@ - * Andrew F. Davis - */ - -+#include - #include - #include - #include -@@ -32,6 +33,7 @@ static int bq27xxx_battery_i2c_read(struct bq27xxx_device_info *di, u8 reg, - struct i2c_msg msg[2]; - u8 data[2]; - int ret; -+ int retry = 0; - - if (!client->adapter) - return -ENODEV; -@@ -48,7 +50,16 @@ static int bq27xxx_battery_i2c_read(struct bq27xxx_device_info *di, u8 reg, - else - msg[1].len = 2; - -- ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg)); -+ do { -+ ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg)); -+ if (ret == -EBUSY && ++retry < 3) { -+ /* sleep 10 milliseconds when busy */ -+ usleep_range(10000, 11000); -+ continue; -+ } -+ break; -+ } while (1); -+ - if (ret < 0) - return ret; - -diff --git a/drivers/power/supply/collie_battery.c b/drivers/power/supply/collie_battery.c -index 68390bd1004f04..3daf7befc0bf64 100644 ---- a/drivers/power/supply/collie_battery.c -+++ b/drivers/power/supply/collie_battery.c -@@ -440,6 +440,7 @@ static int collie_bat_probe(struct ucb1x00_dev *dev) - - static void collie_bat_remove(struct ucb1x00_dev *dev) - { -+ device_init_wakeup(&ucb->dev, 0); - free_irq(gpiod_to_irq(collie_bat_main.gpio_full), &collie_bat_main); - power_supply_unregister(collie_bat_bu.psy); - power_supply_unregister(collie_bat_main.psy); -diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c -index 6b7e8b7ebcef5e..b7fc260ed43bc4 100644 ---- a/drivers/ptp/ptp_clock.c -+++ b/drivers/ptp/ptp_clock.c -@@ -104,7 +104,8 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct __kernel_timex *tx) - struct ptp_clock_info *ops; - int err = -EOPNOTSUPP; - -- if (ptp_clock_freerun(ptp)) { -+ if (tx->modes & (ADJ_SETOFFSET | ADJ_FREQUENCY | ADJ_OFFSET) && -+ ptp_clock_freerun(ptp)) { - pr_err("ptp: physical clock is free running\n"); - return -EBUSY; - } -diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h -index d0eb4555720eba..a54124269c2f49 100644 ---- a/drivers/ptp/ptp_private.h -+++ b/drivers/ptp/ptp_private.h -@@ -89,7 +89,27 @@ static inline int queue_cnt(const struct timestamp_event_queue *q) - /* Check if ptp virtual clock is in use */ - static inline bool ptp_vclock_in_use(struct ptp_clock *ptp) - { -- return !ptp->is_virtual_clock; -+ bool in_use = false; -+ -+ /* Virtual clocks can't be stacked on top of virtual clocks. -+ * Avoid acquiring the n_vclocks_mux on virtual clocks, to allow this -+ * function to be called from code paths where the n_vclocks_mux of the -+ * parent physical clock is already held. Functionally that's not an -+ * issue, but lockdep would complain, because they have the same lock -+ * class. -+ */ -+ if (ptp->is_virtual_clock) -+ return false; -+ -+ if (mutex_lock_interruptible(&ptp->n_vclocks_mux)) -+ return true; -+ -+ if (ptp->n_vclocks) -+ in_use = true; -+ -+ mutex_unlock(&ptp->n_vclocks_mux); -+ -+ return in_use; - } - - /* Check if ptp clock shall be free running */ -diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c -index 49f8d111e54623..897642e62068a3 100644 ---- a/drivers/rapidio/rio_cm.c -+++ b/drivers/rapidio/rio_cm.c -@@ -787,6 +787,9 @@ static int riocm_ch_send(u16 ch_id, void *buf, int len) - if (buf == NULL || ch_id == 0 || len == 0 || len > RIO_MAX_MSG_SIZE) - return -EINVAL; - -+ if (len < sizeof(struct rio_ch_chan_hdr)) -+ return -EINVAL; /* insufficient data from user */ -+ - ch = riocm_get_channel(ch_id); - if (!ch) { - riocm_error("%s(%d) ch_%d not found", current->comm, -diff --git a/drivers/regulator/max14577-regulator.c b/drivers/regulator/max14577-regulator.c -index 5e7171b9065ae7..41fd15adfd1fdd 100644 ---- a/drivers/regulator/max14577-regulator.c -+++ b/drivers/regulator/max14577-regulator.c -@@ -40,11 +40,14 @@ static int max14577_reg_get_current_limit(struct regulator_dev *rdev) - struct max14577 *max14577 = rdev_get_drvdata(rdev); - const struct maxim_charger_current *limits = - &maxim_charger_currents[max14577->dev_type]; -+ int ret; - - if (rdev_get_id(rdev) != MAX14577_CHARGER) - return -EINVAL; - -- max14577_read_reg(rmap, MAX14577_CHG_REG_CHG_CTRL4, ®_data); -+ ret = max14577_read_reg(rmap, MAX14577_CHG_REG_CHG_CTRL4, ®_data); -+ if (ret < 0) -+ return ret; - - if ((reg_data & CHGCTRL4_MBCICHWRCL_MASK) == 0) - return limits->min; -diff --git a/drivers/regulator/max20086-regulator.c b/drivers/regulator/max20086-regulator.c -index 1cf04d1efb3313..8fcca52026bf15 100644 ---- a/drivers/regulator/max20086-regulator.c -+++ b/drivers/regulator/max20086-regulator.c -@@ -29,7 +29,7 @@ - #define MAX20086_REG_ADC4 0x09 - - /* DEVICE IDs */ --#define MAX20086_DEVICE_ID_MAX20086 0x40 -+#define MAX20086_DEVICE_ID_MAX20086 0x30 - #define MAX20086_DEVICE_ID_MAX20087 0x20 - #define MAX20086_DEVICE_ID_MAX20088 0x10 - #define MAX20086_DEVICE_ID_MAX20089 0x00 -@@ -264,7 +264,7 @@ static int max20086_i2c_probe(struct i2c_client *i2c) - * shutdown. - */ - flags = boot_on ? GPIOD_OUT_HIGH : GPIOD_OUT_LOW; -- chip->ena_gpiod = devm_gpiod_get(chip->dev, "enable", flags); -+ chip->ena_gpiod = devm_gpiod_get_optional(chip->dev, "enable", flags); - if (IS_ERR(chip->ena_gpiod)) { - ret = PTR_ERR(chip->ena_gpiod); - dev_err(chip->dev, "Failed to get enable GPIO: %d\n", ret); -diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c -index 0c363ca566ffdb..2d4ae3b5af86f6 100644 ---- a/drivers/remoteproc/remoteproc_core.c -+++ b/drivers/remoteproc/remoteproc_core.c -@@ -1616,7 +1616,7 @@ static int rproc_attach(struct rproc *rproc) - ret = rproc_set_rsc_table(rproc); - if (ret) { - dev_err(dev, "can't load resource table: %d\n", ret); -- goto unprepare_device; -+ goto clean_up_resources; - } - - /* reset max_notifyid */ -@@ -1633,7 +1633,7 @@ static int rproc_attach(struct rproc *rproc) - ret = rproc_handle_resources(rproc, rproc_loading_handlers); - if (ret) { - dev_err(dev, "Failed to process resources: %d\n", ret); -- goto unprepare_device; -+ goto clean_up_resources; - } - - /* Allocate carveout resources associated to rproc */ -@@ -1652,9 +1652,9 @@ static int rproc_attach(struct rproc *rproc) - - clean_up_resources: - rproc_resource_cleanup(rproc); --unprepare_device: - /* release HW resources if needed */ - rproc_unprepare_device(rproc); -+ kfree(rproc->clean_table); - disable_iommu: - rproc_disable_iommu(rproc); - return ret; -diff --git a/drivers/s390/scsi/zfcp_sysfs.c b/drivers/s390/scsi/zfcp_sysfs.c -index cb67fa80fb12c8..a95da6768f6656 100644 ---- a/drivers/s390/scsi/zfcp_sysfs.c -+++ b/drivers/s390/scsi/zfcp_sysfs.c -@@ -450,6 +450,8 @@ static ssize_t zfcp_sysfs_unit_add_store(struct device *dev, - if (kstrtoull(buf, 0, (unsigned long long *) &fcp_lun)) - return -EINVAL; - -+ flush_work(&port->rport_work); -+ - retval = zfcp_unit_add(port, fcp_lun); - if (retval) - return retval; -diff --git a/drivers/scsi/elx/efct/efct_hw.c b/drivers/scsi/elx/efct/efct_hw.c -index 5a5525054d71c8..5b079b8b7a082b 100644 ---- a/drivers/scsi/elx/efct/efct_hw.c -+++ b/drivers/scsi/elx/efct/efct_hw.c -@@ -1120,7 +1120,7 @@ int - efct_hw_parse_filter(struct efct_hw *hw, void *value) - { - int rc = 0; -- char *p = NULL; -+ char *p = NULL, *pp = NULL; - char *token; - u32 idx = 0; - -@@ -1132,6 +1132,7 @@ efct_hw_parse_filter(struct efct_hw *hw, void *value) - efc_log_err(hw->os, "p is NULL\n"); - return -ENOMEM; - } -+ pp = p; - - idx = 0; - while ((token = strsep(&p, ",")) && *token) { -@@ -1144,7 +1145,7 @@ efct_hw_parse_filter(struct efct_hw *hw, void *value) - if (idx == ARRAY_SIZE(hw->config.filter_def)) - break; - } -- kfree(p); -+ kfree(pp); - - return rc; - } -diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c -index 5c9bc8af3c2df8..ff442833387713 100644 ---- a/drivers/scsi/lpfc/lpfc_hbadisc.c -+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c -@@ -5101,7 +5101,7 @@ lpfc_check_sli_ndlp(struct lpfc_hba *phba, - case CMD_GEN_REQUEST64_CR: - if (iocb->ndlp == ndlp) - return 1; -- fallthrough; -+ break; - case CMD_ELS_REQUEST64_CR: - if (remote_id == ndlp->nlp_DID) - return 1; -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index 4a9fa00eeb798e..4cf935b7223af2 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -6014,9 +6014,9 @@ lpfc_sli4_get_ctl_attr(struct lpfc_hba *phba) - phba->sli4_hba.flash_id = bf_get(lpfc_cntl_attr_flash_id, cntl_attr); - phba->sli4_hba.asic_rev = bf_get(lpfc_cntl_attr_asic_rev, cntl_attr); - -- memset(phba->BIOSVersion, 0, sizeof(phba->BIOSVersion)); -- strlcat(phba->BIOSVersion, (char *)cntl_attr->bios_ver_str, -+ memcpy(phba->BIOSVersion, cntl_attr->bios_ver_str, - sizeof(phba->BIOSVersion)); -+ phba->BIOSVersion[sizeof(phba->BIOSVersion) - 1] = '\0'; - - lpfc_printf_log(phba, KERN_INFO, LOG_SLI, - "3086 lnk_type:%d, lnk_numb:%d, bios_ver:%s, " -diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c -index 48b0ca92b44fb3..954a1cc50ba746 100644 ---- a/drivers/scsi/storvsc_drv.c -+++ b/drivers/scsi/storvsc_drv.c -@@ -362,7 +362,7 @@ MODULE_PARM_DESC(ring_avail_percent_lowater, - /* - * Timeout in seconds for all devices managed by this driver. - */ --static int storvsc_timeout = 180; -+static const int storvsc_timeout = 180; - - #if IS_ENABLED(CONFIG_SCSI_FC_ATTRS) - static struct scsi_transport_template *fc_transport_template; -@@ -768,7 +768,7 @@ static void handle_multichannel_storage(struct hv_device *device, int max_chns) - return; - } - -- t = wait_for_completion_timeout(&request->wait_event, 10*HZ); -+ t = wait_for_completion_timeout(&request->wait_event, storvsc_timeout * HZ); - if (t == 0) { - dev_err(dev, "Failed to create sub-channel: timed out\n"); - return; -@@ -833,7 +833,7 @@ static int storvsc_execute_vstor_op(struct hv_device *device, - if (ret != 0) - return ret; - -- t = wait_for_completion_timeout(&request->wait_event, 5*HZ); -+ t = wait_for_completion_timeout(&request->wait_event, storvsc_timeout * HZ); - if (t == 0) - return -ETIMEDOUT; - -@@ -1351,6 +1351,8 @@ static int storvsc_connect_to_vsp(struct hv_device *device, u32 ring_size, - return ret; - - ret = storvsc_channel_init(device, is_fc); -+ if (ret) -+ vmbus_close(device->channel); - - return ret; - } -@@ -1668,7 +1670,7 @@ static int storvsc_host_reset_handler(struct scsi_cmnd *scmnd) - if (ret != 0) - return FAILED; - -- t = wait_for_completion_timeout(&request->wait_event, 5*HZ); -+ t = wait_for_completion_timeout(&request->wait_event, storvsc_timeout * HZ); - if (t == 0) - return TIMEOUT_ERROR; - -diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c -index 2d0883a6408277..31d82a042dad20 100644 ---- a/drivers/staging/iio/impedance-analyzer/ad5933.c -+++ b/drivers/staging/iio/impedance-analyzer/ad5933.c -@@ -412,7 +412,7 @@ static ssize_t ad5933_store(struct device *dev, - ret = ad5933_cmd(st, 0); - break; - case AD5933_OUT_SETTLING_CYCLES: -- val = clamp(val, (u16)0, (u16)0x7FF); -+ val = clamp(val, (u16)0, (u16)0x7FC); - st->settling_cycles = val; - - /* 2x, 4x handling, see datasheet */ -diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c -index 0eb342de0b0018..d7ad16f262b2eb 100644 ---- a/drivers/tee/tee_core.c -+++ b/drivers/tee/tee_core.c -@@ -10,6 +10,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -19,7 +20,7 @@ - - #define TEE_NUM_DEVICES 32 - --#define TEE_IOCTL_PARAM_SIZE(x) (sizeof(struct tee_param) * (x)) -+#define TEE_IOCTL_PARAM_SIZE(x) (size_mul(sizeof(struct tee_param), (x))) - - #define TEE_UUID_NS_NAME_SIZE 128 - -@@ -487,7 +488,7 @@ static int tee_ioctl_open_session(struct tee_context *ctx, - if (copy_from_user(&arg, uarg, sizeof(arg))) - return -EFAULT; - -- if (sizeof(arg) + TEE_IOCTL_PARAM_SIZE(arg.num_params) != buf.buf_len) -+ if (size_add(sizeof(arg), TEE_IOCTL_PARAM_SIZE(arg.num_params)) != buf.buf_len) - return -EINVAL; - - if (arg.num_params) { -@@ -565,7 +566,7 @@ static int tee_ioctl_invoke(struct tee_context *ctx, - if (copy_from_user(&arg, uarg, sizeof(arg))) - return -EFAULT; - -- if (sizeof(arg) + TEE_IOCTL_PARAM_SIZE(arg.num_params) != buf.buf_len) -+ if (size_add(sizeof(arg), TEE_IOCTL_PARAM_SIZE(arg.num_params)) != buf.buf_len) - return -EINVAL; - - if (arg.num_params) { -@@ -699,7 +700,7 @@ static int tee_ioctl_supp_recv(struct tee_context *ctx, - if (get_user(num_params, &uarg->num_params)) - return -EFAULT; - -- if (sizeof(*uarg) + TEE_IOCTL_PARAM_SIZE(num_params) != buf.buf_len) -+ if (size_add(sizeof(*uarg), TEE_IOCTL_PARAM_SIZE(num_params)) != buf.buf_len) - return -EINVAL; - - params = kcalloc(num_params, sizeof(struct tee_param), GFP_KERNEL); -@@ -798,7 +799,7 @@ static int tee_ioctl_supp_send(struct tee_context *ctx, - get_user(num_params, &uarg->num_params)) - return -EFAULT; - -- if (sizeof(*uarg) + TEE_IOCTL_PARAM_SIZE(num_params) > buf.buf_len) -+ if (size_add(sizeof(*uarg), TEE_IOCTL_PARAM_SIZE(num_params)) > buf.buf_len) - return -EINVAL; - - params = kcalloc(num_params, sizeof(struct tee_param), GFP_KERNEL); -diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c -index be7e57e1d1e36a..dab5658d9d54a6 100644 ---- a/drivers/tty/serial/sh-sci.c -+++ b/drivers/tty/serial/sh-sci.c -@@ -3424,6 +3424,22 @@ static int sci_probe_single(struct platform_device *dev, - } - - if (sci_uart_earlycon && sci_ports[0].port.mapbase == sci_res->start) { -+ /* -+ * In case: -+ * - this is the earlycon port (mapped on index 0 in sci_ports[]) and -+ * - it now maps to an alias other than zero and -+ * - the earlycon is still alive (e.g., "earlycon keep_bootcon" is -+ * available in bootargs) -+ * -+ * we need to avoid disabling clocks and PM domains through the runtime -+ * PM APIs called in __device_attach(). For this, increment the runtime -+ * PM reference counter (the clocks and PM domains were already enabled -+ * by the bootloader). Otherwise the earlycon may access the HW when it -+ * has no clocks enabled leading to failures (infinite loop in -+ * sci_poll_put_char()). -+ */ -+ pm_runtime_get_noresume(&dev->dev); -+ - /* - * Skip cleanup the sci_port[0] in early_console_exit(), this - * port is the same as the earlycon one. -diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c -index a2c7abf8c289ef..2804a4f749750a 100644 ---- a/drivers/uio/uio_hv_generic.c -+++ b/drivers/uio/uio_hv_generic.c -@@ -288,13 +288,13 @@ hv_uio_probe(struct hv_device *dev, - pdata->info.mem[INT_PAGE_MAP].name = "int_page"; - pdata->info.mem[INT_PAGE_MAP].addr - = (uintptr_t)vmbus_connection.int_page; -- pdata->info.mem[INT_PAGE_MAP].size = PAGE_SIZE; -+ pdata->info.mem[INT_PAGE_MAP].size = HV_HYP_PAGE_SIZE; - pdata->info.mem[INT_PAGE_MAP].memtype = UIO_MEM_LOGICAL; - - pdata->info.mem[MON_PAGE_MAP].name = "monitor_page"; - pdata->info.mem[MON_PAGE_MAP].addr - = (uintptr_t)vmbus_connection.monitor_pages[1]; -- pdata->info.mem[MON_PAGE_MAP].size = PAGE_SIZE; -+ pdata->info.mem[MON_PAGE_MAP].size = HV_HYP_PAGE_SIZE; - pdata->info.mem[MON_PAGE_MAP].memtype = UIO_MEM_LOGICAL; - - pdata->recv_buf = vzalloc(RECV_BUFFER_SIZE); -diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c -index 7ad047bcae1711..c9ec89649b0552 100644 ---- a/drivers/video/console/vgacon.c -+++ b/drivers/video/console/vgacon.c -@@ -1139,7 +1139,7 @@ static bool vgacon_scroll(struct vc_data *c, unsigned int t, unsigned int b, - c->vc_screenbuf_size - delta); - c->vc_origin = vga_vram_end - c->vc_screenbuf_size; - vga_rolled_over = 0; -- } else -+ } else if (oldo - delta >= (unsigned long)c->vc_screenbuf) - c->vc_origin -= delta; - c->vc_scr_end = c->vc_origin + c->vc_screenbuf_size; - scr_memsetw((u16 *) (c->vc_origin), c->vc_video_erase_char, -diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c -index 7a6f9a3cb3ba34..75996ef9992e41 100644 ---- a/drivers/video/fbdev/core/fbcon.c -+++ b/drivers/video/fbdev/core/fbcon.c -@@ -115,9 +115,14 @@ static signed char con2fb_map_boot[MAX_NR_CONSOLES]; - - static struct fb_info *fbcon_info_from_console(int console) - { -+ signed char fb; - WARN_CONSOLE_UNLOCKED(); - -- return fbcon_registered_fb[con2fb_map[console]]; -+ fb = con2fb_map[console]; -+ if (fb < 0 || fb >= ARRAY_SIZE(fbcon_registered_fb)) -+ return NULL; -+ -+ return fbcon_registered_fb[fb]; - } - - static int logo_lines; -diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c -index ee44a46a66be1c..52bd3af5436908 100644 ---- a/drivers/video/fbdev/core/fbmem.c -+++ b/drivers/video/fbdev/core/fbmem.c -@@ -868,8 +868,10 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var) - !list_empty(&info->modelist)) - ret = fb_add_videomode(&mode, &info->modelist); - -- if (ret) -+ if (ret) { -+ info->var = old_var; - return ret; -+ } - - event.info = info; - event.data = &mode; -@@ -928,7 +930,7 @@ static int fb_check_foreignness(struct fb_info *fi) - - static int do_register_framebuffer(struct fb_info *fb_info) - { -- int i; -+ int i, err = 0; - struct fb_videomode mode; - - if (fb_check_foreignness(fb_info)) -@@ -937,10 +939,18 @@ static int do_register_framebuffer(struct fb_info *fb_info) - if (num_registered_fb == FB_MAX) - return -ENXIO; - -- num_registered_fb++; - for (i = 0 ; i < FB_MAX; i++) - if (!registered_fb[i]) - break; -+ -+ if (!fb_info->modelist.prev || !fb_info->modelist.next) -+ INIT_LIST_HEAD(&fb_info->modelist); -+ -+ fb_var_to_videomode(&mode, &fb_info->var); -+ err = fb_add_videomode(&mode, &fb_info->modelist); -+ if (err < 0) -+ return err; -+ - fb_info->node = i; - refcount_set(&fb_info->count, 1); - mutex_init(&fb_info->lock); -@@ -966,16 +976,12 @@ static int do_register_framebuffer(struct fb_info *fb_info) - if (!fb_info->pixmap.blit_y) - fb_info->pixmap.blit_y = ~(u32)0; - -- if (!fb_info->modelist.prev || !fb_info->modelist.next) -- INIT_LIST_HEAD(&fb_info->modelist); -- - if (fb_info->skip_vt_switch) - pm_vt_switch_required(fb_info->device, false); - else - pm_vt_switch_required(fb_info->device, true); - -- fb_var_to_videomode(&mode, &fb_info->var); -- fb_add_videomode(&mode, &fb_info->modelist); -+ num_registered_fb++; - registered_fb[i] = fb_info; - - #ifdef CONFIG_GUMSTIX_AM200EPD -diff --git a/drivers/video/screen_info_pci.c b/drivers/video/screen_info_pci.c -index 6c583351714100..66bfc1d0a6dc82 100644 ---- a/drivers/video/screen_info_pci.c -+++ b/drivers/video/screen_info_pci.c -@@ -7,8 +7,8 @@ - - static struct pci_dev *screen_info_lfb_pdev; - static size_t screen_info_lfb_bar; --static resource_size_t screen_info_lfb_offset; --static struct resource screen_info_lfb_res = DEFINE_RES_MEM(0, 0); -+static resource_size_t screen_info_lfb_res_start; // original start of resource -+static resource_size_t screen_info_lfb_offset; // framebuffer offset within resource - - static bool __screen_info_relocation_is_valid(const struct screen_info *si, struct resource *pr) - { -@@ -31,7 +31,7 @@ void screen_info_apply_fixups(void) - if (screen_info_lfb_pdev) { - struct resource *pr = &screen_info_lfb_pdev->resource[screen_info_lfb_bar]; - -- if (pr->start != screen_info_lfb_res.start) { -+ if (pr->start != screen_info_lfb_res_start) { - if (__screen_info_relocation_is_valid(si, pr)) { - /* - * Only update base if we have an actual -@@ -47,46 +47,67 @@ void screen_info_apply_fixups(void) - } - } - -+static int __screen_info_lfb_pci_bus_region(const struct screen_info *si, unsigned int type, -+ struct pci_bus_region *r) -+{ -+ u64 base, size; -+ -+ base = __screen_info_lfb_base(si); -+ if (!base) -+ return -EINVAL; -+ -+ size = __screen_info_lfb_size(si, type); -+ if (!size) -+ return -EINVAL; -+ -+ r->start = base; -+ r->end = base + size - 1; -+ -+ return 0; -+} -+ - static void screen_info_fixup_lfb(struct pci_dev *pdev) - { - unsigned int type; -- struct resource res[SCREEN_INFO_MAX_RESOURCES]; -- size_t i, numres; -+ struct pci_bus_region bus_region; - int ret; -+ struct resource r = { -+ .flags = IORESOURCE_MEM, -+ }; -+ const struct resource *pr; - const struct screen_info *si = &screen_info; - - if (screen_info_lfb_pdev) - return; // already found - - type = screen_info_video_type(si); -- if (type != VIDEO_TYPE_EFI) -- return; // only applies to EFI -+ if (!__screen_info_has_lfb(type)) -+ return; // only applies to EFI; maybe VESA - -- ret = screen_info_resources(si, res, ARRAY_SIZE(res)); -+ ret = __screen_info_lfb_pci_bus_region(si, type, &bus_region); - if (ret < 0) - return; -- numres = ret; - -- for (i = 0; i < numres; ++i) { -- struct resource *r = &res[i]; -- const struct resource *pr; -- -- if (!(r->flags & IORESOURCE_MEM)) -- continue; -- pr = pci_find_resource(pdev, r); -- if (!pr) -- continue; -- -- /* -- * We've found a PCI device with the framebuffer -- * resource. Store away the parameters to track -- * relocation of the framebuffer aperture. -- */ -- screen_info_lfb_pdev = pdev; -- screen_info_lfb_bar = pr - pdev->resource; -- screen_info_lfb_offset = r->start - pr->start; -- memcpy(&screen_info_lfb_res, r, sizeof(screen_info_lfb_res)); -- } -+ /* -+ * Translate the PCI bus address to resource. Account -+ * for an offset if the framebuffer is behind a PCI host -+ * bridge. -+ */ -+ pcibios_bus_to_resource(pdev->bus, &r, &bus_region); -+ -+ pr = pci_find_resource(pdev, &r); -+ if (!pr) -+ return; -+ -+ /* -+ * We've found a PCI device with the framebuffer -+ * resource. Store away the parameters to track -+ * relocation of the framebuffer aperture. -+ */ -+ screen_info_lfb_pdev = pdev; -+ screen_info_lfb_bar = pr - pdev->resource; -+ screen_info_lfb_offset = r.start - pr->start; -+ screen_info_lfb_res_start = bus_region.start; - } - DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_ANY_ID, PCI_ANY_ID, PCI_BASE_CLASS_DISPLAY, 16, - screen_info_fixup_lfb); -diff --git a/drivers/watchdog/da9052_wdt.c b/drivers/watchdog/da9052_wdt.c -index d708c091bf1b1e..180526220d8c42 100644 ---- a/drivers/watchdog/da9052_wdt.c -+++ b/drivers/watchdog/da9052_wdt.c -@@ -164,6 +164,7 @@ static int da9052_wdt_probe(struct platform_device *pdev) - da9052_wdt = &driver_data->wdt; - - da9052_wdt->timeout = DA9052_DEF_TIMEOUT; -+ da9052_wdt->min_hw_heartbeat_ms = DA9052_TWDMIN; - da9052_wdt->info = &da9052_wdt_info; - da9052_wdt->ops = &da9052_wdt_ops; - da9052_wdt->parent = dev; -diff --git a/fs/ceph/super.c b/fs/ceph/super.c -index 29026ba4f02290..84e855e8929b03 100644 ---- a/fs/ceph/super.c -+++ b/fs/ceph/super.c -@@ -1220,6 +1220,7 @@ static int ceph_set_super(struct super_block *s, struct fs_context *fc) - s->s_time_min = 0; - s->s_time_max = U32_MAX; - s->s_flags |= SB_NODIRATIME | SB_NOATIME; -+ s->s_magic = CEPH_SUPER_MAGIC; - - ceph_fscrypt_set_ops(s); - -diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c -index 18677cd4e62f54..2df99cd1034d4e 100644 ---- a/fs/configfs/dir.c -+++ b/fs/configfs/dir.c -@@ -593,7 +593,7 @@ static int populate_attrs(struct config_item *item) - break; - } - } -- if (t->ct_bin_attrs) { -+ if (!error && t->ct_bin_attrs) { - for (i = 0; (bin_attr = t->ct_bin_attrs[i]) != NULL; i++) { - error = configfs_create_bin_file(item, bin_attr); - if (error) -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index 81fe87fcbfa068..b55d5e2abeb3cb 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -3351,6 +3351,13 @@ static inline unsigned int ext4_flex_bg_size(struct ext4_sb_info *sbi) - return 1 << sbi->s_log_groups_per_flex; - } - -+static inline loff_t ext4_get_maxbytes(struct inode *inode) -+{ -+ if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) -+ return inode->i_sb->s_maxbytes; -+ return EXT4_SB(inode->i_sb)->s_bitmap_maxbytes; -+} -+ - #define ext4_std_error(sb, errno) \ - do { \ - if ((errno)) \ -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index 39e3661a80c433..a3d3c9fc64262f 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -2374,18 +2374,19 @@ int ext4_ext_calc_credits_for_single_extent(struct inode *inode, int nrblocks, - int ext4_ext_index_trans_blocks(struct inode *inode, int extents) - { - int index; -- int depth; - - /* If we are converting the inline data, only one is needed here. */ - if (ext4_has_inline_data(inode)) - return 1; - -- depth = ext_depth(inode); -- -+ /* -+ * Extent tree can change between the time we estimate credits and -+ * the time we actually modify the tree. Assume the worst case. -+ */ - if (extents <= 1) -- index = depth * 2; -+ index = EXT4_MAX_EXTENT_DEPTH * 2; - else -- index = depth * 3; -+ index = EXT4_MAX_EXTENT_DEPTH * 3; - - return index; - } -@@ -4969,12 +4970,7 @@ static const struct iomap_ops ext4_iomap_xattr_ops = { - - static int ext4_fiemap_check_ranges(struct inode *inode, u64 start, u64 *len) - { -- u64 maxbytes; -- -- if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) -- maxbytes = inode->i_sb->s_maxbytes; -- else -- maxbytes = EXT4_SB(inode->i_sb)->s_bitmap_maxbytes; -+ u64 maxbytes = ext4_get_maxbytes(inode); - - if (*len == 0) - return -EINVAL; -diff --git a/fs/ext4/file.c b/fs/ext4/file.c -index c71af675e310af..b37e0e4a71bfbe 100644 ---- a/fs/ext4/file.c -+++ b/fs/ext4/file.c -@@ -898,12 +898,7 @@ static int ext4_file_open(struct inode *inode, struct file *filp) - loff_t ext4_llseek(struct file *file, loff_t offset, int whence) - { - struct inode *inode = file->f_mapping->host; -- loff_t maxbytes; -- -- if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) -- maxbytes = EXT4_SB(inode->i_sb)->s_bitmap_maxbytes; -- else -- maxbytes = inode->i_sb->s_maxbytes; -+ loff_t maxbytes = ext4_get_maxbytes(inode); - - switch (whence) { - default: -diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c -index 3f363276ddd360..c85647a0ba09fb 100644 ---- a/fs/ext4/inline.c -+++ b/fs/ext4/inline.c -@@ -392,7 +392,7 @@ static int ext4_update_inline_data(handle_t *handle, struct inode *inode, - } - - static int ext4_prepare_inline_data(handle_t *handle, struct inode *inode, -- unsigned int len) -+ loff_t len) - { - int ret, size, no_expand; - struct ext4_inode_info *ei = EXT4_I(inode); -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 86245e27be18db..9694ef6b996e47 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -1011,7 +1011,12 @@ int ext4_walk_page_buffers(handle_t *handle, struct inode *inode, - */ - static int ext4_dirty_journalled_data(handle_t *handle, struct buffer_head *bh) - { -- folio_mark_dirty(bh->b_folio); -+ struct folio *folio = bh->b_folio; -+ struct inode *inode = folio->mapping->host; -+ -+ /* only regular files have a_ops */ -+ if (S_ISREG(inode->i_mode)) -+ folio_mark_dirty(folio); - return ext4_handle_dirty_metadata(handle, NULL, bh); - } - -@@ -4939,7 +4944,8 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, - ei->i_file_acl |= - ((__u64)le16_to_cpu(raw_inode->i_file_acl_high)) << 32; - inode->i_size = ext4_isize(sb, raw_inode); -- if ((size = i_size_read(inode)) < 0) { -+ size = i_size_read(inode); -+ if (size < 0 || size > ext4_get_maxbytes(inode)) { - ext4_error_inode(inode, function, line, 0, - "iget: bad i_size value: %lld", size); - ret = -EFSCORRUPTED; -diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c -index f7ef69f44f3d84..e962de4ecaa2f6 100644 ---- a/fs/f2fs/compress.c -+++ b/fs/f2fs/compress.c -@@ -176,8 +176,7 @@ void f2fs_compress_ctx_add_page(struct compress_ctx *cc, struct page *page) - #ifdef CONFIG_F2FS_FS_LZO - static int lzo_init_compress_ctx(struct compress_ctx *cc) - { -- cc->private = f2fs_kvmalloc(F2FS_I_SB(cc->inode), -- LZO1X_MEM_COMPRESS, GFP_NOFS); -+ cc->private = f2fs_vmalloc(LZO1X_MEM_COMPRESS); - if (!cc->private) - return -ENOMEM; - -@@ -187,7 +186,7 @@ static int lzo_init_compress_ctx(struct compress_ctx *cc) - - static void lzo_destroy_compress_ctx(struct compress_ctx *cc) - { -- kvfree(cc->private); -+ vfree(cc->private); - cc->private = NULL; - } - -@@ -244,7 +243,7 @@ static int lz4_init_compress_ctx(struct compress_ctx *cc) - size = LZ4HC_MEM_COMPRESS; - #endif - -- cc->private = f2fs_kvmalloc(F2FS_I_SB(cc->inode), size, GFP_NOFS); -+ cc->private = f2fs_vmalloc(size); - if (!cc->private) - return -ENOMEM; - -@@ -259,7 +258,7 @@ static int lz4_init_compress_ctx(struct compress_ctx *cc) - - static void lz4_destroy_compress_ctx(struct compress_ctx *cc) - { -- kvfree(cc->private); -+ vfree(cc->private); - cc->private = NULL; - } - -@@ -340,8 +339,7 @@ static int zstd_init_compress_ctx(struct compress_ctx *cc) - params = zstd_get_params(level, cc->rlen); - workspace_size = zstd_cstream_workspace_bound(¶ms.cParams); - -- workspace = f2fs_kvmalloc(F2FS_I_SB(cc->inode), -- workspace_size, GFP_NOFS); -+ workspace = f2fs_vmalloc(workspace_size); - if (!workspace) - return -ENOMEM; - -@@ -349,7 +347,7 @@ static int zstd_init_compress_ctx(struct compress_ctx *cc) - if (!stream) { - f2fs_err_ratelimited(F2FS_I_SB(cc->inode), - "%s zstd_init_cstream failed", __func__); -- kvfree(workspace); -+ vfree(workspace); - return -EIO; - } - -@@ -362,7 +360,7 @@ static int zstd_init_compress_ctx(struct compress_ctx *cc) - - static void zstd_destroy_compress_ctx(struct compress_ctx *cc) - { -- kvfree(cc->private); -+ vfree(cc->private); - cc->private = NULL; - cc->private2 = NULL; - } -@@ -421,8 +419,7 @@ static int zstd_init_decompress_ctx(struct decompress_io_ctx *dic) - - workspace_size = zstd_dstream_workspace_bound(max_window_size); - -- workspace = f2fs_kvmalloc(F2FS_I_SB(dic->inode), -- workspace_size, GFP_NOFS); -+ workspace = f2fs_vmalloc(workspace_size); - if (!workspace) - return -ENOMEM; - -@@ -430,7 +427,7 @@ static int zstd_init_decompress_ctx(struct decompress_io_ctx *dic) - if (!stream) { - f2fs_err_ratelimited(F2FS_I_SB(dic->inode), - "%s zstd_init_dstream failed", __func__); -- kvfree(workspace); -+ vfree(workspace); - return -EIO; - } - -@@ -442,7 +439,7 @@ static int zstd_init_decompress_ctx(struct decompress_io_ctx *dic) - - static void zstd_destroy_decompress_ctx(struct decompress_io_ctx *dic) - { -- kvfree(dic->private); -+ vfree(dic->private); - dic->private = NULL; - dic->private2 = NULL; - } -diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h -index 911c4c64d729d3..2d9a86129bd8de 100644 ---- a/fs/f2fs/f2fs.h -+++ b/fs/f2fs/f2fs.h -@@ -3449,6 +3449,11 @@ static inline void *f2fs_kvzalloc(struct f2fs_sb_info *sbi, - return f2fs_kvmalloc(sbi, size, flags | __GFP_ZERO); - } - -+static inline void *f2fs_vmalloc(size_t size) -+{ -+ return vmalloc(size); -+} -+ - static inline int get_extra_isize(struct inode *inode) - { - return F2FS_I(inode)->i_extra_isize / sizeof(__le32); -diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c -index 06941705e8939f..66721c2093c023 100644 ---- a/fs/f2fs/inode.c -+++ b/fs/f2fs/inode.c -@@ -35,7 +35,9 @@ void f2fs_mark_inode_dirty_sync(struct inode *inode, bool sync) - if (f2fs_inode_dirtied(inode, sync)) - return; - -- if (f2fs_is_atomic_file(inode)) -+ /* only atomic file w/ FI_ATOMIC_COMMITTED can be set vfs dirty */ -+ if (f2fs_is_atomic_file(inode) && -+ !is_inode_flag_set(inode, FI_ATOMIC_COMMITTED)) - return; - - mark_inode_dirty_sync(inode); -@@ -285,6 +287,12 @@ static bool sanity_check_inode(struct inode *inode, struct page *node_page) - return false; - } - -+ if (ino_of_node(node_page) == fi->i_xattr_nid) { -+ f2fs_warn(sbi, "%s: corrupted inode i_ino=%lx, xnid=%x, run fsck to fix.", -+ __func__, inode->i_ino, fi->i_xattr_nid); -+ return false; -+ } -+ - if (f2fs_has_extra_attr(inode)) { - if (!f2fs_sb_has_extra_attr(sbi)) { - f2fs_warn(sbi, "%s: inode (ino=%lx) is with extra_attr, but extra_attr feature is off", -diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c -index 4d6f0a6365fe19..523009bc273209 100644 ---- a/fs/f2fs/namei.c -+++ b/fs/f2fs/namei.c -@@ -560,6 +560,15 @@ static int f2fs_unlink(struct inode *dir, struct dentry *dentry) - goto fail; - } - -+ if (unlikely(inode->i_nlink == 0)) { -+ f2fs_warn(F2FS_I_SB(inode), "%s: inode (ino=%lx) has zero i_nlink", -+ __func__, inode->i_ino); -+ err = -EFSCORRUPTED; -+ set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_FSCK); -+ f2fs_put_page(page, 0); -+ goto fail; -+ } -+ - f2fs_balance_fs(sbi, true); - - f2fs_lock_op(sbi); -diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c -index 156d92b945258a..c7714e954cb540 100644 ---- a/fs/f2fs/segment.c -+++ b/fs/f2fs/segment.c -@@ -372,7 +372,13 @@ static int __f2fs_commit_atomic_write(struct inode *inode) - } else { - sbi->committed_atomic_block += fi->atomic_write_cnt; - set_inode_flag(inode, FI_ATOMIC_COMMITTED); -+ -+ /* -+ * inode may has no FI_ATOMIC_DIRTIED flag due to no write -+ * before commit. -+ */ - if (is_inode_flag_set(inode, FI_ATOMIC_DIRTIED)) { -+ /* clear atomic dirty status and set vfs dirty status */ - clear_inode_flag(inode, FI_ATOMIC_DIRTIED); - f2fs_mark_inode_dirty_sync(inode, true); - } -diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c -index 6b3cafbe98672e..702137eafaa675 100644 ---- a/fs/f2fs/super.c -+++ b/fs/f2fs/super.c -@@ -1500,7 +1500,9 @@ int f2fs_inode_dirtied(struct inode *inode, bool sync) - } - spin_unlock(&sbi->inode_lock[DIRTY_META]); - -- if (!ret && f2fs_is_atomic_file(inode)) -+ /* if atomic write is not committed, set inode w/ atomic dirty */ -+ if (!ret && f2fs_is_atomic_file(inode) && -+ !is_inode_flag_set(inode, FI_ATOMIC_COMMITTED)) - set_inode_flag(inode, FI_ATOMIC_DIRTIED); - - return ret; -@@ -3608,6 +3610,7 @@ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi) - block_t user_block_count, valid_user_blocks; - block_t avail_node_count, valid_node_count; - unsigned int nat_blocks, nat_bits_bytes, nat_bits_blocks; -+ unsigned int sit_blk_cnt; - int i, j; - - total = le32_to_cpu(raw_super->segment_count); -@@ -3719,6 +3722,13 @@ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi) - return 1; - } - -+ sit_blk_cnt = DIV_ROUND_UP(main_segs, SIT_ENTRY_PER_BLOCK); -+ if (sit_bitmap_size * 8 < sit_blk_cnt) { -+ f2fs_err(sbi, "Wrong bitmap size: sit: %u, sit_blk_cnt:%u", -+ sit_bitmap_size, sit_blk_cnt); -+ return 1; -+ } -+ - cp_pack_start_sum = __start_sum_addr(sbi); - cp_payload = __cp_payload(sbi); - if (cp_pack_start_sum < cp_payload + 1 || -diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c -index e028e55e67d95f..07aac73377d8fe 100644 ---- a/fs/gfs2/lock_dlm.c -+++ b/fs/gfs2/lock_dlm.c -@@ -959,14 +959,15 @@ static int control_mount(struct gfs2_sbd *sdp) - if (sdp->sd_args.ar_spectator) { - fs_info(sdp, "Recovery is required. Waiting for a " - "non-spectator to mount.\n"); -+ spin_unlock(&ls->ls_recover_spin); - msleep_interruptible(1000); - } else { - fs_info(sdp, "control_mount wait1 block %u start %u " - "mount %u lvb %u flags %lx\n", block_gen, - start_gen, mount_gen, lvb_gen, - ls->ls_recover_flags); -+ spin_unlock(&ls->ls_recover_spin); - } -- spin_unlock(&ls->ls_recover_spin); - goto restart; - } - -diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c -index 76adab83cac368..c2b8ad0b24c443 100644 ---- a/fs/jbd2/transaction.c -+++ b/fs/jbd2/transaction.c -@@ -1499,7 +1499,7 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) - jh->b_next_transaction == transaction); - spin_unlock(&jh->b_state_lock); - } -- if (jh->b_modified == 1) { -+ if (data_race(jh->b_modified == 1)) { - /* If it's in our transaction it must be in BJ_Metadata list. */ - if (data_race(jh->b_transaction == transaction && - jh->b_jlist != BJ_Metadata)) { -@@ -1518,7 +1518,6 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) - goto out; - } - -- journal = transaction->t_journal; - spin_lock(&jh->b_state_lock); - - if (is_handle_aborted(handle)) { -@@ -1533,6 +1532,8 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) - goto out_unlock_bh; - } - -+ journal = transaction->t_journal; -+ - if (jh->b_modified == 0) { - /* - * This buffer's got modified and becoming part -diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c -index ef3a1e1b6cb065..fda9f4d6093f94 100644 ---- a/fs/jffs2/erase.c -+++ b/fs/jffs2/erase.c -@@ -425,7 +425,9 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb - .totlen = cpu_to_je32(c->cleanmarker_size) - }; - -- jffs2_prealloc_raw_node_refs(c, jeb, 1); -+ ret = jffs2_prealloc_raw_node_refs(c, jeb, 1); -+ if (ret) -+ goto filebad; - - marker.hdr_crc = cpu_to_je32(crc32(0, &marker, sizeof(struct jffs2_unknown_node)-4)); - -diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c -index 29671e33a1714c..62879c218d4b11 100644 ---- a/fs/jffs2/scan.c -+++ b/fs/jffs2/scan.c -@@ -256,7 +256,9 @@ int jffs2_scan_medium(struct jffs2_sb_info *c) - - jffs2_dbg(1, "%s(): Skipping %d bytes in nextblock to ensure page alignment\n", - __func__, skip); -- jffs2_prealloc_raw_node_refs(c, c->nextblock, 1); -+ ret = jffs2_prealloc_raw_node_refs(c, c->nextblock, 1); -+ if (ret) -+ goto out; - jffs2_scan_dirty_space(c, c->nextblock, skip); - } - #endif -diff --git a/fs/jffs2/summary.c b/fs/jffs2/summary.c -index 4fe64519870f1a..d83372d3e1a07b 100644 ---- a/fs/jffs2/summary.c -+++ b/fs/jffs2/summary.c -@@ -858,7 +858,10 @@ int jffs2_sum_write_sumnode(struct jffs2_sb_info *c) - spin_unlock(&c->erase_completion_lock); - - jeb = c->nextblock; -- jffs2_prealloc_raw_node_refs(c, jeb, 1); -+ ret = jffs2_prealloc_raw_node_refs(c, jeb, 1); -+ -+ if (ret) -+ goto out; - - if (!c->summary->sum_num || !c->summary->sum_list_head) { - JFFS2_WARNING("Empty summary info!!!\n"); -@@ -872,6 +875,8 @@ int jffs2_sum_write_sumnode(struct jffs2_sb_info *c) - datasize += padsize; - - ret = jffs2_sum_write_data(c, jeb, infosize, datasize, padsize); -+ -+out: - spin_lock(&c->erase_completion_lock); - return ret; - } -diff --git a/fs/nfs/read.c b/fs/nfs/read.c -index a142287d86f68e..688a24e9bc8bb8 100644 ---- a/fs/nfs/read.c -+++ b/fs/nfs/read.c -@@ -56,7 +56,8 @@ static int nfs_return_empty_folio(struct folio *folio) - { - folio_zero_segment(folio, 0, folio_size(folio)); - folio_mark_uptodate(folio); -- folio_unlock(folio); -+ if (nfs_netfs_folio_unlock(folio)) -+ folio_unlock(folio); - return 0; - } - -diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c -index b3eca08f15b13e..b2bbf3d6d177e8 100644 ---- a/fs/nfsd/nfs4proc.c -+++ b/fs/nfsd/nfs4proc.c -@@ -3580,7 +3580,8 @@ bool nfsd4_spo_must_allow(struct svc_rqst *rqstp) - struct nfs4_op_map *allow = &cstate->clp->cl_spo_must_allow; - u32 opiter; - -- if (!cstate->minorversion) -+ if (rqstp->rq_procinfo != &nfsd_version4.vs_proc[NFSPROC4_COMPOUND] || -+ cstate->minorversion == 0) - return false; - - if (cstate->spo_must_allowed) -diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c -index 710a54c7dffc54..623f522b156599 100644 ---- a/fs/nfsd/nfssvc.c -+++ b/fs/nfsd/nfssvc.c -@@ -432,13 +432,13 @@ static int nfsd_startup_net(struct net *net, const struct cred *cred) - if (ret) - goto out_filecache; - -+#ifdef CONFIG_NFSD_V4_2_INTER_SSC -+ nfsd4_ssc_init_umount_work(nn); -+#endif - ret = nfs4_state_start_net(net); - if (ret) - goto out_reply_cache; - --#ifdef CONFIG_NFSD_V4_2_INTER_SSC -- nfsd4_ssc_init_umount_work(nn); --#endif - nn->nfsd_net_up = true; - return 0; - -diff --git a/fs/smb/client/cached_dir.c b/fs/smb/client/cached_dir.c -index 74979466729535..d64742ba371aa5 100644 ---- a/fs/smb/client/cached_dir.c -+++ b/fs/smb/client/cached_dir.c -@@ -484,8 +484,17 @@ void close_all_cached_dirs(struct cifs_sb_info *cifs_sb) - spin_lock(&cfids->cfid_list_lock); - list_for_each_entry(cfid, &cfids->entries, entry) { - tmp_list = kmalloc(sizeof(*tmp_list), GFP_ATOMIC); -- if (tmp_list == NULL) -- break; -+ if (tmp_list == NULL) { -+ /* -+ * If the malloc() fails, we won't drop all -+ * dentries, and unmounting is likely to trigger -+ * a 'Dentry still in use' error. -+ */ -+ cifs_tcon_dbg(VFS, "Out of memory while dropping dentries\n"); -+ spin_unlock(&cfids->cfid_list_lock); -+ spin_unlock(&cifs_sb->tlink_tree_lock); -+ goto done; -+ } - spin_lock(&cfid->fid_lock); - tmp_list->dentry = cfid->dentry; - cfid->dentry = NULL; -@@ -497,6 +506,7 @@ void close_all_cached_dirs(struct cifs_sb_info *cifs_sb) - } - spin_unlock(&cifs_sb->tlink_tree_lock); - -+done: - list_for_each_entry_safe(tmp_list, q, &entry, entry) { - list_del(&tmp_list->entry); - dput(tmp_list->dentry); -diff --git a/fs/smb/client/cached_dir.h b/fs/smb/client/cached_dir.h -index 1dfe79d947a62f..bc8a812ff95f8b 100644 ---- a/fs/smb/client/cached_dir.h -+++ b/fs/smb/client/cached_dir.h -@@ -21,10 +21,10 @@ struct cached_dirent { - struct cached_dirents { - bool is_valid:1; - bool is_failed:1; -- struct dir_context *ctx; /* -- * Only used to make sure we only take entries -- * from a single context. Never dereferenced. -- */ -+ struct file *file; /* -+ * Used to associate the cache with a single -+ * open file instance. -+ */ - struct mutex de_mutex; - int pos; /* Expected ctx->pos */ - struct list_head entries; -diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h -index 39117343b703fa..6a4ed99e162c5d 100644 ---- a/fs/smb/client/cifsglob.h -+++ b/fs/smb/client/cifsglob.h -@@ -1053,6 +1053,7 @@ struct cifs_chan { - }; - - #define CIFS_SES_FLAG_SCALE_CHANNELS (0x1) -+#define CIFS_SES_FLAGS_PENDING_QUERY_INTERFACES (0x2) - - /* - * Session structure. One of these for each uid session with a particular host -diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c -index 3faaee33ad4558..8fa5fe0a8c5c59 100644 ---- a/fs/smb/client/connect.c -+++ b/fs/smb/client/connect.c -@@ -132,13 +132,9 @@ static void smb2_query_server_interfaces(struct work_struct *work) - rc = server->ops->query_server_interfaces(xid, tcon, false); - free_xid(xid); - -- if (rc) { -- if (rc == -EOPNOTSUPP) -- return; -- -+ if (rc) - cifs_dbg(FYI, "%s: failed to query server interfaces: %d\n", - __func__, rc); -- } - - queue_delayed_work(cifsiod_wq, &tcon->query_interfaces, - (SMB_INTERFACE_POLL_INTERVAL * HZ)); -@@ -393,6 +389,13 @@ static int __cifs_reconnect(struct TCP_Server_Info *server, - if (!cifs_tcp_ses_needs_reconnect(server, 1)) - return 0; - -+ /* -+ * if smb session has been marked for reconnect, also reconnect all -+ * connections. This way, the other connections do not end up bad. -+ */ -+ if (mark_smb_session) -+ cifs_signal_cifsd_for_reconnect(server, mark_smb_session); -+ - cifs_mark_tcp_ses_conns_for_reconnect(server, mark_smb_session); - - cifs_abort_connection(server); -@@ -401,7 +404,8 @@ static int __cifs_reconnect(struct TCP_Server_Info *server, - try_to_freeze(); - cifs_server_lock(server); - -- if (!cifs_swn_set_server_dstaddr(server)) { -+ if (!cifs_swn_set_server_dstaddr(server) && -+ !SERVER_IS_CHAN(server)) { - /* resolve the hostname again to make sure that IP address is up-to-date */ - rc = reconn_set_ipaddr_from_hostname(server); - cifs_dbg(FYI, "%s: reconn_set_ipaddr_from_hostname: rc=%d\n", __func__, rc); -@@ -3978,6 +3982,7 @@ cifs_negotiate_protocol(const unsigned int xid, struct cifs_ses *ses, - return 0; - } - -+ server->lstrp = jiffies; - server->tcpStatus = CifsInNegotiate; - spin_unlock(&server->srv_lock); - -diff --git a/fs/smb/client/namespace.c b/fs/smb/client/namespace.c -index 830f2a292bb00d..ec58c0e507244b 100644 ---- a/fs/smb/client/namespace.c -+++ b/fs/smb/client/namespace.c -@@ -146,6 +146,9 @@ static char *automount_fullpath(struct dentry *dentry, void *page) - } - spin_unlock(&tcon->tc_lock); - -+ if (unlikely(!page)) -+ return ERR_PTR(-ENOMEM); -+ - s = dentry_path_raw(dentry, page, PATH_MAX); - if (IS_ERR(s)) - return s; -diff --git a/fs/smb/client/readdir.c b/fs/smb/client/readdir.c -index e616be8196deda..222348ae625866 100644 ---- a/fs/smb/client/readdir.c -+++ b/fs/smb/client/readdir.c -@@ -850,9 +850,9 @@ static bool emit_cached_dirents(struct cached_dirents *cde, - } - - static void update_cached_dirents_count(struct cached_dirents *cde, -- struct dir_context *ctx) -+ struct file *file) - { -- if (cde->ctx != ctx) -+ if (cde->file != file) - return; - if (cde->is_valid || cde->is_failed) - return; -@@ -861,9 +861,9 @@ static void update_cached_dirents_count(struct cached_dirents *cde, - } - - static void finished_cached_dirents_count(struct cached_dirents *cde, -- struct dir_context *ctx) -+ struct dir_context *ctx, struct file *file) - { -- if (cde->ctx != ctx) -+ if (cde->file != file) - return; - if (cde->is_valid || cde->is_failed) - return; -@@ -876,11 +876,12 @@ static void finished_cached_dirents_count(struct cached_dirents *cde, - static void add_cached_dirent(struct cached_dirents *cde, - struct dir_context *ctx, - const char *name, int namelen, -- struct cifs_fattr *fattr) -+ struct cifs_fattr *fattr, -+ struct file *file) - { - struct cached_dirent *de; - -- if (cde->ctx != ctx) -+ if (cde->file != file) - return; - if (cde->is_valid || cde->is_failed) - return; -@@ -910,7 +911,8 @@ static void add_cached_dirent(struct cached_dirents *cde, - static bool cifs_dir_emit(struct dir_context *ctx, - const char *name, int namelen, - struct cifs_fattr *fattr, -- struct cached_fid *cfid) -+ struct cached_fid *cfid, -+ struct file *file) - { - bool rc; - ino_t ino = cifs_uniqueid_to_ino_t(fattr->cf_uniqueid); -@@ -922,7 +924,7 @@ static bool cifs_dir_emit(struct dir_context *ctx, - if (cfid) { - mutex_lock(&cfid->dirents.de_mutex); - add_cached_dirent(&cfid->dirents, ctx, name, namelen, -- fattr); -+ fattr, file); - mutex_unlock(&cfid->dirents.de_mutex); - } - -@@ -1022,7 +1024,7 @@ static int cifs_filldir(char *find_entry, struct file *file, - cifs_prime_dcache(file_dentry(file), &name, &fattr); - - return !cifs_dir_emit(ctx, name.name, name.len, -- &fattr, cfid); -+ &fattr, cfid, file); - } - - -@@ -1073,8 +1075,8 @@ int cifs_readdir(struct file *file, struct dir_context *ctx) - * we need to initialize scanning and storing the - * directory content. - */ -- if (ctx->pos == 0 && cfid->dirents.ctx == NULL) { -- cfid->dirents.ctx = ctx; -+ if (ctx->pos == 0 && cfid->dirents.file == NULL) { -+ cfid->dirents.file = file; - cfid->dirents.pos = 2; - } - /* -@@ -1142,7 +1144,7 @@ int cifs_readdir(struct file *file, struct dir_context *ctx) - } else { - if (cfid) { - mutex_lock(&cfid->dirents.de_mutex); -- finished_cached_dirents_count(&cfid->dirents, ctx); -+ finished_cached_dirents_count(&cfid->dirents, ctx, file); - mutex_unlock(&cfid->dirents.de_mutex); - } - cifs_dbg(FYI, "Could not find entry\n"); -@@ -1183,7 +1185,7 @@ int cifs_readdir(struct file *file, struct dir_context *ctx) - ctx->pos++; - if (cfid) { - mutex_lock(&cfid->dirents.de_mutex); -- update_cached_dirents_count(&cfid->dirents, ctx); -+ update_cached_dirents_count(&cfid->dirents, file); - mutex_unlock(&cfid->dirents.de_mutex); - } - -diff --git a/fs/smb/client/reparse.c b/fs/smb/client/reparse.c -index b6556fe3dfa11a..4d45c31336df17 100644 ---- a/fs/smb/client/reparse.c -+++ b/fs/smb/client/reparse.c -@@ -738,7 +738,6 @@ static bool wsl_to_fattr(struct cifs_open_info_data *data, - if (!have_xattr_dev && (tag == IO_REPARSE_TAG_LX_CHR || tag == IO_REPARSE_TAG_LX_BLK)) - return false; - -- fattr->cf_dtype = S_DT(fattr->cf_mode); - return true; - } - -diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c -index f04922eb45d4c9..8959206a0353eb 100644 ---- a/fs/smb/client/sess.c -+++ b/fs/smb/client/sess.c -@@ -485,6 +485,10 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) - - ses->chans[chan_index].iface = iface; - spin_unlock(&ses->chan_lock); -+ -+ spin_lock(&server->srv_lock); -+ memcpy(&server->dstaddr, &iface->sockaddr, sizeof(server->dstaddr)); -+ spin_unlock(&server->srv_lock); - } - - /* -@@ -554,8 +558,7 @@ cifs_ses_add_channel(struct cifs_ses *ses, - ctx->domainauto = ses->domainAuto; - ctx->domainname = ses->domainName; - -- /* no hostname for extra channels */ -- ctx->server_hostname = ""; -+ ctx->server_hostname = ses->server->hostname; - - ctx->username = ses->user_name; - ctx->password = ses->password; -diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c -index 3e88e8b3c16ec2..e0f58600933059 100644 ---- a/fs/smb/client/smb2pdu.c -+++ b/fs/smb/client/smb2pdu.c -@@ -425,14 +425,23 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, - if (!rc && - (server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL) && - server->ops->query_server_interfaces) { -- mutex_unlock(&ses->session_mutex); -- - /* -- * query server network interfaces, in case they change -+ * query server network interfaces, in case they change. -+ * Also mark the session as pending this update while the query -+ * is in progress. This will be used to avoid calling -+ * smb2_reconnect recursively. - */ -+ ses->flags |= CIFS_SES_FLAGS_PENDING_QUERY_INTERFACES; - xid = get_xid(); - rc = server->ops->query_server_interfaces(xid, tcon, false); - free_xid(xid); -+ ses->flags &= ~CIFS_SES_FLAGS_PENDING_QUERY_INTERFACES; -+ -+ /* regardless of rc value, setup polling */ -+ queue_delayed_work(cifsiod_wq, &tcon->query_interfaces, -+ (SMB_INTERFACE_POLL_INTERVAL * HZ)); -+ -+ mutex_unlock(&ses->session_mutex); - - if (rc == -EOPNOTSUPP && ses->chan_count > 1) { - /* -@@ -452,11 +461,8 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, - if (ses->chan_max > ses->chan_count && - ses->iface_count && - !SERVER_IS_CHAN(server)) { -- if (ses->chan_count == 1) { -+ if (ses->chan_count == 1) - cifs_server_dbg(VFS, "supports multichannel now\n"); -- queue_delayed_work(cifsiod_wq, &tcon->query_interfaces, -- (SMB_INTERFACE_POLL_INTERVAL * HZ)); -- } - - cifs_try_adding_channels(ses); - } -@@ -574,11 +580,18 @@ static int smb2_ioctl_req_init(u32 opcode, struct cifs_tcon *tcon, - struct TCP_Server_Info *server, - void **request_buf, unsigned int *total_len) - { -- /* Skip reconnect only for FSCTL_VALIDATE_NEGOTIATE_INFO IOCTLs */ -- if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) { -+ /* -+ * Skip reconnect in one of the following cases: -+ * 1. For FSCTL_VALIDATE_NEGOTIATE_INFO IOCTLs -+ * 2. For FSCTL_QUERY_NETWORK_INTERFACE_INFO IOCTL when called from -+ * smb2_reconnect (indicated by CIFS_SES_FLAG_SCALE_CHANNELS ses flag) -+ */ -+ if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO || -+ (opcode == FSCTL_QUERY_NETWORK_INTERFACE_INFO && -+ (tcon->ses->flags & CIFS_SES_FLAGS_PENDING_QUERY_INTERFACES))) - return __smb2_plain_req_init(SMB2_IOCTL, tcon, server, - request_buf, total_len); -- } -+ - return smb2_plain_req_init(SMB2_IOCTL, tcon, server, - request_buf, total_len); - } -diff --git a/fs/smb/client/transport.c b/fs/smb/client/transport.c -index 2269963e500819..7b2560612bd6aa 100644 ---- a/fs/smb/client/transport.c -+++ b/fs/smb/client/transport.c -@@ -1025,14 +1025,16 @@ struct TCP_Server_Info *cifs_pick_channel(struct cifs_ses *ses) - uint index = 0; - unsigned int min_in_flight = UINT_MAX, max_in_flight = 0; - struct TCP_Server_Info *server = NULL; -- int i; -+ int i, start, cur; - - if (!ses) - return NULL; - - spin_lock(&ses->chan_lock); -+ start = atomic_inc_return(&ses->chan_seq); - for (i = 0; i < ses->chan_count; i++) { -- server = ses->chans[i].server; -+ cur = (start + i) % ses->chan_count; -+ server = ses->chans[cur].server; - if (!server || server->terminate) - continue; - -@@ -1049,17 +1051,15 @@ struct TCP_Server_Info *cifs_pick_channel(struct cifs_ses *ses) - */ - if (server->in_flight < min_in_flight) { - min_in_flight = server->in_flight; -- index = i; -+ index = cur; - } - if (server->in_flight > max_in_flight) - max_in_flight = server->in_flight; - } - - /* if all channels are equally loaded, fall back to round-robin */ -- if (min_in_flight == max_in_flight) { -- index = (uint)atomic_inc_return(&ses->chan_seq); -- index %= ses->chan_count; -- } -+ if (min_in_flight == max_in_flight) -+ index = (uint)start % ses->chan_count; - - server = ses->chans[index].server; - spin_unlock(&ses->chan_lock); -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index 9bd817427a345a..d8325504a1624b 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -1599,17 +1599,18 @@ static int krb5_authenticate(struct ksmbd_work *work, - out_len = work->response_sz - - (le16_to_cpu(rsp->SecurityBufferOffset) + 4); - -- /* Check previous session */ -- prev_sess_id = le64_to_cpu(req->PreviousSessionId); -- if (prev_sess_id && prev_sess_id != sess->id) -- destroy_previous_session(conn, sess->user, prev_sess_id); -- - retval = ksmbd_krb5_authenticate(sess, in_blob, in_len, - out_blob, &out_len); - if (retval) { - ksmbd_debug(SMB, "krb5 authentication failed\n"); - return -EINVAL; - } -+ -+ /* Check previous session */ -+ prev_sess_id = le64_to_cpu(req->PreviousSessionId); -+ if (prev_sess_id && prev_sess_id != sess->id) -+ destroy_previous_session(conn, sess->user, prev_sess_id); -+ - rsp->SecurityBufferLength = cpu_to_le16(out_len); - - if ((conn->sign || server_conf.enforced_signing) || -diff --git a/fs/xattr.c b/fs/xattr.c -index 5fed22c22a2be8..7574d24b982ef6 100644 ---- a/fs/xattr.c -+++ b/fs/xattr.c -@@ -1342,6 +1342,7 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs, - buffer += err; - } - remaining_size -= err; -+ err = 0; - - read_lock(&xattrs->lock); - for (rbp = rb_first(&xattrs->rb_root); rbp; rbp = rb_next(rbp)) { -diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h -index 85c2dcf2b70484..0a242008524151 100644 ---- a/include/acpi/actypes.h -+++ b/include/acpi/actypes.h -@@ -527,7 +527,7 @@ typedef u64 acpi_integer; - - /* Support for the special RSDP signature (8 characters) */ - --#define ACPI_VALIDATE_RSDP_SIG(a) (!strncmp (ACPI_CAST_PTR (char, (a)), ACPI_SIG_RSDP, 8)) -+#define ACPI_VALIDATE_RSDP_SIG(a) (!strncmp (ACPI_CAST_PTR (char, (a)), ACPI_SIG_RSDP, (sizeof(a) < 8) ? ACPI_NAMESEG_SIZE : 8)) - #define ACPI_MAKE_RSDP_SIG(dest) (memcpy (ACPI_CAST_PTR (char, (dest)), ACPI_SIG_RSDP, 8)) - - /* Support for OEMx signature (x can be any character) */ -diff --git a/include/linux/acpi.h b/include/linux/acpi.h -index 1b76d2f83eac6a..7c6f4006389daa 100644 ---- a/include/linux/acpi.h -+++ b/include/linux/acpi.h -@@ -1098,13 +1098,13 @@ void acpi_os_set_prepare_extended_sleep(int (*func)(u8 sleep_state, - - acpi_status acpi_os_prepare_extended_sleep(u8 sleep_state, - u32 val_a, u32 val_b); --#if defined(CONFIG_SUSPEND) && defined(CONFIG_X86) - struct acpi_s2idle_dev_ops { - struct list_head list_node; - void (*prepare)(void); - void (*check)(void); - void (*restore)(void); - }; -+#if defined(CONFIG_SUSPEND) && defined(CONFIG_X86) - int acpi_register_lps0_dev(struct acpi_s2idle_dev_ops *arg); - void acpi_unregister_lps0_dev(struct acpi_s2idle_dev_ops *arg); - int acpi_get_lps0_constraint(struct acpi_device *adev); -@@ -1113,6 +1113,13 @@ static inline int acpi_get_lps0_constraint(struct device *dev) - { - return ACPI_STATE_UNKNOWN; - } -+static inline int acpi_register_lps0_dev(struct acpi_s2idle_dev_ops *arg) -+{ -+ return -ENODEV; -+} -+static inline void acpi_unregister_lps0_dev(struct acpi_s2idle_dev_ops *arg) -+{ -+} - #endif /* CONFIG_SUSPEND && CONFIG_X86 */ - #ifndef CONFIG_IA64 - void arch_reserve_mem_area(acpi_physical_address addr, size_t size); -diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h -index 9b02961d65ee66..45f2f278b50a8a 100644 ---- a/include/linux/atmdev.h -+++ b/include/linux/atmdev.h -@@ -249,6 +249,12 @@ static inline void atm_account_tx(struct atm_vcc *vcc, struct sk_buff *skb) - ATM_SKB(skb)->atm_options = vcc->atm_options; - } - -+static inline void atm_return_tx(struct atm_vcc *vcc, struct sk_buff *skb) -+{ -+ WARN_ON_ONCE(refcount_sub_and_test(ATM_SKB(skb)->acct_truesize, -+ &sk_atm(vcc)->sk_wmem_alloc)); -+} -+ - static inline void atm_force_charge(struct atm_vcc *vcc,int truesize) - { - atomic_add(truesize, &sk_atm(vcc)->sk_rmem_alloc); -diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h -index fc2023d07f6931..8b051b8c40345d 100644 ---- a/include/linux/hugetlb.h -+++ b/include/linux/hugetlb.h -@@ -281,6 +281,7 @@ long hugetlb_change_protection(struct vm_area_struct *vma, - - bool is_hugetlb_entry_migration(pte_t pte); - void hugetlb_unshare_all_pmds(struct vm_area_struct *vma); -+void hugetlb_split(struct vm_area_struct *vma, unsigned long addr); - - #else /* !CONFIG_HUGETLB_PAGE */ - -@@ -491,6 +492,8 @@ static inline vm_fault_t hugetlb_fault(struct mm_struct *mm, - - static inline void hugetlb_unshare_all_pmds(struct vm_area_struct *vma) { } - -+static inline void hugetlb_split(struct vm_area_struct *vma, unsigned long addr) {} -+ - #endif /* !CONFIG_HUGETLB_PAGE */ - /* - * hugepages at page global directory. If arch support -diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h -index afa575e362a473..7c6da19fff9f06 100644 ---- a/include/linux/mmc/card.h -+++ b/include/linux/mmc/card.h -@@ -297,6 +297,7 @@ struct mmc_card { - #define MMC_QUIRK_BROKEN_SD_CACHE (1<<15) /* Disable broken SD cache support */ - #define MMC_QUIRK_BROKEN_CACHE_FLUSH (1<<16) /* Don't flush cache until the write has occurred */ - #define MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY (1<<17) /* Disable broken SD poweroff notify support */ -+#define MMC_QUIRK_NO_UHS_DDR50_TUNING (1<<18) /* Disable DDR50 tuning */ - - bool written_flag; /* Indicates eMMC has been written since power on */ - bool reenable_cmdq; /* Re-enable Command Queue */ -diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index 0b0a172337dbac..030d9de2ba2d23 100644 ---- a/include/linux/netdevice.h -+++ b/include/linux/netdevice.h -@@ -3036,7 +3036,8 @@ extern rwlock_t dev_base_lock; /* Device list lock */ - #define net_device_entry(lh) list_entry(lh, struct net_device, dev_list) - - #define for_each_netdev_dump(net, d, ifindex) \ -- xa_for_each_start(&(net)->dev_by_index, (ifindex), (d), (ifindex)) -+ for (; (d = xa_find(&(net)->dev_by_index, &ifindex, \ -+ ULONG_MAX, XA_PRESENT)); ifindex++) - - static inline struct net_device *next_net_device(struct net_device *dev) - { -diff --git a/include/net/checksum.h b/include/net/checksum.h -index 1338cb92c8e72a..28b101f26636e8 100644 ---- a/include/net/checksum.h -+++ b/include/net/checksum.h -@@ -158,7 +158,7 @@ void inet_proto_csum_replace16(__sum16 *sum, struct sk_buff *skb, - const __be32 *from, const __be32 *to, - bool pseudohdr); - void inet_proto_csum_replace_by_diff(__sum16 *sum, struct sk_buff *skb, -- __wsum diff, bool pseudohdr); -+ __wsum diff, bool pseudohdr, bool ipv6); - - static __always_inline - void inet_proto_csum_replace2(__sum16 *sum, struct sk_buff *skb, -diff --git a/include/trace/events/erofs.h b/include/trace/events/erofs.h -index e18684b02c3dfa..0179af103d0f42 100644 ---- a/include/trace/events/erofs.h -+++ b/include/trace/events/erofs.h -@@ -237,24 +237,6 @@ DEFINE_EVENT(erofs__map_blocks_exit, z_erofs_map_blocks_iter_exit, - TP_ARGS(inode, map, flags, ret) - ); - --TRACE_EVENT(erofs_destroy_inode, -- TP_PROTO(struct inode *inode), -- -- TP_ARGS(inode), -- -- TP_STRUCT__entry( -- __field( dev_t, dev ) -- __field( erofs_nid_t, nid ) -- ), -- -- TP_fast_assign( -- __entry->dev = inode->i_sb->s_dev; -- __entry->nid = EROFS_I(inode)->nid; -- ), -- -- TP_printk("dev = (%d,%d), nid = %llu", show_dev_nid(__entry)) --); -- - #endif /* _TRACE_EROFS_H */ - - /* This part must be outside protection */ -diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h -index c7f904a72af217..08a0494736e6e3 100644 ---- a/include/uapi/linux/bpf.h -+++ b/include/uapi/linux/bpf.h -@@ -1913,6 +1913,7 @@ union bpf_attr { - * for updates resulting in a null checksum the value is set to - * **CSUM_MANGLED_0** instead. Flag **BPF_F_PSEUDO_HDR** indicates - * the checksum is to be computed against a pseudo-header. -+ * Flag **BPF_F_IPV6** should be set for IPv6 packets. - * - * This helper works in combination with **bpf_csum_diff**\ (), - * which does not update the checksum in-place, but offers more -@@ -5920,6 +5921,7 @@ enum { - BPF_F_PSEUDO_HDR = (1ULL << 4), - BPF_F_MARK_MANGLED_0 = (1ULL << 5), - BPF_F_MARK_ENFORCE = (1ULL << 6), -+ BPF_F_IPV6 = (1ULL << 7), - }; - - /* BPF_FUNC_skb_set_tunnel_key and BPF_FUNC_skb_get_tunnel_key flags. */ -diff --git a/io_uring/io-wq.c b/io_uring/io-wq.c -index 93f3e4d1df853e..1c4ef4e4eb52b2 100644 ---- a/io_uring/io-wq.c -+++ b/io_uring/io-wq.c -@@ -1206,8 +1206,10 @@ struct io_wq *io_wq_create(unsigned bounded, struct io_wq_data *data) - atomic_set(&wq->worker_refs, 1); - init_completion(&wq->worker_done); - ret = cpuhp_state_add_instance_nocalls(io_wq_online, &wq->cpuhp_node); -- if (ret) -+ if (ret) { -+ put_task_struct(wq->task); - goto err; -+ } - - return wq; - err: -diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c -index ff1a93d405e99e..897f07014c0193 100644 ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -1808,7 +1808,7 @@ static __cold void io_drain_req(struct io_kiocb *req) - spin_unlock(&ctx->completion_lock); - - io_prep_async_link(req); -- de = kmalloc(sizeof(*de), GFP_KERNEL); -+ de = kmalloc(sizeof(*de), GFP_KERNEL_ACCOUNT); - if (!de) { - ret = -ENOMEM; - io_req_defer_failed(req, ret); -diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c -index addd7c97365727..b2c381634393d2 100644 ---- a/io_uring/kbuf.c -+++ b/io_uring/kbuf.c -@@ -560,7 +560,7 @@ int io_register_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg) - io_destroy_bl(ctx, bl); - } - -- free_bl = bl = kzalloc(sizeof(*bl), GFP_KERNEL); -+ free_bl = bl = kzalloc(sizeof(*bl), GFP_KERNEL_ACCOUNT); - if (!bl) - return -ENOMEM; - -diff --git a/ipc/shm.c b/ipc/shm.c -index 576a543b7cfff9..c4845689b7f68b 100644 ---- a/ipc/shm.c -+++ b/ipc/shm.c -@@ -430,8 +430,11 @@ static int shm_try_destroy_orphaned(int id, void *p, void *data) - void shm_destroy_orphaned(struct ipc_namespace *ns) - { - down_write(&shm_ids(ns).rwsem); -- if (shm_ids(ns).in_use) -+ if (shm_ids(ns).in_use) { -+ rcu_read_lock(); - idr_for_each(&shm_ids(ns).ipcs_idr, &shm_try_destroy_orphaned, ns); -+ rcu_read_unlock(); -+ } - up_write(&shm_ids(ns).rwsem); - } - -diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c -index 41d62405c85214..8f0b62b04deebe 100644 ---- a/kernel/bpf/helpers.c -+++ b/kernel/bpf/helpers.c -@@ -128,7 +128,8 @@ const struct bpf_func_proto bpf_map_peek_elem_proto = { - - BPF_CALL_3(bpf_map_lookup_percpu_elem, struct bpf_map *, map, void *, key, u32, cpu) - { -- WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_bh_held()); -+ WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held() && -+ !rcu_read_lock_bh_held()); - return (unsigned long) map->ops->map_lookup_percpu_elem(map, key, cpu); - } - -diff --git a/kernel/cgroup/legacy_freezer.c b/kernel/cgroup/legacy_freezer.c -index 66d1708042a72b..a3e13e6d5ee40d 100644 ---- a/kernel/cgroup/legacy_freezer.c -+++ b/kernel/cgroup/legacy_freezer.c -@@ -189,13 +189,12 @@ static void freezer_attach(struct cgroup_taskset *tset) - if (!(freezer->state & CGROUP_FREEZING)) { - __thaw_task(task); - } else { -- freeze_task(task); -- - /* clear FROZEN and propagate upwards */ - while (freezer && (freezer->state & CGROUP_FROZEN)) { - freezer->state &= ~CGROUP_FROZEN; - freezer = parent_freezer(freezer); - } -+ freeze_task(task); - } - } - -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 563f39518f7fe6..873b17545717cb 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -171,6 +171,19 @@ static void perf_ctx_unlock(struct perf_cpu_context *cpuctx, - raw_spin_unlock(&cpuctx->ctx.lock); - } - -+typedef struct { -+ struct perf_cpu_context *cpuctx; -+ struct perf_event_context *ctx; -+} class_perf_ctx_lock_t; -+ -+static inline void class_perf_ctx_lock_destructor(class_perf_ctx_lock_t *_T) -+{ perf_ctx_unlock(_T->cpuctx, _T->ctx); } -+ -+static inline class_perf_ctx_lock_t -+class_perf_ctx_lock_constructor(struct perf_cpu_context *cpuctx, -+ struct perf_event_context *ctx) -+{ perf_ctx_lock(cpuctx, ctx); return (class_perf_ctx_lock_t){ cpuctx, ctx }; } -+ - #define TASK_TOMBSTONE ((void *)-1L) - - static bool is_kernel_event(struct perf_event *event) -@@ -866,7 +879,13 @@ static void perf_cgroup_switch(struct task_struct *task) - if (READ_ONCE(cpuctx->cgrp) == cgrp) - return; - -- perf_ctx_lock(cpuctx, cpuctx->task_ctx); -+ guard(perf_ctx_lock)(cpuctx, cpuctx->task_ctx); -+ /* -+ * Re-check, could've raced vs perf_remove_from_context(). -+ */ -+ if (READ_ONCE(cpuctx->cgrp) == NULL) -+ return; -+ - perf_ctx_disable(&cpuctx->ctx, true); - - ctx_sched_out(&cpuctx->ctx, EVENT_ALL|EVENT_CGROUP); -@@ -884,7 +903,6 @@ static void perf_cgroup_switch(struct task_struct *task) - ctx_sched_in(&cpuctx->ctx, EVENT_ALL|EVENT_CGROUP); - - perf_ctx_enable(&cpuctx->ctx, true); -- perf_ctx_unlock(cpuctx, cpuctx->task_ctx); - } - - static int perf_cgroup_ensure_storage(struct perf_event *event, -@@ -2067,8 +2085,9 @@ perf_aux_output_match(struct perf_event *event, struct perf_event *aux_event) - } - - static void put_event(struct perf_event *event); --static void event_sched_out(struct perf_event *event, -- struct perf_event_context *ctx); -+static void __event_disable(struct perf_event *event, -+ struct perf_event_context *ctx, -+ enum perf_event_state state); - - static void perf_put_aux_event(struct perf_event *event) - { -@@ -2101,8 +2120,7 @@ static void perf_put_aux_event(struct perf_event *event) - * state so that we don't try to schedule it again. Note - * that perf_event_enable() will clear the ERROR status. - */ -- event_sched_out(iter, ctx); -- perf_event_set_state(event, PERF_EVENT_STATE_ERROR); -+ __event_disable(iter, ctx, PERF_EVENT_STATE_ERROR); - } - } - -@@ -2156,18 +2174,6 @@ static inline struct list_head *get_event_list(struct perf_event *event) - &event->pmu_ctx->flexible_active; - } - --/* -- * Events that have PERF_EV_CAP_SIBLING require being part of a group and -- * cannot exist on their own, schedule them out and move them into the ERROR -- * state. Also see _perf_event_enable(), it will not be able to recover -- * this ERROR state. -- */ --static inline void perf_remove_sibling_event(struct perf_event *event) --{ -- event_sched_out(event, event->ctx); -- perf_event_set_state(event, PERF_EVENT_STATE_ERROR); --} -- - static void perf_group_detach(struct perf_event *event) - { - struct perf_event *leader = event->group_leader; -@@ -2203,8 +2209,15 @@ static void perf_group_detach(struct perf_event *event) - */ - list_for_each_entry_safe(sibling, tmp, &event->sibling_list, sibling_list) { - -+ /* -+ * Events that have PERF_EV_CAP_SIBLING require being part of -+ * a group and cannot exist on their own, schedule them out -+ * and move them into the ERROR state. Also see -+ * _perf_event_enable(), it will not be able to recover this -+ * ERROR state. -+ */ - if (sibling->event_caps & PERF_EV_CAP_SIBLING) -- perf_remove_sibling_event(sibling); -+ __event_disable(sibling, ctx, PERF_EVENT_STATE_ERROR); - - sibling->group_leader = sibling; - list_del_init(&sibling->sibling_list); -@@ -2437,6 +2450,15 @@ static void perf_remove_from_context(struct perf_event *event, unsigned long fla - event_function_call(event, __perf_remove_from_context, (void *)flags); - } - -+static void __event_disable(struct perf_event *event, -+ struct perf_event_context *ctx, -+ enum perf_event_state state) -+{ -+ event_sched_out(event, ctx); -+ perf_cgroup_event_disable(event, ctx); -+ perf_event_set_state(event, state); -+} -+ - /* - * Cross CPU call to disable a performance event - */ -@@ -2455,13 +2477,18 @@ static void __perf_event_disable(struct perf_event *event, - - perf_pmu_disable(event->pmu_ctx->pmu); - -+ /* -+ * When disabling a group leader, the whole group becomes ineligible -+ * to run, so schedule out the full group. -+ */ - if (event == event->group_leader) - group_sched_out(event, ctx); -- else -- event_sched_out(event, ctx); - -- perf_event_set_state(event, PERF_EVENT_STATE_OFF); -- perf_cgroup_event_disable(event, ctx); -+ /* -+ * But only mark the leader OFF; the siblings will remain -+ * INACTIVE. -+ */ -+ __event_disable(event, ctx, PERF_EVENT_STATE_OFF); - - perf_pmu_enable(event->pmu_ctx->pmu); - } -@@ -6987,6 +7014,10 @@ perf_sample_ustack_size(u16 stack_size, u16 header_size, - if (!regs) - return 0; - -+ /* No mm, no stack, no dump. */ -+ if (!current->mm) -+ return 0; -+ - /* - * Check if we fit in with the requested stack size into the: - * - TASK_SIZE -@@ -7685,6 +7716,9 @@ perf_callchain(struct perf_event *event, struct pt_regs *regs) - const u32 max_stack = event->attr.sample_max_stack; - struct perf_callchain_entry *callchain; - -+ if (!current->mm) -+ user = false; -+ - if (!kernel && !user) - return &__empty_callchain; - -diff --git a/kernel/exit.c b/kernel/exit.c -index 3540b2c9b1b6a0..03a1dd32e6ff3c 100644 ---- a/kernel/exit.c -+++ b/kernel/exit.c -@@ -858,6 +858,15 @@ void __noreturn do_exit(long code) - tsk->exit_code = code; - taskstats_exit(tsk, group_dead); - -+ /* -+ * Since sampling can touch ->mm, make sure to stop everything before we -+ * tear it down. -+ * -+ * Also flushes inherited counters to the parent - before the parent -+ * gets woken up by child-exit notifications. -+ */ -+ perf_event_exit_task(tsk); -+ - exit_mm(); - - if (group_dead) -@@ -874,14 +883,6 @@ void __noreturn do_exit(long code) - exit_task_work(tsk); - exit_thread(tsk); - -- /* -- * Flush inherited counters to the parent - before the parent -- * gets woken up by child-exit notifications. -- * -- * because of cgroup mode, must be called before cgroup_exit() -- */ -- perf_event_exit_task(tsk); -- - sched_autogroup_exit_task(tsk); - cgroup_exit(tsk); - -diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c -index 3130f24daf5979..353829883e66de 100644 ---- a/kernel/time/clocksource.c -+++ b/kernel/time/clocksource.c -@@ -288,7 +288,7 @@ static void clocksource_verify_choose_cpus(void) - { - int cpu, i, n = verify_n_cpus; - -- if (n < 0) { -+ if (n < 0 || n >= num_online_cpus()) { - /* Check all of the CPUs. */ - cpumask_copy(&cpus_chosen, cpu_online_mask); - cpumask_clear_cpu(smp_processor_id(), &cpus_chosen); -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 650493ed76cd40..4351b9069a919d 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -6772,9 +6772,10 @@ void ftrace_release_mod(struct module *mod) - - mutex_lock(&ftrace_lock); - -- if (ftrace_disabled) -- goto out_unlock; -- -+ /* -+ * To avoid the UAF problem after the module is unloaded, the -+ * 'mod_map' resource needs to be released unconditionally. -+ */ - list_for_each_entry_safe(mod_map, n, &ftrace_mod_maps, list) { - if (mod_map->mod == mod) { - list_del_rcu(&mod_map->list); -@@ -6783,6 +6784,9 @@ void ftrace_release_mod(struct module *mod) - } - } - -+ if (ftrace_disabled) -+ goto out_unlock; -+ - /* - * Each module has its own ftrace_pages, remove - * them from the list. -diff --git a/kernel/watchdog.c b/kernel/watchdog.c -index 5cd6d4e2691579..7abd69a776b20a 100644 ---- a/kernel/watchdog.c -+++ b/kernel/watchdog.c -@@ -40,6 +40,7 @@ int __read_mostly watchdog_user_enabled = 1; - static int __read_mostly watchdog_hardlockup_user_enabled = WATCHDOG_HARDLOCKUP_DEFAULT; - static int __read_mostly watchdog_softlockup_user_enabled = 1; - int __read_mostly watchdog_thresh = 10; -+static int __read_mostly watchdog_thresh_next; - static int __read_mostly watchdog_hardlockup_available; - - struct cpumask watchdog_cpumask __read_mostly; -@@ -627,12 +628,20 @@ int lockup_detector_offline_cpu(unsigned int cpu) - return 0; - } - --static void __lockup_detector_reconfigure(void) -+static void __lockup_detector_reconfigure(bool thresh_changed) - { - cpus_read_lock(); - watchdog_hardlockup_stop(); - - softlockup_stop_all(); -+ /* -+ * To prevent watchdog_timer_fn from using the old interval and -+ * the new watchdog_thresh at the same time, which could lead to -+ * false softlockup reports, it is necessary to update the -+ * watchdog_thresh after the softlockup is completed. -+ */ -+ if (thresh_changed) -+ watchdog_thresh = READ_ONCE(watchdog_thresh_next); - set_sample_period(); - lockup_detector_update_enable(); - if (watchdog_enabled && watchdog_thresh) -@@ -650,7 +659,7 @@ static void __lockup_detector_reconfigure(void) - void lockup_detector_reconfigure(void) - { - mutex_lock(&watchdog_mutex); -- __lockup_detector_reconfigure(); -+ __lockup_detector_reconfigure(false); - mutex_unlock(&watchdog_mutex); - } - -@@ -670,27 +679,29 @@ static __init void lockup_detector_setup(void) - return; - - mutex_lock(&watchdog_mutex); -- __lockup_detector_reconfigure(); -+ __lockup_detector_reconfigure(false); - softlockup_initialized = true; - mutex_unlock(&watchdog_mutex); - } - - #else /* CONFIG_SOFTLOCKUP_DETECTOR */ --static void __lockup_detector_reconfigure(void) -+static void __lockup_detector_reconfigure(bool thresh_changed) - { - cpus_read_lock(); - watchdog_hardlockup_stop(); -+ if (thresh_changed) -+ watchdog_thresh = READ_ONCE(watchdog_thresh_next); - lockup_detector_update_enable(); - watchdog_hardlockup_start(); - cpus_read_unlock(); - } - void lockup_detector_reconfigure(void) - { -- __lockup_detector_reconfigure(); -+ __lockup_detector_reconfigure(false); - } - static inline void lockup_detector_setup(void) - { -- __lockup_detector_reconfigure(); -+ __lockup_detector_reconfigure(false); - } - #endif /* !CONFIG_SOFTLOCKUP_DETECTOR */ - -@@ -726,11 +737,11 @@ void lockup_detector_soft_poweroff(void) - #ifdef CONFIG_SYSCTL - - /* Propagate any changes to the watchdog infrastructure */ --static void proc_watchdog_update(void) -+static void proc_watchdog_update(bool thresh_changed) - { - /* Remove impossible cpus to keep sysctl output clean. */ - cpumask_and(&watchdog_cpumask, &watchdog_cpumask, cpu_possible_mask); -- __lockup_detector_reconfigure(); -+ __lockup_detector_reconfigure(thresh_changed); - } - - /* -@@ -763,7 +774,7 @@ static int proc_watchdog_common(int which, struct ctl_table *table, int write, - old = READ_ONCE(*param); - err = proc_dointvec_minmax(table, write, buffer, lenp, ppos); - if (!err && old != READ_ONCE(*param)) -- proc_watchdog_update(); -+ proc_watchdog_update(false); - } - mutex_unlock(&watchdog_mutex); - return err; -@@ -812,11 +823,13 @@ int proc_watchdog_thresh(struct ctl_table *table, int write, - - mutex_lock(&watchdog_mutex); - -- old = READ_ONCE(watchdog_thresh); -+ watchdog_thresh_next = READ_ONCE(watchdog_thresh); -+ -+ old = watchdog_thresh_next; - err = proc_dointvec_minmax(table, write, buffer, lenp, ppos); - -- if (!err && write && old != READ_ONCE(watchdog_thresh)) -- proc_watchdog_update(); -+ if (!err && write && old != READ_ONCE(watchdog_thresh_next)) -+ proc_watchdog_update(true); - - mutex_unlock(&watchdog_mutex); - return err; -@@ -837,7 +850,7 @@ int proc_watchdog_cpumask(struct ctl_table *table, int write, - - err = proc_do_large_bitmap(table, write, buffer, lenp, ppos); - if (!err && write) -- proc_watchdog_update(); -+ proc_watchdog_update(false); - - mutex_unlock(&watchdog_mutex); - return err; -@@ -857,7 +870,7 @@ static struct ctl_table watchdog_sysctls[] = { - }, - { - .procname = "watchdog_thresh", -- .data = &watchdog_thresh, -+ .data = &watchdog_thresh_next, - .maxlen = sizeof(int), - .mode = 0644, - .proc_handler = proc_watchdog_thresh, -diff --git a/lib/Kconfig b/lib/Kconfig -index ee365b7402f193..43d69669465aff 100644 ---- a/lib/Kconfig -+++ b/lib/Kconfig -@@ -751,6 +751,7 @@ config GENERIC_LIB_DEVMEM_IS_ALLOWED - - config PLDMFW - bool -+ select CRC32 - default n - - config ASN1_ENCODER -diff --git a/mm/huge_memory.c b/mm/huge_memory.c -index 635f0f0f6860e8..78f5df12b8eb37 100644 ---- a/mm/huge_memory.c -+++ b/mm/huge_memory.c -@@ -2260,12 +2260,14 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd, - { - spinlock_t *ptl; - struct mmu_notifier_range range; -+ bool pmd_migration; - - mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, vma->vm_mm, - address & HPAGE_PMD_MASK, - (address & HPAGE_PMD_MASK) + HPAGE_PMD_SIZE); - mmu_notifier_invalidate_range_start(&range); - ptl = pmd_lock(vma->vm_mm, pmd); -+ pmd_migration = is_pmd_migration_entry(*pmd); - - /* - * If caller asks to setup a migration entry, we need a folio to check -@@ -2274,13 +2276,12 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd, - VM_BUG_ON(freeze && !folio); - VM_WARN_ON_ONCE(folio && !folio_test_locked(folio)); - -- if (pmd_trans_huge(*pmd) || pmd_devmap(*pmd) || -- is_pmd_migration_entry(*pmd)) { -+ if (pmd_trans_huge(*pmd) || pmd_devmap(*pmd) || pmd_migration) { - /* -- * It's safe to call pmd_page when folio is set because it's -- * guaranteed that pmd is present. -+ * Do not apply pmd_folio() to a migration entry; and folio lock -+ * guarantees that it must be of the wrong folio anyway. - */ -- if (folio && folio != page_folio(pmd_page(*pmd))) -+ if (folio && (pmd_migration || folio != page_folio(pmd_page(*pmd)))) - goto out; - __split_huge_pmd_locked(vma, pmd, range.start, freeze); - } -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index 7c196b754071bd..d57d8f1c2dfea4 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -96,7 +96,7 @@ static void hugetlb_vma_lock_free(struct vm_area_struct *vma); - static void hugetlb_vma_lock_alloc(struct vm_area_struct *vma); - static void __hugetlb_vma_unlock_write_free(struct vm_area_struct *vma); - static void hugetlb_unshare_pmds(struct vm_area_struct *vma, -- unsigned long start, unsigned long end); -+ unsigned long start, unsigned long end, bool take_locks); - static struct resv_map *vma_resv_map(struct vm_area_struct *vma); - - static inline bool subpool_is_free(struct hugepage_subpool *spool) -@@ -4903,26 +4903,40 @@ static int hugetlb_vm_op_split(struct vm_area_struct *vma, unsigned long addr) - { - if (addr & ~(huge_page_mask(hstate_vma(vma)))) - return -EINVAL; -+ return 0; -+} - -+void hugetlb_split(struct vm_area_struct *vma, unsigned long addr) -+{ - /* - * PMD sharing is only possible for PUD_SIZE-aligned address ranges - * in HugeTLB VMAs. If we will lose PUD_SIZE alignment due to this - * split, unshare PMDs in the PUD_SIZE interval surrounding addr now. -+ * This function is called in the middle of a VMA split operation, with -+ * MM, VMA and rmap all write-locked to prevent concurrent page table -+ * walks (except hardware and gup_fast()). - */ -+ vma_assert_write_locked(vma); -+ i_mmap_assert_write_locked(vma->vm_file->f_mapping); -+ - if (addr & ~PUD_MASK) { -- /* -- * hugetlb_vm_op_split is called right before we attempt to -- * split the VMA. We will need to unshare PMDs in the old and -- * new VMAs, so let's unshare before we split. -- */ - unsigned long floor = addr & PUD_MASK; - unsigned long ceil = floor + PUD_SIZE; - -- if (floor >= vma->vm_start && ceil <= vma->vm_end) -- hugetlb_unshare_pmds(vma, floor, ceil); -+ if (floor >= vma->vm_start && ceil <= vma->vm_end) { -+ /* -+ * Locking: -+ * Use take_locks=false here. -+ * The file rmap lock is already held. -+ * The hugetlb VMA lock can't be taken when we already -+ * hold the file rmap lock, and we don't need it because -+ * its purpose is to synchronize against concurrent page -+ * table walks, which are not possible thanks to the -+ * locks held by our caller. -+ */ -+ hugetlb_unshare_pmds(vma, floor, ceil, /* take_locks = */ false); -+ } - } -- -- return 0; - } - - static unsigned long hugetlb_vm_op_pagesize(struct vm_area_struct *vma) -@@ -7062,6 +7076,13 @@ int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, - return 0; - - pud_clear(pud); -+ /* -+ * Once our caller drops the rmap lock, some other process might be -+ * using this page table as a normal, non-hugetlb page table. -+ * Wait for pending gup_fast() in other threads to finish before letting -+ * that happen. -+ */ -+ tlb_remove_table_sync_one(); - ptdesc_pmd_pts_dec(virt_to_ptdesc(ptep)); - mm_dec_nr_pmds(mm); - return 1; -@@ -7298,9 +7319,16 @@ void move_hugetlb_state(struct folio *old_folio, struct folio *new_folio, int re - } - } - -+/* -+ * If @take_locks is false, the caller must ensure that no concurrent page table -+ * access can happen (except for gup_fast() and hardware page walks). -+ * If @take_locks is true, we take the hugetlb VMA lock (to lock out things like -+ * concurrent page fault handling) and the file rmap lock. -+ */ - static void hugetlb_unshare_pmds(struct vm_area_struct *vma, - unsigned long start, -- unsigned long end) -+ unsigned long end, -+ bool take_locks) - { - struct hstate *h = hstate_vma(vma); - unsigned long sz = huge_page_size(h); -@@ -7324,8 +7352,12 @@ static void hugetlb_unshare_pmds(struct vm_area_struct *vma, - mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, mm, - start, end); - mmu_notifier_invalidate_range_start(&range); -- hugetlb_vma_lock_write(vma); -- i_mmap_lock_write(vma->vm_file->f_mapping); -+ if (take_locks) { -+ hugetlb_vma_lock_write(vma); -+ i_mmap_lock_write(vma->vm_file->f_mapping); -+ } else { -+ i_mmap_assert_write_locked(vma->vm_file->f_mapping); -+ } - for (address = start; address < end; address += PUD_SIZE) { - ptep = hugetlb_walk(vma, address, sz); - if (!ptep) -@@ -7335,8 +7367,10 @@ static void hugetlb_unshare_pmds(struct vm_area_struct *vma, - spin_unlock(ptl); - } - flush_hugetlb_tlb_range(vma, start, end); -- i_mmap_unlock_write(vma->vm_file->f_mapping); -- hugetlb_vma_unlock_write(vma); -+ if (take_locks) { -+ i_mmap_unlock_write(vma->vm_file->f_mapping); -+ hugetlb_vma_unlock_write(vma); -+ } - /* - * No need to call mmu_notifier_arch_invalidate_secondary_tlbs(), see - * Documentation/mm/mmu_notifier.rst. -@@ -7351,7 +7385,8 @@ static void hugetlb_unshare_pmds(struct vm_area_struct *vma, - void hugetlb_unshare_all_pmds(struct vm_area_struct *vma) - { - hugetlb_unshare_pmds(vma, ALIGN(vma->vm_start, PUD_SIZE), -- ALIGN_DOWN(vma->vm_end, PUD_SIZE)); -+ ALIGN_DOWN(vma->vm_end, PUD_SIZE), -+ /* take_locks = */ true); - } - - #ifdef CONFIG_CMA -diff --git a/mm/mmap.c b/mm/mmap.c -index 03a24cb3951d47..a9c70001e45601 100644 ---- a/mm/mmap.c -+++ b/mm/mmap.c -@@ -2402,7 +2402,13 @@ int __split_vma(struct vma_iterator *vmi, struct vm_area_struct *vma, - init_vma_prep(&vp, vma); - vp.insert = new; - vma_prepare(&vp); -+ /* -+ * Get rid of huge pages and shared page tables straddling the split -+ * boundary. -+ */ - vma_adjust_trans_huge(vma, vma->vm_start, addr, 0); -+ if (is_vm_hugetlb_page(vma)) -+ hugetlb_split(vma, addr); - - if (new_below) { - vma->vm_start = addr; -diff --git a/mm/page-writeback.c b/mm/page-writeback.c -index e632ec9b642109..9ceb841af819e4 100644 ---- a/mm/page-writeback.c -+++ b/mm/page-writeback.c -@@ -541,8 +541,8 @@ static int dirty_ratio_handler(struct ctl_table *table, int write, void *buffer, - - ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); - if (ret == 0 && write && vm_dirty_ratio != old_ratio) { -- writeback_set_ratelimit(); - vm_dirty_bytes = 0; -+ writeback_set_ratelimit(); - } - return ret; - } -diff --git a/net/atm/common.c b/net/atm/common.c -index f7019df41c3e59..9cc82acbc73588 100644 ---- a/net/atm/common.c -+++ b/net/atm/common.c -@@ -635,6 +635,7 @@ int vcc_sendmsg(struct socket *sock, struct msghdr *m, size_t size) - - skb->dev = NULL; /* for paths shared with net_device interfaces */ - if (!copy_from_iter_full(skb_put(skb, size), size, &m->msg_iter)) { -+ atm_return_tx(vcc, skb); - kfree_skb(skb); - error = -EFAULT; - goto out; -diff --git a/net/atm/lec.c b/net/atm/lec.c -index ac3cfc1ae51024..b7fa48a9b72059 100644 ---- a/net/atm/lec.c -+++ b/net/atm/lec.c -@@ -124,6 +124,7 @@ static unsigned char bus_mac[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; - - /* Device structures */ - static struct net_device *dev_lec[MAX_LEC_ITF]; -+static DEFINE_MUTEX(lec_mutex); - - #if IS_ENABLED(CONFIG_BRIDGE) - static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev) -@@ -685,6 +686,7 @@ static int lec_vcc_attach(struct atm_vcc *vcc, void __user *arg) - int bytes_left; - struct atmlec_ioc ioc_data; - -+ lockdep_assert_held(&lec_mutex); - /* Lecd must be up in this case */ - bytes_left = copy_from_user(&ioc_data, arg, sizeof(struct atmlec_ioc)); - if (bytes_left != 0) -@@ -710,6 +712,7 @@ static int lec_vcc_attach(struct atm_vcc *vcc, void __user *arg) - - static int lec_mcast_attach(struct atm_vcc *vcc, int arg) - { -+ lockdep_assert_held(&lec_mutex); - if (arg < 0 || arg >= MAX_LEC_ITF) - return -EINVAL; - arg = array_index_nospec(arg, MAX_LEC_ITF); -@@ -725,6 +728,7 @@ static int lecd_attach(struct atm_vcc *vcc, int arg) - int i; - struct lec_priv *priv; - -+ lockdep_assert_held(&lec_mutex); - if (arg < 0) - arg = 0; - if (arg >= MAX_LEC_ITF) -@@ -742,6 +746,7 @@ static int lecd_attach(struct atm_vcc *vcc, int arg) - snprintf(dev_lec[i]->name, IFNAMSIZ, "lec%d", i); - if (register_netdev(dev_lec[i])) { - free_netdev(dev_lec[i]); -+ dev_lec[i] = NULL; - return -EINVAL; - } - -@@ -904,7 +909,6 @@ static void *lec_itf_walk(struct lec_state *state, loff_t *l) - v = (dev && netdev_priv(dev)) ? - lec_priv_walk(state, l, netdev_priv(dev)) : NULL; - if (!v && dev) { -- dev_put(dev); - /* Partial state reset for the next time we get called */ - dev = NULL; - } -@@ -928,6 +932,7 @@ static void *lec_seq_start(struct seq_file *seq, loff_t *pos) - { - struct lec_state *state = seq->private; - -+ mutex_lock(&lec_mutex); - state->itf = 0; - state->dev = NULL; - state->locked = NULL; -@@ -945,8 +950,9 @@ static void lec_seq_stop(struct seq_file *seq, void *v) - if (state->dev) { - spin_unlock_irqrestore(&state->locked->lec_arp_lock, - state->flags); -- dev_put(state->dev); -+ state->dev = NULL; - } -+ mutex_unlock(&lec_mutex); - } - - static void *lec_seq_next(struct seq_file *seq, void *v, loff_t *pos) -@@ -1003,6 +1009,7 @@ static int lane_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) - return -ENOIOCTLCMD; - } - -+ mutex_lock(&lec_mutex); - switch (cmd) { - case ATMLEC_CTRL: - err = lecd_attach(vcc, (int)arg); -@@ -1017,6 +1024,7 @@ static int lane_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) - break; - } - -+ mutex_unlock(&lec_mutex); - return err; - } - -diff --git a/net/atm/raw.c b/net/atm/raw.c -index 2b5f78a7ec3e4a..1e6511ec842cbc 100644 ---- a/net/atm/raw.c -+++ b/net/atm/raw.c -@@ -36,7 +36,7 @@ static void atm_pop_raw(struct atm_vcc *vcc, struct sk_buff *skb) - - pr_debug("(%d) %d -= %d\n", - vcc->vci, sk_wmem_alloc_get(sk), ATM_SKB(skb)->acct_truesize); -- WARN_ON(refcount_sub_and_test(ATM_SKB(skb)->acct_truesize, &sk->sk_wmem_alloc)); -+ atm_return_tx(vcc, skb); - dev_kfree_skb_any(skb); - sk->sk_write_space(sk); - } -diff --git a/net/bridge/br_mst.c b/net/bridge/br_mst.c -index 1820f09ff59ceb..3f24b4ee49c274 100644 ---- a/net/bridge/br_mst.c -+++ b/net/bridge/br_mst.c -@@ -80,10 +80,10 @@ static void br_mst_vlan_set_state(struct net_bridge_vlan_group *vg, - if (br_vlan_get_state(v) == state) - return; - -- br_vlan_set_state(v, state); -- - if (v->vid == vg->pvid) - br_vlan_set_pvid_state(vg, state); -+ -+ br_vlan_set_state(v, state); - } - - int br_mst_set_state(struct net_bridge_port *p, u16 msti, u8 state, -diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c -index c38244d60ff86e..fa16ee88ec396a 100644 ---- a/net/bridge/br_multicast.c -+++ b/net/bridge/br_multicast.c -@@ -2104,12 +2104,17 @@ static void __br_multicast_enable_port_ctx(struct net_bridge_mcast_port *pmctx) - } - } - --void br_multicast_enable_port(struct net_bridge_port *port) -+static void br_multicast_enable_port_ctx(struct net_bridge_mcast_port *pmctx) - { -- struct net_bridge *br = port->br; -+ struct net_bridge *br = pmctx->port->br; - - spin_lock_bh(&br->multicast_lock); -- __br_multicast_enable_port_ctx(&port->multicast_ctx); -+ if (br_multicast_port_ctx_is_vlan(pmctx) && -+ !(pmctx->vlan->priv_flags & BR_VLFLAG_MCAST_ENABLED)) { -+ spin_unlock_bh(&br->multicast_lock); -+ return; -+ } -+ __br_multicast_enable_port_ctx(pmctx); - spin_unlock_bh(&br->multicast_lock); - } - -@@ -2136,11 +2141,67 @@ static void __br_multicast_disable_port_ctx(struct net_bridge_mcast_port *pmctx) - br_multicast_rport_del_notify(pmctx, del); - } - -+static void br_multicast_disable_port_ctx(struct net_bridge_mcast_port *pmctx) -+{ -+ struct net_bridge *br = pmctx->port->br; -+ -+ spin_lock_bh(&br->multicast_lock); -+ if (br_multicast_port_ctx_is_vlan(pmctx) && -+ !(pmctx->vlan->priv_flags & BR_VLFLAG_MCAST_ENABLED)) { -+ spin_unlock_bh(&br->multicast_lock); -+ return; -+ } -+ -+ __br_multicast_disable_port_ctx(pmctx); -+ spin_unlock_bh(&br->multicast_lock); -+} -+ -+static void br_multicast_toggle_port(struct net_bridge_port *port, bool on) -+{ -+#if IS_ENABLED(CONFIG_BRIDGE_VLAN_FILTERING) -+ if (br_opt_get(port->br, BROPT_MCAST_VLAN_SNOOPING_ENABLED)) { -+ struct net_bridge_vlan_group *vg; -+ struct net_bridge_vlan *vlan; -+ -+ rcu_read_lock(); -+ vg = nbp_vlan_group_rcu(port); -+ if (!vg) { -+ rcu_read_unlock(); -+ return; -+ } -+ -+ /* iterate each vlan, toggle vlan multicast context */ -+ list_for_each_entry_rcu(vlan, &vg->vlan_list, vlist) { -+ struct net_bridge_mcast_port *pmctx = -+ &vlan->port_mcast_ctx; -+ u8 state = br_vlan_get_state(vlan); -+ /* enable vlan multicast context when state is -+ * LEARNING or FORWARDING -+ */ -+ if (on && br_vlan_state_allowed(state, true)) -+ br_multicast_enable_port_ctx(pmctx); -+ else -+ br_multicast_disable_port_ctx(pmctx); -+ } -+ rcu_read_unlock(); -+ return; -+ } -+#endif -+ /* toggle port multicast context when vlan snooping is disabled */ -+ if (on) -+ br_multicast_enable_port_ctx(&port->multicast_ctx); -+ else -+ br_multicast_disable_port_ctx(&port->multicast_ctx); -+} -+ -+void br_multicast_enable_port(struct net_bridge_port *port) -+{ -+ br_multicast_toggle_port(port, true); -+} -+ - void br_multicast_disable_port(struct net_bridge_port *port) - { -- spin_lock_bh(&port->br->multicast_lock); -- __br_multicast_disable_port_ctx(&port->multicast_ctx); -- spin_unlock_bh(&port->br->multicast_lock); -+ br_multicast_toggle_port(port, false); - } - - static int __grp_src_delete_marked(struct net_bridge_port_group *pg) -@@ -4210,6 +4271,32 @@ static void __br_multicast_stop(struct net_bridge_mcast *brmctx) - #endif - } - -+void br_multicast_update_vlan_mcast_ctx(struct net_bridge_vlan *v, u8 state) -+{ -+#if IS_ENABLED(CONFIG_BRIDGE_VLAN_FILTERING) -+ struct net_bridge *br; -+ -+ if (!br_vlan_should_use(v)) -+ return; -+ -+ if (br_vlan_is_master(v)) -+ return; -+ -+ br = v->port->br; -+ -+ if (!br_opt_get(br, BROPT_MCAST_VLAN_SNOOPING_ENABLED)) -+ return; -+ -+ if (br_vlan_state_allowed(state, true)) -+ br_multicast_enable_port_ctx(&v->port_mcast_ctx); -+ -+ /* Multicast is not disabled for the vlan when it goes in -+ * blocking state because the timers will expire and stop by -+ * themselves without sending more queries. -+ */ -+#endif -+} -+ - void br_multicast_toggle_one_vlan(struct net_bridge_vlan *vlan, bool on) - { - struct net_bridge *br; -@@ -4303,9 +4390,9 @@ int br_multicast_toggle_vlan_snooping(struct net_bridge *br, bool on, - __br_multicast_open(&br->multicast_ctx); - list_for_each_entry(p, &br->port_list, list) { - if (on) -- br_multicast_disable_port(p); -+ br_multicast_disable_port_ctx(&p->multicast_ctx); - else -- br_multicast_enable_port(p); -+ br_multicast_enable_port_ctx(&p->multicast_ctx); - } - - list_for_each_entry(vlan, &vg->vlan_list, vlist) -diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h -index 9197b511e45972..067d47b8eb8ffb 100644 ---- a/net/bridge/br_private.h -+++ b/net/bridge/br_private.h -@@ -1043,6 +1043,7 @@ void br_multicast_port_ctx_init(struct net_bridge_port *port, - struct net_bridge_vlan *vlan, - struct net_bridge_mcast_port *pmctx); - void br_multicast_port_ctx_deinit(struct net_bridge_mcast_port *pmctx); -+void br_multicast_update_vlan_mcast_ctx(struct net_bridge_vlan *v, u8 state); - void br_multicast_toggle_one_vlan(struct net_bridge_vlan *vlan, bool on); - int br_multicast_toggle_vlan_snooping(struct net_bridge *br, bool on, - struct netlink_ext_ack *extack); -@@ -1479,6 +1480,11 @@ static inline void br_multicast_port_ctx_deinit(struct net_bridge_mcast_port *pm - { - } - -+static inline void br_multicast_update_vlan_mcast_ctx(struct net_bridge_vlan *v, -+ u8 state) -+{ -+} -+ - static inline void br_multicast_toggle_one_vlan(struct net_bridge_vlan *vlan, - bool on) - { -@@ -1830,7 +1836,9 @@ bool br_vlan_global_opts_can_enter_range(const struct net_bridge_vlan *v_curr, - bool br_vlan_global_opts_fill(struct sk_buff *skb, u16 vid, u16 vid_range, - const struct net_bridge_vlan *v_opts); - --/* vlan state manipulation helpers using *_ONCE to annotate lock-free access */ -+/* vlan state manipulation helpers using *_ONCE to annotate lock-free access, -+ * while br_vlan_set_state() may access data protected by multicast_lock. -+ */ - static inline u8 br_vlan_get_state(const struct net_bridge_vlan *v) - { - return READ_ONCE(v->state); -@@ -1839,6 +1847,7 @@ static inline u8 br_vlan_get_state(const struct net_bridge_vlan *v) - static inline void br_vlan_set_state(struct net_bridge_vlan *v, u8 state) - { - WRITE_ONCE(v->state, state); -+ br_multicast_update_vlan_mcast_ctx(v, state); - } - - static inline u8 br_vlan_get_pvid_state(const struct net_bridge_vlan_group *vg) -diff --git a/net/core/filter.c b/net/core/filter.c -index 5143c8a9e52cab..3e10b4c8338f92 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -1968,10 +1968,11 @@ BPF_CALL_5(bpf_l4_csum_replace, struct sk_buff *, skb, u32, offset, - bool is_pseudo = flags & BPF_F_PSEUDO_HDR; - bool is_mmzero = flags & BPF_F_MARK_MANGLED_0; - bool do_mforce = flags & BPF_F_MARK_ENFORCE; -+ bool is_ipv6 = flags & BPF_F_IPV6; - __sum16 *ptr; - - if (unlikely(flags & ~(BPF_F_MARK_MANGLED_0 | BPF_F_MARK_ENFORCE | -- BPF_F_PSEUDO_HDR | BPF_F_HDR_FIELD_MASK))) -+ BPF_F_PSEUDO_HDR | BPF_F_HDR_FIELD_MASK | BPF_F_IPV6))) - return -EINVAL; - if (unlikely(offset > 0xffff || offset & 1)) - return -EFAULT; -@@ -1987,7 +1988,7 @@ BPF_CALL_5(bpf_l4_csum_replace, struct sk_buff *, skb, u32, offset, - if (unlikely(from != 0)) - return -EINVAL; - -- inet_proto_csum_replace_by_diff(ptr, skb, to, is_pseudo); -+ inet_proto_csum_replace_by_diff(ptr, skb, to, is_pseudo, is_ipv6); - break; - case 2: - inet_proto_csum_replace2(ptr, skb, from, to, is_pseudo); -@@ -3229,6 +3230,13 @@ static const struct bpf_func_proto bpf_skb_vlan_pop_proto = { - .arg1_type = ARG_PTR_TO_CTX, - }; - -+static void bpf_skb_change_protocol(struct sk_buff *skb, u16 proto) -+{ -+ skb->protocol = htons(proto); -+ if (skb_valid_dst(skb)) -+ skb_dst_drop(skb); -+} -+ - static int bpf_skb_generic_push(struct sk_buff *skb, u32 off, u32 len) - { - /* Caller already did skb_cow() with len as headroom, -@@ -3325,7 +3333,7 @@ static int bpf_skb_proto_4_to_6(struct sk_buff *skb) - } - } - -- skb->protocol = htons(ETH_P_IPV6); -+ bpf_skb_change_protocol(skb, ETH_P_IPV6); - skb_clear_hash(skb); - - return 0; -@@ -3355,7 +3363,7 @@ static int bpf_skb_proto_6_to_4(struct sk_buff *skb) - } - } - -- skb->protocol = htons(ETH_P_IP); -+ bpf_skb_change_protocol(skb, ETH_P_IP); - skb_clear_hash(skb); - - return 0; -@@ -3546,10 +3554,10 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff, - /* Match skb->protocol to new outer l3 protocol */ - if (skb->protocol == htons(ETH_P_IP) && - flags & BPF_F_ADJ_ROOM_ENCAP_L3_IPV6) -- skb->protocol = htons(ETH_P_IPV6); -+ bpf_skb_change_protocol(skb, ETH_P_IPV6); - else if (skb->protocol == htons(ETH_P_IPV6) && - flags & BPF_F_ADJ_ROOM_ENCAP_L3_IPV4) -- skb->protocol = htons(ETH_P_IP); -+ bpf_skb_change_protocol(skb, ETH_P_IP); - } - - if (skb_is_gso(skb)) { -@@ -3602,10 +3610,10 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 off, u32 len_diff, - /* Match skb->protocol to new outer l3 protocol */ - if (skb->protocol == htons(ETH_P_IP) && - flags & BPF_F_ADJ_ROOM_DECAP_L3_IPV6) -- skb->protocol = htons(ETH_P_IPV6); -+ bpf_skb_change_protocol(skb, ETH_P_IPV6); - else if (skb->protocol == htons(ETH_P_IPV6) && - flags & BPF_F_ADJ_ROOM_DECAP_L3_IPV4) -- skb->protocol = htons(ETH_P_IP); -+ bpf_skb_change_protocol(skb, ETH_P_IP); - - if (skb_is_gso(skb)) { - struct skb_shared_info *shinfo = skb_shinfo(skb); -diff --git a/net/core/skmsg.c b/net/core/skmsg.c -index 2076db464e9360..c3169e1e635248 100644 ---- a/net/core/skmsg.c -+++ b/net/core/skmsg.c -@@ -689,7 +689,8 @@ static void sk_psock_backlog(struct work_struct *work) - if (ret <= 0) { - if (ret == -EAGAIN) { - sk_psock_skb_state(psock, state, len, off); -- -+ /* Restore redir info we cleared before */ -+ skb_bpf_set_redir(skb, psock->sk, ingress); - /* Delay slightly to prioritize any - * other work that might be here. - */ -diff --git a/net/core/sock.c b/net/core/sock.c -index 84ba3f67bca97b..ec48690b5174eb 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -3817,7 +3817,7 @@ static int assign_proto_idx(struct proto *prot) - { - prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR); - -- if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) { -+ if (unlikely(prot->inuse_idx == PROTO_INUSE_NR)) { - pr_err("PROTO_INUSE_NR exhausted\n"); - return -ENOSPC; - } -@@ -3828,7 +3828,7 @@ static int assign_proto_idx(struct proto *prot) - - static void release_proto_idx(struct proto *prot) - { -- if (prot->inuse_idx != PROTO_INUSE_NR - 1) -+ if (prot->inuse_idx != PROTO_INUSE_NR) - clear_bit(prot->inuse_idx, proto_inuse_idx); - } - #else -diff --git a/net/core/utils.c b/net/core/utils.c -index c994e95172acf5..5895d034bf279d 100644 ---- a/net/core/utils.c -+++ b/net/core/utils.c -@@ -473,11 +473,11 @@ void inet_proto_csum_replace16(__sum16 *sum, struct sk_buff *skb, - EXPORT_SYMBOL(inet_proto_csum_replace16); - - void inet_proto_csum_replace_by_diff(__sum16 *sum, struct sk_buff *skb, -- __wsum diff, bool pseudohdr) -+ __wsum diff, bool pseudohdr, bool ipv6) - { - if (skb->ip_summed != CHECKSUM_PARTIAL) { - csum_replace_by_diff(sum, diff); -- if (skb->ip_summed == CHECKSUM_COMPLETE && pseudohdr) -+ if (skb->ip_summed == CHECKSUM_COMPLETE && pseudohdr && !ipv6) - skb->csum = ~csum_sub(diff, skb->csum); - } else if (pseudohdr) { - *sum = ~csum_fold(csum_add(diff, csum_unfold(*sum))); -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 97dc30a03dbf26..8ee1ad2d8c13f6 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -192,7 +192,11 @@ const __u8 ip_tos2prio[16] = { - EXPORT_SYMBOL(ip_tos2prio); - - static DEFINE_PER_CPU(struct rt_cache_stat, rt_cache_stat); -+#ifndef CONFIG_PREEMPT_RT - #define RT_CACHE_STAT_INC(field) raw_cpu_inc(rt_cache_stat.field) -+#else -+#define RT_CACHE_STAT_INC(field) this_cpu_inc(rt_cache_stat.field) -+#endif - - #ifdef CONFIG_PROC_FS - static void *rt_cache_seq_start(struct seq_file *seq, loff_t *pos) -diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c -index 32b28fc21b63c0..408985eb74eefa 100644 ---- a/net/ipv4/tcp_fastopen.c -+++ b/net/ipv4/tcp_fastopen.c -@@ -3,6 +3,7 @@ - #include - #include - #include -+#include - - void tcp_fastopen_init_key_once(struct net *net) - { -@@ -279,6 +280,8 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk, - - refcount_set(&req->rsk_refcnt, 2); - -+ sk_mark_napi_id_set(child, skb); -+ - /* Now finish processing the fastopen child socket. */ - tcp_init_transfer(child, BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB, skb); - -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index a172248b667837..f7b95bc8ad60bb 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -671,10 +671,12 @@ EXPORT_SYMBOL(tcp_initialize_rcv_mss); - */ - static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep) - { -- u32 new_sample = tp->rcv_rtt_est.rtt_us; -- long m = sample; -+ u32 new_sample, old_sample = tp->rcv_rtt_est.rtt_us; -+ long m = sample << 3; - -- if (new_sample != 0) { -+ if (old_sample == 0 || m < old_sample) { -+ new_sample = m; -+ } else { - /* If we sample in larger samples in the non-timestamp - * case, we could grossly overestimate the RTT especially - * with chatty applications or bulk transfer apps which -@@ -685,17 +687,9 @@ static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep) - * else with timestamps disabled convergence takes too - * long. - */ -- if (!win_dep) { -- m -= (new_sample >> 3); -- new_sample += m; -- } else { -- m <<= 3; -- if (m < new_sample) -- new_sample = m; -- } -- } else { -- /* No previous measure. */ -- new_sample = m << 3; -+ if (win_dep) -+ return; -+ new_sample = old_sample - (old_sample >> 3) + sample; - } - - tp->rcv_rtt_est.rtt_us = new_sample; -@@ -2469,20 +2463,33 @@ static inline bool tcp_packet_delayed(const struct tcp_sock *tp) - { - const struct sock *sk = (const struct sock *)tp; - -- if (tp->retrans_stamp && -- tcp_tsopt_ecr_before(tp, tp->retrans_stamp)) -- return true; /* got echoed TS before first retransmission */ -+ /* Received an echoed timestamp before the first retransmission? */ -+ if (tp->retrans_stamp) -+ return tcp_tsopt_ecr_before(tp, tp->retrans_stamp); -+ -+ /* We set tp->retrans_stamp upon the first retransmission of a loss -+ * recovery episode, so normally if tp->retrans_stamp is 0 then no -+ * retransmission has happened yet (likely due to TSQ, which can cause -+ * fast retransmits to be delayed). So if snd_una advanced while -+ * (tp->retrans_stamp is 0 then apparently a packet was merely delayed, -+ * not lost. But there are exceptions where we retransmit but then -+ * clear tp->retrans_stamp, so we check for those exceptions. -+ */ - -- /* Check if nothing was retransmitted (retrans_stamp==0), which may -- * happen in fast recovery due to TSQ. But we ignore zero retrans_stamp -- * in TCP_SYN_SENT, since when we set FLAG_SYN_ACKED we also clear -- * retrans_stamp even if we had retransmitted the SYN. -+ /* (1) For non-SACK connections, tcp_is_non_sack_preventing_reopen() -+ * clears tp->retrans_stamp when snd_una == high_seq. - */ -- if (!tp->retrans_stamp && /* no record of a retransmit/SYN? */ -- sk->sk_state != TCP_SYN_SENT) /* not the FLAG_SYN_ACKED case? */ -- return true; /* nothing was retransmitted */ -+ if (!tcp_is_sack(tp) && !before(tp->snd_una, tp->high_seq)) -+ return false; - -- return false; -+ /* (2) In TCP_SYN_SENT tcp_clean_rtx_queue() clears tp->retrans_stamp -+ * when setting FLAG_SYN_ACKED is set, even if the SYN was -+ * retransmitted. -+ */ -+ if (sk->sk_state == TCP_SYN_SENT) -+ return false; -+ -+ return true; /* tp->retrans_stamp is zero; no retransmit yet */ - } - - /* Undo procedures. */ -@@ -6705,6 +6712,9 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb) - if (!tp->srtt_us) - tcp_synack_rtt_meas(sk, req); - -+ if (tp->rx_opt.tstamp_ok) -+ tp->advmss -= TCPOLEN_TSTAMP_ALIGNED; -+ - if (req) { - tcp_rcv_synrecv_state_fastopen(sk); - } else { -@@ -6729,9 +6739,6 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb) - tp->snd_wnd = ntohs(th->window) << tp->rx_opt.snd_wscale; - tcp_init_wl(tp, TCP_SKB_CB(skb)->seq); - -- if (tp->rx_opt.tstamp_ok) -- tp->advmss -= TCPOLEN_TSTAMP_ALIGNED; -- - if (!inet_csk(sk)->icsk_ca_ops->cong_control) - tcp_update_pacing_rate(sk); - -diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c -index c07e3da08d2a8b..24666291c54a87 100644 ---- a/net/ipv6/calipso.c -+++ b/net/ipv6/calipso.c -@@ -1210,6 +1210,10 @@ static int calipso_req_setattr(struct request_sock *req, - struct ipv6_opt_hdr *old, *new; - struct sock *sk = sk_to_full_sk(req_to_sk(req)); - -+ /* sk is NULL for SYN+ACK w/ SYN Cookie */ -+ if (!sk) -+ return -ENOMEM; -+ - if (req_inet->ipv6_opt && req_inet->ipv6_opt->hopopt) - old = req_inet->ipv6_opt->hopopt; - else -@@ -1250,6 +1254,10 @@ static void calipso_req_delattr(struct request_sock *req) - struct ipv6_txoptions *txopts; - struct sock *sk = sk_to_full_sk(req_to_sk(req)); - -+ /* sk is NULL for SYN+ACK w/ SYN Cookie */ -+ if (!sk) -+ return; -+ - if (!req_inet->ipv6_opt || !req_inet->ipv6_opt->hopopt) - return; - -diff --git a/net/ipv6/ila/ila_common.c b/net/ipv6/ila/ila_common.c -index 95e9146918cc6f..b8d43ed4689db9 100644 ---- a/net/ipv6/ila/ila_common.c -+++ b/net/ipv6/ila/ila_common.c -@@ -86,7 +86,7 @@ static void ila_csum_adjust_transport(struct sk_buff *skb, - - diff = get_csum_diff(ip6h, p); - inet_proto_csum_replace_by_diff(&th->check, skb, -- diff, true); -+ diff, true, true); - } - break; - case NEXTHDR_UDP: -@@ -97,7 +97,7 @@ static void ila_csum_adjust_transport(struct sk_buff *skb, - if (uh->check || skb->ip_summed == CHECKSUM_PARTIAL) { - diff = get_csum_diff(ip6h, p); - inet_proto_csum_replace_by_diff(&uh->check, skb, -- diff, true); -+ diff, true, true); - if (!uh->check) - uh->check = CSUM_MANGLED_0; - } -@@ -111,7 +111,7 @@ static void ila_csum_adjust_transport(struct sk_buff *skb, - - diff = get_csum_diff(ip6h, p); - inet_proto_csum_replace_by_diff(&ih->icmp6_cksum, skb, -- diff, true); -+ diff, true, true); - } - break; - } -diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c -index c6395551f5df08..54930b06c3a4a5 100644 ---- a/net/mac80211/mesh_hwmp.c -+++ b/net/mac80211/mesh_hwmp.c -@@ -634,7 +634,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata, - mesh_path_add_gate(mpath); - } - rcu_read_unlock(); -- } else { -+ } else if (ifmsh->mshcfg.dot11MeshForwarding) { - rcu_read_lock(); - mpath = mesh_path_lookup(sdata, target_addr); - if (mpath) { -@@ -652,6 +652,8 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata, - } - } - rcu_read_unlock(); -+ } else { -+ forward = false; - } - - if (reply) { -@@ -669,7 +671,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata, - } - } - -- if (forward && ifmsh->mshcfg.dot11MeshForwarding) { -+ if (forward) { - u32 preq_id; - u8 hopcount; - -diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c -index 45a093d3f1fa7f..ec5469add68a27 100644 ---- a/net/mac80211/tx.c -+++ b/net/mac80211/tx.c -@@ -4507,8 +4507,10 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb, - IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, - NULL); - } else if (ieee80211_vif_is_mld(&sdata->vif) && -- sdata->vif.type == NL80211_IFTYPE_AP && -- !ieee80211_hw_check(&sdata->local->hw, MLO_MCAST_MULTI_LINK_TX)) { -+ ((sdata->vif.type == NL80211_IFTYPE_AP && -+ !ieee80211_hw_check(&sdata->local->hw, MLO_MCAST_MULTI_LINK_TX)) || -+ (sdata->vif.type == NL80211_IFTYPE_AP_VLAN && -+ !sdata->wdev.use_4addr))) { - ieee80211_mlo_multicast_tx(dev, skb); - } else { - normal: -diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c -index 43e8343df0db71..5a4b175b78c8c9 100644 ---- a/net/mpls/af_mpls.c -+++ b/net/mpls/af_mpls.c -@@ -81,8 +81,8 @@ static struct mpls_route *mpls_route_input_rcu(struct net *net, unsigned index) - - if (index < net->mpls.platform_labels) { - struct mpls_route __rcu **platform_label = -- rcu_dereference(net->mpls.platform_label); -- rt = rcu_dereference(platform_label[index]); -+ rcu_dereference_rtnl(net->mpls.platform_label); -+ rt = rcu_dereference_rtnl(platform_label[index]); - } - return rt; - } -diff --git a/net/nfc/nci/uart.c b/net/nfc/nci/uart.c -index ed1508a9e093ed..aab107727f186e 100644 ---- a/net/nfc/nci/uart.c -+++ b/net/nfc/nci/uart.c -@@ -119,22 +119,22 @@ static int nci_uart_set_driver(struct tty_struct *tty, unsigned int driver) - - memcpy(nu, nci_uart_drivers[driver], sizeof(struct nci_uart)); - nu->tty = tty; -- tty->disc_data = nu; - skb_queue_head_init(&nu->tx_q); - INIT_WORK(&nu->write_work, nci_uart_write_work); - spin_lock_init(&nu->rx_lock); - - ret = nu->ops.open(nu); - if (ret) { -- tty->disc_data = NULL; - kfree(nu); -+ return ret; - } else if (!try_module_get(nu->owner)) { - nu->ops.close(nu); -- tty->disc_data = NULL; - kfree(nu); - return -ENOENT; - } -- return ret; -+ tty->disc_data = nu; -+ -+ return 0; - } - - /* ------ LDISC part ------ */ -diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c -index d564675a8be4d7..e871cb53946a3e 100644 ---- a/net/sched/sch_sfq.c -+++ b/net/sched/sch_sfq.c -@@ -656,6 +656,14 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt, - NL_SET_ERR_MSG_MOD(extack, "invalid quantum"); - return -EINVAL; - } -+ -+ if (ctl->perturb_period < 0 || -+ ctl->perturb_period > INT_MAX / HZ) { -+ NL_SET_ERR_MSG_MOD(extack, "invalid perturb period"); -+ return -EINVAL; -+ } -+ perturb_period = ctl->perturb_period * HZ; -+ - if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max, - ctl_v1->Wlog, ctl_v1->Scell_log, NULL)) - return -EINVAL; -@@ -672,14 +680,12 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt, - headdrop = q->headdrop; - maxdepth = q->maxdepth; - maxflows = q->maxflows; -- perturb_period = q->perturb_period; - quantum = q->quantum; - flags = q->flags; - - /* update and validate configuration */ - if (ctl->quantum) - quantum = ctl->quantum; -- perturb_period = ctl->perturb_period * HZ; - if (ctl->flows) - maxflows = min_t(u32, ctl->flows, SFQ_MAX_FLOWS); - if (ctl->divisor) { -diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c -index 951a87909c2974..d162e2dd860255 100644 ---- a/net/sched/sch_taprio.c -+++ b/net/sched/sch_taprio.c -@@ -1338,13 +1338,15 @@ static int taprio_dev_notifier(struct notifier_block *nb, unsigned long event, - - stab = rtnl_dereference(q->root->stab); - -- oper = rtnl_dereference(q->oper_sched); -+ rcu_read_lock(); -+ oper = rcu_dereference(q->oper_sched); - if (oper) - taprio_update_queue_max_sdu(q, oper, stab); - -- admin = rtnl_dereference(q->admin_sched); -+ admin = rcu_dereference(q->admin_sched); - if (admin) - taprio_update_queue_max_sdu(q, admin, stab); -+ rcu_read_unlock(); - - break; - } -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index b84c5e0a76f52d..adc04e88f349f0 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -9094,7 +9094,8 @@ static void __sctp_write_space(struct sctp_association *asoc) - wq = rcu_dereference(sk->sk_wq); - if (wq) { - if (waitqueue_active(&wq->wait)) -- wake_up_interruptible(&wq->wait); -+ wake_up_interruptible_poll(&wq->wait, EPOLLOUT | -+ EPOLLWRNORM | EPOLLWRBAND); - - /* Note that we try to include the Async I/O support - * here by modeling from the current TCP/UDP code. -diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c -index b43dc8409b1fb0..4d8d460747164e 100644 ---- a/net/sunrpc/svc.c -+++ b/net/sunrpc/svc.c -@@ -1344,7 +1344,8 @@ svc_process_common(struct svc_rqst *rqstp) - case SVC_OK: - break; - case SVC_GARBAGE: -- goto err_garbage_args; -+ rqstp->rq_auth_stat = rpc_autherr_badcred; -+ goto err_bad_auth; - case SVC_SYSERR: - goto err_system_err; - case SVC_DENIED: -@@ -1485,14 +1486,6 @@ svc_process_common(struct svc_rqst *rqstp) - *rqstp->rq_accept_statp = rpc_proc_unavail; - goto sendit; - --err_garbage_args: -- svc_printk(rqstp, "failed to decode RPC header\n"); -- -- if (serv->sv_stats) -- serv->sv_stats->rpcbadfmt++; -- *rqstp->rq_accept_statp = rpc_garbage_args; -- goto sendit; -- - err_system_err: - if (serv->sv_stats) - serv->sv_stats->rpcbadfmt++; -diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c -index 29df05879c8e95..f90d84492bbedc 100644 ---- a/net/sunrpc/xprtsock.c -+++ b/net/sunrpc/xprtsock.c -@@ -2724,6 +2724,11 @@ static void xs_tcp_tls_setup_socket(struct work_struct *work) - } - rpc_shutdown_client(lower_clnt); - -+ /* Check for ingress data that arrived before the socket's -+ * ->data_ready callback was set up. -+ */ -+ xs_poll_check_readable(upper_transport); -+ - out_unlock: - current_restore_flags(pflags, PF_MEMALLOC); - upper_transport->clnt = NULL; -diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c -index 79f91b6ca8c847..ea5bb131ebd060 100644 ---- a/net/tipc/crypto.c -+++ b/net/tipc/crypto.c -@@ -425,7 +425,7 @@ static void tipc_aead_free(struct rcu_head *rp) - } - free_percpu(aead->tfm_entry); - kfree_sensitive(aead->key); -- kfree(aead); -+ kfree_sensitive(aead); - } - - static int tipc_aead_users(struct tipc_aead __rcu *aead) -diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c -index b16ca400ff559c..e993bd6ed7c26f 100644 ---- a/net/tipc/udp_media.c -+++ b/net/tipc/udp_media.c -@@ -489,7 +489,7 @@ int tipc_udp_nl_dump_remoteip(struct sk_buff *skb, struct netlink_callback *cb) - - rtnl_lock(); - b = tipc_bearer_find(net, bname); -- if (!b) { -+ if (!b || b->bcast_addr.media_id != TIPC_MEDIA_TYPE_UDP) { - rtnl_unlock(); - return -EINVAL; - } -@@ -500,7 +500,7 @@ int tipc_udp_nl_dump_remoteip(struct sk_buff *skb, struct netlink_callback *cb) - - rtnl_lock(); - b = rtnl_dereference(tn->bearer_list[bid]); -- if (!b) { -+ if (!b || b->bcast_addr.media_id != TIPC_MEDIA_TYPE_UDP) { - rtnl_unlock(); - return -EINVAL; - } -diff --git a/net/wireless/core.c b/net/wireless/core.c -index a2b15349324b6e..f6693983b5e986 100644 ---- a/net/wireless/core.c -+++ b/net/wireless/core.c -@@ -550,6 +550,9 @@ struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv, - INIT_WORK(&rdev->mgmt_registrations_update_wk, - cfg80211_mgmt_registrations_update_wk); - spin_lock_init(&rdev->mgmt_registrations_lock); -+ INIT_WORK(&rdev->wiphy_work, cfg80211_wiphy_work); -+ INIT_LIST_HEAD(&rdev->wiphy_work_list); -+ spin_lock_init(&rdev->wiphy_work_lock); - - #ifdef CONFIG_CFG80211_DEFAULT_PS - rdev->wiphy.flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT; -@@ -567,9 +570,6 @@ struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv, - return NULL; - } - -- INIT_WORK(&rdev->wiphy_work, cfg80211_wiphy_work); -- INIT_LIST_HEAD(&rdev->wiphy_work_list); -- spin_lock_init(&rdev->wiphy_work_lock); - INIT_WORK(&rdev->rfkill_block, cfg80211_rfkill_block_work); - INIT_WORK(&rdev->conn_work, cfg80211_conn_work); - INIT_WORK(&rdev->event_work, cfg80211_event_work); -diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c -index 95fcd2d3433e4b..0fbbc62ed3edec 100644 ---- a/security/selinux/xfrm.c -+++ b/security/selinux/xfrm.c -@@ -95,7 +95,7 @@ static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp, - - ctx->ctx_doi = XFRM_SC_DOI_LSM; - ctx->ctx_alg = XFRM_SC_ALG_SELINUX; -- ctx->ctx_len = str_len; -+ ctx->ctx_len = str_len + 1; - memcpy(ctx->ctx_str, &uctx[1], str_len); - ctx->ctx_str[str_len] = '\0'; - rc = security_context_to_sid(ctx->ctx_str, str_len, -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index 3a0df631d25d91..3cd5b7da8e1528 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -2266,6 +2266,8 @@ static const struct snd_pci_quirk power_save_denylist[] = { - SND_PCI_QUIRK(0x1734, 0x1232, "KONTRON SinglePC", 0), - /* Dell ALC3271 */ - SND_PCI_QUIRK(0x1028, 0x0962, "Dell ALC3271", 0), -+ /* https://bugzilla.kernel.org/show_bug.cgi?id=220210 */ -+ SND_PCI_QUIRK(0x17aa, 0x5079, "Lenovo Thinkpad E15", 0), - {} - }; - #endif /* CONFIG_PM */ -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 440b934cdc284a..82210b1e3b9782 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -9952,6 +9952,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC), - SND_PCI_QUIRK(0x1028, 0x0872, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC), - SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB), -+ SND_PCI_QUIRK(0x1028, 0x0879, "Dell Latitude 5420 Rugged", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1028, 0x08ad, "Dell WYSE AIO", ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1028, 0x08ae, "Dell WYSE NB", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), -diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c -index 622df58a969421..9fdee74c28df27 100644 ---- a/sound/soc/amd/yc/acp6x-mach.c -+++ b/sound/soc/amd/yc/acp6x-mach.c -@@ -311,6 +311,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "83AS"), - } - }, -+ { -+ .driver_data = &acp6x_card, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "83HN"), -+ } -+ }, - { - .driver_data = &acp6x_card, - .matches = { -@@ -360,7 +367,7 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "M5402RA"), - } - }, -- { -+ { - .driver_data = &acp6x_card, - .matches = { - DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), -diff --git a/sound/soc/codecs/tas2770.c b/sound/soc/codecs/tas2770.c -index 5c6b825c757b33..181b16530e5bc9 100644 ---- a/sound/soc/codecs/tas2770.c -+++ b/sound/soc/codecs/tas2770.c -@@ -158,11 +158,37 @@ static const struct snd_kcontrol_new isense_switch = - static const struct snd_kcontrol_new vsense_switch = - SOC_DAPM_SINGLE("Switch", TAS2770_PWR_CTRL, 2, 1, 1); - -+static int sense_event(struct snd_soc_dapm_widget *w, -+ struct snd_kcontrol *kcontrol, int event) -+{ -+ struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm); -+ struct tas2770_priv *tas2770 = snd_soc_component_get_drvdata(component); -+ -+ /* -+ * Powering up ISENSE/VSENSE requires a trip through the shutdown state. -+ * Do that here to ensure that our changes are applied properly, otherwise -+ * we might end up with non-functional IVSENSE if playback started earlier, -+ * which would break software speaker protection. -+ */ -+ switch (event) { -+ case SND_SOC_DAPM_PRE_REG: -+ return snd_soc_component_update_bits(component, TAS2770_PWR_CTRL, -+ TAS2770_PWR_CTRL_MASK, -+ TAS2770_PWR_CTRL_SHUTDOWN); -+ case SND_SOC_DAPM_POST_REG: -+ return tas2770_update_pwr_ctrl(tas2770); -+ default: -+ return 0; -+ } -+} -+ - static const struct snd_soc_dapm_widget tas2770_dapm_widgets[] = { - SND_SOC_DAPM_AIF_IN("ASI1", "ASI1 Playback", 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_MUX("ASI1 Sel", SND_SOC_NOPM, 0, 0, &tas2770_asi1_mux), -- SND_SOC_DAPM_SWITCH("ISENSE", TAS2770_PWR_CTRL, 3, 1, &isense_switch), -- SND_SOC_DAPM_SWITCH("VSENSE", TAS2770_PWR_CTRL, 2, 1, &vsense_switch), -+ SND_SOC_DAPM_SWITCH_E("ISENSE", TAS2770_PWR_CTRL, 3, 1, &isense_switch, -+ sense_event, SND_SOC_DAPM_PRE_REG | SND_SOC_DAPM_POST_REG), -+ SND_SOC_DAPM_SWITCH_E("VSENSE", TAS2770_PWR_CTRL, 2, 1, &vsense_switch, -+ sense_event, SND_SOC_DAPM_PRE_REG | SND_SOC_DAPM_POST_REG), - SND_SOC_DAPM_DAC_E("DAC", NULL, SND_SOC_NOPM, 0, 0, tas2770_dac_event, - SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD), - SND_SOC_DAPM_OUTPUT("OUT"), -diff --git a/sound/soc/meson/meson-card-utils.c b/sound/soc/meson/meson-card-utils.c -index f7fd9c013e19f7..1adaf0041a4804 100644 ---- a/sound/soc/meson/meson-card-utils.c -+++ b/sound/soc/meson/meson-card-utils.c -@@ -231,7 +231,7 @@ static int meson_card_parse_of_optional(struct snd_soc_card *card, - const char *p)) - { - /* If property is not provided, don't fail ... */ -- if (!of_property_read_bool(card->dev->of_node, propname)) -+ if (!of_property_present(card->dev->of_node, propname)) - return 0; - - /* ... but do fail if it is provided and the parsing fails */ -diff --git a/sound/soc/qcom/sdm845.c b/sound/soc/qcom/sdm845.c -index 3eb29645a6377c..39d22304ce43ff 100644 ---- a/sound/soc/qcom/sdm845.c -+++ b/sound/soc/qcom/sdm845.c -@@ -90,6 +90,10 @@ static int sdm845_slim_snd_hw_params(struct snd_pcm_substream *substream, - else - ret = snd_soc_dai_set_channel_map(cpu_dai, tx_ch_cnt, - tx_ch, 0, NULL); -+ if (ret != 0 && ret != -ENOTSUPP) { -+ dev_err(rtd->dev, "failed to set cpu chan map, err:%d\n", ret); -+ return ret; -+ } - } - - return 0; -diff --git a/sound/soc/tegra/tegra210_ahub.c b/sound/soc/tegra/tegra210_ahub.c -index ab3c6b2544d205..140cb27f73287e 100644 ---- a/sound/soc/tegra/tegra210_ahub.c -+++ b/sound/soc/tegra/tegra210_ahub.c -@@ -1359,6 +1359,8 @@ static int tegra_ahub_probe(struct platform_device *pdev) - return -ENOMEM; - - ahub->soc_data = of_device_get_match_data(&pdev->dev); -+ if (!ahub->soc_data) -+ return -ENODEV; - - platform_set_drvdata(pdev, ahub); - -diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c -index 0e9b5431a47f20..faac7df1fbcf02 100644 ---- a/sound/usb/mixer_maps.c -+++ b/sound/usb/mixer_maps.c -@@ -383,6 +383,13 @@ static const struct usbmix_name_map ms_usb_link_map[] = { - { 0 } /* terminator */ - }; - -+/* KTMicro USB */ -+static struct usbmix_name_map s31b2_0022_map[] = { -+ { 23, "Speaker Playback" }, -+ { 18, "Headphone Playback" }, -+ { 0 } -+}; -+ - /* ASUS ROG Zenith II with Realtek ALC1220-VB */ - static const struct usbmix_name_map asus_zenith_ii_map[] = { - { 19, NULL, 12 }, /* FU, Input Gain Pad - broken response, disabled */ -@@ -692,6 +699,11 @@ static const struct usbmix_ctl_map usbmix_ctl_maps[] = { - .id = USB_ID(0x045e, 0x083c), - .map = ms_usb_link_map, - }, -+ { -+ /* KTMicro USB */ -+ .id = USB_ID(0X31b2, 0x0022), -+ .map = s31b2_0022_map, -+ }, - { 0 } /* terminator */ - }; - -diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h -index 2a90f04a4160db..2e064a1032a050 100644 ---- a/tools/include/uapi/linux/bpf.h -+++ b/tools/include/uapi/linux/bpf.h -@@ -1913,6 +1913,7 @@ union bpf_attr { - * for updates resulting in a null checksum the value is set to - * **CSUM_MANGLED_0** instead. Flag **BPF_F_PSEUDO_HDR** indicates - * the checksum is to be computed against a pseudo-header. -+ * Flag **BPF_F_IPV6** should be set for IPv6 packets. - * - * This helper works in combination with **bpf_csum_diff**\ (), - * which does not update the checksum in-place, but offers more -@@ -5920,6 +5921,7 @@ enum { - BPF_F_PSEUDO_HDR = (1ULL << 4), - BPF_F_MARK_MANGLED_0 = (1ULL << 5), - BPF_F_MARK_ENFORCE = (1ULL << 6), -+ BPF_F_IPV6 = (1ULL << 7), - }; - - /* BPF_FUNC_clone_redirect and BPF_FUNC_redirect flags. */ -diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c -index 8484b563b53d0a..2e9f28cece3ffe 100644 ---- a/tools/lib/bpf/btf.c -+++ b/tools/lib/bpf/btf.c -@@ -3922,6 +3922,19 @@ static bool btf_dedup_identical_structs(struct btf_dedup *d, __u32 id1, __u32 id - return true; - } - -+static bool btf_dedup_identical_ptrs(struct btf_dedup *d, __u32 id1, __u32 id2) -+{ -+ struct btf_type *t1, *t2; -+ -+ t1 = btf_type_by_id(d->btf, id1); -+ t2 = btf_type_by_id(d->btf, id2); -+ -+ if (!btf_is_ptr(t1) || !btf_is_ptr(t2)) -+ return false; -+ -+ return t1->type == t2->type; -+} -+ - /* - * Check equivalence of BTF type graph formed by candidate struct/union (we'll - * call it "candidate graph" in this description for brevity) to a type graph -@@ -4054,6 +4067,9 @@ static int btf_dedup_is_equiv(struct btf_dedup *d, __u32 cand_id, - */ - if (btf_dedup_identical_structs(d, hypot_type_id, cand_id)) - return 1; -+ /* A similar case is again observed for PTRs. */ -+ if (btf_dedup_identical_ptrs(d, hypot_type_id, cand_id)) -+ return 1; - return 0; - } - -diff --git a/tools/perf/util/print-events.c b/tools/perf/util/print-events.c -index 9bee082194d5ea..fb11a967c450dc 100644 ---- a/tools/perf/util/print-events.c -+++ b/tools/perf/util/print-events.c -@@ -271,6 +271,7 @@ bool is_event_supported(u8 type, u64 config) - ret = evsel__open(evsel, NULL, tmap) >= 0; - } - -+ evsel__close(evsel); - evsel__delete(evsel); - } - -diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile -index 7e8c937627dd94..13ce9a53d5dec5 100644 ---- a/tools/testing/selftests/x86/Makefile -+++ b/tools/testing/selftests/x86/Makefile -@@ -12,7 +12,7 @@ CAN_BUILD_WITH_NOPIE := $(shell ./check_cc.sh "$(CC)" trivial_program.c -no-pie) - - TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt test_mremap_vdso \ - check_initial_reg_state sigreturn iopl ioperm \ -- test_vsyscall mov_ss_trap \ -+ test_vsyscall mov_ss_trap sigtrap_loop \ - syscall_arg_fault fsgsbase_restore sigaltstack - TARGETS_C_32BIT_ONLY := entry_from_vm86 test_syscall_vdso unwind_vdso \ - test_FCMOV test_FCOMI test_FISTTP \ -diff --git a/tools/testing/selftests/x86/sigtrap_loop.c b/tools/testing/selftests/x86/sigtrap_loop.c -new file mode 100644 -index 00000000000000..9d065479e89f94 ---- /dev/null -+++ b/tools/testing/selftests/x86/sigtrap_loop.c -@@ -0,0 +1,101 @@ -+// SPDX-License-Identifier: GPL-2.0-only -+/* -+ * Copyright (C) 2025 Intel Corporation -+ */ -+#define _GNU_SOURCE -+ -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#ifdef __x86_64__ -+# define REG_IP REG_RIP -+#else -+# define REG_IP REG_EIP -+#endif -+ -+static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *), int flags) -+{ -+ struct sigaction sa; -+ -+ memset(&sa, 0, sizeof(sa)); -+ sa.sa_sigaction = handler; -+ sa.sa_flags = SA_SIGINFO | flags; -+ sigemptyset(&sa.sa_mask); -+ -+ if (sigaction(sig, &sa, 0)) -+ err(1, "sigaction"); -+ -+ return; -+} -+ -+static void sigtrap(int sig, siginfo_t *info, void *ctx_void) -+{ -+ ucontext_t *ctx = (ucontext_t *)ctx_void; -+ static unsigned int loop_count_on_same_ip; -+ static unsigned long last_trap_ip; -+ -+ if (last_trap_ip == ctx->uc_mcontext.gregs[REG_IP]) { -+ printf("\tTrapped at %016lx\n", last_trap_ip); -+ -+ /* -+ * If the same IP is hit more than 10 times in a row, it is -+ * _considered_ an infinite loop. -+ */ -+ if (++loop_count_on_same_ip > 10) { -+ printf("[FAIL]\tDetected SIGTRAP infinite loop\n"); -+ exit(1); -+ } -+ -+ return; -+ } -+ -+ loop_count_on_same_ip = 0; -+ last_trap_ip = ctx->uc_mcontext.gregs[REG_IP]; -+ printf("\tTrapped at %016lx\n", last_trap_ip); -+} -+ -+int main(int argc, char *argv[]) -+{ -+ sethandler(SIGTRAP, sigtrap, 0); -+ -+ /* -+ * Set the Trap Flag (TF) to single-step the test code, therefore to -+ * trigger a SIGTRAP signal after each instruction until the TF is -+ * cleared. -+ * -+ * Because the arithmetic flags are not significant here, the TF is -+ * set by pushing 0x302 onto the stack and then popping it into the -+ * flags register. -+ * -+ * Four instructions in the following asm code are executed with the -+ * TF set, thus the SIGTRAP handler is expected to run four times. -+ */ -+ printf("[RUN]\tSIGTRAP infinite loop detection\n"); -+ asm volatile( -+#ifdef __x86_64__ -+ /* -+ * Avoid clobbering the redzone -+ * -+ * Equivalent to "sub $128, %rsp", however -128 can be encoded -+ * in a single byte immediate while 128 uses 4 bytes. -+ */ -+ "add $-128, %rsp\n\t" -+#endif -+ "push $0x302\n\t" -+ "popf\n\t" -+ "nop\n\t" -+ "nop\n\t" -+ "push $0x202\n\t" -+ "popf\n\t" -+#ifdef __x86_64__ -+ "sub $-128, %rsp\n\t" -+#endif -+ ); -+ -+ printf("[OK]\tNo SIGTRAP infinite loop detected\n"); -+ return 0; -+} diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.095-096.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.095-096.patch deleted file mode 100644 index ccc41e9870..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.095-096.patch +++ /dev/null @@ -1,5580 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/serial/8250.yaml b/Documentation/devicetree/bindings/serial/8250.yaml -index 692aa05500fd53..6ba0325039be21 100644 ---- a/Documentation/devicetree/bindings/serial/8250.yaml -+++ b/Documentation/devicetree/bindings/serial/8250.yaml -@@ -45,7 +45,7 @@ allOf: - - ns16550 - - ns16550a - then: -- anyOf: -+ oneOf: - - required: [ clock-frequency ] - - required: [ clocks ] - -diff --git a/Makefile b/Makefile -index 679dff5e165c07..038fc8e0982bdc 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 95 -+SUBLEVEL = 96 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm/include/asm/ptrace.h b/arch/arm/include/asm/ptrace.h -index 7f44e88d1f25bc..14a38cc67e0bc9 100644 ---- a/arch/arm/include/asm/ptrace.h -+++ b/arch/arm/include/asm/ptrace.h -@@ -10,6 +10,7 @@ - #include - - #ifndef __ASSEMBLY__ -+#include - #include - - struct pt_regs { -@@ -35,8 +36,8 @@ struct svc_pt_regs { - - #ifndef CONFIG_CPU_V7M - #define isa_mode(regs) \ -- ((((regs)->ARM_cpsr & PSR_J_BIT) >> (__ffs(PSR_J_BIT) - 1)) | \ -- (((regs)->ARM_cpsr & PSR_T_BIT) >> (__ffs(PSR_T_BIT)))) -+ (FIELD_GET(PSR_J_BIT, (regs)->ARM_cpsr) << 1 | \ -+ FIELD_GET(PSR_T_BIT, (regs)->ARM_cpsr)) - #else - #define isa_mode(regs) 1 /* Thumb */ - #endif -diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S -index ebad8c8b8c57dd..0476ce7700dfaa 100644 ---- a/arch/s390/kernel/entry.S -+++ b/arch/s390/kernel/entry.S -@@ -639,7 +639,7 @@ SYM_CODE_START(stack_overflow) - stmg %r0,%r7,__PT_R0(%r11) - stmg %r8,%r9,__PT_PSW(%r11) - mvc __PT_R8(64,%r11),0(%r14) -- stg %r10,__PT_ORIG_GPR2(%r11) # store last break to orig_gpr2 -+ mvc __PT_ORIG_GPR2(8,%r11),__LC_PGM_LAST_BREAK - xc __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15) - lgr %r2,%r11 # pass pointer to pt_regs - jg kernel_stack_overflow -diff --git a/arch/um/drivers/ubd_user.c b/arch/um/drivers/ubd_user.c -index a1afe414ce4814..fb5b1e7c133d86 100644 ---- a/arch/um/drivers/ubd_user.c -+++ b/arch/um/drivers/ubd_user.c -@@ -41,7 +41,7 @@ int start_io_thread(unsigned long sp, int *fd_out) - *fd_out = fds[1]; - - err = os_set_fd_block(*fd_out, 0); -- err = os_set_fd_block(kernel_fd, 0); -+ err |= os_set_fd_block(kernel_fd, 0); - if (err) { - printk("start_io_thread - failed to set nonblocking I/O.\n"); - goto out_close; -diff --git a/arch/um/include/asm/asm-prototypes.h b/arch/um/include/asm/asm-prototypes.h -index 5898a26daa0dd4..408b31d591279d 100644 ---- a/arch/um/include/asm/asm-prototypes.h -+++ b/arch/um/include/asm/asm-prototypes.h -@@ -1 +1,6 @@ - #include -+#include -+ -+#ifdef CONFIG_UML_X86 -+extern void cmpxchg8b_emu(void); -+#endif -diff --git a/arch/um/kernel/trap.c b/arch/um/kernel/trap.c -index 6d8ae86ae978fd..c16b80011adaac 100644 ---- a/arch/um/kernel/trap.c -+++ b/arch/um/kernel/trap.c -@@ -17,6 +17,122 @@ - #include - #include - -+/* -+ * NOTE: UML does not have exception tables. As such, this is almost a copy -+ * of the code in mm/memory.c, only adjusting the logic to simply check whether -+ * we are coming from the kernel instead of doing an additional lookup in the -+ * exception table. -+ * We can do this simplification because we never get here if the exception was -+ * fixable. -+ */ -+static inline bool get_mmap_lock_carefully(struct mm_struct *mm, bool is_user) -+{ -+ if (likely(mmap_read_trylock(mm))) -+ return true; -+ -+ if (!is_user) -+ return false; -+ -+ return !mmap_read_lock_killable(mm); -+} -+ -+static inline bool mmap_upgrade_trylock(struct mm_struct *mm) -+{ -+ /* -+ * We don't have this operation yet. -+ * -+ * It should be easy enough to do: it's basically a -+ * atomic_long_try_cmpxchg_acquire() -+ * from RWSEM_READER_BIAS -> RWSEM_WRITER_LOCKED, but -+ * it also needs the proper lockdep magic etc. -+ */ -+ return false; -+} -+ -+static inline bool upgrade_mmap_lock_carefully(struct mm_struct *mm, bool is_user) -+{ -+ mmap_read_unlock(mm); -+ if (!is_user) -+ return false; -+ -+ return !mmap_write_lock_killable(mm); -+} -+ -+/* -+ * Helper for page fault handling. -+ * -+ * This is kind of equivalend to "mmap_read_lock()" followed -+ * by "find_extend_vma()", except it's a lot more careful about -+ * the locking (and will drop the lock on failure). -+ * -+ * For example, if we have a kernel bug that causes a page -+ * fault, we don't want to just use mmap_read_lock() to get -+ * the mm lock, because that would deadlock if the bug were -+ * to happen while we're holding the mm lock for writing. -+ * -+ * So this checks the exception tables on kernel faults in -+ * order to only do this all for instructions that are actually -+ * expected to fault. -+ * -+ * We can also actually take the mm lock for writing if we -+ * need to extend the vma, which helps the VM layer a lot. -+ */ -+static struct vm_area_struct * -+um_lock_mm_and_find_vma(struct mm_struct *mm, -+ unsigned long addr, bool is_user) -+{ -+ struct vm_area_struct *vma; -+ -+ if (!get_mmap_lock_carefully(mm, is_user)) -+ return NULL; -+ -+ vma = find_vma(mm, addr); -+ if (likely(vma && (vma->vm_start <= addr))) -+ return vma; -+ -+ /* -+ * Well, dang. We might still be successful, but only -+ * if we can extend a vma to do so. -+ */ -+ if (!vma || !(vma->vm_flags & VM_GROWSDOWN)) { -+ mmap_read_unlock(mm); -+ return NULL; -+ } -+ -+ /* -+ * We can try to upgrade the mmap lock atomically, -+ * in which case we can continue to use the vma -+ * we already looked up. -+ * -+ * Otherwise we'll have to drop the mmap lock and -+ * re-take it, and also look up the vma again, -+ * re-checking it. -+ */ -+ if (!mmap_upgrade_trylock(mm)) { -+ if (!upgrade_mmap_lock_carefully(mm, is_user)) -+ return NULL; -+ -+ vma = find_vma(mm, addr); -+ if (!vma) -+ goto fail; -+ if (vma->vm_start <= addr) -+ goto success; -+ if (!(vma->vm_flags & VM_GROWSDOWN)) -+ goto fail; -+ } -+ -+ if (expand_stack_locked(vma, addr)) -+ goto fail; -+ -+success: -+ mmap_write_downgrade(mm); -+ return vma; -+ -+fail: -+ mmap_write_unlock(mm); -+ return NULL; -+} -+ - /* - * Note this is constrained to return 0, -EFAULT, -EACCES, -ENOMEM by - * segv(). -@@ -43,21 +159,10 @@ int handle_page_fault(unsigned long address, unsigned long ip, - if (is_user) - flags |= FAULT_FLAG_USER; - retry: -- mmap_read_lock(mm); -- vma = find_vma(mm, address); -- if (!vma) -- goto out; -- if (vma->vm_start <= address) -- goto good_area; -- if (!(vma->vm_flags & VM_GROWSDOWN)) -- goto out; -- if (is_user && !ARCH_IS_STACKGROW(address)) -- goto out; -- vma = expand_stack(mm, address); -+ vma = um_lock_mm_and_find_vma(mm, address, is_user); - if (!vma) - goto out_nosemaphore; - --good_area: - *code_out = SEGV_ACCERR; - if (is_write) { - if (!(vma->vm_flags & VM_WRITE)) -diff --git a/arch/x86/tools/insn_decoder_test.c b/arch/x86/tools/insn_decoder_test.c -index 472540aeabc235..08cd913cbd4e9a 100644 ---- a/arch/x86/tools/insn_decoder_test.c -+++ b/arch/x86/tools/insn_decoder_test.c -@@ -10,8 +10,7 @@ - #include - #include - #include -- --#define unlikely(cond) (cond) -+#include - - #include - #include -@@ -106,7 +105,7 @@ static void parse_args(int argc, char **argv) - } - } - --#define BUFSIZE 256 -+#define BUFSIZE (256 + KSYM_NAME_LEN) - - int main(int argc, char **argv) - { -diff --git a/arch/x86/um/asm/checksum.h b/arch/x86/um/asm/checksum.h -index b07824500363fa..ddc144657efad9 100644 ---- a/arch/x86/um/asm/checksum.h -+++ b/arch/x86/um/asm/checksum.h -@@ -20,6 +20,9 @@ - */ - extern __wsum csum_partial(const void *buff, int len, __wsum sum); - -+/* Do not call this directly. Declared for export type visibility. */ -+extern __visible __wsum csum_partial_copy_generic(const void *src, void *dst, int len); -+ - /** - * csum_fold - Fold and invert a 32bit checksum. - * sum: 32bit unfolded sum -diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c -index d7f7f88009d7db..1728cae1e8409f 100644 ---- a/drivers/cxl/core/region.c -+++ b/drivers/cxl/core/region.c -@@ -1653,6 +1653,13 @@ static int find_pos_and_ways(struct cxl_port *port, struct range *range, - } - put_device(dev); - -+ if (rc) -+ dev_err(port->uport_dev, -+ "failed to find %s:%s in target list of %s\n", -+ dev_name(&port->dev), -+ dev_name(port->parent_dport->dport_dev), -+ dev_name(&cxlsd->cxld.dev)); -+ - return rc; - } - -diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c -index 7e3a67f9f0a654..aa39fcd389a942 100644 ---- a/drivers/dma/idxd/cdev.c -+++ b/drivers/dma/idxd/cdev.c -@@ -354,7 +354,9 @@ static void idxd_cdev_evl_drain_pasid(struct idxd_wq *wq, u32 pasid) - set_bit(h, evl->bmap); - h = (h + 1) % size; - } -- drain_workqueue(wq->wq); -+ if (wq->wq) -+ drain_workqueue(wq->wq); -+ - mutex_unlock(&evl->lock); - } - -diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c -index 0a3b2e22f23dbb..14c4c5031b556f 100644 ---- a/drivers/dma/xilinx/xilinx_dma.c -+++ b/drivers/dma/xilinx/xilinx_dma.c -@@ -2900,6 +2900,8 @@ static int xilinx_dma_chan_probe(struct xilinx_dma_device *xdev, - return -EINVAL; - } - -+ xdev->common.directions |= chan->direction; -+ - /* Request the interrupt */ - chan->irq = of_irq_get(node, chan->tdest); - if (chan->irq < 0) -diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c -index 10119cf27ffde5..a8db2bde638401 100644 ---- a/drivers/edac/amd64_edac.c -+++ b/drivers/edac/amd64_edac.c -@@ -1475,7 +1475,9 @@ static int umc_get_cs_mode(int dimm, u8 ctrl, struct amd64_pvt *pvt) - if (csrow_enabled(2 * dimm + 1, ctrl, pvt)) - cs_mode |= CS_ODD_PRIMARY; - -- /* Asymmetric dual-rank DIMM support. */ -+ if (csrow_sec_enabled(2 * dimm, ctrl, pvt)) -+ cs_mode |= CS_EVEN_SECONDARY; -+ - if (csrow_sec_enabled(2 * dimm + 1, ctrl, pvt)) - cs_mode |= CS_ODD_SECONDARY; - -@@ -1496,12 +1498,13 @@ static int umc_get_cs_mode(int dimm, u8 ctrl, struct amd64_pvt *pvt) - return cs_mode; - } - --static int __addr_mask_to_cs_size(u32 addr_mask_orig, unsigned int cs_mode, -- int csrow_nr, int dimm) -+static int calculate_cs_size(u32 mask, unsigned int cs_mode) - { -- u32 msb, weight, num_zero_bits; -- u32 addr_mask_deinterleaved; -- int size = 0; -+ int msb, weight, num_zero_bits; -+ u32 deinterleaved_mask; -+ -+ if (!mask) -+ return 0; - - /* - * The number of zero bits in the mask is equal to the number of bits -@@ -1514,19 +1517,30 @@ static int __addr_mask_to_cs_size(u32 addr_mask_orig, unsigned int cs_mode, - * without swapping with the most significant bit. This can be handled - * by keeping the MSB where it is and ignoring the single zero bit. - */ -- msb = fls(addr_mask_orig) - 1; -- weight = hweight_long(addr_mask_orig); -+ msb = fls(mask) - 1; -+ weight = hweight_long(mask); - num_zero_bits = msb - weight - !!(cs_mode & CS_3R_INTERLEAVE); - - /* Take the number of zero bits off from the top of the mask. */ -- addr_mask_deinterleaved = GENMASK_ULL(msb - num_zero_bits, 1); -+ deinterleaved_mask = GENMASK(msb - num_zero_bits, 1); -+ edac_dbg(1, " Deinterleaved AddrMask: 0x%x\n", deinterleaved_mask); -+ -+ return (deinterleaved_mask >> 2) + 1; -+} -+ -+static int __addr_mask_to_cs_size(u32 addr_mask, u32 addr_mask_sec, -+ unsigned int cs_mode, int csrow_nr, int dimm) -+{ -+ int size; - - edac_dbg(1, "CS%d DIMM%d AddrMasks:\n", csrow_nr, dimm); -- edac_dbg(1, " Original AddrMask: 0x%x\n", addr_mask_orig); -- edac_dbg(1, " Deinterleaved AddrMask: 0x%x\n", addr_mask_deinterleaved); -+ edac_dbg(1, " Primary AddrMask: 0x%x\n", addr_mask); - - /* Register [31:1] = Address [39:9]. Size is in kBs here. */ -- size = (addr_mask_deinterleaved >> 2) + 1; -+ size = calculate_cs_size(addr_mask, cs_mode); -+ -+ edac_dbg(1, " Secondary AddrMask: 0x%x\n", addr_mask_sec); -+ size += calculate_cs_size(addr_mask_sec, cs_mode); - - /* Return size in MBs. */ - return size >> 10; -@@ -1535,8 +1549,8 @@ static int __addr_mask_to_cs_size(u32 addr_mask_orig, unsigned int cs_mode, - static int umc_addr_mask_to_cs_size(struct amd64_pvt *pvt, u8 umc, - unsigned int cs_mode, int csrow_nr) - { -+ u32 addr_mask = 0, addr_mask_sec = 0; - int cs_mask_nr = csrow_nr; -- u32 addr_mask_orig; - int dimm, size = 0; - - /* No Chip Selects are enabled. */ -@@ -1574,13 +1588,13 @@ static int umc_addr_mask_to_cs_size(struct amd64_pvt *pvt, u8 umc, - if (!pvt->flags.zn_regs_v2) - cs_mask_nr >>= 1; - -- /* Asymmetric dual-rank DIMM support. */ -- if ((csrow_nr & 1) && (cs_mode & CS_ODD_SECONDARY)) -- addr_mask_orig = pvt->csels[umc].csmasks_sec[cs_mask_nr]; -- else -- addr_mask_orig = pvt->csels[umc].csmasks[cs_mask_nr]; -+ if (cs_mode & (CS_EVEN_PRIMARY | CS_ODD_PRIMARY)) -+ addr_mask = pvt->csels[umc].csmasks[cs_mask_nr]; -+ -+ if (cs_mode & (CS_EVEN_SECONDARY | CS_ODD_SECONDARY)) -+ addr_mask_sec = pvt->csels[umc].csmasks_sec[cs_mask_nr]; - -- return __addr_mask_to_cs_size(addr_mask_orig, cs_mode, csrow_nr, dimm); -+ return __addr_mask_to_cs_size(addr_mask, addr_mask_sec, cs_mode, csrow_nr, dimm); - } - - static void umc_debug_display_dimm_sizes(struct amd64_pvt *pvt, u8 ctrl) -@@ -3773,9 +3787,10 @@ static void gpu_get_err_info(struct mce *m, struct err_info *err) - static int gpu_addr_mask_to_cs_size(struct amd64_pvt *pvt, u8 umc, - unsigned int cs_mode, int csrow_nr) - { -- u32 addr_mask_orig = pvt->csels[umc].csmasks[csrow_nr]; -+ u32 addr_mask = pvt->csels[umc].csmasks[csrow_nr]; -+ u32 addr_mask_sec = pvt->csels[umc].csmasks_sec[csrow_nr]; - -- return __addr_mask_to_cs_size(addr_mask_orig, cs_mode, csrow_nr, csrow_nr >> 1); -+ return __addr_mask_to_cs_size(addr_mask, addr_mask_sec, cs_mode, csrow_nr, csrow_nr >> 1); - } - - static void gpu_debug_display_dimm_sizes(struct amd64_pvt *pvt, u8 ctrl) -diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c -index 65d1e66a347d75..d1fd2e492909e5 100644 ---- a/drivers/firmware/arm_scmi/driver.c -+++ b/drivers/firmware/arm_scmi/driver.c -@@ -1547,6 +1547,39 @@ static int scmi_common_extended_name_get(const struct scmi_protocol_handle *ph, - return ret; - } - -+/** -+ * scmi_protocol_msg_check - Check protocol message attributes -+ * -+ * @ph: A reference to the protocol handle. -+ * @message_id: The ID of the message to check. -+ * @attributes: A parameter to optionally return the retrieved message -+ * attributes, in case of Success. -+ * -+ * An helper to check protocol message attributes for a specific protocol -+ * and message pair. -+ * -+ * Return: 0 on SUCCESS -+ */ -+static int scmi_protocol_msg_check(const struct scmi_protocol_handle *ph, -+ u32 message_id, u32 *attributes) -+{ -+ int ret; -+ struct scmi_xfer *t; -+ -+ ret = xfer_get_init(ph, PROTOCOL_MESSAGE_ATTRIBUTES, -+ sizeof(__le32), 0, &t); -+ if (ret) -+ return ret; -+ -+ put_unaligned_le32(message_id, t->tx.buf); -+ ret = do_xfer(ph, t); -+ if (!ret && attributes) -+ *attributes = get_unaligned_le32(t->rx.buf); -+ xfer_put(ph, t); -+ -+ return ret; -+} -+ - /** - * struct scmi_iterator - Iterator descriptor - * @msg: A reference to the message TX buffer; filled by @prepare_message with -@@ -1688,6 +1721,7 @@ scmi_common_fastchannel_init(const struct scmi_protocol_handle *ph, - int ret; - u32 flags; - u64 phys_addr; -+ u32 attributes; - u8 size; - void __iomem *addr; - struct scmi_xfer *t; -@@ -1696,6 +1730,15 @@ scmi_common_fastchannel_init(const struct scmi_protocol_handle *ph, - struct scmi_msg_resp_desc_fc *resp; - const struct scmi_protocol_instance *pi = ph_to_pi(ph); - -+ /* Check if the MSG_ID supports fastchannel */ -+ ret = scmi_protocol_msg_check(ph, message_id, &attributes); -+ if (ret || !MSG_SUPPORTS_FASTCHANNEL(attributes)) { -+ dev_dbg(ph->dev, -+ "Skip FC init for 0x%02X/%d domain:%d - ret:%d\n", -+ pi->proto->id, message_id, domain, ret); -+ return; -+ } -+ - if (!p_addr) { - ret = -EINVAL; - goto err_out; -@@ -1824,6 +1867,7 @@ static const struct scmi_proto_helpers_ops helpers_ops = { - .extended_name_get = scmi_common_extended_name_get, - .iter_response_init = scmi_iterator_init, - .iter_response_run = scmi_iterator_run, -+ .protocol_msg_check = scmi_protocol_msg_check, - .fastchannel_init = scmi_common_fastchannel_init, - .fastchannel_db_ring = scmi_common_fastchannel_db_ring, - }; -diff --git a/drivers/firmware/arm_scmi/protocols.h b/drivers/firmware/arm_scmi/protocols.h -index 78e1a01eb656e3..095b14a2d0a3f6 100644 ---- a/drivers/firmware/arm_scmi/protocols.h -+++ b/drivers/firmware/arm_scmi/protocols.h -@@ -29,6 +29,8 @@ - #define PROTOCOL_REV_MAJOR(x) ((u16)(FIELD_GET(PROTOCOL_REV_MAJOR_MASK, (x)))) - #define PROTOCOL_REV_MINOR(x) ((u16)(FIELD_GET(PROTOCOL_REV_MINOR_MASK, (x)))) - -+#define MSG_SUPPORTS_FASTCHANNEL(x) ((x) & BIT(0)) -+ - enum scmi_common_cmd { - PROTOCOL_VERSION = 0x0, - PROTOCOL_ATTRIBUTES = 0x1, -@@ -250,6 +252,8 @@ struct scmi_fc_info { - * provided in @ops. - * @iter_response_run: A common helper to trigger the run of a previously - * initialized iterator. -+ * @protocol_msg_check: A common helper to check is a specific protocol message -+ * is supported. - * @fastchannel_init: A common helper used to initialize FC descriptors by - * gathering FC descriptions from the SCMI platform server. - * @fastchannel_db_ring: A common helper to ring a FC doorbell. -@@ -262,6 +266,8 @@ struct scmi_proto_helpers_ops { - unsigned int max_resources, u8 msg_id, - size_t tx_size, void *priv); - int (*iter_response_run)(void *iter); -+ int (*protocol_msg_check)(const struct scmi_protocol_handle *ph, -+ u32 message_id, u32 *attributes); - void (*fastchannel_init)(const struct scmi_protocol_handle *ph, - u8 describe_id, u32 message_id, - u32 valid_size, u32 domain, -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c -index 963e106d32eed0..256cc15fc9b5a1 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c -@@ -1890,7 +1890,7 @@ static void amdgpu_ib_preempt_mark_partial_job(struct amdgpu_ring *ring) - continue; - } - job = to_amdgpu_job(s_job); -- if (preempted && (&job->hw_fence) == fence) -+ if (preempted && (&job->hw_fence.base) == fence) - /* mark the job as preempted */ - job->preemption_status |= AMDGPU_IB_PREEMPTED; - } -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -index f8058dd5356a13..200b59318759da 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -@@ -5367,7 +5367,7 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev, - * - * job->base holds a reference to parent fence - */ -- if (job && dma_fence_is_signaled(&job->hw_fence)) { -+ if (job && dma_fence_is_signaled(&job->hw_fence.base)) { - job_signaled = true; - dev_info(adev->dev, "Guilty job already signaled, skipping HW reset"); - goto skip_hw_reset; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c -index 7537f5aa76f0c0..017dd494d0a2f6 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c -@@ -41,22 +41,6 @@ - #include "amdgpu_trace.h" - #include "amdgpu_reset.h" - --/* -- * Fences mark an event in the GPUs pipeline and are used -- * for GPU/CPU synchronization. When the fence is written, -- * it is expected that all buffers associated with that fence -- * are no longer in use by the associated ring on the GPU and -- * that the relevant GPU caches have been flushed. -- */ -- --struct amdgpu_fence { -- struct dma_fence base; -- -- /* RB, DMA, etc. */ -- struct amdgpu_ring *ring; -- ktime_t start_timestamp; --}; -- - static struct kmem_cache *amdgpu_fence_slab; - - int amdgpu_fence_slab_init(void) -@@ -153,12 +137,12 @@ int amdgpu_fence_emit(struct amdgpu_ring *ring, struct dma_fence **f, struct amd - am_fence = kmem_cache_alloc(amdgpu_fence_slab, GFP_ATOMIC); - if (am_fence == NULL) - return -ENOMEM; -- fence = &am_fence->base; -- am_fence->ring = ring; - } else { - /* take use of job-embedded fence */ -- fence = &job->hw_fence; -+ am_fence = &job->hw_fence; - } -+ fence = &am_fence->base; -+ am_fence->ring = ring; - - seq = ++ring->fence_drv.sync_seq; - if (job && job->job_run_counter) { -@@ -719,7 +703,7 @@ void amdgpu_fence_driver_clear_job_fences(struct amdgpu_ring *ring) - * it right here or we won't be able to track them in fence_drv - * and they will remain unsignaled during sa_bo free. - */ -- job = container_of(old, struct amdgpu_job, hw_fence); -+ job = container_of(old, struct amdgpu_job, hw_fence.base); - if (!job->base.s_fence && !dma_fence_is_signaled(old)) - dma_fence_signal(old); - RCU_INIT_POINTER(*ptr, NULL); -@@ -781,7 +765,7 @@ static const char *amdgpu_fence_get_timeline_name(struct dma_fence *f) - - static const char *amdgpu_job_fence_get_timeline_name(struct dma_fence *f) - { -- struct amdgpu_job *job = container_of(f, struct amdgpu_job, hw_fence); -+ struct amdgpu_job *job = container_of(f, struct amdgpu_job, hw_fence.base); - - return (const char *)to_amdgpu_ring(job->base.sched)->name; - } -@@ -811,7 +795,7 @@ static bool amdgpu_fence_enable_signaling(struct dma_fence *f) - */ - static bool amdgpu_job_fence_enable_signaling(struct dma_fence *f) - { -- struct amdgpu_job *job = container_of(f, struct amdgpu_job, hw_fence); -+ struct amdgpu_job *job = container_of(f, struct amdgpu_job, hw_fence.base); - - if (!timer_pending(&to_amdgpu_ring(job->base.sched)->fence_drv.fallback_timer)) - amdgpu_fence_schedule_fallback(to_amdgpu_ring(job->base.sched)); -@@ -846,7 +830,7 @@ static void amdgpu_job_fence_free(struct rcu_head *rcu) - struct dma_fence *f = container_of(rcu, struct dma_fence, rcu); - - /* free job if fence has a parent job */ -- kfree(container_of(f, struct amdgpu_job, hw_fence)); -+ kfree(container_of(f, struct amdgpu_job, hw_fence.base)); - } - - /** -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c -index 49a6b6b88843dd..e9adfc88a54ab1 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c -@@ -165,8 +165,8 @@ void amdgpu_job_free_resources(struct amdgpu_job *job) - /* Check if any fences where initialized */ - if (job->base.s_fence && job->base.s_fence->finished.ops) - f = &job->base.s_fence->finished; -- else if (job->hw_fence.ops) -- f = &job->hw_fence; -+ else if (job->hw_fence.base.ops) -+ f = &job->hw_fence.base; - else - f = NULL; - -@@ -183,10 +183,10 @@ static void amdgpu_job_free_cb(struct drm_sched_job *s_job) - amdgpu_sync_free(&job->explicit_sync); - - /* only put the hw fence if has embedded fence */ -- if (!job->hw_fence.ops) -+ if (!job->hw_fence.base.ops) - kfree(job); - else -- dma_fence_put(&job->hw_fence); -+ dma_fence_put(&job->hw_fence.base); - } - - void amdgpu_job_set_gang_leader(struct amdgpu_job *job, -@@ -215,10 +215,10 @@ void amdgpu_job_free(struct amdgpu_job *job) - if (job->gang_submit != &job->base.s_fence->scheduled) - dma_fence_put(job->gang_submit); - -- if (!job->hw_fence.ops) -+ if (!job->hw_fence.base.ops) - kfree(job); - else -- dma_fence_put(&job->hw_fence); -+ dma_fence_put(&job->hw_fence.base); - } - - struct dma_fence *amdgpu_job_submit(struct amdgpu_job *job) -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.h -index a963a25ddd6209..65b6fbab544e5f 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.h -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.h -@@ -48,7 +48,7 @@ struct amdgpu_job { - struct drm_sched_job base; - struct amdgpu_vm *vm; - struct amdgpu_sync explicit_sync; -- struct dma_fence hw_fence; -+ struct amdgpu_fence hw_fence; - struct dma_fence *gang_submit; - uint32_t preamble_status; - uint32_t preemption_status; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h -index e2ab303ad2708e..60f770b99c2c54 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h -@@ -123,6 +123,22 @@ struct amdgpu_fence_driver { - struct dma_fence **fences; - }; - -+/* -+ * Fences mark an event in the GPUs pipeline and are used -+ * for GPU/CPU synchronization. When the fence is written, -+ * it is expected that all buffers associated with that fence -+ * are no longer in use by the associated ring on the GPU and -+ * that the relevant GPU caches have been flushed. -+ */ -+ -+struct amdgpu_fence { -+ struct dma_fence base; -+ -+ /* RB, DMA, etc. */ -+ struct amdgpu_ring *ring; -+ ktime_t start_timestamp; -+}; -+ - extern const struct drm_sched_backend_ops amdgpu_sched_ops; - - void amdgpu_fence_driver_clear_job_fences(struct amdgpu_ring *ring); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c -index bef7541770641c..e9d2fcdde0e1c6 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c -@@ -28,6 +28,10 @@ - #include "amdgpu.h" - #include "amdgpu_ucode.h" - -+static const struct kicker_device kicker_device_list[] = { -+ {0x744B, 0x00}, -+}; -+ - static void amdgpu_ucode_print_common_hdr(const struct common_firmware_header *hdr) - { - DRM_DEBUG("size_bytes: %u\n", le32_to_cpu(hdr->size_bytes)); -@@ -1268,6 +1272,19 @@ static const char *amdgpu_ucode_legacy_naming(struct amdgpu_device *adev, int bl - return NULL; - } - -+bool amdgpu_is_kicker_fw(struct amdgpu_device *adev) -+{ -+ int i; -+ -+ for (i = 0; i < ARRAY_SIZE(kicker_device_list); i++) { -+ if (adev->pdev->device == kicker_device_list[i].device && -+ adev->pdev->revision == kicker_device_list[i].revision) -+ return true; -+ } -+ -+ return false; -+} -+ - void amdgpu_ucode_ip_version_decode(struct amdgpu_device *adev, int block_type, char *ucode_prefix, int len) - { - int maj, min, rev; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.h -index b03321e7d2d893..4760092aafd723 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.h -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.h -@@ -536,6 +536,11 @@ struct amdgpu_firmware { - uint64_t fw_buf_mc; - }; - -+struct kicker_device{ -+ unsigned short device; -+ u8 revision; -+}; -+ - void amdgpu_ucode_print_mc_hdr(const struct common_firmware_header *hdr); - void amdgpu_ucode_print_smc_hdr(const struct common_firmware_header *hdr); - void amdgpu_ucode_print_imu_hdr(const struct common_firmware_header *hdr); -@@ -562,5 +567,6 @@ amdgpu_ucode_get_load_type(struct amdgpu_device *adev, int load_type); - const char *amdgpu_ucode_name(enum AMDGPU_UCODE_ID ucode_id); - - void amdgpu_ucode_ip_version_decode(struct amdgpu_device *adev, int block_type, char *ucode_prefix, int len); -+bool amdgpu_is_kicker_fw(struct amdgpu_device *adev); - - #endif -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c -index c7085a747b03b7..451c37d04e4567 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c -@@ -435,7 +435,7 @@ static int amdgpu_vram_mgr_new(struct ttm_resource_manager *man, - int r; - - lpfn = (u64)place->lpfn << PAGE_SHIFT; -- if (!lpfn) -+ if (!lpfn || lpfn > man->size) - lpfn = man->size; - - fpfn = (u64)place->fpfn << PAGE_SHIFT; -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c -index 0f58be65132fc0..2b07c0000df6eb 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c -@@ -1287,6 +1287,7 @@ void kfd_signal_poison_consumed_event(struct kfd_node *dev, u32 pasid) - user_gpu_id = kfd_process_get_user_gpu_id(p, dev->id); - if (unlikely(user_gpu_id == -EINVAL)) { - WARN_ONCE(1, "Could not get user_gpu_id from dev->id:%x\n", dev->id); -+ kfd_unref_process(p); - return; - } - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager_v9.c b/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager_v9.c -index 1a03173e231337..18e82d0da75bcd 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager_v9.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager_v9.c -@@ -225,7 +225,7 @@ static int pm_map_queues_v9(struct packet_manager *pm, uint32_t *buffer, - - packet->bitfields2.engine_sel = - engine_sel__mes_map_queues__compute_vi; -- packet->bitfields2.gws_control_queue = q->gws ? 1 : 0; -+ packet->bitfields2.gws_control_queue = q->properties.is_gws ? 1 : 0; - packet->bitfields2.extended_engine_sel = - extended_engine_sel__mes_map_queues__legacy_engine_sel; - packet->bitfields2.queue_type = -diff --git a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c -index ff930a71e496a9..7f8f127e7722de 100644 ---- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c -+++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c -@@ -368,6 +368,9 @@ enum mod_hdcp_status mod_hdcp_hdcp1_enable_encryption(struct mod_hdcp *hdcp) - struct mod_hdcp_display *display = get_first_active_display(hdcp); - enum mod_hdcp_status status = MOD_HDCP_STATUS_SUCCESS; - -+ if (!display) -+ return MOD_HDCP_STATUS_DISPLAY_NOT_FOUND; -+ - mutex_lock(&psp->hdcp_context.mutex); - hdcp_cmd = (struct ta_hdcp_shared_memory *)psp->hdcp_context.context.mem_context.shared_buf; - memset(hdcp_cmd, 0, sizeof(struct ta_hdcp_shared_memory)); -diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c -index 5f58da6ebaadb4..27e660e92489f6 100644 ---- a/drivers/gpu/drm/ast/ast_mode.c -+++ b/drivers/gpu/drm/ast/ast_mode.c -@@ -1868,9 +1868,9 @@ static void ast_mode_config_helper_atomic_commit_tail(struct drm_atomic_state *s - - /* - * Concurrent operations could possibly trigger a call to -- * drm_connector_helper_funcs.get_modes by trying to read the -- * display modes. Protect access to I/O registers by acquiring -- * the I/O-register lock. Released in atomic_flush(). -+ * drm_connector_helper_funcs.get_modes by reading the display -+ * modes. Protect access to registers by acquiring the modeset -+ * lock. - */ - mutex_lock(&ast->ioregs_lock); - drm_atomic_helper_commit_tail_rpm(state); -diff --git a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c -index 7457d38622b0c7..89eed0668bfb24 100644 ---- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c -+++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c -@@ -568,15 +568,18 @@ static int cdns_dsi_check_conf(struct cdns_dsi *dsi, - struct phy_configure_opts_mipi_dphy *phy_cfg = &output->phy_opts.mipi_dphy; - unsigned long dsi_hss_hsa_hse_hbp; - unsigned int nlanes = output->dev->lanes; -+ int mode_clock = (mode_valid_check ? mode->clock : mode->crtc_clock); - int ret; - - ret = cdns_dsi_mode2cfg(dsi, mode, dsi_cfg, mode_valid_check); - if (ret) - return ret; - -- phy_mipi_dphy_get_default_config(mode->crtc_clock * 1000, -- mipi_dsi_pixel_format_to_bpp(output->dev->format), -- nlanes, phy_cfg); -+ ret = phy_mipi_dphy_get_default_config(mode_clock * 1000, -+ mipi_dsi_pixel_format_to_bpp(output->dev->format), -+ nlanes, phy_cfg); -+ if (ret) -+ return ret; - - ret = cdns_dsi_adjust_phy_config(dsi, dsi_cfg, phy_cfg, mode, mode_valid_check); - if (ret) -@@ -680,6 +683,11 @@ static void cdns_dsi_bridge_post_disable(struct drm_bridge *bridge) - struct cdns_dsi_input *input = bridge_to_cdns_dsi_input(bridge); - struct cdns_dsi *dsi = input_to_dsi(input); - -+ dsi->phy_initialized = false; -+ dsi->link_initialized = false; -+ phy_power_off(dsi->dphy); -+ phy_exit(dsi->dphy); -+ - pm_runtime_put(dsi->base.dev); - } - -@@ -761,7 +769,7 @@ static void cdns_dsi_bridge_enable(struct drm_bridge *bridge) - struct phy_configure_opts_mipi_dphy *phy_cfg = &output->phy_opts.mipi_dphy; - unsigned long tx_byte_period; - struct cdns_dsi_cfg dsi_cfg; -- u32 tmp, reg_wakeup, div; -+ u32 tmp, reg_wakeup, div, status; - int nlanes; - - if (WARN_ON(pm_runtime_get_sync(dsi->base.dev) < 0)) -@@ -778,6 +786,19 @@ static void cdns_dsi_bridge_enable(struct drm_bridge *bridge) - cdns_dsi_hs_init(dsi); - cdns_dsi_init_link(dsi); - -+ /* -+ * Now that the DSI Link and DSI Phy are initialized, -+ * wait for the CLK and Data Lanes to be ready. -+ */ -+ tmp = CLK_LANE_RDY; -+ for (int i = 0; i < nlanes; i++) -+ tmp |= DATA_LANE_RDY(i); -+ -+ if (readl_poll_timeout(dsi->regs + MCTL_MAIN_STS, status, -+ (tmp == (status & tmp)), 100, 500000)) -+ dev_err(dsi->base.dev, -+ "Timed Out: DSI-DPhy Clock and Data Lanes not ready.\n"); -+ - writel(HBP_LEN(dsi_cfg.hbp) | HSA_LEN(dsi_cfg.hsa), - dsi->regs + VID_HSIZE1); - writel(HFP_LEN(dsi_cfg.hfp) | HACT_LEN(dsi_cfg.hact), -@@ -952,7 +973,7 @@ static int cdns_dsi_attach(struct mipi_dsi_host *host, - bridge = drm_panel_bridge_add_typed(panel, - DRM_MODE_CONNECTOR_DSI); - } else { -- bridge = of_drm_find_bridge(dev->dev.of_node); -+ bridge = of_drm_find_bridge(np); - if (!bridge) - bridge = ERR_PTR(-EINVAL); - } -@@ -1152,7 +1173,6 @@ static int __maybe_unused cdns_dsi_suspend(struct device *dev) - clk_disable_unprepare(dsi->dsi_sys_clk); - clk_disable_unprepare(dsi->dsi_p_clk); - reset_control_assert(dsi->dsi_p_rst); -- dsi->link_initialized = false; - return 0; - } - -diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c -index bfbd3fee125671..002f8aaa509bc9 100644 ---- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c -+++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c -@@ -331,12 +331,18 @@ static void ti_sn65dsi86_enable_comms(struct ti_sn65dsi86 *pdata) - * 200 ms. We'll assume that the panel driver will have the hardcoded - * delay in its prepare and always disable HPD. - * -- * If HPD somehow makes sense on some future panel we'll have to -- * change this to be conditional on someone specifying that HPD should -- * be used. -+ * For DisplayPort bridge type, we need HPD. So we use the bridge type -+ * to conditionally disable HPD. -+ * NOTE: The bridge type is set in ti_sn_bridge_probe() but enable_comms() -+ * can be called before. So for DisplayPort, HPD will be enabled once -+ * bridge type is set. We are using bridge type instead of "no-hpd" -+ * property because it is not used properly in devicetree description -+ * and hence is unreliable. - */ -- regmap_update_bits(pdata->regmap, SN_HPD_DISABLE_REG, HPD_DISABLE, -- HPD_DISABLE); -+ -+ if (pdata->bridge.type != DRM_MODE_CONNECTOR_DisplayPort) -+ regmap_update_bits(pdata->regmap, SN_HPD_DISABLE_REG, HPD_DISABLE, -+ HPD_DISABLE); - - pdata->comms_enabled = true; - -@@ -424,36 +430,8 @@ static int status_show(struct seq_file *s, void *data) - - return 0; - } -- - DEFINE_SHOW_ATTRIBUTE(status); - --static void ti_sn65dsi86_debugfs_remove(void *data) --{ -- debugfs_remove_recursive(data); --} -- --static void ti_sn65dsi86_debugfs_init(struct ti_sn65dsi86 *pdata) --{ -- struct device *dev = pdata->dev; -- struct dentry *debugfs; -- int ret; -- -- debugfs = debugfs_create_dir(dev_name(dev), NULL); -- -- /* -- * We might get an error back if debugfs wasn't enabled in the kernel -- * so let's just silently return upon failure. -- */ -- if (IS_ERR_OR_NULL(debugfs)) -- return; -- -- ret = devm_add_action_or_reset(dev, ti_sn65dsi86_debugfs_remove, debugfs); -- if (ret) -- return; -- -- debugfs_create_file("status", 0600, debugfs, pdata, &status_fops); --} -- - /* ----------------------------------------------------------------------------- - * Auxiliary Devices (*not* AUX) - */ -@@ -1201,9 +1179,14 @@ static enum drm_connector_status ti_sn_bridge_detect(struct drm_bridge *bridge) - struct ti_sn65dsi86 *pdata = bridge_to_ti_sn65dsi86(bridge); - int val = 0; - -- pm_runtime_get_sync(pdata->dev); -+ /* -+ * Runtime reference is grabbed in ti_sn_bridge_hpd_enable() -+ * as the chip won't report HPD just after being powered on. -+ * HPD_DEBOUNCED_STATE reflects correct state only after the -+ * debounce time (~100-400 ms). -+ */ -+ - regmap_read(pdata->regmap, SN_HPD_DISABLE_REG, &val); -- pm_runtime_put_autosuspend(pdata->dev); - - return val & HPD_DEBOUNCED_STATE ? connector_status_connected - : connector_status_disconnected; -@@ -1217,6 +1200,35 @@ static struct edid *ti_sn_bridge_get_edid(struct drm_bridge *bridge, - return drm_get_edid(connector, &pdata->aux.ddc); - } - -+static void ti_sn65dsi86_debugfs_init(struct drm_bridge *bridge, struct dentry *root) -+{ -+ struct ti_sn65dsi86 *pdata = bridge_to_ti_sn65dsi86(bridge); -+ struct dentry *debugfs; -+ -+ debugfs = debugfs_create_dir(dev_name(pdata->dev), root); -+ debugfs_create_file("status", 0600, debugfs, pdata, &status_fops); -+} -+ -+static void ti_sn_bridge_hpd_enable(struct drm_bridge *bridge) -+{ -+ struct ti_sn65dsi86 *pdata = bridge_to_ti_sn65dsi86(bridge); -+ -+ /* -+ * Device needs to be powered on before reading the HPD state -+ * for reliable hpd detection in ti_sn_bridge_detect() due to -+ * the high debounce time. -+ */ -+ -+ pm_runtime_get_sync(pdata->dev); -+} -+ -+static void ti_sn_bridge_hpd_disable(struct drm_bridge *bridge) -+{ -+ struct ti_sn65dsi86 *pdata = bridge_to_ti_sn65dsi86(bridge); -+ -+ pm_runtime_put_autosuspend(pdata->dev); -+} -+ - static const struct drm_bridge_funcs ti_sn_bridge_funcs = { - .attach = ti_sn_bridge_attach, - .detach = ti_sn_bridge_detach, -@@ -1230,6 +1242,9 @@ static const struct drm_bridge_funcs ti_sn_bridge_funcs = { - .atomic_reset = drm_atomic_helper_bridge_reset, - .atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state, - .atomic_destroy_state = drm_atomic_helper_bridge_destroy_state, -+ .debugfs_init = ti_sn65dsi86_debugfs_init, -+ .hpd_enable = ti_sn_bridge_hpd_enable, -+ .hpd_disable = ti_sn_bridge_hpd_disable, - }; - - static void ti_sn_bridge_parse_lanes(struct ti_sn65dsi86 *pdata, -@@ -1318,8 +1333,26 @@ static int ti_sn_bridge_probe(struct auxiliary_device *adev, - pdata->bridge.type = pdata->next_bridge->type == DRM_MODE_CONNECTOR_DisplayPort - ? DRM_MODE_CONNECTOR_DisplayPort : DRM_MODE_CONNECTOR_eDP; - -- if (pdata->bridge.type == DRM_MODE_CONNECTOR_DisplayPort) -- pdata->bridge.ops = DRM_BRIDGE_OP_EDID | DRM_BRIDGE_OP_DETECT; -+ if (pdata->bridge.type == DRM_MODE_CONNECTOR_DisplayPort) { -+ pdata->bridge.ops = DRM_BRIDGE_OP_EDID | DRM_BRIDGE_OP_DETECT | -+ DRM_BRIDGE_OP_HPD; -+ /* -+ * If comms were already enabled they would have been enabled -+ * with the wrong value of HPD_DISABLE. Update it now. Comms -+ * could be enabled if anyone is holding a pm_runtime reference -+ * (like if a GPIO is in use). Note that in most cases nobody -+ * is doing AUX channel xfers before the bridge is added so -+ * HPD doesn't _really_ matter then. The only exception is in -+ * the eDP case where the panel wants to read the EDID before -+ * the bridge is added. We always consistently have HPD disabled -+ * for eDP. -+ */ -+ mutex_lock(&pdata->comms_mutex); -+ if (pdata->comms_enabled) -+ regmap_update_bits(pdata->regmap, SN_HPD_DISABLE_REG, -+ HPD_DISABLE, 0); -+ mutex_unlock(&pdata->comms_mutex); -+ }; - - drm_bridge_add(&pdata->bridge); - -@@ -1935,8 +1968,6 @@ static int ti_sn65dsi86_probe(struct i2c_client *client) - if (ret) - return ret; - -- ti_sn65dsi86_debugfs_init(pdata); -- - /* - * Break ourselves up into a collection of aux devices. The only real - * motiviation here is to solve the chicken-and-egg problem of probe -diff --git a/drivers/gpu/drm/etnaviv/etnaviv_sched.c b/drivers/gpu/drm/etnaviv/etnaviv_sched.c -index 97e406d9ac06f4..a3bd396c9d829d 100644 ---- a/drivers/gpu/drm/etnaviv/etnaviv_sched.c -+++ b/drivers/gpu/drm/etnaviv/etnaviv_sched.c -@@ -34,6 +34,7 @@ static enum drm_gpu_sched_stat etnaviv_sched_timedout_job(struct drm_sched_job - *sched_job) - { - struct etnaviv_gem_submit *submit = to_etnaviv_submit(sched_job); -+ struct drm_gpu_scheduler *sched = sched_job->sched; - struct etnaviv_gpu *gpu = submit->gpu; - u32 dma_addr; - int change; -@@ -76,7 +77,9 @@ static enum drm_gpu_sched_stat etnaviv_sched_timedout_job(struct drm_sched_job - return DRM_GPU_SCHED_STAT_NOMINAL; - - out_no_timeout: -- list_add(&sched_job->list, &sched_job->sched->pending_list); -+ spin_lock(&sched->job_list_lock); -+ list_add(&sched_job->list, &sched->pending_list); -+ spin_unlock(&sched->job_list_lock); - return DRM_GPU_SCHED_STAT_NOMINAL; - } - -diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c -index 5a687a3686bd53..023b2ea74c3601 100644 ---- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c -+++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c -@@ -2013,7 +2013,7 @@ static int eb_capture_stage(struct i915_execbuffer *eb) - continue; - - if (i915_gem_context_is_recoverable(eb->gem_context) && -- (IS_DGFX(eb->i915) || GRAPHICS_VER_FULL(eb->i915) > IP_VER(12, 0))) -+ GRAPHICS_VER_FULL(eb->i915) > IP_VER(12, 10)) - return -EINVAL; - - for_each_batch_create_order(eb, j) { -diff --git a/drivers/gpu/drm/i915/i915_pmu.c b/drivers/gpu/drm/i915/i915_pmu.c -index 33ab82c334a881..461aafc2ae9afa 100644 ---- a/drivers/gpu/drm/i915/i915_pmu.c -+++ b/drivers/gpu/drm/i915/i915_pmu.c -@@ -101,7 +101,7 @@ static unsigned int config_bit(const u64 config) - return other_bit(config); - } - --static u32 config_mask(const u64 config) -+static __always_inline u32 config_mask(const u64 config) - { - unsigned int bit = config_bit(config); - -diff --git a/drivers/gpu/drm/msm/msm_gpu_devfreq.c b/drivers/gpu/drm/msm/msm_gpu_devfreq.c -index 6970b0f7f457c8..2e1d5c3432728c 100644 ---- a/drivers/gpu/drm/msm/msm_gpu_devfreq.c -+++ b/drivers/gpu/drm/msm/msm_gpu_devfreq.c -@@ -156,6 +156,7 @@ void msm_devfreq_init(struct msm_gpu *gpu) - priv->gpu_devfreq_config.downdifferential = 10; - - mutex_init(&df->lock); -+ df->suspended = true; - - ret = dev_pm_qos_add_request(&gpu->pdev->dev, &df->boost_freq, - DEV_PM_QOS_MIN_FREQUENCY, 0); -diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c -index 53130a50584ca0..eed3b8bed9e40f 100644 ---- a/drivers/gpu/drm/scheduler/sched_entity.c -+++ b/drivers/gpu/drm/scheduler/sched_entity.c -@@ -167,6 +167,7 @@ static void drm_sched_entity_kill_jobs_work(struct work_struct *wrk) - { - struct drm_sched_job *job = container_of(wrk, typeof(*job), work); - -+ drm_sched_fence_scheduled(job->s_fence, NULL); - drm_sched_fence_finished(job->s_fence, -ESRCH); - WARN_ON(job->s_fence->parent); - job->sched->ops->free_job(job); -diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c -index 13b182ab905fb0..980d85bc7f3745 100644 ---- a/drivers/gpu/drm/tegra/dc.c -+++ b/drivers/gpu/drm/tegra/dc.c -@@ -1320,10 +1320,16 @@ static struct drm_plane *tegra_dc_add_shared_planes(struct drm_device *drm, - if (wgrp->dc == dc->pipe) { - for (j = 0; j < wgrp->num_windows; j++) { - unsigned int index = wgrp->windows[j]; -+ enum drm_plane_type type; -+ -+ if (primary) -+ type = DRM_PLANE_TYPE_OVERLAY; -+ else -+ type = DRM_PLANE_TYPE_PRIMARY; - - plane = tegra_shared_plane_create(drm, dc, - wgrp->index, -- index); -+ index, type); - if (IS_ERR(plane)) - return plane; - -@@ -1331,10 +1337,8 @@ static struct drm_plane *tegra_dc_add_shared_planes(struct drm_device *drm, - * Choose the first shared plane owned by this - * head as the primary plane. - */ -- if (!primary) { -- plane->type = DRM_PLANE_TYPE_PRIMARY; -+ if (!primary) - primary = plane; -- } - } - } - } -@@ -1388,7 +1392,10 @@ static void tegra_crtc_reset(struct drm_crtc *crtc) - if (crtc->state) - tegra_crtc_atomic_destroy_state(crtc, crtc->state); - -- __drm_atomic_helper_crtc_reset(crtc, &state->base); -+ if (state) -+ __drm_atomic_helper_crtc_reset(crtc, &state->base); -+ else -+ __drm_atomic_helper_crtc_reset(crtc, NULL); - } - - static struct drm_crtc_state * -diff --git a/drivers/gpu/drm/tegra/hub.c b/drivers/gpu/drm/tegra/hub.c -index 1af5f8318d9146..0f88cbb3331706 100644 ---- a/drivers/gpu/drm/tegra/hub.c -+++ b/drivers/gpu/drm/tegra/hub.c -@@ -756,9 +756,9 @@ static const struct drm_plane_helper_funcs tegra_shared_plane_helper_funcs = { - struct drm_plane *tegra_shared_plane_create(struct drm_device *drm, - struct tegra_dc *dc, - unsigned int wgrp, -- unsigned int index) -+ unsigned int index, -+ enum drm_plane_type type) - { -- enum drm_plane_type type = DRM_PLANE_TYPE_OVERLAY; - struct tegra_drm *tegra = drm->dev_private; - struct tegra_display_hub *hub = tegra->hub; - struct tegra_shared_plane *plane; -diff --git a/drivers/gpu/drm/tegra/hub.h b/drivers/gpu/drm/tegra/hub.h -index 23c4b2115ed1e3..a66f18c4facc9d 100644 ---- a/drivers/gpu/drm/tegra/hub.h -+++ b/drivers/gpu/drm/tegra/hub.h -@@ -80,7 +80,8 @@ void tegra_display_hub_cleanup(struct tegra_display_hub *hub); - struct drm_plane *tegra_shared_plane_create(struct drm_device *drm, - struct tegra_dc *dc, - unsigned int wgrp, -- unsigned int index); -+ unsigned int index, -+ enum drm_plane_type type); - - int tegra_display_hub_atomic_check(struct drm_device *drm, - struct drm_atomic_state *state); -diff --git a/drivers/gpu/drm/tiny/cirrus.c b/drivers/gpu/drm/tiny/cirrus.c -index 594bc472862fe6..b0361ef53c4635 100644 ---- a/drivers/gpu/drm/tiny/cirrus.c -+++ b/drivers/gpu/drm/tiny/cirrus.c -@@ -318,7 +318,6 @@ static void cirrus_pitch_set(struct cirrus_device *cirrus, unsigned int pitch) - /* Enable extended blanking and pitch bits, and enable full memory */ - cr1b = 0x22; - cr1b |= (pitch >> 7) & 0x10; -- cr1b |= (pitch >> 6) & 0x40; - wreg_crt(cirrus, 0x1b, cr1b); - - cirrus_set_start_address(cirrus, 0); -diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c -index 1506094a800983..ac357ab1aee544 100644 ---- a/drivers/gpu/drm/udl/udl_drv.c -+++ b/drivers/gpu/drm/udl/udl_drv.c -@@ -126,9 +126,9 @@ static void udl_usb_disconnect(struct usb_interface *interface) - { - struct drm_device *dev = usb_get_intfdata(interface); - -+ drm_dev_unplug(dev); - drm_kms_helper_poll_fini(dev); - udl_drop_usb(dev); -- drm_dev_unplug(dev); - } - - /* -diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c -index a4062f617ba202..ee65da98c7d5b5 100644 ---- a/drivers/hid/hid-lenovo.c -+++ b/drivers/hid/hid-lenovo.c -@@ -529,11 +529,14 @@ static void lenovo_features_set_cptkbd(struct hid_device *hdev) - - /* - * Tell the keyboard a driver understands it, and turn F7, F9, F11 into -- * regular keys -+ * regular keys (Compact only) - */ -- ret = lenovo_send_cmd_cptkbd(hdev, 0x01, 0x03); -- if (ret) -- hid_warn(hdev, "Failed to switch F7/9/11 mode: %d\n", ret); -+ if (hdev->product == USB_DEVICE_ID_LENOVO_CUSBKBD || -+ hdev->product == USB_DEVICE_ID_LENOVO_CBTKBD) { -+ ret = lenovo_send_cmd_cptkbd(hdev, 0x01, 0x03); -+ if (ret) -+ hid_warn(hdev, "Failed to switch F7/9/11 mode: %d\n", ret); -+ } - - /* Switch middle button to native mode */ - ret = lenovo_send_cmd_cptkbd(hdev, 0x09, 0x01); -diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c -index 5a72cf8d6944fa..52011503ff3bac 100644 ---- a/drivers/hid/wacom_sys.c -+++ b/drivers/hid/wacom_sys.c -@@ -2012,14 +2012,18 @@ static int wacom_initialize_remotes(struct wacom *wacom) - - remote->remote_dir = kobject_create_and_add("wacom_remote", - &wacom->hdev->dev.kobj); -- if (!remote->remote_dir) -+ if (!remote->remote_dir) { -+ kfifo_free(&remote->remote_fifo); - return -ENOMEM; -+ } - - error = sysfs_create_files(remote->remote_dir, remote_unpair_attrs); - - if (error) { - hid_err(wacom->hdev, - "cannot create sysfs group err: %d\n", error); -+ kfifo_free(&remote->remote_fifo); -+ kobject_put(remote->remote_dir); - return error; - } - -diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c -index 2f4d09ce027a3f..3c6011a48dabe7 100644 ---- a/drivers/hv/channel_mgmt.c -+++ b/drivers/hv/channel_mgmt.c -@@ -120,7 +120,9 @@ const struct vmbus_device vmbus_devs[] = { - }, - - /* File copy */ -- { .dev_type = HV_FCOPY, -+ /* fcopy always uses 16KB ring buffer size and is working well for last many years */ -+ { .pref_ring_size = 0x4000, -+ .dev_type = HV_FCOPY, - HV_FCOPY_GUID, - .perf_device = false, - .allowed_in_isolated = false, -@@ -140,12 +142,19 @@ const struct vmbus_device vmbus_devs[] = { - .allowed_in_isolated = false, - }, - -- /* Unknown GUID */ -- { .dev_type = HV_UNKNOWN, -+ /* -+ * Unknown GUID -+ * 64 KB ring buffer + 4 KB header should be sufficient size for any Hyper-V device apart -+ * from HV_NIC and HV_SCSI. This case avoid the fallback for unknown devices to allocate -+ * much bigger (2 MB) of ring size. -+ */ -+ { .pref_ring_size = 0x11000, -+ .dev_type = HV_UNKNOWN, - .perf_device = false, - .allowed_in_isolated = false, - }, - }; -+EXPORT_SYMBOL_GPL(vmbus_devs); - - static const struct { - guid_t guid; -diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h -index 787b1506864188..34b60009114a69 100644 ---- a/drivers/hv/hyperv_vmbus.h -+++ b/drivers/hv/hyperv_vmbus.h -@@ -419,6 +419,11 @@ static inline bool hv_is_perf_channel(struct vmbus_channel *channel) - return vmbus_devs[channel->device_id].perf_device; - } - -+static inline size_t hv_dev_ring_size(struct vmbus_channel *channel) -+{ -+ return vmbus_devs[channel->device_id].pref_ring_size; -+} -+ - static inline bool hv_is_allocated_cpu(unsigned int cpu) - { - struct vmbus_channel *channel, *sc; -diff --git a/drivers/hwmon/pmbus/max34440.c b/drivers/hwmon/pmbus/max34440.c -index fe7f6b1b09851e..e14be8ebaad30e 100644 ---- a/drivers/hwmon/pmbus/max34440.c -+++ b/drivers/hwmon/pmbus/max34440.c -@@ -34,16 +34,21 @@ enum chips { max34440, max34441, max34446, max34451, max34460, max34461 }; - /* - * The whole max344* family have IOUT_OC_WARN_LIMIT and IOUT_OC_FAULT_LIMIT - * swapped from the standard pmbus spec addresses. -+ * For max34451, version MAX34451ETNA6+ and later has this issue fixed. - */ - #define MAX34440_IOUT_OC_WARN_LIMIT 0x46 - #define MAX34440_IOUT_OC_FAULT_LIMIT 0x4A - -+#define MAX34451ETNA6_MFR_REV 0x0012 -+ - #define MAX34451_MFR_CHANNEL_CONFIG 0xe4 - #define MAX34451_MFR_CHANNEL_CONFIG_SEL_MASK 0x3f - - struct max34440_data { - int id; - struct pmbus_driver_info info; -+ u8 iout_oc_warn_limit; -+ u8 iout_oc_fault_limit; - }; - - #define to_max34440_data(x) container_of(x, struct max34440_data, info) -@@ -60,11 +65,11 @@ static int max34440_read_word_data(struct i2c_client *client, int page, - switch (reg) { - case PMBUS_IOUT_OC_FAULT_LIMIT: - ret = pmbus_read_word_data(client, page, phase, -- MAX34440_IOUT_OC_FAULT_LIMIT); -+ data->iout_oc_fault_limit); - break; - case PMBUS_IOUT_OC_WARN_LIMIT: - ret = pmbus_read_word_data(client, page, phase, -- MAX34440_IOUT_OC_WARN_LIMIT); -+ data->iout_oc_warn_limit); - break; - case PMBUS_VIRT_READ_VOUT_MIN: - ret = pmbus_read_word_data(client, page, phase, -@@ -133,11 +138,11 @@ static int max34440_write_word_data(struct i2c_client *client, int page, - - switch (reg) { - case PMBUS_IOUT_OC_FAULT_LIMIT: -- ret = pmbus_write_word_data(client, page, MAX34440_IOUT_OC_FAULT_LIMIT, -+ ret = pmbus_write_word_data(client, page, data->iout_oc_fault_limit, - word); - break; - case PMBUS_IOUT_OC_WARN_LIMIT: -- ret = pmbus_write_word_data(client, page, MAX34440_IOUT_OC_WARN_LIMIT, -+ ret = pmbus_write_word_data(client, page, data->iout_oc_warn_limit, - word); - break; - case PMBUS_VIRT_RESET_POUT_HISTORY: -@@ -235,6 +240,25 @@ static int max34451_set_supported_funcs(struct i2c_client *client, - */ - - int page, rv; -+ bool max34451_na6 = false; -+ -+ rv = i2c_smbus_read_word_data(client, PMBUS_MFR_REVISION); -+ if (rv < 0) -+ return rv; -+ -+ if (rv >= MAX34451ETNA6_MFR_REV) { -+ max34451_na6 = true; -+ data->info.format[PSC_VOLTAGE_IN] = direct; -+ data->info.format[PSC_CURRENT_IN] = direct; -+ data->info.m[PSC_VOLTAGE_IN] = 1; -+ data->info.b[PSC_VOLTAGE_IN] = 0; -+ data->info.R[PSC_VOLTAGE_IN] = 3; -+ data->info.m[PSC_CURRENT_IN] = 1; -+ data->info.b[PSC_CURRENT_IN] = 0; -+ data->info.R[PSC_CURRENT_IN] = 2; -+ data->iout_oc_fault_limit = PMBUS_IOUT_OC_FAULT_LIMIT; -+ data->iout_oc_warn_limit = PMBUS_IOUT_OC_WARN_LIMIT; -+ } - - for (page = 0; page < 16; page++) { - rv = i2c_smbus_write_byte_data(client, PMBUS_PAGE, page); -@@ -251,16 +275,30 @@ static int max34451_set_supported_funcs(struct i2c_client *client, - case 0x20: - data->info.func[page] = PMBUS_HAVE_VOUT | - PMBUS_HAVE_STATUS_VOUT; -+ -+ if (max34451_na6) -+ data->info.func[page] |= PMBUS_HAVE_VIN | -+ PMBUS_HAVE_STATUS_INPUT; - break; - case 0x21: - data->info.func[page] = PMBUS_HAVE_VOUT; -+ -+ if (max34451_na6) -+ data->info.func[page] |= PMBUS_HAVE_VIN; - break; - case 0x22: - data->info.func[page] = PMBUS_HAVE_IOUT | - PMBUS_HAVE_STATUS_IOUT; -+ -+ if (max34451_na6) -+ data->info.func[page] |= PMBUS_HAVE_IIN | -+ PMBUS_HAVE_STATUS_INPUT; - break; - case 0x23: - data->info.func[page] = PMBUS_HAVE_IOUT; -+ -+ if (max34451_na6) -+ data->info.func[page] |= PMBUS_HAVE_IIN; - break; - default: - break; -@@ -494,6 +532,8 @@ static int max34440_probe(struct i2c_client *client) - return -ENOMEM; - data->id = i2c_match_id(max34440_id, client)->driver_data; - data->info = max34440_info[data->id]; -+ data->iout_oc_fault_limit = MAX34440_IOUT_OC_FAULT_LIMIT; -+ data->iout_oc_warn_limit = MAX34440_IOUT_OC_WARN_LIMIT; - - if (data->id == max34451) { - rv = max34451_set_supported_funcs(client, data); -diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c -index 783e259c376121..3b57851869eaae 100644 ---- a/drivers/hwtracing/coresight/coresight-core.c -+++ b/drivers/hwtracing/coresight/coresight-core.c -@@ -135,7 +135,8 @@ coresight_find_out_connection(struct coresight_device *src_dev, - - static inline u32 coresight_read_claim_tags(struct coresight_device *csdev) - { -- return csdev_access_relaxed_read32(&csdev->access, CORESIGHT_CLAIMCLR); -+ return FIELD_GET(CORESIGHT_CLAIM_MASK, -+ csdev_access_relaxed_read32(&csdev->access, CORESIGHT_CLAIMCLR)); - } - - static inline bool coresight_is_claimed_self_hosted(struct coresight_device *csdev) -diff --git a/drivers/hwtracing/coresight/coresight-priv.h b/drivers/hwtracing/coresight/coresight-priv.h -index 30c051055e54b3..b758a42ed8c734 100644 ---- a/drivers/hwtracing/coresight/coresight-priv.h -+++ b/drivers/hwtracing/coresight/coresight-priv.h -@@ -32,6 +32,7 @@ - * Coresight device CLAIM protocol. - * See PSCI - ARM DEN 0022D, Section: 6.8.1 Debug and Trace save and restore. - */ -+#define CORESIGHT_CLAIM_MASK GENMASK(1, 0) - #define CORESIGHT_CLAIM_SELF_HOSTED BIT(1) - - #define TIMEOUT_US 100 -diff --git a/drivers/i2c/busses/i2c-robotfuzz-osif.c b/drivers/i2c/busses/i2c-robotfuzz-osif.c -index 66dfa211e736b1..8e4cf9028b2342 100644 ---- a/drivers/i2c/busses/i2c-robotfuzz-osif.c -+++ b/drivers/i2c/busses/i2c-robotfuzz-osif.c -@@ -111,6 +111,11 @@ static u32 osif_func(struct i2c_adapter *adapter) - return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL; - } - -+/* prevent invalid 0-length usb_control_msg */ -+static const struct i2c_adapter_quirks osif_quirks = { -+ .flags = I2C_AQ_NO_ZERO_LEN_READ, -+}; -+ - static const struct i2c_algorithm osif_algorithm = { - .master_xfer = osif_xfer, - .functionality = osif_func, -@@ -143,6 +148,7 @@ static int osif_probe(struct usb_interface *interface, - - priv->adapter.owner = THIS_MODULE; - priv->adapter.class = I2C_CLASS_HWMON; -+ priv->adapter.quirks = &osif_quirks; - priv->adapter.algo = &osif_algorithm; - priv->adapter.algo_data = priv; - snprintf(priv->adapter.name, sizeof(priv->adapter.name), -diff --git a/drivers/i2c/busses/i2c-tiny-usb.c b/drivers/i2c/busses/i2c-tiny-usb.c -index 1bffe36c40ad89..d984b90b352701 100644 ---- a/drivers/i2c/busses/i2c-tiny-usb.c -+++ b/drivers/i2c/busses/i2c-tiny-usb.c -@@ -140,6 +140,11 @@ static u32 usb_func(struct i2c_adapter *adapter) - return ret; - } - -+/* prevent invalid 0-length usb_control_msg */ -+static const struct i2c_adapter_quirks usb_quirks = { -+ .flags = I2C_AQ_NO_ZERO_LEN_READ, -+}; -+ - /* This is the actual algorithm we define */ - static const struct i2c_algorithm usb_algorithm = { - .master_xfer = usb_xfer, -@@ -248,6 +253,7 @@ static int i2c_tiny_usb_probe(struct usb_interface *interface, - /* setup i2c adapter description */ - dev->adapter.owner = THIS_MODULE; - dev->adapter.class = I2C_CLASS_HWMON; -+ dev->adapter.quirks = &usb_quirks; - dev->adapter.algo = &usb_algorithm; - dev->adapter.algo_data = dev; - snprintf(dev->adapter.name, sizeof(dev->adapter.name), -diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c -index 7e21928707437b..533667eefe419c 100644 ---- a/drivers/iio/adc/ad_sigma_delta.c -+++ b/drivers/iio/adc/ad_sigma_delta.c -@@ -476,6 +476,10 @@ static irqreturn_t ad_sd_trigger_handler(int irq, void *p) - * byte set to zero. */ - ad_sd_read_reg_raw(sigma_delta, data_reg, transfer_size, &data[1]); - break; -+ -+ default: -+ dev_err_ratelimited(&indio_dev->dev, "Unsupported reg_size: %u\n", reg_size); -+ goto irq_handled; - } - - /* -diff --git a/drivers/iio/pressure/zpa2326.c b/drivers/iio/pressure/zpa2326.c -index ef1d0349f4247d..a1c694199c9896 100644 ---- a/drivers/iio/pressure/zpa2326.c -+++ b/drivers/iio/pressure/zpa2326.c -@@ -582,7 +582,7 @@ static int zpa2326_fill_sample_buffer(struct iio_dev *indio_dev, - struct { - u32 pressure; - u16 temperature; -- u64 timestamp; -+ aligned_s64 timestamp; - } sample; - int err; - -diff --git a/drivers/leds/led-class-multicolor.c b/drivers/leds/led-class-multicolor.c -index ec62a48116135c..e0785935f4ba67 100644 ---- a/drivers/leds/led-class-multicolor.c -+++ b/drivers/leds/led-class-multicolor.c -@@ -61,7 +61,8 @@ static ssize_t multi_intensity_store(struct device *dev, - for (i = 0; i < mcled_cdev->num_colors; i++) - mcled_cdev->subled_info[i].intensity = intensity_value[i]; - -- led_set_brightness(led_cdev, led_cdev->brightness); -+ if (!test_bit(LED_BLINK_SW, &led_cdev->work_flags)) -+ led_set_brightness(led_cdev, led_cdev->brightness); - ret = size; - err_out: - mutex_unlock(&led_cdev->led_access); -diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c -index f13d705f7861af..cb59b4dbad6269 100644 ---- a/drivers/mailbox/mailbox.c -+++ b/drivers/mailbox/mailbox.c -@@ -500,8 +500,8 @@ void mbox_free_channel(struct mbox_chan *chan) - if (chan->txdone_method == TXDONE_BY_ACK) - chan->txdone_method = TXDONE_BY_POLL; - -- module_put(chan->mbox->dev->driver->owner); - spin_unlock_irqrestore(&chan->lock, flags); -+ module_put(chan->mbox->dev->driver->owner); - } - EXPORT_SYMBOL_GPL(mbox_free_channel); - -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index 8440b56e385d5c..b9dfebaa9eae55 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -1739,7 +1739,12 @@ static void cache_set_flush(struct closure *cl) - mutex_unlock(&b->write_lock); - } - -- if (ca->alloc_thread) -+ /* -+ * If the register_cache_set() call to bch_cache_set_alloc() failed, -+ * ca has not been assigned a value and return error. -+ * So we need check ca is not NULL during bch_cache_set_unregister(). -+ */ -+ if (ca && ca->alloc_thread) - kthread_stop(ca->alloc_thread); - - if (c->journal.cur) { -diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c -index 385e24f55ec002..f23edd79df45e5 100644 ---- a/drivers/md/dm-raid.c -+++ b/drivers/md/dm-raid.c -@@ -2378,7 +2378,7 @@ static int super_init_validation(struct raid_set *rs, struct md_rdev *rdev) - */ - sb_retrieve_failed_devices(sb, failed_devices); - rdev_for_each(r, mddev) { -- if (test_bit(Journal, &rdev->flags) || -+ if (test_bit(Journal, &r->flags) || - !r->sb_page) - continue; - sb2 = page_address(r->sb_page); -diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c -index 8317e07b326d0d..21decb97bc050b 100644 ---- a/drivers/md/md-bitmap.c -+++ b/drivers/md/md-bitmap.c -@@ -589,7 +589,7 @@ static int md_bitmap_new_disk_sb(struct bitmap *bitmap) - * is a good choice? We choose COUNTER_MAX / 2 arbitrarily. - */ - write_behind = bitmap->mddev->bitmap_info.max_write_behind; -- if (write_behind > COUNTER_MAX) -+ if (write_behind > COUNTER_MAX / 2) - write_behind = COUNTER_MAX / 2; - sb->write_behind = cpu_to_le32(write_behind); - bitmap->mddev->bitmap_info.max_write_behind = write_behind; -diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c -index 59e21746f55073..bd90d8bacd5ef1 100644 ---- a/drivers/media/usb/uvc/uvc_ctrl.c -+++ b/drivers/media/usb/uvc/uvc_ctrl.c -@@ -1801,7 +1801,7 @@ static int uvc_ctrl_commit_entity(struct uvc_device *dev, - unsigned int processed_ctrls = 0; - struct uvc_control *ctrl; - unsigned int i; -- int ret; -+ int ret = 0; - - if (entity == NULL) - return 0; -@@ -1830,8 +1830,6 @@ static int uvc_ctrl_commit_entity(struct uvc_device *dev, - dev->intfnum, ctrl->info.selector, - uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT), - ctrl->info.size); -- else -- ret = 0; - - if (!ret) - processed_ctrls++; -@@ -1843,17 +1841,25 @@ static int uvc_ctrl_commit_entity(struct uvc_device *dev, - - ctrl->dirty = 0; - -- if (ret < 0) { -+ if (!rollback && handle && -+ ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS) -+ uvc_ctrl_set_handle(handle, ctrl, handle); -+ -+ if (ret < 0 && !rollback) { - if (err_ctrl) - *err_ctrl = ctrl; -- return ret; -+ /* -+ * If we fail to set a control, we need to rollback -+ * the next ones. -+ */ -+ rollback = 1; - } - -- if (!rollback && handle && -- ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS) -- uvc_ctrl_set_handle(handle, ctrl, handle); - } - -+ if (ret) -+ return ret; -+ - return processed_ctrls; - } - -@@ -1884,7 +1890,8 @@ int __uvc_ctrl_commit(struct uvc_fh *handle, int rollback, - struct uvc_video_chain *chain = handle->chain; - struct uvc_control *err_ctrl; - struct uvc_entity *entity; -- int ret = 0; -+ int ret_out = 0; -+ int ret; - - /* Find the control. */ - list_for_each_entry(entity, &chain->entities, chain) { -@@ -1895,17 +1902,23 @@ int __uvc_ctrl_commit(struct uvc_fh *handle, int rollback, - ctrls->error_idx = - uvc_ctrl_find_ctrl_idx(entity, ctrls, - err_ctrl); -- goto done; -+ /* -+ * When we fail to commit an entity, we need to -+ * restore the UVC_CTRL_DATA_BACKUP for all the -+ * controls in the other entities, otherwise our cache -+ * and the hardware will be out of sync. -+ */ -+ rollback = 1; -+ -+ ret_out = ret; - } else if (ret > 0 && !rollback) { - uvc_ctrl_send_events(handle, entity, - ctrls->controls, ctrls->count); - } - } - -- ret = 0; --done: - mutex_unlock(&chain->ctrl_mutex); -- return ret; -+ return ret_out; - } - - int uvc_ctrl_get(struct uvc_video_chain *chain, -diff --git a/drivers/mfd/max14577.c b/drivers/mfd/max14577.c -index 1f4f5002595c0a..17672eeb1732a2 100644 ---- a/drivers/mfd/max14577.c -+++ b/drivers/mfd/max14577.c -@@ -463,6 +463,7 @@ static void max14577_i2c_remove(struct i2c_client *i2c) - { - struct max14577 *max14577 = i2c_get_clientdata(i2c); - -+ device_init_wakeup(max14577->dev, false); - mfd_remove_devices(max14577->dev); - regmap_del_irq_chip(max14577->irq, max14577->irq_data); - if (max14577->dev_type == MAXIM_DEVICE_TYPE_MAX77836) -diff --git a/drivers/misc/tps6594-pfsm.c b/drivers/misc/tps6594-pfsm.c -index 88dcac8148922c..71fbe31542e562 100644 ---- a/drivers/misc/tps6594-pfsm.c -+++ b/drivers/misc/tps6594-pfsm.c -@@ -260,6 +260,9 @@ static int tps6594_pfsm_probe(struct platform_device *pdev) - pfsm->miscdev.minor = MISC_DYNAMIC_MINOR; - pfsm->miscdev.name = devm_kasprintf(dev, GFP_KERNEL, "pfsm-%ld-0x%02x", - tps->chip_id, tps->reg); -+ if (!pfsm->miscdev.name) -+ return -ENOMEM; -+ - pfsm->miscdev.fops = &tps6594_pfsm_fops; - pfsm->miscdev.parent = dev->parent; - -diff --git a/drivers/net/ethernet/freescale/enetc/enetc_hw.h b/drivers/net/ethernet/freescale/enetc/enetc_hw.h -index 1619943fb2637a..4e8881b479e487 100644 ---- a/drivers/net/ethernet/freescale/enetc/enetc_hw.h -+++ b/drivers/net/ethernet/freescale/enetc/enetc_hw.h -@@ -485,7 +485,7 @@ static inline u64 _enetc_rd_reg64(void __iomem *reg) - tmp = ioread32(reg + 4); - } while (high != tmp); - -- return le64_to_cpu((__le64)high << 32 | low); -+ return (u64)high << 32 | low; - } - #endif - -diff --git a/drivers/net/ethernet/wangxun/libwx/wx_lib.c b/drivers/net/ethernet/wangxun/libwx/wx_lib.c -index c019fe964eceaf..97c6b4d2763433 100644 ---- a/drivers/net/ethernet/wangxun/libwx/wx_lib.c -+++ b/drivers/net/ethernet/wangxun/libwx/wx_lib.c -@@ -2368,7 +2368,7 @@ static int wx_alloc_page_pool(struct wx_ring *rx_ring) - struct page_pool_params pp_params = { - .flags = PP_FLAG_DMA_MAP | PP_FLAG_DMA_SYNC_DEV, - .order = 0, -- .pool_size = rx_ring->size, -+ .pool_size = rx_ring->count, - .nid = dev_to_node(rx_ring->dev), - .dev = rx_ring->dev, - .dma_dir = DMA_FROM_DEVICE, -diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c -index 4ce31f9f069475..5cf050e562b734 100644 ---- a/drivers/nvme/host/ioctl.c -+++ b/drivers/nvme/host/ioctl.c -@@ -526,16 +526,14 @@ static enum rq_end_io_ret nvme_uring_cmd_end_io(struct request *req, - pdu->u.result = le64_to_cpu(nvme_req(req)->result.u64); - - /* -- * For iopoll, complete it directly. -- * Otherwise, move the completion to task work. -+ * IOPOLL could potentially complete this request directly, but -+ * if multiple rings are polling on the same queue, then it's possible -+ * for one ring to find completions for another ring. Punting the -+ * completion via task_work will always direct it to the right -+ * location, rather than potentially complete requests for ringA -+ * under iopoll invocations from ringB. - */ -- if (blk_rq_is_poll(req)) { -- WRITE_ONCE(ioucmd->cookie, NULL); -- nvme_uring_task_cb(ioucmd, IO_URING_F_UNLOCKED); -- } else { -- io_uring_cmd_do_in_task_lazy(ioucmd, nvme_uring_task_cb); -- } -- -+ io_uring_cmd_do_in_task_lazy(ioucmd, nvme_uring_task_cb); - return RQ_END_IO_FREE; - } - -diff --git a/drivers/pci/controller/dwc/pcie-designware.c b/drivers/pci/controller/dwc/pcie-designware.c -index 2b60d20dfdf59d..717af1b757f0a5 100644 ---- a/drivers/pci/controller/dwc/pcie-designware.c -+++ b/drivers/pci/controller/dwc/pcie-designware.c -@@ -748,22 +748,19 @@ static void dw_pcie_link_set_max_link_width(struct dw_pcie *pci, u32 num_lanes) - /* Set link width speed control register */ - lwsc = dw_pcie_readl_dbi(pci, PCIE_LINK_WIDTH_SPEED_CONTROL); - lwsc &= ~PORT_LOGIC_LINK_WIDTH_MASK; -+ lwsc |= PORT_LOGIC_LINK_WIDTH_1_LANES; - switch (num_lanes) { - case 1: - plc |= PORT_LINK_MODE_1_LANES; -- lwsc |= PORT_LOGIC_LINK_WIDTH_1_LANES; - break; - case 2: - plc |= PORT_LINK_MODE_2_LANES; -- lwsc |= PORT_LOGIC_LINK_WIDTH_2_LANES; - break; - case 4: - plc |= PORT_LINK_MODE_4_LANES; -- lwsc |= PORT_LOGIC_LINK_WIDTH_4_LANES; - break; - case 8: - plc |= PORT_LINK_MODE_8_LANES; -- lwsc |= PORT_LOGIC_LINK_WIDTH_8_LANES; - break; - default: - dev_err(pci->dev, "num-lanes %u: invalid value\n", num_lanes); -diff --git a/drivers/pci/controller/pcie-apple.c b/drivers/pci/controller/pcie-apple.c -index 7e6bd63a6425e6..8dfea64a51e0f8 100644 ---- a/drivers/pci/controller/pcie-apple.c -+++ b/drivers/pci/controller/pcie-apple.c -@@ -585,6 +585,9 @@ static int apple_pcie_setup_port(struct apple_pcie *pcie, - list_add_tail(&port->entry, &pcie->ports); - init_completion(&pcie->event); - -+ /* In the success path, we keep a reference to np around */ -+ of_node_get(np); -+ - ret = apple_pcie_port_register_irqs(port); - WARN_ON(ret); - -@@ -764,7 +767,6 @@ static int apple_pcie_init(struct pci_config_window *cfg) - { - struct device *dev = cfg->parent; - struct platform_device *platform = to_platform_device(dev); -- struct device_node *of_port; - struct apple_pcie *pcie; - int ret; - -@@ -787,11 +789,10 @@ static int apple_pcie_init(struct pci_config_window *cfg) - if (ret) - return ret; - -- for_each_child_of_node(dev->of_node, of_port) { -+ for_each_available_child_of_node_scoped(dev->of_node, of_port) { - ret = apple_pcie_setup_port(pcie, of_port); - if (ret) { - dev_err(pcie->dev, "Port %pOF setup fail: %d\n", of_port, ret); -- of_node_put(of_port); - return ret; - } - } -diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig -index 07eea525091b08..1fd57eb867662a 100644 ---- a/drivers/platform/x86/Kconfig -+++ b/drivers/platform/x86/Kconfig -@@ -466,6 +466,7 @@ config LENOVO_YMC - tristate "Lenovo Yoga Tablet Mode Control" - depends on ACPI_WMI - depends on INPUT -+ depends on IDEAPAD_LAPTOP - select INPUT_SPARSEKMAP - help - This driver maps the Tablet Mode Control switch to SW_TABLET_MODE input -diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c -index 50013af0537c36..e84fcb444d872a 100644 ---- a/drivers/platform/x86/ideapad-laptop.c -+++ b/drivers/platform/x86/ideapad-laptop.c -@@ -14,6 +14,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -21,6 +22,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -86,6 +88,34 @@ enum { - SALS_FNLOCK_OFF = 0xf, - }; - -+enum { -+ VPCCMD_R_VPC1 = 0x10, -+ VPCCMD_R_BL_MAX, -+ VPCCMD_R_BL, -+ VPCCMD_W_BL, -+ VPCCMD_R_WIFI, -+ VPCCMD_W_WIFI, -+ VPCCMD_R_BT, -+ VPCCMD_W_BT, -+ VPCCMD_R_BL_POWER, -+ VPCCMD_R_NOVO, -+ VPCCMD_R_VPC2, -+ VPCCMD_R_TOUCHPAD, -+ VPCCMD_W_TOUCHPAD, -+ VPCCMD_R_CAMERA, -+ VPCCMD_W_CAMERA, -+ VPCCMD_R_3G, -+ VPCCMD_W_3G, -+ VPCCMD_R_ODD, /* 0x21 */ -+ VPCCMD_W_FAN, -+ VPCCMD_R_RF, -+ VPCCMD_W_RF, -+ VPCCMD_W_YMC = 0x2A, -+ VPCCMD_R_FAN = 0x2B, -+ VPCCMD_R_SPECIAL_BUTTONS = 0x31, -+ VPCCMD_W_BL_POWER = 0x33, -+}; -+ - /* - * These correspond to the number of supported states - 1 - * Future keyboard types may need a new system, if there's a collision -@@ -145,6 +175,7 @@ struct ideapad_private { - bool touchpad_ctrl_via_ec : 1; - bool ctrl_ps2_aux_port : 1; - bool usb_charging : 1; -+ bool ymc_ec_trigger : 1; - } features; - struct { - bool initialized; -@@ -188,6 +219,12 @@ MODULE_PARM_DESC(touchpad_ctrl_via_ec, - "Enable registering a 'touchpad' sysfs-attribute which can be used to manually " - "tell the EC to enable/disable the touchpad. This may not work on all models."); - -+static bool ymc_ec_trigger __read_mostly; -+module_param(ymc_ec_trigger, bool, 0444); -+MODULE_PARM_DESC(ymc_ec_trigger, -+ "Enable EC triggering work-around to force emitting tablet mode events. " -+ "If you need this please report this to: platform-driver-x86@vger.kernel.org"); -+ - /* - * shared data - */ -@@ -227,6 +264,21 @@ static void ideapad_shared_exit(struct ideapad_private *priv) - /* - * ACPI Helpers - */ -+#define IDEAPAD_EC_TIMEOUT 200 /* in ms */ -+ -+/* -+ * Some models (e.g., ThinkBook since 2024) have a low tolerance for being -+ * polled too frequently. Doing so may break the state machine in the EC, -+ * resulting in a hard shutdown. -+ * -+ * It is also observed that frequent polls may disturb the ongoing operation -+ * and notably delay the availability of EC response. -+ * -+ * These values are used as the delay before the first poll and the interval -+ * between subsequent polls to solve the above issues. -+ */ -+#define IDEAPAD_EC_POLL_MIN_US 150 -+#define IDEAPAD_EC_POLL_MAX_US 300 - - static int eval_int(acpi_handle handle, const char *name, unsigned long *res) - { -@@ -242,6 +294,29 @@ static int eval_int(acpi_handle handle, const char *name, unsigned long *res) - return 0; - } - -+static int eval_int_with_arg(acpi_handle handle, const char *name, unsigned long arg, -+ unsigned long *res) -+{ -+ struct acpi_object_list params; -+ unsigned long long result; -+ union acpi_object in_obj; -+ acpi_status status; -+ -+ params.count = 1; -+ params.pointer = &in_obj; -+ in_obj.type = ACPI_TYPE_INTEGER; -+ in_obj.integer.value = arg; -+ -+ status = acpi_evaluate_integer(handle, (char *)name, ¶ms, &result); -+ if (ACPI_FAILURE(status)) -+ return -EIO; -+ -+ if (res) -+ *res = result; -+ -+ return 0; -+} -+ - static int exec_simple_method(acpi_handle handle, const char *name, unsigned long arg) - { - acpi_status status = acpi_execute_simple_method(handle, (char *)name, arg); -@@ -284,6 +359,89 @@ static int eval_dytc(acpi_handle handle, unsigned long cmd, unsigned long *res) - return eval_int_with_arg(handle, "DYTC", cmd, res); - } - -+static int eval_vpcr(acpi_handle handle, unsigned long cmd, unsigned long *res) -+{ -+ return eval_int_with_arg(handle, "VPCR", cmd, res); -+} -+ -+static int eval_vpcw(acpi_handle handle, unsigned long cmd, unsigned long data) -+{ -+ struct acpi_object_list params; -+ union acpi_object in_obj[2]; -+ acpi_status status; -+ -+ params.count = 2; -+ params.pointer = in_obj; -+ in_obj[0].type = ACPI_TYPE_INTEGER; -+ in_obj[0].integer.value = cmd; -+ in_obj[1].type = ACPI_TYPE_INTEGER; -+ in_obj[1].integer.value = data; -+ -+ status = acpi_evaluate_object(handle, "VPCW", ¶ms, NULL); -+ if (ACPI_FAILURE(status)) -+ return -EIO; -+ -+ return 0; -+} -+ -+static int read_ec_data(acpi_handle handle, unsigned long cmd, unsigned long *data) -+{ -+ unsigned long end_jiffies, val; -+ int err; -+ -+ err = eval_vpcw(handle, 1, cmd); -+ if (err) -+ return err; -+ -+ end_jiffies = jiffies + msecs_to_jiffies(IDEAPAD_EC_TIMEOUT) + 1; -+ -+ while (time_before(jiffies, end_jiffies)) { -+ usleep_range(IDEAPAD_EC_POLL_MIN_US, IDEAPAD_EC_POLL_MAX_US); -+ -+ err = eval_vpcr(handle, 1, &val); -+ if (err) -+ return err; -+ -+ if (val == 0) -+ return eval_vpcr(handle, 0, data); -+ } -+ -+ acpi_handle_err(handle, "timeout in %s\n", __func__); -+ -+ return -ETIMEDOUT; -+} -+ -+static int write_ec_cmd(acpi_handle handle, unsigned long cmd, unsigned long data) -+{ -+ unsigned long end_jiffies, val; -+ int err; -+ -+ err = eval_vpcw(handle, 0, data); -+ if (err) -+ return err; -+ -+ err = eval_vpcw(handle, 1, cmd); -+ if (err) -+ return err; -+ -+ end_jiffies = jiffies + msecs_to_jiffies(IDEAPAD_EC_TIMEOUT) + 1; -+ -+ while (time_before(jiffies, end_jiffies)) { -+ usleep_range(IDEAPAD_EC_POLL_MIN_US, IDEAPAD_EC_POLL_MAX_US); -+ -+ err = eval_vpcr(handle, 1, &val); -+ if (err) -+ return err; -+ -+ if (val == 0) -+ return 0; -+ } -+ -+ acpi_handle_err(handle, "timeout in %s\n", __func__); -+ -+ return -ETIMEDOUT; -+} -+ - /* - * debugfs - */ -@@ -1501,6 +1659,79 @@ static void ideapad_sync_touchpad_state(struct ideapad_private *priv, bool send_ - priv->r_touchpad_val = value; - } - -+static const struct dmi_system_id ymc_ec_trigger_quirk_dmi_table[] = { -+ { -+ /* Lenovo Yoga 7 14ARB7 */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "82QF"), -+ }, -+ }, -+ { -+ /* Lenovo Yoga 7 14ACN6 */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "82N7"), -+ }, -+ }, -+ { } -+}; -+ -+static void ideapad_laptop_trigger_ec(void) -+{ -+ struct ideapad_private *priv; -+ int ret; -+ -+ guard(mutex)(&ideapad_shared_mutex); -+ -+ priv = ideapad_shared; -+ if (!priv) -+ return; -+ -+ if (!priv->features.ymc_ec_trigger) -+ return; -+ -+ ret = write_ec_cmd(priv->adev->handle, VPCCMD_W_YMC, 1); -+ if (ret) -+ dev_warn(&priv->platform_device->dev, "Could not write YMC: %d\n", ret); -+} -+ -+static int ideapad_laptop_nb_notify(struct notifier_block *nb, -+ unsigned long action, void *data) -+{ -+ switch (action) { -+ case IDEAPAD_LAPTOP_YMC_EVENT: -+ ideapad_laptop_trigger_ec(); -+ break; -+ } -+ -+ return 0; -+} -+ -+static struct notifier_block ideapad_laptop_notifier = { -+ .notifier_call = ideapad_laptop_nb_notify, -+}; -+ -+static BLOCKING_NOTIFIER_HEAD(ideapad_laptop_chain_head); -+ -+int ideapad_laptop_register_notifier(struct notifier_block *nb) -+{ -+ return blocking_notifier_chain_register(&ideapad_laptop_chain_head, nb); -+} -+EXPORT_SYMBOL_NS_GPL(ideapad_laptop_register_notifier, IDEAPAD_LAPTOP); -+ -+int ideapad_laptop_unregister_notifier(struct notifier_block *nb) -+{ -+ return blocking_notifier_chain_unregister(&ideapad_laptop_chain_head, nb); -+} -+EXPORT_SYMBOL_NS_GPL(ideapad_laptop_unregister_notifier, IDEAPAD_LAPTOP); -+ -+void ideapad_laptop_call_notifier(unsigned long action, void *data) -+{ -+ blocking_notifier_call_chain(&ideapad_laptop_chain_head, action, data); -+} -+EXPORT_SYMBOL_NS_GPL(ideapad_laptop_call_notifier, IDEAPAD_LAPTOP); -+ - static void ideapad_acpi_notify(acpi_handle handle, u32 event, void *data) - { - struct ideapad_private *priv = data; -@@ -1637,6 +1868,8 @@ static void ideapad_check_features(struct ideapad_private *priv) - priv->features.ctrl_ps2_aux_port = - ctrl_ps2_aux_port || dmi_check_system(ctrl_ps2_aux_port_list); - priv->features.touchpad_ctrl_via_ec = touchpad_ctrl_via_ec; -+ priv->features.ymc_ec_trigger = -+ ymc_ec_trigger || dmi_check_system(ymc_ec_trigger_quirk_dmi_table); - - if (!read_ec_data(handle, VPCCMD_R_FAN, &val)) - priv->features.fan_mode = true; -@@ -1872,6 +2105,8 @@ static int ideapad_acpi_add(struct platform_device *pdev) - if (err) - goto shared_init_failed; - -+ ideapad_laptop_register_notifier(&ideapad_laptop_notifier); -+ - return 0; - - shared_init_failed: -@@ -1903,6 +2138,8 @@ static void ideapad_acpi_remove(struct platform_device *pdev) - struct ideapad_private *priv = dev_get_drvdata(&pdev->dev); - int i; - -+ ideapad_laptop_unregister_notifier(&ideapad_laptop_notifier); -+ - ideapad_shared_exit(priv); - - acpi_remove_notify_handler(priv->adev->handle, -diff --git a/drivers/platform/x86/ideapad-laptop.h b/drivers/platform/x86/ideapad-laptop.h -index 4498a96de59769..1e52f2aa0aac38 100644 ---- a/drivers/platform/x86/ideapad-laptop.h -+++ b/drivers/platform/x86/ideapad-laptop.h -@@ -9,144 +9,14 @@ - #ifndef _IDEAPAD_LAPTOP_H_ - #define _IDEAPAD_LAPTOP_H_ - --#include --#include --#include -+#include - --enum { -- VPCCMD_R_VPC1 = 0x10, -- VPCCMD_R_BL_MAX, -- VPCCMD_R_BL, -- VPCCMD_W_BL, -- VPCCMD_R_WIFI, -- VPCCMD_W_WIFI, -- VPCCMD_R_BT, -- VPCCMD_W_BT, -- VPCCMD_R_BL_POWER, -- VPCCMD_R_NOVO, -- VPCCMD_R_VPC2, -- VPCCMD_R_TOUCHPAD, -- VPCCMD_W_TOUCHPAD, -- VPCCMD_R_CAMERA, -- VPCCMD_W_CAMERA, -- VPCCMD_R_3G, -- VPCCMD_W_3G, -- VPCCMD_R_ODD, /* 0x21 */ -- VPCCMD_W_FAN, -- VPCCMD_R_RF, -- VPCCMD_W_RF, -- VPCCMD_W_YMC = 0x2A, -- VPCCMD_R_FAN = 0x2B, -- VPCCMD_R_SPECIAL_BUTTONS = 0x31, -- VPCCMD_W_BL_POWER = 0x33, -+enum ideapad_laptop_notifier_actions { -+ IDEAPAD_LAPTOP_YMC_EVENT, - }; - --static inline int eval_int_with_arg(acpi_handle handle, const char *name, unsigned long arg, unsigned long *res) --{ -- struct acpi_object_list params; -- unsigned long long result; -- union acpi_object in_obj; -- acpi_status status; -+int ideapad_laptop_register_notifier(struct notifier_block *nb); -+int ideapad_laptop_unregister_notifier(struct notifier_block *nb); -+void ideapad_laptop_call_notifier(unsigned long action, void *data); - -- params.count = 1; -- params.pointer = &in_obj; -- in_obj.type = ACPI_TYPE_INTEGER; -- in_obj.integer.value = arg; -- -- status = acpi_evaluate_integer(handle, (char *)name, ¶ms, &result); -- if (ACPI_FAILURE(status)) -- return -EIO; -- -- if (res) -- *res = result; -- -- return 0; --} -- --static inline int eval_vpcr(acpi_handle handle, unsigned long cmd, unsigned long *res) --{ -- return eval_int_with_arg(handle, "VPCR", cmd, res); --} -- --static inline int eval_vpcw(acpi_handle handle, unsigned long cmd, unsigned long data) --{ -- struct acpi_object_list params; -- union acpi_object in_obj[2]; -- acpi_status status; -- -- params.count = 2; -- params.pointer = in_obj; -- in_obj[0].type = ACPI_TYPE_INTEGER; -- in_obj[0].integer.value = cmd; -- in_obj[1].type = ACPI_TYPE_INTEGER; -- in_obj[1].integer.value = data; -- -- status = acpi_evaluate_object(handle, "VPCW", ¶ms, NULL); -- if (ACPI_FAILURE(status)) -- return -EIO; -- -- return 0; --} -- --#define IDEAPAD_EC_TIMEOUT 200 /* in ms */ -- --static inline int read_ec_data(acpi_handle handle, unsigned long cmd, unsigned long *data) --{ -- unsigned long end_jiffies, val; -- int err; -- -- err = eval_vpcw(handle, 1, cmd); -- if (err) -- return err; -- -- end_jiffies = jiffies + msecs_to_jiffies(IDEAPAD_EC_TIMEOUT) + 1; -- -- while (time_before(jiffies, end_jiffies)) { -- schedule(); -- -- err = eval_vpcr(handle, 1, &val); -- if (err) -- return err; -- -- if (val == 0) -- return eval_vpcr(handle, 0, data); -- } -- -- acpi_handle_err(handle, "timeout in %s\n", __func__); -- -- return -ETIMEDOUT; --} -- --static inline int write_ec_cmd(acpi_handle handle, unsigned long cmd, unsigned long data) --{ -- unsigned long end_jiffies, val; -- int err; -- -- err = eval_vpcw(handle, 0, data); -- if (err) -- return err; -- -- err = eval_vpcw(handle, 1, cmd); -- if (err) -- return err; -- -- end_jiffies = jiffies + msecs_to_jiffies(IDEAPAD_EC_TIMEOUT) + 1; -- -- while (time_before(jiffies, end_jiffies)) { -- schedule(); -- -- err = eval_vpcr(handle, 1, &val); -- if (err) -- return err; -- -- if (val == 0) -- return 0; -- } -- -- acpi_handle_err(handle, "timeout in %s\n", __func__); -- -- return -ETIMEDOUT; --} -- --#undef IDEAPAD_EC_TIMEOUT - #endif /* !_IDEAPAD_LAPTOP_H_ */ -diff --git a/drivers/platform/x86/lenovo-ymc.c b/drivers/platform/x86/lenovo-ymc.c -index ef2c267ab485cd..bd9f95404c7cb0 100644 ---- a/drivers/platform/x86/lenovo-ymc.c -+++ b/drivers/platform/x86/lenovo-ymc.c -@@ -20,32 +20,10 @@ - #define LENOVO_YMC_QUERY_INSTANCE 0 - #define LENOVO_YMC_QUERY_METHOD 0x01 - --static bool ec_trigger __read_mostly; --module_param(ec_trigger, bool, 0444); --MODULE_PARM_DESC(ec_trigger, "Enable EC triggering work-around to force emitting tablet mode events"); -- - static bool force; - module_param(force, bool, 0444); - MODULE_PARM_DESC(force, "Force loading on boards without a convertible DMI chassis-type"); - --static const struct dmi_system_id ec_trigger_quirk_dmi_table[] = { -- { -- /* Lenovo Yoga 7 14ARB7 */ -- .matches = { -- DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), -- DMI_MATCH(DMI_PRODUCT_NAME, "82QF"), -- }, -- }, -- { -- /* Lenovo Yoga 7 14ACN6 */ -- .matches = { -- DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), -- DMI_MATCH(DMI_PRODUCT_NAME, "82N7"), -- }, -- }, -- { } --}; -- - static const struct dmi_system_id allowed_chasis_types_dmi_table[] = { - { - .matches = { -@@ -62,21 +40,8 @@ static const struct dmi_system_id allowed_chasis_types_dmi_table[] = { - - struct lenovo_ymc_private { - struct input_dev *input_dev; -- struct acpi_device *ec_acpi_dev; - }; - --static void lenovo_ymc_trigger_ec(struct wmi_device *wdev, struct lenovo_ymc_private *priv) --{ -- int err; -- -- if (!priv->ec_acpi_dev) -- return; -- -- err = write_ec_cmd(priv->ec_acpi_dev->handle, VPCCMD_W_YMC, 1); -- if (err) -- dev_warn(&wdev->dev, "Could not write YMC: %d\n", err); --} -- - static const struct key_entry lenovo_ymc_keymap[] = { - /* Ignore the uninitialized state */ - { KE_IGNORE, 0x00 }, -@@ -127,11 +92,9 @@ static void lenovo_ymc_notify(struct wmi_device *wdev, union acpi_object *data) - - free_obj: - kfree(obj); -- lenovo_ymc_trigger_ec(wdev, priv); -+ ideapad_laptop_call_notifier(IDEAPAD_LAPTOP_YMC_EVENT, &code); - } - --static void acpi_dev_put_helper(void *p) { acpi_dev_put(p); } -- - static int lenovo_ymc_probe(struct wmi_device *wdev, const void *ctx) - { - struct lenovo_ymc_private *priv; -@@ -145,29 +108,10 @@ static int lenovo_ymc_probe(struct wmi_device *wdev, const void *ctx) - return -ENODEV; - } - -- ec_trigger |= dmi_check_system(ec_trigger_quirk_dmi_table); -- - priv = devm_kzalloc(&wdev->dev, sizeof(*priv), GFP_KERNEL); - if (!priv) - return -ENOMEM; - -- if (ec_trigger) { -- pr_debug("Lenovo YMC enable EC triggering.\n"); -- priv->ec_acpi_dev = acpi_dev_get_first_match_dev("VPC2004", NULL, -1); -- -- if (!priv->ec_acpi_dev) { -- dev_err(&wdev->dev, "Could not find EC ACPI device.\n"); -- return -ENODEV; -- } -- err = devm_add_action_or_reset(&wdev->dev, -- acpi_dev_put_helper, priv->ec_acpi_dev); -- if (err) { -- dev_err(&wdev->dev, -- "Could not clean up EC ACPI device: %d\n", err); -- return err; -- } -- } -- - input_dev = devm_input_allocate_device(&wdev->dev); - if (!input_dev) - return -ENOMEM; -@@ -194,7 +138,6 @@ static int lenovo_ymc_probe(struct wmi_device *wdev, const void *ctx) - dev_set_drvdata(&wdev->dev, priv); - - /* Report the state for the first time on probe */ -- lenovo_ymc_trigger_ec(wdev, priv); - lenovo_ymc_notify(wdev, NULL); - return 0; - } -@@ -219,3 +162,4 @@ module_wmi_driver(lenovo_ymc_driver); - MODULE_AUTHOR("Gergo Koteles "); - MODULE_DESCRIPTION("Lenovo Yoga Mode Control driver"); - MODULE_LICENSE("GPL"); -+MODULE_IMPORT_NS(IDEAPAD_LAPTOP); -diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c -index 70fcb5c40cfe32..21fc6151af79f5 100644 ---- a/drivers/s390/crypto/pkey_api.c -+++ b/drivers/s390/crypto/pkey_api.c -@@ -1333,7 +1333,7 @@ static void *_copy_apqns_from_user(void __user *uapqns, size_t nr_apqns) - if (!uapqns || nr_apqns == 0) - return NULL; - -- return memdup_user(uapqns, nr_apqns * sizeof(struct pkey_apqn)); -+ return memdup_array_user(uapqns, nr_apqns, sizeof(struct pkey_apqn)); - } - - static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, -diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c -index dd3630b09aa241..54f66142e14a82 100644 ---- a/drivers/scsi/megaraid/megaraid_sas_base.c -+++ b/drivers/scsi/megaraid/megaraid_sas_base.c -@@ -5908,7 +5908,11 @@ megasas_set_high_iops_queue_affinity_and_hint(struct megasas_instance *instance) - const struct cpumask *mask; - - if (instance->perf_mode == MR_BALANCED_PERF_MODE) { -- mask = cpumask_of_node(dev_to_node(&instance->pdev->dev)); -+ int nid = dev_to_node(&instance->pdev->dev); -+ -+ if (nid == NUMA_NO_NODE) -+ nid = 0; -+ mask = cpumask_of_node(nid); - - for (i = 0; i < instance->low_latency_index_start; i++) { - irq = pci_irq_vector(instance->pdev, i); -diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c -index bf9b816637d02e..9285a683324f4f 100644 ---- a/drivers/spi/spi-cadence-quadspi.c -+++ b/drivers/spi/spi-cadence-quadspi.c -@@ -1868,6 +1868,13 @@ static int cqspi_probe(struct platform_device *pdev) - goto probe_setup_failed; - } - -+ pm_runtime_enable(dev); -+ -+ if (cqspi->rx_chan) { -+ dma_release_channel(cqspi->rx_chan); -+ goto probe_setup_failed; -+ } -+ - ret = spi_register_controller(host); - if (ret) { - dev_err(&pdev->dev, "failed to register SPI ctlr %d\n", ret); -@@ -1877,6 +1884,7 @@ static int cqspi_probe(struct platform_device *pdev) - return 0; - probe_setup_failed: - cqspi_controller_enable(cqspi, 0); -+ pm_runtime_disable(dev); - probe_reset_failed: - if (cqspi->is_jh7110) - cqspi_jh7110_disable_clk(pdev, cqspi); -@@ -1898,7 +1906,8 @@ static void cqspi_remove(struct platform_device *pdev) - if (cqspi->rx_chan) - dma_release_channel(cqspi->rx_chan); - -- clk_disable_unprepare(cqspi->clk); -+ if (pm_runtime_get_sync(&pdev->dev) >= 0) -+ clk_disable(cqspi->clk); - - if (cqspi->is_jh7110) - cqspi_jh7110_disable_clk(pdev, cqspi); -diff --git a/drivers/staging/rtl8723bs/core/rtw_security.c b/drivers/staging/rtl8723bs/core/rtw_security.c -index 7ecdaa2eeaf33e..83fdee444c1c03 100644 ---- a/drivers/staging/rtl8723bs/core/rtw_security.c -+++ b/drivers/staging/rtl8723bs/core/rtw_security.c -@@ -869,29 +869,21 @@ static signed int aes_cipher(u8 *key, uint hdrlen, - num_blocks, payload_index; - - u8 pn_vector[6]; -- u8 mic_iv[16]; -- u8 mic_header1[16]; -- u8 mic_header2[16]; -- u8 ctr_preload[16]; -+ u8 mic_iv[16] = {}; -+ u8 mic_header1[16] = {}; -+ u8 mic_header2[16] = {}; -+ u8 ctr_preload[16] = {}; - - /* Intermediate Buffers */ -- u8 chain_buffer[16]; -- u8 aes_out[16]; -- u8 padded_buffer[16]; -+ u8 chain_buffer[16] = {}; -+ u8 aes_out[16] = {}; -+ u8 padded_buffer[16] = {}; - u8 mic[8]; - uint frtype = GetFrameType(pframe); - uint frsubtype = GetFrameSubType(pframe); - - frsubtype = frsubtype>>4; - -- memset((void *)mic_iv, 0, 16); -- memset((void *)mic_header1, 0, 16); -- memset((void *)mic_header2, 0, 16); -- memset((void *)ctr_preload, 0, 16); -- memset((void *)chain_buffer, 0, 16); -- memset((void *)aes_out, 0, 16); -- memset((void *)padded_buffer, 0, 16); -- - if ((hdrlen == WLAN_HDR_A3_LEN) || (hdrlen == WLAN_HDR_A3_QOS_LEN)) - a4_exists = 0; - else -@@ -1081,15 +1073,15 @@ static signed int aes_decipher(u8 *key, uint hdrlen, - num_blocks, payload_index; - signed int res = _SUCCESS; - u8 pn_vector[6]; -- u8 mic_iv[16]; -- u8 mic_header1[16]; -- u8 mic_header2[16]; -- u8 ctr_preload[16]; -+ u8 mic_iv[16] = {}; -+ u8 mic_header1[16] = {}; -+ u8 mic_header2[16] = {}; -+ u8 ctr_preload[16] = {}; - - /* Intermediate Buffers */ -- u8 chain_buffer[16]; -- u8 aes_out[16]; -- u8 padded_buffer[16]; -+ u8 chain_buffer[16] = {}; -+ u8 aes_out[16] = {}; -+ u8 padded_buffer[16] = {}; - u8 mic[8]; - - uint frtype = GetFrameType(pframe); -@@ -1097,14 +1089,6 @@ static signed int aes_decipher(u8 *key, uint hdrlen, - - frsubtype = frsubtype>>4; - -- memset((void *)mic_iv, 0, 16); -- memset((void *)mic_header1, 0, 16); -- memset((void *)mic_header2, 0, 16); -- memset((void *)ctr_preload, 0, 16); -- memset((void *)chain_buffer, 0, 16); -- memset((void *)aes_out, 0, 16); -- memset((void *)padded_buffer, 0, 16); -- - /* start to decrypt the payload */ - - num_blocks = (plen-8) / 16; /* plen including LLC, payload_length and mic) */ -diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c -index 04809b781f45be..60d48d857b1c00 100644 ---- a/drivers/tty/serial/imx.c -+++ b/drivers/tty/serial/imx.c -@@ -234,6 +234,7 @@ struct imx_port { - enum imx_tx_state tx_state; - struct hrtimer trigger_start_tx; - struct hrtimer trigger_stop_tx; -+ unsigned int rxtl; - }; - - struct imx_port_ucrs { -@@ -1337,6 +1338,7 @@ static void imx_uart_clear_rx_errors(struct imx_port *sport) - - #define TXTL_DEFAULT 8 - #define RXTL_DEFAULT 8 /* 8 characters or aging timer */ -+#define RXTL_CONSOLE_DEFAULT 1 - #define TXTL_DMA 8 /* DMA burst setting */ - #define RXTL_DMA 9 /* DMA burst setting */ - -@@ -1449,7 +1451,7 @@ static void imx_uart_disable_dma(struct imx_port *sport) - ucr1 &= ~(UCR1_RXDMAEN | UCR1_TXDMAEN | UCR1_ATDMAEN); - imx_uart_writel(sport, ucr1, UCR1); - -- imx_uart_setup_ufcr(sport, TXTL_DEFAULT, RXTL_DEFAULT); -+ imx_uart_setup_ufcr(sport, TXTL_DEFAULT, sport->rxtl); - - sport->dma_is_enabled = 0; - } -@@ -1474,7 +1476,12 @@ static int imx_uart_startup(struct uart_port *port) - return retval; - } - -- imx_uart_setup_ufcr(sport, TXTL_DEFAULT, RXTL_DEFAULT); -+ if (uart_console(&sport->port)) -+ sport->rxtl = RXTL_CONSOLE_DEFAULT; -+ else -+ sport->rxtl = RXTL_DEFAULT; -+ -+ imx_uart_setup_ufcr(sport, TXTL_DEFAULT, sport->rxtl); - - /* disable the DREN bit (Data Ready interrupt enable) before - * requesting IRQs -@@ -1887,7 +1894,7 @@ static int imx_uart_poll_init(struct uart_port *port) - if (retval) - clk_disable_unprepare(sport->clk_ipg); - -- imx_uart_setup_ufcr(sport, TXTL_DEFAULT, RXTL_DEFAULT); -+ imx_uart_setup_ufcr(sport, TXTL_DEFAULT, sport->rxtl); - - spin_lock_irqsave(&sport->port.lock, flags); - -@@ -1979,7 +1986,7 @@ static int imx_uart_rs485_config(struct uart_port *port, struct ktermios *termio - /* If the receiver trigger is 0, set it to a default value */ - ufcr = imx_uart_readl(sport, UFCR); - if ((ufcr & UFCR_RXTL_MASK) == 0) -- imx_uart_setup_ufcr(sport, TXTL_DEFAULT, RXTL_DEFAULT); -+ imx_uart_setup_ufcr(sport, TXTL_DEFAULT, sport->rxtl); - imx_uart_start_rx(port); - } - -@@ -2164,7 +2171,7 @@ imx_uart_console_setup(struct console *co, char *options) - else - imx_uart_console_get_options(sport, &baud, &parity, &bits); - -- imx_uart_setup_ufcr(sport, TXTL_DEFAULT, RXTL_DEFAULT); -+ imx_uart_setup_ufcr(sport, TXTL_DEFAULT, sport->rxtl); - - retval = uart_set_options(&sport->port, co, baud, parity, bits, flow); - -diff --git a/drivers/tty/serial/uartlite.c b/drivers/tty/serial/uartlite.c -index b225a78f6175f3..9f39bafa7fa968 100644 ---- a/drivers/tty/serial/uartlite.c -+++ b/drivers/tty/serial/uartlite.c -@@ -872,16 +872,6 @@ static int ulite_probe(struct platform_device *pdev) - pm_runtime_set_active(&pdev->dev); - pm_runtime_enable(&pdev->dev); - -- if (!ulite_uart_driver.state) { -- dev_dbg(&pdev->dev, "uartlite: calling uart_register_driver()\n"); -- ret = uart_register_driver(&ulite_uart_driver); -- if (ret < 0) { -- dev_err(&pdev->dev, "Failed to register driver\n"); -- clk_disable_unprepare(pdata->clk); -- return ret; -- } -- } -- - ret = ulite_assign(&pdev->dev, id, res->start, irq, pdata); - - pm_runtime_mark_last_busy(&pdev->dev); -@@ -922,16 +912,25 @@ static struct platform_driver ulite_platform_driver = { - - static int __init ulite_init(void) - { -+ int ret; -+ -+ pr_debug("uartlite: calling uart_register_driver()\n"); -+ ret = uart_register_driver(&ulite_uart_driver); -+ if (ret) -+ return ret; - - pr_debug("uartlite: calling platform_driver_register()\n"); -- return platform_driver_register(&ulite_platform_driver); -+ ret = platform_driver_register(&ulite_platform_driver); -+ if (ret) -+ uart_unregister_driver(&ulite_uart_driver); -+ -+ return ret; - } - - static void __exit ulite_exit(void) - { - platform_driver_unregister(&ulite_platform_driver); -- if (ulite_uart_driver.state) -- uart_unregister_driver(&ulite_uart_driver); -+ uart_unregister_driver(&ulite_uart_driver); - } - - module_init(ulite_init); -diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c -index 6bd1a7785e888c..c5ec7306aa7130 100644 ---- a/drivers/tty/vt/vt.c -+++ b/drivers/tty/vt/vt.c -@@ -962,7 +962,7 @@ void redraw_screen(struct vc_data *vc, int is_switch) - } - - if (redraw) { -- int update; -+ bool update; - int old_was_color = vc->vc_can_do_color; - - set_origin(vc); -@@ -999,7 +999,7 @@ int vc_cons_allocated(unsigned int i) - return (i < MAX_NR_CONSOLES && vc_cons[i].d); - } - --static void visual_init(struct vc_data *vc, int num, int init) -+static void visual_init(struct vc_data *vc, int num, bool init) - { - /* ++Geert: vc->vc_sw->con_init determines console size */ - if (vc->vc_sw) -@@ -1083,7 +1083,7 @@ int vc_allocate(unsigned int currcons) /* return 0 on success */ - vc->port.ops = &vc_port_ops; - INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK); - -- visual_init(vc, currcons, 1); -+ visual_init(vc, currcons, true); - - if (!*vc->uni_pagedict_loc) - con_set_default_unimap(vc); -@@ -1582,7 +1582,7 @@ static void csi_X(struct vc_data *vc, unsigned int vpar) - vc_uniscr_clear_line(vc, vc->state.x, count); - scr_memsetw((unsigned short *)vc->vc_pos, vc->vc_video_erase_char, 2 * count); - if (con_should_update(vc)) -- vc->vc_sw->con_clear(vc, vc->state.y, vc->state.x, 1, count); -+ vc->vc_sw->con_clear(vc, vc->state.y, vc->state.x, count); - vc->vc_need_wrap = 0; - } - -@@ -3474,7 +3474,7 @@ static int __init con_init(void) - vc_cons[currcons].d = vc = kzalloc(sizeof(struct vc_data), GFP_NOWAIT); - INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK); - tty_port_init(&vc->port); -- visual_init(vc, currcons, 1); -+ visual_init(vc, currcons, true); - /* Assuming vc->vc_{cols,rows,screenbuf_size} are sane here. */ - vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_NOWAIT); - vc_init(vc, currcons || !vc->vc_sw->con_save_screen); -@@ -3642,7 +3642,7 @@ static int do_bind_con_driver(const struct consw *csw, int first, int last, - old_was_color = vc->vc_can_do_color; - vc->vc_sw->con_deinit(vc); - vc->vc_origin = (unsigned long)vc->vc_screenbuf; -- visual_init(vc, i, 0); -+ visual_init(vc, i, false); - set_origin(vc); - update_attr(vc); - -diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c -index 9dabc03675b00a..412931cf240f64 100644 ---- a/drivers/ufs/core/ufshcd.c -+++ b/drivers/ufs/core/ufshcd.c -@@ -1284,6 +1284,7 @@ static int ufshcd_clock_scaling_prepare(struct ufs_hba *hba, u64 timeout_us) - * make sure that there are no outstanding requests when - * clock scaling is in progress - */ -+ mutex_lock(&hba->host->scan_mutex); - blk_mq_quiesce_tagset(&hba->host->tag_set); - mutex_lock(&hba->wb_mutex); - down_write(&hba->clk_scaling_lock); -@@ -1294,6 +1295,7 @@ static int ufshcd_clock_scaling_prepare(struct ufs_hba *hba, u64 timeout_us) - up_write(&hba->clk_scaling_lock); - mutex_unlock(&hba->wb_mutex); - blk_mq_unquiesce_tagset(&hba->host->tag_set); -+ mutex_unlock(&hba->host->scan_mutex); - goto out; - } - -@@ -1315,6 +1317,7 @@ static void ufshcd_clock_scaling_unprepare(struct ufs_hba *hba, int err, bool sc - mutex_unlock(&hba->wb_mutex); - - blk_mq_unquiesce_tagset(&hba->host->tag_set); -+ mutex_unlock(&hba->host->scan_mutex); - ufshcd_release(hba); - } - -diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c -index 2804a4f749750a..17c1f85f2b7ba2 100644 ---- a/drivers/uio/uio_hv_generic.c -+++ b/drivers/uio/uio_hv_generic.c -@@ -249,6 +249,7 @@ hv_uio_probe(struct hv_device *dev, - struct hv_uio_private_data *pdata; - void *ring_buffer; - int ret; -+ size_t ring_size = hv_dev_ring_size(channel); - - /* Communicating with host has to be via shared memory not hypercall */ - if (!channel->offermsg.monitor_allocated) { -@@ -256,12 +257,17 @@ hv_uio_probe(struct hv_device *dev, - return -ENOTSUPP; - } - -+ if (!ring_size) -+ ring_size = HV_RING_SIZE * PAGE_SIZE; -+ -+ /* Adjust ring size if necessary to have it page aligned */ -+ ring_size = VMBUS_RING_SIZE(ring_size); -+ - pdata = devm_kzalloc(&dev->device, sizeof(*pdata), GFP_KERNEL); - if (!pdata) - return -ENOMEM; - -- ret = vmbus_alloc_ring(channel, HV_RING_SIZE * PAGE_SIZE, -- HV_RING_SIZE * PAGE_SIZE); -+ ret = vmbus_alloc_ring(channel, ring_size, ring_size); - if (ret) - return ret; - -diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c -index 559c121f092300..600ad9412c146b 100644 ---- a/drivers/usb/class/cdc-wdm.c -+++ b/drivers/usb/class/cdc-wdm.c -@@ -92,7 +92,6 @@ struct wdm_device { - u16 wMaxCommand; - u16 wMaxPacketSize; - __le16 inum; -- int reslength; - int length; - int read; - int count; -@@ -214,6 +213,11 @@ static void wdm_in_callback(struct urb *urb) - if (desc->rerr == 0 && status != -EPIPE) - desc->rerr = status; - -+ if (length == 0) { -+ dev_dbg(&desc->intf->dev, "received ZLP\n"); -+ goto skip_zlp; -+ } -+ - if (length + desc->length > desc->wMaxCommand) { - /* The buffer would overflow */ - set_bit(WDM_OVERFLOW, &desc->flags); -@@ -222,18 +226,18 @@ static void wdm_in_callback(struct urb *urb) - if (!test_bit(WDM_OVERFLOW, &desc->flags)) { - memmove(desc->ubuf + desc->length, desc->inbuf, length); - desc->length += length; -- desc->reslength = length; - } - } - skip_error: - - if (desc->rerr) { - /* -- * Since there was an error, userspace may decide to not read -- * any data after poll'ing. -+ * If there was a ZLP or an error, userspace may decide to not -+ * read any data after poll'ing. - * We should respond to further attempts from the device to send - * data, so that we can get unstuck. - */ -+skip_zlp: - schedule_work(&desc->service_outs_intr); - } else { - set_bit(WDM_READ, &desc->flags); -@@ -585,15 +589,6 @@ static ssize_t wdm_read - goto retry; - } - -- if (!desc->reslength) { /* zero length read */ -- dev_dbg(&desc->intf->dev, "zero length - clearing WDM_READ\n"); -- clear_bit(WDM_READ, &desc->flags); -- rv = service_outstanding_interrupt(desc); -- spin_unlock_irq(&desc->iuspin); -- if (rv < 0) -- goto err; -- goto retry; -- } - cntr = desc->length; - spin_unlock_irq(&desc->iuspin); - } -@@ -1016,7 +1011,7 @@ static void service_interrupt_work(struct work_struct *work) - - spin_lock_irq(&desc->iuspin); - service_outstanding_interrupt(desc); -- if (!desc->resp_count) { -+ if (!desc->resp_count && (desc->length || desc->rerr)) { - set_bit(WDM_READ, &desc->flags); - wake_up(&desc->wait); - } -diff --git a/drivers/usb/common/usb-conn-gpio.c b/drivers/usb/common/usb-conn-gpio.c -index 501e8bc9738eba..1096a884c8d705 100644 ---- a/drivers/usb/common/usb-conn-gpio.c -+++ b/drivers/usb/common/usb-conn-gpio.c -@@ -20,6 +20,9 @@ - #include - #include - #include -+#include -+ -+static DEFINE_IDA(usb_conn_ida); - - #define USB_GPIO_DEB_MS 20 /* ms */ - #define USB_GPIO_DEB_US ((USB_GPIO_DEB_MS) * 1000) /* us */ -@@ -29,6 +32,7 @@ - - struct usb_conn_info { - struct device *dev; -+ int conn_id; /* store the IDA-allocated ID */ - struct usb_role_switch *role_sw; - enum usb_role last_role; - struct regulator *vbus; -@@ -160,7 +164,17 @@ static int usb_conn_psy_register(struct usb_conn_info *info) - .of_node = dev->of_node, - }; - -- desc->name = "usb-charger"; -+ info->conn_id = ida_alloc(&usb_conn_ida, GFP_KERNEL); -+ if (info->conn_id < 0) -+ return info->conn_id; -+ -+ desc->name = devm_kasprintf(dev, GFP_KERNEL, "usb-charger-%d", -+ info->conn_id); -+ if (!desc->name) { -+ ida_free(&usb_conn_ida, info->conn_id); -+ return -ENOMEM; -+ } -+ - desc->properties = usb_charger_properties; - desc->num_properties = ARRAY_SIZE(usb_charger_properties); - desc->get_property = usb_charger_get_property; -@@ -168,8 +182,10 @@ static int usb_conn_psy_register(struct usb_conn_info *info) - cfg.drv_data = info; - - info->charger = devm_power_supply_register(dev, desc, &cfg); -- if (IS_ERR(info->charger)) -- dev_err(dev, "Unable to register charger\n"); -+ if (IS_ERR(info->charger)) { -+ dev_err(dev, "Unable to register charger %d\n", info->conn_id); -+ ida_free(&usb_conn_ida, info->conn_id); -+ } - - return PTR_ERR_OR_ZERO(info->charger); - } -@@ -277,6 +293,9 @@ static void usb_conn_remove(struct platform_device *pdev) - - cancel_delayed_work_sync(&info->dw_det); - -+ if (info->charger) -+ ida_free(&usb_conn_ida, info->conn_id); -+ - if (info->last_role == USB_ROLE_HOST && info->vbus) - regulator_disable(info->vbus); - -diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c -index 2a938cf47ccd62..da6d5e5f79e7a5 100644 ---- a/drivers/usb/core/usb.c -+++ b/drivers/usb/core/usb.c -@@ -695,15 +695,16 @@ struct usb_device *usb_alloc_dev(struct usb_device *parent, - device_set_of_node_from_dev(&dev->dev, bus->sysdev); - dev_set_name(&dev->dev, "usb%d", bus->busnum); - } else { -+ int n; -+ - /* match any labeling on the hubs; it's one-based */ - if (parent->devpath[0] == '0') { -- snprintf(dev->devpath, sizeof dev->devpath, -- "%d", port1); -+ n = snprintf(dev->devpath, sizeof(dev->devpath), "%d", port1); - /* Root ports are not counted in route string */ - dev->route = 0; - } else { -- snprintf(dev->devpath, sizeof dev->devpath, -- "%s.%d", parent->devpath, port1); -+ n = snprintf(dev->devpath, sizeof(dev->devpath), "%s.%d", -+ parent->devpath, port1); - /* Route string assumes hubs have less than 16 ports */ - if (port1 < 15) - dev->route = parent->route + -@@ -712,6 +713,11 @@ struct usb_device *usb_alloc_dev(struct usb_device *parent, - dev->route = parent->route + - (15 << ((parent->level - 1)*4)); - } -+ if (n >= sizeof(dev->devpath)) { -+ usb_put_hcd(bus_to_hcd(bus)); -+ usb_put_dev(dev); -+ return NULL; -+ } - - dev->dev.parent = &parent->dev; - dev_set_name(&dev->dev, "%d-%s", bus->busnum, dev->devpath); -diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c -index ce20c06a902531..c0db3c52831a2d 100644 ---- a/drivers/usb/dwc2/gadget.c -+++ b/drivers/usb/dwc2/gadget.c -@@ -4601,6 +4601,12 @@ static int dwc2_hsotg_udc_stop(struct usb_gadget *gadget) - if (!hsotg) - return -ENODEV; - -+ /* Exit clock gating when driver is stopped. */ -+ if (hsotg->params.power_down == DWC2_POWER_DOWN_PARAM_NONE && -+ hsotg->bus_suspended && !hsotg->params.no_clock_gating) { -+ dwc2_gadget_exit_clock_gating(hsotg, 0); -+ } -+ - /* all endpoints should be shutdown */ - for (ep = 1; ep < hsotg->num_of_eps; ep++) { - if (hsotg->eps_in[ep]) -diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c -index a7cd0a06879e61..5d0d8949539539 100644 ---- a/drivers/usb/gadget/function/f_tcm.c -+++ b/drivers/usb/gadget/function/f_tcm.c -@@ -1297,14 +1297,14 @@ static struct se_portal_group *usbg_make_tpg(struct se_wwn *wwn, - struct usbg_tport *tport = container_of(wwn, struct usbg_tport, - tport_wwn); - struct usbg_tpg *tpg; -- unsigned long tpgt; -+ u16 tpgt; - int ret; - struct f_tcm_opts *opts; - unsigned i; - - if (strstr(name, "tpgt_") != name) - return ERR_PTR(-EINVAL); -- if (kstrtoul(name + 5, 0, &tpgt) || tpgt > UINT_MAX) -+ if (kstrtou16(name + 5, 0, &tpgt)) - return ERR_PTR(-EINVAL); - ret = -ENODEV; - mutex_lock(&tpg_instances_lock); -diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c -index ccff838ab89e12..5f6fc5b79212ef 100644 ---- a/drivers/usb/typec/altmodes/displayport.c -+++ b/drivers/usb/typec/altmodes/displayport.c -@@ -323,6 +323,10 @@ static int dp_altmode_vdm(struct typec_altmode *alt, - break; - case CMDT_RSP_NAK: - switch (cmd) { -+ case DP_CMD_STATUS_UPDATE: -+ if (typec_altmode_exit(alt)) -+ dev_err(&dp->alt->dev, "Exit Mode Failed!\n"); -+ break; - case DP_CMD_CONFIGURE: - dp->data.conf = 0; - ret = dp_altmode_configured(dp); -diff --git a/drivers/usb/typec/mux.c b/drivers/usb/typec/mux.c -index 80dd91938d9606..a5b2a6f9c57950 100644 ---- a/drivers/usb/typec/mux.c -+++ b/drivers/usb/typec/mux.c -@@ -214,7 +214,7 @@ int typec_switch_set(struct typec_switch *sw, - sw_dev = sw->sw_devs[i]; - - ret = sw_dev->set(sw_dev, orientation); -- if (ret) -+ if (ret && ret != -EOPNOTSUPP) - return ret; - } - -@@ -378,7 +378,7 @@ int typec_mux_set(struct typec_mux *mux, struct typec_mux_state *state) - mux_dev = mux->mux_devs[i]; - - ret = mux_dev->set(mux_dev, state); -- if (ret) -+ if (ret && ret != -EOPNOTSUPP) - return ret; - } - -diff --git a/drivers/video/console/dummycon.c b/drivers/video/console/dummycon.c -index f1711b2f9ff057..d99e1b3e4e5c1a 100644 ---- a/drivers/video/console/dummycon.c -+++ b/drivers/video/console/dummycon.c -@@ -82,6 +82,15 @@ static int dummycon_blank(struct vc_data *vc, int blank, int mode_switch) - /* Redraw, so that we get putc(s) for output done while blanked */ - return 1; - } -+ -+static bool dummycon_switch(struct vc_data *vc) -+{ -+ /* -+ * Redraw, so that we get putc(s) for output done while switched -+ * away. Informs deferred consoles to take over the display. -+ */ -+ return true; -+} - #else - static void dummycon_putc(struct vc_data *vc, int c, int ypos, int xpos) { } - static void dummycon_putcs(struct vc_data *vc, const unsigned short *s, -@@ -90,6 +99,10 @@ static int dummycon_blank(struct vc_data *vc, int blank, int mode_switch) - { - return 0; - } -+static bool dummycon_switch(struct vc_data *vc) -+{ -+ return false; -+} - #endif - - static const char *dummycon_startup(void) -@@ -97,7 +110,7 @@ static const char *dummycon_startup(void) - return "dummy device"; - } - --static void dummycon_init(struct vc_data *vc, int init) -+static void dummycon_init(struct vc_data *vc, bool init) - { - vc->vc_can_do_color = 1; - if (init) { -@@ -108,8 +121,8 @@ static void dummycon_init(struct vc_data *vc, int init) - } - - static void dummycon_deinit(struct vc_data *vc) { } --static void dummycon_clear(struct vc_data *vc, int sy, int sx, int height, -- int width) { } -+static void dummycon_clear(struct vc_data *vc, unsigned int sy, unsigned int sx, -+ unsigned int width) { } - static void dummycon_cursor(struct vc_data *vc, int mode) { } - - static bool dummycon_scroll(struct vc_data *vc, unsigned int top, -@@ -119,11 +132,6 @@ static bool dummycon_scroll(struct vc_data *vc, unsigned int top, - return false; - } - --static int dummycon_switch(struct vc_data *vc) --{ -- return 0; --} -- - /* - * The console `switch' structure for the dummy console - * -diff --git a/drivers/video/console/mdacon.c b/drivers/video/console/mdacon.c -index ef29b321967f07..26b41a8f36c870 100644 ---- a/drivers/video/console/mdacon.c -+++ b/drivers/video/console/mdacon.c -@@ -352,7 +352,7 @@ static const char *mdacon_startup(void) - return "MDA-2"; - } - --static void mdacon_init(struct vc_data *c, int init) -+static void mdacon_init(struct vc_data *c, bool init) - { - c->vc_complement_mask = 0x0800; /* reverse video */ - c->vc_display_fg = &mda_display_fg; -@@ -442,26 +442,21 @@ static void mdacon_putcs(struct vc_data *c, const unsigned short *s, - } - } - --static void mdacon_clear(struct vc_data *c, int y, int x, -- int height, int width) -+static void mdacon_clear(struct vc_data *c, unsigned int y, unsigned int x, -+ unsigned int width) - { - u16 *dest = mda_addr(x, y); - u16 eattr = mda_convert_attr(c->vc_video_erase_char); - -- if (width <= 0 || height <= 0) -+ if (width <= 0) - return; - -- if (x==0 && width==mda_num_columns) { -- scr_memsetw(dest, eattr, height*width*2); -- } else { -- for (; height > 0; height--, dest+=mda_num_columns) -- scr_memsetw(dest, eattr, width*2); -- } -+ scr_memsetw(dest, eattr, width * 2); - } -- --static int mdacon_switch(struct vc_data *c) -+ -+static bool mdacon_switch(struct vc_data *c) - { -- return 1; /* redrawing needed */ -+ return true; /* redrawing needed */ - } - - static int mdacon_blank(struct vc_data *c, int blank, int mode_switch) -diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c -index e8e4f82cd4a1b8..63d96c4bbdccd3 100644 ---- a/drivers/video/console/newport_con.c -+++ b/drivers/video/console/newport_con.c -@@ -324,7 +324,7 @@ static const char *newport_startup(void) - return NULL; - } - --static void newport_init(struct vc_data *vc, int init) -+static void newport_init(struct vc_data *vc, bool init) - { - int cols, rows; - -@@ -346,12 +346,12 @@ static void newport_deinit(struct vc_data *c) - } - } - --static void newport_clear(struct vc_data *vc, int sy, int sx, int height, -- int width) -+static void newport_clear(struct vc_data *vc, unsigned int sy, unsigned int sx, -+ unsigned int width) - { - int xend = ((sx + width) << 3) - 1; - int ystart = ((sy << 4) + topscan) & 0x3ff; -- int yend = (((sy + height) << 4) + topscan - 1) & 0x3ff; -+ int yend = (((sy + 1) << 4) + topscan - 1) & 0x3ff; - - if (logo_active) - return; -@@ -462,7 +462,7 @@ static void newport_cursor(struct vc_data *vc, int mode) - } - } - --static int newport_switch(struct vc_data *vc) -+static bool newport_switch(struct vc_data *vc) - { - static int logo_drawn = 0; - -@@ -476,7 +476,7 @@ static int newport_switch(struct vc_data *vc) - } - } - -- return 1; -+ return true; - } - - static int newport_blank(struct vc_data *c, int blank, int mode_switch) -diff --git a/drivers/video/console/sticon.c b/drivers/video/console/sticon.c -index 992a4fa431aaa9..87900600eff11f 100644 ---- a/drivers/video/console/sticon.c -+++ b/drivers/video/console/sticon.c -@@ -273,7 +273,7 @@ static int sticon_font_set(struct vc_data *vc, struct console_font *font, - return sticon_set_font(vc, font, vpitch); - } - --static void sticon_init(struct vc_data *c, int init) -+static void sticon_init(struct vc_data *c, bool init) - { - struct sti_struct *sti = sticon_sti; - int vc_cols, vc_rows; -@@ -300,19 +300,19 @@ static void sticon_deinit(struct vc_data *c) - sticon_set_def_font(i); - } - --static void sticon_clear(struct vc_data *conp, int sy, int sx, int height, -- int width) -+static void sticon_clear(struct vc_data *conp, unsigned int sy, unsigned int sx, -+ unsigned int width) - { -- if (!height || !width) -+ if (!width) - return; - -- sti_clear(sticon_sti, sy, sx, height, width, -+ sti_clear(sticon_sti, sy, sx, 1, width, - conp->vc_video_erase_char, font_data[conp->vc_num]); - } - --static int sticon_switch(struct vc_data *conp) -+static bool sticon_switch(struct vc_data *conp) - { -- return 1; /* needs refreshing */ -+ return true; /* needs refreshing */ - } - - static int sticon_blank(struct vc_data *c, int blank, int mode_switch) -diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c -index c9ec89649b0552..bbc362db40c586 100644 ---- a/drivers/video/console/vgacon.c -+++ b/drivers/video/console/vgacon.c -@@ -332,7 +332,7 @@ static const char *vgacon_startup(void) - return display_desc; - } - --static void vgacon_init(struct vc_data *c, int init) -+static void vgacon_init(struct vc_data *c, bool init) - { - struct uni_pagedict *p; - -@@ -349,7 +349,7 @@ static void vgacon_init(struct vc_data *c, int init) - c->vc_scan_lines = vga_scan_lines; - c->vc_font.height = c->vc_cell_height = vga_video_font_height; - -- /* set dimensions manually if init != 0 since vc_resize() will fail */ -+ /* set dimensions manually if init is true since vc_resize() will fail */ - if (init) { - c->vc_cols = vga_video_num_columns; - c->vc_rows = vga_video_num_lines; -@@ -585,7 +585,7 @@ static void vgacon_doresize(struct vc_data *c, - raw_spin_unlock_irqrestore(&vga_lock, flags); - } - --static int vgacon_switch(struct vc_data *c) -+static bool vgacon_switch(struct vc_data *c) - { - int x = c->vc_cols * VGA_FONTWIDTH; - int y = c->vc_rows * c->vc_cell_height; -@@ -614,7 +614,7 @@ static int vgacon_switch(struct vc_data *c) - vgacon_doresize(c, c->vc_cols, c->vc_rows); - } - -- return 0; /* Redrawing not needed */ -+ return false; /* Redrawing not needed */ - } - - static void vga_set_palette(struct vc_data *vc, const unsigned char *table) -@@ -1156,8 +1156,8 @@ static bool vgacon_scroll(struct vc_data *c, unsigned int t, unsigned int b, - * The console `switch' structure for the VGA based console - */ - --static void vgacon_clear(struct vc_data *vc, int sy, int sx, int height, -- int width) { } -+static void vgacon_clear(struct vc_data *vc, unsigned int sy, unsigned int sx, -+ unsigned int width) { } - static void vgacon_putc(struct vc_data *vc, int c, int ypos, int xpos) { } - static void vgacon_putcs(struct vc_data *vc, const unsigned short *s, - int count, int ypos, int xpos) { } -diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c -index 75996ef9992e41..9d095fe03e18ba 100644 ---- a/drivers/video/fbdev/core/fbcon.c -+++ b/drivers/video/fbdev/core/fbcon.c -@@ -993,7 +993,7 @@ static const char *fbcon_startup(void) - return display_desc; - } - --static void fbcon_init(struct vc_data *vc, int init) -+static void fbcon_init(struct vc_data *vc, bool init) - { - struct fb_info *info; - struct fbcon_ops *ops; -@@ -1240,8 +1240,8 @@ static void fbcon_deinit(struct vc_data *vc) - * restriction is simplicity & efficiency at the moment. - */ - --static void fbcon_clear(struct vc_data *vc, int sy, int sx, int height, -- int width) -+static void __fbcon_clear(struct vc_data *vc, unsigned int sy, unsigned int sx, -+ unsigned int height, unsigned int width) - { - struct fb_info *info = fbcon_info_from_console(vc->vc_num); - struct fbcon_ops *ops = info->fbcon_par; -@@ -1280,6 +1280,12 @@ static void fbcon_clear(struct vc_data *vc, int sy, int sx, int height, - ops->clear(vc, info, real_y(p, sy), sx, height, width, fg, bg); - } - -+static void fbcon_clear(struct vc_data *vc, unsigned int sy, unsigned int sx, -+ unsigned int width) -+{ -+ __fbcon_clear(vc, sy, sx, 1, width); -+} -+ - static void fbcon_putcs(struct vc_data *vc, const unsigned short *s, - int count, int ypos, int xpos) - { -@@ -1767,7 +1773,7 @@ static bool fbcon_scroll(struct vc_data *vc, unsigned int t, unsigned int b, - case SCROLL_MOVE: - fbcon_redraw_blit(vc, info, p, t, b - t - count, - count); -- fbcon_clear(vc, b - count, 0, count, vc->vc_cols); -+ __fbcon_clear(vc, b - count, 0, count, vc->vc_cols); - scr_memsetw((unsigned short *) (vc->vc_origin + - vc->vc_size_row * - (b - count)), -@@ -1790,7 +1796,7 @@ static bool fbcon_scroll(struct vc_data *vc, unsigned int t, unsigned int b, - b - t - count, vc->vc_cols); - else - goto redraw_up; -- fbcon_clear(vc, b - count, 0, count, vc->vc_cols); -+ __fbcon_clear(vc, b - count, 0, count, vc->vc_cols); - break; - - case SCROLL_PAN_REDRAW: -@@ -1808,7 +1814,7 @@ static bool fbcon_scroll(struct vc_data *vc, unsigned int t, unsigned int b, - vc->vc_rows - b, b); - } else - fbcon_redraw_move(vc, p, t + count, b - t - count, t); -- fbcon_clear(vc, b - count, 0, count, vc->vc_cols); -+ __fbcon_clear(vc, b - count, 0, count, vc->vc_cols); - break; - - case SCROLL_PAN_MOVE: -@@ -1831,14 +1837,14 @@ static bool fbcon_scroll(struct vc_data *vc, unsigned int t, unsigned int b, - b - t - count, vc->vc_cols); - else - goto redraw_up; -- fbcon_clear(vc, b - count, 0, count, vc->vc_cols); -+ __fbcon_clear(vc, b - count, 0, count, vc->vc_cols); - break; - - case SCROLL_REDRAW: - redraw_up: - fbcon_redraw(vc, t, b - t - count, - count * vc->vc_cols); -- fbcon_clear(vc, b - count, 0, count, vc->vc_cols); -+ __fbcon_clear(vc, b - count, 0, count, vc->vc_cols); - scr_memsetw((unsigned short *) (vc->vc_origin + - vc->vc_size_row * - (b - count)), -@@ -1855,7 +1861,7 @@ static bool fbcon_scroll(struct vc_data *vc, unsigned int t, unsigned int b, - case SCROLL_MOVE: - fbcon_redraw_blit(vc, info, p, b - 1, b - t - count, - -count); -- fbcon_clear(vc, t, 0, count, vc->vc_cols); -+ __fbcon_clear(vc, t, 0, count, vc->vc_cols); - scr_memsetw((unsigned short *) (vc->vc_origin + - vc->vc_size_row * - t), -@@ -1878,7 +1884,7 @@ static bool fbcon_scroll(struct vc_data *vc, unsigned int t, unsigned int b, - b - t - count, vc->vc_cols); - else - goto redraw_down; -- fbcon_clear(vc, t, 0, count, vc->vc_cols); -+ __fbcon_clear(vc, t, 0, count, vc->vc_cols); - break; - - case SCROLL_PAN_MOVE: -@@ -1900,7 +1906,7 @@ static bool fbcon_scroll(struct vc_data *vc, unsigned int t, unsigned int b, - b - t - count, vc->vc_cols); - else - goto redraw_down; -- fbcon_clear(vc, t, 0, count, vc->vc_cols); -+ __fbcon_clear(vc, t, 0, count, vc->vc_cols); - break; - - case SCROLL_PAN_REDRAW: -@@ -1917,14 +1923,14 @@ static bool fbcon_scroll(struct vc_data *vc, unsigned int t, unsigned int b, - fbcon_redraw_move(vc, p, count, t, 0); - } else - fbcon_redraw_move(vc, p, t, b - t - count, t + count); -- fbcon_clear(vc, t, 0, count, vc->vc_cols); -+ __fbcon_clear(vc, t, 0, count, vc->vc_cols); - break; - - case SCROLL_REDRAW: - redraw_down: - fbcon_redraw(vc, b - 1, b - t - count, - -count * vc->vc_cols); -- fbcon_clear(vc, t, 0, count, vc->vc_cols); -+ __fbcon_clear(vc, t, 0, count, vc->vc_cols); - scr_memsetw((unsigned short *) (vc->vc_origin + - vc->vc_size_row * - t), -@@ -2066,7 +2072,7 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width, - return 0; - } - --static int fbcon_switch(struct vc_data *vc) -+static bool fbcon_switch(struct vc_data *vc) - { - struct fb_info *info, *old_info = NULL; - struct fbcon_ops *ops; -@@ -2188,9 +2194,9 @@ static int fbcon_switch(struct vc_data *vc) - vc->vc_origin + vc->vc_size_row * vc->vc_top, - vc->vc_size_row * (vc->vc_bottom - - vc->vc_top) / 2); -- return 0; -+ return false; - } -- return 1; -+ return true; - } - - static void fbcon_generic_blank(struct vc_data *vc, struct fb_info *info, -@@ -2203,7 +2209,7 @@ static void fbcon_generic_blank(struct vc_data *vc, struct fb_info *info, - - oldc = vc->vc_video_erase_char; - vc->vc_video_erase_char &= charmask; -- fbcon_clear(vc, 0, 0, vc->vc_rows, vc->vc_cols); -+ __fbcon_clear(vc, 0, 0, vc->vc_rows, vc->vc_cols); - vc->vc_video_erase_char = oldc; - } - } -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index 34a30d61b470c3..bb5f7911d473cb 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -2148,8 +2148,7 @@ static int load_global_roots_objectid(struct btrfs_root *tree_root, - found = true; - root = read_tree_root_path(tree_root, path, &key); - if (IS_ERR(root)) { -- if (!btrfs_test_opt(fs_info, IGNOREBADROOTS)) -- ret = PTR_ERR(root); -+ ret = PTR_ERR(root); - break; - } - set_bit(BTRFS_ROOT_TRACK_DIRTY, &root->state); -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 48d2579236729d..af1f22b3cff7dc 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -8754,6 +8754,7 @@ static int btrfs_rename_exchange(struct inode *old_dir, - int ret; - int ret2; - bool need_abort = false; -+ bool logs_pinned = false; - struct fscrypt_name old_fname, new_fname; - struct fscrypt_str *old_name, *new_name; - -@@ -8877,6 +8878,31 @@ static int btrfs_rename_exchange(struct inode *old_dir, - inode_inc_iversion(new_inode); - simple_rename_timestamp(old_dir, old_dentry, new_dir, new_dentry); - -+ if (old_ino != BTRFS_FIRST_FREE_OBJECTID && -+ new_ino != BTRFS_FIRST_FREE_OBJECTID) { -+ /* -+ * If we are renaming in the same directory (and it's not for -+ * root entries) pin the log early to prevent any concurrent -+ * task from logging the directory after we removed the old -+ * entries and before we add the new entries, otherwise that -+ * task can sync a log without any entry for the inodes we are -+ * renaming and therefore replaying that log, if a power failure -+ * happens after syncing the log, would result in deleting the -+ * inodes. -+ * -+ * If the rename affects two different directories, we want to -+ * make sure the that there's no log commit that contains -+ * updates for only one of the directories but not for the -+ * other. -+ * -+ * If we are renaming an entry for a root, we don't care about -+ * log updates since we called btrfs_set_log_full_commit(). -+ */ -+ btrfs_pin_log_trans(root); -+ btrfs_pin_log_trans(dest); -+ logs_pinned = true; -+ } -+ - if (old_dentry->d_parent != new_dentry->d_parent) { - btrfs_record_unlink_dir(trans, BTRFS_I(old_dir), - BTRFS_I(old_inode), true); -@@ -8934,30 +8960,23 @@ static int btrfs_rename_exchange(struct inode *old_dir, - BTRFS_I(new_inode)->dir_index = new_idx; - - /* -- * Now pin the logs of the roots. We do it to ensure that no other task -- * can sync the logs while we are in progress with the rename, because -- * that could result in an inconsistency in case any of the inodes that -- * are part of this rename operation were logged before. -+ * Do the log updates for all inodes. -+ * -+ * If either entry is for a root we don't need to update the logs since -+ * we've called btrfs_set_log_full_commit() before. - */ -- if (old_ino != BTRFS_FIRST_FREE_OBJECTID) -- btrfs_pin_log_trans(root); -- if (new_ino != BTRFS_FIRST_FREE_OBJECTID) -- btrfs_pin_log_trans(dest); -- -- /* Do the log updates for all inodes. */ -- if (old_ino != BTRFS_FIRST_FREE_OBJECTID) -+ if (logs_pinned) { - btrfs_log_new_name(trans, old_dentry, BTRFS_I(old_dir), - old_rename_ctx.index, new_dentry->d_parent); -- if (new_ino != BTRFS_FIRST_FREE_OBJECTID) - btrfs_log_new_name(trans, new_dentry, BTRFS_I(new_dir), - new_rename_ctx.index, old_dentry->d_parent); -+ } - -- /* Now unpin the logs. */ -- if (old_ino != BTRFS_FIRST_FREE_OBJECTID) -+out_fail: -+ if (logs_pinned) { - btrfs_end_log_trans(root); -- if (new_ino != BTRFS_FIRST_FREE_OBJECTID) - btrfs_end_log_trans(dest); --out_fail: -+ } - ret2 = btrfs_end_transaction(trans); - ret = ret ? ret : ret2; - out_notrans: -@@ -9007,6 +9026,7 @@ static int btrfs_rename(struct mnt_idmap *idmap, - int ret2; - u64 old_ino = btrfs_ino(BTRFS_I(old_inode)); - struct fscrypt_name old_fname, new_fname; -+ bool logs_pinned = false; - - if (btrfs_ino(BTRFS_I(new_dir)) == BTRFS_EMPTY_SUBVOL_DIR_OBJECTID) - return -EPERM; -@@ -9141,6 +9161,29 @@ static int btrfs_rename(struct mnt_idmap *idmap, - inode_inc_iversion(old_inode); - simple_rename_timestamp(old_dir, old_dentry, new_dir, new_dentry); - -+ if (old_ino != BTRFS_FIRST_FREE_OBJECTID) { -+ /* -+ * If we are renaming in the same directory (and it's not a -+ * root entry) pin the log to prevent any concurrent task from -+ * logging the directory after we removed the old entry and -+ * before we add the new entry, otherwise that task can sync -+ * a log without any entry for the inode we are renaming and -+ * therefore replaying that log, if a power failure happens -+ * after syncing the log, would result in deleting the inode. -+ * -+ * If the rename affects two different directories, we want to -+ * make sure the that there's no log commit that contains -+ * updates for only one of the directories but not for the -+ * other. -+ * -+ * If we are renaming an entry for a root, we don't care about -+ * log updates since we called btrfs_set_log_full_commit(). -+ */ -+ btrfs_pin_log_trans(root); -+ btrfs_pin_log_trans(dest); -+ logs_pinned = true; -+ } -+ - if (old_dentry->d_parent != new_dentry->d_parent) - btrfs_record_unlink_dir(trans, BTRFS_I(old_dir), - BTRFS_I(old_inode), true); -@@ -9189,7 +9232,7 @@ static int btrfs_rename(struct mnt_idmap *idmap, - if (old_inode->i_nlink == 1) - BTRFS_I(old_inode)->dir_index = index; - -- if (old_ino != BTRFS_FIRST_FREE_OBJECTID) -+ if (logs_pinned) - btrfs_log_new_name(trans, old_dentry, BTRFS_I(old_dir), - rename_ctx.index, new_dentry->d_parent); - -@@ -9205,6 +9248,10 @@ static int btrfs_rename(struct mnt_idmap *idmap, - } - } - out_fail: -+ if (logs_pinned) { -+ btrfs_end_log_trans(root); -+ btrfs_end_log_trans(dest); -+ } - ret2 = btrfs_end_transaction(trans); - ret = ret ? ret : ret2; - out_notrans: -diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c -index b9a0b26d08e1c4..1eb543602ff12f 100644 ---- a/fs/btrfs/volumes.c -+++ b/fs/btrfs/volumes.c -@@ -3174,6 +3174,12 @@ int btrfs_remove_chunk(struct btrfs_trans_handle *trans, u64 chunk_offset) - device->bytes_used - dev_extent_len); - atomic64_add(dev_extent_len, &fs_info->free_chunk_space); - btrfs_clear_space_info_full(fs_info); -+ -+ if (list_empty(&device->post_commit_list)) { -+ list_add_tail(&device->post_commit_list, -+ &trans->transaction->dev_update_list); -+ } -+ - mutex_unlock(&fs_info->chunk_mutex); - } - } -diff --git a/fs/ceph/file.c b/fs/ceph/file.c -index a03b11cf788721..e12657b4c3e042 100644 ---- a/fs/ceph/file.c -+++ b/fs/ceph/file.c -@@ -2513,7 +2513,7 @@ static int ceph_zero_objects(struct inode *inode, loff_t offset, loff_t length) - s32 stripe_unit = ci->i_layout.stripe_unit; - s32 stripe_count = ci->i_layout.stripe_count; - s32 object_size = ci->i_layout.object_size; -- u64 object_set_size = object_size * stripe_count; -+ u64 object_set_size = (u64) object_size * stripe_count; - u64 nearly, t; - - /* round offset up to next period boundary */ -diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c -index 702137eafaa675..b9913ab526fd1a 100644 ---- a/fs/f2fs/super.c -+++ b/fs/f2fs/super.c -@@ -1774,26 +1774,32 @@ static int f2fs_statfs_project(struct super_block *sb, - - limit = min_not_zero(dquot->dq_dqb.dqb_bsoftlimit, - dquot->dq_dqb.dqb_bhardlimit); -- if (limit) -- limit >>= sb->s_blocksize_bits; -+ limit >>= sb->s_blocksize_bits; -+ -+ if (limit) { -+ uint64_t remaining = 0; - -- if (limit && buf->f_blocks > limit) { - curblock = (dquot->dq_dqb.dqb_curspace + - dquot->dq_dqb.dqb_rsvspace) >> sb->s_blocksize_bits; -- buf->f_blocks = limit; -- buf->f_bfree = buf->f_bavail = -- (buf->f_blocks > curblock) ? -- (buf->f_blocks - curblock) : 0; -+ if (limit > curblock) -+ remaining = limit - curblock; -+ -+ buf->f_blocks = min(buf->f_blocks, limit); -+ buf->f_bfree = min(buf->f_bfree, remaining); -+ buf->f_bavail = min(buf->f_bavail, remaining); - } - - limit = min_not_zero(dquot->dq_dqb.dqb_isoftlimit, - dquot->dq_dqb.dqb_ihardlimit); - -- if (limit && buf->f_files > limit) { -- buf->f_files = limit; -- buf->f_ffree = -- (buf->f_files > dquot->dq_dqb.dqb_curinodes) ? -- (buf->f_files - dquot->dq_dqb.dqb_curinodes) : 0; -+ if (limit) { -+ uint64_t remaining = 0; -+ -+ if (limit > dquot->dq_dqb.dqb_curinodes) -+ remaining = limit - dquot->dq_dqb.dqb_curinodes; -+ -+ buf->f_files = min(buf->f_files, limit); -+ buf->f_ffree = min(buf->f_ffree, remaining); - } - - spin_unlock(&dquot->dq_dqb_lock); -diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c -index 82951a535d2d4d..0b84284ece98fa 100644 ---- a/fs/fuse/dir.c -+++ b/fs/fuse/dir.c -@@ -1860,6 +1860,7 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr, - int err; - bool trust_local_cmtime = is_wb; - bool fault_blocked = false; -+ u64 attr_version; - - if (!fc->default_permissions) - attr->ia_valid |= ATTR_FORCE; -@@ -1944,6 +1945,8 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr, - if (fc->handle_killpriv_v2 && !capable(CAP_FSETID)) - inarg.valid |= FATTR_KILL_SUIDGID; - } -+ -+ attr_version = fuse_get_attr_version(fm->fc); - fuse_setattr_fill(fc, &args, inode, &inarg, &outarg); - err = fuse_simple_request(fm, &args); - if (err) { -@@ -1969,6 +1972,14 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr, - /* FIXME: clear I_DIRTY_SYNC? */ - } - -+ if (fi->attr_version > attr_version) { -+ /* -+ * Apply attributes, for example for fsnotify_change(), but set -+ * attribute timeout to zero. -+ */ -+ outarg.attr_valid = outarg.attr_valid_nsec = 0; -+ } -+ - fuse_change_attributes_common(inode, &outarg.attr, NULL, - ATTR_TIMEOUT(&outarg), - fuse_get_cache_mask(inode)); -diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c -index 0e1019382cf519..35e063c9f3a42e 100644 ---- a/fs/jfs/jfs_dmap.c -+++ b/fs/jfs/jfs_dmap.c -@@ -178,45 +178,30 @@ int dbMount(struct inode *ipbmap) - dbmp_le = (struct dbmap_disk *) mp->data; - bmp->db_mapsize = le64_to_cpu(dbmp_le->dn_mapsize); - bmp->db_nfree = le64_to_cpu(dbmp_le->dn_nfree); -- - bmp->db_l2nbperpage = le32_to_cpu(dbmp_le->dn_l2nbperpage); -- if (bmp->db_l2nbperpage > L2PSIZE - L2MINBLOCKSIZE || -- bmp->db_l2nbperpage < 0) { -- err = -EINVAL; -- goto err_release_metapage; -- } -- - bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag); -- if (!bmp->db_numag || bmp->db_numag > MAXAG) { -- err = -EINVAL; -- goto err_release_metapage; -- } -- - bmp->db_maxlevel = le32_to_cpu(dbmp_le->dn_maxlevel); - bmp->db_maxag = le32_to_cpu(dbmp_le->dn_maxag); - bmp->db_agpref = le32_to_cpu(dbmp_le->dn_agpref); -- if (bmp->db_maxag >= MAXAG || bmp->db_maxag < 0 || -- bmp->db_agpref >= MAXAG || bmp->db_agpref < 0) { -- err = -EINVAL; -- goto err_release_metapage; -- } -- - bmp->db_aglevel = le32_to_cpu(dbmp_le->dn_aglevel); - bmp->db_agheight = le32_to_cpu(dbmp_le->dn_agheight); - bmp->db_agwidth = le32_to_cpu(dbmp_le->dn_agwidth); -- if (!bmp->db_agwidth) { -- err = -EINVAL; -- goto err_release_metapage; -- } - bmp->db_agstart = le32_to_cpu(dbmp_le->dn_agstart); - bmp->db_agl2size = le32_to_cpu(dbmp_le->dn_agl2size); -- if (bmp->db_agl2size > L2MAXL2SIZE - L2MAXAG || -- bmp->db_agl2size < 0) { -- err = -EINVAL; -- goto err_release_metapage; -- } - -- if (((bmp->db_mapsize - 1) >> bmp->db_agl2size) > MAXAG) { -+ if ((bmp->db_l2nbperpage > L2PSIZE - L2MINBLOCKSIZE) || -+ (bmp->db_l2nbperpage < 0) || -+ !bmp->db_numag || (bmp->db_numag > MAXAG) || -+ (bmp->db_maxag >= MAXAG) || (bmp->db_maxag < 0) || -+ (bmp->db_agpref >= MAXAG) || (bmp->db_agpref < 0) || -+ (bmp->db_agheight < 0) || (bmp->db_agheight > (L2LPERCTL >> 1)) || -+ (bmp->db_agwidth < 1) || (bmp->db_agwidth > (LPERCTL / MAXAG)) || -+ (bmp->db_agwidth > (1 << (L2LPERCTL - (bmp->db_agheight << 1)))) || -+ (bmp->db_agstart < 0) || -+ (bmp->db_agstart > (CTLTREESIZE - 1 - bmp->db_agwidth * (MAXAG - 1))) || -+ (bmp->db_agl2size > L2MAXL2SIZE - L2MAXAG) || -+ (bmp->db_agl2size < 0) || -+ ((bmp->db_mapsize - 1) >> bmp->db_agl2size) > MAXAG) { - err = -EINVAL; - goto err_release_metapage; - } -diff --git a/fs/namespace.c b/fs/namespace.c -index eab9185e228584..cebcb9fa2acc07 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -2364,14 +2364,14 @@ static int attach_recursive_mnt(struct mount *source_mnt, - hlist_for_each_entry_safe(child, n, &tree_list, mnt_hash) { - struct mount *q; - hlist_del_init(&child->mnt_hash); -- q = __lookup_mnt(&child->mnt_parent->mnt, -- child->mnt_mountpoint); -- if (q) -- mnt_change_mountpoint(child, smp, q); - /* Notice when we are propagating across user namespaces */ - if (child->mnt_parent->mnt_ns->user_ns != user_ns) - lock_mnt_tree(child); - child->mnt.mnt_flags &= ~MNT_LOCKED; -+ q = __lookup_mnt(&child->mnt_parent->mnt, -+ child->mnt_mountpoint); -+ if (q) -+ mnt_change_mountpoint(child, smp, q); - commit_tree(child); - } - put_mountpoint(smp); -diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c -index 06230baaa554e7..419d98cf9e29f1 100644 ---- a/fs/nfs/inode.c -+++ b/fs/nfs/inode.c -@@ -555,6 +555,8 @@ nfs_fhget(struct super_block *sb, struct nfs_fh *fh, struct nfs_fattr *fattr) - set_nlink(inode, fattr->nlink); - else if (fattr_supported & NFS_ATTR_FATTR_NLINK) - nfs_set_cache_invalid(inode, NFS_INO_INVALID_NLINK); -+ else -+ set_nlink(inode, 1); - if (fattr->valid & NFS_ATTR_FATTR_OWNER) - inode->i_uid = fattr->uid; - else if (fattr_supported & NFS_ATTR_FATTR_OWNER) -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 1b94a55215e7de..3085a2faab2d34 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -6059,6 +6059,8 @@ static ssize_t nfs4_proc_get_acl(struct inode *inode, void *buf, size_t buflen, - struct nfs_server *server = NFS_SERVER(inode); - int ret; - -+ if (unlikely(NFS_FH(inode)->size == 0)) -+ return -ENODATA; - if (!nfs4_server_supports_acls(server, type)) - return -EOPNOTSUPP; - ret = nfs_revalidate_inode(inode, NFS_INO_INVALID_CHANGE); -@@ -6133,6 +6135,9 @@ static int nfs4_proc_set_acl(struct inode *inode, const void *buf, - { - struct nfs4_exception exception = { }; - int err; -+ -+ if (unlikely(NFS_FH(inode)->size == 0)) -+ return -ENODATA; - do { - err = __nfs4_proc_set_acl(inode, buf, buflen, type); - trace_nfs4_set_acl(inode, err); -@@ -10625,7 +10630,7 @@ const struct nfs4_minor_version_ops *nfs_v4_minor_ops[] = { - - static ssize_t nfs4_listxattr(struct dentry *dentry, char *list, size_t size) - { -- ssize_t error, error2, error3; -+ ssize_t error, error2, error3, error4; - size_t left = size; - - error = generic_listxattr(dentry, list, left); -@@ -10648,8 +10653,16 @@ static ssize_t nfs4_listxattr(struct dentry *dentry, char *list, size_t size) - error3 = nfs4_listxattr_nfs4_user(d_inode(dentry), list, left); - if (error3 < 0) - return error3; -+ if (list) { -+ list += error3; -+ left -= error3; -+ } -+ -+ error4 = security_inode_listsecurity(d_inode(dentry), list, left); -+ if (error4 < 0) -+ return error4; - -- error += error2 + error3; -+ error += error2 + error3 + error4; - if (size && error > size) - return -ERANGE; - return error; -diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c -index 0bf3ffcd072f6a..0da1cd01d01cf7 100644 ---- a/fs/overlayfs/util.c -+++ b/fs/overlayfs/util.c -@@ -274,7 +274,9 @@ enum ovl_path_type ovl_path_realdata(struct dentry *dentry, struct path *path) - - struct dentry *ovl_dentry_upper(struct dentry *dentry) - { -- return ovl_upperdentry_dereference(OVL_I(d_inode(dentry))); -+ struct inode *inode = d_inode(dentry); -+ -+ return inode ? ovl_upperdentry_dereference(OVL_I(inode)) : NULL; - } - - struct dentry *ovl_dentry_lower(struct dentry *dentry) -diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h -index 6a4ed99e162c5d..d776340ad91ce6 100644 ---- a/fs/smb/client/cifsglob.h -+++ b/fs/smb/client/cifsglob.h -@@ -677,6 +677,7 @@ inc_rfc1001_len(void *buf, int count) - struct TCP_Server_Info { - struct list_head tcp_ses_list; - struct list_head smb_ses_list; -+ struct list_head rlist; /* reconnect list */ - spinlock_t srv_lock; /* protect anything here that is not protected */ - __u64 conn_id; /* connection identifier (useful for debugging) */ - int srv_count; /* reference counter */ -@@ -739,6 +740,7 @@ struct TCP_Server_Info { - char workstation_RFC1001_name[RFC1001_NAME_LEN_WITH_NULL]; - __u32 sequence_number; /* for signing, protected by srv_mutex */ - __u32 reconnect_instance; /* incremented on each reconnect */ -+ __le32 session_key_id; /* retrieved from negotiate response and send in session setup request */ - struct session_key session_key; - unsigned long lstrp; /* when we got last response from this server */ - struct cifs_secmech secmech; /* crypto sec mech functs, descriptors */ -diff --git a/fs/smb/client/cifspdu.h b/fs/smb/client/cifspdu.h -index ca33f6cd6a8004..763178b7745424 100644 ---- a/fs/smb/client/cifspdu.h -+++ b/fs/smb/client/cifspdu.h -@@ -557,7 +557,7 @@ typedef union smb_com_session_setup_andx { - __le16 MaxBufferSize; - __le16 MaxMpxCount; - __le16 VcNumber; -- __u32 SessionKey; -+ __le32 SessionKey; - __le16 SecurityBlobLength; - __u32 Reserved; - __le32 Capabilities; /* see below */ -@@ -576,7 +576,7 @@ typedef union smb_com_session_setup_andx { - __le16 MaxBufferSize; - __le16 MaxMpxCount; - __le16 VcNumber; -- __u32 SessionKey; -+ __le32 SessionKey; - __le16 CaseInsensitivePasswordLength; /* ASCII password len */ - __le16 CaseSensitivePasswordLength; /* Unicode password length*/ - __u32 Reserved; /* see below */ -@@ -614,7 +614,7 @@ typedef union smb_com_session_setup_andx { - __le16 MaxBufferSize; - __le16 MaxMpxCount; - __le16 VcNumber; -- __u32 SessionKey; -+ __le32 SessionKey; - __le16 PasswordLength; - __u32 Reserved; /* encrypt key len and offset */ - __le16 ByteCount; -diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c -index c36ab20050c16d..db35e68e8a5830 100644 ---- a/fs/smb/client/cifssmb.c -+++ b/fs/smb/client/cifssmb.c -@@ -479,6 +479,7 @@ CIFSSMBNegotiate(const unsigned int xid, - server->max_rw = le32_to_cpu(pSMBr->MaxRawSize); - cifs_dbg(NOISY, "Max buf = %d\n", ses->server->maxBuf); - server->capabilities = le32_to_cpu(pSMBr->Capabilities); -+ server->session_key_id = pSMBr->SessionKey; - server->timeAdj = (int)(__s16)le16_to_cpu(pSMBr->ServerTimeZone); - server->timeAdj *= 60; - -diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c -index 8fa5fe0a8c5c59..454420aa02220f 100644 ---- a/fs/smb/client/connect.c -+++ b/fs/smb/client/connect.c -@@ -140,6 +140,14 @@ static void smb2_query_server_interfaces(struct work_struct *work) - (SMB_INTERFACE_POLL_INTERVAL * HZ)); - } - -+#define set_need_reco(server) \ -+do { \ -+ spin_lock(&server->srv_lock); \ -+ if (server->tcpStatus != CifsExiting) \ -+ server->tcpStatus = CifsNeedReconnect; \ -+ spin_unlock(&server->srv_lock); \ -+} while (0) -+ - /* - * Update the tcpStatus for the server. - * This is used to signal the cifsd thread to call cifs_reconnect -@@ -153,39 +161,45 @@ void - cifs_signal_cifsd_for_reconnect(struct TCP_Server_Info *server, - bool all_channels) - { -- struct TCP_Server_Info *pserver; -+ struct TCP_Server_Info *nserver; - struct cifs_ses *ses; -+ LIST_HEAD(reco); - int i; - -- /* If server is a channel, select the primary channel */ -- pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; -- - /* if we need to signal just this channel */ - if (!all_channels) { -- spin_lock(&server->srv_lock); -- if (server->tcpStatus != CifsExiting) -- server->tcpStatus = CifsNeedReconnect; -- spin_unlock(&server->srv_lock); -+ set_need_reco(server); - return; - } - -- spin_lock(&cifs_tcp_ses_lock); -- list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { -- if (cifs_ses_exiting(ses)) -- continue; -- spin_lock(&ses->chan_lock); -- for (i = 0; i < ses->chan_count; i++) { -- if (!ses->chans[i].server) -+ if (SERVER_IS_CHAN(server)) -+ server = server->primary_server; -+ scoped_guard(spinlock, &cifs_tcp_ses_lock) { -+ set_need_reco(server); -+ list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) { -+ spin_lock(&ses->ses_lock); -+ if (ses->ses_status == SES_EXITING) { -+ spin_unlock(&ses->ses_lock); - continue; -- -- spin_lock(&ses->chans[i].server->srv_lock); -- if (ses->chans[i].server->tcpStatus != CifsExiting) -- ses->chans[i].server->tcpStatus = CifsNeedReconnect; -- spin_unlock(&ses->chans[i].server->srv_lock); -+ } -+ spin_lock(&ses->chan_lock); -+ for (i = 1; i < ses->chan_count; i++) { -+ nserver = ses->chans[i].server; -+ if (!nserver) -+ continue; -+ nserver->srv_count++; -+ list_add(&nserver->rlist, &reco); -+ } -+ spin_unlock(&ses->chan_lock); -+ spin_unlock(&ses->ses_lock); - } -- spin_unlock(&ses->chan_lock); - } -- spin_unlock(&cifs_tcp_ses_lock); -+ -+ list_for_each_entry_safe(server, nserver, &reco, rlist) { -+ list_del_init(&server->rlist); -+ set_need_reco(server); -+ cifs_put_tcp_session(server, 0); -+ } - } - - /* -diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c -index 65d4b72b4d51a9..9e8e0a01ae8eb0 100644 ---- a/fs/smb/client/misc.c -+++ b/fs/smb/client/misc.c -@@ -320,6 +320,14 @@ check_smb_hdr(struct smb_hdr *smb) - if (smb->Command == SMB_COM_LOCKING_ANDX) - return 0; - -+ /* -+ * Windows NT server returns error resposne (e.g. STATUS_DELETE_PENDING -+ * or STATUS_OBJECT_NAME_NOT_FOUND or ERRDOS/ERRbadfile or any other) -+ * for some TRANS2 requests without the RESPONSE flag set in header. -+ */ -+ if (smb->Command == SMB_COM_TRANSACTION2 && smb->Status.CifsError != 0) -+ return 0; -+ - cifs_dbg(VFS, "Server sent request, not response. mid=%u\n", - get_mid(smb)); - return 1; -diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c -index 8959206a0353eb..c351da8c3e2eaf 100644 ---- a/fs/smb/client/sess.c -+++ b/fs/smb/client/sess.c -@@ -683,6 +683,7 @@ static __u32 cifs_ssetup_hdr(struct cifs_ses *ses, - USHRT_MAX)); - pSMB->req.MaxMpxCount = cpu_to_le16(server->maxReq); - pSMB->req.VcNumber = cpu_to_le16(1); -+ pSMB->req.SessionKey = server->session_key_id; - - /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */ - -@@ -1739,22 +1740,22 @@ _sess_auth_rawntlmssp_assemble_req(struct sess_data *sess_data) - pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base; - - capabilities = cifs_ssetup_hdr(ses, server, pSMB); -- if ((pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) == 0) { -- cifs_dbg(VFS, "NTLMSSP requires Unicode support\n"); -- return -ENOSYS; -- } -- - pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC; - capabilities |= CAP_EXTENDED_SECURITY; - pSMB->req.Capabilities |= cpu_to_le32(capabilities); - - bcc_ptr = sess_data->iov[2].iov_base; -- /* unicode strings must be word aligned */ -- if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) { -- *bcc_ptr = 0; -- bcc_ptr++; -+ -+ if (pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) { -+ /* unicode strings must be word aligned */ -+ if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) { -+ *bcc_ptr = 0; -+ bcc_ptr++; -+ } -+ unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp); -+ } else { -+ ascii_oslm_strings(&bcc_ptr, sess_data->nls_cp); - } -- unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp); - - sess_data->iov[2].iov_len = (long) bcc_ptr - - (long) sess_data->iov[2].iov_base; -diff --git a/fs/smb/server/connection.h b/fs/smb/server/connection.h -index 4fdd76ce53b90c..dc07c6eb8c1921 100644 ---- a/fs/smb/server/connection.h -+++ b/fs/smb/server/connection.h -@@ -107,6 +107,7 @@ struct ksmbd_conn { - __le16 signing_algorithm; - bool binding; - atomic_t refcnt; -+ bool is_aapl; - }; - - struct ksmbd_conn_ops { -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index d8325504a1624b..6c22240368abf4 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -1345,8 +1345,7 @@ static int ntlm_negotiate(struct ksmbd_work *work, - return rc; - - sz = le16_to_cpu(rsp->SecurityBufferOffset); -- chgblob = -- (struct challenge_message *)((char *)&rsp->hdr.ProtocolId + sz); -+ chgblob = (struct challenge_message *)rsp->Buffer; - memset(chgblob, 0, sizeof(struct challenge_message)); - - if (!work->conn->use_spnego) { -@@ -1379,8 +1378,7 @@ static int ntlm_negotiate(struct ksmbd_work *work, - goto out; - } - -- sz = le16_to_cpu(rsp->SecurityBufferOffset); -- memcpy((char *)&rsp->hdr.ProtocolId + sz, spnego_blob, spnego_blob_len); -+ memcpy(rsp->Buffer, spnego_blob, spnego_blob_len); - rsp->SecurityBufferLength = cpu_to_le16(spnego_blob_len); - - out: -@@ -1462,8 +1460,7 @@ static int ntlm_authenticate(struct ksmbd_work *work, - if (rc) - return -ENOMEM; - -- sz = le16_to_cpu(rsp->SecurityBufferOffset); -- memcpy((char *)&rsp->hdr.ProtocolId + sz, spnego_blob, spnego_blob_len); -+ memcpy(rsp->Buffer, spnego_blob, spnego_blob_len); - rsp->SecurityBufferLength = cpu_to_le16(spnego_blob_len); - kfree(spnego_blob); - } -@@ -2862,7 +2859,7 @@ int smb2_open(struct ksmbd_work *work) - int req_op_level = 0, open_flags = 0, may_flags = 0, file_info = 0; - int rc = 0; - int contxt_cnt = 0, query_disk_id = 0; -- int maximal_access_ctxt = 0, posix_ctxt = 0; -+ bool maximal_access_ctxt = false, posix_ctxt = false; - int s_type = 0; - int next_off = 0; - char *name = NULL; -@@ -2889,6 +2886,27 @@ int smb2_open(struct ksmbd_work *work) - return create_smb2_pipe(work); - } - -+ if (req->CreateContextsOffset && tcon->posix_extensions) { -+ context = smb2_find_context_vals(req, SMB2_CREATE_TAG_POSIX, 16); -+ if (IS_ERR(context)) { -+ rc = PTR_ERR(context); -+ goto err_out2; -+ } else if (context) { -+ struct create_posix *posix = (struct create_posix *)context; -+ -+ if (le16_to_cpu(context->DataOffset) + -+ le32_to_cpu(context->DataLength) < -+ sizeof(struct create_posix) - 4) { -+ rc = -EINVAL; -+ goto err_out2; -+ } -+ ksmbd_debug(SMB, "get posix context\n"); -+ -+ posix_mode = le32_to_cpu(posix->Mode); -+ posix_ctxt = true; -+ } -+ } -+ - if (req->NameLength) { - name = smb2_get_name((char *)req + le16_to_cpu(req->NameOffset), - le16_to_cpu(req->NameLength), -@@ -2911,9 +2929,11 @@ int smb2_open(struct ksmbd_work *work) - goto err_out2; - } - -- rc = ksmbd_validate_filename(name); -- if (rc < 0) -- goto err_out2; -+ if (posix_ctxt == false) { -+ rc = ksmbd_validate_filename(name); -+ if (rc < 0) -+ goto err_out2; -+ } - - if (ksmbd_share_veto_filename(share, name)) { - rc = -ENOENT; -@@ -3071,28 +3091,6 @@ int smb2_open(struct ksmbd_work *work) - rc = -EBADF; - goto err_out2; - } -- -- if (tcon->posix_extensions) { -- context = smb2_find_context_vals(req, -- SMB2_CREATE_TAG_POSIX, 16); -- if (IS_ERR(context)) { -- rc = PTR_ERR(context); -- goto err_out2; -- } else if (context) { -- struct create_posix *posix = -- (struct create_posix *)context; -- if (le16_to_cpu(context->DataOffset) + -- le32_to_cpu(context->DataLength) < -- sizeof(struct create_posix) - 4) { -- rc = -EINVAL; -- goto err_out2; -- } -- ksmbd_debug(SMB, "get posix context\n"); -- -- posix_mode = le32_to_cpu(posix->Mode); -- posix_ctxt = 1; -- } -- } - } - - if (ksmbd_override_fsids(work)) { -@@ -3526,6 +3524,15 @@ int smb2_open(struct ksmbd_work *work) - ksmbd_debug(SMB, "get query on disk id context\n"); - query_disk_id = 1; - } -+ -+ if (conn->is_aapl == false) { -+ context = smb2_find_context_vals(req, SMB2_CREATE_AAPL, 4); -+ if (IS_ERR(context)) { -+ rc = PTR_ERR(context); -+ goto err_out1; -+ } else if (context) -+ conn->is_aapl = true; -+ } - } - - rc = ksmbd_vfs_getattr(&path, &stat); -@@ -3964,7 +3971,10 @@ static int smb2_populate_readdir_entry(struct ksmbd_conn *conn, int info_level, - if (dinfo->EaSize) - dinfo->ExtFileAttributes = FILE_ATTRIBUTE_REPARSE_POINT_LE; - dinfo->Reserved = 0; -- dinfo->UniqueId = cpu_to_le64(ksmbd_kstat->kstat->ino); -+ if (conn->is_aapl) -+ dinfo->UniqueId = 0; -+ else -+ dinfo->UniqueId = cpu_to_le64(ksmbd_kstat->kstat->ino); - if (d_info->hide_dot_file && d_info->name[0] == '.') - dinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE; - memcpy(dinfo->FileName, conv_name, conv_len); -@@ -3981,7 +3991,10 @@ static int smb2_populate_readdir_entry(struct ksmbd_conn *conn, int info_level, - smb2_get_reparse_tag_special_file(ksmbd_kstat->kstat->mode); - if (fibdinfo->EaSize) - fibdinfo->ExtFileAttributes = FILE_ATTRIBUTE_REPARSE_POINT_LE; -- fibdinfo->UniqueId = cpu_to_le64(ksmbd_kstat->kstat->ino); -+ if (conn->is_aapl) -+ fibdinfo->UniqueId = 0; -+ else -+ fibdinfo->UniqueId = cpu_to_le64(ksmbd_kstat->kstat->ino); - fibdinfo->ShortNameLength = 0; - fibdinfo->Reserved = 0; - fibdinfo->Reserved2 = cpu_to_le16(0); -diff --git a/fs/smb/server/smb2pdu.h b/fs/smb/server/smb2pdu.h -index 25cc81aac350f2..2821e6c8298f4d 100644 ---- a/fs/smb/server/smb2pdu.h -+++ b/fs/smb/server/smb2pdu.h -@@ -63,6 +63,9 @@ struct preauth_integrity_info { - - #define SMB2_SESSION_TIMEOUT (10 * HZ) - -+/* Apple Defined Contexts */ -+#define SMB2_CREATE_AAPL "AAPL" -+ - struct create_durable_req_v2 { - struct create_context_hdr ccontext; - __u8 Name[8]; -diff --git a/include/linux/console.h b/include/linux/console.h -index 7de11c763eb35d..38571607065d76 100644 ---- a/include/linux/console.h -+++ b/include/linux/console.h -@@ -36,9 +36,14 @@ enum vc_intensity; - /** - * struct consw - callbacks for consoles - * -+ * @con_init: initialize the console on @vc. @init is true for the very first -+ * call on this @vc. -+ * @con_clear: erase @count characters at [@x, @y] on @vc. @count >= 1. - * @con_scroll: move lines from @top to @bottom in direction @dir by @lines. - * Return true if no generic handling should be done. - * Invoked by csi_M and printing to the console. -+ * @con_switch: notifier about the console switch; it is supposed to return -+ * true if a redraw is needed. - * @con_set_palette: sets the palette of the console to @table (optional) - * @con_scrolldelta: the contents of the console should be scrolled by @lines. - * Invoked by user. (optional) -@@ -46,10 +51,10 @@ enum vc_intensity; - struct consw { - struct module *owner; - const char *(*con_startup)(void); -- void (*con_init)(struct vc_data *vc, int init); -+ void (*con_init)(struct vc_data *vc, bool init); - void (*con_deinit)(struct vc_data *vc); -- void (*con_clear)(struct vc_data *vc, int sy, int sx, int height, -- int width); -+ void (*con_clear)(struct vc_data *vc, unsigned int y, -+ unsigned int x, unsigned int count); - void (*con_putc)(struct vc_data *vc, int c, int ypos, int xpos); - void (*con_putcs)(struct vc_data *vc, const unsigned short *s, - int count, int ypos, int xpos); -@@ -57,7 +62,7 @@ struct consw { - bool (*con_scroll)(struct vc_data *vc, unsigned int top, - unsigned int bottom, enum con_scroll dir, - unsigned int lines); -- int (*con_switch)(struct vc_data *vc); -+ bool (*con_switch)(struct vc_data *vc); - int (*con_blank)(struct vc_data *vc, int blank, int mode_switch); - int (*con_font_set)(struct vc_data *vc, struct console_font *font, - unsigned int vpitch, unsigned int flags); -diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h -index b5bf5315ca8c10..e4ad9760774e14 100644 ---- a/include/linux/hyperv.h -+++ b/include/linux/hyperv.h -@@ -820,6 +820,8 @@ struct vmbus_requestor { - #define VMBUS_RQST_RESET (U64_MAX - 3) - - struct vmbus_device { -+ /* preferred ring buffer size in KB, 0 means no preferred size for this device */ -+ size_t pref_ring_size; - u16 dev_type; - guid_t guid; - bool perf_device; -diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h -index d79851c5fabd86..af8a771a053c51 100644 ---- a/include/linux/ipv6.h -+++ b/include/linux/ipv6.h -@@ -199,7 +199,6 @@ struct inet6_cork { - struct ipv6_txoptions *opt; - u8 hop_limit; - u8 tclass; -- u8 dontfrag:1; - }; - - /* struct ipv6_pinfo - ipv6 private area */ -diff --git a/include/uapi/linux/vm_sockets.h b/include/uapi/linux/vm_sockets.h -index ed07181d4eff91..e05280e4152286 100644 ---- a/include/uapi/linux/vm_sockets.h -+++ b/include/uapi/linux/vm_sockets.h -@@ -17,6 +17,10 @@ - #ifndef _UAPI_VM_SOCKETS_H - #define _UAPI_VM_SOCKETS_H - -+#ifndef __KERNEL__ -+#include /* for struct sockaddr and sa_family_t */ -+#endif -+ - #include - #include - -diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug -index e809b6d8bc5373..1aae81c57b2c9a 100644 ---- a/lib/Kconfig.debug -+++ b/lib/Kconfig.debug -@@ -2747,6 +2747,15 @@ config FORTIFY_KUNIT_TEST - by the str*() and mem*() family of functions. For testing runtime - traps of FORTIFY_SOURCE, see LKDTM's "FORTIFY_*" tests. - -+config LONGEST_SYM_KUNIT_TEST -+ tristate "Test the longest symbol possible" if !KUNIT_ALL_TESTS -+ depends on KUNIT && KPROBES -+ default KUNIT_ALL_TESTS -+ help -+ Tests the longest symbol possible -+ -+ If unsure, say N. -+ - config HW_BREAKPOINT_KUNIT_TEST - bool "Test hw_breakpoint constraints accounting" if !KUNIT_ALL_TESTS - depends on HAVE_HW_BREAKPOINT -diff --git a/lib/Makefile b/lib/Makefile -index 740109b6e2c89f..b9d2577fbbe190 100644 ---- a/lib/Makefile -+++ b/lib/Makefile -@@ -402,6 +402,8 @@ obj-$(CONFIG_FORTIFY_KUNIT_TEST) += fortify_kunit.o - obj-$(CONFIG_STRCAT_KUNIT_TEST) += strcat_kunit.o - obj-$(CONFIG_STRSCPY_KUNIT_TEST) += strscpy_kunit.o - obj-$(CONFIG_SIPHASH_KUNIT_TEST) += siphash_kunit.o -+obj-$(CONFIG_LONGEST_SYM_KUNIT_TEST) += longest_symbol_kunit.o -+CFLAGS_longest_symbol_kunit.o += $(call cc-disable-warning, missing-prototypes) - - obj-$(CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED) += devmem_is_allowed.o - -diff --git a/lib/group_cpus.c b/lib/group_cpus.c -index ee272c4cefcc13..18d43a406114b9 100644 ---- a/lib/group_cpus.c -+++ b/lib/group_cpus.c -@@ -352,6 +352,9 @@ struct cpumask *group_cpus_evenly(unsigned int numgrps) - int ret = -ENOMEM; - struct cpumask *masks = NULL; - -+ if (numgrps == 0) -+ return NULL; -+ - if (!zalloc_cpumask_var(&nmsk, GFP_KERNEL)) - return NULL; - -@@ -426,8 +429,12 @@ struct cpumask *group_cpus_evenly(unsigned int numgrps) - #else /* CONFIG_SMP */ - struct cpumask *group_cpus_evenly(unsigned int numgrps) - { -- struct cpumask *masks = kcalloc(numgrps, sizeof(*masks), GFP_KERNEL); -+ struct cpumask *masks; - -+ if (numgrps == 0) -+ return NULL; -+ -+ masks = kcalloc(numgrps, sizeof(*masks), GFP_KERNEL); - if (!masks) - return NULL; - -diff --git a/lib/longest_symbol_kunit.c b/lib/longest_symbol_kunit.c -new file mode 100644 -index 00000000000000..2fea82a6d34e5c ---- /dev/null -+++ b/lib/longest_symbol_kunit.c -@@ -0,0 +1,82 @@ -+// SPDX-License-Identifier: GPL-2.0 -+/* -+ * Test the longest symbol length. Execute with: -+ * ./tools/testing/kunit/kunit.py run longest-symbol -+ * --arch=x86_64 --kconfig_add CONFIG_KPROBES=y --kconfig_add CONFIG_MODULES=y -+ * --kconfig_add CONFIG_RETPOLINE=n --kconfig_add CONFIG_CFI_CLANG=n -+ * --kconfig_add CONFIG_MITIGATION_RETPOLINE=n -+ */ -+ -+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt -+ -+#include -+#include -+#include -+#include -+ -+#define DI(name) s##name##name -+#define DDI(name) DI(n##name##name) -+#define DDDI(name) DDI(n##name##name) -+#define DDDDI(name) DDDI(n##name##name) -+#define DDDDDI(name) DDDDI(n##name##name) -+ -+/*Generate a symbol whose name length is 511 */ -+#define LONGEST_SYM_NAME DDDDDI(g1h2i3j4k5l6m7n) -+ -+#define RETURN_LONGEST_SYM 0xAAAAA -+ -+noinline int LONGEST_SYM_NAME(void); -+noinline int LONGEST_SYM_NAME(void) -+{ -+ return RETURN_LONGEST_SYM; -+} -+ -+_Static_assert(sizeof(__stringify(LONGEST_SYM_NAME)) == KSYM_NAME_LEN, -+"Incorrect symbol length found. Expected KSYM_NAME_LEN: " -+__stringify(KSYM_NAME_LEN) ", but found: " -+__stringify(sizeof(LONGEST_SYM_NAME))); -+ -+static void test_longest_symbol(struct kunit *test) -+{ -+ KUNIT_EXPECT_EQ(test, RETURN_LONGEST_SYM, LONGEST_SYM_NAME()); -+}; -+ -+static void test_longest_symbol_kallsyms(struct kunit *test) -+{ -+ unsigned long (*kallsyms_lookup_name)(const char *name); -+ static int (*longest_sym)(void); -+ -+ struct kprobe kp = { -+ .symbol_name = "kallsyms_lookup_name", -+ }; -+ -+ if (register_kprobe(&kp) < 0) { -+ pr_info("%s: kprobe not registered", __func__); -+ KUNIT_FAIL(test, "test_longest_symbol kallsyms: kprobe not registered\n"); -+ return; -+ } -+ -+ kunit_warn(test, "test_longest_symbol kallsyms: kprobe registered\n"); -+ kallsyms_lookup_name = (unsigned long (*)(const char *name))kp.addr; -+ unregister_kprobe(&kp); -+ -+ longest_sym = -+ (void *) kallsyms_lookup_name(__stringify(LONGEST_SYM_NAME)); -+ KUNIT_EXPECT_EQ(test, RETURN_LONGEST_SYM, longest_sym()); -+}; -+ -+static struct kunit_case longest_symbol_test_cases[] = { -+ KUNIT_CASE(test_longest_symbol), -+ KUNIT_CASE(test_longest_symbol_kallsyms), -+ {} -+}; -+ -+static struct kunit_suite longest_symbol_test_suite = { -+ .name = "longest-symbol", -+ .test_cases = longest_symbol_test_cases, -+}; -+kunit_test_suite(longest_symbol_test_suite); -+ -+MODULE_LICENSE("GPL"); -+MODULE_DESCRIPTION("Test the longest symbol length"); -+MODULE_AUTHOR("Sergio González Collado"); -diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c -index 26c948f87489ee..19d661889cf796 100644 ---- a/mm/damon/sysfs-schemes.c -+++ b/mm/damon/sysfs-schemes.c -@@ -376,6 +376,7 @@ static ssize_t memcg_path_store(struct kobject *kobj, - return -ENOMEM; - - strscpy(path, buf, count + 1); -+ kfree(filter->memcg_path); - filter->memcg_path = path; - return count; - } -diff --git a/net/atm/clip.c b/net/atm/clip.c -index 294cb9efe3d382..511467bb7fe40d 100644 ---- a/net/atm/clip.c -+++ b/net/atm/clip.c -@@ -193,12 +193,6 @@ static void clip_push(struct atm_vcc *vcc, struct sk_buff *skb) - - pr_debug("\n"); - -- if (!clip_devs) { -- atm_return(vcc, skb->truesize); -- kfree_skb(skb); -- return; -- } -- - if (!skb) { - pr_debug("removing VCC %p\n", clip_vcc); - if (clip_vcc->entry) -@@ -208,6 +202,11 @@ static void clip_push(struct atm_vcc *vcc, struct sk_buff *skb) - return; - } - atm_return(vcc, skb->truesize); -+ if (!clip_devs) { -+ kfree_skb(skb); -+ return; -+ } -+ - skb->dev = clip_vcc->entry ? clip_vcc->entry->neigh->dev : clip_devs; - /* clip_vcc->entry == NULL if we don't have an IP address yet */ - if (!skb->dev) { -diff --git a/net/atm/resources.c b/net/atm/resources.c -index 995d29e7fb138c..b19d851e1f4439 100644 ---- a/net/atm/resources.c -+++ b/net/atm/resources.c -@@ -146,11 +146,10 @@ void atm_dev_deregister(struct atm_dev *dev) - */ - mutex_lock(&atm_dev_mutex); - list_del(&dev->dev_list); -- mutex_unlock(&atm_dev_mutex); -- - atm_dev_release_vccs(dev); - atm_unregister_sysfs(dev); - atm_proc_dev_deregister(dev); -+ mutex_unlock(&atm_dev_mutex); - - atm_dev_put(dev); - } -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index 2744ad11687c65..f9995a405e35c3 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -3380,7 +3380,7 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data - struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC }; - struct l2cap_conf_efs efs; - u8 remote_efs = 0; -- u16 mtu = L2CAP_DEFAULT_MTU; -+ u16 mtu = 0; - u16 result = L2CAP_CONF_SUCCESS; - u16 size; - -@@ -3485,6 +3485,13 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data - /* Configure output options and let the other side know - * which ones we don't like. */ - -+ /* If MTU is not provided in configure request, use the most recently -+ * explicitly or implicitly accepted value for the other direction, -+ * or the default value. -+ */ -+ if (mtu == 0) -+ mtu = chan->imtu ? chan->imtu : L2CAP_DEFAULT_MTU; -+ - if (mtu < L2CAP_DEFAULT_MIN_MTU) - result = L2CAP_CONF_UNACCEPT; - else { -diff --git a/net/core/selftests.c b/net/core/selftests.c -index 7af99d07762ea0..946e92cca21110 100644 ---- a/net/core/selftests.c -+++ b/net/core/selftests.c -@@ -160,8 +160,9 @@ static struct sk_buff *net_test_get_skb(struct net_device *ndev, - skb->csum = 0; - skb->ip_summed = CHECKSUM_PARTIAL; - if (attr->tcp) { -- thdr->check = ~tcp_v4_check(skb->len, ihdr->saddr, -- ihdr->daddr, 0); -+ int l4len = skb->len - skb_transport_offset(skb); -+ -+ thdr->check = ~tcp_v4_check(l4len, ihdr->saddr, ihdr->daddr, 0); - skb->csum_start = skb_transport_header(skb) - skb->head; - skb->csum_offset = offsetof(struct tcphdr, check); - } else { -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index 28777b14224048..c86d5dca29df01 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -1452,7 +1452,6 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork, - } - v6_cork->hop_limit = ipc6->hlimit; - v6_cork->tclass = ipc6->tclass; -- v6_cork->dontfrag = ipc6->dontfrag; - if (rt->dst.flags & DST_XFRM_TUNNEL) - mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ? - READ_ONCE(rt->dst.dev->mtu) : dst_mtu(&rt->dst); -@@ -1486,7 +1485,7 @@ static int __ip6_append_data(struct sock *sk, - int getfrag(void *from, char *to, int offset, - int len, int odd, struct sk_buff *skb), - void *from, size_t length, int transhdrlen, -- unsigned int flags) -+ unsigned int flags, struct ipcm6_cookie *ipc6) - { - struct sk_buff *skb, *skb_prev = NULL; - struct inet_cork *cork = &cork_full->base; -@@ -1542,7 +1541,7 @@ static int __ip6_append_data(struct sock *sk, - if (headersize + transhdrlen > mtu) - goto emsgsize; - -- if (cork->length + length > mtu - headersize && v6_cork->dontfrag && -+ if (cork->length + length > mtu - headersize && ipc6->dontfrag && - (sk->sk_protocol == IPPROTO_UDP || - sk->sk_protocol == IPPROTO_ICMPV6 || - sk->sk_protocol == IPPROTO_RAW)) { -@@ -1914,7 +1913,7 @@ int ip6_append_data(struct sock *sk, - - return __ip6_append_data(sk, &sk->sk_write_queue, &inet->cork, - &np->cork, sk_page_frag(sk), getfrag, -- from, length, transhdrlen, flags); -+ from, length, transhdrlen, flags, ipc6); - } - EXPORT_SYMBOL_GPL(ip6_append_data); - -@@ -2119,7 +2118,7 @@ struct sk_buff *ip6_make_skb(struct sock *sk, - err = __ip6_append_data(sk, &queue, cork, &v6_cork, - ¤t->task_frag, getfrag, from, - length + exthdrlen, transhdrlen + exthdrlen, -- flags); -+ flags, ipc6); - if (err) { - __ip6_flush_pending_frames(sk, &queue, cork, &v6_cork); - return ERR_PTR(err); -diff --git a/net/mac80211/util.c b/net/mac80211/util.c -index 154b41af4157d0..3a3cd09bdab658 100644 ---- a/net/mac80211/util.c -+++ b/net/mac80211/util.c -@@ -4753,7 +4753,7 @@ void ieee80211_recalc_dtim(struct ieee80211_local *local, - { - u64 tsf = drv_get_tsf(local, sdata); - u64 dtim_count = 0; -- u16 beacon_int = sdata->vif.bss_conf.beacon_int * 1024; -+ u32 beacon_int = sdata->vif.bss_conf.beacon_int * 1024; - u8 dtim_period = sdata->vif.bss_conf.dtim_period; - struct ps_data *ps; - u8 bcns_from_dtim; -diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c -index 4ffb2bcaf3648e..63756607f63272 100644 ---- a/net/sunrpc/clnt.c -+++ b/net/sunrpc/clnt.c -@@ -2733,8 +2733,13 @@ rpc_decode_header(struct rpc_task *task, struct xdr_stream *xdr) - case -EPROTONOSUPPORT: - goto out_err; - case -EACCES: -- /* Re-encode with a fresh cred */ -- fallthrough; -+ /* possible RPCSEC_GSS out-of-sequence event (RFC2203), -+ * reset recv state and keep waiting, don't retransmit -+ */ -+ task->tk_rqstp->rq_reply_bytes_recvd = 0; -+ task->tk_status = xprt_request_enqueue_receive(task); -+ task->tk_action = call_transmit_status; -+ return -EBADMSG; - default: - goto out_garbage; - } -diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index 236a2cd2bc93d2..f89cd01247f6bb 100644 ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -125,6 +125,46 @@ static spinlock_t bsd_socket_locks[UNIX_HASH_SIZE / 2]; - * hash table is protected with spinlock. - * each socket state is protected by separate spinlock. - */ -+#ifdef CONFIG_PROVE_LOCKING -+#define cmp_ptr(l, r) (((l) > (r)) - ((l) < (r))) -+ -+static int unix_table_lock_cmp_fn(const struct lockdep_map *a, -+ const struct lockdep_map *b) -+{ -+ return cmp_ptr(a, b); -+} -+ -+static int unix_state_lock_cmp_fn(const struct lockdep_map *_a, -+ const struct lockdep_map *_b) -+{ -+ const struct unix_sock *a, *b; -+ -+ a = container_of(_a, struct unix_sock, lock.dep_map); -+ b = container_of(_b, struct unix_sock, lock.dep_map); -+ -+ /* unix_state_double_lock(): ascending address order. */ -+ return cmp_ptr(a, b); -+} -+ -+static int unix_recvq_lock_cmp_fn(const struct lockdep_map *_a, -+ const struct lockdep_map *_b) -+{ -+ const struct sock *a, *b; -+ -+ a = container_of(_a, struct sock, sk_receive_queue.lock.dep_map); -+ b = container_of(_b, struct sock, sk_receive_queue.lock.dep_map); -+ -+ /* unix_collect_skb(): listener -> embryo order. */ -+ if (a->sk_state == TCP_LISTEN && unix_sk(b)->listener == a) -+ return -1; -+ -+ /* Should never happen. Just to be symmetric. */ -+ if (b->sk_state == TCP_LISTEN && unix_sk(a)->listener == b) -+ return 1; -+ -+ return 0; -+} -+#endif - - static unsigned int unix_unbound_hash(struct sock *sk) - { -@@ -167,7 +207,7 @@ static void unix_table_double_lock(struct net *net, - swap(hash1, hash2); - - spin_lock(&net->unx.table.locks[hash1]); -- spin_lock_nested(&net->unx.table.locks[hash2], SINGLE_DEPTH_NESTING); -+ spin_lock(&net->unx.table.locks[hash2]); - } - - static void unix_table_double_unlock(struct net *net, -@@ -590,6 +630,11 @@ static void unix_sock_destructor(struct sock *sk) - #endif - } - -+static unsigned int unix_skb_len(const struct sk_buff *skb) -+{ -+ return skb->len - UNIXCB(skb).consumed; -+} -+ - static void unix_release_sock(struct sock *sk, int embrion) - { - struct unix_sock *u = unix_sk(sk); -@@ -617,20 +662,23 @@ static void unix_release_sock(struct sock *sk, int embrion) - unix_state_unlock(sk); - - #if IS_ENABLED(CONFIG_AF_UNIX_OOB) -- if (u->oob_skb) { -- kfree_skb(u->oob_skb); -- u->oob_skb = NULL; -- } -+ u->oob_skb = NULL; - #endif - - wake_up_interruptible_all(&u->peer_wait); - - if (skpair != NULL) { - if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) { -+ struct sk_buff *skb = skb_peek(&sk->sk_receive_queue); -+ -+#if IS_ENABLED(CONFIG_AF_UNIX_OOB) -+ if (skb && !unix_skb_len(skb)) -+ skb = skb_peek_next(skb, &sk->sk_receive_queue); -+#endif - unix_state_lock(skpair); - /* No more writes */ - WRITE_ONCE(skpair->sk_shutdown, SHUTDOWN_MASK); -- if (!skb_queue_empty_lockless(&sk->sk_receive_queue) || embrion) -+ if (skb || embrion) - WRITE_ONCE(skpair->sk_err, ECONNRESET); - unix_state_unlock(skpair); - skpair->sk_state_change(skpair); -@@ -977,12 +1025,15 @@ static struct sock *unix_create1(struct net *net, struct socket *sock, int kern, - sk->sk_write_space = unix_write_space; - sk->sk_max_ack_backlog = READ_ONCE(net->unx.sysctl_max_dgram_qlen); - sk->sk_destruct = unix_sock_destructor; -+ lock_set_cmp_fn(&sk->sk_receive_queue.lock, unix_recvq_lock_cmp_fn, NULL); -+ - u = unix_sk(sk); - u->listener = NULL; - u->vertex = NULL; - u->path.dentry = NULL; - u->path.mnt = NULL; - spin_lock_init(&u->lock); -+ lock_set_cmp_fn(&u->lock, unix_state_lock_cmp_fn, NULL); - mutex_init(&u->iolock); /* single task reading lock */ - mutex_init(&u->bindlock); /* single task binding lock */ - init_waitqueue_head(&u->peer_wait); -@@ -1331,11 +1382,12 @@ static void unix_state_double_lock(struct sock *sk1, struct sock *sk2) - unix_state_lock(sk1); - return; - } -+ - if (sk1 > sk2) - swap(sk1, sk2); - - unix_state_lock(sk1); -- unix_state_lock_nested(sk2, U_LOCK_SECOND); -+ unix_state_lock(sk2); - } - - static void unix_state_double_unlock(struct sock *sk1, struct sock *sk2) -@@ -2145,13 +2197,9 @@ static int queue_oob(struct socket *sock, struct msghdr *msg, struct sock *other - } - - maybe_add_creds(skb, sock, other); -- skb_get(skb); -- - scm_stat_add(other, skb); - - spin_lock(&other->sk_receive_queue.lock); -- if (ousk->oob_skb) -- consume_skb(ousk->oob_skb); - WRITE_ONCE(ousk->oob_skb, skb); - __skb_queue_tail(&other->sk_receive_queue, skb); - spin_unlock(&other->sk_receive_queue.lock); -@@ -2515,11 +2563,6 @@ static long unix_stream_data_wait(struct sock *sk, long timeo, - return timeo; - } - --static unsigned int unix_skb_len(const struct sk_buff *skb) --{ -- return skb->len - UNIXCB(skb).consumed; --} -- - struct unix_stream_read_state { - int (*recv_actor)(struct sk_buff *, int, int, - struct unix_stream_read_state *); -@@ -2534,11 +2577,11 @@ struct unix_stream_read_state { - #if IS_ENABLED(CONFIG_AF_UNIX_OOB) - static int unix_stream_recv_urg(struct unix_stream_read_state *state) - { -+ struct sk_buff *oob_skb, *read_skb = NULL; - struct socket *sock = state->socket; - struct sock *sk = sock->sk; - struct unix_sock *u = unix_sk(sk); - int chunk = 1; -- struct sk_buff *oob_skb; - - mutex_lock(&u->iolock); - unix_state_lock(sk); -@@ -2553,10 +2596,15 @@ static int unix_stream_recv_urg(struct unix_stream_read_state *state) - - oob_skb = u->oob_skb; - -- if (!(state->flags & MSG_PEEK)) -+ if (!(state->flags & MSG_PEEK)) { - WRITE_ONCE(u->oob_skb, NULL); -- else -- skb_get(oob_skb); -+ -+ if (oob_skb->prev != (struct sk_buff *)&sk->sk_receive_queue && -+ !unix_skb_len(oob_skb->prev)) { -+ read_skb = oob_skb->prev; -+ __skb_unlink(read_skb, &sk->sk_receive_queue); -+ } -+ } - - spin_unlock(&sk->sk_receive_queue.lock); - unix_state_unlock(sk); -@@ -2566,10 +2614,10 @@ static int unix_stream_recv_urg(struct unix_stream_read_state *state) - if (!(state->flags & MSG_PEEK)) - UNIXCB(oob_skb).consumed += 1; - -- consume_skb(oob_skb); -- - mutex_unlock(&u->iolock); - -+ consume_skb(read_skb); -+ - if (chunk < 0) - return -EFAULT; - -@@ -2595,12 +2643,10 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk, - if (copied) { - skb = NULL; - } else if (!(flags & MSG_PEEK)) { -- if (sock_flag(sk, SOCK_URGINLINE)) { -- WRITE_ONCE(u->oob_skb, NULL); -- consume_skb(skb); -- } else { -+ WRITE_ONCE(u->oob_skb, NULL); -+ -+ if (!sock_flag(sk, SOCK_URGINLINE)) { - __skb_unlink(skb, &sk->sk_receive_queue); -- WRITE_ONCE(u->oob_skb, NULL); - unlinked_skb = skb; - skb = skb_peek(&sk->sk_receive_queue); - } -@@ -2611,10 +2657,7 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk, - - spin_unlock(&sk->sk_receive_queue.lock); - -- if (unlinked_skb) { -- WARN_ON_ONCE(skb_unref(unlinked_skb)); -- kfree_skb(unlinked_skb); -- } -+ kfree_skb(unlinked_skb); - } - return skb; - } -@@ -2657,7 +2700,6 @@ static int unix_stream_read_skb(struct sock *sk, skb_read_actor_t recv_actor) - unix_state_unlock(sk); - - if (drop) { -- WARN_ON_ONCE(skb_unref(skb)); - kfree_skb(skb); - return -EAGAIN; - } -@@ -3598,6 +3640,7 @@ static int __net_init unix_net_init(struct net *net) - - for (i = 0; i < UNIX_HASH_SIZE; i++) { - spin_lock_init(&net->unx.table.locks[i]); -+ lock_set_cmp_fn(&net->unx.table.locks[i], unix_table_lock_cmp_fn, NULL); - INIT_HLIST_HEAD(&net->unx.table.buckets[i]); - } - -diff --git a/net/unix/garbage.c b/net/unix/garbage.c -index 23efb78fe9ef4b..0068e758be4ddb 100644 ---- a/net/unix/garbage.c -+++ b/net/unix/garbage.c -@@ -337,23 +337,6 @@ static bool unix_vertex_dead(struct unix_vertex *vertex) - return true; - } - --enum unix_recv_queue_lock_class { -- U_RECVQ_LOCK_NORMAL, -- U_RECVQ_LOCK_EMBRYO, --}; -- --static void unix_collect_queue(struct unix_sock *u, struct sk_buff_head *hitlist) --{ -- skb_queue_splice_init(&u->sk.sk_receive_queue, hitlist); -- --#if IS_ENABLED(CONFIG_AF_UNIX_OOB) -- if (u->oob_skb) { -- WARN_ON_ONCE(skb_unref(u->oob_skb)); -- u->oob_skb = NULL; -- } --#endif --} -- - static void unix_collect_skb(struct list_head *scc, struct sk_buff_head *hitlist) - { - struct unix_vertex *vertex; -@@ -375,13 +358,12 @@ static void unix_collect_skb(struct list_head *scc, struct sk_buff_head *hitlist - skb_queue_walk(queue, skb) { - struct sk_buff_head *embryo_queue = &skb->sk->sk_receive_queue; - -- /* listener -> embryo order, the inversion never happens. */ -- spin_lock_nested(&embryo_queue->lock, U_RECVQ_LOCK_EMBRYO); -- unix_collect_queue(unix_sk(skb->sk), hitlist); -+ spin_lock(&embryo_queue->lock); -+ skb_queue_splice_init(embryo_queue, hitlist); - spin_unlock(&embryo_queue->lock); - } - } else { -- unix_collect_queue(u, hitlist); -+ skb_queue_splice_init(queue, hitlist); - } - - spin_unlock(&queue->lock); -diff --git a/rust/macros/module.rs b/rust/macros/module.rs -index 7dee348ef0cc82..7614a7198ce206 100644 ---- a/rust/macros/module.rs -+++ b/rust/macros/module.rs -@@ -249,6 +249,7 @@ mod __module_init {{ - #[cfg(MODULE)] - #[doc(hidden)] - #[no_mangle] -+ #[link_section = \".exit.text\"] - pub extern \"C\" fn cleanup_module() {{ - // SAFETY: - // - This function is inaccessible to the outside due to the double -diff --git a/scripts/checkstack.pl b/scripts/checkstack.pl -index f27d552aec43f2..aad423c5181a96 100755 ---- a/scripts/checkstack.pl -+++ b/scripts/checkstack.pl -@@ -68,9 +68,6 @@ my (@stack, $re, $dre, $sub, $x, $xs, $funcre, $min_stack); - # 2f60: 48 81 ec e8 05 00 00 sub $0x5e8,%rsp - $re = qr/^.*[as][du][db] \$(0x$x{1,8}),\%(e|r)sp$/o; - $dre = qr/^.*[as][du][db] (%.*),\%(e|r)sp$/o; -- } elsif ($arch eq 'ia64') { -- #e0000000044011fc: 01 0f fc 8c adds r12=-384,r12 -- $re = qr/.*adds.*r12=-(([0-9]{2}|[3-9])[0-9]{2}),r12/o; - } elsif ($arch eq 'm68k') { - # 2b6c: 4e56 fb70 linkw %fp,#-1168 - # 1df770: defc ffe4 addaw #-28,%sp -diff --git a/scripts/gdb/linux/tasks.py b/scripts/gdb/linux/tasks.py -index 17ec19e9b5bf6a..5be53b372a6938 100644 ---- a/scripts/gdb/linux/tasks.py -+++ b/scripts/gdb/linux/tasks.py -@@ -86,21 +86,12 @@ LxPs() - - thread_info_type = utils.CachedType("struct thread_info") - --ia64_task_size = None -- - - def get_thread_info(task): - thread_info_ptr_type = thread_info_type.get_type().pointer() -- if utils.is_target_arch("ia64"): -- global ia64_task_size -- if ia64_task_size is None: -- ia64_task_size = gdb.parse_and_eval("sizeof(struct task_struct)") -- thread_info_addr = task.address + ia64_task_size -- thread_info = thread_info_addr.cast(thread_info_ptr_type) -- else: -- if task.type.fields()[0].type == thread_info_type.get_type(): -- return task['thread_info'] -- thread_info = task['stack'].cast(thread_info_ptr_type) -+ if task.type.fields()[0].type == thread_info_type.get_type(): -+ return task['thread_info'] -+ thread_info = task['stack'].cast(thread_info_ptr_type) - return thread_info.dereference() - - -diff --git a/scripts/head-object-list.txt b/scripts/head-object-list.txt -index 26359968744ef1..890f69005bab41 100644 ---- a/scripts/head-object-list.txt -+++ b/scripts/head-object-list.txt -@@ -17,7 +17,6 @@ arch/arm/kernel/head-nommu.o - arch/arm/kernel/head.o - arch/csky/kernel/head.o - arch/hexagon/kernel/head.o --arch/ia64/kernel/head.o - arch/loongarch/kernel/head.o - arch/m68k/68000/head.o - arch/m68k/coldfire/head.o -diff --git a/scripts/kconfig/mconf.c b/scripts/kconfig/mconf.c -index eccc87a441e713..3795c36a9181aa 100644 ---- a/scripts/kconfig/mconf.c -+++ b/scripts/kconfig/mconf.c -@@ -247,7 +247,7 @@ search_help[] = - " -> PCI support (PCI [=y])\n" - "(1) -> PCI access mode ( [=y])\n" - " Defined at drivers/pci/Kconfig:47\n" -- " Depends on: X86_LOCAL_APIC && X86_IO_APIC || IA64\n" -+ " Depends on: X86_LOCAL_APIC && X86_IO_APIC\n" - " Selects: LIBCRC32\n" - " Selected by: BAR [=n]\n" - "-----------------------------------------------------------------\n" -diff --git a/scripts/kconfig/nconf.c b/scripts/kconfig/nconf.c -index 143a2c351d5764..8cd72fe2597405 100644 ---- a/scripts/kconfig/nconf.c -+++ b/scripts/kconfig/nconf.c -@@ -216,7 +216,7 @@ search_help[] = - "Symbol: FOO [ = m]\n" - "Prompt: Foo bus is used to drive the bar HW\n" - "Defined at drivers/pci/Kconfig:47\n" --"Depends on: X86_LOCAL_APIC && X86_IO_APIC || IA64\n" -+"Depends on: X86_LOCAL_APIC && X86_IO_APIC\n" - "Location:\n" - " -> Bus options (PCI, PCMCIA, EISA, ISA)\n" - " -> PCI support (PCI [ = y])\n" -diff --git a/scripts/package/kernel.spec b/scripts/package/kernel.spec -index 3eee0143e0c5cc..f58726671fb374 100644 ---- a/scripts/package/kernel.spec -+++ b/scripts/package/kernel.spec -@@ -55,18 +55,12 @@ patch -p1 < %{SOURCE2} - %{make} %{makeflags} KERNELRELEASE=%{KERNELRELEASE} KBUILD_BUILD_VERSION=%{release} - - %install --mkdir -p %{buildroot}/boot --%ifarch ia64 --mkdir -p %{buildroot}/boot/efi --cp $(%{make} %{makeflags} -s image_name) %{buildroot}/boot/efi/vmlinuz-%{KERNELRELEASE} --ln -s efi/vmlinuz-%{KERNELRELEASE} %{buildroot}/boot/ --%else --cp $(%{make} %{makeflags} -s image_name) %{buildroot}/boot/vmlinuz-%{KERNELRELEASE} --%endif -+mkdir -p %{buildroot}/lib/modules/%{KERNELRELEASE} -+cp $(%{make} %{makeflags} -s image_name) %{buildroot}/lib/modules/%{KERNELRELEASE}/vmlinuz - %{make} %{makeflags} INSTALL_MOD_PATH=%{buildroot} modules_install - %{make} %{makeflags} INSTALL_HDR_PATH=%{buildroot}/usr headers_install --cp System.map %{buildroot}/boot/System.map-%{KERNELRELEASE} --cp .config %{buildroot}/boot/config-%{KERNELRELEASE} -+cp System.map %{buildroot}/lib/modules/%{KERNELRELEASE} -+cp .config %{buildroot}/lib/modules/%{KERNELRELEASE}/config - ln -fns /usr/src/kernels/%{KERNELRELEASE} %{buildroot}/lib/modules/%{KERNELRELEASE}/build - %if %{with_devel} - %{make} %{makeflags} run-command KBUILD_RUN_COMMAND='${srctree}/scripts/package/install-extmod-build %{buildroot}/usr/src/kernels/%{KERNELRELEASE}' -@@ -76,13 +70,14 @@ ln -fns /usr/src/kernels/%{KERNELRELEASE} %{buildroot}/lib/modules/%{KERNELRELEA - rm -rf %{buildroot} - - %post --if [ -x /sbin/installkernel -a -r /boot/vmlinuz-%{KERNELRELEASE} -a -r /boot/System.map-%{KERNELRELEASE} ]; then --cp /boot/vmlinuz-%{KERNELRELEASE} /boot/.vmlinuz-%{KERNELRELEASE}-rpm --cp /boot/System.map-%{KERNELRELEASE} /boot/.System.map-%{KERNELRELEASE}-rpm --rm -f /boot/vmlinuz-%{KERNELRELEASE} /boot/System.map-%{KERNELRELEASE} --/sbin/installkernel %{KERNELRELEASE} /boot/.vmlinuz-%{KERNELRELEASE}-rpm /boot/.System.map-%{KERNELRELEASE}-rpm --rm -f /boot/.vmlinuz-%{KERNELRELEASE}-rpm /boot/.System.map-%{KERNELRELEASE}-rpm -+if [ -x /usr/bin/kernel-install ]; then -+ /usr/bin/kernel-install add %{KERNELRELEASE} /lib/modules/%{KERNELRELEASE}/vmlinuz - fi -+for file in vmlinuz System.map config; do -+ if ! cmp --silent "/lib/modules/%{KERNELRELEASE}/${file}" "/boot/${file}-%{KERNELRELEASE}"; then -+ cp "/lib/modules/%{KERNELRELEASE}/${file}" "/boot/${file}-%{KERNELRELEASE}" -+ fi -+done - - %preun - if [ -x /sbin/new-kernel-pkg ]; then -@@ -100,7 +95,6 @@ fi - %defattr (-, root, root) - /lib/modules/%{KERNELRELEASE} - %exclude /lib/modules/%{KERNELRELEASE}/build --/boot/* - - %files headers - %defattr (-, root, root) -diff --git a/scripts/package/mkdebian b/scripts/package/mkdebian -index 5044224cf6714b..c1a36da85e84f6 100755 ---- a/scripts/package/mkdebian -+++ b/scripts/package/mkdebian -@@ -26,7 +26,7 @@ set_debarch() { - - # Attempt to find the correct Debian architecture - case "$UTS_MACHINE" in -- i386|ia64|alpha|m68k|riscv*) -+ i386|alpha|m68k|riscv*) - debarch="$UTS_MACHINE" ;; - x86_64) - debarch=amd64 ;; -diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c -index 40ae6b2c7a6da5..3e4f54799cc0a5 100644 ---- a/scripts/recordmcount.c -+++ b/scripts/recordmcount.c -@@ -590,7 +590,6 @@ static int do_file(char const *const fname) - ideal_nop = ideal_nop4_arm64; - is_fake_mcount64 = arm64_is_fake_mcount; - break; -- case EM_IA_64: reltype = R_IA64_IMM64; break; - case EM_MIPS: /* reltype: e_class */ break; - case EM_LOONGARCH: /* reltype: e_class */ break; - case EM_PPC: reltype = R_PPC_ADDR32; break; -diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl -index 6a4645a5797603..f84df9e383fd0a 100755 ---- a/scripts/recordmcount.pl -+++ b/scripts/recordmcount.pl -@@ -275,13 +275,6 @@ if ($arch eq "x86_64") { - $section_type = '%progbits'; - $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*R_AARCH64_CALL26\\s+_mcount\$"; - $type = ".quad"; --} elsif ($arch eq "ia64") { -- $mcount_regex = "^\\s*([0-9a-fA-F]+):.*\\s_mcount\$"; -- $type = "data8"; -- -- if ($is_module eq "0") { -- $cc .= " -mconstant-gp"; -- } - } elsif ($arch eq "sparc64") { - # In the objdump output there are giblets like: - # 0000000000000000 : -diff --git a/scripts/xz_wrap.sh b/scripts/xz_wrap.sh -index 76e9cbcfbeab45..d06baf626abe79 100755 ---- a/scripts/xz_wrap.sh -+++ b/scripts/xz_wrap.sh -@@ -15,7 +15,6 @@ LZMA2OPTS= - case $SRCARCH in - x86) BCJ=--x86 ;; - powerpc) BCJ=--powerpc ;; -- ia64) BCJ=--ia64; LZMA2OPTS=pb=4 ;; - arm) BCJ=--arm ;; - sparc) BCJ=--sparc ;; - esac -diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c -index b7ca2a83fbb086..95786bdadfe6a5 100644 ---- a/sound/pci/hda/hda_bind.c -+++ b/sound/pci/hda/hda_bind.c -@@ -44,7 +44,7 @@ static void hda_codec_unsol_event(struct hdac_device *dev, unsigned int ev) - struct hda_codec *codec = container_of(dev, struct hda_codec, core); - - /* ignore unsol events during shutdown */ -- if (codec->bus->shutdown) -+ if (codec->card->shutdown || codec->bus->shutdown) - return; - - /* ignore unsol events during system suspend/resume */ -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index 3cd5b7da8e1528..059693e03fd962 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -2727,6 +2727,9 @@ static const struct pci_device_id azx_ids[] = { - { PCI_VDEVICE(ATI, 0xab38), - .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS | - AZX_DCAPS_PM_RUNTIME }, -+ { PCI_VDEVICE(ATI, 0xab40), -+ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS | -+ AZX_DCAPS_PM_RUNTIME }, - /* GLENFLY */ - { PCI_DEVICE(PCI_VENDOR_ID_GLENFLY, PCI_ANY_ID), - .class = PCI_CLASS_MULTIMEDIA_HD_AUDIO << 8, -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 82210b1e3b9782..0d367cec03adef 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -10325,6 +10325,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE), - SND_PCI_QUIRK(0x1043, 0x1da2, "ASUS UP6502ZA/ZD", ALC245_FIXUP_CS35L41_SPI_2), - SND_PCI_QUIRK(0x1043, 0x1e02, "ASUS UX3402ZA", ALC245_FIXUP_CS35L41_SPI_2), -+ SND_PCI_QUIRK(0x1043, 0x1e10, "ASUS VivoBook X507UAR", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502), - SND_PCI_QUIRK(0x1043, 0x1e12, "ASUS UM3402", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS), -diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c -index 9fdee74c28df27..40e2b5a87916a8 100644 ---- a/sound/soc/amd/yc/acp6x-mach.c -+++ b/sound/soc/amd/yc/acp6x-mach.c -@@ -353,6 +353,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "83J2"), - } - }, -+ { -+ .driver_data = &acp6x_card, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "83J3"), -+ } -+ }, - { - .driver_data = &acp6x_card, - .matches = { -diff --git a/sound/soc/codecs/wcd9335.c b/sound/soc/codecs/wcd9335.c -index a05b553e6472f4..8d5d186fd58022 100644 ---- a/sound/soc/codecs/wcd9335.c -+++ b/sound/soc/codecs/wcd9335.c -@@ -16,7 +16,7 @@ - #include - #include - #include --#include -+#include - #include - #include - #include -@@ -329,8 +329,7 @@ struct wcd9335_codec { - int comp_enabled[COMPANDER_MAX]; - - int intr1; -- int reset_gpio; -- struct regulator_bulk_data supplies[WCD9335_MAX_SUPPLY]; -+ struct gpio_desc *reset_gpio; - - unsigned int rx_port_value[WCD9335_RX_MAX]; - unsigned int tx_port_value[WCD9335_TX_MAX]; -@@ -357,6 +356,10 @@ struct wcd9335_irq { - char *name; - }; - -+static const char * const wcd9335_supplies[] = { -+ "vdd-buck", "vdd-buck-sido", "vdd-tx", "vdd-rx", "vdd-io", -+}; -+ - static const struct wcd9335_slim_ch wcd9335_tx_chs[WCD9335_TX_MAX] = { - WCD9335_SLIM_TX_CH(0), - WCD9335_SLIM_TX_CH(1), -@@ -5032,53 +5035,30 @@ static const struct regmap_irq_chip wcd9335_regmap_irq1_chip = { - static int wcd9335_parse_dt(struct wcd9335_codec *wcd) - { - struct device *dev = wcd->dev; -- struct device_node *np = dev->of_node; - int ret; - -- wcd->reset_gpio = of_get_named_gpio(np, "reset-gpios", 0); -- if (wcd->reset_gpio < 0) { -- dev_err(dev, "Reset GPIO missing from DT\n"); -- return wcd->reset_gpio; -- } -+ wcd->reset_gpio = devm_gpiod_get(dev, "reset", GPIOD_OUT_LOW); -+ if (IS_ERR(wcd->reset_gpio)) -+ return dev_err_probe(dev, PTR_ERR(wcd->reset_gpio), "Reset GPIO missing from DT\n"); - - wcd->mclk = devm_clk_get(dev, "mclk"); -- if (IS_ERR(wcd->mclk)) { -- dev_err(dev, "mclk not found\n"); -- return PTR_ERR(wcd->mclk); -- } -+ if (IS_ERR(wcd->mclk)) -+ return dev_err_probe(dev, PTR_ERR(wcd->mclk), "mclk not found\n"); - - wcd->native_clk = devm_clk_get(dev, "slimbus"); -- if (IS_ERR(wcd->native_clk)) { -- dev_err(dev, "slimbus clock not found\n"); -- return PTR_ERR(wcd->native_clk); -- } -+ if (IS_ERR(wcd->native_clk)) -+ return dev_err_probe(dev, PTR_ERR(wcd->native_clk), "slimbus clock not found\n"); - -- wcd->supplies[0].supply = "vdd-buck"; -- wcd->supplies[1].supply = "vdd-buck-sido"; -- wcd->supplies[2].supply = "vdd-tx"; -- wcd->supplies[3].supply = "vdd-rx"; -- wcd->supplies[4].supply = "vdd-io"; -- -- ret = regulator_bulk_get(dev, WCD9335_MAX_SUPPLY, wcd->supplies); -- if (ret) { -- dev_err(dev, "Failed to get supplies: err = %d\n", ret); -- return ret; -- } -+ ret = devm_regulator_bulk_get_enable(dev, ARRAY_SIZE(wcd9335_supplies), -+ wcd9335_supplies); -+ if (ret) -+ return dev_err_probe(dev, ret, "Failed to get and enable supplies\n"); - - return 0; - } - - static int wcd9335_power_on_reset(struct wcd9335_codec *wcd) - { -- struct device *dev = wcd->dev; -- int ret; -- -- ret = regulator_bulk_enable(WCD9335_MAX_SUPPLY, wcd->supplies); -- if (ret) { -- dev_err(dev, "Failed to get supplies: err = %d\n", ret); -- return ret; -- } -- - /* - * For WCD9335, it takes about 600us for the Vout_A and - * Vout_D to be ready after BUCK_SIDO is powered up. -@@ -5088,9 +5068,9 @@ static int wcd9335_power_on_reset(struct wcd9335_codec *wcd) - */ - usleep_range(600, 650); - -- gpio_direction_output(wcd->reset_gpio, 0); -+ gpiod_set_value(wcd->reset_gpio, 1); - msleep(20); -- gpio_set_value(wcd->reset_gpio, 1); -+ gpiod_set_value(wcd->reset_gpio, 0); - msleep(20); - - return 0; -@@ -5163,10 +5143,8 @@ static int wcd9335_slim_probe(struct slim_device *slim) - - wcd->dev = dev; - ret = wcd9335_parse_dt(wcd); -- if (ret) { -- dev_err(dev, "Error parsing DT: %d\n", ret); -+ if (ret) - return ret; -- } - - ret = wcd9335_power_on_reset(wcd); - if (ret) -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index 0b8b20550ab381..f19c808444c97a 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -2182,6 +2182,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { - QUIRK_FLAG_DISABLE_AUTOSUSPEND), - DEVICE_FLG(0x17aa, 0x104d, /* Lenovo ThinkStation P620 Internal Speaker + Front Headset */ - QUIRK_FLAG_DISABLE_AUTOSUSPEND), -+ DEVICE_FLG(0x17ef, 0x3083, /* Lenovo TBT3 dock */ -+ QUIRK_FLAG_GET_SAMPLE_RATE), - DEVICE_FLG(0x1852, 0x5062, /* Luxman D-08u */ - QUIRK_FLAG_ITF_USB_DSD_DAC | QUIRK_FLAG_CTL_MSG_DELAY), - DEVICE_FLG(0x1852, 0x5065, /* Luxman DA-06 */ -diff --git a/sound/usb/stream.c b/sound/usb/stream.c -index e14c725acebf2c..0f1558ef855535 100644 ---- a/sound/usb/stream.c -+++ b/sound/usb/stream.c -@@ -982,6 +982,8 @@ snd_usb_get_audioformat_uac3(struct snd_usb_audio *chip, - * and request Cluster Descriptor - */ - wLength = le16_to_cpu(hc_header.wLength); -+ if (wLength < sizeof(cluster)) -+ return NULL; - cluster = kzalloc(wLength, GFP_KERNEL); - if (!cluster) - return ERR_PTR(-ENOMEM); -diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c -index ebf56d21d08eed..cf4db51b99eb5d 100644 ---- a/tools/lib/bpf/btf_dump.c -+++ b/tools/lib/bpf/btf_dump.c -@@ -225,6 +225,9 @@ static void btf_dump_free_names(struct hashmap *map) - size_t bkt; - struct hashmap_entry *cur; - -+ if (!map) -+ return; -+ - hashmap__for_each_entry(map, cur, bkt) - free((void *)cur->pkey); - -diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c -index 5dc2e555533586..aefbfa2df6207c 100644 ---- a/tools/lib/bpf/libbpf.c -+++ b/tools/lib/bpf/libbpf.c -@@ -554,7 +554,7 @@ struct extern_desc { - int sym_idx; - int btf_id; - int sec_btf_id; -- const char *name; -+ char *name; - char *essent_name; - bool is_set; - bool is_weak; -@@ -3822,7 +3822,9 @@ static int bpf_object__collect_externs(struct bpf_object *obj) - return ext->btf_id; - } - t = btf__type_by_id(obj->btf, ext->btf_id); -- ext->name = btf__name_by_offset(obj->btf, t->name_off); -+ ext->name = strdup(btf__name_by_offset(obj->btf, t->name_off)); -+ if (!ext->name) -+ return -ENOMEM; - ext->sym_idx = i; - ext->is_weak = ELF64_ST_BIND(sym->st_info) == STB_WEAK; - -@@ -8457,8 +8459,10 @@ void bpf_object__close(struct bpf_object *obj) - zfree(&obj->btf_custom_path); - zfree(&obj->kconfig); - -- for (i = 0; i < obj->nr_extern; i++) -+ for (i = 0; i < obj->nr_extern; i++) { -+ zfree(&obj->externs[i].name); - zfree(&obj->externs[i].essent_name); -+ } - - zfree(&obj->externs); - obj->nr_extern = 0; -diff --git a/tools/testing/selftests/bpf/progs/test_global_map_resize.c b/tools/testing/selftests/bpf/progs/test_global_map_resize.c -index 1fbb73d3e5d5a0..9be0e32cfeeea4 100644 ---- a/tools/testing/selftests/bpf/progs/test_global_map_resize.c -+++ b/tools/testing/selftests/bpf/progs/test_global_map_resize.c -@@ -31,6 +31,16 @@ int my_int_last SEC(".data.array_not_last"); - - int percpu_arr[1] SEC(".data.percpu_arr"); - -+/* at least one extern is included, to ensure that a specific -+ * regression is tested whereby resizing resulted in a free-after-use -+ * bug after type information is invalidated by the resize operation. -+ * -+ * There isn't a particularly good API to test for this specific condition, -+ * but by having externs for the resizing tests it will cover this path. -+ */ -+extern int LINUX_KERNEL_VERSION __kconfig; -+long version_sink; -+ - SEC("tp/syscalls/sys_enter_getpid") - int bss_array_sum(void *ctx) - { -@@ -43,6 +53,9 @@ int bss_array_sum(void *ctx) - for (size_t i = 0; i < bss_array_len; ++i) - sum += array[i]; - -+ /* see above; ensure this is not optimized out */ -+ version_sink = LINUX_KERNEL_VERSION; -+ - return 0; - } - -@@ -58,5 +71,8 @@ int data_array_sum(void *ctx) - for (size_t i = 0; i < data_array_len; ++i) - sum += my_array[i]; - -+ /* see above; ensure this is not optimized out */ -+ version_sink = LINUX_KERNEL_VERSION; -+ - return 0; - } diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.096-097.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.096-097.patch deleted file mode 100644 index 36cf6a967f..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.096-097.patch +++ /dev/null @@ -1,6094 +0,0 @@ -diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu -index 0426ec112155ec..868ec736a9d235 100644 ---- a/Documentation/ABI/testing/sysfs-devices-system-cpu -+++ b/Documentation/ABI/testing/sysfs-devices-system-cpu -@@ -526,6 +526,7 @@ What: /sys/devices/system/cpu/vulnerabilities - /sys/devices/system/cpu/vulnerabilities/spectre_v1 - /sys/devices/system/cpu/vulnerabilities/spectre_v2 - /sys/devices/system/cpu/vulnerabilities/srbds -+ /sys/devices/system/cpu/vulnerabilities/tsa - /sys/devices/system/cpu/vulnerabilities/tsx_async_abort - Date: January 2018 - Contact: Linux kernel mailing list -diff --git a/Documentation/ABI/testing/sysfs-driver-ufs b/Documentation/ABI/testing/sysfs-driver-ufs -index 0c7efaf62de0c0..84131641580c95 100644 ---- a/Documentation/ABI/testing/sysfs-driver-ufs -+++ b/Documentation/ABI/testing/sysfs-driver-ufs -@@ -711,7 +711,7 @@ Description: This file shows the thin provisioning type. This is one of - - The file is read only. - --What: /sys/class/scsi_device/*/device/unit_descriptor/physical_memory_resourse_count -+What: /sys/class/scsi_device/*/device/unit_descriptor/physical_memory_resource_count - Date: February 2018 - Contact: Stanislav Nijnikov - Description: This file shows the total physical memory resources. This is -diff --git a/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst b/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst -index c98fd11907cc87..e916dc232b0f0c 100644 ---- a/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst -+++ b/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst -@@ -157,9 +157,7 @@ This is achieved by using the otherwise unused and obsolete VERW instruction in - combination with a microcode update. The microcode clears the affected CPU - buffers when the VERW instruction is executed. - --Kernel reuses the MDS function to invoke the buffer clearing: -- -- mds_clear_cpu_buffers() -+Kernel does the buffer clearing with x86_clear_cpu_buffers(). - - On MDS affected CPUs, the kernel already invokes CPU buffer clear on - kernel/userspace, hypervisor/guest and C-state (idle) transitions. No -diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt -index f95734ceb82b86..bcfa49019c3f16 100644 ---- a/Documentation/admin-guide/kernel-parameters.txt -+++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -6645,6 +6645,19 @@ - If not specified, "default" is used. In this case, - the RNG's choice is left to each individual trust source. - -+ tsa= [X86] Control mitigation for Transient Scheduler -+ Attacks on AMD CPUs. Search the following in your -+ favourite search engine for more details: -+ -+ "Technical guidance for mitigating transient scheduler -+ attacks". -+ -+ off - disable the mitigation -+ on - enable the mitigation (default) -+ user - mitigate only user/kernel transitions -+ vm - mitigate only guest/host transitions -+ -+ - tsc= Disable clocksource stability checks for TSC. - Format: - [x86] reliable: mark tsc clocksource as reliable, this -diff --git a/Documentation/arch/x86/mds.rst b/Documentation/arch/x86/mds.rst -index c58c72362911cd..43106f349cc35f 100644 ---- a/Documentation/arch/x86/mds.rst -+++ b/Documentation/arch/x86/mds.rst -@@ -93,7 +93,7 @@ enters a C-state. - - The kernel provides a function to invoke the buffer clearing: - -- mds_clear_cpu_buffers() -+ x86_clear_cpu_buffers() - - Also macro CLEAR_CPU_BUFFERS can be used in ASM late in exit-to-user path. - Other than CFLAGS.ZF, this macro doesn't clobber any registers. -@@ -185,9 +185,9 @@ Mitigation points - idle clearing would be a window dressing exercise and is therefore not - activated. - -- The invocation is controlled by the static key mds_idle_clear which is -- switched depending on the chosen mitigation mode and the SMT state of -- the system. -+ The invocation is controlled by the static key cpu_buf_idle_clear which is -+ switched depending on the chosen mitigation mode and the SMT state of the -+ system. - - The buffer clear is only invoked before entering the C-State to prevent - that stale data from the idling CPU from spilling to the Hyper-Thread -diff --git a/Documentation/core-api/symbol-namespaces.rst b/Documentation/core-api/symbol-namespaces.rst -index 12e4aecdae9452..29875e25e376f6 100644 ---- a/Documentation/core-api/symbol-namespaces.rst -+++ b/Documentation/core-api/symbol-namespaces.rst -@@ -28,6 +28,9 @@ kernel. As of today, modules that make use of symbols exported into namespaces, - are required to import the namespace. Otherwise the kernel will, depending on - its configuration, reject loading the module or warn about a missing import. - -+Additionally, it is possible to put symbols into a module namespace, strictly -+limiting which modules are allowed to use these symbols. -+ - 2. How to define Symbol Namespaces - ================================== - -@@ -84,6 +87,22 @@ unit as preprocessor statement. The above example would then read:: - within the corresponding compilation unit before any EXPORT_SYMBOL macro is - used. - -+2.3 Using the EXPORT_SYMBOL_GPL_FOR_MODULES() macro -+=================================================== -+ -+Symbols exported using this macro are put into a module namespace. This -+namespace cannot be imported. -+ -+The macro takes a comma separated list of module names, allowing only those -+modules to access this symbol. Simple tail-globs are supported. -+ -+For example: -+ -+ EXPORT_SYMBOL_GPL_FOR_MODULES(preempt_notifier_inc, "kvm,kvm-*") -+ -+will limit usage of this symbol to modules whoes name matches the given -+patterns. -+ - 3. How to use Symbols exported in Namespaces - ============================================ - -@@ -155,3 +174,6 @@ in-tree modules:: - You can also run nsdeps for external module builds. A typical usage is:: - - $ make -C M=$PWD nsdeps -+ -+Note: it will happily generate an import statement for the module namespace; -+which will not work and generates build and runtime failures. -diff --git a/Makefile b/Makefile -index 038fc8e0982bdc..9d5c08363637bd 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 96 -+SUBLEVEL = 97 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm64/boot/dts/apple/t8103-jxxx.dtsi b/arch/arm64/boot/dts/apple/t8103-jxxx.dtsi -index 5988a4eb6efaa0..cb78ce7af0b380 100644 ---- a/arch/arm64/boot/dts/apple/t8103-jxxx.dtsi -+++ b/arch/arm64/boot/dts/apple/t8103-jxxx.dtsi -@@ -71,7 +71,7 @@ hpm1: usb-pd@3f { - */ - &port00 { - bus-range = <1 1>; -- wifi0: network@0,0 { -+ wifi0: wifi@0,0 { - compatible = "pci14e4,4425"; - reg = <0x10000 0x0 0x0 0x0 0x0>; - /* To be filled by the loader */ -diff --git a/arch/arm64/boot/dts/qcom/sm8550.dtsi b/arch/arm64/boot/dts/qcom/sm8550.dtsi -index c14c6f8583d548..2f0f1c2ab7391f 100644 ---- a/arch/arm64/boot/dts/qcom/sm8550.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm8550.dtsi -@@ -1064,6 +1064,20 @@ spi13: spi@894000 { - status = "disabled"; - }; - -+ uart14: serial@898000 { -+ compatible = "qcom,geni-uart"; -+ reg = <0 0x898000 0 0x4000>; -+ clock-names = "se"; -+ clocks = <&gcc GCC_QUPV3_WRAP2_S6_CLK>; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&qup_uart14_default>, <&qup_uart14_cts_rts>; -+ interrupts = ; -+ interconnects = <&clk_virt MASTER_QUP_CORE_2 0 &clk_virt SLAVE_QUP_CORE_2 0>, -+ <&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_2 0>; -+ interconnect-names = "qup-core", "qup-config"; -+ status = "disabled"; -+ }; -+ - i2c15: i2c@89c000 { - compatible = "qcom,geni-i2c"; - reg = <0 0x0089c000 0 0x4000>; -@@ -3640,6 +3654,22 @@ qup_uart7_default: qup-uart7-default-state { - bias-disable; - }; - -+ qup_uart14_default: qup-uart14-default-state { -+ /* TX, RX */ -+ pins = "gpio78", "gpio79"; -+ function = "qup2_se6"; -+ drive-strength = <2>; -+ bias-pull-up; -+ }; -+ -+ qup_uart14_cts_rts: qup-uart14-cts-rts-state { -+ /* CTS, RTS */ -+ pins = "gpio76", "gpio77"; -+ function = "qup2_se6"; -+ drive-strength = <2>; -+ bias-pull-down; -+ }; -+ - sdc2_sleep: sdc2-sleep-state { - clk-pins { - pins = "sdc2_clk"; -diff --git a/arch/powerpc/include/uapi/asm/ioctls.h b/arch/powerpc/include/uapi/asm/ioctls.h -index 2c145da3b774a1..b5211e413829a2 100644 ---- a/arch/powerpc/include/uapi/asm/ioctls.h -+++ b/arch/powerpc/include/uapi/asm/ioctls.h -@@ -23,10 +23,10 @@ - #define TCSETSW _IOW('t', 21, struct termios) - #define TCSETSF _IOW('t', 22, struct termios) - --#define TCGETA _IOR('t', 23, struct termio) --#define TCSETA _IOW('t', 24, struct termio) --#define TCSETAW _IOW('t', 25, struct termio) --#define TCSETAF _IOW('t', 28, struct termio) -+#define TCGETA 0x40147417 /* _IOR('t', 23, struct termio) */ -+#define TCSETA 0x80147418 /* _IOW('t', 24, struct termio) */ -+#define TCSETAW 0x80147419 /* _IOW('t', 25, struct termio) */ -+#define TCSETAF 0x8014741c /* _IOW('t', 28, struct termio) */ - - #define TCSBRK _IO('t', 29) - #define TCXONC _IO('t', 30) -diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile -index b7629122680b1e..131c859b24679e 100644 ---- a/arch/powerpc/kernel/Makefile -+++ b/arch/powerpc/kernel/Makefile -@@ -165,9 +165,7 @@ endif - - obj64-$(CONFIG_PPC_TRANSACTIONAL_MEM) += tm.o - --ifneq ($(CONFIG_XMON)$(CONFIG_KEXEC_CORE)$(CONFIG_PPC_BOOK3S),) - obj-y += ppc_save_regs.o --endif - - obj-$(CONFIG_EPAPR_PARAVIRT) += epapr_paravirt.o epapr_hcalls.o - obj-$(CONFIG_KVM_GUEST) += kvm.o kvm_emul.o -diff --git a/arch/s390/pci/pci_event.c b/arch/s390/pci/pci_event.c -index b3961f1016ea0b..d969f36bf186f2 100644 ---- a/arch/s390/pci/pci_event.c -+++ b/arch/s390/pci/pci_event.c -@@ -98,6 +98,10 @@ static pci_ers_result_t zpci_event_do_error_state_clear(struct pci_dev *pdev, - struct zpci_dev *zdev = to_zpci(pdev); - int rc; - -+ /* The underlying device may have been disabled by the event */ -+ if (!zdev_enabled(zdev)) -+ return PCI_ERS_RESULT_NEED_RESET; -+ - pr_info("%s: Unblocking device access for examination\n", pci_name(pdev)); - rc = zpci_reset_load_store_blocked(zdev); - if (rc) { -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 4372657ab0d6fa..caa6adcedc18dd 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -2621,6 +2621,15 @@ config MITIGATION_ITS - disabled, mitigation cannot be enabled via cmdline. - See - -+config MITIGATION_TSA -+ bool "Mitigate Transient Scheduler Attacks" -+ depends on CPU_SUP_AMD -+ default y -+ help -+ Enable mitigation for Transient Scheduler Attacks. TSA is a hardware -+ security vulnerability on AMD CPUs which can lead to forwarding of -+ invalid info to subsequent instructions and thus can affect their -+ timing and thereby cause a leakage. - endif - - config ARCH_HAS_ADD_PAGES -diff --git a/arch/x86/entry/entry.S b/arch/x86/entry/entry.S -index ad292c0d971a3f..4e7ecffee762ad 100644 ---- a/arch/x86/entry/entry.S -+++ b/arch/x86/entry/entry.S -@@ -31,20 +31,20 @@ EXPORT_SYMBOL_GPL(entry_ibpb); - - /* - * Define the VERW operand that is disguised as entry code so that -- * it can be referenced with KPTI enabled. This ensure VERW can be -+ * it can be referenced with KPTI enabled. This ensures VERW can be - * used late in exit-to-user path after page tables are switched. - */ - .pushsection .entry.text, "ax" - - .align L1_CACHE_BYTES, 0xcc --SYM_CODE_START_NOALIGN(mds_verw_sel) -+SYM_CODE_START_NOALIGN(x86_verw_sel) - UNWIND_HINT_UNDEFINED - ANNOTATE_NOENDBR - .word __KERNEL_DS - .align L1_CACHE_BYTES, 0xcc --SYM_CODE_END(mds_verw_sel); -+SYM_CODE_END(x86_verw_sel); - /* For KVM */ --EXPORT_SYMBOL_GPL(mds_verw_sel); -+EXPORT_SYMBOL_GPL(x86_verw_sel); - - .popsection - -diff --git a/arch/x86/include/asm/cpu.h b/arch/x86/include/asm/cpu.h -index fecc4fe1d68aff..9c67f8b4c91971 100644 ---- a/arch/x86/include/asm/cpu.h -+++ b/arch/x86/include/asm/cpu.h -@@ -81,4 +81,16 @@ int intel_microcode_sanity_check(void *mc, bool print_err, int hdr_type); - - extern struct cpumask cpus_stop_mask; - -+union zen_patch_rev { -+ struct { -+ __u32 rev : 8, -+ stepping : 4, -+ model : 4, -+ __reserved : 4, -+ ext_model : 4, -+ ext_fam : 8; -+ }; -+ __u32 ucode_rev; -+}; -+ - #endif /* _ASM_X86_CPU_H */ -diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h -index 8a2482651a6f1e..311cc58f29581d 100644 ---- a/arch/x86/include/asm/cpufeatures.h -+++ b/arch/x86/include/asm/cpufeatures.h -@@ -449,6 +449,7 @@ - /* AMD-defined Extended Feature 2 EAX, CPUID level 0x80000021 (EAX), word 20 */ - #define X86_FEATURE_NO_NESTED_DATA_BP (20*32+ 0) /* "" No Nested Data Breakpoints */ - #define X86_FEATURE_LFENCE_RDTSC (20*32+ 2) /* "" LFENCE always serializing / synchronizes RDTSC */ -+#define X86_FEATURE_VERW_CLEAR (20*32+ 5) /* "" The memory form of VERW mitigates TSA */ - #define X86_FEATURE_NULL_SEL_CLR_BASE (20*32+ 6) /* "" Null Selector Clears Base */ - #define X86_FEATURE_AUTOIBRS (20*32+ 8) /* "" Automatic IBRS */ - #define X86_FEATURE_NO_SMM_CTL_MSR (20*32+ 9) /* "" SMM_CTL MSR is not present */ -@@ -470,6 +471,10 @@ - #define X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT (21*32+ 4) /* "" Clear branch history at vmexit using SW loop */ - #define X86_FEATURE_INDIRECT_THUNK_ITS (21*32 + 5) /* "" Use thunk for indirect branches in lower half of cacheline */ - -+#define X86_FEATURE_TSA_SQ_NO (21*32+11) /* "" AMD CPU not vulnerable to TSA-SQ */ -+#define X86_FEATURE_TSA_L1_NO (21*32+12) /* "" AMD CPU not vulnerable to TSA-L1 */ -+#define X86_FEATURE_CLEAR_CPU_BUF_VM (21*32+13) /* "" Clear CPU buffers using VERW before VMRUN */ -+ - /* - * BUG word(s) - */ -@@ -521,4 +526,5 @@ - #define X86_BUG_IBPB_NO_RET X86_BUG(1*32 + 4) /* "ibpb_no_ret" IBPB omits return target predictions */ - #define X86_BUG_ITS X86_BUG(1*32 + 5) /* CPU is affected by Indirect Target Selection */ - #define X86_BUG_ITS_NATIVE_ONLY X86_BUG(1*32 + 6) /* CPU is affected by ITS, VMX is not affected */ -+#define X86_BUG_TSA X86_BUG(1*32+ 9) /* "tsa" CPU is affected by Transient Scheduler Attacks */ - #endif /* _ASM_X86_CPUFEATURES_H */ -diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h -index 9acfe2bcf1fd5b..9bfb7b90e2990e 100644 ---- a/arch/x86/include/asm/irqflags.h -+++ b/arch/x86/include/asm/irqflags.h -@@ -44,13 +44,13 @@ static __always_inline void native_irq_enable(void) - - static __always_inline void native_safe_halt(void) - { -- mds_idle_clear_cpu_buffers(); -+ x86_idle_clear_cpu_buffers(); - asm volatile("sti; hlt": : :"memory"); - } - - static __always_inline void native_halt(void) - { -- mds_idle_clear_cpu_buffers(); -+ x86_idle_clear_cpu_buffers(); - asm volatile("hlt": : :"memory"); - } - -diff --git a/arch/x86/include/asm/mwait.h b/arch/x86/include/asm/mwait.h -index a541411d9226ef..ae7a83e3f743e0 100644 ---- a/arch/x86/include/asm/mwait.h -+++ b/arch/x86/include/asm/mwait.h -@@ -44,8 +44,6 @@ static __always_inline void __monitorx(const void *eax, unsigned long ecx, - - static __always_inline void __mwait(unsigned long eax, unsigned long ecx) - { -- mds_idle_clear_cpu_buffers(); -- - /* "mwait %eax, %ecx;" */ - asm volatile(".byte 0x0f, 0x01, 0xc9;" - :: "a" (eax), "c" (ecx)); -@@ -80,7 +78,7 @@ static __always_inline void __mwait(unsigned long eax, unsigned long ecx) - static __always_inline void __mwaitx(unsigned long eax, unsigned long ebx, - unsigned long ecx) - { -- /* No MDS buffer clear as this is AMD/HYGON only */ -+ /* No need for TSA buffer clearing on AMD */ - - /* "mwaitx %eax, %ebx, %ecx;" */ - asm volatile(".byte 0x0f, 0x01, 0xfb;" -@@ -89,7 +87,7 @@ static __always_inline void __mwaitx(unsigned long eax, unsigned long ebx, - - static __always_inline void __sti_mwait(unsigned long eax, unsigned long ecx) - { -- mds_idle_clear_cpu_buffers(); -+ - /* "mwait %eax, %ecx;" */ - asm volatile("sti; .byte 0x0f, 0x01, 0xc9;" - :: "a" (eax), "c" (ecx)); -@@ -107,21 +105,29 @@ static __always_inline void __sti_mwait(unsigned long eax, unsigned long ecx) - */ - static __always_inline void mwait_idle_with_hints(unsigned long eax, unsigned long ecx) - { -+ if (need_resched()) -+ return; -+ -+ x86_idle_clear_cpu_buffers(); -+ - if (static_cpu_has_bug(X86_BUG_MONITOR) || !current_set_polling_and_test()) { - const void *addr = ¤t_thread_info()->flags; - - alternative_input("", "clflush (%[addr])", X86_BUG_CLFLUSH_MONITOR, [addr] "a" (addr)); - __monitor(addr, 0, 0); - -- if (!need_resched()) { -- if (ecx & 1) { -- __mwait(eax, ecx); -- } else { -- __sti_mwait(eax, ecx); -- raw_local_irq_disable(); -- } -+ if (need_resched()) -+ goto out; -+ -+ if (ecx & 1) { -+ __mwait(eax, ecx); -+ } else { -+ __sti_mwait(eax, ecx); -+ raw_local_irq_disable(); - } - } -+ -+out: - current_clr_polling(); - } - -diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h -index bc4fa6d09d29d9..04f5a41c3a04ed 100644 ---- a/arch/x86/include/asm/nospec-branch.h -+++ b/arch/x86/include/asm/nospec-branch.h -@@ -324,25 +324,31 @@ - .endm - - /* -- * Macro to execute VERW instruction that mitigate transient data sampling -- * attacks such as MDS. On affected systems a microcode update overloaded VERW -- * instruction to also clear the CPU buffers. VERW clobbers CFLAGS.ZF. -- * -+ * Macro to execute VERW insns that mitigate transient data sampling -+ * attacks such as MDS or TSA. On affected systems a microcode update -+ * overloaded VERW insns to also clear the CPU buffers. VERW clobbers -+ * CFLAGS.ZF. - * Note: Only the memory operand variant of VERW clears the CPU buffers. - */ --.macro CLEAR_CPU_BUFFERS -+.macro __CLEAR_CPU_BUFFERS feature - #ifdef CONFIG_X86_64 -- ALTERNATIVE "", "verw mds_verw_sel(%rip)", X86_FEATURE_CLEAR_CPU_BUF -+ ALTERNATIVE "", "verw x86_verw_sel(%rip)", \feature - #else - /* - * In 32bit mode, the memory operand must be a %cs reference. The data - * segments may not be usable (vm86 mode), and the stack segment may not - * be flat (ESPFIX32). - */ -- ALTERNATIVE "", "verw %cs:mds_verw_sel", X86_FEATURE_CLEAR_CPU_BUF -+ ALTERNATIVE "", "verw %cs:x86_verw_sel", \feature - #endif - .endm - -+#define CLEAR_CPU_BUFFERS \ -+ __CLEAR_CPU_BUFFERS X86_FEATURE_CLEAR_CPU_BUF -+ -+#define VM_CLEAR_CPU_BUFFERS \ -+ __CLEAR_CPU_BUFFERS X86_FEATURE_CLEAR_CPU_BUF_VM -+ - #ifdef CONFIG_X86_64 - .macro CLEAR_BRANCH_HISTORY - ALTERNATIVE "", "call clear_bhb_loop", X86_FEATURE_CLEAR_BHB_LOOP -@@ -592,24 +598,24 @@ DECLARE_STATIC_KEY_FALSE(switch_to_cond_stibp); - DECLARE_STATIC_KEY_FALSE(switch_mm_cond_ibpb); - DECLARE_STATIC_KEY_FALSE(switch_mm_always_ibpb); - --DECLARE_STATIC_KEY_FALSE(mds_idle_clear); -+DECLARE_STATIC_KEY_FALSE(cpu_buf_idle_clear); - - DECLARE_STATIC_KEY_FALSE(switch_mm_cond_l1d_flush); - - DECLARE_STATIC_KEY_FALSE(mmio_stale_data_clear); - --extern u16 mds_verw_sel; -+extern u16 x86_verw_sel; - - #include - - /** -- * mds_clear_cpu_buffers - Mitigation for MDS and TAA vulnerability -+ * x86_clear_cpu_buffers - Buffer clearing support for different x86 CPU vulns - * - * This uses the otherwise unused and obsolete VERW instruction in - * combination with microcode which triggers a CPU buffer flush when the - * instruction is executed. - */ --static __always_inline void mds_clear_cpu_buffers(void) -+static __always_inline void x86_clear_cpu_buffers(void) - { - static const u16 ds = __KERNEL_DS; - -@@ -626,14 +632,15 @@ static __always_inline void mds_clear_cpu_buffers(void) - } - - /** -- * mds_idle_clear_cpu_buffers - Mitigation for MDS vulnerability -+ * x86_idle_clear_cpu_buffers - Buffer clearing support in idle for the MDS -+ * and TSA vulnerabilities. - * - * Clear CPU buffers if the corresponding static key is enabled - */ --static __always_inline void mds_idle_clear_cpu_buffers(void) -+static __always_inline void x86_idle_clear_cpu_buffers(void) - { -- if (static_branch_likely(&mds_idle_clear)) -- mds_clear_cpu_buffers(); -+ if (static_branch_likely(&cpu_buf_idle_clear)) -+ x86_clear_cpu_buffers(); - } - - #endif /* __ASSEMBLY__ */ -diff --git a/arch/x86/include/uapi/asm/debugreg.h b/arch/x86/include/uapi/asm/debugreg.h -index 0007ba077c0c2b..41da492dfb01f0 100644 ---- a/arch/x86/include/uapi/asm/debugreg.h -+++ b/arch/x86/include/uapi/asm/debugreg.h -@@ -15,7 +15,26 @@ - which debugging register was responsible for the trap. The other bits - are either reserved or not of interest to us. */ - --/* Define reserved bits in DR6 which are always set to 1 */ -+/* -+ * Define bits in DR6 which are set to 1 by default. -+ * -+ * This is also the DR6 architectural value following Power-up, Reset or INIT. -+ * -+ * Note, with the introduction of Bus Lock Detection (BLD) and Restricted -+ * Transactional Memory (RTM), the DR6 register has been modified: -+ * -+ * 1) BLD flag (bit 11) is no longer reserved to 1 if the CPU supports -+ * Bus Lock Detection. The assertion of a bus lock could clear it. -+ * -+ * 2) RTM flag (bit 16) is no longer reserved to 1 if the CPU supports -+ * restricted transactional memory. #DB occurred inside an RTM region -+ * could clear it. -+ * -+ * Apparently, DR6.BLD and DR6.RTM are active low bits. -+ * -+ * As a result, DR6_RESERVED is an incorrect name now, but it is kept for -+ * compatibility. -+ */ - #define DR6_RESERVED (0xFFFF0FF0) - - #define DR_TRAP0 (0x1) /* db0 */ -diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c -index 498f2753777292..1180689a239037 100644 ---- a/arch/x86/kernel/cpu/amd.c -+++ b/arch/x86/kernel/cpu/amd.c -@@ -539,6 +539,63 @@ static void early_init_amd_mc(struct cpuinfo_x86 *c) - #endif - } - -+static bool amd_check_tsa_microcode(void) -+{ -+ struct cpuinfo_x86 *c = &boot_cpu_data; -+ union zen_patch_rev p; -+ u32 min_rev = 0; -+ -+ p.ext_fam = c->x86 - 0xf; -+ p.model = c->x86_model; -+ p.stepping = c->x86_stepping; -+ -+ if (cpu_has(c, X86_FEATURE_ZEN3) || -+ cpu_has(c, X86_FEATURE_ZEN4)) { -+ switch (p.ucode_rev >> 8) { -+ case 0xa0011: min_rev = 0x0a0011d7; break; -+ case 0xa0012: min_rev = 0x0a00123b; break; -+ case 0xa0082: min_rev = 0x0a00820d; break; -+ case 0xa1011: min_rev = 0x0a10114c; break; -+ case 0xa1012: min_rev = 0x0a10124c; break; -+ case 0xa1081: min_rev = 0x0a108109; break; -+ case 0xa2010: min_rev = 0x0a20102e; break; -+ case 0xa2012: min_rev = 0x0a201211; break; -+ case 0xa4041: min_rev = 0x0a404108; break; -+ case 0xa5000: min_rev = 0x0a500012; break; -+ case 0xa6012: min_rev = 0x0a60120a; break; -+ case 0xa7041: min_rev = 0x0a704108; break; -+ case 0xa7052: min_rev = 0x0a705208; break; -+ case 0xa7080: min_rev = 0x0a708008; break; -+ case 0xa70c0: min_rev = 0x0a70c008; break; -+ case 0xaa002: min_rev = 0x0aa00216; break; -+ default: -+ pr_debug("%s: ucode_rev: 0x%x, current revision: 0x%x\n", -+ __func__, p.ucode_rev, c->microcode); -+ return false; -+ } -+ } -+ -+ if (!min_rev) -+ return false; -+ -+ return c->microcode >= min_rev; -+} -+ -+static void tsa_init(struct cpuinfo_x86 *c) -+{ -+ if (cpu_has(c, X86_FEATURE_HYPERVISOR)) -+ return; -+ -+ if (cpu_has(c, X86_FEATURE_ZEN3) || -+ cpu_has(c, X86_FEATURE_ZEN4)) { -+ if (amd_check_tsa_microcode()) -+ setup_force_cpu_cap(X86_FEATURE_VERW_CLEAR); -+ } else { -+ setup_force_cpu_cap(X86_FEATURE_TSA_SQ_NO); -+ setup_force_cpu_cap(X86_FEATURE_TSA_L1_NO); -+ } -+} -+ - static void bsp_init_amd(struct cpuinfo_x86 *c) - { - if (cpu_has(c, X86_FEATURE_CONSTANT_TSC)) { -@@ -645,6 +702,9 @@ static void bsp_init_amd(struct cpuinfo_x86 *c) - break; - } - -+ -+ tsa_init(c); -+ - return; - - warn: -diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c -index 07b45bbf6348de..c4d5ac99c6af84 100644 ---- a/arch/x86/kernel/cpu/bugs.c -+++ b/arch/x86/kernel/cpu/bugs.c -@@ -50,6 +50,7 @@ static void __init l1d_flush_select_mitigation(void); - static void __init srso_select_mitigation(void); - static void __init gds_select_mitigation(void); - static void __init its_select_mitigation(void); -+static void __init tsa_select_mitigation(void); - - /* The base value of the SPEC_CTRL MSR without task-specific bits set */ - u64 x86_spec_ctrl_base; -@@ -122,9 +123,9 @@ DEFINE_STATIC_KEY_FALSE(switch_mm_cond_ibpb); - /* Control unconditional IBPB in switch_mm() */ - DEFINE_STATIC_KEY_FALSE(switch_mm_always_ibpb); - --/* Control MDS CPU buffer clear before idling (halt, mwait) */ --DEFINE_STATIC_KEY_FALSE(mds_idle_clear); --EXPORT_SYMBOL_GPL(mds_idle_clear); -+/* Control CPU buffer clear before idling (halt, mwait) */ -+DEFINE_STATIC_KEY_FALSE(cpu_buf_idle_clear); -+EXPORT_SYMBOL_GPL(cpu_buf_idle_clear); - - /* - * Controls whether l1d flush based mitigations are enabled, -@@ -185,6 +186,7 @@ void __init cpu_select_mitigations(void) - srso_select_mitigation(); - gds_select_mitigation(); - its_select_mitigation(); -+ tsa_select_mitigation(); - } - - /* -@@ -445,7 +447,7 @@ static void __init mmio_select_mitigation(void) - * is required irrespective of SMT state. - */ - if (!(x86_arch_cap_msr & ARCH_CAP_FBSDP_NO)) -- static_branch_enable(&mds_idle_clear); -+ static_branch_enable(&cpu_buf_idle_clear); - - /* - * Check if the system has the right microcode. -@@ -2082,10 +2084,10 @@ static void update_mds_branch_idle(void) - return; - - if (sched_smt_active()) { -- static_branch_enable(&mds_idle_clear); -+ static_branch_enable(&cpu_buf_idle_clear); - } else if (mmio_mitigation == MMIO_MITIGATION_OFF || - (x86_arch_cap_msr & ARCH_CAP_FBSDP_NO)) { -- static_branch_disable(&mds_idle_clear); -+ static_branch_disable(&cpu_buf_idle_clear); - } - } - -@@ -2093,6 +2095,94 @@ static void update_mds_branch_idle(void) - #define TAA_MSG_SMT "TAA CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html for more details.\n" - #define MMIO_MSG_SMT "MMIO Stale Data CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html for more details.\n" - -+#undef pr_fmt -+#define pr_fmt(fmt) "Transient Scheduler Attacks: " fmt -+ -+enum tsa_mitigations { -+ TSA_MITIGATION_NONE, -+ TSA_MITIGATION_UCODE_NEEDED, -+ TSA_MITIGATION_USER_KERNEL, -+ TSA_MITIGATION_VM, -+ TSA_MITIGATION_FULL, -+}; -+ -+static const char * const tsa_strings[] = { -+ [TSA_MITIGATION_NONE] = "Vulnerable", -+ [TSA_MITIGATION_UCODE_NEEDED] = "Vulnerable: Clear CPU buffers attempted, no microcode", -+ [TSA_MITIGATION_USER_KERNEL] = "Mitigation: Clear CPU buffers: user/kernel boundary", -+ [TSA_MITIGATION_VM] = "Mitigation: Clear CPU buffers: VM", -+ [TSA_MITIGATION_FULL] = "Mitigation: Clear CPU buffers", -+}; -+ -+static enum tsa_mitigations tsa_mitigation __ro_after_init = -+ IS_ENABLED(CONFIG_MITIGATION_TSA) ? TSA_MITIGATION_FULL : TSA_MITIGATION_NONE; -+ -+static int __init tsa_parse_cmdline(char *str) -+{ -+ if (!str) -+ return -EINVAL; -+ -+ if (!strcmp(str, "off")) -+ tsa_mitigation = TSA_MITIGATION_NONE; -+ else if (!strcmp(str, "on")) -+ tsa_mitigation = TSA_MITIGATION_FULL; -+ else if (!strcmp(str, "user")) -+ tsa_mitigation = TSA_MITIGATION_USER_KERNEL; -+ else if (!strcmp(str, "vm")) -+ tsa_mitigation = TSA_MITIGATION_VM; -+ else -+ pr_err("Ignoring unknown tsa=%s option.\n", str); -+ -+ return 0; -+} -+early_param("tsa", tsa_parse_cmdline); -+ -+static void __init tsa_select_mitigation(void) -+{ -+ if (tsa_mitigation == TSA_MITIGATION_NONE) -+ return; -+ -+ if (cpu_mitigations_off() || !boot_cpu_has_bug(X86_BUG_TSA)) { -+ tsa_mitigation = TSA_MITIGATION_NONE; -+ return; -+ } -+ -+ if (!boot_cpu_has(X86_FEATURE_VERW_CLEAR)) -+ tsa_mitigation = TSA_MITIGATION_UCODE_NEEDED; -+ -+ switch (tsa_mitigation) { -+ case TSA_MITIGATION_USER_KERNEL: -+ setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF); -+ break; -+ -+ case TSA_MITIGATION_VM: -+ setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF_VM); -+ break; -+ -+ case TSA_MITIGATION_UCODE_NEEDED: -+ if (!boot_cpu_has(X86_FEATURE_HYPERVISOR)) -+ goto out; -+ -+ pr_notice("Forcing mitigation on in a VM\n"); -+ -+ /* -+ * On the off-chance that microcode has been updated -+ * on the host, enable the mitigation in the guest just -+ * in case. -+ */ -+ fallthrough; -+ case TSA_MITIGATION_FULL: -+ setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF); -+ setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF_VM); -+ break; -+ default: -+ break; -+ } -+ -+out: -+ pr_info("%s\n", tsa_strings[tsa_mitigation]); -+} -+ - void cpu_bugs_smt_update(void) - { - mutex_lock(&spec_ctrl_mutex); -@@ -2146,6 +2236,24 @@ void cpu_bugs_smt_update(void) - break; - } - -+ switch (tsa_mitigation) { -+ case TSA_MITIGATION_USER_KERNEL: -+ case TSA_MITIGATION_VM: -+ case TSA_MITIGATION_FULL: -+ case TSA_MITIGATION_UCODE_NEEDED: -+ /* -+ * TSA-SQ can potentially lead to info leakage between -+ * SMT threads. -+ */ -+ if (sched_smt_active()) -+ static_branch_enable(&cpu_buf_idle_clear); -+ else -+ static_branch_disable(&cpu_buf_idle_clear); -+ break; -+ case TSA_MITIGATION_NONE: -+ break; -+ } -+ - mutex_unlock(&spec_ctrl_mutex); - } - -@@ -3075,6 +3183,11 @@ static ssize_t gds_show_state(char *buf) - return sysfs_emit(buf, "%s\n", gds_strings[gds_mitigation]); - } - -+static ssize_t tsa_show_state(char *buf) -+{ -+ return sysfs_emit(buf, "%s\n", tsa_strings[tsa_mitigation]); -+} -+ - static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr, - char *buf, unsigned int bug) - { -@@ -3136,6 +3249,9 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr - case X86_BUG_ITS: - return its_show_state(buf); - -+ case X86_BUG_TSA: -+ return tsa_show_state(buf); -+ - default: - break; - } -@@ -3220,4 +3336,9 @@ ssize_t cpu_show_indirect_target_selection(struct device *dev, struct device_att - { - return cpu_show_common(dev, attr, buf, X86_BUG_ITS); - } -+ -+ssize_t cpu_show_tsa(struct device *dev, struct device_attribute *attr, char *buf) -+{ -+ return cpu_show_common(dev, attr, buf, X86_BUG_TSA); -+} - #endif -diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index b6e43dad577a3c..f66c71bffa6d93 100644 ---- a/arch/x86/kernel/cpu/common.c -+++ b/arch/x86/kernel/cpu/common.c -@@ -1277,6 +1277,8 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = { - #define ITS BIT(8) - /* CPU is affected by Indirect Target Selection, but guest-host isolation is not affected */ - #define ITS_NATIVE_ONLY BIT(9) -+/* CPU is affected by Transient Scheduler Attacks */ -+#define TSA BIT(10) - - static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = { - VULNBL_INTEL_STEPPINGS(IVYBRIDGE, X86_STEPPING_ANY, SRBDS), -@@ -1324,7 +1326,7 @@ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = { - VULNBL_AMD(0x16, RETBLEED), - VULNBL_AMD(0x17, RETBLEED | SMT_RSB | SRSO), - VULNBL_HYGON(0x18, RETBLEED | SMT_RSB | SRSO), -- VULNBL_AMD(0x19, SRSO), -+ VULNBL_AMD(0x19, SRSO | TSA), - {} - }; - -@@ -1529,6 +1531,16 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c) - setup_force_cpu_bug(X86_BUG_ITS_NATIVE_ONLY); - } - -+ if (c->x86_vendor == X86_VENDOR_AMD) { -+ if (!cpu_has(c, X86_FEATURE_TSA_SQ_NO) || -+ !cpu_has(c, X86_FEATURE_TSA_L1_NO)) { -+ if (cpu_matches(cpu_vuln_blacklist, TSA) || -+ /* Enable bug on Zen guests to allow for live migration. */ -+ (cpu_has(c, X86_FEATURE_HYPERVISOR) && cpu_has(c, X86_FEATURE_ZEN))) -+ setup_force_cpu_bug(X86_BUG_TSA); -+ } -+ } -+ - if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN)) - return; - -@@ -2215,20 +2227,16 @@ EXPORT_PER_CPU_SYMBOL(__stack_chk_guard); - - #endif /* CONFIG_X86_64 */ - --/* -- * Clear all 6 debug registers: -- */ --static void clear_all_debug_regs(void) -+static void initialize_debug_regs(void) - { -- int i; -- -- for (i = 0; i < 8; i++) { -- /* Ignore db4, db5 */ -- if ((i == 4) || (i == 5)) -- continue; -- -- set_debugreg(0, i); -- } -+ /* Control register first -- to make sure everything is disabled. */ -+ set_debugreg(0, 7); -+ set_debugreg(DR6_RESERVED, 6); -+ /* dr5 and dr4 don't exist */ -+ set_debugreg(0, 3); -+ set_debugreg(0, 2); -+ set_debugreg(0, 1); -+ set_debugreg(0, 0); - } - - #ifdef CONFIG_KGDB -@@ -2371,7 +2379,7 @@ void cpu_init(void) - - load_mm_ldt(&init_mm); - -- clear_all_debug_regs(); -+ initialize_debug_regs(); - dbg_restore_debug_regs(); - - doublefault_init_cpu_tss(); -diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c -index 9b0570f769eb3d..7444fe0e3d08cd 100644 ---- a/arch/x86/kernel/cpu/microcode/amd.c -+++ b/arch/x86/kernel/cpu/microcode/amd.c -@@ -96,18 +96,6 @@ static struct equiv_cpu_table { - struct equiv_cpu_entry *entry; - } equiv_table; - --union zen_patch_rev { -- struct { -- __u32 rev : 8, -- stepping : 4, -- model : 4, -- __reserved : 4, -- ext_model : 4, -- ext_fam : 8; -- }; -- __u32 ucode_rev; --}; -- - union cpuid_1_eax { - struct { - __u32 stepping : 4, -diff --git a/arch/x86/kernel/cpu/microcode/amd_shas.c b/arch/x86/kernel/cpu/microcode/amd_shas.c -index 2a1655b1fdd883..1fd349cfc8024a 100644 ---- a/arch/x86/kernel/cpu/microcode/amd_shas.c -+++ b/arch/x86/kernel/cpu/microcode/amd_shas.c -@@ -231,6 +231,13 @@ static const struct patch_digest phashes[] = { - 0x0d,0x5b,0x65,0x34,0x69,0xb2,0x62,0x21, - } - }, -+ { 0xa0011d7, { -+ 0x35,0x07,0xcd,0x40,0x94,0xbc,0x81,0x6b, -+ 0xfc,0x61,0x56,0x1a,0xe2,0xdb,0x96,0x12, -+ 0x1c,0x1c,0x31,0xb1,0x02,0x6f,0xe5,0xd2, -+ 0xfe,0x1b,0x04,0x03,0x2c,0x8f,0x4c,0x36, -+ } -+ }, - { 0xa001223, { - 0xfb,0x32,0x5f,0xc6,0x83,0x4f,0x8c,0xb8, - 0xa4,0x05,0xf9,0x71,0x53,0x01,0x16,0xc4, -@@ -294,6 +301,13 @@ static const struct patch_digest phashes[] = { - 0xc0,0xcd,0x33,0xf2,0x8d,0xf9,0xef,0x59, - } - }, -+ { 0xa00123b, { -+ 0xef,0xa1,0x1e,0x71,0xf1,0xc3,0x2c,0xe2, -+ 0xc3,0xef,0x69,0x41,0x7a,0x54,0xca,0xc3, -+ 0x8f,0x62,0x84,0xee,0xc2,0x39,0xd9,0x28, -+ 0x95,0xa7,0x12,0x49,0x1e,0x30,0x71,0x72, -+ } -+ }, - { 0xa00820c, { - 0xa8,0x0c,0x81,0xc0,0xa6,0x00,0xe7,0xf3, - 0x5f,0x65,0xd3,0xb9,0x6f,0xea,0x93,0x63, -@@ -301,6 +315,13 @@ static const struct patch_digest phashes[] = { - 0xe1,0x3b,0x8d,0xb2,0xf8,0x22,0x03,0xe2, - } - }, -+ { 0xa00820d, { -+ 0xf9,0x2a,0xc0,0xf4,0x9e,0xa4,0x87,0xa4, -+ 0x7d,0x87,0x00,0xfd,0xab,0xda,0x19,0xca, -+ 0x26,0x51,0x32,0xc1,0x57,0x91,0xdf,0xc1, -+ 0x05,0xeb,0x01,0x7c,0x5a,0x95,0x21,0xb7, -+ } -+ }, - { 0xa10113e, { - 0x05,0x3c,0x66,0xd7,0xa9,0x5a,0x33,0x10, - 0x1b,0xf8,0x9c,0x8f,0xed,0xfc,0xa7,0xa0, -@@ -322,6 +343,13 @@ static const struct patch_digest phashes[] = { - 0xf1,0x5e,0xb0,0xde,0xb4,0x98,0xae,0xc4, - } - }, -+ { 0xa10114c, { -+ 0x9e,0xb6,0xa2,0xd9,0x87,0x38,0xc5,0x64, -+ 0xd8,0x88,0xfa,0x78,0x98,0xf9,0x6f,0x74, -+ 0x39,0x90,0x1b,0xa5,0xcf,0x5e,0xb4,0x2a, -+ 0x02,0xff,0xd4,0x8c,0x71,0x8b,0xe2,0xc0, -+ } -+ }, - { 0xa10123e, { - 0x03,0xb9,0x2c,0x76,0x48,0x93,0xc9,0x18, - 0xfb,0x56,0xfd,0xf7,0xe2,0x1d,0xca,0x4d, -@@ -343,6 +371,13 @@ static const struct patch_digest phashes[] = { - 0x1b,0x7d,0x64,0x9d,0x4b,0x53,0x13,0x75, - } - }, -+ { 0xa10124c, { -+ 0x29,0xea,0xf1,0x2c,0xb2,0xe4,0xef,0x90, -+ 0xa4,0xcd,0x1d,0x86,0x97,0x17,0x61,0x46, -+ 0xfc,0x22,0xcb,0x57,0x75,0x19,0xc8,0xcc, -+ 0x0c,0xf5,0xbc,0xac,0x81,0x9d,0x9a,0xd2, -+ } -+ }, - { 0xa108108, { - 0xed,0xc2,0xec,0xa1,0x15,0xc6,0x65,0xe9, - 0xd0,0xef,0x39,0xaa,0x7f,0x55,0x06,0xc6, -@@ -350,6 +385,13 @@ static const struct patch_digest phashes[] = { - 0x28,0x1e,0x9c,0x59,0x69,0x99,0x4d,0x16, - } - }, -+ { 0xa108109, { -+ 0x85,0xb4,0xbd,0x7c,0x49,0xa7,0xbd,0xfa, -+ 0x49,0x36,0x80,0x81,0xc5,0xb7,0x39,0x1b, -+ 0x9a,0xaa,0x50,0xde,0x9b,0xe9,0x32,0x35, -+ 0x42,0x7e,0x51,0x4f,0x52,0x2c,0x28,0x59, -+ } -+ }, - { 0xa20102d, { - 0xf9,0x6e,0xf2,0x32,0xd3,0x0f,0x5f,0x11, - 0x59,0xa1,0xfe,0xcc,0xcd,0x9b,0x42,0x89, -@@ -357,6 +399,13 @@ static const struct patch_digest phashes[] = { - 0x8c,0xe9,0x19,0x3e,0xcc,0x3f,0x7b,0xb4, - } - }, -+ { 0xa20102e, { -+ 0xbe,0x1f,0x32,0x04,0x0d,0x3c,0x9c,0xdd, -+ 0xe1,0xa4,0xbf,0x76,0x3a,0xec,0xc2,0xf6, -+ 0x11,0x00,0xa7,0xaf,0x0f,0xe5,0x02,0xc5, -+ 0x54,0x3a,0x1f,0x8c,0x16,0xb5,0xff,0xbe, -+ } -+ }, - { 0xa201210, { - 0xe8,0x6d,0x51,0x6a,0x8e,0x72,0xf3,0xfe, - 0x6e,0x16,0xbc,0x62,0x59,0x40,0x17,0xe9, -@@ -364,6 +413,13 @@ static const struct patch_digest phashes[] = { - 0xf7,0x55,0xf0,0x13,0xbb,0x22,0xf6,0x41, - } - }, -+ { 0xa201211, { -+ 0x69,0xa1,0x17,0xec,0xd0,0xf6,0x6c,0x95, -+ 0xe2,0x1e,0xc5,0x59,0x1a,0x52,0x0a,0x27, -+ 0xc4,0xed,0xd5,0x59,0x1f,0xbf,0x00,0xff, -+ 0x08,0x88,0xb5,0xe1,0x12,0xb6,0xcc,0x27, -+ } -+ }, - { 0xa404107, { - 0xbb,0x04,0x4e,0x47,0xdd,0x5e,0x26,0x45, - 0x1a,0xc9,0x56,0x24,0xa4,0x4c,0x82,0xb0, -@@ -371,6 +427,13 @@ static const struct patch_digest phashes[] = { - 0x13,0xbc,0xc5,0x25,0xe4,0xc5,0xc3,0x99, - } - }, -+ { 0xa404108, { -+ 0x69,0x67,0x43,0x06,0xf8,0x0c,0x62,0xdc, -+ 0xa4,0x21,0x30,0x4f,0x0f,0x21,0x2c,0xcb, -+ 0xcc,0x37,0xf1,0x1c,0xc3,0xf8,0x2f,0x19, -+ 0xdf,0x53,0x53,0x46,0xb1,0x15,0xea,0x00, -+ } -+ }, - { 0xa500011, { - 0x23,0x3d,0x70,0x7d,0x03,0xc3,0xc4,0xf4, - 0x2b,0x82,0xc6,0x05,0xda,0x80,0x0a,0xf1, -@@ -378,6 +441,13 @@ static const struct patch_digest phashes[] = { - 0x11,0x5e,0x96,0x7e,0x71,0xe9,0xfc,0x74, - } - }, -+ { 0xa500012, { -+ 0xeb,0x74,0x0d,0x47,0xa1,0x8e,0x09,0xe4, -+ 0x93,0x4c,0xad,0x03,0x32,0x4c,0x38,0x16, -+ 0x10,0x39,0xdd,0x06,0xaa,0xce,0xd6,0x0f, -+ 0x62,0x83,0x9d,0x8e,0x64,0x55,0xbe,0x63, -+ } -+ }, - { 0xa601209, { - 0x66,0x48,0xd4,0x09,0x05,0xcb,0x29,0x32, - 0x66,0xb7,0x9a,0x76,0xcd,0x11,0xf3,0x30, -@@ -385,6 +455,13 @@ static const struct patch_digest phashes[] = { - 0xe8,0x73,0xe2,0xd6,0xdb,0xd2,0x77,0x1d, - } - }, -+ { 0xa60120a, { -+ 0x0c,0x8b,0x3d,0xfd,0x52,0x52,0x85,0x7d, -+ 0x20,0x3a,0xe1,0x7e,0xa4,0x21,0x3b,0x7b, -+ 0x17,0x86,0xae,0xac,0x13,0xb8,0x63,0x9d, -+ 0x06,0x01,0xd0,0xa0,0x51,0x9a,0x91,0x2c, -+ } -+ }, - { 0xa704107, { - 0xf3,0xc6,0x58,0x26,0xee,0xac,0x3f,0xd6, - 0xce,0xa1,0x72,0x47,0x3b,0xba,0x2b,0x93, -@@ -392,6 +469,13 @@ static const struct patch_digest phashes[] = { - 0x64,0x39,0x71,0x8c,0xce,0xe7,0x41,0x39, - } - }, -+ { 0xa704108, { -+ 0xd7,0x55,0x15,0x2b,0xfe,0xc4,0xbc,0x93, -+ 0xec,0x91,0xa0,0xae,0x45,0xb7,0xc3,0x98, -+ 0x4e,0xff,0x61,0x77,0x88,0xc2,0x70,0x49, -+ 0xe0,0x3a,0x1d,0x84,0x38,0x52,0xbf,0x5a, -+ } -+ }, - { 0xa705206, { - 0x8d,0xc0,0x76,0xbd,0x58,0x9f,0x8f,0xa4, - 0x12,0x9d,0x21,0xfb,0x48,0x21,0xbc,0xe7, -@@ -399,6 +483,13 @@ static const struct patch_digest phashes[] = { - 0x03,0x35,0xe9,0xbe,0xfb,0x06,0xdf,0xfc, - } - }, -+ { 0xa705208, { -+ 0x30,0x1d,0x55,0x24,0xbc,0x6b,0x5a,0x19, -+ 0x0c,0x7d,0x1d,0x74,0xaa,0xd1,0xeb,0xd2, -+ 0x16,0x62,0xf7,0x5b,0xe1,0x1f,0x18,0x11, -+ 0x5c,0xf0,0x94,0x90,0x26,0xec,0x69,0xff, -+ } -+ }, - { 0xa708007, { - 0x6b,0x76,0xcc,0x78,0xc5,0x8a,0xa3,0xe3, - 0x32,0x2d,0x79,0xe4,0xc3,0x80,0xdb,0xb2, -@@ -406,6 +497,13 @@ static const struct patch_digest phashes[] = { - 0xdf,0x92,0x73,0x84,0x87,0x3c,0x73,0x93, - } - }, -+ { 0xa708008, { -+ 0x08,0x6e,0xf0,0x22,0x4b,0x8e,0xc4,0x46, -+ 0x58,0x34,0xe6,0x47,0xa2,0x28,0xfd,0xab, -+ 0x22,0x3d,0xdd,0xd8,0x52,0x9e,0x1d,0x16, -+ 0xfa,0x01,0x68,0x14,0x79,0x3e,0xe8,0x6b, -+ } -+ }, - { 0xa70c005, { - 0x88,0x5d,0xfb,0x79,0x64,0xd8,0x46,0x3b, - 0x4a,0x83,0x8e,0x77,0x7e,0xcf,0xb3,0x0f, -@@ -413,6 +511,13 @@ static const struct patch_digest phashes[] = { - 0xee,0x49,0xac,0xe1,0x8b,0x13,0xc5,0x13, - } - }, -+ { 0xa70c008, { -+ 0x0f,0xdb,0x37,0xa1,0x10,0xaf,0xd4,0x21, -+ 0x94,0x0d,0xa4,0xa2,0xe9,0x86,0x6c,0x0e, -+ 0x85,0x7c,0x36,0x30,0xa3,0x3a,0x78,0x66, -+ 0x18,0x10,0x60,0x0d,0x78,0x3d,0x44,0xd0, -+ } -+ }, - { 0xaa00116, { - 0xe8,0x4c,0x2c,0x88,0xa1,0xac,0x24,0x63, - 0x65,0xe5,0xaa,0x2d,0x16,0xa9,0xc3,0xf5, -@@ -441,4 +546,11 @@ static const struct patch_digest phashes[] = { - 0x68,0x2f,0x46,0xee,0xfe,0xc6,0x6d,0xef, - } - }, -+ { 0xaa00216, { -+ 0x79,0xfb,0x5b,0x9f,0xb6,0xe6,0xa8,0xf5, -+ 0x4e,0x7c,0x4f,0x8e,0x1d,0xad,0xd0,0x08, -+ 0xc2,0x43,0x7c,0x8b,0xe6,0xdb,0xd0,0xd2, -+ 0xe8,0x39,0x26,0xc1,0xe5,0x5a,0x48,0xf1, -+ } -+ }, - }; -diff --git a/arch/x86/kernel/cpu/scattered.c b/arch/x86/kernel/cpu/scattered.c -index af5aa2c754c222..7a42e699f6e39a 100644 ---- a/arch/x86/kernel/cpu/scattered.c -+++ b/arch/x86/kernel/cpu/scattered.c -@@ -48,6 +48,8 @@ static const struct cpuid_bit cpuid_bits[] = { - { X86_FEATURE_MBA, CPUID_EBX, 6, 0x80000008, 0 }, - { X86_FEATURE_SMBA, CPUID_EBX, 2, 0x80000020, 0 }, - { X86_FEATURE_BMEC, CPUID_EBX, 3, 0x80000020, 0 }, -+ { X86_FEATURE_TSA_SQ_NO, CPUID_ECX, 1, 0x80000021, 0 }, -+ { X86_FEATURE_TSA_L1_NO, CPUID_ECX, 2, 0x80000021, 0 }, - { X86_FEATURE_PERFMON_V2, CPUID_EAX, 0, 0x80000022, 0 }, - { X86_FEATURE_AMD_LBR_V2, CPUID_EAX, 1, 0x80000022, 0 }, - { X86_FEATURE_AMD_LBR_PMC_FREEZE, CPUID_EAX, 2, 0x80000022, 0 }, -diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c -index 33c235e9d0d3fb..e3c26cc45f7008 100644 ---- a/arch/x86/kernel/process.c -+++ b/arch/x86/kernel/process.c -@@ -928,16 +928,24 @@ static int prefer_mwait_c1_over_halt(const struct cpuinfo_x86 *c) - */ - static __cpuidle void mwait_idle(void) - { -+ if (need_resched()) -+ return; -+ -+ x86_idle_clear_cpu_buffers(); -+ - if (!current_set_polling_and_test()) { - const void *addr = ¤t_thread_info()->flags; - - alternative_input("", "clflush (%[addr])", X86_BUG_CLFLUSH_MONITOR, [addr] "a" (addr)); - __monitor(addr, 0, 0); -- if (!need_resched()) { -- __sti_mwait(0, 0); -- raw_local_irq_disable(); -- } -+ if (need_resched()) -+ goto out; -+ -+ __sti_mwait(0, 0); -+ raw_local_irq_disable(); - } -+ -+out: - __current_clr_polling(); - } - -diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c -index 8718d58dd0fbea..a52db362a65d16 100644 ---- a/arch/x86/kernel/traps.c -+++ b/arch/x86/kernel/traps.c -@@ -975,24 +975,32 @@ static bool is_sysenter_singlestep(struct pt_regs *regs) - #endif - } - --static __always_inline unsigned long debug_read_clear_dr6(void) -+static __always_inline unsigned long debug_read_reset_dr6(void) - { - unsigned long dr6; - -+ get_debugreg(dr6, 6); -+ dr6 ^= DR6_RESERVED; /* Flip to positive polarity */ -+ - /* - * The Intel SDM says: - * -- * Certain debug exceptions may clear bits 0-3. The remaining -- * contents of the DR6 register are never cleared by the -- * processor. To avoid confusion in identifying debug -- * exceptions, debug handlers should clear the register before -- * returning to the interrupted task. -+ * Certain debug exceptions may clear bits 0-3 of DR6. -+ * -+ * BLD induced #DB clears DR6.BLD and any other debug -+ * exception doesn't modify DR6.BLD. - * -- * Keep it simple: clear DR6 immediately. -+ * RTM induced #DB clears DR6.RTM and any other debug -+ * exception sets DR6.RTM. -+ * -+ * To avoid confusion in identifying debug exceptions, -+ * debug handlers should set DR6.BLD and DR6.RTM, and -+ * clear other DR6 bits before returning. -+ * -+ * Keep it simple: write DR6 with its architectural reset -+ * value 0xFFFF0FF0, defined as DR6_RESERVED, immediately. - */ -- get_debugreg(dr6, 6); - set_debugreg(DR6_RESERVED, 6); -- dr6 ^= DR6_RESERVED; /* Flip to positive polarity */ - - return dr6; - } -@@ -1188,19 +1196,19 @@ static __always_inline void exc_debug_user(struct pt_regs *regs, - /* IST stack entry */ - DEFINE_IDTENTRY_DEBUG(exc_debug) - { -- exc_debug_kernel(regs, debug_read_clear_dr6()); -+ exc_debug_kernel(regs, debug_read_reset_dr6()); - } - - /* User entry, runs on regular task stack */ - DEFINE_IDTENTRY_DEBUG_USER(exc_debug) - { -- exc_debug_user(regs, debug_read_clear_dr6()); -+ exc_debug_user(regs, debug_read_reset_dr6()); - } - #else - /* 32 bit does not have separate entry points. */ - DEFINE_IDTENTRY_RAW(exc_debug) - { -- unsigned long dr6 = debug_read_clear_dr6(); -+ unsigned long dr6 = debug_read_reset_dr6(); - - if (user_mode(regs)) - exc_debug_user(regs, dr6); -diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c -index a6cffeff75d40b..288db351677222 100644 ---- a/arch/x86/kvm/cpuid.c -+++ b/arch/x86/kvm/cpuid.c -@@ -780,6 +780,7 @@ void kvm_set_cpu_caps(void) - - kvm_cpu_cap_mask(CPUID_8000_0021_EAX, - F(NO_NESTED_DATA_BP) | F(LFENCE_RDTSC) | 0 /* SmmPgCfgLock */ | -+ F(VERW_CLEAR) | - F(NULL_SEL_CLR_BASE) | F(AUTOIBRS) | 0 /* PrefetchCtlMsr */ - ); - -@@ -790,6 +791,10 @@ void kvm_set_cpu_caps(void) - F(PERFMON_V2) - ); - -+ kvm_cpu_cap_init_kvm_defined(CPUID_8000_0021_ECX, -+ F(TSA_SQ_NO) | F(TSA_L1_NO) -+ ); -+ - /* - * Synthesize "LFENCE is serializing" into the AMD-defined entry in - * KVM's supported CPUID if the feature is reported as supported by the -@@ -1296,8 +1301,9 @@ static inline int __do_cpuid_func(struct kvm_cpuid_array *array, u32 function) - entry->eax = entry->ebx = entry->ecx = entry->edx = 0; - break; - case 0x80000021: -- entry->ebx = entry->ecx = entry->edx = 0; -+ entry->ebx = entry->edx = 0; - cpuid_entry_override(entry, CPUID_8000_0021_EAX); -+ cpuid_entry_override(entry, CPUID_8000_0021_ECX); - break; - /* AMD Extended Performance Monitoring and Debug */ - case 0x80000022: { -diff --git a/arch/x86/kvm/reverse_cpuid.h b/arch/x86/kvm/reverse_cpuid.h -index 2f4e155080badc..be23712354bd8e 100644 ---- a/arch/x86/kvm/reverse_cpuid.h -+++ b/arch/x86/kvm/reverse_cpuid.h -@@ -17,6 +17,7 @@ enum kvm_only_cpuid_leafs { - CPUID_8000_0007_EDX, - CPUID_8000_0022_EAX, - CPUID_7_2_EDX, -+ CPUID_8000_0021_ECX, - NR_KVM_CPU_CAPS, - - NKVMCAPINTS = NR_KVM_CPU_CAPS - NCAPINTS, -@@ -61,6 +62,10 @@ enum kvm_only_cpuid_leafs { - /* CPUID level 0x80000022 (EAX) */ - #define KVM_X86_FEATURE_PERFMON_V2 KVM_X86_FEATURE(CPUID_8000_0022_EAX, 0) - -+/* CPUID level 0x80000021 (ECX) */ -+#define KVM_X86_FEATURE_TSA_SQ_NO KVM_X86_FEATURE(CPUID_8000_0021_ECX, 1) -+#define KVM_X86_FEATURE_TSA_L1_NO KVM_X86_FEATURE(CPUID_8000_0021_ECX, 2) -+ - struct cpuid_reg { - u32 function; - u32 index; -@@ -90,6 +95,7 @@ static const struct cpuid_reg reverse_cpuid[] = { - [CPUID_8000_0021_EAX] = {0x80000021, 0, CPUID_EAX}, - [CPUID_8000_0022_EAX] = {0x80000022, 0, CPUID_EAX}, - [CPUID_7_2_EDX] = { 7, 2, CPUID_EDX}, -+ [CPUID_8000_0021_ECX] = {0x80000021, 0, CPUID_ECX}, - }; - - /* -@@ -129,6 +135,8 @@ static __always_inline u32 __feature_translate(int x86_feature) - KVM_X86_TRANSLATE_FEATURE(PERFMON_V2); - KVM_X86_TRANSLATE_FEATURE(RRSBA_CTRL); - KVM_X86_TRANSLATE_FEATURE(BHI_CTRL); -+ KVM_X86_TRANSLATE_FEATURE(TSA_SQ_NO); -+ KVM_X86_TRANSLATE_FEATURE(TSA_L1_NO); - default: - return x86_feature; - } -diff --git a/arch/x86/kvm/svm/vmenter.S b/arch/x86/kvm/svm/vmenter.S -index ef2ebabb059c8c..56fe34d9397f64 100644 ---- a/arch/x86/kvm/svm/vmenter.S -+++ b/arch/x86/kvm/svm/vmenter.S -@@ -167,6 +167,9 @@ SYM_FUNC_START(__svm_vcpu_run) - #endif - mov VCPU_RDI(%_ASM_DI), %_ASM_DI - -+ /* Clobbers EFLAGS.ZF */ -+ VM_CLEAR_CPU_BUFFERS -+ - /* Enter guest mode */ - sti - -@@ -334,6 +337,9 @@ SYM_FUNC_START(__svm_sev_es_vcpu_run) - mov SVM_current_vmcb(%_ASM_DI), %_ASM_AX - mov KVM_VMCB_pa(%_ASM_AX), %_ASM_AX - -+ /* Clobbers EFLAGS.ZF */ -+ VM_CLEAR_CPU_BUFFERS -+ - /* Enter guest mode */ - sti - -diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c -index e7f3b70f9114ae..e53620e189254b 100644 ---- a/arch/x86/kvm/vmx/vmx.c -+++ b/arch/x86/kvm/vmx/vmx.c -@@ -7263,7 +7263,7 @@ static noinstr void vmx_vcpu_enter_exit(struct kvm_vcpu *vcpu, - vmx_l1d_flush(vcpu); - else if (static_branch_unlikely(&mmio_stale_data_clear) && - kvm_arch_has_assigned_device(vcpu->kvm)) -- mds_clear_cpu_buffers(); -+ x86_clear_cpu_buffers(); - - vmx_disable_fb_clear(vmx); - -diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c -index e809c2aed78aed..a232746d150a75 100644 ---- a/drivers/acpi/acpica/dsmethod.c -+++ b/drivers/acpi/acpica/dsmethod.c -@@ -483,6 +483,13 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread, - return_ACPI_STATUS(AE_NULL_OBJECT); - } - -+ if (this_walk_state->num_operands < obj_desc->method.param_count) { -+ ACPI_ERROR((AE_INFO, "Missing argument for method [%4.4s]", -+ acpi_ut_get_node_name(method_node))); -+ -+ return_ACPI_STATUS(AE_AML_UNINITIALIZED_ARG); -+ } -+ - /* Init for new method, possibly wait on method mutex */ - - status = -diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c -index d36e71f475abdc..39a350755a1baf 100644 ---- a/drivers/ata/libata-acpi.c -+++ b/drivers/ata/libata-acpi.c -@@ -514,15 +514,19 @@ unsigned int ata_acpi_gtm_xfermask(struct ata_device *dev, - EXPORT_SYMBOL_GPL(ata_acpi_gtm_xfermask); - - /** -- * ata_acpi_cbl_80wire - Check for 80 wire cable -+ * ata_acpi_cbl_pata_type - Return PATA cable type - * @ap: Port to check -- * @gtm: GTM data to use - * -- * Return 1 if the @gtm indicates the BIOS selected an 80wire mode. -+ * Return ATA_CBL_PATA* according to the transfer mode selected by BIOS - */ --int ata_acpi_cbl_80wire(struct ata_port *ap, const struct ata_acpi_gtm *gtm) -+int ata_acpi_cbl_pata_type(struct ata_port *ap) - { - struct ata_device *dev; -+ int ret = ATA_CBL_PATA_UNK; -+ const struct ata_acpi_gtm *gtm = ata_acpi_init_gtm(ap); -+ -+ if (!gtm) -+ return ATA_CBL_PATA40; - - ata_for_each_dev(dev, &ap->link, ENABLED) { - unsigned int xfer_mask, udma_mask; -@@ -530,13 +534,17 @@ int ata_acpi_cbl_80wire(struct ata_port *ap, const struct ata_acpi_gtm *gtm) - xfer_mask = ata_acpi_gtm_xfermask(dev, gtm); - ata_unpack_xfermask(xfer_mask, NULL, NULL, &udma_mask); - -- if (udma_mask & ~ATA_UDMA_MASK_40C) -- return 1; -+ ret = ATA_CBL_PATA40; -+ -+ if (udma_mask & ~ATA_UDMA_MASK_40C) { -+ ret = ATA_CBL_PATA80; -+ break; -+ } - } - -- return 0; -+ return ret; - } --EXPORT_SYMBOL_GPL(ata_acpi_cbl_80wire); -+EXPORT_SYMBOL_GPL(ata_acpi_cbl_pata_type); - - static void ata_acpi_gtf_to_tf(struct ata_device *dev, - const struct ata_acpi_gtf *gtf, -diff --git a/drivers/ata/pata_cs5536.c b/drivers/ata/pata_cs5536.c -index b811efd2cc346a..73e81e160c91fb 100644 ---- a/drivers/ata/pata_cs5536.c -+++ b/drivers/ata/pata_cs5536.c -@@ -27,7 +27,7 @@ - #include - #include - --#ifdef CONFIG_X86_32 -+#if defined(CONFIG_X86) && defined(CONFIG_X86_32) - #include - static int use_msr; - module_param_named(msr, use_msr, int, 0644); -diff --git a/drivers/ata/pata_via.c b/drivers/ata/pata_via.c -index d82728a01832b5..bb80e7800dcbe9 100644 ---- a/drivers/ata/pata_via.c -+++ b/drivers/ata/pata_via.c -@@ -201,11 +201,9 @@ static int via_cable_detect(struct ata_port *ap) { - two drives */ - if (ata66 & (0x10100000 >> (16 * ap->port_no))) - return ATA_CBL_PATA80; -+ - /* Check with ACPI so we can spot BIOS reported SATA bridges */ -- if (ata_acpi_init_gtm(ap) && -- ata_acpi_cbl_80wire(ap, ata_acpi_init_gtm(ap))) -- return ATA_CBL_PATA80; -- return ATA_CBL_PATA40; -+ return ata_acpi_cbl_pata_type(ap); - } - - static int via_pre_reset(struct ata_link *link, unsigned long deadline) -diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c -index a5cfc1bfad51fb..a3aea3c1431aa9 100644 ---- a/drivers/base/cpu.c -+++ b/drivers/base/cpu.c -@@ -567,6 +567,7 @@ CPU_SHOW_VULN_FALLBACK(spec_rstack_overflow); - CPU_SHOW_VULN_FALLBACK(gds); - CPU_SHOW_VULN_FALLBACK(reg_file_data_sampling); - CPU_SHOW_VULN_FALLBACK(indirect_target_selection); -+CPU_SHOW_VULN_FALLBACK(tsa); - - static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); - static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL); -@@ -583,6 +584,7 @@ static DEVICE_ATTR(spec_rstack_overflow, 0444, cpu_show_spec_rstack_overflow, NU - static DEVICE_ATTR(gather_data_sampling, 0444, cpu_show_gds, NULL); - static DEVICE_ATTR(reg_file_data_sampling, 0444, cpu_show_reg_file_data_sampling, NULL); - static DEVICE_ATTR(indirect_target_selection, 0444, cpu_show_indirect_target_selection, NULL); -+static DEVICE_ATTR(tsa, 0444, cpu_show_tsa, NULL); - - static struct attribute *cpu_root_vulnerabilities_attrs[] = { - &dev_attr_meltdown.attr, -@@ -600,6 +602,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = { - &dev_attr_gather_data_sampling.attr, - &dev_attr_reg_file_data_sampling.attr, - &dev_attr_indirect_target_selection.attr, -+ &dev_attr_tsa.attr, - NULL - }; - -diff --git a/drivers/block/aoe/aoe.h b/drivers/block/aoe/aoe.h -index 749ae1246f4cf8..d35caa3c69e15e 100644 ---- a/drivers/block/aoe/aoe.h -+++ b/drivers/block/aoe/aoe.h -@@ -80,6 +80,7 @@ enum { - DEVFL_NEWSIZE = (1<<6), /* need to update dev size in block layer */ - DEVFL_FREEING = (1<<7), /* set when device is being cleaned up */ - DEVFL_FREED = (1<<8), /* device has been cleaned up */ -+ DEVFL_DEAD = (1<<9), /* device has timed out of aoe_deadsecs */ - }; - - enum { -diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c -index d1f4ddc576451a..c4c5cf1ec71ba9 100644 ---- a/drivers/block/aoe/aoecmd.c -+++ b/drivers/block/aoe/aoecmd.c -@@ -754,7 +754,7 @@ rexmit_timer(struct timer_list *timer) - - utgts = count_targets(d, NULL); - -- if (d->flags & DEVFL_TKILL) { -+ if (d->flags & (DEVFL_TKILL | DEVFL_DEAD)) { - spin_unlock_irqrestore(&d->lock, flags); - return; - } -@@ -786,7 +786,8 @@ rexmit_timer(struct timer_list *timer) - * to clean up. - */ - list_splice(&flist, &d->factive[0]); -- aoedev_downdev(d); -+ d->flags |= DEVFL_DEAD; -+ queue_work(aoe_wq, &d->work); - goto out; - } - -@@ -898,6 +899,9 @@ aoecmd_sleepwork(struct work_struct *work) - { - struct aoedev *d = container_of(work, struct aoedev, work); - -+ if (d->flags & DEVFL_DEAD) -+ aoedev_downdev(d); -+ - if (d->flags & DEVFL_GDALLOC) - aoeblk_gdalloc(d); - -diff --git a/drivers/block/aoe/aoedev.c b/drivers/block/aoe/aoedev.c -index 280679bde3a506..4240e11adfb769 100644 ---- a/drivers/block/aoe/aoedev.c -+++ b/drivers/block/aoe/aoedev.c -@@ -200,8 +200,11 @@ aoedev_downdev(struct aoedev *d) - struct list_head *head, *pos, *nx; - struct request *rq, *rqnext; - int i; -+ unsigned long flags; - -- d->flags &= ~DEVFL_UP; -+ spin_lock_irqsave(&d->lock, flags); -+ d->flags &= ~(DEVFL_UP | DEVFL_DEAD); -+ spin_unlock_irqrestore(&d->lock, flags); - - /* clean out active and to-be-retransmitted buffers */ - for (i = 0; i < NFACTIVE; i++) { -diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c -index 9093f751f1336a..8f3fa149a76d9b 100644 ---- a/drivers/dma-buf/dma-resv.c -+++ b/drivers/dma-buf/dma-resv.c -@@ -678,11 +678,13 @@ long dma_resv_wait_timeout(struct dma_resv *obj, enum dma_resv_usage usage, - dma_resv_iter_begin(&cursor, obj, usage); - dma_resv_for_each_fence_unlocked(&cursor, fence) { - -- ret = dma_fence_wait_timeout(fence, intr, ret); -- if (ret <= 0) { -- dma_resv_iter_end(&cursor); -- return ret; -- } -+ ret = dma_fence_wait_timeout(fence, intr, timeout); -+ if (ret <= 0) -+ break; -+ -+ /* Even for zero timeout the return value is 1 */ -+ if (timeout) -+ timeout = ret; - } - dma_resv_iter_end(&cursor); - -diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c -index 5bdc246f5fad09..341e95269836e0 100644 ---- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c -+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c -@@ -187,6 +187,7 @@ struct fimd_context { - u32 i80ifcon; - bool i80_if; - bool suspended; -+ bool dp_clk_enabled; - wait_queue_head_t wait_vsync_queue; - atomic_t wait_vsync_event; - atomic_t win_updated; -@@ -1047,7 +1048,18 @@ static void fimd_dp_clock_enable(struct exynos_drm_clk *clk, bool enable) - struct fimd_context *ctx = container_of(clk, struct fimd_context, - dp_clk); - u32 val = enable ? DP_MIE_CLK_DP_ENABLE : DP_MIE_CLK_DISABLE; -+ -+ if (enable == ctx->dp_clk_enabled) -+ return; -+ -+ if (enable) -+ pm_runtime_resume_and_get(ctx->dev); -+ -+ ctx->dp_clk_enabled = enable; - writel(val, ctx->regs + DP_MIE_CLKCON); -+ -+ if (!enable) -+ pm_runtime_put(ctx->dev); - } - - static const struct exynos_drm_crtc_ops fimd_crtc_ops = { -diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c -index 023b2ea74c3601..5a687a3686bd53 100644 ---- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c -+++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c -@@ -2013,7 +2013,7 @@ static int eb_capture_stage(struct i915_execbuffer *eb) - continue; - - if (i915_gem_context_is_recoverable(eb->gem_context) && -- GRAPHICS_VER_FULL(eb->i915) > IP_VER(12, 10)) -+ (IS_DGFX(eb->i915) || GRAPHICS_VER_FULL(eb->i915) > IP_VER(12, 0))) - return -EINVAL; - - for_each_batch_create_order(eb, j) { -diff --git a/drivers/gpu/drm/i915/gt/intel_gsc.c b/drivers/gpu/drm/i915/gt/intel_gsc.c -index bcc3605158dbde..27420ed631d850 100644 ---- a/drivers/gpu/drm/i915/gt/intel_gsc.c -+++ b/drivers/gpu/drm/i915/gt/intel_gsc.c -@@ -298,7 +298,7 @@ static void gsc_irq_handler(struct intel_gt *gt, unsigned int intf_id) - if (gt->gsc.intf[intf_id].irq < 0) - return; - -- ret = generic_handle_irq(gt->gsc.intf[intf_id].irq); -+ ret = generic_handle_irq_safe(gt->gsc.intf[intf_id].irq); - if (ret) - drm_err_ratelimited(>->i915->drm, "error handling GSC irq: %d\n", ret); - } -diff --git a/drivers/gpu/drm/i915/gt/intel_ring_submission.c b/drivers/gpu/drm/i915/gt/intel_ring_submission.c -index 92085ffd23de0e..4eb78895773f6f 100644 ---- a/drivers/gpu/drm/i915/gt/intel_ring_submission.c -+++ b/drivers/gpu/drm/i915/gt/intel_ring_submission.c -@@ -573,7 +573,6 @@ static int ring_context_alloc(struct intel_context *ce) - /* One ringbuffer to rule them all */ - GEM_BUG_ON(!engine->legacy.ring); - ce->ring = engine->legacy.ring; -- ce->timeline = intel_timeline_get(engine->legacy.timeline); - - GEM_BUG_ON(ce->state); - if (engine->context_size) { -@@ -586,6 +585,8 @@ static int ring_context_alloc(struct intel_context *ce) - ce->state = vma; - } - -+ ce->timeline = intel_timeline_get(engine->legacy.timeline); -+ - return 0; - } - -diff --git a/drivers/gpu/drm/i915/selftests/i915_request.c b/drivers/gpu/drm/i915/selftests/i915_request.c -index a9b79888c19316..c7ce2c570ad1f8 100644 ---- a/drivers/gpu/drm/i915/selftests/i915_request.c -+++ b/drivers/gpu/drm/i915/selftests/i915_request.c -@@ -73,8 +73,8 @@ static int igt_add_request(void *arg) - /* Basic preliminary test to create a request and let it loose! */ - - request = mock_request(rcs0(i915)->kernel_context, HZ / 10); -- if (!request) -- return -ENOMEM; -+ if (IS_ERR(request)) -+ return PTR_ERR(request); - - i915_request_add(request); - -@@ -91,8 +91,8 @@ static int igt_wait_request(void *arg) - /* Submit a request, then wait upon it */ - - request = mock_request(rcs0(i915)->kernel_context, T); -- if (!request) -- return -ENOMEM; -+ if (IS_ERR(request)) -+ return PTR_ERR(request); - - i915_request_get(request); - -@@ -160,8 +160,8 @@ static int igt_fence_wait(void *arg) - /* Submit a request, treat it as a fence and wait upon it */ - - request = mock_request(rcs0(i915)->kernel_context, T); -- if (!request) -- return -ENOMEM; -+ if (IS_ERR(request)) -+ return PTR_ERR(request); - - if (dma_fence_wait_timeout(&request->fence, false, T) != -ETIME) { - pr_err("fence wait success before submit (expected timeout)!\n"); -@@ -219,8 +219,8 @@ static int igt_request_rewind(void *arg) - GEM_BUG_ON(IS_ERR(ce)); - request = mock_request(ce, 2 * HZ); - intel_context_put(ce); -- if (!request) { -- err = -ENOMEM; -+ if (IS_ERR(request)) { -+ err = PTR_ERR(request); - goto err_context_0; - } - -@@ -237,8 +237,8 @@ static int igt_request_rewind(void *arg) - GEM_BUG_ON(IS_ERR(ce)); - vip = mock_request(ce, 0); - intel_context_put(ce); -- if (!vip) { -- err = -ENOMEM; -+ if (IS_ERR(vip)) { -+ err = PTR_ERR(vip); - goto err_context_1; - } - -diff --git a/drivers/gpu/drm/i915/selftests/mock_request.c b/drivers/gpu/drm/i915/selftests/mock_request.c -index 09f747228dff57..1b0cf073e9643f 100644 ---- a/drivers/gpu/drm/i915/selftests/mock_request.c -+++ b/drivers/gpu/drm/i915/selftests/mock_request.c -@@ -35,7 +35,7 @@ mock_request(struct intel_context *ce, unsigned long delay) - /* NB the i915->requests slab cache is enlarged to fit mock_request */ - request = intel_context_create_request(ce); - if (IS_ERR(request)) -- return NULL; -+ return request; - - request->mock.delay = delay; - return request; -diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c -index 018b39546fc1dd..bbe4f1665b6039 100644 ---- a/drivers/gpu/drm/msm/msm_gem_submit.c -+++ b/drivers/gpu/drm/msm/msm_gem_submit.c -@@ -85,6 +85,15 @@ void __msm_gem_submit_destroy(struct kref *kref) - container_of(kref, struct msm_gem_submit, ref); - unsigned i; - -+ /* -+ * In error paths, we could unref the submit without calling -+ * drm_sched_entity_push_job(), so msm_job_free() will never -+ * get called. Since drm_sched_job_cleanup() will NULL out -+ * s_fence, we can use that to detect this case. -+ */ -+ if (submit->base.s_fence) -+ drm_sched_job_cleanup(&submit->base); -+ - if (submit->fence_id) { - spin_lock(&submit->queue->idr_lock); - idr_remove(&submit->queue->fence_idr, submit->fence_id); -@@ -754,6 +763,7 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, - struct msm_ringbuffer *ring; - struct msm_submit_post_dep *post_deps = NULL; - struct drm_syncobj **syncobjs_to_reset = NULL; -+ struct sync_file *sync_file = NULL; - int out_fence_fd = -1; - bool has_ww_ticket = false; - unsigned i; -@@ -970,7 +980,7 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, - } - - if (ret == 0 && args->flags & MSM_SUBMIT_FENCE_FD_OUT) { -- struct sync_file *sync_file = sync_file_create(submit->user_fence); -+ sync_file = sync_file_create(submit->user_fence); - if (!sync_file) { - ret = -ENOMEM; - } else { -@@ -1003,8 +1013,11 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, - out_unlock: - mutex_unlock(&queue->lock); - out_post_unlock: -- if (ret && (out_fence_fd >= 0)) -+ if (ret && (out_fence_fd >= 0)) { - put_unused_fd(out_fence_fd); -+ if (sync_file) -+ fput(sync_file->file); -+ } - - if (!IS_ERR_OR_NULL(submit)) { - msm_gem_submit_put(submit); -diff --git a/drivers/gpu/drm/tiny/simpledrm.c b/drivers/gpu/drm/tiny/simpledrm.c -index 8ea120eb8674bd..30676b1073034e 100644 ---- a/drivers/gpu/drm/tiny/simpledrm.c -+++ b/drivers/gpu/drm/tiny/simpledrm.c -@@ -276,7 +276,7 @@ static struct simpledrm_device *simpledrm_device_of_dev(struct drm_device *dev) - - static void simpledrm_device_release_clocks(void *res) - { -- struct simpledrm_device *sdev = simpledrm_device_of_dev(res); -+ struct simpledrm_device *sdev = res; - unsigned int i; - - for (i = 0; i < sdev->clk_count; ++i) { -@@ -374,7 +374,7 @@ static int simpledrm_device_init_clocks(struct simpledrm_device *sdev) - - static void simpledrm_device_release_regulators(void *res) - { -- struct simpledrm_device *sdev = simpledrm_device_of_dev(res); -+ struct simpledrm_device *sdev = res; - unsigned int i; - - for (i = 0; i < sdev->regulator_count; ++i) { -diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h -index 7f664a4b2a7521..bcef978ba9c4ca 100644 ---- a/drivers/gpu/drm/v3d/v3d_drv.h -+++ b/drivers/gpu/drm/v3d/v3d_drv.h -@@ -62,6 +62,12 @@ struct v3d_perfmon { - u64 values[]; - }; - -+enum v3d_irq { -+ V3D_CORE_IRQ, -+ V3D_HUB_IRQ, -+ V3D_MAX_IRQS, -+}; -+ - struct v3d_dev { - struct drm_device drm; - -@@ -71,6 +77,8 @@ struct v3d_dev { - int ver; - bool single_irq_line; - -+ int irq[V3D_MAX_IRQS]; -+ - void __iomem *hub_regs; - void __iomem *core_regs[3]; - void __iomem *bridge_regs; -diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c -index 2e94ce788c714b..ef991a9b1c6c46 100644 ---- a/drivers/gpu/drm/v3d/v3d_gem.c -+++ b/drivers/gpu/drm/v3d/v3d_gem.c -@@ -120,6 +120,8 @@ v3d_reset(struct v3d_dev *v3d) - if (false) - v3d_idle_axi(v3d, 0); - -+ v3d_irq_disable(v3d); -+ - v3d_idle_gca(v3d); - v3d_reset_v3d(v3d); - -diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c -index b2d59a16869728..641315dbee8b29 100644 ---- a/drivers/gpu/drm/v3d/v3d_irq.c -+++ b/drivers/gpu/drm/v3d/v3d_irq.c -@@ -215,7 +215,7 @@ v3d_hub_irq(int irq, void *arg) - int - v3d_irq_init(struct v3d_dev *v3d) - { -- int irq1, ret, core; -+ int irq, ret, core; - - INIT_WORK(&v3d->overflow_mem_work, v3d_overflow_mem_work); - -@@ -226,17 +226,24 @@ v3d_irq_init(struct v3d_dev *v3d) - V3D_CORE_WRITE(core, V3D_CTL_INT_CLR, V3D_CORE_IRQS); - V3D_WRITE(V3D_HUB_INT_CLR, V3D_HUB_IRQS); - -- irq1 = platform_get_irq_optional(v3d_to_pdev(v3d), 1); -- if (irq1 == -EPROBE_DEFER) -- return irq1; -- if (irq1 > 0) { -- ret = devm_request_irq(v3d->drm.dev, irq1, -+ irq = platform_get_irq_optional(v3d_to_pdev(v3d), 1); -+ if (irq == -EPROBE_DEFER) -+ return irq; -+ if (irq > 0) { -+ v3d->irq[V3D_CORE_IRQ] = irq; -+ -+ ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_CORE_IRQ], - v3d_irq, IRQF_SHARED, - "v3d_core0", v3d); - if (ret) - goto fail; -- ret = devm_request_irq(v3d->drm.dev, -- platform_get_irq(v3d_to_pdev(v3d), 0), -+ -+ irq = platform_get_irq(v3d_to_pdev(v3d), 0); -+ if (irq < 0) -+ return irq; -+ v3d->irq[V3D_HUB_IRQ] = irq; -+ -+ ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_HUB_IRQ], - v3d_hub_irq, IRQF_SHARED, - "v3d_hub", v3d); - if (ret) -@@ -244,8 +251,12 @@ v3d_irq_init(struct v3d_dev *v3d) - } else { - v3d->single_irq_line = true; - -- ret = devm_request_irq(v3d->drm.dev, -- platform_get_irq(v3d_to_pdev(v3d), 0), -+ irq = platform_get_irq(v3d_to_pdev(v3d), 0); -+ if (irq < 0) -+ return irq; -+ v3d->irq[V3D_CORE_IRQ] = irq; -+ -+ ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_CORE_IRQ], - v3d_irq, IRQF_SHARED, - "v3d", v3d); - if (ret) -@@ -286,6 +297,12 @@ v3d_irq_disable(struct v3d_dev *v3d) - V3D_CORE_WRITE(core, V3D_CTL_INT_MSK_SET, ~0); - V3D_WRITE(V3D_HUB_INT_MSK_SET, ~0); - -+ /* Finish any interrupt handler still in flight. */ -+ for (int i = 0; i < V3D_MAX_IRQS; i++) { -+ if (v3d->irq[i]) -+ synchronize_irq(v3d->irq[i]); -+ } -+ - /* Clear any pending interrupts we might have left. */ - for (core = 0; core < v3d->cores; core++) - V3D_CORE_WRITE(core, V3D_CTL_INT_CLR, V3D_CORE_IRQS); -diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c -index 51f5491648c077..e865869ccc50ee 100644 ---- a/drivers/i2c/busses/i2c-designware-master.c -+++ b/drivers/i2c/busses/i2c-designware-master.c -@@ -327,6 +327,7 @@ static int amd_i2c_dw_xfer_quirk(struct i2c_adapter *adap, struct i2c_msg *msgs, - - dev->msgs = msgs; - dev->msgs_num = num_msgs; -+ dev->msg_write_idx = 0; - i2c_dw_xfer_init(dev); - regmap_write(dev->map, DW_IC_INTR_MASK, 0); - -diff --git a/drivers/infiniband/hw/mlx5/counters.c b/drivers/infiniband/hw/mlx5/counters.c -index b049bba2157905..d06128501ce4e7 100644 ---- a/drivers/infiniband/hw/mlx5/counters.c -+++ b/drivers/infiniband/hw/mlx5/counters.c -@@ -387,7 +387,7 @@ static int do_get_hw_stats(struct ib_device *ibdev, - return ret; - - /* We don't expose device counters over Vports */ -- if (is_mdev_switchdev_mode(dev->mdev) && port_num != 0) -+ if (is_mdev_switchdev_mode(dev->mdev) && dev->is_rep && port_num != 0) - goto done; - - if (MLX5_CAP_PCAM_FEATURE(dev->mdev, rx_icrc_encapsulated_counter)) { -@@ -407,7 +407,7 @@ static int do_get_hw_stats(struct ib_device *ibdev, - */ - goto done; - } -- ret = mlx5_lag_query_cong_counters(dev->mdev, -+ ret = mlx5_lag_query_cong_counters(mdev, - stats->value + - cnts->num_q_counters, - cnts->num_cong_counters, -diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c -index 6e19974ecf6e71..3f1fa45d936821 100644 ---- a/drivers/infiniband/hw/mlx5/devx.c -+++ b/drivers/infiniband/hw/mlx5/devx.c -@@ -1914,6 +1914,7 @@ subscribe_event_xa_alloc(struct mlx5_devx_event_table *devx_event_table, - /* Level1 is valid for future use, no need to free */ - return -ENOMEM; - -+ INIT_LIST_HEAD(&obj_event->obj_sub_list); - err = xa_insert(&event->object_ids, - key_level2, - obj_event, -@@ -1922,7 +1923,6 @@ subscribe_event_xa_alloc(struct mlx5_devx_event_table *devx_event_table, - kfree(obj_event); - return err; - } -- INIT_LIST_HEAD(&obj_event->obj_sub_list); - } - - return 0; -diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c -index ada7dbf8eb1cf5..e922fb87286547 100644 ---- a/drivers/infiniband/hw/mlx5/main.c -+++ b/drivers/infiniband/hw/mlx5/main.c -@@ -1690,6 +1690,33 @@ static void deallocate_uars(struct mlx5_ib_dev *dev, - context->devx_uid); - } - -+static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, -+ struct mlx5_core_dev *slave) -+{ -+ int err; -+ -+ err = mlx5_nic_vport_update_local_lb(master, true); -+ if (err) -+ return err; -+ -+ err = mlx5_nic_vport_update_local_lb(slave, true); -+ if (err) -+ goto out; -+ -+ return 0; -+ -+out: -+ mlx5_nic_vport_update_local_lb(master, false); -+ return err; -+} -+ -+static void mlx5_ib_disable_lb_mp(struct mlx5_core_dev *master, -+ struct mlx5_core_dev *slave) -+{ -+ mlx5_nic_vport_update_local_lb(slave, false); -+ mlx5_nic_vport_update_local_lb(master, false); -+} -+ - int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) - { - int err = 0; -@@ -3224,6 +3251,8 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev, - - lockdep_assert_held(&mlx5_ib_multiport_mutex); - -+ mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev); -+ - mlx5_core_mp_event_replay(ibdev->mdev, - MLX5_DRIVER_EVENT_AFFILIATION_REMOVED, - NULL); -@@ -3319,6 +3348,10 @@ static bool mlx5_ib_bind_slave_port(struct mlx5_ib_dev *ibdev, - MLX5_DRIVER_EVENT_AFFILIATION_DONE, - &key); - -+ err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev); -+ if (err) -+ goto unbind; -+ - return true; - - unbind: -diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c -index e6fed973ea7411..05c00421ff2b7e 100644 ---- a/drivers/input/joystick/xpad.c -+++ b/drivers/input/joystick/xpad.c -@@ -174,6 +174,7 @@ static const struct xpad_device { - { 0x05fd, 0x107a, "InterAct 'PowerPad Pro' X-Box pad (Germany)", 0, XTYPE_XBOX }, - { 0x05fe, 0x3030, "Chic Controller", 0, XTYPE_XBOX }, - { 0x05fe, 0x3031, "Chic Controller", 0, XTYPE_XBOX }, -+ { 0x0502, 0x1305, "Acer NGR200", 0, XTYPE_XBOX }, - { 0x062a, 0x0020, "Logic3 Xbox GamePad", 0, XTYPE_XBOX }, - { 0x062a, 0x0033, "Competition Pro Steering Wheel", 0, XTYPE_XBOX }, - { 0x06a3, 0x0200, "Saitek Racing Wheel", 0, XTYPE_XBOX }, -@@ -514,6 +515,7 @@ static const struct usb_device_id xpad_table[] = { - XPAD_XBOX360_VENDOR(0x045e), /* Microsoft Xbox 360 controllers */ - XPAD_XBOXONE_VENDOR(0x045e), /* Microsoft Xbox One controllers */ - XPAD_XBOX360_VENDOR(0x046d), /* Logitech Xbox 360-style controllers */ -+ XPAD_XBOX360_VENDOR(0x0502), /* Acer Inc. Xbox 360 style controllers */ - XPAD_XBOX360_VENDOR(0x056e), /* Elecom JC-U3613M */ - XPAD_XBOX360_VENDOR(0x06a3), /* Saitek P3600 */ - XPAD_XBOX360_VENDOR(0x0738), /* Mad Catz Xbox 360 controllers */ -diff --git a/drivers/input/misc/iqs7222.c b/drivers/input/misc/iqs7222.c -index b98529568eeb83..ce7e977cc8a7a1 100644 ---- a/drivers/input/misc/iqs7222.c -+++ b/drivers/input/misc/iqs7222.c -@@ -301,6 +301,7 @@ struct iqs7222_dev_desc { - int allow_offset; - int event_offset; - int comms_offset; -+ int ext_chan; - bool legacy_gesture; - struct iqs7222_reg_grp_desc reg_grps[IQS7222_NUM_REG_GRPS]; - }; -@@ -315,6 +316,7 @@ static const struct iqs7222_dev_desc iqs7222_devs[] = { - .allow_offset = 9, - .event_offset = 10, - .comms_offset = 12, -+ .ext_chan = 10, - .reg_grps = { - [IQS7222_REG_GRP_STAT] = { - .base = IQS7222_SYS_STATUS, -@@ -373,6 +375,7 @@ static const struct iqs7222_dev_desc iqs7222_devs[] = { - .allow_offset = 9, - .event_offset = 10, - .comms_offset = 12, -+ .ext_chan = 10, - .legacy_gesture = true, - .reg_grps = { - [IQS7222_REG_GRP_STAT] = { -@@ -2244,7 +2247,7 @@ static int iqs7222_parse_chan(struct iqs7222_private *iqs7222, - const struct iqs7222_dev_desc *dev_desc = iqs7222->dev_desc; - struct i2c_client *client = iqs7222->client; - int num_chan = dev_desc->reg_grps[IQS7222_REG_GRP_CHAN].num_row; -- int ext_chan = rounddown(num_chan, 10); -+ int ext_chan = dev_desc->ext_chan ? : num_chan; - int error, i; - u16 *chan_setup = iqs7222->chan_setup[chan_index]; - u16 *sys_setup = iqs7222->sys_setup; -@@ -2448,7 +2451,7 @@ static int iqs7222_parse_sldr(struct iqs7222_private *iqs7222, - const struct iqs7222_dev_desc *dev_desc = iqs7222->dev_desc; - struct i2c_client *client = iqs7222->client; - int num_chan = dev_desc->reg_grps[IQS7222_REG_GRP_CHAN].num_row; -- int ext_chan = rounddown(num_chan, 10); -+ int ext_chan = dev_desc->ext_chan ? : num_chan; - int count, error, reg_offset, i; - u16 *event_mask = &iqs7222->sys_setup[dev_desc->event_offset]; - u16 *sldr_setup = iqs7222->sldr_setup[sldr_index]; -diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c -index 8ff69fbf9f65db..36fec26d2a04ac 100644 ---- a/drivers/iommu/rockchip-iommu.c -+++ b/drivers/iommu/rockchip-iommu.c -@@ -1177,7 +1177,6 @@ static int rk_iommu_of_xlate(struct device *dev, - iommu_dev = of_find_device_by_node(args->np); - - data->iommu = platform_get_drvdata(iommu_dev); -- data->iommu->domain = &rk_identity_domain; - dev_iommu_priv_set(dev, data); - - platform_device_put(iommu_dev); -@@ -1217,6 +1216,8 @@ static int rk_iommu_probe(struct platform_device *pdev) - if (!iommu) - return -ENOMEM; - -+ iommu->domain = &rk_identity_domain; -+ - platform_set_drvdata(pdev, iommu); - iommu->dev = dev; - iommu->num_mmu = 0; -diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h -index 7f893bafaa607d..c417ed34c05767 100644 ---- a/drivers/mmc/core/quirks.h -+++ b/drivers/mmc/core/quirks.h -@@ -44,6 +44,12 @@ static const struct mmc_fixup __maybe_unused mmc_sd_fixups[] = { - 0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd, - MMC_QUIRK_NO_UHS_DDR50_TUNING, EXT_CSD_REV_ANY), - -+ /* -+ * Some SD cards reports discard support while they don't -+ */ -+ MMC_FIXUP(CID_NAME_ANY, CID_MANFID_SANDISK_SD, 0x5344, add_quirk_sd, -+ MMC_QUIRK_BROKEN_SD_DISCARD), -+ - END_FIXUP - }; - -@@ -147,12 +153,6 @@ static const struct mmc_fixup __maybe_unused mmc_blk_fixups[] = { - MMC_FIXUP("M62704", CID_MANFID_KINGSTON, 0x0100, add_quirk_mmc, - MMC_QUIRK_TRIM_BROKEN), - -- /* -- * Some SD cards reports discard support while they don't -- */ -- MMC_FIXUP(CID_NAME_ANY, CID_MANFID_SANDISK_SD, 0x5344, add_quirk_sd, -- MMC_QUIRK_BROKEN_SD_DISCARD), -- - END_FIXUP - }; - -diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c -index 02f3748e46c144..cf685c0a17edc0 100644 ---- a/drivers/mmc/host/mtk-sd.c -+++ b/drivers/mmc/host/mtk-sd.c -@@ -770,12 +770,18 @@ static inline void msdc_dma_setup(struct msdc_host *host, struct msdc_dma *dma, - static void msdc_prepare_data(struct msdc_host *host, struct mmc_data *data) - { - if (!(data->host_cookie & MSDC_PREPARE_FLAG)) { -- data->host_cookie |= MSDC_PREPARE_FLAG; - data->sg_count = dma_map_sg(host->dev, data->sg, data->sg_len, - mmc_get_dma_dir(data)); -+ if (data->sg_count) -+ data->host_cookie |= MSDC_PREPARE_FLAG; - } - } - -+static bool msdc_data_prepared(struct mmc_data *data) -+{ -+ return data->host_cookie & MSDC_PREPARE_FLAG; -+} -+ - static void msdc_unprepare_data(struct msdc_host *host, struct mmc_data *data) - { - if (data->host_cookie & MSDC_ASYNC_FLAG) -@@ -1338,8 +1344,19 @@ static void msdc_ops_request(struct mmc_host *mmc, struct mmc_request *mrq) - WARN_ON(host->mrq); - host->mrq = mrq; - -- if (mrq->data) -+ if (mrq->data) { - msdc_prepare_data(host, mrq->data); -+ if (!msdc_data_prepared(mrq->data)) { -+ host->mrq = NULL; -+ /* -+ * Failed to prepare DMA area, fail fast before -+ * starting any commands. -+ */ -+ mrq->cmd->error = -ENOSPC; -+ mmc_request_done(mmc_from_priv(host), mrq); -+ return; -+ } -+ } - - /* if SBC is required, we have HW option and SW option. - * if HW option is enabled, and SBC does not have "special" flags, -diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c -index f32429ff905ff6..9796a3cb3ca62c 100644 ---- a/drivers/mmc/host/sdhci.c -+++ b/drivers/mmc/host/sdhci.c -@@ -2035,15 +2035,10 @@ void sdhci_set_clock(struct sdhci_host *host, unsigned int clock) - - host->mmc->actual_clock = 0; - -- clk = sdhci_readw(host, SDHCI_CLOCK_CONTROL); -- if (clk & SDHCI_CLOCK_CARD_EN) -- sdhci_writew(host, clk & ~SDHCI_CLOCK_CARD_EN, -- SDHCI_CLOCK_CONTROL); -+ sdhci_writew(host, 0, SDHCI_CLOCK_CONTROL); - -- if (clock == 0) { -- sdhci_writew(host, 0, SDHCI_CLOCK_CONTROL); -+ if (clock == 0) - return; -- } - - clk = sdhci_calc_clk(host, clock, &host->mmc->actual_clock); - sdhci_enable_clk(host, clk); -diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h -index a315cee698094f..16d7bff9eae562 100644 ---- a/drivers/mmc/host/sdhci.h -+++ b/drivers/mmc/host/sdhci.h -@@ -825,4 +825,20 @@ void sdhci_switch_external_dma(struct sdhci_host *host, bool en); - void sdhci_set_data_timeout_irq(struct sdhci_host *host, bool enable); - void __sdhci_set_timeout(struct sdhci_host *host, struct mmc_command *cmd); - -+#if defined(CONFIG_DYNAMIC_DEBUG) || \ -+ (defined(CONFIG_DYNAMIC_DEBUG_CORE) && defined(DYNAMIC_DEBUG_MODULE)) -+#define SDHCI_DBG_ANYWAY 0 -+#elif defined(DEBUG) -+#define SDHCI_DBG_ANYWAY 1 -+#else -+#define SDHCI_DBG_ANYWAY 0 -+#endif -+ -+#define sdhci_dbg_dumpregs(host, fmt) \ -+do { \ -+ DEFINE_DYNAMIC_DEBUG_METADATA(descriptor, fmt); \ -+ if (DYNAMIC_DEBUG_BRANCH(descriptor) || SDHCI_DBG_ANYWAY) \ -+ sdhci_dumpregs(host); \ -+} while (0) -+ - #endif /* __SDHCI_HW_H */ -diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c -index 393ff37f0d23c1..cd21bf8f254a75 100644 ---- a/drivers/mtd/nand/spi/core.c -+++ b/drivers/mtd/nand/spi/core.c -@@ -1316,6 +1316,7 @@ static void spinand_cleanup(struct spinand_device *spinand) - { - struct nand_device *nand = spinand_to_nand(spinand); - -+ nanddev_ecc_engine_cleanup(nand); - nanddev_cleanup(nand); - spinand_manufacturer_cleanup(spinand); - kfree(spinand->databuf); -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h -index 3b70f67376331e..aa25a8a0a106f6 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h -+++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h -@@ -1373,6 +1373,8 @@ - #define MDIO_VEND2_CTRL1_SS13 BIT(13) - #endif - -+#define XGBE_VEND2_MAC_AUTO_SW BIT(9) -+ - /* MDIO mask values */ - #define XGBE_AN_CL73_INT_CMPLT BIT(0) - #define XGBE_AN_CL73_INC_LINK BIT(1) -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c -index 4a2dc705b52801..8345d439184ebe 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c -+++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c -@@ -375,6 +375,10 @@ static void xgbe_an37_set(struct xgbe_prv_data *pdata, bool enable, - reg |= MDIO_VEND2_CTRL1_AN_RESTART; - - XMDIO_WRITE(pdata, MDIO_MMD_VEND2, MDIO_CTRL1, reg); -+ -+ reg = XMDIO_READ(pdata, MDIO_MMD_VEND2, MDIO_PCS_DIG_CTRL); -+ reg |= XGBE_VEND2_MAC_AUTO_SW; -+ XMDIO_WRITE(pdata, MDIO_MMD_VEND2, MDIO_PCS_DIG_CTRL, reg); - } - - static void xgbe_an37_restart(struct xgbe_prv_data *pdata) -@@ -1003,6 +1007,11 @@ static void xgbe_an37_init(struct xgbe_prv_data *pdata) - - netif_dbg(pdata, link, pdata->netdev, "CL37 AN (%s) initialized\n", - (pdata->an_mode == XGBE_AN_MODE_CL37) ? "BaseX" : "SGMII"); -+ -+ reg = XMDIO_READ(pdata, MDIO_MMD_AN, MDIO_CTRL1); -+ reg &= ~MDIO_AN_CTRL1_ENABLE; -+ XMDIO_WRITE(pdata, MDIO_MMD_AN, MDIO_CTRL1, reg); -+ - } - - static void xgbe_an73_init(struct xgbe_prv_data *pdata) -@@ -1404,6 +1413,10 @@ static void xgbe_phy_status(struct xgbe_prv_data *pdata) - - pdata->phy.link = pdata->phy_if.phy_impl.link_status(pdata, - &an_restart); -+ /* bail out if the link status register read fails */ -+ if (pdata->phy.link < 0) -+ return; -+ - if (an_restart) { - xgbe_phy_config_aneg(pdata); - goto adjust_link; -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c -index 268399dfcf22f0..32e633d1134843 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c -+++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c -@@ -2855,8 +2855,7 @@ static bool xgbe_phy_valid_speed(struct xgbe_prv_data *pdata, int speed) - static int xgbe_phy_link_status(struct xgbe_prv_data *pdata, int *an_restart) - { - struct xgbe_phy_data *phy_data = pdata->phy_data; -- unsigned int reg; -- int ret; -+ int reg, ret; - - *an_restart = 0; - -@@ -2890,11 +2889,20 @@ static int xgbe_phy_link_status(struct xgbe_prv_data *pdata, int *an_restart) - return 0; - } - -- /* Link status is latched low, so read once to clear -- * and then read again to get current state -- */ -- reg = XMDIO_READ(pdata, MDIO_MMD_PCS, MDIO_STAT1); - reg = XMDIO_READ(pdata, MDIO_MMD_PCS, MDIO_STAT1); -+ if (reg < 0) -+ return reg; -+ -+ /* Link status is latched low so that momentary link drops -+ * can be detected. If link was already down read again -+ * to get the latest state. -+ */ -+ -+ if (!pdata->phy.link && !(reg & MDIO_STAT1_LSTATUS)) { -+ reg = XMDIO_READ(pdata, MDIO_MMD_PCS, MDIO_STAT1); -+ if (reg < 0) -+ return reg; -+ } - - if (pdata->en_rx_adap) { - /* if the link is available and adaptation is done, -@@ -2913,9 +2921,7 @@ static int xgbe_phy_link_status(struct xgbe_prv_data *pdata, int *an_restart) - xgbe_phy_set_mode(pdata, phy_data->cur_mode); - } - -- /* check again for the link and adaptation status */ -- reg = XMDIO_READ(pdata, MDIO_MMD_PCS, MDIO_STAT1); -- if ((reg & MDIO_STAT1_LSTATUS) && pdata->rx_adapt_done) -+ if (pdata->rx_adapt_done) - return 1; - } else if (reg & MDIO_STAT1_LSTATUS) - return 1; -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h -index 173f4dad470f55..a596cd08124fa4 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe.h -+++ b/drivers/net/ethernet/amd/xgbe/xgbe.h -@@ -292,12 +292,12 @@ - #define XGBE_LINK_TIMEOUT 5 - #define XGBE_KR_TRAINING_WAIT_ITER 50 - --#define XGBE_SGMII_AN_LINK_STATUS BIT(1) -+#define XGBE_SGMII_AN_LINK_DUPLEX BIT(1) - #define XGBE_SGMII_AN_LINK_SPEED (BIT(2) | BIT(3)) - #define XGBE_SGMII_AN_LINK_SPEED_10 0x00 - #define XGBE_SGMII_AN_LINK_SPEED_100 0x04 - #define XGBE_SGMII_AN_LINK_SPEED_1000 0x08 --#define XGBE_SGMII_AN_LINK_DUPLEX BIT(4) -+#define XGBE_SGMII_AN_LINK_STATUS BIT(4) - - /* ECC correctable error notification window (seconds) */ - #define XGBE_ECC_LIMIT 60 -diff --git a/drivers/net/ethernet/atheros/atlx/atl1.c b/drivers/net/ethernet/atheros/atlx/atl1.c -index 02aa6fd8ebc2d4..4ed165702d58eb 100644 ---- a/drivers/net/ethernet/atheros/atlx/atl1.c -+++ b/drivers/net/ethernet/atheros/atlx/atl1.c -@@ -1861,14 +1861,21 @@ static u16 atl1_alloc_rx_buffers(struct atl1_adapter *adapter) - break; - } - -- buffer_info->alloced = 1; -- buffer_info->skb = skb; -- buffer_info->length = (u16) adapter->rx_buffer_len; - page = virt_to_page(skb->data); - offset = offset_in_page(skb->data); - buffer_info->dma = dma_map_page(&pdev->dev, page, offset, - adapter->rx_buffer_len, - DMA_FROM_DEVICE); -+ if (dma_mapping_error(&pdev->dev, buffer_info->dma)) { -+ kfree_skb(skb); -+ adapter->soft_stats.rx_dropped++; -+ break; -+ } -+ -+ buffer_info->alloced = 1; -+ buffer_info->skb = skb; -+ buffer_info->length = (u16)adapter->rx_buffer_len; -+ - rfd_desc->buffer_addr = cpu_to_le64(buffer_info->dma); - rfd_desc->buf_len = cpu_to_le16(adapter->rx_buffer_len); - rfd_desc->coalese = 0; -@@ -2183,8 +2190,8 @@ static int atl1_tx_csum(struct atl1_adapter *adapter, struct sk_buff *skb, - return 0; - } - --static void atl1_tx_map(struct atl1_adapter *adapter, struct sk_buff *skb, -- struct tx_packet_desc *ptpd) -+static bool atl1_tx_map(struct atl1_adapter *adapter, struct sk_buff *skb, -+ struct tx_packet_desc *ptpd) - { - struct atl1_tpd_ring *tpd_ring = &adapter->tpd_ring; - struct atl1_buffer *buffer_info; -@@ -2194,6 +2201,7 @@ static void atl1_tx_map(struct atl1_adapter *adapter, struct sk_buff *skb, - unsigned int nr_frags; - unsigned int f; - int retval; -+ u16 first_mapped; - u16 next_to_use; - u16 data_len; - u8 hdr_len; -@@ -2201,6 +2209,7 @@ static void atl1_tx_map(struct atl1_adapter *adapter, struct sk_buff *skb, - buf_len -= skb->data_len; - nr_frags = skb_shinfo(skb)->nr_frags; - next_to_use = atomic_read(&tpd_ring->next_to_use); -+ first_mapped = next_to_use; - buffer_info = &tpd_ring->buffer_info[next_to_use]; - BUG_ON(buffer_info->skb); - /* put skb in last TPD */ -@@ -2216,6 +2225,8 @@ static void atl1_tx_map(struct atl1_adapter *adapter, struct sk_buff *skb, - buffer_info->dma = dma_map_page(&adapter->pdev->dev, page, - offset, hdr_len, - DMA_TO_DEVICE); -+ if (dma_mapping_error(&adapter->pdev->dev, buffer_info->dma)) -+ goto dma_err; - - if (++next_to_use == tpd_ring->count) - next_to_use = 0; -@@ -2242,6 +2253,9 @@ static void atl1_tx_map(struct atl1_adapter *adapter, struct sk_buff *skb, - page, offset, - buffer_info->length, - DMA_TO_DEVICE); -+ if (dma_mapping_error(&adapter->pdev->dev, -+ buffer_info->dma)) -+ goto dma_err; - if (++next_to_use == tpd_ring->count) - next_to_use = 0; - } -@@ -2254,6 +2268,8 @@ static void atl1_tx_map(struct atl1_adapter *adapter, struct sk_buff *skb, - buffer_info->dma = dma_map_page(&adapter->pdev->dev, page, - offset, buf_len, - DMA_TO_DEVICE); -+ if (dma_mapping_error(&adapter->pdev->dev, buffer_info->dma)) -+ goto dma_err; - if (++next_to_use == tpd_ring->count) - next_to_use = 0; - } -@@ -2277,6 +2293,9 @@ static void atl1_tx_map(struct atl1_adapter *adapter, struct sk_buff *skb, - buffer_info->dma = skb_frag_dma_map(&adapter->pdev->dev, - frag, i * ATL1_MAX_TX_BUF_LEN, - buffer_info->length, DMA_TO_DEVICE); -+ if (dma_mapping_error(&adapter->pdev->dev, -+ buffer_info->dma)) -+ goto dma_err; - - if (++next_to_use == tpd_ring->count) - next_to_use = 0; -@@ -2285,6 +2304,22 @@ static void atl1_tx_map(struct atl1_adapter *adapter, struct sk_buff *skb, - - /* last tpd's buffer-info */ - buffer_info->skb = skb; -+ -+ return true; -+ -+ dma_err: -+ while (first_mapped != next_to_use) { -+ buffer_info = &tpd_ring->buffer_info[first_mapped]; -+ dma_unmap_page(&adapter->pdev->dev, -+ buffer_info->dma, -+ buffer_info->length, -+ DMA_TO_DEVICE); -+ buffer_info->dma = 0; -+ -+ if (++first_mapped == tpd_ring->count) -+ first_mapped = 0; -+ } -+ return false; - } - - static void atl1_tx_queue(struct atl1_adapter *adapter, u16 count, -@@ -2355,10 +2390,8 @@ static netdev_tx_t atl1_xmit_frame(struct sk_buff *skb, - - len = skb_headlen(skb); - -- if (unlikely(skb->len <= 0)) { -- dev_kfree_skb_any(skb); -- return NETDEV_TX_OK; -- } -+ if (unlikely(skb->len <= 0)) -+ goto drop_packet; - - nr_frags = skb_shinfo(skb)->nr_frags; - for (f = 0; f < nr_frags; f++) { -@@ -2371,10 +2404,9 @@ static netdev_tx_t atl1_xmit_frame(struct sk_buff *skb, - if (mss) { - if (skb->protocol == htons(ETH_P_IP)) { - proto_hdr_len = skb_tcp_all_headers(skb); -- if (unlikely(proto_hdr_len > len)) { -- dev_kfree_skb_any(skb); -- return NETDEV_TX_OK; -- } -+ if (unlikely(proto_hdr_len > len)) -+ goto drop_packet; -+ - /* need additional TPD ? */ - if (proto_hdr_len != len) - count += (len - proto_hdr_len + -@@ -2406,23 +2438,26 @@ static netdev_tx_t atl1_xmit_frame(struct sk_buff *skb, - } - - tso = atl1_tso(adapter, skb, ptpd); -- if (tso < 0) { -- dev_kfree_skb_any(skb); -- return NETDEV_TX_OK; -- } -+ if (tso < 0) -+ goto drop_packet; - - if (!tso) { - ret_val = atl1_tx_csum(adapter, skb, ptpd); -- if (ret_val < 0) { -- dev_kfree_skb_any(skb); -- return NETDEV_TX_OK; -- } -+ if (ret_val < 0) -+ goto drop_packet; - } - -- atl1_tx_map(adapter, skb, ptpd); -+ if (!atl1_tx_map(adapter, skb, ptpd)) -+ goto drop_packet; -+ - atl1_tx_queue(adapter, count, ptpd); - atl1_update_mailbox(adapter); - return NETDEV_TX_OK; -+ -+drop_packet: -+ adapter->soft_stats.tx_errors++; -+ dev_kfree_skb_any(skb); -+ return NETDEV_TX_OK; - } - - static int atl1_rings_clean(struct napi_struct *napi, int budget) -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index 6bf4a21853858f..8e4e8291d8c66f 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -2491,6 +2491,7 @@ static int __bnxt_poll_work(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, - { - struct bnxt_napi *bnapi = cpr->bnapi; - u32 raw_cons = cpr->cp_raw_cons; -+ bool flush_xdp = false; - u32 cons; - int tx_pkts = 0; - int rx_pkts = 0; -@@ -2528,6 +2529,8 @@ static int __bnxt_poll_work(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, - else - rc = bnxt_force_rx_discard(bp, cpr, &raw_cons, - &event); -+ if (event & BNXT_REDIRECT_EVENT) -+ flush_xdp = true; - if (likely(rc >= 0)) - rx_pkts += rc; - /* Increment rx_pkts when rc is -ENOMEM to count towards -@@ -2555,8 +2558,10 @@ static int __bnxt_poll_work(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, - } - } - -- if (event & BNXT_REDIRECT_EVENT) -+ if (flush_xdp) { - xdp_do_flush(); -+ event &= ~BNXT_REDIRECT_EVENT; -+ } - - if (event & BNXT_TX_EVENT) { - struct bnxt_tx_ring_info *txr = bnapi->tx_ring; -diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c -index cccf0db2fb4e58..48701032c20c56 100644 ---- a/drivers/net/ethernet/cisco/enic/enic_main.c -+++ b/drivers/net/ethernet/cisco/enic/enic_main.c -@@ -2057,10 +2057,10 @@ static int enic_change_mtu(struct net_device *netdev, int new_mtu) - if (enic_is_dynamic(enic) || enic_is_sriov_vf(enic)) - return -EOPNOTSUPP; - -- if (netdev->mtu > enic->port_mtu) -+ if (new_mtu > enic->port_mtu) - netdev_warn(netdev, - "interface MTU (%d) set higher than port MTU (%d)\n", -- netdev->mtu, enic->port_mtu); -+ new_mtu, enic->port_mtu); - - return _enic_change_mtu(netdev, new_mtu); - } -diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c -index 40e88182959519..d3c36a6f84b01d 100644 ---- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c -+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c -@@ -3928,6 +3928,7 @@ static int dpaa2_eth_setup_rx_flow(struct dpaa2_eth_priv *priv, - MEM_TYPE_PAGE_ORDER0, NULL); - if (err) { - dev_err(dev, "xdp_rxq_info_reg_mem_model failed\n"); -+ xdp_rxq_info_unreg(&fq->channel->xdp_rxq); - return err; - } - -@@ -4421,17 +4422,25 @@ static int dpaa2_eth_bind_dpni(struct dpaa2_eth_priv *priv) - return -EINVAL; - } - if (err) -- return err; -+ goto out; - } - - err = dpni_get_qdid(priv->mc_io, 0, priv->mc_token, - DPNI_QUEUE_TX, &priv->tx_qdid); - if (err) { - dev_err(dev, "dpni_get_qdid() failed\n"); -- return err; -+ goto out; - } - - return 0; -+ -+out: -+ while (i--) { -+ if (priv->fq[i].type == DPAA2_RX_FQ && -+ xdp_rxq_info_is_reg(&priv->fq[i].channel->xdp_rxq)) -+ xdp_rxq_info_unreg(&priv->fq[i].channel->xdp_rxq); -+ } -+ return err; - } - - /* Allocate rings for storing incoming frame descriptors */ -@@ -4813,6 +4822,17 @@ static void dpaa2_eth_del_ch_napi(struct dpaa2_eth_priv *priv) - } - } - -+static void dpaa2_eth_free_rx_xdp_rxq(struct dpaa2_eth_priv *priv) -+{ -+ int i; -+ -+ for (i = 0; i < priv->num_fqs; i++) { -+ if (priv->fq[i].type == DPAA2_RX_FQ && -+ xdp_rxq_info_is_reg(&priv->fq[i].channel->xdp_rxq)) -+ xdp_rxq_info_unreg(&priv->fq[i].channel->xdp_rxq); -+ } -+} -+ - static int dpaa2_eth_probe(struct fsl_mc_device *dpni_dev) - { - struct device *dev; -@@ -5016,6 +5036,7 @@ static int dpaa2_eth_probe(struct fsl_mc_device *dpni_dev) - free_percpu(priv->percpu_stats); - err_alloc_percpu_stats: - dpaa2_eth_del_ch_napi(priv); -+ dpaa2_eth_free_rx_xdp_rxq(priv); - err_bind: - dpaa2_eth_free_dpbps(priv); - err_dpbp_setup: -@@ -5068,6 +5089,7 @@ static void dpaa2_eth_remove(struct fsl_mc_device *ls_dev) - free_percpu(priv->percpu_extras); - - dpaa2_eth_del_ch_napi(priv); -+ dpaa2_eth_free_rx_xdp_rxq(priv); - dpaa2_eth_free_dpbps(priv); - dpaa2_eth_free_dpio(priv); - dpaa2_eth_free_dpni(priv); -diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c -index e2f5c4384455e0..11543db4c47f0e 100644 ---- a/drivers/net/ethernet/intel/igc/igc_main.c -+++ b/drivers/net/ethernet/intel/igc/igc_main.c -@@ -6772,6 +6772,10 @@ static int igc_probe(struct pci_dev *pdev, - adapter->port_num = hw->bus.func; - adapter->msg_enable = netif_msg_init(debug, DEFAULT_MSG_ENABLE); - -+ /* Disable ASPM L1.2 on I226 devices to avoid packet loss */ -+ if (igc_is_device_id_i226(hw)) -+ pci_disable_link_state(pdev, PCIE_LINK_STATE_L1_2); -+ - err = pci_save_state(pdev); - if (err) - goto err_ioremap; -@@ -7144,6 +7148,9 @@ static int __maybe_unused igc_resume(struct device *dev) - pci_enable_wake(pdev, PCI_D3hot, 0); - pci_enable_wake(pdev, PCI_D3cold, 0); - -+ if (igc_is_device_id_i226(hw)) -+ pci_disable_link_state(pdev, PCIE_LINK_STATE_L1_2); -+ - if (igc_init_interrupt_scheme(adapter, true)) { - netdev_err(netdev, "Unable to allocate memory for queues\n"); - return -ENOMEM; -@@ -7259,6 +7266,9 @@ static pci_ers_result_t igc_io_slot_reset(struct pci_dev *pdev) - pci_enable_wake(pdev, PCI_D3hot, 0); - pci_enable_wake(pdev, PCI_D3cold, 0); - -+ if (igc_is_device_id_i226(hw)) -+ pci_disable_link_state_locked(pdev, PCIE_LINK_STATE_L1_2); -+ - /* In case of PCI error, adapter loses its HW address - * so we should re-assign it here. - */ -diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c -index 011d74087f860d..fc6217917fc22b 100644 ---- a/drivers/net/ethernet/sun/niu.c -+++ b/drivers/net/ethernet/sun/niu.c -@@ -3336,7 +3336,7 @@ static int niu_rbr_add_page(struct niu *np, struct rx_ring_info *rp, - - addr = np->ops->map_page(np->device, page, 0, - PAGE_SIZE, DMA_FROM_DEVICE); -- if (!addr) { -+ if (np->ops->mapping_error(np->device, addr)) { - __free_page(page); - return -ENOMEM; - } -@@ -6672,6 +6672,8 @@ static netdev_tx_t niu_start_xmit(struct sk_buff *skb, - len = skb_headlen(skb); - mapping = np->ops->map_single(np->device, skb->data, - len, DMA_TO_DEVICE); -+ if (np->ops->mapping_error(np->device, mapping)) -+ goto out_drop; - - prod = rp->prod; - -@@ -6713,6 +6715,8 @@ static netdev_tx_t niu_start_xmit(struct sk_buff *skb, - mapping = np->ops->map_page(np->device, skb_frag_page(frag), - skb_frag_off(frag), len, - DMA_TO_DEVICE); -+ if (np->ops->mapping_error(np->device, mapping)) -+ goto out_unmap; - - rp->tx_buffs[prod].skb = NULL; - rp->tx_buffs[prod].mapping = mapping; -@@ -6737,6 +6741,19 @@ static netdev_tx_t niu_start_xmit(struct sk_buff *skb, - out: - return NETDEV_TX_OK; - -+out_unmap: -+ while (i--) { -+ const skb_frag_t *frag; -+ -+ prod = PREVIOUS_TX(rp, prod); -+ frag = &skb_shinfo(skb)->frags[i]; -+ np->ops->unmap_page(np->device, rp->tx_buffs[prod].mapping, -+ skb_frag_size(frag), DMA_TO_DEVICE); -+ } -+ -+ np->ops->unmap_single(np->device, rp->tx_buffs[rp->prod].mapping, -+ skb_headlen(skb), DMA_TO_DEVICE); -+ - out_drop: - rp->tx_errors++; - kfree_skb(skb); -@@ -9636,6 +9653,11 @@ static void niu_pci_unmap_single(struct device *dev, u64 dma_address, - dma_unmap_single(dev, dma_address, size, direction); - } - -+static int niu_pci_mapping_error(struct device *dev, u64 addr) -+{ -+ return dma_mapping_error(dev, addr); -+} -+ - static const struct niu_ops niu_pci_ops = { - .alloc_coherent = niu_pci_alloc_coherent, - .free_coherent = niu_pci_free_coherent, -@@ -9643,6 +9665,7 @@ static const struct niu_ops niu_pci_ops = { - .unmap_page = niu_pci_unmap_page, - .map_single = niu_pci_map_single, - .unmap_single = niu_pci_unmap_single, -+ .mapping_error = niu_pci_mapping_error, - }; - - static void niu_driver_version(void) -@@ -10009,6 +10032,11 @@ static void niu_phys_unmap_single(struct device *dev, u64 dma_address, - /* Nothing to do. */ - } - -+static int niu_phys_mapping_error(struct device *dev, u64 dma_address) -+{ -+ return false; -+} -+ - static const struct niu_ops niu_phys_ops = { - .alloc_coherent = niu_phys_alloc_coherent, - .free_coherent = niu_phys_free_coherent, -@@ -10016,6 +10044,7 @@ static const struct niu_ops niu_phys_ops = { - .unmap_page = niu_phys_unmap_page, - .map_single = niu_phys_map_single, - .unmap_single = niu_phys_unmap_single, -+ .mapping_error = niu_phys_mapping_error, - }; - - static int niu_of_probe(struct platform_device *op) -diff --git a/drivers/net/ethernet/sun/niu.h b/drivers/net/ethernet/sun/niu.h -index 04c215f91fc08e..0b169c08b0f2d1 100644 ---- a/drivers/net/ethernet/sun/niu.h -+++ b/drivers/net/ethernet/sun/niu.h -@@ -2879,6 +2879,9 @@ struct tx_ring_info { - #define NEXT_TX(tp, index) \ - (((index) + 1) < (tp)->pending ? ((index) + 1) : 0) - -+#define PREVIOUS_TX(tp, index) \ -+ (((index) - 1) >= 0 ? ((index) - 1) : (((tp)->pending) - 1)) -+ - static inline u32 niu_tx_avail(struct tx_ring_info *tp) - { - return (tp->pending - -@@ -3140,6 +3143,7 @@ struct niu_ops { - enum dma_data_direction direction); - void (*unmap_single)(struct device *dev, u64 dma_address, - size_t size, enum dma_data_direction direction); -+ int (*mapping_error)(struct device *dev, u64 dma_address); - }; - - struct niu_link_config { -diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c -index 09173d7b87ed5c..ec5689cd240aaf 100644 ---- a/drivers/net/usb/lan78xx.c -+++ b/drivers/net/usb/lan78xx.c -@@ -4229,8 +4229,6 @@ static void lan78xx_disconnect(struct usb_interface *intf) - if (!dev) - return; - -- netif_napi_del(&dev->napi); -- - udev = interface_to_usbdev(intf); - net = dev->net; - -diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c -index 3bf394b24d9711..5a949f9446a8ed 100644 ---- a/drivers/net/virtio_net.c -+++ b/drivers/net/virtio_net.c -@@ -487,6 +487,26 @@ static unsigned int mergeable_ctx_to_truesize(void *mrg_ctx) - return (unsigned long)mrg_ctx & ((1 << MRG_CTX_HEADER_SHIFT) - 1); - } - -+static int check_mergeable_len(struct net_device *dev, void *mrg_ctx, -+ unsigned int len) -+{ -+ unsigned int headroom, tailroom, room, truesize; -+ -+ truesize = mergeable_ctx_to_truesize(mrg_ctx); -+ headroom = mergeable_ctx_to_headroom(mrg_ctx); -+ tailroom = headroom ? sizeof(struct skb_shared_info) : 0; -+ room = SKB_DATA_ALIGN(headroom + tailroom); -+ -+ if (len > truesize - room) { -+ pr_debug("%s: rx error: len %u exceeds truesize %lu\n", -+ dev->name, len, (unsigned long)(truesize - room)); -+ DEV_STATS_INC(dev, rx_length_errors); -+ return -1; -+ } -+ -+ return 0; -+} -+ - static struct sk_buff *virtnet_build_skb(void *buf, unsigned int buflen, - unsigned int headroom, - unsigned int len) -@@ -1084,7 +1104,8 @@ static unsigned int virtnet_get_headroom(struct virtnet_info *vi) - * across multiple buffers (num_buf > 1), and we make sure buffers - * have enough headroom. - */ --static struct page *xdp_linearize_page(struct receive_queue *rq, -+static struct page *xdp_linearize_page(struct net_device *dev, -+ struct receive_queue *rq, - int *num_buf, - struct page *p, - int offset, -@@ -1104,18 +1125,27 @@ static struct page *xdp_linearize_page(struct receive_queue *rq, - memcpy(page_address(page) + page_off, page_address(p) + offset, *len); - page_off += *len; - -+ /* Only mergeable mode can go inside this while loop. In small mode, -+ * *num_buf == 1, so it cannot go inside. -+ */ - while (--*num_buf) { - unsigned int buflen; - void *buf; -+ void *ctx; - int off; - -- buf = virtnet_rq_get_buf(rq, &buflen, NULL); -+ buf = virtnet_rq_get_buf(rq, &buflen, &ctx); - if (unlikely(!buf)) - goto err_buf; - - p = virt_to_head_page(buf); - off = buf - page_address(p); - -+ if (check_mergeable_len(dev, ctx, buflen)) { -+ put_page(p); -+ goto err_buf; -+ } -+ - /* guard against a misconfigured or uncooperative backend that - * is sending packet larger than the MTU. - */ -@@ -1204,7 +1234,7 @@ static struct sk_buff *receive_small_xdp(struct net_device *dev, - headroom = vi->hdr_len + header_offset; - buflen = SKB_DATA_ALIGN(GOOD_PACKET_LEN + headroom) + - SKB_DATA_ALIGN(sizeof(struct skb_shared_info)); -- xdp_page = xdp_linearize_page(rq, &num_buf, page, -+ xdp_page = xdp_linearize_page(dev, rq, &num_buf, page, - offset, header_offset, - &tlen); - if (!xdp_page) -@@ -1539,7 +1569,7 @@ static void *mergeable_xdp_get_buf(struct virtnet_info *vi, - */ - if (!xdp_prog->aux->xdp_has_frags) { - /* linearize data for XDP */ -- xdp_page = xdp_linearize_page(rq, num_buf, -+ xdp_page = xdp_linearize_page(vi->dev, rq, num_buf, - *page, offset, - VIRTIO_XDP_HEADROOM, - len); -diff --git a/drivers/net/wireless/ath/ath6kl/bmi.c b/drivers/net/wireless/ath/ath6kl/bmi.c -index af98e871199d31..5a9e93fd1ef42a 100644 ---- a/drivers/net/wireless/ath/ath6kl/bmi.c -+++ b/drivers/net/wireless/ath/ath6kl/bmi.c -@@ -87,7 +87,9 @@ int ath6kl_bmi_get_target_info(struct ath6kl *ar, - * We need to do some backwards compatibility to make this work. - */ - if (le32_to_cpu(targ_info->byte_count) != sizeof(*targ_info)) { -- WARN_ON(1); -+ ath6kl_err("mismatched byte count %d vs. expected %zd\n", -+ le32_to_cpu(targ_info->byte_count), -+ sizeof(*targ_info)); - return -EINVAL; - } - -diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c -index 39828eb84e0ba0..1015948ef43eb8 100644 ---- a/drivers/platform/mellanox/mlxbf-tmfifo.c -+++ b/drivers/platform/mellanox/mlxbf-tmfifo.c -@@ -281,7 +281,8 @@ static int mlxbf_tmfifo_alloc_vrings(struct mlxbf_tmfifo *fifo, - vring->align = SMP_CACHE_BYTES; - vring->index = i; - vring->vdev_id = tm_vdev->vdev.id.device; -- vring->drop_desc.len = VRING_DROP_DESC_MAX_LEN; -+ vring->drop_desc.len = cpu_to_virtio32(&tm_vdev->vdev, -+ VRING_DROP_DESC_MAX_LEN); - dev = &tm_vdev->vdev.dev; - - size = vring_size(vring->num, vring->align); -diff --git a/drivers/platform/mellanox/mlxreg-lc.c b/drivers/platform/mellanox/mlxreg-lc.c -index 8d833836a6d322..74e9d78ff01efe 100644 ---- a/drivers/platform/mellanox/mlxreg-lc.c -+++ b/drivers/platform/mellanox/mlxreg-lc.c -@@ -688,7 +688,7 @@ static int mlxreg_lc_completion_notify(void *handle, struct i2c_adapter *parent, - if (regval & mlxreg_lc->data->mask) { - mlxreg_lc->state |= MLXREG_LC_SYNCED; - mlxreg_lc_state_update_locked(mlxreg_lc, MLXREG_LC_SYNCED, 1); -- if (mlxreg_lc->state & ~MLXREG_LC_POWERED) { -+ if (!(mlxreg_lc->state & MLXREG_LC_POWERED)) { - err = mlxreg_lc_power_on_off(mlxreg_lc, 1); - if (err) - goto mlxreg_lc_regmap_power_on_off_fail; -diff --git a/drivers/platform/mellanox/nvsw-sn2201.c b/drivers/platform/mellanox/nvsw-sn2201.c -index 1a7c45aa41bbf0..6b4d3c44d7bd96 100644 ---- a/drivers/platform/mellanox/nvsw-sn2201.c -+++ b/drivers/platform/mellanox/nvsw-sn2201.c -@@ -1088,7 +1088,7 @@ static int nvsw_sn2201_i2c_completion_notify(void *handle, int id) - if (!nvsw_sn2201->main_mux_devs->adapter) { - err = -ENODEV; - dev_err(nvsw_sn2201->dev, "Failed to get adapter for bus %d\n", -- nvsw_sn2201->cpld_devs->nr); -+ nvsw_sn2201->main_mux_devs->nr); - goto i2c_get_adapter_main_fail; - } - -diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c -index 2e3f6fc67c568d..7ed12c1d3b34c0 100644 ---- a/drivers/platform/x86/amd/pmc/pmc-quirks.c -+++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c -@@ -224,6 +224,15 @@ static const struct dmi_system_id fwbug_list[] = { - DMI_MATCH(DMI_BOARD_NAME, "WUJIE14-GX4HRXL"), - } - }, -+ /* https://bugzilla.kernel.org/show_bug.cgi?id=220116 */ -+ { -+ .ident = "PCSpecialist Lafite Pro V 14M", -+ .driver_data = &quirk_spurious_8042, -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "PCSpecialist"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Lafite Pro V 14M"), -+ } -+ }, - {} - }; - -diff --git a/drivers/platform/x86/dell/dell-wmi-sysman/dell-wmi-sysman.h b/drivers/platform/x86/dell/dell-wmi-sysman/dell-wmi-sysman.h -index 3ad33a094588c6..817ee7ba07ca08 100644 ---- a/drivers/platform/x86/dell/dell-wmi-sysman/dell-wmi-sysman.h -+++ b/drivers/platform/x86/dell/dell-wmi-sysman/dell-wmi-sysman.h -@@ -89,6 +89,11 @@ extern struct wmi_sysman_priv wmi_priv; - - enum { ENUM, INT, STR, PO }; - -+#define ENUM_MIN_ELEMENTS 8 -+#define INT_MIN_ELEMENTS 9 -+#define STR_MIN_ELEMENTS 8 -+#define PO_MIN_ELEMENTS 4 -+ - enum { - ATTR_NAME, - DISPL_NAME_LANG_CODE, -diff --git a/drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c b/drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c -index 8cc212c8526683..fc2f58b4cbc6ef 100644 ---- a/drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c -+++ b/drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c -@@ -23,9 +23,10 @@ static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *a - obj = get_wmiobj_pointer(instance_id, DELL_WMI_BIOS_ENUMERATION_ATTRIBUTE_GUID); - if (!obj) - return -EIO; -- if (obj->package.elements[CURRENT_VAL].type != ACPI_TYPE_STRING) { -+ if (obj->type != ACPI_TYPE_PACKAGE || obj->package.count < ENUM_MIN_ELEMENTS || -+ obj->package.elements[CURRENT_VAL].type != ACPI_TYPE_STRING) { - kfree(obj); -- return -EINVAL; -+ return -EIO; - } - ret = snprintf(buf, PAGE_SIZE, "%s\n", obj->package.elements[CURRENT_VAL].string.pointer); - kfree(obj); -diff --git a/drivers/platform/x86/dell/dell-wmi-sysman/int-attributes.c b/drivers/platform/x86/dell/dell-wmi-sysman/int-attributes.c -index 951e75b538fad4..73524806423914 100644 ---- a/drivers/platform/x86/dell/dell-wmi-sysman/int-attributes.c -+++ b/drivers/platform/x86/dell/dell-wmi-sysman/int-attributes.c -@@ -25,9 +25,10 @@ static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *a - obj = get_wmiobj_pointer(instance_id, DELL_WMI_BIOS_INTEGER_ATTRIBUTE_GUID); - if (!obj) - return -EIO; -- if (obj->package.elements[CURRENT_VAL].type != ACPI_TYPE_INTEGER) { -+ if (obj->type != ACPI_TYPE_PACKAGE || obj->package.count < INT_MIN_ELEMENTS || -+ obj->package.elements[CURRENT_VAL].type != ACPI_TYPE_INTEGER) { - kfree(obj); -- return -EINVAL; -+ return -EIO; - } - ret = snprintf(buf, PAGE_SIZE, "%lld\n", obj->package.elements[CURRENT_VAL].integer.value); - kfree(obj); -diff --git a/drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c b/drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c -index d8f1bf5e58a0f4..3167e06d416ede 100644 ---- a/drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c -+++ b/drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c -@@ -26,9 +26,10 @@ static ssize_t is_enabled_show(struct kobject *kobj, struct kobj_attribute *attr - obj = get_wmiobj_pointer(instance_id, DELL_WMI_BIOS_PASSOBJ_ATTRIBUTE_GUID); - if (!obj) - return -EIO; -- if (obj->package.elements[IS_PASS_SET].type != ACPI_TYPE_INTEGER) { -+ if (obj->type != ACPI_TYPE_PACKAGE || obj->package.count < PO_MIN_ELEMENTS || -+ obj->package.elements[IS_PASS_SET].type != ACPI_TYPE_INTEGER) { - kfree(obj); -- return -EINVAL; -+ return -EIO; - } - ret = snprintf(buf, PAGE_SIZE, "%lld\n", obj->package.elements[IS_PASS_SET].integer.value); - kfree(obj); -diff --git a/drivers/platform/x86/dell/dell-wmi-sysman/string-attributes.c b/drivers/platform/x86/dell/dell-wmi-sysman/string-attributes.c -index c392f0ecf8b55b..0d2c74f8d1aad7 100644 ---- a/drivers/platform/x86/dell/dell-wmi-sysman/string-attributes.c -+++ b/drivers/platform/x86/dell/dell-wmi-sysman/string-attributes.c -@@ -25,9 +25,10 @@ static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *a - obj = get_wmiobj_pointer(instance_id, DELL_WMI_BIOS_STRING_ATTRIBUTE_GUID); - if (!obj) - return -EIO; -- if (obj->package.elements[CURRENT_VAL].type != ACPI_TYPE_STRING) { -+ if (obj->type != ACPI_TYPE_PACKAGE || obj->package.count < STR_MIN_ELEMENTS || -+ obj->package.elements[CURRENT_VAL].type != ACPI_TYPE_STRING) { - kfree(obj); -- return -EINVAL; -+ return -EIO; - } - ret = snprintf(buf, PAGE_SIZE, "%s\n", obj->package.elements[CURRENT_VAL].string.pointer); - kfree(obj); -diff --git a/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c b/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c -index af49dd6b31ade7..f5402b71465729 100644 ---- a/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c -+++ b/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c -@@ -25,7 +25,6 @@ struct wmi_sysman_priv wmi_priv = { - /* reset bios to defaults */ - static const char * const reset_types[] = {"builtinsafe", "lastknowngood", "factory", "custom"}; - static int reset_option = -1; --static struct class *fw_attr_class; - - - /** -@@ -408,10 +407,10 @@ static int init_bios_attributes(int attr_type, const char *guid) - return retval; - - switch (attr_type) { -- case ENUM: min_elements = 8; break; -- case INT: min_elements = 9; break; -- case STR: min_elements = 8; break; -- case PO: min_elements = 4; break; -+ case ENUM: min_elements = ENUM_MIN_ELEMENTS; break; -+ case INT: min_elements = INT_MIN_ELEMENTS; break; -+ case STR: min_elements = STR_MIN_ELEMENTS; break; -+ case PO: min_elements = PO_MIN_ELEMENTS; break; - default: - pr_err("Error: Unknown attr_type: %d\n", attr_type); - return -EINVAL; -@@ -541,15 +540,11 @@ static int __init sysman_init(void) - goto err_exit_bios_attr_pass_interface; - } - -- ret = fw_attributes_class_get(&fw_attr_class); -- if (ret) -- goto err_exit_bios_attr_pass_interface; -- -- wmi_priv.class_dev = device_create(fw_attr_class, NULL, MKDEV(0, 0), -+ wmi_priv.class_dev = device_create(&firmware_attributes_class, NULL, MKDEV(0, 0), - NULL, "%s", DRIVER_NAME); - if (IS_ERR(wmi_priv.class_dev)) { - ret = PTR_ERR(wmi_priv.class_dev); -- goto err_unregister_class; -+ goto err_exit_bios_attr_pass_interface; - } - - wmi_priv.main_dir_kset = kset_create_and_add("attributes", NULL, -@@ -602,10 +597,7 @@ static int __init sysman_init(void) - release_attributes_data(); - - err_destroy_classdev: -- device_destroy(fw_attr_class, MKDEV(0, 0)); -- --err_unregister_class: -- fw_attributes_class_put(); -+ device_unregister(wmi_priv.class_dev); - - err_exit_bios_attr_pass_interface: - exit_bios_attr_pass_interface(); -@@ -619,8 +611,7 @@ static int __init sysman_init(void) - static void __exit sysman_exit(void) - { - release_attributes_data(); -- device_destroy(fw_attr_class, MKDEV(0, 0)); -- fw_attributes_class_put(); -+ device_unregister(wmi_priv.class_dev); - exit_bios_attr_set_interface(); - exit_bios_attr_pass_interface(); - } -diff --git a/drivers/platform/x86/firmware_attributes_class.c b/drivers/platform/x86/firmware_attributes_class.c -index fafe8eaf6e3e4e..e214efc97311e2 100644 ---- a/drivers/platform/x86/firmware_attributes_class.c -+++ b/drivers/platform/x86/firmware_attributes_class.c -@@ -2,48 +2,35 @@ - - /* Firmware attributes class helper module */ - --#include --#include - #include - #include "firmware_attributes_class.h" - --static DEFINE_MUTEX(fw_attr_lock); --static int fw_attr_inuse; -- --static struct class firmware_attributes_class = { -+const struct class firmware_attributes_class = { - .name = "firmware-attributes", - }; -+EXPORT_SYMBOL_GPL(firmware_attributes_class); -+ -+static __init int fw_attributes_class_init(void) -+{ -+ return class_register(&firmware_attributes_class); -+} -+module_init(fw_attributes_class_init); -+ -+static __exit void fw_attributes_class_exit(void) -+{ -+ class_unregister(&firmware_attributes_class); -+} -+module_exit(fw_attributes_class_exit); - --int fw_attributes_class_get(struct class **fw_attr_class) -+int fw_attributes_class_get(const struct class **fw_attr_class) - { -- int err; -- -- mutex_lock(&fw_attr_lock); -- if (!fw_attr_inuse) { /*first time class is being used*/ -- err = class_register(&firmware_attributes_class); -- if (err) { -- mutex_unlock(&fw_attr_lock); -- return err; -- } -- } -- fw_attr_inuse++; - *fw_attr_class = &firmware_attributes_class; -- mutex_unlock(&fw_attr_lock); - return 0; - } - EXPORT_SYMBOL_GPL(fw_attributes_class_get); - - int fw_attributes_class_put(void) - { -- mutex_lock(&fw_attr_lock); -- if (!fw_attr_inuse) { -- mutex_unlock(&fw_attr_lock); -- return -EINVAL; -- } -- fw_attr_inuse--; -- if (!fw_attr_inuse) /* No more consumers */ -- class_unregister(&firmware_attributes_class); -- mutex_unlock(&fw_attr_lock); - return 0; - } - EXPORT_SYMBOL_GPL(fw_attributes_class_put); -diff --git a/drivers/platform/x86/firmware_attributes_class.h b/drivers/platform/x86/firmware_attributes_class.h -index 486485cb1f54e3..ef6c3764a83497 100644 ---- a/drivers/platform/x86/firmware_attributes_class.h -+++ b/drivers/platform/x86/firmware_attributes_class.h -@@ -5,7 +5,10 @@ - #ifndef FW_ATTR_CLASS_H - #define FW_ATTR_CLASS_H - --int fw_attributes_class_get(struct class **fw_attr_class); -+#include -+ -+extern const struct class firmware_attributes_class; -+int fw_attributes_class_get(const struct class **fw_attr_class); - int fw_attributes_class_put(void); - - #endif /* FW_ATTR_CLASS_H */ -diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c -index 6ddca857cc4d1a..b62b158cffd85a 100644 ---- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c -+++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c -@@ -24,8 +24,6 @@ struct bioscfg_priv bioscfg_drv = { - .mutex = __MUTEX_INITIALIZER(bioscfg_drv.mutex), - }; - --static struct class *fw_attr_class; -- - ssize_t display_name_language_code_show(struct kobject *kobj, - struct kobj_attribute *attr, - char *buf) -@@ -974,11 +972,7 @@ static int __init hp_init(void) - if (ret) - return ret; - -- ret = fw_attributes_class_get(&fw_attr_class); -- if (ret) -- goto err_unregister_class; -- -- bioscfg_drv.class_dev = device_create(fw_attr_class, NULL, MKDEV(0, 0), -+ bioscfg_drv.class_dev = device_create(&firmware_attributes_class, NULL, MKDEV(0, 0), - NULL, "%s", DRIVER_NAME); - if (IS_ERR(bioscfg_drv.class_dev)) { - ret = PTR_ERR(bioscfg_drv.class_dev); -@@ -1045,10 +1039,9 @@ static int __init hp_init(void) - release_attributes_data(); - - err_destroy_classdev: -- device_destroy(fw_attr_class, MKDEV(0, 0)); -+ device_unregister(bioscfg_drv.class_dev); - - err_unregister_class: -- fw_attributes_class_put(); - hp_exit_attr_set_interface(); - - return ret; -@@ -1057,9 +1050,8 @@ static int __init hp_init(void) - static void __exit hp_exit(void) - { - release_attributes_data(); -- device_destroy(fw_attr_class, MKDEV(0, 0)); -+ device_unregister(bioscfg_drv.class_dev); - -- fw_attributes_class_put(); - hp_exit_attr_set_interface(); - } - -diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c -index 2396decdb3cb3f..d5319b4637e18d 100644 ---- a/drivers/platform/x86/think-lmi.c -+++ b/drivers/platform/x86/think-lmi.c -@@ -195,7 +195,6 @@ static const char * const level_options[] = { - [TLMI_LEVEL_MASTER] = "master", - }; - static struct think_lmi tlmi_priv; --static struct class *fw_attr_class; - static DEFINE_MUTEX(tlmi_mutex); - - /* ------ Utility functions ------------*/ -@@ -917,6 +916,7 @@ static const struct attribute_group auth_attr_group = { - .is_visible = auth_attr_is_visible, - .attrs = auth_attrs, - }; -+__ATTRIBUTE_GROUPS(auth_attr); - - /* ---- Attributes sysfs --------------------------------------------------------- */ - static ssize_t display_name_show(struct kobject *kobj, struct kobj_attribute *attr, -@@ -1120,6 +1120,7 @@ static const struct attribute_group tlmi_attr_group = { - .is_visible = attr_is_visible, - .attrs = tlmi_attrs, - }; -+__ATTRIBUTE_GROUPS(tlmi_attr); - - static void tlmi_attr_setting_release(struct kobject *kobj) - { -@@ -1139,11 +1140,13 @@ static void tlmi_pwd_setting_release(struct kobject *kobj) - static const struct kobj_type tlmi_attr_setting_ktype = { - .release = &tlmi_attr_setting_release, - .sysfs_ops = &kobj_sysfs_ops, -+ .default_groups = tlmi_attr_groups, - }; - - static const struct kobj_type tlmi_pwd_setting_ktype = { - .release = &tlmi_pwd_setting_release, - .sysfs_ops = &kobj_sysfs_ops, -+ .default_groups = auth_attr_groups, - }; - - static ssize_t pending_reboot_show(struct kobject *kobj, struct kobj_attribute *attr, -@@ -1213,19 +1216,16 @@ static struct kobj_attribute debug_cmd = __ATTR_WO(debug_cmd); - /* ---- Initialisation --------------------------------------------------------- */ - static void tlmi_release_attr(void) - { -- int i; -+ struct kobject *pos, *n; - - /* Attribute structures */ -- for (i = 0; i < TLMI_SETTINGS_COUNT; i++) { -- if (tlmi_priv.setting[i]) { -- sysfs_remove_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group); -- kobject_put(&tlmi_priv.setting[i]->kobj); -- } -- } - sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr); - if (tlmi_priv.can_debug_cmd && debug_support) - sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr); - -+ list_for_each_entry_safe(pos, n, &tlmi_priv.attribute_kset->list, entry) -+ kobject_put(pos); -+ - kset_unregister(tlmi_priv.attribute_kset); - - /* Free up any saved signatures */ -@@ -1233,19 +1233,8 @@ static void tlmi_release_attr(void) - kfree(tlmi_priv.pwd_admin->save_signature); - - /* Authentication structures */ -- sysfs_remove_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group); -- kobject_put(&tlmi_priv.pwd_admin->kobj); -- sysfs_remove_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group); -- kobject_put(&tlmi_priv.pwd_power->kobj); -- -- if (tlmi_priv.opcode_support) { -- sysfs_remove_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group); -- kobject_put(&tlmi_priv.pwd_system->kobj); -- sysfs_remove_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group); -- kobject_put(&tlmi_priv.pwd_hdd->kobj); -- sysfs_remove_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group); -- kobject_put(&tlmi_priv.pwd_nvme->kobj); -- } -+ list_for_each_entry_safe(pos, n, &tlmi_priv.authentication_kset->list, entry) -+ kobject_put(pos); - - kset_unregister(tlmi_priv.authentication_kset); - } -@@ -1272,11 +1261,7 @@ static int tlmi_sysfs_init(void) - { - int i, ret; - -- ret = fw_attributes_class_get(&fw_attr_class); -- if (ret) -- return ret; -- -- tlmi_priv.class_dev = device_create(fw_attr_class, NULL, MKDEV(0, 0), -+ tlmi_priv.class_dev = device_create(&firmware_attributes_class, NULL, MKDEV(0, 0), - NULL, "%s", "thinklmi"); - if (IS_ERR(tlmi_priv.class_dev)) { - ret = PTR_ERR(tlmi_priv.class_dev); -@@ -1290,6 +1275,14 @@ static int tlmi_sysfs_init(void) - goto fail_device_created; - } - -+ tlmi_priv.authentication_kset = kset_create_and_add("authentication", NULL, -+ &tlmi_priv.class_dev->kobj); -+ if (!tlmi_priv.authentication_kset) { -+ kset_unregister(tlmi_priv.attribute_kset); -+ ret = -ENOMEM; -+ goto fail_device_created; -+ } -+ - for (i = 0; i < TLMI_SETTINGS_COUNT; i++) { - /* Check if index is a valid setting - skip if it isn't */ - if (!tlmi_priv.setting[i]) -@@ -1306,12 +1299,8 @@ static int tlmi_sysfs_init(void) - - /* Build attribute */ - tlmi_priv.setting[i]->kobj.kset = tlmi_priv.attribute_kset; -- ret = kobject_add(&tlmi_priv.setting[i]->kobj, NULL, -- "%s", tlmi_priv.setting[i]->display_name); -- if (ret) -- goto fail_create_attr; -- -- ret = sysfs_create_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group); -+ ret = kobject_init_and_add(&tlmi_priv.setting[i]->kobj, &tlmi_attr_setting_ktype, -+ NULL, "%s", tlmi_priv.setting[i]->display_name); - if (ret) - goto fail_create_attr; - } -@@ -1327,55 +1316,34 @@ static int tlmi_sysfs_init(void) - } - - /* Create authentication entries */ -- tlmi_priv.authentication_kset = kset_create_and_add("authentication", NULL, -- &tlmi_priv.class_dev->kobj); -- if (!tlmi_priv.authentication_kset) { -- ret = -ENOMEM; -- goto fail_create_attr; -- } - tlmi_priv.pwd_admin->kobj.kset = tlmi_priv.authentication_kset; -- ret = kobject_add(&tlmi_priv.pwd_admin->kobj, NULL, "%s", "Admin"); -- if (ret) -- goto fail_create_attr; -- -- ret = sysfs_create_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group); -+ ret = kobject_init_and_add(&tlmi_priv.pwd_admin->kobj, &tlmi_pwd_setting_ktype, -+ NULL, "%s", "Admin"); - if (ret) - goto fail_create_attr; - - tlmi_priv.pwd_power->kobj.kset = tlmi_priv.authentication_kset; -- ret = kobject_add(&tlmi_priv.pwd_power->kobj, NULL, "%s", "Power-on"); -- if (ret) -- goto fail_create_attr; -- -- ret = sysfs_create_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group); -+ ret = kobject_init_and_add(&tlmi_priv.pwd_power->kobj, &tlmi_pwd_setting_ktype, -+ NULL, "%s", "Power-on"); - if (ret) - goto fail_create_attr; - - if (tlmi_priv.opcode_support) { - tlmi_priv.pwd_system->kobj.kset = tlmi_priv.authentication_kset; -- ret = kobject_add(&tlmi_priv.pwd_system->kobj, NULL, "%s", "System"); -- if (ret) -- goto fail_create_attr; -- -- ret = sysfs_create_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group); -+ ret = kobject_init_and_add(&tlmi_priv.pwd_system->kobj, &tlmi_pwd_setting_ktype, -+ NULL, "%s", "System"); - if (ret) - goto fail_create_attr; - - tlmi_priv.pwd_hdd->kobj.kset = tlmi_priv.authentication_kset; -- ret = kobject_add(&tlmi_priv.pwd_hdd->kobj, NULL, "%s", "HDD"); -- if (ret) -- goto fail_create_attr; -- -- ret = sysfs_create_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group); -+ ret = kobject_init_and_add(&tlmi_priv.pwd_hdd->kobj, &tlmi_pwd_setting_ktype, -+ NULL, "%s", "HDD"); - if (ret) - goto fail_create_attr; - - tlmi_priv.pwd_nvme->kobj.kset = tlmi_priv.authentication_kset; -- ret = kobject_add(&tlmi_priv.pwd_nvme->kobj, NULL, "%s", "NVMe"); -- if (ret) -- goto fail_create_attr; -- -- ret = sysfs_create_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group); -+ ret = kobject_init_and_add(&tlmi_priv.pwd_nvme->kobj, &tlmi_pwd_setting_ktype, -+ NULL, "%s", "NVMe"); - if (ret) - goto fail_create_attr; - } -@@ -1385,9 +1353,8 @@ static int tlmi_sysfs_init(void) - fail_create_attr: - tlmi_release_attr(); - fail_device_created: -- device_destroy(fw_attr_class, MKDEV(0, 0)); -+ device_unregister(tlmi_priv.class_dev); - fail_class_created: -- fw_attributes_class_put(); - return ret; - } - -@@ -1409,8 +1376,6 @@ static struct tlmi_pwd_setting *tlmi_create_auth(const char *pwd_type, - new_pwd->maxlen = tlmi_priv.pwdcfg.core.max_length; - new_pwd->index = 0; - -- kobject_init(&new_pwd->kobj, &tlmi_pwd_setting_ktype); -- - return new_pwd; - } - -@@ -1514,7 +1479,6 @@ static int tlmi_analyze(void) - if (setting->possible_values) - strreplace(setting->possible_values, ',', ';'); - -- kobject_init(&setting->kobj, &tlmi_attr_setting_ktype); - tlmi_priv.setting[i] = setting; - kfree(item); - } -@@ -1610,8 +1574,7 @@ static int tlmi_analyze(void) - static void tlmi_remove(struct wmi_device *wdev) - { - tlmi_release_attr(); -- device_destroy(fw_attr_class, MKDEV(0, 0)); -- fw_attributes_class_put(); -+ device_unregister(tlmi_priv.class_dev); - } - - static int tlmi_probe(struct wmi_device *wdev, const void *context) -diff --git a/drivers/powercap/intel_rapl_common.c b/drivers/powercap/intel_rapl_common.c -index f1de4111e98d9d..5a09a56698f4a0 100644 ---- a/drivers/powercap/intel_rapl_common.c -+++ b/drivers/powercap/intel_rapl_common.c -@@ -338,12 +338,28 @@ static int set_domain_enable(struct powercap_zone *power_zone, bool mode) - { - struct rapl_domain *rd = power_zone_to_rapl_domain(power_zone); - struct rapl_defaults *defaults = get_defaults(rd->rp); -+ u64 val; - int ret; - - cpus_read_lock(); - ret = rapl_write_pl_data(rd, POWER_LIMIT1, PL_ENABLE, mode); -- if (!ret && defaults->set_floor_freq) -+ if (ret) -+ goto end; -+ -+ ret = rapl_read_pl_data(rd, POWER_LIMIT1, PL_ENABLE, false, &val); -+ if (ret) -+ goto end; -+ -+ if (mode != val) { -+ pr_debug("%s cannot be %s\n", power_zone->name, -+ str_enabled_disabled(mode)); -+ goto end; -+ } -+ -+ if (defaults->set_floor_freq) - defaults->set_floor_freq(rd, mode); -+ -+end: - cpus_read_unlock(); - - return ret; -diff --git a/drivers/regulator/fan53555.c b/drivers/regulator/fan53555.c -index 48f312167e5351..8912f5be72707c 100644 ---- a/drivers/regulator/fan53555.c -+++ b/drivers/regulator/fan53555.c -@@ -147,6 +147,7 @@ struct fan53555_device_info { - unsigned int slew_mask; - const unsigned int *ramp_delay_table; - unsigned int n_ramp_values; -+ unsigned int enable_time; - unsigned int slew_rate; - }; - -@@ -282,6 +283,7 @@ static int fan53526_voltages_setup_fairchild(struct fan53555_device_info *di) - di->slew_mask = CTL_SLEW_MASK; - di->ramp_delay_table = slew_rates; - di->n_ramp_values = ARRAY_SIZE(slew_rates); -+ di->enable_time = 250; - di->vsel_count = FAN53526_NVOLTAGES; - - return 0; -@@ -296,10 +298,12 @@ static int fan53555_voltages_setup_fairchild(struct fan53555_device_info *di) - case FAN53555_CHIP_REV_00: - di->vsel_min = 600000; - di->vsel_step = 10000; -+ di->enable_time = 400; - break; - case FAN53555_CHIP_REV_13: - di->vsel_min = 800000; - di->vsel_step = 10000; -+ di->enable_time = 400; - break; - default: - dev_err(di->dev, -@@ -311,13 +315,19 @@ static int fan53555_voltages_setup_fairchild(struct fan53555_device_info *di) - case FAN53555_CHIP_ID_01: - case FAN53555_CHIP_ID_03: - case FAN53555_CHIP_ID_05: -+ di->vsel_min = 600000; -+ di->vsel_step = 10000; -+ di->enable_time = 400; -+ break; - case FAN53555_CHIP_ID_08: - di->vsel_min = 600000; - di->vsel_step = 10000; -+ di->enable_time = 175; - break; - case FAN53555_CHIP_ID_04: - di->vsel_min = 603000; - di->vsel_step = 12826; -+ di->enable_time = 400; - break; - default: - dev_err(di->dev, -@@ -350,6 +360,7 @@ static int fan53555_voltages_setup_rockchip(struct fan53555_device_info *di) - di->slew_mask = CTL_SLEW_MASK; - di->ramp_delay_table = slew_rates; - di->n_ramp_values = ARRAY_SIZE(slew_rates); -+ di->enable_time = 360; - di->vsel_count = FAN53555_NVOLTAGES; - - return 0; -@@ -372,6 +383,7 @@ static int rk8602_voltages_setup_rockchip(struct fan53555_device_info *di) - di->slew_mask = CTL_SLEW_MASK; - di->ramp_delay_table = slew_rates; - di->n_ramp_values = ARRAY_SIZE(slew_rates); -+ di->enable_time = 360; - di->vsel_count = RK8602_NVOLTAGES; - - return 0; -@@ -395,6 +407,7 @@ static int fan53555_voltages_setup_silergy(struct fan53555_device_info *di) - di->slew_mask = CTL_SLEW_MASK; - di->ramp_delay_table = slew_rates; - di->n_ramp_values = ARRAY_SIZE(slew_rates); -+ di->enable_time = 400; - di->vsel_count = FAN53555_NVOLTAGES; - - return 0; -@@ -594,6 +607,7 @@ static int fan53555_regulator_register(struct fan53555_device_info *di, - rdesc->ramp_mask = di->slew_mask; - rdesc->ramp_delay_table = di->ramp_delay_table; - rdesc->n_ramp_values = di->n_ramp_values; -+ rdesc->enable_time = di->enable_time; - rdesc->owner = THIS_MODULE; - - rdev = devm_regulator_register(di->dev, &di->desc, config); -diff --git a/drivers/regulator/gpio-regulator.c b/drivers/regulator/gpio-regulator.c -index 65927fa2ef161c..1bdd494cf8821e 100644 ---- a/drivers/regulator/gpio-regulator.c -+++ b/drivers/regulator/gpio-regulator.c -@@ -260,8 +260,10 @@ static int gpio_regulator_probe(struct platform_device *pdev) - return -ENOMEM; - } - -- drvdata->gpiods = devm_kzalloc(dev, sizeof(struct gpio_desc *), -- GFP_KERNEL); -+ drvdata->gpiods = devm_kcalloc(dev, config->ngpios, -+ sizeof(struct gpio_desc *), GFP_KERNEL); -+ if (!drvdata->gpiods) -+ return -ENOMEM; - - if (config->input_supply) { - drvdata->desc.supply_name = devm_kstrdup(&pdev->dev, -@@ -274,8 +276,6 @@ static int gpio_regulator_probe(struct platform_device *pdev) - } - } - -- if (!drvdata->gpiods) -- return -ENOMEM; - for (i = 0; i < config->ngpios; i++) { - drvdata->gpiods[i] = devm_gpiod_get_index(dev, - NULL, -diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c -index 5849d2970bba45..095de4e0e4f388 100644 ---- a/drivers/rtc/rtc-cmos.c -+++ b/drivers/rtc/rtc-cmos.c -@@ -697,8 +697,12 @@ static irqreturn_t cmos_interrupt(int irq, void *p) - { - u8 irqstat; - u8 rtc_control; -+ unsigned long flags; - -- spin_lock(&rtc_lock); -+ /* We cannot use spin_lock() here, as cmos_interrupt() is also called -+ * in a non-irq context. -+ */ -+ spin_lock_irqsave(&rtc_lock, flags); - - /* When the HPET interrupt handler calls us, the interrupt - * status is passed as arg1 instead of the irq number. But -@@ -732,7 +736,7 @@ static irqreturn_t cmos_interrupt(int irq, void *p) - hpet_mask_rtc_irq_bit(RTC_AIE); - CMOS_READ(RTC_INTR_FLAGS); - } -- spin_unlock(&rtc_lock); -+ spin_unlock_irqrestore(&rtc_lock, flags); - - if (is_intr(irqstat)) { - rtc_update_irq(p, 1, irqstat); -@@ -1300,9 +1304,7 @@ static void cmos_check_wkalrm(struct device *dev) - * ACK the rtc irq here - */ - if (t_now >= cmos->alarm_expires && cmos_use_acpi_alarm()) { -- local_irq_disable(); - cmos_interrupt(0, (void *)cmos->rtc); -- local_irq_enable(); - return; - } - -diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c -index 9c04c4e1a49c37..fc079b9dcf7192 100644 ---- a/drivers/rtc/rtc-pcf2127.c -+++ b/drivers/rtc/rtc-pcf2127.c -@@ -1383,6 +1383,11 @@ static int pcf2127_i2c_probe(struct i2c_client *client) - variant = &pcf21xx_cfg[type]; - } - -+ if (variant->type == PCF2131) { -+ config.read_flag_mask = 0x0; -+ config.write_flag_mask = 0x0; -+ } -+ - config.max_register = variant->max_register, - - regmap = devm_regmap_init(&client->dev, &pcf2127_i2c_regmap, -@@ -1456,7 +1461,7 @@ static int pcf2127_spi_probe(struct spi_device *spi) - variant = &pcf21xx_cfg[type]; - } - -- config.max_register = variant->max_register, -+ config.max_register = variant->max_register; - - regmap = devm_regmap_init_spi(spi, &config); - if (IS_ERR(regmap)) { -diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c -index 0cd6f3e1488249..13b6cb1b93acd9 100644 ---- a/drivers/scsi/qla2xxx/qla_mbx.c -+++ b/drivers/scsi/qla2xxx/qla_mbx.c -@@ -2147,7 +2147,7 @@ qla24xx_get_port_database(scsi_qla_host_t *vha, u16 nport_handle, - - pdb_dma = dma_map_single(&vha->hw->pdev->dev, pdb, - sizeof(*pdb), DMA_FROM_DEVICE); -- if (!pdb_dma) { -+ if (dma_mapping_error(&vha->hw->pdev->dev, pdb_dma)) { - ql_log(ql_log_warn, vha, 0x1116, "Failed to map dma buffer.\n"); - return QLA_MEMORY_ALLOC_FAILED; - } -diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c -index 675332e49a7b06..77c28d2ebf0137 100644 ---- a/drivers/scsi/qla4xxx/ql4_os.c -+++ b/drivers/scsi/qla4xxx/ql4_os.c -@@ -3420,6 +3420,8 @@ static int qla4xxx_alloc_pdu(struct iscsi_task *task, uint8_t opcode) - task_data->data_dma = dma_map_single(&ha->pdev->dev, task->data, - task->data_count, - DMA_TO_DEVICE); -+ if (dma_mapping_error(&ha->pdev->dev, task_data->data_dma)) -+ return -ENOMEM; - } - - DEBUG2(ql4_printk(KERN_INFO, ha, "%s: MaxRecvLen %u, iscsi hrd %d\n", -diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c -index 7dd94369abb47c..3206c84c6f22fb 100644 ---- a/drivers/spi/spi-fsl-dspi.c -+++ b/drivers/spi/spi-fsl-dspi.c -@@ -988,11 +988,20 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr, - if (dspi->devtype_data->trans_mode == DSPI_DMA_MODE) { - status = dspi_dma_xfer(dspi); - } else { -+ /* -+ * Reinitialize the completion before transferring data -+ * to avoid the case where it might remain in the done -+ * state due to a spurious interrupt from a previous -+ * transfer. This could falsely signal that the current -+ * transfer has completed. -+ */ -+ if (dspi->irq) -+ reinit_completion(&dspi->xfer_done); -+ - dspi_fifo_write(dspi); - - if (dspi->irq) { - wait_for_completion(&dspi->xfer_done); -- reinit_completion(&dspi->xfer_done); - } else { - do { - status = dspi_poll(dspi); -diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c -index 49d9167bb263b5..a9eb6a3e838347 100644 ---- a/drivers/target/target_core_pr.c -+++ b/drivers/target/target_core_pr.c -@@ -1841,7 +1841,9 @@ core_scsi3_decode_spec_i_port( - } - - kmem_cache_free(t10_pr_reg_cache, dest_pr_reg); -- core_scsi3_lunacl_undepend_item(dest_se_deve); -+ -+ if (dest_se_deve) -+ core_scsi3_lunacl_undepend_item(dest_se_deve); - - if (is_local) - continue; -diff --git a/drivers/ufs/core/ufs-sysfs.c b/drivers/ufs/core/ufs-sysfs.c -index 3692b39b35e789..6c48255dfff02b 100644 ---- a/drivers/ufs/core/ufs-sysfs.c -+++ b/drivers/ufs/core/ufs-sysfs.c -@@ -1278,7 +1278,7 @@ UFS_UNIT_DESC_PARAM(logical_block_size, _LOGICAL_BLK_SIZE, 1); - UFS_UNIT_DESC_PARAM(logical_block_count, _LOGICAL_BLK_COUNT, 8); - UFS_UNIT_DESC_PARAM(erase_block_size, _ERASE_BLK_SIZE, 4); - UFS_UNIT_DESC_PARAM(provisioning_type, _PROVISIONING_TYPE, 1); --UFS_UNIT_DESC_PARAM(physical_memory_resourse_count, _PHY_MEM_RSRC_CNT, 8); -+UFS_UNIT_DESC_PARAM(physical_memory_resource_count, _PHY_MEM_RSRC_CNT, 8); - UFS_UNIT_DESC_PARAM(context_capabilities, _CTX_CAPABILITIES, 2); - UFS_UNIT_DESC_PARAM(large_unit_granularity, _LARGE_UNIT_SIZE_M1, 1); - UFS_UNIT_DESC_PARAM(wb_buf_alloc_units, _WB_BUF_ALLOC_UNITS, 4); -@@ -1295,7 +1295,7 @@ static struct attribute *ufs_sysfs_unit_descriptor[] = { - &dev_attr_logical_block_count.attr, - &dev_attr_erase_block_size.attr, - &dev_attr_provisioning_type.attr, -- &dev_attr_physical_memory_resourse_count.attr, -+ &dev_attr_physical_memory_resource_count.attr, - &dev_attr_context_capabilities.attr, - &dev_attr_large_unit_granularity.attr, - &dev_attr_wb_buf_alloc_units.attr, -diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c -index 412931cf240f64..da20bd3d46bc78 100644 ---- a/drivers/ufs/core/ufshcd.c -+++ b/drivers/ufs/core/ufshcd.c -@@ -20,6 +20,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -289,8 +290,8 @@ static inline void ufshcd_add_delay_before_dme_cmd(struct ufs_hba *hba); - static int ufshcd_host_reset_and_restore(struct ufs_hba *hba); - static void ufshcd_resume_clkscaling(struct ufs_hba *hba); - static void ufshcd_suspend_clkscaling(struct ufs_hba *hba); --static void __ufshcd_suspend_clkscaling(struct ufs_hba *hba); --static int ufshcd_scale_clks(struct ufs_hba *hba, bool scale_up); -+static int ufshcd_scale_clks(struct ufs_hba *hba, unsigned long freq, -+ bool scale_up); - static irqreturn_t ufshcd_intr(int irq, void *__hba); - static int ufshcd_change_power_mode(struct ufs_hba *hba, - struct ufs_pa_layer_attr *pwr_mode); -@@ -1079,14 +1080,32 @@ static int ufshcd_set_clk_freq(struct ufs_hba *hba, bool scale_up) - return ret; - } - -+static int ufshcd_opp_set_rate(struct ufs_hba *hba, unsigned long freq) -+{ -+ struct dev_pm_opp *opp; -+ int ret; -+ -+ opp = dev_pm_opp_find_freq_floor_indexed(hba->dev, -+ &freq, 0); -+ if (IS_ERR(opp)) -+ return PTR_ERR(opp); -+ -+ ret = dev_pm_opp_set_opp(hba->dev, opp); -+ dev_pm_opp_put(opp); -+ -+ return ret; -+} -+ - /** - * ufshcd_scale_clks - scale up or scale down UFS controller clocks - * @hba: per adapter instance -+ * @freq: frequency to scale - * @scale_up: True if scaling up and false if scaling down - * - * Return: 0 if successful; < 0 upon failure. - */ --static int ufshcd_scale_clks(struct ufs_hba *hba, bool scale_up) -+static int ufshcd_scale_clks(struct ufs_hba *hba, unsigned long freq, -+ bool scale_up) - { - int ret = 0; - ktime_t start = ktime_get(); -@@ -1095,13 +1114,21 @@ static int ufshcd_scale_clks(struct ufs_hba *hba, bool scale_up) - if (ret) - goto out; - -- ret = ufshcd_set_clk_freq(hba, scale_up); -+ if (hba->use_pm_opp) -+ ret = ufshcd_opp_set_rate(hba, freq); -+ else -+ ret = ufshcd_set_clk_freq(hba, scale_up); - if (ret) - goto out; - - ret = ufshcd_vops_clk_scale_notify(hba, scale_up, POST_CHANGE); -- if (ret) -- ufshcd_set_clk_freq(hba, !scale_up); -+ if (ret) { -+ if (hba->use_pm_opp) -+ ufshcd_opp_set_rate(hba, -+ hba->devfreq->previous_freq); -+ else -+ ufshcd_set_clk_freq(hba, !scale_up); -+ } - - out: - trace_ufshcd_profile_clk_scaling(dev_name(hba->dev), -@@ -1113,12 +1140,13 @@ static int ufshcd_scale_clks(struct ufs_hba *hba, bool scale_up) - /** - * ufshcd_is_devfreq_scaling_required - check if scaling is required or not - * @hba: per adapter instance -+ * @freq: frequency to scale - * @scale_up: True if scaling up and false if scaling down - * - * Return: true if scaling is required, false otherwise. - */ - static bool ufshcd_is_devfreq_scaling_required(struct ufs_hba *hba, -- bool scale_up) -+ unsigned long freq, bool scale_up) - { - struct ufs_clk_info *clki; - struct list_head *head = &hba->clk_list_head; -@@ -1126,6 +1154,9 @@ static bool ufshcd_is_devfreq_scaling_required(struct ufs_hba *hba, - if (list_empty(head)) - return false; - -+ if (hba->use_pm_opp) -+ return freq != hba->clk_scaling.target_freq; -+ - list_for_each_entry(clki, head, list) { - if (!IS_ERR_OR_NULL(clki->clk)) { - if (scale_up && clki->max_freq) { -@@ -1324,12 +1355,14 @@ static void ufshcd_clock_scaling_unprepare(struct ufs_hba *hba, int err, bool sc - /** - * ufshcd_devfreq_scale - scale up/down UFS clocks and gear - * @hba: per adapter instance -+ * @freq: frequency to scale - * @scale_up: True for scaling up and false for scalin down - * - * Return: 0 for success; -EBUSY if scaling can't happen at this time; non-zero - * for any other errors. - */ --static int ufshcd_devfreq_scale(struct ufs_hba *hba, bool scale_up) -+static int ufshcd_devfreq_scale(struct ufs_hba *hba, unsigned long freq, -+ bool scale_up) - { - int ret = 0; - -@@ -1344,7 +1377,7 @@ static int ufshcd_devfreq_scale(struct ufs_hba *hba, bool scale_up) - goto out_unprepare; - } - -- ret = ufshcd_scale_clks(hba, scale_up); -+ ret = ufshcd_scale_clks(hba, freq, scale_up); - if (ret) { - if (!scale_up) - ufshcd_scale_gear(hba, true); -@@ -1355,7 +1388,8 @@ static int ufshcd_devfreq_scale(struct ufs_hba *hba, bool scale_up) - if (scale_up) { - ret = ufshcd_scale_gear(hba, true); - if (ret) { -- ufshcd_scale_clks(hba, false); -+ ufshcd_scale_clks(hba, hba->devfreq->previous_freq, -+ false); - goto out_unprepare; - } - } -@@ -1377,9 +1411,10 @@ static void ufshcd_clk_scaling_suspend_work(struct work_struct *work) - return; - } - hba->clk_scaling.is_suspended = true; -+ hba->clk_scaling.window_start_t = 0; - spin_unlock_irqrestore(hba->host->host_lock, irq_flags); - -- __ufshcd_suspend_clkscaling(hba); -+ devfreq_suspend_device(hba->devfreq); - } - - static void ufshcd_clk_scaling_resume_work(struct work_struct *work) -@@ -1413,9 +1448,22 @@ static int ufshcd_devfreq_target(struct device *dev, - if (!ufshcd_is_clkscaling_supported(hba)) - return -EINVAL; - -- clki = list_first_entry(&hba->clk_list_head, struct ufs_clk_info, list); -- /* Override with the closest supported frequency */ -- *freq = (unsigned long) clk_round_rate(clki->clk, *freq); -+ if (hba->use_pm_opp) { -+ struct dev_pm_opp *opp; -+ -+ /* Get the recommended frequency from OPP framework */ -+ opp = devfreq_recommended_opp(dev, freq, flags); -+ if (IS_ERR(opp)) -+ return PTR_ERR(opp); -+ -+ dev_pm_opp_put(opp); -+ } else { -+ /* Override with the closest supported frequency */ -+ clki = list_first_entry(&hba->clk_list_head, struct ufs_clk_info, -+ list); -+ *freq = (unsigned long) clk_round_rate(clki->clk, *freq); -+ } -+ - spin_lock_irqsave(hba->host->host_lock, irq_flags); - if (ufshcd_eh_in_progress(hba)) { - spin_unlock_irqrestore(hba->host->host_lock, irq_flags); -@@ -1430,12 +1478,17 @@ static int ufshcd_devfreq_target(struct device *dev, - goto out; - } - -- /* Decide based on the rounded-off frequency and update */ -- scale_up = *freq == clki->max_freq; -- if (!scale_up) -+ /* Decide based on the target or rounded-off frequency and update */ -+ if (hba->use_pm_opp) -+ scale_up = *freq > hba->clk_scaling.target_freq; -+ else -+ scale_up = *freq == clki->max_freq; -+ -+ if (!hba->use_pm_opp && !scale_up) - *freq = clki->min_freq; -+ - /* Update the frequency */ -- if (!ufshcd_is_devfreq_scaling_required(hba, scale_up)) { -+ if (!ufshcd_is_devfreq_scaling_required(hba, *freq, scale_up)) { - spin_unlock_irqrestore(hba->host->host_lock, irq_flags); - ret = 0; - goto out; /* no state change required */ -@@ -1443,7 +1496,9 @@ static int ufshcd_devfreq_target(struct device *dev, - spin_unlock_irqrestore(hba->host->host_lock, irq_flags); - - start = ktime_get(); -- ret = ufshcd_devfreq_scale(hba, scale_up); -+ ret = ufshcd_devfreq_scale(hba, *freq, scale_up); -+ if (!ret) -+ hba->clk_scaling.target_freq = *freq; - - trace_ufshcd_profile_clk_scaling(dev_name(hba->dev), - (scale_up ? "up" : "down"), -@@ -1463,8 +1518,6 @@ static int ufshcd_devfreq_get_dev_status(struct device *dev, - struct ufs_hba *hba = dev_get_drvdata(dev); - struct ufs_clk_scaling *scaling = &hba->clk_scaling; - unsigned long flags; -- struct list_head *clk_list = &hba->clk_list_head; -- struct ufs_clk_info *clki; - ktime_t curr_t; - - if (!ufshcd_is_clkscaling_supported(hba)) -@@ -1477,17 +1530,24 @@ static int ufshcd_devfreq_get_dev_status(struct device *dev, - if (!scaling->window_start_t) - goto start_window; - -- clki = list_first_entry(clk_list, struct ufs_clk_info, list); - /* - * If current frequency is 0, then the ondemand governor considers - * there's no initial frequency set. And it always requests to set - * to max. frequency. - */ -- stat->current_frequency = clki->curr_freq; -+ if (hba->use_pm_opp) { -+ stat->current_frequency = hba->clk_scaling.target_freq; -+ } else { -+ struct list_head *clk_list = &hba->clk_list_head; -+ struct ufs_clk_info *clki; -+ -+ clki = list_first_entry(clk_list, struct ufs_clk_info, list); -+ stat->current_frequency = clki->curr_freq; -+ } -+ - if (scaling->is_busy_started) - scaling->tot_busy_t += ktime_us_delta(curr_t, - scaling->busy_start_t); -- - stat->total_time = ktime_us_delta(curr_t, scaling->window_start_t); - stat->busy_time = scaling->tot_busy_t; - start_window: -@@ -1516,9 +1576,11 @@ static int ufshcd_devfreq_init(struct ufs_hba *hba) - if (list_empty(clk_list)) - return 0; - -- clki = list_first_entry(clk_list, struct ufs_clk_info, list); -- dev_pm_opp_add(hba->dev, clki->min_freq, 0); -- dev_pm_opp_add(hba->dev, clki->max_freq, 0); -+ if (!hba->use_pm_opp) { -+ clki = list_first_entry(clk_list, struct ufs_clk_info, list); -+ dev_pm_opp_add(hba->dev, clki->min_freq, 0); -+ dev_pm_opp_add(hba->dev, clki->max_freq, 0); -+ } - - ufshcd_vops_config_scaling_param(hba, &hba->vps->devfreq_profile, - &hba->vps->ondemand_data); -@@ -1530,8 +1592,10 @@ static int ufshcd_devfreq_init(struct ufs_hba *hba) - ret = PTR_ERR(devfreq); - dev_err(hba->dev, "Unable to register with devfreq %d\n", ret); - -- dev_pm_opp_remove(hba->dev, clki->min_freq); -- dev_pm_opp_remove(hba->dev, clki->max_freq); -+ if (!hba->use_pm_opp) { -+ dev_pm_opp_remove(hba->dev, clki->min_freq); -+ dev_pm_opp_remove(hba->dev, clki->max_freq); -+ } - return ret; - } - -@@ -1543,7 +1607,6 @@ static int ufshcd_devfreq_init(struct ufs_hba *hba) - static void ufshcd_devfreq_remove(struct ufs_hba *hba) - { - struct list_head *clk_list = &hba->clk_list_head; -- struct ufs_clk_info *clki; - - if (!hba->devfreq) - return; -@@ -1551,19 +1614,13 @@ static void ufshcd_devfreq_remove(struct ufs_hba *hba) - devfreq_remove_device(hba->devfreq); - hba->devfreq = NULL; - -- clki = list_first_entry(clk_list, struct ufs_clk_info, list); -- dev_pm_opp_remove(hba->dev, clki->min_freq); -- dev_pm_opp_remove(hba->dev, clki->max_freq); --} -+ if (!hba->use_pm_opp) { -+ struct ufs_clk_info *clki; - --static void __ufshcd_suspend_clkscaling(struct ufs_hba *hba) --{ -- unsigned long flags; -- -- devfreq_suspend_device(hba->devfreq); -- spin_lock_irqsave(hba->host->host_lock, flags); -- hba->clk_scaling.window_start_t = 0; -- spin_unlock_irqrestore(hba->host->host_lock, flags); -+ clki = list_first_entry(clk_list, struct ufs_clk_info, list); -+ dev_pm_opp_remove(hba->dev, clki->min_freq); -+ dev_pm_opp_remove(hba->dev, clki->max_freq); -+ } - } - - static void ufshcd_suspend_clkscaling(struct ufs_hba *hba) -@@ -1578,11 +1635,12 @@ static void ufshcd_suspend_clkscaling(struct ufs_hba *hba) - if (!hba->clk_scaling.is_suspended) { - suspend = true; - hba->clk_scaling.is_suspended = true; -+ hba->clk_scaling.window_start_t = 0; - } - spin_unlock_irqrestore(hba->host->host_lock, flags); - - if (suspend) -- __ufshcd_suspend_clkscaling(hba); -+ devfreq_suspend_device(hba->devfreq); - } - - static void ufshcd_resume_clkscaling(struct ufs_hba *hba) -@@ -1638,7 +1696,7 @@ static ssize_t ufshcd_clkscale_enable_store(struct device *dev, - ufshcd_resume_clkscaling(hba); - } else { - ufshcd_suspend_clkscaling(hba); -- err = ufshcd_devfreq_scale(hba, true); -+ err = ufshcd_devfreq_scale(hba, ULONG_MAX, true); - if (err) - dev_err(hba->dev, "%s: failed to scale clocks up %d\n", - __func__, err); -@@ -7722,7 +7780,8 @@ static int ufshcd_host_reset_and_restore(struct ufs_hba *hba) - hba->silence_err_logs = false; - - /* scale up clocks to max frequency before full reinitialization */ -- ufshcd_scale_clks(hba, true); -+ if (ufshcd_is_clkscaling_supported(hba)) -+ ufshcd_scale_clks(hba, ULONG_MAX, true); - - err = ufshcd_hba_enable(hba); - -@@ -9360,6 +9419,17 @@ static int ufshcd_init_clocks(struct ufs_hba *hba) - dev_dbg(dev, "%s: clk: %s, rate: %lu\n", __func__, - clki->name, clk_get_rate(clki->clk)); - } -+ -+ /* Set Max. frequency for all clocks */ -+ if (hba->use_pm_opp) { -+ ret = ufshcd_opp_set_rate(hba, ULONG_MAX); -+ if (ret) { -+ dev_err(hba->dev, "%s: failed to set OPP: %d", __func__, -+ ret); -+ goto out; -+ } -+ } -+ - out: - return ret; - } -diff --git a/drivers/usb/cdns3/cdnsp-ring.c b/drivers/usb/cdns3/cdnsp-ring.c -index 080a3f17a35dd7..3b17d9e4b07d8c 100644 ---- a/drivers/usb/cdns3/cdnsp-ring.c -+++ b/drivers/usb/cdns3/cdnsp-ring.c -@@ -772,7 +772,9 @@ static int cdnsp_update_port_id(struct cdnsp_device *pdev, u32 port_id) - } - - if (port_id != old_port) { -- cdnsp_disable_slot(pdev); -+ if (pdev->slot_id) -+ cdnsp_disable_slot(pdev); -+ - pdev->active_port = port; - cdnsp_enable_slot(pdev); - } -diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c -index f2ae5f4c58283a..0bee561420af29 100644 ---- a/drivers/usb/chipidea/udc.c -+++ b/drivers/usb/chipidea/udc.c -@@ -2213,6 +2213,10 @@ static void udc_suspend(struct ci_hdrc *ci) - */ - if (hw_read(ci, OP_ENDPTLISTADDR, ~0) == 0) - hw_write(ci, OP_ENDPTLISTADDR, ~0, ~0); -+ -+ if (ci->gadget.connected && -+ (!ci->suspended || !device_may_wakeup(ci->dev))) -+ usb_gadget_disconnect(&ci->gadget); - } - - static void udc_resume(struct ci_hdrc *ci, bool power_lost) -@@ -2223,6 +2227,9 @@ static void udc_resume(struct ci_hdrc *ci, bool power_lost) - OTGSC_BSVIS | OTGSC_BSVIE); - if (ci->vbus_active) - usb_gadget_vbus_disconnect(&ci->gadget); -+ } else if (ci->vbus_active && ci->driver && -+ !ci->gadget.connected) { -+ usb_gadget_connect(&ci->gadget); - } - - /* Restore value 0 if it was set for power lost check */ -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index c979ecd0169a2d..46db600fdd824e 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -227,7 +227,8 @@ static const struct usb_device_id usb_quirk_list[] = { - { USB_DEVICE(0x046a, 0x0023), .driver_info = USB_QUIRK_RESET_RESUME }, - - /* Logitech HD Webcam C270 */ -- { USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME }, -+ { USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME | -+ USB_QUIRK_NO_LPM}, - - /* Logitech HD Pro Webcams C920, C920-C, C922, C925e and C930e */ - { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT }, -diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c -index fab9e6be4e27ae..2cd8c757c65342 100644 ---- a/drivers/usb/host/xhci-dbgcap.c -+++ b/drivers/usb/host/xhci-dbgcap.c -@@ -639,6 +639,10 @@ static void xhci_dbc_stop(struct xhci_dbc *dbc) - case DS_DISABLED: - return; - case DS_CONFIGURED: -+ spin_lock(&dbc->lock); -+ xhci_dbc_flush_requests(dbc); -+ spin_unlock(&dbc->lock); -+ - if (dbc->driver->disconnect) - dbc->driver->disconnect(dbc); - break; -diff --git a/drivers/usb/host/xhci-dbgtty.c b/drivers/usb/host/xhci-dbgtty.c -index 0266c2f5bc0d8e..aa689fbd3dce67 100644 ---- a/drivers/usb/host/xhci-dbgtty.c -+++ b/drivers/usb/host/xhci-dbgtty.c -@@ -585,6 +585,7 @@ int dbc_tty_init(void) - dbc_tty_driver->type = TTY_DRIVER_TYPE_SERIAL; - dbc_tty_driver->subtype = SERIAL_TYPE_NORMAL; - dbc_tty_driver->init_termios = tty_std_termios; -+ dbc_tty_driver->init_termios.c_lflag &= ~ECHO; - dbc_tty_driver->init_termios.c_cflag = - B9600 | CS8 | CREAD | HUPCL | CLOCAL; - dbc_tty_driver->init_termios.c_ispeed = 9600; -diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c -index 22cca89efbfd72..cceb69d4f61e1c 100644 ---- a/drivers/usb/host/xhci-mem.c -+++ b/drivers/usb/host/xhci-mem.c -@@ -1436,6 +1436,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci, - /* Periodic endpoint bInterval limit quirk */ - if (usb_endpoint_xfer_int(&ep->desc) || - usb_endpoint_xfer_isoc(&ep->desc)) { -+ if ((xhci->quirks & XHCI_LIMIT_ENDPOINT_INTERVAL_9) && -+ interval >= 9) { -+ interval = 8; -+ } - if ((xhci->quirks & XHCI_LIMIT_ENDPOINT_INTERVAL_7) && - udev->speed >= USB_SPEED_HIGH && - interval >= 7) { -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index c1a172b6feae84..5abc48f148dcbc 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -65,12 +65,22 @@ - #define PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI 0x51ed - #define PCI_DEVICE_ID_INTEL_ALDER_LAKE_N_PCH_XHCI 0x54ed - -+#define PCI_DEVICE_ID_AMD_ARIEL_TYPEC_XHCI 0x13ed -+#define PCI_DEVICE_ID_AMD_ARIEL_TYPEA_XHCI 0x13ee -+#define PCI_DEVICE_ID_AMD_STARSHIP_XHCI 0x148c -+#define PCI_DEVICE_ID_AMD_FIREFLIGHT_15D4_XHCI 0x15d4 -+#define PCI_DEVICE_ID_AMD_FIREFLIGHT_15D5_XHCI 0x15d5 -+#define PCI_DEVICE_ID_AMD_RAVEN_15E0_XHCI 0x15e0 -+#define PCI_DEVICE_ID_AMD_RAVEN_15E1_XHCI 0x15e1 -+#define PCI_DEVICE_ID_AMD_RAVEN2_XHCI 0x15e5 - #define PCI_DEVICE_ID_AMD_RENOIR_XHCI 0x1639 - #define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9 - #define PCI_DEVICE_ID_AMD_PROMONTORYA_3 0x43ba - #define PCI_DEVICE_ID_AMD_PROMONTORYA_2 0x43bb - #define PCI_DEVICE_ID_AMD_PROMONTORYA_1 0x43bc - -+#define PCI_DEVICE_ID_ATI_NAVI10_7316_XHCI 0x7316 -+ - #define PCI_DEVICE_ID_ASMEDIA_1042_XHCI 0x1042 - #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI 0x1142 - #define PCI_DEVICE_ID_ASMEDIA_1142_XHCI 0x1242 -@@ -348,6 +358,21 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - if (pdev->vendor == PCI_VENDOR_ID_NEC) - xhci->quirks |= XHCI_NEC_HOST; - -+ if (pdev->vendor == PCI_VENDOR_ID_AMD && -+ (pdev->device == PCI_DEVICE_ID_AMD_ARIEL_TYPEC_XHCI || -+ pdev->device == PCI_DEVICE_ID_AMD_ARIEL_TYPEA_XHCI || -+ pdev->device == PCI_DEVICE_ID_AMD_STARSHIP_XHCI || -+ pdev->device == PCI_DEVICE_ID_AMD_FIREFLIGHT_15D4_XHCI || -+ pdev->device == PCI_DEVICE_ID_AMD_FIREFLIGHT_15D5_XHCI || -+ pdev->device == PCI_DEVICE_ID_AMD_RAVEN_15E0_XHCI || -+ pdev->device == PCI_DEVICE_ID_AMD_RAVEN_15E1_XHCI || -+ pdev->device == PCI_DEVICE_ID_AMD_RAVEN2_XHCI)) -+ xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_9; -+ -+ if (pdev->vendor == PCI_VENDOR_ID_ATI && -+ pdev->device == PCI_DEVICE_ID_ATI_NAVI10_7316_XHCI) -+ xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_9; -+ - if (pdev->vendor == PCI_VENDOR_ID_AMD && xhci->hci_version == 0x96) - xhci->quirks |= XHCI_AMD_0x96_HOST; - -diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c -index 8832e0cedadaff..749ba3596c2b3f 100644 ---- a/drivers/usb/host/xhci-plat.c -+++ b/drivers/usb/host/xhci-plat.c -@@ -313,7 +313,8 @@ int xhci_plat_probe(struct platform_device *pdev, struct device *sysdev, const s - } - - usb3_hcd = xhci_get_usb3_hcd(xhci); -- if (usb3_hcd && HCC_MAX_PSA(xhci->hcc_params) >= 4) -+ if (usb3_hcd && HCC_MAX_PSA(xhci->hcc_params) >= 4 && -+ !(xhci->quirks & XHCI_BROKEN_STREAMS)) - usb3_hcd->can_do_streams = 1; - - if (xhci->shared_hcd) { -diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h -index 74bdd035d756a4..159cdfc7129070 100644 ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -1659,6 +1659,7 @@ struct xhci_hcd { - #define XHCI_WRITE_64_HI_LO BIT_ULL(47) - #define XHCI_CDNS_SCTX_QUIRK BIT_ULL(48) - #define XHCI_ETRON_HOST BIT_ULL(49) -+#define XHCI_LIMIT_ENDPOINT_INTERVAL_9 BIT_ULL(50) - - unsigned int num_active_eps; - unsigned int limit_active_eps; -diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c -index 5f6fc5b79212ef..7eb78885fa2b3a 100644 ---- a/drivers/usb/typec/altmodes/displayport.c -+++ b/drivers/usb/typec/altmodes/displayport.c -@@ -324,8 +324,7 @@ static int dp_altmode_vdm(struct typec_altmode *alt, - case CMDT_RSP_NAK: - switch (cmd) { - case DP_CMD_STATUS_UPDATE: -- if (typec_altmode_exit(alt)) -- dev_err(&dp->alt->dev, "Exit Mode Failed!\n"); -+ dp->state = DP_STATE_EXIT; - break; - case DP_CMD_CONFIGURE: - dp->data.conf = 0; -@@ -528,7 +527,7 @@ static ssize_t pin_assignment_show(struct device *dev, - - assignments = get_current_pin_assignments(dp); - -- for (i = 0; assignments; assignments >>= 1, i++) { -+ for (i = 0; assignments && i < DP_PIN_ASSIGN_MAX; assignments >>= 1, i++) { - if (assignments & 1) { - if (i == cur) - len += sprintf(buf + len, "[%s] ", -diff --git a/fs/anon_inodes.c b/fs/anon_inodes.c -index 24192a7667edf7..a25766e90f0a6e 100644 ---- a/fs/anon_inodes.c -+++ b/fs/anon_inodes.c -@@ -55,15 +55,26 @@ static struct file_system_type anon_inode_fs_type = { - .kill_sb = kill_anon_super, - }; - --static struct inode *anon_inode_make_secure_inode( -- const char *name, -- const struct inode *context_inode) -+/** -+ * anon_inode_make_secure_inode - allocate an anonymous inode with security context -+ * @sb: [in] Superblock to allocate from -+ * @name: [in] Name of the class of the newfile (e.g., "secretmem") -+ * @context_inode: -+ * [in] Optional parent inode for security inheritance -+ * -+ * The function ensures proper security initialization through the LSM hook -+ * security_inode_init_security_anon(). -+ * -+ * Return: Pointer to new inode on success, ERR_PTR on failure. -+ */ -+struct inode *anon_inode_make_secure_inode(struct super_block *sb, const char *name, -+ const struct inode *context_inode) - { - struct inode *inode; - const struct qstr qname = QSTR_INIT(name, strlen(name)); - int error; - -- inode = alloc_anon_inode(anon_inode_mnt->mnt_sb); -+ inode = alloc_anon_inode(sb); - if (IS_ERR(inode)) - return inode; - inode->i_flags &= ~S_PRIVATE; -@@ -74,6 +85,7 @@ static struct inode *anon_inode_make_secure_inode( - } - return inode; - } -+EXPORT_SYMBOL_GPL_FOR_MODULES(anon_inode_make_secure_inode, "kvm"); - - static struct file *__anon_inode_getfile(const char *name, - const struct file_operations *fops, -@@ -88,7 +100,8 @@ static struct file *__anon_inode_getfile(const char *name, - return ERR_PTR(-ENOENT); - - if (secure) { -- inode = anon_inode_make_secure_inode(name, context_inode); -+ inode = anon_inode_make_secure_inode(anon_inode_mnt->mnt_sb, -+ name, context_inode); - if (IS_ERR(inode)) { - file = ERR_CAST(inode); - goto err; -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index af1f22b3cff7dc..e8e57abb032d7a 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -4615,9 +4615,8 @@ static int btrfs_rmdir(struct inode *dir, struct dentry *dentry) - { - struct inode *inode = d_inode(dentry); - struct btrfs_fs_info *fs_info = BTRFS_I(inode)->root->fs_info; -- int err = 0; -+ int ret = 0; - struct btrfs_trans_handle *trans; -- u64 last_unlink_trans; - struct fscrypt_name fname; - - if (inode->i_size > BTRFS_EMPTY_DIR_SIZE) -@@ -4631,55 +4630,56 @@ static int btrfs_rmdir(struct inode *dir, struct dentry *dentry) - return btrfs_delete_subvolume(BTRFS_I(dir), dentry); - } - -- err = fscrypt_setup_filename(dir, &dentry->d_name, 1, &fname); -- if (err) -- return err; -+ ret = fscrypt_setup_filename(dir, &dentry->d_name, 1, &fname); -+ if (ret) -+ return ret; - - /* This needs to handle no-key deletions later on */ - - trans = __unlink_start_trans(BTRFS_I(dir)); - if (IS_ERR(trans)) { -- err = PTR_ERR(trans); -+ ret = PTR_ERR(trans); - goto out_notrans; - } - -+ /* -+ * Propagate the last_unlink_trans value of the deleted dir to its -+ * parent directory. This is to prevent an unrecoverable log tree in the -+ * case we do something like this: -+ * 1) create dir foo -+ * 2) create snapshot under dir foo -+ * 3) delete the snapshot -+ * 4) rmdir foo -+ * 5) mkdir foo -+ * 6) fsync foo or some file inside foo -+ * -+ * This is because we can't unlink other roots when replaying the dir -+ * deletes for directory foo. -+ */ -+ if (BTRFS_I(inode)->last_unlink_trans >= trans->transid) -+ btrfs_record_snapshot_destroy(trans, BTRFS_I(dir)); -+ - if (unlikely(btrfs_ino(BTRFS_I(inode)) == BTRFS_EMPTY_SUBVOL_DIR_OBJECTID)) { -- err = btrfs_unlink_subvol(trans, BTRFS_I(dir), dentry); -+ ret = btrfs_unlink_subvol(trans, BTRFS_I(dir), dentry); - goto out; - } - -- err = btrfs_orphan_add(trans, BTRFS_I(inode)); -- if (err) -+ ret = btrfs_orphan_add(trans, BTRFS_I(inode)); -+ if (ret) - goto out; - -- last_unlink_trans = BTRFS_I(inode)->last_unlink_trans; -- - /* now the directory is empty */ -- err = btrfs_unlink_inode(trans, BTRFS_I(dir), BTRFS_I(d_inode(dentry)), -+ ret = btrfs_unlink_inode(trans, BTRFS_I(dir), BTRFS_I(d_inode(dentry)), - &fname.disk_name); -- if (!err) { -+ if (!ret) - btrfs_i_size_write(BTRFS_I(inode), 0); -- /* -- * Propagate the last_unlink_trans value of the deleted dir to -- * its parent directory. This is to prevent an unrecoverable -- * log tree in the case we do something like this: -- * 1) create dir foo -- * 2) create snapshot under dir foo -- * 3) delete the snapshot -- * 4) rmdir foo -- * 5) mkdir foo -- * 6) fsync foo or some file inside foo -- */ -- if (last_unlink_trans >= trans->transid) -- BTRFS_I(dir)->last_unlink_trans = last_unlink_trans; -- } - out: - btrfs_end_transaction(trans); - out_notrans: - btrfs_btree_balance_dirty(fs_info); - fscrypt_free_filename(&fname); - -- return err; -+ return ret; - } - - /* -diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c -index 86d846eb5ed492..c68e9ecbc438cc 100644 ---- a/fs/btrfs/ordered-data.c -+++ b/fs/btrfs/ordered-data.c -@@ -154,9 +154,10 @@ static struct btrfs_ordered_extent *alloc_ordered_extent( - struct btrfs_ordered_extent *entry; - int ret; - u64 qgroup_rsv = 0; -+ const bool is_nocow = (flags & -+ ((1U << BTRFS_ORDERED_NOCOW) | (1U << BTRFS_ORDERED_PREALLOC))); - -- if (flags & -- ((1 << BTRFS_ORDERED_NOCOW) | (1 << BTRFS_ORDERED_PREALLOC))) { -+ if (is_nocow) { - /* For nocow write, we can release the qgroup rsv right now */ - ret = btrfs_qgroup_free_data(inode, NULL, file_offset, num_bytes, &qgroup_rsv); - if (ret < 0) -@@ -171,8 +172,13 @@ static struct btrfs_ordered_extent *alloc_ordered_extent( - return ERR_PTR(ret); - } - entry = kmem_cache_zalloc(btrfs_ordered_extent_cache, GFP_NOFS); -- if (!entry) -+ if (!entry) { -+ if (!is_nocow) -+ btrfs_qgroup_free_refroot(inode->root->fs_info, -+ btrfs_root_id(inode->root), -+ qgroup_rsv, BTRFS_QGROUP_RSV_DATA); - return ERR_PTR(-ENOMEM); -+ } - - entry->file_offset = file_offset; - entry->num_bytes = num_bytes; -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index cc9a2f8a4ae3b7..13377c3b22897d 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -1087,7 +1087,9 @@ static inline int __add_inode_ref(struct btrfs_trans_handle *trans, - search_key.type = BTRFS_INODE_REF_KEY; - search_key.offset = parent_objectid; - ret = btrfs_search_slot(NULL, root, &search_key, path, 0, 0); -- if (ret == 0) { -+ if (ret < 0) { -+ return ret; -+ } else if (ret == 0) { - struct btrfs_inode_ref *victim_ref; - unsigned long ptr; - unsigned long ptr_end; -@@ -1160,13 +1162,13 @@ static inline int __add_inode_ref(struct btrfs_trans_handle *trans, - struct fscrypt_str victim_name; - - extref = (struct btrfs_inode_extref *)(base + cur_offset); -+ victim_name.len = btrfs_inode_extref_name_len(leaf, extref); - - if (btrfs_inode_extref_parent(leaf, extref) != parent_objectid) - goto next; - - ret = read_alloc_one_name(leaf, &extref->name, -- btrfs_inode_extref_name_len(leaf, extref), -- &victim_name); -+ victim_name.len, &victim_name); - if (ret) - return ret; - -diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c -index ae129044c52f42..8f0cb7c7eedeb4 100644 ---- a/fs/f2fs/file.c -+++ b/fs/f2fs/file.c -@@ -36,9 +36,21 @@ - #include - #include - -+static void f2fs_zero_post_eof_page(struct inode *inode, loff_t new_size) -+{ -+ loff_t old_size = i_size_read(inode); -+ -+ if (old_size >= new_size) -+ return; -+ -+ /* zero or drop pages only in range of [old_size, new_size] */ -+ truncate_pagecache(inode, old_size); -+} -+ - static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf) - { - struct inode *inode = file_inode(vmf->vma->vm_file); -+ vm_flags_t flags = vmf->vma->vm_flags; - vm_fault_t ret; - - ret = filemap_fault(vmf); -@@ -46,47 +58,50 @@ static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf) - f2fs_update_iostat(F2FS_I_SB(inode), inode, - APP_MAPPED_READ_IO, F2FS_BLKSIZE); - -- trace_f2fs_filemap_fault(inode, vmf->pgoff, (unsigned long)ret); -+ trace_f2fs_filemap_fault(inode, vmf->pgoff, flags, ret); - - return ret; - } - - static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf) - { -- struct page *page = vmf->page; -+ struct folio *folio = page_folio(vmf->page); - struct inode *inode = file_inode(vmf->vma->vm_file); - struct f2fs_sb_info *sbi = F2FS_I_SB(inode); - struct dnode_of_data dn; -- bool need_alloc = true; -+ bool need_alloc = !f2fs_is_pinned_file(inode); - int err = 0; -+ vm_fault_t ret; - - if (unlikely(IS_IMMUTABLE(inode))) - return VM_FAULT_SIGBUS; - -- if (is_inode_flag_set(inode, FI_COMPRESS_RELEASED)) -- return VM_FAULT_SIGBUS; -+ if (is_inode_flag_set(inode, FI_COMPRESS_RELEASED)) { -+ err = -EIO; -+ goto out; -+ } - - if (unlikely(f2fs_cp_error(sbi))) { - err = -EIO; -- goto err; -+ goto out; - } - - if (!f2fs_is_checkpoint_ready(sbi)) { - err = -ENOSPC; -- goto err; -+ goto out; - } - - err = f2fs_convert_inline_inode(inode); - if (err) -- goto err; -+ goto out; - - #ifdef CONFIG_F2FS_FS_COMPRESSION - if (f2fs_compressed_file(inode)) { -- int ret = f2fs_is_compressed_cluster(inode, page->index); -+ int ret = f2fs_is_compressed_cluster(inode, folio->index); - - if (ret < 0) { - err = ret; -- goto err; -+ goto out; - } else if (ret) { - need_alloc = false; - } -@@ -100,36 +115,40 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf) - - f2fs_bug_on(sbi, f2fs_has_inline_data(inode)); - -+ filemap_invalidate_lock(inode->i_mapping); -+ f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT); -+ filemap_invalidate_unlock(inode->i_mapping); -+ - file_update_time(vmf->vma->vm_file); - filemap_invalidate_lock_shared(inode->i_mapping); -- lock_page(page); -- if (unlikely(page->mapping != inode->i_mapping || -- page_offset(page) > i_size_read(inode) || -- !PageUptodate(page))) { -- unlock_page(page); -+ -+ folio_lock(folio); -+ if (unlikely(folio->mapping != inode->i_mapping || -+ folio_pos(folio) > i_size_read(inode) || -+ !folio_test_uptodate(folio))) { -+ folio_unlock(folio); - err = -EFAULT; - goto out_sem; - } - -+ set_new_dnode(&dn, inode, NULL, NULL, 0); - if (need_alloc) { - /* block allocation */ -- set_new_dnode(&dn, inode, NULL, NULL, 0); -- err = f2fs_get_block_locked(&dn, page->index); -- } -- --#ifdef CONFIG_F2FS_FS_COMPRESSION -- if (!need_alloc) { -- set_new_dnode(&dn, inode, NULL, NULL, 0); -- err = f2fs_get_dnode_of_data(&dn, page->index, LOOKUP_NODE); -+ err = f2fs_get_block_locked(&dn, folio->index); -+ } else { -+ err = f2fs_get_dnode_of_data(&dn, folio->index, LOOKUP_NODE); - f2fs_put_dnode(&dn); -+ if (f2fs_is_pinned_file(inode) && -+ !__is_valid_data_blkaddr(dn.data_blkaddr)) -+ err = -EIO; - } --#endif -+ - if (err) { -- unlock_page(page); -+ folio_unlock(folio); - goto out_sem; - } - -- f2fs_wait_on_page_writeback(page, DATA, false, true); -+ f2fs_wait_on_page_writeback(folio_page(folio, 0), DATA, false, true); - - /* wait for GCed page writeback via META_MAPPING */ - f2fs_wait_on_block_writeback(inode, dn.data_blkaddr); -@@ -137,29 +156,31 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf) - /* - * check to see if the page is mapped already (no holes) - */ -- if (PageMappedToDisk(page)) -+ if (folio_test_mappedtodisk(folio)) - goto out_sem; - - /* page is wholly or partially inside EOF */ -- if (((loff_t)(page->index + 1) << PAGE_SHIFT) > -+ if (((loff_t)(folio->index + 1) << PAGE_SHIFT) > - i_size_read(inode)) { - loff_t offset; - - offset = i_size_read(inode) & ~PAGE_MASK; -- zero_user_segment(page, offset, PAGE_SIZE); -+ folio_zero_segment(folio, offset, folio_size(folio)); - } -- set_page_dirty(page); -+ folio_mark_dirty(folio); - - f2fs_update_iostat(sbi, inode, APP_MAPPED_IO, F2FS_BLKSIZE); - f2fs_update_time(sbi, REQ_TIME); - -- trace_f2fs_vm_page_mkwrite(page, DATA); - out_sem: - filemap_invalidate_unlock_shared(inode->i_mapping); - - sb_end_pagefault(inode->i_sb); --err: -- return vmf_fs_error(err); -+out: -+ ret = vmf_fs_error(err); -+ -+ trace_f2fs_vm_page_mkwrite(inode, folio->index, vmf->vma->vm_flags, ret); -+ return ret; - } - - static const struct vm_operations_struct f2fs_file_vm_ops = { -@@ -1047,6 +1068,8 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, - f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); - filemap_invalidate_lock(inode->i_mapping); - -+ if (attr->ia_size > old_size) -+ f2fs_zero_post_eof_page(inode, attr->ia_size); - truncate_setsize(inode, attr->ia_size); - - if (attr->ia_size <= old_size) -@@ -1165,6 +1188,10 @@ static int f2fs_punch_hole(struct inode *inode, loff_t offset, loff_t len) - if (ret) - return ret; - -+ filemap_invalidate_lock(inode->i_mapping); -+ f2fs_zero_post_eof_page(inode, offset + len); -+ filemap_invalidate_unlock(inode->i_mapping); -+ - pg_start = ((unsigned long long) offset) >> PAGE_SHIFT; - pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT; - -@@ -1449,6 +1476,8 @@ static int f2fs_do_collapse(struct inode *inode, loff_t offset, loff_t len) - f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); - filemap_invalidate_lock(inode->i_mapping); - -+ f2fs_zero_post_eof_page(inode, offset + len); -+ - f2fs_lock_op(sbi); - f2fs_drop_extent_tree(inode); - truncate_pagecache(inode, offset); -@@ -1571,6 +1600,10 @@ static int f2fs_zero_range(struct inode *inode, loff_t offset, loff_t len, - if (ret) - return ret; - -+ filemap_invalidate_lock(mapping); -+ f2fs_zero_post_eof_page(inode, offset + len); -+ filemap_invalidate_unlock(mapping); -+ - pg_start = ((unsigned long long) offset) >> PAGE_SHIFT; - pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT; - -@@ -1702,6 +1735,8 @@ static int f2fs_insert_range(struct inode *inode, loff_t offset, loff_t len) - /* avoid gc operation during block exchange */ - f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); - filemap_invalidate_lock(mapping); -+ -+ f2fs_zero_post_eof_page(inode, offset + len); - truncate_pagecache(inode, offset); - - while (!ret && idx > pg_start) { -@@ -1757,6 +1792,10 @@ static int f2fs_expand_inode_data(struct inode *inode, loff_t offset, - if (err) - return err; - -+ filemap_invalidate_lock(inode->i_mapping); -+ f2fs_zero_post_eof_page(inode, offset + len); -+ filemap_invalidate_unlock(inode->i_mapping); -+ - f2fs_balance_fs(sbi, true); - - pg_start = ((unsigned long long)offset) >> PAGE_SHIFT; -@@ -3327,7 +3366,7 @@ static int f2fs_ioc_set_pin_file(struct file *filp, unsigned long arg) - goto done; - } - -- if (f2fs_sb_has_blkzoned(sbi) && F2FS_HAS_BLOCKS(inode)) { -+ if (F2FS_HAS_BLOCKS(inode)) { - ret = -EFBIG; - goto out; - } -@@ -4670,6 +4709,10 @@ static ssize_t f2fs_write_checks(struct kiocb *iocb, struct iov_iter *from) - err = file_modified(file); - if (err) - return err; -+ -+ filemap_invalidate_lock(inode->i_mapping); -+ f2fs_zero_post_eof_page(inode, iocb->ki_pos + iov_iter_count(from)); -+ filemap_invalidate_unlock(inode->i_mapping); - return count; - } - -@@ -4914,6 +4957,8 @@ static ssize_t f2fs_file_write_iter(struct kiocb *iocb, struct iov_iter *from) - bool dio; - bool may_need_sync = true; - int preallocated; -+ const loff_t pos = iocb->ki_pos; -+ const ssize_t count = iov_iter_count(from); - ssize_t ret; - - if (unlikely(f2fs_cp_error(F2FS_I_SB(inode)))) { -@@ -4935,6 +4980,12 @@ static ssize_t f2fs_file_write_iter(struct kiocb *iocb, struct iov_iter *from) - inode_lock(inode); - } - -+ if (f2fs_is_pinned_file(inode) && -+ !f2fs_overwrite_io(inode, pos, count)) { -+ ret = -EIO; -+ goto out_unlock; -+ } -+ - ret = f2fs_write_checks(iocb, from); - if (ret <= 0) - goto out_unlock; -diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c -index 0bc537de1b2958..0a26444fe20233 100644 ---- a/fs/nfs/flexfilelayout/flexfilelayout.c -+++ b/fs/nfs/flexfilelayout/flexfilelayout.c -@@ -1096,6 +1096,7 @@ static void ff_layout_reset_read(struct nfs_pgio_header *hdr) - } - - static int ff_layout_async_handle_error_v4(struct rpc_task *task, -+ u32 op_status, - struct nfs4_state *state, - struct nfs_client *clp, - struct pnfs_layout_segment *lseg, -@@ -1106,32 +1107,42 @@ static int ff_layout_async_handle_error_v4(struct rpc_task *task, - struct nfs4_deviceid_node *devid = FF_LAYOUT_DEVID_NODE(lseg, idx); - struct nfs4_slot_table *tbl = &clp->cl_session->fc_slot_table; - -- switch (task->tk_status) { -- case -NFS4ERR_BADSESSION: -- case -NFS4ERR_BADSLOT: -- case -NFS4ERR_BAD_HIGH_SLOT: -- case -NFS4ERR_DEADSESSION: -- case -NFS4ERR_CONN_NOT_BOUND_TO_SESSION: -- case -NFS4ERR_SEQ_FALSE_RETRY: -- case -NFS4ERR_SEQ_MISORDERED: -+ switch (op_status) { -+ case NFS4_OK: -+ case NFS4ERR_NXIO: -+ break; -+ case NFSERR_PERM: -+ if (!task->tk_xprt) -+ break; -+ xprt_force_disconnect(task->tk_xprt); -+ goto out_retry; -+ case NFS4ERR_BADSESSION: -+ case NFS4ERR_BADSLOT: -+ case NFS4ERR_BAD_HIGH_SLOT: -+ case NFS4ERR_DEADSESSION: -+ case NFS4ERR_CONN_NOT_BOUND_TO_SESSION: -+ case NFS4ERR_SEQ_FALSE_RETRY: -+ case NFS4ERR_SEQ_MISORDERED: - dprintk("%s ERROR %d, Reset session. Exchangeid " - "flags 0x%x\n", __func__, task->tk_status, - clp->cl_exchange_flags); - nfs4_schedule_session_recovery(clp->cl_session, task->tk_status); -- break; -- case -NFS4ERR_DELAY: -- case -NFS4ERR_GRACE: -+ goto out_retry; -+ case NFS4ERR_DELAY: -+ nfs_inc_stats(lseg->pls_layout->plh_inode, NFSIOS_DELAY); -+ fallthrough; -+ case NFS4ERR_GRACE: - rpc_delay(task, FF_LAYOUT_POLL_RETRY_MAX); -- break; -- case -NFS4ERR_RETRY_UNCACHED_REP: -- break; -+ goto out_retry; -+ case NFS4ERR_RETRY_UNCACHED_REP: -+ goto out_retry; - /* Invalidate Layout errors */ -- case -NFS4ERR_PNFS_NO_LAYOUT: -- case -ESTALE: /* mapped NFS4ERR_STALE */ -- case -EBADHANDLE: /* mapped NFS4ERR_BADHANDLE */ -- case -EISDIR: /* mapped NFS4ERR_ISDIR */ -- case -NFS4ERR_FHEXPIRED: -- case -NFS4ERR_WRONG_TYPE: -+ case NFS4ERR_PNFS_NO_LAYOUT: -+ case NFS4ERR_STALE: -+ case NFS4ERR_BADHANDLE: -+ case NFS4ERR_ISDIR: -+ case NFS4ERR_FHEXPIRED: -+ case NFS4ERR_WRONG_TYPE: - dprintk("%s Invalid layout error %d\n", __func__, - task->tk_status); - /* -@@ -1144,6 +1155,11 @@ static int ff_layout_async_handle_error_v4(struct rpc_task *task, - pnfs_destroy_layout(NFS_I(inode)); - rpc_wake_up(&tbl->slot_tbl_waitq); - goto reset; -+ default: -+ break; -+ } -+ -+ switch (task->tk_status) { - /* RPC connection errors */ - case -ECONNREFUSED: - case -EHOSTDOWN: -@@ -1159,26 +1175,56 @@ static int ff_layout_async_handle_error_v4(struct rpc_task *task, - nfs4_delete_deviceid(devid->ld, devid->nfs_client, - &devid->deviceid); - rpc_wake_up(&tbl->slot_tbl_waitq); -- fallthrough; -+ break; - default: -- if (ff_layout_avoid_mds_available_ds(lseg)) -- return -NFS4ERR_RESET_TO_PNFS; --reset: -- dprintk("%s Retry through MDS. Error %d\n", __func__, -- task->tk_status); -- return -NFS4ERR_RESET_TO_MDS; -+ break; - } -+ -+ if (ff_layout_avoid_mds_available_ds(lseg)) -+ return -NFS4ERR_RESET_TO_PNFS; -+reset: -+ dprintk("%s Retry through MDS. Error %d\n", __func__, -+ task->tk_status); -+ return -NFS4ERR_RESET_TO_MDS; -+ -+out_retry: - task->tk_status = 0; - return -EAGAIN; - } - - /* Retry all errors through either pNFS or MDS except for -EJUKEBOX */ - static int ff_layout_async_handle_error_v3(struct rpc_task *task, -+ u32 op_status, -+ struct nfs_client *clp, - struct pnfs_layout_segment *lseg, - u32 idx) - { - struct nfs4_deviceid_node *devid = FF_LAYOUT_DEVID_NODE(lseg, idx); - -+ switch (op_status) { -+ case NFS_OK: -+ case NFSERR_NXIO: -+ break; -+ case NFSERR_PERM: -+ if (!task->tk_xprt) -+ break; -+ xprt_force_disconnect(task->tk_xprt); -+ goto out_retry; -+ case NFSERR_ACCES: -+ case NFSERR_BADHANDLE: -+ case NFSERR_FBIG: -+ case NFSERR_IO: -+ case NFSERR_NOSPC: -+ case NFSERR_ROFS: -+ case NFSERR_STALE: -+ goto out_reset_to_pnfs; -+ case NFSERR_JUKEBOX: -+ nfs_inc_stats(lseg->pls_layout->plh_inode, NFSIOS_DELAY); -+ goto out_retry; -+ default: -+ break; -+ } -+ - switch (task->tk_status) { - /* File access problems. Don't mark the device as unavailable */ - case -EACCES: -@@ -1197,6 +1243,7 @@ static int ff_layout_async_handle_error_v3(struct rpc_task *task, - nfs4_delete_deviceid(devid->ld, devid->nfs_client, - &devid->deviceid); - } -+out_reset_to_pnfs: - /* FIXME: Need to prevent infinite looping here. */ - return -NFS4ERR_RESET_TO_PNFS; - out_retry: -@@ -1207,6 +1254,7 @@ static int ff_layout_async_handle_error_v3(struct rpc_task *task, - } - - static int ff_layout_async_handle_error(struct rpc_task *task, -+ u32 op_status, - struct nfs4_state *state, - struct nfs_client *clp, - struct pnfs_layout_segment *lseg, -@@ -1225,10 +1273,11 @@ static int ff_layout_async_handle_error(struct rpc_task *task, - - switch (vers) { - case 3: -- return ff_layout_async_handle_error_v3(task, lseg, idx); -- case 4: -- return ff_layout_async_handle_error_v4(task, state, clp, -+ return ff_layout_async_handle_error_v3(task, op_status, clp, - lseg, idx); -+ case 4: -+ return ff_layout_async_handle_error_v4(task, op_status, state, -+ clp, lseg, idx); - default: - /* should never happen */ - WARN_ON_ONCE(1); -@@ -1281,6 +1330,7 @@ static void ff_layout_io_track_ds_error(struct pnfs_layout_segment *lseg, - switch (status) { - case NFS4ERR_DELAY: - case NFS4ERR_GRACE: -+ case NFS4ERR_PERM: - break; - case NFS4ERR_NXIO: - ff_layout_mark_ds_unreachable(lseg, idx); -@@ -1313,7 +1363,8 @@ static int ff_layout_read_done_cb(struct rpc_task *task, - trace_ff_layout_read_error(hdr); - } - -- err = ff_layout_async_handle_error(task, hdr->args.context->state, -+ err = ff_layout_async_handle_error(task, hdr->res.op_status, -+ hdr->args.context->state, - hdr->ds_clp, hdr->lseg, - hdr->pgio_mirror_idx); - -@@ -1483,7 +1534,8 @@ static int ff_layout_write_done_cb(struct rpc_task *task, - trace_ff_layout_write_error(hdr); - } - -- err = ff_layout_async_handle_error(task, hdr->args.context->state, -+ err = ff_layout_async_handle_error(task, hdr->res.op_status, -+ hdr->args.context->state, - hdr->ds_clp, hdr->lseg, - hdr->pgio_mirror_idx); - -@@ -1529,8 +1581,9 @@ static int ff_layout_commit_done_cb(struct rpc_task *task, - trace_ff_layout_commit_error(data); - } - -- err = ff_layout_async_handle_error(task, NULL, data->ds_clp, -- data->lseg, data->ds_commit_index); -+ err = ff_layout_async_handle_error(task, data->res.op_status, -+ NULL, data->ds_clp, data->lseg, -+ data->ds_commit_index); - - trace_nfs4_pnfs_commit_ds(data, err); - switch (err) { -diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c -index 419d98cf9e29f1..7e7dd2aab449dd 100644 ---- a/fs/nfs/inode.c -+++ b/fs/nfs/inode.c -@@ -2442,15 +2442,26 @@ EXPORT_SYMBOL_GPL(nfs_net_id); - static int nfs_net_init(struct net *net) - { - struct nfs_net *nn = net_generic(net, nfs_net_id); -+ int err; - - nfs_clients_init(net); - - if (!rpc_proc_register(net, &nn->rpcstats)) { -- nfs_clients_exit(net); -- return -ENOMEM; -+ err = -ENOMEM; -+ goto err_proc_rpc; - } - -- return nfs_fs_proc_net_init(net); -+ err = nfs_fs_proc_net_init(net); -+ if (err) -+ goto err_proc_nfs; -+ -+ return 0; -+ -+err_proc_nfs: -+ rpc_proc_unregister(net, "nfs"); -+err_proc_rpc: -+ nfs_clients_exit(net); -+ return err; - } - - static void nfs_net_exit(struct net *net) -diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c -index 73aa5a63afe3fb..79d1ffdcbebd3d 100644 ---- a/fs/nfs/pnfs.c -+++ b/fs/nfs/pnfs.c -@@ -1930,8 +1930,10 @@ static void nfs_layoutget_begin(struct pnfs_layout_hdr *lo) - static void nfs_layoutget_end(struct pnfs_layout_hdr *lo) - { - if (atomic_dec_and_test(&lo->plh_outstanding) && -- test_and_clear_bit(NFS_LAYOUT_DRAIN, &lo->plh_flags)) -+ test_and_clear_bit(NFS_LAYOUT_DRAIN, &lo->plh_flags)) { -+ smp_mb__after_atomic(); - wake_up_bit(&lo->plh_flags, NFS_LAYOUT_DRAIN); -+ } - } - - static bool pnfs_is_first_layoutget(struct pnfs_layout_hdr *lo) -diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h -index d776340ad91ce6..5c856adf7be9ec 100644 ---- a/fs/smb/client/cifsglob.h -+++ b/fs/smb/client/cifsglob.h -@@ -743,6 +743,7 @@ struct TCP_Server_Info { - __le32 session_key_id; /* retrieved from negotiate response and send in session setup request */ - struct session_key session_key; - unsigned long lstrp; /* when we got last response from this server */ -+ unsigned long neg_start; /* when negotiate started (jiffies) */ - struct cifs_secmech secmech; /* crypto sec mech functs, descriptors */ - #define CIFS_NEGFLAVOR_UNENCAP 1 /* wct == 17, but no ext_sec */ - #define CIFS_NEGFLAVOR_EXTENDED 2 /* wct == 17, ext_sec bit set */ -@@ -1268,6 +1269,7 @@ struct cifs_tcon { - bool use_persistent:1; /* use persistent instead of durable handles */ - bool no_lease:1; /* Do not request leases on files or directories */ - bool use_witness:1; /* use witness protocol */ -+ bool dummy:1; /* dummy tcon used for reconnecting channels */ - __le32 capabilities; - __u32 share_flags; - __u32 maximal_access; -diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c -index 454420aa02220f..8298d1745f9b9c 100644 ---- a/fs/smb/client/connect.c -+++ b/fs/smb/client/connect.c -@@ -677,12 +677,12 @@ server_unresponsive(struct TCP_Server_Info *server) - /* - * If we're in the process of mounting a share or reconnecting a session - * and the server abruptly shut down (e.g. socket wasn't closed, packet -- * had been ACK'ed but no SMB response), don't wait longer than 20s to -- * negotiate protocol. -+ * had been ACK'ed but no SMB response), don't wait longer than 20s from -+ * when negotiate actually started. - */ - spin_lock(&server->srv_lock); - if (server->tcpStatus == CifsInNegotiate && -- time_after(jiffies, server->lstrp + 20 * HZ)) { -+ time_after(jiffies, server->neg_start + 20 * HZ)) { - spin_unlock(&server->srv_lock); - cifs_reconnect(server, false); - return true; -@@ -3998,6 +3998,7 @@ cifs_negotiate_protocol(const unsigned int xid, struct cifs_ses *ses, - - server->lstrp = jiffies; - server->tcpStatus = CifsInNegotiate; -+ server->neg_start = jiffies; - spin_unlock(&server->srv_lock); - - rc = server->ops->negotiate(xid, ses, server); -diff --git a/fs/smb/client/readdir.c b/fs/smb/client/readdir.c -index 222348ae625866..0be16f8acd9af5 100644 ---- a/fs/smb/client/readdir.c -+++ b/fs/smb/client/readdir.c -@@ -263,7 +263,7 @@ cifs_posix_to_fattr(struct cifs_fattr *fattr, struct smb2_posix_info *info, - /* The Mode field in the response can now include the file type as well */ - fattr->cf_mode = wire_mode_to_posix(le32_to_cpu(info->Mode), - fattr->cf_cifsattrs & ATTR_DIRECTORY); -- fattr->cf_dtype = S_DT(le32_to_cpu(info->Mode)); -+ fattr->cf_dtype = S_DT(fattr->cf_mode); - - switch (fattr->cf_mode & S_IFMT) { - case S_IFLNK: -diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c -index e0f58600933059..357abb0170c495 100644 ---- a/fs/smb/client/smb2pdu.c -+++ b/fs/smb/client/smb2pdu.c -@@ -437,9 +437,9 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, - free_xid(xid); - ses->flags &= ~CIFS_SES_FLAGS_PENDING_QUERY_INTERFACES; - -- /* regardless of rc value, setup polling */ -- queue_delayed_work(cifsiod_wq, &tcon->query_interfaces, -- (SMB_INTERFACE_POLL_INTERVAL * HZ)); -+ if (!tcon->ipc && !tcon->dummy) -+ queue_delayed_work(cifsiod_wq, &tcon->query_interfaces, -+ (SMB_INTERFACE_POLL_INTERVAL * HZ)); - - mutex_unlock(&ses->session_mutex); - -@@ -4228,10 +4228,8 @@ void smb2_reconnect_server(struct work_struct *work) - } - goto done; - } -- - tcon->status = TID_GOOD; -- tcon->retry = false; -- tcon->need_reconnect = false; -+ tcon->dummy = true; - - /* now reconnect sessions for necessary channels */ - list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { -diff --git a/fs/smb/client/trace.h b/fs/smb/client/trace.h -index 563cb4d8edf0c3..4dfdc521c5c985 100644 ---- a/fs/smb/client/trace.h -+++ b/fs/smb/client/trace.h -@@ -114,7 +114,7 @@ DECLARE_EVENT_CLASS(smb3_rw_err_class, - __entry->len = len; - __entry->rc = rc; - ), -- TP_printk("\txid=%u sid=0x%llx tid=0x%x fid=0x%llx offset=0x%llx len=0x%x rc=%d", -+ TP_printk("xid=%u sid=0x%llx tid=0x%x fid=0x%llx offset=0x%llx len=0x%x rc=%d", - __entry->xid, __entry->sesid, __entry->tid, __entry->fid, - __entry->offset, __entry->len, __entry->rc) - ) -@@ -247,7 +247,7 @@ DECLARE_EVENT_CLASS(smb3_fd_class, - __entry->tid = tid; - __entry->sesid = sesid; - ), -- TP_printk("\txid=%u sid=0x%llx tid=0x%x fid=0x%llx", -+ TP_printk("xid=%u sid=0x%llx tid=0x%x fid=0x%llx", - __entry->xid, __entry->sesid, __entry->tid, __entry->fid) - ) - -@@ -286,7 +286,7 @@ DECLARE_EVENT_CLASS(smb3_fd_err_class, - __entry->sesid = sesid; - __entry->rc = rc; - ), -- TP_printk("\txid=%u sid=0x%llx tid=0x%x fid=0x%llx rc=%d", -+ TP_printk("xid=%u sid=0x%llx tid=0x%x fid=0x%llx rc=%d", - __entry->xid, __entry->sesid, __entry->tid, __entry->fid, - __entry->rc) - ) -@@ -558,7 +558,7 @@ DECLARE_EVENT_CLASS(smb3_cmd_err_class, - __entry->status = status; - __entry->rc = rc; - ), -- TP_printk("\tsid=0x%llx tid=0x%x cmd=%u mid=%llu status=0x%x rc=%d", -+ TP_printk("sid=0x%llx tid=0x%x cmd=%u mid=%llu status=0x%x rc=%d", - __entry->sesid, __entry->tid, __entry->cmd, __entry->mid, - __entry->status, __entry->rc) - ) -@@ -593,7 +593,7 @@ DECLARE_EVENT_CLASS(smb3_cmd_done_class, - __entry->cmd = cmd; - __entry->mid = mid; - ), -- TP_printk("\tsid=0x%llx tid=0x%x cmd=%u mid=%llu", -+ TP_printk("sid=0x%llx tid=0x%x cmd=%u mid=%llu", - __entry->sesid, __entry->tid, - __entry->cmd, __entry->mid) - ) -@@ -631,7 +631,7 @@ DECLARE_EVENT_CLASS(smb3_mid_class, - __entry->when_sent = when_sent; - __entry->when_received = when_received; - ), -- TP_printk("\tcmd=%u mid=%llu pid=%u, when_sent=%lu when_rcv=%lu", -+ TP_printk("cmd=%u mid=%llu pid=%u, when_sent=%lu when_rcv=%lu", - __entry->cmd, __entry->mid, __entry->pid, __entry->when_sent, - __entry->when_received) - ) -@@ -662,7 +662,7 @@ DECLARE_EVENT_CLASS(smb3_exit_err_class, - __assign_str(func_name, func_name); - __entry->rc = rc; - ), -- TP_printk("\t%s: xid=%u rc=%d", -+ TP_printk("%s: xid=%u rc=%d", - __get_str(func_name), __entry->xid, __entry->rc) - ) - -@@ -688,7 +688,7 @@ DECLARE_EVENT_CLASS(smb3_sync_err_class, - __entry->ino = ino; - __entry->rc = rc; - ), -- TP_printk("\tino=%lu rc=%d", -+ TP_printk("ino=%lu rc=%d", - __entry->ino, __entry->rc) - ) - -@@ -714,7 +714,7 @@ DECLARE_EVENT_CLASS(smb3_enter_exit_class, - __entry->xid = xid; - __assign_str(func_name, func_name); - ), -- TP_printk("\t%s: xid=%u", -+ TP_printk("%s: xid=%u", - __get_str(func_name), __entry->xid) - ) - -diff --git a/include/linux/cpu.h b/include/linux/cpu.h -index 20db7fc0651f3c..6b4f9f16968821 100644 ---- a/include/linux/cpu.h -+++ b/include/linux/cpu.h -@@ -79,6 +79,7 @@ extern ssize_t cpu_show_reg_file_data_sampling(struct device *dev, - struct device_attribute *attr, char *buf); - extern ssize_t cpu_show_indirect_target_selection(struct device *dev, - struct device_attribute *attr, char *buf); -+extern ssize_t cpu_show_tsa(struct device *dev, struct device_attribute *attr, char *buf); - - extern __printf(4, 5) - struct device *cpu_device_create(struct device *parent, void *drvdata, -diff --git a/include/linux/export.h b/include/linux/export.h -index 9911508a9604fb..06f7a4eb649286 100644 ---- a/include/linux/export.h -+++ b/include/linux/export.h -@@ -42,11 +42,17 @@ extern struct module __this_module; - .long sym - #endif - --#define ___EXPORT_SYMBOL(sym, license, ns) \ -+/* -+ * LLVM integrated assembler cam merge adjacent string literals (like -+ * C and GNU-as) passed to '.ascii', but not to '.asciz' and chokes on: -+ * -+ * .asciz "MODULE_" "kvm" ; -+ */ -+#define ___EXPORT_SYMBOL(sym, license, ns...) \ - .section ".export_symbol","a" ASM_NL \ - __export_symbol_##sym: ASM_NL \ - .asciz license ASM_NL \ -- .asciz ns ASM_NL \ -+ .ascii ns "\0" ASM_NL \ - __EXPORT_SYMBOL_REF(sym) ASM_NL \ - .previous - -@@ -88,4 +94,6 @@ extern struct module __this_module; - #define EXPORT_SYMBOL_NS(sym, ns) __EXPORT_SYMBOL(sym, "", __stringify(ns)) - #define EXPORT_SYMBOL_NS_GPL(sym, ns) __EXPORT_SYMBOL(sym, "GPL", __stringify(ns)) - -+#define EXPORT_SYMBOL_GPL_FOR_MODULES(sym, mods) __EXPORT_SYMBOL(sym, "GPL", "module:" mods) -+ - #endif /* _LINUX_EXPORT_H */ -diff --git a/include/linux/fs.h b/include/linux/fs.h -index 81edfa1e66b608..b641a01512fb09 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -3170,6 +3170,8 @@ extern int simple_write_begin(struct file *file, struct address_space *mapping, - extern const struct address_space_operations ram_aops; - extern int always_delete_dentry(const struct dentry *); - extern struct inode *alloc_anon_inode(struct super_block *); -+struct inode *anon_inode_make_secure_inode(struct super_block *sb, const char *name, -+ const struct inode *context_inode); - extern int simple_nosetlease(struct file *, int, struct file_lock **, void **); - extern const struct dentry_operations simple_dentry_operations; - -diff --git a/include/linux/libata.h b/include/linux/libata.h -index 91c4e11cb6abb4..285d709cbbde4d 100644 ---- a/include/linux/libata.h -+++ b/include/linux/libata.h -@@ -1305,7 +1305,7 @@ int ata_acpi_stm(struct ata_port *ap, const struct ata_acpi_gtm *stm); - int ata_acpi_gtm(struct ata_port *ap, struct ata_acpi_gtm *stm); - unsigned int ata_acpi_gtm_xfermask(struct ata_device *dev, - const struct ata_acpi_gtm *gtm); --int ata_acpi_cbl_80wire(struct ata_port *ap, const struct ata_acpi_gtm *gtm); -+int ata_acpi_cbl_pata_type(struct ata_port *ap); - #else - static inline const struct ata_acpi_gtm *ata_acpi_init_gtm(struct ata_port *ap) - { -@@ -1330,10 +1330,9 @@ static inline unsigned int ata_acpi_gtm_xfermask(struct ata_device *dev, - return 0; - } - --static inline int ata_acpi_cbl_80wire(struct ata_port *ap, -- const struct ata_acpi_gtm *gtm) -+static inline int ata_acpi_cbl_pata_type(struct ata_port *ap) - { -- return 0; -+ return ATA_CBL_PATA40; - } - #endif - -diff --git a/include/linux/usb/typec_dp.h b/include/linux/usb/typec_dp.h -index 8d09c2f0a9b807..c3f08af20295ca 100644 ---- a/include/linux/usb/typec_dp.h -+++ b/include/linux/usb/typec_dp.h -@@ -56,6 +56,7 @@ enum { - DP_PIN_ASSIGN_D, - DP_PIN_ASSIGN_E, - DP_PIN_ASSIGN_F, /* Not supported after v1.0b */ -+ DP_PIN_ASSIGN_MAX, - }; - - /* DisplayPort alt mode specific commands */ -diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h -index d63af08c6cdc2b..4f067599e6e9e0 100644 ---- a/include/net/bluetooth/hci_core.h -+++ b/include/net/bluetooth/hci_core.h -@@ -29,6 +29,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -339,6 +340,7 @@ struct adv_monitor { - - struct hci_dev { - struct list_head list; -+ struct srcu_struct srcu; - struct mutex lock; - - struct ida unset_handle_ida; -diff --git a/include/trace/events/f2fs.h b/include/trace/events/f2fs.h -index b6ffae01a8cd86..f2ce7f6da87975 100644 ---- a/include/trace/events/f2fs.h -+++ b/include/trace/events/f2fs.h -@@ -1284,13 +1284,6 @@ DEFINE_EVENT(f2fs__page, f2fs_set_page_dirty, - TP_ARGS(page, type) - ); - --DEFINE_EVENT(f2fs__page, f2fs_vm_page_mkwrite, -- -- TP_PROTO(struct page *page, int type), -- -- TP_ARGS(page, type) --); -- - TRACE_EVENT(f2fs_replace_atomic_write_block, - - TP_PROTO(struct inode *inode, struct inode *cow_inode, pgoff_t index, -@@ -1328,30 +1321,50 @@ TRACE_EVENT(f2fs_replace_atomic_write_block, - __entry->recovery) - ); - --TRACE_EVENT(f2fs_filemap_fault, -+DECLARE_EVENT_CLASS(f2fs_mmap, - -- TP_PROTO(struct inode *inode, pgoff_t index, unsigned long ret), -+ TP_PROTO(struct inode *inode, pgoff_t index, -+ vm_flags_t flags, vm_fault_t ret), - -- TP_ARGS(inode, index, ret), -+ TP_ARGS(inode, index, flags, ret), - - TP_STRUCT__entry( - __field(dev_t, dev) - __field(ino_t, ino) - __field(pgoff_t, index) -- __field(unsigned long, ret) -+ __field(vm_flags_t, flags) -+ __field(vm_fault_t, ret) - ), - - TP_fast_assign( - __entry->dev = inode->i_sb->s_dev; - __entry->ino = inode->i_ino; - __entry->index = index; -+ __entry->flags = flags; - __entry->ret = ret; - ), - -- TP_printk("dev = (%d,%d), ino = %lu, index = %lu, ret = %lx", -+ TP_printk("dev = (%d,%d), ino = %lu, index = %lu, flags: %s, ret: %s", - show_dev_ino(__entry), - (unsigned long)__entry->index, -- __entry->ret) -+ __print_flags(__entry->flags, "|", FAULT_FLAG_TRACE), -+ __print_flags(__entry->ret, "|", VM_FAULT_RESULT_TRACE)) -+); -+ -+DEFINE_EVENT(f2fs_mmap, f2fs_filemap_fault, -+ -+ TP_PROTO(struct inode *inode, pgoff_t index, -+ vm_flags_t flags, vm_fault_t ret), -+ -+ TP_ARGS(inode, index, flags, ret) -+); -+ -+DEFINE_EVENT(f2fs_mmap, f2fs_vm_page_mkwrite, -+ -+ TP_PROTO(struct inode *inode, pgoff_t index, -+ vm_flags_t flags, vm_fault_t ret), -+ -+ TP_ARGS(inode, index, flags, ret) - ); - - TRACE_EVENT(f2fs_writepages, -diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h -index d5aa832f8dba3c..e9db9682316a2a 100644 ---- a/include/ufs/ufshcd.h -+++ b/include/ufs/ufshcd.h -@@ -430,6 +430,7 @@ struct ufs_clk_gating { - * @workq: workqueue to schedule devfreq suspend/resume work - * @suspend_work: worker to suspend devfreq - * @resume_work: worker to resume devfreq -+ * @target_freq: frequency requested by devfreq framework - * @min_gear: lowest HS gear to scale down to - * @is_enabled: tracks if scaling is currently enabled or not, controlled by - * clkscale_enable sysfs node -@@ -449,6 +450,7 @@ struct ufs_clk_scaling { - struct workqueue_struct *workq; - struct work_struct suspend_work; - struct work_struct resume_work; -+ unsigned long target_freq; - u32 min_gear; - bool is_enabled; - bool is_allowed; -@@ -862,6 +864,7 @@ enum ufshcd_mcq_opr { - * @auto_bkops_enabled: to track whether bkops is enabled in device - * @vreg_info: UFS device voltage regulator information - * @clk_list_head: UFS host controller clocks list node head -+ * @use_pm_opp: Indicates whether OPP based scaling is used or not - * @req_abort_count: number of times ufshcd_abort() has been called - * @lanes_per_direction: number of lanes per data direction between the UFS - * controller and the UFS device. -@@ -1014,6 +1017,7 @@ struct ufs_hba { - bool auto_bkops_enabled; - struct ufs_vreg_info vreg_info; - struct list_head clk_list_head; -+ bool use_pm_opp; - - /* Number of requests aborts */ - int req_abort_count; -diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c -index 1fb3b7a0ed5d27..536acebf22b0d0 100644 ---- a/kernel/rcu/tree.c -+++ b/kernel/rcu/tree.c -@@ -2699,6 +2699,10 @@ __call_rcu_common(struct rcu_head *head, rcu_callback_t func, bool lazy_in) - /* Misaligned rcu_head! */ - WARN_ON_ONCE((unsigned long)head & (sizeof(void *) - 1)); - -+ /* Avoid NULL dereference if callback is NULL. */ -+ if (WARN_ON_ONCE(!func)) -+ return; -+ - if (debug_rcu_head_queue(head)) { - /* - * Probable double call_rcu(), so leak the callback. -diff --git a/lib/test_objagg.c b/lib/test_objagg.c -index c0c957c5063541..c0f7bb53db8d5c 100644 ---- a/lib/test_objagg.c -+++ b/lib/test_objagg.c -@@ -899,8 +899,10 @@ static int check_expect_hints_stats(struct objagg_hints *objagg_hints, - int err; - - stats = objagg_hints_stats_get(objagg_hints); -- if (IS_ERR(stats)) -+ if (IS_ERR(stats)) { -+ *errmsg = "objagg_hints_stats_get() failed."; - return PTR_ERR(stats); -+ } - err = __check_expect_stats(stats, expect_stats, errmsg); - objagg_stats_put(stats); - return err; -diff --git a/mm/secretmem.c b/mm/secretmem.c -index 399552814fd0ff..4bedf491a8a742 100644 ---- a/mm/secretmem.c -+++ b/mm/secretmem.c -@@ -195,19 +195,10 @@ static struct file *secretmem_file_create(unsigned long flags) - struct file *file; - struct inode *inode; - const char *anon_name = "[secretmem]"; -- const struct qstr qname = QSTR_INIT(anon_name, strlen(anon_name)); -- int err; - -- inode = alloc_anon_inode(secretmem_mnt->mnt_sb); -+ inode = anon_inode_make_secure_inode(secretmem_mnt->mnt_sb, anon_name, NULL); - if (IS_ERR(inode)) - return ERR_CAST(inode); -- -- err = security_inode_init_security_anon(inode, &qname, NULL); -- if (err) { -- file = ERR_PTR(err); -- goto err_free_inode; -- } -- - file = alloc_file_pseudo(inode, secretmem_mnt, "secretmem", - O_RDWR, &secretmem_fops); - if (IS_ERR(file)) -diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c -index 32f7bd0e891689..824208a53c251e 100644 ---- a/net/bluetooth/hci_core.c -+++ b/net/bluetooth/hci_core.c -@@ -65,7 +65,7 @@ static DEFINE_IDA(hci_index_ida); - - /* Get HCI device by index. - * Device is held on return. */ --struct hci_dev *hci_dev_get(int index) -+static struct hci_dev *__hci_dev_get(int index, int *srcu_index) - { - struct hci_dev *hdev = NULL, *d; - -@@ -78,6 +78,8 @@ struct hci_dev *hci_dev_get(int index) - list_for_each_entry(d, &hci_dev_list, list) { - if (d->id == index) { - hdev = hci_dev_hold(d); -+ if (srcu_index) -+ *srcu_index = srcu_read_lock(&d->srcu); - break; - } - } -@@ -85,6 +87,22 @@ struct hci_dev *hci_dev_get(int index) - return hdev; - } - -+struct hci_dev *hci_dev_get(int index) -+{ -+ return __hci_dev_get(index, NULL); -+} -+ -+static struct hci_dev *hci_dev_get_srcu(int index, int *srcu_index) -+{ -+ return __hci_dev_get(index, srcu_index); -+} -+ -+static void hci_dev_put_srcu(struct hci_dev *hdev, int srcu_index) -+{ -+ srcu_read_unlock(&hdev->srcu, srcu_index); -+ hci_dev_put(hdev); -+} -+ - /* ---- Inquiry support ---- */ - - bool hci_discovery_active(struct hci_dev *hdev) -@@ -590,9 +608,9 @@ static int hci_dev_do_reset(struct hci_dev *hdev) - int hci_dev_reset(__u16 dev) - { - struct hci_dev *hdev; -- int err; -+ int err, srcu_index; - -- hdev = hci_dev_get(dev); -+ hdev = hci_dev_get_srcu(dev, &srcu_index); - if (!hdev) - return -ENODEV; - -@@ -614,7 +632,7 @@ int hci_dev_reset(__u16 dev) - err = hci_dev_do_reset(hdev); - - done: -- hci_dev_put(hdev); -+ hci_dev_put_srcu(hdev, srcu_index); - return err; - } - -@@ -2424,6 +2442,11 @@ struct hci_dev *hci_alloc_dev_priv(int sizeof_priv) - if (!hdev) - return NULL; - -+ if (init_srcu_struct(&hdev->srcu)) { -+ kfree(hdev); -+ return NULL; -+ } -+ - hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1); - hdev->esco_type = (ESCO_HV1); - hdev->link_mode = (HCI_LM_ACCEPT); -@@ -2670,6 +2693,9 @@ void hci_unregister_dev(struct hci_dev *hdev) - list_del(&hdev->list); - write_unlock(&hci_dev_list_lock); - -+ synchronize_srcu(&hdev->srcu); -+ cleanup_srcu_struct(&hdev->srcu); -+ - cancel_work_sync(&hdev->rx_work); - cancel_work_sync(&hdev->cmd_work); - cancel_work_sync(&hdev->tx_work); -diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c -index e92bc4ceb5adda..d602e9d8eff450 100644 ---- a/net/bluetooth/hci_sync.c -+++ b/net/bluetooth/hci_sync.c -@@ -2010,13 +2010,10 @@ static int hci_clear_adv_sets_sync(struct hci_dev *hdev, struct sock *sk) - static int hci_clear_adv_sync(struct hci_dev *hdev, struct sock *sk, bool force) - { - struct adv_info *adv, *n; -- int err = 0; - - if (ext_adv_capable(hdev)) - /* Remove all existing sets */ -- err = hci_clear_adv_sets_sync(hdev, sk); -- if (ext_adv_capable(hdev)) -- return err; -+ return hci_clear_adv_sets_sync(hdev, sk); - - /* This is safe as long as there is no command send while the lock is - * held. -@@ -2044,13 +2041,11 @@ static int hci_clear_adv_sync(struct hci_dev *hdev, struct sock *sk, bool force) - static int hci_remove_adv_sync(struct hci_dev *hdev, u8 instance, - struct sock *sk) - { -- int err = 0; -+ int err; - - /* If we use extended advertising, instance has to be removed first. */ - if (ext_adv_capable(hdev)) -- err = hci_remove_ext_adv_instance_sync(hdev, instance, sk); -- if (ext_adv_capable(hdev)) -- return err; -+ return hci_remove_ext_adv_instance_sync(hdev, instance, sk); - - /* This is safe as long as there is no command send while the lock is - * held. -@@ -2149,16 +2144,13 @@ int hci_read_tx_power_sync(struct hci_dev *hdev, __le16 handle, u8 type) - int hci_disable_advertising_sync(struct hci_dev *hdev) - { - u8 enable = 0x00; -- int err = 0; - - /* If controller is not advertising we are done. */ - if (!hci_dev_test_flag(hdev, HCI_LE_ADV)) - return 0; - - if (ext_adv_capable(hdev)) -- err = hci_disable_ext_adv_instance_sync(hdev, 0x00); -- if (ext_adv_capable(hdev)) -- return err; -+ return hci_disable_ext_adv_instance_sync(hdev, 0x00); - - return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_ENABLE, - sizeof(enable), &enable, HCI_CMD_TIMEOUT); -@@ -2526,6 +2518,10 @@ static int hci_pause_advertising_sync(struct hci_dev *hdev) - int err; - int old_state; - -+ /* If controller is not advertising we are done. */ -+ if (!hci_dev_test_flag(hdev, HCI_LE_ADV)) -+ return 0; -+ - /* If already been paused there is nothing to do. */ - if (hdev->advertising_paused) - return 0; -diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c -index 853d217cabc917..82fa8c28438f25 100644 ---- a/net/bluetooth/mgmt.c -+++ b/net/bluetooth/mgmt.c -@@ -1074,7 +1074,8 @@ static int mesh_send_done_sync(struct hci_dev *hdev, void *data) - struct mgmt_mesh_tx *mesh_tx; - - hci_dev_clear_flag(hdev, HCI_MESH_SENDING); -- hci_disable_advertising_sync(hdev); -+ if (list_empty(&hdev->adv_instances)) -+ hci_disable_advertising_sync(hdev); - mesh_tx = mgmt_mesh_next(hdev, NULL); - - if (mesh_tx) -@@ -2140,6 +2141,9 @@ static int set_mesh_sync(struct hci_dev *hdev, void *data) - else - hci_dev_clear_flag(hdev, HCI_MESH); - -+ hdev->le_scan_interval = __le16_to_cpu(cp->period); -+ hdev->le_scan_window = __le16_to_cpu(cp->window); -+ - len -= sizeof(*cp); - - /* If filters don't fit, forward all adv pkts */ -@@ -2154,6 +2158,7 @@ static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) - { - struct mgmt_cp_set_mesh *cp = data; - struct mgmt_pending_cmd *cmd; -+ __u16 period, window; - int err = 0; - - bt_dev_dbg(hdev, "sock %p", sk); -@@ -2167,6 +2172,23 @@ static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) - return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, - MGMT_STATUS_INVALID_PARAMS); - -+ /* Keep allowed ranges in sync with set_scan_params() */ -+ period = __le16_to_cpu(cp->period); -+ -+ if (period < 0x0004 || period > 0x4000) -+ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, -+ MGMT_STATUS_INVALID_PARAMS); -+ -+ window = __le16_to_cpu(cp->window); -+ -+ if (window < 0x0004 || window > 0x4000) -+ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, -+ MGMT_STATUS_INVALID_PARAMS); -+ -+ if (window > period) -+ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, -+ MGMT_STATUS_INVALID_PARAMS); -+ - hci_dev_lock(hdev); - - cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len); -@@ -6529,6 +6551,7 @@ static int set_scan_params(struct sock *sk, struct hci_dev *hdev, - return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, - MGMT_STATUS_NOT_SUPPORTED); - -+ /* Keep allowed ranges in sync with set_mesh() */ - interval = __le16_to_cpu(cp->interval); - - if (interval < 0x0004 || interval > 0x4000) -diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c -index 68952752b5990f..31c4f112345ea4 100644 ---- a/net/mac80211/chan.c -+++ b/net/mac80211/chan.c -@@ -89,11 +89,11 @@ ieee80211_chanctx_reserved_chandef(struct ieee80211_local *local, - - lockdep_assert_held(&local->chanctx_mtx); - -+ if (WARN_ON(!compat)) -+ return NULL; -+ - list_for_each_entry(link, &ctx->reserved_links, - reserved_chanctx_list) { -- if (!compat) -- compat = &link->reserved_chandef; -- - compat = cfg80211_chandef_compatible(&link->reserved_chandef, - compat); - if (!compat) -diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h -index 04c876d78d3bf0..44aad3394084bd 100644 ---- a/net/mac80211/ieee80211_i.h -+++ b/net/mac80211/ieee80211_i.h -@@ -1186,6 +1186,15 @@ ieee80211_vif_get_shift(struct ieee80211_vif *vif) - return shift; - } - -+#define for_each_link_data(sdata, __link) \ -+ struct ieee80211_sub_if_data *__sdata = sdata; \ -+ for (int __link_id = 0; \ -+ __link_id < ARRAY_SIZE((__sdata)->link); __link_id++) \ -+ if ((!(__sdata)->vif.valid_links || \ -+ (__sdata)->vif.valid_links & BIT(__link_id)) && \ -+ ((__link) = sdata_dereference((__sdata)->link[__link_id], \ -+ (__sdata)))) -+ - static inline int - ieee80211_get_mbssid_beacon_len(struct cfg80211_mbssid_elems *elems, - struct cfg80211_rnr_elems *rnr_elems, -diff --git a/net/mac80211/link.c b/net/mac80211/link.c -index 16cbaea93fc32d..af4d2b2e9a26f8 100644 ---- a/net/mac80211/link.c -+++ b/net/mac80211/link.c -@@ -28,8 +28,16 @@ void ieee80211_link_init(struct ieee80211_sub_if_data *sdata, - if (link_id < 0) - link_id = 0; - -- rcu_assign_pointer(sdata->vif.link_conf[link_id], link_conf); -- rcu_assign_pointer(sdata->link[link_id], link); -+ if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) { -+ struct ieee80211_sub_if_data *ap_bss; -+ struct ieee80211_bss_conf *ap_bss_conf; -+ -+ ap_bss = container_of(sdata->bss, -+ struct ieee80211_sub_if_data, u.ap); -+ ap_bss_conf = sdata_dereference(ap_bss->vif.link_conf[link_id], -+ ap_bss); -+ memcpy(link_conf, ap_bss_conf, sizeof(*link_conf)); -+ } - - link->sdata = sdata; - link->link_id = link_id; -@@ -65,6 +73,9 @@ void ieee80211_link_init(struct ieee80211_sub_if_data *sdata, - - ieee80211_link_debugfs_add(link); - } -+ -+ rcu_assign_pointer(sdata->vif.link_conf[link_id], link_conf); -+ rcu_assign_pointer(sdata->link[link_id], link); - } - - void ieee80211_link_stop(struct ieee80211_link_data *link) -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index 5eb233f619817b..58665b6ae6354b 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -4419,6 +4419,10 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) - if (!multicast && - !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1)) - return false; -+ /* reject invalid/our STA address */ -+ if (!is_valid_ether_addr(hdr->addr2) || -+ ether_addr_equal(sdata->dev->dev_addr, hdr->addr2)) -+ return false; - if (!rx->sta) { - int rate_idx; - if (status->encoding != RX_ENC_LEGACY) -diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c -index fee772b4637c88..a7054546f52dfa 100644 ---- a/net/rose/rose_route.c -+++ b/net/rose/rose_route.c -@@ -497,22 +497,15 @@ void rose_rt_device_down(struct net_device *dev) - t = rose_node; - rose_node = rose_node->next; - -- for (i = 0; i < t->count; i++) { -+ for (i = t->count - 1; i >= 0; i--) { - if (t->neighbour[i] != s) - continue; - - t->count--; - -- switch (i) { -- case 0: -- t->neighbour[0] = t->neighbour[1]; -- fallthrough; -- case 1: -- t->neighbour[1] = t->neighbour[2]; -- break; -- case 2: -- break; -- } -+ memmove(&t->neighbour[i], &t->neighbour[i + 1], -+ sizeof(t->neighbour[0]) * -+ (t->count - i)); - } - - if (t->count <= 0) -diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c -index df89790c459ad6..282423106f15d9 100644 ---- a/net/sched/sch_api.c -+++ b/net/sched/sch_api.c -@@ -779,15 +779,12 @@ static u32 qdisc_alloc_handle(struct net_device *dev) - - void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len) - { -- bool qdisc_is_offloaded = sch->flags & TCQ_F_OFFLOADED; - const struct Qdisc_class_ops *cops; - unsigned long cl; - u32 parentid; - bool notify; - int drops; - -- if (n == 0 && len == 0) -- return; - drops = max_t(int, n, 0); - rcu_read_lock(); - while ((parentid = sch->parent)) { -@@ -796,17 +793,8 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len) - - if (sch->flags & TCQ_F_NOPARENT) - break; -- /* Notify parent qdisc only if child qdisc becomes empty. -- * -- * If child was empty even before update then backlog -- * counter is screwed and we skip notification because -- * parent class is already passive. -- * -- * If the original child was offloaded then it is allowed -- * to be seem as empty, so the parent is notified anyway. -- */ -- notify = !sch->q.qlen && !WARN_ON_ONCE(!n && -- !qdisc_is_offloaded); -+ /* Notify parent qdisc only if child qdisc becomes empty. */ -+ notify = !sch->q.qlen; - /* TODO: perform the search on a per txq basis */ - sch = qdisc_lookup_rcu(qdisc_dev(sch), TC_H_MAJ(parentid)); - if (sch == NULL) { -@@ -815,6 +803,9 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len) - } - cops = sch->ops->cl_ops; - if (notify && cops->qlen_notify) { -+ /* Note that qlen_notify must be idempotent as it may get called -+ * multiple times. -+ */ - cl = cops->find(sch, parentid); - cops->qlen_notify(sch, cl); - } -diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c -index b370070194fa4a..7eccd6708d6649 100644 ---- a/net/vmw_vsock/vmci_transport.c -+++ b/net/vmw_vsock/vmci_transport.c -@@ -119,6 +119,8 @@ vmci_transport_packet_init(struct vmci_transport_packet *pkt, - u16 proto, - struct vmci_handle handle) - { -+ memset(pkt, 0, sizeof(*pkt)); -+ - /* We register the stream control handler as an any cid handle so we - * must always send from a source address of VMADDR_CID_ANY - */ -@@ -131,8 +133,6 @@ vmci_transport_packet_init(struct vmci_transport_packet *pkt, - pkt->type = type; - pkt->src_port = src->svm_port; - pkt->dst_port = dst->svm_port; -- memset(&pkt->proto, 0, sizeof(pkt->proto)); -- memset(&pkt->_reserved2, 0, sizeof(pkt->_reserved2)); - - switch (pkt->type) { - case VMCI_TRANSPORT_PACKET_TYPE_INVALID: -diff --git a/sound/isa/sb/sb16_main.c b/sound/isa/sb/sb16_main.c -index a9b87e159b2d11..1497a7822eee68 100644 ---- a/sound/isa/sb/sb16_main.c -+++ b/sound/isa/sb/sb16_main.c -@@ -703,6 +703,9 @@ static int snd_sb16_dma_control_put(struct snd_kcontrol *kcontrol, struct snd_ct - unsigned char nval, oval; - int change; - -+ if (chip->mode & (SB_MODE_PLAYBACK | SB_MODE_CAPTURE)) -+ return -EBUSY; -+ - nval = ucontrol->value.enumerated.item[0]; - if (nval > 2) - return -EINVAL; -@@ -711,6 +714,10 @@ static int snd_sb16_dma_control_put(struct snd_kcontrol *kcontrol, struct snd_ct - change = nval != oval; - snd_sb16_set_dma_mode(chip, nval); - spin_unlock_irqrestore(&chip->reg_lock, flags); -+ if (change) { -+ snd_dma_disable(chip->dma8); -+ snd_dma_disable(chip->dma16); -+ } - return change; - } - -diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c -index 40e2b5a87916a8..429e61d47ffbbe 100644 ---- a/sound/soc/amd/yc/acp6x-mach.c -+++ b/sound/soc/amd/yc/acp6x-mach.c -@@ -451,6 +451,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "Bravo 17 D7VEK"), - } - }, -+ { -+ .driver_data = &acp6x_card, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "Micro-Star International Co., Ltd."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Bravo 17 D7VF"), -+ } -+ }, - { - .driver_data = &acp6x_card, - .matches = { -@@ -514,6 +521,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "OMEN by HP Gaming Laptop 16z-n000"), - } - }, -+ { -+ .driver_data = &acp6x_card, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "HP"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Victus by HP Gaming Laptop 15-fb2xxx"), -+ } -+ }, - { - .driver_data = &acp6x_card, - .matches = { diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.097-098.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.097-098.patch deleted file mode 100644 index b76fa95cab..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.097-098.patch +++ /dev/null @@ -1,25 +0,0 @@ -diff --git a/Makefile b/Makefile -index 9d5c08363637bd..0bb5c23c640616 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 97 -+SUBLEVEL = 98 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c -index 1180689a239037..f6690df70b43ea 100644 ---- a/arch/x86/kernel/cpu/amd.c -+++ b/arch/x86/kernel/cpu/amd.c -@@ -547,6 +547,7 @@ static bool amd_check_tsa_microcode(void) - - p.ext_fam = c->x86 - 0xf; - p.model = c->x86_model; -+ p.ext_model = c->x86_model >> 4; - p.stepping = c->x86_stepping; - - if (cpu_has(c, X86_FEATURE_ZEN3) || diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.098-099.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.098-099.patch deleted file mode 100644 index 70b2d97d1f..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.098-099.patch +++ /dev/null @@ -1,6062 +0,0 @@ -diff --git a/Documentation/bpf/map_hash.rst b/Documentation/bpf/map_hash.rst -index d2343952f2cbd3..8606bf958a8cf0 100644 ---- a/Documentation/bpf/map_hash.rst -+++ b/Documentation/bpf/map_hash.rst -@@ -233,10 +233,16 @@ attempts in order to enforce the LRU property which have increasing impacts on - other CPUs involved in the following operation attempts: - - - Attempt to use CPU-local state to batch operations --- Attempt to fetch free nodes from global lists -+- Attempt to fetch ``target_free`` free nodes from global lists - - Attempt to pull any node from a global list and remove it from the hashmap - - Attempt to pull any node from any CPU's list and remove it from the hashmap - -+The number of nodes to borrow from the global list in a batch, ``target_free``, -+depends on the size of the map. Larger batch size reduces lock contention, but -+may also exhaust the global structure. The value is computed at map init to -+avoid exhaustion, by limiting aggregate reservation by all CPUs to half the map -+size. With a minimum of a single element and maximum budget of 128 at a time. -+ - This algorithm is described visually in the following diagram. See the - description in commit 3a08c2fd7634 ("bpf: LRU List") for a full explanation of - the corresponding operations: -diff --git a/Documentation/bpf/map_lru_hash_update.dot b/Documentation/bpf/map_lru_hash_update.dot -index a0fee349d29c27..ab10058f5b79f5 100644 ---- a/Documentation/bpf/map_lru_hash_update.dot -+++ b/Documentation/bpf/map_lru_hash_update.dot -@@ -35,18 +35,18 @@ digraph { - fn_bpf_lru_list_pop_free_to_local [shape=rectangle,fillcolor=2, - label="Flush local pending, - Rotate Global list, move -- LOCAL_FREE_TARGET -+ target_free - from global -> local"] - // Also corresponds to: - // fn__local_list_flush() - // fn_bpf_lru_list_rotate() - fn___bpf_lru_node_move_to_free[shape=diamond,fillcolor=2, -- label="Able to free\nLOCAL_FREE_TARGET\nnodes?"] -+ label="Able to free\ntarget_free\nnodes?"] - - fn___bpf_lru_list_shrink_inactive [shape=rectangle,fillcolor=3, - label="Shrink inactive list - up to remaining -- LOCAL_FREE_TARGET -+ target_free - (global LRU -> local)"] - fn___bpf_lru_list_shrink [shape=diamond,fillcolor=2, - label="> 0 entries in\nlocal free list?"] -diff --git a/Makefile b/Makefile -index 0bb5c23c640616..2aede51d98ea36 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 98 -+SUBLEVEL = 99 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c -index 2baa8d4a33ed3d..1a068859a41850 100644 ---- a/arch/um/drivers/vector_kern.c -+++ b/arch/um/drivers/vector_kern.c -@@ -1600,35 +1600,19 @@ static void vector_eth_configure( - - device->dev = dev; - -- *vp = ((struct vector_private) -- { -- .list = LIST_HEAD_INIT(vp->list), -- .dev = dev, -- .unit = n, -- .options = get_transport_options(def), -- .rx_irq = 0, -- .tx_irq = 0, -- .parsed = def, -- .max_packet = get_mtu(def) + ETH_HEADER_OTHER, -- /* TODO - we need to calculate headroom so that ip header -- * is 16 byte aligned all the time -- */ -- .headroom = get_headroom(def), -- .form_header = NULL, -- .verify_header = NULL, -- .header_rxbuffer = NULL, -- .header_txbuffer = NULL, -- .header_size = 0, -- .rx_header_size = 0, -- .rexmit_scheduled = false, -- .opened = false, -- .transport_data = NULL, -- .in_write_poll = false, -- .coalesce = 2, -- .req_size = get_req_size(def), -- .in_error = false, -- .bpf = NULL -- }); -+ INIT_LIST_HEAD(&vp->list); -+ vp->dev = dev; -+ vp->unit = n; -+ vp->options = get_transport_options(def); -+ vp->parsed = def; -+ vp->max_packet = get_mtu(def) + ETH_HEADER_OTHER; -+ /* -+ * TODO - we need to calculate headroom so that ip header -+ * is 16 byte aligned all the time -+ */ -+ vp->headroom = get_headroom(def); -+ vp->coalesce = 2; -+ vp->req_size = get_req_size(def); - - dev->features = dev->hw_features = (NETIF_F_SG | NETIF_F_FRAGLIST); - INIT_WORK(&vp->reset_tx, vector_reset_tx); -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index caa6adcedc18dd..2b5b7d9a24e98c 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -128,7 +128,7 @@ config X86 - select ARCH_WANTS_DYNAMIC_TASK_STRUCT - select ARCH_WANTS_NO_INSTR - select ARCH_WANT_GENERAL_HUGETLB -- select ARCH_WANT_HUGE_PMD_SHARE -+ select ARCH_WANT_HUGE_PMD_SHARE if X86_64 - select ARCH_WANT_LD_ORPHAN_WARN - select ARCH_WANT_OPTIMIZE_DAX_VMEMMAP if X86_64 - select ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP if X86_64 -diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h -index 9fbad4cb971bff..03385545758159 100644 ---- a/arch/x86/include/asm/msr-index.h -+++ b/arch/x86/include/asm/msr-index.h -@@ -575,6 +575,7 @@ - #define MSR_AMD64_OSVW_STATUS 0xc0010141 - #define MSR_AMD_PPIN_CTL 0xc00102f0 - #define MSR_AMD_PPIN 0xc00102f1 -+#define MSR_AMD64_CPUID_FN_7 0xc0011002 - #define MSR_AMD64_CPUID_FN_1 0xc0011004 - #define MSR_AMD64_LS_CFG 0xc0011020 - #define MSR_AMD64_DC_CFG 0xc0011022 -diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c -index f6690df70b43ea..5fcdfbb792bd9f 100644 ---- a/arch/x86/kernel/cpu/amd.c -+++ b/arch/x86/kernel/cpu/amd.c -@@ -1154,6 +1154,13 @@ static void init_amd_zen2(struct cpuinfo_x86 *c) - { - fix_erratum_1386(c); - zen2_zenbleed_check(c); -+ -+ /* Disable RDSEED on AMD Cyan Skillfish because of an error. */ -+ if (c->x86_model == 0x47 && c->x86_stepping == 0x0) { -+ clear_cpu_cap(c, X86_FEATURE_RDSEED); -+ msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18); -+ pr_emerg("RDSEED is not reliable on this platform; disabling.\n"); -+ } - } - - static void init_amd_zen3(struct cpuinfo_x86 *c) -diff --git a/arch/x86/kernel/cpu/mce/amd.c b/arch/x86/kernel/cpu/mce/amd.c -index c267f43de39eab..b89c5a38540341 100644 ---- a/arch/x86/kernel/cpu/mce/amd.c -+++ b/arch/x86/kernel/cpu/mce/amd.c -@@ -335,7 +335,6 @@ static void smca_configure(unsigned int bank, unsigned int cpu) - - struct thresh_restart { - struct threshold_block *b; -- int reset; - int set_lvt_off; - int lvt_off; - u16 old_limit; -@@ -430,13 +429,13 @@ static void threshold_restart_bank(void *_tr) - - rdmsr(tr->b->address, lo, hi); - -- if (tr->b->threshold_limit < (hi & THRESHOLD_MAX)) -- tr->reset = 1; /* limit cannot be lower than err count */ -- -- if (tr->reset) { /* reset err count and overflow bit */ -- hi = -- (hi & ~(MASK_ERR_COUNT_HI | MASK_OVERFLOW_HI)) | -- (THRESHOLD_MAX - tr->b->threshold_limit); -+ /* -+ * Reset error count and overflow bit. -+ * This is done during init or after handling an interrupt. -+ */ -+ if (hi & MASK_OVERFLOW_HI || tr->set_lvt_off) { -+ hi &= ~(MASK_ERR_COUNT_HI | MASK_OVERFLOW_HI); -+ hi |= THRESHOLD_MAX - tr->b->threshold_limit; - } else if (tr->old_limit) { /* change limit w/o reset */ - int new_count = (hi & THRESHOLD_MAX) + - (tr->old_limit - tr->b->threshold_limit); -@@ -1049,13 +1048,20 @@ static const char *get_name(unsigned int cpu, unsigned int bank, struct threshol - } - - bank_type = smca_get_bank_type(cpu, bank); -- if (bank_type >= N_SMCA_BANK_TYPES) -- return NULL; - - if (b && (bank_type == SMCA_UMC || bank_type == SMCA_UMC_V2)) { - if (b->block < ARRAY_SIZE(smca_umc_block_names)) - return smca_umc_block_names[b->block]; -- return NULL; -+ } -+ -+ if (b && b->block) { -+ snprintf(buf_mcatype, MAX_MCATYPE_NAME_LEN, "th_block_%u", b->block); -+ return buf_mcatype; -+ } -+ -+ if (bank_type >= N_SMCA_BANK_TYPES) { -+ snprintf(buf_mcatype, MAX_MCATYPE_NAME_LEN, "th_bank_%u", bank); -+ return buf_mcatype; - } - - if (per_cpu(smca_bank_counts, cpu)[bank_type] == 1) -diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c -index e103c227acd3ae..106436ec3c005e 100644 ---- a/arch/x86/kernel/cpu/mce/core.c -+++ b/arch/x86/kernel/cpu/mce/core.c -@@ -2704,15 +2704,9 @@ static int mce_cpu_dead(unsigned int cpu) - static int mce_cpu_online(unsigned int cpu) - { - struct timer_list *t = this_cpu_ptr(&mce_timer); -- int ret; - - mce_device_create(cpu); -- -- ret = mce_threshold_create_device(cpu); -- if (ret) { -- mce_device_remove(cpu); -- return ret; -- } -+ mce_threshold_create_device(cpu); - mce_reenable_cpu(); - mce_start_timer(t); - return 0; -diff --git a/arch/x86/kernel/cpu/mce/intel.c b/arch/x86/kernel/cpu/mce/intel.c -index f5323551c1a9a9..0a9ce4f8a88cf5 100644 ---- a/arch/x86/kernel/cpu/mce/intel.c -+++ b/arch/x86/kernel/cpu/mce/intel.c -@@ -517,6 +517,7 @@ void mce_intel_feature_init(struct cpuinfo_x86 *c) - void mce_intel_feature_clear(struct cpuinfo_x86 *c) - { - intel_clear_lmce(); -+ cmci_clear(); - } - - bool intel_filter_mce(struct mce *m) -diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c -index 99e72b8a96ac0b..67c01bd332f6f0 100644 ---- a/arch/x86/kvm/svm/sev.c -+++ b/arch/x86/kvm/svm/sev.c -@@ -1782,6 +1782,10 @@ static int sev_check_source_vcpus(struct kvm *dst, struct kvm *src) - struct kvm_vcpu *src_vcpu; - unsigned long i; - -+ if (src->created_vcpus != atomic_read(&src->online_vcpus) || -+ dst->created_vcpus != atomic_read(&dst->online_vcpus)) -+ return -EBUSY; -+ - if (!sev_es_guest(src)) - return 0; - -diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c -index 0ea6016ad132a2..c4a158758cb740 100644 ---- a/arch/x86/kvm/xen.c -+++ b/arch/x86/kvm/xen.c -@@ -1737,8 +1737,19 @@ int kvm_xen_setup_evtchn(struct kvm *kvm, - { - struct kvm_vcpu *vcpu; - -- if (ue->u.xen_evtchn.port >= max_evtchn_port(kvm)) -- return -EINVAL; -+ /* -+ * Don't check for the port being within range of max_evtchn_port(). -+ * Userspace can configure what ever targets it likes; events just won't -+ * be delivered if/while the target is invalid, just like userspace can -+ * configure MSIs which target non-existent APICs. -+ * -+ * This allow on Live Migration and Live Update, the IRQ routing table -+ * can be restored *independently* of other things like creating vCPUs, -+ * without imposing an ordering dependency on userspace. In this -+ * particular case, the problematic ordering would be with setting the -+ * Xen 'long mode' flag, which changes max_evtchn_port() to allow 4096 -+ * instead of 1024 event channels. -+ */ - - /* We only support 2 level event channels for now */ - if (ue->u.xen_evtchn.priority != KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL) -diff --git a/crypto/ecc.c b/crypto/ecc.c -index 21504280aca2e5..27fcecf3a61fb1 100644 ---- a/crypto/ecc.c -+++ b/crypto/ecc.c -@@ -69,7 +69,7 @@ EXPORT_SYMBOL(ecc_get_curve); - void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes, - u64 *out, unsigned int ndigits) - { -- int diff = ndigits - DIV_ROUND_UP(nbytes, sizeof(u64)); -+ int diff = ndigits - DIV_ROUND_UP_POW2(nbytes, sizeof(u64)); - unsigned int o = nbytes & 7; - __be64 msd = 0; - -diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c -index cd3cbb7a36f855..e3cbaf3c3bbc15 100644 ---- a/drivers/acpi/battery.c -+++ b/drivers/acpi/battery.c -@@ -243,23 +243,10 @@ static int acpi_battery_get_property(struct power_supply *psy, - break; - case POWER_SUPPLY_PROP_CURRENT_NOW: - case POWER_SUPPLY_PROP_POWER_NOW: -- if (battery->rate_now == ACPI_BATTERY_VALUE_UNKNOWN) { -+ if (battery->rate_now == ACPI_BATTERY_VALUE_UNKNOWN) - ret = -ENODEV; -- break; -- } -- -- val->intval = battery->rate_now * 1000; -- /* -- * When discharging, the current should be reported as a -- * negative number as per the power supply class interface -- * definition. -- */ -- if (psp == POWER_SUPPLY_PROP_CURRENT_NOW && -- (battery->state & ACPI_BATTERY_STATE_DISCHARGING) && -- acpi_battery_handle_discharging(battery) -- == POWER_SUPPLY_STATUS_DISCHARGING) -- val->intval = -val->intval; -- -+ else -+ val->intval = battery->rate_now * 1000; - break; - case POWER_SUPPLY_PROP_CHARGE_FULL_DESIGN: - case POWER_SUPPLY_PROP_ENERGY_FULL_DESIGN: -diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c -index a876024d8a05f9..63d41320cd5cf0 100644 ---- a/drivers/atm/idt77252.c -+++ b/drivers/atm/idt77252.c -@@ -852,6 +852,8 @@ queue_skb(struct idt77252_dev *card, struct vc_map *vc, - - IDT77252_PRV_PADDR(skb) = dma_map_single(&card->pcidev->dev, skb->data, - skb->len, DMA_TO_DEVICE); -+ if (dma_mapping_error(&card->pcidev->dev, IDT77252_PRV_PADDR(skb))) -+ return -ENOMEM; - - error = -EINVAL; - -@@ -1857,6 +1859,8 @@ add_rx_skb(struct idt77252_dev *card, int queue, - paddr = dma_map_single(&card->pcidev->dev, skb->data, - skb_end_pointer(skb) - skb->data, - DMA_FROM_DEVICE); -+ if (dma_mapping_error(&card->pcidev->dev, paddr)) -+ goto outpoolrm; - IDT77252_PRV_PADDR(skb) = paddr; - - if (push_rx_skb(card, skb, queue)) { -@@ -1871,6 +1875,7 @@ add_rx_skb(struct idt77252_dev *card, int queue, - dma_unmap_single(&card->pcidev->dev, IDT77252_PRV_PADDR(skb), - skb_end_pointer(skb) - skb->data, DMA_FROM_DEVICE); - -+outpoolrm: - handle = IDT77252_PRV_POOL(skb); - card->sbpool[POOL_QUEUE(handle)].skb[POOL_INDEX(handle)] = NULL; - -diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c -index 2203686156bfe0..3742ddf46c55ae 100644 ---- a/drivers/block/nbd.c -+++ b/drivers/block/nbd.c -@@ -2120,9 +2120,7 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info) - goto out; - } - } -- ret = nbd_start_device(nbd); -- if (ret) -- goto out; -+ - if (info->attrs[NBD_ATTR_BACKEND_IDENTIFIER]) { - nbd->backend = nla_strdup(info->attrs[NBD_ATTR_BACKEND_IDENTIFIER], - GFP_KERNEL); -@@ -2138,6 +2136,8 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info) - goto out; - } - set_bit(NBD_RT_HAS_BACKEND_FILE, &config->runtime_flags); -+ -+ ret = nbd_start_device(nbd); - out: - mutex_unlock(&nbd->config_lock); - if (!ret) { -diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c -index df3e5aab4b5ac9..8c873a8e39cd93 100644 ---- a/drivers/block/ublk_drv.c -+++ b/drivers/block/ublk_drv.c -@@ -2323,7 +2323,8 @@ static int ublk_ctrl_add_dev(struct io_uring_cmd *cmd) - if (copy_from_user(&info, argp, sizeof(info))) - return -EFAULT; - -- if (info.queue_depth > UBLK_MAX_QUEUE_DEPTH || info.nr_hw_queues > UBLK_MAX_NR_QUEUES) -+ if (info.queue_depth > UBLK_MAX_QUEUE_DEPTH || !info.queue_depth || -+ info.nr_hw_queues > UBLK_MAX_NR_QUEUES || !info.nr_hw_queues) - return -EINVAL; - - if (capable(CAP_SYS_ADMIN)) -diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c -index 186f1fee753403..db8f1dadaa9f4f 100644 ---- a/drivers/char/ipmi/ipmi_msghandler.c -+++ b/drivers/char/ipmi/ipmi_msghandler.c -@@ -1241,7 +1241,7 @@ int ipmi_create_user(unsigned int if_num, - } - /* Not found, return an error */ - rv = -EINVAL; -- goto out_kfree; -+ goto out_unlock; - - found: - if (atomic_add_return(1, &intf->nr_users) > max_users) { -@@ -1283,6 +1283,7 @@ int ipmi_create_user(unsigned int if_num, - - out_kfree: - atomic_dec(&intf->nr_users); -+out_unlock: - srcu_read_unlock(&ipmi_interfaces_srcu, index); - vfree(new_user); - return rv; -diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c -index 1955eaeba0ab7c..4ef05c8c75e652 100644 ---- a/drivers/gpu/drm/drm_framebuffer.c -+++ b/drivers/gpu/drm/drm_framebuffer.c -@@ -844,11 +844,23 @@ void drm_framebuffer_free(struct kref *kref) - int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb, - const struct drm_framebuffer_funcs *funcs) - { -+ unsigned int i; - int ret; -+ bool exists; - - if (WARN_ON_ONCE(fb->dev != dev || !fb->format)) - return -EINVAL; - -+ for (i = 0; i < fb->format->num_planes; i++) { -+ if (drm_WARN_ON_ONCE(dev, fb->internal_flags & DRM_FRAMEBUFFER_HAS_HANDLE_REF(i))) -+ fb->internal_flags &= ~DRM_FRAMEBUFFER_HAS_HANDLE_REF(i); -+ if (fb->obj[i]) { -+ exists = drm_gem_object_handle_get_if_exists_unlocked(fb->obj[i]); -+ if (exists) -+ fb->internal_flags |= DRM_FRAMEBUFFER_HAS_HANDLE_REF(i); -+ } -+ } -+ - INIT_LIST_HEAD(&fb->filp_head); - - fb->funcs = funcs; -@@ -857,7 +869,7 @@ int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb, - ret = __drm_mode_object_add(dev, &fb->base, DRM_MODE_OBJECT_FB, - false, drm_framebuffer_free); - if (ret) -- goto out; -+ goto err; - - mutex_lock(&dev->mode_config.fb_lock); - dev->mode_config.num_fb++; -@@ -865,7 +877,16 @@ int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb, - mutex_unlock(&dev->mode_config.fb_lock); - - drm_mode_object_register(dev, &fb->base); --out: -+ -+ return 0; -+ -+err: -+ for (i = 0; i < fb->format->num_planes; i++) { -+ if (fb->internal_flags & DRM_FRAMEBUFFER_HAS_HANDLE_REF(i)) { -+ drm_gem_object_handle_put_unlocked(fb->obj[i]); -+ fb->internal_flags &= ~DRM_FRAMEBUFFER_HAS_HANDLE_REF(i); -+ } -+ } - return ret; - } - EXPORT_SYMBOL(drm_framebuffer_init); -@@ -942,6 +963,12 @@ EXPORT_SYMBOL(drm_framebuffer_unregister_private); - void drm_framebuffer_cleanup(struct drm_framebuffer *fb) - { - struct drm_device *dev = fb->dev; -+ unsigned int i; -+ -+ for (i = 0; i < fb->format->num_planes; i++) { -+ if (fb->internal_flags & DRM_FRAMEBUFFER_HAS_HANDLE_REF(i)) -+ drm_gem_object_handle_put_unlocked(fb->obj[i]); -+ } - - mutex_lock(&dev->mode_config.fb_lock); - list_del(&fb->head); -diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c -index deb93f78ce3442..a3370c77e949dc 100644 ---- a/drivers/gpu/drm/drm_gem.c -+++ b/drivers/gpu/drm/drm_gem.c -@@ -186,6 +186,46 @@ void drm_gem_private_object_fini(struct drm_gem_object *obj) - } - EXPORT_SYMBOL(drm_gem_private_object_fini); - -+static void drm_gem_object_handle_get(struct drm_gem_object *obj) -+{ -+ struct drm_device *dev = obj->dev; -+ -+ drm_WARN_ON(dev, !mutex_is_locked(&dev->object_name_lock)); -+ -+ if (obj->handle_count++ == 0) -+ drm_gem_object_get(obj); -+} -+ -+/** -+ * drm_gem_object_handle_get_if_exists_unlocked - acquire reference on user-space handle, if any -+ * @obj: GEM object -+ * -+ * Acquires a reference on the GEM buffer object's handle. Required to keep -+ * the GEM object alive. Call drm_gem_object_handle_put_if_exists_unlocked() -+ * to release the reference. Does nothing if the buffer object has no handle. -+ * -+ * Returns: -+ * True if a handle exists, or false otherwise -+ */ -+bool drm_gem_object_handle_get_if_exists_unlocked(struct drm_gem_object *obj) -+{ -+ struct drm_device *dev = obj->dev; -+ -+ guard(mutex)(&dev->object_name_lock); -+ -+ /* -+ * First ref taken during GEM object creation, if any. Some -+ * drivers set up internal framebuffers with GEM objects that -+ * do not have a GEM handle. Hence, this counter can be zero. -+ */ -+ if (!obj->handle_count) -+ return false; -+ -+ drm_gem_object_handle_get(obj); -+ -+ return true; -+} -+ - /** - * drm_gem_object_handle_free - release resources bound to userspace handles - * @obj: GEM object to clean up. -@@ -216,20 +256,26 @@ static void drm_gem_object_exported_dma_buf_free(struct drm_gem_object *obj) - } - } - --static void --drm_gem_object_handle_put_unlocked(struct drm_gem_object *obj) -+/** -+ * drm_gem_object_handle_put_unlocked - releases reference on user-space handle -+ * @obj: GEM object -+ * -+ * Releases a reference on the GEM buffer object's handle. Possibly releases -+ * the GEM buffer object and associated dma-buf objects. -+ */ -+void drm_gem_object_handle_put_unlocked(struct drm_gem_object *obj) - { - struct drm_device *dev = obj->dev; - bool final = false; - -- if (WARN_ON(READ_ONCE(obj->handle_count) == 0)) -+ if (drm_WARN_ON(dev, READ_ONCE(obj->handle_count) == 0)) - return; - - /* -- * Must bump handle count first as this may be the last -- * ref, in which case the object would disappear before we -- * checked for a name -- */ -+ * Must bump handle count first as this may be the last -+ * ref, in which case the object would disappear before -+ * we checked for a name. -+ */ - - mutex_lock(&dev->object_name_lock); - if (--obj->handle_count == 0) { -@@ -253,6 +299,9 @@ drm_gem_object_release_handle(int id, void *ptr, void *data) - struct drm_file *file_priv = data; - struct drm_gem_object *obj = ptr; - -+ if (drm_WARN_ON(obj->dev, !data)) -+ return 0; -+ - if (obj->funcs->close) - obj->funcs->close(obj, file_priv); - -@@ -363,8 +412,8 @@ drm_gem_handle_create_tail(struct drm_file *file_priv, - int ret; - - WARN_ON(!mutex_is_locked(&dev->object_name_lock)); -- if (obj->handle_count++ == 0) -- drm_gem_object_get(obj); -+ -+ drm_gem_object_handle_get(obj); - - /* - * Get the user-visible handle using idr. Preload and perform -@@ -373,7 +422,7 @@ drm_gem_handle_create_tail(struct drm_file *file_priv, - idr_preload(GFP_KERNEL); - spin_lock(&file_priv->table_lock); - -- ret = idr_alloc(&file_priv->object_idr, obj, 1, 0, GFP_NOWAIT); -+ ret = idr_alloc(&file_priv->object_idr, NULL, 1, 0, GFP_NOWAIT); - - spin_unlock(&file_priv->table_lock); - idr_preload_end(); -@@ -394,6 +443,11 @@ drm_gem_handle_create_tail(struct drm_file *file_priv, - goto err_revoke; - } - -+ /* mirrors drm_gem_handle_delete to avoid races */ -+ spin_lock(&file_priv->table_lock); -+ obj = idr_replace(&file_priv->object_idr, obj, handle); -+ WARN_ON(obj != NULL); -+ spin_unlock(&file_priv->table_lock); - *handlep = handle; - return 0; - -diff --git a/drivers/gpu/drm/drm_internal.h b/drivers/gpu/drm/drm_internal.h -index 0ef5fc2a61f194..8d433fe37e8fa8 100644 ---- a/drivers/gpu/drm/drm_internal.h -+++ b/drivers/gpu/drm/drm_internal.h -@@ -155,6 +155,8 @@ void drm_sysfs_lease_event(struct drm_device *dev); - - /* drm_gem.c */ - int drm_gem_init(struct drm_device *dev); -+bool drm_gem_object_handle_get_if_exists_unlocked(struct drm_gem_object *obj); -+void drm_gem_object_handle_put_unlocked(struct drm_gem_object *obj); - int drm_gem_handle_create_tail(struct drm_file *file_priv, - struct drm_gem_object *obj, - u32 *handlep); -diff --git a/drivers/gpu/drm/exynos/exynos7_drm_decon.c b/drivers/gpu/drm/exynos/exynos7_drm_decon.c -index 0156a5e9443594..5f8e5e87d7cd63 100644 ---- a/drivers/gpu/drm/exynos/exynos7_drm_decon.c -+++ b/drivers/gpu/drm/exynos/exynos7_drm_decon.c -@@ -601,6 +601,10 @@ static irqreturn_t decon_irq_handler(int irq, void *dev_id) - if (!ctx->drm_dev) - goto out; - -+ /* check if crtc and vblank have been initialized properly */ -+ if (!drm_dev_has_vblank(ctx->drm_dev)) -+ goto out; -+ - if (!ctx->i80_if) { - drm_crtc_handle_vblank(&ctx->crtc->base); - -diff --git a/drivers/gpu/drm/tegra/nvdec.c b/drivers/gpu/drm/tegra/nvdec.c -index 4860790666af51..14ef61b44f47cd 100644 ---- a/drivers/gpu/drm/tegra/nvdec.c -+++ b/drivers/gpu/drm/tegra/nvdec.c -@@ -261,10 +261,8 @@ static int nvdec_load_falcon_firmware(struct nvdec *nvdec) - - if (!client->group) { - virt = dma_alloc_coherent(nvdec->dev, size, &iova, GFP_KERNEL); -- -- err = dma_mapping_error(nvdec->dev, iova); -- if (err < 0) -- return err; -+ if (!virt) -+ return -ENOMEM; - } else { - virt = tegra_drm_alloc(tegra, size, &iova); - if (IS_ERR(virt)) -diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c -index 0b3f4267130c45..64606104551cd8 100644 ---- a/drivers/gpu/drm/ttm/ttm_bo_util.c -+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c -@@ -254,6 +254,13 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo, - ret = dma_resv_trylock(&fbo->base.base._resv); - WARN_ON(!ret); - -+ ret = dma_resv_reserve_fences(&fbo->base.base._resv, 1); -+ if (ret) { -+ dma_resv_unlock(&fbo->base.base._resv); -+ kfree(fbo); -+ return ret; -+ } -+ - if (fbo->base.resource) { - ttm_resource_set_bo(fbo->base.resource, &fbo->base); - bo->resource = NULL; -@@ -262,12 +269,6 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo, - fbo->base.bulk_move = NULL; - } - -- ret = dma_resv_reserve_fences(&fbo->base.base._resv, 1); -- if (ret) { -- kfree(fbo); -- return ret; -- } -- - ttm_bo_get(bo); - fbo->bo = bo; - -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index a8665d57094b22..0d1d7162814f32 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -305,6 +305,8 @@ - #define USB_DEVICE_ID_ASUS_AK1D 0x1125 - #define USB_DEVICE_ID_CHICONY_TOSHIBA_WT10A 0x1408 - #define USB_DEVICE_ID_CHICONY_ACER_SWITCH12 0x1421 -+#define USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA 0xb824 -+#define USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA2 0xb82c - - #define USB_VENDOR_ID_CHUNGHWAT 0x2247 - #define USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH 0x0001 -@@ -807,6 +809,7 @@ - #define USB_DEVICE_ID_LENOVO_TPPRODOCK 0x6067 - #define USB_DEVICE_ID_LENOVO_X1_COVER 0x6085 - #define USB_DEVICE_ID_LENOVO_X1_TAB 0x60a3 -+#define USB_DEVICE_ID_LENOVO_X1_TAB2 0x60a4 - #define USB_DEVICE_ID_LENOVO_X1_TAB3 0x60b5 - #define USB_DEVICE_ID_LENOVO_X12_TAB 0x60fe - #define USB_DEVICE_ID_LENOVO_X12_TAB2 0x61ae -@@ -1501,4 +1504,7 @@ - #define USB_VENDOR_ID_SIGNOTEC 0x2133 - #define USB_DEVICE_ID_SIGNOTEC_VIEWSONIC_PD1011 0x0018 - -+#define USB_VENDOR_ID_SMARTLINKTECHNOLOGY 0x4c4a -+#define USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155 0x4155 -+ - #endif -diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c -index ee65da98c7d5b5..32cb2e75228c4b 100644 ---- a/drivers/hid/hid-lenovo.c -+++ b/drivers/hid/hid-lenovo.c -@@ -473,6 +473,7 @@ static int lenovo_input_mapping(struct hid_device *hdev, - return lenovo_input_mapping_tp10_ultrabook_kbd(hdev, hi, field, - usage, bit, max); - case USB_DEVICE_ID_LENOVO_X1_TAB: -+ case USB_DEVICE_ID_LENOVO_X1_TAB2: - case USB_DEVICE_ID_LENOVO_X1_TAB3: - return lenovo_input_mapping_x1_tab_kbd(hdev, hi, field, usage, bit, max); - default: -@@ -587,6 +588,7 @@ static ssize_t attr_fn_lock_store(struct device *dev, - break; - case USB_DEVICE_ID_LENOVO_TP10UBKBD: - case USB_DEVICE_ID_LENOVO_X1_TAB: -+ case USB_DEVICE_ID_LENOVO_X1_TAB2: - case USB_DEVICE_ID_LENOVO_X1_TAB3: - ret = lenovo_led_set_tp10ubkbd(hdev, TP10UBKBD_FN_LOCK_LED, value); - if (ret) -@@ -782,6 +784,7 @@ static int lenovo_event(struct hid_device *hdev, struct hid_field *field, - return lenovo_event_cptkbd(hdev, field, usage, value); - case USB_DEVICE_ID_LENOVO_TP10UBKBD: - case USB_DEVICE_ID_LENOVO_X1_TAB: -+ case USB_DEVICE_ID_LENOVO_X1_TAB2: - case USB_DEVICE_ID_LENOVO_X1_TAB3: - return lenovo_event_tp10ubkbd(hdev, field, usage, value); - default: -@@ -1065,6 +1068,7 @@ static int lenovo_led_brightness_set(struct led_classdev *led_cdev, - break; - case USB_DEVICE_ID_LENOVO_TP10UBKBD: - case USB_DEVICE_ID_LENOVO_X1_TAB: -+ case USB_DEVICE_ID_LENOVO_X1_TAB2: - case USB_DEVICE_ID_LENOVO_X1_TAB3: - ret = lenovo_led_set_tp10ubkbd(hdev, tp10ubkbd_led[led_nr], value); - break; -@@ -1296,6 +1300,7 @@ static int lenovo_probe(struct hid_device *hdev, - break; - case USB_DEVICE_ID_LENOVO_TP10UBKBD: - case USB_DEVICE_ID_LENOVO_X1_TAB: -+ case USB_DEVICE_ID_LENOVO_X1_TAB2: - case USB_DEVICE_ID_LENOVO_X1_TAB3: - ret = lenovo_probe_tp10ubkbd(hdev); - break; -@@ -1383,6 +1388,7 @@ static void lenovo_remove(struct hid_device *hdev) - break; - case USB_DEVICE_ID_LENOVO_TP10UBKBD: - case USB_DEVICE_ID_LENOVO_X1_TAB: -+ case USB_DEVICE_ID_LENOVO_X1_TAB2: - case USB_DEVICE_ID_LENOVO_X1_TAB3: - lenovo_remove_tp10ubkbd(hdev); - break; -@@ -1433,6 +1439,8 @@ static const struct hid_device_id lenovo_devices[] = { - */ - { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, - USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_TAB) }, -+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, -+ USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_TAB2) }, - { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, - USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_TAB3) }, - { } -diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c -index 6386043aab0bbf..becd4c1ccf93c1 100644 ---- a/drivers/hid/hid-multitouch.c -+++ b/drivers/hid/hid-multitouch.c -@@ -2110,12 +2110,18 @@ static const struct hid_device_id mt_devices[] = { - HID_DEVICE(BUS_I2C, HID_GROUP_GENERIC, - USB_VENDOR_ID_LG, I2C_DEVICE_ID_LG_7010) }, - -- /* Lenovo X1 TAB Gen 2 */ -+ /* Lenovo X1 TAB Gen 1 */ - { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT, - HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8, - USB_VENDOR_ID_LENOVO, - USB_DEVICE_ID_LENOVO_X1_TAB) }, - -+ /* Lenovo X1 TAB Gen 2 */ -+ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT, -+ HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8, -+ USB_VENDOR_ID_LENOVO, -+ USB_DEVICE_ID_LENOVO_X1_TAB2) }, -+ - /* Lenovo X1 TAB Gen 3 */ - { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT, - HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8, -diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c -index 73979643315bfd..80372342c176af 100644 ---- a/drivers/hid/hid-quirks.c -+++ b/drivers/hid/hid-quirks.c -@@ -747,6 +747,8 @@ static const struct hid_device_id hid_ignore_list[] = { - { HID_USB_DEVICE(USB_VENDOR_ID_AVERMEDIA, USB_DEVICE_ID_AVER_FM_MR800) }, - { HID_USB_DEVICE(USB_VENDOR_ID_AXENTIA, USB_DEVICE_ID_AXENTIA_FM_RADIO) }, - { HID_USB_DEVICE(USB_VENDOR_ID_BERKSHIRE, USB_DEVICE_ID_BERKSHIRE_PCWD) }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA) }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA2) }, - { HID_USB_DEVICE(USB_VENDOR_ID_CIDC, 0x0103) }, - { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_RADIO_SI470X) }, - { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_RADIO_SI4713) }, -@@ -894,6 +896,7 @@ static const struct hid_device_id hid_ignore_list[] = { - #endif - { HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) }, - { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473) }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_SMARTLINKTECHNOLOGY, USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155) }, - { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_MULTITOUCH) }, - { HID_USB_DEVICE(USB_VENDOR_ID_ODROID, USB_DEVICE_ID_VU5) }, - { HID_USB_DEVICE(USB_VENDOR_ID_ODROID, USB_DEVICE_ID_VU7PLUS) }, -diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c -index aad2d75c036781..14ead0fbb80fd4 100644 ---- a/drivers/input/keyboard/atkbd.c -+++ b/drivers/input/keyboard/atkbd.c -@@ -826,7 +826,7 @@ static int atkbd_probe(struct atkbd *atkbd) - - if (atkbd_skip_getid(atkbd)) { - atkbd->id = 0xab83; -- return 0; -+ goto deactivate_kbd; - } - - /* -@@ -863,6 +863,7 @@ static int atkbd_probe(struct atkbd *atkbd) - return -1; - } - -+deactivate_kbd: - /* - * Make sure nothing is coming from the keyboard and disturbs our - * internal state. -diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c -index 21decb97bc050b..1f1991634d0a21 100644 ---- a/drivers/md/md-bitmap.c -+++ b/drivers/md/md-bitmap.c -@@ -2119,8 +2119,7 @@ int md_bitmap_get_stats(struct bitmap *bitmap, struct md_bitmap_stats *stats) - - if (!bitmap) - return -ENOENT; -- if (!bitmap->mddev->bitmap_info.external && -- !bitmap->storage.sb_page) -+ if (!bitmap->storage.sb_page) - return -EINVAL; - sb = kmap_local_page(bitmap->storage.sb_page); - stats->sync_size = le64_to_cpu(sb->sync_size); -diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index 8b25287c89ed6d..4c1f86ca55208c 100644 ---- a/drivers/md/raid1.c -+++ b/drivers/md/raid1.c -@@ -3297,6 +3297,7 @@ static int raid1_reshape(struct mddev *mddev) - /* ok, everything is stopped */ - oldpool = conf->r1bio_pool; - conf->r1bio_pool = newpool; -+ init_waitqueue_head(&conf->r1bio_pool.wait); - - for (d = d2 = 0; d < conf->raid_disks; d++) { - struct md_rdev *rdev = conf->mirrors[d].rdev; -diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c -index 36b6bf3f8b29fd..a75d090a7fa15a 100644 ---- a/drivers/md/raid10.c -+++ b/drivers/md/raid10.c -@@ -1205,8 +1205,11 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, - rcu_read_unlock(); - } - -- if (!regular_request_wait(mddev, conf, bio, r10_bio->sectors)) -+ if (!regular_request_wait(mddev, conf, bio, r10_bio->sectors)) { -+ raid_end_bio_io(r10_bio); - return; -+ } -+ - rdev = read_balance(conf, r10_bio, &max_sectors); - if (!rdev) { - if (err_rdev) { -@@ -1428,8 +1431,11 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio, - } - - sectors = r10_bio->sectors; -- if (!regular_request_wait(mddev, conf, bio, sectors)) -+ if (!regular_request_wait(mddev, conf, bio, sectors)) { -+ raid_end_bio_io(r10_bio); - return; -+ } -+ - if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) && - (mddev->reshape_backwards - ? (bio->bi_iter.bi_sector < conf->reshape_safe && -diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c -index ba7f7de25c8529..e6a74d66f0d8ca 100644 ---- a/drivers/net/can/m_can/m_can.c -+++ b/drivers/net/can/m_can/m_can.c -@@ -606,7 +606,7 @@ static int m_can_handle_lost_msg(struct net_device *dev) - struct can_frame *frame; - u32 timestamp = 0; - -- netdev_err(dev, "msg lost in rxf0\n"); -+ netdev_dbg(dev, "msg lost in rxf0\n"); - - stats->rx_errors++; - stats->rx_over_errors++; -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c -index 63e0670383852a..1727e9bb1479d5 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c -@@ -487,7 +487,9 @@ static int bnxt_ets_validate(struct bnxt *bp, struct ieee_ets *ets, u8 *tc) - - if ((ets->tc_tx_bw[i] || ets->tc_tsa[i]) && i > bp->max_tc) - return -EINVAL; -+ } - -+ for (i = 0; i < max_tc; i++) { - switch (ets->tc_tsa[i]) { - case IEEE_8021QAZ_TSA_STRICT: - break; -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c -index 758f51366ef032..07a458ecb7cc93 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c -@@ -115,7 +115,7 @@ static void __bnxt_xmit_xdp_redirect(struct bnxt *bp, - tx_buf->action = XDP_REDIRECT; - tx_buf->xdpf = xdpf; - dma_unmap_addr_set(tx_buf, mapping, mapping); -- dma_unmap_len_set(tx_buf, len, 0); -+ dma_unmap_len_set(tx_buf, len, len); - } - - void bnxt_tx_int_xdp(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) -diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h -index b3fc18db4f4c39..dfbda2e5ec88aa 100644 ---- a/drivers/net/ethernet/ibm/ibmvnic.h -+++ b/drivers/net/ethernet/ibm/ibmvnic.h -@@ -211,7 +211,6 @@ struct ibmvnic_statistics { - u8 reserved[72]; - } __packed __aligned(8); - --#define NUM_TX_STATS 3 - struct ibmvnic_tx_queue_stats { - u64 batched_packets; - u64 direct_packets; -@@ -219,13 +218,18 @@ struct ibmvnic_tx_queue_stats { - u64 dropped_packets; - }; - --#define NUM_RX_STATS 3 -+#define NUM_TX_STATS \ -+ (sizeof(struct ibmvnic_tx_queue_stats) / sizeof(u64)) -+ - struct ibmvnic_rx_queue_stats { - u64 packets; - u64 bytes; - u64 interrupts; - }; - -+#define NUM_RX_STATS \ -+ (sizeof(struct ibmvnic_rx_queue_stats) / sizeof(u64)) -+ - struct ibmvnic_acl_buffer { - __be32 len; - __be32 version; -diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c -index 9ed965d61e3554..d3c9a3020fbf6e 100644 ---- a/drivers/net/ethernet/microsoft/mana/gdma_main.c -+++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c -@@ -28,6 +28,9 @@ static void mana_gd_init_pf_regs(struct pci_dev *pdev) - gc->db_page_base = gc->bar0_va + - mana_gd_r64(gc, GDMA_PF_REG_DB_PAGE_OFF); - -+ gc->phys_db_page_base = gc->bar0_pa + -+ mana_gd_r64(gc, GDMA_PF_REG_DB_PAGE_OFF); -+ - sriov_base_off = mana_gd_r64(gc, GDMA_SRIOV_REG_CFG_BASE_OFF); - - sriov_base_va = gc->bar0_va + sriov_base_off; -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c -index dd2ab6185c40e8..05ea74e9379399 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c -@@ -364,19 +364,17 @@ static int dwxgmac2_dma_interrupt(struct stmmac_priv *priv, - } - - /* TX/RX NORMAL interrupts */ -- if (likely(intr_status & XGMAC_NIS)) { -- if (likely(intr_status & XGMAC_RI)) { -- u64_stats_update_begin(&stats->syncp); -- u64_stats_inc(&stats->rx_normal_irq_n[chan]); -- u64_stats_update_end(&stats->syncp); -- ret |= handle_rx; -- } -- if (likely(intr_status & (XGMAC_TI | XGMAC_TBU))) { -- u64_stats_update_begin(&stats->syncp); -- u64_stats_inc(&stats->tx_normal_irq_n[chan]); -- u64_stats_update_end(&stats->syncp); -- ret |= handle_tx; -- } -+ if (likely(intr_status & XGMAC_RI)) { -+ u64_stats_update_begin(&stats->syncp); -+ u64_stats_inc(&stats->rx_normal_irq_n[chan]); -+ u64_stats_update_end(&stats->syncp); -+ ret |= handle_rx; -+ } -+ if (likely(intr_status & (XGMAC_TI | XGMAC_TBU))) { -+ u64_stats_update_begin(&stats->syncp); -+ u64_stats_inc(&stats->tx_normal_irq_n[chan]); -+ u64_stats_update_end(&stats->syncp); -+ ret |= handle_tx; - } - - /* Clear interrupts */ -diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c -index c10f94d69dad3b..3d622634e82aad 100644 ---- a/drivers/net/ethernet/xilinx/ll_temac_main.c -+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c -@@ -1309,7 +1309,7 @@ ll_temac_ethtools_set_ringparam(struct net_device *ndev, - if (ering->rx_pending > RX_BD_NUM_MAX || - ering->rx_mini_pending || - ering->rx_jumbo_pending || -- ering->rx_pending > TX_BD_NUM_MAX) -+ ering->tx_pending > TX_BD_NUM_MAX) - return -EINVAL; - - if (netif_running(ndev)) -diff --git a/drivers/net/phy/microchip.c b/drivers/net/phy/microchip.c -index 623607fd2cefd3..cb8306cd98260c 100644 ---- a/drivers/net/phy/microchip.c -+++ b/drivers/net/phy/microchip.c -@@ -310,7 +310,7 @@ static void lan88xx_link_change_notify(struct phy_device *phydev) - * As workaround, set to 10 before setting to 100 - * at forced 100 F/H mode. - */ -- if (!phydev->autoneg && phydev->speed == 100) { -+ if (phydev->state == PHY_NOLINK && !phydev->autoneg && phydev->speed == 100) { - /* disable phy interrupt */ - temp = phy_read(phydev, LAN88XX_INT_MASK); - temp &= ~LAN88XX_INT_MASK_MDINTPIN_EN_; -diff --git a/drivers/net/phy/smsc.c b/drivers/net/phy/smsc.c -index c88edb19d2e710..4ca813c009476a 100644 ---- a/drivers/net/phy/smsc.c -+++ b/drivers/net/phy/smsc.c -@@ -155,10 +155,29 @@ static int smsc_phy_reset(struct phy_device *phydev) - - static int lan87xx_config_aneg(struct phy_device *phydev) - { -- int rc; -+ u8 mdix_ctrl; - int val; -+ int rc; -+ -+ /* When auto-negotiation is disabled (forced mode), the PHY's -+ * Auto-MDIX will continue toggling the TX/RX pairs. -+ * -+ * To establish a stable link, we must select a fixed MDI mode. -+ * If the user has not specified a fixed MDI mode (i.e., mdix_ctrl is -+ * 'auto'), we default to ETH_TP_MDI. This choice of a ETH_TP_MDI mode -+ * mirrors the behavior the hardware would exhibit if the AUTOMDIX_EN -+ * strap were configured for a fixed MDI connection. -+ */ -+ if (phydev->autoneg == AUTONEG_DISABLE) { -+ if (phydev->mdix_ctrl == ETH_TP_MDI_AUTO) -+ mdix_ctrl = ETH_TP_MDI; -+ else -+ mdix_ctrl = phydev->mdix_ctrl; -+ } else { -+ mdix_ctrl = phydev->mdix_ctrl; -+ } - -- switch (phydev->mdix_ctrl) { -+ switch (mdix_ctrl) { - case ETH_TP_MDI: - val = SPECIAL_CTRL_STS_OVRRD_AMDIX_; - break; -@@ -167,7 +186,8 @@ static int lan87xx_config_aneg(struct phy_device *phydev) - SPECIAL_CTRL_STS_AMDIX_STATE_; - break; - case ETH_TP_MDI_AUTO: -- val = SPECIAL_CTRL_STS_AMDIX_ENABLE_; -+ val = SPECIAL_CTRL_STS_OVRRD_AMDIX_ | -+ SPECIAL_CTRL_STS_AMDIX_ENABLE_; - break; - default: - return genphy_config_aneg(phydev); -@@ -183,7 +203,7 @@ static int lan87xx_config_aneg(struct phy_device *phydev) - rc |= val; - phy_write(phydev, SPECIAL_CTRL_STS, rc); - -- phydev->mdix = phydev->mdix_ctrl; -+ phydev->mdix = mdix_ctrl; - return genphy_config_aneg(phydev); - } - -@@ -261,6 +281,33 @@ int lan87xx_read_status(struct phy_device *phydev) - } - EXPORT_SYMBOL_GPL(lan87xx_read_status); - -+static int lan87xx_phy_config_init(struct phy_device *phydev) -+{ -+ int rc; -+ -+ /* The LAN87xx PHY's initial MDI-X mode is determined by the AUTOMDIX_EN -+ * hardware strap, but the driver cannot read the strap's status. This -+ * creates an unpredictable initial state. -+ * -+ * To ensure consistent and reliable behavior across all boards, -+ * override the strap configuration on initialization and force the PHY -+ * into a known state with Auto-MDIX enabled, which is the expected -+ * default for modern hardware. -+ */ -+ rc = phy_modify(phydev, SPECIAL_CTRL_STS, -+ SPECIAL_CTRL_STS_OVRRD_AMDIX_ | -+ SPECIAL_CTRL_STS_AMDIX_ENABLE_ | -+ SPECIAL_CTRL_STS_AMDIX_STATE_, -+ SPECIAL_CTRL_STS_OVRRD_AMDIX_ | -+ SPECIAL_CTRL_STS_AMDIX_ENABLE_); -+ if (rc < 0) -+ return rc; -+ -+ phydev->mdix_ctrl = ETH_TP_MDI_AUTO; -+ -+ return smsc_phy_config_init(phydev); -+} -+ - static int lan874x_phy_config_init(struct phy_device *phydev) - { - u16 val; -@@ -696,7 +743,7 @@ static struct phy_driver smsc_phy_driver[] = { - - /* basic functions */ - .read_status = lan87xx_read_status, -- .config_init = smsc_phy_config_init, -+ .config_init = lan87xx_phy_config_init, - .soft_reset = smsc_phy_reset, - .config_aneg = lan87xx_config_aneg, - -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index dc84d9029c2c79..3976bc4295dd19 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -1432,6 +1432,7 @@ static const struct usb_device_id products[] = { - {QMI_QUIRK_SET_DTR(0x22de, 0x9051, 2)}, /* Hucom Wireless HM-211S/K */ - {QMI_FIXED_INTF(0x22de, 0x9061, 3)}, /* WeTelecom WPD-600N */ - {QMI_QUIRK_SET_DTR(0x1e0e, 0x9001, 5)}, /* SIMCom 7100E, 7230E, 7600E ++ */ -+ {QMI_QUIRK_SET_DTR(0x1e0e, 0x9071, 3)}, /* SIMCom 8230C ++ */ - {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */ - {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */ - {QMI_QUIRK_SET_DTR(0x2c7c, 0x0195, 4)}, /* Quectel EG95 */ -diff --git a/drivers/net/wireless/zydas/zd1211rw/zd_mac.c b/drivers/net/wireless/zydas/zd1211rw/zd_mac.c -index 5d534e15a844f7..278875c02f41f8 100644 ---- a/drivers/net/wireless/zydas/zd1211rw/zd_mac.c -+++ b/drivers/net/wireless/zydas/zd1211rw/zd_mac.c -@@ -583,7 +583,11 @@ void zd_mac_tx_to_dev(struct sk_buff *skb, int error) - - skb_queue_tail(q, skb); - while (skb_queue_len(q) > ZD_MAC_MAX_ACK_WAITERS) { -- zd_mac_tx_status(hw, skb_dequeue(q), -+ skb = skb_dequeue(q); -+ if (!skb) -+ break; -+ -+ zd_mac_tx_status(hw, skb, - mac->ack_pending ? mac->ack_signal : 0, - NULL); - mac->ack_pending = 0; -diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c -index 75bff325a42519..ba38173d3ed3c5 100644 ---- a/drivers/pinctrl/pinctrl-amd.c -+++ b/drivers/pinctrl/pinctrl-amd.c -@@ -933,6 +933,17 @@ static int amd_gpio_suspend_hibernate_common(struct device *dev, bool is_suspend - pin, is_suspend ? "suspend" : "hibernate"); - } - -+ /* -+ * debounce enabled over suspend has shown issues with a GPIO -+ * being unable to wake the system, as we're only interested in -+ * the actual wakeup event, clear it. -+ */ -+ if (gpio_dev->saved_regs[i] & (DB_CNTRl_MASK << DB_CNTRL_OFF)) { -+ amd_gpio_set_debounce(gpio_dev, pin, 0); -+ pm_pr_dbg("Clearing debounce for GPIO #%d during %s.\n", -+ pin, is_suspend ? "suspend" : "hibernate"); -+ } -+ - raw_spin_unlock_irqrestore(&gpio_dev->lock, flags); - } - -diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c -index ed70767ca0f0c9..13dc8bc1d0cff2 100644 ---- a/drivers/pinctrl/qcom/pinctrl-msm.c -+++ b/drivers/pinctrl/qcom/pinctrl-msm.c -@@ -1031,6 +1031,25 @@ static bool msm_gpio_needs_dual_edge_parent_workaround(struct irq_data *d, - test_bit(d->hwirq, pctrl->skip_wake_irqs); - } - -+static void msm_gpio_irq_init_valid_mask(struct gpio_chip *gc, -+ unsigned long *valid_mask, -+ unsigned int ngpios) -+{ -+ struct msm_pinctrl *pctrl = gpiochip_get_data(gc); -+ const struct msm_pingroup *g; -+ int i; -+ -+ bitmap_fill(valid_mask, ngpios); -+ -+ for (i = 0; i < ngpios; i++) { -+ g = &pctrl->soc->groups[i]; -+ -+ if (g->intr_detection_width != 1 && -+ g->intr_detection_width != 2) -+ clear_bit(i, valid_mask); -+ } -+} -+ - static int msm_gpio_irq_set_type(struct irq_data *d, unsigned int type) - { - struct gpio_chip *gc = irq_data_get_irq_chip_data(d); -@@ -1392,6 +1411,7 @@ static int msm_gpio_init(struct msm_pinctrl *pctrl) - girq->default_type = IRQ_TYPE_NONE; - girq->handler = handle_bad_irq; - girq->parents[0] = pctrl->irq; -+ girq->init_valid_mask = msm_gpio_irq_init_valid_mask; - - ret = gpiochip_add_data(&pctrl->chip, pctrl); - if (ret) { -diff --git a/drivers/pwm/pwm-mediatek.c b/drivers/pwm/pwm-mediatek.c -index 6b1a75b6bd12fb..ff7c70a0033d8a 100644 ---- a/drivers/pwm/pwm-mediatek.c -+++ b/drivers/pwm/pwm-mediatek.c -@@ -133,8 +133,10 @@ static int pwm_mediatek_config(struct pwm_chip *chip, struct pwm_device *pwm, - return ret; - - clk_rate = clk_get_rate(pc->clk_pwms[pwm->hwpwm]); -- if (!clk_rate) -- return -EINVAL; -+ if (!clk_rate) { -+ ret = -EINVAL; -+ goto out; -+ } - - /* Make sure we use the bus clock and not the 26MHz clock */ - if (pc->soc->has_ck_26m_sel) -@@ -153,9 +155,9 @@ static int pwm_mediatek_config(struct pwm_chip *chip, struct pwm_device *pwm, - } - - if (clkdiv > PWM_CLK_DIV_MAX) { -- pwm_mediatek_clk_disable(chip, pwm); - dev_err(chip->dev, "period of %d ns not supported\n", period_ns); -- return -EINVAL; -+ ret = -EINVAL; -+ goto out; - } - - if (pc->soc->pwm45_fixup && pwm->hwpwm > 2) { -@@ -172,9 +174,10 @@ static int pwm_mediatek_config(struct pwm_chip *chip, struct pwm_device *pwm, - pwm_mediatek_writel(pc, pwm->hwpwm, reg_width, cnt_period); - pwm_mediatek_writel(pc, pwm->hwpwm, reg_thres, cnt_duty); - -+out: - pwm_mediatek_clk_disable(chip, pwm); - -- return 0; -+ return ret; - } - - static int pwm_mediatek_enable(struct pwm_chip *chip, struct pwm_device *pwm) -diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c -index c5ec7306aa7130..60c878ea95f92d 100644 ---- a/drivers/tty/vt/vt.c -+++ b/drivers/tty/vt/vt.c -@@ -4392,6 +4392,7 @@ void do_unblank_screen(int leaving_gfx) - set_palette(vc); - set_cursor(vc); - vt_event_post(VT_EVENT_UNBLANK, vc->vc_num, vc->vc_num); -+ notify_update(vc); - } - EXPORT_SYMBOL(do_unblank_screen); - -diff --git a/drivers/usb/cdns3/cdnsp-debug.h b/drivers/usb/cdns3/cdnsp-debug.h -index f0ca865cce2a09..86860686d8363e 100644 ---- a/drivers/usb/cdns3/cdnsp-debug.h -+++ b/drivers/usb/cdns3/cdnsp-debug.h -@@ -131,8 +131,6 @@ static inline const char *cdnsp_trb_type_string(u8 type) - return "Endpoint Not ready"; - case TRB_HALT_ENDPOINT: - return "Halt Endpoint"; -- case TRB_FLUSH_ENDPOINT: -- return "FLush Endpoint"; - default: - return "UNKNOWN"; - } -@@ -189,203 +187,203 @@ static inline const char *cdnsp_decode_trb(char *str, size_t size, u32 field0, - - switch (type) { - case TRB_LINK: -- ret = snprintf(str, size, -- "LINK %08x%08x intr %ld type '%s' flags %c:%c:%c:%c", -- field1, field0, GET_INTR_TARGET(field2), -- cdnsp_trb_type_string(type), -- field3 & TRB_IOC ? 'I' : 'i', -- field3 & TRB_CHAIN ? 'C' : 'c', -- field3 & TRB_TC ? 'T' : 't', -- field3 & TRB_CYCLE ? 'C' : 'c'); -+ ret = scnprintf(str, size, -+ "LINK %08x%08x intr %ld type '%s' flags %c:%c:%c:%c", -+ field1, field0, GET_INTR_TARGET(field2), -+ cdnsp_trb_type_string(type), -+ field3 & TRB_IOC ? 'I' : 'i', -+ field3 & TRB_CHAIN ? 'C' : 'c', -+ field3 & TRB_TC ? 'T' : 't', -+ field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_TRANSFER: - case TRB_COMPLETION: - case TRB_PORT_STATUS: - case TRB_HC_EVENT: -- ret = snprintf(str, size, -- "ep%d%s(%d) type '%s' TRB %08x%08x status '%s'" -- " len %ld slot %ld flags %c:%c", -- ep_num, ep_id % 2 ? "out" : "in", -- TRB_TO_EP_INDEX(field3), -- cdnsp_trb_type_string(type), field1, field0, -- cdnsp_trb_comp_code_string(GET_COMP_CODE(field2)), -- EVENT_TRB_LEN(field2), TRB_TO_SLOT_ID(field3), -- field3 & EVENT_DATA ? 'E' : 'e', -- field3 & TRB_CYCLE ? 'C' : 'c'); -+ ret = scnprintf(str, size, -+ "ep%d%s(%d) type '%s' TRB %08x%08x status '%s'" -+ " len %ld slot %ld flags %c:%c", -+ ep_num, ep_id % 2 ? "out" : "in", -+ TRB_TO_EP_INDEX(field3), -+ cdnsp_trb_type_string(type), field1, field0, -+ cdnsp_trb_comp_code_string(GET_COMP_CODE(field2)), -+ EVENT_TRB_LEN(field2), TRB_TO_SLOT_ID(field3), -+ field3 & EVENT_DATA ? 'E' : 'e', -+ field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_MFINDEX_WRAP: -- ret = snprintf(str, size, "%s: flags %c", -- cdnsp_trb_type_string(type), -- field3 & TRB_CYCLE ? 'C' : 'c'); -+ ret = scnprintf(str, size, "%s: flags %c", -+ cdnsp_trb_type_string(type), -+ field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_SETUP: -- ret = snprintf(str, size, -- "type '%s' bRequestType %02x bRequest %02x " -- "wValue %02x%02x wIndex %02x%02x wLength %d " -- "length %ld TD size %ld intr %ld Setup ID %ld " -- "flags %c:%c:%c", -- cdnsp_trb_type_string(type), -- field0 & 0xff, -- (field0 & 0xff00) >> 8, -- (field0 & 0xff000000) >> 24, -- (field0 & 0xff0000) >> 16, -- (field1 & 0xff00) >> 8, -- field1 & 0xff, -- (field1 & 0xff000000) >> 16 | -- (field1 & 0xff0000) >> 16, -- TRB_LEN(field2), GET_TD_SIZE(field2), -- GET_INTR_TARGET(field2), -- TRB_SETUPID_TO_TYPE(field3), -- field3 & TRB_IDT ? 'D' : 'd', -- field3 & TRB_IOC ? 'I' : 'i', -- field3 & TRB_CYCLE ? 'C' : 'c'); -+ ret = scnprintf(str, size, -+ "type '%s' bRequestType %02x bRequest %02x " -+ "wValue %02x%02x wIndex %02x%02x wLength %d " -+ "length %ld TD size %ld intr %ld Setup ID %ld " -+ "flags %c:%c:%c", -+ cdnsp_trb_type_string(type), -+ field0 & 0xff, -+ (field0 & 0xff00) >> 8, -+ (field0 & 0xff000000) >> 24, -+ (field0 & 0xff0000) >> 16, -+ (field1 & 0xff00) >> 8, -+ field1 & 0xff, -+ (field1 & 0xff000000) >> 16 | -+ (field1 & 0xff0000) >> 16, -+ TRB_LEN(field2), GET_TD_SIZE(field2), -+ GET_INTR_TARGET(field2), -+ TRB_SETUPID_TO_TYPE(field3), -+ field3 & TRB_IDT ? 'D' : 'd', -+ field3 & TRB_IOC ? 'I' : 'i', -+ field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_DATA: -- ret = snprintf(str, size, -- "type '%s' Buffer %08x%08x length %ld TD size %ld " -- "intr %ld flags %c:%c:%c:%c:%c:%c:%c", -- cdnsp_trb_type_string(type), -- field1, field0, TRB_LEN(field2), -- GET_TD_SIZE(field2), -- GET_INTR_TARGET(field2), -- field3 & TRB_IDT ? 'D' : 'i', -- field3 & TRB_IOC ? 'I' : 'i', -- field3 & TRB_CHAIN ? 'C' : 'c', -- field3 & TRB_NO_SNOOP ? 'S' : 's', -- field3 & TRB_ISP ? 'I' : 'i', -- field3 & TRB_ENT ? 'E' : 'e', -- field3 & TRB_CYCLE ? 'C' : 'c'); -+ ret = scnprintf(str, size, -+ "type '%s' Buffer %08x%08x length %ld TD size %ld " -+ "intr %ld flags %c:%c:%c:%c:%c:%c:%c", -+ cdnsp_trb_type_string(type), -+ field1, field0, TRB_LEN(field2), -+ GET_TD_SIZE(field2), -+ GET_INTR_TARGET(field2), -+ field3 & TRB_IDT ? 'D' : 'i', -+ field3 & TRB_IOC ? 'I' : 'i', -+ field3 & TRB_CHAIN ? 'C' : 'c', -+ field3 & TRB_NO_SNOOP ? 'S' : 's', -+ field3 & TRB_ISP ? 'I' : 'i', -+ field3 & TRB_ENT ? 'E' : 'e', -+ field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_STATUS: -- ret = snprintf(str, size, -- "Buffer %08x%08x length %ld TD size %ld intr" -- "%ld type '%s' flags %c:%c:%c:%c", -- field1, field0, TRB_LEN(field2), -- GET_TD_SIZE(field2), -- GET_INTR_TARGET(field2), -- cdnsp_trb_type_string(type), -- field3 & TRB_IOC ? 'I' : 'i', -- field3 & TRB_CHAIN ? 'C' : 'c', -- field3 & TRB_ENT ? 'E' : 'e', -- field3 & TRB_CYCLE ? 'C' : 'c'); -+ ret = scnprintf(str, size, -+ "Buffer %08x%08x length %ld TD size %ld intr" -+ "%ld type '%s' flags %c:%c:%c:%c", -+ field1, field0, TRB_LEN(field2), -+ GET_TD_SIZE(field2), -+ GET_INTR_TARGET(field2), -+ cdnsp_trb_type_string(type), -+ field3 & TRB_IOC ? 'I' : 'i', -+ field3 & TRB_CHAIN ? 'C' : 'c', -+ field3 & TRB_ENT ? 'E' : 'e', -+ field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_NORMAL: - case TRB_ISOC: - case TRB_EVENT_DATA: - case TRB_TR_NOOP: -- ret = snprintf(str, size, -- "type '%s' Buffer %08x%08x length %ld " -- "TD size %ld intr %ld " -- "flags %c:%c:%c:%c:%c:%c:%c:%c:%c", -- cdnsp_trb_type_string(type), -- field1, field0, TRB_LEN(field2), -- GET_TD_SIZE(field2), -- GET_INTR_TARGET(field2), -- field3 & TRB_BEI ? 'B' : 'b', -- field3 & TRB_IDT ? 'T' : 't', -- field3 & TRB_IOC ? 'I' : 'i', -- field3 & TRB_CHAIN ? 'C' : 'c', -- field3 & TRB_NO_SNOOP ? 'S' : 's', -- field3 & TRB_ISP ? 'I' : 'i', -- field3 & TRB_ENT ? 'E' : 'e', -- field3 & TRB_CYCLE ? 'C' : 'c', -- !(field3 & TRB_EVENT_INVALIDATE) ? 'V' : 'v'); -+ ret = scnprintf(str, size, -+ "type '%s' Buffer %08x%08x length %ld " -+ "TD size %ld intr %ld " -+ "flags %c:%c:%c:%c:%c:%c:%c:%c:%c", -+ cdnsp_trb_type_string(type), -+ field1, field0, TRB_LEN(field2), -+ GET_TD_SIZE(field2), -+ GET_INTR_TARGET(field2), -+ field3 & TRB_BEI ? 'B' : 'b', -+ field3 & TRB_IDT ? 'T' : 't', -+ field3 & TRB_IOC ? 'I' : 'i', -+ field3 & TRB_CHAIN ? 'C' : 'c', -+ field3 & TRB_NO_SNOOP ? 'S' : 's', -+ field3 & TRB_ISP ? 'I' : 'i', -+ field3 & TRB_ENT ? 'E' : 'e', -+ field3 & TRB_CYCLE ? 'C' : 'c', -+ !(field3 & TRB_EVENT_INVALIDATE) ? 'V' : 'v'); - break; - case TRB_CMD_NOOP: - case TRB_ENABLE_SLOT: -- ret = snprintf(str, size, "%s: flags %c", -- cdnsp_trb_type_string(type), -- field3 & TRB_CYCLE ? 'C' : 'c'); -+ ret = scnprintf(str, size, "%s: flags %c", -+ cdnsp_trb_type_string(type), -+ field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_DISABLE_SLOT: -- ret = snprintf(str, size, "%s: slot %ld flags %c", -- cdnsp_trb_type_string(type), -- TRB_TO_SLOT_ID(field3), -- field3 & TRB_CYCLE ? 'C' : 'c'); -+ ret = scnprintf(str, size, "%s: slot %ld flags %c", -+ cdnsp_trb_type_string(type), -+ TRB_TO_SLOT_ID(field3), -+ field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_ADDR_DEV: -- ret = snprintf(str, size, -- "%s: ctx %08x%08x slot %ld flags %c:%c", -- cdnsp_trb_type_string(type), field1, field0, -- TRB_TO_SLOT_ID(field3), -- field3 & TRB_BSR ? 'B' : 'b', -- field3 & TRB_CYCLE ? 'C' : 'c'); -+ ret = scnprintf(str, size, -+ "%s: ctx %08x%08x slot %ld flags %c:%c", -+ cdnsp_trb_type_string(type), field1, field0, -+ TRB_TO_SLOT_ID(field3), -+ field3 & TRB_BSR ? 'B' : 'b', -+ field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_CONFIG_EP: -- ret = snprintf(str, size, -- "%s: ctx %08x%08x slot %ld flags %c:%c", -- cdnsp_trb_type_string(type), field1, field0, -- TRB_TO_SLOT_ID(field3), -- field3 & TRB_DC ? 'D' : 'd', -- field3 & TRB_CYCLE ? 'C' : 'c'); -+ ret = scnprintf(str, size, -+ "%s: ctx %08x%08x slot %ld flags %c:%c", -+ cdnsp_trb_type_string(type), field1, field0, -+ TRB_TO_SLOT_ID(field3), -+ field3 & TRB_DC ? 'D' : 'd', -+ field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_EVAL_CONTEXT: -- ret = snprintf(str, size, -- "%s: ctx %08x%08x slot %ld flags %c", -- cdnsp_trb_type_string(type), field1, field0, -- TRB_TO_SLOT_ID(field3), -- field3 & TRB_CYCLE ? 'C' : 'c'); -+ ret = scnprintf(str, size, -+ "%s: ctx %08x%08x slot %ld flags %c", -+ cdnsp_trb_type_string(type), field1, field0, -+ TRB_TO_SLOT_ID(field3), -+ field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_RESET_EP: - case TRB_HALT_ENDPOINT: -- case TRB_FLUSH_ENDPOINT: -- ret = snprintf(str, size, -- "%s: ep%d%s(%d) ctx %08x%08x slot %ld flags %c", -- cdnsp_trb_type_string(type), -- ep_num, ep_id % 2 ? "out" : "in", -- TRB_TO_EP_INDEX(field3), field1, field0, -- TRB_TO_SLOT_ID(field3), -- field3 & TRB_CYCLE ? 'C' : 'c'); -+ ret = scnprintf(str, size, -+ "%s: ep%d%s(%d) ctx %08x%08x slot %ld flags %c %c", -+ cdnsp_trb_type_string(type), -+ ep_num, ep_id % 2 ? "out" : "in", -+ TRB_TO_EP_INDEX(field3), field1, field0, -+ TRB_TO_SLOT_ID(field3), -+ field3 & TRB_CYCLE ? 'C' : 'c', -+ field3 & TRB_ESP ? 'P' : 'p'); - break; - case TRB_STOP_RING: -- ret = snprintf(str, size, -- "%s: ep%d%s(%d) slot %ld sp %d flags %c", -- cdnsp_trb_type_string(type), -- ep_num, ep_id % 2 ? "out" : "in", -- TRB_TO_EP_INDEX(field3), -- TRB_TO_SLOT_ID(field3), -- TRB_TO_SUSPEND_PORT(field3), -- field3 & TRB_CYCLE ? 'C' : 'c'); -+ ret = scnprintf(str, size, -+ "%s: ep%d%s(%d) slot %ld sp %d flags %c", -+ cdnsp_trb_type_string(type), -+ ep_num, ep_id % 2 ? "out" : "in", -+ TRB_TO_EP_INDEX(field3), -+ TRB_TO_SLOT_ID(field3), -+ TRB_TO_SUSPEND_PORT(field3), -+ field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_SET_DEQ: -- ret = snprintf(str, size, -- "%s: ep%d%s(%d) deq %08x%08x stream %ld slot %ld flags %c", -- cdnsp_trb_type_string(type), -- ep_num, ep_id % 2 ? "out" : "in", -- TRB_TO_EP_INDEX(field3), field1, field0, -- TRB_TO_STREAM_ID(field2), -- TRB_TO_SLOT_ID(field3), -- field3 & TRB_CYCLE ? 'C' : 'c'); -+ ret = scnprintf(str, size, -+ "%s: ep%d%s(%d) deq %08x%08x stream %ld slot %ld flags %c", -+ cdnsp_trb_type_string(type), -+ ep_num, ep_id % 2 ? "out" : "in", -+ TRB_TO_EP_INDEX(field3), field1, field0, -+ TRB_TO_STREAM_ID(field2), -+ TRB_TO_SLOT_ID(field3), -+ field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_RESET_DEV: -- ret = snprintf(str, size, "%s: slot %ld flags %c", -- cdnsp_trb_type_string(type), -- TRB_TO_SLOT_ID(field3), -- field3 & TRB_CYCLE ? 'C' : 'c'); -+ ret = scnprintf(str, size, "%s: slot %ld flags %c", -+ cdnsp_trb_type_string(type), -+ TRB_TO_SLOT_ID(field3), -+ field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_ENDPOINT_NRDY: - temp = TRB_TO_HOST_STREAM(field2); - -- ret = snprintf(str, size, -- "%s: ep%d%s(%d) H_SID %x%s%s D_SID %lx flags %c:%c", -- cdnsp_trb_type_string(type), -- ep_num, ep_id % 2 ? "out" : "in", -- TRB_TO_EP_INDEX(field3), temp, -- temp == STREAM_PRIME_ACK ? "(PRIME)" : "", -- temp == STREAM_REJECTED ? "(REJECTED)" : "", -- TRB_TO_DEV_STREAM(field0), -- field3 & TRB_STAT ? 'S' : 's', -- field3 & TRB_CYCLE ? 'C' : 'c'); -+ ret = scnprintf(str, size, -+ "%s: ep%d%s(%d) H_SID %x%s%s D_SID %lx flags %c:%c", -+ cdnsp_trb_type_string(type), -+ ep_num, ep_id % 2 ? "out" : "in", -+ TRB_TO_EP_INDEX(field3), temp, -+ temp == STREAM_PRIME_ACK ? "(PRIME)" : "", -+ temp == STREAM_REJECTED ? "(REJECTED)" : "", -+ TRB_TO_DEV_STREAM(field0), -+ field3 & TRB_STAT ? 'S' : 's', -+ field3 & TRB_CYCLE ? 'C' : 'c'); - break; - default: -- ret = snprintf(str, size, -- "type '%s' -> raw %08x %08x %08x %08x", -- cdnsp_trb_type_string(type), -- field0, field1, field2, field3); -+ ret = scnprintf(str, size, -+ "type '%s' -> raw %08x %08x %08x %08x", -+ cdnsp_trb_type_string(type), -+ field0, field1, field2, field3); - } - -- if (ret >= size) -- pr_info("CDNSP: buffer overflowed.\n"); -+ if (ret == size - 1) -+ pr_info("CDNSP: buffer may be truncated.\n"); - - return str; - } -@@ -468,32 +466,32 @@ static inline const char *cdnsp_decode_portsc(char *str, size_t size, - { - int ret; - -- ret = snprintf(str, size, "%s %s %s Link:%s PortSpeed:%d ", -- portsc & PORT_POWER ? "Powered" : "Powered-off", -- portsc & PORT_CONNECT ? "Connected" : "Not-connected", -- portsc & PORT_PED ? "Enabled" : "Disabled", -- cdnsp_portsc_link_state_string(portsc), -- DEV_PORT_SPEED(portsc)); -+ ret = scnprintf(str, size, "%s %s %s Link:%s PortSpeed:%d ", -+ portsc & PORT_POWER ? "Powered" : "Powered-off", -+ portsc & PORT_CONNECT ? "Connected" : "Not-connected", -+ portsc & PORT_PED ? "Enabled" : "Disabled", -+ cdnsp_portsc_link_state_string(portsc), -+ DEV_PORT_SPEED(portsc)); - - if (portsc & PORT_RESET) -- ret += snprintf(str + ret, size - ret, "In-Reset "); -+ ret += scnprintf(str + ret, size - ret, "In-Reset "); - -- ret += snprintf(str + ret, size - ret, "Change: "); -+ ret += scnprintf(str + ret, size - ret, "Change: "); - if (portsc & PORT_CSC) -- ret += snprintf(str + ret, size - ret, "CSC "); -+ ret += scnprintf(str + ret, size - ret, "CSC "); - if (portsc & PORT_WRC) -- ret += snprintf(str + ret, size - ret, "WRC "); -+ ret += scnprintf(str + ret, size - ret, "WRC "); - if (portsc & PORT_RC) -- ret += snprintf(str + ret, size - ret, "PRC "); -+ ret += scnprintf(str + ret, size - ret, "PRC "); - if (portsc & PORT_PLC) -- ret += snprintf(str + ret, size - ret, "PLC "); -+ ret += scnprintf(str + ret, size - ret, "PLC "); - if (portsc & PORT_CEC) -- ret += snprintf(str + ret, size - ret, "CEC "); -- ret += snprintf(str + ret, size - ret, "Wake: "); -+ ret += scnprintf(str + ret, size - ret, "CEC "); -+ ret += scnprintf(str + ret, size - ret, "Wake: "); - if (portsc & PORT_WKCONN_E) -- ret += snprintf(str + ret, size - ret, "WCE "); -+ ret += scnprintf(str + ret, size - ret, "WCE "); - if (portsc & PORT_WKDISC_E) -- ret += snprintf(str + ret, size - ret, "WDE "); -+ ret += scnprintf(str + ret, size - ret, "WDE "); - - return str; - } -@@ -565,20 +563,20 @@ static inline const char *cdnsp_decode_ep_context(char *str, size_t size, - - avg = EP_AVG_TRB_LENGTH(tx_info); - -- ret = snprintf(str, size, "State %s mult %d max P. Streams %d %s", -- cdnsp_ep_state_string(ep_state), mult, -- max_pstr, lsa ? "LSA " : ""); -+ ret = scnprintf(str, size, "State %s mult %d max P. Streams %d %s", -+ cdnsp_ep_state_string(ep_state), mult, -+ max_pstr, lsa ? "LSA " : ""); - -- ret += snprintf(str + ret, size - ret, -- "interval %d us max ESIT payload %d CErr %d ", -- (1 << interval) * 125, esit, cerr); -+ ret += scnprintf(str + ret, size - ret, -+ "interval %d us max ESIT payload %d CErr %d ", -+ (1 << interval) * 125, esit, cerr); - -- ret += snprintf(str + ret, size - ret, -- "Type %s %sburst %d maxp %d deq %016llx ", -- cdnsp_ep_type_string(ep_type), hid ? "HID" : "", -- burst, maxp, deq); -+ ret += scnprintf(str + ret, size - ret, -+ "Type %s %sburst %d maxp %d deq %016llx ", -+ cdnsp_ep_type_string(ep_type), hid ? "HID" : "", -+ burst, maxp, deq); - -- ret += snprintf(str + ret, size - ret, "avg trb len %d", avg); -+ ret += scnprintf(str + ret, size - ret, "avg trb len %d", avg); - - return str; - } -diff --git a/drivers/usb/cdns3/cdnsp-ep0.c b/drivers/usb/cdns3/cdnsp-ep0.c -index f317d3c8478108..5cd9b898ce971f 100644 ---- a/drivers/usb/cdns3/cdnsp-ep0.c -+++ b/drivers/usb/cdns3/cdnsp-ep0.c -@@ -414,6 +414,7 @@ static int cdnsp_ep0_std_request(struct cdnsp_device *pdev, - void cdnsp_setup_analyze(struct cdnsp_device *pdev) - { - struct usb_ctrlrequest *ctrl = &pdev->setup; -+ struct cdnsp_ep *pep; - int ret = -EINVAL; - u16 len; - -@@ -427,10 +428,21 @@ void cdnsp_setup_analyze(struct cdnsp_device *pdev) - goto out; - } - -+ pep = &pdev->eps[0]; -+ - /* Restore the ep0 to Stopped/Running state. */ -- if (pdev->eps[0].ep_state & EP_HALTED) { -- trace_cdnsp_ep0_halted("Restore to normal state"); -- cdnsp_halt_endpoint(pdev, &pdev->eps[0], 0); -+ if (pep->ep_state & EP_HALTED) { -+ if (GET_EP_CTX_STATE(pep->out_ctx) == EP_STATE_HALTED) -+ cdnsp_halt_endpoint(pdev, pep, 0); -+ -+ /* -+ * Halt Endpoint Command for SSP2 for ep0 preserve current -+ * endpoint state and driver has to synchronize the -+ * software endpoint state with endpoint output context -+ * state. -+ */ -+ pep->ep_state &= ~EP_HALTED; -+ pep->ep_state |= EP_STOPPED; - } - - /* -diff --git a/drivers/usb/cdns3/cdnsp-gadget.c b/drivers/usb/cdns3/cdnsp-gadget.c -index 132885fbb98f67..38e693cd3efc05 100644 ---- a/drivers/usb/cdns3/cdnsp-gadget.c -+++ b/drivers/usb/cdns3/cdnsp-gadget.c -@@ -1061,10 +1061,8 @@ static int cdnsp_gadget_ep_disable(struct usb_ep *ep) - pep->ep_state |= EP_DIS_IN_RROGRESS; - - /* Endpoint was unconfigured by Reset Device command. */ -- if (!(pep->ep_state & EP_UNCONFIGURED)) { -+ if (!(pep->ep_state & EP_UNCONFIGURED)) - cdnsp_cmd_stop_ep(pdev, pep); -- cdnsp_cmd_flush_ep(pdev, pep); -- } - - /* Remove all queued USB requests. */ - while (!list_empty(&pep->pending_list)) { -@@ -1461,8 +1459,6 @@ static void cdnsp_stop(struct cdnsp_device *pdev) - { - u32 temp; - -- cdnsp_cmd_flush_ep(pdev, &pdev->eps[0]); -- - /* Remove internally queued request for ep0. */ - if (!list_empty(&pdev->eps[0].pending_list)) { - struct cdnsp_request *req; -diff --git a/drivers/usb/cdns3/cdnsp-gadget.h b/drivers/usb/cdns3/cdnsp-gadget.h -index 909cee01772a70..a91cca509db080 100644 ---- a/drivers/usb/cdns3/cdnsp-gadget.h -+++ b/drivers/usb/cdns3/cdnsp-gadget.h -@@ -987,6 +987,12 @@ enum cdnsp_setup_dev { - #define STREAM_ID_FOR_TRB(p) ((((p)) << 16) & GENMASK(31, 16)) - #define SCT_FOR_TRB(p) (((p) << 1) & 0x7) - -+/* -+ * Halt Endpoint Command TRB field. -+ * The ESP bit only exists in the SSP2 controller. -+ */ -+#define TRB_ESP BIT(9) -+ - /* Link TRB specific fields. */ - #define TRB_TC BIT(1) - -@@ -1138,8 +1144,6 @@ union cdnsp_trb { - #define TRB_HALT_ENDPOINT 54 - /* Doorbell Overflow Event. */ - #define TRB_DRB_OVERFLOW 57 --/* Flush Endpoint Command. */ --#define TRB_FLUSH_ENDPOINT 58 - - #define TRB_TYPE_LINK(x) (((x) & TRB_TYPE_BITMASK) == TRB_TYPE(TRB_LINK)) - #define TRB_TYPE_LINK_LE32(x) (((x) & cpu_to_le32(TRB_TYPE_BITMASK)) == \ -@@ -1552,8 +1556,6 @@ void cdnsp_queue_configure_endpoint(struct cdnsp_device *pdev, - void cdnsp_queue_reset_ep(struct cdnsp_device *pdev, unsigned int ep_index); - void cdnsp_queue_halt_endpoint(struct cdnsp_device *pdev, - unsigned int ep_index); --void cdnsp_queue_flush_endpoint(struct cdnsp_device *pdev, -- unsigned int ep_index); - void cdnsp_force_header_wakeup(struct cdnsp_device *pdev, int intf_num); - void cdnsp_queue_reset_device(struct cdnsp_device *pdev); - void cdnsp_queue_new_dequeue_state(struct cdnsp_device *pdev, -@@ -1587,7 +1589,6 @@ void cdnsp_irq_reset(struct cdnsp_device *pdev); - int cdnsp_halt_endpoint(struct cdnsp_device *pdev, - struct cdnsp_ep *pep, int value); - int cdnsp_cmd_stop_ep(struct cdnsp_device *pdev, struct cdnsp_ep *pep); --int cdnsp_cmd_flush_ep(struct cdnsp_device *pdev, struct cdnsp_ep *pep); - void cdnsp_setup_analyze(struct cdnsp_device *pdev); - int cdnsp_status_stage(struct cdnsp_device *pdev); - int cdnsp_reset_device(struct cdnsp_device *pdev); -diff --git a/drivers/usb/cdns3/cdnsp-ring.c b/drivers/usb/cdns3/cdnsp-ring.c -index 3b17d9e4b07d8c..0758f171f73ecf 100644 ---- a/drivers/usb/cdns3/cdnsp-ring.c -+++ b/drivers/usb/cdns3/cdnsp-ring.c -@@ -2159,19 +2159,6 @@ int cdnsp_cmd_stop_ep(struct cdnsp_device *pdev, struct cdnsp_ep *pep) - return ret; - } - --int cdnsp_cmd_flush_ep(struct cdnsp_device *pdev, struct cdnsp_ep *pep) --{ -- int ret; -- -- cdnsp_queue_flush_endpoint(pdev, pep->idx); -- cdnsp_ring_cmd_db(pdev); -- ret = cdnsp_wait_for_cmd_compl(pdev); -- -- trace_cdnsp_handle_cmd_flush_ep(pep->out_ctx); -- -- return ret; --} -- - /* - * The transfer burst count field of the isochronous TRB defines the number of - * bursts that are required to move all packets in this TD. Only SuperSpeed -@@ -2498,18 +2485,8 @@ void cdnsp_queue_halt_endpoint(struct cdnsp_device *pdev, unsigned int ep_index) - { - cdnsp_queue_command(pdev, 0, 0, 0, TRB_TYPE(TRB_HALT_ENDPOINT) | - SLOT_ID_FOR_TRB(pdev->slot_id) | -- EP_ID_FOR_TRB(ep_index)); --} -- --/* -- * Queue a flush endpoint request on the command ring. -- */ --void cdnsp_queue_flush_endpoint(struct cdnsp_device *pdev, -- unsigned int ep_index) --{ -- cdnsp_queue_command(pdev, 0, 0, 0, TRB_TYPE(TRB_FLUSH_ENDPOINT) | -- SLOT_ID_FOR_TRB(pdev->slot_id) | -- EP_ID_FOR_TRB(ep_index)); -+ EP_ID_FOR_TRB(ep_index) | -+ (!ep_index ? TRB_ESP : 0)); - } - - void cdnsp_force_header_wakeup(struct cdnsp_device *pdev, int intf_num) -diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c -index 30404461ef7de3..b7eaad099309c5 100644 ---- a/drivers/usb/dwc3/core.c -+++ b/drivers/usb/dwc3/core.c -@@ -2128,6 +2128,7 @@ static int dwc3_core_init_for_resume(struct dwc3 *dwc) - static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg) - { - u32 reg; -+ int ret; - - if (!pm_runtime_suspended(dwc->dev) && !PMSG_IS_AUTO(msg)) { - dwc->susphy_state = (dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0)) & -@@ -2146,7 +2147,9 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg) - case DWC3_GCTL_PRTCAP_DEVICE: - if (pm_runtime_suspended(dwc->dev)) - break; -- dwc3_gadget_suspend(dwc); -+ ret = dwc3_gadget_suspend(dwc); -+ if (ret) -+ return ret; - synchronize_irq(dwc->irq_gadget); - dwc3_core_exit(dwc); - break; -@@ -2177,7 +2180,9 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg) - break; - - if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) { -- dwc3_gadget_suspend(dwc); -+ ret = dwc3_gadget_suspend(dwc); -+ if (ret) -+ return ret; - synchronize_irq(dwc->irq_gadget); - } - -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index f51d743bb3ecc6..a17af4ab20a323 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -4802,26 +4802,22 @@ int dwc3_gadget_suspend(struct dwc3 *dwc) - int ret; - - ret = dwc3_gadget_soft_disconnect(dwc); -- if (ret) -- goto err; -- -- spin_lock_irqsave(&dwc->lock, flags); -- if (dwc->gadget_driver) -- dwc3_disconnect_gadget(dwc); -- spin_unlock_irqrestore(&dwc->lock, flags); -- -- return 0; -- --err: - /* - * Attempt to reset the controller's state. Likely no - * communication can be established until the host - * performs a port reset. - */ -- if (dwc->softconnect) -+ if (ret && dwc->softconnect) { - dwc3_gadget_soft_connect(dwc); -+ return -EAGAIN; -+ } - -- return ret; -+ spin_lock_irqsave(&dwc->lock, flags); -+ if (dwc->gadget_driver) -+ dwc3_disconnect_gadget(dwc); -+ spin_unlock_irqrestore(&dwc->lock, flags); -+ -+ return 0; - } - - int dwc3_gadget_resume(struct dwc3 *dwc) -diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c -index 729b0472bab098..4925c874316cb2 100644 ---- a/drivers/usb/gadget/function/u_serial.c -+++ b/drivers/usb/gadget/function/u_serial.c -@@ -291,8 +291,8 @@ __acquires(&port->port_lock) - break; - } - -- if (do_tty_wake && port->port.tty) -- tty_wakeup(port->port.tty); -+ if (do_tty_wake) -+ tty_port_tty_wakeup(&port->port); - return status; - } - -@@ -539,20 +539,16 @@ static int gs_alloc_requests(struct usb_ep *ep, struct list_head *head, - static int gs_start_io(struct gs_port *port) - { - struct list_head *head = &port->read_pool; -- struct usb_ep *ep; -+ struct usb_ep *ep = port->port_usb->out; - int status; - unsigned started; - -- if (!port->port_usb || !port->port.tty) -- return -EIO; -- - /* Allocate RX and TX I/O buffers. We can't easily do this much - * earlier (with GFP_KERNEL) because the requests are coupled to - * endpoints, as are the packet sizes we'll be using. Different - * configurations may use different endpoints with a given port; - * and high speed vs full speed changes packet sizes too. - */ -- ep = port->port_usb->out; - status = gs_alloc_requests(ep, head, gs_read_complete, - &port->read_allocated); - if (status) -@@ -573,7 +569,7 @@ static int gs_start_io(struct gs_port *port) - gs_start_tx(port); - /* Unblock any pending writes into our circular buffer, in case - * we didn't in gs_start_tx() */ -- tty_wakeup(port->port.tty); -+ tty_port_tty_wakeup(&port->port); - } else { - /* Free reqs only if we are still connected */ - if (port->port_usb) { -diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h -index ec6679a538c1dc..c23c56ead6b236 100644 ---- a/fs/btrfs/btrfs_inode.h -+++ b/fs/btrfs/btrfs_inode.h -@@ -488,7 +488,7 @@ struct extent_map *btrfs_get_extent(struct btrfs_inode *inode, - int btrfs_update_inode(struct btrfs_trans_handle *trans, - struct btrfs_root *root, struct btrfs_inode *inode); - int btrfs_update_inode_fallback(struct btrfs_trans_handle *trans, -- struct btrfs_root *root, struct btrfs_inode *inode); -+ struct btrfs_inode *inode); - int btrfs_orphan_add(struct btrfs_trans_handle *trans, struct btrfs_inode *inode); - int btrfs_orphan_cleanup(struct btrfs_root *root); - int btrfs_cont_expand(struct btrfs_inode *inode, loff_t oldsize, loff_t size); -diff --git a/fs/btrfs/free-space-tree.c b/fs/btrfs/free-space-tree.c -index a0d8160b537572..300ee0b68b498e 100644 ---- a/fs/btrfs/free-space-tree.c -+++ b/fs/btrfs/free-space-tree.c -@@ -1104,11 +1104,21 @@ static int populate_free_space_tree(struct btrfs_trans_handle *trans, - ret = btrfs_search_slot_for_read(extent_root, &key, path, 1, 0); - if (ret < 0) - goto out_locked; -- ASSERT(ret == 0); -+ /* -+ * If ret is 1 (no key found), it means this is an empty block group, -+ * without any extents allocated from it and there's no block group -+ * item (key BTRFS_BLOCK_GROUP_ITEM_KEY) located in the extent tree -+ * because we are using the block group tree feature, so block group -+ * items are stored in the block group tree. It also means there are no -+ * extents allocated for block groups with a start offset beyond this -+ * block group's end offset (this is the last, highest, block group). -+ */ -+ if (!btrfs_fs_compat_ro(trans->fs_info, BLOCK_GROUP_TREE)) -+ ASSERT(ret == 0); - - start = block_group->start; - end = block_group->start + block_group->length; -- while (1) { -+ while (ret == 0) { - btrfs_item_key_to_cpu(path->nodes[0], &key, path->slots[0]); - - if (key.type == BTRFS_EXTENT_ITEM_KEY || -@@ -1138,8 +1148,6 @@ static int populate_free_space_tree(struct btrfs_trans_handle *trans, - ret = btrfs_next_item(extent_root, path); - if (ret < 0) - goto out_locked; -- if (ret) -- break; - } - if (start < end) { - ret = __add_to_free_space_tree(trans, block_group, path2, -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index e8e57abb032d7a..218d15f5ddf737 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -3077,7 +3077,7 @@ int btrfs_finish_one_ordered(struct btrfs_ordered_extent *ordered_extent) - goto out; - } - trans->block_rsv = &inode->block_rsv; -- ret = btrfs_update_inode_fallback(trans, root, inode); -+ ret = btrfs_update_inode_fallback(trans, inode); - if (ret) /* -ENOMEM or corruption */ - btrfs_abort_transaction(trans, ret); - goto out; -@@ -3143,7 +3143,7 @@ int btrfs_finish_one_ordered(struct btrfs_ordered_extent *ordered_extent) - &cached_state); - - btrfs_inode_safe_disk_i_size_write(inode, 0); -- ret = btrfs_update_inode_fallback(trans, root, inode); -+ ret = btrfs_update_inode_fallback(trans, inode); - if (ret) { /* -ENOMEM or corruption */ - btrfs_abort_transaction(trans, ret); - goto out; -@@ -4014,9 +4014,9 @@ static noinline int btrfs_update_inode_item(struct btrfs_trans_handle *trans, - /* - * copy everything in the in-memory inode into the btree. - */ --noinline int btrfs_update_inode(struct btrfs_trans_handle *trans, -- struct btrfs_root *root, -- struct btrfs_inode *inode) -+int btrfs_update_inode(struct btrfs_trans_handle *trans, -+ struct btrfs_root *root, -+ struct btrfs_inode *inode) - { - struct btrfs_fs_info *fs_info = root->fs_info; - int ret; -@@ -4043,13 +4043,13 @@ noinline int btrfs_update_inode(struct btrfs_trans_handle *trans, - } - - int btrfs_update_inode_fallback(struct btrfs_trans_handle *trans, -- struct btrfs_root *root, struct btrfs_inode *inode) -+ struct btrfs_inode *inode) - { - int ret; - -- ret = btrfs_update_inode(trans, root, inode); -+ ret = btrfs_update_inode(trans, inode->root, inode); - if (ret == -ENOSPC) -- return btrfs_update_inode_item(trans, root, inode); -+ return btrfs_update_inode_item(trans, inode->root, inode); - return ret; - } - -@@ -4327,7 +4327,7 @@ static int btrfs_unlink_subvol(struct btrfs_trans_handle *trans, - btrfs_i_size_write(dir, dir->vfs_inode.i_size - fname.disk_name.len * 2); - inode_inc_iversion(&dir->vfs_inode); - dir->vfs_inode.i_mtime = inode_set_ctime_current(&dir->vfs_inode); -- ret = btrfs_update_inode_fallback(trans, root, dir); -+ ret = btrfs_update_inode_fallback(trans, dir); - if (ret) - btrfs_abort_transaction(trans, ret); - out: -diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c -index aa03db69a0164c..3989cb19cdae70 100644 ---- a/fs/btrfs/transaction.c -+++ b/fs/btrfs/transaction.c -@@ -1860,7 +1860,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans, - btrfs_i_size_write(BTRFS_I(parent_inode), parent_inode->i_size + - fname.disk_name.len * 2); - parent_inode->i_mtime = inode_set_ctime_current(parent_inode); -- ret = btrfs_update_inode_fallback(trans, parent_root, BTRFS_I(parent_inode)); -+ ret = btrfs_update_inode_fallback(trans, BTRFS_I(parent_inode)); - if (ret) { - btrfs_abort_transaction(trans, ret); - goto fail; -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index 13377c3b22897d..16434106c465db 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -140,11 +140,14 @@ static void wait_log_commit(struct btrfs_root *root, int transid); - * and once to do all the other items. - */ - --static struct inode *btrfs_iget_logging(u64 objectid, struct btrfs_root *root) -+static struct btrfs_inode *btrfs_iget_logging(u64 objectid, struct btrfs_root *root) - { - unsigned int nofs_flag; - struct inode *inode; - -+ /* Only meant to be called for subvolume roots and not for log roots. */ -+ ASSERT(is_fstree(btrfs_root_id(root))); -+ - /* - * We're holding a transaction handle whether we are logging or - * replaying a log tree, so we must make sure NOFS semantics apply -@@ -156,7 +159,10 @@ static struct inode *btrfs_iget_logging(u64 objectid, struct btrfs_root *root) - inode = btrfs_iget(root->fs_info->sb, objectid, root); - memalloc_nofs_restore(nofs_flag); - -- return inode; -+ if (IS_ERR(inode)) -+ return ERR_CAST(inode); -+ -+ return BTRFS_I(inode); - } - - /* -@@ -613,20 +619,6 @@ static int read_alloc_one_name(struct extent_buffer *eb, void *start, int len, - return 0; - } - --/* -- * simple helper to read an inode off the disk from a given root -- * This can only be called for subvolume roots and not for the log -- */ --static noinline struct inode *read_one_inode(struct btrfs_root *root, -- u64 objectid) --{ -- struct inode *inode; -- -- inode = btrfs_iget_logging(objectid, root); -- if (IS_ERR(inode)) -- inode = NULL; -- return inode; --} - - /* replays a single extent in 'eb' at 'slot' with 'key' into the - * subvolume 'root'. path is released on entry and should be released -@@ -681,10 +673,15 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans, - goto out; - } - -- inode = read_one_inode(root, key->objectid); -- if (!inode) { -- ret = -EIO; -- goto out; -+ { -+ struct btrfs_inode *btrfs_inode; -+ -+ btrfs_inode = btrfs_iget_logging(key->objectid, root); -+ if (IS_ERR(btrfs_inode)) { -+ ret = PTR_ERR(btrfs_inode); -+ goto out; -+ } -+ inode = &btrfs_inode->vfs_inode; - } - - /* -@@ -963,10 +960,16 @@ static noinline int drop_one_dir_item(struct btrfs_trans_handle *trans, - - btrfs_release_path(path); - -- inode = read_one_inode(root, location.objectid); -- if (!inode) { -- ret = -EIO; -- goto out; -+ { -+ struct btrfs_inode *btrfs_inode; -+ -+ btrfs_inode = btrfs_iget_logging(location.objectid, root); -+ if (IS_ERR(btrfs_inode)) { -+ ret = PTR_ERR(btrfs_inode); -+ inode = NULL; -+ goto out; -+ } -+ inode = &btrfs_inode->vfs_inode; - } - - ret = link_to_fixup_dir(trans, root, path, location.objectid); -@@ -1183,18 +1186,21 @@ static inline int __add_inode_ref(struct btrfs_trans_handle *trans, - kfree(victim_name.name); - return ret; - } else if (!ret) { -- ret = -ENOENT; -- victim_parent = read_one_inode(root, -- parent_objectid); -- if (victim_parent) { -+ struct btrfs_inode *btrfs_victim; -+ -+ btrfs_victim = btrfs_iget_logging(parent_objectid, root); -+ if (IS_ERR(btrfs_victim)) { -+ ret = PTR_ERR(btrfs_victim); -+ } else { -+ victim_parent = &btrfs_victim->vfs_inode; - inc_nlink(&inode->vfs_inode); - btrfs_release_path(path); - - ret = unlink_inode_for_log_replay(trans, - BTRFS_I(victim_parent), - inode, &victim_name); -+ iput(victim_parent); - } -- iput(victim_parent); - kfree(victim_name.name); - if (ret) - return ret; -@@ -1331,11 +1337,16 @@ static int unlink_old_inode_refs(struct btrfs_trans_handle *trans, - struct inode *dir; - - btrfs_release_path(path); -- dir = read_one_inode(root, parent_id); -- if (!dir) { -- ret = -ENOENT; -- kfree(name.name); -- goto out; -+ { -+ struct btrfs_inode *btrfs_dir; -+ -+ btrfs_dir = btrfs_iget_logging(parent_id, root); -+ if (IS_ERR(btrfs_dir)) { -+ ret = PTR_ERR(btrfs_dir); -+ kfree(name.name); -+ goto out; -+ } -+ dir = &btrfs_dir->vfs_inode; - } - ret = unlink_inode_for_log_replay(trans, BTRFS_I(dir), - inode, &name); -@@ -1406,16 +1417,28 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans, - * copy the back ref in. The link count fixup code will take - * care of the rest - */ -- dir = read_one_inode(root, parent_objectid); -- if (!dir) { -- ret = -ENOENT; -- goto out; -+ { -+ struct btrfs_inode *btrfs_dir; -+ -+ btrfs_dir = btrfs_iget_logging(parent_objectid, root); -+ if (IS_ERR(btrfs_dir)) { -+ ret = PTR_ERR(btrfs_dir); -+ dir = NULL; -+ goto out; -+ } -+ dir = &btrfs_dir->vfs_inode; - } - -- inode = read_one_inode(root, inode_objectid); -- if (!inode) { -- ret = -EIO; -- goto out; -+ { -+ struct btrfs_inode *btrfs_inode; -+ -+ btrfs_inode = btrfs_iget_logging(inode_objectid, root); -+ if (IS_ERR(btrfs_inode)) { -+ ret = PTR_ERR(btrfs_inode); -+ inode = NULL; -+ goto out; -+ } -+ inode = &btrfs_inode->vfs_inode; - } - - while (ref_ptr < ref_end) { -@@ -1426,11 +1449,16 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans, - * parent object can change from one array - * item to another. - */ -- if (!dir) -- dir = read_one_inode(root, parent_objectid); - if (!dir) { -- ret = -ENOENT; -- goto out; -+ struct btrfs_inode *btrfs_dir; -+ -+ btrfs_dir = btrfs_iget_logging(parent_objectid, root); -+ if (IS_ERR(btrfs_dir)) { -+ ret = PTR_ERR(btrfs_dir); -+ dir = NULL; -+ goto out; -+ } -+ dir = &btrfs_dir->vfs_inode; - } - } else { - ret = ref_get_fields(eb, ref_ptr, &name, &ref_index); -@@ -1504,8 +1532,7 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans, - return ret; - } - --static int count_inode_extrefs(struct btrfs_root *root, -- struct btrfs_inode *inode, struct btrfs_path *path) -+static int count_inode_extrefs(struct btrfs_inode *inode, struct btrfs_path *path) - { - int ret = 0; - int name_len; -@@ -1519,8 +1546,8 @@ static int count_inode_extrefs(struct btrfs_root *root, - struct extent_buffer *leaf; - - while (1) { -- ret = btrfs_find_one_extref(root, inode_objectid, offset, path, -- &extref, &offset); -+ ret = btrfs_find_one_extref(inode->root, inode_objectid, offset, -+ path, &extref, &offset); - if (ret) - break; - -@@ -1548,8 +1575,7 @@ static int count_inode_extrefs(struct btrfs_root *root, - return nlink; - } - --static int count_inode_refs(struct btrfs_root *root, -- struct btrfs_inode *inode, struct btrfs_path *path) -+static int count_inode_refs(struct btrfs_inode *inode, struct btrfs_path *path) - { - int ret; - struct btrfs_key key; -@@ -1564,7 +1590,7 @@ static int count_inode_refs(struct btrfs_root *root, - key.offset = (u64)-1; - - while (1) { -- ret = btrfs_search_slot(NULL, root, &key, path, 0, 0); -+ ret = btrfs_search_slot(NULL, inode->root, &key, path, 0, 0); - if (ret < 0) - break; - if (ret > 0) { -@@ -1616,9 +1642,9 @@ static int count_inode_refs(struct btrfs_root *root, - * will free the inode. - */ - static noinline int fixup_inode_link_count(struct btrfs_trans_handle *trans, -- struct btrfs_root *root, - struct inode *inode) - { -+ struct btrfs_root *root = BTRFS_I(inode)->root; - struct btrfs_path *path; - int ret; - u64 nlink = 0; -@@ -1628,13 +1654,13 @@ static noinline int fixup_inode_link_count(struct btrfs_trans_handle *trans, - if (!path) - return -ENOMEM; - -- ret = count_inode_refs(root, BTRFS_I(inode), path); -+ ret = count_inode_refs(BTRFS_I(inode), path); - if (ret < 0) - goto out; - - nlink = ret; - -- ret = count_inode_extrefs(root, BTRFS_I(inode), path); -+ ret = count_inode_extrefs(BTRFS_I(inode), path); - if (ret < 0) - goto out; - -@@ -1700,13 +1726,18 @@ static noinline int fixup_inode_link_counts(struct btrfs_trans_handle *trans, - break; - - btrfs_release_path(path); -- inode = read_one_inode(root, key.offset); -- if (!inode) { -- ret = -EIO; -- break; -+ { -+ struct btrfs_inode *btrfs_inode; -+ -+ btrfs_inode = btrfs_iget_logging(key.offset, root); -+ if (IS_ERR(btrfs_inode)) { -+ ret = PTR_ERR(btrfs_inode); -+ break; -+ } -+ inode = &btrfs_inode->vfs_inode; - } - -- ret = fixup_inode_link_count(trans, root, inode); -+ ret = fixup_inode_link_count(trans, inode); - iput(inode); - if (ret) - break; -@@ -1737,9 +1768,14 @@ static noinline int link_to_fixup_dir(struct btrfs_trans_handle *trans, - int ret = 0; - struct inode *inode; - -- inode = read_one_inode(root, objectid); -- if (!inode) -- return -EIO; -+ { -+ struct btrfs_inode *btrfs_inode; -+ -+ btrfs_inode = btrfs_iget_logging(objectid, root); -+ if (IS_ERR(btrfs_inode)) -+ return PTR_ERR(btrfs_inode); -+ inode = &btrfs_inode->vfs_inode; -+ } - - key.objectid = BTRFS_TREE_LOG_FIXUP_OBJECTID; - key.type = BTRFS_ORPHAN_ITEM_KEY; -@@ -1777,14 +1813,24 @@ static noinline int insert_one_name(struct btrfs_trans_handle *trans, - struct inode *dir; - int ret; - -- inode = read_one_inode(root, location->objectid); -- if (!inode) -- return -ENOENT; -+ { -+ struct btrfs_inode *btrfs_inode; - -- dir = read_one_inode(root, dirid); -- if (!dir) { -- iput(inode); -- return -EIO; -+ btrfs_inode = btrfs_iget_logging(location->objectid, root); -+ if (IS_ERR(btrfs_inode)) -+ return PTR_ERR(btrfs_inode); -+ inode = &btrfs_inode->vfs_inode; -+ } -+ -+ { -+ struct btrfs_inode *btrfs_dir; -+ -+ btrfs_dir = btrfs_iget_logging(dirid, root); -+ if (IS_ERR(btrfs_dir)) { -+ iput(inode); -+ return PTR_ERR(btrfs_dir); -+ } -+ dir = &btrfs_dir->vfs_inode; - } - - ret = btrfs_add_link(trans, BTRFS_I(dir), BTRFS_I(inode), name, -@@ -1862,9 +1908,14 @@ static noinline int replay_one_name(struct btrfs_trans_handle *trans, - bool update_size = true; - bool name_added = false; - -- dir = read_one_inode(root, key->objectid); -- if (!dir) -- return -EIO; -+ { -+ struct btrfs_inode *btrfs_dir; -+ -+ btrfs_dir = btrfs_iget_logging(key->objectid, root); -+ if (IS_ERR(btrfs_dir)) -+ return PTR_ERR(btrfs_dir); -+ dir = &btrfs_dir->vfs_inode; -+ } - - ret = read_alloc_one_name(eb, di + 1, btrfs_dir_name_len(eb, di), &name); - if (ret) -@@ -2166,10 +2217,16 @@ static noinline int check_item_in_log(struct btrfs_trans_handle *trans, - btrfs_dir_item_key_to_cpu(eb, di, &location); - btrfs_release_path(path); - btrfs_release_path(log_path); -- inode = read_one_inode(root, location.objectid); -- if (!inode) { -- ret = -EIO; -- goto out; -+ { -+ struct btrfs_inode *btrfs_inode; -+ -+ btrfs_inode = btrfs_iget_logging(location.objectid, root); -+ if (IS_ERR(btrfs_inode)) { -+ ret = PTR_ERR(btrfs_inode); -+ inode = NULL; -+ goto out; -+ } -+ inode = &btrfs_inode->vfs_inode; - } - - ret = link_to_fixup_dir(trans, root, path, location.objectid); -@@ -2320,14 +2377,22 @@ static noinline int replay_dir_deletes(struct btrfs_trans_handle *trans, - if (!log_path) - return -ENOMEM; - -- dir = read_one_inode(root, dirid); -- /* it isn't an error if the inode isn't there, that can happen -- * because we replay the deletes before we copy in the inode item -- * from the log -- */ -- if (!dir) { -- btrfs_free_path(log_path); -- return 0; -+ { -+ struct btrfs_inode *btrfs_dir; -+ -+ btrfs_dir = btrfs_iget_logging(dirid, root); -+ /* -+ * It isn't an error if the inode isn't there, that can happen because -+ * we replay the deletes before we copy in the inode item from the log. -+ */ -+ if (IS_ERR(btrfs_dir)) { -+ btrfs_free_path(log_path); -+ ret = PTR_ERR(btrfs_dir); -+ if (ret == -ENOENT) -+ ret = 0; -+ return ret; -+ } -+ dir = &btrfs_dir->vfs_inode; - } - - range_start = 0; -@@ -2486,10 +2551,15 @@ static int replay_one_buffer(struct btrfs_root *log, struct extent_buffer *eb, - struct inode *inode; - u64 from; - -- inode = read_one_inode(root, key.objectid); -- if (!inode) { -- ret = -EIO; -- break; -+ { -+ struct btrfs_inode *btrfs_inode; -+ -+ btrfs_inode = btrfs_iget_logging(key.objectid, root); -+ if (IS_ERR(btrfs_inode)) { -+ ret = PTR_ERR(btrfs_inode); -+ break; -+ } -+ inode = &btrfs_inode->vfs_inode; - } - from = ALIGN(i_size_read(inode), - root->fs_info->sectorsize); -@@ -5421,7 +5491,6 @@ static int log_new_dir_dentries(struct btrfs_trans_handle *trans, - ihold(&curr_inode->vfs_inode); - - while (true) { -- struct inode *vfs_inode; - struct btrfs_key key; - struct btrfs_key found_key; - u64 next_index; -@@ -5437,7 +5506,7 @@ static int log_new_dir_dentries(struct btrfs_trans_handle *trans, - struct extent_buffer *leaf = path->nodes[0]; - struct btrfs_dir_item *di; - struct btrfs_key di_key; -- struct inode *di_inode; -+ struct btrfs_inode *di_inode; - int log_mode = LOG_INODE_EXISTS; - int type; - -@@ -5464,17 +5533,16 @@ static int log_new_dir_dentries(struct btrfs_trans_handle *trans, - goto out; - } - -- if (!need_log_inode(trans, BTRFS_I(di_inode))) { -- btrfs_add_delayed_iput(BTRFS_I(di_inode)); -+ if (!need_log_inode(trans, di_inode)) { -+ btrfs_add_delayed_iput(di_inode); - break; - } - - ctx->log_new_dentries = false; - if (type == BTRFS_FT_DIR) - log_mode = LOG_INODE_ALL; -- ret = btrfs_log_inode(trans, BTRFS_I(di_inode), -- log_mode, ctx); -- btrfs_add_delayed_iput(BTRFS_I(di_inode)); -+ ret = btrfs_log_inode(trans, di_inode, log_mode, ctx); -+ btrfs_add_delayed_iput(di_inode); - if (ret) - goto out; - if (ctx->log_new_dentries) { -@@ -5516,14 +5584,13 @@ static int log_new_dir_dentries(struct btrfs_trans_handle *trans, - kfree(dir_elem); - - btrfs_add_delayed_iput(curr_inode); -- curr_inode = NULL; - -- vfs_inode = btrfs_iget_logging(ino, root); -- if (IS_ERR(vfs_inode)) { -- ret = PTR_ERR(vfs_inode); -+ curr_inode = btrfs_iget_logging(ino, root); -+ if (IS_ERR(curr_inode)) { -+ ret = PTR_ERR(curr_inode); -+ curr_inode = NULL; - break; - } -- curr_inode = BTRFS_I(vfs_inode); - } - out: - btrfs_free_path(path); -@@ -5601,7 +5668,7 @@ static int add_conflicting_inode(struct btrfs_trans_handle *trans, - struct btrfs_log_ctx *ctx) - { - struct btrfs_ino_list *ino_elem; -- struct inode *inode; -+ struct btrfs_inode *inode; - - /* - * It's rare to have a lot of conflicting inodes, in practice it is not -@@ -5692,12 +5759,12 @@ static int add_conflicting_inode(struct btrfs_trans_handle *trans, - * inode in LOG_INODE_EXISTS mode and rename operations update the log, - * so that the log ends up with the new name and without the old name. - */ -- if (!need_log_inode(trans, BTRFS_I(inode))) { -- btrfs_add_delayed_iput(BTRFS_I(inode)); -+ if (!need_log_inode(trans, inode)) { -+ btrfs_add_delayed_iput(inode); - return 0; - } - -- btrfs_add_delayed_iput(BTRFS_I(inode)); -+ btrfs_add_delayed_iput(inode); - - ino_elem = kmalloc(sizeof(*ino_elem), GFP_NOFS); - if (!ino_elem) -@@ -5733,7 +5800,7 @@ static int log_conflicting_inodes(struct btrfs_trans_handle *trans, - */ - while (!list_empty(&ctx->conflict_inodes)) { - struct btrfs_ino_list *curr; -- struct inode *inode; -+ struct btrfs_inode *inode; - u64 ino; - u64 parent; - -@@ -5769,9 +5836,8 @@ static int log_conflicting_inodes(struct btrfs_trans_handle *trans, - * dir index key range logged for the directory. So we - * must make sure the deletion is recorded. - */ -- ret = btrfs_log_inode(trans, BTRFS_I(inode), -- LOG_INODE_ALL, ctx); -- btrfs_add_delayed_iput(BTRFS_I(inode)); -+ ret = btrfs_log_inode(trans, inode, LOG_INODE_ALL, ctx); -+ btrfs_add_delayed_iput(inode); - if (ret) - break; - continue; -@@ -5787,8 +5853,8 @@ static int log_conflicting_inodes(struct btrfs_trans_handle *trans, - * it again because if some other task logged the inode after - * that, we can avoid doing it again. - */ -- if (!need_log_inode(trans, BTRFS_I(inode))) { -- btrfs_add_delayed_iput(BTRFS_I(inode)); -+ if (!need_log_inode(trans, inode)) { -+ btrfs_add_delayed_iput(inode); - continue; - } - -@@ -5799,8 +5865,8 @@ static int log_conflicting_inodes(struct btrfs_trans_handle *trans, - * well because during a rename we pin the log and update the - * log with the new name before we unpin it. - */ -- ret = btrfs_log_inode(trans, BTRFS_I(inode), LOG_INODE_EXISTS, ctx); -- btrfs_add_delayed_iput(BTRFS_I(inode)); -+ ret = btrfs_log_inode(trans, inode, LOG_INODE_EXISTS, ctx); -+ btrfs_add_delayed_iput(inode); - if (ret) - break; - } -@@ -6292,7 +6358,7 @@ static int log_new_delayed_dentries(struct btrfs_trans_handle *trans, - - list_for_each_entry(item, delayed_ins_list, log_list) { - struct btrfs_dir_item *dir_item; -- struct inode *di_inode; -+ struct btrfs_inode *di_inode; - struct btrfs_key key; - int log_mode = LOG_INODE_EXISTS; - -@@ -6308,8 +6374,8 @@ static int log_new_delayed_dentries(struct btrfs_trans_handle *trans, - break; - } - -- if (!need_log_inode(trans, BTRFS_I(di_inode))) { -- btrfs_add_delayed_iput(BTRFS_I(di_inode)); -+ if (!need_log_inode(trans, di_inode)) { -+ btrfs_add_delayed_iput(di_inode); - continue; - } - -@@ -6317,12 +6383,12 @@ static int log_new_delayed_dentries(struct btrfs_trans_handle *trans, - log_mode = LOG_INODE_ALL; - - ctx->log_new_dentries = false; -- ret = btrfs_log_inode(trans, BTRFS_I(di_inode), log_mode, ctx); -+ ret = btrfs_log_inode(trans, di_inode, log_mode, ctx); - - if (!ret && ctx->log_new_dentries) -- ret = log_new_dir_dentries(trans, BTRFS_I(di_inode), ctx); -+ ret = log_new_dir_dentries(trans, di_inode, ctx); - -- btrfs_add_delayed_iput(BTRFS_I(di_inode)); -+ btrfs_add_delayed_iput(di_inode); - - if (ret) - break; -@@ -6730,7 +6796,7 @@ static int btrfs_log_all_parents(struct btrfs_trans_handle *trans, - ptr = btrfs_item_ptr_offset(leaf, slot); - while (cur_offset < item_size) { - struct btrfs_key inode_key; -- struct inode *dir_inode; -+ struct btrfs_inode *dir_inode; - - inode_key.type = BTRFS_INODE_ITEM_KEY; - inode_key.offset = 0; -@@ -6779,18 +6845,16 @@ static int btrfs_log_all_parents(struct btrfs_trans_handle *trans, - goto out; - } - -- if (!need_log_inode(trans, BTRFS_I(dir_inode))) { -- btrfs_add_delayed_iput(BTRFS_I(dir_inode)); -+ if (!need_log_inode(trans, dir_inode)) { -+ btrfs_add_delayed_iput(dir_inode); - continue; - } - - ctx->log_new_dentries = false; -- ret = btrfs_log_inode(trans, BTRFS_I(dir_inode), -- LOG_INODE_ALL, ctx); -+ ret = btrfs_log_inode(trans, dir_inode, LOG_INODE_ALL, ctx); - if (!ret && ctx->log_new_dentries) -- ret = log_new_dir_dentries(trans, -- BTRFS_I(dir_inode), ctx); -- btrfs_add_delayed_iput(BTRFS_I(dir_inode)); -+ ret = log_new_dir_dentries(trans, dir_inode, ctx); -+ btrfs_add_delayed_iput(dir_inode); - if (ret) - goto out; - } -@@ -6815,7 +6879,7 @@ static int log_new_ancestors(struct btrfs_trans_handle *trans, - struct extent_buffer *leaf; - int slot; - struct btrfs_key search_key; -- struct inode *inode; -+ struct btrfs_inode *inode; - u64 ino; - int ret = 0; - -@@ -6830,11 +6894,10 @@ static int log_new_ancestors(struct btrfs_trans_handle *trans, - if (IS_ERR(inode)) - return PTR_ERR(inode); - -- if (BTRFS_I(inode)->generation >= trans->transid && -- need_log_inode(trans, BTRFS_I(inode))) -- ret = btrfs_log_inode(trans, BTRFS_I(inode), -- LOG_INODE_EXISTS, ctx); -- btrfs_add_delayed_iput(BTRFS_I(inode)); -+ if (inode->generation >= trans->transid && -+ need_log_inode(trans, inode)) -+ ret = btrfs_log_inode(trans, inode, LOG_INODE_EXISTS, ctx); -+ btrfs_add_delayed_iput(inode); - if (ret) - return ret; - -diff --git a/fs/erofs/data.c b/fs/erofs/data.c -index 19ab9bb3a9a0e1..51250ac184a528 100644 ---- a/fs/erofs/data.c -+++ b/fs/erofs/data.c -@@ -358,6 +358,8 @@ int erofs_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, - */ - static int erofs_read_folio(struct file *file, struct folio *folio) - { -+ trace_erofs_read_folio(folio, true); -+ - return iomap_read_folio(folio, &erofs_iomap_ops); - } - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index cde5a15b129f63..31b32d9e7bbcea 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -772,7 +772,7 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) - call_rcu(&epi->rcu, epi_rcu_free); - - percpu_counter_dec(&ep->user->epoll_watches); -- return ep_refcount_dec_and_test(ep); -+ return true; - } - - /* -@@ -780,14 +780,14 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) - */ - static void ep_remove_safe(struct eventpoll *ep, struct epitem *epi) - { -- WARN_ON_ONCE(__ep_remove(ep, epi, false)); -+ if (__ep_remove(ep, epi, false)) -+ WARN_ON_ONCE(ep_refcount_dec_and_test(ep)); - } - - static void ep_clear_and_put(struct eventpoll *ep) - { - struct rb_node *rbp, *next; - struct epitem *epi; -- bool dispose; - - /* We need to release all tasks waiting for these file */ - if (waitqueue_active(&ep->poll_wait)) -@@ -820,10 +820,8 @@ static void ep_clear_and_put(struct eventpoll *ep) - cond_resched(); - } - -- dispose = ep_refcount_dec_and_test(ep); - mutex_unlock(&ep->mtx); -- -- if (dispose) -+ if (ep_refcount_dec_and_test(ep)) - ep_free(ep); - } - -@@ -1003,7 +1001,7 @@ void eventpoll_release_file(struct file *file) - dispose = __ep_remove(ep, epi, true); - mutex_unlock(&ep->mtx); - -- if (dispose) -+ if (dispose && ep_refcount_dec_and_test(ep)) - ep_free(ep); - goto again; - } -diff --git a/fs/proc/inode.c b/fs/proc/inode.c -index 897c71077a0f7e..4b3ae7e0def32e 100644 ---- a/fs/proc/inode.c -+++ b/fs/proc/inode.c -@@ -52,7 +52,7 @@ static void proc_evict_inode(struct inode *inode) - - head = ei->sysctl; - if (head) { -- RCU_INIT_POINTER(ei->sysctl, NULL); -+ WRITE_ONCE(ei->sysctl, NULL); - proc_sys_evict_inode(inode, head); - } - } -diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c -index 071a71eb1a2d43..b7d6bc5c1ce9a9 100644 ---- a/fs/proc/proc_sysctl.c -+++ b/fs/proc/proc_sysctl.c -@@ -920,17 +920,21 @@ static int proc_sys_compare(const struct dentry *dentry, - struct ctl_table_header *head; - struct inode *inode; - -- /* Although proc doesn't have negative dentries, rcu-walk means -- * that inode here can be NULL */ -- /* AV: can it, indeed? */ -- inode = d_inode_rcu(dentry); -- if (!inode) -- return 1; - if (name->len != len) - return 1; - if (memcmp(name->name, str, len)) - return 1; -- head = rcu_dereference(PROC_I(inode)->sysctl); -+ -+ // false positive is fine here - we'll recheck anyway -+ if (d_in_lookup(dentry)) -+ return 0; -+ -+ inode = d_inode_rcu(dentry); -+ // we just might have run into dentry in the middle of __dentry_kill() -+ if (!inode) -+ return 1; -+ -+ head = READ_ONCE(PROC_I(inode)->sysctl); - return !head || !sysctl_is_seen(head); - } - -diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c -index b8640f36ebf8ab..d0896bf8e12f0f 100644 ---- a/fs/proc/task_mmu.c -+++ b/fs/proc/task_mmu.c -@@ -33,9 +33,9 @@ void task_mem(struct seq_file *m, struct mm_struct *mm) - unsigned long text, lib, swap, anon, file, shmem; - unsigned long hiwater_vm, total_vm, hiwater_rss, total_rss; - -- anon = get_mm_counter(mm, MM_ANONPAGES); -- file = get_mm_counter(mm, MM_FILEPAGES); -- shmem = get_mm_counter(mm, MM_SHMEMPAGES); -+ anon = get_mm_counter_sum(mm, MM_ANONPAGES); -+ file = get_mm_counter_sum(mm, MM_FILEPAGES); -+ shmem = get_mm_counter_sum(mm, MM_SHMEMPAGES); - - /* - * Note: to minimize their overhead, mm maintains hiwater_vm and -@@ -56,7 +56,7 @@ void task_mem(struct seq_file *m, struct mm_struct *mm) - text = min(text, mm->exec_vm << PAGE_SHIFT); - lib = (mm->exec_vm << PAGE_SHIFT) - text; - -- swap = get_mm_counter(mm, MM_SWAPENTS); -+ swap = get_mm_counter_sum(mm, MM_SWAPENTS); - SEQ_PUT_DEC("VmPeak:\t", hiwater_vm); - SEQ_PUT_DEC(" kB\nVmSize:\t", total_vm); - SEQ_PUT_DEC(" kB\nVmLck:\t", mm->locked_vm); -@@ -89,12 +89,12 @@ unsigned long task_statm(struct mm_struct *mm, - unsigned long *shared, unsigned long *text, - unsigned long *data, unsigned long *resident) - { -- *shared = get_mm_counter(mm, MM_FILEPAGES) + -- get_mm_counter(mm, MM_SHMEMPAGES); -+ *shared = get_mm_counter_sum(mm, MM_FILEPAGES) + -+ get_mm_counter_sum(mm, MM_SHMEMPAGES); - *text = (PAGE_ALIGN(mm->end_code) - (mm->start_code & PAGE_MASK)) - >> PAGE_SHIFT; - *data = mm->data_vm + mm->stack_vm; -- *resident = *shared + get_mm_counter(mm, MM_ANONPAGES); -+ *resident = *shared + get_mm_counter_sum(mm, MM_ANONPAGES); - return mm->total_vm; - } - -diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h -index 5c856adf7be9ec..c9b37f2ebde853 100644 ---- a/fs/smb/client/cifsglob.h -+++ b/fs/smb/client/cifsglob.h -@@ -830,6 +830,7 @@ struct TCP_Server_Info { - * format: \\HOST\SHARE[\OPTIONAL PATH] - */ - char *leaf_fullpath; -+ bool dfs_conn:1; - }; - - static inline bool is_smb1(struct TCP_Server_Info *server) -@@ -1065,6 +1066,7 @@ struct cifs_ses { - struct list_head smb_ses_list; - struct list_head rlist; /* reconnect list */ - struct list_head tcon_list; -+ struct list_head dlist; /* dfs list */ - struct cifs_tcon *tcon_ipc; - spinlock_t ses_lock; /* protect anything here that is not protected */ - struct mutex session_mutex; -@@ -1294,6 +1296,7 @@ struct cifs_tcon { - /* BB add field for back pointer to sb struct(s)? */ - #ifdef CONFIG_CIFS_DFS_UPCALL - struct delayed_work dfs_cache_work; -+ struct list_head dfs_ses_list; - #endif - struct delayed_work query_interfaces; /* query interfaces workqueue job */ - char *origin_fullpath; /* canonical copy of smb3_fs_context::source */ -diff --git a/fs/smb/client/cifsproto.h b/fs/smb/client/cifsproto.h -index c6d325666b5cd8..5ab877e480abcb 100644 ---- a/fs/smb/client/cifsproto.h -+++ b/fs/smb/client/cifsproto.h -@@ -136,6 +136,7 @@ extern int SendReceiveBlockingLock(const unsigned int xid, - struct smb_hdr *out_buf, - int *bytes_returned); - -+void smb2_query_server_interfaces(struct work_struct *work); - void - cifs_signal_cifsd_for_reconnect(struct TCP_Server_Info *server, - bool all_channels); -@@ -737,15 +738,9 @@ static inline int cifs_create_options(struct cifs_sb_info *cifs_sb, int options) - - int cifs_wait_for_server_reconnect(struct TCP_Server_Info *server, bool retry); - --/* Put references of @ses and its children */ - static inline void cifs_put_smb_ses(struct cifs_ses *ses) - { -- struct cifs_ses *next; -- -- do { -- next = ses->dfs_root_ses; -- __cifs_put_smb_ses(ses); -- } while ((ses = next)); -+ __cifs_put_smb_ses(ses); - } - - /* Get an active reference of @ses and its children. -@@ -759,9 +754,7 @@ static inline void cifs_put_smb_ses(struct cifs_ses *ses) - static inline void cifs_smb_ses_inc_refcount(struct cifs_ses *ses) - { - lockdep_assert_held(&cifs_tcp_ses_lock); -- -- for (; ses; ses = ses->dfs_root_ses) -- ses->ses_count++; -+ ses->ses_count++; - } - - static inline bool dfs_src_pathname_equal(const char *s1, const char *s2) -diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c -index 8298d1745f9b9c..0588896c44567d 100644 ---- a/fs/smb/client/connect.c -+++ b/fs/smb/client/connect.c -@@ -113,7 +113,7 @@ static int reconn_set_ipaddr_from_hostname(struct TCP_Server_Info *server) - return rc; - } - --static void smb2_query_server_interfaces(struct work_struct *work) -+void smb2_query_server_interfaces(struct work_struct *work) - { - int rc; - int xid; -@@ -1551,6 +1551,9 @@ static int match_server(struct TCP_Server_Info *server, - if (server->nosharesock) - return 0; - -+ if (!match_super && (ctx->dfs_conn || server->dfs_conn)) -+ return 0; -+ - /* If multidialect negotiation see if existing sessions match one */ - if (strcmp(ctx->vals->version_string, SMB3ANY_VERSION_STRING) == 0) { - if (server->vals->protocol_id < SMB30_PROT_ID) -@@ -1740,6 +1743,7 @@ cifs_get_tcp_session(struct smb3_fs_context *ctx, - - if (ctx->nosharesock) - tcp_ses->nosharesock = true; -+ tcp_ses->dfs_conn = ctx->dfs_conn; - - tcp_ses->ops = ctx->ops; - tcp_ses->vals = ctx->vals; -@@ -1890,12 +1894,14 @@ cifs_get_tcp_session(struct smb3_fs_context *ctx, - } - - /* this function must be called with ses_lock and chan_lock held */ --static int match_session(struct cifs_ses *ses, struct smb3_fs_context *ctx) -+static int match_session(struct cifs_ses *ses, -+ struct smb3_fs_context *ctx, -+ bool match_super) - { - struct TCP_Server_Info *server = ses->server; - enum securityEnum ctx_sec, ses_sec; - -- if (ctx->dfs_root_ses != ses->dfs_root_ses) -+ if (!match_super && ctx->dfs_root_ses != ses->dfs_root_ses) - return 0; - - /* -@@ -2047,7 +2053,7 @@ cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb3_fs_context *ctx) - continue; - } - spin_lock(&ses->chan_lock); -- if (match_session(ses, ctx)) { -+ if (match_session(ses, ctx, false)) { - spin_unlock(&ses->chan_lock); - spin_unlock(&ses->ses_lock); - ret = ses; -@@ -2450,8 +2456,6 @@ cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb3_fs_context *ctx) - * need to lock before changing something in the session. - */ - spin_lock(&cifs_tcp_ses_lock); -- if (ctx->dfs_root_ses) -- cifs_smb_ses_inc_refcount(ctx->dfs_root_ses); - ses->dfs_root_ses = ctx->dfs_root_ses; - list_add(&ses->smb_ses_list, &server->smb_ses_list); - spin_unlock(&cifs_tcp_ses_lock); -@@ -2528,6 +2532,7 @@ cifs_put_tcon(struct cifs_tcon *tcon, enum smb3_tcon_ref_trace trace) - { - unsigned int xid; - struct cifs_ses *ses; -+ LIST_HEAD(ses_list); - - /* - * IPC tcon share the lifetime of their session and are -@@ -2559,6 +2564,7 @@ cifs_put_tcon(struct cifs_tcon *tcon, enum smb3_tcon_ref_trace trace) - cancel_delayed_work_sync(&tcon->query_interfaces); - #ifdef CONFIG_CIFS_DFS_UPCALL - cancel_delayed_work_sync(&tcon->dfs_cache_work); -+ list_replace_init(&tcon->dfs_ses_list, &ses_list); - #endif - - if (tcon->use_witness) { -@@ -2579,6 +2585,9 @@ cifs_put_tcon(struct cifs_tcon *tcon, enum smb3_tcon_ref_trace trace) - cifs_fscache_release_super_cookie(tcon); - tconInfoFree(tcon, netfs_trace_tcon_ref_free); - cifs_put_smb_ses(ses); -+#ifdef CONFIG_CIFS_DFS_UPCALL -+ dfs_put_root_smb_sessions(&ses_list); -+#endif - } - - /** -@@ -2807,20 +2816,14 @@ cifs_get_tcon(struct cifs_ses *ses, struct smb3_fs_context *ctx) - tcon->max_cached_dirs = ctx->max_cached_dirs; - tcon->nodelete = ctx->nodelete; - tcon->local_lease = ctx->local_lease; -- INIT_LIST_HEAD(&tcon->pending_opens); - tcon->status = TID_GOOD; - -- INIT_DELAYED_WORK(&tcon->query_interfaces, -- smb2_query_server_interfaces); - if (ses->server->dialect >= SMB30_PROT_ID && - (ses->server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) { - /* schedule query interfaces poll */ - queue_delayed_work(cifsiod_wq, &tcon->query_interfaces, - (SMB_INTERFACE_POLL_INTERVAL * HZ)); - } --#ifdef CONFIG_CIFS_DFS_UPCALL -- INIT_DELAYED_WORK(&tcon->dfs_cache_work, dfs_cache_refresh); --#endif - spin_lock(&cifs_tcp_ses_lock); - list_add(&tcon->tcon_list, &ses->tcon_list); - spin_unlock(&cifs_tcp_ses_lock); -@@ -2962,7 +2965,7 @@ cifs_match_super(struct super_block *sb, void *data) - spin_lock(&ses->chan_lock); - spin_lock(&tcon->tc_lock); - if (!match_server(tcp_srv, ctx, true) || -- !match_session(ses, ctx) || -+ !match_session(ses, ctx, true) || - !match_tcon(tcon, ctx) || - !match_prepath(sb, tcon, mnt_data)) { - rc = 0; -@@ -3712,13 +3715,12 @@ int cifs_is_path_remote(struct cifs_mount_ctx *mnt_ctx) - int cifs_mount(struct cifs_sb_info *cifs_sb, struct smb3_fs_context *ctx) - { - struct cifs_mount_ctx mnt_ctx = { .cifs_sb = cifs_sb, .fs_ctx = ctx, }; -- bool isdfs; - int rc; - -- rc = dfs_mount_share(&mnt_ctx, &isdfs); -+ rc = dfs_mount_share(&mnt_ctx); - if (rc) - goto error; -- if (!isdfs) -+ if (!ctx->dfs_conn) - goto out; - - /* -@@ -4135,7 +4137,7 @@ cifs_set_vol_auth(struct smb3_fs_context *ctx, struct cifs_ses *ses) - } - - static struct cifs_tcon * --__cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid) -+cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid) - { - int rc; - struct cifs_tcon *master_tcon = cifs_sb_master_tcon(cifs_sb); -@@ -4233,17 +4235,6 @@ __cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid) - return tcon; - } - --static struct cifs_tcon * --cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid) --{ -- struct cifs_tcon *ret; -- -- cifs_mount_lock(); -- ret = __cifs_construct_tcon(cifs_sb, fsuid); -- cifs_mount_unlock(); -- return ret; --} -- - struct cifs_tcon * - cifs_sb_master_tcon(struct cifs_sb_info *cifs_sb) - { -diff --git a/fs/smb/client/dfs.c b/fs/smb/client/dfs.c -index bd259b04cdede0..c35953843373ea 100644 ---- a/fs/smb/client/dfs.c -+++ b/fs/smb/client/dfs.c -@@ -69,7 +69,7 @@ static int get_session(struct cifs_mount_ctx *mnt_ctx, const char *full_path) - * Get an active reference of @ses so that next call to cifs_put_tcon() won't - * release it as any new DFS referrals must go through its IPC tcon. - */ --static void add_root_smb_session(struct cifs_mount_ctx *mnt_ctx) -+static void set_root_smb_session(struct cifs_mount_ctx *mnt_ctx) - { - struct smb3_fs_context *ctx = mnt_ctx->fs_ctx; - struct cifs_ses *ses = mnt_ctx->ses; -@@ -95,7 +95,7 @@ static inline int parse_dfs_target(struct smb3_fs_context *ctx, - return rc; - } - --static int set_ref_paths(struct cifs_mount_ctx *mnt_ctx, -+static int setup_dfs_ref(struct cifs_mount_ctx *mnt_ctx, - struct dfs_info3_param *tgt, - struct dfs_ref_walk *rw) - { -@@ -120,6 +120,7 @@ static int set_ref_paths(struct cifs_mount_ctx *mnt_ctx, - } - ref_walk_path(rw) = ref_path; - ref_walk_fpath(rw) = full_path; -+ ref_walk_ses(rw) = ctx->dfs_root_ses; - return 0; - } - -@@ -128,11 +129,11 @@ static int __dfs_referral_walk(struct cifs_mount_ctx *mnt_ctx, - { - struct smb3_fs_context *ctx = mnt_ctx->fs_ctx; - struct dfs_info3_param tgt = {}; -- bool is_refsrv; - int rc = -ENOENT; - - again: - do { -+ ctx->dfs_root_ses = ref_walk_ses(rw); - if (ref_walk_empty(rw)) { - rc = dfs_get_referral(mnt_ctx, ref_walk_path(rw) + 1, - NULL, ref_walk_tl(rw)); -@@ -158,10 +159,7 @@ static int __dfs_referral_walk(struct cifs_mount_ctx *mnt_ctx, - if (rc) - continue; - -- is_refsrv = tgt.server_type == DFS_TYPE_ROOT || -- DFS_INTERLINK(tgt.flags); - ref_walk_set_tgt_hint(rw); -- - if (tgt.flags & DFSREF_STORAGE_SERVER) { - rc = cifs_mount_get_tcon(mnt_ctx); - if (!rc) -@@ -172,12 +170,10 @@ static int __dfs_referral_walk(struct cifs_mount_ctx *mnt_ctx, - continue; - } - -- if (is_refsrv) -- add_root_smb_session(mnt_ctx); -- -+ set_root_smb_session(mnt_ctx); - rc = ref_walk_advance(rw); - if (!rc) { -- rc = set_ref_paths(mnt_ctx, &tgt, rw); -+ rc = setup_dfs_ref(mnt_ctx, &tgt, rw); - if (!rc) { - rc = -EREMOTE; - goto again; -@@ -193,20 +189,22 @@ static int __dfs_referral_walk(struct cifs_mount_ctx *mnt_ctx, - return rc; - } - --static int dfs_referral_walk(struct cifs_mount_ctx *mnt_ctx) -+static int dfs_referral_walk(struct cifs_mount_ctx *mnt_ctx, -+ struct dfs_ref_walk **rw) - { -- struct dfs_ref_walk *rw; - int rc; - -- rw = ref_walk_alloc(); -- if (IS_ERR(rw)) -- return PTR_ERR(rw); -+ *rw = ref_walk_alloc(); -+ if (IS_ERR(*rw)) { -+ rc = PTR_ERR(*rw); -+ *rw = NULL; -+ return rc; -+ } - -- ref_walk_init(rw); -- rc = set_ref_paths(mnt_ctx, NULL, rw); -+ ref_walk_init(*rw); -+ rc = setup_dfs_ref(mnt_ctx, NULL, *rw); - if (!rc) -- rc = __dfs_referral_walk(mnt_ctx, rw); -- ref_walk_free(rw); -+ rc = __dfs_referral_walk(mnt_ctx, *rw); - return rc; - } - -@@ -214,16 +212,16 @@ static int __dfs_mount_share(struct cifs_mount_ctx *mnt_ctx) - { - struct cifs_sb_info *cifs_sb = mnt_ctx->cifs_sb; - struct smb3_fs_context *ctx = mnt_ctx->fs_ctx; -+ struct dfs_ref_walk *rw = NULL; - struct cifs_tcon *tcon; - char *origin_fullpath; -- bool new_tcon = true; - int rc; - - origin_fullpath = dfs_get_path(cifs_sb, ctx->source); - if (IS_ERR(origin_fullpath)) - return PTR_ERR(origin_fullpath); - -- rc = dfs_referral_walk(mnt_ctx); -+ rc = dfs_referral_walk(mnt_ctx, &rw); - if (!rc) { - /* - * Prevent superblock from being created with any missing -@@ -241,21 +239,16 @@ static int __dfs_mount_share(struct cifs_mount_ctx *mnt_ctx) - - tcon = mnt_ctx->tcon; - spin_lock(&tcon->tc_lock); -- if (!tcon->origin_fullpath) { -- tcon->origin_fullpath = origin_fullpath; -- origin_fullpath = NULL; -- } else { -- new_tcon = false; -- } -+ tcon->origin_fullpath = origin_fullpath; -+ origin_fullpath = NULL; -+ ref_walk_set_tcon(rw, tcon); - spin_unlock(&tcon->tc_lock); -- -- if (new_tcon) { -- queue_delayed_work(dfscache_wq, &tcon->dfs_cache_work, -- dfs_cache_get_ttl() * HZ); -- } -+ queue_delayed_work(dfscache_wq, &tcon->dfs_cache_work, -+ dfs_cache_get_ttl() * HZ); - - out: - kfree(origin_fullpath); -+ ref_walk_free(rw); - return rc; - } - -@@ -279,7 +272,7 @@ static int update_fs_context_dstaddr(struct smb3_fs_context *ctx) - return rc; - } - --int dfs_mount_share(struct cifs_mount_ctx *mnt_ctx, bool *isdfs) -+int dfs_mount_share(struct cifs_mount_ctx *mnt_ctx) - { - struct smb3_fs_context *ctx = mnt_ctx->fs_ctx; - bool nodfs = ctx->nodfs; -@@ -289,7 +282,6 @@ int dfs_mount_share(struct cifs_mount_ctx *mnt_ctx, bool *isdfs) - if (rc) - return rc; - -- *isdfs = false; - rc = get_session(mnt_ctx, NULL); - if (rc) - return rc; -@@ -317,10 +309,15 @@ int dfs_mount_share(struct cifs_mount_ctx *mnt_ctx, bool *isdfs) - return rc; - } - -- *isdfs = true; -- add_root_smb_session(mnt_ctx); -- rc = __dfs_mount_share(mnt_ctx); -- dfs_put_root_smb_sessions(mnt_ctx); -+ if (!ctx->dfs_conn) { -+ ctx->dfs_conn = true; -+ cifs_mount_put_conns(mnt_ctx); -+ rc = get_session(mnt_ctx, NULL); -+ } -+ if (!rc) { -+ set_root_smb_session(mnt_ctx); -+ rc = __dfs_mount_share(mnt_ctx); -+ } - return rc; - } - -diff --git a/fs/smb/client/dfs.h b/fs/smb/client/dfs.h -index e5c4dcf837503a..1aa2bc65b3bc2c 100644 ---- a/fs/smb/client/dfs.h -+++ b/fs/smb/client/dfs.h -@@ -19,6 +19,7 @@ - struct dfs_ref { - char *path; - char *full_path; -+ struct cifs_ses *ses; - struct dfs_cache_tgt_list tl; - struct dfs_cache_tgt_iterator *tit; - }; -@@ -38,6 +39,7 @@ struct dfs_ref_walk { - #define ref_walk_path(w) (ref_walk_cur(w)->path) - #define ref_walk_fpath(w) (ref_walk_cur(w)->full_path) - #define ref_walk_tl(w) (&ref_walk_cur(w)->tl) -+#define ref_walk_ses(w) (ref_walk_cur(w)->ses) - - static inline struct dfs_ref_walk *ref_walk_alloc(void) - { -@@ -60,14 +62,19 @@ static inline void __ref_walk_free(struct dfs_ref *ref) - kfree(ref->path); - kfree(ref->full_path); - dfs_cache_free_tgts(&ref->tl); -+ if (ref->ses) -+ cifs_put_smb_ses(ref->ses); - memset(ref, 0, sizeof(*ref)); - } - - static inline void ref_walk_free(struct dfs_ref_walk *rw) - { -- struct dfs_ref *ref = ref_walk_start(rw); -+ struct dfs_ref *ref; - -- for (; ref <= ref_walk_end(rw); ref++) -+ if (!rw) -+ return; -+ -+ for (ref = ref_walk_start(rw); ref <= ref_walk_end(rw); ref++) - __ref_walk_free(ref); - kfree(rw); - } -@@ -116,9 +123,22 @@ static inline void ref_walk_set_tgt_hint(struct dfs_ref_walk *rw) - ref_walk_tit(rw)); - } - -+static inline void ref_walk_set_tcon(struct dfs_ref_walk *rw, -+ struct cifs_tcon *tcon) -+{ -+ struct dfs_ref *ref = ref_walk_start(rw); -+ -+ for (; ref <= ref_walk_cur(rw); ref++) { -+ if (WARN_ON_ONCE(!ref->ses)) -+ continue; -+ list_add(&ref->ses->dlist, &tcon->dfs_ses_list); -+ ref->ses = NULL; -+ } -+} -+ - int dfs_parse_target_referral(const char *full_path, const struct dfs_info3_param *ref, - struct smb3_fs_context *ctx); --int dfs_mount_share(struct cifs_mount_ctx *mnt_ctx, bool *isdfs); -+int dfs_mount_share(struct cifs_mount_ctx *mnt_ctx); - - static inline char *dfs_get_path(struct cifs_sb_info *cifs_sb, const char *path) - { -@@ -142,20 +162,14 @@ static inline int dfs_get_referral(struct cifs_mount_ctx *mnt_ctx, const char *p - * references of all DFS root sessions that were used across the mount process - * in dfs_mount_share(). - */ --static inline void dfs_put_root_smb_sessions(struct cifs_mount_ctx *mnt_ctx) -+static inline void dfs_put_root_smb_sessions(struct list_head *head) - { -- const struct smb3_fs_context *ctx = mnt_ctx->fs_ctx; -- struct cifs_ses *ses = ctx->dfs_root_ses; -- struct cifs_ses *cur; -- -- if (!ses) -- return; -+ struct cifs_ses *ses, *n; - -- for (cur = ses; cur; cur = cur->dfs_root_ses) { -- if (cur->dfs_root_ses) -- cifs_put_smb_ses(cur->dfs_root_ses); -+ list_for_each_entry_safe(ses, n, head, dlist) { -+ list_del_init(&ses->dlist); -+ cifs_put_smb_ses(ses); - } -- cifs_put_smb_ses(ses); - } - - #endif /* _CIFS_DFS_H */ -diff --git a/fs/smb/client/dfs_cache.c b/fs/smb/client/dfs_cache.c -index 11c8efecf7aa12..433f546055b977 100644 ---- a/fs/smb/client/dfs_cache.c -+++ b/fs/smb/client/dfs_cache.c -@@ -1095,16 +1095,18 @@ int dfs_cache_get_tgt_share(char *path, const struct dfs_cache_tgt_iterator *it, - return 0; - } - --static bool target_share_equal(struct TCP_Server_Info *server, const char *s1, const char *s2) -+static bool target_share_equal(struct cifs_tcon *tcon, const char *s1) - { -- char unc[sizeof("\\\\") + SERVER_NAME_LENGTH] = {0}; -+ struct TCP_Server_Info *server = tcon->ses->server; -+ struct sockaddr_storage ss; - const char *host; -+ const char *s2 = &tcon->tree_name[1]; - size_t hostlen; -- struct sockaddr_storage ss; -+ char unc[sizeof("\\\\") + SERVER_NAME_LENGTH] = {0}; - bool match; - int rc; - -- if (strcasecmp(s1, s2)) -+ if (strcasecmp(s2, s1)) - return false; - - /* -@@ -1128,34 +1130,6 @@ static bool target_share_equal(struct TCP_Server_Info *server, const char *s1, c - return match; - } - --/* -- * Mark dfs tcon for reconnecting when the currently connected tcon does not match any of the new -- * target shares in @refs. -- */ --static void mark_for_reconnect_if_needed(struct TCP_Server_Info *server, -- const char *path, -- struct dfs_cache_tgt_list *old_tl, -- struct dfs_cache_tgt_list *new_tl) --{ -- struct dfs_cache_tgt_iterator *oit, *nit; -- -- for (oit = dfs_cache_get_tgt_iterator(old_tl); oit; -- oit = dfs_cache_get_next_tgt(old_tl, oit)) { -- for (nit = dfs_cache_get_tgt_iterator(new_tl); nit; -- nit = dfs_cache_get_next_tgt(new_tl, nit)) { -- if (target_share_equal(server, -- dfs_cache_get_tgt_name(oit), -- dfs_cache_get_tgt_name(nit))) { -- dfs_cache_noreq_update_tgthint(path, nit); -- return; -- } -- } -- } -- -- cifs_dbg(FYI, "%s: no cached or matched targets. mark dfs share for reconnect.\n", __func__); -- cifs_signal_cifsd_for_reconnect(server, true); --} -- - static bool is_ses_good(struct cifs_ses *ses) - { - struct TCP_Server_Info *server = ses->server; -@@ -1172,41 +1146,35 @@ static bool is_ses_good(struct cifs_ses *ses) - return ret; - } - --/* Refresh dfs referral of @ses and mark it for reconnect if needed */ --static void __refresh_ses_referral(struct cifs_ses *ses, bool force_refresh) -+static char *get_ses_refpath(struct cifs_ses *ses) - { - struct TCP_Server_Info *server = ses->server; -- DFS_CACHE_TGT_LIST(old_tl); -- DFS_CACHE_TGT_LIST(new_tl); -- bool needs_refresh = false; -- struct cache_entry *ce; -- unsigned int xid; -- char *path = NULL; -- int rc = 0; -- -- xid = get_xid(); -+ char *path = ERR_PTR(-ENOENT); - - mutex_lock(&server->refpath_lock); - if (server->leaf_fullpath) { - path = kstrdup(server->leaf_fullpath + 1, GFP_ATOMIC); - if (!path) -- rc = -ENOMEM; -+ path = ERR_PTR(-ENOMEM); - } - mutex_unlock(&server->refpath_lock); -- if (!path) -- goto out; -+ return path; -+} - -- down_read(&htable_rw_lock); -- ce = lookup_cache_entry(path); -- needs_refresh = force_refresh || IS_ERR(ce) || cache_entry_expired(ce); -- if (!IS_ERR(ce)) { -- rc = get_targets(ce, &old_tl); -- cifs_dbg(FYI, "%s: get_targets: %d\n", __func__, rc); -- } -- up_read(&htable_rw_lock); -+/* Refresh dfs referral of @ses */ -+static void refresh_ses_referral(struct cifs_ses *ses) -+{ -+ struct cache_entry *ce; -+ unsigned int xid; -+ char *path; -+ int rc = 0; - -- if (!needs_refresh) { -- rc = 0; -+ xid = get_xid(); -+ -+ path = get_ses_refpath(ses); -+ if (IS_ERR(path)) { -+ rc = PTR_ERR(path); -+ path = NULL; - goto out; - } - -@@ -1217,29 +1185,106 @@ static void __refresh_ses_referral(struct cifs_ses *ses, bool force_refresh) - goto out; - } - -- ce = cache_refresh_path(xid, ses, path, true); -- if (!IS_ERR(ce)) { -- rc = get_targets(ce, &new_tl); -+ ce = cache_refresh_path(xid, ses, path, false); -+ if (!IS_ERR(ce)) - up_read(&htable_rw_lock); -- cifs_dbg(FYI, "%s: get_targets: %d\n", __func__, rc); -- mark_for_reconnect_if_needed(server, path, &old_tl, &new_tl); -- } -+ else -+ rc = PTR_ERR(ce); - - out: - free_xid(xid); -- dfs_cache_free_tgts(&old_tl); -- dfs_cache_free_tgts(&new_tl); - kfree(path); - } - --static inline void refresh_ses_referral(struct cifs_ses *ses) -+static int __refresh_tcon_referral(struct cifs_tcon *tcon, -+ const char *path, -+ struct dfs_info3_param *refs, -+ int numrefs, bool force_refresh) - { -- __refresh_ses_referral(ses, false); -+ struct cache_entry *ce; -+ bool reconnect = force_refresh; -+ int rc = 0; -+ int i; -+ -+ if (unlikely(!numrefs)) -+ return 0; -+ -+ if (force_refresh) { -+ for (i = 0; i < numrefs; i++) { -+ /* TODO: include prefix paths in the matching */ -+ if (target_share_equal(tcon, refs[i].node_name)) { -+ reconnect = false; -+ break; -+ } -+ } -+ } -+ -+ down_write(&htable_rw_lock); -+ ce = lookup_cache_entry(path); -+ if (!IS_ERR(ce)) { -+ if (force_refresh || cache_entry_expired(ce)) -+ rc = update_cache_entry_locked(ce, refs, numrefs); -+ } else if (PTR_ERR(ce) == -ENOENT) { -+ ce = add_cache_entry_locked(refs, numrefs); -+ } -+ up_write(&htable_rw_lock); -+ -+ if (IS_ERR(ce)) -+ rc = PTR_ERR(ce); -+ if (reconnect) { -+ cifs_tcon_dbg(FYI, "%s: mark for reconnect\n", __func__); -+ cifs_signal_cifsd_for_reconnect(tcon->ses->server, true); -+ } -+ return rc; - } - --static inline void force_refresh_ses_referral(struct cifs_ses *ses) -+static void refresh_tcon_referral(struct cifs_tcon *tcon, bool force_refresh) - { -- __refresh_ses_referral(ses, true); -+ struct dfs_info3_param *refs = NULL; -+ struct cache_entry *ce; -+ struct cifs_ses *ses; -+ unsigned int xid; -+ bool needs_refresh; -+ char *path; -+ int numrefs = 0; -+ int rc = 0; -+ -+ xid = get_xid(); -+ ses = tcon->ses; -+ -+ path = get_ses_refpath(ses); -+ if (IS_ERR(path)) { -+ rc = PTR_ERR(path); -+ path = NULL; -+ goto out; -+ } -+ -+ down_read(&htable_rw_lock); -+ ce = lookup_cache_entry(path); -+ needs_refresh = force_refresh || IS_ERR(ce) || cache_entry_expired(ce); -+ if (!needs_refresh) { -+ up_read(&htable_rw_lock); -+ goto out; -+ } -+ up_read(&htable_rw_lock); -+ -+ ses = CIFS_DFS_ROOT_SES(ses); -+ if (!is_ses_good(ses)) { -+ cifs_dbg(FYI, "%s: skip cache refresh due to disconnected ipc\n", -+ __func__); -+ goto out; -+ } -+ -+ rc = get_dfs_referral(xid, ses, path, &refs, &numrefs); -+ if (!rc) { -+ rc = __refresh_tcon_referral(tcon, path, refs, -+ numrefs, force_refresh); -+ } -+ -+out: -+ free_xid(xid); -+ kfree(path); -+ free_dfs_info_array(refs, numrefs); - } - - /** -@@ -1280,7 +1325,7 @@ int dfs_cache_remount_fs(struct cifs_sb_info *cifs_sb) - */ - cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH; - -- force_refresh_ses_referral(tcon->ses); -+ refresh_tcon_referral(tcon, true); - return 0; - } - -@@ -1292,8 +1337,9 @@ void dfs_cache_refresh(struct work_struct *work) - - tcon = container_of(work, struct cifs_tcon, dfs_cache_work.work); - -- for (ses = tcon->ses; ses; ses = ses->dfs_root_ses) -+ list_for_each_entry(ses, &tcon->dfs_ses_list, dlist) - refresh_ses_referral(ses); -+ refresh_tcon_referral(tcon, false); - - queue_delayed_work(dfscache_wq, &tcon->dfs_cache_work, - atomic_read(&dfs_cache_ttl) * HZ); -diff --git a/fs/smb/client/fs_context.h b/fs/smb/client/fs_context.h -index d0a2043ea44682..52ee72e562f5f6 100644 ---- a/fs/smb/client/fs_context.h -+++ b/fs/smb/client/fs_context.h -@@ -287,6 +287,7 @@ struct smb3_fs_context { - struct cifs_ses *dfs_root_ses; - bool dfs_automount:1; /* set for dfs automount only */ - enum cifs_reparse_type reparse_type; -+ bool dfs_conn:1; /* set for dfs mounts */ - }; - - extern const struct fs_parameter_spec smb3_fs_parameters[]; -diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c -index 9e8e0a01ae8eb0..bbbe48447765de 100644 ---- a/fs/smb/client/misc.c -+++ b/fs/smb/client/misc.c -@@ -145,6 +145,15 @@ tcon_info_alloc(bool dir_leases_enabled, enum smb3_tcon_ref_trace trace) - mutex_init(&ret_buf->fscache_lock); - #endif - trace_smb3_tcon_ref(ret_buf->debug_id, ret_buf->tc_count, trace); -+#ifdef CONFIG_CIFS_DFS_UPCALL -+ INIT_LIST_HEAD(&ret_buf->dfs_ses_list); -+#endif -+ INIT_LIST_HEAD(&ret_buf->pending_opens); -+ INIT_DELAYED_WORK(&ret_buf->query_interfaces, -+ smb2_query_server_interfaces); -+#ifdef CONFIG_CIFS_DFS_UPCALL -+ INIT_DELAYED_WORK(&ret_buf->dfs_cache_work, dfs_cache_refresh); -+#endif - - return ret_buf; - } -diff --git a/fs/smb/client/namespace.c b/fs/smb/client/namespace.c -index ec58c0e507244b..a6655807c0865a 100644 ---- a/fs/smb/client/namespace.c -+++ b/fs/smb/client/namespace.c -@@ -260,7 +260,7 @@ static struct vfsmount *cifs_do_automount(struct path *path) - ctx->source = NULL; - goto out; - } -- ctx->dfs_automount = is_dfs_mount(mntpt); -+ ctx->dfs_automount = ctx->dfs_conn = is_dfs_mount(mntpt); - cifs_dbg(FYI, "%s: ctx: source=%s UNC=%s prepath=%s dfs_automount=%d\n", - __func__, ctx->source, ctx->UNC, ctx->prepath, ctx->dfs_automount); - -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index 6c22240368abf4..e25c2ca56461ac 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -8503,11 +8503,6 @@ static void smb20_oplock_break_ack(struct ksmbd_work *work) - goto err_out; - } - -- opinfo->op_state = OPLOCK_STATE_NONE; -- wake_up_interruptible_all(&opinfo->oplock_q); -- opinfo_put(opinfo); -- ksmbd_fd_put(work, fp); -- - rsp->StructureSize = cpu_to_le16(24); - rsp->OplockLevel = rsp_oplevel; - rsp->Reserved = 0; -@@ -8515,16 +8510,15 @@ static void smb20_oplock_break_ack(struct ksmbd_work *work) - rsp->VolatileFid = volatile_id; - rsp->PersistentFid = persistent_id; - ret = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_oplock_break)); -- if (!ret) -- return; -- -+ if (ret) { - err_out: -+ smb2_set_err_rsp(work); -+ } -+ - opinfo->op_state = OPLOCK_STATE_NONE; - wake_up_interruptible_all(&opinfo->oplock_q); -- - opinfo_put(opinfo); - ksmbd_fd_put(work, fp); -- smb2_set_err_rsp(work); - } - - static int check_lease_state(struct lease *lease, __le32 req_state) -@@ -8654,11 +8648,6 @@ static void smb21_lease_break_ack(struct ksmbd_work *work) - } - - lease_state = lease->state; -- opinfo->op_state = OPLOCK_STATE_NONE; -- wake_up_interruptible_all(&opinfo->oplock_q); -- atomic_dec(&opinfo->breaking_cnt); -- wake_up_interruptible_all(&opinfo->oplock_brk); -- opinfo_put(opinfo); - - rsp->StructureSize = cpu_to_le16(36); - rsp->Reserved = 0; -@@ -8667,16 +8656,16 @@ static void smb21_lease_break_ack(struct ksmbd_work *work) - rsp->LeaseState = lease_state; - rsp->LeaseDuration = 0; - ret = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_lease_ack)); -- if (!ret) -- return; -- -+ if (ret) { - err_out: -+ smb2_set_err_rsp(work); -+ } -+ -+ opinfo->op_state = OPLOCK_STATE_NONE; - wake_up_interruptible_all(&opinfo->oplock_q); - atomic_dec(&opinfo->breaking_cnt); - wake_up_interruptible_all(&opinfo->oplock_brk); -- - opinfo_put(opinfo); -- smb2_set_err_rsp(work); - } - - /** -diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c -index 8faa25c6e129b5..7b6639949c250c 100644 ---- a/fs/smb/server/transport_rdma.c -+++ b/fs/smb/server/transport_rdma.c -@@ -426,7 +426,8 @@ static void free_transport(struct smb_direct_transport *t) - if (t->qp) { - ib_drain_qp(t->qp); - ib_mr_pool_destroy(t->qp, &t->qp->rdma_mrs); -- ib_destroy_qp(t->qp); -+ t->qp = NULL; -+ rdma_destroy_qp(t->cm_id); - } - - ksmbd_debug(RDMA, "drain the reassembly queue\n"); -@@ -1934,8 +1935,8 @@ static int smb_direct_create_qpair(struct smb_direct_transport *t, - return 0; - err: - if (t->qp) { -- ib_destroy_qp(t->qp); - t->qp = NULL; -+ rdma_destroy_qp(t->cm_id); - } - if (t->recv_cq) { - ib_destroy_cq(t->recv_cq); -diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c -index 3bbf2382706056..de813700f3d4f6 100644 ---- a/fs/smb/server/vfs.c -+++ b/fs/smb/server/vfs.c -@@ -1293,6 +1293,7 @@ int ksmbd_vfs_kern_path_locked(struct ksmbd_work *work, char *name, - - err = ksmbd_vfs_lock_parent(parent_path->dentry, path->dentry); - if (err) { -+ mnt_drop_write(parent_path->mnt); - path_put(path); - path_put(parent_path); - } -diff --git a/include/drm/drm_file.h b/include/drm/drm_file.h -index cc61f6a2b2ad6e..0cb5edd9c46711 100644 ---- a/include/drm/drm_file.h -+++ b/include/drm/drm_file.h -@@ -302,6 +302,9 @@ struct drm_file { - * - * Mapping of mm object handles to object pointers. Used by the GEM - * subsystem. Protected by @table_lock. -+ * -+ * Note that allocated entries might be NULL as a transient state when -+ * creating or deleting a handle. - */ - struct idr object_idr; - -diff --git a/include/drm/drm_framebuffer.h b/include/drm/drm_framebuffer.h -index 0dcc07b6865484..990259873e1e30 100644 ---- a/include/drm/drm_framebuffer.h -+++ b/include/drm/drm_framebuffer.h -@@ -23,6 +23,7 @@ - #ifndef __DRM_FRAMEBUFFER_H__ - #define __DRM_FRAMEBUFFER_H__ - -+#include - #include - #include - #include -@@ -100,6 +101,8 @@ struct drm_framebuffer_funcs { - unsigned num_clips); - }; - -+#define DRM_FRAMEBUFFER_HAS_HANDLE_REF(_i) BIT(0u + (_i)) -+ - /** - * struct drm_framebuffer - frame buffer object - * -@@ -188,6 +191,10 @@ struct drm_framebuffer { - * DRM_MODE_FB_MODIFIERS. - */ - int flags; -+ /** -+ * @internal_flags: Framebuffer flags like DRM_FRAMEBUFFER_HAS_HANDLE_REF. -+ */ -+ unsigned int internal_flags; - /** - * @hot_x: X coordinate of the cursor hotspot. Used by the legacy cursor - * IOCTL when the driver supports cursor through a DRM_PLANE_TYPE_CURSOR -diff --git a/include/drm/spsc_queue.h b/include/drm/spsc_queue.h -index 125f096c88cb96..ee9df8cc67b730 100644 ---- a/include/drm/spsc_queue.h -+++ b/include/drm/spsc_queue.h -@@ -70,9 +70,11 @@ static inline bool spsc_queue_push(struct spsc_queue *queue, struct spsc_node *n - - preempt_disable(); - -+ atomic_inc(&queue->job_count); -+ smp_mb__after_atomic(); -+ - tail = (struct spsc_node **)atomic_long_xchg(&queue->tail, (long)&node->next); - WRITE_ONCE(*tail, node); -- atomic_inc(&queue->job_count); - - /* - * In case of first element verify new node will be visible to the consumer -diff --git a/include/linux/math.h b/include/linux/math.h -index dd4152711de7d5..ee754ec3dc929f 100644 ---- a/include/linux/math.h -+++ b/include/linux/math.h -@@ -34,6 +34,18 @@ - */ - #define round_down(x, y) ((x) & ~__round_mask(x, y)) - -+/** -+ * DIV_ROUND_UP_POW2 - divide and round up -+ * @n: numerator -+ * @d: denominator (must be a power of 2) -+ * -+ * Divides @n by @d and rounds up to next multiple of @d (which must be a power -+ * of 2). Avoids integer overflows that may occur with __KERNEL_DIV_ROUND_UP(). -+ * Performance is roughly equivalent to __KERNEL_DIV_ROUND_UP(). -+ */ -+#define DIV_ROUND_UP_POW2(n, d) \ -+ ((n) / (d) + !!((n) & ((d) - 1))) -+ - #define DIV_ROUND_UP __KERNEL_DIV_ROUND_UP - - #define DIV_ROUND_DOWN_ULL(ll, d) \ -diff --git a/include/linux/mm.h b/include/linux/mm.h -index 209370f6443666..ee26e37daa0a80 100644 ---- a/include/linux/mm.h -+++ b/include/linux/mm.h -@@ -2551,6 +2551,11 @@ static inline unsigned long get_mm_counter(struct mm_struct *mm, int member) - return percpu_counter_read_positive(&mm->rss_stat[member]); - } - -+static inline unsigned long get_mm_counter_sum(struct mm_struct *mm, int member) -+{ -+ return percpu_counter_sum_positive(&mm->rss_stat[member]); -+} -+ - void mm_trace_rss_stat(struct mm_struct *mm, int member); - - static inline void add_mm_counter(struct mm_struct *mm, int member, long value) -diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h -index f8b09a82f62e1d..1820b87b8b7fff 100644 ---- a/include/net/af_vsock.h -+++ b/include/net/af_vsock.h -@@ -236,8 +236,8 @@ int __vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg, - int vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg, - size_t len, int flags); - --#ifdef CONFIG_BPF_SYSCALL - extern struct proto vsock_proto; -+#ifdef CONFIG_BPF_SYSCALL - int vsock_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool restore); - void __init vsock_bpf_build_proto(void); - #else -diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h -index df7775afb92b93..0097791e1eede6 100644 ---- a/include/net/netfilter/nf_flow_table.h -+++ b/include/net/netfilter/nf_flow_table.h -@@ -353,7 +353,7 @@ static inline __be16 __nf_flow_pppoe_proto(const struct sk_buff *skb) - - static inline bool nf_flow_pppoe_proto(struct sk_buff *skb, __be16 *inner_proto) - { -- if (!pskb_may_pull(skb, PPPOE_SES_HLEN)) -+ if (!pskb_may_pull(skb, ETH_HLEN + PPPOE_SES_HLEN)) - return false; - - *inner_proto = __nf_flow_pppoe_proto(skb); -diff --git a/io_uring/opdef.c b/io_uring/opdef.c -index 3b9c6489b8b6d2..2d0a7db940fdb0 100644 ---- a/io_uring/opdef.c -+++ b/io_uring/opdef.c -@@ -202,6 +202,7 @@ const struct io_issue_def io_issue_defs[] = { - }, - [IORING_OP_FALLOCATE] = { - .needs_file = 1, -+ .hash_reg_file = 1, - .prep = io_fallocate_prep, - .issue = io_fallocate, - }, -diff --git a/kernel/bpf/bpf_lru_list.c b/kernel/bpf/bpf_lru_list.c -index 3dabdd137d1021..2d6e1c98d8adc3 100644 ---- a/kernel/bpf/bpf_lru_list.c -+++ b/kernel/bpf/bpf_lru_list.c -@@ -337,12 +337,12 @@ static void bpf_lru_list_pop_free_to_local(struct bpf_lru *lru, - list) { - __bpf_lru_node_move_to_free(l, node, local_free_list(loc_l), - BPF_LRU_LOCAL_LIST_T_FREE); -- if (++nfree == LOCAL_FREE_TARGET) -+ if (++nfree == lru->target_free) - break; - } - -- if (nfree < LOCAL_FREE_TARGET) -- __bpf_lru_list_shrink(lru, l, LOCAL_FREE_TARGET - nfree, -+ if (nfree < lru->target_free) -+ __bpf_lru_list_shrink(lru, l, lru->target_free - nfree, - local_free_list(loc_l), - BPF_LRU_LOCAL_LIST_T_FREE); - -@@ -577,6 +577,9 @@ static void bpf_common_lru_populate(struct bpf_lru *lru, void *buf, - list_add(&node->list, &l->lists[BPF_LRU_LIST_T_FREE]); - buf += elem_size; - } -+ -+ lru->target_free = clamp((nr_elems / num_possible_cpus()) / 2, -+ 1, LOCAL_FREE_TARGET); - } - - static void bpf_percpu_lru_populate(struct bpf_lru *lru, void *buf, -diff --git a/kernel/bpf/bpf_lru_list.h b/kernel/bpf/bpf_lru_list.h -index cbd8d3720c2bbe..fe2661a58ea94a 100644 ---- a/kernel/bpf/bpf_lru_list.h -+++ b/kernel/bpf/bpf_lru_list.h -@@ -58,6 +58,7 @@ struct bpf_lru { - del_from_htab_func del_from_htab; - void *del_arg; - unsigned int hash_offset; -+ unsigned int target_free; - unsigned int nr_scans; - bool percpu; - }; -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 873b17545717cb..3a33d9c1b1b2b4 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -873,8 +873,6 @@ static void perf_cgroup_switch(struct task_struct *task) - if (READ_ONCE(cpuctx->cgrp) == NULL) - return; - -- WARN_ON_ONCE(cpuctx->ctx.nr_cgroups == 0); -- - cgrp = perf_cgroup_from_task(task, NULL); - if (READ_ONCE(cpuctx->cgrp) == cgrp) - return; -@@ -886,6 +884,8 @@ static void perf_cgroup_switch(struct task_struct *task) - if (READ_ONCE(cpuctx->cgrp) == NULL) - return; - -+ WARN_ON_ONCE(cpuctx->ctx.nr_cgroups == 0); -+ - perf_ctx_disable(&cpuctx->ctx, true); - - ctx_sched_out(&cpuctx->ctx, EVENT_ALL|EVENT_CGROUP); -@@ -10473,7 +10473,7 @@ static int perf_uprobe_event_init(struct perf_event *event) - if (event->attr.type != perf_uprobe.type) - return -ENOENT; - -- if (!perfmon_capable()) -+ if (!capable(CAP_SYS_ADMIN)) - return -EACCES; - - /* -diff --git a/kernel/rseq.c b/kernel/rseq.c -index 9de6e35fe67914..23894ba8250cf9 100644 ---- a/kernel/rseq.c -+++ b/kernel/rseq.c -@@ -149,6 +149,29 @@ static int rseq_reset_rseq_cpu_node_id(struct task_struct *t) - return 0; - } - -+/* -+ * Get the user-space pointer value stored in the 'rseq_cs' field. -+ */ -+static int rseq_get_rseq_cs_ptr_val(struct rseq __user *rseq, u64 *rseq_cs) -+{ -+ if (!rseq_cs) -+ return -EFAULT; -+ -+#ifdef CONFIG_64BIT -+ if (get_user(*rseq_cs, &rseq->rseq_cs)) -+ return -EFAULT; -+#else -+ if (copy_from_user(rseq_cs, &rseq->rseq_cs, sizeof(*rseq_cs))) -+ return -EFAULT; -+#endif -+ -+ return 0; -+} -+ -+/* -+ * If the rseq_cs field of 'struct rseq' contains a valid pointer to -+ * user-space, copy 'struct rseq_cs' from user-space and validate its fields. -+ */ - static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs) - { - struct rseq_cs __user *urseq_cs; -@@ -157,17 +180,16 @@ static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs) - u32 sig; - int ret; - --#ifdef CONFIG_64BIT -- if (get_user(ptr, &t->rseq->rseq_cs)) -- return -EFAULT; --#else -- if (copy_from_user(&ptr, &t->rseq->rseq_cs, sizeof(ptr))) -- return -EFAULT; --#endif -+ ret = rseq_get_rseq_cs_ptr_val(t->rseq, &ptr); -+ if (ret) -+ return ret; -+ -+ /* If the rseq_cs pointer is NULL, return a cleared struct rseq_cs. */ - if (!ptr) { - memset(rseq_cs, 0, sizeof(*rseq_cs)); - return 0; - } -+ /* Check that the pointer value fits in the user-space process space. */ - if (ptr >= TASK_SIZE) - return -EINVAL; - urseq_cs = (struct rseq_cs __user *)(unsigned long)ptr; -@@ -243,7 +265,7 @@ static int rseq_need_restart(struct task_struct *t, u32 cs_flags) - return !!event_mask; - } - --static int clear_rseq_cs(struct task_struct *t) -+static int clear_rseq_cs(struct rseq __user *rseq) - { - /* - * The rseq_cs field is set to NULL on preemption or signal -@@ -254,9 +276,9 @@ static int clear_rseq_cs(struct task_struct *t) - * Set rseq_cs to NULL. - */ - #ifdef CONFIG_64BIT -- return put_user(0UL, &t->rseq->rseq_cs); -+ return put_user(0UL, &rseq->rseq_cs); - #else -- if (clear_user(&t->rseq->rseq_cs, sizeof(t->rseq->rseq_cs))) -+ if (clear_user(&rseq->rseq_cs, sizeof(rseq->rseq_cs))) - return -EFAULT; - return 0; - #endif -@@ -288,11 +310,11 @@ static int rseq_ip_fixup(struct pt_regs *regs) - * Clear the rseq_cs pointer and return. - */ - if (!in_rseq_cs(ip, &rseq_cs)) -- return clear_rseq_cs(t); -+ return clear_rseq_cs(t->rseq); - ret = rseq_need_restart(t, rseq_cs.flags); - if (ret <= 0) - return ret; -- ret = clear_rseq_cs(t); -+ ret = clear_rseq_cs(t->rseq); - if (ret) - return ret; - trace_rseq_ip_fixup(ip, rseq_cs.start_ip, rseq_cs.post_commit_offset, -@@ -366,6 +388,7 @@ SYSCALL_DEFINE4(rseq, struct rseq __user *, rseq, u32, rseq_len, - int, flags, u32, sig) - { - int ret; -+ u64 rseq_cs; - - if (flags & RSEQ_FLAG_UNREGISTER) { - if (flags & ~RSEQ_FLAG_UNREGISTER) -@@ -420,6 +443,19 @@ SYSCALL_DEFINE4(rseq, struct rseq __user *, rseq, u32, rseq_len, - return -EINVAL; - if (!access_ok(rseq, rseq_len)) - return -EFAULT; -+ -+ /* -+ * If the rseq_cs pointer is non-NULL on registration, clear it to -+ * avoid a potential segfault on return to user-space. The proper thing -+ * to do would have been to fail the registration but this would break -+ * older libcs that reuse the rseq area for new threads without -+ * clearing the fields. -+ */ -+ if (rseq_get_rseq_cs_ptr_val(rseq, &rseq_cs)) -+ return -EFAULT; -+ if (rseq_cs && clear_rseq_cs(rseq)) -+ return -EFAULT; -+ - current->rseq = rseq; - current->rseq_len = rseq_len; - current->rseq_sig = sig; -diff --git a/lib/maple_tree.c b/lib/maple_tree.c -index a4a2592413b1b6..6f7a2c9cf922a2 100644 ---- a/lib/maple_tree.c -+++ b/lib/maple_tree.c -@@ -5270,6 +5270,7 @@ static void mt_destroy_walk(struct maple_enode *enode, struct maple_tree *mt, - struct maple_enode *start; - - if (mte_is_leaf(enode)) { -+ mte_set_node_dead(enode); - node->type = mte_node_type(enode); - goto free_leaf; - } -@@ -5497,7 +5498,7 @@ int mas_preallocate(struct ma_state *mas, void *entry, gfp_t gfp) - /* At this point, we are at the leaf node that needs to be altered. */ - /* Exact fit, no nodes needed. */ - if (wr_mas.r_min == mas->index && wr_mas.r_max == mas->last) -- return 0; -+ goto set_flag; - - mas_wr_end_piv(&wr_mas); - node_size = mas_wr_new_end(&wr_mas); -@@ -5506,10 +5507,10 @@ int mas_preallocate(struct ma_state *mas, void *entry, gfp_t gfp) - if (node_size == wr_mas.node_end) { - /* reuse node */ - if (!mt_in_rcu(mas->tree)) -- return 0; -+ goto set_flag; - /* shifting boundary */ - if (wr_mas.offset_end - mas->offset == 1) -- return 0; -+ goto set_flag; - } - - if (node_size >= mt_slots[wr_mas.type]) { -@@ -5528,10 +5529,13 @@ int mas_preallocate(struct ma_state *mas, void *entry, gfp_t gfp) - - /* node store, slot store needs one node */ - ask_now: -+ mas->mas_flags &= ~MA_STATE_PREALLOC; - mas_node_count_gfp(mas, request, gfp); -- mas->mas_flags |= MA_STATE_PREALLOC; -- if (likely(!mas_is_err(mas))) -+ if (likely(!mas_is_err(mas))) { -+set_flag: -+ mas->mas_flags |= MA_STATE_PREALLOC; - return 0; -+ } - - mas_set_alloc_req(mas, 0); - ret = xa_err(mas->node); -diff --git a/mm/kasan/report.c b/mm/kasan/report.c -index 465e6a53b3bf25..44636fa953a723 100644 ---- a/mm/kasan/report.c -+++ b/mm/kasan/report.c -@@ -385,17 +385,8 @@ static void print_address_description(void *addr, u8 tag, - } - - if (is_vmalloc_addr(addr)) { -- struct vm_struct *va = find_vm_area(addr); -- -- if (va) { -- pr_err("The buggy address belongs to the virtual mapping at\n" -- " [%px, %px) created by:\n" -- " %pS\n", -- va->addr, va->addr + va->size, va->caller); -- pr_err("\n"); -- -- page = vmalloc_to_page(addr); -- } -+ pr_err("The buggy address %px belongs to a vmalloc virtual mapping\n", addr); -+ page = vmalloc_to_page(addr); - } - - if (page) { -diff --git a/mm/vmalloc.c b/mm/vmalloc.c -index fb947787f25da2..7eb92bcdbd8c16 100644 ---- a/mm/vmalloc.c -+++ b/mm/vmalloc.c -@@ -459,6 +459,7 @@ static int vmap_pages_pte_range(pmd_t *pmd, unsigned long addr, - unsigned long end, pgprot_t prot, struct page **pages, int *nr, - pgtbl_mod_mask *mask) - { -+ int err = 0; - pte_t *pte; - - /* -@@ -472,18 +473,25 @@ static int vmap_pages_pte_range(pmd_t *pmd, unsigned long addr, - do { - struct page *page = pages[*nr]; - -- if (WARN_ON(!pte_none(ptep_get(pte)))) -- return -EBUSY; -- if (WARN_ON(!page)) -- return -ENOMEM; -- if (WARN_ON(!pfn_valid(page_to_pfn(page)))) -- return -EINVAL; -+ if (WARN_ON(!pte_none(ptep_get(pte)))) { -+ err = -EBUSY; -+ break; -+ } -+ if (WARN_ON(!page)) { -+ err = -ENOMEM; -+ break; -+ } -+ if (WARN_ON(!pfn_valid(page_to_pfn(page)))) { -+ err = -EINVAL; -+ break; -+ } - - set_pte_at(&init_mm, addr, pte, mk_pte(page, prot)); - (*nr)++; - } while (pte++, addr += PAGE_SIZE, addr != end); - *mask |= PGTBL_PTE_MODIFIED; -- return 0; -+ -+ return err; - } - - static int vmap_pages_pmd_range(pud_t *pud, unsigned long addr, -diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c -index b070a89912000a..febb1617e1a6a7 100644 ---- a/net/appletalk/ddp.c -+++ b/net/appletalk/ddp.c -@@ -563,6 +563,7 @@ static int atrtr_create(struct rtentry *r, struct net_device *devhint) - - /* Fill in the routing entry */ - rt->target = ta->sat_addr; -+ dev_put(rt->dev); /* Release old device */ - dev_hold(devhint); - rt->dev = devhint; - rt->flags = r->rt_flags; -diff --git a/net/atm/clip.c b/net/atm/clip.c -index 511467bb7fe40d..53d62361ae4606 100644 ---- a/net/atm/clip.c -+++ b/net/atm/clip.c -@@ -45,7 +45,8 @@ - #include - - static struct net_device *clip_devs; --static struct atm_vcc *atmarpd; -+static struct atm_vcc __rcu *atmarpd; -+static DEFINE_MUTEX(atmarpd_lock); - static struct timer_list idle_timer; - static const struct neigh_ops clip_neigh_ops; - -@@ -53,24 +54,35 @@ static int to_atmarpd(enum atmarp_ctrl_type type, int itf, __be32 ip) - { - struct sock *sk; - struct atmarp_ctrl *ctrl; -+ struct atm_vcc *vcc; - struct sk_buff *skb; -+ int err = 0; - - pr_debug("(%d)\n", type); -- if (!atmarpd) -- return -EUNATCH; -+ -+ rcu_read_lock(); -+ vcc = rcu_dereference(atmarpd); -+ if (!vcc) { -+ err = -EUNATCH; -+ goto unlock; -+ } - skb = alloc_skb(sizeof(struct atmarp_ctrl), GFP_ATOMIC); -- if (!skb) -- return -ENOMEM; -+ if (!skb) { -+ err = -ENOMEM; -+ goto unlock; -+ } - ctrl = skb_put(skb, sizeof(struct atmarp_ctrl)); - ctrl->type = type; - ctrl->itf_num = itf; - ctrl->ip = ip; -- atm_force_charge(atmarpd, skb->truesize); -+ atm_force_charge(vcc, skb->truesize); - -- sk = sk_atm(atmarpd); -+ sk = sk_atm(vcc); - skb_queue_tail(&sk->sk_receive_queue, skb); - sk->sk_data_ready(sk); -- return 0; -+unlock: -+ rcu_read_unlock(); -+ return err; - } - - static void link_vcc(struct clip_vcc *clip_vcc, struct atmarp_entry *entry) -@@ -417,6 +429,8 @@ static int clip_mkip(struct atm_vcc *vcc, int timeout) - - if (!vcc->push) - return -EBADFD; -+ if (vcc->user_back) -+ return -EINVAL; - clip_vcc = kmalloc(sizeof(struct clip_vcc), GFP_KERNEL); - if (!clip_vcc) - return -ENOMEM; -@@ -607,17 +621,27 @@ static void atmarpd_close(struct atm_vcc *vcc) - { - pr_debug("\n"); - -- rtnl_lock(); -- atmarpd = NULL; -+ mutex_lock(&atmarpd_lock); -+ RCU_INIT_POINTER(atmarpd, NULL); -+ mutex_unlock(&atmarpd_lock); -+ -+ synchronize_rcu(); - skb_queue_purge(&sk_atm(vcc)->sk_receive_queue); -- rtnl_unlock(); - - pr_debug("(done)\n"); - module_put(THIS_MODULE); - } - -+static int atmarpd_send(struct atm_vcc *vcc, struct sk_buff *skb) -+{ -+ atm_return_tx(vcc, skb); -+ dev_kfree_skb_any(skb); -+ return 0; -+} -+ - static const struct atmdev_ops atmarpd_dev_ops = { -- .close = atmarpd_close -+ .close = atmarpd_close, -+ .send = atmarpd_send - }; - - -@@ -631,15 +655,18 @@ static struct atm_dev atmarpd_dev = { - - static int atm_init_atmarp(struct atm_vcc *vcc) - { -- rtnl_lock(); -+ if (vcc->push == clip_push) -+ return -EINVAL; -+ -+ mutex_lock(&atmarpd_lock); - if (atmarpd) { -- rtnl_unlock(); -+ mutex_unlock(&atmarpd_lock); - return -EADDRINUSE; - } - - mod_timer(&idle_timer, jiffies + CLIP_CHECK_INTERVAL * HZ); - -- atmarpd = vcc; -+ rcu_assign_pointer(atmarpd, vcc); - set_bit(ATM_VF_META, &vcc->flags); - set_bit(ATM_VF_READY, &vcc->flags); - /* allow replies and avoid getting closed if signaling dies */ -@@ -648,13 +675,14 @@ static int atm_init_atmarp(struct atm_vcc *vcc) - vcc->push = NULL; - vcc->pop = NULL; /* crash */ - vcc->push_oam = NULL; /* crash */ -- rtnl_unlock(); -+ mutex_unlock(&atmarpd_lock); - return 0; - } - - static int clip_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) - { - struct atm_vcc *vcc = ATM_SD(sock); -+ struct sock *sk = sock->sk; - int err = 0; - - switch (cmd) { -@@ -675,14 +703,18 @@ static int clip_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) - err = clip_create(arg); - break; - case ATMARPD_CTRL: -+ lock_sock(sk); - err = atm_init_atmarp(vcc); - if (!err) { - sock->state = SS_CONNECTED; - __module_get(THIS_MODULE); - } -+ release_sock(sk); - break; - case ATMARP_MKIP: -+ lock_sock(sk); - err = clip_mkip(vcc, arg); -+ release_sock(sk); - break; - case ATMARP_SETENTRY: - err = clip_setentry(vcc, (__force __be32)arg); -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index 4029330e29a998..8516ba62c54559 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -2139,40 +2139,6 @@ static u8 hci_cc_set_adv_param(struct hci_dev *hdev, void *data, - return rp->status; - } - --static u8 hci_cc_set_ext_adv_param(struct hci_dev *hdev, void *data, -- struct sk_buff *skb) --{ -- struct hci_rp_le_set_ext_adv_params *rp = data; -- struct hci_cp_le_set_ext_adv_params *cp; -- struct adv_info *adv_instance; -- -- bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); -- -- if (rp->status) -- return rp->status; -- -- cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS); -- if (!cp) -- return rp->status; -- -- hci_dev_lock(hdev); -- hdev->adv_addr_type = cp->own_addr_type; -- if (!cp->handle) { -- /* Store in hdev for instance 0 */ -- hdev->adv_tx_power = rp->tx_power; -- } else { -- adv_instance = hci_find_adv_instance(hdev, cp->handle); -- if (adv_instance) -- adv_instance->tx_power = rp->tx_power; -- } -- /* Update adv data as tx power is known now */ -- hci_update_adv_data(hdev, cp->handle); -- -- hci_dev_unlock(hdev); -- -- return rp->status; --} -- - static u8 hci_cc_read_rssi(struct hci_dev *hdev, void *data, - struct sk_buff *skb) - { -@@ -4153,8 +4119,6 @@ static const struct hci_cc { - HCI_CC(HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS, - hci_cc_le_read_num_adv_sets, - sizeof(struct hci_rp_le_read_num_supported_adv_sets)), -- HCI_CC(HCI_OP_LE_SET_EXT_ADV_PARAMS, hci_cc_set_ext_adv_param, -- sizeof(struct hci_rp_le_set_ext_adv_params)), - HCI_CC_STATUS(HCI_OP_LE_SET_EXT_ADV_ENABLE, - hci_cc_le_set_ext_adv_enable), - HCI_CC_STATUS(HCI_OP_LE_SET_ADV_SET_RAND_ADDR, -@@ -6916,7 +6880,10 @@ static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data, - bis->iso_qos.bcast.in.sdu = le16_to_cpu(ev->max_pdu); - - if (!ev->status) { -+ bis->state = BT_CONNECTED; - set_bit(HCI_CONN_BIG_SYNC, &bis->flags); -+ hci_debugfs_create_conn(bis); -+ hci_conn_add_sysfs(bis); - hci_iso_setup_path(bis); - } - } -diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c -index d602e9d8eff450..e1df1c62017d91 100644 ---- a/net/bluetooth/hci_sync.c -+++ b/net/bluetooth/hci_sync.c -@@ -1224,9 +1224,129 @@ static int hci_set_adv_set_random_addr_sync(struct hci_dev *hdev, u8 instance, - sizeof(cp), &cp, HCI_CMD_TIMEOUT); - } - -+static int -+hci_set_ext_adv_params_sync(struct hci_dev *hdev, struct adv_info *adv, -+ const struct hci_cp_le_set_ext_adv_params *cp, -+ struct hci_rp_le_set_ext_adv_params *rp) -+{ -+ struct sk_buff *skb; -+ -+ skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS, sizeof(*cp), -+ cp, HCI_CMD_TIMEOUT); -+ -+ /* If command return a status event, skb will be set to -ENODATA */ -+ if (skb == ERR_PTR(-ENODATA)) -+ return 0; -+ -+ if (IS_ERR(skb)) { -+ bt_dev_err(hdev, "Opcode 0x%4.4x failed: %ld", -+ HCI_OP_LE_SET_EXT_ADV_PARAMS, PTR_ERR(skb)); -+ return PTR_ERR(skb); -+ } -+ -+ if (skb->len != sizeof(*rp)) { -+ bt_dev_err(hdev, "Invalid response length for 0x%4.4x: %u", -+ HCI_OP_LE_SET_EXT_ADV_PARAMS, skb->len); -+ kfree_skb(skb); -+ return -EIO; -+ } -+ -+ memcpy(rp, skb->data, sizeof(*rp)); -+ kfree_skb(skb); -+ -+ if (!rp->status) { -+ hdev->adv_addr_type = cp->own_addr_type; -+ if (!cp->handle) { -+ /* Store in hdev for instance 0 */ -+ hdev->adv_tx_power = rp->tx_power; -+ } else if (adv) { -+ adv->tx_power = rp->tx_power; -+ } -+ } -+ -+ return rp->status; -+} -+ -+static int hci_set_ext_adv_data_sync(struct hci_dev *hdev, u8 instance) -+{ -+ struct { -+ struct hci_cp_le_set_ext_adv_data cp; -+ u8 data[HCI_MAX_EXT_AD_LENGTH]; -+ } pdu; -+ u8 len; -+ struct adv_info *adv = NULL; -+ int err; -+ -+ memset(&pdu, 0, sizeof(pdu)); -+ -+ if (instance) { -+ adv = hci_find_adv_instance(hdev, instance); -+ if (!adv || !adv->adv_data_changed) -+ return 0; -+ } -+ -+ len = eir_create_adv_data(hdev, instance, pdu.data); -+ -+ pdu.cp.length = len; -+ pdu.cp.handle = instance; -+ pdu.cp.operation = LE_SET_ADV_DATA_OP_COMPLETE; -+ pdu.cp.frag_pref = LE_SET_ADV_DATA_NO_FRAG; -+ -+ err = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_DATA, -+ sizeof(pdu.cp) + len, &pdu.cp, -+ HCI_CMD_TIMEOUT); -+ if (err) -+ return err; -+ -+ /* Update data if the command succeed */ -+ if (adv) { -+ adv->adv_data_changed = false; -+ } else { -+ memcpy(hdev->adv_data, pdu.data, len); -+ hdev->adv_data_len = len; -+ } -+ -+ return 0; -+} -+ -+static int hci_set_adv_data_sync(struct hci_dev *hdev, u8 instance) -+{ -+ struct hci_cp_le_set_adv_data cp; -+ u8 len; -+ -+ memset(&cp, 0, sizeof(cp)); -+ -+ len = eir_create_adv_data(hdev, instance, cp.data); -+ -+ /* There's nothing to do if the data hasn't changed */ -+ if (hdev->adv_data_len == len && -+ memcmp(cp.data, hdev->adv_data, len) == 0) -+ return 0; -+ -+ memcpy(hdev->adv_data, cp.data, sizeof(cp.data)); -+ hdev->adv_data_len = len; -+ -+ cp.length = len; -+ -+ return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_DATA, -+ sizeof(cp), &cp, HCI_CMD_TIMEOUT); -+} -+ -+int hci_update_adv_data_sync(struct hci_dev *hdev, u8 instance) -+{ -+ if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) -+ return 0; -+ -+ if (ext_adv_capable(hdev)) -+ return hci_set_ext_adv_data_sync(hdev, instance); -+ -+ return hci_set_adv_data_sync(hdev, instance); -+} -+ - int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) - { - struct hci_cp_le_set_ext_adv_params cp; -+ struct hci_rp_le_set_ext_adv_params rp; - bool connectable; - u32 flags; - bdaddr_t random_addr; -@@ -1247,7 +1367,7 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) - * Command Disallowed error, so we must first disable the - * instance if it is active. - */ -- if (adv && !adv->pending) { -+ if (adv) { - err = hci_disable_ext_adv_instance_sync(hdev, instance); - if (err) - return err; -@@ -1333,8 +1453,12 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) - cp.secondary_phy = HCI_ADV_PHY_1M; - } - -- err = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS, -- sizeof(cp), &cp, HCI_CMD_TIMEOUT); -+ err = hci_set_ext_adv_params_sync(hdev, adv, &cp, &rp); -+ if (err) -+ return err; -+ -+ /* Update adv data as tx power is known now */ -+ err = hci_set_ext_adv_data_sync(hdev, cp.handle); - if (err) - return err; - -@@ -1859,82 +1983,6 @@ int hci_le_terminate_big_sync(struct hci_dev *hdev, u8 handle, u8 reason) - sizeof(cp), &cp, HCI_CMD_TIMEOUT); - } - --static int hci_set_ext_adv_data_sync(struct hci_dev *hdev, u8 instance) --{ -- struct { -- struct hci_cp_le_set_ext_adv_data cp; -- u8 data[HCI_MAX_EXT_AD_LENGTH]; -- } pdu; -- u8 len; -- struct adv_info *adv = NULL; -- int err; -- -- memset(&pdu, 0, sizeof(pdu)); -- -- if (instance) { -- adv = hci_find_adv_instance(hdev, instance); -- if (!adv || !adv->adv_data_changed) -- return 0; -- } -- -- len = eir_create_adv_data(hdev, instance, pdu.data); -- -- pdu.cp.length = len; -- pdu.cp.handle = instance; -- pdu.cp.operation = LE_SET_ADV_DATA_OP_COMPLETE; -- pdu.cp.frag_pref = LE_SET_ADV_DATA_NO_FRAG; -- -- err = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_DATA, -- sizeof(pdu.cp) + len, &pdu.cp, -- HCI_CMD_TIMEOUT); -- if (err) -- return err; -- -- /* Update data if the command succeed */ -- if (adv) { -- adv->adv_data_changed = false; -- } else { -- memcpy(hdev->adv_data, pdu.data, len); -- hdev->adv_data_len = len; -- } -- -- return 0; --} -- --static int hci_set_adv_data_sync(struct hci_dev *hdev, u8 instance) --{ -- struct hci_cp_le_set_adv_data cp; -- u8 len; -- -- memset(&cp, 0, sizeof(cp)); -- -- len = eir_create_adv_data(hdev, instance, cp.data); -- -- /* There's nothing to do if the data hasn't changed */ -- if (hdev->adv_data_len == len && -- memcmp(cp.data, hdev->adv_data, len) == 0) -- return 0; -- -- memcpy(hdev->adv_data, cp.data, sizeof(cp.data)); -- hdev->adv_data_len = len; -- -- cp.length = len; -- -- return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_DATA, -- sizeof(cp), &cp, HCI_CMD_TIMEOUT); --} -- --int hci_update_adv_data_sync(struct hci_dev *hdev, u8 instance) --{ -- if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) -- return 0; -- -- if (ext_adv_capable(hdev)) -- return hci_set_ext_adv_data_sync(hdev, instance); -- -- return hci_set_adv_data_sync(hdev, instance); --} -- - int hci_schedule_adv_instance_sync(struct hci_dev *hdev, u8 instance, - bool force) - { -@@ -6253,6 +6301,7 @@ static int hci_le_ext_directed_advertising_sync(struct hci_dev *hdev, - struct hci_conn *conn) - { - struct hci_cp_le_set_ext_adv_params cp; -+ struct hci_rp_le_set_ext_adv_params rp; - int err; - bdaddr_t random_addr; - u8 own_addr_type; -@@ -6294,8 +6343,12 @@ static int hci_le_ext_directed_advertising_sync(struct hci_dev *hdev, - if (err) - return err; - -- err = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS, -- sizeof(cp), &cp, HCI_CMD_TIMEOUT); -+ err = hci_set_ext_adv_params_sync(hdev, NULL, &cp, &rp); -+ if (err) -+ return err; -+ -+ /* Update adv data as tx power is known now */ -+ err = hci_set_ext_adv_data_sync(hdev, cp.handle); - if (err) - return err; - -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index ff22060f9145f9..a4bbe959d1e25f 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -1132,7 +1132,7 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size) - goto do_error; - - while (msg_data_left(msg)) { -- ssize_t copy = 0; -+ int copy = 0; - - skb = tcp_write_queue_tail(sk); - if (skb) -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 231fa4dc6cde4a..74f7f3e8d96083 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -3499,11 +3499,9 @@ static void addrconf_gre_config(struct net_device *dev) - - ASSERT_RTNL(); - -- idev = ipv6_find_idev(dev); -- if (IS_ERR(idev)) { -- pr_debug("%s: add_dev failed\n", __func__); -+ idev = addrconf_add_dev(dev); -+ if (IS_ERR(idev)) - return; -- } - - /* Generate the IPv6 link-local address using addrconf_addr_gen(), - * unless we have an IPv4 GRE device not bound to an IP address and -@@ -3517,9 +3515,6 @@ static void addrconf_gre_config(struct net_device *dev) - } - - add_v4_addrs(idev); -- -- if (dev->flags & IFF_POINTOPOINT) -- addrconf_add_mroute(dev); - } - #endif - -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index 4aa2cbe9d6fa69..0a412d9a8e5fdb 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -387,7 +387,6 @@ static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk) - WARN_ON(skb->sk != NULL); - skb->sk = sk; - skb->destructor = netlink_skb_destructor; -- atomic_add(skb->truesize, &sk->sk_rmem_alloc); - sk_mem_charge(sk, skb->truesize); - } - -@@ -1223,41 +1222,48 @@ static struct sk_buff *netlink_alloc_large_skb(unsigned int size, - int netlink_attachskb(struct sock *sk, struct sk_buff *skb, - long *timeo, struct sock *ssk) - { -+ DECLARE_WAITQUEUE(wait, current); - struct netlink_sock *nlk; -+ unsigned int rmem; - - nlk = nlk_sk(sk); -+ rmem = atomic_add_return(skb->truesize, &sk->sk_rmem_alloc); - -- if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf || -- test_bit(NETLINK_S_CONGESTED, &nlk->state))) { -- DECLARE_WAITQUEUE(wait, current); -- if (!*timeo) { -- if (!ssk || netlink_is_kernel(ssk)) -- netlink_overrun(sk); -- sock_put(sk); -- kfree_skb(skb); -- return -EAGAIN; -- } -- -- __set_current_state(TASK_INTERRUPTIBLE); -- add_wait_queue(&nlk->wait, &wait); -+ if ((rmem == skb->truesize || rmem < READ_ONCE(sk->sk_rcvbuf)) && -+ !test_bit(NETLINK_S_CONGESTED, &nlk->state)) { -+ netlink_skb_set_owner_r(skb, sk); -+ return 0; -+ } - -- if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf || -- test_bit(NETLINK_S_CONGESTED, &nlk->state)) && -- !sock_flag(sk, SOCK_DEAD)) -- *timeo = schedule_timeout(*timeo); -+ atomic_sub(skb->truesize, &sk->sk_rmem_alloc); - -- __set_current_state(TASK_RUNNING); -- remove_wait_queue(&nlk->wait, &wait); -+ if (!*timeo) { -+ if (!ssk || netlink_is_kernel(ssk)) -+ netlink_overrun(sk); - sock_put(sk); -+ kfree_skb(skb); -+ return -EAGAIN; -+ } - -- if (signal_pending(current)) { -- kfree_skb(skb); -- return sock_intr_errno(*timeo); -- } -- return 1; -+ __set_current_state(TASK_INTERRUPTIBLE); -+ add_wait_queue(&nlk->wait, &wait); -+ rmem = atomic_read(&sk->sk_rmem_alloc); -+ -+ if (((rmem && rmem + skb->truesize > READ_ONCE(sk->sk_rcvbuf)) || -+ test_bit(NETLINK_S_CONGESTED, &nlk->state)) && -+ !sock_flag(sk, SOCK_DEAD)) -+ *timeo = schedule_timeout(*timeo); -+ -+ __set_current_state(TASK_RUNNING); -+ remove_wait_queue(&nlk->wait, &wait); -+ sock_put(sk); -+ -+ if (signal_pending(current)) { -+ kfree_skb(skb); -+ return sock_intr_errno(*timeo); - } -- netlink_skb_set_owner_r(skb, sk); -- return 0; -+ -+ return 1; - } - - static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb) -@@ -1317,6 +1323,7 @@ static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb, - ret = -ECONNREFUSED; - if (nlk->netlink_rcv != NULL) { - ret = skb->len; -+ atomic_add(skb->truesize, &sk->sk_rmem_alloc); - netlink_skb_set_owner_r(skb, sk); - NETLINK_CB(skb).sk = ssk; - netlink_deliver_tap_kernel(sk, ssk, skb); -@@ -1393,13 +1400,19 @@ EXPORT_SYMBOL_GPL(netlink_strict_get_check); - static int netlink_broadcast_deliver(struct sock *sk, struct sk_buff *skb) - { - struct netlink_sock *nlk = nlk_sk(sk); -+ unsigned int rmem, rcvbuf; - -- if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf && -+ rmem = atomic_add_return(skb->truesize, &sk->sk_rmem_alloc); -+ rcvbuf = READ_ONCE(sk->sk_rcvbuf); -+ -+ if ((rmem == skb->truesize || rmem <= rcvbuf) && - !test_bit(NETLINK_S_CONGESTED, &nlk->state)) { - netlink_skb_set_owner_r(skb, sk); - __netlink_sendskb(sk, skb); -- return atomic_read(&sk->sk_rmem_alloc) > (sk->sk_rcvbuf >> 1); -+ return rmem > (rcvbuf >> 1); - } -+ -+ atomic_sub(skb->truesize, &sk->sk_rmem_alloc); - return -1; - } - -@@ -2186,6 +2199,7 @@ static int netlink_dump(struct sock *sk, bool lock_taken) - struct netlink_ext_ack extack = {}; - struct netlink_callback *cb; - struct sk_buff *skb = NULL; -+ unsigned int rmem, rcvbuf; - size_t max_recvmsg_len; - struct module *module; - int err = -ENOBUFS; -@@ -2199,9 +2213,6 @@ static int netlink_dump(struct sock *sk, bool lock_taken) - goto errout_skb; - } - -- if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) -- goto errout_skb; -- - /* NLMSG_GOODSIZE is small to avoid high order allocations being - * required, but it makes sense to _attempt_ a 16K bytes allocation - * to reduce number of system calls on dump operations, if user -@@ -2224,6 +2235,13 @@ static int netlink_dump(struct sock *sk, bool lock_taken) - if (!skb) - goto errout_skb; - -+ rcvbuf = READ_ONCE(sk->sk_rcvbuf); -+ rmem = atomic_add_return(skb->truesize, &sk->sk_rmem_alloc); -+ if (rmem != skb->truesize && rmem >= rcvbuf) { -+ atomic_sub(skb->truesize, &sk->sk_rmem_alloc); -+ goto errout_skb; -+ } -+ - /* Trim skb to allocated size. User is expected to provide buffer as - * large as max(min_dump_alloc, 16KiB (mac_recvmsg_len capped at - * netlink_recvmsg())). dump will pack as many smaller messages as -diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c -index 0f5a1d77b890f8..773bdb2e37dafd 100644 ---- a/net/rxrpc/call_accept.c -+++ b/net/rxrpc/call_accept.c -@@ -149,6 +149,7 @@ static int rxrpc_service_prealloc_one(struct rxrpc_sock *rx, - - id_in_use: - write_unlock(&rx->call_lock); -+ rxrpc_prefail_call(call, RXRPC_CALL_LOCAL_ERROR, -EBADSLT); - rxrpc_cleanup_call(call); - _leave(" = -EBADSLT"); - return -EBADSLT; -@@ -253,6 +254,9 @@ static struct rxrpc_call *rxrpc_alloc_incoming_call(struct rxrpc_sock *rx, - unsigned short call_tail, conn_tail, peer_tail; - unsigned short call_count, conn_count; - -+ if (!b) -+ return NULL; -+ - /* #calls >= #conns >= #peers must hold true. */ - call_head = smp_load_acquire(&b->call_backlog_head); - call_tail = b->call_backlog_tail; -diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c -index 282423106f15d9..a300e8c1b53aaa 100644 ---- a/net/sched/sch_api.c -+++ b/net/sched/sch_api.c -@@ -334,17 +334,22 @@ struct Qdisc *qdisc_lookup_rcu(struct net_device *dev, u32 handle) - return q; - } - --static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid) -+static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid, -+ struct netlink_ext_ack *extack) - { - unsigned long cl; - const struct Qdisc_class_ops *cops = p->ops->cl_ops; - -- if (cops == NULL) -- return NULL; -+ if (cops == NULL) { -+ NL_SET_ERR_MSG(extack, "Parent qdisc is not classful"); -+ return ERR_PTR(-EOPNOTSUPP); -+ } - cl = cops->find(p, classid); - -- if (cl == 0) -- return NULL; -+ if (cl == 0) { -+ NL_SET_ERR_MSG(extack, "Specified class not found"); -+ return ERR_PTR(-ENOENT); -+ } - return cops->leaf(p, cl); - } - -@@ -1497,7 +1502,7 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n, - NL_SET_ERR_MSG(extack, "Failed to find qdisc with specified classid"); - return -ENOENT; - } -- q = qdisc_leaf(p, clid); -+ q = qdisc_leaf(p, clid, extack); - } else if (dev_ingress_queue(dev)) { - q = rtnl_dereference(dev_ingress_queue(dev)->qdisc_sleeping); - } -@@ -1508,6 +1513,8 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n, - NL_SET_ERR_MSG(extack, "Cannot find specified qdisc on specified device"); - return -ENOENT; - } -+ if (IS_ERR(q)) -+ return PTR_ERR(q); - - if (tcm->tcm_handle && q->handle != tcm->tcm_handle) { - NL_SET_ERR_MSG(extack, "Invalid handle"); -@@ -1601,7 +1608,9 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n, - NL_SET_ERR_MSG(extack, "Failed to find specified qdisc"); - return -ENOENT; - } -- q = qdisc_leaf(p, clid); -+ q = qdisc_leaf(p, clid, extack); -+ if (IS_ERR(q)) -+ return PTR_ERR(q); - } else if (dev_ingress_queue_create(dev)) { - q = rtnl_dereference(dev_ingress_queue(dev)->qdisc_sleeping); - } -diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c -index 8ee0c07d00e9bb..ffe577bf6b5155 100644 ---- a/net/tipc/topsrv.c -+++ b/net/tipc/topsrv.c -@@ -704,8 +704,10 @@ static void tipc_topsrv_stop(struct net *net) - for (id = 0; srv->idr_in_use; id++) { - con = idr_find(&srv->conn_idr, id); - if (con) { -+ conn_get(con); - spin_unlock_bh(&srv->idr_lock); - tipc_conn_close(con); -+ conn_put(con); - spin_lock_bh(&srv->idr_lock); - } - } -diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c -index f8f1a49689da6c..f20b117e5255ef 100644 ---- a/net/vmw_vsock/af_vsock.c -+++ b/net/vmw_vsock/af_vsock.c -@@ -406,6 +406,8 @@ EXPORT_SYMBOL_GPL(vsock_enqueue_accept); - - static bool vsock_use_local_transport(unsigned int remote_cid) - { -+ lockdep_assert_held(&vsock_register_mutex); -+ - if (!transport_local) - return false; - -@@ -463,6 +465,8 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk) - - remote_flags = vsk->remote_addr.svm_flags; - -+ mutex_lock(&vsock_register_mutex); -+ - switch (sk->sk_type) { - case SOCK_DGRAM: - new_transport = transport_dgram; -@@ -478,12 +482,15 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk) - new_transport = transport_h2g; - break; - default: -- return -ESOCKTNOSUPPORT; -+ ret = -ESOCKTNOSUPPORT; -+ goto err; - } - - if (vsk->transport) { -- if (vsk->transport == new_transport) -- return 0; -+ if (vsk->transport == new_transport) { -+ ret = 0; -+ goto err; -+ } - - /* transport->release() must be called with sock lock acquired. - * This path can only be taken during vsock_connect(), where we -@@ -507,8 +514,16 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk) - /* We increase the module refcnt to prevent the transport unloading - * while there are open sockets assigned to it. - */ -- if (!new_transport || !try_module_get(new_transport->module)) -- return -ENODEV; -+ if (!new_transport || !try_module_get(new_transport->module)) { -+ ret = -ENODEV; -+ goto err; -+ } -+ -+ /* It's safe to release the mutex after a successful try_module_get(). -+ * Whichever transport `new_transport` points at, it won't go away until -+ * the last module_put() below or in vsock_deassign_transport(). -+ */ -+ mutex_unlock(&vsock_register_mutex); - - if (sk->sk_type == SOCK_SEQPACKET) { - if (!new_transport->seqpacket_allow || -@@ -527,12 +542,31 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk) - vsk->transport = new_transport; - - return 0; -+err: -+ mutex_unlock(&vsock_register_mutex); -+ return ret; - } - EXPORT_SYMBOL_GPL(vsock_assign_transport); - -+/* -+ * Provide safe access to static transport_{h2g,g2h,dgram,local} callbacks. -+ * Otherwise we may race with module removal. Do not use on `vsk->transport`. -+ */ -+static u32 vsock_registered_transport_cid(const struct vsock_transport **transport) -+{ -+ u32 cid = VMADDR_CID_ANY; -+ -+ mutex_lock(&vsock_register_mutex); -+ if (*transport) -+ cid = (*transport)->get_local_cid(); -+ mutex_unlock(&vsock_register_mutex); -+ -+ return cid; -+} -+ - bool vsock_find_cid(unsigned int cid) - { -- if (transport_g2h && cid == transport_g2h->get_local_cid()) -+ if (cid == vsock_registered_transport_cid(&transport_g2h)) - return true; - - if (transport_h2g && cid == VMADDR_CID_HOST) -@@ -2391,18 +2425,19 @@ static long vsock_dev_do_ioctl(struct file *filp, - unsigned int cmd, void __user *ptr) - { - u32 __user *p = ptr; -- u32 cid = VMADDR_CID_ANY; - int retval = 0; -+ u32 cid; - - switch (cmd) { - case IOCTL_VM_SOCKETS_GET_LOCAL_CID: - /* To be compatible with the VMCI behavior, we prioritize the - * guest CID instead of well-know host CID (VMADDR_CID_HOST). - */ -- if (transport_g2h) -- cid = transport_g2h->get_local_cid(); -- else if (transport_h2g) -- cid = transport_h2g->get_local_cid(); -+ cid = vsock_registered_transport_cid(&transport_g2h); -+ if (cid == VMADDR_CID_ANY) -+ cid = vsock_registered_transport_cid(&transport_h2g); -+ if (cid == VMADDR_CID_ANY) -+ cid = vsock_registered_transport_cid(&transport_local); - - if (put_user(cid, p) != 0) - retval = -EFAULT; -diff --git a/net/wireless/util.c b/net/wireless/util.c -index 7acd8d0db61a76..24e5af65da58ea 100644 ---- a/net/wireless/util.c -+++ b/net/wireless/util.c -@@ -826,6 +826,52 @@ bool ieee80211_is_valid_amsdu(struct sk_buff *skb, u8 mesh_hdr) - } - EXPORT_SYMBOL(ieee80211_is_valid_amsdu); - -+ -+/* -+ * Detects if an MSDU frame was maliciously converted into an A-MSDU -+ * frame by an adversary. This is done by parsing the received frame -+ * as if it were a regular MSDU, even though the A-MSDU flag is set. -+ * -+ * For non-mesh interfaces, detection involves checking whether the -+ * payload, when interpreted as an MSDU, begins with a valid RFC1042 -+ * header. This is done by comparing the A-MSDU subheader's destination -+ * address to the start of the RFC1042 header. -+ * -+ * For mesh interfaces, the MSDU includes a 6-byte Mesh Control field -+ * and an optional variable-length Mesh Address Extension field before -+ * the RFC1042 header. The position of the RFC1042 header must therefore -+ * be calculated based on the mesh header length. -+ * -+ * Since this function intentionally parses an A-MSDU frame as an MSDU, -+ * it only assumes that the A-MSDU subframe header is present, and -+ * beyond this it performs its own bounds checks under the assumption -+ * that the frame is instead parsed as a non-aggregated MSDU. -+ */ -+static bool -+is_amsdu_aggregation_attack(struct ethhdr *eth, struct sk_buff *skb, -+ enum nl80211_iftype iftype) -+{ -+ int offset; -+ -+ /* Non-mesh case can be directly compared */ -+ if (iftype != NL80211_IFTYPE_MESH_POINT) -+ return ether_addr_equal(eth->h_dest, rfc1042_header); -+ -+ offset = __ieee80211_get_mesh_hdrlen(eth->h_dest[0]); -+ if (offset == 6) { -+ /* Mesh case with empty address extension field */ -+ return ether_addr_equal(eth->h_source, rfc1042_header); -+ } else if (offset + ETH_ALEN <= skb->len) { -+ /* Mesh case with non-empty address extension field */ -+ u8 temp[ETH_ALEN]; -+ -+ skb_copy_bits(skb, offset, temp, ETH_ALEN); -+ return ether_addr_equal(temp, rfc1042_header); -+ } -+ -+ return false; -+} -+ - void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list, - const u8 *addr, enum nl80211_iftype iftype, - const unsigned int extra_headroom, -@@ -867,8 +913,10 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list, - /* the last MSDU has no padding */ - if (subframe_len > remaining) - goto purge; -- /* mitigate A-MSDU aggregation injection attacks */ -- if (ether_addr_equal(hdr.eth.h_dest, rfc1042_header)) -+ /* mitigate A-MSDU aggregation injection attacks, to be -+ * checked when processing first subframe (offset == 0). -+ */ -+ if (offset == 0 && is_amsdu_aggregation_attack(&hdr.eth, skb, iftype)) - goto purge; - - offset += sizeof(struct ethhdr); -diff --git a/scripts/gdb/linux/constants.py.in b/scripts/gdb/linux/constants.py.in -index e810e0c27ff18d..866c13468ebf82 100644 ---- a/scripts/gdb/linux/constants.py.in -+++ b/scripts/gdb/linux/constants.py.in -@@ -20,6 +20,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -93,6 +94,12 @@ LX_GDBPARSED(RADIX_TREE_MAP_SIZE) - LX_GDBPARSED(RADIX_TREE_MAP_SHIFT) - LX_GDBPARSED(RADIX_TREE_MAP_MASK) - -+/* linux/maple_tree.h */ -+LX_VALUE(MAPLE_NODE_SLOTS) -+LX_VALUE(MAPLE_RANGE64_SLOTS) -+LX_VALUE(MAPLE_ARANGE64_SLOTS) -+LX_GDBPARSED(MAPLE_NODE_MASK) -+ - /* linux/vmalloc.h */ - LX_VALUE(VM_IOREMAP) - LX_VALUE(VM_ALLOC) -diff --git a/scripts/gdb/linux/interrupts.py b/scripts/gdb/linux/interrupts.py -index ef478e273791f3..b371a62213a005 100644 ---- a/scripts/gdb/linux/interrupts.py -+++ b/scripts/gdb/linux/interrupts.py -@@ -7,7 +7,7 @@ import gdb - from linux import constants - from linux import cpus - from linux import utils --from linux import radixtree -+from linux import mapletree - - irq_desc_type = utils.CachedType("struct irq_desc") - -@@ -23,12 +23,12 @@ def irqd_is_level(desc): - def show_irq_desc(prec, irq): - text = "" - -- desc = radixtree.lookup(gdb.parse_and_eval("&irq_desc_tree"), irq) -+ desc = mapletree.mtree_load(gdb.parse_and_eval("&sparse_irqs"), irq) - if desc is None: - return text - -- desc = desc.cast(irq_desc_type.get_type()) -- if desc is None: -+ desc = desc.cast(irq_desc_type.get_type().pointer()) -+ if desc == 0: - return text - - if irq_settings_is_hidden(desc): -@@ -110,7 +110,7 @@ def x86_show_mce(prec, var, pfx, desc): - pvar = gdb.parse_and_eval(var) - text = "%*s: " % (prec, pfx) - for cpu in cpus.each_online_cpu(): -- text += "%10u " % (cpus.per_cpu(pvar, cpu)) -+ text += "%10u " % (cpus.per_cpu(pvar, cpu).dereference()) - text += " %s\n" % (desc) - return text - -@@ -142,7 +142,7 @@ def x86_show_interupts(prec): - - if constants.LX_CONFIG_X86_MCE: - text += x86_show_mce(prec, "&mce_exception_count", "MCE", "Machine check exceptions") -- text == x86_show_mce(prec, "&mce_poll_count", "MCP", "Machine check polls") -+ text += x86_show_mce(prec, "&mce_poll_count", "MCP", "Machine check polls") - - text += show_irq_err_count(prec) - -@@ -221,8 +221,8 @@ class LxInterruptList(gdb.Command): - gdb.write("CPU%-8d" % cpu) - gdb.write("\n") - -- if utils.gdb_eval_or_none("&irq_desc_tree") is None: -- return -+ if utils.gdb_eval_or_none("&sparse_irqs") is None: -+ raise gdb.GdbError("Unable to find the sparse IRQ tree, is CONFIG_SPARSE_IRQ enabled?") - - for irq in range(nr_irqs): - gdb.write(show_irq_desc(prec, irq)) -diff --git a/scripts/gdb/linux/mapletree.py b/scripts/gdb/linux/mapletree.py -new file mode 100644 -index 00000000000000..d52d51c0a03fcb ---- /dev/null -+++ b/scripts/gdb/linux/mapletree.py -@@ -0,0 +1,252 @@ -+# SPDX-License-Identifier: GPL-2.0 -+# -+# Maple tree helpers -+# -+# Copyright (c) 2025 Broadcom -+# -+# Authors: -+# Florian Fainelli -+ -+import gdb -+ -+from linux import utils -+from linux import constants -+from linux import xarray -+ -+maple_tree_root_type = utils.CachedType("struct maple_tree") -+maple_node_type = utils.CachedType("struct maple_node") -+maple_enode_type = utils.CachedType("void") -+ -+maple_dense = 0 -+maple_leaf_64 = 1 -+maple_range_64 = 2 -+maple_arange_64 = 3 -+ -+class Mas(object): -+ ma_active = 0 -+ ma_start = 1 -+ ma_root = 2 -+ ma_none = 3 -+ ma_pause = 4 -+ ma_overflow = 5 -+ ma_underflow = 6 -+ ma_error = 7 -+ -+ def __init__(self, mt, first, end): -+ if mt.type == maple_tree_root_type.get_type().pointer(): -+ self.tree = mt.dereference() -+ elif mt.type != maple_tree_root_type.get_type(): -+ raise gdb.GdbError("must be {} not {}" -+ .format(maple_tree_root_type.get_type().pointer(), mt.type)) -+ self.tree = mt -+ self.index = first -+ self.last = end -+ self.node = None -+ self.status = self.ma_start -+ self.min = 0 -+ self.max = -1 -+ -+ def is_start(self): -+ # mas_is_start() -+ return self.status == self.ma_start -+ -+ def is_ptr(self): -+ # mas_is_ptr() -+ return self.status == self.ma_root -+ -+ def is_none(self): -+ # mas_is_none() -+ return self.status == self.ma_none -+ -+ def root(self): -+ # mas_root() -+ return self.tree['ma_root'].cast(maple_enode_type.get_type().pointer()) -+ -+ def start(self): -+ # mas_start() -+ if self.is_start() is False: -+ return None -+ -+ self.min = 0 -+ self.max = ~0 -+ -+ while True: -+ self.depth = 0 -+ root = self.root() -+ if xarray.xa_is_node(root): -+ self.depth = 0 -+ self.status = self.ma_active -+ self.node = mte_safe_root(root) -+ self.offset = 0 -+ if mte_dead_node(self.node) is True: -+ continue -+ -+ return None -+ -+ self.node = None -+ # Empty tree -+ if root is None: -+ self.status = self.ma_none -+ self.offset = constants.LX_MAPLE_NODE_SLOTS -+ return None -+ -+ # Single entry tree -+ self.status = self.ma_root -+ self.offset = constants.LX_MAPLE_NODE_SLOTS -+ -+ if self.index != 0: -+ return None -+ -+ return root -+ -+ return None -+ -+ def reset(self): -+ # mas_reset() -+ self.status = self.ma_start -+ self.node = None -+ -+def mte_safe_root(node): -+ if node.type != maple_enode_type.get_type().pointer(): -+ raise gdb.GdbError("{} must be {} not {}" -+ .format(mte_safe_root.__name__, maple_enode_type.get_type().pointer(), node.type)) -+ ulong_type = utils.get_ulong_type() -+ indirect_ptr = node.cast(ulong_type) & ~0x2 -+ val = indirect_ptr.cast(maple_enode_type.get_type().pointer()) -+ return val -+ -+def mte_node_type(entry): -+ ulong_type = utils.get_ulong_type() -+ val = None -+ if entry.type == maple_enode_type.get_type().pointer(): -+ val = entry.cast(ulong_type) -+ elif entry.type == ulong_type: -+ val = entry -+ else: -+ raise gdb.GdbError("{} must be {} not {}" -+ .format(mte_node_type.__name__, maple_enode_type.get_type().pointer(), entry.type)) -+ return (val >> 0x3) & 0xf -+ -+def ma_dead_node(node): -+ if node.type != maple_node_type.get_type().pointer(): -+ raise gdb.GdbError("{} must be {} not {}" -+ .format(ma_dead_node.__name__, maple_node_type.get_type().pointer(), node.type)) -+ ulong_type = utils.get_ulong_type() -+ parent = node['parent'] -+ indirect_ptr = node['parent'].cast(ulong_type) & ~constants.LX_MAPLE_NODE_MASK -+ return indirect_ptr == node -+ -+def mte_to_node(enode): -+ ulong_type = utils.get_ulong_type() -+ if enode.type == maple_enode_type.get_type().pointer(): -+ indirect_ptr = enode.cast(ulong_type) -+ elif enode.type == ulong_type: -+ indirect_ptr = enode -+ else: -+ raise gdb.GdbError("{} must be {} not {}" -+ .format(mte_to_node.__name__, maple_enode_type.get_type().pointer(), enode.type)) -+ indirect_ptr = indirect_ptr & ~constants.LX_MAPLE_NODE_MASK -+ return indirect_ptr.cast(maple_node_type.get_type().pointer()) -+ -+def mte_dead_node(enode): -+ if enode.type != maple_enode_type.get_type().pointer(): -+ raise gdb.GdbError("{} must be {} not {}" -+ .format(mte_dead_node.__name__, maple_enode_type.get_type().pointer(), enode.type)) -+ node = mte_to_node(enode) -+ return ma_dead_node(node) -+ -+def ma_is_leaf(tp): -+ result = tp < maple_range_64 -+ return tp < maple_range_64 -+ -+def mt_pivots(t): -+ if t == maple_dense: -+ return 0 -+ elif t == maple_leaf_64 or t == maple_range_64: -+ return constants.LX_MAPLE_RANGE64_SLOTS - 1 -+ elif t == maple_arange_64: -+ return constants.LX_MAPLE_ARANGE64_SLOTS - 1 -+ -+def ma_pivots(node, t): -+ if node.type != maple_node_type.get_type().pointer(): -+ raise gdb.GdbError("{}: must be {} not {}" -+ .format(ma_pivots.__name__, maple_node_type.get_type().pointer(), node.type)) -+ if t == maple_arange_64: -+ return node['ma64']['pivot'] -+ elif t == maple_leaf_64 or t == maple_range_64: -+ return node['mr64']['pivot'] -+ else: -+ return None -+ -+def ma_slots(node, tp): -+ if node.type != maple_node_type.get_type().pointer(): -+ raise gdb.GdbError("{}: must be {} not {}" -+ .format(ma_slots.__name__, maple_node_type.get_type().pointer(), node.type)) -+ if tp == maple_arange_64: -+ return node['ma64']['slot'] -+ elif tp == maple_range_64 or tp == maple_leaf_64: -+ return node['mr64']['slot'] -+ elif tp == maple_dense: -+ return node['slot'] -+ else: -+ return None -+ -+def mt_slot(mt, slots, offset): -+ ulong_type = utils.get_ulong_type() -+ return slots[offset].cast(ulong_type) -+ -+def mtree_lookup_walk(mas): -+ ulong_type = utils.get_ulong_type() -+ n = mas.node -+ -+ while True: -+ node = mte_to_node(n) -+ tp = mte_node_type(n) -+ pivots = ma_pivots(node, tp) -+ end = mt_pivots(tp) -+ offset = 0 -+ while True: -+ if pivots[offset] >= mas.index: -+ break -+ if offset >= end: -+ break -+ offset += 1 -+ -+ slots = ma_slots(node, tp) -+ n = mt_slot(mas.tree, slots, offset) -+ if ma_dead_node(node) is True: -+ mas.reset() -+ return None -+ break -+ -+ if ma_is_leaf(tp) is True: -+ break -+ -+ return n -+ -+def mtree_load(mt, index): -+ ulong_type = utils.get_ulong_type() -+ # MT_STATE(...) -+ mas = Mas(mt, index, index) -+ entry = None -+ -+ while True: -+ entry = mas.start() -+ if mas.is_none(): -+ return None -+ -+ if mas.is_ptr(): -+ if index != 0: -+ entry = None -+ return entry -+ -+ entry = mtree_lookup_walk(mas) -+ if entry is None and mas.is_start(): -+ continue -+ else: -+ break -+ -+ if xarray.xa_is_zero(entry): -+ return None -+ -+ return entry -diff --git a/scripts/gdb/linux/xarray.py b/scripts/gdb/linux/xarray.py -new file mode 100644 -index 00000000000000..f4477b5def75fc ---- /dev/null -+++ b/scripts/gdb/linux/xarray.py -@@ -0,0 +1,28 @@ -+# SPDX-License-Identifier: GPL-2.0 -+# -+# Xarray helpers -+# -+# Copyright (c) 2025 Broadcom -+# -+# Authors: -+# Florian Fainelli -+ -+import gdb -+ -+from linux import utils -+from linux import constants -+ -+def xa_is_internal(entry): -+ ulong_type = utils.get_ulong_type() -+ return ((entry.cast(ulong_type) & 3) == 2) -+ -+def xa_mk_internal(v): -+ return ((v << 2) | 2) -+ -+def xa_is_zero(entry): -+ ulong_type = utils.get_ulong_type() -+ return entry.cast(ulong_type) == xa_mk_internal(257) -+ -+def xa_is_node(entry): -+ ulong_type = utils.get_ulong_type() -+ return xa_is_internal(entry) and (entry.cast(ulong_type) > 4096) -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 0d367cec03adef..1c2059e37fdab6 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -10151,6 +10151,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x8975, "HP EliteBook x360 840 Aero G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x897d, "HP mt440 Mobile Thin Client U74", ALC236_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x8981, "HP Elite Dragonfly G3", ALC245_FIXUP_CS35L41_SPI_4), -+ SND_PCI_QUIRK(0x103c, 0x898a, "HP Pavilion 15-eg100", ALC287_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x898e, "HP EliteBook 835 G9", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x103c, 0x898f, "HP EliteBook 835 G9", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x103c, 0x8991, "HP EliteBook 845 G9", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED), -diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c -index 429e61d47ffbbe..66ef8f4fd02cd4 100644 ---- a/sound/soc/amd/yc/acp6x-mach.c -+++ b/sound/soc/amd/yc/acp6x-mach.c -@@ -346,6 +346,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "83Q3"), - } - }, -+ { -+ .driver_data = &acp6x_card, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "RB"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Nitro ANV15-41"), -+ } -+ }, - { - .driver_data = &acp6x_card, - .matches = { -diff --git a/sound/soc/codecs/cs35l56-shared.c b/sound/soc/codecs/cs35l56-shared.c -index d3db89c93b331d..25ee7477709e76 100644 ---- a/sound/soc/codecs/cs35l56-shared.c -+++ b/sound/soc/codecs/cs35l56-shared.c -@@ -661,7 +661,7 @@ int cs35l56_hw_init(struct cs35l56_base *cs35l56_base) - break; - default: - dev_err(cs35l56_base->dev, "Unknown device %x\n", devid); -- return ret; -+ return -ENODEV; - } - - ret = regmap_read(cs35l56_base->regmap, CS35L56_DSP_RESTRICT_STS1, &secured); -diff --git a/sound/soc/fsl/fsl_asrc.c b/sound/soc/fsl/fsl_asrc.c -index b793263291dc8d..72dc23c994bcd6 100644 ---- a/sound/soc/fsl/fsl_asrc.c -+++ b/sound/soc/fsl/fsl_asrc.c -@@ -517,7 +517,8 @@ static int fsl_asrc_config_pair(struct fsl_asrc_pair *pair, bool use_ideal_rate) - regmap_update_bits(asrc->regmap, REG_ASRCTR, - ASRCTR_ATSi_MASK(index), ASRCTR_ATS(index)); - regmap_update_bits(asrc->regmap, REG_ASRCTR, -- ASRCTR_USRi_MASK(index), 0); -+ ASRCTR_IDRi_MASK(index) | ASRCTR_USRi_MASK(index), -+ ASRCTR_USR(index)); - - /* Set the input and output clock sources */ - regmap_update_bits(asrc->regmap, REG_ASRCSR, -diff --git a/tools/arch/x86/include/asm/msr-index.h b/tools/arch/x86/include/asm/msr-index.h -index 1d111350197f31..76f9cad9fb62b1 100644 ---- a/tools/arch/x86/include/asm/msr-index.h -+++ b/tools/arch/x86/include/asm/msr-index.h -@@ -550,6 +550,7 @@ - #define MSR_AMD64_OSVW_STATUS 0xc0010141 - #define MSR_AMD_PPIN_CTL 0xc00102f0 - #define MSR_AMD_PPIN 0xc00102f1 -+#define MSR_AMD64_CPUID_FN_7 0xc0011002 - #define MSR_AMD64_CPUID_FN_1 0xc0011004 - #define MSR_AMD64_LS_CFG 0xc0011020 - #define MSR_AMD64_DC_CFG 0xc0011022 -diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile -index dad79ede4e0ae0..4f869fff28fe43 100644 ---- a/tools/build/feature/Makefile -+++ b/tools/build/feature/Makefile -@@ -80,7 +80,30 @@ FILES= \ - - FILES := $(addprefix $(OUTPUT),$(FILES)) - --PKG_CONFIG ?= $(CROSS_COMPILE)pkg-config -+# Some distros provide the command $(CROSS_COMPILE)pkg-config for -+# searching packges installed with Multiarch. Use it for cross -+# compilation if it is existed. -+ifneq (, $(shell which $(CROSS_COMPILE)pkg-config)) -+ PKG_CONFIG ?= $(CROSS_COMPILE)pkg-config -+else -+ PKG_CONFIG ?= pkg-config -+ -+ # PKG_CONFIG_PATH or PKG_CONFIG_LIBDIR, alongside PKG_CONFIG_SYSROOT_DIR -+ # for modified system root, are required for the cross compilation. -+ # If these PKG_CONFIG environment variables are not set, Multiarch library -+ # paths are used instead. -+ ifdef CROSS_COMPILE -+ ifeq ($(PKG_CONFIG_LIBDIR)$(PKG_CONFIG_PATH)$(PKG_CONFIG_SYSROOT_DIR),) -+ CROSS_ARCH = $(shell $(CC) -dumpmachine) -+ PKG_CONFIG_LIBDIR := /usr/local/$(CROSS_ARCH)/lib/pkgconfig/ -+ PKG_CONFIG_LIBDIR := $(PKG_CONFIG_LIBDIR):/usr/local/lib/$(CROSS_ARCH)/pkgconfig/ -+ PKG_CONFIG_LIBDIR := $(PKG_CONFIG_LIBDIR):/usr/lib/$(CROSS_ARCH)/pkgconfig/ -+ PKG_CONFIG_LIBDIR := $(PKG_CONFIG_LIBDIR):/usr/local/share/pkgconfig/ -+ PKG_CONFIG_LIBDIR := $(PKG_CONFIG_LIBDIR):/usr/share/pkgconfig/ -+ export PKG_CONFIG_LIBDIR -+ endif -+ endif -+endif - - all: $(FILES) - -diff --git a/tools/include/linux/kallsyms.h b/tools/include/linux/kallsyms.h -index 5a37ccbec54fbc..f61a01dd7eb7c7 100644 ---- a/tools/include/linux/kallsyms.h -+++ b/tools/include/linux/kallsyms.h -@@ -18,6 +18,7 @@ static inline const char *kallsyms_lookup(unsigned long addr, - return NULL; - } - -+#ifdef HAVE_BACKTRACE_SUPPORT - #include - #include - static inline void print_ip_sym(const char *loglvl, unsigned long ip) -@@ -30,5 +31,8 @@ static inline void print_ip_sym(const char *loglvl, unsigned long ip) - - free(name); - } -+#else -+static inline void print_ip_sym(const char *loglvl, unsigned long ip) {} -+#endif - - #endif -diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf -index b97224a8a65b9d..ff72a0d9dea0c3 100644 ---- a/tools/perf/Makefile.perf -+++ b/tools/perf/Makefile.perf -@@ -188,7 +188,32 @@ HOSTLD ?= ld - HOSTAR ?= ar - CLANG ?= clang - --PKG_CONFIG = $(CROSS_COMPILE)pkg-config -+# Some distros provide the command $(CROSS_COMPILE)pkg-config for -+# searching packges installed with Multiarch. Use it for cross -+# compilation if it is existed. -+ifneq (, $(shell which $(CROSS_COMPILE)pkg-config)) -+ PKG_CONFIG ?= $(CROSS_COMPILE)pkg-config -+else -+ PKG_CONFIG ?= pkg-config -+ -+ # PKG_CONFIG_PATH or PKG_CONFIG_LIBDIR, alongside PKG_CONFIG_SYSROOT_DIR -+ # for modified system root, is required for the cross compilation. -+ # If these PKG_CONFIG environment variables are not set, Multiarch library -+ # paths are used instead. -+ ifdef CROSS_COMPILE -+ ifeq ($(PKG_CONFIG_LIBDIR)$(PKG_CONFIG_PATH)$(PKG_CONFIG_SYSROOT_DIR),) -+ CROSS_ARCH = $(shell $(CC) -dumpmachine) -+ PKG_CONFIG_LIBDIR := /usr/local/$(CROSS_ARCH)/lib/pkgconfig/ -+ PKG_CONFIG_LIBDIR := $(PKG_CONFIG_LIBDIR):/usr/local/lib/$(CROSS_ARCH)/pkgconfig/ -+ PKG_CONFIG_LIBDIR := $(PKG_CONFIG_LIBDIR):/usr/lib/$(CROSS_ARCH)/pkgconfig/ -+ PKG_CONFIG_LIBDIR := $(PKG_CONFIG_LIBDIR):/usr/local/share/pkgconfig/ -+ PKG_CONFIG_LIBDIR := $(PKG_CONFIG_LIBDIR):/usr/share/pkgconfig/ -+ export PKG_CONFIG_LIBDIR -+ $(warning Missing PKG_CONFIG_LIBDIR, PKG_CONFIG_PATH and PKG_CONFIG_SYSROOT_DIR for cross compilation,) -+ $(warning set PKG_CONFIG_LIBDIR for using Multiarch libs.) -+ endif -+ endif -+endif - - RM = rm -f - LN = ln -f -diff --git a/tools/testing/selftests/bpf/test_lru_map.c b/tools/testing/selftests/bpf/test_lru_map.c -index fda7589c50236c..0921939532c6c2 100644 ---- a/tools/testing/selftests/bpf/test_lru_map.c -+++ b/tools/testing/selftests/bpf/test_lru_map.c -@@ -138,6 +138,18 @@ static int sched_next_online(int pid, int *next_to_try) - return ret; - } - -+/* Derive target_free from map_size, same as bpf_common_lru_populate */ -+static unsigned int __tgt_size(unsigned int map_size) -+{ -+ return (map_size / nr_cpus) / 2; -+} -+ -+/* Inverse of how bpf_common_lru_populate derives target_free from map_size. */ -+static unsigned int __map_size(unsigned int tgt_free) -+{ -+ return tgt_free * nr_cpus * 2; -+} -+ - /* Size of the LRU map is 2 - * Add key=1 (+1 key) - * Add key=2 (+1 key) -@@ -231,11 +243,11 @@ static void test_lru_sanity0(int map_type, int map_flags) - printf("Pass\n"); - } - --/* Size of the LRU map is 1.5*tgt_free -- * Insert 1 to tgt_free (+tgt_free keys) -- * Lookup 1 to tgt_free/2 -- * Insert 1+tgt_free to 2*tgt_free (+tgt_free keys) -- * => 1+tgt_free/2 to LOCALFREE_TARGET will be removed by LRU -+/* Verify that unreferenced elements are recycled before referenced ones. -+ * Insert elements. -+ * Reference a subset of these. -+ * Insert more, enough to trigger recycling. -+ * Verify that unreferenced are recycled. - */ - static void test_lru_sanity1(int map_type, int map_flags, unsigned int tgt_free) - { -@@ -257,7 +269,7 @@ static void test_lru_sanity1(int map_type, int map_flags, unsigned int tgt_free) - batch_size = tgt_free / 2; - assert(batch_size * 2 == tgt_free); - -- map_size = tgt_free + batch_size; -+ map_size = __map_size(tgt_free) + batch_size; - lru_map_fd = create_map(map_type, map_flags, map_size); - assert(lru_map_fd != -1); - -@@ -266,13 +278,13 @@ static void test_lru_sanity1(int map_type, int map_flags, unsigned int tgt_free) - - value[0] = 1234; - -- /* Insert 1 to tgt_free (+tgt_free keys) */ -- end_key = 1 + tgt_free; -+ /* Insert map_size - batch_size keys */ -+ end_key = 1 + __map_size(tgt_free); - for (key = 1; key < end_key; key++) - assert(!bpf_map_update_elem(lru_map_fd, &key, value, - BPF_NOEXIST)); - -- /* Lookup 1 to tgt_free/2 */ -+ /* Lookup 1 to batch_size */ - end_key = 1 + batch_size; - for (key = 1; key < end_key; key++) { - assert(!bpf_map_lookup_elem_with_ref_bit(lru_map_fd, key, value)); -@@ -280,12 +292,13 @@ static void test_lru_sanity1(int map_type, int map_flags, unsigned int tgt_free) - BPF_NOEXIST)); - } - -- /* Insert 1+tgt_free to 2*tgt_free -- * => 1+tgt_free/2 to LOCALFREE_TARGET will be -+ /* Insert another map_size - batch_size keys -+ * Map will contain 1 to batch_size plus these latest, i.e., -+ * => previous 1+batch_size to map_size - batch_size will have been - * removed by LRU - */ -- key = 1 + tgt_free; -- end_key = key + tgt_free; -+ key = 1 + __map_size(tgt_free); -+ end_key = key + __map_size(tgt_free); - for (; key < end_key; key++) { - assert(!bpf_map_update_elem(lru_map_fd, &key, value, - BPF_NOEXIST)); -@@ -301,17 +314,8 @@ static void test_lru_sanity1(int map_type, int map_flags, unsigned int tgt_free) - printf("Pass\n"); - } - --/* Size of the LRU map 1.5 * tgt_free -- * Insert 1 to tgt_free (+tgt_free keys) -- * Update 1 to tgt_free/2 -- * => The original 1 to tgt_free/2 will be removed due to -- * the LRU shrink process -- * Re-insert 1 to tgt_free/2 again and do a lookup immeidately -- * Insert 1+tgt_free to tgt_free*3/2 -- * Insert 1+tgt_free*3/2 to tgt_free*5/2 -- * => Key 1+tgt_free to tgt_free*3/2 -- * will be removed from LRU because it has never -- * been lookup and ref bit is not set -+/* Verify that insertions exceeding map size will recycle the oldest. -+ * Verify that unreferenced elements are recycled before referenced. - */ - static void test_lru_sanity2(int map_type, int map_flags, unsigned int tgt_free) - { -@@ -334,7 +338,7 @@ static void test_lru_sanity2(int map_type, int map_flags, unsigned int tgt_free) - batch_size = tgt_free / 2; - assert(batch_size * 2 == tgt_free); - -- map_size = tgt_free + batch_size; -+ map_size = __map_size(tgt_free) + batch_size; - lru_map_fd = create_map(map_type, map_flags, map_size); - assert(lru_map_fd != -1); - -@@ -343,8 +347,8 @@ static void test_lru_sanity2(int map_type, int map_flags, unsigned int tgt_free) - - value[0] = 1234; - -- /* Insert 1 to tgt_free (+tgt_free keys) */ -- end_key = 1 + tgt_free; -+ /* Insert map_size - batch_size keys */ -+ end_key = 1 + __map_size(tgt_free); - for (key = 1; key < end_key; key++) - assert(!bpf_map_update_elem(lru_map_fd, &key, value, - BPF_NOEXIST)); -@@ -357,8 +361,7 @@ static void test_lru_sanity2(int map_type, int map_flags, unsigned int tgt_free) - * shrink the inactive list to get tgt_free - * number of free nodes. - * -- * Hence, the oldest key 1 to tgt_free/2 -- * are removed from the LRU list. -+ * Hence, the oldest key is removed from the LRU list. - */ - key = 1; - if (map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH) { -@@ -370,8 +373,7 @@ static void test_lru_sanity2(int map_type, int map_flags, unsigned int tgt_free) - BPF_EXIST)); - } - -- /* Re-insert 1 to tgt_free/2 again and do a lookup -- * immeidately. -+ /* Re-insert 1 to batch_size again and do a lookup immediately. - */ - end_key = 1 + batch_size; - value[0] = 4321; -@@ -387,17 +389,18 @@ static void test_lru_sanity2(int map_type, int map_flags, unsigned int tgt_free) - - value[0] = 1234; - -- /* Insert 1+tgt_free to tgt_free*3/2 */ -- end_key = 1 + tgt_free + batch_size; -- for (key = 1 + tgt_free; key < end_key; key++) -+ /* Insert batch_size new elements */ -+ key = 1 + __map_size(tgt_free); -+ end_key = key + batch_size; -+ for (; key < end_key; key++) - /* These newly added but not referenced keys will be - * gone during the next LRU shrink. - */ - assert(!bpf_map_update_elem(lru_map_fd, &key, value, - BPF_NOEXIST)); - -- /* Insert 1+tgt_free*3/2 to tgt_free*5/2 */ -- end_key = key + tgt_free; -+ /* Insert map_size - batch_size elements */ -+ end_key += __map_size(tgt_free); - for (; key < end_key; key++) { - assert(!bpf_map_update_elem(lru_map_fd, &key, value, - BPF_NOEXIST)); -@@ -413,12 +416,12 @@ static void test_lru_sanity2(int map_type, int map_flags, unsigned int tgt_free) - printf("Pass\n"); - } - --/* Size of the LRU map is 2*tgt_free -- * It is to test the active/inactive list rotation -- * Insert 1 to 2*tgt_free (+2*tgt_free keys) -- * Lookup key 1 to tgt_free*3/2 -- * Add 1+2*tgt_free to tgt_free*5/2 (+tgt_free/2 keys) -- * => key 1+tgt_free*3/2 to 2*tgt_free are removed from LRU -+/* Test the active/inactive list rotation -+ * -+ * Fill the whole map, deplete the free list. -+ * Reference all except the last lru->target_free elements. -+ * Insert lru->target_free new elements. This triggers one shrink. -+ * Verify that the non-referenced elements are replaced. - */ - static void test_lru_sanity3(int map_type, int map_flags, unsigned int tgt_free) - { -@@ -437,8 +440,7 @@ static void test_lru_sanity3(int map_type, int map_flags, unsigned int tgt_free) - - assert(sched_next_online(0, &next_cpu) != -1); - -- batch_size = tgt_free / 2; -- assert(batch_size * 2 == tgt_free); -+ batch_size = __tgt_size(tgt_free); - - map_size = tgt_free * 2; - lru_map_fd = create_map(map_type, map_flags, map_size); -@@ -449,23 +451,21 @@ static void test_lru_sanity3(int map_type, int map_flags, unsigned int tgt_free) - - value[0] = 1234; - -- /* Insert 1 to 2*tgt_free (+2*tgt_free keys) */ -- end_key = 1 + (2 * tgt_free); -+ /* Fill the map */ -+ end_key = 1 + map_size; - for (key = 1; key < end_key; key++) - assert(!bpf_map_update_elem(lru_map_fd, &key, value, - BPF_NOEXIST)); - -- /* Lookup key 1 to tgt_free*3/2 */ -- end_key = tgt_free + batch_size; -+ /* Reference all but the last batch_size */ -+ end_key = 1 + map_size - batch_size; - for (key = 1; key < end_key; key++) { - assert(!bpf_map_lookup_elem_with_ref_bit(lru_map_fd, key, value)); - assert(!bpf_map_update_elem(expected_map_fd, &key, value, - BPF_NOEXIST)); - } - -- /* Add 1+2*tgt_free to tgt_free*5/2 -- * (+tgt_free/2 keys) -- */ -+ /* Insert new batch_size: replaces the non-referenced elements */ - key = 2 * tgt_free + 1; - end_key = key + batch_size; - for (; key < end_key; key++) { -@@ -500,7 +500,8 @@ static void test_lru_sanity4(int map_type, int map_flags, unsigned int tgt_free) - lru_map_fd = create_map(map_type, map_flags, - 3 * tgt_free * nr_cpus); - else -- lru_map_fd = create_map(map_type, map_flags, 3 * tgt_free); -+ lru_map_fd = create_map(map_type, map_flags, -+ 3 * __map_size(tgt_free)); - assert(lru_map_fd != -1); - - expected_map_fd = create_map(BPF_MAP_TYPE_HASH, 0, diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.099-100.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.099-100.patch deleted file mode 100644 index c112ce7480..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.099-100.patch +++ /dev/null @@ -1,3139 +0,0 @@ -diff --git a/Makefile b/Makefile -index 2aede51d98ea36..8d6550abc9cb2c 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 99 -+SUBLEVEL = 100 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi -index 6457d2c377017a..218b5482190784 100644 ---- a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi -+++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi -@@ -470,6 +470,7 @@ reg_vdd_phy: LDO4 { - }; - - reg_nvcc_sd: LDO5 { -+ regulator-always-on; - regulator-max-microvolt = <3300000>; - regulator-min-microvolt = <1800000>; - regulator-name = "On-module +V3.3_1.8_SD (LDO5)"; -diff --git a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts -index faa370a5885ff4..34619f085623b5 100644 ---- a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts -+++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts -@@ -185,7 +185,7 @@ tpm@0 { - #address-cells = <0x1>; - #size-cells = <0x1>; - reg = <0x0>; -- spi-max-frequency = <36000000>; -+ spi-max-frequency = <25000000>; - }; - }; - -diff --git a/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi b/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi -index 2963d634baba99..403a295bde6ab2 100644 ---- a/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi -+++ b/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi -@@ -344,6 +344,18 @@ pmic_int: pmic-int { - <0 RK_PA7 RK_FUNC_GPIO &pcfg_pull_up>; - }; - }; -+ -+ spi1 { -+ spi1_csn0_gpio_pin: spi1-csn0-gpio-pin { -+ rockchip,pins = -+ <3 RK_PB1 RK_FUNC_GPIO &pcfg_pull_up_4ma>; -+ }; -+ -+ spi1_csn1_gpio_pin: spi1-csn1-gpio-pin { -+ rockchip,pins = -+ <3 RK_PB2 RK_FUNC_GPIO &pcfg_pull_up_4ma>; -+ }; -+ }; - }; - - &saradc { -@@ -355,6 +367,17 @@ &sdmmc { - vqmmc-supply = <&vccio_sd>; - }; - -+&spi1 { -+ /* -+ * Hardware CS has a very slow rise time of about 6us, -+ * causing transmission errors. -+ * With cs-gpios we have a rise time of about 20ns. -+ */ -+ cs-gpios = <&gpio3 RK_PB1 GPIO_ACTIVE_LOW>, <&gpio3 RK_PB2 GPIO_ACTIVE_LOW>; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&spi1_clk &spi1_csn0_gpio_pin &spi1_csn1_gpio_pin &spi1_miso &spi1_mosi>; -+}; -+ - &tsadc { - status = "okay"; - }; -diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c -index 82778258855d1a..b6d381f743f3ec 100644 ---- a/arch/arm64/kernel/cpufeature.c -+++ b/arch/arm64/kernel/cpufeature.c -@@ -2804,6 +2804,13 @@ static bool has_sve_feature(const struct arm64_cpu_capabilities *cap, int scope) - } - #endif - -+#ifdef CONFIG_ARM64_SME -+static bool has_sme_feature(const struct arm64_cpu_capabilities *cap, int scope) -+{ -+ return system_supports_sme() && has_user_cpuid_feature(cap, scope); -+} -+#endif -+ - static const struct arm64_cpu_capabilities arm64_elf_hwcaps[] = { - HWCAP_CAP(ID_AA64ISAR0_EL1, AES, PMULL, CAP_HWCAP, KERNEL_HWCAP_PMULL), - HWCAP_CAP(ID_AA64ISAR0_EL1, AES, AES, CAP_HWCAP, KERNEL_HWCAP_AES), -@@ -2875,20 +2882,20 @@ static const struct arm64_cpu_capabilities arm64_elf_hwcaps[] = { - HWCAP_CAP(ID_AA64ISAR2_EL1, MOPS, IMP, CAP_HWCAP, KERNEL_HWCAP_MOPS), - HWCAP_CAP(ID_AA64ISAR2_EL1, BC, IMP, CAP_HWCAP, KERNEL_HWCAP_HBC), - #ifdef CONFIG_ARM64_SME -- HWCAP_CAP(ID_AA64PFR1_EL1, SME, IMP, CAP_HWCAP, KERNEL_HWCAP_SME), -- HWCAP_CAP(ID_AA64SMFR0_EL1, FA64, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_FA64), -- HWCAP_CAP(ID_AA64SMFR0_EL1, SMEver, SME2p1, CAP_HWCAP, KERNEL_HWCAP_SME2P1), -- HWCAP_CAP(ID_AA64SMFR0_EL1, SMEver, SME2, CAP_HWCAP, KERNEL_HWCAP_SME2), -- HWCAP_CAP(ID_AA64SMFR0_EL1, I16I64, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_I16I64), -- HWCAP_CAP(ID_AA64SMFR0_EL1, F64F64, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_F64F64), -- HWCAP_CAP(ID_AA64SMFR0_EL1, I16I32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_I16I32), -- HWCAP_CAP(ID_AA64SMFR0_EL1, B16B16, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_B16B16), -- HWCAP_CAP(ID_AA64SMFR0_EL1, F16F16, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_F16F16), -- HWCAP_CAP(ID_AA64SMFR0_EL1, I8I32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_I8I32), -- HWCAP_CAP(ID_AA64SMFR0_EL1, F16F32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_F16F32), -- HWCAP_CAP(ID_AA64SMFR0_EL1, B16F32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_B16F32), -- HWCAP_CAP(ID_AA64SMFR0_EL1, BI32I32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_BI32I32), -- HWCAP_CAP(ID_AA64SMFR0_EL1, F32F32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_F32F32), -+ HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64PFR1_EL1, SME, IMP, CAP_HWCAP, KERNEL_HWCAP_SME), -+ HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, FA64, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_FA64), -+ HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, SMEver, SME2p1, CAP_HWCAP, KERNEL_HWCAP_SME2P1), -+ HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, SMEver, SME2, CAP_HWCAP, KERNEL_HWCAP_SME2), -+ HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, I16I64, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_I16I64), -+ HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, F64F64, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_F64F64), -+ HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, I16I32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_I16I32), -+ HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, B16B16, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_B16B16), -+ HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, F16F16, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_F16F16), -+ HWCAP_CAP(ID_MATCH_ID(has_sme_feature, AA64SMFR0_EL1, I8I32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_I8I32), -+ HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, F16F32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_F16F32), -+ HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, B16F32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_B16F32), -+ HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, BI32I32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_BI32I32), -+ HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, F32F32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_F32F32), - #endif /* CONFIG_ARM64_SME */ - {}, - }; -diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c -index a40c7ff91caf03..2d8facfd4e4252 100644 ---- a/arch/s390/net/bpf_jit_comp.c -+++ b/arch/s390/net/bpf_jit_comp.c -@@ -539,7 +539,15 @@ static void bpf_jit_plt(struct bpf_plt *plt, void *ret, void *target) - { - memcpy(plt, &bpf_plt, sizeof(*plt)); - plt->ret = ret; -- plt->target = target; -+ /* -+ * (target == NULL) implies that the branch to this PLT entry was -+ * patched and became a no-op. However, some CPU could have jumped -+ * to this PLT entry before patching and may be still executing it. -+ * -+ * Since the intention in this case is to make the PLT entry a no-op, -+ * make the target point to the return label instead of NULL. -+ */ -+ plt->target = target ?: ret; - } - - /* -diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c -index c4a158758cb740..94c7fee7a2259f 100644 ---- a/arch/x86/kvm/xen.c -+++ b/arch/x86/kvm/xen.c -@@ -1260,7 +1260,7 @@ static bool kvm_xen_schedop_poll(struct kvm_vcpu *vcpu, bool longmode, - if (kvm_read_guest_virt(vcpu, (gva_t)sched_poll.ports, ports, - sched_poll.nr_ports * sizeof(*ports), &e)) { - *r = -EFAULT; -- return true; -+ goto out; - } - - for (i = 0; i < sched_poll.nr_ports; i++) { -diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c -index 74839f6f2e0cb3..8d15c73a520bd7 100644 ---- a/block/blk-sysfs.c -+++ b/block/blk-sysfs.c -@@ -909,4 +909,5 @@ void blk_unregister_queue(struct gendisk *disk) - mutex_unlock(&q->sysfs_dir_lock); - - blk_debugfs_remove(disk); -+ kobject_put(&disk->queue_kobj); - } -diff --git a/drivers/base/power/domain_governor.c b/drivers/base/power/domain_governor.c -index cc2c3a5a6d35a4..4f09f9a5a0431b 100644 ---- a/drivers/base/power/domain_governor.c -+++ b/drivers/base/power/domain_governor.c -@@ -8,6 +8,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -345,6 +346,8 @@ static bool cpu_power_down_ok(struct dev_pm_domain *pd) - struct cpuidle_device *dev; - ktime_t domain_wakeup, next_hrtimer; - ktime_t now = ktime_get(); -+ struct device *cpu_dev; -+ s64 cpu_constraint, global_constraint; - s64 idle_duration_ns; - int cpu, i; - -@@ -355,6 +358,7 @@ static bool cpu_power_down_ok(struct dev_pm_domain *pd) - if (!(genpd->flags & GENPD_FLAG_CPU_DOMAIN)) - return true; - -+ global_constraint = cpu_latency_qos_limit(); - /* - * Find the next wakeup for any of the online CPUs within the PM domain - * and its subdomains. Note, we only need the genpd->cpus, as it already -@@ -368,8 +372,16 @@ static bool cpu_power_down_ok(struct dev_pm_domain *pd) - if (ktime_before(next_hrtimer, domain_wakeup)) - domain_wakeup = next_hrtimer; - } -+ -+ cpu_dev = get_cpu_device(cpu); -+ if (cpu_dev) { -+ cpu_constraint = dev_pm_qos_raw_resume_latency(cpu_dev); -+ if (cpu_constraint < global_constraint) -+ global_constraint = cpu_constraint; -+ } - } - -+ global_constraint *= NSEC_PER_USEC; - /* The minimum idle duration is from now - until the next wakeup. */ - idle_duration_ns = ktime_to_ns(ktime_sub(domain_wakeup, now)); - if (idle_duration_ns <= 0) -@@ -385,8 +397,10 @@ static bool cpu_power_down_ok(struct dev_pm_domain *pd) - */ - i = genpd->state_idx; - do { -- if (idle_duration_ns >= (genpd->states[i].residency_ns + -- genpd->states[i].power_off_latency_ns)) { -+ if ((idle_duration_ns >= (genpd->states[i].residency_ns + -+ genpd->states[i].power_off_latency_ns)) && -+ (global_constraint >= (genpd->states[i].power_on_latency_ns + -+ genpd->states[i].power_off_latency_ns))) { - genpd->state_idx = i; - return true; - } -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index e0dd6988960883..db507a66fa8acd 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -3736,6 +3736,32 @@ static const struct qca_device_info qca_devices_table[] = { - { 0x00190200, 40, 4, 16 }, /* WCN785x 2.0 */ - }; - -+static u16 qca_extract_board_id(const struct qca_version *ver) -+{ -+ u16 flag = le16_to_cpu(ver->flag); -+ u16 board_id = 0; -+ -+ if (((flag >> 8) & 0xff) == QCA_FLAG_MULTI_NVM) { -+ /* The board_id should be split into two bytes -+ * The 1st byte is chip ID, and the 2nd byte is platform ID -+ * For example, board ID 0x010A, 0x01 is platform ID. 0x0A is chip ID -+ * we have several platforms, and platform IDs are continuously added -+ * Platform ID: -+ * 0x00 is for Mobile -+ * 0x01 is for X86 -+ * 0x02 is for Automotive -+ * 0x03 is for Consumer electronic -+ */ -+ board_id = (ver->chip_id << 8) + ver->platform_id; -+ } -+ -+ /* Take 0xffff as invalid board ID */ -+ if (board_id == 0xffff) -+ board_id = 0; -+ -+ return board_id; -+} -+ - static int btusb_qca_send_vendor_req(struct usb_device *udev, u8 request, - void *data, u16 size) - { -@@ -3892,44 +3918,28 @@ static void btusb_generate_qca_nvm_name(char *fwname, size_t max_size, - const struct qca_version *ver) - { - u32 rom_version = le32_to_cpu(ver->rom_version); -- u16 flag = le16_to_cpu(ver->flag); -+ const char *variant; -+ int len; -+ u16 board_id; - -- if (((flag >> 8) & 0xff) == QCA_FLAG_MULTI_NVM) { -- /* The board_id should be split into two bytes -- * The 1st byte is chip ID, and the 2nd byte is platform ID -- * For example, board ID 0x010A, 0x01 is platform ID. 0x0A is chip ID -- * we have several platforms, and platform IDs are continuously added -- * Platform ID: -- * 0x00 is for Mobile -- * 0x01 is for X86 -- * 0x02 is for Automotive -- * 0x03 is for Consumer electronic -- */ -- u16 board_id = (ver->chip_id << 8) + ver->platform_id; -- const char *variant; -+ board_id = qca_extract_board_id(ver); - -- switch (le32_to_cpu(ver->ram_version)) { -- case WCN6855_2_0_RAM_VERSION_GF: -- case WCN6855_2_1_RAM_VERSION_GF: -- variant = "_gf"; -- break; -- default: -- variant = ""; -- break; -- } -- -- if (board_id == 0) { -- snprintf(fwname, max_size, "qca/nvm_usb_%08x%s.bin", -- rom_version, variant); -- } else { -- snprintf(fwname, max_size, "qca/nvm_usb_%08x%s_%04x.bin", -- rom_version, variant, board_id); -- } -- } else { -- snprintf(fwname, max_size, "qca/nvm_usb_%08x.bin", -- rom_version); -+ switch (le32_to_cpu(ver->ram_version)) { -+ case WCN6855_2_0_RAM_VERSION_GF: -+ case WCN6855_2_1_RAM_VERSION_GF: -+ variant = "_gf"; -+ break; -+ default: -+ variant = NULL; -+ break; - } - -+ len = snprintf(fwname, max_size, "qca/nvm_usb_%08x", rom_version); -+ if (variant) -+ len += snprintf(fwname + len, max_size - len, "%s", variant); -+ if (board_id) -+ len += snprintf(fwname + len, max_size - len, "_%04x", board_id); -+ len += snprintf(fwname + len, max_size - len, ".bin"); - } - - static int btusb_setup_qca_load_nvm(struct hci_dev *hdev, -diff --git a/drivers/comedi/comedi_fops.c b/drivers/comedi/comedi_fops.c -index 81763e3f948467..e4d62cdaff462d 100644 ---- a/drivers/comedi/comedi_fops.c -+++ b/drivers/comedi/comedi_fops.c -@@ -1556,21 +1556,27 @@ static int do_insnlist_ioctl(struct comedi_device *dev, - } - - for (i = 0; i < n_insns; ++i) { -+ unsigned int n = insns[i].n; -+ - if (insns[i].insn & INSN_MASK_WRITE) { - if (copy_from_user(data, insns[i].data, -- insns[i].n * sizeof(unsigned int))) { -+ n * sizeof(unsigned int))) { - dev_dbg(dev->class_dev, - "copy_from_user failed\n"); - ret = -EFAULT; - goto error; - } -+ if (n < MIN_SAMPLES) { -+ memset(&data[n], 0, (MIN_SAMPLES - n) * -+ sizeof(unsigned int)); -+ } - } - ret = parse_insn(dev, insns + i, data, file); - if (ret < 0) - goto error; - if (insns[i].insn & INSN_MASK_READ) { - if (copy_to_user(insns[i].data, data, -- insns[i].n * sizeof(unsigned int))) { -+ n * sizeof(unsigned int))) { - dev_dbg(dev->class_dev, - "copy_to_user failed\n"); - ret = -EFAULT; -@@ -1589,6 +1595,16 @@ static int do_insnlist_ioctl(struct comedi_device *dev, - return i; - } - -+#define MAX_INSNS MAX_SAMPLES -+static int check_insnlist_len(struct comedi_device *dev, unsigned int n_insns) -+{ -+ if (n_insns > MAX_INSNS) { -+ dev_dbg(dev->class_dev, "insnlist length too large\n"); -+ return -EINVAL; -+ } -+ return 0; -+} -+ - /* - * COMEDI_INSN ioctl - * synchronous instruction -@@ -1633,6 +1649,10 @@ static int do_insn_ioctl(struct comedi_device *dev, - ret = -EFAULT; - goto error; - } -+ if (insn->n < MIN_SAMPLES) { -+ memset(&data[insn->n], 0, -+ (MIN_SAMPLES - insn->n) * sizeof(unsigned int)); -+ } - } - ret = parse_insn(dev, insn, data, file); - if (ret < 0) -@@ -2239,6 +2259,9 @@ static long comedi_unlocked_ioctl(struct file *file, unsigned int cmd, - rc = -EFAULT; - break; - } -+ rc = check_insnlist_len(dev, insnlist.n_insns); -+ if (rc) -+ break; - insns = kcalloc(insnlist.n_insns, sizeof(*insns), GFP_KERNEL); - if (!insns) { - rc = -ENOMEM; -@@ -3090,6 +3113,9 @@ static int compat_insnlist(struct file *file, unsigned long arg) - if (copy_from_user(&insnlist32, compat_ptr(arg), sizeof(insnlist32))) - return -EFAULT; - -+ rc = check_insnlist_len(dev, insnlist32.n_insns); -+ if (rc) -+ return rc; - insns = kcalloc(insnlist32.n_insns, sizeof(*insns), GFP_KERNEL); - if (!insns) - return -ENOMEM; -diff --git a/drivers/comedi/drivers.c b/drivers/comedi/drivers.c -index d4e2ed709bfc7a..086213bcc49933 100644 ---- a/drivers/comedi/drivers.c -+++ b/drivers/comedi/drivers.c -@@ -338,10 +338,10 @@ int comedi_dio_insn_config(struct comedi_device *dev, - unsigned int *data, - unsigned int mask) - { -- unsigned int chan_mask = 1 << CR_CHAN(insn->chanspec); -+ unsigned int chan = CR_CHAN(insn->chanspec); - -- if (!mask) -- mask = chan_mask; -+ if (!mask && chan < 32) -+ mask = 1U << chan; - - switch (data[0]) { - case INSN_CONFIG_DIO_INPUT: -@@ -381,7 +381,7 @@ EXPORT_SYMBOL_GPL(comedi_dio_insn_config); - unsigned int comedi_dio_update_state(struct comedi_subdevice *s, - unsigned int *data) - { -- unsigned int chanmask = (s->n_chan < 32) ? ((1 << s->n_chan) - 1) -+ unsigned int chanmask = (s->n_chan < 32) ? ((1U << s->n_chan) - 1) - : 0xffffffff; - unsigned int mask = data[0] & chanmask; - unsigned int bits = data[1]; -@@ -614,6 +614,9 @@ static int insn_rw_emulate_bits(struct comedi_device *dev, - unsigned int _data[2]; - int ret; - -+ if (insn->n == 0) -+ return 0; -+ - memset(_data, 0, sizeof(_data)); - memset(&_insn, 0, sizeof(_insn)); - _insn.insn = INSN_BITS; -@@ -624,8 +627,8 @@ static int insn_rw_emulate_bits(struct comedi_device *dev, - if (insn->insn == INSN_WRITE) { - if (!(s->subdev_flags & SDF_WRITABLE)) - return -EINVAL; -- _data[0] = 1 << (chan - base_chan); /* mask */ -- _data[1] = data[0] ? (1 << (chan - base_chan)) : 0; /* bits */ -+ _data[0] = 1U << (chan - base_chan); /* mask */ -+ _data[1] = data[0] ? (1U << (chan - base_chan)) : 0; /* bits */ - } - - ret = s->insn_bits(dev, s, &_insn, _data); -@@ -708,7 +711,7 @@ static int __comedi_device_postconfig(struct comedi_device *dev) - - if (s->type == COMEDI_SUBD_DO) { - if (s->n_chan < 32) -- s->io_bits = (1 << s->n_chan) - 1; -+ s->io_bits = (1U << s->n_chan) - 1; - else - s->io_bits = 0xffffffff; - } -diff --git a/drivers/comedi/drivers/aio_iiro_16.c b/drivers/comedi/drivers/aio_iiro_16.c -index b00fab0b89d4c4..739cc4db52ac7e 100644 ---- a/drivers/comedi/drivers/aio_iiro_16.c -+++ b/drivers/comedi/drivers/aio_iiro_16.c -@@ -177,7 +177,8 @@ static int aio_iiro_16_attach(struct comedi_device *dev, - * Digital input change of state interrupts are optionally supported - * using IRQ 2-7, 10-12, 14, or 15. - */ -- if ((1 << it->options[1]) & 0xdcfc) { -+ if (it->options[1] > 0 && it->options[1] < 16 && -+ (1 << it->options[1]) & 0xdcfc) { - ret = request_irq(it->options[1], aio_iiro_16_cos, 0, - dev->board_name, dev); - if (ret == 0) -diff --git a/drivers/comedi/drivers/das16m1.c b/drivers/comedi/drivers/das16m1.c -index 275effb77746b6..99e63d51c506c5 100644 ---- a/drivers/comedi/drivers/das16m1.c -+++ b/drivers/comedi/drivers/das16m1.c -@@ -522,7 +522,8 @@ static int das16m1_attach(struct comedi_device *dev, - devpriv->extra_iobase = dev->iobase + DAS16M1_8255_IOBASE; - - /* only irqs 2, 3, 4, 5, 6, 7, 10, 11, 12, 14, and 15 are valid */ -- if ((1 << it->options[1]) & 0xdcfc) { -+ if (it->options[1] >= 2 && it->options[1] <= 15 && -+ (1 << it->options[1]) & 0xdcfc) { - ret = request_irq(it->options[1], das16m1_interrupt, 0, - dev->board_name, dev); - if (ret == 0) -diff --git a/drivers/comedi/drivers/das6402.c b/drivers/comedi/drivers/das6402.c -index 1af394591e7480..e730668236c268 100644 ---- a/drivers/comedi/drivers/das6402.c -+++ b/drivers/comedi/drivers/das6402.c -@@ -567,7 +567,8 @@ static int das6402_attach(struct comedi_device *dev, - das6402_reset(dev); - - /* IRQs 2,3,5,6,7, 10,11,15 are valid for "enhanced" mode */ -- if ((1 << it->options[1]) & 0x8cec) { -+ if (it->options[1] > 0 && it->options[1] < 16 && -+ (1 << it->options[1]) & 0x8cec) { - ret = request_irq(it->options[1], das6402_interrupt, 0, - dev->board_name, dev); - if (ret == 0) { -diff --git a/drivers/comedi/drivers/pcl812.c b/drivers/comedi/drivers/pcl812.c -index 70dbc129fcf558..e0459f286fa613 100644 ---- a/drivers/comedi/drivers/pcl812.c -+++ b/drivers/comedi/drivers/pcl812.c -@@ -1149,7 +1149,8 @@ static int pcl812_attach(struct comedi_device *dev, struct comedi_devconfig *it) - if (!dev->pacer) - return -ENOMEM; - -- if ((1 << it->options[1]) & board->irq_bits) { -+ if (it->options[1] > 0 && it->options[1] < 16 && -+ (1 << it->options[1]) & board->irq_bits) { - ret = request_irq(it->options[1], pcl812_interrupt, 0, - dev->board_name, dev); - if (ret == 0) -diff --git a/drivers/dma/nbpfaxi.c b/drivers/dma/nbpfaxi.c -index 0b2f96fd8bf0c6..a361f8c29cd38d 100644 ---- a/drivers/dma/nbpfaxi.c -+++ b/drivers/dma/nbpfaxi.c -@@ -1351,7 +1351,7 @@ static int nbpf_probe(struct platform_device *pdev) - if (irqs == 1) { - eirq = irqbuf[0]; - -- for (i = 0; i <= num_channels; i++) -+ for (i = 0; i < num_channels; i++) - nbpf->chan[i].irq = irqbuf[0]; - } else { - eirq = platform_get_irq_byname(pdev, "error"); -@@ -1361,16 +1361,15 @@ static int nbpf_probe(struct platform_device *pdev) - if (irqs == num_channels + 1) { - struct nbpf_channel *chan; - -- for (i = 0, chan = nbpf->chan; i <= num_channels; -+ for (i = 0, chan = nbpf->chan; i < num_channels; - i++, chan++) { - /* Skip the error IRQ */ - if (irqbuf[i] == eirq) - i++; -+ if (i >= ARRAY_SIZE(irqbuf)) -+ return -EINVAL; - chan->irq = irqbuf[i]; - } -- -- if (chan != nbpf->chan + num_channels) -- return -EINVAL; - } else { - /* 2 IRQs and more than one channel */ - if (irqbuf[0] == eirq) -@@ -1378,7 +1377,7 @@ static int nbpf_probe(struct platform_device *pdev) - else - irq = irqbuf[0]; - -- for (i = 0; i <= num_channels; i++) -+ for (i = 0; i < num_channels; i++) - nbpf->chan[i].irq = irq; - } - } -diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c -index 1943beb135c4c2..472cb0f9e8f6c0 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c -@@ -4656,6 +4656,7 @@ static int gfx_v8_0_kcq_init_queue(struct amdgpu_ring *ring) - memcpy(mqd, adev->gfx.mec.mqd_backup[mqd_idx], sizeof(struct vi_mqd_allocation)); - /* reset ring buffer */ - ring->wptr = 0; -+ atomic64_set((atomic64_t *)ring->wptr_cpu_addr, 0); - amdgpu_ring_clear_ring(ring); - } - return 0; -diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c -index 8f156a69912c89..266cd56dec5056 100644 ---- a/drivers/hid/hid-core.c -+++ b/drivers/hid/hid-core.c -@@ -1873,9 +1873,12 @@ u8 *hid_alloc_report_buf(struct hid_report *report, gfp_t flags) - /* - * 7 extra bytes are necessary to achieve proper functionality - * of implement() working on 8 byte chunks -+ * 1 extra byte for the report ID if it is null (not used) so -+ * we can reserve that extra byte in the first position of the buffer -+ * when sending it to .raw_request() - */ - -- u32 len = hid_report_len(report) + 7; -+ u32 len = hid_report_len(report) + 7 + (report->id == 0); - - return kzalloc(len, flags); - } -@@ -1938,7 +1941,7 @@ static struct hid_report *hid_get_report(struct hid_report_enum *report_enum, - int __hid_request(struct hid_device *hid, struct hid_report *report, - enum hid_class_request reqtype) - { -- char *buf; -+ char *buf, *data_buf; - int ret; - u32 len; - -@@ -1946,13 +1949,19 @@ int __hid_request(struct hid_device *hid, struct hid_report *report, - if (!buf) - return -ENOMEM; - -+ data_buf = buf; - len = hid_report_len(report); - -+ if (report->id == 0) { -+ /* reserve the first byte for the report ID */ -+ data_buf++; -+ len++; -+ } -+ - if (reqtype == HID_REQ_SET_REPORT) -- hid_output_report(report, buf); -+ hid_output_report(report, data_buf); - -- ret = hid->ll_driver->raw_request(hid, report->id, buf, len, -- report->type, reqtype); -+ ret = hid_hw_raw_request(hid, report->id, buf, len, report->type, reqtype); - if (ret < 0) { - dbg_hid("unable to complete request: %d\n", ret); - goto out; -diff --git a/drivers/hwmon/corsair-cpro.c b/drivers/hwmon/corsair-cpro.c -index 280b90646a8735..b37f36f55f88a5 100644 ---- a/drivers/hwmon/corsair-cpro.c -+++ b/drivers/hwmon/corsair-cpro.c -@@ -84,6 +84,7 @@ struct ccp_device { - struct mutex mutex; /* whenever buffer is used, lock before send_usb_cmd */ - u8 *cmd_buffer; - u8 *buffer; -+ int buffer_recv_size; /* number of received bytes in buffer */ - int target[6]; - DECLARE_BITMAP(temp_cnct, NUM_TEMP_SENSORS); - DECLARE_BITMAP(fan_cnct, NUM_FANS); -@@ -139,6 +140,9 @@ static int send_usb_cmd(struct ccp_device *ccp, u8 command, u8 byte1, u8 byte2, - if (!t) - return -ETIMEDOUT; - -+ if (ccp->buffer_recv_size != IN_BUFFER_SIZE) -+ return -EPROTO; -+ - return ccp_get_errno(ccp); - } - -@@ -150,6 +154,7 @@ static int ccp_raw_event(struct hid_device *hdev, struct hid_report *report, u8 - spin_lock(&ccp->wait_input_report_lock); - if (!completion_done(&ccp->wait_input_report)) { - memcpy(ccp->buffer, data, min(IN_BUFFER_SIZE, size)); -+ ccp->buffer_recv_size = size; - complete_all(&ccp->wait_input_report); - } - spin_unlock(&ccp->wait_input_report_lock); -diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig -index 982007a112c2a0..8d4270664ebd11 100644 ---- a/drivers/i2c/busses/Kconfig -+++ b/drivers/i2c/busses/Kconfig -@@ -899,6 +899,7 @@ config I2C_OMAP - tristate "OMAP I2C adapter" - depends on ARCH_OMAP || ARCH_K3 || COMPILE_TEST - default MACH_OMAP_OSK -+ select MULTIPLEXER - help - If you say yes to this option, support will be included for the - I2C interface on the Texas Instruments OMAP1/2 family of processors. -diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c -index 22975bfd6b252b..fad88ab32716f0 100644 ---- a/drivers/i2c/busses/i2c-omap.c -+++ b/drivers/i2c/busses/i2c-omap.c -@@ -24,6 +24,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -211,6 +212,7 @@ struct omap_i2c_dev { - u16 syscstate; - u16 westate; - u16 errata; -+ struct mux_state *mux_state; - }; - - static const u8 reg_map_ip_v1[] = { -@@ -1455,8 +1457,27 @@ omap_i2c_probe(struct platform_device *pdev) - (1000 * omap->speed / 8); - } - -+ if (of_property_present(node, "mux-states")) { -+ struct mux_state *mux_state; -+ -+ mux_state = devm_mux_state_get(&pdev->dev, NULL); -+ if (IS_ERR(mux_state)) { -+ r = PTR_ERR(mux_state); -+ dev_dbg(&pdev->dev, "failed to get I2C mux: %d\n", r); -+ goto err_put_pm; -+ } -+ omap->mux_state = mux_state; -+ r = mux_state_select(omap->mux_state); -+ if (r) { -+ dev_err(&pdev->dev, "failed to select I2C mux: %d\n", r); -+ goto err_put_pm; -+ } -+ } -+ - /* reset ASAP, clearing any IRQs */ -- omap_i2c_init(omap); -+ r = omap_i2c_init(omap); -+ if (r) -+ goto err_mux_state_deselect; - - if (omap->rev < OMAP_I2C_OMAP1_REV_2) - r = devm_request_irq(&pdev->dev, omap->irq, omap_i2c_omap1_isr, -@@ -1499,6 +1520,10 @@ omap_i2c_probe(struct platform_device *pdev) - - err_unuse_clocks: - omap_i2c_write_reg(omap, OMAP_I2C_CON_REG, 0); -+err_mux_state_deselect: -+ if (omap->mux_state) -+ mux_state_deselect(omap->mux_state); -+err_put_pm: - pm_runtime_dont_use_autosuspend(omap->dev); - pm_runtime_put_sync(omap->dev); - err_disable_pm: -@@ -1514,6 +1539,9 @@ static void omap_i2c_remove(struct platform_device *pdev) - - i2c_del_adapter(&omap->adapter); - -+ if (omap->mux_state) -+ mux_state_deselect(omap->mux_state); -+ - ret = pm_runtime_get_sync(&pdev->dev); - if (ret < 0) - dev_err(omap->dev, "Failed to resume hardware, skip disable\n"); -diff --git a/drivers/i2c/busses/i2c-stm32.c b/drivers/i2c/busses/i2c-stm32.c -index 157c64e27d0bd3..f84ec056e36dfe 100644 ---- a/drivers/i2c/busses/i2c-stm32.c -+++ b/drivers/i2c/busses/i2c-stm32.c -@@ -102,7 +102,6 @@ int stm32_i2c_prep_dma_xfer(struct device *dev, struct stm32_i2c_dma *dma, - void *dma_async_param) - { - struct dma_async_tx_descriptor *txdesc; -- struct device *chan_dev; - int ret; - - if (rd_wr) { -@@ -116,11 +115,10 @@ int stm32_i2c_prep_dma_xfer(struct device *dev, struct stm32_i2c_dma *dma, - } - - dma->dma_len = len; -- chan_dev = dma->chan_using->device->dev; - -- dma->dma_buf = dma_map_single(chan_dev, buf, dma->dma_len, -+ dma->dma_buf = dma_map_single(dev, buf, dma->dma_len, - dma->dma_data_dir); -- if (dma_mapping_error(chan_dev, dma->dma_buf)) { -+ if (dma_mapping_error(dev, dma->dma_buf)) { - dev_err(dev, "DMA mapping failed\n"); - return -EINVAL; - } -@@ -150,7 +148,7 @@ int stm32_i2c_prep_dma_xfer(struct device *dev, struct stm32_i2c_dma *dma, - return 0; - - err: -- dma_unmap_single(chan_dev, dma->dma_buf, dma->dma_len, -+ dma_unmap_single(dev, dma->dma_buf, dma->dma_len, - dma->dma_data_dir); - return ret; - } -diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c -index b4f10ff31102b6..85f8fd6a21ec4d 100644 ---- a/drivers/i2c/busses/i2c-stm32f7.c -+++ b/drivers/i2c/busses/i2c-stm32f7.c -@@ -728,10 +728,10 @@ static void stm32f7_i2c_dma_callback(void *arg) - { - struct stm32f7_i2c_dev *i2c_dev = (struct stm32f7_i2c_dev *)arg; - struct stm32_i2c_dma *dma = i2c_dev->dma; -- struct device *dev = dma->chan_using->device->dev; - - stm32f7_i2c_disable_dma_req(i2c_dev); -- dma_unmap_single(dev, dma->dma_buf, dma->dma_len, dma->dma_data_dir); -+ dma_unmap_single(i2c_dev->dev, dma->dma_buf, dma->dma_len, -+ dma->dma_data_dir); - complete(&dma->dma_complete); - } - -diff --git a/drivers/iio/accel/fxls8962af-core.c b/drivers/iio/accel/fxls8962af-core.c -index 17820b2c3a1dec..f4e253c6c7d70c 100644 ---- a/drivers/iio/accel/fxls8962af-core.c -+++ b/drivers/iio/accel/fxls8962af-core.c -@@ -865,6 +865,8 @@ static int fxls8962af_buffer_predisable(struct iio_dev *indio_dev) - if (ret) - return ret; - -+ synchronize_irq(data->irq); -+ - ret = __fxls8962af_fifo_set_mode(data, false); - - if (data->enable_event) -diff --git a/drivers/iio/adc/max1363.c b/drivers/iio/adc/max1363.c -index b31581616ce34e..5304235d733f18 100644 ---- a/drivers/iio/adc/max1363.c -+++ b/drivers/iio/adc/max1363.c -@@ -510,10 +510,10 @@ static const struct iio_event_spec max1363_events[] = { - MAX1363_CHAN_U(1, _s1, 1, bits, ev_spec, num_ev_spec), \ - MAX1363_CHAN_U(2, _s2, 2, bits, ev_spec, num_ev_spec), \ - MAX1363_CHAN_U(3, _s3, 3, bits, ev_spec, num_ev_spec), \ -- MAX1363_CHAN_B(0, 1, d0m1, 4, bits, ev_spec, num_ev_spec), \ -- MAX1363_CHAN_B(2, 3, d2m3, 5, bits, ev_spec, num_ev_spec), \ -- MAX1363_CHAN_B(1, 0, d1m0, 6, bits, ev_spec, num_ev_spec), \ -- MAX1363_CHAN_B(3, 2, d3m2, 7, bits, ev_spec, num_ev_spec), \ -+ MAX1363_CHAN_B(0, 1, d0m1, 12, bits, ev_spec, num_ev_spec), \ -+ MAX1363_CHAN_B(2, 3, d2m3, 13, bits, ev_spec, num_ev_spec), \ -+ MAX1363_CHAN_B(1, 0, d1m0, 18, bits, ev_spec, num_ev_spec), \ -+ MAX1363_CHAN_B(3, 2, d3m2, 19, bits, ev_spec, num_ev_spec), \ - IIO_CHAN_SOFT_TIMESTAMP(8) \ - } - -@@ -531,23 +531,23 @@ static const struct iio_chan_spec max1363_channels[] = - /* Applies to max1236, max1237 */ - static const enum max1363_modes max1236_mode_list[] = { - _s0, _s1, _s2, _s3, -- s0to1, s0to2, s0to3, -+ s0to1, s0to2, s2to3, s0to3, - d0m1, d2m3, d1m0, d3m2, - d0m1to2m3, d1m0to3m2, -- s2to3, - }; - - /* Applies to max1238, max1239 */ - static const enum max1363_modes max1238_mode_list[] = { - _s0, _s1, _s2, _s3, _s4, _s5, _s6, _s7, _s8, _s9, _s10, _s11, - s0to1, s0to2, s0to3, s0to4, s0to5, s0to6, -+ s6to7, s6to8, s6to9, s6to10, s6to11, - s0to7, s0to8, s0to9, s0to10, s0to11, - d0m1, d2m3, d4m5, d6m7, d8m9, d10m11, - d1m0, d3m2, d5m4, d7m6, d9m8, d11m10, -- d0m1to2m3, d0m1to4m5, d0m1to6m7, d0m1to8m9, d0m1to10m11, -- d1m0to3m2, d1m0to5m4, d1m0to7m6, d1m0to9m8, d1m0to11m10, -- s6to7, s6to8, s6to9, s6to10, s6to11, -- d6m7to8m9, d6m7to10m11, d7m6to9m8, d7m6to11m10, -+ d0m1to2m3, d0m1to4m5, d0m1to6m7, d6m7to8m9, -+ d0m1to8m9, d6m7to10m11, d0m1to10m11, d1m0to3m2, -+ d1m0to5m4, d1m0to7m6, d7m6to9m8, d1m0to9m8, -+ d7m6to11m10, d1m0to11m10, - }; - - #define MAX1363_12X_CHANS(bits) { \ -@@ -583,16 +583,15 @@ static const struct iio_chan_spec max1238_channels[] = MAX1363_12X_CHANS(12); - - static const enum max1363_modes max11607_mode_list[] = { - _s0, _s1, _s2, _s3, -- s0to1, s0to2, s0to3, -- s2to3, -+ s0to1, s0to2, s2to3, -+ s0to3, - d0m1, d2m3, d1m0, d3m2, - d0m1to2m3, d1m0to3m2, - }; - - static const enum max1363_modes max11608_mode_list[] = { - _s0, _s1, _s2, _s3, _s4, _s5, _s6, _s7, -- s0to1, s0to2, s0to3, s0to4, s0to5, s0to6, s0to7, -- s6to7, -+ s0to1, s0to2, s0to3, s0to4, s0to5, s0to6, s6to7, s0to7, - d0m1, d2m3, d4m5, d6m7, - d1m0, d3m2, d5m4, d7m6, - d0m1to2m3, d0m1to4m5, d0m1to6m7, -@@ -608,14 +607,14 @@ static const enum max1363_modes max11608_mode_list[] = { - MAX1363_CHAN_U(5, _s5, 5, bits, NULL, 0), \ - MAX1363_CHAN_U(6, _s6, 6, bits, NULL, 0), \ - MAX1363_CHAN_U(7, _s7, 7, bits, NULL, 0), \ -- MAX1363_CHAN_B(0, 1, d0m1, 8, bits, NULL, 0), \ -- MAX1363_CHAN_B(2, 3, d2m3, 9, bits, NULL, 0), \ -- MAX1363_CHAN_B(4, 5, d4m5, 10, bits, NULL, 0), \ -- MAX1363_CHAN_B(6, 7, d6m7, 11, bits, NULL, 0), \ -- MAX1363_CHAN_B(1, 0, d1m0, 12, bits, NULL, 0), \ -- MAX1363_CHAN_B(3, 2, d3m2, 13, bits, NULL, 0), \ -- MAX1363_CHAN_B(5, 4, d5m4, 14, bits, NULL, 0), \ -- MAX1363_CHAN_B(7, 6, d7m6, 15, bits, NULL, 0), \ -+ MAX1363_CHAN_B(0, 1, d0m1, 12, bits, NULL, 0), \ -+ MAX1363_CHAN_B(2, 3, d2m3, 13, bits, NULL, 0), \ -+ MAX1363_CHAN_B(4, 5, d4m5, 14, bits, NULL, 0), \ -+ MAX1363_CHAN_B(6, 7, d6m7, 15, bits, NULL, 0), \ -+ MAX1363_CHAN_B(1, 0, d1m0, 18, bits, NULL, 0), \ -+ MAX1363_CHAN_B(3, 2, d3m2, 19, bits, NULL, 0), \ -+ MAX1363_CHAN_B(5, 4, d5m4, 20, bits, NULL, 0), \ -+ MAX1363_CHAN_B(7, 6, d7m6, 21, bits, NULL, 0), \ - IIO_CHAN_SOFT_TIMESTAMP(16) \ - } - static const struct iio_chan_spec max11602_channels[] = MAX1363_8X_CHANS(8); -diff --git a/drivers/iio/adc/stm32-adc-core.c b/drivers/iio/adc/stm32-adc-core.c -index bbd5bdd732f01b..9f1566a378de47 100644 ---- a/drivers/iio/adc/stm32-adc-core.c -+++ b/drivers/iio/adc/stm32-adc-core.c -@@ -428,10 +428,9 @@ static int stm32_adc_irq_probe(struct platform_device *pdev, - return -ENOMEM; - } - -- for (i = 0; i < priv->cfg->num_irqs; i++) { -- irq_set_chained_handler(priv->irq[i], stm32_adc_irq_handler); -- irq_set_handler_data(priv->irq[i], priv); -- } -+ for (i = 0; i < priv->cfg->num_irqs; i++) -+ irq_set_chained_handler_and_data(priv->irq[i], -+ stm32_adc_irq_handler, priv); - - return 0; - } -diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c -index 05c00421ff2b7e..09fcc14051f285 100644 ---- a/drivers/input/joystick/xpad.c -+++ b/drivers/input/joystick/xpad.c -@@ -169,12 +169,12 @@ static const struct xpad_device { - { 0x046d, 0xca88, "Logitech Compact Controller for Xbox", 0, XTYPE_XBOX }, - { 0x046d, 0xca8a, "Logitech Precision Vibration Feedback Wheel", 0, XTYPE_XBOX }, - { 0x046d, 0xcaa3, "Logitech DriveFx Racing Wheel", 0, XTYPE_XBOX360 }, -+ { 0x0502, 0x1305, "Acer NGR200", 0, XTYPE_XBOX360 }, - { 0x056e, 0x2004, "Elecom JC-U3613M", 0, XTYPE_XBOX360 }, - { 0x05fd, 0x1007, "Mad Catz Controller (unverified)", 0, XTYPE_XBOX }, - { 0x05fd, 0x107a, "InterAct 'PowerPad Pro' X-Box pad (Germany)", 0, XTYPE_XBOX }, - { 0x05fe, 0x3030, "Chic Controller", 0, XTYPE_XBOX }, - { 0x05fe, 0x3031, "Chic Controller", 0, XTYPE_XBOX }, -- { 0x0502, 0x1305, "Acer NGR200", 0, XTYPE_XBOX }, - { 0x062a, 0x0020, "Logic3 Xbox GamePad", 0, XTYPE_XBOX }, - { 0x062a, 0x0033, "Competition Pro Steering Wheel", 0, XTYPE_XBOX }, - { 0x06a3, 0x0200, "Saitek Racing Wheel", 0, XTYPE_XBOX }, -diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c -index 2d3afeaf886877..02838beee9d121 100644 ---- a/drivers/md/dm-bufio.c -+++ b/drivers/md/dm-bufio.c -@@ -2708,7 +2708,11 @@ static unsigned long __evict_many(struct dm_bufio_client *c, - __make_buffer_clean(b); - __free_buffer_wake(b); - -- cond_resched(); -+ if (need_resched()) { -+ dm_bufio_unlock(c); -+ cond_resched(); -+ dm_bufio_lock(c); -+ } - } - - return count; -diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c -index bbfaf6536903d3..ac71abdce1b254 100644 ---- a/drivers/memstick/core/memstick.c -+++ b/drivers/memstick/core/memstick.c -@@ -323,7 +323,7 @@ EXPORT_SYMBOL(memstick_init_req); - static int h_memstick_read_dev_id(struct memstick_dev *card, - struct memstick_request **mrq) - { -- struct ms_id_register id_reg; -+ struct ms_id_register id_reg = {}; - - if (!(*mrq)) { - memstick_init_req(&card->current_mrq, MS_TPC_READ_REG, &id_reg, -diff --git a/drivers/mmc/host/bcm2835.c b/drivers/mmc/host/bcm2835.c -index 35d8fdea668b91..f923447ed2ce23 100644 ---- a/drivers/mmc/host/bcm2835.c -+++ b/drivers/mmc/host/bcm2835.c -@@ -502,7 +502,8 @@ void bcm2835_prepare_dma(struct bcm2835_host *host, struct mmc_data *data) - DMA_PREP_INTERRUPT | DMA_CTRL_ACK); - - if (!desc) { -- dma_unmap_sg(dma_chan->device->dev, data->sg, sg_len, dir_data); -+ dma_unmap_sg(dma_chan->device->dev, data->sg, data->sg_len, -+ dir_data); - return; - } - -diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c -index dbfe0a5324eaf0..2ea5357e3bf0ea 100644 ---- a/drivers/mmc/host/sdhci-pci-core.c -+++ b/drivers/mmc/host/sdhci-pci-core.c -@@ -911,7 +911,8 @@ static bool glk_broken_cqhci(struct sdhci_pci_slot *slot) - { - return slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_GLK_EMMC && - (dmi_match(DMI_BIOS_VENDOR, "LENOVO") || -- dmi_match(DMI_SYS_VENDOR, "IRBIS")); -+ dmi_match(DMI_SYS_VENDOR, "IRBIS") || -+ dmi_match(DMI_SYS_VENDOR, "Positivo Tecnologia SA")); - } - - static bool jsl_broken_hs400es(struct sdhci_pci_slot *slot) -diff --git a/drivers/mmc/host/sdhci_am654.c b/drivers/mmc/host/sdhci_am654.c -index 562034af653ebb..fb89b6062351ad 100644 ---- a/drivers/mmc/host/sdhci_am654.c -+++ b/drivers/mmc/host/sdhci_am654.c -@@ -559,7 +559,8 @@ static struct sdhci_ops sdhci_am654_ops = { - static const struct sdhci_pltfm_data sdhci_am654_pdata = { - .ops = &sdhci_am654_ops, - .quirks = SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12, -- .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, -+ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN | -+ SDHCI_QUIRK2_DISABLE_HW_TIMEOUT, - }; - - static const struct sdhci_am654_driver_data sdhci_am654_sr1_drvdata = { -@@ -589,7 +590,8 @@ static struct sdhci_ops sdhci_j721e_8bit_ops = { - static const struct sdhci_pltfm_data sdhci_j721e_8bit_pdata = { - .ops = &sdhci_j721e_8bit_ops, - .quirks = SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12, -- .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, -+ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN | -+ SDHCI_QUIRK2_DISABLE_HW_TIMEOUT, - }; - - static const struct sdhci_am654_driver_data sdhci_j721e_8bit_drvdata = { -@@ -613,7 +615,8 @@ static struct sdhci_ops sdhci_j721e_4bit_ops = { - static const struct sdhci_pltfm_data sdhci_j721e_4bit_pdata = { - .ops = &sdhci_j721e_4bit_ops, - .quirks = SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12, -- .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, -+ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN | -+ SDHCI_QUIRK2_DISABLE_HW_TIMEOUT, - }; - - static const struct sdhci_am654_driver_data sdhci_j721e_4bit_drvdata = { -diff --git a/drivers/net/ethernet/intel/ice/ice_lag.c b/drivers/net/ethernet/intel/ice/ice_lag.c -index 4db0b770420e65..8ed9918ea4e894 100644 ---- a/drivers/net/ethernet/intel/ice/ice_lag.c -+++ b/drivers/net/ethernet/intel/ice/ice_lag.c -@@ -2129,7 +2129,8 @@ bool ice_lag_is_switchdev_running(struct ice_pf *pf) - struct ice_lag *lag = pf->lag; - struct net_device *tmp_nd; - -- if (!ice_is_feature_supported(pf, ICE_F_SRIOV_LAG) || !lag) -+ if (!ice_is_feature_supported(pf, ICE_F_SRIOV_LAG) || -+ !lag || !lag->upper_netdev) - return false; - - rcu_read_lock(); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -index 57b0e26696e306..d5731f7be04fd1 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -@@ -1159,8 +1159,9 @@ static void mlx5e_lro_update_tcp_hdr(struct mlx5_cqe64 *cqe, struct tcphdr *tcp) - } - } - --static void mlx5e_lro_update_hdr(struct sk_buff *skb, struct mlx5_cqe64 *cqe, -- u32 cqe_bcnt) -+static unsigned int mlx5e_lro_update_hdr(struct sk_buff *skb, -+ struct mlx5_cqe64 *cqe, -+ u32 cqe_bcnt) - { - struct ethhdr *eth = (struct ethhdr *)(skb->data); - struct tcphdr *tcp; -@@ -1211,6 +1212,8 @@ static void mlx5e_lro_update_hdr(struct sk_buff *skb, struct mlx5_cqe64 *cqe, - tcp->check = csum_ipv6_magic(&ipv6->saddr, &ipv6->daddr, payload_len, - IPPROTO_TCP, check); - } -+ -+ return (unsigned int)((unsigned char *)tcp + tcp->doff * 4 - skb->data); - } - - static void *mlx5e_shampo_get_packet_hd(struct mlx5e_rq *rq, u16 header_index) -@@ -1567,8 +1570,9 @@ static inline void mlx5e_build_rx_skb(struct mlx5_cqe64 *cqe, - mlx5e_macsec_offload_handle_rx_skb(netdev, skb, cqe); - - if (lro_num_seg > 1) { -- mlx5e_lro_update_hdr(skb, cqe, cqe_bcnt); -- skb_shinfo(skb)->gso_size = DIV_ROUND_UP(cqe_bcnt, lro_num_seg); -+ unsigned int hdrlen = mlx5e_lro_update_hdr(skb, cqe, cqe_bcnt); -+ -+ skb_shinfo(skb)->gso_size = DIV_ROUND_UP(cqe_bcnt - hdrlen, lro_num_seg); - /* Subtract one since we already counted this as one - * "regular" packet in mlx5e_complete_rx_cqe() - */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index 96136229b1b070..32fa789a696056 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -2206,6 +2206,7 @@ static const struct pci_device_id mlx5_core_pci_table[] = { - { PCI_VDEVICE(MELLANOX, 0x1021) }, /* ConnectX-7 */ - { PCI_VDEVICE(MELLANOX, 0x1023) }, /* ConnectX-8 */ - { PCI_VDEVICE(MELLANOX, 0x1025) }, /* ConnectX-9 */ -+ { PCI_VDEVICE(MELLANOX, 0x1027) }, /* ConnectX-10 */ - { PCI_VDEVICE(MELLANOX, 0xa2d2) }, /* BlueField integrated ConnectX-5 network controller */ - { PCI_VDEVICE(MELLANOX, 0xa2d3), MLX5_PCI_DEV_IS_VF}, /* BlueField integrated ConnectX-5 network controller VF */ - { PCI_VDEVICE(MELLANOX, 0xa2d6) }, /* BlueField-2 integrated ConnectX-6 Dx network controller */ -diff --git a/drivers/net/ethernet/wangxun/libwx/wx_hw.c b/drivers/net/ethernet/wangxun/libwx/wx_hw.c -index d6bc2309d2a388..663a8988d27a73 100644 ---- a/drivers/net/ethernet/wangxun/libwx/wx_hw.c -+++ b/drivers/net/ethernet/wangxun/libwx/wx_hw.c -@@ -1348,7 +1348,6 @@ static void wx_configure_rx_ring(struct wx *wx, - struct wx_ring *ring) - { - u16 reg_idx = ring->reg_idx; -- union wx_rx_desc *rx_desc; - u64 rdba = ring->dma; - u32 rxdctl; - -@@ -1378,9 +1377,9 @@ static void wx_configure_rx_ring(struct wx *wx, - memset(ring->rx_buffer_info, 0, - sizeof(struct wx_rx_buffer) * ring->count); - -- /* initialize Rx descriptor 0 */ -- rx_desc = WX_RX_DESC(ring, 0); -- rx_desc->wb.upper.length = 0; -+ /* reset ntu and ntc to place SW in sync with hardware */ -+ ring->next_to_clean = 0; -+ ring->next_to_use = 0; - - /* enable receive descriptor ring */ - wr32m(wx, WX_PX_RR_CFG(reg_idx), -diff --git a/drivers/net/ethernet/wangxun/libwx/wx_lib.c b/drivers/net/ethernet/wangxun/libwx/wx_lib.c -index 97c6b4d2763433..23dbe4e4b36c04 100644 ---- a/drivers/net/ethernet/wangxun/libwx/wx_lib.c -+++ b/drivers/net/ethernet/wangxun/libwx/wx_lib.c -@@ -171,10 +171,6 @@ static void wx_dma_sync_frag(struct wx_ring *rx_ring, - skb_frag_off(frag), - skb_frag_size(frag), - DMA_FROM_DEVICE); -- -- /* If the page was released, just unmap it. */ -- if (unlikely(WX_CB(skb)->page_released)) -- page_pool_put_full_page(rx_ring->page_pool, rx_buffer->page, false); - } - - static struct wx_rx_buffer *wx_get_rx_buffer(struct wx_ring *rx_ring, -@@ -224,10 +220,6 @@ static void wx_put_rx_buffer(struct wx_ring *rx_ring, - struct sk_buff *skb, - int rx_buffer_pgcnt) - { -- if (!IS_ERR(skb) && WX_CB(skb)->dma == rx_buffer->dma) -- /* the page has been released from the ring */ -- WX_CB(skb)->page_released = true; -- - /* clear contents of rx_buffer */ - rx_buffer->page = NULL; - rx_buffer->skb = NULL; -@@ -315,7 +307,7 @@ static bool wx_alloc_mapped_page(struct wx_ring *rx_ring, - return false; - dma = page_pool_get_dma_addr(page); - -- bi->page_dma = dma; -+ bi->dma = dma; - bi->page = page; - bi->page_offset = 0; - -@@ -352,7 +344,7 @@ void wx_alloc_rx_buffers(struct wx_ring *rx_ring, u16 cleaned_count) - DMA_FROM_DEVICE); - - rx_desc->read.pkt_addr = -- cpu_to_le64(bi->page_dma + bi->page_offset); -+ cpu_to_le64(bi->dma + bi->page_offset); - - rx_desc++; - bi++; -@@ -365,6 +357,8 @@ void wx_alloc_rx_buffers(struct wx_ring *rx_ring, u16 cleaned_count) - - /* clear the status bits for the next_to_use descriptor */ - rx_desc->wb.upper.status_error = 0; -+ /* clear the length for the next_to_use descriptor */ -+ rx_desc->wb.upper.length = 0; - - cleaned_count--; - } while (cleaned_count); -@@ -2158,9 +2152,6 @@ static void wx_clean_rx_ring(struct wx_ring *rx_ring) - if (rx_buffer->skb) { - struct sk_buff *skb = rx_buffer->skb; - -- if (WX_CB(skb)->page_released) -- page_pool_put_full_page(rx_ring->page_pool, rx_buffer->page, false); -- - dev_kfree_skb(skb); - } - -@@ -2184,6 +2175,9 @@ static void wx_clean_rx_ring(struct wx_ring *rx_ring) - } - } - -+ /* Zero out the descriptor ring */ -+ memset(rx_ring->desc, 0, rx_ring->size); -+ - rx_ring->next_to_alloc = 0; - rx_ring->next_to_clean = 0; - rx_ring->next_to_use = 0; -diff --git a/drivers/net/ethernet/wangxun/libwx/wx_type.h b/drivers/net/ethernet/wangxun/libwx/wx_type.h -index c555af9ed51b29..0fef9dfdd9a6b7 100644 ---- a/drivers/net/ethernet/wangxun/libwx/wx_type.h -+++ b/drivers/net/ethernet/wangxun/libwx/wx_type.h -@@ -668,7 +668,6 @@ enum wx_reset_type { - struct wx_cb { - dma_addr_t dma; - u16 append_cnt; /* number of skb's appended */ -- bool page_released; - bool dma_released; - }; - -@@ -756,7 +755,6 @@ struct wx_tx_buffer { - struct wx_rx_buffer { - struct sk_buff *skb; - dma_addr_t dma; -- dma_addr_t page_dma; - struct page *page; - unsigned int page_offset; - }; -diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c -index b358ecc6722781..0eff5d4fe35dff 100644 ---- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c -+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c -@@ -285,7 +285,7 @@ static void xemaclite_aligned_read(u32 *src_ptr, u8 *dest_ptr, - - /* Read the remaining data */ - for (; length > 0; length--) -- *to_u8_ptr = *from_u8_ptr; -+ *to_u8_ptr++ = *from_u8_ptr++; - } - } - -diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c -index ce6ac26131b347..f33f9167ba6b6e 100644 ---- a/drivers/net/hyperv/netvsc_drv.c -+++ b/drivers/net/hyperv/netvsc_drv.c -@@ -2313,8 +2313,11 @@ static int netvsc_prepare_bonding(struct net_device *vf_netdev) - if (!ndev) - return NOTIFY_DONE; - -- /* set slave flag before open to prevent IPv6 addrconf */ -+ /* Set slave flag and no addrconf flag before open -+ * to prevent IPv6 addrconf. -+ */ - vf_netdev->flags |= IFF_SLAVE; -+ vf_netdev->priv_flags |= IFF_NO_ADDRCONF; - return NOTIFY_DONE; - } - -diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c -index cde0e80474a1de..875788918bcb3d 100644 ---- a/drivers/net/phy/phy_device.c -+++ b/drivers/net/phy/phy_device.c -@@ -3377,7 +3377,8 @@ static int phy_probe(struct device *dev) - /* Get the LEDs from the device tree, and instantiate standard - * LEDs for them. - */ -- if (IS_ENABLED(CONFIG_PHYLIB_LEDS)) -+ if (IS_ENABLED(CONFIG_PHYLIB_LEDS) && !phy_driver_is_genphy(phydev) && -+ !phy_driver_is_genphy_10g(phydev)) - err = of_phy_leds(phydev); - - out: -@@ -3394,7 +3395,8 @@ static int phy_remove(struct device *dev) - - cancel_delayed_work_sync(&phydev->state_queue); - -- if (IS_ENABLED(CONFIG_PHYLIB_LEDS)) -+ if (IS_ENABLED(CONFIG_PHYLIB_LEDS) && !phy_driver_is_genphy(phydev) && -+ !phy_driver_is_genphy_10g(phydev)) - phy_leds_unregister(phydev); - - phydev->state = PHY_DOWN; -diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c -index 673d3aa8379267..42b66adb35f1bc 100644 ---- a/drivers/net/usb/sierra_net.c -+++ b/drivers/net/usb/sierra_net.c -@@ -689,6 +689,10 @@ static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf) - status); - return -ENODEV; - } -+ if (!dev->status) { -+ dev_err(&dev->udev->dev, "No status endpoint found"); -+ return -ENODEV; -+ } - /* Initialize sierra private data */ - priv = kzalloc(sizeof *priv, GFP_KERNEL); - if (!priv) -diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c -index 6e2d0fda3ba4aa..13221cc0d17d43 100644 ---- a/drivers/nvme/host/core.c -+++ b/drivers/nvme/host/core.c -@@ -689,6 +689,10 @@ blk_status_t nvme_fail_nonready_command(struct nvme_ctrl *ctrl, - !test_bit(NVME_CTRL_FAILFAST_EXPIRED, &ctrl->flags) && - !blk_noretry_request(rq) && !(rq->cmd_flags & REQ_NVME_MPATH)) - return BLK_STS_RESOURCE; -+ -+ if (!(rq->rq_flags & RQF_DONTPREP)) -+ nvme_clear_nvme_request(rq); -+ - return nvme_host_path_error(rq); - } - EXPORT_SYMBOL_GPL(nvme_fail_nonready_command); -@@ -3596,7 +3600,7 @@ static void nvme_ns_add_to_ctrl_list(struct nvme_ns *ns) - return; - } - } -- list_add(&ns->list, &ns->ctrl->namespaces); -+ list_add_rcu(&ns->list, &ns->ctrl->namespaces); - } - - static void nvme_alloc_ns(struct nvme_ctrl *ctrl, struct nvme_ns_info *info) -diff --git a/drivers/nvmem/imx-ocotp-ele.c b/drivers/nvmem/imx-ocotp-ele.c -index 1356ec93bfd00c..66e468af0f2fe8 100644 ---- a/drivers/nvmem/imx-ocotp-ele.c -+++ b/drivers/nvmem/imx-ocotp-ele.c -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include /* ETH_ALEN */ - - enum fuse_type { - FUSE_FSB = 1, -@@ -114,9 +115,11 @@ static int imx_ocotp_cell_pp(void *context, const char *id, int index, - int i; - - /* Deal with some post processing of nvmem cell data */ -- if (id && !strcmp(id, "mac-address")) -+ if (id && !strcmp(id, "mac-address")) { -+ bytes = min(bytes, ETH_ALEN); - for (i = 0; i < bytes / 2; i++) - swap(buf[i], buf[bytes - i - 1]); -+ } - - return 0; - } -diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c -index 79dd4fda03295a..7bf7656d4f9631 100644 ---- a/drivers/nvmem/imx-ocotp.c -+++ b/drivers/nvmem/imx-ocotp.c -@@ -23,6 +23,7 @@ - #include - #include - #include -+#include /* ETH_ALEN */ - - #define IMX_OCOTP_OFFSET_B0W0 0x400 /* Offset from base address of the - * OTP Bank0 Word0 -@@ -227,9 +228,11 @@ static int imx_ocotp_cell_pp(void *context, const char *id, int index, - int i; - - /* Deal with some post processing of nvmem cell data */ -- if (id && !strcmp(id, "mac-address")) -+ if (id && !strcmp(id, "mac-address")) { -+ bytes = min(bytes, ETH_ALEN); - for (i = 0; i < bytes / 2; i++) - swap(buf[i], buf[bytes - i - 1]); -+ } - - return 0; - } -diff --git a/drivers/nvmem/u-boot-env.c b/drivers/nvmem/u-boot-env.c -index adabbfdad6fb6d..8712d3709a2683 100644 ---- a/drivers/nvmem/u-boot-env.c -+++ b/drivers/nvmem/u-boot-env.c -@@ -132,7 +132,7 @@ static int u_boot_env_parse(struct u_boot_env *priv) - size_t crc32_data_offset; - size_t crc32_data_len; - size_t crc32_offset; -- __le32 *crc32_addr; -+ uint32_t *crc32_addr; - size_t data_offset; - size_t data_len; - size_t dev_size; -@@ -183,8 +183,8 @@ static int u_boot_env_parse(struct u_boot_env *priv) - goto err_kfree; - } - -- crc32_addr = (__le32 *)(buf + crc32_offset); -- crc32 = le32_to_cpu(*crc32_addr); -+ crc32_addr = (uint32_t *)(buf + crc32_offset); -+ crc32 = *crc32_addr; - crc32_data_len = dev_size - crc32_data_offset; - data_len = dev_size - data_offset; - -diff --git a/drivers/phy/tegra/xusb-tegra186.c b/drivers/phy/tegra/xusb-tegra186.c -index 23a23f2d64e586..e818f6c3980e6b 100644 ---- a/drivers/phy/tegra/xusb-tegra186.c -+++ b/drivers/phy/tegra/xusb-tegra186.c -@@ -648,14 +648,15 @@ static void tegra186_utmi_bias_pad_power_on(struct tegra_xusb_padctl *padctl) - udelay(100); - } - -- if (padctl->soc->trk_hw_mode) { -- value = padctl_readl(padctl, XUSB_PADCTL_USB2_BIAS_PAD_CTL2); -- value |= USB2_TRK_HW_MODE; -+ value = padctl_readl(padctl, XUSB_PADCTL_USB2_BIAS_PAD_CTL2); -+ if (padctl->soc->trk_update_on_idle) - value &= ~CYA_TRK_CODE_UPDATE_ON_IDLE; -- padctl_writel(padctl, value, XUSB_PADCTL_USB2_BIAS_PAD_CTL2); -- } else { -+ if (padctl->soc->trk_hw_mode) -+ value |= USB2_TRK_HW_MODE; -+ padctl_writel(padctl, value, XUSB_PADCTL_USB2_BIAS_PAD_CTL2); -+ -+ if (!padctl->soc->trk_hw_mode) - clk_disable_unprepare(priv->usb2_trk_clk); -- } - } - - static void tegra186_utmi_bias_pad_power_off(struct tegra_xusb_padctl *padctl) -@@ -782,13 +783,15 @@ static int tegra186_xusb_padctl_vbus_override(struct tegra_xusb_padctl *padctl, - } - - static int tegra186_xusb_padctl_id_override(struct tegra_xusb_padctl *padctl, -- bool status) -+ struct tegra_xusb_usb2_port *port, bool status) - { -- u32 value; -+ u32 value, id_override; -+ int err = 0; - - dev_dbg(padctl->dev, "%s id override\n", status ? "set" : "clear"); - - value = padctl_readl(padctl, USB2_VBUS_ID); -+ id_override = value & ID_OVERRIDE(~0); - - if (status) { - if (value & VBUS_OVERRIDE) { -@@ -799,15 +802,35 @@ static int tegra186_xusb_padctl_id_override(struct tegra_xusb_padctl *padctl, - value = padctl_readl(padctl, USB2_VBUS_ID); - } - -- value &= ~ID_OVERRIDE(~0); -- value |= ID_OVERRIDE_GROUNDED; -+ if (id_override != ID_OVERRIDE_GROUNDED) { -+ value &= ~ID_OVERRIDE(~0); -+ value |= ID_OVERRIDE_GROUNDED; -+ padctl_writel(padctl, value, USB2_VBUS_ID); -+ -+ err = regulator_enable(port->supply); -+ if (err) { -+ dev_err(padctl->dev, "Failed to enable regulator: %d\n", err); -+ return err; -+ } -+ } - } else { -- value &= ~ID_OVERRIDE(~0); -- value |= ID_OVERRIDE_FLOATING; -+ if (id_override == ID_OVERRIDE_GROUNDED) { -+ /* -+ * The regulator is disabled only when the role transitions -+ * from USB_ROLE_HOST to USB_ROLE_NONE. -+ */ -+ err = regulator_disable(port->supply); -+ if (err) { -+ dev_err(padctl->dev, "Failed to disable regulator: %d\n", err); -+ return err; -+ } -+ -+ value &= ~ID_OVERRIDE(~0); -+ value |= ID_OVERRIDE_FLOATING; -+ padctl_writel(padctl, value, USB2_VBUS_ID); -+ } - } - -- padctl_writel(padctl, value, USB2_VBUS_ID); -- - return 0; - } - -@@ -826,27 +849,20 @@ static int tegra186_utmi_phy_set_mode(struct phy *phy, enum phy_mode mode, - - if (mode == PHY_MODE_USB_OTG) { - if (submode == USB_ROLE_HOST) { -- tegra186_xusb_padctl_id_override(padctl, true); -- -- err = regulator_enable(port->supply); -+ err = tegra186_xusb_padctl_id_override(padctl, port, true); -+ if (err) -+ goto out; - } else if (submode == USB_ROLE_DEVICE) { - tegra186_xusb_padctl_vbus_override(padctl, true); - } else if (submode == USB_ROLE_NONE) { -- /* -- * When port is peripheral only or role transitions to -- * USB_ROLE_NONE from USB_ROLE_DEVICE, regulator is not -- * enabled. -- */ -- if (regulator_is_enabled(port->supply)) -- regulator_disable(port->supply); -- -- tegra186_xusb_padctl_id_override(padctl, false); -+ err = tegra186_xusb_padctl_id_override(padctl, port, false); -+ if (err) -+ goto out; - tegra186_xusb_padctl_vbus_override(padctl, false); - } - } -- -+out: - mutex_unlock(&padctl->lock); -- - return err; - } - -@@ -1710,7 +1726,8 @@ const struct tegra_xusb_padctl_soc tegra234_xusb_padctl_soc = { - .num_supplies = ARRAY_SIZE(tegra194_xusb_padctl_supply_names), - .supports_gen2 = true, - .poll_trk_completed = true, -- .trk_hw_mode = true, -+ .trk_hw_mode = false, -+ .trk_update_on_idle = true, - .supports_lp_cfg_en = true, - }; - EXPORT_SYMBOL_GPL(tegra234_xusb_padctl_soc); -diff --git a/drivers/phy/tegra/xusb.h b/drivers/phy/tegra/xusb.h -index 6e45d194c68947..d2b5f95651324a 100644 ---- a/drivers/phy/tegra/xusb.h -+++ b/drivers/phy/tegra/xusb.h -@@ -434,6 +434,7 @@ struct tegra_xusb_padctl_soc { - bool need_fake_usb3_port; - bool poll_trk_completed; - bool trk_hw_mode; -+ bool trk_update_on_idle; - bool supports_lp_cfg_en; - }; - -diff --git a/drivers/regulator/pwm-regulator.c b/drivers/regulator/pwm-regulator.c -index 226ca4c62673ff..60cfcd741c2af3 100644 ---- a/drivers/regulator/pwm-regulator.c -+++ b/drivers/regulator/pwm-regulator.c -@@ -157,6 +157,13 @@ static int pwm_regulator_get_voltage(struct regulator_dev *rdev) - - pwm_get_state(drvdata->pwm, &pstate); - -+ if (!pstate.enabled) { -+ if (pstate.polarity == PWM_POLARITY_INVERSED) -+ pstate.duty_cycle = pstate.period; -+ else -+ pstate.duty_cycle = 0; -+ } -+ - voltage = pwm_get_relative_duty_cycle(&pstate, duty_unit); - if (voltage < min(max_uV_duty, min_uV_duty) || - voltage > max(max_uV_duty, min_uV_duty)) -@@ -316,6 +323,32 @@ static int pwm_regulator_init_continuous(struct platform_device *pdev, - return 0; - } - -+static int pwm_regulator_init_boot_on(struct platform_device *pdev, -+ struct pwm_regulator_data *drvdata, -+ const struct regulator_init_data *init_data) -+{ -+ struct pwm_state pstate; -+ -+ if (!init_data->constraints.boot_on || drvdata->enb_gpio) -+ return 0; -+ -+ pwm_get_state(drvdata->pwm, &pstate); -+ if (pstate.enabled) -+ return 0; -+ -+ /* -+ * Update the duty cycle so the output does not change -+ * when the regulator core enables the regulator (and -+ * thus the PWM channel). -+ */ -+ if (pstate.polarity == PWM_POLARITY_INVERSED) -+ pstate.duty_cycle = pstate.period; -+ else -+ pstate.duty_cycle = 0; -+ -+ return pwm_apply_might_sleep(drvdata->pwm, &pstate); -+} -+ - static int pwm_regulator_probe(struct platform_device *pdev) - { - const struct regulator_init_data *init_data; -@@ -375,6 +408,13 @@ static int pwm_regulator_probe(struct platform_device *pdev) - if (ret) - return ret; - -+ ret = pwm_regulator_init_boot_on(pdev, drvdata, init_data); -+ if (ret) { -+ dev_err(&pdev->dev, "Failed to apply boot_on settings: %d\n", -+ ret); -+ return ret; -+ } -+ - regulator = devm_regulator_register(&pdev->dev, - &drvdata->desc, &config); - if (IS_ERR(regulator)) { -diff --git a/drivers/soc/aspeed/aspeed-lpc-snoop.c b/drivers/soc/aspeed/aspeed-lpc-snoop.c -index 0f2ffee321dd9c..3dd2ab8336aa3a 100644 ---- a/drivers/soc/aspeed/aspeed-lpc-snoop.c -+++ b/drivers/soc/aspeed/aspeed-lpc-snoop.c -@@ -58,6 +58,7 @@ struct aspeed_lpc_snoop_model_data { - }; - - struct aspeed_lpc_snoop_channel { -+ bool enabled; - struct kfifo fifo; - wait_queue_head_t wq; - struct miscdevice miscdev; -@@ -190,6 +191,9 @@ static int aspeed_lpc_enable_snoop(struct aspeed_lpc_snoop *lpc_snoop, - const struct aspeed_lpc_snoop_model_data *model_data = - of_device_get_match_data(dev); - -+ if (WARN_ON(lpc_snoop->chan[channel].enabled)) -+ return -EBUSY; -+ - init_waitqueue_head(&lpc_snoop->chan[channel].wq); - /* Create FIFO datastructure */ - rc = kfifo_alloc(&lpc_snoop->chan[channel].fifo, -@@ -236,6 +240,8 @@ static int aspeed_lpc_enable_snoop(struct aspeed_lpc_snoop *lpc_snoop, - regmap_update_bits(lpc_snoop->regmap, HICRB, - hicrb_en, hicrb_en); - -+ lpc_snoop->chan[channel].enabled = true; -+ - return 0; - - err_misc_deregister: -@@ -248,6 +254,9 @@ static int aspeed_lpc_enable_snoop(struct aspeed_lpc_snoop *lpc_snoop, - static void aspeed_lpc_disable_snoop(struct aspeed_lpc_snoop *lpc_snoop, - int channel) - { -+ if (!lpc_snoop->chan[channel].enabled) -+ return; -+ - switch (channel) { - case 0: - regmap_update_bits(lpc_snoop->regmap, HICR5, -@@ -263,8 +272,10 @@ static void aspeed_lpc_disable_snoop(struct aspeed_lpc_snoop *lpc_snoop, - return; - } - -- kfifo_free(&lpc_snoop->chan[channel].fifo); -+ lpc_snoop->chan[channel].enabled = false; -+ /* Consider improving safety wrt concurrent reader(s) */ - misc_deregister(&lpc_snoop->chan[channel].miscdev); -+ kfifo_free(&lpc_snoop->chan[channel].fifo); - } - - static int aspeed_lpc_snoop_probe(struct platform_device *pdev) -diff --git a/drivers/soundwire/amd_manager.c b/drivers/soundwire/amd_manager.c -index 31b203ebbae0ca..b89f8067e6cdd7 100644 ---- a/drivers/soundwire/amd_manager.c -+++ b/drivers/soundwire/amd_manager.c -@@ -205,7 +205,7 @@ static u64 amd_sdw_send_cmd_get_resp(struct amd_sdw_manager *amd_manager, u32 lo - - if (sts & AMD_SDW_IMM_RES_VALID) { - dev_err(amd_manager->dev, "SDW%x manager is in bad state\n", amd_manager->instance); -- writel(0x00, amd_manager->mmio + ACP_SW_IMM_CMD_STS); -+ writel(AMD_SDW_IMM_RES_VALID, amd_manager->mmio + ACP_SW_IMM_CMD_STS); - } - writel(upper_data, amd_manager->mmio + ACP_SW_IMM_CMD_UPPER_WORD); - writel(lower_data, amd_manager->mmio + ACP_SW_IMM_CMD_LOWER_QWORD); -@@ -1135,9 +1135,11 @@ static int __maybe_unused amd_suspend(struct device *dev) - } - - if (amd_manager->power_mode_mask & AMD_SDW_CLK_STOP_MODE) { -+ cancel_work_sync(&amd_manager->amd_sdw_work); - amd_sdw_wake_enable(amd_manager, false); - return amd_sdw_clock_stop(amd_manager); - } else if (amd_manager->power_mode_mask & AMD_SDW_POWER_OFF_MODE) { -+ cancel_work_sync(&amd_manager->amd_sdw_work); - amd_sdw_wake_enable(amd_manager, false); - /* - * As per hardware programming sequence on AMD platforms, -diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c -index 72e514cee056dd..cfb6755c0730f4 100644 ---- a/drivers/spi/spi.c -+++ b/drivers/spi/spi.c -@@ -4011,10 +4011,13 @@ static int __spi_validate(struct spi_device *spi, struct spi_message *message) - xfer->tx_nbits != SPI_NBITS_OCTAL) - return -EINVAL; - if ((xfer->tx_nbits == SPI_NBITS_DUAL) && -- !(spi->mode & (SPI_TX_DUAL | SPI_TX_QUAD))) -+ !(spi->mode & (SPI_TX_DUAL | SPI_TX_QUAD | SPI_TX_OCTAL))) - return -EINVAL; - if ((xfer->tx_nbits == SPI_NBITS_QUAD) && -- !(spi->mode & SPI_TX_QUAD)) -+ !(spi->mode & (SPI_TX_QUAD | SPI_TX_OCTAL))) -+ return -EINVAL; -+ if ((xfer->tx_nbits == SPI_NBITS_OCTAL) && -+ !(spi->mode & SPI_TX_OCTAL)) - return -EINVAL; - } - /* Check transfer rx_nbits */ -@@ -4027,10 +4030,13 @@ static int __spi_validate(struct spi_device *spi, struct spi_message *message) - xfer->rx_nbits != SPI_NBITS_OCTAL) - return -EINVAL; - if ((xfer->rx_nbits == SPI_NBITS_DUAL) && -- !(spi->mode & (SPI_RX_DUAL | SPI_RX_QUAD))) -+ !(spi->mode & (SPI_RX_DUAL | SPI_RX_QUAD | SPI_RX_OCTAL))) - return -EINVAL; - if ((xfer->rx_nbits == SPI_NBITS_QUAD) && -- !(spi->mode & SPI_RX_QUAD)) -+ !(spi->mode & (SPI_RX_QUAD | SPI_RX_OCTAL))) -+ return -EINVAL; -+ if ((xfer->rx_nbits == SPI_NBITS_OCTAL) && -+ !(spi->mode & SPI_RX_OCTAL)) - return -EINVAL; - } - -diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c -index 52cb1a3bb8c786..df83383800a8ef 100644 ---- a/drivers/thunderbolt/switch.c -+++ b/drivers/thunderbolt/switch.c -@@ -1465,7 +1465,7 @@ int tb_dp_port_set_hops(struct tb_port *port, unsigned int video, - return ret; - - data[0] &= ~ADP_DP_CS_0_VIDEO_HOPID_MASK; -- data[1] &= ~ADP_DP_CS_1_AUX_RX_HOPID_MASK; -+ data[1] &= ~ADP_DP_CS_1_AUX_TX_HOPID_MASK; - data[1] &= ~ADP_DP_CS_1_AUX_RX_HOPID_MASK; - - data[0] |= (video << ADP_DP_CS_0_VIDEO_HOPID_SHIFT) & -@@ -3439,7 +3439,7 @@ void tb_sw_set_unplugged(struct tb_switch *sw) - } - } - --static int tb_switch_set_wake(struct tb_switch *sw, unsigned int flags) -+static int tb_switch_set_wake(struct tb_switch *sw, unsigned int flags, bool runtime) - { - if (flags) - tb_sw_dbg(sw, "enabling wakeup: %#x\n", flags); -@@ -3447,7 +3447,7 @@ static int tb_switch_set_wake(struct tb_switch *sw, unsigned int flags) - tb_sw_dbg(sw, "disabling wakeup\n"); - - if (tb_switch_is_usb4(sw)) -- return usb4_switch_set_wake(sw, flags); -+ return usb4_switch_set_wake(sw, flags, runtime); - return tb_lc_set_wake(sw, flags); - } - -@@ -3523,7 +3523,7 @@ int tb_switch_resume(struct tb_switch *sw, bool runtime) - tb_switch_check_wakes(sw); - - /* Disable wakes */ -- tb_switch_set_wake(sw, 0); -+ tb_switch_set_wake(sw, 0, true); - - err = tb_switch_tmu_init(sw); - if (err) -@@ -3604,7 +3604,7 @@ void tb_switch_suspend(struct tb_switch *sw, bool runtime) - flags |= TB_WAKE_ON_USB4 | TB_WAKE_ON_USB3 | TB_WAKE_ON_PCIE; - } - -- tb_switch_set_wake(sw, flags); -+ tb_switch_set_wake(sw, flags, runtime); - - if (tb_switch_is_usb4(sw)) - usb4_switch_set_sleep(sw); -diff --git a/drivers/thunderbolt/tb.h b/drivers/thunderbolt/tb.h -index 920dac8a63e1df..d67a25f33fd1c5 100644 ---- a/drivers/thunderbolt/tb.h -+++ b/drivers/thunderbolt/tb.h -@@ -1266,7 +1266,7 @@ int usb4_switch_read_uid(struct tb_switch *sw, u64 *uid); - int usb4_switch_drom_read(struct tb_switch *sw, unsigned int address, void *buf, - size_t size); - bool usb4_switch_lane_bonding_possible(struct tb_switch *sw); --int usb4_switch_set_wake(struct tb_switch *sw, unsigned int flags); -+int usb4_switch_set_wake(struct tb_switch *sw, unsigned int flags, bool runtime); - int usb4_switch_set_sleep(struct tb_switch *sw); - int usb4_switch_nvm_sector_size(struct tb_switch *sw); - int usb4_switch_nvm_read(struct tb_switch *sw, unsigned int address, void *buf, -diff --git a/drivers/thunderbolt/usb4.c b/drivers/thunderbolt/usb4.c -index e445516290f912..d4b4f58e717c12 100644 ---- a/drivers/thunderbolt/usb4.c -+++ b/drivers/thunderbolt/usb4.c -@@ -405,12 +405,12 @@ bool usb4_switch_lane_bonding_possible(struct tb_switch *sw) - * usb4_switch_set_wake() - Enabled/disable wake - * @sw: USB4 router - * @flags: Wakeup flags (%0 to disable) -+ * @runtime: Wake is being programmed during system runtime - * - * Enables/disables router to wake up from sleep. - */ --int usb4_switch_set_wake(struct tb_switch *sw, unsigned int flags) -+int usb4_switch_set_wake(struct tb_switch *sw, unsigned int flags, bool runtime) - { -- struct usb4_port *usb4; - struct tb_port *port; - u64 route = tb_route(sw); - u32 val; -@@ -440,13 +440,11 @@ int usb4_switch_set_wake(struct tb_switch *sw, unsigned int flags) - val |= PORT_CS_19_WOU4; - } else { - bool configured = val & PORT_CS_19_PC; -- usb4 = port->usb4; -+ bool wakeup = runtime || device_may_wakeup(&port->usb4->dev); - -- if (((flags & TB_WAKE_ON_CONNECT) && -- device_may_wakeup(&usb4->dev)) && !configured) -+ if ((flags & TB_WAKE_ON_CONNECT) && wakeup && !configured) - val |= PORT_CS_19_WOC; -- if (((flags & TB_WAKE_ON_DISCONNECT) && -- device_may_wakeup(&usb4->dev)) && configured) -+ if ((flags & TB_WAKE_ON_DISCONNECT) && wakeup && configured) - val |= PORT_CS_19_WOD; - if ((flags & TB_WAKE_ON_USB4) && configured) - val |= PORT_CS_19_WOU4; -diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c -index cc83b772b7ca9c..7b868ea48ad597 100644 ---- a/drivers/tty/serial/pch_uart.c -+++ b/drivers/tty/serial/pch_uart.c -@@ -967,7 +967,7 @@ static unsigned int dma_handle_tx(struct eg20t_port *priv) - __func__); - return 0; - } -- dma_sync_sg_for_device(port->dev, priv->sg_tx_p, nent, DMA_TO_DEVICE); -+ dma_sync_sg_for_device(port->dev, priv->sg_tx_p, num, DMA_TO_DEVICE); - priv->desc_tx = desc; - desc->callback = pch_dma_tx_complete; - desc->callback_param = priv; -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 855356752380b6..bebc41308ca930 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -66,6 +66,12 @@ - */ - #define USB_SHORT_SET_ADDRESS_REQ_TIMEOUT 500 /* ms */ - -+/* -+ * Give SS hubs 200ms time after wake to train downstream links before -+ * assuming no port activity and allowing hub to runtime suspend back. -+ */ -+#define USB_SS_PORT_U0_WAKE_TIME 200 /* ms */ -+ - /* Protect struct usb_device->state and ->children members - * Note: Both are also protected by ->dev.sem, except that ->state can - * change to USB_STATE_NOTATTACHED even when the semaphore isn't held. */ -@@ -1065,6 +1071,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) - goto init2; - goto init3; - } -+ - hub_get(hub); - - /* The superspeed hub except for root hub has to use Hub Depth -@@ -1313,6 +1320,17 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) - device_unlock(&hdev->dev); - } - -+ if (type == HUB_RESUME && hub_is_superspeed(hub->hdev)) { -+ /* give usb3 downstream links training time after hub resume */ -+ usb_autopm_get_interface_no_resume( -+ to_usb_interface(hub->intfdev)); -+ -+ queue_delayed_work(system_power_efficient_wq, -+ &hub->post_resume_work, -+ msecs_to_jiffies(USB_SS_PORT_U0_WAKE_TIME)); -+ return; -+ } -+ - hub_put(hub); - } - -@@ -1331,6 +1349,14 @@ static void hub_init_func3(struct work_struct *ws) - hub_activate(hub, HUB_INIT3); - } - -+static void hub_post_resume(struct work_struct *ws) -+{ -+ struct usb_hub *hub = container_of(ws, struct usb_hub, post_resume_work.work); -+ -+ usb_autopm_put_interface_async(to_usb_interface(hub->intfdev)); -+ hub_put(hub); -+} -+ - enum hub_quiescing_type { - HUB_DISCONNECT, HUB_PRE_RESET, HUB_SUSPEND - }; -@@ -1356,6 +1382,7 @@ static void hub_quiesce(struct usb_hub *hub, enum hub_quiescing_type type) - - /* Stop hub_wq and related activity */ - del_timer_sync(&hub->irq_urb_retry); -+ flush_delayed_work(&hub->post_resume_work); - usb_kill_urb(hub->urb); - if (hub->has_indicators) - cancel_delayed_work_sync(&hub->leds); -@@ -1914,6 +1941,7 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id) - hub->hdev = hdev; - INIT_DELAYED_WORK(&hub->leds, led_work); - INIT_DELAYED_WORK(&hub->init_work, NULL); -+ INIT_DELAYED_WORK(&hub->post_resume_work, hub_post_resume); - INIT_WORK(&hub->events, hub_event); - INIT_LIST_HEAD(&hub->onboard_hub_devs); - spin_lock_init(&hub->irq_urb_lock); -@@ -5686,6 +5714,7 @@ static void port_event(struct usb_hub *hub, int port1) - struct usb_device *hdev = hub->hdev; - u16 portstatus, portchange; - int i = 0; -+ int err; - - connect_change = test_bit(port1, hub->change_bits); - clear_bit(port1, hub->event_bits); -@@ -5782,8 +5811,11 @@ static void port_event(struct usb_hub *hub, int port1) - } else if (!udev || !(portstatus & USB_PORT_STAT_CONNECTION) - || udev->state == USB_STATE_NOTATTACHED) { - dev_dbg(&port_dev->dev, "do warm reset, port only\n"); -- if (hub_port_reset(hub, port1, NULL, -- HUB_BH_RESET_TIME, true) < 0) -+ err = hub_port_reset(hub, port1, NULL, -+ HUB_BH_RESET_TIME, true); -+ if (!udev && err == -ENOTCONN) -+ connect_change = 0; -+ else if (err < 0) - hub_port_disable(hub, port1, 1); - } else { - dev_dbg(&port_dev->dev, "do warm reset, full device\n"); -diff --git a/drivers/usb/core/hub.h b/drivers/usb/core/hub.h -index 6610cf6131c673..59c426e0e0b9d4 100644 ---- a/drivers/usb/core/hub.h -+++ b/drivers/usb/core/hub.h -@@ -69,6 +69,7 @@ struct usb_hub { - u8 indicator[USB_MAXCHILDREN]; - struct delayed_work leds; - struct delayed_work init_work; -+ struct delayed_work post_resume_work; - struct work_struct events; - spinlock_t irq_urb_lock; - struct timer_list irq_urb_retry; -diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c -index 82544374110b03..add808efb87165 100644 ---- a/drivers/usb/dwc3/dwc3-qcom.c -+++ b/drivers/usb/dwc3/dwc3-qcom.c -@@ -854,13 +854,13 @@ static int dwc3_qcom_probe(struct platform_device *pdev) - ret = reset_control_deassert(qcom->resets); - if (ret) { - dev_err(&pdev->dev, "failed to deassert resets, err=%d\n", ret); -- goto reset_assert; -+ return ret; - } - - ret = dwc3_qcom_clk_init(qcom, of_clk_get_parent_count(np)); - if (ret) { - dev_err_probe(dev, ret, "failed to get clocks\n"); -- goto reset_assert; -+ return ret; - } - - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); -@@ -964,8 +964,6 @@ static int dwc3_qcom_probe(struct platform_device *pdev) - clk_disable_unprepare(qcom->clks[i]); - clk_put(qcom->clks[i]); - } --reset_assert: -- reset_control_assert(qcom->resets); - - return ret; - } -@@ -995,8 +993,6 @@ static void dwc3_qcom_remove(struct platform_device *pdev) - qcom->num_clocks = 0; - - dwc3_qcom_interconnect_exit(qcom); -- reset_control_assert(qcom->resets); -- - pm_runtime_allow(dev); - pm_runtime_disable(dev); - } -diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c -index 3a80600d68068f..4c89f7629d5308 100644 ---- a/drivers/usb/gadget/configfs.c -+++ b/drivers/usb/gadget/configfs.c -@@ -1062,6 +1062,8 @@ static ssize_t webusb_landingPage_store(struct config_item *item, const char *pa - unsigned int bytes_to_strip = 0; - int l = len; - -+ if (!len) -+ return len; - if (page[l - 1] == '\n') { - --l; - ++bytes_to_strip; -@@ -1185,6 +1187,8 @@ static ssize_t os_desc_qw_sign_store(struct config_item *item, const char *page, - struct gadget_info *gi = os_desc_item_to_gadget_info(item); - int res, l; - -+ if (!len) -+ return len; - l = min((int)len, OS_STRING_QW_SIGN_LEN >> 1); - if (page[l - 1] == '\n') - --l; -diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c -index f175cb2c3e7bd2..cfac9792786549 100644 ---- a/drivers/usb/musb/musb_gadget.c -+++ b/drivers/usb/musb/musb_gadget.c -@@ -1925,6 +1925,7 @@ static int musb_gadget_stop(struct usb_gadget *g) - * gadget driver here and have everything work; - * that currently misbehaves. - */ -+ usb_gadget_set_state(g, USB_STATE_NOTATTACHED); - - /* Force check of devctl register for PM runtime */ - pm_runtime_mark_last_busy(musb->controller); -@@ -2031,6 +2032,7 @@ void musb_g_disconnect(struct musb *musb) - case OTG_STATE_B_PERIPHERAL: - case OTG_STATE_B_IDLE: - musb_set_state(musb, OTG_STATE_B_IDLE); -+ usb_gadget_set_state(&musb->g, USB_STATE_NOTATTACHED); - break; - case OTG_STATE_B_SRP_INIT: - break; -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index b583b31ea5e72e..8906c9dc348edd 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -803,6 +803,8 @@ static const struct usb_device_id id_table_combined[] = { - .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID), - .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, -+ { USB_DEVICE(FTDI_NDI_VID, FTDI_NDI_EMGUIDE_GEMINI_PID), -+ .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, - { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) }, - { USB_DEVICE(NOVITUS_VID, NOVITUS_BONO_E_PID) }, - { USB_DEVICE(FTDI_VID, RTSYSTEMS_USB_VX8_PID) }, -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index 9acb6f83732763..4cc1fae8acb970 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -204,6 +204,9 @@ - #define FTDI_NDI_FUTURE_3_PID 0xDA73 /* NDI future device #3 */ - #define FTDI_NDI_AURORA_SCU_PID 0xDA74 /* NDI Aurora SCU */ - -+#define FTDI_NDI_VID 0x23F2 -+#define FTDI_NDI_EMGUIDE_GEMINI_PID 0x0003 /* NDI Emguide Gemini */ -+ - /* - * ChamSys Limited (www.chamsys.co.uk) USB wing/interface product IDs - */ -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 5d669511609892..6c6387d39db82c 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -1415,6 +1415,9 @@ static const struct usb_device_id option_ids[] = { - .driver_info = NCTRL(5) }, - { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) }, - { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x60) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x30), /* Telit FE910C04 (ECM) */ -+ .driver_info = NCTRL(4) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x40) }, - { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x30), /* Telit FN990B (MBIM) */ - .driver_info = NCTRL(6) }, - { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x40) }, -@@ -2343,6 +2346,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = RSVD(3) }, - { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe145, 0xff), /* Foxconn T99W651 RNDIS */ - .driver_info = RSVD(5) | RSVD(6) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe167, 0xff), /* Foxconn T99W640 MBIM */ -+ .driver_info = RSVD(3) }, - { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ - .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, - { USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */ -diff --git a/fs/cachefiles/io.c b/fs/cachefiles/io.c -index 009d23cd435b54..239a6002083d70 100644 ---- a/fs/cachefiles/io.c -+++ b/fs/cachefiles/io.c -@@ -346,8 +346,6 @@ int __cachefiles_write(struct cachefiles_object *object, - default: - ki->was_async = false; - cachefiles_write_complete(&ki->iocb, ret); -- if (ret > 0) -- ret = 0; - break; - } - -diff --git a/fs/cachefiles/ondemand.c b/fs/cachefiles/ondemand.c -index 3389a373faf680..cfa8f23fdfb655 100644 ---- a/fs/cachefiles/ondemand.c -+++ b/fs/cachefiles/ondemand.c -@@ -84,10 +84,8 @@ static ssize_t cachefiles_ondemand_fd_write_iter(struct kiocb *kiocb, - - trace_cachefiles_ondemand_fd_write(object, file_inode(file), pos, len); - ret = __cachefiles_write(object, file, pos, iter, NULL, NULL); -- if (!ret) { -- ret = len; -+ if (ret > 0) - kiocb->ki_pos += ret; -- } - - out: - fput(file); -diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c -index 54075fe3de9b1f..d989bdcfaa26c7 100644 ---- a/fs/isofs/inode.c -+++ b/fs/isofs/inode.c -@@ -1486,9 +1486,16 @@ static int isofs_read_inode(struct inode *inode, int relocated) - inode->i_op = &page_symlink_inode_operations; - inode_nohighmem(inode); - inode->i_data.a_ops = &isofs_symlink_aops; -- } else -+ } else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) || -+ S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) { - /* XXX - parse_rock_ridge_inode() had already set i_rdev. */ - init_special_inode(inode, inode->i_mode, inode->i_rdev); -+ } else { -+ printk(KERN_DEBUG "ISOFS: Invalid file type 0%04o for inode %lu.\n", -+ inode->i_mode, inode->i_ino); -+ ret = -EIO; -+ goto fail; -+ } - - ret = 0; - out: -diff --git a/fs/namespace.c b/fs/namespace.c -index cebcb9fa2acc07..6a9c53c800c4e4 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -2110,6 +2110,11 @@ struct vfsmount *clone_private_mount(const struct path *path) - if (!check_mnt(old_mnt)) - goto invalid; - -+ if (!ns_capable(old_mnt->mnt_ns->user_ns, CAP_SYS_ADMIN)) { -+ up_read(&namespace_sem); -+ return ERR_PTR(-EPERM); -+ } -+ - if (has_locked_children(old_mnt, path->dentry)) - goto invalid; - -diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c -index d883ed75022c4a..99a8c6fbd41a65 100644 ---- a/fs/smb/client/file.c -+++ b/fs/smb/client/file.c -@@ -5042,7 +5042,8 @@ void cifs_oplock_break(struct work_struct *work) - struct cifsFileInfo *cfile = container_of(work, struct cifsFileInfo, - oplock_break); - struct inode *inode = d_inode(cfile->dentry); -- struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb); -+ struct super_block *sb = inode->i_sb; -+ struct cifs_sb_info *cifs_sb = CIFS_SB(sb); - struct cifsInodeInfo *cinode = CIFS_I(inode); - struct cifs_tcon *tcon; - struct TCP_Server_Info *server; -@@ -5052,6 +5053,12 @@ void cifs_oplock_break(struct work_struct *work) - __u64 persistent_fid, volatile_fid; - __u16 net_fid; - -+ /* -+ * Hold a reference to the superblock to prevent it and its inodes from -+ * being freed while we are accessing cinode. Otherwise, _cifsFileInfo_put() -+ * may release the last reference to the sb and trigger inode eviction. -+ */ -+ cifs_sb_active(sb); - wait_on_bit(&cinode->flags, CIFS_INODE_PENDING_WRITERS, - TASK_UNINTERRUPTIBLE); - -@@ -5124,6 +5131,7 @@ void cifs_oplock_break(struct work_struct *work) - cifs_put_tlink(tlink); - out: - cifs_done_oplock_break(cinode); -+ cifs_sb_deactive(sb); - } - - /* -diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c -index 4e3eacbec96d14..2385e570e3311a 100644 ---- a/fs/smb/client/smb2ops.c -+++ b/fs/smb/client/smb2ops.c -@@ -4271,6 +4271,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, - u8 key[SMB3_ENC_DEC_KEY_SIZE]; - struct aead_request *req; - u8 *iv; -+ DECLARE_CRYPTO_WAIT(wait); - unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize); - void *creq; - size_t sensitive_size; -@@ -4321,7 +4322,11 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, - aead_request_set_crypt(req, sg, sg, crypt_len, iv); - aead_request_set_ad(req, assoc_data_len); - -- rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req); -+ aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, -+ crypto_req_done, &wait); -+ -+ rc = crypto_wait_req(enc ? crypto_aead_encrypt(req) -+ : crypto_aead_decrypt(req), &wait); - - if (!rc && enc) - memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE); -diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h -index 802ea3080d0b36..2fb3151ea7c9e9 100644 ---- a/include/net/cfg80211.h -+++ b/include/net/cfg80211.h -@@ -2543,7 +2543,7 @@ struct cfg80211_scan_request { - struct cfg80211_scan_6ghz_params *scan_6ghz_params; - - /* keep last */ -- struct ieee80211_channel *channels[] __counted_by(n_channels); -+ struct ieee80211_channel *channels[]; - }; - - static inline void get_random_mask_addr(u8 *buf, const u8 *addr, const u8 *mask) -diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h -index 4085765c337054..a2c987289401ee 100644 ---- a/include/net/netfilter/nf_conntrack.h -+++ b/include/net/netfilter/nf_conntrack.h -@@ -302,8 +302,19 @@ static inline bool nf_ct_is_expired(const struct nf_conn *ct) - /* use after obtaining a reference count */ - static inline bool nf_ct_should_gc(const struct nf_conn *ct) - { -- return nf_ct_is_expired(ct) && nf_ct_is_confirmed(ct) && -- !nf_ct_is_dying(ct); -+ if (!nf_ct_is_confirmed(ct)) -+ return false; -+ -+ /* load ct->timeout after is_confirmed() test. -+ * Pairs with __nf_conntrack_confirm() which: -+ * 1. Increases ct->timeout value -+ * 2. Inserts ct into rcu hlist -+ * 3. Sets the confirmed bit -+ * 4. Unlocks the hlist lock -+ */ -+ smp_acquire__after_ctrl_dep(); -+ -+ return nf_ct_is_expired(ct) && !nf_ct_is_dying(ct); - } - - #define NF_CT_DAY (86400 * HZ) -diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h -index e7c7b638943629..743f8f1f42a742 100644 ---- a/include/trace/events/rxrpc.h -+++ b/include/trace/events/rxrpc.h -@@ -278,12 +278,15 @@ - EM(rxrpc_call_put_userid, "PUT user-id ") \ - EM(rxrpc_call_see_accept, "SEE accept ") \ - EM(rxrpc_call_see_activate_client, "SEE act-clnt") \ -+ EM(rxrpc_call_see_already_released, "SEE alrdy-rl") \ - EM(rxrpc_call_see_connect_failed, "SEE con-fail") \ - EM(rxrpc_call_see_connected, "SEE connect ") \ - EM(rxrpc_call_see_conn_abort, "SEE conn-abt") \ -+ EM(rxrpc_call_see_discard, "SEE discard ") \ - EM(rxrpc_call_see_disconnected, "SEE disconn ") \ - EM(rxrpc_call_see_distribute_error, "SEE dist-err") \ - EM(rxrpc_call_see_input, "SEE input ") \ -+ EM(rxrpc_call_see_recvmsg, "SEE recvmsg ") \ - EM(rxrpc_call_see_release, "SEE release ") \ - EM(rxrpc_call_see_userid_exists, "SEE u-exists") \ - EM(rxrpc_call_see_waiting_call, "SEE q-conn ") \ -diff --git a/io_uring/net.c b/io_uring/net.c -index 4948a67bbac480..e455f051e62ef7 100644 ---- a/io_uring/net.c -+++ b/io_uring/net.c -@@ -1537,9 +1537,11 @@ int io_connect(struct io_kiocb *req, unsigned int issue_flags) - io = &__io; - } - -- if (unlikely(req->flags & REQ_F_FAIL)) { -- ret = -ECONNRESET; -- goto out; -+ if (connect->in_progress) { -+ struct poll_table_struct pt = { ._key = EPOLLERR }; -+ -+ if (vfs_poll(req->file, &pt) & EPOLLERR) -+ goto get_sock_err; - } - - file_flags = force_nonblock ? O_NONBLOCK : 0; -@@ -1571,8 +1573,10 @@ int io_connect(struct io_kiocb *req, unsigned int issue_flags) - * which means the previous result is good. For both of these, - * grab the sock_error() and use that for the completion. - */ -- if (ret == -EBADFD || ret == -EISCONN) -+ if (ret == -EBADFD || ret == -EISCONN) { -+get_sock_err: - ret = sock_error(sock_from_file(req->file)->sk); -+ } - } - if (ret == -ERESTARTSYS) - ret = -EINTR; -diff --git a/io_uring/poll.c b/io_uring/poll.c -index 2390bf5f1710b4..65935ec8de89c4 100644 ---- a/io_uring/poll.c -+++ b/io_uring/poll.c -@@ -308,8 +308,6 @@ static int io_poll_check_events(struct io_kiocb *req, struct io_tw_state *ts) - return IOU_POLL_REISSUE; - } - } -- if (unlikely(req->cqe.res & EPOLLERR)) -- req_set_fail(req); - if (req->apoll_events & EPOLLONESHOT) - return IOU_POLL_DONE; - -diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c -index 8f0b62b04deebe..4b20a72ab8cffe 100644 ---- a/kernel/bpf/helpers.c -+++ b/kernel/bpf/helpers.c -@@ -885,6 +885,13 @@ int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args, - if (fmt[i] == 'p') { - sizeof_cur_arg = sizeof(long); - -+ if (fmt[i + 1] == 0 || isspace(fmt[i + 1]) || -+ ispunct(fmt[i + 1])) { -+ if (tmp_buf) -+ cur_arg = raw_args[num_spec]; -+ goto nocopy_fmt; -+ } -+ - if ((fmt[i + 1] == 'k' || fmt[i + 1] == 'u') && - fmt[i + 2] == 's') { - fmt_ptype = fmt[i + 1]; -@@ -892,11 +899,9 @@ int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args, - goto fmt_str; - } - -- if (fmt[i + 1] == 0 || isspace(fmt[i + 1]) || -- ispunct(fmt[i + 1]) || fmt[i + 1] == 'K' || -+ if (fmt[i + 1] == 'K' || - fmt[i + 1] == 'x' || fmt[i + 1] == 's' || - fmt[i + 1] == 'S') { -- /* just kernel pointers */ - if (tmp_buf) - cur_arg = raw_args[num_spec]; - i++; -diff --git a/kernel/cgroup/legacy_freezer.c b/kernel/cgroup/legacy_freezer.c -index a3e13e6d5ee40d..bee2f9ea5e4aec 100644 ---- a/kernel/cgroup/legacy_freezer.c -+++ b/kernel/cgroup/legacy_freezer.c -@@ -66,15 +66,9 @@ static struct freezer *parent_freezer(struct freezer *freezer) - bool cgroup_freezing(struct task_struct *task) - { - bool ret; -- unsigned int state; - - rcu_read_lock(); -- /* Check if the cgroup is still FREEZING, but not FROZEN. The extra -- * !FROZEN check is required, because the FREEZING bit is not cleared -- * when the state FROZEN is reached. -- */ -- state = task_freezer(task)->state; -- ret = (state & CGROUP_FREEZING) && !(state & CGROUP_FROZEN); -+ ret = task_freezer(task)->state & CGROUP_FREEZING; - rcu_read_unlock(); - - return ret; -diff --git a/kernel/sched/loadavg.c b/kernel/sched/loadavg.c -index 52c8f8226b0d35..35537ea03fff0d 100644 ---- a/kernel/sched/loadavg.c -+++ b/kernel/sched/loadavg.c -@@ -80,7 +80,7 @@ long calc_load_fold_active(struct rq *this_rq, long adjust) - long nr_active, delta = 0; - - nr_active = this_rq->nr_running - adjust; -- nr_active += (int)this_rq->nr_uninterruptible; -+ nr_active += (long)this_rq->nr_uninterruptible; - - if (nr_active != this_rq->calc_load_active) { - delta = nr_active - this_rq->calc_load_active; -diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h -index 60dc51f43dd91f..f7cb505ab337a5 100644 ---- a/kernel/sched/sched.h -+++ b/kernel/sched/sched.h -@@ -1011,7 +1011,7 @@ struct rq { - * one CPU and if it got migrated afterwards it may decrease - * it on another CPU. Always updated under the runqueue lock: - */ -- unsigned int nr_uninterruptible; -+ unsigned long nr_uninterruptible; - - struct task_struct __rcu *curr; - struct task_struct *idle; -diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c -index 5f74e9f9c8a734..7b3c55bb0235a7 100644 ---- a/kernel/trace/trace_events.c -+++ b/kernel/trace/trace_events.c -@@ -2845,7 +2845,10 @@ __register_event(struct trace_event_call *call, struct module *mod) - if (ret < 0) - return ret; - -+ down_write(&trace_event_sem); - list_add(&call->list, &ftrace_events); -+ up_write(&trace_event_sem); -+ - if (call->flags & TRACE_EVENT_FL_DYNAMIC) - atomic_set(&call->refcnt, 0); - else -@@ -3437,6 +3440,8 @@ __trace_add_event_dirs(struct trace_array *tr) - struct trace_event_call *call; - int ret; - -+ lockdep_assert_held(&trace_event_sem); -+ - list_for_each_entry(call, &ftrace_events, list) { - ret = __trace_add_new_event(call, tr); - if (ret < 0) -diff --git a/kernel/trace/trace_osnoise.c b/kernel/trace/trace_osnoise.c -index 5bd781359d38b0..4d12d02965a4b7 100644 ---- a/kernel/trace/trace_osnoise.c -+++ b/kernel/trace/trace_osnoise.c -@@ -665,8 +665,8 @@ __timerlat_dump_stack(struct trace_buffer *buffer, struct trace_stack *fstack, u - - entry = ring_buffer_event_data(event); - -- memcpy(&entry->caller, fstack->calls, size); - entry->size = fstack->nr_entries; -+ memcpy(&entry->caller, fstack->calls, size); - - if (!call_filter_check_discard(call, entry, buffer, event)) - trace_buffer_unlock_commit_nostack(buffer, event); -diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c -index 694f32d843d90c..187b1fc403c13d 100644 ---- a/kernel/trace/trace_probe.c -+++ b/kernel/trace/trace_probe.c -@@ -656,7 +656,7 @@ static int parse_btf_arg(char *varname, - ret = query_btf_context(ctx); - if (ret < 0 || ctx->nr_params == 0) { - trace_probe_log_err(ctx->offset, NO_BTF_ENTRY); -- return PTR_ERR(params); -+ return -ENOENT; - } - } - params = ctx->params; -diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c -index b477ba37a6991f..422f726346ea51 100644 ---- a/net/8021q/vlan.c -+++ b/net/8021q/vlan.c -@@ -358,6 +358,35 @@ static int __vlan_device_event(struct net_device *dev, unsigned long event) - return err; - } - -+static void vlan_vid0_add(struct net_device *dev) -+{ -+ struct vlan_info *vlan_info; -+ int err; -+ -+ if (!(dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)) -+ return; -+ -+ pr_info("adding VLAN 0 to HW filter on device %s\n", dev->name); -+ -+ err = vlan_vid_add(dev, htons(ETH_P_8021Q), 0); -+ if (err) -+ return; -+ -+ vlan_info = rtnl_dereference(dev->vlan_info); -+ vlan_info->auto_vid0 = true; -+} -+ -+static void vlan_vid0_del(struct net_device *dev) -+{ -+ struct vlan_info *vlan_info = rtnl_dereference(dev->vlan_info); -+ -+ if (!vlan_info || !vlan_info->auto_vid0) -+ return; -+ -+ vlan_info->auto_vid0 = false; -+ vlan_vid_del(dev, htons(ETH_P_8021Q), 0); -+} -+ - static int vlan_device_event(struct notifier_block *unused, unsigned long event, - void *ptr) - { -@@ -379,15 +408,10 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event, - return notifier_from_errno(err); - } - -- if ((event == NETDEV_UP) && -- (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)) { -- pr_info("adding VLAN 0 to HW filter on device %s\n", -- dev->name); -- vlan_vid_add(dev, htons(ETH_P_8021Q), 0); -- } -- if (event == NETDEV_DOWN && -- (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)) -- vlan_vid_del(dev, htons(ETH_P_8021Q), 0); -+ if (event == NETDEV_UP) -+ vlan_vid0_add(dev); -+ else if (event == NETDEV_DOWN) -+ vlan_vid0_del(dev); - - vlan_info = rtnl_dereference(dev->vlan_info); - if (!vlan_info) -diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h -index 5eaf38875554b0..c7ffe591d59366 100644 ---- a/net/8021q/vlan.h -+++ b/net/8021q/vlan.h -@@ -33,6 +33,7 @@ struct vlan_info { - struct vlan_group grp; - struct list_head vid_list; - unsigned int nr_vids; -+ bool auto_vid0; - struct rcu_head rcu; - }; - -diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c -index e1df1c62017d91..01aca077071174 100644 ---- a/net/bluetooth/hci_sync.c -+++ b/net/bluetooth/hci_sync.c -@@ -6796,8 +6796,8 @@ int hci_get_random_address(struct hci_dev *hdev, bool require_privacy, - return 0; - } - -- /* No privacy so use a public address. */ -- *own_addr_type = ADDR_LE_DEV_PUBLIC; -+ /* No privacy, use the current address */ -+ hci_copy_identity_address(hdev, rand_addr, own_addr_type); - - return 0; - } -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index f9995a405e35c3..dabc07700197c5 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -3485,12 +3485,28 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data - /* Configure output options and let the other side know - * which ones we don't like. */ - -- /* If MTU is not provided in configure request, use the most recently -- * explicitly or implicitly accepted value for the other direction, -- * or the default value. -+ /* If MTU is not provided in configure request, try adjusting it -+ * to the current output MTU if it has been set -+ * -+ * Bluetooth Core 6.1, Vol 3, Part A, Section 4.5 -+ * -+ * Each configuration parameter value (if any is present) in an -+ * L2CAP_CONFIGURATION_RSP packet reflects an ‘adjustment’ to a -+ * configuration parameter value that has been sent (or, in case -+ * of default values, implied) in the corresponding -+ * L2CAP_CONFIGURATION_REQ packet. - */ -- if (mtu == 0) -- mtu = chan->imtu ? chan->imtu : L2CAP_DEFAULT_MTU; -+ if (!mtu) { -+ /* Only adjust for ERTM channels as for older modes the -+ * remote stack may not be able to detect that the -+ * adjustment causing it to silently drop packets. -+ */ -+ if (chan->mode == L2CAP_MODE_ERTM && -+ chan->omtu && chan->omtu != L2CAP_DEFAULT_MTU) -+ mtu = chan->omtu; -+ else -+ mtu = L2CAP_DEFAULT_MTU; -+ } - - if (mtu < L2CAP_DEFAULT_MIN_MTU) - result = L2CAP_CONF_UNACCEPT; -diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c -index aaaaf9733b5894..9a906977c8723c 100644 ---- a/net/bluetooth/l2cap_sock.c -+++ b/net/bluetooth/l2cap_sock.c -@@ -1687,6 +1687,9 @@ static void l2cap_sock_resume_cb(struct l2cap_chan *chan) - { - struct sock *sk = chan->data; - -+ if (!sk) -+ return; -+ - if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) { - sk->sk_state = BT_CONNECTED; - chan->state = BT_CONNECTED; -diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c -index 56f7f041c9a604..4c00bc50de811e 100644 ---- a/net/bluetooth/smp.c -+++ b/net/bluetooth/smp.c -@@ -1380,7 +1380,7 @@ static void smp_timeout(struct work_struct *work) - - bt_dev_dbg(conn->hcon->hdev, "conn %p", conn); - -- hci_disconnect(conn->hcon, HCI_ERROR_REMOTE_USER_TERM); -+ hci_disconnect(conn->hcon, HCI_ERROR_AUTH_FAILURE); - } - - static struct smp_chan *smp_chan_create(struct l2cap_conn *conn) -@@ -2978,8 +2978,25 @@ static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb) - if (code > SMP_CMD_MAX) - goto drop; - -- if (smp && !test_and_clear_bit(code, &smp->allow_cmd)) -+ if (smp && !test_and_clear_bit(code, &smp->allow_cmd)) { -+ /* If there is a context and the command is not allowed consider -+ * it a failure so the session is cleanup properly. -+ */ -+ switch (code) { -+ case SMP_CMD_IDENT_INFO: -+ case SMP_CMD_IDENT_ADDR_INFO: -+ case SMP_CMD_SIGN_INFO: -+ /* 3.6.1. Key distribution and generation -+ * -+ * A device may reject a distributed key by sending the -+ * Pairing Failed command with the reason set to -+ * "Key Rejected". -+ */ -+ smp_failure(conn, SMP_KEY_REJECTED); -+ break; -+ } - goto drop; -+ } - - /* If we don't have a context the only allowed commands are - * pairing request and security request. -diff --git a/net/bluetooth/smp.h b/net/bluetooth/smp.h -index 87a59ec2c9f02b..c5da53dfab04f2 100644 ---- a/net/bluetooth/smp.h -+++ b/net/bluetooth/smp.h -@@ -138,6 +138,7 @@ struct smp_cmd_keypress_notify { - #define SMP_NUMERIC_COMP_FAILED 0x0c - #define SMP_BREDR_PAIRING_IN_PROGRESS 0x0d - #define SMP_CROSS_TRANSP_NOT_ALLOWED 0x0e -+#define SMP_KEY_REJECTED 0x0f - - #define SMP_MIN_ENC_KEY_SIZE 7 - #define SMP_MAX_ENC_KEY_SIZE 16 -diff --git a/net/bridge/br_switchdev.c b/net/bridge/br_switchdev.c -index 7b41ee8740cbba..f10bd6a233dcf9 100644 ---- a/net/bridge/br_switchdev.c -+++ b/net/bridge/br_switchdev.c -@@ -17,6 +17,9 @@ static bool nbp_switchdev_can_offload_tx_fwd(const struct net_bridge_port *p, - if (!static_branch_unlikely(&br_switchdev_tx_fwd_offload)) - return false; - -+ if (br_multicast_igmp_type(skb)) -+ return false; -+ - return (p->flags & BR_TX_FWD_OFFLOAD) && - (p->hwdom != BR_INPUT_SKB_CB(skb)->src_hwdom); - } -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 74f7f3e8d96083..f6188bd9f55ba6 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -7383,7 +7383,8 @@ int __init addrconf_init(void) - if (err < 0) - goto out_addrlabel; - -- addrconf_wq = create_workqueue("ipv6_addrconf"); -+ /* All works using addrconf_wq need to lock rtnl. */ -+ addrconf_wq = create_singlethread_workqueue("ipv6_addrconf"); - if (!addrconf_wq) { - err = -ENOMEM; - goto out_nowq; -diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c -index 9bb246c09fcee8..e153dac47a530d 100644 ---- a/net/ipv6/mcast.c -+++ b/net/ipv6/mcast.c -@@ -803,8 +803,8 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im) - } else { - im->mca_crcount = idev->mc_qrv; - } -- in6_dev_put(pmc->idev); - ip6_mc_clear_src(pmc); -+ in6_dev_put(pmc->idev); - kfree_rcu(pmc, rcu); - } - } -diff --git a/net/ipv6/rpl_iptunnel.c b/net/ipv6/rpl_iptunnel.c -index 28fc7fae579723..523aa8c9b382fe 100644 ---- a/net/ipv6/rpl_iptunnel.c -+++ b/net/ipv6/rpl_iptunnel.c -@@ -129,13 +129,13 @@ static int rpl_do_srh_inline(struct sk_buff *skb, const struct rpl_lwt *rlwt, - struct dst_entry *cache_dst) - { - struct ipv6_rpl_sr_hdr *isrh, *csrh; -- const struct ipv6hdr *oldhdr; -+ struct ipv6hdr oldhdr; - struct ipv6hdr *hdr; - unsigned char *buf; - size_t hdrlen; - int err; - -- oldhdr = ipv6_hdr(skb); -+ memcpy(&oldhdr, ipv6_hdr(skb), sizeof(oldhdr)); - - buf = kcalloc(struct_size(srh, segments.addr, srh->segments_left), 2, GFP_ATOMIC); - if (!buf) -@@ -147,7 +147,7 @@ static int rpl_do_srh_inline(struct sk_buff *skb, const struct rpl_lwt *rlwt, - memcpy(isrh, srh, sizeof(*isrh)); - memcpy(isrh->rpl_segaddr, &srh->rpl_segaddr[1], - (srh->segments_left - 1) * 16); -- isrh->rpl_segaddr[srh->segments_left - 1] = oldhdr->daddr; -+ isrh->rpl_segaddr[srh->segments_left - 1] = oldhdr.daddr; - - ipv6_rpl_srh_compress(csrh, isrh, &srh->rpl_segaddr[0], - isrh->segments_left - 1); -@@ -169,7 +169,7 @@ static int rpl_do_srh_inline(struct sk_buff *skb, const struct rpl_lwt *rlwt, - skb_mac_header_rebuild(skb); - - hdr = ipv6_hdr(skb); -- memmove(hdr, oldhdr, sizeof(*hdr)); -+ memmove(hdr, &oldhdr, sizeof(*hdr)); - isrh = (void *)hdr + sizeof(*hdr); - memcpy(isrh, csrh, hdrlen); - -diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c -index 34ad5975fbf3ba..0081c1a0d5e563 100644 ---- a/net/netfilter/nf_conntrack_core.c -+++ b/net/netfilter/nf_conntrack_core.c -@@ -1075,6 +1075,12 @@ static int nf_ct_resolve_clash_harder(struct sk_buff *skb, u32 repl_idx) - - hlist_nulls_add_head_rcu(&loser_ct->tuplehash[IP_CT_DIR_REPLY].hnnode, - &nf_conntrack_hash[repl_idx]); -+ /* confirmed bit must be set after hlist add, not before: -+ * loser_ct can still be visible to other cpu due to -+ * SLAB_TYPESAFE_BY_RCU. -+ */ -+ smp_mb__before_atomic(); -+ set_bit(IPS_CONFIRMED_BIT, &loser_ct->status); - - NF_CT_STAT_INC(net, clash_resolve); - return NF_ACCEPT; -@@ -1211,8 +1217,6 @@ __nf_conntrack_confirm(struct sk_buff *skb) - * user context, else we insert an already 'dead' hash, blocking - * further use of that particular connection -JM. - */ -- ct->status |= IPS_CONFIRMED; -- - if (unlikely(nf_ct_is_dying(ct))) { - NF_CT_STAT_INC(net, insert_failed); - goto dying; -@@ -1244,7 +1248,7 @@ __nf_conntrack_confirm(struct sk_buff *skb) - } - } - -- /* Timer relative to confirmation time, not original -+ /* Timeout is relative to confirmation time, not original - setting time, otherwise we'd get timer wrap in - weird delay cases. */ - ct->timeout += nfct_time_stamp; -@@ -1252,11 +1256,21 @@ __nf_conntrack_confirm(struct sk_buff *skb) - __nf_conntrack_insert_prepare(ct); - - /* Since the lookup is lockless, hash insertion must be done after -- * starting the timer and setting the CONFIRMED bit. The RCU barriers -- * guarantee that no other CPU can find the conntrack before the above -- * stores are visible. -+ * setting ct->timeout. The RCU barriers guarantee that no other CPU -+ * can find the conntrack before the above stores are visible. - */ - __nf_conntrack_hash_insert(ct, hash, reply_hash); -+ -+ /* IPS_CONFIRMED unset means 'ct not (yet) in hash', conntrack lookups -+ * skip entries that lack this bit. This happens when a CPU is looking -+ * at a stale entry that is being recycled due to SLAB_TYPESAFE_BY_RCU -+ * or when another CPU encounters this entry right after the insertion -+ * but before the set-confirm-bit below. This bit must not be set until -+ * after __nf_conntrack_hash_insert(). -+ */ -+ smp_mb__before_atomic(); -+ set_bit(IPS_CONFIRMED_BIT, &ct->status); -+ - nf_conntrack_double_unlock(hash, reply_hash); - local_bh_enable(); - -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 4abf7e9ac4f2f7..9cac7cb78c0f54 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -2791,7 +2791,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) - int len_sum = 0; - int status = TP_STATUS_AVAILABLE; - int hlen, tlen, copylen = 0; -- long timeo = 0; -+ long timeo; - - mutex_lock(&po->pg_vec_lock); - -@@ -2845,22 +2845,28 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) - if ((size_max > dev->mtu + reserve + VLAN_HLEN) && !vnet_hdr_sz) - size_max = dev->mtu + reserve + VLAN_HLEN; - -+ timeo = sock_sndtimeo(&po->sk, msg->msg_flags & MSG_DONTWAIT); - reinit_completion(&po->skb_completion); - - do { - ph = packet_current_frame(po, &po->tx_ring, - TP_STATUS_SEND_REQUEST); - if (unlikely(ph == NULL)) { -- if (need_wait && skb) { -- timeo = sock_sndtimeo(&po->sk, msg->msg_flags & MSG_DONTWAIT); -+ /* Note: packet_read_pending() might be slow if we -+ * have to call it as it's per_cpu variable, but in -+ * fast-path we don't have to call it, only when ph -+ * is NULL, we need to check the pending_refcnt. -+ */ -+ if (need_wait && packet_read_pending(&po->tx_ring)) { - timeo = wait_for_completion_interruptible_timeout(&po->skb_completion, timeo); - if (timeo <= 0) { - err = !timeo ? -ETIMEDOUT : -ERESTARTSYS; - goto out_put; - } -- } -- /* check for additional frames */ -- continue; -+ /* check for additional frames */ -+ continue; -+ } else -+ break; - } - - skb = NULL; -@@ -2949,14 +2955,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) - } - packet_increment_head(&po->tx_ring); - len_sum += tp_len; -- } while (likely((ph != NULL) || -- /* Note: packet_read_pending() might be slow if we have -- * to call it as it's per_cpu variable, but in fast-path -- * we already short-circuit the loop with the first -- * condition, and luckily don't have to go that path -- * anyway. -- */ -- (need_wait && packet_read_pending(&po->tx_ring)))); -+ } while (1); - - err = len_sum; - goto out_put; -diff --git a/net/phonet/pep.c b/net/phonet/pep.c -index 3dd5f52bc1b58e..e14b2b2d3b5cd7 100644 ---- a/net/phonet/pep.c -+++ b/net/phonet/pep.c -@@ -826,6 +826,7 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp, - } - - /* Check for duplicate pipe handle */ -+ pn_skb_get_dst_sockaddr(skb, &dst); - newsk = pep_find_pipe(&pn->hlist, &dst, pipe_handle); - if (unlikely(newsk)) { - __sock_put(newsk); -@@ -850,7 +851,6 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp, - newsk->sk_destruct = pipe_destruct; - - newpn = pep_sk(newsk); -- pn_skb_get_dst_sockaddr(skb, &dst); - pn_skb_get_src_sockaddr(skb, &src); - newpn->pn_sk.sobject = pn_sockaddr_get_object(&dst); - newpn->pn_sk.dobject = pn_sockaddr_get_object(&src); -diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c -index 773bdb2e37dafd..37ac8a66567866 100644 ---- a/net/rxrpc/call_accept.c -+++ b/net/rxrpc/call_accept.c -@@ -219,6 +219,7 @@ void rxrpc_discard_prealloc(struct rxrpc_sock *rx) - tail = b->call_backlog_tail; - while (CIRC_CNT(head, tail, size) > 0) { - struct rxrpc_call *call = b->call_backlog[tail]; -+ rxrpc_see_call(call, rxrpc_call_see_discard); - rcu_assign_pointer(call->socket, rx); - if (rx->discard_new_call) { - _debug("discard %lx", call->user_call_ID); -diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c -index cad6a7d18e0405..4bbb27a48bd8ae 100644 ---- a/net/rxrpc/output.c -+++ b/net/rxrpc/output.c -@@ -589,6 +589,9 @@ void rxrpc_reject_packet(struct rxrpc_local *local, struct sk_buff *skb) - __be32 code; - int ret, ioc; - -+ if (sp->hdr.type == RXRPC_PACKET_TYPE_ABORT) -+ return; /* Never abort an abort. */ -+ - rxrpc_see_skb(skb, rxrpc_skb_see_reject); - - iov[0].iov_base = &whdr; -diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c -index a482f88c5fc5b6..e24a44bae9a32c 100644 ---- a/net/rxrpc/recvmsg.c -+++ b/net/rxrpc/recvmsg.c -@@ -351,6 +351,16 @@ int rxrpc_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, - goto try_again; - } - -+ rxrpc_see_call(call, rxrpc_call_see_recvmsg); -+ if (test_bit(RXRPC_CALL_RELEASED, &call->flags)) { -+ rxrpc_see_call(call, rxrpc_call_see_already_released); -+ list_del_init(&call->recvmsg_link); -+ spin_unlock_irq(&rx->recvmsg_lock); -+ release_sock(&rx->sk); -+ trace_rxrpc_recvmsg(call->debug_id, rxrpc_recvmsg_unqueue, 0); -+ rxrpc_put_call(call, rxrpc_call_put_recvmsg); -+ goto try_again; -+ } - if (!(flags & MSG_PEEK)) - list_del_init(&call->recvmsg_link); - else -@@ -374,8 +384,13 @@ int rxrpc_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, - - release_sock(&rx->sk); - -- if (test_bit(RXRPC_CALL_RELEASED, &call->flags)) -- BUG(); -+ if (test_bit(RXRPC_CALL_RELEASED, &call->flags)) { -+ rxrpc_see_call(call, rxrpc_call_see_already_released); -+ mutex_unlock(&call->user_mutex); -+ if (!(flags & MSG_PEEK)) -+ rxrpc_put_call(call, rxrpc_call_put_recvmsg); -+ goto try_again; -+ } - - if (test_bit(RXRPC_CALL_HAS_USERID, &call->flags)) { - if (flags & MSG_CMSG_COMPAT) { -diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c -index 716da8c6b3def3..113b305b0d154c 100644 ---- a/net/sched/sch_htb.c -+++ b/net/sched/sch_htb.c -@@ -821,7 +821,9 @@ static struct htb_class *htb_lookup_leaf(struct htb_prio *hprio, const int prio) - u32 *pid; - } stk[TC_HTB_MAXDEPTH], *sp = stk; - -- BUG_ON(!hprio->row.rb_node); -+ if (unlikely(!hprio->row.rb_node)) -+ return NULL; -+ - sp->root = hprio->row.rb_node; - sp->pptr = &hprio->ptr; - sp->pid = &hprio->last_ptr_id; -diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c -index 5e557b960bde33..a2b321fec13c1d 100644 ---- a/net/sched/sch_qfq.c -+++ b/net/sched/sch_qfq.c -@@ -412,7 +412,7 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, - bool existing = false; - struct nlattr *tb[TCA_QFQ_MAX + 1]; - struct qfq_aggregate *new_agg = NULL; -- u32 weight, lmax, inv_w; -+ u32 weight, lmax, inv_w, old_weight, old_lmax; - int err; - int delta_w; - -@@ -446,12 +446,16 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, - inv_w = ONE_FP / weight; - weight = ONE_FP / inv_w; - -- if (cl != NULL && -- lmax == cl->agg->lmax && -- weight == cl->agg->class_weight) -- return 0; /* nothing to change */ -+ if (cl != NULL) { -+ sch_tree_lock(sch); -+ old_weight = cl->agg->class_weight; -+ old_lmax = cl->agg->lmax; -+ sch_tree_unlock(sch); -+ if (lmax == old_lmax && weight == old_weight) -+ return 0; /* nothing to change */ -+ } - -- delta_w = weight - (cl ? cl->agg->class_weight : 0); -+ delta_w = weight - (cl ? old_weight : 0); - - if (q->wsum + delta_w > QFQ_MAX_WSUM) { - NL_SET_ERR_MSG_FMT_MOD(extack, -@@ -558,10 +562,10 @@ static int qfq_delete_class(struct Qdisc *sch, unsigned long arg, - - qdisc_purge_queue(cl->qdisc); - qdisc_class_hash_remove(&q->clhash, &cl->common); -+ qfq_destroy_class(sch, cl); - - sch_tree_unlock(sch); - -- qfq_destroy_class(sch, cl); - return 0; - } - -@@ -628,6 +632,7 @@ static int qfq_dump_class(struct Qdisc *sch, unsigned long arg, - { - struct qfq_class *cl = (struct qfq_class *)arg; - struct nlattr *nest; -+ u32 class_weight, lmax; - - tcm->tcm_parent = TC_H_ROOT; - tcm->tcm_handle = cl->common.classid; -@@ -636,8 +641,13 @@ static int qfq_dump_class(struct Qdisc *sch, unsigned long arg, - nest = nla_nest_start_noflag(skb, TCA_OPTIONS); - if (nest == NULL) - goto nla_put_failure; -- if (nla_put_u32(skb, TCA_QFQ_WEIGHT, cl->agg->class_weight) || -- nla_put_u32(skb, TCA_QFQ_LMAX, cl->agg->lmax)) -+ -+ sch_tree_lock(sch); -+ class_weight = cl->agg->class_weight; -+ lmax = cl->agg->lmax; -+ sch_tree_unlock(sch); -+ if (nla_put_u32(skb, TCA_QFQ_WEIGHT, class_weight) || -+ nla_put_u32(skb, TCA_QFQ_LMAX, lmax)) - goto nla_put_failure; - return nla_nest_end(skb, nest); - -@@ -654,8 +664,10 @@ static int qfq_dump_class_stats(struct Qdisc *sch, unsigned long arg, - - memset(&xstats, 0, sizeof(xstats)); - -+ sch_tree_lock(sch); - xstats.weight = cl->agg->class_weight; - xstats.lmax = cl->agg->lmax; -+ sch_tree_unlock(sch); - - if (gnet_stats_copy_basic(d, NULL, &cl->bstats, true) < 0 || - gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 || -diff --git a/net/tls/tls_strp.c b/net/tls/tls_strp.c -index 1852fac3e72b76..bea60b0160d1fc 100644 ---- a/net/tls/tls_strp.c -+++ b/net/tls/tls_strp.c -@@ -511,9 +511,8 @@ static int tls_strp_read_sock(struct tls_strparser *strp) - if (inq < strp->stm.full_len) - return tls_strp_read_copy(strp, true); - -+ tls_strp_load_anchor_with_queue(strp, inq); - if (!strp->stm.full_len) { -- tls_strp_load_anchor_with_queue(strp, inq); -- - sz = tls_rx_msg_size(strp, strp->anchor); - if (sz < 0) { - tls_strp_abort_strp(strp, sz); -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 1c2059e37fdab6..614784c0ba3188 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -10303,6 +10303,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW), - SND_PCI_QUIRK(0x1043, 0x1a63, "ASUS UX3405MA", ALC245_FIXUP_CS35L41_SPI_2), - SND_PCI_QUIRK(0x1043, 0x1a83, "ASUS UM5302LA", ALC294_FIXUP_CS35L41_I2C_2), -+ SND_PCI_QUIRK(0x1043, 0x1a8e, "ASUS G712LWS", ALC294_FIXUP_LENOVO_MIC_LOCATION), - SND_PCI_QUIRK(0x1043, 0x1a8f, "ASUS UX582ZS", ALC245_FIXUP_CS35L41_SPI_2), - SND_PCI_QUIRK(0x1043, 0x1b11, "ASUS UX431DA", ALC294_FIXUP_ASUS_COEF_1B), - SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC), -diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c -index aa15f56ca139d2..886f5c29939b8e 100644 ---- a/sound/soc/fsl/fsl_sai.c -+++ b/sound/soc/fsl/fsl_sai.c -@@ -762,13 +762,15 @@ static void fsl_sai_config_disable(struct fsl_sai *sai, int dir) - * anymore. Add software reset to fix this issue. - * This is a hardware bug, and will be fix in the - * next sai version. -+ * -+ * In consumer mode, this can happen even after a -+ * single open/close, especially if both tx and rx -+ * are running concurrently. - */ -- if (!sai->is_consumer_mode) { -- /* Software Reset */ -- regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR); -- /* Clear SR bit to finish the reset */ -- regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), 0); -- } -+ /* Software Reset */ -+ regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR); -+ /* Clear SR bit to finish the reset */ -+ regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), 0); - } - - static int fsl_sai_trigger(struct snd_pcm_substream *substream, int cmd, -diff --git a/tools/testing/selftests/bpf/prog_tests/dummy_st_ops.c b/tools/testing/selftests/bpf/prog_tests/dummy_st_ops.c -index d3d94596ab79cf..dd926c00f41469 100644 ---- a/tools/testing/selftests/bpf/prog_tests/dummy_st_ops.c -+++ b/tools/testing/selftests/bpf/prog_tests/dummy_st_ops.c -@@ -147,31 +147,6 @@ static void test_dummy_sleepable(void) - dummy_st_ops_success__destroy(skel); - } - --/* dummy_st_ops.test_sleepable() parameter is not marked as nullable, -- * thus bpf_prog_test_run_opts() below should be rejected as it tries -- * to pass NULL for this parameter. -- */ --static void test_dummy_sleepable_reject_null(void) --{ -- __u64 args[1] = {0}; -- LIBBPF_OPTS(bpf_test_run_opts, attr, -- .ctx_in = args, -- .ctx_size_in = sizeof(args), -- ); -- struct dummy_st_ops_success *skel; -- int fd, err; -- -- skel = dummy_st_ops_success__open_and_load(); -- if (!ASSERT_OK_PTR(skel, "dummy_st_ops_load")) -- return; -- -- fd = bpf_program__fd(skel->progs.test_sleepable); -- err = bpf_prog_test_run_opts(fd, &attr); -- ASSERT_EQ(err, -EINVAL, "test_run"); -- -- dummy_st_ops_success__destroy(skel); --} -- - void test_dummy_st_ops(void) - { - if (test__start_subtest("dummy_st_ops_attach")) -@@ -184,8 +159,6 @@ void test_dummy_st_ops(void) - test_dummy_multiple_args(); - if (test__start_subtest("dummy_sleepable")) - test_dummy_sleepable(); -- if (test__start_subtest("dummy_sleepable_reject_null")) -- test_dummy_sleepable_reject_null(); - - RUN_TESTS(dummy_st_ops_fail); - } -diff --git a/tools/testing/selftests/bpf/progs/dummy_st_ops_success.c b/tools/testing/selftests/bpf/progs/dummy_st_ops_success.c -index ec0c595d47af84..151e3a3ea27fb8 100644 ---- a/tools/testing/selftests/bpf/progs/dummy_st_ops_success.c -+++ b/tools/testing/selftests/bpf/progs/dummy_st_ops_success.c -@@ -11,17 +11,8 @@ int BPF_PROG(test_1, struct bpf_dummy_ops_state *state) - { - int ret; - -- /* Check that 'state' nullable status is detected correctly. -- * If 'state' argument would be assumed non-null by verifier -- * the code below would be deleted as dead (which it shouldn't). -- * Hide it from the compiler behind 'asm' block to avoid -- * unnecessary optimizations. -- */ -- asm volatile ( -- "if %[state] != 0 goto +2;" -- "r0 = 0xf2f3f4f5;" -- "exit;" -- ::[state]"p"(state)); -+ if (!state) -+ return 0xf2f3f4f5; - - ret = state->val; - state->val = 0x5a; -diff --git a/tools/testing/selftests/net/udpgro.sh b/tools/testing/selftests/net/udpgro.sh -index 53341c8135e889..b65cf09f9914e9 100755 ---- a/tools/testing/selftests/net/udpgro.sh -+++ b/tools/testing/selftests/net/udpgro.sh -@@ -50,7 +50,7 @@ run_one() { - - cfg_veth - -- ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 10 ${rx_args} & -+ ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 100 ${rx_args} & - local PID1=$! - - wait_local_port_listen ${PEER_NS} 8000 udp -@@ -97,7 +97,7 @@ run_one_nat() { - # will land on the 'plain' one - ip netns exec "${PEER_NS}" ./udpgso_bench_rx -G ${family} -b ${addr1} -n 0 & - local PID1=$! -- ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 10 ${family} -b ${addr2%/*} ${rx_args} & -+ ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 100 ${family} -b ${addr2%/*} ${rx_args} & - local PID2=$! - - wait_local_port_listen "${PEER_NS}" 8000 udp -@@ -119,9 +119,9 @@ run_one_2sock() { - - cfg_veth - -- ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 10 ${rx_args} -p 12345 & -+ ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 100 ${rx_args} -p 12345 & - local PID1=$! -- ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 2000 -R 10 ${rx_args} & -+ ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 2000 -R 100 ${rx_args} & - local PID2=$! - - wait_local_port_listen "${PEER_NS}" 12345 udp diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.100-101.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.100-101.patch deleted file mode 100644 index f553195502..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.100-101.patch +++ /dev/null @@ -1,3102 +0,0 @@ -diff --git a/Makefile b/Makefile -index 8d6550abc9cb2c..116eb523392a23 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 100 -+SUBLEVEL = 101 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm/Makefile b/arch/arm/Makefile -index 5ba42f69f8ce0c..351d0b039b5ca6 100644 ---- a/arch/arm/Makefile -+++ b/arch/arm/Makefile -@@ -142,7 +142,7 @@ endif - # Need -Uarm for gcc < 3.x - KBUILD_CPPFLAGS +=$(cpp-y) - KBUILD_CFLAGS +=$(CFLAGS_ABI) $(CFLAGS_ISA) $(arch-y) $(tune-y) $(call cc-option,-mshort-load-bytes,$(call cc-option,-malignment-traps,)) -msoft-float -Uarm --KBUILD_AFLAGS +=$(CFLAGS_ABI) $(AFLAGS_ISA) -Wa,$(arch-y) $(tune-y) -include asm/unified.h -msoft-float -+KBUILD_AFLAGS +=$(CFLAGS_ABI) $(AFLAGS_ISA) -Wa,$(arch-y) $(tune-y) -include $(srctree)/arch/arm/include/asm/unified.h -msoft-float - - CHECKFLAGS += -D__arm__ - -diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h -index 376a980f2bad08..0fa067c2324de9 100644 ---- a/arch/arm64/include/asm/assembler.h -+++ b/arch/arm64/include/asm/assembler.h -@@ -45,6 +45,11 @@ - /* - * Save/restore interrupts. - */ -+ .macro save_and_disable_daif, flags -+ mrs \flags, daif -+ msr daifset, #0xf -+ .endm -+ - .macro save_and_disable_irq, flags - mrs \flags, daif - msr daifset, #3 -diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c -index b6d381f743f3ec..2ce9ef9d924aac 100644 ---- a/arch/arm64/kernel/cpufeature.c -+++ b/arch/arm64/kernel/cpufeature.c -@@ -364,6 +364,7 @@ static const struct arm64_ftr_bits ftr_id_aa64mmfr0[] = { - }; - - static const struct arm64_ftr_bits ftr_id_aa64mmfr1[] = { -+ ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR1_EL1_ECBHB_SHIFT, 4, 0), - ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR1_EL1_TIDCP1_SHIFT, 4, 0), - ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR1_EL1_AFP_SHIFT, 4, 0), - ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR1_EL1_HCX_SHIFT, 4, 0), -diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S -index 7fcbee0f6c0e4e..60a3cf3da7181d 100644 ---- a/arch/arm64/kernel/entry.S -+++ b/arch/arm64/kernel/entry.S -@@ -824,6 +824,7 @@ SYM_CODE_END(__bp_harden_el1_vectors) - * - */ - SYM_FUNC_START(cpu_switch_to) -+ save_and_disable_daif x11 - mov x10, #THREAD_CPU_CONTEXT - add x8, x0, x10 - mov x9, sp -@@ -847,6 +848,7 @@ SYM_FUNC_START(cpu_switch_to) - ptrauth_keys_install_kernel x1, x8, x9, x10 - scs_save x0 - scs_load_current -+ restore_irq x11 - ret - SYM_FUNC_END(cpu_switch_to) - NOKPROBE(cpu_switch_to) -@@ -873,6 +875,7 @@ NOKPROBE(ret_from_fork) - * Calls func(regs) using this CPU's irq stack and shadow irq stack. - */ - SYM_FUNC_START(call_on_irq_stack) -+ save_and_disable_daif x9 - #ifdef CONFIG_SHADOW_CALL_STACK - get_current_task x16 - scs_save x16 -@@ -887,8 +890,10 @@ SYM_FUNC_START(call_on_irq_stack) - - /* Move to the new stack and call the function there */ - add sp, x16, #IRQ_STACK_SIZE -+ restore_irq x9 - blr x1 - -+ save_and_disable_daif x9 - /* - * Restore the SP from the FP, and restore the FP and LR from the frame - * record. -@@ -896,6 +901,7 @@ SYM_FUNC_START(call_on_irq_stack) - mov sp, x29 - ldp x29, x30, [sp], #16 - scs_load_current -+ restore_irq x9 - ret - SYM_FUNC_END(call_on_irq_stack) - NOKPROBE(call_on_irq_stack) -diff --git a/arch/powerpc/crypto/Kconfig b/arch/powerpc/crypto/Kconfig -index fccf742c55c2c3..5c1619f2518853 100644 ---- a/arch/powerpc/crypto/Kconfig -+++ b/arch/powerpc/crypto/Kconfig -@@ -129,6 +129,7 @@ config CRYPTO_CHACHA20_P10 - config CRYPTO_POLY1305_P10 - tristate "Hash functions: Poly1305 (P10 or later)" - depends on PPC64 && CPU_LITTLE_ENDIAN && VSX -+ depends on BROKEN # Needs to be fixed to work in softirq context - select CRYPTO_HASH - select CRYPTO_LIB_POLY1305_GENERIC - help -diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c -index 835c9febb6a854..87ea4339e03a28 100644 ---- a/arch/x86/events/intel/core.c -+++ b/arch/x86/events/intel/core.c -@@ -2734,7 +2734,7 @@ static void intel_pmu_read_event(struct perf_event *event) - if (pmu_enabled) - intel_pmu_disable_all(); - -- if (is_topdown_event(event)) -+ if (is_topdown_count(event)) - static_call(intel_pmu_update_topdown_event)(event); - else - intel_pmu_drain_pebs_buffer(); -diff --git a/arch/x86/hyperv/irqdomain.c b/arch/x86/hyperv/irqdomain.c -index 42c70d28ef272d..865ae4be233b37 100644 ---- a/arch/x86/hyperv/irqdomain.c -+++ b/arch/x86/hyperv/irqdomain.c -@@ -192,7 +192,6 @@ static void hv_irq_compose_msi_msg(struct irq_data *data, struct msi_msg *msg) - struct pci_dev *dev; - struct hv_interrupt_entry out_entry, *stored_entry; - struct irq_cfg *cfg = irqd_cfg(data); -- const cpumask_t *affinity; - int cpu; - u64 status; - -@@ -204,8 +203,7 @@ static void hv_irq_compose_msi_msg(struct irq_data *data, struct msi_msg *msg) - return; - } - -- affinity = irq_data_get_effective_affinity_mask(data); -- cpu = cpumask_first_and(affinity, cpu_online_mask); -+ cpu = cpumask_first(irq_data_get_effective_affinity_mask(data)); - - if (data->chip_data) { - /* -diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c -index 5fcdfbb792bd9f..864d62e9461418 100644 ---- a/arch/x86/kernel/cpu/amd.c -+++ b/arch/x86/kernel/cpu/amd.c -@@ -549,6 +549,8 @@ static bool amd_check_tsa_microcode(void) - p.model = c->x86_model; - p.ext_model = c->x86_model >> 4; - p.stepping = c->x86_stepping; -+ /* reserved bits are expected to be 0 in test below */ -+ p.__reserved = 0; - - if (cpu_has(c, X86_FEATURE_ZEN3) || - cpu_has(c, X86_FEATURE_ZEN4)) { -diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c -index 3011f7f9381b7f..1209e01f8c7f97 100644 ---- a/drivers/base/regmap/regmap.c -+++ b/drivers/base/regmap/regmap.c -@@ -1173,6 +1173,8 @@ struct regmap *__regmap_init(struct device *dev, - err_map: - kfree(map); - err: -+ if (bus && bus->free_on_exit) -+ kfree(bus); - return ERR_PTR(ret); - } - EXPORT_SYMBOL_GPL(__regmap_init); -diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c -index b405ee330af1fc..350e7b24ee2b09 100644 ---- a/drivers/bus/fsl-mc/fsl-mc-bus.c -+++ b/drivers/bus/fsl-mc/fsl-mc-bus.c -@@ -942,6 +942,7 @@ struct fsl_mc_device *fsl_mc_get_endpoint(struct fsl_mc_device *mc_dev, - struct fsl_mc_obj_desc endpoint_desc = {{ 0 }}; - struct dprc_endpoint endpoint1 = {{ 0 }}; - struct dprc_endpoint endpoint2 = {{ 0 }}; -+ struct fsl_mc_bus *mc_bus; - int state, err; - - mc_bus_dev = to_fsl_mc_device(mc_dev->dev.parent); -@@ -965,6 +966,8 @@ struct fsl_mc_device *fsl_mc_get_endpoint(struct fsl_mc_device *mc_dev, - strcpy(endpoint_desc.type, endpoint2.type); - endpoint_desc.id = endpoint2.id; - endpoint = fsl_mc_device_lookup(&endpoint_desc, mc_bus_dev); -+ if (endpoint) -+ return endpoint; - - /* - * We know that the device has an endpoint because we verified by -@@ -972,17 +975,13 @@ struct fsl_mc_device *fsl_mc_get_endpoint(struct fsl_mc_device *mc_dev, - * yet discovered by the fsl-mc bus, thus the lookup returned NULL. - * Force a rescan of the devices in this container and retry the lookup. - */ -- if (!endpoint) { -- struct fsl_mc_bus *mc_bus = to_fsl_mc_bus(mc_bus_dev); -- -- if (mutex_trylock(&mc_bus->scan_mutex)) { -- err = dprc_scan_objects(mc_bus_dev, true); -- mutex_unlock(&mc_bus->scan_mutex); -- } -- -- if (err < 0) -- return ERR_PTR(err); -+ mc_bus = to_fsl_mc_bus(mc_bus_dev); -+ if (mutex_trylock(&mc_bus->scan_mutex)) { -+ err = dprc_scan_objects(mc_bus_dev, true); -+ mutex_unlock(&mc_bus->scan_mutex); - } -+ if (err < 0) -+ return ERR_PTR(err); - - endpoint = fsl_mc_device_lookup(&endpoint_desc, mc_bus_dev); - /* -diff --git a/drivers/comedi/drivers/comedi_test.c b/drivers/comedi/drivers/comedi_test.c -index 05ae9122823f80..e713ef611434da 100644 ---- a/drivers/comedi/drivers/comedi_test.c -+++ b/drivers/comedi/drivers/comedi_test.c -@@ -790,7 +790,7 @@ static void waveform_detach(struct comedi_device *dev) - { - struct waveform_private *devpriv = dev->private; - -- if (devpriv) { -+ if (devpriv && dev->n_subdevices) { - del_timer_sync(&devpriv->ai_timer); - del_timer_sync(&devpriv->ao_timer); - } -diff --git a/drivers/crypto/intel/qat/qat_dh895xcc/adf_drv.c b/drivers/crypto/intel/qat/qat_dh895xcc/adf_drv.c -index 1e748e8ce12d5d..b68903212b6404 100644 ---- a/drivers/crypto/intel/qat/qat_dh895xcc/adf_drv.c -+++ b/drivers/crypto/intel/qat/qat_dh895xcc/adf_drv.c -@@ -27,12 +27,14 @@ MODULE_DEVICE_TABLE(pci, adf_pci_tbl); - - static int adf_probe(struct pci_dev *dev, const struct pci_device_id *ent); - static void adf_remove(struct pci_dev *dev); -+static void adf_shutdown(struct pci_dev *dev); - - static struct pci_driver adf_driver = { - .id_table = adf_pci_tbl, - .name = ADF_DH895XCC_DEVICE_NAME, - .probe = adf_probe, - .remove = adf_remove, -+ .shutdown = adf_shutdown, - .sriov_configure = adf_sriov_configure, - .err_handler = &adf_err_handler, - }; -@@ -227,6 +229,13 @@ static void adf_remove(struct pci_dev *pdev) - kfree(accel_dev); - } - -+static void adf_shutdown(struct pci_dev *pdev) -+{ -+ struct adf_accel_dev *accel_dev = adf_devmgr_pci_to_accel_dev(pdev); -+ -+ adf_dev_down(accel_dev, false); -+} -+ - static int __init adfdrv_init(void) - { - request_module("intel_qat"); -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c -index 6b7c6f45a80a86..b77b4723323164 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c -@@ -1130,13 +1130,12 @@ svm_range_split_head(struct svm_range *prange, - } - - static void --svm_range_add_child(struct svm_range *prange, struct mm_struct *mm, -- struct svm_range *pchild, enum svm_work_list_ops op) -+svm_range_add_child(struct svm_range *prange, struct svm_range *pchild, enum svm_work_list_ops op) - { - pr_debug("add child 0x%p [0x%lx 0x%lx] to prange 0x%p child list %d\n", - pchild, pchild->start, pchild->last, prange, op); - -- pchild->work_item.mm = mm; -+ pchild->work_item.mm = NULL; - pchild->work_item.op = op; - list_add_tail(&pchild->child_list, &prange->child_list); - } -@@ -1182,14 +1181,14 @@ svm_range_split_by_granularity(struct kfd_process *p, struct mm_struct *mm, - r = svm_range_split(prange, start, prange->last, &head); - if (r) - return r; -- svm_range_add_child(parent, mm, head, SVM_OP_ADD_RANGE); -+ svm_range_add_child(parent, head, SVM_OP_ADD_RANGE); - } - - if (last < prange->last) { - r = svm_range_split(prange, prange->start, last, &tail); - if (r) - return r; -- svm_range_add_child(parent, mm, tail, SVM_OP_ADD_RANGE); -+ svm_range_add_child(parent, tail, SVM_OP_ADD_RANGE); - } - - /* xnack on, update mapping on GPUs with ACCESS_IN_PLACE */ -@@ -2393,15 +2392,17 @@ svm_range_add_list_work(struct svm_range_list *svms, struct svm_range *prange, - prange->work_item.op != SVM_OP_UNMAP_RANGE) - prange->work_item.op = op; - } else { -- prange->work_item.op = op; -- -- /* Pairs with mmput in deferred_list_work */ -- mmget(mm); -- prange->work_item.mm = mm; -- list_add_tail(&prange->deferred_list, -- &prange->svms->deferred_range_list); -- pr_debug("add prange 0x%p [0x%lx 0x%lx] to work list op %d\n", -- prange, prange->start, prange->last, op); -+ /* Pairs with mmput in deferred_list_work. -+ * If process is exiting and mm is gone, don't update mmu notifier. -+ */ -+ if (mmget_not_zero(mm)) { -+ prange->work_item.mm = mm; -+ prange->work_item.op = op; -+ list_add_tail(&prange->deferred_list, -+ &prange->svms->deferred_range_list); -+ pr_debug("add prange 0x%p [0x%lx 0x%lx] to work list op %d\n", -+ prange, prange->start, prange->last, op); -+ } - } - spin_unlock(&svms->deferred_list_lock); - } -@@ -2415,8 +2416,7 @@ void schedule_deferred_list_work(struct svm_range_list *svms) - } - - static void --svm_range_unmap_split(struct mm_struct *mm, struct svm_range *parent, -- struct svm_range *prange, unsigned long start, -+svm_range_unmap_split(struct svm_range *parent, struct svm_range *prange, unsigned long start, - unsigned long last) - { - struct svm_range *head; -@@ -2437,12 +2437,12 @@ svm_range_unmap_split(struct mm_struct *mm, struct svm_range *parent, - svm_range_split(tail, last + 1, tail->last, &head); - - if (head != prange && tail != prange) { -- svm_range_add_child(parent, mm, head, SVM_OP_UNMAP_RANGE); -- svm_range_add_child(parent, mm, tail, SVM_OP_ADD_RANGE); -+ svm_range_add_child(parent, head, SVM_OP_UNMAP_RANGE); -+ svm_range_add_child(parent, tail, SVM_OP_ADD_RANGE); - } else if (tail != prange) { -- svm_range_add_child(parent, mm, tail, SVM_OP_UNMAP_RANGE); -+ svm_range_add_child(parent, tail, SVM_OP_UNMAP_RANGE); - } else if (head != prange) { -- svm_range_add_child(parent, mm, head, SVM_OP_UNMAP_RANGE); -+ svm_range_add_child(parent, head, SVM_OP_UNMAP_RANGE); - } else if (parent != prange) { - prange->work_item.op = SVM_OP_UNMAP_RANGE; - } -@@ -2481,14 +2481,14 @@ svm_range_unmap_from_cpu(struct mm_struct *mm, struct svm_range *prange, - l = min(last, pchild->last); - if (l >= s) - svm_range_unmap_from_gpus(pchild, s, l, trigger); -- svm_range_unmap_split(mm, prange, pchild, start, last); -+ svm_range_unmap_split(prange, pchild, start, last); - mutex_unlock(&pchild->lock); - } - s = max(start, prange->start); - l = min(last, prange->last); - if (l >= s) - svm_range_unmap_from_gpus(prange, s, l, trigger); -- svm_range_unmap_split(mm, prange, prange, start, last); -+ svm_range_unmap_split(prange, prange, start, last); - - if (unmap_parent) - svm_range_add_list_work(svms, prange, mm, SVM_OP_UNMAP_RANGE); -@@ -2531,8 +2531,6 @@ svm_range_cpu_invalidate_pagetables(struct mmu_interval_notifier *mni, - - if (range->event == MMU_NOTIFY_RELEASE) - return true; -- if (!mmget_not_zero(mni->mm)) -- return true; - - start = mni->interval_tree.start; - last = mni->interval_tree.last; -@@ -2559,7 +2557,6 @@ svm_range_cpu_invalidate_pagetables(struct mmu_interval_notifier *mni, - } - - svm_range_unlock(prange); -- mmput(mni->mm); - - return true; - } -diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c -index 002f8aaa509bc9..59cbff209acd6e 100644 ---- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c -+++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c -@@ -1352,7 +1352,7 @@ static int ti_sn_bridge_probe(struct auxiliary_device *adev, - regmap_update_bits(pdata->regmap, SN_HPD_DISABLE_REG, - HPD_DISABLE, 0); - mutex_unlock(&pdata->comms_mutex); -- }; -+ } - - drm_bridge_add(&pdata->bridge); - -diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c -index c8b6d0f79c9b41..9a894e234f6239 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp.c -+++ b/drivers/gpu/drm/i915/display/intel_dp.c -@@ -1293,6 +1293,12 @@ int intel_dp_rate_select(struct intel_dp *intel_dp, int rate) - void intel_dp_compute_rate(struct intel_dp *intel_dp, int port_clock, - u8 *link_bw, u8 *rate_select) - { -+ struct drm_i915_private *i915 = dp_to_i915(intel_dp); -+ -+ /* FIXME g4x can't generate an exact 2.7GHz with the 96MHz non-SSC refclk */ -+ if (IS_G4X(i915) && port_clock == 268800) -+ port_clock = 270000; -+ - /* eDP 1.4 rate select method. */ - if (intel_dp->use_rate_select) { - *link_bw = 0; -diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c -index eed3b8bed9e40f..245a1ef5278e88 100644 ---- a/drivers/gpu/drm/scheduler/sched_entity.c -+++ b/drivers/gpu/drm/scheduler/sched_entity.c -@@ -346,20 +346,9 @@ void drm_sched_entity_destroy(struct drm_sched_entity *entity) - } - EXPORT_SYMBOL(drm_sched_entity_destroy); - --/* drm_sched_entity_clear_dep - callback to clear the entities dependency */ --static void drm_sched_entity_clear_dep(struct dma_fence *f, -- struct dma_fence_cb *cb) --{ -- struct drm_sched_entity *entity = -- container_of(cb, struct drm_sched_entity, cb); -- -- entity->dependency = NULL; -- dma_fence_put(f); --} -- - /* -- * drm_sched_entity_clear_dep - callback to clear the entities dependency and -- * wake up scheduler -+ * drm_sched_entity_wakeup - callback to clear the entity's dependency and -+ * wake up the scheduler - */ - static void drm_sched_entity_wakeup(struct dma_fence *f, - struct dma_fence_cb *cb) -@@ -367,7 +356,8 @@ static void drm_sched_entity_wakeup(struct dma_fence *f, - struct drm_sched_entity *entity = - container_of(cb, struct drm_sched_entity, cb); - -- drm_sched_entity_clear_dep(f, cb); -+ entity->dependency = NULL; -+ dma_fence_put(f); - drm_sched_wakeup_if_can_queue(entity->rq->sched); - } - -@@ -420,13 +410,6 @@ static bool drm_sched_entity_add_dependency_cb(struct drm_sched_entity *entity) - fence = dma_fence_get(&s_fence->scheduled); - dma_fence_put(entity->dependency); - entity->dependency = fence; -- if (!dma_fence_add_callback(fence, &entity->cb, -- drm_sched_entity_clear_dep)) -- return true; -- -- /* Ignore it when it is already scheduled */ -- dma_fence_put(fence); -- return false; - } - - if (!dma_fence_add_callback(entity->dependency, &entity->cb, -diff --git a/drivers/i2c/busses/i2c-qup.c b/drivers/i2c/busses/i2c-qup.c -index ee92a315f074fe..f324f397356c2b 100644 ---- a/drivers/i2c/busses/i2c-qup.c -+++ b/drivers/i2c/busses/i2c-qup.c -@@ -452,8 +452,10 @@ static int qup_i2c_bus_active(struct qup_i2c_dev *qup, int len) - if (!(status & I2C_STATUS_BUS_ACTIVE)) - break; - -- if (time_after(jiffies, timeout)) -+ if (time_after(jiffies, timeout)) { - ret = -ETIMEDOUT; -+ break; -+ } - - usleep_range(len, len * 2); - } -diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c -index 08a81daedc115e..5766231b13cd17 100644 ---- a/drivers/i2c/busses/i2c-tegra.c -+++ b/drivers/i2c/busses/i2c-tegra.c -@@ -607,7 +607,6 @@ static int tegra_i2c_wait_for_config_load(struct tegra_i2c_dev *i2c_dev) - static int tegra_i2c_init(struct tegra_i2c_dev *i2c_dev) - { - u32 val, clk_divisor, clk_multiplier, tsu_thd, tlow, thigh, non_hs_mode; -- acpi_handle handle = ACPI_HANDLE(i2c_dev->dev); - struct i2c_timings *t = &i2c_dev->timings; - int err; - -@@ -619,11 +618,7 @@ static int tegra_i2c_init(struct tegra_i2c_dev *i2c_dev) - * emit a noisy warning on error, which won't stay unnoticed and - * won't hose machine entirely. - */ -- if (handle) -- err = acpi_evaluate_object(handle, "_RST", NULL, NULL); -- else -- err = reset_control_reset(i2c_dev->rst); -- -+ err = device_reset(i2c_dev->dev); - WARN_ON_ONCE(err); - - if (IS_DVC(i2c_dev)) -@@ -1668,19 +1663,6 @@ static void tegra_i2c_parse_dt(struct tegra_i2c_dev *i2c_dev) - i2c_dev->is_vi = true; - } - --static int tegra_i2c_init_reset(struct tegra_i2c_dev *i2c_dev) --{ -- if (ACPI_HANDLE(i2c_dev->dev)) -- return 0; -- -- i2c_dev->rst = devm_reset_control_get_exclusive(i2c_dev->dev, "i2c"); -- if (IS_ERR(i2c_dev->rst)) -- return dev_err_probe(i2c_dev->dev, PTR_ERR(i2c_dev->rst), -- "failed to get reset control\n"); -- -- return 0; --} -- - static int tegra_i2c_init_clocks(struct tegra_i2c_dev *i2c_dev) - { - int err; -@@ -1790,10 +1772,6 @@ static int tegra_i2c_probe(struct platform_device *pdev) - - tegra_i2c_parse_dt(i2c_dev); - -- err = tegra_i2c_init_reset(i2c_dev); -- if (err) -- return err; -- - err = tegra_i2c_init_clocks(i2c_dev); - if (err) - return err; -diff --git a/drivers/i2c/busses/i2c-virtio.c b/drivers/i2c/busses/i2c-virtio.c -index c60ae531ba57c7..726c162cabd868 100644 ---- a/drivers/i2c/busses/i2c-virtio.c -+++ b/drivers/i2c/busses/i2c-virtio.c -@@ -116,15 +116,16 @@ static int virtio_i2c_complete_reqs(struct virtqueue *vq, - for (i = 0; i < num; i++) { - struct virtio_i2c_req *req = &reqs[i]; - -- wait_for_completion(&req->completion); -- -- if (!failed && req->in_hdr.status != VIRTIO_I2C_MSG_OK) -- failed = true; -+ if (!failed) { -+ if (wait_for_completion_interruptible(&req->completion)) -+ failed = true; -+ else if (req->in_hdr.status != VIRTIO_I2C_MSG_OK) -+ failed = true; -+ else -+ j++; -+ } - - i2c_put_dma_safe_msg_buf(reqs[i].buf, &msgs[i], !failed); -- -- if (!failed) -- j++; - } - - return j; -diff --git a/drivers/iio/adc/ad7949.c b/drivers/iio/adc/ad7949.c -index edd0c3a35ab73c..202561cad4012b 100644 ---- a/drivers/iio/adc/ad7949.c -+++ b/drivers/iio/adc/ad7949.c -@@ -308,7 +308,6 @@ static void ad7949_disable_reg(void *reg) - - static int ad7949_spi_probe(struct spi_device *spi) - { -- u32 spi_ctrl_mask = spi->controller->bits_per_word_mask; - struct device *dev = &spi->dev; - const struct ad7949_adc_spec *spec; - struct ad7949_adc_chip *ad7949_adc; -@@ -337,11 +336,11 @@ static int ad7949_spi_probe(struct spi_device *spi) - ad7949_adc->resolution = spec->resolution; - - /* Set SPI bits per word */ -- if (spi_ctrl_mask & SPI_BPW_MASK(ad7949_adc->resolution)) { -+ if (spi_is_bpw_supported(spi, ad7949_adc->resolution)) { - spi->bits_per_word = ad7949_adc->resolution; -- } else if (spi_ctrl_mask == SPI_BPW_MASK(16)) { -+ } else if (spi_is_bpw_supported(spi, 16)) { - spi->bits_per_word = 16; -- } else if (spi_ctrl_mask == SPI_BPW_MASK(8)) { -+ } else if (spi_is_bpw_supported(spi, 8)) { - spi->bits_per_word = 8; - } else { - dev_err(dev, "unable to find common BPW with spi controller\n"); -diff --git a/drivers/iio/light/hid-sensor-prox.c b/drivers/iio/light/hid-sensor-prox.c -index a47591e1bad9da..24f73279075393 100644 ---- a/drivers/iio/light/hid-sensor-prox.c -+++ b/drivers/iio/light/hid-sensor-prox.c -@@ -102,8 +102,7 @@ static int prox_read_raw(struct iio_dev *indio_dev, - ret_type = prox_state->scale_precision; - break; - case IIO_CHAN_INFO_OFFSET: -- *val = hid_sensor_convert_exponent( -- prox_state->prox_attr.unit_expo); -+ *val = 0; - ret_type = IIO_VAL_INT; - break; - case IIO_CHAN_INFO_SAMP_FREQ: -@@ -227,6 +226,11 @@ static int prox_parse_report(struct platform_device *pdev, - dev_dbg(&pdev->dev, "prox %x:%x\n", st->prox_attr.index, - st->prox_attr.report_id); - -+ st->scale_precision = hid_sensor_format_scale(hsdev->usage, -+ &st->prox_attr, -+ &st->scale_pre_decml, -+ &st->scale_post_decml); -+ - return ret; - } - -diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c -index 0b88203720b059..77c0b89259911f 100644 ---- a/drivers/infiniband/core/cache.c -+++ b/drivers/infiniband/core/cache.c -@@ -582,8 +582,8 @@ static int __ib_cache_gid_add(struct ib_device *ib_dev, u32 port, - out_unlock: - mutex_unlock(&table->lock); - if (ret) -- pr_warn("%s: unable to add gid %pI6 error=%d\n", -- __func__, gid->raw, ret); -+ pr_warn_ratelimited("%s: unable to add gid %pI6 error=%d\n", -+ __func__, gid->raw, ret); - return ret; - } - -diff --git a/drivers/input/keyboard/gpio_keys.c b/drivers/input/keyboard/gpio_keys.c -index c5f4207fddce92..a34b9533d8f18e 100644 ---- a/drivers/input/keyboard/gpio_keys.c -+++ b/drivers/input/keyboard/gpio_keys.c -@@ -495,7 +495,7 @@ static irqreturn_t gpio_keys_irq_isr(int irq, void *dev_id) - if (bdata->release_delay) - hrtimer_start(&bdata->release_timer, - ms_to_ktime(bdata->release_delay), -- HRTIMER_MODE_REL_HARD); -+ HRTIMER_MODE_REL); - out: - spin_unlock_irqrestore(&bdata->lock, flags); - return IRQ_HANDLED; -@@ -632,7 +632,7 @@ static int gpio_keys_setup_key(struct platform_device *pdev, - - bdata->release_delay = button->debounce_interval; - hrtimer_init(&bdata->release_timer, -- CLOCK_REALTIME, HRTIMER_MODE_REL_HARD); -+ CLOCK_REALTIME, HRTIMER_MODE_REL); - bdata->release_timer.function = gpio_keys_irq_timer; - - isr = gpio_keys_irq_isr; -diff --git a/drivers/interconnect/qcom/sc7280.c b/drivers/interconnect/qcom/sc7280.c -index a626dbc719995f..728589ec802641 100644 ---- a/drivers/interconnect/qcom/sc7280.c -+++ b/drivers/interconnect/qcom/sc7280.c -@@ -165,6 +165,7 @@ static struct qcom_icc_node xm_pcie3_1 = { - .id = SC7280_MASTER_PCIE_1, - .channels = 1, - .buswidth = 8, -+ .num_links = 1, - .links = { SC7280_SLAVE_ANOC_PCIE_GEM_NOC }, - }; - -diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c -index beafca6ba0df4d..275d34119acdcb 100644 ---- a/drivers/mtd/nand/raw/qcom_nandc.c -+++ b/drivers/mtd/nand/raw/qcom_nandc.c -@@ -2858,7 +2858,12 @@ static int qcom_param_page_type_exec(struct nand_chip *chip, const struct nand_ - const struct nand_op_instr *instr = NULL; - unsigned int op_id = 0; - unsigned int len = 0; -- int ret; -+ int ret, reg_base; -+ -+ reg_base = NAND_READ_LOCATION_0; -+ -+ if (nandc->props->qpic_v2) -+ reg_base = NAND_READ_LOCATION_LAST_CW_0; - - ret = qcom_parse_instructions(chip, subop, &q_op); - if (ret) -@@ -2910,7 +2915,10 @@ static int qcom_param_page_type_exec(struct nand_chip *chip, const struct nand_ - op_id = q_op.data_instr_idx; - len = nand_subop_get_data_len(subop, op_id); - -- nandc_set_read_loc(chip, 0, 0, 0, len, 1); -+ if (nandc->props->qpic_v2) -+ nandc_set_read_loc_last(chip, reg_base, 0, len, 1); -+ else -+ nandc_set_read_loc_first(chip, reg_base, 0, len, 1); - - if (!nandc->props->qpic_v2) { - write_reg_dma(nandc, NAND_DEV_CMD_VLD, 1, 0); -diff --git a/drivers/net/can/dev/dev.c b/drivers/net/can/dev/dev.c -index 7d9a7c92d4cf63..6018444a76b9bc 100644 ---- a/drivers/net/can/dev/dev.c -+++ b/drivers/net/can/dev/dev.c -@@ -125,13 +125,16 @@ void can_change_state(struct net_device *dev, struct can_frame *cf, - EXPORT_SYMBOL_GPL(can_change_state); - - /* CAN device restart for bus-off recovery */ --static void can_restart(struct net_device *dev) -+static int can_restart(struct net_device *dev) - { - struct can_priv *priv = netdev_priv(dev); - struct sk_buff *skb; - struct can_frame *cf; - int err; - -+ if (!priv->do_set_mode) -+ return -EOPNOTSUPP; -+ - if (netif_carrier_ok(dev)) - netdev_err(dev, "Attempt to restart for bus-off recovery, but carrier is OK?\n"); - -@@ -142,24 +145,25 @@ static void can_restart(struct net_device *dev) - - /* send restart message upstream */ - skb = alloc_can_err_skb(dev, &cf); -- if (!skb) -- goto restart; -- -- cf->can_id |= CAN_ERR_RESTARTED; -- -- netif_rx(skb); -- --restart: -- netdev_dbg(dev, "restarted\n"); -- priv->can_stats.restarts++; -+ if (skb) { -+ cf->can_id |= CAN_ERR_RESTARTED; -+ netif_rx(skb); -+ } - - /* Now restart the device */ - netif_carrier_on(dev); - err = priv->do_set_mode(dev, CAN_MODE_START); - if (err) { -- netdev_err(dev, "Error %d during restart", err); -+ netdev_err(dev, "Restart failed, error %pe\n", ERR_PTR(err)); - netif_carrier_off(dev); -+ -+ return err; -+ } else { -+ netdev_dbg(dev, "Restarted\n"); -+ priv->can_stats.restarts++; - } -+ -+ return 0; - } - - static void can_restart_work(struct work_struct *work) -@@ -184,9 +188,8 @@ int can_restart_now(struct net_device *dev) - return -EBUSY; - - cancel_delayed_work_sync(&priv->restart_work); -- can_restart(dev); - -- return 0; -+ return can_restart(dev); - } - - /* CAN bus-off -diff --git a/drivers/net/can/dev/netlink.c b/drivers/net/can/dev/netlink.c -index 01aacdcda26066..abe8dc051d94f1 100644 ---- a/drivers/net/can/dev/netlink.c -+++ b/drivers/net/can/dev/netlink.c -@@ -285,6 +285,12 @@ static int can_changelink(struct net_device *dev, struct nlattr *tb[], - } - - if (data[IFLA_CAN_RESTART_MS]) { -+ if (!priv->do_set_mode) { -+ NL_SET_ERR_MSG(extack, -+ "Device doesn't support restart from Bus Off"); -+ return -EOPNOTSUPP; -+ } -+ - /* Do not allow changing restart delay while running */ - if (dev->flags & IFF_UP) - return -EBUSY; -@@ -292,6 +298,12 @@ static int can_changelink(struct net_device *dev, struct nlattr *tb[], - } - - if (data[IFLA_CAN_RESTART]) { -+ if (!priv->do_set_mode) { -+ NL_SET_ERR_MSG(extack, -+ "Device doesn't support restart from Bus Off"); -+ return -EOPNOTSUPP; -+ } -+ - /* Do not allow a restart while not running */ - if (!(dev->flags & IFF_UP)) - return -EINVAL; -diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c -index d3c36a6f84b01d..81a99f4824d054 100644 ---- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c -+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c -@@ -4654,12 +4654,19 @@ static int dpaa2_eth_connect_mac(struct dpaa2_eth_priv *priv) - return PTR_ERR(dpmac_dev); - } - -- if (IS_ERR(dpmac_dev) || dpmac_dev->dev.type != &fsl_mc_bus_dpmac_type) -+ if (IS_ERR(dpmac_dev)) - return 0; - -+ if (dpmac_dev->dev.type != &fsl_mc_bus_dpmac_type) { -+ err = 0; -+ goto out_put_device; -+ } -+ - mac = kzalloc(sizeof(struct dpaa2_mac), GFP_KERNEL); -- if (!mac) -- return -ENOMEM; -+ if (!mac) { -+ err = -ENOMEM; -+ goto out_put_device; -+ } - - mac->mc_dev = dpmac_dev; - mac->mc_io = priv->mc_io; -@@ -4693,6 +4700,8 @@ static int dpaa2_eth_connect_mac(struct dpaa2_eth_priv *priv) - dpaa2_mac_close(mac); - err_free_mac: - kfree(mac); -+out_put_device: -+ put_device(&dpmac_dev->dev); - return err; - } - -diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c -index a05a8525caa459..76795bb0b564b7 100644 ---- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c -+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c -@@ -1447,12 +1447,19 @@ static int dpaa2_switch_port_connect_mac(struct ethsw_port_priv *port_priv) - if (PTR_ERR(dpmac_dev) == -EPROBE_DEFER) - return PTR_ERR(dpmac_dev); - -- if (IS_ERR(dpmac_dev) || dpmac_dev->dev.type != &fsl_mc_bus_dpmac_type) -+ if (IS_ERR(dpmac_dev)) - return 0; - -+ if (dpmac_dev->dev.type != &fsl_mc_bus_dpmac_type) { -+ err = 0; -+ goto out_put_device; -+ } -+ - mac = kzalloc(sizeof(*mac), GFP_KERNEL); -- if (!mac) -- return -ENOMEM; -+ if (!mac) { -+ err = -ENOMEM; -+ goto out_put_device; -+ } - - mac->mc_dev = dpmac_dev; - mac->mc_io = port_priv->ethsw_data->mc_io; -@@ -1482,6 +1489,8 @@ static int dpaa2_switch_port_connect_mac(struct ethsw_port_priv *port_priv) - dpaa2_mac_close(mac); - err_free_mac: - kfree(mac); -+out_put_device: -+ put_device(&dpmac_dev->dev); - return err; - } - -diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c -index b4745d94cbbdbf..ec189f0703f99e 100644 ---- a/drivers/net/ethernet/google/gve/gve_main.c -+++ b/drivers/net/ethernet/google/gve/gve_main.c -@@ -1801,49 +1801,56 @@ static void gve_turnup(struct gve_priv *priv) - gve_set_napi_enabled(priv); - } - --static void gve_tx_timeout(struct net_device *dev, unsigned int txqueue) -+static struct gve_notify_block *gve_get_tx_notify_block(struct gve_priv *priv, -+ unsigned int txqueue) - { -- struct gve_notify_block *block; -- struct gve_tx_ring *tx = NULL; -- struct gve_priv *priv; -- u32 last_nic_done; -- u32 current_time; - u32 ntfy_idx; - -- netdev_info(dev, "Timeout on tx queue, %d", txqueue); -- priv = netdev_priv(dev); - if (txqueue > priv->tx_cfg.num_queues) -- goto reset; -+ return NULL; - - ntfy_idx = gve_tx_idx_to_ntfy(priv, txqueue); - if (ntfy_idx >= priv->num_ntfy_blks) -- goto reset; -+ return NULL; -+ -+ return &priv->ntfy_blocks[ntfy_idx]; -+} -+ -+static bool gve_tx_timeout_try_q_kick(struct gve_priv *priv, -+ unsigned int txqueue) -+{ -+ struct gve_notify_block *block; -+ u32 current_time; - -- block = &priv->ntfy_blocks[ntfy_idx]; -- tx = block->tx; -+ block = gve_get_tx_notify_block(priv, txqueue); -+ -+ if (!block) -+ return false; - - current_time = jiffies_to_msecs(jiffies); -- if (tx->last_kick_msec + MIN_TX_TIMEOUT_GAP > current_time) -- goto reset; -+ if (block->tx->last_kick_msec + MIN_TX_TIMEOUT_GAP > current_time) -+ return false; - -- /* Check to see if there are missed completions, which will allow us to -- * kick the queue. -- */ -- last_nic_done = gve_tx_load_event_counter(priv, tx); -- if (last_nic_done - tx->done) { -- netdev_info(dev, "Kicking queue %d", txqueue); -- iowrite32be(GVE_IRQ_MASK, gve_irq_doorbell(priv, block)); -- napi_schedule(&block->napi); -- tx->last_kick_msec = current_time; -- goto out; -- } // Else reset. -+ netdev_info(priv->dev, "Kicking queue %d", txqueue); -+ napi_schedule(&block->napi); -+ block->tx->last_kick_msec = current_time; -+ return true; -+} - --reset: -- gve_schedule_reset(priv); -+static void gve_tx_timeout(struct net_device *dev, unsigned int txqueue) -+{ -+ struct gve_notify_block *block; -+ struct gve_priv *priv; - --out: -- if (tx) -- tx->queue_timeout++; -+ netdev_info(dev, "Timeout on tx queue, %d", txqueue); -+ priv = netdev_priv(dev); -+ -+ if (!gve_tx_timeout_try_q_kick(priv, txqueue)) -+ gve_schedule_reset(priv); -+ -+ block = gve_get_tx_notify_block(priv, txqueue); -+ if (block) -+ block->tx->queue_timeout++; - priv->tx_timeo_cnt++; - } - -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c -index 0ed01f4d680618..dbf44a17987eb4 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c -@@ -11,6 +11,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -1039,6 +1040,8 @@ static bool hns3_can_use_tx_sgl(struct hns3_enet_ring *ring, - static void hns3_init_tx_spare_buffer(struct hns3_enet_ring *ring) - { - u32 alloc_size = ring->tqp->handle->kinfo.tx_spare_buf_size; -+ struct net_device *netdev = ring_to_netdev(ring); -+ struct hns3_nic_priv *priv = netdev_priv(netdev); - struct hns3_tx_spare *tx_spare; - struct page *page; - dma_addr_t dma; -@@ -1080,6 +1083,7 @@ static void hns3_init_tx_spare_buffer(struct hns3_enet_ring *ring) - tx_spare->buf = page_address(page); - tx_spare->len = PAGE_SIZE << order; - ring->tx_spare = tx_spare; -+ ring->tx_copybreak = priv->tx_copybreak; - return; - - dma_mapping_error: -@@ -4879,6 +4883,30 @@ static void hns3_nic_dealloc_vector_data(struct hns3_nic_priv *priv) - devm_kfree(&pdev->dev, priv->tqp_vector); - } - -+static void hns3_update_tx_spare_buf_config(struct hns3_nic_priv *priv) -+{ -+#define HNS3_MIN_SPARE_BUF_SIZE (2 * 1024 * 1024) -+#define HNS3_MAX_PACKET_SIZE (64 * 1024) -+ -+ struct iommu_domain *domain = iommu_get_domain_for_dev(priv->dev); -+ struct hnae3_ae_dev *ae_dev = hns3_get_ae_dev(priv->ae_handle); -+ struct hnae3_handle *handle = priv->ae_handle; -+ -+ if (ae_dev->dev_version < HNAE3_DEVICE_VERSION_V3) -+ return; -+ -+ if (!(domain && iommu_is_dma_domain(domain))) -+ return; -+ -+ priv->min_tx_copybreak = HNS3_MAX_PACKET_SIZE; -+ priv->min_tx_spare_buf_size = HNS3_MIN_SPARE_BUF_SIZE; -+ -+ if (priv->tx_copybreak < priv->min_tx_copybreak) -+ priv->tx_copybreak = priv->min_tx_copybreak; -+ if (handle->kinfo.tx_spare_buf_size < priv->min_tx_spare_buf_size) -+ handle->kinfo.tx_spare_buf_size = priv->min_tx_spare_buf_size; -+} -+ - static void hns3_ring_get_cfg(struct hnae3_queue *q, struct hns3_nic_priv *priv, - unsigned int ring_type) - { -@@ -5113,6 +5141,7 @@ int hns3_init_all_ring(struct hns3_nic_priv *priv) - int i, j; - int ret; - -+ hns3_update_tx_spare_buf_config(priv); - for (i = 0; i < ring_num; i++) { - ret = hns3_alloc_ring_memory(&priv->ring[i]); - if (ret) { -@@ -5317,6 +5346,8 @@ static int hns3_client_init(struct hnae3_handle *handle) - priv->ae_handle = handle; - priv->tx_timeout_count = 0; - priv->max_non_tso_bd_num = ae_dev->dev_specs.max_non_tso_bd_num; -+ priv->min_tx_copybreak = 0; -+ priv->min_tx_spare_buf_size = 0; - set_bit(HNS3_NIC_STATE_DOWN, &priv->state); - - handle->msg_enable = netif_msg_init(debug, DEFAULT_MSG_LEVEL); -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h -index d36c4ed16d8dd2..caf7a4df858527 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h -@@ -596,6 +596,8 @@ struct hns3_nic_priv { - struct hns3_enet_coalesce rx_coal; - u32 tx_copybreak; - u32 rx_copybreak; -+ u32 min_tx_copybreak; -+ u32 min_tx_spare_buf_size; - }; - - union l3_hdr_info { -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -index 4d318af748a0b7..789f72d1067f8a 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -@@ -9493,33 +9493,36 @@ static bool hclge_need_enable_vport_vlan_filter(struct hclge_vport *vport) - return false; - } - --int hclge_enable_vport_vlan_filter(struct hclge_vport *vport, bool request_en) -+static int __hclge_enable_vport_vlan_filter(struct hclge_vport *vport, -+ bool request_en) - { -- struct hclge_dev *hdev = vport->back; - bool need_en; - int ret; - -- mutex_lock(&hdev->vport_lock); -- -- vport->req_vlan_fltr_en = request_en; -- - need_en = hclge_need_enable_vport_vlan_filter(vport); -- if (need_en == vport->cur_vlan_fltr_en) { -- mutex_unlock(&hdev->vport_lock); -+ if (need_en == vport->cur_vlan_fltr_en) - return 0; -- } - - ret = hclge_set_vport_vlan_filter(vport, need_en); -- if (ret) { -- mutex_unlock(&hdev->vport_lock); -+ if (ret) - return ret; -- } - - vport->cur_vlan_fltr_en = need_en; - -+ return 0; -+} -+ -+int hclge_enable_vport_vlan_filter(struct hclge_vport *vport, bool request_en) -+{ -+ struct hclge_dev *hdev = vport->back; -+ int ret; -+ -+ mutex_lock(&hdev->vport_lock); -+ vport->req_vlan_fltr_en = request_en; -+ ret = __hclge_enable_vport_vlan_filter(vport, request_en); - mutex_unlock(&hdev->vport_lock); - -- return 0; -+ return ret; - } - - static int hclge_enable_vlan_filter(struct hnae3_handle *handle, bool enable) -@@ -10540,16 +10543,19 @@ static void hclge_sync_vlan_fltr_state(struct hclge_dev *hdev) - &vport->state)) - continue; - -- ret = hclge_enable_vport_vlan_filter(vport, -- vport->req_vlan_fltr_en); -+ mutex_lock(&hdev->vport_lock); -+ ret = __hclge_enable_vport_vlan_filter(vport, -+ vport->req_vlan_fltr_en); - if (ret) { - dev_err(&hdev->pdev->dev, - "failed to sync vlan filter state for vport%u, ret = %d\n", - vport->vport_id, ret); - set_bit(HCLGE_VPORT_STATE_VLAN_FLTR_CHANGE, - &vport->state); -+ mutex_unlock(&hdev->vport_lock); - return; - } -+ mutex_unlock(&hdev->vport_lock); - } - } - -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c -index 9a806ac727cf5b..c1e88e67ebb657 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c -@@ -497,14 +497,14 @@ int hclge_ptp_init(struct hclge_dev *hdev) - if (ret) { - dev_err(&hdev->pdev->dev, - "failed to init freq, ret = %d\n", ret); -- goto out; -+ goto out_clear_int; - } - - ret = hclge_ptp_set_ts_mode(hdev, &hdev->ptp->ts_cfg); - if (ret) { - dev_err(&hdev->pdev->dev, - "failed to init ts mode, ret = %d\n", ret); -- goto out; -+ goto out_clear_int; - } - - ktime_get_real_ts64(&ts); -@@ -512,7 +512,7 @@ int hclge_ptp_init(struct hclge_dev *hdev) - if (ret) { - dev_err(&hdev->pdev->dev, - "failed to init ts time, ret = %d\n", ret); -- goto out; -+ goto out_clear_int; - } - - set_bit(HCLGE_STATE_PTP_EN, &hdev->state); -@@ -520,6 +520,9 @@ int hclge_ptp_init(struct hclge_dev *hdev) - - return 0; - -+out_clear_int: -+ clear_bit(HCLGE_PTP_FLAG_EN, &hdev->ptp->flags); -+ hclge_ptp_int_en(hdev, false); - out: - hclge_ptp_destroy_clock(hdev); - -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c -index 1ba0b57c7a72d7..68a9aeeed3da06 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c -@@ -3029,11 +3029,7 @@ static void hclgevf_uninit_ae_dev(struct hnae3_ae_dev *ae_dev) - - static u32 hclgevf_get_max_channels(struct hclgevf_dev *hdev) - { -- struct hnae3_handle *nic = &hdev->nic; -- struct hnae3_knic_private_info *kinfo = &nic->kinfo; -- -- return min_t(u32, hdev->rss_size_max, -- hdev->num_tqps / kinfo->tc_info.num_tc); -+ return min(hdev->rss_size_max, hdev->num_tqps); - } - - /** -diff --git a/drivers/net/ethernet/intel/e1000e/defines.h b/drivers/net/ethernet/intel/e1000e/defines.h -index 0a35d36c2c8571..955bb116185728 100644 ---- a/drivers/net/ethernet/intel/e1000e/defines.h -+++ b/drivers/net/ethernet/intel/e1000e/defines.h -@@ -638,6 +638,9 @@ - /* For checksumming, the sum of all words in the NVM should equal 0xBABA. */ - #define NVM_SUM 0xBABA - -+/* Uninitialized ("empty") checksum word value */ -+#define NVM_CHECKSUM_UNINITIALIZED 0xFFFF -+ - /* PBA (printed board assembly) number words */ - #define NVM_PBA_OFFSET_0 8 - #define NVM_PBA_OFFSET_1 9 -diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c -index 364378133526a1..df4e7d781cb1cb 100644 ---- a/drivers/net/ethernet/intel/e1000e/ich8lan.c -+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c -@@ -4274,6 +4274,8 @@ static s32 e1000_validate_nvm_checksum_ich8lan(struct e1000_hw *hw) - ret_val = e1000e_update_nvm_checksum(hw); - if (ret_val) - return ret_val; -+ } else if (hw->mac.type == e1000_pch_tgp) { -+ return 0; - } - } - -diff --git a/drivers/net/ethernet/intel/e1000e/nvm.c b/drivers/net/ethernet/intel/e1000e/nvm.c -index e609f4df86f455..16369e6d245a4a 100644 ---- a/drivers/net/ethernet/intel/e1000e/nvm.c -+++ b/drivers/net/ethernet/intel/e1000e/nvm.c -@@ -558,6 +558,12 @@ s32 e1000e_validate_nvm_checksum_generic(struct e1000_hw *hw) - checksum += nvm_data; - } - -+ if (hw->mac.type == e1000_pch_tgp && -+ nvm_data == NVM_CHECKSUM_UNINITIALIZED) { -+ e_dbg("Uninitialized NVM Checksum on TGP platform - ignoring\n"); -+ return 0; -+ } -+ - if (checksum != (u16)NVM_SUM) { - e_dbg("NVM Checksum Invalid\n"); - return -E1000_ERR_NVM; -diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c -index 4e90570ba7803a..a89f7ca510fdb8 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c -@@ -246,6 +246,7 @@ static const struct i40e_stats i40e_gstrings_net_stats[] = { - I40E_NETDEV_STAT(rx_errors), - I40E_NETDEV_STAT(tx_errors), - I40E_NETDEV_STAT(rx_dropped), -+ I40E_NETDEV_STAT(rx_missed_errors), - I40E_NETDEV_STAT(tx_dropped), - I40E_NETDEV_STAT(collisions), - I40E_NETDEV_STAT(rx_length_errors), -@@ -322,7 +323,7 @@ static const struct i40e_stats i40e_gstrings_stats[] = { - I40E_PF_STAT("port.rx_broadcast", stats.eth.rx_broadcast), - I40E_PF_STAT("port.tx_broadcast", stats.eth.tx_broadcast), - I40E_PF_STAT("port.tx_errors", stats.eth.tx_errors), -- I40E_PF_STAT("port.rx_dropped", stats.eth.rx_discards), -+ I40E_PF_STAT("port.rx_discards", stats.eth.rx_discards), - I40E_PF_STAT("port.tx_dropped_link_down", stats.tx_dropped_link_down), - I40E_PF_STAT("port.rx_crc_errors", stats.crc_errors), - I40E_PF_STAT("port.illegal_bytes", stats.illegal_bytes), -diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c -index 806cec458a0726..b749aa3e783ffe 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_main.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c -@@ -509,6 +509,7 @@ static void i40e_get_netdev_stats_struct(struct net_device *netdev, - stats->tx_dropped = vsi_stats->tx_dropped; - stats->rx_errors = vsi_stats->rx_errors; - stats->rx_dropped = vsi_stats->rx_dropped; -+ stats->rx_missed_errors = vsi_stats->rx_missed_errors; - stats->rx_crc_errors = vsi_stats->rx_crc_errors; - stats->rx_length_errors = vsi_stats->rx_length_errors; - } -@@ -700,17 +701,13 @@ i40e_stats_update_rx_discards(struct i40e_vsi *vsi, struct i40e_hw *hw, - struct i40e_eth_stats *stat_offset, - struct i40e_eth_stats *stat) - { -- u64 rx_rdpc, rx_rxerr; -- - i40e_stat_update32(hw, I40E_GLV_RDPC(stat_idx), offset_loaded, -- &stat_offset->rx_discards, &rx_rdpc); -+ &stat_offset->rx_discards, &stat->rx_discards); - i40e_stat_update64(hw, - I40E_GL_RXERR1H(i40e_compute_pci_to_hw_id(vsi, hw)), - I40E_GL_RXERR1L(i40e_compute_pci_to_hw_id(vsi, hw)), - offset_loaded, &stat_offset->rx_discards_other, -- &rx_rxerr); -- -- stat->rx_discards = rx_rdpc + rx_rxerr; -+ &stat->rx_discards_other); - } - - /** -@@ -732,9 +729,6 @@ void i40e_update_eth_stats(struct i40e_vsi *vsi) - i40e_stat_update32(hw, I40E_GLV_TEPC(stat_idx), - vsi->stat_offsets_loaded, - &oes->tx_errors, &es->tx_errors); -- i40e_stat_update32(hw, I40E_GLV_RDPC(stat_idx), -- vsi->stat_offsets_loaded, -- &oes->rx_discards, &es->rx_discards); - i40e_stat_update32(hw, I40E_GLV_RUPP(stat_idx), - vsi->stat_offsets_loaded, - &oes->rx_unknown_protocol, &es->rx_unknown_protocol); -@@ -991,8 +985,10 @@ static void i40e_update_vsi_stats(struct i40e_vsi *vsi) - ns->tx_errors = es->tx_errors; - ons->multicast = oes->rx_multicast; - ns->multicast = es->rx_multicast; -- ons->rx_dropped = oes->rx_discards; -- ns->rx_dropped = es->rx_discards; -+ ons->rx_dropped = oes->rx_discards_other; -+ ns->rx_dropped = es->rx_discards_other; -+ ons->rx_missed_errors = oes->rx_discards; -+ ns->rx_missed_errors = es->rx_discards; - ons->tx_dropped = oes->tx_discards; - ns->tx_dropped = es->tx_discards; - -diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -index 80036942dc764a..6d7a4f2c3a49b7 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -@@ -3143,10 +3143,10 @@ static int i40e_vc_del_mac_addr_msg(struct i40e_vf *vf, u8 *msg) - const u8 *addr = al->list[i].addr; - - /* Allow to delete VF primary MAC only if it was not set -- * administratively by PF or if VF is trusted. -+ * administratively by PF. - */ - if (ether_addr_equal(addr, vf->default_lan_addr.addr)) { -- if (i40e_can_vf_change_mac(vf)) -+ if (!vf->pf_set_mac) - was_unimac_deleted = true; - else - continue; -@@ -5010,8 +5010,8 @@ int i40e_get_vf_stats(struct net_device *netdev, int vf_id, - vf_stats->tx_bytes = stats->tx_bytes; - vf_stats->broadcast = stats->rx_broadcast; - vf_stats->multicast = stats->rx_multicast; -- vf_stats->rx_dropped = stats->rx_discards; -- vf_stats->tx_dropped = stats->tx_discards; -+ vf_stats->rx_dropped = stats->rx_discards + stats->rx_discards_other; -+ vf_stats->tx_dropped = stats->tx_errors; - - return 0; - } -diff --git a/drivers/net/ethernet/intel/ice/ice_ddp.c b/drivers/net/ethernet/intel/ice/ice_ddp.c -index b27ec93638b6b4..cd97974b451a04 100644 ---- a/drivers/net/ethernet/intel/ice/ice_ddp.c -+++ b/drivers/net/ethernet/intel/ice/ice_ddp.c -@@ -1884,6 +1884,8 @@ enum ice_ddp_state ice_copy_and_init_pkg(struct ice_hw *hw, const u8 *buf, - return ICE_DDP_PKG_ERR; - - buf_copy = devm_kmemdup(ice_hw_to_dev(hw), buf, len, GFP_KERNEL); -+ if (!buf_copy) -+ return ICE_DDP_PKG_ERR; - - state = ice_init_pkg(hw, buf_copy, len); - if (!ice_is_init_pkg_successful(state)) { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -index 3e6bd27f6315d8..5a2126679415c7 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -@@ -1916,8 +1916,8 @@ static int cmd_exec(struct mlx5_core_dev *dev, void *in, int in_size, void *out, - - err = mlx5_cmd_invoke(dev, inb, outb, out, out_size, callback, context, - pages_queue, token, force_polling); -- if (callback) -- return err; -+ if (callback && !err) -+ return 0; - - if (err > 0) /* Failed in FW, command didn't execute */ - err = deliv_status_to_err(err); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -index 326c72b3df8671..86fb8197594f5e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -@@ -1170,19 +1170,19 @@ static void esw_set_peer_miss_rule_source_port(struct mlx5_eswitch *esw, - static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - struct mlx5_core_dev *peer_dev) - { -+ struct mlx5_eswitch *peer_esw = peer_dev->priv.eswitch; - struct mlx5_flow_destination dest = {}; - struct mlx5_flow_act flow_act = {0}; - struct mlx5_flow_handle **flows; -- /* total vports is the same for both e-switches */ -- int nvports = esw->total_vports; - struct mlx5_flow_handle *flow; -+ struct mlx5_vport *peer_vport; - struct mlx5_flow_spec *spec; -- struct mlx5_vport *vport; - int err, pfindex; - unsigned long i; - void *misc; - -- if (!MLX5_VPORT_MANAGER(esw->dev) && !mlx5_core_is_ecpf_esw_manager(esw->dev)) -+ if (!MLX5_VPORT_MANAGER(peer_dev) && -+ !mlx5_core_is_ecpf_esw_manager(peer_dev)) - return 0; - - spec = kvzalloc(sizeof(*spec), GFP_KERNEL); -@@ -1191,7 +1191,7 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - - peer_miss_rules_setup(esw, peer_dev, spec, &dest); - -- flows = kvcalloc(nvports, sizeof(*flows), GFP_KERNEL); -+ flows = kvcalloc(peer_esw->total_vports, sizeof(*flows), GFP_KERNEL); - if (!flows) { - err = -ENOMEM; - goto alloc_flows_err; -@@ -1201,10 +1201,10 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - misc = MLX5_ADDR_OF(fte_match_param, spec->match_value, - misc_parameters); - -- if (mlx5_core_is_ecpf_esw_manager(esw->dev)) { -- vport = mlx5_eswitch_get_vport(esw, MLX5_VPORT_PF); -- esw_set_peer_miss_rule_source_port(esw, peer_dev->priv.eswitch, -- spec, MLX5_VPORT_PF); -+ if (mlx5_core_is_ecpf_esw_manager(peer_dev)) { -+ peer_vport = mlx5_eswitch_get_vport(peer_esw, MLX5_VPORT_PF); -+ esw_set_peer_miss_rule_source_port(esw, peer_esw, spec, -+ MLX5_VPORT_PF); - - flow = mlx5_add_flow_rules(mlx5_eswitch_get_slow_fdb(esw), - spec, &flow_act, &dest, 1); -@@ -1212,11 +1212,11 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - err = PTR_ERR(flow); - goto add_pf_flow_err; - } -- flows[vport->index] = flow; -+ flows[peer_vport->index] = flow; - } - -- if (mlx5_ecpf_vport_exists(esw->dev)) { -- vport = mlx5_eswitch_get_vport(esw, MLX5_VPORT_ECPF); -+ if (mlx5_ecpf_vport_exists(peer_dev)) { -+ peer_vport = mlx5_eswitch_get_vport(peer_esw, MLX5_VPORT_ECPF); - MLX5_SET(fte_match_set_misc, misc, source_port, MLX5_VPORT_ECPF); - flow = mlx5_add_flow_rules(mlx5_eswitch_get_slow_fdb(esw), - spec, &flow_act, &dest, 1); -@@ -1224,13 +1224,14 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - err = PTR_ERR(flow); - goto add_ecpf_flow_err; - } -- flows[vport->index] = flow; -+ flows[peer_vport->index] = flow; - } - -- mlx5_esw_for_each_vf_vport(esw, i, vport, mlx5_core_max_vfs(esw->dev)) { -+ mlx5_esw_for_each_vf_vport(peer_esw, i, peer_vport, -+ mlx5_core_max_vfs(peer_dev)) { - esw_set_peer_miss_rule_source_port(esw, -- peer_dev->priv.eswitch, -- spec, vport->vport); -+ peer_esw, -+ spec, peer_vport->vport); - - flow = mlx5_add_flow_rules(mlx5_eswitch_get_slow_fdb(esw), - spec, &flow_act, &dest, 1); -@@ -1238,22 +1239,22 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - err = PTR_ERR(flow); - goto add_vf_flow_err; - } -- flows[vport->index] = flow; -+ flows[peer_vport->index] = flow; - } - -- if (mlx5_core_ec_sriov_enabled(esw->dev)) { -- mlx5_esw_for_each_ec_vf_vport(esw, i, vport, mlx5_core_max_ec_vfs(esw->dev)) { -- if (i >= mlx5_core_max_ec_vfs(peer_dev)) -- break; -- esw_set_peer_miss_rule_source_port(esw, peer_dev->priv.eswitch, -- spec, vport->vport); -+ if (mlx5_core_ec_sriov_enabled(peer_dev)) { -+ mlx5_esw_for_each_ec_vf_vport(peer_esw, i, peer_vport, -+ mlx5_core_max_ec_vfs(peer_dev)) { -+ esw_set_peer_miss_rule_source_port(esw, peer_esw, -+ spec, -+ peer_vport->vport); - flow = mlx5_add_flow_rules(esw->fdb_table.offloads.slow_fdb, - spec, &flow_act, &dest, 1); - if (IS_ERR(flow)) { - err = PTR_ERR(flow); - goto add_ec_vf_flow_err; - } -- flows[vport->index] = flow; -+ flows[peer_vport->index] = flow; - } - } - -@@ -1270,25 +1271,27 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - return 0; - - add_ec_vf_flow_err: -- mlx5_esw_for_each_ec_vf_vport(esw, i, vport, mlx5_core_max_ec_vfs(esw->dev)) { -- if (!flows[vport->index]) -+ mlx5_esw_for_each_ec_vf_vport(peer_esw, i, peer_vport, -+ mlx5_core_max_ec_vfs(peer_dev)) { -+ if (!flows[peer_vport->index]) - continue; -- mlx5_del_flow_rules(flows[vport->index]); -+ mlx5_del_flow_rules(flows[peer_vport->index]); - } - add_vf_flow_err: -- mlx5_esw_for_each_vf_vport(esw, i, vport, mlx5_core_max_vfs(esw->dev)) { -- if (!flows[vport->index]) -+ mlx5_esw_for_each_vf_vport(peer_esw, i, peer_vport, -+ mlx5_core_max_vfs(peer_dev)) { -+ if (!flows[peer_vport->index]) - continue; -- mlx5_del_flow_rules(flows[vport->index]); -+ mlx5_del_flow_rules(flows[peer_vport->index]); - } -- if (mlx5_ecpf_vport_exists(esw->dev)) { -- vport = mlx5_eswitch_get_vport(esw, MLX5_VPORT_ECPF); -- mlx5_del_flow_rules(flows[vport->index]); -+ if (mlx5_ecpf_vport_exists(peer_dev)) { -+ peer_vport = mlx5_eswitch_get_vport(peer_esw, MLX5_VPORT_ECPF); -+ mlx5_del_flow_rules(flows[peer_vport->index]); - } - add_ecpf_flow_err: -- if (mlx5_core_is_ecpf_esw_manager(esw->dev)) { -- vport = mlx5_eswitch_get_vport(esw, MLX5_VPORT_PF); -- mlx5_del_flow_rules(flows[vport->index]); -+ if (mlx5_core_is_ecpf_esw_manager(peer_dev)) { -+ peer_vport = mlx5_eswitch_get_vport(peer_esw, MLX5_VPORT_PF); -+ mlx5_del_flow_rules(flows[peer_vport->index]); - } - add_pf_flow_err: - esw_warn(esw->dev, "FDB: Failed to add peer miss flow rule err %d\n", err); -@@ -1301,37 +1304,34 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - static void esw_del_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - struct mlx5_core_dev *peer_dev) - { -+ struct mlx5_eswitch *peer_esw = peer_dev->priv.eswitch; - u16 peer_index = mlx5_get_dev_index(peer_dev); - struct mlx5_flow_handle **flows; -- struct mlx5_vport *vport; -+ struct mlx5_vport *peer_vport; - unsigned long i; - - flows = esw->fdb_table.offloads.peer_miss_rules[peer_index]; - if (!flows) - return; - -- if (mlx5_core_ec_sriov_enabled(esw->dev)) { -- mlx5_esw_for_each_ec_vf_vport(esw, i, vport, mlx5_core_max_ec_vfs(esw->dev)) { -- /* The flow for a particular vport could be NULL if the other ECPF -- * has fewer or no VFs enabled -- */ -- if (!flows[vport->index]) -- continue; -- mlx5_del_flow_rules(flows[vport->index]); -- } -+ if (mlx5_core_ec_sriov_enabled(peer_dev)) { -+ mlx5_esw_for_each_ec_vf_vport(peer_esw, i, peer_vport, -+ mlx5_core_max_ec_vfs(peer_dev)) -+ mlx5_del_flow_rules(flows[peer_vport->index]); - } - -- mlx5_esw_for_each_vf_vport(esw, i, vport, mlx5_core_max_vfs(esw->dev)) -- mlx5_del_flow_rules(flows[vport->index]); -+ mlx5_esw_for_each_vf_vport(peer_esw, i, peer_vport, -+ mlx5_core_max_vfs(peer_dev)) -+ mlx5_del_flow_rules(flows[peer_vport->index]); - -- if (mlx5_ecpf_vport_exists(esw->dev)) { -- vport = mlx5_eswitch_get_vport(esw, MLX5_VPORT_ECPF); -- mlx5_del_flow_rules(flows[vport->index]); -+ if (mlx5_ecpf_vport_exists(peer_dev)) { -+ peer_vport = mlx5_eswitch_get_vport(peer_esw, MLX5_VPORT_ECPF); -+ mlx5_del_flow_rules(flows[peer_vport->index]); - } - -- if (mlx5_core_is_ecpf_esw_manager(esw->dev)) { -- vport = mlx5_eswitch_get_vport(esw, MLX5_VPORT_PF); -- mlx5_del_flow_rules(flows[vport->index]); -+ if (mlx5_core_is_ecpf_esw_manager(peer_dev)) { -+ peer_vport = mlx5_eswitch_get_vport(peer_esw, MLX5_VPORT_PF); -+ mlx5_del_flow_rules(flows[peer_vport->index]); - } - - kvfree(flows); -diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c -index 8e2ec395633171..15b7d22d3639f2 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c -@@ -1087,6 +1087,9 @@ static void mt7921_sta_set_decap_offload(struct ieee80211_hw *hw, - struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv; - struct mt792x_dev *dev = mt792x_hw_dev(hw); - -+ if (!msta->wcid.sta) -+ return; -+ - mt792x_mutex_acquire(dev); - - if (enabled) -diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile -index b457de5abf7d79..8012de299174ff 100644 ---- a/drivers/platform/x86/Makefile -+++ b/drivers/platform/x86/Makefile -@@ -58,6 +58,8 @@ obj-$(CONFIG_X86_PLATFORM_DRIVERS_HP) += hp/ - # Hewlett Packard Enterprise - obj-$(CONFIG_UV_SYSFS) += uv_sysfs.o - -+obj-$(CONFIG_FW_ATTR_CLASS) += firmware_attributes_class.o -+ - # IBM Thinkpad and Lenovo - obj-$(CONFIG_IBM_RTL) += ibm_rtl.o - obj-$(CONFIG_IDEAPAD_LAPTOP) += ideapad-laptop.o -@@ -108,7 +110,6 @@ obj-$(CONFIG_SYSTEM76_ACPI) += system76_acpi.o - obj-$(CONFIG_TOPSTAR_LAPTOP) += topstar-laptop.o - - # Platform drivers --obj-$(CONFIG_FW_ATTR_CLASS) += firmware_attributes_class.o - obj-$(CONFIG_SERIAL_MULTI_INSTANTIATE) += serial-multi-instantiate.o - obj-$(CONFIG_MLX_PLATFORM) += mlx-platform.o - obj-$(CONFIG_TOUCHSCREEN_DMI) += touchscreen_dmi.o -diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c -index e84fcb444d872a..17a9e4bd638dcc 100644 ---- a/drivers/platform/x86/ideapad-laptop.c -+++ b/drivers/platform/x86/ideapad-laptop.c -@@ -1600,7 +1600,7 @@ static int ideapad_kbd_bl_init(struct ideapad_private *priv) - priv->kbd_bl.led.name = "platform::" LED_FUNCTION_KBD_BACKLIGHT; - priv->kbd_bl.led.brightness_get = ideapad_kbd_bl_led_cdev_brightness_get; - priv->kbd_bl.led.brightness_set_blocking = ideapad_kbd_bl_led_cdev_brightness_set; -- priv->kbd_bl.led.flags = LED_BRIGHT_HW_CHANGED; -+ priv->kbd_bl.led.flags = LED_BRIGHT_HW_CHANGED | LED_RETAIN_AT_SHUTDOWN; - - err = led_classdev_register(&priv->platform_device->dev, &priv->kbd_bl.led); - if (err) -diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c -index d2e21dc61dd7d5..1d49612eeb7e54 100644 ---- a/drivers/regulator/core.c -+++ b/drivers/regulator/core.c -@@ -5422,6 +5422,7 @@ static void regulator_remove_coupling(struct regulator_dev *rdev) - ERR_PTR(err)); - } - -+ rdev->coupling_desc.n_coupled = 0; - kfree(rdev->coupling_desc.coupled_rdevs); - rdev->coupling_desc.coupled_rdevs = NULL; - } -diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c -index af0d90beba6380..76ba36c83e5228 100644 ---- a/drivers/s390/net/ism_drv.c -+++ b/drivers/s390/net/ism_drv.c -@@ -130,6 +130,7 @@ static int ism_cmd(struct ism_dev *ism, void *cmd) - struct ism_req_hdr *req = cmd; - struct ism_resp_hdr *resp = cmd; - -+ spin_lock(&ism->cmd_lock); - __ism_write_cmd(ism, req + 1, sizeof(*req), req->len - sizeof(*req)); - __ism_write_cmd(ism, req, 0, sizeof(*req)); - -@@ -143,6 +144,7 @@ static int ism_cmd(struct ism_dev *ism, void *cmd) - } - __ism_read_cmd(ism, resp + 1, sizeof(*resp), resp->len - sizeof(*resp)); - out: -+ spin_unlock(&ism->cmd_lock); - return resp->ret; - } - -@@ -630,6 +632,7 @@ static int ism_probe(struct pci_dev *pdev, const struct pci_device_id *id) - return -ENOMEM; - - spin_lock_init(&ism->lock); -+ spin_lock_init(&ism->cmd_lock); - dev_set_drvdata(&pdev->dev, ism); - ism->pdev = pdev; - ism->dev.parent = &pdev->dev; -diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c -index 9285a683324f4f..7c17b8c0425e3c 100644 ---- a/drivers/spi/spi-cadence-quadspi.c -+++ b/drivers/spi/spi-cadence-quadspi.c -@@ -1870,11 +1870,6 @@ static int cqspi_probe(struct platform_device *pdev) - - pm_runtime_enable(dev); - -- if (cqspi->rx_chan) { -- dma_release_channel(cqspi->rx_chan); -- goto probe_setup_failed; -- } -- - ret = spi_register_controller(host); - if (ret) { - dev_err(&pdev->dev, "failed to register SPI ctlr %d\n", ret); -diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c -index 92aa98bbdc6628..6028558f96111c 100644 ---- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c -+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c -@@ -720,8 +720,7 @@ int vchiq_shutdown(struct vchiq_instance *instance) - int status = 0; - struct vchiq_state *state = instance->state; - -- if (mutex_lock_killable(&state->mutex)) -- return -EAGAIN; -+ mutex_lock(&state->mutex); - - /* Remove all services */ - vchiq_shutdown_internal(state, instance); -diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c -index bfcbccb400c3a8..5774b50eeaf7f7 100644 ---- a/drivers/usb/typec/tcpm/tcpm.c -+++ b/drivers/usb/typec/tcpm/tcpm.c -@@ -1041,7 +1041,7 @@ static int tcpm_set_attached_state(struct tcpm_port *port, bool attached) - port->data_role); - } - --static int tcpm_set_roles(struct tcpm_port *port, bool attached, -+static int tcpm_set_roles(struct tcpm_port *port, bool attached, int state, - enum typec_role role, enum typec_data_role data) - { - enum typec_orientation orientation; -@@ -1078,7 +1078,7 @@ static int tcpm_set_roles(struct tcpm_port *port, bool attached, - } - } - -- ret = tcpm_mux_set(port, TYPEC_STATE_USB, usb_role, orientation); -+ ret = tcpm_mux_set(port, state, usb_role, orientation); - if (ret < 0) - return ret; - -@@ -3622,16 +3622,6 @@ static int tcpm_src_attach(struct tcpm_port *port) - - tcpm_enable_auto_vbus_discharge(port, true); - -- ret = tcpm_set_roles(port, true, TYPEC_SOURCE, tcpm_data_role_for_source(port)); -- if (ret < 0) -- return ret; -- -- if (port->pd_supported) { -- ret = port->tcpc->set_pd_rx(port->tcpc, true); -- if (ret < 0) -- goto out_disable_mux; -- } -- - /* - * USB Type-C specification, version 1.2, - * chapter 4.5.2.2.8.1 (Attached.SRC Requirements) -@@ -3641,13 +3631,24 @@ static int tcpm_src_attach(struct tcpm_port *port) - (polarity == TYPEC_POLARITY_CC2 && port->cc1 == TYPEC_CC_RA)) { - ret = tcpm_set_vconn(port, true); - if (ret < 0) -- goto out_disable_pd; -+ return ret; - } - - ret = tcpm_set_vbus(port, true); - if (ret < 0) - goto out_disable_vconn; - -+ ret = tcpm_set_roles(port, true, TYPEC_STATE_USB, TYPEC_SOURCE, -+ tcpm_data_role_for_source(port)); -+ if (ret < 0) -+ goto out_disable_vbus; -+ -+ if (port->pd_supported) { -+ ret = port->tcpc->set_pd_rx(port->tcpc, true); -+ if (ret < 0) -+ goto out_disable_mux; -+ } -+ - port->pd_capable = false; - - port->partner = NULL; -@@ -3657,14 +3658,14 @@ static int tcpm_src_attach(struct tcpm_port *port) - - return 0; - --out_disable_vconn: -- tcpm_set_vconn(port, false); --out_disable_pd: -- if (port->pd_supported) -- port->tcpc->set_pd_rx(port->tcpc, false); - out_disable_mux: - tcpm_mux_set(port, TYPEC_STATE_SAFE, USB_ROLE_NONE, - TYPEC_ORIENTATION_NONE); -+out_disable_vbus: -+ tcpm_set_vbus(port, false); -+out_disable_vconn: -+ tcpm_set_vconn(port, false); -+ - return ret; - } - -@@ -3780,7 +3781,8 @@ static int tcpm_snk_attach(struct tcpm_port *port) - - tcpm_enable_auto_vbus_discharge(port, true); - -- ret = tcpm_set_roles(port, true, TYPEC_SINK, tcpm_data_role_for_sink(port)); -+ ret = tcpm_set_roles(port, true, TYPEC_STATE_USB, -+ TYPEC_SINK, tcpm_data_role_for_sink(port)); - if (ret < 0) - return ret; - -@@ -3802,12 +3804,24 @@ static void tcpm_snk_detach(struct tcpm_port *port) - static int tcpm_acc_attach(struct tcpm_port *port) - { - int ret; -+ enum typec_role role; -+ enum typec_data_role data; -+ int state = TYPEC_STATE_USB; - - if (port->attached) - return 0; - -- ret = tcpm_set_roles(port, true, TYPEC_SOURCE, -- tcpm_data_role_for_source(port)); -+ role = tcpm_port_is_sink(port) ? TYPEC_SINK : TYPEC_SOURCE; -+ data = tcpm_port_is_sink(port) ? tcpm_data_role_for_sink(port) -+ : tcpm_data_role_for_source(port); -+ -+ if (tcpm_port_is_audio(port)) -+ state = TYPEC_MODE_AUDIO; -+ -+ if (tcpm_port_is_debug(port)) -+ state = TYPEC_MODE_DEBUG; -+ -+ ret = tcpm_set_roles(port, true, state, role, data); - if (ret < 0) - return ret; - -@@ -4509,7 +4523,7 @@ static void run_state_machine(struct tcpm_port *port) - */ - tcpm_set_vconn(port, false); - tcpm_set_vbus(port, false); -- tcpm_set_roles(port, port->self_powered, TYPEC_SOURCE, -+ tcpm_set_roles(port, port->self_powered, TYPEC_STATE_USB, TYPEC_SOURCE, - tcpm_data_role_for_source(port)); - /* - * If tcpc fails to notify vbus off, TCPM will wait for PD_T_SAFE_0V + -@@ -4541,7 +4555,7 @@ static void run_state_machine(struct tcpm_port *port) - tcpm_set_vconn(port, false); - if (port->pd_capable) - tcpm_set_charge(port, false); -- tcpm_set_roles(port, port->self_powered, TYPEC_SINK, -+ tcpm_set_roles(port, port->self_powered, TYPEC_STATE_USB, TYPEC_SINK, - tcpm_data_role_for_sink(port)); - /* - * VBUS may or may not toggle, depending on the adapter. -@@ -4647,10 +4661,10 @@ static void run_state_machine(struct tcpm_port *port) - case DR_SWAP_CHANGE_DR: - tcpm_unregister_altmodes(port); - if (port->data_role == TYPEC_HOST) -- tcpm_set_roles(port, true, port->pwr_role, -+ tcpm_set_roles(port, true, TYPEC_STATE_USB, port->pwr_role, - TYPEC_DEVICE); - else -- tcpm_set_roles(port, true, port->pwr_role, -+ tcpm_set_roles(port, true, TYPEC_STATE_USB, port->pwr_role, - TYPEC_HOST); - tcpm_ams_finish(port); - tcpm_set_state(port, ready_state(port), 0); -diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c -index c5f04234d9511a..db4582687b958f 100644 ---- a/drivers/virtio/virtio_ring.c -+++ b/drivers/virtio/virtio_ring.c -@@ -2739,7 +2739,7 @@ int virtqueue_resize(struct virtqueue *_vq, u32 num, - void (*recycle)(struct virtqueue *vq, void *buf)) - { - struct vring_virtqueue *vq = to_vvq(_vq); -- int err; -+ int err, err_reset; - - if (num > vq->vq.num_max) - return -E2BIG; -@@ -2759,7 +2759,11 @@ int virtqueue_resize(struct virtqueue *_vq, u32 num, - else - err = virtqueue_resize_split(_vq, num); - -- return virtqueue_enable_after_reset(_vq); -+ err_reset = virtqueue_enable_after_reset(_vq); -+ if (err_reset) -+ return err_reset; -+ -+ return err; - } - EXPORT_SYMBOL_GPL(virtqueue_resize); - -diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c -index aa59788a61e6e4..86e088fd386ee5 100644 ---- a/fs/erofs/decompressor.c -+++ b/fs/erofs/decompressor.c -@@ -342,14 +342,12 @@ static int z_erofs_transform_plain(struct z_erofs_decompress_req *rq, - - if (outpages > inpages) { - DBG_BUGON(!rq->out[outpages - 1]); -- if (rq->out[outpages - 1] != rq->in[inpages - 1]) { -+ if (rq->out[outpages - 1] != rq->in[inpages - 1]) - memcpy_to_page(rq->out[outpages - 1], 0, src + - (interlaced_offset ? 0 : righthalf), - lefthalf); -- } else if (!interlaced_offset) { -+ else if (!interlaced_offset) - memmove(src, src + righthalf, lefthalf); -- flush_dcache_page(rq->in[inpages - 1]); -- } - } - kunmap_local(src); - return 0; -diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c -index 496e4c7c52a4e0..d852b43ac43e32 100644 ---- a/fs/erofs/zdata.c -+++ b/fs/erofs/zdata.c -@@ -122,9 +122,11 @@ static inline unsigned int z_erofs_pclusterpages(struct z_erofs_pcluster *pcl) - - /* - * bit 30: I/O error occurred on this page -+ * bit 29: CPU has dirty data in D-cache (needs aliasing handling); - * bit 0 - 29: remaining parts to complete this page - */ --#define Z_EROFS_PAGE_EIO (1 << 30) -+#define Z_EROFS_ONLINEPAGE_EIO 30 -+#define Z_EROFS_ONLINEPAGE_DIRTY 29 - - static inline void z_erofs_onlinepage_init(struct page *page) - { -@@ -143,7 +145,7 @@ static inline void z_erofs_onlinepage_split(struct page *page) - atomic_inc((atomic_t *)&page->private); - } - --static void z_erofs_onlinepage_endio(struct page *page, int err) -+static void z_erofs_onlinepage_end(struct page *page, int err, bool dirty) - { - int orig, v; - -@@ -151,16 +153,20 @@ static void z_erofs_onlinepage_endio(struct page *page, int err) - - do { - orig = atomic_read((atomic_t *)&page->private); -- v = (orig - 1) | (err ? Z_EROFS_PAGE_EIO : 0); -+ DBG_BUGON(orig <= 0); -+ v = dirty << Z_EROFS_ONLINEPAGE_DIRTY; -+ v |= (orig - 1) | (!!err << Z_EROFS_ONLINEPAGE_EIO); - } while (atomic_cmpxchg((atomic_t *)&page->private, orig, v) != orig); - -- if (!(v & ~Z_EROFS_PAGE_EIO)) { -- set_page_private(page, 0); -- ClearPagePrivate(page); -- if (!(v & Z_EROFS_PAGE_EIO)) -- SetPageUptodate(page); -- unlock_page(page); -- } -+ if (v & (BIT(Z_EROFS_ONLINEPAGE_DIRTY) - 1)) -+ return; -+ set_page_private(page, 0); -+ ClearPagePrivate(page); -+ if (v & BIT(Z_EROFS_ONLINEPAGE_DIRTY)) -+ flush_dcache_page(page); -+ if (!(v & BIT(Z_EROFS_ONLINEPAGE_EIO))) -+ SetPageUptodate(page); -+ unlock_page(page); - } - - #define Z_EROFS_ONSTACK_PAGES 32 -@@ -1060,7 +1066,7 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe, - goto repeat; - - out: -- z_erofs_onlinepage_endio(page, err); -+ z_erofs_onlinepage_end(page, err, false); - return err; - } - -@@ -1163,7 +1169,7 @@ static void z_erofs_fill_other_copies(struct z_erofs_decompress_backend *be, - cur += len; - } - kunmap_local(dst); -- z_erofs_onlinepage_endio(bvi->bvec.page, err); -+ z_erofs_onlinepage_end(bvi->bvec.page, err, true); - list_del(p); - kfree(bvi); - } -@@ -1333,7 +1339,7 @@ static int z_erofs_decompress_pcluster(struct z_erofs_decompress_backend *be, - /* recycle all individual short-lived pages */ - if (z_erofs_put_shortlivedpage(be->pagepool, page)) - continue; -- z_erofs_onlinepage_endio(page, err); -+ z_erofs_onlinepage_end(page, err, true); - } - - if (be->decompressed_pages != be->onstack_pages) -diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c -index 9a6d504228e7c5..35f3144d703b5c 100644 ---- a/fs/jfs/jfs_imap.c -+++ b/fs/jfs/jfs_imap.c -@@ -3029,14 +3029,23 @@ static void duplicateIXtree(struct super_block *sb, s64 blkno, - * - * RETURN VALUES: - * 0 - success -- * -ENOMEM - insufficient memory -+ * -EINVAL - unexpected inode type - */ - static int copy_from_dinode(struct dinode * dip, struct inode *ip) - { - struct jfs_inode_info *jfs_ip = JFS_IP(ip); - struct jfs_sb_info *sbi = JFS_SBI(ip->i_sb); -+ int fileset = le32_to_cpu(dip->di_fileset); -+ -+ switch (fileset) { -+ case AGGR_RESERVED_I: case AGGREGATE_I: case BMAP_I: -+ case LOG_I: case BADBLOCK_I: case FILESYSTEM_I: -+ break; -+ default: -+ return -EINVAL; -+ } - -- jfs_ip->fileset = le32_to_cpu(dip->di_fileset); -+ jfs_ip->fileset = fileset; - jfs_ip->mode2 = le32_to_cpu(dip->di_mode); - jfs_set_inode_flags(ip); - -diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c -index 5f2d73f36e0d2f..8c47c13c8e7168 100644 ---- a/fs/nilfs2/inode.c -+++ b/fs/nilfs2/inode.c -@@ -517,11 +517,18 @@ static int __nilfs_read_inode(struct super_block *sb, - inode->i_op = &nilfs_symlink_inode_operations; - inode_nohighmem(inode); - inode->i_mapping->a_ops = &nilfs_aops; -- } else { -+ } else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) || -+ S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) { - inode->i_op = &nilfs_special_inode_operations; - init_special_inode( - inode, inode->i_mode, - huge_decode_dev(le64_to_cpu(raw_inode->i_device_code))); -+ } else { -+ nilfs_error(sb, -+ "invalid file type bits in mode 0%o for inode %lu", -+ inode->i_mode, ino); -+ err = -EIO; -+ goto failed_unmap; - } - nilfs_ifile_unmap_inode(root->ifile, ino, bh); - brelse(bh); -diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c -index e7bcc383003103..66b20c3d963eb2 100644 ---- a/fs/smb/server/connection.c -+++ b/fs/smb/server/connection.c -@@ -39,8 +39,10 @@ void ksmbd_conn_free(struct ksmbd_conn *conn) - xa_destroy(&conn->sessions); - kvfree(conn->request_buf); - kfree(conn->preauth_info); -- if (atomic_dec_and_test(&conn->refcnt)) -+ if (atomic_dec_and_test(&conn->refcnt)) { -+ conn->transport->ops->free_transport(conn->transport); - kfree(conn); -+ } - } - - /** -diff --git a/fs/smb/server/connection.h b/fs/smb/server/connection.h -index dc07c6eb8c1921..47e6a8694c0fc1 100644 ---- a/fs/smb/server/connection.h -+++ b/fs/smb/server/connection.h -@@ -132,6 +132,7 @@ struct ksmbd_transport_ops { - void *buf, unsigned int len, - struct smb2_buffer_desc_v1 *desc, - unsigned int desc_len); -+ void (*free_transport)(struct ksmbd_transport *kt); - }; - - struct ksmbd_transport { -diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c -index 7b6639949c250c..eaef459776151b 100644 ---- a/fs/smb/server/transport_rdma.c -+++ b/fs/smb/server/transport_rdma.c -@@ -158,7 +158,8 @@ struct smb_direct_transport { - }; - - #define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport)) -- -+#define SMBD_TRANS(t) ((struct smb_direct_transport *)container_of(t, \ -+ struct smb_direct_transport, transport)) - enum { - SMB_DIRECT_MSG_NEGOTIATE_REQ = 0, - SMB_DIRECT_MSG_DATA_TRANSFER -@@ -409,6 +410,11 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id) - return NULL; - } - -+static void smb_direct_free_transport(struct ksmbd_transport *kt) -+{ -+ kfree(SMBD_TRANS(kt)); -+} -+ - static void free_transport(struct smb_direct_transport *t) - { - struct smb_direct_recvmsg *recvmsg; -@@ -455,7 +461,6 @@ static void free_transport(struct smb_direct_transport *t) - - smb_direct_destroy_pools(t); - ksmbd_conn_free(KSMBD_TRANS(t)->conn); -- kfree(t); - } - - static struct smb_direct_sendmsg -@@ -2301,4 +2306,5 @@ static struct ksmbd_transport_ops ksmbd_smb_direct_transport_ops = { - .read = smb_direct_read, - .rdma_read = smb_direct_rdma_read, - .rdma_write = smb_direct_rdma_write, -+ .free_transport = smb_direct_free_transport, - }; -diff --git a/fs/smb/server/transport_tcp.c b/fs/smb/server/transport_tcp.c -index 2ce7f75059cb35..64941a49438f37 100644 ---- a/fs/smb/server/transport_tcp.c -+++ b/fs/smb/server/transport_tcp.c -@@ -93,17 +93,21 @@ static struct tcp_transport *alloc_transport(struct socket *client_sk) - return t; - } - --static void free_transport(struct tcp_transport *t) -+static void ksmbd_tcp_free_transport(struct ksmbd_transport *kt) - { -- kernel_sock_shutdown(t->sock, SHUT_RDWR); -- sock_release(t->sock); -- t->sock = NULL; -+ struct tcp_transport *t = TCP_TRANS(kt); - -- ksmbd_conn_free(KSMBD_TRANS(t)->conn); -+ sock_release(t->sock); - kfree(t->iov); - kfree(t); - } - -+static void free_transport(struct tcp_transport *t) -+{ -+ kernel_sock_shutdown(t->sock, SHUT_RDWR); -+ ksmbd_conn_free(KSMBD_TRANS(t)->conn); -+} -+ - /** - * kvec_array_init() - initialize a IO vector segment - * @new: IO vector to be initialized -@@ -655,4 +659,5 @@ static struct ksmbd_transport_ops ksmbd_tcp_transport_ops = { - .read = ksmbd_tcp_read, - .writev = ksmbd_tcp_writev, - .disconnect = ksmbd_tcp_disconnect, -+ .free_transport = ksmbd_tcp_free_transport, - }; -diff --git a/fs/smb/server/transport_tcp.h b/fs/smb/server/transport_tcp.h -index e338bebe322f10..5925ec5df47552 100644 ---- a/fs/smb/server/transport_tcp.h -+++ b/fs/smb/server/transport_tcp.h -@@ -7,6 +7,7 @@ - #define __KSMBD_TRANSPORT_TCP_H__ - - int ksmbd_tcp_set_interfaces(char *ifc_list, int ifc_list_sz); -+void ksmbd_free_transport(struct ksmbd_transport *kt); - int ksmbd_tcp_init(void); - void ksmbd_tcp_destroy(void); - -diff --git a/include/linux/ism.h b/include/linux/ism.h -index 9a4c204df3da1d..04e2fc1973ce4e 100644 ---- a/include/linux/ism.h -+++ b/include/linux/ism.h -@@ -28,6 +28,7 @@ struct ism_dmb { - - struct ism_dev { - spinlock_t lock; /* protects the ism device */ -+ spinlock_t cmd_lock; /* serializes cmds */ - struct list_head list; - struct pci_dev *pdev; - -diff --git a/include/linux/sprintf.h b/include/linux/sprintf.h -index 33dcbec719254a..9e13b8040b12ca 100644 ---- a/include/linux/sprintf.h -+++ b/include/linux/sprintf.h -@@ -4,6 +4,7 @@ - - #include - #include -+#include - - int num_to_str(char *buf, int size, unsigned long long num, unsigned int width); - -diff --git a/kernel/resource.c b/kernel/resource.c -index 635e858db0fe81..6506839f8a8118 100644 ---- a/kernel/resource.c -+++ b/kernel/resource.c -@@ -1222,8 +1222,9 @@ static int __request_region_locked(struct resource *res, struct resource *parent - * become unavailable to other users. Conflicts are - * not expected. Warn to aid debugging if encountered. - */ -- if (conflict->desc == IORES_DESC_DEVICE_PRIVATE_MEMORY) { -- pr_warn("Unaddressable device %s %pR conflicts with %pR", -+ if (parent == &iomem_resource && -+ conflict->desc == IORES_DESC_DEVICE_PRIVATE_MEMORY) { -+ pr_warn("Unaddressable device %s %pR conflicts with %pR\n", - conflict->name, conflict, res); - } - if (conflict != parent) { -diff --git a/mm/kasan/report.c b/mm/kasan/report.c -index 44636fa953a723..7301773b5208a4 100644 ---- a/mm/kasan/report.c -+++ b/mm/kasan/report.c -@@ -385,7 +385,9 @@ static void print_address_description(void *addr, u8 tag, - } - - if (is_vmalloc_addr(addr)) { -- pr_err("The buggy address %px belongs to a vmalloc virtual mapping\n", addr); -+ pr_err("The buggy address belongs to a"); -+ if (!vmalloc_dump_obj(addr)) -+ pr_cont(" vmalloc virtual mapping\n"); - page = vmalloc_to_page(addr); - } - -diff --git a/mm/khugepaged.c b/mm/khugepaged.c -index a87cfe1d4b7beb..f227b39ae4cf74 100644 ---- a/mm/khugepaged.c -+++ b/mm/khugepaged.c -@@ -2387,7 +2387,7 @@ static unsigned int khugepaged_scan_mm_slot(unsigned int pages, int *result, - VM_BUG_ON(khugepaged_scan.address < hstart || - khugepaged_scan.address + HPAGE_PMD_SIZE > - hend); -- if (IS_ENABLED(CONFIG_SHMEM) && vma->vm_file) { -+ if (IS_ENABLED(CONFIG_SHMEM) && !vma_is_anonymous(vma)) { - struct file *file = get_file(vma->vm_file); - pgoff_t pgoff = linear_page_index(vma, - khugepaged_scan.address); -@@ -2734,7 +2734,7 @@ int madvise_collapse(struct vm_area_struct *vma, struct vm_area_struct **prev, - mmap_assert_locked(mm); - memset(cc->node_load, 0, sizeof(cc->node_load)); - nodes_clear(cc->alloc_nmask); -- if (IS_ENABLED(CONFIG_SHMEM) && vma->vm_file) { -+ if (IS_ENABLED(CONFIG_SHMEM) && !vma_is_anonymous(vma)) { - struct file *file = get_file(vma->vm_file); - pgoff_t pgoff = linear_page_index(vma, addr); - -diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c -index b58f957429f053..c82070167d8aa8 100644 ---- a/mm/zsmalloc.c -+++ b/mm/zsmalloc.c -@@ -988,6 +988,9 @@ static struct zspage *alloc_zspage(struct zs_pool *pool, - if (!zspage) - return NULL; - -+ if (!IS_ENABLED(CONFIG_COMPACTION)) -+ gfp &= ~__GFP_MOVABLE; -+ - zspage->magic = ZSPAGE_MAGIC; - migrate_lock_init(zspage); - -diff --git a/net/appletalk/aarp.c b/net/appletalk/aarp.c -index c7236daa24152a..0d7c14a4966819 100644 ---- a/net/appletalk/aarp.c -+++ b/net/appletalk/aarp.c -@@ -35,6 +35,7 @@ - #include - #include - #include -+#include - - int sysctl_aarp_expiry_time = AARP_EXPIRY_TIME; - int sysctl_aarp_tick_time = AARP_TICK_TIME; -@@ -44,6 +45,7 @@ int sysctl_aarp_resolve_time = AARP_RESOLVE_TIME; - /* Lists of aarp entries */ - /** - * struct aarp_entry - AARP entry -+ * @refcnt: Reference count - * @last_sent: Last time we xmitted the aarp request - * @packet_queue: Queue of frames wait for resolution - * @status: Used for proxy AARP -@@ -55,6 +57,7 @@ int sysctl_aarp_resolve_time = AARP_RESOLVE_TIME; - * @next: Next entry in chain - */ - struct aarp_entry { -+ refcount_t refcnt; - /* These first two are only used for unresolved entries */ - unsigned long last_sent; - struct sk_buff_head packet_queue; -@@ -79,6 +82,17 @@ static DEFINE_RWLOCK(aarp_lock); - /* Used to walk the list and purge/kick entries. */ - static struct timer_list aarp_timer; - -+static inline void aarp_entry_get(struct aarp_entry *a) -+{ -+ refcount_inc(&a->refcnt); -+} -+ -+static inline void aarp_entry_put(struct aarp_entry *a) -+{ -+ if (refcount_dec_and_test(&a->refcnt)) -+ kfree(a); -+} -+ - /* - * Delete an aarp queue - * -@@ -87,7 +101,7 @@ static struct timer_list aarp_timer; - static void __aarp_expire(struct aarp_entry *a) - { - skb_queue_purge(&a->packet_queue); -- kfree(a); -+ aarp_entry_put(a); - } - - /* -@@ -380,9 +394,11 @@ static void aarp_purge(void) - static struct aarp_entry *aarp_alloc(void) - { - struct aarp_entry *a = kmalloc(sizeof(*a), GFP_ATOMIC); -+ if (!a) -+ return NULL; - -- if (a) -- skb_queue_head_init(&a->packet_queue); -+ refcount_set(&a->refcnt, 1); -+ skb_queue_head_init(&a->packet_queue); - return a; - } - -@@ -508,6 +524,7 @@ int aarp_proxy_probe_network(struct atalk_iface *atif, struct atalk_addr *sa) - entry->dev = atif->dev; - - write_lock_bh(&aarp_lock); -+ aarp_entry_get(entry); - - hash = sa->s_node % (AARP_HASH_SIZE - 1); - entry->next = proxies[hash]; -@@ -533,6 +550,7 @@ int aarp_proxy_probe_network(struct atalk_iface *atif, struct atalk_addr *sa) - retval = 1; - } - -+ aarp_entry_put(entry); - write_unlock_bh(&aarp_lock); - out: - return retval; -diff --git a/net/mptcp/options.c b/net/mptcp/options.c -index 6ef98608ac64cc..8d4889a730064d 100644 ---- a/net/mptcp/options.c -+++ b/net/mptcp/options.c -@@ -979,8 +979,9 @@ static bool check_fully_established(struct mptcp_sock *msk, struct sock *ssk, - if (subflow->mp_join) - goto reset; - subflow->mp_capable = 0; -+ if (!mptcp_try_fallback(ssk)) -+ goto reset; - pr_fallback(msk); -- mptcp_do_fallback(ssk); - return false; - } - -diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c -index 157a574fab0ccf..29c167e5fc0255 100644 ---- a/net/mptcp/pm.c -+++ b/net/mptcp/pm.c -@@ -304,8 +304,14 @@ void mptcp_pm_mp_fail_received(struct sock *sk, u64 fail_seq) - - pr_debug("fail_seq=%llu\n", fail_seq); - -- if (!READ_ONCE(msk->allow_infinite_fallback)) -+ /* After accepting the fail, we can't create any other subflows */ -+ spin_lock_bh(&msk->fallback_lock); -+ if (!msk->allow_infinite_fallback) { -+ spin_unlock_bh(&msk->fallback_lock); - return; -+ } -+ msk->allow_subflows = false; -+ spin_unlock_bh(&msk->fallback_lock); - - if (!subflow->fail_tout) { - pr_debug("send MP_FAIL response and infinite map\n"); -diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c -index 140c3ffcb86ba0..e3f09467b36b2f 100644 ---- a/net/mptcp/protocol.c -+++ b/net/mptcp/protocol.c -@@ -623,10 +623,9 @@ static bool mptcp_check_data_fin(struct sock *sk) - - static void mptcp_dss_corruption(struct mptcp_sock *msk, struct sock *ssk) - { -- if (READ_ONCE(msk->allow_infinite_fallback)) { -+ if (mptcp_try_fallback(ssk)) { - MPTCP_INC_STATS(sock_net(ssk), - MPTCP_MIB_DSSCORRUPTIONFALLBACK); -- mptcp_do_fallback(ssk); - } else { - MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_DSSCORRUPTIONRESET); - mptcp_subflow_reset(ssk); -@@ -876,7 +875,7 @@ void mptcp_data_ready(struct sock *sk, struct sock *ssk) - static void mptcp_subflow_joined(struct mptcp_sock *msk, struct sock *ssk) - { - mptcp_subflow_ctx(ssk)->map_seq = READ_ONCE(msk->ack_seq); -- WRITE_ONCE(msk->allow_infinite_fallback, false); -+ msk->allow_infinite_fallback = false; - mptcp_event(MPTCP_EVENT_SUB_ESTABLISHED, msk, ssk, GFP_ATOMIC); - } - -@@ -887,6 +886,14 @@ static bool __mptcp_finish_join(struct mptcp_sock *msk, struct sock *ssk) - if (sk->sk_state != TCP_ESTABLISHED) - return false; - -+ spin_lock_bh(&msk->fallback_lock); -+ if (!msk->allow_subflows) { -+ spin_unlock_bh(&msk->fallback_lock); -+ return false; -+ } -+ mptcp_subflow_joined(msk, ssk); -+ spin_unlock_bh(&msk->fallback_lock); -+ - /* attach to msk socket only after we are sure we will deal with it - * at close time - */ -@@ -895,7 +902,6 @@ static bool __mptcp_finish_join(struct mptcp_sock *msk, struct sock *ssk) - - mptcp_subflow_ctx(ssk)->subflow_id = msk->subflow_id++; - mptcp_sockopt_sync_locked(msk, ssk); -- mptcp_subflow_joined(msk, ssk); - mptcp_stop_tout_timer(sk); - __mptcp_propagate_sndbuf(sk, ssk); - return true; -@@ -1231,10 +1237,14 @@ static void mptcp_update_infinite_map(struct mptcp_sock *msk, - mpext->infinite_map = 1; - mpext->data_len = 0; - -+ if (!mptcp_try_fallback(ssk)) { -+ mptcp_subflow_reset(ssk); -+ return; -+ } -+ - MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_INFINITEMAPTX); - mptcp_subflow_ctx(ssk)->send_infinite_map = 0; - pr_fallback(msk); -- mptcp_do_fallback(ssk); - } - - #define MPTCP_MAX_GSO_SIZE (GSO_LEGACY_MAX_SIZE - (MAX_TCP_HEADER + 1)) -@@ -2606,9 +2616,9 @@ static void mptcp_check_fastclose(struct mptcp_sock *msk) - - static void __mptcp_retrans(struct sock *sk) - { -+ struct mptcp_sendmsg_info info = { .data_lock_held = true, }; - struct mptcp_sock *msk = mptcp_sk(sk); - struct mptcp_subflow_context *subflow; -- struct mptcp_sendmsg_info info = {}; - struct mptcp_data_frag *dfrag; - struct sock *ssk; - int ret, err; -@@ -2653,6 +2663,18 @@ static void __mptcp_retrans(struct sock *sk) - info.sent = 0; - info.limit = READ_ONCE(msk->csum_enabled) ? dfrag->data_len : - dfrag->already_sent; -+ -+ /* -+ * make the whole retrans decision, xmit, disallow -+ * fallback atomic -+ */ -+ spin_lock_bh(&msk->fallback_lock); -+ if (__mptcp_check_fallback(msk)) { -+ spin_unlock_bh(&msk->fallback_lock); -+ release_sock(ssk); -+ return; -+ } -+ - while (info.sent < info.limit) { - ret = mptcp_sendmsg_frag(sk, ssk, dfrag, &info); - if (ret <= 0) -@@ -2666,8 +2688,9 @@ static void __mptcp_retrans(struct sock *sk) - len = max(copied, len); - tcp_push(ssk, 0, info.mss_now, tcp_sk(ssk)->nonagle, - info.size_goal); -- WRITE_ONCE(msk->allow_infinite_fallback, false); -+ msk->allow_infinite_fallback = false; - } -+ spin_unlock_bh(&msk->fallback_lock); - - release_sock(ssk); - } -@@ -2796,11 +2819,13 @@ static void __mptcp_init_sock(struct sock *sk) - WRITE_ONCE(msk->first, NULL); - inet_csk(sk)->icsk_sync_mss = mptcp_sync_mss; - WRITE_ONCE(msk->csum_enabled, mptcp_is_checksum_enabled(sock_net(sk))); -- WRITE_ONCE(msk->allow_infinite_fallback, true); -+ msk->allow_infinite_fallback = true; -+ msk->allow_subflows = true; - msk->recovery = false; - msk->subflow_id = 1; - - mptcp_pm_data_init(msk); -+ spin_lock_init(&msk->fallback_lock); - - /* re-use the csk retrans timer for MPTCP-level retrans */ - timer_setup(&msk->sk.icsk_retransmit_timer, mptcp_retransmit_timer, 0); -@@ -3183,7 +3208,16 @@ static int mptcp_disconnect(struct sock *sk, int flags) - * subflow - */ - mptcp_destroy_common(msk, MPTCP_CF_FASTCLOSE); -+ -+ /* The first subflow is already in TCP_CLOSE status, the following -+ * can't overlap with a fallback anymore -+ */ -+ spin_lock_bh(&msk->fallback_lock); -+ msk->allow_subflows = true; -+ msk->allow_infinite_fallback = true; - WRITE_ONCE(msk->flags, 0); -+ spin_unlock_bh(&msk->fallback_lock); -+ - msk->cb_flags = 0; - msk->recovery = false; - msk->can_ack = false; -@@ -3599,7 +3633,13 @@ bool mptcp_finish_join(struct sock *ssk) - - /* active subflow, already present inside the conn_list */ - if (!list_empty(&subflow->node)) { -+ spin_lock_bh(&msk->fallback_lock); -+ if (!msk->allow_subflows) { -+ spin_unlock_bh(&msk->fallback_lock); -+ return false; -+ } - mptcp_subflow_joined(msk, ssk); -+ spin_unlock_bh(&msk->fallback_lock); - mptcp_propagate_sndbuf(parent, ssk); - return true; - } -@@ -3712,7 +3752,7 @@ static void mptcp_subflow_early_fallback(struct mptcp_sock *msk, - struct mptcp_subflow_context *subflow) - { - subflow->request_mptcp = 0; -- __mptcp_do_fallback(msk); -+ WARN_ON_ONCE(!__mptcp_try_fallback(msk)); - } - - static int mptcp_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) -diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h -index d67add91c9b905..c5f41cdb36c4b1 100644 ---- a/net/mptcp/protocol.h -+++ b/net/mptcp/protocol.h -@@ -330,10 +330,16 @@ struct mptcp_sock { - u64 rtt_us; /* last maximum rtt of subflows */ - } rcvq_space; - u8 scaling_ratio; -+ bool allow_subflows; - - u32 subflow_id; - u32 setsockopt_seq; - char ca_name[TCP_CA_NAME_MAX]; -+ -+ spinlock_t fallback_lock; /* protects fallback, -+ * allow_infinite_fallback and -+ * allow_join -+ */ - }; - - #define mptcp_data_lock(sk) spin_lock_bh(&(sk)->sk_lock.slock) -@@ -1097,25 +1103,33 @@ static inline bool mptcp_check_fallback(const struct sock *sk) - return __mptcp_check_fallback(msk); - } - --static inline void __mptcp_do_fallback(struct mptcp_sock *msk) -+static inline bool __mptcp_try_fallback(struct mptcp_sock *msk) - { - if (test_bit(MPTCP_FALLBACK_DONE, &msk->flags)) { - pr_debug("TCP fallback already done (msk=%p)\n", msk); -- return; -+ return true; - } -- if (WARN_ON_ONCE(!READ_ONCE(msk->allow_infinite_fallback))) -- return; -+ spin_lock_bh(&msk->fallback_lock); -+ if (!msk->allow_infinite_fallback) { -+ spin_unlock_bh(&msk->fallback_lock); -+ return false; -+ } -+ -+ msk->allow_subflows = false; - set_bit(MPTCP_FALLBACK_DONE, &msk->flags); -+ spin_unlock_bh(&msk->fallback_lock); -+ return true; - } - --static inline void mptcp_do_fallback(struct sock *ssk) -+static inline bool mptcp_try_fallback(struct sock *ssk) - { - struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk); - struct sock *sk = subflow->conn; - struct mptcp_sock *msk; - - msk = mptcp_sk(sk); -- __mptcp_do_fallback(msk); -+ if (!__mptcp_try_fallback(msk)) -+ return false; - if (READ_ONCE(msk->snd_data_fin_enable) && !(ssk->sk_shutdown & SEND_SHUTDOWN)) { - gfp_t saved_allocation = ssk->sk_allocation; - -@@ -1127,6 +1141,7 @@ static inline void mptcp_do_fallback(struct sock *ssk) - tcp_shutdown(ssk, SEND_SHUTDOWN); - ssk->sk_allocation = saved_allocation; - } -+ return true; - } - - #define pr_fallback(a) pr_debug("%s:fallback to TCP (msk=%p)\n", __func__, a) -diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c -index f4b8ca8be81e8a..a01ea18283c726 100644 ---- a/net/mptcp/subflow.c -+++ b/net/mptcp/subflow.c -@@ -524,9 +524,11 @@ static void subflow_finish_connect(struct sock *sk, const struct sk_buff *skb) - mptcp_get_options(skb, &mp_opt); - if (subflow->request_mptcp) { - if (!(mp_opt.suboptions & OPTION_MPTCP_MPC_SYNACK)) { -+ if (!mptcp_try_fallback(sk)) -+ goto do_reset; -+ - MPTCP_INC_STATS(sock_net(sk), - MPTCP_MIB_MPCAPABLEACTIVEFALLBACK); -- mptcp_do_fallback(sk); - pr_fallback(msk); - goto fallback; - } -@@ -1255,20 +1257,29 @@ static void subflow_sched_work_if_closed(struct mptcp_sock *msk, struct sock *ss - mptcp_schedule_work(sk); - } - --static void mptcp_subflow_fail(struct mptcp_sock *msk, struct sock *ssk) -+static bool mptcp_subflow_fail(struct mptcp_sock *msk, struct sock *ssk) - { - struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk); - unsigned long fail_tout; - -+ /* we are really failing, prevent any later subflow join */ -+ spin_lock_bh(&msk->fallback_lock); -+ if (!msk->allow_infinite_fallback) { -+ spin_unlock_bh(&msk->fallback_lock); -+ return false; -+ } -+ msk->allow_subflows = false; -+ spin_unlock_bh(&msk->fallback_lock); -+ - /* greceful failure can happen only on the MPC subflow */ - if (WARN_ON_ONCE(ssk != READ_ONCE(msk->first))) -- return; -+ return false; - - /* since the close timeout take precedence on the fail one, - * no need to start the latter when the first is already set - */ - if (sock_flag((struct sock *)msk, SOCK_DEAD)) -- return; -+ return true; - - /* we don't need extreme accuracy here, use a zero fail_tout as special - * value meaning no fail timeout at all; -@@ -1280,6 +1291,7 @@ static void mptcp_subflow_fail(struct mptcp_sock *msk, struct sock *ssk) - tcp_send_ack(ssk); - - mptcp_reset_tout_timer(msk, subflow->fail_tout); -+ return true; - } - - static bool subflow_check_data_avail(struct sock *ssk) -@@ -1340,17 +1352,16 @@ static bool subflow_check_data_avail(struct sock *ssk) - (subflow->mp_join || subflow->valid_csum_seen)) { - subflow->send_mp_fail = 1; - -- if (!READ_ONCE(msk->allow_infinite_fallback)) { -+ if (!mptcp_subflow_fail(msk, ssk)) { - subflow->reset_transient = 0; - subflow->reset_reason = MPTCP_RST_EMIDDLEBOX; - goto reset; - } -- mptcp_subflow_fail(msk, ssk); - WRITE_ONCE(subflow->data_avail, MPTCP_SUBFLOW_DATA_AVAIL); - return true; - } - -- if (!READ_ONCE(msk->allow_infinite_fallback)) { -+ if (!mptcp_try_fallback(ssk)) { - /* fatal protocol error, close the socket. - * subflow_error_report() will introduce the appropriate barriers - */ -@@ -1366,8 +1377,6 @@ static bool subflow_check_data_avail(struct sock *ssk) - WRITE_ONCE(subflow->data_avail, MPTCP_SUBFLOW_NODATA); - return false; - } -- -- mptcp_do_fallback(ssk); - } - - skb = skb_peek(&ssk->sk_receive_queue); -@@ -1612,7 +1621,6 @@ int __mptcp_subflow_connect(struct sock *sk, const struct mptcp_addr_info *loc, - /* discard the subflow socket */ - mptcp_sock_graft(ssk, sk->sk_socket); - iput(SOCK_INODE(sf)); -- WRITE_ONCE(msk->allow_infinite_fallback, false); - mptcp_stop_tout_timer(sk); - return 0; - -@@ -1790,7 +1798,7 @@ static void subflow_state_change(struct sock *sk) - - msk = mptcp_sk(parent); - if (subflow_simultaneous_connect(sk)) { -- mptcp_do_fallback(sk); -+ WARN_ON_ONCE(!mptcp_try_fallback(sk)); - pr_fallback(msk); - subflow->conn_finished = 1; - mptcp_propagate_state(parent, sk, subflow, NULL); -diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c -index a2b321fec13c1d..c3f9a6375b4ea6 100644 ---- a/net/sched/sch_qfq.c -+++ b/net/sched/sch_qfq.c -@@ -539,9 +539,6 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, - - static void qfq_destroy_class(struct Qdisc *sch, struct qfq_class *cl) - { -- struct qfq_sched *q = qdisc_priv(sch); -- -- qfq_rm_from_agg(q, cl); - gen_kill_estimator(&cl->rate_est); - qdisc_put(cl->qdisc); - kfree(cl); -@@ -562,10 +559,11 @@ static int qfq_delete_class(struct Qdisc *sch, unsigned long arg, - - qdisc_purge_queue(cl->qdisc); - qdisc_class_hash_remove(&q->clhash, &cl->common); -- qfq_destroy_class(sch, cl); -+ qfq_rm_from_agg(q, cl); - - sch_tree_unlock(sch); - -+ qfq_destroy_class(sch, cl); - return 0; - } - -@@ -1506,6 +1504,7 @@ static void qfq_destroy_qdisc(struct Qdisc *sch) - for (i = 0; i < q->clhash.hashsize; i++) { - hlist_for_each_entry_safe(cl, next, &q->clhash.hash[i], - common.hnode) { -+ qfq_rm_from_agg(q, cl); - qfq_destroy_class(sch, cl); - } - } -diff --git a/net/xfrm/xfrm_interface_core.c b/net/xfrm/xfrm_interface_core.c -index e21cc71095bb27..ca6db1e960ce64 100644 ---- a/net/xfrm/xfrm_interface_core.c -+++ b/net/xfrm/xfrm_interface_core.c -@@ -880,7 +880,7 @@ static int xfrmi_changelink(struct net_device *dev, struct nlattr *tb[], - return -EINVAL; - } - -- if (p.collect_md) { -+ if (p.collect_md || xi->p.collect_md) { - NL_SET_ERR_MSG(extack, "collect_md can't be changed"); - return -EINVAL; - } -@@ -891,11 +891,6 @@ static int xfrmi_changelink(struct net_device *dev, struct nlattr *tb[], - } else { - if (xi->dev != dev) - return -EEXIST; -- if (xi->p.collect_md) { -- NL_SET_ERR_MSG(extack, -- "device can't be changed to collect_md"); -- return -EINVAL; -- } - } - - return xfrmi_update(xi, &p); -diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c -index d967e70a705859..12a144a269ee89 100644 ---- a/sound/pci/hda/hda_tegra.c -+++ b/sound/pci/hda/hda_tegra.c -@@ -72,6 +72,10 @@ - struct hda_tegra_soc { - bool has_hda2codec_2x_reset; - bool has_hda2hdmi; -+ bool has_hda2codec_2x; -+ bool input_stream; -+ bool always_on; -+ bool requires_init; - }; - - struct hda_tegra { -@@ -187,7 +191,9 @@ static int __maybe_unused hda_tegra_runtime_resume(struct device *dev) - if (rc != 0) - return rc; - if (chip->running) { -- hda_tegra_init(hda); -+ if (hda->soc->requires_init) -+ hda_tegra_init(hda); -+ - azx_init_chip(chip, 1); - /* disable controller wake up event*/ - azx_writew(chip, WAKEEN, azx_readw(chip, WAKEEN) & -@@ -252,7 +258,8 @@ static int hda_tegra_init_chip(struct azx *chip, struct platform_device *pdev) - bus->remap_addr = hda->regs + HDA_BAR0; - bus->addr = res->start + HDA_BAR0; - -- hda_tegra_init(hda); -+ if (hda->soc->requires_init) -+ hda_tegra_init(hda); - - return 0; - } -@@ -325,7 +332,7 @@ static int hda_tegra_first_init(struct azx *chip, struct platform_device *pdev) - * starts with offset 0 which is wrong as HW register for output stream - * offset starts with 4. - */ -- if (of_device_is_compatible(np, "nvidia,tegra234-hda")) -+ if (!hda->soc->input_stream) - chip->capture_streams = 4; - - chip->playback_streams = (gcap >> 12) & 0x0f; -@@ -421,7 +428,6 @@ static int hda_tegra_create(struct snd_card *card, - chip->driver_caps = driver_caps; - chip->driver_type = driver_caps & 0xff; - chip->dev_index = 0; -- chip->jackpoll_interval = msecs_to_jiffies(5000); - INIT_LIST_HEAD(&chip->pcm_list); - - chip->codec_probe_mask = -1; -@@ -438,7 +444,16 @@ static int hda_tegra_create(struct snd_card *card, - chip->bus.core.sync_write = 0; - chip->bus.core.needs_damn_long_delay = 1; - chip->bus.core.aligned_mmio = 1; -- chip->bus.jackpoll_in_suspend = 1; -+ -+ /* -+ * HDA power domain and clocks are always on for Tegra264 and -+ * the jack detection logic would work always, so no need of -+ * jack polling mechanism running. -+ */ -+ if (!hda->soc->always_on) { -+ chip->jackpoll_interval = msecs_to_jiffies(5000); -+ chip->bus.jackpoll_in_suspend = 1; -+ } - - err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops); - if (err < 0) { -@@ -452,22 +467,44 @@ static int hda_tegra_create(struct snd_card *card, - static const struct hda_tegra_soc tegra30_data = { - .has_hda2codec_2x_reset = true, - .has_hda2hdmi = true, -+ .has_hda2codec_2x = true, -+ .input_stream = true, -+ .always_on = false, -+ .requires_init = true, - }; - - static const struct hda_tegra_soc tegra194_data = { - .has_hda2codec_2x_reset = false, - .has_hda2hdmi = true, -+ .has_hda2codec_2x = true, -+ .input_stream = true, -+ .always_on = false, -+ .requires_init = true, - }; - - static const struct hda_tegra_soc tegra234_data = { - .has_hda2codec_2x_reset = true, - .has_hda2hdmi = false, -+ .has_hda2codec_2x = true, -+ .input_stream = false, -+ .always_on = false, -+ .requires_init = true, -+}; -+ -+static const struct hda_tegra_soc tegra264_data = { -+ .has_hda2codec_2x_reset = true, -+ .has_hda2hdmi = false, -+ .has_hda2codec_2x = false, -+ .input_stream = false, -+ .always_on = true, -+ .requires_init = false, - }; - - static const struct of_device_id hda_tegra_match[] = { - { .compatible = "nvidia,tegra30-hda", .data = &tegra30_data }, - { .compatible = "nvidia,tegra194-hda", .data = &tegra194_data }, - { .compatible = "nvidia,tegra234-hda", .data = &tegra234_data }, -+ { .compatible = "nvidia,tegra264-hda", .data = &tegra264_data }, - {}, - }; - MODULE_DEVICE_TABLE(of, hda_tegra_match); -@@ -522,7 +559,9 @@ static int hda_tegra_probe(struct platform_device *pdev) - hda->clocks[hda->nclocks++].id = "hda"; - if (hda->soc->has_hda2hdmi) - hda->clocks[hda->nclocks++].id = "hda2hdmi"; -- hda->clocks[hda->nclocks++].id = "hda2codec_2x"; -+ -+ if (hda->soc->has_hda2codec_2x) -+ hda->clocks[hda->nclocks++].id = "hda2codec_2x"; - - err = devm_clk_bulk_get(&pdev->dev, hda->nclocks, hda->clocks); - if (err < 0) -diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c -index f030700cd60d75..f2c03fbf892f1b 100644 ---- a/sound/pci/hda/patch_hdmi.c -+++ b/sound/pci/hda/patch_hdmi.c -@@ -4559,6 +4559,9 @@ HDA_CODEC_ENTRY(0x10de002e, "Tegra186 HDMI/DP1", patch_tegra_hdmi), - HDA_CODEC_ENTRY(0x10de002f, "Tegra194 HDMI/DP2", patch_tegra_hdmi), - HDA_CODEC_ENTRY(0x10de0030, "Tegra194 HDMI/DP3", patch_tegra_hdmi), - HDA_CODEC_ENTRY(0x10de0031, "Tegra234 HDMI/DP", patch_tegra234_hdmi), -+HDA_CODEC_ENTRY(0x10de0033, "SoC 33 HDMI/DP", patch_tegra234_hdmi), -+HDA_CODEC_ENTRY(0x10de0034, "Tegra264 HDMI/DP", patch_tegra234_hdmi), -+HDA_CODEC_ENTRY(0x10de0035, "SoC 35 HDMI/DP", patch_tegra234_hdmi), - HDA_CODEC_ENTRY(0x10de0040, "GPU 40 HDMI/DP", patch_nvhdmi), - HDA_CODEC_ENTRY(0x10de0041, "GPU 41 HDMI/DP", patch_nvhdmi), - HDA_CODEC_ENTRY(0x10de0042, "GPU 42 HDMI/DP", patch_nvhdmi), -@@ -4597,15 +4600,32 @@ HDA_CODEC_ENTRY(0x10de0097, "GPU 97 HDMI/DP", patch_nvhdmi), - HDA_CODEC_ENTRY(0x10de0098, "GPU 98 HDMI/DP", patch_nvhdmi), - HDA_CODEC_ENTRY(0x10de0099, "GPU 99 HDMI/DP", patch_nvhdmi), - HDA_CODEC_ENTRY(0x10de009a, "GPU 9a HDMI/DP", patch_nvhdmi), -+HDA_CODEC_ENTRY(0x10de009b, "GPU 9b HDMI/DP", patch_nvhdmi), -+HDA_CODEC_ENTRY(0x10de009c, "GPU 9c HDMI/DP", patch_nvhdmi), - HDA_CODEC_ENTRY(0x10de009d, "GPU 9d HDMI/DP", patch_nvhdmi), - HDA_CODEC_ENTRY(0x10de009e, "GPU 9e HDMI/DP", patch_nvhdmi), - HDA_CODEC_ENTRY(0x10de009f, "GPU 9f HDMI/DP", patch_nvhdmi), - HDA_CODEC_ENTRY(0x10de00a0, "GPU a0 HDMI/DP", patch_nvhdmi), -+HDA_CODEC_ENTRY(0x10de00a1, "GPU a1 HDMI/DP", patch_nvhdmi), - HDA_CODEC_ENTRY(0x10de00a3, "GPU a3 HDMI/DP", patch_nvhdmi), - HDA_CODEC_ENTRY(0x10de00a4, "GPU a4 HDMI/DP", patch_nvhdmi), - HDA_CODEC_ENTRY(0x10de00a5, "GPU a5 HDMI/DP", patch_nvhdmi), - HDA_CODEC_ENTRY(0x10de00a6, "GPU a6 HDMI/DP", patch_nvhdmi), - HDA_CODEC_ENTRY(0x10de00a7, "GPU a7 HDMI/DP", patch_nvhdmi), -+HDA_CODEC_ENTRY(0x10de00a8, "GPU a8 HDMI/DP", patch_nvhdmi), -+HDA_CODEC_ENTRY(0x10de00a9, "GPU a9 HDMI/DP", patch_nvhdmi), -+HDA_CODEC_ENTRY(0x10de00aa, "GPU aa HDMI/DP", patch_nvhdmi), -+HDA_CODEC_ENTRY(0x10de00ab, "GPU ab HDMI/DP", patch_nvhdmi), -+HDA_CODEC_ENTRY(0x10de00ad, "GPU ad HDMI/DP", patch_nvhdmi), -+HDA_CODEC_ENTRY(0x10de00ae, "GPU ae HDMI/DP", patch_nvhdmi), -+HDA_CODEC_ENTRY(0x10de00af, "GPU af HDMI/DP", patch_nvhdmi), -+HDA_CODEC_ENTRY(0x10de00b0, "GPU b0 HDMI/DP", patch_nvhdmi), -+HDA_CODEC_ENTRY(0x10de00b1, "GPU b1 HDMI/DP", patch_nvhdmi), -+HDA_CODEC_ENTRY(0x10de00c0, "GPU c0 HDMI/DP", patch_nvhdmi), -+HDA_CODEC_ENTRY(0x10de00c1, "GPU c1 HDMI/DP", patch_nvhdmi), -+HDA_CODEC_ENTRY(0x10de00c3, "GPU c3 HDMI/DP", patch_nvhdmi), -+HDA_CODEC_ENTRY(0x10de00c4, "GPU c4 HDMI/DP", patch_nvhdmi), -+HDA_CODEC_ENTRY(0x10de00c5, "GPU c5 HDMI/DP", patch_nvhdmi), - HDA_CODEC_ENTRY(0x10de8001, "MCP73 HDMI", patch_nvhdmi_2ch), - HDA_CODEC_ENTRY(0x10de8067, "MCP67/68 HDMI", patch_nvhdmi_2ch), - HDA_CODEC_ENTRY(0x67663d82, "Arise 82 HDMI/DP", patch_gf_hdmi), -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 614784c0ba3188..e12e3134b5e16b 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -10103,6 +10103,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x8788, "HP OMEN 15", ALC285_FIXUP_HP_MUTE_LED), - SND_PCI_QUIRK(0x103c, 0x87b7, "HP Laptop 14-fq0xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), - SND_PCI_QUIRK(0x103c, 0x87c8, "HP", ALC287_FIXUP_HP_GPIO_LED), -+ SND_PCI_QUIRK(0x103c, 0x87cc, "HP Pavilion 15-eg0xxx", ALC287_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x87d3, "HP Laptop 15-gw0xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), - SND_PCI_QUIRK(0x103c, 0x87df, "HP ProBook 430 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x87e5, "HP ProBook 440 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED), -diff --git a/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c b/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c -index 2c57ceede095eb..a84c41862ff8c9 100644 ---- a/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c -+++ b/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c -@@ -12,7 +12,6 @@ - #include - #include - #include --#include "network_helpers.h" - - #define STACK_SIZE (1024 * 1024) - static char child_stack[STACK_SIZE]; -@@ -75,50 +74,6 @@ static int test_current_pid_tgid_tp(void *args) - return ret; - } - --static int test_current_pid_tgid_cgrp(void *args) --{ -- struct test_ns_current_pid_tgid__bss *bss; -- struct test_ns_current_pid_tgid *skel; -- int server_fd = -1, ret = -1, err; -- int cgroup_fd = *(int *)args; -- pid_t tgid, pid; -- -- skel = test_ns_current_pid_tgid__open(); -- if (!ASSERT_OK_PTR(skel, "test_ns_current_pid_tgid__open")) -- return ret; -- -- bpf_program__set_autoload(skel->progs.cgroup_bind4, true); -- -- err = test_ns_current_pid_tgid__load(skel); -- if (!ASSERT_OK(err, "test_ns_current_pid_tgid__load")) -- goto cleanup; -- -- bss = skel->bss; -- if (get_pid_tgid(&pid, &tgid, bss)) -- goto cleanup; -- -- skel->links.cgroup_bind4 = bpf_program__attach_cgroup( -- skel->progs.cgroup_bind4, cgroup_fd); -- if (!ASSERT_OK_PTR(skel->links.cgroup_bind4, "bpf_program__attach_cgroup")) -- goto cleanup; -- -- server_fd = start_server(AF_INET, SOCK_STREAM, NULL, 0, 0); -- if (!ASSERT_GE(server_fd, 0, "start_server")) -- goto cleanup; -- -- if (!ASSERT_EQ(bss->user_pid, pid, "pid")) -- goto cleanup; -- if (!ASSERT_EQ(bss->user_tgid, tgid, "tgid")) -- goto cleanup; -- ret = 0; -- --cleanup: -- if (server_fd >= 0) -- close(server_fd); -- test_ns_current_pid_tgid__destroy(skel); -- return ret; --} -- - static void test_ns_current_pid_tgid_new_ns(int (*fn)(void *), void *arg) - { - int wstatus; -@@ -140,25 +95,6 @@ static void test_ns_current_pid_tgid_new_ns(int (*fn)(void *), void *arg) - return; - } - --static void test_in_netns(int (*fn)(void *), void *arg) --{ -- struct nstoken *nstoken = NULL; -- -- SYS(cleanup, "ip netns add ns_current_pid_tgid"); -- SYS(cleanup, "ip -net ns_current_pid_tgid link set dev lo up"); -- -- nstoken = open_netns("ns_current_pid_tgid"); -- if (!ASSERT_OK_PTR(nstoken, "open_netns")) -- goto cleanup; -- -- test_ns_current_pid_tgid_new_ns(fn, arg); -- --cleanup: -- if (nstoken) -- close_netns(nstoken); -- SYS_NOFAIL("ip netns del ns_current_pid_tgid"); --} -- - /* TODO: use a different tracepoint */ - void serial_test_ns_current_pid_tgid(void) - { -@@ -166,13 +102,4 @@ void serial_test_ns_current_pid_tgid(void) - test_current_pid_tgid_tp(NULL); - if (test__start_subtest("new_ns_tp")) - test_ns_current_pid_tgid_new_ns(test_current_pid_tgid_tp, NULL); -- if (test__start_subtest("new_ns_cgrp")) { -- int cgroup_fd = -1; -- -- cgroup_fd = test__join_cgroup("/sock_addr"); -- if (ASSERT_GE(cgroup_fd, 0, "join_cgroup")) { -- test_in_netns(test_current_pid_tgid_cgrp, &cgroup_fd); -- close(cgroup_fd); -- } -- } - } -diff --git a/tools/testing/selftests/bpf/progs/test_ns_current_pid_tgid.c b/tools/testing/selftests/bpf/progs/test_ns_current_pid_tgid.c -index d0010e698f6688..aa3ec7ca16d9b6 100644 ---- a/tools/testing/selftests/bpf/progs/test_ns_current_pid_tgid.c -+++ b/tools/testing/selftests/bpf/progs/test_ns_current_pid_tgid.c -@@ -28,11 +28,4 @@ int tp_handler(const void *ctx) - return 0; - } - --SEC("?cgroup/bind4") --int cgroup_bind4(struct bpf_sock_addr *ctx) --{ -- get_pid_tgid(); -- return 1; --} -- - char _license[] SEC("license") = "GPL"; -diff --git a/tools/testing/selftests/net/mptcp/Makefile b/tools/testing/selftests/net/mptcp/Makefile -index 7b936a92685949..3c2fb9efb0b140 100644 ---- a/tools/testing/selftests/net/mptcp/Makefile -+++ b/tools/testing/selftests/net/mptcp/Makefile -@@ -4,7 +4,8 @@ top_srcdir = ../../../../.. - - CFLAGS = -Wall -Wl,--no-as-needed -O2 -g -I$(top_srcdir)/usr/include $(KHDR_INCLUDES) - --TEST_PROGS := mptcp_connect.sh pm_netlink.sh mptcp_join.sh diag.sh \ -+TEST_PROGS := mptcp_connect.sh mptcp_connect_mmap.sh mptcp_connect_sendfile.sh \ -+ mptcp_connect_checksum.sh pm_netlink.sh mptcp_join.sh diag.sh \ - simult_flows.sh mptcp_sockopt.sh userspace_pm.sh - - TEST_GEN_FILES = mptcp_connect pm_nl_ctl mptcp_sockopt mptcp_inq -diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect_checksum.sh b/tools/testing/selftests/net/mptcp/mptcp_connect_checksum.sh -new file mode 100644 -index 00000000000000..ce93ec2f107fba ---- /dev/null -+++ b/tools/testing/selftests/net/mptcp/mptcp_connect_checksum.sh -@@ -0,0 +1,5 @@ -+#!/bin/bash -+# SPDX-License-Identifier: GPL-2.0 -+ -+MPTCP_LIB_KSFT_TEST="$(basename "${0}" .sh)" \ -+ "$(dirname "${0}")/mptcp_connect.sh" -C "${@}" -diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect_mmap.sh b/tools/testing/selftests/net/mptcp/mptcp_connect_mmap.sh -new file mode 100644 -index 00000000000000..5dd30f9394af6a ---- /dev/null -+++ b/tools/testing/selftests/net/mptcp/mptcp_connect_mmap.sh -@@ -0,0 +1,5 @@ -+#!/bin/bash -+# SPDX-License-Identifier: GPL-2.0 -+ -+MPTCP_LIB_KSFT_TEST="$(basename "${0}" .sh)" \ -+ "$(dirname "${0}")/mptcp_connect.sh" -m mmap "${@}" -diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect_sendfile.sh b/tools/testing/selftests/net/mptcp/mptcp_connect_sendfile.sh -new file mode 100644 -index 00000000000000..1d16fb1cc9bb6d ---- /dev/null -+++ b/tools/testing/selftests/net/mptcp/mptcp_connect_sendfile.sh -@@ -0,0 +1,5 @@ -+#!/bin/bash -+# SPDX-License-Identifier: GPL-2.0 -+ -+MPTCP_LIB_KSFT_TEST="$(basename "${0}" .sh)" \ -+ "$(dirname "${0}")/mptcp_connect.sh" -m sendfile "${@}" diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.101-102.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.101-102.patch deleted file mode 100644 index 5d4e6ed879..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.101-102.patch +++ /dev/null @@ -1,9931 +0,0 @@ -diff --git a/Documentation/filesystems/f2fs.rst b/Documentation/filesystems/f2fs.rst -index dbfbbe9ab28b12..961684e9466e6f 100644 ---- a/Documentation/filesystems/f2fs.rst -+++ b/Documentation/filesystems/f2fs.rst -@@ -233,9 +233,9 @@ usrjquota= Appoint specified file and type during mount, so that quota - grpjquota= information can be properly updated during recovery flow, - prjjquota= : must be in root directory; - jqfmt= : [vfsold,vfsv0,vfsv1]. --offusrjquota Turn off user journalled quota. --offgrpjquota Turn off group journalled quota. --offprjjquota Turn off project journalled quota. -+usrjquota= Turn off user journalled quota. -+grpjquota= Turn off group journalled quota. -+prjjquota= Turn off project journalled quota. - quota Enable plain user disk quota accounting. - noquota Disable all plain disk quota option. - alloc_mode=%s Adjust block allocation policy, which supports "reuse" -diff --git a/Documentation/netlink/specs/ethtool.yaml b/Documentation/netlink/specs/ethtool.yaml -index 3e38f69567939e..b463949736c566 100644 ---- a/Documentation/netlink/specs/ethtool.yaml -+++ b/Documentation/netlink/specs/ethtool.yaml -@@ -1489,9 +1489,6 @@ operations: - - do: &module-eeprom-get-op - request: -- attributes: -- - header -- reply: - attributes: - - header - - offset -@@ -1499,6 +1496,9 @@ operations: - - page - - bank - - i2c-address -+ reply: -+ attributes: -+ - header - - data - dump: *module-eeprom-get-op - - -diff --git a/Makefile b/Makefile -index 116eb523392a23..685a65992449d1 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 101 -+SUBLEVEL = 102 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm/boot/dts/nxp/imx/imx6ul-kontron-bl-common.dtsi b/arch/arm/boot/dts/nxp/imx/imx6ul-kontron-bl-common.dtsi -index 33d5f27285a476..9ece280d163afd 100644 ---- a/arch/arm/boot/dts/nxp/imx/imx6ul-kontron-bl-common.dtsi -+++ b/arch/arm/boot/dts/nxp/imx/imx6ul-kontron-bl-common.dtsi -@@ -169,7 +169,6 @@ &uart2 { - pinctrl-0 = <&pinctrl_uart2>; - linux,rs485-enabled-at-boot-time; - rs485-rx-during-tx; -- rs485-rts-active-low; - uart-has-rtscts; - status = "okay"; - }; -diff --git a/arch/arm/boot/dts/nxp/vf/vfxxx.dtsi b/arch/arm/boot/dts/nxp/vf/vfxxx.dtsi -index d1095b700c5654..d96148abf5bb6a 100644 ---- a/arch/arm/boot/dts/nxp/vf/vfxxx.dtsi -+++ b/arch/arm/boot/dts/nxp/vf/vfxxx.dtsi -@@ -612,7 +612,7 @@ usbmisc1: usb@400b4800 { - - ftm: ftm@400b8000 { - compatible = "fsl,ftm-timer"; -- reg = <0x400b8000 0x1000 0x400b9000 0x1000>; -+ reg = <0x400b8000 0x1000>, <0x400b9000 0x1000>; - interrupts = <44 IRQ_TYPE_LEVEL_HIGH>; - clock-names = "ftm-evt", "ftm-src", - "ftm-evt-counter-en", "ftm-src-counter-en"; -diff --git a/arch/arm/boot/dts/ti/omap/am335x-boneblack.dts b/arch/arm/boot/dts/ti/omap/am335x-boneblack.dts -index 16b567e3cb4722..b4fdcf9c02b500 100644 ---- a/arch/arm/boot/dts/ti/omap/am335x-boneblack.dts -+++ b/arch/arm/boot/dts/ti/omap/am335x-boneblack.dts -@@ -35,7 +35,7 @@ &gpio0 { - "P9_18 [spi0_d1]", - "P9_17 [spi0_cs0]", - "[mmc0_cd]", -- "P8_42A [ecappwm0]", -+ "P9_42A [ecappwm0]", - "P8_35 [lcd d12]", - "P8_33 [lcd d13]", - "P8_31 [lcd d14]", -diff --git a/arch/arm/crypto/aes-neonbs-glue.c b/arch/arm/crypto/aes-neonbs-glue.c -index 0ca94b90bc4ec5..ba98daeb119cd9 100644 ---- a/arch/arm/crypto/aes-neonbs-glue.c -+++ b/arch/arm/crypto/aes-neonbs-glue.c -@@ -245,7 +245,7 @@ static int ctr_encrypt(struct skcipher_request *req) - while (walk.nbytes > 0) { - const u8 *src = walk.src.virt.addr; - u8 *dst = walk.dst.virt.addr; -- int bytes = walk.nbytes; -+ unsigned int bytes = walk.nbytes; - - if (unlikely(bytes < AES_BLOCK_SIZE)) - src = dst = memcpy(buf + sizeof(buf) - bytes, -diff --git a/arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi -index 8ab0e45f2ad31c..f93c2b604c57fb 100644 ---- a/arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi -+++ b/arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi -@@ -284,6 +284,8 @@ &usdhc3 { - pinctrl-0 = <&pinctrl_usdhc3>; - pinctrl-1 = <&pinctrl_usdhc3_100mhz>; - pinctrl-2 = <&pinctrl_usdhc3_200mhz>; -+ assigned-clocks = <&clk IMX8MM_CLK_USDHC3>; -+ assigned-clock-rates = <400000000>; - bus-width = <8>; - non-removable; - status = "okay"; -diff --git a/arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi -index 1760062e6ffcfd..f5f87b38912345 100644 ---- a/arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi -+++ b/arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi -@@ -295,6 +295,8 @@ &usdhc3 { - pinctrl-0 = <&pinctrl_usdhc3>; - pinctrl-1 = <&pinctrl_usdhc3_100mhz>; - pinctrl-2 = <&pinctrl_usdhc3_200mhz>; -+ assigned-clocks = <&clk IMX8MN_CLK_USDHC3>; -+ assigned-clock-rates = <400000000>; - bus-width = <8>; - non-removable; - status = "okay"; -diff --git a/arch/arm64/boot/dts/qcom/msm8976.dtsi b/arch/arm64/boot/dts/qcom/msm8976.dtsi -index 4c5be22b47feea..e01f6e8a17f2fc 100644 ---- a/arch/arm64/boot/dts/qcom/msm8976.dtsi -+++ b/arch/arm64/boot/dts/qcom/msm8976.dtsi -@@ -862,6 +862,7 @@ blsp1_dma: dma-controller@7884000 { - clock-names = "bam_clk"; - #dma-cells = <1>; - qcom,ee = <0>; -+ qcom,controlled-remotely; - }; - - blsp1_uart1: serial@78af000 { -@@ -982,6 +983,7 @@ blsp2_dma: dma-controller@7ac4000 { - clock-names = "bam_clk"; - #dma-cells = <1>; - qcom,ee = <0>; -+ qcom,controlled-remotely; - }; - - blsp2_uart2: serial@7af0000 { -diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi -index 7758136d71d645..9dc00f759f19bb 100644 ---- a/arch/arm64/boot/dts/qcom/sc7180.dtsi -+++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi -@@ -3435,18 +3435,18 @@ spmi_bus: spmi@c440000 { - #interrupt-cells = <4>; - }; - -- sram@146aa000 { -+ sram@14680000 { - compatible = "qcom,sc7180-imem", "syscon", "simple-mfd"; -- reg = <0 0x146aa000 0 0x2000>; -+ reg = <0 0x14680000 0 0x2e000>; - - #address-cells = <1>; - #size-cells = <1>; - -- ranges = <0 0 0x146aa000 0x2000>; -+ ranges = <0 0 0x14680000 0x2e000>; - -- pil-reloc@94c { -+ pil-reloc@2a94c { - compatible = "qcom,pil-reloc-info"; -- reg = <0x94c 0xc8>; -+ reg = <0x2a94c 0xc8>; - }; - }; - -diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi -index 4ea693a0758565..64ea9d73d970a9 100644 ---- a/arch/arm64/boot/dts/qcom/sdm845.dtsi -+++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi -@@ -4989,18 +4989,18 @@ spmi_bus: spmi@c440000 { - #interrupt-cells = <4>; - }; - -- sram@146bf000 { -+ sram@14680000 { - compatible = "qcom,sdm845-imem", "syscon", "simple-mfd"; -- reg = <0 0x146bf000 0 0x1000>; -+ reg = <0 0x14680000 0 0x40000>; - - #address-cells = <1>; - #size-cells = <1>; - -- ranges = <0 0 0x146bf000 0x1000>; -+ ranges = <0 0 0x14680000 0x40000>; - -- pil-reloc@94c { -+ pil-reloc@3f94c { - compatible = "qcom,pil-reloc-info"; -- reg = <0x94c 0xc8>; -+ reg = <0x3f94c 0xc8>; - }; - }; - -diff --git a/arch/m68k/Kconfig.debug b/arch/m68k/Kconfig.debug -index 30638a6e8edcb3..d036f903864c26 100644 ---- a/arch/m68k/Kconfig.debug -+++ b/arch/m68k/Kconfig.debug -@@ -10,7 +10,7 @@ config BOOTPARAM_STRING - - config EARLY_PRINTK - bool "Early printk" -- depends on !(SUN3 || M68000 || COLDFIRE) -+ depends on MMU_MOTOROLA - help - Write kernel log output directly to a serial port. - Where implemented, output goes to the framebuffer as well. -diff --git a/arch/m68k/kernel/early_printk.c b/arch/m68k/kernel/early_printk.c -index f11ef9f1f56fcf..521cbb8a150c99 100644 ---- a/arch/m68k/kernel/early_printk.c -+++ b/arch/m68k/kernel/early_printk.c -@@ -16,25 +16,10 @@ - #include "../mvme147/mvme147.h" - #include "../mvme16x/mvme16x.h" - --asmlinkage void __init debug_cons_nputs(const char *s, unsigned n); -- --static void __ref debug_cons_write(struct console *c, -- const char *s, unsigned n) --{ --#if !(defined(CONFIG_SUN3) || defined(CONFIG_M68000) || \ -- defined(CONFIG_COLDFIRE)) -- if (MACH_IS_MVME147) -- mvme147_scc_write(c, s, n); -- else if (MACH_IS_MVME16x) -- mvme16x_cons_write(c, s, n); -- else -- debug_cons_nputs(s, n); --#endif --} -+asmlinkage void __init debug_cons_nputs(struct console *c, const char *s, unsigned int n); - - static struct console early_console_instance = { - .name = "debug", -- .write = debug_cons_write, - .flags = CON_PRINTBUFFER | CON_BOOT, - .index = -1 - }; -@@ -44,6 +29,12 @@ static int __init setup_early_printk(char *buf) - if (early_console || buf) - return 0; - -+ if (MACH_IS_MVME147) -+ early_console_instance.write = mvme147_scc_write; -+ else if (MACH_IS_MVME16x) -+ early_console_instance.write = mvme16x_cons_write; -+ else -+ early_console_instance.write = debug_cons_nputs; - early_console = &early_console_instance; - register_console(early_console); - -@@ -51,20 +42,15 @@ static int __init setup_early_printk(char *buf) - } - early_param("earlyprintk", setup_early_printk); - --/* -- * debug_cons_nputs() defined in arch/m68k/kernel/head.S cannot be called -- * after init sections are discarded (for platforms that use it). -- */ --#if !(defined(CONFIG_SUN3) || defined(CONFIG_M68000) || \ -- defined(CONFIG_COLDFIRE)) -- - static int __init unregister_early_console(void) - { -- if (!early_console || MACH_IS_MVME16x) -- return 0; -+ /* -+ * debug_cons_nputs() defined in arch/m68k/kernel/head.S cannot be -+ * called after init sections are discarded (for platforms that use it). -+ */ -+ if (early_console && early_console->write == debug_cons_nputs) -+ return unregister_console(early_console); - -- return unregister_console(early_console); -+ return 0; - } - late_initcall(unregister_early_console); -- --#endif -diff --git a/arch/m68k/kernel/head.S b/arch/m68k/kernel/head.S -index 9e812d8606be83..397114962a1427 100644 ---- a/arch/m68k/kernel/head.S -+++ b/arch/m68k/kernel/head.S -@@ -3267,8 +3267,8 @@ func_return putn - * turns around and calls the internal routines. This routine - * is used by the boot console. - * -- * The calling parameters are: -- * void debug_cons_nputs(const char *str, unsigned length) -+ * The function signature is - -+ * void debug_cons_nputs(struct console *c, const char *s, unsigned int n) - * - * This routine does NOT understand variable arguments only - * simple strings! -@@ -3277,8 +3277,8 @@ ENTRY(debug_cons_nputs) - moveml %d0/%d1/%a0,%sp@- - movew %sr,%sp@- - ori #0x0700,%sr -- movel %sp@(18),%a0 /* fetch parameter */ -- movel %sp@(22),%d1 /* fetch parameter */ -+ movel %sp@(22),%a0 /* char *s */ -+ movel %sp@(26),%d1 /* unsigned int n */ - jra 2f - 1: - #ifdef CONSOLE_DEBUG -diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c -index 93c2d695588a1c..ab8102f94e066f 100644 ---- a/arch/mips/mm/tlb-r4k.c -+++ b/arch/mips/mm/tlb-r4k.c -@@ -506,6 +506,60 @@ static int __init set_ntlb(char *str) - - __setup("ntlb=", set_ntlb); - -+/* Initialise all TLB entries with unique values */ -+static void r4k_tlb_uniquify(void) -+{ -+ int entry = num_wired_entries(); -+ -+ htw_stop(); -+ write_c0_entrylo0(0); -+ write_c0_entrylo1(0); -+ -+ while (entry < current_cpu_data.tlbsize) { -+ unsigned long asid_mask = cpu_asid_mask(¤t_cpu_data); -+ unsigned long asid = 0; -+ int idx; -+ -+ /* Skip wired MMID to make ginvt_mmid work */ -+ if (cpu_has_mmid) -+ asid = MMID_KERNEL_WIRED + 1; -+ -+ /* Check for match before using UNIQUE_ENTRYHI */ -+ do { -+ if (cpu_has_mmid) { -+ write_c0_memorymapid(asid); -+ write_c0_entryhi(UNIQUE_ENTRYHI(entry)); -+ } else { -+ write_c0_entryhi(UNIQUE_ENTRYHI(entry) | asid); -+ } -+ mtc0_tlbw_hazard(); -+ tlb_probe(); -+ tlb_probe_hazard(); -+ idx = read_c0_index(); -+ /* No match or match is on current entry */ -+ if (idx < 0 || idx == entry) -+ break; -+ /* -+ * If we hit a match, we need to try again with -+ * a different ASID. -+ */ -+ asid++; -+ } while (asid < asid_mask); -+ -+ if (idx >= 0 && idx != entry) -+ panic("Unable to uniquify TLB entry %d", idx); -+ -+ write_c0_index(entry); -+ mtc0_tlbw_hazard(); -+ tlb_write_indexed(); -+ entry++; -+ } -+ -+ tlbw_use_hazard(); -+ htw_start(); -+ flush_micro_tlb(); -+} -+ - /* - * Configure TLB (for init or after a CPU has been powered off). - */ -@@ -545,7 +599,7 @@ static void r4k_tlb_configure(void) - temp_tlb_entry = current_cpu_data.tlbsize - 1; - - /* From this point on the ARC firmware is dead. */ -- local_flush_tlb_all(); -+ r4k_tlb_uniquify(); - - /* Did I tell you that ARC SUCKS? */ - } -diff --git a/arch/powerpc/configs/ppc6xx_defconfig b/arch/powerpc/configs/ppc6xx_defconfig -index eaf3273372a982..80989e3f6780fb 100644 ---- a/arch/powerpc/configs/ppc6xx_defconfig -+++ b/arch/powerpc/configs/ppc6xx_defconfig -@@ -254,7 +254,6 @@ CONFIG_NET_SCH_DSMARK=m - CONFIG_NET_SCH_NETEM=m - CONFIG_NET_SCH_INGRESS=m - CONFIG_NET_CLS_BASIC=m --CONFIG_NET_CLS_TCINDEX=m - CONFIG_NET_CLS_ROUTE4=m - CONFIG_NET_CLS_FW=m - CONFIG_NET_CLS_U32=m -diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c -index 2e286bba2f6456..82626363a3090c 100644 ---- a/arch/powerpc/kernel/eeh.c -+++ b/arch/powerpc/kernel/eeh.c -@@ -1130,6 +1130,7 @@ int eeh_unfreeze_pe(struct eeh_pe *pe) - - return ret; - } -+EXPORT_SYMBOL_GPL(eeh_unfreeze_pe); - - - static struct pci_device_id eeh_reset_ids[] = { -diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c -index 438568a472d03b..9ba4adc214af7c 100644 ---- a/arch/powerpc/kernel/eeh_driver.c -+++ b/arch/powerpc/kernel/eeh_driver.c -@@ -257,13 +257,12 @@ static void eeh_pe_report_edev(struct eeh_dev *edev, eeh_report_fn fn, - struct pci_driver *driver; - enum pci_ers_result new_result; - -- pci_lock_rescan_remove(); - pdev = edev->pdev; - if (pdev) - get_device(&pdev->dev); -- pci_unlock_rescan_remove(); - if (!pdev) { - eeh_edev_info(edev, "no device"); -+ *result = PCI_ERS_RESULT_DISCONNECT; - return; - } - device_lock(&pdev->dev); -@@ -304,8 +303,9 @@ static void eeh_pe_report(const char *name, struct eeh_pe *root, - struct eeh_dev *edev, *tmp; - - pr_info("EEH: Beginning: '%s'\n", name); -- eeh_for_each_pe(root, pe) eeh_pe_for_each_dev(pe, edev, tmp) -- eeh_pe_report_edev(edev, fn, result); -+ eeh_for_each_pe(root, pe) -+ eeh_pe_for_each_dev(pe, edev, tmp) -+ eeh_pe_report_edev(edev, fn, result); - if (result) - pr_info("EEH: Finished:'%s' with aggregate recovery state:'%s'\n", - name, pci_ers_result_name(*result)); -@@ -383,6 +383,8 @@ static void eeh_dev_restore_state(struct eeh_dev *edev, void *userdata) - if (!edev) - return; - -+ pci_lock_rescan_remove(); -+ - /* - * The content in the config space isn't saved because - * the blocked config space on some adapters. We have -@@ -393,14 +395,19 @@ static void eeh_dev_restore_state(struct eeh_dev *edev, void *userdata) - if (list_is_last(&edev->entry, &edev->pe->edevs)) - eeh_pe_restore_bars(edev->pe); - -+ pci_unlock_rescan_remove(); - return; - } - - pdev = eeh_dev_to_pci_dev(edev); -- if (!pdev) -+ if (!pdev) { -+ pci_unlock_rescan_remove(); - return; -+ } - - pci_restore_state(pdev); -+ -+ pci_unlock_rescan_remove(); - } - - /** -@@ -647,9 +654,7 @@ static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus, - if (any_passed || driver_eeh_aware || (pe->type & EEH_PE_VF)) { - eeh_pe_dev_traverse(pe, eeh_rmv_device, rmv_data); - } else { -- pci_lock_rescan_remove(); - pci_hp_remove_devices(bus); -- pci_unlock_rescan_remove(); - } - - /* -@@ -665,8 +670,6 @@ static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus, - if (rc) - return rc; - -- pci_lock_rescan_remove(); -- - /* Restore PE */ - eeh_ops->configure_bridge(pe); - eeh_pe_restore_bars(pe); -@@ -674,7 +677,6 @@ static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus, - /* Clear frozen state */ - rc = eeh_clear_pe_frozen_state(pe, false); - if (rc) { -- pci_unlock_rescan_remove(); - return rc; - } - -@@ -709,7 +711,6 @@ static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus, - pe->tstamp = tstamp; - pe->freeze_count = cnt; - -- pci_unlock_rescan_remove(); - return 0; - } - -@@ -843,10 +844,13 @@ void eeh_handle_normal_event(struct eeh_pe *pe) - {LIST_HEAD_INIT(rmv_data.removed_vf_list), 0}; - int devices = 0; - -+ pci_lock_rescan_remove(); -+ - bus = eeh_pe_bus_get(pe); - if (!bus) { - pr_err("%s: Cannot find PCI bus for PHB#%x-PE#%x\n", - __func__, pe->phb->global_number, pe->addr); -+ pci_unlock_rescan_remove(); - return; - } - -@@ -1085,10 +1089,15 @@ void eeh_handle_normal_event(struct eeh_pe *pe) - eeh_pe_state_clear(pe, EEH_PE_PRI_BUS, true); - eeh_pe_dev_mode_mark(pe, EEH_DEV_REMOVED); - -- pci_lock_rescan_remove(); -- pci_hp_remove_devices(bus); -- pci_unlock_rescan_remove(); -+ bus = eeh_pe_bus_get(pe); -+ if (bus) -+ pci_hp_remove_devices(bus); -+ else -+ pr_err("%s: PCI bus for PHB#%x-PE#%x disappeared\n", -+ __func__, pe->phb->global_number, pe->addr); -+ - /* The passed PE should no longer be used */ -+ pci_unlock_rescan_remove(); - return; - } - -@@ -1105,6 +1114,8 @@ void eeh_handle_normal_event(struct eeh_pe *pe) - eeh_clear_slot_attention(edev->pdev); - - eeh_pe_state_clear(pe, EEH_PE_RECOVERING, true); -+ -+ pci_unlock_rescan_remove(); - } - - /** -@@ -1123,6 +1134,7 @@ void eeh_handle_special_event(void) - unsigned long flags; - int rc; - -+ pci_lock_rescan_remove(); - - do { - rc = eeh_ops->next_error(&pe); -@@ -1162,10 +1174,12 @@ void eeh_handle_special_event(void) - - break; - case EEH_NEXT_ERR_NONE: -+ pci_unlock_rescan_remove(); - return; - default: - pr_warn("%s: Invalid value %d from next_error()\n", - __func__, rc); -+ pci_unlock_rescan_remove(); - return; - } - -@@ -1177,7 +1191,9 @@ void eeh_handle_special_event(void) - if (rc == EEH_NEXT_ERR_FROZEN_PE || - rc == EEH_NEXT_ERR_FENCED_PHB) { - eeh_pe_state_mark(pe, EEH_PE_RECOVERING); -+ pci_unlock_rescan_remove(); - eeh_handle_normal_event(pe); -+ pci_lock_rescan_remove(); - } else { - eeh_for_each_pe(pe, tmp_pe) - eeh_pe_for_each_dev(tmp_pe, edev, tmp_edev) -@@ -1190,7 +1206,6 @@ void eeh_handle_special_event(void) - eeh_report_failure, NULL); - eeh_set_channel_state(pe, pci_channel_io_perm_failure); - -- pci_lock_rescan_remove(); - list_for_each_entry(hose, &hose_list, list_node) { - phb_pe = eeh_phb_pe_get(hose); - if (!phb_pe || -@@ -1209,7 +1224,6 @@ void eeh_handle_special_event(void) - } - pci_hp_remove_devices(bus); - } -- pci_unlock_rescan_remove(); - } - - /* -@@ -1219,4 +1233,6 @@ void eeh_handle_special_event(void) - if (rc == EEH_NEXT_ERR_DEAD_IOC) - break; - } while (rc != EEH_NEXT_ERR_NONE); -+ -+ pci_unlock_rescan_remove(); - } -diff --git a/arch/powerpc/kernel/eeh_pe.c b/arch/powerpc/kernel/eeh_pe.c -index 7d1b50599dd6c2..08095aeba5c983 100644 ---- a/arch/powerpc/kernel/eeh_pe.c -+++ b/arch/powerpc/kernel/eeh_pe.c -@@ -671,10 +671,12 @@ static void eeh_bridge_check_link(struct eeh_dev *edev) - eeh_ops->write_config(edev, cap + PCI_EXP_LNKCTL, 2, val); - - /* Check link */ -- if (!edev->pdev->link_active_reporting) { -- eeh_edev_dbg(edev, "No link reporting capability\n"); -- msleep(1000); -- return; -+ if (edev->pdev) { -+ if (!edev->pdev->link_active_reporting) { -+ eeh_edev_dbg(edev, "No link reporting capability\n"); -+ msleep(1000); -+ return; -+ } - } - - /* Wait the link is up until timeout (5s) */ -diff --git a/arch/powerpc/kernel/pci-hotplug.c b/arch/powerpc/kernel/pci-hotplug.c -index 0fe251c6ac2ce7..ac70e85b0df85d 100644 ---- a/arch/powerpc/kernel/pci-hotplug.c -+++ b/arch/powerpc/kernel/pci-hotplug.c -@@ -111,6 +111,9 @@ void pci_hp_add_devices(struct pci_bus *bus) - struct pci_controller *phb; - struct device_node *dn = pci_bus_to_OF_node(bus); - -+ if (!dn) -+ return; -+ - phb = pci_bus_to_host(bus); - - mode = PCI_PROBE_NORMAL; -diff --git a/arch/sh/Makefile b/arch/sh/Makefile -index cab2f9c011a8db..7b420424b6d7c4 100644 ---- a/arch/sh/Makefile -+++ b/arch/sh/Makefile -@@ -103,16 +103,16 @@ UTS_MACHINE := sh - LDFLAGS_vmlinux += -e _stext - - ifdef CONFIG_CPU_LITTLE_ENDIAN --ld-bfd := elf32-sh-linux --LDFLAGS_vmlinux += --defsym jiffies=jiffies_64 --oformat $(ld-bfd) -+ld_bfd := elf32-sh-linux -+LDFLAGS_vmlinux += --defsym jiffies=jiffies_64 --oformat $(ld_bfd) - KBUILD_LDFLAGS += -EL - else --ld-bfd := elf32-shbig-linux --LDFLAGS_vmlinux += --defsym jiffies=jiffies_64+4 --oformat $(ld-bfd) -+ld_bfd := elf32-shbig-linux -+LDFLAGS_vmlinux += --defsym jiffies=jiffies_64+4 --oformat $(ld_bfd) - KBUILD_LDFLAGS += -EB - endif - --export ld-bfd -+export ld_bfd - - # Mach groups - machdir-$(CONFIG_SOLUTION_ENGINE) += mach-se -diff --git a/arch/sh/boot/compressed/Makefile b/arch/sh/boot/compressed/Makefile -index b5e29f99c02c84..5d5b2da2a3f1f9 100644 ---- a/arch/sh/boot/compressed/Makefile -+++ b/arch/sh/boot/compressed/Makefile -@@ -29,7 +29,7 @@ endif - - ccflags-remove-$(CONFIG_MCOUNT) += -pg - --LDFLAGS_vmlinux := --oformat $(ld-bfd) -Ttext $(IMAGE_OFFSET) -e startup \ -+LDFLAGS_vmlinux := --oformat $(ld_bfd) -Ttext $(IMAGE_OFFSET) -e startup \ - -T $(obj)/../../kernel/vmlinux.lds - - KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING -@@ -53,7 +53,7 @@ $(obj)/vmlinux.bin.lzo: $(obj)/vmlinux.bin FORCE - - OBJCOPYFLAGS += -R .empty_zero_page - --LDFLAGS_piggy.o := -r --format binary --oformat $(ld-bfd) -T -+LDFLAGS_piggy.o := -r --format binary --oformat $(ld_bfd) -T - - $(obj)/piggy.o: $(obj)/vmlinux.scr $(obj)/vmlinux.bin.$(suffix_y) FORCE - $(call if_changed,ld) -diff --git a/arch/sh/boot/romimage/Makefile b/arch/sh/boot/romimage/Makefile -index c7c8be58400cd9..17b03df0a8de4d 100644 ---- a/arch/sh/boot/romimage/Makefile -+++ b/arch/sh/boot/romimage/Makefile -@@ -13,7 +13,7 @@ mmcif-obj-$(CONFIG_CPU_SUBTYPE_SH7724) := $(obj)/mmcif-sh7724.o - load-$(CONFIG_ROMIMAGE_MMCIF) := $(mmcif-load-y) - obj-$(CONFIG_ROMIMAGE_MMCIF) := $(mmcif-obj-y) - --LDFLAGS_vmlinux := --oformat $(ld-bfd) -Ttext $(load-y) -e romstart \ -+LDFLAGS_vmlinux := --oformat $(ld_bfd) -Ttext $(load-y) -e romstart \ - -T $(obj)/../../kernel/vmlinux.lds - - $(obj)/vmlinux: $(obj)/head.o $(obj-y) $(obj)/piggy.o FORCE -@@ -24,7 +24,7 @@ OBJCOPYFLAGS += -j .empty_zero_page - $(obj)/zeropage.bin: vmlinux FORCE - $(call if_changed,objcopy) - --LDFLAGS_piggy.o := -r --format binary --oformat $(ld-bfd) -T -+LDFLAGS_piggy.o := -r --format binary --oformat $(ld_bfd) -T - - $(obj)/piggy.o: $(obj)/vmlinux.scr $(obj)/zeropage.bin arch/sh/boot/zImage FORCE - $(call if_changed,ld) -diff --git a/arch/um/drivers/rtc_user.c b/arch/um/drivers/rtc_user.c -index 7c3cec4c68cffe..006a5a164ea91d 100644 ---- a/arch/um/drivers/rtc_user.c -+++ b/arch/um/drivers/rtc_user.c -@@ -28,7 +28,7 @@ int uml_rtc_start(bool timetravel) - int err; - - if (timetravel) { -- int err = os_pipe(uml_rtc_irq_fds, 1, 1); -+ err = os_pipe(uml_rtc_irq_fds, 1, 1); - if (err) - goto fail; - } else { -diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c -index 5616c3b258060e..92c9f8b79f0dc4 100644 ---- a/arch/x86/boot/compressed/sev.c -+++ b/arch/x86/boot/compressed/sev.c -@@ -165,6 +165,13 @@ static void __page_state_change(unsigned long paddr, enum psc_op op) - */ - if (op == SNP_PAGE_STATE_PRIVATE && pvalidate(paddr, RMP_PG_SIZE_4K, 1)) - sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_PVALIDATE); -+ -+ /* -+ * If validating memory (making it private) and affected by the -+ * cache-coherency vulnerability, perform the cache eviction mitigation. -+ */ -+ if (op == SNP_PAGE_STATE_PRIVATE && !has_cpuflag(X86_FEATURE_COHERENCY_SFW_NO)) -+ sev_evict_cache((void *)paddr, 1); - } - - void snp_set_page_private(unsigned long paddr) -diff --git a/arch/x86/boot/cpuflags.c b/arch/x86/boot/cpuflags.c -index d75237ba7ce944..5660d3229d29c2 100644 ---- a/arch/x86/boot/cpuflags.c -+++ b/arch/x86/boot/cpuflags.c -@@ -115,5 +115,18 @@ void get_cpuflags(void) - cpuid(0x80000001, &ignored, &ignored, &cpu.flags[6], - &cpu.flags[1]); - } -+ -+ if (max_amd_level >= 0x8000001f) { -+ u32 ebx; -+ -+ /* -+ * The X86_FEATURE_COHERENCY_SFW_NO feature bit is in -+ * the virtualization flags entry (word 8) and set by -+ * scattered.c, so the bit needs to be explicitly set. -+ */ -+ cpuid(0x8000001f, &ignored, &ebx, &ignored, &ignored); -+ if (ebx & BIT(31)) -+ set_bit(X86_FEATURE_COHERENCY_SFW_NO, cpu.flags); -+ } - } - } -diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h -index 311cc58f29581d..199441d11fbbab 100644 ---- a/arch/x86/include/asm/cpufeatures.h -+++ b/arch/x86/include/asm/cpufeatures.h -@@ -228,6 +228,7 @@ - #define X86_FEATURE_FLEXPRIORITY ( 8*32+ 1) /* Intel FlexPriority */ - #define X86_FEATURE_EPT ( 8*32+ 2) /* Intel Extended Page Table */ - #define X86_FEATURE_VPID ( 8*32+ 3) /* Intel Virtual Processor ID */ -+#define X86_FEATURE_COHERENCY_SFW_NO ( 8*32+ 4) /* "" SNP cache coherency software work around not needed */ - - #define X86_FEATURE_VMMCALL ( 8*32+15) /* Prefer VMMCALL to VMCALL */ - #define X86_FEATURE_XENPV ( 8*32+16) /* "" Xen paravirtual guest */ -diff --git a/arch/x86/kernel/cpu/scattered.c b/arch/x86/kernel/cpu/scattered.c -index 7a42e699f6e39a..8fad19ec855514 100644 ---- a/arch/x86/kernel/cpu/scattered.c -+++ b/arch/x86/kernel/cpu/scattered.c -@@ -46,6 +46,7 @@ static const struct cpuid_bit cpuid_bits[] = { - { X86_FEATURE_CPB, CPUID_EDX, 9, 0x80000007, 0 }, - { X86_FEATURE_PROC_FEEDBACK, CPUID_EDX, 11, 0x80000007, 0 }, - { X86_FEATURE_MBA, CPUID_EBX, 6, 0x80000008, 0 }, -+ { X86_FEATURE_COHERENCY_SFW_NO, CPUID_EBX, 31, 0x8000001f, 0 }, - { X86_FEATURE_SMBA, CPUID_EBX, 2, 0x80000020, 0 }, - { X86_FEATURE_BMEC, CPUID_EBX, 3, 0x80000020, 0 }, - { X86_FEATURE_TSA_SQ_NO, CPUID_ECX, 1, 0x80000021, 0 }, -diff --git a/arch/x86/kernel/sev-shared.c b/arch/x86/kernel/sev-shared.c -index acbec4de3ec31a..b90dfa46ec5b57 100644 ---- a/arch/x86/kernel/sev-shared.c -+++ b/arch/x86/kernel/sev-shared.c -@@ -1068,6 +1068,24 @@ static void __head setup_cpuid_table(const struct cc_blob_sev_info *cc_info) - } - } - -+static inline void sev_evict_cache(void *va, int npages) -+{ -+ volatile u8 val __always_unused; -+ u8 *bytes = va; -+ int page_idx; -+ -+ /* -+ * For SEV guests, a read from the first/last cache-lines of a 4K page -+ * using the guest key is sufficient to cause a flush of all cache-lines -+ * associated with that 4K page without incurring all the overhead of a -+ * full CLFLUSH sequence. -+ */ -+ for (page_idx = 0; page_idx < npages; page_idx++) { -+ val = bytes[page_idx * PAGE_SIZE]; -+ val = bytes[page_idx * PAGE_SIZE + PAGE_SIZE - 1]; -+ } -+} -+ - static void pvalidate_pages(struct snp_psc_desc *desc) - { - struct psc_entry *e; -@@ -1100,6 +1118,24 @@ static void pvalidate_pages(struct snp_psc_desc *desc) - sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_PVALIDATE); - } - } -+ -+ /* -+ * If not affected by the cache-coherency vulnerability there is no need -+ * to perform the cache eviction mitigation. -+ */ -+ if (cpu_feature_enabled(X86_FEATURE_COHERENCY_SFW_NO)) -+ return; -+ -+ for (i = 0; i <= desc->hdr.end_entry; i++) { -+ e = &desc->entries[i]; -+ -+ /* -+ * If validating memory (making it private) perform the cache -+ * eviction mitigation. -+ */ -+ if (e->operation == SNP_PAGE_STATE_PRIVATE) -+ sev_evict_cache(pfn_to_kaddr(e->gfn), e->pagesize ? 512 : 1); -+ } - } - - static int vmgexit_psc(struct ghcb *ghcb, struct snp_psc_desc *desc) -diff --git a/arch/x86/kernel/sev.c b/arch/x86/kernel/sev.c -index 9905dc0e0b0960..c6a9a9d3ff2f37 100644 ---- a/arch/x86/kernel/sev.c -+++ b/arch/x86/kernel/sev.c -@@ -688,12 +688,14 @@ static void __head - early_set_pages_state(unsigned long vaddr, unsigned long paddr, - unsigned long npages, enum psc_op op) - { -- unsigned long paddr_end; -+ unsigned long vaddr_begin, paddr_end; - u64 val; - int ret; - - vaddr = vaddr & PAGE_MASK; - -+ vaddr_begin = vaddr; -+ - paddr = paddr & PAGE_MASK; - paddr_end = paddr + (npages << PAGE_SHIFT); - -@@ -736,6 +738,13 @@ early_set_pages_state(unsigned long vaddr, unsigned long paddr, - paddr += PAGE_SIZE; - } - -+ /* -+ * If validating memory (making it private) and affected by the -+ * cache-coherency vulnerability, perform the cache eviction mitigation. -+ */ -+ if (op == SNP_PAGE_STATE_PRIVATE && !cpu_feature_enabled(X86_FEATURE_COHERENCY_SFW_NO)) -+ sev_evict_cache((void *)vaddr_begin, npages); -+ - return; - - e_term: -diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c -index 2354c0156e51c9..94195d750e65c0 100644 ---- a/arch/x86/mm/extable.c -+++ b/arch/x86/mm/extable.c -@@ -121,13 +121,12 @@ static bool ex_handler_sgx(const struct exception_table_entry *fixup, - static bool ex_handler_fprestore(const struct exception_table_entry *fixup, - struct pt_regs *regs) - { -- regs->ip = ex_fixup_addr(fixup); -- - WARN_ONCE(1, "Bad FPU state detected at %pB, reinitializing FPU registers.", - (void *)instruction_pointer(regs)); - - fpu_reset_from_exception_fixup(); -- return true; -+ -+ return ex_handler_default(fixup, regs); - } - - /* -diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c -index 8c873a8e39cd93..ec6d7a08104d91 100644 ---- a/drivers/block/ublk_drv.c -+++ b/drivers/block/ublk_drv.c -@@ -2030,7 +2030,7 @@ static void ublk_deinit_queues(struct ublk_device *ub) - - for (i = 0; i < nr_queues; i++) - ublk_deinit_queue(ub, i); -- kfree(ub->__queues); -+ kvfree(ub->__queues); - } - - static int ublk_init_queues(struct ublk_device *ub) -@@ -2041,7 +2041,7 @@ static int ublk_init_queues(struct ublk_device *ub) - int i, ret = -ENOMEM; - - ub->queue_size = ubq_size; -- ub->__queues = kcalloc(nr_queues, ubq_size, GFP_KERNEL); -+ ub->__queues = kvcalloc(nr_queues, ubq_size, GFP_KERNEL); - if (!ub->__queues) - return ret; - -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index db507a66fa8acd..1a2d227b7b7b96 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -508,6 +508,10 @@ static const struct usb_device_id quirks_table[] = { - { USB_DEVICE(0x13d3, 0x3549), .driver_info = BTUSB_REALTEK | - BTUSB_WIDEBAND_SPEECH }, - -+ /* Realtek 8851BU Bluetooth devices */ -+ { USB_DEVICE(0x3625, 0x010b), .driver_info = BTUSB_REALTEK | -+ BTUSB_WIDEBAND_SPEECH }, -+ - /* Realtek 8852AE Bluetooth devices */ - { USB_DEVICE(0x0bda, 0x2852), .driver_info = BTUSB_REALTEK | - BTUSB_WIDEBAND_SPEECH }, -diff --git a/drivers/char/hw_random/mtk-rng.c b/drivers/char/hw_random/mtk-rng.c -index 1e3048f2bb38f0..6c4e40d0365f00 100644 ---- a/drivers/char/hw_random/mtk-rng.c -+++ b/drivers/char/hw_random/mtk-rng.c -@@ -142,7 +142,9 @@ static int mtk_rng_probe(struct platform_device *pdev) - dev_set_drvdata(&pdev->dev, priv); - pm_runtime_set_autosuspend_delay(&pdev->dev, RNG_AUTOSUSPEND_TIMEOUT); - pm_runtime_use_autosuspend(&pdev->dev); -- devm_pm_runtime_enable(&pdev->dev); -+ ret = devm_pm_runtime_enable(&pdev->dev); -+ if (ret) -+ return ret; - - dev_info(&pdev->dev, "registered RNG driver\n"); - -diff --git a/drivers/clk/clk-axi-clkgen.c b/drivers/clk/clk-axi-clkgen.c -index 934e53a96dddac..00bf799964c61a 100644 ---- a/drivers/clk/clk-axi-clkgen.c -+++ b/drivers/clk/clk-axi-clkgen.c -@@ -118,7 +118,7 @@ static const struct axi_clkgen_limits axi_clkgen_zynqmp_default_limits = { - - static const struct axi_clkgen_limits axi_clkgen_zynq_default_limits = { - .fpfd_min = 10000, -- .fpfd_max = 300000, -+ .fpfd_max = 450000, - .fvco_min = 600000, - .fvco_max = 1200000, - }; -diff --git a/drivers/clk/davinci/psc.c b/drivers/clk/davinci/psc.c -index cd85d9f158b0c2..6f7b8f082ad307 100644 ---- a/drivers/clk/davinci/psc.c -+++ b/drivers/clk/davinci/psc.c -@@ -278,6 +278,11 @@ davinci_lpsc_clk_register(struct device *dev, const char *name, - - lpsc->pm_domain.name = devm_kasprintf(dev, GFP_KERNEL, "%s: %s", - best_dev_name(dev), name); -+ if (!lpsc->pm_domain.name) { -+ clk_hw_unregister(&lpsc->hw); -+ kfree(lpsc); -+ return ERR_PTR(-ENOMEM); -+ } - lpsc->pm_domain.attach_dev = davinci_psc_genpd_attach_dev; - lpsc->pm_domain.detach_dev = davinci_psc_genpd_detach_dev; - lpsc->pm_domain.flags = GENPD_FLAG_PM_CLK; -diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c -index f3ce8664b2883b..b05553faed6d14 100644 ---- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c -+++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c -@@ -347,8 +347,7 @@ static SUNXI_CCU_GATE(dram_ohci_clk, "dram-ohci", "dram", - - static const char * const de_parents[] = { "pll-video", "pll-periph0" }; - static SUNXI_CCU_M_WITH_MUX_GATE(de_clk, "de", de_parents, -- 0x104, 0, 4, 24, 2, BIT(31), -- CLK_SET_RATE_PARENT); -+ 0x104, 0, 4, 24, 3, BIT(31), 0); - - static const char * const tcon_parents[] = { "pll-video" }; - static SUNXI_CCU_M_WITH_MUX_GATE(tcon_clk, "tcon", tcon_parents, -diff --git a/drivers/clk/xilinx/xlnx_vcu.c b/drivers/clk/xilinx/xlnx_vcu.c -index 60a3ed7c7263bf..299332818ba3e2 100644 ---- a/drivers/clk/xilinx/xlnx_vcu.c -+++ b/drivers/clk/xilinx/xlnx_vcu.c -@@ -587,8 +587,8 @@ static void xvcu_unregister_clock_provider(struct xvcu_device *xvcu) - xvcu_clk_hw_unregister_leaf(hws[CLK_XVCU_ENC_MCU]); - if (!IS_ERR_OR_NULL(hws[CLK_XVCU_ENC_CORE])) - xvcu_clk_hw_unregister_leaf(hws[CLK_XVCU_ENC_CORE]); -- -- clk_hw_unregister_fixed_factor(xvcu->pll_post); -+ if (!IS_ERR_OR_NULL(xvcu->pll_post)) -+ clk_hw_unregister_fixed_factor(xvcu->pll_post); - } - - /** -diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c -index 6682f422cadd90..cc98d8cf543303 100644 ---- a/drivers/cpufreq/cpufreq.c -+++ b/drivers/cpufreq/cpufreq.c -@@ -1287,6 +1287,8 @@ static struct cpufreq_policy *cpufreq_policy_alloc(unsigned int cpu) - goto err_free_real_cpus; - } - -+ init_rwsem(&policy->rwsem); -+ - freq_constraints_init(&policy->constraints); - - policy->nb_min.notifier_call = cpufreq_notifier_min; -@@ -1309,7 +1311,6 @@ static struct cpufreq_policy *cpufreq_policy_alloc(unsigned int cpu) - } - - INIT_LIST_HEAD(&policy->policy_list); -- init_rwsem(&policy->rwsem); - spin_lock_init(&policy->transition_lock); - init_waitqueue_head(&policy->transition_wait); - INIT_WORK(&policy->update, handle_update); -@@ -2938,15 +2939,6 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) - cpufreq_driver = driver_data; - write_unlock_irqrestore(&cpufreq_driver_lock, flags); - -- /* -- * Mark support for the scheduler's frequency invariance engine for -- * drivers that implement target(), target_index() or fast_switch(). -- */ -- if (!cpufreq_driver->setpolicy) { -- static_branch_enable_cpuslocked(&cpufreq_freq_invariance); -- pr_debug("supports frequency invariance"); -- } -- - if (driver_data->setpolicy) - driver_data->flags |= CPUFREQ_CONST_LOOPS; - -@@ -2977,6 +2969,15 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) - hp_online = ret; - ret = 0; - -+ /* -+ * Mark support for the scheduler's frequency invariance engine for -+ * drivers that implement target(), target_index() or fast_switch(). -+ */ -+ if (!cpufreq_driver->setpolicy) { -+ static_branch_enable_cpuslocked(&cpufreq_freq_invariance); -+ pr_debug("supports frequency invariance"); -+ } -+ - pr_debug("driver %s up and running\n", driver_data->name); - goto out; - -diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c -index 8a4fdf212ce0de..4f1206ff0a10e9 100644 ---- a/drivers/cpufreq/intel_pstate.c -+++ b/drivers/cpufreq/intel_pstate.c -@@ -2902,8 +2902,8 @@ static int intel_cpufreq_update_pstate(struct cpufreq_policy *policy, - int max_pstate = policy->strict_target ? - target_pstate : cpu->max_perf_ratio; - -- intel_cpufreq_hwp_update(cpu, target_pstate, max_pstate, 0, -- fast_switch); -+ intel_cpufreq_hwp_update(cpu, target_pstate, max_pstate, -+ target_pstate, fast_switch); - } else if (target_pstate != old_pstate) { - intel_cpufreq_perf_ctl_update(cpu, target_pstate, fast_switch); - } -diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c -index 70434601f99bed..9e093d44a06629 100644 ---- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c -+++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c -@@ -265,8 +265,8 @@ static int sun8i_ce_cipher_prepare(struct crypto_engine *engine, void *async_req - } - - chan->timeout = areq->cryptlen; -- rctx->nr_sgs = nr_sgs; -- rctx->nr_sgd = nr_sgd; -+ rctx->nr_sgs = ns; -+ rctx->nr_sgd = nd; - return 0; - - theend_sgs: -diff --git a/drivers/crypto/ccp/ccp-debugfs.c b/drivers/crypto/ccp/ccp-debugfs.c -index a1055554b47a24..dc26bc22c91d1d 100644 ---- a/drivers/crypto/ccp/ccp-debugfs.c -+++ b/drivers/crypto/ccp/ccp-debugfs.c -@@ -319,5 +319,8 @@ void ccp5_debugfs_setup(struct ccp_device *ccp) - - void ccp5_debugfs_destroy(void) - { -+ mutex_lock(&ccp_debugfs_lock); - debugfs_remove_recursive(ccp_debugfs_dir); -+ ccp_debugfs_dir = NULL; -+ mutex_unlock(&ccp_debugfs_lock); - } -diff --git a/drivers/crypto/img-hash.c b/drivers/crypto/img-hash.c -index 45063693859c01..de80c95309e627 100644 ---- a/drivers/crypto/img-hash.c -+++ b/drivers/crypto/img-hash.c -@@ -436,7 +436,7 @@ static int img_hash_write_via_dma_stop(struct img_hash_dev *hdev) - struct img_hash_request_ctx *ctx = ahash_request_ctx(hdev->req); - - if (ctx->flags & DRIVER_FLAGS_SG) -- dma_unmap_sg(hdev->dev, ctx->sg, ctx->dma_ct, DMA_TO_DEVICE); -+ dma_unmap_sg(hdev->dev, ctx->sg, 1, DMA_TO_DEVICE); - - return 0; - } -diff --git a/drivers/crypto/inside-secure/safexcel_hash.c b/drivers/crypto/inside-secure/safexcel_hash.c -index f44c08f5f5ec4a..af4b978189e519 100644 ---- a/drivers/crypto/inside-secure/safexcel_hash.c -+++ b/drivers/crypto/inside-secure/safexcel_hash.c -@@ -249,7 +249,9 @@ static int safexcel_handle_req_result(struct safexcel_crypto_priv *priv, - safexcel_complete(priv, ring); - - if (sreq->nents) { -- dma_unmap_sg(priv->dev, areq->src, sreq->nents, DMA_TO_DEVICE); -+ dma_unmap_sg(priv->dev, areq->src, -+ sg_nents_for_len(areq->src, areq->nbytes), -+ DMA_TO_DEVICE); - sreq->nents = 0; - } - -@@ -497,7 +499,9 @@ static int safexcel_ahash_send_req(struct crypto_async_request *async, int ring, - DMA_FROM_DEVICE); - unmap_sg: - if (req->nents) { -- dma_unmap_sg(priv->dev, areq->src, req->nents, DMA_TO_DEVICE); -+ dma_unmap_sg(priv->dev, areq->src, -+ sg_nents_for_len(areq->src, areq->nbytes), -+ DMA_TO_DEVICE); - req->nents = 0; - } - cdesc_rollback: -diff --git a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c -index daba8ca05dbe42..b7322230353998 100644 ---- a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c -+++ b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c -@@ -68,6 +68,7 @@ struct ocs_hcu_ctx { - * @sg_data_total: Total data in the SG list at any time. - * @sg_data_offset: Offset into the data of the current individual SG node. - * @sg_dma_nents: Number of sg entries mapped in dma_list. -+ * @nents: Number of entries in the scatterlist. - */ - struct ocs_hcu_rctx { - struct ocs_hcu_dev *hcu_dev; -@@ -91,6 +92,7 @@ struct ocs_hcu_rctx { - unsigned int sg_data_total; - unsigned int sg_data_offset; - unsigned int sg_dma_nents; -+ unsigned int nents; - }; - - /** -@@ -199,7 +201,7 @@ static void kmb_ocs_hcu_dma_cleanup(struct ahash_request *req, - - /* Unmap req->src (if mapped). */ - if (rctx->sg_dma_nents) { -- dma_unmap_sg(dev, req->src, rctx->sg_dma_nents, DMA_TO_DEVICE); -+ dma_unmap_sg(dev, req->src, rctx->nents, DMA_TO_DEVICE); - rctx->sg_dma_nents = 0; - } - -@@ -260,6 +262,10 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req) - rc = -ENOMEM; - goto cleanup; - } -+ -+ /* Save the value of nents to pass to dma_unmap_sg. */ -+ rctx->nents = nents; -+ - /* - * The value returned by dma_map_sg() can be < nents; so update - * nents accordingly. -diff --git a/drivers/crypto/intel/qat/qat_common/adf_transport_debug.c b/drivers/crypto/intel/qat/qat_common/adf_transport_debug.c -index e2dd568b87b519..621b5d3dfcef91 100644 ---- a/drivers/crypto/intel/qat/qat_common/adf_transport_debug.c -+++ b/drivers/crypto/intel/qat/qat_common/adf_transport_debug.c -@@ -31,8 +31,10 @@ static void *adf_ring_next(struct seq_file *sfile, void *v, loff_t *pos) - struct adf_etr_ring_data *ring = sfile->private; - - if (*pos >= (ADF_SIZE_TO_RING_SIZE_IN_BYTES(ring->ring_size) / -- ADF_MSG_SIZE_TO_BYTES(ring->msg_size))) -+ ADF_MSG_SIZE_TO_BYTES(ring->msg_size))) { -+ (*pos)++; - return NULL; -+ } - - return ring->base_addr + - (ADF_MSG_SIZE_TO_BYTES(ring->msg_size) * (*pos)++); -diff --git a/drivers/crypto/intel/qat/qat_common/qat_bl.c b/drivers/crypto/intel/qat/qat_common/qat_bl.c -index 76baed0a76c0ee..0d2ce20db6d86d 100644 ---- a/drivers/crypto/intel/qat/qat_common/qat_bl.c -+++ b/drivers/crypto/intel/qat/qat_common/qat_bl.c -@@ -38,7 +38,7 @@ void qat_bl_free_bufl(struct adf_accel_dev *accel_dev, - for (i = 0; i < blout->num_mapped_bufs; i++) { - dma_unmap_single(dev, blout->buffers[i].addr, - blout->buffers[i].len, -- DMA_FROM_DEVICE); -+ DMA_BIDIRECTIONAL); - } - dma_unmap_single(dev, blpout, sz_out, DMA_TO_DEVICE); - -@@ -160,7 +160,7 @@ static int __qat_bl_sgl_to_bufl(struct adf_accel_dev *accel_dev, - } - buffers[y].addr = dma_map_single(dev, sg_virt(sg) + left, - sg->length - left, -- DMA_FROM_DEVICE); -+ DMA_BIDIRECTIONAL); - if (unlikely(dma_mapping_error(dev, buffers[y].addr))) - goto err_out; - buffers[y].len = sg->length; -@@ -202,7 +202,7 @@ static int __qat_bl_sgl_to_bufl(struct adf_accel_dev *accel_dev, - if (!dma_mapping_error(dev, buflout->buffers[i].addr)) - dma_unmap_single(dev, buflout->buffers[i].addr, - buflout->buffers[i].len, -- DMA_FROM_DEVICE); -+ DMA_BIDIRECTIONAL); - } - - if (!buf->sgl_dst_valid) -diff --git a/drivers/crypto/intel/qat/qat_common/qat_compression.c b/drivers/crypto/intel/qat/qat_common/qat_compression.c -index 7842a9f22178c2..cf94ba3011d51b 100644 ---- a/drivers/crypto/intel/qat/qat_common/qat_compression.c -+++ b/drivers/crypto/intel/qat/qat_common/qat_compression.c -@@ -197,7 +197,7 @@ static int qat_compression_alloc_dc_data(struct adf_accel_dev *accel_dev) - struct adf_dc_data *dc_data = NULL; - u8 *obuff = NULL; - -- dc_data = devm_kzalloc(dev, sizeof(*dc_data), GFP_KERNEL); -+ dc_data = kzalloc_node(sizeof(*dc_data), GFP_KERNEL, dev_to_node(dev)); - if (!dc_data) - goto err; - -@@ -205,7 +205,7 @@ static int qat_compression_alloc_dc_data(struct adf_accel_dev *accel_dev) - if (!obuff) - goto err; - -- obuff_p = dma_map_single(dev, obuff, ovf_buff_sz, DMA_FROM_DEVICE); -+ obuff_p = dma_map_single(dev, obuff, ovf_buff_sz, DMA_BIDIRECTIONAL); - if (unlikely(dma_mapping_error(dev, obuff_p))) - goto err; - -@@ -233,9 +233,9 @@ static void qat_free_dc_data(struct adf_accel_dev *accel_dev) - return; - - dma_unmap_single(dev, dc_data->ovf_buff_p, dc_data->ovf_buff_sz, -- DMA_FROM_DEVICE); -+ DMA_BIDIRECTIONAL); - kfree_sensitive(dc_data->ovf_buff); -- devm_kfree(dev, dc_data); -+ kfree(dc_data); - accel_dev->dc_data = NULL; - } - -diff --git a/drivers/crypto/marvell/cesa/cipher.c b/drivers/crypto/marvell/cesa/cipher.c -index 3876e3ce822f44..eabed9d977df6c 100644 ---- a/drivers/crypto/marvell/cesa/cipher.c -+++ b/drivers/crypto/marvell/cesa/cipher.c -@@ -75,9 +75,12 @@ mv_cesa_skcipher_dma_cleanup(struct skcipher_request *req) - static inline void mv_cesa_skcipher_cleanup(struct skcipher_request *req) - { - struct mv_cesa_skcipher_req *creq = skcipher_request_ctx(req); -+ struct mv_cesa_engine *engine = creq->base.engine; - - if (mv_cesa_req_get_type(&creq->base) == CESA_DMA_REQ) - mv_cesa_skcipher_dma_cleanup(req); -+ -+ atomic_sub(req->cryptlen, &engine->load); - } - - static void mv_cesa_skcipher_std_step(struct skcipher_request *req) -@@ -212,7 +215,6 @@ mv_cesa_skcipher_complete(struct crypto_async_request *req) - struct mv_cesa_engine *engine = creq->base.engine; - unsigned int ivsize; - -- atomic_sub(skreq->cryptlen, &engine->load); - ivsize = crypto_skcipher_ivsize(crypto_skcipher_reqtfm(skreq)); - - if (mv_cesa_req_get_type(&creq->base) == CESA_DMA_REQ) { -diff --git a/drivers/crypto/marvell/cesa/hash.c b/drivers/crypto/marvell/cesa/hash.c -index 6815eddc906812..e339ce7ad53310 100644 ---- a/drivers/crypto/marvell/cesa/hash.c -+++ b/drivers/crypto/marvell/cesa/hash.c -@@ -110,9 +110,12 @@ static inline void mv_cesa_ahash_dma_cleanup(struct ahash_request *req) - static inline void mv_cesa_ahash_cleanup(struct ahash_request *req) - { - struct mv_cesa_ahash_req *creq = ahash_request_ctx(req); -+ struct mv_cesa_engine *engine = creq->base.engine; - - if (mv_cesa_req_get_type(&creq->base) == CESA_DMA_REQ) - mv_cesa_ahash_dma_cleanup(req); -+ -+ atomic_sub(req->nbytes, &engine->load); - } - - static void mv_cesa_ahash_last_cleanup(struct ahash_request *req) -@@ -395,8 +398,6 @@ static void mv_cesa_ahash_complete(struct crypto_async_request *req) - } - } - } -- -- atomic_sub(ahashreq->nbytes, &engine->load); - } - - static void mv_cesa_ahash_prepare(struct crypto_async_request *req, -diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c -index 49c542ecccde3b..7b991bbef4895a 100644 ---- a/drivers/devfreq/devfreq.c -+++ b/drivers/devfreq/devfreq.c -@@ -1382,15 +1382,11 @@ int devfreq_remove_governor(struct devfreq_governor *governor) - int ret; - struct device *dev = devfreq->dev.parent; - -+ if (!devfreq->governor) -+ continue; -+ - if (!strncmp(devfreq->governor->name, governor->name, - DEVFREQ_NAME_LEN)) { -- /* we should have a devfreq governor! */ -- if (!devfreq->governor) { -- dev_warn(dev, "%s: Governor %s NOT present\n", -- __func__, governor->name); -- continue; -- /* Fall through */ -- } - ret = devfreq->governor->event_handler(devfreq, - DEVFREQ_GOV_STOP, NULL); - if (ret) { -diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c -index ea48661e87ea70..ca0ba1d462832d 100644 ---- a/drivers/dma/mv_xor.c -+++ b/drivers/dma/mv_xor.c -@@ -1061,8 +1061,16 @@ mv_xor_channel_add(struct mv_xor_device *xordev, - */ - mv_chan->dummy_src_addr = dma_map_single(dma_dev->dev, - mv_chan->dummy_src, MV_XOR_MIN_BYTE_COUNT, DMA_FROM_DEVICE); -+ if (dma_mapping_error(dma_dev->dev, mv_chan->dummy_src_addr)) -+ return ERR_PTR(-ENOMEM); -+ - mv_chan->dummy_dst_addr = dma_map_single(dma_dev->dev, - mv_chan->dummy_dst, MV_XOR_MIN_BYTE_COUNT, DMA_TO_DEVICE); -+ if (dma_mapping_error(dma_dev->dev, mv_chan->dummy_dst_addr)) { -+ ret = -ENOMEM; -+ goto err_unmap_src; -+ } -+ - - /* allocate coherent memory for hardware descriptors - * note: writecombine gives slightly better performance, but -@@ -1071,8 +1079,10 @@ mv_xor_channel_add(struct mv_xor_device *xordev, - mv_chan->dma_desc_pool_virt = - dma_alloc_wc(&pdev->dev, MV_XOR_POOL_SIZE, &mv_chan->dma_desc_pool, - GFP_KERNEL); -- if (!mv_chan->dma_desc_pool_virt) -- return ERR_PTR(-ENOMEM); -+ if (!mv_chan->dma_desc_pool_virt) { -+ ret = -ENOMEM; -+ goto err_unmap_dst; -+ } - - /* discover transaction capabilites from the platform data */ - dma_dev->cap_mask = cap_mask; -@@ -1155,6 +1165,13 @@ mv_xor_channel_add(struct mv_xor_device *xordev, - err_free_dma: - dma_free_coherent(&pdev->dev, MV_XOR_POOL_SIZE, - mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool); -+err_unmap_dst: -+ dma_unmap_single(dma_dev->dev, mv_chan->dummy_dst_addr, -+ MV_XOR_MIN_BYTE_COUNT, DMA_TO_DEVICE); -+err_unmap_src: -+ dma_unmap_single(dma_dev->dev, mv_chan->dummy_src_addr, -+ MV_XOR_MIN_BYTE_COUNT, DMA_FROM_DEVICE); -+ - return ERR_PTR(ret); - } - -diff --git a/drivers/dma/nbpfaxi.c b/drivers/dma/nbpfaxi.c -index a361f8c29cd38d..69c80d9339033f 100644 ---- a/drivers/dma/nbpfaxi.c -+++ b/drivers/dma/nbpfaxi.c -@@ -711,6 +711,9 @@ static int nbpf_desc_page_alloc(struct nbpf_channel *chan) - list_add_tail(&ldesc->node, &lhead); - ldesc->hwdesc_dma_addr = dma_map_single(dchan->device->dev, - hwdesc, sizeof(*hwdesc), DMA_TO_DEVICE); -+ if (dma_mapping_error(dchan->device->dev, -+ ldesc->hwdesc_dma_addr)) -+ goto unmap_error; - - dev_dbg(dev, "%s(): mapped 0x%p to %pad\n", __func__, - hwdesc, &ldesc->hwdesc_dma_addr); -@@ -737,6 +740,16 @@ static int nbpf_desc_page_alloc(struct nbpf_channel *chan) - spin_unlock_irq(&chan->lock); - - return ARRAY_SIZE(dpage->desc); -+ -+unmap_error: -+ while (i--) { -+ ldesc--; hwdesc--; -+ -+ dma_unmap_single(dchan->device->dev, ldesc->hwdesc_dma_addr, -+ sizeof(hwdesc), DMA_TO_DEVICE); -+ } -+ -+ return -ENOMEM; - } - - static void nbpf_desc_put(struct nbpf_desc *desc) -diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu_helper.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu_helper.c -index 79a566f3564a57..c305ea4ec17d21 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu_helper.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu_helper.c -@@ -149,7 +149,7 @@ int phm_wait_on_indirect_register(struct pp_hwmgr *hwmgr, - } - - cgs_write_register(hwmgr->device, indirect_port, index); -- return phm_wait_on_register(hwmgr, indirect_port + 1, mask, value); -+ return phm_wait_on_register(hwmgr, indirect_port + 1, value, mask); - } - - int phm_wait_for_register_unequal(struct pp_hwmgr *hwmgr, -diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h -index 427dec0cd1d36d..b77ecec50733bc 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h -@@ -378,6 +378,7 @@ static const struct dpu_perf_cfg sc8180x_perf_data = { - .min_core_ib = 2400000, - .min_llcc_ib = 800000, - .min_dram_ib = 800000, -+ .min_prefill_lines = 24, - .danger_lut_tbl = {0xf, 0xffff, 0x0}, - .safe_lut_tbl = {0xfff0, 0xf000, 0xffff}, - .qos_lut_tbl = { -diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_fb.c b/drivers/gpu/drm/rockchip/rockchip_drm_fb.c -index cfe8b793d34467..69ab8d4f289cd8 100644 ---- a/drivers/gpu/drm/rockchip/rockchip_drm_fb.c -+++ b/drivers/gpu/drm/rockchip/rockchip_drm_fb.c -@@ -52,16 +52,9 @@ rockchip_fb_create(struct drm_device *dev, struct drm_file *file, - } - - if (drm_is_afbc(mode_cmd->modifier[0])) { -- int ret, i; -- - ret = drm_gem_fb_afbc_init(dev, mode_cmd, afbc_fb); - if (ret) { -- struct drm_gem_object **obj = afbc_fb->base.obj; -- -- for (i = 0; i < info->num_planes; ++i) -- drm_gem_object_put(obj[i]); -- -- kfree(afbc_fb); -+ drm_framebuffer_put(&afbc_fb->base); - return ERR_PTR(ret); - } - } -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c -index 7fb1c88bcc475f..69dfe69ce0f87d 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c -@@ -896,7 +896,7 @@ int vmw_compat_shader_add(struct vmw_private *dev_priv, - .busy_domain = VMW_BO_DOMAIN_SYS, - .bo_type = ttm_bo_type_device, - .size = size, -- .pin = true, -+ .pin = false, - .keep_resv = true, - }; - -diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c -index 85f8fd6a21ec4d..956803ba6c1e1b 100644 ---- a/drivers/i2c/busses/i2c-stm32f7.c -+++ b/drivers/i2c/busses/i2c-stm32f7.c -@@ -726,10 +726,11 @@ static void stm32f7_i2c_disable_dma_req(struct stm32f7_i2c_dev *i2c_dev) - - static void stm32f7_i2c_dma_callback(void *arg) - { -- struct stm32f7_i2c_dev *i2c_dev = (struct stm32f7_i2c_dev *)arg; -+ struct stm32f7_i2c_dev *i2c_dev = arg; - struct stm32_i2c_dma *dma = i2c_dev->dma; - - stm32f7_i2c_disable_dma_req(i2c_dev); -+ dmaengine_terminate_async(dma->chan_using); - dma_unmap_single(i2c_dev->dev, dma->dma_buf, dma->dma_len, - dma->dma_data_dir); - complete(&dma->dma_complete); -@@ -1496,17 +1497,11 @@ static irqreturn_t stm32f7_i2c_slave_isr_event(struct stm32f7_i2c_dev *i2c_dev) - static irqreturn_t stm32f7_i2c_isr_event(int irq, void *data) - { - struct stm32f7_i2c_dev *i2c_dev = data; -- struct stm32f7_i2c_msg *f7_msg = &i2c_dev->f7_msg; -- struct stm32_i2c_dma *dma = i2c_dev->dma; -- void __iomem *base = i2c_dev->base; -- u32 status, mask; -- int ret = IRQ_HANDLED; -+ u32 status; - -- /* Check if the interrupt if for a slave device */ -- if (!i2c_dev->master_mode) { -- ret = stm32f7_i2c_slave_isr_event(i2c_dev); -- return ret; -- } -+ /* Check if the interrupt is for a slave device */ -+ if (!i2c_dev->master_mode) -+ return IRQ_WAKE_THREAD; - - status = readl_relaxed(i2c_dev->base + STM32F7_I2C_ISR); - -@@ -1518,45 +1513,59 @@ static irqreturn_t stm32f7_i2c_isr_event(int irq, void *data) - if (status & STM32F7_I2C_ISR_RXNE) - stm32f7_i2c_read_rx_data(i2c_dev); - -+ /* Wake up the thread if other flags are raised */ -+ if (status & -+ (STM32F7_I2C_ISR_NACKF | STM32F7_I2C_ISR_STOPF | -+ STM32F7_I2C_ISR_TC | STM32F7_I2C_ISR_TCR)) -+ return IRQ_WAKE_THREAD; -+ -+ return IRQ_HANDLED; -+} -+ -+static irqreturn_t stm32f7_i2c_isr_event_thread(int irq, void *data) -+{ -+ struct stm32f7_i2c_dev *i2c_dev = data; -+ struct stm32f7_i2c_msg *f7_msg = &i2c_dev->f7_msg; -+ void __iomem *base = i2c_dev->base; -+ u32 status, mask; -+ int ret; -+ -+ if (!i2c_dev->master_mode) -+ return stm32f7_i2c_slave_isr_event(i2c_dev); -+ -+ status = readl_relaxed(i2c_dev->base + STM32F7_I2C_ISR); -+ - /* NACK received */ - if (status & STM32F7_I2C_ISR_NACKF) { - dev_dbg(i2c_dev->dev, "<%s>: Receive NACK (addr %x)\n", - __func__, f7_msg->addr); - writel_relaxed(STM32F7_I2C_ICR_NACKCF, base + STM32F7_I2C_ICR); -- if (i2c_dev->use_dma) { -- stm32f7_i2c_disable_dma_req(i2c_dev); -- dmaengine_terminate_async(dma->chan_using); -- } -+ if (i2c_dev->use_dma) -+ stm32f7_i2c_dma_callback(i2c_dev); - f7_msg->result = -ENXIO; - } - -- /* STOP detection flag */ -- if (status & STM32F7_I2C_ISR_STOPF) { -- /* Disable interrupts */ -- if (stm32f7_i2c_is_slave_registered(i2c_dev)) -- mask = STM32F7_I2C_XFER_IRQ_MASK; -+ if (status & STM32F7_I2C_ISR_TCR) { -+ if (f7_msg->smbus) -+ stm32f7_i2c_smbus_reload(i2c_dev); - else -- mask = STM32F7_I2C_ALL_IRQ_MASK; -- stm32f7_i2c_disable_irq(i2c_dev, mask); -- -- /* Clear STOP flag */ -- writel_relaxed(STM32F7_I2C_ICR_STOPCF, base + STM32F7_I2C_ICR); -- -- if (i2c_dev->use_dma && !f7_msg->result) { -- ret = IRQ_WAKE_THREAD; -- } else { -- i2c_dev->master_mode = false; -- complete(&i2c_dev->complete); -- } -+ stm32f7_i2c_reload(i2c_dev); - } - - /* Transfer complete */ - if (status & STM32F7_I2C_ISR_TC) { -+ /* Wait for dma transfer completion before sending next message */ -+ if (i2c_dev->use_dma && !f7_msg->result) { -+ ret = wait_for_completion_timeout(&i2c_dev->dma->dma_complete, HZ); -+ if (!ret) { -+ dev_dbg(i2c_dev->dev, "<%s>: Timed out\n", __func__); -+ stm32f7_i2c_dma_callback(i2c_dev); -+ f7_msg->result = -ETIMEDOUT; -+ } -+ } - if (f7_msg->stop) { - mask = STM32F7_I2C_CR2_STOP; - stm32f7_i2c_set_bits(base + STM32F7_I2C_CR2, mask); -- } else if (i2c_dev->use_dma && !f7_msg->result) { -- ret = IRQ_WAKE_THREAD; - } else if (f7_msg->smbus) { - stm32f7_i2c_smbus_rep_start(i2c_dev); - } else { -@@ -1566,47 +1575,18 @@ static irqreturn_t stm32f7_i2c_isr_event(int irq, void *data) - } - } - -- if (status & STM32F7_I2C_ISR_TCR) { -- if (f7_msg->smbus) -- stm32f7_i2c_smbus_reload(i2c_dev); -+ /* STOP detection flag */ -+ if (status & STM32F7_I2C_ISR_STOPF) { -+ /* Disable interrupts */ -+ if (stm32f7_i2c_is_slave_registered(i2c_dev)) -+ mask = STM32F7_I2C_XFER_IRQ_MASK; - else -- stm32f7_i2c_reload(i2c_dev); -- } -- -- return ret; --} -- --static irqreturn_t stm32f7_i2c_isr_event_thread(int irq, void *data) --{ -- struct stm32f7_i2c_dev *i2c_dev = data; -- struct stm32f7_i2c_msg *f7_msg = &i2c_dev->f7_msg; -- struct stm32_i2c_dma *dma = i2c_dev->dma; -- u32 status; -- int ret; -- -- /* -- * Wait for dma transfer completion before sending next message or -- * notity the end of xfer to the client -- */ -- ret = wait_for_completion_timeout(&i2c_dev->dma->dma_complete, HZ); -- if (!ret) { -- dev_dbg(i2c_dev->dev, "<%s>: Timed out\n", __func__); -- stm32f7_i2c_disable_dma_req(i2c_dev); -- dmaengine_terminate_async(dma->chan_using); -- f7_msg->result = -ETIMEDOUT; -- } -+ mask = STM32F7_I2C_ALL_IRQ_MASK; -+ stm32f7_i2c_disable_irq(i2c_dev, mask); - -- status = readl_relaxed(i2c_dev->base + STM32F7_I2C_ISR); -+ /* Clear STOP flag */ -+ writel_relaxed(STM32F7_I2C_ICR_STOPCF, base + STM32F7_I2C_ICR); - -- if (status & STM32F7_I2C_ISR_TC) { -- if (f7_msg->smbus) { -- stm32f7_i2c_smbus_rep_start(i2c_dev); -- } else { -- i2c_dev->msg_id++; -- i2c_dev->msg++; -- stm32f7_i2c_xfer_msg(i2c_dev, i2c_dev->msg); -- } -- } else { - i2c_dev->master_mode = false; - complete(&i2c_dev->complete); - } -@@ -1614,21 +1594,20 @@ static irqreturn_t stm32f7_i2c_isr_event_thread(int irq, void *data) - return IRQ_HANDLED; - } - --static irqreturn_t stm32f7_i2c_isr_error(int irq, void *data) -+static irqreturn_t stm32f7_i2c_isr_error_thread(int irq, void *data) - { - struct stm32f7_i2c_dev *i2c_dev = data; - struct stm32f7_i2c_msg *f7_msg = &i2c_dev->f7_msg; -+ u16 addr = f7_msg->addr; - void __iomem *base = i2c_dev->base; - struct device *dev = i2c_dev->dev; -- struct stm32_i2c_dma *dma = i2c_dev->dma; - u32 status; - - status = readl_relaxed(i2c_dev->base + STM32F7_I2C_ISR); - - /* Bus error */ - if (status & STM32F7_I2C_ISR_BERR) { -- dev_err(dev, "<%s>: Bus error accessing addr 0x%x\n", -- __func__, f7_msg->addr); -+ dev_err(dev, "Bus error accessing addr 0x%x\n", addr); - writel_relaxed(STM32F7_I2C_ICR_BERRCF, base + STM32F7_I2C_ICR); - stm32f7_i2c_release_bus(&i2c_dev->adap); - f7_msg->result = -EIO; -@@ -1636,21 +1615,19 @@ static irqreturn_t stm32f7_i2c_isr_error(int irq, void *data) - - /* Arbitration loss */ - if (status & STM32F7_I2C_ISR_ARLO) { -- dev_dbg(dev, "<%s>: Arbitration loss accessing addr 0x%x\n", -- __func__, f7_msg->addr); -+ dev_dbg(dev, "Arbitration loss accessing addr 0x%x\n", addr); - writel_relaxed(STM32F7_I2C_ICR_ARLOCF, base + STM32F7_I2C_ICR); - f7_msg->result = -EAGAIN; - } - - if (status & STM32F7_I2C_ISR_PECERR) { -- dev_err(dev, "<%s>: PEC error in reception accessing addr 0x%x\n", -- __func__, f7_msg->addr); -+ dev_err(dev, "PEC error in reception accessing addr 0x%x\n", addr); - writel_relaxed(STM32F7_I2C_ICR_PECCF, base + STM32F7_I2C_ICR); - f7_msg->result = -EINVAL; - } - - if (status & STM32F7_I2C_ISR_ALERT) { -- dev_dbg(dev, "<%s>: SMBus alert received\n", __func__); -+ dev_dbg(dev, "SMBus alert received\n"); - writel_relaxed(STM32F7_I2C_ICR_ALERTCF, base + STM32F7_I2C_ICR); - i2c_handle_smbus_alert(i2c_dev->alert->ara); - return IRQ_HANDLED; -@@ -1667,10 +1644,8 @@ static irqreturn_t stm32f7_i2c_isr_error(int irq, void *data) - } - - /* Disable dma */ -- if (i2c_dev->use_dma) { -- stm32f7_i2c_disable_dma_req(i2c_dev); -- dmaengine_terminate_async(dma->chan_using); -- } -+ if (i2c_dev->use_dma) -+ stm32f7_i2c_dma_callback(i2c_dev); - - i2c_dev->master_mode = false; - complete(&i2c_dev->complete); -@@ -2177,23 +2152,16 @@ static int stm32f7_i2c_probe(struct platform_device *pdev) - i2c_dev->wakeup_src = of_property_read_bool(pdev->dev.of_node, - "wakeup-source"); - -- i2c_dev->clk = devm_clk_get(&pdev->dev, NULL); -+ i2c_dev->clk = devm_clk_get_enabled(&pdev->dev, NULL); - if (IS_ERR(i2c_dev->clk)) - return dev_err_probe(&pdev->dev, PTR_ERR(i2c_dev->clk), -- "Failed to get controller clock\n"); -- -- ret = clk_prepare_enable(i2c_dev->clk); -- if (ret) { -- dev_err(&pdev->dev, "Failed to prepare_enable clock\n"); -- return ret; -- } -+ "Failed to enable controller clock\n"); - - rst = devm_reset_control_get(&pdev->dev, NULL); -- if (IS_ERR(rst)) { -- ret = dev_err_probe(&pdev->dev, PTR_ERR(rst), -- "Error: Missing reset ctrl\n"); -- goto clk_free; -- } -+ if (IS_ERR(rst)) -+ return dev_err_probe(&pdev->dev, PTR_ERR(rst), -+ "Error: Missing reset ctrl\n"); -+ - reset_control_assert(rst); - udelay(2); - reset_control_deassert(rst); -@@ -2205,40 +2173,36 @@ static int stm32f7_i2c_probe(struct platform_device *pdev) - stm32f7_i2c_isr_event_thread, - IRQF_ONESHOT, - pdev->name, i2c_dev); -- if (ret) { -- dev_err(&pdev->dev, "Failed to request irq event %i\n", -- irq_event); -- goto clk_free; -- } -+ if (ret) -+ return dev_err_probe(&pdev->dev, ret, "Failed to request irq event\n"); - -- ret = devm_request_irq(&pdev->dev, irq_error, stm32f7_i2c_isr_error, 0, -- pdev->name, i2c_dev); -- if (ret) { -- dev_err(&pdev->dev, "Failed to request irq error %i\n", -- irq_error); -- goto clk_free; -- } -+ ret = devm_request_threaded_irq(&pdev->dev, irq_error, -+ NULL, -+ stm32f7_i2c_isr_error_thread, -+ IRQF_ONESHOT, -+ pdev->name, i2c_dev); -+ if (ret) -+ return dev_err_probe(&pdev->dev, ret, "Failed to request irq error\n"); - - setup = of_device_get_match_data(&pdev->dev); - if (!setup) { - dev_err(&pdev->dev, "Can't get device data\n"); -- ret = -ENODEV; -- goto clk_free; -+ return -ENODEV; - } - i2c_dev->setup = *setup; - - ret = stm32f7_i2c_setup_timing(i2c_dev, &i2c_dev->setup); - if (ret) -- goto clk_free; -+ return ret; - - /* Setup Fast mode plus if necessary */ - if (i2c_dev->bus_rate > I2C_MAX_FAST_MODE_FREQ) { - ret = stm32f7_i2c_setup_fm_plus_bits(pdev, i2c_dev); - if (ret) -- goto clk_free; -+ return ret; - ret = stm32f7_i2c_write_fm_plus_bits(i2c_dev, true); - if (ret) -- goto clk_free; -+ return ret; - } - - adap = &i2c_dev->adap; -@@ -2349,9 +2313,6 @@ static int stm32f7_i2c_probe(struct platform_device *pdev) - fmp_clear: - stm32f7_i2c_write_fm_plus_bits(i2c_dev, false); - --clk_free: -- clk_disable_unprepare(i2c_dev->clk); -- - return ret; - } - -@@ -2385,8 +2346,6 @@ static void stm32f7_i2c_remove(struct platform_device *pdev) - } - - stm32f7_i2c_write_fm_plus_bits(i2c_dev, false); -- -- clk_disable_unprepare(i2c_dev->clk); - } - - static int __maybe_unused stm32f7_i2c_runtime_suspend(struct device *dev) -diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c -index b010c4209ea381..29ad2f5ffabe20 100644 ---- a/drivers/infiniband/hw/erdma/erdma_verbs.c -+++ b/drivers/infiniband/hw/erdma/erdma_verbs.c -@@ -585,7 +585,8 @@ static struct erdma_mtt *erdma_create_cont_mtt(struct erdma_dev *dev, - static void erdma_destroy_mtt_buf_sg(struct erdma_dev *dev, - struct erdma_mtt *mtt) - { -- dma_unmap_sg(&dev->pdev->dev, mtt->sglist, mtt->nsg, DMA_TO_DEVICE); -+ dma_unmap_sg(&dev->pdev->dev, mtt->sglist, -+ DIV_ROUND_UP(mtt->size, PAGE_SIZE), DMA_TO_DEVICE); - vfree(mtt->sglist); - } - -diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -index 9d23d4b5c1285f..4a10b826d15a38 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -@@ -5192,11 +5192,10 @@ static int hns_roce_v2_modify_qp(struct ib_qp *ibqp, - { - struct hns_roce_dev *hr_dev = to_hr_dev(ibqp->device); - struct hns_roce_qp *hr_qp = to_hr_qp(ibqp); -- struct hns_roce_v2_qp_context ctx[2]; -- struct hns_roce_v2_qp_context *context = ctx; -- struct hns_roce_v2_qp_context *qpc_mask = ctx + 1; -+ struct hns_roce_v2_qp_context *context; -+ struct hns_roce_v2_qp_context *qpc_mask; - struct ib_device *ibdev = &hr_dev->ib_dev; -- int ret; -+ int ret = -ENOMEM; - - if (attr_mask & ~IB_QP_ATTR_STANDARD_BITS) - return -EOPNOTSUPP; -@@ -5207,7 +5206,11 @@ static int hns_roce_v2_modify_qp(struct ib_qp *ibqp, - * we should set all bits of the relevant fields in context mask to - * 0 at the same time, else set them to 0x1. - */ -- memset(context, 0, hr_dev->caps.qpc_sz); -+ context = kvzalloc(sizeof(*context), GFP_KERNEL); -+ qpc_mask = kvzalloc(sizeof(*qpc_mask), GFP_KERNEL); -+ if (!context || !qpc_mask) -+ goto out; -+ - memset(qpc_mask, 0xff, hr_dev->caps.qpc_sz); - - ret = hns_roce_v2_set_abs_fields(ibqp, attr, attr_mask, cur_state, -@@ -5249,6 +5252,8 @@ static int hns_roce_v2_modify_qp(struct ib_qp *ibqp, - clear_qp(hr_qp); - - out: -+ kvfree(qpc_mask); -+ kvfree(context); - return ret; - } - -diff --git a/drivers/infiniband/hw/mlx5/dm.c b/drivers/infiniband/hw/mlx5/dm.c -index 3669c90b2dadc6..672e5cfd2fca5d 100644 ---- a/drivers/infiniband/hw/mlx5/dm.c -+++ b/drivers/infiniband/hw/mlx5/dm.c -@@ -282,7 +282,7 @@ static struct ib_dm *handle_alloc_dm_memic(struct ib_ucontext *ctx, - int err; - u64 address; - -- if (!MLX5_CAP_DEV_MEM(dm_db->dev, memic)) -+ if (!dm_db || !MLX5_CAP_DEV_MEM(dm_db->dev, memic)) - return ERR_PTR(-EOPNOTSUPP); - - dm = kzalloc(sizeof(*dm), GFP_KERNEL); -diff --git a/drivers/interconnect/qcom/sc8180x.c b/drivers/interconnect/qcom/sc8180x.c -index a741badaa966e0..4dd1d2f2e82162 100644 ---- a/drivers/interconnect/qcom/sc8180x.c -+++ b/drivers/interconnect/qcom/sc8180x.c -@@ -1492,34 +1492,40 @@ static struct qcom_icc_bcm bcm_sh3 = { - - static struct qcom_icc_bcm bcm_sn0 = { - .name = "SN0", -+ .num_nodes = 1, - .nodes = { &slv_qns_gemnoc_sf } - }; - - static struct qcom_icc_bcm bcm_sn1 = { - .name = "SN1", -+ .num_nodes = 1, - .nodes = { &slv_qxs_imem } - }; - - static struct qcom_icc_bcm bcm_sn2 = { - .name = "SN2", - .keepalive = true, -+ .num_nodes = 1, - .nodes = { &slv_qns_gemnoc_gc } - }; - - static struct qcom_icc_bcm bcm_co2 = { - .name = "CO2", -+ .num_nodes = 1, - .nodes = { &mas_qnm_npu } - }; - - static struct qcom_icc_bcm bcm_sn3 = { - .name = "SN3", - .keepalive = true, -+ .num_nodes = 2, - .nodes = { &slv_srvc_aggre1_noc, - &slv_qns_cnoc } - }; - - static struct qcom_icc_bcm bcm_sn4 = { - .name = "SN4", -+ .num_nodes = 1, - .nodes = { &slv_qxs_pimem } - }; - -diff --git a/drivers/interconnect/qcom/sc8280xp.c b/drivers/interconnect/qcom/sc8280xp.c -index 0270f6c64481a9..c646cdf8a19bf6 100644 ---- a/drivers/interconnect/qcom/sc8280xp.c -+++ b/drivers/interconnect/qcom/sc8280xp.c -@@ -48,6 +48,7 @@ static struct qcom_icc_node qnm_a1noc_cfg = { - .id = SC8280XP_MASTER_A1NOC_CFG, - .channels = 1, - .buswidth = 4, -+ .num_links = 1, - .links = { SC8280XP_SLAVE_SERVICE_A1NOC }, - }; - -diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c -index a5d6d786dba523..23cfb98fe90a7b 100644 ---- a/drivers/iommu/amd/iommu.c -+++ b/drivers/iommu/amd/iommu.c -@@ -2159,8 +2159,21 @@ static inline u64 dma_max_address(void) - if (amd_iommu_pgtable == AMD_IOMMU_V1) - return ~0ULL; - -- /* V2 with 4/5 level page table */ -- return ((1ULL << PM_LEVEL_SHIFT(amd_iommu_gpt_level)) - 1); -+ /* -+ * V2 with 4/5 level page table. Note that "2.2.6.5 AMD64 4-Kbyte Page -+ * Translation" shows that the V2 table sign extends the top of the -+ * address space creating a reserved region in the middle of the -+ * translation, just like the CPU does. Further Vasant says the docs are -+ * incomplete and this only applies to non-zero PASIDs. If the AMDv2 -+ * page table is assigned to the 0 PASID then there is no sign extension -+ * check. -+ * -+ * Since the IOMMU must have a fixed geometry, and the core code does -+ * not understand sign extended addressing, we have to chop off the high -+ * bit to get consistent behavior with attachments of the domain to any -+ * PASID. -+ */ -+ return ((1ULL << (PM_LEVEL_SHIFT(amd_iommu_gpt_level) - 1)) - 1); - } - - static struct iommu_domain *amd_iommu_domain_alloc(unsigned type) -diff --git a/drivers/irqchip/Kconfig b/drivers/irqchip/Kconfig -index e7b736800dd023..4ff91df7694783 100644 ---- a/drivers/irqchip/Kconfig -+++ b/drivers/irqchip/Kconfig -@@ -483,6 +483,7 @@ config IMX_MU_MSI - tristate "i.MX MU used as MSI controller" - depends on OF && HAS_IOMEM - depends on ARCH_MXC || COMPILE_TEST -+ depends on ARM || ARM64 - default m if ARCH_MXC - select IRQ_DOMAIN - select IRQ_DOMAIN_HIERARCHY -diff --git a/drivers/md/md.c b/drivers/md/md.c -index ca7ae3aad2655f..b086cbf2408690 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -9465,8 +9465,8 @@ void md_check_recovery(struct mddev *mddev) - * remove disk. - */ - rdev_for_each_safe(rdev, tmp, mddev) { -- if (test_and_clear_bit(ClusterRemove, &rdev->flags) && -- rdev->raid_disk < 0) -+ if (rdev->raid_disk < 0 && -+ test_and_clear_bit(ClusterRemove, &rdev->flags)) - md_kick_rdev_from_array(rdev); - } - } -@@ -9813,8 +9813,11 @@ static void check_sb_changes(struct mddev *mddev, struct md_rdev *rdev) - - /* Check for change of roles in the active devices */ - rdev_for_each_safe(rdev2, tmp, mddev) { -- if (test_bit(Faulty, &rdev2->flags)) -+ if (test_bit(Faulty, &rdev2->flags)) { -+ if (test_bit(ClusterRemove, &rdev2->flags)) -+ set_bit(MD_RECOVERY_NEEDED, &mddev->recovery); - continue; -+ } - - /* Check if the roles changed */ - role = le16_to_cpu(sb->dev_roles[rdev2->desc_nr]); -diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-core/v4l2-ctrls-core.c -index a662fb60f73f42..84fbf4e06cd33c 100644 ---- a/drivers/media/v4l2-core/v4l2-ctrls-core.c -+++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c -@@ -894,12 +894,12 @@ static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx, - - p_h264_sps->flags &= - ~V4L2_H264_SPS_FLAG_QPPRIME_Y_ZERO_TRANSFORM_BYPASS; -- -- if (p_h264_sps->chroma_format_idc < 3) -- p_h264_sps->flags &= -- ~V4L2_H264_SPS_FLAG_SEPARATE_COLOUR_PLANE; - } - -+ if (p_h264_sps->chroma_format_idc < 3) -+ p_h264_sps->flags &= -+ ~V4L2_H264_SPS_FLAG_SEPARATE_COLOUR_PLANE; -+ - if (p_h264_sps->flags & V4L2_H264_SPS_FLAG_FRAME_MBS_ONLY) - p_h264_sps->flags &= - ~V4L2_H264_SPS_FLAG_MB_ADAPTIVE_FRAME_FIELD; -diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c -index 8c22064ead3870..f2bd1984609ccc 100644 ---- a/drivers/mtd/ftl.c -+++ b/drivers/mtd/ftl.c -@@ -344,7 +344,7 @@ static int erase_xfer(partition_t *part, - return -ENOMEM; - - erase->addr = xfer->Offset; -- erase->len = 1 << part->header.EraseUnitSize; -+ erase->len = 1ULL << part->header.EraseUnitSize; - - ret = mtd_erase(part->mbd.mtd, erase); - if (!ret) { -diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c -index 3f494f7c7ecbdb..d4fd1302008ebd 100644 ---- a/drivers/mtd/nand/raw/atmel/nand-controller.c -+++ b/drivers/mtd/nand/raw/atmel/nand-controller.c -@@ -373,7 +373,7 @@ static int atmel_nand_dma_transfer(struct atmel_nand_controller *nc, - dma_cookie_t cookie; - - buf_dma = dma_map_single(nc->dev, buf, len, dir); -- if (dma_mapping_error(nc->dev, dev_dma)) { -+ if (dma_mapping_error(nc->dev, buf_dma)) { - dev_err(nc->dev, - "Failed to prepare a buffer for DMA access\n"); - goto err; -diff --git a/drivers/mtd/nand/raw/atmel/pmecc.c b/drivers/mtd/nand/raw/atmel/pmecc.c -index 3c7dee1be21df1..0b402823b619cf 100644 ---- a/drivers/mtd/nand/raw/atmel/pmecc.c -+++ b/drivers/mtd/nand/raw/atmel/pmecc.c -@@ -143,6 +143,7 @@ struct atmel_pmecc_caps { - int nstrengths; - int el_offset; - bool correct_erased_chunks; -+ bool clk_ctrl; - }; - - struct atmel_pmecc { -@@ -843,6 +844,10 @@ static struct atmel_pmecc *atmel_pmecc_create(struct platform_device *pdev, - if (IS_ERR(pmecc->regs.errloc)) - return ERR_CAST(pmecc->regs.errloc); - -+ /* pmecc data setup time */ -+ if (caps->clk_ctrl) -+ writel(PMECC_CLK_133MHZ, pmecc->regs.base + ATMEL_PMECC_CLK); -+ - /* Disable all interrupts before registering the PMECC handler. */ - writel(0xffffffff, pmecc->regs.base + ATMEL_PMECC_IDR); - atmel_pmecc_reset(pmecc); -@@ -896,6 +901,7 @@ static struct atmel_pmecc_caps at91sam9g45_caps = { - .strengths = atmel_pmecc_strengths, - .nstrengths = 5, - .el_offset = 0x8c, -+ .clk_ctrl = true, - }; - - static struct atmel_pmecc_caps sama5d4_caps = { -diff --git a/drivers/mtd/nand/raw/rockchip-nand-controller.c b/drivers/mtd/nand/raw/rockchip-nand-controller.c -index 2a95dd63b8c203..f68600ce5bfad4 100644 ---- a/drivers/mtd/nand/raw/rockchip-nand-controller.c -+++ b/drivers/mtd/nand/raw/rockchip-nand-controller.c -@@ -656,9 +656,16 @@ static int rk_nfc_write_page_hwecc(struct nand_chip *chip, const u8 *buf, - - dma_data = dma_map_single(nfc->dev, (void *)nfc->page_buf, - mtd->writesize, DMA_TO_DEVICE); -+ if (dma_mapping_error(nfc->dev, dma_data)) -+ return -ENOMEM; -+ - dma_oob = dma_map_single(nfc->dev, nfc->oob_buf, - ecc->steps * oob_step, - DMA_TO_DEVICE); -+ if (dma_mapping_error(nfc->dev, dma_oob)) { -+ dma_unmap_single(nfc->dev, dma_data, mtd->writesize, DMA_TO_DEVICE); -+ return -ENOMEM; -+ } - - reinit_completion(&nfc->done); - writel(INT_DMA, nfc->regs + nfc->cfg->int_en_off); -@@ -772,9 +779,17 @@ static int rk_nfc_read_page_hwecc(struct nand_chip *chip, u8 *buf, int oob_on, - dma_data = dma_map_single(nfc->dev, nfc->page_buf, - mtd->writesize, - DMA_FROM_DEVICE); -+ if (dma_mapping_error(nfc->dev, dma_data)) -+ return -ENOMEM; -+ - dma_oob = dma_map_single(nfc->dev, nfc->oob_buf, - ecc->steps * oob_step, - DMA_FROM_DEVICE); -+ if (dma_mapping_error(nfc->dev, dma_oob)) { -+ dma_unmap_single(nfc->dev, dma_data, mtd->writesize, -+ DMA_FROM_DEVICE); -+ return -ENOMEM; -+ } - - /* - * The first blocks (4, 8 or 16 depending on the device) -diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c -index 73b448cd00f29f..0b74b79b08f0a2 100644 ---- a/drivers/net/can/kvaser_pciefd.c -+++ b/drivers/net/can/kvaser_pciefd.c -@@ -927,6 +927,7 @@ static int kvaser_pciefd_setup_can_ctrls(struct kvaser_pciefd *pcie) - can->err_rep_cnt = 0; - can->bec.txerr = 0; - can->bec.rxerr = 0; -+ can->can.dev->dev_port = i; - - init_completion(&can->start_comp); - init_completion(&can->flush_comp); -diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c -index 15f28b6fe758ee..022b5b79247c5d 100644 ---- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c -+++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c -@@ -856,6 +856,7 @@ static int kvaser_usb_init_one(struct kvaser_usb *dev, int channel) - } - SET_NETDEV_DEV(netdev, &dev->intf->dev); - netdev->dev_id = channel; -+ netdev->dev_port = channel; - - dev->nets[channel] = priv; - -diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c -index 4d85b29a17b787..ebefc274b50a5f 100644 ---- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c -+++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c -@@ -49,7 +49,7 @@ struct __packed pcan_ufd_fw_info { - __le32 ser_no; /* S/N */ - __le32 flags; /* special functions */ - -- /* extended data when type == PCAN_USBFD_TYPE_EXT */ -+ /* extended data when type >= PCAN_USBFD_TYPE_EXT */ - u8 cmd_out_ep; /* ep for cmd */ - u8 cmd_in_ep; /* ep for replies */ - u8 data_out_ep[2]; /* ep for CANx TX */ -@@ -982,10 +982,11 @@ static int pcan_usb_fd_init(struct peak_usb_device *dev) - dev->can.ctrlmode |= CAN_CTRLMODE_FD_NON_ISO; - } - -- /* if vendor rsp is of type 2, then it contains EP numbers to -- * use for cmds pipes. If not, then default EP should be used. -+ /* if vendor rsp type is greater than or equal to 2, then it -+ * contains EP numbers to use for cmds pipes. If not, then -+ * default EP should be used. - */ -- if (fw_info->type != cpu_to_le16(PCAN_USBFD_TYPE_EXT)) { -+ if (le16_to_cpu(fw_info->type) < PCAN_USBFD_TYPE_EXT) { - fw_info->cmd_out_ep = PCAN_USBPRO_EP_CMDOUT; - fw_info->cmd_in_ep = PCAN_USBPRO_EP_CMDIN; - } -@@ -1018,11 +1019,11 @@ static int pcan_usb_fd_init(struct peak_usb_device *dev) - dev->can_channel_id = - le32_to_cpu(pdev->usb_if->fw_info.dev_id[dev->ctrl_idx]); - -- /* if vendor rsp is of type 2, then it contains EP numbers to -- * use for data pipes. If not, then statically defined EP are used -- * (see peak_usb_create_dev()). -+ /* if vendor rsp type is greater than or equal to 2, then it contains EP -+ * numbers to use for data pipes. If not, then statically defined EP are -+ * used (see peak_usb_create_dev()). - */ -- if (fw_info->type == cpu_to_le16(PCAN_USBFD_TYPE_EXT)) { -+ if (le16_to_cpu(fw_info->type) >= PCAN_USBFD_TYPE_EXT) { - dev->ep_msg_in = fw_info->data_in_ep; - dev->ep_msg_out = fw_info->data_out_ep[dev->ctrl_idx]; - } -diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c -index a89aa4ac0a064a..779f1324bb5f82 100644 ---- a/drivers/net/ethernet/emulex/benet/be_cmds.c -+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c -@@ -3852,8 +3852,8 @@ int be_cmd_set_mac_list(struct be_adapter *adapter, u8 *mac_array, - status = be_mcc_notify_wait(adapter); - - err: -- dma_free_coherent(&adapter->pdev->dev, cmd.size, cmd.va, cmd.dma); - spin_unlock_bh(&adapter->mcc_lock); -+ dma_free_coherent(&adapter->pdev->dev, cmd.size, cmd.va, cmd.dma); - return status; - } - -diff --git a/drivers/net/ethernet/intel/fm10k/fm10k.h b/drivers/net/ethernet/intel/fm10k/fm10k.h -index 6119a410883815..65a2816142d962 100644 ---- a/drivers/net/ethernet/intel/fm10k/fm10k.h -+++ b/drivers/net/ethernet/intel/fm10k/fm10k.h -@@ -189,13 +189,14 @@ struct fm10k_q_vector { - struct fm10k_ring_container rx, tx; - - struct napi_struct napi; -+ struct rcu_head rcu; /* to avoid race with update stats on free */ -+ - cpumask_t affinity_mask; - char name[IFNAMSIZ + 9]; - - #ifdef CONFIG_DEBUG_FS - struct dentry *dbg_q_vector; - #endif /* CONFIG_DEBUG_FS */ -- struct rcu_head rcu; /* to avoid race with update stats on free */ - - /* for dynamic allocation of rings associated with this q_vector */ - struct fm10k_ring ring[] ____cacheline_internodealigned_in_smp; -diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h -index 68f403dd2f5267..9fb7c5fe05d15f 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e.h -+++ b/drivers/net/ethernet/intel/i40e/i40e.h -@@ -953,6 +953,7 @@ struct i40e_q_vector { - u16 reg_idx; /* register index of the interrupt */ - - struct napi_struct napi; -+ struct rcu_head rcu; /* to avoid race with update stats on free */ - - struct i40e_ring_container rx; - struct i40e_ring_container tx; -@@ -963,7 +964,6 @@ struct i40e_q_vector { - cpumask_t affinity_mask; - struct irq_affinity_notify affinity_notify; - -- struct rcu_head rcu; /* to avoid race with update stats on free */ - char name[I40E_INT_NAME_STR_LEN]; - bool arm_wb_state; - bool in_busy_poll; -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe.h b/drivers/net/ethernet/intel/ixgbe/ixgbe.h -index b6f0376e42f4b5..d15182657cead9 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe.h -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe.h -@@ -503,9 +503,10 @@ struct ixgbe_q_vector { - struct ixgbe_ring_container rx, tx; - - struct napi_struct napi; -+ struct rcu_head rcu; /* to avoid race with update stats on free */ -+ - cpumask_t affinity_mask; - int numa_node; -- struct rcu_head rcu; /* to avoid race with update stats on free */ - char name[IFNAMSIZ + 9]; - - /* for dynamic allocation of rings associated with this q_vector */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c -index 8e25f4ef5cccee..5ae787656a7ca0 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c -@@ -331,6 +331,9 @@ static int port_set_buffer(struct mlx5e_priv *priv, - if (err) - goto out; - -+ /* RO bits should be set to 0 on write */ -+ MLX5_SET(pbmc_reg, in, port_buffer_size, 0); -+ - err = mlx5e_port_set_pbmc(mdev, in); - out: - kfree(in); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c -index 51a144246ea623..f96e9bbf8fc69c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c -@@ -333,6 +333,10 @@ void mlx5e_ipsec_offload_handle_rx_skb(struct net_device *netdev, - if (unlikely(!sa_entry)) { - rcu_read_unlock(); - atomic64_inc(&ipsec->sw_stats.ipsec_rx_drop_sadb_miss); -+ /* Clear secpath to prevent invalid dereference -+ * in downstream XFRM policy checks. -+ */ -+ secpath_reset(skb); - return; - } - xfrm_state_hold(sa_entry->x); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -index d5731f7be04fd1..8278395ee20a01 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -@@ -1573,6 +1573,7 @@ static inline void mlx5e_build_rx_skb(struct mlx5_cqe64 *cqe, - unsigned int hdrlen = mlx5e_lro_update_hdr(skb, cqe, cqe_bcnt); - - skb_shinfo(skb)->gso_size = DIV_ROUND_UP(cqe_bcnt - hdrlen, lro_num_seg); -+ skb_shinfo(skb)->gso_segs = lro_num_seg; - /* Subtract one since we already counted this as one - * "regular" packet in mlx5e_complete_rx_cqe() - */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c -index 9482e51ac82a58..bdbbfaf504d988 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c -@@ -28,7 +28,7 @@ struct mlx5_dm *mlx5_dm_create(struct mlx5_core_dev *dev) - - dm = kzalloc(sizeof(*dm), GFP_KERNEL); - if (!dm) -- return ERR_PTR(-ENOMEM); -+ return NULL; - - spin_lock_init(&dm->lock); - -@@ -80,7 +80,7 @@ struct mlx5_dm *mlx5_dm_create(struct mlx5_core_dev *dev) - err_steering: - kfree(dm); - -- return ERR_PTR(-ENOMEM); -+ return NULL; - } - - void mlx5_dm_cleanup(struct mlx5_core_dev *dev) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index 32fa789a696056..62a85f09b52fd7 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -1055,9 +1055,6 @@ static int mlx5_init_once(struct mlx5_core_dev *dev) - } - - dev->dm = mlx5_dm_create(dev); -- if (IS_ERR(dev->dm)) -- mlx5_core_warn(dev, "Failed to init device memory %ld\n", PTR_ERR(dev->dm)); -- - dev->tracer = mlx5_fw_tracer_create(dev); - dev->hv_vhca = mlx5_hv_vhca_create(dev); - dev->rsc_dump = mlx5_rsc_dump_create(dev); -diff --git a/drivers/net/ipa/ipa_sysfs.c b/drivers/net/ipa/ipa_sysfs.c -index 2ff09ce343b73a..2e676b9d4042de 100644 ---- a/drivers/net/ipa/ipa_sysfs.c -+++ b/drivers/net/ipa/ipa_sysfs.c -@@ -38,8 +38,12 @@ static const char *ipa_version_string(struct ipa *ipa) - return "4.11"; - case IPA_VERSION_5_0: - return "5.0"; -+ case IPA_VERSION_5_1: -+ return "5.1"; -+ case IPA_VERSION_5_5: -+ return "5.5"; - default: -- return "0.0"; /* Won't happen (checked at probe time) */ -+ return "0.0"; /* Should not happen */ - } - } - -diff --git a/drivers/net/phy/mscc/mscc_ptp.c b/drivers/net/phy/mscc/mscc_ptp.c -index 7e7ce79eadffb9..d0bd6ab45ebed7 100644 ---- a/drivers/net/phy/mscc/mscc_ptp.c -+++ b/drivers/net/phy/mscc/mscc_ptp.c -@@ -897,6 +897,7 @@ static int vsc85xx_eth1_conf(struct phy_device *phydev, enum ts_blk blk, - get_unaligned_be32(ptp_multicast)); - } else { - val |= ANA_ETH1_FLOW_ADDR_MATCH2_ANY_MULTICAST; -+ val |= ANA_ETH1_FLOW_ADDR_MATCH2_ANY_UNICAST; - vsc85xx_ts_write_csr(phydev, blk, - MSCC_ANA_ETH1_FLOW_ADDR_MATCH2(0), val); - vsc85xx_ts_write_csr(phydev, blk, -diff --git a/drivers/net/phy/mscc/mscc_ptp.h b/drivers/net/phy/mscc/mscc_ptp.h -index da3465360e9018..ae9ad925bfa8c0 100644 ---- a/drivers/net/phy/mscc/mscc_ptp.h -+++ b/drivers/net/phy/mscc/mscc_ptp.h -@@ -98,6 +98,7 @@ - #define MSCC_ANA_ETH1_FLOW_ADDR_MATCH2(x) (MSCC_ANA_ETH1_FLOW_ENA(x) + 3) - #define ANA_ETH1_FLOW_ADDR_MATCH2_MASK_MASK GENMASK(22, 20) - #define ANA_ETH1_FLOW_ADDR_MATCH2_ANY_MULTICAST 0x400000 -+#define ANA_ETH1_FLOW_ADDR_MATCH2_ANY_UNICAST 0x200000 - #define ANA_ETH1_FLOW_ADDR_MATCH2_FULL_ADDR 0x100000 - #define ANA_ETH1_FLOW_ADDR_MATCH2_SRC_DEST_MASK GENMASK(17, 16) - #define ANA_ETH1_FLOW_ADDR_MATCH2_SRC_DEST 0x020000 -diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c -index 6833ef0c79305f..3a10303eb756a8 100644 ---- a/drivers/net/ppp/pptp.c -+++ b/drivers/net/ppp/pptp.c -@@ -159,19 +159,17 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb) - int len; - unsigned char *data; - __u32 seq_recv; -- -- - struct rtable *rt; - struct net_device *tdev; - struct iphdr *iph; - int max_headroom; - - if (sk_pppox(po)->sk_state & PPPOX_DEAD) -- goto tx_error; -+ goto tx_drop; - - rt = pptp_route_output(po, &fl4); - if (IS_ERR(rt)) -- goto tx_error; -+ goto tx_drop; - - tdev = rt->dst.dev; - -@@ -179,16 +177,20 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb) - - if (skb_headroom(skb) < max_headroom || skb_cloned(skb) || skb_shared(skb)) { - struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom); -- if (!new_skb) { -- ip_rt_put(rt); -+ -+ if (!new_skb) - goto tx_error; -- } -+ - if (skb->sk) - skb_set_owner_w(new_skb, skb->sk); - consume_skb(skb); - skb = new_skb; - } - -+ /* Ensure we can safely access protocol field and LCP code */ -+ if (!pskb_may_pull(skb, 3)) -+ goto tx_error; -+ - data = skb->data; - islcp = ((data[0] << 8) + data[1]) == PPP_LCP && 1 <= data[2] && data[2] <= 7; - -@@ -262,6 +264,8 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb) - return 1; - - tx_error: -+ ip_rt_put(rt); -+tx_drop: - kfree_skb(skb); - return 1; - } -diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c -index ac0458b96738c1..fd6b5865ac5135 100644 ---- a/drivers/net/usb/usbnet.c -+++ b/drivers/net/usb/usbnet.c -@@ -1113,6 +1113,9 @@ static void __handle_link_change(struct usbnet *dev) - if (!test_bit(EVENT_DEV_OPEN, &dev->flags)) - return; - -+ if (test_and_clear_bit(EVENT_LINK_CARRIER_ON, &dev->flags)) -+ netif_carrier_on(dev->net); -+ - if (!netif_carrier_ok(dev->net)) { - /* kill URBs for reading packets to save bus bandwidth */ - unlink_urbs(dev, &dev->rxq); -@@ -2015,10 +2018,12 @@ EXPORT_SYMBOL(usbnet_manage_power); - void usbnet_link_change(struct usbnet *dev, bool link, bool need_reset) - { - /* update link after link is reseted */ -- if (link && !need_reset) -- netif_carrier_on(dev->net); -- else -+ if (link && !need_reset) { -+ set_bit(EVENT_LINK_CARRIER_ON, &dev->flags); -+ } else { -+ clear_bit(EVENT_LINK_CARRIER_ON, &dev->flags); - netif_carrier_off(dev->net); -+ } - - if (need_reset && link) - usbnet_defer_kevent(dev, EVENT_LINK_RESET); -diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c -index 5968a3ab817707..64114e98d75d0e 100644 ---- a/drivers/net/vrf.c -+++ b/drivers/net/vrf.c -@@ -1345,6 +1345,8 @@ static void vrf_ip6_input_dst(struct sk_buff *skb, struct net_device *vrf_dev, - struct net *net = dev_net(vrf_dev); - struct rt6_info *rt6; - -+ skb_dst_drop(skb); -+ - rt6 = vrf_ip6_route_lookup(net, vrf_dev, &fl6, ifindex, skb, - RT6_LOOKUP_F_HAS_SADDR | RT6_LOOKUP_F_IFACE); - if (unlikely(!rt6)) -diff --git a/drivers/net/wireless/ath/ath11k/hal.c b/drivers/net/wireless/ath/ath11k/hal.c -index f32fa104ded9de..df493d1760623e 100644 ---- a/drivers/net/wireless/ath/ath11k/hal.c -+++ b/drivers/net/wireless/ath/ath11k/hal.c -@@ -1319,6 +1319,10 @@ EXPORT_SYMBOL(ath11k_hal_srng_init); - void ath11k_hal_srng_deinit(struct ath11k_base *ab) - { - struct ath11k_hal *hal = &ab->hal; -+ int i; -+ -+ for (i = 0; i < HAL_SRNG_RING_ID_MAX; i++) -+ ab->hal.srng_list[i].initialized = 0; - - ath11k_hal_unregister_srng_key(ab); - ath11k_hal_free_cont_rdp(ab); -diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c -index 958ac4ed5c3491..e918218ce2d607 100644 ---- a/drivers/net/wireless/ath/ath12k/wmi.c -+++ b/drivers/net/wireless/ath/ath12k/wmi.c -@@ -6303,7 +6303,7 @@ static int ath12k_wmi_tlv_services_parser(struct ath12k_base *ab, - void *data) - { - const struct wmi_service_available_event *ev; -- u32 *wmi_ext2_service_bitmap; -+ __le32 *wmi_ext2_service_bitmap; - int i, j; - u16 expected_len; - -@@ -6335,12 +6335,12 @@ static int ath12k_wmi_tlv_services_parser(struct ath12k_base *ab, - ev->wmi_service_segment_bitmap[3]); - break; - case WMI_TAG_ARRAY_UINT32: -- wmi_ext2_service_bitmap = (u32 *)ptr; -+ wmi_ext2_service_bitmap = (__le32 *)ptr; - for (i = 0, j = WMI_MAX_EXT_SERVICE; - i < WMI_SERVICE_SEGMENT_BM_SIZE32 && j < WMI_MAX_EXT2_SERVICE; - i++) { - do { -- if (wmi_ext2_service_bitmap[i] & -+ if (__le32_to_cpu(wmi_ext2_service_bitmap[i]) & - BIT(j % WMI_AVAIL_SERVICE_BITS_IN_SIZE32)) - set_bit(j, ab->wmi_ab.svc_map); - } while (++j % WMI_AVAIL_SERVICE_BITS_IN_SIZE32); -@@ -6348,8 +6348,10 @@ static int ath12k_wmi_tlv_services_parser(struct ath12k_base *ab, - - ath12k_dbg(ab, ATH12K_DBG_WMI, - "wmi_ext2_service_bitmap 0x%04x 0x%04x 0x%04x 0x%04x", -- wmi_ext2_service_bitmap[0], wmi_ext2_service_bitmap[1], -- wmi_ext2_service_bitmap[2], wmi_ext2_service_bitmap[3]); -+ __le32_to_cpu(wmi_ext2_service_bitmap[0]), -+ __le32_to_cpu(wmi_ext2_service_bitmap[1]), -+ __le32_to_cpu(wmi_ext2_service_bitmap[2]), -+ __le32_to_cpu(wmi_ext2_service_bitmap[3])); - break; - } - return 0; -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -index c708ae91c3ce93..e883cf80f506d1 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -@@ -1541,10 +1541,6 @@ brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request) - return -EAGAIN; - } - -- /* If scan req comes for p2p0, send it over primary I/F */ -- if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif) -- vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif; -- - brcmf_dbg(SCAN, "START ESCAN\n"); - - cfg->scan_request = request; -@@ -1560,6 +1556,10 @@ brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request) - if (err) - goto scan_out; - -+ /* If scan req comes for p2p0, send it over primary I/F */ -+ if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif) -+ vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif; -+ - err = brcmf_do_escan(vif->ifp, request); - if (err) - goto scan_out; -diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/main.c b/drivers/net/wireless/intel/iwlwifi/dvm/main.c -index a873be109f4399..b490a88b97ca75 100644 ---- a/drivers/net/wireless/intel/iwlwifi/dvm/main.c -+++ b/drivers/net/wireless/intel/iwlwifi/dvm/main.c -@@ -1048,9 +1048,11 @@ static void iwl_bg_restart(struct work_struct *data) - * - *****************************************************************************/ - --static void iwl_setup_deferred_work(struct iwl_priv *priv) -+static int iwl_setup_deferred_work(struct iwl_priv *priv) - { - priv->workqueue = alloc_ordered_workqueue(DRV_NAME, 0); -+ if (!priv->workqueue) -+ return -ENOMEM; - - INIT_WORK(&priv->restart, iwl_bg_restart); - INIT_WORK(&priv->beacon_update, iwl_bg_beacon_update); -@@ -1067,6 +1069,8 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv) - timer_setup(&priv->statistics_periodic, iwl_bg_statistics_periodic, 0); - - timer_setup(&priv->ucode_trace, iwl_bg_ucode_trace, 0); -+ -+ return 0; - } - - void iwl_cancel_deferred_work(struct iwl_priv *priv) -@@ -1456,7 +1460,9 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans, - /******************** - * 6. Setup services - ********************/ -- iwl_setup_deferred_work(priv); -+ if (iwl_setup_deferred_work(priv)) -+ goto out_uninit_drv; -+ - iwl_setup_rx_handlers(priv); - - iwl_power_initialize(priv); -@@ -1494,6 +1500,7 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans, - iwl_cancel_deferred_work(priv); - destroy_workqueue(priv->workqueue); - priv->workqueue = NULL; -+out_uninit_drv: - iwl_uninit_drv(priv); - out_free_eeprom_blob: - kfree(priv->eeprom_blob); -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c -index b2cf5aeff7e3cf..d2dbbc9fe38448 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c -@@ -65,8 +65,10 @@ static int __init iwl_mvm_init(void) - } - - ret = iwl_opmode_register("iwlmvm", &iwl_mvm_ops); -- if (ret) -+ if (ret) { - pr_err("Unable to register MVM op_mode: %d\n", ret); -+ iwl_mvm_rate_control_unregister(); -+ } - - return ret; - } -diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c -index c0ecd769ada764..1a48914e6f828a 100644 ---- a/drivers/net/wireless/marvell/mwl8k.c -+++ b/drivers/net/wireless/marvell/mwl8k.c -@@ -1222,6 +1222,10 @@ static int rxq_refill(struct ieee80211_hw *hw, int index, int limit) - - addr = dma_map_single(&priv->pdev->dev, skb->data, - MWL8K_RX_MAXSZ, DMA_FROM_DEVICE); -+ if (dma_mapping_error(&priv->pdev->dev, addr)) { -+ kfree_skb(skb); -+ break; -+ } - - rxq->rxd_count++; - rx = rxq->tail++; -diff --git a/drivers/net/wireless/purelifi/plfxlc/mac.c b/drivers/net/wireless/purelifi/plfxlc/mac.c -index 7ebc0df0944cb5..f9f7532c32fde9 100644 ---- a/drivers/net/wireless/purelifi/plfxlc/mac.c -+++ b/drivers/net/wireless/purelifi/plfxlc/mac.c -@@ -100,11 +100,6 @@ int plfxlc_mac_init_hw(struct ieee80211_hw *hw) - return r; - } - --void plfxlc_mac_release(struct plfxlc_mac *mac) --{ -- plfxlc_chip_release(&mac->chip); --} -- - int plfxlc_op_start(struct ieee80211_hw *hw) - { - plfxlc_hw_mac(hw)->chip.usb.initialized = 1; -@@ -752,3 +747,9 @@ struct ieee80211_hw *plfxlc_mac_alloc_hw(struct usb_interface *intf) - SET_IEEE80211_DEV(hw, &intf->dev); - return hw; - } -+ -+void plfxlc_mac_release_hw(struct ieee80211_hw *hw) -+{ -+ plfxlc_chip_release(&plfxlc_hw_mac(hw)->chip); -+ ieee80211_free_hw(hw); -+} -diff --git a/drivers/net/wireless/purelifi/plfxlc/mac.h b/drivers/net/wireless/purelifi/plfxlc/mac.h -index 49b92413729bfa..c0445932b2e8a5 100644 ---- a/drivers/net/wireless/purelifi/plfxlc/mac.h -+++ b/drivers/net/wireless/purelifi/plfxlc/mac.h -@@ -168,7 +168,7 @@ static inline u8 *plfxlc_mac_get_perm_addr(struct plfxlc_mac *mac) - } - - struct ieee80211_hw *plfxlc_mac_alloc_hw(struct usb_interface *intf); --void plfxlc_mac_release(struct plfxlc_mac *mac); -+void plfxlc_mac_release_hw(struct ieee80211_hw *hw); - - int plfxlc_mac_preinit_hw(struct ieee80211_hw *hw, const u8 *hw_address); - int plfxlc_mac_init_hw(struct ieee80211_hw *hw); -diff --git a/drivers/net/wireless/purelifi/plfxlc/usb.c b/drivers/net/wireless/purelifi/plfxlc/usb.c -index 8151bc5e00ccc8..901e0139969e8d 100644 ---- a/drivers/net/wireless/purelifi/plfxlc/usb.c -+++ b/drivers/net/wireless/purelifi/plfxlc/usb.c -@@ -604,7 +604,7 @@ static int probe(struct usb_interface *intf, - r = plfxlc_upload_mac_and_serial(intf, hw_address, serial_number); - if (r) { - dev_err(&intf->dev, "MAC and Serial upload failed (%d)\n", r); -- goto error; -+ goto error_free_hw; - } - - chip->unit_type = STA; -@@ -613,13 +613,13 @@ static int probe(struct usb_interface *intf, - r = plfxlc_mac_preinit_hw(hw, hw_address); - if (r) { - dev_err(&intf->dev, "Init mac failed (%d)\n", r); -- goto error; -+ goto error_free_hw; - } - - r = ieee80211_register_hw(hw); - if (r) { - dev_err(&intf->dev, "Register device failed (%d)\n", r); -- goto error; -+ goto error_free_hw; - } - - if ((le16_to_cpu(interface_to_usbdev(intf)->descriptor.idVendor) == -@@ -632,7 +632,7 @@ static int probe(struct usb_interface *intf, - } - if (r != 0) { - dev_err(&intf->dev, "FPGA download failed (%d)\n", r); -- goto error; -+ goto error_unreg_hw; - } - - tx->mac_fifo_full = 0; -@@ -642,21 +642,21 @@ static int probe(struct usb_interface *intf, - r = plfxlc_usb_init_hw(usb); - if (r < 0) { - dev_err(&intf->dev, "usb_init_hw failed (%d)\n", r); -- goto error; -+ goto error_unreg_hw; - } - - msleep(PLF_MSLEEP_TIME); - r = plfxlc_chip_switch_radio(chip, PLFXLC_RADIO_ON); - if (r < 0) { - dev_dbg(&intf->dev, "chip_switch_radio_on failed (%d)\n", r); -- goto error; -+ goto error_unreg_hw; - } - - msleep(PLF_MSLEEP_TIME); - r = plfxlc_chip_set_rate(chip, 8); - if (r < 0) { - dev_dbg(&intf->dev, "chip_set_rate failed (%d)\n", r); -- goto error; -+ goto error_unreg_hw; - } - - msleep(PLF_MSLEEP_TIME); -@@ -664,7 +664,7 @@ static int probe(struct usb_interface *intf, - hw_address, ETH_ALEN, USB_REQ_MAC_WR); - if (r < 0) { - dev_dbg(&intf->dev, "MAC_WR failure (%d)\n", r); -- goto error; -+ goto error_unreg_hw; - } - - plfxlc_chip_enable_rxtx(chip); -@@ -691,12 +691,12 @@ static int probe(struct usb_interface *intf, - plfxlc_mac_init_hw(hw); - usb->initialized = true; - return 0; -+ -+error_unreg_hw: -+ ieee80211_unregister_hw(hw); -+error_free_hw: -+ plfxlc_mac_release_hw(hw); - error: -- if (hw) { -- plfxlc_mac_release(plfxlc_hw_mac(hw)); -- ieee80211_unregister_hw(hw); -- ieee80211_free_hw(hw); -- } - dev_err(&intf->dev, "pureLifi:Device error"); - return r; - } -@@ -730,8 +730,7 @@ static void disconnect(struct usb_interface *intf) - */ - usb_reset_device(interface_to_usbdev(intf)); - -- plfxlc_mac_release(mac); -- ieee80211_free_hw(hw); -+ plfxlc_mac_release_hw(hw); - } - - static void plfxlc_usb_resume(struct plfxlc_usb *usb) -diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c -index 04945f905d6d06..f6528469022bfb 100644 ---- a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c -+++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c -@@ -1041,10 +1041,11 @@ static void rtl8187_stop(struct ieee80211_hw *dev) - rtl818x_iowrite8(priv, &priv->map->CONFIG4, reg | RTL818X_CONFIG4_VCOOFF); - rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL); - -+ usb_kill_anchored_urbs(&priv->anchored); -+ - while ((skb = skb_dequeue(&priv->b_tx_status.queue))) - dev_kfree_skb_any(skb); - -- usb_kill_anchored_urbs(&priv->anchored); - mutex_unlock(&priv->conf_mutex); - - if (!priv->is_rtl8187b) -diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c -index 05e77d2bda3738..03aacb7a431710 100644 ---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c -+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c -@@ -6501,7 +6501,7 @@ static int rtl8xxxu_submit_rx_urb(struct rtl8xxxu_priv *priv, - skb_size = fops->rx_agg_buf_size; - skb_size += (rx_desc_sz + sizeof(struct rtl8723au_phy_stats)); - } else { -- skb_size = IEEE80211_MAX_FRAME_LEN; -+ skb_size = IEEE80211_MAX_FRAME_LEN + rx_desc_sz; - } - - skb = __netdev_alloc_skb(NULL, skb_size, GFP_KERNEL); -diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c -index d1d8fd812cbf6d..21e9ec8768b5dc 100644 ---- a/drivers/net/wireless/realtek/rtw89/core.c -+++ b/drivers/net/wireless/realtek/rtw89/core.c -@@ -1597,6 +1597,11 @@ static void rtw89_core_cancel_6ghz_probe_tx(struct rtw89_dev *rtwdev, - if (rx_status->band != NL80211_BAND_6GHZ) - return; - -+ if (unlikely(!(rtwdev->chip->support_bands & BIT(NL80211_BAND_6GHZ)))) { -+ rtw89_debug(rtwdev, RTW89_DBG_UNEXP, "invalid rx on unsupported 6 GHz\n"); -+ return; -+ } -+ - ssid_ie = cfg80211_find_ie(WLAN_EID_SSID, ies, skb->len); - - list_for_each_entry(info, &pkt_list[NL80211_BAND_6GHZ], list) { -diff --git a/drivers/pci/controller/pcie-rockchip-host.c b/drivers/pci/controller/pcie-rockchip-host.c -index afbbdccd195d97..6ff20d58539662 100644 ---- a/drivers/pci/controller/pcie-rockchip-host.c -+++ b/drivers/pci/controller/pcie-rockchip-host.c -@@ -436,7 +436,7 @@ static irqreturn_t rockchip_pcie_subsys_irq_handler(int irq, void *arg) - dev_dbg(dev, "malformed TLP received from the link\n"); - - if (sub_reg & PCIE_CORE_INT_UCR) -- dev_dbg(dev, "malformed TLP received from the link\n"); -+ dev_dbg(dev, "Unexpected Completion received from the link\n"); - - if (sub_reg & PCIE_CORE_INT_FCE) - dev_dbg(dev, "an error was observed in the flow control advertisements from the other side\n"); -diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c -index 3368f483f818df..33c3f9b980e684 100644 ---- a/drivers/pci/endpoint/functions/pci-epf-vntb.c -+++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c -@@ -531,7 +531,7 @@ static int epf_ntb_db_bar_init(struct epf_ntb *ntb) - struct device *dev = &ntb->epf->dev; - int ret; - struct pci_epf_bar *epf_bar; -- void __iomem *mw_addr; -+ void *mw_addr; - enum pci_barno barno; - size_t size = sizeof(u32) * ntb->db_count; - -@@ -711,7 +711,7 @@ static int epf_ntb_init_epc_bar(struct epf_ntb *ntb) - barno = pci_epc_get_next_free_bar(epc_features, barno); - if (barno < 0) { - dev_err(dev, "Fail to get NTB function BAR\n"); -- return barno; -+ return -ENOENT; - } - ntb->epf_ntb_bar[bar] = barno; - } -diff --git a/drivers/pci/hotplug/pnv_php.c b/drivers/pci/hotplug/pnv_php.c -index 092c9ac0d26d27..ec7828ad666179 100644 ---- a/drivers/pci/hotplug/pnv_php.c -+++ b/drivers/pci/hotplug/pnv_php.c -@@ -3,11 +3,14 @@ - * PCI Hotplug Driver for PowerPC PowerNV platform. - * - * Copyright Gavin Shan, IBM Corporation 2016. -+ * Copyright (C) 2025 Raptor Engineering, LLC -+ * Copyright (C) 2025 Raptor Computing Systems, LLC - */ - - #include - #include - #include -+#include - #include - #include - -@@ -35,8 +38,10 @@ static void pnv_php_register(struct device_node *dn); - static void pnv_php_unregister_one(struct device_node *dn); - static void pnv_php_unregister(struct device_node *dn); - -+static void pnv_php_enable_irq(struct pnv_php_slot *php_slot); -+ - static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, -- bool disable_device) -+ bool disable_device, bool disable_msi) - { - struct pci_dev *pdev = php_slot->pdev; - u16 ctrl; -@@ -52,19 +57,15 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, - php_slot->irq = 0; - } - -- if (php_slot->wq) { -- destroy_workqueue(php_slot->wq); -- php_slot->wq = NULL; -- } -- -- if (disable_device) { -+ if (disable_device || disable_msi) { - if (pdev->msix_enabled) - pci_disable_msix(pdev); - else if (pdev->msi_enabled) - pci_disable_msi(pdev); -+ } - -+ if (disable_device) - pci_disable_device(pdev); -- } - } - - static void pnv_php_free_slot(struct kref *kref) -@@ -73,7 +74,8 @@ static void pnv_php_free_slot(struct kref *kref) - struct pnv_php_slot, kref); - - WARN_ON(!list_empty(&php_slot->children)); -- pnv_php_disable_irq(php_slot, false); -+ pnv_php_disable_irq(php_slot, false, false); -+ destroy_workqueue(php_slot->wq); - kfree(php_slot->name); - kfree(php_slot); - } -@@ -390,6 +392,20 @@ static int pnv_php_get_power_state(struct hotplug_slot *slot, u8 *state) - return 0; - } - -+static int pcie_check_link_active(struct pci_dev *pdev) -+{ -+ u16 lnk_status; -+ int ret; -+ -+ ret = pcie_capability_read_word(pdev, PCI_EXP_LNKSTA, &lnk_status); -+ if (ret == PCIBIOS_DEVICE_NOT_FOUND || PCI_POSSIBLE_ERROR(lnk_status)) -+ return -ENODEV; -+ -+ ret = !!(lnk_status & PCI_EXP_LNKSTA_DLLLA); -+ -+ return ret; -+} -+ - static int pnv_php_get_adapter_state(struct hotplug_slot *slot, u8 *state) - { - struct pnv_php_slot *php_slot = to_pnv_php_slot(slot); -@@ -402,6 +418,19 @@ static int pnv_php_get_adapter_state(struct hotplug_slot *slot, u8 *state) - */ - ret = pnv_pci_get_presence_state(php_slot->id, &presence); - if (ret >= 0) { -+ if (pci_pcie_type(php_slot->pdev) == PCI_EXP_TYPE_DOWNSTREAM && -+ presence == OPAL_PCI_SLOT_EMPTY) { -+ /* -+ * Similar to pciehp_hpc, check whether the Link Active -+ * bit is set to account for broken downstream bridges -+ * that don't properly assert Presence Detect State, as -+ * was observed on the Microsemi Switchtec PM8533 PFX -+ * [11f8:8533]. -+ */ -+ if (pcie_check_link_active(php_slot->pdev) > 0) -+ presence = OPAL_PCI_SLOT_PRESENT; -+ } -+ - *state = presence; - ret = 0; - } else { -@@ -441,6 +470,61 @@ static int pnv_php_set_attention_state(struct hotplug_slot *slot, u8 state) - return 0; - } - -+static int pnv_php_activate_slot(struct pnv_php_slot *php_slot, -+ struct hotplug_slot *slot) -+{ -+ int ret, i; -+ -+ /* -+ * Issue initial slot activation command to firmware -+ * -+ * Firmware will power slot on, attempt to train the link, and -+ * discover any downstream devices. If this process fails, firmware -+ * will return an error code and an invalid device tree. Failure -+ * can be caused for multiple reasons, including a faulty -+ * downstream device, poor connection to the downstream device, or -+ * a previously latched PHB fence. On failure, issue fundamental -+ * reset up to three times before aborting. -+ */ -+ ret = pnv_php_set_slot_power_state(slot, OPAL_PCI_SLOT_POWER_ON); -+ if (ret) { -+ SLOT_WARN( -+ php_slot, -+ "PCI slot activation failed with error code %d, possible frozen PHB", -+ ret); -+ SLOT_WARN( -+ php_slot, -+ "Attempting complete PHB reset before retrying slot activation\n"); -+ for (i = 0; i < 3; i++) { -+ /* -+ * Slot activation failed, PHB may be fenced from a -+ * prior device failure. -+ * -+ * Use the OPAL fundamental reset call to both try a -+ * device reset and clear any potentially active PHB -+ * fence / freeze. -+ */ -+ SLOT_WARN(php_slot, "Try %d...\n", i + 1); -+ pci_set_pcie_reset_state(php_slot->pdev, -+ pcie_warm_reset); -+ msleep(250); -+ pci_set_pcie_reset_state(php_slot->pdev, -+ pcie_deassert_reset); -+ -+ ret = pnv_php_set_slot_power_state( -+ slot, OPAL_PCI_SLOT_POWER_ON); -+ if (!ret) -+ break; -+ } -+ -+ if (i >= 3) -+ SLOT_WARN(php_slot, -+ "Failed to bring slot online, aborting!\n"); -+ } -+ -+ return ret; -+} -+ - static int pnv_php_enable(struct pnv_php_slot *php_slot, bool rescan) - { - struct hotplug_slot *slot = &php_slot->slot; -@@ -503,7 +587,7 @@ static int pnv_php_enable(struct pnv_php_slot *php_slot, bool rescan) - goto scan; - - /* Power is off, turn it on and then scan the slot */ -- ret = pnv_php_set_slot_power_state(slot, OPAL_PCI_SLOT_POWER_ON); -+ ret = pnv_php_activate_slot(php_slot, slot); - if (ret) - return ret; - -@@ -560,8 +644,58 @@ static int pnv_php_reset_slot(struct hotplug_slot *slot, bool probe) - static int pnv_php_enable_slot(struct hotplug_slot *slot) - { - struct pnv_php_slot *php_slot = to_pnv_php_slot(slot); -+ u32 prop32; -+ int ret; -+ -+ ret = pnv_php_enable(php_slot, true); -+ if (ret) -+ return ret; -+ -+ /* (Re-)enable interrupt if the slot supports surprise hotplug */ -+ ret = of_property_read_u32(php_slot->dn, "ibm,slot-surprise-pluggable", -+ &prop32); -+ if (!ret && prop32) -+ pnv_php_enable_irq(php_slot); -+ -+ return 0; -+} -+ -+/* -+ * Disable any hotplug interrupts for all slots on the provided bus, as well as -+ * all downstream slots in preparation for a hot unplug. -+ */ -+static int pnv_php_disable_all_irqs(struct pci_bus *bus) -+{ -+ struct pci_bus *child_bus; -+ struct pci_slot *slot; -+ -+ /* First go down child buses */ -+ list_for_each_entry(child_bus, &bus->children, node) -+ pnv_php_disable_all_irqs(child_bus); -+ -+ /* Disable IRQs for all pnv_php slots on this bus */ -+ list_for_each_entry(slot, &bus->slots, list) { -+ struct pnv_php_slot *php_slot = to_pnv_php_slot(slot->hotplug); - -- return pnv_php_enable(php_slot, true); -+ pnv_php_disable_irq(php_slot, false, true); -+ } -+ -+ return 0; -+} -+ -+/* -+ * Disable any hotplug interrupts for all downstream slots on the provided -+ * bus in preparation for a hot unplug. -+ */ -+static int pnv_php_disable_all_downstream_irqs(struct pci_bus *bus) -+{ -+ struct pci_bus *child_bus; -+ -+ /* Go down child buses, recursively deactivating their IRQs */ -+ list_for_each_entry(child_bus, &bus->children, node) -+ pnv_php_disable_all_irqs(child_bus); -+ -+ return 0; - } - - static int pnv_php_disable_slot(struct hotplug_slot *slot) -@@ -578,6 +712,13 @@ static int pnv_php_disable_slot(struct hotplug_slot *slot) - php_slot->state != PNV_PHP_STATE_REGISTERED) - return 0; - -+ /* -+ * Free all IRQ resources from all child slots before remove. -+ * Note that we do not disable the root slot IRQ here as that -+ * would also deactivate the slot hot (re)plug interrupt! -+ */ -+ pnv_php_disable_all_downstream_irqs(php_slot->bus); -+ - /* Remove all devices behind the slot */ - pci_lock_rescan_remove(); - pci_hp_remove_devices(php_slot->bus); -@@ -646,6 +787,15 @@ static struct pnv_php_slot *pnv_php_alloc_slot(struct device_node *dn) - return NULL; - } - -+ /* Allocate workqueue for this slot's interrupt handling */ -+ php_slot->wq = alloc_workqueue("pciehp-%s", 0, 0, php_slot->name); -+ if (!php_slot->wq) { -+ SLOT_WARN(php_slot, "Cannot alloc workqueue\n"); -+ kfree(php_slot->name); -+ kfree(php_slot); -+ return NULL; -+ } -+ - if (dn->child && PCI_DN(dn->child)) - php_slot->slot_no = PCI_SLOT(PCI_DN(dn->child)->devfn); - else -@@ -744,16 +894,63 @@ static int pnv_php_enable_msix(struct pnv_php_slot *php_slot) - return entry.vector; - } - -+static void -+pnv_php_detect_clear_suprise_removal_freeze(struct pnv_php_slot *php_slot) -+{ -+ struct pci_dev *pdev = php_slot->pdev; -+ struct eeh_dev *edev; -+ struct eeh_pe *pe; -+ int i, rc; -+ -+ /* -+ * When a device is surprise removed from a downstream bridge slot, -+ * the upstream bridge port can still end up frozen due to related EEH -+ * events, which will in turn block the MSI interrupts for slot hotplug -+ * detection. -+ * -+ * Detect and thaw any frozen upstream PE after slot deactivation. -+ */ -+ edev = pci_dev_to_eeh_dev(pdev); -+ pe = edev ? edev->pe : NULL; -+ rc = eeh_pe_get_state(pe); -+ if ((rc == -ENODEV) || (rc == -ENOENT)) { -+ SLOT_WARN( -+ php_slot, -+ "Upstream bridge PE state unknown, hotplug detect may fail\n"); -+ } else { -+ if (pe->state & EEH_PE_ISOLATED) { -+ SLOT_WARN( -+ php_slot, -+ "Upstream bridge PE %02x frozen, thawing...\n", -+ pe->addr); -+ for (i = 0; i < 3; i++) -+ if (!eeh_unfreeze_pe(pe)) -+ break; -+ if (i >= 3) -+ SLOT_WARN( -+ php_slot, -+ "Unable to thaw PE %02x, hotplug detect will fail!\n", -+ pe->addr); -+ else -+ SLOT_WARN(php_slot, -+ "PE %02x thawed successfully\n", -+ pe->addr); -+ } -+ } -+} -+ - static void pnv_php_event_handler(struct work_struct *work) - { - struct pnv_php_event *event = - container_of(work, struct pnv_php_event, work); - struct pnv_php_slot *php_slot = event->php_slot; - -- if (event->added) -+ if (event->added) { - pnv_php_enable_slot(&php_slot->slot); -- else -+ } else { - pnv_php_disable_slot(&php_slot->slot); -+ pnv_php_detect_clear_suprise_removal_freeze(php_slot); -+ } - - kfree(event); - } -@@ -842,14 +1039,6 @@ static void pnv_php_init_irq(struct pnv_php_slot *php_slot, int irq) - u16 sts, ctrl; - int ret; - -- /* Allocate workqueue */ -- php_slot->wq = alloc_workqueue("pciehp-%s", 0, 0, php_slot->name); -- if (!php_slot->wq) { -- SLOT_WARN(php_slot, "Cannot alloc workqueue\n"); -- pnv_php_disable_irq(php_slot, true); -- return; -- } -- - /* Check PDC (Presence Detection Change) is broken or not */ - ret = of_property_read_u32(php_slot->dn, "ibm,slot-broken-pdc", - &broken_pdc); -@@ -868,7 +1057,7 @@ static void pnv_php_init_irq(struct pnv_php_slot *php_slot, int irq) - ret = request_irq(irq, pnv_php_interrupt, IRQF_SHARED, - php_slot->name, php_slot); - if (ret) { -- pnv_php_disable_irq(php_slot, true); -+ pnv_php_disable_irq(php_slot, true, true); - SLOT_WARN(php_slot, "Error %d enabling IRQ %d\n", ret, irq); - return; - } -diff --git a/drivers/pinctrl/pinmux.c b/drivers/pinctrl/pinmux.c -index 97e8af88df851b..ab853d6c586b60 100644 ---- a/drivers/pinctrl/pinmux.c -+++ b/drivers/pinctrl/pinmux.c -@@ -238,18 +238,7 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin, - if (desc->mux_usecount) - return NULL; - } -- } -- -- /* -- * If there is no kind of request function for the pin we just assume -- * we got it by default and proceed. -- */ -- if (gpio_range && ops->gpio_disable_free) -- ops->gpio_disable_free(pctldev, gpio_range, pin); -- else if (ops->free) -- ops->free(pctldev, pin); - -- scoped_guard(mutex, &desc->mux_lock) { - if (gpio_range) { - owner = desc->gpio_owner; - desc->gpio_owner = NULL; -@@ -260,6 +249,15 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin, - } - } - -+ /* -+ * If there is no kind of request function for the pin we just assume -+ * we got it by default and proceed. -+ */ -+ if (gpio_range && ops->gpio_disable_free) -+ ops->gpio_disable_free(pctldev, gpio_range, pin); -+ else if (ops->free) -+ ops->free(pctldev, pin); -+ - module_put(pctldev->owner); - - return owner; -diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c -index 73bcf806af0ec2..fc11c3d55fa8c0 100644 ---- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c -+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c -@@ -395,6 +395,7 @@ static int sunxi_pctrl_dt_node_to_map(struct pinctrl_dev *pctldev, - const char *function, *pin_prop; - const char *group; - int ret, npins, nmaps, configlen = 0, i = 0; -+ struct pinctrl_map *new_map; - - *map = NULL; - *num_maps = 0; -@@ -469,9 +470,13 @@ static int sunxi_pctrl_dt_node_to_map(struct pinctrl_dev *pctldev, - * We know have the number of maps we need, we can resize our - * map array - */ -- *map = krealloc(*map, i * sizeof(struct pinctrl_map), GFP_KERNEL); -- if (!*map) -- return -ENOMEM; -+ new_map = krealloc(*map, i * sizeof(struct pinctrl_map), GFP_KERNEL); -+ if (!new_map) { -+ ret = -ENOMEM; -+ goto err_free_map; -+ } -+ -+ *map = new_map; - - return 0; - -diff --git a/drivers/power/supply/cpcap-charger.c b/drivers/power/supply/cpcap-charger.c -index be9764541d52a5..05a3f4b208a420 100644 ---- a/drivers/power/supply/cpcap-charger.c -+++ b/drivers/power/supply/cpcap-charger.c -@@ -689,9 +689,8 @@ static void cpcap_usb_detect(struct work_struct *work) - struct power_supply *battery; - - battery = power_supply_get_by_name("battery"); -- if (IS_ERR_OR_NULL(battery)) { -- dev_err(ddata->dev, "battery power_supply not available %li\n", -- PTR_ERR(battery)); -+ if (!battery) { -+ dev_err(ddata->dev, "battery power_supply not available\n"); - return; - } - -diff --git a/drivers/power/supply/max14577_charger.c b/drivers/power/supply/max14577_charger.c -index 96f9de775043ac..daa5a6d41bb48b 100644 ---- a/drivers/power/supply/max14577_charger.c -+++ b/drivers/power/supply/max14577_charger.c -@@ -501,7 +501,7 @@ static struct max14577_charger_platform_data *max14577_charger_dt_init( - static struct max14577_charger_platform_data *max14577_charger_dt_init( - struct platform_device *pdev) - { -- return NULL; -+ return ERR_PTR(-ENODATA); - } - #endif /* CONFIG_OF */ - -@@ -572,7 +572,7 @@ static int max14577_charger_probe(struct platform_device *pdev) - chg->max14577 = max14577; - - chg->pdata = max14577_charger_dt_init(pdev); -- if (IS_ERR_OR_NULL(chg->pdata)) -+ if (IS_ERR(chg->pdata)) - return PTR_ERR(chg->pdata); - - ret = max14577_charger_reg_init(chg); -diff --git a/drivers/powercap/dtpm_cpu.c b/drivers/powercap/dtpm_cpu.c -index ae7ee611978ba1..99a82060ead984 100644 ---- a/drivers/powercap/dtpm_cpu.c -+++ b/drivers/powercap/dtpm_cpu.c -@@ -93,6 +93,8 @@ static u64 get_pd_power_uw(struct dtpm *dtpm) - int i; - - pd = em_cpu_get(dtpm_cpu->cpu); -+ if (!pd) -+ return 0; - - pd_mask = em_span_cpus(pd); - -diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c -index 63f96357eb9fd8..e1689957736d95 100644 ---- a/drivers/pps/pps.c -+++ b/drivers/pps/pps.c -@@ -41,6 +41,9 @@ static __poll_t pps_cdev_poll(struct file *file, poll_table *wait) - - poll_wait(file, &pps->queue, wait); - -+ if (pps->last_fetched_ev == pps->last_ev) -+ return 0; -+ - return EPOLLIN | EPOLLRDNORM; - } - -@@ -186,9 +189,11 @@ static long pps_cdev_ioctl(struct file *file, - if (err) - return err; - -- /* Return the fetched timestamp */ -+ /* Return the fetched timestamp and save last fetched event */ - spin_lock_irq(&pps->lock); - -+ pps->last_fetched_ev = pps->last_ev; -+ - fdata.info.assert_sequence = pps->assert_sequence; - fdata.info.clear_sequence = pps->clear_sequence; - fdata.info.assert_tu = pps->assert_tu; -@@ -272,9 +277,11 @@ static long pps_cdev_compat_ioctl(struct file *file, - if (err) - return err; - -- /* Return the fetched timestamp */ -+ /* Return the fetched timestamp and save last fetched event */ - spin_lock_irq(&pps->lock); - -+ pps->last_fetched_ev = pps->last_ev; -+ - compat.info.assert_sequence = pps->assert_sequence; - compat.info.clear_sequence = pps->clear_sequence; - compat.info.current_mode = pps->current_mode; -diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c -index 0c78451960926d..e14981383c0125 100644 ---- a/drivers/rtc/rtc-ds1307.c -+++ b/drivers/rtc/rtc-ds1307.c -@@ -1461,7 +1461,7 @@ static long ds3231_clk_sqw_round_rate(struct clk_hw *hw, unsigned long rate, - return ds3231_clk_sqw_rates[i]; - } - -- return 0; -+ return ds3231_clk_sqw_rates[ARRAY_SIZE(ds3231_clk_sqw_rates) - 1]; - } - - static int ds3231_clk_sqw_set_rate(struct clk_hw *hw, unsigned long rate, -diff --git a/drivers/rtc/rtc-hym8563.c b/drivers/rtc/rtc-hym8563.c -index b018535c842b37..b873918042e33b 100644 ---- a/drivers/rtc/rtc-hym8563.c -+++ b/drivers/rtc/rtc-hym8563.c -@@ -294,7 +294,7 @@ static long hym8563_clkout_round_rate(struct clk_hw *hw, unsigned long rate, - if (clkout_rates[i] <= rate) - return clkout_rates[i]; - -- return 0; -+ return clkout_rates[0]; - } - - static int hym8563_clkout_set_rate(struct clk_hw *hw, unsigned long rate, -diff --git a/drivers/rtc/rtc-nct3018y.c b/drivers/rtc/rtc-nct3018y.c -index c4533c0f538967..5e7a8c7ad58c5f 100644 ---- a/drivers/rtc/rtc-nct3018y.c -+++ b/drivers/rtc/rtc-nct3018y.c -@@ -342,7 +342,7 @@ static long nct3018y_clkout_round_rate(struct clk_hw *hw, unsigned long rate, - if (clkout_rates[i] <= rate) - return clkout_rates[i]; - -- return 0; -+ return clkout_rates[0]; - } - - static int nct3018y_clkout_set_rate(struct clk_hw *hw, unsigned long rate, -diff --git a/drivers/rtc/rtc-pcf85063.c b/drivers/rtc/rtc-pcf85063.c -index 73848f764559b4..2b4921c23467d7 100644 ---- a/drivers/rtc/rtc-pcf85063.c -+++ b/drivers/rtc/rtc-pcf85063.c -@@ -410,7 +410,7 @@ static long pcf85063_clkout_round_rate(struct clk_hw *hw, unsigned long rate, - if (clkout_rates[i] <= rate) - return clkout_rates[i]; - -- return 0; -+ return clkout_rates[0]; - } - - static int pcf85063_clkout_set_rate(struct clk_hw *hw, unsigned long rate, -diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c -index ea82b89d8929f9..61be91c25cf182 100644 ---- a/drivers/rtc/rtc-pcf8563.c -+++ b/drivers/rtc/rtc-pcf8563.c -@@ -386,7 +386,7 @@ static long pcf8563_clkout_round_rate(struct clk_hw *hw, unsigned long rate, - if (clkout_rates[i] <= rate) - return clkout_rates[i]; - -- return 0; -+ return clkout_rates[0]; - } - - static int pcf8563_clkout_set_rate(struct clk_hw *hw, unsigned long rate, -diff --git a/drivers/rtc/rtc-rv3028.c b/drivers/rtc/rtc-rv3028.c -index 2f001c59c61d54..86b7f821e937b2 100644 ---- a/drivers/rtc/rtc-rv3028.c -+++ b/drivers/rtc/rtc-rv3028.c -@@ -738,7 +738,7 @@ static long rv3028_clkout_round_rate(struct clk_hw *hw, unsigned long rate, - if (clkout_rates[i] <= rate) - return clkout_rates[i]; - -- return 0; -+ return clkout_rates[0]; - } - - static int rv3028_clkout_set_rate(struct clk_hw *hw, unsigned long rate, -diff --git a/drivers/scsi/elx/efct/efct_lio.c b/drivers/scsi/elx/efct/efct_lio.c -index a982b9cf987017..49d7fe150684bc 100644 ---- a/drivers/scsi/elx/efct/efct_lio.c -+++ b/drivers/scsi/elx/efct/efct_lio.c -@@ -382,7 +382,7 @@ efct_lio_sg_unmap(struct efct_io *io) - return; - - dma_unmap_sg(&io->efct->pci->dev, cmd->t_data_sg, -- ocp->seg_map_cnt, cmd->data_direction); -+ cmd->t_data_nents, cmd->data_direction); - ocp->seg_map_cnt = 0; - } - -diff --git a/drivers/scsi/ibmvscsi_tgt/libsrp.c b/drivers/scsi/ibmvscsi_tgt/libsrp.c -index 8a0e28aec928e4..0ecad398ed3db0 100644 ---- a/drivers/scsi/ibmvscsi_tgt/libsrp.c -+++ b/drivers/scsi/ibmvscsi_tgt/libsrp.c -@@ -184,7 +184,8 @@ static int srp_direct_data(struct ibmvscsis_cmd *cmd, struct srp_direct_buf *md, - err = rdma_io(cmd, sg, nsg, md, 1, dir, len); - - if (dma_map) -- dma_unmap_sg(iue->target->dev, sg, nsg, DMA_BIDIRECTIONAL); -+ dma_unmap_sg(iue->target->dev, sg, cmd->se_cmd.t_data_nents, -+ DMA_BIDIRECTIONAL); - - return err; - } -@@ -256,7 +257,8 @@ static int srp_indirect_data(struct ibmvscsis_cmd *cmd, struct srp_cmd *srp_cmd, - err = rdma_io(cmd, sg, nsg, md, nmd, dir, len); - - if (dma_map) -- dma_unmap_sg(iue->target->dev, sg, nsg, DMA_BIDIRECTIONAL); -+ dma_unmap_sg(iue->target->dev, sg, cmd->se_cmd.t_data_nents, -+ DMA_BIDIRECTIONAL); - - free_mem: - if (token && dma_map) { -diff --git a/drivers/scsi/isci/request.c b/drivers/scsi/isci/request.c -index 7162a5029b37a8..3841db665fe4bd 100644 ---- a/drivers/scsi/isci/request.c -+++ b/drivers/scsi/isci/request.c -@@ -2907,7 +2907,7 @@ static void isci_request_io_request_complete(struct isci_host *ihost, - task->total_xfer_len, task->data_dir); - else /* unmap the sgl dma addresses */ - dma_unmap_sg(&ihost->pdev->dev, task->scatter, -- request->num_sg_entries, task->data_dir); -+ task->num_scatter, task->data_dir); - break; - case SAS_PROTOCOL_SMP: { - struct scatterlist *sg = &task->smp_task.smp_req; -diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -index f270b0d829f6ea..0afa485fb300ca 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -@@ -10818,8 +10818,7 @@ _mpt3sas_fw_work(struct MPT3SAS_ADAPTER *ioc, struct fw_event_work *fw_event) - break; - case MPI2_EVENT_PCIE_TOPOLOGY_CHANGE_LIST: - _scsih_pcie_topology_change_event(ioc, fw_event); -- ioc->current_event = NULL; -- return; -+ break; - } - out: - fw_event_work_put(fw_event); -diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c -index 1444b1f1c4c886..d6897432cf0f56 100644 ---- a/drivers/scsi/mvsas/mv_sas.c -+++ b/drivers/scsi/mvsas/mv_sas.c -@@ -828,7 +828,7 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf - dev_printk(KERN_ERR, mvi->dev, "mvsas prep failed[%d]!\n", rc); - if (!sas_protocol_ata(task->task_proto)) - if (n_elem) -- dma_unmap_sg(mvi->dev, task->scatter, n_elem, -+ dma_unmap_sg(mvi->dev, task->scatter, task->num_scatter, - task->data_dir); - prep_out: - return rc; -@@ -874,7 +874,7 @@ static void mvs_slot_task_free(struct mvs_info *mvi, struct sas_task *task, - if (!sas_protocol_ata(task->task_proto)) - if (slot->n_elem) - dma_unmap_sg(mvi->dev, task->scatter, -- slot->n_elem, task->data_dir); -+ task->num_scatter, task->data_dir); - - switch (task->task_proto) { - case SAS_PROTOCOL_SMP: -diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c -index f2c31e74d8ed06..22bec2453bac9c 100644 ---- a/drivers/scsi/scsi_transport_iscsi.c -+++ b/drivers/scsi/scsi_transport_iscsi.c -@@ -2169,6 +2169,8 @@ static int iscsi_iter_destroy_conn_fn(struct device *dev, void *data) - return 0; - - iscsi_remove_conn(iscsi_dev_to_conn(dev)); -+ iscsi_put_conn(iscsi_dev_to_conn(dev)); -+ - return 0; - } - -diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c -index fe694fec16b516..873c920eb0cf06 100644 ---- a/drivers/scsi/sd.c -+++ b/drivers/scsi/sd.c -@@ -3895,7 +3895,9 @@ static void sd_shutdown(struct device *dev) - if ((system_state != SYSTEM_RESTART && - sdkp->device->manage_system_start_stop) || - (system_state == SYSTEM_POWER_OFF && -- sdkp->device->manage_shutdown)) { -+ sdkp->device->manage_shutdown) || -+ (system_state == SYSTEM_RUNNING && -+ sdkp->device->manage_runtime_start_stop)) { - sd_printk(KERN_NOTICE, sdkp, "Stopping disk\n"); - sd_start_stop_device(sdkp, 0); - } -diff --git a/drivers/soc/qcom/pmic_glink.c b/drivers/soc/qcom/pmic_glink.c -index 7e50eeb4cc6f2f..2222ca4fa6e214 100644 ---- a/drivers/soc/qcom/pmic_glink.c -+++ b/drivers/soc/qcom/pmic_glink.c -@@ -145,7 +145,10 @@ static int pmic_glink_rpmsg_callback(struct rpmsg_device *rpdev, void *data, - return 0; - } - --static void pmic_glink_aux_release(struct device *dev) {} -+static void pmic_glink_aux_release(struct device *dev) -+{ -+ of_node_put(dev->of_node); -+} - - static int pmic_glink_add_aux_device(struct pmic_glink *pg, - struct auxiliary_device *aux, -@@ -159,8 +162,10 @@ static int pmic_glink_add_aux_device(struct pmic_glink *pg, - aux->dev.release = pmic_glink_aux_release; - device_set_of_node_from_dev(&aux->dev, parent); - ret = auxiliary_device_init(aux); -- if (ret) -+ if (ret) { -+ of_node_put(aux->dev.of_node); - return ret; -+ } - - ret = auxiliary_device_add(aux); - if (ret) -diff --git a/drivers/soc/qcom/qmi_encdec.c b/drivers/soc/qcom/qmi_encdec.c -index 5c7161b18b7240..645c4ee24f5b4f 100644 ---- a/drivers/soc/qcom/qmi_encdec.c -+++ b/drivers/soc/qcom/qmi_encdec.c -@@ -304,6 +304,8 @@ static int qmi_encode(const struct qmi_elem_info *ei_array, void *out_buf, - const void *buf_src; - int encode_tlv = 0; - int rc; -+ u8 val8; -+ u16 val16; - - if (!ei_array) - return 0; -@@ -338,7 +340,6 @@ static int qmi_encode(const struct qmi_elem_info *ei_array, void *out_buf, - break; - - case QMI_DATA_LEN: -- memcpy(&data_len_value, buf_src, temp_ei->elem_size); - data_len_sz = temp_ei->elem_size == sizeof(u8) ? - sizeof(u8) : sizeof(u16); - /* Check to avoid out of range buffer access */ -@@ -348,8 +349,17 @@ static int qmi_encode(const struct qmi_elem_info *ei_array, void *out_buf, - __func__); - return -ETOOSMALL; - } -- rc = qmi_encode_basic_elem(buf_dst, &data_len_value, -- 1, data_len_sz); -+ if (data_len_sz == sizeof(u8)) { -+ val8 = *(u8 *)buf_src; -+ data_len_value = (u32)val8; -+ rc = qmi_encode_basic_elem(buf_dst, &val8, -+ 1, data_len_sz); -+ } else { -+ val16 = *(u16 *)buf_src; -+ data_len_value = (u32)le16_to_cpu(val16); -+ rc = qmi_encode_basic_elem(buf_dst, &val16, -+ 1, data_len_sz); -+ } - UPDATE_ENCODE_VARIABLES(temp_ei, buf_dst, - encoded_bytes, tlv_len, - encode_tlv, rc); -@@ -523,14 +533,23 @@ static int qmi_decode_string_elem(const struct qmi_elem_info *ei_array, - u32 string_len = 0; - u32 string_len_sz = 0; - const struct qmi_elem_info *temp_ei = ei_array; -+ u8 val8; -+ u16 val16; - - if (dec_level == 1) { - string_len = tlv_len; - } else { - string_len_sz = temp_ei->elem_len <= U8_MAX ? - sizeof(u8) : sizeof(u16); -- rc = qmi_decode_basic_elem(&string_len, buf_src, -- 1, string_len_sz); -+ if (string_len_sz == sizeof(u8)) { -+ rc = qmi_decode_basic_elem(&val8, buf_src, -+ 1, string_len_sz); -+ string_len = (u32)val8; -+ } else { -+ rc = qmi_decode_basic_elem(&val16, buf_src, -+ 1, string_len_sz); -+ string_len = (u32)val16; -+ } - decoded_bytes += rc; - } - -@@ -604,6 +623,9 @@ static int qmi_decode(const struct qmi_elem_info *ei_array, void *out_c_struct, - u32 decoded_bytes = 0; - const void *buf_src = in_buf; - int rc; -+ u8 val8; -+ u16 val16; -+ u32 val32; - - while (decoded_bytes < in_buf_len) { - if (dec_level >= 2 && temp_ei->data_type == QMI_EOTI) -@@ -642,9 +664,17 @@ static int qmi_decode(const struct qmi_elem_info *ei_array, void *out_c_struct, - if (temp_ei->data_type == QMI_DATA_LEN) { - data_len_sz = temp_ei->elem_size == sizeof(u8) ? - sizeof(u8) : sizeof(u16); -- rc = qmi_decode_basic_elem(&data_len_value, buf_src, -- 1, data_len_sz); -- memcpy(buf_dst, &data_len_value, sizeof(u32)); -+ if (data_len_sz == sizeof(u8)) { -+ rc = qmi_decode_basic_elem(&val8, buf_src, -+ 1, data_len_sz); -+ data_len_value = (u32)val8; -+ } else { -+ rc = qmi_decode_basic_elem(&val16, buf_src, -+ 1, data_len_sz); -+ data_len_value = (u32)val16; -+ } -+ val32 = cpu_to_le32(data_len_value); -+ memcpy(buf_dst, &val32, sizeof(u32)); - temp_ei = temp_ei + 1; - buf_dst = out_c_struct + temp_ei->offset; - tlv_len -= data_len_sz; -diff --git a/drivers/soc/tegra/cbb/tegra234-cbb.c b/drivers/soc/tegra/cbb/tegra234-cbb.c -index 5cf0e8c341644c..e8cc46874c7297 100644 ---- a/drivers/soc/tegra/cbb/tegra234-cbb.c -+++ b/drivers/soc/tegra/cbb/tegra234-cbb.c -@@ -185,6 +185,8 @@ static void tegra234_cbb_error_clear(struct tegra_cbb *cbb) - { - struct tegra234_cbb *priv = to_tegra234_cbb(cbb); - -+ writel(0, priv->mon + FABRIC_MN_MASTER_ERR_FORCE_0); -+ - writel(0x3f, priv->mon + FABRIC_MN_MASTER_ERR_STATUS_0); - dsb(sy); - } -diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c -index 68d54887992d91..8ebfa44078e85f 100644 ---- a/drivers/soundwire/stream.c -+++ b/drivers/soundwire/stream.c -@@ -1409,7 +1409,7 @@ static int _sdw_prepare_stream(struct sdw_stream_runtime *stream, - if (ret < 0) { - dev_err(bus->dev, "Prepare port(s) failed ret = %d\n", - ret); -- return ret; -+ goto restore_params; - } - } - -diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c -index 40680b5fffc9ab..211d9c76665bc4 100644 ---- a/drivers/spi/spi-stm32.c -+++ b/drivers/spi/spi-stm32.c -@@ -1808,9 +1808,15 @@ static int stm32_spi_probe(struct platform_device *pdev) - struct resource *res; - struct reset_control *rst; - struct device_node *np = pdev->dev.of_node; -+ const struct stm32_spi_cfg *cfg; - bool device_mode; - int ret; -- const struct stm32_spi_cfg *cfg = of_device_get_match_data(&pdev->dev); -+ -+ cfg = of_device_get_match_data(&pdev->dev); -+ if (!cfg) { -+ dev_err(&pdev->dev, "Failed to get match data for platform\n"); -+ return -ENODEV; -+ } - - device_mode = of_property_read_bool(np, "spi-slave"); - if (!cfg->has_device_mode && device_mode) { -diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c -index eac1d570f4372d..dce721f440c5ee 100644 ---- a/drivers/staging/fbtft/fbtft-core.c -+++ b/drivers/staging/fbtft/fbtft-core.c -@@ -744,6 +744,7 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display, - return info; - - release_framebuf: -+ fb_deferred_io_cleanup(info); - framebuffer_release(info); - - alloc_fail: -diff --git a/drivers/staging/nvec/nvec_power.c b/drivers/staging/nvec/nvec_power.c -index 9943b1fff1905d..573521e1703bb5 100644 ---- a/drivers/staging/nvec/nvec_power.c -+++ b/drivers/staging/nvec/nvec_power.c -@@ -194,7 +194,7 @@ static int nvec_power_bat_notifier(struct notifier_block *nb, - break; - case MANUFACTURER: - memcpy(power->bat_manu, &res->plc, res->length - 2); -- power->bat_model[res->length - 2] = '\0'; -+ power->bat_manu[res->length - 2] = '\0'; - break; - case MODEL: - memcpy(power->bat_model, &res->plc, res->length - 2); -diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c -index da20bd3d46bc78..7dcdaac31546ba 100644 ---- a/drivers/ufs/core/ufshcd.c -+++ b/drivers/ufs/core/ufshcd.c -@@ -4274,7 +4274,7 @@ static int ufshcd_uic_pwr_ctrl(struct ufs_hba *hba, struct uic_command *cmd) - hba->uic_async_done = NULL; - if (reenable_intr) - ufshcd_enable_intr(hba, UIC_COMMAND_COMPL); -- if (ret) { -+ if (ret && !hba->pm_op_in_progress) { - ufshcd_set_link_broken(hba); - ufshcd_schedule_eh_work(hba); - } -@@ -4282,6 +4282,14 @@ static int ufshcd_uic_pwr_ctrl(struct ufs_hba *hba, struct uic_command *cmd) - spin_unlock_irqrestore(hba->host->host_lock, flags); - mutex_unlock(&hba->uic_cmd_mutex); - -+ /* -+ * If the h8 exit fails during the runtime resume process, it becomes -+ * stuck and cannot be recovered through the error handler. To fix -+ * this, use link recovery instead of the error handler. -+ */ -+ if (ret && hba->pm_op_in_progress) -+ ret = ufshcd_link_recovery(hba); -+ - return ret; - } - -diff --git a/drivers/usb/early/xhci-dbc.c b/drivers/usb/early/xhci-dbc.c -index 341408410ed934..41118bba91978d 100644 ---- a/drivers/usb/early/xhci-dbc.c -+++ b/drivers/usb/early/xhci-dbc.c -@@ -681,6 +681,10 @@ int __init early_xdbc_setup_hardware(void) - - xdbc.table_base = NULL; - xdbc.out_buf = NULL; -+ -+ early_iounmap(xdbc.xhci_base, xdbc.xhci_length); -+ xdbc.xhci_base = NULL; -+ xdbc.xhci_length = 0; - } - - return ret; -diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c -index 4f326988be867c..22231ad96d6107 100644 ---- a/drivers/usb/gadget/composite.c -+++ b/drivers/usb/gadget/composite.c -@@ -2489,6 +2489,11 @@ int composite_os_desc_req_prepare(struct usb_composite_dev *cdev, - if (!cdev->os_desc_req->buf) { - ret = -ENOMEM; - usb_ep_free_request(ep0, cdev->os_desc_req); -+ /* -+ * Set os_desc_req to NULL so that composite_dev_cleanup() -+ * will not try to free it again. -+ */ -+ cdev->os_desc_req = NULL; - goto end; - } - cdev->os_desc_req->context = cdev; -diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c -index 749ba3596c2b3f..b350ee080236e2 100644 ---- a/drivers/usb/host/xhci-plat.c -+++ b/drivers/usb/host/xhci-plat.c -@@ -149,7 +149,7 @@ int xhci_plat_probe(struct platform_device *pdev, struct device *sysdev, const s - int ret; - int irq; - struct xhci_plat_priv *priv = NULL; -- bool of_match; -+ const struct of_device_id *of_match; - - if (usb_disabled()) - return -ENODEV; -diff --git a/drivers/usb/misc/apple-mfi-fastcharge.c b/drivers/usb/misc/apple-mfi-fastcharge.c -index ac8695195c13c8..8e852f4b8262e6 100644 ---- a/drivers/usb/misc/apple-mfi-fastcharge.c -+++ b/drivers/usb/misc/apple-mfi-fastcharge.c -@@ -44,6 +44,7 @@ MODULE_DEVICE_TABLE(usb, mfi_fc_id_table); - struct mfi_device { - struct usb_device *udev; - struct power_supply *battery; -+ struct power_supply_desc battery_desc; - int charge_type; - }; - -@@ -178,6 +179,7 @@ static int mfi_fc_probe(struct usb_device *udev) - { - struct power_supply_config battery_cfg = {}; - struct mfi_device *mfi = NULL; -+ char *battery_name; - int err; - - if (!mfi_fc_match(udev)) -@@ -187,23 +189,38 @@ static int mfi_fc_probe(struct usb_device *udev) - if (!mfi) - return -ENOMEM; - -+ battery_name = kasprintf(GFP_KERNEL, "apple_mfi_fastcharge_%d-%d", -+ udev->bus->busnum, udev->devnum); -+ if (!battery_name) { -+ err = -ENOMEM; -+ goto err_free_mfi; -+ } -+ -+ mfi->battery_desc = apple_mfi_fc_desc; -+ mfi->battery_desc.name = battery_name; -+ - battery_cfg.drv_data = mfi; - - mfi->charge_type = POWER_SUPPLY_CHARGE_TYPE_TRICKLE; - mfi->battery = power_supply_register(&udev->dev, -- &apple_mfi_fc_desc, -+ &mfi->battery_desc, - &battery_cfg); - if (IS_ERR(mfi->battery)) { - dev_err(&udev->dev, "Can't register battery\n"); - err = PTR_ERR(mfi->battery); -- kfree(mfi); -- return err; -+ goto err_free_name; - } - - mfi->udev = usb_get_dev(udev); - dev_set_drvdata(&udev->dev, mfi); - - return 0; -+ -+err_free_name: -+ kfree(battery_name); -+err_free_mfi: -+ kfree(mfi); -+ return err; - } - - static void mfi_fc_disconnect(struct usb_device *udev) -@@ -213,6 +230,7 @@ static void mfi_fc_disconnect(struct usb_device *udev) - mfi = dev_get_drvdata(&udev->dev); - if (mfi->battery) - power_supply_unregister(mfi->battery); -+ kfree(mfi->battery_desc.name); - dev_set_drvdata(&udev->dev, NULL); - usb_put_dev(mfi->udev); - kfree(mfi); -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 6c6387d39db82c..ac72b04c997bfb 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -2346,6 +2346,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = RSVD(3) }, - { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe145, 0xff), /* Foxconn T99W651 RNDIS */ - .driver_info = RSVD(5) | RSVD(6) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe15f, 0xff), /* Foxconn T99W709 */ -+ .driver_info = RSVD(5) }, - { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe167, 0xff), /* Foxconn T99W640 MBIM */ - .driver_info = RSVD(3) }, - { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ -diff --git a/drivers/vfio/group.c b/drivers/vfio/group.c -index 610a429c619125..54c3079031e165 100644 ---- a/drivers/vfio/group.c -+++ b/drivers/vfio/group.c -@@ -194,11 +194,10 @@ static int vfio_df_group_open(struct vfio_device_file *df) - * implies they expected translation to exist - */ - if (!capable(CAP_SYS_RAWIO) || -- vfio_iommufd_device_has_compat_ioas(device, df->iommufd)) -+ vfio_iommufd_device_has_compat_ioas(device, df->iommufd)) { - ret = -EPERM; -- else -- ret = 0; -- goto out_put_kvm; -+ goto out_put_kvm; -+ } - } - - ret = vfio_df_open(df); -diff --git a/drivers/vfio/iommufd.c b/drivers/vfio/iommufd.c -index 82eba6966fa508..02852899c2aee4 100644 ---- a/drivers/vfio/iommufd.c -+++ b/drivers/vfio/iommufd.c -@@ -25,6 +25,10 @@ int vfio_df_iommufd_bind(struct vfio_device_file *df) - - lockdep_assert_held(&vdev->dev_set->lock); - -+ /* Returns 0 to permit device opening under noiommu mode */ -+ if (vfio_device_is_noiommu(vdev)) -+ return 0; -+ - return vdev->ops->bind_iommufd(vdev, ictx, &df->devid); - } - -diff --git a/drivers/vfio/pci/pds/vfio_dev.c b/drivers/vfio/pci/pds/vfio_dev.c -index a286ebcc711262..69d1bcefd7c32e 100644 ---- a/drivers/vfio/pci/pds/vfio_dev.c -+++ b/drivers/vfio/pci/pds/vfio_dev.c -@@ -231,6 +231,7 @@ static const struct vfio_device_ops pds_vfio_ops = { - .bind_iommufd = vfio_iommufd_physical_bind, - .unbind_iommufd = vfio_iommufd_physical_unbind, - .attach_ioas = vfio_iommufd_physical_attach_ioas, -+ .detach_ioas = vfio_iommufd_physical_detach_ioas, - }; - - const struct vfio_device_ops *pds_vfio_ops_info(void) -diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c -index fa168b43423954..3f139360752e29 100644 ---- a/drivers/vfio/pci/vfio_pci_core.c -+++ b/drivers/vfio/pci/vfio_pci_core.c -@@ -2235,7 +2235,7 @@ int vfio_pci_core_register_device(struct vfio_pci_core_device *vdev) - return -EBUSY; - } - -- if (pci_is_root_bus(pdev->bus)) { -+ if (pci_is_root_bus(pdev->bus) || pdev->is_virtfn) { - ret = vfio_assign_device_set(&vdev->vdev, vdev); - } else if (!pci_probe_reset_slot(pdev->slot)) { - ret = vfio_assign_device_set(&vdev->vdev, pdev->slot); -diff --git a/drivers/vfio/vfio_main.c b/drivers/vfio/vfio_main.c -index 40732e8ed4c6fb..edb631e5e7ec99 100644 ---- a/drivers/vfio/vfio_main.c -+++ b/drivers/vfio/vfio_main.c -@@ -537,7 +537,8 @@ void vfio_df_close(struct vfio_device_file *df) - - lockdep_assert_held(&device->dev_set->lock); - -- vfio_assert_device_open(device); -+ if (!vfio_assert_device_open(device)) -+ return; - if (device->open_count == 1) - vfio_df_device_last_close(df); - device->open_count--; -diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c -index 66235151115740..90a3c0fc5ab0a6 100644 ---- a/drivers/vhost/scsi.c -+++ b/drivers/vhost/scsi.c -@@ -1032,10 +1032,8 @@ vhost_scsi_get_req(struct vhost_virtqueue *vq, struct vhost_scsi_ctx *vc, - /* validated at handler entry */ - vs_tpg = vhost_vq_get_backend(vq); - tpg = READ_ONCE(vs_tpg[*vc->target]); -- if (unlikely(!tpg)) { -- vq_err(vq, "Target 0x%x does not exist\n", *vc->target); -+ if (unlikely(!tpg)) - goto out; -- } - } - - if (tpgp) -diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c -index 9d095fe03e18ba..ed68ba89b80b8f 100644 ---- a/drivers/video/fbdev/core/fbcon.c -+++ b/drivers/video/fbdev/core/fbcon.c -@@ -935,13 +935,13 @@ static const char *fbcon_startup(void) - int rows, cols; - - /* -- * If num_registered_fb is zero, this is a call for the dummy part. -+ * If fbcon_num_registered_fb is zero, this is a call for the dummy part. - * The frame buffer devices weren't initialized yet. - */ - if (!fbcon_num_registered_fb || info_idx == -1) - return display_desc; - /* -- * Instead of blindly using registered_fb[0], we use info_idx, set by -+ * Instead of blindly using fbcon_registered_fb[0], we use info_idx, set by - * fbcon_fb_registered(); - */ - info = fbcon_registered_fb[info_idx]; -diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c -index 7042a43b81d856..5f9e98423d6569 100644 ---- a/drivers/video/fbdev/imxfb.c -+++ b/drivers/video/fbdev/imxfb.c -@@ -1004,8 +1004,13 @@ static int imxfb_probe(struct platform_device *pdev) - info->fix.smem_start = fbi->map_dma; - - INIT_LIST_HEAD(&info->modelist); -- for (i = 0; i < fbi->num_modes; i++) -- fb_add_videomode(&fbi->mode[i].mode, &info->modelist); -+ for (i = 0; i < fbi->num_modes; i++) { -+ ret = fb_add_videomode(&fbi->mode[i].mode, &info->modelist); -+ if (ret) { -+ dev_err(&pdev->dev, "Failed to add videomode\n"); -+ goto failed_cmap; -+ } -+ } - - /* - * This makes sure that our colour bitfield -diff --git a/drivers/watchdog/ziirave_wdt.c b/drivers/watchdog/ziirave_wdt.c -index 5ed33df68e9aba..e611d60316c683 100644 ---- a/drivers/watchdog/ziirave_wdt.c -+++ b/drivers/watchdog/ziirave_wdt.c -@@ -302,6 +302,9 @@ static int ziirave_firm_verify(struct watchdog_device *wdd, - const u16 len = be16_to_cpu(rec->len); - const u32 addr = be32_to_cpu(rec->addr); - -+ if (len > sizeof(data)) -+ return -EINVAL; -+ - if (ziirave_firm_addr_readonly(addr)) - continue; - -diff --git a/drivers/xen/gntdev-common.h b/drivers/xen/gntdev-common.h -index 9c286b2a190016..ac8ce3179ba2e9 100644 ---- a/drivers/xen/gntdev-common.h -+++ b/drivers/xen/gntdev-common.h -@@ -26,6 +26,10 @@ struct gntdev_priv { - /* lock protects maps and freeable_maps. */ - struct mutex lock; - -+ /* Free instances of struct gntdev_copy_batch. */ -+ struct gntdev_copy_batch *batch; -+ struct mutex batch_lock; -+ - #ifdef CONFIG_XEN_GRANT_DMA_ALLOC - /* Device for which DMA memory is allocated. */ - struct device *dma_dev; -diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c -index 61faea1f066305..1f21607656182a 100644 ---- a/drivers/xen/gntdev.c -+++ b/drivers/xen/gntdev.c -@@ -56,6 +56,18 @@ MODULE_AUTHOR("Derek G. Murray , " - "Gerd Hoffmann "); - MODULE_DESCRIPTION("User-space granted page access driver"); - -+#define GNTDEV_COPY_BATCH 16 -+ -+struct gntdev_copy_batch { -+ struct gnttab_copy ops[GNTDEV_COPY_BATCH]; -+ struct page *pages[GNTDEV_COPY_BATCH]; -+ s16 __user *status[GNTDEV_COPY_BATCH]; -+ unsigned int nr_ops; -+ unsigned int nr_pages; -+ bool writeable; -+ struct gntdev_copy_batch *next; -+}; -+ - static unsigned int limit = 64*1024; - module_param(limit, uint, 0644); - MODULE_PARM_DESC(limit, -@@ -584,6 +596,8 @@ static int gntdev_open(struct inode *inode, struct file *flip) - INIT_LIST_HEAD(&priv->maps); - mutex_init(&priv->lock); - -+ mutex_init(&priv->batch_lock); -+ - #ifdef CONFIG_XEN_GNTDEV_DMABUF - priv->dmabuf_priv = gntdev_dmabuf_init(flip); - if (IS_ERR(priv->dmabuf_priv)) { -@@ -608,6 +622,7 @@ static int gntdev_release(struct inode *inode, struct file *flip) - { - struct gntdev_priv *priv = flip->private_data; - struct gntdev_grant_map *map; -+ struct gntdev_copy_batch *batch; - - pr_debug("priv %p\n", priv); - -@@ -620,6 +635,14 @@ static int gntdev_release(struct inode *inode, struct file *flip) - } - mutex_unlock(&priv->lock); - -+ mutex_lock(&priv->batch_lock); -+ while (priv->batch) { -+ batch = priv->batch; -+ priv->batch = batch->next; -+ kfree(batch); -+ } -+ mutex_unlock(&priv->batch_lock); -+ - #ifdef CONFIG_XEN_GNTDEV_DMABUF - gntdev_dmabuf_fini(priv->dmabuf_priv); - #endif -@@ -785,17 +808,6 @@ static long gntdev_ioctl_notify(struct gntdev_priv *priv, void __user *u) - return rc; - } - --#define GNTDEV_COPY_BATCH 16 -- --struct gntdev_copy_batch { -- struct gnttab_copy ops[GNTDEV_COPY_BATCH]; -- struct page *pages[GNTDEV_COPY_BATCH]; -- s16 __user *status[GNTDEV_COPY_BATCH]; -- unsigned int nr_ops; -- unsigned int nr_pages; -- bool writeable; --}; -- - static int gntdev_get_page(struct gntdev_copy_batch *batch, void __user *virt, - unsigned long *gfn) - { -@@ -953,36 +965,53 @@ static int gntdev_grant_copy_seg(struct gntdev_copy_batch *batch, - static long gntdev_ioctl_grant_copy(struct gntdev_priv *priv, void __user *u) - { - struct ioctl_gntdev_grant_copy copy; -- struct gntdev_copy_batch batch; -+ struct gntdev_copy_batch *batch; - unsigned int i; - int ret = 0; - - if (copy_from_user(©, u, sizeof(copy))) - return -EFAULT; - -- batch.nr_ops = 0; -- batch.nr_pages = 0; -+ mutex_lock(&priv->batch_lock); -+ if (!priv->batch) { -+ batch = kmalloc(sizeof(*batch), GFP_KERNEL); -+ } else { -+ batch = priv->batch; -+ priv->batch = batch->next; -+ } -+ mutex_unlock(&priv->batch_lock); -+ if (!batch) -+ return -ENOMEM; -+ -+ batch->nr_ops = 0; -+ batch->nr_pages = 0; - - for (i = 0; i < copy.count; i++) { - struct gntdev_grant_copy_segment seg; - - if (copy_from_user(&seg, ©.segments[i], sizeof(seg))) { - ret = -EFAULT; -+ gntdev_put_pages(batch); - goto out; - } - -- ret = gntdev_grant_copy_seg(&batch, &seg, ©.segments[i].status); -- if (ret < 0) -+ ret = gntdev_grant_copy_seg(batch, &seg, ©.segments[i].status); -+ if (ret < 0) { -+ gntdev_put_pages(batch); - goto out; -+ } - - cond_resched(); - } -- if (batch.nr_ops) -- ret = gntdev_copy(&batch); -- return ret; -+ if (batch->nr_ops) -+ ret = gntdev_copy(batch); -+ -+ out: -+ mutex_lock(&priv->batch_lock); -+ batch->next = priv->batch; -+ priv->batch = batch; -+ mutex_unlock(&priv->batch_lock); - -- out: -- gntdev_put_pages(&batch); - return ret; - } - -diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c -index a123bb26acd8bd..d37104aa847a74 100644 ---- a/fs/f2fs/data.c -+++ b/fs/f2fs/data.c -@@ -288,7 +288,7 @@ static void f2fs_read_end_io(struct bio *bio) - { - struct f2fs_sb_info *sbi = F2FS_P_SB(bio_first_page_all(bio)); - struct bio_post_read_ctx *ctx; -- bool intask = in_task(); -+ bool intask = in_task() && !irqs_disabled(); - - iostat_update_and_unbind_ctx(bio); - ctx = bio->bi_private; -@@ -1552,8 +1552,11 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag) - end = pgofs + maxblocks; - - next_dnode: -- if (map->m_may_create) -+ if (map->m_may_create) { -+ if (f2fs_lfs_mode(sbi)) -+ f2fs_balance_fs(sbi, true); - f2fs_map_lock(sbi, flag); -+ } - - /* When reading holes, we need its node page */ - set_new_dnode(&dn, inode, NULL, NULL, 0); -diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c -index bfa2d89dc9ea3b..6a77581106a9e4 100644 ---- a/fs/f2fs/extent_cache.c -+++ b/fs/f2fs/extent_cache.c -@@ -382,7 +382,7 @@ void f2fs_init_read_extent_tree(struct inode *inode, struct page *ipage) - struct f2fs_extent *i_ext = &F2FS_INODE(ipage)->i_ext; - struct extent_tree *et; - struct extent_node *en; -- struct extent_info ei; -+ struct extent_info ei = {0}; - - if (!__may_extent_tree(inode, EX_READ)) { - /* drop largest read extent */ -diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h -index 2d9a86129bd8de..7329f706da83c3 100644 ---- a/fs/f2fs/f2fs.h -+++ b/fs/f2fs/f2fs.h -@@ -1245,7 +1245,7 @@ struct f2fs_bio_info { - #define RDEV(i) (raw_super->devs[i]) - struct f2fs_dev_info { - struct block_device *bdev; -- char path[MAX_PATH_LEN]; -+ char path[MAX_PATH_LEN + 1]; - unsigned int total_segments; - block_t start_blk; - block_t end_blk; -diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c -index 66721c2093c023..76ec2899cbe892 100644 ---- a/fs/f2fs/inode.c -+++ b/fs/f2fs/inode.c -@@ -905,6 +905,19 @@ void f2fs_evict_inode(struct inode *inode) - f2fs_update_inode_page(inode); - if (dquot_initialize_needed(inode)) - set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR); -+ -+ /* -+ * If both f2fs_truncate() and f2fs_update_inode_page() failed -+ * due to fuzzed corrupted inode, call f2fs_inode_synced() to -+ * avoid triggering later f2fs_bug_on(). -+ */ -+ if (is_inode_flag_set(inode, FI_DIRTY_INODE)) { -+ f2fs_warn(sbi, -+ "f2fs_evict_inode: inode is dirty, ino:%lu", -+ inode->i_ino); -+ f2fs_inode_synced(inode); -+ set_sbi_flag(sbi, SBI_NEED_FSCK); -+ } - } - if (!is_sbi_flag_set(sbi, SBI_IS_FREEZING)) - sb_end_intwrite(inode->i_sb); -@@ -921,8 +934,12 @@ void f2fs_evict_inode(struct inode *inode) - if (likely(!f2fs_cp_error(sbi) && - !is_sbi_flag_set(sbi, SBI_CP_DISABLED))) - f2fs_bug_on(sbi, is_inode_flag_set(inode, FI_DIRTY_INODE)); -- else -- f2fs_inode_synced(inode); -+ -+ /* -+ * anyway, it needs to remove the inode from sbi->inode_list[DIRTY_META] -+ * list to avoid UAF in f2fs_sync_inode_meta() during checkpoint. -+ */ -+ f2fs_inode_synced(inode); - - /* for the case f2fs_new_inode() was failed, .i_ino is zero, skip it */ - if (inode->i_ino) -diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h -index cd2ec6acc71776..a51a56bd0b61a4 100644 ---- a/fs/f2fs/segment.h -+++ b/fs/f2fs/segment.h -@@ -606,8 +606,7 @@ static inline void __get_secs_required(struct f2fs_sb_info *sbi, - unsigned int dent_blocks = total_dent_blocks % CAP_BLKS_PER_SEC(sbi); - unsigned int data_blocks = 0; - -- if (f2fs_lfs_mode(sbi) && -- unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) { -+ if (f2fs_lfs_mode(sbi)) { - total_data_blocks = get_pages(sbi, F2FS_DIRTY_DATA); - data_secs = total_data_blocks / CAP_BLKS_PER_SEC(sbi); - data_blocks = total_data_blocks % CAP_BLKS_PER_SEC(sbi); -@@ -616,7 +615,7 @@ static inline void __get_secs_required(struct f2fs_sb_info *sbi, - if (lower_p) - *lower_p = node_secs + dent_secs + data_secs; - if (upper_p) -- *upper_p = node_secs + dent_secs + -+ *upper_p = node_secs + dent_secs + data_secs + - (node_blocks ? 1 : 0) + (dent_blocks ? 1 : 0) + - (data_blocks ? 1 : 0); - if (curseg_p) -diff --git a/fs/gfs2/util.c b/fs/gfs2/util.c -index 268ff47b039636..fd921e07e12b28 100644 ---- a/fs/gfs2/util.c -+++ b/fs/gfs2/util.c -@@ -232,32 +232,23 @@ static void signal_our_withdraw(struct gfs2_sbd *sdp) - */ - ret = gfs2_glock_nq(&sdp->sd_live_gh); - -+ gfs2_glock_put(live_gl); /* drop extra reference we acquired */ -+ clear_bit(SDF_WITHDRAW_RECOVERY, &sdp->sd_flags); -+ - /* - * If we actually got the "live" lock in EX mode, there are no other -- * nodes available to replay our journal. So we try to replay it -- * ourselves. We hold the "live" glock to prevent other mounters -- * during recovery, then just dequeue it and reacquire it in our -- * normal SH mode. Just in case the problem that caused us to -- * withdraw prevents us from recovering our journal (e.g. io errors -- * and such) we still check if the journal is clean before proceeding -- * but we may wait forever until another mounter does the recovery. -+ * nodes available to replay our journal. - */ - if (ret == 0) { -- fs_warn(sdp, "No other mounters found. Trying to recover our " -- "own journal jid %d.\n", sdp->sd_lockstruct.ls_jid); -- if (gfs2_recover_journal(sdp->sd_jdesc, 1)) -- fs_warn(sdp, "Unable to recover our journal jid %d.\n", -- sdp->sd_lockstruct.ls_jid); -- gfs2_glock_dq_wait(&sdp->sd_live_gh); -- gfs2_holder_reinit(LM_ST_SHARED, -- LM_FLAG_NOEXP | GL_EXACT | GL_NOPID, -- &sdp->sd_live_gh); -- gfs2_glock_nq(&sdp->sd_live_gh); -+ fs_warn(sdp, "No other mounters found.\n"); -+ /* -+ * We are about to release the lockspace. By keeping live_gl -+ * locked here, we ensure that the next mounter coming along -+ * will be a "first" mounter which will perform recovery. -+ */ -+ goto skip_recovery; - } - -- gfs2_glock_put(live_gl); /* drop extra reference we acquired */ -- clear_bit(SDF_WITHDRAW_RECOVERY, &sdp->sd_flags); -- - /* - * At this point our journal is evicted, so we need to get a new inode - * for it. Once done, we need to call gfs2_find_jhead which -diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c -index 61ed76d1039276..6a89f22d89677d 100644 ---- a/fs/hfs/inode.c -+++ b/fs/hfs/inode.c -@@ -697,6 +697,7 @@ static const struct file_operations hfs_file_operations = { - .write_iter = generic_file_write_iter, - .mmap = generic_file_mmap, - .splice_read = filemap_splice_read, -+ .splice_write = iter_file_splice_write, - .fsync = hfs_file_fsync, - .open = hfs_file_open, - .release = hfs_file_release, -diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c -index 9c51867dddc51f..f6ac98b0d44ffd 100644 ---- a/fs/hfsplus/extents.c -+++ b/fs/hfsplus/extents.c -@@ -342,9 +342,6 @@ static int hfsplus_free_extents(struct super_block *sb, - int i; - int err = 0; - -- /* Mapping the allocation file may lock the extent tree */ -- WARN_ON(mutex_is_locked(&HFSPLUS_SB(sb)->ext_tree->tree_lock)); -- - hfsplus_dump_extent(extent); - for (i = 0; i < 8; extent++, i++) { - count = be32_to_cpu(extent->block_count); -diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c -index c65c8c4b03dd38..73ff191ff2adc5 100644 ---- a/fs/hfsplus/inode.c -+++ b/fs/hfsplus/inode.c -@@ -373,6 +373,7 @@ static const struct file_operations hfsplus_file_operations = { - .write_iter = generic_file_write_iter, - .mmap = generic_file_mmap, - .splice_read = filemap_splice_read, -+ .splice_write = iter_file_splice_write, - .fsync = hfsplus_file_fsync, - .open = hfsplus_file_open, - .release = hfsplus_file_release, -diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c -index 35e063c9f3a42e..5a877261c3fe48 100644 ---- a/fs/jfs/jfs_dmap.c -+++ b/fs/jfs/jfs_dmap.c -@@ -1809,8 +1809,10 @@ dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno, s64 * results) - return -EIO; - dp = (struct dmap *) mp->data; - -- if (dp->tree.budmin < 0) -+ if (dp->tree.budmin < 0) { -+ release_metapage(mp); - return -EIO; -+ } - - /* try to allocate the blocks. - */ -diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c -index 38918638423596..385baf871800c4 100644 ---- a/fs/nfs/dir.c -+++ b/fs/nfs/dir.c -@@ -1835,9 +1835,7 @@ static void block_revalidate(struct dentry *dentry) - - static void unblock_revalidate(struct dentry *dentry) - { -- /* store_release ensures wait_var_event() sees the update */ -- smp_store_release(&dentry->d_fsdata, NULL); -- wake_up_var(&dentry->d_fsdata); -+ store_release_wake_up(&dentry->d_fsdata, NULL); - } - - /* -diff --git a/fs/nfs/export.c b/fs/nfs/export.c -index be686b8e0c5465..aeb17adcb2b646 100644 ---- a/fs/nfs/export.c -+++ b/fs/nfs/export.c -@@ -66,14 +66,21 @@ nfs_fh_to_dentry(struct super_block *sb, struct fid *fid, - { - struct nfs_fattr *fattr = NULL; - struct nfs_fh *server_fh = nfs_exp_embedfh(fid->raw); -- size_t fh_size = offsetof(struct nfs_fh, data) + server_fh->size; -+ size_t fh_size = offsetof(struct nfs_fh, data); - const struct nfs_rpc_ops *rpc_ops; - struct dentry *dentry; - struct inode *inode; -- int len = EMBED_FH_OFF + XDR_QUADLEN(fh_size); -+ int len = EMBED_FH_OFF; - u32 *p = fid->raw; - int ret; - -+ /* Initial check of bounds */ -+ if (fh_len < len + XDR_QUADLEN(fh_size) || -+ fh_len > XDR_QUADLEN(NFS_MAXFHSIZE)) -+ return NULL; -+ /* Calculate embedded filehandle size */ -+ fh_size += server_fh->size; -+ len += XDR_QUADLEN(fh_size); - /* NULL translates to ESTALE */ - if (fh_len < len || fh_type != len) - return NULL; -diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c -index 0a26444fe20233..7354b6b1047833 100644 ---- a/fs/nfs/flexfilelayout/flexfilelayout.c -+++ b/fs/nfs/flexfilelayout/flexfilelayout.c -@@ -745,14 +745,14 @@ ff_layout_choose_ds_for_read(struct pnfs_layout_segment *lseg, - { - struct nfs4_ff_layout_segment *fls = FF_LAYOUT_LSEG(lseg); - struct nfs4_ff_layout_mirror *mirror; -- struct nfs4_pnfs_ds *ds; -+ struct nfs4_pnfs_ds *ds = ERR_PTR(-EAGAIN); - u32 idx; - - /* mirrors are initially sorted by efficiency */ - for (idx = start_idx; idx < fls->mirror_array_cnt; idx++) { - mirror = FF_LAYOUT_COMP(lseg, idx); - ds = nfs4_ff_layout_prepare_ds(lseg, mirror, false); -- if (!ds) -+ if (IS_ERR(ds)) - continue; - - if (check_device && -@@ -760,10 +760,10 @@ ff_layout_choose_ds_for_read(struct pnfs_layout_segment *lseg, - continue; - - *best_idx = idx; -- return ds; -+ break; - } - -- return NULL; -+ return ds; - } - - static struct nfs4_pnfs_ds * -@@ -933,7 +933,7 @@ ff_layout_pg_init_write(struct nfs_pageio_descriptor *pgio, - for (i = 0; i < pgio->pg_mirror_count; i++) { - mirror = FF_LAYOUT_COMP(pgio->pg_lseg, i); - ds = nfs4_ff_layout_prepare_ds(pgio->pg_lseg, mirror, true); -- if (!ds) { -+ if (IS_ERR(ds)) { - if (!ff_layout_no_fallback_to_mds(pgio->pg_lseg)) - goto out_mds; - pnfs_generic_pg_cleanup(pgio); -@@ -1839,6 +1839,7 @@ ff_layout_read_pagelist(struct nfs_pgio_header *hdr) - u32 idx = hdr->pgio_mirror_idx; - int vers; - struct nfs_fh *fh; -+ bool ds_fatal_error = false; - - dprintk("--> %s ino %lu pgbase %u req %zu@%llu\n", - __func__, hdr->inode->i_ino, -@@ -1846,8 +1847,10 @@ ff_layout_read_pagelist(struct nfs_pgio_header *hdr) - - mirror = FF_LAYOUT_COMP(lseg, idx); - ds = nfs4_ff_layout_prepare_ds(lseg, mirror, false); -- if (!ds) -+ if (IS_ERR(ds)) { -+ ds_fatal_error = nfs_error_is_fatal(PTR_ERR(ds)); - goto out_failed; -+ } - - ds_clnt = nfs4_ff_find_or_create_ds_client(mirror, ds->ds_clp, - hdr->inode); -@@ -1888,7 +1891,7 @@ ff_layout_read_pagelist(struct nfs_pgio_header *hdr) - return PNFS_ATTEMPTED; - - out_failed: -- if (ff_layout_avoid_mds_available_ds(lseg)) -+ if (ff_layout_avoid_mds_available_ds(lseg) && !ds_fatal_error) - return PNFS_TRY_AGAIN; - trace_pnfs_mds_fallback_read_pagelist(hdr->inode, - hdr->args.offset, hdr->args.count, -@@ -1909,11 +1912,14 @@ ff_layout_write_pagelist(struct nfs_pgio_header *hdr, int sync) - int vers; - struct nfs_fh *fh; - u32 idx = hdr->pgio_mirror_idx; -+ bool ds_fatal_error = false; - - mirror = FF_LAYOUT_COMP(lseg, idx); - ds = nfs4_ff_layout_prepare_ds(lseg, mirror, true); -- if (!ds) -+ if (IS_ERR(ds)) { -+ ds_fatal_error = nfs_error_is_fatal(PTR_ERR(ds)); - goto out_failed; -+ } - - ds_clnt = nfs4_ff_find_or_create_ds_client(mirror, ds->ds_clp, - hdr->inode); -@@ -1956,7 +1962,7 @@ ff_layout_write_pagelist(struct nfs_pgio_header *hdr, int sync) - return PNFS_ATTEMPTED; - - out_failed: -- if (ff_layout_avoid_mds_available_ds(lseg)) -+ if (ff_layout_avoid_mds_available_ds(lseg) && !ds_fatal_error) - return PNFS_TRY_AGAIN; - trace_pnfs_mds_fallback_write_pagelist(hdr->inode, - hdr->args.offset, hdr->args.count, -@@ -1998,7 +2004,7 @@ static int ff_layout_initiate_commit(struct nfs_commit_data *data, int how) - idx = calc_ds_index_from_commit(lseg, data->ds_commit_index); - mirror = FF_LAYOUT_COMP(lseg, idx); - ds = nfs4_ff_layout_prepare_ds(lseg, mirror, true); -- if (!ds) -+ if (IS_ERR(ds)) - goto out_err; - - ds_clnt = nfs4_ff_find_or_create_ds_client(mirror, ds->ds_clp, -diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c -index d21c5ecfbf1cc3..95d5dca6714563 100644 ---- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c -+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c -@@ -370,11 +370,11 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, - struct nfs4_ff_layout_mirror *mirror, - bool fail_return) - { -- struct nfs4_pnfs_ds *ds = NULL; -+ struct nfs4_pnfs_ds *ds; - struct inode *ino = lseg->pls_layout->plh_inode; - struct nfs_server *s = NFS_SERVER(ino); - unsigned int max_payload; -- int status; -+ int status = -EAGAIN; - - if (!ff_layout_init_mirror_ds(lseg->pls_layout, mirror)) - goto noconnect; -@@ -412,7 +412,7 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, - ff_layout_send_layouterror(lseg); - if (fail_return || !ff_layout_has_available_ds(lseg)) - pnfs_error_mark_layout_for_return(ino, lseg); -- ds = NULL; -+ ds = ERR_PTR(status); - out: - return ds; - } -diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h -index c29ad2e1d41635..8870c72416acbd 100644 ---- a/fs/nfs/internal.h -+++ b/fs/nfs/internal.h -@@ -613,9 +613,12 @@ nfs_write_match_verf(const struct nfs_writeverf *verf, - - static inline gfp_t nfs_io_gfp_mask(void) - { -- if (current->flags & PF_WQ_WORKER) -- return GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN; -- return GFP_KERNEL; -+ gfp_t ret = current_gfp_context(GFP_KERNEL); -+ -+ /* For workers __GFP_NORETRY only with __GFP_IO or __GFP_FS */ -+ if ((current->flags & PF_WQ_WORKER) && ret == GFP_KERNEL) -+ ret |= __GFP_NORETRY | __GFP_NOWARN; -+ return ret; - } - - /* -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 3085a2faab2d34..89d88d37e0cc5c 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -10630,7 +10630,7 @@ const struct nfs4_minor_version_ops *nfs_v4_minor_ops[] = { - - static ssize_t nfs4_listxattr(struct dentry *dentry, char *list, size_t size) - { -- ssize_t error, error2, error3, error4; -+ ssize_t error, error2, error3, error4 = 0; - size_t left = size; - - error = generic_listxattr(dentry, list, left); -@@ -10658,9 +10658,11 @@ static ssize_t nfs4_listxattr(struct dentry *dentry, char *list, size_t size) - left -= error3; - } - -- error4 = security_inode_listsecurity(d_inode(dentry), list, left); -- if (error4 < 0) -- return error4; -+ if (!nfs_server_capable(d_inode(dentry), NFS_CAP_SECURITY_LABEL)) { -+ error4 = security_inode_listsecurity(d_inode(dentry), list, left); -+ if (error4 < 0) -+ return error4; -+ } - - error += error2 + error3 + error4; - if (size && error > size) -diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c -index 9dac7f6e72d2bd..723ff9cad9ed92 100644 ---- a/fs/notify/fanotify/fanotify.c -+++ b/fs/notify/fanotify/fanotify.c -@@ -445,7 +445,13 @@ static int fanotify_encode_fh(struct fanotify_fh *fh, struct inode *inode, - dwords = fh_len >> 2; - type = exportfs_encode_fid(inode, buf, &dwords); - err = -EINVAL; -- if (type <= 0 || type == FILEID_INVALID || fh_len != dwords << 2) -+ /* -+ * Unlike file_handle, type and len of struct fanotify_fh are u8. -+ * Traditionally, filesystem return handle_type < 0xff, but there -+ * is no enforecement for that in vfs. -+ */ -+ BUILD_BUG_ON(MAX_HANDLE_SZ > 0xff || FILEID_INVALID > 0xff); -+ if (type <= 0 || type >= FILEID_INVALID || fh_len != dwords << 2) - goto out_err; - - fh->type = type; -diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c -index 4aea458216117f..a7fe2e02c32ee6 100644 ---- a/fs/ntfs3/file.c -+++ b/fs/ntfs3/file.c -@@ -299,7 +299,10 @@ static int ntfs_file_mmap(struct file *file, struct vm_area_struct *vma) - } - - if (ni->i_valid < to) { -- inode_lock(inode); -+ if (!inode_trylock(inode)) { -+ err = -EAGAIN; -+ goto out; -+ } - err = ntfs_extend_initialized_size(file, ni, - ni->i_valid, to); - inode_unlock(inode); -diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c -index 3c876c468c2c47..5c45fec832b00b 100644 ---- a/fs/ntfs3/frecord.c -+++ b/fs/ntfs3/frecord.c -@@ -3058,8 +3058,7 @@ int ni_add_name(struct ntfs_inode *dir_ni, struct ntfs_inode *ni, - * ni_rename - Remove one name and insert new name. - */ - int ni_rename(struct ntfs_inode *dir_ni, struct ntfs_inode *new_dir_ni, -- struct ntfs_inode *ni, struct NTFS_DE *de, struct NTFS_DE *new_de, -- bool *is_bad) -+ struct ntfs_inode *ni, struct NTFS_DE *de, struct NTFS_DE *new_de) - { - int err; - struct NTFS_DE *de2 = NULL; -@@ -3082,8 +3081,8 @@ int ni_rename(struct ntfs_inode *dir_ni, struct ntfs_inode *new_dir_ni, - err = ni_add_name(new_dir_ni, ni, new_de); - if (!err) { - err = ni_remove_name(dir_ni, ni, de, &de2, &undo); -- if (err && ni_remove_name(new_dir_ni, ni, new_de, &de2, &undo)) -- *is_bad = true; -+ WARN_ON(err && ni_remove_name(new_dir_ni, ni, new_de, &de2, -+ &undo)); - } - - /* -diff --git a/fs/ntfs3/namei.c b/fs/ntfs3/namei.c -index 61c4da8e6c3de9..f5901c23ab9379 100644 ---- a/fs/ntfs3/namei.c -+++ b/fs/ntfs3/namei.c -@@ -261,7 +261,7 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *dir, - struct ntfs_inode *ni = ntfs_i(inode); - struct inode *new_inode = d_inode(new_dentry); - struct NTFS_DE *de, *new_de; -- bool is_same, is_bad; -+ bool is_same; - /* - * de - memory of PATH_MAX bytes: - * [0-1024) - original name (dentry->d_name) -@@ -330,12 +330,8 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *dir, - if (dir_ni != new_dir_ni) - ni_lock_dir2(new_dir_ni); - -- is_bad = false; -- err = ni_rename(dir_ni, new_dir_ni, ni, de, new_de, &is_bad); -- if (is_bad) { -- /* Restore after failed rename failed too. */ -- _ntfs_bad_inode(inode); -- } else if (!err) { -+ err = ni_rename(dir_ni, new_dir_ni, ni, de, new_de); -+ if (!err) { - simple_rename_timestamp(dir, dentry, new_dir, new_dentry); - mark_inode_dirty(inode); - mark_inode_dirty(dir); -diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h -index c98e6868bfbadb..72810d8f62ee9d 100644 ---- a/fs/ntfs3/ntfs_fs.h -+++ b/fs/ntfs3/ntfs_fs.h -@@ -577,8 +577,7 @@ int ni_add_name(struct ntfs_inode *dir_ni, struct ntfs_inode *ni, - struct NTFS_DE *de); - - int ni_rename(struct ntfs_inode *dir_ni, struct ntfs_inode *new_dir_ni, -- struct ntfs_inode *ni, struct NTFS_DE *de, struct NTFS_DE *new_de, -- bool *is_bad); -+ struct ntfs_inode *ni, struct NTFS_DE *de, struct NTFS_DE *new_de); - - bool ni_is_dirty(struct inode *inode); - -diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c -index fa41db08848802..b57140ebfad0f7 100644 ---- a/fs/orangefs/orangefs-debugfs.c -+++ b/fs/orangefs/orangefs-debugfs.c -@@ -728,8 +728,8 @@ static void do_k_string(void *k_mask, int index) - - if (*mask & s_kmod_keyword_mask_map[index].mask_val) { - if ((strlen(kernel_debug_string) + -- strlen(s_kmod_keyword_mask_map[index].keyword)) -- < ORANGEFS_MAX_DEBUG_STRING_LEN - 1) { -+ strlen(s_kmod_keyword_mask_map[index].keyword) + 1) -+ < ORANGEFS_MAX_DEBUG_STRING_LEN) { - strcat(kernel_debug_string, - s_kmod_keyword_mask_map[index].keyword); - strcat(kernel_debug_string, ","); -@@ -756,7 +756,7 @@ static void do_c_string(void *c_mask, int index) - (mask->mask2 & cdm_array[index].mask2)) { - if ((strlen(client_debug_string) + - strlen(cdm_array[index].keyword) + 1) -- < ORANGEFS_MAX_DEBUG_STRING_LEN - 2) { -+ < ORANGEFS_MAX_DEBUG_STRING_LEN) { - strcat(client_debug_string, - cdm_array[index].keyword); - strcat(client_debug_string, ","); -diff --git a/fs/proc/generic.c b/fs/proc/generic.c -index c8785d68e870bf..2187d9ca351ced 100644 ---- a/fs/proc/generic.c -+++ b/fs/proc/generic.c -@@ -567,6 +567,8 @@ static void pde_set_flags(struct proc_dir_entry *pde) - if (pde->proc_ops->proc_compat_ioctl) - pde->flags |= PROC_ENTRY_proc_compat_ioctl; - #endif -+ if (pde->proc_ops->proc_lseek) -+ pde->flags |= PROC_ENTRY_proc_lseek; - } - - struct proc_dir_entry *proc_create_data(const char *name, umode_t mode, -diff --git a/fs/proc/inode.c b/fs/proc/inode.c -index 4b3ae7e0def32e..92772702d3695c 100644 ---- a/fs/proc/inode.c -+++ b/fs/proc/inode.c -@@ -494,7 +494,7 @@ static int proc_reg_open(struct inode *inode, struct file *file) - typeof_member(struct proc_ops, proc_release) release; - struct pde_opener *pdeo; - -- if (!pde->proc_ops->proc_lseek) -+ if (!pde_has_proc_lseek(pde)) - file->f_mode &= ~FMODE_LSEEK; - - if (pde_is_permanent(pde)) { -diff --git a/fs/proc/internal.h b/fs/proc/internal.h -index 445c74a39a931f..fe378136012076 100644 ---- a/fs/proc/internal.h -+++ b/fs/proc/internal.h -@@ -98,6 +98,11 @@ static inline bool pde_has_proc_compat_ioctl(const struct proc_dir_entry *pde) - #endif - } - -+static inline bool pde_has_proc_lseek(const struct proc_dir_entry *pde) -+{ -+ return pde->flags & PROC_ENTRY_proc_lseek; -+} -+ - extern struct kmem_cache *proc_dir_entry_cache; - void pde_free(struct proc_dir_entry *pde); - -diff --git a/fs/smb/client/cifs_debug.c b/fs/smb/client/cifs_debug.c -index 4a20e92474b234..50ad8246ed187c 100644 ---- a/fs/smb/client/cifs_debug.c -+++ b/fs/smb/client/cifs_debug.c -@@ -384,7 +384,7 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v) - seq_printf(m, "\nSMBDirect (in hex) protocol version: %x " - "transport status: %x", - server->smbd_conn->protocol, -- server->smbd_conn->transport_status); -+ server->smbd_conn->socket.status); - seq_printf(m, "\nConn receive_credit_max: %x " - "send_credit_target: %x max_send_size: %x", - server->smbd_conn->receive_credit_max, -diff --git a/fs/smb/client/cifsacl.c b/fs/smb/client/cifsacl.c -index bf32bc22ebd69f..7bd29e827c8f1b 100644 ---- a/fs/smb/client/cifsacl.c -+++ b/fs/smb/client/cifsacl.c -@@ -187,7 +187,7 @@ compare_sids(const struct smb_sid *ctsid, const struct smb_sid *cwsid) - /* compare all of the subauth values if any */ - num_sat = ctsid->num_subauth; - num_saw = cwsid->num_subauth; -- num_subauth = num_sat < num_saw ? num_sat : num_saw; -+ num_subauth = min(num_sat, num_saw); - if (num_subauth) { - for (i = 0; i < num_subauth; ++i) { - if (ctsid->sub_auth[i] != cwsid->sub_auth[i]) { -diff --git a/fs/smb/client/cifsacl.h b/fs/smb/client/cifsacl.h -index cbaed8038e3654..05b3650ba0aec8 100644 ---- a/fs/smb/client/cifsacl.h -+++ b/fs/smb/client/cifsacl.h -@@ -144,7 +144,7 @@ struct smb3_sd { - #define ACL_CONTROL_SI 0x0800 /* SACL Auto-Inherited */ - #define ACL_CONTROL_DI 0x0400 /* DACL Auto-Inherited */ - #define ACL_CONTROL_SC 0x0200 /* SACL computed through inheritance */ --#define ACL_CONTROL_DC 0x0100 /* DACL computed through inheritence */ -+#define ACL_CONTROL_DC 0x0100 /* DACL computed through inheritance */ - #define ACL_CONTROL_SS 0x0080 /* Create server ACL */ - #define ACL_CONTROL_DT 0x0040 /* DACL provided by trusted source */ - #define ACL_CONTROL_SD 0x0020 /* SACL defaulted */ -diff --git a/fs/smb/client/cifsencrypt.c b/fs/smb/client/cifsencrypt.c -index b0473c2567fe68..da3d003cb43db8 100644 ---- a/fs/smb/client/cifsencrypt.c -+++ b/fs/smb/client/cifsencrypt.c -@@ -353,7 +353,7 @@ int cifs_verify_signature(struct smb_rqst *rqst, - cifs_dbg(FYI, "dummy signature received for smb command 0x%x\n", - cifs_pdu->Command); - -- /* save off the origiginal signature so we can modify the smb and check -+ /* save off the original signature so we can modify the smb and check - its signature against what the server sent */ - memcpy(server_response_sig, cifs_pdu->Signature.SecuritySignature, 8); - -diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c -index bbb0ef18d7b8c8..a1ab95f382d566 100644 ---- a/fs/smb/client/cifsfs.c -+++ b/fs/smb/client/cifsfs.c -@@ -161,7 +161,7 @@ __u32 cifs_lock_secret; - - /* - * Bumps refcount for cifs super block. -- * Note that it should be only called if a referece to VFS super block is -+ * Note that it should be only called if a reference to VFS super block is - * already held, e.g. in open-type syscalls context. Otherwise it can race with - * atomic_dec_and_test in deactivate_locked_super. - */ -@@ -289,7 +289,7 @@ static void cifs_kill_sb(struct super_block *sb) - struct cifs_sb_info *cifs_sb = CIFS_SB(sb); - - /* -- * We ned to release all dentries for the cached directories -+ * We need to release all dentries for the cached directories - * before we kill the sb. - */ - if (cifs_sb->root) { -diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h -index c9b37f2ebde853..4bafb1adfb2235 100644 ---- a/fs/smb/client/cifsglob.h -+++ b/fs/smb/client/cifsglob.h -@@ -785,7 +785,7 @@ struct TCP_Server_Info { - } compression; - __u16 signing_algorithm; - __le16 cipher_type; -- /* save initital negprot hash */ -+ /* save initial negprot hash */ - __u8 preauth_sha_hash[SMB2_PREAUTH_HASH_SIZE]; - bool signing_negotiated; /* true if valid signing context rcvd from server */ - bool posix_ext_supported; -diff --git a/fs/smb/client/cifspdu.h b/fs/smb/client/cifspdu.h -index 763178b7745424..f4cfb082dfd146 100644 ---- a/fs/smb/client/cifspdu.h -+++ b/fs/smb/client/cifspdu.h -@@ -781,7 +781,7 @@ typedef struct smb_com_logoff_andx_rsp { - __u16 ByteCount; - } __attribute__((packed)) LOGOFF_ANDX_RSP; - --typedef union smb_com_tree_disconnect { /* as an altetnative can use flag on -+typedef union smb_com_tree_disconnect { /* as an alternative can use flag on - tree_connect PDU to effect disconnect */ - /* tdis is probably simplest SMB PDU */ - struct { -@@ -2405,7 +2405,7 @@ struct cifs_posix_ace { /* access control entry (ACE) */ - __le64 cifs_uid; /* or gid */ - } __attribute__((packed)); - --struct cifs_posix_acl { /* access conrol list (ACL) */ -+struct cifs_posix_acl { /* access control list (ACL) */ - __le16 version; - __le16 access_entry_count; /* access ACL - count of entries */ - __le16 default_entry_count; /* default ACL - count of entries */ -diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c -index db35e68e8a5830..81d425f571e28d 100644 ---- a/fs/smb/client/cifssmb.c -+++ b/fs/smb/client/cifssmb.c -@@ -1214,7 +1214,7 @@ CIFS_open(const unsigned int xid, struct cifs_open_parms *oparms, int *oplock, - req->CreateDisposition = cpu_to_le32(disposition); - req->CreateOptions = cpu_to_le32(create_options & CREATE_OPTIONS_MASK); - -- /* BB Expirement with various impersonation levels and verify */ -+ /* BB Experiment with various impersonation levels and verify */ - req->ImpersonationLevel = cpu_to_le32(SECURITY_IMPERSONATION); - req->SecurityFlags = SECURITY_CONTEXT_TRACKING|SECURITY_EFFECTIVE_ONLY; - -@@ -2993,7 +2993,7 @@ static void cifs_init_ace(struct cifs_posix_ace *cifs_ace, - - /** - * posix_acl_to_cifs - convert ACLs from POSIX ACL to cifs format -- * @parm_data: ACLs in cifs format to conver to -+ * @parm_data: ACLs in cifs format to convert to - * @acl: ACLs in POSIX ACL format to convert from - * @acl_type: the type of POSIX ACLs stored in @acl - * -@@ -3970,7 +3970,7 @@ CIFSFindFirst(const unsigned int xid, struct cifs_tcon *tcon, - name_len = - cifsConvertToUTF16((__le16 *) pSMB->FileName, searchName, - PATH_MAX, nls_codepage, remap); -- /* We can not add the asterik earlier in case -+ /* We can not add the asterisk earlier in case - it got remapped to 0xF03A as if it were part of the - directory name instead of a wildcard */ - name_len *= 2; -diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c -index 99a8c6fbd41a65..7a2b81fbd9cfd2 100644 ---- a/fs/smb/client/file.c -+++ b/fs/smb/client/file.c -@@ -2421,7 +2421,7 @@ cifs_get_writable_file(struct cifsInodeInfo *cifs_inode, int flags, - } - } - } -- /* couldn't find useable FH with same pid, try any available */ -+ /* couldn't find usable FH with same pid, try any available */ - if (!any_available) { - any_available = true; - goto refind_writable; -diff --git a/fs/smb/client/fs_context.h b/fs/smb/client/fs_context.h -index 52ee72e562f5f6..90ebff5d0199d9 100644 ---- a/fs/smb/client/fs_context.h -+++ b/fs/smb/client/fs_context.h -@@ -263,7 +263,7 @@ struct smb3_fs_context { - unsigned int min_offload; - unsigned int retrans; - bool sockopt_tcp_nodelay:1; -- /* attribute cache timemout for files and directories in jiffies */ -+ /* attribute cache timeout for files and directories in jiffies */ - unsigned long acregmax; - unsigned long acdirmax; - /* timeout for deferred close of files in jiffies */ -diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c -index bbbe48447765de..ad77952f6d810b 100644 ---- a/fs/smb/client/misc.c -+++ b/fs/smb/client/misc.c -@@ -260,7 +260,7 @@ free_rsp_buf(int resp_buftype, void *rsp) - } - - /* NB: MID can not be set if treeCon not passed in, in that -- case it is responsbility of caller to set the mid */ -+ case it is responsibility of caller to set the mid */ - void - header_assemble(struct smb_hdr *buffer, char smb_command /* command */ , - const struct cifs_tcon *treeCon, int word_count -diff --git a/fs/smb/client/netmisc.c b/fs/smb/client/netmisc.c -index 1b52e6ac431cb0..2a8d71221e5e71 100644 ---- a/fs/smb/client/netmisc.c -+++ b/fs/smb/client/netmisc.c -@@ -1003,7 +1003,7 @@ struct timespec64 cnvrtDosUnixTm(__le16 le_date, __le16 le_time, int offset) - year is 2**7, the last year is 1980+127, which means we need only - consider 2 special case years, ie the years 2000 and 2100, and only - adjust for the lack of leap year for the year 2100, as 2000 was a -- leap year (divisable by 400) */ -+ leap year (divisible by 400) */ - if (year >= 120) /* the year 2100 */ - days = days - 1; /* do not count leap year for the year 2100 */ - -diff --git a/fs/smb/client/readdir.c b/fs/smb/client/readdir.c -index 0be16f8acd9af5..5febf8afaab042 100644 ---- a/fs/smb/client/readdir.c -+++ b/fs/smb/client/readdir.c -@@ -567,7 +567,7 @@ static void cifs_fill_dirent_std(struct cifs_dirent *de, - const FIND_FILE_STANDARD_INFO *info) - { - de->name = &info->FileName[0]; -- /* one byte length, no endianess conversion */ -+ /* one byte length, no endianness conversion */ - de->namelen = info->FileNameLength; - de->resume_key = info->ResumeKey; - } -@@ -832,7 +832,7 @@ static bool emit_cached_dirents(struct cached_dirents *cde, - * However, this sequence of ->pos values may have holes - * in it, for example dot-dirs returned from the server - * are suppressed. -- * Handle this bu forcing ctx->pos to be the same as the -+ * Handle this by forcing ctx->pos to be the same as the - * ->pos of the current dirent we emit from the cache. - * This means that when we emit these entries from the cache - * we now emit them with the same ->pos value as in the -diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c -index 2385e570e3311a..d0734aa1961a3e 100644 ---- a/fs/smb/client/smb2ops.c -+++ b/fs/smb/client/smb2ops.c -@@ -2132,7 +2132,7 @@ smb3_enum_snapshots(const unsigned int xid, struct cifs_tcon *tcon, - NULL, 0 /* no input data */, max_response_size, - (char **)&retbuf, - &ret_data_len); -- cifs_dbg(FYI, "enum snaphots ioctl returned %d and ret buflen is %d\n", -+ cifs_dbg(FYI, "enum snapshots ioctl returned %d and ret buflen is %d\n", - rc, ret_data_len); - if (rc) - return rc; -@@ -3540,7 +3540,7 @@ static long smb3_simple_falloc(struct file *file, struct cifs_tcon *tcon, - /* - * At this point, we are trying to fallocate an internal - * regions of a sparse file. Since smb2 does not have a -- * fallocate command we have two otions on how to emulate this. -+ * fallocate command we have two options on how to emulate this. - * We can either turn the entire file to become non-sparse - * which we only do if the fallocate is for virtually - * the whole file, or we can overwrite the region with zeroes -diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c -index 357abb0170c495..e58cad5d735a22 100644 ---- a/fs/smb/client/smb2pdu.c -+++ b/fs/smb/client/smb2pdu.c -@@ -2989,7 +2989,7 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, - - SMB2_close(xid, tcon, rsp->PersistentFileId, rsp->VolatileFileId); - -- /* Eventually save off posix specific response info and timestaps */ -+ /* Eventually save off posix specific response info and timestamps */ - - err_free_rsp_buf: - free_rsp_buf(resp_buftype, rsp_iov.iov_base); -@@ -4574,7 +4574,7 @@ smb2_readv_callback(struct mid_q_entry *mid) - } - #ifdef CONFIG_CIFS_SMB_DIRECT - /* -- * If this rdata has a memmory registered, the MR can be freed -+ * If this rdata has a memory registered, the MR can be freed - * MR needs to be freed as soon as I/O finishes to prevent deadlock - * because they have limited number and are used for future I/Os - */ -diff --git a/fs/smb/client/smb2transport.c b/fs/smb/client/smb2transport.c -index 4a43802375b3a3..99081e9d6283a2 100644 ---- a/fs/smb/client/smb2transport.c -+++ b/fs/smb/client/smb2transport.c -@@ -720,7 +720,7 @@ smb2_verify_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server) - shdr->Command); - - /* -- * Save off the origiginal signature so we can modify the smb and check -+ * Save off the original signature so we can modify the smb and check - * our calculated signature against what the server sent. - */ - memcpy(server_response_sig, shdr->Signature, SMB2_SIGNATURE_SIZE); -diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c -index d74e829de51c22..48d020e1f663b5 100644 ---- a/fs/smb/client/smbdirect.c -+++ b/fs/smb/client/smbdirect.c -@@ -164,10 +164,11 @@ static void smbd_disconnect_rdma_work(struct work_struct *work) - { - struct smbd_connection *info = - container_of(work, struct smbd_connection, disconnect_work); -+ struct smbdirect_socket *sc = &info->socket; - -- if (info->transport_status == SMBD_CONNECTED) { -- info->transport_status = SMBD_DISCONNECTING; -- rdma_disconnect(info->id); -+ if (sc->status == SMBDIRECT_SOCKET_CONNECTED) { -+ sc->status = SMBDIRECT_SOCKET_DISCONNECTING; -+ rdma_disconnect(sc->rdma.cm_id); - } - } - -@@ -181,6 +182,7 @@ static int smbd_conn_upcall( - struct rdma_cm_id *id, struct rdma_cm_event *event) - { - struct smbd_connection *info = id->context; -+ struct smbdirect_socket *sc = &info->socket; - - log_rdma_event(INFO, "event=%d status=%d\n", - event->event, event->status); -@@ -204,7 +206,7 @@ static int smbd_conn_upcall( - - case RDMA_CM_EVENT_ESTABLISHED: - log_rdma_event(INFO, "connected event=%d\n", event->event); -- info->transport_status = SMBD_CONNECTED; -+ sc->status = SMBDIRECT_SOCKET_CONNECTED; - wake_up_interruptible(&info->conn_wait); - break; - -@@ -212,20 +214,20 @@ static int smbd_conn_upcall( - case RDMA_CM_EVENT_UNREACHABLE: - case RDMA_CM_EVENT_REJECTED: - log_rdma_event(INFO, "connecting failed event=%d\n", event->event); -- info->transport_status = SMBD_DISCONNECTED; -+ sc->status = SMBDIRECT_SOCKET_DISCONNECTED; - wake_up_interruptible(&info->conn_wait); - break; - - case RDMA_CM_EVENT_DEVICE_REMOVAL: - case RDMA_CM_EVENT_DISCONNECTED: -- /* This happenes when we fail the negotiation */ -- if (info->transport_status == SMBD_NEGOTIATE_FAILED) { -- info->transport_status = SMBD_DISCONNECTED; -+ /* This happens when we fail the negotiation */ -+ if (sc->status == SMBDIRECT_SOCKET_NEGOTIATE_FAILED) { -+ sc->status = SMBDIRECT_SOCKET_DISCONNECTED; - wake_up(&info->conn_wait); - break; - } - -- info->transport_status = SMBD_DISCONNECTED; -+ sc->status = SMBDIRECT_SOCKET_DISCONNECTED; - wake_up_interruptible(&info->disconn_wait); - wake_up_interruptible(&info->wait_reassembly_queue); - wake_up_interruptible_all(&info->wait_send_queue); -@@ -274,6 +276,8 @@ static void send_done(struct ib_cq *cq, struct ib_wc *wc) - int i; - struct smbd_request *request = - container_of(wc->wr_cqe, struct smbd_request, cqe); -+ struct smbd_connection *info = request->info; -+ struct smbdirect_socket *sc = &info->socket; - - log_rdma_send(INFO, "smbd_request 0x%p completed wc->status=%d\n", - request, wc->status); -@@ -285,7 +289,7 @@ static void send_done(struct ib_cq *cq, struct ib_wc *wc) - } - - for (i = 0; i < request->num_sge; i++) -- ib_dma_unmap_single(request->info->id->device, -+ ib_dma_unmap_single(sc->ib.dev, - request->sge[i].addr, - request->sge[i].length, - DMA_TO_DEVICE); -@@ -392,8 +396,9 @@ static void smbd_post_send_credits(struct work_struct *work) - struct smbd_connection *info = - container_of(work, struct smbd_connection, - post_send_credits_work); -+ struct smbdirect_socket *sc = &info->socket; - -- if (info->transport_status != SMBD_CONNECTED) { -+ if (sc->status != SMBDIRECT_SOCKET_CONNECTED) { - wake_up(&info->wait_receive_queues); - return; - } -@@ -460,7 +465,6 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) - if (wc->status != IB_WC_SUCCESS || wc->opcode != IB_WC_RECV) { - log_rdma_recv(INFO, "wc->status=%d opcode=%d\n", - wc->status, wc->opcode); -- smbd_disconnect_rdma_connection(info); - goto error; - } - -@@ -477,8 +481,9 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) - info->full_packet_received = true; - info->negotiate_done = - process_negotiation_response(response, wc->byte_len); -+ put_receive_buffer(info, response); - complete(&info->negotiate_completion); -- break; -+ return; - - /* SMBD data transfer packet */ - case SMBD_TRANSFER_DATA: -@@ -535,14 +540,16 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) - } - - return; -- -- default: -- log_rdma_recv(ERR, -- "unexpected response type=%d\n", response->type); - } - -+ /* -+ * This is an internal error! -+ */ -+ log_rdma_recv(ERR, "unexpected response type=%d\n", response->type); -+ WARN_ON_ONCE(response->type != SMBD_TRANSFER_DATA); - error: - put_receive_buffer(info, response); -+ smbd_disconnect_rdma_connection(info); - } - - static struct rdma_cm_id *smbd_create_id( -@@ -634,32 +641,34 @@ static int smbd_ia_open( - struct smbd_connection *info, - struct sockaddr *dstaddr, int port) - { -+ struct smbdirect_socket *sc = &info->socket; - int rc; - -- info->id = smbd_create_id(info, dstaddr, port); -- if (IS_ERR(info->id)) { -- rc = PTR_ERR(info->id); -+ sc->rdma.cm_id = smbd_create_id(info, dstaddr, port); -+ if (IS_ERR(sc->rdma.cm_id)) { -+ rc = PTR_ERR(sc->rdma.cm_id); - goto out1; - } -+ sc->ib.dev = sc->rdma.cm_id->device; - -- if (!frwr_is_supported(&info->id->device->attrs)) { -+ if (!frwr_is_supported(&sc->ib.dev->attrs)) { - log_rdma_event(ERR, "Fast Registration Work Requests (FRWR) is not supported\n"); - log_rdma_event(ERR, "Device capability flags = %llx max_fast_reg_page_list_len = %u\n", -- info->id->device->attrs.device_cap_flags, -- info->id->device->attrs.max_fast_reg_page_list_len); -+ sc->ib.dev->attrs.device_cap_flags, -+ sc->ib.dev->attrs.max_fast_reg_page_list_len); - rc = -EPROTONOSUPPORT; - goto out2; - } - info->max_frmr_depth = min_t(int, - smbd_max_frmr_depth, -- info->id->device->attrs.max_fast_reg_page_list_len); -+ sc->ib.dev->attrs.max_fast_reg_page_list_len); - info->mr_type = IB_MR_TYPE_MEM_REG; -- if (info->id->device->attrs.kernel_cap_flags & IBK_SG_GAPS_REG) -+ if (sc->ib.dev->attrs.kernel_cap_flags & IBK_SG_GAPS_REG) - info->mr_type = IB_MR_TYPE_SG_GAPS; - -- info->pd = ib_alloc_pd(info->id->device, 0); -- if (IS_ERR(info->pd)) { -- rc = PTR_ERR(info->pd); -+ sc->ib.pd = ib_alloc_pd(sc->ib.dev, 0); -+ if (IS_ERR(sc->ib.pd)) { -+ rc = PTR_ERR(sc->ib.pd); - log_rdma_event(ERR, "ib_alloc_pd() returned %d\n", rc); - goto out2; - } -@@ -667,8 +676,8 @@ static int smbd_ia_open( - return 0; - - out2: -- rdma_destroy_id(info->id); -- info->id = NULL; -+ rdma_destroy_id(sc->rdma.cm_id); -+ sc->rdma.cm_id = NULL; - - out1: - return rc; -@@ -682,6 +691,7 @@ static int smbd_ia_open( - */ - static int smbd_post_send_negotiate_req(struct smbd_connection *info) - { -+ struct smbdirect_socket *sc = &info->socket; - struct ib_send_wr send_wr; - int rc = -ENOMEM; - struct smbd_request *request; -@@ -705,18 +715,18 @@ static int smbd_post_send_negotiate_req(struct smbd_connection *info) - - request->num_sge = 1; - request->sge[0].addr = ib_dma_map_single( -- info->id->device, (void *)packet, -+ sc->ib.dev, (void *)packet, - sizeof(*packet), DMA_TO_DEVICE); -- if (ib_dma_mapping_error(info->id->device, request->sge[0].addr)) { -+ if (ib_dma_mapping_error(sc->ib.dev, request->sge[0].addr)) { - rc = -EIO; - goto dma_mapping_failed; - } - - request->sge[0].length = sizeof(*packet); -- request->sge[0].lkey = info->pd->local_dma_lkey; -+ request->sge[0].lkey = sc->ib.pd->local_dma_lkey; - - ib_dma_sync_single_for_device( -- info->id->device, request->sge[0].addr, -+ sc->ib.dev, request->sge[0].addr, - request->sge[0].length, DMA_TO_DEVICE); - - request->cqe.done = send_done; -@@ -733,14 +743,14 @@ static int smbd_post_send_negotiate_req(struct smbd_connection *info) - request->sge[0].length, request->sge[0].lkey); - - atomic_inc(&info->send_pending); -- rc = ib_post_send(info->id->qp, &send_wr, NULL); -+ rc = ib_post_send(sc->ib.qp, &send_wr, NULL); - if (!rc) - return 0; - - /* if we reach here, post send failed */ - log_rdma_send(ERR, "ib_post_send failed rc=%d\n", rc); - atomic_dec(&info->send_pending); -- ib_dma_unmap_single(info->id->device, request->sge[0].addr, -+ ib_dma_unmap_single(sc->ib.dev, request->sge[0].addr, - request->sge[0].length, DMA_TO_DEVICE); - - smbd_disconnect_rdma_connection(info); -@@ -792,6 +802,7 @@ static int manage_keep_alive_before_sending(struct smbd_connection *info) - static int smbd_post_send(struct smbd_connection *info, - struct smbd_request *request) - { -+ struct smbdirect_socket *sc = &info->socket; - struct ib_send_wr send_wr; - int rc, i; - -@@ -800,7 +811,7 @@ static int smbd_post_send(struct smbd_connection *info, - "rdma_request sge[%d] addr=0x%llx length=%u\n", - i, request->sge[i].addr, request->sge[i].length); - ib_dma_sync_single_for_device( -- info->id->device, -+ sc->ib.dev, - request->sge[i].addr, - request->sge[i].length, - DMA_TO_DEVICE); -@@ -815,7 +826,7 @@ static int smbd_post_send(struct smbd_connection *info, - send_wr.opcode = IB_WR_SEND; - send_wr.send_flags = IB_SEND_SIGNALED; - -- rc = ib_post_send(info->id->qp, &send_wr, NULL); -+ rc = ib_post_send(sc->ib.qp, &send_wr, NULL); - if (rc) { - log_rdma_send(ERR, "ib_post_send failed rc=%d\n", rc); - smbd_disconnect_rdma_connection(info); -@@ -832,6 +843,7 @@ static int smbd_post_send_iter(struct smbd_connection *info, - struct iov_iter *iter, - int *_remaining_data_length) - { -+ struct smbdirect_socket *sc = &info->socket; - int i, rc; - int header_length; - int data_length; -@@ -843,11 +855,11 @@ static int smbd_post_send_iter(struct smbd_connection *info, - /* Wait for send credits. A SMBD packet needs one credit */ - rc = wait_event_interruptible(info->wait_send_queue, - atomic_read(&info->send_credits) > 0 || -- info->transport_status != SMBD_CONNECTED); -+ sc->status != SMBDIRECT_SOCKET_CONNECTED); - if (rc) - goto err_wait_credit; - -- if (info->transport_status != SMBD_CONNECTED) { -+ if (sc->status != SMBDIRECT_SOCKET_CONNECTED) { - log_outgoing(ERR, "disconnected not sending on wait_credit\n"); - rc = -EAGAIN; - goto err_wait_credit; -@@ -860,9 +872,9 @@ static int smbd_post_send_iter(struct smbd_connection *info, - wait_send_queue: - wait_event(info->wait_post_send, - atomic_read(&info->send_pending) < info->send_credit_target || -- info->transport_status != SMBD_CONNECTED); -+ sc->status != SMBDIRECT_SOCKET_CONNECTED); - -- if (info->transport_status != SMBD_CONNECTED) { -+ if (sc->status != SMBDIRECT_SOCKET_CONNECTED) { - log_outgoing(ERR, "disconnected not sending on wait_send_queue\n"); - rc = -EAGAIN; - goto err_wait_send_queue; -@@ -889,8 +901,8 @@ static int smbd_post_send_iter(struct smbd_connection *info, - .nr_sge = 1, - .max_sge = SMBDIRECT_MAX_SEND_SGE, - .sge = request->sge, -- .device = info->id->device, -- .local_dma_lkey = info->pd->local_dma_lkey, -+ .device = sc->ib.dev, -+ .local_dma_lkey = sc->ib.pd->local_dma_lkey, - .direction = DMA_TO_DEVICE, - }; - -@@ -942,18 +954,18 @@ static int smbd_post_send_iter(struct smbd_connection *info, - if (!data_length) - header_length = offsetof(struct smbd_data_transfer, padding); - -- request->sge[0].addr = ib_dma_map_single(info->id->device, -+ request->sge[0].addr = ib_dma_map_single(sc->ib.dev, - (void *)packet, - header_length, - DMA_TO_DEVICE); -- if (ib_dma_mapping_error(info->id->device, request->sge[0].addr)) { -+ if (ib_dma_mapping_error(sc->ib.dev, request->sge[0].addr)) { - rc = -EIO; - request->sge[0].addr = 0; - goto err_dma; - } - - request->sge[0].length = header_length; -- request->sge[0].lkey = info->pd->local_dma_lkey; -+ request->sge[0].lkey = sc->ib.pd->local_dma_lkey; - - rc = smbd_post_send(info, request); - if (!rc) -@@ -962,7 +974,7 @@ static int smbd_post_send_iter(struct smbd_connection *info, - err_dma: - for (i = 0; i < request->num_sge; i++) - if (request->sge[i].addr) -- ib_dma_unmap_single(info->id->device, -+ ib_dma_unmap_single(sc->ib.dev, - request->sge[i].addr, - request->sge[i].length, - DMA_TO_DEVICE); -@@ -1007,17 +1019,18 @@ static int smbd_post_send_empty(struct smbd_connection *info) - static int smbd_post_recv( - struct smbd_connection *info, struct smbd_response *response) - { -+ struct smbdirect_socket *sc = &info->socket; - struct ib_recv_wr recv_wr; - int rc = -EIO; - - response->sge.addr = ib_dma_map_single( -- info->id->device, response->packet, -+ sc->ib.dev, response->packet, - info->max_receive_size, DMA_FROM_DEVICE); -- if (ib_dma_mapping_error(info->id->device, response->sge.addr)) -+ if (ib_dma_mapping_error(sc->ib.dev, response->sge.addr)) - return rc; - - response->sge.length = info->max_receive_size; -- response->sge.lkey = info->pd->local_dma_lkey; -+ response->sge.lkey = sc->ib.pd->local_dma_lkey; - - response->cqe.done = recv_done; - -@@ -1026,10 +1039,11 @@ static int smbd_post_recv( - recv_wr.sg_list = &response->sge; - recv_wr.num_sge = 1; - -- rc = ib_post_recv(info->id->qp, &recv_wr, NULL); -+ rc = ib_post_recv(sc->ib.qp, &recv_wr, NULL); - if (rc) { -- ib_dma_unmap_single(info->id->device, response->sge.addr, -+ ib_dma_unmap_single(sc->ib.dev, response->sge.addr, - response->sge.length, DMA_FROM_DEVICE); -+ response->sge.length = 0; - smbd_disconnect_rdma_connection(info); - log_rdma_recv(ERR, "ib_post_recv failed rc=%d\n", rc); - } -@@ -1186,10 +1200,16 @@ static struct smbd_response *get_receive_buffer(struct smbd_connection *info) - static void put_receive_buffer( - struct smbd_connection *info, struct smbd_response *response) - { -+ struct smbdirect_socket *sc = &info->socket; - unsigned long flags; - -- ib_dma_unmap_single(info->id->device, response->sge.addr, -- response->sge.length, DMA_FROM_DEVICE); -+ if (likely(response->sge.length != 0)) { -+ ib_dma_unmap_single(sc->ib.dev, -+ response->sge.addr, -+ response->sge.length, -+ DMA_FROM_DEVICE); -+ response->sge.length = 0; -+ } - - spin_lock_irqsave(&info->receive_queue_lock, flags); - list_add_tail(&response->list, &info->receive_queue); -@@ -1227,6 +1247,7 @@ static int allocate_receive_buffers(struct smbd_connection *info, int num_buf) - goto allocate_failed; - - response->info = info; -+ response->sge.length = 0; - list_add_tail(&response->list, &info->receive_queue); - info->count_receive_queue++; - } -@@ -1288,6 +1309,7 @@ static void idle_connection_timer(struct work_struct *work) - void smbd_destroy(struct TCP_Server_Info *server) - { - struct smbd_connection *info = server->smbd_conn; -+ struct smbdirect_socket *sc; - struct smbd_response *response; - unsigned long flags; - -@@ -1295,19 +1317,21 @@ void smbd_destroy(struct TCP_Server_Info *server) - log_rdma_event(INFO, "rdma session already destroyed\n"); - return; - } -+ sc = &info->socket; - - log_rdma_event(INFO, "destroying rdma session\n"); -- if (info->transport_status != SMBD_DISCONNECTED) { -- rdma_disconnect(server->smbd_conn->id); -+ if (sc->status != SMBDIRECT_SOCKET_DISCONNECTED) { -+ rdma_disconnect(sc->rdma.cm_id); - log_rdma_event(INFO, "wait for transport being disconnected\n"); - wait_event_interruptible( - info->disconn_wait, -- info->transport_status == SMBD_DISCONNECTED); -+ sc->status == SMBDIRECT_SOCKET_DISCONNECTED); - } - - log_rdma_event(INFO, "destroying qp\n"); -- ib_drain_qp(info->id->qp); -- rdma_destroy_qp(info->id); -+ ib_drain_qp(sc->ib.qp); -+ rdma_destroy_qp(sc->rdma.cm_id); -+ sc->ib.qp = NULL; - - log_rdma_event(INFO, "cancelling idle timer\n"); - cancel_delayed_work_sync(&info->idle_timer_work); -@@ -1343,7 +1367,7 @@ void smbd_destroy(struct TCP_Server_Info *server) - * are not locked by srv_mutex. It is possible some processes are - * blocked on transport srv_mutex while holding memory registration. - * Release the transport srv_mutex to allow them to hit the failure -- * path when sending data, and then release memory registartions. -+ * path when sending data, and then release memory registrations. - */ - log_rdma_event(INFO, "freeing mr list\n"); - wake_up_interruptible_all(&info->wait_mr); -@@ -1354,10 +1378,10 @@ void smbd_destroy(struct TCP_Server_Info *server) - } - destroy_mr_list(info); - -- ib_free_cq(info->send_cq); -- ib_free_cq(info->recv_cq); -- ib_dealloc_pd(info->pd); -- rdma_destroy_id(info->id); -+ ib_free_cq(sc->ib.send_cq); -+ ib_free_cq(sc->ib.recv_cq); -+ ib_dealloc_pd(sc->ib.pd); -+ rdma_destroy_id(sc->rdma.cm_id); - - /* free mempools */ - mempool_destroy(info->request_mempool); -@@ -1366,7 +1390,7 @@ void smbd_destroy(struct TCP_Server_Info *server) - mempool_destroy(info->response_mempool); - kmem_cache_destroy(info->response_cache); - -- info->transport_status = SMBD_DESTROYED; -+ sc->status = SMBDIRECT_SOCKET_DESTROYED; - - destroy_workqueue(info->workqueue); - log_rdma_event(INFO, "rdma session destroyed\n"); -@@ -1391,7 +1415,7 @@ int smbd_reconnect(struct TCP_Server_Info *server) - * This is possible if transport is disconnected and we haven't received - * notification from RDMA, but upper layer has detected timeout - */ -- if (server->smbd_conn->transport_status == SMBD_CONNECTED) { -+ if (server->smbd_conn->socket.status == SMBDIRECT_SOCKET_CONNECTED) { - log_rdma_event(INFO, "disconnecting transport\n"); - smbd_destroy(server); - } -@@ -1490,6 +1514,7 @@ static struct smbd_connection *_smbd_get_connection( - { - int rc; - struct smbd_connection *info; -+ struct smbdirect_socket *sc; - struct rdma_conn_param conn_param; - struct ib_qp_init_attr qp_attr; - struct sockaddr_in *addr_in = (struct sockaddr_in *) dstaddr; -@@ -1499,29 +1524,30 @@ static struct smbd_connection *_smbd_get_connection( - info = kzalloc(sizeof(struct smbd_connection), GFP_KERNEL); - if (!info) - return NULL; -+ sc = &info->socket; - -- info->transport_status = SMBD_CONNECTING; -+ sc->status = SMBDIRECT_SOCKET_CONNECTING; - rc = smbd_ia_open(info, dstaddr, port); - if (rc) { - log_rdma_event(INFO, "smbd_ia_open rc=%d\n", rc); - goto create_id_failed; - } - -- if (smbd_send_credit_target > info->id->device->attrs.max_cqe || -- smbd_send_credit_target > info->id->device->attrs.max_qp_wr) { -+ if (smbd_send_credit_target > sc->ib.dev->attrs.max_cqe || -+ smbd_send_credit_target > sc->ib.dev->attrs.max_qp_wr) { - log_rdma_event(ERR, "consider lowering send_credit_target = %d. Possible CQE overrun, device reporting max_cqe %d max_qp_wr %d\n", - smbd_send_credit_target, -- info->id->device->attrs.max_cqe, -- info->id->device->attrs.max_qp_wr); -+ sc->ib.dev->attrs.max_cqe, -+ sc->ib.dev->attrs.max_qp_wr); - goto config_failed; - } - -- if (smbd_receive_credit_max > info->id->device->attrs.max_cqe || -- smbd_receive_credit_max > info->id->device->attrs.max_qp_wr) { -+ if (smbd_receive_credit_max > sc->ib.dev->attrs.max_cqe || -+ smbd_receive_credit_max > sc->ib.dev->attrs.max_qp_wr) { - log_rdma_event(ERR, "consider lowering receive_credit_max = %d. Possible CQE overrun, device reporting max_cqe %d max_qp_wr %d\n", - smbd_receive_credit_max, -- info->id->device->attrs.max_cqe, -- info->id->device->attrs.max_qp_wr); -+ sc->ib.dev->attrs.max_cqe, -+ sc->ib.dev->attrs.max_qp_wr); - goto config_failed; - } - -@@ -1532,32 +1558,30 @@ static struct smbd_connection *_smbd_get_connection( - info->max_receive_size = smbd_max_receive_size; - info->keep_alive_interval = smbd_keep_alive_interval; - -- if (info->id->device->attrs.max_send_sge < SMBDIRECT_MAX_SEND_SGE || -- info->id->device->attrs.max_recv_sge < SMBDIRECT_MAX_RECV_SGE) { -+ if (sc->ib.dev->attrs.max_send_sge < SMBDIRECT_MAX_SEND_SGE || -+ sc->ib.dev->attrs.max_recv_sge < SMBDIRECT_MAX_RECV_SGE) { - log_rdma_event(ERR, - "device %.*s max_send_sge/max_recv_sge = %d/%d too small\n", - IB_DEVICE_NAME_MAX, -- info->id->device->name, -- info->id->device->attrs.max_send_sge, -- info->id->device->attrs.max_recv_sge); -+ sc->ib.dev->name, -+ sc->ib.dev->attrs.max_send_sge, -+ sc->ib.dev->attrs.max_recv_sge); - goto config_failed; - } - -- info->send_cq = NULL; -- info->recv_cq = NULL; -- info->send_cq = -- ib_alloc_cq_any(info->id->device, info, -+ sc->ib.send_cq = -+ ib_alloc_cq_any(sc->ib.dev, info, - info->send_credit_target, IB_POLL_SOFTIRQ); -- if (IS_ERR(info->send_cq)) { -- info->send_cq = NULL; -+ if (IS_ERR(sc->ib.send_cq)) { -+ sc->ib.send_cq = NULL; - goto alloc_cq_failed; - } - -- info->recv_cq = -- ib_alloc_cq_any(info->id->device, info, -+ sc->ib.recv_cq = -+ ib_alloc_cq_any(sc->ib.dev, info, - info->receive_credit_max, IB_POLL_SOFTIRQ); -- if (IS_ERR(info->recv_cq)) { -- info->recv_cq = NULL; -+ if (IS_ERR(sc->ib.recv_cq)) { -+ sc->ib.recv_cq = NULL; - goto alloc_cq_failed; - } - -@@ -1571,31 +1595,30 @@ static struct smbd_connection *_smbd_get_connection( - qp_attr.cap.max_inline_data = 0; - qp_attr.sq_sig_type = IB_SIGNAL_REQ_WR; - qp_attr.qp_type = IB_QPT_RC; -- qp_attr.send_cq = info->send_cq; -- qp_attr.recv_cq = info->recv_cq; -+ qp_attr.send_cq = sc->ib.send_cq; -+ qp_attr.recv_cq = sc->ib.recv_cq; - qp_attr.port_num = ~0; - -- rc = rdma_create_qp(info->id, info->pd, &qp_attr); -+ rc = rdma_create_qp(sc->rdma.cm_id, sc->ib.pd, &qp_attr); - if (rc) { - log_rdma_event(ERR, "rdma_create_qp failed %i\n", rc); - goto create_qp_failed; - } -+ sc->ib.qp = sc->rdma.cm_id->qp; - - memset(&conn_param, 0, sizeof(conn_param)); - conn_param.initiator_depth = 0; - - conn_param.responder_resources = -- info->id->device->attrs.max_qp_rd_atom -- < SMBD_CM_RESPONDER_RESOURCES ? -- info->id->device->attrs.max_qp_rd_atom : -- SMBD_CM_RESPONDER_RESOURCES; -+ min(sc->ib.dev->attrs.max_qp_rd_atom, -+ SMBD_CM_RESPONDER_RESOURCES); - info->responder_resources = conn_param.responder_resources; - log_rdma_mr(INFO, "responder_resources=%d\n", - info->responder_resources); - - /* Need to send IRD/ORD in private data for iWARP */ -- info->id->device->ops.get_port_immutable( -- info->id->device, info->id->port_num, &port_immutable); -+ sc->ib.dev->ops.get_port_immutable( -+ sc->ib.dev, sc->rdma.cm_id->port_num, &port_immutable); - if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) { - ird_ord_hdr[0] = info->responder_resources; - ird_ord_hdr[1] = 1; -@@ -1616,16 +1639,18 @@ static struct smbd_connection *_smbd_get_connection( - init_waitqueue_head(&info->conn_wait); - init_waitqueue_head(&info->disconn_wait); - init_waitqueue_head(&info->wait_reassembly_queue); -- rc = rdma_connect(info->id, &conn_param); -+ rc = rdma_connect(sc->rdma.cm_id, &conn_param); - if (rc) { - log_rdma_event(ERR, "rdma_connect() failed with %i\n", rc); - goto rdma_connect_failed; - } - -- wait_event_interruptible( -- info->conn_wait, info->transport_status != SMBD_CONNECTING); -+ wait_event_interruptible_timeout( -+ info->conn_wait, -+ sc->status != SMBDIRECT_SOCKET_CONNECTING, -+ msecs_to_jiffies(RDMA_RESOLVE_TIMEOUT)); - -- if (info->transport_status != SMBD_CONNECTED) { -+ if (sc->status != SMBDIRECT_SOCKET_CONNECTED) { - log_rdma_event(ERR, "rdma_connect failed port=%d\n", port); - goto rdma_connect_failed; - } -@@ -1676,26 +1701,26 @@ static struct smbd_connection *_smbd_get_connection( - negotiation_failed: - cancel_delayed_work_sync(&info->idle_timer_work); - destroy_caches_and_workqueue(info); -- info->transport_status = SMBD_NEGOTIATE_FAILED; -+ sc->status = SMBDIRECT_SOCKET_NEGOTIATE_FAILED; - init_waitqueue_head(&info->conn_wait); -- rdma_disconnect(info->id); -+ rdma_disconnect(sc->rdma.cm_id); - wait_event(info->conn_wait, -- info->transport_status == SMBD_DISCONNECTED); -+ sc->status == SMBDIRECT_SOCKET_DISCONNECTED); - - allocate_cache_failed: - rdma_connect_failed: -- rdma_destroy_qp(info->id); -+ rdma_destroy_qp(sc->rdma.cm_id); - - create_qp_failed: - alloc_cq_failed: -- if (info->send_cq) -- ib_free_cq(info->send_cq); -- if (info->recv_cq) -- ib_free_cq(info->recv_cq); -+ if (sc->ib.send_cq) -+ ib_free_cq(sc->ib.send_cq); -+ if (sc->ib.recv_cq) -+ ib_free_cq(sc->ib.recv_cq); - - config_failed: -- ib_dealloc_pd(info->pd); -- rdma_destroy_id(info->id); -+ ib_dealloc_pd(sc->ib.pd); -+ rdma_destroy_id(sc->rdma.cm_id); - - create_id_failed: - kfree(info); -@@ -1735,6 +1760,7 @@ struct smbd_connection *smbd_get_connection( - static int smbd_recv_buf(struct smbd_connection *info, char *buf, - unsigned int size) - { -+ struct smbdirect_socket *sc = &info->socket; - struct smbd_response *response; - struct smbd_data_transfer *data_transfer; - int to_copy, to_read, data_read, offset; -@@ -1849,12 +1875,12 @@ static int smbd_recv_buf(struct smbd_connection *info, char *buf, - rc = wait_event_interruptible( - info->wait_reassembly_queue, - info->reassembly_data_length >= size || -- info->transport_status != SMBD_CONNECTED); -+ sc->status != SMBDIRECT_SOCKET_CONNECTED); - /* Don't return any data if interrupted */ - if (rc) - return rc; - -- if (info->transport_status != SMBD_CONNECTED) { -+ if (sc->status != SMBDIRECT_SOCKET_CONNECTED) { - log_read(ERR, "disconnected\n"); - return -ECONNABORTED; - } -@@ -1872,6 +1898,7 @@ static int smbd_recv_page(struct smbd_connection *info, - struct page *page, unsigned int page_offset, - unsigned int to_read) - { -+ struct smbdirect_socket *sc = &info->socket; - int ret; - char *to_address; - void *page_address; -@@ -1880,7 +1907,7 @@ static int smbd_recv_page(struct smbd_connection *info, - ret = wait_event_interruptible( - info->wait_reassembly_queue, - info->reassembly_data_length >= to_read || -- info->transport_status != SMBD_CONNECTED); -+ sc->status != SMBDIRECT_SOCKET_CONNECTED); - if (ret) - return ret; - -@@ -1955,12 +1982,13 @@ int smbd_send(struct TCP_Server_Info *server, - int num_rqst, struct smb_rqst *rqst_array) - { - struct smbd_connection *info = server->smbd_conn; -+ struct smbdirect_socket *sc = &info->socket; - struct smb_rqst *rqst; - struct iov_iter iter; - unsigned int remaining_data_length, klen; - int rc, i, rqst_idx; - -- if (info->transport_status != SMBD_CONNECTED) -+ if (sc->status != SMBDIRECT_SOCKET_CONNECTED) - return -EAGAIN; - - /* -@@ -2054,6 +2082,7 @@ static void smbd_mr_recovery_work(struct work_struct *work) - { - struct smbd_connection *info = - container_of(work, struct smbd_connection, mr_recovery_work); -+ struct smbdirect_socket *sc = &info->socket; - struct smbd_mr *smbdirect_mr; - int rc; - -@@ -2071,7 +2100,7 @@ static void smbd_mr_recovery_work(struct work_struct *work) - } - - smbdirect_mr->mr = ib_alloc_mr( -- info->pd, info->mr_type, -+ sc->ib.pd, info->mr_type, - info->max_frmr_depth); - if (IS_ERR(smbdirect_mr->mr)) { - log_rdma_mr(ERR, "ib_alloc_mr failed mr_type=%x max_frmr_depth=%x\n", -@@ -2100,12 +2129,13 @@ static void smbd_mr_recovery_work(struct work_struct *work) - - static void destroy_mr_list(struct smbd_connection *info) - { -+ struct smbdirect_socket *sc = &info->socket; - struct smbd_mr *mr, *tmp; - - cancel_work_sync(&info->mr_recovery_work); - list_for_each_entry_safe(mr, tmp, &info->mr_list, list) { - if (mr->state == MR_INVALIDATED) -- ib_dma_unmap_sg(info->id->device, mr->sgt.sgl, -+ ib_dma_unmap_sg(sc->ib.dev, mr->sgt.sgl, - mr->sgt.nents, mr->dir); - ib_dereg_mr(mr->mr); - kfree(mr->sgt.sgl); -@@ -2122,6 +2152,7 @@ static void destroy_mr_list(struct smbd_connection *info) - */ - static int allocate_mr_list(struct smbd_connection *info) - { -+ struct smbdirect_socket *sc = &info->socket; - int i; - struct smbd_mr *smbdirect_mr, *tmp; - -@@ -2137,7 +2168,7 @@ static int allocate_mr_list(struct smbd_connection *info) - smbdirect_mr = kzalloc(sizeof(*smbdirect_mr), GFP_KERNEL); - if (!smbdirect_mr) - goto cleanup_entries; -- smbdirect_mr->mr = ib_alloc_mr(info->pd, info->mr_type, -+ smbdirect_mr->mr = ib_alloc_mr(sc->ib.pd, info->mr_type, - info->max_frmr_depth); - if (IS_ERR(smbdirect_mr->mr)) { - log_rdma_mr(ERR, "ib_alloc_mr failed mr_type=%x max_frmr_depth=%x\n", -@@ -2182,20 +2213,20 @@ static int allocate_mr_list(struct smbd_connection *info) - */ - static struct smbd_mr *get_mr(struct smbd_connection *info) - { -+ struct smbdirect_socket *sc = &info->socket; - struct smbd_mr *ret; - int rc; - again: - rc = wait_event_interruptible(info->wait_mr, - atomic_read(&info->mr_ready_count) || -- info->transport_status != SMBD_CONNECTED); -+ sc->status != SMBDIRECT_SOCKET_CONNECTED); - if (rc) { - log_rdma_mr(ERR, "wait_event_interruptible rc=%x\n", rc); - return NULL; - } - -- if (info->transport_status != SMBD_CONNECTED) { -- log_rdma_mr(ERR, "info->transport_status=%x\n", -- info->transport_status); -+ if (sc->status != SMBDIRECT_SOCKET_CONNECTED) { -+ log_rdma_mr(ERR, "sc->status=%x\n", sc->status); - return NULL; - } - -@@ -2248,6 +2279,7 @@ struct smbd_mr *smbd_register_mr(struct smbd_connection *info, - struct iov_iter *iter, - bool writing, bool need_invalidate) - { -+ struct smbdirect_socket *sc = &info->socket; - struct smbd_mr *smbdirect_mr; - int rc, num_pages; - enum dma_data_direction dir; -@@ -2277,7 +2309,7 @@ struct smbd_mr *smbd_register_mr(struct smbd_connection *info, - num_pages, iov_iter_count(iter), info->max_frmr_depth); - smbd_iter_to_mr(info, iter, &smbdirect_mr->sgt, info->max_frmr_depth); - -- rc = ib_dma_map_sg(info->id->device, smbdirect_mr->sgt.sgl, -+ rc = ib_dma_map_sg(sc->ib.dev, smbdirect_mr->sgt.sgl, - smbdirect_mr->sgt.nents, dir); - if (!rc) { - log_rdma_mr(ERR, "ib_dma_map_sg num_pages=%x dir=%x rc=%x\n", -@@ -2313,7 +2345,7 @@ struct smbd_mr *smbd_register_mr(struct smbd_connection *info, - * on IB_WR_REG_MR. Hardware enforces a barrier and order of execution - * on the next ib_post_send when we actaully send I/O to remote peer - */ -- rc = ib_post_send(info->id->qp, ®_wr->wr, NULL); -+ rc = ib_post_send(sc->ib.qp, ®_wr->wr, NULL); - if (!rc) - return smbdirect_mr; - -@@ -2322,7 +2354,7 @@ struct smbd_mr *smbd_register_mr(struct smbd_connection *info, - - /* If all failed, attempt to recover this MR by setting it MR_ERROR*/ - map_mr_error: -- ib_dma_unmap_sg(info->id->device, smbdirect_mr->sgt.sgl, -+ ib_dma_unmap_sg(sc->ib.dev, smbdirect_mr->sgt.sgl, - smbdirect_mr->sgt.nents, smbdirect_mr->dir); - - dma_map_error: -@@ -2360,6 +2392,7 @@ int smbd_deregister_mr(struct smbd_mr *smbdirect_mr) - { - struct ib_send_wr *wr; - struct smbd_connection *info = smbdirect_mr->conn; -+ struct smbdirect_socket *sc = &info->socket; - int rc = 0; - - if (smbdirect_mr->need_invalidate) { -@@ -2373,7 +2406,7 @@ int smbd_deregister_mr(struct smbd_mr *smbdirect_mr) - wr->send_flags = IB_SEND_SIGNALED; - - init_completion(&smbdirect_mr->invalidate_done); -- rc = ib_post_send(info->id->qp, wr, NULL); -+ rc = ib_post_send(sc->ib.qp, wr, NULL); - if (rc) { - log_rdma_mr(ERR, "ib_post_send failed rc=%x\n", rc); - smbd_disconnect_rdma_connection(info); -@@ -2390,7 +2423,7 @@ int smbd_deregister_mr(struct smbd_mr *smbdirect_mr) - - if (smbdirect_mr->state == MR_INVALIDATED) { - ib_dma_unmap_sg( -- info->id->device, smbdirect_mr->sgt.sgl, -+ sc->ib.dev, smbdirect_mr->sgt.sgl, - smbdirect_mr->sgt.nents, - smbdirect_mr->dir); - smbdirect_mr->state = MR_READY; -diff --git a/fs/smb/client/smbdirect.h b/fs/smb/client/smbdirect.h -index 83f239f376f06d..c881e58c639de3 100644 ---- a/fs/smb/client/smbdirect.h -+++ b/fs/smb/client/smbdirect.h -@@ -15,6 +15,8 @@ - #include - #include - -+#include "../common/smbdirect/smbdirect_socket.h" -+ - extern int rdma_readwrite_threshold; - extern int smbd_max_frmr_depth; - extern int smbd_keep_alive_interval; -@@ -50,14 +52,8 @@ enum smbd_connection_status { - * 5. mempools for allocating packets - */ - struct smbd_connection { -- enum smbd_connection_status transport_status; -- -- /* RDMA related */ -- struct rdma_cm_id *id; -- struct ib_qp_init_attr qp_attr; -- struct ib_pd *pd; -- struct ib_cq *send_cq, *recv_cq; -- struct ib_device_attr dev_attr; -+ struct smbdirect_socket socket; -+ - int ri_rc; - struct completion ri_done; - wait_queue_head_t conn_wait; -@@ -111,7 +107,7 @@ struct smbd_connection { - /* Used by transport to wait until all MRs are returned */ - wait_queue_head_t wait_for_mr_cleanup; - -- /* Activity accoutning */ -+ /* Activity accounting */ - atomic_t send_pending; - wait_queue_head_t wait_send_pending; - wait_queue_head_t wait_post_send; -diff --git a/fs/smb/common/smbdirect/smbdirect_socket.h b/fs/smb/common/smbdirect/smbdirect_socket.h -new file mode 100644 -index 00000000000000..69a55561f91ae9 ---- /dev/null -+++ b/fs/smb/common/smbdirect/smbdirect_socket.h -@@ -0,0 +1,41 @@ -+/* SPDX-License-Identifier: GPL-2.0-or-later */ -+/* -+ * Copyright (c) 2025 Stefan Metzmacher -+ */ -+ -+#ifndef __FS_SMB_COMMON_SMBDIRECT_SMBDIRECT_SOCKET_H__ -+#define __FS_SMB_COMMON_SMBDIRECT_SMBDIRECT_SOCKET_H__ -+ -+enum smbdirect_socket_status { -+ SMBDIRECT_SOCKET_CREATED, -+ SMBDIRECT_SOCKET_CONNECTING, -+ SMBDIRECT_SOCKET_CONNECTED, -+ SMBDIRECT_SOCKET_NEGOTIATE_FAILED, -+ SMBDIRECT_SOCKET_DISCONNECTING, -+ SMBDIRECT_SOCKET_DISCONNECTED, -+ SMBDIRECT_SOCKET_DESTROYED -+}; -+ -+struct smbdirect_socket { -+ enum smbdirect_socket_status status; -+ -+ /* RDMA related */ -+ struct { -+ struct rdma_cm_id *cm_id; -+ } rdma; -+ -+ /* IB verbs related */ -+ struct { -+ struct ib_pd *pd; -+ struct ib_cq *send_cq; -+ struct ib_cq *recv_cq; -+ -+ /* -+ * shortcuts for rdma.cm_id->{qp,device}; -+ */ -+ struct ib_qp *qp; -+ struct ib_device *dev; -+ } ib; -+}; -+ -+#endif /* __FS_SMB_COMMON_SMBDIRECT_SMBDIRECT_SOCKET_H__ */ -diff --git a/fs/smb/server/connection.h b/fs/smb/server/connection.h -index 47e6a8694c0fc1..c769fe3859b37e 100644 ---- a/fs/smb/server/connection.h -+++ b/fs/smb/server/connection.h -@@ -45,6 +45,7 @@ struct ksmbd_conn { - struct mutex srv_mutex; - int status; - unsigned int cli_cap; -+ __be32 inet_addr; - char *request_buf; - struct ksmbd_transport *transport; - struct nls_table *local_nls; -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index e25c2ca56461ac..d3dd3b9b4005c6 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -1610,11 +1610,24 @@ static int krb5_authenticate(struct ksmbd_work *work, - - rsp->SecurityBufferLength = cpu_to_le16(out_len); - -- if ((conn->sign || server_conf.enforced_signing) || -+ /* -+ * If session state is SMB2_SESSION_VALID, We can assume -+ * that it is reauthentication. And the user/password -+ * has been verified, so return it here. -+ */ -+ if (sess->state == SMB2_SESSION_VALID) { -+ if (conn->binding) -+ goto binding_session; -+ return 0; -+ } -+ -+ if ((rsp->SessionFlags != SMB2_SESSION_FLAG_IS_GUEST_LE && -+ (conn->sign || server_conf.enforced_signing)) || - (req->SecurityMode & SMB2_NEGOTIATE_SIGNING_REQUIRED)) - sess->sign = true; - -- if (smb3_encryption_negotiated(conn)) { -+ if (smb3_encryption_negotiated(conn) && -+ !(req->Flags & SMB2_SESSION_REQ_FLAG_BINDING)) { - retval = conn->ops->generate_encryptionkey(conn, sess); - if (retval) { - ksmbd_debug(SMB, -@@ -1627,6 +1640,7 @@ static int krb5_authenticate(struct ksmbd_work *work, - sess->sign = false; - } - -+binding_session: - if (conn->dialect >= SMB30_PROT_ID) { - chann = lookup_chann_list(sess, conn); - if (!chann) { -@@ -1817,8 +1831,6 @@ int smb2_sess_setup(struct ksmbd_work *work) - ksmbd_conn_set_good(conn); - sess->state = SMB2_SESSION_VALID; - } -- kfree(sess->Preauth_HashValue); -- sess->Preauth_HashValue = NULL; - } else if (conn->preferred_auth_mech == KSMBD_AUTH_NTLMSSP) { - if (negblob->MessageType == NtLmNegotiate) { - rc = ntlm_negotiate(work, negblob, negblob_len, rsp); -@@ -1845,8 +1857,6 @@ int smb2_sess_setup(struct ksmbd_work *work) - kfree(preauth_sess); - } - } -- kfree(sess->Preauth_HashValue); -- sess->Preauth_HashValue = NULL; - } else { - pr_info_ratelimited("Unknown NTLMSSP message type : 0x%x\n", - le32_to_cpu(negblob->MessageType)); -diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c -index 23537e1b346858..2839c704110cd1 100644 ---- a/fs/smb/server/smb_common.c -+++ b/fs/smb/server/smb_common.c -@@ -515,7 +515,7 @@ int ksmbd_extract_shortname(struct ksmbd_conn *conn, const char *longname, - - p = strrchr(longname, '.'); - if (p == longname) { /*name starts with a dot*/ -- strscpy(extension, "___", strlen("___")); -+ strscpy(extension, "___", sizeof(extension)); - } else { - if (p) { - p++; -diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c -index eaef459776151b..6c3a57bff14703 100644 ---- a/fs/smb/server/transport_rdma.c -+++ b/fs/smb/server/transport_rdma.c -@@ -128,9 +128,6 @@ struct smb_direct_transport { - spinlock_t recvmsg_queue_lock; - struct list_head recvmsg_queue; - -- spinlock_t empty_recvmsg_queue_lock; -- struct list_head empty_recvmsg_queue; -- - int send_credit_target; - atomic_t send_credits; - spinlock_t lock_new_recv_credits; -@@ -267,40 +264,19 @@ smb_direct_recvmsg *get_free_recvmsg(struct smb_direct_transport *t) - static void put_recvmsg(struct smb_direct_transport *t, - struct smb_direct_recvmsg *recvmsg) - { -- ib_dma_unmap_single(t->cm_id->device, recvmsg->sge.addr, -- recvmsg->sge.length, DMA_FROM_DEVICE); -+ if (likely(recvmsg->sge.length != 0)) { -+ ib_dma_unmap_single(t->cm_id->device, -+ recvmsg->sge.addr, -+ recvmsg->sge.length, -+ DMA_FROM_DEVICE); -+ recvmsg->sge.length = 0; -+ } - - spin_lock(&t->recvmsg_queue_lock); - list_add(&recvmsg->list, &t->recvmsg_queue); - spin_unlock(&t->recvmsg_queue_lock); - } - --static struct --smb_direct_recvmsg *get_empty_recvmsg(struct smb_direct_transport *t) --{ -- struct smb_direct_recvmsg *recvmsg = NULL; -- -- spin_lock(&t->empty_recvmsg_queue_lock); -- if (!list_empty(&t->empty_recvmsg_queue)) { -- recvmsg = list_first_entry(&t->empty_recvmsg_queue, -- struct smb_direct_recvmsg, list); -- list_del(&recvmsg->list); -- } -- spin_unlock(&t->empty_recvmsg_queue_lock); -- return recvmsg; --} -- --static void put_empty_recvmsg(struct smb_direct_transport *t, -- struct smb_direct_recvmsg *recvmsg) --{ -- ib_dma_unmap_single(t->cm_id->device, recvmsg->sge.addr, -- recvmsg->sge.length, DMA_FROM_DEVICE); -- -- spin_lock(&t->empty_recvmsg_queue_lock); -- list_add_tail(&recvmsg->list, &t->empty_recvmsg_queue); -- spin_unlock(&t->empty_recvmsg_queue_lock); --} -- - static void enqueue_reassembly(struct smb_direct_transport *t, - struct smb_direct_recvmsg *recvmsg, - int data_length) -@@ -385,9 +361,6 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id) - spin_lock_init(&t->recvmsg_queue_lock); - INIT_LIST_HEAD(&t->recvmsg_queue); - -- spin_lock_init(&t->empty_recvmsg_queue_lock); -- INIT_LIST_HEAD(&t->empty_recvmsg_queue); -- - init_waitqueue_head(&t->wait_send_pending); - atomic_set(&t->send_pending, 0); - -@@ -547,13 +520,13 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) - t = recvmsg->transport; - - if (wc->status != IB_WC_SUCCESS || wc->opcode != IB_WC_RECV) { -+ put_recvmsg(t, recvmsg); - if (wc->status != IB_WC_WR_FLUSH_ERR) { - pr_err("Recv error. status='%s (%d)' opcode=%d\n", - ib_wc_status_msg(wc->status), wc->status, - wc->opcode); - smb_direct_disconnect_rdma_connection(t); - } -- put_empty_recvmsg(t, recvmsg); - return; - } - -@@ -567,7 +540,8 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) - switch (recvmsg->type) { - case SMB_DIRECT_MSG_NEGOTIATE_REQ: - if (wc->byte_len < sizeof(struct smb_direct_negotiate_req)) { -- put_empty_recvmsg(t, recvmsg); -+ put_recvmsg(t, recvmsg); -+ smb_direct_disconnect_rdma_connection(t); - return; - } - t->negotiation_requested = true; -@@ -575,7 +549,7 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) - t->status = SMB_DIRECT_CS_CONNECTED; - enqueue_reassembly(t, recvmsg, 0); - wake_up_interruptible(&t->wait_status); -- break; -+ return; - case SMB_DIRECT_MSG_DATA_TRANSFER: { - struct smb_direct_data_transfer *data_transfer = - (struct smb_direct_data_transfer *)recvmsg->packet; -@@ -584,7 +558,8 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) - - if (wc->byte_len < - offsetof(struct smb_direct_data_transfer, padding)) { -- put_empty_recvmsg(t, recvmsg); -+ put_recvmsg(t, recvmsg); -+ smb_direct_disconnect_rdma_connection(t); - return; - } - -@@ -592,7 +567,8 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) - if (data_length) { - if (wc->byte_len < sizeof(struct smb_direct_data_transfer) + - (u64)data_length) { -- put_empty_recvmsg(t, recvmsg); -+ put_recvmsg(t, recvmsg); -+ smb_direct_disconnect_rdma_connection(t); - return; - } - -@@ -604,16 +580,11 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) - else - t->full_packet_received = true; - -- enqueue_reassembly(t, recvmsg, (int)data_length); -- wake_up_interruptible(&t->wait_reassembly_queue); -- - spin_lock(&t->receive_credit_lock); - receive_credits = --(t->recv_credits); - avail_recvmsg_count = t->count_avail_recvmsg; - spin_unlock(&t->receive_credit_lock); - } else { -- put_empty_recvmsg(t, recvmsg); -- - spin_lock(&t->receive_credit_lock); - receive_credits = --(t->recv_credits); - avail_recvmsg_count = ++(t->count_avail_recvmsg); -@@ -635,11 +606,23 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) - if (is_receive_credit_post_required(receive_credits, avail_recvmsg_count)) - mod_delayed_work(smb_direct_wq, - &t->post_recv_credits_work, 0); -- break; -+ -+ if (data_length) { -+ enqueue_reassembly(t, recvmsg, (int)data_length); -+ wake_up_interruptible(&t->wait_reassembly_queue); -+ } else -+ put_recvmsg(t, recvmsg); -+ -+ return; - } -- default: -- break; - } -+ -+ /* -+ * This is an internal error! -+ */ -+ WARN_ON_ONCE(recvmsg->type != SMB_DIRECT_MSG_DATA_TRANSFER); -+ put_recvmsg(t, recvmsg); -+ smb_direct_disconnect_rdma_connection(t); - } - - static int smb_direct_post_recv(struct smb_direct_transport *t, -@@ -669,6 +652,7 @@ static int smb_direct_post_recv(struct smb_direct_transport *t, - ib_dma_unmap_single(t->cm_id->device, - recvmsg->sge.addr, recvmsg->sge.length, - DMA_FROM_DEVICE); -+ recvmsg->sge.length = 0; - smb_direct_disconnect_rdma_connection(t); - return ret; - } -@@ -810,7 +794,6 @@ static void smb_direct_post_recv_credits(struct work_struct *work) - struct smb_direct_recvmsg *recvmsg; - int receive_credits, credits = 0; - int ret; -- int use_free = 1; - - spin_lock(&t->receive_credit_lock); - receive_credits = t->recv_credits; -@@ -818,18 +801,9 @@ static void smb_direct_post_recv_credits(struct work_struct *work) - - if (receive_credits < t->recv_credit_target) { - while (true) { -- if (use_free) -- recvmsg = get_free_recvmsg(t); -- else -- recvmsg = get_empty_recvmsg(t); -- if (!recvmsg) { -- if (use_free) { -- use_free = 0; -- continue; -- } else { -- break; -- } -- } -+ recvmsg = get_free_recvmsg(t); -+ if (!recvmsg) -+ break; - - recvmsg->type = SMB_DIRECT_MSG_DATA_TRANSFER; - recvmsg->first_segment = false; -@@ -1805,8 +1779,6 @@ static void smb_direct_destroy_pools(struct smb_direct_transport *t) - - while ((recvmsg = get_free_recvmsg(t))) - mempool_free(recvmsg, t->recvmsg_mempool); -- while ((recvmsg = get_empty_recvmsg(t))) -- mempool_free(recvmsg, t->recvmsg_mempool); - - mempool_destroy(t->recvmsg_mempool); - t->recvmsg_mempool = NULL; -@@ -1862,6 +1834,7 @@ static int smb_direct_create_pools(struct smb_direct_transport *t) - if (!recvmsg) - goto err; - recvmsg->transport = t; -+ recvmsg->sge.length = 0; - list_add(&recvmsg->list, &t->recvmsg_queue); - } - t->count_avail_recvmsg = t->recv_credit_max; -diff --git a/fs/smb/server/transport_tcp.c b/fs/smb/server/transport_tcp.c -index 64941a49438f37..e86bc4a460687a 100644 ---- a/fs/smb/server/transport_tcp.c -+++ b/fs/smb/server/transport_tcp.c -@@ -87,6 +87,7 @@ static struct tcp_transport *alloc_transport(struct socket *client_sk) - return NULL; - } - -+ conn->inet_addr = inet_sk(client_sk->sk)->inet_daddr; - conn->transport = KSMBD_TRANS(t); - KSMBD_TRANS(t)->conn = conn; - KSMBD_TRANS(t)->ops = &ksmbd_tcp_transport_ops; -@@ -230,6 +231,8 @@ static int ksmbd_kthread_fn(void *p) - { - struct socket *client_sk = NULL; - struct interface *iface = (struct interface *)p; -+ struct inet_sock *csk_inet; -+ struct ksmbd_conn *conn; - int ret; - - while (!kthread_should_stop()) { -@@ -248,6 +251,20 @@ static int ksmbd_kthread_fn(void *p) - continue; - } - -+ /* -+ * Limits repeated connections from clients with the same IP. -+ */ -+ csk_inet = inet_sk(client_sk->sk); -+ down_read(&conn_list_lock); -+ list_for_each_entry(conn, &conn_list, conns_list) -+ if (csk_inet->inet_daddr == conn->inet_addr) { -+ ret = -EAGAIN; -+ break; -+ } -+ up_read(&conn_list_lock); -+ if (ret == -EAGAIN) -+ continue; -+ - if (server_conf.max_connections && - atomic_inc_return(&active_num_conn) >= server_conf.max_connections) { - pr_info_ratelimited("Limit the maximum number of connections(%u)\n", -diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c -index de813700f3d4f6..067b346921b63f 100644 ---- a/fs/smb/server/vfs.c -+++ b/fs/smb/server/vfs.c -@@ -563,7 +563,8 @@ int ksmbd_vfs_getattr(const struct path *path, struct kstat *stat) - { - int err; - -- err = vfs_getattr(path, stat, STATX_BTIME, AT_STATX_SYNC_AS_STAT); -+ err = vfs_getattr(path, stat, STATX_BASIC_STATS | STATX_BTIME, -+ AT_STATX_SYNC_AS_STAT); - if (err) - pr_err("getattr failed, err %d\n", err); - return err; -diff --git a/include/linux/audit.h b/include/linux/audit.h -index 51b1b7054a233a..335e1ba5a23271 100644 ---- a/include/linux/audit.h -+++ b/include/linux/audit.h -@@ -416,7 +416,7 @@ extern int __audit_log_bprm_fcaps(struct linux_binprm *bprm, - extern void __audit_log_capset(const struct cred *new, const struct cred *old); - extern void __audit_mmap_fd(int fd, int flags); - extern void __audit_openat2_how(struct open_how *how); --extern void __audit_log_kern_module(char *name); -+extern void __audit_log_kern_module(const char *name); - extern void __audit_fanotify(u32 response, struct fanotify_response_info_audit_rule *friar); - extern void __audit_tk_injoffset(struct timespec64 offset); - extern void __audit_ntp_log(const struct audit_ntp_data *ad); -@@ -518,7 +518,7 @@ static inline void audit_openat2_how(struct open_how *how) - __audit_openat2_how(how); - } - --static inline void audit_log_kern_module(char *name) -+static inline void audit_log_kern_module(const char *name) - { - if (!audit_dummy_context()) - __audit_log_kern_module(name); -@@ -676,9 +676,8 @@ static inline void audit_mmap_fd(int fd, int flags) - static inline void audit_openat2_how(struct open_how *how) - { } - --static inline void audit_log_kern_module(char *name) --{ --} -+static inline void audit_log_kern_module(const char *name) -+{ } - - static inline void audit_fanotify(u32 response, struct fanotify_response_info_audit_rule *friar) - { } -diff --git a/include/linux/fs_context.h b/include/linux/fs_context.h -index c13e99cbbf8162..c9eae711700133 100644 ---- a/include/linux/fs_context.h -+++ b/include/linux/fs_context.h -@@ -196,7 +196,7 @@ void logfc(struct fc_log *log, const char *prefix, char level, const char *fmt, - */ - #define infof(fc, fmt, ...) __logfc(fc, 'i', fmt, ## __VA_ARGS__) - #define info_plog(p, fmt, ...) __plog(p, 'i', fmt, ## __VA_ARGS__) --#define infofc(p, fmt, ...) __plog((&(fc)->log), 'i', fmt, ## __VA_ARGS__) -+#define infofc(fc, fmt, ...) __plog((&(fc)->log), 'i', fmt, ## __VA_ARGS__) - - /** - * warnf - Store supplementary warning message -diff --git a/include/linux/moduleparam.h b/include/linux/moduleparam.h -index 962cd41a2cb5af..061e19c94a6bc6 100644 ---- a/include/linux/moduleparam.h -+++ b/include/linux/moduleparam.h -@@ -282,10 +282,9 @@ struct kparam_array - #define __moduleparam_const const - #endif - --/* This is the fundamental function for registering boot/module -- parameters. */ -+/* This is the fundamental function for registering boot/module parameters. */ - #define __module_param_call(prefix, name, ops, arg, perm, level, flags) \ -- /* Default value instead of permissions? */ \ -+ static_assert(sizeof(""prefix) - 1 <= MAX_PARAM_PREFIX_LEN); \ - static const char __param_str_##name[] = prefix #name; \ - static struct kernel_param __moduleparam_const __param_##name \ - __used __section("__param") \ -diff --git a/include/linux/pps_kernel.h b/include/linux/pps_kernel.h -index c7abce28ed2995..aab0aebb529e02 100644 ---- a/include/linux/pps_kernel.h -+++ b/include/linux/pps_kernel.h -@@ -52,6 +52,7 @@ struct pps_device { - int current_mode; /* PPS mode at event time */ - - unsigned int last_ev; /* last PPS event id */ -+ unsigned int last_fetched_ev; /* last fetched PPS event id */ - wait_queue_head_t queue; /* PPS event queue */ - - unsigned int id; /* PPS source unique ID */ -diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h -index 1aca3f332d9c06..85672adc734921 100644 ---- a/include/linux/proc_fs.h -+++ b/include/linux/proc_fs.h -@@ -27,6 +27,7 @@ enum { - - PROC_ENTRY_proc_read_iter = 1U << 1, - PROC_ENTRY_proc_compat_ioctl = 1U << 2, -+ PROC_ENTRY_proc_lseek = 1U << 3, - }; - - struct proc_ops { -diff --git a/include/linux/psi_types.h b/include/linux/psi_types.h -index f1fd3a8044e0ec..dd10c22299ab82 100644 ---- a/include/linux/psi_types.h -+++ b/include/linux/psi_types.h -@@ -84,11 +84,9 @@ enum psi_aggregators { - struct psi_group_cpu { - /* 1st cacheline updated by the scheduler */ - -- /* Aggregator needs to know of concurrent changes */ -- seqcount_t seq ____cacheline_aligned_in_smp; -- - /* States of the tasks belonging to this group */ -- unsigned int tasks[NR_PSI_TASK_COUNTS]; -+ unsigned int tasks[NR_PSI_TASK_COUNTS] -+ ____cacheline_aligned_in_smp; - - /* Aggregate pressure state derived from the tasks */ - u32 state_mask; -diff --git a/include/linux/sched.h b/include/linux/sched.h -index 393c300347dee4..cb38eee732fd02 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -753,10 +753,8 @@ struct task_struct { - #endif - unsigned int __state; - --#ifdef CONFIG_PREEMPT_RT - /* saved state for "spinlock sleepers" */ - unsigned int saved_state; --#endif - - /* - * This begins the randomizable portion of task_struct. Only -diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h -index f7d392d849be56..7b7222b4f6111d 100644 ---- a/include/linux/skbuff.h -+++ b/include/linux/skbuff.h -@@ -2877,6 +2877,29 @@ static inline void skb_reset_transport_header(struct sk_buff *skb) - skb->transport_header = skb->data - skb->head; - } - -+/** -+ * skb_reset_transport_header_careful - conditionally reset transport header -+ * @skb: buffer to alter -+ * -+ * Hardened version of skb_reset_transport_header(). -+ * -+ * Returns: true if the operation was a success. -+ */ -+static inline bool __must_check -+skb_reset_transport_header_careful(struct sk_buff *skb) -+{ -+ long offset = skb->data - skb->head; -+ -+ if (unlikely(offset != (typeof(skb->transport_header))offset)) -+ return false; -+ -+ if (unlikely(offset == (typeof(skb->transport_header))~0U)) -+ return false; -+ -+ skb->transport_header = offset; -+ return true; -+} -+ - static inline void skb_set_transport_header(struct sk_buff *skb, - const int offset) - { -diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h -index 0b9f1e598e3a6b..4bc6bb01a0eb8b 100644 ---- a/include/linux/usb/usbnet.h -+++ b/include/linux/usb/usbnet.h -@@ -76,6 +76,7 @@ struct usbnet { - # define EVENT_LINK_CHANGE 11 - # define EVENT_SET_RX_MODE 12 - # define EVENT_NO_IP_ALIGN 13 -+# define EVENT_LINK_CARRIER_ON 14 - /* This one is special, as it indicates that the device is going away - * there are cyclic dependencies between tasklet, timer and bh - * that must be broken -diff --git a/include/linux/wait_bit.h b/include/linux/wait_bit.h -index 7725b7579b7819..2209c227e85920 100644 ---- a/include/linux/wait_bit.h -+++ b/include/linux/wait_bit.h -@@ -335,4 +335,64 @@ static inline void clear_and_wake_up_bit(int bit, void *word) - wake_up_bit(word, bit); - } - -+/** -+ * test_and_clear_wake_up_bit - clear a bit if it was set: wake up anyone waiting on that bit -+ * @bit: the bit of the word being waited on -+ * @word: the address of memory containing that bit -+ * -+ * If the bit is set and can be atomically cleared, any tasks waiting in -+ * wait_on_bit() or similar will be woken. This call has the same -+ * complete ordering semantics as test_and_clear_bit(). Any changes to -+ * memory made before this call are guaranteed to be visible after the -+ * corresponding wait_on_bit() completes. -+ * -+ * Returns %true if the bit was successfully set and the wake up was sent. -+ */ -+static inline bool test_and_clear_wake_up_bit(int bit, unsigned long *word) -+{ -+ if (!test_and_clear_bit(bit, word)) -+ return false; -+ /* no extra barrier required */ -+ wake_up_bit(word, bit); -+ return true; -+} -+ -+/** -+ * atomic_dec_and_wake_up - decrement an atomic_t and if zero, wake up waiters -+ * @var: the variable to dec and test -+ * -+ * Decrements the atomic variable and if it reaches zero, send a wake_up to any -+ * processes waiting on the variable. -+ * -+ * This function has the same complete ordering semantics as atomic_dec_and_test. -+ * -+ * Returns %true is the variable reaches zero and the wake up was sent. -+ */ -+ -+static inline bool atomic_dec_and_wake_up(atomic_t *var) -+{ -+ if (!atomic_dec_and_test(var)) -+ return false; -+ /* No extra barrier required */ -+ wake_up_var(var); -+ return true; -+} -+ -+/** -+ * store_release_wake_up - update a variable and send a wake_up -+ * @var: the address of the variable to be updated and woken -+ * @val: the value to store in the variable. -+ * -+ * Store the given value in the variable send a wake up to any tasks -+ * waiting on the variable. All necessary barriers are included to ensure -+ * the task calling wait_var_event() sees the new value and all values -+ * written to memory before this call. -+ */ -+#define store_release_wake_up(var, val) \ -+do { \ -+ smp_store_release(var, val); \ -+ smp_mb(); \ -+ wake_up_var(var); \ -+} while (0) -+ - #endif /* _LINUX_WAIT_BIT_H */ -diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h -index e4a97b2d099841..4c084a03d6bb75 100644 ---- a/include/net/bluetooth/hci.h -+++ b/include/net/bluetooth/hci.h -@@ -2577,6 +2577,7 @@ struct hci_ev_le_conn_complete { - #define LE_EXT_ADV_DIRECT_IND 0x0004 - #define LE_EXT_ADV_SCAN_RSP 0x0008 - #define LE_EXT_ADV_LEGACY_PDU 0x0010 -+#define LE_EXT_ADV_DATA_STATUS_MASK 0x0060 - #define LE_EXT_ADV_EVT_TYPE_MASK 0x007f - - #define ADDR_LE_DEV_PUBLIC 0x00 -diff --git a/include/net/dst.h b/include/net/dst.h -index 16b7b99b5f309c..60fb5d2faf43e4 100644 ---- a/include/net/dst.h -+++ b/include/net/dst.h -@@ -464,7 +464,7 @@ INDIRECT_CALLABLE_DECLARE(int ip_output(struct net *, struct sock *, - /* Output packet to network from transport. */ - static inline int dst_output(struct net *net, struct sock *sk, struct sk_buff *skb) - { -- return INDIRECT_CALL_INET(skb_dst(skb)->output, -+ return INDIRECT_CALL_INET(READ_ONCE(skb_dst(skb)->output), - ip6_output, ip_output, - net, sk, skb); - } -@@ -474,7 +474,7 @@ INDIRECT_CALLABLE_DECLARE(int ip_local_deliver(struct sk_buff *)); - /* Input packet from network to transport. */ - static inline int dst_input(struct sk_buff *skb) - { -- return INDIRECT_CALL_INET(skb_dst(skb)->input, -+ return INDIRECT_CALL_INET(READ_ONCE(skb_dst(skb)->input), - ip6_input, ip_local_deliver, skb); - } - -diff --git a/include/net/lwtunnel.h b/include/net/lwtunnel.h -index 53bd2d02a4f0db..09791f5d9b6ec8 100644 ---- a/include/net/lwtunnel.h -+++ b/include/net/lwtunnel.h -@@ -138,12 +138,12 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, - static inline void lwtunnel_set_redirect(struct dst_entry *dst) - { - if (lwtunnel_output_redirect(dst->lwtstate)) { -- dst->lwtstate->orig_output = dst->output; -- dst->output = lwtunnel_output; -+ dst->lwtstate->orig_output = READ_ONCE(dst->output); -+ WRITE_ONCE(dst->output, lwtunnel_output); - } - if (lwtunnel_input_redirect(dst->lwtstate)) { -- dst->lwtstate->orig_input = dst->input; -- dst->input = lwtunnel_input; -+ dst->lwtstate->orig_input = READ_ONCE(dst->input); -+ WRITE_ONCE(dst->input, lwtunnel_input); - } - } - #else -diff --git a/include/net/tc_act/tc_ctinfo.h b/include/net/tc_act/tc_ctinfo.h -index f071c1d70a25e1..a04bcac7adf4b6 100644 ---- a/include/net/tc_act/tc_ctinfo.h -+++ b/include/net/tc_act/tc_ctinfo.h -@@ -18,9 +18,9 @@ struct tcf_ctinfo_params { - struct tcf_ctinfo { - struct tc_action common; - struct tcf_ctinfo_params __rcu *params; -- u64 stats_dscp_set; -- u64 stats_dscp_error; -- u64 stats_cpmark_set; -+ atomic64_t stats_dscp_set; -+ atomic64_t stats_dscp_error; -+ atomic64_t stats_cpmark_set; - }; - - enum { -diff --git a/include/net/udp.h b/include/net/udp.h -index 488a6d2babccf2..89eeb187667b01 100644 ---- a/include/net/udp.h -+++ b/include/net/udp.h -@@ -466,6 +466,16 @@ static inline struct sk_buff *udp_rcv_segment(struct sock *sk, - { - netdev_features_t features = NETIF_F_SG; - struct sk_buff *segs; -+ int drop_count; -+ -+ /* -+ * Segmentation in UDP receive path is only for UDP GRO, drop udp -+ * fragmentation offload (UFO) packets. -+ */ -+ if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP) { -+ drop_count = 1; -+ goto drop; -+ } - - /* Avoid csum recalculation by skb_segment unless userspace explicitly - * asks for the final checksum values -@@ -489,16 +499,18 @@ static inline struct sk_buff *udp_rcv_segment(struct sock *sk, - */ - segs = __skb_gso_segment(skb, features, false); - if (IS_ERR_OR_NULL(segs)) { -- int segs_nr = skb_shinfo(skb)->gso_segs; -- -- atomic_add(segs_nr, &sk->sk_drops); -- SNMP_ADD_STATS(__UDPX_MIB(sk, ipv4), UDP_MIB_INERRORS, segs_nr); -- kfree_skb(skb); -- return NULL; -+ drop_count = skb_shinfo(skb)->gso_segs; -+ goto drop; - } - - consume_skb(skb); - return segs; -+ -+drop: -+ atomic_add(drop_count, &sk->sk_drops); -+ SNMP_ADD_STATS(__UDPX_MIB(sk, ipv4), UDP_MIB_INERRORS, drop_count); -+ kfree_skb(skb); -+ return NULL; - } - - static inline void udp_post_segment_fix_csum(struct sk_buff *skb) -diff --git a/kernel/audit.h b/kernel/audit.h -index a60d2840559e2b..5156ecd3545733 100644 ---- a/kernel/audit.h -+++ b/kernel/audit.h -@@ -199,7 +199,7 @@ struct audit_context { - int argc; - } execve; - struct { -- char *name; -+ const char *name; - } module; - struct { - struct audit_ntp_data ntp_data; -diff --git a/kernel/auditsc.c b/kernel/auditsc.c -index 6f0d6fb6523fa7..d48830c7e4beb7 100644 ---- a/kernel/auditsc.c -+++ b/kernel/auditsc.c -@@ -2870,7 +2870,7 @@ void __audit_openat2_how(struct open_how *how) - context->type = AUDIT_OPENAT2; - } - --void __audit_log_kern_module(char *name) -+void __audit_log_kern_module(const char *name) - { - struct audit_context *context = audit_context(); - -diff --git a/kernel/bpf/preload/Kconfig b/kernel/bpf/preload/Kconfig -index c9d45c9d6918d1..f9b11d01c3b50d 100644 ---- a/kernel/bpf/preload/Kconfig -+++ b/kernel/bpf/preload/Kconfig -@@ -10,7 +10,6 @@ menuconfig BPF_PRELOAD - # The dependency on !COMPILE_TEST prevents it from being enabled - # in allmodconfig or allyesconfig configurations - depends on !COMPILE_TEST -- select USERMODE_DRIVER - help - This builds kernel module with several embedded BPF programs that are - pinned into BPF FS mount point as human readable files that are -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 3a33d9c1b1b2b4..b73f5c44113d64 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -6499,11 +6499,21 @@ static void perf_mmap_close(struct vm_area_struct *vma) - ring_buffer_put(rb); /* could be last */ - } - -+static int perf_mmap_may_split(struct vm_area_struct *vma, unsigned long addr) -+{ -+ /* -+ * Forbid splitting perf mappings to prevent refcount leaks due to -+ * the resulting non-matching offsets and sizes. See open()/close(). -+ */ -+ return -EINVAL; -+} -+ - static const struct vm_operations_struct perf_mmap_vmops = { - .open = perf_mmap_open, - .close = perf_mmap_close, /* non mergeable */ - .fault = perf_mmap_fault, - .page_mkwrite = perf_mmap_fault, -+ .may_split = perf_mmap_may_split, - }; - - static int perf_mmap(struct file *file, struct vm_area_struct *vma) -@@ -6595,9 +6605,7 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) - goto unlock; - } - -- atomic_set(&rb->aux_mmap_count, 1); - user_extra = nr_pages; -- - goto accounting; - } - -@@ -6699,8 +6707,10 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) - } else { - ret = rb_alloc_aux(rb, event, vma->vm_pgoff, nr_pages, - event->attr.aux_watermark, flags); -- if (!ret) -+ if (!ret) { -+ atomic_set(&rb->aux_mmap_count, 1); - rb->aux_mmap_locked = extra; -+ } - } - - unlock: -@@ -6710,6 +6720,7 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) - - atomic_inc(&event->mmap_count); - } else if (rb) { -+ /* AUX allocation failed */ - atomic_dec(&rb->mmap_count); - } - aux_unlock: -@@ -6717,6 +6728,9 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) - mutex_unlock(aux_mutex); - mutex_unlock(&event->mmap_mutex); - -+ if (ret) -+ return ret; -+ - /* - * Since pinned accounting is per vm we cannot allow fork() to copy our - * vma. -diff --git a/kernel/freezer.c b/kernel/freezer.c -index 4fad0e6fca6447..d8db479af478e7 100644 ---- a/kernel/freezer.c -+++ b/kernel/freezer.c -@@ -71,7 +71,11 @@ bool __refrigerator(bool check_kthr_stop) - for (;;) { - bool freeze; - -+ raw_spin_lock_irq(¤t->pi_lock); - set_current_state(TASK_FROZEN); -+ /* unstale saved_state so that __thaw_task() will wake us up */ -+ current->saved_state = TASK_RUNNING; -+ raw_spin_unlock_irq(¤t->pi_lock); - - spin_lock_irq(&freezer_lock); - freeze = freezing(current) && !(check_kthr_stop && kthread_should_stop()); -@@ -129,6 +133,7 @@ static int __set_task_frozen(struct task_struct *p, void *arg) - WARN_ON_ONCE(debug_locks && p->lockdep_depth); - #endif - -+ p->saved_state = p->__state; - WRITE_ONCE(p->__state, TASK_FROZEN); - return TASK_FROZEN; - } -@@ -170,46 +175,30 @@ bool freeze_task(struct task_struct *p) - } - - /* -- * The special task states (TASK_STOPPED, TASK_TRACED) keep their canonical -- * state in p->jobctl. If either of them got a wakeup that was missed because -- * TASK_FROZEN, then their canonical state reflects that and the below will -- * refuse to restore the special state and instead issue the wakeup. -+ * Restore the saved_state before the task entered freezer. For typical task -+ * in the __refrigerator(), saved_state == TASK_RUNNING so nothing happens -+ * here. For tasks which were TASK_NORMAL | TASK_FREEZABLE, their initial state -+ * is restored unless they got an expected wakeup (see ttwu_state_match()). -+ * Returns 1 if the task state was restored. - */ --static int __set_task_special(struct task_struct *p, void *arg) -+static int __restore_freezer_state(struct task_struct *p, void *arg) - { -- unsigned int state = 0; -+ unsigned int state = p->saved_state; - -- if (p->jobctl & JOBCTL_TRACED) -- state = TASK_TRACED; -- -- else if (p->jobctl & JOBCTL_STOPPED) -- state = TASK_STOPPED; -- -- if (state) -+ if (state != TASK_RUNNING) { - WRITE_ONCE(p->__state, state); -+ p->saved_state = TASK_RUNNING; -+ return 1; -+ } - -- return state; -+ return 0; - } - - void __thaw_task(struct task_struct *p) - { -- unsigned long flags, flags2; -- -- spin_lock_irqsave(&freezer_lock, flags); -- if (WARN_ON_ONCE(freezing(p))) -- goto unlock; -- -- if (lock_task_sighand(p, &flags2)) { -- /* TASK_FROZEN -> TASK_{STOPPED,TRACED} */ -- bool ret = task_call_func(p, __set_task_special, NULL); -- unlock_task_sighand(p, &flags2); -- if (ret) -- goto unlock; -- } -- -- wake_up_state(p, TASK_FROZEN); --unlock: -- spin_unlock_irqrestore(&freezer_lock, flags); -+ guard(spinlock_irqsave)(&freezer_lock); -+ if (frozen(p) && !task_call_func(p, __restore_freezer_state, NULL)) -+ wake_up_state(p, TASK_FROZEN); - } - - /** -diff --git a/kernel/kcsan/kcsan_test.c b/kernel/kcsan/kcsan_test.c -index 0ddbdab5903dff..9d8c95defdd673 100644 ---- a/kernel/kcsan/kcsan_test.c -+++ b/kernel/kcsan/kcsan_test.c -@@ -530,7 +530,7 @@ static void test_barrier_nothreads(struct kunit *test) - struct kcsan_scoped_access *reorder_access = NULL; - #endif - arch_spinlock_t arch_spinlock = __ARCH_SPIN_LOCK_UNLOCKED; -- atomic_t dummy; -+ atomic_t dummy = ATOMIC_INIT(0); - - KCSAN_TEST_REQUIRES(test, reorder_access != NULL); - KCSAN_TEST_REQUIRES(test, IS_ENABLED(CONFIG_SMP)); -diff --git a/kernel/module/main.c b/kernel/module/main.c -index b00e31721a73e3..9711ad14825b24 100644 ---- a/kernel/module/main.c -+++ b/kernel/module/main.c -@@ -2876,7 +2876,7 @@ static int load_module(struct load_info *info, const char __user *uargs, - - module_allocated = true; - -- audit_log_kern_module(mod->name); -+ audit_log_kern_module(info->name); - - /* Reserve our place in the list. */ - err = add_unformed_module(mod); -@@ -3034,8 +3034,10 @@ static int load_module(struct load_info *info, const char __user *uargs, - * failures once the proper module was allocated and - * before that. - */ -- if (!module_allocated) -+ if (!module_allocated) { -+ audit_log_kern_module(info->name ? info->name : "?"); - mod_stat_bump_becoming(info, flags); -+ } - free_copy(info, flags); - return err; - } -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 760a6c3781cbfc..1b5e4389f788a3 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -2238,31 +2238,26 @@ int __task_state_match(struct task_struct *p, unsigned int state) - if (READ_ONCE(p->__state) & state) - return 1; - --#ifdef CONFIG_PREEMPT_RT - if (READ_ONCE(p->saved_state) & state) - return -1; --#endif -+ - return 0; - } - - static __always_inline - int task_state_match(struct task_struct *p, unsigned int state) - { --#ifdef CONFIG_PREEMPT_RT - int match; - - /* - * Serialize against current_save_and_set_rtlock_wait_state() and -- * current_restore_rtlock_saved_state(). -+ * current_restore_rtlock_saved_state(), and __refrigerator(). - */ - raw_spin_lock_irq(&p->pi_lock); - match = __task_state_match(p, state); - raw_spin_unlock_irq(&p->pi_lock); - - return match; --#else -- return __task_state_match(p, state); --#endif - } - - /* -@@ -4039,13 +4034,17 @@ static void ttwu_queue(struct task_struct *p, int cpu, int wake_flags) - * The caller holds p::pi_lock if p != current or has preemption - * disabled when p == current. - * -- * The rules of PREEMPT_RT saved_state: -+ * The rules of saved_state: - * - * The related locking code always holds p::pi_lock when updating - * p::saved_state, which means the code is fully serialized in both cases. - * -- * The lock wait and lock wakeups happen via TASK_RTLOCK_WAIT. No other -- * bits set. This allows to distinguish all wakeup scenarios. -+ * For PREEMPT_RT, the lock wait and lock wakeups happen via TASK_RTLOCK_WAIT. -+ * No other bits set. This allows to distinguish all wakeup scenarios. -+ * -+ * For FREEZER, the wakeup happens via TASK_FROZEN. No other bits set. This -+ * allows us to prevent early wakeup of tasks before they can be run on -+ * asymmetric ISA architectures (eg ARMv9). - */ - static __always_inline - bool ttwu_state_match(struct task_struct *p, unsigned int state, int *success) -@@ -4059,13 +4058,13 @@ bool ttwu_state_match(struct task_struct *p, unsigned int state, int *success) - - *success = !!(match = __task_state_match(p, state)); - --#ifdef CONFIG_PREEMPT_RT - /* - * Saved state preserves the task state across blocking on -- * an RT lock. If the state matches, set p::saved_state to -- * TASK_RUNNING, but do not wake the task because it waits -- * for a lock wakeup. Also indicate success because from -- * the regular waker's point of view this has succeeded. -+ * an RT lock or TASK_FREEZABLE tasks. If the state matches, -+ * set p::saved_state to TASK_RUNNING, but do not wake the task -+ * because it waits for a lock wakeup or __thaw_task(). Also -+ * indicate success because from the regular waker's point of -+ * view this has succeeded. - * - * After acquiring the lock the task will restore p::__state - * from p::saved_state which ensures that the regular -@@ -4075,7 +4074,7 @@ bool ttwu_state_match(struct task_struct *p, unsigned int state, int *success) - */ - if (match < 0) - p->saved_state = TASK_RUNNING; --#endif -+ - return match > 0; - } - -diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c -index f97e1473389ff1..08a9a9f909d518 100644 ---- a/kernel/sched/psi.c -+++ b/kernel/sched/psi.c -@@ -172,17 +172,35 @@ struct psi_group psi_system = { - .pcpu = &system_group_pcpu, - }; - -+static DEFINE_PER_CPU(seqcount_t, psi_seq) = SEQCNT_ZERO(psi_seq); -+ -+static inline void psi_write_begin(int cpu) -+{ -+ write_seqcount_begin(per_cpu_ptr(&psi_seq, cpu)); -+} -+ -+static inline void psi_write_end(int cpu) -+{ -+ write_seqcount_end(per_cpu_ptr(&psi_seq, cpu)); -+} -+ -+static inline u32 psi_read_begin(int cpu) -+{ -+ return read_seqcount_begin(per_cpu_ptr(&psi_seq, cpu)); -+} -+ -+static inline bool psi_read_retry(int cpu, u32 seq) -+{ -+ return read_seqcount_retry(per_cpu_ptr(&psi_seq, cpu), seq); -+} -+ - static void psi_avgs_work(struct work_struct *work); - - static void poll_timer_fn(struct timer_list *t); - - static void group_init(struct psi_group *group) - { -- int cpu; -- - group->enabled = true; -- for_each_possible_cpu(cpu) -- seqcount_init(&per_cpu_ptr(group->pcpu, cpu)->seq); - group->avg_last_update = sched_clock(); - group->avg_next_update = group->avg_last_update + psi_period; - mutex_init(&group->avgs_lock); -@@ -258,14 +276,14 @@ static void get_recent_times(struct psi_group *group, int cpu, - - /* Snapshot a coherent view of the CPU state */ - do { -- seq = read_seqcount_begin(&groupc->seq); -+ seq = psi_read_begin(cpu); - now = cpu_clock(cpu); - memcpy(times, groupc->times, sizeof(groupc->times)); - state_mask = groupc->state_mask; - state_start = groupc->state_start; - if (cpu == current_cpu) - memcpy(tasks, groupc->tasks, sizeof(groupc->tasks)); -- } while (read_seqcount_retry(&groupc->seq, seq)); -+ } while (psi_read_retry(cpu, seq)); - - /* Calculate state time deltas against the previous snapshot */ - for (s = 0; s < NR_PSI_STATES; s++) { -@@ -775,31 +793,21 @@ static void record_times(struct psi_group_cpu *groupc, u64 now) - groupc->times[PSI_NONIDLE] += delta; - } - -+#define for_each_group(iter, group) \ -+ for (typeof(group) iter = group; iter; iter = iter->parent) -+ - static void psi_group_change(struct psi_group *group, int cpu, - unsigned int clear, unsigned int set, -- bool wake_clock) -+ u64 now, bool wake_clock) - { - struct psi_group_cpu *groupc; - unsigned int t, m; - enum psi_states s; - u32 state_mask; -- u64 now; - - lockdep_assert_rq_held(cpu_rq(cpu)); - groupc = per_cpu_ptr(group->pcpu, cpu); - -- /* -- * First we update the task counts according to the state -- * change requested through the @clear and @set bits. -- * -- * Then if the cgroup PSI stats accounting enabled, we -- * assess the aggregate resource states this CPU's tasks -- * have been in since the last change, and account any -- * SOME and FULL time these may have resulted in. -- */ -- write_seqcount_begin(&groupc->seq); -- now = cpu_clock(cpu); -- - /* - * Start with TSK_ONCPU, which doesn't have a corresponding - * task count - it's just a boolean flag directly encoded in -@@ -851,7 +859,6 @@ static void psi_group_change(struct psi_group *group, int cpu, - - groupc->state_mask = state_mask; - -- write_seqcount_end(&groupc->seq); - return; - } - -@@ -875,8 +882,6 @@ static void psi_group_change(struct psi_group *group, int cpu, - - groupc->state_mask = state_mask; - -- write_seqcount_end(&groupc->seq); -- - if (state_mask & group->rtpoll_states) - psi_schedule_rtpoll_work(group, 1, false); - -@@ -911,24 +916,29 @@ static void psi_flags_change(struct task_struct *task, int clear, int set) - void psi_task_change(struct task_struct *task, int clear, int set) - { - int cpu = task_cpu(task); -- struct psi_group *group; -+ u64 now; - - if (!task->pid) - return; - - psi_flags_change(task, clear, set); - -- group = task_psi_group(task); -- do { -- psi_group_change(group, cpu, clear, set, true); -- } while ((group = group->parent)); -+ psi_write_begin(cpu); -+ now = cpu_clock(cpu); -+ for_each_group(group, task_psi_group(task)) -+ psi_group_change(group, cpu, clear, set, now, true); -+ psi_write_end(cpu); - } - - void psi_task_switch(struct task_struct *prev, struct task_struct *next, - bool sleep) - { -- struct psi_group *group, *common = NULL; -+ struct psi_group *common = NULL; - int cpu = task_cpu(prev); -+ u64 now; -+ -+ psi_write_begin(cpu); -+ now = cpu_clock(cpu); - - if (next->pid) { - psi_flags_change(next, 0, TSK_ONCPU); -@@ -937,16 +947,15 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, - * ancestors with @prev, those will already have @prev's - * TSK_ONCPU bit set, and we can stop the iteration there. - */ -- group = task_psi_group(next); -- do { -- if (per_cpu_ptr(group->pcpu, cpu)->state_mask & -- PSI_ONCPU) { -+ for_each_group(group, task_psi_group(next)) { -+ struct psi_group_cpu *groupc = per_cpu_ptr(group->pcpu, cpu); -+ -+ if (groupc->state_mask & PSI_ONCPU) { - common = group; - break; - } -- -- psi_group_change(group, cpu, 0, TSK_ONCPU, true); -- } while ((group = group->parent)); -+ psi_group_change(group, cpu, 0, TSK_ONCPU, now, true); -+ } - } - - if (prev->pid) { -@@ -979,12 +988,11 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, - - psi_flags_change(prev, clear, set); - -- group = task_psi_group(prev); -- do { -+ for_each_group(group, task_psi_group(prev)) { - if (group == common) - break; -- psi_group_change(group, cpu, clear, set, wake_clock); -- } while ((group = group->parent)); -+ psi_group_change(group, cpu, clear, set, now, wake_clock); -+ } - - /* - * TSK_ONCPU is handled up to the common ancestor. If there are -@@ -994,27 +1002,27 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, - */ - if ((prev->psi_flags ^ next->psi_flags) & ~TSK_ONCPU) { - clear &= ~TSK_ONCPU; -- for (; group; group = group->parent) -- psi_group_change(group, cpu, clear, set, wake_clock); -+ for_each_group(group, common) -+ psi_group_change(group, cpu, clear, set, now, wake_clock); - } - } -+ psi_write_end(cpu); - } - - #ifdef CONFIG_IRQ_TIME_ACCOUNTING - void psi_account_irqtime(struct rq *rq, struct task_struct *curr, struct task_struct *prev) - { - int cpu = task_cpu(curr); -- struct psi_group *group; - struct psi_group_cpu *groupc; - s64 delta; - u64 irq; -+ u64 now; - - if (!curr->pid) - return; - - lockdep_assert_rq_held(rq); -- group = task_psi_group(curr); -- if (prev && task_psi_group(prev) == group) -+ if (prev && task_psi_group(prev) == task_psi_group(curr)) - return; - - irq = irq_time_read(cpu); -@@ -1023,25 +1031,22 @@ void psi_account_irqtime(struct rq *rq, struct task_struct *curr, struct task_st - return; - rq->psi_irq_time = irq; - -- do { -- u64 now; -+ psi_write_begin(cpu); -+ now = cpu_clock(cpu); - -+ for_each_group(group, task_psi_group(curr)) { - if (!group->enabled) - continue; - - groupc = per_cpu_ptr(group->pcpu, cpu); - -- write_seqcount_begin(&groupc->seq); -- now = cpu_clock(cpu); -- - record_times(groupc, now); - groupc->times[PSI_IRQ_FULL] += delta; - -- write_seqcount_end(&groupc->seq); -- - if (group->rtpoll_states & (1 << PSI_IRQ_FULL)) - psi_schedule_rtpoll_work(group, 1, false); -- } while ((group = group->parent)); -+ } -+ psi_write_end(cpu); - } - #endif - -@@ -1229,12 +1234,14 @@ void psi_cgroup_restart(struct psi_group *group) - return; - - for_each_possible_cpu(cpu) { -- struct rq *rq = cpu_rq(cpu); -- struct rq_flags rf; -+ u64 now; - -- rq_lock_irq(rq, &rf); -- psi_group_change(group, cpu, 0, 0, true); -- rq_unlock_irq(rq, &rf); -+ guard(rq_lock_irq)(cpu_rq(cpu)); -+ -+ psi_write_begin(cpu); -+ now = cpu_clock(cpu); -+ psi_group_change(group, cpu, 0, 0, now, true); -+ psi_write_end(cpu); - } - } - #endif /* CONFIG_CGROUPS */ -diff --git a/kernel/trace/preemptirq_delay_test.c b/kernel/trace/preemptirq_delay_test.c -index cb0871fbdb07f0..8af92dbe98f07b 100644 ---- a/kernel/trace/preemptirq_delay_test.c -+++ b/kernel/trace/preemptirq_delay_test.c -@@ -119,12 +119,15 @@ static int preemptirq_delay_run(void *data) - { - int i; - int s = MIN(burst_size, NR_TEST_FUNCS); -- struct cpumask cpu_mask; -+ cpumask_var_t cpu_mask; -+ -+ if (!alloc_cpumask_var(&cpu_mask, GFP_KERNEL)) -+ return -ENOMEM; - - if (cpu_affinity > -1) { -- cpumask_clear(&cpu_mask); -- cpumask_set_cpu(cpu_affinity, &cpu_mask); -- if (set_cpus_allowed_ptr(current, &cpu_mask)) -+ cpumask_clear(cpu_mask); -+ cpumask_set_cpu(cpu_affinity, cpu_mask); -+ if (set_cpus_allowed_ptr(current, cpu_mask)) - pr_err("cpu_affinity:%d, failed\n", cpu_affinity); - } - -@@ -141,6 +144,8 @@ static int preemptirq_delay_run(void *data) - - __set_current_state(TASK_RUNNING); - -+ free_cpumask_var(cpu_mask); -+ - return 0; - } - -diff --git a/kernel/ucount.c b/kernel/ucount.c -index 3456018730b6c8..a7fd89693bd2a1 100644 ---- a/kernel/ucount.c -+++ b/kernel/ucount.c -@@ -213,7 +213,7 @@ void put_ucounts(struct ucounts *ucounts) - } - } - --static inline bool atomic_long_inc_below(atomic_long_t *v, int u) -+static inline bool atomic_long_inc_below(atomic_long_t *v, long u) - { - long c, old; - c = atomic_long_read(v); -diff --git a/mm/hmm.c b/mm/hmm.c -index 277ddcab4947d9..a36e1b4046dbd6 100644 ---- a/mm/hmm.c -+++ b/mm/hmm.c -@@ -173,6 +173,7 @@ static inline unsigned long hmm_pfn_flags_order(unsigned long order) - return order << HMM_PFN_ORDER_SHIFT; - } - -+#ifdef CONFIG_TRANSPARENT_HUGEPAGE - static inline unsigned long pmd_to_hmm_pfn_flags(struct hmm_range *range, - pmd_t pmd) - { -@@ -183,7 +184,6 @@ static inline unsigned long pmd_to_hmm_pfn_flags(struct hmm_range *range, - hmm_pfn_flags_order(PMD_SHIFT - PAGE_SHIFT); - } - --#ifdef CONFIG_TRANSPARENT_HUGEPAGE - static int hmm_vma_handle_pmd(struct mm_walk *walk, unsigned long addr, - unsigned long end, unsigned long hmm_pfns[], - pmd_t pmd) -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index 8516ba62c54559..3b22ce3aa95bb5 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -6216,6 +6216,11 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, void *data, - - static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type) - { -+ u16 pdu_type = evt_type & ~LE_EXT_ADV_DATA_STATUS_MASK; -+ -+ if (!pdu_type) -+ return LE_ADV_NONCONN_IND; -+ - if (evt_type & LE_EXT_ADV_LEGACY_PDU) { - switch (evt_type) { - case LE_LEGACY_ADV_IND: -@@ -6247,8 +6252,7 @@ static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type) - if (evt_type & LE_EXT_ADV_SCAN_IND) - return LE_ADV_SCAN_IND; - -- if (evt_type == LE_EXT_ADV_NON_CONN_IND || -- evt_type & LE_EXT_ADV_DIRECT_IND) -+ if (evt_type & LE_EXT_ADV_DIRECT_IND) - return LE_ADV_NONCONN_IND; - - invalid: -diff --git a/net/caif/cfctrl.c b/net/caif/cfctrl.c -index 8480684f276251..10eeace2278b72 100644 ---- a/net/caif/cfctrl.c -+++ b/net/caif/cfctrl.c -@@ -351,17 +351,154 @@ int cfctrl_cancel_req(struct cflayer *layr, struct cflayer *adap_layer) - return found; - } - -+static int cfctrl_link_setup(struct cfctrl *cfctrl, struct cfpkt *pkt, u8 cmdrsp) -+{ -+ u8 len; -+ u8 linkid = 0; -+ enum cfctrl_srv serv; -+ enum cfctrl_srv servtype; -+ u8 endpoint; -+ u8 physlinkid; -+ u8 prio; -+ u8 tmp; -+ u8 *cp; -+ int i; -+ struct cfctrl_link_param linkparam; -+ struct cfctrl_request_info rsp, *req; -+ -+ memset(&linkparam, 0, sizeof(linkparam)); -+ -+ tmp = cfpkt_extr_head_u8(pkt); -+ -+ serv = tmp & CFCTRL_SRV_MASK; -+ linkparam.linktype = serv; -+ -+ servtype = tmp >> 4; -+ linkparam.chtype = servtype; -+ -+ tmp = cfpkt_extr_head_u8(pkt); -+ physlinkid = tmp & 0x07; -+ prio = tmp >> 3; -+ -+ linkparam.priority = prio; -+ linkparam.phyid = physlinkid; -+ endpoint = cfpkt_extr_head_u8(pkt); -+ linkparam.endpoint = endpoint & 0x03; -+ -+ switch (serv) { -+ case CFCTRL_SRV_VEI: -+ case CFCTRL_SRV_DBG: -+ if (CFCTRL_ERR_BIT & cmdrsp) -+ break; -+ /* Link ID */ -+ linkid = cfpkt_extr_head_u8(pkt); -+ break; -+ case CFCTRL_SRV_VIDEO: -+ tmp = cfpkt_extr_head_u8(pkt); -+ linkparam.u.video.connid = tmp; -+ if (CFCTRL_ERR_BIT & cmdrsp) -+ break; -+ /* Link ID */ -+ linkid = cfpkt_extr_head_u8(pkt); -+ break; -+ -+ case CFCTRL_SRV_DATAGRAM: -+ linkparam.u.datagram.connid = cfpkt_extr_head_u32(pkt); -+ if (CFCTRL_ERR_BIT & cmdrsp) -+ break; -+ /* Link ID */ -+ linkid = cfpkt_extr_head_u8(pkt); -+ break; -+ case CFCTRL_SRV_RFM: -+ /* Construct a frame, convert -+ * DatagramConnectionID -+ * to network format long and copy it out... -+ */ -+ linkparam.u.rfm.connid = cfpkt_extr_head_u32(pkt); -+ cp = (u8 *) linkparam.u.rfm.volume; -+ for (tmp = cfpkt_extr_head_u8(pkt); -+ cfpkt_more(pkt) && tmp != '\0'; -+ tmp = cfpkt_extr_head_u8(pkt)) -+ *cp++ = tmp; -+ *cp = '\0'; -+ -+ if (CFCTRL_ERR_BIT & cmdrsp) -+ break; -+ /* Link ID */ -+ linkid = cfpkt_extr_head_u8(pkt); -+ -+ break; -+ case CFCTRL_SRV_UTIL: -+ /* Construct a frame, convert -+ * DatagramConnectionID -+ * to network format long and copy it out... -+ */ -+ /* Fifosize KB */ -+ linkparam.u.utility.fifosize_kb = cfpkt_extr_head_u16(pkt); -+ /* Fifosize bufs */ -+ linkparam.u.utility.fifosize_bufs = cfpkt_extr_head_u16(pkt); -+ /* name */ -+ cp = (u8 *) linkparam.u.utility.name; -+ caif_assert(sizeof(linkparam.u.utility.name) -+ >= UTILITY_NAME_LENGTH); -+ for (i = 0; i < UTILITY_NAME_LENGTH && cfpkt_more(pkt); i++) { -+ tmp = cfpkt_extr_head_u8(pkt); -+ *cp++ = tmp; -+ } -+ /* Length */ -+ len = cfpkt_extr_head_u8(pkt); -+ linkparam.u.utility.paramlen = len; -+ /* Param Data */ -+ cp = linkparam.u.utility.params; -+ while (cfpkt_more(pkt) && len--) { -+ tmp = cfpkt_extr_head_u8(pkt); -+ *cp++ = tmp; -+ } -+ if (CFCTRL_ERR_BIT & cmdrsp) -+ break; -+ /* Link ID */ -+ linkid = cfpkt_extr_head_u8(pkt); -+ /* Length */ -+ len = cfpkt_extr_head_u8(pkt); -+ /* Param Data */ -+ cfpkt_extr_head(pkt, NULL, len); -+ break; -+ default: -+ pr_warn("Request setup, invalid type (%d)\n", serv); -+ return -1; -+ } -+ -+ rsp.cmd = CFCTRL_CMD_LINK_SETUP; -+ rsp.param = linkparam; -+ spin_lock_bh(&cfctrl->info_list_lock); -+ req = cfctrl_remove_req(cfctrl, &rsp); -+ -+ if (CFCTRL_ERR_BIT == (CFCTRL_ERR_BIT & cmdrsp) || -+ cfpkt_erroneous(pkt)) { -+ pr_err("Invalid O/E bit or parse error " -+ "on CAIF control channel\n"); -+ cfctrl->res.reject_rsp(cfctrl->serv.layer.up, 0, -+ req ? req->client_layer : NULL); -+ } else { -+ cfctrl->res.linksetup_rsp(cfctrl->serv.layer.up, linkid, -+ serv, physlinkid, -+ req ? req->client_layer : NULL); -+ } -+ -+ kfree(req); -+ -+ spin_unlock_bh(&cfctrl->info_list_lock); -+ -+ return 0; -+} -+ - static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt) - { - u8 cmdrsp; - u8 cmd; -- int ret = -1; -- u8 len; -- u8 param[255]; -+ int ret = 0; - u8 linkid = 0; - struct cfctrl *cfctrl = container_obj(layer); -- struct cfctrl_request_info rsp, *req; -- - - cmdrsp = cfpkt_extr_head_u8(pkt); - cmd = cmdrsp & CFCTRL_CMD_MASK; -@@ -374,150 +511,7 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt) - - switch (cmd) { - case CFCTRL_CMD_LINK_SETUP: -- { -- enum cfctrl_srv serv; -- enum cfctrl_srv servtype; -- u8 endpoint; -- u8 physlinkid; -- u8 prio; -- u8 tmp; -- u8 *cp; -- int i; -- struct cfctrl_link_param linkparam; -- memset(&linkparam, 0, sizeof(linkparam)); -- -- tmp = cfpkt_extr_head_u8(pkt); -- -- serv = tmp & CFCTRL_SRV_MASK; -- linkparam.linktype = serv; -- -- servtype = tmp >> 4; -- linkparam.chtype = servtype; -- -- tmp = cfpkt_extr_head_u8(pkt); -- physlinkid = tmp & 0x07; -- prio = tmp >> 3; -- -- linkparam.priority = prio; -- linkparam.phyid = physlinkid; -- endpoint = cfpkt_extr_head_u8(pkt); -- linkparam.endpoint = endpoint & 0x03; -- -- switch (serv) { -- case CFCTRL_SRV_VEI: -- case CFCTRL_SRV_DBG: -- if (CFCTRL_ERR_BIT & cmdrsp) -- break; -- /* Link ID */ -- linkid = cfpkt_extr_head_u8(pkt); -- break; -- case CFCTRL_SRV_VIDEO: -- tmp = cfpkt_extr_head_u8(pkt); -- linkparam.u.video.connid = tmp; -- if (CFCTRL_ERR_BIT & cmdrsp) -- break; -- /* Link ID */ -- linkid = cfpkt_extr_head_u8(pkt); -- break; -- -- case CFCTRL_SRV_DATAGRAM: -- linkparam.u.datagram.connid = -- cfpkt_extr_head_u32(pkt); -- if (CFCTRL_ERR_BIT & cmdrsp) -- break; -- /* Link ID */ -- linkid = cfpkt_extr_head_u8(pkt); -- break; -- case CFCTRL_SRV_RFM: -- /* Construct a frame, convert -- * DatagramConnectionID -- * to network format long and copy it out... -- */ -- linkparam.u.rfm.connid = -- cfpkt_extr_head_u32(pkt); -- cp = (u8 *) linkparam.u.rfm.volume; -- for (tmp = cfpkt_extr_head_u8(pkt); -- cfpkt_more(pkt) && tmp != '\0'; -- tmp = cfpkt_extr_head_u8(pkt)) -- *cp++ = tmp; -- *cp = '\0'; -- -- if (CFCTRL_ERR_BIT & cmdrsp) -- break; -- /* Link ID */ -- linkid = cfpkt_extr_head_u8(pkt); -- -- break; -- case CFCTRL_SRV_UTIL: -- /* Construct a frame, convert -- * DatagramConnectionID -- * to network format long and copy it out... -- */ -- /* Fifosize KB */ -- linkparam.u.utility.fifosize_kb = -- cfpkt_extr_head_u16(pkt); -- /* Fifosize bufs */ -- linkparam.u.utility.fifosize_bufs = -- cfpkt_extr_head_u16(pkt); -- /* name */ -- cp = (u8 *) linkparam.u.utility.name; -- caif_assert(sizeof(linkparam.u.utility.name) -- >= UTILITY_NAME_LENGTH); -- for (i = 0; -- i < UTILITY_NAME_LENGTH -- && cfpkt_more(pkt); i++) { -- tmp = cfpkt_extr_head_u8(pkt); -- *cp++ = tmp; -- } -- /* Length */ -- len = cfpkt_extr_head_u8(pkt); -- linkparam.u.utility.paramlen = len; -- /* Param Data */ -- cp = linkparam.u.utility.params; -- while (cfpkt_more(pkt) && len--) { -- tmp = cfpkt_extr_head_u8(pkt); -- *cp++ = tmp; -- } -- if (CFCTRL_ERR_BIT & cmdrsp) -- break; -- /* Link ID */ -- linkid = cfpkt_extr_head_u8(pkt); -- /* Length */ -- len = cfpkt_extr_head_u8(pkt); -- /* Param Data */ -- cfpkt_extr_head(pkt, ¶m, len); -- break; -- default: -- pr_warn("Request setup, invalid type (%d)\n", -- serv); -- goto error; -- } -- -- rsp.cmd = cmd; -- rsp.param = linkparam; -- spin_lock_bh(&cfctrl->info_list_lock); -- req = cfctrl_remove_req(cfctrl, &rsp); -- -- if (CFCTRL_ERR_BIT == (CFCTRL_ERR_BIT & cmdrsp) || -- cfpkt_erroneous(pkt)) { -- pr_err("Invalid O/E bit or parse error " -- "on CAIF control channel\n"); -- cfctrl->res.reject_rsp(cfctrl->serv.layer.up, -- 0, -- req ? req->client_layer -- : NULL); -- } else { -- cfctrl->res.linksetup_rsp(cfctrl->serv. -- layer.up, linkid, -- serv, physlinkid, -- req ? req-> -- client_layer : NULL); -- } -- -- kfree(req); -- -- spin_unlock_bh(&cfctrl->info_list_lock); -- } -+ ret = cfctrl_link_setup(cfctrl, pkt, cmdrsp); - break; - case CFCTRL_CMD_LINK_DESTROY: - linkid = cfpkt_extr_head_u8(pkt); -@@ -544,9 +538,9 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt) - break; - default: - pr_err("Unrecognized Control Frame\n"); -+ ret = -1; - goto error; - } -- ret = 0; - error: - cfpkt_destroy(pkt); - return ret; -diff --git a/net/core/dst.c b/net/core/dst.c -index aad197e761cb4c..2513665696f693 100644 ---- a/net/core/dst.c -+++ b/net/core/dst.c -@@ -150,8 +150,8 @@ void dst_dev_put(struct dst_entry *dst) - dst->obsolete = DST_OBSOLETE_DEAD; - if (dst->ops->ifdown) - dst->ops->ifdown(dst, dev); -- dst->input = dst_discard; -- dst->output = dst_discard_out; -+ WRITE_ONCE(dst->input, dst_discard); -+ WRITE_ONCE(dst->output, dst_discard_out); - dst->dev = blackhole_netdev; - netdev_ref_replace(dev, blackhole_netdev, &dst->dev_tracker, - GFP_ATOMIC); -diff --git a/net/core/filter.c b/net/core/filter.c -index 3e10b4c8338f92..7afb7658c38835 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -9330,6 +9330,9 @@ static bool flow_dissector_is_valid_access(int off, int size, - if (off < 0 || off >= sizeof(struct __sk_buff)) - return false; - -+ if (off % size != 0) -+ return false; -+ - if (type == BPF_WRITE) - return false; - -diff --git a/net/core/netpoll.c b/net/core/netpoll.c -index 1a4d2a61b060bd..2bdb1e84c6c8a8 100644 ---- a/net/core/netpoll.c -+++ b/net/core/netpoll.c -@@ -791,6 +791,13 @@ int netpoll_setup(struct netpoll *np) - if (err) - goto put; - rtnl_unlock(); -+ -+ /* Make sure all NAPI polls which started before dev->npinfo -+ * was visible have exited before we start calling NAPI poll. -+ * NAPI skips locking if dev->npinfo is NULL. -+ */ -+ synchronize_rcu(); -+ - return 0; - - put: -diff --git a/net/core/skmsg.c b/net/core/skmsg.c -index c3169e1e635248..6225547808a6ba 100644 ---- a/net/core/skmsg.c -+++ b/net/core/skmsg.c -@@ -655,6 +655,13 @@ static void sk_psock_backlog(struct work_struct *work) - bool ingress; - int ret; - -+ /* If sk is quickly removed from the map and then added back, the old -+ * psock should not be scheduled, because there are now two psocks -+ * pointing to the same sk. -+ */ -+ if (!sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) -+ return; -+ - /* Increment the psock refcnt to synchronize with close(fd) path in - * sock_map_close(), ensuring we wait for backlog thread completion - * before sk_socket freed. If refcnt increment fails, it indicates -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 8ee1ad2d8c13f6..6ee77f7f911473 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -1699,8 +1699,8 @@ struct rtable *rt_dst_clone(struct net_device *dev, struct rtable *rt) - else if (rt->rt_gw_family == AF_INET6) - new_rt->rt_gw6 = rt->rt_gw6; - -- new_rt->dst.input = rt->dst.input; -- new_rt->dst.output = rt->dst.output; -+ new_rt->dst.input = READ_ONCE(rt->dst.input); -+ new_rt->dst.output = READ_ONCE(rt->dst.output); - new_rt->dst.error = rt->dst.error; - new_rt->dst.lastuse = jiffies; - new_rt->dst.lwtstate = lwtstate_get(rt->dst.lwtstate); -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index f7b95bc8ad60bb..c6d00817ad3fd9 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -4872,8 +4872,9 @@ static void tcp_ofo_queue(struct sock *sk) - - if (before(TCP_SKB_CB(skb)->seq, dsack_high)) { - __u32 dsack = dsack_high; -+ - if (before(TCP_SKB_CB(skb)->end_seq, dsack_high)) -- dsack_high = TCP_SKB_CB(skb)->end_seq; -+ dsack = TCP_SKB_CB(skb)->end_seq; - tcp_dsack_extend(sk, TCP_SKB_CB(skb)->seq, dsack); - } - p = rb_next(p); -@@ -4940,6 +4941,7 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb) - return; - } - -+ tcp_measure_rcv_mss(sk, skb); - /* Disable header prediction. */ - tp->pred_flags = 0; - inet_csk_schedule_ack(sk); -diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c -index 023ac39041a214..c44136cbbaa1f4 100644 ---- a/net/ipv6/ip6_fib.c -+++ b/net/ipv6/ip6_fib.c -@@ -437,15 +437,17 @@ struct fib6_dump_arg { - static int fib6_rt_dump(struct fib6_info *rt, struct fib6_dump_arg *arg) - { - enum fib_event_type fib_event = FIB_EVENT_ENTRY_REPLACE; -+ unsigned int nsiblings; - int err; - - if (!rt || rt == arg->net->ipv6.fib6_null_entry) - return 0; - -- if (rt->fib6_nsiblings) -+ nsiblings = READ_ONCE(rt->fib6_nsiblings); -+ if (nsiblings) - err = call_fib6_multipath_entry_notifier(arg->nb, fib_event, - rt, -- rt->fib6_nsiblings, -+ nsiblings, - arg->extack); - else - err = call_fib6_entry_notifier(arg->nb, fib_event, rt, -@@ -1118,7 +1120,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, - - if (rt6_duplicate_nexthop(iter, rt)) { - if (rt->fib6_nsiblings) -- rt->fib6_nsiblings = 0; -+ WRITE_ONCE(rt->fib6_nsiblings, 0); - if (!(iter->fib6_flags & RTF_EXPIRES)) - return -EEXIST; - if (!(rt->fib6_flags & RTF_EXPIRES)) -@@ -1144,7 +1146,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, - */ - if (rt_can_ecmp && - rt6_qualify_for_ecmp(iter)) -- rt->fib6_nsiblings++; -+ WRITE_ONCE(rt->fib6_nsiblings, -+ rt->fib6_nsiblings + 1); - } - - if (iter->fib6_metric > rt->fib6_metric) -@@ -1194,7 +1197,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, - fib6_nsiblings = 0; - list_for_each_entry_safe(sibling, temp_sibling, - &rt->fib6_siblings, fib6_siblings) { -- sibling->fib6_nsiblings++; -+ WRITE_ONCE(sibling->fib6_nsiblings, -+ sibling->fib6_nsiblings + 1); - BUG_ON(sibling->fib6_nsiblings != rt->fib6_nsiblings); - fib6_nsiblings++; - } -@@ -1239,8 +1243,9 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, - list_for_each_entry_safe(sibling, next_sibling, - &rt->fib6_siblings, - fib6_siblings) -- sibling->fib6_nsiblings--; -- rt->fib6_nsiblings = 0; -+ WRITE_ONCE(sibling->fib6_nsiblings, -+ sibling->fib6_nsiblings - 1); -+ WRITE_ONCE(rt->fib6_nsiblings, 0); - list_del_rcu(&rt->fib6_siblings); - rt6_multipath_rebalance(next_sibling); - return err; -@@ -1952,8 +1957,9 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn, - notify_del = true; - list_for_each_entry_safe(sibling, next_sibling, - &rt->fib6_siblings, fib6_siblings) -- sibling->fib6_nsiblings--; -- rt->fib6_nsiblings = 0; -+ WRITE_ONCE(sibling->fib6_nsiblings, -+ sibling->fib6_nsiblings - 1); -+ WRITE_ONCE(rt->fib6_nsiblings, 0); - list_del_rcu(&rt->fib6_siblings); - rt6_multipath_rebalance(next_sibling); - } -diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c -index 7f014a8969fb25..84b17eeaa57cc7 100644 ---- a/net/ipv6/ip6_offload.c -+++ b/net/ipv6/ip6_offload.c -@@ -150,7 +150,9 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, - - ops = rcu_dereference(inet6_offloads[proto]); - if (likely(ops && ops->callbacks.gso_segment)) { -- skb_reset_transport_header(skb); -+ if (!skb_reset_transport_header_careful(skb)) -+ goto out; -+ - segs = ops->callbacks.gso_segment(skb, features); - if (!segs) - skb->network_header = skb_mac_header(skb) + nhoff - skb->head; -diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c -index 7f19868d7d6c6b..18451dfeae6822 100644 ---- a/net/ipv6/ip6mr.c -+++ b/net/ipv6/ip6mr.c -@@ -2035,6 +2035,7 @@ static int ip6mr_forward2(struct net *net, struct mr_table *mrt, - struct sk_buff *skb, int vifi) - { - struct vif_device *vif = &mrt->vif_table[vifi]; -+ struct net_device *indev = skb->dev; - struct net_device *vif_dev; - struct ipv6hdr *ipv6h; - struct dst_entry *dst; -@@ -2097,7 +2098,7 @@ static int ip6mr_forward2(struct net *net, struct mr_table *mrt, - IP6CB(skb)->flags |= IP6SKB_FORWARDED; - - return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, -- net, NULL, skb, skb->dev, vif_dev, -+ net, NULL, skb, indev, skb->dev, - ip6mr_forward2_finish); - - out_free: -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index 53197087353a7b..eb9e505f71f979 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -5230,7 +5230,8 @@ static void ip6_route_mpath_notify(struct fib6_info *rt, - */ - rcu_read_lock(); - -- if ((nlflags & NLM_F_APPEND) && rt_last && rt_last->fib6_nsiblings) { -+ if ((nlflags & NLM_F_APPEND) && rt_last && -+ READ_ONCE(rt_last->fib6_nsiblings)) { - rt = list_first_or_null_rcu(&rt_last->fib6_siblings, - struct fib6_info, - fib6_siblings); -@@ -5577,32 +5578,34 @@ static int rt6_nh_nlmsg_size(struct fib6_nh *nh, void *arg) - - static size_t rt6_nlmsg_size(struct fib6_info *f6i) - { -+ struct fib6_info *sibling; -+ struct fib6_nh *nh; - int nexthop_len; - - if (f6i->nh) { - nexthop_len = nla_total_size(4); /* RTA_NH_ID */ - nexthop_for_each_fib6_nh(f6i->nh, rt6_nh_nlmsg_size, - &nexthop_len); -- } else { -- struct fib6_nh *nh = f6i->fib6_nh; -- struct fib6_info *sibling; -- -- nexthop_len = 0; -- if (f6i->fib6_nsiblings) { -- rt6_nh_nlmsg_size(nh, &nexthop_len); -- -- rcu_read_lock(); -+ goto common; -+ } - -- list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, -- fib6_siblings) { -- rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); -- } -+ rcu_read_lock(); -+retry: -+ nh = f6i->fib6_nh; -+ nexthop_len = 0; -+ if (READ_ONCE(f6i->fib6_nsiblings)) { -+ rt6_nh_nlmsg_size(nh, &nexthop_len); - -- rcu_read_unlock(); -+ list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, -+ fib6_siblings) { -+ rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); -+ if (!READ_ONCE(f6i->fib6_nsiblings)) -+ goto retry; - } -- nexthop_len += lwtunnel_get_encap_size(nh->fib_nh_lws); - } -- -+ rcu_read_unlock(); -+ nexthop_len += lwtunnel_get_encap_size(nh->fib_nh_lws); -+common: - return NLMSG_ALIGN(sizeof(struct rtmsg)) - + nla_total_size(16) /* RTA_SRC */ - + nla_total_size(16) /* RTA_DST */ -@@ -5761,7 +5764,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb, - if (dst->lwtstate && - lwtunnel_fill_encap(skb, dst->lwtstate, RTA_ENCAP, RTA_ENCAP_TYPE) < 0) - goto nla_put_failure; -- } else if (rt->fib6_nsiblings) { -+ } else if (READ_ONCE(rt->fib6_nsiblings)) { - struct fib6_info *sibling; - struct nlattr *mp; - -@@ -5863,16 +5866,21 @@ static bool fib6_info_uses_dev(const struct fib6_info *f6i, - if (f6i->fib6_nh->fib_nh_dev == dev) - return true; - -- if (f6i->fib6_nsiblings) { -- struct fib6_info *sibling, *next_sibling; -+ if (READ_ONCE(f6i->fib6_nsiblings)) { -+ const struct fib6_info *sibling; - -- list_for_each_entry_safe(sibling, next_sibling, -- &f6i->fib6_siblings, fib6_siblings) { -- if (sibling->fib6_nh->fib_nh_dev == dev) -+ rcu_read_lock(); -+ list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, -+ fib6_siblings) { -+ if (sibling->fib6_nh->fib_nh_dev == dev) { -+ rcu_read_unlock(); - return true; -+ } -+ if (!READ_ONCE(f6i->fib6_nsiblings)) -+ break; - } -+ rcu_read_unlock(); - } -- - return false; - } - -diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c -index a3c5d4d995db02..3ff7f38394a6bc 100644 ---- a/net/mac80211/cfg.c -+++ b/net/mac80211/cfg.c -@@ -1099,13 +1099,13 @@ ieee80211_copy_rnr_beacon(u8 *pos, struct cfg80211_rnr_elems *dst, - { - int i, offset = 0; - -+ dst->cnt = src->cnt; - for (i = 0; i < src->cnt; i++) { - memcpy(pos + offset, src->elem[i].data, src->elem[i].len); - dst->elem[i].len = src->elem[i].len; - dst->elem[i].data = pos + offset; - offset += dst->elem[i].len; - } -- dst->cnt = src->cnt; - - return offset; - } -diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c -index a4af3b7675efae..f3cdbd2133f67c 100644 ---- a/net/mac80211/tdls.c -+++ b/net/mac80211/tdls.c -@@ -1450,7 +1450,7 @@ int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev, - if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS)) - return -ENOTSUPP; - -- if (sdata->vif.type != NL80211_IFTYPE_STATION) -+ if (sdata->vif.type != NL80211_IFTYPE_STATION || !sdata->vif.cfg.assoc) - return -EINVAL; - - switch (oper) { -diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c -index ec5469add68a27..7eddcb6f964555 100644 ---- a/net/mac80211/tx.c -+++ b/net/mac80211/tx.c -@@ -629,6 +629,12 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx) - else - tx->key = NULL; - -+ if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) { -+ if (tx->key && tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) -+ info->control.hw_key = &tx->key->conf; -+ return TX_CONTINUE; -+ } -+ - if (tx->key) { - bool skip_hw = false; - -@@ -1451,7 +1457,7 @@ static void ieee80211_txq_enqueue(struct ieee80211_local *local, - { - struct fq *fq = &local->fq; - struct fq_tin *tin = &txqi->tin; -- u32 flow_idx = fq_flow_idx(fq, skb); -+ u32 flow_idx; - - ieee80211_set_skb_enqueue_time(skb); - -@@ -1467,6 +1473,7 @@ static void ieee80211_txq_enqueue(struct ieee80211_local *local, - IEEE80211_TX_INTCFL_NEED_TXPROCESSING; - __skb_queue_tail(&txqi->frags, skb); - } else { -+ flow_idx = fq_flow_idx(fq, skb); - fq_tin_enqueue(fq, tin, flow_idx, skb, - fq_skb_free_func); - } -@@ -3877,6 +3884,7 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw, - * The key can be removed while the packet was queued, so need to call - * this here to get the current key. - */ -+ info->control.hw_key = NULL; - r = ieee80211_tx_h_select_key(&tx); - if (r != TX_CONTINUE) { - ieee80211_free_txskb(&local->hw, skb); -@@ -4099,7 +4107,9 @@ void __ieee80211_schedule_txq(struct ieee80211_hw *hw, - - spin_lock_bh(&local->active_txq_lock[txq->ac]); - -- has_queue = force || txq_has_queue(txq); -+ has_queue = force || -+ (!test_bit(IEEE80211_TXQ_STOP, &txqi->flags) && -+ txq_has_queue(txq)); - if (list_empty(&txqi->schedule_order) && - (has_queue || ieee80211_txq_keep_active(txqi))) { - /* If airtime accounting is active, always enqueue STAs at the -diff --git a/net/netfilter/nf_bpf_link.c b/net/netfilter/nf_bpf_link.c -index 2aad0562a41351..658e401b7937e4 100644 ---- a/net/netfilter/nf_bpf_link.c -+++ b/net/netfilter/nf_bpf_link.c -@@ -17,7 +17,7 @@ static unsigned int nf_hook_run_bpf(void *bpf_prog, struct sk_buff *skb, - .skb = skb, - }; - -- return bpf_prog_run(prog, &ctx); -+ return bpf_prog_run_pin_on_cpu(prog, &ctx); - } - - struct bpf_nf_link { -@@ -295,6 +295,9 @@ static bool nf_is_valid_access(int off, int size, enum bpf_access_type type, - if (off < 0 || off >= sizeof(struct bpf_nf_ctx)) - return false; - -+ if (off % size != 0) -+ return false; -+ - if (type == BPF_WRITE) - return false; - -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 18ae39cf418876..4ffb5ef79ca13f 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -979,11 +979,6 @@ static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net, - NFTA_TABLE_PAD)) - goto nla_put_failure; - -- if (event == NFT_MSG_DELTABLE) { -- nlmsg_end(skb, nlh); -- return 0; -- } -- - if (nla_put_be32(skb, NFTA_TABLE_FLAGS, - htonl(table->flags & NFT_TABLE_F_MASK))) - goto nla_put_failure; -@@ -1827,11 +1822,6 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net, - NFTA_CHAIN_PAD)) - goto nla_put_failure; - -- if (event == NFT_MSG_DELCHAIN && !hook_list) { -- nlmsg_end(skb, nlh); -- return 0; -- } -- - if (nft_is_base_chain(chain)) { - const struct nft_base_chain *basechain = nft_base_chain(chain); - struct nft_stats __percpu *stats; -@@ -3785,7 +3775,7 @@ void nf_tables_rule_destroy(const struct nft_ctx *ctx, struct nft_rule *rule) - /* can only be used if rule is no longer visible to dumps */ - static void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *rule) - { -- lockdep_commit_lock_is_held(ctx->net); -+ WARN_ON_ONCE(!lockdep_commit_lock_is_held(ctx->net)); - - nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE); - nf_tables_rule_destroy(ctx, rule); -@@ -4584,11 +4574,6 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, - NFTA_SET_PAD)) - goto nla_put_failure; - -- if (event == NFT_MSG_DELSET) { -- nlmsg_end(skb, nlh); -- return 0; -- } -- - if (set->flags != 0) - if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags))) - goto nla_put_failure; -@@ -5586,7 +5571,7 @@ void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set, - struct nft_set_binding *binding, - enum nft_trans_phase phase) - { -- lockdep_commit_lock_is_held(ctx->net); -+ WARN_ON_ONCE(!lockdep_commit_lock_is_held(ctx->net)); - - switch (phase) { - case NFT_TRANS_PREPARE_ERROR: -@@ -7828,11 +7813,6 @@ static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net, - NFTA_OBJ_PAD)) - goto nla_put_failure; - -- if (event == NFT_MSG_DELOBJ) { -- nlmsg_end(skb, nlh); -- return 0; -- } -- - if (nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) || - nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) || - nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset)) -@@ -8851,11 +8831,6 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, - NFTA_FLOWTABLE_PAD)) - goto nla_put_failure; - -- if (event == NFT_MSG_DELFLOWTABLE && !hook_list) { -- nlmsg_end(skb, nlh); -- return 0; -- } -- - if (nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) || - nla_put_be32(skb, NFTA_FLOWTABLE_FLAGS, htonl(flowtable->data.flags))) - goto nla_put_failure; -diff --git a/net/netfilter/xt_nfacct.c b/net/netfilter/xt_nfacct.c -index 7c6bf1c168131a..0ca1cdfc4095b6 100644 ---- a/net/netfilter/xt_nfacct.c -+++ b/net/netfilter/xt_nfacct.c -@@ -38,8 +38,8 @@ nfacct_mt_checkentry(const struct xt_mtchk_param *par) - - nfacct = nfnl_acct_find_get(par->net, info->name); - if (nfacct == NULL) { -- pr_info_ratelimited("accounting object `%s' does not exists\n", -- info->name); -+ pr_info_ratelimited("accounting object `%.*s' does not exist\n", -+ NFACCT_NAME_MAX, info->name); - return -ENOENT; - } - info->nfacct = nfacct; -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 9cac7cb78c0f54..9620f160be70bb 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -4566,10 +4566,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - spin_lock(&po->bind_lock); - was_running = packet_sock_flag(po, PACKET_SOCK_RUNNING); - num = po->num; -- if (was_running) { -- WRITE_ONCE(po->num, 0); -+ WRITE_ONCE(po->num, 0); -+ if (was_running) - __unregister_prot_hook(sk, false); -- } -+ - spin_unlock(&po->bind_lock); - - synchronize_net(); -@@ -4601,10 +4601,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - mutex_unlock(&po->pg_vec_lock); - - spin_lock(&po->bind_lock); -- if (was_running) { -- WRITE_ONCE(po->num, num); -+ WRITE_ONCE(po->num, num); -+ if (was_running) - register_prot_hook(sk); -- } -+ - spin_unlock(&po->bind_lock); - if (pg_vec && (po->tp_version > TPACKET_V2)) { - /* Because we don't support block-based V3 on tx-ring */ -diff --git a/net/sched/act_ctinfo.c b/net/sched/act_ctinfo.c -index 4d15b6a6169c45..8792244620b9d2 100644 ---- a/net/sched/act_ctinfo.c -+++ b/net/sched/act_ctinfo.c -@@ -44,9 +44,9 @@ static void tcf_ctinfo_dscp_set(struct nf_conn *ct, struct tcf_ctinfo *ca, - ipv4_change_dsfield(ip_hdr(skb), - INET_ECN_MASK, - newdscp); -- ca->stats_dscp_set++; -+ atomic64_inc(&ca->stats_dscp_set); - } else { -- ca->stats_dscp_error++; -+ atomic64_inc(&ca->stats_dscp_error); - } - } - break; -@@ -57,9 +57,9 @@ static void tcf_ctinfo_dscp_set(struct nf_conn *ct, struct tcf_ctinfo *ca, - ipv6_change_dsfield(ipv6_hdr(skb), - INET_ECN_MASK, - newdscp); -- ca->stats_dscp_set++; -+ atomic64_inc(&ca->stats_dscp_set); - } else { -- ca->stats_dscp_error++; -+ atomic64_inc(&ca->stats_dscp_error); - } - } - break; -@@ -72,7 +72,7 @@ static void tcf_ctinfo_cpmark_set(struct nf_conn *ct, struct tcf_ctinfo *ca, - struct tcf_ctinfo_params *cp, - struct sk_buff *skb) - { -- ca->stats_cpmark_set++; -+ atomic64_inc(&ca->stats_cpmark_set); - skb->mark = READ_ONCE(ct->mark) & cp->cpmarkmask; - } - -@@ -323,15 +323,18 @@ static int tcf_ctinfo_dump(struct sk_buff *skb, struct tc_action *a, - } - - if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_SET, -- ci->stats_dscp_set, TCA_CTINFO_PAD)) -+ atomic64_read(&ci->stats_dscp_set), -+ TCA_CTINFO_PAD)) - goto nla_put_failure; - - if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_DSCP_ERROR, -- ci->stats_dscp_error, TCA_CTINFO_PAD)) -+ atomic64_read(&ci->stats_dscp_error), -+ TCA_CTINFO_PAD)) - goto nla_put_failure; - - if (nla_put_u64_64bit(skb, TCA_CTINFO_STATS_CPMARK_SET, -- ci->stats_cpmark_set, TCA_CTINFO_PAD)) -+ atomic64_read(&ci->stats_cpmark_set), -+ TCA_CTINFO_PAD)) - goto nla_put_failure; - - spin_unlock_bh(&ci->tcf_lock); -diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c -index 793009f445c03b..a0e3f3bae5361d 100644 ---- a/net/sched/sch_mqprio.c -+++ b/net/sched/sch_mqprio.c -@@ -152,7 +152,7 @@ static int mqprio_parse_opt(struct net_device *dev, struct tc_mqprio_qopt *qopt, - static const struct - nla_policy mqprio_tc_entry_policy[TCA_MQPRIO_TC_ENTRY_MAX + 1] = { - [TCA_MQPRIO_TC_ENTRY_INDEX] = NLA_POLICY_MAX(NLA_U32, -- TC_QOPT_MAX_QUEUE), -+ TC_QOPT_MAX_QUEUE - 1), - [TCA_MQPRIO_TC_ENTRY_FP] = NLA_POLICY_RANGE(NLA_U32, - TC_FP_EXPRESS, - TC_FP_PREEMPTIBLE), -diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c -index 447d3e836a24f0..0ad231e94e14d3 100644 ---- a/net/sched/sch_netem.c -+++ b/net/sched/sch_netem.c -@@ -972,6 +972,41 @@ static int parse_attr(struct nlattr *tb[], int maxtype, struct nlattr *nla, - return 0; - } - -+static const struct Qdisc_class_ops netem_class_ops; -+ -+static int check_netem_in_tree(struct Qdisc *sch, bool duplicates, -+ struct netlink_ext_ack *extack) -+{ -+ struct Qdisc *root, *q; -+ unsigned int i; -+ -+ root = qdisc_root_sleeping(sch); -+ -+ if (sch != root && root->ops->cl_ops == &netem_class_ops) { -+ if (duplicates || -+ ((struct netem_sched_data *)qdisc_priv(root))->duplicate) -+ goto err; -+ } -+ -+ if (!qdisc_dev(root)) -+ return 0; -+ -+ hash_for_each(qdisc_dev(root)->qdisc_hash, i, q, hash) { -+ if (sch != q && q->ops->cl_ops == &netem_class_ops) { -+ if (duplicates || -+ ((struct netem_sched_data *)qdisc_priv(q))->duplicate) -+ goto err; -+ } -+ } -+ -+ return 0; -+ -+err: -+ NL_SET_ERR_MSG(extack, -+ "netem: cannot mix duplicating netems with other netems in tree"); -+ return -EINVAL; -+} -+ - /* Parse netlink message to set options */ - static int netem_change(struct Qdisc *sch, struct nlattr *opt, - struct netlink_ext_ack *extack) -@@ -1030,6 +1065,11 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt, - q->gap = qopt->gap; - q->counter = 0; - q->loss = qopt->loss; -+ -+ ret = check_netem_in_tree(sch, qopt->duplicate, extack); -+ if (ret) -+ goto unlock; -+ - q->duplicate = qopt->duplicate; - - /* for compatibility with earlier versions. -diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c -index d162e2dd860255..a01d17d03bf571 100644 ---- a/net/sched/sch_taprio.c -+++ b/net/sched/sch_taprio.c -@@ -41,6 +41,11 @@ static struct static_key_false taprio_have_working_mqprio; - #define TXTIME_ASSIST_IS_ENABLED(flags) ((flags) & TCA_TAPRIO_ATTR_FLAG_TXTIME_ASSIST) - #define FULL_OFFLOAD_IS_ENABLED(flags) ((flags) & TCA_TAPRIO_ATTR_FLAG_FULL_OFFLOAD) - #define TAPRIO_FLAGS_INVALID U32_MAX -+/* Minimum value for picos_per_byte to ensure non-zero duration -+ * for minimum-sized Ethernet frames (ETH_ZLEN = 60). -+ * 60 * 17 > PSEC_PER_NSEC (1000) -+ */ -+#define TAPRIO_PICOS_PER_BYTE_MIN 17 - - struct sched_entry { - /* Durations between this GCL entry and the GCL entry where the -@@ -1294,7 +1299,8 @@ static void taprio_start_sched(struct Qdisc *sch, - } - - static void taprio_set_picos_per_byte(struct net_device *dev, -- struct taprio_sched *q) -+ struct taprio_sched *q, -+ struct netlink_ext_ack *extack) - { - struct ethtool_link_ksettings ecmd; - int speed = SPEED_10; -@@ -1310,6 +1316,15 @@ static void taprio_set_picos_per_byte(struct net_device *dev, - - skip: - picos_per_byte = (USEC_PER_SEC * 8) / speed; -+ if (picos_per_byte < TAPRIO_PICOS_PER_BYTE_MIN) { -+ if (!extack) -+ pr_warn("Link speed %d is too high. Schedule may be inaccurate.\n", -+ speed); -+ NL_SET_ERR_MSG_FMT_MOD(extack, -+ "Link speed %d is too high. Schedule may be inaccurate.", -+ speed); -+ picos_per_byte = TAPRIO_PICOS_PER_BYTE_MIN; -+ } - - atomic64_set(&q->picos_per_byte, picos_per_byte); - netdev_dbg(dev, "taprio: set %s's picos_per_byte to: %lld, linkspeed: %d\n", -@@ -1334,7 +1349,7 @@ static int taprio_dev_notifier(struct notifier_block *nb, unsigned long event, - if (dev != qdisc_dev(q->root)) - continue; - -- taprio_set_picos_per_byte(dev, q); -+ taprio_set_picos_per_byte(dev, q, NULL); - - stab = rtnl_dereference(q->root->stab); - -@@ -1871,7 +1886,7 @@ static int taprio_change(struct Qdisc *sch, struct nlattr *opt, - q->flags = err; - - /* Needed for length_to_duration() during netlink attribute parsing */ -- taprio_set_picos_per_byte(dev, q); -+ taprio_set_picos_per_byte(dev, q, extack); - - err = taprio_parse_mqprio_opt(dev, mqprio, extack, q->flags); - if (err < 0) -diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c -index 8d760f8fc4b5a6..7229b4a9ad1dcf 100644 ---- a/net/sunrpc/svcsock.c -+++ b/net/sunrpc/svcsock.c -@@ -257,20 +257,47 @@ svc_tcp_sock_process_cmsg(struct socket *sock, struct msghdr *msg, - } - - static int --svc_tcp_sock_recv_cmsg(struct svc_sock *svsk, struct msghdr *msg) -+svc_tcp_sock_recv_cmsg(struct socket *sock, unsigned int *msg_flags) - { - union { - struct cmsghdr cmsg; - u8 buf[CMSG_SPACE(sizeof(u8))]; - } u; -- struct socket *sock = svsk->sk_sock; -+ u8 alert[2]; -+ struct kvec alert_kvec = { -+ .iov_base = alert, -+ .iov_len = sizeof(alert), -+ }; -+ struct msghdr msg = { -+ .msg_flags = *msg_flags, -+ .msg_control = &u, -+ .msg_controllen = sizeof(u), -+ }; -+ int ret; -+ -+ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &alert_kvec, 1, -+ alert_kvec.iov_len); -+ ret = sock_recvmsg(sock, &msg, MSG_DONTWAIT); -+ if (ret > 0 && -+ tls_get_record_type(sock->sk, &u.cmsg) == TLS_RECORD_TYPE_ALERT) { -+ iov_iter_revert(&msg.msg_iter, ret); -+ ret = svc_tcp_sock_process_cmsg(sock, &msg, &u.cmsg, -EAGAIN); -+ } -+ return ret; -+} -+ -+static int -+svc_tcp_sock_recvmsg(struct svc_sock *svsk, struct msghdr *msg) -+{ - int ret; -+ struct socket *sock = svsk->sk_sock; - -- msg->msg_control = &u; -- msg->msg_controllen = sizeof(u); - ret = sock_recvmsg(sock, msg, MSG_DONTWAIT); -- if (unlikely(msg->msg_controllen != sizeof(u))) -- ret = svc_tcp_sock_process_cmsg(sock, msg, &u.cmsg, ret); -+ if (msg->msg_flags & MSG_CTRUNC) { -+ msg->msg_flags &= ~(MSG_CTRUNC | MSG_EOR); -+ if (ret == 0 || ret == -EIO) -+ ret = svc_tcp_sock_recv_cmsg(sock, &msg->msg_flags); -+ } - return ret; - } - -@@ -321,7 +348,7 @@ static ssize_t svc_tcp_read_msg(struct svc_rqst *rqstp, size_t buflen, - iov_iter_advance(&msg.msg_iter, seek); - buflen -= seek; - } -- len = svc_tcp_sock_recv_cmsg(svsk, &msg); -+ len = svc_tcp_sock_recvmsg(svsk, &msg); - if (len > 0) - svc_flush_bvec(bvec, len, seek); - -@@ -1019,7 +1046,7 @@ static ssize_t svc_tcp_read_marker(struct svc_sock *svsk, - iov.iov_base = ((char *)&svsk->sk_marker) + svsk->sk_tcplen; - iov.iov_len = want; - iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, want); -- len = svc_tcp_sock_recv_cmsg(svsk, &msg); -+ len = svc_tcp_sock_recvmsg(svsk, &msg); - if (len < 0) - return len; - svsk->sk_tcplen += len; -diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c -index f90d84492bbedc..99bb3e762af46f 100644 ---- a/net/sunrpc/xprtsock.c -+++ b/net/sunrpc/xprtsock.c -@@ -358,7 +358,7 @@ xs_alloc_sparse_pages(struct xdr_buf *buf, size_t want, gfp_t gfp) - - static int - xs_sock_process_cmsg(struct socket *sock, struct msghdr *msg, -- struct cmsghdr *cmsg, int ret) -+ unsigned int *msg_flags, struct cmsghdr *cmsg, int ret) - { - u8 content_type = tls_get_record_type(sock->sk, cmsg); - u8 level, description; -@@ -371,7 +371,7 @@ xs_sock_process_cmsg(struct socket *sock, struct msghdr *msg, - * record, even though there might be more frames - * waiting to be decrypted. - */ -- msg->msg_flags &= ~MSG_EOR; -+ *msg_flags &= ~MSG_EOR; - break; - case TLS_RECORD_TYPE_ALERT: - tls_alert_recv(sock->sk, msg, &level, &description); -@@ -386,19 +386,33 @@ xs_sock_process_cmsg(struct socket *sock, struct msghdr *msg, - } - - static int --xs_sock_recv_cmsg(struct socket *sock, struct msghdr *msg, int flags) -+xs_sock_recv_cmsg(struct socket *sock, unsigned int *msg_flags, int flags) - { - union { - struct cmsghdr cmsg; - u8 buf[CMSG_SPACE(sizeof(u8))]; - } u; -+ u8 alert[2]; -+ struct kvec alert_kvec = { -+ .iov_base = alert, -+ .iov_len = sizeof(alert), -+ }; -+ struct msghdr msg = { -+ .msg_flags = *msg_flags, -+ .msg_control = &u, -+ .msg_controllen = sizeof(u), -+ }; - int ret; - -- msg->msg_control = &u; -- msg->msg_controllen = sizeof(u); -- ret = sock_recvmsg(sock, msg, flags); -- if (msg->msg_controllen != sizeof(u)) -- ret = xs_sock_process_cmsg(sock, msg, &u.cmsg, ret); -+ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &alert_kvec, 1, -+ alert_kvec.iov_len); -+ ret = sock_recvmsg(sock, &msg, flags); -+ if (ret > 0 && -+ tls_get_record_type(sock->sk, &u.cmsg) == TLS_RECORD_TYPE_ALERT) { -+ iov_iter_revert(&msg.msg_iter, ret); -+ ret = xs_sock_process_cmsg(sock, &msg, msg_flags, &u.cmsg, -+ -EAGAIN); -+ } - return ret; - } - -@@ -408,7 +422,13 @@ xs_sock_recvmsg(struct socket *sock, struct msghdr *msg, int flags, size_t seek) - ssize_t ret; - if (seek != 0) - iov_iter_advance(&msg->msg_iter, seek); -- ret = xs_sock_recv_cmsg(sock, msg, flags); -+ ret = sock_recvmsg(sock, msg, flags); -+ /* Handle TLS inband control message lazily */ -+ if (msg->msg_flags & MSG_CTRUNC) { -+ msg->msg_flags &= ~(MSG_CTRUNC | MSG_EOR); -+ if (ret == 0 || ret == -EIO) -+ ret = xs_sock_recv_cmsg(sock, &msg->msg_flags, flags); -+ } - return ret > 0 ? ret + seek : ret; - } - -@@ -434,7 +454,7 @@ xs_read_discard(struct socket *sock, struct msghdr *msg, int flags, - size_t count) - { - iov_iter_discard(&msg->msg_iter, ITER_DEST, count); -- return xs_sock_recv_cmsg(sock, msg, flags); -+ return xs_sock_recvmsg(sock, msg, flags, 0); - } - - #if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE -diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c -index 4a9a3aed5d6d41..4905a81c4ac194 100644 ---- a/net/tls/tls_sw.c -+++ b/net/tls/tls_sw.c -@@ -872,6 +872,19 @@ static int bpf_exec_tx_verdict(struct sk_msg *msg, struct sock *sk, - delta = msg->sg.size; - psock->eval = sk_psock_msg_verdict(sk, psock, msg); - delta -= msg->sg.size; -+ -+ if ((s32)delta > 0) { -+ /* It indicates that we executed bpf_msg_pop_data(), -+ * causing the plaintext data size to decrease. -+ * Therefore the encrypted data size also needs to -+ * correspondingly decrease. We only need to subtract -+ * delta to calculate the new ciphertext length since -+ * ktls does not support block encryption. -+ */ -+ struct sk_msg *enc = &ctx->open_rec->msg_encrypted; -+ -+ sk_msg_trim(sk, enc, enc->sg.size - delta); -+ } - } - if (msg->cork_bytes && msg->cork_bytes > msg->sg.size && - !enospc && !full_record) { -diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c -index f20b117e5255ef..f95ac11a7e0de4 100644 ---- a/net/vmw_vsock/af_vsock.c -+++ b/net/vmw_vsock/af_vsock.c -@@ -688,7 +688,8 @@ static int __vsock_bind_connectible(struct vsock_sock *vsk, - unsigned int i; - - for (i = 0; i < MAX_PORT_RETRIES; i++) { -- if (port <= LAST_RESERVED_PORT) -+ if (port == VMADDR_PORT_ANY || -+ port <= LAST_RESERVED_PORT) - port = LAST_RESERVED_PORT + 1; - - new_addr.svm_port = port++; -diff --git a/samples/mei/mei-amt-version.c b/samples/mei/mei-amt-version.c -index 867debd3b9124c..1d7254bcb44cb7 100644 ---- a/samples/mei/mei-amt-version.c -+++ b/samples/mei/mei-amt-version.c -@@ -69,11 +69,11 @@ - #include - #include - #include -+#include - #include - #include - #include - #include --#include - #include - - /***************************************************************************** -diff --git a/scripts/kconfig/qconf.cc b/scripts/kconfig/qconf.cc -index 4f3ba3debc08e1..119997c8bf1f74 100644 ---- a/scripts/kconfig/qconf.cc -+++ b/scripts/kconfig/qconf.cc -@@ -480,7 +480,7 @@ void ConfigList::updateListAllForAll() - while (it.hasNext()) { - ConfigList *list = it.next(); - -- list->updateList(); -+ list->updateListAll(); - } - } - -diff --git a/security/apparmor/include/match.h b/security/apparmor/include/match.h -index 58fbf67139b9c7..e59305abb85a33 100644 ---- a/security/apparmor/include/match.h -+++ b/security/apparmor/include/match.h -@@ -141,17 +141,15 @@ aa_state_t aa_dfa_matchn_until(struct aa_dfa *dfa, aa_state_t start, - - void aa_dfa_free_kref(struct kref *kref); - --#define WB_HISTORY_SIZE 24 -+/* This needs to be a power of 2 */ -+#define WB_HISTORY_SIZE 32 - struct match_workbuf { -- unsigned int count; - unsigned int pos; - unsigned int len; -- unsigned int size; /* power of 2, same as history size */ -- unsigned int history[WB_HISTORY_SIZE]; -+ aa_state_t history[WB_HISTORY_SIZE]; - }; - #define DEFINE_MATCH_WB(N) \ - struct match_workbuf N = { \ -- .count = 0, \ - .pos = 0, \ - .len = 0, \ - } -diff --git a/security/apparmor/match.c b/security/apparmor/match.c -index b97ef5e1db7320..3667b79e9366b0 100644 ---- a/security/apparmor/match.c -+++ b/security/apparmor/match.c -@@ -668,34 +668,35 @@ aa_state_t aa_dfa_matchn_until(struct aa_dfa *dfa, aa_state_t start, - return state; - } - --#define inc_wb_pos(wb) \ --do { \ -+#define inc_wb_pos(wb) \ -+do { \ -+ BUILD_BUG_ON_NOT_POWER_OF_2(WB_HISTORY_SIZE); \ - wb->pos = (wb->pos + 1) & (WB_HISTORY_SIZE - 1); \ -- wb->len = (wb->len + 1) & (WB_HISTORY_SIZE - 1); \ -+ wb->len = (wb->len + 1) > WB_HISTORY_SIZE ? WB_HISTORY_SIZE : \ -+ wb->len + 1; \ - } while (0) - - /* For DFAs that don't support extended tagging of states */ -+/* adjust is only set if is_loop returns true */ - static bool is_loop(struct match_workbuf *wb, aa_state_t state, - unsigned int *adjust) - { -- aa_state_t pos = wb->pos; -- aa_state_t i; -+ int pos = wb->pos; -+ int i; - - if (wb->history[pos] < state) - return false; - -- for (i = 0; i <= wb->len; i++) { -+ for (i = 0; i < wb->len; i++) { - if (wb->history[pos] == state) { - *adjust = i; - return true; - } -- if (pos == 0) -- pos = WB_HISTORY_SIZE; -- pos--; -+ /* -1 wraps to WB_HISTORY_SIZE - 1 */ -+ pos = (pos - 1) & (WB_HISTORY_SIZE - 1); - } - -- *adjust = i; -- return true; -+ return false; - } - - static aa_state_t leftmatch_fb(struct aa_dfa *dfa, aa_state_t start, -diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c -index 27e48fdbbf3aa0..94b452595f3032 100644 ---- a/sound/pci/hda/patch_ca0132.c -+++ b/sound/pci/hda/patch_ca0132.c -@@ -4803,7 +4803,8 @@ static int ca0132_alt_select_out(struct hda_codec *codec) - if (err < 0) - goto exit; - -- if (ca0132_alt_select_out_quirk_set(codec) < 0) -+ err = ca0132_alt_select_out_quirk_set(codec); -+ if (err < 0) - goto exit; - - switch (spec->cur_out_type) { -@@ -4893,6 +4894,8 @@ static int ca0132_alt_select_out(struct hda_codec *codec) - spec->bass_redirection_val); - else - err = ca0132_alt_surround_set_bass_redirection(codec, 0); -+ if (err < 0) -+ goto exit; - - /* Unmute DSP now that we're done with output selection. */ - err = dspio_set_uint_param(codec, 0x96, -diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c -index 66ef8f4fd02cd4..24919e68b34689 100644 ---- a/sound/soc/amd/yc/acp6x-mach.c -+++ b/sound/soc/amd/yc/acp6x-mach.c -@@ -409,6 +409,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "M6500RC"), - } - }, -+ { -+ .driver_data = &acp6x_card, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "M6501RM"), -+ } -+ }, - { - .driver_data = &acp6x_card, - .matches = { -@@ -528,6 +535,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "OMEN by HP Gaming Laptop 16z-n000"), - } - }, -+ { -+ .driver_data = &acp6x_card, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "HP"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Victus by HP Gaming Laptop 15-fb1xxx"), -+ } -+ }, - { - .driver_data = &acp6x_card, - .matches = { -@@ -577,6 +591,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { - DMI_MATCH(DMI_BOARD_NAME, "8A7F"), - } - }, -+ { -+ .driver_data = &acp6x_card, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "HP"), -+ DMI_MATCH(DMI_BOARD_NAME, "8A81"), -+ } -+ }, - { - .driver_data = &acp6x_card, - .matches = { -diff --git a/sound/soc/fsl/fsl_xcvr.c b/sound/soc/fsl/fsl_xcvr.c -index c46f64557a7ffd..1d7791c7fb4ec0 100644 ---- a/sound/soc/fsl/fsl_xcvr.c -+++ b/sound/soc/fsl/fsl_xcvr.c -@@ -1197,6 +1197,26 @@ static irqreturn_t irq0_isr(int irq, void *devid) - /* clear CS control register */ - memset_io(reg_ctrl, 0, sizeof(val)); - } -+ } else { -+ regmap_read(xcvr->regmap, FSL_XCVR_RX_CS_DATA_0, -+ (u32 *)&xcvr->rx_iec958.status[0]); -+ regmap_read(xcvr->regmap, FSL_XCVR_RX_CS_DATA_1, -+ (u32 *)&xcvr->rx_iec958.status[4]); -+ regmap_read(xcvr->regmap, FSL_XCVR_RX_CS_DATA_2, -+ (u32 *)&xcvr->rx_iec958.status[8]); -+ regmap_read(xcvr->regmap, FSL_XCVR_RX_CS_DATA_3, -+ (u32 *)&xcvr->rx_iec958.status[12]); -+ regmap_read(xcvr->regmap, FSL_XCVR_RX_CS_DATA_4, -+ (u32 *)&xcvr->rx_iec958.status[16]); -+ regmap_read(xcvr->regmap, FSL_XCVR_RX_CS_DATA_5, -+ (u32 *)&xcvr->rx_iec958.status[20]); -+ for (i = 0; i < 6; i++) { -+ val = *(u32 *)(xcvr->rx_iec958.status + i * 4); -+ *(u32 *)(xcvr->rx_iec958.status + i * 4) = -+ bitrev32(val); -+ } -+ regmap_set_bits(xcvr->regmap, FSL_XCVR_RX_DPTH_CTRL, -+ FSL_XCVR_RX_DPTH_CTRL_CSA); - } - } - if (isr & FSL_XCVR_IRQ_NEW_UD) { -diff --git a/sound/soc/intel/boards/Kconfig b/sound/soc/intel/boards/Kconfig -index 0ae6eecc885191..033be4d3e02db9 100644 ---- a/sound/soc/intel/boards/Kconfig -+++ b/sound/soc/intel/boards/Kconfig -@@ -11,7 +11,7 @@ menuconfig SND_SOC_INTEL_MACH - kernel: saying N will just cause the configurator to skip all - the questions about Intel ASoC machine drivers. - --if SND_SOC_INTEL_MACH -+if SND_SOC_INTEL_MACH && (SND_SOC_SOF_INTEL_COMMON || !SND_SOC_SOF_INTEL_COMMON) - - config SND_SOC_INTEL_USER_FRIENDLY_LONG_NAMES - bool "Use more user friendly long card names" -diff --git a/sound/soc/mediatek/common/mtk-afe-platform-driver.c b/sound/soc/mediatek/common/mtk-afe-platform-driver.c -index 52495c930ca3bf..56a704ec2ea947 100644 ---- a/sound/soc/mediatek/common/mtk-afe-platform-driver.c -+++ b/sound/soc/mediatek/common/mtk-afe-platform-driver.c -@@ -120,7 +120,9 @@ int mtk_afe_pcm_new(struct snd_soc_component *component, - struct mtk_base_afe *afe = snd_soc_component_get_drvdata(component); - - size = afe->mtk_afe_hardware->buffer_bytes_max; -- snd_pcm_set_managed_buffer_all(pcm, SNDRV_DMA_TYPE_DEV, afe->dev, 0, size); -+ snd_pcm_set_managed_buffer_all(pcm, SNDRV_DMA_TYPE_DEV, afe->dev, -+ afe->preallocate_buffers ? size : 0, -+ size); - - return 0; - } -diff --git a/sound/soc/mediatek/common/mtk-base-afe.h b/sound/soc/mediatek/common/mtk-base-afe.h -index f51578b6c50a35..a406f2e3e7a878 100644 ---- a/sound/soc/mediatek/common/mtk-base-afe.h -+++ b/sound/soc/mediatek/common/mtk-base-afe.h -@@ -117,6 +117,7 @@ struct mtk_base_afe { - struct mtk_base_afe_irq *irqs; - int irqs_size; - int memif_32bit_supported; -+ bool preallocate_buffers; - - struct list_head sub_dais; - struct snd_soc_dai_driver *dai_drivers; -diff --git a/sound/soc/mediatek/mt8173/mt8173-afe-pcm.c b/sound/soc/mediatek/mt8173/mt8173-afe-pcm.c -index 06269f7e37566b..240b2f041a3f8b 100644 ---- a/sound/soc/mediatek/mt8173/mt8173-afe-pcm.c -+++ b/sound/soc/mediatek/mt8173/mt8173-afe-pcm.c -@@ -13,6 +13,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -1070,6 +1071,12 @@ static int mt8173_afe_pcm_dev_probe(struct platform_device *pdev) - - afe->dev = &pdev->dev; - -+ ret = of_reserved_mem_device_init(&pdev->dev); -+ if (ret) { -+ dev_info(&pdev->dev, "no reserved memory found, pre-allocating buffers instead\n"); -+ afe->preallocate_buffers = true; -+ } -+ - irq_id = platform_get_irq(pdev, 0); - if (irq_id <= 0) - return irq_id < 0 ? irq_id : -ENXIO; -diff --git a/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c b/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c -index 90422ed2bbcc27..cbee5a8764c37f 100644 ---- a/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c -+++ b/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c -@@ -10,6 +10,7 @@ - #include - #include - #include -+#include - #include - #include - -@@ -1106,6 +1107,12 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev) - afe->dev = &pdev->dev; - dev = afe->dev; - -+ ret = of_reserved_mem_device_init(dev); -+ if (ret) { -+ dev_info(dev, "no reserved memory found, pre-allocating buffers instead\n"); -+ afe->preallocate_buffers = true; -+ } -+ - /* initial audio related clock */ - ret = mt8183_init_clock(afe); - if (ret) { -diff --git a/sound/soc/mediatek/mt8186/mt8186-afe-pcm.c b/sound/soc/mediatek/mt8186/mt8186-afe-pcm.c -index b86159f70a33a2..9ee431304a431b 100644 ---- a/sound/soc/mediatek/mt8186/mt8186-afe-pcm.c -+++ b/sound/soc/mediatek/mt8186/mt8186-afe-pcm.c -@@ -10,6 +10,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -2835,6 +2836,12 @@ static int mt8186_afe_pcm_dev_probe(struct platform_device *pdev) - afe_priv = afe->platform_priv; - afe->dev = &pdev->dev; - -+ ret = of_reserved_mem_device_init(dev); -+ if (ret) { -+ dev_info(dev, "no reserved memory found, pre-allocating buffers instead\n"); -+ afe->preallocate_buffers = true; -+ } -+ - afe->base_addr = devm_platform_ioremap_resource(pdev, 0); - if (IS_ERR(afe->base_addr)) - return PTR_ERR(afe->base_addr); -diff --git a/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c b/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c -index d0520e7e1d79ae..364e43da0e2416 100644 ---- a/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c -+++ b/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -2196,6 +2197,12 @@ static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev) - afe->dev = &pdev->dev; - dev = afe->dev; - -+ ret = of_reserved_mem_device_init(dev); -+ if (ret) { -+ dev_info(dev, "no reserved memory found, pre-allocating buffers instead\n"); -+ afe->preallocate_buffers = true; -+ } -+ - /* init audio related clock */ - ret = mt8192_init_clock(afe); - if (ret) { -diff --git a/sound/soc/soc-dai.c b/sound/soc/soc-dai.c -index 507743c87e402d..5a0fa8d1f38b5c 100644 ---- a/sound/soc/soc-dai.c -+++ b/sound/soc/soc-dai.c -@@ -273,13 +273,15 @@ int snd_soc_dai_set_tdm_slot(struct snd_soc_dai *dai, - &rx_mask, - }; - -- if (dai->driver->ops && -- dai->driver->ops->xlate_tdm_slot_mask) -- ret = dai->driver->ops->xlate_tdm_slot_mask(slots, &tx_mask, &rx_mask); -- else -- ret = snd_soc_xlate_tdm_slot_mask(slots, &tx_mask, &rx_mask); -- if (ret) -- goto err; -+ if (slots) { -+ if (dai->driver->ops && -+ dai->driver->ops->xlate_tdm_slot_mask) -+ ret = dai->driver->ops->xlate_tdm_slot_mask(slots, &tx_mask, &rx_mask); -+ else -+ ret = snd_soc_xlate_tdm_slot_mask(slots, &tx_mask, &rx_mask); -+ if (ret) -+ goto err; -+ } - - for_each_pcm_streams(stream) - snd_soc_dai_tdm_mask_set(dai, stream, *tdm_mask[stream]); -diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c -index eff1355cc3df00..5be32c37bb8a09 100644 ---- a/sound/soc/soc-ops.c -+++ b/sound/soc/soc-ops.c -@@ -641,28 +641,32 @@ EXPORT_SYMBOL_GPL(snd_soc_get_volsw_range); - static int snd_soc_clip_to_platform_max(struct snd_kcontrol *kctl) - { - struct soc_mixer_control *mc = (struct soc_mixer_control *)kctl->private_value; -- struct snd_ctl_elem_value uctl; -+ struct snd_ctl_elem_value *uctl; - int ret; - - if (!mc->platform_max) - return 0; - -- ret = kctl->get(kctl, &uctl); -+ uctl = kzalloc(sizeof(*uctl), GFP_KERNEL); -+ if (!uctl) -+ return -ENOMEM; -+ -+ ret = kctl->get(kctl, uctl); - if (ret < 0) -- return ret; -+ goto out; - -- if (uctl.value.integer.value[0] > mc->platform_max) -- uctl.value.integer.value[0] = mc->platform_max; -+ if (uctl->value.integer.value[0] > mc->platform_max) -+ uctl->value.integer.value[0] = mc->platform_max; - - if (snd_soc_volsw_is_stereo(mc) && -- uctl.value.integer.value[1] > mc->platform_max) -- uctl.value.integer.value[1] = mc->platform_max; -+ uctl->value.integer.value[1] > mc->platform_max) -+ uctl->value.integer.value[1] = mc->platform_max; - -- ret = kctl->put(kctl, &uctl); -- if (ret < 0) -- return ret; -+ ret = kctl->put(kctl, uctl); - -- return 0; -+out: -+ kfree(uctl); -+ return ret; - } - - /** -diff --git a/sound/usb/mixer_scarlett2.c b/sound/usb/mixer_scarlett2.c -index 90480b9b9b0891..316f1abefd51db 100644 ---- a/sound/usb/mixer_scarlett2.c -+++ b/sound/usb/mixer_scarlett2.c -@@ -1279,6 +1279,8 @@ static int scarlett2_usb( - struct scarlett2_usb_packet *req, *resp = NULL; - size_t req_buf_size = struct_size(req, data, req_size); - size_t resp_buf_size = struct_size(resp, data, resp_size); -+ int retries = 0; -+ const int max_retries = 5; - int err; - - req = kmalloc(req_buf_size, GFP_KERNEL); -@@ -1302,10 +1304,15 @@ static int scarlett2_usb( - if (req_size) - memcpy(req->data, req_data, req_size); - -+retry: - err = scarlett2_usb_tx(dev, private->bInterfaceNumber, - req, req_buf_size); - - if (err != req_buf_size) { -+ if (err == -EPROTO && ++retries <= max_retries) { -+ msleep(5 * (1 << (retries - 1))); -+ goto retry; -+ } - usb_audio_err( - mixer->chip, - "%s USB request result cmd %x was %d\n", -diff --git a/sound/x86/intel_hdmi_audio.c b/sound/x86/intel_hdmi_audio.c -index ab95fb34a63584..7b9292cf839f27 100644 ---- a/sound/x86/intel_hdmi_audio.c -+++ b/sound/x86/intel_hdmi_audio.c -@@ -1766,7 +1766,7 @@ static int __hdmi_lpe_audio_probe(struct platform_device *pdev) - /* setup private data which can be retrieved when required */ - pcm->private_data = ctx; - pcm->info_flags = 0; -- strscpy(pcm->name, card->shortname, strlen(card->shortname)); -+ strscpy(pcm->name, card->shortname, sizeof(pcm->name)); - /* setup the ops for playback */ - snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK, &had_pcm_ops); - -diff --git a/tools/bpf/bpftool/net.c b/tools/bpf/bpftool/net.c -index 28e9417a5c2e35..c2ca82fc21e21a 100644 ---- a/tools/bpf/bpftool/net.c -+++ b/tools/bpf/bpftool/net.c -@@ -360,17 +360,18 @@ static int dump_link_nlmsg(void *cookie, void *msg, struct nlattr **tb) - { - struct bpf_netdev_t *netinfo = cookie; - struct ifinfomsg *ifinfo = msg; -+ struct ip_devname_ifindex *tmp; - - if (netinfo->filter_idx > 0 && netinfo->filter_idx != ifinfo->ifi_index) - return 0; - - if (netinfo->used_len == netinfo->array_len) { -- netinfo->devices = realloc(netinfo->devices, -- (netinfo->array_len + 16) * -- sizeof(struct ip_devname_ifindex)); -- if (!netinfo->devices) -+ tmp = realloc(netinfo->devices, -+ (netinfo->array_len + 16) * sizeof(struct ip_devname_ifindex)); -+ if (!tmp) - return -ENOMEM; - -+ netinfo->devices = tmp; - netinfo->array_len += 16; - } - netinfo->devices[netinfo->used_len].ifindex = ifinfo->ifi_index; -@@ -389,6 +390,7 @@ static int dump_class_qdisc_nlmsg(void *cookie, void *msg, struct nlattr **tb) - { - struct bpf_tcinfo_t *tcinfo = cookie; - struct tcmsg *info = msg; -+ struct tc_kind_handle *tmp; - - if (tcinfo->is_qdisc) { - /* skip clsact qdisc */ -@@ -400,11 +402,12 @@ static int dump_class_qdisc_nlmsg(void *cookie, void *msg, struct nlattr **tb) - } - - if (tcinfo->used_len == tcinfo->array_len) { -- tcinfo->handle_array = realloc(tcinfo->handle_array, -+ tmp = realloc(tcinfo->handle_array, - (tcinfo->array_len + 16) * sizeof(struct tc_kind_handle)); -- if (!tcinfo->handle_array) -+ if (!tmp) - return -ENOMEM; - -+ tcinfo->handle_array = tmp; - tcinfo->array_len += 16; - } - tcinfo->handle_array[tcinfo->used_len].handle = info->tcm_handle; -diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c -index 8561b0f01a2476..9ef569492560ef 100644 ---- a/tools/lib/subcmd/help.c -+++ b/tools/lib/subcmd/help.c -@@ -9,6 +9,7 @@ - #include - #include - #include -+#include - #include "subcmd-util.h" - #include "help.h" - #include "exec-cmd.h" -@@ -82,10 +83,11 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes) - ci++; - cj++; - } else { -- zfree(&cmds->names[cj]); -- cmds->names[cj++] = cmds->names[ci++]; -+ cmds->names[cj++] = cmds->names[ci]; -+ cmds->names[ci++] = NULL; - } - } else if (cmp == 0) { -+ zfree(&cmds->names[ci]); - ci++; - ei++; - } else if (cmp > 0) { -@@ -94,12 +96,12 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes) - } - if (ci != cj) { - while (ci < cmds->cnt) { -- zfree(&cmds->names[cj]); -- cmds->names[cj++] = cmds->names[ci++]; -+ cmds->names[cj++] = cmds->names[ci]; -+ cmds->names[ci++] = NULL; - } - } - for (ci = cj; ci < cmds->cnt; ci++) -- zfree(&cmds->names[ci]); -+ assert(cmds->names[ci] == NULL); - cmds->cnt = cj; - } - -diff --git a/tools/perf/.gitignore b/tools/perf/.gitignore -index f533e76fb48002..5a8617eb541957 100644 ---- a/tools/perf/.gitignore -+++ b/tools/perf/.gitignore -@@ -45,7 +45,5 @@ libbpf/ - libperf/ - libsubcmd/ - libsymbol/ --libtraceevent/ --libtraceevent_plugins/ - fixdep - Documentation/doc.dep -diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c -index ac9d94dbbeefae..16cb7278fabaf7 100644 ---- a/tools/perf/builtin-sched.c -+++ b/tools/perf/builtin-sched.c -@@ -1125,6 +1125,21 @@ add_sched_in_event(struct work_atoms *atoms, u64 timestamp) - atoms->nb_atoms++; - } - -+static void free_work_atoms(struct work_atoms *atoms) -+{ -+ struct work_atom *atom, *tmp; -+ -+ if (atoms == NULL) -+ return; -+ -+ list_for_each_entry_safe(atom, tmp, &atoms->work_list, list) { -+ list_del(&atom->list); -+ free(atom); -+ } -+ thread__zput(atoms->thread); -+ free(atoms); -+} -+ - static int latency_switch_event(struct perf_sched *sched, - struct evsel *evsel, - struct perf_sample *sample, -@@ -1949,6 +1964,16 @@ static u64 evsel__get_time(struct evsel *evsel, u32 cpu) - return r->last_time[cpu]; - } - -+static void timehist__evsel_priv_destructor(void *priv) -+{ -+ struct evsel_runtime *r = priv; -+ -+ if (r) { -+ free(r->last_time); -+ free(r); -+ } -+} -+ - static int comm_width = 30; - - static char *timehist_get_commstr(struct thread *thread) -@@ -3080,6 +3105,8 @@ static int perf_sched__timehist(struct perf_sched *sched) - - setup_pager(); - -+ evsel__set_priv_destructor(timehist__evsel_priv_destructor); -+ - /* prefer sched_waking if it is captured */ - if (evlist__find_tracepoint_by_name(session->evlist, "sched:sched_waking")) - handlers[1].handler = timehist_sched_wakeup_ignore; -@@ -3180,13 +3207,13 @@ static void __merge_work_atoms(struct rb_root_cached *root, struct work_atoms *d - this->total_runtime += data->total_runtime; - this->nb_atoms += data->nb_atoms; - this->total_lat += data->total_lat; -- list_splice(&data->work_list, &this->work_list); -+ list_splice_init(&data->work_list, &this->work_list); - if (this->max_lat < data->max_lat) { - this->max_lat = data->max_lat; - this->max_lat_start = data->max_lat_start; - this->max_lat_end = data->max_lat_end; - } -- zfree(&data); -+ free_work_atoms(data); - return; - } - } -@@ -3265,7 +3292,6 @@ static int perf_sched__lat(struct perf_sched *sched) - work_list = rb_entry(next, struct work_atoms, node); - output_lat_thread(sched, work_list); - next = rb_next(next); -- thread__zput(work_list->thread); - } - - printf(" -----------------------------------------------------------------------------------------------------------------\n"); -@@ -3279,6 +3305,13 @@ static int perf_sched__lat(struct perf_sched *sched) - - rc = 0; - -+ while ((next = rb_first_cached(&sched->sorted_atom_root))) { -+ struct work_atoms *data; -+ -+ data = rb_entry(next, struct work_atoms, node); -+ rb_erase_cached(next, &sched->sorted_atom_root); -+ free_work_atoms(data); -+ } - out_free_cpus_switch_event: - free_cpus_switch_event(sched); - return rc; -@@ -3678,6 +3711,8 @@ int cmd_sched(int argc, const char **argv) - if (!argc) - usage_with_options(sched_usage, sched_options); - -+ thread__set_priv_destructor(free); -+ - /* - * Aliased to 'perf script' for now: - */ -diff --git a/tools/perf/tests/bp_account.c b/tools/perf/tests/bp_account.c -index 6f921db33cf90e..855b81c3326c7c 100644 ---- a/tools/perf/tests/bp_account.c -+++ b/tools/perf/tests/bp_account.c -@@ -102,6 +102,7 @@ static int bp_accounting(int wp_cnt, int share) - fd_wp = wp_event((void *)&the_var, &attr_new); - TEST_ASSERT_VAL("failed to create max wp\n", fd_wp != -1); - pr_debug("wp max created\n"); -+ close(fd_wp); - } - - for (i = 0; i < wp_cnt; i++) -diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c -index 6d2b056232f6e1..2a6295f1ac1bc0 100644 ---- a/tools/perf/util/evsel.c -+++ b/tools/perf/util/evsel.c -@@ -1460,6 +1460,15 @@ static void evsel__free_config_terms(struct evsel *evsel) - free_config_terms(&evsel->config_terms); - } - -+static void (*evsel__priv_destructor)(void *priv); -+ -+void evsel__set_priv_destructor(void (*destructor)(void *priv)) -+{ -+ assert(evsel__priv_destructor == NULL); -+ -+ evsel__priv_destructor = destructor; -+} -+ - void evsel__exit(struct evsel *evsel) - { - assert(list_empty(&evsel->core.node)); -@@ -1485,6 +1494,8 @@ void evsel__exit(struct evsel *evsel) - hashmap__free(evsel->per_pkg_mask); - evsel->per_pkg_mask = NULL; - zfree(&evsel->metric_events); -+ if (evsel__priv_destructor) -+ evsel__priv_destructor(evsel->priv); - perf_evsel__object.fini(evsel); - } - -diff --git a/tools/perf/util/evsel.h b/tools/perf/util/evsel.h -index 848534ec74fa0a..ac396d6f95cb51 100644 ---- a/tools/perf/util/evsel.h -+++ b/tools/perf/util/evsel.h -@@ -252,6 +252,8 @@ void evsel__init(struct evsel *evsel, struct perf_event_attr *attr, int idx); - void evsel__exit(struct evsel *evsel); - void evsel__delete(struct evsel *evsel); - -+void evsel__set_priv_destructor(void (*destructor)(void *priv)); -+ - struct callchain_param; - - void evsel__config(struct evsel *evsel, struct record_opts *opts, -diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c -index ea24f21aafc3e3..4f0bbebcb6d62d 100644 ---- a/tools/perf/util/symbol.c -+++ b/tools/perf/util/symbol.c -@@ -1366,6 +1366,7 @@ static int dso__load_kcore(struct dso *dso, struct map *map, - goto out_err; - } - } -+ map__zput(new_node->map); - free(new_node); - } - -diff --git a/tools/testing/selftests/arm64/fp/sve-ptrace.c b/tools/testing/selftests/arm64/fp/sve-ptrace.c -index 6d61992fe8a01e..c6228176dd1a0c 100644 ---- a/tools/testing/selftests/arm64/fp/sve-ptrace.c -+++ b/tools/testing/selftests/arm64/fp/sve-ptrace.c -@@ -251,7 +251,7 @@ static void ptrace_set_get_vl(pid_t child, const struct vec_type *type, - return; - } - -- ksft_test_result(new_sve->vl = prctl_vl, "Set %s VL %u\n", -+ ksft_test_result(new_sve->vl == prctl_vl, "Set %s VL %u\n", - type->name, vl); - - free(new_sve); -diff --git a/tools/testing/selftests/bpf/prog_tests/sockmap_listen.c b/tools/testing/selftests/bpf/prog_tests/sockmap_listen.c -index 84d59419e4eb5b..a6d8aa8c2a9ac9 100644 ---- a/tools/testing/selftests/bpf/prog_tests/sockmap_listen.c -+++ b/tools/testing/selftests/bpf/prog_tests/sockmap_listen.c -@@ -894,6 +894,8 @@ static void redir_partial(int family, int sotype, int sock_map, int parser_map) - goto close; - - n = xsend(c1, buf, sizeof(buf), 0); -+ if (n == -1) -+ goto close; - if (n < sizeof(buf)) - FAIL("incomplete write"); - -diff --git a/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc b/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc -index b7c8f29c09a978..65916bb55dfbbf 100644 ---- a/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc -+++ b/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc -@@ -14,11 +14,35 @@ fail() { #msg - exit_fail - } - -+# As reading trace can last forever, simply look for 3 different -+# events then exit out of reading the file. If there's not 3 different -+# events, then the test has failed. -+check_unique() { -+ cat trace | grep -v '^#' | awk ' -+ BEGIN { cnt = 0; } -+ { -+ for (i = 0; i < cnt; i++) { -+ if (event[i] == $5) { -+ break; -+ } -+ } -+ if (i == cnt) { -+ event[cnt++] = $5; -+ if (cnt > 2) { -+ exit; -+ } -+ } -+ } -+ END { -+ printf "%d", cnt; -+ }' -+} -+ - echo 'sched:*' > set_event - - yield - --count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` -+count=`check_unique` - if [ $count -lt 3 ]; then - fail "at least fork, exec and exit events should be recorded" - fi -@@ -29,7 +53,7 @@ echo 1 > events/sched/enable - - yield - --count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` -+count=`check_unique` - if [ $count -lt 3 ]; then - fail "at least fork, exec and exit events should be recorded" - fi -diff --git a/tools/testing/selftests/net/rtnetlink.sh b/tools/testing/selftests/net/rtnetlink.sh -index 855505c40ed8eb..c9ba4d269c3828 100755 ---- a/tools/testing/selftests/net/rtnetlink.sh -+++ b/tools/testing/selftests/net/rtnetlink.sh -@@ -854,6 +854,11 @@ kci_test_ipsec_offload() - sysfsf=$sysfsd/ipsec - sysfsnet=/sys/bus/netdevsim/devices/netdevsim0/net/ - probed=false -+ esp4_offload_probed_default=false -+ -+ if lsmod | grep -q esp4_offload; then -+ esp4_offload_probed_default=true -+ fi - - # setup netdevsim since dummydev doesn't have offload support - if [ ! -w /sys/bus/netdevsim/new_device ] ; then -@@ -943,6 +948,7 @@ EOF - fi - - # clean up any leftovers -+ ! "$esp4_offload_probed_default" && lsmod | grep -q esp4_offload && rmmod esp4_offload - echo 0 > /sys/bus/netdevsim/del_device - $probed && rmmod netdevsim - -diff --git a/tools/testing/selftests/perf_events/.gitignore b/tools/testing/selftests/perf_events/.gitignore -index 790c47001e77e3..4858977dd55b5f 100644 ---- a/tools/testing/selftests/perf_events/.gitignore -+++ b/tools/testing/selftests/perf_events/.gitignore -@@ -1,3 +1,4 @@ - # SPDX-License-Identifier: GPL-2.0-only - sigtrap_threads - remove_on_exec -+mmap -diff --git a/tools/testing/selftests/perf_events/Makefile b/tools/testing/selftests/perf_events/Makefile -index db93c4ff081a45..913854914ae499 100644 ---- a/tools/testing/selftests/perf_events/Makefile -+++ b/tools/testing/selftests/perf_events/Makefile -@@ -2,5 +2,5 @@ - CFLAGS += -Wl,-no-as-needed -Wall $(KHDR_INCLUDES) - LDFLAGS += -lpthread - --TEST_GEN_PROGS := sigtrap_threads remove_on_exec -+TEST_GEN_PROGS := sigtrap_threads remove_on_exec mmap - include ../lib.mk -diff --git a/tools/testing/selftests/perf_events/mmap.c b/tools/testing/selftests/perf_events/mmap.c -new file mode 100644 -index 00000000000000..ea0427aac1f98f ---- /dev/null -+++ b/tools/testing/selftests/perf_events/mmap.c -@@ -0,0 +1,236 @@ -+// SPDX-License-Identifier: GPL-2.0-only -+#define _GNU_SOURCE -+ -+#include -+#include -+#include -+#include -+#include -+ -+#include -+#include -+#include -+#include -+ -+#include -+ -+#include "../kselftest_harness.h" -+ -+#define RB_SIZE 0x3000 -+#define AUX_SIZE 0x10000 -+#define AUX_OFFS 0x4000 -+ -+#define HOLE_SIZE 0x1000 -+ -+/* Reserve space for rb, aux with space for shrink-beyond-vma testing. */ -+#define REGION_SIZE (2 * RB_SIZE + 2 * AUX_SIZE) -+#define REGION_AUX_OFFS (2 * RB_SIZE) -+ -+#define MAP_BASE 1 -+#define MAP_AUX 2 -+ -+#define EVENT_SRC_DIR "/sys/bus/event_source/devices" -+ -+FIXTURE(perf_mmap) -+{ -+ int fd; -+ void *ptr; -+ void *region; -+}; -+ -+FIXTURE_VARIANT(perf_mmap) -+{ -+ bool aux; -+ unsigned long ptr_size; -+}; -+ -+FIXTURE_VARIANT_ADD(perf_mmap, rb) -+{ -+ .aux = false, -+ .ptr_size = RB_SIZE, -+}; -+ -+FIXTURE_VARIANT_ADD(perf_mmap, aux) -+{ -+ .aux = true, -+ .ptr_size = AUX_SIZE, -+}; -+ -+static bool read_event_type(struct dirent *dent, __u32 *type) -+{ -+ char typefn[512]; -+ FILE *fp; -+ int res; -+ -+ snprintf(typefn, sizeof(typefn), "%s/%s/type", EVENT_SRC_DIR, dent->d_name); -+ fp = fopen(typefn, "r"); -+ if (!fp) -+ return false; -+ -+ res = fscanf(fp, "%u", type); -+ fclose(fp); -+ return res > 0; -+} -+ -+FIXTURE_SETUP(perf_mmap) -+{ -+ struct perf_event_attr attr = { -+ .size = sizeof(attr), -+ .disabled = 1, -+ .exclude_kernel = 1, -+ .exclude_hv = 1, -+ }; -+ struct perf_event_attr attr_ok = {}; -+ unsigned int eacces = 0, map = 0; -+ struct perf_event_mmap_page *rb; -+ struct dirent *dent; -+ void *aux, *region; -+ DIR *dir; -+ -+ self->ptr = NULL; -+ -+ dir = opendir(EVENT_SRC_DIR); -+ if (!dir) -+ SKIP(return, "perf not available."); -+ -+ region = mmap(NULL, REGION_SIZE, PROT_NONE, MAP_ANON | MAP_PRIVATE, -1, 0); -+ ASSERT_NE(region, MAP_FAILED); -+ self->region = region; -+ -+ // Try to find a suitable event on this system -+ while ((dent = readdir(dir))) { -+ int fd; -+ -+ if (!read_event_type(dent, &attr.type)) -+ continue; -+ -+ fd = syscall(SYS_perf_event_open, &attr, 0, -1, -1, 0); -+ if (fd < 0) { -+ if (errno == EACCES) -+ eacces++; -+ continue; -+ } -+ -+ // Check whether the event supports mmap() -+ rb = mmap(region, RB_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_FIXED, fd, 0); -+ if (rb == MAP_FAILED) { -+ close(fd); -+ continue; -+ } -+ -+ if (!map) { -+ // Save the event in case that no AUX capable event is found -+ attr_ok = attr; -+ map = MAP_BASE; -+ } -+ -+ if (!variant->aux) -+ continue; -+ -+ rb->aux_offset = AUX_OFFS; -+ rb->aux_size = AUX_SIZE; -+ -+ // Check whether it supports a AUX buffer -+ aux = mmap(region + REGION_AUX_OFFS, AUX_SIZE, PROT_READ | PROT_WRITE, -+ MAP_SHARED | MAP_FIXED, fd, AUX_OFFS); -+ if (aux == MAP_FAILED) { -+ munmap(rb, RB_SIZE); -+ close(fd); -+ continue; -+ } -+ -+ attr_ok = attr; -+ map = MAP_AUX; -+ munmap(aux, AUX_SIZE); -+ munmap(rb, RB_SIZE); -+ close(fd); -+ break; -+ } -+ closedir(dir); -+ -+ if (!map) { -+ if (!eacces) -+ SKIP(return, "No mappable perf event found."); -+ else -+ SKIP(return, "No permissions for perf_event_open()"); -+ } -+ -+ self->fd = syscall(SYS_perf_event_open, &attr_ok, 0, -1, -1, 0); -+ ASSERT_NE(self->fd, -1); -+ -+ rb = mmap(region, RB_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_FIXED, self->fd, 0); -+ ASSERT_NE(rb, MAP_FAILED); -+ -+ if (!variant->aux) { -+ self->ptr = rb; -+ return; -+ } -+ -+ if (map != MAP_AUX) -+ SKIP(return, "No AUX event found."); -+ -+ rb->aux_offset = AUX_OFFS; -+ rb->aux_size = AUX_SIZE; -+ aux = mmap(region + REGION_AUX_OFFS, AUX_SIZE, PROT_READ | PROT_WRITE, -+ MAP_SHARED | MAP_FIXED, self->fd, AUX_OFFS); -+ ASSERT_NE(aux, MAP_FAILED); -+ self->ptr = aux; -+} -+ -+FIXTURE_TEARDOWN(perf_mmap) -+{ -+ ASSERT_EQ(munmap(self->region, REGION_SIZE), 0); -+ if (self->fd != -1) -+ ASSERT_EQ(close(self->fd), 0); -+} -+ -+TEST_F(perf_mmap, remap) -+{ -+ void *tmp, *ptr = self->ptr; -+ unsigned long size = variant->ptr_size; -+ -+ // Test the invalid remaps -+ ASSERT_EQ(mremap(ptr, size, HOLE_SIZE, MREMAP_MAYMOVE), MAP_FAILED); -+ ASSERT_EQ(mremap(ptr + HOLE_SIZE, size, HOLE_SIZE, MREMAP_MAYMOVE), MAP_FAILED); -+ ASSERT_EQ(mremap(ptr + size - HOLE_SIZE, HOLE_SIZE, size, MREMAP_MAYMOVE), MAP_FAILED); -+ // Shrink the end of the mapping such that we only unmap past end of the VMA, -+ // which should succeed and poke a hole into the PROT_NONE region -+ ASSERT_NE(mremap(ptr + size - HOLE_SIZE, size, HOLE_SIZE, MREMAP_MAYMOVE), MAP_FAILED); -+ -+ // Remap the whole buffer to a new address -+ tmp = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0); -+ ASSERT_NE(tmp, MAP_FAILED); -+ -+ // Try splitting offset 1 hole size into VMA, this should fail -+ ASSERT_EQ(mremap(ptr + HOLE_SIZE, size - HOLE_SIZE, size - HOLE_SIZE, -+ MREMAP_MAYMOVE | MREMAP_FIXED, tmp), MAP_FAILED); -+ // Remapping the whole thing should succeed fine -+ ptr = mremap(ptr, size, size, MREMAP_MAYMOVE | MREMAP_FIXED, tmp); -+ ASSERT_EQ(ptr, tmp); -+ ASSERT_EQ(munmap(tmp, size), 0); -+} -+ -+TEST_F(perf_mmap, unmap) -+{ -+ unsigned long size = variant->ptr_size; -+ -+ // Try to poke holes into the mappings -+ ASSERT_NE(munmap(self->ptr, HOLE_SIZE), 0); -+ ASSERT_NE(munmap(self->ptr + HOLE_SIZE, HOLE_SIZE), 0); -+ ASSERT_NE(munmap(self->ptr + size - HOLE_SIZE, HOLE_SIZE), 0); -+} -+ -+TEST_F(perf_mmap, map) -+{ -+ unsigned long size = variant->ptr_size; -+ -+ // Try to poke holes into the mappings by mapping anonymous memory over it -+ ASSERT_EQ(mmap(self->ptr, HOLE_SIZE, PROT_READ | PROT_WRITE, -+ MAP_PRIVATE | MAP_ANON | MAP_FIXED, -1, 0), MAP_FAILED); -+ ASSERT_EQ(mmap(self->ptr + HOLE_SIZE, HOLE_SIZE, PROT_READ | PROT_WRITE, -+ MAP_PRIVATE | MAP_ANON | MAP_FIXED, -1, 0), MAP_FAILED); -+ ASSERT_EQ(mmap(self->ptr + size - HOLE_SIZE, HOLE_SIZE, PROT_READ | PROT_WRITE, -+ MAP_PRIVATE | MAP_ANON | MAP_FIXED, -1, 0), MAP_FAILED); -+} -+ -+TEST_HARNESS_MAIN -diff --git a/tools/testing/selftests/syscall_user_dispatch/sud_test.c b/tools/testing/selftests/syscall_user_dispatch/sud_test.c -index d975a67673299f..48cf01aeec3e77 100644 ---- a/tools/testing/selftests/syscall_user_dispatch/sud_test.c -+++ b/tools/testing/selftests/syscall_user_dispatch/sud_test.c -@@ -79,6 +79,21 @@ TEST_SIGNAL(dispatch_trigger_sigsys, SIGSYS) - } - } - -+static void prctl_valid(struct __test_metadata *_metadata, -+ unsigned long op, unsigned long off, -+ unsigned long size, void *sel) -+{ -+ EXPECT_EQ(0, prctl(PR_SET_SYSCALL_USER_DISPATCH, op, off, size, sel)); -+} -+ -+static void prctl_invalid(struct __test_metadata *_metadata, -+ unsigned long op, unsigned long off, -+ unsigned long size, void *sel, int err) -+{ -+ EXPECT_EQ(-1, prctl(PR_SET_SYSCALL_USER_DISPATCH, op, off, size, sel)); -+ EXPECT_EQ(err, errno); -+} -+ - TEST(bad_prctl_param) - { - char sel = SYSCALL_DISPATCH_FILTER_ALLOW; -@@ -86,57 +101,42 @@ TEST(bad_prctl_param) - - /* Invalid op */ - op = -1; -- prctl(PR_SET_SYSCALL_USER_DISPATCH, op, 0, 0, &sel); -- ASSERT_EQ(EINVAL, errno); -+ prctl_invalid(_metadata, op, 0, 0, &sel, EINVAL); - - /* PR_SYS_DISPATCH_OFF */ - op = PR_SYS_DISPATCH_OFF; - - /* offset != 0 */ -- prctl(PR_SET_SYSCALL_USER_DISPATCH, op, 0x1, 0x0, 0); -- EXPECT_EQ(EINVAL, errno); -+ prctl_invalid(_metadata, op, 0x1, 0x0, 0, EINVAL); - - /* len != 0 */ -- prctl(PR_SET_SYSCALL_USER_DISPATCH, op, 0x0, 0xff, 0); -- EXPECT_EQ(EINVAL, errno); -+ prctl_invalid(_metadata, op, 0x0, 0xff, 0, EINVAL); - - /* sel != NULL */ -- prctl(PR_SET_SYSCALL_USER_DISPATCH, op, 0x0, 0x0, &sel); -- EXPECT_EQ(EINVAL, errno); -+ prctl_invalid(_metadata, op, 0x0, 0x0, &sel, EINVAL); - - /* Valid parameter */ -- errno = 0; -- prctl(PR_SET_SYSCALL_USER_DISPATCH, op, 0x0, 0x0, 0x0); -- EXPECT_EQ(0, errno); -+ prctl_valid(_metadata, op, 0x0, 0x0, 0x0); - - /* PR_SYS_DISPATCH_ON */ - op = PR_SYS_DISPATCH_ON; - - /* Dispatcher region is bad (offset > 0 && len == 0) */ -- prctl(PR_SET_SYSCALL_USER_DISPATCH, op, 0x1, 0x0, &sel); -- EXPECT_EQ(EINVAL, errno); -- prctl(PR_SET_SYSCALL_USER_DISPATCH, op, -1L, 0x0, &sel); -- EXPECT_EQ(EINVAL, errno); -+ prctl_invalid(_metadata, op, 0x1, 0x0, &sel, EINVAL); -+ prctl_invalid(_metadata, op, -1L, 0x0, &sel, EINVAL); - - /* Invalid selector */ -- prctl(PR_SET_SYSCALL_USER_DISPATCH, op, 0x0, 0x1, (void *) -1); -- ASSERT_EQ(EFAULT, errno); -+ prctl_invalid(_metadata, op, 0x0, 0x1, (void *) -1, EFAULT); - - /* - * Dispatcher range overflows unsigned long - */ -- prctl(PR_SET_SYSCALL_USER_DISPATCH, PR_SYS_DISPATCH_ON, 1, -1L, &sel); -- ASSERT_EQ(EINVAL, errno) { -- TH_LOG("Should reject bad syscall range"); -- } -+ prctl_invalid(_metadata, PR_SYS_DISPATCH_ON, 1, -1L, &sel, EINVAL); - - /* - * Allowed range overflows usigned long - */ -- prctl(PR_SET_SYSCALL_USER_DISPATCH, PR_SYS_DISPATCH_ON, -1L, 0x1, &sel); -- ASSERT_EQ(EINVAL, errno) { -- TH_LOG("Should reject bad syscall range"); -- } -+ prctl_invalid(_metadata, PR_SYS_DISPATCH_ON, -1L, 0x1, &sel, EINVAL); - } - - /* -diff --git a/tools/verification/rv/src/in_kernel.c b/tools/verification/rv/src/in_kernel.c -index f04479ecc96c0b..ced72950cb1eed 100644 ---- a/tools/verification/rv/src/in_kernel.c -+++ b/tools/verification/rv/src/in_kernel.c -@@ -353,7 +353,7 @@ ikm_event_handler(struct trace_seq *s, struct tep_record *record, - - if (config_has_id && (config_my_pid == id)) - return 0; -- else if (config_my_pid && (config_my_pid == pid)) -+ else if (config_my_pid == pid) - return 0; - - tep_print_event(trace_event->tep, s, record, "%16s-%-8d ", TEP_PRINT_COMM, TEP_PRINT_PID); -@@ -595,7 +595,7 @@ static int parse_arguments(char *monitor_name, int argc, char **argv) - config_reactor = optarg; - break; - case 's': -- config_my_pid = 0; -+ config_my_pid = -1; - break; - case 't': - config_trace = 1; diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.102-103.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.102-103.patch deleted file mode 100644 index a8cafa9509..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.102-103.patch +++ /dev/null @@ -1,22717 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/display/sprd/sprd,sharkl3-dpu.yaml b/Documentation/devicetree/bindings/display/sprd/sprd,sharkl3-dpu.yaml -index 4ebea60b8c5ba5..8c52fa0ea5f8ee 100644 ---- a/Documentation/devicetree/bindings/display/sprd/sprd,sharkl3-dpu.yaml -+++ b/Documentation/devicetree/bindings/display/sprd/sprd,sharkl3-dpu.yaml -@@ -25,7 +25,7 @@ properties: - maxItems: 1 - - clocks: -- minItems: 2 -+ maxItems: 2 - - clock-names: - items: -diff --git a/Documentation/devicetree/bindings/display/sprd/sprd,sharkl3-dsi-host.yaml b/Documentation/devicetree/bindings/display/sprd/sprd,sharkl3-dsi-host.yaml -index bc5594d1864301..300bf2252c3e8e 100644 ---- a/Documentation/devicetree/bindings/display/sprd/sprd,sharkl3-dsi-host.yaml -+++ b/Documentation/devicetree/bindings/display/sprd/sprd,sharkl3-dsi-host.yaml -@@ -20,7 +20,7 @@ properties: - maxItems: 2 - - clocks: -- minItems: 1 -+ maxItems: 1 - - clock-names: - items: -diff --git a/Documentation/filesystems/fscrypt.rst b/Documentation/filesystems/fscrypt.rst -index a624e92f2687f0..6ba11dfb4bf360 100644 ---- a/Documentation/filesystems/fscrypt.rst -+++ b/Documentation/filesystems/fscrypt.rst -@@ -141,9 +141,8 @@ However, these ioctls have some limitations: - CONFIG_PAGE_POISONING=y in your kernel config and add page_poison=1 - to your kernel command line. However, this has a performance cost. - --- Secret keys might still exist in CPU registers, in crypto -- accelerator hardware (if used by the crypto API to implement any of -- the algorithms), or in other places not explicitly considered here. -+- Secret keys might still exist in CPU registers or in other places -+ not explicitly considered here. - - Limitations of v1 policies - ~~~~~~~~~~~~~~~~~~~~~~~~~~ -@@ -375,9 +374,12 @@ the work is done by XChaCha12, which is much faster than AES when AES - acceleration is unavailable. For more information about Adiantum, see - `the Adiantum paper `_. - --The (AES-128-CBC-ESSIV, AES-128-CTS-CBC) pair exists only to support --systems whose only form of AES acceleration is an off-CPU crypto --accelerator such as CAAM or CESA that does not support XTS. -+The (AES-128-CBC-ESSIV, AES-128-CTS-CBC) pair was added to try to -+provide a more efficient option for systems that lack AES instructions -+in the CPU but do have a non-inline crypto engine such as CAAM or CESA -+that supports AES-CBC (and not AES-XTS). This is deprecated. It has -+been shown that just doing AES on the CPU is actually faster. -+Moreover, Adiantum is faster still and is recommended on such systems. - - The remaining mode pairs are the "national pride ciphers": - -@@ -1231,22 +1233,13 @@ this by validating all top-level encryption policies prior to access. - Inline encryption support - ========================= - --By default, fscrypt uses the kernel crypto API for all cryptographic --operations (other than HKDF, which fscrypt partially implements --itself). The kernel crypto API supports hardware crypto accelerators, --but only ones that work in the traditional way where all inputs and --outputs (e.g. plaintexts and ciphertexts) are in memory. fscrypt can --take advantage of such hardware, but the traditional acceleration --model isn't particularly efficient and fscrypt hasn't been optimized --for it. -- --Instead, many newer systems (especially mobile SoCs) have *inline --encryption hardware* that can encrypt/decrypt data while it is on its --way to/from the storage device. Linux supports inline encryption --through a set of extensions to the block layer called *blk-crypto*. --blk-crypto allows filesystems to attach encryption contexts to bios --(I/O requests) to specify how the data will be encrypted or decrypted --in-line. For more information about blk-crypto, see -+Many newer systems (especially mobile SoCs) have *inline encryption -+hardware* that can encrypt/decrypt data while it is on its way to/from -+the storage device. Linux supports inline encryption through a set of -+extensions to the block layer called *blk-crypto*. blk-crypto allows -+filesystems to attach encryption contexts to bios (I/O requests) to -+specify how the data will be encrypted or decrypted in-line. For more -+information about blk-crypto, see - :ref:`Documentation/block/inline-encryption.rst `. - - On supported filesystems (currently ext4 and f2fs), fscrypt can use -diff --git a/Documentation/firmware-guide/acpi/i2c-muxes.rst b/Documentation/firmware-guide/acpi/i2c-muxes.rst -index 3a8997ccd7c4b6..f366539acd792a 100644 ---- a/Documentation/firmware-guide/acpi/i2c-muxes.rst -+++ b/Documentation/firmware-guide/acpi/i2c-muxes.rst -@@ -14,7 +14,7 @@ Consider this topology:: - | | | 0x70 |--CH01--> i2c client B (0x50) - +------+ +------+ - --which corresponds to the following ASL:: -+which corresponds to the following ASL (in the scope of \_SB):: - - Device (SMB1) - { -@@ -24,7 +24,7 @@ which corresponds to the following ASL:: - Name (_HID, ...) - Name (_CRS, ResourceTemplate () { - I2cSerialBus (0x70, ControllerInitiated, I2C_SPEED, -- AddressingMode7Bit, "^SMB1", 0x00, -+ AddressingMode7Bit, "\\_SB.SMB1", 0x00, - ResourceConsumer,,) - } - -@@ -37,7 +37,7 @@ which corresponds to the following ASL:: - Name (_HID, ...) - Name (_CRS, ResourceTemplate () { - I2cSerialBus (0x50, ControllerInitiated, I2C_SPEED, -- AddressingMode7Bit, "^CH00", 0x00, -+ AddressingMode7Bit, "\\_SB.SMB1.CH00", 0x00, - ResourceConsumer,,) - } - } -@@ -52,7 +52,7 @@ which corresponds to the following ASL:: - Name (_HID, ...) - Name (_CRS, ResourceTemplate () { - I2cSerialBus (0x50, ControllerInitiated, I2C_SPEED, -- AddressingMode7Bit, "^CH01", 0x00, -+ AddressingMode7Bit, "\\_SB.SMB1.CH01", 0x00, - ResourceConsumer,,) - } - } -diff --git a/Documentation/networking/bonding.rst b/Documentation/networking/bonding.rst -index f7a73421eb76a1..e774b48de9f511 100644 ---- a/Documentation/networking/bonding.rst -+++ b/Documentation/networking/bonding.rst -@@ -444,6 +444,18 @@ arp_missed_max - - The default value is 2, and the allowable range is 1 - 255. - -+coupled_control -+ -+ Specifies whether the LACP state machine's MUX in the 802.3ad mode -+ should have separate Collecting and Distributing states. -+ -+ This is by implementing the independent control state machine per -+ IEEE 802.1AX-2008 5.4.15 in addition to the existing coupled control -+ state machine. -+ -+ The default value is 1. This setting does not separate the Collecting -+ and Distributing states, maintaining the bond in coupled control. -+ - downdelay - - Specifies the time, in milliseconds, to wait before disabling -diff --git a/Documentation/networking/mptcp-sysctl.rst b/Documentation/networking/mptcp-sysctl.rst -index 15f1919d640c09..b797f3dd4b6922 100644 ---- a/Documentation/networking/mptcp-sysctl.rst -+++ b/Documentation/networking/mptcp-sysctl.rst -@@ -20,6 +20,8 @@ add_addr_timeout - INTEGER (seconds) - resent to an MPTCP peer that has not acknowledged a previous - ADD_ADDR message. - -+ Do not retransmit if set to 0. -+ - The default value matches TCP_RTO_MAX. This is a per-namespace - sysctl. - -diff --git a/Documentation/power/runtime_pm.rst b/Documentation/power/runtime_pm.rst -index b6d5a3a8febc10..f6a7cffdc12921 100644 ---- a/Documentation/power/runtime_pm.rst -+++ b/Documentation/power/runtime_pm.rst -@@ -398,10 +398,9 @@ drivers/base/power/runtime.c and include/linux/pm_runtime.h: - nonzero, increment the counter and return 1; otherwise return 0 without - changing the counter - -- `int pm_runtime_get_if_active(struct device *dev, bool ign_usage_count);` -+ `int pm_runtime_get_if_active(struct device *dev);` - - return -EINVAL if 'power.disable_depth' is nonzero; otherwise, if the -- runtime PM status is RPM_ACTIVE, and either ign_usage_count is true -- or the device's usage_count is non-zero, increment the counter and -+ runtime PM status is RPM_ACTIVE, increment the counter and - return 1; otherwise return 0 without changing the counter - - `void pm_runtime_put_noidle(struct device *dev);` -diff --git a/Makefile b/Makefile -index 685a65992449d1..9b288ccccd6495 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 102 -+SUBLEVEL = 103 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -@@ -1061,7 +1061,7 @@ KBUILD_USERCFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CPPFLAGS) $(KBUILD - KBUILD_USERLDFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS)) - - # userspace programs are linked via the compiler, use the correct linker --ifeq ($(CONFIG_CC_IS_CLANG)$(CONFIG_LD_IS_LLD),yy) -+ifdef CONFIG_CC_IS_CLANG - KBUILD_USERLDFLAGS += $(call cc-option, --ld-path=$(LD)) - endif - -diff --git a/arch/arm/include/asm/topology.h b/arch/arm/include/asm/topology.h -index c7d2510e5a786f..853c4f81ba4a57 100644 ---- a/arch/arm/include/asm/topology.h -+++ b/arch/arm/include/asm/topology.h -@@ -13,6 +13,7 @@ - #define arch_set_freq_scale topology_set_freq_scale - #define arch_scale_freq_capacity topology_get_freq_scale - #define arch_scale_freq_invariant topology_scale_freq_invariant -+#define arch_scale_freq_ref topology_get_freq_ref - #endif - - /* Replace task scheduler's default cpu-invariant accounting */ -diff --git a/arch/arm/mach-rockchip/platsmp.c b/arch/arm/mach-rockchip/platsmp.c -index 36915a073c2340..f432d22bfed844 100644 ---- a/arch/arm/mach-rockchip/platsmp.c -+++ b/arch/arm/mach-rockchip/platsmp.c -@@ -279,11 +279,6 @@ static void __init rockchip_smp_prepare_cpus(unsigned int max_cpus) - } - - if (read_cpuid_part() == ARM_CPU_PART_CORTEX_A9) { -- if (rockchip_smp_prepare_sram(node)) { -- of_node_put(node); -- return; -- } -- - /* enable the SCU power domain */ - pmu_set_power_domain(PMU_PWRDN_SCU, true); - -@@ -316,11 +311,19 @@ static void __init rockchip_smp_prepare_cpus(unsigned int max_cpus) - asm ("mrc p15, 1, %0, c9, c0, 2\n" : "=r" (l2ctlr)); - ncores = ((l2ctlr >> 24) & 0x3) + 1; - } -- of_node_put(node); - - /* Make sure that all cores except the first are really off */ - for (i = 1; i < ncores; i++) - pmu_set_power_domain(0 + i, false); -+ -+ if (read_cpuid_part() == ARM_CPU_PART_CORTEX_A9) { -+ if (rockchip_smp_prepare_sram(node)) { -+ of_node_put(node); -+ return; -+ } -+ } -+ -+ of_node_put(node); - } - - static void __init rk3036_smp_prepare_cpus(unsigned int max_cpus) -diff --git a/arch/arm/mach-tegra/reset.c b/arch/arm/mach-tegra/reset.c -index d5c805adf7a82b..ea706fac63587a 100644 ---- a/arch/arm/mach-tegra/reset.c -+++ b/arch/arm/mach-tegra/reset.c -@@ -63,7 +63,7 @@ static void __init tegra_cpu_reset_handler_enable(void) - BUG_ON(is_enabled); - BUG_ON(tegra_cpu_reset_handler_size > TEGRA_IRAM_RESET_HANDLER_SIZE); - -- memcpy(iram_base, (void *)__tegra_cpu_reset_handler_start, -+ memcpy_toio(iram_base, (void *)__tegra_cpu_reset_handler_start, - tegra_cpu_reset_handler_size); - - err = call_firmware_op(set_cpu_boot_addr, 0, reset_address); -diff --git a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi -index f156167b4e8a71..3f74767d63ab71 100644 ---- a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi -+++ b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi -@@ -531,7 +531,6 @@ sdhci0: mmc@fa10000 { - clock-names = "clk_ahb", "clk_xin"; - assigned-clocks = <&k3_clks 57 6>; - assigned-clock-parents = <&k3_clks 57 8>; -- mmc-ddr-1_8v; - mmc-hs200-1_8v; - ti,trm-icp = <0x2>; - bus-width = <8>; -diff --git a/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi b/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi -index e931c966b7f22b..e98d043e574600 100644 ---- a/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi -+++ b/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi -@@ -448,16 +448,16 @@ AM62X_IOPAD(0x01ec, PIN_INPUT_PULLUP, 0) /* (A17) I2C1_SDA */ /* SODIMM 12 */ - /* Verdin I2C_2_DSI */ - pinctrl_i2c2: main-i2c2-default-pins { - pinctrl-single,pins = < -- AM62X_IOPAD(0x00b0, PIN_INPUT, 1) /* (K22) GPMC0_CSn2.I2C2_SCL */ /* SODIMM 55 */ -- AM62X_IOPAD(0x00b4, PIN_INPUT, 1) /* (K24) GPMC0_CSn3.I2C2_SDA */ /* SODIMM 53 */ -+ AM62X_IOPAD(0x00b0, PIN_INPUT_PULLUP, 1) /* (K22) GPMC0_CSn2.I2C2_SCL */ /* SODIMM 55 */ -+ AM62X_IOPAD(0x00b4, PIN_INPUT_PULLUP, 1) /* (K24) GPMC0_CSn3.I2C2_SDA */ /* SODIMM 53 */ - >; - }; - - /* Verdin I2C_4_CSI */ - pinctrl_i2c3: main-i2c3-default-pins { - pinctrl-single,pins = < -- AM62X_IOPAD(0x01d0, PIN_INPUT, 2) /* (A15) UART0_CTSn.I2C3_SCL */ /* SODIMM 95 */ -- AM62X_IOPAD(0x01d4, PIN_INPUT, 2) /* (B15) UART0_RTSn.I2C3_SDA */ /* SODIMM 93 */ -+ AM62X_IOPAD(0x01d0, PIN_INPUT_PULLUP, 2) /* (A15) UART0_CTSn.I2C3_SCL */ /* SODIMM 95 */ -+ AM62X_IOPAD(0x01d4, PIN_INPUT_PULLUP, 2) /* (B15) UART0_RTSn.I2C3_SDA */ /* SODIMM 93 */ - >; - }; - -@@ -729,8 +729,8 @@ AM62X_MCU_IOPAD(0x0010, PIN_INPUT, 7) /* (C9) MCU_SPI0_D1.MCU_GPIO0_4 */ /* SODI - /* Verdin I2C_3_HDMI */ - pinctrl_mcu_i2c0: mcu-i2c0-default-pins { - pinctrl-single,pins = < -- AM62X_MCU_IOPAD(0x0044, PIN_INPUT, 0) /* (A8) MCU_I2C0_SCL */ /* SODIMM 59 */ -- AM62X_MCU_IOPAD(0x0048, PIN_INPUT, 0) /* (D10) MCU_I2C0_SDA */ /* SODIMM 57 */ -+ AM62X_MCU_IOPAD(0x0044, PIN_INPUT_PULLUP, 0) /* (A8) MCU_I2C0_SCL */ /* SODIMM 59 */ -+ AM62X_MCU_IOPAD(0x0048, PIN_INPUT_PULLUP, 0) /* (D10) MCU_I2C0_SDA */ /* SODIMM 57 */ - >; - }; - -diff --git a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts -index 99f2878de4c677..12cbf253a8910b 100644 ---- a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts -+++ b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts -@@ -144,8 +144,8 @@ AM62AX_IOPAD(0x1cc, PIN_OUTPUT, 0) /* (D15) UART0_TXD */ - - main_uart1_pins_default: main-uart1-default-pins { - pinctrl-single,pins = < -- AM62AX_IOPAD(0x01e8, PIN_INPUT, 1) /* (C17) I2C1_SCL.UART1_RXD */ -- AM62AX_IOPAD(0x01ec, PIN_OUTPUT, 1) /* (E17) I2C1_SDA.UART1_TXD */ -+ AM62AX_IOPAD(0x01ac, PIN_INPUT, 2) /* (B21) MCASP0_AFSR.UART1_RXD */ -+ AM62AX_IOPAD(0x01b0, PIN_OUTPUT, 2) /* (A21) MCASP0_ACLKR.UART1_TXD */ - AM62AX_IOPAD(0x0194, PIN_INPUT, 2) /* (C19) MCASP0_AXR3.UART1_CTSn */ - AM62AX_IOPAD(0x0198, PIN_OUTPUT, 2) /* (B19) MCASP0_AXR2.UART1_RTSn */ - >; -diff --git a/arch/arm64/boot/dts/ti/k3-pinctrl.h b/arch/arm64/boot/dts/ti/k3-pinctrl.h -index 2a4e0e084d695d..8e0869d9b7a0e5 100644 ---- a/arch/arm64/boot/dts/ti/k3-pinctrl.h -+++ b/arch/arm64/boot/dts/ti/k3-pinctrl.h -@@ -8,11 +8,16 @@ - #ifndef DTS_ARM64_TI_K3_PINCTRL_H - #define DTS_ARM64_TI_K3_PINCTRL_H - -+#define ST_EN_SHIFT (14) - #define PULLUDEN_SHIFT (16) - #define PULLTYPESEL_SHIFT (17) - #define RXACTIVE_SHIFT (18) - #define DEBOUNCE_SHIFT (11) - -+/* Schmitt trigger configuration */ -+#define ST_DISABLE (0 << ST_EN_SHIFT) -+#define ST_ENABLE (1 << ST_EN_SHIFT) -+ - #define PULL_DISABLE (1 << PULLUDEN_SHIFT) - #define PULL_ENABLE (0 << PULLUDEN_SHIFT) - -@@ -26,9 +31,13 @@ - #define PIN_OUTPUT (INPUT_DISABLE | PULL_DISABLE) - #define PIN_OUTPUT_PULLUP (INPUT_DISABLE | PULL_UP) - #define PIN_OUTPUT_PULLDOWN (INPUT_DISABLE | PULL_DOWN) --#define PIN_INPUT (INPUT_EN | PULL_DISABLE) --#define PIN_INPUT_PULLUP (INPUT_EN | PULL_UP) --#define PIN_INPUT_PULLDOWN (INPUT_EN | PULL_DOWN) -+#define PIN_INPUT (INPUT_EN | ST_ENABLE | PULL_DISABLE) -+#define PIN_INPUT_PULLUP (INPUT_EN | ST_ENABLE | PULL_UP) -+#define PIN_INPUT_PULLDOWN (INPUT_EN | ST_ENABLE | PULL_DOWN) -+/* Input configurations with Schmitt Trigger disabled */ -+#define PIN_INPUT_NOST (INPUT_EN | PULL_DISABLE) -+#define PIN_INPUT_PULLUP_NOST (INPUT_EN | PULL_UP) -+#define PIN_INPUT_PULLDOWN_NOST (INPUT_EN | PULL_DOWN) - - #define PIN_DEBOUNCE_DISABLE (0 << DEBOUNCE_SHIFT) - #define PIN_DEBOUNCE_CONF1 (1 << DEBOUNCE_SHIFT) -diff --git a/arch/arm64/include/asm/acpi.h b/arch/arm64/include/asm/acpi.h -index a407f9cd549edc..c07a58b96329d8 100644 ---- a/arch/arm64/include/asm/acpi.h -+++ b/arch/arm64/include/asm/acpi.h -@@ -150,7 +150,7 @@ acpi_set_mailbox_entry(int cpu, struct acpi_madt_generic_interrupt *processor) - {} - #endif - --static inline const char *acpi_get_enable_method(int cpu) -+static __always_inline const char *acpi_get_enable_method(int cpu) - { - if (acpi_psci_present()) - return "psci"; -diff --git a/arch/arm64/include/asm/topology.h b/arch/arm64/include/asm/topology.h -index 9fab663dd2de96..a323b109b9c44b 100644 ---- a/arch/arm64/include/asm/topology.h -+++ b/arch/arm64/include/asm/topology.h -@@ -23,6 +23,7 @@ void update_freq_counters_refs(void); - #define arch_set_freq_scale topology_set_freq_scale - #define arch_scale_freq_capacity topology_get_freq_scale - #define arch_scale_freq_invariant topology_scale_freq_invariant -+#define arch_scale_freq_ref topology_get_freq_ref - - #ifdef CONFIG_ACPI_CPPC_LIB - #define arch_init_invariance_cppc topology_init_cpu_capacity_cppc -diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c -index a1e0cc5353fb12..d0d836448a76b2 100644 ---- a/arch/arm64/kernel/fpsimd.c -+++ b/arch/arm64/kernel/fpsimd.c -@@ -1876,10 +1876,10 @@ void fpsimd_save_and_flush_cpu_state(void) - if (!system_supports_fpsimd()) - return; - WARN_ON(preemptible()); -- __get_cpu_fpsimd_context(); -+ get_cpu_fpsimd_context(); - fpsimd_save(); - fpsimd_flush_cpu_state(); -- __put_cpu_fpsimd_context(); -+ put_cpu_fpsimd_context(); - } - - #ifdef CONFIG_KERNEL_MODE_NEON -diff --git a/arch/arm64/kernel/topology.c b/arch/arm64/kernel/topology.c -index 817d788cd86669..1a2c72f3e7f80e 100644 ---- a/arch/arm64/kernel/topology.c -+++ b/arch/arm64/kernel/topology.c -@@ -82,7 +82,12 @@ int __init parse_acpi_topology(void) - #undef pr_fmt - #define pr_fmt(fmt) "AMU: " fmt - --static DEFINE_PER_CPU_READ_MOSTLY(unsigned long, arch_max_freq_scale); -+/* -+ * Ensure that amu_scale_freq_tick() will return SCHED_CAPACITY_SCALE until -+ * the CPU capacity and its associated frequency have been correctly -+ * initialized. -+ */ -+static DEFINE_PER_CPU_READ_MOSTLY(unsigned long, arch_max_freq_scale) = 1UL << (2 * SCHED_CAPACITY_SHIFT); - static DEFINE_PER_CPU(u64, arch_const_cycles_prev); - static DEFINE_PER_CPU(u64, arch_core_cycles_prev); - static cpumask_var_t amu_fie_cpus; -@@ -112,14 +117,14 @@ static inline bool freq_counters_valid(int cpu) - return true; - } - --static int freq_inv_set_max_ratio(int cpu, u64 max_rate, u64 ref_rate) -+void freq_inv_set_max_ratio(int cpu, u64 max_rate) - { -- u64 ratio; -+ u64 ratio, ref_rate = arch_timer_get_rate(); - - if (unlikely(!max_rate || !ref_rate)) { -- pr_debug("CPU%d: invalid maximum or reference frequency.\n", -+ WARN_ONCE(1, "CPU%d: invalid maximum or reference frequency.\n", - cpu); -- return -EINVAL; -+ return; - } - - /* -@@ -139,12 +144,10 @@ static int freq_inv_set_max_ratio(int cpu, u64 max_rate, u64 ref_rate) - ratio = div64_u64(ratio, max_rate); - if (!ratio) { - WARN_ONCE(1, "Reference frequency too low.\n"); -- return -EINVAL; -+ return; - } - -- per_cpu(arch_max_freq_scale, cpu) = (unsigned long)ratio; -- -- return 0; -+ WRITE_ONCE(per_cpu(arch_max_freq_scale, cpu), (unsigned long)ratio); - } - - static void amu_scale_freq_tick(void) -@@ -195,10 +198,7 @@ static void amu_fie_setup(const struct cpumask *cpus) - return; - - for_each_cpu(cpu, cpus) { -- if (!freq_counters_valid(cpu) || -- freq_inv_set_max_ratio(cpu, -- cpufreq_get_hw_max_freq(cpu) * 1000ULL, -- arch_timer_get_rate())) -+ if (!freq_counters_valid(cpu)) - return; - } - -diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c -index 8b70759cdbb90c..610f8a1099f50b 100644 ---- a/arch/arm64/kernel/traps.c -+++ b/arch/arm64/kernel/traps.c -@@ -953,6 +953,7 @@ void __noreturn panic_bad_stack(struct pt_regs *regs, unsigned long esr, unsigne - - void __noreturn arm64_serror_panic(struct pt_regs *regs, unsigned long esr) - { -+ add_taint(TAINT_MACHINE_CHECK, LOCKDEP_STILL_OK); - console_verbose(); - - pr_crit("SError Interrupt on CPU%d, code 0x%016lx -- %s\n", -diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c -index 2e5d1e238af958..893b9485b840a4 100644 ---- a/arch/arm64/mm/fault.c -+++ b/arch/arm64/mm/fault.c -@@ -753,6 +753,7 @@ static int do_sea(unsigned long far, unsigned long esr, struct pt_regs *regs) - */ - siaddr = untagged_addr(far); - } -+ add_taint(TAINT_MACHINE_CHECK, LOCKDEP_STILL_OK); - arm64_notify_die(inf->name, regs, inf->sig, inf->code, siaddr, esr); - - return 0; -diff --git a/arch/arm64/mm/ptdump_debugfs.c b/arch/arm64/mm/ptdump_debugfs.c -index 68bf1a125502da..1e308328c07966 100644 ---- a/arch/arm64/mm/ptdump_debugfs.c -+++ b/arch/arm64/mm/ptdump_debugfs.c -@@ -1,6 +1,5 @@ - // SPDX-License-Identifier: GPL-2.0 - #include --#include - #include - - #include -@@ -9,9 +8,7 @@ static int ptdump_show(struct seq_file *m, void *v) - { - struct ptdump_info *info = m->private; - -- get_online_mems(); - ptdump_walk(m, info); -- put_online_mems(); - return 0; - } - DEFINE_SHOW_ATTRIBUTE(ptdump); -diff --git a/arch/loongarch/kernel/module-sections.c b/arch/loongarch/kernel/module-sections.c -index e2f30ff9afde82..a43ba7f9f9872a 100644 ---- a/arch/loongarch/kernel/module-sections.c -+++ b/arch/loongarch/kernel/module-sections.c -@@ -8,6 +8,7 @@ - #include - #include - #include -+#include - - Elf_Addr module_emit_got_entry(struct module *mod, Elf_Shdr *sechdrs, Elf_Addr val) - { -@@ -61,39 +62,38 @@ Elf_Addr module_emit_plt_entry(struct module *mod, Elf_Shdr *sechdrs, Elf_Addr v - return (Elf_Addr)&plt[nr]; - } - --static int is_rela_equal(const Elf_Rela *x, const Elf_Rela *y) --{ -- return x->r_info == y->r_info && x->r_addend == y->r_addend; --} -+#define cmp_3way(a, b) ((a) < (b) ? -1 : (a) > (b)) - --static bool duplicate_rela(const Elf_Rela *rela, int idx) -+static int compare_rela(const void *x, const void *y) - { -- int i; -+ int ret; -+ const Elf_Rela *rela_x = x, *rela_y = y; - -- for (i = 0; i < idx; i++) { -- if (is_rela_equal(&rela[i], &rela[idx])) -- return true; -- } -+ ret = cmp_3way(rela_x->r_info, rela_y->r_info); -+ if (ret == 0) -+ ret = cmp_3way(rela_x->r_addend, rela_y->r_addend); - -- return false; -+ return ret; - } - - static void count_max_entries(Elf_Rela *relas, int num, - unsigned int *plts, unsigned int *gots) - { -- unsigned int i, type; -+ unsigned int i; -+ -+ sort(relas, num, sizeof(Elf_Rela), compare_rela, NULL); - - for (i = 0; i < num; i++) { -- type = ELF_R_TYPE(relas[i].r_info); -- switch (type) { -+ if (i && !compare_rela(&relas[i-1], &relas[i])) -+ continue; -+ -+ switch (ELF_R_TYPE(relas[i].r_info)) { - case R_LARCH_SOP_PUSH_PLT_PCREL: - case R_LARCH_B26: -- if (!duplicate_rela(relas, i)) -- (*plts)++; -+ (*plts)++; - break; - case R_LARCH_GOT_PC_HI20: -- if (!duplicate_rela(relas, i)) -- (*gots)++; -+ (*gots)++; - break; - default: - break; /* Do nothing. */ -diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c -index dcb1428b458c8f..869003f1c7036e 100644 ---- a/arch/loongarch/net/bpf_jit.c -+++ b/arch/loongarch/net/bpf_jit.c -@@ -203,11 +203,9 @@ bool bpf_jit_supports_kfunc_call(void) - return true; - } - --/* initialized on the first pass of build_body() */ --static int out_offset = -1; --static int emit_bpf_tail_call(struct jit_ctx *ctx) -+static int emit_bpf_tail_call(struct jit_ctx *ctx, int insn) - { -- int off; -+ int off, tc_ninsn = 0; - u8 tcc = tail_call_reg(ctx); - u8 a1 = LOONGARCH_GPR_A1; - u8 a2 = LOONGARCH_GPR_A2; -@@ -217,7 +215,7 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx) - const int idx0 = ctx->idx; - - #define cur_offset (ctx->idx - idx0) --#define jmp_offset (out_offset - (cur_offset)) -+#define jmp_offset (tc_ninsn - (cur_offset)) - - /* - * a0: &ctx -@@ -227,6 +225,7 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx) - * if (index >= array->map.max_entries) - * goto out; - */ -+ tc_ninsn = insn ? ctx->offset[insn+1] - ctx->offset[insn] : ctx->offset[0]; - off = offsetof(struct bpf_array, map.max_entries); - emit_insn(ctx, ldwu, t1, a1, off); - /* bgeu $a2, $t1, jmp_offset */ -@@ -258,15 +257,6 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx) - emit_insn(ctx, ldd, t3, t2, off); - __build_epilogue(ctx, true); - -- /* out: */ -- if (out_offset == -1) -- out_offset = cur_offset; -- if (cur_offset != out_offset) { -- pr_err_once("tail_call out_offset = %d, expected %d!\n", -- cur_offset, out_offset); -- return -1; -- } -- - return 0; - - toofar: -@@ -853,7 +843,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext - /* tail call */ - case BPF_JMP | BPF_TAIL_CALL: - mark_tail_call(ctx); -- if (emit_bpf_tail_call(ctx) < 0) -+ if (emit_bpf_tail_call(ctx, i) < 0) - return -EINVAL; - break; - -@@ -1251,7 +1241,6 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) - if (tmp_blinded) - bpf_jit_prog_release_other(prog, prog == orig_prog ? tmp : orig_prog); - -- out_offset = -1; - - return prog; - } -diff --git a/arch/m68k/kernel/head.S b/arch/m68k/kernel/head.S -index 397114962a1427..10f6aa4d8f0571 100644 ---- a/arch/m68k/kernel/head.S -+++ b/arch/m68k/kernel/head.S -@@ -3404,6 +3404,7 @@ L(console_clear_loop): - - movel %d4,%d1 /* screen height in pixels */ - divul %a0@(FONT_DESC_HEIGHT),%d1 /* d1 = max num rows */ -+ subql #1,%d1 /* row range is 0 to num - 1 */ - - movel %d0,%a2@(Lconsole_struct_num_columns) - movel %d1,%a2@(Lconsole_struct_num_rows) -@@ -3550,15 +3551,14 @@ func_start console_putc,%a0/%a1/%d0-%d7 - cmpib #10,%d7 - jne L(console_not_lf) - movel %a0@(Lconsole_struct_cur_row),%d0 -- addil #1,%d0 -- movel %d0,%a0@(Lconsole_struct_cur_row) - movel %a0@(Lconsole_struct_num_rows),%d1 - cmpl %d1,%d0 - jcs 1f -- subil #1,%d0 -- movel %d0,%a0@(Lconsole_struct_cur_row) - console_scroll -+ jra L(console_exit) - 1: -+ addql #1,%d0 -+ movel %d0,%a0@(Lconsole_struct_cur_row) - jra L(console_exit) - - L(console_not_lf): -@@ -3585,12 +3585,6 @@ L(console_not_cr): - */ - L(console_not_home): - movel %a0@(Lconsole_struct_cur_column),%d0 -- addql #1,%a0@(Lconsole_struct_cur_column) -- movel %a0@(Lconsole_struct_num_columns),%d1 -- cmpl %d1,%d0 -- jcs 1f -- console_putc #'\n' /* recursion is OK! */ --1: - movel %a0@(Lconsole_struct_cur_row),%d1 - - /* -@@ -3637,6 +3631,23 @@ L(console_do_font_scanline): - addq #1,%d1 - dbra %d7,L(console_read_char_scanline) - -+ /* -+ * Register usage in the code below: -+ * a0 = pointer to console globals -+ * d0 = cursor column -+ * d1 = cursor column limit -+ */ -+ -+ lea %pc@(L(console_globals)),%a0 -+ -+ movel %a0@(Lconsole_struct_cur_column),%d0 -+ addql #1,%d0 -+ movel %d0,%a0@(Lconsole_struct_cur_column) /* Update cursor pos */ -+ movel %a0@(Lconsole_struct_num_columns),%d1 -+ cmpl %d1,%d0 -+ jcs L(console_exit) -+ console_putc #'\n' /* Line wrap using tail recursion */ -+ - L(console_exit): - func_return console_putc - -diff --git a/arch/mips/crypto/chacha-core.S b/arch/mips/crypto/chacha-core.S -index 5755f69cfe0074..706aeb850fb0d6 100644 ---- a/arch/mips/crypto/chacha-core.S -+++ b/arch/mips/crypto/chacha-core.S -@@ -55,17 +55,13 @@ - #if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__ - #define MSB 0 - #define LSB 3 --#define ROTx rotl --#define ROTR(n) rotr n, 24 - #define CPU_TO_LE32(n) \ -- wsbh n; \ -+ wsbh n, n; \ - rotr n, 16; - #else - #define MSB 3 - #define LSB 0 --#define ROTx rotr - #define CPU_TO_LE32(n) --#define ROTR(n) - #endif - - #define FOR_EACH_WORD(x) \ -@@ -192,10 +188,10 @@ CONCAT3(.Lchacha_mips_xor_aligned_, PLUS_ONE(x), _b: ;) \ - xor X(W), X(B); \ - xor X(Y), X(C); \ - xor X(Z), X(D); \ -- rotl X(V), S; \ -- rotl X(W), S; \ -- rotl X(Y), S; \ -- rotl X(Z), S; -+ rotr X(V), 32 - S; \ -+ rotr X(W), 32 - S; \ -+ rotr X(Y), 32 - S; \ -+ rotr X(Z), 32 - S; - - .text - .set reorder -@@ -372,21 +368,19 @@ chacha_crypt_arch: - /* First byte */ - lbu T1, 0(IN) - addiu $at, BYTES, 1 -- CPU_TO_LE32(SAVED_X) -- ROTR(SAVED_X) - xor T1, SAVED_X - sb T1, 0(OUT) - beqz $at, .Lchacha_mips_xor_done - /* Second byte */ - lbu T1, 1(IN) - addiu $at, BYTES, 2 -- ROTx SAVED_X, 8 -+ rotr SAVED_X, 8 - xor T1, SAVED_X - sb T1, 1(OUT) - beqz $at, .Lchacha_mips_xor_done - /* Third byte */ - lbu T1, 2(IN) -- ROTx SAVED_X, 8 -+ rotr SAVED_X, 8 - xor T1, SAVED_X - sb T1, 2(OUT) - b .Lchacha_mips_xor_done -diff --git a/arch/mips/include/asm/vpe.h b/arch/mips/include/asm/vpe.h -index 61fd4d0aeda41f..c0769dc4b85321 100644 ---- a/arch/mips/include/asm/vpe.h -+++ b/arch/mips/include/asm/vpe.h -@@ -119,4 +119,12 @@ void cleanup_tc(struct tc *tc); - - int __init vpe_module_init(void); - void __exit vpe_module_exit(void); -+ -+#ifdef CONFIG_MIPS_VPE_LOADER_MT -+void *vpe_alloc(void); -+int vpe_start(void *vpe, unsigned long start); -+int vpe_stop(void *vpe); -+int vpe_free(void *vpe); -+#endif /* CONFIG_MIPS_VPE_LOADER_MT */ -+ - #endif /* _ASM_VPE_H */ -diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c -index b630604c577f9f..02aa6a04a21da4 100644 ---- a/arch/mips/kernel/process.c -+++ b/arch/mips/kernel/process.c -@@ -690,18 +690,20 @@ unsigned long mips_stack_top(void) - } - - /* Space for the VDSO, data page & GIC user page */ -- top -= PAGE_ALIGN(current->thread.abi->vdso->size); -- top -= PAGE_SIZE; -- top -= mips_gic_present() ? PAGE_SIZE : 0; -+ if (current->thread.abi) { -+ top -= PAGE_ALIGN(current->thread.abi->vdso->size); -+ top -= PAGE_SIZE; -+ top -= mips_gic_present() ? PAGE_SIZE : 0; -+ -+ /* Space to randomize the VDSO base */ -+ if (current->flags & PF_RANDOMIZE) -+ top -= VDSO_RANDOMIZE_SIZE; -+ } - - /* Space for cache colour alignment */ - if (cpu_has_dc_aliases) - top -= shm_align_mask + 1; - -- /* Space to randomize the VDSO base */ -- if (current->flags & PF_RANDOMIZE) -- top -= VDSO_RANDOMIZE_SIZE; -- - return top; - } - -diff --git a/arch/mips/lantiq/falcon/sysctrl.c b/arch/mips/lantiq/falcon/sysctrl.c -index 1187729d8cbb1b..357543996ee661 100644 ---- a/arch/mips/lantiq/falcon/sysctrl.c -+++ b/arch/mips/lantiq/falcon/sysctrl.c -@@ -214,19 +214,16 @@ void __init ltq_soc_init(void) - of_node_put(np_syseth); - of_node_put(np_sysgpe); - -- if ((request_mem_region(res_status.start, resource_size(&res_status), -- res_status.name) < 0) || -- (request_mem_region(res_ebu.start, resource_size(&res_ebu), -- res_ebu.name) < 0) || -- (request_mem_region(res_sys[0].start, -- resource_size(&res_sys[0]), -- res_sys[0].name) < 0) || -- (request_mem_region(res_sys[1].start, -- resource_size(&res_sys[1]), -- res_sys[1].name) < 0) || -- (request_mem_region(res_sys[2].start, -- resource_size(&res_sys[2]), -- res_sys[2].name) < 0)) -+ if ((!request_mem_region(res_status.start, resource_size(&res_status), -+ res_status.name)) || -+ (!request_mem_region(res_ebu.start, resource_size(&res_ebu), -+ res_ebu.name)) || -+ (!request_mem_region(res_sys[0].start, resource_size(&res_sys[0]), -+ res_sys[0].name)) || -+ (!request_mem_region(res_sys[1].start, resource_size(&res_sys[1]), -+ res_sys[1].name)) || -+ (!request_mem_region(res_sys[2].start, resource_size(&res_sys[2]), -+ res_sys[2].name))) - pr_err("Failed to request core resources"); - - status_membase = ioremap(res_status.start, -diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile -index 920db57b6b4cc8..5f0a1f1b00a78b 100644 ---- a/arch/parisc/Makefile -+++ b/arch/parisc/Makefile -@@ -39,7 +39,9 @@ endif - - export LD_BFD - --# Set default 32 bits cross compilers for vdso -+# Set default 32 bits cross compilers for vdso. -+# This means that for 64BIT, both the 64-bit tools and the 32-bit tools -+# need to be in the path. - CC_ARCHES_32 = hppa hppa2.0 hppa1.1 - CC_SUFFIXES = linux linux-gnu unknown-linux-gnu suse-linux - CROSS32_COMPILE := $(call cc-cross-prefix, \ -@@ -139,7 +141,7 @@ palo lifimage: vmlinuz - fi - @if test ! -f "$(PALOCONF)"; then \ - cp $(srctree)/arch/parisc/defpalo.conf $(objtree)/palo.conf; \ -- echo 'A generic palo config file ($(objree)/palo.conf) has been created for you.'; \ -+ echo 'A generic palo config file ($(objtree)/palo.conf) has been created for you.'; \ - echo 'You should check it and re-run "make palo".'; \ - echo 'WARNING: the "lifimage" file is now placed in this directory by default!'; \ - false; \ -diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h -index babf65751e8180..3446a5e2520b22 100644 ---- a/arch/parisc/include/asm/pgtable.h -+++ b/arch/parisc/include/asm/pgtable.h -@@ -276,7 +276,7 @@ extern unsigned long *empty_zero_page; - #define pte_none(x) (pte_val(x) == 0) - #define pte_present(x) (pte_val(x) & _PAGE_PRESENT) - #define pte_user(x) (pte_val(x) & _PAGE_USER) --#define pte_clear(mm, addr, xp) set_pte(xp, __pte(0)) -+#define pte_clear(mm, addr, xp) set_pte_at((mm), (addr), (xp), __pte(0)) - - #define pmd_flag(x) (pmd_val(x) & PxD_FLAG_MASK) - #define pmd_address(x) ((unsigned long)(pmd_val(x) &~ PxD_FLAG_MASK) << PxD_VALUE_SHIFT) -@@ -398,6 +398,7 @@ static inline void set_ptes(struct mm_struct *mm, unsigned long addr, - } - } - #define set_ptes set_ptes -+#define set_pte_at(mm, addr, ptep, pte) set_ptes(mm, addr, ptep, pte, 1) - - /* Used for deferring calls to flush_dcache_page() */ - -@@ -462,7 +463,7 @@ static inline int ptep_test_and_clear_young(struct vm_area_struct *vma, unsigned - if (!pte_young(pte)) { - return 0; - } -- set_pte(ptep, pte_mkold(pte)); -+ set_pte_at(vma->vm_mm, addr, ptep, pte_mkold(pte)); - return 1; - } - -@@ -472,7 +473,7 @@ pte_t ptep_clear_flush(struct vm_area_struct *vma, unsigned long addr, pte_t *pt - struct mm_struct; - static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr, pte_t *ptep) - { -- set_pte(ptep, pte_wrprotect(*ptep)); -+ set_pte_at(mm, addr, ptep, pte_wrprotect(*ptep)); - } - - #define pte_same(A,B) (pte_val(A) == pte_val(B)) -diff --git a/arch/parisc/include/asm/special_insns.h b/arch/parisc/include/asm/special_insns.h -index 51f40eaf778065..1013eeba31e5bb 100644 ---- a/arch/parisc/include/asm/special_insns.h -+++ b/arch/parisc/include/asm/special_insns.h -@@ -32,6 +32,34 @@ - pa; \ - }) - -+/** -+ * prober_user() - Probe user read access -+ * @sr: Space regster. -+ * @va: Virtual address. -+ * -+ * Return: Non-zero if address is accessible. -+ * -+ * Due to the way _PAGE_READ is handled in TLB entries, we need -+ * a special check to determine whether a user address is accessible. -+ * The ldb instruction does the initial access check. If it is -+ * successful, the probe instruction checks user access rights. -+ */ -+#define prober_user(sr, va) ({ \ -+ unsigned long read_allowed; \ -+ __asm__ __volatile__( \ -+ "copy %%r0,%0\n" \ -+ "8:\tldb 0(%%sr%1,%2),%%r0\n" \ -+ "\tproberi (%%sr%1,%2),%3,%0\n" \ -+ "9:\n" \ -+ ASM_EXCEPTIONTABLE_ENTRY(8b, 9b, \ -+ "or %%r0,%%r0,%%r0") \ -+ : "=&r" (read_allowed) \ -+ : "i" (sr), "r" (va), "i" (PRIV_USER) \ -+ : "memory" \ -+ ); \ -+ read_allowed; \ -+}) -+ - #define CR_EIEM 15 /* External Interrupt Enable Mask */ - #define CR_CR16 16 /* CR16 Interval Timer */ - #define CR_EIRR 23 /* External Interrupt Request Register */ -diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h -index 88d0ae5769dde5..6c531d2c847eb1 100644 ---- a/arch/parisc/include/asm/uaccess.h -+++ b/arch/parisc/include/asm/uaccess.h -@@ -42,9 +42,24 @@ - __gu_err; \ - }) - --#define __get_user(val, ptr) \ --({ \ -- __get_user_internal(SR_USER, val, ptr); \ -+#define __probe_user_internal(sr, error, ptr) \ -+({ \ -+ __asm__("\tproberi (%%sr%1,%2),%3,%0\n" \ -+ "\tcmpiclr,= 1,%0,%0\n" \ -+ "\tldi %4,%0\n" \ -+ : "=r"(error) \ -+ : "i"(sr), "r"(ptr), "i"(PRIV_USER), \ -+ "i"(-EFAULT)); \ -+}) -+ -+#define __get_user(val, ptr) \ -+({ \ -+ register long __gu_err; \ -+ \ -+ __gu_err = __get_user_internal(SR_USER, val, ptr); \ -+ if (likely(!__gu_err)) \ -+ __probe_user_internal(SR_USER, __gu_err, ptr); \ -+ __gu_err; \ - }) - - #define __get_user_asm(sr, val, ldx, ptr) \ -diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c -index f7953b0391cf60..1898956a70f25c 100644 ---- a/arch/parisc/kernel/cache.c -+++ b/arch/parisc/kernel/cache.c -@@ -425,7 +425,7 @@ static inline pte_t *get_ptep(struct mm_struct *mm, unsigned long addr) - return ptep; - } - --static inline bool pte_needs_flush(pte_t pte) -+static inline bool pte_needs_cache_flush(pte_t pte) - { - return (pte_val(pte) & (_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_NO_CACHE)) - == (_PAGE_PRESENT | _PAGE_ACCESSED); -@@ -630,7 +630,7 @@ static void flush_cache_page_if_present(struct vm_area_struct *vma, - ptep = get_ptep(vma->vm_mm, vmaddr); - if (ptep) { - pte = ptep_get(ptep); -- needs_flush = pte_needs_flush(pte); -+ needs_flush = pte_needs_cache_flush(pte); - pte_unmap(ptep); - } - if (needs_flush) -@@ -841,7 +841,7 @@ void flush_cache_vmap(unsigned long start, unsigned long end) - } - - vm = find_vm_area((void *)start); -- if (WARN_ON_ONCE(!vm)) { -+ if (!vm) { - flush_cache_all(); - return; - } -diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S -index ea57bcc21dc5fe..f4bf61a34701e5 100644 ---- a/arch/parisc/kernel/entry.S -+++ b/arch/parisc/kernel/entry.S -@@ -499,6 +499,12 @@ - * this happens is quite subtle, read below */ - .macro make_insert_tlb spc,pte,prot,tmp - space_to_prot \spc \prot /* create prot id from space */ -+ -+#if _PAGE_SPECIAL_BIT == _PAGE_DMB_BIT -+ /* need to drop DMB bit, as it's used as SPECIAL flag */ -+ depi 0,_PAGE_SPECIAL_BIT,1,\pte -+#endif -+ - /* The following is the real subtlety. This is depositing - * T <-> _PAGE_REFTRAP - * D <-> _PAGE_DIRTY -@@ -511,17 +517,18 @@ - * Finally, _PAGE_READ goes in the top bit of PL1 (so we - * trigger an access rights trap in user space if the user - * tries to read an unreadable page */ --#if _PAGE_SPECIAL_BIT == _PAGE_DMB_BIT -- /* need to drop DMB bit, as it's used as SPECIAL flag */ -- depi 0,_PAGE_SPECIAL_BIT,1,\pte --#endif - depd \pte,8,7,\prot - - /* PAGE_USER indicates the page can be read with user privileges, - * so deposit X1|11 to PL1|PL2 (remember the upper bit of PL1 -- * contains _PAGE_READ) */ -+ * contains _PAGE_READ). While the kernel can't directly write -+ * user pages which have _PAGE_WRITE zero, it can read pages -+ * which have _PAGE_READ zero (PL <= PL1). Thus, the kernel -+ * exception fault handler doesn't trigger when reading pages -+ * that aren't user read accessible */ - extrd,u,*= \pte,_PAGE_USER_BIT+32,1,%r0 - depdi 7,11,3,\prot -+ - /* If we're a gateway page, drop PL2 back to zero for promotion - * to kernel privilege (so we can execute the page as kernel). - * Any privilege promotion page always denys read and write */ -diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S -index 0fa81bf1466b15..f58c4bccfbce0e 100644 ---- a/arch/parisc/kernel/syscall.S -+++ b/arch/parisc/kernel/syscall.S -@@ -613,6 +613,9 @@ lws_compare_and_swap32: - lws_compare_and_swap: - /* Trigger memory reference interruptions without writing to memory */ - 1: ldw 0(%r26), %r28 -+ proberi (%r26), PRIV_USER, %r28 -+ comb,=,n %r28, %r0, lws_fault /* backwards, likely not taken */ -+ nop - 2: stbys,e %r0, 0(%r26) - - /* Calculate 8-bit hash index from virtual address */ -@@ -767,6 +770,9 @@ cas2_lock_start: - copy %r26, %r28 - depi_safe 0, 31, 2, %r28 - 10: ldw 0(%r28), %r1 -+ proberi (%r28), PRIV_USER, %r1 -+ comb,=,n %r1, %r0, lws_fault /* backwards, likely not taken */ -+ nop - 11: stbys,e %r0, 0(%r28) - - /* Calculate 8-bit hash index from virtual address */ -@@ -951,41 +957,47 @@ atomic_xchg_begin: - - /* 8-bit exchange */ - 1: ldb 0(%r24), %r20 -+ proberi (%r24), PRIV_USER, %r20 -+ comb,=,n %r20, %r0, lws_fault /* backwards, likely not taken */ -+ nop - copy %r23, %r20 - depi_safe 0, 31, 2, %r20 - b atomic_xchg_start - 2: stbys,e %r0, 0(%r20) -- nop -- nop -- nop - - /* 16-bit exchange */ - 3: ldh 0(%r24), %r20 -+ proberi (%r24), PRIV_USER, %r20 -+ comb,=,n %r20, %r0, lws_fault /* backwards, likely not taken */ -+ nop - copy %r23, %r20 - depi_safe 0, 31, 2, %r20 - b atomic_xchg_start - 4: stbys,e %r0, 0(%r20) -- nop -- nop -- nop - - /* 32-bit exchange */ - 5: ldw 0(%r24), %r20 -+ proberi (%r24), PRIV_USER, %r20 -+ comb,=,n %r20, %r0, lws_fault /* backwards, likely not taken */ -+ nop - b atomic_xchg_start - 6: stbys,e %r0, 0(%r23) - nop - nop -- nop -- nop -- nop - - /* 64-bit exchange */ - #ifdef CONFIG_64BIT - 7: ldd 0(%r24), %r20 -+ proberi (%r24), PRIV_USER, %r20 -+ comb,=,n %r20, %r0, lws_fault /* backwards, likely not taken */ -+ nop - 8: stdby,e %r0, 0(%r23) - #else - 7: ldw 0(%r24), %r20 - 8: ldw 4(%r24), %r20 -+ proberi (%r24), PRIV_USER, %r20 -+ comb,=,n %r20, %r0, lws_fault /* backwards, likely not taken */ -+ nop - copy %r23, %r20 - depi_safe 0, 31, 2, %r20 - 9: stbys,e %r0, 0(%r20) -diff --git a/arch/parisc/lib/memcpy.c b/arch/parisc/lib/memcpy.c -index 5fc0c852c84c8d..69d65ffab31263 100644 ---- a/arch/parisc/lib/memcpy.c -+++ b/arch/parisc/lib/memcpy.c -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include - - #define get_user_space() mfsp(SR_USER) - #define get_kernel_space() SR_KERNEL -@@ -32,9 +33,25 @@ EXPORT_SYMBOL(raw_copy_to_user); - unsigned long raw_copy_from_user(void *dst, const void __user *src, - unsigned long len) - { -+ unsigned long start = (unsigned long) src; -+ unsigned long end = start + len; -+ unsigned long newlen = len; -+ - mtsp(get_user_space(), SR_TEMP1); - mtsp(get_kernel_space(), SR_TEMP2); -- return pa_memcpy(dst, (void __force *)src, len); -+ -+ /* Check region is user accessible */ -+ if (start) -+ while (start < end) { -+ if (!prober_user(SR_TEMP1, start)) { -+ newlen = (start - (unsigned long) src); -+ break; -+ } -+ start += PAGE_SIZE; -+ /* align to page boundry which may have different permission */ -+ start = PAGE_ALIGN_DOWN(start); -+ } -+ return len - newlen + pa_memcpy(dst, (void __force *)src, newlen); - } - EXPORT_SYMBOL(raw_copy_from_user); - -diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c -index c39de84e98b051..f1785640b049b5 100644 ---- a/arch/parisc/mm/fault.c -+++ b/arch/parisc/mm/fault.c -@@ -363,6 +363,10 @@ void do_page_fault(struct pt_regs *regs, unsigned long code, - mmap_read_unlock(mm); - - bad_area_nosemaphore: -+ if (!user_mode(regs) && fixup_exception(regs)) { -+ return; -+ } -+ - if (user_mode(regs)) { - int signo, si_code; - -diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile -index 968aee2025b819..99c39c9b2a71f6 100644 ---- a/arch/powerpc/boot/Makefile -+++ b/arch/powerpc/boot/Makefile -@@ -72,6 +72,7 @@ BOOTCPPFLAGS := -nostdinc $(LINUXINCLUDE) - BOOTCPPFLAGS += -isystem $(shell $(BOOTCC) -print-file-name=include) - - BOOTCFLAGS := $(BOOTTARGETFLAGS) \ -+ -std=gnu11 \ - -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \ - -fno-strict-aliasing -O2 \ - -msoft-float -mno-altivec -mno-vsx \ -diff --git a/arch/powerpc/include/asm/floppy.h b/arch/powerpc/include/asm/floppy.h -index f8ce178b43b783..34abf8bea2ccd6 100644 ---- a/arch/powerpc/include/asm/floppy.h -+++ b/arch/powerpc/include/asm/floppy.h -@@ -144,9 +144,12 @@ static int hard_dma_setup(char *addr, unsigned long size, int mode, int io) - bus_addr = 0; - } - -- if (!bus_addr) /* need to map it */ -+ if (!bus_addr) { /* need to map it */ - bus_addr = dma_map_single(&isa_bridge_pcidev->dev, addr, size, - dir); -+ if (dma_mapping_error(&isa_bridge_pcidev->dev, bus_addr)) -+ return -ENOMEM; -+ } - - /* remember this one as prev */ - prev_addr = addr; -diff --git a/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c b/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c -index 4a25b6b4861582..f1e353fc6594e9 100644 ---- a/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c -+++ b/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c -@@ -240,10 +240,8 @@ static int mpc512x_lpbfifo_kick(void) - dma_conf.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; - - /* Make DMA channel work with LPB FIFO data register */ -- if (dma_dev->device_config(lpbfifo.chan, &dma_conf)) { -- ret = -EINVAL; -- goto err_dma_prep; -- } -+ if (dma_dev->device_config(lpbfifo.chan, &dma_conf)) -+ return -EINVAL; - - sg_init_table(&sg, 1); - -diff --git a/arch/riscv/include/asm/topology.h b/arch/riscv/include/asm/topology.h -index e316ab3b77f341..61183688bdd54e 100644 ---- a/arch/riscv/include/asm/topology.h -+++ b/arch/riscv/include/asm/topology.h -@@ -9,6 +9,7 @@ - #define arch_set_freq_scale topology_set_freq_scale - #define arch_scale_freq_capacity topology_get_freq_scale - #define arch_scale_freq_invariant topology_scale_freq_invariant -+#define arch_scale_freq_ref topology_get_freq_ref - - /* Replace task scheduler's default cpu-invariant accounting */ - #define arch_scale_cpu_capacity topology_get_cpu_scale -diff --git a/arch/s390/hypfs/hypfs_dbfs.c b/arch/s390/hypfs/hypfs_dbfs.c -index 4024599eb448ea..3612af9b4890b5 100644 ---- a/arch/s390/hypfs/hypfs_dbfs.c -+++ b/arch/s390/hypfs/hypfs_dbfs.c -@@ -6,6 +6,7 @@ - * Author(s): Michael Holzheu - */ - -+#include - #include - #include "hypfs.h" - -@@ -64,24 +65,28 @@ static long dbfs_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - long rc; - - mutex_lock(&df->lock); -- if (df->unlocked_ioctl) -- rc = df->unlocked_ioctl(file, cmd, arg); -- else -- rc = -ENOTTY; -+ rc = df->unlocked_ioctl(file, cmd, arg); - mutex_unlock(&df->lock); - return rc; - } - --static const struct file_operations dbfs_ops = { -+static const struct file_operations dbfs_ops_ioctl = { - .read = dbfs_read, - .llseek = no_llseek, - .unlocked_ioctl = dbfs_ioctl, - }; - -+static const struct file_operations dbfs_ops = { -+ .read = dbfs_read, -+}; -+ - void hypfs_dbfs_create_file(struct hypfs_dbfs_file *df) - { -- df->dentry = debugfs_create_file(df->name, 0400, dbfs_dir, df, -- &dbfs_ops); -+ const struct file_operations *fops = &dbfs_ops; -+ -+ if (df->unlocked_ioctl && !security_locked_down(LOCKDOWN_DEBUGFS)) -+ fops = &dbfs_ops_ioctl; -+ df->dentry = debugfs_create_file(df->name, 0400, dbfs_dir, df, fops); - mutex_init(&df->lock); - } - -diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h -index 4d646659a5f582..f7a44af12c2f4c 100644 ---- a/arch/s390/include/asm/timex.h -+++ b/arch/s390/include/asm/timex.h -@@ -192,13 +192,6 @@ static inline unsigned long get_tod_clock_fast(void) - asm volatile("stckf %0" : "=Q" (clk) : : "cc"); - return clk; - } -- --static inline cycles_t get_cycles(void) --{ -- return (cycles_t) get_tod_clock() >> 2; --} --#define get_cycles get_cycles -- - int get_phys_clock(unsigned long *clock); - void init_cpu_timer(void); - -@@ -226,6 +219,12 @@ static inline unsigned long get_tod_clock_monotonic(void) - return tod; - } - -+static inline cycles_t get_cycles(void) -+{ -+ return (cycles_t)get_tod_clock_monotonic() >> 2; -+} -+#define get_cycles get_cycles -+ - /** - * tod_to_ns - convert a TOD format value to nanoseconds - * @todval: to be converted TOD format value -diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c -index d34d3548c046c2..086d3e3ffdea55 100644 ---- a/arch/s390/kernel/time.c -+++ b/arch/s390/kernel/time.c -@@ -579,7 +579,7 @@ static int stp_sync_clock(void *data) - atomic_dec(&sync->cpus); - /* Wait for in_sync to be set. */ - while (READ_ONCE(sync->in_sync) == 0) -- __udelay(1); -+ ; - } - if (sync->in_sync != 1) - /* Didn't work. Clear per-cpu in sync bit again. */ -diff --git a/arch/s390/mm/dump_pagetables.c b/arch/s390/mm/dump_pagetables.c -index b51666967aa1fd..4721ada81a02da 100644 ---- a/arch/s390/mm/dump_pagetables.c -+++ b/arch/s390/mm/dump_pagetables.c -@@ -249,11 +249,9 @@ static int ptdump_show(struct seq_file *m, void *v) - .marker = address_markers, - }; - -- get_online_mems(); - mutex_lock(&cpa_mutex); - ptdump_walk_pgd(&st.ptdump, &init_mm, NULL); - mutex_unlock(&cpa_mutex); -- put_online_mems(); - return 0; - } - DEFINE_SHOW_ATTRIBUTE(ptdump); -diff --git a/arch/s390/mm/pgalloc.c b/arch/s390/mm/pgalloc.c -index 9355fbe5f51e94..2f534b26fda6c5 100644 ---- a/arch/s390/mm/pgalloc.c -+++ b/arch/s390/mm/pgalloc.c -@@ -456,11 +456,6 @@ void pte_free_defer(struct mm_struct *mm, pgtable_t pgtable) - page = virt_to_page(pgtable); - SetPageActive(page); - page_table_free(mm, (unsigned long *)pgtable); -- /* -- * page_table_free() does not do the pgste gmap_unlink() which -- * page_table_free_rcu() does: warn us if pgste ever reaches here. -- */ -- WARN_ON_ONCE(mm_has_pgste(mm)); - } - #endif /* CONFIG_TRANSPARENT_HUGEPAGE */ - -diff --git a/arch/um/include/asm/thread_info.h b/arch/um/include/asm/thread_info.h -index c7b4b49826a2aa..40d823f36c0941 100644 ---- a/arch/um/include/asm/thread_info.h -+++ b/arch/um/include/asm/thread_info.h -@@ -68,7 +68,11 @@ static inline struct thread_info *current_thread_info(void) - #define _TIF_NOTIFY_SIGNAL (1 << TIF_NOTIFY_SIGNAL) - #define _TIF_MEMDIE (1 << TIF_MEMDIE) - #define _TIF_SYSCALL_AUDIT (1 << TIF_SYSCALL_AUDIT) -+#define _TIF_NOTIFY_RESUME (1 << TIF_NOTIFY_RESUME) - #define _TIF_SECCOMP (1 << TIF_SECCOMP) - #define _TIF_SINGLESTEP (1 << TIF_SINGLESTEP) - -+#define _TIF_WORK_MASK (_TIF_NEED_RESCHED | _TIF_SIGPENDING | _TIF_NOTIFY_SIGNAL | \ -+ _TIF_NOTIFY_RESUME) -+ - #endif -diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c -index afe67d81614676..e7fbf610bda868 100644 ---- a/arch/um/kernel/process.c -+++ b/arch/um/kernel/process.c -@@ -98,14 +98,18 @@ void *__switch_to(struct task_struct *from, struct task_struct *to) - void interrupt_end(void) - { - struct pt_regs *regs = ¤t->thread.regs; -- -- if (need_resched()) -- schedule(); -- if (test_thread_flag(TIF_SIGPENDING) || -- test_thread_flag(TIF_NOTIFY_SIGNAL)) -- do_signal(regs); -- if (test_thread_flag(TIF_NOTIFY_RESUME)) -- resume_user_mode_work(regs); -+ unsigned long thread_flags; -+ -+ thread_flags = read_thread_flags(); -+ while (thread_flags & _TIF_WORK_MASK) { -+ if (thread_flags & _TIF_NEED_RESCHED) -+ schedule(); -+ if (thread_flags & (_TIF_SIGPENDING | _TIF_NOTIFY_SIGNAL)) -+ do_signal(regs); -+ if (thread_flags & _TIF_NOTIFY_RESUME) -+ resume_user_mode_work(regs); -+ thread_flags = read_thread_flags(); -+ } - } - - int get_current_pid(void) -diff --git a/arch/x86/include/asm/kvm-x86-ops.h b/arch/x86/include/asm/kvm-x86-ops.h -index e59ded9761663e..a0a4fc684e63b3 100644 ---- a/arch/x86/include/asm/kvm-x86-ops.h -+++ b/arch/x86/include/asm/kvm-x86-ops.h -@@ -48,7 +48,6 @@ KVM_X86_OP(set_idt) - KVM_X86_OP(get_gdt) - KVM_X86_OP(set_gdt) - KVM_X86_OP(sync_dirty_debug_regs) --KVM_X86_OP(set_dr6) - KVM_X86_OP(set_dr7) - KVM_X86_OP(cache_reg) - KVM_X86_OP(get_rflags) -@@ -102,7 +101,6 @@ KVM_X86_OP(write_tsc_multiplier) - KVM_X86_OP(get_exit_info) - KVM_X86_OP(check_intercept) - KVM_X86_OP(handle_exit_irqoff) --KVM_X86_OP(request_immediate_exit) - KVM_X86_OP(sched_in) - KVM_X86_OP_OPTIONAL(update_cpu_dirty_logging) - KVM_X86_OP_OPTIONAL(vcpu_blocking) -diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h -index 5dfb8cc9616e55..813887324d52da 100644 ---- a/arch/x86/include/asm/kvm_host.h -+++ b/arch/x86/include/asm/kvm_host.h -@@ -733,6 +733,7 @@ struct kvm_vcpu_arch { - u32 pkru; - u32 hflags; - u64 efer; -+ u64 host_debugctl; - u64 apic_base; - struct kvm_lapic *apic; /* kernel irqchip context */ - bool load_eoi_exitmap_pending; -@@ -1549,6 +1550,12 @@ static inline u16 kvm_lapic_irq_dest_mode(bool dest_mode_logical) - return dest_mode_logical ? APIC_DEST_LOGICAL : APIC_DEST_PHYSICAL; - } - -+enum kvm_x86_run_flags { -+ KVM_RUN_FORCE_IMMEDIATE_EXIT = BIT(0), -+ KVM_RUN_LOAD_GUEST_DR6 = BIT(1), -+ KVM_RUN_LOAD_DEBUGCTL = BIT(2), -+}; -+ - struct kvm_x86_ops { - const char *name; - -@@ -1574,6 +1581,12 @@ struct kvm_x86_ops { - void (*vcpu_load)(struct kvm_vcpu *vcpu, int cpu); - void (*vcpu_put)(struct kvm_vcpu *vcpu); - -+ /* -+ * Mask of DEBUGCTL bits that are owned by the host, i.e. that need to -+ * match the host's value even while the guest is active. -+ */ -+ const u64 HOST_OWNED_DEBUGCTL; -+ - void (*update_exception_bitmap)(struct kvm_vcpu *vcpu); - int (*get_msr)(struct kvm_vcpu *vcpu, struct msr_data *msr); - int (*set_msr)(struct kvm_vcpu *vcpu, struct msr_data *msr); -@@ -1595,7 +1608,6 @@ struct kvm_x86_ops { - void (*get_gdt)(struct kvm_vcpu *vcpu, struct desc_ptr *dt); - void (*set_gdt)(struct kvm_vcpu *vcpu, struct desc_ptr *dt); - void (*sync_dirty_debug_regs)(struct kvm_vcpu *vcpu); -- void (*set_dr6)(struct kvm_vcpu *vcpu, unsigned long value); - void (*set_dr7)(struct kvm_vcpu *vcpu, unsigned long value); - void (*cache_reg)(struct kvm_vcpu *vcpu, enum kvm_reg reg); - unsigned long (*get_rflags)(struct kvm_vcpu *vcpu); -@@ -1623,7 +1635,8 @@ struct kvm_x86_ops { - void (*flush_tlb_guest)(struct kvm_vcpu *vcpu); - - int (*vcpu_pre_run)(struct kvm_vcpu *vcpu); -- enum exit_fastpath_completion (*vcpu_run)(struct kvm_vcpu *vcpu); -+ enum exit_fastpath_completion (*vcpu_run)(struct kvm_vcpu *vcpu, -+ u64 run_flags); - int (*handle_exit)(struct kvm_vcpu *vcpu, - enum exit_fastpath_completion exit_fastpath); - int (*skip_emulated_instruction)(struct kvm_vcpu *vcpu); -@@ -1657,7 +1670,7 @@ struct kvm_x86_ops { - bool allow_apicv_in_x2apic_without_x2apic_virtualization; - void (*refresh_apicv_exec_ctrl)(struct kvm_vcpu *vcpu); - void (*hwapic_irr_update)(struct kvm_vcpu *vcpu, int max_irr); -- void (*hwapic_isr_update)(int isr); -+ void (*hwapic_isr_update)(struct kvm_vcpu *vcpu, int isr); - bool (*guest_apic_has_interrupt)(struct kvm_vcpu *vcpu); - void (*load_eoi_exitmap)(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap); - void (*set_virtual_apic_mode)(struct kvm_vcpu *vcpu); -@@ -1693,8 +1706,6 @@ struct kvm_x86_ops { - struct x86_exception *exception); - void (*handle_exit_irqoff)(struct kvm_vcpu *vcpu); - -- void (*request_immediate_exit)(struct kvm_vcpu *vcpu); -- - void (*sched_in)(struct kvm_vcpu *kvm, int cpu); - - /* -@@ -2180,7 +2191,6 @@ extern bool kvm_find_async_pf_gfn(struct kvm_vcpu *vcpu, gfn_t gfn); - - int kvm_skip_emulated_instruction(struct kvm_vcpu *vcpu); - int kvm_complete_insn_gp(struct kvm_vcpu *vcpu, int err); --void __kvm_request_immediate_exit(struct kvm_vcpu *vcpu); - - void __user *__x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, - u32 size); -diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h -index 03385545758159..723e48b57bd0f8 100644 ---- a/arch/x86/include/asm/msr-index.h -+++ b/arch/x86/include/asm/msr-index.h -@@ -380,6 +380,7 @@ - #define DEBUGCTLMSR_FREEZE_PERFMON_ON_PMI (1UL << 12) - #define DEBUGCTLMSR_FREEZE_IN_SMM_BIT 14 - #define DEBUGCTLMSR_FREEZE_IN_SMM (1UL << DEBUGCTLMSR_FREEZE_IN_SMM_BIT) -+#define DEBUGCTLMSR_RTM_DEBUG BIT(15) - - #define MSR_PEBS_FRONTEND 0x000003f7 - -diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h -index 97771b9d33af30..2759524b8ffc3a 100644 ---- a/arch/x86/include/asm/xen/hypercall.h -+++ b/arch/x86/include/asm/xen/hypercall.h -@@ -94,12 +94,13 @@ DECLARE_STATIC_CALL(xen_hypercall, xen_hypercall_func); - #ifdef MODULE - #define __ADDRESSABLE_xen_hypercall - #else --#define __ADDRESSABLE_xen_hypercall __ADDRESSABLE_ASM_STR(__SCK__xen_hypercall) -+#define __ADDRESSABLE_xen_hypercall \ -+ __stringify(.global STATIC_CALL_KEY(xen_hypercall);) - #endif - - #define __HYPERCALL \ - __ADDRESSABLE_xen_hypercall \ -- "call __SCT__xen_hypercall" -+ __stringify(call STATIC_CALL_TRAMP(xen_hypercall)) - - #define __HYPERCALL_ENTRY(x) "a" (x) - -diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c -index c4d5ac99c6af84..332c6f24280dde 100644 ---- a/arch/x86/kernel/cpu/bugs.c -+++ b/arch/x86/kernel/cpu/bugs.c -@@ -71,10 +71,9 @@ void (*x86_return_thunk)(void) __ro_after_init = __x86_return_thunk; - - static void __init set_return_thunk(void *thunk) - { -- if (x86_return_thunk != __x86_return_thunk) -- pr_warn("x86/bugs: return thunk changed\n"); -- - x86_return_thunk = thunk; -+ -+ pr_info("active return thunk: %ps\n", thunk); - } - - /* Update SPEC_CTRL MSR and its cached copy unconditionally */ -diff --git a/arch/x86/kernel/cpu/hygon.c b/arch/x86/kernel/cpu/hygon.c -index 6e738759779e81..5c594781b463db 100644 ---- a/arch/x86/kernel/cpu/hygon.c -+++ b/arch/x86/kernel/cpu/hygon.c -@@ -15,6 +15,7 @@ - #include - #include - #include -+#include - - #include "cpu.h" - -@@ -240,6 +241,8 @@ static void bsp_init_hygon(struct cpuinfo_x86 *c) - x86_amd_ls_cfg_ssbd_mask = 1ULL << 10; - } - } -+ -+ resctrl_cpu_detect(c); - } - - static void early_init_hygon(struct cpuinfo_x86 *c) -diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c -index bd3fbd5be5da6e..223f4fa6a849b8 100644 ---- a/arch/x86/kvm/hyperv.c -+++ b/arch/x86/kvm/hyperv.c -@@ -1929,6 +1929,9 @@ int kvm_hv_vcpu_flush_tlb(struct kvm_vcpu *vcpu) - if (entries[i] == KVM_HV_TLB_FLUSHALL_ENTRY) - goto out_flush_all; - -+ if (is_noncanonical_address(entries[i], vcpu)) -+ continue; -+ - /* - * Lower 12 bits of 'address' encode the number of additional - * pages to flush. -diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c -index 66c7f2367bb34e..ba1c2a7f74f766 100644 ---- a/arch/x86/kvm/lapic.c -+++ b/arch/x86/kvm/lapic.c -@@ -750,7 +750,7 @@ static inline void apic_set_isr(int vec, struct kvm_lapic *apic) - * just set SVI. - */ - if (unlikely(apic->apicv_active)) -- static_call_cond(kvm_x86_hwapic_isr_update)(vec); -+ static_call_cond(kvm_x86_hwapic_isr_update)(apic->vcpu, vec); - else { - ++apic->isr_count; - BUG_ON(apic->isr_count > MAX_APIC_VECTOR); -@@ -795,7 +795,7 @@ static inline void apic_clear_isr(int vec, struct kvm_lapic *apic) - * and must be left alone. - */ - if (unlikely(apic->apicv_active)) -- static_call_cond(kvm_x86_hwapic_isr_update)(apic_find_highest_isr(apic)); -+ static_call_cond(kvm_x86_hwapic_isr_update)(apic->vcpu, apic_find_highest_isr(apic)); - else { - --apic->isr_count; - BUG_ON(apic->isr_count < 0); -@@ -803,6 +803,17 @@ static inline void apic_clear_isr(int vec, struct kvm_lapic *apic) - } - } - -+void kvm_apic_update_hwapic_isr(struct kvm_vcpu *vcpu) -+{ -+ struct kvm_lapic *apic = vcpu->arch.apic; -+ -+ if (WARN_ON_ONCE(!lapic_in_kernel(vcpu)) || !apic->apicv_active) -+ return; -+ -+ static_call(kvm_x86_hwapic_isr_update)(vcpu, apic_find_highest_isr(apic)); -+} -+EXPORT_SYMBOL_GPL(kvm_apic_update_hwapic_isr); -+ - int kvm_lapic_find_highest_irr(struct kvm_vcpu *vcpu) - { - /* This may race with setting of irr in __apic_accept_irq() and -@@ -2772,7 +2783,7 @@ void kvm_lapic_reset(struct kvm_vcpu *vcpu, bool init_event) - if (apic->apicv_active) { - static_call_cond(kvm_x86_apicv_post_state_restore)(vcpu); - static_call_cond(kvm_x86_hwapic_irr_update)(vcpu, -1); -- static_call_cond(kvm_x86_hwapic_isr_update)(-1); -+ static_call_cond(kvm_x86_hwapic_isr_update)(vcpu, -1); - } - - vcpu->arch.apic_arb_prio = 0; -@@ -3072,7 +3083,7 @@ int kvm_apic_set_state(struct kvm_vcpu *vcpu, struct kvm_lapic_state *s) - if (apic->apicv_active) { - static_call_cond(kvm_x86_apicv_post_state_restore)(vcpu); - static_call_cond(kvm_x86_hwapic_irr_update)(vcpu, apic_find_highest_irr(apic)); -- static_call_cond(kvm_x86_hwapic_isr_update)(apic_find_highest_isr(apic)); -+ static_call_cond(kvm_x86_hwapic_isr_update)(vcpu, apic_find_highest_isr(apic)); - } - kvm_make_request(KVM_REQ_EVENT, vcpu); - if (ioapic_in_kernel(vcpu->kvm)) -diff --git a/arch/x86/kvm/lapic.h b/arch/x86/kvm/lapic.h -index 0a0ea4b5dd8ce7..0dd069b8d6d11f 100644 ---- a/arch/x86/kvm/lapic.h -+++ b/arch/x86/kvm/lapic.h -@@ -124,6 +124,7 @@ int kvm_set_apic_base(struct kvm_vcpu *vcpu, struct msr_data *msr_info); - int kvm_apic_get_state(struct kvm_vcpu *vcpu, struct kvm_lapic_state *s); - int kvm_apic_set_state(struct kvm_vcpu *vcpu, struct kvm_lapic_state *s); - enum lapic_mode kvm_get_apic_mode(struct kvm_vcpu *vcpu); -+void kvm_apic_update_hwapic_isr(struct kvm_vcpu *vcpu); - int kvm_lapic_find_highest_irr(struct kvm_vcpu *vcpu); - - u64 kvm_get_lapic_tscdeadline_msr(struct kvm_vcpu *vcpu); -diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c -index 86c50747e15837..abff6d45ae3334 100644 ---- a/arch/x86/kvm/svm/svm.c -+++ b/arch/x86/kvm/svm/svm.c -@@ -4157,6 +4157,9 @@ static int svm_vcpu_pre_run(struct kvm_vcpu *vcpu) - - static fastpath_t svm_exit_handlers_fastpath(struct kvm_vcpu *vcpu) - { -+ if (is_guest_mode(vcpu)) -+ return EXIT_FASTPATH_NONE; -+ - if (to_svm(vcpu)->vmcb->control.exit_code == SVM_EXIT_MSR && - to_svm(vcpu)->vmcb->control.exit_info_1) - return handle_fastpath_set_msr_irqoff(vcpu); -@@ -4170,6 +4173,18 @@ static noinstr void svm_vcpu_enter_exit(struct kvm_vcpu *vcpu, bool spec_ctrl_in - - guest_state_enter_irqoff(); - -+ /* -+ * Set RFLAGS.IF prior to VMRUN, as the host's RFLAGS.IF at the time of -+ * VMRUN controls whether or not physical IRQs are masked (KVM always -+ * runs with V_INTR_MASKING_MASK). Toggle RFLAGS.IF here to avoid the -+ * temptation to do STI+VMRUN+CLI, as AMD CPUs bleed the STI shadow -+ * into guest state if delivery of an event during VMRUN triggers a -+ * #VMEXIT, and the guest_state transitions already tell lockdep that -+ * IRQs are being enabled/disabled. Note! GIF=0 for the entirety of -+ * this path, so IRQs aren't actually unmasked while running host code. -+ */ -+ raw_local_irq_enable(); -+ - amd_clear_divider(); - - if (sev_es_guest(vcpu->kvm)) -@@ -4177,15 +4192,18 @@ static noinstr void svm_vcpu_enter_exit(struct kvm_vcpu *vcpu, bool spec_ctrl_in - else - __svm_vcpu_run(svm, spec_ctrl_intercepted); - -+ raw_local_irq_disable(); -+ - guest_state_exit_irqoff(); - } - --static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu) -+static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags) - { -+ bool force_immediate_exit = run_flags & KVM_RUN_FORCE_IMMEDIATE_EXIT; - struct vcpu_svm *svm = to_svm(vcpu); - bool spec_ctrl_intercepted = msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL); - -- trace_kvm_entry(vcpu); -+ trace_kvm_entry(vcpu, force_immediate_exit); - - svm->vmcb->save.rax = vcpu->arch.regs[VCPU_REGS_RAX]; - svm->vmcb->save.rsp = vcpu->arch.regs[VCPU_REGS_RSP]; -@@ -4204,9 +4222,12 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu) - * is enough to force an immediate vmexit. - */ - disable_nmi_singlestep(svm); -- smp_send_reschedule(vcpu->cpu); -+ force_immediate_exit = true; - } - -+ if (force_immediate_exit) -+ smp_send_reschedule(vcpu->cpu); -+ - pre_svm_run(vcpu); - - sync_lapic_to_cr8(vcpu); -@@ -4220,10 +4241,13 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu) - svm_hv_update_vp_id(svm->vmcb, vcpu); - - /* -- * Run with all-zero DR6 unless needed, so that we can get the exact cause -- * of a #DB. -+ * Run with all-zero DR6 unless the guest can write DR6 freely, so that -+ * KVM can get the exact cause of a #DB. Note, loading guest DR6 from -+ * KVM's snapshot is only necessary when DR accesses won't exit. - */ -- if (likely(!(vcpu->arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT))) -+ if (unlikely(run_flags & KVM_RUN_LOAD_GUEST_DR6)) -+ svm_set_dr6(vcpu, vcpu->arch.dr6); -+ else if (likely(!(vcpu->arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT))) - svm_set_dr6(vcpu, DR6_ACTIVE_LOW); - - clgi(); -@@ -4300,9 +4324,6 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu) - - svm_complete_interrupts(vcpu); - -- if (is_guest_mode(vcpu)) -- return EXIT_FASTPATH_NONE; -- - return svm_exit_handlers_fastpath(vcpu); - } - -@@ -5003,7 +5024,6 @@ static struct kvm_x86_ops svm_x86_ops __initdata = { - .set_idt = svm_set_idt, - .get_gdt = svm_get_gdt, - .set_gdt = svm_set_gdt, -- .set_dr6 = svm_set_dr6, - .set_dr7 = svm_set_dr7, - .sync_dirty_debug_regs = svm_sync_dirty_debug_regs, - .cache_reg = svm_cache_reg, -@@ -5060,8 +5080,6 @@ static struct kvm_x86_ops svm_x86_ops __initdata = { - .check_intercept = svm_check_intercept, - .handle_exit_irqoff = svm_handle_exit_irqoff, - -- .request_immediate_exit = __kvm_request_immediate_exit, -- - .sched_in = svm_sched_in, - - .nested_ops = &svm_nested_ops, -diff --git a/arch/x86/kvm/svm/vmenter.S b/arch/x86/kvm/svm/vmenter.S -index 56fe34d9397f64..81ecb9e1101d78 100644 ---- a/arch/x86/kvm/svm/vmenter.S -+++ b/arch/x86/kvm/svm/vmenter.S -@@ -171,12 +171,8 @@ SYM_FUNC_START(__svm_vcpu_run) - VM_CLEAR_CPU_BUFFERS - - /* Enter guest mode */ -- sti -- - 3: vmrun %_ASM_AX - 4: -- cli -- - /* Pop @svm to RAX while it's the only available register. */ - pop %_ASM_AX - -@@ -341,11 +337,8 @@ SYM_FUNC_START(__svm_sev_es_vcpu_run) - VM_CLEAR_CPU_BUFFERS - - /* Enter guest mode */ -- sti -- - 1: vmrun %_ASM_AX -- --2: cli -+2: - - /* Pop @svm to RDI, guest registers have been saved already. */ - pop %_ASM_DI -diff --git a/arch/x86/kvm/trace.h b/arch/x86/kvm/trace.h -index b82e6ed4f02417..c6b4b1728006d5 100644 ---- a/arch/x86/kvm/trace.h -+++ b/arch/x86/kvm/trace.h -@@ -15,20 +15,23 @@ - * Tracepoint for guest mode entry. - */ - TRACE_EVENT(kvm_entry, -- TP_PROTO(struct kvm_vcpu *vcpu), -- TP_ARGS(vcpu), -+ TP_PROTO(struct kvm_vcpu *vcpu, bool force_immediate_exit), -+ TP_ARGS(vcpu, force_immediate_exit), - - TP_STRUCT__entry( - __field( unsigned int, vcpu_id ) - __field( unsigned long, rip ) -+ __field( bool, immediate_exit ) - ), - - TP_fast_assign( - __entry->vcpu_id = vcpu->vcpu_id; - __entry->rip = kvm_rip_read(vcpu); -+ __entry->immediate_exit = force_immediate_exit; - ), - -- TP_printk("vcpu %u, rip 0x%lx", __entry->vcpu_id, __entry->rip) -+ TP_printk("vcpu %u, rip 0x%lx%s", __entry->vcpu_id, __entry->rip, -+ __entry->immediate_exit ? "[immediate exit]" : "") - ); - - /* -diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c -index d3e346a574f11b..d2fa192d7ce776 100644 ---- a/arch/x86/kvm/vmx/nested.c -+++ b/arch/x86/kvm/vmx/nested.c -@@ -2564,10 +2564,11 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12, - if (vmx->nested.nested_run_pending && - (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS)) { - kvm_set_dr(vcpu, 7, vmcs12->guest_dr7); -- vmcs_write64(GUEST_IA32_DEBUGCTL, vmcs12->guest_ia32_debugctl); -+ vmx_guest_debugctl_write(vcpu, vmcs12->guest_ia32_debugctl & -+ vmx_get_supported_debugctl(vcpu, false)); - } else { - kvm_set_dr(vcpu, 7, vcpu->arch.dr7); -- vmcs_write64(GUEST_IA32_DEBUGCTL, vmx->nested.pre_vmenter_debugctl); -+ vmx_guest_debugctl_write(vcpu, vmx->nested.pre_vmenter_debugctl); - } - if (kvm_mpx_supported() && (!vmx->nested.nested_run_pending || - !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS))) -@@ -3045,7 +3046,8 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu, - return -EINVAL; - - if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) && -- CC(!kvm_dr7_valid(vmcs12->guest_dr7))) -+ (CC(!kvm_dr7_valid(vmcs12->guest_dr7)) || -+ CC(!vmx_is_valid_debugctl(vcpu, vmcs12->guest_ia32_debugctl, false)))) - return -EINVAL; - - if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_PAT) && -@@ -3431,7 +3433,7 @@ enum nvmx_vmentry_status nested_vmx_enter_non_root_mode(struct kvm_vcpu *vcpu, - - if (!vmx->nested.nested_run_pending || - !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS)) -- vmx->nested.pre_vmenter_debugctl = vmcs_read64(GUEST_IA32_DEBUGCTL); -+ vmx->nested.pre_vmenter_debugctl = vmx_guest_debugctl_read(); - if (kvm_mpx_supported() && - (!vmx->nested.nested_run_pending || - !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS))) -@@ -4435,6 +4437,12 @@ static void sync_vmcs02_to_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12) - (vmcs12->vm_entry_controls & ~VM_ENTRY_IA32E_MODE) | - (vm_entry_controls_get(to_vmx(vcpu)) & VM_ENTRY_IA32E_MODE); - -+ /* -+ * Note! Save DR7, but intentionally don't grab DEBUGCTL from vmcs02. -+ * Writes to DEBUGCTL that aren't intercepted by L1 are immediately -+ * propagated to vmcs12 (see vmx_set_msr()), as the value loaded into -+ * vmcs02 doesn't strictly track vmcs12. -+ */ - if (vmcs12->vm_exit_controls & VM_EXIT_SAVE_DEBUG_CONTROLS) - kvm_get_dr(vcpu, 7, (unsigned long *)&vmcs12->guest_dr7); - -@@ -4625,7 +4633,7 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu, - __vmx_set_segment(vcpu, &seg, VCPU_SREG_LDTR); - - kvm_set_dr(vcpu, 7, 0x400); -- vmcs_write64(GUEST_IA32_DEBUGCTL, 0); -+ vmx_guest_debugctl_write(vcpu, 0); - - if (nested_vmx_load_msr(vcpu, vmcs12->vm_exit_msr_load_addr, - vmcs12->vm_exit_msr_load_count)) -@@ -4680,6 +4688,9 @@ static void nested_vmx_restore_host_state(struct kvm_vcpu *vcpu) - WARN_ON(kvm_set_dr(vcpu, 7, vmcs_readl(GUEST_DR7))); - } - -+ /* Reload DEBUGCTL to ensure vmcs01 has a fresh FREEZE_IN_SMM value. */ -+ vmx_reload_guest_debugctl(vcpu); -+ - /* - * Note that calling vmx_set_{efer,cr0,cr4} is important as they - * handle a variety of side effects to KVM's software model. -@@ -4900,6 +4911,11 @@ void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 vm_exit_reason, - kvm_make_request(KVM_REQ_APICV_UPDATE, vcpu); - } - -+ if (vmx->nested.update_vmcs01_hwapic_isr) { -+ vmx->nested.update_vmcs01_hwapic_isr = false; -+ kvm_apic_update_hwapic_isr(vcpu); -+ } -+ - if ((vm_exit_reason != -1) && - (enable_shadow_vmcs || evmptr_is_valid(vmx->nested.hv_evmcs_vmptr))) - vmx->nested.need_vmcs12_to_shadow_sync = true; -diff --git a/arch/x86/kvm/vmx/pmu_intel.c b/arch/x86/kvm/vmx/pmu_intel.c -index 48a2f77f62ef35..50364e00e4e90d 100644 ---- a/arch/x86/kvm/vmx/pmu_intel.c -+++ b/arch/x86/kvm/vmx/pmu_intel.c -@@ -633,11 +633,11 @@ static void intel_pmu_reset(struct kvm_vcpu *vcpu) - */ - static void intel_pmu_legacy_freezing_lbrs_on_pmi(struct kvm_vcpu *vcpu) - { -- u64 data = vmcs_read64(GUEST_IA32_DEBUGCTL); -+ u64 data = vmx_guest_debugctl_read(); - - if (data & DEBUGCTLMSR_FREEZE_LBRS_ON_PMI) { - data &= ~DEBUGCTLMSR_LBR; -- vmcs_write64(GUEST_IA32_DEBUGCTL, data); -+ vmx_guest_debugctl_write(vcpu, data); - } - } - -@@ -707,7 +707,7 @@ void vmx_passthrough_lbr_msrs(struct kvm_vcpu *vcpu) - - if (!lbr_desc->event) { - vmx_disable_lbr_msrs_passthrough(vcpu); -- if (vmcs_read64(GUEST_IA32_DEBUGCTL) & DEBUGCTLMSR_LBR) -+ if (vmx_guest_debugctl_read() & DEBUGCTLMSR_LBR) - goto warn; - if (test_bit(INTEL_PMC_IDX_FIXED_VLBR, pmu->pmc_in_use)) - goto warn; -@@ -729,7 +729,7 @@ void vmx_passthrough_lbr_msrs(struct kvm_vcpu *vcpu) - - static void intel_pmu_cleanup(struct kvm_vcpu *vcpu) - { -- if (!(vmcs_read64(GUEST_IA32_DEBUGCTL) & DEBUGCTLMSR_LBR)) -+ if (!(vmx_guest_debugctl_read() & DEBUGCTLMSR_LBR)) - intel_pmu_release_guest_lbr_event(vcpu); - } - -diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c -index e53620e189254b..9b1f22bcb71658 100644 ---- a/arch/x86/kvm/vmx/vmx.c -+++ b/arch/x86/kvm/vmx/vmx.c -@@ -49,6 +49,8 @@ - #include - #include - -+#include -+ - #include "capabilities.h" - #include "cpuid.h" - #include "hyperv.h" -@@ -1304,8 +1306,6 @@ void vmx_prepare_switch_to_guest(struct kvm_vcpu *vcpu) - u16 fs_sel, gs_sel; - int i; - -- vmx->req_immediate_exit = false; -- - /* - * Note that guest MSRs to be saved/restored can also be changed - * when guest state is loaded. This happens when guest transitions -@@ -1499,13 +1499,9 @@ void vmx_vcpu_load_vmcs(struct kvm_vcpu *vcpu, int cpu, - */ - static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu) - { -- struct vcpu_vmx *vmx = to_vmx(vcpu); -- - vmx_vcpu_load_vmcs(vcpu, cpu, NULL); - - vmx_vcpu_pi_load(vcpu, cpu); -- -- vmx->host_debugctlmsr = get_debugctlmsr(); - } - - static void vmx_vcpu_put(struct kvm_vcpu *vcpu) -@@ -2128,7 +2124,7 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - msr_info->data = vmx->pt_desc.guest.addr_a[index / 2]; - break; - case MSR_IA32_DEBUGCTLMSR: -- msr_info->data = vmcs_read64(GUEST_IA32_DEBUGCTL); -+ msr_info->data = vmx_guest_debugctl_read(); - break; - default: - find_uret_msr: -@@ -2153,7 +2149,7 @@ static u64 nested_vmx_truncate_sysenter_addr(struct kvm_vcpu *vcpu, - return (unsigned long)data; - } - --static u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated) -+u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated) - { - u64 debugctl = 0; - -@@ -2165,9 +2161,25 @@ static u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated - (host_initiated || intel_pmu_lbr_is_enabled(vcpu))) - debugctl |= DEBUGCTLMSR_LBR | DEBUGCTLMSR_FREEZE_LBRS_ON_PMI; - -+ if (boot_cpu_has(X86_FEATURE_RTM) && -+ (host_initiated || guest_cpuid_has(vcpu, X86_FEATURE_RTM))) -+ debugctl |= DEBUGCTLMSR_RTM_DEBUG; -+ - return debugctl; - } - -+bool vmx_is_valid_debugctl(struct kvm_vcpu *vcpu, u64 data, bool host_initiated) -+{ -+ u64 invalid; -+ -+ invalid = data & ~vmx_get_supported_debugctl(vcpu, host_initiated); -+ if (invalid & (DEBUGCTLMSR_BTF | DEBUGCTLMSR_LBR)) { -+ kvm_pr_unimpl_wrmsr(vcpu, MSR_IA32_DEBUGCTLMSR, data); -+ invalid &= ~(DEBUGCTLMSR_BTF | DEBUGCTLMSR_LBR); -+ } -+ return !invalid; -+} -+ - /* - * Writes msr value into the appropriate "register". - * Returns 0 on success, non-0 otherwise. -@@ -2236,29 +2248,22 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - } - vmcs_writel(GUEST_SYSENTER_ESP, data); - break; -- case MSR_IA32_DEBUGCTLMSR: { -- u64 invalid; -- -- invalid = data & ~vmx_get_supported_debugctl(vcpu, msr_info->host_initiated); -- if (invalid & (DEBUGCTLMSR_BTF|DEBUGCTLMSR_LBR)) { -- kvm_pr_unimpl_wrmsr(vcpu, msr_index, data); -- data &= ~(DEBUGCTLMSR_BTF|DEBUGCTLMSR_LBR); -- invalid &= ~(DEBUGCTLMSR_BTF|DEBUGCTLMSR_LBR); -- } -- -- if (invalid) -+ case MSR_IA32_DEBUGCTLMSR: -+ if (!vmx_is_valid_debugctl(vcpu, data, msr_info->host_initiated)) - return 1; - -+ data &= vmx_get_supported_debugctl(vcpu, msr_info->host_initiated); -+ - if (is_guest_mode(vcpu) && get_vmcs12(vcpu)->vm_exit_controls & - VM_EXIT_SAVE_DEBUG_CONTROLS) - get_vmcs12(vcpu)->guest_ia32_debugctl = data; - -- vmcs_write64(GUEST_IA32_DEBUGCTL, data); -+ vmx_guest_debugctl_write(vcpu, data); -+ - if (intel_pmu_lbr_is_enabled(vcpu) && !to_vmx(vcpu)->lbr_desc.event && - (data & DEBUGCTLMSR_LBR)) - intel_pmu_create_guest_lbr_event(vcpu); - return 0; -- } - case MSR_IA32_BNDCFGS: - if (!kvm_mpx_supported() || - (!msr_info->host_initiated && -@@ -4822,7 +4827,8 @@ static void init_vmcs(struct vcpu_vmx *vmx) - vmcs_write32(GUEST_SYSENTER_CS, 0); - vmcs_writel(GUEST_SYSENTER_ESP, 0); - vmcs_writel(GUEST_SYSENTER_EIP, 0); -- vmcs_write64(GUEST_IA32_DEBUGCTL, 0); -+ -+ vmx_guest_debugctl_write(&vmx->vcpu, 0); - - if (cpu_has_vmx_tpr_shadow()) { - vmcs_write64(VIRTUAL_APIC_PAGE_ADDR, 0); -@@ -5620,12 +5626,6 @@ static void vmx_sync_dirty_debug_regs(struct kvm_vcpu *vcpu) - set_debugreg(DR6_RESERVED, 6); - } - --static void vmx_set_dr6(struct kvm_vcpu *vcpu, unsigned long val) --{ -- lockdep_assert_irqs_disabled(); -- set_debugreg(vcpu->arch.dr6, 6); --} -- - static void vmx_set_dr7(struct kvm_vcpu *vcpu, unsigned long val) - { - vmcs_writel(GUEST_DR7, val); -@@ -6019,22 +6019,46 @@ static int handle_pml_full(struct kvm_vcpu *vcpu) - return 1; - } - --static fastpath_t handle_fastpath_preemption_timer(struct kvm_vcpu *vcpu) -+static fastpath_t handle_fastpath_preemption_timer(struct kvm_vcpu *vcpu, -+ bool force_immediate_exit) - { - struct vcpu_vmx *vmx = to_vmx(vcpu); - -- if (!vmx->req_immediate_exit && -- !unlikely(vmx->loaded_vmcs->hv_timer_soft_disabled)) { -- kvm_lapic_expired_hv_timer(vcpu); -+ /* -+ * In the *extremely* unlikely scenario that this is a spurious VM-Exit -+ * due to the timer expiring while it was "soft" disabled, just eat the -+ * exit and re-enter the guest. -+ */ -+ if (unlikely(vmx->loaded_vmcs->hv_timer_soft_disabled)) - return EXIT_FASTPATH_REENTER_GUEST; -- } - -- return EXIT_FASTPATH_NONE; -+ /* -+ * If the timer expired because KVM used it to force an immediate exit, -+ * then mission accomplished. -+ */ -+ if (force_immediate_exit) -+ return EXIT_FASTPATH_EXIT_HANDLED; -+ -+ /* -+ * If L2 is active, go down the slow path as emulating the guest timer -+ * expiration likely requires synthesizing a nested VM-Exit. -+ */ -+ if (is_guest_mode(vcpu)) -+ return EXIT_FASTPATH_NONE; -+ -+ kvm_lapic_expired_hv_timer(vcpu); -+ return EXIT_FASTPATH_REENTER_GUEST; - } - - static int handle_preemption_timer(struct kvm_vcpu *vcpu) - { -- handle_fastpath_preemption_timer(vcpu); -+ /* -+ * This non-fastpath handler is reached if and only if the preemption -+ * timer was being used to emulate a guest timer while L2 is active. -+ * All other scenarios are supposed to be handled in the fastpath. -+ */ -+ WARN_ON_ONCE(!is_guest_mode(vcpu)); -+ kvm_lapic_expired_hv_timer(vcpu); - return 1; - } - -@@ -6834,11 +6858,27 @@ static void vmx_set_apic_access_page_addr(struct kvm_vcpu *vcpu) - kvm_release_pfn_clean(pfn); - } - --static void vmx_hwapic_isr_update(int max_isr) -+static void vmx_hwapic_isr_update(struct kvm_vcpu *vcpu, int max_isr) - { - u16 status; - u8 old; - -+ /* -+ * If L2 is active, defer the SVI update until vmcs01 is loaded, as SVI -+ * is only relevant for if and only if Virtual Interrupt Delivery is -+ * enabled in vmcs12, and if VID is enabled then L2 EOIs affect L2's -+ * vAPIC, not L1's vAPIC. KVM must update vmcs01 on the next nested -+ * VM-Exit, otherwise L1 with run with a stale SVI. -+ */ -+ if (is_guest_mode(vcpu)) { -+ /* -+ * KVM is supposed to forward intercepted L2 EOIs to L1 if VID -+ * is enabled in vmcs12; as above, the EOIs affect L2's vAPIC. -+ */ -+ to_vmx(vcpu)->nested.update_vmcs01_hwapic_isr = true; -+ return; -+ } -+ - if (max_isr == -1) - max_isr = 0; - -@@ -7175,13 +7215,13 @@ static void atomic_switch_perf_msrs(struct vcpu_vmx *vmx) - msrs[i].host, false); - } - --static void vmx_update_hv_timer(struct kvm_vcpu *vcpu) -+static void vmx_update_hv_timer(struct kvm_vcpu *vcpu, bool force_immediate_exit) - { - struct vcpu_vmx *vmx = to_vmx(vcpu); - u64 tscl; - u32 delta_tsc; - -- if (vmx->req_immediate_exit) { -+ if (force_immediate_exit) { - vmcs_write32(VMX_PREEMPTION_TIMER_VALUE, 0); - vmx->loaded_vmcs->hv_timer_soft_disabled = false; - } else if (vmx->hv_deadline_tsc != -1) { -@@ -7234,13 +7274,22 @@ void noinstr vmx_spec_ctrl_restore_host(struct vcpu_vmx *vmx, - barrier_nospec(); - } - --static fastpath_t vmx_exit_handlers_fastpath(struct kvm_vcpu *vcpu) -+static fastpath_t vmx_exit_handlers_fastpath(struct kvm_vcpu *vcpu, -+ bool force_immediate_exit) - { -+ /* -+ * If L2 is active, some VMX preemption timer exits can be handled in -+ * the fastpath even, all other exits must use the slow path. -+ */ -+ if (is_guest_mode(vcpu) && -+ to_vmx(vcpu)->exit_reason.basic != EXIT_REASON_PREEMPTION_TIMER) -+ return EXIT_FASTPATH_NONE; -+ - switch (to_vmx(vcpu)->exit_reason.basic) { - case EXIT_REASON_MSR_WRITE: - return handle_fastpath_set_msr_irqoff(vcpu); - case EXIT_REASON_PREEMPTION_TIMER: -- return handle_fastpath_preemption_timer(vcpu); -+ return handle_fastpath_preemption_timer(vcpu, force_immediate_exit); - default: - return EXIT_FASTPATH_NONE; - } -@@ -7300,8 +7349,9 @@ static noinstr void vmx_vcpu_enter_exit(struct kvm_vcpu *vcpu, - guest_state_exit_irqoff(); - } - --static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu) -+static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags) - { -+ bool force_immediate_exit = run_flags & KVM_RUN_FORCE_IMMEDIATE_EXIT; - struct vcpu_vmx *vmx = to_vmx(vcpu); - unsigned long cr3, cr4; - -@@ -7327,7 +7377,7 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu) - return EXIT_FASTPATH_NONE; - } - -- trace_kvm_entry(vcpu); -+ trace_kvm_entry(vcpu, force_immediate_exit); - - if (vmx->ple_window_dirty) { - vmx->ple_window_dirty = false; -@@ -7346,6 +7396,12 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu) - vmcs_writel(GUEST_RIP, vcpu->arch.regs[VCPU_REGS_RIP]); - vcpu->arch.regs_dirty = 0; - -+ if (run_flags & KVM_RUN_LOAD_GUEST_DR6) -+ set_debugreg(vcpu->arch.dr6, 6); -+ -+ if (run_flags & KVM_RUN_LOAD_DEBUGCTL) -+ vmx_reload_guest_debugctl(vcpu); -+ - /* - * Refresh vmcs.HOST_CR3 if necessary. This must be done immediately - * prior to VM-Enter, as the kernel may load a new ASID (PCID) any time -@@ -7382,7 +7438,9 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu) - vmx_passthrough_lbr_msrs(vcpu); - - if (enable_preemption_timer) -- vmx_update_hv_timer(vcpu); -+ vmx_update_hv_timer(vcpu, force_immediate_exit); -+ else if (force_immediate_exit) -+ smp_send_reschedule(vcpu->cpu); - - kvm_wait_lapic_expire(vcpu); - -@@ -7398,8 +7456,8 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu) - } - - /* MSR_IA32_DEBUGCTLMSR is zeroed on vmexit. Restore it if needed */ -- if (vmx->host_debugctlmsr) -- update_debugctlmsr(vmx->host_debugctlmsr); -+ if (vcpu->arch.host_debugctl) -+ update_debugctlmsr(vcpu->arch.host_debugctl); - - #ifndef CONFIG_X86_64 - /* -@@ -7446,10 +7504,7 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu) - vmx_recover_nmi_blocking(vmx); - vmx_complete_interrupts(vmx); - -- if (is_guest_mode(vcpu)) -- return EXIT_FASTPATH_NONE; -- -- return vmx_exit_handlers_fastpath(vcpu); -+ return vmx_exit_handlers_fastpath(vcpu, force_immediate_exit); - } - - static void vmx_vcpu_free(struct kvm_vcpu *vcpu) -@@ -7948,11 +8003,6 @@ static __init void vmx_set_cpu_caps(void) - kvm_cpu_cap_check_and_set(X86_FEATURE_WAITPKG); - } - --static void vmx_request_immediate_exit(struct kvm_vcpu *vcpu) --{ -- to_vmx(vcpu)->req_immediate_exit = true; --} -- - static int vmx_check_intercept_io(struct kvm_vcpu *vcpu, - struct x86_instruction_info *info) - { -@@ -8279,6 +8329,8 @@ static struct kvm_x86_ops vmx_x86_ops __initdata = { - .vcpu_load = vmx_vcpu_load, - .vcpu_put = vmx_vcpu_put, - -+ .HOST_OWNED_DEBUGCTL = DEBUGCTLMSR_FREEZE_IN_SMM, -+ - .update_exception_bitmap = vmx_update_exception_bitmap, - .get_msr_feature = vmx_get_msr_feature, - .get_msr = vmx_get_msr, -@@ -8297,7 +8349,6 @@ static struct kvm_x86_ops vmx_x86_ops __initdata = { - .set_idt = vmx_set_idt, - .get_gdt = vmx_get_gdt, - .set_gdt = vmx_set_gdt, -- .set_dr6 = vmx_set_dr6, - .set_dr7 = vmx_set_dr7, - .sync_dirty_debug_regs = vmx_sync_dirty_debug_regs, - .cache_reg = vmx_cache_reg, -@@ -8364,8 +8415,6 @@ static struct kvm_x86_ops vmx_x86_ops __initdata = { - .check_intercept = vmx_check_intercept, - .handle_exit_irqoff = vmx_handle_exit_irqoff, - -- .request_immediate_exit = vmx_request_immediate_exit, -- - .sched_in = vmx_sched_in, - - .cpu_dirty_log_size = PML_ENTITY_NUM, -@@ -8623,7 +8672,6 @@ static __init int hardware_setup(void) - if (!enable_preemption_timer) { - vmx_x86_ops.set_hv_timer = NULL; - vmx_x86_ops.cancel_hv_timer = NULL; -- vmx_x86_ops.request_immediate_exit = __kvm_request_immediate_exit; - } - - kvm_caps.supported_mce_cap |= MCG_LMCE_P; -diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h -index 6be1627d888e5a..5d73d3e570d782 100644 ---- a/arch/x86/kvm/vmx/vmx.h -+++ b/arch/x86/kvm/vmx/vmx.h -@@ -177,6 +177,7 @@ struct nested_vmx { - bool reload_vmcs01_apic_access_page; - bool update_vmcs01_cpu_dirty_logging; - bool update_vmcs01_apicv_status; -+ bool update_vmcs01_hwapic_isr; - - /* - * Enlightened VMCS has been enabled. It does not mean that L1 has to -@@ -330,8 +331,6 @@ struct vcpu_vmx { - unsigned int ple_window; - bool ple_window_dirty; - -- bool req_immediate_exit; -- - /* Support for PML */ - #define PML_ENTITY_NUM 512 - struct page *pml_pg; -@@ -339,8 +338,6 @@ struct vcpu_vmx { - /* apic deadline value in host tsc */ - u64 hv_deadline_tsc; - -- unsigned long host_debugctlmsr; -- - /* - * Only bits masked by msr_ia32_feature_control_valid_bits can be set in - * msr_ia32_feature_control. FEAT_CTL_LOCKED is always included -@@ -432,6 +429,32 @@ static inline void vmx_set_intercept_for_msr(struct kvm_vcpu *vcpu, u32 msr, - - void vmx_update_cpu_dirty_logging(struct kvm_vcpu *vcpu); - -+u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated); -+bool vmx_is_valid_debugctl(struct kvm_vcpu *vcpu, u64 data, bool host_initiated); -+ -+static inline void vmx_guest_debugctl_write(struct kvm_vcpu *vcpu, u64 val) -+{ -+ WARN_ON_ONCE(val & DEBUGCTLMSR_FREEZE_IN_SMM); -+ -+ val |= vcpu->arch.host_debugctl & DEBUGCTLMSR_FREEZE_IN_SMM; -+ vmcs_write64(GUEST_IA32_DEBUGCTL, val); -+} -+ -+static inline u64 vmx_guest_debugctl_read(void) -+{ -+ return vmcs_read64(GUEST_IA32_DEBUGCTL) & ~DEBUGCTLMSR_FREEZE_IN_SMM; -+} -+ -+static inline void vmx_reload_guest_debugctl(struct kvm_vcpu *vcpu) -+{ -+ u64 val = vmcs_read64(GUEST_IA32_DEBUGCTL); -+ -+ if (!((val ^ vcpu->arch.host_debugctl) & DEBUGCTLMSR_FREEZE_IN_SMM)) -+ return; -+ -+ vmx_guest_debugctl_write(vcpu, val & ~DEBUGCTLMSR_FREEZE_IN_SMM); -+} -+ - /* - * Note, early Intel manuals have the write-low and read-high bitmap offsets - * the wrong way round. The bitmaps control MSRs 0x00000000-0x00001fff and -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 55185670e0e566..af0b2b3bc991e2 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -10505,12 +10505,6 @@ static void kvm_vcpu_reload_apic_access_page(struct kvm_vcpu *vcpu) - static_call_cond(kvm_x86_set_apic_access_page_addr)(vcpu); - } - --void __kvm_request_immediate_exit(struct kvm_vcpu *vcpu) --{ -- smp_send_reschedule(vcpu->cpu); --} --EXPORT_SYMBOL_GPL(__kvm_request_immediate_exit); -- - /* - * Called within kvm->srcu read side. - * Returns 1 to let vcpu_run() continue the guest execution loop without -@@ -10524,6 +10518,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) - dm_request_for_irq_injection(vcpu) && - kvm_cpu_accept_dm_intr(vcpu); - fastpath_t exit_fastpath; -+ u64 run_flags, debug_ctl; - - bool req_immediate_exit = false; - -@@ -10756,9 +10751,10 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) - goto cancel_injection; - } - -+ run_flags = 0; - if (req_immediate_exit) { -+ run_flags |= KVM_RUN_FORCE_IMMEDIATE_EXIT; - kvm_make_request(KVM_REQ_EVENT, vcpu); -- static_call(kvm_x86_request_immediate_exit)(vcpu); - } - - fpregs_assert_state_consistent(); -@@ -10776,11 +10772,23 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) - set_debugreg(vcpu->arch.eff_db[3], 3); - /* When KVM_DEBUGREG_WONT_EXIT, dr6 is accessible in guest. */ - if (unlikely(vcpu->arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT)) -- static_call(kvm_x86_set_dr6)(vcpu, vcpu->arch.dr6); -+ run_flags |= KVM_RUN_LOAD_GUEST_DR6; - } else if (unlikely(hw_breakpoint_active())) { - set_debugreg(0, 7); - } - -+ /* -+ * Refresh the host DEBUGCTL snapshot after disabling IRQs, as DEBUGCTL -+ * can be modified in IRQ context, e.g. via SMP function calls. Inform -+ * vendor code if any host-owned bits were changed, e.g. so that the -+ * value loaded into hardware while running the guest can be updated. -+ */ -+ debug_ctl = get_debugctlmsr(); -+ if ((debug_ctl ^ vcpu->arch.host_debugctl) & kvm_x86_ops.HOST_OWNED_DEBUGCTL && -+ !vcpu->arch.guest_state_protected) -+ run_flags |= KVM_RUN_LOAD_DEBUGCTL; -+ vcpu->arch.host_debugctl = debug_ctl; -+ - guest_timing_enter_irqoff(); - - for (;;) { -@@ -10793,7 +10801,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) - WARN_ON_ONCE((kvm_vcpu_apicv_activated(vcpu) != kvm_vcpu_apicv_active(vcpu)) && - (kvm_get_apic_mode(vcpu) != LAPIC_MODE_DISABLED)); - -- exit_fastpath = static_call(kvm_x86_vcpu_run)(vcpu); -+ exit_fastpath = static_call(kvm_x86_vcpu_run)(vcpu, run_flags); - if (likely(exit_fastpath != EXIT_FASTPATH_REENTER_GUEST)) - break; - -@@ -10805,6 +10813,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) - break; - } - -+ run_flags = 0; -+ - /* Note, VM-Exits that go down the "slow" path are accounted below. */ - ++vcpu->stat.exits; - } -@@ -13256,16 +13266,22 @@ int kvm_arch_irq_bypass_add_producer(struct irq_bypass_consumer *cons, - { - struct kvm_kernel_irqfd *irqfd = - container_of(cons, struct kvm_kernel_irqfd, consumer); -+ struct kvm *kvm = irqfd->kvm; - int ret; - -- irqfd->producer = prod; - kvm_arch_start_assignment(irqfd->kvm); -+ -+ spin_lock_irq(&kvm->irqfds.lock); -+ irqfd->producer = prod; -+ - ret = static_call(kvm_x86_pi_update_irte)(irqfd->kvm, - prod->irq, irqfd->gsi, 1); -- - if (ret) - kvm_arch_end_assignment(irqfd->kvm); - -+ spin_unlock_irq(&kvm->irqfds.lock); -+ -+ - return ret; - } - -@@ -13275,9 +13291,9 @@ void kvm_arch_irq_bypass_del_producer(struct irq_bypass_consumer *cons, - int ret; - struct kvm_kernel_irqfd *irqfd = - container_of(cons, struct kvm_kernel_irqfd, consumer); -+ struct kvm *kvm = irqfd->kvm; - - WARN_ON(irqfd->producer != prod); -- irqfd->producer = NULL; - - /* - * When producer of consumer is unregistered, we change back to -@@ -13285,11 +13301,17 @@ void kvm_arch_irq_bypass_del_producer(struct irq_bypass_consumer *cons, - * when the irq is masked/disabled or the consumer side (KVM - * int this case doesn't want to receive the interrupts. - */ -+ spin_lock_irq(&kvm->irqfds.lock); -+ irqfd->producer = NULL; -+ - ret = static_call(kvm_x86_pi_update_irte)(irqfd->kvm, prod->irq, irqfd->gsi, 0); - if (ret) - printk(KERN_INFO "irq bypass consumer (token %p) unregistration" - " fails: %d\n", irqfd->consumer.token, ret); - -+ spin_unlock_irq(&kvm->irqfds.lock); -+ -+ - kvm_arch_end_assignment(irqfd->kvm); - } - -diff --git a/block/blk-core.c b/block/blk-core.c -index 4f25d2c4bc7055..923b7d91e6dc5d 100644 ---- a/block/blk-core.c -+++ b/block/blk-core.c -@@ -775,6 +775,15 @@ void submit_bio_noacct(struct bio *bio) - bio_clear_polled(bio); - - switch (bio_op(bio)) { -+ case REQ_OP_READ: -+ case REQ_OP_WRITE: -+ break; -+ case REQ_OP_FLUSH: -+ /* -+ * REQ_OP_FLUSH can't be submitted through bios, it is only -+ * synthetized in struct request by the flush state machine. -+ */ -+ goto not_supported; - case REQ_OP_DISCARD: - if (!bdev_max_discard_sectors(bdev)) - goto not_supported; -@@ -788,6 +797,10 @@ void submit_bio_noacct(struct bio *bio) - if (status != BLK_STS_OK) - goto end_io; - break; -+ case REQ_OP_WRITE_ZEROES: -+ if (!q->limits.max_write_zeroes_sectors) -+ goto not_supported; -+ break; - case REQ_OP_ZONE_RESET: - case REQ_OP_ZONE_OPEN: - case REQ_OP_ZONE_CLOSE: -@@ -799,12 +812,15 @@ void submit_bio_noacct(struct bio *bio) - if (!bdev_is_zoned(bio->bi_bdev) || !blk_queue_zone_resetall(q)) - goto not_supported; - break; -- case REQ_OP_WRITE_ZEROES: -- if (!q->limits.max_write_zeroes_sectors) -- goto not_supported; -- break; -+ case REQ_OP_DRV_IN: -+ case REQ_OP_DRV_OUT: -+ /* -+ * Driver private operations are only used with passthrough -+ * requests. -+ */ -+ fallthrough; - default: -- break; -+ goto not_supported; - } - - if (blk_throtl_bio(bio)) -diff --git a/block/blk-settings.c b/block/blk-settings.c -index 7019b8e204d965..021994f6d2d829 100644 ---- a/block/blk-settings.c -+++ b/block/blk-settings.c -@@ -634,7 +634,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, - } - - /* chunk_sectors a multiple of the physical block size? */ -- if ((t->chunk_sectors << 9) & (t->physical_block_size - 1)) { -+ if (t->chunk_sectors % (t->physical_block_size >> SECTOR_SHIFT)) { - t->chunk_sectors = 0; - t->misaligned = 1; - ret = -1; -diff --git a/crypto/jitterentropy-kcapi.c b/crypto/jitterentropy-kcapi.c -index 7d1463a1562acb..dd05faf00571f3 100644 ---- a/crypto/jitterentropy-kcapi.c -+++ b/crypto/jitterentropy-kcapi.c -@@ -134,7 +134,7 @@ int jent_hash_time(void *hash_state, __u64 time, u8 *addtl, - * Inject the data from the previous loop into the pool. This data is - * not considered to contain any entropy, but it stirs the pool a bit. - */ -- ret = crypto_shash_update(desc, intermediary, sizeof(intermediary)); -+ ret = crypto_shash_update(hash_state_desc, intermediary, sizeof(intermediary)); - if (ret) - goto err; - -@@ -147,11 +147,12 @@ int jent_hash_time(void *hash_state, __u64 time, u8 *addtl, - * conditioning operation to have an identical amount of input data - * according to section 3.1.5. - */ -- if (!stuck) { -- ret = crypto_shash_update(hash_state_desc, (u8 *)&time, -- sizeof(__u64)); -+ if (stuck) { -+ time = 0; - } - -+ ret = crypto_shash_update(hash_state_desc, (u8 *)&time, sizeof(__u64)); -+ - err: - shash_desc_zero(desc); - memzero_explicit(intermediary, sizeof(intermediary)); -diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c -index 7053f1b9fc1ddc..c0f9cf9768ea9a 100644 ---- a/drivers/acpi/acpi_processor.c -+++ b/drivers/acpi/acpi_processor.c -@@ -250,7 +250,7 @@ static inline int acpi_processor_hotadd_init(struct acpi_processor *pr) - - static int acpi_processor_get_info(struct acpi_device *device) - { -- union acpi_object object = { 0 }; -+ union acpi_object object = { .processor = { 0 } }; - struct acpi_buffer buffer = { sizeof(union acpi_object), &object }; - struct acpi_processor *pr = acpi_driver_data(device); - int device_declaration = 0; -diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c -index 2abf20736702c0..ec364c2541124d 100644 ---- a/drivers/acpi/apei/ghes.c -+++ b/drivers/acpi/apei/ghes.c -@@ -715,6 +715,17 @@ static bool ghes_do_proc(struct ghes *ghes, - } - } - -+ /* -+ * If no memory failure work is queued for abnormal synchronous -+ * errors, do a force kill. -+ */ -+ if (sync && !queued) { -+ dev_err(ghes->dev, -+ HW_ERR GHES_PFX "%s:%d: synchronous unrecoverable error (SIGBUS)\n", -+ current->comm, task_pid_nr(current)); -+ force_sig(SIGBUS); -+ } -+ - return queued; - } - -@@ -901,6 +912,8 @@ static void __ghes_panic(struct ghes *ghes, - - __ghes_print_estatus(KERN_EMERG, ghes->generic, estatus); - -+ add_taint(TAINT_MACHINE_CHECK, LOCKDEP_STILL_OK); -+ - ghes_clear_estatus(ghes, estatus, buf_paddr, fixmap_idx); - - if (!panic_timeout) -diff --git a/drivers/acpi/pfr_update.c b/drivers/acpi/pfr_update.c -index 98267f163e2bd0..aedf7e40145e06 100644 ---- a/drivers/acpi/pfr_update.c -+++ b/drivers/acpi/pfr_update.c -@@ -310,7 +310,7 @@ static bool applicable_image(const void *data, struct pfru_update_cap_info *cap, - if (type == PFRU_CODE_INJECT_TYPE) - return payload_hdr->rt_ver >= cap->code_rt_version; - -- return payload_hdr->rt_ver >= cap->drv_rt_version; -+ return payload_hdr->svn_ver >= cap->drv_svn; - } - - static void print_update_debug_info(struct pfru_updated_result *result, -diff --git a/drivers/acpi/prmt.c b/drivers/acpi/prmt.c -index a34f7d37877c9a..eb8f2a1ce1388d 100644 ---- a/drivers/acpi/prmt.c -+++ b/drivers/acpi/prmt.c -@@ -85,8 +85,6 @@ static u64 efi_pa_va_lookup(efi_guid_t *guid, u64 pa) - } - } - -- pr_warn("Failed to find VA for GUID: %pUL, PA: 0x%llx", guid, pa); -- - return 0; - } - -@@ -154,13 +152,37 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end) - guid_copy(&th->guid, (guid_t *)handler_info->handler_guid); - th->handler_addr = - (void *)efi_pa_va_lookup(&th->guid, handler_info->handler_address); -+ /* -+ * Print a warning message if handler_addr is zero which is not expected to -+ * ever happen. -+ */ -+ if (unlikely(!th->handler_addr)) -+ pr_warn("Failed to find VA of handler for GUID: %pUL, PA: 0x%llx", -+ &th->guid, handler_info->handler_address); - - th->static_data_buffer_addr = - efi_pa_va_lookup(&th->guid, handler_info->static_data_buffer_address); -+ /* -+ * According to the PRM specification, static_data_buffer_address can be zero, -+ * so avoid printing a warning message in that case. Otherwise, if the -+ * return value of efi_pa_va_lookup() is zero, print the message. -+ */ -+ if (unlikely(!th->static_data_buffer_addr && handler_info->static_data_buffer_address)) -+ pr_warn("Failed to find VA of static data buffer for GUID: %pUL, PA: 0x%llx", -+ &th->guid, handler_info->static_data_buffer_address); - - th->acpi_param_buffer_addr = - efi_pa_va_lookup(&th->guid, handler_info->acpi_param_buffer_address); - -+ /* -+ * According to the PRM specification, acpi_param_buffer_address can be zero, -+ * so avoid printing a warning message in that case. Otherwise, if the -+ * return value of efi_pa_va_lookup() is zero, print the message. -+ */ -+ if (unlikely(!th->acpi_param_buffer_addr && handler_info->acpi_param_buffer_address)) -+ pr_warn("Failed to find VA of acpi param buffer for GUID: %pUL, PA: 0x%llx", -+ &th->guid, handler_info->acpi_param_buffer_address); -+ - } while (++cur_handler < tm->handler_count && (handler_info = get_next_handler(handler_info))); - - return 0; -diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c -index 4265814c74f81a..d81f30ce2341a0 100644 ---- a/drivers/acpi/processor_perflib.c -+++ b/drivers/acpi/processor_perflib.c -@@ -174,6 +174,9 @@ void acpi_processor_ppc_init(struct cpufreq_policy *policy) - { - unsigned int cpu; - -+ if (ignore_ppc == 1) -+ return; -+ - for_each_cpu(cpu, policy->related_cpus) { - struct acpi_processor *pr = per_cpu(processors, cpu); - int ret; -@@ -194,6 +197,14 @@ void acpi_processor_ppc_init(struct cpufreq_policy *policy) - if (ret < 0) - pr_err("Failed to add freq constraint for CPU%d (%d)\n", - cpu, ret); -+ -+ if (!pr->performance) -+ continue; -+ -+ ret = acpi_processor_get_platform_limit(pr); -+ if (ret) -+ pr_err("Failed to update freq constraint for CPU%d (%d)\n", -+ cpu, ret); - } - } - -diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig -index 42b51c9812a0eb..188707d2970ef7 100644 ---- a/drivers/ata/Kconfig -+++ b/drivers/ata/Kconfig -@@ -117,7 +117,7 @@ config SATA_AHCI - - config SATA_MOBILE_LPM_POLICY - int "Default SATA Link Power Management policy for low power chipsets" -- range 0 4 -+ range 0 5 - default 0 - depends on SATA_AHCI - help -@@ -126,15 +126,32 @@ config SATA_MOBILE_LPM_POLICY - chipsets are typically found on most laptops but desktops and - servers now also widely use chipsets supporting low power modes. - -- The value set has the following meanings: -+ Each policy combines power saving states and features: -+ - Partial: The Phy logic is powered but is in a reduced power -+ state. The exit latency from this state is no longer than -+ 10us). -+ - Slumber: The Phy logic is powered but is in an even lower power -+ state. The exit latency from this state is potentially -+ longer, but no longer than 10ms. -+ - DevSleep: The Phy logic may be powered down. The exit latency from -+ this state is no longer than 20 ms, unless otherwise -+ specified by DETO in the device Identify Device Data log. -+ - HIPM: Host Initiated Power Management (host automatically -+ transitions to partial and slumber). -+ - DIPM: Device Initiated Power Management (device automatically -+ transitions to partial and slumber). -+ -+ The possible values for the default SATA link power management -+ policies are: - 0 => Keep firmware settings -- 1 => Maximum performance -- 2 => Medium power -- 3 => Medium power with Device Initiated PM enabled -- 4 => Minimum power -- -- Note "Minimum power" is known to cause issues, including disk -- corruption, with some disks and should not be used. -+ 1 => No power savings (maximum performance) -+ 2 => HIPM (Partial) -+ 3 => HIPM (Partial) and DIPM (Partial and Slumber) -+ 4 => HIPM (Partial and DevSleep) and DIPM (Partial and Slumber) -+ 5 => HIPM (Slumber and DevSleep) and DIPM (Partial and Slumber) -+ -+ Excluding the value 0, higher values represent policies with higher -+ power savings. - - config SATA_AHCI_PLATFORM - tristate "Platform AHCI SATA support" -diff --git a/drivers/ata/libata-sata.c b/drivers/ata/libata-sata.c -index be72030a500d44..9e0a820d6961d0 100644 ---- a/drivers/ata/libata-sata.c -+++ b/drivers/ata/libata-sata.c -@@ -817,6 +817,11 @@ static ssize_t ata_scsi_lpm_store(struct device *device, - - spin_lock_irqsave(ap->lock, flags); - -+ if (ap->flags & ATA_FLAG_NO_LPM) { -+ count = -EOPNOTSUPP; -+ goto out_unlock; -+ } -+ - ata_for_each_link(link, ap, EDGE) { - ata_for_each_dev(dev, &ap->link, ENABLED) { - if (dev->horkage & ATA_HORKAGE_NOLPM) { -diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c -index 6a1460d35447cc..0b2f1e269ca496 100644 ---- a/drivers/ata/libata-scsi.c -+++ b/drivers/ata/libata-scsi.c -@@ -856,18 +856,14 @@ static void ata_to_sense_error(unsigned id, u8 drv_stat, u8 drv_err, u8 *sk, - {0xFF, 0xFF, 0xFF, 0xFF}, // END mark - }; - static const unsigned char stat_table[][4] = { -- /* Must be first because BUSY means no other bits valid */ -- {0x80, ABORTED_COMMAND, 0x47, 0x00}, -- // Busy, fake parity for now -- {0x40, ILLEGAL_REQUEST, 0x21, 0x04}, -- // Device ready, unaligned write command -- {0x20, HARDWARE_ERROR, 0x44, 0x00}, -- // Device fault, internal target failure -- {0x08, ABORTED_COMMAND, 0x47, 0x00}, -- // Timed out in xfer, fake parity for now -- {0x04, RECOVERED_ERROR, 0x11, 0x00}, -- // Recovered ECC error Medium error, recovered -- {0xFF, 0xFF, 0xFF, 0xFF}, // END mark -+ /* Busy: must be first because BUSY means no other bits valid */ -+ { ATA_BUSY, ABORTED_COMMAND, 0x00, 0x00 }, -+ /* Device fault: INTERNAL TARGET FAILURE */ -+ { ATA_DF, HARDWARE_ERROR, 0x44, 0x00 }, -+ /* Corrected data error */ -+ { ATA_CORR, RECOVERED_ERROR, 0x00, 0x00 }, -+ -+ { 0xFF, 0xFF, 0xFF, 0xFF }, /* END mark */ - }; - - /* -@@ -939,6 +935,8 @@ static void ata_gen_passthru_sense(struct ata_queued_cmd *qc) - if (!(qc->flags & ATA_QCFLAG_RTF_FILLED)) { - ata_dev_dbg(dev, - "missing result TF: can't generate ATA PT sense data\n"); -+ if (qc->err_mask) -+ ata_scsi_set_sense(dev, cmd, ABORTED_COMMAND, 0, 0); - return; - } - -@@ -996,8 +994,8 @@ static void ata_gen_ata_sense(struct ata_queued_cmd *qc) - - if (!(qc->flags & ATA_QCFLAG_RTF_FILLED)) { - ata_dev_dbg(dev, -- "missing result TF: can't generate sense data\n"); -- return; -+ "Missing result TF: reporting aborted command\n"); -+ goto aborted; - } - - /* Use ata_to_sense_error() to map status register bits -@@ -1008,19 +1006,20 @@ static void ata_gen_ata_sense(struct ata_queued_cmd *qc) - ata_to_sense_error(qc->ap->print_id, tf->status, tf->error, - &sense_key, &asc, &ascq); - ata_scsi_set_sense(dev, cmd, sense_key, asc, ascq); -- } else { -- /* Could not decode error */ -- ata_dev_warn(dev, "could not decode error status 0x%x err_mask 0x%x\n", -- tf->status, qc->err_mask); -- ata_scsi_set_sense(dev, cmd, ABORTED_COMMAND, 0, 0); -- return; -- } - -- block = ata_tf_read_block(&qc->result_tf, dev); -- if (block == U64_MAX) -+ block = ata_tf_read_block(&qc->result_tf, dev); -+ if (block != U64_MAX) -+ scsi_set_sense_information(sb, SCSI_SENSE_BUFFERSIZE, -+ block); - return; -+ } - -- scsi_set_sense_information(sb, SCSI_SENSE_BUFFERSIZE, block); -+ /* Could not decode error */ -+ ata_dev_warn(dev, -+ "Could not decode error 0x%x, status 0x%x (err_mask=0x%x)\n", -+ tf->error, tf->status, qc->err_mask); -+aborted: -+ ata_scsi_set_sense(dev, cmd, ABORTED_COMMAND, 0, 0); - } - - void ata_scsi_sdev_config(struct scsi_device *sdev) -@@ -3786,21 +3785,16 @@ static int ata_mselect_control_ata_feature(struct ata_queued_cmd *qc, - /* Check cdl_ctrl */ - switch (buf[0] & 0x03) { - case 0: -- /* Disable CDL if it is enabled */ -- if (!(dev->flags & ATA_DFLAG_CDL_ENABLED)) -- return 0; -+ /* Disable CDL */ - ata_dev_dbg(dev, "Disabling CDL\n"); - cdl_action = 0; - dev->flags &= ~ATA_DFLAG_CDL_ENABLED; - break; - case 0x02: - /* -- * Enable CDL if not already enabled. Since this is mutually -- * exclusive with NCQ priority, allow this only if NCQ priority -- * is disabled. -+ * Enable CDL. Since CDL is mutually exclusive with NCQ -+ * priority, allow this only if NCQ priority is disabled. - */ -- if (dev->flags & ATA_DFLAG_CDL_ENABLED) -- return 0; - if (dev->flags & ATA_DFLAG_NCQ_PRIO_ENABLED) { - ata_dev_err(dev, - "NCQ priority must be disabled to enable CDL\n"); -diff --git a/drivers/base/arch_topology.c b/drivers/base/arch_topology.c -index b741b5ba82bd6e..2aa0c642529021 100644 ---- a/drivers/base/arch_topology.c -+++ b/drivers/base/arch_topology.c -@@ -19,6 +19,7 @@ - #include - #include - #include -+#include - - #define CREATE_TRACE_POINTS - #include -@@ -26,7 +27,8 @@ - static DEFINE_PER_CPU(struct scale_freq_data __rcu *, sft_data); - static struct cpumask scale_freq_counters_mask; - static bool scale_freq_invariant; --static DEFINE_PER_CPU(u32, freq_factor) = 1; -+DEFINE_PER_CPU(unsigned long, capacity_freq_ref) = 1; -+EXPORT_PER_CPU_SYMBOL_GPL(capacity_freq_ref); - - static bool supports_scale_freq_counters(const struct cpumask *cpus) - { -@@ -170,9 +172,9 @@ DEFINE_PER_CPU(unsigned long, thermal_pressure); - * operating on stale data when hot-plug is used for some CPUs. The - * @capped_freq reflects the currently allowed max CPUs frequency due to - * thermal capping. It might be also a boost frequency value, which is bigger -- * than the internal 'freq_factor' max frequency. In such case the pressure -- * value should simply be removed, since this is an indication that there is -- * no thermal throttling. The @capped_freq must be provided in kHz. -+ * than the internal 'capacity_freq_ref' max frequency. In such case the -+ * pressure value should simply be removed, since this is an indication that -+ * there is no thermal throttling. The @capped_freq must be provided in kHz. - */ - void topology_update_thermal_pressure(const struct cpumask *cpus, - unsigned long capped_freq) -@@ -183,10 +185,7 @@ void topology_update_thermal_pressure(const struct cpumask *cpus, - - cpu = cpumask_first(cpus); - max_capacity = arch_scale_cpu_capacity(cpu); -- max_freq = per_cpu(freq_factor, cpu); -- -- /* Convert to MHz scale which is used in 'freq_factor' */ -- capped_freq /= 1000; -+ max_freq = arch_scale_freq_ref(cpu); - - /* - * Handle properly the boost frequencies, which should simply clean -@@ -279,13 +278,13 @@ void topology_normalize_cpu_scale(void) - - capacity_scale = 1; - for_each_possible_cpu(cpu) { -- capacity = raw_capacity[cpu] * per_cpu(freq_factor, cpu); -+ capacity = raw_capacity[cpu] * per_cpu(capacity_freq_ref, cpu); - capacity_scale = max(capacity, capacity_scale); - } - - pr_debug("cpu_capacity: capacity_scale=%llu\n", capacity_scale); - for_each_possible_cpu(cpu) { -- capacity = raw_capacity[cpu] * per_cpu(freq_factor, cpu); -+ capacity = raw_capacity[cpu] * per_cpu(capacity_freq_ref, cpu); - capacity = div64_u64(capacity << SCHED_CAPACITY_SHIFT, - capacity_scale); - topology_set_cpu_scale(cpu, capacity); -@@ -321,15 +320,15 @@ bool __init topology_parse_cpu_capacity(struct device_node *cpu_node, int cpu) - cpu_node, raw_capacity[cpu]); - - /* -- * Update freq_factor for calculating early boot cpu capacities. -+ * Update capacity_freq_ref for calculating early boot CPU capacities. - * For non-clk CPU DVFS mechanism, there's no way to get the - * frequency value now, assuming they are running at the same -- * frequency (by keeping the initial freq_factor value). -+ * frequency (by keeping the initial capacity_freq_ref value). - */ - cpu_clk = of_clk_get(cpu_node, 0); - if (!PTR_ERR_OR_ZERO(cpu_clk)) { -- per_cpu(freq_factor, cpu) = -- clk_get_rate(cpu_clk) / 1000; -+ per_cpu(capacity_freq_ref, cpu) = -+ clk_get_rate(cpu_clk) / HZ_PER_KHZ; - clk_put(cpu_clk); - } - } else { -@@ -345,11 +344,16 @@ bool __init topology_parse_cpu_capacity(struct device_node *cpu_node, int cpu) - return !ret; - } - -+void __weak freq_inv_set_max_ratio(int cpu, u64 max_rate) -+{ -+} -+ - #ifdef CONFIG_ACPI_CPPC_LIB - #include - - void topology_init_cpu_capacity_cppc(void) - { -+ u64 capacity, capacity_scale = 0; - struct cppc_perf_caps perf_caps; - int cpu; - -@@ -366,6 +370,10 @@ void topology_init_cpu_capacity_cppc(void) - (perf_caps.highest_perf >= perf_caps.nominal_perf) && - (perf_caps.highest_perf >= perf_caps.lowest_perf)) { - raw_capacity[cpu] = perf_caps.highest_perf; -+ capacity_scale = max_t(u64, capacity_scale, raw_capacity[cpu]); -+ -+ per_cpu(capacity_freq_ref, cpu) = cppc_perf_to_khz(&perf_caps, raw_capacity[cpu]); -+ - pr_debug("cpu_capacity: CPU%d cpu_capacity=%u (raw).\n", - cpu, raw_capacity[cpu]); - continue; -@@ -376,7 +384,18 @@ void topology_init_cpu_capacity_cppc(void) - goto exit; - } - -- topology_normalize_cpu_scale(); -+ for_each_possible_cpu(cpu) { -+ freq_inv_set_max_ratio(cpu, -+ per_cpu(capacity_freq_ref, cpu) * HZ_PER_KHZ); -+ -+ capacity = raw_capacity[cpu]; -+ capacity = div64_u64(capacity << SCHED_CAPACITY_SHIFT, -+ capacity_scale); -+ topology_set_cpu_scale(cpu, capacity); -+ pr_debug("cpu_capacity: CPU%d cpu_capacity=%lu\n", -+ cpu, topology_get_cpu_scale(cpu)); -+ } -+ - schedule_work(&update_topology_flags_work); - pr_debug("cpu_capacity: cpu_capacity initialization done\n"); - -@@ -398,9 +417,6 @@ init_cpu_capacity_callback(struct notifier_block *nb, - struct cpufreq_policy *policy = data; - int cpu; - -- if (!raw_capacity) -- return 0; -- - if (val != CPUFREQ_CREATE_POLICY) - return 0; - -@@ -410,13 +426,18 @@ init_cpu_capacity_callback(struct notifier_block *nb, - - cpumask_andnot(cpus_to_visit, cpus_to_visit, policy->related_cpus); - -- for_each_cpu(cpu, policy->related_cpus) -- per_cpu(freq_factor, cpu) = policy->cpuinfo.max_freq / 1000; -+ for_each_cpu(cpu, policy->related_cpus) { -+ per_cpu(capacity_freq_ref, cpu) = policy->cpuinfo.max_freq; -+ freq_inv_set_max_ratio(cpu, -+ per_cpu(capacity_freq_ref, cpu) * HZ_PER_KHZ); -+ } - - if (cpumask_empty(cpus_to_visit)) { -- topology_normalize_cpu_scale(); -- schedule_work(&update_topology_flags_work); -- free_raw_capacity(); -+ if (raw_capacity) { -+ topology_normalize_cpu_scale(); -+ schedule_work(&update_topology_flags_work); -+ free_raw_capacity(); -+ } - pr_debug("cpu_capacity: parsing done\n"); - schedule_work(&parsing_done_work); - } -@@ -436,7 +457,7 @@ static int __init register_cpufreq_notifier(void) - * On ACPI-based systems skip registering cpufreq notifier as cpufreq - * information is not needed for cpu capacity initialization. - */ -- if (!acpi_disabled || !raw_capacity) -+ if (!acpi_disabled) - return -EINVAL; - - if (!alloc_cpumask_var(&cpus_to_visit, GFP_KERNEL)) -diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c -index 0d43bf5b6cecbf..f53c14fb74fda7 100644 ---- a/drivers/base/power/runtime.c -+++ b/drivers/base/power/runtime.c -@@ -1175,16 +1175,18 @@ int __pm_runtime_resume(struct device *dev, int rpmflags) - EXPORT_SYMBOL_GPL(__pm_runtime_resume); - - /** -- * pm_runtime_get_if_active - Conditionally bump up device usage counter. -+ * pm_runtime_get_conditional - Conditionally bump up device usage counter. - * @dev: Device to handle. - * @ign_usage_count: Whether or not to look at the current usage counter value. - * - * Return -EINVAL if runtime PM is disabled for @dev. - * -- * Otherwise, if the runtime PM status of @dev is %RPM_ACTIVE and either -- * @ign_usage_count is %true or the runtime PM usage counter of @dev is not -- * zero, increment the usage counter of @dev and return 1. Otherwise, return 0 -- * without changing the usage counter. -+ * Otherwise, if its runtime PM status is %RPM_ACTIVE and (1) @ign_usage_count -+ * is set, or (2) @dev is not ignoring children and its active child count is -+ * nonero, or (3) the runtime PM usage counter of @dev is not zero, increment -+ * the usage counter of @dev and return 1. -+ * -+ * Otherwise, return 0 without changing the usage counter. - * - * If @ign_usage_count is %true, this function can be used to prevent suspending - * the device when its runtime PM status is %RPM_ACTIVE. -@@ -1196,7 +1198,7 @@ EXPORT_SYMBOL_GPL(__pm_runtime_resume); - * The caller is responsible for decrementing the runtime PM usage counter of - * @dev after this function has returned a positive value for it. - */ --int pm_runtime_get_if_active(struct device *dev, bool ign_usage_count) -+static int pm_runtime_get_conditional(struct device *dev, bool ign_usage_count) - { - unsigned long flags; - int retval; -@@ -1206,7 +1208,8 @@ int pm_runtime_get_if_active(struct device *dev, bool ign_usage_count) - retval = -EINVAL; - } else if (dev->power.runtime_status != RPM_ACTIVE) { - retval = 0; -- } else if (ign_usage_count) { -+ } else if (ign_usage_count || (!dev->power.ignore_children && -+ atomic_read(&dev->power.child_count) > 0)) { - retval = 1; - atomic_inc(&dev->power.usage_count); - } else { -@@ -1217,8 +1220,45 @@ int pm_runtime_get_if_active(struct device *dev, bool ign_usage_count) - - return retval; - } -+ -+/** -+ * pm_runtime_get_if_active - Bump up runtime PM usage counter if the device is -+ * in active state -+ * @dev: Target device. -+ * -+ * Increment the runtime PM usage counter of @dev if its runtime PM status is -+ * %RPM_ACTIVE, in which case it returns 1. If the device is in a different -+ * state, 0 is returned. -EINVAL is returned if runtime PM is disabled for the -+ * device, in which case also the usage_count will remain unmodified. -+ */ -+int pm_runtime_get_if_active(struct device *dev) -+{ -+ return pm_runtime_get_conditional(dev, true); -+} - EXPORT_SYMBOL_GPL(pm_runtime_get_if_active); - -+/** -+ * pm_runtime_get_if_in_use - Conditionally bump up runtime PM usage counter. -+ * @dev: Target device. -+ * -+ * Increment the runtime PM usage counter of @dev if its runtime PM status is -+ * %RPM_ACTIVE and its runtime PM usage counter is greater than 0 or it is not -+ * ignoring children and its active child count is nonzero. 1 is returned in -+ * this case. -+ * -+ * If @dev is in a different state or it is not in use (that is, its usage -+ * counter is 0, or it is ignoring children, or its active child count is 0), -+ * 0 is returned. -+ * -+ * -EINVAL is returned if runtime PM is disabled for the device, in which case -+ * also the usage counter of @dev is not updated. -+ */ -+int pm_runtime_get_if_in_use(struct device *dev) -+{ -+ return pm_runtime_get_conditional(dev, false); -+} -+EXPORT_SYMBOL_GPL(pm_runtime_get_if_in_use); -+ - /** - * __pm_runtime_set_status - Set runtime PM status of a device. - * @dev: Device to handle. -@@ -1754,6 +1794,11 @@ void pm_runtime_reinit(struct device *dev) - pm_runtime_put(dev->parent); - } - } -+ /* -+ * Clear power.needs_force_resume in case it has been set by -+ * pm_runtime_force_suspend() invoked from a driver remove callback. -+ */ -+ dev->power.needs_force_resume = false; - } - - /** -diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c -index 0c9f54197768d6..ac18d36b0ea84e 100644 ---- a/drivers/block/drbd/drbd_receiver.c -+++ b/drivers/block/drbd/drbd_receiver.c -@@ -2500,7 +2500,11 @@ static int handle_write_conflicts(struct drbd_device *device, - peer_req->w.cb = superseded ? e_send_superseded : - e_send_retry_write; - list_add_tail(&peer_req->w.list, &device->done_ee); -- queue_work(connection->ack_sender, &peer_req->peer_device->send_acks_work); -+ /* put is in drbd_send_acks_wf() */ -+ kref_get(&device->kref); -+ if (!queue_work(connection->ack_sender, -+ &peer_req->peer_device->send_acks_work)) -+ kref_put(&device->kref, drbd_destroy_device); - - err = -ENOENT; - goto out; -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index 455e2a2b149f4b..ed004e1610dd1f 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -1472,19 +1472,36 @@ static int loop_set_dio(struct loop_device *lo, unsigned long arg) - return error; - } - --static int loop_set_block_size(struct loop_device *lo, unsigned long arg) -+static int loop_set_block_size(struct loop_device *lo, blk_mode_t mode, -+ struct block_device *bdev, unsigned long arg) - { - int err = 0; - -- if (lo->lo_state != Lo_bound) -- return -ENXIO; -+ /* -+ * If we don't hold exclusive handle for the device, upgrade to it -+ * here to avoid changing device under exclusive owner. -+ */ -+ if (!(mode & BLK_OPEN_EXCL)) { -+ err = bd_prepare_to_claim(bdev, loop_set_block_size, NULL); -+ if (err) -+ return err; -+ } -+ -+ err = mutex_lock_killable(&lo->lo_mutex); -+ if (err) -+ goto abort_claim; -+ -+ if (lo->lo_state != Lo_bound) { -+ err = -ENXIO; -+ goto unlock; -+ } - - err = blk_validate_block_size(arg); - if (err) - return err; - - if (lo->lo_queue->limits.logical_block_size == arg) -- return 0; -+ goto unlock; - - sync_blockdev(lo->lo_device); - invalidate_bdev(lo->lo_device); -@@ -1496,6 +1513,11 @@ static int loop_set_block_size(struct loop_device *lo, unsigned long arg) - loop_update_dio(lo); - blk_mq_unfreeze_queue(lo->lo_queue); - -+unlock: -+ mutex_unlock(&lo->lo_mutex); -+abort_claim: -+ if (!(mode & BLK_OPEN_EXCL)) -+ bd_abort_claiming(bdev, loop_set_block_size); - return err; - } - -@@ -1514,9 +1536,6 @@ static int lo_simple_ioctl(struct loop_device *lo, unsigned int cmd, - case LOOP_SET_DIRECT_IO: - err = loop_set_dio(lo, arg); - break; -- case LOOP_SET_BLOCK_SIZE: -- err = loop_set_block_size(lo, arg); -- break; - default: - err = -EINVAL; - } -@@ -1571,9 +1590,12 @@ static int lo_ioctl(struct block_device *bdev, blk_mode_t mode, - break; - case LOOP_GET_STATUS64: - return loop_get_status64(lo, argp); -+ case LOOP_SET_BLOCK_SIZE: -+ if (!(mode & BLK_OPEN_WRITE) && !capable(CAP_SYS_ADMIN)) -+ return -EPERM; -+ return loop_set_block_size(lo, mode, bdev, arg); - case LOOP_SET_CAPACITY: - case LOOP_SET_DIRECT_IO: -- case LOOP_SET_BLOCK_SIZE: - if (!(mode & BLK_OPEN_WRITE) && !capable(CAP_SYS_ADMIN)) - return -EPERM; - fallthrough; -diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c -index 7bf4b48e2282e7..a379a37c944984 100644 ---- a/drivers/block/sunvdc.c -+++ b/drivers/block/sunvdc.c -@@ -956,8 +956,10 @@ static bool vdc_port_mpgroup_check(struct vio_dev *vdev) - dev = device_find_child(vdev->dev.parent, &port_data, - vdc_device_probed); - -- if (dev) -+ if (dev) { -+ put_device(dev); - return true; -+ } - - return false; - } -diff --git a/drivers/bus/mhi/host/boot.c b/drivers/bus/mhi/host/boot.c -index edc0ec5a093398..022571cfec5cb0 100644 ---- a/drivers/bus/mhi/host/boot.c -+++ b/drivers/bus/mhi/host/boot.c -@@ -31,8 +31,8 @@ int mhi_rddm_prepare(struct mhi_controller *mhi_cntrl, - int ret; - - for (i = 0; i < img_info->entries - 1; i++, mhi_buf++, bhi_vec++) { -- bhi_vec->dma_addr = mhi_buf->dma_addr; -- bhi_vec->size = mhi_buf->len; -+ bhi_vec->dma_addr = cpu_to_le64(mhi_buf->dma_addr); -+ bhi_vec->size = cpu_to_le64(mhi_buf->len); - } - - dev_dbg(dev, "BHIe programming for RDDM\n"); -@@ -375,8 +375,8 @@ static void mhi_firmware_copy(struct mhi_controller *mhi_cntrl, - while (remainder) { - to_cpy = min(remainder, mhi_buf->len); - memcpy(mhi_buf->buf, buf, to_cpy); -- bhi_vec->dma_addr = mhi_buf->dma_addr; -- bhi_vec->size = to_cpy; -+ bhi_vec->dma_addr = cpu_to_le64(mhi_buf->dma_addr); -+ bhi_vec->size = cpu_to_le64(to_cpy); - - buf += to_cpy; - remainder -= to_cpy; -diff --git a/drivers/bus/mhi/host/internal.h b/drivers/bus/mhi/host/internal.h -index d2858236af52b1..88c9bc11f17170 100644 ---- a/drivers/bus/mhi/host/internal.h -+++ b/drivers/bus/mhi/host/internal.h -@@ -31,8 +31,8 @@ struct mhi_ctxt { - }; - - struct bhi_vec_entry { -- u64 dma_addr; -- u64 size; -+ __le64 dma_addr; -+ __le64 size; - }; - - enum mhi_ch_state_type { -diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c -index ad1e97222a0f49..196929fff243e2 100644 ---- a/drivers/bus/mhi/host/main.c -+++ b/drivers/bus/mhi/host/main.c -@@ -603,7 +603,7 @@ static int parse_xfer_event(struct mhi_controller *mhi_cntrl, - { - dma_addr_t ptr = MHI_TRE_GET_EV_PTR(event); - struct mhi_ring_element *local_rp, *ev_tre; -- void *dev_rp; -+ void *dev_rp, *next_rp; - struct mhi_buf_info *buf_info; - u16 xfer_len; - -@@ -622,6 +622,16 @@ static int parse_xfer_event(struct mhi_controller *mhi_cntrl, - result.dir = mhi_chan->dir; - - local_rp = tre_ring->rp; -+ -+ next_rp = local_rp + 1; -+ if (next_rp >= tre_ring->base + tre_ring->len) -+ next_rp = tre_ring->base; -+ if (dev_rp != next_rp && !MHI_TRE_DATA_GET_CHAIN(local_rp)) { -+ dev_err(&mhi_cntrl->mhi_dev->dev, -+ "Event element points to an unexpected TRE\n"); -+ break; -+ } -+ - while (local_rp != dev_rp) { - buf_info = buf_ring->rp; - /* If it's the last TRE, get length from the event */ -diff --git a/drivers/cdx/controller/cdx_rpmsg.c b/drivers/cdx/controller/cdx_rpmsg.c -index 04b578a0be17c2..61f1a290ff0890 100644 ---- a/drivers/cdx/controller/cdx_rpmsg.c -+++ b/drivers/cdx/controller/cdx_rpmsg.c -@@ -129,8 +129,7 @@ static int cdx_rpmsg_probe(struct rpmsg_device *rpdev) - - chinfo.src = RPMSG_ADDR_ANY; - chinfo.dst = rpdev->dst; -- strscpy(chinfo.name, cdx_rpmsg_id_table[0].name, -- strlen(cdx_rpmsg_id_table[0].name)); -+ strscpy(chinfo.name, cdx_rpmsg_id_table[0].name, sizeof(chinfo.name)); - - cdx_mcdi->ept = rpmsg_create_ept(rpdev, cdx_rpmsg_cb, NULL, chinfo); - if (!cdx_mcdi->ept) { -diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c -index db8f1dadaa9f4f..96f175bd6d9fb7 100644 ---- a/drivers/char/ipmi/ipmi_msghandler.c -+++ b/drivers/char/ipmi/ipmi_msghandler.c -@@ -4618,10 +4618,10 @@ static int handle_one_recv_msg(struct ipmi_smi *intf, - * The NetFN and Command in the response is not even - * marginally correct. - */ -- dev_warn(intf->si_dev, -- "BMC returned incorrect response, expected netfn %x cmd %x, got netfn %x cmd %x\n", -- (msg->data[0] >> 2) | 1, msg->data[1], -- msg->rsp[0] >> 2, msg->rsp[1]); -+ dev_warn_ratelimited(intf->si_dev, -+ "BMC returned incorrect response, expected netfn %x cmd %x, got netfn %x cmd %x\n", -+ (msg->data[0] >> 2) | 1, msg->data[1], -+ msg->rsp[0] >> 2, msg->rsp[1]); - - goto return_unspecified; - } -diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c -index 9a459257489f0d..ca149ca8ccd669 100644 ---- a/drivers/char/ipmi/ipmi_watchdog.c -+++ b/drivers/char/ipmi/ipmi_watchdog.c -@@ -1190,14 +1190,8 @@ static struct ipmi_smi_watcher smi_watcher = { - .smi_gone = ipmi_smi_gone - }; - --static int action_op(const char *inval, char *outval) -+static int action_op_set_val(const char *inval) - { -- if (outval) -- strcpy(outval, action); -- -- if (!inval) -- return 0; -- - if (strcmp(inval, "reset") == 0) - action_val = WDOG_TIMEOUT_RESET; - else if (strcmp(inval, "none") == 0) -@@ -1208,18 +1202,26 @@ static int action_op(const char *inval, char *outval) - action_val = WDOG_TIMEOUT_POWER_DOWN; - else - return -EINVAL; -- strcpy(action, inval); - return 0; - } - --static int preaction_op(const char *inval, char *outval) -+static int action_op(const char *inval, char *outval) - { -+ int rv; -+ - if (outval) -- strcpy(outval, preaction); -+ strcpy(outval, action); - - if (!inval) - return 0; -+ rv = action_op_set_val(inval); -+ if (!rv) -+ strcpy(action, inval); -+ return rv; -+} - -+static int preaction_op_set_val(const char *inval) -+{ - if (strcmp(inval, "pre_none") == 0) - preaction_val = WDOG_PRETIMEOUT_NONE; - else if (strcmp(inval, "pre_smi") == 0) -@@ -1232,18 +1234,26 @@ static int preaction_op(const char *inval, char *outval) - preaction_val = WDOG_PRETIMEOUT_MSG_INT; - else - return -EINVAL; -- strcpy(preaction, inval); - return 0; - } - --static int preop_op(const char *inval, char *outval) -+static int preaction_op(const char *inval, char *outval) - { -+ int rv; -+ - if (outval) -- strcpy(outval, preop); -+ strcpy(outval, preaction); - - if (!inval) - return 0; -+ rv = preaction_op_set_val(inval); -+ if (!rv) -+ strcpy(preaction, inval); -+ return 0; -+} - -+static int preop_op_set_val(const char *inval) -+{ - if (strcmp(inval, "preop_none") == 0) - preop_val = WDOG_PREOP_NONE; - else if (strcmp(inval, "preop_panic") == 0) -@@ -1252,7 +1262,22 @@ static int preop_op(const char *inval, char *outval) - preop_val = WDOG_PREOP_GIVE_DATA; - else - return -EINVAL; -- strcpy(preop, inval); -+ return 0; -+} -+ -+static int preop_op(const char *inval, char *outval) -+{ -+ int rv; -+ -+ if (outval) -+ strcpy(outval, preop); -+ -+ if (!inval) -+ return 0; -+ -+ rv = preop_op_set_val(inval); -+ if (!rv) -+ strcpy(preop, inval); - return 0; - } - -@@ -1289,18 +1314,18 @@ static int __init ipmi_wdog_init(void) - { - int rv; - -- if (action_op(action, NULL)) { -+ if (action_op_set_val(action)) { - action_op("reset", NULL); - pr_info("Unknown action '%s', defaulting to reset\n", action); - } - -- if (preaction_op(preaction, NULL)) { -+ if (preaction_op_set_val(preaction)) { - preaction_op("pre_none", NULL); - pr_info("Unknown preaction '%s', defaulting to none\n", - preaction); - } - -- if (preop_op(preop, NULL)) { -+ if (preop_op_set_val(preop)) { - preop_op("preop_none", NULL); - pr_info("Unknown preop '%s', defaulting to none\n", preop); - } -diff --git a/drivers/char/misc.c b/drivers/char/misc.c -index dda466f9181acf..30178e20d962d4 100644 ---- a/drivers/char/misc.c -+++ b/drivers/char/misc.c -@@ -314,8 +314,8 @@ static int __init misc_init(void) - if (err) - goto fail_remove; - -- err = -EIO; -- if (__register_chrdev(MISC_MAJOR, 0, MINORMASK + 1, "misc", &misc_fops)) -+ err = __register_chrdev(MISC_MAJOR, 0, MINORMASK + 1, "misc", &misc_fops); -+ if (err < 0) - goto fail_printk; - return 0; - -diff --git a/drivers/clk/qcom/gcc-ipq5018.c b/drivers/clk/qcom/gcc-ipq5018.c -index 3136ba1c2a59cc..915e84db3c97da 100644 ---- a/drivers/clk/qcom/gcc-ipq5018.c -+++ b/drivers/clk/qcom/gcc-ipq5018.c -@@ -1370,7 +1370,7 @@ static struct clk_branch gcc_xo_clk = { - &gcc_xo_clk_src.clkr.hw, - }, - .num_parents = 1, -- .flags = CLK_SET_RATE_PARENT, -+ .flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL, - .ops = &clk_branch2_ops, - }, - }, -diff --git a/drivers/clk/tegra/clk-periph.c b/drivers/clk/tegra/clk-periph.c -index 0626650a7011cc..c9fc52a36fce9c 100644 ---- a/drivers/clk/tegra/clk-periph.c -+++ b/drivers/clk/tegra/clk-periph.c -@@ -51,7 +51,7 @@ static int clk_periph_determine_rate(struct clk_hw *hw, - struct tegra_clk_periph *periph = to_clk_periph(hw); - const struct clk_ops *div_ops = periph->div_ops; - struct clk_hw *div_hw = &periph->divider.hw; -- unsigned long rate; -+ long rate; - - __clk_hw_set_clk(div_hw, hw); - -@@ -59,7 +59,7 @@ static int clk_periph_determine_rate(struct clk_hw *hw, - if (rate < 0) - return rate; - -- req->rate = rate; -+ req->rate = (unsigned long)rate; - return 0; - } - -diff --git a/drivers/comedi/comedi_fops.c b/drivers/comedi/comedi_fops.c -index e4d62cdaff462d..1f12f7ea3dc492 100644 ---- a/drivers/comedi/comedi_fops.c -+++ b/drivers/comedi/comedi_fops.c -@@ -787,6 +787,7 @@ static int is_device_busy(struct comedi_device *dev) - struct comedi_subdevice *s; - int i; - -+ lockdep_assert_held_write(&dev->attach_lock); - lockdep_assert_held(&dev->mutex); - if (!dev->attached) - return 0; -@@ -795,7 +796,16 @@ static int is_device_busy(struct comedi_device *dev) - s = &dev->subdevices[i]; - if (s->busy) - return 1; -- if (s->async && comedi_buf_is_mmapped(s)) -+ if (!s->async) -+ continue; -+ if (comedi_buf_is_mmapped(s)) -+ return 1; -+ /* -+ * There may be tasks still waiting on the subdevice's wait -+ * queue, although they should already be about to be removed -+ * from it since the subdevice has no active async command. -+ */ -+ if (wq_has_sleeper(&s->async->wait_head)) - return 1; - } - -@@ -825,15 +835,22 @@ static int do_devconfig_ioctl(struct comedi_device *dev, - return -EPERM; - - if (!arg) { -- if (is_device_busy(dev)) -- return -EBUSY; -+ int rc = 0; -+ - if (dev->attached) { -- struct module *driver_module = dev->driver->module; -+ down_write(&dev->attach_lock); -+ if (is_device_busy(dev)) { -+ rc = -EBUSY; -+ } else { -+ struct module *driver_module = -+ dev->driver->module; - -- comedi_device_detach(dev); -- module_put(driver_module); -+ comedi_device_detach_locked(dev); -+ module_put(driver_module); -+ } -+ up_write(&dev->attach_lock); - } -- return 0; -+ return rc; - } - - if (copy_from_user(&it, arg, sizeof(it))) -@@ -1570,6 +1587,9 @@ static int do_insnlist_ioctl(struct comedi_device *dev, - memset(&data[n], 0, (MIN_SAMPLES - n) * - sizeof(unsigned int)); - } -+ } else { -+ memset(data, 0, max_t(unsigned int, n, MIN_SAMPLES) * -+ sizeof(unsigned int)); - } - ret = parse_insn(dev, insns + i, data, file); - if (ret < 0) -@@ -1653,6 +1673,8 @@ static int do_insn_ioctl(struct comedi_device *dev, - memset(&data[insn->n], 0, - (MIN_SAMPLES - insn->n) * sizeof(unsigned int)); - } -+ } else { -+ memset(data, 0, n_data * sizeof(unsigned int)); - } - ret = parse_insn(dev, insn, data, file); - if (ret < 0) -diff --git a/drivers/comedi/comedi_internal.h b/drivers/comedi/comedi_internal.h -index 9b3631a654c895..cf10ba016ebc81 100644 ---- a/drivers/comedi/comedi_internal.h -+++ b/drivers/comedi/comedi_internal.h -@@ -50,6 +50,7 @@ extern struct mutex comedi_drivers_list_lock; - int insn_inval(struct comedi_device *dev, struct comedi_subdevice *s, - struct comedi_insn *insn, unsigned int *data); - -+void comedi_device_detach_locked(struct comedi_device *dev); - void comedi_device_detach(struct comedi_device *dev); - int comedi_device_attach(struct comedi_device *dev, - struct comedi_devconfig *it); -diff --git a/drivers/comedi/drivers.c b/drivers/comedi/drivers.c -index 086213bcc49933..ce4cde140518b0 100644 ---- a/drivers/comedi/drivers.c -+++ b/drivers/comedi/drivers.c -@@ -158,7 +158,7 @@ static void comedi_device_detach_cleanup(struct comedi_device *dev) - int i; - struct comedi_subdevice *s; - -- lockdep_assert_held(&dev->attach_lock); -+ lockdep_assert_held_write(&dev->attach_lock); - lockdep_assert_held(&dev->mutex); - if (dev->subdevices) { - for (i = 0; i < dev->n_subdevices; i++) { -@@ -195,16 +195,23 @@ static void comedi_device_detach_cleanup(struct comedi_device *dev) - comedi_clear_hw_dev(dev); - } - --void comedi_device_detach(struct comedi_device *dev) -+void comedi_device_detach_locked(struct comedi_device *dev) - { -+ lockdep_assert_held_write(&dev->attach_lock); - lockdep_assert_held(&dev->mutex); - comedi_device_cancel_all(dev); -- down_write(&dev->attach_lock); - dev->attached = false; - dev->detach_count++; - if (dev->driver) - dev->driver->detach(dev); - comedi_device_detach_cleanup(dev); -+} -+ -+void comedi_device_detach(struct comedi_device *dev) -+{ -+ lockdep_assert_held(&dev->mutex); -+ down_write(&dev->attach_lock); -+ comedi_device_detach_locked(dev); - up_write(&dev->attach_lock); - } - -@@ -612,11 +619,9 @@ static int insn_rw_emulate_bits(struct comedi_device *dev, - unsigned int chan = CR_CHAN(insn->chanspec); - unsigned int base_chan = (chan < 32) ? 0 : chan; - unsigned int _data[2]; -+ unsigned int i; - int ret; - -- if (insn->n == 0) -- return 0; -- - memset(_data, 0, sizeof(_data)); - memset(&_insn, 0, sizeof(_insn)); - _insn.insn = INSN_BITS; -@@ -627,18 +632,21 @@ static int insn_rw_emulate_bits(struct comedi_device *dev, - if (insn->insn == INSN_WRITE) { - if (!(s->subdev_flags & SDF_WRITABLE)) - return -EINVAL; -- _data[0] = 1U << (chan - base_chan); /* mask */ -- _data[1] = data[0] ? (1U << (chan - base_chan)) : 0; /* bits */ -+ _data[0] = 1U << (chan - base_chan); /* mask */ - } -+ for (i = 0; i < insn->n; i++) { -+ if (insn->insn == INSN_WRITE) -+ _data[1] = data[i] ? _data[0] : 0; /* bits */ - -- ret = s->insn_bits(dev, s, &_insn, _data); -- if (ret < 0) -- return ret; -+ ret = s->insn_bits(dev, s, &_insn, _data); -+ if (ret < 0) -+ return ret; - -- if (insn->insn == INSN_READ) -- data[0] = (_data[1] >> (chan - base_chan)) & 1; -+ if (insn->insn == INSN_READ) -+ data[i] = (_data[1] >> (chan - base_chan)) & 1; -+ } - -- return 1; -+ return insn->n; - } - - static int __comedi_device_postconfig_async(struct comedi_device *dev, -diff --git a/drivers/comedi/drivers/pcl726.c b/drivers/comedi/drivers/pcl726.c -index 0430630e6ebb90..b542896fa0e427 100644 ---- a/drivers/comedi/drivers/pcl726.c -+++ b/drivers/comedi/drivers/pcl726.c -@@ -328,7 +328,8 @@ static int pcl726_attach(struct comedi_device *dev, - * Hook up the external trigger source interrupt only if the - * user config option is valid and the board supports interrupts. - */ -- if (it->options[1] && (board->irq_mask & (1 << it->options[1]))) { -+ if (it->options[1] > 0 && it->options[1] < 16 && -+ (board->irq_mask & (1U << it->options[1]))) { - ret = request_irq(it->options[1], pcl726_interrupt, 0, - dev->board_name, dev); - if (ret == 0) { -diff --git a/drivers/cpufreq/armada-8k-cpufreq.c b/drivers/cpufreq/armada-8k-cpufreq.c -index 8afefdea4d80c9..8a01032e57fa74 100644 ---- a/drivers/cpufreq/armada-8k-cpufreq.c -+++ b/drivers/cpufreq/armada-8k-cpufreq.c -@@ -103,7 +103,7 @@ static void armada_8k_cpufreq_free_table(struct freq_table *freq_tables) - { - int opps_index, nb_cpus = num_possible_cpus(); - -- for (opps_index = 0 ; opps_index <= nb_cpus; opps_index++) { -+ for (opps_index = 0 ; opps_index < nb_cpus; opps_index++) { - int i; - - /* If cpu_dev is NULL then we reached the end of the array */ -diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c -index aa34af940cb53b..ea32bdf7cc24e0 100644 ---- a/drivers/cpufreq/cppc_cpufreq.c -+++ b/drivers/cpufreq/cppc_cpufreq.c -@@ -847,7 +847,7 @@ static struct freq_attr *cppc_cpufreq_attr[] = { - }; - - static struct cpufreq_driver cppc_cpufreq_driver = { -- .flags = CPUFREQ_CONST_LOOPS, -+ .flags = CPUFREQ_CONST_LOOPS | CPUFREQ_NEED_UPDATE_LIMITS, - .verify = cppc_verify_policy, - .target = cppc_cpufreq_set_target, - .get = cppc_cpufreq_get_rate, -diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c -index cc98d8cf543303..30d8f2ada0f176 100644 ---- a/drivers/cpufreq/cpufreq.c -+++ b/drivers/cpufreq/cpufreq.c -@@ -454,7 +454,7 @@ void cpufreq_freq_transition_end(struct cpufreq_policy *policy, - - arch_set_freq_scale(policy->related_cpus, - policy->cur, -- policy->cpuinfo.max_freq); -+ arch_scale_freq_ref(policy->cpu)); - - spin_lock(&policy->transition_lock); - policy->transition_ongoing = false; -@@ -2205,7 +2205,7 @@ unsigned int cpufreq_driver_fast_switch(struct cpufreq_policy *policy, - - policy->cur = freq; - arch_set_freq_scale(policy->related_cpus, freq, -- policy->cpuinfo.max_freq); -+ arch_scale_freq_ref(policy->cpu)); - cpufreq_stats_record_transition(policy, freq); - - if (trace_cpu_frequency_enabled()) { -@@ -2701,10 +2701,12 @@ static int cpufreq_set_policy(struct cpufreq_policy *policy, - pr_debug("starting governor %s failed\n", policy->governor->name); - if (old_gov) { - policy->governor = old_gov; -- if (cpufreq_init_governor(policy)) -+ if (cpufreq_init_governor(policy)) { - policy->governor = NULL; -- else -- cpufreq_start_governor(policy); -+ } else if (cpufreq_start_governor(policy)) { -+ cpufreq_exit_governor(policy); -+ policy->governor = NULL; -+ } - } - - return ret; -diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c -index edd9a8fb9878d6..92f9c00ad5f9fb 100644 ---- a/drivers/cpuidle/governors/menu.c -+++ b/drivers/cpuidle/governors/menu.c -@@ -21,7 +21,7 @@ - - #include "gov.h" - --#define BUCKETS 12 -+#define BUCKETS 6 - #define INTERVAL_SHIFT 3 - #define INTERVALS (1UL << INTERVAL_SHIFT) - #define RESOLUTION 1024 -@@ -31,12 +31,11 @@ - /* - * Concepts and ideas behind the menu governor - * -- * For the menu governor, there are 3 decision factors for picking a C -+ * For the menu governor, there are 2 decision factors for picking a C - * state: - * 1) Energy break even point -- * 2) Performance impact -- * 3) Latency tolerance (from pmqos infrastructure) -- * These three factors are treated independently. -+ * 2) Latency tolerance (from pmqos infrastructure) -+ * These two factors are treated independently. - * - * Energy break even point - * ----------------------- -@@ -119,19 +118,10 @@ struct menu_device { - int interval_ptr; - }; - --static inline int which_bucket(u64 duration_ns, unsigned int nr_iowaiters) -+static inline int which_bucket(u64 duration_ns) - { - int bucket = 0; - -- /* -- * We keep two groups of stats; one with no -- * IO pending, one without. -- * This allows us to calculate -- * E(duration)|iowait -- */ -- if (nr_iowaiters) -- bucket = BUCKETS/2; -- - if (duration_ns < 10ULL * NSEC_PER_USEC) - return bucket; - if (duration_ns < 100ULL * NSEC_PER_USEC) -@@ -145,21 +135,16 @@ static inline int which_bucket(u64 duration_ns, unsigned int nr_iowaiters) - return bucket + 5; - } - --/* -- * Return a multiplier for the exit latency that is intended -- * to take performance requirements into account. -- * The more performance critical we estimate the system -- * to be, the higher this multiplier, and thus the higher -- * the barrier to go to an expensive C state. -- */ --static inline int performance_multiplier(unsigned int nr_iowaiters) -+static DEFINE_PER_CPU(struct menu_device, menu_devices); -+ -+static void menu_update_intervals(struct menu_device *data, unsigned int interval_us) - { -- /* for IO wait tasks (per cpu!) we add 10x each */ -- return 1 + 10 * nr_iowaiters; -+ /* Update the repeating-pattern data. */ -+ data->intervals[data->interval_ptr++] = interval_us; -+ if (data->interval_ptr >= INTERVALS) -+ data->interval_ptr = 0; - } - --static DEFINE_PER_CPU(struct menu_device, menu_devices); -- - static void menu_update(struct cpuidle_driver *drv, struct cpuidle_device *dev); - - /* -@@ -276,18 +261,22 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev, - struct menu_device *data = this_cpu_ptr(&menu_devices); - s64 latency_req = cpuidle_governor_latency_req(dev->cpu); - u64 predicted_ns; -- u64 interactivity_req; -- unsigned int nr_iowaiters; - ktime_t delta, delta_tick; - int i, idx; - - if (data->needs_update) { - menu_update(drv, dev); - data->needs_update = 0; -+ } else if (!dev->last_residency_ns) { -+ /* -+ * This happens when the driver rejects the previously selected -+ * idle state and returns an error, so update the recent -+ * intervals table to prevent invalid information from being -+ * used going forward. -+ */ -+ menu_update_intervals(data, UINT_MAX); - } - -- nr_iowaiters = nr_iowait_cpu(dev->cpu); -- - /* Find the shortest expected idle interval. */ - predicted_ns = get_typical_interval(data) * NSEC_PER_USEC; - if (predicted_ns > RESIDENCY_THRESHOLD_NS) { -@@ -301,7 +290,7 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev, - } - - data->next_timer_ns = delta; -- data->bucket = which_bucket(data->next_timer_ns, nr_iowaiters); -+ data->bucket = which_bucket(data->next_timer_ns); - - /* Round up the result for half microseconds. */ - timer_us = div_u64((RESOLUTION * DECAY * NSEC_PER_USEC) / 2 + -@@ -319,7 +308,7 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev, - */ - data->next_timer_ns = KTIME_MAX; - delta_tick = TICK_NSEC / 2; -- data->bucket = which_bucket(KTIME_MAX, nr_iowaiters); -+ data->bucket = which_bucket(KTIME_MAX); - } - - if (unlikely(drv->state_count <= 1 || latency_req == 0) || -@@ -335,27 +324,15 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev, - return 0; - } - -- if (tick_nohz_tick_stopped()) { -- /* -- * If the tick is already stopped, the cost of possible short -- * idle duration misprediction is much higher, because the CPU -- * may be stuck in a shallow idle state for a long time as a -- * result of it. In that case say we might mispredict and use -- * the known time till the closest timer event for the idle -- * state selection. -- */ -- if (predicted_ns < TICK_NSEC) -- predicted_ns = data->next_timer_ns; -- } else { -- /* -- * Use the performance multiplier and the user-configurable -- * latency_req to determine the maximum exit latency. -- */ -- interactivity_req = div64_u64(predicted_ns, -- performance_multiplier(nr_iowaiters)); -- if (latency_req > interactivity_req) -- latency_req = interactivity_req; -- } -+ /* -+ * If the tick is already stopped, the cost of possible short idle -+ * duration misprediction is much higher, because the CPU may be stuck -+ * in a shallow idle state for a long time as a result of it. In that -+ * case, say we might mispredict and use the known time till the closest -+ * timer event for the idle state selection. -+ */ -+ if (tick_nohz_tick_stopped() && predicted_ns < TICK_NSEC) -+ predicted_ns = data->next_timer_ns; - - /* - * Find the idle state with the lowest power while satisfying -@@ -371,13 +348,15 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev, - if (idx == -1) - idx = i; /* first enabled state */ - -+ if (s->exit_latency_ns > latency_req) -+ break; -+ - if (s->target_residency_ns > predicted_ns) { - /* - * Use a physical idle state, not busy polling, unless - * a timer is going to trigger soon enough. - */ - if ((drv->states[idx].flags & CPUIDLE_FLAG_POLLING) && -- s->exit_latency_ns <= latency_req && - s->target_residency_ns <= data->next_timer_ns) { - predicted_ns = s->target_residency_ns; - idx = i; -@@ -409,8 +388,6 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev, - - return idx; - } -- if (s->exit_latency_ns > latency_req) -- break; - - idx = i; - } -@@ -553,10 +530,7 @@ static void menu_update(struct cpuidle_driver *drv, struct cpuidle_device *dev) - - data->correction_factor[data->bucket] = new_factor; - -- /* update the repeating-pattern data */ -- data->intervals[data->interval_ptr++] = ktime_to_us(measured_ns); -- if (data->interval_ptr >= INTERVALS) -- data->interval_ptr = 0; -+ menu_update_intervals(data, ktime_to_us(measured_ns)); - } - - /** -diff --git a/drivers/crypto/hisilicon/hpre/hpre_crypto.c b/drivers/crypto/hisilicon/hpre/hpre_crypto.c -index 9a1c61be32ccdb..059319f7a7160f 100644 ---- a/drivers/crypto/hisilicon/hpre/hpre_crypto.c -+++ b/drivers/crypto/hisilicon/hpre/hpre_crypto.c -@@ -1482,11 +1482,13 @@ static void hpre_ecdh_cb(struct hpre_ctx *ctx, void *resp) - if (overtime_thrhld && hpre_is_bd_timeout(req, overtime_thrhld)) - atomic64_inc(&dfx[HPRE_OVER_THRHLD_CNT].value); - -+ /* Do unmap before data processing */ -+ hpre_ecdh_hw_data_clr_all(ctx, req, areq->dst, areq->src); -+ - p = sg_virt(areq->dst); - memmove(p, p + ctx->key_sz - curve_sz, curve_sz); - memmove(p + curve_sz, p + areq->dst_len - curve_sz, curve_sz); - -- hpre_ecdh_hw_data_clr_all(ctx, req, areq->dst, areq->src); - kpp_request_complete(areq, ret); - - atomic64_inc(&dfx[HPRE_RECV_CNT].value); -@@ -1796,9 +1798,11 @@ static void hpre_curve25519_cb(struct hpre_ctx *ctx, void *resp) - if (overtime_thrhld && hpre_is_bd_timeout(req, overtime_thrhld)) - atomic64_inc(&dfx[HPRE_OVER_THRHLD_CNT].value); - -+ /* Do unmap before data processing */ -+ hpre_curve25519_hw_data_clr_all(ctx, req, areq->dst, areq->src); -+ - hpre_key_to_big_end(sg_virt(areq->dst), CURVE25519_KEY_SIZE); - -- hpre_curve25519_hw_data_clr_all(ctx, req, areq->dst, areq->src); - kpp_request_complete(areq, ret); - - atomic64_inc(&dfx[HPRE_RECV_CNT].value); -diff --git a/drivers/crypto/intel/qat/qat_common/adf_common_drv.h b/drivers/crypto/intel/qat/qat_common/adf_common_drv.h -index 79ff7982378d9f..05d1402001a1ef 100644 ---- a/drivers/crypto/intel/qat/qat_common/adf_common_drv.h -+++ b/drivers/crypto/intel/qat/qat_common/adf_common_drv.h -@@ -193,6 +193,7 @@ void adf_exit_misc_wq(void); - bool adf_misc_wq_queue_work(struct work_struct *work); - bool adf_misc_wq_queue_delayed_work(struct delayed_work *work, - unsigned long delay); -+void adf_misc_wq_flush(void); - #if defined(CONFIG_PCI_IOV) - int adf_sriov_configure(struct pci_dev *pdev, int numvfs); - void adf_disable_sriov(struct adf_accel_dev *accel_dev); -diff --git a/drivers/crypto/intel/qat/qat_common/adf_init.c b/drivers/crypto/intel/qat/qat_common/adf_init.c -index 0f9e2d59ce3857..9c1b587a87e5b4 100644 ---- a/drivers/crypto/intel/qat/qat_common/adf_init.c -+++ b/drivers/crypto/intel/qat/qat_common/adf_init.c -@@ -381,6 +381,7 @@ static void adf_dev_shutdown(struct adf_accel_dev *accel_dev) - hw_data->exit_admin_comms(accel_dev); - - adf_cleanup_etr_data(accel_dev); -+ adf_misc_wq_flush(); - adf_dev_restore(accel_dev); - } - -diff --git a/drivers/crypto/intel/qat/qat_common/adf_isr.c b/drivers/crypto/intel/qat/qat_common/adf_isr.c -index 2aba194a7c2922..ce7c9ef6346b39 100644 ---- a/drivers/crypto/intel/qat/qat_common/adf_isr.c -+++ b/drivers/crypto/intel/qat/qat_common/adf_isr.c -@@ -386,3 +386,8 @@ bool adf_misc_wq_queue_delayed_work(struct delayed_work *work, - { - return queue_delayed_work(adf_misc_wq, work, delay); - } -+ -+void adf_misc_wq_flush(void) -+{ -+ flush_workqueue(adf_misc_wq); -+} -diff --git a/drivers/crypto/intel/qat/qat_common/qat_algs.c b/drivers/crypto/intel/qat/qat_common/qat_algs.c -index 3c4bba4a87795e..d69cc1e5e0239e 100644 ---- a/drivers/crypto/intel/qat/qat_common/qat_algs.c -+++ b/drivers/crypto/intel/qat/qat_common/qat_algs.c -@@ -1277,7 +1277,7 @@ static struct aead_alg qat_aeads[] = { { - .base = { - .cra_name = "authenc(hmac(sha1),cbc(aes))", - .cra_driver_name = "qat_aes_cbc_hmac_sha1", -- .cra_priority = 4001, -+ .cra_priority = 100, - .cra_flags = CRYPTO_ALG_ASYNC | CRYPTO_ALG_ALLOCATES_MEMORY, - .cra_blocksize = AES_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct qat_alg_aead_ctx), -@@ -1294,7 +1294,7 @@ static struct aead_alg qat_aeads[] = { { - .base = { - .cra_name = "authenc(hmac(sha256),cbc(aes))", - .cra_driver_name = "qat_aes_cbc_hmac_sha256", -- .cra_priority = 4001, -+ .cra_priority = 100, - .cra_flags = CRYPTO_ALG_ASYNC | CRYPTO_ALG_ALLOCATES_MEMORY, - .cra_blocksize = AES_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct qat_alg_aead_ctx), -@@ -1311,7 +1311,7 @@ static struct aead_alg qat_aeads[] = { { - .base = { - .cra_name = "authenc(hmac(sha512),cbc(aes))", - .cra_driver_name = "qat_aes_cbc_hmac_sha512", -- .cra_priority = 4001, -+ .cra_priority = 100, - .cra_flags = CRYPTO_ALG_ASYNC | CRYPTO_ALG_ALLOCATES_MEMORY, - .cra_blocksize = AES_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct qat_alg_aead_ctx), -@@ -1329,7 +1329,7 @@ static struct aead_alg qat_aeads[] = { { - static struct skcipher_alg qat_skciphers[] = { { - .base.cra_name = "cbc(aes)", - .base.cra_driver_name = "qat_aes_cbc", -- .base.cra_priority = 4001, -+ .base.cra_priority = 100, - .base.cra_flags = CRYPTO_ALG_ASYNC | CRYPTO_ALG_ALLOCATES_MEMORY, - .base.cra_blocksize = AES_BLOCK_SIZE, - .base.cra_ctxsize = sizeof(struct qat_alg_skcipher_ctx), -@@ -1347,7 +1347,7 @@ static struct skcipher_alg qat_skciphers[] = { { - }, { - .base.cra_name = "ctr(aes)", - .base.cra_driver_name = "qat_aes_ctr", -- .base.cra_priority = 4001, -+ .base.cra_priority = 100, - .base.cra_flags = CRYPTO_ALG_ASYNC | CRYPTO_ALG_ALLOCATES_MEMORY, - .base.cra_blocksize = 1, - .base.cra_ctxsize = sizeof(struct qat_alg_skcipher_ctx), -@@ -1365,7 +1365,7 @@ static struct skcipher_alg qat_skciphers[] = { { - }, { - .base.cra_name = "xts(aes)", - .base.cra_driver_name = "qat_aes_xts", -- .base.cra_priority = 4001, -+ .base.cra_priority = 100, - .base.cra_flags = CRYPTO_ALG_ASYNC | CRYPTO_ALG_NEED_FALLBACK | - CRYPTO_ALG_ALLOCATES_MEMORY, - .base.cra_blocksize = AES_BLOCK_SIZE, -diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c -index 1958b797a42100..682e7d80adb8c9 100644 ---- a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c -+++ b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c -@@ -1485,6 +1485,7 @@ int otx2_cpt_discover_eng_capabilities(struct otx2_cptpf_dev *cptpf) - dma_addr_t rptr_baddr; - struct pci_dev *pdev; - u32 len, compl_rlen; -+ int timeout = 10000; - int ret, etype; - void *rptr; - -@@ -1547,16 +1548,27 @@ int otx2_cpt_discover_eng_capabilities(struct otx2_cptpf_dev *cptpf) - etype); - otx2_cpt_fill_inst(&inst, &iq_cmd, rptr_baddr); - lfs->ops->send_cmd(&inst, 1, &cptpf->lfs.lf[0]); -+ timeout = 10000; - - while (lfs->ops->cpt_get_compcode(result) == -- OTX2_CPT_COMPLETION_CODE_INIT) -+ OTX2_CPT_COMPLETION_CODE_INIT) { - cpu_relax(); -+ udelay(1); -+ timeout--; -+ if (!timeout) { -+ ret = -ENODEV; -+ cptpf->is_eng_caps_discovered = false; -+ dev_warn(&pdev->dev, "Timeout on CPT load_fvc completion poll\n"); -+ goto error_no_response; -+ } -+ } - - cptpf->eng_caps[etype].u = be64_to_cpup(rptr); - } -- dma_unmap_single(&pdev->dev, rptr_baddr, len, DMA_BIDIRECTIONAL); - cptpf->is_eng_caps_discovered = true; - -+error_no_response: -+ dma_unmap_single(&pdev->dev, rptr_baddr, len, DMA_BIDIRECTIONAL); - free_result: - kfree(result); - lf_cleanup: -diff --git a/drivers/devfreq/governor_userspace.c b/drivers/devfreq/governor_userspace.c -index d69672ccacc49b..8d057cea09d5b6 100644 ---- a/drivers/devfreq/governor_userspace.c -+++ b/drivers/devfreq/governor_userspace.c -@@ -9,6 +9,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -39,10 +40,13 @@ static ssize_t set_freq_store(struct device *dev, struct device_attribute *attr, - unsigned long wanted; - int err = 0; - -+ err = kstrtoul(buf, 0, &wanted); -+ if (err) -+ return err; -+ - mutex_lock(&devfreq->lock); - data = devfreq->governor_data; - -- sscanf(buf, "%lu", &wanted); - data->user_frequency = wanted; - data->valid = true; - err = update_devfreq(devfreq); -diff --git a/drivers/dma/stm32-dma.c b/drivers/dma/stm32-dma.c -index 9840594a6aaa1f..3882080cffa69c 100644 ---- a/drivers/dma/stm32-dma.c -+++ b/drivers/dma/stm32-dma.c -@@ -745,7 +745,7 @@ static void stm32_dma_handle_chan_done(struct stm32_dma_chan *chan, u32 scr) - /* cyclic while CIRC/DBM disable => post resume reconfiguration needed */ - if (!(scr & (STM32_DMA_SCR_CIRC | STM32_DMA_SCR_DBM))) - stm32_dma_post_resume_reconfigure(chan); -- else if (scr & STM32_DMA_SCR_DBM) -+ else if (scr & STM32_DMA_SCR_DBM && chan->desc->num_sgs > 2) - stm32_dma_configure_next_sg(chan); - } else { - chan->busy = false; -diff --git a/drivers/edac/synopsys_edac.c b/drivers/edac/synopsys_edac.c -index 6ddc90d7ba7c2a..f8aaada42d3f25 100644 ---- a/drivers/edac/synopsys_edac.c -+++ b/drivers/edac/synopsys_edac.c -@@ -332,20 +332,26 @@ struct synps_edac_priv { - #endif - }; - -+enum synps_platform_type { -+ ZYNQ, -+ ZYNQMP, -+ SYNPS, -+}; -+ - /** - * struct synps_platform_data - synps platform data structure. -+ * @platform: Identifies the target hardware platform - * @get_error_info: Get EDAC error info. - * @get_mtype: Get mtype. - * @get_dtype: Get dtype. -- * @get_ecc_state: Get ECC state. - * @get_mem_info: Get EDAC memory info - * @quirks: To differentiate IPs. - */ - struct synps_platform_data { -+ enum synps_platform_type platform; - int (*get_error_info)(struct synps_edac_priv *priv); - enum mem_type (*get_mtype)(const void __iomem *base); - enum dev_type (*get_dtype)(const void __iomem *base); -- bool (*get_ecc_state)(void __iomem *base); - #ifdef CONFIG_EDAC_DEBUG - u64 (*get_mem_info)(struct synps_edac_priv *priv); - #endif -@@ -720,51 +726,38 @@ static enum dev_type zynqmp_get_dtype(const void __iomem *base) - return dt; - } - --/** -- * zynq_get_ecc_state - Return the controller ECC enable/disable status. -- * @base: DDR memory controller base address. -- * -- * Get the ECC enable/disable status of the controller. -- * -- * Return: true if enabled, otherwise false. -- */ --static bool zynq_get_ecc_state(void __iomem *base) -+static bool get_ecc_state(struct synps_edac_priv *priv) - { -+ u32 ecctype, clearval; - enum dev_type dt; -- u32 ecctype; -- -- dt = zynq_get_dtype(base); -- if (dt == DEV_UNKNOWN) -- return false; - -- ecctype = readl(base + SCRUB_OFST) & SCRUB_MODE_MASK; -- if ((ecctype == SCRUB_MODE_SECDED) && (dt == DEV_X2)) -- return true; -- -- return false; --} -- --/** -- * zynqmp_get_ecc_state - Return the controller ECC enable/disable status. -- * @base: DDR memory controller base address. -- * -- * Get the ECC enable/disable status for the controller. -- * -- * Return: a ECC status boolean i.e true/false - enabled/disabled. -- */ --static bool zynqmp_get_ecc_state(void __iomem *base) --{ -- enum dev_type dt; -- u32 ecctype; -- -- dt = zynqmp_get_dtype(base); -- if (dt == DEV_UNKNOWN) -- return false; -- -- ecctype = readl(base + ECC_CFG0_OFST) & SCRUB_MODE_MASK; -- if ((ecctype == SCRUB_MODE_SECDED) && -- ((dt == DEV_X2) || (dt == DEV_X4) || (dt == DEV_X8))) -- return true; -+ if (priv->p_data->platform == ZYNQ) { -+ dt = zynq_get_dtype(priv->baseaddr); -+ if (dt == DEV_UNKNOWN) -+ return false; -+ -+ ecctype = readl(priv->baseaddr + SCRUB_OFST) & SCRUB_MODE_MASK; -+ if (ecctype == SCRUB_MODE_SECDED && dt == DEV_X2) { -+ clearval = ECC_CTRL_CLR_CE_ERR | ECC_CTRL_CLR_UE_ERR; -+ writel(clearval, priv->baseaddr + ECC_CTRL_OFST); -+ writel(0x0, priv->baseaddr + ECC_CTRL_OFST); -+ return true; -+ } -+ } else { -+ dt = zynqmp_get_dtype(priv->baseaddr); -+ if (dt == DEV_UNKNOWN) -+ return false; -+ -+ ecctype = readl(priv->baseaddr + ECC_CFG0_OFST) & SCRUB_MODE_MASK; -+ if (ecctype == SCRUB_MODE_SECDED && -+ (dt == DEV_X2 || dt == DEV_X4 || dt == DEV_X8)) { -+ clearval = readl(priv->baseaddr + ECC_CLR_OFST) | -+ ECC_CTRL_CLR_CE_ERR | ECC_CTRL_CLR_CE_ERRCNT | -+ ECC_CTRL_CLR_UE_ERR | ECC_CTRL_CLR_UE_ERRCNT; -+ writel(clearval, priv->baseaddr + ECC_CLR_OFST); -+ return true; -+ } -+ } - - return false; - } -@@ -934,18 +927,18 @@ static int setup_irq(struct mem_ctl_info *mci, - } - - static const struct synps_platform_data zynq_edac_def = { -+ .platform = ZYNQ, - .get_error_info = zynq_get_error_info, - .get_mtype = zynq_get_mtype, - .get_dtype = zynq_get_dtype, -- .get_ecc_state = zynq_get_ecc_state, - .quirks = 0, - }; - - static const struct synps_platform_data zynqmp_edac_def = { -+ .platform = ZYNQMP, - .get_error_info = zynqmp_get_error_info, - .get_mtype = zynqmp_get_mtype, - .get_dtype = zynqmp_get_dtype, -- .get_ecc_state = zynqmp_get_ecc_state, - #ifdef CONFIG_EDAC_DEBUG - .get_mem_info = zynqmp_get_mem_info, - #endif -@@ -957,10 +950,10 @@ static const struct synps_platform_data zynqmp_edac_def = { - }; - - static const struct synps_platform_data synopsys_edac_def = { -+ .platform = SYNPS, - .get_error_info = zynqmp_get_error_info, - .get_mtype = zynqmp_get_mtype, - .get_dtype = zynqmp_get_dtype, -- .get_ecc_state = zynqmp_get_ecc_state, - .quirks = (DDR_ECC_INTR_SUPPORT | DDR_ECC_INTR_SELF_CLEAR - #ifdef CONFIG_EDAC_DEBUG - | DDR_ECC_DATA_POISON_SUPPORT -@@ -1392,10 +1385,6 @@ static int mc_probe(struct platform_device *pdev) - if (!p_data) - return -ENODEV; - -- if (!p_data->get_ecc_state(baseaddr)) { -- edac_printk(KERN_INFO, EDAC_MC, "ECC not enabled\n"); -- return -ENXIO; -- } - - layers[0].type = EDAC_MC_LAYER_CHIP_SELECT; - layers[0].size = SYNPS_EDAC_NR_CSROWS; -@@ -1415,6 +1404,12 @@ static int mc_probe(struct platform_device *pdev) - priv = mci->pvt_info; - priv->baseaddr = baseaddr; - priv->p_data = p_data; -+ if (!get_ecc_state(priv)) { -+ edac_printk(KERN_INFO, EDAC_MC, "ECC not enabled\n"); -+ rc = -ENODEV; -+ goto free_edac_mc; -+ } -+ - spin_lock_init(&priv->reglock); - - mc_init(mci, pdev); -diff --git a/drivers/firmware/tegra/Kconfig b/drivers/firmware/tegra/Kconfig -index cde1ab8bd9d1cb..91f2320c0d0f89 100644 ---- a/drivers/firmware/tegra/Kconfig -+++ b/drivers/firmware/tegra/Kconfig -@@ -2,7 +2,7 @@ - menu "Tegra firmware driver" - - config TEGRA_IVC -- bool "Tegra IVC protocol" -+ bool "Tegra IVC protocol" if COMPILE_TEST - depends on ARCH_TEGRA - help - IVC (Inter-VM Communication) protocol is part of the IPC -@@ -13,8 +13,9 @@ config TEGRA_IVC - - config TEGRA_BPMP - bool "Tegra BPMP driver" -- depends on ARCH_TEGRA && TEGRA_HSP_MBOX && TEGRA_IVC -+ depends on ARCH_TEGRA && TEGRA_HSP_MBOX - depends on !CPU_BIG_ENDIAN -+ select TEGRA_IVC - help - BPMP (Boot and Power Management Processor) is designed to off-loading - the PM functions which include clock/DVFS/thermal/power from the CPU. -diff --git a/drivers/fpga/zynq-fpga.c b/drivers/fpga/zynq-fpga.c -index 96611d424a104e..b77097c93973aa 100644 ---- a/drivers/fpga/zynq-fpga.c -+++ b/drivers/fpga/zynq-fpga.c -@@ -405,12 +405,12 @@ static int zynq_fpga_ops_write(struct fpga_manager *mgr, struct sg_table *sgt) - } - } - -- priv->dma_nelms = -- dma_map_sg(mgr->dev.parent, sgt->sgl, sgt->nents, DMA_TO_DEVICE); -- if (priv->dma_nelms == 0) { -+ err = dma_map_sgtable(mgr->dev.parent, sgt, DMA_TO_DEVICE, 0); -+ if (err) { - dev_err(&mgr->dev, "Unable to DMA map (TO_DEVICE)\n"); -- return -ENOMEM; -+ return err; - } -+ priv->dma_nelms = sgt->nents; - - /* enable clock */ - err = clk_enable(priv->clk); -@@ -478,7 +478,7 @@ static int zynq_fpga_ops_write(struct fpga_manager *mgr, struct sg_table *sgt) - clk_disable(priv->clk); - - out_free: -- dma_unmap_sg(mgr->dev.parent, sgt->sgl, sgt->nents, DMA_TO_DEVICE); -+ dma_unmap_sgtable(mgr->dev.parent, sgt, DMA_TO_DEVICE, 0); - return err; - } - -diff --git a/drivers/gpio/gpio-mlxbf2.c b/drivers/gpio/gpio-mlxbf2.c -index 6abe01bc39c3e1..c03945af8538e3 100644 ---- a/drivers/gpio/gpio-mlxbf2.c -+++ b/drivers/gpio/gpio-mlxbf2.c -@@ -397,7 +397,7 @@ mlxbf2_gpio_probe(struct platform_device *pdev) - gc->ngpio = npins; - gc->owner = THIS_MODULE; - -- irq = platform_get_irq(pdev, 0); -+ irq = platform_get_irq_optional(pdev, 0); - if (irq >= 0) { - girq = &gs->gc.irq; - gpio_irq_chip_set_chip(girq, &mlxbf2_gpio_irq_chip); -diff --git a/drivers/gpio/gpio-mlxbf3.c b/drivers/gpio/gpio-mlxbf3.c -index 9875e34bde72a4..ed29b07d16c190 100644 ---- a/drivers/gpio/gpio-mlxbf3.c -+++ b/drivers/gpio/gpio-mlxbf3.c -@@ -190,9 +190,7 @@ static int mlxbf3_gpio_probe(struct platform_device *pdev) - struct mlxbf3_gpio_context *gs; - struct gpio_irq_chip *girq; - struct gpio_chip *gc; -- char *colon_ptr; - int ret, irq; -- long num; - - gs = devm_kzalloc(dev, sizeof(*gs), GFP_KERNEL); - if (!gs) -@@ -229,39 +227,25 @@ static int mlxbf3_gpio_probe(struct platform_device *pdev) - gc->owner = THIS_MODULE; - gc->add_pin_ranges = mlxbf3_gpio_add_pin_ranges; - -- colon_ptr = strchr(dev_name(dev), ':'); -- if (!colon_ptr) { -- dev_err(dev, "invalid device name format\n"); -- return -EINVAL; -- } -- -- ret = kstrtol(++colon_ptr, 16, &num); -- if (ret) { -- dev_err(dev, "invalid device instance\n"); -- return ret; -- } -- -- if (!num) { -- irq = platform_get_irq(pdev, 0); -- if (irq >= 0) { -- girq = &gs->gc.irq; -- gpio_irq_chip_set_chip(girq, &gpio_mlxbf3_irqchip); -- girq->default_type = IRQ_TYPE_NONE; -- /* This will let us handle the parent IRQ in the driver */ -- girq->num_parents = 0; -- girq->parents = NULL; -- girq->parent_handler = NULL; -- girq->handler = handle_bad_irq; -- -- /* -- * Directly request the irq here instead of passing -- * a flow-handler because the irq is shared. -- */ -- ret = devm_request_irq(dev, irq, mlxbf3_gpio_irq_handler, -- IRQF_SHARED, dev_name(dev), gs); -- if (ret) -- return dev_err_probe(dev, ret, "failed to request IRQ"); -- } -+ irq = platform_get_irq_optional(pdev, 0); -+ if (irq >= 0) { -+ girq = &gs->gc.irq; -+ gpio_irq_chip_set_chip(girq, &gpio_mlxbf3_irqchip); -+ girq->default_type = IRQ_TYPE_NONE; -+ /* This will let us handle the parent IRQ in the driver */ -+ girq->num_parents = 0; -+ girq->parents = NULL; -+ girq->parent_handler = NULL; -+ girq->handler = handle_bad_irq; -+ -+ /* -+ * Directly request the irq here instead of passing -+ * a flow-handler because the irq is shared. -+ */ -+ ret = devm_request_irq(dev, irq, mlxbf3_gpio_irq_handler, -+ IRQF_SHARED, dev_name(dev), gs); -+ if (ret) -+ return dev_err_probe(dev, ret, "failed to request IRQ"); - } - - platform_set_drvdata(pdev, gs); -diff --git a/drivers/gpio/gpio-tps65912.c b/drivers/gpio/gpio-tps65912.c -index fab771cb6a87bf..bac757c191c2ea 100644 ---- a/drivers/gpio/gpio-tps65912.c -+++ b/drivers/gpio/gpio-tps65912.c -@@ -49,10 +49,13 @@ static int tps65912_gpio_direction_output(struct gpio_chip *gc, - unsigned offset, int value) - { - struct tps65912_gpio *gpio = gpiochip_get_data(gc); -+ int ret; - - /* Set the initial value */ -- regmap_update_bits(gpio->tps->regmap, TPS65912_GPIO1 + offset, -- GPIO_SET_MASK, value ? GPIO_SET_MASK : 0); -+ ret = regmap_update_bits(gpio->tps->regmap, TPS65912_GPIO1 + offset, -+ GPIO_SET_MASK, value ? GPIO_SET_MASK : 0); -+ if (ret) -+ return ret; - - return regmap_update_bits(gpio->tps->regmap, TPS65912_GPIO1 + offset, - GPIO_CFG_MASK, GPIO_CFG_MASK); -diff --git a/drivers/gpio/gpio-virtio.c b/drivers/gpio/gpio-virtio.c -index fcc5e8c08973b3..1d0eb49eae3b4c 100644 ---- a/drivers/gpio/gpio-virtio.c -+++ b/drivers/gpio/gpio-virtio.c -@@ -539,7 +539,6 @@ static const char **virtio_gpio_get_names(struct virtio_gpio *vgpio, - - static int virtio_gpio_probe(struct virtio_device *vdev) - { -- struct virtio_gpio_config config; - struct device *dev = &vdev->dev; - struct virtio_gpio *vgpio; - u32 gpio_names_size; -@@ -551,9 +550,11 @@ static int virtio_gpio_probe(struct virtio_device *vdev) - return -ENOMEM; - - /* Read configuration */ -- virtio_cread_bytes(vdev, 0, &config, sizeof(config)); -- gpio_names_size = le32_to_cpu(config.gpio_names_size); -- ngpio = le16_to_cpu(config.ngpio); -+ gpio_names_size = -+ virtio_cread32(vdev, offsetof(struct virtio_gpio_config, -+ gpio_names_size)); -+ ngpio = virtio_cread16(vdev, offsetof(struct virtio_gpio_config, -+ ngpio)); - if (!ngpio) { - dev_err(dev, "Number of GPIOs can't be zero\n"); - return -EINVAL; -diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c -index 2bba27b13947f1..cfa7b0a50c8e33 100644 ---- a/drivers/gpio/gpio-wcd934x.c -+++ b/drivers/gpio/gpio-wcd934x.c -@@ -46,9 +46,12 @@ static int wcd_gpio_direction_output(struct gpio_chip *chip, unsigned int pin, - int val) - { - struct wcd_gpio_data *data = gpiochip_get_data(chip); -+ int ret; - -- regmap_update_bits(data->map, WCD_REG_DIR_CTL_OFFSET, -- WCD_PIN_MASK(pin), WCD_PIN_MASK(pin)); -+ ret = regmap_update_bits(data->map, WCD_REG_DIR_CTL_OFFSET, -+ WCD_PIN_MASK(pin), WCD_PIN_MASK(pin)); -+ if (ret) -+ return ret; - - return regmap_update_bits(data->map, WCD_REG_VAL_CTL_OFFSET, - WCD_PIN_MASK(pin), -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c -index 7200110197415f..384834fbd59011 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c -@@ -89,8 +89,8 @@ int amdgpu_map_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm, - } - - r = amdgpu_vm_bo_map(adev, *bo_va, csa_addr, 0, size, -- AMDGPU_PTE_READABLE | AMDGPU_PTE_WRITEABLE | -- AMDGPU_PTE_EXECUTABLE); -+ AMDGPU_VM_PAGE_READABLE | AMDGPU_VM_PAGE_WRITEABLE | -+ AMDGPU_VM_PAGE_EXECUTABLE); - - if (r) { - DRM_ERROR("failed to do bo_map on static CSA, err=%d\n", r); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c -index 2992ce494e000c..fded8902346f5d 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c -@@ -2125,13 +2125,11 @@ void amdgpu_vm_adjust_size(struct amdgpu_device *adev, uint32_t min_vm_size, - */ - long amdgpu_vm_wait_idle(struct amdgpu_vm *vm, long timeout) - { -- timeout = dma_resv_wait_timeout(vm->root.bo->tbo.base.resv, -- DMA_RESV_USAGE_BOOKKEEP, -- true, timeout); -+ timeout = drm_sched_entity_flush(&vm->immediate, timeout); - if (timeout <= 0) - return timeout; - -- return dma_fence_wait_timeout(vm->last_unlocked, true, timeout); -+ return drm_sched_entity_flush(&vm->delayed, timeout); - } - - /** -diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c -index 12c7f4b46ea94f..b0c003da52fc1b 100644 ---- a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c -+++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c -@@ -36,40 +36,47 @@ - - static const char *mmhub_client_ids_v3_0_1[][2] = { - [0][0] = "VMC", -+ [1][0] = "ISPXT", -+ [2][0] = "ISPIXT", - [4][0] = "DCEDMC", - [5][0] = "DCEVGA", - [6][0] = "MP0", - [7][0] = "MP1", -- [8][0] = "MPIO", -- [16][0] = "HDP", -- [17][0] = "LSDMA", -- [18][0] = "JPEG", -- [19][0] = "VCNU0", -- [21][0] = "VSCH", -- [22][0] = "VCNU1", -- [23][0] = "VCN1", -- [32+20][0] = "VCN0", -- [2][1] = "DBGUNBIO", -+ [8][0] = "MPM", -+ [12][0] = "ISPTNR", -+ [14][0] = "ISPCRD0", -+ [15][0] = "ISPCRD1", -+ [16][0] = "ISPCRD2", -+ [22][0] = "HDP", -+ [23][0] = "LSDMA", -+ [24][0] = "JPEG", -+ [27][0] = "VSCH", -+ [28][0] = "VCNU", -+ [29][0] = "VCN", -+ [1][1] = "ISPXT", -+ [2][1] = "ISPIXT", - [3][1] = "DCEDWB", - [4][1] = "DCEDMC", - [5][1] = "DCEVGA", - [6][1] = "MP0", - [7][1] = "MP1", -- [8][1] = "MPIO", -- [10][1] = "DBGU0", -- [11][1] = "DBGU1", -- [12][1] = "DBGU2", -- [13][1] = "DBGU3", -- [14][1] = "XDP", -- [15][1] = "OSSSYS", -- [16][1] = "HDP", -- [17][1] = "LSDMA", -- [18][1] = "JPEG", -- [19][1] = "VCNU0", -- [20][1] = "VCN0", -- [21][1] = "VSCH", -- [22][1] = "VCNU1", -- [23][1] = "VCN1", -+ [8][1] = "MPM", -+ [10][1] = "ISPMWR0", -+ [11][1] = "ISPMWR1", -+ [12][1] = "ISPTNR", -+ [13][1] = "ISPSWR", -+ [14][1] = "ISPCWR0", -+ [15][1] = "ISPCWR1", -+ [16][1] = "ISPCWR2", -+ [17][1] = "ISPCWR3", -+ [18][1] = "XDP", -+ [21][1] = "OSSSYS", -+ [22][1] = "HDP", -+ [23][1] = "LSDMA", -+ [24][1] = "JPEG", -+ [27][1] = "VSCH", -+ [28][1] = "VCNU", -+ [29][1] = "VCN", - }; - - static uint32_t mmhub_v3_0_1_get_invalidate_req(unsigned int vmid, -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_module.c b/drivers/gpu/drm/amd/amdkfd/kfd_module.c -index aee2212e52f69a..33aa23450b3f72 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_module.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_module.c -@@ -78,8 +78,8 @@ static int kfd_init(void) - static void kfd_exit(void) - { - kfd_cleanup_processes(); -- kfd_debugfs_fini(); - kfd_process_destroy_wq(); -+ kfd_debugfs_fini(); - kfd_procfs_shutdown(); - kfd_topology_shutdown(); - kfd_chardev_exit(); -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index d4edddaa23dd3e..8421e5f0737bfc 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -4620,7 +4620,8 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev) - - static void amdgpu_dm_destroy_drm_device(struct amdgpu_display_manager *dm) - { -- drm_atomic_private_obj_fini(&dm->atomic_obj); -+ if (dm->atomic_obj.state) -+ drm_atomic_private_obj_fini(&dm->atomic_obj); - } - - /****************************************************************************** -@@ -6778,6 +6779,9 @@ amdgpu_dm_connector_atomic_check(struct drm_connector *conn, - struct amdgpu_dm_connector *aconn = to_amdgpu_dm_connector(conn); - int ret; - -+ if (WARN_ON(unlikely(!old_con_state || !new_con_state))) -+ return -EINVAL; -+ - trace_amdgpu_dm_connector_atomic_check(new_con_state); - - if (conn->connector_type == DRM_MODE_CONNECTOR_DisplayPort) { -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c -index 30d4c6fd95f531..dab732c6c6c7cc 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c -@@ -410,6 +410,15 @@ static int dm_crtc_helper_atomic_check(struct drm_crtc *crtc, - return -EINVAL; - } - -+ if (!state->legacy_cursor_update && amdgpu_dm_crtc_vrr_active(dm_crtc_state)) { -+ struct drm_plane_state *primary_state; -+ -+ /* Pull in primary plane for correct VRR handling */ -+ primary_state = drm_atomic_get_plane_state(state, crtc->primary); -+ if (IS_ERR(primary_state)) -+ return PTR_ERR(primary_state); -+ } -+ - /* In some use cases, like reset, no stream is attached */ - if (!dm_crtc_state->stream) - return 0; -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c -index fe96bab7d05d7b..67972d25366e59 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c -@@ -124,8 +124,10 @@ bool amdgpu_dm_link_setup_psr(struct dc_stream_state *stream) - psr_config.allow_multi_disp_optimizations = - (amdgpu_dc_feature_mask & DC_PSR_ALLOW_MULTI_DISP_OPT); - -- if (!psr_su_set_dsc_slice_height(dc, link, stream, &psr_config)) -- return false; -+ if (link->psr_settings.psr_version == DC_PSR_VERSION_SU_1) { -+ if (!psr_su_set_dsc_slice_height(dc, link, stream, &psr_config)) -+ return false; -+ } - - ret = dc_link_setup_psr(link, stream, &psr_config, &psr_context); - -diff --git a/drivers/gpu/drm/amd/display/dc/bios/command_table.c b/drivers/gpu/drm/amd/display/dc/bios/command_table.c -index 818a529cacc373..12a54fabd80ec8 100644 ---- a/drivers/gpu/drm/amd/display/dc/bios/command_table.c -+++ b/drivers/gpu/drm/amd/display/dc/bios/command_table.c -@@ -993,7 +993,7 @@ static enum bp_result set_pixel_clock_v3( - allocation.sPCLKInput.usFbDiv = - cpu_to_le16((uint16_t)bp_params->feedback_divider); - allocation.sPCLKInput.ucFracFbDiv = -- (uint8_t)bp_params->fractional_feedback_divider; -+ (uint8_t)(bp_params->fractional_feedback_divider / 100000); - allocation.sPCLKInput.ucPostDiv = - (uint8_t)bp_params->pixel_clock_post_divider; - -diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c -index dcedf96451615c..719881406f18e5 100644 ---- a/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c -@@ -162,7 +162,6 @@ struct clk_mgr *dc_clk_mgr_create(struct dc_context *ctx, struct pp_smu_funcs *p - return NULL; - } - dce60_clk_mgr_construct(ctx, clk_mgr); -- dce_clk_mgr_construct(ctx, clk_mgr); - return &clk_mgr->base; - } - #endif -diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dce100/dce_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dce100/dce_clk_mgr.c -index 26feefbb8990ae..b268c367c27cc4 100644 ---- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dce100/dce_clk_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dce100/dce_clk_mgr.c -@@ -386,8 +386,6 @@ static void dce_pplib_apply_display_requirements( - { - struct dm_pp_display_configuration *pp_display_cfg = &context->pp_display_cfg; - -- pp_display_cfg->avail_mclk_switch_time_us = dce110_get_min_vblank_time_us(context); -- - dce110_fill_display_configs(context, pp_display_cfg); - - if (memcmp(&dc->current_state->pp_display_cfg, pp_display_cfg, sizeof(*pp_display_cfg)) != 0) -diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c -index 78df96882d6ec5..fb2f154f4fda16 100644 ---- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c -@@ -120,9 +120,15 @@ void dce110_fill_display_configs( - const struct dc_state *context, - struct dm_pp_display_configuration *pp_display_cfg) - { -+ struct dc *dc = context->clk_mgr->ctx->dc; - int j; - int num_cfgs = 0; - -+ pp_display_cfg->avail_mclk_switch_time_us = dce110_get_min_vblank_time_us(context); -+ pp_display_cfg->disp_clk_khz = dc->clk_mgr->clks.dispclk_khz; -+ pp_display_cfg->avail_mclk_switch_time_in_disp_active_us = 0; -+ pp_display_cfg->crtc_index = dc->res_pool->res_cap->num_timing_generator; -+ - for (j = 0; j < context->stream_count; j++) { - int k; - -@@ -164,6 +170,23 @@ void dce110_fill_display_configs( - cfg->v_refresh /= stream->timing.h_total; - cfg->v_refresh = (cfg->v_refresh + stream->timing.v_total / 2) - / stream->timing.v_total; -+ -+ /* Find first CRTC index and calculate its line time. -+ * This is necessary for DPM on SI GPUs. -+ */ -+ if (cfg->pipe_idx < pp_display_cfg->crtc_index) { -+ const struct dc_crtc_timing *timing = -+ &context->streams[0]->timing; -+ -+ pp_display_cfg->crtc_index = cfg->pipe_idx; -+ pp_display_cfg->line_time_in_us = -+ timing->h_total * 10000 / timing->pix_clk_100hz; -+ } -+ } -+ -+ if (!num_cfgs) { -+ pp_display_cfg->crtc_index = 0; -+ pp_display_cfg->line_time_in_us = 0; - } - - pp_display_cfg->display_count = num_cfgs; -@@ -223,25 +246,8 @@ void dce11_pplib_apply_display_requirements( - pp_display_cfg->min_engine_clock_deep_sleep_khz - = context->bw_ctx.bw.dce.sclk_deep_sleep_khz; - -- pp_display_cfg->avail_mclk_switch_time_us = -- dce110_get_min_vblank_time_us(context); -- /* TODO: dce11.2*/ -- pp_display_cfg->avail_mclk_switch_time_in_disp_active_us = 0; -- -- pp_display_cfg->disp_clk_khz = dc->clk_mgr->clks.dispclk_khz; -- - dce110_fill_display_configs(context, pp_display_cfg); - -- /* TODO: is this still applicable?*/ -- if (pp_display_cfg->display_count == 1) { -- const struct dc_crtc_timing *timing = -- &context->streams[0]->timing; -- -- pp_display_cfg->crtc_index = -- pp_display_cfg->disp_configs[0].pipe_idx; -- pp_display_cfg->line_time_in_us = timing->h_total * 10000 / timing->pix_clk_100hz; -- } -- - if (memcmp(&dc->current_state->pp_display_cfg, pp_display_cfg, sizeof(*pp_display_cfg)) != 0) - dm_pp_apply_display_requirements(dc->ctx, pp_display_cfg); - } -diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dce60/dce60_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dce60/dce60_clk_mgr.c -index 0267644717b27a..ffd0f4a7631023 100644 ---- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dce60/dce60_clk_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dce60/dce60_clk_mgr.c -@@ -83,22 +83,13 @@ static const struct state_dependent_clocks dce60_max_clks_by_state[] = { - static int dce60_get_dp_ref_freq_khz(struct clk_mgr *clk_mgr_base) - { - struct clk_mgr_internal *clk_mgr = TO_CLK_MGR_INTERNAL(clk_mgr_base); -- int dprefclk_wdivider; -- int dp_ref_clk_khz; -- int target_div; -+ struct dc_context *ctx = clk_mgr_base->ctx; -+ int dp_ref_clk_khz = 0; - -- /* DCE6 has no DPREFCLK_CNTL to read DP Reference Clock source */ -- -- /* Read the mmDENTIST_DISPCLK_CNTL to get the currently -- * programmed DID DENTIST_DPREFCLK_WDIVIDER*/ -- REG_GET(DENTIST_DISPCLK_CNTL, DENTIST_DPREFCLK_WDIVIDER, &dprefclk_wdivider); -- -- /* Convert DENTIST_DPREFCLK_WDIVIDERto actual divider*/ -- target_div = dentist_get_divider_from_did(dprefclk_wdivider); -- -- /* Calculate the current DFS clock, in kHz.*/ -- dp_ref_clk_khz = (DENTIST_DIVIDER_RANGE_SCALE_FACTOR -- * clk_mgr->base.dentist_vco_freq_khz) / target_div; -+ if (ASIC_REV_IS_TAHITI_P(ctx->asic_id.hw_internal_rev)) -+ dp_ref_clk_khz = ctx->dc_bios->fw_info.default_display_engine_pll_frequency; -+ else -+ dp_ref_clk_khz = clk_mgr_base->clks.dispclk_khz; - - return dce_adjust_dp_ref_freq_for_ss(clk_mgr, dp_ref_clk_khz); - } -@@ -109,8 +100,6 @@ static void dce60_pplib_apply_display_requirements( - { - struct dm_pp_display_configuration *pp_display_cfg = &context->pp_display_cfg; - -- pp_display_cfg->avail_mclk_switch_time_us = dce110_get_min_vblank_time_us(context); -- - dce110_fill_display_configs(context, pp_display_cfg); - - if (memcmp(&dc->current_state->pp_display_cfg, pp_display_cfg, sizeof(*pp_display_cfg)) != 0) -@@ -123,11 +112,9 @@ static void dce60_update_clocks(struct clk_mgr *clk_mgr_base, - { - struct clk_mgr_internal *clk_mgr_dce = TO_CLK_MGR_INTERNAL(clk_mgr_base); - struct dm_pp_power_level_change_request level_change_req; -- int patched_disp_clk = context->bw_ctx.bw.dce.dispclk_khz; -- -- /*TODO: W/A for dal3 linux, investigate why this works */ -- if (!clk_mgr_dce->dfs_bypass_active) -- patched_disp_clk = patched_disp_clk * 115 / 100; -+ const int max_disp_clk = -+ clk_mgr_dce->max_clks_by_state[DM_PP_CLOCKS_STATE_PERFORMANCE].display_clk_khz; -+ int patched_disp_clk = min(max_disp_clk, context->bw_ctx.bw.dce.dispclk_khz); - - level_change_req.power_level = dce_get_required_clocks_state(clk_mgr_base, context); - /* get max clock state from PPLIB */ -diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c -index a825fd6c7fa666..f0b472e84a53d7 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c -@@ -163,14 +163,13 @@ static void dcn20_setup_gsl_group_as_lock( - } - - /* at this point we want to program whether it's to enable or disable */ -- if (pipe_ctx->stream_res.tg->funcs->set_gsl != NULL && -- pipe_ctx->stream_res.tg->funcs->set_gsl_source_select != NULL) { -+ if (pipe_ctx->stream_res.tg->funcs->set_gsl != NULL) { - pipe_ctx->stream_res.tg->funcs->set_gsl( - pipe_ctx->stream_res.tg, - &gsl); -- -- pipe_ctx->stream_res.tg->funcs->set_gsl_source_select( -- pipe_ctx->stream_res.tg, group_idx, enable ? 4 : 0); -+ if (pipe_ctx->stream_res.tg->funcs->set_gsl_source_select != NULL) -+ pipe_ctx->stream_res.tg->funcs->set_gsl_source_select( -+ pipe_ctx->stream_res.tg, group_idx, enable ? 4 : 0); - } else - BREAK_TO_DEBUGGER(); - } -@@ -782,7 +781,7 @@ enum dc_status dcn20_enable_stream_timing( - return DC_ERROR_UNEXPECTED; - } - -- hws->funcs.wait_for_blank_complete(pipe_ctx->stream_res.opp); -+ fsleep(stream->timing.v_total * (stream->timing.h_total * 10000u / stream->timing.pix_clk_100hz)); - - params.vertical_total_min = stream->adjust.v_total_min; - params.vertical_total_max = stream->adjust.v_total_max; -diff --git a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c -index 9b470812d96a5f..2ce2d9ff7568a6 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c -+++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c -@@ -137,7 +137,8 @@ void link_blank_dp_stream(struct dc_link *link, bool hw_init) - } - } - -- if ((!link->wa_flags.dp_keep_receiver_powered) || hw_init) -+ if (((!link->wa_flags.dp_keep_receiver_powered) || hw_init) && -+ (link->type != dc_connection_none)) - dpcd_write_rx_power_ctrl(link, false); - } - } -diff --git a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c -index 7f8f127e7722de..ab6964ca1c2b47 100644 ---- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c -+++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c -@@ -260,6 +260,9 @@ enum mod_hdcp_status mod_hdcp_hdcp1_create_session(struct mod_hdcp *hdcp) - return MOD_HDCP_STATUS_FAILURE; - } - -+ if (!display) -+ return MOD_HDCP_STATUS_DISPLAY_NOT_FOUND; -+ - hdcp_cmd = (struct ta_hdcp_shared_memory *)psp->hdcp_context.context.mem_context.shared_buf; - - mutex_lock(&psp->hdcp_context.mutex); -diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c -index 2997aeed634084..632fc8aed6536f 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c -@@ -1757,6 +1757,12 @@ static int smu_resume(void *handle) - - adev->pm.dpm_enabled = true; - -+ if (smu->current_power_limit) { -+ ret = smu_set_power_limit(smu, smu->current_power_limit); -+ if (ret && ret != -EOPNOTSUPP) -+ return ret; -+ } -+ - dev_info(adev->dev, "SMU is resumed successfully!\n"); - - return 0; -diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c -index 454216bd6f1dd2..4fabecaa2b4195 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c -@@ -686,7 +686,6 @@ static int vangogh_print_clk_levels(struct smu_context *smu, - { - DpmClocks_t *clk_table = smu->smu_table.clocks_table; - SmuMetrics_t metrics; -- struct smu_dpm_context *smu_dpm_ctx = &(smu->smu_dpm); - int i, idx, size = 0, ret = 0; - uint32_t cur_value = 0, value = 0, count = 0; - bool cur_value_match_level = false; -@@ -702,31 +701,25 @@ static int vangogh_print_clk_levels(struct smu_context *smu, - - switch (clk_type) { - case SMU_OD_SCLK: -- if (smu_dpm_ctx->dpm_level == AMD_DPM_FORCED_LEVEL_MANUAL) { -- size += sysfs_emit_at(buf, size, "%s:\n", "OD_SCLK"); -- size += sysfs_emit_at(buf, size, "0: %10uMhz\n", -- (smu->gfx_actual_hard_min_freq > 0) ? smu->gfx_actual_hard_min_freq : smu->gfx_default_hard_min_freq); -- size += sysfs_emit_at(buf, size, "1: %10uMhz\n", -- (smu->gfx_actual_soft_max_freq > 0) ? smu->gfx_actual_soft_max_freq : smu->gfx_default_soft_max_freq); -- } -+ size += sysfs_emit_at(buf, size, "%s:\n", "OD_SCLK"); -+ size += sysfs_emit_at(buf, size, "0: %10uMhz\n", -+ (smu->gfx_actual_hard_min_freq > 0) ? smu->gfx_actual_hard_min_freq : smu->gfx_default_hard_min_freq); -+ size += sysfs_emit_at(buf, size, "1: %10uMhz\n", -+ (smu->gfx_actual_soft_max_freq > 0) ? smu->gfx_actual_soft_max_freq : smu->gfx_default_soft_max_freq); - break; - case SMU_OD_CCLK: -- if (smu_dpm_ctx->dpm_level == AMD_DPM_FORCED_LEVEL_MANUAL) { -- size += sysfs_emit_at(buf, size, "CCLK_RANGE in Core%d:\n", smu->cpu_core_id_select); -- size += sysfs_emit_at(buf, size, "0: %10uMhz\n", -- (smu->cpu_actual_soft_min_freq > 0) ? smu->cpu_actual_soft_min_freq : smu->cpu_default_soft_min_freq); -- size += sysfs_emit_at(buf, size, "1: %10uMhz\n", -- (smu->cpu_actual_soft_max_freq > 0) ? smu->cpu_actual_soft_max_freq : smu->cpu_default_soft_max_freq); -- } -+ size += sysfs_emit_at(buf, size, "CCLK_RANGE in Core%d:\n", smu->cpu_core_id_select); -+ size += sysfs_emit_at(buf, size, "0: %10uMhz\n", -+ (smu->cpu_actual_soft_min_freq > 0) ? smu->cpu_actual_soft_min_freq : smu->cpu_default_soft_min_freq); -+ size += sysfs_emit_at(buf, size, "1: %10uMhz\n", -+ (smu->cpu_actual_soft_max_freq > 0) ? smu->cpu_actual_soft_max_freq : smu->cpu_default_soft_max_freq); - break; - case SMU_OD_RANGE: -- if (smu_dpm_ctx->dpm_level == AMD_DPM_FORCED_LEVEL_MANUAL) { -- size += sysfs_emit_at(buf, size, "%s:\n", "OD_RANGE"); -- size += sysfs_emit_at(buf, size, "SCLK: %7uMhz %10uMhz\n", -- smu->gfx_default_hard_min_freq, smu->gfx_default_soft_max_freq); -- size += sysfs_emit_at(buf, size, "CCLK: %7uMhz %10uMhz\n", -- smu->cpu_default_soft_min_freq, smu->cpu_default_soft_max_freq); -- } -+ size += sysfs_emit_at(buf, size, "%s:\n", "OD_RANGE"); -+ size += sysfs_emit_at(buf, size, "SCLK: %7uMhz %10uMhz\n", -+ smu->gfx_default_hard_min_freq, smu->gfx_default_soft_max_freq); -+ size += sysfs_emit_at(buf, size, "CCLK: %7uMhz %10uMhz\n", -+ smu->cpu_default_soft_min_freq, smu->cpu_default_soft_max_freq); - break; - case SMU_SOCCLK: - /* the level 3 ~ 6 of socclk use the same frequency for vangogh */ -diff --git a/drivers/gpu/drm/display/drm_dp_helper.c b/drivers/gpu/drm/display/drm_dp_helper.c -index 851f0baf94600c..772d8e662278b9 100644 ---- a/drivers/gpu/drm/display/drm_dp_helper.c -+++ b/drivers/gpu/drm/display/drm_dp_helper.c -@@ -663,7 +663,7 @@ ssize_t drm_dp_dpcd_read(struct drm_dp_aux *aux, unsigned int offset, - * monitor doesn't power down exactly after the throw away read. - */ - if (!aux->is_remote) { -- ret = drm_dp_dpcd_probe(aux, DP_DPCD_REV); -+ ret = drm_dp_dpcd_probe(aux, DP_LANE0_1_STATUS); - if (ret < 0) - return ret; - } -diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c -index 8a98fa276e8a9d..96f960bcfd82d3 100644 ---- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c -+++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c -@@ -258,13 +258,13 @@ static int hibmc_load(struct drm_device *dev) - - ret = hibmc_hw_init(priv); - if (ret) -- goto err; -+ return ret; - - ret = drmm_vram_helper_init(dev, pci_resource_start(pdev, 0), - pci_resource_len(pdev, 0)); - if (ret) { - drm_err(dev, "Error initializing VRAM MM; %d\n", ret); -- goto err; -+ return ret; - } - - ret = hibmc_kms_init(priv); -diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c -index 6d8e5e5c0cba28..37c963d33bb7eb 100644 ---- a/drivers/gpu/drm/i915/intel_runtime_pm.c -+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c -@@ -434,7 +434,10 @@ static intel_wakeref_t __intel_runtime_pm_get_if_active(struct intel_runtime_pm - * function, since the power state is undefined. This applies - * atm to the late/early system suspend/resume handlers. - */ -- if (pm_runtime_get_if_active(rpm->kdev, ignore_usecount) <= 0) -+ if ((ignore_usecount && -+ pm_runtime_get_if_active(rpm->kdev) <= 0) || -+ (!ignore_usecount && -+ pm_runtime_get_if_in_use(rpm->kdev) <= 0)) - return 0; - } - -diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c -index 1113e6b2ec8ec9..aaf7c338eb96d2 100644 ---- a/drivers/gpu/drm/msm/msm_gem.c -+++ b/drivers/gpu/drm/msm/msm_gem.c -@@ -928,7 +928,8 @@ void msm_gem_describe(struct drm_gem_object *obj, struct seq_file *m, - uint64_t off = drm_vma_node_start(&obj->vma_node); - const char *madv; - -- msm_gem_lock(obj); -+ if (!msm_gem_trylock(obj)) -+ return; - - stats->all.count++; - stats->all.size += obj->size; -diff --git a/drivers/gpu/drm/msm/msm_gem.h b/drivers/gpu/drm/msm/msm_gem.h -index 8ddef544314083..631a9aa129bd5d 100644 ---- a/drivers/gpu/drm/msm/msm_gem.h -+++ b/drivers/gpu/drm/msm/msm_gem.h -@@ -183,6 +183,12 @@ msm_gem_lock(struct drm_gem_object *obj) - dma_resv_lock(obj->resv, NULL); - } - -+static inline bool __must_check -+msm_gem_trylock(struct drm_gem_object *obj) -+{ -+ return dma_resv_trylock(obj->resv); -+} -+ - static inline int - msm_gem_lock_interruptible(struct drm_gem_object *obj) - { -diff --git a/drivers/gpu/drm/nouveau/nvif/vmm.c b/drivers/gpu/drm/nouveau/nvif/vmm.c -index 99296f03371ae0..07c1ebc2a94141 100644 ---- a/drivers/gpu/drm/nouveau/nvif/vmm.c -+++ b/drivers/gpu/drm/nouveau/nvif/vmm.c -@@ -219,7 +219,8 @@ nvif_vmm_ctor(struct nvif_mmu *mmu, const char *name, s32 oclass, - case RAW: args->type = NVIF_VMM_V0_TYPE_RAW; break; - default: - WARN_ON(1); -- return -EINVAL; -+ ret = -EINVAL; -+ goto done; - } - - memcpy(args->data, argv, argc); -diff --git a/drivers/gpu/drm/renesas/rcar-du/rzg2l_mipi_dsi.c b/drivers/gpu/drm/renesas/rcar-du/rzg2l_mipi_dsi.c -index 10febea473cde9..6cec796dd463f6 100644 ---- a/drivers/gpu/drm/renesas/rcar-du/rzg2l_mipi_dsi.c -+++ b/drivers/gpu/drm/renesas/rcar-du/rzg2l_mipi_dsi.c -@@ -585,6 +585,9 @@ rzg2l_mipi_dsi_bridge_mode_valid(struct drm_bridge *bridge, - if (mode->clock > 148500) - return MODE_CLOCK_HIGH; - -+ if (mode->clock < 5803) -+ return MODE_CLOCK_LOW; -+ - return MODE_OK; - } - -diff --git a/drivers/gpu/drm/ttm/ttm_pool.c b/drivers/gpu/drm/ttm/ttm_pool.c -index 37c08fac7e7d01..80ba34cabca368 100644 ---- a/drivers/gpu/drm/ttm/ttm_pool.c -+++ b/drivers/gpu/drm/ttm/ttm_pool.c -@@ -615,7 +615,6 @@ void ttm_pool_fini(struct ttm_pool *pool) - } - EXPORT_SYMBOL(ttm_pool_fini); - --/* As long as pages are available make sure to release at least one */ - static unsigned long ttm_pool_shrinker_scan(struct shrinker *shrink, - struct shrink_control *sc) - { -@@ -623,9 +622,12 @@ static unsigned long ttm_pool_shrinker_scan(struct shrinker *shrink, - - do - num_freed += ttm_pool_shrink(); -- while (!num_freed && atomic_long_read(&allocated_pages)); -+ while (num_freed < sc->nr_to_scan && -+ atomic_long_read(&allocated_pages)); - -- return num_freed; -+ sc->nr_scanned = num_freed; -+ -+ return num_freed ?: SHRINK_STOP; - } - - /* Return the number of pages available or SHRINK_EMPTY if we have none */ -diff --git a/drivers/gpu/drm/ttm/ttm_resource.c b/drivers/gpu/drm/ttm/ttm_resource.c -index 46ff9c75bb124a..8f2423a15c71c6 100644 ---- a/drivers/gpu/drm/ttm/ttm_resource.c -+++ b/drivers/gpu/drm/ttm/ttm_resource.c -@@ -437,6 +437,9 @@ int ttm_resource_manager_evict_all(struct ttm_device *bdev, - } - spin_unlock(&bdev->lru_lock); - -+ if (ret && ret != -ENOENT) -+ return ret; -+ - spin_lock(&man->move_lock); - fence = dma_fence_get(man->move); - spin_unlock(&man->move_lock); -diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c -index 0b561c1eb59e2e..7cf17c671da488 100644 ---- a/drivers/hid/hid-apple.c -+++ b/drivers/hid/hid-apple.c -@@ -858,10 +858,12 @@ static int apple_probe(struct hid_device *hdev, - return ret; - } - -- timer_setup(&asc->battery_timer, apple_battery_timer_tick, 0); -- mod_timer(&asc->battery_timer, -- jiffies + msecs_to_jiffies(APPLE_BATTERY_TIMEOUT_MS)); -- apple_fetch_battery(hdev); -+ if (quirks & APPLE_RDESC_BATTERY) { -+ timer_setup(&asc->battery_timer, apple_battery_timer_tick, 0); -+ mod_timer(&asc->battery_timer, -+ jiffies + msecs_to_jiffies(APPLE_BATTERY_TIMEOUT_MS)); -+ apple_fetch_battery(hdev); -+ } - - if (quirks & APPLE_BACKLIGHT_CTL) - apple_backlight_init(hdev); -@@ -873,7 +875,8 @@ static void apple_remove(struct hid_device *hdev) - { - struct apple_sc *asc = hid_get_drvdata(hdev); - -- del_timer_sync(&asc->battery_timer); -+ if (asc->quirks & APPLE_RDESC_BATTERY) -+ del_timer_sync(&asc->battery_timer); - - hid_hw_stop(hdev); - } -diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c -index 9bb8daf7f78609..4fe1e0bc244934 100644 ---- a/drivers/hid/hid-magicmouse.c -+++ b/drivers/hid/hid-magicmouse.c -@@ -772,16 +772,30 @@ static void magicmouse_enable_mt_work(struct work_struct *work) - hid_err(msc->hdev, "unable to request touch data (%d)\n", ret); - } - -+static bool is_usb_magicmouse2(__u32 vendor, __u32 product) -+{ -+ if (vendor != USB_VENDOR_ID_APPLE) -+ return false; -+ return product == USB_DEVICE_ID_APPLE_MAGICMOUSE2; -+} -+ -+static bool is_usb_magictrackpad2(__u32 vendor, __u32 product) -+{ -+ if (vendor != USB_VENDOR_ID_APPLE) -+ return false; -+ return product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 || -+ product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC; -+} -+ - static int magicmouse_fetch_battery(struct hid_device *hdev) - { - #ifdef CONFIG_HID_BATTERY_STRENGTH - struct hid_report_enum *report_enum; - struct hid_report *report; - -- if (!hdev->battery || hdev->vendor != USB_VENDOR_ID_APPLE || -- (hdev->product != USB_DEVICE_ID_APPLE_MAGICMOUSE2 && -- hdev->product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 && -- hdev->product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC)) -+ if (!hdev->battery || -+ (!is_usb_magicmouse2(hdev->vendor, hdev->product) && -+ !is_usb_magictrackpad2(hdev->vendor, hdev->product))) - return -1; - - report_enum = &hdev->report_enum[hdev->battery_report_type]; -@@ -843,16 +857,17 @@ static int magicmouse_probe(struct hid_device *hdev, - return ret; - } - -- timer_setup(&msc->battery_timer, magicmouse_battery_timer_tick, 0); -- mod_timer(&msc->battery_timer, -- jiffies + msecs_to_jiffies(USB_BATTERY_TIMEOUT_MS)); -- magicmouse_fetch_battery(hdev); -+ if (is_usb_magicmouse2(id->vendor, id->product) || -+ is_usb_magictrackpad2(id->vendor, id->product)) { -+ timer_setup(&msc->battery_timer, magicmouse_battery_timer_tick, 0); -+ mod_timer(&msc->battery_timer, -+ jiffies + msecs_to_jiffies(USB_BATTERY_TIMEOUT_MS)); -+ magicmouse_fetch_battery(hdev); -+ } - -- if (id->vendor == USB_VENDOR_ID_APPLE && -- (id->product == USB_DEVICE_ID_APPLE_MAGICMOUSE2 || -- ((id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 || -- id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) && -- hdev->type != HID_TYPE_USBMOUSE))) -+ if (is_usb_magicmouse2(id->vendor, id->product) || -+ (is_usb_magictrackpad2(id->vendor, id->product) && -+ hdev->type != HID_TYPE_USBMOUSE)) - return 0; - - if (!msc->input) { -@@ -908,7 +923,10 @@ static int magicmouse_probe(struct hid_device *hdev, - - return 0; - err_stop_hw: -- del_timer_sync(&msc->battery_timer); -+ if (is_usb_magicmouse2(id->vendor, id->product) || -+ is_usb_magictrackpad2(id->vendor, id->product)) -+ del_timer_sync(&msc->battery_timer); -+ - hid_hw_stop(hdev); - return ret; - } -@@ -919,7 +937,9 @@ static void magicmouse_remove(struct hid_device *hdev) - - if (msc) { - cancel_delayed_work_sync(&msc->work); -- del_timer_sync(&msc->battery_timer); -+ if (is_usb_magicmouse2(hdev->vendor, hdev->product) || -+ is_usb_magictrackpad2(hdev->vendor, hdev->product)) -+ del_timer_sync(&msc->battery_timer); - } - - hid_hw_stop(hdev); -@@ -936,10 +956,8 @@ static __u8 *magicmouse_report_fixup(struct hid_device *hdev, __u8 *rdesc, - * 0x05, 0x01, // Usage Page (Generic Desktop) 0 - * 0x09, 0x02, // Usage (Mouse) 2 - */ -- if (hdev->vendor == USB_VENDOR_ID_APPLE && -- (hdev->product == USB_DEVICE_ID_APPLE_MAGICMOUSE2 || -- hdev->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 || -- hdev->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) && -+ if ((is_usb_magicmouse2(hdev->vendor, hdev->product) || -+ is_usb_magictrackpad2(hdev->vendor, hdev->product)) && - *rsize == 83 && rdesc[46] == 0x84 && rdesc[58] == 0x85) { - hid_info(hdev, - "fixing up magicmouse battery report descriptor\n"); -diff --git a/drivers/hwmon/emc2305.c b/drivers/hwmon/emc2305.c -index 29f0e4945f1924..840acd5260f4e4 100644 ---- a/drivers/hwmon/emc2305.c -+++ b/drivers/hwmon/emc2305.c -@@ -303,6 +303,12 @@ static int emc2305_set_single_tz(struct device *dev, int idx) - dev_err(dev, "Failed to register cooling device %s\n", emc2305_fan_name[idx]); - return PTR_ERR(data->cdev_data[cdev_idx].cdev); - } -+ -+ if (data->cdev_data[cdev_idx].cur_state > 0) -+ /* Update pwm when temperature is above trips */ -+ pwm = EMC2305_PWM_STATE2DUTY(data->cdev_data[cdev_idx].cur_state, -+ data->max_state, EMC2305_FAN_MAX); -+ - /* Set minimal PWM speed. */ - if (data->pwm_separate) { - ret = emc2305_set_pwm(dev, pwm, cdev_idx); -@@ -316,10 +322,10 @@ static int emc2305_set_single_tz(struct device *dev, int idx) - } - } - data->cdev_data[cdev_idx].cur_state = -- EMC2305_PWM_DUTY2STATE(data->pwm_min[cdev_idx], data->max_state, -+ EMC2305_PWM_DUTY2STATE(pwm, data->max_state, - EMC2305_FAN_MAX); - data->cdev_data[cdev_idx].last_hwmon_state = -- EMC2305_PWM_DUTY2STATE(data->pwm_min[cdev_idx], data->max_state, -+ EMC2305_PWM_DUTY2STATE(pwm, data->max_state, - EMC2305_FAN_MAX); - return 0; - } -diff --git a/drivers/hwmon/gsc-hwmon.c b/drivers/hwmon/gsc-hwmon.c -index 1501ceb551e796..23238a80c000dd 100644 ---- a/drivers/hwmon/gsc-hwmon.c -+++ b/drivers/hwmon/gsc-hwmon.c -@@ -65,7 +65,7 @@ static ssize_t pwm_auto_point_temp_show(struct device *dev, - return ret; - - ret = regs[0] | regs[1] << 8; -- return sprintf(buf, "%d\n", ret * 10); -+ return sprintf(buf, "%d\n", ret * 100); - } - - static ssize_t pwm_auto_point_temp_store(struct device *dev, -@@ -100,7 +100,7 @@ static ssize_t pwm_auto_point_pwm_show(struct device *dev, - { - struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr); - -- return sprintf(buf, "%d\n", 255 * (50 + (attr->index * 10))); -+ return sprintf(buf, "%d\n", 255 * (50 + (attr->index * 10)) / 100); - } - - static SENSOR_DEVICE_ATTR_RO(pwm1_auto_point1_pwm, pwm_auto_point_pwm, 0); -diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c -index d2499f302b5083..f43067f6797e94 100644 ---- a/drivers/i2c/i2c-core-acpi.c -+++ b/drivers/i2c/i2c-core-acpi.c -@@ -370,6 +370,7 @@ static const struct acpi_device_id i2c_acpi_force_100khz_device_ids[] = { - * the device works without issues on Windows at what is expected to be - * a 400KHz frequency. The root cause of the issue is not known. - */ -+ { "DLL0945", 0 }, - { "ELAN06FA", 0 }, - {} - }; -diff --git a/drivers/i3c/internals.h b/drivers/i3c/internals.h -index 908a807badaf9c..e267ea5ec5b95e 100644 ---- a/drivers/i3c/internals.h -+++ b/drivers/i3c/internals.h -@@ -9,6 +9,7 @@ - #define I3C_INTERNALS_H - - #include -+#include - - extern struct bus_type i3c_bus_type; - -diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c -index 33254bc338b9c0..b6995e767850b4 100644 ---- a/drivers/i3c/master.c -+++ b/drivers/i3c/master.c -@@ -1398,7 +1398,7 @@ static int i3c_master_retrieve_dev_info(struct i3c_dev_desc *dev) - - if (dev->info.bcr & I3C_BCR_HDR_CAP) { - ret = i3c_master_gethdrcap_locked(master, &dev->info); -- if (ret) -+ if (ret && ret != -ENOTSUPP) - return ret; - } - -@@ -2430,6 +2430,8 @@ static int i3c_i2c_notifier_call(struct notifier_block *nb, unsigned long action - case BUS_NOTIFY_DEL_DEVICE: - ret = i3c_master_i2c_detach(adap, client); - break; -+ default: -+ ret = -EINVAL; - } - i3c_bus_maintenance_unlock(&master->bus); - -diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c -index 44842f243f40b5..6908052dea7785 100644 ---- a/drivers/idle/intel_idle.c -+++ b/drivers/idle/intel_idle.c -@@ -1432,7 +1432,7 @@ static const struct x86_cpu_id intel_idle_ids[] __initconst = { - }; - - static const struct x86_cpu_id intel_mwait_ids[] __initconst = { -- X86_MATCH_VENDOR_FAM_FEATURE(INTEL, 6, X86_FEATURE_MWAIT, NULL), -+ X86_MATCH_VENDOR_FAM_FEATURE(INTEL, X86_FAMILY_ANY, X86_FEATURE_MWAIT, NULL), - {} - }; - -diff --git a/drivers/iio/adc/ad7768-1.c b/drivers/iio/adc/ad7768-1.c -index 967f06cd3f94e7..e147eaf1a3b15f 100644 ---- a/drivers/iio/adc/ad7768-1.c -+++ b/drivers/iio/adc/ad7768-1.c -@@ -203,6 +203,24 @@ static int ad7768_spi_reg_write(struct ad7768_state *st, - return spi_write(st->spi, st->data.d8, 2); - } - -+static int ad7768_send_sync_pulse(struct ad7768_state *st) -+{ -+ /* -+ * The datasheet specifies a minimum SYNC_IN pulse width of 1.5 × Tmclk, -+ * where Tmclk is the MCLK period. The supported MCLK frequencies range -+ * from 0.6 MHz to 17 MHz, which corresponds to a minimum SYNC_IN pulse -+ * width of approximately 2.5 µs in the worst-case scenario (0.6 MHz). -+ * -+ * Add a delay to ensure the pulse width is always sufficient to -+ * trigger synchronization. -+ */ -+ gpiod_set_value_cansleep(st->gpio_sync_in, 1); -+ fsleep(3); -+ gpiod_set_value_cansleep(st->gpio_sync_in, 0); -+ -+ return 0; -+} -+ - static int ad7768_set_mode(struct ad7768_state *st, - enum ad7768_conv_mode mode) - { -@@ -288,10 +306,7 @@ static int ad7768_set_dig_fil(struct ad7768_state *st, - return ret; - - /* A sync-in pulse is required every time the filter dec rate changes */ -- gpiod_set_value(st->gpio_sync_in, 1); -- gpiod_set_value(st->gpio_sync_in, 0); -- -- return 0; -+ return ad7768_send_sync_pulse(st); - } - - static int ad7768_set_freq(struct ad7768_state *st, -diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c -index 533667eefe419c..914274ed899ec0 100644 ---- a/drivers/iio/adc/ad_sigma_delta.c -+++ b/drivers/iio/adc/ad_sigma_delta.c -@@ -378,7 +378,7 @@ static int ad_sd_buffer_postenable(struct iio_dev *indio_dev) - return ret; - } - -- samples_buf_size = ALIGN(slot * indio_dev->channels[0].scan_type.storagebits, 8); -+ samples_buf_size = ALIGN(slot * indio_dev->channels[0].scan_type.storagebits / 8, 8); - samples_buf_size += sizeof(int64_t); - samples_buf = devm_krealloc(&sigma_delta->spi->dev, sigma_delta->samples_buf, - samples_buf_size, GFP_KERNEL); -@@ -406,7 +406,7 @@ static int ad_sd_buffer_postenable(struct iio_dev *indio_dev) - return ret; - } - --static int ad_sd_buffer_postdisable(struct iio_dev *indio_dev) -+static int ad_sd_buffer_predisable(struct iio_dev *indio_dev) - { - struct ad_sigma_delta *sigma_delta = iio_device_get_drvdata(indio_dev); - -@@ -534,7 +534,7 @@ static bool ad_sd_validate_scan_mask(struct iio_dev *indio_dev, const unsigned l - - static const struct iio_buffer_setup_ops ad_sd_buffer_setup_ops = { - .postenable = &ad_sd_buffer_postenable, -- .postdisable = &ad_sd_buffer_postdisable, -+ .predisable = &ad_sd_buffer_predisable, - .validate_scan_mask = &ad_sd_validate_scan_mask, - }; - -diff --git a/drivers/iio/imu/bno055/bno055.c b/drivers/iio/imu/bno055/bno055.c -index 52744dd98e65b4..98f17c29da69bd 100644 ---- a/drivers/iio/imu/bno055/bno055.c -+++ b/drivers/iio/imu/bno055/bno055.c -@@ -118,6 +118,7 @@ struct bno055_sysfs_attr { - int len; - int *fusion_vals; - int *hw_xlate; -+ int hw_xlate_len; - int type; - }; - -@@ -170,20 +171,24 @@ static int bno055_gyr_scale_vals[] = { - 1000, 1877467, 2000, 1877467, - }; - -+static int bno055_gyr_scale_hw_xlate[] = {0, 1, 2, 3, 4}; - static struct bno055_sysfs_attr bno055_gyr_scale = { - .vals = bno055_gyr_scale_vals, - .len = ARRAY_SIZE(bno055_gyr_scale_vals), - .fusion_vals = (int[]){1, 900}, -- .hw_xlate = (int[]){4, 3, 2, 1, 0}, -+ .hw_xlate = bno055_gyr_scale_hw_xlate, -+ .hw_xlate_len = ARRAY_SIZE(bno055_gyr_scale_hw_xlate), - .type = IIO_VAL_FRACTIONAL, - }; - - static int bno055_gyr_lpf_vals[] = {12, 23, 32, 47, 64, 116, 230, 523}; -+static int bno055_gyr_lpf_hw_xlate[] = {5, 4, 7, 3, 6, 2, 1, 0}; - static struct bno055_sysfs_attr bno055_gyr_lpf = { - .vals = bno055_gyr_lpf_vals, - .len = ARRAY_SIZE(bno055_gyr_lpf_vals), - .fusion_vals = (int[]){32}, -- .hw_xlate = (int[]){5, 4, 7, 3, 6, 2, 1, 0}, -+ .hw_xlate = bno055_gyr_lpf_hw_xlate, -+ .hw_xlate_len = ARRAY_SIZE(bno055_gyr_lpf_hw_xlate), - .type = IIO_VAL_INT, - }; - -@@ -561,7 +566,7 @@ static int bno055_get_regmask(struct bno055_priv *priv, int *val, int *val2, - - idx = (hwval & mask) >> shift; - if (attr->hw_xlate) -- for (i = 0; i < attr->len; i++) -+ for (i = 0; i < attr->hw_xlate_len; i++) - if (attr->hw_xlate[i] == idx) { - idx = i; - break; -diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600.h b/drivers/iio/imu/inv_icm42600/inv_icm42600.h -index 94c0eb0bf8748a..809734e566e332 100644 ---- a/drivers/iio/imu/inv_icm42600/inv_icm42600.h -+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600.h -@@ -142,11 +142,11 @@ struct inv_icm42600_state { - struct inv_icm42600_suspended suspended; - struct iio_dev *indio_gyro; - struct iio_dev *indio_accel; -- uint8_t buffer[2] __aligned(IIO_DMA_MINALIGN); -+ u8 buffer[2] __aligned(IIO_DMA_MINALIGN); - struct inv_icm42600_fifo fifo; - struct { -- int64_t gyro; -- int64_t accel; -+ s64 gyro; -+ s64 accel; - } timestamp; - }; - -@@ -369,7 +369,7 @@ const struct iio_mount_matrix * - inv_icm42600_get_mount_matrix(const struct iio_dev *indio_dev, - const struct iio_chan_spec *chan); - --uint32_t inv_icm42600_odr_to_period(enum inv_icm42600_odr odr); -+u32 inv_icm42600_odr_to_period(enum inv_icm42600_odr odr); - - int inv_icm42600_set_accel_conf(struct inv_icm42600_state *st, - struct inv_icm42600_sensor_conf *conf, -diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c -index 47720560de6e03..a4155939e9567b 100644 ---- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c -+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c -@@ -77,8 +77,8 @@ static const struct iio_chan_spec inv_icm42600_accel_channels[] = { - */ - struct inv_icm42600_accel_buffer { - struct inv_icm42600_fifo_sensor_data accel; -- int16_t temp; -- int64_t timestamp __aligned(8); -+ s16 temp; -+ aligned_s64 timestamp; - }; - - #define INV_ICM42600_SCAN_MASK_ACCEL_3AXIS \ -@@ -142,7 +142,7 @@ static int inv_icm42600_accel_update_scan_mode(struct iio_dev *indio_dev, - - static int inv_icm42600_accel_read_sensor(struct inv_icm42600_state *st, - struct iio_chan_spec const *chan, -- int16_t *val) -+ s16 *val) - { - struct device *dev = regmap_get_device(st->map); - struct inv_icm42600_sensor_conf conf = INV_ICM42600_SENSOR_CONF_INIT; -@@ -182,7 +182,7 @@ static int inv_icm42600_accel_read_sensor(struct inv_icm42600_state *st, - if (ret) - goto exit; - -- *val = (int16_t)be16_to_cpup(data); -+ *val = (s16)be16_to_cpup(data); - if (*val == INV_ICM42600_DATA_INVALID) - ret = -EINVAL; - exit: -@@ -359,11 +359,11 @@ static int inv_icm42600_accel_read_offset(struct inv_icm42600_state *st, - int *val, int *val2) - { - struct device *dev = regmap_get_device(st->map); -- int64_t val64; -- int32_t bias; -+ s64 val64; -+ s32 bias; - unsigned int reg; -- int16_t offset; -- uint8_t data[2]; -+ s16 offset; -+ u8 data[2]; - int ret; - - if (chan->type != IIO_ACCEL) -@@ -417,7 +417,7 @@ static int inv_icm42600_accel_read_offset(struct inv_icm42600_state *st, - * result in micro (1000000) - * (offset * 5 * 9.806650 * 1000000) / 10000 - */ -- val64 = (int64_t)offset * 5LL * 9806650LL; -+ val64 = (s64)offset * 5LL * 9806650LL; - /* for rounding, add + or - divisor (10000) divided by 2 */ - if (val64 >= 0) - val64 += 10000LL / 2LL; -@@ -435,10 +435,10 @@ static int inv_icm42600_accel_write_offset(struct inv_icm42600_state *st, - int val, int val2) - { - struct device *dev = regmap_get_device(st->map); -- int64_t val64; -- int32_t min, max; -+ s64 val64; -+ s32 min, max; - unsigned int reg, regval; -- int16_t offset; -+ s16 offset; - int ret; - - if (chan->type != IIO_ACCEL) -@@ -463,7 +463,7 @@ static int inv_icm42600_accel_write_offset(struct inv_icm42600_state *st, - inv_icm42600_accel_calibbias[1]; - max = inv_icm42600_accel_calibbias[4] * 1000000L + - inv_icm42600_accel_calibbias[5]; -- val64 = (int64_t)val * 1000000LL + (int64_t)val2; -+ val64 = (s64)val * 1000000LL + (s64)val2; - if (val64 < min || val64 > max) - return -EINVAL; - -@@ -538,7 +538,7 @@ static int inv_icm42600_accel_read_raw(struct iio_dev *indio_dev, - int *val, int *val2, long mask) - { - struct inv_icm42600_state *st = iio_device_get_drvdata(indio_dev); -- int16_t data; -+ s16 data; - int ret; - - switch (chan->type) { -@@ -755,7 +755,8 @@ int inv_icm42600_accel_parse_fifo(struct iio_dev *indio_dev) - const int8_t *temp; - unsigned int odr; - int64_t ts_val; -- struct inv_icm42600_accel_buffer buffer; -+ /* buffer is copied to userspace, zeroing it to avoid any data leak */ -+ struct inv_icm42600_accel_buffer buffer = { }; - - /* parse all fifo packets */ - for (i = 0, no = 0; i < st->fifo.count; i += size, ++no) { -@@ -774,8 +775,6 @@ int inv_icm42600_accel_parse_fifo(struct iio_dev *indio_dev) - inv_sensors_timestamp_apply_odr(ts, st->fifo.period, - st->fifo.nb.total, no); - -- /* buffer is copied to userspace, zeroing it to avoid any data leak */ -- memset(&buffer, 0, sizeof(buffer)); - memcpy(&buffer.accel, accel, sizeof(buffer.accel)); - /* convert 8 bits FIFO temperature in high resolution format */ - buffer.temp = temp ? (*temp * 64) : 0; -diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c -index 6ef1df9d60b77d..aca6ce75889053 100644 ---- a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c -+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c -@@ -26,28 +26,28 @@ - #define INV_ICM42600_FIFO_HEADER_ODR_GYRO BIT(0) - - struct inv_icm42600_fifo_1sensor_packet { -- uint8_t header; -+ u8 header; - struct inv_icm42600_fifo_sensor_data data; -- int8_t temp; -+ s8 temp; - } __packed; - #define INV_ICM42600_FIFO_1SENSOR_PACKET_SIZE 8 - - struct inv_icm42600_fifo_2sensors_packet { -- uint8_t header; -+ u8 header; - struct inv_icm42600_fifo_sensor_data accel; - struct inv_icm42600_fifo_sensor_data gyro; -- int8_t temp; -+ s8 temp; - __be16 timestamp; - } __packed; - #define INV_ICM42600_FIFO_2SENSORS_PACKET_SIZE 16 - - ssize_t inv_icm42600_fifo_decode_packet(const void *packet, const void **accel, -- const void **gyro, const int8_t **temp, -+ const void **gyro, const s8 **temp, - const void **timestamp, unsigned int *odr) - { - const struct inv_icm42600_fifo_1sensor_packet *pack1 = packet; - const struct inv_icm42600_fifo_2sensors_packet *pack2 = packet; -- uint8_t header = *((const uint8_t *)packet); -+ u8 header = *((const u8 *)packet); - - /* FIFO empty */ - if (header & INV_ICM42600_FIFO_HEADER_MSG) { -@@ -100,7 +100,7 @@ ssize_t inv_icm42600_fifo_decode_packet(const void *packet, const void **accel, - - void inv_icm42600_buffer_update_fifo_period(struct inv_icm42600_state *st) - { -- uint32_t period_gyro, period_accel, period; -+ u32 period_gyro, period_accel, period; - - if (st->fifo.en & INV_ICM42600_SENSOR_GYRO) - period_gyro = inv_icm42600_odr_to_period(st->conf.gyro.odr); -@@ -204,8 +204,8 @@ int inv_icm42600_buffer_update_watermark(struct inv_icm42600_state *st) - { - size_t packet_size, wm_size; - unsigned int wm_gyro, wm_accel, watermark; -- uint32_t period_gyro, period_accel, period; -- uint32_t latency_gyro, latency_accel, latency; -+ u32 period_gyro, period_accel, period; -+ u32 latency_gyro, latency_accel, latency; - bool restore; - __le16 raw_wm; - int ret; -@@ -451,7 +451,7 @@ int inv_icm42600_buffer_fifo_read(struct inv_icm42600_state *st, - __be16 *raw_fifo_count; - ssize_t i, size; - const void *accel, *gyro, *timestamp; -- const int8_t *temp; -+ const s8 *temp; - unsigned int odr; - int ret; - -@@ -538,7 +538,7 @@ int inv_icm42600_buffer_hwfifo_flush(struct inv_icm42600_state *st, - unsigned int count) - { - struct inv_sensors_timestamp *ts; -- int64_t gyro_ts, accel_ts; -+ s64 gyro_ts, accel_ts; - int ret; - - gyro_ts = iio_get_time_ns(st->indio_gyro); -diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h -index 8b85ee333bf8f6..eed6a3152acf48 100644 ---- a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h -+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h -@@ -28,7 +28,7 @@ struct inv_icm42600_state; - struct inv_icm42600_fifo { - unsigned int on; - unsigned int en; -- uint32_t period; -+ u32 period; - struct { - unsigned int gyro; - unsigned int accel; -@@ -39,7 +39,7 @@ struct inv_icm42600_fifo { - size_t accel; - size_t total; - } nb; -- uint8_t data[2080] __aligned(IIO_DMA_MINALIGN); -+ u8 data[2080] __aligned(IIO_DMA_MINALIGN); - }; - - /* FIFO data packet */ -@@ -50,7 +50,7 @@ struct inv_icm42600_fifo_sensor_data { - } __packed; - #define INV_ICM42600_FIFO_DATA_INVALID -32768 - --static inline int16_t inv_icm42600_fifo_get_sensor_data(__be16 d) -+static inline s16 inv_icm42600_fifo_get_sensor_data(__be16 d) - { - return be16_to_cpu(d); - } -@@ -58,7 +58,7 @@ static inline int16_t inv_icm42600_fifo_get_sensor_data(__be16 d) - static inline bool - inv_icm42600_fifo_is_data_valid(const struct inv_icm42600_fifo_sensor_data *s) - { -- int16_t x, y, z; -+ s16 x, y, z; - - x = inv_icm42600_fifo_get_sensor_data(s->x); - y = inv_icm42600_fifo_get_sensor_data(s->y); -@@ -73,7 +73,7 @@ inv_icm42600_fifo_is_data_valid(const struct inv_icm42600_fifo_sensor_data *s) - } - - ssize_t inv_icm42600_fifo_decode_packet(const void *packet, const void **accel, -- const void **gyro, const int8_t **temp, -+ const void **gyro, const s8 **temp, - const void **timestamp, unsigned int *odr); - - extern const struct iio_buffer_setup_ops inv_icm42600_buffer_ops; -diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c -index da65aa4e27242f..91c181bb92869d 100644 ---- a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c -+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c -@@ -56,7 +56,7 @@ const struct regmap_config inv_icm42600_spi_regmap_config = { - EXPORT_SYMBOL_NS_GPL(inv_icm42600_spi_regmap_config, IIO_ICM42600); - - struct inv_icm42600_hw { -- uint8_t whoami; -+ u8 whoami; - const char *name; - const struct inv_icm42600_conf *conf; - }; -@@ -115,9 +115,9 @@ inv_icm42600_get_mount_matrix(const struct iio_dev *indio_dev, - return &st->orientation; - } - --uint32_t inv_icm42600_odr_to_period(enum inv_icm42600_odr odr) -+u32 inv_icm42600_odr_to_period(enum inv_icm42600_odr odr) - { -- static uint32_t odr_periods[INV_ICM42600_ODR_NB] = { -+ static u32 odr_periods[INV_ICM42600_ODR_NB] = { - /* reserved values */ - 0, 0, 0, - /* 8kHz */ -diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c -index d08cd6839a3a67..9ee26478b666be 100644 ---- a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c -+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c -@@ -77,8 +77,8 @@ static const struct iio_chan_spec inv_icm42600_gyro_channels[] = { - */ - struct inv_icm42600_gyro_buffer { - struct inv_icm42600_fifo_sensor_data gyro; -- int16_t temp; -- int64_t timestamp __aligned(8); -+ s16 temp; -+ aligned_s64 timestamp; - }; - - #define INV_ICM42600_SCAN_MASK_GYRO_3AXIS \ -@@ -142,7 +142,7 @@ static int inv_icm42600_gyro_update_scan_mode(struct iio_dev *indio_dev, - - static int inv_icm42600_gyro_read_sensor(struct inv_icm42600_state *st, - struct iio_chan_spec const *chan, -- int16_t *val) -+ s16 *val) - { - struct device *dev = regmap_get_device(st->map); - struct inv_icm42600_sensor_conf conf = INV_ICM42600_SENSOR_CONF_INIT; -@@ -182,7 +182,7 @@ static int inv_icm42600_gyro_read_sensor(struct inv_icm42600_state *st, - if (ret) - goto exit; - -- *val = (int16_t)be16_to_cpup(data); -+ *val = (s16)be16_to_cpup(data); - if (*val == INV_ICM42600_DATA_INVALID) - ret = -EINVAL; - exit: -@@ -371,11 +371,11 @@ static int inv_icm42600_gyro_read_offset(struct inv_icm42600_state *st, - int *val, int *val2) - { - struct device *dev = regmap_get_device(st->map); -- int64_t val64; -- int32_t bias; -+ s64 val64; -+ s32 bias; - unsigned int reg; -- int16_t offset; -- uint8_t data[2]; -+ s16 offset; -+ u8 data[2]; - int ret; - - if (chan->type != IIO_ANGL_VEL) -@@ -429,7 +429,7 @@ static int inv_icm42600_gyro_read_offset(struct inv_icm42600_state *st, - * result in nano (1000000000) - * (offset * 64 * Pi * 1000000000) / (2048 * 180) - */ -- val64 = (int64_t)offset * 64LL * 3141592653LL; -+ val64 = (s64)offset * 64LL * 3141592653LL; - /* for rounding, add + or - divisor (2048 * 180) divided by 2 */ - if (val64 >= 0) - val64 += 2048 * 180 / 2; -@@ -447,9 +447,9 @@ static int inv_icm42600_gyro_write_offset(struct inv_icm42600_state *st, - int val, int val2) - { - struct device *dev = regmap_get_device(st->map); -- int64_t val64, min, max; -+ s64 val64, min, max; - unsigned int reg, regval; -- int16_t offset; -+ s16 offset; - int ret; - - if (chan->type != IIO_ANGL_VEL) -@@ -470,11 +470,11 @@ static int inv_icm42600_gyro_write_offset(struct inv_icm42600_state *st, - } - - /* inv_icm42600_gyro_calibbias: min - step - max in nano */ -- min = (int64_t)inv_icm42600_gyro_calibbias[0] * 1000000000LL + -- (int64_t)inv_icm42600_gyro_calibbias[1]; -- max = (int64_t)inv_icm42600_gyro_calibbias[4] * 1000000000LL + -- (int64_t)inv_icm42600_gyro_calibbias[5]; -- val64 = (int64_t)val * 1000000000LL + (int64_t)val2; -+ min = (s64)inv_icm42600_gyro_calibbias[0] * 1000000000LL + -+ (s64)inv_icm42600_gyro_calibbias[1]; -+ max = (s64)inv_icm42600_gyro_calibbias[4] * 1000000000LL + -+ (s64)inv_icm42600_gyro_calibbias[5]; -+ val64 = (s64)val * 1000000000LL + (s64)val2; - if (val64 < min || val64 > max) - return -EINVAL; - -@@ -549,7 +549,7 @@ static int inv_icm42600_gyro_read_raw(struct iio_dev *indio_dev, - int *val, int *val2, long mask) - { - struct inv_icm42600_state *st = iio_device_get_drvdata(indio_dev); -- int16_t data; -+ s16 data; - int ret; - - switch (chan->type) { -@@ -764,10 +764,11 @@ int inv_icm42600_gyro_parse_fifo(struct iio_dev *indio_dev) - ssize_t i, size; - unsigned int no; - const void *accel, *gyro, *timestamp; -- const int8_t *temp; -+ const s8 *temp; - unsigned int odr; -- int64_t ts_val; -- struct inv_icm42600_gyro_buffer buffer; -+ s64 ts_val; -+ /* buffer is copied to userspace, zeroing it to avoid any data leak */ -+ struct inv_icm42600_gyro_buffer buffer = { }; - - /* parse all fifo packets */ - for (i = 0, no = 0; i < st->fifo.count; i += size, ++no) { -@@ -786,8 +787,6 @@ int inv_icm42600_gyro_parse_fifo(struct iio_dev *indio_dev) - inv_sensors_timestamp_apply_odr(ts, st->fifo.period, - st->fifo.nb.total, no); - -- /* buffer is copied to userspace, zeroing it to avoid any data leak */ -- memset(&buffer, 0, sizeof(buffer)); - memcpy(&buffer.gyro, gyro, sizeof(buffer.gyro)); - /* convert 8 bits FIFO temperature in high resolution format */ - buffer.temp = temp ? (*temp * 64) : 0; -diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_temp.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_temp.c -index 91f0f381082bda..51430b4f5e51b6 100644 ---- a/drivers/iio/imu/inv_icm42600/inv_icm42600_temp.c -+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_temp.c -@@ -13,7 +13,7 @@ - #include "inv_icm42600.h" - #include "inv_icm42600_temp.h" - --static int inv_icm42600_temp_read(struct inv_icm42600_state *st, int16_t *temp) -+static int inv_icm42600_temp_read(struct inv_icm42600_state *st, s16 *temp) - { - struct device *dev = regmap_get_device(st->map); - __be16 *raw; -@@ -31,9 +31,13 @@ static int inv_icm42600_temp_read(struct inv_icm42600_state *st, int16_t *temp) - if (ret) - goto exit; - -- *temp = (int16_t)be16_to_cpup(raw); -+ *temp = (s16)be16_to_cpup(raw); -+ /* -+ * Temperature data is invalid if both accel and gyro are off. -+ * Return -EBUSY in this case. -+ */ - if (*temp == INV_ICM42600_DATA_INVALID) -- ret = -EINVAL; -+ ret = -EBUSY; - - exit: - mutex_unlock(&st->lock); -@@ -48,7 +52,7 @@ int inv_icm42600_temp_read_raw(struct iio_dev *indio_dev, - int *val, int *val2, long mask) - { - struct inv_icm42600_state *st = iio_device_get_drvdata(indio_dev); -- int16_t temp; -+ s16 temp; - int ret; - - if (chan->type != IIO_TEMP) -diff --git a/drivers/iio/light/as73211.c b/drivers/iio/light/as73211.c -index c1f9604c27141e..166874c68ff639 100644 ---- a/drivers/iio/light/as73211.c -+++ b/drivers/iio/light/as73211.c -@@ -573,7 +573,7 @@ static irqreturn_t as73211_trigger_handler(int irq __always_unused, void *p) - struct { - __le16 chan[4]; - s64 ts __aligned(8); -- } scan; -+ } scan = { }; - int data_result, ret; - - mutex_lock(&data->mutex); -diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c -index 84f6b333c91958..8d9e8a1c94c455 100644 ---- a/drivers/iio/pressure/bmp280-core.c -+++ b/drivers/iio/pressure/bmp280-core.c -@@ -2152,11 +2152,12 @@ int bmp280_common_probe(struct device *dev, - - /* Bring chip out of reset if there is an assigned GPIO line */ - gpiod = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH); -+ if (IS_ERR(gpiod)) -+ return dev_err_probe(dev, PTR_ERR(gpiod), "failed to get reset GPIO\n"); -+ - /* Deassert the signal */ -- if (gpiod) { -- dev_info(dev, "release reset\n"); -- gpiod_set_value(gpiod, 0); -- } -+ dev_info(dev, "release reset\n"); -+ gpiod_set_value(gpiod, 0); - - data->regmap = regmap; - -diff --git a/drivers/iio/proximity/isl29501.c b/drivers/iio/proximity/isl29501.c -index bcebacaf3dab0d..9fd3d2e8cea6cd 100644 ---- a/drivers/iio/proximity/isl29501.c -+++ b/drivers/iio/proximity/isl29501.c -@@ -938,12 +938,18 @@ static irqreturn_t isl29501_trigger_handler(int irq, void *p) - struct iio_dev *indio_dev = pf->indio_dev; - struct isl29501_private *isl29501 = iio_priv(indio_dev); - const unsigned long *active_mask = indio_dev->active_scan_mask; -- u32 buffer[4] __aligned(8) = {}; /* 1x16-bit + naturally aligned ts */ -- -- if (test_bit(ISL29501_DISTANCE_SCAN_INDEX, active_mask)) -- isl29501_register_read(isl29501, REG_DISTANCE, buffer); -+ u32 value; -+ struct { -+ u16 data; -+ aligned_s64 ts; -+ } scan = { }; -+ -+ if (test_bit(ISL29501_DISTANCE_SCAN_INDEX, active_mask)) { -+ isl29501_register_read(isl29501, REG_DISTANCE, &value); -+ scan.data = value; -+ } - -- iio_push_to_buffers_with_timestamp(indio_dev, buffer, pf->timestamp); -+ iio_push_to_buffers_with_timestamp(indio_dev, &scan, pf->timestamp); - iio_trigger_notify_done(indio_dev->trig); - - return IRQ_HANDLED; -diff --git a/drivers/iio/temperature/maxim_thermocouple.c b/drivers/iio/temperature/maxim_thermocouple.c -index 555a61e2f3fdd1..44fba61ccfe27d 100644 ---- a/drivers/iio/temperature/maxim_thermocouple.c -+++ b/drivers/iio/temperature/maxim_thermocouple.c -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -122,8 +123,15 @@ struct maxim_thermocouple_data { - struct spi_device *spi; - const struct maxim_thermocouple_chip *chip; - char tc_type; -- -- u8 buffer[16] __aligned(IIO_DMA_MINALIGN); -+ /* Buffer for reading up to 2 hardware channels. */ -+ struct { -+ union { -+ __be16 raw16; -+ __be32 raw32; -+ __be16 raw[2]; -+ }; -+ aligned_s64 timestamp; -+ } buffer __aligned(IIO_DMA_MINALIGN); - }; - - static int maxim_thermocouple_read(struct maxim_thermocouple_data *data, -@@ -131,18 +139,16 @@ static int maxim_thermocouple_read(struct maxim_thermocouple_data *data, - { - unsigned int storage_bytes = data->chip->read_size; - unsigned int shift = chan->scan_type.shift + (chan->address * 8); -- __be16 buf16; -- __be32 buf32; - int ret; - - switch (storage_bytes) { - case 2: -- ret = spi_read(data->spi, (void *)&buf16, storage_bytes); -- *val = be16_to_cpu(buf16); -+ ret = spi_read(data->spi, &data->buffer.raw16, storage_bytes); -+ *val = be16_to_cpu(data->buffer.raw16); - break; - case 4: -- ret = spi_read(data->spi, (void *)&buf32, storage_bytes); -- *val = be32_to_cpu(buf32); -+ ret = spi_read(data->spi, &data->buffer.raw32, storage_bytes); -+ *val = be32_to_cpu(data->buffer.raw32); - break; - default: - ret = -EINVAL; -@@ -167,9 +173,9 @@ static irqreturn_t maxim_thermocouple_trigger_handler(int irq, void *private) - struct maxim_thermocouple_data *data = iio_priv(indio_dev); - int ret; - -- ret = spi_read(data->spi, data->buffer, data->chip->read_size); -+ ret = spi_read(data->spi, data->buffer.raw, data->chip->read_size); - if (!ret) { -- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, -+ iio_push_to_buffers_with_timestamp(indio_dev, &data->buffer, - iio_get_time_ns(indio_dev)); - } - -diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c -index 6d1dbc97875906..a94723a12bb486 100644 ---- a/drivers/infiniband/core/nldev.c -+++ b/drivers/infiniband/core/nldev.c -@@ -1412,10 +1412,11 @@ static const struct nldev_fill_res_entry fill_entries[RDMA_RESTRACK_MAX] = { - - }; - --static int res_get_common_doit(struct sk_buff *skb, struct nlmsghdr *nlh, -- struct netlink_ext_ack *extack, -- enum rdma_restrack_type res_type, -- res_fill_func_t fill_func) -+static noinline_for_stack int -+res_get_common_doit(struct sk_buff *skb, struct nlmsghdr *nlh, -+ struct netlink_ext_ack *extack, -+ enum rdma_restrack_type res_type, -+ res_fill_func_t fill_func) - { - const struct nldev_fill_res_entry *fe = &fill_entries[res_type]; - struct nlattr *tb[RDMA_NLDEV_ATTR_MAX]; -@@ -2153,10 +2154,10 @@ static int nldev_stat_del_doit(struct sk_buff *skb, struct nlmsghdr *nlh, - return ret; - } - --static int stat_get_doit_default_counter(struct sk_buff *skb, -- struct nlmsghdr *nlh, -- struct netlink_ext_ack *extack, -- struct nlattr *tb[]) -+static noinline_for_stack int -+stat_get_doit_default_counter(struct sk_buff *skb, struct nlmsghdr *nlh, -+ struct netlink_ext_ack *extack, -+ struct nlattr *tb[]) - { - struct rdma_hw_stats *stats; - struct nlattr *table_attr; -@@ -2246,8 +2247,9 @@ static int stat_get_doit_default_counter(struct sk_buff *skb, - return ret; - } - --static int stat_get_doit_qp(struct sk_buff *skb, struct nlmsghdr *nlh, -- struct netlink_ext_ack *extack, struct nlattr *tb[]) -+static noinline_for_stack int -+stat_get_doit_qp(struct sk_buff *skb, struct nlmsghdr *nlh, -+ struct netlink_ext_ack *extack, struct nlattr *tb[]) - - { - static enum rdma_nl_counter_mode mode; -diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c -index f7345e4890a141..31fff5885f1a83 100644 ---- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c -+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c -@@ -1823,7 +1823,6 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr, - struct bnxt_re_srq *srq = container_of(ib_srq, struct bnxt_re_srq, - ib_srq); - struct bnxt_re_dev *rdev = srq->rdev; -- int rc; - - switch (srq_attr_mask) { - case IB_SRQ_MAX_WR: -@@ -1835,11 +1834,8 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr, - return -EINVAL; - - srq->qplib_srq.threshold = srq_attr->srq_limit; -- rc = bnxt_qplib_modify_srq(&rdev->qplib_res, &srq->qplib_srq); -- if (rc) { -- ibdev_err(&rdev->ibdev, "Modify HW SRQ failed!"); -- return rc; -- } -+ bnxt_qplib_srq_arm_db(&srq->qplib_srq.dbinfo, srq->qplib_srq.threshold); -+ - /* On success, update the shadow */ - srq->srq_limit = srq_attr->srq_limit; - /* No need to Build and send response back to udata */ -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c -index 68ea4ed0b171b8..c19dd732c2354c 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c -+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c -@@ -685,9 +685,7 @@ int bnxt_qplib_create_srq(struct bnxt_qplib_res *res, - srq->dbinfo.db = srq->dpi->dbr; - srq->dbinfo.max_slot = 1; - srq->dbinfo.priv_db = res->dpi_tbl.priv_db; -- if (srq->threshold) -- bnxt_qplib_armen_db(&srq->dbinfo, DBC_DBC_TYPE_SRQ_ARMENA); -- srq->arm_req = false; -+ bnxt_qplib_armen_db(&srq->dbinfo, DBC_DBC_TYPE_SRQ_ARMENA); - - return 0; - fail: -@@ -697,24 +695,6 @@ int bnxt_qplib_create_srq(struct bnxt_qplib_res *res, - return rc; - } - --int bnxt_qplib_modify_srq(struct bnxt_qplib_res *res, -- struct bnxt_qplib_srq *srq) --{ -- struct bnxt_qplib_hwq *srq_hwq = &srq->hwq; -- u32 count; -- -- count = __bnxt_qplib_get_avail(srq_hwq); -- if (count > srq->threshold) { -- srq->arm_req = false; -- bnxt_qplib_srq_arm_db(&srq->dbinfo, srq->threshold); -- } else { -- /* Deferred arming */ -- srq->arm_req = true; -- } -- -- return 0; --} -- - int bnxt_qplib_query_srq(struct bnxt_qplib_res *res, - struct bnxt_qplib_srq *srq) - { -@@ -756,7 +736,6 @@ int bnxt_qplib_post_srq_recv(struct bnxt_qplib_srq *srq, - struct bnxt_qplib_hwq *srq_hwq = &srq->hwq; - struct rq_wqe *srqe; - struct sq_sge *hw_sge; -- u32 count = 0; - int i, next; - - spin_lock(&srq_hwq->lock); -@@ -788,15 +767,8 @@ int bnxt_qplib_post_srq_recv(struct bnxt_qplib_srq *srq, - - bnxt_qplib_hwq_incr_prod(&srq->dbinfo, srq_hwq, srq->dbinfo.max_slot); - -- spin_lock(&srq_hwq->lock); -- count = __bnxt_qplib_get_avail(srq_hwq); -- spin_unlock(&srq_hwq->lock); - /* Ring DB */ - bnxt_qplib_ring_prod_db(&srq->dbinfo, DBC_DBC_TYPE_SRQ); -- if (srq->arm_req == true && count > srq->threshold) { -- srq->arm_req = false; -- bnxt_qplib_srq_arm_db(&srq->dbinfo, srq->threshold); -- } - - return 0; - } -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h -index 55fd840359ef23..288196facfd7ce 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h -+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h -@@ -519,8 +519,6 @@ int bnxt_qplib_enable_nq(struct pci_dev *pdev, struct bnxt_qplib_nq *nq, - srqn_handler_t srq_handler); - int bnxt_qplib_create_srq(struct bnxt_qplib_res *res, - struct bnxt_qplib_srq *srq); --int bnxt_qplib_modify_srq(struct bnxt_qplib_res *res, -- struct bnxt_qplib_srq *srq); - int bnxt_qplib_query_srq(struct bnxt_qplib_res *res, - struct bnxt_qplib_srq *srq); - void bnxt_qplib_destroy_srq(struct bnxt_qplib_res *res, -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c -index 96ceec1e8199a6..77da7cf344274b 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_res.c -+++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c -@@ -121,6 +121,7 @@ static int __alloc_pbl(struct bnxt_qplib_res *res, - pbl->pg_arr = vmalloc_array(pages, sizeof(void *)); - if (!pbl->pg_arr) - return -ENOMEM; -+ memset(pbl->pg_arr, 0, pages * sizeof(void *)); - - pbl->pg_map_arr = vmalloc_array(pages, sizeof(dma_addr_t)); - if (!pbl->pg_map_arr) { -@@ -128,6 +129,7 @@ static int __alloc_pbl(struct bnxt_qplib_res *res, - pbl->pg_arr = NULL; - return -ENOMEM; - } -+ memset(pbl->pg_map_arr, 0, pages * sizeof(dma_addr_t)); - pbl->pg_count = 0; - pbl->pg_size = sginfo->pgsize; - -diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c -index 29ad2f5ffabe20..e990690d8b3cd5 100644 ---- a/drivers/infiniband/hw/erdma/erdma_verbs.c -+++ b/drivers/infiniband/hw/erdma/erdma_verbs.c -@@ -979,7 +979,9 @@ int erdma_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs, - if (ret) - goto err_out_cmd; - } else { -- init_kernel_qp(dev, qp, attrs); -+ ret = init_kernel_qp(dev, qp, attrs); -+ if (ret) -+ goto err_out_xa; - } - - qp->attrs.max_send_sge = attrs->cap.max_send_sge; -diff --git a/drivers/infiniband/hw/hfi1/affinity.c b/drivers/infiniband/hw/hfi1/affinity.c -index bbc957c578e1e5..e5db39f4720de9 100644 ---- a/drivers/infiniband/hw/hfi1/affinity.c -+++ b/drivers/infiniband/hw/hfi1/affinity.c -@@ -964,31 +964,35 @@ static void find_hw_thread_mask(uint hw_thread_no, cpumask_var_t hw_thread_mask, - struct hfi1_affinity_node_list *affinity) - { - int possible, curr_cpu, i; -- uint num_cores_per_socket = node_affinity.num_online_cpus / -+ uint num_cores_per_socket; -+ -+ cpumask_copy(hw_thread_mask, &affinity->proc.mask); -+ -+ if (affinity->num_core_siblings == 0) -+ return; -+ -+ num_cores_per_socket = node_affinity.num_online_cpus / - affinity->num_core_siblings / - node_affinity.num_online_nodes; - -- cpumask_copy(hw_thread_mask, &affinity->proc.mask); -- if (affinity->num_core_siblings > 0) { -- /* Removing other siblings not needed for now */ -- possible = cpumask_weight(hw_thread_mask); -- curr_cpu = cpumask_first(hw_thread_mask); -- for (i = 0; -- i < num_cores_per_socket * node_affinity.num_online_nodes; -- i++) -- curr_cpu = cpumask_next(curr_cpu, hw_thread_mask); -- -- for (; i < possible; i++) { -- cpumask_clear_cpu(curr_cpu, hw_thread_mask); -- curr_cpu = cpumask_next(curr_cpu, hw_thread_mask); -- } -+ /* Removing other siblings not needed for now */ -+ possible = cpumask_weight(hw_thread_mask); -+ curr_cpu = cpumask_first(hw_thread_mask); -+ for (i = 0; -+ i < num_cores_per_socket * node_affinity.num_online_nodes; -+ i++) -+ curr_cpu = cpumask_next(curr_cpu, hw_thread_mask); - -- /* Identifying correct HW threads within physical cores */ -- cpumask_shift_left(hw_thread_mask, hw_thread_mask, -- num_cores_per_socket * -- node_affinity.num_online_nodes * -- hw_thread_no); -+ for (; i < possible; i++) { -+ cpumask_clear_cpu(curr_cpu, hw_thread_mask); -+ curr_cpu = cpumask_next(curr_cpu, hw_thread_mask); - } -+ -+ /* Identifying correct HW threads within physical cores */ -+ cpumask_shift_left(hw_thread_mask, hw_thread_mask, -+ num_cores_per_socket * -+ node_affinity.num_online_nodes * -+ hw_thread_no); - } - - int hfi1_get_proc_affinity(int node) -diff --git a/drivers/infiniband/sw/siw/siw_qp_tx.c b/drivers/infiniband/sw/siw/siw_qp_tx.c -index feae920784be80..03e3f6668840f3 100644 ---- a/drivers/infiniband/sw/siw/siw_qp_tx.c -+++ b/drivers/infiniband/sw/siw/siw_qp_tx.c -@@ -340,18 +340,17 @@ static int siw_tcp_sendpages(struct socket *s, struct page **page, int offset, - if (!sendpage_ok(page[i])) - msg.msg_flags &= ~MSG_SPLICE_PAGES; - bvec_set_page(&bvec, page[i], bytes, offset); -- iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, size); -+ iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, bytes); - - try_page_again: - lock_sock(sk); -- rv = tcp_sendmsg_locked(sk, &msg, size); -+ rv = tcp_sendmsg_locked(sk, &msg, bytes); - release_sock(sk); - - if (rv > 0) { - size -= rv; - sent += rv; - if (rv != bytes) { -- offset += rv; - bytes -= rv; - goto try_page_again; - } -diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c -index 2e7a12f306510c..431cea41df2af1 100644 ---- a/drivers/iommu/amd/init.c -+++ b/drivers/iommu/amd/init.c -@@ -3625,7 +3625,7 @@ static int __init parse_ivrs_acpihid(char *str) - { - u32 seg = 0, bus, dev, fn; - char *hid, *uid, *p, *addr; -- char acpiid[ACPIID_LEN] = {0}; -+ char acpiid[ACPIID_LEN + 1] = { }; /* size with NULL terminator */ - int i; - - addr = strchr(str, '@'); -@@ -3651,7 +3651,7 @@ static int __init parse_ivrs_acpihid(char *str) - /* We have the '@', make it the terminator to get just the acpiid */ - *addr++ = 0; - -- if (strlen(str) > ACPIID_LEN + 1) -+ if (strlen(str) > ACPIID_LEN) - goto not_found; - - if (sscanf(str, "=%s", acpiid) != 1) -diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c -index e6b4bab0dde2e5..3d031366979637 100644 ---- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c -+++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c -@@ -255,6 +255,7 @@ static const struct of_device_id qcom_smmu_client_of_match[] __maybe_unused = { - { .compatible = "qcom,sdm670-mdss" }, - { .compatible = "qcom,sdm845-mdss" }, - { .compatible = "qcom,sdm845-mss-pil" }, -+ { .compatible = "qcom,sm6115-mdss" }, - { .compatible = "qcom,sm6350-mdss" }, - { .compatible = "qcom,sm6375-mdss" }, - { .compatible = "qcom,sm8150-mdss" }, -diff --git a/drivers/iommu/iommufd/io_pagetable.c b/drivers/iommu/iommufd/io_pagetable.c -index e76b2293999481..f058405c5fbb66 100644 ---- a/drivers/iommu/iommufd/io_pagetable.c -+++ b/drivers/iommu/iommufd/io_pagetable.c -@@ -69,36 +69,45 @@ struct iopt_area *iopt_area_contig_next(struct iopt_area_contig_iter *iter) - return iter->area; - } - --static bool __alloc_iova_check_hole(struct interval_tree_double_span_iter *span, -- unsigned long length, -- unsigned long iova_alignment, -- unsigned long page_offset) -+static bool __alloc_iova_check_range(unsigned long *start, unsigned long last, -+ unsigned long length, -+ unsigned long iova_alignment, -+ unsigned long page_offset) - { -- if (span->is_used || span->last_hole - span->start_hole < length - 1) -+ unsigned long aligned_start; -+ -+ /* ALIGN_UP() */ -+ if (check_add_overflow(*start, iova_alignment - 1, &aligned_start)) - return false; -+ aligned_start &= ~(iova_alignment - 1); -+ aligned_start |= page_offset; - -- span->start_hole = ALIGN(span->start_hole, iova_alignment) | -- page_offset; -- if (span->start_hole > span->last_hole || -- span->last_hole - span->start_hole < length - 1) -+ if (aligned_start >= last || last - aligned_start < length - 1) - return false; -+ *start = aligned_start; - return true; - } - --static bool __alloc_iova_check_used(struct interval_tree_span_iter *span, -+static bool __alloc_iova_check_hole(struct interval_tree_double_span_iter *span, - unsigned long length, - unsigned long iova_alignment, - unsigned long page_offset) - { -- if (span->is_hole || span->last_used - span->start_used < length - 1) -+ if (span->is_used) - return false; -+ return __alloc_iova_check_range(&span->start_hole, span->last_hole, -+ length, iova_alignment, page_offset); -+} - -- span->start_used = ALIGN(span->start_used, iova_alignment) | -- page_offset; -- if (span->start_used > span->last_used || -- span->last_used - span->start_used < length - 1) -+static bool __alloc_iova_check_used(struct interval_tree_span_iter *span, -+ unsigned long length, -+ unsigned long iova_alignment, -+ unsigned long page_offset) -+{ -+ if (span->is_hole) - return false; -- return true; -+ return __alloc_iova_check_range(&span->start_used, span->last_used, -+ length, iova_alignment, page_offset); - } - - /* -@@ -524,8 +533,10 @@ static int iopt_unmap_iova_range(struct io_pagetable *iopt, unsigned long start, - iommufd_access_notify_unmap(iopt, area_first, length); - /* Something is not responding to unmap requests. */ - tries++; -- if (WARN_ON(tries > 100)) -- return -EDEADLOCK; -+ if (WARN_ON(tries > 100)) { -+ rc = -EDEADLOCK; -+ goto out_unmapped; -+ } - goto again; - } - -@@ -547,6 +558,7 @@ static int iopt_unmap_iova_range(struct io_pagetable *iopt, unsigned long start, - out_unlock_iova: - up_write(&iopt->iova_rwsem); - up_read(&iopt->domains_rwsem); -+out_unmapped: - if (unmapped) - *unmapped = unmapped_bytes; - return rc; -diff --git a/drivers/leds/flash/leds-qcom-flash.c b/drivers/leds/flash/leds-qcom-flash.c -index 17391aefeb941f..a619dbe0152434 100644 ---- a/drivers/leds/flash/leds-qcom-flash.c -+++ b/drivers/leds/flash/leds-qcom-flash.c -@@ -1,6 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0-only - /* -- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. -+ * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include -@@ -14,6 +14,9 @@ - #include - - /* registers definitions */ -+#define FLASH_REVISION_REG 0x00 -+#define FLASH_4CH_REVISION_V0P1 0x01 -+ - #define FLASH_TYPE_REG 0x04 - #define FLASH_TYPE_VAL 0x18 - -@@ -73,6 +76,16 @@ - - #define UA_PER_MA 1000 - -+/* thermal threshold constants */ -+#define OTST_3CH_MIN_VAL 3 -+#define OTST1_4CH_MIN_VAL 0 -+#define OTST1_4CH_V0P1_MIN_VAL 3 -+#define OTST2_4CH_MIN_VAL 0 -+ -+#define OTST1_MAX_CURRENT_MA 1000 -+#define OTST2_MAX_CURRENT_MA 500 -+#define OTST3_MAX_CURRENT_MA 200 -+ - enum hw_type { - QCOM_MVFLASH_3CH, - QCOM_MVFLASH_4CH, -@@ -98,10 +111,13 @@ enum { - REG_IRESOLUTION, - REG_CHAN_STROBE, - REG_CHAN_EN, -+ REG_THERM_THRSH1, -+ REG_THERM_THRSH2, -+ REG_THERM_THRSH3, - REG_MAX_COUNT, - }; - --static struct reg_field mvflash_3ch_regs[REG_MAX_COUNT] = { -+static const struct reg_field mvflash_3ch_regs[REG_MAX_COUNT] = { - REG_FIELD(0x08, 0, 7), /* status1 */ - REG_FIELD(0x09, 0, 7), /* status2 */ - REG_FIELD(0x0a, 0, 7), /* status3 */ -@@ -111,9 +127,12 @@ static struct reg_field mvflash_3ch_regs[REG_MAX_COUNT] = { - REG_FIELD(0x47, 0, 5), /* iresolution */ - REG_FIELD_ID(0x49, 0, 2, 3, 1), /* chan_strobe */ - REG_FIELD(0x4c, 0, 2), /* chan_en */ -+ REG_FIELD(0x56, 0, 2), /* therm_thrsh1 */ -+ REG_FIELD(0x57, 0, 2), /* therm_thrsh2 */ -+ REG_FIELD(0x58, 0, 2), /* therm_thrsh3 */ - }; - --static struct reg_field mvflash_4ch_regs[REG_MAX_COUNT] = { -+static const struct reg_field mvflash_4ch_regs[REG_MAX_COUNT] = { - REG_FIELD(0x06, 0, 7), /* status1 */ - REG_FIELD(0x07, 0, 6), /* status2 */ - REG_FIELD(0x09, 0, 7), /* status3 */ -@@ -123,6 +142,8 @@ static struct reg_field mvflash_4ch_regs[REG_MAX_COUNT] = { - REG_FIELD(0x49, 0, 3), /* iresolution */ - REG_FIELD_ID(0x4a, 0, 6, 4, 1), /* chan_strobe */ - REG_FIELD(0x4e, 0, 3), /* chan_en */ -+ REG_FIELD(0x7a, 0, 2), /* therm_thrsh1 */ -+ REG_FIELD(0x78, 0, 2), /* therm_thrsh2 */ - }; - - struct qcom_flash_data { -@@ -130,9 +151,11 @@ struct qcom_flash_data { - struct regmap_field *r_fields[REG_MAX_COUNT]; - struct mutex lock; - enum hw_type hw_type; -+ u32 total_ma; - u8 leds_count; - u8 max_channels; - u8 chan_en_bits; -+ u8 revision; - }; - - struct qcom_flash_led { -@@ -143,6 +166,7 @@ struct qcom_flash_led { - u32 max_timeout_ms; - u32 flash_current_ma; - u32 flash_timeout_ms; -+ u32 current_in_use_ma; - u8 *chan_id; - u8 chan_count; - bool enabled; -@@ -172,6 +196,127 @@ static int set_flash_module_en(struct qcom_flash_led *led, bool en) - return rc; - } - -+static int update_allowed_flash_current(struct qcom_flash_led *led, u32 *current_ma, bool strobe) -+{ -+ struct qcom_flash_data *flash_data = led->flash_data; -+ u32 therm_ma, avail_ma, thrsh[3], min_thrsh, sts; -+ int rc = 0; -+ -+ mutex_lock(&flash_data->lock); -+ /* -+ * Put previously allocated current into allowed budget in either of these two cases: -+ * 1) LED is disabled; -+ * 2) LED is enabled repeatedly -+ */ -+ if (!strobe || led->current_in_use_ma != 0) { -+ if (flash_data->total_ma >= led->current_in_use_ma) -+ flash_data->total_ma -= led->current_in_use_ma; -+ else -+ flash_data->total_ma = 0; -+ -+ led->current_in_use_ma = 0; -+ if (!strobe) -+ goto unlock; -+ } -+ -+ /* -+ * Cache the default thermal threshold settings, and set them to the lowest levels before -+ * reading over-temp real time status. If over-temp has been triggered at the lowest -+ * threshold, it's very likely that it would be triggered at a higher (default) threshold -+ * when more flash current is requested. Prevent device from triggering over-temp condition -+ * by limiting the flash current for the new request. -+ */ -+ rc = regmap_field_read(flash_data->r_fields[REG_THERM_THRSH1], &thrsh[0]); -+ if (rc < 0) -+ goto unlock; -+ -+ rc = regmap_field_read(flash_data->r_fields[REG_THERM_THRSH2], &thrsh[1]); -+ if (rc < 0) -+ goto unlock; -+ -+ if (flash_data->hw_type == QCOM_MVFLASH_3CH) { -+ rc = regmap_field_read(flash_data->r_fields[REG_THERM_THRSH3], &thrsh[2]); -+ if (rc < 0) -+ goto unlock; -+ } -+ -+ min_thrsh = OTST_3CH_MIN_VAL; -+ if (flash_data->hw_type == QCOM_MVFLASH_4CH) -+ min_thrsh = (flash_data->revision == FLASH_4CH_REVISION_V0P1) ? -+ OTST1_4CH_V0P1_MIN_VAL : OTST1_4CH_MIN_VAL; -+ -+ rc = regmap_field_write(flash_data->r_fields[REG_THERM_THRSH1], min_thrsh); -+ if (rc < 0) -+ goto unlock; -+ -+ if (flash_data->hw_type == QCOM_MVFLASH_4CH) -+ min_thrsh = OTST2_4CH_MIN_VAL; -+ -+ /* -+ * The default thermal threshold settings have been updated hence -+ * restore them if any fault happens starting from here. -+ */ -+ rc = regmap_field_write(flash_data->r_fields[REG_THERM_THRSH2], min_thrsh); -+ if (rc < 0) -+ goto restore; -+ -+ if (flash_data->hw_type == QCOM_MVFLASH_3CH) { -+ rc = regmap_field_write(flash_data->r_fields[REG_THERM_THRSH3], min_thrsh); -+ if (rc < 0) -+ goto restore; -+ } -+ -+ /* Read thermal level status to get corresponding derating flash current */ -+ rc = regmap_field_read(flash_data->r_fields[REG_STATUS2], &sts); -+ if (rc) -+ goto restore; -+ -+ therm_ma = FLASH_TOTAL_CURRENT_MAX_UA / 1000; -+ if (flash_data->hw_type == QCOM_MVFLASH_3CH) { -+ if (sts & FLASH_STS_3CH_OTST3) -+ therm_ma = OTST3_MAX_CURRENT_MA; -+ else if (sts & FLASH_STS_3CH_OTST2) -+ therm_ma = OTST2_MAX_CURRENT_MA; -+ else if (sts & FLASH_STS_3CH_OTST1) -+ therm_ma = OTST1_MAX_CURRENT_MA; -+ } else { -+ if (sts & FLASH_STS_4CH_OTST2) -+ therm_ma = OTST2_MAX_CURRENT_MA; -+ else if (sts & FLASH_STS_4CH_OTST1) -+ therm_ma = OTST1_MAX_CURRENT_MA; -+ } -+ -+ /* Calculate the allowed flash current for the request */ -+ if (therm_ma <= flash_data->total_ma) -+ avail_ma = 0; -+ else -+ avail_ma = therm_ma - flash_data->total_ma; -+ -+ *current_ma = min_t(u32, *current_ma, avail_ma); -+ led->current_in_use_ma = *current_ma; -+ flash_data->total_ma += led->current_in_use_ma; -+ -+ dev_dbg(led->flash.led_cdev.dev, "allowed flash current: %dmA, total current: %dmA\n", -+ led->current_in_use_ma, flash_data->total_ma); -+ -+restore: -+ /* Restore to default thermal threshold settings */ -+ rc = regmap_field_write(flash_data->r_fields[REG_THERM_THRSH1], thrsh[0]); -+ if (rc < 0) -+ goto unlock; -+ -+ rc = regmap_field_write(flash_data->r_fields[REG_THERM_THRSH2], thrsh[1]); -+ if (rc < 0) -+ goto unlock; -+ -+ if (flash_data->hw_type == QCOM_MVFLASH_3CH) -+ rc = regmap_field_write(flash_data->r_fields[REG_THERM_THRSH3], thrsh[2]); -+ -+unlock: -+ mutex_unlock(&flash_data->lock); -+ return rc; -+} -+ - static int set_flash_current(struct qcom_flash_led *led, u32 current_ma, enum led_mode mode) - { - struct qcom_flash_data *flash_data = led->flash_data; -@@ -313,6 +458,10 @@ static int qcom_flash_strobe_set(struct led_classdev_flash *fled_cdev, bool stat - if (rc) - return rc; - -+ rc = update_allowed_flash_current(led, &led->flash_current_ma, state); -+ if (rc < 0) -+ return rc; -+ - rc = set_flash_current(led, led->flash_current_ma, FLASH_MODE); - if (rc) - return rc; -@@ -429,6 +578,10 @@ static int qcom_flash_led_brightness_set(struct led_classdev *led_cdev, - if (rc) - return rc; - -+ rc = update_allowed_flash_current(led, ¤t_ma, enable); -+ if (rc < 0) -+ return rc; -+ - rc = set_flash_current(led, current_ma, TORCH_MODE); - if (rc) - return rc; -@@ -702,11 +855,25 @@ static int qcom_flash_led_probe(struct platform_device *pdev) - if (val == FLASH_SUBTYPE_3CH_PM8150_VAL || val == FLASH_SUBTYPE_3CH_PMI8998_VAL) { - flash_data->hw_type = QCOM_MVFLASH_3CH; - flash_data->max_channels = 3; -- regs = mvflash_3ch_regs; -+ regs = devm_kmemdup(dev, mvflash_3ch_regs, sizeof(mvflash_3ch_regs), -+ GFP_KERNEL); -+ if (!regs) -+ return -ENOMEM; - } else if (val == FLASH_SUBTYPE_4CH_VAL) { - flash_data->hw_type = QCOM_MVFLASH_4CH; - flash_data->max_channels = 4; -- regs = mvflash_4ch_regs; -+ regs = devm_kmemdup(dev, mvflash_4ch_regs, sizeof(mvflash_4ch_regs), -+ GFP_KERNEL); -+ if (!regs) -+ return -ENOMEM; -+ -+ rc = regmap_read(regmap, reg_base + FLASH_REVISION_REG, &val); -+ if (rc < 0) { -+ dev_err(dev, "Failed to read flash LED module revision, rc=%d\n", rc); -+ return rc; -+ } -+ -+ flash_data->revision = val; - } else { - dev_err(dev, "flash LED subtype %#x is not yet supported\n", val); - return -ENODEV; -@@ -720,6 +887,7 @@ static int qcom_flash_led_probe(struct platform_device *pdev) - dev_err(dev, "Failed to allocate regmap field, rc=%d\n", rc); - return rc; - } -+ devm_kfree(dev, regs); /* devm_regmap_field_bulk_alloc() makes copies */ - - platform_set_drvdata(pdev, flash_data); - mutex_init(&flash_data->lock); -diff --git a/drivers/leds/leds-lp50xx.c b/drivers/leds/leds-lp50xx.c -index 68c4d9967d6831..182a590b026775 100644 ---- a/drivers/leds/leds-lp50xx.c -+++ b/drivers/leds/leds-lp50xx.c -@@ -486,6 +486,7 @@ static int lp50xx_probe_dt(struct lp50xx *priv) - } - - fwnode_for_each_child_node(child, led_node) { -+ int multi_index; - ret = fwnode_property_read_u32(led_node, "color", - &color_id); - if (ret) { -@@ -493,8 +494,16 @@ static int lp50xx_probe_dt(struct lp50xx *priv) - dev_err(priv->dev, "Cannot read color\n"); - goto child_out; - } -+ ret = fwnode_property_read_u32(led_node, "reg", &multi_index); -+ if (ret != 0) { -+ dev_err(priv->dev, "reg must be set\n"); -+ return -EINVAL; -+ } else if (multi_index >= LP50XX_LEDS_PER_MODULE) { -+ dev_err(priv->dev, "reg %i out of range\n", multi_index); -+ return -EINVAL; -+ } - -- mc_led_info[num_colors].color_index = color_id; -+ mc_led_info[multi_index].color_index = color_id; - num_colors++; - } - -diff --git a/drivers/leds/trigger/ledtrig-netdev.c b/drivers/leds/trigger/ledtrig-netdev.c -index f8912fa60c4988..79719fc8a08fb4 100644 ---- a/drivers/leds/trigger/ledtrig-netdev.c -+++ b/drivers/leds/trigger/ledtrig-netdev.c -@@ -54,7 +54,6 @@ struct led_netdev_data { - unsigned int last_activity; - - unsigned long mode; -- unsigned long blink_delay; - int link_speed; - u8 duplex; - -@@ -70,10 +69,6 @@ static void set_baseline_state(struct led_netdev_data *trigger_data) - /* Already validated, hw control is possible with the requested mode */ - if (trigger_data->hw_control) { - led_cdev->hw_control_set(led_cdev, trigger_data->mode); -- if (led_cdev->blink_set) { -- led_cdev->blink_set(led_cdev, &trigger_data->blink_delay, -- &trigger_data->blink_delay); -- } - - return; - } -@@ -391,11 +386,10 @@ static ssize_t interval_store(struct device *dev, - size_t size) - { - struct led_netdev_data *trigger_data = led_trigger_get_drvdata(dev); -- struct led_classdev *led_cdev = trigger_data->led_cdev; - unsigned long value; - int ret; - -- if (trigger_data->hw_control && !led_cdev->blink_set) -+ if (trigger_data->hw_control) - return -EINVAL; - - ret = kstrtoul(buf, 0, &value); -@@ -404,13 +398,9 @@ static ssize_t interval_store(struct device *dev, - - /* impose some basic bounds on the timer interval */ - if (value >= 5 && value <= 10000) { -- if (trigger_data->hw_control) { -- trigger_data->blink_delay = value; -- } else { -- cancel_delayed_work_sync(&trigger_data->work); -+ cancel_delayed_work_sync(&trigger_data->work); - -- atomic_set(&trigger_data->interval, msecs_to_jiffies(value)); -- } -+ atomic_set(&trigger_data->interval, msecs_to_jiffies(value)); - set_baseline_state(trigger_data); /* resets timer */ - } - -diff --git a/drivers/md/dm-ps-historical-service-time.c b/drivers/md/dm-ps-historical-service-time.c -index b49e10d76d0302..2c8626a83de437 100644 ---- a/drivers/md/dm-ps-historical-service-time.c -+++ b/drivers/md/dm-ps-historical-service-time.c -@@ -541,8 +541,10 @@ static int __init dm_hst_init(void) - { - int r = dm_register_path_selector(&hst_ps); - -- if (r < 0) -+ if (r < 0) { - DMERR("register failed %d", r); -+ return r; -+ } - - DMINFO("version " HST_VERSION " loaded"); - -diff --git a/drivers/md/dm-ps-queue-length.c b/drivers/md/dm-ps-queue-length.c -index e305f05ad1e5e8..eb543e6431e038 100644 ---- a/drivers/md/dm-ps-queue-length.c -+++ b/drivers/md/dm-ps-queue-length.c -@@ -260,8 +260,10 @@ static int __init dm_ql_init(void) - { - int r = dm_register_path_selector(&ql_ps); - -- if (r < 0) -+ if (r < 0) { - DMERR("register failed %d", r); -+ return r; -+ } - - DMINFO("version " QL_VERSION " loaded"); - -diff --git a/drivers/md/dm-ps-round-robin.c b/drivers/md/dm-ps-round-robin.c -index 0f04b673597aeb..62ac820125cbdc 100644 ---- a/drivers/md/dm-ps-round-robin.c -+++ b/drivers/md/dm-ps-round-robin.c -@@ -220,8 +220,10 @@ static int __init dm_rr_init(void) - { - int r = dm_register_path_selector(&rr_ps); - -- if (r < 0) -+ if (r < 0) { - DMERR("register failed %d", r); -+ return r; -+ } - - DMINFO("version " RR_VERSION " loaded"); - -diff --git a/drivers/md/dm-ps-service-time.c b/drivers/md/dm-ps-service-time.c -index 969d31c40272e2..f8c43aecdb27ad 100644 ---- a/drivers/md/dm-ps-service-time.c -+++ b/drivers/md/dm-ps-service-time.c -@@ -341,8 +341,10 @@ static int __init dm_st_init(void) - { - int r = dm_register_path_selector(&st_ps); - -- if (r < 0) -+ if (r < 0) { - DMERR("register failed %d", r); -+ return r; -+ } - - DMINFO("version " ST_VERSION " loaded"); - -diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c -index bf2ade89c8c2dc..ed0a5e91968dfb 100644 ---- a/drivers/md/dm-table.c -+++ b/drivers/md/dm-table.c -@@ -862,17 +862,17 @@ static bool dm_table_supports_dax(struct dm_table *t, - return true; - } - --static int device_is_rq_stackable(struct dm_target *ti, struct dm_dev *dev, -- sector_t start, sector_t len, void *data) -+static int device_is_not_rq_stackable(struct dm_target *ti, struct dm_dev *dev, -+ sector_t start, sector_t len, void *data) - { - struct block_device *bdev = dev->bdev; - struct request_queue *q = bdev_get_queue(bdev); - - /* request-based cannot stack on partitions! */ - if (bdev_is_partition(bdev)) -- return false; -+ return true; - -- return queue_is_mq(q); -+ return !queue_is_mq(q); - } - - static int dm_table_determine_type(struct dm_table *t) -@@ -968,7 +968,7 @@ static int dm_table_determine_type(struct dm_table *t) - - /* Non-request-stackable devices can't be used for request-based dm */ - if (!ti->type->iterate_devices || -- !ti->type->iterate_devices(ti, device_is_rq_stackable, NULL)) { -+ ti->type->iterate_devices(ti, device_is_not_rq_stackable, NULL)) { - DMERR("table load rejected: including non-request-stackable devices"); - return -EINVAL; - } -diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c -index b487f7acc860f7..36e55a5bcb0de8 100644 ---- a/drivers/md/dm-zoned-target.c -+++ b/drivers/md/dm-zoned-target.c -@@ -1062,7 +1062,7 @@ static int dmz_iterate_devices(struct dm_target *ti, - struct dmz_target *dmz = ti->private; - unsigned int zone_nr_sectors = dmz_zone_nr_sectors(dmz->metadata); - sector_t capacity; -- int i, r; -+ int i, r = 0; - - for (i = 0; i < dmz->nr_ddevs; i++) { - capacity = dmz->dev[i].capacity & ~(zone_nr_sectors - 1); -diff --git a/drivers/media/cec/usb/rainshadow/rainshadow-cec.c b/drivers/media/cec/usb/rainshadow/rainshadow-cec.c -index ee870ea1a88601..6f8d6797c61459 100644 ---- a/drivers/media/cec/usb/rainshadow/rainshadow-cec.c -+++ b/drivers/media/cec/usb/rainshadow/rainshadow-cec.c -@@ -171,11 +171,12 @@ static irqreturn_t rain_interrupt(struct serio *serio, unsigned char data, - { - struct rain *rain = serio_get_drvdata(serio); - -+ spin_lock(&rain->buf_lock); - if (rain->buf_len == DATA_SIZE) { -+ spin_unlock(&rain->buf_lock); - dev_warn_once(rain->dev, "buffer overflow\n"); - return IRQ_HANDLED; - } -- spin_lock(&rain->buf_lock); - rain->buf_len++; - rain->buf[rain->buf_wr_idx] = data; - rain->buf_wr_idx = (rain->buf_wr_idx + 1) & 0xff; -diff --git a/drivers/media/dvb-frontends/dib7000p.c b/drivers/media/dvb-frontends/dib7000p.c -index 444fe1c4bf2d71..e561c7cc35bfaf 100644 ---- a/drivers/media/dvb-frontends/dib7000p.c -+++ b/drivers/media/dvb-frontends/dib7000p.c -@@ -2198,6 +2198,8 @@ static int w7090p_tuner_write_serpar(struct i2c_adapter *i2c_adap, struct i2c_ms - struct dib7000p_state *state = i2c_get_adapdata(i2c_adap); - u8 n_overflow = 1; - u16 i = 1000; -+ if (msg[0].len < 3) -+ return -EOPNOTSUPP; - u16 serpar_num = msg[0].buf[0]; - - while (n_overflow == 1 && i) { -@@ -2217,6 +2219,8 @@ static int w7090p_tuner_read_serpar(struct i2c_adapter *i2c_adap, struct i2c_msg - struct dib7000p_state *state = i2c_get_adapdata(i2c_adap); - u8 n_overflow = 1, n_empty = 1; - u16 i = 1000; -+ if (msg[0].len < 1 || msg[1].len < 2) -+ return -EOPNOTSUPP; - u16 serpar_num = msg[0].buf[0]; - u16 read_word; - -@@ -2261,8 +2265,12 @@ static int dib7090p_rw_on_apb(struct i2c_adapter *i2c_adap, - u16 word; - - if (num == 1) { /* write */ -+ if (msg[0].len < 3) -+ return -EOPNOTSUPP; - dib7000p_write_word(state, apb_address, ((msg[0].buf[1] << 8) | (msg[0].buf[2]))); - } else { -+ if (msg[1].len < 2) -+ return -EOPNOTSUPP; - word = dib7000p_read_word(state, apb_address); - msg[1].buf[0] = (word >> 8) & 0xff; - msg[1].buf[1] = (word) & 0xff; -diff --git a/drivers/media/i2c/ccs/ccs-core.c b/drivers/media/i2c/ccs/ccs-core.c -index 36402612425779..4d31b2bb8f09f6 100644 ---- a/drivers/media/i2c/ccs/ccs-core.c -+++ b/drivers/media/i2c/ccs/ccs-core.c -@@ -665,7 +665,7 @@ static int ccs_set_ctrl(struct v4l2_ctrl *ctrl) - break; - } - -- pm_status = pm_runtime_get_if_active(&client->dev, true); -+ pm_status = pm_runtime_get_if_active(&client->dev); - if (!pm_status) - return 0; - -diff --git a/drivers/media/i2c/hi556.c b/drivers/media/i2c/hi556.c -index fd56ba13873915..d6ef4a249e94f9 100644 ---- a/drivers/media/i2c/hi556.c -+++ b/drivers/media/i2c/hi556.c -@@ -689,21 +689,23 @@ static int hi556_test_pattern(struct hi556 *hi556, u32 pattern) - int ret; - u32 val; - -- if (pattern) { -- ret = hi556_read_reg(hi556, HI556_REG_ISP, -- HI556_REG_VALUE_08BIT, &val); -- if (ret) -- return ret; -+ ret = hi556_read_reg(hi556, HI556_REG_ISP, -+ HI556_REG_VALUE_08BIT, &val); -+ if (ret) -+ return ret; - -- ret = hi556_write_reg(hi556, HI556_REG_ISP, -- HI556_REG_VALUE_08BIT, -- val | HI556_REG_ISP_TPG_EN); -- if (ret) -- return ret; -- } -+ val = pattern ? (val | HI556_REG_ISP_TPG_EN) : -+ (val & ~HI556_REG_ISP_TPG_EN); -+ -+ ret = hi556_write_reg(hi556, HI556_REG_ISP, -+ HI556_REG_VALUE_08BIT, val); -+ if (ret) -+ return ret; -+ -+ val = pattern ? BIT(pattern - 1) : 0; - - return hi556_write_reg(hi556, HI556_REG_TEST_PATTERN, -- HI556_REG_VALUE_08BIT, pattern); -+ HI556_REG_VALUE_08BIT, val); - } - - static int hi556_set_ctrl(struct v4l2_ctrl *ctrl) -diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c -index 5429bd2eb05318..5206784726dbde 100644 ---- a/drivers/media/i2c/ov2659.c -+++ b/drivers/media/i2c/ov2659.c -@@ -1479,14 +1479,15 @@ static int ov2659_probe(struct i2c_client *client) - V4L2_CID_TEST_PATTERN, - ARRAY_SIZE(ov2659_test_pattern_menu) - 1, - 0, 0, ov2659_test_pattern_menu); -- ov2659->sd.ctrl_handler = &ov2659->ctrls; - - if (ov2659->ctrls.error) { - dev_err(&client->dev, "%s: control initialization error %d\n", - __func__, ov2659->ctrls.error); -+ v4l2_ctrl_handler_free(&ov2659->ctrls); - return ov2659->ctrls.error; - } - -+ ov2659->sd.ctrl_handler = &ov2659->ctrls; - sd = &ov2659->sd; - client->flags |= I2C_CLIENT_SCCB; - #ifdef CONFIG_VIDEO_V4L2_SUBDEV_API -diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c -index c81dd41834043f..8a1a33862ba712 100644 ---- a/drivers/media/i2c/tc358743.c -+++ b/drivers/media/i2c/tc358743.c -@@ -110,7 +110,7 @@ static inline struct tc358743_state *to_state(struct v4l2_subdev *sd) - - /* --------------- I2C --------------- */ - --static void i2c_rd(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n) -+static int i2c_rd(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n) - { - struct tc358743_state *state = to_state(sd); - struct i2c_client *client = state->i2c_client; -@@ -136,6 +136,7 @@ static void i2c_rd(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n) - v4l2_err(sd, "%s: reading register 0x%x from 0x%x failed: %d\n", - __func__, reg, client->addr, err); - } -+ return err != ARRAY_SIZE(msgs); - } - - static void i2c_wr(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n) -@@ -192,15 +193,24 @@ static void i2c_wr(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n) - } - } - --static noinline u32 i2c_rdreg(struct v4l2_subdev *sd, u16 reg, u32 n) -+static noinline u32 i2c_rdreg_err(struct v4l2_subdev *sd, u16 reg, u32 n, -+ int *err) - { -+ int error; - __le32 val = 0; - -- i2c_rd(sd, reg, (u8 __force *)&val, n); -+ error = i2c_rd(sd, reg, (u8 __force *)&val, n); -+ if (err) -+ *err = error; - - return le32_to_cpu(val); - } - -+static inline u32 i2c_rdreg(struct v4l2_subdev *sd, u16 reg, u32 n) -+{ -+ return i2c_rdreg_err(sd, reg, n, NULL); -+} -+ - static noinline void i2c_wrreg(struct v4l2_subdev *sd, u16 reg, u32 val, u32 n) - { - __le32 raw = cpu_to_le32(val); -@@ -229,6 +239,13 @@ static u16 i2c_rd16(struct v4l2_subdev *sd, u16 reg) - return i2c_rdreg(sd, reg, 2); - } - -+static int i2c_rd16_err(struct v4l2_subdev *sd, u16 reg, u16 *value) -+{ -+ int err; -+ *value = i2c_rdreg_err(sd, reg, 2, &err); -+ return err; -+} -+ - static void i2c_wr16(struct v4l2_subdev *sd, u16 reg, u16 val) - { - i2c_wrreg(sd, reg, val, 2); -@@ -1651,12 +1668,23 @@ static int tc358743_enum_mbus_code(struct v4l2_subdev *sd, - return 0; - } - -+static u32 tc358743_g_colorspace(u32 code) -+{ -+ switch (code) { -+ case MEDIA_BUS_FMT_RGB888_1X24: -+ return V4L2_COLORSPACE_SRGB; -+ case MEDIA_BUS_FMT_UYVY8_1X16: -+ return V4L2_COLORSPACE_SMPTE170M; -+ default: -+ return 0; -+ } -+} -+ - static int tc358743_get_fmt(struct v4l2_subdev *sd, - struct v4l2_subdev_state *sd_state, - struct v4l2_subdev_format *format) - { - struct tc358743_state *state = to_state(sd); -- u8 vi_rep = i2c_rd8(sd, VI_REP); - - if (format->pad != 0) - return -EINVAL; -@@ -1666,23 +1694,7 @@ static int tc358743_get_fmt(struct v4l2_subdev *sd, - format->format.height = state->timings.bt.height; - format->format.field = V4L2_FIELD_NONE; - -- switch (vi_rep & MASK_VOUT_COLOR_SEL) { -- case MASK_VOUT_COLOR_RGB_FULL: -- case MASK_VOUT_COLOR_RGB_LIMITED: -- format->format.colorspace = V4L2_COLORSPACE_SRGB; -- break; -- case MASK_VOUT_COLOR_601_YCBCR_LIMITED: -- case MASK_VOUT_COLOR_601_YCBCR_FULL: -- format->format.colorspace = V4L2_COLORSPACE_SMPTE170M; -- break; -- case MASK_VOUT_COLOR_709_YCBCR_FULL: -- case MASK_VOUT_COLOR_709_YCBCR_LIMITED: -- format->format.colorspace = V4L2_COLORSPACE_REC709; -- break; -- default: -- format->format.colorspace = 0; -- break; -- } -+ format->format.colorspace = tc358743_g_colorspace(format->format.code); - - return 0; - } -@@ -1696,19 +1708,14 @@ static int tc358743_set_fmt(struct v4l2_subdev *sd, - u32 code = format->format.code; /* is overwritten by get_fmt */ - int ret = tc358743_get_fmt(sd, sd_state, format); - -- format->format.code = code; -+ if (code == MEDIA_BUS_FMT_RGB888_1X24 || -+ code == MEDIA_BUS_FMT_UYVY8_1X16) -+ format->format.code = code; -+ format->format.colorspace = tc358743_g_colorspace(format->format.code); - - if (ret) - return ret; - -- switch (code) { -- case MEDIA_BUS_FMT_RGB888_1X24: -- case MEDIA_BUS_FMT_UYVY8_1X16: -- break; -- default: -- return -EINVAL; -- } -- - if (format->which == V4L2_SUBDEV_FORMAT_TRY) - return 0; - -@@ -1932,8 +1939,19 @@ static int tc358743_probe_of(struct tc358743_state *state) - state->pdata.refclk_hz = clk_get_rate(refclk); - state->pdata.ddc5v_delay = DDC5V_DELAY_100_MS; - state->pdata.enable_hdcp = false; -- /* A FIFO level of 16 should be enough for 2-lane 720p60 at 594 MHz. */ -- state->pdata.fifo_level = 16; -+ /* -+ * Ideally the FIFO trigger level should be set based on the input and -+ * output data rates, but the calculations required are buried in -+ * Toshiba's register settings spreadsheet. -+ * A value of 16 works with a 594Mbps data rate for 720p60 (using 2 -+ * lanes) and 1080p60 (using 4 lanes), but fails when the data rate -+ * is increased, or a lower pixel clock is used that result in CSI -+ * reading out faster than the data is arriving. -+ * -+ * A value of 374 works with both those modes at 594Mbps, and with most -+ * modes on 972Mbps. -+ */ -+ state->pdata.fifo_level = 374; - /* - * The PLL input clock is obtained by dividing refclk by pll_prd. - * It must be between 6 MHz and 40 MHz, lower frequency is better. -@@ -2021,6 +2039,7 @@ static int tc358743_probe(struct i2c_client *client) - struct tc358743_platform_data *pdata = client->dev.platform_data; - struct v4l2_subdev *sd; - u16 irq_mask = MASK_HDMI_MSK | MASK_CSI_MSK; -+ u16 chipid; - int err; - - if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_BYTE_DATA)) -@@ -2052,7 +2071,8 @@ static int tc358743_probe(struct i2c_client *client) - sd->flags |= V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS; - - /* i2c access */ -- if ((i2c_rd16(sd, CHIPID) & MASK_CHIPID) != 0) { -+ if (i2c_rd16_err(sd, CHIPID, &chipid) || -+ (chipid & MASK_CHIPID) != 0) { - v4l2_info(sd, "not a TC358743 on address 0x%x\n", - client->addr << 1); - return -ENODEV; -diff --git a/drivers/media/pci/intel/ivsc/mei_ace.c b/drivers/media/pci/intel/ivsc/mei_ace.c -index a0491f30783119..5696a951c0fbca 100644 ---- a/drivers/media/pci/intel/ivsc/mei_ace.c -+++ b/drivers/media/pci/intel/ivsc/mei_ace.c -@@ -528,6 +528,8 @@ static void mei_ace_remove(struct mei_cl_device *cldev) - - ace_set_camera_owner(ace, ACE_CAMERA_IVSC); - -+ mei_cldev_disable(cldev); -+ - mutex_destroy(&ace->lock); - } - -diff --git a/drivers/media/pci/intel/ivsc/mei_csi.c b/drivers/media/pci/intel/ivsc/mei_csi.c -index 685b2ec96071a4..6c16721a6226ec 100644 ---- a/drivers/media/pci/intel/ivsc/mei_csi.c -+++ b/drivers/media/pci/intel/ivsc/mei_csi.c -@@ -807,6 +807,8 @@ static void mei_csi_remove(struct mei_cl_device *cldev) - - pm_runtime_disable(&cldev->dev); - -+ mei_cldev_disable(cldev); -+ - mutex_destroy(&csi->lock); - } - -diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c -index 0754645d26acba..e62245c5c6fc47 100644 ---- a/drivers/media/platform/qcom/camss/camss.c -+++ b/drivers/media/platform/qcom/camss/camss.c -@@ -1660,7 +1660,7 @@ static int camss_probe(struct platform_device *pdev) - ret = v4l2_device_register(camss->dev, &camss->v4l2_dev); - if (ret < 0) { - dev_err(dev, "Failed to register V4L2 device: %d\n", ret); -- goto err_genpd_cleanup; -+ goto err_media_device_cleanup; - } - - v4l2_async_nf_init(&camss->notifier, &camss->v4l2_dev); -@@ -1711,6 +1711,8 @@ static int camss_probe(struct platform_device *pdev) - v4l2_device_unregister(&camss->v4l2_dev); - v4l2_async_nf_cleanup(&camss->notifier); - pm_runtime_disable(dev); -+err_media_device_cleanup: -+ media_device_cleanup(&camss->media_dev); - err_genpd_cleanup: - camss_genpd_cleanup(camss); - -diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c -index 47ce3365451d37..64a858783c41ef 100644 ---- a/drivers/media/platform/qcom/venus/core.c -+++ b/drivers/media/platform/qcom/venus/core.c -@@ -334,13 +334,13 @@ static int venus_probe(struct platform_device *pdev) - INIT_DELAYED_WORK(&core->work, venus_sys_error_handler); - init_waitqueue_head(&core->sys_err_done); - -- ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread, -- IRQF_TRIGGER_HIGH | IRQF_ONESHOT, -- "venus", core); -+ ret = hfi_create(core, &venus_core_ops); - if (ret) - goto err_core_put; - -- ret = hfi_create(core, &venus_core_ops); -+ ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread, -+ IRQF_TRIGGER_HIGH | IRQF_ONESHOT, -+ "venus", core); - if (ret) - goto err_core_put; - -diff --git a/drivers/media/platform/qcom/venus/core.h b/drivers/media/platform/qcom/venus/core.h -index 4a633261ece473..ba8afda6667d44 100644 ---- a/drivers/media/platform/qcom/venus/core.h -+++ b/drivers/media/platform/qcom/venus/core.h -@@ -28,6 +28,8 @@ - #define VIDC_PMDOMAINS_NUM_MAX 3 - #define VIDC_RESETS_NUM_MAX 2 - -+#define VENUS_MAX_FPS 240 -+ - extern int venus_fw_debug; - - struct freq_tbl { -diff --git a/drivers/media/platform/qcom/venus/hfi_msgs.c b/drivers/media/platform/qcom/venus/hfi_msgs.c -index 0a041b4db9efc5..cf0d97cbc4631f 100644 ---- a/drivers/media/platform/qcom/venus/hfi_msgs.c -+++ b/drivers/media/platform/qcom/venus/hfi_msgs.c -@@ -33,8 +33,9 @@ static void event_seq_changed(struct venus_core *core, struct venus_inst *inst, - struct hfi_buffer_requirements *bufreq; - struct hfi_extradata_input_crop *crop; - struct hfi_dpb_counts *dpb_count; -+ u32 ptype, rem_bytes; -+ u32 size_read = 0; - u8 *data_ptr; -- u32 ptype; - - inst->error = HFI_ERR_NONE; - -@@ -44,86 +45,118 @@ static void event_seq_changed(struct venus_core *core, struct venus_inst *inst, - break; - default: - inst->error = HFI_ERR_SESSION_INVALID_PARAMETER; -- goto done; -+ inst->ops->event_notify(inst, EVT_SYS_EVENT_CHANGE, &event); -+ return; - } - - event.event_type = pkt->event_data1; - - num_properties_changed = pkt->event_data2; -- if (!num_properties_changed) { -- inst->error = HFI_ERR_SESSION_INSUFFICIENT_RESOURCES; -- goto done; -- } -+ if (!num_properties_changed) -+ goto error; - - data_ptr = (u8 *)&pkt->ext_event_data[0]; -+ rem_bytes = pkt->shdr.hdr.size - sizeof(*pkt); -+ - do { -+ if (rem_bytes < sizeof(u32)) -+ goto error; - ptype = *((u32 *)data_ptr); -+ -+ data_ptr += sizeof(u32); -+ rem_bytes -= sizeof(u32); -+ - switch (ptype) { - case HFI_PROPERTY_PARAM_FRAME_SIZE: -- data_ptr += sizeof(u32); -+ if (rem_bytes < sizeof(struct hfi_framesize)) -+ goto error; -+ - frame_sz = (struct hfi_framesize *)data_ptr; - event.width = frame_sz->width; - event.height = frame_sz->height; -- data_ptr += sizeof(*frame_sz); -+ size_read = sizeof(struct hfi_framesize); - break; - case HFI_PROPERTY_PARAM_PROFILE_LEVEL_CURRENT: -- data_ptr += sizeof(u32); -+ if (rem_bytes < sizeof(struct hfi_profile_level)) -+ goto error; -+ - profile_level = (struct hfi_profile_level *)data_ptr; - event.profile = profile_level->profile; - event.level = profile_level->level; -- data_ptr += sizeof(*profile_level); -+ size_read = sizeof(struct hfi_profile_level); - break; - case HFI_PROPERTY_PARAM_VDEC_PIXEL_BITDEPTH: -- data_ptr += sizeof(u32); -+ if (rem_bytes < sizeof(struct hfi_bit_depth)) -+ goto error; -+ - pixel_depth = (struct hfi_bit_depth *)data_ptr; - event.bit_depth = pixel_depth->bit_depth; -- data_ptr += sizeof(*pixel_depth); -+ size_read = sizeof(struct hfi_bit_depth); - break; - case HFI_PROPERTY_PARAM_VDEC_PIC_STRUCT: -- data_ptr += sizeof(u32); -+ if (rem_bytes < sizeof(struct hfi_pic_struct)) -+ goto error; -+ - pic_struct = (struct hfi_pic_struct *)data_ptr; - event.pic_struct = pic_struct->progressive_only; -- data_ptr += sizeof(*pic_struct); -+ size_read = sizeof(struct hfi_pic_struct); - break; - case HFI_PROPERTY_PARAM_VDEC_COLOUR_SPACE: -- data_ptr += sizeof(u32); -+ if (rem_bytes < sizeof(struct hfi_colour_space)) -+ goto error; -+ - colour_info = (struct hfi_colour_space *)data_ptr; - event.colour_space = colour_info->colour_space; -- data_ptr += sizeof(*colour_info); -+ size_read = sizeof(struct hfi_colour_space); - break; - case HFI_PROPERTY_CONFIG_VDEC_ENTROPY: -- data_ptr += sizeof(u32); -+ if (rem_bytes < sizeof(u32)) -+ goto error; -+ - event.entropy_mode = *(u32 *)data_ptr; -- data_ptr += sizeof(u32); -+ size_read = sizeof(u32); - break; - case HFI_PROPERTY_CONFIG_BUFFER_REQUIREMENTS: -- data_ptr += sizeof(u32); -+ if (rem_bytes < sizeof(struct hfi_buffer_requirements)) -+ goto error; -+ - bufreq = (struct hfi_buffer_requirements *)data_ptr; - event.buf_count = hfi_bufreq_get_count_min(bufreq, ver); -- data_ptr += sizeof(*bufreq); -+ size_read = sizeof(struct hfi_buffer_requirements); - break; - case HFI_INDEX_EXTRADATA_INPUT_CROP: -- data_ptr += sizeof(u32); -+ if (rem_bytes < sizeof(struct hfi_extradata_input_crop)) -+ goto error; -+ - crop = (struct hfi_extradata_input_crop *)data_ptr; - event.input_crop.left = crop->left; - event.input_crop.top = crop->top; - event.input_crop.width = crop->width; - event.input_crop.height = crop->height; -- data_ptr += sizeof(*crop); -+ size_read = sizeof(struct hfi_extradata_input_crop); - break; - case HFI_PROPERTY_PARAM_VDEC_DPB_COUNTS: -- data_ptr += sizeof(u32); -+ if (rem_bytes < sizeof(struct hfi_dpb_counts)) -+ goto error; -+ - dpb_count = (struct hfi_dpb_counts *)data_ptr; - event.buf_count = dpb_count->fw_min_cnt; -- data_ptr += sizeof(*dpb_count); -+ size_read = sizeof(struct hfi_dpb_counts); - break; - default: -+ size_read = 0; - break; - } -+ data_ptr += size_read; -+ rem_bytes -= size_read; - num_properties_changed--; - } while (num_properties_changed > 0); - --done: -+ inst->ops->event_notify(inst, EVT_SYS_EVENT_CHANGE, &event); -+ return; -+ -+error: -+ inst->error = HFI_ERR_SESSION_INSUFFICIENT_RESOURCES; - inst->ops->event_notify(inst, EVT_SYS_EVENT_CHANGE, &event); - } - -diff --git a/drivers/media/platform/qcom/venus/hfi_venus.c b/drivers/media/platform/qcom/venus/hfi_venus.c -index ab93757fff4b31..8e211527960118 100644 ---- a/drivers/media/platform/qcom/venus/hfi_venus.c -+++ b/drivers/media/platform/qcom/venus/hfi_venus.c -@@ -239,6 +239,7 @@ static int venus_write_queue(struct venus_hfi_device *hdev, - static int venus_read_queue(struct venus_hfi_device *hdev, - struct iface_queue *queue, void *pkt, u32 *tx_req) - { -+ struct hfi_pkt_hdr *pkt_hdr = NULL; - struct hfi_queue_header *qhdr; - u32 dwords, new_rd_idx; - u32 rd_idx, wr_idx, type, qsize; -@@ -304,6 +305,9 @@ static int venus_read_queue(struct venus_hfi_device *hdev, - memcpy(pkt, rd_ptr, len); - memcpy(pkt + len, queue->qmem.kva, new_rd_idx << 2); - } -+ pkt_hdr = (struct hfi_pkt_hdr *)(pkt); -+ if ((pkt_hdr->size >> 2) != dwords) -+ return -EINVAL; - } else { - /* bad packet received, dropping */ - new_rd_idx = qhdr->write_idx; -@@ -1689,6 +1693,7 @@ void venus_hfi_destroy(struct venus_core *core) - venus_interface_queues_release(hdev); - mutex_destroy(&hdev->lock); - kfree(hdev); -+ disable_irq(core->irq); - core->ops = NULL; - } - -diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c -index 884ee6e9d4bd1a..8be056210f1d34 100644 ---- a/drivers/media/platform/qcom/venus/vdec.c -+++ b/drivers/media/platform/qcom/venus/vdec.c -@@ -481,11 +481,10 @@ static int vdec_s_parm(struct file *file, void *fh, struct v4l2_streamparm *a) - us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC; - do_div(us_per_frame, timeperframe->denominator); - -- if (!us_per_frame) -- return -EINVAL; -- -+ us_per_frame = clamp(us_per_frame, 1, USEC_PER_SEC); - fps = (u64)USEC_PER_SEC; - do_div(fps, us_per_frame); -+ fps = min(VENUS_MAX_FPS, fps); - - inst->fps = fps; - inst->timeperframe = *timeperframe; -diff --git a/drivers/media/platform/qcom/venus/venc.c b/drivers/media/platform/qcom/venus/venc.c -index 44b13696cf82a5..dd3840f7bb7bde 100644 ---- a/drivers/media/platform/qcom/venus/venc.c -+++ b/drivers/media/platform/qcom/venus/venc.c -@@ -411,11 +411,10 @@ static int venc_s_parm(struct file *file, void *fh, struct v4l2_streamparm *a) - us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC; - do_div(us_per_frame, timeperframe->denominator); - -- if (!us_per_frame) -- return -EINVAL; -- -+ us_per_frame = clamp(us_per_frame, 1, USEC_PER_SEC); - fps = (u64)USEC_PER_SEC; - do_div(fps, us_per_frame); -+ fps = min(VENUS_MAX_FPS, fps); - - inst->timeperframe = *timeperframe; - inst->fps = fps; -diff --git a/drivers/media/platform/verisilicon/rockchip_vpu_hw.c b/drivers/media/platform/verisilicon/rockchip_vpu_hw.c -index f9752767078355..df5b7dadb1b4e4 100644 ---- a/drivers/media/platform/verisilicon/rockchip_vpu_hw.c -+++ b/drivers/media/platform/verisilicon/rockchip_vpu_hw.c -@@ -17,7 +17,6 @@ - - #define RK3066_ACLK_MAX_FREQ (300 * 1000 * 1000) - #define RK3288_ACLK_MAX_FREQ (400 * 1000 * 1000) --#define RK3588_ACLK_MAX_FREQ (300 * 1000 * 1000) - - #define ROCKCHIP_VPU981_MIN_SIZE 64 - -@@ -441,13 +440,6 @@ static int rk3066_vpu_hw_init(struct hantro_dev *vpu) - return 0; - } - --static int rk3588_vpu981_hw_init(struct hantro_dev *vpu) --{ -- /* Bump ACLKs to max. possible freq. to improve performance. */ -- clk_set_rate(vpu->clocks[0].clk, RK3588_ACLK_MAX_FREQ); -- return 0; --} -- - static int rockchip_vpu_hw_init(struct hantro_dev *vpu) - { - /* Bump ACLK to max. possible freq. to improve performance. */ -@@ -808,7 +800,6 @@ const struct hantro_variant rk3588_vpu981_variant = { - .codec_ops = rk3588_vpu981_codec_ops, - .irqs = rk3588_vpu981_irqs, - .num_irqs = ARRAY_SIZE(rk3588_vpu981_irqs), -- .init = rk3588_vpu981_hw_init, - .clk_names = rk3588_vpu981_vpu_clk_names, - .num_clocks = ARRAY_SIZE(rk3588_vpu981_vpu_clk_names) - }; -diff --git a/drivers/media/test-drivers/vivid/vivid-ctrls.c b/drivers/media/test-drivers/vivid/vivid-ctrls.c -index f2b20e25a7a497..5ca385a6a13656 100644 ---- a/drivers/media/test-drivers/vivid/vivid-ctrls.c -+++ b/drivers/media/test-drivers/vivid/vivid-ctrls.c -@@ -240,7 +240,8 @@ static const struct v4l2_ctrl_config vivid_ctrl_u8_pixel_array = { - .min = 0x00, - .max = 0xff, - .step = 1, -- .dims = { 640 / PIXEL_ARRAY_DIV, 360 / PIXEL_ARRAY_DIV }, -+ .dims = { DIV_ROUND_UP(360, PIXEL_ARRAY_DIV), -+ DIV_ROUND_UP(640, PIXEL_ARRAY_DIV) }, - }; - - static const struct v4l2_ctrl_config vivid_ctrl_s32_array = { -diff --git a/drivers/media/test-drivers/vivid/vivid-vid-cap.c b/drivers/media/test-drivers/vivid/vivid-vid-cap.c -index 0ab47fb8696bd0..5d1f78c7604dea 100644 ---- a/drivers/media/test-drivers/vivid/vivid-vid-cap.c -+++ b/drivers/media/test-drivers/vivid/vivid-vid-cap.c -@@ -460,8 +460,8 @@ void vivid_update_format_cap(struct vivid_dev *dev, bool keep_controls) - if (keep_controls) - return; - -- dims[0] = roundup(dev->src_rect.width, PIXEL_ARRAY_DIV); -- dims[1] = roundup(dev->src_rect.height, PIXEL_ARRAY_DIV); -+ dims[0] = DIV_ROUND_UP(dev->src_rect.height, PIXEL_ARRAY_DIV); -+ dims[1] = DIV_ROUND_UP(dev->src_rect.width, PIXEL_ARRAY_DIV); - v4l2_ctrl_modify_dimensions(dev->pixel_array, dims); - } - -diff --git a/drivers/media/usb/gspca/vicam.c b/drivers/media/usb/gspca/vicam.c -index d98343fd33fe34..91e177aa8136fd 100644 ---- a/drivers/media/usb/gspca/vicam.c -+++ b/drivers/media/usb/gspca/vicam.c -@@ -227,6 +227,7 @@ static int sd_init(struct gspca_dev *gspca_dev) - const struct ihex_binrec *rec; - const struct firmware *fw; - u8 *firmware_buf; -+ int len; - - ret = request_ihex_firmware(&fw, VICAM_FIRMWARE, - &gspca_dev->dev->dev); -@@ -241,9 +242,14 @@ static int sd_init(struct gspca_dev *gspca_dev) - goto exit; - } - for (rec = (void *)fw->data; rec; rec = ihex_next_binrec(rec)) { -- memcpy(firmware_buf, rec->data, be16_to_cpu(rec->len)); -+ len = be16_to_cpu(rec->len); -+ if (len > PAGE_SIZE) { -+ ret = -EINVAL; -+ break; -+ } -+ memcpy(firmware_buf, rec->data, len); - ret = vicam_control_msg(gspca_dev, 0xff, 0, 0, firmware_buf, -- be16_to_cpu(rec->len)); -+ len); - if (ret < 0) - break; - } -diff --git a/drivers/media/usb/hdpvr/hdpvr-i2c.c b/drivers/media/usb/hdpvr/hdpvr-i2c.c -index 070559b01b01b8..54956a8ff15e86 100644 ---- a/drivers/media/usb/hdpvr/hdpvr-i2c.c -+++ b/drivers/media/usb/hdpvr/hdpvr-i2c.c -@@ -165,10 +165,16 @@ static const struct i2c_algorithm hdpvr_algo = { - .functionality = hdpvr_functionality, - }; - -+/* prevent invalid 0-length usb_control_msg */ -+static const struct i2c_adapter_quirks hdpvr_quirks = { -+ .flags = I2C_AQ_NO_ZERO_LEN_READ, -+}; -+ - static const struct i2c_adapter hdpvr_i2c_adapter_template = { - .name = "Hauppauge HD PVR I2C", - .owner = THIS_MODULE, - .algo = &hdpvr_algo, -+ .quirks = &hdpvr_quirks, - }; - - static int hdpvr_activate_ir(struct hdpvr_device *dev) -diff --git a/drivers/media/usb/usbtv/usbtv-video.c b/drivers/media/usb/usbtv/usbtv-video.c -index 7495df6b519125..f3633448e8b969 100644 ---- a/drivers/media/usb/usbtv/usbtv-video.c -+++ b/drivers/media/usb/usbtv/usbtv-video.c -@@ -73,6 +73,10 @@ static int usbtv_configure_for_norm(struct usbtv *usbtv, v4l2_std_id norm) - } - - if (params) { -+ if (vb2_is_busy(&usbtv->vb2q) && -+ (usbtv->width != params->cap_width || -+ usbtv->height != params->cap_height)) -+ return -EBUSY; - usbtv->width = params->cap_width; - usbtv->height = params->cap_height; - usbtv->n_chunks = usbtv->width * usbtv->height -diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c -index 76f18557f37bd4..09753993068a95 100644 ---- a/drivers/media/usb/uvc/uvc_driver.c -+++ b/drivers/media/usb/uvc/uvc_driver.c -@@ -235,6 +235,9 @@ static int uvc_parse_format(struct uvc_device *dev, - unsigned int i, n; - u8 ftype; - -+ if (buflen < 4) -+ return -EINVAL; -+ - format->type = buffer[2]; - format->index = buffer[3]; - format->frames = frames; -diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c -index 9572fdfe74f246..a9f880eb518ad8 100644 ---- a/drivers/media/usb/uvc/uvc_video.c -+++ b/drivers/media/usb/uvc/uvc_video.c -@@ -258,6 +258,15 @@ static void uvc_fixup_video_ctrl(struct uvc_streaming *stream, - - ctrl->dwMaxPayloadTransferSize = bandwidth; - } -+ -+ if (stream->intf->num_altsetting > 1 && -+ ctrl->dwMaxPayloadTransferSize > stream->maxpsize) { -+ dev_warn_ratelimited(&stream->intf->dev, -+ "UVC non compliance: the max payload transmission size (%u) exceeds the size of the ep max packet (%u). Using the max size.\n", -+ ctrl->dwMaxPayloadTransferSize, -+ stream->maxpsize); -+ ctrl->dwMaxPayloadTransferSize = stream->maxpsize; -+ } - } - - static size_t uvc_video_ctrl_size(struct uvc_streaming *stream) -@@ -1405,12 +1414,6 @@ static void uvc_video_decode_meta(struct uvc_streaming *stream, - if (!meta_buf || length == 2) - return; - -- if (meta_buf->length - meta_buf->bytesused < -- length + sizeof(meta->ns) + sizeof(meta->sof)) { -- meta_buf->error = 1; -- return; -- } -- - has_pts = mem[1] & UVC_STREAM_PTS; - has_scr = mem[1] & UVC_STREAM_SCR; - -@@ -1431,6 +1434,12 @@ static void uvc_video_decode_meta(struct uvc_streaming *stream, - !memcmp(scr, stream->clock.last_scr, 6))) - return; - -+ if (meta_buf->length - meta_buf->bytesused < -+ length + sizeof(meta->ns) + sizeof(meta->sof)) { -+ meta_buf->error = 1; -+ return; -+ } -+ - meta = (struct uvc_meta_buf *)((u8 *)meta_buf->mem + meta_buf->bytesused); - local_irq_save(flags); - time = uvc_video_get_time(); -diff --git a/drivers/media/v4l2-core/v4l2-common.c b/drivers/media/v4l2-core/v4l2-common.c -index 3a4b15a98e0216..b37507e093399c 100644 ---- a/drivers/media/v4l2-core/v4l2-common.c -+++ b/drivers/media/v4l2-core/v4l2-common.c -@@ -487,10 +487,10 @@ s64 v4l2_get_link_freq(struct v4l2_ctrl_handler *handler, unsigned int mul, - - freq = div_u64(v4l2_ctrl_g_ctrl_int64(ctrl) * mul, div); - -- pr_warn("%s: Link frequency estimated using pixel rate: result might be inaccurate\n", -- __func__); -- pr_warn("%s: Consider implementing support for V4L2_CID_LINK_FREQ in the transmitter driver\n", -- __func__); -+ pr_warn_once("%s: Link frequency estimated using pixel rate: result might be inaccurate\n", -+ __func__); -+ pr_warn_once("%s: Consider implementing support for V4L2_CID_LINK_FREQ in the transmitter driver\n", -+ __func__); - } - - return freq > 0 ? freq : -EINVAL; -diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-core/v4l2-ctrls-core.c -index 84fbf4e06cd33c..a1d3e93a409565 100644 ---- a/drivers/media/v4l2-core/v4l2-ctrls-core.c -+++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c -@@ -1578,7 +1578,6 @@ void v4l2_ctrl_handler_free(struct v4l2_ctrl_handler *hdl) - kvfree(hdl->buckets); - hdl->buckets = NULL; - hdl->cached = NULL; -- hdl->error = 0; - mutex_unlock(hdl->lock); - mutex_destroy(&hdl->_lock); - } -diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c -index ac71abdce1b254..e0895e979e35b3 100644 ---- a/drivers/memstick/core/memstick.c -+++ b/drivers/memstick/core/memstick.c -@@ -548,7 +548,6 @@ EXPORT_SYMBOL(memstick_add_host); - */ - void memstick_remove_host(struct memstick_host *host) - { -- host->removing = 1; - flush_workqueue(workqueue); - mutex_lock(&host->lock); - if (host->card) -diff --git a/drivers/memstick/host/rtsx_usb_ms.c b/drivers/memstick/host/rtsx_usb_ms.c -index dec279845a752d..43ec4948daa206 100644 ---- a/drivers/memstick/host/rtsx_usb_ms.c -+++ b/drivers/memstick/host/rtsx_usb_ms.c -@@ -812,6 +812,7 @@ static int rtsx_usb_ms_drv_remove(struct platform_device *pdev) - int err; - - host->eject = true; -+ msh->removing = true; - cancel_work_sync(&host->handle_req); - cancel_delayed_work_sync(&host->poll_card); - -diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c -index 87603eeaa27705..2b85da0fcf27e1 100644 ---- a/drivers/mfd/axp20x.c -+++ b/drivers/mfd/axp20x.c -@@ -936,7 +936,8 @@ static const struct mfd_cell axp152_cells[] = { - }; - - static struct mfd_cell axp313a_cells[] = { -- MFD_CELL_NAME("axp20x-regulator"), -+ /* AXP323 is sometimes paired with AXP717 as sub-PMIC */ -+ MFD_CELL_BASIC("axp20x-regulator", NULL, NULL, 0, 1), - MFD_CELL_RES("axp313a-pek", axp313a_pek_resources), - }; - -diff --git a/drivers/misc/cardreader/rtsx_usb.c b/drivers/misc/cardreader/rtsx_usb.c -index f150d8769f1986..f546b050cb495f 100644 ---- a/drivers/misc/cardreader/rtsx_usb.c -+++ b/drivers/misc/cardreader/rtsx_usb.c -@@ -698,6 +698,12 @@ static void rtsx_usb_disconnect(struct usb_interface *intf) - } - - #ifdef CONFIG_PM -+static int rtsx_usb_resume_child(struct device *dev, void *data) -+{ -+ pm_request_resume(dev); -+ return 0; -+} -+ - static int rtsx_usb_suspend(struct usb_interface *intf, pm_message_t message) - { - struct rtsx_ucr *ucr = -@@ -713,8 +719,10 @@ static int rtsx_usb_suspend(struct usb_interface *intf, pm_message_t message) - mutex_unlock(&ucr->dev_mutex); - - /* Defer the autosuspend if card exists */ -- if (val & (SD_CD | MS_CD)) -+ if (val & (SD_CD | MS_CD)) { -+ device_for_each_child(&intf->dev, NULL, rtsx_usb_resume_child); - return -EAGAIN; -+ } - } else { - /* There is an ongoing operation*/ - return -EAGAIN; -@@ -724,12 +732,6 @@ static int rtsx_usb_suspend(struct usb_interface *intf, pm_message_t message) - return 0; - } - --static int rtsx_usb_resume_child(struct device *dev, void *data) --{ -- pm_request_resume(dev); -- return 0; --} -- - static int rtsx_usb_resume(struct usb_interface *intf) - { - device_for_each_child(&intf->dev, NULL, rtsx_usb_resume_child); -diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c -index 2e65ce6bdec7d9..b94cf7393fad6a 100644 ---- a/drivers/misc/mei/bus.c -+++ b/drivers/misc/mei/bus.c -@@ -1269,10 +1269,16 @@ static void mei_dev_bus_put(struct mei_device *bus) - static void mei_cl_bus_dev_release(struct device *dev) - { - struct mei_cl_device *cldev = to_mei_cl_device(dev); -+ struct mei_device *mdev = cldev->cl->dev; -+ struct mei_cl *cl; - - mei_cl_flush_queues(cldev->cl, NULL); - mei_me_cl_put(cldev->me_cl); - mei_dev_bus_put(cldev->bus); -+ -+ list_for_each_entry(cl, &mdev->file_list, link) -+ WARN_ON(cl == cldev->cl); -+ - kfree(cldev->cl); - kfree(cldev); - } -diff --git a/drivers/mmc/host/rtsx_usb_sdmmc.c b/drivers/mmc/host/rtsx_usb_sdmmc.c -index ded9b6849e35e9..90ea92bbdb2cf9 100644 ---- a/drivers/mmc/host/rtsx_usb_sdmmc.c -+++ b/drivers/mmc/host/rtsx_usb_sdmmc.c -@@ -1032,9 +1032,7 @@ static int sd_set_power_mode(struct rtsx_usb_sdmmc *host, - err = sd_power_on(host); - } - -- if (!err) -- host->power_mode = power_mode; -- -+ host->power_mode = power_mode; - return err; - } - -diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c -index 82808cc373f68b..c2144a3efb308e 100644 ---- a/drivers/mmc/host/sdhci-msm.c -+++ b/drivers/mmc/host/sdhci-msm.c -@@ -1564,6 +1564,7 @@ static void sdhci_msm_check_power_status(struct sdhci_host *host, u32 req_type) - { - struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); - struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host); -+ struct mmc_host *mmc = host->mmc; - bool done = false; - u32 val = SWITCHABLE_SIGNALING_VOLTAGE; - const struct sdhci_msm_offset *msm_offset = -@@ -1621,6 +1622,12 @@ static void sdhci_msm_check_power_status(struct sdhci_host *host, u32 req_type) - "%s: pwr_irq for req: (%d) timed out\n", - mmc_hostname(host->mmc), req_type); - } -+ -+ if ((req_type & REQ_BUS_ON) && mmc->card && !mmc->ops->get_cd(mmc)) { -+ sdhci_writeb(host, 0, SDHCI_POWER_CONTROL); -+ host->pwr = 0; -+ } -+ - pr_debug("%s: %s: request %d done\n", mmc_hostname(host->mmc), - __func__, req_type); - } -@@ -1679,6 +1686,13 @@ static void sdhci_msm_handle_pwr_irq(struct sdhci_host *host, int irq) - udelay(10); - } - -+ if ((irq_status & CORE_PWRCTL_BUS_ON) && mmc->card && -+ !mmc->ops->get_cd(mmc)) { -+ msm_host_writel(msm_host, CORE_PWRCTL_BUS_FAIL, host, -+ msm_offset->core_pwrctl_ctl); -+ return; -+ } -+ - /* Handle BUS ON/OFF*/ - if (irq_status & CORE_PWRCTL_BUS_ON) { - pwr_state = REQ_BUS_ON; -diff --git a/drivers/mmc/host/sdhci-pci-gli.c b/drivers/mmc/host/sdhci-pci-gli.c -index 11c404374d79da..1dc1b9274b68cc 100644 ---- a/drivers/mmc/host/sdhci-pci-gli.c -+++ b/drivers/mmc/host/sdhci-pci-gli.c -@@ -28,9 +28,6 @@ - #define PCI_GLI_9750_PM_CTRL 0xFC - #define PCI_GLI_9750_PM_STATE GENMASK(1, 0) - --#define PCI_GLI_9750_CORRERR_MASK 0x214 --#define PCI_GLI_9750_CORRERR_MASK_REPLAY_TIMER_TIMEOUT BIT(12) -- - #define SDHCI_GLI_9750_CFG2 0x848 - #define SDHCI_GLI_9750_CFG2_L1DLY GENMASK(28, 24) - #define GLI_9750_CFG2_L1DLY_VALUE 0x1F -@@ -155,9 +152,6 @@ - #define PCI_GLI_9755_PM_CTRL 0xFC - #define PCI_GLI_9755_PM_STATE GENMASK(1, 0) - --#define PCI_GLI_9755_CORRERR_MASK 0x214 --#define PCI_GLI_9755_CORRERR_MASK_REPLAY_TIMER_TIMEOUT BIT(12) -- - #define SDHCI_GLI_9767_GM_BURST_SIZE 0x510 - #define SDHCI_GLI_9767_GM_BURST_SIZE_AXI_ALWAYS_SET BIT(8) - -@@ -227,6 +221,20 @@ - #define GLI_MAX_TUNING_LOOP 40 - - /* Genesys Logic chipset */ -+static void sdhci_gli_mask_replay_timer_timeout(struct pci_dev *pdev) -+{ -+ int aer; -+ u32 value; -+ -+ /* mask the replay timer timeout of AER */ -+ aer = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_ERR); -+ if (aer) { -+ pci_read_config_dword(pdev, aer + PCI_ERR_COR_MASK, &value); -+ value |= PCI_ERR_COR_REP_TIMER; -+ pci_write_config_dword(pdev, aer + PCI_ERR_COR_MASK, value); -+ } -+} -+ - static inline void gl9750_wt_on(struct sdhci_host *host) - { - u32 wt_value; -@@ -568,9 +576,7 @@ static void gl9750_hw_setting(struct sdhci_host *host) - pci_write_config_dword(pdev, PCI_GLI_9750_PM_CTRL, value); - - /* mask the replay timer timeout of AER */ -- pci_read_config_dword(pdev, PCI_GLI_9750_CORRERR_MASK, &value); -- value |= PCI_GLI_9750_CORRERR_MASK_REPLAY_TIMER_TIMEOUT; -- pci_write_config_dword(pdev, PCI_GLI_9750_CORRERR_MASK, value); -+ sdhci_gli_mask_replay_timer_timeout(pdev); - - gl9750_wt_off(host); - } -@@ -782,9 +788,7 @@ static void gl9755_hw_setting(struct sdhci_pci_slot *slot) - pci_write_config_dword(pdev, PCI_GLI_9755_PM_CTRL, value); - - /* mask the replay timer timeout of AER */ -- pci_read_config_dword(pdev, PCI_GLI_9755_CORRERR_MASK, &value); -- value |= PCI_GLI_9755_CORRERR_MASK_REPLAY_TIMER_TIMEOUT; -- pci_write_config_dword(pdev, PCI_GLI_9755_CORRERR_MASK, value); -+ sdhci_gli_mask_replay_timer_timeout(pdev); - - gl9755_wt_off(pdev); - } -@@ -1343,7 +1347,7 @@ static int gl9763e_add_host(struct sdhci_pci_slot *slot) - return ret; - } - --static void gli_set_gl9763e(struct sdhci_pci_slot *slot) -+static void gl9763e_hw_setting(struct sdhci_pci_slot *slot) - { - struct pci_dev *pdev = slot->chip->pdev; - u32 value; -@@ -1372,6 +1376,9 @@ static void gli_set_gl9763e(struct sdhci_pci_slot *slot) - value |= FIELD_PREP(GLI_9763E_HS400_RXDLY, GLI_9763E_HS400_RXDLY_5); - pci_write_config_dword(pdev, PCIE_GLI_9763E_CLKRXDLY, value); - -+ /* mask the replay timer timeout of AER */ -+ sdhci_gli_mask_replay_timer_timeout(pdev); -+ - pci_read_config_dword(pdev, PCIE_GLI_9763E_VHS, &value); - value &= ~GLI_9763E_VHS_REV; - value |= FIELD_PREP(GLI_9763E_VHS_REV, GLI_9763E_VHS_REV_R); -@@ -1515,7 +1522,7 @@ static int gli_probe_slot_gl9763e(struct sdhci_pci_slot *slot) - gli_pcie_enable_msi(slot); - host->mmc_host_ops.hs400_enhanced_strobe = - gl9763e_hs400_enhanced_strobe; -- gli_set_gl9763e(slot); -+ gl9763e_hw_setting(slot); - sdhci_enable_v4_mode(host); - - return 0; -diff --git a/drivers/most/core.c b/drivers/most/core.c -index e4412c7d25b0e0..5d073b3d279675 100644 ---- a/drivers/most/core.c -+++ b/drivers/most/core.c -@@ -538,8 +538,8 @@ static struct most_channel *get_channel(char *mdev, char *mdev_ch) - dev = bus_find_device_by_name(&mostbus, NULL, mdev); - if (!dev) - return NULL; -- put_device(dev); - iface = dev_get_drvdata(dev); -+ put_device(dev); - list_for_each_entry_safe(c, tmp, &iface->p->channel_list, list) { - if (!strcmp(dev_name(&c->dev), mdev_ch)) - return c; -diff --git a/drivers/mtd/nand/raw/fsmc_nand.c b/drivers/mtd/nand/raw/fsmc_nand.c -index 811982da355740..fe5912d31beea4 100644 ---- a/drivers/mtd/nand/raw/fsmc_nand.c -+++ b/drivers/mtd/nand/raw/fsmc_nand.c -@@ -503,6 +503,8 @@ static int dma_xfer(struct fsmc_nand_data *host, void *buffer, int len, - - dma_dev = chan->device; - dma_addr = dma_map_single(dma_dev->dev, buffer, len, direction); -+ if (dma_mapping_error(dma_dev->dev, dma_addr)) -+ return -EINVAL; - - if (direction == DMA_TO_DEVICE) { - dma_src = dma_addr; -diff --git a/drivers/mtd/nand/raw/renesas-nand-controller.c b/drivers/mtd/nand/raw/renesas-nand-controller.c -index 589021ea9eb2ac..a9e79f0acbe2a9 100644 ---- a/drivers/mtd/nand/raw/renesas-nand-controller.c -+++ b/drivers/mtd/nand/raw/renesas-nand-controller.c -@@ -426,6 +426,9 @@ static int rnandc_read_page_hw_ecc(struct nand_chip *chip, u8 *buf, - /* Configure DMA */ - dma_addr = dma_map_single(rnandc->dev, rnandc->buf, mtd->writesize, - DMA_FROM_DEVICE); -+ if (dma_mapping_error(rnandc->dev, dma_addr)) -+ return -ENOMEM; -+ - writel(dma_addr, rnandc->regs + DMA_ADDR_LOW_REG); - writel(mtd->writesize, rnandc->regs + DMA_CNT_REG); - writel(DMA_TLVL_MAX, rnandc->regs + DMA_TLVL_REG); -@@ -606,6 +609,9 @@ static int rnandc_write_page_hw_ecc(struct nand_chip *chip, const u8 *buf, - /* Configure DMA */ - dma_addr = dma_map_single(rnandc->dev, (void *)rnandc->buf, mtd->writesize, - DMA_TO_DEVICE); -+ if (dma_mapping_error(rnandc->dev, dma_addr)) -+ return -ENOMEM; -+ - writel(dma_addr, rnandc->regs + DMA_ADDR_LOW_REG); - writel(mtd->writesize, rnandc->regs + DMA_CNT_REG); - writel(DMA_TLVL_MAX, rnandc->regs + DMA_TLVL_REG); -diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c -index cd21bf8f254a75..ee61b2d8823203 100644 ---- a/drivers/mtd/nand/spi/core.c -+++ b/drivers/mtd/nand/spi/core.c -@@ -624,7 +624,10 @@ static int spinand_write_page(struct spinand_device *spinand, - SPINAND_WRITE_INITIAL_DELAY_US, - SPINAND_WRITE_POLL_DELAY_US, - &status); -- if (!ret && (status & STATUS_PROG_FAILED)) -+ if (ret) -+ return ret; -+ -+ if (status & STATUS_PROG_FAILED) - return -EIO; - - return nand_ecc_finish_io_req(nand, (struct nand_page_io_req *)req); -diff --git a/drivers/mtd/spi-nor/swp.c b/drivers/mtd/spi-nor/swp.c -index 5ab9d532486081..a186d1fde8694a 100644 ---- a/drivers/mtd/spi-nor/swp.c -+++ b/drivers/mtd/spi-nor/swp.c -@@ -50,7 +50,6 @@ static u64 spi_nor_get_min_prot_length_sr(struct spi_nor *nor) - static void spi_nor_get_locked_range_sr(struct spi_nor *nor, u8 sr, loff_t *ofs, - uint64_t *len) - { -- struct mtd_info *mtd = &nor->mtd; - u64 min_prot_len; - u8 mask = spi_nor_get_sr_bp_mask(nor); - u8 tb_mask = spi_nor_get_sr_tb_mask(nor); -@@ -71,13 +70,13 @@ static void spi_nor_get_locked_range_sr(struct spi_nor *nor, u8 sr, loff_t *ofs, - min_prot_len = spi_nor_get_min_prot_length_sr(nor); - *len = min_prot_len << (bp - 1); - -- if (*len > mtd->size) -- *len = mtd->size; -+ if (*len > nor->params->size) -+ *len = nor->params->size; - - if (nor->flags & SNOR_F_HAS_SR_TB && sr & tb_mask) - *ofs = 0; - else -- *ofs = mtd->size - *len; -+ *ofs = nor->params->size - *len; - } - - /* -@@ -153,7 +152,6 @@ static bool spi_nor_is_unlocked_sr(struct spi_nor *nor, loff_t ofs, - */ - static int spi_nor_sr_lock(struct spi_nor *nor, loff_t ofs, uint64_t len) - { -- struct mtd_info *mtd = &nor->mtd; - u64 min_prot_len; - int ret, status_old, status_new; - u8 mask = spi_nor_get_sr_bp_mask(nor); -@@ -178,7 +176,7 @@ static int spi_nor_sr_lock(struct spi_nor *nor, loff_t ofs, uint64_t len) - can_be_bottom = false; - - /* If anything above us is unlocked, we can't use 'top' protection */ -- if (!spi_nor_is_locked_sr(nor, ofs + len, mtd->size - (ofs + len), -+ if (!spi_nor_is_locked_sr(nor, ofs + len, nor->params->size - (ofs + len), - status_old)) - can_be_top = false; - -@@ -190,11 +188,11 @@ static int spi_nor_sr_lock(struct spi_nor *nor, loff_t ofs, uint64_t len) - - /* lock_len: length of region that should end up locked */ - if (use_top) -- lock_len = mtd->size - ofs; -+ lock_len = nor->params->size - ofs; - else - lock_len = ofs + len; - -- if (lock_len == mtd->size) { -+ if (lock_len == nor->params->size) { - val = mask; - } else { - min_prot_len = spi_nor_get_min_prot_length_sr(nor); -@@ -243,7 +241,6 @@ static int spi_nor_sr_lock(struct spi_nor *nor, loff_t ofs, uint64_t len) - */ - static int spi_nor_sr_unlock(struct spi_nor *nor, loff_t ofs, uint64_t len) - { -- struct mtd_info *mtd = &nor->mtd; - u64 min_prot_len; - int ret, status_old, status_new; - u8 mask = spi_nor_get_sr_bp_mask(nor); -@@ -268,7 +265,7 @@ static int spi_nor_sr_unlock(struct spi_nor *nor, loff_t ofs, uint64_t len) - can_be_top = false; - - /* If anything above us is locked, we can't use 'bottom' protection */ -- if (!spi_nor_is_unlocked_sr(nor, ofs + len, mtd->size - (ofs + len), -+ if (!spi_nor_is_unlocked_sr(nor, ofs + len, nor->params->size - (ofs + len), - status_old)) - can_be_bottom = false; - -@@ -280,7 +277,7 @@ static int spi_nor_sr_unlock(struct spi_nor *nor, loff_t ofs, uint64_t len) - - /* lock_len: length of region that should remain locked */ - if (use_top) -- lock_len = mtd->size - (ofs + len); -+ lock_len = nor->params->size - (ofs + len); - else - lock_len = ofs; - -diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c -index c99ffe6c683a38..d02a91cefec89b 100644 ---- a/drivers/net/bonding/bond_3ad.c -+++ b/drivers/net/bonding/bond_3ad.c -@@ -99,13 +99,16 @@ static int ad_marker_send(struct port *port, struct bond_marker *marker); - static void ad_mux_machine(struct port *port, bool *update_slave_arr); - static void ad_rx_machine(struct lacpdu *lacpdu, struct port *port); - static void ad_tx_machine(struct port *port); --static void ad_periodic_machine(struct port *port, struct bond_params *bond_params); -+static void ad_periodic_machine(struct port *port); - static void ad_port_selection_logic(struct port *port, bool *update_slave_arr); - static void ad_agg_selection_logic(struct aggregator *aggregator, - bool *update_slave_arr); - static void ad_clear_agg(struct aggregator *aggregator); - static void ad_initialize_agg(struct aggregator *aggregator); --static void ad_initialize_port(struct port *port, int lacp_fast); -+static void ad_initialize_port(struct port *port, const struct bond_params *bond_params); -+static void ad_enable_collecting(struct port *port); -+static void ad_disable_distributing(struct port *port, -+ bool *update_slave_arr); - static void ad_enable_collecting_distributing(struct port *port, - bool *update_slave_arr); - static void ad_disable_collecting_distributing(struct port *port, -@@ -171,9 +174,38 @@ static inline int __agg_has_partner(struct aggregator *agg) - return !is_zero_ether_addr(agg->partner_system.mac_addr_value); - } - -+/** -+ * __disable_distributing_port - disable the port's slave for distributing. -+ * Port will still be able to collect. -+ * @port: the port we're looking at -+ * -+ * This will disable only distributing on the port's slave. -+ */ -+static void __disable_distributing_port(struct port *port) -+{ -+ bond_set_slave_tx_disabled_flags(port->slave, BOND_SLAVE_NOTIFY_LATER); -+} -+ -+/** -+ * __enable_collecting_port - enable the port's slave for collecting, -+ * if it's up -+ * @port: the port we're looking at -+ * -+ * This will enable only collecting on the port's slave. -+ */ -+static void __enable_collecting_port(struct port *port) -+{ -+ struct slave *slave = port->slave; -+ -+ if (slave->link == BOND_LINK_UP && bond_slave_is_up(slave)) -+ bond_set_slave_rx_enabled_flags(slave, BOND_SLAVE_NOTIFY_LATER); -+} -+ - /** - * __disable_port - disable the port's slave - * @port: the port we're looking at -+ * -+ * This will disable both collecting and distributing on the port's slave. - */ - static inline void __disable_port(struct port *port) - { -@@ -183,6 +215,8 @@ static inline void __disable_port(struct port *port) - /** - * __enable_port - enable the port's slave, if it's up - * @port: the port we're looking at -+ * -+ * This will enable both collecting and distributing on the port's slave. - */ - static inline void __enable_port(struct port *port) - { -@@ -193,10 +227,27 @@ static inline void __enable_port(struct port *port) - } - - /** -- * __port_is_enabled - check if the port's slave is in active state -+ * __port_move_to_attached_state - check if port should transition back to attached -+ * state. - * @port: the port we're looking at - */ --static inline int __port_is_enabled(struct port *port) -+static bool __port_move_to_attached_state(struct port *port) -+{ -+ if (!(port->sm_vars & AD_PORT_SELECTED) || -+ (port->sm_vars & AD_PORT_STANDBY) || -+ !(port->partner_oper.port_state & LACP_STATE_SYNCHRONIZATION) || -+ !(port->actor_oper_port_state & LACP_STATE_SYNCHRONIZATION)) -+ port->sm_mux_state = AD_MUX_ATTACHED; -+ -+ return port->sm_mux_state == AD_MUX_ATTACHED; -+} -+ -+/** -+ * __port_is_collecting_distributing - check if the port's slave is in the -+ * combined collecting/distributing state -+ * @port: the port we're looking at -+ */ -+static int __port_is_collecting_distributing(struct port *port) - { - return bond_is_active_slave(port->slave); - } -@@ -942,6 +993,7 @@ static int ad_marker_send(struct port *port, struct bond_marker *marker) - */ - static void ad_mux_machine(struct port *port, bool *update_slave_arr) - { -+ struct bonding *bond = __get_bond_by_port(port); - mux_states_t last_state; - - /* keep current State Machine state to compare later if it was -@@ -999,9 +1051,13 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) - if ((port->sm_vars & AD_PORT_SELECTED) && - (port->partner_oper.port_state & LACP_STATE_SYNCHRONIZATION) && - !__check_agg_selection_timer(port)) { -- if (port->aggregator->is_active) -- port->sm_mux_state = -- AD_MUX_COLLECTING_DISTRIBUTING; -+ if (port->aggregator->is_active) { -+ int state = AD_MUX_COLLECTING_DISTRIBUTING; -+ -+ if (!bond->params.coupled_control) -+ state = AD_MUX_COLLECTING; -+ port->sm_mux_state = state; -+ } - } else if (!(port->sm_vars & AD_PORT_SELECTED) || - (port->sm_vars & AD_PORT_STANDBY)) { - /* if UNSELECTED or STANDBY */ -@@ -1019,11 +1075,45 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) - } - break; - case AD_MUX_COLLECTING_DISTRIBUTING: -+ if (!__port_move_to_attached_state(port)) { -+ /* if port state hasn't changed make -+ * sure that a collecting distributing -+ * port in an active aggregator is enabled -+ */ -+ if (port->aggregator->is_active && -+ !__port_is_collecting_distributing(port)) { -+ __enable_port(port); -+ *update_slave_arr = true; -+ } -+ } -+ break; -+ case AD_MUX_COLLECTING: -+ if (!__port_move_to_attached_state(port)) { -+ if ((port->sm_vars & AD_PORT_SELECTED) && -+ (port->partner_oper.port_state & LACP_STATE_SYNCHRONIZATION) && -+ (port->partner_oper.port_state & LACP_STATE_COLLECTING)) { -+ port->sm_mux_state = AD_MUX_DISTRIBUTING; -+ } else { -+ /* If port state hasn't changed, make sure that a collecting -+ * port is enabled for an active aggregator. -+ */ -+ struct slave *slave = port->slave; -+ -+ if (port->aggregator->is_active && -+ bond_is_slave_rx_disabled(slave)) { -+ ad_enable_collecting(port); -+ *update_slave_arr = true; -+ } -+ } -+ } -+ break; -+ case AD_MUX_DISTRIBUTING: - if (!(port->sm_vars & AD_PORT_SELECTED) || - (port->sm_vars & AD_PORT_STANDBY) || -+ !(port->partner_oper.port_state & LACP_STATE_COLLECTING) || - !(port->partner_oper.port_state & LACP_STATE_SYNCHRONIZATION) || - !(port->actor_oper_port_state & LACP_STATE_SYNCHRONIZATION)) { -- port->sm_mux_state = AD_MUX_ATTACHED; -+ port->sm_mux_state = AD_MUX_COLLECTING; - } else { - /* if port state hasn't changed make - * sure that a collecting distributing -@@ -1031,7 +1121,7 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) - */ - if (port->aggregator && - port->aggregator->is_active && -- !__port_is_enabled(port)) { -+ !__port_is_collecting_distributing(port)) { - __enable_port(port); - *update_slave_arr = true; - } -@@ -1082,6 +1172,20 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) - update_slave_arr); - port->ntt = true; - break; -+ case AD_MUX_COLLECTING: -+ port->actor_oper_port_state |= LACP_STATE_COLLECTING; -+ port->actor_oper_port_state &= ~LACP_STATE_DISTRIBUTING; -+ port->actor_oper_port_state |= LACP_STATE_SYNCHRONIZATION; -+ ad_enable_collecting(port); -+ ad_disable_distributing(port, update_slave_arr); -+ port->ntt = true; -+ break; -+ case AD_MUX_DISTRIBUTING: -+ port->actor_oper_port_state |= LACP_STATE_DISTRIBUTING; -+ port->actor_oper_port_state |= LACP_STATE_SYNCHRONIZATION; -+ ad_enable_collecting_distributing(port, -+ update_slave_arr); -+ break; - default: - break; - } -@@ -1196,10 +1300,16 @@ static void ad_rx_machine(struct lacpdu *lacpdu, struct port *port) - * case of EXPIRED even if LINK_DOWN didn't arrive for - * the port. - */ -- port->partner_oper.port_state &= ~LACP_STATE_SYNCHRONIZATION; - port->sm_vars &= ~AD_PORT_MATCHED; -+ /* Based on IEEE 8021AX-2014, Figure 6-18 - Receive -+ * machine state diagram, the statue should be -+ * Partner_Oper_Port_State.Synchronization = FALSE; -+ * Partner_Oper_Port_State.LACP_Timeout = Short Timeout; -+ * start current_while_timer(Short Timeout); -+ * Actor_Oper_Port_State.Expired = TRUE; -+ */ -+ port->partner_oper.port_state &= ~LACP_STATE_SYNCHRONIZATION; - port->partner_oper.port_state |= LACP_STATE_LACP_TIMEOUT; -- port->partner_oper.port_state |= LACP_STATE_LACP_ACTIVITY; - port->sm_rx_timer_counter = __ad_timer_to_ticks(AD_CURRENT_WHILE_TIMER, (u16)(AD_SHORT_TIMEOUT)); - port->actor_oper_port_state |= LACP_STATE_EXPIRED; - port->sm_vars |= AD_PORT_CHURNED; -@@ -1305,11 +1415,10 @@ static void ad_tx_machine(struct port *port) - /** - * ad_periodic_machine - handle a port's periodic state machine - * @port: the port we're looking at -- * @bond_params: bond parameters we will use - * - * Turn ntt flag on priodically to perform periodic transmission of lacpdu's. - */ --static void ad_periodic_machine(struct port *port, struct bond_params *bond_params) -+static void ad_periodic_machine(struct port *port) - { - periodic_states_t last_state; - -@@ -1318,8 +1427,7 @@ static void ad_periodic_machine(struct port *port, struct bond_params *bond_para - - /* check if port was reinitialized */ - if (((port->sm_vars & AD_PORT_BEGIN) || !(port->sm_vars & AD_PORT_LACP_ENABLED) || !port->is_enabled) || -- (!(port->actor_oper_port_state & LACP_STATE_LACP_ACTIVITY) && !(port->partner_oper.port_state & LACP_STATE_LACP_ACTIVITY)) || -- !bond_params->lacp_active) { -+ (!(port->actor_oper_port_state & LACP_STATE_LACP_ACTIVITY) && !(port->partner_oper.port_state & LACP_STATE_LACP_ACTIVITY))) { - port->sm_periodic_state = AD_NO_PERIODIC; - } - /* check if state machine should change state */ -@@ -1843,16 +1951,16 @@ static void ad_initialize_agg(struct aggregator *aggregator) - /** - * ad_initialize_port - initialize a given port's parameters - * @port: the port we're looking at -- * @lacp_fast: boolean. whether fast periodic should be used -+ * @bond_params: bond parameters we will use - */ --static void ad_initialize_port(struct port *port, int lacp_fast) -+static void ad_initialize_port(struct port *port, const struct bond_params *bond_params) - { - static const struct port_params tmpl = { - .system_priority = 0xffff, - .key = 1, - .port_number = 1, - .port_priority = 0xff, -- .port_state = 1, -+ .port_state = 0, - }; - static const struct lacpdu lacpdu = { - .subtype = 0x01, -@@ -1870,12 +1978,14 @@ static void ad_initialize_port(struct port *port, int lacp_fast) - port->actor_port_priority = 0xff; - port->actor_port_aggregator_identifier = 0; - port->ntt = false; -- port->actor_admin_port_state = LACP_STATE_AGGREGATION | -- LACP_STATE_LACP_ACTIVITY; -- port->actor_oper_port_state = LACP_STATE_AGGREGATION | -- LACP_STATE_LACP_ACTIVITY; -+ port->actor_admin_port_state = LACP_STATE_AGGREGATION; -+ port->actor_oper_port_state = LACP_STATE_AGGREGATION; -+ if (bond_params->lacp_active) { -+ port->actor_admin_port_state |= LACP_STATE_LACP_ACTIVITY; -+ port->actor_oper_port_state |= LACP_STATE_LACP_ACTIVITY; -+ } - -- if (lacp_fast) -+ if (bond_params->lacp_fast) - port->actor_oper_port_state |= LACP_STATE_LACP_TIMEOUT; - - memcpy(&port->partner_admin, &tmpl, sizeof(tmpl)); -@@ -1906,6 +2016,45 @@ static void ad_initialize_port(struct port *port, int lacp_fast) - } - } - -+/** -+ * ad_enable_collecting - enable a port's receive -+ * @port: the port we're looking at -+ * -+ * Enable @port if it's in an active aggregator -+ */ -+static void ad_enable_collecting(struct port *port) -+{ -+ if (port->aggregator->is_active) { -+ struct slave *slave = port->slave; -+ -+ slave_dbg(slave->bond->dev, slave->dev, -+ "Enabling collecting on port %d (LAG %d)\n", -+ port->actor_port_number, -+ port->aggregator->aggregator_identifier); -+ __enable_collecting_port(port); -+ } -+} -+ -+/** -+ * ad_disable_distributing - disable a port's transmit -+ * @port: the port we're looking at -+ * @update_slave_arr: Does slave array need update? -+ */ -+static void ad_disable_distributing(struct port *port, bool *update_slave_arr) -+{ -+ if (port->aggregator && -+ !MAC_ADDRESS_EQUAL(&port->aggregator->partner_system, -+ &(null_mac_addr))) { -+ slave_dbg(port->slave->bond->dev, port->slave->dev, -+ "Disabling distributing on port %d (LAG %d)\n", -+ port->actor_port_number, -+ port->aggregator->aggregator_identifier); -+ __disable_distributing_port(port); -+ /* Slave array needs an update */ -+ *update_slave_arr = true; -+ } -+} -+ - /** - * ad_enable_collecting_distributing - enable a port's transmit/receive - * @port: the port we're looking at -@@ -2052,7 +2201,7 @@ void bond_3ad_bind_slave(struct slave *slave) - /* port initialization */ - port = &(SLAVE_AD_INFO(slave)->port); - -- ad_initialize_port(port, bond->params.lacp_fast); -+ ad_initialize_port(port, &bond->params); - - port->slave = slave; - port->actor_port_number = SLAVE_AD_INFO(slave)->id; -@@ -2364,7 +2513,7 @@ void bond_3ad_state_machine_handler(struct work_struct *work) - } - - ad_rx_machine(NULL, port); -- ad_periodic_machine(port, &bond->params); -+ ad_periodic_machine(port); - ad_port_selection_logic(port, &update_slave_arr); - ad_mux_machine(port, &update_slave_arr); - ad_tx_machine(port); -@@ -2734,6 +2883,31 @@ void bond_3ad_update_lacp_rate(struct bonding *bond) - spin_unlock_bh(&bond->mode_lock); - } - -+/** -+ * bond_3ad_update_lacp_active - change the lacp active -+ * @bond: bonding struct -+ * -+ * Update actor_oper_port_state when lacp_active is modified. -+ */ -+void bond_3ad_update_lacp_active(struct bonding *bond) -+{ -+ struct port *port = NULL; -+ struct list_head *iter; -+ struct slave *slave; -+ int lacp_active; -+ -+ lacp_active = bond->params.lacp_active; -+ spin_lock_bh(&bond->mode_lock); -+ bond_for_each_slave(bond, slave, iter) { -+ port = &(SLAVE_AD_INFO(slave)->port); -+ if (lacp_active) -+ port->actor_oper_port_state |= LACP_STATE_LACP_ACTIVITY; -+ else -+ port->actor_oper_port_state &= ~LACP_STATE_LACP_ACTIVITY; -+ } -+ spin_unlock_bh(&bond->mode_lock); -+} -+ - size_t bond_3ad_stats_size(void) - { - return nla_total_size_64bit(sizeof(u64)) + /* BOND_3AD_STAT_LACPDU_RX */ -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 85ab6925716272..cd5691ed9f171e 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -6399,6 +6399,7 @@ static int __init bond_check_params(struct bond_params *params) - params->ad_actor_sys_prio = ad_actor_sys_prio; - eth_zero_addr(params->ad_actor_system); - params->ad_user_port_key = ad_user_port_key; -+ params->coupled_control = 1; - if (packets_per_slave > 0) { - params->reciprocal_packets_per_slave = - reciprocal_value(packets_per_slave); -diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c -index 27cbe148f0db5f..aebc814ad495d9 100644 ---- a/drivers/net/bonding/bond_netlink.c -+++ b/drivers/net/bonding/bond_netlink.c -@@ -122,6 +122,7 @@ static const struct nla_policy bond_policy[IFLA_BOND_MAX + 1] = { - [IFLA_BOND_PEER_NOTIF_DELAY] = NLA_POLICY_FULL_RANGE(NLA_U32, &delay_range), - [IFLA_BOND_MISSED_MAX] = { .type = NLA_U8 }, - [IFLA_BOND_NS_IP6_TARGET] = { .type = NLA_NESTED }, -+ [IFLA_BOND_COUPLED_CONTROL] = { .type = NLA_U8 }, - }; - - static const struct nla_policy bond_slave_policy[IFLA_BOND_SLAVE_MAX + 1] = { -@@ -549,6 +550,16 @@ static int bond_changelink(struct net_device *bond_dev, struct nlattr *tb[], - return err; - } - -+ if (data[IFLA_BOND_COUPLED_CONTROL]) { -+ int coupled_control = nla_get_u8(data[IFLA_BOND_COUPLED_CONTROL]); -+ -+ bond_opt_initval(&newval, coupled_control); -+ err = __bond_opt_set(bond, BOND_OPT_COUPLED_CONTROL, &newval, -+ data[IFLA_BOND_COUPLED_CONTROL], extack); -+ if (err) -+ return err; -+ } -+ - return 0; - } - -@@ -615,6 +626,7 @@ static size_t bond_get_size(const struct net_device *bond_dev) - /* IFLA_BOND_NS_IP6_TARGET */ - nla_total_size(sizeof(struct nlattr)) + - nla_total_size(sizeof(struct in6_addr)) * BOND_MAX_NS_TARGETS + -+ nla_total_size(sizeof(u8)) + /* IFLA_BOND_COUPLED_CONTROL */ - 0; - } - -@@ -774,6 +786,10 @@ static int bond_fill_info(struct sk_buff *skb, - bond->params.missed_max)) - goto nla_put_failure; - -+ if (nla_put_u8(skb, IFLA_BOND_COUPLED_CONTROL, -+ bond->params.coupled_control)) -+ goto nla_put_failure; -+ - if (BOND_MODE(bond) == BOND_MODE_8023AD) { - struct ad_info info; - -diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c -index 6d003c0ef6698f..8291803e4f00ab 100644 ---- a/drivers/net/bonding/bond_options.c -+++ b/drivers/net/bonding/bond_options.c -@@ -85,7 +85,8 @@ static int bond_option_ad_user_port_key_set(struct bonding *bond, - const struct bond_opt_value *newval); - static int bond_option_missed_max_set(struct bonding *bond, - const struct bond_opt_value *newval); -- -+static int bond_option_coupled_control_set(struct bonding *bond, -+ const struct bond_opt_value *newval); - - static const struct bond_opt_value bond_mode_tbl[] = { - { "balance-rr", BOND_MODE_ROUNDROBIN, BOND_VALFLAG_DEFAULT}, -@@ -233,6 +234,12 @@ static const struct bond_opt_value bond_missed_max_tbl[] = { - { NULL, -1, 0}, - }; - -+static const struct bond_opt_value bond_coupled_control_tbl[] = { -+ { "on", 1, BOND_VALFLAG_DEFAULT}, -+ { "off", 0, 0}, -+ { NULL, -1, 0}, -+}; -+ - static const struct bond_option bond_opts[BOND_OPT_LAST] = { - [BOND_OPT_MODE] = { - .id = BOND_OPT_MODE, -@@ -497,6 +504,15 @@ static const struct bond_option bond_opts[BOND_OPT_LAST] = { - .desc = "Delay between each peer notification on failover event, in milliseconds", - .values = bond_peer_notif_delay_tbl, - .set = bond_option_peer_notif_delay_set -+ }, -+ [BOND_OPT_COUPLED_CONTROL] = { -+ .id = BOND_OPT_COUPLED_CONTROL, -+ .name = "coupled_control", -+ .desc = "Opt into using coupled control MUX for LACP states", -+ .unsuppmodes = BOND_MODE_ALL_EX(BIT(BOND_MODE_8023AD)), -+ .flags = BOND_OPTFLAG_IFDOWN, -+ .values = bond_coupled_control_tbl, -+ .set = bond_option_coupled_control_set, - } - }; - -@@ -1618,6 +1634,7 @@ static int bond_option_lacp_active_set(struct bonding *bond, - netdev_dbg(bond->dev, "Setting LACP active to %s (%llu)\n", - newval->string, newval->value); - bond->params.lacp_active = newval->value; -+ bond_3ad_update_lacp_active(bond); - - return 0; - } -@@ -1811,3 +1828,13 @@ static int bond_option_ad_user_port_key_set(struct bonding *bond, - bond->params.ad_user_port_key = newval->value; - return 0; - } -+ -+static int bond_option_coupled_control_set(struct bonding *bond, -+ const struct bond_opt_value *newval) -+{ -+ netdev_info(bond->dev, "Setting coupled_control to %s (%llu)\n", -+ newval->string, newval->value); -+ -+ bond->params.coupled_control = newval->value; -+ return 0; -+} -diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c -index 004d2c988ff097..b00bac4686773d 100644 ---- a/drivers/net/dsa/b53/b53_common.c -+++ b/drivers/net/dsa/b53/b53_common.c -@@ -339,18 +339,23 @@ static void b53_set_forwarding(struct b53_device *dev, int enable) - - b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_MODE, mgmt); - -- /* Include IMP port in dumb forwarding mode -- */ -- b53_read8(dev, B53_CTRL_PAGE, B53_SWITCH_CTRL, &mgmt); -- mgmt |= B53_MII_DUMB_FWDG_EN; -- b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_CTRL, mgmt); -- -- /* Look at B53_UC_FWD_EN and B53_MC_FWD_EN to decide whether -- * frames should be flooded or not. -- */ -- b53_read8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, &mgmt); -- mgmt |= B53_UC_FWD_EN | B53_MC_FWD_EN | B53_IPMC_FWD_EN; -- b53_write8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, mgmt); -+ if (!is5325(dev)) { -+ /* Include IMP port in dumb forwarding mode */ -+ b53_read8(dev, B53_CTRL_PAGE, B53_SWITCH_CTRL, &mgmt); -+ mgmt |= B53_MII_DUMB_FWDG_EN; -+ b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_CTRL, mgmt); -+ -+ /* Look at B53_UC_FWD_EN and B53_MC_FWD_EN to decide whether -+ * frames should be flooded or not. -+ */ -+ b53_read8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, &mgmt); -+ mgmt |= B53_UC_FWD_EN | B53_MC_FWD_EN | B53_IPMC_FWD_EN; -+ b53_write8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, mgmt); -+ } else { -+ b53_read8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, &mgmt); -+ mgmt |= B53_IP_MCAST_25; -+ b53_write8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, mgmt); -+ } - } - - static void b53_enable_vlan(struct b53_device *dev, int port, bool enable, -@@ -507,6 +512,10 @@ void b53_imp_vlan_setup(struct dsa_switch *ds, int cpu_port) - unsigned int i; - u16 pvlan; - -+ /* BCM5325 CPU port is at 8 */ -+ if ((is5325(dev) || is5365(dev)) && cpu_port == B53_CPU_PORT_25) -+ cpu_port = B53_CPU_PORT; -+ - /* Enable the IMP port to be in the same VLAN as the other ports - * on a per-port basis such that we only have Port i and IMP in - * the same VLAN. -@@ -557,6 +566,9 @@ static void b53_port_set_learning(struct b53_device *dev, int port, - { - u16 reg; - -+ if (is5325(dev)) -+ return; -+ - b53_read16(dev, B53_CTRL_PAGE, B53_DIS_LEARNING, ®); - if (learning) - reg &= ~BIT(port); -@@ -1163,6 +1175,8 @@ static void b53_force_link(struct b53_device *dev, int port, int link) - if (port == dev->imp_port) { - off = B53_PORT_OVERRIDE_CTRL; - val = PORT_OVERRIDE_EN; -+ } else if (is5325(dev)) { -+ return; - } else { - off = B53_GMII_PORT_OVERRIDE_CTRL(port); - val = GMII_PO_EN; -@@ -1187,6 +1201,8 @@ static void b53_force_port_config(struct b53_device *dev, int port, - if (port == dev->imp_port) { - off = B53_PORT_OVERRIDE_CTRL; - val = PORT_OVERRIDE_EN; -+ } else if (is5325(dev)) { -+ return; - } else { - off = B53_GMII_PORT_OVERRIDE_CTRL(port); - val = GMII_PO_EN; -@@ -1217,10 +1233,19 @@ static void b53_force_port_config(struct b53_device *dev, int port, - return; - } - -- if (rx_pause) -- reg |= PORT_OVERRIDE_RX_FLOW; -- if (tx_pause) -- reg |= PORT_OVERRIDE_TX_FLOW; -+ if (rx_pause) { -+ if (is5325(dev)) -+ reg |= PORT_OVERRIDE_LP_FLOW_25; -+ else -+ reg |= PORT_OVERRIDE_RX_FLOW; -+ } -+ -+ if (tx_pause) { -+ if (is5325(dev)) -+ reg |= PORT_OVERRIDE_LP_FLOW_25; -+ else -+ reg |= PORT_OVERRIDE_TX_FLOW; -+ } - - b53_write8(dev, B53_CTRL_PAGE, off, reg); - } -@@ -2045,7 +2070,13 @@ int b53_br_flags_pre(struct dsa_switch *ds, int port, - struct switchdev_brport_flags flags, - struct netlink_ext_ack *extack) - { -- if (flags.mask & ~(BR_FLOOD | BR_MCAST_FLOOD | BR_LEARNING)) -+ struct b53_device *dev = ds->priv; -+ unsigned long mask = (BR_FLOOD | BR_MCAST_FLOOD); -+ -+ if (!is5325(dev)) -+ mask |= BR_LEARNING; -+ -+ if (flags.mask & ~mask) - return -EINVAL; - - return 0; -diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h -index bfbcb66bef6626..3179fe58de6b62 100644 ---- a/drivers/net/dsa/b53/b53_regs.h -+++ b/drivers/net/dsa/b53/b53_regs.h -@@ -92,6 +92,7 @@ - #define PORT_OVERRIDE_SPEED_10M (0 << PORT_OVERRIDE_SPEED_S) - #define PORT_OVERRIDE_SPEED_100M (1 << PORT_OVERRIDE_SPEED_S) - #define PORT_OVERRIDE_SPEED_1000M (2 << PORT_OVERRIDE_SPEED_S) -+#define PORT_OVERRIDE_LP_FLOW_25 BIT(3) /* BCM5325 only */ - #define PORT_OVERRIDE_RV_MII_25 BIT(4) /* BCM5325 only */ - #define PORT_OVERRIDE_RX_FLOW BIT(4) - #define PORT_OVERRIDE_TX_FLOW BIT(5) -@@ -103,6 +104,7 @@ - - /* IP Multicast control (8 bit) */ - #define B53_IP_MULTICAST_CTRL 0x21 -+#define B53_IP_MCAST_25 BIT(0) - #define B53_IPMC_FWD_EN BIT(1) - #define B53_UC_FWD_EN BIT(6) - #define B53_MC_FWD_EN BIT(7) -diff --git a/drivers/net/ethernet/agere/et131x.c b/drivers/net/ethernet/agere/et131x.c -index 3d9220f9c9fe74..294dbe2c3797af 100644 ---- a/drivers/net/ethernet/agere/et131x.c -+++ b/drivers/net/ethernet/agere/et131x.c -@@ -2459,6 +2459,10 @@ static int nic_send_packet(struct et131x_adapter *adapter, struct tcb *tcb) - skb->data, - skb_headlen(skb), - DMA_TO_DEVICE); -+ if (dma_mapping_error(&adapter->pdev->dev, -+ dma_addr)) -+ return -ENOMEM; -+ - desc[frag].addr_lo = lower_32_bits(dma_addr); - desc[frag].addr_hi = upper_32_bits(dma_addr); - frag++; -@@ -2468,6 +2472,10 @@ static int nic_send_packet(struct et131x_adapter *adapter, struct tcb *tcb) - skb->data, - skb_headlen(skb) / 2, - DMA_TO_DEVICE); -+ if (dma_mapping_error(&adapter->pdev->dev, -+ dma_addr)) -+ return -ENOMEM; -+ - desc[frag].addr_lo = lower_32_bits(dma_addr); - desc[frag].addr_hi = upper_32_bits(dma_addr); - frag++; -@@ -2478,6 +2486,10 @@ static int nic_send_packet(struct et131x_adapter *adapter, struct tcb *tcb) - skb_headlen(skb) / 2, - skb_headlen(skb) / 2, - DMA_TO_DEVICE); -+ if (dma_mapping_error(&adapter->pdev->dev, -+ dma_addr)) -+ goto unmap_first_out; -+ - desc[frag].addr_lo = lower_32_bits(dma_addr); - desc[frag].addr_hi = upper_32_bits(dma_addr); - frag++; -@@ -2489,6 +2501,9 @@ static int nic_send_packet(struct et131x_adapter *adapter, struct tcb *tcb) - 0, - desc[frag].len_vlan, - DMA_TO_DEVICE); -+ if (dma_mapping_error(&adapter->pdev->dev, dma_addr)) -+ goto unmap_out; -+ - desc[frag].addr_lo = lower_32_bits(dma_addr); - desc[frag].addr_hi = upper_32_bits(dma_addr); - frag++; -@@ -2578,6 +2593,27 @@ static int nic_send_packet(struct et131x_adapter *adapter, struct tcb *tcb) - &adapter->regs->global.watchdog_timer); - } - return 0; -+ -+unmap_out: -+ // Unmap the body of the packet with map_page -+ while (--i) { -+ frag--; -+ dma_addr = desc[frag].addr_lo; -+ dma_addr |= (u64)desc[frag].addr_hi << 32; -+ dma_unmap_page(&adapter->pdev->dev, dma_addr, -+ desc[frag].len_vlan, DMA_TO_DEVICE); -+ } -+ -+unmap_first_out: -+ // Unmap the header with map_single -+ while (frag--) { -+ dma_addr = desc[frag].addr_lo; -+ dma_addr |= (u64)desc[frag].addr_hi << 32; -+ dma_unmap_single(&adapter->pdev->dev, dma_addr, -+ desc[frag].len_vlan, DMA_TO_DEVICE); -+ } -+ -+ return -ENOMEM; - } - - static int send_packet(struct sk_buff *skb, struct et131x_adapter *adapter) -diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h -index dbd28466013580..7f616abd3db2c4 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h -+++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h -@@ -113,6 +113,8 @@ struct aq_stats_s { - #define AQ_HW_POWER_STATE_D0 0U - #define AQ_HW_POWER_STATE_D3 3U - -+#define AQ_FW_WAKE_ON_LINK_RTPM BIT(10) -+ - #define AQ_HW_FLAG_STARTED 0x00000004U - #define AQ_HW_FLAG_STOPPING 0x00000008U - #define AQ_HW_FLAG_RESETTING 0x00000010U -diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2_utils_fw.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2_utils_fw.c -index 52e2070a4a2f0c..7370e3f76b6208 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2_utils_fw.c -+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2_utils_fw.c -@@ -462,6 +462,44 @@ static int aq_a2_fw_get_mac_temp(struct aq_hw_s *self, int *temp) - return aq_a2_fw_get_phy_temp(self, temp); - } - -+static int aq_a2_fw_set_wol_params(struct aq_hw_s *self, const u8 *mac, u32 wol) -+{ -+ struct mac_address_aligned_s mac_address; -+ struct link_control_s link_control; -+ struct wake_on_lan_s wake_on_lan; -+ -+ memcpy(mac_address.aligned.mac_address, mac, ETH_ALEN); -+ hw_atl2_shared_buffer_write(self, mac_address, mac_address); -+ -+ memset(&wake_on_lan, 0, sizeof(wake_on_lan)); -+ -+ if (wol & WAKE_MAGIC) -+ wake_on_lan.wake_on_magic_packet = 1U; -+ -+ if (wol & (WAKE_PHY | AQ_FW_WAKE_ON_LINK_RTPM)) -+ wake_on_lan.wake_on_link_up = 1U; -+ -+ hw_atl2_shared_buffer_write(self, sleep_proxy, wake_on_lan); -+ -+ hw_atl2_shared_buffer_get(self, link_control, link_control); -+ link_control.mode = AQ_HOST_MODE_SLEEP_PROXY; -+ hw_atl2_shared_buffer_write(self, link_control, link_control); -+ -+ return hw_atl2_shared_buffer_finish_ack(self); -+} -+ -+static int aq_a2_fw_set_power(struct aq_hw_s *self, unsigned int power_state, -+ const u8 *mac) -+{ -+ u32 wol = self->aq_nic_cfg->wol; -+ int err = 0; -+ -+ if (wol) -+ err = aq_a2_fw_set_wol_params(self, mac, wol); -+ -+ return err; -+} -+ - static int aq_a2_fw_set_eee_rate(struct aq_hw_s *self, u32 speed) - { - struct link_options_s link_options; -@@ -605,6 +643,7 @@ const struct aq_fw_ops aq_a2_fw_ops = { - .set_state = aq_a2_fw_set_state, - .update_link_status = aq_a2_fw_update_link_status, - .update_stats = aq_a2_fw_update_stats, -+ .set_power = aq_a2_fw_set_power, - .get_mac_temp = aq_a2_fw_get_mac_temp, - .get_phy_temp = aq_a2_fw_get_phy_temp, - .set_eee_rate = aq_a2_fw_set_eee_rate, -diff --git a/drivers/net/ethernet/atheros/ag71xx.c b/drivers/net/ethernet/atheros/ag71xx.c -index 009e0b3066fa3f..baf12ae0b8c4cb 100644 ---- a/drivers/net/ethernet/atheros/ag71xx.c -+++ b/drivers/net/ethernet/atheros/ag71xx.c -@@ -1234,6 +1234,11 @@ static bool ag71xx_fill_rx_buf(struct ag71xx *ag, struct ag71xx_buf *buf, - buf->rx.rx_buf = data; - buf->rx.dma_addr = dma_map_single(&ag->pdev->dev, data, ag->rx_buf_size, - DMA_FROM_DEVICE); -+ if (dma_mapping_error(&ag->pdev->dev, buf->rx.dma_addr)) { -+ skb_free_frag(data); -+ buf->rx.rx_buf = NULL; -+ return false; -+ } - desc->data = (u32)buf->rx.dma_addr + offset; - return true; - } -@@ -1532,6 +1537,10 @@ static netdev_tx_t ag71xx_hard_start_xmit(struct sk_buff *skb, - - dma_addr = dma_map_single(&ag->pdev->dev, skb->data, skb->len, - DMA_TO_DEVICE); -+ if (dma_mapping_error(&ag->pdev->dev, dma_addr)) { -+ netif_dbg(ag, tx_err, ndev, "DMA mapping error\n"); -+ goto err_drop; -+ } - - i = ring->curr & ring_mask; - desc = ag71xx_ring_desc(ring, i); -diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c -index a317feb8decb64..087d4c2b3efd1a 100644 ---- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c -+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c -@@ -1427,9 +1427,9 @@ static acpi_status bgx_acpi_match_id(acpi_handle handle, u32 lvl, - { - struct acpi_buffer string = { ACPI_ALLOCATE_BUFFER, NULL }; - struct bgx *bgx = context; -- char bgx_sel[5]; -+ char bgx_sel[7]; - -- snprintf(bgx_sel, 5, "BGX%d", bgx->bgx_id); -+ snprintf(bgx_sel, sizeof(bgx_sel), "BGX%d", bgx->bgx_id); - if (ACPI_FAILURE(acpi_get_name(handle, ACPI_SINGLE_NAME, &string))) { - pr_warn("Invalid link device\n"); - return AE_OK; -diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c -index 6bc0fde95f9dcf..0fda17bc8e2303 100644 ---- a/drivers/net/ethernet/emulex/benet/be_main.c -+++ b/drivers/net/ethernet/emulex/benet/be_main.c -@@ -1465,10 +1465,10 @@ static void be_tx_timeout(struct net_device *netdev, unsigned int txqueue) - ntohs(tcphdr->source)); - dev_info(dev, "TCP dest port %d\n", - ntohs(tcphdr->dest)); -- dev_info(dev, "TCP sequence num %d\n", -- ntohs(tcphdr->seq)); -- dev_info(dev, "TCP ack_seq %d\n", -- ntohs(tcphdr->ack_seq)); -+ dev_info(dev, "TCP sequence num %u\n", -+ ntohl(tcphdr->seq)); -+ dev_info(dev, "TCP ack_seq %u\n", -+ ntohl(tcphdr->ack_seq)); - } else if (ip_hdr(skb)->protocol == - IPPROTO_UDP) { - udphdr = udp_hdr(skb); -diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c -index e7bf70ac9a4ca5..6b7e1bb5c62d90 100644 ---- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c -+++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c -@@ -28,7 +28,6 @@ - #include - #include - #include --#include - #include - #include - #include -@@ -3141,7 +3140,6 @@ static const struct net_device_ops dpaa_ops = { - .ndo_stop = dpaa_eth_stop, - .ndo_tx_timeout = dpaa_tx_timeout, - .ndo_get_stats64 = dpaa_get_stats64, -- .ndo_change_carrier = fixed_phy_change_carrier, - .ndo_set_mac_address = dpaa_set_mac_address, - .ndo_validate_addr = eth_validate_addr, - .ndo_set_rx_mode = dpaa_set_rx_mode, -diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c b/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c -index 3f8cd4a7d84576..20d73a4ed22cd5 100644 ---- a/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c -+++ b/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c -@@ -415,8 +415,10 @@ static int dpaa_get_ts_info(struct net_device *net_dev, - of_node_put(ptp_node); - } - -- if (ptp_dev) -+ if (ptp_dev) { - ptp = platform_get_drvdata(ptp_dev); -+ put_device(&ptp_dev->dev); -+ } - - if (ptp) - info->phc_index = ptp->phc_index; -diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c -index a856047f1dfd6b..0ad3ea380e9b18 100644 ---- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c -+++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c -@@ -1179,19 +1179,29 @@ static int enetc_pf_register_with_ierb(struct pci_dev *pdev) - { - struct platform_device *ierb_pdev; - struct device_node *ierb_node; -+ int ret; - - ierb_node = of_find_compatible_node(NULL, NULL, - "fsl,ls1028a-enetc-ierb"); -- if (!ierb_node || !of_device_is_available(ierb_node)) -+ if (!ierb_node) - return -ENODEV; - -+ if (!of_device_is_available(ierb_node)) { -+ of_node_put(ierb_node); -+ return -ENODEV; -+ } -+ - ierb_pdev = of_find_device_by_node(ierb_node); - of_node_put(ierb_node); - - if (!ierb_pdev) - return -EPROBE_DEFER; - -- return enetc_ierb_register_pf(ierb_pdev, pdev); -+ ret = enetc_ierb_register_pf(ierb_pdev, pdev); -+ -+ put_device(&ierb_pdev->dev); -+ -+ return ret; - } - - static struct enetc_si *enetc_psi_create(struct pci_dev *pdev) -diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c -index 291c88a76a27f4..2a8b5429df5957 100644 ---- a/drivers/net/ethernet/freescale/fec_main.c -+++ b/drivers/net/ethernet/freescale/fec_main.c -@@ -3069,27 +3069,25 @@ static int fec_enet_us_to_itr_clock(struct net_device *ndev, int us) - static void fec_enet_itr_coal_set(struct net_device *ndev) - { - struct fec_enet_private *fep = netdev_priv(ndev); -- int rx_itr, tx_itr; -+ u32 rx_itr = 0, tx_itr = 0; -+ int rx_ictt, tx_ictt; - -- /* Must be greater than zero to avoid unpredictable behavior */ -- if (!fep->rx_time_itr || !fep->rx_pkts_itr || -- !fep->tx_time_itr || !fep->tx_pkts_itr) -- return; -- -- /* Select enet system clock as Interrupt Coalescing -- * timer Clock Source -- */ -- rx_itr = FEC_ITR_CLK_SEL; -- tx_itr = FEC_ITR_CLK_SEL; -+ rx_ictt = fec_enet_us_to_itr_clock(ndev, fep->rx_time_itr); -+ tx_ictt = fec_enet_us_to_itr_clock(ndev, fep->tx_time_itr); - -- /* set ICFT and ICTT */ -- rx_itr |= FEC_ITR_ICFT(fep->rx_pkts_itr); -- rx_itr |= FEC_ITR_ICTT(fec_enet_us_to_itr_clock(ndev, fep->rx_time_itr)); -- tx_itr |= FEC_ITR_ICFT(fep->tx_pkts_itr); -- tx_itr |= FEC_ITR_ICTT(fec_enet_us_to_itr_clock(ndev, fep->tx_time_itr)); -+ if (rx_ictt > 0 && fep->rx_pkts_itr > 1) { -+ /* Enable with enet system clock as Interrupt Coalescing timer Clock Source */ -+ rx_itr = FEC_ITR_EN | FEC_ITR_CLK_SEL; -+ rx_itr |= FEC_ITR_ICFT(fep->rx_pkts_itr); -+ rx_itr |= FEC_ITR_ICTT(rx_ictt); -+ } - -- rx_itr |= FEC_ITR_EN; -- tx_itr |= FEC_ITR_EN; -+ if (tx_ictt > 0 && fep->tx_pkts_itr > 1) { -+ /* Enable with enet system clock as Interrupt Coalescing timer Clock Source */ -+ tx_itr = FEC_ITR_EN | FEC_ITR_CLK_SEL; -+ tx_itr |= FEC_ITR_ICFT(fep->tx_pkts_itr); -+ tx_itr |= FEC_ITR_ICTT(tx_ictt); -+ } - - writel(tx_itr, fep->hwp + FEC_TXIC0); - writel(rx_itr, fep->hwp + FEC_RXIC0); -diff --git a/drivers/net/ethernet/freescale/gianfar_ethtool.c b/drivers/net/ethernet/freescale/gianfar_ethtool.c -index 7a15b9245698bb..30c7bc019d2feb 100644 ---- a/drivers/net/ethernet/freescale/gianfar_ethtool.c -+++ b/drivers/net/ethernet/freescale/gianfar_ethtool.c -@@ -1468,8 +1468,10 @@ static int gfar_get_ts_info(struct net_device *dev, - if (ptp_node) { - ptp_dev = of_find_device_by_node(ptp_node); - of_node_put(ptp_node); -- if (ptp_dev) -+ if (ptp_dev) { - ptp = platform_get_drvdata(ptp_dev); -+ put_device(&ptp_dev->dev); -+ } - } - - if (ptp) -diff --git a/drivers/net/ethernet/google/gve/gve_adminq.c b/drivers/net/ethernet/google/gve/gve_adminq.c -index 79db7a6d42bc2f..9c50febb427179 100644 ---- a/drivers/net/ethernet/google/gve/gve_adminq.c -+++ b/drivers/net/ethernet/google/gve/gve_adminq.c -@@ -431,6 +431,7 @@ static int gve_adminq_issue_cmd(struct gve_priv *priv, - break; - default: - dev_err(&priv->pdev->dev, "unknown AQ command opcode %d\n", opcode); -+ return -EINVAL; - } - - return 0; -diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c -index ec189f0703f99e..241a541b8edd2f 100644 ---- a/drivers/net/ethernet/google/gve/gve_main.c -+++ b/drivers/net/ethernet/google/gve/gve_main.c -@@ -2373,6 +2373,8 @@ static void gve_shutdown(struct pci_dev *pdev) - struct gve_priv *priv = netdev_priv(netdev); - bool was_up = netif_carrier_ok(priv->dev); - -+ netif_device_detach(netdev); -+ - rtnl_lock(); - if (was_up && gve_close(priv->dev)) { - /* If the dev was up, attempt to close, if close fails, reset */ -diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c -index 11543db4c47f0e..3e1408e1c1fcfb 100644 ---- a/drivers/net/ethernet/intel/igc/igc_main.c -+++ b/drivers/net/ethernet/intel/igc/igc_main.c -@@ -6772,6 +6772,13 @@ static int igc_probe(struct pci_dev *pdev, - adapter->port_num = hw->bus.func; - adapter->msg_enable = netif_msg_init(debug, DEFAULT_MSG_ENABLE); - -+ /* PCI config space info */ -+ hw->vendor_id = pdev->vendor; -+ hw->device_id = pdev->device; -+ hw->revision_id = pdev->revision; -+ hw->subsystem_vendor_id = pdev->subsystem_vendor; -+ hw->subsystem_device_id = pdev->subsystem_device; -+ - /* Disable ASPM L1.2 on I226 devices to avoid packet loss */ - if (igc_is_device_id_i226(hw)) - pci_disable_link_state(pdev, PCIE_LINK_STATE_L1_2); -@@ -6797,13 +6804,6 @@ static int igc_probe(struct pci_dev *pdev, - netdev->mem_start = pci_resource_start(pdev, 0); - netdev->mem_end = pci_resource_end(pdev, 0); - -- /* PCI config space info */ -- hw->vendor_id = pdev->vendor; -- hw->device_id = pdev->device; -- hw->revision_id = pdev->revision; -- hw->subsystem_vendor_id = pdev->subsystem_vendor; -- hw->subsystem_device_id = pdev->subsystem_device; -- - /* Copy the default MAC and PHY function pointers */ - memcpy(&hw->mac.ops, ei->mac_ops, sizeof(hw->mac.ops)); - memcpy(&hw->phy.ops, ei->phy_ops, sizeof(hw->phy.ops)); -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c -index 1703c640a434db..7ef82c30e85712 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c -@@ -403,7 +403,7 @@ static bool ixgbe_xmit_zc(struct ixgbe_ring *xdp_ring, unsigned int budget) - dma_addr_t dma; - u32 cmd_type; - -- while (budget-- > 0) { -+ while (likely(budget)) { - if (unlikely(!ixgbe_desc_unused(xdp_ring))) { - work_done = false; - break; -@@ -438,6 +438,8 @@ static bool ixgbe_xmit_zc(struct ixgbe_ring *xdp_ring, unsigned int budget) - xdp_ring->next_to_use++; - if (xdp_ring->next_to_use == xdp_ring->count) - xdp_ring->next_to_use = 0; -+ -+ budget--; - } - - if (tx_desc) { -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c -index 237f82082ebe5d..0f4e462d39c2ea 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c -@@ -580,8 +580,8 @@ static void npc_set_features(struct rvu *rvu, int blkaddr, u8 intf) - if (!npc_check_field(rvu, blkaddr, NPC_LB, intf)) - *features &= ~BIT_ULL(NPC_OUTER_VID); - -- /* Set SPI flag only if AH/ESP and IPSEC_SPI are in the key */ -- if (npc_check_field(rvu, blkaddr, NPC_IPSEC_SPI, intf) && -+ /* Allow extracting SPI field from AH and ESP headers at same offset */ -+ if (npc_is_field_present(rvu, NPC_IPSEC_SPI, intf) && - (*features & (BIT_ULL(NPC_IPPROTO_ESP) | BIT_ULL(NPC_IPPROTO_AH)))) - *features |= BIT_ULL(NPC_IPSEC_SPI); - -diff --git a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c -index 889fd26843e608..11e16c9e4e9221 100644 ---- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c -+++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c -@@ -101,7 +101,9 @@ mtk_flow_get_wdma_info(struct net_device *dev, const u8 *addr, struct mtk_wdma_i - if (!IS_ENABLED(CONFIG_NET_MEDIATEK_SOC_WED)) - return -1; - -+ rcu_read_lock(); - err = dev_fill_forward_path(dev, addr, &stack); -+ rcu_read_unlock(); - if (err) - return err; - -diff --git a/drivers/net/ethernet/mediatek/mtk_wed.c b/drivers/net/ethernet/mediatek/mtk_wed.c -index 85a9ad2b86bfff..525e2d365cd95c 100644 ---- a/drivers/net/ethernet/mediatek/mtk_wed.c -+++ b/drivers/net/ethernet/mediatek/mtk_wed.c -@@ -1886,7 +1886,6 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth, - if (!pdev) - goto err_of_node_put; - -- get_device(&pdev->dev); - irq = platform_get_irq(pdev, 0); - if (irq < 0) - goto err_put_device; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c -index 5ae787656a7ca0..3efa8bf1d14ef4 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c -@@ -272,8 +272,8 @@ static int port_update_shared_buffer(struct mlx5_core_dev *mdev, - /* Total shared buffer size is split in a ratio of 3:1 between - * lossy and lossless pools respectively. - */ -- lossy_epool_size = (shared_buffer_size / 4) * 3; - lossless_ipool_size = shared_buffer_size / 4; -+ lossy_epool_size = shared_buffer_size - lossless_ipool_size; - - mlx5e_port_set_sbpr(mdev, 0, MLX5_EGRESS_DIR, MLX5_LOSSY_POOL, 0, - lossy_epool_size); -@@ -288,14 +288,12 @@ static int port_set_buffer(struct mlx5e_priv *priv, - u16 port_buff_cell_sz = priv->dcbx.port_buff_cell_sz; - struct mlx5_core_dev *mdev = priv->mdev; - int sz = MLX5_ST_SZ_BYTES(pbmc_reg); -- u32 new_headroom_size = 0; -- u32 current_headroom_size; -+ u32 current_headroom_cells = 0; -+ u32 new_headroom_cells = 0; - void *in; - int err; - int i; - -- current_headroom_size = port_buffer->headroom_size; -- - in = kzalloc(sz, GFP_KERNEL); - if (!in) - return -ENOMEM; -@@ -306,12 +304,14 @@ static int port_set_buffer(struct mlx5e_priv *priv, - - for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++) { - void *buffer = MLX5_ADDR_OF(pbmc_reg, in, buffer[i]); -+ current_headroom_cells += MLX5_GET(bufferx_reg, buffer, size); -+ - u64 size = port_buffer->buffer[i].size; - u64 xoff = port_buffer->buffer[i].xoff; - u64 xon = port_buffer->buffer[i].xon; - -- new_headroom_size += size; - do_div(size, port_buff_cell_sz); -+ new_headroom_cells += size; - do_div(xoff, port_buff_cell_sz); - do_div(xon, port_buff_cell_sz); - MLX5_SET(bufferx_reg, buffer, size, size); -@@ -320,10 +320,8 @@ static int port_set_buffer(struct mlx5e_priv *priv, - MLX5_SET(bufferx_reg, buffer, xon_threshold, xon); - } - -- new_headroom_size /= port_buff_cell_sz; -- current_headroom_size /= port_buff_cell_sz; -- err = port_update_shared_buffer(priv->mdev, current_headroom_size, -- new_headroom_size); -+ err = port_update_shared_buffer(priv->mdev, current_headroom_cells, -+ new_headroom_cells); - if (err) - goto out; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c -index d9acc37afe1c86..74729bf168b136 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c -@@ -362,7 +362,7 @@ void mlx5e_reactivate_qos_sq(struct mlx5e_priv *priv, u16 qid, struct netdev_que - void mlx5e_reset_qdisc(struct net_device *dev, u16 qid) - { - struct netdev_queue *dev_queue = netdev_get_tx_queue(dev, qid); -- struct Qdisc *qdisc = dev_queue->qdisc_sleeping; -+ struct Qdisc *qdisc = rtnl_dereference(dev_queue->qdisc_sleeping); - - if (!qdisc) - return; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c -index d8e739cbcbced1..91319b5acd3de5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c -@@ -47,10 +47,12 @@ static void mlx5_esw_offloads_pf_vf_devlink_port_attrs_set(struct mlx5_eswitch * - devlink_port_attrs_pci_vf_set(dl_port, controller_num, pfnum, - vport_num - 1, external); - } else if (mlx5_core_is_ec_vf_vport(esw->dev, vport_num)) { -+ u16 base_vport = mlx5_core_ec_vf_vport_base(dev); -+ - memcpy(dl_port->attrs.switch_id.id, ppid.id, ppid.id_len); - dl_port->attrs.switch_id.id_len = ppid.id_len; - devlink_port_attrs_pci_vf_set(dl_port, 0, pfnum, -- vport_num - 1, false); -+ vport_num - base_vport, false); - } - } - -diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c -index 9dbd5edff0b023..51f49510826a3e 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c -@@ -2528,6 +2528,8 @@ static const struct mlxsw_listener mlxsw_sp_listener[] = { - ROUTER_EXP, false), - MLXSW_SP_RXL_NO_MARK(DISCARD_ING_ROUTER_DIP_LINK_LOCAL, FORWARD, - ROUTER_EXP, false), -+ MLXSW_SP_RXL_NO_MARK(DISCARD_ING_ROUTER_SIP_LINK_LOCAL, FORWARD, -+ ROUTER_EXP, false), - /* Multicast Router Traps */ - MLXSW_SP_RXL_MARK(ACL1, TRAP_TO_CPU, MULTICAST, false), - MLXSW_SP_RXL_L3_MARK(ACL2, TRAP_TO_CPU, MULTICAST, false), -diff --git a/drivers/net/ethernet/mellanox/mlxsw/trap.h b/drivers/net/ethernet/mellanox/mlxsw/trap.h -index 83477c8e6971b8..5bfc1499347a93 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/trap.h -+++ b/drivers/net/ethernet/mellanox/mlxsw/trap.h -@@ -95,6 +95,7 @@ enum { - MLXSW_TRAP_ID_DISCARD_ING_ROUTER_IPV4_SIP_BC = 0x16A, - MLXSW_TRAP_ID_DISCARD_ING_ROUTER_IPV4_DIP_LOCAL_NET = 0x16B, - MLXSW_TRAP_ID_DISCARD_ING_ROUTER_DIP_LINK_LOCAL = 0x16C, -+ MLXSW_TRAP_ID_DISCARD_ING_ROUTER_SIP_LINK_LOCAL = 0x16D, - MLXSW_TRAP_ID_DISCARD_ROUTER_IRIF_EN = 0x178, - MLXSW_TRAP_ID_DISCARD_ROUTER_ERIF_EN = 0x179, - MLXSW_TRAP_ID_DISCARD_ROUTER_LPM4 = 0x17B, -diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c -index bc7c5cd3859695..1ac7a40fcc43e3 100644 ---- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c -+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c -@@ -3394,10 +3394,6 @@ void ionic_lif_free(struct ionic_lif *lif) - lif->info = NULL; - lif->info_pa = 0; - -- /* unmap doorbell page */ -- ionic_bus_unmap_dbpage(lif->ionic, lif->kern_dbpage); -- lif->kern_dbpage = NULL; -- - mutex_destroy(&lif->config_lock); - mutex_destroy(&lif->queue_lock); - -@@ -3423,6 +3419,9 @@ void ionic_lif_deinit(struct ionic_lif *lif) - ionic_lif_qcq_deinit(lif, lif->notifyqcq); - ionic_lif_qcq_deinit(lif, lif->adminqcq); - -+ ionic_bus_unmap_dbpage(lif->ionic, lif->kern_dbpage); -+ lif->kern_dbpage = NULL; -+ - ionic_lif_reset(lif); - } - -diff --git a/drivers/net/ethernet/ti/icssg/icss_iep.c b/drivers/net/ethernet/ti/icssg/icss_iep.c -index f3315c65151561..e7306ed529226a 100644 ---- a/drivers/net/ethernet/ti/icssg/icss_iep.c -+++ b/drivers/net/ethernet/ti/icssg/icss_iep.c -@@ -638,7 +638,8 @@ static int icss_iep_pps_enable(struct icss_iep *iep, int on) - - static int icss_iep_extts_enable(struct icss_iep *iep, u32 index, int on) - { -- u32 val, cap, ret = 0; -+ u32 val, cap; -+ int ret = 0; - - mutex_lock(&iep->ptp_clk_mutex); - -@@ -702,10 +703,16 @@ struct icss_iep *icss_iep_get_idx(struct device_node *np, int idx) - struct platform_device *pdev; - struct device_node *iep_np; - struct icss_iep *iep; -+ int ret; - - iep_np = of_parse_phandle(np, "ti,iep", idx); -- if (!iep_np || !of_device_is_available(iep_np)) -+ if (!iep_np) -+ return ERR_PTR(-ENODEV); -+ -+ if (!of_device_is_available(iep_np)) { -+ of_node_put(iep_np); - return ERR_PTR(-ENODEV); -+ } - - pdev = of_find_device_by_node(iep_np); - of_node_put(iep_np); -@@ -715,21 +722,28 @@ struct icss_iep *icss_iep_get_idx(struct device_node *np, int idx) - return ERR_PTR(-EPROBE_DEFER); - - iep = platform_get_drvdata(pdev); -- if (!iep) -- return ERR_PTR(-EPROBE_DEFER); -+ if (!iep) { -+ ret = -EPROBE_DEFER; -+ goto err_put_pdev; -+ } - - device_lock(iep->dev); - if (iep->client_np) { - device_unlock(iep->dev); - dev_err(iep->dev, "IEP is already acquired by %s", - iep->client_np->name); -- return ERR_PTR(-EBUSY); -+ ret = -EBUSY; -+ goto err_put_pdev; - } - iep->client_np = np; - device_unlock(iep->dev); -- get_device(iep->dev); - - return iep; -+ -+err_put_pdev: -+ put_device(&pdev->dev); -+ -+ return ERR_PTR(ret); - } - EXPORT_SYMBOL_GPL(icss_iep_get_idx); - -diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h -index 4c12067b07f05e..f07bde6695c7b9 100644 ---- a/drivers/net/hyperv/hyperv_net.h -+++ b/drivers/net/hyperv/hyperv_net.h -@@ -1061,6 +1061,7 @@ struct net_device_context { - struct net_device __rcu *vf_netdev; - struct netvsc_vf_pcpu_stats __percpu *vf_stats; - struct delayed_work vf_takeover; -+ struct delayed_work vfns_work; - - /* 1: allocated, serial number is valid. 0: not allocated */ - u32 vf_alloc; -@@ -1075,6 +1076,8 @@ struct net_device_context { - struct netvsc_device_info *saved_netvsc_dev_info; - }; - -+void netvsc_vfns_work(struct work_struct *w); -+ - /* Azure hosts don't support non-TCP port numbers in hashing for fragmented - * packets. We can use ethtool to change UDP hash level when necessary. - */ -diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c -index f33f9167ba6b6e..aa114240e340d9 100644 ---- a/drivers/net/hyperv/netvsc_drv.c -+++ b/drivers/net/hyperv/netvsc_drv.c -@@ -2513,6 +2513,7 @@ static int netvsc_probe(struct hv_device *dev, - spin_lock_init(&net_device_ctx->lock); - INIT_LIST_HEAD(&net_device_ctx->reconfig_events); - INIT_DELAYED_WORK(&net_device_ctx->vf_takeover, netvsc_vf_setup); -+ INIT_DELAYED_WORK(&net_device_ctx->vfns_work, netvsc_vfns_work); - - net_device_ctx->vf_stats - = netdev_alloc_pcpu_stats(struct netvsc_vf_pcpu_stats); -@@ -2655,6 +2656,8 @@ static void netvsc_remove(struct hv_device *dev) - cancel_delayed_work_sync(&ndev_ctx->dwork); - - rtnl_lock(); -+ cancel_delayed_work_sync(&ndev_ctx->vfns_work); -+ - nvdev = rtnl_dereference(ndev_ctx->nvdev); - if (nvdev) { - cancel_work_sync(&nvdev->subchan_work); -@@ -2696,6 +2699,7 @@ static int netvsc_suspend(struct hv_device *dev) - cancel_delayed_work_sync(&ndev_ctx->dwork); - - rtnl_lock(); -+ cancel_delayed_work_sync(&ndev_ctx->vfns_work); - - nvdev = rtnl_dereference(ndev_ctx->nvdev); - if (nvdev == NULL) { -@@ -2789,6 +2793,27 @@ static void netvsc_event_set_vf_ns(struct net_device *ndev) - } - } - -+void netvsc_vfns_work(struct work_struct *w) -+{ -+ struct net_device_context *ndev_ctx = -+ container_of(w, struct net_device_context, vfns_work.work); -+ struct net_device *ndev; -+ -+ if (!rtnl_trylock()) { -+ schedule_delayed_work(&ndev_ctx->vfns_work, 1); -+ return; -+ } -+ -+ ndev = hv_get_drvdata(ndev_ctx->device_ctx); -+ if (!ndev) -+ goto out; -+ -+ netvsc_event_set_vf_ns(ndev); -+ -+out: -+ rtnl_unlock(); -+} -+ - /* - * On Hyper-V, every VF interface is matched with a corresponding - * synthetic interface. The synthetic interface is presented first -@@ -2799,10 +2824,12 @@ static int netvsc_netdev_event(struct notifier_block *this, - unsigned long event, void *ptr) - { - struct net_device *event_dev = netdev_notifier_info_to_dev(ptr); -+ struct net_device_context *ndev_ctx; - int ret = 0; - - if (event_dev->netdev_ops == &device_ops && event == NETDEV_REGISTER) { -- netvsc_event_set_vf_ns(event_dev); -+ ndev_ctx = netdev_priv(event_dev); -+ schedule_delayed_work(&ndev_ctx->vfns_work, 0); - return NOTIFY_DONE; - } - -diff --git a/drivers/net/ipa/ipa_smp2p.c b/drivers/net/ipa/ipa_smp2p.c -index 5620dc271fac33..cbf3d4761ce357 100644 ---- a/drivers/net/ipa/ipa_smp2p.c -+++ b/drivers/net/ipa/ipa_smp2p.c -@@ -92,7 +92,7 @@ static void ipa_smp2p_notify(struct ipa_smp2p *smp2p) - return; - - dev = &smp2p->ipa->pdev->dev; -- smp2p->power_on = pm_runtime_get_if_active(dev, true) > 0; -+ smp2p->power_on = pm_runtime_get_if_active(dev) > 0; - - /* Signal whether the IPA power is enabled */ - mask = BIT(smp2p->enabled_bit); -diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c -index 9a0432145645f4..6a114883ed8c5a 100644 ---- a/drivers/net/phy/micrel.c -+++ b/drivers/net/phy/micrel.c -@@ -372,6 +372,8 @@ static const struct kszphy_type ksz8051_type = { - - static const struct kszphy_type ksz8081_type = { - .led_mode_reg = MII_KSZPHY_CTRL_2, -+ .cable_diag_reg = KSZ8081_LMD, -+ .pair_mask = KSZPHY_WIRE_PAIR_MASK, - .has_broadcast_disable = true, - .has_nand_tree_disable = true, - .has_rmii_ref_clk_sel = true, -@@ -4720,6 +4722,14 @@ static int lan8841_suspend(struct phy_device *phydev) - return genphy_suspend(phydev); - } - -+static int ksz9131_resume(struct phy_device *phydev) -+{ -+ if (phydev->suspended && phy_interface_is_rgmii(phydev)) -+ ksz9131_config_rgmii_delay(phydev); -+ -+ return kszphy_resume(phydev); -+} -+ - static struct phy_driver ksphy_driver[] = { - { - .phy_id = PHY_ID_KS8737, -@@ -4966,7 +4976,7 @@ static struct phy_driver ksphy_driver[] = { - .get_strings = kszphy_get_strings, - .get_stats = kszphy_get_stats, - .suspend = kszphy_suspend, -- .resume = kszphy_resume, -+ .resume = ksz9131_resume, - .cable_test_start = ksz9x31_cable_test_start, - .cable_test_get_status = ksz9x31_cable_test_get_status, - .get_features = ksz9477_get_features, -diff --git a/drivers/net/phy/mscc/mscc.h b/drivers/net/phy/mscc/mscc.h -index 7a962050a4d45e..cdb343779a8fb5 100644 ---- a/drivers/net/phy/mscc/mscc.h -+++ b/drivers/net/phy/mscc/mscc.h -@@ -362,6 +362,13 @@ struct vsc85xx_hw_stat { - u16 mask; - }; - -+struct vsc8531_skb_cb { -+ u32 ns; -+}; -+ -+#define VSC8531_SKB_CB(skb) \ -+ ((struct vsc8531_skb_cb *)((skb)->cb)) -+ - struct vsc8531_private { - int rate_magic; - u16 supp_led_modes; -@@ -410,6 +417,11 @@ struct vsc8531_private { - */ - struct mutex ts_lock; - struct mutex phc_lock; -+ -+ /* list of skbs that were received and need timestamp information but it -+ * didn't received it yet -+ */ -+ struct sk_buff_head rx_skbs_list; - }; - - /* Shared structure between the PHYs of the same package. -diff --git a/drivers/net/phy/mscc/mscc_main.c b/drivers/net/phy/mscc/mscc_main.c -index 4171f01d34e579..3de72d9cc22bd0 100644 ---- a/drivers/net/phy/mscc/mscc_main.c -+++ b/drivers/net/phy/mscc/mscc_main.c -@@ -2335,6 +2335,13 @@ static int vsc85xx_probe(struct phy_device *phydev) - return vsc85xx_dt_led_modes_get(phydev, default_mode); - } - -+static void vsc85xx_remove(struct phy_device *phydev) -+{ -+ struct vsc8531_private *priv = phydev->priv; -+ -+ skb_queue_purge(&priv->rx_skbs_list); -+} -+ - /* Microsemi VSC85xx PHYs */ - static struct phy_driver vsc85xx_driver[] = { - { -@@ -2589,6 +2596,7 @@ static struct phy_driver vsc85xx_driver[] = { - .config_intr = &vsc85xx_config_intr, - .suspend = &genphy_suspend, - .resume = &genphy_resume, -+ .remove = &vsc85xx_remove, - .probe = &vsc8574_probe, - .set_wol = &vsc85xx_wol_set, - .get_wol = &vsc85xx_wol_get, -@@ -2614,6 +2622,7 @@ static struct phy_driver vsc85xx_driver[] = { - .config_intr = &vsc85xx_config_intr, - .suspend = &genphy_suspend, - .resume = &genphy_resume, -+ .remove = &vsc85xx_remove, - .probe = &vsc8574_probe, - .set_wol = &vsc85xx_wol_set, - .get_wol = &vsc85xx_wol_get, -@@ -2639,6 +2648,7 @@ static struct phy_driver vsc85xx_driver[] = { - .config_intr = &vsc85xx_config_intr, - .suspend = &genphy_suspend, - .resume = &genphy_resume, -+ .remove = &vsc85xx_remove, - .probe = &vsc8584_probe, - .get_tunable = &vsc85xx_get_tunable, - .set_tunable = &vsc85xx_set_tunable, -@@ -2662,6 +2672,7 @@ static struct phy_driver vsc85xx_driver[] = { - .config_intr = &vsc85xx_config_intr, - .suspend = &genphy_suspend, - .resume = &genphy_resume, -+ .remove = &vsc85xx_remove, - .probe = &vsc8584_probe, - .get_tunable = &vsc85xx_get_tunable, - .set_tunable = &vsc85xx_set_tunable, -@@ -2685,6 +2696,7 @@ static struct phy_driver vsc85xx_driver[] = { - .config_intr = &vsc85xx_config_intr, - .suspend = &genphy_suspend, - .resume = &genphy_resume, -+ .remove = &vsc85xx_remove, - .probe = &vsc8584_probe, - .get_tunable = &vsc85xx_get_tunable, - .set_tunable = &vsc85xx_set_tunable, -diff --git a/drivers/net/phy/mscc/mscc_ptp.c b/drivers/net/phy/mscc/mscc_ptp.c -index d0bd6ab45ebed7..add1a9ee721afa 100644 ---- a/drivers/net/phy/mscc/mscc_ptp.c -+++ b/drivers/net/phy/mscc/mscc_ptp.c -@@ -1193,9 +1193,7 @@ static bool vsc85xx_rxtstamp(struct mii_timestamper *mii_ts, - { - struct vsc8531_private *vsc8531 = - container_of(mii_ts, struct vsc8531_private, mii_ts); -- struct skb_shared_hwtstamps *shhwtstamps = NULL; - struct vsc85xx_ptphdr *ptphdr; -- struct timespec64 ts; - unsigned long ns; - - if (!vsc8531->ptp->configured) -@@ -1205,27 +1203,52 @@ static bool vsc85xx_rxtstamp(struct mii_timestamper *mii_ts, - type == PTP_CLASS_NONE) - return false; - -- vsc85xx_gettime(&vsc8531->ptp->caps, &ts); -- - ptphdr = get_ptp_header_rx(skb, vsc8531->ptp->rx_filter); - if (!ptphdr) - return false; - -- shhwtstamps = skb_hwtstamps(skb); -- memset(shhwtstamps, 0, sizeof(struct skb_shared_hwtstamps)); -- - ns = ntohl(ptphdr->rsrvd2); - -- /* nsec is in reserved field */ -- if (ts.tv_nsec < ns) -- ts.tv_sec--; -+ VSC8531_SKB_CB(skb)->ns = ns; -+ skb_queue_tail(&vsc8531->rx_skbs_list, skb); - -- shhwtstamps->hwtstamp = ktime_set(ts.tv_sec, ns); -- netif_rx(skb); -+ ptp_schedule_worker(vsc8531->ptp->ptp_clock, 0); - - return true; - } - -+static long vsc85xx_do_aux_work(struct ptp_clock_info *info) -+{ -+ struct vsc85xx_ptp *ptp = container_of(info, struct vsc85xx_ptp, caps); -+ struct skb_shared_hwtstamps *shhwtstamps = NULL; -+ struct phy_device *phydev = ptp->phydev; -+ struct vsc8531_private *priv = phydev->priv; -+ struct sk_buff_head received; -+ struct sk_buff *rx_skb; -+ struct timespec64 ts; -+ unsigned long flags; -+ -+ __skb_queue_head_init(&received); -+ spin_lock_irqsave(&priv->rx_skbs_list.lock, flags); -+ skb_queue_splice_tail_init(&priv->rx_skbs_list, &received); -+ spin_unlock_irqrestore(&priv->rx_skbs_list.lock, flags); -+ -+ vsc85xx_gettime(info, &ts); -+ while ((rx_skb = __skb_dequeue(&received)) != NULL) { -+ shhwtstamps = skb_hwtstamps(rx_skb); -+ memset(shhwtstamps, 0, sizeof(struct skb_shared_hwtstamps)); -+ -+ if (ts.tv_nsec < VSC8531_SKB_CB(rx_skb)->ns) -+ ts.tv_sec--; -+ -+ shhwtstamps->hwtstamp = ktime_set(ts.tv_sec, -+ VSC8531_SKB_CB(rx_skb)->ns); -+ netif_rx(rx_skb); -+ } -+ -+ return -1; -+} -+ - static const struct ptp_clock_info vsc85xx_clk_caps = { - .owner = THIS_MODULE, - .name = "VSC85xx timer", -@@ -1239,6 +1262,7 @@ static const struct ptp_clock_info vsc85xx_clk_caps = { - .adjfine = &vsc85xx_adjfine, - .gettime64 = &vsc85xx_gettime, - .settime64 = &vsc85xx_settime, -+ .do_aux_work = &vsc85xx_do_aux_work, - }; - - static struct vsc8531_private *vsc8584_base_priv(struct phy_device *phydev) -@@ -1566,6 +1590,7 @@ int vsc8584_ptp_probe(struct phy_device *phydev) - - mutex_init(&vsc8531->phc_lock); - mutex_init(&vsc8531->ts_lock); -+ skb_queue_head_init(&vsc8531->rx_skbs_list); - - /* Retrieve the shared load/save GPIO. Request it as non exclusive as - * the same GPIO can be requested by all the PHYs of the same package. -diff --git a/drivers/net/phy/smsc.c b/drivers/net/phy/smsc.c -index 4ca813c009476a..5f9bb0ebe455d2 100644 ---- a/drivers/net/phy/smsc.c -+++ b/drivers/net/phy/smsc.c -@@ -786,6 +786,7 @@ static struct phy_driver smsc_phy_driver[] = { - - /* PHY_BASIC_FEATURES */ - -+ .flags = PHY_RST_AFTER_CLK_EN, - .probe = smsc_phy_probe, - - /* basic functions */ -diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c -index ee1527cf3d0c4c..28b894bcd7a93d 100644 ---- a/drivers/net/ppp/ppp_generic.c -+++ b/drivers/net/ppp/ppp_generic.c -@@ -33,6 +33,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -1613,11 +1614,14 @@ static int ppp_fill_forward_path(struct net_device_path_ctx *ctx, - if (ppp->flags & SC_MULTILINK) - return -EOPNOTSUPP; - -- if (list_empty(&ppp->channels)) -+ pch = list_first_or_null_rcu(&ppp->channels, struct channel, clist); -+ if (!pch) -+ return -ENODEV; -+ -+ chan = READ_ONCE(pch->chan); -+ if (!chan) - return -ENODEV; - -- pch = list_first_entry(&ppp->channels, struct channel, clist); -- chan = pch->chan; - if (!chan->ops->fill_forward_path) - return -EOPNOTSUPP; - -@@ -3000,7 +3004,7 @@ ppp_unregister_channel(struct ppp_channel *chan) - */ - down_write(&pch->chan_sem); - spin_lock_bh(&pch->downl); -- pch->chan = NULL; -+ WRITE_ONCE(pch->chan, NULL); - spin_unlock_bh(&pch->downl); - up_write(&pch->chan_sem); - ppp_disconnect_channel(pch); -@@ -3506,7 +3510,7 @@ ppp_connect_channel(struct channel *pch, int unit) - hdrlen = pch->file.hdrlen + 2; /* for protocol bytes */ - if (hdrlen > ppp->dev->hard_header_len) - ppp->dev->hard_header_len = hdrlen; -- list_add_tail(&pch->clist, &ppp->channels); -+ list_add_tail_rcu(&pch->clist, &ppp->channels); - ++ppp->n_channels; - pch->ppp = ppp; - refcount_inc(&ppp->file.refcnt); -@@ -3536,10 +3540,11 @@ ppp_disconnect_channel(struct channel *pch) - if (ppp) { - /* remove it from the ppp unit's list */ - ppp_lock(ppp); -- list_del(&pch->clist); -+ list_del_rcu(&pch->clist); - if (--ppp->n_channels == 0) - wake_up_interruptible(&ppp->file.rwait); - ppp_unlock(ppp); -+ synchronize_net(); - if (refcount_dec_and_test(&ppp->file.refcnt)) - ppp_destroy_interface(ppp); - err = 0; -diff --git a/drivers/net/thunderbolt/main.c b/drivers/net/thunderbolt/main.c -index 0a53ec293d0408..dcaa62377808c2 100644 ---- a/drivers/net/thunderbolt/main.c -+++ b/drivers/net/thunderbolt/main.c -@@ -396,9 +396,9 @@ static void tbnet_tear_down(struct tbnet *net, bool send_logout) - - ret = tb_xdomain_disable_paths(net->xd, - net->local_transmit_path, -- net->rx_ring.ring->hop, -+ net->tx_ring.ring->hop, - net->remote_transmit_path, -- net->tx_ring.ring->hop); -+ net->rx_ring.ring->hop); - if (ret) - netdev_warn(net->dev, "failed to disable DMA paths\n"); - -@@ -662,9 +662,9 @@ static void tbnet_connected_work(struct work_struct *work) - goto err_free_rx_buffers; - - ret = tb_xdomain_enable_paths(net->xd, net->local_transmit_path, -- net->rx_ring.ring->hop, -+ net->tx_ring.ring->hop, - net->remote_transmit_path, -- net->tx_ring.ring->hop); -+ net->rx_ring.ring->hop); - if (ret) { - netdev_err(net->dev, "failed to enable DMA paths\n"); - goto err_free_tx_buffers; -@@ -924,8 +924,12 @@ static int tbnet_open(struct net_device *dev) - - netif_carrier_off(dev); - -- ring = tb_ring_alloc_tx(xd->tb->nhi, -1, TBNET_RING_SIZE, -- RING_FLAG_FRAME); -+ flags = RING_FLAG_FRAME; -+ /* Only enable full E2E if the other end supports it too */ -+ if (tbnet_e2e && net->svc->prtcstns & TBNET_E2E) -+ flags |= RING_FLAG_E2E; -+ -+ ring = tb_ring_alloc_tx(xd->tb->nhi, -1, TBNET_RING_SIZE, flags); - if (!ring) { - netdev_err(dev, "failed to allocate Tx ring\n"); - return -ENOMEM; -@@ -944,11 +948,6 @@ static int tbnet_open(struct net_device *dev) - sof_mask = BIT(TBIP_PDF_FRAME_START); - eof_mask = BIT(TBIP_PDF_FRAME_END); - -- flags = RING_FLAG_FRAME; -- /* Only enable full E2E if the other end supports it too */ -- if (tbnet_e2e && net->svc->prtcstns & TBNET_E2E) -- flags |= RING_FLAG_E2E; -- - ring = tb_ring_alloc_rx(xd->tb->nhi, -1, TBNET_RING_SIZE, flags, - net->tx_ring.ring->hop, sof_mask, - eof_mask, tbnet_start_poll, net); -diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c -index 119295f5f3b351..f4340d4ef7eeab 100644 ---- a/drivers/net/usb/asix_devices.c -+++ b/drivers/net/usb/asix_devices.c -@@ -676,6 +676,7 @@ static int ax88772_init_mdio(struct usbnet *dev) - priv->mdio->read = &asix_mdio_bus_read; - priv->mdio->write = &asix_mdio_bus_write; - priv->mdio->name = "Asix MDIO Bus"; -+ priv->mdio->phy_mask = ~(BIT(priv->phy_addr & 0x1f) | BIT(AX_EMBD_PHY_ADDR)); - /* mii bus name is usb-- */ - snprintf(priv->mdio->id, MII_BUS_ID_SIZE, "usb-%03d:%03d", - dev->udev->bus->busnum, dev->udev->devnum); -diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c -index db05622f1f703e..d9792fd515a904 100644 ---- a/drivers/net/usb/cdc_ncm.c -+++ b/drivers/net/usb/cdc_ncm.c -@@ -893,6 +893,10 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_ - } - } - -+ if (ctx->func_desc) -+ ctx->filtering_supported = !!(ctx->func_desc->bmNetworkCapabilities -+ & USB_CDC_NCM_NCAP_ETH_FILTER); -+ - iface_no = ctx->data->cur_altsetting->desc.bInterfaceNumber; - - /* Device-specific flags */ -@@ -1898,6 +1902,14 @@ static void cdc_ncm_status(struct usbnet *dev, struct urb *urb) - } - } - -+static void cdc_ncm_update_filter(struct usbnet *dev) -+{ -+ struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0]; -+ -+ if (ctx->filtering_supported) -+ usbnet_cdc_update_filter(dev); -+} -+ - static const struct driver_info cdc_ncm_info = { - .description = "CDC NCM (NO ZLP)", - .flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET -@@ -1908,7 +1920,7 @@ static const struct driver_info cdc_ncm_info = { - .status = cdc_ncm_status, - .rx_fixup = cdc_ncm_rx_fixup, - .tx_fixup = cdc_ncm_tx_fixup, -- .set_rx_mode = usbnet_cdc_update_filter, -+ .set_rx_mode = cdc_ncm_update_filter, - }; - - /* Same as cdc_ncm_info, but with FLAG_SEND_ZLP */ -@@ -1922,7 +1934,7 @@ static const struct driver_info cdc_ncm_zlp_info = { - .status = cdc_ncm_status, - .rx_fixup = cdc_ncm_rx_fixup, - .tx_fixup = cdc_ncm_tx_fixup, -- .set_rx_mode = usbnet_cdc_update_filter, -+ .set_rx_mode = cdc_ncm_update_filter, - }; - - /* Same as cdc_ncm_info, but with FLAG_WWAN */ -@@ -1936,7 +1948,7 @@ static const struct driver_info wwan_info = { - .status = cdc_ncm_status, - .rx_fixup = cdc_ncm_rx_fixup, - .tx_fixup = cdc_ncm_tx_fixup, -- .set_rx_mode = usbnet_cdc_update_filter, -+ .set_rx_mode = cdc_ncm_update_filter, - }; - - /* Same as wwan_info, but with FLAG_NOARP */ -@@ -1950,7 +1962,7 @@ static const struct driver_info wwan_noarp_info = { - .status = cdc_ncm_status, - .rx_fixup = cdc_ncm_rx_fixup, - .tx_fixup = cdc_ncm_tx_fixup, -- .set_rx_mode = usbnet_cdc_update_filter, -+ .set_rx_mode = cdc_ncm_update_filter, - }; - - static const struct usb_device_id cdc_devs[] = { -diff --git a/drivers/net/wireless/ath/ath11k/ce.c b/drivers/net/wireless/ath/ath11k/ce.c -index 9d8efec46508a1..39d9aad33bc690 100644 ---- a/drivers/net/wireless/ath/ath11k/ce.c -+++ b/drivers/net/wireless/ath/ath11k/ce.c -@@ -393,9 +393,6 @@ static int ath11k_ce_completed_recv_next(struct ath11k_ce_pipe *pipe, - goto err; - } - -- /* Make sure descriptor is read after the head pointer. */ -- dma_rmb(); -- - *nbytes = ath11k_hal_ce_dst_status_get_length(desc); - - *skb = pipe->dest_ring->skb[sw_index]; -diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c -index 2b7bee66647286..33b9764eaa9167 100644 ---- a/drivers/net/wireless/ath/ath11k/dp_rx.c -+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c -@@ -2662,9 +2662,6 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id, - try_again: - ath11k_hal_srng_access_begin(ab, srng); - -- /* Make sure descriptor is read after the head pointer. */ -- dma_rmb(); -- - while (likely(desc = - (struct hal_reo_dest_ring *)ath11k_hal_srng_dst_get_next_entry(ab, - srng))) { -diff --git a/drivers/net/wireless/ath/ath11k/hal.c b/drivers/net/wireless/ath/ath11k/hal.c -index df493d1760623e..1215408d1a6abb 100644 ---- a/drivers/net/wireless/ath/ath11k/hal.c -+++ b/drivers/net/wireless/ath/ath11k/hal.c -@@ -796,13 +796,23 @@ u32 *ath11k_hal_srng_src_peek(struct ath11k_base *ab, struct hal_srng *srng) - - void ath11k_hal_srng_access_begin(struct ath11k_base *ab, struct hal_srng *srng) - { -+ u32 hp; -+ - lockdep_assert_held(&srng->lock); - - if (srng->ring_dir == HAL_SRNG_DIR_SRC) { - srng->u.src_ring.cached_tp = - *(volatile u32 *)srng->u.src_ring.tp_addr; - } else { -- srng->u.dst_ring.cached_hp = READ_ONCE(*srng->u.dst_ring.hp_addr); -+ hp = READ_ONCE(*srng->u.dst_ring.hp_addr); -+ -+ if (hp != srng->u.dst_ring.cached_hp) { -+ srng->u.dst_ring.cached_hp = hp; -+ /* Make sure descriptor is read after the head -+ * pointer. -+ */ -+ dma_rmb(); -+ } - - /* Try to prefetch the next descriptor in the ring */ - if (srng->flags & HAL_SRNG_FLAGS_CACHED) -@@ -817,7 +827,6 @@ void ath11k_hal_srng_access_end(struct ath11k_base *ab, struct hal_srng *srng) - { - lockdep_assert_held(&srng->lock); - -- /* TODO: See if we need a write memory barrier here */ - if (srng->flags & HAL_SRNG_FLAGS_LMAC_RING) { - /* For LMAC rings, ring pointer updates are done through FW and - * hence written to a shared memory location that is read by FW -@@ -825,21 +834,37 @@ void ath11k_hal_srng_access_end(struct ath11k_base *ab, struct hal_srng *srng) - if (srng->ring_dir == HAL_SRNG_DIR_SRC) { - srng->u.src_ring.last_tp = - *(volatile u32 *)srng->u.src_ring.tp_addr; -- *srng->u.src_ring.hp_addr = srng->u.src_ring.hp; -+ /* Make sure descriptor is written before updating the -+ * head pointer. -+ */ -+ dma_wmb(); -+ WRITE_ONCE(*srng->u.src_ring.hp_addr, srng->u.src_ring.hp); - } else { - srng->u.dst_ring.last_hp = *srng->u.dst_ring.hp_addr; -- *srng->u.dst_ring.tp_addr = srng->u.dst_ring.tp; -+ /* Make sure descriptor is read before updating the -+ * tail pointer. -+ */ -+ dma_mb(); -+ WRITE_ONCE(*srng->u.dst_ring.tp_addr, srng->u.dst_ring.tp); - } - } else { - if (srng->ring_dir == HAL_SRNG_DIR_SRC) { - srng->u.src_ring.last_tp = - *(volatile u32 *)srng->u.src_ring.tp_addr; -+ /* Assume implementation use an MMIO write accessor -+ * which has the required wmb() so that the descriptor -+ * is written before the updating the head pointer. -+ */ - ath11k_hif_write32(ab, - (unsigned long)srng->u.src_ring.hp_addr - - (unsigned long)ab->mem, - srng->u.src_ring.hp); - } else { - srng->u.dst_ring.last_hp = *srng->u.dst_ring.hp_addr; -+ /* Make sure descriptor is read before updating the -+ * tail pointer. -+ */ -+ mb(); - ath11k_hif_write32(ab, - (unsigned long)srng->u.dst_ring.tp_addr - - (unsigned long)ab->mem, -diff --git a/drivers/net/wireless/ath/ath12k/ce.c b/drivers/net/wireless/ath/ath12k/ce.c -index 740586fe49d1f9..b66d23d6b2bd9e 100644 ---- a/drivers/net/wireless/ath/ath12k/ce.c -+++ b/drivers/net/wireless/ath/ath12k/ce.c -@@ -343,9 +343,6 @@ static int ath12k_ce_completed_recv_next(struct ath12k_ce_pipe *pipe, - goto err; - } - -- /* Make sure descriptor is read after the head pointer. */ -- dma_rmb(); -- - *nbytes = ath12k_hal_ce_dst_status_get_length(desc); - - *skb = pipe->dest_ring->skb[sw_index]; -diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c -index c663ff990b4791..c918f5d12975cb 100644 ---- a/drivers/net/wireless/ath/ath12k/dp.c -+++ b/drivers/net/wireless/ath/ath12k/dp.c -@@ -74,6 +74,7 @@ int ath12k_dp_peer_setup(struct ath12k *ar, int vdev_id, const u8 *addr) - ret = ath12k_dp_rx_peer_frag_setup(ar, addr, vdev_id); - if (ret) { - ath12k_warn(ab, "failed to setup rx defrag context\n"); -+ tid--; - goto peer_clean; - } - -@@ -91,7 +92,7 @@ int ath12k_dp_peer_setup(struct ath12k *ar, int vdev_id, const u8 *addr) - return -ENOENT; - } - -- for (; tid >= 0; tid--) -+ for (tid--; tid >= 0; tid--) - ath12k_dp_rx_peer_tid_delete(ar, peer, tid); - - spin_unlock_bh(&ab->base_lock); -diff --git a/drivers/net/wireless/ath/ath12k/hal.c b/drivers/net/wireless/ath/ath12k/hal.c -index 169e16c6ed650f..2d80cb9f0e7b7f 100644 ---- a/drivers/net/wireless/ath/ath12k/hal.c -+++ b/drivers/net/wireless/ath/ath12k/hal.c -@@ -1728,13 +1728,24 @@ void *ath12k_hal_srng_src_get_next_reaped(struct ath12k_base *ab, - - void ath12k_hal_srng_access_begin(struct ath12k_base *ab, struct hal_srng *srng) - { -+ u32 hp; -+ - lockdep_assert_held(&srng->lock); - -- if (srng->ring_dir == HAL_SRNG_DIR_SRC) -+ if (srng->ring_dir == HAL_SRNG_DIR_SRC) { - srng->u.src_ring.cached_tp = - *(volatile u32 *)srng->u.src_ring.tp_addr; -- else -- srng->u.dst_ring.cached_hp = READ_ONCE(*srng->u.dst_ring.hp_addr); -+ } else { -+ hp = READ_ONCE(*srng->u.dst_ring.hp_addr); -+ -+ if (hp != srng->u.dst_ring.cached_hp) { -+ srng->u.dst_ring.cached_hp = hp; -+ /* Make sure descriptor is read after the head -+ * pointer. -+ */ -+ dma_rmb(); -+ } -+ } - } - - /* Update cached ring head/tail pointers to HW. ath12k_hal_srng_access_begin() -@@ -1744,7 +1755,6 @@ void ath12k_hal_srng_access_end(struct ath12k_base *ab, struct hal_srng *srng) - { - lockdep_assert_held(&srng->lock); - -- /* TODO: See if we need a write memory barrier here */ - if (srng->flags & HAL_SRNG_FLAGS_LMAC_RING) { - /* For LMAC rings, ring pointer updates are done through FW and - * hence written to a shared memory location that is read by FW -@@ -1752,21 +1762,37 @@ void ath12k_hal_srng_access_end(struct ath12k_base *ab, struct hal_srng *srng) - if (srng->ring_dir == HAL_SRNG_DIR_SRC) { - srng->u.src_ring.last_tp = - *(volatile u32 *)srng->u.src_ring.tp_addr; -- *srng->u.src_ring.hp_addr = srng->u.src_ring.hp; -+ /* Make sure descriptor is written before updating the -+ * head pointer. -+ */ -+ dma_wmb(); -+ WRITE_ONCE(*srng->u.src_ring.hp_addr, srng->u.src_ring.hp); - } else { - srng->u.dst_ring.last_hp = *srng->u.dst_ring.hp_addr; -- *srng->u.dst_ring.tp_addr = srng->u.dst_ring.tp; -+ /* Make sure descriptor is read before updating the -+ * tail pointer. -+ */ -+ dma_mb(); -+ WRITE_ONCE(*srng->u.dst_ring.tp_addr, srng->u.dst_ring.tp); - } - } else { - if (srng->ring_dir == HAL_SRNG_DIR_SRC) { - srng->u.src_ring.last_tp = - *(volatile u32 *)srng->u.src_ring.tp_addr; -+ /* Assume implementation use an MMIO write accessor -+ * which has the required wmb() so that the descriptor -+ * is written before the updating the head pointer. -+ */ - ath12k_hif_write32(ab, - (unsigned long)srng->u.src_ring.hp_addr - - (unsigned long)ab->mem, - srng->u.src_ring.hp); - } else { - srng->u.dst_ring.last_hp = *srng->u.dst_ring.hp_addr; -+ /* Make sure descriptor is read before updating the -+ * tail pointer. -+ */ -+ mb(); - ath12k_hif_write32(ab, - (unsigned long)srng->u.dst_ring.tp_addr - - (unsigned long)ab->mem, -diff --git a/drivers/net/wireless/ath/ath12k/hw.c b/drivers/net/wireless/ath/ath12k/hw.c -index dafd7c34d74650..97ed179be22835 100644 ---- a/drivers/net/wireless/ath/ath12k/hw.c -+++ b/drivers/net/wireless/ath/ath12k/hw.c -@@ -1002,7 +1002,7 @@ static const struct ath12k_hw_params ath12k_hw_params[] = { - .download_calib = true, - .supports_suspend = false, - .tcl_ring_retry = true, -- .reoq_lut_support = false, -+ .reoq_lut_support = true, - .supports_shadow_regs = false, - - .hal_desc_sz = sizeof(struct hal_rx_desc_qcn9274), -diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c -index e918218ce2d607..7e400a0e0eb111 100644 ---- a/drivers/net/wireless/ath/ath12k/wmi.c -+++ b/drivers/net/wireless/ath/ath12k/wmi.c -@@ -4965,6 +4965,11 @@ static int wmi_process_mgmt_tx_comp(struct ath12k *ar, u32 desc_id, - dma_unmap_single(ar->ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE); - - info = IEEE80211_SKB_CB(msdu); -+ memset(&info->status, 0, sizeof(info->status)); -+ -+ /* skip tx rate update from ieee80211_status*/ -+ info->status.rates[0].idx = -1; -+ - if ((!(info->flags & IEEE80211_TX_CTL_NO_ACK)) && !status) - info->flags |= IEEE80211_TX_STAT_ACK; - -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c -index 47c0e8e429e544..3064e603e7e3e0 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c -@@ -919,7 +919,7 @@ void wlc_lcnphy_read_table(struct brcms_phy *pi, struct phytbl_info *pti) - - static void - wlc_lcnphy_common_read_table(struct brcms_phy *pi, u32 tbl_id, -- const u16 *tbl_ptr, u32 tbl_len, -+ u16 *tbl_ptr, u32 tbl_len, - u32 tbl_width, u32 tbl_offset) - { - struct phytbl_info tab; -diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c -index 0a4aa3c678c101..75118e24061911 100644 ---- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c -+++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c -@@ -1575,8 +1575,11 @@ il4965_tx_cmd_build_rate(struct il_priv *il, - || rate_idx > RATE_COUNT_LEGACY) - rate_idx = rate_lowest_index(&il->bands[info->band], sta); - /* For 5 GHZ band, remap mac80211 rate indices into driver indices */ -- if (info->band == NL80211_BAND_5GHZ) -+ if (info->band == NL80211_BAND_5GHZ) { - rate_idx += IL_FIRST_OFDM_RATE; -+ if (rate_idx > IL_LAST_OFDM_RATE) -+ rate_idx = IL_LAST_OFDM_RATE; -+ } - /* Get PLCP rate for tx_cmd->rate_n_flags */ - rate_plcp = il_rates[rate_idx].plcp; - /* Zero out flags for this packet */ -diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/rs.c b/drivers/net/wireless/intel/iwlwifi/dvm/rs.c -index f4a6f76cf193ab..e70024525eb90a 100644 ---- a/drivers/net/wireless/intel/iwlwifi/dvm/rs.c -+++ b/drivers/net/wireless/intel/iwlwifi/dvm/rs.c -@@ -2904,7 +2904,7 @@ static void rs_fill_link_cmd(struct iwl_priv *priv, - /* Repeat initial/next rate. - * For legacy IWL_NUMBER_TRY == 1, this loop will not execute. - * For HT IWL_HT_NUMBER_TRY == 3, this executes twice. */ -- while (repeat_rate > 0 && (index < LINK_QUAL_MAX_RETRY_NUM)) { -+ while (repeat_rate > 0 && index < (LINK_QUAL_MAX_RETRY_NUM - 1)) { - if (is_legacy(tbl_type.lq_type)) { - if (ant_toggle_cnt < NUM_TRY_BEFORE_ANT_TOGGLE) - ant_toggle_cnt++; -diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c -index 0a1f302ad6d3fd..2deb259615d9c5 100644 ---- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c -+++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c -@@ -2816,6 +2816,7 @@ int iwl_fw_dbg_collect(struct iwl_fw_runtime *fwrt, - struct iwl_fw_dump_desc *desc; - unsigned int delay = 0; - bool monitor_only = false; -+ int ret; - - if (trigger) { - u16 occurrences = le16_to_cpu(trigger->occurrences) - 1; -@@ -2846,7 +2847,11 @@ int iwl_fw_dbg_collect(struct iwl_fw_runtime *fwrt, - desc->trig_desc.type = cpu_to_le32(trig); - memcpy(desc->trig_desc.data, str, len); - -- return iwl_fw_dbg_collect_desc(fwrt, desc, monitor_only, delay); -+ ret = iwl_fw_dbg_collect_desc(fwrt, desc, monitor_only, delay); -+ if (ret) -+ kfree(desc); -+ -+ return ret; - } - IWL_EXPORT_SYMBOL(iwl_fw_dbg_collect); - -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c -index a82cdd897173f5..6c108dbbbc5402 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c -@@ -2143,6 +2143,7 @@ static void iwl_mvm_convert_gtk_v2(struct iwl_wowlan_status_data *status, - - status->gtk[0].len = data->key_len; - status->gtk[0].flags = data->key_flags; -+ status->gtk[0].id = status->gtk[0].flags & IWL_WOWLAN_GTK_IDX_MASK; - - memcpy(status->gtk[0].key, data->key, sizeof(data->key)); - -@@ -2369,6 +2370,7 @@ iwl_mvm_send_wowlan_get_status(struct iwl_mvm *mvm, u8 sta_id) - * currently used key. - */ - status->gtk[0].flags = v6->gtk.key_index | BIT(7); -+ status->gtk[0].id = v6->gtk.key_index; - } else if (notif_ver == 7) { - struct iwl_wowlan_status_v7 *v7 = (void *)cmd.resp_pkt->data; - -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c -index cc866401aad0ba..8b22779e5b3e57 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c -@@ -828,7 +828,7 @@ static inline bool iwl_mvm_scan_fits(struct iwl_mvm *mvm, int n_ssids, - int n_channels) - { - return ((n_ssids <= PROBE_OPTION_MAX) && -- (n_channels <= mvm->fw->ucode_capa.n_scan_channels) & -+ (n_channels <= mvm->fw->ucode_capa.n_scan_channels) && - (ies->common_ie_len + - ies->len[NL80211_BAND_2GHZ] + ies->len[NL80211_BAND_5GHZ] + - ies->len[NL80211_BAND_6GHZ] <= -diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c -index f0226db2e57c7a..fae9ec98da3b9d 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c -@@ -2060,16 +2060,21 @@ static int mt7915_load_firmware(struct mt7915_dev *dev) - { - int ret; - -- /* make sure fw is download state */ -- if (mt7915_firmware_state(dev, false)) { -- /* restart firmware once */ -- mt76_connac_mcu_restart(&dev->mt76); -- ret = mt7915_firmware_state(dev, false); -- if (ret) { -- dev_err(dev->mt76.dev, -- "Firmware is not ready for download\n"); -- return ret; -- } -+ /* Release Semaphore if taken by previous failed attempt */ -+ ret = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, false); -+ if (ret != PATCH_REL_SEM_SUCCESS) { -+ dev_err(dev->mt76.dev, "Could not release semaphore\n"); -+ /* Continue anyways */ -+ } -+ -+ /* Always restart MCU firmware */ -+ mt76_connac_mcu_restart(&dev->mt76); -+ -+ /* Check if MCU is ready */ -+ ret = mt7915_firmware_state(dev, false); -+ if (ret) { -+ dev_err(dev->mt76.dev, "Firmware did not enter download state\n"); -+ return ret; - } - - ret = mt76_connac2_load_patch(&dev->mt76, fw_name_var(dev, ROM_PATCH)); -diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c -index 3645f212021f92..40112b2c37775d 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/pci.c -+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c -@@ -573,8 +573,11 @@ static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw, - dma_map_single(&rtlpci->pdev->dev, skb_tail_pointer(skb), - rtlpci->rxbuffersize, DMA_FROM_DEVICE); - bufferaddress = *((dma_addr_t *)skb->cb); -- if (dma_mapping_error(&rtlpci->pdev->dev, bufferaddress)) -+ if (dma_mapping_error(&rtlpci->pdev->dev, bufferaddress)) { -+ if (!new_skb) -+ kfree_skb(skb); - return 0; -+ } - rtlpci->rx_ring[rxring_idx].rx_buf[desc_idx] = skb; - if (rtlpriv->use_new_trx_flow) { - /* skb->cb may be 64 bit address */ -@@ -803,13 +806,19 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw) - skb = new_skb; - no_new: - if (rtlpriv->use_new_trx_flow) { -- _rtl_pci_init_one_rxdesc(hw, skb, (u8 *)buffer_desc, -- rxring_idx, -- rtlpci->rx_ring[rxring_idx].idx); -+ if (!_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)buffer_desc, -+ rxring_idx, -+ rtlpci->rx_ring[rxring_idx].idx)) { -+ if (new_skb) -+ dev_kfree_skb_any(skb); -+ } - } else { -- _rtl_pci_init_one_rxdesc(hw, skb, (u8 *)pdesc, -- rxring_idx, -- rtlpci->rx_ring[rxring_idx].idx); -+ if (!_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)pdesc, -+ rxring_idx, -+ rtlpci->rx_ring[rxring_idx].idx)) { -+ if (new_skb) -+ dev_kfree_skb_any(skb); -+ } - if (rtlpci->rx_ring[rxring_idx].idx == - rtlpci->rxringcount - 1) - rtlpriv->cfg->ops->set_desc(hw, (u8 *)pdesc, -diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c -index 21e9ec8768b5dc..c172ef13c9540c 100644 ---- a/drivers/net/wireless/realtek/rtw89/core.c -+++ b/drivers/net/wireless/realtek/rtw89/core.c -@@ -1996,6 +1996,9 @@ static enum rtw89_ps_mode rtw89_update_ps_mode(struct rtw89_dev *rtwdev) - { - const struct rtw89_chip_info *chip = rtwdev->chip; - -+ if (rtwdev->hci.type != RTW89_HCI_TYPE_PCIE) -+ return RTW89_PS_MODE_NONE; -+ - if (rtw89_disable_ps_mode || !chip->ps_mode_supported || - RTW89_CHK_FW_FEATURE(NO_DEEP_PS, &rtwdev->fw)) - return RTW89_PS_MODE_NONE; -diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c -index 89b0a7970508e2..539537360914c6 100644 ---- a/drivers/net/wireless/realtek/rtw89/fw.c -+++ b/drivers/net/wireless/realtek/rtw89/fw.c -@@ -3427,13 +3427,18 @@ static int rtw89_fw_read_c2h_reg(struct rtw89_dev *rtwdev, - const struct rtw89_chip_info *chip = rtwdev->chip; - struct rtw89_fw_info *fw_info = &rtwdev->fw; - const u32 *c2h_reg = chip->c2h_regs; -- u32 ret; -+ u32 ret, timeout; - u8 i, val; - - info->id = RTW89_FWCMD_C2HREG_FUNC_NULL; - -+ if (rtwdev->hci.type == RTW89_HCI_TYPE_USB) -+ timeout = RTW89_C2H_TIMEOUT_USB; -+ else -+ timeout = RTW89_C2H_TIMEOUT; -+ - ret = read_poll_timeout_atomic(rtw89_read8, val, val, 1, -- RTW89_C2H_TIMEOUT, false, rtwdev, -+ timeout, false, rtwdev, - chip->c2h_ctrl_reg); - if (ret) { - rtw89_warn(rtwdev, "c2h reg timeout\n"); -diff --git a/drivers/net/wireless/realtek/rtw89/fw.h b/drivers/net/wireless/realtek/rtw89/fw.h -index 775f4e8fbda4dd..bc6a9ea9352e0f 100644 ---- a/drivers/net/wireless/realtek/rtw89/fw.h -+++ b/drivers/net/wireless/realtek/rtw89/fw.h -@@ -69,6 +69,8 @@ struct rtw89_h2creg_sch_tx_en { - #define RTW89_C2HREG_HDR_LEN 2 - #define RTW89_H2CREG_HDR_LEN 2 - #define RTW89_C2H_TIMEOUT 1000000 -+#define RTW89_C2H_TIMEOUT_USB 4000 -+ - struct rtw89_mac_c2h_info { - u8 id; - u8 content_len; -diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c -index 3c818c4b4653ad..3d63f8b2770e21 100644 ---- a/drivers/net/wireless/realtek/rtw89/mac.c -+++ b/drivers/net/wireless/realtek/rtw89/mac.c -@@ -1301,6 +1301,23 @@ void rtw89_mac_notify_wake(struct rtw89_dev *rtwdev) - rtw89_mac_send_rpwm(rtwdev, state, true); - } - -+static void rtw89_mac_power_switch_boot_mode(struct rtw89_dev *rtwdev) -+{ -+ u32 boot_mode; -+ -+ if (rtwdev->hci.type != RTW89_HCI_TYPE_USB) -+ return; -+ -+ boot_mode = rtw89_read32_mask(rtwdev, R_AX_GPIO_MUXCFG, B_AX_BOOT_MODE); -+ if (!boot_mode) -+ return; -+ -+ rtw89_write32_clr(rtwdev, R_AX_SYS_PW_CTRL, B_AX_APFN_ONMAC); -+ rtw89_write32_clr(rtwdev, R_AX_SYS_STATUS1, B_AX_AUTO_WLPON); -+ rtw89_write32_clr(rtwdev, R_AX_GPIO_MUXCFG, B_AX_BOOT_MODE); -+ rtw89_write32_clr(rtwdev, R_AX_RSV_CTRL, B_AX_R_DIS_PRST); -+} -+ - static int rtw89_mac_power_switch(struct rtw89_dev *rtwdev, bool on) - { - #define PWR_ACT 1 -@@ -1310,6 +1327,8 @@ static int rtw89_mac_power_switch(struct rtw89_dev *rtwdev, bool on) - int ret; - u8 val; - -+ rtw89_mac_power_switch_boot_mode(rtwdev); -+ - if (on) { - cfg_seq = chip->pwr_on_seq; - cfg_func = chip->ops->pwr_on_func; -diff --git a/drivers/net/wireless/realtek/rtw89/reg.h b/drivers/net/wireless/realtek/rtw89/reg.h -index c0aac4d3678a32..ef116259504232 100644 ---- a/drivers/net/wireless/realtek/rtw89/reg.h -+++ b/drivers/net/wireless/realtek/rtw89/reg.h -@@ -172,6 +172,7 @@ - - #define R_AX_SYS_STATUS1 0x00F4 - #define B_AX_SEL_0XC0_MASK GENMASK(17, 16) -+#define B_AX_AUTO_WLPON BIT(10) - #define B_AX_PAD_HCI_SEL_V2_MASK GENMASK(5, 3) - #define MAC_AX_HCI_SEL_SDIO_UART 0 - #define MAC_AX_HCI_SEL_MULTI_USB 1 -diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c -index 0115f8f5b7245f..5b59c0ee6c6660 100644 ---- a/drivers/net/xen-netfront.c -+++ b/drivers/net/xen-netfront.c -@@ -637,8 +637,6 @@ static int xennet_xdp_xmit_one(struct net_device *dev, - tx_stats->packets++; - u64_stats_update_end(&tx_stats->syncp); - -- xennet_tx_buf_gc(queue); -- - return 0; - } - -@@ -848,9 +846,6 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev - tx_stats->packets++; - u64_stats_update_end(&tx_stats->syncp); - -- /* Note: It is not safe to access skb after xennet_tx_buf_gc()! */ -- xennet_tx_buf_gc(queue); -- - if (!netfront_tx_slot_available(queue)) - netif_tx_stop_queue(netdev_get_tx_queue(dev, queue->id)); - -diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c -index 97ab91a479d112..136dba6221d86a 100644 ---- a/drivers/nvme/host/pci.c -+++ b/drivers/nvme/host/pci.c -@@ -1755,8 +1755,28 @@ static int nvme_pci_configure_admin_queue(struct nvme_dev *dev) - * might be pointing at! - */ - result = nvme_disable_ctrl(&dev->ctrl, false); -- if (result < 0) -- return result; -+ if (result < 0) { -+ struct pci_dev *pdev = to_pci_dev(dev->dev); -+ -+ /* -+ * The NVMe Controller Reset method did not get an expected -+ * CSTS.RDY transition, so something with the device appears to -+ * be stuck. Use the lower level and bigger hammer PCIe -+ * Function Level Reset to attempt restoring the device to its -+ * initial state, and try again. -+ */ -+ result = pcie_reset_flr(pdev, false); -+ if (result < 0) -+ return result; -+ -+ pci_restore_state(pdev); -+ result = nvme_disable_ctrl(&dev->ctrl, false); -+ if (result < 0) -+ return result; -+ -+ dev_info(dev->ctrl.device, -+ "controller reset completed after pcie flr\n"); -+ } - - result = nvme_alloc_queue(dev, 0, NVME_AQ_DEPTH); - if (result) -diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c -index cedfbd4258631d..23b8dda70cb2f0 100644 ---- a/drivers/pci/controller/dwc/pci-imx6.c -+++ b/drivers/pci/controller/dwc/pci-imx6.c -@@ -1043,7 +1043,10 @@ static const struct pci_epc_features imx8m_pcie_epc_features = { - .linkup_notifier = false, - .msi_capable = true, - .msix_capable = false, -- .reserved_bar = 1 << BAR_1 | 1 << BAR_3, -+ .reserved_bar = 1 << BAR_1 | 1 << BAR_3 | 1 << BAR_5, -+ .bar_fixed_size = { -+ [BAR_4] = SZ_256, -+ }, - .align = SZ_64K, - }; - -@@ -1098,8 +1101,6 @@ static int imx6_add_pcie_ep(struct imx6_pcie *imx6_pcie, - dev_err(dev, "failed to initialize endpoint\n"); - return ret; - } -- /* Start LTSSM. */ -- imx6_pcie_ltssm_enable(dev); - - return 0; - } -diff --git a/drivers/pci/controller/pcie-rockchip-host.c b/drivers/pci/controller/pcie-rockchip-host.c -index 6ff20d58539662..c25f32abbdf646 100644 ---- a/drivers/pci/controller/pcie-rockchip-host.c -+++ b/drivers/pci/controller/pcie-rockchip-host.c -@@ -11,6 +11,7 @@ - * ARM PCI Host generic driver. - */ - -+#include - #include - #include - #include -@@ -40,18 +41,18 @@ static void rockchip_pcie_enable_bw_int(struct rockchip_pcie *rockchip) - { - u32 status; - -- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_LCS); -+ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); - status |= (PCI_EXP_LNKCTL_LBMIE | PCI_EXP_LNKCTL_LABIE); -- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_LCS); -+ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); - } - - static void rockchip_pcie_clr_bw_int(struct rockchip_pcie *rockchip) - { - u32 status; - -- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_LCS); -+ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); - status |= (PCI_EXP_LNKSTA_LBMS | PCI_EXP_LNKSTA_LABS) << 16; -- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_LCS); -+ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); - } - - static void rockchip_pcie_update_txcredit_mui(struct rockchip_pcie *rockchip) -@@ -269,7 +270,7 @@ static void rockchip_pcie_set_power_limit(struct rockchip_pcie *rockchip) - scale = 3; /* 0.001x */ - curr = curr / 1000; /* convert to mA */ - power = (curr * 3300) / 1000; /* milliwatt */ -- while (power > PCIE_RC_CONFIG_DCR_CSPL_LIMIT) { -+ while (power > FIELD_MAX(PCI_EXP_DEVCAP_PWR_VAL)) { - if (!scale) { - dev_warn(rockchip->dev, "invalid power supply\n"); - return; -@@ -278,10 +279,10 @@ static void rockchip_pcie_set_power_limit(struct rockchip_pcie *rockchip) - power = power / 10; - } - -- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_DCR); -- status |= (power << PCIE_RC_CONFIG_DCR_CSPL_SHIFT) | -- (scale << PCIE_RC_CONFIG_DCR_CPLS_SHIFT); -- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_DCR); -+ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_DEVCAP); -+ status |= FIELD_PREP(PCI_EXP_DEVCAP_PWR_VAL, power); -+ status |= FIELD_PREP(PCI_EXP_DEVCAP_PWR_SCL, scale); -+ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_DEVCAP); - } - - /** -@@ -309,14 +310,14 @@ static int rockchip_pcie_host_init_port(struct rockchip_pcie *rockchip) - rockchip_pcie_set_power_limit(rockchip); - - /* Set RC's clock architecture as common clock */ -- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_LCS); -+ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); - status |= PCI_EXP_LNKSTA_SLC << 16; -- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_LCS); -+ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); - - /* Set RC's RCB to 128 */ -- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_LCS); -+ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); - status |= PCI_EXP_LNKCTL_RCB; -- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_LCS); -+ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); - - /* Enable Gen1 training */ - rockchip_pcie_write(rockchip, PCIE_CLIENT_LINK_TRAIN_ENABLE, -@@ -338,9 +339,13 @@ static int rockchip_pcie_host_init_port(struct rockchip_pcie *rockchip) - * Enable retrain for gen2. This should be configured only after - * gen1 finished. - */ -- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_LCS); -+ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL2); -+ status &= ~PCI_EXP_LNKCTL2_TLS; -+ status |= PCI_EXP_LNKCTL2_TLS_5_0GT; -+ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL2); -+ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); - status |= PCI_EXP_LNKCTL_RL; -- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_LCS); -+ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); - - err = readl_poll_timeout(rockchip->apb_base + PCIE_CORE_CTRL, - status, PCIE_LINK_IS_GEN2(status), 20, -@@ -377,15 +382,15 @@ static int rockchip_pcie_host_init_port(struct rockchip_pcie *rockchip) - - /* Clear L0s from RC's link cap */ - if (of_property_read_bool(dev->of_node, "aspm-no-l0s")) { -- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_LINK_CAP); -- status &= ~PCIE_RC_CONFIG_LINK_CAP_L0S; -- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_LINK_CAP); -+ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCAP); -+ status &= ~PCI_EXP_LNKCAP_ASPM_L0S; -+ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCAP); - } - -- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_DCSR); -- status &= ~PCIE_RC_CONFIG_DCSR_MPS_MASK; -- status |= PCIE_RC_CONFIG_DCSR_MPS_256; -- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_DCSR); -+ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_DEVCTL); -+ status &= ~PCI_EXP_DEVCTL_PAYLOAD; -+ status |= PCI_EXP_DEVCTL_PAYLOAD_256B; -+ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_DEVCTL); - - return 0; - err_power_off_phy: -diff --git a/drivers/pci/controller/pcie-rockchip.h b/drivers/pci/controller/pcie-rockchip.h -index 15ee949f2485e3..049ad984a4164a 100644 ---- a/drivers/pci/controller/pcie-rockchip.h -+++ b/drivers/pci/controller/pcie-rockchip.h -@@ -144,16 +144,7 @@ - #define PCIE_EP_CONFIG_BASE 0xa00000 - #define PCIE_EP_CONFIG_DID_VID (PCIE_EP_CONFIG_BASE + 0x00) - #define PCIE_RC_CONFIG_RID_CCR (PCIE_RC_CONFIG_BASE + 0x08) --#define PCIE_RC_CONFIG_DCR (PCIE_RC_CONFIG_BASE + 0xc4) --#define PCIE_RC_CONFIG_DCR_CSPL_SHIFT 18 --#define PCIE_RC_CONFIG_DCR_CSPL_LIMIT 0xff --#define PCIE_RC_CONFIG_DCR_CPLS_SHIFT 26 --#define PCIE_RC_CONFIG_DCSR (PCIE_RC_CONFIG_BASE + 0xc8) --#define PCIE_RC_CONFIG_DCSR_MPS_MASK GENMASK(7, 5) --#define PCIE_RC_CONFIG_DCSR_MPS_256 (0x1 << 5) --#define PCIE_RC_CONFIG_LINK_CAP (PCIE_RC_CONFIG_BASE + 0xcc) --#define PCIE_RC_CONFIG_LINK_CAP_L0S BIT(10) --#define PCIE_RC_CONFIG_LCS (PCIE_RC_CONFIG_BASE + 0xd0) -+#define PCIE_RC_CONFIG_CR (PCIE_RC_CONFIG_BASE + 0xc0) - #define PCIE_RC_CONFIG_L1_SUBSTATE_CTRL2 (PCIE_RC_CONFIG_BASE + 0x90c) - #define PCIE_RC_CONFIG_THP_CAP (PCIE_RC_CONFIG_BASE + 0x274) - #define PCIE_RC_CONFIG_THP_CAP_NEXT_MASK GENMASK(31, 20) -diff --git a/drivers/pci/endpoint/pci-ep-cfs.c b/drivers/pci/endpoint/pci-ep-cfs.c -index 0ea64e24ed616b..c17dff4bd19b43 100644 ---- a/drivers/pci/endpoint/pci-ep-cfs.c -+++ b/drivers/pci/endpoint/pci-ep-cfs.c -@@ -683,6 +683,7 @@ void pci_ep_cfs_remove_epf_group(struct config_group *group) - if (IS_ERR_OR_NULL(group)) - return; - -+ list_del(&group->group_entry); - configfs_unregister_default_group(group); - } - EXPORT_SYMBOL(pci_ep_cfs_remove_epf_group); -diff --git a/drivers/pci/endpoint/pci-epf-core.c b/drivers/pci/endpoint/pci-epf-core.c -index 059f8639f21e92..03673ade6ce4df 100644 ---- a/drivers/pci/endpoint/pci-epf-core.c -+++ b/drivers/pci/endpoint/pci-epf-core.c -@@ -311,7 +311,7 @@ static void pci_epf_remove_cfs(struct pci_epf_driver *driver) - mutex_lock(&pci_epf_mutex); - list_for_each_entry_safe(group, tmp, &driver->epf_group, group_entry) - pci_ep_cfs_remove_epf_group(group); -- list_del(&driver->epf_group); -+ WARN_ON(!list_empty(&driver->epf_group)); - mutex_unlock(&pci_epf_mutex); - } - -diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c -index 05b7357bd25861..61bded8623d218 100644 ---- a/drivers/pci/pci-acpi.c -+++ b/drivers/pci/pci-acpi.c -@@ -793,13 +793,11 @@ int pci_acpi_program_hp_params(struct pci_dev *dev) - bool pciehp_is_native(struct pci_dev *bridge) - { - const struct pci_host_bridge *host; -- u32 slot_cap; - - if (!IS_ENABLED(CONFIG_HOTPLUG_PCI_PCIE)) - return false; - -- pcie_capability_read_dword(bridge, PCI_EXP_SLTCAP, &slot_cap); -- if (!(slot_cap & PCI_EXP_SLTCAP_HPC)) -+ if (!bridge->is_pciehp) - return false; - - if (pcie_ports_native) -diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c -index 4541dfbf0e1b63..df7f7e2ed0064a 100644 ---- a/drivers/pci/pci.c -+++ b/drivers/pci/pci.c -@@ -2475,7 +2475,7 @@ static void pci_pme_list_scan(struct work_struct *work) - * course of the call. - */ - if (bdev) { -- bref = pm_runtime_get_if_active(bdev, true); -+ bref = pm_runtime_get_if_active(bdev); - if (!bref) - continue; - -@@ -3065,8 +3065,12 @@ static const struct dmi_system_id bridge_d3_blacklist[] = { - * pci_bridge_d3_possible - Is it possible to put the bridge into D3 - * @bridge: Bridge to check - * -- * This function checks if it is possible to move the bridge to D3. -- * Currently we only allow D3 for recent enough PCIe ports and Thunderbolt. -+ * Currently we only allow D3 for some PCIe ports and for Thunderbolt. -+ * -+ * Return: Whether it is possible to move the bridge to D3. -+ * -+ * The return value is guaranteed to be constant across the entire lifetime -+ * of the bridge, including its hot-removal. - */ - bool pci_bridge_d3_possible(struct pci_dev *bridge) - { -diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c -index b7cec139d816ba..5557290b63dc15 100644 ---- a/drivers/pci/probe.c -+++ b/drivers/pci/probe.c -@@ -1594,7 +1594,7 @@ void set_pcie_hotplug_bridge(struct pci_dev *pdev) - - pcie_capability_read_dword(pdev, PCI_EXP_SLTCAP, ®32); - if (reg32 & PCI_EXP_SLTCAP_HPC) -- pdev->is_hotplug_bridge = 1; -+ pdev->is_hotplug_bridge = pdev->is_pciehp = 1; - } - - static void set_pcie_thunderbolt(struct pci_dev *dev) -diff --git a/drivers/perf/cxl_pmu.c b/drivers/perf/cxl_pmu.c -index 308c9969642e1f..c03df0f5288984 100644 ---- a/drivers/perf/cxl_pmu.c -+++ b/drivers/perf/cxl_pmu.c -@@ -881,7 +881,7 @@ static int cxl_pmu_probe(struct device *dev) - return rc; - irq = rc; - -- irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_overflow\n", dev_name); -+ irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_overflow", dev_name); - if (!irq_name) - return -ENOMEM; - -diff --git a/drivers/phy/qualcomm/phy-qcom-m31.c b/drivers/phy/qualcomm/phy-qcom-m31.c -index 89c9d74e35466c..a5e60039a264a2 100644 ---- a/drivers/phy/qualcomm/phy-qcom-m31.c -+++ b/drivers/phy/qualcomm/phy-qcom-m31.c -@@ -58,14 +58,16 @@ - #define USB2_0_TX_ENABLE BIT(2) - - #define USB2PHY_USB_PHY_M31_XCFGI_4 0xc8 -- #define HSTX_SLEW_RATE_565PS GENMASK(1, 0) -+ #define HSTX_SLEW_RATE_400PS GENMASK(2, 0) - #define PLL_CHARGING_PUMP_CURRENT_35UA GENMASK(4, 3) - #define ODT_VALUE_38_02_OHM GENMASK(7, 6) - - #define USB2PHY_USB_PHY_M31_XCFGI_5 0xcc -- #define ODT_VALUE_45_02_OHM BIT(2) - #define HSTX_PRE_EMPHASIS_LEVEL_0_55MA BIT(0) - -+#define USB2PHY_USB_PHY_M31_XCFGI_9 0xdc -+ #define HSTX_CURRENT_17_1MA_385MV BIT(1) -+ - #define USB2PHY_USB_PHY_M31_XCFGI_11 0xe4 - #define XCFG_COARSE_TUNE_NUM BIT(1) - #define XCFG_FINE_TUNE_NUM BIT(3) -@@ -120,7 +122,7 @@ static struct m31_phy_regs m31_ipq5332_regs[] = { - }, - { - USB2PHY_USB_PHY_M31_XCFGI_4, -- HSTX_SLEW_RATE_565PS | PLL_CHARGING_PUMP_CURRENT_35UA | ODT_VALUE_38_02_OHM, -+ HSTX_SLEW_RATE_400PS | PLL_CHARGING_PUMP_CURRENT_35UA | ODT_VALUE_38_02_OHM, - 0 - }, - { -@@ -130,9 +132,13 @@ static struct m31_phy_regs m31_ipq5332_regs[] = { - }, - { - USB2PHY_USB_PHY_M31_XCFGI_5, -- ODT_VALUE_45_02_OHM | HSTX_PRE_EMPHASIS_LEVEL_0_55MA, -+ HSTX_PRE_EMPHASIS_LEVEL_0_55MA, - 4 - }, -+ { -+ USB2PHY_USB_PHY_M31_XCFGI_9, -+ HSTX_CURRENT_17_1MA_385MV, -+ }, - { - USB_PHY_UTMI_CTRL5, - 0x0, -diff --git a/drivers/phy/rockchip/phy-rockchip-pcie.c b/drivers/phy/rockchip/phy-rockchip-pcie.c -index 8234b83fdd88c0..cbf3c140a138ee 100644 ---- a/drivers/phy/rockchip/phy-rockchip-pcie.c -+++ b/drivers/phy/rockchip/phy-rockchip-pcie.c -@@ -31,9 +31,8 @@ - #define PHY_CFG_ADDR_SHIFT 1 - #define PHY_CFG_DATA_MASK 0xf - #define PHY_CFG_ADDR_MASK 0x3f --#define PHY_CFG_RD_MASK 0x3ff - #define PHY_CFG_WR_ENABLE 1 --#define PHY_CFG_WR_DISABLE 1 -+#define PHY_CFG_WR_DISABLE 0 - #define PHY_CFG_WR_SHIFT 0 - #define PHY_CFG_WR_MASK 1 - #define PHY_CFG_PLL_LOCK 0x10 -diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c -index 84121b125d90ed..67c2791ee246f5 100644 ---- a/drivers/pinctrl/stm32/pinctrl-stm32.c -+++ b/drivers/pinctrl/stm32/pinctrl-stm32.c -@@ -418,6 +418,7 @@ static struct irq_chip stm32_gpio_irq_chip = { - .irq_set_wake = irq_chip_set_wake_parent, - .irq_request_resources = stm32_gpio_irq_request_resources, - .irq_release_resources = stm32_gpio_irq_release_resources, -+ .irq_set_affinity = IS_ENABLED(CONFIG_SMP) ? irq_chip_set_affinity_parent : NULL, - }; - - static int stm32_gpio_domain_translate(struct irq_domain *d, -diff --git a/drivers/platform/chrome/cros_ec.c b/drivers/platform/chrome/cros_ec.c -index 47d19f7e295a7a..e82f433e542ef0 100644 ---- a/drivers/platform/chrome/cros_ec.c -+++ b/drivers/platform/chrome/cros_ec.c -@@ -313,6 +313,9 @@ EXPORT_SYMBOL(cros_ec_register); - */ - void cros_ec_unregister(struct cros_ec_device *ec_dev) - { -+ if (ec_dev->mkbp_event_supported) -+ blocking_notifier_chain_unregister(&ec_dev->event_notifier, -+ &ec_dev->notifier_ready); - platform_device_unregister(ec_dev->pd); - platform_device_unregister(ec_dev->ec); - mutex_destroy(&ec_dev->lock); -diff --git a/drivers/platform/chrome/cros_ec_typec.c b/drivers/platform/chrome/cros_ec_typec.c -index 66fdc6fa73ec54..76807ceb313a97 100644 ---- a/drivers/platform/chrome/cros_ec_typec.c -+++ b/drivers/platform/chrome/cros_ec_typec.c -@@ -1179,8 +1179,8 @@ static int cros_typec_probe(struct platform_device *pdev) - - typec->ec = dev_get_drvdata(pdev->dev.parent); - if (!typec->ec) { -- dev_err(dev, "couldn't find parent EC device\n"); -- return -ENODEV; -+ dev_warn(dev, "couldn't find parent EC device\n"); -+ return -EPROBE_DEFER; - } - - platform_set_drvdata(pdev, typec); -diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c -index 7ed12c1d3b34c0..04686ae1e976bd 100644 ---- a/drivers/platform/x86/amd/pmc/pmc-quirks.c -+++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c -@@ -189,6 +189,15 @@ static const struct dmi_system_id fwbug_list[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "82XQ"), - } - }, -+ /* https://gitlab.freedesktop.org/drm/amd/-/issues/4434 */ -+ { -+ .ident = "Lenovo Yoga 6 13ALC6", -+ .driver_data = &quirk_s2idle_bug, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "82ND"), -+ } -+ }, - /* https://gitlab.freedesktop.org/drm/amd/-/issues/2684 */ - { - .ident = "HP Laptop 15s-eq2xxx", -diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c -index 8de0d3232e48c5..88364a5502e691 100644 ---- a/drivers/platform/x86/thinkpad_acpi.c -+++ b/drivers/platform/x86/thinkpad_acpi.c -@@ -537,12 +537,12 @@ static unsigned long __init tpacpi_check_quirks( - return 0; - } - --static inline bool __pure __init tpacpi_is_lenovo(void) -+static __always_inline bool __pure __init tpacpi_is_lenovo(void) - { - return thinkpad_id.vendor == PCI_VENDOR_ID_LENOVO; - } - --static inline bool __pure __init tpacpi_is_ibm(void) -+static __always_inline bool __pure __init tpacpi_is_ibm(void) - { - return thinkpad_id.vendor == PCI_VENDOR_ID_IBM; - } -diff --git a/drivers/pmdomain/imx/imx8m-blk-ctrl.c b/drivers/pmdomain/imx/imx8m-blk-ctrl.c -index cc5ef6e2f0a8cb..0dfaf1d14035de 100644 ---- a/drivers/pmdomain/imx/imx8m-blk-ctrl.c -+++ b/drivers/pmdomain/imx/imx8m-blk-ctrl.c -@@ -664,6 +664,11 @@ static const struct imx8m_blk_ctrl_data imx8mn_disp_blk_ctl_dev_data = { - #define LCDIF_1_RD_HURRY GENMASK(15, 13) - #define LCDIF_0_RD_HURRY GENMASK(12, 10) - -+#define ISI_CACHE_CTRL 0x50 -+#define ISI_V_WR_HURRY GENMASK(28, 26) -+#define ISI_U_WR_HURRY GENMASK(25, 23) -+#define ISI_Y_WR_HURRY GENMASK(22, 20) -+ - static int imx8mp_media_power_notifier(struct notifier_block *nb, - unsigned long action, void *data) - { -@@ -693,6 +698,11 @@ static int imx8mp_media_power_notifier(struct notifier_block *nb, - regmap_set_bits(bc->regmap, LCDIF_ARCACHE_CTRL, - FIELD_PREP(LCDIF_1_RD_HURRY, 7) | - FIELD_PREP(LCDIF_0_RD_HURRY, 7)); -+ /* Same here for ISI */ -+ regmap_set_bits(bc->regmap, ISI_CACHE_CTRL, -+ FIELD_PREP(ISI_V_WR_HURRY, 7) | -+ FIELD_PREP(ISI_U_WR_HURRY, 7) | -+ FIELD_PREP(ISI_Y_WR_HURRY, 7)); - } - - return NOTIFY_OK; -diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qcom_battmgr.c -index 5b3681b9100c1e..190e8a4cfa97f4 100644 ---- a/drivers/power/supply/qcom_battmgr.c -+++ b/drivers/power/supply/qcom_battmgr.c -@@ -977,6 +977,8 @@ static unsigned int qcom_battmgr_sc8280xp_parse_technology(const char *chemistry - { - if (!strncmp(chemistry, "LIO", BATTMGR_CHEMISTRY_LEN)) - return POWER_SUPPLY_TECHNOLOGY_LION; -+ if (!strncmp(chemistry, "LIP", BATTMGR_CHEMISTRY_LEN)) -+ return POWER_SUPPLY_TECHNOLOGY_LIPO; - - pr_err("Unknown battery technology '%s'\n", chemistry); - return POWER_SUPPLY_TECHNOLOGY_UNKNOWN; -diff --git a/drivers/pps/clients/pps-gpio.c b/drivers/pps/clients/pps-gpio.c -index bf3b6f1aa98425..41e1fdbcda165c 100644 ---- a/drivers/pps/clients/pps-gpio.c -+++ b/drivers/pps/clients/pps-gpio.c -@@ -206,8 +206,8 @@ static int pps_gpio_probe(struct platform_device *pdev) - } - - /* register IRQ interrupt handler */ -- ret = devm_request_irq(dev, data->irq, pps_gpio_irq_handler, -- get_irqf_trigger_flags(data), data->info.name, data); -+ ret = request_irq(data->irq, pps_gpio_irq_handler, -+ get_irqf_trigger_flags(data), data->info.name, data); - if (ret) { - pps_unregister_source(data->pps); - dev_err(dev, "failed to acquire IRQ %d\n", data->irq); -@@ -224,6 +224,7 @@ static int pps_gpio_remove(struct platform_device *pdev) - { - struct pps_gpio_device_data *data = platform_get_drvdata(pdev); - -+ free_irq(data->irq, data); - pps_unregister_source(data->pps); - del_timer_sync(&data->echo_timer); - /* reset echo pin in any case */ -diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c -index b7fc260ed43bc4..0682bb340221ab 100644 ---- a/drivers/ptp/ptp_clock.c -+++ b/drivers/ptp/ptp_clock.c -@@ -79,7 +79,7 @@ static int ptp_clock_settime(struct posix_clock *pc, const struct timespec64 *tp - struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock); - - if (ptp_clock_freerun(ptp)) { -- pr_err("ptp: physical clock is free running\n"); -+ pr_err_ratelimited("ptp: physical clock is free running\n"); - return -EBUSY; - } - -diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h -index a54124269c2f49..3fbd1d68a9bcb3 100644 ---- a/drivers/ptp/ptp_private.h -+++ b/drivers/ptp/ptp_private.h -@@ -20,6 +20,11 @@ - #define PTP_BUF_TIMESTAMPS 30 - #define PTP_DEFAULT_MAX_VCLOCKS 20 - -+enum { -+ PTP_LOCK_PHYSICAL = 0, -+ PTP_LOCK_VIRTUAL, -+}; -+ - struct timestamp_event_queue { - struct ptp_extts_event buf[PTP_MAX_TIMESTAMPS]; - int head; -diff --git a/drivers/ptp/ptp_vclock.c b/drivers/ptp/ptp_vclock.c -index dcf752c9e04506..7d08ff3b30fc27 100644 ---- a/drivers/ptp/ptp_vclock.c -+++ b/drivers/ptp/ptp_vclock.c -@@ -154,6 +154,11 @@ static long ptp_vclock_refresh(struct ptp_clock_info *ptp) - return PTP_VCLOCK_REFRESH_INTERVAL; - } - -+static void ptp_vclock_set_subclass(struct ptp_clock *ptp) -+{ -+ lockdep_set_subclass(&ptp->clock.rwsem, PTP_LOCK_VIRTUAL); -+} -+ - static const struct ptp_clock_info ptp_vclock_info = { - .owner = THIS_MODULE, - .name = "ptp virtual clock", -@@ -213,6 +218,8 @@ struct ptp_vclock *ptp_vclock_register(struct ptp_clock *pclock) - return NULL; - } - -+ ptp_vclock_set_subclass(vclock->clock); -+ - timecounter_init(&vclock->tc, &vclock->cc, 0); - ptp_schedule_worker(vclock->clock, PTP_VCLOCK_REFRESH_INTERVAL); - -diff --git a/drivers/pwm/pwm-imx-tpm.c b/drivers/pwm/pwm-imx-tpm.c -index 2fc6163eace315..6591f8f84ce8e7 100644 ---- a/drivers/pwm/pwm-imx-tpm.c -+++ b/drivers/pwm/pwm-imx-tpm.c -@@ -204,6 +204,15 @@ static int pwm_imx_tpm_apply_hw(struct pwm_chip *chip, - val |= FIELD_PREP(PWM_IMX_TPM_SC_PS, p->prescale); - writel(val, tpm->base + PWM_IMX_TPM_SC); - -+ /* -+ * if the counter is disabled (CMOD == 0), programming the new -+ * period length (MOD) will not reset the counter (CNT). If -+ * CNT.COUNT happens to be bigger than the new MOD value then -+ * the counter will end up being reset way too late. Therefore, -+ * manually reset it to 0. -+ */ -+ if (!cmod) -+ writel(0x0, tpm->base + PWM_IMX_TPM_CNT); - /* - * set period count: - * if the PWM is disabled (CMOD[1:0] = 2b00), then MOD register -diff --git a/drivers/pwm/pwm-mediatek.c b/drivers/pwm/pwm-mediatek.c -index ff7c70a0033d8a..34413607b86f4b 100644 ---- a/drivers/pwm/pwm-mediatek.c -+++ b/drivers/pwm/pwm-mediatek.c -@@ -118,6 +118,26 @@ static inline void pwm_mediatek_writel(struct pwm_mediatek_chip *chip, - writel(value, chip->regs + chip->soc->reg_offset[num] + offset); - } - -+static void pwm_mediatek_enable(struct pwm_chip *chip, struct pwm_device *pwm) -+{ -+ struct pwm_mediatek_chip *pc = to_pwm_mediatek_chip(chip); -+ u32 value; -+ -+ value = readl(pc->regs); -+ value |= BIT(pwm->hwpwm); -+ writel(value, pc->regs); -+} -+ -+static void pwm_mediatek_disable(struct pwm_chip *chip, struct pwm_device *pwm) -+{ -+ struct pwm_mediatek_chip *pc = to_pwm_mediatek_chip(chip); -+ u32 value; -+ -+ value = readl(pc->regs); -+ value &= ~BIT(pwm->hwpwm); -+ writel(value, pc->regs); -+} -+ - static int pwm_mediatek_config(struct pwm_chip *chip, struct pwm_device *pwm, - int duty_ns, int period_ns) - { -@@ -147,7 +167,10 @@ static int pwm_mediatek_config(struct pwm_chip *chip, struct pwm_device *pwm, - do_div(resolution, clk_rate); - - cnt_period = DIV_ROUND_CLOSEST_ULL((u64)period_ns * 1000, resolution); -- while (cnt_period > 8191) { -+ if (!cnt_period) -+ return -EINVAL; -+ -+ while (cnt_period > 8192) { - resolution *= 2; - clkdiv++; - cnt_period = DIV_ROUND_CLOSEST_ULL((u64)period_ns * 1000, -@@ -170,9 +193,16 @@ static int pwm_mediatek_config(struct pwm_chip *chip, struct pwm_device *pwm, - } - - cnt_duty = DIV_ROUND_CLOSEST_ULL((u64)duty_ns * 1000, resolution); -+ - pwm_mediatek_writel(pc, pwm->hwpwm, PWMCON, BIT(15) | clkdiv); -- pwm_mediatek_writel(pc, pwm->hwpwm, reg_width, cnt_period); -- pwm_mediatek_writel(pc, pwm->hwpwm, reg_thres, cnt_duty); -+ pwm_mediatek_writel(pc, pwm->hwpwm, reg_width, cnt_period - 1); -+ -+ if (cnt_duty) { -+ pwm_mediatek_writel(pc, pwm->hwpwm, reg_thres, cnt_duty - 1); -+ pwm_mediatek_enable(chip, pwm); -+ } else { -+ pwm_mediatek_disable(chip, pwm); -+ } - - out: - pwm_mediatek_clk_disable(chip, pwm); -@@ -180,35 +210,6 @@ static int pwm_mediatek_config(struct pwm_chip *chip, struct pwm_device *pwm, - return ret; - } - --static int pwm_mediatek_enable(struct pwm_chip *chip, struct pwm_device *pwm) --{ -- struct pwm_mediatek_chip *pc = to_pwm_mediatek_chip(chip); -- u32 value; -- int ret; -- -- ret = pwm_mediatek_clk_enable(chip, pwm); -- if (ret < 0) -- return ret; -- -- value = readl(pc->regs); -- value |= BIT(pwm->hwpwm); -- writel(value, pc->regs); -- -- return 0; --} -- --static void pwm_mediatek_disable(struct pwm_chip *chip, struct pwm_device *pwm) --{ -- struct pwm_mediatek_chip *pc = to_pwm_mediatek_chip(chip); -- u32 value; -- -- value = readl(pc->regs); -- value &= ~BIT(pwm->hwpwm); -- writel(value, pc->regs); -- -- pwm_mediatek_clk_disable(chip, pwm); --} -- - static int pwm_mediatek_apply(struct pwm_chip *chip, struct pwm_device *pwm, - const struct pwm_state *state) - { -@@ -218,8 +219,10 @@ static int pwm_mediatek_apply(struct pwm_chip *chip, struct pwm_device *pwm, - return -EINVAL; - - if (!state->enabled) { -- if (pwm->state.enabled) -+ if (pwm->state.enabled) { - pwm_mediatek_disable(chip, pwm); -+ pwm_mediatek_clk_disable(chip, pwm); -+ } - - return 0; - } -@@ -229,7 +232,7 @@ static int pwm_mediatek_apply(struct pwm_chip *chip, struct pwm_device *pwm, - return err; - - if (!pwm->state.enabled) -- err = pwm_mediatek_enable(chip, pwm); -+ err = pwm_mediatek_clk_enable(chip, pwm); - - return err; - } -diff --git a/drivers/remoteproc/imx_rproc.c b/drivers/remoteproc/imx_rproc.c -index 610a69928dff2a..251f9840d85bd8 100644 ---- a/drivers/remoteproc/imx_rproc.c -+++ b/drivers/remoteproc/imx_rproc.c -@@ -1088,8 +1088,8 @@ static int imx_rproc_clk_enable(struct imx_rproc *priv) - struct device *dev = priv->dev; - int ret; - -- /* Remote core is not under control of Linux */ -- if (dcfg->method == IMX_RPROC_NONE) -+ /* Remote core is not under control of Linux or it is managed by SCU API */ -+ if (dcfg->method == IMX_RPROC_NONE || dcfg->method == IMX_RPROC_SCU_API) - return 0; - - priv->clk = devm_clk_get(dev, NULL); -diff --git a/drivers/reset/Kconfig b/drivers/reset/Kconfig -index ccd59ddd76100a..9f25eb3aec2561 100644 ---- a/drivers/reset/Kconfig -+++ b/drivers/reset/Kconfig -@@ -51,8 +51,8 @@ config RESET_BERLIN - - config RESET_BRCMSTB - tristate "Broadcom STB reset controller" -- depends on ARCH_BRCMSTB || COMPILE_TEST -- default ARCH_BRCMSTB -+ depends on ARCH_BRCMSTB || ARCH_BCM2835 || COMPILE_TEST -+ default ARCH_BRCMSTB || ARCH_BCM2835 - help - This enables the reset controller driver for Broadcom STB SoCs using - a SUN_TOP_CTRL_SW_INIT style controller. -@@ -60,11 +60,11 @@ config RESET_BRCMSTB - config RESET_BRCMSTB_RESCAL - tristate "Broadcom STB RESCAL reset controller" - depends on HAS_IOMEM -- depends on ARCH_BRCMSTB || COMPILE_TEST -- default ARCH_BRCMSTB -+ depends on ARCH_BRCMSTB || ARCH_BCM2835 || COMPILE_TEST -+ default ARCH_BRCMSTB || ARCH_BCM2835 - help - This enables the RESCAL reset controller for SATA, PCIe0, or PCIe1 on -- BCM7216. -+ BCM7216 or the BCM2712. - - config RESET_HSDK - bool "Synopsys HSDK Reset Driver" -diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c -index e14981383c0125..74aad2b12460c3 100644 ---- a/drivers/rtc/rtc-ds1307.c -+++ b/drivers/rtc/rtc-ds1307.c -@@ -274,6 +274,13 @@ static int ds1307_get_time(struct device *dev, struct rtc_time *t) - if (tmp & DS1340_BIT_OSF) - return -EINVAL; - break; -+ case ds_1341: -+ ret = regmap_read(ds1307->regmap, DS1337_REG_STATUS, &tmp); -+ if (ret) -+ return ret; -+ if (tmp & DS1337_BIT_OSF) -+ return -EINVAL; -+ break; - case ds_1388: - ret = regmap_read(ds1307->regmap, DS1388_REG_FLAG, &tmp); - if (ret) -@@ -372,6 +379,10 @@ static int ds1307_set_time(struct device *dev, struct rtc_time *t) - regmap_update_bits(ds1307->regmap, DS1340_REG_FLAG, - DS1340_BIT_OSF, 0); - break; -+ case ds_1341: -+ regmap_update_bits(ds1307->regmap, DS1337_REG_STATUS, -+ DS1337_BIT_OSF, 0); -+ break; - case ds_1388: - regmap_update_bits(ds1307->regmap, DS1388_REG_FLAG, - DS1388_BIT_OSF, 0); -@@ -1808,10 +1819,8 @@ static int ds1307_probe(struct i2c_client *client) - regmap_write(ds1307->regmap, DS1337_REG_CONTROL, - regs[0]); - -- /* oscillator fault? clear flag, and warn */ -+ /* oscillator fault? warn */ - if (regs[1] & DS1337_BIT_OSF) { -- regmap_write(ds1307->regmap, DS1337_REG_STATUS, -- regs[1] & ~DS1337_BIT_OSF); - dev_warn(ds1307->dev, "SET TIME!\n"); - } - break; -diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c -index 6fa0fb35e5210f..3409822dfbb41d 100644 ---- a/drivers/s390/char/sclp.c -+++ b/drivers/s390/char/sclp.c -@@ -76,6 +76,13 @@ unsigned long sclp_console_full; - /* The currently active SCLP command word. */ - static sclp_cmdw_t active_cmd; - -+static inline struct sccb_header *sclpint_to_sccb(u32 sccb_int) -+{ -+ if (sccb_int) -+ return __va(sccb_int); -+ return NULL; -+} -+ - static inline void sclp_trace(int prio, char *id, u32 a, u64 b, bool err) - { - struct sclp_trace_entry e; -@@ -620,7 +627,7 @@ __sclp_find_req(u32 sccb) - - static bool ok_response(u32 sccb_int, sclp_cmdw_t cmd) - { -- struct sccb_header *sccb = (struct sccb_header *)__va(sccb_int); -+ struct sccb_header *sccb = sclpint_to_sccb(sccb_int); - struct evbuf_header *evbuf; - u16 response; - -@@ -659,7 +666,7 @@ static void sclp_interrupt_handler(struct ext_code ext_code, - - /* INT: Interrupt received (a=intparm, b=cmd) */ - sclp_trace_sccb(0, "INT", param32, active_cmd, active_cmd, -- (struct sccb_header *)__va(finished_sccb), -+ sclpint_to_sccb(finished_sccb), - !ok_response(finished_sccb, active_cmd)); - - if (finished_sccb) { -diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c -index 0f64b024430376..31b95e6c96c5fe 100644 ---- a/drivers/scsi/aacraid/comminit.c -+++ b/drivers/scsi/aacraid/comminit.c -@@ -481,8 +481,7 @@ void aac_define_int_mode(struct aac_dev *dev) - pci_find_capability(dev->pdev, PCI_CAP_ID_MSIX)) { - min_msix = 2; - i = pci_alloc_irq_vectors(dev->pdev, -- min_msix, msi_count, -- PCI_IRQ_MSIX | PCI_IRQ_AFFINITY); -+ min_msix, msi_count, PCI_IRQ_MSIX); - if (i > 0) { - dev->msi_enabled = 1; - msi_count = i; -diff --git a/drivers/scsi/bfa/bfad_im.c b/drivers/scsi/bfa/bfad_im.c -index a9d3d8562d3c17..0ec76d1cb6fbe9 100644 ---- a/drivers/scsi/bfa/bfad_im.c -+++ b/drivers/scsi/bfa/bfad_im.c -@@ -706,6 +706,7 @@ bfad_im_probe(struct bfad_s *bfad) - - if (bfad_thread_workq(bfad) != BFA_STATUS_OK) { - kfree(im); -+ bfad->im = NULL; - return BFA_STATUS_FAILED; - } - -diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c -index 0fda8905eabd82..916c076484608a 100644 ---- a/drivers/scsi/libiscsi.c -+++ b/drivers/scsi/libiscsi.c -@@ -3184,7 +3184,8 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size, - return NULL; - conn = cls_conn->dd_data; - -- conn->dd_data = cls_conn->dd_data + sizeof(*conn); -+ if (dd_size) -+ conn->dd_data = cls_conn->dd_data + sizeof(*conn); - conn->session = session; - conn->cls_conn = cls_conn; - conn->c_stage = ISCSI_CONN_INITIAL_STAGE; -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c -index 20662b4f339eb3..6b6c964e8076e2 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.c -+++ b/drivers/scsi/lpfc/lpfc_debugfs.c -@@ -6291,7 +6291,6 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - } - phba->nvmeio_trc_on = 1; - phba->nvmeio_trc_output_idx = 0; -- phba->nvmeio_trc = NULL; - } else { - nvmeio_off: - phba->nvmeio_trc_size = 0; -diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c -index 070654cc929208..dcbb2432c978bc 100644 ---- a/drivers/scsi/lpfc/lpfc_scsi.c -+++ b/drivers/scsi/lpfc/lpfc_scsi.c -@@ -390,6 +390,10 @@ lpfc_sli4_vport_delete_fcp_xri_aborted(struct lpfc_vport *vport) - if (!(vport->cfg_enable_fc4_type & LPFC_ENABLE_FCP)) - return; - -+ /* may be called before queues established if hba_setup fails */ -+ if (!phba->sli4_hba.hdwq) -+ return; -+ - spin_lock_irqsave(&phba->hbalock, iflag); - for (idx = 0; idx < phba->cfg_hdw_queue; idx++) { - qp = &phba->sli4_hba.hdwq[idx]; -diff --git a/drivers/scsi/mpi3mr/mpi3mr.h b/drivers/scsi/mpi3mr/mpi3mr.h -index ae98d15c30b1dd..90da783457fbff 100644 ---- a/drivers/scsi/mpi3mr/mpi3mr.h -+++ b/drivers/scsi/mpi3mr/mpi3mr.h -@@ -1025,6 +1025,8 @@ struct scmd_priv { - * @logdata_buf: Circular buffer to store log data entries - * @logdata_buf_idx: Index of entry in buffer to store - * @logdata_entry_sz: log data entry size -+ * @adm_req_q_bar_writeq_lock: Admin request queue lock -+ * @adm_reply_q_bar_writeq_lock: Admin reply queue lock - * @pend_large_data_sz: Counter to track pending large data - * @io_throttle_data_length: I/O size to track in 512b blocks - * @io_throttle_high: I/O size to start throttle in 512b blocks -@@ -1055,7 +1057,7 @@ struct mpi3mr_ioc { - char name[MPI3MR_NAME_LENGTH]; - char driver_name[MPI3MR_NAME_LENGTH]; - -- volatile struct mpi3_sysif_registers __iomem *sysif_regs; -+ struct mpi3_sysif_registers __iomem *sysif_regs; - resource_size_t sysif_regs_phys; - int bars; - u64 dma_mask; -@@ -1207,6 +1209,8 @@ struct mpi3mr_ioc { - u8 *logdata_buf; - u16 logdata_buf_idx; - u16 logdata_entry_sz; -+ spinlock_t adm_req_q_bar_writeq_lock; -+ spinlock_t adm_reply_q_bar_writeq_lock; - - atomic_t pend_large_data_sz; - u32 io_throttle_data_length; -diff --git a/drivers/scsi/mpi3mr/mpi3mr_fw.c b/drivers/scsi/mpi3mr/mpi3mr_fw.c -index 60714a6c26375e..b03e4b8cb67d66 100644 ---- a/drivers/scsi/mpi3mr/mpi3mr_fw.c -+++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c -@@ -23,17 +23,22 @@ module_param(poll_queues, int, 0444); - MODULE_PARM_DESC(poll_queues, "Number of queues for io_uring poll mode. (Range 1 - 126)"); - - #if defined(writeq) && defined(CONFIG_64BIT) --static inline void mpi3mr_writeq(__u64 b, volatile void __iomem *addr) -+static inline void mpi3mr_writeq(__u64 b, void __iomem *addr, -+ spinlock_t *write_queue_lock) - { - writeq(b, addr); - } - #else --static inline void mpi3mr_writeq(__u64 b, volatile void __iomem *addr) -+static inline void mpi3mr_writeq(__u64 b, void __iomem *addr, -+ spinlock_t *write_queue_lock) - { - __u64 data_out = b; -+ unsigned long flags; - -+ spin_lock_irqsave(write_queue_lock, flags); - writel((u32)(data_out), addr); - writel((u32)(data_out >> 32), (addr + 4)); -+ spin_unlock_irqrestore(write_queue_lock, flags); - } - #endif - -@@ -411,8 +416,8 @@ static void mpi3mr_process_admin_reply_desc(struct mpi3mr_ioc *mrioc, - MPI3MR_SENSE_BUF_SZ); - } - if (cmdptr->is_waiting) { -- complete(&cmdptr->done); - cmdptr->is_waiting = 0; -+ complete(&cmdptr->done); - } else if (cmdptr->callback) - cmdptr->callback(mrioc, cmdptr); - } -@@ -2666,9 +2671,11 @@ static int mpi3mr_setup_admin_qpair(struct mpi3mr_ioc *mrioc) - (mrioc->num_admin_req); - writel(num_admin_entries, &mrioc->sysif_regs->admin_queue_num_entries); - mpi3mr_writeq(mrioc->admin_req_dma, -- &mrioc->sysif_regs->admin_request_queue_address); -+ &mrioc->sysif_regs->admin_request_queue_address, -+ &mrioc->adm_req_q_bar_writeq_lock); - mpi3mr_writeq(mrioc->admin_reply_dma, -- &mrioc->sysif_regs->admin_reply_queue_address); -+ &mrioc->sysif_regs->admin_reply_queue_address, -+ &mrioc->adm_reply_q_bar_writeq_lock); - writel(mrioc->admin_req_pi, &mrioc->sysif_regs->admin_request_queue_pi); - writel(mrioc->admin_reply_ci, &mrioc->sysif_regs->admin_reply_queue_ci); - return retval; -diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c -index 7880675a68dba6..1bf3572c7aac44 100644 ---- a/drivers/scsi/mpi3mr/mpi3mr_os.c -+++ b/drivers/scsi/mpi3mr/mpi3mr_os.c -@@ -49,6 +49,13 @@ static void mpi3mr_send_event_ack(struct mpi3mr_ioc *mrioc, u8 event, - - #define MPI3_EVENT_WAIT_FOR_DEVICES_TO_REFRESH (0xFFFE) - -+/* -+ * SAS Log info code for a NCQ collateral abort after an NCQ error: -+ * IOC_LOGINFO_PREFIX_PL | PL_LOGINFO_CODE_SATA_NCQ_FAIL_ALL_CMDS_AFTR_ERR -+ * See: drivers/message/fusion/lsi/mpi_log_sas.h -+ */ -+#define IOC_LOGINFO_SATA_NCQ_FAIL_AFTER_ERR 0x31080000 -+ - /** - * mpi3mr_host_tag_for_scmd - Get host tag for a scmd - * @mrioc: Adapter instance reference -@@ -3270,7 +3277,18 @@ void mpi3mr_process_op_reply_desc(struct mpi3mr_ioc *mrioc, - scmd->result = DID_NO_CONNECT << 16; - break; - case MPI3_IOCSTATUS_SCSI_IOC_TERMINATED: -- scmd->result = DID_SOFT_ERROR << 16; -+ if (ioc_loginfo == IOC_LOGINFO_SATA_NCQ_FAIL_AFTER_ERR) { -+ /* -+ * This is a ATA NCQ command aborted due to another NCQ -+ * command failure. We must retry this command -+ * immediately but without incrementing its retry -+ * counter. -+ */ -+ WARN_ON_ONCE(xfer_count != 0); -+ scmd->result = DID_IMM_RETRY << 16; -+ } else { -+ scmd->result = DID_SOFT_ERROR << 16; -+ } - break; - case MPI3_IOCSTATUS_SCSI_TASK_TERMINATED: - case MPI3_IOCSTATUS_SCSI_EXT_TERMINATED: -@@ -5084,6 +5102,8 @@ mpi3mr_probe(struct pci_dev *pdev, const struct pci_device_id *id) - spin_lock_init(&mrioc->tgtdev_lock); - spin_lock_init(&mrioc->watchdog_lock); - spin_lock_init(&mrioc->chain_buf_lock); -+ spin_lock_init(&mrioc->adm_req_q_bar_writeq_lock); -+ spin_lock_init(&mrioc->adm_reply_q_bar_writeq_lock); - spin_lock_init(&mrioc->sas_node_lock); - - INIT_LIST_HEAD(&mrioc->fwevt_list); -diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -index 0afa485fb300ca..7bef42a2fb5762 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -@@ -196,6 +196,14 @@ struct sense_info { - #define MPT3SAS_PORT_ENABLE_COMPLETE (0xFFFD) - #define MPT3SAS_ABRT_TASK_SET (0xFFFE) - #define MPT3SAS_REMOVE_UNRESPONDING_DEVICES (0xFFFF) -+ -+/* -+ * SAS Log info code for a NCQ collateral abort after an NCQ error: -+ * IOC_LOGINFO_PREFIX_PL | PL_LOGINFO_CODE_SATA_NCQ_FAIL_ALL_CMDS_AFTR_ERR -+ * See: drivers/message/fusion/lsi/mpi_log_sas.h -+ */ -+#define IOC_LOGINFO_SATA_NCQ_FAIL_AFTER_ERR 0x31080000 -+ - /** - * struct fw_event_work - firmware event struct - * @list: link list framework -@@ -5824,6 +5832,17 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply) - scmd->result = DID_TRANSPORT_DISRUPTED << 16; - goto out; - } -+ if (log_info == IOC_LOGINFO_SATA_NCQ_FAIL_AFTER_ERR) { -+ /* -+ * This is a ATA NCQ command aborted due to another NCQ -+ * command failure. We must retry this command -+ * immediately but without incrementing its retry -+ * counter. -+ */ -+ WARN_ON_ONCE(xfer_cnt != 0); -+ scmd->result = DID_IMM_RETRY << 16; -+ break; -+ } - if (log_info == 0x31110630) { - if (scmd->retries > 2) { - scmd->result = DID_NO_CONNECT << 16; -diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c -index 77c28d2ebf0137..d91efd7c983ce0 100644 ---- a/drivers/scsi/qla4xxx/ql4_os.c -+++ b/drivers/scsi/qla4xxx/ql4_os.c -@@ -6606,6 +6606,8 @@ static struct iscsi_endpoint *qla4xxx_get_ep_fwdb(struct scsi_qla_host *ha, - - ep = qla4xxx_ep_connect(ha->host, (struct sockaddr *)dst_addr, 0); - vfree(dst_addr); -+ if (IS_ERR(ep)) -+ return NULL; - return ep; - } - -diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c -index cead0fbbe5dbdf..8ee74dddef16e0 100644 ---- a/drivers/scsi/scsi_scan.c -+++ b/drivers/scsi/scsi_scan.c -@@ -1851,7 +1851,7 @@ int scsi_scan_host_selected(struct Scsi_Host *shost, unsigned int channel, - - return 0; - } -- -+EXPORT_SYMBOL(scsi_scan_host_selected); - static void scsi_sysfs_add_devices(struct Scsi_Host *shost) - { - struct scsi_device *sdev; -diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c -index 7fdd2b61fe855e..7b4c4752e21609 100644 ---- a/drivers/scsi/scsi_transport_sas.c -+++ b/drivers/scsi/scsi_transport_sas.c -@@ -40,6 +40,8 @@ - #include - - #include "scsi_sas_internal.h" -+#include "scsi_priv.h" -+ - struct sas_host_attrs { - struct list_head rphy_list; - struct mutex lock; -@@ -1681,32 +1683,66 @@ int scsi_is_sas_rphy(const struct device *dev) - } - EXPORT_SYMBOL(scsi_is_sas_rphy); - -- --/* -- * SCSI scan helper -- */ -- --static int sas_user_scan(struct Scsi_Host *shost, uint channel, -- uint id, u64 lun) -+static void scan_channel_zero(struct Scsi_Host *shost, uint id, u64 lun) - { - struct sas_host_attrs *sas_host = to_sas_host_attrs(shost); - struct sas_rphy *rphy; - -- mutex_lock(&sas_host->lock); - list_for_each_entry(rphy, &sas_host->rphy_list, list) { - if (rphy->identify.device_type != SAS_END_DEVICE || - rphy->scsi_target_id == -1) - continue; - -- if ((channel == SCAN_WILD_CARD || channel == 0) && -- (id == SCAN_WILD_CARD || id == rphy->scsi_target_id)) { -+ if (id == SCAN_WILD_CARD || id == rphy->scsi_target_id) { - scsi_scan_target(&rphy->dev, 0, rphy->scsi_target_id, - lun, SCSI_SCAN_MANUAL); - } - } -- mutex_unlock(&sas_host->lock); -+} - -- return 0; -+/* -+ * SCSI scan helper -+ */ -+ -+static int sas_user_scan(struct Scsi_Host *shost, uint channel, -+ uint id, u64 lun) -+{ -+ struct sas_host_attrs *sas_host = to_sas_host_attrs(shost); -+ int res = 0; -+ int i; -+ -+ switch (channel) { -+ case 0: -+ mutex_lock(&sas_host->lock); -+ scan_channel_zero(shost, id, lun); -+ mutex_unlock(&sas_host->lock); -+ break; -+ -+ case SCAN_WILD_CARD: -+ mutex_lock(&sas_host->lock); -+ scan_channel_zero(shost, id, lun); -+ mutex_unlock(&sas_host->lock); -+ -+ for (i = 1; i <= shost->max_channel; i++) { -+ res = scsi_scan_host_selected(shost, i, id, lun, -+ SCSI_SCAN_MANUAL); -+ if (res) -+ goto exit_scan; -+ } -+ break; -+ -+ default: -+ if (channel < shost->max_channel) { -+ res = scsi_scan_host_selected(shost, channel, id, lun, -+ SCSI_SCAN_MANUAL); -+ } else { -+ res = -EINVAL; -+ } -+ break; -+ } -+ -+exit_scan: -+ return res; - } - - -diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c -index 6f177e46fa0f8e..a6773075bfe3ef 100644 ---- a/drivers/soc/qcom/mdt_loader.c -+++ b/drivers/soc/qcom/mdt_loader.c -@@ -17,6 +17,37 @@ - #include - #include - -+static bool mdt_header_valid(const struct firmware *fw) -+{ -+ const struct elf32_hdr *ehdr; -+ size_t phend; -+ size_t shend; -+ -+ if (fw->size < sizeof(*ehdr)) -+ return false; -+ -+ ehdr = (struct elf32_hdr *)fw->data; -+ -+ if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG)) -+ return false; -+ -+ if (ehdr->e_phentsize != sizeof(struct elf32_phdr)) -+ return false; -+ -+ phend = size_add(size_mul(sizeof(struct elf32_phdr), ehdr->e_phnum), ehdr->e_phoff); -+ if (phend > fw->size) -+ return false; -+ -+ if (ehdr->e_shentsize != sizeof(struct elf32_shdr)) -+ return false; -+ -+ shend = size_add(size_mul(sizeof(struct elf32_shdr), ehdr->e_shnum), ehdr->e_shoff); -+ if (shend > fw->size) -+ return false; -+ -+ return true; -+} -+ - static bool mdt_phdr_valid(const struct elf32_phdr *phdr) - { - if (phdr->p_type != PT_LOAD) -@@ -84,8 +115,11 @@ ssize_t qcom_mdt_get_size(const struct firmware *fw) - phys_addr_t max_addr = 0; - int i; - -+ if (!mdt_header_valid(fw)) -+ return -EINVAL; -+ - ehdr = (struct elf32_hdr *)fw->data; -- phdrs = (struct elf32_phdr *)(ehdr + 1); -+ phdrs = (struct elf32_phdr *)(fw->data + ehdr->e_phoff); - - for (i = 0; i < ehdr->e_phnum; i++) { - phdr = &phdrs[i]; -@@ -136,8 +170,11 @@ void *qcom_mdt_read_metadata(const struct firmware *fw, size_t *data_len, - ssize_t ret; - void *data; - -+ if (!mdt_header_valid(fw)) -+ return ERR_PTR(-EINVAL); -+ - ehdr = (struct elf32_hdr *)fw->data; -- phdrs = (struct elf32_phdr *)(ehdr + 1); -+ phdrs = (struct elf32_phdr *)(fw->data + ehdr->e_phoff); - - if (ehdr->e_phnum < 2) - return ERR_PTR(-EINVAL); -@@ -216,8 +253,11 @@ int qcom_mdt_pas_init(struct device *dev, const struct firmware *fw, - int ret; - int i; - -+ if (!mdt_header_valid(fw)) -+ return -EINVAL; -+ - ehdr = (struct elf32_hdr *)fw->data; -- phdrs = (struct elf32_phdr *)(ehdr + 1); -+ phdrs = (struct elf32_phdr *)(fw->data + ehdr->e_phoff); - - for (i = 0; i < ehdr->e_phnum; i++) { - phdr = &phdrs[i]; -@@ -272,7 +312,7 @@ static bool qcom_mdt_bins_are_split(const struct firmware *fw, const char *fw_na - int i; - - ehdr = (struct elf32_hdr *)fw->data; -- phdrs = (struct elf32_phdr *)(ehdr + 1); -+ phdrs = (struct elf32_phdr *)(fw->data + ehdr->e_phoff); - - for (i = 0; i < ehdr->e_phnum; i++) { - /* -@@ -312,9 +352,12 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw, - if (!fw || !mem_region || !mem_phys || !mem_size) - return -EINVAL; - -+ if (!mdt_header_valid(fw)) -+ return -EINVAL; -+ - is_split = qcom_mdt_bins_are_split(fw, fw_name); - ehdr = (struct elf32_hdr *)fw->data; -- phdrs = (struct elf32_phdr *)(ehdr + 1); -+ phdrs = (struct elf32_phdr *)(fw->data + ehdr->e_phoff); - - for (i = 0; i < ehdr->e_phnum; i++) { - phdr = &phdrs[i]; -diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c -index dfc2d4e38fa9b9..163a58eb02e0a2 100644 ---- a/drivers/soc/qcom/rpmh-rsc.c -+++ b/drivers/soc/qcom/rpmh-rsc.c -@@ -1075,7 +1075,7 @@ static int rpmh_rsc_probe(struct platform_device *pdev) - drv->ver.minor = rsc_id & (MINOR_VER_MASK << MINOR_VER_SHIFT); - drv->ver.minor >>= MINOR_VER_SHIFT; - -- if (drv->ver.major == 3) -+ if (drv->ver.major >= 3) - drv->regs = rpmh_rsc_reg_offset_ver_3_0; - else - drv->regs = rpmh_rsc_reg_offset_ver_2_7; -diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c -index 162f52456f654e..1306e3b8b5c04b 100644 ---- a/drivers/soc/tegra/pmc.c -+++ b/drivers/soc/tegra/pmc.c -@@ -1232,7 +1232,7 @@ static int tegra_powergate_of_get_clks(struct tegra_powergate *pg, - } - - static int tegra_powergate_of_get_resets(struct tegra_powergate *pg, -- struct device_node *np, bool off) -+ struct device_node *np) - { - struct device *dev = pg->pmc->dev; - int err; -@@ -1247,22 +1247,6 @@ static int tegra_powergate_of_get_resets(struct tegra_powergate *pg, - err = reset_control_acquire(pg->reset); - if (err < 0) { - pr_err("failed to acquire resets: %d\n", err); -- goto out; -- } -- -- if (off) { -- err = reset_control_assert(pg->reset); -- } else { -- err = reset_control_deassert(pg->reset); -- if (err < 0) -- goto out; -- -- reset_control_release(pg->reset); -- } -- --out: -- if (err) { -- reset_control_release(pg->reset); - reset_control_put(pg->reset); - } - -@@ -1307,20 +1291,43 @@ static int tegra_powergate_add(struct tegra_pmc *pmc, struct device_node *np) - goto set_available; - } - -- err = tegra_powergate_of_get_resets(pg, np, off); -+ err = tegra_powergate_of_get_resets(pg, np); - if (err < 0) { - dev_err(dev, "failed to get resets for %pOFn: %d\n", np, err); - goto remove_clks; - } - -- if (!IS_ENABLED(CONFIG_PM_GENERIC_DOMAINS)) { -- if (off) -- WARN_ON(tegra_powergate_power_up(pg, true)); -+ /* -+ * If the power-domain is off, then ensure the resets are asserted. -+ * If the power-domain is on, then power down to ensure that when is -+ * it turned on the power-domain, clocks and resets are all in the -+ * expected state. -+ */ -+ if (off) { -+ err = reset_control_assert(pg->reset); -+ if (err) { -+ pr_err("failed to assert resets: %d\n", err); -+ goto remove_resets; -+ } -+ } else { -+ err = tegra_powergate_power_down(pg); -+ if (err) { -+ dev_err(dev, "failed to turn off PM domain %s: %d\n", -+ pg->genpd.name, err); -+ goto remove_resets; -+ } -+ } - -+ /* -+ * If PM_GENERIC_DOMAINS is not enabled, power-on -+ * the domain and skip the genpd registration. -+ */ -+ if (!IS_ENABLED(CONFIG_PM_GENERIC_DOMAINS)) { -+ WARN_ON(tegra_powergate_power_up(pg, true)); - goto remove_resets; - } - -- err = pm_genpd_init(&pg->genpd, NULL, off); -+ err = pm_genpd_init(&pg->genpd, NULL, true); - if (err < 0) { - dev_err(dev, "failed to initialise PM domain %pOFn: %d\n", np, - err); -diff --git a/drivers/soundwire/amd_manager.c b/drivers/soundwire/amd_manager.c -index b89f8067e6cdd7..3d8937245c1807 100644 ---- a/drivers/soundwire/amd_manager.c -+++ b/drivers/soundwire/amd_manager.c -@@ -1104,10 +1104,10 @@ static int __maybe_unused amd_pm_prepare(struct device *dev) - * device is not in runtime suspend state, observed that device alerts are missing - * without pm_prepare on AMD platforms in clockstop mode0. - */ -- if (amd_manager->power_mode_mask & AMD_SDW_CLK_STOP_MODE) { -- ret = pm_request_resume(dev); -+ if (amd_manager->power_mode_mask) { -+ ret = pm_runtime_resume(dev); - if (ret < 0) { -- dev_err(bus->dev, "pm_request_resume failed: %d\n", ret); -+ dev_err(bus->dev, "pm_runtime_resume failed: %d\n", ret); - return 0; - } - } -diff --git a/drivers/soundwire/bus.c b/drivers/soundwire/bus.c -index 767942f19adb6a..e7397fd8e9ad94 100644 ---- a/drivers/soundwire/bus.c -+++ b/drivers/soundwire/bus.c -@@ -1730,15 +1730,15 @@ static int sdw_handle_slave_alerts(struct sdw_slave *slave) - - /* Update the Slave driver */ - if (slave_notify) { -+ if (slave->prop.use_domain_irq && slave->irq) -+ handle_nested_irq(slave->irq); -+ - mutex_lock(&slave->sdw_dev_lock); - - if (slave->probed) { - struct device *dev = &slave->dev; - struct sdw_driver *drv = drv_to_sdw_driver(dev->driver); - -- if (slave->prop.use_domain_irq && slave->irq) -- handle_nested_irq(slave->irq); -- - if (drv->ops && drv->ops->interrupt_callback) { - slave_intr.sdca_cascade = sdca_cascade; - slave_intr.control_port = clear; -diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c -index 9e2541dee56e57..fa899ab2014c6a 100644 ---- a/drivers/spi/spi-fsl-lpspi.c -+++ b/drivers/spi/spi-fsl-lpspi.c -@@ -330,13 +330,11 @@ static int fsl_lpspi_set_bitrate(struct fsl_lpspi_data *fsl_lpspi) - } - - if (config.speed_hz > perclk_rate / 2) { -- dev_err(fsl_lpspi->dev, -- "per-clk should be at least two times of transfer speed"); -- return -EINVAL; -+ div = 2; -+ } else { -+ div = DIV_ROUND_UP(perclk_rate, config.speed_hz); - } - -- div = DIV_ROUND_UP(perclk_rate, config.speed_hz); -- - for (prescale = 0; prescale <= prescale_max; prescale++) { - scldiv = div / (1 << prescale) - 2; - if (scldiv >= 0 && scldiv < 256) { -diff --git a/drivers/staging/media/imx/imx-media-csc-scaler.c b/drivers/staging/media/imx/imx-media-csc-scaler.c -index 95cca281e8a378..07104e7f5a5f9d 100644 ---- a/drivers/staging/media/imx/imx-media-csc-scaler.c -+++ b/drivers/staging/media/imx/imx-media-csc-scaler.c -@@ -914,7 +914,7 @@ imx_media_csc_scaler_device_init(struct imx_media_dev *md) - return &priv->vdev; - - err_m2m: -- video_set_drvdata(vfd, NULL); -+ video_device_release(vfd); - err_vfd: - kfree(priv); - return ERR_PTR(ret); -diff --git a/drivers/target/target_core_fabric_lib.c b/drivers/target/target_core_fabric_lib.c -index 6600ae44f29d9e..d3ab251ba04973 100644 ---- a/drivers/target/target_core_fabric_lib.c -+++ b/drivers/target/target_core_fabric_lib.c -@@ -257,11 +257,41 @@ static int iscsi_get_pr_transport_id_len( - return len; - } - --static char *iscsi_parse_pr_out_transport_id( -+static void sas_parse_pr_out_transport_id(char *buf, char *i_str) -+{ -+ char hex[17] = {}; -+ -+ bin2hex(hex, buf + 4, 8); -+ snprintf(i_str, TRANSPORT_IQN_LEN, "naa.%s", hex); -+} -+ -+static void srp_parse_pr_out_transport_id(char *buf, char *i_str) -+{ -+ char hex[33] = {}; -+ -+ bin2hex(hex, buf + 8, 16); -+ snprintf(i_str, TRANSPORT_IQN_LEN, "0x%s", hex); -+} -+ -+static void fcp_parse_pr_out_transport_id(char *buf, char *i_str) -+{ -+ snprintf(i_str, TRANSPORT_IQN_LEN, "%8phC", buf + 8); -+} -+ -+static void sbp_parse_pr_out_transport_id(char *buf, char *i_str) -+{ -+ char hex[17] = {}; -+ -+ bin2hex(hex, buf + 8, 8); -+ snprintf(i_str, TRANSPORT_IQN_LEN, "%s", hex); -+} -+ -+static bool iscsi_parse_pr_out_transport_id( - struct se_portal_group *se_tpg, - char *buf, - u32 *out_tid_len, -- char **port_nexus_ptr) -+ char **port_nexus_ptr, -+ char *i_str) - { - char *p; - int i; -@@ -282,7 +312,7 @@ static char *iscsi_parse_pr_out_transport_id( - if ((format_code != 0x00) && (format_code != 0x40)) { - pr_err("Illegal format code: 0x%02x for iSCSI" - " Initiator Transport ID\n", format_code); -- return NULL; -+ return false; - } - /* - * If the caller wants the TransportID Length, we set that value for the -@@ -306,7 +336,7 @@ static char *iscsi_parse_pr_out_transport_id( - pr_err("Unable to locate \",i,0x\" separator" - " for Initiator port identifier: %s\n", - &buf[4]); -- return NULL; -+ return false; - } - *p = '\0'; /* Terminate iSCSI Name */ - p += 5; /* Skip over ",i,0x" separator */ -@@ -339,7 +369,8 @@ static char *iscsi_parse_pr_out_transport_id( - } else - *port_nexus_ptr = NULL; - -- return &buf[4]; -+ strscpy(i_str, &buf[4], TRANSPORT_IQN_LEN); -+ return true; - } - - int target_get_pr_transport_id_len(struct se_node_acl *nacl, -@@ -387,33 +418,35 @@ int target_get_pr_transport_id(struct se_node_acl *nacl, - } - } - --const char *target_parse_pr_out_transport_id(struct se_portal_group *tpg, -- char *buf, u32 *out_tid_len, char **port_nexus_ptr) -+bool target_parse_pr_out_transport_id(struct se_portal_group *tpg, -+ char *buf, u32 *out_tid_len, char **port_nexus_ptr, char *i_str) - { -- u32 offset; -- - switch (tpg->proto_id) { - case SCSI_PROTOCOL_SAS: - /* - * Assume the FORMAT CODE 00b from spc4r17, 7.5.4.7 TransportID - * for initiator ports using SCSI over SAS Serial SCSI Protocol. - */ -- offset = 4; -+ sas_parse_pr_out_transport_id(buf, i_str); - break; -- case SCSI_PROTOCOL_SBP: - case SCSI_PROTOCOL_SRP: -+ srp_parse_pr_out_transport_id(buf, i_str); -+ break; - case SCSI_PROTOCOL_FCP: -- offset = 8; -+ fcp_parse_pr_out_transport_id(buf, i_str); -+ break; -+ case SCSI_PROTOCOL_SBP: -+ sbp_parse_pr_out_transport_id(buf, i_str); - break; - case SCSI_PROTOCOL_ISCSI: - return iscsi_parse_pr_out_transport_id(tpg, buf, out_tid_len, -- port_nexus_ptr); -+ port_nexus_ptr, i_str); - default: - pr_err("Unknown proto_id: 0x%02x\n", tpg->proto_id); -- return NULL; -+ return false; - } - - *port_nexus_ptr = NULL; - *out_tid_len = 24; -- return buf + offset; -+ return true; - } -diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h -index 408be26d2e9b4d..20aab1f505655c 100644 ---- a/drivers/target/target_core_internal.h -+++ b/drivers/target/target_core_internal.h -@@ -103,8 +103,8 @@ int target_get_pr_transport_id_len(struct se_node_acl *nacl, - int target_get_pr_transport_id(struct se_node_acl *nacl, - struct t10_pr_registration *pr_reg, int *format_code, - unsigned char *buf); --const char *target_parse_pr_out_transport_id(struct se_portal_group *tpg, -- char *buf, u32 *out_tid_len, char **port_nexus_ptr); -+bool target_parse_pr_out_transport_id(struct se_portal_group *tpg, -+ char *buf, u32 *out_tid_len, char **port_nexus_ptr, char *i_str); - - /* target_core_hba.c */ - struct se_hba *core_alloc_hba(const char *, u32, u32); -diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c -index a9eb6a3e838347..624d2f68bf385b 100644 ---- a/drivers/target/target_core_pr.c -+++ b/drivers/target/target_core_pr.c -@@ -1477,11 +1477,12 @@ core_scsi3_decode_spec_i_port( - LIST_HEAD(tid_dest_list); - struct pr_transport_id_holder *tidh_new, *tidh, *tidh_tmp; - unsigned char *buf, *ptr, proto_ident; -- const unsigned char *i_str = NULL; -+ unsigned char i_str[TRANSPORT_IQN_LEN]; - char *iport_ptr = NULL, i_buf[PR_REG_ISID_ID_LEN]; - sense_reason_t ret; - u32 tpdl, tid_len = 0; - u32 dest_rtpi = 0; -+ bool tid_found; - - /* - * Allocate a struct pr_transport_id_holder and setup the -@@ -1570,9 +1571,9 @@ core_scsi3_decode_spec_i_port( - dest_rtpi = tmp_lun->lun_tpg->tpg_rtpi; - - iport_ptr = NULL; -- i_str = target_parse_pr_out_transport_id(tmp_tpg, -- ptr, &tid_len, &iport_ptr); -- if (!i_str) -+ tid_found = target_parse_pr_out_transport_id(tmp_tpg, -+ ptr, &tid_len, &iport_ptr, i_str); -+ if (!tid_found) - continue; - /* - * Determine if this SCSI device server requires that -@@ -3152,13 +3153,14 @@ core_scsi3_emulate_pro_register_and_move(struct se_cmd *cmd, u64 res_key, - struct t10_pr_registration *pr_reg, *pr_res_holder, *dest_pr_reg; - struct t10_reservation *pr_tmpl = &dev->t10_pr; - unsigned char *buf; -- const unsigned char *initiator_str; -+ unsigned char initiator_str[TRANSPORT_IQN_LEN]; - char *iport_ptr = NULL, i_buf[PR_REG_ISID_ID_LEN] = { }; - u32 tid_len, tmp_tid_len; - int new_reg = 0, type, scope, matching_iname; - sense_reason_t ret; - unsigned short rtpi; - unsigned char proto_ident; -+ bool tid_found; - - if (!se_sess || !se_lun) { - pr_err("SPC-3 PR: se_sess || struct se_lun is NULL!\n"); -@@ -3277,9 +3279,9 @@ core_scsi3_emulate_pro_register_and_move(struct se_cmd *cmd, u64 res_key, - ret = TCM_INVALID_PARAMETER_LIST; - goto out; - } -- initiator_str = target_parse_pr_out_transport_id(dest_se_tpg, -- &buf[24], &tmp_tid_len, &iport_ptr); -- if (!initiator_str) { -+ tid_found = target_parse_pr_out_transport_id(dest_se_tpg, -+ &buf[24], &tmp_tid_len, &iport_ptr, initiator_str); -+ if (!tid_found) { - pr_err("SPC-3 PR REGISTER_AND_MOVE: Unable to locate" - " initiator_str from Transport ID\n"); - ret = TCM_INVALID_PARAMETER_LIST; -diff --git a/drivers/thermal/qcom/qcom-spmi-temp-alarm.c b/drivers/thermal/qcom/qcom-spmi-temp-alarm.c -index 78c5cfe6a0c0f5..eeccf905f83edd 100644 ---- a/drivers/thermal/qcom/qcom-spmi-temp-alarm.c -+++ b/drivers/thermal/qcom/qcom-spmi-temp-alarm.c -@@ -1,6 +1,7 @@ - // SPDX-License-Identifier: GPL-2.0-only - /* - * Copyright (c) 2011-2015, 2017, 2020, The Linux Foundation. All rights reserved. -+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. - */ - - #include -@@ -16,6 +17,7 @@ - - #include "../thermal_hwmon.h" - -+#define QPNP_TM_REG_DIG_MINOR 0x00 - #define QPNP_TM_REG_DIG_MAJOR 0x01 - #define QPNP_TM_REG_TYPE 0x04 - #define QPNP_TM_REG_SUBTYPE 0x05 -@@ -31,7 +33,7 @@ - #define STATUS_GEN2_STATE_MASK GENMASK(6, 4) - #define STATUS_GEN2_STATE_SHIFT 4 - --#define SHUTDOWN_CTRL1_OVERRIDE_S2 BIT(6) -+#define SHUTDOWN_CTRL1_OVERRIDE_STAGE2 BIT(6) - #define SHUTDOWN_CTRL1_THRESHOLD_MASK GENMASK(1, 0) - - #define SHUTDOWN_CTRL1_RATE_25HZ BIT(3) -@@ -79,6 +81,7 @@ struct qpnp_tm_chip { - /* protects .thresh, .stage and chip registers */ - struct mutex lock; - bool initialized; -+ bool require_stage2_shutdown; - - struct iio_channel *adc; - const long (*temp_map)[THRESH_COUNT][STAGE_COUNT]; -@@ -221,13 +224,13 @@ static int qpnp_tm_update_critical_trip_temp(struct qpnp_tm_chip *chip, - { - long stage2_threshold_min = (*chip->temp_map)[THRESH_MIN][1]; - long stage2_threshold_max = (*chip->temp_map)[THRESH_MAX][1]; -- bool disable_s2_shutdown = false; -+ bool disable_stage2_shutdown = false; - u8 reg; - - WARN_ON(!mutex_is_locked(&chip->lock)); - - /* -- * Default: S2 and S3 shutdown enabled, thresholds at -+ * Default: Stage 2 and Stage 3 shutdown enabled, thresholds at - * lowest threshold set, monitoring at 25Hz - */ - reg = SHUTDOWN_CTRL1_RATE_25HZ; -@@ -242,12 +245,12 @@ static int qpnp_tm_update_critical_trip_temp(struct qpnp_tm_chip *chip, - chip->thresh = THRESH_MAX - - ((stage2_threshold_max - temp) / - TEMP_THRESH_STEP); -- disable_s2_shutdown = true; -+ disable_stage2_shutdown = true; - } else { - chip->thresh = THRESH_MAX; - - if (chip->adc) -- disable_s2_shutdown = true; -+ disable_stage2_shutdown = true; - else - dev_warn(chip->dev, - "No ADC is configured and critical temperature %d mC is above the maximum stage 2 threshold of %ld mC! Configuring stage 2 shutdown at %ld mC.\n", -@@ -256,8 +259,8 @@ static int qpnp_tm_update_critical_trip_temp(struct qpnp_tm_chip *chip, - - skip: - reg |= chip->thresh; -- if (disable_s2_shutdown) -- reg |= SHUTDOWN_CTRL1_OVERRIDE_S2; -+ if (disable_stage2_shutdown && !chip->require_stage2_shutdown) -+ reg |= SHUTDOWN_CTRL1_OVERRIDE_STAGE2; - - return qpnp_tm_write(chip, QPNP_TM_REG_SHUTDOWN_CTRL1, reg); - } -@@ -371,8 +374,8 @@ static int qpnp_tm_probe(struct platform_device *pdev) - { - struct qpnp_tm_chip *chip; - struct device_node *node; -- u8 type, subtype, dig_major; -- u32 res; -+ u8 type, subtype, dig_major, dig_minor; -+ u32 res, dig_revision; - int ret, irq; - - node = pdev->dev.of_node; -@@ -424,6 +427,11 @@ static int qpnp_tm_probe(struct platform_device *pdev) - return dev_err_probe(&pdev->dev, ret, - "could not read dig_major\n"); - -+ ret = qpnp_tm_read(chip, QPNP_TM_REG_DIG_MINOR, &dig_minor); -+ if (ret < 0) -+ return dev_err_probe(&pdev->dev, ret, -+ "could not read dig_minor\n"); -+ - if (type != QPNP_TM_TYPE || (subtype != QPNP_TM_SUBTYPE_GEN1 - && subtype != QPNP_TM_SUBTYPE_GEN2)) { - dev_err(&pdev->dev, "invalid type 0x%02x or subtype 0x%02x\n", -@@ -437,6 +445,23 @@ static int qpnp_tm_probe(struct platform_device *pdev) - else - chip->temp_map = &temp_map_gen1; - -+ if (chip->subtype == QPNP_TM_SUBTYPE_GEN2) { -+ dig_revision = (dig_major << 8) | dig_minor; -+ /* -+ * Check if stage 2 automatic partial shutdown must remain -+ * enabled to avoid potential repeated faults upon reaching -+ * over-temperature stage 3. -+ */ -+ switch (dig_revision) { -+ case 0x0001: -+ case 0x0002: -+ case 0x0100: -+ case 0x0101: -+ chip->require_stage2_shutdown = true; -+ break; -+ } -+ } -+ - /* - * Register the sensor before initializing the hardware to be able to - * read the trip points. get_temp() returns the default temperature -diff --git a/drivers/thermal/thermal_sysfs.c b/drivers/thermal/thermal_sysfs.c -index eef40d4f306394..0dea605faadbcc 100644 ---- a/drivers/thermal/thermal_sysfs.c -+++ b/drivers/thermal/thermal_sysfs.c -@@ -39,10 +39,13 @@ temp_show(struct device *dev, struct device_attribute *attr, char *buf) - - ret = thermal_zone_get_temp(tz, &temperature); - -- if (ret) -- return ret; -+ if (!ret) -+ return sprintf(buf, "%d\n", temperature); - -- return sprintf(buf, "%d\n", temperature); -+ if (ret == -EAGAIN) -+ return -ENODATA; -+ -+ return ret; - } - - static ssize_t -diff --git a/drivers/thunderbolt/domain.c b/drivers/thunderbolt/domain.c -index 31f3da4e6a08df..73be797acd5092 100644 ---- a/drivers/thunderbolt/domain.c -+++ b/drivers/thunderbolt/domain.c -@@ -36,7 +36,7 @@ static bool match_service_id(const struct tb_service_id *id, - return false; - } - -- if (id->match_flags & TBSVC_MATCH_PROTOCOL_VERSION) { -+ if (id->match_flags & TBSVC_MATCH_PROTOCOL_REVISION) { - if (id->protocol_revision != svc->prtcrevs) - return false; - } -diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c -index d5ad6cae6b652b..23aed9e89e3047 100644 ---- a/drivers/tty/serial/8250/8250_port.c -+++ b/drivers/tty/serial/8250/8250_port.c -@@ -2375,9 +2375,8 @@ int serial8250_do_startup(struct uart_port *port) - /* - * Now, initialize the UART - */ -- serial_port_out(port, UART_LCR, UART_LCR_WLEN8); -- - spin_lock_irqsave(&port->lock, flags); -+ serial_port_out(port, UART_LCR, UART_LCR_WLEN8); - if (up->port.flags & UPF_FOURPORT) { - if (!up->port.irq) - up->port.mctrl |= TIOCM_OUT1; -diff --git a/drivers/tty/vt/defkeymap.c_shipped b/drivers/tty/vt/defkeymap.c_shipped -index 0c043e4f292e8a..6af7bf8d5460c5 100644 ---- a/drivers/tty/vt/defkeymap.c_shipped -+++ b/drivers/tty/vt/defkeymap.c_shipped -@@ -23,6 +23,22 @@ unsigned short plain_map[NR_KEYS] = { - 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, - 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, - 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, - }; - - static unsigned short shift_map[NR_KEYS] = { -@@ -42,6 +58,22 @@ static unsigned short shift_map[NR_KEYS] = { - 0xf20b, 0xf601, 0xf602, 0xf117, 0xf600, 0xf20a, 0xf115, 0xf116, - 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, - 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, - }; - - static unsigned short altgr_map[NR_KEYS] = { -@@ -61,6 +93,22 @@ static unsigned short altgr_map[NR_KEYS] = { - 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, - 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, - 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, - }; - - static unsigned short ctrl_map[NR_KEYS] = { -@@ -80,6 +128,22 @@ static unsigned short ctrl_map[NR_KEYS] = { - 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, - 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, - 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, - }; - - static unsigned short shift_ctrl_map[NR_KEYS] = { -@@ -99,6 +163,22 @@ static unsigned short shift_ctrl_map[NR_KEYS] = { - 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, - 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, - 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, - }; - - static unsigned short alt_map[NR_KEYS] = { -@@ -118,6 +198,22 @@ static unsigned short alt_map[NR_KEYS] = { - 0xf118, 0xf210, 0xf211, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, - 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, - 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, - }; - - static unsigned short ctrl_alt_map[NR_KEYS] = { -@@ -137,6 +233,22 @@ static unsigned short ctrl_alt_map[NR_KEYS] = { - 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf20c, - 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, - 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, -+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, - }; - - unsigned short *key_maps[MAX_NR_KEYMAPS] = { -diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c -index 358f216c6cd6ee..18b3c197c1349b 100644 ---- a/drivers/tty/vt/keyboard.c -+++ b/drivers/tty/vt/keyboard.c -@@ -1496,7 +1496,7 @@ static void kbd_keycode(unsigned int keycode, int down, bool hw_raw) - rc = atomic_notifier_call_chain(&keyboard_notifier_list, - KBD_UNICODE, ¶m); - if (rc != NOTIFY_STOP) -- if (down && !raw_mode) -+ if (down && !(raw_mode || kbd->kbdmode == VC_OFF)) - k_unicode(vc, keysym, !down); - return; - } -diff --git a/drivers/ufs/core/ufshcd-priv.h b/drivers/ufs/core/ufshcd-priv.h -index dffc932285ac50..e3346660905243 100644 ---- a/drivers/ufs/core/ufshcd-priv.h -+++ b/drivers/ufs/core/ufshcd-priv.h -@@ -326,7 +326,7 @@ static inline int ufshcd_rpm_get_sync(struct ufs_hba *hba) - - static inline int ufshcd_rpm_get_if_active(struct ufs_hba *hba) - { -- return pm_runtime_get_if_active(&hba->ufs_device_wlun->sdev_gendev, true); -+ return pm_runtime_get_if_active(&hba->ufs_device_wlun->sdev_gendev); - } - - static inline int ufshcd_rpm_put_sync(struct ufs_hba *hba) -diff --git a/drivers/ufs/host/ufs-exynos.c b/drivers/ufs/host/ufs-exynos.c -index f61126189876e9..14c1b855e10ad2 100644 ---- a/drivers/ufs/host/ufs-exynos.c -+++ b/drivers/ufs/host/ufs-exynos.c -@@ -1028,8 +1028,8 @@ static int exynos_ufs_post_link(struct ufs_hba *hba) - hci_writel(ufs, 0xa, HCI_DATA_REORDER); - hci_writel(ufs, PRDT_SET_SIZE(12), HCI_TXPRDT_ENTRY_SIZE); - hci_writel(ufs, PRDT_SET_SIZE(12), HCI_RXPRDT_ENTRY_SIZE); -- hci_writel(ufs, (1 << hba->nutrs) - 1, HCI_UTRL_NEXUS_TYPE); -- hci_writel(ufs, (1 << hba->nutmrs) - 1, HCI_UTMRL_NEXUS_TYPE); -+ hci_writel(ufs, BIT(hba->nutrs) - 1, HCI_UTRL_NEXUS_TYPE); -+ hci_writel(ufs, BIT(hba->nutmrs) - 1, HCI_UTMRL_NEXUS_TYPE); - hci_writel(ufs, 0xf, HCI_AXIDMA_RWDATA_BURST_LEN); - - if (ufs->opts & EXYNOS_UFS_OPT_SKIP_CONNECTION_ESTAB) -diff --git a/drivers/ufs/host/ufshcd-pci.c b/drivers/ufs/host/ufshcd-pci.c -index 248a49e5e7f357..c38ea3395b2c10 100644 ---- a/drivers/ufs/host/ufshcd-pci.c -+++ b/drivers/ufs/host/ufshcd-pci.c -@@ -213,6 +213,32 @@ static int ufs_intel_lkf_apply_dev_quirks(struct ufs_hba *hba) - return ret; - } - -+static void ufs_intel_ctrl_uic_compl(struct ufs_hba *hba, bool enable) -+{ -+ u32 set = ufshcd_readl(hba, REG_INTERRUPT_ENABLE); -+ -+ if (enable) -+ set |= UIC_COMMAND_COMPL; -+ else -+ set &= ~UIC_COMMAND_COMPL; -+ ufshcd_writel(hba, set, REG_INTERRUPT_ENABLE); -+} -+ -+static void ufs_intel_mtl_h8_notify(struct ufs_hba *hba, -+ enum uic_cmd_dme cmd, -+ enum ufs_notify_change_status status) -+{ -+ /* -+ * Disable UIC COMPL INTR to prevent access to UFSHCI after -+ * checking HCS.UPMCRS -+ */ -+ if (status == PRE_CHANGE && cmd == UIC_CMD_DME_HIBER_ENTER) -+ ufs_intel_ctrl_uic_compl(hba, false); -+ -+ if (status == POST_CHANGE && cmd == UIC_CMD_DME_HIBER_EXIT) -+ ufs_intel_ctrl_uic_compl(hba, true); -+} -+ - #define INTEL_ACTIVELTR 0x804 - #define INTEL_IDLELTR 0x808 - -@@ -439,10 +465,23 @@ static int ufs_intel_adl_init(struct ufs_hba *hba) - return ufs_intel_common_init(hba); - } - -+static void ufs_intel_mtl_late_init(struct ufs_hba *hba) -+{ -+ hba->rpm_lvl = UFS_PM_LVL_2; -+ hba->spm_lvl = UFS_PM_LVL_2; -+} -+ - static int ufs_intel_mtl_init(struct ufs_hba *hba) - { -+ struct ufs_host *ufs_host; -+ int err; -+ - hba->caps |= UFSHCD_CAP_CRYPTO | UFSHCD_CAP_WB_EN; -- return ufs_intel_common_init(hba); -+ err = ufs_intel_common_init(hba); -+ /* Get variant after it is set in ufs_intel_common_init() */ -+ ufs_host = ufshcd_get_variant(hba); -+ ufs_host->late_init = ufs_intel_mtl_late_init; -+ return err; - } - - static struct ufs_hba_variant_ops ufs_intel_cnl_hba_vops = { -@@ -487,6 +526,7 @@ static struct ufs_hba_variant_ops ufs_intel_mtl_hba_vops = { - .init = ufs_intel_mtl_init, - .exit = ufs_intel_common_exit, - .hce_enable_notify = ufs_intel_hce_enable_notify, -+ .hibern8_notify = ufs_intel_mtl_h8_notify, - .link_startup_notify = ufs_intel_link_startup_notify, - .resume = ufs_intel_resume, - .device_reset = ufs_intel_device_reset, -diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c -index 1443e9cf631a6e..db9a8f2731f1a4 100644 ---- a/drivers/usb/atm/cxacru.c -+++ b/drivers/usb/atm/cxacru.c -@@ -980,25 +980,60 @@ static int cxacru_fw(struct usb_device *usb_dev, enum cxacru_fw_request fw, - return ret; - } - --static void cxacru_upload_firmware(struct cxacru_data *instance, -- const struct firmware *fw, -- const struct firmware *bp) -+ -+static int cxacru_find_firmware(struct cxacru_data *instance, -+ char *phase, const struct firmware **fw_p) - { -- int ret; -+ struct usbatm_data *usbatm = instance->usbatm; -+ struct device *dev = &usbatm->usb_intf->dev; -+ char buf[16]; -+ -+ sprintf(buf, "cxacru-%s.bin", phase); -+ usb_dbg(usbatm, "cxacru_find_firmware: looking for %s\n", buf); -+ -+ if (request_firmware(fw_p, buf, dev)) { -+ usb_dbg(usbatm, "no stage %s firmware found\n", phase); -+ return -ENOENT; -+ } -+ -+ usb_info(usbatm, "found firmware %s\n", buf); -+ -+ return 0; -+} -+ -+static int cxacru_heavy_init(struct usbatm_data *usbatm_instance, -+ struct usb_interface *usb_intf) -+{ -+ const struct firmware *fw, *bp; -+ struct cxacru_data *instance = usbatm_instance->driver_data; - struct usbatm_data *usbatm = instance->usbatm; - struct usb_device *usb_dev = usbatm->usb_dev; - __le16 signature[] = { usb_dev->descriptor.idVendor, - usb_dev->descriptor.idProduct }; - __le32 val; -+ int ret; - -- usb_dbg(usbatm, "%s\n", __func__); -+ ret = cxacru_find_firmware(instance, "fw", &fw); -+ if (ret) { -+ usb_warn(usbatm_instance, "firmware (cxacru-fw.bin) unavailable (system misconfigured?)\n"); -+ return ret; -+ } -+ -+ if (instance->modem_type->boot_rom_patch) { -+ ret = cxacru_find_firmware(instance, "bp", &bp); -+ if (ret) { -+ usb_warn(usbatm_instance, "boot ROM patch (cxacru-bp.bin) unavailable (system misconfigured?)\n"); -+ release_firmware(fw); -+ return ret; -+ } -+ } - - /* FirmwarePllFClkValue */ - val = cpu_to_le32(instance->modem_type->pll_f_clk); - ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, PLLFCLK_ADDR, (u8 *) &val, 4); - if (ret) { - usb_err(usbatm, "FirmwarePllFClkValue failed: %d\n", ret); -- return; -+ goto done; - } - - /* FirmwarePllBClkValue */ -@@ -1006,7 +1041,7 @@ static void cxacru_upload_firmware(struct cxacru_data *instance, - ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, PLLBCLK_ADDR, (u8 *) &val, 4); - if (ret) { - usb_err(usbatm, "FirmwarePllBClkValue failed: %d\n", ret); -- return; -+ goto done; - } - - /* Enable SDRAM */ -@@ -1014,7 +1049,7 @@ static void cxacru_upload_firmware(struct cxacru_data *instance, - ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, SDRAMEN_ADDR, (u8 *) &val, 4); - if (ret) { - usb_err(usbatm, "Enable SDRAM failed: %d\n", ret); -- return; -+ goto done; - } - - /* Firmware */ -@@ -1022,7 +1057,7 @@ static void cxacru_upload_firmware(struct cxacru_data *instance, - ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, FW_ADDR, fw->data, fw->size); - if (ret) { - usb_err(usbatm, "Firmware upload failed: %d\n", ret); -- return; -+ goto done; - } - - /* Boot ROM patch */ -@@ -1031,7 +1066,7 @@ static void cxacru_upload_firmware(struct cxacru_data *instance, - ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, BR_ADDR, bp->data, bp->size); - if (ret) { - usb_err(usbatm, "Boot ROM patching failed: %d\n", ret); -- return; -+ goto done; - } - } - -@@ -1039,7 +1074,7 @@ static void cxacru_upload_firmware(struct cxacru_data *instance, - ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, SIG_ADDR, (u8 *) signature, 4); - if (ret) { - usb_err(usbatm, "Signature storing failed: %d\n", ret); -- return; -+ goto done; - } - - usb_info(usbatm, "starting device\n"); -@@ -1051,7 +1086,7 @@ static void cxacru_upload_firmware(struct cxacru_data *instance, - } - if (ret) { - usb_err(usbatm, "Passing control to firmware failed: %d\n", ret); -- return; -+ goto done; - } - - /* Delay to allow firmware to start up. */ -@@ -1065,53 +1100,10 @@ static void cxacru_upload_firmware(struct cxacru_data *instance, - ret = cxacru_cm(instance, CM_REQUEST_CARD_GET_STATUS, NULL, 0, NULL, 0); - if (ret < 0) { - usb_err(usbatm, "modem failed to initialize: %d\n", ret); -- return; -- } --} -- --static int cxacru_find_firmware(struct cxacru_data *instance, -- char *phase, const struct firmware **fw_p) --{ -- struct usbatm_data *usbatm = instance->usbatm; -- struct device *dev = &usbatm->usb_intf->dev; -- char buf[16]; -- -- sprintf(buf, "cxacru-%s.bin", phase); -- usb_dbg(usbatm, "cxacru_find_firmware: looking for %s\n", buf); -- -- if (request_firmware(fw_p, buf, dev)) { -- usb_dbg(usbatm, "no stage %s firmware found\n", phase); -- return -ENOENT; -- } -- -- usb_info(usbatm, "found firmware %s\n", buf); -- -- return 0; --} -- --static int cxacru_heavy_init(struct usbatm_data *usbatm_instance, -- struct usb_interface *usb_intf) --{ -- const struct firmware *fw, *bp; -- struct cxacru_data *instance = usbatm_instance->driver_data; -- int ret = cxacru_find_firmware(instance, "fw", &fw); -- -- if (ret) { -- usb_warn(usbatm_instance, "firmware (cxacru-fw.bin) unavailable (system misconfigured?)\n"); -- return ret; -+ goto done; - } - -- if (instance->modem_type->boot_rom_patch) { -- ret = cxacru_find_firmware(instance, "bp", &bp); -- if (ret) { -- usb_warn(usbatm_instance, "boot ROM patch (cxacru-bp.bin) unavailable (system misconfigured?)\n"); -- release_firmware(fw); -- return ret; -- } -- } -- -- cxacru_upload_firmware(instance, fw, bp); -- -+done: - if (instance->modem_type->boot_rom_patch) - release_firmware(bp); - release_firmware(fw); -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index c1d7d87b32cc5a..f0c87c914149d4 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1520,6 +1520,12 @@ static int acm_probe(struct usb_interface *intf, - goto err_remove_files; - } - -+ if (quirks & CLEAR_HALT_CONDITIONS) { -+ /* errors intentionally ignored */ -+ usb_clear_halt(usb_dev, acm->in); -+ usb_clear_halt(usb_dev, acm->out); -+ } -+ - tty_dev = tty_port_register_device(&acm->port, acm_tty_driver, minor, - &control_interface->dev); - if (IS_ERR(tty_dev)) { -@@ -1527,11 +1533,6 @@ static int acm_probe(struct usb_interface *intf, - goto err_release_data_interface; - } - -- if (quirks & CLEAR_HALT_CONDITIONS) { -- usb_clear_halt(usb_dev, acm->in); -- usb_clear_halt(usb_dev, acm->out); -- } -- - dev_info(&intf->dev, "ttyACM%d: USB ACM device\n", minor); - - return 0; -diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c -index 847dd32c0f5e28..3180419424c064 100644 ---- a/drivers/usb/core/config.c -+++ b/drivers/usb/core/config.c -@@ -81,8 +81,14 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno, - */ - desc = (struct usb_ss_ep_comp_descriptor *) buffer; - -- if (desc->bDescriptorType != USB_DT_SS_ENDPOINT_COMP || -- size < USB_DT_SS_EP_COMP_SIZE) { -+ if (size < USB_DT_SS_EP_COMP_SIZE) { -+ dev_notice(ddev, -+ "invalid SuperSpeed endpoint companion descriptor " -+ "of length %d, skipping\n", size); -+ return; -+ } -+ -+ if (desc->bDescriptorType != USB_DT_SS_ENDPOINT_COMP) { - dev_notice(ddev, "No SuperSpeed endpoint companion for config %d " - " interface %d altsetting %d ep %d: " - "using minimum values\n", -diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c -index 12b6dfeaf658c9..0b2a3f645d2fe2 100644 ---- a/drivers/usb/core/hcd.c -+++ b/drivers/usb/core/hcd.c -@@ -2152,7 +2152,7 @@ static struct urb *request_single_step_set_feature_urb( - urb->complete = usb_ehset_completion; - urb->status = -EINPROGRESS; - urb->actual_length = 0; -- urb->transfer_flags = URB_DIR_IN; -+ urb->transfer_flags = URB_DIR_IN | URB_NO_TRANSFER_DMA_MAP; - usb_get_urb(urb); - atomic_inc(&urb->use_count); - atomic_inc(&urb->dev->urbnum); -@@ -2216,9 +2216,15 @@ int ehset_single_step_set_feature(struct usb_hcd *hcd, int port) - - /* Complete remaining DATA and STATUS stages using the same URB */ - urb->status = -EINPROGRESS; -+ urb->transfer_flags &= ~URB_NO_TRANSFER_DMA_MAP; - usb_get_urb(urb); - atomic_inc(&urb->use_count); - atomic_inc(&urb->dev->urbnum); -+ if (map_urb_for_dma(hcd, urb, GFP_KERNEL)) { -+ usb_put_urb(urb); -+ goto out1; -+ } -+ - retval = hcd->driver->submit_single_step_set_feature(hcd, urb, 0); - if (!retval && !wait_for_completion_timeout(&done, - msecs_to_jiffies(2000))) { -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 46db600fdd824e..bfd97cad8aa4d7 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -371,6 +371,7 @@ static const struct usb_device_id usb_quirk_list[] = { - { USB_DEVICE(0x0781, 0x5591), .driver_info = USB_QUIRK_NO_LPM }, - - /* SanDisk Corp. SanDisk 3.2Gen1 */ -+ { USB_DEVICE(0x0781, 0x5596), .driver_info = USB_QUIRK_DELAY_INIT }, - { USB_DEVICE(0x0781, 0x55a3), .driver_info = USB_QUIRK_DELAY_INIT }, - - /* SanDisk Extreme 55AE */ -diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c -index 7576920e2d5a3e..9f202f575cecce 100644 ---- a/drivers/usb/core/urb.c -+++ b/drivers/usb/core/urb.c -@@ -500,7 +500,7 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags) - - /* Check that the pipe's type matches the endpoint's type */ - if (usb_pipe_type_check(urb->dev, urb->pipe)) -- dev_WARN(&dev->dev, "BOGUS urb xfer, pipe %x != type %x\n", -+ dev_warn_once(&dev->dev, "BOGUS urb xfer, pipe %x != type %x\n", - usb_pipetype(urb->pipe), pipetypes[xfertype]); - - /* Check against a simple/standard policy */ -diff --git a/drivers/usb/dwc3/dwc3-imx8mp.c b/drivers/usb/dwc3/dwc3-imx8mp.c -index a1e15f2fffdbff..b53468c41f6771 100644 ---- a/drivers/usb/dwc3/dwc3-imx8mp.c -+++ b/drivers/usb/dwc3/dwc3-imx8mp.c -@@ -244,7 +244,7 @@ static int dwc3_imx8mp_probe(struct platform_device *pdev) - IRQF_ONESHOT, dev_name(dev), dwc3_imx); - if (err) { - dev_err(dev, "failed to request IRQ #%d --> %d\n", irq, err); -- goto depopulate; -+ goto put_dwc3; - } - - device_set_wakeup_capable(dev, true); -@@ -252,6 +252,8 @@ static int dwc3_imx8mp_probe(struct platform_device *pdev) - - return 0; - -+put_dwc3: -+ put_device(&dwc3_imx->dwc3->dev); - depopulate: - of_platform_depopulate(dev); - err_node_put: -@@ -272,6 +274,8 @@ static void dwc3_imx8mp_remove(struct platform_device *pdev) - struct dwc3_imx8mp *dwc3_imx = platform_get_drvdata(pdev); - struct device *dev = &pdev->dev; - -+ put_device(&dwc3_imx->dwc3->dev); -+ - pm_runtime_get_sync(dev); - of_platform_depopulate(dev); - -diff --git a/drivers/usb/dwc3/dwc3-meson-g12a.c b/drivers/usb/dwc3/dwc3-meson-g12a.c -index 2c07c038b584dc..6ea1a876203d9a 100644 ---- a/drivers/usb/dwc3/dwc3-meson-g12a.c -+++ b/drivers/usb/dwc3/dwc3-meson-g12a.c -@@ -837,6 +837,9 @@ static void dwc3_meson_g12a_remove(struct platform_device *pdev) - - usb_role_switch_unregister(priv->role_switch); - -+ put_device(priv->switch_desc.udc); -+ put_device(priv->switch_desc.usb2_port); -+ - of_platform_depopulate(dev); - - for (i = 0 ; i < PHY_COUNT ; ++i) { -diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c -index 54a4ee2b90b7f4..39c72cb52ce76a 100644 ---- a/drivers/usb/dwc3/dwc3-pci.c -+++ b/drivers/usb/dwc3/dwc3-pci.c -@@ -41,6 +41,7 @@ - #define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee - #define PCI_DEVICE_ID_INTEL_TGPH 0x43ee - #define PCI_DEVICE_ID_INTEL_JSP 0x4dee -+#define PCI_DEVICE_ID_INTEL_WCL 0x4d7e - #define PCI_DEVICE_ID_INTEL_ADL 0x460e - #define PCI_DEVICE_ID_INTEL_ADL_PCH 0x51ee - #define PCI_DEVICE_ID_INTEL_ADLN 0x465e -@@ -431,6 +432,7 @@ static const struct pci_device_id dwc3_pci_id_table[] = { - { PCI_DEVICE_DATA(INTEL, TGPLP, &dwc3_pci_intel_swnode) }, - { PCI_DEVICE_DATA(INTEL, TGPH, &dwc3_pci_intel_swnode) }, - { PCI_DEVICE_DATA(INTEL, JSP, &dwc3_pci_intel_swnode) }, -+ { PCI_DEVICE_DATA(INTEL, WCL, &dwc3_pci_intel_swnode) }, - { PCI_DEVICE_DATA(INTEL, ADL, &dwc3_pci_intel_swnode) }, - { PCI_DEVICE_DATA(INTEL, ADL_PCH, &dwc3_pci_intel_swnode) }, - { PCI_DEVICE_DATA(INTEL, ADLN, &dwc3_pci_intel_swnode) }, -diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c -index 874497f86499b3..876a839f2d1d09 100644 ---- a/drivers/usb/dwc3/ep0.c -+++ b/drivers/usb/dwc3/ep0.c -@@ -288,7 +288,9 @@ void dwc3_ep0_out_start(struct dwc3 *dwc) - dwc3_ep0_prepare_one_trb(dep, dwc->ep0_trb_addr, 8, - DWC3_TRBCTL_CONTROL_SETUP, false); - ret = dwc3_ep0_start_trans(dep); -- WARN_ON(ret < 0); -+ if (ret < 0) -+ dev_err(dwc->dev, "ep0 out start transfer failed: %d\n", ret); -+ - for (i = 2; i < DWC3_ENDPOINTS_NUM; i++) { - struct dwc3_ep *dwc3_ep; - -@@ -1061,7 +1063,9 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc, - ret = dwc3_ep0_start_trans(dep); - } - -- WARN_ON(ret < 0); -+ if (ret < 0) -+ dev_err(dwc->dev, -+ "ep0 data phase start transfer failed: %d\n", ret); - } - - static int dwc3_ep0_start_control_status(struct dwc3_ep *dep) -@@ -1078,7 +1082,12 @@ static int dwc3_ep0_start_control_status(struct dwc3_ep *dep) - - static void __dwc3_ep0_do_control_status(struct dwc3 *dwc, struct dwc3_ep *dep) - { -- WARN_ON(dwc3_ep0_start_control_status(dep)); -+ int ret; -+ -+ ret = dwc3_ep0_start_control_status(dep); -+ if (ret) -+ dev_err(dwc->dev, -+ "ep0 status phase start transfer failed: %d\n", ret); - } - - static void dwc3_ep0_do_control_status(struct dwc3 *dwc, -@@ -1121,7 +1130,10 @@ void dwc3_ep0_end_control_data(struct dwc3 *dwc, struct dwc3_ep *dep) - cmd |= DWC3_DEPCMD_PARAM(dep->resource_index); - memset(¶ms, 0, sizeof(params)); - ret = dwc3_send_gadget_ep_cmd(dep, cmd, ¶ms); -- WARN_ON_ONCE(ret); -+ if (ret) -+ dev_err_ratelimited(dwc->dev, -+ "ep0 data phase end transfer failed: %d\n", ret); -+ - dep->resource_index = 0; - } - -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index a17af4ab20a323..6e90f2ad0426a4 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -1765,7 +1765,11 @@ static int __dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force, bool int - dep->flags |= DWC3_EP_DELAY_STOP; - return 0; - } -- WARN_ON_ONCE(ret); -+ -+ if (ret) -+ dev_err_ratelimited(dep->dwc->dev, -+ "end transfer failed: %d\n", ret); -+ - dep->resource_index = 0; - - if (!interrupt) -@@ -3735,6 +3739,15 @@ static void dwc3_gadget_endpoint_transfer_complete(struct dwc3_ep *dep, - static void dwc3_gadget_endpoint_transfer_not_ready(struct dwc3_ep *dep, - const struct dwc3_event_depevt *event) - { -+ /* -+ * During a device-initiated disconnect, a late xferNotReady event can -+ * be generated after the End Transfer command resets the event filter, -+ * but before the controller is halted. Ignore it to prevent a new -+ * transfer from starting. -+ */ -+ if (!dep->dwc->connected) -+ return; -+ - dwc3_gadget_endpoint_frame_from_event(dep, event); - - /* -@@ -4036,7 +4049,9 @@ static void dwc3_clear_stall_all_ep(struct dwc3 *dwc) - dep->flags &= ~DWC3_EP_STALL; - - ret = dwc3_send_clear_stall_ep_cmd(dep); -- WARN_ON_ONCE(ret); -+ if (ret) -+ dev_err_ratelimited(dwc->dev, -+ "failed to clear STALL on %s\n", dep->name); - } - } - -diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c -index a93ad93390ba17..34685c714473dd 100644 ---- a/drivers/usb/gadget/udc/renesas_usb3.c -+++ b/drivers/usb/gadget/udc/renesas_usb3.c -@@ -2658,6 +2658,7 @@ static void renesas_usb3_remove(struct platform_device *pdev) - struct renesas_usb3 *usb3 = platform_get_drvdata(pdev); - - debugfs_remove_recursive(usb3->dentry); -+ put_device(usb3->host_dev); - device_remove_file(&pdev->dev, &dev_attr_role); - - cancel_work_sync(&usb3->role_work); -diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index a2b6a922077ee3..d3d535ed00b50b 100644 ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -735,8 +735,7 @@ static int xhci_enter_test_mode(struct xhci_hcd *xhci, - if (!xhci->devs[i]) - continue; - -- retval = xhci_disable_slot(xhci, i); -- xhci_free_virt_device(xhci, i); -+ retval = xhci_disable_and_free_slot(xhci, i); - if (retval) - xhci_err(xhci, "Failed to disable slot %d, %d. Enter test mode anyway\n", - i, retval); -diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c -index cceb69d4f61e1c..04718048b74bd9 100644 ---- a/drivers/usb/host/xhci-mem.c -+++ b/drivers/usb/host/xhci-mem.c -@@ -849,21 +849,20 @@ int xhci_alloc_tt_info(struct xhci_hcd *xhci, - * will be manipulated by the configure endpoint, allocate device, or update - * hub functions while this function is removing the TT entries from the list. - */ --void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id) -+void xhci_free_virt_device(struct xhci_hcd *xhci, struct xhci_virt_device *dev, -+ int slot_id) - { -- struct xhci_virt_device *dev; - int i; - int old_active_eps = 0; - - /* Slot ID 0 is reserved */ -- if (slot_id == 0 || !xhci->devs[slot_id]) -+ if (slot_id == 0 || !dev) - return; - -- dev = xhci->devs[slot_id]; -- -- xhci->dcbaa->dev_context_ptrs[slot_id] = 0; -- if (!dev) -- return; -+ /* If device ctx array still points to _this_ device, clear it */ -+ if (dev->out_ctx && -+ xhci->dcbaa->dev_context_ptrs[slot_id] == cpu_to_le64(dev->out_ctx->dma)) -+ xhci->dcbaa->dev_context_ptrs[slot_id] = 0; - - trace_xhci_free_virt_device(dev); - -@@ -902,8 +901,9 @@ void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id) - - if (dev->udev && dev->udev->slot_id) - dev->udev->slot_id = 0; -- kfree(xhci->devs[slot_id]); -- xhci->devs[slot_id] = NULL; -+ if (xhci->devs[slot_id] == dev) -+ xhci->devs[slot_id] = NULL; -+ kfree(dev); - } - - /* -@@ -945,7 +945,7 @@ static void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_i - out: - /* we are now at a leaf device */ - xhci_debugfs_remove_slot(xhci, slot_id); -- xhci_free_virt_device(xhci, slot_id); -+ xhci_free_virt_device(xhci, vdev, slot_id); - } - - int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id, -@@ -1182,6 +1182,8 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud - ep0_ctx->deq = cpu_to_le64(dev->eps[0].ring->first_seg->dma | - dev->eps[0].ring->cycle_state); - -+ ep0_ctx->tx_info = cpu_to_le32(EP_AVG_TRB_LENGTH(8)); -+ - trace_xhci_setup_addressable_virt_device(dev); - - /* Steps 7 and 8 were done in xhci_alloc_virt_device() */ -diff --git a/drivers/usb/host/xhci-pci-renesas.c b/drivers/usb/host/xhci-pci-renesas.c -index 93f8b355bc706e..4ceed19c64f032 100644 ---- a/drivers/usb/host/xhci-pci-renesas.c -+++ b/drivers/usb/host/xhci-pci-renesas.c -@@ -47,8 +47,9 @@ - #define RENESAS_ROM_ERASE_MAGIC 0x5A65726F - #define RENESAS_ROM_WRITE_MAGIC 0x53524F4D - --#define RENESAS_RETRY 10000 --#define RENESAS_DELAY 10 -+#define RENESAS_RETRY 50000 /* 50000 * RENESAS_DELAY ~= 500ms */ -+#define RENESAS_CHIP_ERASE_RETRY 500000 /* 500000 * RENESAS_DELAY ~= 5s */ -+#define RENESAS_DELAY 10 - - static int renesas_fw_download_image(struct pci_dev *dev, - const u32 *fw, size_t step, bool rom) -@@ -405,7 +406,7 @@ static void renesas_rom_erase(struct pci_dev *pdev) - /* sleep a bit while ROM is erased */ - msleep(20); - -- for (i = 0; i < RENESAS_RETRY; i++) { -+ for (i = 0; i < RENESAS_CHIP_ERASE_RETRY; i++) { - retval = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, - &status); - status &= RENESAS_ROM_STATUS_ERASE; -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index 44352df58c9e4e..a21ac9d80275f7 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -1338,12 +1338,15 @@ static void xhci_kill_endpoint_urbs(struct xhci_hcd *xhci, - */ - void xhci_hc_died(struct xhci_hcd *xhci) - { -+ bool notify; - int i, j; - - if (xhci->xhc_state & XHCI_STATE_DYING) - return; - -- xhci_err(xhci, "xHCI host controller not responding, assume dead\n"); -+ notify = !(xhci->xhc_state & XHCI_STATE_REMOVING); -+ if (notify) -+ xhci_err(xhci, "xHCI host controller not responding, assume dead\n"); - xhci->xhc_state |= XHCI_STATE_DYING; - - xhci_cleanup_command_queue(xhci); -@@ -1357,7 +1360,7 @@ void xhci_hc_died(struct xhci_hcd *xhci) - } - - /* inform usb core hc died if PCI remove isn't already handling it */ -- if (!(xhci->xhc_state & XHCI_STATE_REMOVING)) -+ if (notify) - usb_hc_died(xhci_to_hcd(xhci)); - } - -@@ -1584,7 +1587,8 @@ static void xhci_handle_cmd_enable_slot(struct xhci_hcd *xhci, int slot_id, - command->slot_id = 0; - } - --static void xhci_handle_cmd_disable_slot(struct xhci_hcd *xhci, int slot_id) -+static void xhci_handle_cmd_disable_slot(struct xhci_hcd *xhci, int slot_id, -+ u32 cmd_comp_code) - { - struct xhci_virt_device *virt_dev; - struct xhci_slot_ctx *slot_ctx; -@@ -1599,6 +1603,10 @@ static void xhci_handle_cmd_disable_slot(struct xhci_hcd *xhci, int slot_id) - if (xhci->quirks & XHCI_EP_LIMIT_QUIRK) - /* Delete default control endpoint resources */ - xhci_free_device_endpoint_resources(xhci, virt_dev, true); -+ if (cmd_comp_code == COMP_SUCCESS) { -+ xhci->dcbaa->dev_context_ptrs[slot_id] = 0; -+ xhci->devs[slot_id] = NULL; -+ } - } - - static void xhci_handle_cmd_config_ep(struct xhci_hcd *xhci, int slot_id, -@@ -1847,7 +1855,7 @@ static void handle_cmd_completion(struct xhci_hcd *xhci, - xhci_handle_cmd_enable_slot(xhci, slot_id, cmd, cmd_comp_code); - break; - case TRB_DISABLE_SLOT: -- xhci_handle_cmd_disable_slot(xhci, slot_id); -+ xhci_handle_cmd_disable_slot(xhci, slot_id, cmd_comp_code); - break; - case TRB_CONFIG_EP: - if (!cmd->completion) -@@ -4454,7 +4462,8 @@ static int queue_command(struct xhci_hcd *xhci, struct xhci_command *cmd, - - if ((xhci->xhc_state & XHCI_STATE_DYING) || - (xhci->xhc_state & XHCI_STATE_HALTED)) { -- xhci_dbg(xhci, "xHCI dying or halted, can't queue_command\n"); -+ xhci_dbg(xhci, "xHCI dying or halted, can't queue_command. state: 0x%x\n", -+ xhci->xhc_state); - return -ESHUTDOWN; - } - -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index ce38cd2435c8c3..8fd88fedbb30ea 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -119,7 +119,8 @@ int xhci_halt(struct xhci_hcd *xhci) - ret = xhci_handshake(&xhci->op_regs->status, - STS_HALT, STS_HALT, XHCI_MAX_HALT_USEC); - if (ret) { -- xhci_warn(xhci, "Host halt failed, %d\n", ret); -+ if (!(xhci->xhc_state & XHCI_STATE_DYING)) -+ xhci_warn(xhci, "Host halt failed, %d\n", ret); - return ret; - } - -@@ -178,7 +179,8 @@ int xhci_reset(struct xhci_hcd *xhci, u64 timeout_us) - state = readl(&xhci->op_regs->status); - - if (state == ~(u32)0) { -- xhci_warn(xhci, "Host not accessible, reset failed.\n"); -+ if (!(xhci->xhc_state & XHCI_STATE_DYING)) -+ xhci_warn(xhci, "Host not accessible, reset failed.\n"); - return -ENODEV; - } - -@@ -3758,8 +3760,7 @@ static int xhci_discover_or_reset_device(struct usb_hcd *hcd, - * Obtaining a new device slot to inform the xHCI host that - * the USB device has been reset. - */ -- ret = xhci_disable_slot(xhci, udev->slot_id); -- xhci_free_virt_device(xhci, udev->slot_id); -+ ret = xhci_disable_and_free_slot(xhci, udev->slot_id); - if (!ret) { - ret = xhci_alloc_dev(hcd, udev); - if (ret == 1) -@@ -3914,7 +3915,7 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev) - xhci_disable_slot(xhci, udev->slot_id); - - spin_lock_irqsave(&xhci->lock, flags); -- xhci_free_virt_device(xhci, udev->slot_id); -+ xhci_free_virt_device(xhci, virt_dev, udev->slot_id); - spin_unlock_irqrestore(&xhci->lock, flags); - - } -@@ -3963,6 +3964,16 @@ int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id) - return 0; - } - -+int xhci_disable_and_free_slot(struct xhci_hcd *xhci, u32 slot_id) -+{ -+ struct xhci_virt_device *vdev = xhci->devs[slot_id]; -+ int ret; -+ -+ ret = xhci_disable_slot(xhci, slot_id); -+ xhci_free_virt_device(xhci, vdev, slot_id); -+ return ret; -+} -+ - /* - * Checks if we have enough host controller resources for the default control - * endpoint. -@@ -4069,8 +4080,7 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev) - return 1; - - disable_slot: -- xhci_disable_slot(xhci, udev->slot_id); -- xhci_free_virt_device(xhci, udev->slot_id); -+ xhci_disable_and_free_slot(xhci, udev->slot_id); - - return 0; - } -@@ -4206,8 +4216,7 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev, - dev_warn(&udev->dev, "Device not responding to setup %s.\n", act); - - mutex_unlock(&xhci->mutex); -- ret = xhci_disable_slot(xhci, udev->slot_id); -- xhci_free_virt_device(xhci, udev->slot_id); -+ ret = xhci_disable_and_free_slot(xhci, udev->slot_id); - if (!ret) { - if (xhci_alloc_dev(hcd, udev) == 1) - xhci_setup_addressable_virt_dev(xhci, udev); -diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h -index 159cdfc7129070..808f2ee43b9444 100644 ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -1798,7 +1798,7 @@ void xhci_dbg_trace(struct xhci_hcd *xhci, void (*trace)(struct va_format *), - /* xHCI memory management */ - void xhci_mem_cleanup(struct xhci_hcd *xhci); - int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags); --void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id); -+void xhci_free_virt_device(struct xhci_hcd *xhci, struct xhci_virt_device *dev, int slot_id); - int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id, struct usb_device *udev, gfp_t flags); - int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *udev); - void xhci_copy_ep0_dequeue_into_input_ctx(struct xhci_hcd *xhci, -@@ -1895,6 +1895,7 @@ void xhci_reset_bandwidth(struct usb_hcd *hcd, struct usb_device *udev); - int xhci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev, - struct usb_tt *tt, gfp_t mem_flags); - int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id); -+int xhci_disable_and_free_slot(struct xhci_hcd *xhci, u32 slot_id); - int xhci_ext_cap_init(struct xhci_hcd *xhci); - - int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup); -diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c -index b4a4c1df4e0d96..a4668c6d575dcf 100644 ---- a/drivers/usb/musb/omap2430.c -+++ b/drivers/usb/musb/omap2430.c -@@ -400,7 +400,7 @@ static int omap2430_probe(struct platform_device *pdev) - ret = platform_device_add_resources(musb, pdev->resource, pdev->num_resources); - if (ret) { - dev_err(&pdev->dev, "failed to add resources\n"); -- goto err2; -+ goto err_put_control_otghs; - } - - if (populate_irqs) { -@@ -413,7 +413,7 @@ static int omap2430_probe(struct platform_device *pdev) - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (!res) { - ret = -EINVAL; -- goto err2; -+ goto err_put_control_otghs; - } - - musb_res[i].start = res->start; -@@ -441,14 +441,14 @@ static int omap2430_probe(struct platform_device *pdev) - ret = platform_device_add_resources(musb, musb_res, i); - if (ret) { - dev_err(&pdev->dev, "failed to add IRQ resources\n"); -- goto err2; -+ goto err_put_control_otghs; - } - } - - ret = platform_device_add_data(musb, pdata, sizeof(*pdata)); - if (ret) { - dev_err(&pdev->dev, "failed to add platform_data\n"); -- goto err2; -+ goto err_put_control_otghs; - } - - pm_runtime_enable(glue->dev); -@@ -463,7 +463,9 @@ static int omap2430_probe(struct platform_device *pdev) - - err3: - pm_runtime_disable(glue->dev); -- -+err_put_control_otghs: -+ if (!IS_ERR(glue->control_otghs)) -+ put_device(glue->control_otghs); - err2: - platform_device_put(musb); - -@@ -477,6 +479,8 @@ static void omap2430_remove(struct platform_device *pdev) - - platform_device_unregister(glue->musb); - pm_runtime_disable(glue->dev); -+ if (!IS_ERR(glue->control_otghs)) -+ put_device(glue->control_otghs); - } - - #ifdef CONFIG_PM -diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c -index 0c423916d7bfa4..a026c6cb6e684b 100644 ---- a/drivers/usb/storage/realtek_cr.c -+++ b/drivers/usb/storage/realtek_cr.c -@@ -252,7 +252,7 @@ static int rts51x_bulk_transport(struct us_data *us, u8 lun, - return USB_STOR_TRANSPORT_ERROR; - } - -- residue = bcs->Residue; -+ residue = le32_to_cpu(bcs->Residue); - if (bcs->Tag != us->tag) - return USB_STOR_TRANSPORT_ERROR; - -diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h -index 54f0b1c83317cd..dfa5276a5a43e2 100644 ---- a/drivers/usb/storage/unusual_devs.h -+++ b/drivers/usb/storage/unusual_devs.h -@@ -934,6 +934,13 @@ UNUSUAL_DEV( 0x05e3, 0x0723, 0x9451, 0x9451, - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_SANE_SENSE ), - -+/* Added by Maël GUERIN */ -+UNUSUAL_DEV( 0x0603, 0x8611, 0x0000, 0xffff, -+ "Novatek", -+ "NTK96550-based camera", -+ USB_SC_SCSI, USB_PR_BULK, NULL, -+ US_FL_BULK_IGNORE_TAG ), -+ - /* - * Reported by Hanno Boeck - * Taken from the Lycoris Kernel -@@ -1494,6 +1501,28 @@ UNUSUAL_DEV( 0x0bc2, 0x3332, 0x0000, 0x9999, - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_NO_WP_DETECT ), - -+/* -+ * Reported by Zenm Chen -+ * Ignore driver CD mode, otherwise usb_modeswitch may fail to switch -+ * the device into Wi-Fi mode. -+ */ -+UNUSUAL_DEV( 0x0bda, 0x1a2b, 0x0000, 0xffff, -+ "Realtek", -+ "DISK", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_IGNORE_DEVICE ), -+ -+/* -+ * Reported by Zenm Chen -+ * Ignore driver CD mode, otherwise usb_modeswitch may fail to switch -+ * the device into Wi-Fi mode. -+ */ -+UNUSUAL_DEV( 0x0bda, 0xa192, 0x0000, 0xffff, -+ "Realtek", -+ "DISK", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_IGNORE_DEVICE ), -+ - UNUSUAL_DEV( 0x0d49, 0x7310, 0x0000, 0x9999, - "Maxtor", - "USB to SATA", -diff --git a/drivers/usb/typec/mux/intel_pmc_mux.c b/drivers/usb/typec/mux/intel_pmc_mux.c -index 60ed1f809130d8..a174ff7a9abd39 100644 ---- a/drivers/usb/typec/mux/intel_pmc_mux.c -+++ b/drivers/usb/typec/mux/intel_pmc_mux.c -@@ -730,7 +730,7 @@ static int pmc_usb_probe(struct platform_device *pdev) - - pmc->ipc = devm_intel_scu_ipc_dev_get(&pdev->dev); - if (!pmc->ipc) -- return -ENODEV; -+ return -EPROBE_DEFER; - - pmc->dev = &pdev->dev; - -diff --git a/drivers/usb/typec/tcpm/fusb302.c b/drivers/usb/typec/tcpm/fusb302.c -index bc21006e979c66..03749a392fdbd5 100644 ---- a/drivers/usb/typec/tcpm/fusb302.c -+++ b/drivers/usb/typec/tcpm/fusb302.c -@@ -103,6 +103,7 @@ struct fusb302_chip { - bool vconn_on; - bool vbus_on; - bool charge_on; -+ bool pd_rx_on; - bool vbus_present; - enum typec_cc_polarity cc_polarity; - enum typec_cc_status cc1; -@@ -841,6 +842,11 @@ static int tcpm_set_pd_rx(struct tcpc_dev *dev, bool on) - int ret = 0; - - mutex_lock(&chip->lock); -+ if (chip->pd_rx_on == on) { -+ fusb302_log(chip, "pd is already %s", str_on_off(on)); -+ goto done; -+ } -+ - ret = fusb302_pd_rx_flush(chip); - if (ret < 0) { - fusb302_log(chip, "cannot flush pd rx buffer, ret=%d", ret); -@@ -863,6 +869,8 @@ static int tcpm_set_pd_rx(struct tcpc_dev *dev, bool on) - on ? "on" : "off", ret); - goto done; - } -+ -+ chip->pd_rx_on = on; - fusb302_log(chip, "pd := %s", on ? "on" : "off"); - done: - mutex_unlock(&chip->lock); -diff --git a/drivers/usb/typec/tcpm/maxim_contaminant.c b/drivers/usb/typec/tcpm/maxim_contaminant.c -index 60f90272fed315..e37bf26cca805c 100644 ---- a/drivers/usb/typec/tcpm/maxim_contaminant.c -+++ b/drivers/usb/typec/tcpm/maxim_contaminant.c -@@ -5,6 +5,7 @@ - * USB-C module to reduce wakeups due to contaminants. - */ - -+#include - #include - #include - #include -@@ -189,6 +190,11 @@ static int max_contaminant_read_comparators(struct max_tcpci_chip *chip, u8 *ven - if (ret < 0) - return ret; - -+ /* Disable low power mode */ -+ ret = regmap_update_bits(regmap, TCPC_VENDOR_CC_CTRL2, CCLPMODESEL_MASK, -+ FIELD_PREP(CCLPMODESEL_MASK, -+ LOW_POWER_MODE_DISABLE)); -+ - /* Sleep to allow comparators settle */ - usleep_range(5000, 6000); - ret = regmap_update_bits(regmap, TCPC_TCPC_CTRL, TCPC_TCPC_CTRL_ORIENTATION, PLUG_ORNT_CC1); -@@ -322,6 +328,34 @@ static int max_contaminant_enable_dry_detection(struct max_tcpci_chip *chip) - return 0; - } - -+static int max_contaminant_enable_toggling(struct max_tcpci_chip *chip) -+{ -+ struct regmap *regmap = chip->data.regmap; -+ int ret; -+ -+ /* Disable dry detection if enabled. */ -+ ret = regmap_update_bits(regmap, TCPC_VENDOR_CC_CTRL2, CCLPMODESEL_MASK, -+ ULTRA_LOW_POWER_MODE); -+ if (ret) -+ return ret; -+ -+ ret = regmap_update_bits(regmap, TCPC_VENDOR_CC_CTRL1, CCCONNDRY, 0); -+ if (ret) -+ return ret; -+ -+ ret = max_tcpci_write8(chip, TCPC_ROLE_CTRL, TCPC_ROLE_CTRL_DRP | 0xA); -+ if (ret) -+ return ret; -+ -+ ret = regmap_update_bits(regmap, TCPC_TCPC_CTRL, -+ TCPC_TCPC_CTRL_EN_LK4CONN_ALRT, -+ TCPC_TCPC_CTRL_EN_LK4CONN_ALRT); -+ if (ret) -+ return ret; -+ -+ return max_tcpci_write8(chip, TCPC_COMMAND, TCPC_CMD_LOOK4CONNECTION); -+} -+ - bool max_contaminant_is_contaminant(struct max_tcpci_chip *chip, bool disconnect_while_debounce) - { - u8 cc_status, pwr_cntl; -@@ -335,6 +369,12 @@ bool max_contaminant_is_contaminant(struct max_tcpci_chip *chip, bool disconnect - if (ret < 0) - return false; - -+ if (cc_status & TCPC_CC_STATUS_TOGGLING) { -+ if (chip->contaminant_state == DETECTED) -+ return true; -+ return false; -+ } -+ - if (chip->contaminant_state == NOT_DETECTED || chip->contaminant_state == SINK) { - if (!disconnect_while_debounce) - msleep(100); -@@ -367,6 +407,12 @@ bool max_contaminant_is_contaminant(struct max_tcpci_chip *chip, bool disconnect - max_contaminant_enable_dry_detection(chip); - return true; - } -+ -+ ret = max_contaminant_enable_toggling(chip); -+ if (ret) -+ dev_err(chip->dev, -+ "Failed to enable toggling, ret=%d", -+ ret); - } - return false; - } else if (chip->contaminant_state == DETECTED) { -@@ -375,6 +421,14 @@ bool max_contaminant_is_contaminant(struct max_tcpci_chip *chip, bool disconnect - if (chip->contaminant_state == DETECTED) { - max_contaminant_enable_dry_detection(chip); - return true; -+ } else { -+ ret = max_contaminant_enable_toggling(chip); -+ if (ret) { -+ dev_err(chip->dev, -+ "Failed to enable toggling, ret=%d", -+ ret); -+ return true; -+ } - } - } - } -diff --git a/drivers/usb/typec/tcpm/tcpci_maxim.h b/drivers/usb/typec/tcpm/tcpci_maxim.h -index 2c1c4d161b0dcb..861801cc456ff4 100644 ---- a/drivers/usb/typec/tcpm/tcpci_maxim.h -+++ b/drivers/usb/typec/tcpm/tcpci_maxim.h -@@ -21,6 +21,7 @@ - #define CCOVPDIS BIT(6) - #define SBURPCTRL BIT(5) - #define CCLPMODESEL_MASK GENMASK(4, 3) -+#define LOW_POWER_MODE_DISABLE 0 - #define ULTRA_LOW_POWER_MODE BIT(3) - #define CCRPCTRL_MASK GENMASK(2, 0) - #define UA_1_SRC 1 -diff --git a/drivers/usb/typec/ucsi/psy.c b/drivers/usb/typec/ucsi/psy.c -index b35c6e07911e90..9b0157063df0a3 100644 ---- a/drivers/usb/typec/ucsi/psy.c -+++ b/drivers/usb/typec/ucsi/psy.c -@@ -163,7 +163,7 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con, - case UCSI_CONSTAT_PWR_OPMODE_DEFAULT: - /* UCSI can't tell b/w DCP/CDP or USB2/3x1/3x2 SDP chargers */ - default: -- val->intval = 0; -+ val->intval = UCSI_TYPEC_DEFAULT_CURRENT * 1000; - break; - } - return 0; -diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c -index ea98bc5674940d..e5c001ee0cd7c0 100644 ---- a/drivers/usb/typec/ucsi/ucsi.c -+++ b/drivers/usb/typec/ucsi/ucsi.c -@@ -910,6 +910,7 @@ static void ucsi_handle_connector_change(struct work_struct *work) - - if (con->status.change & UCSI_CONSTAT_POWER_DIR_CHANGE) { - typec_set_pwr_role(con->port, role); -+ ucsi_port_psy_changed(con); - - /* Complete pending power role swap */ - if (!completion_done(&con->complete)) -diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h -index 7706f4e951258b..51e745117dcbac 100644 ---- a/drivers/usb/typec/ucsi/ucsi.h -+++ b/drivers/usb/typec/ucsi/ucsi.h -@@ -340,9 +340,10 @@ struct ucsi { - #define UCSI_MAX_SVID 5 - #define UCSI_MAX_ALTMODES (UCSI_MAX_SVID * 6) - --#define UCSI_TYPEC_VSAFE5V 5000 --#define UCSI_TYPEC_1_5_CURRENT 1500 --#define UCSI_TYPEC_3_0_CURRENT 3000 -+#define UCSI_TYPEC_VSAFE5V 5000 -+#define UCSI_TYPEC_DEFAULT_CURRENT 100 -+#define UCSI_TYPEC_1_5_CURRENT 1500 -+#define UCSI_TYPEC_3_0_CURRENT 3000 - - struct ucsi_connector { - int num; -diff --git a/drivers/vfio/pci/mlx5/cmd.c b/drivers/vfio/pci/mlx5/cmd.c -index 2d996c913ecd56..82558fa7712e4a 100644 ---- a/drivers/vfio/pci/mlx5/cmd.c -+++ b/drivers/vfio/pci/mlx5/cmd.c -@@ -1389,8 +1389,8 @@ int mlx5vf_start_page_tracker(struct vfio_device *vdev, - log_max_msg_size = MLX5_CAP_ADV_VIRTUALIZATION(mdev, pg_track_log_max_msg_size); - max_msg_size = (1ULL << log_max_msg_size); - /* The RQ must hold at least 4 WQEs/messages for successful QP creation */ -- if (rq_size < 4 * max_msg_size) -- rq_size = 4 * max_msg_size; -+ if (rq_size < 4ULL * max_msg_size) -+ rq_size = 4ULL * max_msg_size; - - memset(tracker, 0, sizeof(*tracker)); - tracker->uar = mlx5_get_uars_page(mdev); -diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c -index 5fe7aed3672eea..f63f116b9cd0a6 100644 ---- a/drivers/vfio/vfio_iommu_type1.c -+++ b/drivers/vfio/vfio_iommu_type1.c -@@ -635,6 +635,13 @@ static long vfio_pin_pages_remote(struct vfio_dma *dma, unsigned long vaddr, - - while (npage) { - if (!batch->size) { -+ /* -+ * Large mappings may take a while to repeatedly refill -+ * the batch, so conditionally relinquish the CPU when -+ * needed to avoid stalls. -+ */ -+ cond_resched(); -+ - /* Empty batch, so refill it. */ - long req_pages = min_t(long, npage, batch->capacity); - -diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c -index d0238bd741b089..147cfb64bba2d5 100644 ---- a/drivers/vhost/vhost.c -+++ b/drivers/vhost/vhost.c -@@ -2770,6 +2770,9 @@ int vhost_add_used_n(struct vhost_virtqueue *vq, struct vring_used_elem *heads, - } - r = __vhost_add_used_n(vq, heads, count); - -+ if (r < 0) -+ return r; -+ - /* Make sure buffer is written before we update index. */ - smp_wmb(); - if (vhost_put_used_idx(vq)) { -diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c -index d94a06008ff647..2ec0d52606853a 100644 ---- a/drivers/vhost/vsock.c -+++ b/drivers/vhost/vsock.c -@@ -340,6 +340,9 @@ vhost_vsock_alloc_skb(struct vhost_virtqueue *vq, - - len = iov_length(vq->iov, out); - -+ if (len > VIRTIO_VSOCK_MAX_PKT_BUF_SIZE + VIRTIO_VSOCK_SKB_HEADROOM) -+ return NULL; -+ - /* len contains both payload and hdr */ - skb = virtio_vsock_alloc_skb(len, GFP_KERNEL); - if (!skb) -@@ -363,8 +366,7 @@ vhost_vsock_alloc_skb(struct vhost_virtqueue *vq, - return skb; - - /* The pkt is too big or the length in the header is invalid */ -- if (payload_len > VIRTIO_VSOCK_MAX_PKT_BUF_SIZE || -- payload_len + sizeof(*hdr) > len) { -+ if (payload_len + sizeof(*hdr) > len) { - kfree_skb(skb); - return NULL; - } -diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c -index bbc362db40c586..14e5312a00308e 100644 ---- a/drivers/video/console/vgacon.c -+++ b/drivers/video/console/vgacon.c -@@ -1139,7 +1139,7 @@ static bool vgacon_scroll(struct vc_data *c, unsigned int t, unsigned int b, - c->vc_screenbuf_size - delta); - c->vc_origin = vga_vram_end - c->vc_screenbuf_size; - vga_rolled_over = 0; -- } else if (oldo - delta >= (unsigned long)c->vc_screenbuf) -+ } else - c->vc_origin -= delta; - c->vc_scr_end = c->vc_origin + c->vc_screenbuf_size; - scr_memsetw((u16 *) (c->vc_origin), c->vc_video_erase_char, -diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c -index ed68ba89b80b8f..58eee27aa6cca9 100644 ---- a/drivers/video/fbdev/core/fbcon.c -+++ b/drivers/video/fbdev/core/fbcon.c -@@ -808,7 +808,8 @@ static void con2fb_init_display(struct vc_data *vc, struct fb_info *info, - fg_vc->vc_rows); - } - -- update_screen(vc_cons[fg_console].d); -+ if (fg_console != unit) -+ update_screen(vc_cons[fg_console].d); - } - - /** -@@ -1353,6 +1354,7 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var, - struct vc_data *svc; - struct fbcon_ops *ops = info->fbcon_par; - int rows, cols; -+ unsigned long ret = 0; - - p = &fb_display[unit]; - -@@ -1403,11 +1405,10 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var, - rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres); - cols /= vc->vc_font.width; - rows /= vc->vc_font.height; -- vc_resize(vc, cols, rows); -+ ret = vc_resize(vc, cols, rows); - -- if (con_is_visible(vc)) { -+ if (con_is_visible(vc) && !ret) - update_screen(vc); -- } - } - - static __inline__ void ywrap_up(struct vc_data *vc, int count) -diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c -index 52bd3af5436908..942b942f6bf9af 100644 ---- a/drivers/video/fbdev/core/fbmem.c -+++ b/drivers/video/fbdev/core/fbmem.c -@@ -943,6 +943,9 @@ static int do_register_framebuffer(struct fb_info *fb_info) - if (!registered_fb[i]) - break; - -+ if (i >= FB_MAX) -+ return -ENXIO; -+ - if (!fb_info->modelist.prev || !fb_info->modelist.next) - INIT_LIST_HEAD(&fb_info->modelist); - -diff --git a/drivers/virt/coco/efi_secret/efi_secret.c b/drivers/virt/coco/efi_secret/efi_secret.c -index e700a5ef704315..d996feb0509a19 100644 ---- a/drivers/virt/coco/efi_secret/efi_secret.c -+++ b/drivers/virt/coco/efi_secret/efi_secret.c -@@ -136,15 +136,7 @@ static int efi_secret_unlink(struct inode *dir, struct dentry *dentry) - if (s->fs_files[i] == dentry) - s->fs_files[i] = NULL; - -- /* -- * securityfs_remove tries to lock the directory's inode, but we reach -- * the unlink callback when it's already locked -- */ -- inode_unlock(dir); -- securityfs_remove(dentry); -- inode_lock(dir); -- -- return 0; -+ return simple_unlink(inode, dentry); - } - - static const struct inode_operations efi_secret_dir_inode_operations = { -diff --git a/drivers/watchdog/dw_wdt.c b/drivers/watchdog/dw_wdt.c -index 84dca3695f862d..e5e6d7f159180f 100644 ---- a/drivers/watchdog/dw_wdt.c -+++ b/drivers/watchdog/dw_wdt.c -@@ -644,6 +644,8 @@ static int dw_wdt_drv_probe(struct platform_device *pdev) - } else { - wdd->timeout = DW_WDT_DEFAULT_SECONDS; - watchdog_init_timeout(wdd, 0, dev); -+ /* Limit timeout value to hardware constraints. */ -+ dw_wdt_set_timeout(wdd, wdd->timeout); - } - - platform_set_drvdata(pdev, dw_wdt); -diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c -index dd297dcd524c9c..68973be2ce6269 100644 ---- a/drivers/watchdog/iTCO_wdt.c -+++ b/drivers/watchdog/iTCO_wdt.c -@@ -601,7 +601,11 @@ static int iTCO_wdt_probe(struct platform_device *pdev) - /* Check that the heartbeat value is within it's range; - if not reset to the default */ - if (iTCO_wdt_set_timeout(&p->wddev, heartbeat)) { -- iTCO_wdt_set_timeout(&p->wddev, WATCHDOG_TIMEOUT); -+ ret = iTCO_wdt_set_timeout(&p->wddev, WATCHDOG_TIMEOUT); -+ if (ret != 0) { -+ dev_err(dev, "Failed to set watchdog timeout (%d)\n", WATCHDOG_TIMEOUT); -+ return ret; -+ } - dev_info(dev, "timeout value out of range, using %d\n", - WATCHDOG_TIMEOUT); - } -diff --git a/drivers/watchdog/sbsa_gwdt.c b/drivers/watchdog/sbsa_gwdt.c -index 5f23913ce3b49c..6ce1bfb3906413 100644 ---- a/drivers/watchdog/sbsa_gwdt.c -+++ b/drivers/watchdog/sbsa_gwdt.c -@@ -75,11 +75,17 @@ - #define SBSA_GWDT_VERSION_MASK 0xF - #define SBSA_GWDT_VERSION_SHIFT 16 - -+#define SBSA_GWDT_IMPL_MASK 0x7FF -+#define SBSA_GWDT_IMPL_SHIFT 0 -+#define SBSA_GWDT_IMPL_MEDIATEK 0x426 -+ - /** - * struct sbsa_gwdt - Internal representation of the SBSA GWDT - * @wdd: kernel watchdog_device structure - * @clk: store the System Counter clock frequency, in Hz. - * @version: store the architecture version -+ * @need_ws0_race_workaround: -+ * indicate whether to adjust wdd->timeout to avoid a race with WS0 - * @refresh_base: Virtual address of the watchdog refresh frame - * @control_base: Virtual address of the watchdog control frame - */ -@@ -87,6 +93,7 @@ struct sbsa_gwdt { - struct watchdog_device wdd; - u32 clk; - int version; -+ bool need_ws0_race_workaround; - void __iomem *refresh_base; - void __iomem *control_base; - }; -@@ -161,6 +168,31 @@ static int sbsa_gwdt_set_timeout(struct watchdog_device *wdd, - */ - sbsa_gwdt_reg_write(((u64)gwdt->clk / 2) * timeout, gwdt); - -+ /* -+ * Some watchdog hardware has a race condition where it will ignore -+ * sbsa_gwdt_keepalive() if it is called at the exact moment that a -+ * timeout occurs and WS0 is being asserted. Unfortunately, the default -+ * behavior of the watchdog core is very likely to trigger this race -+ * when action=0 because it programs WOR to be half of the desired -+ * timeout, and watchdog_next_keepalive() chooses the exact same time to -+ * send keepalive pings. -+ * -+ * This triggers a race where sbsa_gwdt_keepalive() can be called right -+ * as WS0 is being asserted, and affected hardware will ignore that -+ * write and continue to assert WS0. After another (timeout / 2) -+ * seconds, the same race happens again. If the driver wins then the -+ * explicit refresh will reset WS0 to false but if the hardware wins, -+ * then WS1 is asserted and the system resets. -+ * -+ * Avoid the problem by scheduling keepalive heartbeats one second later -+ * than the WOR timeout. -+ * -+ * This workaround might not be needed in a future revision of the -+ * hardware. -+ */ -+ if (gwdt->need_ws0_race_workaround) -+ wdd->min_hw_heartbeat_ms = timeout * 500 + 1000; -+ - return 0; - } - -@@ -202,12 +234,15 @@ static int sbsa_gwdt_keepalive(struct watchdog_device *wdd) - static void sbsa_gwdt_get_version(struct watchdog_device *wdd) - { - struct sbsa_gwdt *gwdt = watchdog_get_drvdata(wdd); -- int ver; -+ int iidr, ver, impl; - -- ver = readl(gwdt->control_base + SBSA_GWDT_W_IIDR); -- ver = (ver >> SBSA_GWDT_VERSION_SHIFT) & SBSA_GWDT_VERSION_MASK; -+ iidr = readl(gwdt->control_base + SBSA_GWDT_W_IIDR); -+ ver = (iidr >> SBSA_GWDT_VERSION_SHIFT) & SBSA_GWDT_VERSION_MASK; -+ impl = (iidr >> SBSA_GWDT_IMPL_SHIFT) & SBSA_GWDT_IMPL_MASK; - - gwdt->version = ver; -+ gwdt->need_ws0_race_workaround = -+ !action && (impl == SBSA_GWDT_IMPL_MEDIATEK); - } - - static int sbsa_gwdt_start(struct watchdog_device *wdd) -@@ -299,6 +334,15 @@ static int sbsa_gwdt_probe(struct platform_device *pdev) - else - wdd->max_hw_heartbeat_ms = GENMASK_ULL(47, 0) / gwdt->clk * 1000; - -+ if (gwdt->need_ws0_race_workaround) { -+ /* -+ * A timeout of 3 seconds means that WOR will be set to 1.5 -+ * seconds and the heartbeat will be scheduled every 2.5 -+ * seconds. -+ */ -+ wdd->min_timeout = 3; -+ } -+ - status = readl(cf_base + SBSA_GWDT_WCS); - if (status & SBSA_GWDT_WCS_WS1) { - dev_warn(dev, "System reset by WDT.\n"); -diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c -index a2ba1c7fc16af4..10f803d0534e63 100644 ---- a/fs/btrfs/backref.c -+++ b/fs/btrfs/backref.c -@@ -222,8 +222,8 @@ static void free_pref(struct prelim_ref *ref) - * A -1 return indicates ref1 is a 'lower' block than ref2, while 1 - * indicates a 'higher' block. - */ --static int prelim_ref_compare(struct prelim_ref *ref1, -- struct prelim_ref *ref2) -+static int prelim_ref_compare(const struct prelim_ref *ref1, -+ const struct prelim_ref *ref2) - { - if (ref1->level < ref2->level) - return -1; -@@ -254,7 +254,7 @@ static int prelim_ref_compare(struct prelim_ref *ref1, - } - - static void update_share_count(struct share_check *sc, int oldcount, -- int newcount, struct prelim_ref *newref) -+ int newcount, const struct prelim_ref *newref) - { - if ((!sc) || (oldcount == 0 && newcount < 1)) - return; -diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c -index 226e6434a58a94..5a3a41c6d509f5 100644 ---- a/fs/btrfs/block-group.c -+++ b/fs/btrfs/block-group.c -@@ -23,7 +23,7 @@ - #include "extent-tree.h" - - #ifdef CONFIG_BTRFS_DEBUG --int btrfs_should_fragment_free_space(struct btrfs_block_group *block_group) -+int btrfs_should_fragment_free_space(const struct btrfs_block_group *block_group) - { - struct btrfs_fs_info *fs_info = block_group->fs_info; - -@@ -34,15 +34,28 @@ int btrfs_should_fragment_free_space(struct btrfs_block_group *block_group) - } - #endif - -+static inline bool has_unwritten_metadata(struct btrfs_block_group *block_group) -+{ -+ /* The meta_write_pointer is available only on the zoned setup. */ -+ if (!btrfs_is_zoned(block_group->fs_info)) -+ return false; -+ -+ if (block_group->flags & BTRFS_BLOCK_GROUP_DATA) -+ return false; -+ -+ return block_group->start + block_group->alloc_offset > -+ block_group->meta_write_pointer; -+} -+ - /* - * Return target flags in extended format or 0 if restripe for this chunk_type - * is not in progress - * - * Should be called with balance_lock held - */ --static u64 get_restripe_target(struct btrfs_fs_info *fs_info, u64 flags) -+static u64 get_restripe_target(const struct btrfs_fs_info *fs_info, u64 flags) - { -- struct btrfs_balance_control *bctl = fs_info->balance_ctl; -+ const struct btrfs_balance_control *bctl = fs_info->balance_ctl; - u64 target = 0; - - if (!bctl) -@@ -1240,6 +1253,15 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans, - goto out; - - spin_lock(&block_group->lock); -+ /* -+ * Hitting this WARN means we removed a block group with an unwritten -+ * region. It will cause "unable to find chunk map for logical" errors. -+ */ -+ if (WARN_ON(has_unwritten_metadata(block_group))) -+ btrfs_warn(fs_info, -+ "block group %llu is removed before metadata write out", -+ block_group->start); -+ - set_bit(BLOCK_GROUP_FLAG_REMOVED, &block_group->runtime_flags); - - /* -@@ -1418,9 +1440,9 @@ static int inc_block_group_ro(struct btrfs_block_group *cache, int force) - } - - static bool clean_pinned_extents(struct btrfs_trans_handle *trans, -- struct btrfs_block_group *bg) -+ const struct btrfs_block_group *bg) - { -- struct btrfs_fs_info *fs_info = bg->fs_info; -+ struct btrfs_fs_info *fs_info = trans->fs_info; - struct btrfs_transaction *prev_trans = NULL; - const u64 start = bg->start; - const u64 end = start + bg->length - 1; -@@ -1563,8 +1585,9 @@ void btrfs_delete_unused_bgs(struct btrfs_fs_info *fs_info) - * needing to allocate extents from the block group. - */ - used = btrfs_space_info_used(space_info, true); -- if (space_info->total_bytes - block_group->length < used && -- block_group->zone_unusable < block_group->length) { -+ if ((space_info->total_bytes - block_group->length < used && -+ block_group->zone_unusable < block_group->length) || -+ has_unwritten_metadata(block_group)) { - /* - * Add a reference for the list, compensate for the ref - * drop under the "next" label for the -@@ -1752,14 +1775,14 @@ static int reclaim_bgs_cmp(void *unused, const struct list_head *a, - return bg1->used > bg2->used; - } - --static inline bool btrfs_should_reclaim(struct btrfs_fs_info *fs_info) -+static inline bool btrfs_should_reclaim(const struct btrfs_fs_info *fs_info) - { - if (btrfs_is_zoned(fs_info)) - return btrfs_zoned_should_reclaim(fs_info); - return true; - } - --static bool should_reclaim_block_group(struct btrfs_block_group *bg, u64 bytes_freed) -+static bool should_reclaim_block_group(const struct btrfs_block_group *bg, u64 bytes_freed) - { - const struct btrfs_space_info *space_info = bg->space_info; - const int reclaim_thresh = READ_ONCE(space_info->bg_reclaim_threshold); -@@ -1991,8 +2014,8 @@ void btrfs_mark_bg_to_reclaim(struct btrfs_block_group *bg) - spin_unlock(&fs_info->unused_bgs_lock); - } - --static int read_bg_from_eb(struct btrfs_fs_info *fs_info, struct btrfs_key *key, -- struct btrfs_path *path) -+static int read_bg_from_eb(struct btrfs_fs_info *fs_info, const struct btrfs_key *key, -+ const struct btrfs_path *path) - { - struct extent_map_tree *em_tree; - struct extent_map *em; -@@ -2044,7 +2067,7 @@ static int read_bg_from_eb(struct btrfs_fs_info *fs_info, struct btrfs_key *key, - - static int find_first_block_group(struct btrfs_fs_info *fs_info, - struct btrfs_path *path, -- struct btrfs_key *key) -+ const struct btrfs_key *key) - { - struct btrfs_root *root = btrfs_block_group_root(fs_info); - int ret; -@@ -2636,8 +2659,8 @@ static int insert_block_group_item(struct btrfs_trans_handle *trans, - } - - static int insert_dev_extent(struct btrfs_trans_handle *trans, -- struct btrfs_device *device, u64 chunk_offset, -- u64 start, u64 num_bytes) -+ const struct btrfs_device *device, u64 chunk_offset, -+ u64 start, u64 num_bytes) - { - struct btrfs_fs_info *fs_info = device->fs_info; - struct btrfs_root *root = fs_info->dev_root; -@@ -2787,7 +2810,7 @@ void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans) - * For extent tree v2 we use the block_group_item->chunk_offset to point at our - * global root id. For v1 it's always set to BTRFS_FIRST_CHUNK_TREE_OBJECTID. - */ --static u64 calculate_global_root_id(struct btrfs_fs_info *fs_info, u64 offset) -+static u64 calculate_global_root_id(const struct btrfs_fs_info *fs_info, u64 offset) - { - u64 div = SZ_1G; - u64 index; -@@ -3823,8 +3846,8 @@ static void force_metadata_allocation(struct btrfs_fs_info *info) - } - } - --static int should_alloc_chunk(struct btrfs_fs_info *fs_info, -- struct btrfs_space_info *sinfo, int force) -+static int should_alloc_chunk(const struct btrfs_fs_info *fs_info, -+ const struct btrfs_space_info *sinfo, int force) - { - u64 bytes_used = btrfs_space_info_used(sinfo, false); - u64 thresh; -@@ -4199,7 +4222,7 @@ int btrfs_chunk_alloc(struct btrfs_trans_handle *trans, u64 flags, - return ret; - } - --static u64 get_profile_num_devs(struct btrfs_fs_info *fs_info, u64 type) -+static u64 get_profile_num_devs(const struct btrfs_fs_info *fs_info, u64 type) - { - u64 num_dev; - -@@ -4606,7 +4629,7 @@ int btrfs_use_block_group_size_class(struct btrfs_block_group *bg, - return 0; - } - --bool btrfs_block_group_should_use_size_class(struct btrfs_block_group *bg) -+bool btrfs_block_group_should_use_size_class(const struct btrfs_block_group *bg) - { - if (btrfs_is_zoned(bg->fs_info)) - return false; -diff --git a/fs/btrfs/block-group.h b/fs/btrfs/block-group.h -index 089979981e4aaa..a8a6a21e393d2e 100644 ---- a/fs/btrfs/block-group.h -+++ b/fs/btrfs/block-group.h -@@ -250,7 +250,7 @@ struct btrfs_block_group { - enum btrfs_block_group_size_class size_class; - }; - --static inline u64 btrfs_block_group_end(struct btrfs_block_group *block_group) -+static inline u64 btrfs_block_group_end(const struct btrfs_block_group *block_group) - { - return (block_group->start + block_group->length); - } -@@ -262,8 +262,7 @@ static inline bool btrfs_is_block_group_used(const struct btrfs_block_group *bg) - return (bg->used > 0 || bg->reserved > 0 || bg->pinned > 0); - } - --static inline bool btrfs_is_block_group_data_only( -- struct btrfs_block_group *block_group) -+static inline bool btrfs_is_block_group_data_only(const struct btrfs_block_group *block_group) - { - /* - * In mixed mode the fragmentation is expected to be high, lowering the -@@ -274,7 +273,7 @@ static inline bool btrfs_is_block_group_data_only( - } - - #ifdef CONFIG_BTRFS_DEBUG --int btrfs_should_fragment_free_space(struct btrfs_block_group *block_group); -+int btrfs_should_fragment_free_space(const struct btrfs_block_group *block_group); - #endif - - struct btrfs_block_group *btrfs_lookup_first_block_group( -@@ -355,7 +354,7 @@ static inline u64 btrfs_system_alloc_profile(struct btrfs_fs_info *fs_info) - return btrfs_get_alloc_profile(fs_info, BTRFS_BLOCK_GROUP_SYSTEM); - } - --static inline int btrfs_block_group_done(struct btrfs_block_group *cache) -+static inline int btrfs_block_group_done(const struct btrfs_block_group *cache) - { - smp_mb(); - return cache->cached == BTRFS_CACHE_FINISHED || -@@ -372,6 +371,6 @@ enum btrfs_block_group_size_class btrfs_calc_block_group_size_class(u64 size); - int btrfs_use_block_group_size_class(struct btrfs_block_group *bg, - enum btrfs_block_group_size_class size_class, - bool force_wrong_size_class); --bool btrfs_block_group_should_use_size_class(struct btrfs_block_group *bg); -+bool btrfs_block_group_should_use_size_class(const struct btrfs_block_group *bg); - - #endif /* BTRFS_BLOCK_GROUP_H */ -diff --git a/fs/btrfs/block-rsv.c b/fs/btrfs/block-rsv.c -index db8da4e7b22891..97084ea3af0cca 100644 ---- a/fs/btrfs/block-rsv.c -+++ b/fs/btrfs/block-rsv.c -@@ -547,7 +547,7 @@ struct btrfs_block_rsv *btrfs_use_block_rsv(struct btrfs_trans_handle *trans, - return ERR_PTR(ret); - } - --int btrfs_check_trunc_cache_free_space(struct btrfs_fs_info *fs_info, -+int btrfs_check_trunc_cache_free_space(const struct btrfs_fs_info *fs_info, - struct btrfs_block_rsv *rsv) - { - u64 needed_bytes; -diff --git a/fs/btrfs/block-rsv.h b/fs/btrfs/block-rsv.h -index 43a9a6b5a79f46..3c9a15f59731fc 100644 ---- a/fs/btrfs/block-rsv.h -+++ b/fs/btrfs/block-rsv.h -@@ -82,7 +82,7 @@ void btrfs_release_global_block_rsv(struct btrfs_fs_info *fs_info); - struct btrfs_block_rsv *btrfs_use_block_rsv(struct btrfs_trans_handle *trans, - struct btrfs_root *root, - u32 blocksize); --int btrfs_check_trunc_cache_free_space(struct btrfs_fs_info *fs_info, -+int btrfs_check_trunc_cache_free_space(const struct btrfs_fs_info *fs_info, - struct btrfs_block_rsv *rsv); - static inline void btrfs_unuse_block_rsv(struct btrfs_fs_info *fs_info, - struct btrfs_block_rsv *block_rsv, -diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h -index c23c56ead6b236..c4968efc3fc464 100644 ---- a/fs/btrfs/btrfs_inode.h -+++ b/fs/btrfs/btrfs_inode.h -@@ -251,7 +251,8 @@ struct btrfs_inode { - struct btrfs_delayed_node *delayed_node; - - /* File creation time. */ -- struct timespec64 i_otime; -+ u64 i_otime_sec; -+ u32 i_otime_nsec; - - /* Hook into fs_info->delayed_iputs */ - struct list_head delayed_iput; -diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c -index 4b21ca49b6665d..31b1b448efc2eb 100644 ---- a/fs/btrfs/ctree.c -+++ b/fs/btrfs/ctree.c -@@ -347,7 +347,14 @@ int btrfs_copy_root(struct btrfs_trans_handle *trans, - - write_extent_buffer_fsid(cow, fs_info->fs_devices->metadata_uuid); - -- WARN_ON(btrfs_header_generation(buf) > trans->transid); -+ if (unlikely(btrfs_header_generation(buf) > trans->transid)) { -+ btrfs_tree_unlock(cow); -+ free_extent_buffer(cow); -+ ret = -EUCLEAN; -+ btrfs_abort_transaction(trans, ret); -+ return ret; -+ } -+ - if (new_root_objectid == BTRFS_TREE_RELOC_OBJECTID) - ret = btrfs_inc_ref(trans, root, cow, 1); - else -@@ -2712,7 +2719,7 @@ int btrfs_get_next_valid_item(struct btrfs_root *root, struct btrfs_key *key, - * - */ - static void fixup_low_keys(struct btrfs_trans_handle *trans, -- struct btrfs_path *path, -+ const struct btrfs_path *path, - struct btrfs_disk_key *key, int level) - { - int i; -@@ -2742,7 +2749,7 @@ static void fixup_low_keys(struct btrfs_trans_handle *trans, - * that the new key won't break the order - */ - void btrfs_set_item_key_safe(struct btrfs_trans_handle *trans, -- struct btrfs_path *path, -+ const struct btrfs_path *path, - const struct btrfs_key *new_key) - { - struct btrfs_fs_info *fs_info = trans->fs_info; -@@ -2808,8 +2815,8 @@ void btrfs_set_item_key_safe(struct btrfs_trans_handle *trans, - * is correct, we only need to bother the last key of @left and the first - * key of @right. - */ --static bool check_sibling_keys(struct extent_buffer *left, -- struct extent_buffer *right) -+static bool check_sibling_keys(const struct extent_buffer *left, -+ const struct extent_buffer *right) - { - struct btrfs_key left_last; - struct btrfs_key right_first; -@@ -3049,6 +3056,7 @@ static noinline int insert_new_root(struct btrfs_trans_handle *trans, - if (ret < 0) { - int ret2; - -+ btrfs_clear_buffer_dirty(trans, c); - ret2 = btrfs_free_tree_block(trans, btrfs_root_id(root), c, 0, 1); - if (ret2 < 0) - btrfs_abort_transaction(trans, ret2); -@@ -3077,7 +3085,7 @@ static noinline int insert_new_root(struct btrfs_trans_handle *trans, - * blocknr is the block the key points to. - */ - static int insert_ptr(struct btrfs_trans_handle *trans, -- struct btrfs_path *path, -+ const struct btrfs_path *path, - struct btrfs_disk_key *key, u64 bytenr, - int slot, int level) - { -@@ -4168,7 +4176,7 @@ int btrfs_split_item(struct btrfs_trans_handle *trans, - * the front. - */ - void btrfs_truncate_item(struct btrfs_trans_handle *trans, -- struct btrfs_path *path, u32 new_size, int from_end) -+ const struct btrfs_path *path, u32 new_size, int from_end) - { - int slot; - struct extent_buffer *leaf; -@@ -4260,7 +4268,7 @@ void btrfs_truncate_item(struct btrfs_trans_handle *trans, - * make the item pointed to by the path bigger, data_size is the added size. - */ - void btrfs_extend_item(struct btrfs_trans_handle *trans, -- struct btrfs_path *path, u32 data_size) -+ const struct btrfs_path *path, u32 data_size) - { - int slot; - struct extent_buffer *leaf; -diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h -index 7df3ed2945b049..834af67fac231d 100644 ---- a/fs/btrfs/ctree.h -+++ b/fs/btrfs/ctree.h -@@ -521,7 +521,7 @@ int btrfs_previous_item(struct btrfs_root *root, - int btrfs_previous_extent_item(struct btrfs_root *root, - struct btrfs_path *path, u64 min_objectid); - void btrfs_set_item_key_safe(struct btrfs_trans_handle *trans, -- struct btrfs_path *path, -+ const struct btrfs_path *path, - const struct btrfs_key *new_key); - struct extent_buffer *btrfs_root_node(struct btrfs_root *root); - int btrfs_find_next_key(struct btrfs_root *root, struct btrfs_path *path, -@@ -555,9 +555,9 @@ int btrfs_block_can_be_shared(struct btrfs_trans_handle *trans, - int btrfs_del_ptr(struct btrfs_trans_handle *trans, struct btrfs_root *root, - struct btrfs_path *path, int level, int slot); - void btrfs_extend_item(struct btrfs_trans_handle *trans, -- struct btrfs_path *path, u32 data_size); -+ const struct btrfs_path *path, u32 data_size); - void btrfs_truncate_item(struct btrfs_trans_handle *trans, -- struct btrfs_path *path, u32 new_size, int from_end); -+ const struct btrfs_path *path, u32 new_size, int from_end); - int btrfs_split_item(struct btrfs_trans_handle *trans, - struct btrfs_root *root, - struct btrfs_path *path, -diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c -index 32c5f5a8a0e93d..c39e39142abf1d 100644 ---- a/fs/btrfs/delayed-inode.c -+++ b/fs/btrfs/delayed-inode.c -@@ -1849,10 +1849,8 @@ static void fill_stack_inode_item(struct btrfs_trans_handle *trans, - btrfs_set_stack_timespec_nsec(&inode_item->ctime, - inode_get_ctime(inode).tv_nsec); - -- btrfs_set_stack_timespec_sec(&inode_item->otime, -- BTRFS_I(inode)->i_otime.tv_sec); -- btrfs_set_stack_timespec_nsec(&inode_item->otime, -- BTRFS_I(inode)->i_otime.tv_nsec); -+ btrfs_set_stack_timespec_sec(&inode_item->otime, BTRFS_I(inode)->i_otime_sec); -+ btrfs_set_stack_timespec_nsec(&inode_item->otime, BTRFS_I(inode)->i_otime_nsec); - } - - int btrfs_fill_inode(struct inode *inode, u32 *rdev) -@@ -1901,10 +1899,8 @@ int btrfs_fill_inode(struct inode *inode, u32 *rdev) - inode_set_ctime(inode, btrfs_stack_timespec_sec(&inode_item->ctime), - btrfs_stack_timespec_nsec(&inode_item->ctime)); - -- BTRFS_I(inode)->i_otime.tv_sec = -- btrfs_stack_timespec_sec(&inode_item->otime); -- BTRFS_I(inode)->i_otime.tv_nsec = -- btrfs_stack_timespec_nsec(&inode_item->otime); -+ BTRFS_I(inode)->i_otime_sec = btrfs_stack_timespec_sec(&inode_item->otime); -+ BTRFS_I(inode)->i_otime_nsec = btrfs_stack_timespec_nsec(&inode_item->otime); - - inode->i_generation = BTRFS_I(inode)->generation; - BTRFS_I(inode)->index_cnt = (u64)-1; -diff --git a/fs/btrfs/discard.c b/fs/btrfs/discard.c -index 3981c941f5b556..d6eef4bd9e9d45 100644 ---- a/fs/btrfs/discard.c -+++ b/fs/btrfs/discard.c -@@ -68,7 +68,7 @@ static int discard_minlen[BTRFS_NR_DISCARD_LISTS] = { - }; - - static struct list_head *get_discard_list(struct btrfs_discard_ctl *discard_ctl, -- struct btrfs_block_group *block_group) -+ const struct btrfs_block_group *block_group) - { - return &discard_ctl->discard_list[block_group->discard_index]; - } -@@ -80,7 +80,7 @@ static struct list_head *get_discard_list(struct btrfs_discard_ctl *discard_ctl, - * - * Check if the file system is writeable and BTRFS_FS_DISCARD_RUNNING is set. - */ --static bool btrfs_run_discard_work(struct btrfs_discard_ctl *discard_ctl) -+static bool btrfs_run_discard_work(const struct btrfs_discard_ctl *discard_ctl) - { - struct btrfs_fs_info *fs_info = container_of(discard_ctl, - struct btrfs_fs_info, -diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c -index ef77d420851040..8248113eb067fa 100644 ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -3530,6 +3530,21 @@ btrfs_release_block_group(struct btrfs_block_group *cache, - btrfs_put_block_group(cache); - } - -+static bool find_free_extent_check_size_class(const struct find_free_extent_ctl *ffe_ctl, -+ const struct btrfs_block_group *bg) -+{ -+ if (ffe_ctl->policy == BTRFS_EXTENT_ALLOC_ZONED) -+ return true; -+ if (!btrfs_block_group_should_use_size_class(bg)) -+ return true; -+ if (ffe_ctl->loop >= LOOP_WRONG_SIZE_CLASS) -+ return true; -+ if (ffe_ctl->loop >= LOOP_UNSET_SIZE_CLASS && -+ bg->size_class == BTRFS_BG_SZ_NONE) -+ return true; -+ return ffe_ctl->size_class == bg->size_class; -+} -+ - /* - * Helper function for find_free_extent(). - * -@@ -3551,7 +3566,8 @@ static int find_free_extent_clustered(struct btrfs_block_group *bg, - if (!cluster_bg) - goto refill_cluster; - if (cluster_bg != bg && (cluster_bg->ro || -- !block_group_bits(cluster_bg, ffe_ctl->flags))) -+ !block_group_bits(cluster_bg, ffe_ctl->flags) || -+ !find_free_extent_check_size_class(ffe_ctl, cluster_bg))) - goto release_cluster; - - offset = btrfs_alloc_from_cluster(cluster_bg, last_ptr, -@@ -4107,21 +4123,6 @@ static int find_free_extent_update_loop(struct btrfs_fs_info *fs_info, - return -ENOSPC; - } - --static bool find_free_extent_check_size_class(struct find_free_extent_ctl *ffe_ctl, -- struct btrfs_block_group *bg) --{ -- if (ffe_ctl->policy == BTRFS_EXTENT_ALLOC_ZONED) -- return true; -- if (!btrfs_block_group_should_use_size_class(bg)) -- return true; -- if (ffe_ctl->loop >= LOOP_WRONG_SIZE_CLASS) -- return true; -- if (ffe_ctl->loop >= LOOP_UNSET_SIZE_CLASS && -- bg->size_class == BTRFS_BG_SZ_NONE) -- return true; -- return ffe_ctl->size_class == bg->size_class; --} -- - static int prepare_allocation_clustered(struct btrfs_fs_info *fs_info, - struct find_free_extent_ctl *ffe_ctl, - struct btrfs_space_info *space_info, -diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c -index 45cae356e89ba0..ea5759a689b97d 100644 ---- a/fs/btrfs/file-item.c -+++ b/fs/btrfs/file-item.c -@@ -153,7 +153,7 @@ static inline u32 max_ordered_sum_bytes(const struct btrfs_fs_info *fs_info) - * Calculate the total size needed to allocate for an ordered sum structure - * spanning @bytes in the file. - */ --static int btrfs_ordered_sum_size(struct btrfs_fs_info *fs_info, unsigned long bytes) -+static int btrfs_ordered_sum_size(const struct btrfs_fs_info *fs_info, unsigned long bytes) - { - return sizeof(struct btrfs_ordered_sum) + bytes_to_csum_size(fs_info, bytes); - } -@@ -1263,7 +1263,7 @@ int btrfs_csum_file_blocks(struct btrfs_trans_handle *trans, - - void btrfs_extent_item_to_extent_map(struct btrfs_inode *inode, - const struct btrfs_path *path, -- struct btrfs_file_extent_item *fi, -+ const struct btrfs_file_extent_item *fi, - struct extent_map *em) - { - struct btrfs_fs_info *fs_info = inode->root->fs_info; -diff --git a/fs/btrfs/file-item.h b/fs/btrfs/file-item.h -index 04bd2d34efb14b..2b1d08b88b616d 100644 ---- a/fs/btrfs/file-item.h -+++ b/fs/btrfs/file-item.h -@@ -62,7 +62,7 @@ int btrfs_lookup_csums_bitmap(struct btrfs_root *root, struct btrfs_path *path, - unsigned long *csum_bitmap); - void btrfs_extent_item_to_extent_map(struct btrfs_inode *inode, - const struct btrfs_path *path, -- struct btrfs_file_extent_item *fi, -+ const struct btrfs_file_extent_item *fi, - struct extent_map *em); - int btrfs_inode_clear_file_extent_range(struct btrfs_inode *inode, u64 start, - u64 len); -diff --git a/fs/btrfs/free-space-tree.c b/fs/btrfs/free-space-tree.c -index 300ee0b68b498e..8efe3a9369df04 100644 ---- a/fs/btrfs/free-space-tree.c -+++ b/fs/btrfs/free-space-tree.c -@@ -1371,12 +1371,17 @@ static int __add_block_group_free_space(struct btrfs_trans_handle *trans, - clear_bit(BLOCK_GROUP_FLAG_NEEDS_FREE_SPACE, &block_group->runtime_flags); - - ret = add_new_free_space_info(trans, block_group, path); -- if (ret) -+ if (ret) { -+ btrfs_abort_transaction(trans, ret); - return ret; -+ } -+ -+ ret = __add_to_free_space_tree(trans, block_group, path, -+ block_group->start, block_group->length); -+ if (ret) -+ btrfs_abort_transaction(trans, ret); - -- return __add_to_free_space_tree(trans, block_group, path, -- block_group->start, -- block_group->length); -+ return 0; - } - - int add_block_group_free_space(struct btrfs_trans_handle *trans, -@@ -1396,16 +1401,14 @@ int add_block_group_free_space(struct btrfs_trans_handle *trans, - path = btrfs_alloc_path(); - if (!path) { - ret = -ENOMEM; -+ btrfs_abort_transaction(trans, ret); - goto out; - } - - ret = __add_block_group_free_space(trans, block_group, path); -- - out: - btrfs_free_path(path); - mutex_unlock(&block_group->free_space_lock); -- if (ret) -- btrfs_abort_transaction(trans, ret); - return ret; - } - -diff --git a/fs/btrfs/inode-item.c b/fs/btrfs/inode-item.c -index d3ff97374d48aa..ab741a57842409 100644 ---- a/fs/btrfs/inode-item.c -+++ b/fs/btrfs/inode-item.c -@@ -15,7 +15,7 @@ - #include "extent-tree.h" - #include "file-item.h" - --struct btrfs_inode_ref *btrfs_find_name_in_backref(struct extent_buffer *leaf, -+struct btrfs_inode_ref *btrfs_find_name_in_backref(const struct extent_buffer *leaf, - int slot, - const struct fscrypt_str *name) - { -@@ -43,7 +43,7 @@ struct btrfs_inode_ref *btrfs_find_name_in_backref(struct extent_buffer *leaf, - } - - struct btrfs_inode_extref *btrfs_find_name_in_ext_backref( -- struct extent_buffer *leaf, int slot, u64 ref_objectid, -+ const struct extent_buffer *leaf, int slot, u64 ref_objectid, - const struct fscrypt_str *name) - { - struct btrfs_inode_extref *extref; -@@ -424,9 +424,9 @@ int btrfs_lookup_inode(struct btrfs_trans_handle *trans, struct btrfs_root - return ret; - } - --static inline void btrfs_trace_truncate(struct btrfs_inode *inode, -- struct extent_buffer *leaf, -- struct btrfs_file_extent_item *fi, -+static inline void btrfs_trace_truncate(const struct btrfs_inode *inode, -+ const struct extent_buffer *leaf, -+ const struct btrfs_file_extent_item *fi, - u64 offset, int extent_type, int slot) - { - if (!inode) -diff --git a/fs/btrfs/inode-item.h b/fs/btrfs/inode-item.h -index ede43b6c65591d..d43633d5620f29 100644 ---- a/fs/btrfs/inode-item.h -+++ b/fs/btrfs/inode-item.h -@@ -100,11 +100,11 @@ struct btrfs_inode_extref *btrfs_lookup_inode_extref( - u64 inode_objectid, u64 ref_objectid, int ins_len, - int cow); - --struct btrfs_inode_ref *btrfs_find_name_in_backref(struct extent_buffer *leaf, -+struct btrfs_inode_ref *btrfs_find_name_in_backref(const struct extent_buffer *leaf, - int slot, - const struct fscrypt_str *name); - struct btrfs_inode_extref *btrfs_find_name_in_ext_backref( -- struct extent_buffer *leaf, int slot, u64 ref_objectid, -+ const struct extent_buffer *leaf, int slot, u64 ref_objectid, - const struct fscrypt_str *name); - - #endif -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 218d15f5ddf737..4502a474a81dab 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -3785,10 +3785,8 @@ static int btrfs_read_locked_inode(struct inode *inode, - inode_set_ctime(inode, btrfs_timespec_sec(leaf, &inode_item->ctime), - btrfs_timespec_nsec(leaf, &inode_item->ctime)); - -- BTRFS_I(inode)->i_otime.tv_sec = -- btrfs_timespec_sec(leaf, &inode_item->otime); -- BTRFS_I(inode)->i_otime.tv_nsec = -- btrfs_timespec_nsec(leaf, &inode_item->otime); -+ BTRFS_I(inode)->i_otime_sec = btrfs_timespec_sec(leaf, &inode_item->otime); -+ BTRFS_I(inode)->i_otime_nsec = btrfs_timespec_nsec(leaf, &inode_item->otime); - - inode_set_bytes(inode, btrfs_inode_nbytes(leaf, inode_item)); - BTRFS_I(inode)->generation = btrfs_inode_generation(leaf, inode_item); -@@ -3958,10 +3956,8 @@ static void fill_inode_item(struct btrfs_trans_handle *trans, - btrfs_set_token_timespec_nsec(&token, &item->ctime, - inode_get_ctime(inode).tv_nsec); - -- btrfs_set_token_timespec_sec(&token, &item->otime, -- BTRFS_I(inode)->i_otime.tv_sec); -- btrfs_set_token_timespec_nsec(&token, &item->otime, -- BTRFS_I(inode)->i_otime.tv_nsec); -+ btrfs_set_token_timespec_sec(&token, &item->otime, BTRFS_I(inode)->i_otime_sec); -+ btrfs_set_token_timespec_nsec(&token, &item->otime, BTRFS_I(inode)->i_otime_nsec); - - btrfs_set_token_inode_nbytes(&token, item, inode_get_bytes(inode)); - btrfs_set_token_inode_generation(&token, item, -@@ -5644,7 +5640,8 @@ static struct inode *new_simple_dir(struct inode *dir, - inode->i_mode = S_IFDIR | S_IRUGO | S_IWUSR | S_IXUGO; - inode->i_mtime = inode_set_ctime_current(inode); - inode->i_atime = dir->i_atime; -- BTRFS_I(inode)->i_otime = inode->i_mtime; -+ BTRFS_I(inode)->i_otime_sec = inode->i_mtime.tv_sec; -+ BTRFS_I(inode)->i_otime_nsec = inode->i_mtime.tv_nsec; - inode->i_uid = dir->i_uid; - inode->i_gid = dir->i_gid; - -@@ -6321,7 +6318,8 @@ int btrfs_create_new_inode(struct btrfs_trans_handle *trans, - - inode->i_mtime = inode_set_ctime_current(inode); - inode->i_atime = inode->i_mtime; -- BTRFS_I(inode)->i_otime = inode->i_mtime; -+ BTRFS_I(inode)->i_otime_sec = inode->i_mtime.tv_sec; -+ BTRFS_I(inode)->i_otime_nsec = inode->i_mtime.tv_nsec; - - /* - * We're going to fill the inode item now, so at this point the inode -@@ -8550,8 +8548,8 @@ struct inode *btrfs_alloc_inode(struct super_block *sb) - - ei->delayed_node = NULL; - -- ei->i_otime.tv_sec = 0; -- ei->i_otime.tv_nsec = 0; -+ ei->i_otime_sec = 0; -+ ei->i_otime_nsec = 0; - - inode = &ei->vfs_inode; - extent_map_tree_init(&ei->extent_tree); -@@ -8703,8 +8701,8 @@ static int btrfs_getattr(struct mnt_idmap *idmap, - u32 bi_ro_flags = BTRFS_I(inode)->ro_flags; - - stat->result_mask |= STATX_BTIME; -- stat->btime.tv_sec = BTRFS_I(inode)->i_otime.tv_sec; -- stat->btime.tv_nsec = BTRFS_I(inode)->i_otime.tv_nsec; -+ stat->btime.tv_sec = BTRFS_I(inode)->i_otime_sec; -+ stat->btime.tv_nsec = BTRFS_I(inode)->i_otime_nsec; - if (bi_flags & BTRFS_INODE_APPEND) - stat->attributes |= STATX_ATTR_APPEND; - if (bi_flags & BTRFS_INODE_COMPRESS) -diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c -index 1b9f4f16d12404..c46ea2ecf18817 100644 ---- a/fs/btrfs/qgroup.c -+++ b/fs/btrfs/qgroup.c -@@ -579,22 +579,30 @@ bool btrfs_check_quota_leak(struct btrfs_fs_info *fs_info) - - /* - * This is called from close_ctree() or open_ctree() or btrfs_quota_disable(), -- * first two are in single-threaded paths.And for the third one, we have set -- * quota_root to be null with qgroup_lock held before, so it is safe to clean -- * up the in-memory structures without qgroup_lock held. -+ * first two are in single-threaded paths. - */ - void btrfs_free_qgroup_config(struct btrfs_fs_info *fs_info) - { - struct rb_node *n; - struct btrfs_qgroup *qgroup; - -+ /* -+ * btrfs_quota_disable() can be called concurrently with -+ * btrfs_qgroup_rescan() -> qgroup_rescan_zero_tracking(), so take the -+ * lock. -+ */ -+ spin_lock(&fs_info->qgroup_lock); - while ((n = rb_first(&fs_info->qgroup_tree))) { - qgroup = rb_entry(n, struct btrfs_qgroup, node); - rb_erase(n, &fs_info->qgroup_tree); - __del_qgroup_rb(fs_info, qgroup); -+ spin_unlock(&fs_info->qgroup_lock); - btrfs_sysfs_del_one_qgroup(fs_info, qgroup); - kfree(qgroup); -+ spin_lock(&fs_info->qgroup_lock); - } -+ spin_unlock(&fs_info->qgroup_lock); -+ - /* - * We call btrfs_free_qgroup_config() when unmounting - * filesystem and disabling quota, so we set qgroup_ulist -@@ -3616,12 +3624,21 @@ btrfs_qgroup_rescan(struct btrfs_fs_info *fs_info) - qgroup_rescan_zero_tracking(fs_info); - - mutex_lock(&fs_info->qgroup_rescan_lock); -- fs_info->qgroup_rescan_running = true; -- btrfs_queue_work(fs_info->qgroup_rescan_workers, -- &fs_info->qgroup_rescan_work); -+ /* -+ * The rescan worker is only for full accounting qgroups, check if it's -+ * enabled as it is pointless to queue it otherwise. A concurrent quota -+ * disable may also have just cleared BTRFS_FS_QUOTA_ENABLED. -+ */ -+ if (test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags)) { -+ fs_info->qgroup_rescan_running = true; -+ btrfs_queue_work(fs_info->qgroup_rescan_workers, -+ &fs_info->qgroup_rescan_work); -+ } else { -+ ret = -ENOTCONN; -+ } - mutex_unlock(&fs_info->qgroup_rescan_lock); - -- return 0; -+ return ret; - } - - int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info, -diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c -index 474758c878fcab..8cc1f4b832773e 100644 ---- a/fs/btrfs/relocation.c -+++ b/fs/btrfs/relocation.c -@@ -693,6 +693,25 @@ static struct btrfs_root *create_reloc_root(struct btrfs_trans_handle *trans, - if (root->root_key.objectid == objectid) { - u64 commit_root_gen; - -+ /* -+ * Relocation will wait for cleaner thread, and any half-dropped -+ * subvolume will be fully cleaned up at mount time. -+ * So here we shouldn't hit a subvolume with non-zero drop_progress. -+ * -+ * If this isn't the case, error out since it can make us attempt to -+ * drop references for extents that were already dropped before. -+ */ -+ if (unlikely(btrfs_disk_key_objectid(&root->root_item.drop_progress))) { -+ struct btrfs_key cpu_key; -+ -+ btrfs_disk_key_to_cpu(&cpu_key, &root->root_item.drop_progress); -+ btrfs_err(fs_info, -+ "cannot relocate partially dropped subvolume %llu, drop progress key (%llu %u %llu)", -+ objectid, cpu_key.objectid, cpu_key.type, cpu_key.offset); -+ ret = -EUCLEAN; -+ goto fail; -+ } -+ - /* called by btrfs_init_reloc_root */ - ret = btrfs_copy_root(trans, root, root->commit_root, &eb, - BTRFS_TREE_RELOC_OBJECTID); -diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c -index e2ead36e5be422..c25eb4416a6710 100644 ---- a/fs/btrfs/send.c -+++ b/fs/btrfs/send.c -@@ -4,6 +4,7 @@ - */ - - #include -+#include - #include - #include - #include -@@ -179,6 +180,7 @@ struct send_ctx { - u64 cur_inode_rdev; - u64 cur_inode_last_extent; - u64 cur_inode_next_write_offset; -+ struct fs_path cur_inode_path; - bool cur_inode_new; - bool cur_inode_new_gen; - bool cur_inode_deleted; -@@ -436,6 +438,14 @@ static void fs_path_reset(struct fs_path *p) - } - } - -+static void init_path(struct fs_path *p) -+{ -+ p->reversed = 0; -+ p->buf = p->inline_buf; -+ p->buf_len = FS_PATH_INLINE_SIZE; -+ fs_path_reset(p); -+} -+ - static struct fs_path *fs_path_alloc(void) - { - struct fs_path *p; -@@ -443,10 +453,7 @@ static struct fs_path *fs_path_alloc(void) - p = kmalloc(sizeof(*p), GFP_KERNEL); - if (!p) - return NULL; -- p->reversed = 0; -- p->buf = p->inline_buf; -- p->buf_len = FS_PATH_INLINE_SIZE; -- fs_path_reset(p); -+ init_path(p); - return p; - } - -@@ -471,7 +478,7 @@ static void fs_path_free(struct fs_path *p) - kfree(p); - } - --static int fs_path_len(struct fs_path *p) -+static inline int fs_path_len(const struct fs_path *p) - { - return p->end - p->start; - } -@@ -624,6 +631,14 @@ static void fs_path_unreverse(struct fs_path *p) - p->reversed = 0; - } - -+static inline bool is_current_inode_path(const struct send_ctx *sctx, -+ const struct fs_path *path) -+{ -+ const struct fs_path *cur = &sctx->cur_inode_path; -+ -+ return (strncmp(path->start, cur->start, fs_path_len(cur)) == 0); -+} -+ - static struct btrfs_path *alloc_path_for_send(void) - { - struct btrfs_path *path; -@@ -2450,6 +2465,14 @@ static int get_cur_path(struct send_ctx *sctx, u64 ino, u64 gen, - u64 parent_inode = 0; - u64 parent_gen = 0; - int stop = 0; -+ const bool is_cur_inode = (ino == sctx->cur_ino && gen == sctx->cur_inode_gen); -+ -+ if (is_cur_inode && fs_path_len(&sctx->cur_inode_path) > 0) { -+ if (dest != &sctx->cur_inode_path) -+ return fs_path_copy(dest, &sctx->cur_inode_path); -+ -+ return 0; -+ } - - name = fs_path_alloc(); - if (!name) { -@@ -2501,8 +2524,12 @@ static int get_cur_path(struct send_ctx *sctx, u64 ino, u64 gen, - - out: - fs_path_free(name); -- if (!ret) -+ if (!ret) { - fs_path_unreverse(dest); -+ if (is_cur_inode && dest != &sctx->cur_inode_path) -+ ret = fs_path_copy(&sctx->cur_inode_path, dest); -+ } -+ - return ret; - } - -@@ -2597,6 +2624,47 @@ static int send_subvol_begin(struct send_ctx *sctx) - return ret; - } - -+static struct fs_path *get_cur_inode_path(struct send_ctx *sctx) -+{ -+ if (fs_path_len(&sctx->cur_inode_path) == 0) { -+ int ret; -+ -+ ret = get_cur_path(sctx, sctx->cur_ino, sctx->cur_inode_gen, -+ &sctx->cur_inode_path); -+ if (ret < 0) -+ return ERR_PTR(ret); -+ } -+ -+ return &sctx->cur_inode_path; -+} -+ -+static struct fs_path *get_path_for_command(struct send_ctx *sctx, u64 ino, u64 gen) -+{ -+ struct fs_path *path; -+ int ret; -+ -+ if (ino == sctx->cur_ino && gen == sctx->cur_inode_gen) -+ return get_cur_inode_path(sctx); -+ -+ path = fs_path_alloc(); -+ if (!path) -+ return ERR_PTR(-ENOMEM); -+ -+ ret = get_cur_path(sctx, ino, gen, path); -+ if (ret < 0) { -+ fs_path_free(path); -+ return ERR_PTR(ret); -+ } -+ -+ return path; -+} -+ -+static void free_path_for_command(const struct send_ctx *sctx, struct fs_path *path) -+{ -+ if (path != &sctx->cur_inode_path) -+ fs_path_free(path); -+} -+ - static int send_truncate(struct send_ctx *sctx, u64 ino, u64 gen, u64 size) - { - struct btrfs_fs_info *fs_info = sctx->send_root->fs_info; -@@ -2605,17 +2673,14 @@ static int send_truncate(struct send_ctx *sctx, u64 ino, u64 gen, u64 size) - - btrfs_debug(fs_info, "send_truncate %llu size=%llu", ino, size); - -- p = fs_path_alloc(); -- if (!p) -- return -ENOMEM; -+ p = get_path_for_command(sctx, ino, gen); -+ if (IS_ERR(p)) -+ return PTR_ERR(p); - - ret = begin_cmd(sctx, BTRFS_SEND_C_TRUNCATE); - if (ret < 0) - goto out; - -- ret = get_cur_path(sctx, ino, gen, p); -- if (ret < 0) -- goto out; - TLV_PUT_PATH(sctx, BTRFS_SEND_A_PATH, p); - TLV_PUT_U64(sctx, BTRFS_SEND_A_SIZE, size); - -@@ -2623,7 +2688,7 @@ static int send_truncate(struct send_ctx *sctx, u64 ino, u64 gen, u64 size) - - tlv_put_failure: - out: -- fs_path_free(p); -+ free_path_for_command(sctx, p); - return ret; - } - -@@ -2635,17 +2700,14 @@ static int send_chmod(struct send_ctx *sctx, u64 ino, u64 gen, u64 mode) - - btrfs_debug(fs_info, "send_chmod %llu mode=%llu", ino, mode); - -- p = fs_path_alloc(); -- if (!p) -- return -ENOMEM; -+ p = get_path_for_command(sctx, ino, gen); -+ if (IS_ERR(p)) -+ return PTR_ERR(p); - - ret = begin_cmd(sctx, BTRFS_SEND_C_CHMOD); - if (ret < 0) - goto out; - -- ret = get_cur_path(sctx, ino, gen, p); -- if (ret < 0) -- goto out; - TLV_PUT_PATH(sctx, BTRFS_SEND_A_PATH, p); - TLV_PUT_U64(sctx, BTRFS_SEND_A_MODE, mode & 07777); - -@@ -2653,7 +2715,7 @@ static int send_chmod(struct send_ctx *sctx, u64 ino, u64 gen, u64 mode) - - tlv_put_failure: - out: -- fs_path_free(p); -+ free_path_for_command(sctx, p); - return ret; - } - -@@ -2668,17 +2730,14 @@ static int send_fileattr(struct send_ctx *sctx, u64 ino, u64 gen, u64 fileattr) - - btrfs_debug(fs_info, "send_fileattr %llu fileattr=%llu", ino, fileattr); - -- p = fs_path_alloc(); -- if (!p) -- return -ENOMEM; -+ p = get_path_for_command(sctx, ino, gen); -+ if (IS_ERR(p)) -+ return PTR_ERR(p); - - ret = begin_cmd(sctx, BTRFS_SEND_C_FILEATTR); - if (ret < 0) - goto out; - -- ret = get_cur_path(sctx, ino, gen, p); -- if (ret < 0) -- goto out; - TLV_PUT_PATH(sctx, BTRFS_SEND_A_PATH, p); - TLV_PUT_U64(sctx, BTRFS_SEND_A_FILEATTR, fileattr); - -@@ -2686,7 +2745,7 @@ static int send_fileattr(struct send_ctx *sctx, u64 ino, u64 gen, u64 fileattr) - - tlv_put_failure: - out: -- fs_path_free(p); -+ free_path_for_command(sctx, p); - return ret; - } - -@@ -2699,17 +2758,14 @@ static int send_chown(struct send_ctx *sctx, u64 ino, u64 gen, u64 uid, u64 gid) - btrfs_debug(fs_info, "send_chown %llu uid=%llu, gid=%llu", - ino, uid, gid); - -- p = fs_path_alloc(); -- if (!p) -- return -ENOMEM; -+ p = get_path_for_command(sctx, ino, gen); -+ if (IS_ERR(p)) -+ return PTR_ERR(p); - - ret = begin_cmd(sctx, BTRFS_SEND_C_CHOWN); - if (ret < 0) - goto out; - -- ret = get_cur_path(sctx, ino, gen, p); -- if (ret < 0) -- goto out; - TLV_PUT_PATH(sctx, BTRFS_SEND_A_PATH, p); - TLV_PUT_U64(sctx, BTRFS_SEND_A_UID, uid); - TLV_PUT_U64(sctx, BTRFS_SEND_A_GID, gid); -@@ -2718,7 +2774,7 @@ static int send_chown(struct send_ctx *sctx, u64 ino, u64 gen, u64 uid, u64 gid) - - tlv_put_failure: - out: -- fs_path_free(p); -+ free_path_for_command(sctx, p); - return ret; - } - -@@ -2735,9 +2791,9 @@ static int send_utimes(struct send_ctx *sctx, u64 ino, u64 gen) - - btrfs_debug(fs_info, "send_utimes %llu", ino); - -- p = fs_path_alloc(); -- if (!p) -- return -ENOMEM; -+ p = get_path_for_command(sctx, ino, gen); -+ if (IS_ERR(p)) -+ return PTR_ERR(p); - - path = alloc_path_for_send(); - if (!path) { -@@ -2762,9 +2818,6 @@ static int send_utimes(struct send_ctx *sctx, u64 ino, u64 gen) - if (ret < 0) - goto out; - -- ret = get_cur_path(sctx, ino, gen, p); -- if (ret < 0) -- goto out; - TLV_PUT_PATH(sctx, BTRFS_SEND_A_PATH, p); - TLV_PUT_BTRFS_TIMESPEC(sctx, BTRFS_SEND_A_ATIME, eb, &ii->atime); - TLV_PUT_BTRFS_TIMESPEC(sctx, BTRFS_SEND_A_MTIME, eb, &ii->mtime); -@@ -2776,7 +2829,7 @@ static int send_utimes(struct send_ctx *sctx, u64 ino, u64 gen) - - tlv_put_failure: - out: -- fs_path_free(p); -+ free_path_for_command(sctx, p); - btrfs_free_path(path); - return ret; - } -@@ -3113,6 +3166,11 @@ static int orphanize_inode(struct send_ctx *sctx, u64 ino, u64 gen, - goto out; - - ret = send_rename(sctx, path, orphan); -+ if (ret < 0) -+ goto out; -+ -+ if (ino == sctx->cur_ino && gen == sctx->cur_inode_gen) -+ ret = fs_path_copy(&sctx->cur_inode_path, orphan); - - out: - fs_path_free(orphan); -@@ -4166,6 +4224,23 @@ static int refresh_ref_path(struct send_ctx *sctx, struct recorded_ref *ref) - return ret; - } - -+static int rename_current_inode(struct send_ctx *sctx, -+ struct fs_path *current_path, -+ struct fs_path *new_path) -+{ -+ int ret; -+ -+ ret = send_rename(sctx, current_path, new_path); -+ if (ret < 0) -+ return ret; -+ -+ ret = fs_path_copy(&sctx->cur_inode_path, new_path); -+ if (ret < 0) -+ return ret; -+ -+ return fs_path_copy(current_path, new_path); -+} -+ - /* - * This does all the move/link/unlink/rmdir magic. - */ -@@ -4180,9 +4255,9 @@ static int process_recorded_refs(struct send_ctx *sctx, int *pending_move) - u64 ow_inode = 0; - u64 ow_gen; - u64 ow_mode; -- int did_overwrite = 0; -- int is_orphan = 0; - u64 last_dir_ino_rm = 0; -+ bool did_overwrite = false; -+ bool is_orphan = false; - bool can_rename = true; - bool orphanized_dir = false; - bool orphanized_ancestor = false; -@@ -4224,14 +4299,14 @@ static int process_recorded_refs(struct send_ctx *sctx, int *pending_move) - if (ret < 0) - goto out; - if (ret) -- did_overwrite = 1; -+ did_overwrite = true; - } - if (sctx->cur_inode_new || did_overwrite) { - ret = gen_unique_name(sctx, sctx->cur_ino, - sctx->cur_inode_gen, valid_path); - if (ret < 0) - goto out; -- is_orphan = 1; -+ is_orphan = true; - } else { - ret = get_cur_path(sctx, sctx->cur_ino, sctx->cur_inode_gen, - valid_path); -@@ -4356,6 +4431,7 @@ static int process_recorded_refs(struct send_ctx *sctx, int *pending_move) - if (ret > 0) { - orphanized_ancestor = true; - fs_path_reset(valid_path); -+ fs_path_reset(&sctx->cur_inode_path); - ret = get_cur_path(sctx, sctx->cur_ino, - sctx->cur_inode_gen, - valid_path); -@@ -4451,13 +4527,10 @@ static int process_recorded_refs(struct send_ctx *sctx, int *pending_move) - * it depending on the inode mode. - */ - if (is_orphan && can_rename) { -- ret = send_rename(sctx, valid_path, cur->full_path); -- if (ret < 0) -- goto out; -- is_orphan = 0; -- ret = fs_path_copy(valid_path, cur->full_path); -+ ret = rename_current_inode(sctx, valid_path, cur->full_path); - if (ret < 0) - goto out; -+ is_orphan = false; - } else if (can_rename) { - if (S_ISDIR(sctx->cur_inode_mode)) { - /* -@@ -4465,10 +4538,7 @@ static int process_recorded_refs(struct send_ctx *sctx, int *pending_move) - * dirs, we always have one new and one deleted - * ref. The deleted ref is ignored later. - */ -- ret = send_rename(sctx, valid_path, -- cur->full_path); -- if (!ret) -- ret = fs_path_copy(valid_path, -+ ret = rename_current_inode(sctx, valid_path, - cur->full_path); - if (ret < 0) - goto out; -@@ -4515,7 +4585,7 @@ static int process_recorded_refs(struct send_ctx *sctx, int *pending_move) - sctx->cur_inode_gen, valid_path); - if (ret < 0) - goto out; -- is_orphan = 1; -+ is_orphan = true; - } - - list_for_each_entry(cur, &sctx->deleted_refs, list) { -@@ -4561,6 +4631,8 @@ static int process_recorded_refs(struct send_ctx *sctx, int *pending_move) - ret = send_unlink(sctx, cur->full_path); - if (ret < 0) - goto out; -+ if (is_current_inode_path(sctx, cur->full_path)) -+ fs_path_reset(&sctx->cur_inode_path); - } - ret = dup_ref(cur, &check_dirs); - if (ret < 0) -@@ -4879,11 +4951,15 @@ static int process_all_refs(struct send_ctx *sctx, - } - - static int send_set_xattr(struct send_ctx *sctx, -- struct fs_path *path, - const char *name, int name_len, - const char *data, int data_len) - { -- int ret = 0; -+ struct fs_path *path; -+ int ret; -+ -+ path = get_cur_inode_path(sctx); -+ if (IS_ERR(path)) -+ return PTR_ERR(path); - - ret = begin_cmd(sctx, BTRFS_SEND_C_SET_XATTR); - if (ret < 0) -@@ -4924,19 +5000,13 @@ static int __process_new_xattr(int num, struct btrfs_key *di_key, - const char *name, int name_len, const char *data, - int data_len, void *ctx) - { -- int ret; - struct send_ctx *sctx = ctx; -- struct fs_path *p; - struct posix_acl_xattr_header dummy_acl; - - /* Capabilities are emitted by finish_inode_if_needed */ - if (!strncmp(name, XATTR_NAME_CAPS, name_len)) - return 0; - -- p = fs_path_alloc(); -- if (!p) -- return -ENOMEM; -- - /* - * This hack is needed because empty acls are stored as zero byte - * data in xattrs. Problem with that is, that receiving these zero byte -@@ -4953,38 +5023,21 @@ static int __process_new_xattr(int num, struct btrfs_key *di_key, - } - } - -- ret = get_cur_path(sctx, sctx->cur_ino, sctx->cur_inode_gen, p); -- if (ret < 0) -- goto out; -- -- ret = send_set_xattr(sctx, p, name, name_len, data, data_len); -- --out: -- fs_path_free(p); -- return ret; -+ return send_set_xattr(sctx, name, name_len, data, data_len); - } - - static int __process_deleted_xattr(int num, struct btrfs_key *di_key, - const char *name, int name_len, - const char *data, int data_len, void *ctx) - { -- int ret; - struct send_ctx *sctx = ctx; - struct fs_path *p; - -- p = fs_path_alloc(); -- if (!p) -- return -ENOMEM; -- -- ret = get_cur_path(sctx, sctx->cur_ino, sctx->cur_inode_gen, p); -- if (ret < 0) -- goto out; -- -- ret = send_remove_xattr(sctx, p, name, name_len); -+ p = get_cur_inode_path(sctx); -+ if (IS_ERR(p)) -+ return PTR_ERR(p); - --out: -- fs_path_free(p); -- return ret; -+ return send_remove_xattr(sctx, p, name, name_len); - } - - static int process_new_xattr(struct send_ctx *sctx) -@@ -5218,21 +5271,13 @@ static int process_verity(struct send_ctx *sctx) - if (ret < 0) - goto iput; - -- p = fs_path_alloc(); -- if (!p) { -- ret = -ENOMEM; -+ p = get_cur_inode_path(sctx); -+ if (IS_ERR(p)) { -+ ret = PTR_ERR(p); - goto iput; - } -- ret = get_cur_path(sctx, sctx->cur_ino, sctx->cur_inode_gen, p); -- if (ret < 0) -- goto free_path; - - ret = send_verity(sctx, p, sctx->verity_descriptor); -- if (ret < 0) -- goto free_path; -- --free_path: -- fs_path_free(p); - iput: - iput(inode); - return ret; -@@ -5347,31 +5392,25 @@ static int send_write(struct send_ctx *sctx, u64 offset, u32 len) - int ret = 0; - struct fs_path *p; - -- p = fs_path_alloc(); -- if (!p) -- return -ENOMEM; -- - btrfs_debug(fs_info, "send_write offset=%llu, len=%d", offset, len); - -- ret = begin_cmd(sctx, BTRFS_SEND_C_WRITE); -- if (ret < 0) -- goto out; -+ p = get_cur_inode_path(sctx); -+ if (IS_ERR(p)) -+ return PTR_ERR(p); - -- ret = get_cur_path(sctx, sctx->cur_ino, sctx->cur_inode_gen, p); -+ ret = begin_cmd(sctx, BTRFS_SEND_C_WRITE); - if (ret < 0) -- goto out; -+ return ret; - - TLV_PUT_PATH(sctx, BTRFS_SEND_A_PATH, p); - TLV_PUT_U64(sctx, BTRFS_SEND_A_FILE_OFFSET, offset); - ret = put_file_data(sctx, offset, len); - if (ret < 0) -- goto out; -+ return ret; - - ret = send_cmd(sctx); - - tlv_put_failure: --out: -- fs_path_free(p); - return ret; - } - -@@ -5384,6 +5423,7 @@ static int send_clone(struct send_ctx *sctx, - { - int ret = 0; - struct fs_path *p; -+ struct fs_path *cur_inode_path; - u64 gen; - - btrfs_debug(sctx->send_root->fs_info, -@@ -5391,6 +5431,10 @@ static int send_clone(struct send_ctx *sctx, - offset, len, clone_root->root->root_key.objectid, - clone_root->ino, clone_root->offset); - -+ cur_inode_path = get_cur_inode_path(sctx); -+ if (IS_ERR(cur_inode_path)) -+ return PTR_ERR(cur_inode_path); -+ - p = fs_path_alloc(); - if (!p) - return -ENOMEM; -@@ -5399,13 +5443,9 @@ static int send_clone(struct send_ctx *sctx, - if (ret < 0) - goto out; - -- ret = get_cur_path(sctx, sctx->cur_ino, sctx->cur_inode_gen, p); -- if (ret < 0) -- goto out; -- - TLV_PUT_U64(sctx, BTRFS_SEND_A_FILE_OFFSET, offset); - TLV_PUT_U64(sctx, BTRFS_SEND_A_CLONE_LEN, len); -- TLV_PUT_PATH(sctx, BTRFS_SEND_A_PATH, p); -+ TLV_PUT_PATH(sctx, BTRFS_SEND_A_PATH, cur_inode_path); - - if (clone_root->root == sctx->send_root) { - ret = get_inode_gen(sctx->send_root, clone_root->ino, &gen); -@@ -5456,27 +5496,45 @@ static int send_update_extent(struct send_ctx *sctx, - int ret = 0; - struct fs_path *p; - -- p = fs_path_alloc(); -- if (!p) -- return -ENOMEM; -+ p = get_cur_inode_path(sctx); -+ if (IS_ERR(p)) -+ return PTR_ERR(p); - - ret = begin_cmd(sctx, BTRFS_SEND_C_UPDATE_EXTENT); - if (ret < 0) -- goto out; -+ return ret; -+ -+ TLV_PUT_PATH(sctx, BTRFS_SEND_A_PATH, p); -+ TLV_PUT_U64(sctx, BTRFS_SEND_A_FILE_OFFSET, offset); -+ TLV_PUT_U64(sctx, BTRFS_SEND_A_SIZE, len); -+ -+ ret = send_cmd(sctx); - -- ret = get_cur_path(sctx, sctx->cur_ino, sctx->cur_inode_gen, p); -+tlv_put_failure: -+ return ret; -+} -+ -+static int send_fallocate(struct send_ctx *sctx, u32 mode, u64 offset, u64 len) -+{ -+ struct fs_path *path; -+ int ret; -+ -+ path = get_cur_inode_path(sctx); -+ if (IS_ERR(path)) -+ return PTR_ERR(path); -+ -+ ret = begin_cmd(sctx, BTRFS_SEND_C_FALLOCATE); - if (ret < 0) -- goto out; -+ return ret; - -- TLV_PUT_PATH(sctx, BTRFS_SEND_A_PATH, p); -+ TLV_PUT_PATH(sctx, BTRFS_SEND_A_PATH, path); -+ TLV_PUT_U32(sctx, BTRFS_SEND_A_FALLOCATE_MODE, mode); - TLV_PUT_U64(sctx, BTRFS_SEND_A_FILE_OFFSET, offset); - TLV_PUT_U64(sctx, BTRFS_SEND_A_SIZE, len); - - ret = send_cmd(sctx); - - tlv_put_failure: --out: -- fs_path_free(p); - return ret; - } - -@@ -5487,6 +5545,14 @@ static int send_hole(struct send_ctx *sctx, u64 end) - u64 offset = sctx->cur_inode_last_extent; - int ret = 0; - -+ /* -+ * Starting with send stream v2 we have fallocate and can use it to -+ * punch holes instead of sending writes full of zeroes. -+ */ -+ if (proto_cmd_ok(sctx, BTRFS_SEND_C_FALLOCATE)) -+ return send_fallocate(sctx, FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE, -+ offset, end - offset); -+ - /* - * A hole that starts at EOF or beyond it. Since we do not yet support - * fallocate (for extent preallocation and hole punching), sending a -@@ -5505,12 +5571,10 @@ static int send_hole(struct send_ctx *sctx, u64 end) - if (sctx->flags & BTRFS_SEND_FLAG_NO_FILE_DATA) - return send_update_extent(sctx, offset, end - offset); - -- p = fs_path_alloc(); -- if (!p) -- return -ENOMEM; -- ret = get_cur_path(sctx, sctx->cur_ino, sctx->cur_inode_gen, p); -- if (ret < 0) -- goto tlv_put_failure; -+ p = get_cur_inode_path(sctx); -+ if (IS_ERR(p)) -+ return PTR_ERR(p); -+ - while (offset < end) { - u64 len = min(end - offset, read_size); - -@@ -5531,7 +5595,6 @@ static int send_hole(struct send_ctx *sctx, u64 end) - } - sctx->cur_inode_next_write_offset = offset; - tlv_put_failure: -- fs_path_free(p); - return ret; - } - -@@ -5554,9 +5617,9 @@ static int send_encoded_inline_extent(struct send_ctx *sctx, - if (IS_ERR(inode)) - return PTR_ERR(inode); - -- fspath = fs_path_alloc(); -- if (!fspath) { -- ret = -ENOMEM; -+ fspath = get_cur_inode_path(sctx); -+ if (IS_ERR(fspath)) { -+ ret = PTR_ERR(fspath); - goto out; - } - -@@ -5564,10 +5627,6 @@ static int send_encoded_inline_extent(struct send_ctx *sctx, - if (ret < 0) - goto out; - -- ret = get_cur_path(sctx, sctx->cur_ino, sctx->cur_inode_gen, fspath); -- if (ret < 0) -- goto out; -- - btrfs_item_key_to_cpu(leaf, &key, path->slots[0]); - ei = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_file_extent_item); - ram_bytes = btrfs_file_extent_ram_bytes(leaf, ei); -@@ -5596,7 +5655,6 @@ static int send_encoded_inline_extent(struct send_ctx *sctx, - - tlv_put_failure: - out: -- fs_path_free(fspath); - iput(inode); - return ret; - } -@@ -5621,9 +5679,9 @@ static int send_encoded_extent(struct send_ctx *sctx, struct btrfs_path *path, - if (IS_ERR(inode)) - return PTR_ERR(inode); - -- fspath = fs_path_alloc(); -- if (!fspath) { -- ret = -ENOMEM; -+ fspath = get_cur_inode_path(sctx); -+ if (IS_ERR(fspath)) { -+ ret = PTR_ERR(fspath); - goto out; - } - -@@ -5631,10 +5689,6 @@ static int send_encoded_extent(struct send_ctx *sctx, struct btrfs_path *path, - if (ret < 0) - goto out; - -- ret = get_cur_path(sctx, sctx->cur_ino, sctx->cur_inode_gen, fspath); -- if (ret < 0) -- goto out; -- - btrfs_item_key_to_cpu(leaf, &key, path->slots[0]); - ei = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_file_extent_item); - disk_bytenr = btrfs_file_extent_disk_bytenr(leaf, ei); -@@ -5701,7 +5755,6 @@ static int send_encoded_extent(struct send_ctx *sctx, struct btrfs_path *path, - - tlv_put_failure: - out: -- fs_path_free(fspath); - iput(inode); - return ret; - } -@@ -5831,7 +5884,6 @@ static int send_extent_data(struct send_ctx *sctx, struct btrfs_path *path, - */ - static int send_capabilities(struct send_ctx *sctx) - { -- struct fs_path *fspath = NULL; - struct btrfs_path *path; - struct btrfs_dir_item *di; - struct extent_buffer *leaf; -@@ -5857,25 +5909,19 @@ static int send_capabilities(struct send_ctx *sctx) - leaf = path->nodes[0]; - buf_len = btrfs_dir_data_len(leaf, di); - -- fspath = fs_path_alloc(); - buf = kmalloc(buf_len, GFP_KERNEL); -- if (!fspath || !buf) { -+ if (!buf) { - ret = -ENOMEM; - goto out; - } - -- ret = get_cur_path(sctx, sctx->cur_ino, sctx->cur_inode_gen, fspath); -- if (ret < 0) -- goto out; -- - data_ptr = (unsigned long)(di + 1) + btrfs_dir_name_len(leaf, di); - read_extent_buffer(leaf, buf, data_ptr, buf_len); - -- ret = send_set_xattr(sctx, fspath, XATTR_NAME_CAPS, -+ ret = send_set_xattr(sctx, XATTR_NAME_CAPS, - strlen(XATTR_NAME_CAPS), buf, buf_len); - out: - kfree(buf); -- fs_path_free(fspath); - btrfs_free_path(path); - return ret; - } -@@ -6904,6 +6950,7 @@ static int changed_inode(struct send_ctx *sctx, - sctx->cur_inode_last_extent = (u64)-1; - sctx->cur_inode_next_write_offset = 0; - sctx->ignore_cur_inode = false; -+ fs_path_reset(&sctx->cur_inode_path); - - /* - * Set send_progress to current inode. This will tell all get_cur_xxx -@@ -8194,6 +8241,7 @@ long btrfs_ioctl_send(struct inode *inode, struct btrfs_ioctl_send_args *arg) - goto out; - } - -+ init_path(&sctx->cur_inode_path); - INIT_LIST_HEAD(&sctx->new_refs); - INIT_LIST_HEAD(&sctx->deleted_refs); - -@@ -8479,6 +8527,9 @@ long btrfs_ioctl_send(struct inode *inode, struct btrfs_ioctl_send_args *arg) - btrfs_lru_cache_clear(&sctx->dir_created_cache); - btrfs_lru_cache_clear(&sctx->dir_utimes_cache); - -+ if (sctx->cur_inode_path.buf != sctx->cur_inode_path.inline_buf) -+ kfree(sctx->cur_inode_path.buf); -+ - kfree(sctx); - } - -diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c -index 581bdd709ee0d0..27690c518f6d79 100644 ---- a/fs/btrfs/space-info.c -+++ b/fs/btrfs/space-info.c -@@ -162,7 +162,7 @@ - * thing with or without extra unallocated space. - */ - --u64 __pure btrfs_space_info_used(struct btrfs_space_info *s_info, -+u64 __pure btrfs_space_info_used(const struct btrfs_space_info *s_info, - bool may_use_included) - { - ASSERT(s_info); -@@ -342,7 +342,7 @@ struct btrfs_space_info *btrfs_find_space_info(struct btrfs_fs_info *info, - } - - static u64 calc_available_free_space(struct btrfs_fs_info *fs_info, -- struct btrfs_space_info *space_info, -+ const struct btrfs_space_info *space_info, - enum btrfs_reserve_flush_enum flush) - { - u64 profile; -@@ -378,7 +378,7 @@ static u64 calc_available_free_space(struct btrfs_fs_info *fs_info, - } - - int btrfs_can_overcommit(struct btrfs_fs_info *fs_info, -- struct btrfs_space_info *space_info, u64 bytes, -+ const struct btrfs_space_info *space_info, u64 bytes, - enum btrfs_reserve_flush_enum flush) - { - u64 avail; -@@ -483,8 +483,8 @@ static void dump_global_block_rsv(struct btrfs_fs_info *fs_info) - DUMP_BLOCK_RSV(fs_info, delayed_refs_rsv); - } - --static void __btrfs_dump_space_info(struct btrfs_fs_info *fs_info, -- struct btrfs_space_info *info) -+static void __btrfs_dump_space_info(const struct btrfs_fs_info *fs_info, -+ const struct btrfs_space_info *info) - { - const char *flag_str = space_info_flag_to_str(info); - lockdep_assert_held(&info->lock); -@@ -807,9 +807,8 @@ static void flush_space(struct btrfs_fs_info *fs_info, - return; - } - --static inline u64 --btrfs_calc_reclaim_metadata_size(struct btrfs_fs_info *fs_info, -- struct btrfs_space_info *space_info) -+static u64 btrfs_calc_reclaim_metadata_size(struct btrfs_fs_info *fs_info, -+ const struct btrfs_space_info *space_info) - { - u64 used; - u64 avail; -@@ -834,7 +833,7 @@ btrfs_calc_reclaim_metadata_size(struct btrfs_fs_info *fs_info, - } - - static bool need_preemptive_reclaim(struct btrfs_fs_info *fs_info, -- struct btrfs_space_info *space_info) -+ const struct btrfs_space_info *space_info) - { - const u64 global_rsv_size = btrfs_block_rsv_reserved(&fs_info->global_block_rsv); - u64 ordered, delalloc; -diff --git a/fs/btrfs/space-info.h b/fs/btrfs/space-info.h -index 08a3bd10addcf9..b0187f25dbb5e0 100644 ---- a/fs/btrfs/space-info.h -+++ b/fs/btrfs/space-info.h -@@ -165,7 +165,7 @@ struct reserve_ticket { - wait_queue_head_t wait; - }; - --static inline bool btrfs_mixed_space_info(struct btrfs_space_info *space_info) -+static inline bool btrfs_mixed_space_info(const struct btrfs_space_info *space_info) - { - return ((space_info->flags & BTRFS_BLOCK_GROUP_METADATA) && - (space_info->flags & BTRFS_BLOCK_GROUP_DATA)); -@@ -206,7 +206,7 @@ void btrfs_update_space_info_chunk_size(struct btrfs_space_info *space_info, - u64 chunk_size); - struct btrfs_space_info *btrfs_find_space_info(struct btrfs_fs_info *info, - u64 flags); --u64 __pure btrfs_space_info_used(struct btrfs_space_info *s_info, -+u64 __pure btrfs_space_info_used(const struct btrfs_space_info *s_info, - bool may_use_included); - void btrfs_clear_space_info_full(struct btrfs_fs_info *info); - void btrfs_dump_space_info(struct btrfs_fs_info *fs_info, -@@ -219,7 +219,7 @@ int btrfs_reserve_metadata_bytes(struct btrfs_fs_info *fs_info, - void btrfs_try_granting_tickets(struct btrfs_fs_info *fs_info, - struct btrfs_space_info *space_info); - int btrfs_can_overcommit(struct btrfs_fs_info *fs_info, -- struct btrfs_space_info *space_info, u64 bytes, -+ const struct btrfs_space_info *space_info, u64 bytes, - enum btrfs_reserve_flush_enum flush); - - static inline void btrfs_space_info_free_bytes_may_use( -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index 16434106c465db..9439abf415ae36 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -326,8 +326,7 @@ struct walk_control { - - /* - * Ignore any items from the inode currently being processed. Needs -- * to be set every time we find a BTRFS_INODE_ITEM_KEY and we are in -- * the LOG_WALK_REPLAY_INODES stage. -+ * to be set every time we find a BTRFS_INODE_ITEM_KEY. - */ - bool ignore_cur_inode; - -@@ -1423,6 +1422,8 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans, - btrfs_dir = btrfs_iget_logging(parent_objectid, root); - if (IS_ERR(btrfs_dir)) { - ret = PTR_ERR(btrfs_dir); -+ if (ret == -ENOENT) -+ ret = 0; - dir = NULL; - goto out; - } -@@ -1456,6 +1457,15 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans, - if (IS_ERR(btrfs_dir)) { - ret = PTR_ERR(btrfs_dir); - dir = NULL; -+ /* -+ * A new parent dir may have not been -+ * logged and not exist in the subvolume -+ * tree, see the comment above before -+ * the loop when getting the first -+ * parent dir. -+ */ -+ if (ret == -ENOENT) -+ ret = 0; - goto out; - } - dir = &btrfs_dir->vfs_inode; -@@ -2498,23 +2508,30 @@ static int replay_one_buffer(struct btrfs_root *log, struct extent_buffer *eb, - - nritems = btrfs_header_nritems(eb); - for (i = 0; i < nritems; i++) { -- btrfs_item_key_to_cpu(eb, &key, i); -+ struct btrfs_inode_item *inode_item; - -- /* inode keys are done during the first stage */ -- if (key.type == BTRFS_INODE_ITEM_KEY && -- wc->stage == LOG_WALK_REPLAY_INODES) { -- struct btrfs_inode_item *inode_item; -- u32 mode; -+ btrfs_item_key_to_cpu(eb, &key, i); - -- inode_item = btrfs_item_ptr(eb, i, -- struct btrfs_inode_item); -+ if (key.type == BTRFS_INODE_ITEM_KEY) { -+ inode_item = btrfs_item_ptr(eb, i, struct btrfs_inode_item); - /* -- * If we have a tmpfile (O_TMPFILE) that got fsync'ed -- * and never got linked before the fsync, skip it, as -- * replaying it is pointless since it would be deleted -- * later. We skip logging tmpfiles, but it's always -- * possible we are replaying a log created with a kernel -- * that used to log tmpfiles. -+ * An inode with no links is either: -+ * -+ * 1) A tmpfile (O_TMPFILE) that got fsync'ed and never -+ * got linked before the fsync, skip it, as replaying -+ * it is pointless since it would be deleted later. -+ * We skip logging tmpfiles, but it's always possible -+ * we are replaying a log created with a kernel that -+ * used to log tmpfiles; -+ * -+ * 2) A non-tmpfile which got its last link deleted -+ * while holding an open fd on it and later got -+ * fsynced through that fd. We always log the -+ * parent inodes when inode->last_unlink_trans is -+ * set to the current transaction, so ignore all the -+ * inode items for this inode. We will delete the -+ * inode when processing the parent directory with -+ * replay_dir_deletes(). - */ - if (btrfs_inode_nlink(eb, inode_item) == 0) { - wc->ignore_cur_inode = true; -@@ -2522,8 +2539,14 @@ static int replay_one_buffer(struct btrfs_root *log, struct extent_buffer *eb, - } else { - wc->ignore_cur_inode = false; - } -- ret = replay_xattr_deletes(wc->trans, root, log, -- path, key.objectid); -+ } -+ -+ /* Inode keys are done during the first stage. */ -+ if (key.type == BTRFS_INODE_ITEM_KEY && -+ wc->stage == LOG_WALK_REPLAY_INODES) { -+ u32 mode; -+ -+ ret = replay_xattr_deletes(wc->trans, root, log, path, key.objectid); - if (ret) - break; - mode = btrfs_inode_mode(eb, inode_item); -@@ -2611,9 +2634,8 @@ static int replay_one_buffer(struct btrfs_root *log, struct extent_buffer *eb, - key.type == BTRFS_INODE_EXTREF_KEY) { - ret = add_inode_ref(wc->trans, root, log, path, - eb, i, &key); -- if (ret && ret != -ENOENT) -+ if (ret) - break; -- ret = 0; - } else if (key.type == BTRFS_EXTENT_DATA_KEY) { - ret = replay_one_extent(wc->trans, root, path, - eb, i, &key); -@@ -4243,6 +4265,9 @@ static void fill_inode_item(struct btrfs_trans_handle *trans, - btrfs_set_token_timespec_nsec(&token, &item->ctime, - inode_get_ctime(inode).tv_nsec); - -+ btrfs_set_timespec_sec(leaf, &item->otime, BTRFS_I(inode)->i_otime_sec); -+ btrfs_set_timespec_nsec(leaf, &item->otime, BTRFS_I(inode)->i_otime_nsec); -+ - /* - * We do not need to set the nbytes field, in fact during a fast fsync - * its value may not even be correct, since a fast fsync does not wait -@@ -7300,11 +7325,14 @@ int btrfs_recover_log_trees(struct btrfs_root *log_root_tree) - - wc.replay_dest->log_root = log; - ret = btrfs_record_root_in_trans(trans, wc.replay_dest); -- if (ret) -+ if (ret) { - /* The loop needs to continue due to the root refs */ - btrfs_abort_transaction(trans, ret); -- else -+ } else { - ret = walk_log_tree(trans, log, &wc); -+ if (ret) -+ btrfs_abort_transaction(trans, ret); -+ } - - if (!ret && wc.stage == LOG_WALK_REPLAY_ALL) { - ret = fixup_inode_link_counts(trans, wc.replay_dest, -diff --git a/fs/btrfs/tree-mod-log.c b/fs/btrfs/tree-mod-log.c -index 3df6153d5d5a80..febc014a510df4 100644 ---- a/fs/btrfs/tree-mod-log.c -+++ b/fs/btrfs/tree-mod-log.c -@@ -171,7 +171,7 @@ static noinline int tree_mod_log_insert(struct btrfs_fs_info *fs_info, - * write unlock fs_info::tree_mod_log_lock. - */ - static inline bool tree_mod_dont_log(struct btrfs_fs_info *fs_info, -- struct extent_buffer *eb) -+ const struct extent_buffer *eb) - { - if (!test_bit(BTRFS_FS_TREE_MOD_LOG_USERS, &fs_info->flags)) - return true; -@@ -189,7 +189,7 @@ static inline bool tree_mod_dont_log(struct btrfs_fs_info *fs_info, - - /* Similar to tree_mod_dont_log, but doesn't acquire any locks. */ - static inline bool tree_mod_need_log(const struct btrfs_fs_info *fs_info, -- struct extent_buffer *eb) -+ const struct extent_buffer *eb) - { - if (!test_bit(BTRFS_FS_TREE_MOD_LOG_USERS, &fs_info->flags)) - return false; -@@ -199,7 +199,7 @@ static inline bool tree_mod_need_log(const struct btrfs_fs_info *fs_info, - return true; - } - --static struct tree_mod_elem *alloc_tree_mod_elem(struct extent_buffer *eb, -+static struct tree_mod_elem *alloc_tree_mod_elem(const struct extent_buffer *eb, - int slot, - enum btrfs_mod_log_op op) - { -@@ -222,7 +222,7 @@ static struct tree_mod_elem *alloc_tree_mod_elem(struct extent_buffer *eb, - return tm; - } - --int btrfs_tree_mod_log_insert_key(struct extent_buffer *eb, int slot, -+int btrfs_tree_mod_log_insert_key(const struct extent_buffer *eb, int slot, - enum btrfs_mod_log_op op) - { - struct tree_mod_elem *tm; -@@ -259,7 +259,7 @@ int btrfs_tree_mod_log_insert_key(struct extent_buffer *eb, int slot, - return ret; - } - --static struct tree_mod_elem *tree_mod_log_alloc_move(struct extent_buffer *eb, -+static struct tree_mod_elem *tree_mod_log_alloc_move(const struct extent_buffer *eb, - int dst_slot, int src_slot, - int nr_items) - { -@@ -279,7 +279,7 @@ static struct tree_mod_elem *tree_mod_log_alloc_move(struct extent_buffer *eb, - return tm; - } - --int btrfs_tree_mod_log_insert_move(struct extent_buffer *eb, -+int btrfs_tree_mod_log_insert_move(const struct extent_buffer *eb, - int dst_slot, int src_slot, - int nr_items) - { -@@ -536,7 +536,7 @@ static struct tree_mod_elem *tree_mod_log_search(struct btrfs_fs_info *fs_info, - } - - int btrfs_tree_mod_log_eb_copy(struct extent_buffer *dst, -- struct extent_buffer *src, -+ const struct extent_buffer *src, - unsigned long dst_offset, - unsigned long src_offset, - int nr_items) -diff --git a/fs/btrfs/tree-mod-log.h b/fs/btrfs/tree-mod-log.h -index 94f10afeee9725..5f94ab681fa437 100644 ---- a/fs/btrfs/tree-mod-log.h -+++ b/fs/btrfs/tree-mod-log.h -@@ -31,7 +31,7 @@ void btrfs_put_tree_mod_seq(struct btrfs_fs_info *fs_info, - int btrfs_tree_mod_log_insert_root(struct extent_buffer *old_root, - struct extent_buffer *new_root, - bool log_removal); --int btrfs_tree_mod_log_insert_key(struct extent_buffer *eb, int slot, -+int btrfs_tree_mod_log_insert_key(const struct extent_buffer *eb, int slot, - enum btrfs_mod_log_op op); - int btrfs_tree_mod_log_free_eb(struct extent_buffer *eb); - struct extent_buffer *btrfs_tree_mod_log_rewind(struct btrfs_fs_info *fs_info, -@@ -41,11 +41,11 @@ struct extent_buffer *btrfs_tree_mod_log_rewind(struct btrfs_fs_info *fs_info, - struct extent_buffer *btrfs_get_old_root(struct btrfs_root *root, u64 time_seq); - int btrfs_old_root_level(struct btrfs_root *root, u64 time_seq); - int btrfs_tree_mod_log_eb_copy(struct extent_buffer *dst, -- struct extent_buffer *src, -+ const struct extent_buffer *src, - unsigned long dst_offset, - unsigned long src_offset, - int nr_items); --int btrfs_tree_mod_log_insert_move(struct extent_buffer *eb, -+int btrfs_tree_mod_log_insert_move(const struct extent_buffer *eb, - int dst_slot, int src_slot, - int nr_items); - u64 btrfs_tree_mod_log_lowest_seq(struct btrfs_fs_info *fs_info); -diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c -index 197dfafbf40139..3622ba1d8e09f4 100644 ---- a/fs/btrfs/zoned.c -+++ b/fs/btrfs/zoned.c -@@ -1992,10 +1992,15 @@ bool btrfs_zone_activate(struct btrfs_block_group *block_group) - goto out_unlock; - } - -- /* No space left */ -- if (btrfs_zoned_bg_is_full(block_group)) { -- ret = false; -- goto out_unlock; -+ if (block_group->flags & BTRFS_BLOCK_GROUP_DATA) { -+ /* The caller should check if the block group is full. */ -+ if (WARN_ON_ONCE(btrfs_zoned_bg_is_full(block_group))) { -+ ret = false; -+ goto out_unlock; -+ } -+ } else { -+ /* Since it is already written, it should have been active. */ -+ WARN_ON_ONCE(block_group->meta_write_pointer != block_group->start); - } - - for (i = 0; i < map->num_stripes; i++) { -@@ -2346,12 +2351,12 @@ void btrfs_free_zone_cache(struct btrfs_fs_info *fs_info) - mutex_unlock(&fs_devices->device_list_mutex); - } - --bool btrfs_zoned_should_reclaim(struct btrfs_fs_info *fs_info) -+bool btrfs_zoned_should_reclaim(const struct btrfs_fs_info *fs_info) - { - struct btrfs_fs_devices *fs_devices = fs_info->fs_devices; - struct btrfs_device *device; -+ u64 total = btrfs_super_total_bytes(fs_info->super_copy); - u64 used = 0; -- u64 total = 0; - u64 factor; - - ASSERT(btrfs_is_zoned(fs_info)); -@@ -2364,7 +2369,6 @@ bool btrfs_zoned_should_reclaim(struct btrfs_fs_info *fs_info) - if (!device->bdev) - continue; - -- total += device->disk_total_bytes; - used += device->bytes_used; - } - mutex_unlock(&fs_devices->device_list_mutex); -@@ -2418,7 +2422,7 @@ int btrfs_zone_finish_one_bg(struct btrfs_fs_info *fs_info) - - spin_lock(&block_group->lock); - if (block_group->reserved || block_group->alloc_offset == 0 || -- (block_group->flags & BTRFS_BLOCK_GROUP_SYSTEM) || -+ !(block_group->flags & BTRFS_BLOCK_GROUP_DATA) || - test_bit(BLOCK_GROUP_FLAG_ZONED_DATA_RELOC, &block_group->runtime_flags)) { - spin_unlock(&block_group->lock); - continue; -diff --git a/fs/btrfs/zoned.h b/fs/btrfs/zoned.h -index b9cec523b77842..448955641d1143 100644 ---- a/fs/btrfs/zoned.h -+++ b/fs/btrfs/zoned.h -@@ -77,7 +77,7 @@ void btrfs_schedule_zone_finish_bg(struct btrfs_block_group *bg, - struct extent_buffer *eb); - void btrfs_clear_data_reloc_bg(struct btrfs_block_group *bg); - void btrfs_free_zone_cache(struct btrfs_fs_info *fs_info); --bool btrfs_zoned_should_reclaim(struct btrfs_fs_info *fs_info); -+bool btrfs_zoned_should_reclaim(const struct btrfs_fs_info *fs_info); - void btrfs_zoned_release_data_reloc_bg(struct btrfs_fs_info *fs_info, u64 logical, - u64 length); - int btrfs_zone_finish_one_bg(struct btrfs_fs_info *fs_info); -@@ -237,7 +237,7 @@ static inline void btrfs_clear_data_reloc_bg(struct btrfs_block_group *bg) { } - - static inline void btrfs_free_zone_cache(struct btrfs_fs_info *fs_info) { } - --static inline bool btrfs_zoned_should_reclaim(struct btrfs_fs_info *fs_info) -+static inline bool btrfs_zoned_should_reclaim(const struct btrfs_fs_info *fs_info) - { - return false; - } -diff --git a/fs/buffer.c b/fs/buffer.c -index 4b86e971efd8a1..32df6163ffed5f 100644 ---- a/fs/buffer.c -+++ b/fs/buffer.c -@@ -157,8 +157,8 @@ static void __end_buffer_read_notouch(struct buffer_head *bh, int uptodate) - */ - void end_buffer_read_sync(struct buffer_head *bh, int uptodate) - { -- __end_buffer_read_notouch(bh, uptodate); - put_bh(bh); -+ __end_buffer_read_notouch(bh, uptodate); - } - EXPORT_SYMBOL(end_buffer_read_sync); - -diff --git a/fs/crypto/fscrypt_private.h b/fs/crypto/fscrypt_private.h -index 2d63da48635ab8..14b26036055e40 100644 ---- a/fs/crypto/fscrypt_private.h -+++ b/fs/crypto/fscrypt_private.h -@@ -27,6 +27,22 @@ - */ - #define FSCRYPT_MIN_KEY_SIZE 16 - -+/* -+ * This mask is passed as the third argument to the crypto_alloc_*() functions -+ * to prevent fscrypt from using the Crypto API drivers for non-inline crypto -+ * engines. Those drivers have been problematic for fscrypt. fscrypt users -+ * have reported hangs and even incorrect en/decryption with these drivers. -+ * Since going to the driver, off CPU, and back again is really slow, such -+ * drivers can be over 50 times slower than the CPU-based code for fscrypt's -+ * workload. Even on platforms that lack AES instructions on the CPU, using the -+ * offloads has been shown to be slower, even staying with AES. (Of course, -+ * Adiantum is faster still, and is the recommended option on such platforms...) -+ * -+ * Note that fscrypt also supports inline crypto engines. Those don't use the -+ * Crypto API and work much better than the old-style (non-inline) engines. -+ */ -+#define FSCRYPT_CRYPTOAPI_MASK \ -+ (CRYPTO_ALG_ALLOCATES_MEMORY | CRYPTO_ALG_KERN_DRIVER_ONLY) - #define FSCRYPT_CONTEXT_V1 1 - #define FSCRYPT_CONTEXT_V2 2 - -diff --git a/fs/crypto/hkdf.c b/fs/crypto/hkdf.c -index 5a384dad2c72f3..b7f5e7884e03b9 100644 ---- a/fs/crypto/hkdf.c -+++ b/fs/crypto/hkdf.c -@@ -72,7 +72,7 @@ int fscrypt_init_hkdf(struct fscrypt_hkdf *hkdf, const u8 *master_key, - u8 prk[HKDF_HASHLEN]; - int err; - -- hmac_tfm = crypto_alloc_shash(HKDF_HMAC_ALG, 0, 0); -+ hmac_tfm = crypto_alloc_shash(HKDF_HMAC_ALG, 0, FSCRYPT_CRYPTOAPI_MASK); - if (IS_ERR(hmac_tfm)) { - fscrypt_err(NULL, "Error allocating " HKDF_HMAC_ALG ": %ld", - PTR_ERR(hmac_tfm)); -diff --git a/fs/crypto/keysetup.c b/fs/crypto/keysetup.c -index 361f41ef46c787..2348fc2a47f86a 100644 ---- a/fs/crypto/keysetup.c -+++ b/fs/crypto/keysetup.c -@@ -103,7 +103,8 @@ fscrypt_allocate_skcipher(struct fscrypt_mode *mode, const u8 *raw_key, - struct crypto_skcipher *tfm; - int err; - -- tfm = crypto_alloc_skcipher(mode->cipher_str, 0, 0); -+ tfm = crypto_alloc_skcipher(mode->cipher_str, 0, -+ FSCRYPT_CRYPTOAPI_MASK); - if (IS_ERR(tfm)) { - if (PTR_ERR(tfm) == -ENOENT) { - fscrypt_warn(inode, -diff --git a/fs/crypto/keysetup_v1.c b/fs/crypto/keysetup_v1.c -index 75dabd9b27f9b6..159dd0288349a0 100644 ---- a/fs/crypto/keysetup_v1.c -+++ b/fs/crypto/keysetup_v1.c -@@ -52,7 +52,8 @@ static int derive_key_aes(const u8 *master_key, - struct skcipher_request *req = NULL; - DECLARE_CRYPTO_WAIT(wait); - struct scatterlist src_sg, dst_sg; -- struct crypto_skcipher *tfm = crypto_alloc_skcipher("ecb(aes)", 0, 0); -+ struct crypto_skcipher *tfm = -+ crypto_alloc_skcipher("ecb(aes)", 0, FSCRYPT_CRYPTOAPI_MASK); - - if (IS_ERR(tfm)) { - res = PTR_ERR(tfm); -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 31b32d9e7bbcea..6b2d655c1cefcd 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -217,6 +217,7 @@ struct eventpoll { - /* used to optimize loop detection check */ - u64 gen; - struct hlist_head refs; -+ u8 loop_check_depth; - - /* - * usage count, used together with epitem->dying to -@@ -1986,23 +1987,24 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, - } - - /** -- * ep_loop_check_proc - verify that adding an epoll file inside another -- * epoll structure does not violate the constraints, in -- * terms of closed loops, or too deep chains (which can -- * result in excessive stack usage). -+ * ep_loop_check_proc - verify that adding an epoll file @ep inside another -+ * epoll file does not create closed loops, and -+ * determine the depth of the subtree starting at @ep - * - * @ep: the &struct eventpoll to be currently checked. - * @depth: Current depth of the path being checked. - * -- * Return: %zero if adding the epoll @file inside current epoll -- * structure @ep does not violate the constraints, or %-1 otherwise. -+ * Return: depth of the subtree, or INT_MAX if we found a loop or went too deep. - */ - static int ep_loop_check_proc(struct eventpoll *ep, int depth) - { -- int error = 0; -+ int result = 0; - struct rb_node *rbp; - struct epitem *epi; - -+ if (ep->gen == loop_check_gen) -+ return ep->loop_check_depth; -+ - mutex_lock_nested(&ep->mtx, depth + 1); - ep->gen = loop_check_gen; - for (rbp = rb_first_cached(&ep->rbr); rbp; rbp = rb_next(rbp)) { -@@ -2010,13 +2012,11 @@ static int ep_loop_check_proc(struct eventpoll *ep, int depth) - if (unlikely(is_file_epoll(epi->ffd.file))) { - struct eventpoll *ep_tovisit; - ep_tovisit = epi->ffd.file->private_data; -- if (ep_tovisit->gen == loop_check_gen) -- continue; - if (ep_tovisit == inserting_into || depth > EP_MAX_NESTS) -- error = -1; -+ result = INT_MAX; - else -- error = ep_loop_check_proc(ep_tovisit, depth + 1); -- if (error != 0) -+ result = max(result, ep_loop_check_proc(ep_tovisit, depth + 1) + 1); -+ if (result > EP_MAX_NESTS) - break; - } else { - /* -@@ -2030,9 +2030,27 @@ static int ep_loop_check_proc(struct eventpoll *ep, int depth) - list_file(epi->ffd.file); - } - } -+ ep->loop_check_depth = result; - mutex_unlock(&ep->mtx); - -- return error; -+ return result; -+} -+ -+/** -+ * ep_get_upwards_depth_proc - determine depth of @ep when traversed upwards -+ */ -+static int ep_get_upwards_depth_proc(struct eventpoll *ep, int depth) -+{ -+ int result = 0; -+ struct epitem *epi; -+ -+ if (ep->gen == loop_check_gen) -+ return ep->loop_check_depth; -+ hlist_for_each_entry_rcu(epi, &ep->refs, fllink) -+ result = max(result, ep_get_upwards_depth_proc(epi->ep, depth + 1) + 1); -+ ep->gen = loop_check_gen; -+ ep->loop_check_depth = result; -+ return result; - } - - /** -@@ -2048,8 +2066,22 @@ static int ep_loop_check_proc(struct eventpoll *ep, int depth) - */ - static int ep_loop_check(struct eventpoll *ep, struct eventpoll *to) - { -+ int depth, upwards_depth; -+ - inserting_into = ep; -- return ep_loop_check_proc(to, 0); -+ /* -+ * Check how deep down we can get from @to, and whether it is possible -+ * to loop up to @ep. -+ */ -+ depth = ep_loop_check_proc(to, 0); -+ if (depth > EP_MAX_NESTS) -+ return -1; -+ /* Check how far up we can go from @ep. */ -+ rcu_read_lock(); -+ upwards_depth = ep_get_upwards_depth_proc(ep, 0); -+ rcu_read_unlock(); -+ -+ return (depth+1+upwards_depth > EP_MAX_NESTS) ? -1 : 0; - } - - static void clear_tfile_check_list(void) -diff --git a/fs/exfat/dir.c b/fs/exfat/dir.c -index f4f81e349cefe1..6139a57fde70a2 100644 ---- a/fs/exfat/dir.c -+++ b/fs/exfat/dir.c -@@ -994,6 +994,7 @@ int exfat_find_dir_entry(struct super_block *sb, struct exfat_inode_info *ei, - struct exfat_hint_femp candi_empty; - struct exfat_sb_info *sbi = EXFAT_SB(sb); - int num_entries = exfat_calc_num_entries(p_uniname); -+ unsigned int clu_count = 0; - - if (num_entries < 0) - return num_entries; -@@ -1131,6 +1132,10 @@ int exfat_find_dir_entry(struct super_block *sb, struct exfat_inode_info *ei, - } else { - if (exfat_get_next_cluster(sb, &clu.dir)) - return -EIO; -+ -+ /* break if the cluster chain includes a loop */ -+ if (unlikely(++clu_count > EXFAT_DATA_CLUSTER_COUNT(sbi))) -+ goto not_found; - } - } - -@@ -1214,6 +1219,7 @@ int exfat_count_dir_entries(struct super_block *sb, struct exfat_chain *p_dir) - int i, count = 0; - int dentries_per_clu; - unsigned int entry_type; -+ unsigned int clu_count = 0; - struct exfat_chain clu; - struct exfat_dentry *ep; - struct exfat_sb_info *sbi = EXFAT_SB(sb); -@@ -1246,6 +1252,12 @@ int exfat_count_dir_entries(struct super_block *sb, struct exfat_chain *p_dir) - } else { - if (exfat_get_next_cluster(sb, &(clu.dir))) - return -EIO; -+ -+ if (unlikely(++clu_count > sbi->used_clusters)) { -+ exfat_fs_error(sb, "FAT or bitmap is corrupted"); -+ return -EIO; -+ } -+ - } - } - -diff --git a/fs/exfat/fatent.c b/fs/exfat/fatent.c -index 24e1e05f9f34a7..407880901ee3fb 100644 ---- a/fs/exfat/fatent.c -+++ b/fs/exfat/fatent.c -@@ -461,5 +461,15 @@ int exfat_count_num_clusters(struct super_block *sb, - } - - *ret_count = count; -+ -+ /* -+ * since exfat_count_used_clusters() is not called, sbi->used_clusters -+ * cannot be used here. -+ */ -+ if (unlikely(i == sbi->num_clusters && clu != EXFAT_EOF_CLUSTER)) { -+ exfat_fs_error(sb, "The cluster chain has a loop"); -+ return -EIO; -+ } -+ - return 0; - } -diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c -index f340e96b499f1c..4657f893dea786 100644 ---- a/fs/exfat/namei.c -+++ b/fs/exfat/namei.c -@@ -893,6 +893,7 @@ static int exfat_check_dir_empty(struct super_block *sb, - { - int i, dentries_per_clu; - unsigned int type; -+ unsigned int clu_count = 0; - struct exfat_chain clu; - struct exfat_dentry *ep; - struct exfat_sb_info *sbi = EXFAT_SB(sb); -@@ -929,6 +930,10 @@ static int exfat_check_dir_empty(struct super_block *sb, - } else { - if (exfat_get_next_cluster(sb, &(clu.dir))) - return -EIO; -+ -+ /* break if the cluster chain includes a loop */ -+ if (unlikely(++clu_count > EXFAT_DATA_CLUSTER_COUNT(sbi))) -+ break; - } - } - -diff --git a/fs/exfat/super.c b/fs/exfat/super.c -index 2778bd9b631e72..5affc11d14615a 100644 ---- a/fs/exfat/super.c -+++ b/fs/exfat/super.c -@@ -327,13 +327,12 @@ static void exfat_hash_init(struct super_block *sb) - INIT_HLIST_HEAD(&sbi->inode_hashtable[i]); - } - --static int exfat_read_root(struct inode *inode) -+static int exfat_read_root(struct inode *inode, struct exfat_chain *root_clu) - { - struct super_block *sb = inode->i_sb; - struct exfat_sb_info *sbi = EXFAT_SB(sb); - struct exfat_inode_info *ei = EXFAT_I(inode); -- struct exfat_chain cdir; -- int num_subdirs, num_clu = 0; -+ int num_subdirs; - - exfat_chain_set(&ei->dir, sbi->root_dir, 0, ALLOC_FAT_CHAIN); - ei->entry = -1; -@@ -346,12 +345,9 @@ static int exfat_read_root(struct inode *inode) - ei->hint_stat.clu = sbi->root_dir; - ei->hint_femp.eidx = EXFAT_HINT_NONE; - -- exfat_chain_set(&cdir, sbi->root_dir, 0, ALLOC_FAT_CHAIN); -- if (exfat_count_num_clusters(sb, &cdir, &num_clu)) -- return -EIO; -- i_size_write(inode, num_clu << sbi->cluster_size_bits); -+ i_size_write(inode, EXFAT_CLU_TO_B(root_clu->size, sbi)); - -- num_subdirs = exfat_count_dir_entries(sb, &cdir); -+ num_subdirs = exfat_count_dir_entries(sb, root_clu); - if (num_subdirs < 0) - return -EIO; - set_nlink(inode, num_subdirs + EXFAT_MIN_SUBDIR); -@@ -567,7 +563,8 @@ static int exfat_verify_boot_region(struct super_block *sb) - } - - /* mount the file system volume */ --static int __exfat_fill_super(struct super_block *sb) -+static int __exfat_fill_super(struct super_block *sb, -+ struct exfat_chain *root_clu) - { - int ret; - struct exfat_sb_info *sbi = EXFAT_SB(sb); -@@ -584,6 +581,18 @@ static int __exfat_fill_super(struct super_block *sb) - goto free_bh; - } - -+ /* -+ * Call exfat_count_num_cluster() before searching for up-case and -+ * bitmap directory entries to avoid infinite loop if they are missing -+ * and the cluster chain includes a loop. -+ */ -+ exfat_chain_set(root_clu, sbi->root_dir, 0, ALLOC_FAT_CHAIN); -+ ret = exfat_count_num_clusters(sb, root_clu, &root_clu->size); -+ if (ret) { -+ exfat_err(sb, "failed to count the number of clusters in root"); -+ goto free_bh; -+ } -+ - ret = exfat_create_upcase_table(sb); - if (ret) { - exfat_err(sb, "failed to load upcase table"); -@@ -618,6 +627,7 @@ static int exfat_fill_super(struct super_block *sb, struct fs_context *fc) - struct exfat_sb_info *sbi = sb->s_fs_info; - struct exfat_mount_options *opts = &sbi->options; - struct inode *root_inode; -+ struct exfat_chain root_clu; - int err; - - if (opts->allow_utime == (unsigned short)-1) -@@ -636,7 +646,7 @@ static int exfat_fill_super(struct super_block *sb, struct fs_context *fc) - sb->s_time_min = EXFAT_MIN_TIMESTAMP_SECS; - sb->s_time_max = EXFAT_MAX_TIMESTAMP_SECS; - -- err = __exfat_fill_super(sb); -+ err = __exfat_fill_super(sb, &root_clu); - if (err) { - exfat_err(sb, "failed to recognize exfat type"); - goto check_nls_io; -@@ -671,7 +681,7 @@ static int exfat_fill_super(struct super_block *sb, struct fs_context *fc) - - root_inode->i_ino = EXFAT_ROOT_INO; - inode_set_iversion(root_inode, 1); -- err = exfat_read_root(root_inode); -+ err = exfat_read_root(root_inode, &root_clu); - if (err) { - exfat_err(sb, "failed to initialize root inode"); - goto put_inode; -diff --git a/fs/ext2/inode.c b/fs/ext2/inode.c -index 314b415ee51860..6ff1f8f29a3c62 100644 ---- a/fs/ext2/inode.c -+++ b/fs/ext2/inode.c -@@ -895,9 +895,19 @@ int ext2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, - u64 start, u64 len) - { - int ret; -+ loff_t i_size; - - inode_lock(inode); -- len = min_t(u64, len, i_size_read(inode)); -+ i_size = i_size_read(inode); -+ /* -+ * iomap_fiemap() returns EINVAL for 0 length. Make sure we don't trim -+ * length to 0 but still trim the range as much as possible since -+ * ext2_get_blocks() iterates unmapped space block by block which is -+ * slow. -+ */ -+ if (i_size == 0) -+ i_size = 1; -+ len = min_t(u64, len, i_size); - ret = iomap_fiemap(inode, fieinfo, start, len, &ext2_iomap_ops); - inode_unlock(inode); - -diff --git a/fs/ext4/fsmap.c b/fs/ext4/fsmap.c -index 53a05b8292f033..1b68586f73f3fe 100644 ---- a/fs/ext4/fsmap.c -+++ b/fs/ext4/fsmap.c -@@ -393,6 +393,14 @@ static unsigned int ext4_getfsmap_find_sb(struct super_block *sb, - /* Reserved GDT blocks */ - if (!ext4_has_feature_meta_bg(sb) || metagroup < first_meta_bg) { - len = le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks); -+ -+ /* -+ * mkfs.ext4 can set s_reserved_gdt_blocks as 0 in some cases, -+ * check for that. -+ */ -+ if (!len) -+ return 0; -+ - error = ext4_getfsmap_fill(meta_list, fsb, len, - EXT4_FMR_OWN_RESV_GDT); - if (error) -@@ -526,6 +534,7 @@ static int ext4_getfsmap_datadev(struct super_block *sb, - ext4_group_t end_ag; - ext4_grpblk_t first_cluster; - ext4_grpblk_t last_cluster; -+ struct ext4_fsmap irec; - int error = 0; - - bofs = le32_to_cpu(sbi->s_es->s_first_data_block); -@@ -609,10 +618,18 @@ static int ext4_getfsmap_datadev(struct super_block *sb, - goto err; - } - -- /* Report any gaps at the end of the bg */ -+ /* -+ * The dummy record below will cause ext4_getfsmap_helper() to report -+ * any allocated blocks at the end of the range. -+ */ -+ irec.fmr_device = 0; -+ irec.fmr_physical = end_fsb + 1; -+ irec.fmr_length = 0; -+ irec.fmr_owner = EXT4_FMR_OWN_FREE; -+ irec.fmr_flags = 0; -+ - info->gfi_last = true; -- error = ext4_getfsmap_datadev_helper(sb, end_ag, last_cluster + 1, -- 0, info); -+ error = ext4_getfsmap_helper(sb, info, &irec); - if (error) - goto err; - -diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c -index f2c495b745f1e4..d18a5bee102157 100644 ---- a/fs/ext4/indirect.c -+++ b/fs/ext4/indirect.c -@@ -539,7 +539,7 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode, - int indirect_blks; - int blocks_to_boundary = 0; - int depth; -- int count = 0; -+ u64 count = 0; - ext4_fsblk_t first_block = 0; - - trace_ext4_ind_map_blocks_enter(inode, map->m_lblk, map->m_len, flags); -@@ -588,7 +588,7 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode, - count++; - /* Fill in size of a hole we found */ - map->m_pblk = 0; -- map->m_len = min_t(unsigned int, map->m_len, count); -+ map->m_len = umin(map->m_len, count); - goto cleanup; - } - -diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c -index c85647a0ba09fb..5fa1dd58ac42c1 100644 ---- a/fs/ext4/inline.c -+++ b/fs/ext4/inline.c -@@ -298,7 +298,11 @@ static int ext4_create_inline_data(handle_t *handle, - if (error) - goto out; - -- BUG_ON(!is.s.not_found); -+ if (!is.s.not_found) { -+ EXT4_ERROR_INODE(inode, "unexpected inline data xattr"); -+ error = -EFSCORRUPTED; -+ goto out; -+ } - - error = ext4_xattr_ibody_set(handle, inode, &i, &is); - if (error) { -@@ -349,7 +353,11 @@ static int ext4_update_inline_data(handle_t *handle, struct inode *inode, - if (error) - goto out; - -- BUG_ON(is.s.not_found); -+ if (is.s.not_found) { -+ EXT4_ERROR_INODE(inode, "missing inline data xattr"); -+ error = -EFSCORRUPTED; -+ goto out; -+ } - - len -= EXT4_MIN_INLINE_DATA_SIZE; - value = kzalloc(len, GFP_NOFS); -@@ -1966,7 +1974,12 @@ int ext4_inline_data_truncate(struct inode *inode, int *has_inline) - if ((err = ext4_xattr_ibody_find(inode, &i, &is)) != 0) - goto out_error; - -- BUG_ON(is.s.not_found); -+ if (is.s.not_found) { -+ EXT4_ERROR_INODE(inode, -+ "missing inline data xattr"); -+ err = -EFSCORRUPTED; -+ goto out_error; -+ } - - value_len = le32_to_cpu(is.s.here->e_value_size); - value = kmalloc(value_len, GFP_NOFS); -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 9694ef6b996e47..886d4dfa737a27 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -146,7 +146,7 @@ static int ext4_meta_trans_blocks(struct inode *inode, int lblocks, - */ - int ext4_inode_is_fast_symlink(struct inode *inode) - { -- if (!(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)) { -+ if (!ext4_has_feature_ea_inode(inode->i_sb)) { - int ea_blocks = EXT4_I(inode)->i_file_acl ? - EXT4_CLUSTER_SIZE(inode->i_sb) >> 9 : 0; - -diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index 8a9f8c95c6f1eb..c5f642096ab4ec 100644 ---- a/fs/ext4/mballoc.c -+++ b/fs/ext4/mballoc.c -@@ -841,30 +841,30 @@ static void - mb_update_avg_fragment_size(struct super_block *sb, struct ext4_group_info *grp) - { - struct ext4_sb_info *sbi = EXT4_SB(sb); -- int new_order; -+ int new, old; - -- if (!test_opt2(sb, MB_OPTIMIZE_SCAN) || grp->bb_fragments == 0) -+ if (!test_opt2(sb, MB_OPTIMIZE_SCAN)) - return; - -- new_order = mb_avg_fragment_size_order(sb, -- grp->bb_free / grp->bb_fragments); -- if (new_order == grp->bb_avg_fragment_size_order) -+ old = grp->bb_avg_fragment_size_order; -+ new = grp->bb_fragments == 0 ? -1 : -+ mb_avg_fragment_size_order(sb, grp->bb_free / grp->bb_fragments); -+ if (new == old) - return; - -- if (grp->bb_avg_fragment_size_order != -1) { -- write_lock(&sbi->s_mb_avg_fragment_size_locks[ -- grp->bb_avg_fragment_size_order]); -+ if (old >= 0) { -+ write_lock(&sbi->s_mb_avg_fragment_size_locks[old]); - list_del(&grp->bb_avg_fragment_size_node); -- write_unlock(&sbi->s_mb_avg_fragment_size_locks[ -- grp->bb_avg_fragment_size_order]); -+ write_unlock(&sbi->s_mb_avg_fragment_size_locks[old]); -+ } -+ -+ grp->bb_avg_fragment_size_order = new; -+ if (new >= 0) { -+ write_lock(&sbi->s_mb_avg_fragment_size_locks[new]); -+ list_add_tail(&grp->bb_avg_fragment_size_node, -+ &sbi->s_mb_avg_fragment_size[new]); -+ write_unlock(&sbi->s_mb_avg_fragment_size_locks[new]); - } -- grp->bb_avg_fragment_size_order = new_order; -- write_lock(&sbi->s_mb_avg_fragment_size_locks[ -- grp->bb_avg_fragment_size_order]); -- list_add_tail(&grp->bb_avg_fragment_size_node, -- &sbi->s_mb_avg_fragment_size[grp->bb_avg_fragment_size_order]); -- write_unlock(&sbi->s_mb_avg_fragment_size_locks[ -- grp->bb_avg_fragment_size_order]); - } - - /* -@@ -1150,33 +1150,28 @@ static void - mb_set_largest_free_order(struct super_block *sb, struct ext4_group_info *grp) - { - struct ext4_sb_info *sbi = EXT4_SB(sb); -- int i; -+ int new, old = grp->bb_largest_free_order; - -- for (i = MB_NUM_ORDERS(sb) - 1; i >= 0; i--) -- if (grp->bb_counters[i] > 0) -+ for (new = MB_NUM_ORDERS(sb) - 1; new >= 0; new--) -+ if (grp->bb_counters[new] > 0) - break; -+ - /* No need to move between order lists? */ -- if (!test_opt2(sb, MB_OPTIMIZE_SCAN) || -- i == grp->bb_largest_free_order) { -- grp->bb_largest_free_order = i; -+ if (new == old) - return; -- } - -- if (grp->bb_largest_free_order >= 0) { -- write_lock(&sbi->s_mb_largest_free_orders_locks[ -- grp->bb_largest_free_order]); -+ if (old >= 0 && !list_empty(&grp->bb_largest_free_order_node)) { -+ write_lock(&sbi->s_mb_largest_free_orders_locks[old]); - list_del_init(&grp->bb_largest_free_order_node); -- write_unlock(&sbi->s_mb_largest_free_orders_locks[ -- grp->bb_largest_free_order]); -+ write_unlock(&sbi->s_mb_largest_free_orders_locks[old]); - } -- grp->bb_largest_free_order = i; -- if (grp->bb_largest_free_order >= 0 && grp->bb_free) { -- write_lock(&sbi->s_mb_largest_free_orders_locks[ -- grp->bb_largest_free_order]); -+ -+ grp->bb_largest_free_order = new; -+ if (test_opt2(sb, MB_OPTIMIZE_SCAN) && new >= 0 && grp->bb_free) { -+ write_lock(&sbi->s_mb_largest_free_orders_locks[new]); - list_add_tail(&grp->bb_largest_free_order_node, -- &sbi->s_mb_largest_free_orders[grp->bb_largest_free_order]); -- write_unlock(&sbi->s_mb_largest_free_orders_locks[ -- grp->bb_largest_free_order]); -+ &sbi->s_mb_largest_free_orders[new]); -+ write_unlock(&sbi->s_mb_largest_free_orders_locks[new]); - } - } - -diff --git a/fs/ext4/orphan.c b/fs/ext4/orphan.c -index e5b47dda331759..a23b0c01f8096d 100644 ---- a/fs/ext4/orphan.c -+++ b/fs/ext4/orphan.c -@@ -590,8 +590,9 @@ int ext4_init_orphan_info(struct super_block *sb) - } - oi->of_blocks = inode->i_size >> sb->s_blocksize_bits; - oi->of_csum_seed = EXT4_I(inode)->i_csum_seed; -- oi->of_binfo = kmalloc(oi->of_blocks*sizeof(struct ext4_orphan_block), -- GFP_KERNEL); -+ oi->of_binfo = kmalloc_array(oi->of_blocks, -+ sizeof(struct ext4_orphan_block), -+ GFP_KERNEL); - if (!oi->of_binfo) { - ret = -ENOMEM; - goto out_put; -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index d2b58f940aab5e..7e3906f1390975 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -2028,6 +2028,9 @@ int ext4_init_fs_context(struct fs_context *fc) - fc->fs_private = ctx; - fc->ops = &ext4_context_ops; - -+ /* i_version is always enabled now */ -+ fc->sb_flags |= SB_I_VERSION; -+ - return 0; - } - -@@ -5305,9 +5308,6 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb) - sb->s_flags = (sb->s_flags & ~SB_POSIXACL) | - (test_opt(sb, POSIX_ACL) ? SB_POSIXACL : 0); - -- /* i_version is always enabled now */ -- sb->s_flags |= SB_I_VERSION; -- - err = ext4_check_feature_compatibility(sb, es, silent); - if (err) - goto failed_mount; -@@ -5398,6 +5398,8 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb) - err = ext4_load_and_init_journal(sb, es, ctx); - if (err) - goto failed_mount3a; -+ if (bdev_read_only(sb->s_bdev)) -+ needs_recovery = 0; - } else if (test_opt(sb, NOLOAD) && !sb_rdonly(sb) && - ext4_has_feature_journal_needs_recovery(sb)) { - ext4_msg(sb, KERN_ERR, "required journal recovery " -diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c -index 8f0cb7c7eedeb4..031015823acb2b 100644 ---- a/fs/f2fs/file.c -+++ b/fs/f2fs/file.c -@@ -991,6 +991,18 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, - if (unlikely(f2fs_cp_error(F2FS_I_SB(inode)))) - return -EIO; - -+ err = setattr_prepare(idmap, dentry, attr); -+ if (err) -+ return err; -+ -+ err = fscrypt_prepare_setattr(dentry, attr); -+ if (err) -+ return err; -+ -+ err = fsverity_prepare_setattr(dentry, attr); -+ if (err) -+ return err; -+ - if (unlikely(IS_IMMUTABLE(inode))) - return -EPERM; - -@@ -1008,18 +1020,6 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, - return -EINVAL; - } - -- err = setattr_prepare(idmap, dentry, attr); -- if (err) -- return err; -- -- err = fscrypt_prepare_setattr(dentry, attr); -- if (err) -- return err; -- -- err = fsverity_prepare_setattr(dentry, attr); -- if (err) -- return err; -- - if (is_quota_modification(idmap, inode, attr)) { - err = f2fs_dquot_initialize(inode); - if (err) -diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c -index b00d66b953210d..1b404937743cf3 100644 ---- a/fs/f2fs/node.c -+++ b/fs/f2fs/node.c -@@ -799,6 +799,16 @@ int f2fs_get_dnode_of_data(struct dnode_of_data *dn, pgoff_t index, int mode) - for (i = 1; i <= level; i++) { - bool done = false; - -+ if (nids[i] && nids[i] == dn->inode->i_ino) { -+ err = -EFSCORRUPTED; -+ f2fs_err_ratelimited(sbi, -+ "inode mapping table is corrupted, run fsck to fix it, " -+ "ino:%lu, nid:%u, level:%d, offset:%d", -+ dn->inode->i_ino, nids[i], level, offset[level]); -+ set_sbi_flag(sbi, SBI_NEED_FSCK); -+ goto release_pages; -+ } -+ - if (!nids[i] && mode == ALLOC_NODE) { - /* alloc new node */ - if (!f2fs_alloc_nid(sbi, &(nids[i]))) { -diff --git a/fs/file.c b/fs/file.c -index f8cf6728c6a03f..0ce6a6930276d3 100644 ---- a/fs/file.c -+++ b/fs/file.c -@@ -90,18 +90,11 @@ static void copy_fdtable(struct fdtable *nfdt, struct fdtable *ofdt) - * 'unsigned long' in some places, but simply because that is how the Linux - * kernel bitmaps are defined to work: they are not "bits in an array of bytes", - * they are very much "bits in an array of unsigned long". -- * -- * The ALIGN(nr, BITS_PER_LONG) here is for clarity: since we just multiplied -- * by that "1024/sizeof(ptr)" before, we already know there are sufficient -- * clear low bits. Clang seems to realize that, gcc ends up being confused. -- * -- * On a 128-bit machine, the ALIGN() would actually matter. In the meantime, -- * let's consider it documentation (and maybe a test-case for gcc to improve -- * its code generation ;) - */ --static struct fdtable * alloc_fdtable(unsigned int nr) -+static struct fdtable *alloc_fdtable(unsigned int slots_wanted) - { - struct fdtable *fdt; -+ unsigned int nr; - void *data; - - /* -@@ -109,22 +102,47 @@ static struct fdtable * alloc_fdtable(unsigned int nr) - * Allocation steps are keyed to the size of the fdarray, since it - * grows far faster than any of the other dynamic data. We try to fit - * the fdarray into comfortable page-tuned chunks: starting at 1024B -- * and growing in powers of two from there on. -+ * and growing in powers of two from there on. Since we called only -+ * with slots_wanted > BITS_PER_LONG (embedded instance in files->fdtab -+ * already gives BITS_PER_LONG slots), the above boils down to -+ * 1. use the smallest power of two large enough to give us that many -+ * slots. -+ * 2. on 32bit skip 64 and 128 - the minimal capacity we want there is -+ * 256 slots (i.e. 1Kb fd array). -+ * 3. on 64bit don't skip anything, 1Kb fd array means 128 slots there -+ * and we are never going to be asked for 64 or less. - */ -- nr /= (1024 / sizeof(struct file *)); -- nr = roundup_pow_of_two(nr + 1); -- nr *= (1024 / sizeof(struct file *)); -- nr = ALIGN(nr, BITS_PER_LONG); -+ if (IS_ENABLED(CONFIG_32BIT) && slots_wanted < 256) -+ nr = 256; -+ else -+ nr = roundup_pow_of_two(slots_wanted); - /* - * Note that this can drive nr *below* what we had passed if sysctl_nr_open -- * had been set lower between the check in expand_files() and here. Deal -- * with that in caller, it's cheaper that way. -+ * had been set lower between the check in expand_files() and here. - * - * We make sure that nr remains a multiple of BITS_PER_LONG - otherwise - * bitmaps handling below becomes unpleasant, to put it mildly... - */ -- if (unlikely(nr > sysctl_nr_open)) -- nr = ((sysctl_nr_open - 1) | (BITS_PER_LONG - 1)) + 1; -+ if (unlikely(nr > sysctl_nr_open)) { -+ nr = round_down(sysctl_nr_open, BITS_PER_LONG); -+ if (nr < slots_wanted) -+ return ERR_PTR(-EMFILE); -+ } -+ -+ /* -+ * Check if the allocation size would exceed INT_MAX. kvmalloc_array() -+ * and kvmalloc() will warn if the allocation size is greater than -+ * INT_MAX, as filp_cachep objects are not __GFP_NOWARN. -+ * -+ * This can happen when sysctl_nr_open is set to a very high value and -+ * a process tries to use a file descriptor near that limit. For example, -+ * if sysctl_nr_open is set to 1073741816 (0x3ffffff8) - which is what -+ * systemd typically sets it to - then trying to use a file descriptor -+ * close to that value will require allocating a file descriptor table -+ * that exceeds 8GB in size. -+ */ -+ if (unlikely(nr > INT_MAX / sizeof(struct file *))) -+ return ERR_PTR(-EMFILE); - - fdt = kmalloc(sizeof(struct fdtable), GFP_KERNEL_ACCOUNT); - if (!fdt) -@@ -153,7 +171,7 @@ static struct fdtable * alloc_fdtable(unsigned int nr) - out_fdt: - kfree(fdt); - out: -- return NULL; -+ return ERR_PTR(-ENOMEM); - } - - /* -@@ -170,7 +188,7 @@ static int expand_fdtable(struct files_struct *files, unsigned int nr) - struct fdtable *new_fdt, *cur_fdt; - - spin_unlock(&files->file_lock); -- new_fdt = alloc_fdtable(nr); -+ new_fdt = alloc_fdtable(nr + 1); - - /* make sure all fd_install() have seen resize_in_progress - * or have finished their rcu_read_lock_sched() section. -@@ -179,16 +197,8 @@ static int expand_fdtable(struct files_struct *files, unsigned int nr) - synchronize_rcu(); - - spin_lock(&files->file_lock); -- if (!new_fdt) -- return -ENOMEM; -- /* -- * extremely unlikely race - sysctl_nr_open decreased between the check in -- * caller and alloc_fdtable(). Cheaper to catch it here... -- */ -- if (unlikely(new_fdt->max_fds <= nr)) { -- __free_fdtable(new_fdt); -- return -EMFILE; -- } -+ if (IS_ERR(new_fdt)) -+ return PTR_ERR(new_fdt); - cur_fdt = files_fdtable(files); - BUG_ON(nr < cur_fdt->max_fds); - copy_fdtable(new_fdt, cur_fdt); -@@ -302,7 +312,6 @@ struct files_struct *dup_fd(struct files_struct *oldf, struct fd_range *punch_ho - struct file **old_fds, **new_fds; - unsigned int open_files, i; - struct fdtable *old_fdt, *new_fdt; -- int error; - - newf = kmem_cache_alloc(files_cachep, GFP_KERNEL); - if (!newf) -@@ -334,17 +343,10 @@ struct files_struct *dup_fd(struct files_struct *oldf, struct fd_range *punch_ho - if (new_fdt != &newf->fdtab) - __free_fdtable(new_fdt); - -- new_fdt = alloc_fdtable(open_files - 1); -- if (!new_fdt) { -- error = -ENOMEM; -- goto out_release; -- } -- -- /* beyond sysctl_nr_open; nothing to do */ -- if (unlikely(new_fdt->max_fds < open_files)) { -- __free_fdtable(new_fdt); -- error = -EMFILE; -- goto out_release; -+ new_fdt = alloc_fdtable(open_files); -+ if (IS_ERR(new_fdt)) { -+ kmem_cache_free(files_cachep, newf); -+ return ERR_CAST(new_fdt); - } - - /* -@@ -393,10 +395,6 @@ struct files_struct *dup_fd(struct files_struct *oldf, struct fd_range *punch_ho - rcu_assign_pointer(newf->fdt, new_fdt); - - return newf; -- --out_release: -- kmem_cache_free(files_cachep, newf); -- return ERR_PTR(error); - } - - static struct fdtable *close_files(struct files_struct * files) -diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c -index 1f42eae112fb88..b1a368fc089f32 100644 ---- a/fs/gfs2/meta_io.c -+++ b/fs/gfs2/meta_io.c -@@ -93,6 +93,7 @@ const struct address_space_operations gfs2_meta_aops = { - .invalidate_folio = block_invalidate_folio, - .writepage = gfs2_aspace_writepage, - .release_folio = gfs2_release_folio, -+ .migrate_folio = buffer_migrate_folio_norefs, - }; - - const struct address_space_operations gfs2_rgrp_aops = { -@@ -100,6 +101,7 @@ const struct address_space_operations gfs2_rgrp_aops = { - .invalidate_folio = block_invalidate_folio, - .writepage = gfs2_aspace_writepage, - .release_folio = gfs2_release_folio, -+ .migrate_folio = buffer_migrate_folio_norefs, - }; - - /** -diff --git a/fs/hfs/bfind.c b/fs/hfs/bfind.c -index ef9498a6e88acd..34e9804e0f3601 100644 ---- a/fs/hfs/bfind.c -+++ b/fs/hfs/bfind.c -@@ -16,6 +16,9 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) - { - void *ptr; - -+ if (!tree || !fd) -+ return -EINVAL; -+ - fd->tree = tree; - fd->bnode = NULL; - ptr = kmalloc(tree->max_key_len * 2 + 4, GFP_KERNEL); -diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c -index cb823a8a6ba960..e8cd1a31f2470c 100644 ---- a/fs/hfs/bnode.c -+++ b/fs/hfs/bnode.c -@@ -15,6 +15,48 @@ - - #include "btree.h" - -+static inline -+bool is_bnode_offset_valid(struct hfs_bnode *node, int off) -+{ -+ bool is_valid = off < node->tree->node_size; -+ -+ if (!is_valid) { -+ pr_err("requested invalid offset: " -+ "NODE: id %u, type %#x, height %u, " -+ "node_size %u, offset %d\n", -+ node->this, node->type, node->height, -+ node->tree->node_size, off); -+ } -+ -+ return is_valid; -+} -+ -+static inline -+int check_and_correct_requested_length(struct hfs_bnode *node, int off, int len) -+{ -+ unsigned int node_size; -+ -+ if (!is_bnode_offset_valid(node, off)) -+ return 0; -+ -+ node_size = node->tree->node_size; -+ -+ if ((off + len) > node_size) { -+ int new_len = (int)node_size - off; -+ -+ pr_err("requested length has been corrected: " -+ "NODE: id %u, type %#x, height %u, " -+ "node_size %u, offset %d, " -+ "requested_len %d, corrected_len %d\n", -+ node->this, node->type, node->height, -+ node->tree->node_size, off, len, new_len); -+ -+ return new_len; -+ } -+ -+ return len; -+} -+ - void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len) - { - struct page *page; -@@ -22,6 +64,20 @@ void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len) - int bytes_read; - int bytes_to_read; - -+ if (!is_bnode_offset_valid(node, off)) -+ return; -+ -+ if (len == 0) { -+ pr_err("requested zero length: " -+ "NODE: id %u, type %#x, height %u, " -+ "node_size %u, offset %d, len %d\n", -+ node->this, node->type, node->height, -+ node->tree->node_size, off, len); -+ return; -+ } -+ -+ len = check_and_correct_requested_length(node, off, len); -+ - off += node->page_offset; - pagenum = off >> PAGE_SHIFT; - off &= ~PAGE_MASK; /* compute page offset for the first page */ -@@ -80,6 +136,20 @@ void hfs_bnode_write(struct hfs_bnode *node, void *buf, int off, int len) - { - struct page *page; - -+ if (!is_bnode_offset_valid(node, off)) -+ return; -+ -+ if (len == 0) { -+ pr_err("requested zero length: " -+ "NODE: id %u, type %#x, height %u, " -+ "node_size %u, offset %d, len %d\n", -+ node->this, node->type, node->height, -+ node->tree->node_size, off, len); -+ return; -+ } -+ -+ len = check_and_correct_requested_length(node, off, len); -+ - off += node->page_offset; - page = node->page[0]; - -@@ -104,6 +174,20 @@ void hfs_bnode_clear(struct hfs_bnode *node, int off, int len) - { - struct page *page; - -+ if (!is_bnode_offset_valid(node, off)) -+ return; -+ -+ if (len == 0) { -+ pr_err("requested zero length: " -+ "NODE: id %u, type %#x, height %u, " -+ "node_size %u, offset %d, len %d\n", -+ node->this, node->type, node->height, -+ node->tree->node_size, off, len); -+ return; -+ } -+ -+ len = check_and_correct_requested_length(node, off, len); -+ - off += node->page_offset; - page = node->page[0]; - -@@ -119,6 +203,10 @@ void hfs_bnode_copy(struct hfs_bnode *dst_node, int dst, - hfs_dbg(BNODE_MOD, "copybytes: %u,%u,%u\n", dst, src, len); - if (!len) - return; -+ -+ len = check_and_correct_requested_length(src_node, src, len); -+ len = check_and_correct_requested_length(dst_node, dst, len); -+ - src += src_node->page_offset; - dst += dst_node->page_offset; - src_page = src_node->page[0]; -@@ -136,6 +224,10 @@ void hfs_bnode_move(struct hfs_bnode *node, int dst, int src, int len) - hfs_dbg(BNODE_MOD, "movebytes: %u,%u,%u\n", dst, src, len); - if (!len) - return; -+ -+ len = check_and_correct_requested_length(node, src, len); -+ len = check_and_correct_requested_length(node, dst, len); -+ - src += node->page_offset; - dst += node->page_offset; - page = node->page[0]; -@@ -482,6 +574,7 @@ void hfs_bnode_put(struct hfs_bnode *node) - if (test_bit(HFS_BNODE_DELETED, &node->flags)) { - hfs_bnode_unhash(node); - spin_unlock(&tree->hash_lock); -+ hfs_bnode_clear(node, 0, tree->node_size); - hfs_bmap_free(node); - hfs_bnode_free(node); - return; -diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c -index 2fa4b1f8cc7fb0..e86e1e235658fa 100644 ---- a/fs/hfs/btree.c -+++ b/fs/hfs/btree.c -@@ -21,8 +21,12 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke - struct hfs_btree *tree; - struct hfs_btree_header_rec *head; - struct address_space *mapping; -- struct page *page; -+ struct folio *folio; -+ struct buffer_head *bh; - unsigned int size; -+ u16 dblock; -+ sector_t start_block; -+ loff_t offset; - - tree = kzalloc(sizeof(*tree), GFP_KERNEL); - if (!tree) -@@ -75,12 +79,40 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke - unlock_new_inode(tree->inode); - - mapping = tree->inode->i_mapping; -- page = read_mapping_page(mapping, 0, NULL); -- if (IS_ERR(page)) -+ folio = filemap_grab_folio(mapping, 0); -+ if (IS_ERR(folio)) - goto free_inode; - -+ folio_zero_range(folio, 0, folio_size(folio)); -+ -+ dblock = hfs_ext_find_block(HFS_I(tree->inode)->first_extents, 0); -+ start_block = HFS_SB(sb)->fs_start + (dblock * HFS_SB(sb)->fs_div); -+ -+ size = folio_size(folio); -+ offset = 0; -+ while (size > 0) { -+ size_t len; -+ -+ bh = sb_bread(sb, start_block); -+ if (!bh) { -+ pr_err("unable to read tree header\n"); -+ goto put_folio; -+ } -+ -+ len = min_t(size_t, folio_size(folio), sb->s_blocksize); -+ memcpy_to_folio(folio, offset, bh->b_data, sb->s_blocksize); -+ -+ brelse(bh); -+ -+ start_block++; -+ offset += len; -+ size -= len; -+ } -+ -+ folio_mark_uptodate(folio); -+ - /* Load the header */ -- head = (struct hfs_btree_header_rec *)(kmap_local_page(page) + -+ head = (struct hfs_btree_header_rec *)(kmap_local_folio(folio, 0) + - sizeof(struct hfs_bnode_desc)); - tree->root = be32_to_cpu(head->root); - tree->leaf_count = be32_to_cpu(head->leaf_count); -@@ -95,22 +127,22 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke - - size = tree->node_size; - if (!is_power_of_2(size)) -- goto fail_page; -+ goto fail_folio; - if (!tree->node_count) -- goto fail_page; -+ goto fail_folio; - switch (id) { - case HFS_EXT_CNID: - if (tree->max_key_len != HFS_MAX_EXT_KEYLEN) { - pr_err("invalid extent max_key_len %d\n", - tree->max_key_len); -- goto fail_page; -+ goto fail_folio; - } - break; - case HFS_CAT_CNID: - if (tree->max_key_len != HFS_MAX_CAT_KEYLEN) { - pr_err("invalid catalog max_key_len %d\n", - tree->max_key_len); -- goto fail_page; -+ goto fail_folio; - } - break; - default: -@@ -121,12 +153,15 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke - tree->pages_per_bnode = (tree->node_size + PAGE_SIZE - 1) >> PAGE_SHIFT; - - kunmap_local(head); -- put_page(page); -+ folio_unlock(folio); -+ folio_put(folio); - return tree; - --fail_page: -+fail_folio: - kunmap_local(head); -- put_page(page); -+put_folio: -+ folio_unlock(folio); -+ folio_put(folio); - free_inode: - tree->inode->i_mapping->a_ops = &hfs_aops; - iput(tree->inode); -diff --git a/fs/hfs/extent.c b/fs/hfs/extent.c -index 6d1878b99b3058..941c92525815e0 100644 ---- a/fs/hfs/extent.c -+++ b/fs/hfs/extent.c -@@ -71,7 +71,7 @@ int hfs_ext_keycmp(const btree_key *key1, const btree_key *key2) - * - * Find a block within an extent record - */ --static u16 hfs_ext_find_block(struct hfs_extent *ext, u16 off) -+u16 hfs_ext_find_block(struct hfs_extent *ext, u16 off) - { - int i; - u16 count; -diff --git a/fs/hfs/hfs_fs.h b/fs/hfs/hfs_fs.h -index 49d02524e66717..f1402d71b092be 100644 ---- a/fs/hfs/hfs_fs.h -+++ b/fs/hfs/hfs_fs.h -@@ -190,6 +190,7 @@ extern const struct inode_operations hfs_dir_inode_operations; - - /* extent.c */ - extern int hfs_ext_keycmp(const btree_key *, const btree_key *); -+extern u16 hfs_ext_find_block(struct hfs_extent *ext, u16 off); - extern int hfs_free_fork(struct super_block *, struct hfs_cat_file *, int); - extern int hfs_ext_write_extent(struct inode *); - extern int hfs_extend_file(struct inode *); -diff --git a/fs/hfsplus/bnode.c b/fs/hfsplus/bnode.c -index 079ea80534f7de..14f4995588ff03 100644 ---- a/fs/hfsplus/bnode.c -+++ b/fs/hfsplus/bnode.c -@@ -18,12 +18,68 @@ - #include "hfsplus_fs.h" - #include "hfsplus_raw.h" - -+static inline -+bool is_bnode_offset_valid(struct hfs_bnode *node, int off) -+{ -+ bool is_valid = off < node->tree->node_size; -+ -+ if (!is_valid) { -+ pr_err("requested invalid offset: " -+ "NODE: id %u, type %#x, height %u, " -+ "node_size %u, offset %d\n", -+ node->this, node->type, node->height, -+ node->tree->node_size, off); -+ } -+ -+ return is_valid; -+} -+ -+static inline -+int check_and_correct_requested_length(struct hfs_bnode *node, int off, int len) -+{ -+ unsigned int node_size; -+ -+ if (!is_bnode_offset_valid(node, off)) -+ return 0; -+ -+ node_size = node->tree->node_size; -+ -+ if ((off + len) > node_size) { -+ int new_len = (int)node_size - off; -+ -+ pr_err("requested length has been corrected: " -+ "NODE: id %u, type %#x, height %u, " -+ "node_size %u, offset %d, " -+ "requested_len %d, corrected_len %d\n", -+ node->this, node->type, node->height, -+ node->tree->node_size, off, len, new_len); -+ -+ return new_len; -+ } -+ -+ return len; -+} -+ - /* Copy a specified range of bytes from the raw data of a node */ - void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len) - { - struct page **pagep; - int l; - -+ if (!is_bnode_offset_valid(node, off)) -+ return; -+ -+ if (len == 0) { -+ pr_err("requested zero length: " -+ "NODE: id %u, type %#x, height %u, " -+ "node_size %u, offset %d, len %d\n", -+ node->this, node->type, node->height, -+ node->tree->node_size, off, len); -+ return; -+ } -+ -+ len = check_and_correct_requested_length(node, off, len); -+ - off += node->page_offset; - pagep = node->page + (off >> PAGE_SHIFT); - off &= ~PAGE_MASK; -@@ -81,6 +137,20 @@ void hfs_bnode_write(struct hfs_bnode *node, void *buf, int off, int len) - struct page **pagep; - int l; - -+ if (!is_bnode_offset_valid(node, off)) -+ return; -+ -+ if (len == 0) { -+ pr_err("requested zero length: " -+ "NODE: id %u, type %#x, height %u, " -+ "node_size %u, offset %d, len %d\n", -+ node->this, node->type, node->height, -+ node->tree->node_size, off, len); -+ return; -+ } -+ -+ len = check_and_correct_requested_length(node, off, len); -+ - off += node->page_offset; - pagep = node->page + (off >> PAGE_SHIFT); - off &= ~PAGE_MASK; -@@ -109,6 +179,20 @@ void hfs_bnode_clear(struct hfs_bnode *node, int off, int len) - struct page **pagep; - int l; - -+ if (!is_bnode_offset_valid(node, off)) -+ return; -+ -+ if (len == 0) { -+ pr_err("requested zero length: " -+ "NODE: id %u, type %#x, height %u, " -+ "node_size %u, offset %d, len %d\n", -+ node->this, node->type, node->height, -+ node->tree->node_size, off, len); -+ return; -+ } -+ -+ len = check_and_correct_requested_length(node, off, len); -+ - off += node->page_offset; - pagep = node->page + (off >> PAGE_SHIFT); - off &= ~PAGE_MASK; -@@ -133,6 +217,10 @@ void hfs_bnode_copy(struct hfs_bnode *dst_node, int dst, - hfs_dbg(BNODE_MOD, "copybytes: %u,%u,%u\n", dst, src, len); - if (!len) - return; -+ -+ len = check_and_correct_requested_length(src_node, src, len); -+ len = check_and_correct_requested_length(dst_node, dst, len); -+ - src += src_node->page_offset; - dst += dst_node->page_offset; - src_page = src_node->page + (src >> PAGE_SHIFT); -@@ -187,6 +275,10 @@ void hfs_bnode_move(struct hfs_bnode *node, int dst, int src, int len) - hfs_dbg(BNODE_MOD, "movebytes: %u,%u,%u\n", dst, src, len); - if (!len) - return; -+ -+ len = check_and_correct_requested_length(node, src, len); -+ len = check_and_correct_requested_length(node, dst, len); -+ - src += node->page_offset; - dst += node->page_offset; - if (dst > src) { -diff --git a/fs/hfsplus/unicode.c b/fs/hfsplus/unicode.c -index 73342c925a4b6e..36b6cf2a3abba4 100644 ---- a/fs/hfsplus/unicode.c -+++ b/fs/hfsplus/unicode.c -@@ -132,7 +132,14 @@ int hfsplus_uni2asc(struct super_block *sb, - - op = astr; - ip = ustr->unicode; -+ - ustrlen = be16_to_cpu(ustr->length); -+ if (ustrlen > HFSPLUS_MAX_STRLEN) { -+ ustrlen = HFSPLUS_MAX_STRLEN; -+ pr_err("invalid length %u has been corrected to %d\n", -+ be16_to_cpu(ustr->length), ustrlen); -+ } -+ - len = *len_p; - ce1 = NULL; - compose = !test_bit(HFSPLUS_SB_NODECOMPOSE, &HFSPLUS_SB(sb)->flags); -diff --git a/fs/hfsplus/xattr.c b/fs/hfsplus/xattr.c -index f7f9d0889df342..d5fd8e068486e9 100644 ---- a/fs/hfsplus/xattr.c -+++ b/fs/hfsplus/xattr.c -@@ -172,7 +172,11 @@ static int hfsplus_create_attributes_file(struct super_block *sb) - return PTR_ERR(attr_file); - } - -- BUG_ON(i_size_read(attr_file) != 0); -+ if (i_size_read(attr_file) != 0) { -+ err = -EIO; -+ pr_err("detected inconsistent attributes file, running fsck.hfsplus is recommended.\n"); -+ goto end_attr_file_creation; -+ } - - hip = HFSPLUS_I(attr_file); - -diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c -index ac519515ef6c06..ab951fd475317c 100644 ---- a/fs/hugetlbfs/inode.c -+++ b/fs/hugetlbfs/inode.c -@@ -136,7 +136,7 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma) - vm_flags_set(vma, VM_HUGETLB | VM_DONTEXPAND); - vma->vm_ops = &hugetlb_vm_ops; - -- ret = seal_check_future_write(info->seals, vma); -+ ret = seal_check_write(info->seals, vma); - if (ret) - return ret; - -diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c -index 8fda66c98a610f..368ae50d8a59e0 100644 ---- a/fs/jbd2/checkpoint.c -+++ b/fs/jbd2/checkpoint.c -@@ -285,6 +285,7 @@ int jbd2_log_do_checkpoint(journal_t *journal) - retry: - if (batch_count) - __flush_batch(journal, &batch_count); -+ cond_resched(); - spin_lock(&journal->j_list_lock); - goto restart; - } -diff --git a/fs/jfs/file.c b/fs/jfs/file.c -index 01b6912e60f808..742cadd1f37e84 100644 ---- a/fs/jfs/file.c -+++ b/fs/jfs/file.c -@@ -44,6 +44,9 @@ static int jfs_open(struct inode *inode, struct file *file) - { - int rc; - -+ if (S_ISREG(inode->i_mode) && inode->i_size < 0) -+ return -EIO; -+ - if ((rc = dquot_file_open(inode, file))) - return rc; - -diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c -index 920d58a1566bfb..66c38ef5e57111 100644 ---- a/fs/jfs/inode.c -+++ b/fs/jfs/inode.c -@@ -145,9 +145,9 @@ void jfs_evict_inode(struct inode *inode) - if (!inode->i_nlink && !is_bad_inode(inode)) { - dquot_initialize(inode); - -+ truncate_inode_pages_final(&inode->i_data); - if (JFS_IP(inode)->fileset == FILESYSTEM_I) { - struct inode *ipimap = JFS_SBI(inode->i_sb)->ipimap; -- truncate_inode_pages_final(&inode->i_data); - - if (test_cflag(COMMIT_Freewmap, inode)) - jfs_free_zero_link(inode); -diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c -index 5a877261c3fe48..cdfa699cd7c8fa 100644 ---- a/fs/jfs/jfs_dmap.c -+++ b/fs/jfs/jfs_dmap.c -@@ -1389,6 +1389,12 @@ dbAllocAG(struct bmap * bmp, int agno, s64 nblocks, int l2nb, s64 * results) - (1 << (L2LPERCTL - (bmp->db_agheight << 1))) / bmp->db_agwidth; - ti = bmp->db_agstart + bmp->db_agwidth * (agno & (agperlev - 1)); - -+ if (ti < 0 || ti >= le32_to_cpu(dcp->nleafs)) { -+ jfs_error(bmp->db_ipbmap->i_sb, "Corrupt dmapctl page\n"); -+ release_metapage(mp); -+ return -EIO; -+ } -+ - /* dmap control page trees fan-out by 4 and a single allocation - * group may be described by 1 or 2 subtrees within the ag level - * dmap control page, depending upon the ag size. examine the ag's -diff --git a/fs/libfs.c b/fs/libfs.c -index f5566964aa7d13..b913ab238cc156 100644 ---- a/fs/libfs.c -+++ b/fs/libfs.c -@@ -610,7 +610,7 @@ void simple_recursive_removal(struct dentry *dentry, - struct dentry *victim = NULL, *child; - struct inode *inode = this->d_inode; - -- inode_lock(inode); -+ inode_lock_nested(inode, I_MUTEX_CHILD); - if (d_is_dir(this)) - inode->i_flags |= S_DEAD; - while ((child = find_next_child(this, victim)) == NULL) { -@@ -622,7 +622,7 @@ void simple_recursive_removal(struct dentry *dentry, - victim = this; - this = this->d_parent; - inode = this->d_inode; -- inode_lock(inode); -+ inode_lock_nested(inode, I_MUTEX_CHILD); - if (simple_positive(victim)) { - d_invalidate(victim); // avoid lost mounts - if (d_is_dir(victim)) -diff --git a/fs/namespace.c b/fs/namespace.c -index 6a9c53c800c4e4..f79226472251ba 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -2526,6 +2526,19 @@ static int graft_tree(struct mount *mnt, struct mount *p, struct mountpoint *mp) - return attach_recursive_mnt(mnt, p, mp, 0); - } - -+static int may_change_propagation(const struct mount *m) -+{ -+ struct mnt_namespace *ns = m->mnt_ns; -+ -+ // it must be mounted in some namespace -+ if (IS_ERR_OR_NULL(ns)) // is_mounted() -+ return -EINVAL; -+ // and the caller must be admin in userns of that namespace -+ if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN)) -+ return -EPERM; -+ return 0; -+} -+ - /* - * Sanity check the flags to change_mnt_propagation. - */ -@@ -2562,10 +2575,10 @@ static int do_change_type(struct path *path, int ms_flags) - return -EINVAL; - - namespace_lock(); -- if (!check_mnt(mnt)) { -- err = -EINVAL; -+ err = may_change_propagation(mnt); -+ if (err) - goto out_unlock; -- } -+ - if (type == MS_SHARED) { - err = invent_group_ids(mnt, recurse); - if (err) -@@ -2960,18 +2973,11 @@ static int do_set_group(struct path *from_path, struct path *to_path) - - namespace_lock(); - -- err = -EINVAL; -- /* To and From must be mounted */ -- if (!is_mounted(&from->mnt)) -- goto out; -- if (!is_mounted(&to->mnt)) -- goto out; -- -- err = -EPERM; -- /* We should be allowed to modify mount namespaces of both mounts */ -- if (!ns_capable(from->mnt_ns->user_ns, CAP_SYS_ADMIN)) -+ err = may_change_propagation(from); -+ if (err) - goto out; -- if (!ns_capable(to->mnt_ns->user_ns, CAP_SYS_ADMIN)) -+ err = may_change_propagation(to); -+ if (err) - goto out; - - err = -EINVAL; -diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c -index 6be13e0ec170d1..e498aade8c4796 100644 ---- a/fs/nfs/blocklayout/blocklayout.c -+++ b/fs/nfs/blocklayout/blocklayout.c -@@ -149,8 +149,8 @@ do_add_page_to_bio(struct bio *bio, int npg, enum req_op op, sector_t isect, - - /* limit length to what the device mapping allows */ - end = disk_addr + *len; -- if (end >= map->start + map->len) -- *len = map->start + map->len - disk_addr; -+ if (end >= map->disk_offset + map->len) -+ *len = map->disk_offset + map->len - disk_addr; - - retry: - if (!bio) { -diff --git a/fs/nfs/blocklayout/dev.c b/fs/nfs/blocklayout/dev.c -index 65cbb5607a5fc4..61ee0b6c0fba26 100644 ---- a/fs/nfs/blocklayout/dev.c -+++ b/fs/nfs/blocklayout/dev.c -@@ -199,10 +199,11 @@ static bool bl_map_stripe(struct pnfs_block_dev *dev, u64 offset, - struct pnfs_block_dev *child; - u64 chunk; - u32 chunk_idx; -+ u64 disk_chunk; - u64 disk_offset; - - chunk = div_u64(offset, dev->chunk_size); -- div_u64_rem(chunk, dev->nr_children, &chunk_idx); -+ disk_chunk = div_u64_rem(chunk, dev->nr_children, &chunk_idx); - - if (chunk_idx >= dev->nr_children) { - dprintk("%s: invalid chunk idx %d (%lld/%lld)\n", -@@ -215,7 +216,7 @@ static bool bl_map_stripe(struct pnfs_block_dev *dev, u64 offset, - offset = chunk * dev->chunk_size; - - /* disk offset of the stripe */ -- disk_offset = div_u64(offset, dev->nr_children); -+ disk_offset = disk_chunk * dev->chunk_size; - - child = &dev->children[chunk_idx]; - child->map(child, disk_offset, map); -diff --git a/fs/nfs/blocklayout/extent_tree.c b/fs/nfs/blocklayout/extent_tree.c -index 8f7cff7a42938e..0add0f329816b0 100644 ---- a/fs/nfs/blocklayout/extent_tree.c -+++ b/fs/nfs/blocklayout/extent_tree.c -@@ -552,6 +552,15 @@ static int ext_tree_encode_commit(struct pnfs_block_layout *bl, __be32 *p, - return ret; - } - -+/** -+ * ext_tree_prepare_commit - encode extents that need to be committed -+ * @arg: layout commit data -+ * -+ * Return values: -+ * %0: Success, all required extents are encoded -+ * %-ENOSPC: Some extents are encoded, but not all, due to RPC size limit -+ * %-ENOMEM: Out of memory, extents not encoded -+ */ - int - ext_tree_prepare_commit(struct nfs4_layoutcommit_args *arg) - { -@@ -568,12 +577,12 @@ ext_tree_prepare_commit(struct nfs4_layoutcommit_args *arg) - start_p = page_address(arg->layoutupdate_page); - arg->layoutupdate_pages = &arg->layoutupdate_page; - --retry: -- ret = ext_tree_encode_commit(bl, start_p + 1, buffer_size, &count, &arg->lastbytewritten); -+ ret = ext_tree_encode_commit(bl, start_p + 1, buffer_size, -+ &count, &arg->lastbytewritten); - if (unlikely(ret)) { - ext_tree_free_commitdata(arg, buffer_size); - -- buffer_size = ext_tree_layoutupdate_size(bl, count); -+ buffer_size = NFS_SERVER(arg->inode)->wsize; - count = 0; - - arg->layoutupdate_pages = -@@ -588,7 +597,8 @@ ext_tree_prepare_commit(struct nfs4_layoutcommit_args *arg) - return -ENOMEM; - } - -- goto retry; -+ ret = ext_tree_encode_commit(bl, start_p + 1, buffer_size, -+ &count, &arg->lastbytewritten); - } - - *start_p = cpu_to_be32(count); -@@ -608,7 +618,7 @@ ext_tree_prepare_commit(struct nfs4_layoutcommit_args *arg) - } - - dprintk("%s found %zu ranges\n", __func__, count); -- return 0; -+ return ret; - } - - void -diff --git a/fs/nfs/client.c b/fs/nfs/client.c -index aa09f930eeaf7e..cc764da581c43c 100644 ---- a/fs/nfs/client.c -+++ b/fs/nfs/client.c -@@ -668,6 +668,44 @@ struct nfs_client *nfs_init_client(struct nfs_client *clp, - } - EXPORT_SYMBOL_GPL(nfs_init_client); - -+static void nfs4_server_set_init_caps(struct nfs_server *server) -+{ -+#if IS_ENABLED(CONFIG_NFS_V4) -+ /* Set the basic capabilities */ -+ server->caps = server->nfs_client->cl_mvops->init_caps; -+ if (server->flags & NFS_MOUNT_NORDIRPLUS) -+ server->caps &= ~NFS_CAP_READDIRPLUS; -+ if (server->nfs_client->cl_proto == XPRT_TRANSPORT_RDMA) -+ server->caps &= ~NFS_CAP_READ_PLUS; -+ -+ /* -+ * Don't use NFS uid/gid mapping if we're using AUTH_SYS or lower -+ * authentication. -+ */ -+ if (nfs4_disable_idmapping && -+ server->client->cl_auth->au_flavor == RPC_AUTH_UNIX) -+ server->caps |= NFS_CAP_UIDGID_NOMAP; -+#endif -+} -+ -+void nfs_server_set_init_caps(struct nfs_server *server) -+{ -+ switch (server->nfs_client->rpc_ops->version) { -+ case 2: -+ server->caps = NFS_CAP_HARDLINKS | NFS_CAP_SYMLINKS; -+ break; -+ case 3: -+ server->caps = NFS_CAP_HARDLINKS | NFS_CAP_SYMLINKS; -+ if (!(server->flags & NFS_MOUNT_NORDIRPLUS)) -+ server->caps |= NFS_CAP_READDIRPLUS; -+ break; -+ default: -+ nfs4_server_set_init_caps(server); -+ break; -+ } -+} -+EXPORT_SYMBOL_GPL(nfs_server_set_init_caps); -+ - /* - * Create a version 2 or 3 client - */ -@@ -709,7 +747,6 @@ static int nfs_init_server(struct nfs_server *server, - /* Initialise the client representation from the mount data */ - server->flags = ctx->flags; - server->options = ctx->options; -- server->caps |= NFS_CAP_HARDLINKS | NFS_CAP_SYMLINKS; - - switch (clp->rpc_ops->version) { - case 2: -@@ -745,6 +782,8 @@ static int nfs_init_server(struct nfs_server *server, - if (error < 0) - goto error; - -+ nfs_server_set_init_caps(server); -+ - /* Preserve the values of mount_server-related mount options */ - if (ctx->mount_server.addrlen) { - memcpy(&server->mountd_address, &ctx->mount_server.address, -@@ -919,7 +958,6 @@ void nfs_server_copy_userdata(struct nfs_server *target, struct nfs_server *sour - target->acregmax = source->acregmax; - target->acdirmin = source->acdirmin; - target->acdirmax = source->acdirmax; -- target->caps = source->caps; - target->options = source->options; - target->auth_info = source->auth_info; - target->port = source->port; -@@ -1145,6 +1183,8 @@ struct nfs_server *nfs_clone_server(struct nfs_server *source, - if (error < 0) - goto out_free_server; - -+ nfs_server_set_init_caps(server); -+ - /* probe the filesystem info for this server filesystem */ - error = nfs_probe_server(server, fh); - if (error < 0) -diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h -index 8870c72416acbd..4eea91d054b241 100644 ---- a/fs/nfs/internal.h -+++ b/fs/nfs/internal.h -@@ -223,7 +223,7 @@ extern struct nfs_client * - nfs4_find_client_sessionid(struct net *, const struct sockaddr *, - struct nfs4_sessionid *, u32); - extern struct nfs_server *nfs_create_server(struct fs_context *); --extern void nfs4_server_set_init_caps(struct nfs_server *); -+extern void nfs_server_set_init_caps(struct nfs_server *); - extern struct nfs_server *nfs4_create_server(struct fs_context *); - extern struct nfs_server *nfs4_create_referral_server(struct fs_context *); - extern int nfs4_update_server(struct nfs_server *server, const char *hostname, -diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c -index ac80f87cb9d996..f6dc42de48f03d 100644 ---- a/fs/nfs/nfs4client.c -+++ b/fs/nfs/nfs4client.c -@@ -1079,24 +1079,6 @@ static void nfs4_session_limit_xasize(struct nfs_server *server) - #endif - } - --void nfs4_server_set_init_caps(struct nfs_server *server) --{ -- /* Set the basic capabilities */ -- server->caps |= server->nfs_client->cl_mvops->init_caps; -- if (server->flags & NFS_MOUNT_NORDIRPLUS) -- server->caps &= ~NFS_CAP_READDIRPLUS; -- if (server->nfs_client->cl_proto == XPRT_TRANSPORT_RDMA) -- server->caps &= ~NFS_CAP_READ_PLUS; -- -- /* -- * Don't use NFS uid/gid mapping if we're using AUTH_SYS or lower -- * authentication. -- */ -- if (nfs4_disable_idmapping && -- server->client->cl_auth->au_flavor == RPC_AUTH_UNIX) -- server->caps |= NFS_CAP_UIDGID_NOMAP; --} -- - static int nfs4_server_common_setup(struct nfs_server *server, - struct nfs_fh *mntfh, bool auth_probe) - { -@@ -1111,7 +1093,7 @@ static int nfs4_server_common_setup(struct nfs_server *server, - if (error < 0) - goto out; - -- nfs4_server_set_init_caps(server); -+ nfs_server_set_init_caps(server); - - /* Probe the root fh to retrieve its FSID and filehandle */ - error = nfs4_get_rootfh(server, mntfh, auth_probe); -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 89d88d37e0cc5c..6debcfc63222d2 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -3951,7 +3951,7 @@ int nfs4_server_capabilities(struct nfs_server *server, struct nfs_fh *fhandle) - }; - int err; - -- nfs4_server_set_init_caps(server); -+ nfs_server_set_init_caps(server); - do { - err = nfs4_handle_exception(server, - _nfs4_server_capabilities(server, fhandle), -diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c -index 79d1ffdcbebd3d..b40c20bd364b04 100644 ---- a/fs/nfs/pnfs.c -+++ b/fs/nfs/pnfs.c -@@ -3216,6 +3216,7 @@ pnfs_layoutcommit_inode(struct inode *inode, bool sync) - struct nfs_inode *nfsi = NFS_I(inode); - loff_t end_pos; - int status; -+ bool mark_as_dirty = false; - - if (!pnfs_layoutcommit_outstanding(inode)) - return 0; -@@ -3267,19 +3268,23 @@ pnfs_layoutcommit_inode(struct inode *inode, bool sync) - if (ld->prepare_layoutcommit) { - status = ld->prepare_layoutcommit(&data->args); - if (status) { -- put_cred(data->cred); -+ if (status != -ENOSPC) -+ put_cred(data->cred); - spin_lock(&inode->i_lock); - set_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags); - if (end_pos > nfsi->layout->plh_lwb) - nfsi->layout->plh_lwb = end_pos; -- goto out_unlock; -+ if (status != -ENOSPC) -+ goto out_unlock; -+ spin_unlock(&inode->i_lock); -+ mark_as_dirty = true; - } - } - - - status = nfs4_proc_layoutcommit(data, sync); - out: -- if (status) -+ if (status || mark_as_dirty) - mark_inode_dirty_sync(inode); - dprintk("<-- %s status %d\n", __func__, status); - return status; -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index e2875706e6bfd7..4aeb08040f3e5a 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -4282,10 +4282,16 @@ nfsd4_setclientid_confirm(struct svc_rqst *rqstp, - } - status = nfs_ok; - if (conf) { -- old = unconf; -- unhash_client_locked(old); -- nfsd4_change_callback(conf, &unconf->cl_cb_conn); -- } else { -+ if (get_client_locked(conf) == nfs_ok) { -+ old = unconf; -+ unhash_client_locked(old); -+ nfsd4_change_callback(conf, &unconf->cl_cb_conn); -+ } else { -+ conf = NULL; -+ } -+ } -+ -+ if (!conf) { - old = find_confirmed_client_by_name(&unconf->cl_name, nn); - if (old) { - status = nfserr_clid_inuse; -@@ -4302,10 +4308,14 @@ nfsd4_setclientid_confirm(struct svc_rqst *rqstp, - } - trace_nfsd_clid_replaced(&old->cl_clientid); - } -+ status = get_client_locked(unconf); -+ if (status != nfs_ok) { -+ old = NULL; -+ goto out; -+ } - move_to_confirmed(unconf); - conf = unconf; - } -- get_client_locked(conf); - spin_unlock(&nn->client_lock); - if (conf == unconf) - fsnotify_dentry(conf->cl_nfsd_info_dentry, FS_MODIFY); -@@ -5765,6 +5775,20 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf - status = nfs4_check_deleg(cl, open, &dp); - if (status) - goto out; -+ if (dp && nfsd4_is_deleg_cur(open) && -+ (dp->dl_stid.sc_file != fp)) { -+ /* -+ * RFC8881 section 8.2.4 mandates the server to return -+ * NFS4ERR_BAD_STATEID if the selected table entry does -+ * not match the current filehandle. However returning -+ * NFS4ERR_BAD_STATEID in the OPEN can cause the client -+ * to repeatedly retry the operation with the same -+ * stateid, since the stateid itself is valid. To avoid -+ * this situation NFSD returns NFS4ERR_INVAL instead. -+ */ -+ status = nfserr_inval; -+ goto out; -+ } - stp = nfsd4_find_and_lock_existing_open(fp, open); - } else { - open->op_file = NULL; -diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c -index e1b856ecce61d0..6b93c909bdc9e4 100644 ---- a/fs/ntfs3/dir.c -+++ b/fs/ntfs3/dir.c -@@ -304,6 +304,9 @@ static inline bool ntfs_dir_emit(struct ntfs_sb_info *sbi, - if (sbi->options->nohidden && (fname->dup.fa & FILE_ATTRIBUTE_HIDDEN)) - return true; - -+ if (fname->name_len + sizeof(struct NTFS_DE) > le16_to_cpu(e->size)) -+ return true; -+ - name_len = ntfs_utf16_to_nls(sbi, fname->name, fname->name_len, name, - PATH_MAX); - if (name_len <= 0) { -diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c -index af7c0cbba74e3d..0150a221020988 100644 ---- a/fs/ntfs3/inode.c -+++ b/fs/ntfs3/inode.c -@@ -1130,10 +1130,10 @@ int inode_write_data(struct inode *inode, const void *data, size_t bytes) - * Number of bytes for REPARSE_DATA_BUFFER(IO_REPARSE_TAG_SYMLINK) - * for unicode string of @uni_len length. - */ --static inline u32 ntfs_reparse_bytes(u32 uni_len) -+static inline u32 ntfs_reparse_bytes(u32 uni_len, bool is_absolute) - { - /* Header + unicode string + decorated unicode string. */ -- return sizeof(short) * (2 * uni_len + 4) + -+ return sizeof(short) * (2 * uni_len + (is_absolute ? 4 : 0)) + - offsetof(struct REPARSE_DATA_BUFFER, - SymbolicLinkReparseBuffer.PathBuffer); - } -@@ -1146,8 +1146,11 @@ ntfs_create_reparse_buffer(struct ntfs_sb_info *sbi, const char *symname, - struct REPARSE_DATA_BUFFER *rp; - __le16 *rp_name; - typeof(rp->SymbolicLinkReparseBuffer) *rs; -+ bool is_absolute; - -- rp = kzalloc(ntfs_reparse_bytes(2 * size + 2), GFP_NOFS); -+ is_absolute = (strlen(symname) > 1 && symname[1] == ':'); -+ -+ rp = kzalloc(ntfs_reparse_bytes(2 * size + 2, is_absolute), GFP_NOFS); - if (!rp) - return ERR_PTR(-ENOMEM); - -@@ -1162,7 +1165,7 @@ ntfs_create_reparse_buffer(struct ntfs_sb_info *sbi, const char *symname, - goto out; - - /* err = the length of unicode name of symlink. */ -- *nsize = ntfs_reparse_bytes(err); -+ *nsize = ntfs_reparse_bytes(err, is_absolute); - - if (*nsize > sbi->reparse.max_size) { - err = -EFBIG; -@@ -1182,7 +1185,7 @@ ntfs_create_reparse_buffer(struct ntfs_sb_info *sbi, const char *symname, - - /* PrintName + SubstituteName. */ - rs->SubstituteNameOffset = cpu_to_le16(sizeof(short) * err); -- rs->SubstituteNameLength = cpu_to_le16(sizeof(short) * err + 8); -+ rs->SubstituteNameLength = cpu_to_le16(sizeof(short) * err + (is_absolute ? 8 : 0)); - rs->PrintNameLength = rs->SubstituteNameOffset; - - /* -@@ -1190,16 +1193,18 @@ ntfs_create_reparse_buffer(struct ntfs_sb_info *sbi, const char *symname, - * parse this path. - * 0-absolute path 1- relative path (SYMLINK_FLAG_RELATIVE). - */ -- rs->Flags = 0; -+ rs->Flags = cpu_to_le32(is_absolute ? 0 : SYMLINK_FLAG_RELATIVE); - -- memmove(rp_name + err + 4, rp_name, sizeof(short) * err); -+ memmove(rp_name + err + (is_absolute ? 4 : 0), rp_name, sizeof(short) * err); - -- /* Decorate SubstituteName. */ -- rp_name += err; -- rp_name[0] = cpu_to_le16('\\'); -- rp_name[1] = cpu_to_le16('?'); -- rp_name[2] = cpu_to_le16('?'); -- rp_name[3] = cpu_to_le16('\\'); -+ if (is_absolute) { -+ /* Decorate SubstituteName. */ -+ rp_name += err; -+ rp_name[0] = cpu_to_le16('\\'); -+ rp_name[1] = cpu_to_le16('?'); -+ rp_name[2] = cpu_to_le16('?'); -+ rp_name[3] = cpu_to_le16('\\'); -+ } - - return rp; - out: -diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c -index b57140ebfad0f7..cd4bfd92ebd6e8 100644 ---- a/fs/orangefs/orangefs-debugfs.c -+++ b/fs/orangefs/orangefs-debugfs.c -@@ -354,7 +354,7 @@ static ssize_t orangefs_debug_read(struct file *file, - goto out; - - mutex_lock(&orangefs_debug_lock); -- sprintf_ret = sprintf(buf, "%s", (char *)file->private_data); -+ sprintf_ret = scnprintf(buf, ORANGEFS_MAX_DEBUG_STRING_LEN, "%s", (char *)file->private_data); - mutex_unlock(&orangefs_debug_lock); - - read_ret = simple_read_from_buffer(ubuf, count, ppos, buf, sprintf_ret); -diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c -index 81d425f571e28d..91f4e50af1e947 100644 ---- a/fs/smb/client/cifssmb.c -+++ b/fs/smb/client/cifssmb.c -@@ -3984,6 +3984,12 @@ CIFSFindFirst(const unsigned int xid, struct cifs_tcon *tcon, - pSMB->FileName[name_len] = 0; - pSMB->FileName[name_len+1] = 0; - name_len += 2; -+ } else if (!searchName[0]) { -+ pSMB->FileName[0] = CIFS_DIR_SEP(cifs_sb); -+ pSMB->FileName[1] = 0; -+ pSMB->FileName[2] = 0; -+ pSMB->FileName[3] = 0; -+ name_len = 4; - } - } else { - name_len = copy_path_name(pSMB->FileName, searchName); -@@ -3995,6 +4001,10 @@ CIFSFindFirst(const unsigned int xid, struct cifs_tcon *tcon, - pSMB->FileName[name_len] = '*'; - pSMB->FileName[name_len+1] = 0; - name_len += 2; -+ } else if (!searchName[0]) { -+ pSMB->FileName[0] = CIFS_DIR_SEP(cifs_sb); -+ pSMB->FileName[1] = 0; -+ name_len = 2; - } - } - -diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c -index 0588896c44567d..986286ef40466d 100644 ---- a/fs/smb/client/connect.c -+++ b/fs/smb/client/connect.c -@@ -3162,18 +3162,15 @@ generic_ip_connect(struct TCP_Server_Info *server) - struct net *net = cifs_net_ns(server); - struct sock *sk; - -- rc = __sock_create(net, sfamily, SOCK_STREAM, -- IPPROTO_TCP, &server->ssocket, 1); -+ rc = sock_create_kern(net, sfamily, SOCK_STREAM, -+ IPPROTO_TCP, &server->ssocket); - if (rc < 0) { - cifs_server_dbg(VFS, "Error %d creating socket\n", rc); - return rc; - } - - sk = server->ssocket->sk; -- __netns_tracker_free(net, &sk->ns_tracker, false); -- sk->sk_net_refcnt = 1; -- get_net_track(net, &sk->ns_tracker, GFP_KERNEL); -- sock_inuse_add(net, 1); -+ sk_net_refcnt_upgrade(sk); - - /* BB other socket options to set KEEPALIVE, NODELAY? */ - cifs_dbg(FYI, "Socket created\n"); -@@ -3998,7 +3995,6 @@ cifs_negotiate_protocol(const unsigned int xid, struct cifs_ses *ses, - return 0; - } - -- server->lstrp = jiffies; - server->tcpStatus = CifsInNegotiate; - server->neg_start = jiffies; - spin_unlock(&server->srv_lock); -diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c -index c351da8c3e2eaf..bbde7180a90ac4 100644 ---- a/fs/smb/client/sess.c -+++ b/fs/smb/client/sess.c -@@ -372,6 +372,7 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) - struct cifs_server_iface *old_iface = NULL; - struct cifs_server_iface *last_iface = NULL; - struct sockaddr_storage ss; -+ int retry = 0; - - spin_lock(&ses->chan_lock); - chan_index = cifs_ses_get_chan_index(ses, server); -@@ -400,6 +401,7 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) - return; - } - -+try_again: - last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface, - iface_head); - iface_min_speed = last_iface->speed; -@@ -437,6 +439,13 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) - } - - if (list_entry_is_head(iface, &ses->iface_list, iface_head)) { -+ list_for_each_entry(iface, &ses->iface_list, iface_head) -+ iface->weight_fulfilled = 0; -+ -+ /* see if it can be satisfied in second attempt */ -+ if (!retry++) -+ goto try_again; -+ - iface = NULL; - cifs_dbg(FYI, "unable to find a suitable iface\n"); - } -diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c -index d0734aa1961a3e..b74f7690473948 100644 ---- a/fs/smb/client/smb2ops.c -+++ b/fs/smb/client/smb2ops.c -@@ -730,6 +730,13 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, - bytes_left -= sizeof(*p); - break; - } -+ /* Validate that Next doesn't point beyond the buffer */ -+ if (next > bytes_left) { -+ cifs_dbg(VFS, "%s: invalid Next pointer %zu > %zd\n", -+ __func__, next, bytes_left); -+ rc = -EINVAL; -+ goto out; -+ } - p = (struct network_interface_info_ioctl_rsp *)((u8 *)p+next); - bytes_left -= next; - } -@@ -741,7 +748,9 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, - } - - /* Azure rounds the buffer size up 8, to a 16 byte boundary */ -- if ((bytes_left > 8) || p->Next) -+ if ((bytes_left > 8) || -+ (bytes_left >= offsetof(struct network_interface_info_ioctl_rsp, Next) -+ + sizeof(p->Next) && p->Next)) - cifs_dbg(VFS, "%s: incomplete interface info\n", __func__); - - ses->iface_last_update = jiffies; -diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c -index 48d020e1f663b5..713bd1dcd39cce 100644 ---- a/fs/smb/client/smbdirect.c -+++ b/fs/smb/client/smbdirect.c -@@ -282,18 +282,20 @@ static void send_done(struct ib_cq *cq, struct ib_wc *wc) - log_rdma_send(INFO, "smbd_request 0x%p completed wc->status=%d\n", - request, wc->status); - -- if (wc->status != IB_WC_SUCCESS || wc->opcode != IB_WC_SEND) { -- log_rdma_send(ERR, "wc->status=%d wc->opcode=%d\n", -- wc->status, wc->opcode); -- smbd_disconnect_rdma_connection(request->info); -- } -- - for (i = 0; i < request->num_sge; i++) - ib_dma_unmap_single(sc->ib.dev, - request->sge[i].addr, - request->sge[i].length, - DMA_TO_DEVICE); - -+ if (wc->status != IB_WC_SUCCESS || wc->opcode != IB_WC_SEND) { -+ log_rdma_send(ERR, "wc->status=%d wc->opcode=%d\n", -+ wc->status, wc->opcode); -+ mempool_free(request, info->request_mempool); -+ smbd_disconnect_rdma_connection(info); -+ return; -+ } -+ - if (atomic_dec_and_test(&request->info->send_pending)) - wake_up(&request->info->wait_send_pending); - -@@ -1336,10 +1338,6 @@ void smbd_destroy(struct TCP_Server_Info *server) - log_rdma_event(INFO, "cancelling idle timer\n"); - cancel_delayed_work_sync(&info->idle_timer_work); - -- log_rdma_event(INFO, "wait for all send posted to IB to finish\n"); -- wait_event(info->wait_send_pending, -- atomic_read(&info->send_pending) == 0); -- - /* It's not possible for upper layer to get to reassembly */ - log_rdma_event(INFO, "drain the reassembly queue\n"); - do { -@@ -2051,7 +2049,11 @@ int smbd_send(struct TCP_Server_Info *server, - */ - - wait_event(info->wait_send_pending, -- atomic_read(&info->send_pending) == 0); -+ atomic_read(&info->send_pending) == 0 || -+ sc->status != SMBDIRECT_SOCKET_CONNECTED); -+ -+ if (sc->status != SMBDIRECT_SOCKET_CONNECTED && rc == 0) -+ rc = -EAGAIN; - - return rc; - } -diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c -index 66b20c3d963eb2..f5ebc200dd7383 100644 ---- a/fs/smb/server/connection.c -+++ b/fs/smb/server/connection.c -@@ -503,7 +503,8 @@ void ksmbd_conn_transport_destroy(void) - { - mutex_lock(&init_lock); - ksmbd_tcp_destroy(); -- ksmbd_rdma_destroy(); -+ ksmbd_rdma_stop_listening(); - stop_sessions(); -+ ksmbd_rdma_destroy(); - mutex_unlock(&init_lock); - } -diff --git a/fs/smb/server/connection.h b/fs/smb/server/connection.h -index c769fe3859b37e..29ba91fc54076c 100644 ---- a/fs/smb/server/connection.h -+++ b/fs/smb/server/connection.h -@@ -45,7 +45,12 @@ struct ksmbd_conn { - struct mutex srv_mutex; - int status; - unsigned int cli_cap; -- __be32 inet_addr; -+ union { -+ __be32 inet_addr; -+#if IS_ENABLED(CONFIG_IPV6) -+ u8 inet6_addr[16]; -+#endif -+ }; - char *request_buf; - struct ksmbd_transport *transport; - struct nls_table *local_nls; -diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c -index e564432643ea30..2a3ef29ac0eb75 100644 ---- a/fs/smb/server/oplock.c -+++ b/fs/smb/server/oplock.c -@@ -1102,8 +1102,10 @@ void smb_send_parent_lease_break_noti(struct ksmbd_file *fp, - if (!atomic_inc_not_zero(&opinfo->refcount)) - continue; - -- if (ksmbd_conn_releasing(opinfo->conn)) -+ if (ksmbd_conn_releasing(opinfo->conn)) { -+ opinfo_put(opinfo); - continue; -+ } - - oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE, NULL); - opinfo_put(opinfo); -@@ -1139,8 +1141,11 @@ void smb_lazy_parent_lease_break_close(struct ksmbd_file *fp) - if (!atomic_inc_not_zero(&opinfo->refcount)) - continue; - -- if (ksmbd_conn_releasing(opinfo->conn)) -+ if (ksmbd_conn_releasing(opinfo->conn)) { -+ opinfo_put(opinfo); - continue; -+ } -+ - oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE, NULL); - opinfo_put(opinfo); - } -@@ -1343,8 +1348,10 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp, - if (!atomic_inc_not_zero(&brk_op->refcount)) - continue; - -- if (ksmbd_conn_releasing(brk_op->conn)) -+ if (ksmbd_conn_releasing(brk_op->conn)) { -+ opinfo_put(brk_op); - continue; -+ } - - if (brk_op->is_lease && (brk_op->o_lease->state & - (~(SMB2_LEASE_READ_CACHING_LE | -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index d3dd3b9b4005c6..85e7bc3a2bd33c 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -6011,7 +6011,6 @@ static int smb2_create_link(struct ksmbd_work *work, - { - char *link_name = NULL, *target_name = NULL, *pathname = NULL; - struct path path, parent_path; -- bool file_present = false; - int rc; - - if (buf_len < (u64)sizeof(struct smb2_file_link_info) + -@@ -6044,11 +6043,8 @@ static int smb2_create_link(struct ksmbd_work *work, - if (rc) { - if (rc != -ENOENT) - goto out; -- } else -- file_present = true; -- -- if (file_info->ReplaceIfExists) { -- if (file_present) { -+ } else { -+ if (file_info->ReplaceIfExists) { - rc = ksmbd_vfs_remove_file(work, &path); - if (rc) { - rc = -EINVAL; -@@ -6056,21 +6052,17 @@ static int smb2_create_link(struct ksmbd_work *work, - link_name); - goto out; - } -- } -- } else { -- if (file_present) { -+ } else { - rc = -EEXIST; - ksmbd_debug(SMB, "link already exists\n"); - goto out; - } -+ ksmbd_vfs_kern_path_unlock(&parent_path, &path); - } -- - rc = ksmbd_vfs_link(work, target_name, link_name); - if (rc) - rc = -EINVAL; - out: -- if (file_present) -- ksmbd_vfs_kern_path_unlock(&parent_path, &path); - - if (!IS_ERR(link_name)) - kfree(link_name); -diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c -index 6c3a57bff14703..a4ff1167c9a123 100644 ---- a/fs/smb/server/transport_rdma.c -+++ b/fs/smb/server/transport_rdma.c -@@ -2193,7 +2193,7 @@ int ksmbd_rdma_init(void) - return 0; - } - --void ksmbd_rdma_destroy(void) -+void ksmbd_rdma_stop_listening(void) - { - if (!smb_direct_listener.cm_id) - return; -@@ -2202,7 +2202,10 @@ void ksmbd_rdma_destroy(void) - rdma_destroy_id(smb_direct_listener.cm_id); - - smb_direct_listener.cm_id = NULL; -+} - -+void ksmbd_rdma_destroy(void) -+{ - if (smb_direct_wq) { - destroy_workqueue(smb_direct_wq); - smb_direct_wq = NULL; -diff --git a/fs/smb/server/transport_rdma.h b/fs/smb/server/transport_rdma.h -index 77aee4e5c9dcd8..a2291b77488a15 100644 ---- a/fs/smb/server/transport_rdma.h -+++ b/fs/smb/server/transport_rdma.h -@@ -54,13 +54,15 @@ struct smb_direct_data_transfer { - - #ifdef CONFIG_SMB_SERVER_SMBDIRECT - int ksmbd_rdma_init(void); -+void ksmbd_rdma_stop_listening(void); - void ksmbd_rdma_destroy(void); - bool ksmbd_rdma_capable_netdev(struct net_device *netdev); - void init_smbd_max_io_size(unsigned int sz); - unsigned int get_smbd_max_read_write_size(void); - #else - static inline int ksmbd_rdma_init(void) { return 0; } --static inline int ksmbd_rdma_destroy(void) { return 0; } -+static inline void ksmbd_rdma_stop_listening(void) { } -+static inline void ksmbd_rdma_destroy(void) { } - static inline bool ksmbd_rdma_capable_netdev(struct net_device *netdev) { return false; } - static inline void init_smbd_max_io_size(unsigned int sz) { } - static inline unsigned int get_smbd_max_read_write_size(void) { return 0; } -diff --git a/fs/smb/server/transport_tcp.c b/fs/smb/server/transport_tcp.c -index e86bc4a460687a..53c536f2ce9f9c 100644 ---- a/fs/smb/server/transport_tcp.c -+++ b/fs/smb/server/transport_tcp.c -@@ -87,7 +87,14 @@ static struct tcp_transport *alloc_transport(struct socket *client_sk) - return NULL; - } - -+#if IS_ENABLED(CONFIG_IPV6) -+ if (client_sk->sk->sk_family == AF_INET6) -+ memcpy(&conn->inet6_addr, &client_sk->sk->sk_v6_daddr, 16); -+ else -+ conn->inet_addr = inet_sk(client_sk->sk)->inet_daddr; -+#else - conn->inet_addr = inet_sk(client_sk->sk)->inet_daddr; -+#endif - conn->transport = KSMBD_TRANS(t); - KSMBD_TRANS(t)->conn = conn; - KSMBD_TRANS(t)->ops = &ksmbd_tcp_transport_ops; -@@ -231,7 +238,6 @@ static int ksmbd_kthread_fn(void *p) - { - struct socket *client_sk = NULL; - struct interface *iface = (struct interface *)p; -- struct inet_sock *csk_inet; - struct ksmbd_conn *conn; - int ret; - -@@ -254,13 +260,27 @@ static int ksmbd_kthread_fn(void *p) - /* - * Limits repeated connections from clients with the same IP. - */ -- csk_inet = inet_sk(client_sk->sk); - down_read(&conn_list_lock); - list_for_each_entry(conn, &conn_list, conns_list) -- if (csk_inet->inet_daddr == conn->inet_addr) { -+#if IS_ENABLED(CONFIG_IPV6) -+ if (client_sk->sk->sk_family == AF_INET6) { -+ if (memcmp(&client_sk->sk->sk_v6_daddr, -+ &conn->inet6_addr, 16) == 0) { -+ ret = -EAGAIN; -+ break; -+ } -+ } else if (inet_sk(client_sk->sk)->inet_daddr == -+ conn->inet_addr) { -+ ret = -EAGAIN; -+ break; -+ } -+#else -+ if (inet_sk(client_sk->sk)->inet_daddr == -+ conn->inet_addr) { - ret = -EAGAIN; - break; - } -+#endif - up_read(&conn_list_lock); - if (ret == -EAGAIN) - continue; -diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c -index 3a27d4268b3c4a..494d21777ed00b 100644 ---- a/fs/squashfs/super.c -+++ b/fs/squashfs/super.c -@@ -187,10 +187,15 @@ static int squashfs_fill_super(struct super_block *sb, struct fs_context *fc) - unsigned short flags; - unsigned int fragments; - u64 lookup_table_start, xattr_id_table_start, next_table; -- int err; -+ int err, devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); - - TRACE("Entered squashfs_fill_superblock\n"); - -+ if (!devblksize) { -+ errorf(fc, "squashfs: unable to set blocksize\n"); -+ return -EINVAL; -+ } -+ - sb->s_fs_info = kzalloc(sizeof(*msblk), GFP_KERNEL); - if (sb->s_fs_info == NULL) { - ERROR("Failed to allocate squashfs_sb_info\n"); -@@ -201,12 +206,7 @@ static int squashfs_fill_super(struct super_block *sb, struct fs_context *fc) - - msblk->panic_on_errors = (opts->errors == Opt_errors_panic); - -- msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); -- if (!msblk->devblksize) { -- errorf(fc, "squashfs: unable to set blocksize\n"); -- return -EINVAL; -- } -- -+ msblk->devblksize = devblksize; - msblk->devblksize_log2 = ffz(~msblk->devblksize); - - mutex_init(&msblk->meta_index_mutex); -diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c -index 7d389dd5ed5195..6b70965063d739 100644 ---- a/fs/tracefs/inode.c -+++ b/fs/tracefs/inode.c -@@ -483,9 +483,20 @@ static int tracefs_d_revalidate(struct dentry *dentry, unsigned int flags) - return !(ei && ei->is_freed); - } - -+static int tracefs_d_delete(const struct dentry *dentry) -+{ -+ /* -+ * We want to keep eventfs dentries around but not tracefs -+ * ones. eventfs dentries have content in d_fsdata. -+ * Use d_fsdata to determine if it's a eventfs dentry or not. -+ */ -+ return dentry->d_fsdata == NULL; -+} -+ - static const struct dentry_operations tracefs_dentry_operations = { - .d_revalidate = tracefs_d_revalidate, - .d_release = tracefs_d_release, -+ .d_delete = tracefs_d_delete, - }; - - static int trace_fill_super(struct super_block *sb, void *data, int silent) -diff --git a/fs/udf/super.c b/fs/udf/super.c -index 20dff9ed2471da..cb13a07a4aa852 100644 ---- a/fs/udf/super.c -+++ b/fs/udf/super.c -@@ -1409,7 +1409,7 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block, - struct genericPartitionMap *gpm; - uint16_t ident; - struct buffer_head *bh; -- unsigned int table_len; -+ unsigned int table_len, part_map_count; - int ret; - - bh = udf_read_tagged(sb, block, block, &ident); -@@ -1430,7 +1430,16 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block, - "logical volume"); - if (ret) - goto out_bh; -- ret = udf_sb_alloc_partition_maps(sb, le32_to_cpu(lvd->numPartitionMaps)); -+ -+ part_map_count = le32_to_cpu(lvd->numPartitionMaps); -+ if (part_map_count > table_len / sizeof(struct genericPartitionMap1)) { -+ udf_err(sb, "error loading logical volume descriptor: " -+ "Too many partition maps (%u > %u)\n", part_map_count, -+ table_len / (unsigned)sizeof(struct genericPartitionMap1)); -+ ret = -EIO; -+ goto out_bh; -+ } -+ ret = udf_sb_alloc_partition_maps(sb, part_map_count); - if (ret) - goto out_bh; - -diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c -index f5377ba5967a7a..68af6ae3b5d5b8 100644 ---- a/fs/xfs/xfs_itable.c -+++ b/fs/xfs/xfs_itable.c -@@ -422,11 +422,15 @@ xfs_inumbers( - .breq = breq, - }; - struct xfs_trans *tp; -+ unsigned int iwalk_flags = 0; - int error = 0; - - if (xfs_bulkstat_already_done(breq->mp, breq->startino)) - return 0; - -+ if (breq->flags & XFS_IBULK_SAME_AG) -+ iwalk_flags |= XFS_IWALK_SAME_AG; -+ - /* - * Grab an empty transaction so that we can use its recursive buffer - * locking abilities to detect cycles in the inobt without deadlocking. -@@ -435,7 +439,7 @@ xfs_inumbers( - if (error) - goto out; - -- error = xfs_inobt_walk(breq->mp, tp, breq->startino, breq->flags, -+ error = xfs_inobt_walk(breq->mp, tp, breq->startino, iwalk_flags, - xfs_inumbers_walk, breq->icount, &ic); - xfs_trans_cancel(tp); - out: -diff --git a/include/linux/arch_topology.h b/include/linux/arch_topology.h -index a07b510e7dc559..a63d61ca55afc8 100644 ---- a/include/linux/arch_topology.h -+++ b/include/linux/arch_topology.h -@@ -27,6 +27,13 @@ static inline unsigned long topology_get_cpu_scale(int cpu) - - void topology_set_cpu_scale(unsigned int cpu, unsigned long capacity); - -+DECLARE_PER_CPU(unsigned long, capacity_freq_ref); -+ -+static inline unsigned long topology_get_freq_ref(int cpu) -+{ -+ return per_cpu(capacity_freq_ref, cpu); -+} -+ - DECLARE_PER_CPU(unsigned long, arch_freq_scale); - - static inline unsigned long topology_get_freq_scale(int cpu) -@@ -92,6 +99,7 @@ void update_siblings_masks(unsigned int cpu); - void remove_cpu_topology(unsigned int cpuid); - void reset_cpu_topology(void); - int parse_acpi_topology(void); -+void freq_inv_set_max_ratio(int cpu, u64 max_rate); - #endif - - #endif /* _LINUX_ARCH_TOPOLOGY_H_ */ -diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h -index 92c8997b193816..b9c0b3281ace16 100644 ---- a/include/linux/blk_types.h -+++ b/include/linux/blk_types.h -@@ -379,6 +379,8 @@ enum req_op { - REQ_OP_DISCARD = (__force blk_opf_t)3, - /* securely erase sectors */ - REQ_OP_SECURE_ERASE = (__force blk_opf_t)5, -+ /* write data at the current zone write pointer */ -+ REQ_OP_ZONE_APPEND = (__force blk_opf_t)7, - /* write the zero filled sector many times */ - REQ_OP_WRITE_ZEROES = (__force blk_opf_t)9, - /* Open a zone */ -@@ -386,9 +388,7 @@ enum req_op { - /* Close a zone */ - REQ_OP_ZONE_CLOSE = (__force blk_opf_t)11, - /* Transition a zone to full */ -- REQ_OP_ZONE_FINISH = (__force blk_opf_t)12, -- /* write data at the current zone write pointer */ -- REQ_OP_ZONE_APPEND = (__force blk_opf_t)13, -+ REQ_OP_ZONE_FINISH = (__force blk_opf_t)13, - /* reset a zone write pointer */ - REQ_OP_ZONE_RESET = (__force blk_opf_t)15, - /* reset all the zone present on the device */ -diff --git a/include/linux/compiler.h b/include/linux/compiler.h -index 5a4054f17cbc68..e84ed3a43f1f80 100644 ---- a/include/linux/compiler.h -+++ b/include/linux/compiler.h -@@ -234,14 +234,6 @@ static inline void *offset_to_ptr(const int *off) - #define __ADDRESSABLE(sym) \ - ___ADDRESSABLE(sym, __section(".discard.addressable")) - --#define __ADDRESSABLE_ASM(sym) \ -- .pushsection .discard.addressable,"aw"; \ -- .align ARCH_SEL(8,4); \ -- ARCH_SEL(.quad, .long) __stringify(sym); \ -- .popsection; -- --#define __ADDRESSABLE_ASM_STR(sym) __stringify(__ADDRESSABLE_ASM(sym)) -- - /* &a[0] degrades to a pointer: a different type from an array */ - #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0])) - -diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h -index 184a84dd467ec7..bfecd9dcb55297 100644 ---- a/include/linux/cpufreq.h -+++ b/include/linux/cpufreq.h -@@ -1245,6 +1245,7 @@ void arch_set_freq_scale(const struct cpumask *cpus, - { - } - #endif -+ - /* the following are really really optional */ - extern struct freq_attr cpufreq_freq_attr_scaling_available_freqs; - extern struct freq_attr cpufreq_freq_attr_scaling_boost_freqs; -diff --git a/include/linux/energy_model.h b/include/linux/energy_model.h -index adec808b371a11..88d91e08747187 100644 ---- a/include/linux/energy_model.h -+++ b/include/linux/energy_model.h -@@ -224,7 +224,7 @@ static inline unsigned long em_cpu_energy(struct em_perf_domain *pd, - unsigned long max_util, unsigned long sum_util, - unsigned long allowed_cpu_cap) - { -- unsigned long freq, scale_cpu; -+ unsigned long freq, ref_freq, scale_cpu; - struct em_perf_state *ps; - int cpu; - -@@ -241,10 +241,10 @@ static inline unsigned long em_cpu_energy(struct em_perf_domain *pd, - */ - cpu = cpumask_first(to_cpumask(pd->cpus)); - scale_cpu = arch_scale_cpu_capacity(cpu); -- ps = &pd->table[pd->nr_perf_states - 1]; -+ ref_freq = arch_scale_freq_ref(cpu); - - max_util = min(max_util, allowed_cpu_cap); -- freq = map_util_freq(max_util, ps->frequency, scale_cpu); -+ freq = map_util_freq(max_util, ref_freq, scale_cpu); - - /* - * Find the lowest performance state of the Energy Model above the -diff --git a/include/linux/fs.h b/include/linux/fs.h -index b641a01512fb09..4cdeeaedaa404f 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -456,7 +456,7 @@ extern const struct address_space_operations empty_aops; - * It is also used to block modification of page cache contents through - * memory mappings. - * @gfp_mask: Memory allocation flags to use for allocating pages. -- * @i_mmap_writable: Number of VM_SHARED mappings. -+ * @i_mmap_writable: Number of VM_SHARED, VM_MAYWRITE mappings. - * @nr_thps: Number of THPs in the pagecache (non-shmem only). - * @i_mmap: Tree of private and shared mappings. - * @i_mmap_rwsem: Protects @i_mmap and @i_mmap_writable. -@@ -559,7 +559,7 @@ static inline int mapping_mapped(struct address_space *mapping) - - /* - * Might pages of this file have been modified in userspace? -- * Note that i_mmap_writable counts all VM_SHARED vmas: do_mmap -+ * Note that i_mmap_writable counts all VM_SHARED, VM_MAYWRITE vmas: do_mmap - * marks vma as VM_SHARED if it is shared, and the file was opened for - * writing i.e. vma may be mprotected writable even if now readonly. - * -diff --git a/include/linux/hypervisor.h b/include/linux/hypervisor.h -index 9efbc54e35e596..be5417303ecf69 100644 ---- a/include/linux/hypervisor.h -+++ b/include/linux/hypervisor.h -@@ -37,6 +37,9 @@ static inline bool hypervisor_isolated_pci_functions(void) - if (IS_ENABLED(CONFIG_S390)) - return true; - -+ if (IS_ENABLED(CONFIG_LOONGARCH)) -+ return true; -+ - return jailhouse_paravirt(); - } - -diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h -index 430749a0f362aa..272d9ad739607e 100644 ---- a/include/linux/if_vlan.h -+++ b/include/linux/if_vlan.h -@@ -79,11 +79,6 @@ static inline struct vlan_ethhdr *skb_vlan_eth_hdr(const struct sk_buff *skb) - /* found in socket.c */ - extern void vlan_ioctl_set(int (*hook)(struct net *, void __user *)); - --static inline bool is_vlan_dev(const struct net_device *dev) --{ -- return dev->priv_flags & IFF_802_1Q_VLAN; --} -- - #define skb_vlan_tag_present(__skb) (!!(__skb)->vlan_all) - #define skb_vlan_tag_get(__skb) ((__skb)->vlan_tci) - #define skb_vlan_tag_get_id(__skb) ((__skb)->vlan_tci & VLAN_VID_MASK) -@@ -199,6 +194,11 @@ struct vlan_dev_priv { - #endif - }; - -+static inline bool is_vlan_dev(const struct net_device *dev) -+{ -+ return dev->priv_flags & IFF_802_1Q_VLAN; -+} -+ - static inline struct vlan_dev_priv *vlan_dev_priv(const struct net_device *dev) - { - return netdev_priv(dev); -@@ -236,6 +236,11 @@ extern void vlan_vids_del_by_dev(struct net_device *dev, - extern bool vlan_uses_dev(const struct net_device *dev); - - #else -+static inline bool is_vlan_dev(const struct net_device *dev) -+{ -+ return false; -+} -+ - static inline struct net_device * - __vlan_find_dev_deep_rcu(struct net_device *real_dev, - __be16 vlan_proto, u16 vlan_id) -@@ -253,19 +258,19 @@ vlan_for_each(struct net_device *dev, - - static inline struct net_device *vlan_dev_real_dev(const struct net_device *dev) - { -- BUG(); -+ WARN_ON_ONCE(1); - return NULL; - } - - static inline u16 vlan_dev_vlan_id(const struct net_device *dev) - { -- BUG(); -+ WARN_ON_ONCE(1); - return 0; - } - - static inline __be16 vlan_dev_vlan_proto(const struct net_device *dev) - { -- BUG(); -+ WARN_ON_ONCE(1); - return 0; - } - -diff --git a/include/linux/iosys-map.h b/include/linux/iosys-map.h -index cb71aa616bd37f..631d58d0b83850 100644 ---- a/include/linux/iosys-map.h -+++ b/include/linux/iosys-map.h -@@ -264,12 +264,7 @@ static inline bool iosys_map_is_set(const struct iosys_map *map) - */ - static inline void iosys_map_clear(struct iosys_map *map) - { -- if (map->is_iomem) { -- map->vaddr_iomem = NULL; -- map->is_iomem = false; -- } else { -- map->vaddr = NULL; -- } -+ memset(map, 0, sizeof(*map)); - } - - /** -diff --git a/include/linux/memfd.h b/include/linux/memfd.h -index e7abf6fa4c5223..40cc726a8a0ce4 100644 ---- a/include/linux/memfd.h -+++ b/include/linux/memfd.h -@@ -6,11 +6,25 @@ - - #ifdef CONFIG_MEMFD_CREATE - extern long memfd_fcntl(struct file *file, unsigned int cmd, unsigned int arg); -+unsigned int *memfd_file_seals_ptr(struct file *file); - #else - static inline long memfd_fcntl(struct file *f, unsigned int c, unsigned int a) - { - return -EINVAL; - } -+ -+static inline unsigned int *memfd_file_seals_ptr(struct file *file) -+{ -+ return NULL; -+} - #endif - -+/* Retrieve memfd seals associated with the file, if any. */ -+static inline unsigned int memfd_file_seals(struct file *file) -+{ -+ unsigned int *sealsp = memfd_file_seals_ptr(file); -+ -+ return sealsp ? *sealsp : 0; -+} -+ - #endif /* __LINUX_MEMFD_H */ -diff --git a/include/linux/mm.h b/include/linux/mm.h -index ee26e37daa0a80..b97d8a691b28bf 100644 ---- a/include/linux/mm.h -+++ b/include/linux/mm.h -@@ -941,6 +941,17 @@ static inline bool vma_is_accessible(struct vm_area_struct *vma) - return vma->vm_flags & VM_ACCESS_FLAGS; - } - -+static inline bool is_shared_maywrite(vm_flags_t vm_flags) -+{ -+ return (vm_flags & (VM_SHARED | VM_MAYWRITE)) == -+ (VM_SHARED | VM_MAYWRITE); -+} -+ -+static inline bool vma_is_shared_maywrite(struct vm_area_struct *vma) -+{ -+ return is_shared_maywrite(vma->vm_flags); -+} -+ - static inline - struct vm_area_struct *vma_find(struct vma_iterator *vmi, unsigned long max) - { -@@ -4011,34 +4022,57 @@ void mem_dump_obj(void *object); - static inline void mem_dump_obj(void *object) {} - #endif - -+static inline bool is_write_sealed(int seals) -+{ -+ return seals & (F_SEAL_WRITE | F_SEAL_FUTURE_WRITE); -+} -+ -+/** -+ * is_readonly_sealed - Checks whether write-sealed but mapped read-only, -+ * in which case writes should be disallowing moving -+ * forwards. -+ * @seals: the seals to check -+ * @vm_flags: the VMA flags to check -+ * -+ * Returns whether readonly sealed, in which case writess should be disallowed -+ * going forward. -+ */ -+static inline bool is_readonly_sealed(int seals, vm_flags_t vm_flags) -+{ -+ /* -+ * Since an F_SEAL_[FUTURE_]WRITE sealed memfd can be mapped as -+ * MAP_SHARED and read-only, take care to not allow mprotect to -+ * revert protections on such mappings. Do this only for shared -+ * mappings. For private mappings, don't need to mask -+ * VM_MAYWRITE as we still want them to be COW-writable. -+ */ -+ if (is_write_sealed(seals) && -+ ((vm_flags & (VM_SHARED | VM_WRITE)) == VM_SHARED)) -+ return true; -+ -+ return false; -+} -+ - /** -- * seal_check_future_write - Check for F_SEAL_FUTURE_WRITE flag and handle it -+ * seal_check_write - Check for F_SEAL_WRITE or F_SEAL_FUTURE_WRITE flags and -+ * handle them. - * @seals: the seals to check - * @vma: the vma to operate on - * -- * Check whether F_SEAL_FUTURE_WRITE is set; if so, do proper check/handling on -- * the vma flags. Return 0 if check pass, or <0 for errors. -- */ --static inline int seal_check_future_write(int seals, struct vm_area_struct *vma) --{ -- if (seals & F_SEAL_FUTURE_WRITE) { -- /* -- * New PROT_WRITE and MAP_SHARED mmaps are not allowed when -- * "future write" seal active. -- */ -- if ((vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_WRITE)) -- return -EPERM; -- -- /* -- * Since an F_SEAL_FUTURE_WRITE sealed memfd can be mapped as -- * MAP_SHARED and read-only, take care to not allow mprotect to -- * revert protections on such mappings. Do this only for shared -- * mappings. For private mappings, don't need to mask -- * VM_MAYWRITE as we still want them to be COW-writable. -- */ -- if (vma->vm_flags & VM_SHARED) -- vm_flags_clear(vma, VM_MAYWRITE); -- } -+ * Check whether F_SEAL_WRITE or F_SEAL_FUTURE_WRITE are set; if so, do proper -+ * check/handling on the vma flags. Return 0 if check pass, or <0 for errors. -+ */ -+static inline int seal_check_write(int seals, struct vm_area_struct *vma) -+{ -+ if (!is_write_sealed(seals)) -+ return 0; -+ -+ /* -+ * New PROT_WRITE and MAP_SHARED mmaps are not allowed when -+ * write seals are active. -+ */ -+ if ((vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_WRITE)) -+ return -EPERM; - - return 0; - } -diff --git a/include/linux/pci.h b/include/linux/pci.h -index 2d1fb935a8c86a..ac5bd1718af241 100644 ---- a/include/linux/pci.h -+++ b/include/linux/pci.h -@@ -318,7 +318,14 @@ struct pci_sriov; - struct pci_p2pdma; - struct rcec_ea; - --/* The pci_dev structure describes PCI devices */ -+/* struct pci_dev - describes a PCI device -+ * -+ * @is_hotplug_bridge: Hotplug bridge of any kind (e.g. PCIe Hot-Plug Capable, -+ * Conventional PCI Hot-Plug, ACPI slot). -+ * Such bridges are allocated additional MMIO and bus -+ * number resources to allow for hierarchy expansion. -+ * @is_pciehp: PCIe Hot-Plug Capable bridge. -+ */ - struct pci_dev { - struct list_head bus_list; /* Node in per-bus list */ - struct pci_bus *bus; /* Bus this device is on */ -@@ -439,6 +446,7 @@ struct pci_dev { - unsigned int is_physfn:1; - unsigned int is_virtfn:1; - unsigned int is_hotplug_bridge:1; -+ unsigned int is_pciehp:1; - unsigned int shpc_managed:1; /* SHPC owned by shpchp */ - unsigned int is_thunderbolt:1; /* Thunderbolt controller */ - /* -diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h -index 406855d73901a4..4b74f0f012a59f 100644 ---- a/include/linux/pm_runtime.h -+++ b/include/linux/pm_runtime.h -@@ -73,7 +73,8 @@ extern int pm_runtime_force_resume(struct device *dev); - extern int __pm_runtime_idle(struct device *dev, int rpmflags); - extern int __pm_runtime_suspend(struct device *dev, int rpmflags); - extern int __pm_runtime_resume(struct device *dev, int rpmflags); --extern int pm_runtime_get_if_active(struct device *dev, bool ign_usage_count); -+extern int pm_runtime_get_if_active(struct device *dev); -+extern int pm_runtime_get_if_in_use(struct device *dev); - extern int pm_schedule_suspend(struct device *dev, unsigned int delay); - extern int __pm_runtime_set_status(struct device *dev, unsigned int status); - extern int pm_runtime_barrier(struct device *dev); -@@ -95,18 +96,6 @@ extern void pm_runtime_release_supplier(struct device_link *link); - - extern int devm_pm_runtime_enable(struct device *dev); - --/** -- * pm_runtime_get_if_in_use - Conditionally bump up runtime PM usage counter. -- * @dev: Target device. -- * -- * Increment the runtime PM usage counter of @dev if its runtime PM status is -- * %RPM_ACTIVE and its runtime PM usage counter is greater than 0. -- */ --static inline int pm_runtime_get_if_in_use(struct device *dev) --{ -- return pm_runtime_get_if_active(dev, false); --} -- - /** - * pm_suspend_ignore_children - Set runtime PM behavior regarding children. - * @dev: Target device. -@@ -277,8 +266,7 @@ static inline int pm_runtime_get_if_in_use(struct device *dev) - { - return -EINVAL; - } --static inline int pm_runtime_get_if_active(struct device *dev, -- bool ign_usage_count) -+static inline int pm_runtime_get_if_active(struct device *dev) - { - return -EINVAL; - } -diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h -index 67b573d5bf28f2..9671b7234684ae 100644 ---- a/include/linux/sched/topology.h -+++ b/include/linux/sched/topology.h -@@ -275,6 +275,14 @@ void arch_update_thermal_pressure(const struct cpumask *cpus, - { } - #endif - -+#ifndef arch_scale_freq_ref -+static __always_inline -+unsigned int arch_scale_freq_ref(int cpu) -+{ -+ return 0; -+} -+#endif -+ - static inline int task_node(const struct task_struct *p) - { - return cpu_to_node(task_cpu(p)); -diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h -index 7b7222b4f6111d..3a558a3c2cca8a 100644 ---- a/include/linux/skbuff.h -+++ b/include/linux/skbuff.h -@@ -3556,7 +3556,13 @@ static inline void *skb_frag_address(const skb_frag_t *frag) - */ - static inline void *skb_frag_address_safe(const skb_frag_t *frag) - { -- void *ptr = page_address(skb_frag_page(frag)); -+ struct page *page = skb_frag_page(frag); -+ void *ptr; -+ -+ if (!page) -+ return NULL; -+ -+ ptr = page_address(page); - if (unlikely(!ptr)) - return NULL; - -diff --git a/include/linux/usb/cdc_ncm.h b/include/linux/usb/cdc_ncm.h -index 2d207cb4837dbf..4ac082a6317381 100644 ---- a/include/linux/usb/cdc_ncm.h -+++ b/include/linux/usb/cdc_ncm.h -@@ -119,6 +119,7 @@ struct cdc_ncm_ctx { - u32 timer_interval; - u32 max_ndp_size; - u8 is_ndp16; -+ u8 filtering_supported; - union { - struct usb_cdc_ncm_ndp16 *delayed_ndp16; - struct usb_cdc_ncm_ndp32 *delayed_ndp32; -diff --git a/include/linux/virtio_vsock.h b/include/linux/virtio_vsock.h -index fbf30721bac9e5..5148b035a8f387 100644 ---- a/include/linux/virtio_vsock.h -+++ b/include/linux/virtio_vsock.h -@@ -110,7 +110,12 @@ static inline size_t virtio_vsock_skb_len(struct sk_buff *skb) - return (size_t)(skb_end_pointer(skb) - skb->head); - } - --#define VIRTIO_VSOCK_DEFAULT_RX_BUF_SIZE (1024 * 4) -+/* Dimension the RX SKB so that the entire thing fits exactly into -+ * a single 4KiB page. This avoids wasting memory due to alloc_skb() -+ * rounding up to the next page order and also means that we -+ * don't leave higher-order pages sitting around in the RX queue. -+ */ -+#define VIRTIO_VSOCK_DEFAULT_RX_BUF_SIZE SKB_WITH_OVERHEAD(1024 * 4) - #define VIRTIO_VSOCK_MAX_BUF_SIZE 0xFFFFFFFFUL - #define VIRTIO_VSOCK_MAX_PKT_BUF_SIZE (1024 * 64) - -diff --git a/include/net/bond_3ad.h b/include/net/bond_3ad.h -index c5e57c6bd87367..078e16d2512a55 100644 ---- a/include/net/bond_3ad.h -+++ b/include/net/bond_3ad.h -@@ -54,6 +54,8 @@ typedef enum { - AD_MUX_DETACHED, /* mux machine */ - AD_MUX_WAITING, /* mux machine */ - AD_MUX_ATTACHED, /* mux machine */ -+ AD_MUX_COLLECTING, /* mux machine */ -+ AD_MUX_DISTRIBUTING, /* mux machine */ - AD_MUX_COLLECTING_DISTRIBUTING /* mux machine */ - } mux_states_t; - -@@ -302,6 +304,7 @@ int bond_3ad_lacpdu_recv(const struct sk_buff *skb, struct bonding *bond, - struct slave *slave); - int bond_3ad_set_carrier(struct bonding *bond); - void bond_3ad_update_lacp_rate(struct bonding *bond); -+void bond_3ad_update_lacp_active(struct bonding *bond); - void bond_3ad_update_ad_actor_settings(struct bonding *bond); - int bond_3ad_stats_fill(struct sk_buff *skb, struct bond_3ad_stats *stats); - size_t bond_3ad_stats_size(void); -diff --git a/include/net/bond_options.h b/include/net/bond_options.h -index f631d9f099410c..18687ccf063830 100644 ---- a/include/net/bond_options.h -+++ b/include/net/bond_options.h -@@ -76,6 +76,7 @@ enum { - BOND_OPT_MISSED_MAX, - BOND_OPT_NS_TARGETS, - BOND_OPT_PRIO, -+ BOND_OPT_COUPLED_CONTROL, - BOND_OPT_LAST - }; - -diff --git a/include/net/bonding.h b/include/net/bonding.h -index 94594026a5c554..8bb5f016969f10 100644 ---- a/include/net/bonding.h -+++ b/include/net/bonding.h -@@ -148,6 +148,7 @@ struct bond_params { - #if IS_ENABLED(CONFIG_IPV6) - struct in6_addr ns_targets[BOND_MAX_NS_TARGETS]; - #endif -+ int coupled_control; - - /* 2 bytes of padding : see ether_addr_equal_64bits() */ - u8 ad_actor_system[ETH_ALEN + 2]; -@@ -167,6 +168,7 @@ struct slave { - u8 backup:1, /* indicates backup slave. Value corresponds with - BOND_STATE_ACTIVE and BOND_STATE_BACKUP */ - inactive:1, /* indicates inactive slave */ -+ rx_disabled:1, /* indicates whether slave's Rx is disabled */ - should_notify:1, /* indicates whether the state changed */ - should_notify_link:1; /* indicates whether the link changed */ - u8 duplex; -@@ -568,6 +570,14 @@ static inline void bond_set_slave_inactive_flags(struct slave *slave, - bond_set_slave_state(slave, BOND_STATE_BACKUP, notify); - if (!slave->bond->params.all_slaves_active) - slave->inactive = 1; -+ if (BOND_MODE(slave->bond) == BOND_MODE_8023AD) -+ slave->rx_disabled = 1; -+} -+ -+static inline void bond_set_slave_tx_disabled_flags(struct slave *slave, -+ bool notify) -+{ -+ bond_set_slave_state(slave, BOND_STATE_BACKUP, notify); - } - - static inline void bond_set_slave_active_flags(struct slave *slave, -@@ -575,6 +585,14 @@ static inline void bond_set_slave_active_flags(struct slave *slave, - { - bond_set_slave_state(slave, BOND_STATE_ACTIVE, notify); - slave->inactive = 0; -+ if (BOND_MODE(slave->bond) == BOND_MODE_8023AD) -+ slave->rx_disabled = 0; -+} -+ -+static inline void bond_set_slave_rx_enabled_flags(struct slave *slave, -+ bool notify) -+{ -+ slave->rx_disabled = 0; - } - - static inline bool bond_is_slave_inactive(struct slave *slave) -@@ -582,6 +600,11 @@ static inline bool bond_is_slave_inactive(struct slave *slave) - return slave->inactive; - } - -+static inline bool bond_is_slave_rx_disabled(struct slave *slave) -+{ -+ return slave->rx_disabled; -+} -+ - static inline void bond_propose_link_state(struct slave *slave, int state) - { - slave->link_new_state = state; -diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h -index 2fb3151ea7c9e9..5b3a63c377d60b 100644 ---- a/include/net/cfg80211.h -+++ b/include/net/cfg80211.h -@@ -559,7 +559,7 @@ ieee80211_get_sband_iftype_data(const struct ieee80211_supported_band *sband, - { - int i; - -- if (WARN_ON(iftype >= NL80211_IFTYPE_MAX)) -+ if (WARN_ON(iftype >= NUM_NL80211_IFTYPES)) - return NULL; - - if (iftype == NL80211_IFTYPE_AP_VLAN) -diff --git a/include/net/mac80211.h b/include/net/mac80211.h -index 835a58ce9ca57c..adaa1b2323d2c4 100644 ---- a/include/net/mac80211.h -+++ b/include/net/mac80211.h -@@ -4111,6 +4111,8 @@ struct ieee80211_prep_tx_info { - * @mgd_complete_tx: Notify the driver that the response frame for a previously - * transmitted frame announced with @mgd_prepare_tx was received, the data - * is filled similarly to @mgd_prepare_tx though the duration is not used. -+ * Note that this isn't always called for each mgd_prepare_tx() call, for -+ * example for SAE the 'confirm' messages can be on the air in any order. - * - * @mgd_protect_tdls_discover: Protect a TDLS discovery session. After sending - * a TDLS discovery-request, we expect a reply to arrive on the AP's -diff --git a/include/net/neighbour.h b/include/net/neighbour.h -index 0d28172193fa63..d775906a65c75c 100644 ---- a/include/net/neighbour.h -+++ b/include/net/neighbour.h -@@ -180,6 +180,7 @@ struct pneigh_entry { - netdevice_tracker dev_tracker; - u32 flags; - u8 protocol; -+ bool permanent; - u32 key[]; - }; - -diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h -index ce3f84c6eb8eb3..5ddcadee62b766 100644 ---- a/include/net/net_namespace.h -+++ b/include/net/net_namespace.h -@@ -293,6 +293,7 @@ static inline int check_net(const struct net *net) - } - - void net_drop_ns(void *); -+void net_passive_dec(struct net *net); - - #else - -@@ -322,8 +323,23 @@ static inline int check_net(const struct net *net) - } - - #define net_drop_ns NULL -+ -+static inline void net_passive_dec(struct net *net) -+{ -+ refcount_dec(&net->passive); -+} - #endif - -+static inline void net_passive_inc(struct net *net) -+{ -+ refcount_inc(&net->passive); -+} -+ -+/* Returns true if the netns initialization is completed successfully */ -+static inline bool net_initialized(const struct net *net) -+{ -+ return READ_ONCE(net->list.next); -+} - - static inline void __netns_tracker_alloc(struct net *net, - netns_tracker *tracker, -diff --git a/include/net/sock.h b/include/net/sock.h -index e15bea43b2ecd1..b5f7208a9ec383 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -1859,6 +1859,7 @@ static inline bool sock_allow_reclassification(const struct sock *csk) - struct sock *sk_alloc(struct net *net, int family, gfp_t priority, - struct proto *prot, int kern); - void sk_free(struct sock *sk); -+void sk_net_refcnt_upgrade(struct sock *sk); - void sk_destruct(struct sock *sk); - struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority); - void sk_free_unlock_clone(struct sock *sk); -diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h -index 8ea1674069fe81..f759109caeeac6 100644 ---- a/include/trace/events/btrfs.h -+++ b/include/trace/events/btrfs.h -@@ -1857,7 +1857,7 @@ TRACE_EVENT(qgroup_update_counters, - - TRACE_EVENT(qgroup_update_reserve, - -- TP_PROTO(struct btrfs_fs_info *fs_info, struct btrfs_qgroup *qgroup, -+ TP_PROTO(const struct btrfs_fs_info *fs_info, const struct btrfs_qgroup *qgroup, - s64 diff, int type), - - TP_ARGS(fs_info, qgroup, diff, type), -@@ -1883,7 +1883,7 @@ TRACE_EVENT(qgroup_update_reserve, - - TRACE_EVENT(qgroup_meta_reserve, - -- TP_PROTO(struct btrfs_root *root, s64 diff, int type), -+ TP_PROTO(const struct btrfs_root *root, s64 diff, int type), - - TP_ARGS(root, diff, type), - -@@ -1906,7 +1906,7 @@ TRACE_EVENT(qgroup_meta_reserve, - - TRACE_EVENT(qgroup_meta_convert, - -- TP_PROTO(struct btrfs_root *root, s64 diff), -+ TP_PROTO(const struct btrfs_root *root, s64 diff), - - TP_ARGS(root, diff), - -diff --git a/include/trace/events/thp.h b/include/trace/events/thp.h -index f50048af5fcc28..c8fe879d5828bd 100644 ---- a/include/trace/events/thp.h -+++ b/include/trace/events/thp.h -@@ -8,6 +8,7 @@ - #include - #include - -+#ifdef CONFIG_PPC_BOOK3S_64 - DECLARE_EVENT_CLASS(hugepage_set, - - TP_PROTO(unsigned long addr, unsigned long pte), -@@ -66,6 +67,7 @@ DEFINE_EVENT(hugepage_update, hugepage_update_pud, - TP_PROTO(unsigned long addr, unsigned long pud, unsigned long clr, unsigned long set), - TP_ARGS(addr, pud, clr, set) - ); -+#endif /* CONFIG_PPC_BOOK3S_64 */ - - DECLARE_EVENT_CLASS(migration_pmd, - -diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h -index ce3117df9cec29..6750911da4f066 100644 ---- a/include/uapi/linux/if_link.h -+++ b/include/uapi/linux/if_link.h -@@ -950,6 +950,7 @@ enum { - IFLA_BOND_AD_LACP_ACTIVE, - IFLA_BOND_MISSED_MAX, - IFLA_BOND_NS_IP6_TARGET, -+ IFLA_BOND_COUPLED_CONTROL, - __IFLA_BOND_MAX, - }; - -diff --git a/include/uapi/linux/in6.h b/include/uapi/linux/in6.h -index ff8d21f9e95b77..5a47339ef7d768 100644 ---- a/include/uapi/linux/in6.h -+++ b/include/uapi/linux/in6.h -@@ -152,7 +152,6 @@ struct in6_flowlabel_req { - /* - * IPV6 socket options - */ --#if __UAPI_DEF_IPV6_OPTIONS - #define IPV6_ADDRFORM 1 - #define IPV6_2292PKTINFO 2 - #define IPV6_2292HOPOPTS 3 -@@ -169,8 +168,10 @@ struct in6_flowlabel_req { - #define IPV6_MULTICAST_IF 17 - #define IPV6_MULTICAST_HOPS 18 - #define IPV6_MULTICAST_LOOP 19 -+#if __UAPI_DEF_IPV6_OPTIONS - #define IPV6_ADD_MEMBERSHIP 20 - #define IPV6_DROP_MEMBERSHIP 21 -+#endif - #define IPV6_ROUTER_ALERT 22 - #define IPV6_MTU_DISCOVER 23 - #define IPV6_MTU 24 -@@ -203,7 +204,6 @@ struct in6_flowlabel_req { - #define IPV6_IPSEC_POLICY 34 - #define IPV6_XFRM_POLICY 35 - #define IPV6_HDRINCL 36 --#endif - - /* - * Multicast: -diff --git a/include/uapi/linux/io_uring.h b/include/uapi/linux/io_uring.h -index 8e61f8b7c2ced1..333769bc6abf0c 100644 ---- a/include/uapi/linux/io_uring.h -+++ b/include/uapi/linux/io_uring.h -@@ -46,7 +46,7 @@ struct io_uring_sqe { - }; - __u32 len; /* buffer size or number of iovecs */ - union { -- __kernel_rwf_t rw_flags; -+ __u32 rw_flags; - __u32 fsync_flags; - __u16 poll_events; /* compatibility */ - __u32 poll32_events; /* word-reversed for BE */ -diff --git a/include/uapi/linux/pfrut.h b/include/uapi/linux/pfrut.h -index 42fa15f8310d6b..b77d5c210c2620 100644 ---- a/include/uapi/linux/pfrut.h -+++ b/include/uapi/linux/pfrut.h -@@ -89,6 +89,7 @@ struct pfru_payload_hdr { - __u32 hw_ver; - __u32 rt_ver; - __u8 platform_id[16]; -+ __u32 svn_ver; - }; - - enum pfru_dsm_status { -diff --git a/io_uring/net.c b/io_uring/net.c -index e455f051e62ef7..e7f8a79e049c9d 100644 ---- a/io_uring/net.c -+++ b/io_uring/net.c -@@ -351,6 +351,13 @@ static int io_setup_async_addr(struct io_kiocb *req, - return -EAGAIN; - } - -+static void io_net_kbuf_recyle(struct io_kiocb *req) -+{ -+ req->flags |= REQ_F_PARTIAL_IO; -+ if (req->flags & REQ_F_BUFFER_RING) -+ io_kbuf_recycle_ring(req); -+} -+ - int io_sendmsg_prep_async(struct io_kiocb *req) - { - int ret; -@@ -442,7 +449,7 @@ int io_sendmsg(struct io_kiocb *req, unsigned int issue_flags) - kmsg->msg.msg_controllen = 0; - kmsg->msg.msg_control = NULL; - sr->done_io += ret; -- req->flags |= REQ_F_PARTIAL_IO; -+ io_net_kbuf_recyle(req); - return io_setup_async_msg(req, kmsg, issue_flags); - } - if (ret == -ERESTARTSYS) -@@ -521,7 +528,7 @@ int io_send(struct io_kiocb *req, unsigned int issue_flags) - sr->len -= ret; - sr->buf += ret; - sr->done_io += ret; -- req->flags |= REQ_F_PARTIAL_IO; -+ io_net_kbuf_recyle(req); - return io_setup_async_addr(req, &__address, issue_flags); - } - if (ret == -ERESTARTSYS) -@@ -891,7 +898,7 @@ int io_recvmsg(struct io_kiocb *req, unsigned int issue_flags) - } - if (ret > 0 && io_net_retry(sock, flags)) { - sr->done_io += ret; -- req->flags |= REQ_F_PARTIAL_IO; -+ io_net_kbuf_recyle(req); - return io_setup_async_msg(req, kmsg, issue_flags); - } - if (ret == -ERESTARTSYS) -@@ -991,7 +998,7 @@ int io_recv(struct io_kiocb *req, unsigned int issue_flags) - sr->len -= ret; - sr->buf += ret; - sr->done_io += ret; -- req->flags |= REQ_F_PARTIAL_IO; -+ io_net_kbuf_recyle(req); - return -EAGAIN; - } - if (ret == -ERESTARTSYS) -@@ -1235,7 +1242,7 @@ int io_send_zc(struct io_kiocb *req, unsigned int issue_flags) - zc->len -= ret; - zc->buf += ret; - zc->done_io += ret; -- req->flags |= REQ_F_PARTIAL_IO; -+ io_net_kbuf_recyle(req); - return io_setup_async_addr(req, &__address, issue_flags); - } - if (ret == -ERESTARTSYS) -@@ -1306,7 +1313,7 @@ int io_sendmsg_zc(struct io_kiocb *req, unsigned int issue_flags) - - if (ret > 0 && io_net_retry(sock, flags)) { - sr->done_io += ret; -- req->flags |= REQ_F_PARTIAL_IO; -+ io_net_kbuf_recyle(req); - return io_setup_async_msg(req, kmsg, issue_flags); - } - if (ret == -ERESTARTSYS) -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index 1f9ae600e4455c..7d6ee41f4b4f4f 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -460,7 +460,8 @@ static bool reg_not_null(const struct bpf_reg_state *reg) - type == PTR_TO_MAP_KEY || - type == PTR_TO_SOCK_COMMON || - (type == PTR_TO_BTF_ID && is_trusted_reg(reg)) || -- type == PTR_TO_MEM; -+ type == PTR_TO_MEM || -+ type == CONST_PTR_TO_MAP; - } - - static bool type_is_ptr_alloc_obj(u32 type) -diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c -index ad8b62202bdc46..eadb028916c812 100644 ---- a/kernel/cgroup/cpuset.c -+++ b/kernel/cgroup/cpuset.c -@@ -432,7 +432,7 @@ static inline void check_insane_mems_config(nodemask_t *nodes) - { - if (!cpusets_insane_config() && - movable_only_nodes(nodes)) { -- static_branch_enable(&cpusets_insane_config_key); -+ static_branch_enable_cpuslocked(&cpusets_insane_config_key); - pr_info("Unsupported (movable nodes only) cpuset configuration detected (nmask=%*pbl)!\n" - "Cpuset allocations might fail even with a lot of memory available.\n", - nodemask_pr_args(nodes)); -diff --git a/kernel/fork.c b/kernel/fork.c -index 7966c9a1c163d1..0e20d7e9460848 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -739,7 +739,7 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, - - get_file(file); - i_mmap_lock_write(mapping); -- if (tmp->vm_flags & VM_SHARED) -+ if (vma_is_shared_maywrite(tmp)) - mapping_allow_writable(mapping); - flush_dcache_mmap_lock(mapping); - /* insert tmp into the share list, just after mpnt */ -diff --git a/kernel/module/main.c b/kernel/module/main.c -index 9711ad14825b24..627680e568fccc 100644 ---- a/kernel/module/main.c -+++ b/kernel/module/main.c -@@ -701,14 +701,16 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user, - struct module *mod; - char name[MODULE_NAME_LEN]; - char buf[MODULE_FLAGS_BUF_SIZE]; -- int ret, forced = 0; -+ int ret, len, forced = 0; - - if (!capable(CAP_SYS_MODULE) || modules_disabled) - return -EPERM; - -- if (strncpy_from_user(name, name_user, MODULE_NAME_LEN-1) < 0) -- return -EFAULT; -- name[MODULE_NAME_LEN-1] = '\0'; -+ len = strncpy_from_user(name, name_user, MODULE_NAME_LEN); -+ if (len == 0 || len == MODULE_NAME_LEN) -+ return -ENOENT; -+ if (len < 0) -+ return len; - - audit_log_kern_module(name); - -diff --git a/kernel/power/console.c b/kernel/power/console.c -index fcdf0e14a47d47..19c48aa5355d2b 100644 ---- a/kernel/power/console.c -+++ b/kernel/power/console.c -@@ -16,6 +16,7 @@ - #define SUSPEND_CONSOLE (MAX_NR_CONSOLES-1) - - static int orig_fgconsole, orig_kmsg; -+static bool vt_switch_done; - - static DEFINE_MUTEX(vt_switch_mutex); - -@@ -136,17 +137,21 @@ void pm_prepare_console(void) - if (orig_fgconsole < 0) - return; - -+ vt_switch_done = true; -+ - orig_kmsg = vt_kmsg_redirect(SUSPEND_CONSOLE); - return; - } - - void pm_restore_console(void) - { -- if (!pm_vt_switch()) -+ if (!pm_vt_switch() && !vt_switch_done) - return; - - if (orig_fgconsole >= 0) { - vt_move_to_console(orig_fgconsole, 0); - vt_kmsg_redirect(orig_kmsg); - } -+ -+ vt_switch_done = false; - } -diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c -index 536acebf22b0d0..607b2e68fa4c20 100644 ---- a/kernel/rcu/tree.c -+++ b/kernel/rcu/tree.c -@@ -4427,6 +4427,8 @@ int rcutree_prepare_cpu(unsigned int cpu) - rdp->rcu_iw_gp_seq = rdp->gp_seq - 1; - trace_rcu_grace_period(rcu_state.name, rdp->gp_seq, TPS("cpuonl")); - raw_spin_unlock_irqrestore_rcu_node(rnp, flags); -+ -+ rcu_preempt_deferred_qs_init(rdp); - rcu_spawn_one_boost_kthread(rnp); - rcu_spawn_cpu_nocb_kthread(cpu); - WRITE_ONCE(rcu_state.n_online_cpus, rcu_state.n_online_cpus + 1); -diff --git a/kernel/rcu/tree.h b/kernel/rcu/tree.h -index ac8cc756920ddf..71403d22a84655 100644 ---- a/kernel/rcu/tree.h -+++ b/kernel/rcu/tree.h -@@ -175,6 +175,17 @@ struct rcu_snap_record { - unsigned long jiffies; /* Track jiffies value */ - }; - -+/* -+ * An IRQ work (deferred_qs_iw) is used by RCU to get the scheduler's attention. -+ * to report quiescent states at the soonest possible time. -+ * The request can be in one of the following states: -+ * - DEFER_QS_IDLE: An IRQ work is yet to be scheduled. -+ * - DEFER_QS_PENDING: An IRQ work was scheduled but either not yet run, or it -+ * ran and we still haven't reported a quiescent state. -+ */ -+#define DEFER_QS_IDLE 0 -+#define DEFER_QS_PENDING 1 -+ - /* Per-CPU data for read-copy update. */ - struct rcu_data { - /* 1) quiescent-state and grace-period handling : */ -@@ -192,7 +203,7 @@ struct rcu_data { - /* during and after the last grace */ - /* period it is aware of. */ - struct irq_work defer_qs_iw; /* Obtain later scheduler attention. */ -- bool defer_qs_iw_pending; /* Scheduler attention pending? */ -+ int defer_qs_iw_pending; /* Scheduler attention pending? */ - struct work_struct strict_work; /* Schedule readers for strict GPs. */ - - /* 2) batch handling */ -@@ -452,6 +463,7 @@ static int rcu_print_task_exp_stall(struct rcu_node *rnp); - static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp); - static void rcu_flavor_sched_clock_irq(int user); - static void dump_blkd_tasks(struct rcu_node *rnp, int ncheck); -+static void rcu_preempt_deferred_qs_init(struct rcu_data *rdp); - static void rcu_initiate_boost(struct rcu_node *rnp, unsigned long flags); - static void rcu_preempt_boost_start_gp(struct rcu_node *rnp); - static bool rcu_is_callbacks_kthread(struct rcu_data *rdp); -diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h -index 94b715139f52d9..8707f155afb6df 100644 ---- a/kernel/rcu/tree_plugin.h -+++ b/kernel/rcu/tree_plugin.h -@@ -474,13 +474,16 @@ rcu_preempt_deferred_qs_irqrestore(struct task_struct *t, unsigned long flags) - struct rcu_node *rnp; - union rcu_special special; - -+ rdp = this_cpu_ptr(&rcu_data); -+ if (rdp->defer_qs_iw_pending == DEFER_QS_PENDING) -+ rdp->defer_qs_iw_pending = DEFER_QS_IDLE; -+ - /* - * If RCU core is waiting for this CPU to exit its critical section, - * report the fact that it has exited. Because irqs are disabled, - * t->rcu_read_unlock_special cannot change. - */ - special = t->rcu_read_unlock_special; -- rdp = this_cpu_ptr(&rcu_data); - if (!special.s && !rdp->cpu_no_qs.b.exp) { - local_irq_restore(flags); - return; -@@ -612,10 +615,29 @@ notrace void rcu_preempt_deferred_qs(struct task_struct *t) - */ - static void rcu_preempt_deferred_qs_handler(struct irq_work *iwp) - { -+ unsigned long flags; - struct rcu_data *rdp; - - rdp = container_of(iwp, struct rcu_data, defer_qs_iw); -- rdp->defer_qs_iw_pending = false; -+ local_irq_save(flags); -+ -+ /* -+ * If the IRQ work handler happens to run in the middle of RCU read-side -+ * critical section, it could be ineffective in getting the scheduler's -+ * attention to report a deferred quiescent state (the whole point of the -+ * IRQ work). For this reason, requeue the IRQ work. -+ * -+ * Basically, we want to avoid following situation: -+ * 1. rcu_read_unlock() queues IRQ work (state -> DEFER_QS_PENDING) -+ * 2. CPU enters new rcu_read_lock() -+ * 3. IRQ work runs but cannot report QS due to rcu_preempt_depth() > 0 -+ * 4. rcu_read_unlock() does not re-queue work (state still PENDING) -+ * 5. Deferred QS reporting does not happen. -+ */ -+ if (rcu_preempt_depth() > 0) -+ WRITE_ONCE(rdp->defer_qs_iw_pending, DEFER_QS_IDLE); -+ -+ local_irq_restore(flags); - } - - /* -@@ -661,17 +683,11 @@ static void rcu_read_unlock_special(struct task_struct *t) - set_tsk_need_resched(current); - set_preempt_need_resched(); - if (IS_ENABLED(CONFIG_IRQ_WORK) && irqs_were_disabled && -- expboost && !rdp->defer_qs_iw_pending && cpu_online(rdp->cpu)) { -+ expboost && rdp->defer_qs_iw_pending != DEFER_QS_PENDING && -+ cpu_online(rdp->cpu)) { - // Get scheduler to re-evaluate and call hooks. - // If !IRQ_WORK, FQS scan will eventually IPI. -- if (IS_ENABLED(CONFIG_RCU_STRICT_GRACE_PERIOD) && -- IS_ENABLED(CONFIG_PREEMPT_RT)) -- rdp->defer_qs_iw = IRQ_WORK_INIT_HARD( -- rcu_preempt_deferred_qs_handler); -- else -- init_irq_work(&rdp->defer_qs_iw, -- rcu_preempt_deferred_qs_handler); -- rdp->defer_qs_iw_pending = true; -+ rdp->defer_qs_iw_pending = DEFER_QS_PENDING; - irq_work_queue_on(&rdp->defer_qs_iw, rdp->cpu); - } - } -@@ -810,6 +826,10 @@ dump_blkd_tasks(struct rcu_node *rnp, int ncheck) - } - } - -+static void rcu_preempt_deferred_qs_init(struct rcu_data *rdp) -+{ -+ rdp->defer_qs_iw = IRQ_WORK_INIT_HARD(rcu_preempt_deferred_qs_handler); -+} - #else /* #ifdef CONFIG_PREEMPT_RCU */ - - /* -@@ -1009,6 +1029,8 @@ dump_blkd_tasks(struct rcu_node *rnp, int ncheck) - WARN_ON_ONCE(!list_empty(&rnp->blkd_tasks)); - } - -+static void rcu_preempt_deferred_qs_init(struct rcu_data *rdp) { } -+ - #endif /* #else #ifdef CONFIG_PREEMPT_RCU */ - - /* -diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c -index 776be0549162c9..819ec1ccc08cf5 100644 ---- a/kernel/sched/cpufreq_schedutil.c -+++ b/kernel/sched/cpufreq_schedutil.c -@@ -137,6 +137,32 @@ static void sugov_deferred_update(struct sugov_policy *sg_policy) - } - } - -+/** -+ * get_capacity_ref_freq - get the reference frequency that has been used to -+ * correlate frequency and compute capacity for a given cpufreq policy. We use -+ * the CPU managing it for the arch_scale_freq_ref() call in the function. -+ * @policy: the cpufreq policy of the CPU in question. -+ * -+ * Return: the reference CPU frequency to compute a capacity. -+ */ -+static __always_inline -+unsigned long get_capacity_ref_freq(struct cpufreq_policy *policy) -+{ -+ unsigned int freq = arch_scale_freq_ref(policy->cpu); -+ -+ if (freq) -+ return freq; -+ -+ if (arch_scale_freq_invariant()) -+ return policy->cpuinfo.max_freq; -+ -+ /* -+ * Apply a 25% margin so that we select a higher frequency than -+ * the current one before the CPU is fully busy: -+ */ -+ return policy->cur + (policy->cur >> 2); -+} -+ - /** - * get_next_freq - Compute a new frequency for a given cpufreq policy. - * @sg_policy: schedutil policy object to compute the new frequency for. -@@ -163,9 +189,9 @@ static unsigned int get_next_freq(struct sugov_policy *sg_policy, - unsigned long util, unsigned long max) - { - struct cpufreq_policy *policy = sg_policy->policy; -- unsigned int freq = arch_scale_freq_invariant() ? -- policy->cpuinfo.max_freq : policy->cur; -+ unsigned int freq; - -+ freq = get_capacity_ref_freq(policy); - freq = map_util_freq(util, freq, max); - - if (freq == sg_policy->cached_raw_freq && !sg_policy->need_freq_update) -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 6ce3028e6e852f..1cf43e91ae9de8 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -11697,8 +11697,14 @@ static inline bool update_newidle_cost(struct sched_domain *sd, u64 cost) - /* - * Track max cost of a domain to make sure to not delay the - * next wakeup on the CPU. -+ * -+ * sched_balance_newidle() bumps the cost whenever newidle -+ * balance fails, and we don't want things to grow out of -+ * control. Use the sysctl_sched_migration_cost as the upper -+ * limit, plus a litle extra to avoid off by ones. - */ -- sd->max_newidle_lb_cost = cost; -+ sd->max_newidle_lb_cost = -+ min(cost, sysctl_sched_migration_cost + 200); - sd->last_decay_max_lb_cost = jiffies; - } else if (time_after(jiffies, sd->last_decay_max_lb_cost + HZ)) { - /* -@@ -12384,10 +12390,17 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) - - t1 = sched_clock_cpu(this_cpu); - domain_cost = t1 - t0; -- update_newidle_cost(sd, domain_cost); -- - curr_cost += domain_cost; - t0 = t1; -+ -+ /* -+ * Failing newidle means it is not effective; -+ * bump the cost so we end up doing less of it. -+ */ -+ if (!pulled_task) -+ domain_cost = (3 * sd->max_newidle_lb_cost) / 2; -+ -+ update_newidle_cost(sd, domain_cost); - } - - /* -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 4351b9069a919d..15785a729a0cdf 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -4058,13 +4058,17 @@ ftrace_regex_open(struct ftrace_ops *ops, int flag, - } else { - iter->hash = alloc_and_copy_ftrace_hash(size_bits, hash); - } -+ } else { -+ if (hash) -+ iter->hash = alloc_and_copy_ftrace_hash(hash->size_bits, hash); -+ else -+ iter->hash = EMPTY_HASH; -+ } - -- if (!iter->hash) { -- trace_parser_put(&iter->parser); -- goto out_unlock; -- } -- } else -- iter->hash = hash; -+ if (!iter->hash) { -+ trace_parser_put(&iter->parser); -+ goto out_unlock; -+ } - - ret = 0; - -@@ -5922,9 +5926,6 @@ int ftrace_regex_release(struct inode *inode, struct file *file) - ftrace_hash_move_and_update_ops(iter->ops, orig_hash, - iter->hash, filter_hash); - mutex_unlock(&ftrace_lock); -- } else { -- /* For read only, the hash is the ops hash */ -- iter->hash = NULL; - } - - mutex_unlock(&iter->ops->func_hash->regex_lock); -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 946350c98b5396..907e45361939be 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -1661,7 +1661,7 @@ int trace_get_user(struct trace_parser *parser, const char __user *ubuf, - - ret = get_user(ch, ubuf++); - if (ret) -- goto out; -+ goto fail; - - read++; - cnt--; -@@ -1675,7 +1675,7 @@ int trace_get_user(struct trace_parser *parser, const char __user *ubuf, - while (cnt && isspace(ch)) { - ret = get_user(ch, ubuf++); - if (ret) -- goto out; -+ goto fail; - read++; - cnt--; - } -@@ -1685,8 +1685,7 @@ int trace_get_user(struct trace_parser *parser, const char __user *ubuf, - /* only spaces were written */ - if (isspace(ch) || !ch) { - *ppos += read; -- ret = read; -- goto out; -+ return read; - } - } - -@@ -1696,11 +1695,12 @@ int trace_get_user(struct trace_parser *parser, const char __user *ubuf, - parser->buffer[parser->idx++] = ch; - else { - ret = -EINVAL; -- goto out; -+ goto fail; - } -+ - ret = get_user(ch, ubuf++); - if (ret) -- goto out; -+ goto fail; - read++; - cnt--; - } -@@ -1716,13 +1716,13 @@ int trace_get_user(struct trace_parser *parser, const char __user *ubuf, - parser->buffer[parser->idx] = 0; - } else { - ret = -EINVAL; -- goto out; -+ goto fail; - } - - *ppos += read; -- ret = read; -- --out: -+ return read; -+fail: -+ trace_parser_fail(parser); - return ret; - } - -@@ -2211,10 +2211,10 @@ int __init register_tracer(struct tracer *type) - mutex_unlock(&trace_types_lock); - - if (ret || !default_bootup_tracer) -- goto out_unlock; -+ return ret; - - if (strncmp(default_bootup_tracer, type->name, MAX_TRACER_SIZE)) -- goto out_unlock; -+ return 0; - - printk(KERN_INFO "Starting tracer '%s'\n", type->name); - /* Do we want this tracer to start on bootup? */ -@@ -2226,8 +2226,7 @@ int __init register_tracer(struct tracer *type) - /* disable other selftests, since this will break it. */ - disable_tracing_selftest("running a tracer"); - -- out_unlock: -- return ret; -+ return 0; - } - - static void tracing_reset_cpu(struct array_buffer *buf, int cpu) -@@ -8734,11 +8733,10 @@ ftrace_trace_snapshot_callback(struct trace_array *tr, struct ftrace_hash *hash, - out_reg: - ret = tracing_alloc_snapshot_instance(tr); - if (ret < 0) -- goto out; -+ return ret; - - ret = register_ftrace_function_probe(glob, tr, ops, count); - -- out: - return ret < 0 ? ret : 0; - } - -@@ -10344,7 +10342,7 @@ __init static int tracer_alloc_buffers(void) - BUILD_BUG_ON(TRACE_ITER_LAST_BIT > TRACE_FLAGS_MAX_SIZE); - - if (!alloc_cpumask_var(&tracing_buffer_mask, GFP_KERNEL)) -- goto out; -+ return -ENOMEM; - - if (!alloc_cpumask_var(&global_trace.tracing_cpumask, GFP_KERNEL)) - goto out_free_buffer_mask; -@@ -10455,7 +10453,6 @@ __init static int tracer_alloc_buffers(void) - free_cpumask_var(global_trace.tracing_cpumask); - out_free_buffer_mask: - free_cpumask_var(tracing_buffer_mask); --out: - return ret; - } - -diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h -index e3afb830fbcc7b..c91f3c47ac642f 100644 ---- a/kernel/trace/trace.h -+++ b/kernel/trace/trace.h -@@ -1153,6 +1153,7 @@ bool ftrace_event_is_function(struct trace_event_call *call); - */ - struct trace_parser { - bool cont; -+ bool fail; - char *buffer; - unsigned idx; - unsigned size; -@@ -1160,7 +1161,7 @@ struct trace_parser { - - static inline bool trace_parser_loaded(struct trace_parser *parser) - { -- return (parser->idx != 0); -+ return !parser->fail && parser->idx != 0; - } - - static inline bool trace_parser_cont(struct trace_parser *parser) -@@ -1174,6 +1175,11 @@ static inline void trace_parser_clear(struct trace_parser *parser) - parser->idx = 0; - } - -+static inline void trace_parser_fail(struct trace_parser *parser) -+{ -+ parser->fail = true; -+} -+ - extern int trace_parser_get_init(struct trace_parser *parser, int size); - extern void trace_parser_put(struct trace_parser *parser); - extern int trace_get_user(struct trace_parser *parser, const char __user *ubuf, -@@ -2053,7 +2059,7 @@ static inline bool is_good_system_name(const char *name) - static inline void sanitize_event_name(char *name) - { - while (*name++ != '\0') -- if (*name == ':' || *name == '.') -+ if (*name == ':' || *name == '.' || *name == '*') - *name = '_'; - } - -diff --git a/mm/debug_vm_pgtable.c b/mm/debug_vm_pgtable.c -index 68af76ca8bc992..0a5454fae31693 100644 ---- a/mm/debug_vm_pgtable.c -+++ b/mm/debug_vm_pgtable.c -@@ -1047,29 +1047,34 @@ static void __init destroy_args(struct pgtable_debug_args *args) - - /* Free page table entries */ - if (args->start_ptep) { -+ pmd_clear(args->pmdp); - pte_free(args->mm, args->start_ptep); - mm_dec_nr_ptes(args->mm); - } - - if (args->start_pmdp) { -+ pud_clear(args->pudp); - pmd_free(args->mm, args->start_pmdp); - mm_dec_nr_pmds(args->mm); - } - - if (args->start_pudp) { -+ p4d_clear(args->p4dp); - pud_free(args->mm, args->start_pudp); - mm_dec_nr_puds(args->mm); - } - -- if (args->start_p4dp) -+ if (args->start_p4dp) { -+ pgd_clear(args->pgdp); - p4d_free(args->mm, args->start_p4dp); -+ } - - /* Free vma and mm struct */ - if (args->vma) - vm_area_free(args->vma); - - if (args->mm) -- mmdrop(args->mm); -+ mmput(args->mm); - } - - static struct page * __init -diff --git a/mm/filemap.c b/mm/filemap.c -index 05eb77623a1063..ab24dbf5e747ef 100644 ---- a/mm/filemap.c -+++ b/mm/filemap.c -@@ -3716,7 +3716,7 @@ int generic_file_mmap(struct file *file, struct vm_area_struct *vma) - */ - int generic_file_readonly_mmap(struct file *file, struct vm_area_struct *vma) - { -- if ((vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_MAYWRITE)) -+ if (vma_is_shared_maywrite(vma)) - return -EINVAL; - return generic_file_mmap(file, vma); - } -diff --git a/mm/kmemleak.c b/mm/kmemleak.c -index f86d4e04d95e12..e2e41de55c02b1 100644 ---- a/mm/kmemleak.c -+++ b/mm/kmemleak.c -@@ -452,6 +452,7 @@ static struct kmemleak_object *mem_pool_alloc(gfp_t gfp) - { - unsigned long flags; - struct kmemleak_object *object; -+ bool warn = false; - - /* try the slab allocator first */ - if (object_cache) { -@@ -469,8 +470,10 @@ static struct kmemleak_object *mem_pool_alloc(gfp_t gfp) - else if (mem_pool_free_count) - object = &mem_pool[--mem_pool_free_count]; - else -- pr_warn_once("Memory pool empty, consider increasing CONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE\n"); -+ warn = true; - raw_spin_unlock_irqrestore(&kmemleak_lock, flags); -+ if (warn) -+ pr_warn_once("Memory pool empty, consider increasing CONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE\n"); - - return object; - } -@@ -2006,6 +2009,7 @@ static const struct file_operations kmemleak_fops = { - static void __kmemleak_do_cleanup(void) - { - struct kmemleak_object *object, *tmp; -+ unsigned int cnt = 0; - - /* - * Kmemleak has already been disabled, no need for RCU list traversal -@@ -2014,6 +2018,10 @@ static void __kmemleak_do_cleanup(void) - list_for_each_entry_safe(object, tmp, &object_list, object_list) { - __remove_object(object); - __delete_object(object); -+ -+ /* Call cond_resched() once per 64 iterations to avoid soft lockup */ -+ if (!(++cnt & 0x3f)) -+ cond_resched(); - } - } - -diff --git a/mm/madvise.c b/mm/madvise.c -index 9d2a6cb655ff20..3d6370d3199f31 100644 ---- a/mm/madvise.c -+++ b/mm/madvise.c -@@ -987,7 +987,7 @@ static long madvise_remove(struct vm_area_struct *vma, - return -EINVAL; - } - -- if ((vma->vm_flags & (VM_SHARED|VM_WRITE)) != (VM_SHARED|VM_WRITE)) -+ if (!vma_is_shared_maywrite(vma)) - return -EACCES; - - offset = (loff_t)(start - vma->vm_start) -diff --git a/mm/memfd.c b/mm/memfd.c -index 2dba2cb6f0d0f8..187265dc68f5e8 100644 ---- a/mm/memfd.c -+++ b/mm/memfd.c -@@ -134,7 +134,7 @@ static int memfd_wait_for_pins(struct address_space *mapping) - return error; - } - --static unsigned int *memfd_file_seals_ptr(struct file *file) -+unsigned int *memfd_file_seals_ptr(struct file *file) - { - if (shmem_file(file)) - return &SHMEM_I(file_inode(file))->seals; -diff --git a/mm/memory-failure.c b/mm/memory-failure.c -index a96840c4158165..dae5e60d64e2fd 100644 ---- a/mm/memory-failure.c -+++ b/mm/memory-failure.c -@@ -835,9 +835,17 @@ static int hwpoison_hugetlb_range(pte_t *ptep, unsigned long hmask, - #define hwpoison_hugetlb_range NULL - #endif - -+static int hwpoison_test_walk(unsigned long start, unsigned long end, -+ struct mm_walk *walk) -+{ -+ /* We also want to consider pages mapped into VM_PFNMAP. */ -+ return 0; -+} -+ - static const struct mm_walk_ops hwpoison_walk_ops = { - .pmd_entry = hwpoison_pte_range, - .hugetlb_entry = hwpoison_hugetlb_range, -+ .test_walk = hwpoison_test_walk, - .walk_lock = PGWALK_RDLOCK, - }; - -diff --git a/mm/mmap.c b/mm/mmap.c -index a9c70001e45601..8cf23a07ae500f 100644 ---- a/mm/mmap.c -+++ b/mm/mmap.c -@@ -47,6 +47,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -107,7 +108,7 @@ void vma_set_page_prot(struct vm_area_struct *vma) - static void __remove_shared_vm_struct(struct vm_area_struct *vma, - struct file *file, struct address_space *mapping) - { -- if (vma->vm_flags & VM_SHARED) -+ if (vma_is_shared_maywrite(vma)) - mapping_unmap_writable(mapping); - - flush_dcache_mmap_lock(mapping); -@@ -383,7 +384,7 @@ static unsigned long count_vma_pages_range(struct mm_struct *mm, - static void __vma_link_file(struct vm_area_struct *vma, - struct address_space *mapping) - { -- if (vma->vm_flags & VM_SHARED) -+ if (vma_is_shared_maywrite(vma)) - mapping_allow_writable(mapping); - - flush_dcache_mmap_lock(mapping); -@@ -1285,6 +1286,7 @@ unsigned long do_mmap(struct file *file, unsigned long addr, - - if (file) { - struct inode *inode = file_inode(file); -+ unsigned int seals = memfd_file_seals(file); - unsigned long flags_mask; - - if (!file_mmap_ok(file, inode, pgoff, len)) -@@ -1323,6 +1325,8 @@ unsigned long do_mmap(struct file *file, unsigned long addr, - vm_flags |= VM_SHARED | VM_MAYSHARE; - if (!(file->f_mode & FMODE_WRITE)) - vm_flags &= ~(VM_MAYWRITE | VM_SHARED); -+ else if (is_readonly_sealed(seals, vm_flags)) -+ vm_flags &= ~VM_MAYWRITE; - fallthrough; - case MAP_PRIVATE: - if (!(file->f_mode & FMODE_READ)) -@@ -2845,7 +2849,7 @@ static unsigned long __mmap_region(struct file *file, unsigned long addr, - mm->map_count++; - if (vma->vm_file) { - i_mmap_lock_write(vma->vm_file->f_mapping); -- if (vma->vm_flags & VM_SHARED) -+ if (vma_is_shared_maywrite(vma)) - mapping_allow_writable(vma->vm_file->f_mapping); - - flush_dcache_mmap_lock(vma->vm_file->f_mapping); -@@ -2926,7 +2930,7 @@ unsigned long mmap_region(struct file *file, unsigned long addr, - return -EINVAL; - - /* Map writable and ensure this isn't a sealed memfd. */ -- if (file && (vm_flags & VM_SHARED)) { -+ if (file && is_shared_maywrite(vm_flags)) { - int error = mapping_map_writable(file->f_mapping); - - if (error) -diff --git a/mm/ptdump.c b/mm/ptdump.c -index 03c1bdae4a4368..e46df2c24d8583 100644 ---- a/mm/ptdump.c -+++ b/mm/ptdump.c -@@ -152,6 +152,7 @@ void ptdump_walk_pgd(struct ptdump_state *st, struct mm_struct *mm, pgd_t *pgd) - { - const struct ptdump_range *range = st->range; - -+ get_online_mems(); - mmap_write_lock(mm); - while (range->start != range->end) { - walk_page_range_novma(mm, range->start, range->end, -@@ -159,6 +160,7 @@ void ptdump_walk_pgd(struct ptdump_state *st, struct mm_struct *mm, pgd_t *pgd) - range++; - } - mmap_write_unlock(mm); -+ put_online_mems(); - - /* Flush out the last page */ - st->note_page(st, 0, -1, 0); -diff --git a/mm/shmem.c b/mm/shmem.c -index 283fb62084d454..ecf1011cc3e296 100644 ---- a/mm/shmem.c -+++ b/mm/shmem.c -@@ -2396,7 +2396,7 @@ static int shmem_mmap(struct file *file, struct vm_area_struct *vma) - struct shmem_inode_info *info = SHMEM_I(inode); - int ret; - -- ret = seal_check_future_write(info->seals, vma); -+ ret = seal_check_write(info->seals, vma); - if (ret) - return ret; - -diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c -index 549ee9e87d6366..ff9d2520ba749c 100644 ---- a/net/bluetooth/hci_conn.c -+++ b/net/bluetooth/hci_conn.c -@@ -339,7 +339,8 @@ static int hci_enhanced_setup_sync(struct hci_dev *hdev, void *data) - case BT_CODEC_TRANSPARENT: - if (!find_next_esco_param(conn, esco_param_msbc, - ARRAY_SIZE(esco_param_msbc))) -- return false; -+ return -EINVAL; -+ - param = &esco_param_msbc[conn->attempt - 1]; - cp.tx_coding_format.id = 0x03; - cp.rx_coding_format.id = 0x03; -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index 3b22ce3aa95bb5..c06010c0d88293 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -6664,8 +6664,8 @@ static void hci_le_cis_estabilished_evt(struct hci_dev *hdev, void *data, - qos->ucast.out.latency = - DIV_ROUND_CLOSEST(get_unaligned_le24(ev->p_latency), - 1000); -- qos->ucast.in.sdu = le16_to_cpu(ev->c_mtu); -- qos->ucast.out.sdu = le16_to_cpu(ev->p_mtu); -+ qos->ucast.in.sdu = ev->c_bn ? le16_to_cpu(ev->c_mtu) : 0; -+ qos->ucast.out.sdu = ev->p_bn ? le16_to_cpu(ev->p_mtu) : 0; - qos->ucast.in.phy = ev->c_phy; - qos->ucast.out.phy = ev->p_phy; - break; -@@ -6679,8 +6679,8 @@ static void hci_le_cis_estabilished_evt(struct hci_dev *hdev, void *data, - qos->ucast.in.latency = - DIV_ROUND_CLOSEST(get_unaligned_le24(ev->p_latency), - 1000); -- qos->ucast.out.sdu = le16_to_cpu(ev->c_mtu); -- qos->ucast.in.sdu = le16_to_cpu(ev->p_mtu); -+ qos->ucast.out.sdu = ev->c_bn ? le16_to_cpu(ev->c_mtu) : 0; -+ qos->ucast.in.sdu = ev->p_bn ? le16_to_cpu(ev->p_mtu) : 0; - qos->ucast.out.phy = ev->c_phy; - qos->ucast.in.phy = ev->p_phy; - break; -diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c -index 69c2ba1e843eb4..d2613bd3e6db02 100644 ---- a/net/bluetooth/hci_sock.c -+++ b/net/bluetooth/hci_sock.c -@@ -118,7 +118,7 @@ static void hci_sock_free_cookie(struct sock *sk) - int id = hci_pi(sk)->cookie; - - if (id) { -- hci_pi(sk)->cookie = 0xffffffff; -+ hci_pi(sk)->cookie = 0; - ida_free(&sock_cookie_ida, id); - } - } -diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c -index fa16ee88ec396a..f42805d9b38fa6 100644 ---- a/net/bridge/br_multicast.c -+++ b/net/bridge/br_multicast.c -@@ -4807,6 +4807,14 @@ void br_multicast_set_query_intvl(struct net_bridge_mcast *brmctx, - intvl_jiffies = BR_MULTICAST_QUERY_INTVL_MIN; - } - -+ if (intvl_jiffies > BR_MULTICAST_QUERY_INTVL_MAX) { -+ br_info(brmctx->br, -+ "trying to set multicast query interval above maximum, setting to %lu (%ums)\n", -+ jiffies_to_clock_t(BR_MULTICAST_QUERY_INTVL_MAX), -+ jiffies_to_msecs(BR_MULTICAST_QUERY_INTVL_MAX)); -+ intvl_jiffies = BR_MULTICAST_QUERY_INTVL_MAX; -+ } -+ - brmctx->multicast_query_interval = intvl_jiffies; - } - -@@ -4823,6 +4831,14 @@ void br_multicast_set_startup_query_intvl(struct net_bridge_mcast *brmctx, - intvl_jiffies = BR_MULTICAST_STARTUP_QUERY_INTVL_MIN; - } - -+ if (intvl_jiffies > BR_MULTICAST_STARTUP_QUERY_INTVL_MAX) { -+ br_info(brmctx->br, -+ "trying to set multicast startup query interval above maximum, setting to %lu (%ums)\n", -+ jiffies_to_clock_t(BR_MULTICAST_STARTUP_QUERY_INTVL_MAX), -+ jiffies_to_msecs(BR_MULTICAST_STARTUP_QUERY_INTVL_MAX)); -+ intvl_jiffies = BR_MULTICAST_STARTUP_QUERY_INTVL_MAX; -+ } -+ - brmctx->multicast_startup_query_interval = intvl_jiffies; - } - -diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h -index 067d47b8eb8ffb..ef98ec4c3f51d4 100644 ---- a/net/bridge/br_private.h -+++ b/net/bridge/br_private.h -@@ -31,6 +31,8 @@ - #define BR_MULTICAST_DEFAULT_HASH_MAX 4096 - #define BR_MULTICAST_QUERY_INTVL_MIN msecs_to_jiffies(1000) - #define BR_MULTICAST_STARTUP_QUERY_INTVL_MIN BR_MULTICAST_QUERY_INTVL_MIN -+#define BR_MULTICAST_QUERY_INTVL_MAX msecs_to_jiffies(86400000) /* 24 hours */ -+#define BR_MULTICAST_STARTUP_QUERY_INTVL_MAX BR_MULTICAST_QUERY_INTVL_MAX - - #define BR_HWDOM_MAX BITS_PER_LONG - -diff --git a/net/core/dev.c b/net/core/dev.c -index 4006fd164b7bc7..2d3e0e4130c213 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -3559,6 +3559,18 @@ static netdev_features_t gso_features_check(const struct sk_buff *skb, - features &= ~NETIF_F_TSO_MANGLEID; - } - -+ /* NETIF_F_IPV6_CSUM does not support IPv6 extension headers, -+ * so neither does TSO that depends on it. -+ */ -+ if (features & NETIF_F_IPV6_CSUM && -+ (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6 || -+ (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4 && -+ vlan_get_protocol(skb) == htons(ETH_P_IPV6))) && -+ skb_transport_header_was_set(skb) && -+ skb_network_header_len(skb) != sizeof(struct ipv6hdr) && -+ !ipv6_has_hopopt_jumbo(skb)) -+ features &= ~(NETIF_F_IPV6_CSUM | NETIF_F_TSO6 | NETIF_F_GSO_UDP_L4); -+ - return features; - } - -diff --git a/net/core/neighbour.c b/net/core/neighbour.c -index 1e2e60ffe76629..e6b36df482bc7f 100644 ---- a/net/core/neighbour.c -+++ b/net/core/neighbour.c -@@ -55,7 +55,8 @@ static void __neigh_notify(struct neighbour *n, int type, int flags, - u32 pid); - static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid); - static int pneigh_ifdown_and_unlock(struct neigh_table *tbl, -- struct net_device *dev); -+ struct net_device *dev, -+ bool skip_perm); - - #ifdef CONFIG_PROC_FS - static const struct seq_operations neigh_stat_seq_ops; -@@ -444,7 +445,7 @@ static int __neigh_ifdown(struct neigh_table *tbl, struct net_device *dev, - { - write_lock_bh(&tbl->lock); - neigh_flush_dev(tbl, dev, skip_perm); -- pneigh_ifdown_and_unlock(tbl, dev); -+ pneigh_ifdown_and_unlock(tbl, dev, skip_perm); - pneigh_queue_purge(&tbl->proxy_queue, dev ? dev_net(dev) : NULL, - tbl->family); - if (skb_queue_empty_lockless(&tbl->proxy_queue)) -@@ -845,7 +846,8 @@ int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey, - } - - static int pneigh_ifdown_and_unlock(struct neigh_table *tbl, -- struct net_device *dev) -+ struct net_device *dev, -+ bool skip_perm) - { - struct pneigh_entry *n, **np, *freelist = NULL; - u32 h; -@@ -853,12 +855,15 @@ static int pneigh_ifdown_and_unlock(struct neigh_table *tbl, - for (h = 0; h <= PNEIGH_HASHMASK; h++) { - np = &tbl->phash_buckets[h]; - while ((n = *np) != NULL) { -+ if (skip_perm && n->permanent) -+ goto skip; - if (!dev || n->dev == dev) { - *np = n->next; - n->next = freelist; - freelist = n; - continue; - } -+skip: - np = &n->next; - } - } -@@ -2033,6 +2038,7 @@ static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh, - pn = pneigh_lookup(tbl, net, dst, dev, 1); - if (pn) { - pn->flags = ndm_flags; -+ pn->permanent = !!(ndm->ndm_state & NUD_PERMANENT); - if (protocol) - pn->protocol = protocol; - err = 0; -diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c -index 70ac9d9bc87708..20829e0c36cdbf 100644 ---- a/net/core/net_namespace.c -+++ b/net/core/net_namespace.c -@@ -467,7 +467,7 @@ static void net_complete_free(void) - - } - --static void net_free(struct net *net) -+void net_passive_dec(struct net *net) - { - if (refcount_dec_and_test(&net->passive)) { - kfree(rcu_access_pointer(net->gen)); -@@ -485,7 +485,7 @@ void net_drop_ns(void *p) - struct net *net = (struct net *)p; - - if (net) -- net_free(net); -+ net_passive_dec(net); - } - - struct net *copy_net_ns(unsigned long flags, -@@ -527,7 +527,7 @@ struct net *copy_net_ns(unsigned long flags, - key_remove_domain(net->key_domain); - #endif - put_user_ns(user_ns); -- net_free(net); -+ net_passive_dec(net); - dec_ucounts: - dec_net_namespaces(ucounts); - return ERR_PTR(rv); -@@ -672,7 +672,7 @@ static void cleanup_net(struct work_struct *work) - key_remove_domain(net->key_domain); - #endif - put_user_ns(net->user_ns); -- net_free(net); -+ net_passive_dec(net); - } - } - -diff --git a/net/core/sock.c b/net/core/sock.c -index ec48690b5174eb..b74bc8175937e2 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -2159,6 +2159,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority, - get_net_track(net, &sk->ns_tracker, priority); - sock_inuse_add(net, 1); - } else { -+ net_passive_inc(net); - __netns_tracker_alloc(net, &sk->ns_tracker, - false, priority); - } -@@ -2183,6 +2184,7 @@ EXPORT_SYMBOL(sk_alloc); - static void __sk_destruct(struct rcu_head *head) - { - struct sock *sk = container_of(head, struct sock, sk_rcu); -+ struct net *net = sock_net(sk); - struct sk_filter *filter; - - if (sk->sk_destruct) -@@ -2214,14 +2216,28 @@ static void __sk_destruct(struct rcu_head *head) - put_cred(sk->sk_peer_cred); - put_pid(sk->sk_peer_pid); - -- if (likely(sk->sk_net_refcnt)) -- put_net_track(sock_net(sk), &sk->ns_tracker); -- else -- __netns_tracker_free(sock_net(sk), &sk->ns_tracker, false); -- -+ if (likely(sk->sk_net_refcnt)) { -+ put_net_track(net, &sk->ns_tracker); -+ } else { -+ __netns_tracker_free(net, &sk->ns_tracker, false); -+ net_passive_dec(net); -+ } - sk_prot_free(sk->sk_prot_creator, sk); - } - -+void sk_net_refcnt_upgrade(struct sock *sk) -+{ -+ struct net *net = sock_net(sk); -+ -+ WARN_ON_ONCE(sk->sk_net_refcnt); -+ __netns_tracker_free(net, &sk->ns_tracker, false); -+ net_passive_dec(net); -+ sk->sk_net_refcnt = 1; -+ get_net_track(net, &sk->ns_tracker, GFP_KERNEL); -+ sock_inuse_add(net, 1); -+} -+EXPORT_SYMBOL_GPL(sk_net_refcnt_upgrade); -+ - void sk_destruct(struct sock *sk) - { - bool use_call_rcu = sock_flag(sk, SOCK_RCU_FREE); -@@ -2313,6 +2329,7 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) - * is not properly dismantling its kernel sockets at netns - * destroy time. - */ -+ net_passive_inc(sock_net(newsk)); - __netns_tracker_alloc(sock_net(newsk), &newsk->ns_tracker, - false, priority); - } -diff --git a/net/hsr/hsr_slave.c b/net/hsr/hsr_slave.c -index 1b6457f357bdb2..b8230faa567f77 100644 ---- a/net/hsr/hsr_slave.c -+++ b/net/hsr/hsr_slave.c -@@ -62,8 +62,14 @@ static rx_handler_result_t hsr_handle_frame(struct sk_buff **pskb) - skb_push(skb, ETH_HLEN); - skb_reset_mac_header(skb); - if ((!hsr->prot_version && protocol == htons(ETH_P_PRP)) || -- protocol == htons(ETH_P_HSR)) -+ protocol == htons(ETH_P_HSR)) { -+ if (!pskb_may_pull(skb, ETH_HLEN + HSR_HLEN)) { -+ kfree_skb(skb); -+ goto finish_consume; -+ } -+ - skb_set_network_header(skb, ETH_HLEN + HSR_HLEN); -+ } - skb_reset_mac_len(skb); - - hsr_forward_skb(skb, port); -diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c -index 675b5bbed638e4..2d663fe50f876c 100644 ---- a/net/ipv4/netfilter/nf_reject_ipv4.c -+++ b/net/ipv4/netfilter/nf_reject_ipv4.c -@@ -247,8 +247,7 @@ void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb, - if (!oth) - return; - -- if ((hook == NF_INET_PRE_ROUTING || hook == NF_INET_INGRESS) && -- nf_reject_fill_skb_dst(oldskb) < 0) -+ if (!skb_dst(oldskb) && nf_reject_fill_skb_dst(oldskb) < 0) - return; - - if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) -@@ -321,8 +320,7 @@ void nf_send_unreach(struct sk_buff *skb_in, int code, int hook) - if (iph->frag_off & htons(IP_OFFSET)) - return; - -- if ((hook == NF_INET_PRE_ROUTING || hook == NF_INET_INGRESS) && -- nf_reject_fill_skb_dst(skb_in) < 0) -+ if (!skb_dst(skb_in) && nf_reject_fill_skb_dst(skb_in) < 0) - return; - - if (skb_csum_unnecessary(skb_in) || -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 6ee77f7f911473..8672ebbace980b 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -2560,7 +2560,6 @@ static struct rtable *__mkroute_output(const struct fib_result *res, - do_cache = true; - if (type == RTN_BROADCAST) { - flags |= RTCF_BROADCAST | RTCF_LOCAL; -- fi = NULL; - } else if (type == RTN_MULTICAST) { - flags |= RTCF_MULTICAST | RTCF_LOCAL; - if (!ip_check_mc_rcu(in_dev, fl4->daddr, fl4->saddr, -diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c -index 3870b59f540048..9be9df2caf6540 100644 ---- a/net/ipv4/udp_offload.c -+++ b/net/ipv4/udp_offload.c -@@ -61,7 +61,7 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb, - remcsum = !!(skb_shinfo(skb)->gso_type & SKB_GSO_TUNNEL_REMCSUM); - skb->remcsum_offload = remcsum; - -- need_ipsec = skb_dst(skb) && dst_xfrm(skb_dst(skb)); -+ need_ipsec = (skb_dst(skb) && dst_xfrm(skb_dst(skb))) || skb_sec_path(skb); - /* Try to offload checksum if possible */ - offload_csum = !!(need_csum && - !need_ipsec && -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index f6188bd9f55ba6..1c3b0ba289fbd4 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -2193,13 +2193,12 @@ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp) - in6_ifa_put(ifp); - } - --/* Join to solicited addr multicast group. -- * caller must hold RTNL */ -+/* Join to solicited addr multicast group. */ - void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr) - { - struct in6_addr maddr; - -- if (dev->flags&(IFF_LOOPBACK|IFF_NOARP)) -+ if (READ_ONCE(dev->flags) & (IFF_LOOPBACK | IFF_NOARP)) - return; - - addrconf_addr_solict_mult(addr, &maddr); -@@ -3834,7 +3833,7 @@ static int addrconf_ifdown(struct net_device *dev, bool unregister) - * Do not dev_put! - */ - if (unregister) { -- idev->dead = 1; -+ WRITE_ONCE(idev->dead, 1); - - /* protected by rtnl_lock */ - RCU_INIT_POINTER(dev->ip6_ptr, NULL); -diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c -index e153dac47a530d..160b452f75e7d2 100644 ---- a/net/ipv6/mcast.c -+++ b/net/ipv6/mcast.c -@@ -906,23 +906,22 @@ static struct ifmcaddr6 *mca_alloc(struct inet6_dev *idev, - static int __ipv6_dev_mc_inc(struct net_device *dev, - const struct in6_addr *addr, unsigned int mode) - { -- struct ifmcaddr6 *mc; - struct inet6_dev *idev; -- -- ASSERT_RTNL(); -+ struct ifmcaddr6 *mc; - - /* we need to take a reference on idev */ - idev = in6_dev_get(dev); -- - if (!idev) - return -EINVAL; - -- if (idev->dead) { -+ mutex_lock(&idev->mc_lock); -+ -+ if (READ_ONCE(idev->dead)) { -+ mutex_unlock(&idev->mc_lock); - in6_dev_put(idev); - return -ENODEV; - } - -- mutex_lock(&idev->mc_lock); - for_each_mc_mclock(idev, mc) { - if (ipv6_addr_equal(&mc->mca_addr, addr)) { - mc->mca_users++; -diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c -index e4776bd2ed89bd..f3579bccf0a516 100644 ---- a/net/ipv6/netfilter/nf_reject_ipv6.c -+++ b/net/ipv6/netfilter/nf_reject_ipv6.c -@@ -293,7 +293,7 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb, - fl6.fl6_sport = otcph->dest; - fl6.fl6_dport = otcph->source; - -- if (hook == NF_INET_PRE_ROUTING || hook == NF_INET_INGRESS) { -+ if (!skb_dst(oldskb)) { - nf_ip6_route(net, &dst, flowi6_to_flowi(&fl6), false); - if (!dst) - return; -@@ -397,8 +397,7 @@ void nf_send_unreach6(struct net *net, struct sk_buff *skb_in, - if (hooknum == NF_INET_LOCAL_OUT && skb_in->dev == NULL) - skb_in->dev = net->loopback_dev; - -- if ((hooknum == NF_INET_PRE_ROUTING || hooknum == NF_INET_INGRESS) && -- nf_reject6_fill_skb_dst(skb_in) < 0) -+ if (!skb_dst(skb_in) && nf_reject6_fill_skb_dst(skb_in) < 0) - return; - - icmpv6_send(skb_in, ICMPV6_DEST_UNREACH, code, 0); -diff --git a/net/ipv6/seg6_hmac.c b/net/ipv6/seg6_hmac.c -index 3c3800223e0e0d..6e15a65faeccd7 100644 ---- a/net/ipv6/seg6_hmac.c -+++ b/net/ipv6/seg6_hmac.c -@@ -35,6 +35,7 @@ - #include - - #include -+#include - #include - #include - #include -@@ -269,7 +270,7 @@ bool seg6_hmac_validate_skb(struct sk_buff *skb) - if (seg6_hmac_compute(hinfo, srh, &ipv6_hdr(skb)->saddr, hmac_output)) - return false; - -- if (memcmp(hmac_output, tlv->hmac, SEG6_HMAC_FIELD_LEN) != 0) -+ if (crypto_memneq(hmac_output, tlv->hmac, SEG6_HMAC_FIELD_LEN)) - return false; - - return true; -@@ -293,6 +294,9 @@ int seg6_hmac_info_add(struct net *net, u32 key, struct seg6_hmac_info *hinfo) - struct seg6_pernet_data *sdata = seg6_pernet(net); - int err; - -+ if (!__hmac_get_algo(hinfo->alg_id)) -+ return -EINVAL; -+ - err = rhashtable_lookup_insert_fast(&sdata->hmac_infos, &hinfo->node, - rht_params); - -diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c -index 3ff7f38394a6bc..1addfba4b28567 100644 ---- a/net/mac80211/cfg.c -+++ b/net/mac80211/cfg.c -@@ -1847,12 +1847,12 @@ static int sta_link_apply_parameters(struct ieee80211_local *local, - } - - if (params->supported_rates && -- params->supported_rates_len) { -- ieee80211_parse_bitrates(link->conf->chandef.width, -- sband, params->supported_rates, -- params->supported_rates_len, -- &link_sta->pub->supp_rates[sband->band]); -- } -+ params->supported_rates_len && -+ !ieee80211_parse_bitrates(link->conf->chandef.width, -+ sband, params->supported_rates, -+ params->supported_rates_len, -+ &link_sta->pub->supp_rates[sband->band])) -+ return -EINVAL; - - if (params->ht_capa) - ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband, -diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c -index 31c4f112345ea4..4a21e53afa72ef 100644 ---- a/net/mac80211/chan.c -+++ b/net/mac80211/chan.c -@@ -1313,6 +1313,7 @@ ieee80211_link_use_reserved_reassign(struct ieee80211_link_data *link) - goto out; - } - -+ link->radar_required = link->reserved_radar_required; - list_move(&link->assigned_chanctx_list, &new_ctx->assigned_links); - rcu_assign_pointer(link_conf->chanctx_conf, &new_ctx->conf); - -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index 2c7e139efd532f..295c2fdbd3c742 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -3662,6 +3662,7 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata, - struct ieee80211_prep_tx_info info = { - .subtype = IEEE80211_STYPE_AUTH, - }; -+ bool sae_need_confirm = false; - - sdata_assert_lock(sdata); - -@@ -3705,6 +3706,8 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata, - jiffies + IEEE80211_AUTH_WAIT_SAE_RETRY; - ifmgd->auth_data->timeout_started = true; - run_again(sdata, ifmgd->auth_data->timeout); -+ if (auth_transaction == 1) -+ sae_need_confirm = true; - goto notify_driver; - } - -@@ -3747,6 +3750,9 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata, - ifmgd->auth_data->expected_transaction == 2)) { - if (!ieee80211_mark_sta_auth(sdata)) - return; /* ignore frame -- wait for timeout */ -+ } else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE && -+ auth_transaction == 1) { -+ sae_need_confirm = true; - } else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE && - auth_transaction == 2) { - sdata_info(sdata, "SAE peer confirmed\n"); -@@ -3755,7 +3761,8 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata, - - cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len); - notify_driver: -- drv_mgd_complete_tx(sdata->local, sdata, &info); -+ if (!sae_need_confirm) -+ drv_mgd_complete_tx(sdata->local, sdata, &info); - } - - #define case_WLAN(type) \ -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index 58665b6ae6354b..210337ef23cf5c 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -4221,10 +4221,16 @@ static bool ieee80211_rx_data_set_sta(struct ieee80211_rx_data *rx, - rx->link_sta = NULL; - } - -- if (link_id < 0) -- rx->link = &rx->sdata->deflink; -- else if (!ieee80211_rx_data_set_link(rx, link_id)) -+ if (link_id < 0) { -+ if (ieee80211_vif_is_mld(&rx->sdata->vif) && -+ sta && !sta->sta.valid_links) -+ rx->link = -+ rcu_dereference(rx->sdata->link[sta->deflink.link_id]); -+ else -+ rx->link = &rx->sdata->deflink; -+ } else if (!ieee80211_rx_data_set_link(rx, link_id)) { - return false; -+ } - - return true; - } -diff --git a/net/mctp/af_mctp.c b/net/mctp/af_mctp.c -index 8032cfba22d1c5..5f9592fb57add2 100644 ---- a/net/mctp/af_mctp.c -+++ b/net/mctp/af_mctp.c -@@ -73,7 +73,6 @@ static int mctp_bind(struct socket *sock, struct sockaddr *addr, int addrlen) - - lock_sock(sk); - -- /* TODO: allow rebind */ - if (sk_hashed(sk)) { - rc = -EADDRINUSE; - goto out_release; -@@ -549,15 +548,36 @@ static void mctp_sk_close(struct sock *sk, long timeout) - static int mctp_sk_hash(struct sock *sk) - { - struct net *net = sock_net(sk); -+ struct sock *existing; -+ struct mctp_sock *msk; -+ int rc; -+ -+ msk = container_of(sk, struct mctp_sock, sk); - - /* Bind lookup runs under RCU, remain live during that. */ - sock_set_flag(sk, SOCK_RCU_FREE); - - mutex_lock(&net->mctp.bind_lock); -+ -+ /* Prevent duplicate binds. */ -+ sk_for_each(existing, &net->mctp.binds) { -+ struct mctp_sock *mex = -+ container_of(existing, struct mctp_sock, sk); -+ -+ if (mex->bind_type == msk->bind_type && -+ mex->bind_addr == msk->bind_addr && -+ mex->bind_net == msk->bind_net) { -+ rc = -EADDRINUSE; -+ goto out; -+ } -+ } -+ - sk_add_node_rcu(sk, &net->mctp.binds); -- mutex_unlock(&net->mctp.bind_lock); -+ rc = 0; - -- return 0; -+out: -+ mutex_unlock(&net->mctp.bind_lock); -+ return rc; - } - - static void mctp_sk_unhash(struct sock *sk) -diff --git a/net/mptcp/options.c b/net/mptcp/options.c -index 8d4889a730064d..9406d2d555e74d 100644 ---- a/net/mptcp/options.c -+++ b/net/mptcp/options.c -@@ -1117,7 +1117,9 @@ static bool add_addr_hmac_valid(struct mptcp_sock *msk, - return hmac == mp_opt->ahmac; - } - --/* Return false if a subflow has been reset, else return true */ -+/* Return false in case of error (or subflow has been reset), -+ * else return true. -+ */ - bool mptcp_incoming_options(struct sock *sk, struct sk_buff *skb) - { - struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk); -@@ -1221,7 +1223,7 @@ bool mptcp_incoming_options(struct sock *sk, struct sk_buff *skb) - - mpext = skb_ext_add(skb, SKB_EXT_MPTCP); - if (!mpext) -- return true; -+ return false; - - memset(mpext, 0, sizeof(*mpext)); - -diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c -index f7257de37bd090..e8042014bd5f4a 100644 ---- a/net/mptcp/pm_netlink.c -+++ b/net/mptcp/pm_netlink.c -@@ -294,6 +294,7 @@ static void mptcp_pm_add_timer(struct timer_list *timer) - struct mptcp_pm_add_entry *entry = from_timer(entry, timer, add_timer); - struct mptcp_sock *msk = entry->sock; - struct sock *sk = (struct sock *)msk; -+ unsigned int timeout; - - pr_debug("msk=%p\n", msk); - -@@ -311,6 +312,10 @@ static void mptcp_pm_add_timer(struct timer_list *timer) - goto out; - } - -+ timeout = mptcp_get_add_addr_timeout(sock_net(sk)); -+ if (!timeout) -+ goto out; -+ - spin_lock_bh(&msk->pm.lock); - - if (!mptcp_pm_should_add_signal_addr(msk)) { -@@ -322,7 +327,7 @@ static void mptcp_pm_add_timer(struct timer_list *timer) - - if (entry->retrans_times < ADD_ADDR_RETRANS_MAX) - sk_reset_timer(sk, timer, -- jiffies + mptcp_get_add_addr_timeout(sock_net(sk))); -+ jiffies + timeout); - - spin_unlock_bh(&msk->pm.lock); - -@@ -364,6 +369,7 @@ bool mptcp_pm_alloc_anno_list(struct mptcp_sock *msk, - struct mptcp_pm_add_entry *add_entry = NULL; - struct sock *sk = (struct sock *)msk; - struct net *net = sock_net(sk); -+ unsigned int timeout; - - lockdep_assert_held(&msk->pm.lock); - -@@ -373,9 +379,7 @@ bool mptcp_pm_alloc_anno_list(struct mptcp_sock *msk, - if (WARN_ON_ONCE(mptcp_pm_is_kernel(msk))) - return false; - -- sk_reset_timer(sk, &add_entry->add_timer, -- jiffies + mptcp_get_add_addr_timeout(net)); -- return true; -+ goto reset_timer; - } - - add_entry = kmalloc(sizeof(*add_entry), GFP_ATOMIC); -@@ -389,8 +393,10 @@ bool mptcp_pm_alloc_anno_list(struct mptcp_sock *msk, - add_entry->retrans_times = 0; - - timer_setup(&add_entry->add_timer, mptcp_pm_add_timer, 0); -- sk_reset_timer(sk, &add_entry->add_timer, -- jiffies + mptcp_get_add_addr_timeout(net)); -+reset_timer: -+ timeout = mptcp_get_add_addr_timeout(net); -+ if (timeout) -+ sk_reset_timer(sk, &add_entry->add_timer, jiffies + timeout); - - return true; - } -@@ -1783,7 +1789,6 @@ static void __flush_addrs(struct list_head *list) - static void __reset_counters(struct pm_nl_pernet *pernet) - { - WRITE_ONCE(pernet->add_addr_signal_max, 0); -- WRITE_ONCE(pernet->add_addr_accept_max, 0); - WRITE_ONCE(pernet->local_addr_max, 0); - pernet->addrs = 0; - } -diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c -index a01ea18283c726..0c9b9c0c277c23 100644 ---- a/net/mptcp/subflow.c -+++ b/net/mptcp/subflow.c -@@ -1715,10 +1715,7 @@ int mptcp_subflow_create_socket(struct sock *sk, unsigned short family, - * needs it. - * Update ns_tracker to current stack trace and refcounted tracker. - */ -- __netns_tracker_free(net, &sf->sk->ns_tracker, false); -- sf->sk->sk_net_refcnt = 1; -- get_net_track(net, &sf->sk->ns_tracker, GFP_KERNEL); -- sock_inuse_add(net, 1); -+ sk_net_refcnt_upgrade(sf->sk); - err = tcp_set_ulp(sf->sk, "mptcp"); - - release_ssk: -diff --git a/net/ncsi/internal.h b/net/ncsi/internal.h -index 2c260f33b55cc5..ad1f671ffc37fa 100644 ---- a/net/ncsi/internal.h -+++ b/net/ncsi/internal.h -@@ -110,7 +110,7 @@ struct ncsi_channel_version { - u8 update; /* NCSI version update */ - char alpha1; /* NCSI version alpha1 */ - char alpha2; /* NCSI version alpha2 */ -- u8 fw_name[12]; /* Firmware name string */ -+ u8 fw_name[12 + 1]; /* Firmware name string */ - u32 fw_version; /* Firmware version */ - u16 pci_ids[4]; /* PCI identification */ - u32 mf_id; /* Manufacture ID */ -diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c -index 8668888c5a2f99..d5ed80731e8928 100644 ---- a/net/ncsi/ncsi-rsp.c -+++ b/net/ncsi/ncsi-rsp.c -@@ -775,6 +775,7 @@ static int ncsi_rsp_handler_gvi(struct ncsi_request *nr) - ncv->alpha1 = rsp->alpha1; - ncv->alpha2 = rsp->alpha2; - memcpy(ncv->fw_name, rsp->fw_name, 12); -+ ncv->fw_name[12] = '\0'; - ncv->fw_version = ntohl(rsp->fw_version); - for (i = 0; i < ARRAY_SIZE(ncv->pci_ids); i++) - ncv->pci_ids[i] = ntohs(rsp->pci_ids[i]); -diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c -index 282e9644f6fdd6..928bd2013289af 100644 ---- a/net/netfilter/nf_conntrack_netlink.c -+++ b/net/netfilter/nf_conntrack_netlink.c -@@ -859,8 +859,6 @@ ctnetlink_conntrack_event(unsigned int events, const struct nf_ct_event *item) - - static int ctnetlink_done(struct netlink_callback *cb) - { -- if (cb->args[1]) -- nf_ct_put((struct nf_conn *)cb->args[1]); - kfree(cb->data); - return 0; - } -@@ -1175,19 +1173,26 @@ static int ctnetlink_filter_match(struct nf_conn *ct, void *data) - return 0; - } - -+static unsigned long ctnetlink_get_id(const struct nf_conn *ct) -+{ -+ unsigned long id = nf_ct_get_id(ct); -+ -+ return id ? id : 1; -+} -+ - static int - ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) - { - unsigned int flags = cb->data ? NLM_F_DUMP_FILTERED : 0; - struct net *net = sock_net(skb->sk); -- struct nf_conn *ct, *last; -+ unsigned long last_id = cb->args[1]; - struct nf_conntrack_tuple_hash *h; - struct hlist_nulls_node *n; - struct nf_conn *nf_ct_evict[8]; -+ struct nf_conn *ct; - int res, i; - spinlock_t *lockp; - -- last = (struct nf_conn *)cb->args[1]; - i = 0; - - local_bh_disable(); -@@ -1224,7 +1229,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) - continue; - - if (cb->args[1]) { -- if (ct != last) -+ if (ctnetlink_get_id(ct) != last_id) - continue; - cb->args[1] = 0; - } -@@ -1237,8 +1242,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) - NFNL_MSG_TYPE(cb->nlh->nlmsg_type), - ct, true, flags); - if (res < 0) { -- nf_conntrack_get(&ct->ct_general); -- cb->args[1] = (unsigned long)ct; -+ cb->args[1] = ctnetlink_get_id(ct); - spin_unlock(lockp); - goto out; - } -@@ -1251,12 +1255,10 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) - } - out: - local_bh_enable(); -- if (last) { -+ if (last_id) { - /* nf ct hash resize happened, now clear the leftover. */ -- if ((struct nf_conn *)cb->args[1] == last) -+ if (cb->args[1] == last_id) - cb->args[1] = 0; -- -- nf_ct_put(last); - } - - while (i) { -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index 0a412d9a8e5fdb..a5ffda87daf63b 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -798,16 +798,6 @@ static int netlink_release(struct socket *sock) - - sock_prot_inuse_add(sock_net(sk), &netlink_proto, -1); - -- /* Because struct net might disappear soon, do not keep a pointer. */ -- if (!sk->sk_net_refcnt && sock_net(sk) != &init_net) { -- __netns_tracker_free(sock_net(sk), &sk->ns_tracker, false); -- /* Because of deferred_put_nlk_sk and use of work queue, -- * it is possible netns will be freed before this socket. -- */ -- sock_net_set(sk, &init_net); -- __netns_tracker_alloc(&init_net, &sk->ns_tracker, -- false, GFP_KERNEL); -- } - call_rcu(&nlk->rcu, deferred_put_nlk_sk); - return 0; - } -@@ -1229,7 +1219,7 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb, - nlk = nlk_sk(sk); - rmem = atomic_add_return(skb->truesize, &sk->sk_rmem_alloc); - -- if ((rmem == skb->truesize || rmem < READ_ONCE(sk->sk_rcvbuf)) && -+ if ((rmem == skb->truesize || rmem <= READ_ONCE(sk->sk_rcvbuf)) && - !test_bit(NETLINK_S_CONGESTED, &nlk->state)) { - netlink_skb_set_owner_r(skb, sk); - return 0; -diff --git a/net/rds/tcp.c b/net/rds/tcp.c -index 2dba7505b41489..985b05f38b6746 100644 ---- a/net/rds/tcp.c -+++ b/net/rds/tcp.c -@@ -503,12 +503,8 @@ bool rds_tcp_tune(struct socket *sock) - release_sock(sk); - return false; - } -- /* Update ns_tracker to current stack trace and refcounted tracker */ -- __netns_tracker_free(net, &sk->ns_tracker, false); -- -- sk->sk_net_refcnt = 1; -- netns_tracker_alloc(net, &sk->ns_tracker, GFP_KERNEL); -- sock_inuse_add(net, 1); -+ sk_net_refcnt_upgrade(sk); -+ put_net(net); - } - rtn = net_generic(net, rds_tcp_netid); - if (rtn->sndbuf_size > 0) { -diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c -index 09242578dac5bc..85984c91cf51fe 100644 ---- a/net/sched/sch_cake.c -+++ b/net/sched/sch_cake.c -@@ -1762,7 +1762,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - ktime_t now = ktime_get(); - struct cake_tin_data *b; - struct cake_flow *flow; -- u32 idx; -+ u32 idx, tin; - - /* choose flow to insert into */ - idx = cake_classify(sch, &b, skb, q->flow_mode, &ret); -@@ -1772,6 +1772,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - __qdisc_drop(skb, to_free); - return ret; - } -+ tin = (u32)(b - q->tins); - idx--; - flow = &b->flows[idx]; - -@@ -1939,13 +1940,22 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - q->buffer_max_used = q->buffer_used; - - if (q->buffer_used > q->buffer_limit) { -+ bool same_flow = false; - u32 dropped = 0; -+ u32 drop_id; - - while (q->buffer_used > q->buffer_limit) { - dropped++; -- cake_drop(sch, to_free); -+ drop_id = cake_drop(sch, to_free); -+ -+ if ((drop_id >> 16) == tin && -+ (drop_id & 0xFFFF) == idx) -+ same_flow = true; - } - b->drop_overlimit += dropped; -+ -+ if (same_flow) -+ return NET_XMIT_CN; - } - return NET_XMIT_SUCCESS; - } -diff --git a/net/sched/sch_ets.c b/net/sched/sch_ets.c -index 3ee46f6e005da0..9873f4ae90c3aa 100644 ---- a/net/sched/sch_ets.c -+++ b/net/sched/sch_ets.c -@@ -651,23 +651,24 @@ static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt, - - sch_tree_lock(sch); - -- q->nbands = nbands; -+ for (i = nbands; i < oldbands; i++) { -+ if (i >= q->nstrict && q->classes[i].qdisc->q.qlen) -+ list_del_init(&q->classes[i].alist); -+ qdisc_purge_queue(q->classes[i].qdisc); -+ } -+ -+ WRITE_ONCE(q->nbands, nbands); - for (i = nstrict; i < q->nstrict; i++) { - if (q->classes[i].qdisc->q.qlen) { - list_add_tail(&q->classes[i].alist, &q->active); - q->classes[i].deficit = quanta[i]; - } - } -- for (i = q->nbands; i < oldbands; i++) { -- if (i >= q->nstrict && q->classes[i].qdisc->q.qlen) -- list_del_init(&q->classes[i].alist); -- qdisc_purge_queue(q->classes[i].qdisc); -- } -- q->nstrict = nstrict; -+ WRITE_ONCE(q->nstrict, nstrict); - memcpy(q->prio2band, priomap, sizeof(priomap)); - - for (i = 0; i < q->nbands; i++) -- q->classes[i].quantum = quanta[i]; -+ WRITE_ONCE(q->classes[i].quantum, quanta[i]); - - for (i = oldbands; i < q->nbands; i++) { - q->classes[i].qdisc = queues[i]; -@@ -681,7 +682,7 @@ static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt, - for (i = q->nbands; i < oldbands; i++) { - qdisc_put(q->classes[i].qdisc); - q->classes[i].qdisc = NULL; -- q->classes[i].quantum = 0; -+ WRITE_ONCE(q->classes[i].quantum, 0); - q->classes[i].deficit = 0; - gnet_stats_basic_sync_init(&q->classes[i].bstats); - memset(&q->classes[i].qstats, 0, sizeof(q->classes[i].qstats)); -@@ -738,6 +739,7 @@ static int ets_qdisc_dump(struct Qdisc *sch, struct sk_buff *skb) - struct ets_sched *q = qdisc_priv(sch); - struct nlattr *opts; - struct nlattr *nest; -+ u8 nbands, nstrict; - int band; - int prio; - int err; -@@ -750,21 +752,22 @@ static int ets_qdisc_dump(struct Qdisc *sch, struct sk_buff *skb) - if (!opts) - goto nla_err; - -- if (nla_put_u8(skb, TCA_ETS_NBANDS, q->nbands)) -+ nbands = READ_ONCE(q->nbands); -+ if (nla_put_u8(skb, TCA_ETS_NBANDS, nbands)) - goto nla_err; - -- if (q->nstrict && -- nla_put_u8(skb, TCA_ETS_NSTRICT, q->nstrict)) -+ nstrict = READ_ONCE(q->nstrict); -+ if (nstrict && nla_put_u8(skb, TCA_ETS_NSTRICT, nstrict)) - goto nla_err; - -- if (q->nbands > q->nstrict) { -+ if (nbands > nstrict) { - nest = nla_nest_start(skb, TCA_ETS_QUANTA); - if (!nest) - goto nla_err; - -- for (band = q->nstrict; band < q->nbands; band++) { -+ for (band = nstrict; band < nbands; band++) { - if (nla_put_u32(skb, TCA_ETS_QUANTA_BAND, -- q->classes[band].quantum)) -+ READ_ONCE(q->classes[band].quantum))) - goto nla_err; - } - -@@ -776,7 +779,8 @@ static int ets_qdisc_dump(struct Qdisc *sch, struct sk_buff *skb) - goto nla_err; - - for (prio = 0; prio <= TC_PRIO_MAX; prio++) { -- if (nla_put_u8(skb, TCA_ETS_PRIOMAP_BAND, q->prio2band[prio])) -+ if (nla_put_u8(skb, TCA_ETS_PRIOMAP_BAND, -+ READ_ONCE(q->prio2band[prio]))) - goto nla_err; - } - -diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c -index 113b305b0d154c..c8a426062923ac 100644 ---- a/net/sched/sch_htb.c -+++ b/net/sched/sch_htb.c -@@ -592,7 +592,7 @@ htb_change_class_mode(struct htb_sched *q, struct htb_class *cl, s64 *diff) - */ - static inline void htb_activate(struct htb_sched *q, struct htb_class *cl) - { -- WARN_ON(cl->level || !cl->leaf.q || !cl->leaf.q->q.qlen); -+ WARN_ON(cl->level || !cl->leaf.q); - - if (!cl->prio_activity) { - cl->prio_activity = 1 << cl->prio; -diff --git a/net/sctp/input.c b/net/sctp/input.c -index a8a254a5008e52..032a10d82302c3 100644 ---- a/net/sctp/input.c -+++ b/net/sctp/input.c -@@ -117,7 +117,7 @@ int sctp_rcv(struct sk_buff *skb) - * it's better to just linearize it otherwise crc computing - * takes longer. - */ -- if ((!is_gso && skb_linearize(skb)) || -+ if (((!is_gso || skb_cloned(skb)) && skb_linearize(skb)) || - !pskb_may_pull(skb, sizeof(struct sctphdr))) - goto discard_it; - -diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c -index 45efbbfff94ae2..b3bfd0f18d4180 100644 ---- a/net/smc/af_smc.c -+++ b/net/smc/af_smc.c -@@ -2553,8 +2553,9 @@ static void smc_listen_work(struct work_struct *work) - goto out_decl; - } - -- smc_listen_out_connected(new_smc); - SMC_STAT_SERV_SUCC_INC(sock_net(newclcsock->sk), ini); -+ /* smc_listen_out() will release smcsk */ -+ smc_listen_out_connected(new_smc); - goto out_free; - - out_unlock: -@@ -3343,10 +3344,7 @@ int smc_create_clcsk(struct net *net, struct sock *sk, int family) - * which need net ref. - */ - sk = smc->clcsock->sk; -- __netns_tracker_free(net, &sk->ns_tracker, false); -- sk->sk_net_refcnt = 1; -- get_net_track(net, &sk->ns_tracker, GFP_KERNEL); -- sock_inuse_add(net, 1); -+ sk_net_refcnt_upgrade(sk); - return 0; - } - -diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c -index 7229b4a9ad1dcf..78b139d8c1f3b9 100644 ---- a/net/sunrpc/svcsock.c -+++ b/net/sunrpc/svcsock.c -@@ -1579,10 +1579,7 @@ static struct svc_xprt *svc_create_socket(struct svc_serv *serv, - newlen = error; - - if (protocol == IPPROTO_TCP) { -- __netns_tracker_free(net, &sock->sk->ns_tracker, false); -- sock->sk->sk_net_refcnt = 1; -- get_net_track(net, &sock->sk->ns_tracker, GFP_KERNEL); -- sock_inuse_add(net, 1); -+ sk_net_refcnt_upgrade(sock->sk); - if ((error = kernel_listen(sock, 64)) < 0) - goto bummer; - } -diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c -index 99bb3e762af46f..8b27a21f3b42d8 100644 ---- a/net/sunrpc/xprtsock.c -+++ b/net/sunrpc/xprtsock.c -@@ -1941,12 +1941,8 @@ static struct socket *xs_create_sock(struct rpc_xprt *xprt, - goto out; - } - -- if (protocol == IPPROTO_TCP) { -- __netns_tracker_free(xprt->xprt_net, &sock->sk->ns_tracker, false); -- sock->sk->sk_net_refcnt = 1; -- get_net_track(xprt->xprt_net, &sock->sk->ns_tracker, GFP_KERNEL); -- sock_inuse_add(xprt->xprt_net, 1); -- } -+ if (protocol == IPPROTO_TCP) -+ sk_net_refcnt_upgrade(sock->sk); - - filp = sock_alloc_file(sock, O_NONBLOCK, NULL); - if (IS_ERR(filp)) -diff --git a/net/tls/tls.h b/net/tls/tls.h -index 02038d0381b754..5dc61c85c076ec 100644 ---- a/net/tls/tls.h -+++ b/net/tls/tls.h -@@ -192,7 +192,7 @@ void tls_strp_msg_done(struct tls_strparser *strp); - int tls_rx_msg_size(struct tls_strparser *strp, struct sk_buff *skb); - void tls_rx_msg_ready(struct tls_strparser *strp); - --void tls_strp_msg_load(struct tls_strparser *strp, bool force_refresh); -+bool tls_strp_msg_load(struct tls_strparser *strp, bool force_refresh); - int tls_strp_msg_cow(struct tls_sw_context_rx *ctx); - struct sk_buff *tls_strp_msg_detach(struct tls_sw_context_rx *ctx); - int tls_strp_msg_hold(struct tls_strparser *strp, struct sk_buff_head *dst); -diff --git a/net/tls/tls_strp.c b/net/tls/tls_strp.c -index bea60b0160d1fc..6ce64a6e4495ec 100644 ---- a/net/tls/tls_strp.c -+++ b/net/tls/tls_strp.c -@@ -474,7 +474,7 @@ static void tls_strp_load_anchor_with_queue(struct tls_strparser *strp, int len) - strp->stm.offset = offset; - } - --void tls_strp_msg_load(struct tls_strparser *strp, bool force_refresh) -+bool tls_strp_msg_load(struct tls_strparser *strp, bool force_refresh) - { - struct strp_msg *rxm; - struct tls_msg *tlm; -@@ -483,8 +483,11 @@ void tls_strp_msg_load(struct tls_strparser *strp, bool force_refresh) - DEBUG_NET_WARN_ON_ONCE(!strp->stm.full_len); - - if (!strp->copy_mode && force_refresh) { -- if (WARN_ON(tcp_inq(strp->sk) < strp->stm.full_len)) -- return; -+ if (unlikely(tcp_inq(strp->sk) < strp->stm.full_len)) { -+ WRITE_ONCE(strp->msg_ready, 0); -+ memset(&strp->stm, 0, sizeof(strp->stm)); -+ return false; -+ } - - tls_strp_load_anchor_with_queue(strp, strp->stm.full_len); - } -@@ -494,6 +497,8 @@ void tls_strp_msg_load(struct tls_strparser *strp, bool force_refresh) - rxm->offset = strp->stm.offset; - tlm = tls_msg(strp->anchor); - tlm->control = strp->mark; -+ -+ return true; - } - - /* Called with lock held on lower socket */ -diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c -index 4905a81c4ac194..27ce1feb79e14e 100644 ---- a/net/tls/tls_sw.c -+++ b/net/tls/tls_sw.c -@@ -1380,7 +1380,8 @@ tls_rx_rec_wait(struct sock *sk, struct sk_psock *psock, bool nonblock, - return sock_intr_errno(timeo); - } - -- tls_strp_msg_load(&ctx->strp, released); -+ if (unlikely(!tls_strp_msg_load(&ctx->strp, released))) -+ return tls_rx_rec_wait(sk, psock, nonblock, false); - - return 1; - } -@@ -1773,6 +1774,9 @@ int decrypt_skb(struct sock *sk, struct scatterlist *sgout) - return tls_decrypt_sg(sk, NULL, sgout, &darg); - } - -+/* All records returned from a recvmsg() call must have the same type. -+ * 0 is not a valid content type. Use it as "no type reported, yet". -+ */ - static int tls_record_content_type(struct msghdr *msg, struct tls_msg *tlm, - u8 *control) - { -@@ -2016,8 +2020,10 @@ int tls_sw_recvmsg(struct sock *sk, - if (err < 0) - goto end; - -+ /* process_rx_list() will set @control if it processed any records */ - copied = err; -- if (len <= copied || (copied && control != TLS_RECORD_TYPE_DATA) || rx_more) -+ if (len <= copied || rx_more || -+ (control && control != TLS_RECORD_TYPE_DATA)) - goto end; - - target = sock_rcvlowat(sk, flags & MSG_WAITALL, len); -diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c -index 2925f5d27ad3fb..e1d7ce8dac082e 100644 ---- a/net/vmw_vsock/virtio_transport.c -+++ b/net/vmw_vsock/virtio_transport.c -@@ -221,7 +221,7 @@ virtio_transport_cancel_pkt(struct vsock_sock *vsk) - - static void virtio_vsock_rx_fill(struct virtio_vsock *vsock) - { -- int total_len = VIRTIO_VSOCK_DEFAULT_RX_BUF_SIZE + VIRTIO_VSOCK_SKB_HEADROOM; -+ int total_len = VIRTIO_VSOCK_DEFAULT_RX_BUF_SIZE; - struct scatterlist pkt, *p; - struct virtqueue *vq; - struct sk_buff *skb; -@@ -497,8 +497,9 @@ static void virtio_transport_rx_work(struct work_struct *work) - do { - virtqueue_disable_cb(vq); - for (;;) { -+ unsigned int len, payload_len; -+ struct virtio_vsock_hdr *hdr; - struct sk_buff *skb; -- unsigned int len; - - if (!virtio_transport_more_replies(vsock)) { - /* Stop rx until the device processes already -@@ -515,12 +516,19 @@ static void virtio_transport_rx_work(struct work_struct *work) - vsock->rx_buf_nr--; - - /* Drop short/long packets */ -- if (unlikely(len < sizeof(struct virtio_vsock_hdr) || -+ if (unlikely(len < sizeof(*hdr) || - len > virtio_vsock_skb_len(skb))) { - kfree_skb(skb); - continue; - } - -+ hdr = virtio_vsock_hdr(skb); -+ payload_len = le32_to_cpu(hdr->len); -+ if (unlikely(payload_len > len - sizeof(*hdr))) { -+ kfree_skb(skb); -+ continue; -+ } -+ - virtio_vsock_skb_rx_put(skb); - virtio_transport_deliver_tap_pkt(skb); - virtio_transport_recv_pkt(&virtio_transport, skb); -diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c -index 55a1d3633853fa..3d631f8073f06b 100644 ---- a/net/wireless/mlme.c -+++ b/net/wireless/mlme.c -@@ -739,7 +739,8 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev, - - mgmt = (const struct ieee80211_mgmt *)params->buf; - -- if (!ieee80211_is_mgmt(mgmt->frame_control)) -+ if (!ieee80211_is_mgmt(mgmt->frame_control) || -+ ieee80211_has_order(mgmt->frame_control)) - return -EINVAL; - - stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE; -diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c -index d2bd5bddfb05d8..acfbe1f013d1b8 100644 ---- a/net/xfrm/xfrm_state.c -+++ b/net/xfrm/xfrm_state.c -@@ -1466,6 +1466,26 @@ struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi, - } - EXPORT_SYMBOL(xfrm_state_lookup_byspi); - -+static struct xfrm_state *xfrm_state_lookup_spi_proto(struct net *net, __be32 spi, u8 proto) -+{ -+ struct xfrm_state *x; -+ unsigned int i; -+ -+ rcu_read_lock(); -+ for (i = 0; i <= net->xfrm.state_hmask; i++) { -+ hlist_for_each_entry_rcu(x, &net->xfrm.state_byspi[i], byspi) { -+ if (x->id.spi == spi && x->id.proto == proto) { -+ if (!xfrm_state_hold_rcu(x)) -+ continue; -+ rcu_read_unlock(); -+ return x; -+ } -+ } -+ } -+ rcu_read_unlock(); -+ return NULL; -+} -+ - static void __xfrm_state_insert(struct xfrm_state *x) - { - struct net *net = xs_net(x); -@@ -2259,10 +2279,8 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high, - unsigned int h; - struct xfrm_state *x0; - int err = -ENOENT; -- __be32 minspi = htonl(low); -- __be32 maxspi = htonl(high); -+ u32 range = high - low + 1; - __be32 newspi = 0; -- u32 mark = x->mark.v & x->mark.m; - - spin_lock_bh(&x->lock); - if (x->km.state == XFRM_STATE_DEAD) { -@@ -2276,38 +2294,34 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high, - - err = -ENOENT; - -- if (minspi == maxspi) { -- x0 = xfrm_state_lookup(net, mark, &x->id.daddr, minspi, x->id.proto, x->props.family); -- if (x0) { -- NL_SET_ERR_MSG(extack, "Requested SPI is already in use"); -- xfrm_state_put(x0); -+ for (h = 0; h < range; h++) { -+ u32 spi = (low == high) ? low : get_random_u32_inclusive(low, high); -+ newspi = htonl(spi); -+ -+ spin_lock_bh(&net->xfrm.xfrm_state_lock); -+ x0 = xfrm_state_lookup_spi_proto(net, newspi, x->id.proto); -+ if (!x0) { -+ x->id.spi = newspi; -+ h = xfrm_spi_hash(net, &x->id.daddr, newspi, x->id.proto, x->props.family); -+ XFRM_STATE_INSERT(byspi, &x->byspi, net->xfrm.state_byspi + h, x->xso.type); -+ spin_unlock_bh(&net->xfrm.xfrm_state_lock); -+ err = 0; - goto unlock; - } -- newspi = minspi; -- } else { -- u32 spi = 0; -- for (h = 0; h < high-low+1; h++) { -- spi = get_random_u32_inclusive(low, high); -- x0 = xfrm_state_lookup(net, mark, &x->id.daddr, htonl(spi), x->id.proto, x->props.family); -- if (x0 == NULL) { -- newspi = htonl(spi); -- break; -- } -- xfrm_state_put(x0); -+ xfrm_state_put(x0); -+ spin_unlock_bh(&net->xfrm.xfrm_state_lock); -+ -+ if (signal_pending(current)) { -+ err = -ERESTARTSYS; -+ goto unlock; - } -+ -+ if (low == high) -+ break; - } -- if (newspi) { -- spin_lock_bh(&net->xfrm.xfrm_state_lock); -- x->id.spi = newspi; -- h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family); -- XFRM_STATE_INSERT(byspi, &x->byspi, net->xfrm.state_byspi + h, -- x->xso.type); -- spin_unlock_bh(&net->xfrm.xfrm_state_lock); - -- err = 0; -- } else { -+ if (err) - NL_SET_ERR_MSG(extack, "No SPI available in the requested range"); -- } - - unlock: - spin_unlock_bh(&x->lock); -diff --git a/scripts/kconfig/gconf.c b/scripts/kconfig/gconf.c -index 9e52c7360e55b4..2b99d18e703d8a 100644 ---- a/scripts/kconfig/gconf.c -+++ b/scripts/kconfig/gconf.c -@@ -780,7 +780,7 @@ static void renderer_edited(GtkCellRendererText * cell, - struct symbol *sym; - - if (!gtk_tree_model_get_iter(model2, &iter, path)) -- return; -+ goto free; - - gtk_tree_model_get(model2, &iter, COL_MENU, &menu, -1); - sym = menu->sym; -@@ -792,6 +792,7 @@ static void renderer_edited(GtkCellRendererText * cell, - - update_tree(&rootmenu, NULL); - -+free: - gtk_tree_path_free(path); - } - -@@ -974,13 +975,14 @@ on_treeview2_key_press_event(GtkWidget * widget, - void - on_treeview2_cursor_changed(GtkTreeView * treeview, gpointer user_data) - { -+ GtkTreeModel *model = gtk_tree_view_get_model(treeview); - GtkTreeSelection *selection; - GtkTreeIter iter; - struct menu *menu; - - selection = gtk_tree_view_get_selection(treeview); -- if (gtk_tree_selection_get_selected(selection, &model2, &iter)) { -- gtk_tree_model_get(model2, &iter, COL_MENU, &menu, -1); -+ if (gtk_tree_selection_get_selected(selection, &model, &iter)) { -+ gtk_tree_model_get(model, &iter, COL_MENU, &menu, -1); - text_insert_help(menu); - } - } -diff --git a/scripts/kconfig/lxdialog/inputbox.c b/scripts/kconfig/lxdialog/inputbox.c -index 1dcfb288ee6363..327b60cdb8dace 100644 ---- a/scripts/kconfig/lxdialog/inputbox.c -+++ b/scripts/kconfig/lxdialog/inputbox.c -@@ -39,8 +39,10 @@ int dialog_inputbox(const char *title, const char *prompt, int height, int width - - if (!init) - instr[0] = '\0'; -- else -- strcpy(instr, init); -+ else { -+ strncpy(instr, init, sizeof(dialog_input_result) - 1); -+ instr[sizeof(dialog_input_result) - 1] = '\0'; -+ } - - do_resize: - if (getmaxy(stdscr) <= (height - INPUTBOX_HEIGTH_MIN)) -diff --git a/scripts/kconfig/lxdialog/menubox.c b/scripts/kconfig/lxdialog/menubox.c -index 0e333284e947bc..6bb8a320a4cb8d 100644 ---- a/scripts/kconfig/lxdialog/menubox.c -+++ b/scripts/kconfig/lxdialog/menubox.c -@@ -264,7 +264,7 @@ int dialog_menu(const char *title, const char *prompt, - if (key < 256 && isalpha(key)) - key = tolower(key); - -- if (strchr("ynmh", key)) -+ if (strchr("ynmh ", key)) - i = max_choice; - else { - for (i = choice + 1; i < max_choice; i++) { -diff --git a/scripts/kconfig/nconf.c b/scripts/kconfig/nconf.c -index 8cd72fe2597405..7a17c94a159418 100644 ---- a/scripts/kconfig/nconf.c -+++ b/scripts/kconfig/nconf.c -@@ -591,6 +591,8 @@ static void item_add_str(const char *fmt, ...) - tmp_str, - sizeof(k_menu_items[index].str)); - -+ k_menu_items[index].str[sizeof(k_menu_items[index].str) - 1] = '\0'; -+ - free_item(curses_menu_items[index]); - curses_menu_items[index] = new_item( - k_menu_items[index].str, -diff --git a/scripts/kconfig/nconf.gui.c b/scripts/kconfig/nconf.gui.c -index 25a7263ef3c8c5..5f13a0a7fb0bec 100644 ---- a/scripts/kconfig/nconf.gui.c -+++ b/scripts/kconfig/nconf.gui.c -@@ -349,6 +349,7 @@ int dialog_inputbox(WINDOW *main_window, - x = (columns-win_cols)/2; - - strncpy(result, init, *result_len); -+ result[*result_len - 1] = '\0'; - - /* create the windows */ - win = newwin(win_lines, win_cols, y, x); -diff --git a/security/apparmor/file.c b/security/apparmor/file.c -index 6fd21324a097f6..a51b83cf696899 100644 ---- a/security/apparmor/file.c -+++ b/security/apparmor/file.c -@@ -436,9 +436,11 @@ int aa_path_link(const struct cred *subj_cred, - { - struct path link = { .mnt = new_dir->mnt, .dentry = new_dentry }; - struct path target = { .mnt = new_dir->mnt, .dentry = old_dentry }; -+ struct inode *inode = d_backing_inode(old_dentry); -+ vfsuid_t vfsuid = i_uid_into_vfsuid(mnt_idmap(target.mnt), inode); - struct path_cond cond = { -- d_backing_inode(old_dentry)->i_uid, -- d_backing_inode(old_dentry)->i_mode -+ .uid = vfsuid_into_kuid(vfsuid), -+ .mode = inode->i_mode, - }; - char *buffer = NULL, *buffer2 = NULL; - struct aa_profile *profile; -diff --git a/security/apparmor/include/lib.h b/security/apparmor/include/lib.h -index 73c8a32c68613e..6e88e99da80f6b 100644 ---- a/security/apparmor/include/lib.h -+++ b/security/apparmor/include/lib.h -@@ -46,7 +46,11 @@ - #define AA_BUG_FMT(X, fmt, args...) \ - WARN((X), "AppArmor WARN %s: (" #X "): " fmt, __func__, ##args) - #else --#define AA_BUG_FMT(X, fmt, args...) no_printk(fmt, ##args) -+#define AA_BUG_FMT(X, fmt, args...) \ -+ do { \ -+ BUILD_BUG_ON_INVALID(X); \ -+ no_printk(fmt, ##args); \ -+ } while (0) - #endif - - #define AA_ERROR(fmt, args...) \ -diff --git a/security/inode.c b/security/inode.c -index 3aa75fffa8c929..a90b043695d92c 100644 ---- a/security/inode.c -+++ b/security/inode.c -@@ -159,7 +159,6 @@ static struct dentry *securityfs_create_dentry(const char *name, umode_t mode, - inode->i_fop = fops; - } - d_instantiate(dentry, inode); -- dget(dentry); - inode_unlock(dir); - return dentry; - -@@ -306,7 +305,6 @@ void securityfs_remove(struct dentry *dentry) - simple_rmdir(dir, dentry); - else - simple_unlink(dir, dentry); -- dput(dentry); - } - inode_unlock(dir); - simple_release_fs(&mount, &mount_count); -diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c -index 31fc20350fd96e..f37fd1e48740f1 100644 ---- a/sound/core/pcm_native.c -+++ b/sound/core/pcm_native.c -@@ -24,6 +24,7 @@ - #include - #include - #include -+#include - - #include "pcm_local.h" - -@@ -3125,13 +3126,23 @@ struct snd_pcm_sync_ptr32 { - static snd_pcm_uframes_t recalculate_boundary(struct snd_pcm_runtime *runtime) - { - snd_pcm_uframes_t boundary; -+ snd_pcm_uframes_t border; -+ int order; - - if (! runtime->buffer_size) - return 0; -- boundary = runtime->buffer_size; -- while (boundary * 2 <= 0x7fffffffUL - runtime->buffer_size) -- boundary *= 2; -- return boundary; -+ -+ border = 0x7fffffffUL - runtime->buffer_size; -+ if (runtime->buffer_size > border) -+ return runtime->buffer_size; -+ -+ order = __fls(border) - __fls(runtime->buffer_size); -+ boundary = runtime->buffer_size << order; -+ -+ if (boundary <= border) -+ return boundary; -+ else -+ return boundary / 2; - } - - static int snd_pcm_ioctl_sync_ptr_compat(struct snd_pcm_substream *substream, -diff --git a/sound/hda/hdac_device.c b/sound/hda/hdac_device.c -index bbf7bcdb449a8b..0a9223c18d77c3 100644 ---- a/sound/hda/hdac_device.c -+++ b/sound/hda/hdac_device.c -@@ -611,7 +611,7 @@ EXPORT_SYMBOL_GPL(snd_hdac_power_up_pm); - int snd_hdac_keep_power_up(struct hdac_device *codec) - { - if (!atomic_inc_not_zero(&codec->in_pm)) { -- int ret = pm_runtime_get_if_active(&codec->dev, true); -+ int ret = pm_runtime_get_if_active(&codec->dev); - if (!ret) - return -1; - if (ret < 0) -diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c -index aa6dc00985b514..80c3084189b039 100644 ---- a/sound/pci/hda/hda_codec.c -+++ b/sound/pci/hda/hda_codec.c -@@ -641,24 +641,16 @@ static void hda_jackpoll_work(struct work_struct *work) - struct hda_codec *codec = - container_of(work, struct hda_codec, jackpoll_work.work); - -- /* for non-polling trigger: we need nothing if already powered on */ -- if (!codec->jackpoll_interval && snd_hdac_is_power_on(&codec->core)) -+ if (!codec->jackpoll_interval) - return; - - /* the power-up/down sequence triggers the runtime resume */ -- snd_hda_power_up_pm(codec); -+ snd_hda_power_up(codec); - /* update jacks manually if polling is required, too */ -- if (codec->jackpoll_interval) { -- snd_hda_jack_set_dirty_all(codec); -- snd_hda_jack_poll_all(codec); -- } -- snd_hda_power_down_pm(codec); -- -- if (!codec->jackpoll_interval) -- return; -- -- schedule_delayed_work(&codec->jackpoll_work, -- codec->jackpoll_interval); -+ snd_hda_jack_set_dirty_all(codec); -+ snd_hda_jack_poll_all(codec); -+ schedule_delayed_work(&codec->jackpoll_work, codec->jackpoll_interval); -+ snd_hda_power_down(codec); - } - - /* release all pincfg lists */ -@@ -2920,12 +2912,12 @@ static void hda_call_codec_resume(struct hda_codec *codec) - snd_hda_regmap_sync(codec); - } - -- if (codec->jackpoll_interval) -- hda_jackpoll_work(&codec->jackpoll_work.work); -- else -- snd_hda_jack_report_sync(codec); -+ snd_hda_jack_report_sync(codec); - codec->core.dev.power.power_state = PMSG_ON; - snd_hdac_leave_pm(&codec->core); -+ if (codec->jackpoll_interval) -+ schedule_delayed_work(&codec->jackpoll_work, -+ codec->jackpoll_interval); - } - - static int hda_codec_runtime_suspend(struct device *dev) -@@ -2937,8 +2929,6 @@ static int hda_codec_runtime_suspend(struct device *dev) - if (!codec->card) - return 0; - -- cancel_delayed_work_sync(&codec->jackpoll_work); -- - state = hda_call_codec_suspend(codec); - if (codec->link_down_at_suspend || - (codec_has_clkstop(codec) && codec_has_epss(codec) && -@@ -2946,10 +2936,6 @@ static int hda_codec_runtime_suspend(struct device *dev) - snd_hdac_codec_link_down(&codec->core); - snd_hda_codec_display_power(codec, false); - -- if (codec->bus->jackpoll_in_suspend && -- (dev->power.power_state.event != PM_EVENT_SUSPEND)) -- schedule_delayed_work(&codec->jackpoll_work, -- codec->jackpoll_interval); - return 0; - } - -@@ -3052,6 +3038,7 @@ void snd_hda_codec_shutdown(struct hda_codec *codec) - if (!codec->core.registered) - return; - -+ codec->jackpoll_interval = 0; /* don't poll any longer */ - cancel_delayed_work_sync(&codec->jackpoll_work); - list_for_each_entry(cpcm, &codec->pcm_list_head, list) - snd_pcm_suspend_all(cpcm->pcm); -@@ -3118,10 +3105,11 @@ int snd_hda_codec_build_controls(struct hda_codec *codec) - if (err < 0) - return err; - -+ snd_hda_jack_report_sync(codec); /* call at the last init point */ - if (codec->jackpoll_interval) -- hda_jackpoll_work(&codec->jackpoll_work.work); -- else -- snd_hda_jack_report_sync(codec); /* call at the last init point */ -+ schedule_delayed_work(&codec->jackpoll_work, -+ codec->jackpoll_interval); -+ - sync_power_up_states(codec); - return 0; - } -diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c -index 94b452595f3032..851e9231bbbd55 100644 ---- a/sound/pci/hda/patch_ca0132.c -+++ b/sound/pci/hda/patch_ca0132.c -@@ -4411,7 +4411,7 @@ static int add_tuning_control(struct hda_codec *codec, - } - knew.private_value = - HDA_COMPOSE_AMP_VAL(nid, 1, 0, type); -- sprintf(namestr, "%s %s Volume", name, dirstr[dir]); -+ snprintf(namestr, sizeof(namestr), "%s %s Volume", name, dirstr[dir]); - return snd_hda_ctl_add(codec, nid, snd_ctl_new1(&knew, codec)); - } - -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index e12e3134b5e16b..d4bc80780a1f91 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -10071,6 +10071,8 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3), - SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360), - SND_PCI_QUIRK(0x103c, 0x8537, "HP ProBook 440 G6", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), -+ SND_PCI_QUIRK(0x103c, 0x8548, "HP EliteBook x360 830 G6", ALC285_FIXUP_HP_GPIO_LED), -+ SND_PCI_QUIRK(0x103c, 0x854a, "HP EliteBook 830 G6", ALC285_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x85c6, "HP Pavilion x360 Convertible 14-dy1xxx", ALC295_FIXUP_HP_MUTE_LED_COEFBIT11), - SND_PCI_QUIRK(0x103c, 0x85de, "HP Envy x360 13-ar0xxx", ALC285_FIXUP_HP_ENVY_X360), - SND_PCI_QUIRK(0x103c, 0x860f, "HP ZBook 15 G6", ALC285_FIXUP_HP_GPIO_AMP_INIT), -@@ -10636,6 +10638,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1d72, 0x1901, "RedmiBook 14", ALC256_FIXUP_ASUS_HEADSET_MIC), - SND_PCI_QUIRK(0x1d72, 0x1945, "Redmi G", ALC256_FIXUP_ASUS_HEADSET_MIC), - SND_PCI_QUIRK(0x1d72, 0x1947, "RedmiBook Air", ALC255_FIXUP_XIAOMI_HEADSET_MIC), -+ SND_PCI_QUIRK(0x1ee7, 0x2078, "HONOR BRB-X M1010", ALC2XX_FIXUP_HEADSET_MIC), - SND_PCI_QUIRK(0x1f66, 0x0105, "Ayaneo Portable Game Player", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x2014, 0x800a, "Positivo ARN50", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), - SND_PCI_QUIRK(0x2782, 0x0214, "VAIO VJFE-CL", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), -@@ -10651,6 +10654,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0xf111, 0x0001, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0xf111, 0x0006, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0xf111, 0x0009, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE), -+ SND_PCI_QUIRK(0xf111, 0x000b, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0xf111, 0x000c, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE), - - #if 0 -diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c -index ae285c0a629c82..f3df6fe2b7f187 100644 ---- a/sound/pci/intel8x0.c -+++ b/sound/pci/intel8x0.c -@@ -2252,7 +2252,7 @@ static int snd_intel8x0_mixer(struct intel8x0 *chip, int ac97_clock, - tmp |= chip->ac97_sdin[0] << ICH_DI1L_SHIFT; - for (i = 1; i < 4; i++) { - if (pcm->r[0].codec[i]) { -- tmp |= chip->ac97_sdin[pcm->r[0].codec[1]->num] << ICH_DI2L_SHIFT; -+ tmp |= chip->ac97_sdin[pcm->r[0].codec[i]->num] << ICH_DI2L_SHIFT; - break; - } - } -diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c -index 8b6b7602969488..0ddfb0cb376fde 100644 ---- a/sound/soc/codecs/hdac_hdmi.c -+++ b/sound/soc/codecs/hdac_hdmi.c -@@ -1230,7 +1230,8 @@ static int hdac_hdmi_parse_eld(struct hdac_device *hdev, - >> DRM_ELD_VER_SHIFT; - - if (ver != ELD_VER_CEA_861D && ver != ELD_VER_PARTIAL) { -- dev_err(&hdev->dev, "HDMI: Unknown ELD version %d\n", ver); -+ dev_err_ratelimited(&hdev->dev, -+ "HDMI: Unknown ELD version %d\n", ver); - return -EINVAL; - } - -@@ -1238,7 +1239,8 @@ static int hdac_hdmi_parse_eld(struct hdac_device *hdev, - DRM_ELD_MNL_MASK) >> DRM_ELD_MNL_SHIFT; - - if (mnl > ELD_MAX_MNL) { -- dev_err(&hdev->dev, "HDMI: MNL Invalid %d\n", mnl); -+ dev_err_ratelimited(&hdev->dev, -+ "HDMI: MNL Invalid %d\n", mnl); - return -EINVAL; - } - -@@ -1297,8 +1299,8 @@ static void hdac_hdmi_present_sense(struct hdac_hdmi_pin *pin, - - if (!port->eld.monitor_present || !port->eld.eld_valid) { - -- dev_err(&hdev->dev, "%s: disconnect for pin:port %d:%d\n", -- __func__, pin->nid, port->id); -+ dev_dbg(&hdev->dev, "%s: disconnect for pin:port %d:%d\n", -+ __func__, pin->nid, port->id); - - /* - * PCMs are not registered during device probe, so don't -diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c -index 1955d77cffd996..0f250e8e216a4f 100644 ---- a/sound/soc/codecs/rt5640.c -+++ b/sound/soc/codecs/rt5640.c -@@ -3016,6 +3016,11 @@ static int rt5640_i2c_probe(struct i2c_client *i2c) - } - - regmap_read(rt5640->regmap, RT5640_VENDOR_ID2, &val); -+ if (val != RT5640_DEVICE_ID) { -+ usleep_range(60000, 100000); -+ regmap_read(rt5640->regmap, RT5640_VENDOR_ID2, &val); -+ } -+ - if (val != RT5640_DEVICE_ID) { - dev_err(&i2c->dev, - "Device with ID register %#x is not rt5640/39\n", val); -diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c -index 886f5c29939b8e..a6948a57636ab5 100644 ---- a/sound/soc/fsl/fsl_sai.c -+++ b/sound/soc/fsl/fsl_sai.c -@@ -768,9 +768,9 @@ static void fsl_sai_config_disable(struct fsl_sai *sai, int dir) - * are running concurrently. - */ - /* Software Reset */ -- regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR); -+ regmap_update_bits(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR); - /* Clear SR bit to finish the reset */ -- regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), 0); -+ regmap_update_bits(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR, 0); - } - - static int fsl_sai_trigger(struct snd_pcm_substream *substream, int cmd, -@@ -889,11 +889,11 @@ static int fsl_sai_dai_probe(struct snd_soc_dai *cpu_dai) - unsigned int ofs = sai->soc_data->reg_offset; - - /* Software Reset for both Tx and Rx */ -- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR); -- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR); -+ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR); -+ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR); - /* Clear SR bit to finish the reset */ -- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), 0); -- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), 0); -+ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, 0); -+ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, 0); - - regmap_update_bits(sai->regmap, FSL_SAI_TCR1(ofs), - FSL_SAI_CR1_RFW_MASK(sai->soc_data->fifo_depth), -@@ -1710,11 +1710,11 @@ static int fsl_sai_runtime_resume(struct device *dev) - - regcache_cache_only(sai->regmap, false); - regcache_mark_dirty(sai->regmap); -- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR); -- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR); -+ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR); -+ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR); - usleep_range(1000, 2000); -- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), 0); -- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), 0); -+ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, 0); -+ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, 0); - - ret = regcache_sync(sai->regmap); - if (ret) -diff --git a/sound/soc/intel/avs/core.c b/sound/soc/intel/avs/core.c -index 63e4356e8caf94..8f36cef88fe60b 100644 ---- a/sound/soc/intel/avs/core.c -+++ b/sound/soc/intel/avs/core.c -@@ -415,6 +415,8 @@ static int avs_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) - adev = devm_kzalloc(dev, sizeof(*adev), GFP_KERNEL); - if (!adev) - return -ENOMEM; -+ bus = &adev->base.core; -+ - ret = avs_bus_init(adev, pci, id); - if (ret < 0) { - dev_err(dev, "failed to init avs bus: %d\n", ret); -@@ -425,7 +427,6 @@ static int avs_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) - if (ret < 0) - return ret; - -- bus = &adev->base.core; - bus->addr = pci_resource_start(pci, 0); - bus->remap_addr = pci_ioremap_bar(pci, 0); - if (!bus->remap_addr) { -diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c -index f918d9e16dc041..f342bc4b3a1468 100644 ---- a/sound/soc/qcom/lpass-platform.c -+++ b/sound/soc/qcom/lpass-platform.c -@@ -201,7 +201,6 @@ static int lpass_platform_pcmops_open(struct snd_soc_component *component, - struct regmap *map; - unsigned int dai_id = cpu_dai->driver->id; - -- component->id = dai_id; - data = kzalloc(sizeof(*data), GFP_KERNEL); - if (!data) - return -ENOMEM; -@@ -1189,13 +1188,14 @@ static int lpass_platform_pcmops_suspend(struct snd_soc_component *component) - { - struct lpass_data *drvdata = snd_soc_component_get_drvdata(component); - struct regmap *map; -- unsigned int dai_id = component->id; - -- if (dai_id == LPASS_DP_RX) -+ if (drvdata->hdmi_port_enable) { - map = drvdata->hdmiif_map; -- else -- map = drvdata->lpaif_map; -+ regcache_cache_only(map, true); -+ regcache_mark_dirty(map); -+ } - -+ map = drvdata->lpaif_map; - regcache_cache_only(map, true); - regcache_mark_dirty(map); - -@@ -1206,14 +1206,19 @@ static int lpass_platform_pcmops_resume(struct snd_soc_component *component) - { - struct lpass_data *drvdata = snd_soc_component_get_drvdata(component); - struct regmap *map; -- unsigned int dai_id = component->id; -+ int ret; - -- if (dai_id == LPASS_DP_RX) -+ if (drvdata->hdmi_port_enable) { - map = drvdata->hdmiif_map; -- else -- map = drvdata->lpaif_map; -+ regcache_cache_only(map, false); -+ ret = regcache_sync(map); -+ if (ret) -+ return ret; -+ } - -+ map = drvdata->lpaif_map; - regcache_cache_only(map, false); -+ - return regcache_sync(map); - } - -@@ -1223,7 +1228,9 @@ static int lpass_platform_copy(struct snd_soc_component *component, - unsigned long bytes) - { - struct snd_pcm_runtime *rt = substream->runtime; -- unsigned int dai_id = component->id; -+ struct snd_soc_pcm_runtime *soc_runtime = snd_soc_substream_to_rtd(substream); -+ struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(soc_runtime, 0); -+ unsigned int dai_id = cpu_dai->driver->id; - int ret = 0; - - void __iomem *dma_buf = (void __iomem *) (rt->dma_area + pos + -diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c -index 7eea70eea68b47..dc95b6f4155586 100644 ---- a/sound/soc/soc-core.c -+++ b/sound/soc/soc-core.c -@@ -1025,6 +1025,9 @@ static int soc_dai_link_sanity_check(struct snd_soc_card *card, - void snd_soc_remove_pcm_runtime(struct snd_soc_card *card, - struct snd_soc_pcm_runtime *rtd) - { -+ if (!rtd) -+ return; -+ - lockdep_assert_held(&client_mutex); - - /* -diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c -index 7729f8f4d5e610..7facb7b2dba19d 100644 ---- a/sound/soc/soc-dapm.c -+++ b/sound/soc/soc-dapm.c -@@ -734,6 +734,10 @@ static int snd_soc_dapm_set_bias_level(struct snd_soc_dapm_context *dapm, - out: - trace_snd_soc_bias_level_done(card, level); - -+ /* success */ -+ if (ret == 0) -+ snd_soc_dapm_init_bias_level(dapm, level); -+ - return ret; - } - -diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c -index be0b3c8ac7055b..f2cce15be4e271 100644 ---- a/sound/usb/mixer_quirks.c -+++ b/sound/usb/mixer_quirks.c -@@ -2150,15 +2150,15 @@ static int dell_dock_mixer_init(struct usb_mixer_interface *mixer) - #define SND_RME_CLK_FREQMUL_SHIFT 18 - #define SND_RME_CLK_FREQMUL_MASK 0x7 - #define SND_RME_CLK_SYSTEM(x) \ -- ((x >> SND_RME_CLK_SYSTEM_SHIFT) & SND_RME_CLK_SYSTEM_MASK) -+ (((x) >> SND_RME_CLK_SYSTEM_SHIFT) & SND_RME_CLK_SYSTEM_MASK) - #define SND_RME_CLK_AES(x) \ -- ((x >> SND_RME_CLK_AES_SHIFT) & SND_RME_CLK_AES_SPDIF_MASK) -+ (((x) >> SND_RME_CLK_AES_SHIFT) & SND_RME_CLK_AES_SPDIF_MASK) - #define SND_RME_CLK_SPDIF(x) \ -- ((x >> SND_RME_CLK_SPDIF_SHIFT) & SND_RME_CLK_AES_SPDIF_MASK) -+ (((x) >> SND_RME_CLK_SPDIF_SHIFT) & SND_RME_CLK_AES_SPDIF_MASK) - #define SND_RME_CLK_SYNC(x) \ -- ((x >> SND_RME_CLK_SYNC_SHIFT) & SND_RME_CLK_SYNC_MASK) -+ (((x) >> SND_RME_CLK_SYNC_SHIFT) & SND_RME_CLK_SYNC_MASK) - #define SND_RME_CLK_FREQMUL(x) \ -- ((x >> SND_RME_CLK_FREQMUL_SHIFT) & SND_RME_CLK_FREQMUL_MASK) -+ (((x) >> SND_RME_CLK_FREQMUL_SHIFT) & SND_RME_CLK_FREQMUL_MASK) - #define SND_RME_CLK_AES_LOCK 0x1 - #define SND_RME_CLK_AES_SYNC 0x4 - #define SND_RME_CLK_SPDIF_LOCK 0x2 -@@ -2167,9 +2167,9 @@ static int dell_dock_mixer_init(struct usb_mixer_interface *mixer) - #define SND_RME_SPDIF_FORMAT_SHIFT 5 - #define SND_RME_BINARY_MASK 0x1 - #define SND_RME_SPDIF_IF(x) \ -- ((x >> SND_RME_SPDIF_IF_SHIFT) & SND_RME_BINARY_MASK) -+ (((x) >> SND_RME_SPDIF_IF_SHIFT) & SND_RME_BINARY_MASK) - #define SND_RME_SPDIF_FORMAT(x) \ -- ((x >> SND_RME_SPDIF_FORMAT_SHIFT) & SND_RME_BINARY_MASK) -+ (((x) >> SND_RME_SPDIF_FORMAT_SHIFT) & SND_RME_BINARY_MASK) - - static const u32 snd_rme_rate_table[] = { - 32000, 44100, 48000, 50000, -diff --git a/sound/usb/stream.c b/sound/usb/stream.c -index 0f1558ef855535..12a5e053ec54fc 100644 ---- a/sound/usb/stream.c -+++ b/sound/usb/stream.c -@@ -341,20 +341,28 @@ snd_pcm_chmap_elem *convert_chmap_v3(struct uac3_cluster_header_descriptor - - len = le16_to_cpu(cluster->wLength); - c = 0; -- p += sizeof(struct uac3_cluster_header_descriptor); -+ p += sizeof(*cluster); -+ len -= sizeof(*cluster); - -- while (((p - (void *)cluster) < len) && (c < channels)) { -+ while (len > 0 && (c < channels)) { - struct uac3_cluster_segment_descriptor *cs_desc = p; - u16 cs_len; - u8 cs_type; - -+ if (len < sizeof(*cs_desc)) -+ break; - cs_len = le16_to_cpu(cs_desc->wLength); -+ if (len < cs_len) -+ break; - cs_type = cs_desc->bSegmentType; - - if (cs_type == UAC3_CHANNEL_INFORMATION) { - struct uac3_cluster_information_segment_descriptor *is = p; - unsigned char map; - -+ if (cs_len < sizeof(*is)) -+ break; -+ - /* - * TODO: this conversion is not complete, update it - * after adding UAC3 values to asound.h -@@ -456,6 +464,7 @@ snd_pcm_chmap_elem *convert_chmap_v3(struct uac3_cluster_header_descriptor - chmap->map[c++] = map; - } - p += cs_len; -+ len -= cs_len; - } - - if (channels < c) -@@ -876,7 +885,7 @@ snd_usb_get_audioformat_uac3(struct snd_usb_audio *chip, - u64 badd_formats = 0; - unsigned int num_channels; - struct audioformat *fp; -- u16 cluster_id, wLength; -+ u16 cluster_id, wLength, cluster_wLength; - int clock = 0; - int err; - -@@ -1005,6 +1014,16 @@ snd_usb_get_audioformat_uac3(struct snd_usb_audio *chip, - return ERR_PTR(-EIO); - } - -+ cluster_wLength = le16_to_cpu(cluster->wLength); -+ if (cluster_wLength < sizeof(*cluster) || -+ cluster_wLength > wLength) { -+ dev_err(&dev->dev, -+ "%u:%d : invalid Cluster Descriptor size\n", -+ iface_no, altno); -+ kfree(cluster); -+ return ERR_PTR(-EIO); -+ } -+ - num_channels = cluster->bNrChannels; - chmap = convert_chmap_v3(cluster); - kfree(cluster); -diff --git a/sound/usb/validate.c b/sound/usb/validate.c -index 6fe206f6e91105..a0d55b77c9941d 100644 ---- a/sound/usb/validate.c -+++ b/sound/usb/validate.c -@@ -221,6 +221,17 @@ static bool validate_uac3_feature_unit(const void *p, - return d->bLength >= sizeof(*d) + 4 + 2; - } - -+static bool validate_uac3_power_domain_unit(const void *p, -+ const struct usb_desc_validator *v) -+{ -+ const struct uac3_power_domain_descriptor *d = p; -+ -+ if (d->bLength < sizeof(*d)) -+ return false; -+ /* baEntities[] + wPDomainDescrStr */ -+ return d->bLength >= sizeof(*d) + d->bNrEntities + 2; -+} -+ - static bool validate_midi_out_jack(const void *p, - const struct usb_desc_validator *v) - { -@@ -274,7 +285,7 @@ static const struct usb_desc_validator audio_validators[] = { - /* UAC_VERSION_3, UAC3_EXTENDED_TERMINAL: not implemented yet */ - FUNC(UAC_VERSION_3, UAC3_MIXER_UNIT, validate_mixer_unit), - FUNC(UAC_VERSION_3, UAC3_SELECTOR_UNIT, validate_selector_unit), -- FUNC(UAC_VERSION_3, UAC_FEATURE_UNIT, validate_uac3_feature_unit), -+ FUNC(UAC_VERSION_3, UAC3_FEATURE_UNIT, validate_uac3_feature_unit), - /* UAC_VERSION_3, UAC3_EFFECT_UNIT: not implemented yet */ - FUNC(UAC_VERSION_3, UAC3_PROCESSING_UNIT, validate_processing_unit), - FUNC(UAC_VERSION_3, UAC3_EXTENSION_UNIT, validate_processing_unit), -@@ -285,6 +296,7 @@ static const struct usb_desc_validator audio_validators[] = { - struct uac3_clock_multiplier_descriptor), - /* UAC_VERSION_3, UAC3_SAMPLE_RATE_CONVERTER: not implemented yet */ - /* UAC_VERSION_3, UAC3_CONNECTORS: not implemented yet */ -+ FUNC(UAC_VERSION_3, UAC3_POWER_DOMAIN, validate_uac3_power_domain_unit), - { } /* terminator */ - }; - -diff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c -index 08d0ac543c6746..a0536528dfde26 100644 ---- a/tools/bpf/bpftool/main.c -+++ b/tools/bpf/bpftool/main.c -@@ -534,9 +534,9 @@ int main(int argc, char **argv) - usage(); - - if (version_requested) -- return do_version(argc, argv); -- -- ret = cmd_select(commands, argc, argv, do_help); -+ ret = do_version(argc, argv); -+ else -+ ret = cmd_select(commands, argc, argv, do_help); - - if (json_output) - jsonw_destroy(&json_wtr); -diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h -index 933bc0be7e1c6b..a9d8b5b51f37f8 100644 ---- a/tools/include/nolibc/std.h -+++ b/tools/include/nolibc/std.h -@@ -20,6 +20,8 @@ - - #include "stdint.h" - -+#include -+ - /* those are commonly provided by sys/types.h */ - typedef unsigned int dev_t; - typedef unsigned long ino_t; -@@ -31,6 +33,6 @@ typedef unsigned long nlink_t; - typedef signed long off_t; - typedef signed long blksize_t; - typedef signed long blkcnt_t; --typedef signed long time_t; -+typedef __kernel_old_time_t time_t; - - #endif /* _NOLIBC_STD_H */ -diff --git a/tools/include/nolibc/types.h b/tools/include/nolibc/types.h -index 8cfc4c860fa444..48dca7b188d06c 100644 ---- a/tools/include/nolibc/types.h -+++ b/tools/include/nolibc/types.h -@@ -128,7 +128,7 @@ typedef struct { - int __fd = (fd); \ - if (__fd >= 0) \ - __set->fds[__fd / FD_SETIDXMASK] &= \ -- ~(1U << (__fd & FX_SETBITMASK)); \ -+ ~(1U << (__fd & FD_SETBITMASK)); \ - } while (0) - - #define FD_SET(fd, set) do { \ -@@ -145,7 +145,7 @@ typedef struct { - int __r = 0; \ - if (__fd >= 0) \ - __r = !!(__set->fds[__fd / FD_SETIDXMASK] & \ --1U << (__fd & FD_SET_BITMASK)); \ -+1U << (__fd & FD_SETBITMASK)); \ - __r; \ - }) - -diff --git a/tools/include/uapi/linux/if_link.h b/tools/include/uapi/linux/if_link.h -index 39e659c83cfd21..cb8b0a3029d3d0 100644 ---- a/tools/include/uapi/linux/if_link.h -+++ b/tools/include/uapi/linux/if_link.h -@@ -865,6 +865,7 @@ enum { - IFLA_BOND_AD_LACP_ACTIVE, - IFLA_BOND_MISSED_MAX, - IFLA_BOND_NS_IP6_TARGET, -+ IFLA_BOND_COUPLED_CONTROL, - __IFLA_BOND_MAX, - }; - -diff --git a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c -index 08a399b0be286c..6ab9139f16af90 100644 ---- a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c -+++ b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c -@@ -240,9 +240,9 @@ static int mperf_stop(void) - int cpu; - - for (cpu = 0; cpu < cpu_count; cpu++) { -- mperf_measure_stats(cpu); -- mperf_get_tsc(&tsc_at_measure_end[cpu]); - clock_gettime(CLOCK_REALTIME, &time_end[cpu]); -+ mperf_get_tsc(&tsc_at_measure_end[cpu]); -+ mperf_measure_stats(cpu); - } - - return 0; -diff --git a/tools/scripts/Makefile.include b/tools/scripts/Makefile.include -index ff527ac065cf8b..c006e72b4f4348 100644 ---- a/tools/scripts/Makefile.include -+++ b/tools/scripts/Makefile.include -@@ -98,7 +98,9 @@ else ifneq ($(CROSS_COMPILE),) - # Allow userspace to override CLANG_CROSS_FLAGS to specify their own - # sysroots and flags or to avoid the GCC call in pure Clang builds. - ifeq ($(CLANG_CROSS_FLAGS),) --CLANG_CROSS_FLAGS := --target=$(notdir $(CROSS_COMPILE:%-=%)) -+CLANG_TARGET := $(notdir $(CROSS_COMPILE:%-=%)) -+CLANG_TARGET := $(subst s390-linux,s390x-linux,$(CLANG_TARGET)) -+CLANG_CROSS_FLAGS := --target=$(CLANG_TARGET) - GCC_TOOLCHAIN_DIR := $(dir $(shell which $(CROSS_COMPILE)gcc 2>/dev/null)) - ifneq ($(GCC_TOOLCHAIN_DIR),) - CLANG_CROSS_FLAGS += --prefix=$(GCC_TOOLCHAIN_DIR)$(notdir $(CROSS_COMPILE)) -diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl -index 3316015757433a..a8979280b50552 100755 ---- a/tools/testing/ktest/ktest.pl -+++ b/tools/testing/ktest/ktest.pl -@@ -1358,7 +1358,10 @@ sub __eval_option { - # If a variable contains itself, use the default var - if (($var eq $name) && defined($opt{$var})) { - $o = $opt{$var}; -- $retval = "$retval$o"; -+ # Only append if the default doesn't contain itself -+ if ($o !~ m/\$\{$var\}/) { -+ $retval = "$retval$o"; -+ } - } elsif (defined($opt{$o})) { - $o = $opt{$o}; - $retval = "$retval$o"; -diff --git a/tools/testing/selftests/arm64/fp/sve-ptrace.c b/tools/testing/selftests/arm64/fp/sve-ptrace.c -index c6228176dd1a0c..408fb1c5c2f856 100644 ---- a/tools/testing/selftests/arm64/fp/sve-ptrace.c -+++ b/tools/testing/selftests/arm64/fp/sve-ptrace.c -@@ -168,7 +168,7 @@ static void ptrace_set_get_inherit(pid_t child, const struct vec_type *type) - memset(&sve, 0, sizeof(sve)); - sve.size = sizeof(sve); - sve.vl = sve_vl_from_vq(SVE_VQ_MIN); -- sve.flags = SVE_PT_VL_INHERIT; -+ sve.flags = SVE_PT_VL_INHERIT | SVE_PT_REGS_SVE; - ret = set_sve(child, type, &sve); - if (ret != 0) { - ksft_test_result_fail("Failed to set %s SVE_PT_VL_INHERIT\n", -@@ -233,6 +233,7 @@ static void ptrace_set_get_vl(pid_t child, const struct vec_type *type, - /* Set the VL by doing a set with no register payload */ - memset(&sve, 0, sizeof(sve)); - sve.size = sizeof(sve); -+ sve.flags = SVE_PT_REGS_SVE; - sve.vl = vl; - ret = set_sve(child, type, &sve); - if (ret != 0) { -diff --git a/tools/testing/selftests/bpf/prog_tests/user_ringbuf.c b/tools/testing/selftests/bpf/prog_tests/user_ringbuf.c -index dfff6feac12c3c..7e9a508c157184 100644 ---- a/tools/testing/selftests/bpf/prog_tests/user_ringbuf.c -+++ b/tools/testing/selftests/bpf/prog_tests/user_ringbuf.c -@@ -21,8 +21,7 @@ - #include "../progs/test_user_ringbuf.h" - - static const long c_sample_size = sizeof(struct sample) + BPF_RINGBUF_HDR_SZ; --static const long c_ringbuf_size = 1 << 12; /* 1 small page */ --static const long c_max_entries = c_ringbuf_size / c_sample_size; -+static long c_ringbuf_size, c_max_entries; - - static void drain_current_samples(void) - { -@@ -424,7 +423,9 @@ static void test_user_ringbuf_loop(void) - uint32_t remaining_samples = total_samples; - int err; - -- BUILD_BUG_ON(total_samples <= c_max_entries); -+ if (!ASSERT_LT(c_max_entries, total_samples, "compare_c_max_entries")) -+ return; -+ - err = load_skel_create_user_ringbuf(&skel, &ringbuf); - if (err) - return; -@@ -686,6 +687,9 @@ void test_user_ringbuf(void) - { - int i; - -+ c_ringbuf_size = getpagesize(); /* 1 page */ -+ c_max_entries = c_ringbuf_size / c_sample_size; -+ - for (i = 0; i < ARRAY_SIZE(success_tests); i++) { - if (!test__start_subtest(success_tests[i].test_name)) - continue; -diff --git a/tools/testing/selftests/bpf/progs/verifier_unpriv.c b/tools/testing/selftests/bpf/progs/verifier_unpriv.c -index 7ea535bfbacd3e..e4ef82a6ee38c8 100644 ---- a/tools/testing/selftests/bpf/progs/verifier_unpriv.c -+++ b/tools/testing/selftests/bpf/progs/verifier_unpriv.c -@@ -619,7 +619,7 @@ __naked void pass_pointer_to_tail_call(void) - - SEC("socket") - __description("unpriv: cmp map pointer with zero") --__success __failure_unpriv __msg_unpriv("R1 pointer comparison") -+__success __success_unpriv - __retval(0) - __naked void cmp_map_pointer_with_zero(void) - { -diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc -index 4b994b6df5ac30..ed81eaf2afd6d9 100644 ---- a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc -+++ b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc -@@ -29,7 +29,7 @@ ftrace_filter_check 'schedule*' '^schedule.*$' - ftrace_filter_check '*pin*lock' '.*pin.*lock$' - - # filter by start*mid* --ftrace_filter_check 'mutex*try*' '^mutex.*try.*' -+ftrace_filter_check 'mutex*unl*' '^mutex.*unl.*' - - # Advanced full-glob matching feature is recently supported. - # Skip the tests if we are sure the kernel does not support it. -diff --git a/tools/testing/selftests/futex/include/futextest.h b/tools/testing/selftests/futex/include/futextest.h -index ddbcfc9b7bac4a..7a5fd1d5355e7e 100644 ---- a/tools/testing/selftests/futex/include/futextest.h -+++ b/tools/testing/selftests/futex/include/futextest.h -@@ -47,6 +47,17 @@ typedef volatile u_int32_t futex_t; - FUTEX_PRIVATE_FLAG) - #endif - -+/* -+ * SYS_futex is expected from system C library, in glibc some 32-bit -+ * architectures (e.g. RV32) are using 64-bit time_t, therefore it doesn't have -+ * SYS_futex defined but just SYS_futex_time64. Define SYS_futex as -+ * SYS_futex_time64 in this situation to ensure the compilation and the -+ * compatibility. -+ */ -+#if !defined(SYS_futex) && defined(SYS_futex_time64) -+#define SYS_futex SYS_futex_time64 -+#endif -+ - /** - * futex() - SYS_futex syscall wrapper - * @uaddr: address of first futex -diff --git a/tools/testing/selftests/memfd/memfd_test.c b/tools/testing/selftests/memfd/memfd_test.c -index e92b60eecb7d5c..9c9c82fd18a7ea 100644 ---- a/tools/testing/selftests/memfd/memfd_test.c -+++ b/tools/testing/selftests/memfd/memfd_test.c -@@ -285,6 +285,24 @@ static void *mfd_assert_mmap_shared(int fd) - return p; - } - -+static void *mfd_assert_mmap_read_shared(int fd) -+{ -+ void *p; -+ -+ p = mmap(NULL, -+ mfd_def_size, -+ PROT_READ, -+ MAP_SHARED, -+ fd, -+ 0); -+ if (p == MAP_FAILED) { -+ printf("mmap() failed: %m\n"); -+ abort(); -+ } -+ -+ return p; -+} -+ - static void *mfd_assert_mmap_private(int fd) - { - void *p; -@@ -986,6 +1004,30 @@ static void test_seal_future_write(void) - close(fd); - } - -+static void test_seal_write_map_read_shared(void) -+{ -+ int fd; -+ void *p; -+ -+ printf("%s SEAL-WRITE-MAP-READ\n", memfd_str); -+ -+ fd = mfd_assert_new("kern_memfd_seal_write_map_read", -+ mfd_def_size, -+ MFD_CLOEXEC | MFD_ALLOW_SEALING); -+ -+ mfd_assert_add_seals(fd, F_SEAL_WRITE); -+ mfd_assert_has_seals(fd, F_SEAL_WRITE); -+ -+ p = mfd_assert_mmap_read_shared(fd); -+ -+ mfd_assert_read(fd); -+ mfd_assert_read_shared(fd); -+ mfd_fail_write(fd); -+ -+ munmap(p, mfd_def_size); -+ close(fd); -+} -+ - /* - * Test SEAL_SHRINK - * Test whether SEAL_SHRINK actually prevents shrinking -@@ -1603,6 +1645,7 @@ int main(int argc, char **argv) - - test_seal_write(); - test_seal_future_write(); -+ test_seal_write_map_read_shared(); - test_seal_shrink(); - test_seal_grow(); - test_seal_resize(); -diff --git a/tools/testing/selftests/net/mptcp/pm_netlink.sh b/tools/testing/selftests/net/mptcp/pm_netlink.sh -index 71899a3ffa7a9d..3528e730e4d37c 100755 ---- a/tools/testing/selftests/net/mptcp/pm_netlink.sh -+++ b/tools/testing/selftests/net/mptcp/pm_netlink.sh -@@ -134,6 +134,7 @@ ip netns exec $ns1 ./pm_nl_ctl limits 1 9 2>/dev/null - check "ip netns exec $ns1 ./pm_nl_ctl limits" "$default_limits" "subflows above hard limit" - - ip netns exec $ns1 ./pm_nl_ctl limits 8 8 -+ip netns exec $ns1 ./pm_nl_ctl flush - check "ip netns exec $ns1 ./pm_nl_ctl limits" "accept 8 - subflows 8" "set limits" - diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.103-104.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.103-104.patch deleted file mode 100644 index eb7ea28a0a..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.103-104.patch +++ /dev/null @@ -1,3677 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/display/msm/qcom,mdp5.yaml b/Documentation/devicetree/bindings/display/msm/qcom,mdp5.yaml -index 91c774f106ceb1..ab1196d1ec2dd4 100644 ---- a/Documentation/devicetree/bindings/display/msm/qcom,mdp5.yaml -+++ b/Documentation/devicetree/bindings/display/msm/qcom,mdp5.yaml -@@ -59,7 +59,6 @@ properties: - - const: bus - - const: core - - const: vsync -- - const: lut - - const: tbu - - const: tbu_rt - # MSM8996 has additional iommu clock -diff --git a/Makefile b/Makefile -index 9b288ccccd6495..ae57f816375ebd 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 103 -+SUBLEVEL = 104 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/mips/boot/dts/lantiq/danube_easy50712.dts b/arch/mips/boot/dts/lantiq/danube_easy50712.dts -index 1ce20b7d05cb8c..c4d7aa5753b043 100644 ---- a/arch/mips/boot/dts/lantiq/danube_easy50712.dts -+++ b/arch/mips/boot/dts/lantiq/danube_easy50712.dts -@@ -82,13 +82,16 @@ conf_out { - }; - }; - -- etop@e180000 { -+ ethernet@e180000 { - compatible = "lantiq,etop-xway"; - reg = <0xe180000 0x40000>; - interrupt-parent = <&icu0>; - interrupts = <73 78>; -+ interrupt-names = "tx", "rx"; - phy-mode = "rmii"; - mac-address = [ 00 11 22 33 44 55 ]; -+ lantiq,rx-burst-length = <4>; -+ lantiq,tx-burst-length = <4>; - }; - - stp0: stp@e100bb0 { -diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c -index 3ed0782252229a..4c72b59fdf98cc 100644 ---- a/arch/mips/lantiq/xway/sysctrl.c -+++ b/arch/mips/lantiq/xway/sysctrl.c -@@ -478,7 +478,7 @@ void __init ltq_soc_init(void) - ifccr = CGU_IFCCR_VR9; - pcicr = CGU_PCICR_VR9; - } else { -- clkdev_add_pmu("1e180000.etop", NULL, 1, 0, PMU_PPE); -+ clkdev_add_pmu("1e180000.ethernet", NULL, 1, 0, PMU_PPE); - } - - if (!of_machine_is_compatible("lantiq,ase")) -@@ -512,9 +512,9 @@ void __init ltq_soc_init(void) - CLOCK_133M, CLOCK_133M); - clkdev_add_pmu("1e101000.usb", "otg", 1, 0, PMU_USB0); - clkdev_add_pmu("1f203018.usb2-phy", "phy", 1, 0, PMU_USB0_P); -- clkdev_add_pmu("1e180000.etop", "ppe", 1, 0, PMU_PPE); -- clkdev_add_cgu("1e180000.etop", "ephycgu", CGU_EPHY); -- clkdev_add_pmu("1e180000.etop", "ephy", 1, 0, PMU_EPHY); -+ clkdev_add_pmu("1e180000.ethernet", "ppe", 1, 0, PMU_PPE); -+ clkdev_add_cgu("1e180000.ethernet", "ephycgu", CGU_EPHY); -+ clkdev_add_pmu("1e180000.ethernet", "ephy", 1, 0, PMU_EPHY); - clkdev_add_pmu("1e103000.sdio", NULL, 1, 0, PMU_ASE_SDIO); - clkdev_add_pmu("1e116000.mei", "dfe", 1, 0, PMU_DFE); - } else if (of_machine_is_compatible("lantiq,grx390")) { -@@ -573,7 +573,7 @@ void __init ltq_soc_init(void) - clkdev_add_pmu("1e101000.usb", "otg", 1, 0, PMU_USB0 | PMU_AHBM); - clkdev_add_pmu("1f203034.usb2-phy", "phy", 1, 0, PMU_USB1_P); - clkdev_add_pmu("1e106000.usb", "otg", 1, 0, PMU_USB1 | PMU_AHBM); -- clkdev_add_pmu("1e180000.etop", "switch", 1, 0, PMU_SWITCH); -+ clkdev_add_pmu("1e180000.ethernet", "switch", 1, 0, PMU_SWITCH); - clkdev_add_pmu("1e103000.sdio", NULL, 1, 0, PMU_SDIO); - clkdev_add_pmu("1e103100.deu", NULL, 1, 0, PMU_DEU); - clkdev_add_pmu("1e116000.mei", "dfe", 1, 0, PMU_DFE); -diff --git a/arch/powerpc/kernel/kvm.c b/arch/powerpc/kernel/kvm.c -index 5b3c093611baf1..7209d00a9c2576 100644 ---- a/arch/powerpc/kernel/kvm.c -+++ b/arch/powerpc/kernel/kvm.c -@@ -632,19 +632,19 @@ static void __init kvm_check_ins(u32 *inst, u32 features) - #endif - } - -- switch (inst_no_rt & ~KVM_MASK_RB) { - #ifdef CONFIG_PPC_BOOK3S_32 -+ switch (inst_no_rt & ~KVM_MASK_RB) { - case KVM_INST_MTSRIN: - if (features & KVM_MAGIC_FEAT_SR) { - u32 inst_rb = _inst & KVM_MASK_RB; - kvm_patch_ins_mtsrin(inst, inst_rt, inst_rb); - } - break; --#endif - } -+#endif - -- switch (_inst) { - #ifdef CONFIG_BOOKE -+ switch (_inst) { - case KVM_INST_WRTEEI_0: - kvm_patch_ins_wrteei_0(inst); - break; -@@ -652,8 +652,8 @@ static void __init kvm_check_ins(u32 *inst, u32 features) - case KVM_INST_WRTEEI_1: - kvm_patch_ins_wrtee(inst, 0, 1); - break; --#endif - } -+#endif - } - - extern u32 kvm_template_start[]; -diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c -index 7444fe0e3d08cd..2cb30d9c5b4ae7 100644 ---- a/arch/x86/kernel/cpu/microcode/amd.c -+++ b/arch/x86/kernel/cpu/microcode/amd.c -@@ -161,8 +161,28 @@ static int cmp_id(const void *key, const void *elem) - return 1; - } - -+static u32 cpuid_to_ucode_rev(unsigned int val) -+{ -+ union zen_patch_rev p = {}; -+ union cpuid_1_eax c; -+ -+ c.full = val; -+ -+ p.stepping = c.stepping; -+ p.model = c.model; -+ p.ext_model = c.ext_model; -+ p.ext_fam = c.ext_fam; -+ -+ return p.ucode_rev; -+} -+ - static bool need_sha_check(u32 cur_rev) - { -+ if (!cur_rev) { -+ cur_rev = cpuid_to_ucode_rev(bsp_cpuid_1_eax); -+ pr_info_once("No current revision, generating the lowest one: 0x%x\n", cur_rev); -+ } -+ - switch (cur_rev >> 8) { - case 0x80012: return cur_rev <= 0x800126f; break; - case 0x80082: return cur_rev <= 0x800820f; break; -@@ -744,8 +764,6 @@ static struct ucode_patch *cache_find_patch(struct ucode_cpu_info *uci, u16 equi - n.equiv_cpu = equiv_cpu; - n.patch_id = uci->cpu_sig.rev; - -- WARN_ON_ONCE(!n.patch_id); -- - list_for_each_entry(p, µcode_cache, plist) - if (patch_cpus_equivalent(p, &n, false)) - return p; -diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c -index ba1c2a7f74f766..af4ae9216667ea 100644 ---- a/arch/x86/kvm/lapic.c -+++ b/arch/x86/kvm/lapic.c -@@ -847,6 +847,8 @@ static int __pv_send_ipi(unsigned long *ipi_bitmap, struct kvm_apic_map *map, - if (min > map->max_apic_id) - return 0; - -+ min = array_index_nospec(min, map->max_apic_id + 1); -+ - for_each_set_bit(i, ipi_bitmap, - min((u32)BITS_PER_LONG, (map->max_apic_id - min + 1))) { - if (map->phys_map[min + i]) { -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index af0b2b3bc991e2..5088065ac704be 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -9802,8 +9802,11 @@ static void kvm_sched_yield(struct kvm_vcpu *vcpu, unsigned long dest_id) - rcu_read_lock(); - map = rcu_dereference(vcpu->kvm->arch.apic_map); - -- if (likely(map) && dest_id <= map->max_apic_id && map->phys_map[dest_id]) -- target = map->phys_map[dest_id]->vcpu; -+ if (likely(map) && dest_id <= map->max_apic_id) { -+ dest_id = array_index_nospec(dest_id, map->max_apic_id + 1); -+ if (map->phys_map[dest_id]) -+ target = map->phys_map[dest_id]->vcpu; -+ } - - rcu_read_unlock(); - -diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c -index 77d6af61158936..8e304efde3429e 100644 ---- a/drivers/acpi/ec.c -+++ b/drivers/acpi/ec.c -@@ -2329,6 +2329,12 @@ static const struct dmi_system_id acpi_ec_no_wakeup[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "83Q3"), - } - }, -+ { -+ // TUXEDO InfinityBook Pro AMD Gen9 -+ .matches = { -+ DMI_MATCH(DMI_BOARD_NAME, "GXxHRXx"), -+ }, -+ }, - { }, - }; - -diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c -index ff558908897f3e..9c83fb29b2f1b2 100644 ---- a/drivers/atm/atmtcp.c -+++ b/drivers/atm/atmtcp.c -@@ -279,6 +279,19 @@ static struct atm_vcc *find_vcc(struct atm_dev *dev, short vpi, int vci) - return NULL; - } - -+static int atmtcp_c_pre_send(struct atm_vcc *vcc, struct sk_buff *skb) -+{ -+ struct atmtcp_hdr *hdr; -+ -+ if (skb->len < sizeof(struct atmtcp_hdr)) -+ return -EINVAL; -+ -+ hdr = (struct atmtcp_hdr *)skb->data; -+ if (hdr->length == ATMTCP_HDR_MAGIC) -+ return -EINVAL; -+ -+ return 0; -+} - - static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb) - { -@@ -288,9 +301,6 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb) - struct sk_buff *new_skb; - int result = 0; - -- if (skb->len < sizeof(struct atmtcp_hdr)) -- goto done; -- - dev = vcc->dev_data; - hdr = (struct atmtcp_hdr *) skb->data; - if (hdr->length == ATMTCP_HDR_MAGIC) { -@@ -347,6 +357,7 @@ static const struct atmdev_ops atmtcp_v_dev_ops = { - - static const struct atmdev_ops atmtcp_c_dev_ops = { - .close = atmtcp_c_close, -+ .pre_send = atmtcp_c_pre_send, - .send = atmtcp_c_send - }; - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c -index 384834fbd59011..7200110197415f 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c -@@ -89,8 +89,8 @@ int amdgpu_map_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm, - } - - r = amdgpu_vm_bo_map(adev, *bo_va, csa_addr, 0, size, -- AMDGPU_VM_PAGE_READABLE | AMDGPU_VM_PAGE_WRITEABLE | -- AMDGPU_VM_PAGE_EXECUTABLE); -+ AMDGPU_PTE_READABLE | AMDGPU_PTE_WRITEABLE | -+ AMDGPU_PTE_EXECUTABLE); - - if (r) { - DRM_ERROR("failed to do bo_map on static CSA, err=%d\n", r); -diff --git a/drivers/gpu/drm/display/drm_dp_helper.c b/drivers/gpu/drm/display/drm_dp_helper.c -index 772d8e662278b9..851f0baf94600c 100644 ---- a/drivers/gpu/drm/display/drm_dp_helper.c -+++ b/drivers/gpu/drm/display/drm_dp_helper.c -@@ -663,7 +663,7 @@ ssize_t drm_dp_dpcd_read(struct drm_dp_aux *aux, unsigned int offset, - * monitor doesn't power down exactly after the throw away read. - */ - if (!aux->is_remote) { -- ret = drm_dp_dpcd_probe(aux, DP_LANE0_1_STATUS); -+ ret = drm_dp_dpcd_probe(aux, DP_DPCD_REV); - if (ret < 0) - return ret; - } -diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c -index bbe4f1665b6039..dc142f9e4f6028 100644 ---- a/drivers/gpu/drm/msm/msm_gem_submit.c -+++ b/drivers/gpu/drm/msm/msm_gem_submit.c -@@ -981,12 +981,8 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, - - if (ret == 0 && args->flags & MSM_SUBMIT_FENCE_FD_OUT) { - sync_file = sync_file_create(submit->user_fence); -- if (!sync_file) { -+ if (!sync_file) - ret = -ENOMEM; -- } else { -- fd_install(out_fence_fd, sync_file->file); -- args->fence_fd = out_fence_fd; -- } - } - - submit_attach_object_fences(submit); -@@ -1013,10 +1009,14 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, - out_unlock: - mutex_unlock(&queue->lock); - out_post_unlock: -- if (ret && (out_fence_fd >= 0)) { -- put_unused_fd(out_fence_fd); -+ if (ret) { -+ if (out_fence_fd >= 0) -+ put_unused_fd(out_fence_fd); - if (sync_file) - fput(sync_file->file); -+ } else if (sync_file) { -+ fd_install(out_fence_fd, sync_file->file); -+ args->fence_fd = out_fence_fd; - } - - if (!IS_ERR_OR_NULL(submit)) { -diff --git a/drivers/gpu/drm/nouveau/dispnv50/wndw.c b/drivers/gpu/drm/nouveau/dispnv50/wndw.c -index 7a2cceaee6e97f..1199dfc1194c80 100644 ---- a/drivers/gpu/drm/nouveau/dispnv50/wndw.c -+++ b/drivers/gpu/drm/nouveau/dispnv50/wndw.c -@@ -663,6 +663,10 @@ static bool nv50_plane_format_mod_supported(struct drm_plane *plane, - struct nouveau_drm *drm = nouveau_drm(plane->dev); - uint8_t i; - -+ /* All chipsets can display all formats in linear layout */ -+ if (modifier == DRM_FORMAT_MOD_LINEAR) -+ return true; -+ - if (drm->client.device.info.chipset < 0xc0) { - const struct drm_format_info *info = drm_format_info(format); - const uint8_t kind = (modifier >> 12) & 0xff; -diff --git a/drivers/gpu/drm/nouveau/nvkm/falcon/gm200.c b/drivers/gpu/drm/nouveau/nvkm/falcon/gm200.c -index b7da3ab44c277d..7c43397c19e61d 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/falcon/gm200.c -+++ b/drivers/gpu/drm/nouveau/nvkm/falcon/gm200.c -@@ -103,7 +103,7 @@ gm200_flcn_pio_imem_wr_init(struct nvkm_falcon *falcon, u8 port, bool sec, u32 i - static void - gm200_flcn_pio_imem_wr(struct nvkm_falcon *falcon, u8 port, const u8 *img, int len, u16 tag) - { -- nvkm_falcon_wr32(falcon, 0x188 + (port * 0x10), tag++); -+ nvkm_falcon_wr32(falcon, 0x188 + (port * 0x10), tag); - while (len >= 4) { - nvkm_falcon_wr32(falcon, 0x184 + (port * 0x10), *(u32 *)img); - img += 4; -@@ -249,9 +249,11 @@ int - gm200_flcn_fw_load(struct nvkm_falcon_fw *fw) - { - struct nvkm_falcon *falcon = fw->falcon; -- int target, ret; -+ int ret; - - if (fw->inst) { -+ int target; -+ - nvkm_falcon_mask(falcon, 0x048, 0x00000001, 0x00000001); - - switch (nvkm_memory_target(fw->inst)) { -@@ -285,15 +287,6 @@ gm200_flcn_fw_load(struct nvkm_falcon_fw *fw) - } - - if (fw->boot) { -- switch (nvkm_memory_target(&fw->fw.mem.memory)) { -- case NVKM_MEM_TARGET_VRAM: target = 4; break; -- case NVKM_MEM_TARGET_HOST: target = 5; break; -- case NVKM_MEM_TARGET_NCOH: target = 6; break; -- default: -- WARN_ON(1); -- return -EINVAL; -- } -- - ret = nvkm_falcon_pio_wr(falcon, fw->boot, 0, 0, - IMEM, falcon->code.limit - fw->boot_size, fw->boot_size, - fw->boot_addr >> 8, false); -diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c -index 84625e817ce950..896f73aa4d2c82 100644 ---- a/drivers/hid/hid-asus.c -+++ b/drivers/hid/hid-asus.c -@@ -1108,7 +1108,13 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id) - return ret; - } - -- if (!drvdata->input) { -+ /* -+ * Check that input registration succeeded. Checking that -+ * HID_CLAIMED_INPUT is set prevents a UAF when all input devices -+ * were freed during registration due to no usages being mapped, -+ * leaving drvdata->input pointing to freed memory. -+ */ -+ if (!drvdata->input || !(hdev->claimed & HID_CLAIMED_INPUT)) { - hid_err(hdev, "Asus input not registered\n"); - ret = -ENOMEM; - goto err_stop_hw; -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index 0d1d7162814f32..3f74633070b6ec 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -818,6 +818,8 @@ - #define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019 0x6019 - #define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_602E 0x602e - #define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6093 0x6093 -+#define USB_DEVICE_ID_LENOVO_LEGION_GO_DUAL_DINPUT 0x6184 -+#define USB_DEVICE_ID_LENOVO_LEGION_GO2_DUAL_DINPUT 0x61ed - - #define USB_VENDOR_ID_LETSKETCH 0x6161 - #define USB_DEVICE_ID_WP9620N 0x4d15 -@@ -891,6 +893,7 @@ - #define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_2 0xc534 - #define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1 0xc539 - #define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1_1 0xc53f -+#define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1_2 0xc543 - #define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_POWERPLAY 0xc53a - #define USB_DEVICE_ID_LOGITECH_BOLT_RECEIVER 0xc548 - #define USB_DEVICE_ID_SPACETRAVELLER 0xc623 -diff --git a/drivers/hid/hid-input-test.c b/drivers/hid/hid-input-test.c -index 77c2d45ac62a7f..6f5c71660d823b 100644 ---- a/drivers/hid/hid-input-test.c -+++ b/drivers/hid/hid-input-test.c -@@ -7,7 +7,7 @@ - - #include - --static void hid_test_input_set_battery_charge_status(struct kunit *test) -+static void hid_test_input_update_battery_charge_status(struct kunit *test) - { - struct hid_device *dev; - bool handled; -@@ -15,15 +15,15 @@ static void hid_test_input_set_battery_charge_status(struct kunit *test) - dev = kunit_kzalloc(test, sizeof(*dev), GFP_KERNEL); - KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dev); - -- handled = hidinput_set_battery_charge_status(dev, HID_DG_HEIGHT, 0); -+ handled = hidinput_update_battery_charge_status(dev, HID_DG_HEIGHT, 0); - KUNIT_EXPECT_FALSE(test, handled); - KUNIT_EXPECT_EQ(test, dev->battery_charge_status, POWER_SUPPLY_STATUS_UNKNOWN); - -- handled = hidinput_set_battery_charge_status(dev, HID_BAT_CHARGING, 0); -+ handled = hidinput_update_battery_charge_status(dev, HID_BAT_CHARGING, 0); - KUNIT_EXPECT_TRUE(test, handled); - KUNIT_EXPECT_EQ(test, dev->battery_charge_status, POWER_SUPPLY_STATUS_DISCHARGING); - -- handled = hidinput_set_battery_charge_status(dev, HID_BAT_CHARGING, 1); -+ handled = hidinput_update_battery_charge_status(dev, HID_BAT_CHARGING, 1); - KUNIT_EXPECT_TRUE(test, handled); - KUNIT_EXPECT_EQ(test, dev->battery_charge_status, POWER_SUPPLY_STATUS_CHARGING); - } -@@ -63,7 +63,7 @@ static void hid_test_input_get_battery_property(struct kunit *test) - } - - static struct kunit_case hid_input_tests[] = { -- KUNIT_CASE(hid_test_input_set_battery_charge_status), -+ KUNIT_CASE(hid_test_input_update_battery_charge_status), - KUNIT_CASE(hid_test_input_get_battery_property), - { } - }; -diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c -index 9d80635a91ebd8..f5c217ac4bfaa7 100644 ---- a/drivers/hid/hid-input.c -+++ b/drivers/hid/hid-input.c -@@ -595,13 +595,33 @@ static void hidinput_cleanup_battery(struct hid_device *dev) - dev->battery = NULL; - } - --static void hidinput_update_battery(struct hid_device *dev, int value) -+static bool hidinput_update_battery_charge_status(struct hid_device *dev, -+ unsigned int usage, int value) -+{ -+ switch (usage) { -+ case HID_BAT_CHARGING: -+ dev->battery_charge_status = value ? -+ POWER_SUPPLY_STATUS_CHARGING : -+ POWER_SUPPLY_STATUS_DISCHARGING; -+ return true; -+ } -+ -+ return false; -+} -+ -+static void hidinput_update_battery(struct hid_device *dev, unsigned int usage, -+ int value) - { - int capacity; - - if (!dev->battery) - return; - -+ if (hidinput_update_battery_charge_status(dev, usage, value)) { -+ power_supply_changed(dev->battery); -+ return; -+ } -+ - if (value == 0 || value < dev->battery_min || value > dev->battery_max) - return; - -@@ -617,20 +637,6 @@ static void hidinput_update_battery(struct hid_device *dev, int value) - power_supply_changed(dev->battery); - } - } -- --static bool hidinput_set_battery_charge_status(struct hid_device *dev, -- unsigned int usage, int value) --{ -- switch (usage) { -- case HID_BAT_CHARGING: -- dev->battery_charge_status = value ? -- POWER_SUPPLY_STATUS_CHARGING : -- POWER_SUPPLY_STATUS_DISCHARGING; -- return true; -- } -- -- return false; --} - #else /* !CONFIG_HID_BATTERY_STRENGTH */ - static int hidinput_setup_battery(struct hid_device *dev, unsigned report_type, - struct hid_field *field, bool is_percentage) -@@ -642,14 +648,9 @@ static void hidinput_cleanup_battery(struct hid_device *dev) - { - } - --static void hidinput_update_battery(struct hid_device *dev, int value) --{ --} -- --static bool hidinput_set_battery_charge_status(struct hid_device *dev, -- unsigned int usage, int value) -+static void hidinput_update_battery(struct hid_device *dev, unsigned int usage, -+ int value) - { -- return false; - } - #endif /* CONFIG_HID_BATTERY_STRENGTH */ - -@@ -1515,11 +1516,7 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct - return; - - if (usage->type == EV_PWR) { -- bool handled = hidinput_set_battery_charge_status(hid, usage->hid, value); -- -- if (!handled) -- hidinput_update_battery(hid, value); -- -+ hidinput_update_battery(hid, usage->hid, value); - return; - } - -diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c -index 37958edec55f5f..e2d5b3f699146d 100644 ---- a/drivers/hid/hid-logitech-dj.c -+++ b/drivers/hid/hid-logitech-dj.c -@@ -1983,6 +1983,10 @@ static const struct hid_device_id logi_dj_receivers[] = { - HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, - USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1_1), - .driver_data = recvr_type_gaming_hidpp}, -+ { /* Logitech lightspeed receiver (0xc543) */ -+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, -+ USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1_2), -+ .driver_data = recvr_type_gaming_hidpp}, - - { /* Logitech 27 MHz HID++ 1.0 receiver (0xc513) */ - HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_MX3000_RECEIVER), -diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c -index 4519ee377aa767..3a2c1e48aba20c 100644 ---- a/drivers/hid/hid-logitech-hidpp.c -+++ b/drivers/hid/hid-logitech-hidpp.c -@@ -4652,6 +4652,8 @@ static const struct hid_device_id hidpp_devices[] = { - HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC094) }, - { /* Logitech G Pro X Superlight 2 Gaming Mouse over USB */ - HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC09b) }, -+ { /* Logitech G PRO 2 LIGHTSPEED Wireless Mouse over USB */ -+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xc09a) }, - - { /* G935 Gaming Headset */ - HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0x0a87), -diff --git a/drivers/hid/hid-mcp2221.c b/drivers/hid/hid-mcp2221.c -index c5bfca8ac5e6e8..a985301a4135f5 100644 ---- a/drivers/hid/hid-mcp2221.c -+++ b/drivers/hid/hid-mcp2221.c -@@ -49,6 +49,7 @@ enum { - MCP2221_I2C_MASK_ADDR_NACK = 0x40, - MCP2221_I2C_WRADDRL_SEND = 0x21, - MCP2221_I2C_ADDR_NACK = 0x25, -+ MCP2221_I2C_READ_PARTIAL = 0x54, - MCP2221_I2C_READ_COMPL = 0x55, - MCP2221_ALT_F_NOT_GPIOV = 0xEE, - MCP2221_ALT_F_NOT_GPIOD = 0xEF, -@@ -187,6 +188,25 @@ static int mcp_cancel_last_cmd(struct mcp2221 *mcp) - return mcp_send_data_req_status(mcp, mcp->txbuf, 8); - } - -+/* Check if the last command succeeded or failed and return the result. -+ * If the command did fail, cancel that command which will free the i2c bus. -+ */ -+static int mcp_chk_last_cmd_status_free_bus(struct mcp2221 *mcp) -+{ -+ int ret; -+ -+ ret = mcp_chk_last_cmd_status(mcp); -+ if (ret) { -+ /* The last command was a failure. -+ * Send a cancel which will also free the bus. -+ */ -+ usleep_range(980, 1000); -+ mcp_cancel_last_cmd(mcp); -+ } -+ -+ return ret; -+} -+ - static int mcp_set_i2c_speed(struct mcp2221 *mcp) - { - int ret; -@@ -241,7 +261,7 @@ static int mcp_i2c_write(struct mcp2221 *mcp, - usleep_range(980, 1000); - - if (last_status) { -- ret = mcp_chk_last_cmd_status(mcp); -+ ret = mcp_chk_last_cmd_status_free_bus(mcp); - if (ret) - return ret; - } -@@ -278,6 +298,7 @@ static int mcp_i2c_smbus_read(struct mcp2221 *mcp, - { - int ret; - u16 total_len; -+ int retries = 0; - - mcp->txbuf[0] = type; - if (msg) { -@@ -301,20 +322,31 @@ static int mcp_i2c_smbus_read(struct mcp2221 *mcp, - mcp->rxbuf_idx = 0; - - do { -+ /* Wait for the data to be read by the device */ -+ usleep_range(980, 1000); -+ - memset(mcp->txbuf, 0, 4); - mcp->txbuf[0] = MCP2221_I2C_GET_DATA; - - ret = mcp_send_data_req_status(mcp, mcp->txbuf, 1); -- if (ret) -- return ret; -- -- ret = mcp_chk_last_cmd_status(mcp); -- if (ret) -- return ret; -- -- usleep_range(980, 1000); -+ if (ret) { -+ if (retries < 5) { -+ /* The data wasn't ready to read. -+ * Wait a bit longer and try again. -+ */ -+ usleep_range(90, 100); -+ retries++; -+ } else { -+ return ret; -+ } -+ } else { -+ retries = 0; -+ } - } while (mcp->rxbuf_idx < total_len); - -+ usleep_range(980, 1000); -+ ret = mcp_chk_last_cmd_status_free_bus(mcp); -+ - return ret; - } - -@@ -328,11 +360,6 @@ static int mcp_i2c_xfer(struct i2c_adapter *adapter, - - mutex_lock(&mcp->lock); - -- /* Setting speed before every transaction is required for mcp2221 */ -- ret = mcp_set_i2c_speed(mcp); -- if (ret) -- goto exit; -- - if (num == 1) { - if (msgs->flags & I2C_M_RD) { - ret = mcp_i2c_smbus_read(mcp, msgs, MCP2221_I2C_RD_DATA, -@@ -417,9 +444,7 @@ static int mcp_smbus_write(struct mcp2221 *mcp, u16 addr, - if (last_status) { - usleep_range(980, 1000); - -- ret = mcp_chk_last_cmd_status(mcp); -- if (ret) -- return ret; -+ ret = mcp_chk_last_cmd_status_free_bus(mcp); - } - - return ret; -@@ -437,10 +462,6 @@ static int mcp_smbus_xfer(struct i2c_adapter *adapter, u16 addr, - - mutex_lock(&mcp->lock); - -- ret = mcp_set_i2c_speed(mcp); -- if (ret) -- goto exit; -- - switch (size) { - - case I2C_SMBUS_QUICK: -@@ -791,7 +812,8 @@ static int mcp2221_raw_event(struct hid_device *hdev, - mcp->status = -EIO; - break; - } -- if (data[2] == MCP2221_I2C_READ_COMPL) { -+ if (data[2] == MCP2221_I2C_READ_COMPL || -+ data[2] == MCP2221_I2C_READ_PARTIAL) { - buf = mcp->rxbuf; - memcpy(&buf[mcp->rxbuf_idx], &data[4], data[3]); - mcp->rxbuf_idx = mcp->rxbuf_idx + data[3]; -@@ -1152,6 +1174,11 @@ static int mcp2221_probe(struct hid_device *hdev, - if (i2c_clk_freq < 50) - i2c_clk_freq = 50; - mcp->cur_i2c_clk_div = (12000000 / (i2c_clk_freq * 1000)) - 3; -+ ret = mcp_set_i2c_speed(mcp); -+ if (ret) { -+ hid_err(hdev, "can't set i2c speed: %d\n", ret); -+ return ret; -+ } - - mcp->adapter.owner = THIS_MODULE; - mcp->adapter.class = I2C_CLASS_HWMON; -diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c -index becd4c1ccf93c1..a85581cd511fd3 100644 ---- a/drivers/hid/hid-multitouch.c -+++ b/drivers/hid/hid-multitouch.c -@@ -1448,6 +1448,14 @@ static __u8 *mt_report_fixup(struct hid_device *hdev, __u8 *rdesc, - if (hdev->vendor == I2C_VENDOR_ID_GOODIX && - (hdev->product == I2C_DEVICE_ID_GOODIX_01E8 || - hdev->product == I2C_DEVICE_ID_GOODIX_01E9)) { -+ if (*size < 608) { -+ dev_info( -+ &hdev->dev, -+ "GT7868Q fixup: report descriptor is only %u bytes, skipping\n", -+ *size); -+ return rdesc; -+ } -+ - if (rdesc[607] == 0x15) { - rdesc[607] = 0x25; - dev_info( -diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c -index b5d26f03fe6bb7..a1128c5315fffa 100644 ---- a/drivers/hid/hid-ntrig.c -+++ b/drivers/hid/hid-ntrig.c -@@ -144,6 +144,9 @@ static void ntrig_report_version(struct hid_device *hdev) - struct usb_device *usb_dev = hid_to_usb_dev(hdev); - unsigned char *data = kmalloc(8, GFP_KERNEL); - -+ if (!hid_is_usb(hdev)) -+ return; -+ - if (!data) - goto err_free; - -diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c -index 80372342c176af..64f9728018b885 100644 ---- a/drivers/hid/hid-quirks.c -+++ b/drivers/hid/hid-quirks.c -@@ -124,6 +124,8 @@ static const struct hid_device_id hid_quirks[] = { - { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X_V2), HID_QUIRK_MULTI_INPUT }, - { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_PENSKETCH_T609A), HID_QUIRK_MULTI_INPUT }, - { HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_ODDOR_HANDBRAKE), HID_QUIRK_ALWAYS_POLL }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_LEGION_GO_DUAL_DINPUT), HID_QUIRK_MULTI_INPUT }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_LEGION_GO2_DUAL_DINPUT), HID_QUIRK_MULTI_INPUT }, - { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_OPTICAL_USB_MOUSE_600E), HID_QUIRK_ALWAYS_POLL }, - { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D), HID_QUIRK_ALWAYS_POLL }, - { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019), HID_QUIRK_ALWAYS_POLL }, -diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c -index dd44373ba930e2..42bc8f05e26358 100644 ---- a/drivers/hid/wacom_wac.c -+++ b/drivers/hid/wacom_wac.c -@@ -684,6 +684,7 @@ static bool wacom_is_art_pen(int tool_id) - case 0x885: /* Intuos3 Marker Pen */ - case 0x804: /* Intuos4/5 13HD/24HD Marker Pen */ - case 0x10804: /* Intuos4/5 13HD/24HD Art Pen */ -+ case 0x204: /* Art Pen 2 */ - is_art_pen = true; - break; - } -diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c -index fad5a72d3b1671..f1208591ed67e3 100644 ---- a/drivers/net/ethernet/dlink/dl2k.c -+++ b/drivers/net/ethernet/dlink/dl2k.c -@@ -1092,7 +1092,7 @@ get_stats (struct net_device *dev) - dev->stats.rx_bytes += dr32(OctetRcvOk); - dev->stats.tx_bytes += dr32(OctetXmtOk); - -- dev->stats.multicast = dr32(McstFramesRcvdOk); -+ dev->stats.multicast += dr32(McstFramesRcvdOk); - dev->stats.collisions += dr32(SingleColFrames) - + dr32(MultiColFrames); - -diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c -index f5023ac9ab8323..eae4376c685952 100644 ---- a/drivers/net/ethernet/intel/ice/ice_txrx.c -+++ b/drivers/net/ethernet/intel/ice/ice_txrx.c -@@ -527,14 +527,14 @@ int ice_setup_rx_ring(struct ice_rx_ring *rx_ring) - * @xdp: xdp_buff used as input to the XDP program - * @xdp_prog: XDP program to run - * @xdp_ring: ring to be used for XDP_TX action -- * @rx_buf: Rx buffer to store the XDP action -+ * @eop_desc: Last descriptor in packet to read metadata from - * - * Returns any of ICE_XDP_{PASS, CONSUMED, TX, REDIR} - */ --static void -+static u32 - ice_run_xdp(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp, - struct bpf_prog *xdp_prog, struct ice_tx_ring *xdp_ring, -- struct ice_rx_buf *rx_buf) -+ union ice_32b_rx_flex_desc *eop_desc) - { - unsigned int ret = ICE_XDP_PASS; - u32 act; -@@ -542,6 +542,8 @@ ice_run_xdp(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp, - if (!xdp_prog) - goto exit; - -+ ice_xdp_meta_set_desc(xdp, eop_desc); -+ - act = bpf_prog_run_xdp(xdp_prog, xdp); - switch (act) { - case XDP_PASS: -@@ -571,7 +573,7 @@ ice_run_xdp(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp, - ret = ICE_XDP_CONSUMED; - } - exit: -- ice_set_rx_bufs_act(xdp, rx_ring, ret); -+ return ret; - } - - /** -@@ -857,10 +859,8 @@ ice_add_xdp_frag(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp, - xdp_buff_set_frags_flag(xdp); - } - -- if (unlikely(sinfo->nr_frags == MAX_SKB_FRAGS)) { -- ice_set_rx_bufs_act(xdp, rx_ring, ICE_XDP_CONSUMED); -+ if (unlikely(sinfo->nr_frags == MAX_SKB_FRAGS)) - return -ENOMEM; -- } - - __skb_fill_page_desc_noacc(sinfo, sinfo->nr_frags++, rx_buf->page, - rx_buf->page_offset, size); -@@ -921,7 +921,6 @@ ice_get_rx_buf(struct ice_rx_ring *rx_ring, const unsigned int size, - struct ice_rx_buf *rx_buf; - - rx_buf = &rx_ring->rx_buf[ntc]; -- rx_buf->pgcnt = page_count(rx_buf->page); - prefetchw(rx_buf->page); - - if (!size) -@@ -937,6 +936,31 @@ ice_get_rx_buf(struct ice_rx_ring *rx_ring, const unsigned int size, - return rx_buf; - } - -+/** -+ * ice_get_pgcnts - grab page_count() for gathered fragments -+ * @rx_ring: Rx descriptor ring to store the page counts on -+ * -+ * This function is intended to be called right before running XDP -+ * program so that the page recycling mechanism will be able to take -+ * a correct decision regarding underlying pages; this is done in such -+ * way as XDP program can change the refcount of page -+ */ -+static void ice_get_pgcnts(struct ice_rx_ring *rx_ring) -+{ -+ u32 nr_frags = rx_ring->nr_frags + 1; -+ u32 idx = rx_ring->first_desc; -+ struct ice_rx_buf *rx_buf; -+ u32 cnt = rx_ring->count; -+ -+ for (int i = 0; i < nr_frags; i++) { -+ rx_buf = &rx_ring->rx_buf[idx]; -+ rx_buf->pgcnt = page_count(rx_buf->page); -+ -+ if (++idx == cnt) -+ idx = 0; -+ } -+} -+ - /** - * ice_build_skb - Build skb around an existing buffer - * @rx_ring: Rx descriptor ring to transact packets on -@@ -1049,12 +1073,12 @@ ice_construct_skb(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp) - rx_buf->page_offset + headlen, size, - xdp->frame_sz); - } else { -- /* buffer is unused, change the act that should be taken later -- * on; data was copied onto skb's linear part so there's no -+ /* buffer is unused, restore biased page count in Rx buffer; -+ * data was copied onto skb's linear part so there's no - * need for adjusting page offset and we can reuse this buffer - * as-is - */ -- rx_buf->act = ICE_SKB_CONSUMED; -+ rx_buf->pagecnt_bias++; - } - - if (unlikely(xdp_buff_has_frags(xdp))) { -@@ -1107,29 +1131,34 @@ ice_put_rx_buf(struct ice_rx_ring *rx_ring, struct ice_rx_buf *rx_buf) - * @xdp: XDP buffer carrying linear + frags part - * @xdp_xmit: XDP_TX/XDP_REDIRECT verdict storage - * @ntc: a current next_to_clean value to be stored at rx_ring -+ * @verdict: return code from XDP program execution - * - * Walk through gathered fragments and satisfy internal page - * recycle mechanism; we take here an action related to verdict - * returned by XDP program; - */ - static void ice_put_rx_mbuf(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp, -- u32 *xdp_xmit, u32 ntc) -+ u32 *xdp_xmit, u32 ntc, u32 verdict) - { - u32 nr_frags = rx_ring->nr_frags + 1; - u32 idx = rx_ring->first_desc; - u32 cnt = rx_ring->count; -+ u32 post_xdp_frags = 1; - struct ice_rx_buf *buf; - int i; - -- for (i = 0; i < nr_frags; i++) { -+ if (unlikely(xdp_buff_has_frags(xdp))) -+ post_xdp_frags += xdp_get_shared_info_from_buff(xdp)->nr_frags; -+ -+ for (i = 0; i < post_xdp_frags; i++) { - buf = &rx_ring->rx_buf[idx]; - -- if (buf->act & (ICE_XDP_TX | ICE_XDP_REDIR)) { -+ if (verdict & (ICE_XDP_TX | ICE_XDP_REDIR)) { - ice_rx_buf_adjust_pg_offset(buf, xdp->frame_sz); -- *xdp_xmit |= buf->act; -- } else if (buf->act & ICE_XDP_CONSUMED) { -+ *xdp_xmit |= verdict; -+ } else if (verdict & ICE_XDP_CONSUMED) { - buf->pagecnt_bias++; -- } else if (buf->act == ICE_XDP_PASS) { -+ } else if (verdict == ICE_XDP_PASS) { - ice_rx_buf_adjust_pg_offset(buf, xdp->frame_sz); - } - -@@ -1138,6 +1167,17 @@ static void ice_put_rx_mbuf(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp, - if (++idx == cnt) - idx = 0; - } -+ /* handle buffers that represented frags released by XDP prog; -+ * for these we keep pagecnt_bias as-is; refcount from struct page -+ * has been decremented within XDP prog and we do not have to increase -+ * the biased refcnt -+ */ -+ for (; i < nr_frags; i++) { -+ buf = &rx_ring->rx_buf[idx]; -+ ice_put_rx_buf(rx_ring, buf); -+ if (++idx == cnt) -+ idx = 0; -+ } - - xdp->data = NULL; - rx_ring->first_desc = ntc; -@@ -1164,9 +1204,9 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget) - struct ice_tx_ring *xdp_ring = NULL; - struct bpf_prog *xdp_prog = NULL; - u32 ntc = rx_ring->next_to_clean; -+ u32 cached_ntu, xdp_verdict; - u32 cnt = rx_ring->count; - u32 xdp_xmit = 0; -- u32 cached_ntu; - bool failure; - - xdp_prog = READ_ONCE(rx_ring->xdp_prog); -@@ -1230,7 +1270,7 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget) - xdp_prepare_buff(xdp, hard_start, offset, size, !!offset); - xdp_buff_clear_frags_flag(xdp); - } else if (ice_add_xdp_frag(rx_ring, xdp, rx_buf, size)) { -- ice_put_rx_mbuf(rx_ring, xdp, NULL, ntc); -+ ice_put_rx_mbuf(rx_ring, xdp, NULL, ntc, ICE_XDP_CONSUMED); - break; - } - if (++ntc == cnt) -@@ -1240,13 +1280,14 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget) - if (ice_is_non_eop(rx_ring, rx_desc)) - continue; - -- ice_run_xdp(rx_ring, xdp, xdp_prog, xdp_ring, rx_buf); -- if (rx_buf->act == ICE_XDP_PASS) -+ ice_get_pgcnts(rx_ring); -+ xdp_verdict = ice_run_xdp(rx_ring, xdp, xdp_prog, xdp_ring, rx_desc); -+ if (xdp_verdict == ICE_XDP_PASS) - goto construct_skb; - total_rx_bytes += xdp_get_buff_len(xdp); - total_rx_pkts++; - -- ice_put_rx_mbuf(rx_ring, xdp, &xdp_xmit, ntc); -+ ice_put_rx_mbuf(rx_ring, xdp, &xdp_xmit, ntc, xdp_verdict); - - continue; - construct_skb: -@@ -1256,13 +1297,10 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget) - skb = ice_construct_skb(rx_ring, xdp); - /* exit if we failed to retrieve a buffer */ - if (!skb) { -- rx_ring->ring_stats->rx_stats.alloc_page_failed++; -- rx_buf->act = ICE_XDP_CONSUMED; -- if (unlikely(xdp_buff_has_frags(xdp))) -- ice_set_rx_bufs_act(xdp, rx_ring, -- ICE_XDP_CONSUMED); -+ rx_ring->ring_stats->rx_stats.alloc_buf_failed++; -+ xdp_verdict = ICE_XDP_CONSUMED; - } -- ice_put_rx_mbuf(rx_ring, xdp, &xdp_xmit, ntc); -+ ice_put_rx_mbuf(rx_ring, xdp, &xdp_xmit, ntc, xdp_verdict); - - if (!skb) - break; -diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.h b/drivers/net/ethernet/intel/ice/ice_txrx.h -index 407d4c320097f6..53a155dde3e320 100644 ---- a/drivers/net/ethernet/intel/ice/ice_txrx.h -+++ b/drivers/net/ethernet/intel/ice/ice_txrx.h -@@ -201,7 +201,6 @@ struct ice_rx_buf { - struct page *page; - unsigned int page_offset; - unsigned int pgcnt; -- unsigned int act; - unsigned int pagecnt_bias; - }; - -@@ -257,6 +256,14 @@ enum ice_rx_dtype { - ICE_RX_DTYPE_SPLIT_ALWAYS = 2, - }; - -+struct ice_xdp_buff { -+ struct xdp_buff xdp_buff; -+ const union ice_32b_rx_flex_desc *eop_desc; -+}; -+ -+/* Required for compatibility with xdp_buffs from xsk_pool */ -+static_assert(offsetof(struct ice_xdp_buff, xdp_buff) == 0); -+ - /* indices into GLINT_ITR registers */ - #define ICE_RX_ITR ICE_IDX_ITR0 - #define ICE_TX_ITR ICE_IDX_ITR1 -@@ -298,7 +305,6 @@ enum ice_dynamic_itr { - /* descriptor ring, associated with a VSI */ - struct ice_rx_ring { - /* CL1 - 1st cacheline starts here */ -- struct ice_rx_ring *next; /* pointer to next ring in q_vector */ - void *desc; /* Descriptor ring memory */ - struct device *dev; /* Used for DMA mapping */ - struct net_device *netdev; /* netdev ring maps to */ -@@ -310,12 +316,16 @@ struct ice_rx_ring { - u16 count; /* Number of descriptors */ - u16 reg_idx; /* HW register index of the ring */ - u16 next_to_alloc; -- /* CL2 - 2nd cacheline starts here */ -+ - union { - struct ice_rx_buf *rx_buf; - struct xdp_buff **xdp_buf; - }; -- struct xdp_buff xdp; -+ /* CL2 - 2nd cacheline starts here */ -+ union { -+ struct ice_xdp_buff xdp_ext; -+ struct xdp_buff xdp; -+ }; - /* CL3 - 3rd cacheline starts here */ - struct bpf_prog *xdp_prog; - u16 rx_offset; -@@ -332,6 +342,7 @@ struct ice_rx_ring { - /* CL4 - 4th cacheline starts here */ - struct ice_channel *ch; - struct ice_tx_ring *xdp_ring; -+ struct ice_rx_ring *next; /* pointer to next ring in q_vector */ - struct xsk_buff_pool *xsk_pool; - u32 nr_frags; - dma_addr_t dma; /* physical address of ring */ -diff --git a/drivers/net/ethernet/intel/ice/ice_txrx_lib.h b/drivers/net/ethernet/intel/ice/ice_txrx_lib.h -index b0e56675f98b2a..41efafc5eb386a 100644 ---- a/drivers/net/ethernet/intel/ice/ice_txrx_lib.h -+++ b/drivers/net/ethernet/intel/ice/ice_txrx_lib.h -@@ -5,49 +5,6 @@ - #define _ICE_TXRX_LIB_H_ - #include "ice.h" - --/** -- * ice_set_rx_bufs_act - propagate Rx buffer action to frags -- * @xdp: XDP buffer representing frame (linear and frags part) -- * @rx_ring: Rx ring struct -- * act: action to store onto Rx buffers related to XDP buffer parts -- * -- * Set action that should be taken before putting Rx buffer from first frag -- * to the last. -- */ --static inline void --ice_set_rx_bufs_act(struct xdp_buff *xdp, const struct ice_rx_ring *rx_ring, -- const unsigned int act) --{ -- u32 sinfo_frags = xdp_get_shared_info_from_buff(xdp)->nr_frags; -- u32 nr_frags = rx_ring->nr_frags + 1; -- u32 idx = rx_ring->first_desc; -- u32 cnt = rx_ring->count; -- struct ice_rx_buf *buf; -- -- for (int i = 0; i < nr_frags; i++) { -- buf = &rx_ring->rx_buf[idx]; -- buf->act = act; -- -- if (++idx == cnt) -- idx = 0; -- } -- -- /* adjust pagecnt_bias on frags freed by XDP prog */ -- if (sinfo_frags < rx_ring->nr_frags && act == ICE_XDP_CONSUMED) { -- u32 delta = rx_ring->nr_frags - sinfo_frags; -- -- while (delta) { -- if (idx == 0) -- idx = cnt - 1; -- else -- idx--; -- buf = &rx_ring->rx_buf[idx]; -- buf->pagecnt_bias--; -- delta--; -- } -- } --} -- - /** - * ice_test_staterr - tests bits in Rx descriptor status and error fields - * @status_err_n: Rx descriptor status_error0 or status_error1 bits -@@ -164,4 +121,14 @@ ice_process_skb_fields(struct ice_rx_ring *rx_ring, - struct sk_buff *skb, u16 ptype); - void - ice_receive_skb(struct ice_rx_ring *rx_ring, struct sk_buff *skb, u16 vlan_tag); -+ -+static inline void -+ice_xdp_meta_set_desc(struct xdp_buff *xdp, -+ union ice_32b_rx_flex_desc *eop_desc) -+{ -+ struct ice_xdp_buff *xdp_ext = container_of(xdp, struct ice_xdp_buff, -+ xdp_buff); -+ -+ xdp_ext->eop_desc = eop_desc; -+} - #endif /* !_ICE_TXRX_LIB_H_ */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -index f66788a2ed77ec..8489b5087d9c60 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -@@ -107,7 +107,7 @@ static int mlx5_devlink_reload_fw_activate(struct devlink *devlink, struct netli - if (err) - return err; - -- mlx5_unload_one_devl_locked(dev, true); -+ mlx5_sync_reset_unload_flow(dev, true); - err = mlx5_health_wait_pci_up(dev); - if (err) - NL_SET_ERR_MSG_MOD(extack, "FW activate aborted, PCI reads fail after reset"); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c -index 3efa8bf1d14ef4..4720523813b976 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c -@@ -575,7 +575,6 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, - if (err) - return err; - } -- priv->dcbx.xoff = xoff; - - /* Apply the settings */ - if (update_buffer) { -@@ -584,6 +583,8 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, - return err; - } - -+ priv->dcbx.xoff = xoff; -+ - if (update_prio2buffer) - err = mlx5e_port_set_priority2buffer(priv->mdev, prio2buffer); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h -index f4a19ffbb641c0..66d276a1be836a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h -@@ -66,11 +66,23 @@ struct mlx5e_port_buffer { - struct mlx5e_bufferx_reg buffer[MLX5E_MAX_NETWORK_BUFFER]; - }; - -+#ifdef CONFIG_MLX5_CORE_EN_DCB - int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, - u32 change, unsigned int mtu, - struct ieee_pfc *pfc, - u32 *buffer_size, - u8 *prio2buffer); -+#else -+static inline int -+mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, -+ u32 change, unsigned int mtu, -+ void *pfc, -+ u32 *buffer_size, -+ u8 *prio2buffer) -+{ -+ return 0; -+} -+#endif - - int mlx5e_port_query_buffer(struct mlx5e_priv *priv, - struct mlx5e_port_buffer *port_buffer); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 5c6f01abdcb91d..d378aa55f22f90 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -44,6 +44,7 @@ - #include "eswitch.h" - #include "en.h" - #include "en/txrx.h" -+#include "en/port_buffer.h" - #include "en_tc.h" - #include "en_rep.h" - #include "en_accel/ipsec.h" -@@ -108,6 +109,8 @@ void mlx5e_update_carrier(struct mlx5e_priv *priv) - if (up) { - netdev_info(priv->netdev, "Link up\n"); - netif_carrier_on(priv->netdev); -+ mlx5e_port_manual_buffer_config(priv, 0, priv->netdev->mtu, -+ NULL, NULL, NULL); - } else { - netdev_info(priv->netdev, "Link down\n"); - netif_carrier_off(priv->netdev); -@@ -2722,9 +2725,11 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) - struct mlx5e_params *params = &priv->channels.params; - struct net_device *netdev = priv->netdev; - struct mlx5_core_dev *mdev = priv->mdev; -- u16 mtu; -+ u16 mtu, prev_mtu; - int err; - -+ mlx5e_query_mtu(mdev, params, &prev_mtu); -+ - err = mlx5e_set_mtu(mdev, params, params->sw_mtu); - if (err) - return err; -@@ -2734,6 +2739,18 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) - netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n", - __func__, mtu, params->sw_mtu); - -+ if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) { -+ err = mlx5e_port_manual_buffer_config(priv, 0, mtu, -+ NULL, NULL, NULL); -+ if (err) { -+ netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n", -+ __func__, mtu, err, prev_mtu); -+ -+ mlx5e_set_mtu(mdev, params, prev_mtu); -+ return err; -+ } -+ } -+ - params->sw_mtu = mtu; - return 0; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c -index 6b17346aa4cef2..1547704c89767f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c -@@ -6,13 +6,15 @@ - #include "fw_reset.h" - #include "diag/fw_tracer.h" - #include "lib/tout.h" -+#include "sf/sf.h" - - enum { - MLX5_FW_RESET_FLAGS_RESET_REQUESTED, - MLX5_FW_RESET_FLAGS_NACK_RESET_REQUEST, - MLX5_FW_RESET_FLAGS_PENDING_COMP, - MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS, -- MLX5_FW_RESET_FLAGS_RELOAD_REQUIRED -+ MLX5_FW_RESET_FLAGS_RELOAD_REQUIRED, -+ MLX5_FW_RESET_FLAGS_UNLOAD_EVENT, - }; - - struct mlx5_fw_reset { -@@ -26,6 +28,7 @@ struct mlx5_fw_reset { - struct work_struct reset_now_work; - struct work_struct reset_abort_work; - unsigned long reset_flags; -+ u8 reset_method; - struct timer_list timer; - struct completion done; - int ret; -@@ -94,7 +97,7 @@ static int mlx5_reg_mfrl_set(struct mlx5_core_dev *dev, u8 reset_level, - } - - static int mlx5_reg_mfrl_query(struct mlx5_core_dev *dev, u8 *reset_level, -- u8 *reset_type, u8 *reset_state) -+ u8 *reset_type, u8 *reset_state, u8 *reset_method) - { - u32 out[MLX5_ST_SZ_DW(mfrl_reg)] = {}; - u32 in[MLX5_ST_SZ_DW(mfrl_reg)] = {}; -@@ -110,13 +113,26 @@ static int mlx5_reg_mfrl_query(struct mlx5_core_dev *dev, u8 *reset_level, - *reset_type = MLX5_GET(mfrl_reg, out, reset_type); - if (reset_state) - *reset_state = MLX5_GET(mfrl_reg, out, reset_state); -+ if (reset_method) -+ *reset_method = MLX5_GET(mfrl_reg, out, pci_reset_req_method); - - return 0; - } - - int mlx5_fw_reset_query(struct mlx5_core_dev *dev, u8 *reset_level, u8 *reset_type) - { -- return mlx5_reg_mfrl_query(dev, reset_level, reset_type, NULL); -+ return mlx5_reg_mfrl_query(dev, reset_level, reset_type, NULL, NULL); -+} -+ -+static int mlx5_fw_reset_get_reset_method(struct mlx5_core_dev *dev, -+ u8 *reset_method) -+{ -+ if (!MLX5_CAP_GEN(dev, pcie_reset_using_hotreset_method)) { -+ *reset_method = MLX5_MFRL_REG_PCI_RESET_METHOD_LINK_TOGGLE; -+ return 0; -+ } -+ -+ return mlx5_reg_mfrl_query(dev, NULL, NULL, NULL, reset_method); - } - - static int mlx5_fw_reset_get_reset_state_err(struct mlx5_core_dev *dev, -@@ -124,7 +140,7 @@ static int mlx5_fw_reset_get_reset_state_err(struct mlx5_core_dev *dev, - { - u8 reset_state; - -- if (mlx5_reg_mfrl_query(dev, NULL, NULL, &reset_state)) -+ if (mlx5_reg_mfrl_query(dev, NULL, NULL, &reset_state, NULL)) - goto out; - - if (!reset_state) -@@ -203,7 +219,7 @@ int mlx5_fw_reset_set_live_patch(struct mlx5_core_dev *dev) - return mlx5_reg_mfrl_set(dev, MLX5_MFRL_REG_RESET_LEVEL0, 0, 0, false); - } - --static void mlx5_fw_reset_complete_reload(struct mlx5_core_dev *dev, bool unloaded) -+static void mlx5_fw_reset_complete_reload(struct mlx5_core_dev *dev) - { - struct mlx5_fw_reset *fw_reset = dev->priv.fw_reset; - struct devlink *devlink = priv_to_devlink(dev); -@@ -212,8 +228,7 @@ static void mlx5_fw_reset_complete_reload(struct mlx5_core_dev *dev, bool unload - if (test_bit(MLX5_FW_RESET_FLAGS_PENDING_COMP, &fw_reset->reset_flags)) { - complete(&fw_reset->done); - } else { -- if (!unloaded) -- mlx5_unload_one(dev, false); -+ mlx5_sync_reset_unload_flow(dev, false); - if (mlx5_health_wait_pci_up(dev)) - mlx5_core_err(dev, "reset reload flow aborted, PCI reads still not working\n"); - else -@@ -256,7 +271,7 @@ static void mlx5_sync_reset_reload_work(struct work_struct *work) - - mlx5_sync_reset_clear_reset_requested(dev, false); - mlx5_enter_error_state(dev, true); -- mlx5_fw_reset_complete_reload(dev, false); -+ mlx5_fw_reset_complete_reload(dev); - } - - #define MLX5_RESET_POLL_INTERVAL (HZ / 10) -@@ -383,6 +398,11 @@ static bool mlx5_is_reset_now_capable(struct mlx5_core_dev *dev) - return false; - } - -+ if (!mlx5_core_is_ecpf(dev) && !mlx5_sf_table_empty(dev)) { -+ mlx5_core_warn(dev, "SFs should be removed before reset\n"); -+ return false; -+ } -+ - #if IS_ENABLED(CONFIG_HOTPLUG_PCI_PCIE) - err = mlx5_check_hotplug_interrupt(dev); - if (err) -@@ -402,7 +422,11 @@ static void mlx5_sync_reset_request_event(struct work_struct *work) - struct mlx5_core_dev *dev = fw_reset->dev; - int err; - -- if (test_bit(MLX5_FW_RESET_FLAGS_NACK_RESET_REQUEST, &fw_reset->reset_flags) || -+ err = mlx5_fw_reset_get_reset_method(dev, &fw_reset->reset_method); -+ if (err) -+ mlx5_core_warn(dev, "Failed reading MFRL, err %d\n", err); -+ -+ if (err || test_bit(MLX5_FW_RESET_FLAGS_NACK_RESET_REQUEST, &fw_reset->reset_flags) || - !mlx5_is_reset_now_capable(dev)) { - err = mlx5_fw_reset_set_reset_sync_nack(dev); - mlx5_core_warn(dev, "PCI Sync FW Update Reset Nack %s", -@@ -419,21 +443,15 @@ static void mlx5_sync_reset_request_event(struct work_struct *work) - mlx5_core_warn(dev, "PCI Sync FW Update Reset Ack. Device reset is expected.\n"); - } - --static int mlx5_pci_link_toggle(struct mlx5_core_dev *dev) -+static int mlx5_pci_link_toggle(struct mlx5_core_dev *dev, u16 dev_id) - { - struct pci_bus *bridge_bus = dev->pdev->bus; - struct pci_dev *bridge = bridge_bus->self; - unsigned long timeout; - struct pci_dev *sdev; -- u16 reg16, dev_id; - int cap, err; -+ u16 reg16; - -- err = pci_read_config_word(dev->pdev, PCI_DEVICE_ID, &dev_id); -- if (err) -- return pcibios_err_to_errno(err); -- err = mlx5_check_dev_ids(dev, dev_id); -- if (err) -- return err; - cap = pci_find_capability(bridge, PCI_CAP_ID_EXP); - if (!cap) - return -EOPNOTSUPP; -@@ -503,64 +521,60 @@ static int mlx5_pci_link_toggle(struct mlx5_core_dev *dev) - return err; - } - --static void mlx5_sync_reset_now_event(struct work_struct *work) -+static int mlx5_pci_reset_bus(struct mlx5_core_dev *dev) - { -- struct mlx5_fw_reset *fw_reset = container_of(work, struct mlx5_fw_reset, -- reset_now_work); -- struct mlx5_core_dev *dev = fw_reset->dev; -- int err; -+ if (!MLX5_CAP_GEN(dev, pcie_reset_using_hotreset_method)) -+ return -EOPNOTSUPP; - -- if (mlx5_sync_reset_clear_reset_requested(dev, false)) -- return; -+ return pci_reset_bus(dev->pdev); -+} - -- mlx5_core_warn(dev, "Sync Reset now. Device is going to reset.\n"); -+static int mlx5_sync_pci_reset(struct mlx5_core_dev *dev, u8 reset_method) -+{ -+ u16 dev_id; -+ int err; - -- err = mlx5_cmd_fast_teardown_hca(dev); -- if (err) { -- mlx5_core_warn(dev, "Fast teardown failed, no reset done, err %d\n", err); -- goto done; -- } -+ err = pci_read_config_word(dev->pdev, PCI_DEVICE_ID, &dev_id); -+ if (err) -+ return pcibios_err_to_errno(err); -+ err = mlx5_check_dev_ids(dev, dev_id); -+ if (err) -+ return err; - -- err = mlx5_pci_link_toggle(dev); -- if (err) { -- mlx5_core_warn(dev, "mlx5_pci_link_toggle failed, no reset done, err %d\n", err); -- set_bit(MLX5_FW_RESET_FLAGS_RELOAD_REQUIRED, &fw_reset->reset_flags); -+ switch (reset_method) { -+ case MLX5_MFRL_REG_PCI_RESET_METHOD_LINK_TOGGLE: -+ err = mlx5_pci_link_toggle(dev, dev_id); -+ if (err) -+ mlx5_core_warn(dev, "mlx5_pci_link_toggle failed\n"); -+ break; -+ case MLX5_MFRL_REG_PCI_RESET_METHOD_HOT_RESET: -+ err = mlx5_pci_reset_bus(dev); -+ if (err) -+ mlx5_core_warn(dev, "mlx5_pci_reset_bus failed\n"); -+ break; -+ default: -+ return -EOPNOTSUPP; - } - -- mlx5_enter_error_state(dev, true); --done: -- fw_reset->ret = err; -- mlx5_fw_reset_complete_reload(dev, false); -+ return err; - } - --static void mlx5_sync_reset_unload_event(struct work_struct *work) -+void mlx5_sync_reset_unload_flow(struct mlx5_core_dev *dev, bool locked) - { -- struct mlx5_fw_reset *fw_reset; -- struct mlx5_core_dev *dev; -+ struct mlx5_fw_reset *fw_reset = dev->priv.fw_reset; - unsigned long timeout; - bool reset_action; - u8 rst_state; - int err; - -- fw_reset = container_of(work, struct mlx5_fw_reset, reset_unload_work); -- dev = fw_reset->dev; -- -- if (mlx5_sync_reset_clear_reset_requested(dev, false)) -- return; -- -- mlx5_core_warn(dev, "Sync Reset Unload. Function is forced down.\n"); -- -- err = mlx5_cmd_fast_teardown_hca(dev); -- if (err) -- mlx5_core_warn(dev, "Fast teardown failed, unloading, err %d\n", err); -- else -- mlx5_enter_error_state(dev, true); -- -- if (test_bit(MLX5_FW_RESET_FLAGS_PENDING_COMP, &fw_reset->reset_flags)) -+ if (locked) - mlx5_unload_one_devl_locked(dev, false); - else - mlx5_unload_one(dev, false); - -+ if (!test_bit(MLX5_FW_RESET_FLAGS_UNLOAD_EVENT, &fw_reset->reset_flags)) -+ return; -+ - mlx5_set_fw_rst_ack(dev); - mlx5_core_warn(dev, "Sync Reset Unload done, device reset expected\n"); - -@@ -583,17 +597,73 @@ static void mlx5_sync_reset_unload_event(struct work_struct *work) - goto done; - } - -- mlx5_core_warn(dev, "Sync Reset, got reset action. rst_state = %u\n", rst_state); -+ mlx5_core_warn(dev, "Sync Reset, got reset action. rst_state = %u\n", -+ rst_state); - if (rst_state == MLX5_FW_RST_STATE_TOGGLE_REQ) { -- err = mlx5_pci_link_toggle(dev); -+ err = mlx5_sync_pci_reset(dev, fw_reset->reset_method); - if (err) { -- mlx5_core_warn(dev, "mlx5_pci_link_toggle failed, err %d\n", err); -+ mlx5_core_warn(dev, "mlx5_sync_pci_reset failed, err %d\n", -+ err); - fw_reset->ret = err; - } - } - - done: -- mlx5_fw_reset_complete_reload(dev, true); -+ clear_bit(MLX5_FW_RESET_FLAGS_UNLOAD_EVENT, &fw_reset->reset_flags); -+} -+ -+static void mlx5_sync_reset_now_event(struct work_struct *work) -+{ -+ struct mlx5_fw_reset *fw_reset = container_of(work, struct mlx5_fw_reset, -+ reset_now_work); -+ struct mlx5_core_dev *dev = fw_reset->dev; -+ int err; -+ -+ if (mlx5_sync_reset_clear_reset_requested(dev, false)) -+ return; -+ -+ mlx5_core_warn(dev, "Sync Reset now. Device is going to reset.\n"); -+ -+ err = mlx5_cmd_fast_teardown_hca(dev); -+ if (err) { -+ mlx5_core_warn(dev, "Fast teardown failed, no reset done, err %d\n", err); -+ goto done; -+ } -+ -+ err = mlx5_sync_pci_reset(dev, fw_reset->reset_method); -+ if (err) { -+ mlx5_core_warn(dev, "mlx5_sync_pci_reset failed, no reset done, err %d\n", err); -+ set_bit(MLX5_FW_RESET_FLAGS_RELOAD_REQUIRED, &fw_reset->reset_flags); -+ } -+ -+ mlx5_enter_error_state(dev, true); -+done: -+ fw_reset->ret = err; -+ mlx5_fw_reset_complete_reload(dev); -+} -+ -+static void mlx5_sync_reset_unload_event(struct work_struct *work) -+{ -+ struct mlx5_fw_reset *fw_reset; -+ struct mlx5_core_dev *dev; -+ int err; -+ -+ fw_reset = container_of(work, struct mlx5_fw_reset, reset_unload_work); -+ dev = fw_reset->dev; -+ -+ if (mlx5_sync_reset_clear_reset_requested(dev, false)) -+ return; -+ -+ set_bit(MLX5_FW_RESET_FLAGS_UNLOAD_EVENT, &fw_reset->reset_flags); -+ mlx5_core_warn(dev, "Sync Reset Unload. Function is forced down.\n"); -+ -+ err = mlx5_cmd_fast_teardown_hca(dev); -+ if (err) -+ mlx5_core_warn(dev, "Fast teardown failed, unloading, err %d\n", err); -+ else -+ mlx5_enter_error_state(dev, true); -+ -+ mlx5_fw_reset_complete_reload(dev); - } - - static void mlx5_sync_reset_abort_event(struct work_struct *work) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h -index ea527d06a85f07..d5b28525c960dc 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h -@@ -12,6 +12,7 @@ int mlx5_fw_reset_set_reset_sync(struct mlx5_core_dev *dev, u8 reset_type_sel, - int mlx5_fw_reset_set_live_patch(struct mlx5_core_dev *dev); - - int mlx5_fw_reset_wait_reset_done(struct mlx5_core_dev *dev); -+void mlx5_sync_reset_unload_flow(struct mlx5_core_dev *dev, bool locked); - int mlx5_fw_reset_verify_fw_complete(struct mlx5_core_dev *dev, - struct netlink_ext_ack *extack); - void mlx5_fw_reset_events_start(struct mlx5_core_dev *dev); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index 62a85f09b52fd7..8a11e410f7c135 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -627,6 +627,9 @@ static int handle_hca_cap(struct mlx5_core_dev *dev, void *set_ctx) - if (MLX5_CAP_GEN_MAX(dev, pci_sync_for_fw_update_with_driver_unload)) - MLX5_SET(cmd_hca_cap, set_hca_cap, - pci_sync_for_fw_update_with_driver_unload, 1); -+ if (MLX5_CAP_GEN_MAX(dev, pcie_reset_using_hotreset_method)) -+ MLX5_SET(cmd_hca_cap, set_hca_cap, -+ pcie_reset_using_hotreset_method, 1); - - if (MLX5_CAP_GEN_MAX(dev, num_vhca_ports)) - MLX5_SET(cmd_hca_cap, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c -index e34a8f88c518c1..d5b2b6cfc8d21d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c -@@ -20,9 +20,16 @@ struct mlx5_sf { - u16 hw_state; - }; - -+static void *mlx5_sf_by_dl_port(struct devlink_port *dl_port) -+{ -+ struct mlx5_devlink_port *mlx5_dl_port = mlx5_devlink_port_get(dl_port); -+ -+ return container_of(mlx5_dl_port, struct mlx5_sf, dl_port); -+} -+ - struct mlx5_sf_table { - struct mlx5_core_dev *dev; /* To refer from notifier context. */ -- struct xarray port_indices; /* port index based lookup. */ -+ struct xarray function_ids; /* function id based lookup. */ - refcount_t refcount; - struct completion disable_complete; - struct mutex sf_state_lock; /* Serializes sf state among user cmds & vhca event handler. */ -@@ -30,33 +37,20 @@ struct mlx5_sf_table { - struct notifier_block vhca_nb; - }; - --static struct mlx5_sf * --mlx5_sf_lookup_by_index(struct mlx5_sf_table *table, unsigned int port_index) --{ -- return xa_load(&table->port_indices, port_index); --} -- - static struct mlx5_sf * - mlx5_sf_lookup_by_function_id(struct mlx5_sf_table *table, unsigned int fn_id) - { -- unsigned long index; -- struct mlx5_sf *sf; -- -- xa_for_each(&table->port_indices, index, sf) { -- if (sf->hw_fn_id == fn_id) -- return sf; -- } -- return NULL; -+ return xa_load(&table->function_ids, fn_id); - } - --static int mlx5_sf_id_insert(struct mlx5_sf_table *table, struct mlx5_sf *sf) -+static int mlx5_sf_function_id_insert(struct mlx5_sf_table *table, struct mlx5_sf *sf) - { -- return xa_insert(&table->port_indices, sf->port_index, sf, GFP_KERNEL); -+ return xa_insert(&table->function_ids, sf->hw_fn_id, sf, GFP_KERNEL); - } - --static void mlx5_sf_id_erase(struct mlx5_sf_table *table, struct mlx5_sf *sf) -+static void mlx5_sf_function_id_erase(struct mlx5_sf_table *table, struct mlx5_sf *sf) - { -- xa_erase(&table->port_indices, sf->port_index); -+ xa_erase(&table->function_ids, sf->hw_fn_id); - } - - static struct mlx5_sf * -@@ -93,7 +87,7 @@ mlx5_sf_alloc(struct mlx5_sf_table *table, struct mlx5_eswitch *esw, - sf->hw_state = MLX5_VHCA_STATE_ALLOCATED; - sf->controller = controller; - -- err = mlx5_sf_id_insert(table, sf); -+ err = mlx5_sf_function_id_insert(table, sf); - if (err) - goto insert_err; - -@@ -111,7 +105,6 @@ mlx5_sf_alloc(struct mlx5_sf_table *table, struct mlx5_eswitch *esw, - - static void mlx5_sf_free(struct mlx5_sf_table *table, struct mlx5_sf *sf) - { -- mlx5_sf_id_erase(table, sf); - mlx5_sf_hw_table_sf_free(table->dev, sf->controller, sf->id); - trace_mlx5_sf_free(table->dev, sf->port_index, sf->controller, sf->hw_fn_id); - kfree(sf); -@@ -172,26 +165,19 @@ int mlx5_devlink_sf_port_fn_state_get(struct devlink_port *dl_port, - struct netlink_ext_ack *extack) - { - struct mlx5_core_dev *dev = devlink_priv(dl_port->devlink); -+ struct mlx5_sf *sf = mlx5_sf_by_dl_port(dl_port); - struct mlx5_sf_table *table; -- struct mlx5_sf *sf; -- int err = 0; - - table = mlx5_sf_table_try_get(dev); - if (!table) - return -EOPNOTSUPP; - -- sf = mlx5_sf_lookup_by_index(table, dl_port->index); -- if (!sf) { -- err = -EOPNOTSUPP; -- goto sf_err; -- } - mutex_lock(&table->sf_state_lock); - *state = mlx5_sf_to_devlink_state(sf->hw_state); - *opstate = mlx5_sf_to_devlink_opstate(sf->hw_state); - mutex_unlock(&table->sf_state_lock); --sf_err: - mlx5_sf_table_put(table); -- return err; -+ return 0; - } - - static int mlx5_sf_activate(struct mlx5_core_dev *dev, struct mlx5_sf *sf, -@@ -257,8 +243,8 @@ int mlx5_devlink_sf_port_fn_state_set(struct devlink_port *dl_port, - struct netlink_ext_ack *extack) - { - struct mlx5_core_dev *dev = devlink_priv(dl_port->devlink); -+ struct mlx5_sf *sf = mlx5_sf_by_dl_port(dl_port); - struct mlx5_sf_table *table; -- struct mlx5_sf *sf; - int err; - - table = mlx5_sf_table_try_get(dev); -@@ -267,14 +253,7 @@ int mlx5_devlink_sf_port_fn_state_set(struct devlink_port *dl_port, - "Port state set is only supported in eswitch switchdev mode or SF ports are disabled."); - return -EOPNOTSUPP; - } -- sf = mlx5_sf_lookup_by_index(table, dl_port->index); -- if (!sf) { -- err = -ENODEV; -- goto out; -- } -- - err = mlx5_sf_state_set(dev, table, sf, state, extack); --out: - mlx5_sf_table_put(table); - return err; - } -@@ -301,6 +280,7 @@ static int mlx5_sf_add(struct mlx5_core_dev *dev, struct mlx5_sf_table *table, - return 0; - - esw_err: -+ mlx5_sf_function_id_erase(table, sf); - mlx5_sf_free(table, sf); - return err; - } -@@ -361,6 +341,8 @@ int mlx5_devlink_sf_port_new(struct devlink *devlink, - - static void mlx5_sf_dealloc(struct mlx5_sf_table *table, struct mlx5_sf *sf) - { -+ mlx5_sf_function_id_erase(table, sf); -+ - if (sf->hw_state == MLX5_VHCA_STATE_ALLOCATED) { - mlx5_sf_free(table, sf); - } else if (mlx5_sf_is_active(sf)) { -@@ -383,10 +365,9 @@ int mlx5_devlink_sf_port_del(struct devlink *devlink, - struct netlink_ext_ack *extack) - { - struct mlx5_core_dev *dev = devlink_priv(devlink); -+ struct mlx5_sf *sf = mlx5_sf_by_dl_port(dl_port); - struct mlx5_eswitch *esw = dev->priv.eswitch; - struct mlx5_sf_table *table; -- struct mlx5_sf *sf; -- int err = 0; - - table = mlx5_sf_table_try_get(dev); - if (!table) { -@@ -394,21 +375,14 @@ int mlx5_devlink_sf_port_del(struct devlink *devlink, - "Port del is only supported in eswitch switchdev mode or SF ports are disabled."); - return -EOPNOTSUPP; - } -- sf = mlx5_sf_lookup_by_index(table, dl_port->index); -- if (!sf) { -- err = -ENODEV; -- goto sf_err; -- } - - mlx5_eswitch_unload_sf_vport(esw, sf->hw_fn_id); -- mlx5_sf_id_erase(table, sf); - - mutex_lock(&table->sf_state_lock); - mlx5_sf_dealloc(table, sf); - mutex_unlock(&table->sf_state_lock); --sf_err: - mlx5_sf_table_put(table); -- return err; -+ return 0; - } - - static bool mlx5_sf_state_update_check(const struct mlx5_sf *sf, u8 new_state) -@@ -471,9 +445,8 @@ static void mlx5_sf_deactivate_all(struct mlx5_sf_table *table) - /* At this point, no new user commands can start and no vhca event can - * arrive. It is safe to destroy all user created SFs. - */ -- xa_for_each(&table->port_indices, index, sf) { -+ xa_for_each(&table->function_ids, index, sf) { - mlx5_eswitch_unload_sf_vport(esw, sf->hw_fn_id); -- mlx5_sf_id_erase(table, sf); - mlx5_sf_dealloc(table, sf); - } - } -@@ -531,7 +504,7 @@ int mlx5_sf_table_init(struct mlx5_core_dev *dev) - - mutex_init(&table->sf_state_lock); - table->dev = dev; -- xa_init(&table->port_indices); -+ xa_init(&table->function_ids); - dev->priv.sf_table = table; - refcount_set(&table->refcount, 0); - table->esw_nb.notifier_call = mlx5_sf_esw_event; -@@ -566,6 +539,16 @@ void mlx5_sf_table_cleanup(struct mlx5_core_dev *dev) - mlx5_esw_event_notifier_unregister(dev->priv.eswitch, &table->esw_nb); - WARN_ON(refcount_read(&table->refcount)); - mutex_destroy(&table->sf_state_lock); -- WARN_ON(!xa_empty(&table->port_indices)); -+ WARN_ON(!xa_empty(&table->function_ids)); - kfree(table); - } -+ -+bool mlx5_sf_table_empty(const struct mlx5_core_dev *dev) -+{ -+ struct mlx5_sf_table *table = dev->priv.sf_table; -+ -+ if (!table) -+ return true; -+ -+ return xa_empty(&table->function_ids); -+} -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h b/drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h -index 860f9ddb7107b8..89559a37997ad6 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h -@@ -17,6 +17,7 @@ void mlx5_sf_hw_table_destroy(struct mlx5_core_dev *dev); - - int mlx5_sf_table_init(struct mlx5_core_dev *dev); - void mlx5_sf_table_cleanup(struct mlx5_core_dev *dev); -+bool mlx5_sf_table_empty(const struct mlx5_core_dev *dev); - - int mlx5_devlink_sf_port_new(struct devlink *devlink, - const struct devlink_port_new_attrs *add_attr, -@@ -61,6 +62,11 @@ static inline void mlx5_sf_table_cleanup(struct mlx5_core_dev *dev) - { - } - -+static inline bool mlx5_sf_table_empty(const struct mlx5_core_dev *dev) -+{ -+ return true; -+} -+ - #endif - - #endif -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c -index a9837985a483d8..bdb4f527289d2d 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c -@@ -69,7 +69,7 @@ static void dwmac4_core_init(struct mac_device_info *hw, - init_waitqueue_head(&priv->tstamp_busy_wait); - } - --static void dwmac4_phylink_get_caps(struct stmmac_priv *priv) -+static void dwmac4_update_caps(struct stmmac_priv *priv) - { - if (priv->plat->tx_queues_to_use > 1) - priv->hw->link.caps &= ~(MAC_10HD | MAC_100HD | MAC_1000HD); -@@ -1161,7 +1161,7 @@ static int dwmac4_config_l4_filter(struct mac_device_info *hw, u32 filter_no, - - const struct stmmac_ops dwmac4_ops = { - .core_init = dwmac4_core_init, -- .phylink_get_caps = dwmac4_phylink_get_caps, -+ .update_caps = dwmac4_update_caps, - .set_mac = stmmac_set_mac, - .rx_ipc = dwmac4_rx_ipc_enable, - .rx_queue_enable = dwmac4_rx_queue_enable, -@@ -1204,7 +1204,7 @@ const struct stmmac_ops dwmac4_ops = { - - const struct stmmac_ops dwmac410_ops = { - .core_init = dwmac4_core_init, -- .phylink_get_caps = dwmac4_phylink_get_caps, -+ .update_caps = dwmac4_update_caps, - .set_mac = stmmac_dwmac4_set_mac, - .rx_ipc = dwmac4_rx_ipc_enable, - .rx_queue_enable = dwmac4_rx_queue_enable, -@@ -1253,7 +1253,7 @@ const struct stmmac_ops dwmac410_ops = { - - const struct stmmac_ops dwmac510_ops = { - .core_init = dwmac4_core_init, -- .phylink_get_caps = dwmac4_phylink_get_caps, -+ .update_caps = dwmac4_update_caps, - .set_mac = stmmac_dwmac4_set_mac, - .rx_ipc = dwmac4_rx_ipc_enable, - .rx_queue_enable = dwmac4_rx_queue_enable, -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c -index 052566f5b7f361..0bcb378fa0bc91 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c -@@ -47,6 +47,14 @@ static void dwxgmac2_core_init(struct mac_device_info *hw, - writel(XGMAC_INT_DEFAULT_EN, ioaddr + XGMAC_INT_EN); - } - -+static void dwxgmac2_update_caps(struct stmmac_priv *priv) -+{ -+ if (!priv->dma_cap.mbps_10_100) -+ priv->hw->link.caps &= ~(MAC_10 | MAC_100); -+ else if (!priv->dma_cap.half_duplex) -+ priv->hw->link.caps &= ~(MAC_10HD | MAC_100HD); -+} -+ - static void dwxgmac2_set_mac(void __iomem *ioaddr, bool enable) - { - u32 tx = readl(ioaddr + XGMAC_TX_CONFIG); -@@ -1583,6 +1591,7 @@ static void dwxgmac3_fpe_configure(void __iomem *ioaddr, struct stmmac_fpe_cfg * - - const struct stmmac_ops dwxgmac210_ops = { - .core_init = dwxgmac2_core_init, -+ .update_caps = dwxgmac2_update_caps, - .set_mac = dwxgmac2_set_mac, - .rx_ipc = dwxgmac2_rx_ipc, - .rx_queue_enable = dwxgmac2_rx_queue_enable, -@@ -1705,8 +1714,8 @@ int dwxgmac2_setup(struct stmmac_priv *priv) - mac->mcast_bits_log2 = ilog2(mac->multicast_filter_bins); - - mac->link.caps = MAC_ASYM_PAUSE | MAC_SYM_PAUSE | -- MAC_1000FD | MAC_2500FD | MAC_5000FD | -- MAC_10000FD; -+ MAC_10 | MAC_100 | MAC_1000FD | -+ MAC_2500FD | MAC_5000FD | MAC_10000FD; - mac->link.duplex = 0; - mac->link.speed10 = XGMAC_CONFIG_SS_10_MII; - mac->link.speed100 = XGMAC_CONFIG_SS_100_MII; -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c -index 05ea74e9379399..b2c03cb65c7cc8 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c -@@ -203,10 +203,6 @@ static void dwxgmac2_dma_rx_mode(struct stmmac_priv *priv, void __iomem *ioaddr, - } - - writel(value, ioaddr + XGMAC_MTL_RXQ_OPMODE(channel)); -- -- /* Enable MTL RX overflow */ -- value = readl(ioaddr + XGMAC_MTL_QINTEN(channel)); -- writel(value | XGMAC_RXOIE, ioaddr + XGMAC_MTL_QINTEN(channel)); - } - - static void dwxgmac2_dma_tx_mode(struct stmmac_priv *priv, void __iomem *ioaddr, -@@ -386,8 +382,11 @@ static int dwxgmac2_dma_interrupt(struct stmmac_priv *priv, - static int dwxgmac2_get_hw_feature(void __iomem *ioaddr, - struct dma_features *dma_cap) - { -+ struct stmmac_priv *priv; - u32 hw_cap; - -+ priv = container_of(dma_cap, struct stmmac_priv, dma_cap); -+ - /* MAC HW feature 0 */ - hw_cap = readl(ioaddr + XGMAC_HW_FEATURE0); - dma_cap->edma = (hw_cap & XGMAC_HWFEAT_EDMA) >> 31; -@@ -410,6 +409,8 @@ static int dwxgmac2_get_hw_feature(void __iomem *ioaddr, - dma_cap->vlhash = (hw_cap & XGMAC_HWFEAT_VLHASH) >> 4; - dma_cap->half_duplex = (hw_cap & XGMAC_HWFEAT_HDSEL) >> 3; - dma_cap->mbps_1000 = (hw_cap & XGMAC_HWFEAT_GMIISEL) >> 1; -+ if (dma_cap->mbps_1000 && priv->synopsys_id >= DWXGMAC_CORE_2_20) -+ dma_cap->mbps_10_100 = 1; - - /* MAC HW feature 1 */ - hw_cap = readl(ioaddr + XGMAC_HW_FEATURE1); -diff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h -index 47fb8e1646c2e9..ee9a7d98648b01 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/hwif.h -+++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h -@@ -300,8 +300,8 @@ struct stmmac_est; - struct stmmac_ops { - /* MAC core initialization */ - void (*core_init)(struct mac_device_info *hw, struct net_device *dev); -- /* Get phylink capabilities */ -- void (*phylink_get_caps)(struct stmmac_priv *priv); -+ /* Update MAC capabilities */ -+ void (*update_caps)(struct stmmac_priv *priv); - /* Enable the MAC RX/TX */ - void (*set_mac)(void __iomem *ioaddr, bool enable); - /* Enable and verify that the IPC module is supported */ -@@ -423,8 +423,8 @@ struct stmmac_ops { - - #define stmmac_core_init(__priv, __args...) \ - stmmac_do_void_callback(__priv, mac, core_init, __args) --#define stmmac_mac_phylink_get_caps(__priv) \ -- stmmac_do_void_callback(__priv, mac, phylink_get_caps, __priv) -+#define stmmac_mac_update_caps(__priv) \ -+ stmmac_do_void_callback(__priv, mac, update_caps, __priv) - #define stmmac_mac_set(__priv, __args...) \ - stmmac_do_void_callback(__priv, mac, set_mac, __args) - #define stmmac_rx_ipc(__priv, __args...) \ -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index 615d25a0e46be5..ff5389a8efc33a 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -1230,8 +1230,8 @@ static int stmmac_phy_setup(struct stmmac_priv *priv) - xpcs_get_interfaces(priv->hw->xpcs, - priv->phylink_config.supported_interfaces); - -- /* Get the MAC specific capabilities */ -- stmmac_mac_phylink_get_caps(priv); -+ /* Refresh the MAC-specific capabilities */ -+ stmmac_mac_update_caps(priv); - - priv->phylink_config.mac_capabilities = priv->hw->link.caps; - -@@ -2426,6 +2426,7 @@ static bool stmmac_xdp_xmit_zc(struct stmmac_priv *priv, u32 queue, u32 budget) - struct netdev_queue *nq = netdev_get_tx_queue(priv->dev, queue); - struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue]; - struct stmmac_txq_stats *txq_stats = &priv->xstats.txq_stats[queue]; -+ bool csum = !priv->plat->tx_queues_cfg[queue].coe_unsupported; - struct xsk_buff_pool *pool = tx_q->xsk_pool; - unsigned int entry = tx_q->cur_tx; - struct dma_desc *tx_desc = NULL; -@@ -2496,7 +2497,7 @@ static bool stmmac_xdp_xmit_zc(struct stmmac_priv *priv, u32 queue, u32 budget) - } - - stmmac_prepare_tx_desc(priv, tx_desc, 1, xdp_desc.len, -- true, priv->mode, true, true, -+ csum, priv->mode, true, true, - xdp_desc.len); - - stmmac_enable_dma_transmission(priv, priv->ioaddr); -@@ -4789,6 +4790,7 @@ static int stmmac_xdp_xmit_xdpf(struct stmmac_priv *priv, int queue, - { - struct stmmac_txq_stats *txq_stats = &priv->xstats.txq_stats[queue]; - struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue]; -+ bool csum = !priv->plat->tx_queues_cfg[queue].coe_unsupported; - unsigned int entry = tx_q->cur_tx; - struct dma_desc *tx_desc; - dma_addr_t dma_addr; -@@ -4833,7 +4835,7 @@ static int stmmac_xdp_xmit_xdpf(struct stmmac_priv *priv, int queue, - stmmac_set_desc_addr(priv, tx_desc, dma_addr); - - stmmac_prepare_tx_desc(priv, tx_desc, 1, xdpf->len, -- true, priv->mode, true, true, -+ csum, priv->mode, true, true, - xdpf->len); - - tx_q->tx_count_frames++; -@@ -7232,7 +7234,7 @@ int stmmac_reinit_queues(struct net_device *dev, u32 rx_cnt, u32 tx_cnt) - priv->rss.table[i] = ethtool_rxfh_indir_default(i, - rx_cnt); - -- stmmac_mac_phylink_get_caps(priv); -+ stmmac_mac_update_caps(priv); - - priv->phylink_config.mac_capabilities = priv->hw->link.caps; - -diff --git a/drivers/net/phy/mscc/mscc.h b/drivers/net/phy/mscc/mscc.h -index cdb343779a8fb5..4ba6e32cf6d8d1 100644 ---- a/drivers/net/phy/mscc/mscc.h -+++ b/drivers/net/phy/mscc/mscc.h -@@ -476,6 +476,7 @@ static inline void vsc8584_config_macsec_intr(struct phy_device *phydev) - void vsc85xx_link_change_notify(struct phy_device *phydev); - void vsc8584_config_ts_intr(struct phy_device *phydev); - int vsc8584_ptp_init(struct phy_device *phydev); -+void vsc8584_ptp_deinit(struct phy_device *phydev); - int vsc8584_ptp_probe_once(struct phy_device *phydev); - int vsc8584_ptp_probe(struct phy_device *phydev); - irqreturn_t vsc8584_handle_ts_interrupt(struct phy_device *phydev); -@@ -490,6 +491,9 @@ static inline int vsc8584_ptp_init(struct phy_device *phydev) - { - return 0; - } -+static inline void vsc8584_ptp_deinit(struct phy_device *phydev) -+{ -+} - static inline int vsc8584_ptp_probe_once(struct phy_device *phydev) - { - return 0; -diff --git a/drivers/net/phy/mscc/mscc_main.c b/drivers/net/phy/mscc/mscc_main.c -index 3de72d9cc22bd0..3a932b30f4358f 100644 ---- a/drivers/net/phy/mscc/mscc_main.c -+++ b/drivers/net/phy/mscc/mscc_main.c -@@ -2337,9 +2337,7 @@ static int vsc85xx_probe(struct phy_device *phydev) - - static void vsc85xx_remove(struct phy_device *phydev) - { -- struct vsc8531_private *priv = phydev->priv; -- -- skb_queue_purge(&priv->rx_skbs_list); -+ vsc8584_ptp_deinit(phydev); - } - - /* Microsemi VSC85xx PHYs */ -diff --git a/drivers/net/phy/mscc/mscc_ptp.c b/drivers/net/phy/mscc/mscc_ptp.c -index add1a9ee721afa..1f6237705b44b7 100644 ---- a/drivers/net/phy/mscc/mscc_ptp.c -+++ b/drivers/net/phy/mscc/mscc_ptp.c -@@ -1297,7 +1297,6 @@ static void vsc8584_set_input_clk_configured(struct phy_device *phydev) - - static int __vsc8584_init_ptp(struct phy_device *phydev) - { -- struct vsc8531_private *vsc8531 = phydev->priv; - static const u32 ltc_seq_e[] = { 0, 400000, 0, 0, 0 }; - static const u8 ltc_seq_a[] = { 8, 6, 5, 4, 2 }; - u32 val; -@@ -1514,17 +1513,7 @@ static int __vsc8584_init_ptp(struct phy_device *phydev) - - vsc85xx_ts_eth_cmp1_sig(phydev); - -- vsc8531->mii_ts.rxtstamp = vsc85xx_rxtstamp; -- vsc8531->mii_ts.txtstamp = vsc85xx_txtstamp; -- vsc8531->mii_ts.hwtstamp = vsc85xx_hwtstamp; -- vsc8531->mii_ts.ts_info = vsc85xx_ts_info; -- phydev->mii_ts = &vsc8531->mii_ts; -- -- memcpy(&vsc8531->ptp->caps, &vsc85xx_clk_caps, sizeof(vsc85xx_clk_caps)); -- -- vsc8531->ptp->ptp_clock = ptp_clock_register(&vsc8531->ptp->caps, -- &phydev->mdio.dev); -- return PTR_ERR_OR_ZERO(vsc8531->ptp->ptp_clock); -+ return 0; - } - - void vsc8584_config_ts_intr(struct phy_device *phydev) -@@ -1551,6 +1540,16 @@ int vsc8584_ptp_init(struct phy_device *phydev) - return 0; - } - -+void vsc8584_ptp_deinit(struct phy_device *phydev) -+{ -+ struct vsc8531_private *vsc8531 = phydev->priv; -+ -+ if (vsc8531->ptp->ptp_clock) { -+ ptp_clock_unregister(vsc8531->ptp->ptp_clock); -+ skb_queue_purge(&vsc8531->rx_skbs_list); -+ } -+} -+ - irqreturn_t vsc8584_handle_ts_interrupt(struct phy_device *phydev) - { - struct vsc8531_private *priv = phydev->priv; -@@ -1608,7 +1607,16 @@ int vsc8584_ptp_probe(struct phy_device *phydev) - - vsc8531->ptp->phydev = phydev; - -- return 0; -+ vsc8531->mii_ts.rxtstamp = vsc85xx_rxtstamp; -+ vsc8531->mii_ts.txtstamp = vsc85xx_txtstamp; -+ vsc8531->mii_ts.hwtstamp = vsc85xx_hwtstamp; -+ vsc8531->mii_ts.ts_info = vsc85xx_ts_info; -+ phydev->mii_ts = &vsc8531->mii_ts; -+ -+ memcpy(&vsc8531->ptp->caps, &vsc85xx_clk_caps, sizeof(vsc85xx_clk_caps)); -+ vsc8531->ptp->ptp_clock = ptp_clock_register(&vsc8531->ptp->caps, -+ &phydev->mdio.dev); -+ return PTR_ERR_OR_ZERO(vsc8531->ptp->ptp_clock); - } - - int vsc8584_ptp_probe_once(struct phy_device *phydev) -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index 3976bc4295dd19..eba755b584a459 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -1363,6 +1363,9 @@ static const struct usb_device_id products[] = { - {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ - {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */ - {QMI_QUIRK_SET_DTR(0x1bc7, 0x1031, 3)}, /* Telit LE910C1-EUX */ -+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1034, 2)}, /* Telit LE910C4-WWX */ -+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1037, 4)}, /* Telit LE910C4-WWX */ -+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1038, 3)}, /* Telit LE910C4-WWX */ - {QMI_QUIRK_SET_DTR(0x1bc7, 0x103a, 0)}, /* Telit LE910C4-WWX */ - {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */ - {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */ -diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c -index 4d57a4e3410546..18393800546c11 100644 ---- a/drivers/of/dynamic.c -+++ b/drivers/of/dynamic.c -@@ -306,15 +306,20 @@ int of_detach_node(struct device_node *np) - } - EXPORT_SYMBOL_GPL(of_detach_node); - -+void __of_prop_free(struct property *prop) -+{ -+ kfree(prop->name); -+ kfree(prop->value); -+ kfree(prop); -+} -+ - static void property_list_free(struct property *prop_list) - { - struct property *prop, *next; - - for (prop = prop_list; prop != NULL; prop = next) { - next = prop->next; -- kfree(prop->name); -- kfree(prop->value); -- kfree(prop); -+ __of_prop_free(prop); - } - } - -@@ -427,9 +432,7 @@ struct property *__of_prop_dup(const struct property *prop, gfp_t allocflags) - return new; - - err_free: -- kfree(new->name); -- kfree(new->value); -- kfree(new); -+ __of_prop_free(new); - return NULL; - } - -@@ -471,9 +474,7 @@ struct device_node *__of_node_dup(const struct device_node *np, - if (!new_pp) - goto err_prop; - if (__of_add_property(node, new_pp)) { -- kfree(new_pp->name); -- kfree(new_pp->value); -- kfree(new_pp); -+ __of_prop_free(new_pp); - goto err_prop; - } - } -@@ -934,12 +935,14 @@ static int of_changeset_add_prop_helper(struct of_changeset *ocs, - - ret = of_changeset_add_property(ocs, np, new_pp); - if (ret) { -- kfree(new_pp->name); -- kfree(new_pp->value); -- kfree(new_pp); -+ __of_prop_free(new_pp); -+ return ret; - } - -- return ret; -+ new_pp->next = np->deadprops; -+ np->deadprops = new_pp; -+ -+ return 0; - } - - /** -diff --git a/drivers/of/of_private.h b/drivers/of/of_private.h -index 21f8f5e80917d1..73b55f4f84a3cc 100644 ---- a/drivers/of/of_private.h -+++ b/drivers/of/of_private.h -@@ -123,6 +123,7 @@ extern void *__unflatten_device_tree(const void *blob, - * own the devtree lock or work on detached trees only. - */ - struct property *__of_prop_dup(const struct property *prop, gfp_t allocflags); -+void __of_prop_free(struct property *prop); - struct device_node *__of_node_dup(const struct device_node *np, - const char *full_name); - -diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c -index a9a292d6d59b26..dc13299586414f 100644 ---- a/drivers/of/overlay.c -+++ b/drivers/of/overlay.c -@@ -262,9 +262,7 @@ static struct property *dup_and_fixup_symbol_prop( - return new_prop; - - err_free_new_prop: -- kfree(new_prop->name); -- kfree(new_prop->value); -- kfree(new_prop); -+ __of_prop_free(new_prop); - err_free_target_path: - kfree(target_path); - -@@ -361,11 +359,8 @@ static int add_changeset_property(struct overlay_changeset *ovcs, - pr_err("WARNING: memory leak will occur if overlay removed, property: %pOF/%s\n", - target->np, new_prop->name); - -- if (ret) { -- kfree(new_prop->name); -- kfree(new_prop->value); -- kfree(new_prop); -- } -+ if (ret) -+ __of_prop_free(new_prop); - return ret; - } - -diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c -index 3b22c36bfb0b7c..5bfec440b4fd70 100644 ---- a/drivers/of/unittest.c -+++ b/drivers/of/unittest.c -@@ -800,15 +800,11 @@ static void __init of_unittest_property_copy(void) - - new = __of_prop_dup(&p1, GFP_KERNEL); - unittest(new && propcmp(&p1, new), "empty property didn't copy correctly\n"); -- kfree(new->value); -- kfree(new->name); -- kfree(new); -+ __of_prop_free(new); - - new = __of_prop_dup(&p2, GFP_KERNEL); - unittest(new && propcmp(&p2, new), "non-empty property didn't copy correctly\n"); -- kfree(new->value); -- kfree(new->name); -- kfree(new); -+ __of_prop_free(new); - #endif - } - -@@ -3665,9 +3661,7 @@ static __init void of_unittest_overlay_high_level(void) - goto err_unlock; - } - if (__of_add_property(of_symbols, new_prop)) { -- kfree(new_prop->name); -- kfree(new_prop->value); -- kfree(new_prop); -+ __of_prop_free(new_prop); - /* "name" auto-generated by unflatten */ - if (!strcmp(prop->name, "name")) - continue; -diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig -index 7dfb7190580efa..ab3908a923e3a0 100644 ---- a/drivers/pinctrl/Kconfig -+++ b/drivers/pinctrl/Kconfig -@@ -438,6 +438,7 @@ config PINCTRL_STMFX - tristate "STMicroelectronics STMFX GPIO expander pinctrl driver" - depends on I2C - depends on OF_GPIO -+ depends on HAS_IOMEM - select GENERIC_PINCONF - select GPIOLIB_IRQCHIP - select MFD_STMFX -diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c -index 24f6eefb68030d..df37ac81620e62 100644 ---- a/drivers/scsi/scsi_sysfs.c -+++ b/drivers/scsi/scsi_sysfs.c -@@ -265,7 +265,7 @@ show_shost_supported_mode(struct device *dev, struct device_attribute *attr, - return show_shost_mode(supported_mode, buf); - } - --static DEVICE_ATTR(supported_mode, S_IRUGO | S_IWUSR, show_shost_supported_mode, NULL); -+static DEVICE_ATTR(supported_mode, S_IRUGO, show_shost_supported_mode, NULL); - - static ssize_t - show_shost_active_mode(struct device *dev, -@@ -279,7 +279,7 @@ show_shost_active_mode(struct device *dev, - return show_shost_mode(shost->active_mode, buf); - } - --static DEVICE_ATTR(active_mode, S_IRUGO | S_IWUSR, show_shost_active_mode, NULL); -+static DEVICE_ATTR(active_mode, S_IRUGO, show_shost_active_mode, NULL); - - static int check_reset_type(const char *str) - { -diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c -index f2ed7167c84809..5ad237d77a9a9f 100644 ---- a/drivers/vhost/net.c -+++ b/drivers/vhost/net.c -@@ -96,6 +96,7 @@ struct vhost_net_ubuf_ref { - atomic_t refcount; - wait_queue_head_t wait; - struct vhost_virtqueue *vq; -+ struct rcu_head rcu; - }; - - #define VHOST_NET_BATCH 64 -@@ -249,9 +250,13 @@ vhost_net_ubuf_alloc(struct vhost_virtqueue *vq, bool zcopy) - - static int vhost_net_ubuf_put(struct vhost_net_ubuf_ref *ubufs) - { -- int r = atomic_sub_return(1, &ubufs->refcount); -+ int r; -+ -+ rcu_read_lock(); -+ r = atomic_sub_return(1, &ubufs->refcount); - if (unlikely(!r)) - wake_up(&ubufs->wait); -+ rcu_read_unlock(); - return r; - } - -@@ -264,7 +269,7 @@ static void vhost_net_ubuf_put_and_wait(struct vhost_net_ubuf_ref *ubufs) - static void vhost_net_ubuf_put_wait_and_free(struct vhost_net_ubuf_ref *ubufs) - { - vhost_net_ubuf_put_and_wait(ubufs); -- kfree(ubufs); -+ kfree_rcu(ubufs, rcu); - } - - static void vhost_net_clear_ubuf_info(struct vhost_net *n) -diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c -index 586c5709dfb554..34438981ddd805 100644 ---- a/fs/efivarfs/super.c -+++ b/fs/efivarfs/super.c -@@ -90,6 +90,10 @@ static int efivarfs_d_compare(const struct dentry *dentry, - { - int guid = len - EFI_VARIABLE_GUID_LEN; - -+ /* Parallel lookups may produce a temporary invalid filename */ -+ if (guid <= 0) -+ return 1; -+ - if (name->len != len) - return 1; - -diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c -index d852b43ac43e32..c1f802ecc47b2c 100644 ---- a/fs/erofs/zdata.c -+++ b/fs/erofs/zdata.c -@@ -1401,6 +1401,16 @@ static void z_erofs_decompressqueue_kthread_work(struct kthread_work *work) - } - #endif - -+/* Use (kthread_)work in atomic contexts to minimize scheduling overhead */ -+static inline bool z_erofs_in_atomic(void) -+{ -+ if (IS_ENABLED(CONFIG_PREEMPTION) && rcu_preempt_depth()) -+ return true; -+ if (!IS_ENABLED(CONFIG_PREEMPT_COUNT)) -+ return true; -+ return !preemptible(); -+} -+ - static void z_erofs_decompress_kickoff(struct z_erofs_decompressqueue *io, - int bios) - { -@@ -1415,8 +1425,7 @@ static void z_erofs_decompress_kickoff(struct z_erofs_decompressqueue *io, - - if (atomic_add_return(bios, &io->pending_bios)) - return; -- /* Use (kthread_)work and sync decompression for atomic contexts only */ -- if (!in_task() || irqs_disabled() || rcu_read_lock_any_held()) { -+ if (z_erofs_in_atomic()) { - #ifdef CONFIG_EROFS_FS_PCPU_KTHREAD - struct kthread_worker *worker; - -diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c -index 040b6b79c75e59..0ea3916ed1dcb1 100644 ---- a/fs/nfs/pagelist.c -+++ b/fs/nfs/pagelist.c -@@ -206,83 +206,6 @@ nfs_page_group_lock_head(struct nfs_page *req) - return head; - } - --/* -- * nfs_unroll_locks - unlock all newly locked reqs and wait on @req -- * @head: head request of page group, must be holding head lock -- * @req: request that couldn't lock and needs to wait on the req bit lock -- * -- * This is a helper function for nfs_lock_and_join_requests -- * returns 0 on success, < 0 on error. -- */ --static void --nfs_unroll_locks(struct nfs_page *head, struct nfs_page *req) --{ -- struct nfs_page *tmp; -- -- /* relinquish all the locks successfully grabbed this run */ -- for (tmp = head->wb_this_page ; tmp != req; tmp = tmp->wb_this_page) { -- if (!kref_read(&tmp->wb_kref)) -- continue; -- nfs_unlock_and_release_request(tmp); -- } --} -- --/* -- * nfs_page_group_lock_subreq - try to lock a subrequest -- * @head: head request of page group -- * @subreq: request to lock -- * -- * This is a helper function for nfs_lock_and_join_requests which -- * must be called with the head request and page group both locked. -- * On error, it returns with the page group unlocked. -- */ --static int --nfs_page_group_lock_subreq(struct nfs_page *head, struct nfs_page *subreq) --{ -- int ret; -- -- if (!kref_get_unless_zero(&subreq->wb_kref)) -- return 0; -- while (!nfs_lock_request(subreq)) { -- nfs_page_group_unlock(head); -- ret = nfs_wait_on_request(subreq); -- if (!ret) -- ret = nfs_page_group_lock(head); -- if (ret < 0) { -- nfs_unroll_locks(head, subreq); -- nfs_release_request(subreq); -- return ret; -- } -- } -- return 0; --} -- --/* -- * nfs_page_group_lock_subrequests - try to lock the subrequests -- * @head: head request of page group -- * -- * This is a helper function for nfs_lock_and_join_requests which -- * must be called with the head request locked. -- */ --int nfs_page_group_lock_subrequests(struct nfs_page *head) --{ -- struct nfs_page *subreq; -- int ret; -- -- ret = nfs_page_group_lock(head); -- if (ret < 0) -- return ret; -- /* lock each request in the page group */ -- for (subreq = head->wb_this_page; subreq != head; -- subreq = subreq->wb_this_page) { -- ret = nfs_page_group_lock_subreq(head, subreq); -- if (ret < 0) -- return ret; -- } -- nfs_page_group_unlock(head); -- return 0; --} -- - /* - * nfs_page_set_headlock - set the request PG_HEADLOCK - * @req: request that is to be locked -@@ -349,13 +272,14 @@ nfs_page_group_unlock(struct nfs_page *req) - nfs_page_clear_headlock(req); - } - --/* -- * nfs_page_group_sync_on_bit_locked -+/** -+ * nfs_page_group_sync_on_bit_locked - Test if all requests have @bit set -+ * @req: request in page group -+ * @bit: PG_* bit that is used to sync page group - * - * must be called with page group lock held - */ --static bool --nfs_page_group_sync_on_bit_locked(struct nfs_page *req, unsigned int bit) -+bool nfs_page_group_sync_on_bit_locked(struct nfs_page *req, unsigned int bit) - { - struct nfs_page *head = req->wb_head; - struct nfs_page *tmp; -diff --git a/fs/nfs/write.c b/fs/nfs/write.c -index 7d03811f44a4bb..cb1e9996fcc8ec 100644 ---- a/fs/nfs/write.c -+++ b/fs/nfs/write.c -@@ -156,20 +156,10 @@ nfs_page_set_inode_ref(struct nfs_page *req, struct inode *inode) - } - } - --static int --nfs_cancel_remove_inode(struct nfs_page *req, struct inode *inode) -+static void nfs_cancel_remove_inode(struct nfs_page *req, struct inode *inode) - { -- int ret; -- -- if (!test_bit(PG_REMOVE, &req->wb_flags)) -- return 0; -- ret = nfs_page_group_lock(req); -- if (ret) -- return ret; - if (test_and_clear_bit(PG_REMOVE, &req->wb_flags)) - nfs_page_set_inode_ref(req, inode); -- nfs_page_group_unlock(req); -- return 0; - } - - static struct nfs_page *nfs_folio_private_request(struct folio *folio) -@@ -238,36 +228,6 @@ static struct nfs_page *nfs_folio_find_head_request(struct folio *folio) - return req; - } - --static struct nfs_page *nfs_folio_find_and_lock_request(struct folio *folio) --{ -- struct inode *inode = folio_file_mapping(folio)->host; -- struct nfs_page *req, *head; -- int ret; -- -- for (;;) { -- req = nfs_folio_find_head_request(folio); -- if (!req) -- return req; -- head = nfs_page_group_lock_head(req); -- if (head != req) -- nfs_release_request(req); -- if (IS_ERR(head)) -- return head; -- ret = nfs_cancel_remove_inode(head, inode); -- if (ret < 0) { -- nfs_unlock_and_release_request(head); -- return ERR_PTR(ret); -- } -- /* Ensure that nobody removed the request before we locked it */ -- if (head == nfs_folio_private_request(folio)) -- break; -- if (folio_test_swapcache(folio)) -- break; -- nfs_unlock_and_release_request(head); -- } -- return head; --} -- - /* Adjust the file length if we're writing beyond the end */ - static void nfs_grow_file(struct folio *folio, unsigned int offset, - unsigned int count) -@@ -548,6 +508,57 @@ void nfs_join_page_group(struct nfs_page *head, struct nfs_commit_info *cinfo, - nfs_destroy_unlinked_subrequests(destroy_list, head, inode); - } - -+/* -+ * nfs_unroll_locks - unlock all newly locked reqs and wait on @req -+ * @head: head request of page group, must be holding head lock -+ * @req: request that couldn't lock and needs to wait on the req bit lock -+ * -+ * This is a helper function for nfs_lock_and_join_requests -+ * returns 0 on success, < 0 on error. -+ */ -+static void -+nfs_unroll_locks(struct nfs_page *head, struct nfs_page *req) -+{ -+ struct nfs_page *tmp; -+ -+ /* relinquish all the locks successfully grabbed this run */ -+ for (tmp = head->wb_this_page ; tmp != req; tmp = tmp->wb_this_page) { -+ if (!kref_read(&tmp->wb_kref)) -+ continue; -+ nfs_unlock_and_release_request(tmp); -+ } -+} -+ -+/* -+ * nfs_page_group_lock_subreq - try to lock a subrequest -+ * @head: head request of page group -+ * @subreq: request to lock -+ * -+ * This is a helper function for nfs_lock_and_join_requests which -+ * must be called with the head request and page group both locked. -+ * On error, it returns with the page group unlocked. -+ */ -+static int -+nfs_page_group_lock_subreq(struct nfs_page *head, struct nfs_page *subreq) -+{ -+ int ret; -+ -+ if (!kref_get_unless_zero(&subreq->wb_kref)) -+ return 0; -+ while (!nfs_lock_request(subreq)) { -+ nfs_page_group_unlock(head); -+ ret = nfs_wait_on_request(subreq); -+ if (!ret) -+ ret = nfs_page_group_lock(head); -+ if (ret < 0) { -+ nfs_unroll_locks(head, subreq); -+ nfs_release_request(subreq); -+ return ret; -+ } -+ } -+ return 0; -+} -+ - /* - * nfs_lock_and_join_requests - join all subreqs to the head req - * @folio: the folio used to lookup the "page group" of nfs_page structures -@@ -566,30 +577,59 @@ void nfs_join_page_group(struct nfs_page *head, struct nfs_commit_info *cinfo, - static struct nfs_page *nfs_lock_and_join_requests(struct folio *folio) - { - struct inode *inode = folio_file_mapping(folio)->host; -- struct nfs_page *head; -+ struct nfs_page *head, *subreq; - struct nfs_commit_info cinfo; - int ret; - -- nfs_init_cinfo_from_inode(&cinfo, inode); - /* - * A reference is taken only on the head request which acts as a - * reference to the whole page group - the group will not be destroyed - * until the head reference is released. - */ -- head = nfs_folio_find_and_lock_request(folio); -- if (IS_ERR_OR_NULL(head)) -- return head; -+retry: -+ head = nfs_folio_find_head_request(folio); -+ if (!head) -+ return NULL; - -- /* lock each request in the page group */ -- ret = nfs_page_group_lock_subrequests(head); -- if (ret < 0) { -+ while (!nfs_lock_request(head)) { -+ ret = nfs_wait_on_request(head); -+ if (ret < 0) { -+ nfs_release_request(head); -+ return ERR_PTR(ret); -+ } -+ } -+ -+ ret = nfs_page_group_lock(head); -+ if (ret < 0) -+ goto out_unlock; -+ -+ /* Ensure that nobody removed the request before we locked it */ -+ if (head != folio->private && !folio_test_swapcache(folio)) { -+ nfs_page_group_unlock(head); - nfs_unlock_and_release_request(head); -- return ERR_PTR(ret); -+ goto retry; - } - -- nfs_join_page_group(head, &cinfo, inode); -+ nfs_cancel_remove_inode(head, inode); -+ -+ /* lock each request in the page group */ -+ for (subreq = head->wb_this_page; -+ subreq != head; -+ subreq = subreq->wb_this_page) { -+ ret = nfs_page_group_lock_subreq(head, subreq); -+ if (ret < 0) -+ goto out_unlock; -+ } - -+ nfs_page_group_unlock(head); -+ -+ nfs_init_cinfo_from_inode(&cinfo, inode); -+ nfs_join_page_group(head, &cinfo, inode); - return head; -+ -+out_unlock: -+ nfs_unlock_and_release_request(head); -+ return ERR_PTR(ret); - } - - static void nfs_write_error(struct nfs_page *req, int error) -@@ -792,7 +832,8 @@ static void nfs_inode_remove_request(struct nfs_page *req) - { - struct nfs_inode *nfsi = NFS_I(nfs_page_to_inode(req)); - -- if (nfs_page_group_sync_on_bit(req, PG_REMOVE)) { -+ nfs_page_group_lock(req); -+ if (nfs_page_group_sync_on_bit_locked(req, PG_REMOVE)) { - struct folio *folio = nfs_page_to_folio(req->wb_head); - struct address_space *mapping = folio_file_mapping(folio); - -@@ -804,6 +845,7 @@ static void nfs_inode_remove_request(struct nfs_page *req) - } - spin_unlock(&mapping->private_lock); - } -+ nfs_page_group_unlock(req); - - if (test_and_clear_bit(PG_INODE_REF, &req->wb_flags)) { - atomic_long_dec(&nfsi->nrequests); -diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c -index a1ab95f382d566..2744d5580d195f 100644 ---- a/fs/smb/client/cifsfs.c -+++ b/fs/smb/client/cifsfs.c -@@ -1371,6 +1371,20 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off, - netfs_resize_file(&target_cifsi->netfs, new_size); - fscache_resize_cookie(cifs_inode_cookie(target_inode), - new_size); -+ } else if (rc == -EOPNOTSUPP) { -+ /* -+ * copy_file_range syscall man page indicates EINVAL -+ * is returned e.g when "fd_in and fd_out refer to the -+ * same file and the source and target ranges overlap." -+ * Test generic/157 was what showed these cases where -+ * we need to remap EOPNOTSUPP to EINVAL -+ */ -+ if (off >= src_inode->i_size) { -+ rc = -EINVAL; -+ } else if (src_inode == target_inode) { -+ if (off + len > destoff) -+ rc = -EINVAL; -+ } - } - } - -diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c -index d93ebd58ecae16..6c16c4f34d8824 100644 ---- a/fs/smb/client/inode.c -+++ b/fs/smb/client/inode.c -@@ -1856,15 +1856,24 @@ int cifs_unlink(struct inode *dir, struct dentry *dentry) - struct cifs_sb_info *cifs_sb = CIFS_SB(sb); - struct tcon_link *tlink; - struct cifs_tcon *tcon; -+ __u32 dosattr = 0, origattr = 0; - struct TCP_Server_Info *server; - struct iattr *attrs = NULL; -- __u32 dosattr = 0, origattr = 0; -+ bool rehash = false; - - cifs_dbg(FYI, "cifs_unlink, dir=0x%p, dentry=0x%p\n", dir, dentry); - - if (unlikely(cifs_forced_shutdown(cifs_sb))) - return -EIO; - -+ /* Unhash dentry in advance to prevent any concurrent opens */ -+ spin_lock(&dentry->d_lock); -+ if (!d_unhashed(dentry)) { -+ __d_drop(dentry); -+ rehash = true; -+ } -+ spin_unlock(&dentry->d_lock); -+ - tlink = cifs_sb_tlink(cifs_sb); - if (IS_ERR(tlink)) - return PTR_ERR(tlink); -@@ -1915,7 +1924,8 @@ int cifs_unlink(struct inode *dir, struct dentry *dentry) - cifs_drop_nlink(inode); - } - } else if (rc == -ENOENT) { -- d_drop(dentry); -+ if (simple_positive(dentry)) -+ d_delete(dentry); - } else if (rc == -EBUSY) { - if (server->ops->rename_pending_delete) { - rc = server->ops->rename_pending_delete(full_path, -@@ -1968,6 +1978,8 @@ int cifs_unlink(struct inode *dir, struct dentry *dentry) - kfree(attrs); - free_xid(xid); - cifs_put_tlink(tlink); -+ if (rehash) -+ d_rehash(dentry); - return rc; - } - -@@ -2367,6 +2379,7 @@ cifs_rename2(struct mnt_idmap *idmap, struct inode *source_dir, - struct cifs_sb_info *cifs_sb; - struct tcon_link *tlink; - struct cifs_tcon *tcon; -+ bool rehash = false; - unsigned int xid; - int rc, tmprc; - int retry_count = 0; -@@ -2382,6 +2395,17 @@ cifs_rename2(struct mnt_idmap *idmap, struct inode *source_dir, - if (unlikely(cifs_forced_shutdown(cifs_sb))) - return -EIO; - -+ /* -+ * Prevent any concurrent opens on the target by unhashing the dentry. -+ * VFS already unhashes the target when renaming directories. -+ */ -+ if (d_is_positive(target_dentry) && !d_is_dir(target_dentry)) { -+ if (!d_unhashed(target_dentry)) { -+ d_drop(target_dentry); -+ rehash = true; -+ } -+ } -+ - tlink = cifs_sb_tlink(cifs_sb); - if (IS_ERR(tlink)) - return PTR_ERR(tlink); -@@ -2421,6 +2445,8 @@ cifs_rename2(struct mnt_idmap *idmap, struct inode *source_dir, - } - } - -+ if (!rc) -+ rehash = false; - /* - * No-replace is the natural behavior for CIFS, so skip unlink hacks. - */ -@@ -2479,12 +2505,16 @@ cifs_rename2(struct mnt_idmap *idmap, struct inode *source_dir, - goto cifs_rename_exit; - rc = cifs_do_rename(xid, source_dentry, from_name, - target_dentry, to_name); -+ if (!rc) -+ rehash = false; - } - - /* force revalidate to go get info when needed */ - CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0; - - cifs_rename_exit: -+ if (rehash) -+ d_rehash(target_dentry); - kfree(info_buf_source); - free_dentry_path(page2); - free_dentry_path(page1); -diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c -index e1078a1decdfa3..0cc80f472432ad 100644 ---- a/fs/smb/client/smb2inode.c -+++ b/fs/smb/client/smb2inode.c -@@ -206,8 +206,10 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - server = cifs_pick_channel(ses); - - vars = kzalloc(sizeof(*vars), GFP_ATOMIC); -- if (vars == NULL) -- return -ENOMEM; -+ if (vars == NULL) { -+ rc = -ENOMEM; -+ goto out; -+ } - rqst = &vars->rqst[0]; - rsp_iov = &vars->rsp_iov[0]; - -@@ -828,6 +830,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - smb2_should_replay(tcon, &retries, &cur_sleep)) - goto replay_again; - -+out: - if (cfile) - cifsFileInfo_put(cfile); - -diff --git a/fs/xfs/libxfs/xfs_attr_remote.c b/fs/xfs/libxfs/xfs_attr_remote.c -index 54de405cbab5ac..4d369876487bde 100644 ---- a/fs/xfs/libxfs/xfs_attr_remote.c -+++ b/fs/xfs/libxfs/xfs_attr_remote.c -@@ -418,6 +418,13 @@ xfs_attr_rmtval_get( - dblkcnt = XFS_FSB_TO_BB(mp, map[i].br_blockcount); - error = xfs_buf_read(mp->m_ddev_targp, dblkno, dblkcnt, - 0, &bp, &xfs_attr3_rmt_buf_ops); -+ /* -+ * ENODATA from disk implies a disk medium failure; -+ * ENODATA for xattrs means attribute not found, so -+ * disambiguate that here. -+ */ -+ if (error == -ENODATA) -+ error = -EIO; - if (error) - return error; - -diff --git a/fs/xfs/libxfs/xfs_da_btree.c b/fs/xfs/libxfs/xfs_da_btree.c -index 28bbfc31039c0e..1efd45076ee2ae 100644 ---- a/fs/xfs/libxfs/xfs_da_btree.c -+++ b/fs/xfs/libxfs/xfs_da_btree.c -@@ -2649,6 +2649,12 @@ xfs_da_read_buf( - - error = xfs_trans_read_buf_map(mp, tp, mp->m_ddev_targp, mapp, nmap, 0, - &bp, ops); -+ /* -+ * ENODATA from disk implies a disk medium failure; ENODATA for -+ * xattrs means attribute not found, so disambiguate that here. -+ */ -+ if (error == -ENODATA && whichfork == XFS_ATTR_FORK) -+ error = -EIO; - if (error) - goto out_free; - -diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h -index 45f2f278b50a8a..70807c679f1abc 100644 ---- a/include/linux/atmdev.h -+++ b/include/linux/atmdev.h -@@ -185,6 +185,7 @@ struct atmdev_ops { /* only send is required */ - int (*compat_ioctl)(struct atm_dev *dev,unsigned int cmd, - void __user *arg); - #endif -+ int (*pre_send)(struct atm_vcc *vcc, struct sk_buff *skb); - int (*send)(struct atm_vcc *vcc,struct sk_buff *skb); - int (*send_bh)(struct atm_vcc *vcc, struct sk_buff *skb); - int (*send_oam)(struct atm_vcc *vcc,void *cell,int flags); -diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h -index 9106771bb92f01..4913d364e97747 100644 ---- a/include/linux/mlx5/mlx5_ifc.h -+++ b/include/linux/mlx5/mlx5_ifc.h -@@ -1731,7 +1731,8 @@ struct mlx5_ifc_cmd_hca_cap_bits { - u8 reserved_at_328[0x2]; - u8 relaxed_ordering_read[0x1]; - u8 log_max_pd[0x5]; -- u8 reserved_at_330[0x6]; -+ u8 reserved_at_330[0x5]; -+ u8 pcie_reset_using_hotreset_method[0x1]; - u8 pci_sync_for_fw_update_with_driver_unload[0x1]; - u8 vnic_env_cnt_steering_fail[0x1]; - u8 vport_counter_local_loopback[0x1]; -@@ -10824,6 +10825,11 @@ struct mlx5_ifc_mcda_reg_bits { - u8 data[][0x20]; - }; - -+enum { -+ MLX5_MFRL_REG_PCI_RESET_METHOD_LINK_TOGGLE = 0, -+ MLX5_MFRL_REG_PCI_RESET_METHOD_HOT_RESET = 1, -+}; -+ - enum { - MLX5_MFRL_REG_RESET_STATE_IDLE = 0, - MLX5_MFRL_REG_RESET_STATE_IN_NEGOTIATION = 1, -@@ -10851,7 +10857,8 @@ struct mlx5_ifc_mfrl_reg_bits { - u8 pci_sync_for_fw_update_start[0x1]; - u8 pci_sync_for_fw_update_resp[0x2]; - u8 rst_type_sel[0x3]; -- u8 reserved_at_28[0x4]; -+ u8 pci_reset_req_method[0x3]; -+ u8 reserved_at_2b[0x1]; - u8 reset_state[0x4]; - u8 reset_type[0x8]; - u8 reset_level[0x8]; -diff --git a/include/linux/nfs_page.h b/include/linux/nfs_page.h -index 1c315f854ea801..6a46069c5a3689 100644 ---- a/include/linux/nfs_page.h -+++ b/include/linux/nfs_page.h -@@ -156,13 +156,13 @@ extern int nfs_wait_on_request(struct nfs_page *); - extern void nfs_unlock_request(struct nfs_page *req); - extern void nfs_unlock_and_release_request(struct nfs_page *); - extern struct nfs_page *nfs_page_group_lock_head(struct nfs_page *req); --extern int nfs_page_group_lock_subrequests(struct nfs_page *head); - extern void nfs_join_page_group(struct nfs_page *head, - struct nfs_commit_info *cinfo, - struct inode *inode); - extern int nfs_page_group_lock(struct nfs_page *); - extern void nfs_page_group_unlock(struct nfs_page *); - extern bool nfs_page_group_sync_on_bit(struct nfs_page *, unsigned int); -+extern bool nfs_page_group_sync_on_bit_locked(struct nfs_page *, unsigned int); - extern int nfs_page_set_headlock(struct nfs_page *req); - extern void nfs_page_clear_headlock(struct nfs_page *req); - extern bool nfs_async_iocounter_wait(struct rpc_task *, struct nfs_lock_context *); -diff --git a/include/net/bluetooth/hci_sync.h b/include/net/bluetooth/hci_sync.h -index 3cb2d10cac930b..e2e588b08fe90a 100644 ---- a/include/net/bluetooth/hci_sync.h -+++ b/include/net/bluetooth/hci_sync.h -@@ -72,7 +72,7 @@ int hci_update_class_sync(struct hci_dev *hdev); - - int hci_update_eir_sync(struct hci_dev *hdev); - int hci_update_class_sync(struct hci_dev *hdev); --int hci_update_name_sync(struct hci_dev *hdev); -+int hci_update_name_sync(struct hci_dev *hdev, const u8 *name); - int hci_write_ssp_mode_sync(struct hci_dev *hdev, u8 mode); - - int hci_get_random_address(struct hci_dev *hdev, bool require_privacy, -diff --git a/include/net/rose.h b/include/net/rose.h -index 23267b4efcfa32..2b5491bbf39ab5 100644 ---- a/include/net/rose.h -+++ b/include/net/rose.h -@@ -8,6 +8,7 @@ - #ifndef _ROSE_H - #define _ROSE_H - -+#include - #include - #include - #include -@@ -96,7 +97,7 @@ struct rose_neigh { - ax25_cb *ax25; - struct net_device *dev; - unsigned short count; -- unsigned short use; -+ refcount_t use; - unsigned int number; - char restarted; - char dce_mode; -@@ -151,6 +152,21 @@ struct rose_sock { - - #define rose_sk(sk) ((struct rose_sock *)(sk)) - -+static inline void rose_neigh_hold(struct rose_neigh *rose_neigh) -+{ -+ refcount_inc(&rose_neigh->use); -+} -+ -+static inline void rose_neigh_put(struct rose_neigh *rose_neigh) -+{ -+ if (refcount_dec_and_test(&rose_neigh->use)) { -+ if (rose_neigh->ax25) -+ ax25_cb_put(rose_neigh->ax25); -+ kfree(rose_neigh->digipeat); -+ kfree(rose_neigh); -+ } -+} -+ - /* af_rose.c */ - extern ax25_address rose_callsign; - extern int sysctl_rose_restart_request_timeout; -diff --git a/kernel/dma/pool.c b/kernel/dma/pool.c -index b481c48a31a630..6b0be9598a973f 100644 ---- a/kernel/dma/pool.c -+++ b/kernel/dma/pool.c -@@ -102,8 +102,8 @@ static int atomic_pool_expand(struct gen_pool *pool, size_t pool_size, - - #ifdef CONFIG_DMA_DIRECT_REMAP - addr = dma_common_contiguous_remap(page, pool_size, -- pgprot_dmacoherent(PAGE_KERNEL), -- __builtin_return_address(0)); -+ pgprot_decrypted(pgprot_dmacoherent(PAGE_KERNEL)), -+ __builtin_return_address(0)); - if (!addr) - goto free_page; - #else -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 907e45361939be..a32c8637503d14 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -10162,10 +10162,10 @@ void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) - ret = print_trace_line(&iter); - if (ret != TRACE_TYPE_NO_CONSUME) - trace_consume(&iter); -+ -+ trace_printk_seq(&iter.seq); - } - touch_nmi_watchdog(); -- -- trace_printk_seq(&iter.seq); - } - - if (!cnt) -diff --git a/net/atm/common.c b/net/atm/common.c -index 9cc82acbc73588..48bb3f66a3f2ab 100644 ---- a/net/atm/common.c -+++ b/net/atm/common.c -@@ -635,18 +635,27 @@ int vcc_sendmsg(struct socket *sock, struct msghdr *m, size_t size) - - skb->dev = NULL; /* for paths shared with net_device interfaces */ - if (!copy_from_iter_full(skb_put(skb, size), size, &m->msg_iter)) { -- atm_return_tx(vcc, skb); -- kfree_skb(skb); - error = -EFAULT; -- goto out; -+ goto free_skb; - } - if (eff != size) - memset(skb->data + size, 0, eff-size); -+ -+ if (vcc->dev->ops->pre_send) { -+ error = vcc->dev->ops->pre_send(vcc, skb); -+ if (error) -+ goto free_skb; -+ } -+ - error = vcc->dev->ops->send(vcc, skb); - error = error ? error : size; - out: - release_sock(sk); - return error; -+free_skb: -+ atm_return_tx(vcc, skb); -+ kfree_skb(skb); -+ goto out; - } - - __poll_t vcc_poll(struct file *file, struct socket *sock, poll_table *wait) -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index c06010c0d88293..5eed23b8d6c332 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -2692,7 +2692,7 @@ static void hci_cs_disconnect(struct hci_dev *hdev, u8 status) - if (!conn) - goto unlock; - -- if (status) { -+ if (status && status != HCI_ERROR_UNKNOWN_CONN_ID) { - mgmt_disconnect_failed(hdev, &conn->dst, conn->type, - conn->dst_type, status); - -@@ -2707,6 +2707,12 @@ static void hci_cs_disconnect(struct hci_dev *hdev, u8 status) - goto done; - } - -+ /* During suspend, mark connection as closed immediately -+ * since we might not receive HCI_EV_DISCONN_COMPLETE -+ */ -+ if (hdev->suspended) -+ conn->state = BT_CLOSED; -+ - mgmt_conn = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags); - - if (conn->type == ACL_LINK) { -@@ -4386,7 +4392,17 @@ static void hci_num_comp_pkts_evt(struct hci_dev *hdev, void *data, - if (!conn) - continue; - -- conn->sent -= count; -+ /* Check if there is really enough packets outstanding before -+ * attempting to decrease the sent counter otherwise it could -+ * underflow.. -+ */ -+ if (conn->sent >= count) { -+ conn->sent -= count; -+ } else { -+ bt_dev_warn(hdev, "hcon %p sent %u < count %u", -+ conn, conn->sent, count); -+ conn->sent = 0; -+ } - - switch (conn->type) { - case ACL_LINK: -diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c -index 01aca077071174..020f1809fc9946 100644 ---- a/net/bluetooth/hci_sync.c -+++ b/net/bluetooth/hci_sync.c -@@ -3491,13 +3491,13 @@ int hci_update_scan_sync(struct hci_dev *hdev) - return hci_write_scan_enable_sync(hdev, scan); - } - --int hci_update_name_sync(struct hci_dev *hdev) -+int hci_update_name_sync(struct hci_dev *hdev, const u8 *name) - { - struct hci_cp_write_local_name cp; - - memset(&cp, 0, sizeof(cp)); - -- memcpy(cp.name, hdev->dev_name, sizeof(cp.name)); -+ memcpy(cp.name, name, sizeof(cp.name)); - - return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_LOCAL_NAME, - sizeof(cp), &cp, -@@ -3550,7 +3550,7 @@ int hci_powered_update_sync(struct hci_dev *hdev) - hci_write_fast_connectable_sync(hdev, false); - hci_update_scan_sync(hdev); - hci_update_class_sync(hdev); -- hci_update_name_sync(hdev); -+ hci_update_name_sync(hdev, hdev->dev_name); - hci_update_eir_sync(hdev); - } - -diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c -index 82fa8c28438f25..9b01eaaa0eb2d6 100644 ---- a/net/bluetooth/mgmt.c -+++ b/net/bluetooth/mgmt.c -@@ -3819,8 +3819,11 @@ static void set_name_complete(struct hci_dev *hdev, void *data, int err) - - static int set_name_sync(struct hci_dev *hdev, void *data) - { -+ struct mgmt_pending_cmd *cmd = data; -+ struct mgmt_cp_set_local_name *cp = cmd->param; -+ - if (lmp_bredr_capable(hdev)) { -- hci_update_name_sync(hdev); -+ hci_update_name_sync(hdev, cp->name); - hci_update_eir_sync(hdev); - } - -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 8672ebbace980b..20f5c8307443d3 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -2547,12 +2547,16 @@ static struct rtable *__mkroute_output(const struct fib_result *res, - !netif_is_l3_master(dev_out)) - return ERR_PTR(-EINVAL); - -- if (ipv4_is_lbcast(fl4->daddr)) -+ if (ipv4_is_lbcast(fl4->daddr)) { - type = RTN_BROADCAST; -- else if (ipv4_is_multicast(fl4->daddr)) -+ -+ /* reset fi to prevent gateway resolution */ -+ fi = NULL; -+ } else if (ipv4_is_multicast(fl4->daddr)) { - type = RTN_MULTICAST; -- else if (ipv4_is_zeronet(fl4->daddr)) -+ } else if (ipv4_is_zeronet(fl4->daddr)) { - return ERR_PTR(-EINVAL); -+ } - - if (dev_out->flags & IFF_LOOPBACK) - flags |= RTCF_LOCAL; -diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c -index 66e9ceaaa43a14..614695444b6acb 100644 ---- a/net/rose/af_rose.c -+++ b/net/rose/af_rose.c -@@ -170,7 +170,7 @@ void rose_kill_by_neigh(struct rose_neigh *neigh) - - if (rose->neighbour == neigh) { - rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0); -- rose->neighbour->use--; -+ rose_neigh_put(rose->neighbour); - rose->neighbour = NULL; - } - } -@@ -212,7 +212,7 @@ static void rose_kill_by_device(struct net_device *dev) - if (rose->device == dev) { - rose_disconnect(sk, ENETUNREACH, ROSE_OUT_OF_ORDER, 0); - if (rose->neighbour) -- rose->neighbour->use--; -+ rose_neigh_put(rose->neighbour); - netdev_put(rose->device, &rose->dev_tracker); - rose->device = NULL; - } -@@ -655,7 +655,7 @@ static int rose_release(struct socket *sock) - break; - - case ROSE_STATE_2: -- rose->neighbour->use--; -+ rose_neigh_put(rose->neighbour); - release_sock(sk); - rose_disconnect(sk, 0, -1, -1); - lock_sock(sk); -@@ -823,6 +823,7 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le - rose->lci = rose_new_lci(rose->neighbour); - if (!rose->lci) { - err = -ENETUNREACH; -+ rose_neigh_put(rose->neighbour); - goto out_release; - } - -@@ -834,12 +835,14 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le - dev = rose_dev_first(); - if (!dev) { - err = -ENETUNREACH; -+ rose_neigh_put(rose->neighbour); - goto out_release; - } - - user = ax25_findbyuid(current_euid()); - if (!user) { - err = -EINVAL; -+ rose_neigh_put(rose->neighbour); - dev_put(dev); - goto out_release; - } -@@ -874,8 +877,6 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le - - rose->state = ROSE_STATE_1; - -- rose->neighbour->use++; -- - rose_write_internal(sk, ROSE_CALL_REQUEST); - rose_start_heartbeat(sk); - rose_start_t1timer(sk); -@@ -1077,7 +1078,7 @@ int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct ros - GFP_ATOMIC); - make_rose->facilities = facilities; - -- make_rose->neighbour->use++; -+ rose_neigh_hold(make_rose->neighbour); - - if (rose_sk(sk)->defer) { - make_rose->state = ROSE_STATE_5; -diff --git a/net/rose/rose_in.c b/net/rose/rose_in.c -index 4d67f36dce1b49..7caae93937ee9b 100644 ---- a/net/rose/rose_in.c -+++ b/net/rose/rose_in.c -@@ -56,7 +56,7 @@ static int rose_state1_machine(struct sock *sk, struct sk_buff *skb, int framety - case ROSE_CLEAR_REQUEST: - rose_write_internal(sk, ROSE_CLEAR_CONFIRMATION); - rose_disconnect(sk, ECONNREFUSED, skb->data[3], skb->data[4]); -- rose->neighbour->use--; -+ rose_neigh_put(rose->neighbour); - break; - - default: -@@ -79,12 +79,12 @@ static int rose_state2_machine(struct sock *sk, struct sk_buff *skb, int framety - case ROSE_CLEAR_REQUEST: - rose_write_internal(sk, ROSE_CLEAR_CONFIRMATION); - rose_disconnect(sk, 0, skb->data[3], skb->data[4]); -- rose->neighbour->use--; -+ rose_neigh_put(rose->neighbour); - break; - - case ROSE_CLEAR_CONFIRMATION: - rose_disconnect(sk, 0, -1, -1); -- rose->neighbour->use--; -+ rose_neigh_put(rose->neighbour); - break; - - default: -@@ -120,7 +120,7 @@ static int rose_state3_machine(struct sock *sk, struct sk_buff *skb, int framety - case ROSE_CLEAR_REQUEST: - rose_write_internal(sk, ROSE_CLEAR_CONFIRMATION); - rose_disconnect(sk, 0, skb->data[3], skb->data[4]); -- rose->neighbour->use--; -+ rose_neigh_put(rose->neighbour); - break; - - case ROSE_RR: -@@ -233,7 +233,7 @@ static int rose_state4_machine(struct sock *sk, struct sk_buff *skb, int framety - case ROSE_CLEAR_REQUEST: - rose_write_internal(sk, ROSE_CLEAR_CONFIRMATION); - rose_disconnect(sk, 0, skb->data[3], skb->data[4]); -- rose->neighbour->use--; -+ rose_neigh_put(rose->neighbour); - break; - - default: -@@ -253,7 +253,7 @@ static int rose_state5_machine(struct sock *sk, struct sk_buff *skb, int framety - if (frametype == ROSE_CLEAR_REQUEST) { - rose_write_internal(sk, ROSE_CLEAR_CONFIRMATION); - rose_disconnect(sk, 0, skb->data[3], skb->data[4]); -- rose_sk(sk)->neighbour->use--; -+ rose_neigh_put(rose_sk(sk)->neighbour); - } - - return 0; -diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c -index a7054546f52dfa..28746ae5a25828 100644 ---- a/net/rose/rose_route.c -+++ b/net/rose/rose_route.c -@@ -93,11 +93,11 @@ static int __must_check rose_add_node(struct rose_route_struct *rose_route, - rose_neigh->ax25 = NULL; - rose_neigh->dev = dev; - rose_neigh->count = 0; -- rose_neigh->use = 0; - rose_neigh->dce_mode = 0; - rose_neigh->loopback = 0; - rose_neigh->number = rose_neigh_no++; - rose_neigh->restarted = 0; -+ refcount_set(&rose_neigh->use, 1); - - skb_queue_head_init(&rose_neigh->queue); - -@@ -178,6 +178,7 @@ static int __must_check rose_add_node(struct rose_route_struct *rose_route, - } - } - rose_neigh->count++; -+ rose_neigh_hold(rose_neigh); - - goto out; - } -@@ -187,6 +188,7 @@ static int __must_check rose_add_node(struct rose_route_struct *rose_route, - rose_node->neighbour[rose_node->count] = rose_neigh; - rose_node->count++; - rose_neigh->count++; -+ rose_neigh_hold(rose_neigh); - } - - out: -@@ -234,20 +236,12 @@ static void rose_remove_neigh(struct rose_neigh *rose_neigh) - - if ((s = rose_neigh_list) == rose_neigh) { - rose_neigh_list = rose_neigh->next; -- if (rose_neigh->ax25) -- ax25_cb_put(rose_neigh->ax25); -- kfree(rose_neigh->digipeat); -- kfree(rose_neigh); - return; - } - - while (s != NULL && s->next != NULL) { - if (s->next == rose_neigh) { - s->next = rose_neigh->next; -- if (rose_neigh->ax25) -- ax25_cb_put(rose_neigh->ax25); -- kfree(rose_neigh->digipeat); -- kfree(rose_neigh); - return; - } - -@@ -263,10 +257,10 @@ static void rose_remove_route(struct rose_route *rose_route) - struct rose_route *s; - - if (rose_route->neigh1 != NULL) -- rose_route->neigh1->use--; -+ rose_neigh_put(rose_route->neigh1); - - if (rose_route->neigh2 != NULL) -- rose_route->neigh2->use--; -+ rose_neigh_put(rose_route->neigh2); - - if ((s = rose_route_list) == rose_route) { - rose_route_list = rose_route->next; -@@ -330,9 +324,12 @@ static int rose_del_node(struct rose_route_struct *rose_route, - for (i = 0; i < rose_node->count; i++) { - if (rose_node->neighbour[i] == rose_neigh) { - rose_neigh->count--; -+ rose_neigh_put(rose_neigh); - -- if (rose_neigh->count == 0 && rose_neigh->use == 0) -+ if (rose_neigh->count == 0) { - rose_remove_neigh(rose_neigh); -+ rose_neigh_put(rose_neigh); -+ } - - rose_node->count--; - -@@ -381,11 +378,11 @@ void rose_add_loopback_neigh(void) - sn->ax25 = NULL; - sn->dev = NULL; - sn->count = 0; -- sn->use = 0; - sn->dce_mode = 1; - sn->loopback = 1; - sn->number = rose_neigh_no++; - sn->restarted = 1; -+ refcount_set(&sn->use, 1); - - skb_queue_head_init(&sn->queue); - -@@ -436,6 +433,7 @@ int rose_add_loopback_node(const rose_address *address) - rose_node_list = rose_node; - - rose_loopback_neigh->count++; -+ rose_neigh_hold(rose_loopback_neigh); - - out: - spin_unlock_bh(&rose_node_list_lock); -@@ -467,6 +465,7 @@ void rose_del_loopback_node(const rose_address *address) - rose_remove_node(rose_node); - - rose_loopback_neigh->count--; -+ rose_neigh_put(rose_loopback_neigh); - - out: - spin_unlock_bh(&rose_node_list_lock); -@@ -506,6 +505,7 @@ void rose_rt_device_down(struct net_device *dev) - memmove(&t->neighbour[i], &t->neighbour[i + 1], - sizeof(t->neighbour[0]) * - (t->count - i)); -+ rose_neigh_put(s); - } - - if (t->count <= 0) -@@ -513,6 +513,7 @@ void rose_rt_device_down(struct net_device *dev) - } - - rose_remove_neigh(s); -+ rose_neigh_put(s); - } - spin_unlock_bh(&rose_neigh_list_lock); - spin_unlock_bh(&rose_node_list_lock); -@@ -548,6 +549,7 @@ static int rose_clear_routes(void) - { - struct rose_neigh *s, *rose_neigh; - struct rose_node *t, *rose_node; -+ int i; - - spin_lock_bh(&rose_node_list_lock); - spin_lock_bh(&rose_neigh_list_lock); -@@ -558,17 +560,21 @@ static int rose_clear_routes(void) - while (rose_node != NULL) { - t = rose_node; - rose_node = rose_node->next; -- if (!t->loopback) -+ -+ if (!t->loopback) { -+ for (i = 0; i < t->count; i++) -+ rose_neigh_put(t->neighbour[i]); - rose_remove_node(t); -+ } - } - - while (rose_neigh != NULL) { - s = rose_neigh; - rose_neigh = rose_neigh->next; - -- if (s->use == 0 && !s->loopback) { -- s->count = 0; -+ if (!s->loopback) { - rose_remove_neigh(s); -+ rose_neigh_put(s); - } - } - -@@ -684,6 +690,7 @@ struct rose_neigh *rose_get_neigh(rose_address *addr, unsigned char *cause, - for (i = 0; i < node->count; i++) { - if (node->neighbour[i]->restarted) { - res = node->neighbour[i]; -+ rose_neigh_hold(node->neighbour[i]); - goto out; - } - } -@@ -695,6 +702,7 @@ struct rose_neigh *rose_get_neigh(rose_address *addr, unsigned char *cause, - for (i = 0; i < node->count; i++) { - if (!rose_ftimer_running(node->neighbour[i])) { - res = node->neighbour[i]; -+ rose_neigh_hold(node->neighbour[i]); - goto out; - } - failed = 1; -@@ -784,13 +792,13 @@ static void rose_del_route_by_neigh(struct rose_neigh *rose_neigh) - } - - if (rose_route->neigh1 == rose_neigh) { -- rose_route->neigh1->use--; -+ rose_neigh_put(rose_route->neigh1); - rose_route->neigh1 = NULL; - rose_transmit_clear_request(rose_route->neigh2, rose_route->lci2, ROSE_OUT_OF_ORDER, 0); - } - - if (rose_route->neigh2 == rose_neigh) { -- rose_route->neigh2->use--; -+ rose_neigh_put(rose_route->neigh2); - rose_route->neigh2 = NULL; - rose_transmit_clear_request(rose_route->neigh1, rose_route->lci1, ROSE_OUT_OF_ORDER, 0); - } -@@ -919,7 +927,7 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25) - rose_clear_queues(sk); - rose->cause = ROSE_NETWORK_CONGESTION; - rose->diagnostic = 0; -- rose->neighbour->use--; -+ rose_neigh_put(rose->neighbour); - rose->neighbour = NULL; - rose->lci = 0; - rose->state = ROSE_STATE_0; -@@ -1044,12 +1052,12 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25) - - if ((new_lci = rose_new_lci(new_neigh)) == 0) { - rose_transmit_clear_request(rose_neigh, lci, ROSE_NETWORK_CONGESTION, 71); -- goto out; -+ goto put_neigh; - } - - if ((rose_route = kmalloc(sizeof(*rose_route), GFP_ATOMIC)) == NULL) { - rose_transmit_clear_request(rose_neigh, lci, ROSE_NETWORK_CONGESTION, 120); -- goto out; -+ goto put_neigh; - } - - rose_route->lci1 = lci; -@@ -1062,8 +1070,8 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25) - rose_route->lci2 = new_lci; - rose_route->neigh2 = new_neigh; - -- rose_route->neigh1->use++; -- rose_route->neigh2->use++; -+ rose_neigh_hold(rose_route->neigh1); -+ rose_neigh_hold(rose_route->neigh2); - - rose_route->next = rose_route_list; - rose_route_list = rose_route; -@@ -1075,6 +1083,8 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25) - rose_transmit_link(skb, rose_route->neigh2); - res = 1; - -+put_neigh: -+ rose_neigh_put(new_neigh); - out: - spin_unlock_bh(&rose_route_list_lock); - spin_unlock_bh(&rose_neigh_list_lock); -@@ -1190,7 +1200,7 @@ static int rose_neigh_show(struct seq_file *seq, void *v) - (rose_neigh->loopback) ? "RSLOOP-0" : ax2asc(buf, &rose_neigh->callsign), - rose_neigh->dev ? rose_neigh->dev->name : "???", - rose_neigh->count, -- rose_neigh->use, -+ refcount_read(&rose_neigh->use) - rose_neigh->count - 1, - (rose_neigh->dce_mode) ? "DCE" : "DTE", - (rose_neigh->restarted) ? "yes" : "no", - ax25_display_timer(&rose_neigh->t0timer) / HZ, -@@ -1295,18 +1305,22 @@ void __exit rose_rt_free(void) - struct rose_neigh *s, *rose_neigh = rose_neigh_list; - struct rose_node *t, *rose_node = rose_node_list; - struct rose_route *u, *rose_route = rose_route_list; -+ int i; - - while (rose_neigh != NULL) { - s = rose_neigh; - rose_neigh = rose_neigh->next; - - rose_remove_neigh(s); -+ rose_neigh_put(s); - } - - while (rose_node != NULL) { - t = rose_node; - rose_node = rose_node->next; - -+ for (i = 0; i < t->count; i++) -+ rose_neigh_put(t->neighbour[i]); - rose_remove_node(t); - } - -diff --git a/net/rose/rose_timer.c b/net/rose/rose_timer.c -index 1525773e94aa17..c52d7d20c5199b 100644 ---- a/net/rose/rose_timer.c -+++ b/net/rose/rose_timer.c -@@ -180,7 +180,7 @@ static void rose_timer_expiry(struct timer_list *t) - break; - - case ROSE_STATE_2: /* T3 */ -- rose->neighbour->use--; -+ rose_neigh_put(rose->neighbour); - rose_disconnect(sk, ETIMEDOUT, -1, -1); - break; - -diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c -index 717828e531621a..0673857cb3d8b1 100644 ---- a/net/sctp/ipv6.c -+++ b/net/sctp/ipv6.c -@@ -547,7 +547,9 @@ static void sctp_v6_from_sk(union sctp_addr *addr, struct sock *sk) - { - addr->v6.sin6_family = AF_INET6; - addr->v6.sin6_port = 0; -+ addr->v6.sin6_flowinfo = 0; - addr->v6.sin6_addr = sk->sk_v6_rcv_saddr; -+ addr->v6.sin6_scope_id = 0; - } - - /* Initialize sk->sk_rcv_saddr from sctp_addr. */ -diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c -index ebddfa74ce0a07..150ed10c8377ab 100644 ---- a/sound/soc/codecs/lpass-tx-macro.c -+++ b/sound/soc/codecs/lpass-tx-macro.c -@@ -1940,7 +1940,7 @@ static int tx_macro_register_mclk_output(struct tx_macro *tx) - } - - static const struct snd_soc_component_driver tx_macro_component_drv = { -- .name = "RX-MACRO", -+ .name = "TX-MACRO", - .probe = tx_macro_component_probe, - .controls = tx_macro_snd_controls, - .num_controls = ARRAY_SIZE(tx_macro_snd_controls), diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.104-105.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.104-105.patch deleted file mode 100644 index 6394a1e504..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.104-105.patch +++ /dev/null @@ -1,5454 +0,0 @@ -diff --git a/Documentation/userspace-api/netlink/specs.rst b/Documentation/userspace-api/netlink/specs.rst -index cc4e2430997ef8..a8218284e67a42 100644 ---- a/Documentation/userspace-api/netlink/specs.rst -+++ b/Documentation/userspace-api/netlink/specs.rst -@@ -408,10 +408,21 @@ This section describes the attribute types supported by the ``genetlink`` - compatibility level. Refer to documentation of different levels for additional - attribute types. - --Scalar integer types -+Common integer types - -------------------- - --Fixed-width integer types: -+``sint`` and ``uint`` represent signed and unsigned 64 bit integers. -+If the value can fit on 32 bits only 32 bits are carried in netlink -+messages, otherwise full 64 bits are carried. Note that the payload -+is only aligned to 4B, so the full 64 bit value may be unaligned! -+ -+Common integer types should be preferred over fix-width types in majority -+of cases. -+ -+Fix-width integer types -+----------------------- -+ -+Fixed-width integer types include: - ``u8``, ``u16``, ``u32``, ``u64``, ``s8``, ``s16``, ``s32``, ``s64``. - - Note that types smaller than 32 bit should be avoided as using them -@@ -421,6 +432,9 @@ See :ref:`pad_type` for padding of 64 bit attributes. - The payload of the attribute is the integer in host order unless ``byte-order`` - specifies otherwise. - -+64 bit values are usually aligned by the kernel but it is recommended -+that the user space is able to deal with unaligned values. -+ - .. _pad_type: - - pad -diff --git a/Makefile b/Makefile -index ae57f816375ebd..2b7f67d7b641ce 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 104 -+SUBLEVEL = 105 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts b/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts -index cd44bf83745cae..678ecc9f81dbb7 100644 ---- a/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts -+++ b/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts -@@ -442,6 +442,7 @@ &usdhc2 { - pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_gpio>; - cd-gpios = <&gpio2 12 GPIO_ACTIVE_LOW>; - vmmc-supply = <®_usdhc2_vmmc>; -+ vqmmc-supply = <&ldo5>; - bus-width = <4>; - status = "okay"; - }; -diff --git a/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi -index eae39c1cb98568..2e93d922c86111 100644 ---- a/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi -+++ b/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi -@@ -571,6 +571,7 @@ &usdhc2 { - pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_gpio>; - cd-gpios = <&gpio2 12 GPIO_ACTIVE_LOW>; - vmmc-supply = <®_usdhc2_vmmc>; -+ vqmmc-supply = <&ldo5>; - bus-width = <4>; - status = "okay"; - }; -diff --git a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts -index f5e124b235c83c..fb3012a6c9fc30 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts -+++ b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts -@@ -967,6 +967,7 @@ spiflash: flash@0 { - reg = <0>; - m25p,fast-read; - spi-max-frequency = <10000000>; -+ vcc-supply = <&vcc_3v0>; - }; - }; - -diff --git a/arch/arm64/include/asm/module.h b/arch/arm64/include/asm/module.h -index bfa6638b4c930c..8f7ac23c404d99 100644 ---- a/arch/arm64/include/asm/module.h -+++ b/arch/arm64/include/asm/module.h -@@ -19,6 +19,7 @@ struct mod_arch_specific { - - /* for CONFIG_DYNAMIC_FTRACE */ - struct plt_entry *ftrace_trampolines; -+ struct plt_entry *init_ftrace_trampolines; - }; - - u64 module_emit_plt_entry(struct module *mod, Elf64_Shdr *sechdrs, -diff --git a/arch/arm64/include/asm/module.lds.h b/arch/arm64/include/asm/module.lds.h -index b9ae8349e35dbb..fb944b46846dae 100644 ---- a/arch/arm64/include/asm/module.lds.h -+++ b/arch/arm64/include/asm/module.lds.h -@@ -2,6 +2,7 @@ SECTIONS { - .plt 0 : { BYTE(0) } - .init.plt 0 : { BYTE(0) } - .text.ftrace_trampoline 0 : { BYTE(0) } -+ .init.text.ftrace_trampoline 0 : { BYTE(0) } - - #ifdef CONFIG_KASAN_SW_TAGS - /* -diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c -index a650f5e11fc5d8..b657f058bf4d50 100644 ---- a/arch/arm64/kernel/ftrace.c -+++ b/arch/arm64/kernel/ftrace.c -@@ -195,10 +195,17 @@ int ftrace_update_ftrace_func(ftrace_func_t func) - return ftrace_modify_code(pc, 0, new, false); - } - --static struct plt_entry *get_ftrace_plt(struct module *mod) -+static struct plt_entry *get_ftrace_plt(struct module *mod, unsigned long addr) - { - #ifdef CONFIG_MODULES -- struct plt_entry *plt = mod->arch.ftrace_trampolines; -+ struct plt_entry *plt = NULL; -+ -+ if (within_module_mem_type(addr, mod, MOD_INIT_TEXT)) -+ plt = mod->arch.init_ftrace_trampolines; -+ else if (within_module_mem_type(addr, mod, MOD_TEXT)) -+ plt = mod->arch.ftrace_trampolines; -+ else -+ return NULL; - - return &plt[FTRACE_PLT_IDX]; - #else -@@ -270,7 +277,7 @@ static bool ftrace_find_callable_addr(struct dyn_ftrace *rec, - if (WARN_ON(!mod)) - return false; - -- plt = get_ftrace_plt(mod); -+ plt = get_ftrace_plt(mod, pc); - if (!plt) { - pr_err("ftrace: no module PLT for %ps\n", (void *)*addr); - return false; -diff --git a/arch/arm64/kernel/module-plts.c b/arch/arm64/kernel/module-plts.c -index 79200f21e12393..e4ddb1642ee22d 100644 ---- a/arch/arm64/kernel/module-plts.c -+++ b/arch/arm64/kernel/module-plts.c -@@ -284,7 +284,7 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, - unsigned long core_plts = 0; - unsigned long init_plts = 0; - Elf64_Sym *syms = NULL; -- Elf_Shdr *pltsec, *tramp = NULL; -+ Elf_Shdr *pltsec, *tramp = NULL, *init_tramp = NULL; - int i; - - /* -@@ -299,6 +299,9 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, - else if (!strcmp(secstrings + sechdrs[i].sh_name, - ".text.ftrace_trampoline")) - tramp = sechdrs + i; -+ else if (!strcmp(secstrings + sechdrs[i].sh_name, -+ ".init.text.ftrace_trampoline")) -+ init_tramp = sechdrs + i; - else if (sechdrs[i].sh_type == SHT_SYMTAB) - syms = (Elf64_Sym *)sechdrs[i].sh_addr; - } -@@ -364,5 +367,12 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, - tramp->sh_size = NR_FTRACE_PLTS * sizeof(struct plt_entry); - } - -+ if (init_tramp) { -+ init_tramp->sh_type = SHT_NOBITS; -+ init_tramp->sh_flags = SHF_EXECINSTR | SHF_ALLOC; -+ init_tramp->sh_addralign = __alignof__(struct plt_entry); -+ init_tramp->sh_size = NR_FTRACE_PLTS * sizeof(struct plt_entry); -+ } -+ - return 0; - } -diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c -index dd851297596e5e..adaf2920773b37 100644 ---- a/arch/arm64/kernel/module.c -+++ b/arch/arm64/kernel/module.c -@@ -579,6 +579,17 @@ static int module_init_ftrace_plt(const Elf_Ehdr *hdr, - __init_plt(&plts[FTRACE_PLT_IDX], FTRACE_ADDR); - - mod->arch.ftrace_trampolines = plts; -+ -+ s = find_section(hdr, sechdrs, ".init.text.ftrace_trampoline"); -+ if (!s) -+ return -ENOEXEC; -+ -+ plts = (void *)s->sh_addr; -+ -+ __init_plt(&plts[FTRACE_PLT_IDX], FTRACE_ADDR); -+ -+ mod->arch.init_ftrace_trampolines = plts; -+ - #endif - return 0; - } -diff --git a/arch/loongarch/kernel/signal.c b/arch/loongarch/kernel/signal.c -index 4a3686d1334949..0e90cd2df0ea3a 100644 ---- a/arch/loongarch/kernel/signal.c -+++ b/arch/loongarch/kernel/signal.c -@@ -697,6 +697,11 @@ static int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc, - for (i = 1; i < 32; i++) - err |= __put_user(regs->regs[i], &sc->sc_regs[i]); - -+#ifdef CONFIG_CPU_HAS_LBT -+ if (extctx->lbt.addr) -+ err |= protected_save_lbt_context(extctx); -+#endif -+ - if (extctx->lasx.addr) - err |= protected_save_lasx_context(extctx); - else if (extctx->lsx.addr) -@@ -704,11 +709,6 @@ static int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc, - else if (extctx->fpu.addr) - err |= protected_save_fpu_context(extctx); - --#ifdef CONFIG_CPU_HAS_LBT -- if (extctx->lbt.addr) -- err |= protected_save_lbt_context(extctx); --#endif -- - /* Set the "end" magic */ - info = (struct sctx_info *)extctx->end.addr; - err |= __put_user(0, &info->magic); -diff --git a/arch/riscv/include/asm/asm.h b/arch/riscv/include/asm/asm.h -index b5b84c6be01e16..da818b39a24cc4 100644 ---- a/arch/riscv/include/asm/asm.h -+++ b/arch/riscv/include/asm/asm.h -@@ -90,7 +90,7 @@ - #endif - - .macro asm_per_cpu dst sym tmp -- REG_L \tmp, TASK_TI_CPU_NUM(tp) -+ lw \tmp, TASK_TI_CPU_NUM(tp) - slli \tmp, \tmp, PER_CPU_OFFSET_SHIFT - la \dst, __per_cpu_offset - add \dst, \dst, \tmp -diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h -index 35c416f061552b..ea95303ab15b81 100644 ---- a/arch/x86/include/asm/pgtable_64_types.h -+++ b/arch/x86/include/asm/pgtable_64_types.h -@@ -41,6 +41,9 @@ static inline bool pgtable_l5_enabled(void) - #define pgtable_l5_enabled() 0 - #endif /* CONFIG_X86_5LEVEL */ - -+#define ARCH_PAGE_TABLE_SYNC_MASK \ -+ (pgtable_l5_enabled() ? PGTBL_PGD_MODIFIED : PGTBL_P4D_MODIFIED) -+ - extern unsigned int pgdir_shift; - extern unsigned int ptrs_per_p4d; - -diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c -index 11eb93e13ce175..cf080c96b7dd66 100644 ---- a/arch/x86/mm/init_64.c -+++ b/arch/x86/mm/init_64.c -@@ -223,6 +223,24 @@ static void sync_global_pgds(unsigned long start, unsigned long end) - sync_global_pgds_l4(start, end); - } - -+/* -+ * Make kernel mappings visible in all page tables in the system. -+ * This is necessary except when the init task populates kernel mappings -+ * during the boot process. In that case, all processes originating from -+ * the init task copies the kernel mappings, so there is no issue. -+ * Otherwise, missing synchronization could lead to kernel crashes due -+ * to missing page table entries for certain kernel mappings. -+ * -+ * Synchronization is performed at the top level, which is the PGD in -+ * 5-level paging systems. But in 4-level paging systems, however, -+ * pgd_populate() is a no-op, so synchronization is done at the P4D level. -+ * sync_global_pgds() handles this difference between paging levels. -+ */ -+void arch_sync_kernel_mappings(unsigned long start, unsigned long end) -+{ -+ sync_global_pgds(start, end); -+} -+ - /* - * NOTE: This function is marked __ref because it calls __init function - * (alloc_bootmem_pages). It's safe to do it ONLY when after_bootmem == 0. -diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c -index 1a31106a14e446..6ee8382a32302e 100644 ---- a/drivers/acpi/arm64/iort.c -+++ b/drivers/acpi/arm64/iort.c -@@ -937,8 +937,10 @@ static u32 *iort_rmr_alloc_sids(u32 *sids, u32 count, u32 id_start, - - new_sids = krealloc_array(sids, count + new_count, - sizeof(*new_sids), GFP_KERNEL); -- if (!new_sids) -+ if (!new_sids) { -+ kfree(sids); - return NULL; -+ } - - for (i = count; i < total_count; i++) - new_sids[i] = id_start++; -diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c -index 4bfc78f9781ede..0935045051699f 100644 ---- a/drivers/bluetooth/hci_vhci.c -+++ b/drivers/bluetooth/hci_vhci.c -@@ -380,6 +380,28 @@ static const struct file_operations force_devcoredump_fops = { - .write = force_devcd_write, - }; - -+static void vhci_debugfs_init(struct vhci_data *data) -+{ -+ struct hci_dev *hdev = data->hdev; -+ -+ debugfs_create_file("force_suspend", 0644, hdev->debugfs, data, -+ &force_suspend_fops); -+ -+ debugfs_create_file("force_wakeup", 0644, hdev->debugfs, data, -+ &force_wakeup_fops); -+ -+ if (IS_ENABLED(CONFIG_BT_MSFTEXT)) -+ debugfs_create_file("msft_opcode", 0644, hdev->debugfs, data, -+ &msft_opcode_fops); -+ -+ if (IS_ENABLED(CONFIG_BT_AOSPEXT)) -+ debugfs_create_file("aosp_capable", 0644, hdev->debugfs, data, -+ &aosp_capable_fops); -+ -+ debugfs_create_file("force_devcoredump", 0644, hdev->debugfs, data, -+ &force_devcoredump_fops); -+} -+ - static int __vhci_create_device(struct vhci_data *data, __u8 opcode) - { - struct hci_dev *hdev; -@@ -435,22 +457,8 @@ static int __vhci_create_device(struct vhci_data *data, __u8 opcode) - return -EBUSY; - } - -- debugfs_create_file("force_suspend", 0644, hdev->debugfs, data, -- &force_suspend_fops); -- -- debugfs_create_file("force_wakeup", 0644, hdev->debugfs, data, -- &force_wakeup_fops); -- -- if (IS_ENABLED(CONFIG_BT_MSFTEXT)) -- debugfs_create_file("msft_opcode", 0644, hdev->debugfs, data, -- &msft_opcode_fops); -- -- if (IS_ENABLED(CONFIG_BT_AOSPEXT)) -- debugfs_create_file("aosp_capable", 0644, hdev->debugfs, data, -- &aosp_capable_fops); -- -- debugfs_create_file("force_devcoredump", 0644, hdev->debugfs, data, -- &force_devcoredump_fops); -+ if (!IS_ERR_OR_NULL(hdev->debugfs)) -+ vhci_debugfs_init(data); - - hci_skb_pkt_type(skb) = HCI_VENDOR_PKT; - -@@ -652,6 +660,21 @@ static int vhci_open(struct inode *inode, struct file *file) - return 0; - } - -+static void vhci_debugfs_remove(struct hci_dev *hdev) -+{ -+ debugfs_lookup_and_remove("force_suspend", hdev->debugfs); -+ -+ debugfs_lookup_and_remove("force_wakeup", hdev->debugfs); -+ -+ if (IS_ENABLED(CONFIG_BT_MSFTEXT)) -+ debugfs_lookup_and_remove("msft_opcode", hdev->debugfs); -+ -+ if (IS_ENABLED(CONFIG_BT_AOSPEXT)) -+ debugfs_lookup_and_remove("aosp_capable", hdev->debugfs); -+ -+ debugfs_lookup_and_remove("force_devcoredump", hdev->debugfs); -+} -+ - static int vhci_release(struct inode *inode, struct file *file) - { - struct vhci_data *data = file->private_data; -@@ -663,6 +686,8 @@ static int vhci_release(struct inode *inode, struct file *file) - hdev = data->hdev; - - if (hdev) { -+ if (!IS_ERR_OR_NULL(hdev->debugfs)) -+ vhci_debugfs_remove(hdev); - hci_unregister_dev(hdev); - hci_free_dev(hdev); - } -diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c -index 4f1206ff0a10e9..ed782c0b48af25 100644 ---- a/drivers/cpufreq/intel_pstate.c -+++ b/drivers/cpufreq/intel_pstate.c -@@ -172,7 +172,6 @@ struct vid_data { - * based on the MSR_IA32_MISC_ENABLE value and whether or - * not the maximum reported turbo P-state is different from - * the maximum reported non-turbo one. -- * @turbo_disabled_mf: The @turbo_disabled value reflected by cpuinfo.max_freq. - * @min_perf_pct: Minimum capacity limit in percent of the maximum turbo - * P-state capacity. - * @max_perf_pct: Maximum capacity limit in percent of the maximum turbo -@@ -181,7 +180,6 @@ struct vid_data { - struct global_params { - bool no_turbo; - bool turbo_disabled; -- bool turbo_disabled_mf; - int max_perf_pct; - int min_perf_pct; - }; -@@ -592,16 +590,16 @@ static void intel_pstate_hybrid_hwp_adjust(struct cpudata *cpu) - cpu->pstate.min_pstate = intel_pstate_freq_to_hwp(cpu, freq); - } - --static inline void update_turbo_state(void) -+static bool turbo_is_disabled(void) - { - u64 misc_en; -- struct cpudata *cpu; - -- cpu = all_cpu_data[0]; -+ if (!cpu_feature_enabled(X86_FEATURE_IDA)) -+ return true; -+ - rdmsrl(MSR_IA32_MISC_ENABLE, misc_en); -- global.turbo_disabled = -- (misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE || -- cpu->pstate.max_pstate == cpu->pstate.turbo_pstate); -+ -+ return !!(misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE); - } - - static int min_perf_pct_min(void) -@@ -1156,40 +1154,16 @@ static void intel_pstate_update_policies(void) - static void __intel_pstate_update_max_freq(struct cpudata *cpudata, - struct cpufreq_policy *policy) - { -- policy->cpuinfo.max_freq = global.turbo_disabled_mf ? -+ policy->cpuinfo.max_freq = global.turbo_disabled ? - cpudata->pstate.max_freq : cpudata->pstate.turbo_freq; - refresh_frequency_limits(policy); - } - --static void intel_pstate_update_max_freq(unsigned int cpu) --{ -- struct cpufreq_policy *policy = cpufreq_cpu_acquire(cpu); -- -- if (!policy) -- return; -- -- __intel_pstate_update_max_freq(all_cpu_data[cpu], policy); -- -- cpufreq_cpu_release(policy); --} -- - static void intel_pstate_update_limits(unsigned int cpu) - { - mutex_lock(&intel_pstate_driver_lock); - -- update_turbo_state(); -- /* -- * If turbo has been turned on or off globally, policy limits for -- * all CPUs need to be updated to reflect that. -- */ -- if (global.turbo_disabled_mf != global.turbo_disabled) { -- global.turbo_disabled_mf = global.turbo_disabled; -- arch_set_max_freq_ratio(global.turbo_disabled); -- for_each_possible_cpu(cpu) -- intel_pstate_update_max_freq(cpu); -- } else { -- cpufreq_update_policy(cpu); -- } -+ cpufreq_update_policy(cpu); - - mutex_unlock(&intel_pstate_driver_lock); - } -@@ -1289,11 +1263,7 @@ static ssize_t show_no_turbo(struct kobject *kobj, - return -EAGAIN; - } - -- update_turbo_state(); -- if (global.turbo_disabled) -- ret = sprintf(buf, "%u\n", global.turbo_disabled); -- else -- ret = sprintf(buf, "%u\n", global.no_turbo); -+ ret = sprintf(buf, "%u\n", global.no_turbo); - - mutex_unlock(&intel_pstate_driver_lock); - -@@ -1304,32 +1274,39 @@ static ssize_t store_no_turbo(struct kobject *a, struct kobj_attribute *b, - const char *buf, size_t count) - { - unsigned int input; -- int ret; -+ bool no_turbo; - -- ret = sscanf(buf, "%u", &input); -- if (ret != 1) -+ if (sscanf(buf, "%u", &input) != 1) - return -EINVAL; - - mutex_lock(&intel_pstate_driver_lock); - - if (!intel_pstate_driver) { -- mutex_unlock(&intel_pstate_driver_lock); -- return -EAGAIN; -+ count = -EAGAIN; -+ goto unlock_driver; - } - -- mutex_lock(&intel_pstate_limits_lock); -+ no_turbo = !!clamp_t(int, input, 0, 1); - -- update_turbo_state(); -- if (global.turbo_disabled) { -- pr_notice_once("Turbo disabled by BIOS or unavailable on processor\n"); -- mutex_unlock(&intel_pstate_limits_lock); -- mutex_unlock(&intel_pstate_driver_lock); -- return -EPERM; -+ WRITE_ONCE(global.turbo_disabled, turbo_is_disabled()); -+ if (global.turbo_disabled && !no_turbo) { -+ pr_notice("Turbo disabled by BIOS or unavailable on processor\n"); -+ count = -EPERM; -+ if (global.no_turbo) -+ goto unlock_driver; -+ else -+ no_turbo = 1; - } - -- global.no_turbo = clamp_t(int, input, 0, 1); -+ if (no_turbo == global.no_turbo) { -+ goto unlock_driver; -+ } - -- if (global.no_turbo) { -+ WRITE_ONCE(global.no_turbo, no_turbo); -+ -+ mutex_lock(&intel_pstate_limits_lock); -+ -+ if (no_turbo) { - struct cpudata *cpu = all_cpu_data[0]; - int pct = cpu->pstate.max_pstate * 100 / cpu->pstate.turbo_pstate; - -@@ -1341,8 +1318,9 @@ static ssize_t store_no_turbo(struct kobject *a, struct kobj_attribute *b, - mutex_unlock(&intel_pstate_limits_lock); - - intel_pstate_update_policies(); -- arch_set_max_freq_ratio(global.no_turbo); -+ arch_set_max_freq_ratio(no_turbo); - -+unlock_driver: - mutex_unlock(&intel_pstate_driver_lock); - - return count; -@@ -1793,7 +1771,7 @@ static u64 atom_get_val(struct cpudata *cpudata, int pstate) - u32 vid; - - val = (u64)pstate << 8; -- if (global.no_turbo && !global.turbo_disabled) -+ if (READ_ONCE(global.no_turbo) && !READ_ONCE(global.turbo_disabled)) - val |= (u64)1 << 32; - - vid_fp = cpudata->vid.min + mul_fp( -@@ -1958,7 +1936,7 @@ static u64 core_get_val(struct cpudata *cpudata, int pstate) - u64 val; - - val = (u64)pstate << 8; -- if (global.no_turbo && !global.turbo_disabled) -+ if (READ_ONCE(global.no_turbo) && !READ_ONCE(global.turbo_disabled)) - val |= (u64)1 << 32; - - return val; -@@ -2031,14 +2009,6 @@ static void intel_pstate_set_min_pstate(struct cpudata *cpu) - intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate); - } - --static void intel_pstate_max_within_limits(struct cpudata *cpu) --{ -- int pstate = max(cpu->pstate.min_pstate, cpu->max_perf_ratio); -- -- update_turbo_state(); -- intel_pstate_set_pstate(cpu, pstate); --} -- - static void intel_pstate_get_cpu_pstates(struct cpudata *cpu) - { - int perf_ctl_max_phys = pstate_funcs.get_max_physical(cpu->cpu); -@@ -2264,7 +2234,7 @@ static inline int32_t get_target_pstate(struct cpudata *cpu) - - sample->busy_scaled = busy_frac * 100; - -- target = global.no_turbo || global.turbo_disabled ? -+ target = READ_ONCE(global.no_turbo) ? - cpu->pstate.max_pstate : cpu->pstate.turbo_pstate; - target += target >> 2; - target = mul_fp(target, busy_frac); -@@ -2308,8 +2278,6 @@ static void intel_pstate_adjust_pstate(struct cpudata *cpu) - struct sample *sample; - int target_pstate; - -- update_turbo_state(); -- - target_pstate = get_target_pstate(cpu); - target_pstate = intel_pstate_prepare_request(cpu, target_pstate); - trace_cpu_frequency(target_pstate * cpu->pstate.scaling, cpu->cpu); -@@ -2527,7 +2495,7 @@ static void intel_pstate_clear_update_util_hook(unsigned int cpu) - - static int intel_pstate_get_max_freq(struct cpudata *cpu) - { -- return global.turbo_disabled || global.no_turbo ? -+ return READ_ONCE(global.no_turbo) ? - cpu->pstate.max_freq : cpu->pstate.turbo_freq; - } - -@@ -2612,12 +2580,14 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy) - intel_pstate_update_perf_limits(cpu, policy->min, policy->max); - - if (cpu->policy == CPUFREQ_POLICY_PERFORMANCE) { -+ int pstate = max(cpu->pstate.min_pstate, cpu->max_perf_ratio); -+ - /* - * NOHZ_FULL CPUs need this as the governor callback may not - * be invoked on them. - */ - intel_pstate_clear_update_util_hook(policy->cpu); -- intel_pstate_max_within_limits(cpu); -+ intel_pstate_set_pstate(cpu, pstate); - } else { - intel_pstate_set_update_util_hook(policy->cpu); - } -@@ -2660,10 +2630,9 @@ static void intel_pstate_verify_cpu_policy(struct cpudata *cpu, - { - int max_freq; - -- update_turbo_state(); - if (hwp_active) { - intel_pstate_get_hwp_cap(cpu); -- max_freq = global.no_turbo || global.turbo_disabled ? -+ max_freq = READ_ONCE(global.no_turbo) ? - cpu->pstate.max_freq : cpu->pstate.turbo_freq; - } else { - max_freq = intel_pstate_get_max_freq(cpu); -@@ -2757,8 +2726,6 @@ static int __intel_pstate_cpu_init(struct cpufreq_policy *policy) - - /* cpuinfo and default policy values */ - policy->cpuinfo.min_freq = cpu->pstate.min_freq; -- update_turbo_state(); -- global.turbo_disabled_mf = global.turbo_disabled; - policy->cpuinfo.max_freq = global.turbo_disabled ? - cpu->pstate.max_freq : cpu->pstate.turbo_freq; - -@@ -2924,8 +2891,6 @@ static int intel_cpufreq_target(struct cpufreq_policy *policy, - struct cpufreq_freqs freqs; - int target_pstate; - -- update_turbo_state(); -- - freqs.old = policy->cur; - freqs.new = target_freq; - -@@ -2947,8 +2912,6 @@ static unsigned int intel_cpufreq_fast_switch(struct cpufreq_policy *policy, - struct cpudata *cpu = all_cpu_data[policy->cpu]; - int target_pstate; - -- update_turbo_state(); -- - target_pstate = intel_pstate_freq_to_hwp(cpu, target_freq); - - target_pstate = intel_cpufreq_update_pstate(policy, target_pstate, true); -@@ -2966,7 +2929,6 @@ static void intel_cpufreq_adjust_perf(unsigned int cpunum, - int old_pstate = cpu->pstate.current_pstate; - int cap_pstate, min_pstate, max_pstate, target_pstate; - -- update_turbo_state(); - cap_pstate = global.turbo_disabled ? HWP_GUARANTEED_PERF(hwp_cap) : - HWP_HIGHEST_PERF(hwp_cap); - -@@ -3156,6 +3118,10 @@ static int intel_pstate_register_driver(struct cpufreq_driver *driver) - - memset(&global, 0, sizeof(global)); - global.max_perf_pct = 100; -+ global.turbo_disabled = turbo_is_disabled(); -+ global.no_turbo = global.turbo_disabled; -+ -+ arch_set_max_freq_ratio(global.turbo_disabled); - - intel_pstate_driver = driver; - ret = cpufreq_register_driver(intel_pstate_driver); -diff --git a/drivers/dma/mediatek/mtk-cqdma.c b/drivers/dma/mediatek/mtk-cqdma.c -index 324b7387b1b922..525bb92ced8f82 100644 ---- a/drivers/dma/mediatek/mtk-cqdma.c -+++ b/drivers/dma/mediatek/mtk-cqdma.c -@@ -420,15 +420,11 @@ static struct virt_dma_desc *mtk_cqdma_find_active_desc(struct dma_chan *c, - { - struct mtk_cqdma_vchan *cvc = to_cqdma_vchan(c); - struct virt_dma_desc *vd; -- unsigned long flags; - -- spin_lock_irqsave(&cvc->pc->lock, flags); - list_for_each_entry(vd, &cvc->pc->queue, node) - if (vd->tx.cookie == cookie) { -- spin_unlock_irqrestore(&cvc->pc->lock, flags); - return vd; - } -- spin_unlock_irqrestore(&cvc->pc->lock, flags); - - list_for_each_entry(vd, &cvc->vc.desc_issued, node) - if (vd->tx.cookie == cookie) -@@ -452,9 +448,11 @@ static enum dma_status mtk_cqdma_tx_status(struct dma_chan *c, - if (ret == DMA_COMPLETE || !txstate) - return ret; - -- spin_lock_irqsave(&cvc->vc.lock, flags); -+ spin_lock_irqsave(&cvc->pc->lock, flags); -+ spin_lock(&cvc->vc.lock); - vd = mtk_cqdma_find_active_desc(c, cookie); -- spin_unlock_irqrestore(&cvc->vc.lock, flags); -+ spin_unlock(&cvc->vc.lock); -+ spin_unlock_irqrestore(&cvc->pc->lock, flags); - - if (vd) { - cvd = to_cqdma_vdesc(vd); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c -index ffa5e72a84ebcb..c83445c2e37f3d 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c -@@ -291,21 +291,22 @@ static int psp_memory_training_init(struct psp_context *psp) - struct psp_memory_training_context *ctx = &psp->mem_train_ctx; - - if (ctx->init != PSP_MEM_TRAIN_RESERVE_SUCCESS) { -- DRM_DEBUG("memory training is not supported!\n"); -+ dev_dbg(psp->adev->dev, "memory training is not supported!\n"); - return 0; - } - - ctx->sys_cache = kzalloc(ctx->train_data_size, GFP_KERNEL); - if (ctx->sys_cache == NULL) { -- DRM_ERROR("alloc mem_train_ctx.sys_cache failed!\n"); -+ dev_err(psp->adev->dev, "alloc mem_train_ctx.sys_cache failed!\n"); - ret = -ENOMEM; - goto Err_out; - } - -- DRM_DEBUG("train_data_size:%llx,p2c_train_data_offset:%llx,c2p_train_data_offset:%llx.\n", -- ctx->train_data_size, -- ctx->p2c_train_data_offset, -- ctx->c2p_train_data_offset); -+ dev_dbg(psp->adev->dev, -+ "train_data_size:%llx,p2c_train_data_offset:%llx,c2p_train_data_offset:%llx.\n", -+ ctx->train_data_size, -+ ctx->p2c_train_data_offset, -+ ctx->c2p_train_data_offset); - ctx->init = PSP_MEM_TRAIN_INIT_SUCCESS; - return 0; - -@@ -407,8 +408,8 @@ static int psp_sw_init(void *handle) - - psp->cmd = kzalloc(sizeof(struct psp_gfx_cmd_resp), GFP_KERNEL); - if (!psp->cmd) { -- DRM_ERROR("Failed to allocate memory to command buffer!\n"); -- ret = -ENOMEM; -+ dev_err(adev->dev, "Failed to allocate memory to command buffer!\n"); -+ return -ENOMEM; - } - - adev->psp.xgmi_context.supports_extended_data = -@@ -454,13 +455,13 @@ static int psp_sw_init(void *handle) - if (mem_training_ctx->enable_mem_training) { - ret = psp_memory_training_init(psp); - if (ret) { -- DRM_ERROR("Failed to initialize memory training!\n"); -+ dev_err(adev->dev, "Failed to initialize memory training!\n"); - return ret; - } - - ret = psp_mem_training(psp, PSP_MEM_TRAIN_COLD_BOOT); - if (ret) { -- DRM_ERROR("Failed to process memory training!\n"); -+ dev_err(adev->dev, "Failed to process memory training!\n"); - return ret; - } - } -@@ -674,9 +675,11 @@ psp_cmd_submit_buf(struct psp_context *psp, - */ - if (!skip_unsupport && (psp->cmd_buf_mem->resp.status || !timeout) && !ras_intr) { - if (ucode) -- DRM_WARN("failed to load ucode %s(0x%X) ", -- amdgpu_ucode_name(ucode->ucode_id), ucode->ucode_id); -- DRM_WARN("psp gfx command %s(0x%X) failed and response status is (0x%X)\n", -+ dev_warn(psp->adev->dev, -+ "failed to load ucode %s(0x%X) ", -+ amdgpu_ucode_name(ucode->ucode_id), ucode->ucode_id); -+ dev_warn(psp->adev->dev, -+ "psp gfx command %s(0x%X) failed and response status is (0x%X)\n", - psp_gfx_cmd_name(psp->cmd_buf_mem->cmd_id), psp->cmd_buf_mem->cmd_id, - psp->cmd_buf_mem->resp.status); - /* If any firmware (including CAP) load fails under SRIOV, it should -@@ -806,7 +809,7 @@ static int psp_tmr_init(struct psp_context *psp) - psp->fw_pri_buf) { - ret = psp_load_toc(psp, &tmr_size); - if (ret) { -- DRM_ERROR("Failed to load toc\n"); -+ dev_err(psp->adev->dev, "Failed to load toc\n"); - return ret; - } - } -@@ -854,7 +857,7 @@ static int psp_tmr_load(struct psp_context *psp) - - psp_prep_tmr_cmd_buf(psp, cmd, psp->tmr_mc_addr, psp->tmr_bo); - if (psp->tmr_bo) -- DRM_INFO("reserve 0x%lx from 0x%llx for PSP TMR\n", -+ dev_info(psp->adev->dev, "reserve 0x%lx from 0x%llx for PSP TMR\n", - amdgpu_bo_size(psp->tmr_bo), psp->tmr_mc_addr); - - ret = psp_cmd_submit_buf(psp, NULL, cmd, -@@ -1112,7 +1115,7 @@ int psp_reg_program(struct psp_context *psp, enum psp_reg_prog_id reg, - psp_prep_reg_prog_cmd_buf(cmd, reg, value); - ret = psp_cmd_submit_buf(psp, NULL, cmd, psp->fence_buf_mc_addr); - if (ret) -- DRM_ERROR("PSP failed to program reg id %d", reg); -+ dev_err(psp->adev->dev, "PSP failed to program reg id %d\n", reg); - - release_psp_cmd_buf(psp); - -@@ -1492,22 +1495,22 @@ static void psp_ras_ta_check_status(struct psp_context *psp) - switch (ras_cmd->ras_status) { - case TA_RAS_STATUS__ERROR_UNSUPPORTED_IP: - dev_warn(psp->adev->dev, -- "RAS WARNING: cmd failed due to unsupported ip\n"); -+ "RAS WARNING: cmd failed due to unsupported ip\n"); - break; - case TA_RAS_STATUS__ERROR_UNSUPPORTED_ERROR_INJ: - dev_warn(psp->adev->dev, -- "RAS WARNING: cmd failed due to unsupported error injection\n"); -+ "RAS WARNING: cmd failed due to unsupported error injection\n"); - break; - case TA_RAS_STATUS__SUCCESS: - break; - case TA_RAS_STATUS__TEE_ERROR_ACCESS_DENIED: - if (ras_cmd->cmd_id == TA_RAS_COMMAND__TRIGGER_ERROR) - dev_warn(psp->adev->dev, -- "RAS WARNING: Inject error to critical region is not allowed\n"); -+ "RAS WARNING: Inject error to critical region is not allowed\n"); - break; - default: - dev_warn(psp->adev->dev, -- "RAS WARNING: ras status = 0x%X\n", ras_cmd->ras_status); -+ "RAS WARNING: ras status = 0x%X\n", ras_cmd->ras_status); - break; - } - } -@@ -1531,7 +1534,7 @@ int psp_ras_invoke(struct psp_context *psp, uint32_t ta_cmd_id) - return ret; - - if (ras_cmd->if_version > RAS_TA_HOST_IF_VER) { -- DRM_WARN("RAS: Unsupported Interface"); -+ dev_warn(psp->adev->dev, "RAS: Unsupported Interface\n"); - return -EINVAL; - } - -@@ -1681,7 +1684,7 @@ int psp_ras_initialize(struct psp_context *psp) - psp->ras_context.context.initialized = true; - else { - if (ras_cmd->ras_status) -- dev_warn(psp->adev->dev, "RAS Init Status: 0x%X\n", ras_cmd->ras_status); -+ dev_warn(adev->dev, "RAS Init Status: 0x%X\n", ras_cmd->ras_status); - - /* fail to load RAS TA */ - psp->ras_context.context.initialized = false; -@@ -2101,7 +2104,7 @@ static int psp_hw_start(struct psp_context *psp) - (psp->funcs->bootloader_load_kdb != NULL)) { - ret = psp_bootloader_load_kdb(psp); - if (ret) { -- DRM_ERROR("PSP load kdb failed!\n"); -+ dev_err(adev->dev, "PSP load kdb failed!\n"); - return ret; - } - } -@@ -2110,7 +2113,7 @@ static int psp_hw_start(struct psp_context *psp) - (psp->funcs->bootloader_load_spl != NULL)) { - ret = psp_bootloader_load_spl(psp); - if (ret) { -- DRM_ERROR("PSP load spl failed!\n"); -+ dev_err(adev->dev, "PSP load spl failed!\n"); - return ret; - } - } -@@ -2119,7 +2122,7 @@ static int psp_hw_start(struct psp_context *psp) - (psp->funcs->bootloader_load_sysdrv != NULL)) { - ret = psp_bootloader_load_sysdrv(psp); - if (ret) { -- DRM_ERROR("PSP load sys drv failed!\n"); -+ dev_err(adev->dev, "PSP load sys drv failed!\n"); - return ret; - } - } -@@ -2128,7 +2131,7 @@ static int psp_hw_start(struct psp_context *psp) - (psp->funcs->bootloader_load_soc_drv != NULL)) { - ret = psp_bootloader_load_soc_drv(psp); - if (ret) { -- DRM_ERROR("PSP load soc drv failed!\n"); -+ dev_err(adev->dev, "PSP load soc drv failed!\n"); - return ret; - } - } -@@ -2137,7 +2140,7 @@ static int psp_hw_start(struct psp_context *psp) - (psp->funcs->bootloader_load_intf_drv != NULL)) { - ret = psp_bootloader_load_intf_drv(psp); - if (ret) { -- DRM_ERROR("PSP load intf drv failed!\n"); -+ dev_err(adev->dev, "PSP load intf drv failed!\n"); - return ret; - } - } -@@ -2146,7 +2149,7 @@ static int psp_hw_start(struct psp_context *psp) - (psp->funcs->bootloader_load_dbg_drv != NULL)) { - ret = psp_bootloader_load_dbg_drv(psp); - if (ret) { -- DRM_ERROR("PSP load dbg drv failed!\n"); -+ dev_err(adev->dev, "PSP load dbg drv failed!\n"); - return ret; - } - } -@@ -2155,7 +2158,7 @@ static int psp_hw_start(struct psp_context *psp) - (psp->funcs->bootloader_load_ras_drv != NULL)) { - ret = psp_bootloader_load_ras_drv(psp); - if (ret) { -- DRM_ERROR("PSP load ras_drv failed!\n"); -+ dev_err(adev->dev, "PSP load ras_drv failed!\n"); - return ret; - } - } -@@ -2164,7 +2167,7 @@ static int psp_hw_start(struct psp_context *psp) - (psp->funcs->bootloader_load_sos != NULL)) { - ret = psp_bootloader_load_sos(psp); - if (ret) { -- DRM_ERROR("PSP load sos failed!\n"); -+ dev_err(adev->dev, "PSP load sos failed!\n"); - return ret; - } - } -@@ -2172,7 +2175,7 @@ static int psp_hw_start(struct psp_context *psp) - - ret = psp_ring_create(psp, PSP_RING_TYPE__KM); - if (ret) { -- DRM_ERROR("PSP create ring failed!\n"); -+ dev_err(adev->dev, "PSP create ring failed!\n"); - return ret; - } - -@@ -2182,7 +2185,7 @@ static int psp_hw_start(struct psp_context *psp) - if (!psp_boottime_tmr(psp)) { - ret = psp_tmr_init(psp); - if (ret) { -- DRM_ERROR("PSP tmr init failed!\n"); -+ dev_err(adev->dev, "PSP tmr init failed!\n"); - return ret; - } - } -@@ -2201,7 +2204,7 @@ static int psp_hw_start(struct psp_context *psp) - - ret = psp_tmr_load(psp); - if (ret) { -- DRM_ERROR("PSP load tmr failed!\n"); -+ dev_err(adev->dev, "PSP load tmr failed!\n"); - return ret; - } - -@@ -2448,7 +2451,8 @@ static void psp_print_fw_hdr(struct psp_context *psp, - } - } - --static int psp_prep_load_ip_fw_cmd_buf(struct amdgpu_firmware_info *ucode, -+static int psp_prep_load_ip_fw_cmd_buf(struct psp_context *psp, -+ struct amdgpu_firmware_info *ucode, - struct psp_gfx_cmd_resp *cmd) - { - int ret; -@@ -2461,7 +2465,7 @@ static int psp_prep_load_ip_fw_cmd_buf(struct amdgpu_firmware_info *ucode, - - ret = psp_get_fw_type(ucode, &cmd->cmd.cmd_load_ip_fw.fw_type); - if (ret) -- DRM_ERROR("Unknown firmware type\n"); -+ dev_err(psp->adev->dev, "Unknown firmware type\n"); - - return ret; - } -@@ -2472,7 +2476,7 @@ int psp_execute_ip_fw_load(struct psp_context *psp, - int ret = 0; - struct psp_gfx_cmd_resp *cmd = acquire_psp_cmd_buf(psp); - -- ret = psp_prep_load_ip_fw_cmd_buf(ucode, cmd); -+ ret = psp_prep_load_ip_fw_cmd_buf(psp, ucode, cmd); - if (!ret) { - ret = psp_cmd_submit_buf(psp, ucode, cmd, - psp->fence_buf_mc_addr); -@@ -2507,13 +2511,13 @@ static int psp_load_smu_fw(struct psp_context *psp) - adev->ip_versions[MP0_HWIP][0] == IP_VERSION(11, 0, 2)))) { - ret = amdgpu_dpm_set_mp1_state(adev, PP_MP1_STATE_UNLOAD); - if (ret) -- DRM_WARN("Failed to set MP1 state prepare for reload\n"); -+ dev_err(adev->dev, "Failed to set MP1 state prepare for reload\n"); - } - - ret = psp_execute_ip_fw_load(psp, ucode); - - if (ret) -- DRM_ERROR("PSP load smu failed!\n"); -+ dev_err(adev->dev, "PSP load smu failed!\n"); - - return ret; - } -@@ -2609,7 +2613,7 @@ static int psp_load_non_psp_fw(struct psp_context *psp) - adev->virt.autoload_ucode_id : AMDGPU_UCODE_ID_RLC_G)) { - ret = psp_rlc_autoload_start(psp); - if (ret) { -- DRM_ERROR("Failed to start rlc autoload\n"); -+ dev_err(adev->dev, "Failed to start rlc autoload\n"); - return ret; - } - } -@@ -2631,7 +2635,7 @@ static int psp_load_fw(struct amdgpu_device *adev) - - ret = psp_ring_init(psp, PSP_RING_TYPE__KM); - if (ret) { -- DRM_ERROR("PSP ring init failed!\n"); -+ dev_err(adev->dev, "PSP ring init failed!\n"); - goto failed; - } - } -@@ -2646,13 +2650,13 @@ static int psp_load_fw(struct amdgpu_device *adev) - - ret = psp_asd_initialize(psp); - if (ret) { -- DRM_ERROR("PSP load asd failed!\n"); -+ dev_err(adev->dev, "PSP load asd failed!\n"); - goto failed1; - } - - ret = psp_rl_load(adev); - if (ret) { -- DRM_ERROR("PSP load RL failed!\n"); -+ dev_err(adev->dev, "PSP load RL failed!\n"); - goto failed1; - } - -@@ -2672,7 +2676,7 @@ static int psp_load_fw(struct amdgpu_device *adev) - ret = psp_ras_initialize(psp); - if (ret) - dev_err(psp->adev->dev, -- "RAS: Failed to initialize RAS\n"); -+ "RAS: Failed to initialize RAS\n"); - - ret = psp_hdcp_initialize(psp); - if (ret) -@@ -2725,7 +2729,7 @@ static int psp_hw_init(void *handle) - - ret = psp_load_fw(adev); - if (ret) { -- DRM_ERROR("PSP firmware loading failed\n"); -+ dev_err(adev->dev, "PSP firmware loading failed\n"); - goto failed; - } - -@@ -2772,7 +2776,7 @@ static int psp_suspend(void *handle) - psp->xgmi_context.context.initialized) { - ret = psp_xgmi_terminate(psp); - if (ret) { -- DRM_ERROR("Failed to terminate xgmi ta\n"); -+ dev_err(adev->dev, "Failed to terminate xgmi ta\n"); - goto out; - } - } -@@ -2780,46 +2784,46 @@ static int psp_suspend(void *handle) - if (psp->ta_fw) { - ret = psp_ras_terminate(psp); - if (ret) { -- DRM_ERROR("Failed to terminate ras ta\n"); -+ dev_err(adev->dev, "Failed to terminate ras ta\n"); - goto out; - } - ret = psp_hdcp_terminate(psp); - if (ret) { -- DRM_ERROR("Failed to terminate hdcp ta\n"); -+ dev_err(adev->dev, "Failed to terminate hdcp ta\n"); - goto out; - } - ret = psp_dtm_terminate(psp); - if (ret) { -- DRM_ERROR("Failed to terminate dtm ta\n"); -+ dev_err(adev->dev, "Failed to terminate dtm ta\n"); - goto out; - } - ret = psp_rap_terminate(psp); - if (ret) { -- DRM_ERROR("Failed to terminate rap ta\n"); -+ dev_err(adev->dev, "Failed to terminate rap ta\n"); - goto out; - } - ret = psp_securedisplay_terminate(psp); - if (ret) { -- DRM_ERROR("Failed to terminate securedisplay ta\n"); -+ dev_err(adev->dev, "Failed to terminate securedisplay ta\n"); - goto out; - } - } - - ret = psp_asd_terminate(psp); - if (ret) { -- DRM_ERROR("Failed to terminate asd\n"); -+ dev_err(adev->dev, "Failed to terminate asd\n"); - goto out; - } - - ret = psp_tmr_terminate(psp); - if (ret) { -- DRM_ERROR("Failed to terminate tmr\n"); -+ dev_err(adev->dev, "Failed to terminate tmr\n"); - goto out; - } - - ret = psp_ring_stop(psp, PSP_RING_TYPE__KM); - if (ret) -- DRM_ERROR("PSP ring stop failed\n"); -+ dev_err(adev->dev, "PSP ring stop failed\n"); - - out: - return ret; -@@ -2831,12 +2835,12 @@ static int psp_resume(void *handle) - struct amdgpu_device *adev = (struct amdgpu_device *)handle; - struct psp_context *psp = &adev->psp; - -- DRM_INFO("PSP is resuming...\n"); -+ dev_info(adev->dev, "PSP is resuming...\n"); - - if (psp->mem_train_ctx.enable_mem_training) { - ret = psp_mem_training(psp, PSP_MEM_TRAIN_RESUME); - if (ret) { -- DRM_ERROR("Failed to process memory training!\n"); -+ dev_err(adev->dev, "Failed to process memory training!\n"); - return ret; - } - } -@@ -2853,7 +2857,7 @@ static int psp_resume(void *handle) - - ret = psp_asd_initialize(psp); - if (ret) { -- DRM_ERROR("PSP load asd failed!\n"); -+ dev_err(adev->dev, "PSP load asd failed!\n"); - goto failed; - } - -@@ -2877,7 +2881,7 @@ static int psp_resume(void *handle) - ret = psp_ras_initialize(psp); - if (ret) - dev_err(psp->adev->dev, -- "RAS: Failed to initialize RAS\n"); -+ "RAS: Failed to initialize RAS\n"); - - ret = psp_hdcp_initialize(psp); - if (ret) -@@ -2905,7 +2909,7 @@ static int psp_resume(void *handle) - return 0; - - failed: -- DRM_ERROR("PSP resume failed\n"); -+ dev_err(adev->dev, "PSP resume failed\n"); - mutex_unlock(&adev->firmware.mutex); - return ret; - } -@@ -2966,9 +2970,11 @@ int psp_ring_cmd_submit(struct psp_context *psp, - write_frame = ring_buffer_start + (psp_write_ptr_reg / rb_frame_size_dw); - /* Check invalid write_frame ptr address */ - if ((write_frame < ring_buffer_start) || (ring_buffer_end < write_frame)) { -- DRM_ERROR("ring_buffer_start = %p; ring_buffer_end = %p; write_frame = %p\n", -- ring_buffer_start, ring_buffer_end, write_frame); -- DRM_ERROR("write_frame is pointing to address out of bounds\n"); -+ dev_err(adev->dev, -+ "ring_buffer_start = %p; ring_buffer_end = %p; write_frame = %p\n", -+ ring_buffer_start, ring_buffer_end, write_frame); -+ dev_err(adev->dev, -+ "write_frame is pointing to address out of bounds\n"); - return -EINVAL; - } - -@@ -3495,7 +3501,7 @@ static ssize_t psp_usbc_pd_fw_sysfs_read(struct device *dev, - int ret; - - if (!adev->ip_blocks[AMD_IP_BLOCK_TYPE_PSP].status.late_initialized) { -- DRM_INFO("PSP block is not ready yet."); -+ dev_info(adev->dev, "PSP block is not ready yet\n."); - return -EBUSY; - } - -@@ -3504,7 +3510,7 @@ static ssize_t psp_usbc_pd_fw_sysfs_read(struct device *dev, - mutex_unlock(&adev->psp.mutex); - - if (ret) { -- DRM_ERROR("Failed to read USBC PD FW, err = %d", ret); -+ dev_err(adev->dev, "Failed to read USBC PD FW, err = %d\n", ret); - return ret; - } - -@@ -3526,7 +3532,7 @@ static ssize_t psp_usbc_pd_fw_sysfs_write(struct device *dev, - void *fw_pri_cpu_addr; - - if (!adev->ip_blocks[AMD_IP_BLOCK_TYPE_PSP].status.late_initialized) { -- DRM_INFO("PSP block is not ready yet."); -+ dev_err(adev->dev, "PSP block is not ready yet."); - return -EBUSY; - } - -@@ -3559,7 +3565,7 @@ static ssize_t psp_usbc_pd_fw_sysfs_write(struct device *dev, - release_firmware(usbc_pd_fw); - fail: - if (ret) { -- DRM_ERROR("Failed to load USBC PD FW, err = %d", ret); -+ dev_err(adev->dev, "Failed to load USBC PD FW, err = %d", ret); - count = ret; - } - -@@ -3606,7 +3612,7 @@ static ssize_t amdgpu_psp_vbflash_write(struct file *filp, struct kobject *kobj, - - /* Safeguard against memory drain */ - if (adev->psp.vbflash_image_size > AMD_VBIOS_FILE_MAX_SIZE_B) { -- dev_err(adev->dev, "File size cannot exceed %u", AMD_VBIOS_FILE_MAX_SIZE_B); -+ dev_err(adev->dev, "File size cannot exceed %u\n", AMD_VBIOS_FILE_MAX_SIZE_B); - kvfree(adev->psp.vbflash_tmp_buf); - adev->psp.vbflash_tmp_buf = NULL; - adev->psp.vbflash_image_size = 0; -@@ -3625,7 +3631,7 @@ static ssize_t amdgpu_psp_vbflash_write(struct file *filp, struct kobject *kobj, - adev->psp.vbflash_image_size += count; - mutex_unlock(&adev->psp.mutex); - -- dev_dbg(adev->dev, "IFWI staged for update"); -+ dev_dbg(adev->dev, "IFWI staged for update\n"); - - return count; - } -@@ -3645,7 +3651,7 @@ static ssize_t amdgpu_psp_vbflash_read(struct file *filp, struct kobject *kobj, - if (adev->psp.vbflash_image_size == 0) - return -EINVAL; - -- dev_dbg(adev->dev, "PSP IFWI flash process initiated"); -+ dev_dbg(adev->dev, "PSP IFWI flash process initiated\n"); - - ret = amdgpu_bo_create_kernel(adev, adev->psp.vbflash_image_size, - AMDGPU_GPU_PAGE_SIZE, -@@ -3670,11 +3676,11 @@ static ssize_t amdgpu_psp_vbflash_read(struct file *filp, struct kobject *kobj, - adev->psp.vbflash_image_size = 0; - - if (ret) { -- dev_err(adev->dev, "Failed to load IFWI, err = %d", ret); -+ dev_err(adev->dev, "Failed to load IFWI, err = %d\n", ret); - return ret; - } - -- dev_dbg(adev->dev, "PSP IFWI flash process done"); -+ dev_dbg(adev->dev, "PSP IFWI flash process done\n"); - return 0; - } - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c -index fded8902346f5d..2992ce494e000c 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c -@@ -2125,11 +2125,13 @@ void amdgpu_vm_adjust_size(struct amdgpu_device *adev, uint32_t min_vm_size, - */ - long amdgpu_vm_wait_idle(struct amdgpu_vm *vm, long timeout) - { -- timeout = drm_sched_entity_flush(&vm->immediate, timeout); -+ timeout = dma_resv_wait_timeout(vm->root.bo->tbo.base.resv, -+ DMA_RESV_USAGE_BOOKKEEP, -+ true, timeout); - if (timeout <= 0) - return timeout; - -- return drm_sched_entity_flush(&vm->delayed, timeout); -+ return dma_fence_wait_timeout(vm->last_unlocked, true, timeout); - } - - /** -diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c -index 584cd5277f9272..e2dd7d4361cf31 100644 ---- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c -@@ -1459,17 +1459,12 @@ static int dce_v10_0_audio_init(struct amdgpu_device *adev) - - static void dce_v10_0_audio_fini(struct amdgpu_device *adev) - { -- int i; -- - if (!amdgpu_audio) - return; - - if (!adev->mode_info.audio.enabled) - return; - -- for (i = 0; i < adev->mode_info.audio.num_pins; i++) -- dce_v10_0_audio_enable(adev, &adev->mode_info.audio.pin[i], false); -- - adev->mode_info.audio.enabled = false; - } - -diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c -index c14b70350a51ae..7ce89654e12b42 100644 ---- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c -@@ -1508,17 +1508,12 @@ static int dce_v11_0_audio_init(struct amdgpu_device *adev) - - static void dce_v11_0_audio_fini(struct amdgpu_device *adev) - { -- int i; -- - if (!amdgpu_audio) - return; - - if (!adev->mode_info.audio.enabled) - return; - -- for (i = 0; i < adev->mode_info.audio.num_pins; i++) -- dce_v11_0_audio_enable(adev, &adev->mode_info.audio.pin[i], false); -- - adev->mode_info.audio.enabled = false; - } - -diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c -index 7f85ba5b726f68..c3d05ab7b12ff1 100644 ---- a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c -@@ -1377,17 +1377,12 @@ static int dce_v6_0_audio_init(struct amdgpu_device *adev) - - static void dce_v6_0_audio_fini(struct amdgpu_device *adev) - { -- int i; -- - if (!amdgpu_audio) - return; - - if (!adev->mode_info.audio.enabled) - return; - -- for (i = 0; i < adev->mode_info.audio.num_pins; i++) -- dce_v6_0_audio_enable(adev, &adev->mode_info.audio.pin[i], false); -- - adev->mode_info.audio.enabled = false; - } - -diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c -index f2b3cb5ed6bec2..ce2300c3c36b40 100644 ---- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c -@@ -1426,17 +1426,12 @@ static int dce_v8_0_audio_init(struct amdgpu_device *adev) - - static void dce_v8_0_audio_fini(struct amdgpu_device *adev) - { -- int i; -- - if (!amdgpu_audio) - return; - - if (!adev->mode_info.audio.enabled) - return; - -- for (i = 0; i < adev->mode_info.audio.num_pins; i++) -- dce_v8_0_audio_enable(adev, &adev->mode_info.audio.pin[i], false); -- - adev->mode_info.audio.enabled = false; - } - -diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c -index 136bd93c3b6554..0a33f8f117e921 100644 ---- a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c -+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c -@@ -896,13 +896,13 @@ void dce110_link_encoder_construct( - enc110->base.id, &bp_cap_info); - - /* Override features with DCE-specific values */ -- if (BP_RESULT_OK == result) { -+ if (result == BP_RESULT_OK) { - enc110->base.features.flags.bits.IS_HBR2_CAPABLE = - bp_cap_info.DP_HBR2_EN; - enc110->base.features.flags.bits.IS_HBR3_CAPABLE = - bp_cap_info.DP_HBR3_EN; - enc110->base.features.flags.bits.HDMI_6GB_EN = bp_cap_info.HDMI_6GB_EN; -- } else { -+ } else if (result != BP_RESULT_NORECORD) { - DC_LOG_WARNING("%s: Failed to get encoder_cap_info from VBIOS with error code %d!\n", - __func__, - result); -@@ -1795,13 +1795,13 @@ void dce60_link_encoder_construct( - enc110->base.id, &bp_cap_info); - - /* Override features with DCE-specific values */ -- if (BP_RESULT_OK == result) { -+ if (result == BP_RESULT_OK) { - enc110->base.features.flags.bits.IS_HBR2_CAPABLE = - bp_cap_info.DP_HBR2_EN; - enc110->base.features.flags.bits.IS_HBR3_CAPABLE = - bp_cap_info.DP_HBR3_EN; - enc110->base.features.flags.bits.HDMI_6GB_EN = bp_cap_info.HDMI_6GB_EN; -- } else { -+ } else if (result != BP_RESULT_NORECORD) { - DC_LOG_WARNING("%s: Failed to get encoder_cap_info from VBIOS with error code %d!\n", - __func__, - result); -diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c -index 59cbff209acd6e..560935f2e8cbe1 100644 ---- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c -+++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c -@@ -375,6 +375,17 @@ static int __maybe_unused ti_sn65dsi86_resume(struct device *dev) - - gpiod_set_value_cansleep(pdata->enable_gpio, 1); - -+ /* -+ * After EN is deasserted and an external clock is detected, the bridge -+ * will sample GPIO3:1 to determine its frequency. The driver will -+ * overwrite this setting in ti_sn_bridge_set_refclk_freq(). But this is -+ * racy. Thus we have to wait a couple of us. According to the datasheet -+ * the GPIO lines has to be stable at least 5 us (td5) but it seems that -+ * is not enough and the refclk frequency value is still lost or -+ * overwritten by the bridge itself. Waiting for 20us seems to work. -+ */ -+ usleep_range(20, 30); -+ - /* - * If we have a reference clock we can enable communication w/ the - * panel (including the aux channel) w/out any need for an input clock -diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c -index ef4fa70119de1a..bfa1070a5f08e2 100644 ---- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c -+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c -@@ -352,6 +352,7 @@ static bool mtk_drm_get_all_drm_priv(struct device *dev) - { - struct mtk_drm_private *drm_priv = dev_get_drvdata(dev); - struct mtk_drm_private *all_drm_priv[MAX_CRTC]; -+ struct mtk_drm_private *temp_drm_priv; - struct device_node *phandle = dev->parent->of_node; - const struct of_device_id *of_id; - struct device_node *node; -@@ -364,24 +365,41 @@ static bool mtk_drm_get_all_drm_priv(struct device *dev) - - of_id = of_match_node(mtk_drm_of_ids, node); - if (!of_id) -- continue; -+ goto next_put_node; - - pdev = of_find_device_by_node(node); - if (!pdev) -- continue; -+ goto next_put_node; - - drm_dev = device_find_child(&pdev->dev, NULL, mtk_drm_match); -- if (!drm_dev || !dev_get_drvdata(drm_dev)) -- continue; -+ if (!drm_dev) -+ goto next_put_device_pdev_dev; -+ -+ temp_drm_priv = dev_get_drvdata(drm_dev); -+ if (!temp_drm_priv) -+ goto next_put_device_drm_dev; -+ -+ if (temp_drm_priv->data->main_len) -+ all_drm_priv[CRTC_MAIN] = temp_drm_priv; -+ else if (temp_drm_priv->data->ext_len) -+ all_drm_priv[CRTC_EXT] = temp_drm_priv; -+ else if (temp_drm_priv->data->third_len) -+ all_drm_priv[CRTC_THIRD] = temp_drm_priv; - -- all_drm_priv[cnt] = dev_get_drvdata(drm_dev); -- if (all_drm_priv[cnt] && all_drm_priv[cnt]->mtk_drm_bound) -+ if (temp_drm_priv->mtk_drm_bound) - cnt++; - -- if (cnt == MAX_CRTC) { -- of_node_put(node); -+next_put_device_drm_dev: -+ put_device(drm_dev); -+ -+next_put_device_pdev_dev: -+ put_device(&pdev->dev); -+ -+next_put_node: -+ of_node_put(node); -+ -+ if (cnt == MAX_CRTC) - break; -- } - } - - if (drm_priv->data->mmsys_dev_num == cnt) { -@@ -475,21 +493,21 @@ static int mtk_drm_kms_init(struct drm_device *drm) - for (j = 0; j < private->data->mmsys_dev_num; j++) { - priv_n = private->all_drm_private[j]; - -- if (i == 0 && priv_n->data->main_len) { -+ if (i == CRTC_MAIN && priv_n->data->main_len) { - ret = mtk_drm_crtc_create(drm, priv_n->data->main_path, - priv_n->data->main_len, j); - if (ret) - goto err_component_unbind; - - continue; -- } else if (i == 1 && priv_n->data->ext_len) { -+ } else if (i == CRTC_EXT && priv_n->data->ext_len) { - ret = mtk_drm_crtc_create(drm, priv_n->data->ext_path, - priv_n->data->ext_len, j); - if (ret) - goto err_component_unbind; - - continue; -- } else if (i == 2 && priv_n->data->third_len) { -+ } else if (i == CRTC_THIRD && priv_n->data->third_len) { - ret = mtk_drm_crtc_create(drm, priv_n->data->third_path, - priv_n->data->third_len, j); - if (ret) -diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.h b/drivers/gpu/drm/mediatek/mtk_drm_drv.h -index eb2fd45941f09d..f4de8bb2768503 100644 ---- a/drivers/gpu/drm/mediatek/mtk_drm_drv.h -+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.h -@@ -9,11 +9,17 @@ - #include - #include "mtk_drm_ddp_comp.h" - --#define MAX_CRTC 3 - #define MAX_CONNECTOR 2 - #define DDP_COMPONENT_DRM_OVL_ADAPTOR (DDP_COMPONENT_ID_MAX + 1) - #define DDP_COMPONENT_DRM_ID_MAX (DDP_COMPONENT_DRM_OVL_ADAPTOR + 1) - -+enum mtk_drm_crtc_path { -+ CRTC_MAIN, -+ CRTC_EXT, -+ CRTC_THIRD, -+ MAX_CRTC, -+}; -+ - struct device; - struct device_node; - struct drm_crtc; -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/base.c -index 5db37247dc29b2..572c54a3709139 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/base.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/base.c -@@ -348,6 +348,8 @@ nvkm_fifo_dtor(struct nvkm_engine *engine) - nvkm_chid_unref(&fifo->chid); - - nvkm_event_fini(&fifo->nonstall.event); -+ if (fifo->func->nonstall_dtor) -+ fifo->func->nonstall_dtor(fifo); - mutex_destroy(&fifo->mutex); - return fifo; - } -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c -index c56d2a839efbaf..686a2c9fec46d8 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c -@@ -516,19 +516,11 @@ ga100_fifo_nonstall_intr(struct nvkm_inth *inth) - static void - ga100_fifo_nonstall_block(struct nvkm_event *event, int type, int index) - { -- struct nvkm_fifo *fifo = container_of(event, typeof(*fifo), nonstall.event); -- struct nvkm_runl *runl = nvkm_runl_get(fifo, index, 0); -- -- nvkm_inth_block(&runl->nonstall.inth); - } - - static void - ga100_fifo_nonstall_allow(struct nvkm_event *event, int type, int index) - { -- struct nvkm_fifo *fifo = container_of(event, typeof(*fifo), nonstall.event); -- struct nvkm_runl *runl = nvkm_runl_get(fifo, index, 0); -- -- nvkm_inth_allow(&runl->nonstall.inth); - } - - const struct nvkm_event_func -@@ -559,12 +551,26 @@ ga100_fifo_nonstall_ctor(struct nvkm_fifo *fifo) - if (ret) - return ret; - -+ nvkm_inth_allow(&runl->nonstall.inth); -+ - nr = max(nr, runl->id + 1); - } - - return nr; - } - -+void -+ga100_fifo_nonstall_dtor(struct nvkm_fifo *fifo) -+{ -+ struct nvkm_runl *runl; -+ -+ nvkm_runl_foreach(runl, fifo) { -+ if (runl->nonstall.vector < 0) -+ continue; -+ nvkm_inth_block(&runl->nonstall.inth); -+ } -+} -+ - int - ga100_fifo_runl_ctor(struct nvkm_fifo *fifo) - { -@@ -594,6 +600,7 @@ ga100_fifo = { - .runl_ctor = ga100_fifo_runl_ctor, - .mmu_fault = &tu102_fifo_mmu_fault, - .nonstall_ctor = ga100_fifo_nonstall_ctor, -+ .nonstall_dtor = ga100_fifo_nonstall_dtor, - .nonstall = &ga100_fifo_nonstall, - .runl = &ga100_runl, - .runq = &ga100_runq, -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c -index 2cdf5da339b60b..dccf38101fd9e7 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c -@@ -28,6 +28,7 @@ ga102_fifo = { - .runl_ctor = ga100_fifo_runl_ctor, - .mmu_fault = &tu102_fifo_mmu_fault, - .nonstall_ctor = ga100_fifo_nonstall_ctor, -+ .nonstall_dtor = ga100_fifo_nonstall_dtor, - .nonstall = &ga100_fifo_nonstall, - .runl = &ga100_runl, - .runq = &ga100_runq, -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/priv.h b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/priv.h -index 4d448be19224a8..b4ccf6b8bd21a1 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/priv.h -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/priv.h -@@ -38,6 +38,7 @@ struct nvkm_fifo_func { - void (*start)(struct nvkm_fifo *, unsigned long *); - - int (*nonstall_ctor)(struct nvkm_fifo *); -+ void (*nonstall_dtor)(struct nvkm_fifo *); - const struct nvkm_event_func *nonstall; - - const struct nvkm_runl_func *runl; -@@ -194,6 +195,7 @@ extern const struct nvkm_fifo_func_mmu_fault tu102_fifo_mmu_fault; - - int ga100_fifo_runl_ctor(struct nvkm_fifo *); - int ga100_fifo_nonstall_ctor(struct nvkm_fifo *); -+void ga100_fifo_nonstall_dtor(struct nvkm_fifo *); - extern const struct nvkm_event_func ga100_fifo_nonstall; - extern const struct nvkm_runl_func ga100_runl; - extern const struct nvkm_runq_func ga100_runq; -diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c -index a5f89aab3fb4d2..c25a54d5b39ad5 100644 ---- a/drivers/hwmon/mlxreg-fan.c -+++ b/drivers/hwmon/mlxreg-fan.c -@@ -561,15 +561,14 @@ static int mlxreg_fan_cooling_config(struct device *dev, struct mlxreg_fan *fan) - if (!pwm->connected) - continue; - pwm->fan = fan; -+ /* Set minimal PWM speed. */ -+ pwm->last_hwmon_state = MLXREG_FAN_PWM_DUTY2STATE(MLXREG_FAN_MIN_DUTY); - pwm->cdev = devm_thermal_of_cooling_device_register(dev, NULL, mlxreg_fan_name[i], - pwm, &mlxreg_fan_cooling_ops); - if (IS_ERR(pwm->cdev)) { - dev_err(dev, "Failed to register cooling device\n"); - return PTR_ERR(pwm->cdev); - } -- -- /* Set minimal PWM speed. */ -- pwm->last_hwmon_state = MLXREG_FAN_PWM_DUTY2STATE(MLXREG_FAN_MIN_DUTY); - } - - return 0; -diff --git a/drivers/iio/chemical/pms7003.c b/drivers/iio/chemical/pms7003.c -index e9857d93b307e4..70c92cbfc9f141 100644 ---- a/drivers/iio/chemical/pms7003.c -+++ b/drivers/iio/chemical/pms7003.c -@@ -5,7 +5,6 @@ - * Copyright (c) Tomasz Duszynski - */ - --#include - #include - #include - #include -@@ -19,6 +18,8 @@ - #include - #include - #include -+#include -+#include - - #define PMS7003_DRIVER_NAME "pms7003" - -@@ -76,7 +77,7 @@ struct pms7003_state { - /* Used to construct scan to push to the IIO buffer */ - struct { - u16 data[3]; /* PM1, PM2P5, PM10 */ -- s64 ts; -+ aligned_s64 ts; - } scan; - }; - -diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c -index d4f9b5d8d28d6d..ace3ce4faea73a 100644 ---- a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c -+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c -@@ -52,7 +52,7 @@ irqreturn_t inv_mpu6050_read_fifo(int irq, void *p) - u16 fifo_count; - u32 fifo_period; - s64 timestamp; -- u8 data[INV_MPU6050_OUTPUT_DATA_SIZE]; -+ u8 data[INV_MPU6050_OUTPUT_DATA_SIZE] __aligned(8); - int int_status; - size_t i, nb; - -diff --git a/drivers/iio/light/opt3001.c b/drivers/iio/light/opt3001.c -index dc529cbe3805e2..25a45c4251fbd0 100644 ---- a/drivers/iio/light/opt3001.c -+++ b/drivers/iio/light/opt3001.c -@@ -692,8 +692,9 @@ static irqreturn_t opt3001_irq(int irq, void *_iio) - struct opt3001 *opt = iio_priv(iio); - int ret; - bool wake_result_ready_queue = false; -+ bool ok_to_ignore_lock = opt->ok_to_ignore_lock; - -- if (!opt->ok_to_ignore_lock) -+ if (!ok_to_ignore_lock) - mutex_lock(&opt->lock); - - ret = i2c_smbus_read_word_swapped(opt->client, OPT3001_CONFIGURATION); -@@ -730,7 +731,7 @@ static irqreturn_t opt3001_irq(int irq, void *_iio) - } - - out: -- if (!opt->ok_to_ignore_lock) -+ if (!ok_to_ignore_lock) - mutex_unlock(&opt->lock); - - if (wake_result_ready_queue) -diff --git a/drivers/iio/pressure/mprls0025pa.c b/drivers/iio/pressure/mprls0025pa.c -index e3f0de020a40c9..829c472812e49b 100644 ---- a/drivers/iio/pressure/mprls0025pa.c -+++ b/drivers/iio/pressure/mprls0025pa.c -@@ -87,11 +87,6 @@ static const struct mpr_func_spec mpr_func_spec[] = { - [MPR_FUNCTION_C] = {.output_min = 3355443, .output_max = 13421773}, - }; - --struct mpr_chan { -- s32 pres; /* pressure value */ -- s64 ts; /* timestamp */ --}; -- - struct mpr_data { - struct i2c_client *client; - struct mutex lock; /* -@@ -120,7 +115,10 @@ struct mpr_data { - * loop until data is ready - */ - struct completion completion; /* handshake from irq to read */ -- struct mpr_chan chan; /* -+ struct { -+ s32 pres; /* pressure value */ -+ aligned_s64 ts; /* timestamp */ -+ } chan; /* - * channel values for buffered - * mode - */ -diff --git a/drivers/isdn/mISDN/dsp_hwec.c b/drivers/isdn/mISDN/dsp_hwec.c -index 0b3f29195330ac..0cd216e28f0090 100644 ---- a/drivers/isdn/mISDN/dsp_hwec.c -+++ b/drivers/isdn/mISDN/dsp_hwec.c -@@ -51,14 +51,14 @@ void dsp_hwec_enable(struct dsp *dsp, const char *arg) - goto _do; - - { -- char *dup, *tok, *name, *val; -+ char *dup, *next, *tok, *name, *val; - int tmp; - -- dup = kstrdup(arg, GFP_ATOMIC); -+ dup = next = kstrdup(arg, GFP_ATOMIC); - if (!dup) - return; - -- while ((tok = strsep(&dup, ","))) { -+ while ((tok = strsep(&next, ","))) { - if (!strlen(tok)) - continue; - name = strsep(&tok, "="); -diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c -index 534e7f7bca4c2f..b836ab2a649a2b 100644 ---- a/drivers/net/ethernet/cadence/macb_main.c -+++ b/drivers/net/ethernet/cadence/macb_main.c -@@ -1234,11 +1234,12 @@ static int macb_tx_complete(struct macb_queue *queue, int budget) - { - struct macb *bp = queue->bp; - u16 queue_index = queue - bp->queues; -+ unsigned long flags; - unsigned int tail; - unsigned int head; - int packets = 0; - -- spin_lock(&queue->tx_ptr_lock); -+ spin_lock_irqsave(&queue->tx_ptr_lock, flags); - head = queue->tx_head; - for (tail = queue->tx_tail; tail != head && packets < budget; tail++) { - struct macb_tx_skb *tx_skb; -@@ -1297,7 +1298,7 @@ static int macb_tx_complete(struct macb_queue *queue, int budget) - CIRC_CNT(queue->tx_head, queue->tx_tail, - bp->tx_ring_size) <= MACB_TX_WAKEUP_THRESH(bp)) - netif_wake_subqueue(bp->dev, queue_index); -- spin_unlock(&queue->tx_ptr_lock); -+ spin_unlock_irqrestore(&queue->tx_ptr_lock, flags); - - return packets; - } -@@ -1713,8 +1714,9 @@ static void macb_tx_restart(struct macb_queue *queue) - { - struct macb *bp = queue->bp; - unsigned int head_idx, tbqp; -+ unsigned long flags; - -- spin_lock(&queue->tx_ptr_lock); -+ spin_lock_irqsave(&queue->tx_ptr_lock, flags); - - if (queue->tx_head == queue->tx_tail) - goto out_tx_ptr_unlock; -@@ -1726,19 +1728,20 @@ static void macb_tx_restart(struct macb_queue *queue) - if (tbqp == head_idx) - goto out_tx_ptr_unlock; - -- spin_lock_irq(&bp->lock); -+ spin_lock(&bp->lock); - macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(TSTART)); -- spin_unlock_irq(&bp->lock); -+ spin_unlock(&bp->lock); - - out_tx_ptr_unlock: -- spin_unlock(&queue->tx_ptr_lock); -+ spin_unlock_irqrestore(&queue->tx_ptr_lock, flags); - } - - static bool macb_tx_complete_pending(struct macb_queue *queue) - { - bool retval = false; -+ unsigned long flags; - -- spin_lock(&queue->tx_ptr_lock); -+ spin_lock_irqsave(&queue->tx_ptr_lock, flags); - if (queue->tx_head != queue->tx_tail) { - /* Make hw descriptor updates visible to CPU */ - rmb(); -@@ -1746,7 +1749,7 @@ static bool macb_tx_complete_pending(struct macb_queue *queue) - if (macb_tx_desc(queue, queue->tx_tail)->ctrl & MACB_BIT(TX_USED)) - retval = true; - } -- spin_unlock(&queue->tx_ptr_lock); -+ spin_unlock_irqrestore(&queue->tx_ptr_lock, flags); - return retval; - } - -@@ -2314,6 +2317,7 @@ static netdev_tx_t macb_start_xmit(struct sk_buff *skb, struct net_device *dev) - struct macb_queue *queue = &bp->queues[queue_index]; - unsigned int desc_cnt, nr_frags, frag_size, f; - unsigned int hdrlen; -+ unsigned long flags; - bool is_lso; - netdev_tx_t ret = NETDEV_TX_OK; - -@@ -2374,7 +2378,7 @@ static netdev_tx_t macb_start_xmit(struct sk_buff *skb, struct net_device *dev) - desc_cnt += DIV_ROUND_UP(frag_size, bp->max_tx_length); - } - -- spin_lock_bh(&queue->tx_ptr_lock); -+ spin_lock_irqsave(&queue->tx_ptr_lock, flags); - - /* This is a hard error, log it. */ - if (CIRC_SPACE(queue->tx_head, queue->tx_tail, -@@ -2396,15 +2400,15 @@ static netdev_tx_t macb_start_xmit(struct sk_buff *skb, struct net_device *dev) - wmb(); - skb_tx_timestamp(skb); - -- spin_lock_irq(&bp->lock); -+ spin_lock(&bp->lock); - macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(TSTART)); -- spin_unlock_irq(&bp->lock); -+ spin_unlock(&bp->lock); - - if (CIRC_SPACE(queue->tx_head, queue->tx_tail, bp->tx_ring_size) < 1) - netif_stop_subqueue(dev, queue_index); - - unlock: -- spin_unlock_bh(&queue->tx_ptr_lock); -+ spin_unlock_irqrestore(&queue->tx_ptr_lock, flags); - - return ret; - } -diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c -index 087d4c2b3efd1a..a423a938821156 100644 ---- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c -+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c -@@ -1491,13 +1491,17 @@ static int bgx_init_of_phy(struct bgx *bgx) - * this cortina phy, for which there is no driver - * support, ignore it. - */ -- if (phy_np && -- !of_device_is_compatible(phy_np, "cortina,cs4223-slice")) { -- /* Wait until the phy drivers are available */ -- pd = of_phy_find_device(phy_np); -- if (!pd) -- goto defer; -- bgx->lmac[lmac].phydev = pd; -+ if (phy_np) { -+ if (!of_device_is_compatible(phy_np, "cortina,cs4223-slice")) { -+ /* Wait until the phy drivers are available */ -+ pd = of_phy_find_device(phy_np); -+ if (!pd) { -+ of_node_put(phy_np); -+ goto defer; -+ } -+ bgx->lmac[lmac].phydev = pd; -+ } -+ of_node_put(phy_np); - } - - lmac++; -@@ -1513,11 +1517,11 @@ static int bgx_init_of_phy(struct bgx *bgx) - * for phy devices we may have already found. - */ - while (lmac) { -+ lmac--; - if (bgx->lmac[lmac].phydev) { - put_device(&bgx->lmac[lmac].phydev->mdio.dev); - bgx->lmac[lmac].phydev = NULL; - } -- lmac--; - } - of_node_put(node); - return -EPROBE_DEFER; -diff --git a/drivers/net/ethernet/intel/e1000e/ethtool.c b/drivers/net/ethernet/intel/e1000e/ethtool.c -index fc0f98ea61332f..a1abc51584a183 100644 ---- a/drivers/net/ethernet/intel/e1000e/ethtool.c -+++ b/drivers/net/ethernet/intel/e1000e/ethtool.c -@@ -567,12 +567,12 @@ static int e1000_set_eeprom(struct net_device *netdev, - { - struct e1000_adapter *adapter = netdev_priv(netdev); - struct e1000_hw *hw = &adapter->hw; -+ size_t total_len, max_len; - u16 *eeprom_buff; -- void *ptr; -- int max_len; -+ int ret_val = 0; - int first_word; - int last_word; -- int ret_val = 0; -+ void *ptr; - u16 i; - - if (eeprom->len == 0) -@@ -587,6 +587,10 @@ static int e1000_set_eeprom(struct net_device *netdev, - - max_len = hw->nvm.word_size * 2; - -+ if (check_add_overflow(eeprom->offset, eeprom->len, &total_len) || -+ total_len > max_len) -+ return -EFBIG; -+ - first_word = eeprom->offset >> 1; - last_word = (eeprom->offset + eeprom->len - 1) >> 1; - eeprom_buff = kmalloc(max_len, GFP_KERNEL); -diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.c b/drivers/net/ethernet/intel/i40e/i40e_client.c -index 306758428aefd7..a569d2fcc90af4 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_client.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_client.c -@@ -361,8 +361,8 @@ static void i40e_client_add_instance(struct i40e_pf *pf) - if (i40e_client_get_params(vsi, &cdev->lan_info.params)) - goto free_cdev; - -- mac = list_first_entry(&cdev->lan_info.netdev->dev_addrs.list, -- struct netdev_hw_addr, list); -+ mac = list_first_entry_or_null(&cdev->lan_info.netdev->dev_addrs.list, -+ struct netdev_hw_addr, list); - if (mac) - ether_addr_copy(cdev->lan_info.lanmac, mac->addr); - else -diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c -index cb8efc952dfda9..aefe2af6f01d41 100644 ---- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c -+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c -@@ -1586,6 +1586,13 @@ static netdev_tx_t mtk_start_xmit(struct sk_buff *skb, struct net_device *dev) - bool gso = false; - int tx_num; - -+ if (skb_vlan_tag_present(skb) && -+ !eth_proto_is_802_3(eth_hdr(skb)->h_proto)) { -+ skb = __vlan_hwaccel_push_inside(skb); -+ if (!skb) -+ goto dropped; -+ } -+ - /* normally we can rely on the stack not calling this more than once, - * however we have 2 queues running on the same ring so we need to lock - * the ring access -@@ -1631,8 +1638,9 @@ static netdev_tx_t mtk_start_xmit(struct sk_buff *skb, struct net_device *dev) - - drop: - spin_unlock(ð->page_lock); -- stats->tx_dropped++; - dev_kfree_skb_any(skb); -+dropped: -+ stats->tx_dropped++; - return NETDEV_TX_OK; - } - -diff --git a/drivers/net/ethernet/xircom/xirc2ps_cs.c b/drivers/net/ethernet/xircom/xirc2ps_cs.c -index 9f505cf02d9651..2dc1cfcd7ce99b 100644 ---- a/drivers/net/ethernet/xircom/xirc2ps_cs.c -+++ b/drivers/net/ethernet/xircom/xirc2ps_cs.c -@@ -1578,7 +1578,7 @@ do_reset(struct net_device *dev, int full) - msleep(40); /* wait 40 msec to let it complete */ - } - if (full_duplex) -- PutByte(XIRCREG1_ECR, GetByte(XIRCREG1_ECR | FullDuplex)); -+ PutByte(XIRCREG1_ECR, GetByte(XIRCREG1_ECR) | FullDuplex); - } else { /* No MII */ - SelectPage(0); - value = GetByte(XIRCREG_ESR); /* read the ESR */ -diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c -index 767053d6c6b6f9..af6cc3e90ef7ce 100644 ---- a/drivers/net/macsec.c -+++ b/drivers/net/macsec.c -@@ -1840,7 +1840,7 @@ static int macsec_add_rxsa(struct sk_buff *skb, struct genl_info *info) - - if (tb_sa[MACSEC_SA_ATTR_PN]) { - spin_lock_bh(&rx_sa->lock); -- rx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]); -+ rx_sa->next_pn = nla_get_uint(tb_sa[MACSEC_SA_ATTR_PN]); - spin_unlock_bh(&rx_sa->lock); - } - -@@ -2082,7 +2082,7 @@ static int macsec_add_txsa(struct sk_buff *skb, struct genl_info *info) - } - - spin_lock_bh(&tx_sa->lock); -- tx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]); -+ tx_sa->next_pn = nla_get_uint(tb_sa[MACSEC_SA_ATTR_PN]); - spin_unlock_bh(&tx_sa->lock); - - if (tb_sa[MACSEC_SA_ATTR_ACTIVE]) -@@ -2394,7 +2394,7 @@ static int macsec_upd_txsa(struct sk_buff *skb, struct genl_info *info) - - spin_lock_bh(&tx_sa->lock); - prev_pn = tx_sa->next_pn_halves; -- tx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]); -+ tx_sa->next_pn = nla_get_uint(tb_sa[MACSEC_SA_ATTR_PN]); - spin_unlock_bh(&tx_sa->lock); - } - -@@ -2492,7 +2492,7 @@ static int macsec_upd_rxsa(struct sk_buff *skb, struct genl_info *info) - - spin_lock_bh(&rx_sa->lock); - prev_pn = rx_sa->next_pn_halves; -- rx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]); -+ rx_sa->next_pn = nla_get_uint(tb_sa[MACSEC_SA_ATTR_PN]); - spin_unlock_bh(&rx_sa->lock); - } - -diff --git a/drivers/net/pcs/pcs-rzn1-miic.c b/drivers/net/pcs/pcs-rzn1-miic.c -index 97139c07130fc9..b65682b8b6cd9a 100644 ---- a/drivers/net/pcs/pcs-rzn1-miic.c -+++ b/drivers/net/pcs/pcs-rzn1-miic.c -@@ -19,7 +19,7 @@ - #define MIIC_PRCMD 0x0 - #define MIIC_ESID_CODE 0x4 - --#define MIIC_MODCTRL 0x20 -+#define MIIC_MODCTRL 0x8 - #define MIIC_MODCTRL_SW_MODE GENMASK(4, 0) - - #define MIIC_CONVCTRL(port) (0x100 + (port) * 4) -diff --git a/drivers/net/phy/mscc/mscc_ptp.c b/drivers/net/phy/mscc/mscc_ptp.c -index 1f6237705b44b7..939a8a17595ef9 100644 ---- a/drivers/net/phy/mscc/mscc_ptp.c -+++ b/drivers/net/phy/mscc/mscc_ptp.c -@@ -455,12 +455,12 @@ static void vsc85xx_dequeue_skb(struct vsc85xx_ptp *ptp) - *p++ = (reg >> 24) & 0xff; - } - -- len = skb_queue_len(&ptp->tx_queue); -+ len = skb_queue_len_lockless(&ptp->tx_queue); - if (len < 1) - return; - - while (len--) { -- skb = __skb_dequeue(&ptp->tx_queue); -+ skb = skb_dequeue(&ptp->tx_queue); - if (!skb) - return; - -@@ -485,7 +485,7 @@ static void vsc85xx_dequeue_skb(struct vsc85xx_ptp *ptp) - * packet in the FIFO right now, reschedule it for later - * packets. - */ -- __skb_queue_tail(&ptp->tx_queue, skb); -+ skb_queue_tail(&ptp->tx_queue, skb); - } - } - -@@ -1067,6 +1067,7 @@ static int vsc85xx_hwtstamp(struct mii_timestamper *mii_ts, struct ifreq *ifr) - case HWTSTAMP_TX_ON: - break; - case HWTSTAMP_TX_OFF: -+ skb_queue_purge(&vsc8531->ptp->tx_queue); - break; - default: - return -ERANGE; -@@ -1091,9 +1092,6 @@ static int vsc85xx_hwtstamp(struct mii_timestamper *mii_ts, struct ifreq *ifr) - - mutex_lock(&vsc8531->ts_lock); - -- __skb_queue_purge(&vsc8531->ptp->tx_queue); -- __skb_queue_head_init(&vsc8531->ptp->tx_queue); -- - /* Disable predictor while configuring the 1588 block */ - val = vsc85xx_ts_read_csr(phydev, PROCESSOR, - MSCC_PHY_PTP_INGR_PREDICTOR); -@@ -1179,9 +1177,7 @@ static void vsc85xx_txtstamp(struct mii_timestamper *mii_ts, - - skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS; - -- mutex_lock(&vsc8531->ts_lock); -- __skb_queue_tail(&vsc8531->ptp->tx_queue, skb); -- mutex_unlock(&vsc8531->ts_lock); -+ skb_queue_tail(&vsc8531->ptp->tx_queue, skb); - return; - - out: -@@ -1547,6 +1543,7 @@ void vsc8584_ptp_deinit(struct phy_device *phydev) - if (vsc8531->ptp->ptp_clock) { - ptp_clock_unregister(vsc8531->ptp->ptp_clock); - skb_queue_purge(&vsc8531->rx_skbs_list); -+ skb_queue_purge(&vsc8531->ptp->tx_queue); - } - } - -@@ -1570,7 +1567,7 @@ irqreturn_t vsc8584_handle_ts_interrupt(struct phy_device *phydev) - if (rc & VSC85XX_1588_INT_FIFO_ADD) { - vsc85xx_get_tx_ts(priv->ptp); - } else if (rc & VSC85XX_1588_INT_FIFO_OVERFLOW) { -- __skb_queue_purge(&priv->ptp->tx_queue); -+ skb_queue_purge(&priv->ptp->tx_queue); - vsc85xx_ts_reset_fifo(phydev); - } - -@@ -1590,6 +1587,7 @@ int vsc8584_ptp_probe(struct phy_device *phydev) - mutex_init(&vsc8531->phc_lock); - mutex_init(&vsc8531->ts_lock); - skb_queue_head_init(&vsc8531->rx_skbs_list); -+ skb_queue_head_init(&vsc8531->ptp->tx_queue); - - /* Retrieve the shared load/save GPIO. Request it as non exclusive as - * the same GPIO can be requested by all the PHYs of the same package. -diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c -index 28b894bcd7a93d..46ac51217114bd 100644 ---- a/drivers/net/ppp/ppp_generic.c -+++ b/drivers/net/ppp/ppp_generic.c -@@ -1753,7 +1753,6 @@ pad_compress_skb(struct ppp *ppp, struct sk_buff *skb) - */ - if (net_ratelimit()) - netdev_err(ppp->dev, "ppp: compressor dropped pkt\n"); -- kfree_skb(skb); - consume_skb(new_skb); - new_skb = NULL; - } -@@ -1855,9 +1854,10 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb) - "down - pkt dropped.\n"); - goto drop; - } -- skb = pad_compress_skb(ppp, skb); -- if (!skb) -+ new_skb = pad_compress_skb(ppp, skb); -+ if (!new_skb) - goto drop; -+ skb = new_skb; - } - - /* -diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c -index d9792fd515a904..22554daaf6ff17 100644 ---- a/drivers/net/usb/cdc_ncm.c -+++ b/drivers/net/usb/cdc_ncm.c -@@ -2043,6 +2043,13 @@ static const struct usb_device_id cdc_devs[] = { - .driver_info = (unsigned long)&wwan_info, - }, - -+ /* Intel modem (label from OEM reads Fibocom L850-GL) */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x8087, 0x095a, -+ USB_CLASS_COMM, -+ USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE), -+ .driver_info = (unsigned long)&wwan_info, -+ }, -+ - /* DisplayLink docking stations */ - { .match_flags = USB_DEVICE_ID_MATCH_INT_INFO - | USB_DEVICE_ID_MATCH_VENDOR, -diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c -index afd78324f3aa39..6e4023791b4761 100644 ---- a/drivers/net/vmxnet3/vmxnet3_drv.c -+++ b/drivers/net/vmxnet3/vmxnet3_drv.c -@@ -3483,8 +3483,6 @@ vmxnet3_change_mtu(struct net_device *netdev, int new_mtu) - struct vmxnet3_adapter *adapter = netdev_priv(netdev); - int err = 0; - -- netdev->mtu = new_mtu; -- - /* - * Reset_work may be in the middle of resetting the device, wait for its - * completion. -@@ -3498,6 +3496,7 @@ vmxnet3_change_mtu(struct net_device *netdev, int new_mtu) - - /* we need to re-create the rx queue based on the new mtu */ - vmxnet3_rq_destroy_all(adapter); -+ netdev->mtu = new_mtu; - vmxnet3_adjust_rx_ring_size(adapter); - err = vmxnet3_rq_create_all(adapter); - if (err) { -@@ -3514,6 +3513,8 @@ vmxnet3_change_mtu(struct net_device *netdev, int new_mtu) - "Closing it\n", err); - goto out; - } -+ } else { -+ netdev->mtu = new_mtu; - } - - out: -diff --git a/drivers/net/wireless/ath/ath11k/core.h b/drivers/net/wireless/ath/ath11k/core.h -index 812a174f74c0b3..4bb36dc6ae08ba 100644 ---- a/drivers/net/wireless/ath/ath11k/core.h -+++ b/drivers/net/wireless/ath/ath11k/core.h -@@ -365,6 +365,8 @@ struct ath11k_vif { - struct ieee80211_chanctx_conf chanctx; - struct ath11k_arp_ns_offload arp_ns_offload; - struct ath11k_rekey_data rekey_data; -+ u32 num_stations; -+ bool reinstall_group_keys; - - #ifdef CONFIG_ATH11K_DEBUGFS - struct dentry *debugfs_twt; -@@ -1234,6 +1236,11 @@ static inline struct ath11k_vif *ath11k_vif_to_arvif(struct ieee80211_vif *vif) - return (struct ath11k_vif *)vif->drv_priv; - } - -+static inline struct ath11k_sta *ath11k_sta_to_arsta(struct ieee80211_sta *sta) -+{ -+ return (struct ath11k_sta *)sta->drv_priv; -+} -+ - static inline struct ath11k *ath11k_ab_to_ar(struct ath11k_base *ab, - int mac_id) - { -diff --git a/drivers/net/wireless/ath/ath11k/debugfs.c b/drivers/net/wireless/ath/ath11k/debugfs.c -index 50bc17127e68a3..4304fed44d5839 100644 ---- a/drivers/net/wireless/ath/ath11k/debugfs.c -+++ b/drivers/net/wireless/ath/ath11k/debugfs.c -@@ -1452,7 +1452,7 @@ static void ath11k_reset_peer_ps_duration(void *data, - struct ieee80211_sta *sta) - { - struct ath11k *ar = data; -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); - - spin_lock_bh(&ar->data_lock); - arsta->ps_total_duration = 0; -@@ -1503,7 +1503,7 @@ static void ath11k_peer_ps_state_disable(void *data, - struct ieee80211_sta *sta) - { - struct ath11k *ar = data; -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); - - spin_lock_bh(&ar->data_lock); - arsta->peer_ps_state = WMI_PEER_PS_STATE_DISABLED; -diff --git a/drivers/net/wireless/ath/ath11k/debugfs_sta.c b/drivers/net/wireless/ath/ath11k/debugfs_sta.c -index 168879a380cb2d..f56a24b6c8da21 100644 ---- a/drivers/net/wireless/ath/ath11k/debugfs_sta.c -+++ b/drivers/net/wireless/ath/ath11k/debugfs_sta.c -@@ -137,7 +137,7 @@ static ssize_t ath11k_dbg_sta_dump_tx_stats(struct file *file, - size_t count, loff_t *ppos) - { - struct ieee80211_sta *sta = file->private_data; -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); - struct ath11k *ar = arsta->arvif->ar; - struct ath11k_htt_data_stats *stats; - static const char *str_name[ATH11K_STATS_TYPE_MAX] = {"succ", "fail", -@@ -244,7 +244,7 @@ static ssize_t ath11k_dbg_sta_dump_rx_stats(struct file *file, - size_t count, loff_t *ppos) - { - struct ieee80211_sta *sta = file->private_data; -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); - struct ath11k *ar = arsta->arvif->ar; - struct ath11k_rx_peer_stats *rx_stats = arsta->rx_stats; - int len = 0, i, retval = 0; -@@ -341,7 +341,7 @@ static int - ath11k_dbg_sta_open_htt_peer_stats(struct inode *inode, struct file *file) - { - struct ieee80211_sta *sta = inode->i_private; -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); - struct ath11k *ar = arsta->arvif->ar; - struct debug_htt_stats_req *stats_req; - int type = ar->debug.htt_stats.type; -@@ -377,7 +377,7 @@ static int - ath11k_dbg_sta_release_htt_peer_stats(struct inode *inode, struct file *file) - { - struct ieee80211_sta *sta = inode->i_private; -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); - struct ath11k *ar = arsta->arvif->ar; - - mutex_lock(&ar->conf_mutex); -@@ -414,7 +414,7 @@ static ssize_t ath11k_dbg_sta_write_peer_pktlog(struct file *file, - size_t count, loff_t *ppos) - { - struct ieee80211_sta *sta = file->private_data; -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); - struct ath11k *ar = arsta->arvif->ar; - int ret, enable; - -@@ -454,7 +454,7 @@ static ssize_t ath11k_dbg_sta_read_peer_pktlog(struct file *file, - size_t count, loff_t *ppos) - { - struct ieee80211_sta *sta = file->private_data; -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); - struct ath11k *ar = arsta->arvif->ar; - char buf[32] = {0}; - int len; -@@ -481,7 +481,7 @@ static ssize_t ath11k_dbg_sta_write_delba(struct file *file, - size_t count, loff_t *ppos) - { - struct ieee80211_sta *sta = file->private_data; -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); - struct ath11k *ar = arsta->arvif->ar; - u32 tid, initiator, reason; - int ret; -@@ -532,7 +532,7 @@ static ssize_t ath11k_dbg_sta_write_addba_resp(struct file *file, - size_t count, loff_t *ppos) - { - struct ieee80211_sta *sta = file->private_data; -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); - struct ath11k *ar = arsta->arvif->ar; - u32 tid, status; - int ret; -@@ -582,7 +582,7 @@ static ssize_t ath11k_dbg_sta_write_addba(struct file *file, - size_t count, loff_t *ppos) - { - struct ieee80211_sta *sta = file->private_data; -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); - struct ath11k *ar = arsta->arvif->ar; - u32 tid, buf_size; - int ret; -@@ -633,7 +633,7 @@ static ssize_t ath11k_dbg_sta_read_aggr_mode(struct file *file, - size_t count, loff_t *ppos) - { - struct ieee80211_sta *sta = file->private_data; -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); - struct ath11k *ar = arsta->arvif->ar; - char buf[64]; - int len = 0; -@@ -653,7 +653,7 @@ static ssize_t ath11k_dbg_sta_write_aggr_mode(struct file *file, - size_t count, loff_t *ppos) - { - struct ieee80211_sta *sta = file->private_data; -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); - struct ath11k *ar = arsta->arvif->ar; - u32 aggr_mode; - int ret; -@@ -698,7 +698,7 @@ ath11k_write_htt_peer_stats_reset(struct file *file, - size_t count, loff_t *ppos) - { - struct ieee80211_sta *sta = file->private_data; -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); - struct ath11k *ar = arsta->arvif->ar; - struct htt_ext_stats_cfg_params cfg_params = { 0 }; - int ret; -@@ -757,7 +757,7 @@ static ssize_t ath11k_dbg_sta_read_peer_ps_state(struct file *file, - size_t count, loff_t *ppos) - { - struct ieee80211_sta *sta = file->private_data; -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); - struct ath11k *ar = arsta->arvif->ar; - char buf[20]; - int len; -@@ -784,7 +784,7 @@ static ssize_t ath11k_dbg_sta_read_current_ps_duration(struct file *file, - loff_t *ppos) - { - struct ieee80211_sta *sta = file->private_data; -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); - struct ath11k *ar = arsta->arvif->ar; - u64 time_since_station_in_power_save; - char buf[20]; -@@ -818,7 +818,7 @@ static ssize_t ath11k_dbg_sta_read_total_ps_duration(struct file *file, - size_t count, loff_t *ppos) - { - struct ieee80211_sta *sta = file->private_data; -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); - struct ath11k *ar = arsta->arvif->ar; - char buf[20]; - u64 power_save_duration; -diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c -index 33b9764eaa9167..8cc51ab699de78 100644 ---- a/drivers/net/wireless/ath/ath11k/dp_rx.c -+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c -@@ -1100,7 +1100,7 @@ int ath11k_dp_rx_ampdu_start(struct ath11k *ar, - struct ieee80211_ampdu_params *params) - { - struct ath11k_base *ab = ar->ab; -- struct ath11k_sta *arsta = (void *)params->sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(params->sta); - int vdev_id = arsta->arvif->vdev_id; - int ret; - -@@ -1118,7 +1118,7 @@ int ath11k_dp_rx_ampdu_stop(struct ath11k *ar, - { - struct ath11k_base *ab = ar->ab; - struct ath11k_peer *peer; -- struct ath11k_sta *arsta = (void *)params->sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(params->sta); - int vdev_id = arsta->arvif->vdev_id; - dma_addr_t paddr; - bool active; -@@ -1460,7 +1460,7 @@ ath11k_update_per_peer_tx_stats(struct ath11k *ar, - } - - sta = peer->sta; -- arsta = (struct ath11k_sta *)sta->drv_priv; -+ arsta = ath11k_sta_to_arsta(sta); - - memset(&arsta->txrate, 0, sizeof(arsta->txrate)); - -@@ -5269,7 +5269,7 @@ int ath11k_dp_rx_process_mon_status(struct ath11k_base *ab, int mac_id, - goto next_skb; - } - -- arsta = (struct ath11k_sta *)peer->sta->drv_priv; -+ arsta = ath11k_sta_to_arsta(peer->sta); - ath11k_dp_rx_update_peer_stats(arsta, ppdu_info); - - if (ath11k_debugfs_is_pktlog_peer_valid(ar, peer->addr)) -diff --git a/drivers/net/wireless/ath/ath11k/dp_tx.c b/drivers/net/wireless/ath/ath11k/dp_tx.c -index 7dd1ee58980177..c1072e66e3e8fd 100644 ---- a/drivers/net/wireless/ath/ath11k/dp_tx.c -+++ b/drivers/net/wireless/ath/ath11k/dp_tx.c -@@ -467,7 +467,7 @@ void ath11k_dp_tx_update_txcompl(struct ath11k *ar, struct hal_tx_status *ts) - } - - sta = peer->sta; -- arsta = (struct ath11k_sta *)sta->drv_priv; -+ arsta = ath11k_sta_to_arsta(sta); - - memset(&arsta->txrate, 0, sizeof(arsta->txrate)); - pkt_type = FIELD_GET(HAL_TX_RATE_STATS_INFO0_PKT_TYPE, -@@ -627,7 +627,7 @@ static void ath11k_dp_tx_complete_msdu(struct ath11k *ar, - ieee80211_free_txskb(ar->hw, msdu); - return; - } -- arsta = (struct ath11k_sta *)peer->sta->drv_priv; -+ arsta = ath11k_sta_to_arsta(peer->sta); - status.sta = peer->sta; - status.skb = msdu; - status.info = info; -diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c -index 9df3f6449f7689..2921be9bd530cf 100644 ---- a/drivers/net/wireless/ath/ath11k/mac.c -+++ b/drivers/net/wireless/ath/ath11k/mac.c -@@ -254,9 +254,6 @@ static const u32 ath11k_smps_map[] = { - [WLAN_HT_CAP_SM_PS_DISABLED] = WMI_PEER_SMPS_PS_NONE, - }; - --static int ath11k_start_vdev_delay(struct ieee80211_hw *hw, -- struct ieee80211_vif *vif); -- - enum nl80211_he_ru_alloc ath11k_mac_phy_he_ru_to_nl80211_he_ru_alloc(u16 ru_phy) - { - enum nl80211_he_ru_alloc ret; -@@ -2828,7 +2825,7 @@ static void ath11k_peer_assoc_prepare(struct ath11k *ar, - - lockdep_assert_held(&ar->conf_mutex); - -- arsta = (struct ath11k_sta *)sta->drv_priv; -+ arsta = ath11k_sta_to_arsta(sta); - - memset(arg, 0, sizeof(*arg)); - -@@ -4208,6 +4205,40 @@ static int ath11k_clear_peer_keys(struct ath11k_vif *arvif, - return first_errno; - } - -+static int ath11k_set_group_keys(struct ath11k_vif *arvif) -+{ -+ struct ath11k *ar = arvif->ar; -+ struct ath11k_base *ab = ar->ab; -+ const u8 *addr = arvif->bssid; -+ int i, ret, first_errno = 0; -+ struct ath11k_peer *peer; -+ -+ spin_lock_bh(&ab->base_lock); -+ peer = ath11k_peer_find(ab, arvif->vdev_id, addr); -+ spin_unlock_bh(&ab->base_lock); -+ -+ if (!peer) -+ return -ENOENT; -+ -+ for (i = 0; i < ARRAY_SIZE(peer->keys); i++) { -+ struct ieee80211_key_conf *key = peer->keys[i]; -+ -+ if (!key || (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) -+ continue; -+ -+ ret = ath11k_install_key(arvif, key, SET_KEY, addr, -+ WMI_KEY_GROUP); -+ if (ret < 0 && first_errno == 0) -+ first_errno = ret; -+ -+ if (ret < 0) -+ ath11k_warn(ab, "failed to set group key of idx %d for vdev %d: %d\n", -+ i, arvif->vdev_id, ret); -+ } -+ -+ return first_errno; -+} -+ - static int ath11k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, - struct ieee80211_vif *vif, struct ieee80211_sta *sta, - struct ieee80211_key_conf *key) -@@ -4217,6 +4248,7 @@ static int ath11k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, - struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif); - struct ath11k_peer *peer; - struct ath11k_sta *arsta; -+ bool is_ap_with_no_sta; - const u8 *peer_addr; - int ret = 0; - u32 flags = 0; -@@ -4277,16 +4309,57 @@ static int ath11k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, - else - flags |= WMI_KEY_GROUP; - -- ret = ath11k_install_key(arvif, key, cmd, peer_addr, flags); -- if (ret) { -- ath11k_warn(ab, "ath11k_install_key failed (%d)\n", ret); -- goto exit; -- } -+ ath11k_dbg(ar->ab, ATH11K_DBG_MAC, -+ "%s for peer %pM on vdev %d flags 0x%X, type = %d, num_sta %d\n", -+ cmd == SET_KEY ? "SET_KEY" : "DEL_KEY", peer_addr, arvif->vdev_id, -+ flags, arvif->vdev_type, arvif->num_stations); -+ -+ /* Allow group key clearing only in AP mode when no stations are -+ * associated. There is a known race condition in firmware where -+ * group addressed packets may be dropped if the key is cleared -+ * and immediately set again during rekey. -+ * -+ * During GTK rekey, mac80211 issues a clear key (if the old key -+ * exists) followed by an install key operation for same key -+ * index. This causes ath11k to send two WMI commands in quick -+ * succession: one to clear the old key and another to install the -+ * new key in the same slot. -+ * -+ * Under certain conditions—especially under high load or time -+ * sensitive scenarios, firmware may process these commands -+ * asynchronously in a way that firmware assumes the key is -+ * cleared whereas hardware has a valid key. This inconsistency -+ * between hardware and firmware leads to group addressed packet -+ * drops after rekey. -+ * Only setting the same key again can restore a valid key in -+ * firmware and allow packets to be transmitted. -+ * -+ * There is a use case where an AP can transition from Secure mode -+ * to open mode without a vdev restart by just deleting all -+ * associated peers and clearing key, Hence allow clear key for -+ * that case alone. Mark arvif->reinstall_group_keys in such cases -+ * and reinstall the same key when the first peer is added, -+ * allowing firmware to recover from the race if it had occurred. -+ */ - -- ret = ath11k_dp_peer_rx_pn_replay_config(arvif, peer_addr, cmd, key); -- if (ret) { -- ath11k_warn(ab, "failed to offload PN replay detection %d\n", ret); -- goto exit; -+ is_ap_with_no_sta = (vif->type == NL80211_IFTYPE_AP && -+ !arvif->num_stations); -+ if ((flags & WMI_KEY_PAIRWISE) || cmd == SET_KEY || is_ap_with_no_sta) { -+ ret = ath11k_install_key(arvif, key, cmd, peer_addr, flags); -+ if (ret) { -+ ath11k_warn(ab, "ath11k_install_key failed (%d)\n", ret); -+ goto exit; -+ } -+ -+ ret = ath11k_dp_peer_rx_pn_replay_config(arvif, peer_addr, cmd, key); -+ if (ret) { -+ ath11k_warn(ab, "failed to offload PN replay detection %d\n", -+ ret); -+ goto exit; -+ } -+ -+ if ((flags & WMI_KEY_GROUP) && cmd == SET_KEY && is_ap_with_no_sta) -+ arvif->reinstall_group_keys = true; - } - - spin_lock_bh(&ab->base_lock); -@@ -4311,7 +4384,7 @@ static int ath11k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, - ath11k_warn(ab, "peer %pM disappeared!\n", peer_addr); - - if (sta) { -- arsta = (struct ath11k_sta *)sta->drv_priv; -+ arsta = ath11k_sta_to_arsta(sta); - - switch (key->cipher) { - case WLAN_CIPHER_SUITE_TKIP: -@@ -4879,6 +4952,7 @@ static int ath11k_mac_inc_num_stations(struct ath11k_vif *arvif, - return -ENOBUFS; - - ar->num_stations++; -+ arvif->num_stations++; - - return 0; - } -@@ -4894,100 +4968,7 @@ static void ath11k_mac_dec_num_stations(struct ath11k_vif *arvif, - return; - - ar->num_stations--; --} -- --static int ath11k_mac_station_add(struct ath11k *ar, -- struct ieee80211_vif *vif, -- struct ieee80211_sta *sta) --{ -- struct ath11k_base *ab = ar->ab; -- struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif); -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -- struct peer_create_params peer_param; -- int ret; -- -- lockdep_assert_held(&ar->conf_mutex); -- -- ret = ath11k_mac_inc_num_stations(arvif, sta); -- if (ret) { -- ath11k_warn(ab, "refusing to associate station: too many connected already (%d)\n", -- ar->max_num_stations); -- goto exit; -- } -- -- arsta->rx_stats = kzalloc(sizeof(*arsta->rx_stats), GFP_KERNEL); -- if (!arsta->rx_stats) { -- ret = -ENOMEM; -- goto dec_num_station; -- } -- -- peer_param.vdev_id = arvif->vdev_id; -- peer_param.peer_addr = sta->addr; -- peer_param.peer_type = WMI_PEER_TYPE_DEFAULT; -- -- ret = ath11k_peer_create(ar, arvif, sta, &peer_param); -- if (ret) { -- ath11k_warn(ab, "Failed to add peer: %pM for VDEV: %d\n", -- sta->addr, arvif->vdev_id); -- goto free_rx_stats; -- } -- -- ath11k_dbg(ab, ATH11K_DBG_MAC, "Added peer: %pM for VDEV: %d\n", -- sta->addr, arvif->vdev_id); -- -- if (ath11k_debugfs_is_extd_tx_stats_enabled(ar)) { -- arsta->tx_stats = kzalloc(sizeof(*arsta->tx_stats), GFP_KERNEL); -- if (!arsta->tx_stats) { -- ret = -ENOMEM; -- goto free_peer; -- } -- } -- -- if (ieee80211_vif_is_mesh(vif)) { -- ath11k_dbg(ab, ATH11K_DBG_MAC, -- "setting USE_4ADDR for mesh STA %pM\n", sta->addr); -- ret = ath11k_wmi_set_peer_param(ar, sta->addr, -- arvif->vdev_id, -- WMI_PEER_USE_4ADDR, 1); -- if (ret) { -- ath11k_warn(ab, "failed to set mesh STA %pM 4addr capability: %d\n", -- sta->addr, ret); -- goto free_tx_stats; -- } -- } -- -- ret = ath11k_dp_peer_setup(ar, arvif->vdev_id, sta->addr); -- if (ret) { -- ath11k_warn(ab, "failed to setup dp for peer %pM on vdev %i (%d)\n", -- sta->addr, arvif->vdev_id, ret); -- goto free_tx_stats; -- } -- -- if (ab->hw_params.vdev_start_delay && -- !arvif->is_started && -- arvif->vdev_type != WMI_VDEV_TYPE_AP) { -- ret = ath11k_start_vdev_delay(ar->hw, vif); -- if (ret) { -- ath11k_warn(ab, "failed to delay vdev start: %d\n", ret); -- goto free_tx_stats; -- } -- } -- -- ewma_avg_rssi_init(&arsta->avg_rssi); -- return 0; -- --free_tx_stats: -- kfree(arsta->tx_stats); -- arsta->tx_stats = NULL; --free_peer: -- ath11k_peer_delete(ar, arvif->vdev_id, sta->addr); --free_rx_stats: -- kfree(arsta->rx_stats); -- arsta->rx_stats = NULL; --dec_num_station: -- ath11k_mac_dec_num_stations(arvif, sta); --exit: -- return ret; -+ arvif->num_stations--; - } - - static u32 ath11k_mac_ieee80211_sta_bw_to_wmi(struct ath11k *ar, -@@ -5018,140 +4999,6 @@ static u32 ath11k_mac_ieee80211_sta_bw_to_wmi(struct ath11k *ar, - return bw; - } - --static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw, -- struct ieee80211_vif *vif, -- struct ieee80211_sta *sta, -- enum ieee80211_sta_state old_state, -- enum ieee80211_sta_state new_state) --{ -- struct ath11k *ar = hw->priv; -- struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif); -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -- struct ath11k_peer *peer; -- int ret = 0; -- -- /* cancel must be done outside the mutex to avoid deadlock */ -- if ((old_state == IEEE80211_STA_NONE && -- new_state == IEEE80211_STA_NOTEXIST)) { -- cancel_work_sync(&arsta->update_wk); -- cancel_work_sync(&arsta->set_4addr_wk); -- } -- -- mutex_lock(&ar->conf_mutex); -- -- if (old_state == IEEE80211_STA_NOTEXIST && -- new_state == IEEE80211_STA_NONE) { -- memset(arsta, 0, sizeof(*arsta)); -- arsta->arvif = arvif; -- arsta->peer_ps_state = WMI_PEER_PS_STATE_DISABLED; -- INIT_WORK(&arsta->update_wk, ath11k_sta_rc_update_wk); -- INIT_WORK(&arsta->set_4addr_wk, ath11k_sta_set_4addr_wk); -- -- ret = ath11k_mac_station_add(ar, vif, sta); -- if (ret) -- ath11k_warn(ar->ab, "Failed to add station: %pM for VDEV: %d\n", -- sta->addr, arvif->vdev_id); -- } else if ((old_state == IEEE80211_STA_NONE && -- new_state == IEEE80211_STA_NOTEXIST)) { -- bool skip_peer_delete = ar->ab->hw_params.vdev_start_delay && -- vif->type == NL80211_IFTYPE_STATION; -- -- ath11k_dp_peer_cleanup(ar, arvif->vdev_id, sta->addr); -- -- if (!skip_peer_delete) { -- ret = ath11k_peer_delete(ar, arvif->vdev_id, sta->addr); -- if (ret) -- ath11k_warn(ar->ab, -- "Failed to delete peer: %pM for VDEV: %d\n", -- sta->addr, arvif->vdev_id); -- else -- ath11k_dbg(ar->ab, -- ATH11K_DBG_MAC, -- "Removed peer: %pM for VDEV: %d\n", -- sta->addr, arvif->vdev_id); -- } -- -- ath11k_mac_dec_num_stations(arvif, sta); -- mutex_lock(&ar->ab->tbl_mtx_lock); -- spin_lock_bh(&ar->ab->base_lock); -- peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr); -- if (skip_peer_delete && peer) { -- peer->sta = NULL; -- } else if (peer && peer->sta == sta) { -- ath11k_warn(ar->ab, "Found peer entry %pM n vdev %i after it was supposedly removed\n", -- vif->addr, arvif->vdev_id); -- ath11k_peer_rhash_delete(ar->ab, peer); -- peer->sta = NULL; -- list_del(&peer->list); -- kfree(peer); -- ar->num_peers--; -- } -- spin_unlock_bh(&ar->ab->base_lock); -- mutex_unlock(&ar->ab->tbl_mtx_lock); -- -- kfree(arsta->tx_stats); -- arsta->tx_stats = NULL; -- -- kfree(arsta->rx_stats); -- arsta->rx_stats = NULL; -- } else if (old_state == IEEE80211_STA_AUTH && -- new_state == IEEE80211_STA_ASSOC && -- (vif->type == NL80211_IFTYPE_AP || -- vif->type == NL80211_IFTYPE_MESH_POINT || -- vif->type == NL80211_IFTYPE_ADHOC)) { -- ret = ath11k_station_assoc(ar, vif, sta, false); -- if (ret) -- ath11k_warn(ar->ab, "Failed to associate station: %pM\n", -- sta->addr); -- -- spin_lock_bh(&ar->data_lock); -- /* Set arsta bw and prev bw */ -- arsta->bw = ath11k_mac_ieee80211_sta_bw_to_wmi(ar, sta); -- arsta->bw_prev = arsta->bw; -- spin_unlock_bh(&ar->data_lock); -- } else if (old_state == IEEE80211_STA_ASSOC && -- new_state == IEEE80211_STA_AUTHORIZED) { -- spin_lock_bh(&ar->ab->base_lock); -- -- peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr); -- if (peer) -- peer->is_authorized = true; -- -- spin_unlock_bh(&ar->ab->base_lock); -- -- if (vif->type == NL80211_IFTYPE_STATION && arvif->is_up) { -- ret = ath11k_wmi_set_peer_param(ar, sta->addr, -- arvif->vdev_id, -- WMI_PEER_AUTHORIZE, -- 1); -- if (ret) -- ath11k_warn(ar->ab, "Unable to authorize peer %pM vdev %d: %d\n", -- sta->addr, arvif->vdev_id, ret); -- } -- } else if (old_state == IEEE80211_STA_AUTHORIZED && -- new_state == IEEE80211_STA_ASSOC) { -- spin_lock_bh(&ar->ab->base_lock); -- -- peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr); -- if (peer) -- peer->is_authorized = false; -- -- spin_unlock_bh(&ar->ab->base_lock); -- } else if (old_state == IEEE80211_STA_ASSOC && -- new_state == IEEE80211_STA_AUTH && -- (vif->type == NL80211_IFTYPE_AP || -- vif->type == NL80211_IFTYPE_MESH_POINT || -- vif->type == NL80211_IFTYPE_ADHOC)) { -- ret = ath11k_station_disassoc(ar, vif, sta); -- if (ret) -- ath11k_warn(ar->ab, "Failed to disassociate station: %pM\n", -- sta->addr); -- } -- -- mutex_unlock(&ar->conf_mutex); -- return ret; --} -- - static int ath11k_mac_op_sta_set_txpwr(struct ieee80211_hw *hw, - struct ieee80211_vif *vif, - struct ieee80211_sta *sta) -@@ -5192,7 +5039,7 @@ static void ath11k_mac_op_sta_set_4addr(struct ieee80211_hw *hw, - struct ieee80211_sta *sta, bool enabled) - { - struct ath11k *ar = hw->priv; -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); - - if (enabled && !arsta->use_4addr_set) { - ieee80211_queue_work(ar->hw, &arsta->set_4addr_wk); -@@ -5206,7 +5053,7 @@ static void ath11k_mac_op_sta_rc_update(struct ieee80211_hw *hw, - u32 changed) - { - struct ath11k *ar = hw->priv; -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); - struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif); - struct ath11k_peer *peer; - u32 bw, smps; -@@ -6204,7 +6051,7 @@ static void ath11k_mac_op_tx(struct ieee80211_hw *hw, - } - - if (control->sta) -- arsta = (struct ath11k_sta *)control->sta->drv_priv; -+ arsta = ath11k_sta_to_arsta(control->sta); - - ret = ath11k_dp_tx(ar, arvif, arsta, skb); - if (unlikely(ret)) { -@@ -7546,8 +7393,8 @@ static void ath11k_mac_op_change_chanctx(struct ieee80211_hw *hw, - mutex_unlock(&ar->conf_mutex); - } - --static int ath11k_start_vdev_delay(struct ieee80211_hw *hw, -- struct ieee80211_vif *vif) -+static int ath11k_mac_start_vdev_delay(struct ieee80211_hw *hw, -+ struct ieee80211_vif *vif) - { - struct ath11k *ar = hw->priv; - struct ath11k_base *ab = ar->ab; -@@ -8228,7 +8075,7 @@ static void ath11k_mac_set_bitrate_mask_iter(void *data, - struct ieee80211_sta *sta) - { - struct ath11k_vif *arvif = data; -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); - struct ath11k *ar = arvif->ar; - - spin_lock_bh(&ar->data_lock); -@@ -8632,7 +8479,7 @@ static void ath11k_mac_op_sta_statistics(struct ieee80211_hw *hw, - struct ieee80211_sta *sta, - struct station_info *sinfo) - { -- struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv; -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); - struct ath11k *ar = arsta->arvif->ar; - s8 signal; - bool db2dbm = test_bit(WMI_TLV_SERVICE_HW_DB2DBM_CONVERSION_SUPPORT, -@@ -9099,6 +8946,249 @@ static int ath11k_mac_op_get_txpower(struct ieee80211_hw *hw, - return 0; - } - -+static int ath11k_mac_station_add(struct ath11k *ar, -+ struct ieee80211_vif *vif, -+ struct ieee80211_sta *sta) -+{ -+ struct ath11k_base *ab = ar->ab; -+ struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif); -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); -+ struct peer_create_params peer_param; -+ int ret; -+ -+ lockdep_assert_held(&ar->conf_mutex); -+ -+ ret = ath11k_mac_inc_num_stations(arvif, sta); -+ if (ret) { -+ ath11k_warn(ab, "refusing to associate station: too many connected already (%d)\n", -+ ar->max_num_stations); -+ goto exit; -+ } -+ -+ /* Driver allows the DEL KEY followed by SET KEY sequence for -+ * group keys for only when there is no clients associated, if at -+ * all firmware has entered the race during that window, -+ * reinstalling the same key when the first sta connects will allow -+ * firmware to recover from the race. -+ */ -+ if (arvif->num_stations == 1 && arvif->reinstall_group_keys) { -+ ath11k_dbg(ab, ATH11K_DBG_MAC, "set group keys on 1st station add for vdev %d\n", -+ arvif->vdev_id); -+ ret = ath11k_set_group_keys(arvif); -+ if (ret) -+ goto dec_num_station; -+ arvif->reinstall_group_keys = false; -+ } -+ -+ arsta->rx_stats = kzalloc(sizeof(*arsta->rx_stats), GFP_KERNEL); -+ if (!arsta->rx_stats) { -+ ret = -ENOMEM; -+ goto dec_num_station; -+ } -+ -+ peer_param.vdev_id = arvif->vdev_id; -+ peer_param.peer_addr = sta->addr; -+ peer_param.peer_type = WMI_PEER_TYPE_DEFAULT; -+ -+ ret = ath11k_peer_create(ar, arvif, sta, &peer_param); -+ if (ret) { -+ ath11k_warn(ab, "Failed to add peer: %pM for VDEV: %d\n", -+ sta->addr, arvif->vdev_id); -+ goto free_rx_stats; -+ } -+ -+ ath11k_dbg(ab, ATH11K_DBG_MAC, "Added peer: %pM for VDEV: %d\n", -+ sta->addr, arvif->vdev_id); -+ -+ if (ath11k_debugfs_is_extd_tx_stats_enabled(ar)) { -+ arsta->tx_stats = kzalloc(sizeof(*arsta->tx_stats), GFP_KERNEL); -+ if (!arsta->tx_stats) { -+ ret = -ENOMEM; -+ goto free_peer; -+ } -+ } -+ -+ if (ieee80211_vif_is_mesh(vif)) { -+ ath11k_dbg(ab, ATH11K_DBG_MAC, -+ "setting USE_4ADDR for mesh STA %pM\n", sta->addr); -+ ret = ath11k_wmi_set_peer_param(ar, sta->addr, -+ arvif->vdev_id, -+ WMI_PEER_USE_4ADDR, 1); -+ if (ret) { -+ ath11k_warn(ab, "failed to set mesh STA %pM 4addr capability: %d\n", -+ sta->addr, ret); -+ goto free_tx_stats; -+ } -+ } -+ -+ ret = ath11k_dp_peer_setup(ar, arvif->vdev_id, sta->addr); -+ if (ret) { -+ ath11k_warn(ab, "failed to setup dp for peer %pM on vdev %i (%d)\n", -+ sta->addr, arvif->vdev_id, ret); -+ goto free_tx_stats; -+ } -+ -+ if (ab->hw_params.vdev_start_delay && -+ !arvif->is_started && -+ arvif->vdev_type != WMI_VDEV_TYPE_AP) { -+ ret = ath11k_mac_start_vdev_delay(ar->hw, vif); -+ if (ret) { -+ ath11k_warn(ab, "failed to delay vdev start: %d\n", ret); -+ goto free_tx_stats; -+ } -+ } -+ -+ ewma_avg_rssi_init(&arsta->avg_rssi); -+ return 0; -+ -+free_tx_stats: -+ kfree(arsta->tx_stats); -+ arsta->tx_stats = NULL; -+free_peer: -+ ath11k_peer_delete(ar, arvif->vdev_id, sta->addr); -+free_rx_stats: -+ kfree(arsta->rx_stats); -+ arsta->rx_stats = NULL; -+dec_num_station: -+ ath11k_mac_dec_num_stations(arvif, sta); -+exit: -+ return ret; -+} -+ -+static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw, -+ struct ieee80211_vif *vif, -+ struct ieee80211_sta *sta, -+ enum ieee80211_sta_state old_state, -+ enum ieee80211_sta_state new_state) -+{ -+ struct ath11k *ar = hw->priv; -+ struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif); -+ struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta); -+ struct ath11k_peer *peer; -+ int ret = 0; -+ -+ /* cancel must be done outside the mutex to avoid deadlock */ -+ if ((old_state == IEEE80211_STA_NONE && -+ new_state == IEEE80211_STA_NOTEXIST)) { -+ cancel_work_sync(&arsta->update_wk); -+ cancel_work_sync(&arsta->set_4addr_wk); -+ } -+ -+ mutex_lock(&ar->conf_mutex); -+ -+ if (old_state == IEEE80211_STA_NOTEXIST && -+ new_state == IEEE80211_STA_NONE) { -+ memset(arsta, 0, sizeof(*arsta)); -+ arsta->arvif = arvif; -+ arsta->peer_ps_state = WMI_PEER_PS_STATE_DISABLED; -+ INIT_WORK(&arsta->update_wk, ath11k_sta_rc_update_wk); -+ INIT_WORK(&arsta->set_4addr_wk, ath11k_sta_set_4addr_wk); -+ -+ ret = ath11k_mac_station_add(ar, vif, sta); -+ if (ret) -+ ath11k_warn(ar->ab, "Failed to add station: %pM for VDEV: %d\n", -+ sta->addr, arvif->vdev_id); -+ } else if ((old_state == IEEE80211_STA_NONE && -+ new_state == IEEE80211_STA_NOTEXIST)) { -+ bool skip_peer_delete = ar->ab->hw_params.vdev_start_delay && -+ vif->type == NL80211_IFTYPE_STATION; -+ -+ ath11k_dp_peer_cleanup(ar, arvif->vdev_id, sta->addr); -+ -+ if (!skip_peer_delete) { -+ ret = ath11k_peer_delete(ar, arvif->vdev_id, sta->addr); -+ if (ret) -+ ath11k_warn(ar->ab, -+ "Failed to delete peer: %pM for VDEV: %d\n", -+ sta->addr, arvif->vdev_id); -+ else -+ ath11k_dbg(ar->ab, -+ ATH11K_DBG_MAC, -+ "Removed peer: %pM for VDEV: %d\n", -+ sta->addr, arvif->vdev_id); -+ } -+ -+ ath11k_mac_dec_num_stations(arvif, sta); -+ mutex_lock(&ar->ab->tbl_mtx_lock); -+ spin_lock_bh(&ar->ab->base_lock); -+ peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr); -+ if (skip_peer_delete && peer) { -+ peer->sta = NULL; -+ } else if (peer && peer->sta == sta) { -+ ath11k_warn(ar->ab, "Found peer entry %pM n vdev %i after it was supposedly removed\n", -+ vif->addr, arvif->vdev_id); -+ ath11k_peer_rhash_delete(ar->ab, peer); -+ peer->sta = NULL; -+ list_del(&peer->list); -+ kfree(peer); -+ ar->num_peers--; -+ } -+ spin_unlock_bh(&ar->ab->base_lock); -+ mutex_unlock(&ar->ab->tbl_mtx_lock); -+ -+ kfree(arsta->tx_stats); -+ arsta->tx_stats = NULL; -+ -+ kfree(arsta->rx_stats); -+ arsta->rx_stats = NULL; -+ } else if (old_state == IEEE80211_STA_AUTH && -+ new_state == IEEE80211_STA_ASSOC && -+ (vif->type == NL80211_IFTYPE_AP || -+ vif->type == NL80211_IFTYPE_MESH_POINT || -+ vif->type == NL80211_IFTYPE_ADHOC)) { -+ ret = ath11k_station_assoc(ar, vif, sta, false); -+ if (ret) -+ ath11k_warn(ar->ab, "Failed to associate station: %pM\n", -+ sta->addr); -+ -+ spin_lock_bh(&ar->data_lock); -+ /* Set arsta bw and prev bw */ -+ arsta->bw = ath11k_mac_ieee80211_sta_bw_to_wmi(ar, sta); -+ arsta->bw_prev = arsta->bw; -+ spin_unlock_bh(&ar->data_lock); -+ } else if (old_state == IEEE80211_STA_ASSOC && -+ new_state == IEEE80211_STA_AUTHORIZED) { -+ spin_lock_bh(&ar->ab->base_lock); -+ -+ peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr); -+ if (peer) -+ peer->is_authorized = true; -+ -+ spin_unlock_bh(&ar->ab->base_lock); -+ -+ if (vif->type == NL80211_IFTYPE_STATION && arvif->is_up) { -+ ret = ath11k_wmi_set_peer_param(ar, sta->addr, -+ arvif->vdev_id, -+ WMI_PEER_AUTHORIZE, -+ 1); -+ if (ret) -+ ath11k_warn(ar->ab, "Unable to authorize peer %pM vdev %d: %d\n", -+ sta->addr, arvif->vdev_id, ret); -+ } -+ } else if (old_state == IEEE80211_STA_AUTHORIZED && -+ new_state == IEEE80211_STA_ASSOC) { -+ spin_lock_bh(&ar->ab->base_lock); -+ -+ peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr); -+ if (peer) -+ peer->is_authorized = false; -+ -+ spin_unlock_bh(&ar->ab->base_lock); -+ } else if (old_state == IEEE80211_STA_ASSOC && -+ new_state == IEEE80211_STA_AUTH && -+ (vif->type == NL80211_IFTYPE_AP || -+ vif->type == NL80211_IFTYPE_MESH_POINT || -+ vif->type == NL80211_IFTYPE_ADHOC)) { -+ ret = ath11k_station_disassoc(ar, vif, sta); -+ if (ret) -+ ath11k_warn(ar->ab, "Failed to disassociate station: %pM\n", -+ sta->addr); -+ } -+ -+ mutex_unlock(&ar->conf_mutex); -+ return ret; -+} -+ - static const struct ieee80211_ops ath11k_ops = { - .tx = ath11k_mac_op_tx, - .wake_tx_queue = ieee80211_handle_wake_tx_queue, -diff --git a/drivers/net/wireless/ath/ath11k/peer.c b/drivers/net/wireless/ath/ath11k/peer.c -index ca719eb3f7f829..6d0126c3930185 100644 ---- a/drivers/net/wireless/ath/ath11k/peer.c -+++ b/drivers/net/wireless/ath/ath11k/peer.c -@@ -446,7 +446,7 @@ int ath11k_peer_create(struct ath11k *ar, struct ath11k_vif *arvif, - peer->sec_type_grp = HAL_ENCRYPT_TYPE_OPEN; - - if (sta) { -- arsta = (struct ath11k_sta *)sta->drv_priv; -+ arsta = ath11k_sta_to_arsta(sta); - arsta->tcl_metadata |= FIELD_PREP(HTT_TCL_META_DATA_TYPE, 0) | - FIELD_PREP(HTT_TCL_META_DATA_PEER_ID, - peer->peer_id); -diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c -index 9a829b8282420a..31dbabc9eaf330 100644 ---- a/drivers/net/wireless/ath/ath11k/wmi.c -+++ b/drivers/net/wireless/ath/ath11k/wmi.c -@@ -6452,7 +6452,7 @@ static int ath11k_wmi_tlv_rssi_chain_parse(struct ath11k_base *ab, - goto exit; - } - -- arsta = (struct ath11k_sta *)sta->drv_priv; -+ arsta = ath11k_sta_to_arsta(sta); - - BUILD_BUG_ON(ARRAY_SIZE(arsta->chain_signal) > - ARRAY_SIZE(stats_rssi->rssi_avg_beacon)); -@@ -6540,7 +6540,7 @@ static int ath11k_wmi_tlv_fw_stats_data_parse(struct ath11k_base *ab, - arvif->bssid, - NULL); - if (sta) { -- arsta = (struct ath11k_sta *)sta->drv_priv; -+ arsta = ath11k_sta_to_arsta(sta); - arsta->rssi_beacon = src->beacon_snr; - ath11k_dbg(ab, ATH11K_DBG_WMI, - "stats vdev id %d snr %d\n", -@@ -7469,7 +7469,7 @@ static void ath11k_wmi_event_peer_sta_ps_state_chg(struct ath11k_base *ab, - goto exit; - } - -- arsta = (struct ath11k_sta *)sta->drv_priv; -+ arsta = ath11k_sta_to_arsta(sta); - - spin_lock_bh(&ar->data_lock); - -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c -index 00794086cc7c97..bf80675667ba38 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c -@@ -392,10 +392,8 @@ void brcmf_btcoex_detach(struct brcmf_cfg80211_info *cfg) - if (!cfg->btcoex) - return; - -- if (cfg->btcoex->timer_on) { -- cfg->btcoex->timer_on = false; -- timer_shutdown_sync(&cfg->btcoex->timer); -- } -+ timer_shutdown_sync(&cfg->btcoex->timer); -+ cfg->btcoex->timer_on = false; - - cancel_work_sync(&cfg->btcoex->work); - -diff --git a/drivers/net/wireless/marvell/libertas/cfg.c b/drivers/net/wireless/marvell/libertas/cfg.c -index b700c213d10c4f..38ad49033d0bad 100644 ---- a/drivers/net/wireless/marvell/libertas/cfg.c -+++ b/drivers/net/wireless/marvell/libertas/cfg.c -@@ -1150,10 +1150,13 @@ static int lbs_associate(struct lbs_private *priv, - /* add SSID TLV */ - rcu_read_lock(); - ssid_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SSID); -- if (ssid_eid) -- pos += lbs_add_ssid_tlv(pos, ssid_eid + 2, ssid_eid[1]); -- else -+ if (ssid_eid) { -+ u32 ssid_len = min(ssid_eid[1], IEEE80211_MAX_SSID_LEN); -+ -+ pos += lbs_add_ssid_tlv(pos, ssid_eid + 2, ssid_len); -+ } else { - lbs_deb_assoc("no SSID\n"); -+ } - rcu_read_unlock(); - - /* add DS param TLV */ -diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c -index b7ead0cd004508..69eea0628e670e 100644 ---- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c -+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c -@@ -4316,8 +4316,9 @@ int mwifiex_init_channel_scan_gap(struct mwifiex_adapter *adapter) - * additional active scan request for hidden SSIDs on passive channels. - */ - adapter->num_in_chan_stats = 2 * (n_channels_bg + n_channels_a); -- adapter->chan_stats = vmalloc(array_size(sizeof(*adapter->chan_stats), -- adapter->num_in_chan_stats)); -+ adapter->chan_stats = kcalloc(adapter->num_in_chan_stats, -+ sizeof(*adapter->chan_stats), -+ GFP_KERNEL); - - if (!adapter->chan_stats) - return -ENOMEM; -diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c -index 6c60a4c21a3128..685dcab11a488f 100644 ---- a/drivers/net/wireless/marvell/mwifiex/main.c -+++ b/drivers/net/wireless/marvell/mwifiex/main.c -@@ -664,7 +664,7 @@ static int _mwifiex_fw_dpc(const struct firmware *firmware, void *context) - goto done; - - err_add_intf: -- vfree(adapter->chan_stats); -+ kfree(adapter->chan_stats); - err_init_chan_scan: - wiphy_unregister(adapter->wiphy); - wiphy_free(adapter->wiphy); -@@ -1481,7 +1481,7 @@ static void mwifiex_uninit_sw(struct mwifiex_adapter *adapter) - wiphy_free(adapter->wiphy); - adapter->wiphy = NULL; - -- vfree(adapter->chan_stats); -+ kfree(adapter->chan_stats); - mwifiex_free_cmd_buffers(adapter); - } - -diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c -index 65a5f24e53136b..8ab55fc705f076 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c -@@ -1616,8 +1616,8 @@ mt7996_mcu_get_mmps_mode(enum ieee80211_smps_mode smps) - int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev, - void *data, u16 version) - { -+ struct uni_header hdr = {}; - struct ra_fixed_rate *req; -- struct uni_header hdr; - struct sk_buff *skb; - struct tlv *tlv; - int len; -@@ -2638,7 +2638,7 @@ int mt7996_mcu_set_hdr_trans(struct mt7996_dev *dev, bool hdr_trans) - { - struct { - u8 __rsv[4]; -- } __packed hdr; -+ } __packed hdr = {}; - struct hdr_trans_blacklist *req_blacklist; - struct hdr_trans_en *req_en; - struct sk_buff *skb; -diff --git a/drivers/net/wireless/st/cw1200/sta.c b/drivers/net/wireless/st/cw1200/sta.c -index 8ef1d06b9bbddb..121d810c8839e5 100644 ---- a/drivers/net/wireless/st/cw1200/sta.c -+++ b/drivers/net/wireless/st/cw1200/sta.c -@@ -1290,7 +1290,7 @@ static void cw1200_do_join(struct cw1200_common *priv) - rcu_read_lock(); - ssidie = ieee80211_bss_get_ie(bss, WLAN_EID_SSID); - if (ssidie) { -- join.ssid_len = ssidie[1]; -+ join.ssid_len = min(ssidie[1], IEEE80211_MAX_SSID_LEN); - memcpy(join.ssid, &ssidie[2], join.ssid_len); - } - rcu_read_unlock(); -diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c -index 053bb9fac6e3e1..b638731aa5ff2f 100644 ---- a/drivers/pci/msi/msi.c -+++ b/drivers/pci/msi/msi.c -@@ -610,6 +610,9 @@ void msix_prepare_msi_desc(struct pci_dev *dev, struct msi_desc *desc) - if (desc->pci.msi_attrib.can_mask) { - void __iomem *addr = pci_msix_desc_addr(desc); - -+ /* Workaround for SUN NIU insanity, which requires write before read */ -+ if (dev->dev_flags & PCI_DEV_FLAGS_MSIX_TOUCH_ENTRY_DATA_FIRST) -+ writel(0, addr + PCI_MSIX_ENTRY_DATA); - desc->pci.msix_ctrl = readl(addr + PCI_MSIX_ENTRY_VECTOR_CTRL); - } - } -diff --git a/drivers/pcmcia/omap_cf.c b/drivers/pcmcia/omap_cf.c -index e613818dc0bc90..25382612e48acb 100644 ---- a/drivers/pcmcia/omap_cf.c -+++ b/drivers/pcmcia/omap_cf.c -@@ -215,6 +215,8 @@ static int __init omap_cf_probe(struct platform_device *pdev) - return -EINVAL; - - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); -+ if (!res) -+ return -EINVAL; - - cf = kzalloc(sizeof *cf, GFP_KERNEL); - if (!cf) -diff --git a/drivers/pcmcia/rsrc_iodyn.c b/drivers/pcmcia/rsrc_iodyn.c -index b04b16496b0c4b..2677b577c1f858 100644 ---- a/drivers/pcmcia/rsrc_iodyn.c -+++ b/drivers/pcmcia/rsrc_iodyn.c -@@ -62,6 +62,9 @@ static struct resource *__iodyn_find_io_region(struct pcmcia_socket *s, - unsigned long min = base; - int ret; - -+ if (!res) -+ return NULL; -+ - data.mask = align - 1; - data.offset = base & data.mask; - -diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c -index bf9d070a44966d..da494fe451baf0 100644 ---- a/drivers/pcmcia/rsrc_nonstatic.c -+++ b/drivers/pcmcia/rsrc_nonstatic.c -@@ -375,7 +375,9 @@ static int do_validate_mem(struct pcmcia_socket *s, - - if (validate && !s->fake_cis) { - /* move it to the validated data set */ -- add_interval(&s_data->mem_db_valid, base, size); -+ ret = add_interval(&s_data->mem_db_valid, base, size); -+ if (ret) -+ return ret; - sub_interval(&s_data->mem_db, base, size); - } - -diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c -index 04686ae1e976bd..6f5437d210a617 100644 ---- a/drivers/platform/x86/amd/pmc/pmc-quirks.c -+++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c -@@ -242,6 +242,20 @@ static const struct dmi_system_id fwbug_list[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "Lafite Pro V 14M"), - } - }, -+ { -+ .ident = "TUXEDO InfinityBook Pro 14/15 AMD Gen10", -+ .driver_data = &quirk_spurious_8042, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_NAME, "XxHP4NAx"), -+ } -+ }, -+ { -+ .ident = "TUXEDO InfinityBook Pro 14/15 AMD Gen10", -+ .driver_data = &quirk_spurious_8042, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_NAME, "XxKK4NAx_XxSP4NAx"), -+ } -+ }, - {} - }; - -diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c -index d41fea53e41e90..502be061cc658c 100644 ---- a/drivers/scsi/lpfc/lpfc_nvmet.c -+++ b/drivers/scsi/lpfc/lpfc_nvmet.c -@@ -1243,7 +1243,7 @@ lpfc_nvmet_defer_rcv(struct nvmet_fc_target_port *tgtport, - struct lpfc_nvmet_tgtport *tgtp; - struct lpfc_async_xchg_ctx *ctxp = - container_of(rsp, struct lpfc_async_xchg_ctx, hdlrctx.fcp_req); -- struct rqb_dmabuf *nvmebuf = ctxp->rqb_buffer; -+ struct rqb_dmabuf *nvmebuf; - struct lpfc_hba *phba = ctxp->phba; - unsigned long iflag; - -@@ -1251,13 +1251,18 @@ lpfc_nvmet_defer_rcv(struct nvmet_fc_target_port *tgtport, - lpfc_nvmeio_data(phba, "NVMET DEFERRCV: xri x%x sz %d CPU %02x\n", - ctxp->oxid, ctxp->size, raw_smp_processor_id()); - -+ spin_lock_irqsave(&ctxp->ctxlock, iflag); -+ nvmebuf = ctxp->rqb_buffer; - if (!nvmebuf) { -+ spin_unlock_irqrestore(&ctxp->ctxlock, iflag); - lpfc_printf_log(phba, KERN_INFO, LOG_NVME_IOERR, - "6425 Defer rcv: no buffer oxid x%x: " - "flg %x ste %x\n", - ctxp->oxid, ctxp->flag, ctxp->state); - return; - } -+ ctxp->rqb_buffer = NULL; -+ spin_unlock_irqrestore(&ctxp->ctxlock, iflag); - - tgtp = phba->targetport->private; - if (tgtp) -@@ -1265,9 +1270,6 @@ lpfc_nvmet_defer_rcv(struct nvmet_fc_target_port *tgtport, - - /* Free the nvmebuf since a new buffer already replaced it */ - nvmebuf->hrq->rqbp->rqb_free_buffer(phba, nvmebuf); -- spin_lock_irqsave(&ctxp->ctxlock, iflag); -- ctxp->rqb_buffer = NULL; -- spin_unlock_irqrestore(&ctxp->ctxlock, iflag); - } - - /** -diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c -index a6773075bfe3ef..0afecda0bfaa38 100644 ---- a/drivers/soc/qcom/mdt_loader.c -+++ b/drivers/soc/qcom/mdt_loader.c -@@ -38,12 +38,14 @@ static bool mdt_header_valid(const struct firmware *fw) - if (phend > fw->size) - return false; - -- if (ehdr->e_shentsize != sizeof(struct elf32_shdr)) -- return false; -+ if (ehdr->e_shentsize || ehdr->e_shnum) { -+ if (ehdr->e_shentsize != sizeof(struct elf32_shdr)) -+ return false; - -- shend = size_add(size_mul(sizeof(struct elf32_shdr), ehdr->e_shnum), ehdr->e_shoff); -- if (shend > fw->size) -- return false; -+ shend = size_add(size_mul(sizeof(struct elf32_shdr), ehdr->e_shnum), ehdr->e_shoff); -+ if (shend > fw->size) -+ return false; -+ } - - return true; - } -diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c -index 7c17b8c0425e3c..bf9b816637d02e 100644 ---- a/drivers/spi/spi-cadence-quadspi.c -+++ b/drivers/spi/spi-cadence-quadspi.c -@@ -1868,8 +1868,6 @@ static int cqspi_probe(struct platform_device *pdev) - goto probe_setup_failed; - } - -- pm_runtime_enable(dev); -- - ret = spi_register_controller(host); - if (ret) { - dev_err(&pdev->dev, "failed to register SPI ctlr %d\n", ret); -@@ -1879,7 +1877,6 @@ static int cqspi_probe(struct platform_device *pdev) - return 0; - probe_setup_failed: - cqspi_controller_enable(cqspi, 0); -- pm_runtime_disable(dev); - probe_reset_failed: - if (cqspi->is_jh7110) - cqspi_jh7110_disable_clk(pdev, cqspi); -@@ -1901,8 +1898,7 @@ static void cqspi_remove(struct platform_device *pdev) - if (cqspi->rx_chan) - dma_release_channel(cqspi->rx_chan); - -- if (pm_runtime_get_sync(&pdev->dev) >= 0) -- clk_disable(cqspi->clk); -+ clk_disable_unprepare(cqspi->clk); - - if (cqspi->is_jh7110) - cqspi_jh7110_disable_clk(pdev, cqspi); -diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c -index fa899ab2014c6a..8ef82a11ebb0fa 100644 ---- a/drivers/spi/spi-fsl-lpspi.c -+++ b/drivers/spi/spi-fsl-lpspi.c -@@ -3,8 +3,9 @@ - // Freescale i.MX7ULP LPSPI driver - // - // Copyright 2016 Freescale Semiconductor, Inc. --// Copyright 2018 NXP Semiconductors -+// Copyright 2018, 2023, 2025 NXP - -+#include - #include - #include - #include -@@ -70,7 +71,7 @@ - #define DER_TDDE BIT(0) - #define CFGR1_PCSCFG BIT(27) - #define CFGR1_PINCFG (BIT(24)|BIT(25)) --#define CFGR1_PCSPOL BIT(8) -+#define CFGR1_PCSPOL_MASK GENMASK(11, 8) - #define CFGR1_NOSTALL BIT(3) - #define CFGR1_HOST BIT(0) - #define FSR_TXCOUNT (0xFF) -@@ -82,6 +83,8 @@ - #define TCR_RXMSK BIT(19) - #define TCR_TXMSK BIT(18) - -+#define SR_CLEAR_MASK GENMASK(13, 8) -+ - struct fsl_lpspi_devtype_data { - u8 prescale_max; - }; -@@ -420,7 +423,9 @@ static int fsl_lpspi_config(struct fsl_lpspi_data *fsl_lpspi) - else - temp = CFGR1_PINCFG; - if (fsl_lpspi->config.mode & SPI_CS_HIGH) -- temp |= CFGR1_PCSPOL; -+ temp |= FIELD_PREP(CFGR1_PCSPOL_MASK, -+ BIT(fsl_lpspi->config.chip_select)); -+ - writel(temp, fsl_lpspi->base + IMX7ULP_CFGR1); - - temp = readl(fsl_lpspi->base + IMX7ULP_CR); -@@ -529,14 +534,13 @@ static int fsl_lpspi_reset(struct fsl_lpspi_data *fsl_lpspi) - fsl_lpspi_intctrl(fsl_lpspi, 0); - } - -- /* W1C for all flags in SR */ -- temp = 0x3F << 8; -- writel(temp, fsl_lpspi->base + IMX7ULP_SR); -- - /* Clear FIFO and disable module */ - temp = CR_RRF | CR_RTF; - writel(temp, fsl_lpspi->base + IMX7ULP_CR); - -+ /* W1C for all flags in SR */ -+ writel(SR_CLEAR_MASK, fsl_lpspi->base + IMX7ULP_SR); -+ - return 0; - } - -@@ -727,12 +731,10 @@ static int fsl_lpspi_pio_transfer(struct spi_controller *controller, - fsl_lpspi_write_tx_fifo(fsl_lpspi); - - ret = fsl_lpspi_wait_for_completion(controller); -- if (ret) -- return ret; - - fsl_lpspi_reset(fsl_lpspi); - -- return 0; -+ return ret; - } - - static int fsl_lpspi_transfer_one(struct spi_controller *controller, -@@ -780,7 +782,7 @@ static irqreturn_t fsl_lpspi_isr(int irq, void *dev_id) - if (temp_SR & SR_MBF || - readl(fsl_lpspi->base + IMX7ULP_FSR) & FSR_TXCOUNT) { - writel(SR_FCF, fsl_lpspi->base + IMX7ULP_SR); -- fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE); -+ fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE | (temp_IER & IER_TDIE)); - return IRQ_HANDLED; - } - -diff --git a/drivers/spi/spi-fsl-qspi.c b/drivers/spi/spi-fsl-qspi.c -index 79bac30e79af64..21e357966d2a22 100644 ---- a/drivers/spi/spi-fsl-qspi.c -+++ b/drivers/spi/spi-fsl-qspi.c -@@ -839,6 +839,19 @@ static const struct spi_controller_mem_ops fsl_qspi_mem_ops = { - .get_name = fsl_qspi_get_name, - }; - -+static void fsl_qspi_cleanup(void *data) -+{ -+ struct fsl_qspi *q = data; -+ -+ /* disable the hardware */ -+ qspi_writel(q, QUADSPI_MCR_MDIS_MASK, q->iobase + QUADSPI_MCR); -+ qspi_writel(q, 0x0, q->iobase + QUADSPI_RSER); -+ -+ fsl_qspi_clk_disable_unprep(q); -+ -+ mutex_destroy(&q->lock); -+} -+ - static int fsl_qspi_probe(struct platform_device *pdev) - { - struct spi_controller *ctlr; -@@ -928,15 +941,16 @@ static int fsl_qspi_probe(struct platform_device *pdev) - - ctlr->dev.of_node = np; - -+ ret = devm_add_action_or_reset(dev, fsl_qspi_cleanup, q); -+ if (ret) -+ goto err_put_ctrl; -+ - ret = devm_spi_register_controller(dev, ctlr); - if (ret) -- goto err_destroy_mutex; -+ goto err_put_ctrl; - - return 0; - --err_destroy_mutex: -- mutex_destroy(&q->lock); -- - err_disable_clk: - fsl_qspi_clk_disable_unprep(q); - -@@ -947,19 +961,6 @@ static int fsl_qspi_probe(struct platform_device *pdev) - return ret; - } - --static void fsl_qspi_remove(struct platform_device *pdev) --{ -- struct fsl_qspi *q = platform_get_drvdata(pdev); -- -- /* disable the hardware */ -- qspi_writel(q, QUADSPI_MCR_MDIS_MASK, q->iobase + QUADSPI_MCR); -- qspi_writel(q, 0x0, q->iobase + QUADSPI_RSER); -- -- fsl_qspi_clk_disable_unprep(q); -- -- mutex_destroy(&q->lock); --} -- - static int fsl_qspi_suspend(struct device *dev) - { - return 0; -@@ -997,7 +998,6 @@ static struct platform_driver fsl_qspi_driver = { - .pm = &fsl_qspi_pm_ops, - }, - .probe = fsl_qspi_probe, -- .remove_new = fsl_qspi_remove, - }; - module_platform_driver(fsl_qspi_driver); - -diff --git a/drivers/tee/optee/ffa_abi.c b/drivers/tee/optee/ffa_abi.c -index b8ba360e863edf..927c3d7947f9cf 100644 ---- a/drivers/tee/optee/ffa_abi.c -+++ b/drivers/tee/optee/ffa_abi.c -@@ -653,7 +653,7 @@ static int optee_ffa_do_call_with_arg(struct tee_context *ctx, - * with a matching configuration. - */ - --static bool optee_ffa_api_is_compatbile(struct ffa_device *ffa_dev, -+static bool optee_ffa_api_is_compatible(struct ffa_device *ffa_dev, - const struct ffa_ops *ops) - { - const struct ffa_msg_ops *msg_ops = ops->msg_ops; -@@ -804,7 +804,7 @@ static int optee_ffa_probe(struct ffa_device *ffa_dev) - - ffa_ops = ffa_dev->ops; - -- if (!optee_ffa_api_is_compatbile(ffa_dev, ffa_ops)) -+ if (!optee_ffa_api_is_compatible(ffa_dev, ffa_ops)) - return -EINVAL; - - if (!optee_ffa_exchange_caps(ffa_dev, ffa_ops, &sec_caps, -diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c -index 673cf035949483..426b818f2dd795 100644 ---- a/drivers/tee/tee_shm.c -+++ b/drivers/tee/tee_shm.c -@@ -489,9 +489,13 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id); - */ - void tee_shm_put(struct tee_shm *shm) - { -- struct tee_device *teedev = shm->ctx->teedev; -+ struct tee_device *teedev; - bool do_release = false; - -+ if (!shm || !shm->ctx || !shm->ctx->teedev) -+ return; -+ -+ teedev = shm->ctx->teedev; - mutex_lock(&teedev->mutex); - if (refcount_dec_and_test(&shm->refcount)) { - /* -diff --git a/drivers/thermal/mediatek/lvts_thermal.c b/drivers/thermal/mediatek/lvts_thermal.c -index 8d0ccf494ba224..603b37ce1eb8e6 100644 ---- a/drivers/thermal/mediatek/lvts_thermal.c -+++ b/drivers/thermal/mediatek/lvts_thermal.c -@@ -67,10 +67,14 @@ - #define LVTS_CALSCALE_CONF 0x300 - #define LVTS_MONINT_CONF 0x8300318C - --#define LVTS_MONINT_OFFSET_SENSOR0 0xC --#define LVTS_MONINT_OFFSET_SENSOR1 0x180 --#define LVTS_MONINT_OFFSET_SENSOR2 0x3000 --#define LVTS_MONINT_OFFSET_SENSOR3 0x3000000 -+#define LVTS_MONINT_OFFSET_HIGH_INTEN_SENSOR0 BIT(3) -+#define LVTS_MONINT_OFFSET_HIGH_INTEN_SENSOR1 BIT(8) -+#define LVTS_MONINT_OFFSET_HIGH_INTEN_SENSOR2 BIT(13) -+#define LVTS_MONINT_OFFSET_HIGH_INTEN_SENSOR3 BIT(25) -+#define LVTS_MONINT_OFFSET_LOW_INTEN_SENSOR0 BIT(2) -+#define LVTS_MONINT_OFFSET_LOW_INTEN_SENSOR1 BIT(7) -+#define LVTS_MONINT_OFFSET_LOW_INTEN_SENSOR2 BIT(12) -+#define LVTS_MONINT_OFFSET_LOW_INTEN_SENSOR3 BIT(24) - - #define LVTS_INT_SENSOR0 0x0009001F - #define LVTS_INT_SENSOR1 0x001203E0 -@@ -308,23 +312,41 @@ static int lvts_get_temp(struct thermal_zone_device *tz, int *temp) - - static void lvts_update_irq_mask(struct lvts_ctrl *lvts_ctrl) - { -- u32 masks[] = { -- LVTS_MONINT_OFFSET_SENSOR0, -- LVTS_MONINT_OFFSET_SENSOR1, -- LVTS_MONINT_OFFSET_SENSOR2, -- LVTS_MONINT_OFFSET_SENSOR3, -+ static const u32 high_offset_inten_masks[] = { -+ LVTS_MONINT_OFFSET_HIGH_INTEN_SENSOR0, -+ LVTS_MONINT_OFFSET_HIGH_INTEN_SENSOR1, -+ LVTS_MONINT_OFFSET_HIGH_INTEN_SENSOR2, -+ LVTS_MONINT_OFFSET_HIGH_INTEN_SENSOR3, -+ }; -+ static const u32 low_offset_inten_masks[] = { -+ LVTS_MONINT_OFFSET_LOW_INTEN_SENSOR0, -+ LVTS_MONINT_OFFSET_LOW_INTEN_SENSOR1, -+ LVTS_MONINT_OFFSET_LOW_INTEN_SENSOR2, -+ LVTS_MONINT_OFFSET_LOW_INTEN_SENSOR3, - }; - u32 value = 0; - int i; - - value = readl(LVTS_MONINT(lvts_ctrl->base)); - -- for (i = 0; i < ARRAY_SIZE(masks); i++) { -+ for (i = 0; i < ARRAY_SIZE(high_offset_inten_masks); i++) { - if (lvts_ctrl->sensors[i].high_thresh == lvts_ctrl->high_thresh -- && lvts_ctrl->sensors[i].low_thresh == lvts_ctrl->low_thresh) -- value |= masks[i]; -- else -- value &= ~masks[i]; -+ && lvts_ctrl->sensors[i].low_thresh == lvts_ctrl->low_thresh) { -+ /* -+ * The minimum threshold needs to be configured in the -+ * OFFSETL register to get working interrupts, but we -+ * don't actually want to generate interrupts when -+ * crossing it. -+ */ -+ if (lvts_ctrl->low_thresh == -INT_MAX) { -+ value &= ~low_offset_inten_masks[i]; -+ value |= high_offset_inten_masks[i]; -+ } else { -+ value |= low_offset_inten_masks[i] | high_offset_inten_masks[i]; -+ } -+ } else { -+ value &= ~(low_offset_inten_masks[i] | high_offset_inten_masks[i]); -+ } - } - - writel(value, LVTS_MONINT(lvts_ctrl->base)); -diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h -index c4968efc3fc464..a2e471d51a8f0b 100644 ---- a/fs/btrfs/btrfs_inode.h -+++ b/fs/btrfs/btrfs_inode.h -@@ -179,7 +179,7 @@ struct btrfs_inode { - u64 new_delalloc_bytes; - /* - * The offset of the last dir index key that was logged. -- * This is used only for directories. -+ * This is used only for directories. Protected by 'log_mutex'. - */ - u64 last_dir_index_offset; - }; -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index ed08d8e5639f59..48b06459bc485a 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -1742,7 +1742,7 @@ static int submit_eb_subpage(struct page *page, struct writeback_control *wbc) - subpage->bitmaps)) { - spin_unlock_irqrestore(&subpage->lock, flags); - spin_unlock(&page->mapping->private_lock); -- bit_start++; -+ bit_start += sectors_per_node; - continue; - } - -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 4502a474a81dab..ee5ffeab85bb78 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -8525,6 +8525,7 @@ struct inode *btrfs_alloc_inode(struct super_block *sb) - ei->last_sub_trans = 0; - ei->logged_trans = 0; - ei->delalloc_bytes = 0; -+ /* new_delalloc_bytes and last_dir_index_offset are in a union. */ - ei->new_delalloc_bytes = 0; - ei->defrag_bytes = 0; - ei->disk_i_size = 0; -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index 9439abf415ae36..e5d6bc1bb5e5da 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -3356,6 +3356,31 @@ int btrfs_free_log_root_tree(struct btrfs_trans_handle *trans, - return 0; - } - -+static bool mark_inode_as_not_logged(const struct btrfs_trans_handle *trans, -+ struct btrfs_inode *inode) -+{ -+ bool ret = false; -+ -+ /* -+ * Do this only if ->logged_trans is still 0 to prevent races with -+ * concurrent logging as we may see the inode not logged when -+ * inode_logged() is called but it gets logged after inode_logged() did -+ * not find it in the log tree and we end up setting ->logged_trans to a -+ * value less than trans->transid after the concurrent logging task has -+ * set it to trans->transid. As a consequence, subsequent rename, unlink -+ * and link operations may end up not logging new names and removing old -+ * names from the log. -+ */ -+ spin_lock(&inode->lock); -+ if (inode->logged_trans == 0) -+ inode->logged_trans = trans->transid - 1; -+ else if (inode->logged_trans == trans->transid) -+ ret = true; -+ spin_unlock(&inode->lock); -+ -+ return ret; -+} -+ - /* - * Check if an inode was logged in the current transaction. This correctly deals - * with the case where the inode was logged but has a logged_trans of 0, which -@@ -3373,15 +3398,32 @@ static int inode_logged(const struct btrfs_trans_handle *trans, - struct btrfs_key key; - int ret; - -- if (inode->logged_trans == trans->transid) -+ /* -+ * Quick lockless call, since once ->logged_trans is set to the current -+ * transaction, we never set it to a lower value anywhere else. -+ */ -+ if (data_race(inode->logged_trans) == trans->transid) - return 1; - - /* -- * If logged_trans is not 0, then we know the inode logged was not logged -- * in this transaction, so we can return false right away. -+ * If logged_trans is not 0 and not trans->transid, then we know the -+ * inode was not logged in this transaction, so we can return false -+ * right away. We take the lock to avoid a race caused by load/store -+ * tearing with a concurrent btrfs_log_inode() call or a concurrent task -+ * in this function further below - an update to trans->transid can be -+ * teared into two 32 bits updates for example, in which case we could -+ * see a positive value that is not trans->transid and assume the inode -+ * was not logged when it was. - */ -- if (inode->logged_trans > 0) -+ spin_lock(&inode->lock); -+ if (inode->logged_trans == trans->transid) { -+ spin_unlock(&inode->lock); -+ return 1; -+ } else if (inode->logged_trans > 0) { -+ spin_unlock(&inode->lock); - return 0; -+ } -+ spin_unlock(&inode->lock); - - /* - * If no log tree was created for this root in this transaction, then -@@ -3390,10 +3432,8 @@ static int inode_logged(const struct btrfs_trans_handle *trans, - * transaction's ID, to avoid the search below in a future call in case - * a log tree gets created after this. - */ -- if (!test_bit(BTRFS_ROOT_HAS_LOG_TREE, &inode->root->state)) { -- inode->logged_trans = trans->transid - 1; -- return 0; -- } -+ if (!test_bit(BTRFS_ROOT_HAS_LOG_TREE, &inode->root->state)) -+ return mark_inode_as_not_logged(trans, inode); - - /* - * We have a log tree and the inode's logged_trans is 0. We can't tell -@@ -3447,8 +3487,7 @@ static int inode_logged(const struct btrfs_trans_handle *trans, - * Set logged_trans to a value greater than 0 and less then the - * current transaction to avoid doing the search in future calls. - */ -- inode->logged_trans = trans->transid - 1; -- return 0; -+ return mark_inode_as_not_logged(trans, inode); - } - - /* -@@ -3456,20 +3495,9 @@ static int inode_logged(const struct btrfs_trans_handle *trans, - * the current transacion's ID, to avoid future tree searches as long as - * the inode is not evicted again. - */ -+ spin_lock(&inode->lock); - inode->logged_trans = trans->transid; -- -- /* -- * If it's a directory, then we must set last_dir_index_offset to the -- * maximum possible value, so that the next attempt to log the inode does -- * not skip checking if dir index keys found in modified subvolume tree -- * leaves have been logged before, otherwise it would result in attempts -- * to insert duplicate dir index keys in the log tree. This must be done -- * because last_dir_index_offset is an in-memory only field, not persisted -- * in the inode item or any other on-disk structure, so its value is lost -- * once the inode is evicted. -- */ -- if (S_ISDIR(inode->vfs_inode.i_mode)) -- inode->last_dir_index_offset = (u64)-1; -+ spin_unlock(&inode->lock); - - return 1; - } -@@ -4041,7 +4069,7 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans, - - /* - * If the inode was logged before and it was evicted, then its -- * last_dir_index_offset is (u64)-1, so we don't the value of the last index -+ * last_dir_index_offset is 0, so we don't know the value of the last index - * key offset. If that's the case, search for it and update the inode. This - * is to avoid lookups in the log tree every time we try to insert a dir index - * key from a leaf changed in the current transaction, and to allow us to always -@@ -4057,7 +4085,7 @@ static int update_last_dir_index_offset(struct btrfs_inode *inode, - - lockdep_assert_held(&inode->log_mutex); - -- if (inode->last_dir_index_offset != (u64)-1) -+ if (inode->last_dir_index_offset != 0) - return 0; - - if (!ctx->logged_before) { -diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c -index 0a498bc60f5573..ed110568d6127f 100644 ---- a/fs/fs-writeback.c -+++ b/fs/fs-writeback.c -@@ -2536,10 +2536,6 @@ void __mark_inode_dirty(struct inode *inode, int flags) - wakeup_bdi = inode_io_list_move_locked(inode, wb, - dirty_list); - -- spin_unlock(&wb->list_lock); -- spin_unlock(&inode->i_lock); -- trace_writeback_dirty_inode_enqueue(inode); -- - /* - * If this is the first dirty inode for this bdi, - * we have to wake-up the corresponding bdi thread -@@ -2549,6 +2545,11 @@ void __mark_inode_dirty(struct inode *inode, int flags) - if (wakeup_bdi && - (wb->bdi->capabilities & BDI_CAP_WRITEBACK)) - wb_wakeup_delayed(wb); -+ -+ spin_unlock(&wb->list_lock); -+ spin_unlock(&inode->i_lock); -+ trace_writeback_dirty_inode_enqueue(inode); -+ - return; - } - } -diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c -index 999111bfc27178..c561a8a6493e7c 100644 ---- a/fs/ocfs2/inode.c -+++ b/fs/ocfs2/inode.c -@@ -1205,6 +1205,9 @@ static void ocfs2_clear_inode(struct inode *inode) - * the journal is flushed before journal shutdown. Thus it is safe to - * have inodes get cleaned up after journal shutdown. - */ -+ if (!osb->journal) -+ return; -+ - jbd2_journal_release_jbd_inode(osb->journal->j_journal, - &oi->ip_jinode); - } -diff --git a/fs/proc/generic.c b/fs/proc/generic.c -index 2187d9ca351ced..db3f2c6abc162a 100644 ---- a/fs/proc/generic.c -+++ b/fs/proc/generic.c -@@ -362,6 +362,25 @@ static const struct inode_operations proc_dir_inode_operations = { - .setattr = proc_notify_change, - }; - -+static void pde_set_flags(struct proc_dir_entry *pde) -+{ -+ const struct proc_ops *proc_ops = pde->proc_ops; -+ -+ if (!proc_ops) -+ return; -+ -+ if (proc_ops->proc_flags & PROC_ENTRY_PERMANENT) -+ pde->flags |= PROC_ENTRY_PERMANENT; -+ if (proc_ops->proc_read_iter) -+ pde->flags |= PROC_ENTRY_proc_read_iter; -+#ifdef CONFIG_COMPAT -+ if (proc_ops->proc_compat_ioctl) -+ pde->flags |= PROC_ENTRY_proc_compat_ioctl; -+#endif -+ if (proc_ops->proc_lseek) -+ pde->flags |= PROC_ENTRY_proc_lseek; -+} -+ - /* returns the registered entry, or frees dp and returns NULL on failure */ - struct proc_dir_entry *proc_register(struct proc_dir_entry *dir, - struct proc_dir_entry *dp) -@@ -369,6 +388,8 @@ struct proc_dir_entry *proc_register(struct proc_dir_entry *dir, - if (proc_alloc_inum(&dp->low_ino)) - goto out_free_entry; - -+ pde_set_flags(dp); -+ - write_lock(&proc_subdir_lock); - dp->parent = dir; - if (pde_subdir_insert(dir, dp) == false) { -@@ -557,20 +578,6 @@ struct proc_dir_entry *proc_create_reg(const char *name, umode_t mode, - return p; - } - --static void pde_set_flags(struct proc_dir_entry *pde) --{ -- if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT) -- pde->flags |= PROC_ENTRY_PERMANENT; -- if (pde->proc_ops->proc_read_iter) -- pde->flags |= PROC_ENTRY_proc_read_iter; --#ifdef CONFIG_COMPAT -- if (pde->proc_ops->proc_compat_ioctl) -- pde->flags |= PROC_ENTRY_proc_compat_ioctl; --#endif -- if (pde->proc_ops->proc_lseek) -- pde->flags |= PROC_ENTRY_proc_lseek; --} -- - struct proc_dir_entry *proc_create_data(const char *name, umode_t mode, - struct proc_dir_entry *parent, - const struct proc_ops *proc_ops, void *data) -@@ -581,7 +588,6 @@ struct proc_dir_entry *proc_create_data(const char *name, umode_t mode, - if (!p) - return NULL; - p->proc_ops = proc_ops; -- pde_set_flags(p); - return proc_register(parent, p); - } - EXPORT_SYMBOL(proc_create_data); -@@ -632,7 +638,6 @@ struct proc_dir_entry *proc_create_seq_private(const char *name, umode_t mode, - p->proc_ops = &proc_seq_ops; - p->seq_ops = ops; - p->state_size = state_size; -- pde_set_flags(p); - return proc_register(parent, p); - } - EXPORT_SYMBOL(proc_create_seq_private); -@@ -663,7 +668,6 @@ struct proc_dir_entry *proc_create_single_data(const char *name, umode_t mode, - return NULL; - p->proc_ops = &proc_single_ops; - p->single_show = show; -- pde_set_flags(p); - return proc_register(parent, p); - } - EXPORT_SYMBOL(proc_create_single_data); -diff --git a/fs/smb/client/cifs_unicode.c b/fs/smb/client/cifs_unicode.c -index 4cc6e0896fad37..f8659d36793f17 100644 ---- a/fs/smb/client/cifs_unicode.c -+++ b/fs/smb/client/cifs_unicode.c -@@ -629,6 +629,9 @@ cifs_strndup_to_utf16(const char *src, const int maxlen, int *utf16_len, - int len; - __le16 *dst; - -+ if (!src) -+ return NULL; -+ - len = cifs_local_to_utf16_bytes(src, maxlen, cp); - len += 2; /* NULL */ - dst = kmalloc(len, GFP_KERNEL); -diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h -index 2331cd8174fe3f..684c4822f76a3f 100644 ---- a/include/linux/bpf-cgroup.h -+++ b/include/linux/bpf-cgroup.h -@@ -72,9 +72,6 @@ to_cgroup_bpf_attach_type(enum bpf_attach_type attach_type) - extern struct static_key_false cgroup_bpf_enabled_key[MAX_CGROUP_BPF_ATTACH_TYPE]; - #define cgroup_bpf_enabled(atype) static_branch_unlikely(&cgroup_bpf_enabled_key[atype]) - --#define for_each_cgroup_storage_type(stype) \ -- for (stype = 0; stype < MAX_BPF_CGROUP_STORAGE_TYPE; stype++) -- - struct bpf_cgroup_storage_map; - - struct bpf_storage_buffer { -@@ -500,8 +497,6 @@ static inline int bpf_percpu_cgroup_storage_update(struct bpf_map *map, - #define BPF_CGROUP_RUN_PROG_SETSOCKOPT(sock, level, optname, optval, optlen, \ - kernel_optval) ({ 0; }) - --#define for_each_cgroup_storage_type(stype) for (; false; ) -- - #endif /* CONFIG_CGROUP_BPF */ - - #endif /* _BPF_CGROUP_H */ -diff --git a/include/linux/bpf.h b/include/linux/bpf.h -index 17de12a98f858a..83da9c81fa86ad 100644 ---- a/include/linux/bpf.h -+++ b/include/linux/bpf.h -@@ -194,6 +194,20 @@ enum btf_field_type { - BPF_REFCOUNT = (1 << 8), - }; - -+enum bpf_cgroup_storage_type { -+ BPF_CGROUP_STORAGE_SHARED, -+ BPF_CGROUP_STORAGE_PERCPU, -+ __BPF_CGROUP_STORAGE_MAX -+#define MAX_BPF_CGROUP_STORAGE_TYPE __BPF_CGROUP_STORAGE_MAX -+}; -+ -+#ifdef CONFIG_CGROUP_BPF -+# define for_each_cgroup_storage_type(stype) \ -+ for (stype = 0; stype < MAX_BPF_CGROUP_STORAGE_TYPE; stype++) -+#else -+# define for_each_cgroup_storage_type(stype) for (; false; ) -+#endif /* CONFIG_CGROUP_BPF */ -+ - typedef void (*btf_dtor_kfunc_t)(void *); - - struct btf_field_kptr { -@@ -244,6 +258,19 @@ struct bpf_list_node_kern { - void *owner; - } __attribute__((aligned(8))); - -+/* 'Ownership' of program-containing map is claimed by the first program -+ * that is going to use this map or by the first program which FD is -+ * stored in the map to make sure that all callers and callees have the -+ * same prog type, JITed flag and xdp_has_frags flag. -+ */ -+struct bpf_map_owner { -+ enum bpf_prog_type type; -+ bool jited; -+ bool xdp_has_frags; -+ u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE]; -+ const struct btf_type *attach_func_proto; -+}; -+ - struct bpf_map { - /* The first two cachelines with read-mostly members of which some - * are also accessed in fast-path (e.g. ops, max_entries). -@@ -282,24 +309,15 @@ struct bpf_map { - }; - struct mutex freeze_mutex; - atomic64_t writecnt; -- /* 'Ownership' of program-containing map is claimed by the first program -- * that is going to use this map or by the first program which FD is -- * stored in the map to make sure that all callers and callees have the -- * same prog type, JITed flag and xdp_has_frags flag. -- */ -- struct { -- const struct btf_type *attach_func_proto; -- spinlock_t lock; -- enum bpf_prog_type type; -- bool jited; -- bool xdp_has_frags; -- } owner; -+ spinlock_t owner_lock; -+ struct bpf_map_owner *owner; - bool bypass_spec_v1; - bool frozen; /* write-once; write-protected by freeze_mutex */ - bool free_after_mult_rcu_gp; - bool free_after_rcu_gp; - atomic64_t sleepable_refcnt; - s64 __percpu *elem_count; -+ u64 cookie; /* write-once */ - }; - - static inline const char *btf_field_type_name(enum btf_field_type type) -@@ -994,14 +1012,6 @@ struct bpf_prog_offload { - u32 jited_len; - }; - --enum bpf_cgroup_storage_type { -- BPF_CGROUP_STORAGE_SHARED, -- BPF_CGROUP_STORAGE_PERCPU, -- __BPF_CGROUP_STORAGE_MAX --}; -- --#define MAX_BPF_CGROUP_STORAGE_TYPE __BPF_CGROUP_STORAGE_MAX -- - /* The longest tracepoint has 12 args. - * See include/trace/bpf_probe.h - */ -@@ -1811,6 +1821,16 @@ static inline bool bpf_map_flags_access_ok(u32 access_flags) - (BPF_F_RDONLY_PROG | BPF_F_WRONLY_PROG); - } - -+static inline struct bpf_map_owner *bpf_map_owner_alloc(struct bpf_map *map) -+{ -+ return kzalloc(sizeof(*map->owner), GFP_ATOMIC); -+} -+ -+static inline void bpf_map_owner_free(struct bpf_map *map) -+{ -+ kfree(map->owner); -+} -+ - struct bpf_event_entry { - struct perf_event *event; - struct file *perf_file; -diff --git a/include/linux/pci.h b/include/linux/pci.h -index ac5bd1718af241..0511f6f9a4e6ad 100644 ---- a/include/linux/pci.h -+++ b/include/linux/pci.h -@@ -245,6 +245,8 @@ enum pci_dev_flags { - PCI_DEV_FLAGS_NO_RELAXED_ORDERING = (__force pci_dev_flags_t) (1 << 11), - /* Device does honor MSI masking despite saying otherwise */ - PCI_DEV_FLAGS_HAS_MSI_MASKING = (__force pci_dev_flags_t) (1 << 12), -+ /* Device requires write to PCI_MSIX_ENTRY_DATA before any MSIX reads */ -+ PCI_DEV_FLAGS_MSIX_TOUCH_ENTRY_DATA_FIRST = (__force pci_dev_flags_t) (1 << 13), - }; - - enum pci_irq_reroute_variant { -diff --git a/include/linux/pgtable.h b/include/linux/pgtable.h -index e2c9a0c259df3b..e42388b6998b17 100644 ---- a/include/linux/pgtable.h -+++ b/include/linux/pgtable.h -@@ -1465,6 +1465,22 @@ static inline int pmd_protnone(pmd_t pmd) - } - #endif /* CONFIG_NUMA_BALANCING */ - -+/* -+ * Architectures can set this mask to a combination of PGTBL_P?D_MODIFIED values -+ * and let generic vmalloc and ioremap code know when arch_sync_kernel_mappings() -+ * needs to be called. -+ */ -+#ifndef ARCH_PAGE_TABLE_SYNC_MASK -+#define ARCH_PAGE_TABLE_SYNC_MASK 0 -+#endif -+ -+/* -+ * There is no default implementation for arch_sync_kernel_mappings(). It is -+ * relied upon the compiler to optimize calls out if ARCH_PAGE_TABLE_SYNC_MASK -+ * is 0. -+ */ -+void arch_sync_kernel_mappings(unsigned long start, unsigned long end); -+ - #endif /* CONFIG_MMU */ - - #ifdef CONFIG_HAVE_ARCH_HUGE_VMAP -diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h -index c720be70c8ddde..897f2109f6ada8 100644 ---- a/include/linux/vmalloc.h -+++ b/include/linux/vmalloc.h -@@ -173,22 +173,6 @@ extern int remap_vmalloc_range_partial(struct vm_area_struct *vma, - extern int remap_vmalloc_range(struct vm_area_struct *vma, void *addr, - unsigned long pgoff); - --/* -- * Architectures can set this mask to a combination of PGTBL_P?D_MODIFIED values -- * and let generic vmalloc and ioremap code know when arch_sync_kernel_mappings() -- * needs to be called. -- */ --#ifndef ARCH_PAGE_TABLE_SYNC_MASK --#define ARCH_PAGE_TABLE_SYNC_MASK 0 --#endif -- --/* -- * There is no default implementation for arch_sync_kernel_mappings(). It is -- * relied upon the compiler to optimize calls out if ARCH_PAGE_TABLE_SYNC_MASK -- * is 0. -- */ --void arch_sync_kernel_mappings(unsigned long start, unsigned long end); -- - /* - * Lowlevel-APIs (not for driver use!) - */ -diff --git a/include/net/netlink.h b/include/net/netlink.h -index 8a7cd1170e1f7b..aba2b162a2260b 100644 ---- a/include/net/netlink.h -+++ b/include/net/netlink.h -@@ -128,6 +128,8 @@ - * nla_len(nla) length of attribute payload - * - * Attribute Payload Access for Basic Types: -+ * nla_get_uint(nla) get payload for a uint attribute -+ * nla_get_sint(nla) get payload for a sint attribute - * nla_get_u8(nla) get payload for a u8 attribute - * nla_get_u16(nla) get payload for a u16 attribute - * nla_get_u32(nla) get payload for a u32 attribute -@@ -183,6 +185,8 @@ enum { - NLA_REJECT, - NLA_BE16, - NLA_BE32, -+ NLA_SINT, -+ NLA_UINT, - __NLA_TYPE_MAX, - }; - -@@ -229,6 +233,7 @@ enum nla_policy_validation { - * nested header (or empty); len field is used if - * nested_policy is also used, for the max attr - * number in the nested policy. -+ * NLA_SINT, NLA_UINT, - * NLA_U8, NLA_U16, - * NLA_U32, NLA_U64, - * NLA_S8, NLA_S16, -@@ -260,12 +265,14 @@ enum nla_policy_validation { - * while an array has the nested attributes at another - * level down and the attribute types directly in the - * nesting don't matter. -+ * NLA_UINT, - * NLA_U8, - * NLA_U16, - * NLA_U32, - * NLA_U64, - * NLA_BE16, - * NLA_BE32, -+ * NLA_SINT, - * NLA_S8, - * NLA_S16, - * NLA_S32, -@@ -280,6 +287,7 @@ enum nla_policy_validation { - * or NLA_POLICY_FULL_RANGE_SIGNED() macros instead. - * Use the NLA_POLICY_MIN(), NLA_POLICY_MAX() and - * NLA_POLICY_RANGE() macros. -+ * NLA_UINT, - * NLA_U8, - * NLA_U16, - * NLA_U32, -@@ -288,6 +296,7 @@ enum nla_policy_validation { - * to a struct netlink_range_validation that indicates - * the min/max values. - * Use NLA_POLICY_FULL_RANGE(). -+ * NLA_SINT, - * NLA_S8, - * NLA_S16, - * NLA_S32, -@@ -377,9 +386,11 @@ struct nla_policy { - - #define __NLA_IS_UINT_TYPE(tp) \ - (tp == NLA_U8 || tp == NLA_U16 || tp == NLA_U32 || \ -- tp == NLA_U64 || tp == NLA_BE16 || tp == NLA_BE32) -+ tp == NLA_U64 || tp == NLA_UINT || \ -+ tp == NLA_BE16 || tp == NLA_BE32) - #define __NLA_IS_SINT_TYPE(tp) \ -- (tp == NLA_S8 || tp == NLA_S16 || tp == NLA_S32 || tp == NLA_S64) -+ (tp == NLA_S8 || tp == NLA_S16 || tp == NLA_S32 || tp == NLA_S64 || \ -+ tp == NLA_SINT) - - #define __NLA_ENSURE(condition) BUILD_BUG_ON_ZERO(!(condition)) - #define NLA_ENSURE_UINT_TYPE(tp) \ -@@ -1357,6 +1368,22 @@ static inline int nla_put_u32(struct sk_buff *skb, int attrtype, u32 value) - return nla_put(skb, attrtype, sizeof(u32), &tmp); - } - -+/** -+ * nla_put_uint - Add a variable-size unsigned int to a socket buffer -+ * @skb: socket buffer to add attribute to -+ * @attrtype: attribute type -+ * @value: numeric value -+ */ -+static inline int nla_put_uint(struct sk_buff *skb, int attrtype, u64 value) -+{ -+ u64 tmp64 = value; -+ u32 tmp32 = value; -+ -+ if (tmp64 == tmp32) -+ return nla_put_u32(skb, attrtype, tmp32); -+ return nla_put(skb, attrtype, sizeof(u64), &tmp64); -+} -+ - /** - * nla_put_be32 - Add a __be32 netlink attribute to a socket buffer - * @skb: socket buffer to add attribute to -@@ -1511,6 +1538,22 @@ static inline int nla_put_s64(struct sk_buff *skb, int attrtype, s64 value, - return nla_put_64bit(skb, attrtype, sizeof(s64), &tmp, padattr); - } - -+/** -+ * nla_put_sint - Add a variable-size signed int to a socket buffer -+ * @skb: socket buffer to add attribute to -+ * @attrtype: attribute type -+ * @value: numeric value -+ */ -+static inline int nla_put_sint(struct sk_buff *skb, int attrtype, s64 value) -+{ -+ s64 tmp64 = value; -+ s32 tmp32 = value; -+ -+ if (tmp64 == tmp32) -+ return nla_put_s32(skb, attrtype, tmp32); -+ return nla_put(skb, attrtype, sizeof(s64), &tmp64); -+} -+ - /** - * nla_put_string - Add a string netlink attribute to a socket buffer - * @skb: socket buffer to add attribute to -@@ -1667,6 +1710,17 @@ static inline u64 nla_get_u64(const struct nlattr *nla) - return tmp; - } - -+/** -+ * nla_get_uint - return payload of uint attribute -+ * @nla: uint netlink attribute -+ */ -+static inline u64 nla_get_uint(const struct nlattr *nla) -+{ -+ if (nla_len(nla) == sizeof(u32)) -+ return nla_get_u32(nla); -+ return nla_get_u64(nla); -+} -+ - /** - * nla_get_be64 - return payload of __be64 attribute - * @nla: __be64 netlink attribute -@@ -1729,6 +1783,17 @@ static inline s64 nla_get_s64(const struct nlattr *nla) - return tmp; - } - -+/** -+ * nla_get_sint - return payload of uint attribute -+ * @nla: uint netlink attribute -+ */ -+static inline s64 nla_get_sint(const struct nlattr *nla) -+{ -+ if (nla_len(nla) == sizeof(s32)) -+ return nla_get_s32(nla); -+ return nla_get_s64(nla); -+} -+ - /** - * nla_get_flag - return payload of flag attribute - * @nla: flag netlink attribute -diff --git a/include/uapi/linux/netlink.h b/include/uapi/linux/netlink.h -index e2ae82e3f9f718..f87aaf28a6491d 100644 ---- a/include/uapi/linux/netlink.h -+++ b/include/uapi/linux/netlink.h -@@ -298,6 +298,8 @@ struct nla_bitfield32 { - * entry has attributes again, the policy for those inner ones - * and the corresponding maxtype may be specified. - * @NL_ATTR_TYPE_BITFIELD32: &struct nla_bitfield32 attribute -+ * @NL_ATTR_TYPE_SINT: 32-bit or 64-bit signed attribute, aligned to 4B -+ * @NL_ATTR_TYPE_UINT: 32-bit or 64-bit unsigned attribute, aligned to 4B - */ - enum netlink_attribute_type { - NL_ATTR_TYPE_INVALID, -@@ -322,6 +324,9 @@ enum netlink_attribute_type { - NL_ATTR_TYPE_NESTED_ARRAY, - - NL_ATTR_TYPE_BITFIELD32, -+ -+ NL_ATTR_TYPE_SINT, -+ NL_ATTR_TYPE_UINT, - }; - - /** -diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c -index 5eaaf95048abc1..3618be05fc3527 100644 ---- a/kernel/bpf/core.c -+++ b/kernel/bpf/core.c -@@ -2262,28 +2262,44 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, - const struct bpf_prog *fp) - { - enum bpf_prog_type prog_type = resolve_prog_type(fp); -- bool ret; - struct bpf_prog_aux *aux = fp->aux; -+ enum bpf_cgroup_storage_type i; -+ bool ret = false; -+ u64 cookie; - - if (fp->kprobe_override) -- return false; -+ return ret; - -- spin_lock(&map->owner.lock); -- if (!map->owner.type) { -- /* There's no owner yet where we could check for -- * compatibility. -- */ -- map->owner.type = prog_type; -- map->owner.jited = fp->jited; -- map->owner.xdp_has_frags = aux->xdp_has_frags; -- map->owner.attach_func_proto = aux->attach_func_proto; -+ spin_lock(&map->owner_lock); -+ /* There's no owner yet where we could check for compatibility. */ -+ if (!map->owner) { -+ map->owner = bpf_map_owner_alloc(map); -+ if (!map->owner) -+ goto err; -+ map->owner->type = prog_type; -+ map->owner->jited = fp->jited; -+ map->owner->xdp_has_frags = aux->xdp_has_frags; -+ map->owner->attach_func_proto = aux->attach_func_proto; -+ for_each_cgroup_storage_type(i) { -+ map->owner->storage_cookie[i] = -+ aux->cgroup_storage[i] ? -+ aux->cgroup_storage[i]->cookie : 0; -+ } - ret = true; - } else { -- ret = map->owner.type == prog_type && -- map->owner.jited == fp->jited && -- map->owner.xdp_has_frags == aux->xdp_has_frags; -+ ret = map->owner->type == prog_type && -+ map->owner->jited == fp->jited && -+ map->owner->xdp_has_frags == aux->xdp_has_frags; -+ for_each_cgroup_storage_type(i) { -+ if (!ret) -+ break; -+ cookie = aux->cgroup_storage[i] ? -+ aux->cgroup_storage[i]->cookie : 0; -+ ret = map->owner->storage_cookie[i] == cookie || -+ !cookie; -+ } - if (ret && -- map->owner.attach_func_proto != aux->attach_func_proto) { -+ map->owner->attach_func_proto != aux->attach_func_proto) { - switch (prog_type) { - case BPF_PROG_TYPE_TRACING: - case BPF_PROG_TYPE_LSM: -@@ -2296,8 +2312,8 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, - } - } - } -- spin_unlock(&map->owner.lock); -- -+err: -+ spin_unlock(&map->owner_lock); - return ret; - } - -diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c -index b66349f892f25e..98f3f206d112e1 100644 ---- a/kernel/bpf/syscall.c -+++ b/kernel/bpf/syscall.c -@@ -35,6 +35,7 @@ - #include - #include - #include -+#include - #include - - #include -@@ -50,6 +51,7 @@ - #define BPF_OBJ_FLAG_MASK (BPF_F_RDONLY | BPF_F_WRONLY) - - DEFINE_PER_CPU(int, bpf_prog_active); -+DEFINE_COOKIE(bpf_map_cookie); - static DEFINE_IDR(prog_idr); - static DEFINE_SPINLOCK(prog_idr_lock); - static DEFINE_IDR(map_idr); -@@ -696,6 +698,7 @@ static void bpf_map_free_deferred(struct work_struct *work) - - security_bpf_map_free(map); - bpf_map_release_memcg(map); -+ bpf_map_owner_free(map); - /* implementation dependent freeing */ - map->ops->map_free(map); - /* Delay freeing of btf_record for maps, as map_free -@@ -713,7 +716,6 @@ static void bpf_map_free_deferred(struct work_struct *work) - */ - btf_put(btf); - } -- - static void bpf_map_put_uref(struct bpf_map *map) - { - if (atomic64_dec_and_test(&map->usercnt)) { -@@ -805,12 +807,12 @@ static void bpf_map_show_fdinfo(struct seq_file *m, struct file *filp) - struct bpf_map *map = filp->private_data; - u32 type = 0, jited = 0; - -- if (map_type_contains_progs(map)) { -- spin_lock(&map->owner.lock); -- type = map->owner.type; -- jited = map->owner.jited; -- spin_unlock(&map->owner.lock); -+ spin_lock(&map->owner_lock); -+ if (map->owner) { -+ type = map->owner->type; -+ jited = map->owner->jited; - } -+ spin_unlock(&map->owner_lock); - - seq_printf(m, - "map_type:\t%u\n" -@@ -1253,10 +1255,14 @@ static int map_create(union bpf_attr *attr) - if (err < 0) - goto free_map; - -+ preempt_disable(); -+ map->cookie = gen_cookie_next(&bpf_map_cookie); -+ preempt_enable(); -+ - atomic64_set(&map->refcnt, 1); - atomic64_set(&map->usercnt, 1); - mutex_init(&map->freeze_mutex); -- spin_lock_init(&map->owner.lock); -+ spin_lock_init(&map->owner_lock); - - if (attr->btf_key_type_id || attr->btf_value_type_id || - /* Even the map's value is a kernel's struct, -diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c -index c61698cff0f3a8..b87426b74eec28 100644 ---- a/kernel/sched/topology.c -+++ b/kernel/sched/topology.c -@@ -2140,6 +2140,8 @@ int sched_numa_find_nth_cpu(const struct cpumask *cpus, int cpu, int node) - goto unlock; - - hop_masks = bsearch(&k, k.masks, sched_domains_numa_levels, sizeof(k.masks[0]), hop_cmp); -+ if (!hop_masks) -+ goto unlock; - hop = hop_masks - k.masks; - - ret = hop ? -diff --git a/lib/nlattr.c b/lib/nlattr.c -index ba698a097fc810..0319e811bb10a3 100644 ---- a/lib/nlattr.c -+++ b/lib/nlattr.c -@@ -138,6 +138,7 @@ void nla_get_range_unsigned(const struct nla_policy *pt, - range->max = U32_MAX; - break; - case NLA_U64: -+ case NLA_UINT: - case NLA_MSECS: - range->max = U64_MAX; - break; -@@ -187,6 +188,9 @@ static int nla_validate_range_unsigned(const struct nla_policy *pt, - case NLA_U64: - value = nla_get_u64(nla); - break; -+ case NLA_UINT: -+ value = nla_get_uint(nla); -+ break; - case NLA_MSECS: - value = nla_get_u64(nla); - break; -@@ -252,6 +256,7 @@ void nla_get_range_signed(const struct nla_policy *pt, - range->max = S32_MAX; - break; - case NLA_S64: -+ case NLA_SINT: - range->min = S64_MIN; - range->max = S64_MAX; - break; -@@ -299,6 +304,9 @@ static int nla_validate_int_range_signed(const struct nla_policy *pt, - case NLA_S64: - value = nla_get_s64(nla); - break; -+ case NLA_SINT: -+ value = nla_get_sint(nla); -+ break; - default: - return -EINVAL; - } -@@ -324,6 +332,7 @@ static int nla_validate_int_range(const struct nla_policy *pt, - case NLA_U16: - case NLA_U32: - case NLA_U64: -+ case NLA_UINT: - case NLA_MSECS: - case NLA_BINARY: - case NLA_BE16: -@@ -333,6 +342,7 @@ static int nla_validate_int_range(const struct nla_policy *pt, - case NLA_S16: - case NLA_S32: - case NLA_S64: -+ case NLA_SINT: - return nla_validate_int_range_signed(pt, nla, extack); - default: - WARN_ON(1); -@@ -359,6 +369,9 @@ static int nla_validate_mask(const struct nla_policy *pt, - case NLA_U64: - value = nla_get_u64(nla); - break; -+ case NLA_UINT: -+ value = nla_get_uint(nla); -+ break; - case NLA_BE16: - value = ntohs(nla_get_be16(nla)); - break; -@@ -437,6 +450,15 @@ static int validate_nla(const struct nlattr *nla, int maxtype, - goto out_err; - break; - -+ case NLA_SINT: -+ case NLA_UINT: -+ if (attrlen != sizeof(u32) && attrlen != sizeof(u64)) { -+ NL_SET_ERR_MSG_ATTR_POL(extack, nla, pt, -+ "invalid attribute length"); -+ return -EINVAL; -+ } -+ break; -+ - case NLA_BITFIELD32: - if (attrlen != sizeof(struct nla_bitfield32)) - goto out_err; -diff --git a/mm/slub.c b/mm/slub.c -index d2544c88a5c43c..400563c45266e6 100644 ---- a/mm/slub.c -+++ b/mm/slub.c -@@ -771,19 +771,19 @@ static struct track *get_track(struct kmem_cache *s, void *object, - } - - #ifdef CONFIG_STACKDEPOT --static noinline depot_stack_handle_t set_track_prepare(void) -+static noinline depot_stack_handle_t set_track_prepare(gfp_t gfp_flags) - { - depot_stack_handle_t handle; - unsigned long entries[TRACK_ADDRS_COUNT]; - unsigned int nr_entries; - - nr_entries = stack_trace_save(entries, ARRAY_SIZE(entries), 3); -- handle = stack_depot_save(entries, nr_entries, GFP_NOWAIT); -+ handle = stack_depot_save(entries, nr_entries, gfp_flags); - - return handle; - } - #else --static inline depot_stack_handle_t set_track_prepare(void) -+static inline depot_stack_handle_t set_track_prepare(gfp_t gfp_flags) - { - return 0; - } -@@ -805,9 +805,9 @@ static void set_track_update(struct kmem_cache *s, void *object, - } - - static __always_inline void set_track(struct kmem_cache *s, void *object, -- enum track_item alloc, unsigned long addr) -+ enum track_item alloc, unsigned long addr, gfp_t gfp_flags) - { -- depot_stack_handle_t handle = set_track_prepare(); -+ depot_stack_handle_t handle = set_track_prepare(gfp_flags); - - set_track_update(s, object, alloc, addr, handle); - } -@@ -988,7 +988,12 @@ static void object_err(struct kmem_cache *s, struct slab *slab, - return; - - slab_bug(s, "%s", reason); -- print_trailer(s, slab, object); -+ if (!object || !check_valid_pointer(s, slab, object)) { -+ print_slab_info(slab); -+ pr_err("Invalid pointer 0x%p\n", object); -+ } else { -+ print_trailer(s, slab, object); -+ } - add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE); - } - -@@ -1733,9 +1738,9 @@ static inline bool free_debug_processing(struct kmem_cache *s, - static inline void slab_pad_check(struct kmem_cache *s, struct slab *slab) {} - static inline int check_object(struct kmem_cache *s, struct slab *slab, - void *object, u8 val) { return 1; } --static inline depot_stack_handle_t set_track_prepare(void) { return 0; } -+static inline depot_stack_handle_t set_track_prepare(gfp_t gfp_flags) { return 0; } - static inline void set_track(struct kmem_cache *s, void *object, -- enum track_item alloc, unsigned long addr) {} -+ enum track_item alloc, unsigned long addr, gfp_t gfp_flags) {} - static inline void add_full(struct kmem_cache *s, struct kmem_cache_node *n, - struct slab *slab) {} - static inline void remove_full(struct kmem_cache *s, struct kmem_cache_node *n, -@@ -3223,8 +3228,26 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node, - pc.slab = &slab; - pc.orig_size = orig_size; - freelist = get_partial(s, node, &pc); -- if (freelist) -- goto check_new_slab; -+ if (freelist) { -+ if (kmem_cache_debug(s)) { -+ /* -+ * For debug caches here we had to go through -+ * alloc_single_from_partial() so just store the -+ * tracking info and return the object. -+ * -+ * Due to disabled preemption we need to disallow -+ * blocking. The flags are further adjusted by -+ * gfp_nested_mask() in stack_depot itself. -+ */ -+ if (s->flags & SLAB_STORE_USER) -+ set_track(s, freelist, TRACK_ALLOC, addr, -+ gfpflags & ~(__GFP_DIRECT_RECLAIM)); -+ -+ return freelist; -+ } -+ -+ goto retry_load_slab; -+ } - - slub_put_cpu_ptr(s->cpu_slab); - slab = new_slab(s, gfpflags, node); -@@ -3244,7 +3267,8 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node, - goto new_objects; - - if (s->flags & SLAB_STORE_USER) -- set_track(s, freelist, TRACK_ALLOC, addr); -+ set_track(s, freelist, TRACK_ALLOC, addr, -+ gfpflags & ~(__GFP_DIRECT_RECLAIM)); - - return freelist; - } -@@ -3260,20 +3284,6 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node, - - inc_slabs_node(s, slab_nid(slab), slab->objects); - --check_new_slab: -- -- if (kmem_cache_debug(s)) { -- /* -- * For debug caches here we had to go through -- * alloc_single_from_partial() so just store the tracking info -- * and return the object -- */ -- if (s->flags & SLAB_STORE_USER) -- set_track(s, freelist, TRACK_ALLOC, addr); -- -- return freelist; -- } -- - if (unlikely(!pfmemalloc_match(slab, gfpflags))) { - /* - * For !pfmemalloc_match() case we don't load freelist so that -@@ -3546,8 +3556,12 @@ static noinline void free_to_partial_list( - unsigned long flags; - depot_stack_handle_t handle = 0; - -+ /* -+ * We cannot use GFP_NOWAIT as there are callsites where waking up -+ * kswapd could deadlock -+ */ - if (s->flags & SLAB_STORE_USER) -- handle = set_track_prepare(); -+ handle = set_track_prepare(__GFP_NOWARN); - - spin_lock_irqsave(&n->list_lock, flags); - -diff --git a/net/atm/resources.c b/net/atm/resources.c -index b19d851e1f4439..7c6fdedbcf4e5c 100644 ---- a/net/atm/resources.c -+++ b/net/atm/resources.c -@@ -112,7 +112,9 @@ struct atm_dev *atm_dev_register(const char *type, struct device *parent, - - if (atm_proc_dev_register(dev) < 0) { - pr_err("atm_proc_dev_register failed for dev %s\n", type); -- goto out_fail; -+ mutex_unlock(&atm_dev_mutex); -+ kfree(dev); -+ return NULL; - } - - if (atm_register_sysfs(dev, parent) < 0) { -@@ -128,7 +130,7 @@ struct atm_dev *atm_dev_register(const char *type, struct device *parent, - return dev; - - out_fail: -- kfree(dev); -+ put_device(&dev->class_dev); - dev = NULL; - goto out; - } -diff --git a/net/ax25/ax25_in.c b/net/ax25/ax25_in.c -index 1cac25aca63784..f2d66af8635957 100644 ---- a/net/ax25/ax25_in.c -+++ b/net/ax25/ax25_in.c -@@ -433,6 +433,10 @@ static int ax25_rcv(struct sk_buff *skb, struct net_device *dev, - int ax25_kiss_rcv(struct sk_buff *skb, struct net_device *dev, - struct packet_type *ptype, struct net_device *orig_dev) - { -+ skb = skb_share_check(skb, GFP_ATOMIC); -+ if (!skb) -+ return NET_RX_DROP; -+ - skb_orphan(skb); - - if (!net_eq(dev_net(dev), &init_net)) { -diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c -index 71ebd0284f95d2..0adc783fb83ca2 100644 ---- a/net/batman-adv/network-coding.c -+++ b/net/batman-adv/network-coding.c -@@ -1687,7 +1687,12 @@ batadv_nc_skb_decode_packet(struct batadv_priv *bat_priv, struct sk_buff *skb, - - coding_len = ntohs(coded_packet_tmp.coded_len); - -- if (coding_len > skb->len) -+ /* ensure dst buffer is large enough (payload only) */ -+ if (coding_len + h_size > skb->len) -+ return NULL; -+ -+ /* ensure src buffer is large enough (payload only) */ -+ if (coding_len + h_size > nc_packet->skb->len) - return NULL; - - /* Here the magic is reversed: -diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c -index 020f1809fc9946..7f3f700faebc24 100644 ---- a/net/bluetooth/hci_sync.c -+++ b/net/bluetooth/hci_sync.c -@@ -3354,7 +3354,7 @@ static int hci_powered_update_adv_sync(struct hci_dev *hdev) - * advertising data. This also applies to the case - * where BR/EDR was toggled during the AUTO_OFF phase. - */ -- if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || -+ if (hci_dev_test_flag(hdev, HCI_ADVERTISING) && - list_empty(&hdev->adv_instances)) { - if (ext_adv_capable(hdev)) { - err = hci_setup_ext_adv_instance_sync(hdev, 0x00); -diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c -index 9a906977c8723c..59630dbeda20d6 100644 ---- a/net/bluetooth/l2cap_sock.c -+++ b/net/bluetooth/l2cap_sock.c -@@ -1406,7 +1406,10 @@ static int l2cap_sock_release(struct socket *sock) - if (!sk) - return 0; - -+ lock_sock_nested(sk, L2CAP_NESTING_PARENT); - l2cap_sock_cleanup_listen(sk); -+ release_sock(sk); -+ - bt_sock_unlink(&l2cap_sk_list, sk); - - err = l2cap_sock_shutdown(sock, SHUT_RDWR); -diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c -index 2a4958e995f2d9..e6962d693359b3 100644 ---- a/net/bridge/br_netfilter_hooks.c -+++ b/net/bridge/br_netfilter_hooks.c -@@ -648,9 +648,6 @@ static unsigned int br_nf_local_in(void *priv, - break; - } - -- ct = container_of(nfct, struct nf_conn, ct_general); -- WARN_ON_ONCE(!nf_ct_is_confirmed(ct)); -- - return ret; - } - #endif -diff --git a/net/dsa/tag_ksz.c b/net/dsa/tag_ksz.c -index ea100bd25939b4..0a16c04c4bfc49 100644 ---- a/net/dsa/tag_ksz.c -+++ b/net/dsa/tag_ksz.c -@@ -139,7 +139,12 @@ static struct sk_buff *ksz8795_xmit(struct sk_buff *skb, struct net_device *dev) - - static struct sk_buff *ksz8795_rcv(struct sk_buff *skb, struct net_device *dev) - { -- u8 *tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN; -+ u8 *tag; -+ -+ if (skb_linearize(skb)) -+ return NULL; -+ -+ tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN; - - return ksz_common_rcv(skb, dev, tag[0] & 7, KSZ_EGRESS_TAG_LEN); - } -@@ -176,8 +181,9 @@ MODULE_ALIAS_DSA_TAG_DRIVER(DSA_TAG_PROTO_KSZ8795, KSZ8795_NAME); - - #define KSZ9477_INGRESS_TAG_LEN 2 - #define KSZ9477_PTP_TAG_LEN 4 --#define KSZ9477_PTP_TAG_INDICATION 0x80 -+#define KSZ9477_PTP_TAG_INDICATION BIT(7) - -+#define KSZ9477_TAIL_TAG_EG_PORT_M GENMASK(2, 0) - #define KSZ9477_TAIL_TAG_PRIO GENMASK(8, 7) - #define KSZ9477_TAIL_TAG_OVERRIDE BIT(9) - #define KSZ9477_TAIL_TAG_LOOKUP BIT(10) -@@ -300,10 +306,16 @@ static struct sk_buff *ksz9477_xmit(struct sk_buff *skb, - - static struct sk_buff *ksz9477_rcv(struct sk_buff *skb, struct net_device *dev) - { -- /* Tag decoding */ -- u8 *tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN; -- unsigned int port = tag[0] & 7; - unsigned int len = KSZ_EGRESS_TAG_LEN; -+ unsigned int port; -+ u8 *tag; -+ -+ if (skb_linearize(skb)) -+ return NULL; -+ -+ /* Tag decoding */ -+ tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN; -+ port = tag[0] & KSZ9477_TAIL_TAG_EG_PORT_M; - - /* Extra 4-bytes PTP timestamp */ - if (tag[0] & KSZ9477_PTP_TAG_INDICATION) { -diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c -index c33b1ecc591e4e..798497c8b1923e 100644 ---- a/net/ipv4/devinet.c -+++ b/net/ipv4/devinet.c -@@ -336,14 +336,13 @@ static void inetdev_destroy(struct in_device *in_dev) - - static int __init inet_blackhole_dev_init(void) - { -- int err = 0; -+ struct in_device *in_dev; - - rtnl_lock(); -- if (!inetdev_init(blackhole_netdev)) -- err = -ENOMEM; -+ in_dev = inetdev_init(blackhole_netdev); - rtnl_unlock(); - -- return err; -+ return PTR_ERR_OR_ZERO(in_dev); - } - late_initcall(inet_blackhole_dev_init); - -diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c -index 94501bb30c431b..b17549c4e5de8a 100644 ---- a/net/ipv4/icmp.c -+++ b/net/ipv4/icmp.c -@@ -801,11 +801,12 @@ void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info) - struct sk_buff *cloned_skb = NULL; - struct ip_options opts = { 0 }; - enum ip_conntrack_info ctinfo; -+ enum ip_conntrack_dir dir; - struct nf_conn *ct; - __be32 orig_ip; - - ct = nf_ct_get(skb_in, &ctinfo); -- if (!ct || !(ct->status & IPS_SRC_NAT)) { -+ if (!ct || !(READ_ONCE(ct->status) & IPS_NAT_MASK)) { - __icmp_send(skb_in, type, code, info, &opts); - return; - } -@@ -820,7 +821,8 @@ void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info) - goto out; - - orig_ip = ip_hdr(skb_in)->saddr; -- ip_hdr(skb_in)->saddr = ct->tuplehash[0].tuple.src.u3.ip; -+ dir = CTINFO2DIR(ctinfo); -+ ip_hdr(skb_in)->saddr = ct->tuplehash[dir].tuple.src.u3.ip; - __icmp_send(skb_in, type, code, info, &opts); - ip_hdr(skb_in)->saddr = orig_ip; - out: -diff --git a/net/ipv6/ip6_icmp.c b/net/ipv6/ip6_icmp.c -index 9e3574880cb03e..233914b63bdb82 100644 ---- a/net/ipv6/ip6_icmp.c -+++ b/net/ipv6/ip6_icmp.c -@@ -54,11 +54,12 @@ void icmpv6_ndo_send(struct sk_buff *skb_in, u8 type, u8 code, __u32 info) - struct inet6_skb_parm parm = { 0 }; - struct sk_buff *cloned_skb = NULL; - enum ip_conntrack_info ctinfo; -+ enum ip_conntrack_dir dir; - struct in6_addr orig_ip; - struct nf_conn *ct; - - ct = nf_ct_get(skb_in, &ctinfo); -- if (!ct || !(ct->status & IPS_SRC_NAT)) { -+ if (!ct || !(READ_ONCE(ct->status) & IPS_NAT_MASK)) { - __icmpv6_send(skb_in, type, code, info, &parm); - return; - } -@@ -73,7 +74,8 @@ void icmpv6_ndo_send(struct sk_buff *skb_in, u8 type, u8 code, __u32 info) - goto out; - - orig_ip = ipv6_hdr(skb_in)->saddr; -- ipv6_hdr(skb_in)->saddr = ct->tuplehash[0].tuple.src.u3.in6; -+ dir = CTINFO2DIR(ctinfo); -+ ipv6_hdr(skb_in)->saddr = ct->tuplehash[dir].tuple.src.u3.in6; - __icmpv6_send(skb_in, type, code, info, &parm); - ipv6_hdr(skb_in)->saddr = orig_ip; - out: -diff --git a/net/mctp/af_mctp.c b/net/mctp/af_mctp.c -index 5f9592fb57add2..805f7376cebe3f 100644 ---- a/net/mctp/af_mctp.c -+++ b/net/mctp/af_mctp.c -@@ -346,7 +346,7 @@ static int mctp_getsockopt(struct socket *sock, int level, int optname, - return 0; - } - -- return -EINVAL; -+ return -ENOPROTOOPT; - } - - static int mctp_ioctl_alloctag(struct mctp_sock *msk, unsigned long arg) -diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c -index f22691f8385363..10f72b5b4e1ad7 100644 ---- a/net/netfilter/nf_conntrack_helper.c -+++ b/net/netfilter/nf_conntrack_helper.c -@@ -373,7 +373,7 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me) - (cur->tuple.src.l3num == NFPROTO_UNSPEC || - cur->tuple.src.l3num == me->tuple.src.l3num) && - cur->tuple.dst.protonum == me->tuple.dst.protonum) { -- ret = -EEXIST; -+ ret = -EBUSY; - goto out; - } - } -@@ -384,7 +384,7 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me) - hlist_for_each_entry(cur, &nf_ct_helper_hash[h], hnode) { - if (nf_ct_tuple_src_mask_cmp(&cur->tuple, &me->tuple, - &mask)) { -- ret = -EEXIST; -+ ret = -EBUSY; - goto out; - } - } -diff --git a/net/netlink/policy.c b/net/netlink/policy.c -index 87e3de0fde8963..ef542a142b9800 100644 ---- a/net/netlink/policy.c -+++ b/net/netlink/policy.c -@@ -229,6 +229,8 @@ int netlink_policy_dump_attr_size_estimate(const struct nla_policy *pt) - case NLA_S16: - case NLA_S32: - case NLA_S64: -+ case NLA_SINT: -+ case NLA_UINT: - /* maximum is common, u64 min/max with padding */ - return common + - 2 * (nla_attr_size(0) + nla_attr_size(sizeof(u64))); -@@ -287,6 +289,7 @@ __netlink_policy_dump_write_attr(struct netlink_policy_dump_state *state, - case NLA_U16: - case NLA_U32: - case NLA_U64: -+ case NLA_UINT: - case NLA_MSECS: { - struct netlink_range_validation range; - -@@ -296,8 +299,10 @@ __netlink_policy_dump_write_attr(struct netlink_policy_dump_state *state, - type = NL_ATTR_TYPE_U16; - else if (pt->type == NLA_U32) - type = NL_ATTR_TYPE_U32; -- else -+ else if (pt->type == NLA_U64) - type = NL_ATTR_TYPE_U64; -+ else -+ type = NL_ATTR_TYPE_UINT; - - if (pt->validation_type == NLA_VALIDATE_MASK) { - if (nla_put_u64_64bit(skb, NL_POLICY_TYPE_ATTR_MASK, -@@ -319,7 +324,8 @@ __netlink_policy_dump_write_attr(struct netlink_policy_dump_state *state, - case NLA_S8: - case NLA_S16: - case NLA_S32: -- case NLA_S64: { -+ case NLA_S64: -+ case NLA_SINT: { - struct netlink_range_validation_signed range; - - if (pt->type == NLA_S8) -@@ -328,8 +334,10 @@ __netlink_policy_dump_write_attr(struct netlink_policy_dump_state *state, - type = NL_ATTR_TYPE_S16; - else if (pt->type == NLA_S32) - type = NL_ATTR_TYPE_S32; -- else -+ else if (pt->type == NLA_S64) - type = NL_ATTR_TYPE_S64; -+ else -+ type = NL_ATTR_TYPE_SINT; - - nla_get_range_signed(pt, &range); - -diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c -index dbce904c03cf73..4f485b9b31b288 100644 ---- a/net/smc/smc_clc.c -+++ b/net/smc/smc_clc.c -@@ -426,8 +426,6 @@ smc_clc_msg_decl_valid(struct smc_clc_msg_decline *dclc) - { - struct smc_clc_msg_hdr *hdr = &dclc->hdr; - -- if (hdr->typev1 != SMC_TYPE_R && hdr->typev1 != SMC_TYPE_D) -- return false; - if (hdr->version == SMC_V1) { - if (ntohs(hdr->length) != sizeof(struct smc_clc_msg_decline)) - return false; -diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c -index 598ac9ead64b72..6df543e083fb34 100644 ---- a/net/smc/smc_ib.c -+++ b/net/smc/smc_ib.c -@@ -743,6 +743,9 @@ bool smc_ib_is_sg_need_sync(struct smc_link *lnk, - unsigned int i; - bool ret = false; - -+ if (!lnk->smcibdev->ibdev->dma_device) -+ return ret; -+ - /* for now there is just one DMA address */ - for_each_sg(buf_slot->sgt[lnk->link_idx].sgl, sg, - buf_slot->sgt[lnk->link_idx].nents, i) { -diff --git a/net/wireless/scan.c b/net/wireless/scan.c -index 6db8c9a2a7a2b8..c1d64e25045484 100644 ---- a/net/wireless/scan.c -+++ b/net/wireless/scan.c -@@ -1807,7 +1807,8 @@ cfg80211_update_known_bss(struct cfg80211_registered_device *rdev, - */ - - f = rcu_access_pointer(new->pub.beacon_ies); -- kfree_rcu((struct cfg80211_bss_ies *)f, rcu_head); -+ if (!new->pub.hidden_beacon_bss) -+ kfree_rcu((struct cfg80211_bss_ies *)f, rcu_head); - return false; - } - -diff --git a/net/wireless/sme.c b/net/wireless/sme.c -index 70881782c25c6c..5904c869085c80 100644 ---- a/net/wireless/sme.c -+++ b/net/wireless/sme.c -@@ -915,13 +915,16 @@ void __cfg80211_connect_result(struct net_device *dev, - if (!wdev->u.client.ssid_len) { - rcu_read_lock(); - for_each_valid_link(cr, link) { -+ u32 ssid_len; -+ - ssid = ieee80211_bss_get_elem(cr->links[link].bss, - WLAN_EID_SSID); - - if (!ssid || !ssid->datalen) - continue; - -- memcpy(wdev->u.client.ssid, ssid->data, ssid->datalen); -+ ssid_len = min(ssid->datalen, IEEE80211_MAX_SSID_LEN); -+ memcpy(wdev->u.client.ssid, ssid->data, ssid_len); - wdev->u.client.ssid_len = ssid->datalen; - break; - } -diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c -index f2c03fbf892f1b..80c015af09efde 100644 ---- a/sound/pci/hda/patch_hdmi.c -+++ b/sound/pci/hda/patch_hdmi.c -@@ -1991,6 +1991,7 @@ static int hdmi_add_cvt(struct hda_codec *codec, hda_nid_t cvt_nid) - static const struct snd_pci_quirk force_connect_list[] = { - SND_PCI_QUIRK(0x103c, 0x83e2, "HP EliteDesk 800 G4", 1), - SND_PCI_QUIRK(0x103c, 0x83ef, "HP MP9 G4 Retail System AMS", 1), -+ SND_PCI_QUIRK(0x103c, 0x845a, "HP EliteDesk 800 G4 DM 65W", 1), - SND_PCI_QUIRK(0x103c, 0x870f, "HP", 1), - SND_PCI_QUIRK(0x103c, 0x871a, "HP", 1), - SND_PCI_QUIRK(0x103c, 0x8711, "HP", 1), -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index d4bc80780a1f91..6aae06223f2664 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -10249,6 +10249,9 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x8e18, "HP ZBook Firefly 14 G12A", ALC285_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x8e19, "HP ZBook Firefly 14 G12A", ALC285_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x8e1a, "HP ZBook Firefly 14 G12A", ALC285_FIXUP_HP_GPIO_LED), -+ SND_PCI_QUIRK(0x103c, 0x8e1d, "HP ZBook X Gli 16 G12", ALC236_FIXUP_HP_GPIO_LED), -+ SND_PCI_QUIRK(0x103c, 0x8e3a, "HP Agusta", ALC287_FIXUP_CS35L41_I2C_2), -+ SND_PCI_QUIRK(0x103c, 0x8e3b, "HP Agusta", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), - SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), - SND_PCI_QUIRK(0x1043, 0x1054, "ASUS G614FH/FM/FP", ALC287_FIXUP_CS35L41_I2C_2), -@@ -10632,6 +10635,8 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1d05, 0x121b, "TongFang GMxAGxx", ALC269_FIXUP_NO_SHUTUP), - SND_PCI_QUIRK(0x1d05, 0x1387, "TongFang GMxIXxx", ALC2XX_FIXUP_HEADSET_MIC), - SND_PCI_QUIRK(0x1d05, 0x1409, "TongFang GMxIXxx", ALC2XX_FIXUP_HEADSET_MIC), -+ SND_PCI_QUIRK(0x1d05, 0x300f, "TongFang X6AR5xxY", ALC2XX_FIXUP_HEADSET_MIC), -+ SND_PCI_QUIRK(0x1d05, 0x3019, "TongFang X6FR5xxY", ALC2XX_FIXUP_HEADSET_MIC), - SND_PCI_QUIRK(0x1d17, 0x3288, "Haier Boyue G42", ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS), - SND_PCI_QUIRK(0x1d72, 0x1602, "RedmiBook", ALC255_FIXUP_XIAOMI_HEADSET_MIC), - SND_PCI_QUIRK(0x1d72, 0x1701, "XiaomiNotebook Pro", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE), -diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c -index f2cce15be4e271..68c82e344d3baf 100644 ---- a/sound/usb/mixer_quirks.c -+++ b/sound/usb/mixer_quirks.c -@@ -3631,9 +3631,11 @@ void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer, - snd_dragonfly_quirk_db_scale(mixer, cval, kctl); - break; - /* lowest playback value is muted on some devices */ -+ case USB_ID(0x0572, 0x1b09): /* Conexant Systems (Rockwell), Inc. */ - case USB_ID(0x0d8c, 0x000c): /* C-Media */ - case USB_ID(0x0d8c, 0x0014): /* C-Media */ - case USB_ID(0x19f7, 0x0003): /* RODE NT-USB */ -+ case USB_ID(0x2d99, 0x0026): /* HECATE G2 GAMING HEADSET */ - if (strstr(kctl->id.name, "Playback")) - cval->min_mute = 1; - break; -diff --git a/tools/gpio/Makefile b/tools/gpio/Makefile -index d29c9c49e2512a..342e056c8c665a 100644 ---- a/tools/gpio/Makefile -+++ b/tools/gpio/Makefile -@@ -77,8 +77,8 @@ $(OUTPUT)gpio-watch: $(GPIO_WATCH_IN) - - clean: - rm -f $(ALL_PROGRAMS) -- rm -f $(OUTPUT)include/linux/gpio.h -- find $(or $(OUTPUT),.) -name '*.o' -delete -o -name '\.*.d' -delete -+ rm -rf $(OUTPUT)include -+ find $(or $(OUTPUT),.) -name '*.o' -delete -o -name '\.*.d' -delete -o -name '\.*.cmd' -delete - - install: $(ALL_PROGRAMS) - install -d -m 755 $(DESTDIR)$(bindir); \ -diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c -index b94b4f16a60a54..1573d6b6478d28 100644 ---- a/tools/perf/util/bpf-event.c -+++ b/tools/perf/util/bpf-event.c -@@ -289,9 +289,15 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_session *session, - - info_node->info_linear = info_linear; - if (!perf_env__insert_bpf_prog_info(env, info_node)) { -- free(info_linear); -+ /* -+ * Insert failed, likely because of a duplicate event -+ * made by the sideband thread. Ignore synthesizing the -+ * metadata. -+ */ - free(info_node); -+ goto out; - } -+ /* info_linear is now owned by info_node and shouldn't be freed below. */ - info_linear = NULL; - - /* -@@ -447,18 +453,18 @@ int perf_event__synthesize_bpf_events(struct perf_session *session, - return err; - } - --static void perf_env__add_bpf_info(struct perf_env *env, u32 id) -+static int perf_env__add_bpf_info(struct perf_env *env, u32 id) - { - struct bpf_prog_info_node *info_node; - struct perf_bpil *info_linear; - struct btf *btf = NULL; - u64 arrays; - u32 btf_id; -- int fd; -+ int fd, err = 0; - - fd = bpf_prog_get_fd_by_id(id); - if (fd < 0) -- return; -+ return -EINVAL; - - arrays = 1UL << PERF_BPIL_JITED_KSYMS; - arrays |= 1UL << PERF_BPIL_JITED_FUNC_LENS; -@@ -471,6 +477,7 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id) - info_linear = get_bpf_prog_info_linear(fd, arrays); - if (IS_ERR_OR_NULL(info_linear)) { - pr_debug("%s: failed to get BPF program info. aborting\n", __func__); -+ err = PTR_ERR(info_linear); - goto out; - } - -@@ -480,38 +487,46 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id) - if (info_node) { - info_node->info_linear = info_linear; - if (!perf_env__insert_bpf_prog_info(env, info_node)) { -+ pr_debug("%s: duplicate add bpf info request for id %u\n", -+ __func__, btf_id); - free(info_linear); - free(info_node); -+ goto out; - } -- } else -+ } else { - free(info_linear); -+ err = -ENOMEM; -+ goto out; -+ } - - if (btf_id == 0) - goto out; - - btf = btf__load_from_kernel_by_id(btf_id); -- if (libbpf_get_error(btf)) { -- pr_debug("%s: failed to get BTF of id %u, aborting\n", -- __func__, btf_id); -- goto out; -+ if (!btf) { -+ err = -errno; -+ pr_debug("%s: failed to get BTF of id %u %d\n", __func__, btf_id, err); -+ } else { -+ perf_env__fetch_btf(env, btf_id, btf); - } -- perf_env__fetch_btf(env, btf_id, btf); - - out: - btf__free(btf); - close(fd); -+ return err; - } - - static int bpf_event__sb_cb(union perf_event *event, void *data) - { - struct perf_env *env = data; -+ int ret = 0; - - if (event->header.type != PERF_RECORD_BPF_EVENT) - return -1; - - switch (event->bpf.type) { - case PERF_BPF_EVENT_PROG_LOAD: -- perf_env__add_bpf_info(env, event->bpf.id); -+ ret = perf_env__add_bpf_info(env, event->bpf.id); - - case PERF_BPF_EVENT_PROG_UNLOAD: - /* -@@ -525,7 +540,7 @@ static int bpf_event__sb_cb(union perf_event *event, void *data) - break; - } - -- return 0; -+ return ret; - } - - int evlist__add_bpf_sb_event(struct evlist *evlist, struct perf_env *env) -diff --git a/tools/power/cpupower/utils/cpupower-set.c b/tools/power/cpupower/utils/cpupower-set.c -index 0677b58374abf1..59ace394cf3ef9 100644 ---- a/tools/power/cpupower/utils/cpupower-set.c -+++ b/tools/power/cpupower/utils/cpupower-set.c -@@ -62,8 +62,8 @@ int cmd_set(int argc, char **argv) - - params.params = 0; - /* parameter parsing */ -- while ((ret = getopt_long(argc, argv, "b:e:m:", -- set_opts, NULL)) != -1) { -+ while ((ret = getopt_long(argc, argv, "b:e:m:t:", -+ set_opts, NULL)) != -1) { - switch (ret) { - case 'b': - if (params.perf_bias) -diff --git a/tools/testing/selftests/net/bind_bhash.c b/tools/testing/selftests/net/bind_bhash.c -index 57ff67a3751eb3..da04b0b19b73ca 100644 ---- a/tools/testing/selftests/net/bind_bhash.c -+++ b/tools/testing/selftests/net/bind_bhash.c -@@ -75,7 +75,7 @@ static void *setup(void *arg) - int *array = (int *)arg; - - for (i = 0; i < MAX_CONNECTIONS; i++) { -- sock_fd = bind_socket(SO_REUSEADDR | SO_REUSEPORT, setup_addr); -+ sock_fd = bind_socket(SO_REUSEPORT, setup_addr); - if (sock_fd < 0) { - ret = sock_fd; - pthread_exit(&ret); -@@ -103,7 +103,7 @@ int main(int argc, const char *argv[]) - - setup_addr = use_v6 ? setup_addr_v6 : setup_addr_v4; - -- listener_fd = bind_socket(SO_REUSEADDR | SO_REUSEPORT, setup_addr); -+ listener_fd = bind_socket(SO_REUSEPORT, setup_addr); - if (listen(listener_fd, 100) < 0) { - perror("listen failed"); - return -1; diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.105-106.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.105-106.patch deleted file mode 100644 index 8695b9de35..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.105-106.patch +++ /dev/null @@ -1,744 +0,0 @@ -diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu -index 868ec736a9d235..cfa393c51f4d61 100644 ---- a/Documentation/ABI/testing/sysfs-devices-system-cpu -+++ b/Documentation/ABI/testing/sysfs-devices-system-cpu -@@ -528,6 +528,7 @@ What: /sys/devices/system/cpu/vulnerabilities - /sys/devices/system/cpu/vulnerabilities/srbds - /sys/devices/system/cpu/vulnerabilities/tsa - /sys/devices/system/cpu/vulnerabilities/tsx_async_abort -+ /sys/devices/system/cpu/vulnerabilities/vmscape - Date: January 2018 - Contact: Linux kernel mailing list - Description: Information about CPU vulnerabilities -diff --git a/Documentation/admin-guide/hw-vuln/index.rst b/Documentation/admin-guide/hw-vuln/index.rst -index d2caa390395e5b..5d6c001b8a988c 100644 ---- a/Documentation/admin-guide/hw-vuln/index.rst -+++ b/Documentation/admin-guide/hw-vuln/index.rst -@@ -23,3 +23,4 @@ are configurable at compile, boot or run time. - gather_data_sampling - reg-file-data-sampling - indirect-target-selection -+ vmscape -diff --git a/Documentation/admin-guide/hw-vuln/vmscape.rst b/Documentation/admin-guide/hw-vuln/vmscape.rst -new file mode 100644 -index 00000000000000..d9b9a2b6c114c0 ---- /dev/null -+++ b/Documentation/admin-guide/hw-vuln/vmscape.rst -@@ -0,0 +1,110 @@ -+.. SPDX-License-Identifier: GPL-2.0 -+ -+VMSCAPE -+======= -+ -+VMSCAPE is a vulnerability that may allow a guest to influence the branch -+prediction in host userspace. It particularly affects hypervisors like QEMU. -+ -+Even if a hypervisor may not have any sensitive data like disk encryption keys, -+guest-userspace may be able to attack the guest-kernel using the hypervisor as -+a confused deputy. -+ -+Affected processors -+------------------- -+ -+The following CPU families are affected by VMSCAPE: -+ -+**Intel processors:** -+ - Skylake generation (Parts without Enhanced-IBRS) -+ - Cascade Lake generation - (Parts affected by ITS guest/host separation) -+ - Alder Lake and newer (Parts affected by BHI) -+ -+Note that, BHI affected parts that use BHB clearing software mitigation e.g. -+Icelake are not vulnerable to VMSCAPE. -+ -+**AMD processors:** -+ - Zen series (families 0x17, 0x19, 0x1a) -+ -+** Hygon processors:** -+ - Family 0x18 -+ -+Mitigation -+---------- -+ -+Conditional IBPB -+---------------- -+ -+Kernel tracks when a CPU has run a potentially malicious guest and issues an -+IBPB before the first exit to userspace after VM-exit. If userspace did not run -+between VM-exit and the next VM-entry, no IBPB is issued. -+ -+Note that the existing userspace mitigation against Spectre-v2 is effective in -+protecting the userspace. They are insufficient to protect the userspace VMMs -+from a malicious guest. This is because Spectre-v2 mitigations are applied at -+context switch time, while the userspace VMM can run after a VM-exit without a -+context switch. -+ -+Vulnerability enumeration and mitigation is not applied inside a guest. This is -+because nested hypervisors should already be deploying IBPB to isolate -+themselves from nested guests. -+ -+SMT considerations -+------------------ -+ -+When Simultaneous Multi-Threading (SMT) is enabled, hypervisors can be -+vulnerable to cross-thread attacks. For complete protection against VMSCAPE -+attacks in SMT environments, STIBP should be enabled. -+ -+The kernel will issue a warning if SMT is enabled without adequate STIBP -+protection. Warning is not issued when: -+ -+- SMT is disabled -+- STIBP is enabled system-wide -+- Intel eIBRS is enabled (which implies STIBP protection) -+ -+System information and options -+------------------------------ -+ -+The sysfs file showing VMSCAPE mitigation status is: -+ -+ /sys/devices/system/cpu/vulnerabilities/vmscape -+ -+The possible values in this file are: -+ -+ * 'Not affected': -+ -+ The processor is not vulnerable to VMSCAPE attacks. -+ -+ * 'Vulnerable': -+ -+ The processor is vulnerable and no mitigation has been applied. -+ -+ * 'Mitigation: IBPB before exit to userspace': -+ -+ Conditional IBPB mitigation is enabled. The kernel tracks when a CPU has -+ run a potentially malicious guest and issues an IBPB before the first -+ exit to userspace after VM-exit. -+ -+ * 'Mitigation: IBPB on VMEXIT': -+ -+ IBPB is issued on every VM-exit. This occurs when other mitigations like -+ RETBLEED or SRSO are already issuing IBPB on VM-exit. -+ -+Mitigation control on the kernel command line -+---------------------------------------------- -+ -+The mitigation can be controlled via the ``vmscape=`` command line parameter: -+ -+ * ``vmscape=off``: -+ -+ Disable the VMSCAPE mitigation. -+ -+ * ``vmscape=ibpb``: -+ -+ Enable conditional IBPB mitigation (default when CONFIG_MITIGATION_VMSCAPE=y). -+ -+ * ``vmscape=force``: -+ -+ Force vulnerability detection and mitigation even on processors that are -+ not known to be affected. -diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt -index bcfa49019c3f16..60d48ebbc2cb00 100644 ---- a/Documentation/admin-guide/kernel-parameters.txt -+++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -3368,6 +3368,7 @@ - srbds=off [X86,INTEL] - ssbd=force-off [ARM64] - tsx_async_abort=off [X86] -+ vmscape=off [X86] - - Exceptions: - This does not have any effect on -@@ -7074,6 +7075,16 @@ - vmpoff= [KNL,S390] Perform z/VM CP command after power off. - Format: - -+ vmscape= [X86] Controls mitigation for VMscape attacks. -+ VMscape attacks can leak information from a userspace -+ hypervisor to a guest via speculative side-channels. -+ -+ off - disable the mitigation -+ ibpb - use Indirect Branch Prediction Barrier -+ (IBPB) mitigation (default) -+ force - force vulnerability detection even on -+ unaffected processors -+ - vsyscall= [X86-64] - Controls the behavior of vsyscalls (i.e. calls to - fixed addresses of 0xffffffffff600x00 from legacy -diff --git a/Makefile b/Makefile -index 2b7f67d7b641ce..b934846659eed0 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 105 -+SUBLEVEL = 106 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 2b5b7d9a24e98c..37e22efbd1e1e2 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -2630,6 +2630,15 @@ config MITIGATION_TSA - security vulnerability on AMD CPUs which can lead to forwarding of - invalid info to subsequent instructions and thus can affect their - timing and thereby cause a leakage. -+ -+config MITIGATION_VMSCAPE -+ bool "Mitigate VMSCAPE" -+ depends on KVM -+ default y -+ help -+ Enable mitigation for VMSCAPE attacks. VMSCAPE is a hardware security -+ vulnerability on Intel and AMD CPUs that may allow a guest to do -+ Spectre v2 style attacks on userspace hypervisor. - endif - - config ARCH_HAS_ADD_PAGES -diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h -index 199441d11fbbab..ae4ea1f9594f71 100644 ---- a/arch/x86/include/asm/cpufeatures.h -+++ b/arch/x86/include/asm/cpufeatures.h -@@ -475,6 +475,7 @@ - #define X86_FEATURE_TSA_SQ_NO (21*32+11) /* "" AMD CPU not vulnerable to TSA-SQ */ - #define X86_FEATURE_TSA_L1_NO (21*32+12) /* "" AMD CPU not vulnerable to TSA-L1 */ - #define X86_FEATURE_CLEAR_CPU_BUF_VM (21*32+13) /* "" Clear CPU buffers using VERW before VMRUN */ -+#define X86_FEATURE_IBPB_EXIT_TO_USER (21*32+14) /* Use IBPB on exit-to-userspace, see VMSCAPE bug */ - - /* - * BUG word(s) -@@ -528,4 +529,5 @@ - #define X86_BUG_ITS X86_BUG(1*32 + 5) /* CPU is affected by Indirect Target Selection */ - #define X86_BUG_ITS_NATIVE_ONLY X86_BUG(1*32 + 6) /* CPU is affected by ITS, VMX is not affected */ - #define X86_BUG_TSA X86_BUG(1*32+ 9) /* "tsa" CPU is affected by Transient Scheduler Attacks */ -+#define X86_BUG_VMSCAPE X86_BUG( 1*32+10) /* "vmscape" CPU is affected by VMSCAPE attacks from guests */ - #endif /* _ASM_X86_CPUFEATURES_H */ -diff --git a/arch/x86/include/asm/entry-common.h b/arch/x86/include/asm/entry-common.h -index fb2809b20b0ac4..bb0a5ecc807fe7 100644 ---- a/arch/x86/include/asm/entry-common.h -+++ b/arch/x86/include/asm/entry-common.h -@@ -83,6 +83,13 @@ static inline void arch_exit_to_user_mode_prepare(struct pt_regs *regs, - * 8 (ia32) bits. - */ - choose_random_kstack_offset(rdtsc()); -+ -+ /* Avoid unnecessary reads of 'x86_ibpb_exit_to_user' */ -+ if (cpu_feature_enabled(X86_FEATURE_IBPB_EXIT_TO_USER) && -+ this_cpu_read(x86_ibpb_exit_to_user)) { -+ indirect_branch_prediction_barrier(); -+ this_cpu_write(x86_ibpb_exit_to_user, false); -+ } - } - #define arch_exit_to_user_mode_prepare arch_exit_to_user_mode_prepare - -diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h -index 04f5a41c3a04ed..fb469ace38393f 100644 ---- a/arch/x86/include/asm/nospec-branch.h -+++ b/arch/x86/include/asm/nospec-branch.h -@@ -559,6 +559,8 @@ void alternative_msr_write(unsigned int msr, u64 val, unsigned int feature) - - extern u64 x86_pred_cmd; - -+DECLARE_PER_CPU(bool, x86_ibpb_exit_to_user); -+ - static inline void indirect_branch_prediction_barrier(void) - { - alternative_msr_write(MSR_IA32_PRED_CMD, x86_pred_cmd, X86_FEATURE_USE_IBPB); -diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c -index 332c6f24280dde..315926ccea0fa3 100644 ---- a/arch/x86/kernel/cpu/bugs.c -+++ b/arch/x86/kernel/cpu/bugs.c -@@ -51,6 +51,7 @@ static void __init srso_select_mitigation(void); - static void __init gds_select_mitigation(void); - static void __init its_select_mitigation(void); - static void __init tsa_select_mitigation(void); -+static void __init vmscape_select_mitigation(void); - - /* The base value of the SPEC_CTRL MSR without task-specific bits set */ - u64 x86_spec_ctrl_base; -@@ -60,6 +61,14 @@ EXPORT_SYMBOL_GPL(x86_spec_ctrl_base); - DEFINE_PER_CPU(u64, x86_spec_ctrl_current); - EXPORT_SYMBOL_GPL(x86_spec_ctrl_current); - -+/* -+ * Set when the CPU has run a potentially malicious guest. An IBPB will -+ * be needed to before running userspace. That IBPB will flush the branch -+ * predictor content. -+ */ -+DEFINE_PER_CPU(bool, x86_ibpb_exit_to_user); -+EXPORT_PER_CPU_SYMBOL_GPL(x86_ibpb_exit_to_user); -+ - u64 x86_pred_cmd __ro_after_init = PRED_CMD_IBPB; - EXPORT_SYMBOL_GPL(x86_pred_cmd); - -@@ -186,6 +195,7 @@ void __init cpu_select_mitigations(void) - gds_select_mitigation(); - its_select_mitigation(); - tsa_select_mitigation(); -+ vmscape_select_mitigation(); - } - - /* -@@ -2182,80 +2192,6 @@ static void __init tsa_select_mitigation(void) - pr_info("%s\n", tsa_strings[tsa_mitigation]); - } - --void cpu_bugs_smt_update(void) --{ -- mutex_lock(&spec_ctrl_mutex); -- -- if (sched_smt_active() && unprivileged_ebpf_enabled() && -- spectre_v2_enabled == SPECTRE_V2_EIBRS_LFENCE) -- pr_warn_once(SPECTRE_V2_EIBRS_LFENCE_EBPF_SMT_MSG); -- -- switch (spectre_v2_user_stibp) { -- case SPECTRE_V2_USER_NONE: -- break; -- case SPECTRE_V2_USER_STRICT: -- case SPECTRE_V2_USER_STRICT_PREFERRED: -- update_stibp_strict(); -- break; -- case SPECTRE_V2_USER_PRCTL: -- case SPECTRE_V2_USER_SECCOMP: -- update_indir_branch_cond(); -- break; -- } -- -- switch (mds_mitigation) { -- case MDS_MITIGATION_FULL: -- case MDS_MITIGATION_VMWERV: -- if (sched_smt_active() && !boot_cpu_has(X86_BUG_MSBDS_ONLY)) -- pr_warn_once(MDS_MSG_SMT); -- update_mds_branch_idle(); -- break; -- case MDS_MITIGATION_OFF: -- break; -- } -- -- switch (taa_mitigation) { -- case TAA_MITIGATION_VERW: -- case TAA_MITIGATION_UCODE_NEEDED: -- if (sched_smt_active()) -- pr_warn_once(TAA_MSG_SMT); -- break; -- case TAA_MITIGATION_TSX_DISABLED: -- case TAA_MITIGATION_OFF: -- break; -- } -- -- switch (mmio_mitigation) { -- case MMIO_MITIGATION_VERW: -- case MMIO_MITIGATION_UCODE_NEEDED: -- if (sched_smt_active()) -- pr_warn_once(MMIO_MSG_SMT); -- break; -- case MMIO_MITIGATION_OFF: -- break; -- } -- -- switch (tsa_mitigation) { -- case TSA_MITIGATION_USER_KERNEL: -- case TSA_MITIGATION_VM: -- case TSA_MITIGATION_FULL: -- case TSA_MITIGATION_UCODE_NEEDED: -- /* -- * TSA-SQ can potentially lead to info leakage between -- * SMT threads. -- */ -- if (sched_smt_active()) -- static_branch_enable(&cpu_buf_idle_clear); -- else -- static_branch_disable(&cpu_buf_idle_clear); -- break; -- case TSA_MITIGATION_NONE: -- break; -- } -- -- mutex_unlock(&spec_ctrl_mutex); --} -- - #undef pr_fmt - #define pr_fmt(fmt) "Speculative Store Bypass: " fmt - -@@ -2941,9 +2877,169 @@ static void __init srso_select_mitigation(void) - x86_pred_cmd = PRED_CMD_SBPB; - } - -+#undef pr_fmt -+#define pr_fmt(fmt) "VMSCAPE: " fmt -+ -+enum vmscape_mitigations { -+ VMSCAPE_MITIGATION_NONE, -+ VMSCAPE_MITIGATION_AUTO, -+ VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER, -+ VMSCAPE_MITIGATION_IBPB_ON_VMEXIT, -+}; -+ -+static const char * const vmscape_strings[] = { -+ [VMSCAPE_MITIGATION_NONE] = "Vulnerable", -+ /* [VMSCAPE_MITIGATION_AUTO] */ -+ [VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER] = "Mitigation: IBPB before exit to userspace", -+ [VMSCAPE_MITIGATION_IBPB_ON_VMEXIT] = "Mitigation: IBPB on VMEXIT", -+}; -+ -+static enum vmscape_mitigations vmscape_mitigation __ro_after_init = -+ IS_ENABLED(CONFIG_MITIGATION_VMSCAPE) ? VMSCAPE_MITIGATION_AUTO : VMSCAPE_MITIGATION_NONE; -+ -+static int __init vmscape_parse_cmdline(char *str) -+{ -+ if (!str) -+ return -EINVAL; -+ -+ if (!strcmp(str, "off")) { -+ vmscape_mitigation = VMSCAPE_MITIGATION_NONE; -+ } else if (!strcmp(str, "ibpb")) { -+ vmscape_mitigation = VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER; -+ } else if (!strcmp(str, "force")) { -+ setup_force_cpu_bug(X86_BUG_VMSCAPE); -+ vmscape_mitigation = VMSCAPE_MITIGATION_AUTO; -+ } else { -+ pr_err("Ignoring unknown vmscape=%s option.\n", str); -+ } -+ -+ return 0; -+} -+early_param("vmscape", vmscape_parse_cmdline); -+ -+static void __init vmscape_select_mitigation(void) -+{ -+ if (cpu_mitigations_off() || -+ !boot_cpu_has_bug(X86_BUG_VMSCAPE) || -+ !boot_cpu_has(X86_FEATURE_IBPB)) { -+ vmscape_mitigation = VMSCAPE_MITIGATION_NONE; -+ return; -+ } -+ -+ if (vmscape_mitigation == VMSCAPE_MITIGATION_AUTO) -+ vmscape_mitigation = VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER; -+ -+ if (retbleed_mitigation == RETBLEED_MITIGATION_IBPB || -+ srso_mitigation == SRSO_MITIGATION_IBPB_ON_VMEXIT) -+ vmscape_mitigation = VMSCAPE_MITIGATION_IBPB_ON_VMEXIT; -+ -+ if (vmscape_mitigation == VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER) -+ setup_force_cpu_cap(X86_FEATURE_IBPB_EXIT_TO_USER); -+ -+ pr_info("%s\n", vmscape_strings[vmscape_mitigation]); -+} -+ - #undef pr_fmt - #define pr_fmt(fmt) fmt - -+#define VMSCAPE_MSG_SMT "VMSCAPE: SMT on, STIBP is required for full protection. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/vmscape.html for more details.\n" -+ -+void cpu_bugs_smt_update(void) -+{ -+ mutex_lock(&spec_ctrl_mutex); -+ -+ if (sched_smt_active() && unprivileged_ebpf_enabled() && -+ spectre_v2_enabled == SPECTRE_V2_EIBRS_LFENCE) -+ pr_warn_once(SPECTRE_V2_EIBRS_LFENCE_EBPF_SMT_MSG); -+ -+ switch (spectre_v2_user_stibp) { -+ case SPECTRE_V2_USER_NONE: -+ break; -+ case SPECTRE_V2_USER_STRICT: -+ case SPECTRE_V2_USER_STRICT_PREFERRED: -+ update_stibp_strict(); -+ break; -+ case SPECTRE_V2_USER_PRCTL: -+ case SPECTRE_V2_USER_SECCOMP: -+ update_indir_branch_cond(); -+ break; -+ } -+ -+ switch (mds_mitigation) { -+ case MDS_MITIGATION_FULL: -+ case MDS_MITIGATION_VMWERV: -+ if (sched_smt_active() && !boot_cpu_has(X86_BUG_MSBDS_ONLY)) -+ pr_warn_once(MDS_MSG_SMT); -+ update_mds_branch_idle(); -+ break; -+ case MDS_MITIGATION_OFF: -+ break; -+ } -+ -+ switch (taa_mitigation) { -+ case TAA_MITIGATION_VERW: -+ case TAA_MITIGATION_UCODE_NEEDED: -+ if (sched_smt_active()) -+ pr_warn_once(TAA_MSG_SMT); -+ break; -+ case TAA_MITIGATION_TSX_DISABLED: -+ case TAA_MITIGATION_OFF: -+ break; -+ } -+ -+ switch (mmio_mitigation) { -+ case MMIO_MITIGATION_VERW: -+ case MMIO_MITIGATION_UCODE_NEEDED: -+ if (sched_smt_active()) -+ pr_warn_once(MMIO_MSG_SMT); -+ break; -+ case MMIO_MITIGATION_OFF: -+ break; -+ } -+ -+ switch (tsa_mitigation) { -+ case TSA_MITIGATION_USER_KERNEL: -+ case TSA_MITIGATION_VM: -+ case TSA_MITIGATION_FULL: -+ case TSA_MITIGATION_UCODE_NEEDED: -+ /* -+ * TSA-SQ can potentially lead to info leakage between -+ * SMT threads. -+ */ -+ if (sched_smt_active()) -+ static_branch_enable(&cpu_buf_idle_clear); -+ else -+ static_branch_disable(&cpu_buf_idle_clear); -+ break; -+ case TSA_MITIGATION_NONE: -+ break; -+ } -+ -+ switch (vmscape_mitigation) { -+ case VMSCAPE_MITIGATION_NONE: -+ case VMSCAPE_MITIGATION_AUTO: -+ break; -+ case VMSCAPE_MITIGATION_IBPB_ON_VMEXIT: -+ case VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER: -+ /* -+ * Hypervisors can be attacked across-threads, warn for SMT when -+ * STIBP is not already enabled system-wide. -+ * -+ * Intel eIBRS (!AUTOIBRS) implies STIBP on. -+ */ -+ if (!sched_smt_active() || -+ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT || -+ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED || -+ (spectre_v2_in_eibrs_mode(spectre_v2_enabled) && -+ !boot_cpu_has(X86_FEATURE_AUTOIBRS))) -+ break; -+ pr_warn_once(VMSCAPE_MSG_SMT); -+ break; -+ } -+ -+ mutex_unlock(&spec_ctrl_mutex); -+} -+ - #ifdef CONFIG_SYSFS - - #define L1TF_DEFAULT_MSG "Mitigation: PTE Inversion" -@@ -3187,6 +3283,11 @@ static ssize_t tsa_show_state(char *buf) - return sysfs_emit(buf, "%s\n", tsa_strings[tsa_mitigation]); - } - -+static ssize_t vmscape_show_state(char *buf) -+{ -+ return sysfs_emit(buf, "%s\n", vmscape_strings[vmscape_mitigation]); -+} -+ - static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr, - char *buf, unsigned int bug) - { -@@ -3251,6 +3352,9 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr - case X86_BUG_TSA: - return tsa_show_state(buf); - -+ case X86_BUG_VMSCAPE: -+ return vmscape_show_state(buf); -+ - default: - break; - } -@@ -3340,4 +3444,9 @@ ssize_t cpu_show_tsa(struct device *dev, struct device_attribute *attr, char *bu - { - return cpu_show_common(dev, attr, buf, X86_BUG_TSA); - } -+ -+ssize_t cpu_show_vmscape(struct device *dev, struct device_attribute *attr, char *buf) -+{ -+ return cpu_show_common(dev, attr, buf, X86_BUG_VMSCAPE); -+} - #endif -diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index f66c71bffa6d93..cf455968f27b69 100644 ---- a/arch/x86/kernel/cpu/common.c -+++ b/arch/x86/kernel/cpu/common.c -@@ -1279,54 +1279,68 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = { - #define ITS_NATIVE_ONLY BIT(9) - /* CPU is affected by Transient Scheduler Attacks */ - #define TSA BIT(10) -+/* CPU is affected by VMSCAPE */ -+#define VMSCAPE BIT(11) - - static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = { -- VULNBL_INTEL_STEPPINGS(IVYBRIDGE, X86_STEPPING_ANY, SRBDS), -- VULNBL_INTEL_STEPPINGS(HASWELL, X86_STEPPING_ANY, SRBDS), -- VULNBL_INTEL_STEPPINGS(HASWELL_L, X86_STEPPING_ANY, SRBDS), -- VULNBL_INTEL_STEPPINGS(HASWELL_G, X86_STEPPING_ANY, SRBDS), -- VULNBL_INTEL_STEPPINGS(HASWELL_X, X86_STEPPING_ANY, MMIO), -- VULNBL_INTEL_STEPPINGS(BROADWELL_D, X86_STEPPING_ANY, MMIO), -- VULNBL_INTEL_STEPPINGS(BROADWELL_G, X86_STEPPING_ANY, SRBDS), -- VULNBL_INTEL_STEPPINGS(BROADWELL_X, X86_STEPPING_ANY, MMIO), -- VULNBL_INTEL_STEPPINGS(BROADWELL, X86_STEPPING_ANY, SRBDS), -- VULNBL_INTEL_STEPPINGS(SKYLAKE_X, X86_STEPPINGS(0x0, 0x5), MMIO | RETBLEED | GDS), -- VULNBL_INTEL_STEPPINGS(SKYLAKE_X, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | ITS), -- VULNBL_INTEL_STEPPINGS(SKYLAKE_L, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS), -- VULNBL_INTEL_STEPPINGS(SKYLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS), -- VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPINGS(0x0, 0xb), MMIO | RETBLEED | GDS | SRBDS), -- VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS | ITS), -- VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPINGS(0x0, 0xc), MMIO | RETBLEED | GDS | SRBDS), -- VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS | ITS), -- VULNBL_INTEL_STEPPINGS(CANNONLAKE_L, X86_STEPPING_ANY, RETBLEED), -+ VULNBL_INTEL_STEPPINGS(SANDYBRIDGE_X, X86_STEPPING_ANY, VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(SANDYBRIDGE, X86_STEPPING_ANY, VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(IVYBRIDGE_X, X86_STEPPING_ANY, VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(IVYBRIDGE, X86_STEPPING_ANY, SRBDS | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(HASWELL, X86_STEPPING_ANY, SRBDS | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(HASWELL_L, X86_STEPPING_ANY, SRBDS | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(HASWELL_G, X86_STEPPING_ANY, SRBDS | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(HASWELL_X, X86_STEPPING_ANY, MMIO | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(BROADWELL_D, X86_STEPPING_ANY, MMIO | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(BROADWELL_X, X86_STEPPING_ANY, MMIO | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(BROADWELL_G, X86_STEPPING_ANY, SRBDS | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(BROADWELL, X86_STEPPING_ANY, SRBDS | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(SKYLAKE_X, X86_STEPPINGS(0x0, 0x5), MMIO | RETBLEED | GDS | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(SKYLAKE_X, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | ITS | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(SKYLAKE_L, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(SKYLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPINGS(0x0, 0xb), MMIO | RETBLEED | GDS | SRBDS | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS | ITS | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPINGS(0x0, 0xc), MMIO | RETBLEED | GDS | SRBDS | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS | ITS | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(CANNONLAKE_L, X86_STEPPING_ANY, RETBLEED | VMSCAPE), - VULNBL_INTEL_STEPPINGS(ICELAKE_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS | ITS | ITS_NATIVE_ONLY), - VULNBL_INTEL_STEPPINGS(ICELAKE_D, X86_STEPPING_ANY, MMIO | GDS | ITS | ITS_NATIVE_ONLY), - VULNBL_INTEL_STEPPINGS(ICELAKE_X, X86_STEPPING_ANY, MMIO | GDS | ITS | ITS_NATIVE_ONLY), -- VULNBL_INTEL_STEPPINGS(COMETLAKE, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS | ITS), -- VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPINGS(0x0, 0x0), MMIO | RETBLEED | ITS), -- VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS | ITS), -+ VULNBL_INTEL_STEPPINGS(COMETLAKE, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS | ITS | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPINGS(0x0, 0x0), MMIO | RETBLEED | ITS | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS | ITS | VMSCAPE), - VULNBL_INTEL_STEPPINGS(TIGERLAKE_L, X86_STEPPING_ANY, GDS | ITS | ITS_NATIVE_ONLY), - VULNBL_INTEL_STEPPINGS(TIGERLAKE, X86_STEPPING_ANY, GDS | ITS | ITS_NATIVE_ONLY), - VULNBL_INTEL_STEPPINGS(LAKEFIELD, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED), - VULNBL_INTEL_STEPPINGS(ROCKETLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | ITS | ITS_NATIVE_ONLY), -- VULNBL_INTEL_STEPPINGS(ALDERLAKE, X86_STEPPING_ANY, RFDS), -- VULNBL_INTEL_STEPPINGS(ALDERLAKE_L, X86_STEPPING_ANY, RFDS), -- VULNBL_INTEL_STEPPINGS(RAPTORLAKE, X86_STEPPING_ANY, RFDS), -- VULNBL_INTEL_STEPPINGS(RAPTORLAKE_P, X86_STEPPING_ANY, RFDS), -- VULNBL_INTEL_STEPPINGS(RAPTORLAKE_S, X86_STEPPING_ANY, RFDS), -- VULNBL_INTEL_STEPPINGS(ATOM_GRACEMONT, X86_STEPPING_ANY, RFDS), -+ VULNBL_INTEL_STEPPINGS(ALDERLAKE, X86_STEPPING_ANY, RFDS | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(ALDERLAKE_L, X86_STEPPING_ANY, RFDS | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(RAPTORLAKE, X86_STEPPING_ANY, RFDS | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(RAPTORLAKE_P, X86_STEPPING_ANY, RFDS | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(RAPTORLAKE_S, X86_STEPPING_ANY, RFDS | VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(METEORLAKE_L, X86_STEPPING_ANY, VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(ARROWLAKE_H, X86_STEPPING_ANY, VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(ARROWLAKE, X86_STEPPING_ANY, VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(ARROWLAKE_U, X86_STEPPING_ANY, VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(LUNARLAKE_M, X86_STEPPING_ANY, VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(SAPPHIRERAPIDS_X,X86_STEPPING_ANY, VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(GRANITERAPIDS_X, X86_STEPPING_ANY, VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(EMERALDRAPIDS_X, X86_STEPPING_ANY, VMSCAPE), -+ VULNBL_INTEL_STEPPINGS(ATOM_GRACEMONT, X86_STEPPING_ANY, RFDS | VMSCAPE), - VULNBL_INTEL_STEPPINGS(ATOM_TREMONT, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RFDS), - VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_D, X86_STEPPING_ANY, MMIO | RFDS), - VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RFDS), - VULNBL_INTEL_STEPPINGS(ATOM_GOLDMONT, X86_STEPPING_ANY, RFDS), - VULNBL_INTEL_STEPPINGS(ATOM_GOLDMONT_D, X86_STEPPING_ANY, RFDS), - VULNBL_INTEL_STEPPINGS(ATOM_GOLDMONT_PLUS, X86_STEPPING_ANY, RFDS), -+ VULNBL_INTEL_STEPPINGS(ATOM_CRESTMONT_X, X86_STEPPING_ANY, VMSCAPE), - - VULNBL_AMD(0x15, RETBLEED), - VULNBL_AMD(0x16, RETBLEED), -- VULNBL_AMD(0x17, RETBLEED | SMT_RSB | SRSO), -- VULNBL_HYGON(0x18, RETBLEED | SMT_RSB | SRSO), -- VULNBL_AMD(0x19, SRSO | TSA), -+ VULNBL_AMD(0x17, RETBLEED | SMT_RSB | SRSO | VMSCAPE), -+ VULNBL_HYGON(0x18, RETBLEED | SMT_RSB | SRSO | VMSCAPE), -+ VULNBL_AMD(0x19, SRSO | TSA | VMSCAPE), - {} - }; - -@@ -1541,6 +1555,14 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c) - } - } - -+ /* -+ * Set the bug only on bare-metal. A nested hypervisor should already be -+ * deploying IBPB to isolate itself from nested guests. -+ */ -+ if (cpu_matches(cpu_vuln_blacklist, VMSCAPE) && -+ !boot_cpu_has(X86_FEATURE_HYPERVISOR)) -+ setup_force_cpu_bug(X86_BUG_VMSCAPE); -+ - if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN)) - return; - -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 5088065ac704be..7238686a49bb5a 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -10864,6 +10864,15 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) - if (vcpu->arch.guest_fpu.xfd_err) - wrmsrl(MSR_IA32_XFD_ERR, 0); - -+ /* -+ * Mark this CPU as needing a branch predictor flush before running -+ * userspace. Must be done before enabling preemption to ensure it gets -+ * set for the CPU that actually ran the guest, and not the CPU that it -+ * may migrate to. -+ */ -+ if (cpu_feature_enabled(X86_FEATURE_IBPB_EXIT_TO_USER)) -+ this_cpu_write(x86_ibpb_exit_to_user, true); -+ - /* - * Consume any pending interrupts, including the possible source of - * VM-Exit on SVM and any ticks that occur between VM-Exit and now. -diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c -index a3aea3c1431aa9..801a4b4f90260b 100644 ---- a/drivers/base/cpu.c -+++ b/drivers/base/cpu.c -@@ -568,6 +568,7 @@ CPU_SHOW_VULN_FALLBACK(gds); - CPU_SHOW_VULN_FALLBACK(reg_file_data_sampling); - CPU_SHOW_VULN_FALLBACK(indirect_target_selection); - CPU_SHOW_VULN_FALLBACK(tsa); -+CPU_SHOW_VULN_FALLBACK(vmscape); - - static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); - static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL); -@@ -585,6 +586,7 @@ static DEVICE_ATTR(gather_data_sampling, 0444, cpu_show_gds, NULL); - static DEVICE_ATTR(reg_file_data_sampling, 0444, cpu_show_reg_file_data_sampling, NULL); - static DEVICE_ATTR(indirect_target_selection, 0444, cpu_show_indirect_target_selection, NULL); - static DEVICE_ATTR(tsa, 0444, cpu_show_tsa, NULL); -+static DEVICE_ATTR(vmscape, 0444, cpu_show_vmscape, NULL); - - static struct attribute *cpu_root_vulnerabilities_attrs[] = { - &dev_attr_meltdown.attr, -@@ -603,6 +605,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = { - &dev_attr_reg_file_data_sampling.attr, - &dev_attr_indirect_target_selection.attr, - &dev_attr_tsa.attr, -+ &dev_attr_vmscape.attr, - NULL - }; - -diff --git a/include/linux/cpu.h b/include/linux/cpu.h -index 6b4f9f16968821..1e3d1b2ac4c1da 100644 ---- a/include/linux/cpu.h -+++ b/include/linux/cpu.h -@@ -80,6 +80,7 @@ extern ssize_t cpu_show_reg_file_data_sampling(struct device *dev, - extern ssize_t cpu_show_indirect_target_selection(struct device *dev, - struct device_attribute *attr, char *buf); - extern ssize_t cpu_show_tsa(struct device *dev, struct device_attribute *attr, char *buf); -+extern ssize_t cpu_show_vmscape(struct device *dev, struct device_attribute *attr, char *buf); - - extern __printf(4, 5) - struct device *cpu_device_create(struct device *parent, void *drvdata, diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.106-107.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.106-107.patch deleted file mode 100644 index 4e1e6afea7..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.106-107.patch +++ /dev/null @@ -1,3614 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/serial/brcm,bcm7271-uart.yaml b/Documentation/devicetree/bindings/serial/brcm,bcm7271-uart.yaml -index 89c462653e2d33..8cc848ae11cb73 100644 ---- a/Documentation/devicetree/bindings/serial/brcm,bcm7271-uart.yaml -+++ b/Documentation/devicetree/bindings/serial/brcm,bcm7271-uart.yaml -@@ -41,7 +41,7 @@ properties: - - const: dma_intr2 - - clocks: -- minItems: 1 -+ maxItems: 1 - - clock-names: - const: sw_baud -diff --git a/Documentation/networking/can.rst b/Documentation/networking/can.rst -index d7e1ada905b2d3..3bdd1558381057 100644 ---- a/Documentation/networking/can.rst -+++ b/Documentation/networking/can.rst -@@ -740,7 +740,7 @@ The broadcast manager sends responses to user space in the same form: - struct timeval ival1, ival2; /* count and subsequent interval */ - canid_t can_id; /* unique can_id for task */ - __u32 nframes; /* number of can_frames following */ -- struct can_frame frames[0]; -+ struct can_frame frames[]; - }; - - The aligned payload 'frames' uses the same basic CAN frame structure defined -diff --git a/Makefile b/Makefile -index b934846659eed0..9c9e272f48b879 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 106 -+SUBLEVEL = 107 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/riscv/include/asm/compat.h b/arch/riscv/include/asm/compat.h -index 2ac955b51148f4..6b79287baecc00 100644 ---- a/arch/riscv/include/asm/compat.h -+++ b/arch/riscv/include/asm/compat.h -@@ -9,7 +9,6 @@ - */ - #include - #include --#include - #include - - static inline int is_compat_task(void) -diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c -index 65a66df5bb865e..771e1cb17540db 100644 ---- a/arch/s390/kernel/perf_cpum_cf.c -+++ b/arch/s390/kernel/perf_cpum_cf.c -@@ -757,8 +757,6 @@ static int __hw_perf_event_init(struct perf_event *event, unsigned int type) - break; - - case PERF_TYPE_HARDWARE: -- if (is_sampling_event(event)) /* No sampling support */ -- return -ENOENT; - ev = attr->config; - if (!attr->exclude_user && attr->exclude_kernel) { - /* -@@ -856,6 +854,8 @@ static int cpumf_pmu_event_init(struct perf_event *event) - unsigned int type = event->attr.type; - int err; - -+ if (is_sampling_event(event)) /* No sampling support */ -+ return err; - if (type == PERF_TYPE_HARDWARE || type == PERF_TYPE_RAW) - err = __hw_perf_event_init(event, type); - else if (event->pmu->type == type) -diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S -index c57d5df1abc603..0929d7fe7e2740 100644 ---- a/arch/x86/kernel/vmlinux.lds.S -+++ b/arch/x86/kernel/vmlinux.lds.S -@@ -500,10 +500,18 @@ SECTIONS - PROVIDE(__ref_stack_chk_guard = __stack_chk_guard); - - /* -- * The ASSERT() sink to . is intentional, for binutils 2.14 compatibility: -+ * COMPILE_TEST kernels can be large - CONFIG_KASAN, for example, can cause -+ * this. Let's assume that nobody will be running a COMPILE_TEST kernel and -+ * let's assert that fuller build coverage is more valuable than being able to -+ * run a COMPILE_TEST kernel. -+ */ -+#ifndef CONFIG_COMPILE_TEST -+/* -+ * The ASSERT() sync to . is intentional, for binutils 2.14 compatibility: - */ - . = ASSERT((_end - LOAD_OFFSET <= KERNEL_IMAGE_SIZE), - "kernel image bigger than KERNEL_IMAGE_SIZE"); -+#endif - - #ifdef CONFIG_X86_64 - /* -diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c -index 288db351677222..2c0bc6a93ec3e8 100644 ---- a/arch/x86/kvm/cpuid.c -+++ b/arch/x86/kvm/cpuid.c -@@ -791,10 +791,15 @@ void kvm_set_cpu_caps(void) - F(PERFMON_V2) - ); - -+ kvm_cpu_cap_check_and_set(X86_FEATURE_VERW_CLEAR); -+ - kvm_cpu_cap_init_kvm_defined(CPUID_8000_0021_ECX, - F(TSA_SQ_NO) | F(TSA_L1_NO) - ); - -+ kvm_cpu_cap_check_and_set(X86_FEATURE_TSA_SQ_NO); -+ kvm_cpu_cap_check_and_set(X86_FEATURE_TSA_L1_NO); -+ - /* - * Synthesize "LFENCE is serializing" into the AMD-defined entry in - * KVM's supported CPUID if the feature is reported as supported by the -diff --git a/drivers/dma/dw/rzn1-dmamux.c b/drivers/dma/dw/rzn1-dmamux.c -index 4fb8508419dbd8..deadf135681b67 100644 ---- a/drivers/dma/dw/rzn1-dmamux.c -+++ b/drivers/dma/dw/rzn1-dmamux.c -@@ -48,12 +48,16 @@ static void *rzn1_dmamux_route_allocate(struct of_phandle_args *dma_spec, - u32 mask; - int ret; - -- if (dma_spec->args_count != RNZ1_DMAMUX_NCELLS) -- return ERR_PTR(-EINVAL); -+ if (dma_spec->args_count != RNZ1_DMAMUX_NCELLS) { -+ ret = -EINVAL; -+ goto put_device; -+ } - - map = kzalloc(sizeof(*map), GFP_KERNEL); -- if (!map) -- return ERR_PTR(-ENOMEM); -+ if (!map) { -+ ret = -ENOMEM; -+ goto put_device; -+ } - - chan = dma_spec->args[0]; - map->req_idx = dma_spec->args[4]; -@@ -94,12 +98,15 @@ static void *rzn1_dmamux_route_allocate(struct of_phandle_args *dma_spec, - if (ret) - goto clear_bitmap; - -+ put_device(&pdev->dev); - return map; - - clear_bitmap: - clear_bit(map->req_idx, dmamux->used_chans); - free_map: - kfree(map); -+put_device: -+ put_device(&pdev->dev); - - return ERR_PTR(ret); - } -diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c -index 92e86ae9db29d7..4b999c5802f4b2 100644 ---- a/drivers/dma/idxd/init.c -+++ b/drivers/dma/idxd/init.c -@@ -179,27 +179,30 @@ static int idxd_setup_wqs(struct idxd_device *idxd) - idxd->wq_enable_map = bitmap_zalloc_node(idxd->max_wqs, GFP_KERNEL, dev_to_node(dev)); - if (!idxd->wq_enable_map) { - rc = -ENOMEM; -- goto err_bitmap; -+ goto err_free_wqs; - } - - for (i = 0; i < idxd->max_wqs; i++) { - wq = kzalloc_node(sizeof(*wq), GFP_KERNEL, dev_to_node(dev)); - if (!wq) { - rc = -ENOMEM; -- goto err; -+ goto err_unwind; - } - - idxd_dev_set_type(&wq->idxd_dev, IDXD_DEV_WQ); - conf_dev = wq_confdev(wq); - wq->id = i; - wq->idxd = idxd; -- device_initialize(wq_confdev(wq)); -+ device_initialize(conf_dev); - conf_dev->parent = idxd_confdev(idxd); - conf_dev->bus = &dsa_bus_type; - conf_dev->type = &idxd_wq_device_type; - rc = dev_set_name(conf_dev, "wq%d.%d", idxd->id, wq->id); -- if (rc < 0) -- goto err; -+ if (rc < 0) { -+ put_device(conf_dev); -+ kfree(wq); -+ goto err_unwind; -+ } - - mutex_init(&wq->wq_lock); - init_waitqueue_head(&wq->err_queue); -@@ -210,15 +213,20 @@ static int idxd_setup_wqs(struct idxd_device *idxd) - wq->enqcmds_retries = IDXD_ENQCMDS_RETRIES; - wq->wqcfg = kzalloc_node(idxd->wqcfg_size, GFP_KERNEL, dev_to_node(dev)); - if (!wq->wqcfg) { -+ put_device(conf_dev); -+ kfree(wq); - rc = -ENOMEM; -- goto err; -+ goto err_unwind; - } - - if (idxd->hw.wq_cap.op_config) { - wq->opcap_bmap = bitmap_zalloc(IDXD_MAX_OPCAP_BITS, GFP_KERNEL); - if (!wq->opcap_bmap) { -+ kfree(wq->wqcfg); -+ put_device(conf_dev); -+ kfree(wq); - rc = -ENOMEM; -- goto err_opcap_bmap; -+ goto err_unwind; - } - bitmap_copy(wq->opcap_bmap, idxd->opcap_bmap, IDXD_MAX_OPCAP_BITS); - } -@@ -229,13 +237,7 @@ static int idxd_setup_wqs(struct idxd_device *idxd) - - return 0; - --err_opcap_bmap: -- kfree(wq->wqcfg); -- --err: -- put_device(conf_dev); -- kfree(wq); -- -+err_unwind: - while (--i >= 0) { - wq = idxd->wqs[i]; - if (idxd->hw.wq_cap.op_config) -@@ -244,11 +246,10 @@ static int idxd_setup_wqs(struct idxd_device *idxd) - conf_dev = wq_confdev(wq); - put_device(conf_dev); - kfree(wq); -- - } - bitmap_free(idxd->wq_enable_map); - --err_bitmap: -+err_free_wqs: - kfree(idxd->wqs); - - return rc; -@@ -904,10 +905,12 @@ static void idxd_remove(struct pci_dev *pdev) - device_unregister(idxd_confdev(idxd)); - idxd_shutdown(pdev); - idxd_device_remove_debugfs(idxd); -- idxd_cleanup(idxd); -+ perfmon_pmu_remove(idxd); -+ idxd_cleanup_interrupts(idxd); -+ if (device_pasid_enabled(idxd)) -+ idxd_disable_system_pasid(idxd); - pci_iounmap(pdev, idxd->reg_base); - put_device(idxd_confdev(idxd)); -- idxd_free(idxd); - pci_disable_device(pdev); - } - -diff --git a/drivers/dma/qcom/bam_dma.c b/drivers/dma/qcom/bam_dma.c -index 4c3eb972039d60..d5882c8537e52b 100644 ---- a/drivers/dma/qcom/bam_dma.c -+++ b/drivers/dma/qcom/bam_dma.c -@@ -1283,13 +1283,17 @@ static int bam_dma_probe(struct platform_device *pdev) - if (!bdev->bamclk) { - ret = of_property_read_u32(pdev->dev.of_node, "num-channels", - &bdev->num_channels); -- if (ret) -+ if (ret) { - dev_err(bdev->dev, "num-channels unspecified in dt\n"); -+ return ret; -+ } - - ret = of_property_read_u32(pdev->dev.of_node, "qcom,num-ees", - &bdev->num_ees); -- if (ret) -+ if (ret) { - dev_err(bdev->dev, "num-ees unspecified in dt\n"); -+ return ret; -+ } - } - - ret = clk_prepare_enable(bdev->bamclk); -diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c -index c0fa5413246756..f7ddf588b7f9b7 100644 ---- a/drivers/dma/ti/edma.c -+++ b/drivers/dma/ti/edma.c -@@ -2063,8 +2063,8 @@ static int edma_setup_from_hw(struct device *dev, struct edma_soc_info *pdata, - * priority. So Q0 is the highest priority queue and the last queue has - * the lowest priority. - */ -- queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8), -- GFP_KERNEL); -+ queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, -+ sizeof(*queue_priority_map), GFP_KERNEL); - if (!queue_priority_map) - return -ENOMEM; - -diff --git a/drivers/edac/altera_edac.c b/drivers/edac/altera_edac.c -index 54ec894150939a..233e58278943e0 100644 ---- a/drivers/edac/altera_edac.c -+++ b/drivers/edac/altera_edac.c -@@ -127,7 +127,6 @@ static ssize_t altr_sdr_mc_err_inject_write(struct file *file, - - ptemp = dma_alloc_coherent(mci->pdev, 16, &dma_handle, GFP_KERNEL); - if (!ptemp) { -- dma_free_coherent(mci->pdev, 16, ptemp, dma_handle); - edac_printk(KERN_ERR, EDAC_MC, - "Inject: Buffer Allocation error\n"); - return -ENOMEM; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c -index f44b303ae287a7..eebac2e1a6c75b 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c -@@ -396,9 +396,6 @@ void amdgpu_ring_fini(struct amdgpu_ring *ring) - dma_fence_put(ring->vmid_wait); - ring->vmid_wait = NULL; - ring->me = 0; -- -- if (!ring->is_mes_queue) -- ring->adev->rings[ring->idx] = NULL; - } - - /** -diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c -index a61ecefdafc512..710328f12194d3 100644 ---- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c -@@ -1765,15 +1765,19 @@ static int vcn_v3_0_limit_sched(struct amdgpu_cs_parser *p, - struct amdgpu_job *job) - { - struct drm_gpu_scheduler **scheds; -- -- /* The create msg must be in the first IB submitted */ -- if (atomic_read(&job->base.entity->fence_seq)) -- return -EINVAL; -+ struct dma_fence *fence; - - /* if VCN0 is harvested, we can't support AV1 */ - if (p->adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0) - return -EINVAL; - -+ /* wait for all jobs to finish before switching to instance 0 */ -+ fence = amdgpu_ctx_get_fence(p->ctx, job->base.entity, ~0ull); -+ if (fence) { -+ dma_fence_wait(fence, false); -+ dma_fence_put(fence); -+ } -+ - scheds = p->adev->gpu_sched[AMDGPU_HW_IP_VCN_DEC] - [AMDGPU_RING_PRIO_DEFAULT].sched; - drm_sched_entity_modify_sched(job->base.entity, scheds, 1); -diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c -index 29164289c5f3e1..43249e9f66d74d 100644 ---- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c -@@ -1644,15 +1644,19 @@ static int vcn_v4_0_limit_sched(struct amdgpu_cs_parser *p, - struct amdgpu_job *job) - { - struct drm_gpu_scheduler **scheds; -- -- /* The create msg must be in the first IB submitted */ -- if (atomic_read(&job->base.entity->fence_seq)) -- return -EINVAL; -+ struct dma_fence *fence; - - /* if VCN0 is harvested, we can't support AV1 */ - if (p->adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0) - return -EINVAL; - -+ /* wait for all jobs to finish before switching to instance 0 */ -+ fence = amdgpu_ctx_get_fence(p->ctx, job->base.entity, ~0ull); -+ if (fence) { -+ dma_fence_wait(fence, false); -+ dma_fence_put(fence); -+ } -+ - scheds = p->adev->gpu_sched[AMDGPU_HW_IP_VCN_ENC] - [AMDGPU_RING_PRIO_0].sched; - drm_sched_entity_modify_sched(job->base.entity, scheds, 1); -@@ -1743,22 +1747,16 @@ static int vcn_v4_0_dec_msg(struct amdgpu_cs_parser *p, struct amdgpu_job *job, - - #define RADEON_VCN_ENGINE_TYPE_ENCODE (0x00000002) - #define RADEON_VCN_ENGINE_TYPE_DECODE (0x00000003) -- - #define RADEON_VCN_ENGINE_INFO (0x30000001) --#define RADEON_VCN_ENGINE_INFO_MAX_OFFSET 16 -- - #define RENCODE_ENCODE_STANDARD_AV1 2 - #define RENCODE_IB_PARAM_SESSION_INIT 0x00000003 --#define RENCODE_IB_PARAM_SESSION_INIT_MAX_OFFSET 64 - --/* return the offset in ib if id is found, -1 otherwise -- * to speed up the searching we only search upto max_offset -- */ --static int vcn_v4_0_enc_find_ib_param(struct amdgpu_ib *ib, uint32_t id, int max_offset) -+/* return the offset in ib if id is found, -1 otherwise */ -+static int vcn_v4_0_enc_find_ib_param(struct amdgpu_ib *ib, uint32_t id, int start) - { - int i; - -- for (i = 0; i < ib->length_dw && i < max_offset && ib->ptr[i] >= 8; i += ib->ptr[i]/4) { -+ for (i = start; i < ib->length_dw && ib->ptr[i] >= 8; i += ib->ptr[i] / 4) { - if (ib->ptr[i + 1] == id) - return i; - } -@@ -1773,33 +1771,29 @@ static int vcn_v4_0_ring_patch_cs_in_place(struct amdgpu_cs_parser *p, - struct amdgpu_vcn_decode_buffer *decode_buffer; - uint64_t addr; - uint32_t val; -- int idx; -+ int idx = 0, sidx; - - /* The first instance can decode anything */ - if (!ring->me) - return 0; - -- /* RADEON_VCN_ENGINE_INFO is at the top of ib block */ -- idx = vcn_v4_0_enc_find_ib_param(ib, RADEON_VCN_ENGINE_INFO, -- RADEON_VCN_ENGINE_INFO_MAX_OFFSET); -- if (idx < 0) /* engine info is missing */ -- return 0; -- -- val = amdgpu_ib_get_value(ib, idx + 2); /* RADEON_VCN_ENGINE_TYPE */ -- if (val == RADEON_VCN_ENGINE_TYPE_DECODE) { -- decode_buffer = (struct amdgpu_vcn_decode_buffer *)&ib->ptr[idx + 6]; -- -- if (!(decode_buffer->valid_buf_flag & 0x1)) -- return 0; -- -- addr = ((u64)decode_buffer->msg_buffer_address_hi) << 32 | -- decode_buffer->msg_buffer_address_lo; -- return vcn_v4_0_dec_msg(p, job, addr); -- } else if (val == RADEON_VCN_ENGINE_TYPE_ENCODE) { -- idx = vcn_v4_0_enc_find_ib_param(ib, RENCODE_IB_PARAM_SESSION_INIT, -- RENCODE_IB_PARAM_SESSION_INIT_MAX_OFFSET); -- if (idx >= 0 && ib->ptr[idx + 2] == RENCODE_ENCODE_STANDARD_AV1) -- return vcn_v4_0_limit_sched(p, job); -+ while ((idx = vcn_v4_0_enc_find_ib_param(ib, RADEON_VCN_ENGINE_INFO, idx)) >= 0) { -+ val = amdgpu_ib_get_value(ib, idx + 2); /* RADEON_VCN_ENGINE_TYPE */ -+ if (val == RADEON_VCN_ENGINE_TYPE_DECODE) { -+ decode_buffer = (struct amdgpu_vcn_decode_buffer *)&ib->ptr[idx + 6]; -+ -+ if (!(decode_buffer->valid_buf_flag & 0x1)) -+ return 0; -+ -+ addr = ((u64)decode_buffer->msg_buffer_address_hi) << 32 | -+ decode_buffer->msg_buffer_address_lo; -+ return vcn_v4_0_dec_msg(p, job, addr); -+ } else if (val == RADEON_VCN_ENGINE_TYPE_ENCODE) { -+ sidx = vcn_v4_0_enc_find_ib_param(ib, RENCODE_IB_PARAM_SESSION_INIT, idx); -+ if (sidx >= 0 && ib->ptr[sidx + 2] == RENCODE_ENCODE_STANDARD_AV1) -+ return vcn_v4_0_limit_sched(p, job); -+ } -+ idx += ib->ptr[idx] / 4; - } - return 0; - } -diff --git a/drivers/gpu/drm/i915/display/intel_display_power.c b/drivers/gpu/drm/i915/display/intel_display_power.c -index 9e01054c243001..8beeda3439818e 100644 ---- a/drivers/gpu/drm/i915/display/intel_display_power.c -+++ b/drivers/gpu/drm/i915/display/intel_display_power.c -@@ -1170,7 +1170,7 @@ static void icl_mbus_init(struct drm_i915_private *dev_priv) - if (DISPLAY_VER(dev_priv) == 12) - abox_regs |= BIT(0); - -- for_each_set_bit(i, &abox_regs, sizeof(abox_regs)) -+ for_each_set_bit(i, &abox_regs, BITS_PER_TYPE(abox_regs)) - intel_de_rmw(dev_priv, MBUS_ABOX_CTL(i), mask, val); - } - -@@ -1623,11 +1623,11 @@ static void tgl_bw_buddy_init(struct drm_i915_private *dev_priv) - if (table[config].page_mask == 0) { - drm_dbg(&dev_priv->drm, - "Unknown memory configuration; disabling address buddy logic.\n"); -- for_each_set_bit(i, &abox_mask, sizeof(abox_mask)) -+ for_each_set_bit(i, &abox_mask, BITS_PER_TYPE(abox_mask)) - intel_de_write(dev_priv, BW_BUDDY_CTL(i), - BW_BUDDY_DISABLE); - } else { -- for_each_set_bit(i, &abox_mask, sizeof(abox_mask)) { -+ for_each_set_bit(i, &abox_mask, BITS_PER_TYPE(abox_mask)) { - intel_de_write(dev_priv, BW_BUDDY_PAGE_MASK(i), - table[config].page_mask); - -diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c -index bfa1070a5f08e2..f1f73c1e7b5cbf 100644 ---- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c -+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c -@@ -365,11 +365,11 @@ static bool mtk_drm_get_all_drm_priv(struct device *dev) - - of_id = of_match_node(mtk_drm_of_ids, node); - if (!of_id) -- goto next_put_node; -+ continue; - - pdev = of_find_device_by_node(node); - if (!pdev) -- goto next_put_node; -+ continue; - - drm_dev = device_find_child(&pdev->dev, NULL, mtk_drm_match); - if (!drm_dev) -@@ -395,11 +395,10 @@ static bool mtk_drm_get_all_drm_priv(struct device *dev) - next_put_device_pdev_dev: - put_device(&pdev->dev); - --next_put_node: -- of_node_put(node); -- -- if (cnt == MAX_CRTC) -+ if (cnt == MAX_CRTC) { -+ of_node_put(node); - break; -+ } - } - - if (drm_priv->data->mmsys_dev_num == cnt) { -diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c -index 18c04f5e41d9c5..89fdc75cdcfa54 100644 ---- a/drivers/i2c/busses/i2c-i801.c -+++ b/drivers/i2c/busses/i2c-i801.c -@@ -1051,7 +1051,7 @@ static const struct pci_device_id i801_ids[] = { - { PCI_DEVICE_DATA(INTEL, METEOR_LAKE_P_SMBUS, FEATURES_ICH5 | FEATURE_TCO_CNL) }, - { PCI_DEVICE_DATA(INTEL, METEOR_LAKE_SOC_S_SMBUS, FEATURES_ICH5 | FEATURE_TCO_CNL) }, - { PCI_DEVICE_DATA(INTEL, METEOR_LAKE_PCH_S_SMBUS, FEATURES_ICH5 | FEATURE_TCO_CNL) }, -- { PCI_DEVICE_DATA(INTEL, BIRCH_STREAM_SMBUS, FEATURES_ICH5 | FEATURE_TCO_CNL) }, -+ { PCI_DEVICE_DATA(INTEL, BIRCH_STREAM_SMBUS, FEATURES_ICH5) }, - { PCI_DEVICE_DATA(INTEL, ARROW_LAKE_H_SMBUS, FEATURES_ICH5 | FEATURE_TCO_CNL) }, - { PCI_DEVICE_DATA(INTEL, PANTHER_LAKE_H_SMBUS, FEATURES_ICH5 | FEATURE_TCO_CNL) }, - { PCI_DEVICE_DATA(INTEL, PANTHER_LAKE_P_SMBUS, FEATURES_ICH5 | FEATURE_TCO_CNL) }, -diff --git a/drivers/input/misc/iqs7222.c b/drivers/input/misc/iqs7222.c -index ce7e977cc8a7a1..eb0e0b37eb41b6 100644 ---- a/drivers/input/misc/iqs7222.c -+++ b/drivers/input/misc/iqs7222.c -@@ -2430,6 +2430,9 @@ static int iqs7222_parse_chan(struct iqs7222_private *iqs7222, - if (error) - return error; - -+ if (!iqs7222->kp_type[chan_index][i]) -+ continue; -+ - if (!dev_desc->event_offset) - continue; - -diff --git a/drivers/input/serio/i8042-acpipnpio.h b/drivers/input/serio/i8042-acpipnpio.h -index 8813db7eec3978..630cdd5a132831 100644 ---- a/drivers/input/serio/i8042-acpipnpio.h -+++ b/drivers/input/serio/i8042-acpipnpio.h -@@ -1155,6 +1155,20 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { - .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | - SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) - }, -+ { -+ .matches = { -+ DMI_MATCH(DMI_BOARD_NAME, "XxHP4NAx"), -+ }, -+ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -+ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ }, -+ { -+ .matches = { -+ DMI_MATCH(DMI_BOARD_NAME, "XxKK4NAx_XxSP4NAx"), -+ }, -+ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | -+ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) -+ }, - /* - * A lot of modern Clevo barebones have touchpad and/or keyboard issues - * after suspend fixable with the forcenorestore quirk. -diff --git a/drivers/media/i2c/imx214.c b/drivers/media/i2c/imx214.c -index 2f9c8582f9401a..db40008f31cf1b 100644 ---- a/drivers/media/i2c/imx214.c -+++ b/drivers/media/i2c/imx214.c -@@ -20,7 +20,9 @@ - #include - - #define IMX214_DEFAULT_CLK_FREQ 24000000 --#define IMX214_DEFAULT_LINK_FREQ 480000000 -+#define IMX214_DEFAULT_LINK_FREQ 600000000 -+/* Keep wrong link frequency for backward compatibility */ -+#define IMX214_DEFAULT_LINK_FREQ_LEGACY 480000000 - #define IMX214_DEFAULT_PIXEL_RATE ((IMX214_DEFAULT_LINK_FREQ * 8LL) / 10) - #define IMX214_FPS 30 - #define IMX214_MBUS_CODE MEDIA_BUS_FMT_SRGGB10_1X10 -@@ -892,17 +894,26 @@ static int imx214_parse_fwnode(struct device *dev) - goto done; - } - -- for (i = 0; i < bus_cfg.nr_of_link_frequencies; i++) -+ if (bus_cfg.nr_of_link_frequencies != 1) -+ dev_warn(dev, "Only one link-frequency supported, please review your DT. Continuing anyway\n"); -+ -+ for (i = 0; i < bus_cfg.nr_of_link_frequencies; i++) { - if (bus_cfg.link_frequencies[i] == IMX214_DEFAULT_LINK_FREQ) - break; -- -- if (i == bus_cfg.nr_of_link_frequencies) { -- dev_err(dev, "link-frequencies %d not supported, Please review your DT\n", -- IMX214_DEFAULT_LINK_FREQ); -- ret = -EINVAL; -- goto done; -+ if (bus_cfg.link_frequencies[i] == -+ IMX214_DEFAULT_LINK_FREQ_LEGACY) { -+ dev_warn(dev, -+ "link-frequencies %d not supported, please review your DT. Continuing anyway\n", -+ IMX214_DEFAULT_LINK_FREQ); -+ break; -+ } - } - -+ if (i == bus_cfg.nr_of_link_frequencies) -+ ret = dev_err_probe(dev, -EINVAL, -+ "link-frequencies %d not supported, please review your DT\n", -+ IMX214_DEFAULT_LINK_FREQ); -+ - done: - v4l2_fwnode_endpoint_free(&bus_cfg); - fwnode_handle_put(endpoint); -diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c -index d4fd1302008ebd..c5aff27ec4a895 100644 ---- a/drivers/mtd/nand/raw/atmel/nand-controller.c -+++ b/drivers/mtd/nand/raw/atmel/nand-controller.c -@@ -1378,13 +1378,23 @@ static int atmel_smc_nand_prepare_smcconf(struct atmel_nand *nand, - return ret; - - /* -- * The write cycle timing is directly matching tWC, but is also -+ * Read setup timing depends on the operation done on the NAND: -+ * -+ * NRD_SETUP = max(tAR, tCLR) -+ */ -+ timeps = max(conf->timings.sdr.tAR_min, conf->timings.sdr.tCLR_min); -+ ncycles = DIV_ROUND_UP(timeps, mckperiodps); -+ totalcycles += ncycles; -+ ret = atmel_smc_cs_conf_set_setup(smcconf, ATMEL_SMC_NRD_SHIFT, ncycles); -+ if (ret) -+ return ret; -+ -+ /* -+ * The read cycle timing is directly matching tRC, but is also - * dependent on the setup and hold timings we calculated earlier, - * which gives: - * -- * NRD_CYCLE = max(tRC, NRD_PULSE + NRD_HOLD) -- * -- * NRD_SETUP is always 0. -+ * NRD_CYCLE = max(tRC, NRD_SETUP + NRD_PULSE + NRD_HOLD) - */ - ncycles = DIV_ROUND_UP(conf->timings.sdr.tRC_min, mckperiodps); - ncycles = max(totalcycles, ncycles); -diff --git a/drivers/mtd/nand/raw/stm32_fmc2_nand.c b/drivers/mtd/nand/raw/stm32_fmc2_nand.c -index 88811139aaf5b9..c7956298397173 100644 ---- a/drivers/mtd/nand/raw/stm32_fmc2_nand.c -+++ b/drivers/mtd/nand/raw/stm32_fmc2_nand.c -@@ -263,6 +263,7 @@ struct stm32_fmc2_nfc { - struct sg_table dma_data_sg; - struct sg_table dma_ecc_sg; - u8 *ecc_buf; -+ dma_addr_t dma_ecc_addr; - int dma_ecc_len; - - struct completion complete; -@@ -885,17 +886,10 @@ static int stm32_fmc2_nfc_xfer(struct nand_chip *chip, const u8 *buf, - - if (!write_data && !raw) { - /* Configure DMA ECC status */ -- p = nfc->ecc_buf; - for_each_sg(nfc->dma_ecc_sg.sgl, sg, eccsteps, s) { -- sg_set_buf(sg, p, nfc->dma_ecc_len); -- p += nfc->dma_ecc_len; -- } -- -- ret = dma_map_sg(nfc->dev, nfc->dma_ecc_sg.sgl, -- eccsteps, dma_data_dir); -- if (!ret) { -- ret = -EIO; -- goto err_unmap_data; -+ sg_dma_address(sg) = nfc->dma_ecc_addr + -+ s * nfc->dma_ecc_len; -+ sg_dma_len(sg) = nfc->dma_ecc_len; - } - - desc_ecc = dmaengine_prep_slave_sg(nfc->dma_ecc_ch, -@@ -904,7 +898,7 @@ static int stm32_fmc2_nfc_xfer(struct nand_chip *chip, const u8 *buf, - DMA_PREP_INTERRUPT); - if (!desc_ecc) { - ret = -ENOMEM; -- goto err_unmap_ecc; -+ goto err_unmap_data; - } - - reinit_completion(&nfc->dma_ecc_complete); -@@ -912,7 +906,7 @@ static int stm32_fmc2_nfc_xfer(struct nand_chip *chip, const u8 *buf, - desc_ecc->callback_param = &nfc->dma_ecc_complete; - ret = dma_submit_error(dmaengine_submit(desc_ecc)); - if (ret) -- goto err_unmap_ecc; -+ goto err_unmap_data; - - dma_async_issue_pending(nfc->dma_ecc_ch); - } -@@ -932,7 +926,7 @@ static int stm32_fmc2_nfc_xfer(struct nand_chip *chip, const u8 *buf, - if (!write_data && !raw) - dmaengine_terminate_all(nfc->dma_ecc_ch); - ret = -ETIMEDOUT; -- goto err_unmap_ecc; -+ goto err_unmap_data; - } - - /* Wait DMA data transfer completion */ -@@ -952,11 +946,6 @@ static int stm32_fmc2_nfc_xfer(struct nand_chip *chip, const u8 *buf, - } - } - --err_unmap_ecc: -- if (!write_data && !raw) -- dma_unmap_sg(nfc->dev, nfc->dma_ecc_sg.sgl, -- eccsteps, dma_data_dir); -- - err_unmap_data: - dma_unmap_sg(nfc->dev, nfc->dma_data_sg.sgl, eccsteps, dma_data_dir); - -@@ -979,9 +968,21 @@ static int stm32_fmc2_nfc_seq_write(struct nand_chip *chip, const u8 *buf, - - /* Write oob */ - if (oob_required) { -- ret = nand_change_write_column_op(chip, mtd->writesize, -- chip->oob_poi, mtd->oobsize, -- false); -+ unsigned int offset_in_page = mtd->writesize; -+ const void *buf = chip->oob_poi; -+ unsigned int len = mtd->oobsize; -+ -+ if (!raw) { -+ struct mtd_oob_region oob_free; -+ -+ mtd_ooblayout_free(mtd, 0, &oob_free); -+ offset_in_page += oob_free.offset; -+ buf += oob_free.offset; -+ len = oob_free.length; -+ } -+ -+ ret = nand_change_write_column_op(chip, offset_in_page, -+ buf, len, false); - if (ret) - return ret; - } -@@ -1582,7 +1583,8 @@ static int stm32_fmc2_nfc_dma_setup(struct stm32_fmc2_nfc *nfc) - return ret; - - /* Allocate a buffer to store ECC status registers */ -- nfc->ecc_buf = devm_kzalloc(nfc->dev, FMC2_MAX_ECC_BUF_LEN, GFP_KERNEL); -+ nfc->ecc_buf = dmam_alloc_coherent(nfc->dev, FMC2_MAX_ECC_BUF_LEN, -+ &nfc->dma_ecc_addr, GFP_KERNEL); - if (!nfc->ecc_buf) - return -ENOMEM; - -diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c -index abe58f10304336..57d1209134f11b 100644 ---- a/drivers/net/can/xilinx_can.c -+++ b/drivers/net/can/xilinx_can.c -@@ -628,14 +628,6 @@ static void xcan_write_frame(struct net_device *ndev, struct sk_buff *skb, - dlc |= XCAN_DLCR_EDL_MASK; - } - -- if (!(priv->devtype.flags & XCAN_FLAG_TX_MAILBOXES) && -- (priv->devtype.flags & XCAN_FLAG_TXFEMP)) -- can_put_echo_skb(skb, ndev, priv->tx_head % priv->tx_max, 0); -- else -- can_put_echo_skb(skb, ndev, 0, 0); -- -- priv->tx_head++; -- - priv->write_reg(priv, XCAN_FRAME_ID_OFFSET(frame_offset), id); - /* If the CAN frame is RTR frame this write triggers transmission - * (not on CAN FD) -@@ -668,6 +660,14 @@ static void xcan_write_frame(struct net_device *ndev, struct sk_buff *skb, - data[1]); - } - } -+ -+ if (!(priv->devtype.flags & XCAN_FLAG_TX_MAILBOXES) && -+ (priv->devtype.flags & XCAN_FLAG_TXFEMP)) -+ can_put_echo_skb(skb, ndev, priv->tx_head % priv->tx_max, 0); -+ else -+ can_put_echo_skb(skb, ndev, 0, 0); -+ -+ priv->tx_head++; - } - - /** -diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c -index 2a8b5429df5957..8352d9b6469f2a 100644 ---- a/drivers/net/ethernet/freescale/fec_main.c -+++ b/drivers/net/ethernet/freescale/fec_main.c -@@ -2300,7 +2300,8 @@ static void fec_enet_phy_reset_after_clk_enable(struct net_device *ndev) - */ - phy_dev = of_phy_find_device(fep->phy_node); - phy_reset_after_clk_enable(phy_dev); -- put_device(&phy_dev->mdio.dev); -+ if (phy_dev) -+ put_device(&phy_dev->mdio.dev); - } - } - -diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c -index b749aa3e783ffe..72869336e3a9a9 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_main.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c -@@ -4210,7 +4210,7 @@ static int i40e_vsi_request_irq_msix(struct i40e_vsi *vsi, char *basename) - irq_num = pf->msix_entries[base + vector].vector; - irq_set_affinity_notifier(irq_num, NULL); - irq_update_affinity_hint(irq_num, NULL); -- free_irq(irq_num, &vsi->q_vectors[vector]); -+ free_irq(irq_num, vsi->q_vectors[vector]); - } - return err; - } -diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c -index 92b2be06a6e930..f11cba65e5d85e 100644 ---- a/drivers/net/ethernet/intel/igb/igb_ethtool.c -+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c -@@ -2081,11 +2081,8 @@ static void igb_diag_test(struct net_device *netdev, - } else { - dev_info(&adapter->pdev->dev, "online testing starting\n"); - -- /* PHY is powered down when interface is down */ -- if (if_running && igb_link_test(adapter, &data[TEST_LINK])) -+ if (igb_link_test(adapter, &data[TEST_LINK])) - eth_test->flags |= ETH_TEST_FL_FAILED; -- else -- data[TEST_LINK] = 0; - - /* Online tests aren't run; pass by default */ - data[TEST_REG] = 0; -diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c -index e02706b7cc1ed6..f1fac89721ed93 100644 ---- a/drivers/net/phy/mdio_bus.c -+++ b/drivers/net/phy/mdio_bus.c -@@ -99,6 +99,7 @@ int mdiobus_unregister_device(struct mdio_device *mdiodev) - if (mdiodev->bus->mdio_map[mdiodev->addr] != mdiodev) - return -EINVAL; - -+ gpiod_put(mdiodev->reset_gpio); - reset_control_put(mdiodev->reset_ctrl); - - mdiodev->bus->mdio_map[mdiodev->addr] = NULL; -@@ -775,9 +776,6 @@ void mdiobus_unregister(struct mii_bus *bus) - if (!mdiodev) - continue; - -- if (mdiodev->reset_gpio) -- gpiod_put(mdiodev->reset_gpio); -- - mdiodev->device_remove(mdiodev); - mdiodev->device_free(mdiodev); - } -diff --git a/drivers/phy/tegra/xusb-tegra210.c b/drivers/phy/tegra/xusb-tegra210.c -index ebc8a7e21a3181..3409924498e9cf 100644 ---- a/drivers/phy/tegra/xusb-tegra210.c -+++ b/drivers/phy/tegra/xusb-tegra210.c -@@ -3164,18 +3164,22 @@ tegra210_xusb_padctl_probe(struct device *dev, - } - - pdev = of_find_device_by_node(np); -+ of_node_put(np); - if (!pdev) { - dev_warn(dev, "PMC device is not available\n"); - goto out; - } - -- if (!platform_get_drvdata(pdev)) -+ if (!platform_get_drvdata(pdev)) { -+ put_device(&pdev->dev); - return ERR_PTR(-EPROBE_DEFER); -+ } - - padctl->regmap = dev_get_regmap(&pdev->dev, "usb_sleepwalk"); - if (!padctl->regmap) - dev_info(dev, "failed to find PMC regmap\n"); - -+ put_device(&pdev->dev); - out: - return &padctl->base; - } -diff --git a/drivers/phy/ti/phy-ti-pipe3.c b/drivers/phy/ti/phy-ti-pipe3.c -index 507e1552db5e83..3127f3702c3ae3 100644 ---- a/drivers/phy/ti/phy-ti-pipe3.c -+++ b/drivers/phy/ti/phy-ti-pipe3.c -@@ -666,12 +666,20 @@ static int ti_pipe3_get_clk(struct ti_pipe3 *phy) - return 0; - } - -+static void ti_pipe3_put_device(void *_dev) -+{ -+ struct device *dev = _dev; -+ -+ put_device(dev); -+} -+ - static int ti_pipe3_get_sysctrl(struct ti_pipe3 *phy) - { - struct device *dev = phy->dev; - struct device_node *node = dev->of_node; - struct device_node *control_node; - struct platform_device *control_pdev; -+ int ret; - - phy->phy_power_syscon = syscon_regmap_lookup_by_phandle(node, - "syscon-phy-power"); -@@ -703,6 +711,11 @@ static int ti_pipe3_get_sysctrl(struct ti_pipe3 *phy) - } - - phy->control_dev = &control_pdev->dev; -+ -+ ret = devm_add_action_or_reset(dev, ti_pipe3_put_device, -+ phy->control_dev); -+ if (ret) -+ return ret; - } - - if (phy->mode == PIPE3_MODE_PCIE) { -diff --git a/drivers/regulator/sy7636a-regulator.c b/drivers/regulator/sy7636a-regulator.c -index d1e7ba1fb3e1af..27e3d939b7bb9e 100644 ---- a/drivers/regulator/sy7636a-regulator.c -+++ b/drivers/regulator/sy7636a-regulator.c -@@ -83,9 +83,11 @@ static int sy7636a_regulator_probe(struct platform_device *pdev) - if (!regmap) - return -EPROBE_DEFER; - -- gdp = devm_gpiod_get(pdev->dev.parent, "epd-pwr-good", GPIOD_IN); -+ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent); -+ -+ gdp = devm_gpiod_get(&pdev->dev, "epd-pwr-good", GPIOD_IN); - if (IS_ERR(gdp)) { -- dev_err(pdev->dev.parent, "Power good GPIO fault %ld\n", PTR_ERR(gdp)); -+ dev_err(&pdev->dev, "Power good GPIO fault %ld\n", PTR_ERR(gdp)); - return PTR_ERR(gdp); - } - -@@ -105,7 +107,6 @@ static int sy7636a_regulator_probe(struct platform_device *pdev) - } - - config.dev = &pdev->dev; -- config.dev->of_node = pdev->dev.parent->of_node; - config.regmap = regmap; - - rdev = devm_regulator_register(&pdev->dev, &desc, &config); -diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c -index 959fae54ca394b..4c252bbbf8e276 100644 ---- a/drivers/tty/hvc/hvc_console.c -+++ b/drivers/tty/hvc/hvc_console.c -@@ -543,10 +543,10 @@ static ssize_t hvc_write(struct tty_struct *tty, const u8 *buf, size_t count) - } - - /* -- * Racy, but harmless, kick thread if there is still pending data. -+ * Kick thread to flush if there's still pending data -+ * or to wakeup the write queue. - */ -- if (hp->n_outbuf) -- hvc_kick(); -+ hvc_kick(); - - return written; - } -diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c -index 8a2ce2ca6b394a..66a88bba8f15b8 100644 ---- a/drivers/tty/serial/sc16is7xx.c -+++ b/drivers/tty/serial/sc16is7xx.c -@@ -1163,17 +1163,6 @@ static int sc16is7xx_startup(struct uart_port *port) - sc16is7xx_port_write(port, SC16IS7XX_FCR_REG, - SC16IS7XX_FCR_FIFO_BIT); - -- /* Enable EFR */ -- sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, -- SC16IS7XX_LCR_CONF_MODE_B); -- -- regcache_cache_bypass(one->regmap, true); -- -- /* Enable write access to enhanced features and internal clock div */ -- sc16is7xx_port_update(port, SC16IS7XX_EFR_REG, -- SC16IS7XX_EFR_ENABLE_BIT, -- SC16IS7XX_EFR_ENABLE_BIT); -- - /* Enable TCR/TLR */ - sc16is7xx_port_update(port, SC16IS7XX_MCR_REG, - SC16IS7XX_MCR_TCRTLR_BIT, -@@ -1185,7 +1174,8 @@ static int sc16is7xx_startup(struct uart_port *port) - SC16IS7XX_TCR_RX_RESUME(24) | - SC16IS7XX_TCR_RX_HALT(48)); - -- regcache_cache_bypass(one->regmap, false); -+ /* Disable TCR/TLR access */ -+ sc16is7xx_port_update(port, SC16IS7XX_MCR_REG, SC16IS7XX_MCR_TCRTLR_BIT, 0); - - /* Now, initialize the UART */ - sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, SC16IS7XX_LCR_WORD_LEN_8); -diff --git a/drivers/usb/gadget/function/f_midi2.c b/drivers/usb/gadget/function/f_midi2.c -index 90536f47906c33..d7ed50ff380cf4 100644 ---- a/drivers/usb/gadget/function/f_midi2.c -+++ b/drivers/usb/gadget/function/f_midi2.c -@@ -1601,6 +1601,7 @@ static int f_midi2_create_card(struct f_midi2 *midi2) - strscpy(fb->info.name, ump_fb_name(b), - sizeof(fb->info.name)); - } -+ snd_ump_update_group_attrs(ump); - } - - for (i = 0; i < midi2->num_eps; i++) { -@@ -1738,9 +1739,12 @@ static int f_midi2_create_usb_configs(struct f_midi2 *midi2, - case USB_SPEED_HIGH: - midi2_midi1_ep_out_desc.wMaxPacketSize = cpu_to_le16(512); - midi2_midi1_ep_in_desc.wMaxPacketSize = cpu_to_le16(512); -- for (i = 0; i < midi2->num_eps; i++) -+ for (i = 0; i < midi2->num_eps; i++) { - midi2_midi2_ep_out_desc[i].wMaxPacketSize = - cpu_to_le16(512); -+ midi2_midi2_ep_in_desc[i].wMaxPacketSize = -+ cpu_to_le16(512); -+ } - fallthrough; - case USB_SPEED_FULL: - midi1_in_eps = midi2_midi1_ep_in_descs; -@@ -1749,9 +1753,12 @@ static int f_midi2_create_usb_configs(struct f_midi2 *midi2, - case USB_SPEED_SUPER: - midi2_midi1_ep_out_desc.wMaxPacketSize = cpu_to_le16(1024); - midi2_midi1_ep_in_desc.wMaxPacketSize = cpu_to_le16(1024); -- for (i = 0; i < midi2->num_eps; i++) -+ for (i = 0; i < midi2->num_eps; i++) { - midi2_midi2_ep_out_desc[i].wMaxPacketSize = - cpu_to_le16(1024); -+ midi2_midi2_ep_in_desc[i].wMaxPacketSize = -+ cpu_to_le16(1024); -+ } - midi1_in_eps = midi2_midi1_ep_in_ss_descs; - midi1_out_eps = midi2_midi1_ep_out_ss_descs; - break; -diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c -index d5d89fadde433f..a06f56c08e19d0 100644 ---- a/drivers/usb/gadget/udc/dummy_hcd.c -+++ b/drivers/usb/gadget/udc/dummy_hcd.c -@@ -764,8 +764,7 @@ static int dummy_dequeue(struct usb_ep *_ep, struct usb_request *_req) - if (!dum->driver) - return -ESHUTDOWN; - -- local_irq_save(flags); -- spin_lock(&dum->lock); -+ spin_lock_irqsave(&dum->lock, flags); - list_for_each_entry(iter, &ep->queue, queue) { - if (&iter->req != _req) - continue; -@@ -775,15 +774,16 @@ static int dummy_dequeue(struct usb_ep *_ep, struct usb_request *_req) - retval = 0; - break; - } -- spin_unlock(&dum->lock); - - if (retval == 0) { - dev_dbg(udc_dev(dum), - "dequeued req %p from %s, len %d buf %p\n", - req, _ep->name, _req->length, _req->buf); -+ spin_unlock(&dum->lock); - usb_gadget_giveback_request(_ep, _req); -+ spin_lock(&dum->lock); - } -- local_irq_restore(flags); -+ spin_unlock_irqrestore(&dum->lock, flags); - return retval; - } - -diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c -index 04718048b74bd9..621f12c11cbc2b 100644 ---- a/drivers/usb/host/xhci-mem.c -+++ b/drivers/usb/host/xhci-mem.c -@@ -945,7 +945,7 @@ static void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_i - out: - /* we are now at a leaf device */ - xhci_debugfs_remove_slot(xhci, slot_id); -- xhci_free_virt_device(xhci, vdev, slot_id); -+ xhci_free_virt_device(xhci, xhci->devs[slot_id], slot_id); - } - - int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id, -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index ac72b04c997bfb..ef546f660b9927 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -1322,7 +1322,18 @@ static const struct usb_device_id option_ids[] = { - .driver_info = NCTRL(0) | RSVD(3) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1033, 0xff), /* Telit LE910C1-EUX (ECM) */ - .driver_info = NCTRL(0) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1034, 0xff), /* Telit LE910C4-WWX (rmnet) */ -+ .driver_info = RSVD(2) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1035, 0xff) }, /* Telit LE910C4-WWX (ECM) */ -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1036, 0xff) }, /* Telit LE910C4-WWX */ -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1037, 0xff), /* Telit LE910C4-WWX (rmnet) */ -+ .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1038, 0xff), /* Telit LE910C4-WWX (rmnet) */ -+ .driver_info = NCTRL(0) | RSVD(3) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x103b, 0xff), /* Telit LE910C4-WWX */ -+ .driver_info = NCTRL(0) | NCTRL(1) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x103c, 0xff), /* Telit LE910C4-WWX */ -+ .driver_info = NCTRL(0) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0), - .driver_info = RSVD(0) | RSVD(1) | NCTRL(2) | RSVD(3) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG1), -@@ -1369,6 +1380,12 @@ static const struct usb_device_id option_ids[] = { - .driver_info = NCTRL(0) | RSVD(1) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990A (PCIe) */ - .driver_info = RSVD(0) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1077, 0xff), /* Telit FN990A (rmnet + audio) */ -+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1078, 0xff), /* Telit FN990A (MBIM + audio) */ -+ .driver_info = NCTRL(0) | RSVD(1) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1079, 0xff), /* Telit FN990A (RNDIS + audio) */ -+ .driver_info = NCTRL(2) | RSVD(3) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1080, 0xff), /* Telit FE990A (rmnet) */ - .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1081, 0xff), /* Telit FE990A (MBIM) */ -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index 48b06459bc485a..ccf94c5fbfdfd6 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -103,6 +103,25 @@ struct btrfs_bio_ctrl { - blk_opf_t opf; - btrfs_bio_end_io_t end_io_func; - struct writeback_control *wbc; -+ struct readahead_control *ractl; -+ -+ /* -+ * The start offset of the last used extent map by a read operation. -+ * -+ * This is for proper compressed read merge. -+ * U64_MAX means we are starting the read and have made no progress yet. -+ * -+ * The current btrfs_bio_is_contig() only uses disk_bytenr as -+ * the condition to check if the read can be merged with previous -+ * bio, which is not correct. E.g. two file extents pointing to the -+ * same extent but with different offset. -+ * -+ * So here we need to do extra checks to only merge reads that are -+ * covered by the same extent map. -+ * Just extent_map::start will be enough, as they are unique -+ * inside the same inode. -+ */ -+ u64 last_em_start; - }; - - static void submit_one_bio(struct btrfs_bio_ctrl *bio_ctrl) -@@ -952,6 +971,23 @@ __get_extent_map(struct inode *inode, struct page *page, size_t pg_offset, - } - return em; - } -+ -+static void btrfs_readahead_expand(struct readahead_control *ractl, -+ const struct extent_map *em) -+{ -+ const u64 ra_pos = readahead_pos(ractl); -+ const u64 ra_end = ra_pos + readahead_length(ractl); -+ const u64 em_end = em->start + em->ram_bytes; -+ -+ /* No expansion for holes and inline extents. */ -+ if (em->block_start > EXTENT_MAP_LAST_BYTE) -+ return; -+ -+ ASSERT(em_end >= ra_pos); -+ if (em_end > ra_end) -+ readahead_expand(ractl, ra_pos, em_end - ra_pos); -+} -+ - /* - * basic readpage implementation. Locked extent state structs are inserted - * into the tree that are removed when the IO is done (by the end_io -@@ -960,7 +996,7 @@ __get_extent_map(struct inode *inode, struct page *page, size_t pg_offset, - * return 0 on success, otherwise return error - */ - static int btrfs_do_readpage(struct page *page, struct extent_map **em_cached, -- struct btrfs_bio_ctrl *bio_ctrl, u64 *prev_em_start) -+ struct btrfs_bio_ctrl *bio_ctrl) - { - struct inode *inode = page->mapping->host; - struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); -@@ -1023,6 +1059,17 @@ static int btrfs_do_readpage(struct page *page, struct extent_map **em_cached, - - iosize = min(extent_map_end(em) - cur, end - cur + 1); - iosize = ALIGN(iosize, blocksize); -+ -+ /* -+ * Only expand readahead for extents which are already creating -+ * the pages anyway in add_ra_bio_pages, which is compressed -+ * extents in the non subpage case. -+ */ -+ if (bio_ctrl->ractl && -+ !btrfs_is_subpage(fs_info, page) && -+ compress_type != BTRFS_COMPRESS_NONE) -+ btrfs_readahead_expand(bio_ctrl->ractl, em); -+ - if (compress_type != BTRFS_COMPRESS_NONE) - disk_bytenr = em->block_start; - else -@@ -1066,12 +1113,11 @@ static int btrfs_do_readpage(struct page *page, struct extent_map **em_cached, - * non-optimal behavior (submitting 2 bios for the same extent). - */ - if (test_bit(EXTENT_FLAG_COMPRESSED, &em->flags) && -- prev_em_start && *prev_em_start != (u64)-1 && -- *prev_em_start != em->start) -+ bio_ctrl->last_em_start != (u64)-1 && -+ bio_ctrl->last_em_start != em->start) - force_bio_submit = true; - -- if (prev_em_start) -- *prev_em_start = em->start; -+ bio_ctrl->last_em_start = em->start; - - free_extent_map(em); - em = NULL; -@@ -1117,12 +1163,15 @@ int btrfs_read_folio(struct file *file, struct folio *folio) - struct btrfs_inode *inode = BTRFS_I(page->mapping->host); - u64 start = page_offset(page); - u64 end = start + PAGE_SIZE - 1; -- struct btrfs_bio_ctrl bio_ctrl = { .opf = REQ_OP_READ }; -+ struct btrfs_bio_ctrl bio_ctrl = { -+ .opf = REQ_OP_READ, -+ .last_em_start = (u64)-1, -+ }; - int ret; - - btrfs_lock_and_flush_ordered_range(inode, start, end, NULL); - -- ret = btrfs_do_readpage(page, NULL, &bio_ctrl, NULL); -+ ret = btrfs_do_readpage(page, NULL, &bio_ctrl); - /* - * If btrfs_do_readpage() failed we will want to submit the assembled - * bio to do the cleanup. -@@ -1134,8 +1183,7 @@ int btrfs_read_folio(struct file *file, struct folio *folio) - static inline void contiguous_readpages(struct page *pages[], int nr_pages, - u64 start, u64 end, - struct extent_map **em_cached, -- struct btrfs_bio_ctrl *bio_ctrl, -- u64 *prev_em_start) -+ struct btrfs_bio_ctrl *bio_ctrl) - { - struct btrfs_inode *inode = BTRFS_I(pages[0]->mapping->host); - int index; -@@ -1143,8 +1191,7 @@ static inline void contiguous_readpages(struct page *pages[], int nr_pages, - btrfs_lock_and_flush_ordered_range(inode, start, end, NULL); - - for (index = 0; index < nr_pages; index++) { -- btrfs_do_readpage(pages[index], em_cached, bio_ctrl, -- prev_em_start); -+ btrfs_do_readpage(pages[index], em_cached, bio_ctrl); - put_page(pages[index]); - } - } -@@ -2224,10 +2271,13 @@ int extent_writepages(struct address_space *mapping, - - void extent_readahead(struct readahead_control *rac) - { -- struct btrfs_bio_ctrl bio_ctrl = { .opf = REQ_OP_READ | REQ_RAHEAD }; -+ struct btrfs_bio_ctrl bio_ctrl = { -+ .opf = REQ_OP_READ | REQ_RAHEAD, -+ .ractl = rac, -+ .last_em_start = (u64)-1, -+ }; - struct page *pagepool[16]; - struct extent_map *em_cached = NULL; -- u64 prev_em_start = (u64)-1; - int nr; - - while ((nr = readahead_page_batch(rac, pagepool))) { -@@ -2235,7 +2285,7 @@ void extent_readahead(struct readahead_control *rac) - u64 contig_end = contig_start + readahead_batch_length(rac) - 1; - - contiguous_readpages(pagepool, nr, contig_start, contig_end, -- &em_cached, &bio_ctrl, &prev_em_start); -+ &em_cached, &bio_ctrl); - } - - if (em_cached) -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index 3e4c3fcb588ba8..952c99fcb636dc 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -3106,7 +3106,7 @@ static ssize_t __fuse_copy_file_range(struct file *file_in, loff_t pos_in, - .nodeid_out = ff_out->nodeid, - .fh_out = ff_out->fh, - .off_out = pos_out, -- .len = len, -+ .len = min_t(size_t, len, UINT_MAX & PAGE_MASK), - .flags = flags - }; - struct fuse_write_out outarg; -@@ -3172,6 +3172,9 @@ static ssize_t __fuse_copy_file_range(struct file *file_in, loff_t pos_in, - fc->no_copy_file_range = 1; - err = -EOPNOTSUPP; - } -+ if (!err && outarg.size > len) -+ err = -EIO; -+ - if (err) - goto out; - -diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c -index 6b90fea6cca209..257ba5398387be 100644 ---- a/fs/kernfs/file.c -+++ b/fs/kernfs/file.c -@@ -70,6 +70,24 @@ static struct kernfs_open_node *of_on(struct kernfs_open_file *of) - !list_empty(&of->list)); - } - -+/* Get active reference to kernfs node for an open file */ -+static struct kernfs_open_file *kernfs_get_active_of(struct kernfs_open_file *of) -+{ -+ /* Skip if file was already released */ -+ if (unlikely(of->released)) -+ return NULL; -+ -+ if (!kernfs_get_active(of->kn)) -+ return NULL; -+ -+ return of; -+} -+ -+static void kernfs_put_active_of(struct kernfs_open_file *of) -+{ -+ return kernfs_put_active(of->kn); -+} -+ - /** - * kernfs_deref_open_node_locked - Get kernfs_open_node corresponding to @kn - * -@@ -139,7 +157,7 @@ static void kernfs_seq_stop_active(struct seq_file *sf, void *v) - - if (ops->seq_stop) - ops->seq_stop(sf, v); -- kernfs_put_active(of->kn); -+ kernfs_put_active_of(of); - } - - static void *kernfs_seq_start(struct seq_file *sf, loff_t *ppos) -@@ -152,7 +170,7 @@ static void *kernfs_seq_start(struct seq_file *sf, loff_t *ppos) - * the ops aren't called concurrently for the same open file. - */ - mutex_lock(&of->mutex); -- if (!kernfs_get_active(of->kn)) -+ if (!kernfs_get_active_of(of)) - return ERR_PTR(-ENODEV); - - ops = kernfs_ops(of->kn); -@@ -238,7 +256,7 @@ static ssize_t kernfs_file_read_iter(struct kiocb *iocb, struct iov_iter *iter) - * the ops aren't called concurrently for the same open file. - */ - mutex_lock(&of->mutex); -- if (!kernfs_get_active(of->kn)) { -+ if (!kernfs_get_active_of(of)) { - len = -ENODEV; - mutex_unlock(&of->mutex); - goto out_free; -@@ -252,7 +270,7 @@ static ssize_t kernfs_file_read_iter(struct kiocb *iocb, struct iov_iter *iter) - else - len = -EINVAL; - -- kernfs_put_active(of->kn); -+ kernfs_put_active_of(of); - mutex_unlock(&of->mutex); - - if (len < 0) -@@ -323,7 +341,7 @@ static ssize_t kernfs_fop_write_iter(struct kiocb *iocb, struct iov_iter *iter) - * the ops aren't called concurrently for the same open file. - */ - mutex_lock(&of->mutex); -- if (!kernfs_get_active(of->kn)) { -+ if (!kernfs_get_active_of(of)) { - mutex_unlock(&of->mutex); - len = -ENODEV; - goto out_free; -@@ -335,7 +353,7 @@ static ssize_t kernfs_fop_write_iter(struct kiocb *iocb, struct iov_iter *iter) - else - len = -EINVAL; - -- kernfs_put_active(of->kn); -+ kernfs_put_active_of(of); - mutex_unlock(&of->mutex); - - if (len > 0) -@@ -357,13 +375,13 @@ static void kernfs_vma_open(struct vm_area_struct *vma) - if (!of->vm_ops) - return; - -- if (!kernfs_get_active(of->kn)) -+ if (!kernfs_get_active_of(of)) - return; - - if (of->vm_ops->open) - of->vm_ops->open(vma); - -- kernfs_put_active(of->kn); -+ kernfs_put_active_of(of); - } - - static vm_fault_t kernfs_vma_fault(struct vm_fault *vmf) -@@ -375,14 +393,14 @@ static vm_fault_t kernfs_vma_fault(struct vm_fault *vmf) - if (!of->vm_ops) - return VM_FAULT_SIGBUS; - -- if (!kernfs_get_active(of->kn)) -+ if (!kernfs_get_active_of(of)) - return VM_FAULT_SIGBUS; - - ret = VM_FAULT_SIGBUS; - if (of->vm_ops->fault) - ret = of->vm_ops->fault(vmf); - -- kernfs_put_active(of->kn); -+ kernfs_put_active_of(of); - return ret; - } - -@@ -395,7 +413,7 @@ static vm_fault_t kernfs_vma_page_mkwrite(struct vm_fault *vmf) - if (!of->vm_ops) - return VM_FAULT_SIGBUS; - -- if (!kernfs_get_active(of->kn)) -+ if (!kernfs_get_active_of(of)) - return VM_FAULT_SIGBUS; - - ret = 0; -@@ -404,7 +422,7 @@ static vm_fault_t kernfs_vma_page_mkwrite(struct vm_fault *vmf) - else - file_update_time(file); - -- kernfs_put_active(of->kn); -+ kernfs_put_active_of(of); - return ret; - } - -@@ -418,14 +436,14 @@ static int kernfs_vma_access(struct vm_area_struct *vma, unsigned long addr, - if (!of->vm_ops) - return -EINVAL; - -- if (!kernfs_get_active(of->kn)) -+ if (!kernfs_get_active_of(of)) - return -EINVAL; - - ret = -EINVAL; - if (of->vm_ops->access) - ret = of->vm_ops->access(vma, addr, buf, len, write); - -- kernfs_put_active(of->kn); -+ kernfs_put_active_of(of); - return ret; - } - -@@ -504,7 +522,7 @@ static int kernfs_fop_mmap(struct file *file, struct vm_area_struct *vma) - mutex_lock(&of->mutex); - - rc = -ENODEV; -- if (!kernfs_get_active(of->kn)) -+ if (!kernfs_get_active_of(of)) - goto out_unlock; - - ops = kernfs_ops(of->kn); -@@ -539,7 +557,7 @@ static int kernfs_fop_mmap(struct file *file, struct vm_area_struct *vma) - } - vma->vm_ops = &kernfs_vm_ops; - out_put: -- kernfs_put_active(of->kn); -+ kernfs_put_active_of(of); - out_unlock: - mutex_unlock(&of->mutex); - -@@ -894,7 +912,7 @@ static __poll_t kernfs_fop_poll(struct file *filp, poll_table *wait) - struct kernfs_node *kn = kernfs_dentry_node(filp->f_path.dentry); - __poll_t ret; - -- if (!kernfs_get_active(kn)) -+ if (!kernfs_get_active_of(of)) - return DEFAULT_POLLMASK|EPOLLERR|EPOLLPRI; - - if (kn->attr.ops->poll) -@@ -902,7 +920,7 @@ static __poll_t kernfs_fop_poll(struct file *filp, poll_table *wait) - else - ret = kernfs_generic_poll(of, wait); - -- kernfs_put_active(kn); -+ kernfs_put_active_of(of); - return ret; - } - -diff --git a/fs/nfs/client.c b/fs/nfs/client.c -index cc764da581c43c..1bcdaee7e856f0 100644 ---- a/fs/nfs/client.c -+++ b/fs/nfs/client.c -@@ -873,6 +873,8 @@ static void nfs_server_set_fsinfo(struct nfs_server *server, - - if (fsinfo->xattr_support) - server->caps |= NFS_CAP_XATTR; -+ else -+ server->caps &= ~NFS_CAP_XATTR; - #endif - } - -diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c -index a1ff4a4f5380eb..4e53708dfcf434 100644 ---- a/fs/nfs/direct.c -+++ b/fs/nfs/direct.c -@@ -469,8 +469,16 @@ ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter, - if (user_backed_iter(iter)) - dreq->flags = NFS_ODIRECT_SHOULD_DIRTY; - -- if (!swap) -- nfs_start_io_direct(inode); -+ if (!swap) { -+ result = nfs_start_io_direct(inode); -+ if (result) { -+ /* release the reference that would usually be -+ * consumed by nfs_direct_read_schedule_iovec() -+ */ -+ nfs_direct_req_release(dreq); -+ goto out_release; -+ } -+ } - - NFS_I(inode)->read_io += count; - requested = nfs_direct_read_schedule_iovec(dreq, iter, iocb->ki_pos); -@@ -1023,7 +1031,14 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter, - requested = nfs_direct_write_schedule_iovec(dreq, iter, pos, - FLUSH_STABLE); - } else { -- nfs_start_io_direct(inode); -+ result = nfs_start_io_direct(inode); -+ if (result) { -+ /* release the reference that would usually be -+ * consumed by nfs_direct_write_schedule_iovec() -+ */ -+ nfs_direct_req_release(dreq); -+ goto out_release; -+ } - - requested = nfs_direct_write_schedule_iovec(dreq, iter, pos, - FLUSH_COND_STABLE); -diff --git a/fs/nfs/file.c b/fs/nfs/file.c -index 003dda0018403d..2f4db026f8d678 100644 ---- a/fs/nfs/file.c -+++ b/fs/nfs/file.c -@@ -167,7 +167,10 @@ nfs_file_read(struct kiocb *iocb, struct iov_iter *to) - iocb->ki_filp, - iov_iter_count(to), (unsigned long) iocb->ki_pos); - -- nfs_start_io_read(inode); -+ result = nfs_start_io_read(inode); -+ if (result) -+ return result; -+ - result = nfs_revalidate_mapping(inode, iocb->ki_filp->f_mapping); - if (!result) { - result = generic_file_read_iter(iocb, to); -@@ -188,7 +191,10 @@ nfs_file_splice_read(struct file *in, loff_t *ppos, struct pipe_inode_info *pipe - - dprintk("NFS: splice_read(%pD2, %zu@%llu)\n", in, len, *ppos); - -- nfs_start_io_read(inode); -+ result = nfs_start_io_read(inode); -+ if (result) -+ return result; -+ - result = nfs_revalidate_mapping(inode, in->f_mapping); - if (!result) { - result = filemap_splice_read(in, ppos, pipe, len, flags); -@@ -668,7 +674,9 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from) - nfs_clear_invalid_mapping(file->f_mapping); - - since = filemap_sample_wb_err(file->f_mapping); -- nfs_start_io_write(inode); -+ error = nfs_start_io_write(inode); -+ if (error) -+ return error; - result = generic_write_checks(iocb, from); - if (result > 0) - result = generic_perform_write(iocb, from); -diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c -index 7354b6b1047833..42c73c647a27fe 100644 ---- a/fs/nfs/flexfilelayout/flexfilelayout.c -+++ b/fs/nfs/flexfilelayout/flexfilelayout.c -@@ -276,7 +276,7 @@ ff_lseg_match_mirrors(struct pnfs_layout_segment *l1, - struct pnfs_layout_segment *l2) - { - const struct nfs4_ff_layout_segment *fl1 = FF_LAYOUT_LSEG(l1); -- const struct nfs4_ff_layout_segment *fl2 = FF_LAYOUT_LSEG(l1); -+ const struct nfs4_ff_layout_segment *fl2 = FF_LAYOUT_LSEG(l2); - u32 i; - - if (fl1->mirror_array_cnt != fl2->mirror_array_cnt) -@@ -756,8 +756,11 @@ ff_layout_choose_ds_for_read(struct pnfs_layout_segment *lseg, - continue; - - if (check_device && -- nfs4_test_deviceid_unavailable(&mirror->mirror_ds->id_node)) -+ nfs4_test_deviceid_unavailable(&mirror->mirror_ds->id_node)) { -+ // reinitialize the error state in case if this is the last iteration -+ ds = ERR_PTR(-EINVAL); - continue; -+ } - - *best_idx = idx; - break; -@@ -787,7 +790,7 @@ ff_layout_choose_best_ds_for_read(struct pnfs_layout_segment *lseg, - struct nfs4_pnfs_ds *ds; - - ds = ff_layout_choose_valid_ds_for_read(lseg, start_idx, best_idx); -- if (ds) -+ if (!IS_ERR(ds)) - return ds; - return ff_layout_choose_any_ds_for_read(lseg, start_idx, best_idx); - } -@@ -801,7 +804,7 @@ ff_layout_get_ds_for_read(struct nfs_pageio_descriptor *pgio, - - ds = ff_layout_choose_best_ds_for_read(lseg, pgio->pg_mirror_idx, - best_idx); -- if (ds || !pgio->pg_mirror_idx) -+ if (!IS_ERR(ds) || !pgio->pg_mirror_idx) - return ds; - return ff_layout_choose_best_ds_for_read(lseg, 0, best_idx); - } -@@ -859,7 +862,7 @@ ff_layout_pg_init_read(struct nfs_pageio_descriptor *pgio, - req->wb_nio = 0; - - ds = ff_layout_get_ds_for_read(pgio, &ds_idx); -- if (!ds) { -+ if (IS_ERR(ds)) { - if (!ff_layout_no_fallback_to_mds(pgio->pg_lseg)) - goto out_mds; - pnfs_generic_pg_cleanup(pgio); -@@ -1063,11 +1066,13 @@ static void ff_layout_resend_pnfs_read(struct nfs_pgio_header *hdr) - { - u32 idx = hdr->pgio_mirror_idx + 1; - u32 new_idx = 0; -+ struct nfs4_pnfs_ds *ds; - -- if (ff_layout_choose_any_ds_for_read(hdr->lseg, idx, &new_idx)) -- ff_layout_send_layouterror(hdr->lseg); -- else -+ ds = ff_layout_choose_any_ds_for_read(hdr->lseg, idx, &new_idx); -+ if (IS_ERR(ds)) - pnfs_error_mark_layout_for_return(hdr->inode, hdr->lseg); -+ else -+ ff_layout_send_layouterror(hdr->lseg); - pnfs_read_resend_pnfs(hdr, new_idx); - } - -diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c -index 7e7dd2aab449dd..5cd5e4226db364 100644 ---- a/fs/nfs/inode.c -+++ b/fs/nfs/inode.c -@@ -645,8 +645,10 @@ nfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, - trace_nfs_setattr_enter(inode); - - /* Write all dirty data */ -- if (S_ISREG(inode->i_mode)) -+ if (S_ISREG(inode->i_mode)) { -+ nfs_file_block_o_direct(NFS_I(inode)); - nfs_sync_inode(inode); -+ } - - fattr = nfs_alloc_fattr_with_label(NFS_SERVER(inode)); - if (fattr == NULL) { -diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h -index 4eea91d054b241..bde81e0abf0ae1 100644 ---- a/fs/nfs/internal.h -+++ b/fs/nfs/internal.h -@@ -6,6 +6,7 @@ - #include "nfs4_fs.h" - #include - #include -+#include - #include - #include - #include -@@ -461,11 +462,11 @@ extern const struct netfs_request_ops nfs_netfs_ops; - #endif - - /* io.c */ --extern void nfs_start_io_read(struct inode *inode); -+extern __must_check int nfs_start_io_read(struct inode *inode); - extern void nfs_end_io_read(struct inode *inode); --extern void nfs_start_io_write(struct inode *inode); -+extern __must_check int nfs_start_io_write(struct inode *inode); - extern void nfs_end_io_write(struct inode *inode); --extern void nfs_start_io_direct(struct inode *inode); -+extern __must_check int nfs_start_io_direct(struct inode *inode); - extern void nfs_end_io_direct(struct inode *inode); - - static inline bool nfs_file_io_is_buffered(struct nfs_inode *nfsi) -@@ -473,6 +474,16 @@ static inline bool nfs_file_io_is_buffered(struct nfs_inode *nfsi) - return test_bit(NFS_INO_ODIRECT, &nfsi->flags) == 0; - } - -+/* Must be called with exclusively locked inode->i_rwsem */ -+static inline void nfs_file_block_o_direct(struct nfs_inode *nfsi) -+{ -+ if (test_bit(NFS_INO_ODIRECT, &nfsi->flags)) { -+ clear_bit(NFS_INO_ODIRECT, &nfsi->flags); -+ inode_dio_wait(&nfsi->vfs_inode); -+ } -+} -+ -+ - /* namespace.c */ - #define NFS_PATH_CANONICAL 1 - extern char *nfs_path(char **p, struct dentry *dentry, -diff --git a/fs/nfs/io.c b/fs/nfs/io.c -index b5551ed8f648bc..d275b0a250bf3b 100644 ---- a/fs/nfs/io.c -+++ b/fs/nfs/io.c -@@ -14,15 +14,6 @@ - - #include "internal.h" - --/* Call with exclusively locked inode->i_rwsem */ --static void nfs_block_o_direct(struct nfs_inode *nfsi, struct inode *inode) --{ -- if (test_bit(NFS_INO_ODIRECT, &nfsi->flags)) { -- clear_bit(NFS_INO_ODIRECT, &nfsi->flags); -- inode_dio_wait(inode); -- } --} -- - /** - * nfs_start_io_read - declare the file is being used for buffered reads - * @inode: file inode -@@ -39,19 +30,28 @@ static void nfs_block_o_direct(struct nfs_inode *nfsi, struct inode *inode) - * Note that buffered writes and truncates both take a write lock on - * inode->i_rwsem, meaning that those are serialised w.r.t. the reads. - */ --void -+int - nfs_start_io_read(struct inode *inode) - { - struct nfs_inode *nfsi = NFS_I(inode); -+ int err; -+ - /* Be an optimist! */ -- down_read(&inode->i_rwsem); -+ err = down_read_killable(&inode->i_rwsem); -+ if (err) -+ return err; - if (test_bit(NFS_INO_ODIRECT, &nfsi->flags) == 0) -- return; -+ return 0; - up_read(&inode->i_rwsem); -+ - /* Slow path.... */ -- down_write(&inode->i_rwsem); -- nfs_block_o_direct(nfsi, inode); -+ err = down_write_killable(&inode->i_rwsem); -+ if (err) -+ return err; -+ nfs_file_block_o_direct(nfsi); - downgrade_write(&inode->i_rwsem); -+ -+ return 0; - } - - /** -@@ -74,11 +74,15 @@ nfs_end_io_read(struct inode *inode) - * Declare that a buffered read operation is about to start, and ensure - * that we block all direct I/O. - */ --void -+int - nfs_start_io_write(struct inode *inode) - { -- down_write(&inode->i_rwsem); -- nfs_block_o_direct(NFS_I(inode), inode); -+ int err; -+ -+ err = down_write_killable(&inode->i_rwsem); -+ if (!err) -+ nfs_file_block_o_direct(NFS_I(inode)); -+ return err; - } - - /** -@@ -119,19 +123,28 @@ static void nfs_block_buffered(struct nfs_inode *nfsi, struct inode *inode) - * Note that buffered writes and truncates both take a write lock on - * inode->i_rwsem, meaning that those are serialised w.r.t. O_DIRECT. - */ --void -+int - nfs_start_io_direct(struct inode *inode) - { - struct nfs_inode *nfsi = NFS_I(inode); -+ int err; -+ - /* Be an optimist! */ -- down_read(&inode->i_rwsem); -+ err = down_read_killable(&inode->i_rwsem); -+ if (err) -+ return err; - if (test_bit(NFS_INO_ODIRECT, &nfsi->flags) != 0) -- return; -+ return 0; - up_read(&inode->i_rwsem); -+ - /* Slow path.... */ -- down_write(&inode->i_rwsem); -+ err = down_write_killable(&inode->i_rwsem); -+ if (err) -+ return err; - nfs_block_buffered(nfsi, inode); - downgrade_write(&inode->i_rwsem); -+ -+ return 0; - } - - /** -diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c -index 9f0d69e6526443..582cf8a469560b 100644 ---- a/fs/nfs/nfs42proc.c -+++ b/fs/nfs/nfs42proc.c -@@ -112,6 +112,7 @@ static int nfs42_proc_fallocate(struct rpc_message *msg, struct file *filep, - exception.inode = inode; - exception.state = lock->open_context->state; - -+ nfs_file_block_o_direct(NFS_I(inode)); - err = nfs_sync_inode(inode); - if (err) - goto out; -@@ -355,6 +356,7 @@ static ssize_t _nfs42_proc_copy(struct file *src, - return status; - } - -+ nfs_file_block_o_direct(NFS_I(dst_inode)); - status = nfs_sync_inode(dst_inode); - if (status) - return status; -diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c -index 02788c3c85e5bb..befdb0f4e6dc3c 100644 ---- a/fs/nfs/nfs4file.c -+++ b/fs/nfs/nfs4file.c -@@ -282,9 +282,11 @@ static loff_t nfs42_remap_file_range(struct file *src_file, loff_t src_off, - - /* flush all pending writes on both src and dst so that server - * has the latest data */ -+ nfs_file_block_o_direct(NFS_I(src_inode)); - ret = nfs_sync_inode(src_inode); - if (ret) - goto out_unlock; -+ nfs_file_block_o_direct(NFS_I(dst_inode)); - ret = nfs_sync_inode(dst_inode); - if (ret) - goto out_unlock; -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 6debcfc63222d2..124b9cee6fed7d 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -3882,8 +3882,9 @@ static int _nfs4_server_capabilities(struct nfs_server *server, struct nfs_fh *f - res.attr_bitmask[2] &= FATTR4_WORD2_NFS42_MASK; - } - memcpy(server->attr_bitmask, res.attr_bitmask, sizeof(server->attr_bitmask)); -- server->caps &= ~(NFS_CAP_ACLS | NFS_CAP_HARDLINKS | -- NFS_CAP_SYMLINKS| NFS_CAP_SECURITY_LABEL); -+ server->caps &= -+ ~(NFS_CAP_ACLS | NFS_CAP_HARDLINKS | NFS_CAP_SYMLINKS | -+ NFS_CAP_SECURITY_LABEL | NFS_CAP_FS_LOCATIONS); - server->fattr_valid = NFS_ATTR_FATTR_V4; - if (res.attr_bitmask[0] & FATTR4_WORD0_ACL && - res.acl_bitmask & ACL4_SUPPORT_ALLOW_ACL) -@@ -3951,7 +3952,6 @@ int nfs4_server_capabilities(struct nfs_server *server, struct nfs_fh *fhandle) - }; - int err; - -- nfs_server_set_init_caps(server); - do { - err = nfs4_handle_exception(server, - _nfs4_server_capabilities(server, fhandle), -diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c -index b2bbf3d6d177e8..cd78b7ecbd4325 100644 ---- a/fs/nfsd/nfs4proc.c -+++ b/fs/nfsd/nfs4proc.c -@@ -1131,6 +1131,7 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, - }; - struct inode *inode; - __be32 status = nfs_ok; -+ bool save_no_wcc; - int err; - - if (setattr->sa_iattr.ia_valid & ATTR_SIZE) { -@@ -1156,8 +1157,11 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, - - if (status) - goto out; -+ save_no_wcc = cstate->current_fh.fh_no_wcc; -+ cstate->current_fh.fh_no_wcc = true; - status = nfsd_setattr(rqstp, &cstate->current_fh, &attrs, - 0, (time64_t)0); -+ cstate->current_fh.fh_no_wcc = save_no_wcc; - if (!status) - status = nfserrno(attrs.na_labelerr); - if (!status) -diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c -index b3e51d88faff46..5ee7149ceaa5a7 100644 ---- a/fs/nfsd/vfs.c -+++ b/fs/nfsd/vfs.c -@@ -480,7 +480,7 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, - int accmode = NFSD_MAY_SATTR; - umode_t ftype = 0; - __be32 err; -- int host_err; -+ int host_err = 0; - bool get_write_count; - bool size_change = (iap->ia_valid & ATTR_SIZE); - int retries; -@@ -538,6 +538,9 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, - } - - inode_lock(inode); -+ err = fh_fill_pre_attrs(fhp); -+ if (err) -+ goto out_unlock; - for (retries = 1;;) { - struct iattr attrs; - -@@ -565,13 +568,15 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, - attr->na_aclerr = set_posix_acl(&nop_mnt_idmap, - dentry, ACL_TYPE_DEFAULT, - attr->na_dpacl); -+ fh_fill_post_attrs(fhp); -+out_unlock: - inode_unlock(inode); - if (size_change) - put_write_access(inode); - out: - if (!host_err) - host_err = commit_metadata(fhp); -- return nfserrno(host_err); -+ return err != 0 ? err : nfserrno(host_err); - } - - #if defined(CONFIG_NFSD_V4) -@@ -1965,11 +1970,9 @@ nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, - err = nfserr_file_open; - else - err = nfserr_acces; -- } else { -- err = nfserrno(host_err); - } - out: -- return err; -+ return err != nfs_ok ? err : nfserrno(host_err); - out_unlock: - inode_unlock(dirp); - goto out_drop_write; -diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c -index f7672472fa8279..5e86c7e2c82125 100644 ---- a/fs/ocfs2/extent_map.c -+++ b/fs/ocfs2/extent_map.c -@@ -696,6 +696,8 @@ int ocfs2_extent_map_get_blocks(struct inode *inode, u64 v_blkno, u64 *p_blkno, - * it not only handles the fiemap for inlined files, but also deals - * with the fast symlink, cause they have no difference for extent - * mapping per se. -+ * -+ * Must be called with ip_alloc_sem semaphore held. - */ - static int ocfs2_fiemap_inline(struct inode *inode, struct buffer_head *di_bh, - struct fiemap_extent_info *fieinfo, -@@ -707,6 +709,7 @@ static int ocfs2_fiemap_inline(struct inode *inode, struct buffer_head *di_bh, - u64 phys; - u32 flags = FIEMAP_EXTENT_DATA_INLINE|FIEMAP_EXTENT_LAST; - struct ocfs2_inode_info *oi = OCFS2_I(inode); -+ lockdep_assert_held_read(&oi->ip_alloc_sem); - - di = (struct ocfs2_dinode *)di_bh->b_data; - if (ocfs2_inode_is_fast_symlink(inode)) -@@ -722,8 +725,11 @@ static int ocfs2_fiemap_inline(struct inode *inode, struct buffer_head *di_bh, - phys += offsetof(struct ocfs2_dinode, - id2.i_data.id_data); - -+ /* Release the ip_alloc_sem to prevent deadlock on page fault */ -+ up_read(&OCFS2_I(inode)->ip_alloc_sem); - ret = fiemap_fill_next_extent(fieinfo, 0, phys, id_count, - flags); -+ down_read(&OCFS2_I(inode)->ip_alloc_sem); - if (ret < 0) - return ret; - } -@@ -792,9 +798,11 @@ int ocfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, - len_bytes = (u64)le16_to_cpu(rec.e_leaf_clusters) << osb->s_clustersize_bits; - phys_bytes = le64_to_cpu(rec.e_blkno) << osb->sb->s_blocksize_bits; - virt_bytes = (u64)le32_to_cpu(rec.e_cpos) << osb->s_clustersize_bits; -- -+ /* Release the ip_alloc_sem to prevent deadlock on page fault */ -+ up_read(&OCFS2_I(inode)->ip_alloc_sem); - ret = fiemap_fill_next_extent(fieinfo, virt_bytes, phys_bytes, - len_bytes, fe_flags); -+ down_read(&OCFS2_I(inode)->ip_alloc_sem); - if (ret) - break; - -diff --git a/fs/proc/generic.c b/fs/proc/generic.c -index db3f2c6abc162a..4cadd2fd23d8f8 100644 ---- a/fs/proc/generic.c -+++ b/fs/proc/generic.c -@@ -388,7 +388,8 @@ struct proc_dir_entry *proc_register(struct proc_dir_entry *dir, - if (proc_alloc_inum(&dp->low_ino)) - goto out_free_entry; - -- pde_set_flags(dp); -+ if (!S_ISDIR(dp->mode)) -+ pde_set_flags(dp); - - write_lock(&proc_subdir_lock); - dp->parent = dir; -diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c -index 7a2b81fbd9cfd2..1058066913dd60 100644 ---- a/fs/smb/client/file.c -+++ b/fs/smb/client/file.c -@@ -2884,17 +2884,21 @@ static ssize_t cifs_write_back_from_locked_folio(struct address_space *mapping, - rc = cifs_get_writable_file(CIFS_I(inode), FIND_WR_ANY, &cfile); - if (rc) { - cifs_dbg(VFS, "No writable handle in writepages rc=%d\n", rc); -+ folio_unlock(folio); - goto err_xid; - } - - rc = server->ops->wait_mtu_credits(server, cifs_sb->ctx->wsize, - &wsize, credits); -- if (rc != 0) -+ if (rc != 0) { -+ folio_unlock(folio); - goto err_close; -+ } - - wdata = cifs_writedata_alloc(cifs_writev_complete); - if (!wdata) { - rc = -ENOMEM; -+ folio_unlock(folio); - goto err_uncredit; - } - -@@ -3041,17 +3045,22 @@ static ssize_t cifs_writepages_begin(struct address_space *mapping, - lock_again: - if (wbc->sync_mode != WB_SYNC_NONE) { - ret = folio_lock_killable(folio); -- if (ret < 0) -+ if (ret < 0) { -+ folio_put(folio); - return ret; -+ } - } else { -- if (!folio_trylock(folio)) -+ if (!folio_trylock(folio)) { -+ folio_put(folio); - goto search_again; -+ } - } - - if (folio->mapping != mapping || - !folio_test_dirty(folio)) { - start += folio_size(folio); - folio_unlock(folio); -+ folio_put(folio); - goto search_again; - } - -@@ -3081,6 +3090,7 @@ static ssize_t cifs_writepages_begin(struct address_space *mapping, - out: - if (ret > 0) - *_start = start + ret; -+ folio_put(folio); - return ret; - } - -diff --git a/fs/smb/server/connection.h b/fs/smb/server/connection.h -index 29ba91fc54076c..45421269ddd881 100644 ---- a/fs/smb/server/connection.h -+++ b/fs/smb/server/connection.h -@@ -27,6 +27,7 @@ enum { - KSMBD_SESS_EXITING, - KSMBD_SESS_NEED_RECONNECT, - KSMBD_SESS_NEED_NEGOTIATE, -+ KSMBD_SESS_NEED_SETUP, - KSMBD_SESS_RELEASING - }; - -@@ -195,6 +196,11 @@ static inline bool ksmbd_conn_need_negotiate(struct ksmbd_conn *conn) - return READ_ONCE(conn->status) == KSMBD_SESS_NEED_NEGOTIATE; - } - -+static inline bool ksmbd_conn_need_setup(struct ksmbd_conn *conn) -+{ -+ return READ_ONCE(conn->status) == KSMBD_SESS_NEED_SETUP; -+} -+ - static inline bool ksmbd_conn_need_reconnect(struct ksmbd_conn *conn) - { - return READ_ONCE(conn->status) == KSMBD_SESS_NEED_RECONNECT; -@@ -225,6 +231,11 @@ static inline void ksmbd_conn_set_need_negotiate(struct ksmbd_conn *conn) - WRITE_ONCE(conn->status, KSMBD_SESS_NEED_NEGOTIATE); - } - -+static inline void ksmbd_conn_set_need_setup(struct ksmbd_conn *conn) -+{ -+ WRITE_ONCE(conn->status, KSMBD_SESS_NEED_SETUP); -+} -+ - static inline void ksmbd_conn_set_need_reconnect(struct ksmbd_conn *conn) - { - WRITE_ONCE(conn->status, KSMBD_SESS_NEED_RECONNECT); -diff --git a/fs/smb/server/mgmt/user_session.c b/fs/smb/server/mgmt/user_session.c -index 82dcc86a32c57a..408f47220c07b7 100644 ---- a/fs/smb/server/mgmt/user_session.c -+++ b/fs/smb/server/mgmt/user_session.c -@@ -373,12 +373,12 @@ void destroy_previous_session(struct ksmbd_conn *conn, - ksmbd_all_conn_set_status(id, KSMBD_SESS_NEED_RECONNECT); - err = ksmbd_conn_wait_idle_sess_id(conn, id); - if (err) { -- ksmbd_all_conn_set_status(id, KSMBD_SESS_NEED_NEGOTIATE); -+ ksmbd_all_conn_set_status(id, KSMBD_SESS_NEED_SETUP); - goto out; - } - ksmbd_destroy_file_table(&prev_sess->file_table); - prev_sess->state = SMB2_SESSION_EXPIRED; -- ksmbd_all_conn_set_status(id, KSMBD_SESS_NEED_NEGOTIATE); -+ ksmbd_all_conn_set_status(id, KSMBD_SESS_NEED_SETUP); - out: - up_write(&conn->session_lock); - up_write(&sessions_table_lock); -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index 85e7bc3a2bd33c..ae47450dc40f82 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -1252,7 +1252,7 @@ int smb2_handle_negotiate(struct ksmbd_work *work) - } - - conn->srv_sec_mode = le16_to_cpu(rsp->SecurityMode); -- ksmbd_conn_set_need_negotiate(conn); -+ ksmbd_conn_set_need_setup(conn); - - err_out: - if (rc) -@@ -1273,6 +1273,9 @@ static int alloc_preauth_hash(struct ksmbd_session *sess, - if (sess->Preauth_HashValue) - return 0; - -+ if (!conn->preauth_info) -+ return -ENOMEM; -+ - sess->Preauth_HashValue = kmemdup(conn->preauth_info->Preauth_HashValue, - PREAUTH_HASHVALUE_SIZE, GFP_KERNEL); - if (!sess->Preauth_HashValue) -@@ -1688,6 +1691,11 @@ int smb2_sess_setup(struct ksmbd_work *work) - - ksmbd_debug(SMB, "Received request for session setup\n"); - -+ if (!ksmbd_conn_need_setup(conn) && !ksmbd_conn_good(conn)) { -+ work->send_no_response = 1; -+ return rc; -+ } -+ - WORK_BUFFERS(work, req, rsp); - - rsp->StructureSize = cpu_to_le16(9); -@@ -1919,7 +1927,7 @@ int smb2_sess_setup(struct ksmbd_work *work) - if (try_delay) { - ksmbd_conn_set_need_reconnect(conn); - ssleep(5); -- ksmbd_conn_set_need_negotiate(conn); -+ ksmbd_conn_set_need_setup(conn); - } - } - smb2_set_err_rsp(work); -@@ -2249,7 +2257,7 @@ int smb2_session_logoff(struct ksmbd_work *work) - ksmbd_free_user(sess->user); - sess->user = NULL; - } -- ksmbd_all_conn_set_status(sess_id, KSMBD_SESS_NEED_NEGOTIATE); -+ ksmbd_all_conn_set_status(sess_id, KSMBD_SESS_NEED_SETUP); - - rsp->StructureSize = cpu_to_le16(4); - err = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_logoff_rsp)); -diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h -index 9b673fefcef8a6..f9de53fff3acc4 100644 ---- a/include/linux/compiler-clang.h -+++ b/include/linux/compiler-clang.h -@@ -23,23 +23,42 @@ - #define KASAN_ABI_VERSION 5 - - /* -+ * Clang 22 added preprocessor macros to match GCC, in hopes of eventually -+ * dropping __has_feature support for sanitizers: -+ * https://github.com/llvm/llvm-project/commit/568c23bbd3303518c5056d7f03444dae4fdc8a9c -+ * Create these macros for older versions of clang so that it is easy to clean -+ * up once the minimum supported version of LLVM for building the kernel always -+ * creates these macros. -+ * - * Note: Checking __has_feature(*_sanitizer) is only true if the feature is - * enabled. Therefore it is not required to additionally check defined(CONFIG_*) - * to avoid adding redundant attributes in other configurations. - */ -+#if __has_feature(address_sanitizer) && !defined(__SANITIZE_ADDRESS__) -+#define __SANITIZE_ADDRESS__ -+#endif -+#if __has_feature(hwaddress_sanitizer) && !defined(__SANITIZE_HWADDRESS__) -+#define __SANITIZE_HWADDRESS__ -+#endif -+#if __has_feature(thread_sanitizer) && !defined(__SANITIZE_THREAD__) -+#define __SANITIZE_THREAD__ -+#endif - --#if __has_feature(address_sanitizer) || __has_feature(hwaddress_sanitizer) --/* Emulate GCC's __SANITIZE_ADDRESS__ flag */ -+/* -+ * Treat __SANITIZE_HWADDRESS__ the same as __SANITIZE_ADDRESS__ in the kernel. -+ */ -+#ifdef __SANITIZE_HWADDRESS__ - #define __SANITIZE_ADDRESS__ -+#endif -+ -+#ifdef __SANITIZE_ADDRESS__ - #define __no_sanitize_address \ - __attribute__((no_sanitize("address", "hwaddress"))) - #else - #define __no_sanitize_address - #endif - --#if __has_feature(thread_sanitizer) --/* emulate gcc's __SANITIZE_THREAD__ flag */ --#define __SANITIZE_THREAD__ -+#ifdef __SANITIZE_THREAD__ - #define __no_sanitize_thread \ - __attribute__((no_sanitize("thread"))) - #else -diff --git a/include/linux/pgalloc.h b/include/linux/pgalloc.h -new file mode 100644 -index 00000000000000..9174fa59bbc54d ---- /dev/null -+++ b/include/linux/pgalloc.h -@@ -0,0 +1,29 @@ -+/* SPDX-License-Identifier: GPL-2.0 */ -+#ifndef _LINUX_PGALLOC_H -+#define _LINUX_PGALLOC_H -+ -+#include -+#include -+ -+/* -+ * {pgd,p4d}_populate_kernel() are defined as macros to allow -+ * compile-time optimization based on the configured page table levels. -+ * Without this, linking may fail because callers (e.g., KASAN) may rely -+ * on calls to these functions being optimized away when passing symbols -+ * that exist only for certain page table levels. -+ */ -+#define pgd_populate_kernel(addr, pgd, p4d) \ -+ do { \ -+ pgd_populate(&init_mm, pgd, p4d); \ -+ if (ARCH_PAGE_TABLE_SYNC_MASK & PGTBL_PGD_MODIFIED) \ -+ arch_sync_kernel_mappings(addr, addr); \ -+ } while (0) -+ -+#define p4d_populate_kernel(addr, p4d, pud) \ -+ do { \ -+ p4d_populate(&init_mm, p4d, pud); \ -+ if (ARCH_PAGE_TABLE_SYNC_MASK & PGTBL_P4D_MODIFIED) \ -+ arch_sync_kernel_mappings(addr, addr); \ -+ } while (0) -+ -+#endif /* _LINUX_PGALLOC_H */ -diff --git a/include/linux/pgtable.h b/include/linux/pgtable.h -index e42388b6998b17..78a518129e8f06 100644 ---- a/include/linux/pgtable.h -+++ b/include/linux/pgtable.h -@@ -1467,8 +1467,8 @@ static inline int pmd_protnone(pmd_t pmd) - - /* - * Architectures can set this mask to a combination of PGTBL_P?D_MODIFIED values -- * and let generic vmalloc and ioremap code know when arch_sync_kernel_mappings() -- * needs to be called. -+ * and let generic vmalloc, ioremap and page table update code know when -+ * arch_sync_kernel_mappings() needs to be called. - */ - #ifndef ARCH_PAGE_TABLE_SYNC_MASK - #define ARCH_PAGE_TABLE_SYNC_MASK 0 -@@ -1601,10 +1601,11 @@ static inline bool arch_has_pfn_modify_check(void) - /* - * Page Table Modification bits for pgtbl_mod_mask. - * -- * These are used by the p?d_alloc_track*() set of functions an in the generic -- * vmalloc/ioremap code to track at which page-table levels entries have been -- * modified. Based on that the code can better decide when vmalloc and ioremap -- * mapping changes need to be synchronized to other page-tables in the system. -+ * These are used by the p?d_alloc_track*() and p*d_populate_kernel() -+ * functions in the generic vmalloc, ioremap and page table update code -+ * to track at which page-table levels entries have been modified. -+ * Based on that the code can better decide when page table changes need -+ * to be synchronized to other page-tables in the system. - */ - #define __PGTBL_PGD_MODIFIED 0 - #define __PGTBL_P4D_MODIFIED 1 -diff --git a/include/net/sock.h b/include/net/sock.h -index b5f7208a9ec383..f8e029cc48ccce 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -353,6 +353,8 @@ struct sk_filter; - * @sk_txtime_unused: unused txtime flags - * @ns_tracker: tracker for netns reference - * @sk_bind2_node: bind node in the bhash2 table -+ * @sk_owner: reference to the real owner of the socket that calls -+ * sock_lock_init_class_and_name(). - */ - struct sock { - /* -@@ -545,6 +547,10 @@ struct sock { - struct rcu_head sk_rcu; - netns_tracker ns_tracker; - struct hlist_node sk_bind2_node; -+ -+#if IS_ENABLED(CONFIG_PROVE_LOCKING) && IS_ENABLED(CONFIG_MODULES) -+ struct module *sk_owner; -+#endif - }; - - enum sk_pacing { -@@ -1699,6 +1705,35 @@ static inline void sk_mem_uncharge(struct sock *sk, int size) - sk_mem_reclaim(sk); - } - -+#if IS_ENABLED(CONFIG_PROVE_LOCKING) && IS_ENABLED(CONFIG_MODULES) -+static inline void sk_owner_set(struct sock *sk, struct module *owner) -+{ -+ __module_get(owner); -+ sk->sk_owner = owner; -+} -+ -+static inline void sk_owner_clear(struct sock *sk) -+{ -+ sk->sk_owner = NULL; -+} -+ -+static inline void sk_owner_put(struct sock *sk) -+{ -+ module_put(sk->sk_owner); -+} -+#else -+static inline void sk_owner_set(struct sock *sk, struct module *owner) -+{ -+} -+ -+static inline void sk_owner_clear(struct sock *sk) -+{ -+} -+ -+static inline void sk_owner_put(struct sock *sk) -+{ -+} -+#endif - /* - * Macro so as to not evaluate some arguments when - * lockdep is not enabled. -@@ -1708,13 +1743,14 @@ static inline void sk_mem_uncharge(struct sock *sk, int size) - */ - #define sock_lock_init_class_and_name(sk, sname, skey, name, key) \ - do { \ -+ sk_owner_set(sk, THIS_MODULE); \ - sk->sk_lock.owned = 0; \ - init_waitqueue_head(&sk->sk_lock.wq); \ - spin_lock_init(&(sk)->sk_lock.slock); \ - debug_check_no_locks_freed((void *)&(sk)->sk_lock, \ -- sizeof((sk)->sk_lock)); \ -+ sizeof((sk)->sk_lock)); \ - lockdep_set_class_and_name(&(sk)->sk_lock.slock, \ -- (skey), (sname)); \ -+ (skey), (sname)); \ - lockdep_init_map(&(sk)->sk_lock.dep_map, (name), (key), 0); \ - } while (0) - -diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c -index 4b20a72ab8cffe..90c281e1379eeb 100644 ---- a/kernel/bpf/helpers.c -+++ b/kernel/bpf/helpers.c -@@ -1204,8 +1204,11 @@ static int __bpf_async_init(struct bpf_async_kern *async, struct bpf_map *map, u - goto out; - } - -- /* allocate hrtimer via map_kmalloc to use memcg accounting */ -- cb = bpf_map_kmalloc_node(map, size, GFP_ATOMIC, map->numa_node); -+ /* Allocate via bpf_map_kmalloc_node() for memcg accounting. Until -+ * kmalloc_nolock() is available, avoid locking issues by using -+ * __GFP_HIGH (GFP_ATOMIC & ~__GFP_RECLAIM). -+ */ -+ cb = bpf_map_kmalloc_node(map, size, __GFP_HIGH, map->numa_node); - if (!cb) { - ret = -ENOMEM; - goto out; -diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h -index 3fcd9f92d38612..9189ccd4fee472 100644 ---- a/kernel/rcu/tasks.h -+++ b/kernel/rcu/tasks.h -@@ -150,8 +150,6 @@ static struct rcu_tasks rt_name = \ - } - - #ifdef CONFIG_TASKS_RCU --/* Track exiting tasks in order to allow them to be waited for. */ --DEFINE_STATIC_SRCU(tasks_rcu_exit_srcu); - - /* Report delay in synchronize_srcu() completion in rcu_tasks_postscan(). */ - static void tasks_rcu_exit_srcu_stall(struct timer_list *unused); -@@ -879,10 +877,12 @@ static void rcu_tasks_wait_gp(struct rcu_tasks *rtp) - // number of voluntary context switches, and add that task to the - // holdout list. - // rcu_tasks_postscan(): --// Invoke synchronize_srcu() to ensure that all tasks that were --// in the process of exiting (and which thus might not know to --// synchronize with this RCU Tasks grace period) have completed --// exiting. -+// Gather per-CPU lists of tasks in do_exit() to ensure that all -+// tasks that were in the process of exiting (and which thus might -+// not know to synchronize with this RCU Tasks grace period) have -+// completed exiting. The synchronize_rcu() in rcu_tasks_postgp() -+// will take care of any tasks stuck in the non-preemptible region -+// of do_exit() following its call to exit_tasks_rcu_stop(). - // check_all_holdout_tasks(), repeatedly until holdout list is empty: - // Scans the holdout list, attempting to identify a quiescent state - // for each task on the list. If there is a quiescent state, the -@@ -895,8 +895,10 @@ static void rcu_tasks_wait_gp(struct rcu_tasks *rtp) - // with interrupts disabled. - // - // For each exiting task, the exit_tasks_rcu_start() and --// exit_tasks_rcu_finish() functions begin and end, respectively, the SRCU --// read-side critical sections waited for by rcu_tasks_postscan(). -+// exit_tasks_rcu_finish() functions add and remove, respectively, the -+// current task to a per-CPU list of tasks that rcu_tasks_postscan() must -+// wait on. This is necessary because rcu_tasks_postscan() must wait on -+// tasks that have already been removed from the global list of tasks. - // - // Pre-grace-period update-side code is ordered before the grace - // via the raw_spin_lock.*rcu_node(). Pre-grace-period read-side code -@@ -960,9 +962,13 @@ static void rcu_tasks_pertask(struct task_struct *t, struct list_head *hop) - } - } - -+void call_rcu_tasks(struct rcu_head *rhp, rcu_callback_t func); -+DEFINE_RCU_TASKS(rcu_tasks, rcu_tasks_wait_gp, call_rcu_tasks, "RCU Tasks"); -+ - /* Processing between scanning taskslist and draining the holdout list. */ - static void rcu_tasks_postscan(struct list_head *hop) - { -+ int cpu; - int rtsi = READ_ONCE(rcu_task_stall_info); - - if (!IS_ENABLED(CONFIG_TINY_RCU)) { -@@ -976,9 +982,9 @@ static void rcu_tasks_postscan(struct list_head *hop) - * this, divide the fragile exit path part in two intersecting - * read side critical sections: - * -- * 1) An _SRCU_ read side starting before calling exit_notify(), -- * which may remove the task from the tasklist, and ending after -- * the final preempt_disable() call in do_exit(). -+ * 1) A task_struct list addition before calling exit_notify(), -+ * which may remove the task from the tasklist, with the -+ * removal after the final preempt_disable() call in do_exit(). - * - * 2) An _RCU_ read side starting with the final preempt_disable() - * call in do_exit() and ending with the final call to schedule() -@@ -987,7 +993,37 @@ static void rcu_tasks_postscan(struct list_head *hop) - * This handles the part 1). And postgp will handle part 2) with a - * call to synchronize_rcu(). - */ -- synchronize_srcu(&tasks_rcu_exit_srcu); -+ -+ for_each_possible_cpu(cpu) { -+ unsigned long j = jiffies + 1; -+ struct rcu_tasks_percpu *rtpcp = per_cpu_ptr(rcu_tasks.rtpcpu, cpu); -+ struct task_struct *t; -+ struct task_struct *t1; -+ struct list_head tmp; -+ -+ raw_spin_lock_irq_rcu_node(rtpcp); -+ list_for_each_entry_safe(t, t1, &rtpcp->rtp_exit_list, rcu_tasks_exit_list) { -+ if (list_empty(&t->rcu_tasks_holdout_list)) -+ rcu_tasks_pertask(t, hop); -+ -+ // RT kernels need frequent pauses, otherwise -+ // pause at least once per pair of jiffies. -+ if (!IS_ENABLED(CONFIG_PREEMPT_RT) && time_before(jiffies, j)) -+ continue; -+ -+ // Keep our place in the list while pausing. -+ // Nothing else traverses this list, so adding a -+ // bare list_head is OK. -+ list_add(&tmp, &t->rcu_tasks_exit_list); -+ raw_spin_unlock_irq_rcu_node(rtpcp); -+ cond_resched(); // For CONFIG_PREEMPT=n kernels -+ raw_spin_lock_irq_rcu_node(rtpcp); -+ t1 = list_entry(tmp.next, struct task_struct, rcu_tasks_exit_list); -+ list_del(&tmp); -+ j = jiffies + 1; -+ } -+ raw_spin_unlock_irq_rcu_node(rtpcp); -+ } - - if (!IS_ENABLED(CONFIG_TINY_RCU)) - del_timer_sync(&tasks_rcu_exit_srcu_stall_timer); -@@ -1055,7 +1091,6 @@ static void rcu_tasks_postgp(struct rcu_tasks *rtp) - * - * In addition, this synchronize_rcu() waits for exiting tasks - * to complete their final preempt_disable() region of execution, -- * cleaning up after synchronize_srcu(&tasks_rcu_exit_srcu), - * enforcing the whole region before tasklist removal until - * the final schedule() with TASK_DEAD state to be an RCU TASKS - * read side critical section. -@@ -1063,9 +1098,6 @@ static void rcu_tasks_postgp(struct rcu_tasks *rtp) - synchronize_rcu(); - } - --void call_rcu_tasks(struct rcu_head *rhp, rcu_callback_t func); --DEFINE_RCU_TASKS(rcu_tasks, rcu_tasks_wait_gp, call_rcu_tasks, "RCU Tasks"); -- - static void tasks_rcu_exit_srcu_stall(struct timer_list *unused) - { - #ifndef CONFIG_TINY_RCU -@@ -1175,25 +1207,48 @@ struct task_struct *get_rcu_tasks_gp_kthread(void) - EXPORT_SYMBOL_GPL(get_rcu_tasks_gp_kthread); - - /* -- * Contribute to protect against tasklist scan blind spot while the -- * task is exiting and may be removed from the tasklist. See -- * corresponding synchronize_srcu() for further details. -+ * Protect against tasklist scan blind spot while the task is exiting and -+ * may be removed from the tasklist. Do this by adding the task to yet -+ * another list. -+ * -+ * Note that the task will remove itself from this list, so there is no -+ * need for get_task_struct(), except in the case where rcu_tasks_pertask() -+ * adds it to the holdout list, in which case rcu_tasks_pertask() supplies -+ * the needed get_task_struct(). - */ --void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu) -+void exit_tasks_rcu_start(void) - { -- current->rcu_tasks_idx = __srcu_read_lock(&tasks_rcu_exit_srcu); -+ unsigned long flags; -+ struct rcu_tasks_percpu *rtpcp; -+ struct task_struct *t = current; -+ -+ WARN_ON_ONCE(!list_empty(&t->rcu_tasks_exit_list)); -+ preempt_disable(); -+ rtpcp = this_cpu_ptr(rcu_tasks.rtpcpu); -+ t->rcu_tasks_exit_cpu = smp_processor_id(); -+ raw_spin_lock_irqsave_rcu_node(rtpcp, flags); -+ if (!rtpcp->rtp_exit_list.next) -+ INIT_LIST_HEAD(&rtpcp->rtp_exit_list); -+ list_add(&t->rcu_tasks_exit_list, &rtpcp->rtp_exit_list); -+ raw_spin_unlock_irqrestore_rcu_node(rtpcp, flags); -+ preempt_enable(); - } - - /* -- * Contribute to protect against tasklist scan blind spot while the -- * task is exiting and may be removed from the tasklist. See -- * corresponding synchronize_srcu() for further details. -+ * Remove the task from the "yet another list" because do_exit() is now -+ * non-preemptible, allowing synchronize_rcu() to wait beyond this point. - */ --void exit_tasks_rcu_stop(void) __releases(&tasks_rcu_exit_srcu) -+void exit_tasks_rcu_stop(void) - { -+ unsigned long flags; -+ struct rcu_tasks_percpu *rtpcp; - struct task_struct *t = current; - -- __srcu_read_unlock(&tasks_rcu_exit_srcu, t->rcu_tasks_idx); -+ WARN_ON_ONCE(list_empty(&t->rcu_tasks_exit_list)); -+ rtpcp = per_cpu_ptr(rcu_tasks.rtpcpu, t->rcu_tasks_exit_cpu); -+ raw_spin_lock_irqsave_rcu_node(rtpcp, flags); -+ list_del_init(&t->rcu_tasks_exit_list); -+ raw_spin_unlock_irqrestore_rcu_node(rtpcp, flags); - } - - /* -diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c -index 6d9da768604d68..ccea52adcba672 100644 ---- a/kernel/time/hrtimer.c -+++ b/kernel/time/hrtimer.c -@@ -671,17 +671,12 @@ static inline ktime_t hrtimer_update_base(struct hrtimer_cpu_base *base) - /* - * Is the high resolution mode active ? - */ --static inline int __hrtimer_hres_active(struct hrtimer_cpu_base *cpu_base) -+static inline int hrtimer_hres_active(struct hrtimer_cpu_base *cpu_base) - { - return IS_ENABLED(CONFIG_HIGH_RES_TIMERS) ? - cpu_base->hres_active : 0; - } - --static inline int hrtimer_hres_active(void) --{ -- return __hrtimer_hres_active(this_cpu_ptr(&hrtimer_bases)); --} -- - static void __hrtimer_reprogram(struct hrtimer_cpu_base *cpu_base, - struct hrtimer *next_timer, - ktime_t expires_next) -@@ -705,7 +700,7 @@ static void __hrtimer_reprogram(struct hrtimer_cpu_base *cpu_base, - * set. So we'd effectively block all timers until the T2 event - * fires. - */ -- if (!__hrtimer_hres_active(cpu_base) || cpu_base->hang_detected) -+ if (!hrtimer_hres_active(cpu_base) || cpu_base->hang_detected) - return; - - tick_program_event(expires_next, 1); -@@ -813,13 +808,13 @@ static void retrigger_next_event(void *arg) - * of the next expiring timer is enough. The return from the SMP - * function call will take care of the reprogramming in case the - * CPU was in a NOHZ idle sleep. -+ * -+ * In periodic low resolution mode, the next softirq expiration -+ * must also be updated. - */ -- if (!__hrtimer_hres_active(base) && !tick_nohz_active) -- return; -- - raw_spin_lock(&base->lock); - hrtimer_update_base(base); -- if (__hrtimer_hres_active(base)) -+ if (hrtimer_hres_active(base)) - hrtimer_force_reprogram(base, 0); - else - hrtimer_update_next_event(base); -@@ -976,7 +971,7 @@ void clock_was_set(unsigned int bases) - cpumask_var_t mask; - int cpu; - -- if (!__hrtimer_hres_active(cpu_base) && !tick_nohz_active) -+ if (!hrtimer_hres_active(cpu_base) && !tick_nohz_active) - goto out_timerfd; - - if (!zalloc_cpumask_var(&mask, GFP_KERNEL)) { -@@ -1554,7 +1549,7 @@ u64 hrtimer_get_next_event(void) - - raw_spin_lock_irqsave(&cpu_base->lock, flags); - -- if (!__hrtimer_hres_active(cpu_base)) -+ if (!hrtimer_hres_active(cpu_base)) - expires = __hrtimer_get_next_event(cpu_base, HRTIMER_ACTIVE_ALL); - - raw_spin_unlock_irqrestore(&cpu_base->lock, flags); -@@ -1577,7 +1572,7 @@ u64 hrtimer_next_event_without(const struct hrtimer *exclude) - - raw_spin_lock_irqsave(&cpu_base->lock, flags); - -- if (__hrtimer_hres_active(cpu_base)) { -+ if (hrtimer_hres_active(cpu_base)) { - unsigned int active; - - if (!cpu_base->softirq_activated) { -@@ -1938,25 +1933,7 @@ void hrtimer_interrupt(struct clock_event_device *dev) - tick_program_event(expires_next, 1); - pr_warn_once("hrtimer: interrupt took %llu ns\n", ktime_to_ns(delta)); - } -- --/* called with interrupts disabled */ --static inline void __hrtimer_peek_ahead_timers(void) --{ -- struct tick_device *td; -- -- if (!hrtimer_hres_active()) -- return; -- -- td = this_cpu_ptr(&tick_cpu_device); -- if (td && td->evtdev) -- hrtimer_interrupt(td->evtdev); --} -- --#else /* CONFIG_HIGH_RES_TIMERS */ -- --static inline void __hrtimer_peek_ahead_timers(void) { } -- --#endif /* !CONFIG_HIGH_RES_TIMERS */ -+#endif /* !CONFIG_HIGH_RES_TIMERS */ - - /* - * Called from run_local_timers in hardirq context every jiffy -@@ -1967,7 +1944,7 @@ void hrtimer_run_queues(void) - unsigned long flags; - ktime_t now; - -- if (__hrtimer_hres_active(cpu_base)) -+ if (hrtimer_hres_active(cpu_base)) - return; - - /* -@@ -2312,11 +2289,6 @@ int hrtimers_cpu_dying(unsigned int dying_cpu) - &new_base->clock_base[i]); - } - -- /* -- * The migration might have changed the first expiring softirq -- * timer on this CPU. Update it. -- */ -- __hrtimer_get_next_event(new_base, HRTIMER_ACTIVE_SOFT); - /* Tell the other CPU to retrigger the next event */ - smp_call_function_single(ncpu, retrigger_next_event, NULL, 0); - -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index a32c8637503d14..a111be83c36939 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -750,7 +750,10 @@ int trace_pid_write(struct trace_pid_list *filtered_pids, - /* copy the current bits to the new max */ - ret = trace_pid_list_first(filtered_pids, &pid); - while (!ret) { -- trace_pid_list_set(pid_list, pid); -+ ret = trace_pid_list_set(pid_list, pid); -+ if (ret < 0) -+ goto out; -+ - ret = trace_pid_list_next(filtered_pids, pid + 1, &pid); - nr_pids++; - } -@@ -787,6 +790,7 @@ int trace_pid_write(struct trace_pid_list *filtered_pids, - trace_parser_clear(&parser); - ret = 0; - } -+ out: - trace_parser_put(&parser); - - if (ret < 0) { -@@ -7226,7 +7230,7 @@ tracing_mark_write(struct file *filp, const char __user *ubuf, - entry = ring_buffer_event_data(event); - entry->ip = _THIS_IP_; - -- len = __copy_from_user_inatomic(&entry->buf, ubuf, cnt); -+ len = copy_from_user_nofault(&entry->buf, ubuf, cnt); - if (len) { - memcpy(&entry->buf, FAULTED_STR, FAULTED_SIZE); - cnt = FAULTED_SIZE; -@@ -7301,7 +7305,7 @@ tracing_mark_raw_write(struct file *filp, const char __user *ubuf, - - entry = ring_buffer_event_data(event); - -- len = __copy_from_user_inatomic(&entry->id, ubuf, cnt); -+ len = copy_from_user_nofault(&entry->id, ubuf, cnt); - if (len) { - entry->id = -1; - memcpy(&entry->buf, FAULTED_STR, FAULTED_SIZE); -diff --git a/mm/Kconfig b/mm/Kconfig -index c11cd01169e8d1..046c32686fc4d8 100644 ---- a/mm/Kconfig -+++ b/mm/Kconfig -@@ -280,7 +280,7 @@ config SLAB - - config SLUB_TINY - bool "Configure SLUB for minimal memory footprint" -- depends on SLUB && EXPERT -+ depends on SLUB && EXPERT && !COMPILE_TEST - select SLAB_MERGE_DEFAULT - help - Configures the SLUB allocator in a way to achieve minimal memory -diff --git a/mm/damon/core.c b/mm/damon/core.c -index 43e4fe7ef17eb4..48747236c21ca8 100644 ---- a/mm/damon/core.c -+++ b/mm/damon/core.c -@@ -1043,6 +1043,10 @@ static void damos_adjust_quota(struct damon_ctx *c, struct damos *s) - if (!quota->ms && !quota->sz) - return; - -+ /* First charge window */ -+ if (!quota->total_charged_sz && !quota->charged_from) -+ quota->charged_from = jiffies; -+ - /* New charge window starts */ - if (time_after_eq(jiffies, quota->charged_from + - msecs_to_jiffies(quota->reset_interval))) { -diff --git a/mm/damon/lru_sort.c b/mm/damon/lru_sort.c -index 3de2916a65c38c..b4032538b22cf7 100644 ---- a/mm/damon/lru_sort.c -+++ b/mm/damon/lru_sort.c -@@ -203,6 +203,9 @@ static int damon_lru_sort_apply_parameters(void) - unsigned int hot_thres, cold_thres; - int err = 0; - -+ if (!damon_lru_sort_mon_attrs.sample_interval) -+ return -EINVAL; -+ - err = damon_set_attrs(ctx, &damon_lru_sort_mon_attrs); - if (err) - return err; -diff --git a/mm/damon/reclaim.c b/mm/damon/reclaim.c -index 66e190f0374ac8..586daa2cefe4fe 100644 ---- a/mm/damon/reclaim.c -+++ b/mm/damon/reclaim.c -@@ -167,6 +167,9 @@ static int damon_reclaim_apply_parameters(void) - struct damos_filter *filter; - int err = 0; - -+ if (!damon_reclaim_mon_attrs.aggr_interval) -+ return -EINVAL; -+ - err = damon_set_attrs(ctx, &damon_reclaim_mon_attrs); - if (err) - return err; -diff --git a/mm/damon/sysfs.c b/mm/damon/sysfs.c -index b317f51dcc9876..91893543d47ca3 100644 ---- a/mm/damon/sysfs.c -+++ b/mm/damon/sysfs.c -@@ -1055,14 +1055,18 @@ static ssize_t state_show(struct kobject *kobj, struct kobj_attribute *attr, - { - struct damon_sysfs_kdamond *kdamond = container_of(kobj, - struct damon_sysfs_kdamond, kobj); -- struct damon_ctx *ctx = kdamond->damon_ctx; -- bool running; -+ struct damon_ctx *ctx; -+ bool running = false; - -- if (!ctx) -- running = false; -- else -+ if (!mutex_trylock(&damon_sysfs_lock)) -+ return -EBUSY; -+ -+ ctx = kdamond->damon_ctx; -+ if (ctx) - running = damon_sysfs_ctx_running(ctx); - -+ mutex_unlock(&damon_sysfs_lock); -+ - return sysfs_emit(buf, "%s\n", running ? - damon_sysfs_cmd_strs[DAMON_SYSFS_CMD_ON] : - damon_sysfs_cmd_strs[DAMON_SYSFS_CMD_OFF]); -diff --git a/mm/kasan/init.c b/mm/kasan/init.c -index 89895f38f72242..afecc04b486a63 100644 ---- a/mm/kasan/init.c -+++ b/mm/kasan/init.c -@@ -13,9 +13,9 @@ - #include - #include - #include -+#include - - #include --#include - - #include "kasan.h" - -@@ -197,7 +197,7 @@ static int __ref zero_p4d_populate(pgd_t *pgd, unsigned long addr, - pud_t *pud; - pmd_t *pmd; - -- p4d_populate(&init_mm, p4d, -+ p4d_populate_kernel(addr, p4d, - lm_alias(kasan_early_shadow_pud)); - pud = pud_offset(p4d, addr); - pud_populate(&init_mm, pud, -@@ -218,7 +218,7 @@ static int __ref zero_p4d_populate(pgd_t *pgd, unsigned long addr, - } else { - p = early_alloc(PAGE_SIZE, NUMA_NO_NODE); - pud_init(p); -- p4d_populate(&init_mm, p4d, p); -+ p4d_populate_kernel(addr, p4d, p); - } - } - zero_pud_populate(p4d, addr, next); -@@ -257,10 +257,10 @@ int __ref kasan_populate_early_shadow(const void *shadow_start, - * puds,pmds, so pgd_populate(), pud_populate() - * is noops. - */ -- pgd_populate(&init_mm, pgd, -+ pgd_populate_kernel(addr, pgd, - lm_alias(kasan_early_shadow_p4d)); - p4d = p4d_offset(pgd, addr); -- p4d_populate(&init_mm, p4d, -+ p4d_populate_kernel(addr, p4d, - lm_alias(kasan_early_shadow_pud)); - pud = pud_offset(p4d, addr); - pud_populate(&init_mm, pud, -@@ -279,7 +279,7 @@ int __ref kasan_populate_early_shadow(const void *shadow_start, - if (!p) - return -ENOMEM; - } else { -- pgd_populate(&init_mm, pgd, -+ pgd_populate_kernel(addr, pgd, - early_alloc(PAGE_SIZE, NUMA_NO_NODE)); - } - } -diff --git a/mm/kasan/kasan_test.c b/mm/kasan/kasan_test.c -index ecf9f5aa352005..9ca21d1e10ac19 100644 ---- a/mm/kasan/kasan_test.c -+++ b/mm/kasan/kasan_test.c -@@ -1053,6 +1053,7 @@ static void kasan_strings(struct kunit *test) - - ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO); - KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); -+ OPTIMIZER_HIDE_VAR(ptr); - - kfree(ptr); - -diff --git a/mm/khugepaged.c b/mm/khugepaged.c -index f227b39ae4cf74..16d29ee602c70a 100644 ---- a/mm/khugepaged.c -+++ b/mm/khugepaged.c -@@ -1240,6 +1240,7 @@ static int hpage_collapse_scan_pmd(struct mm_struct *mm, - int result = SCAN_FAIL, referenced = 0; - int none_or_zero = 0, shared = 0; - struct page *page = NULL; -+ struct folio *folio = NULL; - unsigned long _address; - spinlock_t *ptl; - int node = NUMA_NO_NODE, unmapped = 0; -@@ -1326,29 +1327,28 @@ static int hpage_collapse_scan_pmd(struct mm_struct *mm, - } - } - -- page = compound_head(page); -- -+ folio = page_folio(page); - /* - * Record which node the original page is from and save this - * information to cc->node_load[]. - * Khugepaged will allocate hugepage from the node has the max - * hit record. - */ -- node = page_to_nid(page); -+ node = folio_nid(folio); - if (hpage_collapse_scan_abort(node, cc)) { - result = SCAN_SCAN_ABORT; - goto out_unmap; - } - cc->node_load[node]++; -- if (!PageLRU(page)) { -+ if (!folio_test_lru(folio)) { - result = SCAN_PAGE_LRU; - goto out_unmap; - } -- if (PageLocked(page)) { -+ if (folio_test_locked(folio)) { - result = SCAN_PAGE_LOCK; - goto out_unmap; - } -- if (!PageAnon(page)) { -+ if (!folio_test_anon(folio)) { - result = SCAN_PAGE_ANON; - goto out_unmap; - } -@@ -1363,7 +1363,7 @@ static int hpage_collapse_scan_pmd(struct mm_struct *mm, - * has excessive GUP pins (i.e. 512). Anyway the same check - * will be done again later the risk seems low. - */ -- if (!is_refcount_suitable(page)) { -+ if (!is_refcount_suitable(&folio->page)) { - result = SCAN_PAGE_COUNT; - goto out_unmap; - } -@@ -1373,9 +1373,9 @@ static int hpage_collapse_scan_pmd(struct mm_struct *mm, - * enough young pte to justify collapsing the page - */ - if (cc->is_khugepaged && -- (pte_young(pteval) || page_is_young(page) || -- PageReferenced(page) || mmu_notifier_test_young(vma->vm_mm, -- address))) -+ (pte_young(pteval) || folio_test_young(folio) || -+ folio_test_referenced(folio) || -+ mmu_notifier_test_young(vma->vm_mm, _address))) - referenced++; - } - if (!writable) { -@@ -1396,7 +1396,7 @@ static int hpage_collapse_scan_pmd(struct mm_struct *mm, - *mmap_locked = false; - } - out: -- trace_mm_khugepaged_scan_pmd(mm, page, writable, referenced, -+ trace_mm_khugepaged_scan_pmd(mm, &folio->page, writable, referenced, - none_or_zero, result, unmapped); - return result; - } -diff --git a/mm/memory-failure.c b/mm/memory-failure.c -index dae5e60d64e2fd..8bedcd288a0cc9 100644 ---- a/mm/memory-failure.c -+++ b/mm/memory-failure.c -@@ -2535,10 +2535,9 @@ int unpoison_memory(unsigned long pfn) - static DEFINE_RATELIMIT_STATE(unpoison_rs, DEFAULT_RATELIMIT_INTERVAL, - DEFAULT_RATELIMIT_BURST); - -- if (!pfn_valid(pfn)) -- return -ENXIO; -- -- p = pfn_to_page(pfn); -+ p = pfn_to_online_page(pfn); -+ if (!p) -+ return -EIO; - folio = page_folio(p); - - mutex_lock(&mf_mutex); -diff --git a/mm/percpu.c b/mm/percpu.c -index d287cebd58caa3..38d5121c2b652a 100644 ---- a/mm/percpu.c -+++ b/mm/percpu.c -@@ -3157,7 +3157,7 @@ int __init pcpu_embed_first_chunk(size_t reserved_size, size_t dyn_size, - #endif /* BUILD_EMBED_FIRST_CHUNK */ - - #ifdef BUILD_PAGE_FIRST_CHUNK --#include -+#include - - #ifndef P4D_TABLE_SIZE - #define P4D_TABLE_SIZE PAGE_SIZE -@@ -3185,7 +3185,7 @@ void __init __weak pcpu_populate_pte(unsigned long addr) - p4d = memblock_alloc(P4D_TABLE_SIZE, P4D_TABLE_SIZE); - if (!p4d) - goto err_alloc; -- pgd_populate(&init_mm, pgd, p4d); -+ pgd_populate_kernel(addr, pgd, p4d); - } - - p4d = p4d_offset(pgd, addr); -@@ -3193,7 +3193,7 @@ void __init __weak pcpu_populate_pte(unsigned long addr) - pud = memblock_alloc(PUD_TABLE_SIZE, PUD_TABLE_SIZE); - if (!pud) - goto err_alloc; -- p4d_populate(&init_mm, p4d, pud); -+ p4d_populate_kernel(addr, p4d, pud); - } - - pud = pud_offset(p4d, addr); -diff --git a/mm/sparse-vmemmap.c b/mm/sparse-vmemmap.c -index a2cbe44c48e10f..589d6a262b6dad 100644 ---- a/mm/sparse-vmemmap.c -+++ b/mm/sparse-vmemmap.c -@@ -27,9 +27,9 @@ - #include - #include - #include -+#include - - #include --#include - - /* - * Allocate a block of memory to be used to back the virtual memory map -@@ -225,7 +225,7 @@ p4d_t * __meminit vmemmap_p4d_populate(pgd_t *pgd, unsigned long addr, int node) - if (!p) - return NULL; - pud_init(p); -- p4d_populate(&init_mm, p4d, p); -+ p4d_populate_kernel(addr, p4d, p); - } - return p4d; - } -@@ -237,7 +237,7 @@ pgd_t * __meminit vmemmap_pgd_populate(unsigned long addr, int node) - void *p = vmemmap_alloc_block_zero(PAGE_SIZE, node); - if (!p) - return NULL; -- pgd_populate(&init_mm, pgd, p); -+ pgd_populate_kernel(addr, pgd, p); - } - return pgd; - } -diff --git a/net/bridge/br.c b/net/bridge/br.c -index a6e94ceb7c9a08..a45db67197226b 100644 ---- a/net/bridge/br.c -+++ b/net/bridge/br.c -@@ -312,6 +312,13 @@ int br_boolopt_multi_toggle(struct net_bridge *br, - int err = 0; - int opt_id; - -+ opt_id = find_next_bit(&bitmap, BITS_PER_LONG, BR_BOOLOPT_MAX); -+ if (opt_id != BITS_PER_LONG) { -+ NL_SET_ERR_MSG_FMT_MOD(extack, "Unknown boolean option %d", -+ opt_id); -+ return -EINVAL; -+ } -+ - for_each_set_bit(opt_id, &bitmap, BR_BOOLOPT_MAX) { - bool on = !!(bm->optval & BIT(opt_id)); - -diff --git a/net/can/j1939/bus.c b/net/can/j1939/bus.c -index 48668790160211..e0b966c2517cf1 100644 ---- a/net/can/j1939/bus.c -+++ b/net/can/j1939/bus.c -@@ -290,8 +290,11 @@ int j1939_local_ecu_get(struct j1939_priv *priv, name_t name, u8 sa) - if (!ecu) - ecu = j1939_ecu_create_locked(priv, name); - err = PTR_ERR_OR_ZERO(ecu); -- if (err) -+ if (err) { -+ if (j1939_address_is_unicast(sa)) -+ priv->ents[sa].nusers--; - goto done; -+ } - - ecu->nusers++; - /* TODO: do we care if ecu->addr != sa? */ -diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c -index cf9a12d8da6f90..7bf4d4fb96735a 100644 ---- a/net/can/j1939/socket.c -+++ b/net/can/j1939/socket.c -@@ -520,6 +520,9 @@ static int j1939_sk_bind(struct socket *sock, struct sockaddr *uaddr, int len) - ret = j1939_local_ecu_get(priv, jsk->addr.src_name, jsk->addr.sa); - if (ret) { - j1939_netdev_stop(priv); -+ jsk->priv = NULL; -+ synchronize_rcu(); -+ j1939_priv_put(priv); - goto out_release_sock; - } - -diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c -index 3c8b78d9c4d1ce..8add91385375e1 100644 ---- a/net/ceph/messenger.c -+++ b/net/ceph/messenger.c -@@ -1524,7 +1524,7 @@ static void con_fault_finish(struct ceph_connection *con) - * in case we faulted due to authentication, invalidate our - * current tickets so that we can get new ones. - */ -- if (con->v1.auth_retry) { -+ if (!ceph_msgr2(from_msgr(con->msgr)) && con->v1.auth_retry) { - dout("auth_retry %d, invalidating\n", con->v1.auth_retry); - if (con->ops->invalidate_authorizer) - con->ops->invalidate_authorizer(con); -@@ -1714,9 +1714,10 @@ static void clear_standby(struct ceph_connection *con) - { - /* come back from STANDBY? */ - if (con->state == CEPH_CON_S_STANDBY) { -- dout("clear_standby %p and ++connect_seq\n", con); -+ dout("clear_standby %p\n", con); - con->state = CEPH_CON_S_PREOPEN; -- con->v1.connect_seq++; -+ if (!ceph_msgr2(from_msgr(con->msgr))) -+ con->v1.connect_seq++; - WARN_ON(ceph_con_flag_test(con, CEPH_CON_F_WRITE_PENDING)); - WARN_ON(ceph_con_flag_test(con, CEPH_CON_F_KEEPALIVE_PENDING)); - } -diff --git a/net/core/sock.c b/net/core/sock.c -index b74bc8175937e2..9918a9a337b616 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -2029,6 +2029,8 @@ int sk_getsockopt(struct sock *sk, int level, int optname, - */ - static inline void sock_lock_init(struct sock *sk) - { -+ sk_owner_clear(sk); -+ - if (sk->sk_kern_sock) - sock_lock_init_class_and_name( - sk, -@@ -2124,6 +2126,9 @@ static void sk_prot_free(struct proto *prot, struct sock *sk) - cgroup_sk_free(&sk->sk_cgrp_data); - mem_cgroup_sk_free(sk); - security_sk_free(sk); -+ -+ sk_owner_put(sk); -+ - if (slab != NULL) - kmem_cache_free(slab, sk); - else -diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c -index 906c38b9d66ff3..5514b5bedc9298 100644 ---- a/net/hsr/hsr_device.c -+++ b/net/hsr/hsr_device.c -@@ -59,7 +59,7 @@ static bool hsr_check_carrier(struct hsr_port *master) - - ASSERT_RTNL(); - -- hsr_for_each_port(master->hsr, port) { -+ hsr_for_each_port_rtnl(master->hsr, port) { - if (port->type != HSR_PT_MASTER && is_slave_up(port->dev)) { - netif_carrier_on(master->dev); - return true; -@@ -109,7 +109,7 @@ int hsr_get_max_mtu(struct hsr_priv *hsr) - struct hsr_port *port; - - mtu_max = ETH_DATA_LEN; -- hsr_for_each_port(hsr, port) -+ hsr_for_each_port_rtnl(hsr, port) - if (port->type != HSR_PT_MASTER) - mtu_max = min(port->dev->mtu, mtu_max); - -@@ -144,7 +144,7 @@ static int hsr_dev_open(struct net_device *dev) - hsr = netdev_priv(dev); - designation = '\0'; - -- hsr_for_each_port(hsr, port) { -+ hsr_for_each_port_rtnl(hsr, port) { - if (port->type == HSR_PT_MASTER) - continue; - switch (port->type) { -@@ -170,7 +170,24 @@ static int hsr_dev_open(struct net_device *dev) - - static int hsr_dev_close(struct net_device *dev) - { -- /* Nothing to do here. */ -+ struct hsr_port *port; -+ struct hsr_priv *hsr; -+ -+ hsr = netdev_priv(dev); -+ hsr_for_each_port_rtnl(hsr, port) { -+ if (port->type == HSR_PT_MASTER) -+ continue; -+ switch (port->type) { -+ case HSR_PT_SLAVE_A: -+ case HSR_PT_SLAVE_B: -+ dev_uc_unsync(port->dev, dev); -+ dev_mc_unsync(port->dev, dev); -+ break; -+ default: -+ break; -+ } -+ } -+ - return 0; - } - -@@ -190,7 +207,7 @@ static netdev_features_t hsr_features_recompute(struct hsr_priv *hsr, - * may become enabled. - */ - features &= ~NETIF_F_ONE_FOR_ALL; -- hsr_for_each_port(hsr, port) -+ hsr_for_each_port_rtnl(hsr, port) - features = netdev_increment_features(features, - port->dev->features, - mask); -@@ -211,6 +228,7 @@ static netdev_tx_t hsr_dev_xmit(struct sk_buff *skb, struct net_device *dev) - struct hsr_priv *hsr = netdev_priv(dev); - struct hsr_port *master; - -+ rcu_read_lock(); - master = hsr_port_get_hsr(hsr, HSR_PT_MASTER); - if (master) { - skb->dev = master->dev; -@@ -223,6 +241,8 @@ static netdev_tx_t hsr_dev_xmit(struct sk_buff *skb, struct net_device *dev) - dev_core_stats_tx_dropped_inc(dev); - dev_kfree_skb_any(skb); - } -+ rcu_read_unlock(); -+ - return NETDEV_TX_OK; - } - -@@ -401,12 +421,133 @@ void hsr_del_ports(struct hsr_priv *hsr) - hsr_del_port(port); - } - -+static void hsr_set_rx_mode(struct net_device *dev) -+{ -+ struct hsr_port *port; -+ struct hsr_priv *hsr; -+ -+ hsr = netdev_priv(dev); -+ -+ hsr_for_each_port_rtnl(hsr, port) { -+ if (port->type == HSR_PT_MASTER) -+ continue; -+ switch (port->type) { -+ case HSR_PT_SLAVE_A: -+ case HSR_PT_SLAVE_B: -+ dev_mc_sync_multiple(port->dev, dev); -+ dev_uc_sync_multiple(port->dev, dev); -+ break; -+ default: -+ break; -+ } -+ } -+} -+ -+static void hsr_change_rx_flags(struct net_device *dev, int change) -+{ -+ struct hsr_port *port; -+ struct hsr_priv *hsr; -+ -+ hsr = netdev_priv(dev); -+ -+ hsr_for_each_port_rtnl(hsr, port) { -+ if (port->type == HSR_PT_MASTER) -+ continue; -+ switch (port->type) { -+ case HSR_PT_SLAVE_A: -+ case HSR_PT_SLAVE_B: -+ if (change & IFF_ALLMULTI) -+ dev_set_allmulti(port->dev, -+ dev->flags & -+ IFF_ALLMULTI ? 1 : -1); -+ break; -+ default: -+ break; -+ } -+ } -+} -+ -+static int hsr_ndo_vlan_rx_add_vid(struct net_device *dev, -+ __be16 proto, u16 vid) -+{ -+ bool is_slave_a_added = false; -+ bool is_slave_b_added = false; -+ struct hsr_port *port; -+ struct hsr_priv *hsr; -+ int ret = 0; -+ -+ hsr = netdev_priv(dev); -+ -+ hsr_for_each_port_rtnl(hsr, port) { -+ if (port->type == HSR_PT_MASTER || -+ port->type == HSR_PT_INTERLINK) -+ continue; -+ -+ ret = vlan_vid_add(port->dev, proto, vid); -+ switch (port->type) { -+ case HSR_PT_SLAVE_A: -+ if (ret) { -+ /* clean up Slave-B */ -+ netdev_err(dev, "add vid failed for Slave-A\n"); -+ if (is_slave_b_added) -+ vlan_vid_del(port->dev, proto, vid); -+ return ret; -+ } -+ -+ is_slave_a_added = true; -+ break; -+ -+ case HSR_PT_SLAVE_B: -+ if (ret) { -+ /* clean up Slave-A */ -+ netdev_err(dev, "add vid failed for Slave-B\n"); -+ if (is_slave_a_added) -+ vlan_vid_del(port->dev, proto, vid); -+ return ret; -+ } -+ -+ is_slave_b_added = true; -+ break; -+ default: -+ break; -+ } -+ } -+ -+ return 0; -+} -+ -+static int hsr_ndo_vlan_rx_kill_vid(struct net_device *dev, -+ __be16 proto, u16 vid) -+{ -+ struct hsr_port *port; -+ struct hsr_priv *hsr; -+ -+ hsr = netdev_priv(dev); -+ -+ hsr_for_each_port_rtnl(hsr, port) { -+ switch (port->type) { -+ case HSR_PT_SLAVE_A: -+ case HSR_PT_SLAVE_B: -+ vlan_vid_del(port->dev, proto, vid); -+ break; -+ default: -+ break; -+ } -+ } -+ -+ return 0; -+} -+ - static const struct net_device_ops hsr_device_ops = { - .ndo_change_mtu = hsr_dev_change_mtu, - .ndo_open = hsr_dev_open, - .ndo_stop = hsr_dev_close, - .ndo_start_xmit = hsr_dev_xmit, -+ .ndo_change_rx_flags = hsr_change_rx_flags, - .ndo_fix_features = hsr_fix_features, -+ .ndo_set_rx_mode = hsr_set_rx_mode, -+ .ndo_vlan_rx_add_vid = hsr_ndo_vlan_rx_add_vid, -+ .ndo_vlan_rx_kill_vid = hsr_ndo_vlan_rx_kill_vid, - }; - - static struct device_type hsr_type = { -@@ -447,7 +588,8 @@ void hsr_dev_setup(struct net_device *dev) - - dev->hw_features = NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA | - NETIF_F_GSO_MASK | NETIF_F_HW_CSUM | -- NETIF_F_HW_VLAN_CTAG_TX; -+ NETIF_F_HW_VLAN_CTAG_TX | -+ NETIF_F_HW_VLAN_CTAG_FILTER; - - dev->features = dev->hw_features; - -@@ -533,6 +675,10 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2], - (slave[1]->features & NETIF_F_HW_HSR_FWD)) - hsr->fwd_offloaded = true; - -+ if ((slave[0]->features & NETIF_F_HW_VLAN_CTAG_FILTER) && -+ (slave[1]->features & NETIF_F_HW_VLAN_CTAG_FILTER)) -+ hsr_dev->features |= NETIF_F_HW_VLAN_CTAG_FILTER; -+ - res = register_netdevice(hsr_dev); - if (res) - goto err_unregister; -diff --git a/net/hsr/hsr_main.c b/net/hsr/hsr_main.c -index 257b50124cee5e..76a1958609e291 100644 ---- a/net/hsr/hsr_main.c -+++ b/net/hsr/hsr_main.c -@@ -22,7 +22,7 @@ static bool hsr_slave_empty(struct hsr_priv *hsr) - { - struct hsr_port *port; - -- hsr_for_each_port(hsr, port) -+ hsr_for_each_port_rtnl(hsr, port) - if (port->type != HSR_PT_MASTER) - return false; - return true; -@@ -125,7 +125,7 @@ struct hsr_port *hsr_port_get_hsr(struct hsr_priv *hsr, enum hsr_port_type pt) - { - struct hsr_port *port; - -- hsr_for_each_port(hsr, port) -+ hsr_for_each_port_rtnl(hsr, port) - if (port->type == pt) - return port; - return NULL; -diff --git a/net/hsr/hsr_main.h b/net/hsr/hsr_main.h -index 18e01791ad799d..2fcabe39e61f4f 100644 ---- a/net/hsr/hsr_main.h -+++ b/net/hsr/hsr_main.h -@@ -221,6 +221,9 @@ struct hsr_priv { - #define hsr_for_each_port(hsr, port) \ - list_for_each_entry_rcu((port), &(hsr)->ports, port_list) - -+#define hsr_for_each_port_rtnl(hsr, port) \ -+ list_for_each_entry_rcu((port), &(hsr)->ports, port_list, lockdep_rtnl_is_held()) -+ - struct hsr_port *hsr_port_get_hsr(struct hsr_priv *hsr, enum hsr_port_type pt); - - /* Caller must ensure skb is a valid HSR frame */ -diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c -index deb08cab44640d..75e3d7501752df 100644 ---- a/net/ipv4/ip_tunnel_core.c -+++ b/net/ipv4/ip_tunnel_core.c -@@ -203,6 +203,9 @@ static int iptunnel_pmtud_build_icmp(struct sk_buff *skb, int mtu) - if (!pskb_may_pull(skb, ETH_HLEN + sizeof(struct iphdr))) - return -EINVAL; - -+ if (skb_is_gso(skb)) -+ skb_gso_reset(skb); -+ - skb_copy_bits(skb, skb_mac_offset(skb), &eh, ETH_HLEN); - pskb_pull(skb, ETH_HLEN); - skb_reset_network_header(skb); -@@ -297,6 +300,9 @@ static int iptunnel_pmtud_build_icmpv6(struct sk_buff *skb, int mtu) - if (!pskb_may_pull(skb, ETH_HLEN + sizeof(struct ipv6hdr))) - return -EINVAL; - -+ if (skb_is_gso(skb)) -+ skb_gso_reset(skb); -+ - skb_copy_bits(skb, skb_mac_offset(skb), &eh, ETH_HLEN); - pskb_pull(skb, ETH_HLEN); - skb_reset_network_header(skb); -diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c -index 5312237e804093..7518d2af630880 100644 ---- a/net/ipv4/tcp_bpf.c -+++ b/net/ipv4/tcp_bpf.c -@@ -408,8 +408,11 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock, - if (!psock->cork) { - psock->cork = kzalloc(sizeof(*psock->cork), - GFP_ATOMIC | __GFP_NOWARN); -- if (!psock->cork) -+ if (!psock->cork) { -+ sk_msg_free(sk, msg); -+ *copied = 0; - return -ENOMEM; -+ } - } - memcpy(psock->cork, msg, sizeof(*msg)); - return 0; -diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c -index 31f6899ef71aac..b31ba9f905e30c 100644 ---- a/net/mptcp/sockopt.c -+++ b/net/mptcp/sockopt.c -@@ -1471,13 +1471,12 @@ static void sync_socket_options(struct mptcp_sock *msk, struct sock *ssk) - { - static const unsigned int tx_rx_locks = SOCK_RCVBUF_LOCK | SOCK_SNDBUF_LOCK; - struct sock *sk = (struct sock *)msk; -+ bool keep_open; - -- if (ssk->sk_prot->keepalive) { -- if (sock_flag(sk, SOCK_KEEPOPEN)) -- ssk->sk_prot->keepalive(ssk, 1); -- else -- ssk->sk_prot->keepalive(ssk, 0); -- } -+ keep_open = sock_flag(sk, SOCK_KEEPOPEN); -+ if (ssk->sk_prot->keepalive) -+ ssk->sk_prot->keepalive(ssk, keep_open); -+ sock_valbool_flag(ssk, SOCK_KEEPOPEN, keep_open); - - ssk->sk_priority = sk->sk_priority; - ssk->sk_bound_dev_if = sk->sk_bound_dev_if; -diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c -index 73bc39281ef5f5..9b45fbdc90cabe 100644 ---- a/net/sunrpc/sched.c -+++ b/net/sunrpc/sched.c -@@ -276,8 +276,6 @@ EXPORT_SYMBOL_GPL(rpc_destroy_wait_queue); - - static int rpc_wait_bit_killable(struct wait_bit_key *key, int mode) - { -- if (unlikely(current->flags & PF_EXITING)) -- return -EINTR; - schedule(); - if (signal_pending_state(mode, current)) - return -ERESTARTSYS; -diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c -index 8b27a21f3b42d8..3660ef26471129 100644 ---- a/net/sunrpc/xprtsock.c -+++ b/net/sunrpc/xprtsock.c -@@ -407,9 +407,9 @@ xs_sock_recv_cmsg(struct socket *sock, unsigned int *msg_flags, int flags) - iov_iter_kvec(&msg.msg_iter, ITER_DEST, &alert_kvec, 1, - alert_kvec.iov_len); - ret = sock_recvmsg(sock, &msg, flags); -- if (ret > 0 && -- tls_get_record_type(sock->sk, &u.cmsg) == TLS_RECORD_TYPE_ALERT) { -- iov_iter_revert(&msg.msg_iter, ret); -+ if (ret > 0) { -+ if (tls_get_record_type(sock->sk, &u.cmsg) == TLS_RECORD_TYPE_ALERT) -+ iov_iter_revert(&msg.msg_iter, ret); - ret = xs_sock_process_cmsg(sock, &msg, msg_flags, &u.cmsg, - -EAGAIN); - } -diff --git a/samples/ftrace/ftrace-direct-modify.c b/samples/ftrace/ftrace-direct-modify.c -index e2a6a69352dfb7..b40f85e3806fcb 100644 ---- a/samples/ftrace/ftrace-direct-modify.c -+++ b/samples/ftrace/ftrace-direct-modify.c -@@ -40,8 +40,8 @@ asm ( - CALL_DEPTH_ACCOUNT - " call my_direct_func1\n" - " leave\n" --" .size my_tramp1, .-my_tramp1\n" - ASM_RET -+" .size my_tramp1, .-my_tramp1\n" - - " .type my_tramp2, @function\n" - " .globl my_tramp2\n" -diff --git a/scripts/Makefile.kasan b/scripts/Makefile.kasan -index 390658a2d5b746..a57c24c129720f 100644 ---- a/scripts/Makefile.kasan -+++ b/scripts/Makefile.kasan -@@ -68,10 +68,14 @@ CFLAGS_KASAN := -fsanitize=kernel-hwaddress \ - $(call cc-param,hwasan-inline-all-checks=0) \ - $(instrumentation_flags) - --# Instrument memcpy/memset/memmove calls by using instrumented __hwasan_mem*(). --ifeq ($(call clang-min-version, 150000)$(call gcc-min-version, 130000),y) --CFLAGS_KASAN += $(call cc-param,hwasan-kernel-mem-intrinsic-prefix=1) --endif -+# Instrument memcpy/memset/memmove calls by using instrumented __(hw)asan_mem*(). -+ifdef CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX -+ ifdef CONFIG_CC_IS_GCC -+ CFLAGS_KASAN += $(call cc-param,asan-kernel-mem-intrinsic-prefix=1) -+ else -+ CFLAGS_KASAN += $(call cc-param,hwasan-kernel-mem-intrinsic-prefix=1) -+ endif -+endif # CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX - - endif # CONFIG_KASAN_SW_TAGS - -diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c -index 068edb0d79f736..3b734a4dfcbe4e 100644 ---- a/security/integrity/ima/ima_main.c -+++ b/security/integrity/ima/ima_main.c -@@ -128,16 +128,22 @@ static void ima_rdwr_violation_check(struct file *file, - if (atomic_read(&inode->i_readcount) && IS_IMA(inode)) { - if (!iint) - iint = integrity_iint_find(inode); -+ - /* IMA_MEASURE is set from reader side */ -- if (iint && test_bit(IMA_MUST_MEASURE, -- &iint->atomic_flags)) -+ if (iint && test_and_clear_bit(IMA_MAY_EMIT_TOMTOU, -+ &iint->atomic_flags)) - send_tomtou = true; - } - } else { - if (must_measure) -- set_bit(IMA_MUST_MEASURE, &iint->atomic_flags); -- if (inode_is_open_for_write(inode) && must_measure) -- send_writers = true; -+ set_bit(IMA_MAY_EMIT_TOMTOU, &iint->atomic_flags); -+ -+ /* Limit number of open_writers violations */ -+ if (inode_is_open_for_write(inode) && must_measure) { -+ if (!test_and_set_bit(IMA_EMITTED_OPENWRITERS, -+ &iint->atomic_flags)) -+ send_writers = true; -+ } - } - - if (!send_tomtou && !send_writers) -diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h -index ad20ff7f5dfaa4..a007edae938aeb 100644 ---- a/security/integrity/integrity.h -+++ b/security/integrity/integrity.h -@@ -74,7 +74,8 @@ - #define IMA_UPDATE_XATTR 1 - #define IMA_CHANGE_ATTR 2 - #define IMA_DIGSIG 3 --#define IMA_MUST_MEASURE 4 -+#define IMA_MAY_EMIT_TOMTOU 4 -+#define IMA_EMITTED_OPENWRITERS 5 - - enum evm_ima_xattr_type { - IMA_XATTR_DIGEST = 0x01, diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.107-108.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.107-108.patch deleted file mode 100644 index bd6af10b4a..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.107-108.patch +++ /dev/null @@ -1,2572 +0,0 @@ -diff --git a/Makefile b/Makefile -index 9c9e272f48b879..1e3fb36bb71d78 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 107 -+SUBLEVEL = 108 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig -index 25aa993abebcea..9f56c15ed22d0c 100644 ---- a/arch/loongarch/Kconfig -+++ b/arch/loongarch/Kconfig -@@ -503,10 +503,14 @@ config ARCH_STRICT_ALIGN - -mstrict-align build parameter to prevent unaligned accesses. - - CPUs with h/w unaligned access support: -- Loongson-2K2000/2K3000/3A5000/3C5000/3D5000. -+ Loongson-2K2000/2K3000 and all of Loongson-3 series processors -+ based on LoongArch. - - CPUs without h/w unaligned access support: -- Loongson-2K500/2K1000. -+ Loongson-2K0300/2K0500/2K1000. -+ -+ If you want to make sure whether to support unaligned memory access -+ on your hardware, please read the bit 20 (UAL) of CPUCFG1 register. - - This option is enabled by default to make the kernel be able to run - on all LoongArch systems. But you can disable it manually if you want -diff --git a/arch/loongarch/include/asm/acenv.h b/arch/loongarch/include/asm/acenv.h -index 52f298f7293bab..483c955f2ae50d 100644 ---- a/arch/loongarch/include/asm/acenv.h -+++ b/arch/loongarch/include/asm/acenv.h -@@ -10,9 +10,8 @@ - #ifndef _ASM_LOONGARCH_ACENV_H - #define _ASM_LOONGARCH_ACENV_H - --/* -- * This header is required by ACPI core, but we have nothing to fill in -- * right now. Will be updated later when needed. -- */ -+#ifdef CONFIG_ARCH_STRICT_ALIGN -+#define ACPI_MISALIGNMENT_NOT_SUPPORTED -+#endif /* CONFIG_ARCH_STRICT_ALIGN */ - - #endif /* _ASM_LOONGARCH_ACENV_H */ -diff --git a/arch/loongarch/kernel/env.c b/arch/loongarch/kernel/env.c -index 6b3bfb0092e60b..2178b35896af19 100644 ---- a/arch/loongarch/kernel/env.c -+++ b/arch/loongarch/kernel/env.c -@@ -72,6 +72,8 @@ static int __init boardinfo_init(void) - struct kobject *loongson_kobj; - - loongson_kobj = kobject_create_and_add("loongson", firmware_kobj); -+ if (!loongson_kobj) -+ return -ENOMEM; - - return sysfs_create_file(loongson_kobj, &boardinfo_attr.attr); - } -diff --git a/arch/um/drivers/virtio_uml.c b/arch/um/drivers/virtio_uml.c -index 8adca2000e519f..d790acfc2c674d 100644 ---- a/arch/um/drivers/virtio_uml.c -+++ b/arch/um/drivers/virtio_uml.c -@@ -1229,10 +1229,12 @@ static int virtio_uml_probe(struct platform_device *pdev) - device_set_wakeup_capable(&vu_dev->vdev.dev, true); - - rc = register_virtio_device(&vu_dev->vdev); -- if (rc) -+ if (rc) { - put_device(&vu_dev->vdev.dev); -+ return rc; -+ } - vu_dev->registered = 1; -- return rc; -+ return 0; - - error_init: - os_close_file(vu_dev->sock); -diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c -index abff6d45ae3334..29566e457ec4b5 100644 ---- a/arch/x86/kvm/svm/svm.c -+++ b/arch/x86/kvm/svm/svm.c -@@ -4029,8 +4029,7 @@ static inline void sync_lapic_to_cr8(struct kvm_vcpu *vcpu) - struct vcpu_svm *svm = to_svm(vcpu); - u64 cr8; - -- if (nested_svm_virtualize_tpr(vcpu) || -- kvm_vcpu_apicv_active(vcpu)) -+ if (nested_svm_virtualize_tpr(vcpu)) - return; - - cr8 = kvm_get_cr8(vcpu); -diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c -index b18f5a71e679e2..98aa303ad0546f 100644 ---- a/arch/x86/mm/pgtable.c -+++ b/arch/x86/mm/pgtable.c -@@ -107,7 +107,7 @@ static inline void pgd_list_del(pgd_t *pgd) - #define UNSHARED_PTRS_PER_PGD \ - (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD) - #define MAX_UNSHARED_PTRS_PER_PGD \ -- max_t(size_t, KERNEL_PGD_BOUNDARY, PTRS_PER_PGD) -+ MAX_T(size_t, KERNEL_PGD_BOUNDARY, PTRS_PER_PGD) - - - static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm) -diff --git a/crypto/af_alg.c b/crypto/af_alg.c -index 68cc9290cabe9a..886eccb97b041d 100644 ---- a/crypto/af_alg.c -+++ b/crypto/af_alg.c -@@ -969,6 +969,12 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, - } - - lock_sock(sk); -+ if (ctx->write) { -+ release_sock(sk); -+ return -EBUSY; -+ } -+ ctx->write = true; -+ - if (ctx->init && !ctx->more) { - if (ctx->used) { - err = -EINVAL; -@@ -1018,6 +1024,8 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, - continue; - } - -+ ctx->merge = 0; -+ - if (!af_alg_writable(sk)) { - err = af_alg_wait_for_wmem(sk, msg->msg_flags); - if (err) -@@ -1057,7 +1065,6 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, - ctx->used += plen; - copied += plen; - size -= plen; -- ctx->merge = 0; - } else { - do { - struct page *pg; -@@ -1103,6 +1110,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, - - unlock: - af_alg_data_wakeup(sk); -+ ctx->write = false; - release_sock(sk); - - return copied ?: err; -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index ed004e1610dd1f..455e2a2b149f4b 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -1472,36 +1472,19 @@ static int loop_set_dio(struct loop_device *lo, unsigned long arg) - return error; - } - --static int loop_set_block_size(struct loop_device *lo, blk_mode_t mode, -- struct block_device *bdev, unsigned long arg) -+static int loop_set_block_size(struct loop_device *lo, unsigned long arg) - { - int err = 0; - -- /* -- * If we don't hold exclusive handle for the device, upgrade to it -- * here to avoid changing device under exclusive owner. -- */ -- if (!(mode & BLK_OPEN_EXCL)) { -- err = bd_prepare_to_claim(bdev, loop_set_block_size, NULL); -- if (err) -- return err; -- } -- -- err = mutex_lock_killable(&lo->lo_mutex); -- if (err) -- goto abort_claim; -- -- if (lo->lo_state != Lo_bound) { -- err = -ENXIO; -- goto unlock; -- } -+ if (lo->lo_state != Lo_bound) -+ return -ENXIO; - - err = blk_validate_block_size(arg); - if (err) - return err; - - if (lo->lo_queue->limits.logical_block_size == arg) -- goto unlock; -+ return 0; - - sync_blockdev(lo->lo_device); - invalidate_bdev(lo->lo_device); -@@ -1513,11 +1496,6 @@ static int loop_set_block_size(struct loop_device *lo, blk_mode_t mode, - loop_update_dio(lo); - blk_mq_unfreeze_queue(lo->lo_queue); - --unlock: -- mutex_unlock(&lo->lo_mutex); --abort_claim: -- if (!(mode & BLK_OPEN_EXCL)) -- bd_abort_claiming(bdev, loop_set_block_size); - return err; - } - -@@ -1536,6 +1514,9 @@ static int lo_simple_ioctl(struct loop_device *lo, unsigned int cmd, - case LOOP_SET_DIRECT_IO: - err = loop_set_dio(lo, arg); - break; -+ case LOOP_SET_BLOCK_SIZE: -+ err = loop_set_block_size(lo, arg); -+ break; - default: - err = -EINVAL; - } -@@ -1590,12 +1571,9 @@ static int lo_ioctl(struct block_device *bdev, blk_mode_t mode, - break; - case LOOP_GET_STATUS64: - return loop_get_status64(lo, argp); -- case LOOP_SET_BLOCK_SIZE: -- if (!(mode & BLK_OPEN_WRITE) && !capable(CAP_SYS_ADMIN)) -- return -EPERM; -- return loop_set_block_size(lo, mode, bdev, arg); - case LOOP_SET_CAPACITY: - case LOOP_SET_DIRECT_IO: -+ case LOOP_SET_BLOCK_SIZE: - if (!(mode & BLK_OPEN_WRITE) && !capable(CAP_SYS_ADMIN)) - return -EPERM; - fallthrough; -diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c -index 0c779a0326b628..6c3a40e6f4c63a 100644 ---- a/drivers/edac/sb_edac.c -+++ b/drivers/edac/sb_edac.c -@@ -109,8 +109,8 @@ static const u32 knl_interleave_list[] = { - 0x104, 0x10c, 0x114, 0x11c, /* 20-23 */ - }; - #define MAX_INTERLEAVE \ -- (max_t(unsigned int, ARRAY_SIZE(sbridge_interleave_list), \ -- max_t(unsigned int, ARRAY_SIZE(ibridge_interleave_list), \ -+ (MAX_T(unsigned int, ARRAY_SIZE(sbridge_interleave_list), \ -+ MAX_T(unsigned int, ARRAY_SIZE(ibridge_interleave_list), \ - ARRAY_SIZE(knl_interleave_list)))) - - struct interleave_pkg { -diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c -index ddf944651c55a9..08885a5ba826ef 100644 ---- a/drivers/gpu/drm/bridge/analogix/anx7625.c -+++ b/drivers/gpu/drm/bridge/analogix/anx7625.c -@@ -2705,7 +2705,7 @@ static int anx7625_i2c_probe(struct i2c_client *client) - ret = devm_request_threaded_irq(dev, platform->pdata.intp_irq, - NULL, anx7625_intr_hpd_isr, - IRQF_TRIGGER_FALLING | -- IRQF_ONESHOT, -+ IRQF_ONESHOT | IRQF_NO_AUTOEN, - "anx7625-intp", platform); - if (ret) { - DRM_DEV_ERROR(dev, "fail to request irq\n"); -@@ -2775,8 +2775,10 @@ static int anx7625_i2c_probe(struct i2c_client *client) - } - - /* Add work function */ -- if (platform->pdata.intp_irq) -+ if (platform->pdata.intp_irq) { -+ enable_irq(platform->pdata.intp_irq); - queue_work(platform->workqueue, &platform->work); -+ } - - if (platform->pdata.audio_en) - anx7625_register_audio(dev, platform); -diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c -index 858f5b6508491f..bdb9fc00c776b3 100644 ---- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c -+++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c -@@ -2057,8 +2057,10 @@ static void cdns_mhdp_atomic_enable(struct drm_bridge *bridge, - mhdp_state = to_cdns_mhdp_bridge_state(new_state); - - mhdp_state->current_mode = drm_mode_duplicate(bridge->dev, mode); -- if (!mhdp_state->current_mode) -- return; -+ if (!mhdp_state->current_mode) { -+ ret = -EINVAL; -+ goto out; -+ } - - drm_mode_set_name(mhdp_state->current_mode); - -diff --git a/drivers/gpu/drm/drm_color_mgmt.c b/drivers/gpu/drm/drm_color_mgmt.c -index d021497841b846..3969dc548cff60 100644 ---- a/drivers/gpu/drm/drm_color_mgmt.c -+++ b/drivers/gpu/drm/drm_color_mgmt.c -@@ -532,7 +532,7 @@ int drm_plane_create_color_properties(struct drm_plane *plane, - { - struct drm_device *dev = plane->dev; - struct drm_property *prop; -- struct drm_prop_enum_list enum_list[max_t(int, DRM_COLOR_ENCODING_MAX, -+ struct drm_prop_enum_list enum_list[MAX_T(int, DRM_COLOR_ENCODING_MAX, - DRM_COLOR_RANGE_MAX)]; - int i, len; - -diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h -index 7dc30c2b56b302..d872054b874fa5 100644 ---- a/drivers/iommu/amd/amd_iommu_types.h -+++ b/drivers/iommu/amd/amd_iommu_types.h -@@ -540,6 +540,7 @@ struct amd_irte_ops; - container_of((x), struct amd_io_pgtable, pgtbl_cfg) - - struct amd_io_pgtable { -+ seqcount_t seqcount; /* Protects root/mode update */ - struct io_pgtable_cfg pgtbl_cfg; - struct io_pgtable iop; - int mode; -diff --git a/drivers/iommu/amd/io_pgtable.c b/drivers/iommu/amd/io_pgtable.c -index 2892aa1b4dc1db..b785d823999835 100644 ---- a/drivers/iommu/amd/io_pgtable.c -+++ b/drivers/iommu/amd/io_pgtable.c -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - - #include - -@@ -171,8 +172,11 @@ static bool increase_address_space(struct protection_domain *domain, - - *pte = PM_LEVEL_PDE(domain->iop.mode, iommu_virt_to_phys(domain->iop.root)); - -+ write_seqcount_begin(&domain->iop.seqcount); - domain->iop.root = pte; - domain->iop.mode += 1; -+ write_seqcount_end(&domain->iop.seqcount); -+ - amd_iommu_update_and_flush_device_table(domain); - amd_iommu_domain_flush_complete(domain); - -@@ -199,6 +203,7 @@ static u64 *alloc_pte(struct protection_domain *domain, - gfp_t gfp, - bool *updated) - { -+ unsigned int seqcount; - int level, end_lvl; - u64 *pte, *page; - -@@ -214,8 +219,14 @@ static u64 *alloc_pte(struct protection_domain *domain, - } - - -- level = domain->iop.mode - 1; -- pte = &domain->iop.root[PM_LEVEL_INDEX(level, address)]; -+ do { -+ seqcount = read_seqcount_begin(&domain->iop.seqcount); -+ -+ level = domain->iop.mode - 1; -+ pte = &domain->iop.root[PM_LEVEL_INDEX(level, address)]; -+ } while (read_seqcount_retry(&domain->iop.seqcount, seqcount)); -+ -+ - address = PAGE_SIZE_ALIGN(address, page_size); - end_lvl = PAGE_SIZE_LEVEL(page_size); - -@@ -292,6 +303,7 @@ static u64 *fetch_pte(struct amd_io_pgtable *pgtable, - unsigned long *page_size) - { - int level; -+ unsigned int seqcount; - u64 *pte; - - *page_size = 0; -@@ -299,8 +311,12 @@ static u64 *fetch_pte(struct amd_io_pgtable *pgtable, - if (address > PM_LEVEL_SIZE(pgtable->mode)) - return NULL; - -- level = pgtable->mode - 1; -- pte = &pgtable->root[PM_LEVEL_INDEX(level, address)]; -+ do { -+ seqcount = read_seqcount_begin(&pgtable->seqcount); -+ level = pgtable->mode - 1; -+ pte = &pgtable->root[PM_LEVEL_INDEX(level, address)]; -+ } while (read_seqcount_retry(&pgtable->seqcount, seqcount)); -+ - *page_size = PTE_LEVEL_PAGE_SIZE(level); - - while (level > 0) { -@@ -524,6 +540,8 @@ static struct io_pgtable *v1_alloc_pgtable(struct io_pgtable_cfg *cfg, void *coo - cfg->oas = IOMMU_OUT_ADDR_BIT_SIZE, - cfg->tlb = &v1_flush_ops; - -+ seqcount_init(&pgtable->seqcount); -+ - pgtable->iop.ops.map_pages = iommu_v1_map_pages; - pgtable->iop.ops.unmap_pages = iommu_v1_unmap_pages; - pgtable->iop.ops.iova_to_phys = iommu_v1_iova_to_phys; -diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c -index 6a745616d85a4b..88bccdbb0bed08 100644 ---- a/drivers/iommu/intel/iommu.c -+++ b/drivers/iommu/intel/iommu.c -@@ -2168,6 +2168,10 @@ static void switch_to_super_page(struct dmar_domain *domain, - struct dma_pte *pte = NULL; - unsigned long i; - -+ if (WARN_ON(!IS_ALIGNED(start_pfn, lvl_pages) || -+ !IS_ALIGNED(end_pfn + 1, lvl_pages))) -+ return; -+ - while (start_pfn <= end_pfn) { - if (!pte) - pte = pfn_to_dma_pte(domain, start_pfn, &level, -@@ -2241,7 +2245,8 @@ __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn, - unsigned long pages_to_remove; - - pteval |= DMA_PTE_LARGE_PAGE; -- pages_to_remove = min_t(unsigned long, nr_pages, -+ pages_to_remove = min_t(unsigned long, -+ round_down(nr_pages, lvl_pages), - nr_pte_to_next_page(pte) * lvl_pages); - end_pfn = iov_pfn + pages_to_remove - 1; - switch_to_super_page(domain, iov_pfn, end_pfn, largepage_lvl); -diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c -index 1e27a5bce2d942..0bd76f8d4dc6b8 100644 ---- a/drivers/md/dm-integrity.c -+++ b/drivers/md/dm-integrity.c -@@ -1794,7 +1794,7 @@ static void integrity_metadata(struct work_struct *w) - struct bio *bio = dm_bio_from_per_bio_data(dio, sizeof(struct dm_integrity_io)); - char *checksums; - unsigned int extra_space = unlikely(digest_size > ic->tag_size) ? digest_size - ic->tag_size : 0; -- char checksums_onstack[max_t(size_t, HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)]; -+ char checksums_onstack[MAX_T(size_t, HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)]; - sector_t sector; - unsigned int sectors_to_process; - -@@ -2073,7 +2073,7 @@ static bool __journal_read_write(struct dm_integrity_io *dio, struct bio *bio, - } while (++s < ic->sectors_per_block); - #ifdef INTERNAL_VERIFY - if (ic->internal_hash) { -- char checksums_onstack[max_t(size_t, HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)]; -+ char checksums_onstack[MAX_T(size_t, HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)]; - - integrity_sector_checksum(ic, logical_sector, mem + bv.bv_offset, checksums_onstack); - if (unlikely(memcmp(checksums_onstack, journal_entry_tag(ic, je), ic->tag_size))) { -@@ -2638,7 +2638,7 @@ static void do_journal_write(struct dm_integrity_c *ic, unsigned int write_start - unlikely(from_replay) && - #endif - ic->internal_hash) { -- char test_tag[max_t(size_t, HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)]; -+ char test_tag[MAX_T(size_t, HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)]; - - integrity_sector_checksum(ic, sec + ((l - j) << ic->sb->log2_sectors_per_block), - (char *)access_journal_data(ic, i, l), test_tag); -diff --git a/drivers/mmc/host/mvsdio.c b/drivers/mmc/host/mvsdio.c -index ca01b7d204ba66..955df7f370a789 100644 ---- a/drivers/mmc/host/mvsdio.c -+++ b/drivers/mmc/host/mvsdio.c -@@ -292,7 +292,7 @@ static u32 mvsd_finish_data(struct mvsd_host *host, struct mmc_data *data, - host->pio_ptr = NULL; - host->pio_size = 0; - } else { -- dma_unmap_sg(mmc_dev(host->mmc), data->sg, host->sg_frags, -+ dma_unmap_sg(mmc_dev(host->mmc), data->sg, data->sg_len, - mmc_get_dma_dir(data)); - } - -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index cd5691ed9f171e..f7ed129fc8110a 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -2042,6 +2042,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev, - memcpy(ss.__data, bond_dev->dev_addr, bond_dev->addr_len); - } else if (bond->params.fail_over_mac == BOND_FOM_FOLLOW && - BOND_MODE(bond) == BOND_MODE_ACTIVEBACKUP && -+ bond_has_slaves(bond) && - memcmp(slave_dev->dev_addr, bond_dev->dev_addr, bond_dev->addr_len) == 0) { - /* Set slave to random address to avoid duplicate mac - * address in later fail over. -@@ -3260,7 +3261,6 @@ static void bond_ns_send_all(struct bonding *bond, struct slave *slave) - /* Find out through which dev should the packet go */ - memset(&fl6, 0, sizeof(struct flowi6)); - fl6.daddr = targets[i]; -- fl6.flowi6_oif = bond->dev->ifindex; - - dst = ip6_route_output(dev_net(bond->dev), NULL, &fl6); - if (dst->error) { -diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c -index 7926aaef8f0c52..ad2745c07c1ae7 100644 ---- a/drivers/net/ethernet/broadcom/cnic.c -+++ b/drivers/net/ethernet/broadcom/cnic.c -@@ -4220,8 +4220,7 @@ static void cnic_cm_stop_bnx2x_hw(struct cnic_dev *dev) - - cnic_bnx2x_delete_wait(dev, 0); - -- cancel_delayed_work(&cp->delete_task); -- flush_workqueue(cnic_wq); -+ cancel_delayed_work_sync(&cp->delete_task); - - if (atomic_read(&cp->iscsi_conn) != 0) - netdev_warn(dev->netdev, "%d iSCSI connections not destroyed\n", -diff --git a/drivers/net/ethernet/cavium/liquidio/request_manager.c b/drivers/net/ethernet/cavium/liquidio/request_manager.c -index de8a6ce86ad7e2..12105ffb5dac6d 100644 ---- a/drivers/net/ethernet/cavium/liquidio/request_manager.c -+++ b/drivers/net/ethernet/cavium/liquidio/request_manager.c -@@ -126,7 +126,7 @@ int octeon_init_instr_queue(struct octeon_device *oct, - oct->io_qmask.iq |= BIT_ULL(iq_no); - - /* Set the 32B/64B mode for each input queue */ -- oct->io_qmask.iq64B |= ((conf->instr_type == 64) << iq_no); -+ oct->io_qmask.iq64B |= ((u64)(conf->instr_type == 64) << iq_no); - iq->iqcmd_64B = (conf->instr_type == 64); - - oct->fn_list.setup_iq_regs(oct, iq_no); -diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c -index 76795bb0b564b7..cdab37e9634d4f 100644 ---- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c -+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c -@@ -2700,7 +2700,7 @@ static int dpaa2_switch_setup_dpbp(struct ethsw_core *ethsw) - dev_err(dev, "dpsw_ctrl_if_set_pools() failed\n"); - goto err_get_attr; - } -- ethsw->bpid = dpbp_attrs.id; -+ ethsw->bpid = dpbp_attrs.bpid; - - return 0; - -diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c -index c962987d8b51bb..6a9b47b005d29b 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c -@@ -950,9 +950,6 @@ static bool i40e_clean_tx_irq(struct i40e_vsi *vsi, - if (!eop_desc) - break; - -- /* prevent any other reads prior to eop_desc */ -- smp_rmb(); -- - i40e_trace(clean_tx_irq, tx_ring, tx_desc, tx_buf); - /* we have caught up to head, no work left to do */ - if (tx_head == tx_desc) -diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ptp.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ptp.c -index 3a72b0793d4a73..82725923555c51 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ptp.c -+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ptp.c -@@ -476,7 +476,7 @@ void otx2_ptp_destroy(struct otx2_nic *pfvf) - if (!ptp) - return; - -- cancel_delayed_work(&pfvf->ptp->synctstamp_work); -+ cancel_delayed_work_sync(&pfvf->ptp->synctstamp_work); - - ptp_clock_unregister(ptp->ptp_clock); - kfree(ptp); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index d378aa55f22f90..09ba60b2e744b1 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -109,8 +109,6 @@ void mlx5e_update_carrier(struct mlx5e_priv *priv) - if (up) { - netdev_info(priv->netdev, "Link up\n"); - netif_carrier_on(priv->netdev); -- mlx5e_port_manual_buffer_config(priv, 0, priv->netdev->mtu, -- NULL, NULL, NULL); - } else { - netdev_info(priv->netdev, "Link down\n"); - netif_carrier_off(priv->netdev); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -index 851c499faa7954..656a7b65f4c7bb 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -@@ -1448,12 +1448,21 @@ static const struct mlx5e_profile mlx5e_uplink_rep_profile = { - static int - mlx5e_vport_uplink_rep_load(struct mlx5_core_dev *dev, struct mlx5_eswitch_rep *rep) - { -- struct mlx5e_priv *priv = netdev_priv(mlx5_uplink_netdev_get(dev)); - struct mlx5e_rep_priv *rpriv = mlx5e_rep_to_rep_priv(rep); -+ struct net_device *netdev; -+ struct mlx5e_priv *priv; -+ int err; -+ -+ netdev = mlx5_uplink_netdev_get(dev); -+ if (!netdev) -+ return 0; - -+ priv = netdev_priv(netdev); - rpriv->netdev = priv->netdev; -- return mlx5e_netdev_change_profile(priv, &mlx5e_uplink_rep_profile, -- rpriv); -+ err = mlx5e_netdev_change_profile(priv, &mlx5e_uplink_rep_profile, -+ rpriv); -+ mlx5_uplink_netdev_put(dev, netdev); -+ return err; - } - - static void -@@ -1565,8 +1574,16 @@ mlx5e_vport_rep_unload(struct mlx5_eswitch_rep *rep) - { - struct mlx5e_rep_priv *rpriv = mlx5e_rep_to_rep_priv(rep); - struct net_device *netdev = rpriv->netdev; -- struct mlx5e_priv *priv = netdev_priv(netdev); -- void *ppriv = priv->ppriv; -+ struct mlx5e_priv *priv; -+ void *ppriv; -+ -+ if (!netdev) { -+ ppriv = rpriv; -+ goto free_ppriv; -+ } -+ -+ priv = netdev_priv(netdev); -+ ppriv = priv->ppriv; - - if (rep->vport == MLX5_VPORT_UPLINK) { - mlx5e_vport_uplink_rep_unload(rpriv); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -index cc0f2be21a265a..05fbd2098b268a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -@@ -2,6 +2,7 @@ - /* Copyright (c) 2021, NVIDIA CORPORATION & AFFILIATES. All rights reserved. */ - - #include "eswitch.h" -+#include "lib/mlx5.h" - #include "esw/qos.h" - #include "en/port.h" - #define CREATE_TRACE_POINTS -@@ -712,6 +713,71 @@ int mlx5_esw_qos_set_vport_rate(struct mlx5_eswitch *esw, struct mlx5_vport *vpo - return err; - } - -+static u32 mlx5_esw_qos_lag_link_speed_get_locked(struct mlx5_core_dev *mdev) -+{ -+ struct ethtool_link_ksettings lksettings; -+ struct net_device *slave, *master; -+ u32 speed = SPEED_UNKNOWN; -+ -+ /* Lock ensures a stable reference to master and slave netdevice -+ * while port speed of master is queried. -+ */ -+ ASSERT_RTNL(); -+ -+ slave = mlx5_uplink_netdev_get(mdev); -+ if (!slave) -+ goto out; -+ -+ master = netdev_master_upper_dev_get(slave); -+ if (master && !__ethtool_get_link_ksettings(master, &lksettings)) -+ speed = lksettings.base.speed; -+ -+out: -+ mlx5_uplink_netdev_put(mdev, slave); -+ return speed; -+} -+ -+static int mlx5_esw_qos_max_link_speed_get(struct mlx5_core_dev *mdev, u32 *link_speed_max, -+ bool hold_rtnl_lock, struct netlink_ext_ack *extack) -+{ -+ int err; -+ -+ if (!mlx5_lag_is_active(mdev)) -+ goto skip_lag; -+ -+ if (hold_rtnl_lock) -+ rtnl_lock(); -+ -+ *link_speed_max = mlx5_esw_qos_lag_link_speed_get_locked(mdev); -+ -+ if (hold_rtnl_lock) -+ rtnl_unlock(); -+ -+ if (*link_speed_max != (u32)SPEED_UNKNOWN) -+ return 0; -+ -+skip_lag: -+ err = mlx5_port_max_linkspeed(mdev, link_speed_max); -+ if (err) -+ NL_SET_ERR_MSG_MOD(extack, "Failed to get link maximum speed"); -+ -+ return err; -+} -+ -+static int mlx5_esw_qos_link_speed_verify(struct mlx5_core_dev *mdev, -+ const char *name, u32 link_speed_max, -+ u64 value, struct netlink_ext_ack *extack) -+{ -+ if (value > link_speed_max) { -+ pr_err("%s rate value %lluMbps exceed link maximum speed %u.\n", -+ name, value, link_speed_max); -+ NL_SET_ERR_MSG_MOD(extack, "TX rate value exceed link maximum speed"); -+ return -EINVAL; -+ } -+ -+ return 0; -+} -+ - int mlx5_esw_qos_modify_vport_rate(struct mlx5_eswitch *esw, u16 vport_num, u32 rate_mbps) - { - u32 ctx[MLX5_ST_SZ_DW(scheduling_context)] = {}; -@@ -755,12 +821,6 @@ static int esw_qos_devlink_rate_to_mbps(struct mlx5_core_dev *mdev, const char * - u64 value; - int err; - -- err = mlx5_port_max_linkspeed(mdev, &link_speed_max); -- if (err) { -- NL_SET_ERR_MSG_MOD(extack, "Failed to get link maximum speed"); -- return err; -- } -- - value = div_u64_rem(*rate, MLX5_LINKSPEED_UNIT, &remainder); - if (remainder) { - pr_err("%s rate value %lluBps not in link speed units of 1Mbps.\n", -@@ -769,12 +829,13 @@ static int esw_qos_devlink_rate_to_mbps(struct mlx5_core_dev *mdev, const char * - return -EINVAL; - } - -- if (value > link_speed_max) { -- pr_err("%s rate value %lluMbps exceed link maximum speed %u.\n", -- name, value, link_speed_max); -- NL_SET_ERR_MSG_MOD(extack, "TX rate value exceed link maximum speed"); -- return -EINVAL; -- } -+ err = mlx5_esw_qos_max_link_speed_get(mdev, &link_speed_max, true, extack); -+ if (err) -+ return err; -+ -+ err = mlx5_esw_qos_link_speed_verify(mdev, name, link_speed_max, value, extack); -+ if (err) -+ return err; - - *rate = value; - return 0; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h b/drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h -index 2b5826a785c4f7..adcc2bc9c8c870 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h -@@ -52,6 +52,19 @@ static inline struct net *mlx5_core_net(struct mlx5_core_dev *dev) - - static inline struct net_device *mlx5_uplink_netdev_get(struct mlx5_core_dev *mdev) - { -- return mdev->mlx5e_res.uplink_netdev; -+ struct mlx5e_resources *mlx5e_res = &mdev->mlx5e_res; -+ struct net_device *netdev; -+ -+ mutex_lock(&mlx5e_res->uplink_netdev_lock); -+ netdev = mlx5e_res->uplink_netdev; -+ netdev_hold(netdev, &mlx5e_res->tracker, GFP_KERNEL); -+ mutex_unlock(&mlx5e_res->uplink_netdev_lock); -+ return netdev; -+} -+ -+static inline void mlx5_uplink_netdev_put(struct mlx5_core_dev *mdev, -+ struct net_device *netdev) -+{ -+ netdev_put(netdev, &mdev->mlx5e_res.tracker); - } - #endif -diff --git a/drivers/net/ethernet/natsemi/ns83820.c b/drivers/net/ethernet/natsemi/ns83820.c -index 998586872599b3..c692d2e878b2e3 100644 ---- a/drivers/net/ethernet/natsemi/ns83820.c -+++ b/drivers/net/ethernet/natsemi/ns83820.c -@@ -820,7 +820,7 @@ static void rx_irq(struct net_device *ndev) - struct ns83820 *dev = PRIV(ndev); - struct rx_info *info = &dev->rx_info; - unsigned next_rx; -- int rx_rc, len; -+ int len; - u32 cmdsts; - __le32 *desc; - unsigned long flags; -@@ -881,8 +881,10 @@ static void rx_irq(struct net_device *ndev) - if (likely(CMDSTS_OK & cmdsts)) { - #endif - skb_put(skb, len); -- if (unlikely(!skb)) -+ if (unlikely(!skb)) { -+ ndev->stats.rx_dropped++; - goto netdev_mangle_me_harder_failed; -+ } - if (cmdsts & CMDSTS_DEST_MULTI) - ndev->stats.multicast++; - ndev->stats.rx_packets++; -@@ -901,15 +903,12 @@ static void rx_irq(struct net_device *ndev) - __vlan_hwaccel_put_tag(skb, htons(ETH_P_IPV6), tag); - } - #endif -- rx_rc = netif_rx(skb); -- if (NET_RX_DROP == rx_rc) { --netdev_mangle_me_harder_failed: -- ndev->stats.rx_dropped++; -- } -+ netif_rx(skb); - } else { - dev_kfree_skb_irq(skb); - } - -+netdev_mangle_me_harder_failed: - nr++; - next_rx = info->next_rx; - desc = info->descs + (DESC_SIZE * next_rx); -diff --git a/drivers/net/ethernet/qlogic/qed/qed_debug.c b/drivers/net/ethernet/qlogic/qed/qed_debug.c -index cdcead614e9fa8..ae421c2707785f 100644 ---- a/drivers/net/ethernet/qlogic/qed/qed_debug.c -+++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c -@@ -4461,10 +4461,11 @@ static enum dbg_status qed_protection_override_dump(struct qed_hwfn *p_hwfn, - goto out; - } - -- /* Add override window info to buffer */ -+ /* Add override window info to buffer, preventing buffer overflow */ - override_window_dwords = -- qed_rd(p_hwfn, p_ptt, GRC_REG_NUMBER_VALID_OVERRIDE_WINDOW) * -- PROTECTION_OVERRIDE_ELEMENT_DWORDS; -+ min(qed_rd(p_hwfn, p_ptt, GRC_REG_NUMBER_VALID_OVERRIDE_WINDOW) * -+ PROTECTION_OVERRIDE_ELEMENT_DWORDS, -+ PROTECTION_OVERRIDE_DEPTH_DWORDS); - if (override_window_dwords) { - addr = BYTES_TO_DWORDS(GRC_REG_PROTECTION_OVERRIDE_WINDOW); - offset += qed_grc_dump_addr_range(p_hwfn, -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index ff5389a8efc33a..f3155d69a013c6 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -2841,7 +2841,7 @@ static void stmmac_dma_interrupt(struct stmmac_priv *priv) - u32 channels_to_check = tx_channel_count > rx_channel_count ? - tx_channel_count : rx_channel_count; - u32 chan; -- int status[max_t(u32, MTL_MAX_TX_QUEUES, MTL_MAX_RX_QUEUES)]; -+ int status[MAX_T(u32, MTL_MAX_TX_QUEUES, MTL_MAX_RX_QUEUES)]; - - /* Make sure we never check beyond our status buffer. */ - if (WARN_ON_ONCE(channels_to_check > ARRAY_SIZE(status))) -diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c -index 6e4023791b4761..68b8e458a88f6a 100644 ---- a/drivers/net/vmxnet3/vmxnet3_drv.c -+++ b/drivers/net/vmxnet3/vmxnet3_drv.c -@@ -1981,6 +1981,11 @@ vmxnet3_rq_cleanup(struct vmxnet3_rx_queue *rq, - - rq->comp_ring.gen = VMXNET3_INIT_GEN; - rq->comp_ring.next2proc = 0; -+ -+ if (xdp_rxq_info_is_reg(&rq->xdp_rxq)) -+ xdp_rxq_info_unreg(&rq->xdp_rxq); -+ page_pool_destroy(rq->page_pool); -+ rq->page_pool = NULL; - } - - -@@ -2021,11 +2026,6 @@ static void vmxnet3_rq_destroy(struct vmxnet3_rx_queue *rq, - } - } - -- if (xdp_rxq_info_is_reg(&rq->xdp_rxq)) -- xdp_rxq_info_unreg(&rq->xdp_rxq); -- page_pool_destroy(rq->page_pool); -- rq->page_pool = NULL; -- - if (rq->data_ring.base) { - dma_free_coherent(&adapter->pdev->dev, - rq->rx_ring[0].size * rq->data_ring.desc_size, -diff --git a/drivers/net/wireless/microchip/wilc1000/wlan_cfg.c b/drivers/net/wireless/microchip/wilc1000/wlan_cfg.c -index 131388886acbfa..cfabd5aebb5400 100644 ---- a/drivers/net/wireless/microchip/wilc1000/wlan_cfg.c -+++ b/drivers/net/wireless/microchip/wilc1000/wlan_cfg.c -@@ -41,10 +41,10 @@ static const struct wilc_cfg_word g_cfg_word[] = { - }; - - static const struct wilc_cfg_str g_cfg_str[] = { -- {WID_FIRMWARE_VERSION, NULL}, -- {WID_MAC_ADDR, NULL}, -- {WID_ASSOC_RES_INFO, NULL}, -- {WID_NIL, NULL} -+ {WID_FIRMWARE_VERSION, 0, NULL}, -+ {WID_MAC_ADDR, 0, NULL}, -+ {WID_ASSOC_RES_INFO, 0, NULL}, -+ {WID_NIL, 0, NULL} - }; - - #define WILC_RESP_MSG_TYPE_CONFIG_REPLY 'R' -@@ -147,44 +147,58 @@ static void wilc_wlan_parse_response_frame(struct wilc *wl, u8 *info, int size) - - switch (FIELD_GET(WILC_WID_TYPE, wid)) { - case WID_CHAR: -+ len = 3; -+ if (len + 2 > size) -+ return; -+ - while (cfg->b[i].id != WID_NIL && cfg->b[i].id != wid) - i++; - - if (cfg->b[i].id == wid) - cfg->b[i].val = info[4]; - -- len = 3; - break; - - case WID_SHORT: -+ len = 4; -+ if (len + 2 > size) -+ return; -+ - while (cfg->hw[i].id != WID_NIL && cfg->hw[i].id != wid) - i++; - - if (cfg->hw[i].id == wid) - cfg->hw[i].val = get_unaligned_le16(&info[4]); - -- len = 4; - break; - - case WID_INT: -+ len = 6; -+ if (len + 2 > size) -+ return; -+ - while (cfg->w[i].id != WID_NIL && cfg->w[i].id != wid) - i++; - - if (cfg->w[i].id == wid) - cfg->w[i].val = get_unaligned_le32(&info[4]); - -- len = 6; - break; - - case WID_STR: -+ len = 2 + get_unaligned_le16(&info[2]); -+ - while (cfg->s[i].id != WID_NIL && cfg->s[i].id != wid) - i++; - -- if (cfg->s[i].id == wid) -+ if (cfg->s[i].id == wid) { -+ if (len > cfg->s[i].len || (len + 2 > size)) -+ return; -+ - memcpy(cfg->s[i].str, &info[2], -- get_unaligned_le16(&info[2]) + 2); -+ len); -+ } - -- len = 2 + get_unaligned_le16(&info[2]); - break; - - default: -@@ -384,12 +398,15 @@ int wilc_wlan_cfg_init(struct wilc *wl) - /* store the string cfg parameters */ - wl->cfg.s[i].id = WID_FIRMWARE_VERSION; - wl->cfg.s[i].str = str_vals->firmware_version; -+ wl->cfg.s[i].len = sizeof(str_vals->firmware_version); - i++; - wl->cfg.s[i].id = WID_MAC_ADDR; - wl->cfg.s[i].str = str_vals->mac_address; -+ wl->cfg.s[i].len = sizeof(str_vals->mac_address); - i++; - wl->cfg.s[i].id = WID_ASSOC_RES_INFO; - wl->cfg.s[i].str = str_vals->assoc_rsp; -+ wl->cfg.s[i].len = sizeof(str_vals->assoc_rsp); - i++; - wl->cfg.s[i].id = WID_NIL; - wl->cfg.s[i].str = NULL; -diff --git a/drivers/net/wireless/microchip/wilc1000/wlan_cfg.h b/drivers/net/wireless/microchip/wilc1000/wlan_cfg.h -index 7038b74f8e8ff6..5ae74bced7d748 100644 ---- a/drivers/net/wireless/microchip/wilc1000/wlan_cfg.h -+++ b/drivers/net/wireless/microchip/wilc1000/wlan_cfg.h -@@ -24,12 +24,13 @@ struct wilc_cfg_word { - - struct wilc_cfg_str { - u16 id; -+ u16 len; - u8 *str; - }; - - struct wilc_cfg_str_vals { -- u8 mac_address[7]; -- u8 firmware_version[129]; -+ u8 mac_address[8]; -+ u8 firmware_version[130]; - u8 assoc_rsp[WILC_MAX_ASSOC_RESP_FRAME_SIZE]; - }; - -diff --git a/drivers/pcmcia/omap_cf.c b/drivers/pcmcia/omap_cf.c -index 25382612e48acb..a8e0dd5d30c436 100644 ---- a/drivers/pcmcia/omap_cf.c -+++ b/drivers/pcmcia/omap_cf.c -@@ -305,7 +305,13 @@ static int __exit omap_cf_remove(struct platform_device *pdev) - return 0; - } - --static struct platform_driver omap_cf_driver = { -+/* -+ * omap_cf_remove() lives in .exit.text. For drivers registered via -+ * platform_driver_probe() this is ok because they cannot get unbound at -+ * runtime. So mark the driver struct with __refdata to prevent modpost -+ * triggering a section mismatch warning. -+ */ -+static struct platform_driver omap_cf_driver __refdata = { - .driver = { - .name = driver_name, - }, -diff --git a/drivers/phy/broadcom/phy-bcm-ns-usb3.c b/drivers/phy/broadcom/phy-bcm-ns-usb3.c -index 69584b685edbb7..2c8b1b7dda5bdc 100644 ---- a/drivers/phy/broadcom/phy-bcm-ns-usb3.c -+++ b/drivers/phy/broadcom/phy-bcm-ns-usb3.c -@@ -16,10 +16,11 @@ - #include - #include - #include -+#include - #include --#include - #include - #include -+#include - #include - - #define BCM_NS_USB3_PHY_BASE_ADDR_REG 0x1f -@@ -189,7 +190,6 @@ static int bcm_ns_usb3_mdio_phy_write(struct bcm_ns_usb3 *usb3, u16 reg, - static int bcm_ns_usb3_mdio_probe(struct mdio_device *mdiodev) - { - struct device *dev = &mdiodev->dev; -- const struct of_device_id *of_id; - struct phy_provider *phy_provider; - struct device_node *syscon_np; - struct bcm_ns_usb3 *usb3; -@@ -203,10 +203,7 @@ static int bcm_ns_usb3_mdio_probe(struct mdio_device *mdiodev) - usb3->dev = dev; - usb3->mdiodev = mdiodev; - -- of_id = of_match_device(bcm_ns_usb3_id_table, dev); -- if (!of_id) -- return -EINVAL; -- usb3->family = (uintptr_t)of_id->data; -+ usb3->family = (enum bcm_ns_family)device_get_match_data(dev); - - syscon_np = of_parse_phandle(dev->of_node, "usb3-dmp-syscon", 0); - err = of_address_to_resource(syscon_np, 0, &res); -diff --git a/drivers/phy/marvell/phy-berlin-usb.c b/drivers/phy/marvell/phy-berlin-usb.c -index 78ef6ae72a9a74..f26bf630da2c9f 100644 ---- a/drivers/phy/marvell/phy-berlin-usb.c -+++ b/drivers/phy/marvell/phy-berlin-usb.c -@@ -8,9 +8,10 @@ - - #include - #include --#include -+#include - #include - #include -+#include - #include - - #define USB_PHY_PLL 0x04 -@@ -162,8 +163,6 @@ MODULE_DEVICE_TABLE(of, phy_berlin_usb_of_match); - - static int phy_berlin_usb_probe(struct platform_device *pdev) - { -- const struct of_device_id *match = -- of_match_device(phy_berlin_usb_of_match, &pdev->dev); - struct phy_berlin_usb_priv *priv; - struct phy *phy; - struct phy_provider *phy_provider; -@@ -180,7 +179,7 @@ static int phy_berlin_usb_probe(struct platform_device *pdev) - if (IS_ERR(priv->rst_ctrl)) - return PTR_ERR(priv->rst_ctrl); - -- priv->pll_divider = *((u32 *)match->data); -+ priv->pll_divider = *((u32 *)device_get_match_data(&pdev->dev)); - - phy = devm_phy_create(&pdev->dev, NULL, &phy_berlin_usb_ops); - if (IS_ERR(phy)) { -diff --git a/drivers/phy/ralink/phy-ralink-usb.c b/drivers/phy/ralink/phy-ralink-usb.c -index 2bd8ad2e76eda0..41bce5290e9220 100644 ---- a/drivers/phy/ralink/phy-ralink-usb.c -+++ b/drivers/phy/ralink/phy-ralink-usb.c -@@ -13,9 +13,10 @@ - #include - #include - #include --#include -+#include - #include - #include -+#include - #include - #include - -@@ -171,18 +172,13 @@ static int ralink_usb_phy_probe(struct platform_device *pdev) - { - struct device *dev = &pdev->dev; - struct phy_provider *phy_provider; -- const struct of_device_id *match; - struct ralink_usb_phy *phy; - -- match = of_match_device(ralink_usb_phy_of_match, &pdev->dev); -- if (!match) -- return -ENODEV; -- - phy = devm_kzalloc(dev, sizeof(*phy), GFP_KERNEL); - if (!phy) - return -ENOMEM; - -- phy->clk = (uintptr_t)match->data; -+ phy->clk = (uintptr_t)device_get_match_data(&pdev->dev); - phy->base = NULL; - - phy->sysctl = syscon_regmap_lookup_by_phandle(dev->of_node, "ralink,sysctl"); -diff --git a/drivers/phy/rockchip/phy-rockchip-pcie.c b/drivers/phy/rockchip/phy-rockchip-pcie.c -index cbf3c140a138ee..4669e87b32435a 100644 ---- a/drivers/phy/rockchip/phy-rockchip-pcie.c -+++ b/drivers/phy/rockchip/phy-rockchip-pcie.c -@@ -12,10 +12,9 @@ - #include - #include - #include --#include --#include - #include - #include -+#include - #include - #include - -@@ -62,7 +61,7 @@ struct rockchip_pcie_data { - }; - - struct rockchip_pcie_phy { -- struct rockchip_pcie_data *phy_data; -+ const struct rockchip_pcie_data *phy_data; - struct regmap *reg_base; - struct phy_pcie_instance { - struct phy *phy; -@@ -349,7 +348,6 @@ static int rockchip_pcie_phy_probe(struct platform_device *pdev) - struct rockchip_pcie_phy *rk_phy; - struct phy_provider *phy_provider; - struct regmap *grf; -- const struct of_device_id *of_id; - int i; - u32 phy_num; - -@@ -363,11 +361,10 @@ static int rockchip_pcie_phy_probe(struct platform_device *pdev) - if (!rk_phy) - return -ENOMEM; - -- of_id = of_match_device(rockchip_pcie_phy_dt_ids, &pdev->dev); -- if (!of_id) -+ rk_phy->phy_data = device_get_match_data(&pdev->dev); -+ if (!rk_phy->phy_data) - return -EINVAL; - -- rk_phy->phy_data = (struct rockchip_pcie_data *)of_id->data; - rk_phy->reg_base = grf; - - mutex_init(&rk_phy->pcie_mutex); -diff --git a/drivers/phy/rockchip/phy-rockchip-usb.c b/drivers/phy/rockchip/phy-rockchip-usb.c -index 8454285977ebc1..666a896c8f0a08 100644 ---- a/drivers/phy/rockchip/phy-rockchip-usb.c -+++ b/drivers/phy/rockchip/phy-rockchip-usb.c -@@ -13,10 +13,9 @@ - #include - #include - #include --#include --#include - #include - #include -+#include - #include - #include - #include -@@ -458,7 +457,6 @@ static int rockchip_usb_phy_probe(struct platform_device *pdev) - struct device *dev = &pdev->dev; - struct rockchip_usb_phy_base *phy_base; - struct phy_provider *phy_provider; -- const struct of_device_id *match; - struct device_node *child; - int err; - -@@ -466,14 +464,12 @@ static int rockchip_usb_phy_probe(struct platform_device *pdev) - if (!phy_base) - return -ENOMEM; - -- match = of_match_device(dev->driver->of_match_table, dev); -- if (!match || !match->data) { -+ phy_base->pdata = device_get_match_data(dev); -+ if (!phy_base->pdata) { - dev_err(dev, "missing phy data\n"); - return -EINVAL; - } - -- phy_base->pdata = match->data; -- - phy_base->dev = dev; - phy_base->reg_base = ERR_PTR(-ENODEV); - if (dev->parent && dev->parent->of_node) -diff --git a/drivers/phy/ti/phy-omap-control.c b/drivers/phy/ti/phy-omap-control.c -index 76c5595f0859cb..2fdb8f4241c742 100644 ---- a/drivers/phy/ti/phy-omap-control.c -+++ b/drivers/phy/ti/phy-omap-control.c -@@ -8,9 +8,9 @@ - - #include - #include -+#include - #include - #include --#include - #include - #include - #include -@@ -268,20 +268,15 @@ MODULE_DEVICE_TABLE(of, omap_control_phy_id_table); - - static int omap_control_phy_probe(struct platform_device *pdev) - { -- const struct of_device_id *of_id; - struct omap_control_phy *control_phy; - -- of_id = of_match_device(omap_control_phy_id_table, &pdev->dev); -- if (!of_id) -- return -EINVAL; -- - control_phy = devm_kzalloc(&pdev->dev, sizeof(*control_phy), - GFP_KERNEL); - if (!control_phy) - return -ENOMEM; - - control_phy->dev = &pdev->dev; -- control_phy->type = *(enum omap_control_phy_type *)of_id->data; -+ control_phy->type = *(enum omap_control_phy_type *)device_get_match_data(&pdev->dev); - - if (control_phy->type == OMAP_CTRL_TYPE_OTGHS) { - control_phy->otghs_control = -diff --git a/drivers/phy/ti/phy-omap-usb2.c b/drivers/phy/ti/phy-omap-usb2.c -index 6bd3c749233068..0fea766a98d756 100644 ---- a/drivers/phy/ti/phy-omap-usb2.c -+++ b/drivers/phy/ti/phy-omap-usb2.c -@@ -19,6 +19,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -362,6 +363,13 @@ static void omap_usb2_init_errata(struct omap_usb *phy) - phy->flags |= OMAP_USB2_DISABLE_CHRG_DET; - } - -+static void omap_usb2_put_device(void *_dev) -+{ -+ struct device *dev = _dev; -+ -+ put_device(dev); -+} -+ - static int omap_usb2_probe(struct platform_device *pdev) - { - struct omap_usb *phy; -@@ -371,16 +379,13 @@ static int omap_usb2_probe(struct platform_device *pdev) - struct device_node *node = pdev->dev.of_node; - struct device_node *control_node; - struct platform_device *control_pdev; -- const struct of_device_id *of_id; -- struct usb_phy_data *phy_data; -- -- of_id = of_match_device(omap_usb2_id_table, &pdev->dev); -+ const struct usb_phy_data *phy_data; -+ int ret; - -- if (!of_id) -+ phy_data = device_get_match_data(&pdev->dev); -+ if (!phy_data) - return -EINVAL; - -- phy_data = (struct usb_phy_data *)of_id->data; -- - phy = devm_kzalloc(&pdev->dev, sizeof(*phy), GFP_KERNEL); - if (!phy) - return -ENOMEM; -@@ -426,6 +431,11 @@ static int omap_usb2_probe(struct platform_device *pdev) - return -EINVAL; - } - phy->control_dev = &control_pdev->dev; -+ -+ ret = devm_add_action_or_reset(&pdev->dev, omap_usb2_put_device, -+ phy->control_dev); -+ if (ret) -+ return ret; - } else { - if (of_property_read_u32_index(node, - "syscon-phy-power", 1, -diff --git a/drivers/phy/ti/phy-ti-pipe3.c b/drivers/phy/ti/phy-ti-pipe3.c -index 3127f3702c3ae3..8e94d2c6e266a0 100644 ---- a/drivers/phy/ti/phy-ti-pipe3.c -+++ b/drivers/phy/ti/phy-ti-pipe3.c -@@ -8,6 +8,7 @@ - - #include - #include -+#include - #include - #include - #include -@@ -791,23 +792,16 @@ static int ti_pipe3_probe(struct platform_device *pdev) - struct phy_provider *phy_provider; - struct device *dev = &pdev->dev; - int ret; -- const struct of_device_id *match; -- struct pipe3_data *data; -+ const struct pipe3_data *data; - - phy = devm_kzalloc(dev, sizeof(*phy), GFP_KERNEL); - if (!phy) - return -ENOMEM; - -- match = of_match_device(ti_pipe3_id_table, dev); -- if (!match) -+ data = device_get_match_data(dev); -+ if (!data) - return -EINVAL; - -- data = (struct pipe3_data *)match->data; -- if (!data) { -- dev_err(dev, "no driver data\n"); -- return -EINVAL; -- } -- - phy->dev = dev; - phy->mode = data->mode; - phy->dpll_map = data->dpll_map; -diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c -index e51fa2c694bc6d..1f06dee4b8b4e3 100644 ---- a/drivers/power/supply/bq27xxx_battery.c -+++ b/drivers/power/supply/bq27xxx_battery.c -@@ -1872,8 +1872,8 @@ static void bq27xxx_battery_update_unlocked(struct bq27xxx_device_info *di) - bool has_singe_flag = di->opts & BQ27XXX_O_ZERO; - - cache.flags = bq27xxx_read(di, BQ27XXX_REG_FLAGS, has_singe_flag); -- if ((cache.flags & 0xff) == 0xff) -- cache.flags = -1; /* read error */ -+ if (di->chip == BQ27000 && (cache.flags & 0xff) == 0xff) -+ cache.flags = -ENODEV; /* bq27000 hdq read error */ - if (cache.flags >= 0) { - cache.temperature = bq27xxx_battery_read_temperature(di); - if (di->regs[BQ27XXX_REG_TTE] != INVALID_REG_ADDR) -diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c -index fc079b9dcf7192..502571f0c203fa 100644 ---- a/drivers/rtc/rtc-pcf2127.c -+++ b/drivers/rtc/rtc-pcf2127.c -@@ -1383,11 +1383,6 @@ static int pcf2127_i2c_probe(struct i2c_client *client) - variant = &pcf21xx_cfg[type]; - } - -- if (variant->type == PCF2131) { -- config.read_flag_mask = 0x0; -- config.write_flag_mask = 0x0; -- } -- - config.max_register = variant->max_register, - - regmap = devm_regmap_init(&client->dev, &pcf2127_i2c_regmap, -@@ -1461,6 +1456,11 @@ static int pcf2127_spi_probe(struct spi_device *spi) - variant = &pcf21xx_cfg[type]; - } - -+ if (variant->type == PCF2131) { -+ config.read_flag_mask = 0x0; -+ config.write_flag_mask = 0x0; -+ } -+ - config.max_register = variant->max_register; - - regmap = devm_regmap_init_spi(spi, &config); -diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c -index 2cd8c757c65342..764657070883c1 100644 ---- a/drivers/usb/host/xhci-dbgcap.c -+++ b/drivers/usb/host/xhci-dbgcap.c -@@ -86,13 +86,34 @@ static u32 xhci_dbc_populate_strings(struct dbc_str_descs *strings) - return string_length; - } - -+static void xhci_dbc_init_ep_contexts(struct xhci_dbc *dbc) -+{ -+ struct xhci_ep_ctx *ep_ctx; -+ unsigned int max_burst; -+ dma_addr_t deq; -+ -+ max_burst = DBC_CTRL_MAXBURST(readl(&dbc->regs->control)); -+ -+ /* Populate bulk out endpoint context: */ -+ ep_ctx = dbc_bulkout_ctx(dbc); -+ deq = dbc_bulkout_enq(dbc); -+ ep_ctx->ep_info = 0; -+ ep_ctx->ep_info2 = dbc_epctx_info2(BULK_OUT_EP, 1024, max_burst); -+ ep_ctx->deq = cpu_to_le64(deq | dbc->ring_out->cycle_state); -+ -+ /* Populate bulk in endpoint context: */ -+ ep_ctx = dbc_bulkin_ctx(dbc); -+ deq = dbc_bulkin_enq(dbc); -+ ep_ctx->ep_info = 0; -+ ep_ctx->ep_info2 = dbc_epctx_info2(BULK_IN_EP, 1024, max_burst); -+ ep_ctx->deq = cpu_to_le64(deq | dbc->ring_in->cycle_state); -+} -+ - static void xhci_dbc_init_contexts(struct xhci_dbc *dbc, u32 string_length) - { - struct dbc_info_context *info; -- struct xhci_ep_ctx *ep_ctx; - u32 dev_info; -- dma_addr_t deq, dma; -- unsigned int max_burst; -+ dma_addr_t dma; - - if (!dbc) - return; -@@ -106,20 +127,8 @@ static void xhci_dbc_init_contexts(struct xhci_dbc *dbc, u32 string_length) - info->serial = cpu_to_le64(dma + DBC_MAX_STRING_LENGTH * 3); - info->length = cpu_to_le32(string_length); - -- /* Populate bulk out endpoint context: */ -- ep_ctx = dbc_bulkout_ctx(dbc); -- max_burst = DBC_CTRL_MAXBURST(readl(&dbc->regs->control)); -- deq = dbc_bulkout_enq(dbc); -- ep_ctx->ep_info = 0; -- ep_ctx->ep_info2 = dbc_epctx_info2(BULK_OUT_EP, 1024, max_burst); -- ep_ctx->deq = cpu_to_le64(deq | dbc->ring_out->cycle_state); -- -- /* Populate bulk in endpoint context: */ -- ep_ctx = dbc_bulkin_ctx(dbc); -- deq = dbc_bulkin_enq(dbc); -- ep_ctx->ep_info = 0; -- ep_ctx->ep_info2 = dbc_epctx_info2(BULK_IN_EP, 1024, max_burst); -- ep_ctx->deq = cpu_to_le64(deq | dbc->ring_in->cycle_state); -+ /* Populate bulk in and out endpoint contexts: */ -+ xhci_dbc_init_ep_contexts(dbc); - - /* Set DbC context and info registers: */ - lo_hi_writeq(dbc->ctx->dma, &dbc->regs->dccp); -@@ -421,6 +430,42 @@ dbc_alloc_ctx(struct device *dev, gfp_t flags) - return ctx; - } - -+static void xhci_dbc_ring_init(struct xhci_ring *ring) -+{ -+ struct xhci_segment *seg = ring->first_seg; -+ -+ /* clear all trbs on ring in case of old ring */ -+ memset(seg->trbs, 0, TRB_SEGMENT_SIZE); -+ -+ /* Only event ring does not use link TRB */ -+ if (ring->type != TYPE_EVENT) { -+ union xhci_trb *trb = &seg->trbs[TRBS_PER_SEGMENT - 1]; -+ -+ trb->link.segment_ptr = cpu_to_le64(ring->first_seg->dma); -+ trb->link.control = cpu_to_le32(LINK_TOGGLE | TRB_TYPE(TRB_LINK)); -+ } -+ xhci_initialize_ring_info(ring, 1); -+} -+ -+static int xhci_dbc_reinit_ep_rings(struct xhci_dbc *dbc) -+{ -+ struct xhci_ring *in_ring = dbc->eps[BULK_IN].ring; -+ struct xhci_ring *out_ring = dbc->eps[BULK_OUT].ring; -+ -+ if (!in_ring || !out_ring || !dbc->ctx) { -+ dev_warn(dbc->dev, "Can't re-init unallocated endpoints\n"); -+ return -ENODEV; -+ } -+ -+ xhci_dbc_ring_init(in_ring); -+ xhci_dbc_ring_init(out_ring); -+ -+ /* set ep context enqueue, dequeue, and cycle to initial values */ -+ xhci_dbc_init_ep_contexts(dbc); -+ -+ return 0; -+} -+ - static struct xhci_ring * - xhci_dbc_ring_alloc(struct device *dev, enum xhci_ring_type type, gfp_t flags) - { -@@ -449,15 +494,10 @@ xhci_dbc_ring_alloc(struct device *dev, enum xhci_ring_type type, gfp_t flags) - - seg->dma = dma; - -- /* Only event ring does not use link TRB */ -- if (type != TYPE_EVENT) { -- union xhci_trb *trb = &seg->trbs[TRBS_PER_SEGMENT - 1]; -- -- trb->link.segment_ptr = cpu_to_le64(dma); -- trb->link.control = cpu_to_le32(LINK_TOGGLE | TRB_TYPE(TRB_LINK)); -- } - INIT_LIST_HEAD(&ring->td_list); -- xhci_initialize_ring_info(ring, 1); -+ -+ xhci_dbc_ring_init(ring); -+ - return ring; - dma_fail: - kfree(seg); -@@ -850,7 +890,7 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc) - dev_info(dbc->dev, "DbC cable unplugged\n"); - dbc->state = DS_ENABLED; - xhci_dbc_flush_requests(dbc); -- -+ xhci_dbc_reinit_ep_rings(dbc); - return EVT_DISC; - } - -@@ -860,7 +900,7 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc) - writel(portsc, &dbc->regs->portsc); - dbc->state = DS_ENABLED; - xhci_dbc_flush_requests(dbc); -- -+ xhci_dbc_reinit_ep_rings(dbc); - return EVT_DISC; - } - -diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c -index 6d16506bbdc0d9..d49ce7768f7f5b 100644 ---- a/fs/btrfs/tree-checker.c -+++ b/fs/btrfs/tree-checker.c -@@ -1717,10 +1717,10 @@ static int check_inode_ref(struct extent_buffer *leaf, - while (ptr < end) { - u16 namelen; - -- if (unlikely(ptr + sizeof(iref) > end)) { -+ if (unlikely(ptr + sizeof(*iref) > end)) { - inode_ref_err(leaf, slot, - "inode ref overflow, ptr %lu end %lu inode_ref_size %zu", -- ptr, end, sizeof(iref)); -+ ptr, end, sizeof(*iref)); - return -EUCLEAN; - } - -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index e5d6bc1bb5e5da..4b53e19f7520fe 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -1998,7 +1998,7 @@ static noinline int replay_one_name(struct btrfs_trans_handle *trans, - - search_key.objectid = log_key.objectid; - search_key.type = BTRFS_INODE_EXTREF_KEY; -- search_key.offset = key->objectid; -+ search_key.offset = btrfs_extref_hash(key->objectid, name.name, name.len); - ret = backref_in_log(root->log_root, &search_key, key->objectid, &name); - if (ret < 0) { - goto out; -diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c -index 905c7eadf9676d..59fda8ce0790bc 100644 ---- a/fs/nilfs2/sysfs.c -+++ b/fs/nilfs2/sysfs.c -@@ -1075,7 +1075,7 @@ void nilfs_sysfs_delete_device_group(struct the_nilfs *nilfs) - ************************************************************************/ - - static ssize_t nilfs_feature_revision_show(struct kobject *kobj, -- struct attribute *attr, char *buf) -+ struct kobj_attribute *attr, char *buf) - { - return sysfs_emit(buf, "%d.%d\n", - NILFS_CURRENT_REV, NILFS_MINOR_REV); -@@ -1087,7 +1087,7 @@ static const char features_readme_str[] = - "(1) revision\n\tshow current revision of NILFS file system driver.\n"; - - static ssize_t nilfs_feature_README_show(struct kobject *kobj, -- struct attribute *attr, -+ struct kobj_attribute *attr, - char *buf) - { - return sysfs_emit(buf, features_readme_str); -diff --git a/fs/nilfs2/sysfs.h b/fs/nilfs2/sysfs.h -index 78a87a016928b7..d370cd5cce3f5d 100644 ---- a/fs/nilfs2/sysfs.h -+++ b/fs/nilfs2/sysfs.h -@@ -50,16 +50,16 @@ struct nilfs_sysfs_dev_subgroups { - struct completion sg_segments_kobj_unregister; - }; - --#define NILFS_COMMON_ATTR_STRUCT(name) \ -+#define NILFS_KOBJ_ATTR_STRUCT(name) \ - struct nilfs_##name##_attr { \ - struct attribute attr; \ -- ssize_t (*show)(struct kobject *, struct attribute *, \ -+ ssize_t (*show)(struct kobject *, struct kobj_attribute *, \ - char *); \ -- ssize_t (*store)(struct kobject *, struct attribute *, \ -+ ssize_t (*store)(struct kobject *, struct kobj_attribute *, \ - const char *, size_t); \ - } - --NILFS_COMMON_ATTR_STRUCT(feature); -+NILFS_KOBJ_ATTR_STRUCT(feature); - - #define NILFS_DEV_ATTR_STRUCT(name) \ - struct nilfs_##name##_attr { \ -diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c -index 713bd1dcd39cce..be9be8f3633196 100644 ---- a/fs/smb/client/smbdirect.c -+++ b/fs/smb/client/smbdirect.c -@@ -1064,8 +1064,10 @@ static int smbd_negotiate(struct smbd_connection *info) - log_rdma_event(INFO, "smbd_post_recv rc=%d iov.addr=0x%llx iov.length=%u iov.lkey=0x%x\n", - rc, response->sge.addr, - response->sge.length, response->sge.lkey); -- if (rc) -+ if (rc) { -+ put_receive_buffer(info, response); - return rc; -+ } - - init_completion(&info->negotiate_completion); - info->negotiate_done = false; -diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c -index a4ff1167c9a123..3720304d679293 100644 ---- a/fs/smb/server/transport_rdma.c -+++ b/fs/smb/server/transport_rdma.c -@@ -553,7 +553,7 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) - case SMB_DIRECT_MSG_DATA_TRANSFER: { - struct smb_direct_data_transfer *data_transfer = - (struct smb_direct_data_transfer *)recvmsg->packet; -- unsigned int data_length; -+ u32 remaining_data_length, data_offset, data_length; - int avail_recvmsg_count, receive_credits; - - if (wc->byte_len < -@@ -563,15 +563,25 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) - return; - } - -+ remaining_data_length = le32_to_cpu(data_transfer->remaining_data_length); - data_length = le32_to_cpu(data_transfer->data_length); -- if (data_length) { -- if (wc->byte_len < sizeof(struct smb_direct_data_transfer) + -- (u64)data_length) { -- put_recvmsg(t, recvmsg); -- smb_direct_disconnect_rdma_connection(t); -- return; -- } -+ data_offset = le32_to_cpu(data_transfer->data_offset); -+ if (wc->byte_len < data_offset || -+ wc->byte_len < (u64)data_offset + data_length) { -+ put_recvmsg(t, recvmsg); -+ smb_direct_disconnect_rdma_connection(t); -+ return; -+ } -+ if (remaining_data_length > t->max_fragmented_recv_size || -+ data_length > t->max_fragmented_recv_size || -+ (u64)remaining_data_length + (u64)data_length > -+ (u64)t->max_fragmented_recv_size) { -+ put_recvmsg(t, recvmsg); -+ smb_direct_disconnect_rdma_connection(t); -+ return; -+ } - -+ if (data_length) { - if (t->full_packet_received) - recvmsg->first_segment = true; - -diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h -index 08b803a4fcde4c..7402bf3e037ee7 100644 ---- a/include/crypto/if_alg.h -+++ b/include/crypto/if_alg.h -@@ -134,6 +134,7 @@ struct af_alg_async_req { - * SG? - * @enc: Cryptographic operation to be performed when - * recvmsg is invoked. -+ * @write: True if we are in the middle of a write. - * @init: True if metadata has been sent. - * @len: Length of memory allocated for this data structure. - * @inflight: Non-zero when AIO requests are in flight. -@@ -149,10 +150,11 @@ struct af_alg_ctx { - size_t used; - atomic_t rcvused; - -- bool more; -- bool merge; -- bool enc; -- bool init; -+ u32 more:1, -+ merge:1, -+ enc:1, -+ write:1, -+ init:1; - - unsigned int len; - -diff --git a/include/linux/minmax.h b/include/linux/minmax.h -index 2ec559284a9f6c..9c2848abc80496 100644 ---- a/include/linux/minmax.h -+++ b/include/linux/minmax.h -@@ -45,17 +45,20 @@ - - #define __cmp(op, x, y) ((x) __cmp_op_##op (y) ? (x) : (y)) - --#define __cmp_once(op, x, y, unique_x, unique_y) ({ \ -- typeof(x) unique_x = (x); \ -- typeof(y) unique_y = (y); \ -+#define __cmp_once_unique(op, type, x, y, ux, uy) \ -+ ({ type ux = (x); type uy = (y); __cmp(op, ux, uy); }) -+ -+#define __cmp_once(op, type, x, y) \ -+ __cmp_once_unique(op, type, x, y, __UNIQUE_ID(x_), __UNIQUE_ID(y_)) -+ -+#define __careful_cmp_once(op, x, y) ({ \ - static_assert(__types_ok(x, y), \ - #op "(" #x ", " #y ") signedness error, fix types or consider u" #op "() before " #op "_t()"); \ -- __cmp(op, unique_x, unique_y); }) -+ __cmp_once(op, __auto_type, x, y); }) - - #define __careful_cmp(op, x, y) \ - __builtin_choose_expr(__is_constexpr((x) - (y)), \ -- __cmp(op, x, y), \ -- __cmp_once(op, x, y, __UNIQUE_ID(__x), __UNIQUE_ID(__y))) -+ __cmp(op, x, y), __careful_cmp_once(op, x, y)) - - #define __clamp(val, lo, hi) \ - ((val) >= (hi) ? (hi) : ((val) <= (lo) ? (lo) : (val))) -@@ -158,7 +161,7 @@ - * @x: first value - * @y: second value - */ --#define min_t(type, x, y) __careful_cmp(min, (type)(x), (type)(y)) -+#define min_t(type, x, y) __cmp_once(min, type, x, y) - - /** - * max_t - return maximum of two values, using the specified type -@@ -166,7 +169,7 @@ - * @x: first value - * @y: second value - */ --#define max_t(type, x, y) __careful_cmp(max, (type)(x), (type)(y)) -+#define max_t(type, x, y) __cmp_once(max, type, x, y) - - /* - * Do not check the array parameter using __must_be_array(). -@@ -270,4 +273,11 @@ static inline bool in_range32(u32 val, u32 start, u32 len) - #define swap(a, b) \ - do { typeof(a) __tmp = (a); (a) = (b); (b) = __tmp; } while (0) - -+/* -+ * Use these carefully: no type checking, and uses the arguments -+ * multiple times. Use for obvious constants only. -+ */ -+#define MIN_T(type,a,b) __cmp(min,(type)(a),(type)(b)) -+#define MAX_T(type,a,b) __cmp(max,(type)(a),(type)(b)) -+ - #endif /* _LINUX_MINMAX_H */ -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index 696a2227869fb3..c0e0468b25a180 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -677,6 +677,7 @@ struct mlx5e_resources { - struct mlx5_sq_bfreg bfreg; - } hw_objs; - struct net_device *uplink_netdev; -+ netdevice_tracker tracker; - struct mutex uplink_netdev_lock; - struct mlx5_crypto_dek_priv *dek_priv; - }; -diff --git a/include/linux/pageblock-flags.h b/include/linux/pageblock-flags.h -index e83c4c09504173..a4bf7f0989b211 100644 ---- a/include/linux/pageblock-flags.h -+++ b/include/linux/pageblock-flags.h -@@ -41,7 +41,7 @@ extern unsigned int pageblock_order; - * Huge pages are a constant size, but don't exceed the maximum allocation - * granularity. - */ --#define pageblock_order min_t(unsigned int, HUGETLB_PAGE_ORDER, MAX_ORDER) -+#define pageblock_order MIN_T(unsigned int, HUGETLB_PAGE_ORDER, MAX_ORDER) - - #endif /* CONFIG_HUGETLB_PAGE_SIZE_VARIABLE */ - -diff --git a/include/uapi/linux/mptcp.h b/include/uapi/linux/mptcp.h -index ee9c49f949a2c5..00d62212167330 100644 ---- a/include/uapi/linux/mptcp.h -+++ b/include/uapi/linux/mptcp.h -@@ -81,6 +81,8 @@ enum { - - #define MPTCP_PM_ADDR_ATTR_MAX (__MPTCP_PM_ADDR_ATTR_MAX - 1) - -+#define MPTCP_PM_EV_FLAG_DENY_JOIN_ID0 _BITUL(0) -+ - #define MPTCP_PM_ADDR_FLAG_SIGNAL (1 << 0) - #define MPTCP_PM_ADDR_FLAG_SUBFLOW (1 << 1) - #define MPTCP_PM_ADDR_FLAG_BACKUP (1 << 2) -@@ -132,13 +134,13 @@ struct mptcp_info { - - /* - * MPTCP_EVENT_CREATED: token, family, saddr4 | saddr6, daddr4 | daddr6, -- * sport, dport -+ * sport, dport, server-side, [flags] - * A new MPTCP connection has been created. It is the good time to allocate - * memory and send ADD_ADDR if needed. Depending on the traffic-patterns - * it can take a long time until the MPTCP_EVENT_ESTABLISHED is sent. - * - * MPTCP_EVENT_ESTABLISHED: token, family, saddr4 | saddr6, daddr4 | daddr6, -- * sport, dport -+ * sport, dport, server-side, [flags] - * A MPTCP connection is established (can start new subflows). - * - * MPTCP_EVENT_CLOSED: token -diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c -index 897f07014c0193..07a5824ad98d48 100644 ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -1459,9 +1459,10 @@ static void io_req_task_cancel(struct io_kiocb *req, struct io_tw_state *ts) - - void io_req_task_submit(struct io_kiocb *req, struct io_tw_state *ts) - { -- io_tw_lock(req->ctx, ts); -- /* req->task == current here, checking PF_EXITING is safe */ -- if (unlikely(req->task->flags & PF_EXITING)) -+ struct io_ring_ctx *ctx = req->ctx; -+ -+ io_tw_lock(ctx, ts); -+ if (unlikely(io_should_terminate_tw(ctx))) - io_req_defer_failed(req, -EFAULT); - else if (req->flags & REQ_F_FORCE_ASYNC) - io_queue_iowq(req); -diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h -index 59f5f71037ffe1..0f6b47f55c249c 100644 ---- a/io_uring/io_uring.h -+++ b/io_uring/io_uring.h -@@ -394,6 +394,19 @@ static inline bool io_allowed_run_tw(struct io_ring_ctx *ctx) - ctx->submitter_task == current); - } - -+/* -+ * Terminate the request if either of these conditions are true: -+ * -+ * 1) It's being executed by the original task, but that task is marked -+ * with PF_EXITING as it's exiting. -+ * 2) PF_KTHREAD is set, in which case the invoker of the task_work is -+ * our fallback task_work. -+ */ -+static inline bool io_should_terminate_tw(struct io_ring_ctx *ctx) -+{ -+ return (current->flags & (PF_KTHREAD | PF_EXITING)) || percpu_ref_is_dying(&ctx->refs); -+} -+ - static inline void io_req_queue_tw_complete(struct io_kiocb *req, s32 res) - { - io_req_set_res(req, res, 0); -diff --git a/io_uring/poll.c b/io_uring/poll.c -index 65935ec8de89c4..b6c8acd8625e3f 100644 ---- a/io_uring/poll.c -+++ b/io_uring/poll.c -@@ -258,8 +258,7 @@ static int io_poll_check_events(struct io_kiocb *req, struct io_tw_state *ts) - { - int v; - -- /* req->task == current here, checking PF_EXITING is safe */ -- if (unlikely(req->task->flags & PF_EXITING)) -+ if (unlikely(io_should_terminate_tw(req->ctx))) - return -ECANCELED; - - do { -diff --git a/io_uring/timeout.c b/io_uring/timeout.c -index 277e22d55c6171..be2a0f6c209b2a 100644 ---- a/io_uring/timeout.c -+++ b/io_uring/timeout.c -@@ -307,7 +307,7 @@ static void io_req_task_link_timeout(struct io_kiocb *req, struct io_tw_state *t - int ret = -ENOENT; - - if (prev) { -- if (!(req->task->flags & PF_EXITING)) { -+ if (!io_should_terminate_tw(req->ctx)) { - struct io_cancel_data cd = { - .ctx = req->ctx, - .data = prev->cqe.user_data, -diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c -index e8ef062f6ca058..5135838b5899f8 100644 ---- a/kernel/cgroup/cgroup.c -+++ b/kernel/cgroup/cgroup.c -@@ -123,8 +123,31 @@ DEFINE_PERCPU_RWSEM(cgroup_threadgroup_rwsem); - * of concurrent destructions. Use a separate workqueue so that cgroup - * destruction work items don't end up filling up max_active of system_wq - * which may lead to deadlock. -+ * -+ * A cgroup destruction should enqueue work sequentially to: -+ * cgroup_offline_wq: use for css offline work -+ * cgroup_release_wq: use for css release work -+ * cgroup_free_wq: use for free work -+ * -+ * Rationale for using separate workqueues: -+ * The cgroup root free work may depend on completion of other css offline -+ * operations. If all tasks were enqueued to a single workqueue, this could -+ * create a deadlock scenario where: -+ * - Free work waits for other css offline work to complete. -+ * - But other css offline work is queued after free work in the same queue. -+ * -+ * Example deadlock scenario with single workqueue (cgroup_destroy_wq): -+ * 1. umount net_prio -+ * 2. net_prio root destruction enqueues work to cgroup_destroy_wq (CPUx) -+ * 3. perf_event CSS A offline enqueues work to same cgroup_destroy_wq (CPUx) -+ * 4. net_prio cgroup_destroy_root->cgroup_lock_and_drain_offline. -+ * 5. net_prio root destruction blocks waiting for perf_event CSS A offline, -+ * which can never complete as it's behind in the same queue and -+ * workqueue's max_active is 1. - */ --static struct workqueue_struct *cgroup_destroy_wq; -+static struct workqueue_struct *cgroup_offline_wq; -+static struct workqueue_struct *cgroup_release_wq; -+static struct workqueue_struct *cgroup_free_wq; - - /* generate an array of cgroup subsystem pointers */ - #define SUBSYS(_x) [_x ## _cgrp_id] = &_x ## _cgrp_subsys, -@@ -5435,7 +5458,7 @@ static void css_release_work_fn(struct work_struct *work) - cgroup_unlock(); - - INIT_RCU_WORK(&css->destroy_rwork, css_free_rwork_fn); -- queue_rcu_work(cgroup_destroy_wq, &css->destroy_rwork); -+ queue_rcu_work(cgroup_free_wq, &css->destroy_rwork); - } - - static void css_release(struct percpu_ref *ref) -@@ -5444,7 +5467,7 @@ static void css_release(struct percpu_ref *ref) - container_of(ref, struct cgroup_subsys_state, refcnt); - - INIT_WORK(&css->destroy_work, css_release_work_fn); -- queue_work(cgroup_destroy_wq, &css->destroy_work); -+ queue_work(cgroup_release_wq, &css->destroy_work); - } - - static void init_and_link_css(struct cgroup_subsys_state *css, -@@ -5566,7 +5589,7 @@ static struct cgroup_subsys_state *css_create(struct cgroup *cgrp, - err_free_css: - list_del_rcu(&css->rstat_css_node); - INIT_RCU_WORK(&css->destroy_rwork, css_free_rwork_fn); -- queue_rcu_work(cgroup_destroy_wq, &css->destroy_rwork); -+ queue_rcu_work(cgroup_free_wq, &css->destroy_rwork); - return ERR_PTR(err); - } - -@@ -5801,7 +5824,7 @@ static void css_killed_ref_fn(struct percpu_ref *ref) - - if (atomic_dec_and_test(&css->online_cnt)) { - INIT_WORK(&css->destroy_work, css_killed_work_fn); -- queue_work(cgroup_destroy_wq, &css->destroy_work); -+ queue_work(cgroup_offline_wq, &css->destroy_work); - } - } - -@@ -6173,8 +6196,14 @@ static int __init cgroup_wq_init(void) - * We would prefer to do this in cgroup_init() above, but that - * is called before init_workqueues(): so leave this until after. - */ -- cgroup_destroy_wq = alloc_workqueue("cgroup_destroy", 0, 1); -- BUG_ON(!cgroup_destroy_wq); -+ cgroup_offline_wq = alloc_workqueue("cgroup_offline", 0, 1); -+ BUG_ON(!cgroup_offline_wq); -+ -+ cgroup_release_wq = alloc_workqueue("cgroup_release", 0, 1); -+ BUG_ON(!cgroup_release_wq); -+ -+ cgroup_free_wq = alloc_workqueue("cgroup_free", 0, 1); -+ BUG_ON(!cgroup_free_wq); - return 0; - } - core_initcall(cgroup_wq_init); -diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c -index a85b0aba36462d..b444767b15a5d2 100644 ---- a/net/ipv4/proc.c -+++ b/net/ipv4/proc.c -@@ -43,7 +43,7 @@ - #include - #include - --#define TCPUDP_MIB_MAX max_t(u32, UDP_MIB_MAX, TCP_MIB_MAX) -+#define TCPUDP_MIB_MAX MAX_T(u32, UDP_MIB_MAX, TCP_MIB_MAX) - - /* - * Report socket allocation statistics [mea@utu.fi] -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index a4bbe959d1e25f..40a2f172be2cbd 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -3011,6 +3011,7 @@ int tcp_disconnect(struct sock *sk, int flags) - struct inet_connection_sock *icsk = inet_csk(sk); - struct tcp_sock *tp = tcp_sk(sk); - int old_state = sk->sk_state; -+ struct request_sock *req; - u32 seq; - - if (old_state != TCP_CLOSE) -@@ -3121,6 +3122,10 @@ int tcp_disconnect(struct sock *sk, int flags) - - - /* Clean up fastopen related fields */ -+ req = rcu_dereference_protected(tp->fastopen_rsk, -+ lockdep_sock_is_held(sk)); -+ if (req) -+ reqsk_fastopen_remove(sk, req, false); - tcp_free_fastopen_req(tp); - inet_clear_bit(DEFER_CONNECT, sk); - tp->fastopen_client_fail = 0; -diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c -index 6d1d9221649d52..752327b10dde74 100644 ---- a/net/ipv6/proc.c -+++ b/net/ipv6/proc.c -@@ -27,7 +27,7 @@ - #include - - #define MAX4(a, b, c, d) \ -- max_t(u32, max_t(u32, a, b), max_t(u32, c, d)) -+ MAX_T(u32, MAX_T(u32, a, b), MAX_T(u32, c, d)) - #define SNMP_MIB_MAX MAX4(UDP_MIB_MAX, TCP_MIB_MAX, \ - IPSTATS_MIB_MAX, ICMP_MIB_MAX) - -diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h -index 78aa3bc51586e2..5f8f72ca2769c4 100644 ---- a/net/mac80211/driver-ops.h -+++ b/net/mac80211/driver-ops.h -@@ -1273,7 +1273,7 @@ drv_get_ftm_responder_stats(struct ieee80211_local *local, - struct ieee80211_sub_if_data *sdata, - struct cfg80211_ftm_responder_stats *ftm_stats) - { -- u32 ret = -EOPNOTSUPP; -+ int ret = -EOPNOTSUPP; - - if (local->ops->get_ftm_responder_stats) - ret = local->ops->get_ftm_responder_stats(&local->hw, -diff --git a/net/mac80211/main.c b/net/mac80211/main.c -index 3a6fff98748b86..80b143bde93d63 100644 ---- a/net/mac80211/main.c -+++ b/net/mac80211/main.c -@@ -965,7 +965,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw) - int result, i; - enum nl80211_band band; - int channels, max_bitrates; -- bool supp_ht, supp_vht, supp_he, supp_eht; -+ bool supp_ht, supp_vht, supp_he, supp_eht, supp_s1g; - struct cfg80211_chan_def dflt_chandef = {}; - - if (ieee80211_hw_check(hw, QUEUE_CONTROL) && -@@ -1081,6 +1081,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw) - supp_vht = false; - supp_he = false; - supp_eht = false; -+ supp_s1g = false; - for (band = 0; band < NUM_NL80211_BANDS; band++) { - struct ieee80211_supported_band *sband; - -@@ -1127,6 +1128,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw) - max_bitrates = sband->n_bitrates; - supp_ht = supp_ht || sband->ht_cap.ht_supported; - supp_vht = supp_vht || sband->vht_cap.vht_supported; -+ supp_s1g = supp_s1g || sband->s1g_cap.s1g; - - for (i = 0; i < sband->n_iftype_data; i++) { - const struct ieee80211_sband_iftype_data *iftd; -@@ -1253,6 +1255,9 @@ int ieee80211_register_hw(struct ieee80211_hw *hw) - local->scan_ies_len += - 2 + sizeof(struct ieee80211_vht_cap); - -+ if (supp_s1g) -+ local->scan_ies_len += 2 + sizeof(struct ieee80211_s1g_cap); -+ - /* - * HE cap element is variable in size - set len to allow max size */ - if (supp_he) { -diff --git a/net/mptcp/options.c b/net/mptcp/options.c -index 9406d2d555e74d..b245abd08c8241 100644 ---- a/net/mptcp/options.c -+++ b/net/mptcp/options.c -@@ -985,13 +985,13 @@ static bool check_fully_established(struct mptcp_sock *msk, struct sock *ssk, - return false; - } - -- if (mp_opt->deny_join_id0) -- WRITE_ONCE(msk->pm.remote_deny_join_id0, true); -- - if (unlikely(!READ_ONCE(msk->pm.server_side))) - pr_warn_once("bogus mpc option on established client sk"); - - set_fully_established: -+ if (mp_opt->deny_join_id0) -+ WRITE_ONCE(msk->pm.remote_deny_join_id0, true); -+ - mptcp_data_lock((struct sock *)msk); - __mptcp_subflow_fully_established(msk, subflow, mp_opt); - mptcp_data_unlock((struct sock *)msk); -diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c -index e8042014bd5f4a..de24989b05a600 100644 ---- a/net/mptcp/pm_netlink.c -+++ b/net/mptcp/pm_netlink.c -@@ -2252,6 +2252,7 @@ static int mptcp_event_created(struct sk_buff *skb, - const struct sock *ssk) - { - int err = nla_put_u32(skb, MPTCP_ATTR_TOKEN, msk->token); -+ u16 flags = 0; - - if (err) - return err; -@@ -2259,6 +2260,12 @@ static int mptcp_event_created(struct sk_buff *skb, - if (nla_put_u8(skb, MPTCP_ATTR_SERVER_SIDE, READ_ONCE(msk->pm.server_side))) - return -EMSGSIZE; - -+ if (READ_ONCE(msk->pm.remote_deny_join_id0)) -+ flags |= MPTCP_PM_EV_FLAG_DENY_JOIN_ID0; -+ -+ if (flags && nla_put_u16(skb, MPTCP_ATTR_FLAGS, flags)) -+ return -EMSGSIZE; -+ - return mptcp_event_add_subflow(skb, ssk); - } - -diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c -index e3f09467b36b2f..643d64bdef2ea7 100644 ---- a/net/mptcp/protocol.c -+++ b/net/mptcp/protocol.c -@@ -415,6 +415,20 @@ static void mptcp_close_wake_up(struct sock *sk) - sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN); - } - -+static void mptcp_shutdown_subflows(struct mptcp_sock *msk) -+{ -+ struct mptcp_subflow_context *subflow; -+ -+ mptcp_for_each_subflow(msk, subflow) { -+ struct sock *ssk = mptcp_subflow_tcp_sock(subflow); -+ bool slow; -+ -+ slow = lock_sock_fast(ssk); -+ tcp_shutdown(ssk, SEND_SHUTDOWN); -+ unlock_sock_fast(ssk, slow); -+ } -+} -+ - static bool mptcp_pending_data_fin_ack(struct sock *sk) - { - struct mptcp_sock *msk = mptcp_sk(sk); -@@ -438,6 +452,7 @@ static void mptcp_check_data_fin_ack(struct sock *sk) - break; - case TCP_CLOSING: - case TCP_LAST_ACK: -+ mptcp_shutdown_subflows(msk); - mptcp_set_state(sk, TCP_CLOSE); - break; - } -@@ -605,6 +620,7 @@ static bool mptcp_check_data_fin(struct sock *sk) - mptcp_set_state(sk, TCP_CLOSING); - break; - case TCP_FIN_WAIT2: -+ mptcp_shutdown_subflows(msk); - mptcp_set_state(sk, TCP_CLOSE); - break; - default: -diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c -index 0c9b9c0c277c23..dfee1890c841bb 100644 ---- a/net/mptcp/subflow.c -+++ b/net/mptcp/subflow.c -@@ -863,6 +863,10 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, - - ctx->subflow_id = 1; - owner = mptcp_sk(ctx->conn); -+ -+ if (mp_opt.deny_join_id0) -+ WRITE_ONCE(owner->pm.remote_deny_join_id0, true); -+ - mptcp_pm_new_connection(owner, child, 1); - - /* with OoO packets we can reach here without ingress -diff --git a/net/rds/ib_frmr.c b/net/rds/ib_frmr.c -index 28c1b00221780f..bd861191157b54 100644 ---- a/net/rds/ib_frmr.c -+++ b/net/rds/ib_frmr.c -@@ -133,12 +133,15 @@ static int rds_ib_post_reg_frmr(struct rds_ib_mr *ibmr) - - ret = ib_map_mr_sg_zbva(frmr->mr, ibmr->sg, ibmr->sg_dma_len, - &off, PAGE_SIZE); -- if (unlikely(ret != ibmr->sg_dma_len)) -- return ret < 0 ? ret : -EINVAL; -+ if (unlikely(ret != ibmr->sg_dma_len)) { -+ ret = ret < 0 ? ret : -EINVAL; -+ goto out_inc; -+ } - -- if (cmpxchg(&frmr->fr_state, -- FRMR_IS_FREE, FRMR_IS_INUSE) != FRMR_IS_FREE) -- return -EBUSY; -+ if (cmpxchg(&frmr->fr_state, FRMR_IS_FREE, FRMR_IS_INUSE) != FRMR_IS_FREE) { -+ ret = -EBUSY; -+ goto out_inc; -+ } - - atomic_inc(&ibmr->ic->i_fastreg_inuse_count); - -@@ -166,11 +169,10 @@ static int rds_ib_post_reg_frmr(struct rds_ib_mr *ibmr) - /* Failure here can be because of -ENOMEM as well */ - rds_transition_frwr_state(ibmr, FRMR_IS_INUSE, FRMR_IS_STALE); - -- atomic_inc(&ibmr->ic->i_fastreg_wrs); - if (printk_ratelimit()) - pr_warn("RDS/IB: %s returned error(%d)\n", - __func__, ret); -- goto out; -+ goto out_inc; - } - - /* Wait for the registration to complete in order to prevent an invalid -@@ -179,8 +181,10 @@ static int rds_ib_post_reg_frmr(struct rds_ib_mr *ibmr) - */ - wait_event(frmr->fr_reg_done, !frmr->fr_reg); - --out: -+ return ret; - -+out_inc: -+ atomic_inc(&ibmr->ic->i_fastreg_wrs); - return ret; - } - -diff --git a/net/rfkill/rfkill-gpio.c b/net/rfkill/rfkill-gpio.c -index b12edbe0ef45c1..badc71acbbdd8d 100644 ---- a/net/rfkill/rfkill-gpio.c -+++ b/net/rfkill/rfkill-gpio.c -@@ -79,10 +79,10 @@ static int rfkill_gpio_acpi_probe(struct device *dev, - static int rfkill_gpio_probe(struct platform_device *pdev) - { - struct rfkill_gpio_data *rfkill; -- struct gpio_desc *gpio; -+ const char *type_name = NULL; - const char *name_property; - const char *type_property; -- const char *type_name; -+ struct gpio_desc *gpio; - int ret; - - rfkill = devm_kzalloc(&pdev->dev, sizeof(*rfkill), GFP_KERNEL); -diff --git a/net/tls/tls.h b/net/tls/tls.h -index 5dc61c85c076ec..a3c5c5a59fda69 100644 ---- a/net/tls/tls.h -+++ b/net/tls/tls.h -@@ -141,6 +141,7 @@ void update_sk_prot(struct sock *sk, struct tls_context *ctx); - - int wait_on_pending_writer(struct sock *sk, long *timeo); - void tls_err_abort(struct sock *sk, int err); -+void tls_strp_abort_strp(struct tls_strparser *strp, int err); - - int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx); - void tls_update_rx_zc_capable(struct tls_context *tls_ctx); -diff --git a/net/tls/tls_strp.c b/net/tls/tls_strp.c -index 6ce64a6e4495ec..ae723cd6af3975 100644 ---- a/net/tls/tls_strp.c -+++ b/net/tls/tls_strp.c -@@ -12,7 +12,7 @@ - - static struct workqueue_struct *tls_strp_wq; - --static void tls_strp_abort_strp(struct tls_strparser *strp, int err) -+void tls_strp_abort_strp(struct tls_strparser *strp, int err) - { - if (strp->stopped) - return; -@@ -210,11 +210,17 @@ static int tls_strp_copyin_frag(struct tls_strparser *strp, struct sk_buff *skb, - struct sk_buff *in_skb, unsigned int offset, - size_t in_len) - { -+ unsigned int nfrag = skb->len / PAGE_SIZE; - size_t len, chunk; - skb_frag_t *frag; - int sz; - -- frag = &skb_shinfo(skb)->frags[skb->len / PAGE_SIZE]; -+ if (unlikely(nfrag >= skb_shinfo(skb)->nr_frags)) { -+ DEBUG_NET_WARN_ON_ONCE(1); -+ return -EMSGSIZE; -+ } -+ -+ frag = &skb_shinfo(skb)->frags[nfrag]; - - len = in_len; - /* First make sure we got the header */ -@@ -519,10 +525,8 @@ static int tls_strp_read_sock(struct tls_strparser *strp) - tls_strp_load_anchor_with_queue(strp, inq); - if (!strp->stm.full_len) { - sz = tls_rx_msg_size(strp, strp->anchor); -- if (sz < 0) { -- tls_strp_abort_strp(strp, sz); -+ if (sz < 0) - return sz; -- } - - strp->stm.full_len = sz; - -diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c -index 27ce1feb79e14e..435235a351e2f4 100644 ---- a/net/tls/tls_sw.c -+++ b/net/tls/tls_sw.c -@@ -2441,8 +2441,7 @@ int tls_rx_msg_size(struct tls_strparser *strp, struct sk_buff *skb) - return data_len + TLS_HEADER_SIZE; - - read_failure: -- tls_err_abort(strp->sk, ret); -- -+ tls_strp_abort_strp(strp, ret); - return ret; - } - -diff --git a/sound/firewire/motu/motu-hwdep.c b/sound/firewire/motu/motu-hwdep.c -index 88d1f4b56e4be4..a220ac0c8eb831 100644 ---- a/sound/firewire/motu/motu-hwdep.c -+++ b/sound/firewire/motu/motu-hwdep.c -@@ -111,7 +111,7 @@ static __poll_t hwdep_poll(struct snd_hwdep *hwdep, struct file *file, - events = 0; - spin_unlock_irq(&motu->lock); - -- return events | EPOLLOUT; -+ return events; - } - - static int hwdep_get_info(struct snd_motu *motu, void __user *arg) -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 6aae06223f2664..5fe6b71d90f4f4 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -10161,6 +10161,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x8992, "HP EliteBook 845 G9", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x103c, 0x8994, "HP EliteBook 855 G9", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x8995, "HP EliteBook 855 G9", ALC287_FIXUP_CS35L41_I2C_2), -+ SND_PCI_QUIRK(0x103c, 0x89a0, "HP Laptop 15-dw4xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), - SND_PCI_QUIRK(0x103c, 0x89a4, "HP ProBook 440 G9", ALC236_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x89a6, "HP ProBook 450 G9", ALC236_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x89aa, "HP EliteBook 630 G9", ALC236_FIXUP_HP_GPIO_LED), -diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c -index b9432f8b64e5bc..39d2c8e85d9dbc 100644 ---- a/sound/soc/codecs/wm8940.c -+++ b/sound/soc/codecs/wm8940.c -@@ -220,7 +220,7 @@ static const struct snd_kcontrol_new wm8940_snd_controls[] = { - SOC_SINGLE_TLV("Digital Capture Volume", WM8940_ADCVOL, - 0, 255, 0, wm8940_adc_tlv), - SOC_ENUM("Mic Bias Level", wm8940_mic_bias_level_enum), -- SOC_SINGLE_TLV("Capture Boost Volue", WM8940_ADCBOOST, -+ SOC_SINGLE_TLV("Capture Boost Volume", WM8940_ADCBOOST, - 8, 1, 0, wm8940_capture_boost_vol_tlv), - SOC_SINGLE_TLV("Speaker Playback Volume", WM8940_SPKVOL, - 0, 63, 0, wm8940_spk_vol_tlv), -@@ -693,7 +693,12 @@ static int wm8940_update_clocks(struct snd_soc_dai *dai) - f = wm8940_get_mclkdiv(priv->mclk, fs256, &mclkdiv); - if (f != priv->mclk) { - /* The PLL performs best around 90MHz */ -- fpll = wm8940_get_mclkdiv(22500000, fs256, &mclkdiv); -+ if (fs256 % 8000) -+ f = 22579200; -+ else -+ f = 24576000; -+ -+ fpll = wm8940_get_mclkdiv(f, fs256, &mclkdiv); - } - - wm8940_set_dai_pll(dai, 0, 0, priv->mclk, fpll); -diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c -index 260bac695b20ab..2aaa1cbe68b71c 100644 ---- a/sound/soc/codecs/wm8974.c -+++ b/sound/soc/codecs/wm8974.c -@@ -419,10 +419,14 @@ static int wm8974_update_clocks(struct snd_soc_dai *dai) - fs256 = 256 * priv->fs; - - f = wm8974_get_mclkdiv(priv->mclk, fs256, &mclkdiv); -- - if (f != priv->mclk) { - /* The PLL performs best around 90MHz */ -- fpll = wm8974_get_mclkdiv(22500000, fs256, &mclkdiv); -+ if (fs256 % 8000) -+ f = 22579200; -+ else -+ f = 24576000; -+ -+ fpll = wm8974_get_mclkdiv(f, fs256, &mclkdiv); - } - - wm8974_set_dai_pll(dai, 0, 0, priv->mclk, fpll); -diff --git a/sound/soc/qcom/qdsp6/audioreach.c b/sound/soc/qcom/qdsp6/audioreach.c -index 5974c7929dd370..3eab43e9efb324 100644 ---- a/sound/soc/qcom/qdsp6/audioreach.c -+++ b/sound/soc/qcom/qdsp6/audioreach.c -@@ -967,6 +967,7 @@ static int audioreach_i2s_set_media_format(struct q6apm_graph *graph, - param_data->param_id = PARAM_ID_I2S_INTF_CFG; - param_data->param_size = ic_sz - APM_MODULE_PARAM_DATA_SIZE; - -+ intf_cfg->cfg.lpaif_type = module->hw_interface_type; - intf_cfg->cfg.intf_idx = module->hw_interface_idx; - intf_cfg->cfg.sd_line_idx = module->sd_line_idx; - -diff --git a/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c b/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c -index 6511f0a08de161..3813fe5e01819a 100644 ---- a/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c -+++ b/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c -@@ -207,8 +207,10 @@ static int q6apm_lpass_dai_prepare(struct snd_pcm_substream *substream, struct s - - return 0; - err: -- q6apm_graph_close(dai_data->graph[dai->id]); -- dai_data->graph[dai->id] = NULL; -+ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) { -+ q6apm_graph_close(dai_data->graph[dai->id]); -+ dai_data->graph[dai->id] = NULL; -+ } - return rc; - } - -@@ -254,6 +256,7 @@ static const struct snd_soc_dai_ops q6i2s_ops = { - .shutdown = q6apm_lpass_dai_shutdown, - .set_channel_map = q6dma_set_channel_map, - .hw_params = q6dma_hw_params, -+ .set_fmt = q6i2s_set_fmt, - }; - - static const struct snd_soc_dai_ops q6hdmi_ops = { -diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c -index 0b0087abcc50ed..3bb743cb167a5b 100644 ---- a/sound/soc/sof/intel/hda-stream.c -+++ b/sound/soc/sof/intel/hda-stream.c -@@ -842,7 +842,7 @@ int hda_dsp_stream_init(struct snd_sof_dev *sdev) - - if (num_capture >= SOF_HDA_CAPTURE_STREAMS) { - dev_err(sdev->dev, "error: too many capture streams %d\n", -- num_playback); -+ num_capture); - return -EINVAL; - } - -diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.c b/tools/testing/selftests/net/mptcp/mptcp_connect.c -index c83a8b47bbdfa5..fc9eff0e89e226 100644 ---- a/tools/testing/selftests/net/mptcp/mptcp_connect.c -+++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c -@@ -1079,6 +1079,7 @@ int main_loop_s(int listensock) - struct pollfd polls; - socklen_t salen; - int remotesock; -+ int err = 0; - int fd = 0; - - again: -@@ -1111,7 +1112,7 @@ int main_loop_s(int listensock) - SOCK_TEST_TCPULP(remotesock, 0); - - memset(&winfo, 0, sizeof(winfo)); -- copyfd_io(fd, remotesock, 1, true, &winfo); -+ err = copyfd_io(fd, remotesock, 1, true, &winfo); - } else { - perror("accept"); - return 1; -@@ -1120,10 +1121,10 @@ int main_loop_s(int listensock) - if (cfg_input) - close(fd); - -- if (--cfg_repeat > 0) -+ if (!err && --cfg_repeat > 0) - goto again; - -- return 0; -+ return err; - } - - static void init_rng(void) -@@ -1233,7 +1234,7 @@ void xdisconnect(int fd) - else - xerror("bad family"); - -- strcpy(cmd, "ss -M | grep -q "); -+ strcpy(cmd, "ss -Mnt | grep -q "); - cmdlen = strlen(cmd); - if (!inet_ntop(addr.ss_family, raw_addr, &cmd[cmdlen], - sizeof(cmd) - cmdlen)) -@@ -1243,7 +1244,7 @@ void xdisconnect(int fd) - - /* - * wait until the pending data is completely flushed and all -- * the MPTCP sockets reached the closed status. -+ * the sockets reached the closed status. - * disconnect will bypass/ignore/drop any pending data. - */ - for (i = 0; ; i += msec_sleep) { -diff --git a/tools/testing/selftests/net/mptcp/mptcp_sockopt.c b/tools/testing/selftests/net/mptcp/mptcp_sockopt.c -index 926b0be87c9905..1dc2bd6ee4a50e 100644 ---- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.c -+++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.c -@@ -658,22 +658,26 @@ static void process_one_client(int fd, int pipefd) - - do_getsockopts(&s, fd, ret, ret2); - if (s.mptcpi_rcv_delta != (uint64_t)ret + 1) -- xerror("mptcpi_rcv_delta %" PRIu64 ", expect %" PRIu64, s.mptcpi_rcv_delta, ret + 1, s.mptcpi_rcv_delta - ret); -+ xerror("mptcpi_rcv_delta %" PRIu64 ", expect %" PRIu64 ", diff %" PRId64, -+ s.mptcpi_rcv_delta, ret + 1, s.mptcpi_rcv_delta - (ret + 1)); - - /* be nice when running on top of older kernel */ - if (s.pkt_stats_avail) { - if (s.last_sample.mptcpi_bytes_sent != ret2) -- xerror("mptcpi_bytes_sent %" PRIu64 ", expect %" PRIu64, -+ xerror("mptcpi_bytes_sent %" PRIu64 ", expect %" PRIu64 -+ ", diff %" PRId64, - s.last_sample.mptcpi_bytes_sent, ret2, - s.last_sample.mptcpi_bytes_sent - ret2); - if (s.last_sample.mptcpi_bytes_received != ret) -- xerror("mptcpi_bytes_received %" PRIu64 ", expect %" PRIu64, -+ xerror("mptcpi_bytes_received %" PRIu64 ", expect %" PRIu64 -+ ", diff %" PRId64, - s.last_sample.mptcpi_bytes_received, ret, - s.last_sample.mptcpi_bytes_received - ret); - if (s.last_sample.mptcpi_bytes_acked != ret) -- xerror("mptcpi_bytes_acked %" PRIu64 ", expect %" PRIu64, -- s.last_sample.mptcpi_bytes_acked, ret2, -- s.last_sample.mptcpi_bytes_acked - ret2); -+ xerror("mptcpi_bytes_acked %" PRIu64 ", expect %" PRIu64 -+ ", diff %" PRId64, -+ s.last_sample.mptcpi_bytes_acked, ret, -+ s.last_sample.mptcpi_bytes_acked - ret); - } - - close(fd); -diff --git a/tools/testing/selftests/net/mptcp/pm_nl_ctl.c b/tools/testing/selftests/net/mptcp/pm_nl_ctl.c -index 763402dd17742f..234c267dd2aad3 100644 ---- a/tools/testing/selftests/net/mptcp/pm_nl_ctl.c -+++ b/tools/testing/selftests/net/mptcp/pm_nl_ctl.c -@@ -194,6 +194,13 @@ static int capture_events(int fd, int event_group) - fprintf(stderr, ",error:%u", *(__u8 *)RTA_DATA(attrs)); - else if (attrs->rta_type == MPTCP_ATTR_SERVER_SIDE) - fprintf(stderr, ",server_side:%u", *(__u8 *)RTA_DATA(attrs)); -+ else if (attrs->rta_type == MPTCP_ATTR_FLAGS) { -+ __u16 flags = *(__u16 *)RTA_DATA(attrs); -+ -+ /* only print when present, easier */ -+ if (flags & MPTCP_PM_EV_FLAG_DENY_JOIN_ID0) -+ fprintf(stderr, ",deny_join_id0:1"); -+ } - - attrs = RTA_NEXT(attrs, msg_len); - } -diff --git a/tools/testing/selftests/net/mptcp/userspace_pm.sh b/tools/testing/selftests/net/mptcp/userspace_pm.sh -index c5d7af8e8efde1..4e966a9e373835 100755 ---- a/tools/testing/selftests/net/mptcp/userspace_pm.sh -+++ b/tools/testing/selftests/net/mptcp/userspace_pm.sh -@@ -196,6 +196,9 @@ make_connection() - is_v6="v4" - fi - -+ # set this on the client side only: will not affect the rest -+ ip netns exec "$ns2" sysctl -q net.mptcp.allow_join_initial_addr_port=0 -+ - # Capture netlink events over the two network namespaces running - # the MPTCP client and server - if [ -z "$client_evts" ]; then -@@ -227,23 +230,28 @@ make_connection() - local client_token - local client_port - local client_serverside -+ local client_nojoin - local server_token - local server_serverside -+ local server_nojoin - - client_token=$(mptcp_lib_evts_get_info token "$client_evts") - client_port=$(mptcp_lib_evts_get_info sport "$client_evts") - client_serverside=$(mptcp_lib_evts_get_info server_side "$client_evts") -+ client_nojoin=$(mptcp_lib_evts_get_info deny_join_id0 "$client_evts") - server_token=$(mptcp_lib_evts_get_info token "$server_evts") - server_serverside=$(mptcp_lib_evts_get_info server_side "$server_evts") -+ server_nojoin=$(mptcp_lib_evts_get_info deny_join_id0 "$server_evts") - - print_test "Established IP${is_v6} MPTCP Connection ns2 => ns1" -- if [ "$client_token" != "" ] && [ "$server_token" != "" ] && [ "$client_serverside" = 0 ] && -- [ "$server_serverside" = 1 ] -+ if [ "${client_token}" != "" ] && [ "${server_token}" != "" ] && -+ [ "${client_serverside}" = 0 ] && [ "${server_serverside}" = 1 ] && -+ [ "${client_nojoin:-0}" = 0 ] && [ "${server_nojoin:-0}" = 1 ] - then - test_pass - print_title "Connection info: ${client_addr}:${client_port} -> ${connect_addr}:${app_port}" - else -- test_fail "Expected tokens (c:${client_token} - s:${server_token}) and server (c:${client_serverside} - s:${server_serverside})" -+ test_fail "Expected tokens (c:${client_token} - s:${server_token}), server (c:${client_serverside} - s:${server_serverside}), nojoin (c:${client_nojoin} - s:${server_nojoin})" - mptcp_lib_result_print_all_tap - exit 1 - fi diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.108-109.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.108-109.patch deleted file mode 100644 index a0a74cbd8e..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.108-109.patch +++ /dev/null @@ -1,3085 +0,0 @@ -diff --git a/Makefile b/Makefile -index 1e3fb36bb71d78..afeacf5efc9553 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 108 -+SUBLEVEL = 109 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_sodia.dts b/arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_sodia.dts -index 2564671fc1c67f..59745ba9c8dabd 100644 ---- a/arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_sodia.dts -+++ b/arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_sodia.dts -@@ -66,8 +66,10 @@ &gmac1 { - mdio0 { - #address-cells = <1>; - #size-cells = <0>; -- phy0: ethernet-phy@0 { -- reg = <0>; -+ compatible = "snps,dwmac-mdio"; -+ -+ phy0: ethernet-phy@4 { -+ reg = <4>; - rxd0-skew-ps = <0>; - rxd1-skew-ps = <0>; - rxd2-skew-ps = <0>; -diff --git a/arch/arm/boot/dts/marvell/kirkwood-openrd-client.dts b/arch/arm/boot/dts/marvell/kirkwood-openrd-client.dts -index d4e0b8150a84ce..cf26e2ceaaa074 100644 ---- a/arch/arm/boot/dts/marvell/kirkwood-openrd-client.dts -+++ b/arch/arm/boot/dts/marvell/kirkwood-openrd-client.dts -@@ -38,7 +38,7 @@ sound { - simple-audio-card,mclk-fs = <256>; - - simple-audio-card,cpu { -- sound-dai = <&audio0 0>; -+ sound-dai = <&audio0>; - }; - - simple-audio-card,codec { -diff --git a/arch/arm/mach-bcm/Kconfig b/arch/arm/mach-bcm/Kconfig -index 8789d93a7c04b3..c705bec1410c57 100644 ---- a/arch/arm/mach-bcm/Kconfig -+++ b/arch/arm/mach-bcm/Kconfig -@@ -186,6 +186,7 @@ config ARCH_BRCMSTB - select ARCH_HAS_RESET_CONTROLLER - select ARM_AMBA - select ARM_GIC -+ select ARM_GIC_V3 - select ARM_ERRATA_798181 if SMP - select HAVE_ARM_ARCH_TIMER - select ZONE_DMA if ARM_LPAE -diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi -index 69b213ed7a5943..7f7bd8477efde3 100644 ---- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi -+++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi -@@ -228,7 +228,7 @@ thermal-zones { - cpu-thermal { - polling-delay-passive = <250>; - polling-delay = <2000>; -- thermal-sensors = <&tmu 0>; -+ thermal-sensors = <&tmu 1>; - trips { - cpu_alert0: trip0 { - temperature = <85000>; -@@ -258,7 +258,7 @@ map0 { - soc-thermal { - polling-delay-passive = <250>; - polling-delay = <2000>; -- thermal-sensors = <&tmu 1>; -+ thermal-sensors = <&tmu 0>; - trips { - soc_alert0: trip0 { - temperature = <85000>; -diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c -index 771e1cb17540db..e590b4c096253e 100644 ---- a/arch/s390/kernel/perf_cpum_cf.c -+++ b/arch/s390/kernel/perf_cpum_cf.c -@@ -852,7 +852,7 @@ static int cpumf_pmu_event_type(struct perf_event *event) - static int cpumf_pmu_event_init(struct perf_event *event) - { - unsigned int type = event->attr.type; -- int err; -+ int err = -ENOENT; - - if (is_sampling_event(event)) /* No sampling support */ - return err; -@@ -861,8 +861,6 @@ static int cpumf_pmu_event_init(struct perf_event *event) - else if (event->pmu->type == type) - /* Registered as unknown PMU */ - err = __hw_perf_event_init(event, cpumf_pmu_event_type(event)); -- else -- return -ENOENT; - - if (unlikely(err) && event->destroy) - event->destroy(event); -diff --git a/arch/um/drivers/mconsole_user.c b/arch/um/drivers/mconsole_user.c -index e24298a734befd..a04cd13c6315a2 100644 ---- a/arch/um/drivers/mconsole_user.c -+++ b/arch/um/drivers/mconsole_user.c -@@ -71,7 +71,9 @@ static struct mconsole_command *mconsole_parse(struct mc_request *req) - return NULL; - } - -+#ifndef MIN - #define MIN(a,b) ((a)<(b) ? (a):(b)) -+#endif - - #define STRINGX(x) #x - #define STRING(x) STRINGX(x) -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index 455e2a2b149f4b..6fe9180aafb36b 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -1472,19 +1472,36 @@ static int loop_set_dio(struct loop_device *lo, unsigned long arg) - return error; - } - --static int loop_set_block_size(struct loop_device *lo, unsigned long arg) -+static int loop_set_block_size(struct loop_device *lo, blk_mode_t mode, -+ struct block_device *bdev, unsigned long arg) - { - int err = 0; - -- if (lo->lo_state != Lo_bound) -- return -ENXIO; -+ /* -+ * If we don't hold exclusive handle for the device, upgrade to it -+ * here to avoid changing device under exclusive owner. -+ */ -+ if (!(mode & BLK_OPEN_EXCL)) { -+ err = bd_prepare_to_claim(bdev, loop_set_block_size, NULL); -+ if (err) -+ return err; -+ } -+ -+ err = mutex_lock_killable(&lo->lo_mutex); -+ if (err) -+ goto abort_claim; -+ -+ if (lo->lo_state != Lo_bound) { -+ err = -ENXIO; -+ goto unlock; -+ } - - err = blk_validate_block_size(arg); - if (err) -- return err; -+ goto unlock; - - if (lo->lo_queue->limits.logical_block_size == arg) -- return 0; -+ goto unlock; - - sync_blockdev(lo->lo_device); - invalidate_bdev(lo->lo_device); -@@ -1496,6 +1513,11 @@ static int loop_set_block_size(struct loop_device *lo, unsigned long arg) - loop_update_dio(lo); - blk_mq_unfreeze_queue(lo->lo_queue); - -+unlock: -+ mutex_unlock(&lo->lo_mutex); -+abort_claim: -+ if (!(mode & BLK_OPEN_EXCL)) -+ bd_abort_claiming(bdev, loop_set_block_size); - return err; - } - -@@ -1514,9 +1536,6 @@ static int lo_simple_ioctl(struct loop_device *lo, unsigned int cmd, - case LOOP_SET_DIRECT_IO: - err = loop_set_dio(lo, arg); - break; -- case LOOP_SET_BLOCK_SIZE: -- err = loop_set_block_size(lo, arg); -- break; - default: - err = -EINVAL; - } -@@ -1571,9 +1590,12 @@ static int lo_ioctl(struct block_device *bdev, blk_mode_t mode, - break; - case LOOP_GET_STATUS64: - return loop_get_status64(lo, argp); -+ case LOOP_SET_BLOCK_SIZE: -+ if (!(mode & BLK_OPEN_WRITE) && !capable(CAP_SYS_ADMIN)) -+ return -EPERM; -+ return loop_set_block_size(lo, mode, bdev, arg); - case LOOP_SET_CAPACITY: - case LOOP_SET_DIRECT_IO: -- case LOOP_SET_BLOCK_SIZE: - if (!(mode & BLK_OPEN_WRITE) && !capable(CAP_SYS_ADMIN)) - return -EPERM; - fallthrough; -diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c -index 30d8f2ada0f176..76b0b9e6309b91 100644 ---- a/drivers/cpufreq/cpufreq.c -+++ b/drivers/cpufreq/cpufreq.c -@@ -2950,6 +2950,15 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) - goto err_null_driver; - } - -+ /* -+ * Mark support for the scheduler's frequency invariance engine for -+ * drivers that implement target(), target_index() or fast_switch(). -+ */ -+ if (!cpufreq_driver->setpolicy) { -+ static_branch_enable_cpuslocked(&cpufreq_freq_invariance); -+ pr_debug("cpufreq: supports frequency invariance\n"); -+ } -+ - ret = subsys_interface_register(&cpufreq_interface); - if (ret) - goto err_boost_unreg; -@@ -2971,21 +2980,14 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) - hp_online = ret; - ret = 0; - -- /* -- * Mark support for the scheduler's frequency invariance engine for -- * drivers that implement target(), target_index() or fast_switch(). -- */ -- if (!cpufreq_driver->setpolicy) { -- static_branch_enable_cpuslocked(&cpufreq_freq_invariance); -- pr_debug("supports frequency invariance"); -- } -- - pr_debug("driver %s up and running\n", driver_data->name); - goto out; - - err_if_unreg: - subsys_interface_unregister(&cpufreq_interface); - err_boost_unreg: -+ if (!cpufreq_driver->setpolicy) -+ static_branch_disable_cpuslocked(&cpufreq_freq_invariance); - remove_boost_sysfs_file(); - err_null_driver: - write_lock_irqsave(&cpufreq_driver_lock, flags); -diff --git a/drivers/edac/skx_common.h b/drivers/edac/skx_common.h -index 2ea4d1d1fbef26..1fa31a6fdfcd5d 100644 ---- a/drivers/edac/skx_common.h -+++ b/drivers/edac/skx_common.h -@@ -45,7 +45,6 @@ - #define I10NM_NUM_CHANNELS MAX(I10NM_NUM_DDR_CHANNELS, I10NM_NUM_HBM_CHANNELS) - #define I10NM_NUM_DIMMS MAX(I10NM_NUM_DDR_DIMMS, I10NM_NUM_HBM_DIMMS) - --#define MAX(a, b) ((a) > (b) ? (a) : (b)) - #define NUM_IMC MAX(SKX_NUM_IMC, I10NM_NUM_IMC) - #define NUM_CHANNELS MAX(SKX_NUM_CHANNELS, I10NM_NUM_CHANNELS) - #define NUM_DIMMS MAX(SKX_NUM_DIMMS, I10NM_NUM_DIMMS) -diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c -index 73cc2f2dcbf923..bdf4b035325e95 100644 ---- a/drivers/firewire/core-cdev.c -+++ b/drivers/firewire/core-cdev.c -@@ -39,7 +39,7 @@ - /* - * ABI version history is documented in linux/firewire-cdev.h. - */ --#define FW_CDEV_KERNEL_VERSION 5 -+#define FW_CDEV_KERNEL_VERSION 6 - #define FW_CDEV_VERSION_EVENT_REQUEST2 4 - #define FW_CDEV_VERSION_ALLOCATE_REGION_END 4 - #define FW_CDEV_VERSION_AUTO_FLUSH_ISO_OVERFLOW 5 -diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c -index efb592b6f6aa7a..9b8a200423858e 100644 ---- a/drivers/gpio/gpiolib.c -+++ b/drivers/gpio/gpiolib.c -@@ -4022,6 +4022,23 @@ static struct gpio_desc *gpiod_find_by_fwnode(struct fwnode_handle *fwnode, - return desc; - } - -+static struct gpio_desc *gpiod_fwnode_lookup(struct fwnode_handle *fwnode, -+ struct device *consumer, -+ const char *con_id, -+ unsigned int idx, -+ enum gpiod_flags *flags, -+ unsigned long *lookupflags) -+{ -+ struct gpio_desc *desc; -+ -+ desc = gpiod_find_by_fwnode(fwnode, consumer, con_id, idx, flags, lookupflags); -+ if (gpiod_not_found(desc) && !IS_ERR_OR_NULL(fwnode)) -+ desc = gpiod_find_by_fwnode(fwnode->secondary, consumer, con_id, -+ idx, flags, lookupflags); -+ -+ return desc; -+} -+ - struct gpio_desc *gpiod_find_and_request(struct device *consumer, - struct fwnode_handle *fwnode, - const char *con_id, -@@ -4034,7 +4051,7 @@ struct gpio_desc *gpiod_find_and_request(struct device *consumer, - struct gpio_desc *desc; - int ret; - -- desc = gpiod_find_by_fwnode(fwnode, consumer, con_id, idx, &flags, &lookupflags); -+ desc = gpiod_fwnode_lookup(fwnode, consumer, con_id, idx, &flags, &lookupflags); - if (gpiod_not_found(desc) && platform_lookup_allowed) { - /* - * Either we are not using DT or ACPI, or their lookup did not -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h -index c5d706a4c7b4a7..78426f8c5420db 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h -@@ -1285,7 +1285,9 @@ int emu_soc_asic_init(struct amdgpu_device *adev); - for (i = ffs(inst_mask); i-- != 0; \ - i = ffs(inst_mask & BIT_MASK_UPPER(i + 1))) - -+#ifndef MIN - #define MIN(X, Y) ((X) < (Y) ? (X) : (Y)) -+#endif - - /* Common functions */ - bool amdgpu_device_has_job_running(struct amdgpu_device *adev); -diff --git a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c -index 1b2df97226a3f2..40286e8dd4e1ab 100644 ---- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c -+++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c -@@ -25,7 +25,9 @@ - - #include "hdcp.h" - -+#ifndef MIN - #define MIN(a, b) ((a) < (b) ? (a) : (b)) -+#endif - #define HDCP_I2C_ADDR 0x3a /* 0x74 >> 1*/ - #define KSV_READ_SIZE 0xf /* 0x6803b - 0x6802c */ - #define HDCP_MAX_AUX_TRANSACTION_SIZE 16 -diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppevvmath.h b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppevvmath.h -index 6f54c410c2f985..409aeec6baa921 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppevvmath.h -+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppevvmath.h -@@ -22,12 +22,18 @@ - */ - #include - --#define SHIFT_AMOUNT 16 /* We multiply all original integers with 2^SHIFT_AMOUNT to get the fInt representation */ -+enum ppevvmath_constants { -+ /* We multiply all original integers with 2^SHIFT_AMOUNT to get the fInt representation */ -+ SHIFT_AMOUNT = 16, - --#define PRECISION 5 /* Change this value to change the number of decimal places in the final output - 5 is a good default */ -+ /* Change this value to change the number of decimal places in the final output - 5 is a good default */ -+ PRECISION = 5, - --#define SHIFTED_2 (2 << SHIFT_AMOUNT) --#define MAX (1 << (SHIFT_AMOUNT - 1)) - 1 /* 32767 - Might change in the future */ -+ SHIFTED_2 = (2 << SHIFT_AMOUNT), -+ -+ /* 32767 - Might change in the future */ -+ MAX = (1 << (SHIFT_AMOUNT - 1)) - 1, -+}; - - /* ------------------------------------------------------------------------------- - * NEW TYPE - fINT -diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c -index a7f4f82d23b4b9..2fdb982e70ef7d 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c -@@ -2082,7 +2082,9 @@ static int sienna_cichlid_display_disable_memory_clock_switch(struct smu_context - return ret; - } - -+#ifndef MAX - #define MAX(a, b) ((a) > (b) ? (a) : (b)) -+#endif - - static int sienna_cichlid_update_pcie_parameters(struct smu_context *smu, - uint8_t pcie_gen_cap, -diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c -index 4022dd44ebb2b3..fe6c42a736d08b 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c -@@ -1696,7 +1696,10 @@ static int smu_v13_0_0_get_thermal_temperature_range(struct smu_context *smu, - return 0; - } - -+#ifndef MAX - #define MAX(a, b) ((a) > (b) ? (a) : (b)) -+#endif -+ - static ssize_t smu_v13_0_0_get_gpu_metrics(struct smu_context *smu, - void **table) - { -diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c -index e1521d3a5e0ca1..df99d185cf8e03 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c -@@ -1674,7 +1674,10 @@ static int smu_v13_0_7_get_thermal_temperature_range(struct smu_context *smu, - return 0; - } - -+#ifndef MAX - #define MAX(a, b) ((a) > (b) ? (a) : (b)) -+#endif -+ - static ssize_t smu_v13_0_7_get_gpu_metrics(struct smu_context *smu, - void **table) - { -diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c -index 12618a583e97cd..c1962f1974c6fe 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c -@@ -708,7 +708,7 @@ static const char *smu_get_feature_name(struct smu_context *smu, - size_t smu_cmn_get_pp_feature_mask(struct smu_context *smu, - char *buf) - { -- int8_t sort_feature[max(SMU_FEATURE_COUNT, SMU_FEATURE_MAX)]; -+ int8_t sort_feature[MAX(SMU_FEATURE_COUNT, SMU_FEATURE_MAX)]; - uint64_t feature_mask; - int i, feature_index; - uint32_t count = 0; -diff --git a/drivers/gpu/drm/ast/ast_dp.c b/drivers/gpu/drm/ast/ast_dp.c -index c6f226b6f08136..fc9c36c8b81b99 100644 ---- a/drivers/gpu/drm/ast/ast_dp.c -+++ b/drivers/gpu/drm/ast/ast_dp.c -@@ -62,7 +62,7 @@ int ast_astdp_read_edid(struct drm_device *dev, u8 *ediddata) - * of right-click of mouse. - * 2. The Delays are often longer a lot when system resume from S3/S4. - */ -- mdelay(j+1); -+ msleep(j + 1); - - if (!(ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xD1, - ASTDP_MCU_FW_EXECUTING) && -diff --git a/drivers/gpu/drm/gma500/oaktrail_hdmi.c b/drivers/gpu/drm/gma500/oaktrail_hdmi.c -index ed8626c73541c1..f0ae675581d9a5 100644 ---- a/drivers/gpu/drm/gma500/oaktrail_hdmi.c -+++ b/drivers/gpu/drm/gma500/oaktrail_hdmi.c -@@ -726,8 +726,8 @@ void oaktrail_hdmi_teardown(struct drm_device *dev) - - if (hdmi_dev) { - pdev = hdmi_dev->dev; -- pci_set_drvdata(pdev, NULL); - oaktrail_hdmi_i2c_exit(pdev); -+ pci_set_drvdata(pdev, NULL); - iounmap(hdmi_dev->regs); - kfree(hdmi_dev); - pci_dev_put(pdev); -diff --git a/drivers/gpu/drm/i915/display/intel_backlight.c b/drivers/gpu/drm/i915/display/intel_backlight.c -index ff9b9918b0a134..d414627813aab7 100644 ---- a/drivers/gpu/drm/i915/display/intel_backlight.c -+++ b/drivers/gpu/drm/i915/display/intel_backlight.c -@@ -40,8 +40,9 @@ static u32 scale(u32 source_val, - { - u64 target_val; - -- WARN_ON(source_min > source_max); -- WARN_ON(target_min > target_max); -+ if (WARN_ON(source_min >= source_max) || -+ WARN_ON(target_min > target_max)) -+ return target_min; - - /* defensive */ - source_val = clamp(source_val, source_min, source_max); -diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c -index 820c2c3641d388..1311f10fad660c 100644 ---- a/drivers/gpu/drm/radeon/evergreen_cs.c -+++ b/drivers/gpu/drm/radeon/evergreen_cs.c -@@ -33,8 +33,10 @@ - #include "evergreen_reg_safe.h" - #include "cayman_reg_safe.h" - -+#ifndef MIN - #define MAX(a,b) (((a)>(b))?(a):(b)) - #define MIN(a,b) (((a)<(b))?(a):(b)) -+#endif - - #define REG_SAFE_BM_SIZE ARRAY_SIZE(evergreen_reg_safe_bm) - -diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c -index 896f73aa4d2c82..a8d440f6e804fb 100644 ---- a/drivers/hid/hid-asus.c -+++ b/drivers/hid/hid-asus.c -@@ -869,7 +869,10 @@ static int asus_input_mapping(struct hid_device *hdev, - case 0xc4: asus_map_key_clear(KEY_KBDILLUMUP); break; - case 0xc5: asus_map_key_clear(KEY_KBDILLUMDOWN); break; - case 0xc7: asus_map_key_clear(KEY_KBDILLUMTOGGLE); break; -+ case 0x4e: asus_map_key_clear(KEY_FN_ESC); break; -+ case 0x7e: asus_map_key_clear(KEY_EMOJI_PICKER); break; - -+ case 0x8b: asus_map_key_clear(KEY_PROG1); break; /* ProArt Creator Hub key */ - case 0x6b: asus_map_key_clear(KEY_F21); break; /* ASUS touchpad toggle */ - case 0x38: asus_map_key_clear(KEY_PROG1); break; /* ROG key */ - case 0xba: asus_map_key_clear(KEY_PROG2); break; /* Fn+C ASUS Splendid */ -diff --git a/drivers/hwmon/adt7475.c b/drivers/hwmon/adt7475.c -index 14b2547adae8d3..ce0ab4e4e41a73 100644 ---- a/drivers/hwmon/adt7475.c -+++ b/drivers/hwmon/adt7475.c -@@ -22,23 +22,23 @@ - #include - - /* Indexes for the sysfs hooks */ -- --#define INPUT 0 --#define MIN 1 --#define MAX 2 --#define CONTROL 3 --#define OFFSET 3 --#define AUTOMIN 4 --#define THERM 5 --#define HYSTERSIS 6 -- -+enum adt_sysfs_id { -+ INPUT = 0, -+ MIN = 1, -+ MAX = 2, -+ CONTROL = 3, -+ OFFSET = 3, // Dup -+ AUTOMIN = 4, -+ THERM = 5, -+ HYSTERSIS = 6, - /* - * These are unique identifiers for the sysfs functions - unlike the - * numbers above, these are not also indexes into an array - */ -+ ALARM = 9, -+ FAULT = 10, -+}; - --#define ALARM 9 --#define FAULT 10 - - /* 7475 Common Registers */ - -diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c -index f3245a68563095..1ebcf5673a06b2 100644 ---- a/drivers/i2c/busses/i2c-designware-platdrv.c -+++ b/drivers/i2c/busses/i2c-designware-platdrv.c -@@ -168,7 +168,7 @@ static inline int dw_i2c_of_configure(struct platform_device *pdev) - } - #endif - --static int txgbe_i2c_request_regs(struct dw_i2c_dev *dev) -+static int dw_i2c_get_parent_regmap(struct dw_i2c_dev *dev) - { - dev->map = dev_get_regmap(dev->dev->parent, NULL); - if (!dev->map) -@@ -190,12 +190,15 @@ static int dw_i2c_plat_request_regs(struct dw_i2c_dev *dev) - struct platform_device *pdev = to_platform_device(dev->dev); - int ret; - -+ if (device_is_compatible(dev->dev, "intel,xe-i2c")) -+ return dw_i2c_get_parent_regmap(dev); -+ - switch (dev->flags & MODEL_MASK) { - case MODEL_BAIKAL_BT1: - ret = bt1_i2c_request_regs(dev); - break; - case MODEL_WANGXUN_SP: -- ret = txgbe_i2c_request_regs(dev); -+ ret = dw_i2c_get_parent_regmap(dev); - break; - default: - dev->base = devm_platform_ioremap_resource(pdev, 0); -diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c -index 3f1fa45d936821..388c95562a927a 100644 ---- a/drivers/infiniband/hw/mlx5/devx.c -+++ b/drivers/infiniband/hw/mlx5/devx.c -@@ -191,6 +191,7 @@ static u16 get_legacy_obj_type(u16 opcode) - { - switch (opcode) { - case MLX5_CMD_OP_CREATE_RQ: -+ case MLX5_CMD_OP_CREATE_RMP: - return MLX5_EVENT_QUEUE_TYPE_RQ; - case MLX5_CMD_OP_CREATE_QP: - return MLX5_EVENT_QUEUE_TYPE_QP; -diff --git a/drivers/input/touchscreen/cyttsp4_core.c b/drivers/input/touchscreen/cyttsp4_core.c -index 7cb26929dc7328..9dc25eb2be445f 100644 ---- a/drivers/input/touchscreen/cyttsp4_core.c -+++ b/drivers/input/touchscreen/cyttsp4_core.c -@@ -871,7 +871,7 @@ static void cyttsp4_get_mt_touches(struct cyttsp4_mt_data *md, int num_cur_tch) - struct cyttsp4_touch tch; - int sig; - int i, j, t = 0; -- int ids[max(CY_TMA1036_MAX_TCH, CY_TMA4XX_MAX_TCH)]; -+ int ids[MAX(CY_TMA1036_MAX_TCH, CY_TMA4XX_MAX_TCH)]; - - memset(ids, 0, si->si_ofs.tch_abs[CY_TCH_T].max * sizeof(int)); - for (i = 0; i < num_cur_tch; i++) { -diff --git a/drivers/irqchip/irq-sun6i-r.c b/drivers/irqchip/irq-sun6i-r.c -index a01e440494154e..99958d470d6268 100644 ---- a/drivers/irqchip/irq-sun6i-r.c -+++ b/drivers/irqchip/irq-sun6i-r.c -@@ -270,7 +270,7 @@ static const struct irq_domain_ops sun6i_r_intc_domain_ops = { - - static int sun6i_r_intc_suspend(void) - { -- u32 buf[BITS_TO_U32(max(SUN6I_NR_TOP_LEVEL_IRQS, SUN6I_NR_MUX_BITS))]; -+ u32 buf[BITS_TO_U32(MAX(SUN6I_NR_TOP_LEVEL_IRQS, SUN6I_NR_MUX_BITS))]; - int i; - - /* Wake IRQs are enabled during system sleep and shutdown. */ -diff --git a/drivers/media/dvb-frontends/stv0367_priv.h b/drivers/media/dvb-frontends/stv0367_priv.h -index 617f605947b2c4..7f056d1cce8228 100644 ---- a/drivers/media/dvb-frontends/stv0367_priv.h -+++ b/drivers/media/dvb-frontends/stv0367_priv.h -@@ -25,8 +25,11 @@ - #endif - - /* MACRO definitions */ -+#ifndef MIN - #define MAX(X, Y) ((X) >= (Y) ? (X) : (Y)) - #define MIN(X, Y) ((X) <= (Y) ? (X) : (Y)) -+#endif -+ - #define INRANGE(X, Y, Z) \ - ((((X) <= (Y)) && ((Y) <= (Z))) || \ - (((Z) <= (Y)) && ((Y) <= (X))) ? 1 : 0) -diff --git a/drivers/mmc/host/sdhci-cadence.c b/drivers/mmc/host/sdhci-cadence.c -index be1505e8c536e8..7759531ccca70f 100644 ---- a/drivers/mmc/host/sdhci-cadence.c -+++ b/drivers/mmc/host/sdhci-cadence.c -@@ -433,6 +433,13 @@ static const struct sdhci_cdns_drv_data sdhci_elba_drv_data = { - }, - }; - -+static const struct sdhci_cdns_drv_data sdhci_eyeq_drv_data = { -+ .pltfm_data = { -+ .ops = &sdhci_cdns_ops, -+ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, -+ }, -+}; -+ - static const struct sdhci_cdns_drv_data sdhci_cdns_drv_data = { - .pltfm_data = { - .ops = &sdhci_cdns_ops, -@@ -595,6 +602,10 @@ static const struct of_device_id sdhci_cdns_match[] = { - .compatible = "amd,pensando-elba-sd4hc", - .data = &sdhci_elba_drv_data, - }, -+ { -+ .compatible = "mobileye,eyeq-sd4hc", -+ .data = &sdhci_eyeq_drv_data, -+ }, - { .compatible = "cdns,sd4hc" }, - { /* sentinel */ } - }; -diff --git a/drivers/net/can/rcar/rcar_can.c b/drivers/net/can/rcar/rcar_can.c -index f5aa5dbacaf21f..1f26aba620b988 100644 ---- a/drivers/net/can/rcar/rcar_can.c -+++ b/drivers/net/can/rcar/rcar_can.c -@@ -861,7 +861,6 @@ static int __maybe_unused rcar_can_resume(struct device *dev) - { - struct net_device *ndev = dev_get_drvdata(dev); - struct rcar_can_priv *priv = netdev_priv(ndev); -- u16 ctlr; - int err; - - if (!netif_running(ndev)) -@@ -873,12 +872,7 @@ static int __maybe_unused rcar_can_resume(struct device *dev) - return err; - } - -- ctlr = readw(&priv->regs->ctlr); -- ctlr &= ~RCAR_CAN_CTLR_SLPM; -- writew(ctlr, &priv->regs->ctlr); -- ctlr &= ~RCAR_CAN_CTLR_CANM; -- writew(ctlr, &priv->regs->ctlr); -- priv->can.state = CAN_STATE_ERROR_ACTIVE; -+ rcar_can_start(ndev); - - netif_device_attach(ndev); - netif_start_queue(ndev); -diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c -index b757555ed4c4f6..57ea7dfe8a596f 100644 ---- a/drivers/net/can/spi/hi311x.c -+++ b/drivers/net/can/spi/hi311x.c -@@ -813,6 +813,7 @@ static const struct net_device_ops hi3110_netdev_ops = { - .ndo_open = hi3110_open, - .ndo_stop = hi3110_stop, - .ndo_start_xmit = hi3110_hard_start_xmit, -+ .ndo_change_mtu = can_change_mtu, - }; - - static const struct ethtool_ops hi3110_ethtool_ops = { -diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c -index 283fbf59e66d5e..5ab1f9c7288e59 100644 ---- a/drivers/net/can/sun4i_can.c -+++ b/drivers/net/can/sun4i_can.c -@@ -768,6 +768,7 @@ static const struct net_device_ops sun4ican_netdev_ops = { - .ndo_open = sun4ican_open, - .ndo_stop = sun4ican_close, - .ndo_start_xmit = sun4ican_start_xmit, -+ .ndo_change_mtu = can_change_mtu, - }; - - static const struct ethtool_ops sun4ican_ethtool_ops = { -diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c -index 5e3a72b7c46919..bb49a2c0a9a5c1 100644 ---- a/drivers/net/can/usb/etas_es58x/es58x_core.c -+++ b/drivers/net/can/usb/etas_es58x/es58x_core.c -@@ -7,7 +7,7 @@ - * - * Copyright (c) 2019 Robert Bosch Engineering and Business Solutions. All rights reserved. - * Copyright (c) 2020 ETAS K.K.. All rights reserved. -- * Copyright (c) 2020-2022 Vincent Mailhol -+ * Copyright (c) 2020-2025 Vincent Mailhol - */ - - #include -@@ -1977,6 +1977,7 @@ static const struct net_device_ops es58x_netdev_ops = { - .ndo_stop = es58x_stop, - .ndo_start_xmit = es58x_start_xmit, - .ndo_eth_ioctl = can_eth_ioctl_hwts, -+ .ndo_change_mtu = can_change_mtu, - }; - - static const struct ethtool_ops es58x_ethtool_ops = { -diff --git a/drivers/net/can/usb/etas_es58x/es58x_devlink.c b/drivers/net/can/usb/etas_es58x/es58x_devlink.c -index e763a9904bedd0..0d155eb1b9e999 100644 ---- a/drivers/net/can/usb/etas_es58x/es58x_devlink.c -+++ b/drivers/net/can/usb/etas_es58x/es58x_devlink.c -@@ -215,7 +215,7 @@ static int es58x_devlink_info_get(struct devlink *devlink, - struct es58x_sw_version *fw_ver = &es58x_dev->firmware_version; - struct es58x_sw_version *bl_ver = &es58x_dev->bootloader_version; - struct es58x_hw_revision *hw_rev = &es58x_dev->hardware_revision; -- char buf[max(sizeof("xx.xx.xx"), sizeof("axxx/xxx"))]; -+ char buf[MAX(sizeof("xx.xx.xx"), sizeof("axxx/xxx"))]; - int ret = 0; - - if (es58x_sw_version_is_valid(fw_ver)) { -diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c -index 47619e9cb0055b..ecc489afb84163 100644 ---- a/drivers/net/can/usb/mcba_usb.c -+++ b/drivers/net/can/usb/mcba_usb.c -@@ -761,6 +761,7 @@ static const struct net_device_ops mcba_netdev_ops = { - .ndo_open = mcba_usb_open, - .ndo_stop = mcba_usb_close, - .ndo_start_xmit = mcba_usb_start_xmit, -+ .ndo_change_mtu = can_change_mtu, - }; - - static const struct ethtool_ops mcba_ethtool_ops = { -diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c -index 24ad9f593a7736..9d162d1004c267 100644 ---- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c -+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c -@@ -111,7 +111,7 @@ void peak_usb_update_ts_now(struct peak_time_ref *time_ref, u32 ts_now) - u32 delta_ts = time_ref->ts_dev_2 - time_ref->ts_dev_1; - - if (time_ref->ts_dev_2 < time_ref->ts_dev_1) -- delta_ts &= (1 << time_ref->adapter->ts_used_bits) - 1; -+ delta_ts &= (1ULL << time_ref->adapter->ts_used_bits) - 1; - - time_ref->ts_total += delta_ts; - } -diff --git a/drivers/net/dsa/lantiq_gswip.c b/drivers/net/dsa/lantiq_gswip.c -index 3c76a1a14aee3c..c1a9ab92597685 100644 ---- a/drivers/net/dsa/lantiq_gswip.c -+++ b/drivers/net/dsa/lantiq_gswip.c -@@ -682,30 +682,24 @@ static int gswip_add_single_port_br(struct gswip_priv *priv, int port, bool add) - return 0; - } - --static int gswip_port_enable(struct dsa_switch *ds, int port, -- struct phy_device *phydev) -+static int gswip_port_setup(struct dsa_switch *ds, int port) - { - struct gswip_priv *priv = ds->priv; - int err; - -- if (!dsa_is_user_port(ds, port)) -- return 0; -- - if (!dsa_is_cpu_port(ds, port)) { - err = gswip_add_single_port_br(priv, port, true); - if (err) - return err; - } - -- /* RMON Counter Enable for port */ -- gswip_switch_w(priv, GSWIP_BM_PCFG_CNTEN, GSWIP_BM_PCFGp(port)); -+ return 0; -+} - -- /* enable port fetch/store dma & VLAN Modification */ -- gswip_switch_mask(priv, 0, GSWIP_FDMA_PCTRL_EN | -- GSWIP_FDMA_PCTRL_VLANMOD_BOTH, -- GSWIP_FDMA_PCTRLp(port)); -- gswip_switch_mask(priv, 0, GSWIP_SDMA_PCTRL_EN, -- GSWIP_SDMA_PCTRLp(port)); -+static int gswip_port_enable(struct dsa_switch *ds, int port, -+ struct phy_device *phydev) -+{ -+ struct gswip_priv *priv = ds->priv; - - if (!dsa_is_cpu_port(ds, port)) { - u32 mdio_phy = 0; -@@ -717,6 +711,16 @@ static int gswip_port_enable(struct dsa_switch *ds, int port, - GSWIP_MDIO_PHYp(port)); - } - -+ /* RMON Counter Enable for port */ -+ gswip_switch_w(priv, GSWIP_BM_PCFG_CNTEN, GSWIP_BM_PCFGp(port)); -+ -+ /* enable port fetch/store dma & VLAN Modification */ -+ gswip_switch_mask(priv, 0, GSWIP_FDMA_PCTRL_EN | -+ GSWIP_FDMA_PCTRL_VLANMOD_BOTH, -+ GSWIP_FDMA_PCTRLp(port)); -+ gswip_switch_mask(priv, 0, GSWIP_SDMA_PCTRL_EN, -+ GSWIP_SDMA_PCTRLp(port)); -+ - return 0; - } - -@@ -724,9 +728,6 @@ static void gswip_port_disable(struct dsa_switch *ds, int port) - { - struct gswip_priv *priv = ds->priv; - -- if (!dsa_is_user_port(ds, port)) -- return; -- - gswip_switch_mask(priv, GSWIP_FDMA_PCTRL_EN, 0, - GSWIP_FDMA_PCTRLp(port)); - gswip_switch_mask(priv, GSWIP_SDMA_PCTRL_EN, 0, -@@ -1365,8 +1366,9 @@ static int gswip_port_fdb(struct dsa_switch *ds, int port, - int i; - int err; - -+ /* Operation not supported on the CPU port, don't throw errors */ - if (!bridge) -- return -EINVAL; -+ return 0; - - for (i = max_ports; i < ARRAY_SIZE(priv->vlans); i++) { - if (priv->vlans[i].bridge == bridge) { -@@ -1821,6 +1823,7 @@ static int gswip_get_sset_count(struct dsa_switch *ds, int port, int sset) - static const struct dsa_switch_ops gswip_xrx200_switch_ops = { - .get_tag_protocol = gswip_get_tag_protocol, - .setup = gswip_setup, -+ .port_setup = gswip_port_setup, - .port_enable = gswip_port_enable, - .port_disable = gswip_port_disable, - .port_bridge_join = gswip_port_bridge_join, -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c -index 273c9ba48f09a1..b896f8d20ff336 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c -@@ -244,7 +244,7 @@ bnxt_tc_parse_pedit(struct bnxt *bp, struct bnxt_tc_actions *actions, - offset < offset_of_ip6_daddr + 16) { - actions->nat.src_xlate = false; - idx = (offset - offset_of_ip6_daddr) / 4; -- actions->nat.l3.ipv6.saddr.s6_addr32[idx] = htonl(val); -+ actions->nat.l3.ipv6.daddr.s6_addr32[idx] = htonl(val); - } else { - netdev_err(bp->dev, - "%s: IPv6_hdr: Invalid pedit field\n", -diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h -index 9fb7c5fe05d15f..f095069dc32a9e 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e.h -+++ b/drivers/net/ethernet/intel/i40e/i40e.h -@@ -23,6 +23,7 @@ - #define I40E_MAX_VEB 16 - - #define I40E_MAX_NUM_DESCRIPTORS 4096 -+#define I40E_MAX_NUM_DESCRIPTORS_XL710 8160 - #define I40E_MAX_CSR_SPACE (4 * 1024 * 1024 - 64 * 1024) - #define I40E_DEFAULT_NUM_DESCRIPTORS 512 - #define I40E_REQ_DESCRIPTOR_MULTIPLE 32 -@@ -1228,7 +1229,8 @@ struct i40e_mac_filter *i40e_add_mac_filter(struct i40e_vsi *vsi, - const u8 *macaddr); - int i40e_del_mac_filter(struct i40e_vsi *vsi, const u8 *macaddr); - bool i40e_is_vsi_in_vlan(struct i40e_vsi *vsi); --int i40e_count_filters(struct i40e_vsi *vsi); -+int i40e_count_all_filters(struct i40e_vsi *vsi); -+int i40e_count_active_filters(struct i40e_vsi *vsi); - struct i40e_mac_filter *i40e_find_mac(struct i40e_vsi *vsi, const u8 *macaddr); - void i40e_vlan_stripping_enable(struct i40e_vsi *vsi); - static inline bool i40e_is_sw_dcb(struct i40e_pf *pf) -diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c -index a89f7ca510fdb8..077d5daaedccaa 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c -@@ -2015,6 +2015,18 @@ static void i40e_get_drvinfo(struct net_device *netdev, - drvinfo->n_priv_flags += I40E_GL_PRIV_FLAGS_STR_LEN; - } - -+static u32 i40e_get_max_num_descriptors(struct i40e_pf *pf) -+{ -+ struct i40e_hw *hw = &pf->hw; -+ -+ switch (hw->mac.type) { -+ case I40E_MAC_XL710: -+ return I40E_MAX_NUM_DESCRIPTORS_XL710; -+ default: -+ return I40E_MAX_NUM_DESCRIPTORS; -+ } -+} -+ - static void i40e_get_ringparam(struct net_device *netdev, - struct ethtool_ringparam *ring, - struct kernel_ethtool_ringparam *kernel_ring, -@@ -2024,8 +2036,8 @@ static void i40e_get_ringparam(struct net_device *netdev, - struct i40e_pf *pf = np->vsi->back; - struct i40e_vsi *vsi = pf->vsi[pf->lan_vsi]; - -- ring->rx_max_pending = I40E_MAX_NUM_DESCRIPTORS; -- ring->tx_max_pending = I40E_MAX_NUM_DESCRIPTORS; -+ ring->rx_max_pending = i40e_get_max_num_descriptors(pf); -+ ring->tx_max_pending = i40e_get_max_num_descriptors(pf); - ring->rx_mini_max_pending = 0; - ring->rx_jumbo_max_pending = 0; - ring->rx_pending = vsi->rx_rings[0]->count; -@@ -2050,12 +2062,12 @@ static int i40e_set_ringparam(struct net_device *netdev, - struct kernel_ethtool_ringparam *kernel_ring, - struct netlink_ext_ack *extack) - { -+ u32 new_rx_count, new_tx_count, max_num_descriptors; - struct i40e_ring *tx_rings = NULL, *rx_rings = NULL; - struct i40e_netdev_priv *np = netdev_priv(netdev); - struct i40e_hw *hw = &np->vsi->back->hw; - struct i40e_vsi *vsi = np->vsi; - struct i40e_pf *pf = vsi->back; -- u32 new_rx_count, new_tx_count; - u16 tx_alloc_queue_pairs; - int timeout = 50; - int i, err = 0; -@@ -2063,14 +2075,15 @@ static int i40e_set_ringparam(struct net_device *netdev, - if ((ring->rx_mini_pending) || (ring->rx_jumbo_pending)) - return -EINVAL; - -- if (ring->tx_pending > I40E_MAX_NUM_DESCRIPTORS || -+ max_num_descriptors = i40e_get_max_num_descriptors(pf); -+ if (ring->tx_pending > max_num_descriptors || - ring->tx_pending < I40E_MIN_NUM_DESCRIPTORS || -- ring->rx_pending > I40E_MAX_NUM_DESCRIPTORS || -+ ring->rx_pending > max_num_descriptors || - ring->rx_pending < I40E_MIN_NUM_DESCRIPTORS) { - netdev_info(netdev, - "Descriptors requested (Tx: %d / Rx: %d) out of range [%d-%d]\n", - ring->tx_pending, ring->rx_pending, -- I40E_MIN_NUM_DESCRIPTORS, I40E_MAX_NUM_DESCRIPTORS); -+ I40E_MIN_NUM_DESCRIPTORS, max_num_descriptors); - return -EINVAL; - } - -diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c -index 72869336e3a9a9..affdbd3ee76c54 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_main.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c -@@ -1247,12 +1247,30 @@ void i40e_update_stats(struct i40e_vsi *vsi) - } - - /** -- * i40e_count_filters - counts VSI mac filters -+ * i40e_count_all_filters - counts VSI MAC filters - * @vsi: the VSI to be searched - * -- * Returns count of mac filters -- **/ --int i40e_count_filters(struct i40e_vsi *vsi) -+ * Return: count of MAC filters in any state. -+ */ -+int i40e_count_all_filters(struct i40e_vsi *vsi) -+{ -+ struct i40e_mac_filter *f; -+ struct hlist_node *h; -+ int bkt, cnt = 0; -+ -+ hash_for_each_safe(vsi->mac_filter_hash, bkt, h, f, hlist) -+ cnt++; -+ -+ return cnt; -+} -+ -+/** -+ * i40e_count_active_filters - counts VSI MAC filters -+ * @vsi: the VSI to be searched -+ * -+ * Return: count of active MAC filters. -+ */ -+int i40e_count_active_filters(struct i40e_vsi *vsi) - { - struct i40e_mac_filter *f; - struct hlist_node *h; -diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -index 6d7a4f2c3a49b7..7f5538e2c9de5c 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -@@ -448,7 +448,7 @@ static void i40e_config_irq_link_list(struct i40e_vf *vf, u16 vsi_id, - (qtype << I40E_QINT_RQCTL_NEXTQ_TYPE_SHIFT) | - (pf_queue_id << I40E_QINT_RQCTL_NEXTQ_INDX_SHIFT) | - BIT(I40E_QINT_RQCTL_CAUSE_ENA_SHIFT) | -- (itr_idx << I40E_QINT_RQCTL_ITR_INDX_SHIFT); -+ FIELD_PREP(I40E_QINT_RQCTL_ITR_INDX_MASK, itr_idx); - wr32(hw, reg_idx, reg); - } - -@@ -657,6 +657,13 @@ static int i40e_config_vsi_tx_queue(struct i40e_vf *vf, u16 vsi_id, - - /* only set the required fields */ - tx_ctx.base = info->dma_ring_addr / 128; -+ -+ /* ring_len has to be multiple of 8 */ -+ if (!IS_ALIGNED(info->ring_len, 8) || -+ info->ring_len > I40E_MAX_NUM_DESCRIPTORS_XL710) { -+ ret = -EINVAL; -+ goto error_context; -+ } - tx_ctx.qlen = info->ring_len; - tx_ctx.rdylist = le16_to_cpu(vsi->info.qs_handle[0]); - tx_ctx.rdylist_act = 0; -@@ -722,6 +729,13 @@ static int i40e_config_vsi_rx_queue(struct i40e_vf *vf, u16 vsi_id, - - /* only set the required fields */ - rx_ctx.base = info->dma_ring_addr / 128; -+ -+ /* ring_len has to be multiple of 32 */ -+ if (!IS_ALIGNED(info->ring_len, 32) || -+ info->ring_len > I40E_MAX_NUM_DESCRIPTORS_XL710) { -+ ret = -EINVAL; -+ goto error_param; -+ } - rx_ctx.qlen = info->ring_len; - - if (info->splithdr_enabled) { -@@ -1459,6 +1473,7 @@ static void i40e_trigger_vf_reset(struct i40e_vf *vf, bool flr) - * functions that may still be running at this point. - */ - clear_bit(I40E_VF_STATE_INIT, &vf->vf_states); -+ clear_bit(I40E_VF_STATE_RESOURCES_LOADED, &vf->vf_states); - - /* In the case of a VFLR, the HW has already reset the VF and we - * just need to clean up, so don't hit the VFRTRIG register. -@@ -2125,7 +2140,10 @@ static int i40e_vc_get_vf_resources_msg(struct i40e_vf *vf, u8 *msg) - size_t len = 0; - int ret; - -- if (!i40e_sync_vf_state(vf, I40E_VF_STATE_INIT)) { -+ i40e_sync_vf_state(vf, I40E_VF_STATE_INIT); -+ -+ if (!test_bit(I40E_VF_STATE_INIT, &vf->vf_states) || -+ test_bit(I40E_VF_STATE_RESOURCES_LOADED, &vf->vf_states)) { - aq_ret = -EINVAL; - goto err; - } -@@ -2228,6 +2246,7 @@ static int i40e_vc_get_vf_resources_msg(struct i40e_vf *vf, u8 *msg) - vf->default_lan_addr.addr); - } - set_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states); -+ set_bit(I40E_VF_STATE_RESOURCES_LOADED, &vf->vf_states); - - err: - /* send the response back to the VF */ -@@ -2390,7 +2409,7 @@ static int i40e_vc_config_queues_msg(struct i40e_vf *vf, u8 *msg) - } - - if (vf->adq_enabled) { -- if (idx >= ARRAY_SIZE(vf->ch)) { -+ if (idx >= vf->num_tc) { - aq_ret = -ENODEV; - goto error_param; - } -@@ -2411,7 +2430,7 @@ static int i40e_vc_config_queues_msg(struct i40e_vf *vf, u8 *msg) - * to its appropriate VSIs based on TC mapping - */ - if (vf->adq_enabled) { -- if (idx >= ARRAY_SIZE(vf->ch)) { -+ if (idx >= vf->num_tc) { - aq_ret = -ENODEV; - goto error_param; - } -@@ -2461,8 +2480,10 @@ static int i40e_validate_queue_map(struct i40e_vf *vf, u16 vsi_id, - u16 vsi_queue_id, queue_id; - - for_each_set_bit(vsi_queue_id, &queuemap, I40E_MAX_VSI_QP) { -- if (vf->adq_enabled) { -- vsi_id = vf->ch[vsi_queue_id / I40E_MAX_VF_VSI].vsi_id; -+ u16 idx = vsi_queue_id / I40E_MAX_VF_VSI; -+ -+ if (vf->adq_enabled && idx < vf->num_tc) { -+ vsi_id = vf->ch[idx].vsi_id; - queue_id = (vsi_queue_id % I40E_DEFAULT_QUEUES_PER_VF); - } else { - queue_id = vsi_queue_id; -@@ -2850,24 +2871,6 @@ static int i40e_vc_get_stats_msg(struct i40e_vf *vf, u8 *msg) - (u8 *)&stats, sizeof(stats)); - } - --/** -- * i40e_can_vf_change_mac -- * @vf: pointer to the VF info -- * -- * Return true if the VF is allowed to change its MAC filters, false otherwise -- */ --static bool i40e_can_vf_change_mac(struct i40e_vf *vf) --{ -- /* If the VF MAC address has been set administratively (via the -- * ndo_set_vf_mac command), then deny permission to the VF to -- * add/delete unicast MAC addresses, unless the VF is trusted -- */ -- if (vf->pf_set_mac && !vf->trusted) -- return false; -- -- return true; --} -- - #define I40E_MAX_MACVLAN_PER_HW 3072 - #define I40E_MAX_MACVLAN_PER_PF(num_ports) (I40E_MAX_MACVLAN_PER_HW / \ - (num_ports)) -@@ -2906,8 +2909,10 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf, - struct i40e_pf *pf = vf->pf; - struct i40e_vsi *vsi = pf->vsi[vf->lan_vsi_idx]; - struct i40e_hw *hw = &pf->hw; -- int mac2add_cnt = 0; -- int i; -+ int i, mac_add_max, mac_add_cnt = 0; -+ bool vf_trusted; -+ -+ vf_trusted = test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps); - - for (i = 0; i < al->num_elements; i++) { - struct i40e_mac_filter *f; -@@ -2927,9 +2932,8 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf, - * The VF may request to set the MAC address filter already - * assigned to it so do not return an error in that case. - */ -- if (!i40e_can_vf_change_mac(vf) && -- !is_multicast_ether_addr(addr) && -- !ether_addr_equal(addr, vf->default_lan_addr.addr)) { -+ if (!vf_trusted && !is_multicast_ether_addr(addr) && -+ vf->pf_set_mac && !ether_addr_equal(addr, vf->default_lan_addr.addr)) { - dev_err(&pf->pdev->dev, - "VF attempting to override administratively set MAC address, bring down and up the VF interface to resume normal operation\n"); - return -EPERM; -@@ -2938,29 +2942,33 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf, - /*count filters that really will be added*/ - f = i40e_find_mac(vsi, addr); - if (!f) -- ++mac2add_cnt; -+ ++mac_add_cnt; - } - - /* If this VF is not privileged, then we can't add more than a limited -- * number of addresses. Check to make sure that the additions do not -- * push us over the limit. -- */ -- if (!test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps)) { -- if ((i40e_count_filters(vsi) + mac2add_cnt) > -- I40E_VC_MAX_MAC_ADDR_PER_VF) { -- dev_err(&pf->pdev->dev, -- "Cannot add more MAC addresses, VF is not trusted, switch the VF to trusted to add more functionality\n"); -- return -EPERM; -- } -- /* If this VF is trusted, it can use more resources than untrusted. -+ * number of addresses. -+ * -+ * If this VF is trusted, it can use more resources than untrusted. - * However to ensure that every trusted VF has appropriate number of - * resources, divide whole pool of resources per port and then across - * all VFs. - */ -- } else { -- if ((i40e_count_filters(vsi) + mac2add_cnt) > -- I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs, -- hw->num_ports)) { -+ if (!vf_trusted) -+ mac_add_max = I40E_VC_MAX_MAC_ADDR_PER_VF; -+ else -+ mac_add_max = I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs, hw->num_ports); -+ -+ /* VF can replace all its filters in one step, in this case mac_add_max -+ * will be added as active and another mac_add_max will be in -+ * a to-be-removed state. Account for that. -+ */ -+ if ((i40e_count_active_filters(vsi) + mac_add_cnt) > mac_add_max || -+ (i40e_count_all_filters(vsi) + mac_add_cnt) > 2 * mac_add_max) { -+ if (!vf_trusted) { -+ dev_err(&pf->pdev->dev, -+ "Cannot add more MAC addresses, VF is not trusted, switch the VF to trusted to add more functionality\n"); -+ return -EPERM; -+ } else { - dev_err(&pf->pdev->dev, - "Cannot add more MAC addresses, trusted VF exhausted it's resources\n"); - return -EPERM; -@@ -3593,7 +3601,7 @@ static int i40e_validate_cloud_filter(struct i40e_vf *vf, - - /* action_meta is TC number here to which the filter is applied */ - if (!tc_filter->action_meta || -- tc_filter->action_meta > vf->num_tc) { -+ tc_filter->action_meta >= vf->num_tc) { - dev_info(&pf->pdev->dev, "VF %d: Invalid TC number %u\n", - vf->vf_id, tc_filter->action_meta); - goto err; -@@ -3891,6 +3899,8 @@ static int i40e_vc_del_cloud_filter(struct i40e_vf *vf, u8 *msg) - aq_ret); - } - -+#define I40E_MAX_VF_CLOUD_FILTER 0xFF00 -+ - /** - * i40e_vc_add_cloud_filter - * @vf: pointer to the VF info -@@ -3930,6 +3940,14 @@ static int i40e_vc_add_cloud_filter(struct i40e_vf *vf, u8 *msg) - goto err_out; - } - -+ if (vf->num_cloud_filters >= I40E_MAX_VF_CLOUD_FILTER) { -+ dev_warn(&pf->pdev->dev, -+ "VF %d: Max number of filters reached, can't apply cloud filter\n", -+ vf->vf_id); -+ aq_ret = -ENOSPC; -+ goto err_out; -+ } -+ - cfilter = kzalloc(sizeof(*cfilter), GFP_KERNEL); - if (!cfilter) { - aq_ret = -ENOMEM; -diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h -index 66f95e2f3146a8..e0e797fea138ad 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h -+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h -@@ -41,7 +41,8 @@ enum i40e_vf_states { - I40E_VF_STATE_MC_PROMISC, - I40E_VF_STATE_UC_PROMISC, - I40E_VF_STATE_PRE_ENABLE, -- I40E_VF_STATE_RESETTING -+ I40E_VF_STATE_RESETTING, -+ I40E_VF_STATE_RESOURCES_LOADED, - }; - - /* VF capabilities */ -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c -index 6302990e9a5ff8..729d1833a829a5 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c -@@ -21,8 +21,7 @@ - #include "rvu.h" - #include "lmac_common.h" - --#define DRV_NAME "Marvell-CGX/RPM" --#define DRV_STRING "Marvell CGX/RPM Driver" -+#define DRV_NAME "Marvell-CGX-RPM" - - #define CGX_RX_STAT_GLOBAL_INDEX 9 - -diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c -index 46bdbee9d38adf..635cfb9a3e2c5f 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c -+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c -@@ -1116,7 +1116,6 @@ static int otx2_tc_add_flow(struct otx2_nic *nic, - - free_leaf: - otx2_tc_del_from_flow_list(flow_cfg, new_node); -- kfree_rcu(new_node, rcu); - if (new_node->is_act_police) { - mutex_lock(&nic->mbox.lock); - -@@ -1136,6 +1135,7 @@ static int otx2_tc_add_flow(struct otx2_nic *nic, - - mutex_unlock(&nic->mbox.lock); - } -+ kfree_rcu(new_node, rcu); - - return rc; - } -diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c -index 2513be6d4e11d1..cfcf0f7d9d903e 100644 ---- a/drivers/net/fjes/fjes_main.c -+++ b/drivers/net/fjes/fjes_main.c -@@ -14,9 +14,7 @@ - #include "fjes.h" - #include "fjes_trace.h" - --#define MAJ 1 --#define MIN 2 --#define DRV_VERSION __stringify(MAJ) "." __stringify(MIN) -+#define DRV_VERSION "1.2" - #define DRV_NAME "fjes" - char fjes_driver_name[] = DRV_NAME; - char fjes_driver_version[] = DRV_VERSION; -diff --git a/drivers/net/wireless/virtual/virt_wifi.c b/drivers/net/wireless/virtual/virt_wifi.c -index fb4d95a027fefa..2977b30c6d593c 100644 ---- a/drivers/net/wireless/virtual/virt_wifi.c -+++ b/drivers/net/wireless/virtual/virt_wifi.c -@@ -277,7 +277,9 @@ static void virt_wifi_connect_complete(struct work_struct *work) - priv->is_connected = true; - - /* Schedules an event that acquires the rtnl lock. */ -- cfg80211_connect_result(priv->upperdev, requested_bss, NULL, 0, NULL, 0, -+ cfg80211_connect_result(priv->upperdev, -+ priv->is_connected ? fake_router_bssid : NULL, -+ NULL, 0, NULL, 0, - status, GFP_KERNEL); - netif_carrier_on(priv->upperdev); - } -diff --git a/drivers/nfc/pn544/i2c.c b/drivers/nfc/pn544/i2c.c -index 3f6d74832bac3b..be566ca7bae947 100644 ---- a/drivers/nfc/pn544/i2c.c -+++ b/drivers/nfc/pn544/i2c.c -@@ -126,8 +126,6 @@ struct pn544_i2c_fw_secure_blob { - #define PN544_FW_CMD_RESULT_COMMAND_REJECTED 0xE0 - #define PN544_FW_CMD_RESULT_CHUNK_ERROR 0xE6 - --#define MIN(X, Y) ((X) < (Y) ? (X) : (Y)) -- - #define PN544_FW_WRITE_BUFFER_MAX_LEN 0x9f7 - #define PN544_FW_I2C_MAX_PAYLOAD PN544_HCI_I2C_LLC_MAX_SIZE - #define PN544_FW_I2C_WRITE_FRAME_HEADER_LEN 8 -diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c -index 9569f11dec8c56..bd7323cf9a97f8 100644 ---- a/drivers/platform/x86/sony-laptop.c -+++ b/drivers/platform/x86/sony-laptop.c -@@ -757,7 +757,6 @@ static union acpi_object *__call_snc_method(acpi_handle handle, char *method, - return result; - } - --#define MIN(a, b) (a > b ? b : a) - static int sony_nc_buffer_call(acpi_handle handle, char *name, u64 *value, - void *buffer, size_t buflen) - { -diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c -index 6277162a028bb9..6eefa7e5f4cf6a 100644 ---- a/drivers/scsi/isci/init.c -+++ b/drivers/scsi/isci/init.c -@@ -65,11 +65,7 @@ - #include "task.h" - #include "probe_roms.h" - --#define MAJ 1 --#define MIN 2 --#define BUILD 0 --#define DRV_VERSION __stringify(MAJ) "." __stringify(MIN) "." \ -- __stringify(BUILD) -+#define DRV_VERSION "1.2.0" - - MODULE_VERSION(DRV_VERSION); - -diff --git a/drivers/staging/media/atomisp/pci/hive_isp_css_include/math_support.h b/drivers/staging/media/atomisp/pci/hive_isp_css_include/math_support.h -index a444ec14ff9d5b..1c17a87a85720c 100644 ---- a/drivers/staging/media/atomisp/pci/hive_isp_css_include/math_support.h -+++ b/drivers/staging/media/atomisp/pci/hive_isp_css_include/math_support.h -@@ -31,11 +31,6 @@ - /* A => B */ - #define IMPLIES(a, b) (!(a) || (b)) - --/* for preprocessor and array sizing use MIN and MAX -- otherwise use min and max */ --#define MAX(a, b) (((a) > (b)) ? (a) : (b)) --#define MIN(a, b) (((a) < (b)) ? (a) : (b)) -- - #define ROUND_DIV(a, b) (((b) != 0) ? ((a) + ((b) >> 1)) / (b) : 0) - #define CEIL_DIV(a, b) (((b) != 0) ? ((a) + (b) - 1) / (b) : 0) - #define CEIL_MUL(a, b) (CEIL_DIV(a, b) * (b)) -diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c -index 14864cfc242238..cb8f0652a4beec 100644 ---- a/drivers/ufs/core/ufs-mcq.c -+++ b/drivers/ufs/core/ufs-mcq.c -@@ -209,7 +209,7 @@ int ufshcd_mcq_memory_alloc(struct ufs_hba *hba) - hwq->sqe_base_addr = dmam_alloc_coherent(hba->dev, utrdl_size, - &hwq->sqe_dma_addr, - GFP_KERNEL); -- if (!hwq->sqe_dma_addr) { -+ if (!hwq->sqe_base_addr) { - dev_err(hba->dev, "SQE allocation failed\n"); - return -ENOMEM; - } -@@ -218,7 +218,7 @@ int ufshcd_mcq_memory_alloc(struct ufs_hba *hba) - hwq->cqe_base_addr = dmam_alloc_coherent(hba->dev, cqe_size, - &hwq->cqe_dma_addr, - GFP_KERNEL); -- if (!hwq->cqe_dma_addr) { -+ if (!hwq->cqe_base_addr) { - dev_err(hba->dev, "CQE allocation failed\n"); - return -ENOMEM; - } -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index bfd97cad8aa4d7..c0fd8ab3fe8fc2 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -734,7 +734,7 @@ void usb_detect_quirks(struct usb_device *udev) - udev->quirks ^= usb_detect_dynamic_quirks(udev); - - if (udev->quirks) -- dev_dbg(&udev->dev, "USB quirks for this device: %x\n", -+ dev_dbg(&udev->dev, "USB quirks for this device: 0x%x\n", - udev->quirks); - - #ifdef CONFIG_USB_DEFAULT_PERSIST -diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c -index 58eee27aa6cca9..b49f15a3442eab 100644 ---- a/drivers/video/fbdev/core/fbcon.c -+++ b/drivers/video/fbdev/core/fbcon.c -@@ -2483,7 +2483,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, - unsigned charcount = font->charcount; - int w = font->width; - int h = font->height; -- int size; -+ int size, alloc_size; - int i, csum; - u8 *new_data, *data = font->data; - int pitch = PITCH(font->width); -@@ -2510,9 +2510,16 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, - if (fbcon_invalid_charcount(info, charcount)) - return -EINVAL; - -- size = CALC_FONTSZ(h, pitch, charcount); -+ /* Check for integer overflow in font size calculation */ -+ if (check_mul_overflow(h, pitch, &size) || -+ check_mul_overflow(size, charcount, &size)) -+ return -EINVAL; -+ -+ /* Check for overflow in allocation size calculation */ -+ if (check_add_overflow(FONT_EXTRA_WORDS * sizeof(int), size, &alloc_size)) -+ return -EINVAL; - -- new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER); -+ new_data = kmalloc(alloc_size, GFP_USER); - - if (!new_data) - return -ENOMEM; -diff --git a/fs/afs/server.c b/fs/afs/server.c -index 87381c2ffe374c..f92ce4b7d73a19 100644 ---- a/fs/afs/server.c -+++ b/fs/afs/server.c -@@ -401,13 +401,14 @@ struct afs_server *afs_use_server(struct afs_server *server, enum afs_server_tra - void afs_put_server(struct afs_net *net, struct afs_server *server, - enum afs_server_trace reason) - { -- unsigned int a, debug_id = server->debug_id; -+ unsigned int a, debug_id; - bool zero; - int r; - - if (!server) - return; - -+ debug_id = server->debug_id; - a = atomic_read(&server->active); - zero = __refcount_dec_and_test(&server->ref, &r); - trace_afs_server(debug_id, r - 1, a, reason); -diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c -index d49ce7768f7f5b..0d93368c1691ae 100644 ---- a/fs/btrfs/tree-checker.c -+++ b/fs/btrfs/tree-checker.c -@@ -614,7 +614,7 @@ static int check_dir_item(struct extent_buffer *leaf, - */ - if (key->type == BTRFS_DIR_ITEM_KEY || - key->type == BTRFS_XATTR_ITEM_KEY) { -- char namebuf[max(BTRFS_NAME_LEN, XATTR_NAME_MAX)]; -+ char namebuf[MAX(BTRFS_NAME_LEN, XATTR_NAME_MAX)]; - - read_extent_buffer(leaf, namebuf, - (unsigned long)(di + 1), name_len); -diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c -index ab951fd475317c..914e850b9cbb77 100644 ---- a/fs/hugetlbfs/inode.c -+++ b/fs/hugetlbfs/inode.c -@@ -619,14 +619,16 @@ static bool remove_inode_single_folio(struct hstate *h, struct inode *inode, - - /* - * If folio is mapped, it was faulted in after being -- * unmapped in caller. Unmap (again) while holding -- * the fault mutex. The mutex will prevent faults -- * until we finish removing the folio. -+ * unmapped in caller or hugetlb_vmdelete_list() skips -+ * unmapping it due to fail to grab lock. Unmap (again) -+ * while holding the fault mutex. The mutex will prevent -+ * faults until we finish removing the folio. Hold folio -+ * lock to guarantee no concurrent migration. - */ -+ folio_lock(folio); - if (unlikely(folio_mapped(folio))) - hugetlb_unmap_file_folio(h, mapping, folio, index); - -- folio_lock(folio); - /* - * We must remove the folio from page cache before removing - * the region/ reserve map (hugetlb_unreserve_pages). In -diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c -index 0cc80f472432ad..79641d1ee86757 100644 ---- a/fs/smb/client/smb2inode.c -+++ b/fs/smb/client/smb2inode.c -@@ -641,7 +641,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, - - tmp_rc = rc; - for (i = 0; i < num_cmds; i++) { -- char *buf = rsp_iov[i + i].iov_base; -+ char *buf = rsp_iov[i + 1].iov_base; - - if (buf && resp_buftype[i + 1] != CIFS_NO_BUFFER) - rc = server->ops->map_error(buf, false); -diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c -index 3720304d679293..504e2a1cf33b84 100644 ---- a/fs/smb/server/transport_rdma.c -+++ b/fs/smb/server/transport_rdma.c -@@ -147,7 +147,7 @@ struct smb_direct_transport { - wait_queue_head_t wait_send_pending; - atomic_t send_pending; - -- struct delayed_work post_recv_credits_work; -+ struct work_struct post_recv_credits_work; - struct work_struct send_immediate_work; - struct work_struct disconnect_work; - -@@ -366,8 +366,8 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id) - - spin_lock_init(&t->lock_new_recv_credits); - -- INIT_DELAYED_WORK(&t->post_recv_credits_work, -- smb_direct_post_recv_credits); -+ INIT_WORK(&t->post_recv_credits_work, -+ smb_direct_post_recv_credits); - INIT_WORK(&t->send_immediate_work, smb_direct_send_immediate_work); - INIT_WORK(&t->disconnect_work, smb_direct_disconnect_rdma_work); - -@@ -399,7 +399,7 @@ static void free_transport(struct smb_direct_transport *t) - atomic_read(&t->send_pending) == 0); - - cancel_work_sync(&t->disconnect_work); -- cancel_delayed_work_sync(&t->post_recv_credits_work); -+ cancel_work_sync(&t->post_recv_credits_work); - cancel_work_sync(&t->send_immediate_work); - - if (t->qp) { -@@ -614,8 +614,7 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) - wake_up_interruptible(&t->wait_send_credits); - - if (is_receive_credit_post_required(receive_credits, avail_recvmsg_count)) -- mod_delayed_work(smb_direct_wq, -- &t->post_recv_credits_work, 0); -+ queue_work(smb_direct_wq, &t->post_recv_credits_work); - - if (data_length) { - enqueue_reassembly(t, recvmsg, (int)data_length); -@@ -772,8 +771,7 @@ static int smb_direct_read(struct ksmbd_transport *t, char *buf, - st->count_avail_recvmsg += queue_removed; - if (is_receive_credit_post_required(st->recv_credits, st->count_avail_recvmsg)) { - spin_unlock(&st->receive_credit_lock); -- mod_delayed_work(smb_direct_wq, -- &st->post_recv_credits_work, 0); -+ queue_work(smb_direct_wq, &st->post_recv_credits_work); - } else { - spin_unlock(&st->receive_credit_lock); - } -@@ -800,7 +798,7 @@ static int smb_direct_read(struct ksmbd_transport *t, char *buf, - static void smb_direct_post_recv_credits(struct work_struct *work) - { - struct smb_direct_transport *t = container_of(work, -- struct smb_direct_transport, post_recv_credits_work.work); -+ struct smb_direct_transport, post_recv_credits_work); - struct smb_direct_recvmsg *recvmsg; - int receive_credits, credits = 0; - int ret; -@@ -1681,7 +1679,7 @@ static int smb_direct_prepare_negotiation(struct smb_direct_transport *t) - goto out_err; - } - -- smb_direct_post_recv_credits(&t->post_recv_credits_work.work); -+ smb_direct_post_recv_credits(&t->post_recv_credits_work); - return 0; - out_err: - put_recvmsg(t, recvmsg); -diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h -index 7402bf3e037ee7..2fe6abb2ca803d 100644 ---- a/include/crypto/if_alg.h -+++ b/include/crypto/if_alg.h -@@ -150,7 +150,7 @@ struct af_alg_ctx { - size_t used; - atomic_t rcvused; - -- u32 more:1, -+ bool more:1, - merge:1, - enc:1, - write:1, -diff --git a/include/linux/compiler.h b/include/linux/compiler.h -index e84ed3a43f1f80..1d4f23ea3105d0 100644 ---- a/include/linux/compiler.h -+++ b/include/linux/compiler.h -@@ -244,6 +244,15 @@ static inline void *offset_to_ptr(const int *off) - #define is_signed_type(type) (((type)(-1)) < (__force type)1) - #define is_unsigned_type(type) (!is_signed_type(type)) - -+/* -+ * Useful shorthand for "is this condition known at compile-time?" -+ * -+ * Note that the condition may involve non-constant values, -+ * but the compiler may know enough about the details of the -+ * values to determine that the condition is statically true. -+ */ -+#define statically_true(x) (__builtin_constant_p(x) && (x)) -+ - /* - * This is needed in functions which generate the stack canary, see - * arch/x86/kernel/smpboot.c::start_secondary() for an example. -diff --git a/include/linux/minmax.h b/include/linux/minmax.h -index 9c2848abc80496..eaaf5c008e4d05 100644 ---- a/include/linux/minmax.h -+++ b/include/linux/minmax.h -@@ -8,13 +8,10 @@ - #include - - /* -- * min()/max()/clamp() macros must accomplish three things: -+ * min()/max()/clamp() macros must accomplish several things: - * - * - Avoid multiple evaluations of the arguments (so side-effects like - * "x++" happen only once) when non-constant. -- * - Retain result as a constant expressions when called with only -- * constant expressions (to avoid tripping VLA warnings in stack -- * allocation usage). - * - Perform signed v unsigned type-checking (to generate compile - * errors instead of nasty runtime surprises). - * - Unsigned char/short are always promoted to signed int and can be -@@ -26,19 +23,59 @@ - #define __typecheck(x, y) \ - (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) - --/* is_signed_type() isn't a constexpr for pointer types */ --#define __is_signed(x) \ -- __builtin_choose_expr(__is_constexpr(is_signed_type(typeof(x))), \ -- is_signed_type(typeof(x)), 0) -+/* -+ * __sign_use for integer expressions: -+ * bit #0 set if ok for unsigned comparisons -+ * bit #1 set if ok for signed comparisons -+ * -+ * In particular, statically non-negative signed integer expressions -+ * are ok for both. -+ * -+ * NOTE! Unsigned types smaller than 'int' are implicitly converted to 'int' -+ * in expressions, and are accepted for signed conversions for now. -+ * This is debatable. -+ * -+ * Note that 'x' is the original expression, and 'ux' is the unique variable -+ * that contains the value. -+ * -+ * We use 'ux' for pure type checking, and 'x' for when we need to look at the -+ * value (but without evaluating it for side effects! -+ * Careful to only ever evaluate it with sizeof() or __builtin_constant_p() etc). -+ * -+ * Pointers end up being checked by the normal C type rules at the actual -+ * comparison, and these expressions only need to be careful to not cause -+ * warnings for pointer use. -+ */ -+#define __sign_use(ux) (is_signed_type(typeof(ux)) ? \ -+ (2 + __is_nonneg(ux)) : (1 + 2 * (sizeof(ux) < 4))) -+ -+/* -+ * Check whether a signed value is always non-negative. -+ * -+ * A cast is needed to avoid any warnings from values that aren't signed -+ * integer types (in which case the result doesn't matter). -+ * -+ * On 64-bit any integer or pointer type can safely be cast to 'long long'. -+ * But on 32-bit we need to avoid warnings about casting pointers to integers -+ * of different sizes without truncating 64-bit values so 'long' or 'long long' -+ * must be used depending on the size of the value. -+ * -+ * This does not work for 128-bit signed integers since the cast would truncate -+ * them, but we do not use s128 types in the kernel (we do use 'u128', -+ * but they are handled by the !is_signed_type() case). -+ */ -+#if __SIZEOF_POINTER__ == __SIZEOF_LONG_LONG__ -+#define __is_nonneg(ux) statically_true((long long)(ux) >= 0) -+#else -+#define __is_nonneg(ux) statically_true( \ -+ (typeof(__builtin_choose_expr(sizeof(ux) > 4, 1LL, 1L)))(ux) >= 0) -+#endif - --/* True for a non-negative signed int constant */ --#define __is_noneg_int(x) \ -- (__builtin_choose_expr(__is_constexpr(x) && __is_signed(x), x, -1) >= 0) -+#define __types_ok(ux, uy) \ -+ (__sign_use(ux) & __sign_use(uy)) - --#define __types_ok(x, y) \ -- (__is_signed(x) == __is_signed(y) || \ -- __is_signed((x) + 0) == __is_signed((y) + 0) || \ -- __is_noneg_int(x) || __is_noneg_int(y)) -+#define __types_ok3(ux, uy, uz) \ -+ (__sign_use(ux) & __sign_use(uy) & __sign_use(uz)) - - #define __cmp_op_min < - #define __cmp_op_max > -@@ -51,34 +88,14 @@ - #define __cmp_once(op, type, x, y) \ - __cmp_once_unique(op, type, x, y, __UNIQUE_ID(x_), __UNIQUE_ID(y_)) - --#define __careful_cmp_once(op, x, y) ({ \ -- static_assert(__types_ok(x, y), \ -- #op "(" #x ", " #y ") signedness error, fix types or consider u" #op "() before " #op "_t()"); \ -- __cmp_once(op, __auto_type, x, y); }) -- --#define __careful_cmp(op, x, y) \ -- __builtin_choose_expr(__is_constexpr((x) - (y)), \ -- __cmp(op, x, y), __careful_cmp_once(op, x, y)) -- --#define __clamp(val, lo, hi) \ -- ((val) >= (hi) ? (hi) : ((val) <= (lo) ? (lo) : (val))) -- --#define __clamp_once(val, lo, hi, unique_val, unique_lo, unique_hi) ({ \ -- typeof(val) unique_val = (val); \ -- typeof(lo) unique_lo = (lo); \ -- typeof(hi) unique_hi = (hi); \ -- static_assert(__builtin_choose_expr(__is_constexpr((lo) > (hi)), \ -- (lo) <= (hi), true), \ -- "clamp() low limit " #lo " greater than high limit " #hi); \ -- static_assert(__types_ok(val, lo), "clamp() 'lo' signedness error"); \ -- static_assert(__types_ok(val, hi), "clamp() 'hi' signedness error"); \ -- __clamp(unique_val, unique_lo, unique_hi); }) -+#define __careful_cmp_once(op, x, y, ux, uy) ({ \ -+ __auto_type ux = (x); __auto_type uy = (y); \ -+ BUILD_BUG_ON_MSG(!__types_ok(ux, uy), \ -+ #op"("#x", "#y") signedness error"); \ -+ __cmp(op, ux, uy); }) - --#define __careful_clamp(val, lo, hi) ({ \ -- __builtin_choose_expr(__is_constexpr((val) - (lo) + (hi)), \ -- __clamp(val, lo, hi), \ -- __clamp_once(val, lo, hi, __UNIQUE_ID(__val), \ -- __UNIQUE_ID(__lo), __UNIQUE_ID(__hi))); }) -+#define __careful_cmp(op, x, y) \ -+ __careful_cmp_once(op, x, y, __UNIQUE_ID(x_), __UNIQUE_ID(y_)) - - /** - * min - return minimum of two values of the same or compatible types -@@ -111,13 +128,20 @@ - #define umax(x, y) \ - __careful_cmp(max, (x) + 0u + 0ul + 0ull, (y) + 0u + 0ul + 0ull) - -+#define __careful_op3(op, x, y, z, ux, uy, uz) ({ \ -+ __auto_type ux = (x); __auto_type uy = (y);__auto_type uz = (z);\ -+ BUILD_BUG_ON_MSG(!__types_ok3(ux, uy, uz), \ -+ #op"3("#x", "#y", "#z") signedness error"); \ -+ __cmp(op, ux, __cmp(op, uy, uz)); }) -+ - /** - * min3 - return minimum of three values - * @x: first value - * @y: second value - * @z: third value - */ --#define min3(x, y, z) min((typeof(x))min(x, y), z) -+#define min3(x, y, z) \ -+ __careful_op3(min, x, y, z, __UNIQUE_ID(x_), __UNIQUE_ID(y_), __UNIQUE_ID(z_)) - - /** - * max3 - return maximum of three values -@@ -125,7 +149,24 @@ - * @y: second value - * @z: third value - */ --#define max3(x, y, z) max((typeof(x))max(x, y), z) -+#define max3(x, y, z) \ -+ __careful_op3(max, x, y, z, __UNIQUE_ID(x_), __UNIQUE_ID(y_), __UNIQUE_ID(z_)) -+ -+/** -+ * min_t - return minimum of two values, using the specified type -+ * @type: data type to use -+ * @x: first value -+ * @y: second value -+ */ -+#define min_t(type, x, y) __cmp_once(min, type, x, y) -+ -+/** -+ * max_t - return maximum of two values, using the specified type -+ * @type: data type to use -+ * @x: first value -+ * @y: second value -+ */ -+#define max_t(type, x, y) __cmp_once(max, type, x, y) - - /** - * min_not_zero - return the minimum that is _not_ zero, unless both are zero -@@ -137,39 +178,57 @@ - typeof(y) __y = (y); \ - __x == 0 ? __y : ((__y == 0) ? __x : min(__x, __y)); }) - -+#define __clamp(val, lo, hi) \ -+ ((val) >= (hi) ? (hi) : ((val) <= (lo) ? (lo) : (val))) -+ -+#define __clamp_once(type, val, lo, hi, uval, ulo, uhi) ({ \ -+ type uval = (val); \ -+ type ulo = (lo); \ -+ type uhi = (hi); \ -+ BUILD_BUG_ON_MSG(statically_true(ulo > uhi), \ -+ "clamp() low limit " #lo " greater than high limit " #hi); \ -+ BUILD_BUG_ON_MSG(!__types_ok3(uval, ulo, uhi), \ -+ "clamp("#val", "#lo", "#hi") signedness error"); \ -+ __clamp(uval, ulo, uhi); }) -+ -+#define __careful_clamp(type, val, lo, hi) \ -+ __clamp_once(type, val, lo, hi, __UNIQUE_ID(v_), __UNIQUE_ID(l_), __UNIQUE_ID(h_)) -+ - /** -- * clamp - return a value clamped to a given range with strict typechecking -+ * clamp - return a value clamped to a given range with typechecking - * @val: current value - * @lo: lowest allowable value - * @hi: highest allowable value - * -- * This macro does strict typechecking of @lo/@hi to make sure they are of the -- * same type as @val. See the unnecessary pointer comparisons. -- */ --#define clamp(val, lo, hi) __careful_clamp(val, lo, hi) -- --/* -- * ..and if you can't take the strict -- * types, you can specify one yourself. -- * -- * Or not use min/max/clamp at all, of course. -+ * This macro checks @val/@lo/@hi to make sure they have compatible -+ * signedness. - */ -+#define clamp(val, lo, hi) __careful_clamp(__auto_type, val, lo, hi) - - /** -- * min_t - return minimum of two values, using the specified type -- * @type: data type to use -- * @x: first value -- * @y: second value -+ * clamp_t - return a value clamped to a given range using a given type -+ * @type: the type of variable to use -+ * @val: current value -+ * @lo: minimum allowable value -+ * @hi: maximum allowable value -+ * -+ * This macro does no typechecking and uses temporary variables of type -+ * @type to make all the comparisons. - */ --#define min_t(type, x, y) __cmp_once(min, type, x, y) -+#define clamp_t(type, val, lo, hi) __careful_clamp(type, val, lo, hi) - - /** -- * max_t - return maximum of two values, using the specified type -- * @type: data type to use -- * @x: first value -- * @y: second value -+ * clamp_val - return a value clamped to a given range using val's type -+ * @val: current value -+ * @lo: minimum allowable value -+ * @hi: maximum allowable value -+ * -+ * This macro does no typechecking and uses temporary variables of whatever -+ * type the input argument @val is. This is useful when @val is an unsigned -+ * type and @lo and @hi are literals that will otherwise be assigned a signed -+ * integer type. - */ --#define max_t(type, x, y) __cmp_once(max, type, x, y) -+#define clamp_val(val, lo, hi) __careful_clamp(typeof(val), val, lo, hi) - - /* - * Do not check the array parameter using __must_be_array(). -@@ -214,31 +273,6 @@ - */ - #define max_array(array, len) __minmax_array(max, array, len) - --/** -- * clamp_t - return a value clamped to a given range using a given type -- * @type: the type of variable to use -- * @val: current value -- * @lo: minimum allowable value -- * @hi: maximum allowable value -- * -- * This macro does no typechecking and uses temporary variables of type -- * @type to make all the comparisons. -- */ --#define clamp_t(type, val, lo, hi) __careful_clamp((type)(val), (type)(lo), (type)(hi)) -- --/** -- * clamp_val - return a value clamped to a given range using val's type -- * @val: current value -- * @lo: minimum allowable value -- * @hi: maximum allowable value -- * -- * This macro does no typechecking and uses temporary variables of whatever -- * type the input argument @val is. This is useful when @val is an unsigned -- * type and @lo and @hi are literals that will otherwise be assigned a signed -- * integer type. -- */ --#define clamp_val(val, lo, hi) clamp_t(typeof(val), val, lo, hi) -- - static inline bool in_range64(u64 val, u64 start, u64 len) - { - return (val - start) < len; -@@ -277,7 +311,9 @@ static inline bool in_range32(u32 val, u32 start, u32 len) - * Use these carefully: no type checking, and uses the arguments - * multiple times. Use for obvious constants only. - */ --#define MIN_T(type,a,b) __cmp(min,(type)(a),(type)(b)) --#define MAX_T(type,a,b) __cmp(max,(type)(a),(type)(b)) -+#define MIN(a, b) __cmp(min, a, b) -+#define MAX(a, b) __cmp(max, a, b) -+#define MIN_T(type, a, b) __cmp(min, (type)(a), (type)(b)) -+#define MAX_T(type, a, b) __cmp(max, (type)(a), (type)(b)) - - #endif /* _LINUX_MINMAX_H */ -diff --git a/include/linux/mm.h b/include/linux/mm.h -index b97d8a691b28bf..ba77f08900ca2e 100644 ---- a/include/linux/mm.h -+++ b/include/linux/mm.h -@@ -2156,6 +2156,61 @@ static inline int folio_estimated_sharers(struct folio *folio) - return page_mapcount(folio_page(folio, 0)); - } - -+/** -+ * folio_expected_ref_count - calculate the expected folio refcount -+ * @folio: the folio -+ * -+ * Calculate the expected folio refcount, taking references from the pagecache, -+ * swapcache, PG_private and page table mappings into account. Useful in -+ * combination with folio_ref_count() to detect unexpected references (e.g., -+ * GUP or other temporary references). -+ * -+ * Does currently not consider references from the LRU cache. If the folio -+ * was isolated from the LRU (which is the case during migration or split), -+ * the LRU cache does not apply. -+ * -+ * Calling this function on an unmapped folio -- !folio_mapped() -- that is -+ * locked will return a stable result. -+ * -+ * Calling this function on a mapped folio will not result in a stable result, -+ * because nothing stops additional page table mappings from coming (e.g., -+ * fork()) or going (e.g., munmap()). -+ * -+ * Calling this function without the folio lock will also not result in a -+ * stable result: for example, the folio might get dropped from the swapcache -+ * concurrently. -+ * -+ * However, even when called without the folio lock or on a mapped folio, -+ * this function can be used to detect unexpected references early (for example, -+ * if it makes sense to even lock the folio and unmap it). -+ * -+ * The caller must add any reference (e.g., from folio_try_get()) it might be -+ * holding itself to the result. -+ * -+ * Returns the expected folio refcount. -+ */ -+static inline int folio_expected_ref_count(struct folio *folio) -+{ -+ const int order = folio_order(folio); -+ int ref_count = 0; -+ -+ if (WARN_ON_ONCE(folio_test_slab(folio))) -+ return 0; -+ -+ if (folio_test_anon(folio)) { -+ /* One reference per page from the swapcache. */ -+ ref_count += folio_test_swapcache(folio) << order; -+ } else if (!((unsigned long)folio->mapping & PAGE_MAPPING_FLAGS)) { -+ /* One reference per page from the pagecache. */ -+ ref_count += !!folio->mapping << order; -+ /* One reference from PG_private. */ -+ ref_count += folio_test_private(folio); -+ } -+ -+ /* One reference per page table mapping. */ -+ return ref_count + folio_mapcount(folio); -+} -+ - #ifndef HAVE_ARCH_MAKE_PAGE_ACCESSIBLE - static inline int arch_make_page_accessible(struct page *page) - { -diff --git a/include/linux/swap.h b/include/linux/swap.h -index cb25db2a93dd1b..d7a5b7817987d8 100644 ---- a/include/linux/swap.h -+++ b/include/linux/swap.h -@@ -375,6 +375,16 @@ void folio_add_lru_vma(struct folio *, struct vm_area_struct *); - void mark_page_accessed(struct page *); - void folio_mark_accessed(struct folio *); - -+static inline bool folio_may_be_lru_cached(struct folio *folio) -+{ -+ /* -+ * Holding PMD-sized folios in per-CPU LRU cache unbalances accounting. -+ * Holding small numbers of low-order mTHP folios in per-CPU LRU cache -+ * will be sensible, but nobody has implemented and tested that yet. -+ */ -+ return !folio_test_large(folio); -+} -+ - extern atomic_t lru_disable_count; - - static inline bool lru_cache_disabled(void) -diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h -index 4f067599e6e9e0..62135b7782f5be 100644 ---- a/include/net/bluetooth/hci_core.h -+++ b/include/net/bluetooth/hci_core.h -@@ -1169,6 +1169,27 @@ static inline struct hci_conn *hci_conn_hash_lookup_ba(struct hci_dev *hdev, - return NULL; - } - -+static inline struct hci_conn *hci_conn_hash_lookup_role(struct hci_dev *hdev, -+ __u8 type, __u8 role, -+ bdaddr_t *ba) -+{ -+ struct hci_conn_hash *h = &hdev->conn_hash; -+ struct hci_conn *c; -+ -+ rcu_read_lock(); -+ -+ list_for_each_entry_rcu(c, &h->list, list) { -+ if (c->type == type && c->role == role && !bacmp(&c->dst, ba)) { -+ rcu_read_unlock(); -+ return c; -+ } -+ } -+ -+ rcu_read_unlock(); -+ -+ return NULL; -+} -+ - static inline struct hci_conn *hci_conn_hash_lookup_le(struct hci_dev *hdev, - bdaddr_t *ba, - __u8 ba_type) -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index 7d6ee41f4b4f4f..a6f825b7fbe6cd 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -7546,6 +7546,10 @@ static int process_timer_func(struct bpf_verifier_env *env, int regno, - verbose(env, "verifier bug. Two map pointers in a timer helper\n"); - return -EFAULT; - } -+ if (IS_ENABLED(CONFIG_PREEMPT_RT)) { -+ verbose(env, "bpf_timer cannot be used for PREEMPT_RT.\n"); -+ return -EOPNOTSUPP; -+ } - meta->map_uid = reg->map_uid; - meta->map_ptr = map; - return 0; -diff --git a/kernel/futex/requeue.c b/kernel/futex/requeue.c -index cba8b1a6a4cc27..7e43839ca7b05c 100644 ---- a/kernel/futex/requeue.c -+++ b/kernel/futex/requeue.c -@@ -223,18 +223,20 @@ static inline - void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key, - struct futex_hash_bucket *hb) - { -- q->key = *key; -+ struct task_struct *task; - -+ q->key = *key; - __futex_unqueue(q); - - WARN_ON(!q->rt_waiter); - q->rt_waiter = NULL; - - q->lock_ptr = &hb->lock; -+ task = READ_ONCE(q->task); - - /* Signal locked state to the waiter */ - futex_requeue_pi_complete(q, 1); -- wake_up_state(q->task, TASK_NORMAL); -+ wake_up_state(task, TASK_NORMAL); - } - - /** -diff --git a/kernel/trace/preemptirq_delay_test.c b/kernel/trace/preemptirq_delay_test.c -index 8af92dbe98f07b..acb0c971a4082a 100644 ---- a/kernel/trace/preemptirq_delay_test.c -+++ b/kernel/trace/preemptirq_delay_test.c -@@ -34,8 +34,6 @@ MODULE_PARM_DESC(cpu_affinity, "Cpu num test is running on"); - - static struct completion done; - --#define MIN(x, y) ((x) < (y) ? (x) : (y)) -- - static void busy_wait(ulong time) - { - u64 start, end; -diff --git a/kernel/trace/trace_dynevent.c b/kernel/trace/trace_dynevent.c -index c9b0533407edeb..76737492e750e3 100644 ---- a/kernel/trace/trace_dynevent.c -+++ b/kernel/trace/trace_dynevent.c -@@ -239,6 +239,10 @@ static int dyn_event_open(struct inode *inode, struct file *file) - { - int ret; - -+ ret = security_locked_down(LOCKDOWN_TRACEFS); -+ if (ret) -+ return ret; -+ - ret = tracing_check_open_get_tr(NULL); - if (ret) - return ret; -diff --git a/kernel/vhost_task.c b/kernel/vhost_task.c -index 8800f5acc00717..5a2116356428f8 100644 ---- a/kernel/vhost_task.c -+++ b/kernel/vhost_task.c -@@ -100,6 +100,7 @@ void vhost_task_stop(struct vhost_task *vtsk) - * freeing it below. - */ - wait_for_completion(&vtsk->exited); -+ put_task_struct(vtsk->task); - kfree(vtsk); - } - EXPORT_SYMBOL_GPL(vhost_task_stop); -@@ -148,7 +149,7 @@ struct vhost_task *vhost_task_create(bool (*fn)(void *), - return NULL; - } - -- vtsk->task = tsk; -+ vtsk->task = get_task_struct(tsk); - return vtsk; - } - EXPORT_SYMBOL_GPL(vhost_task_create); -diff --git a/lib/btree.c b/lib/btree.c -index 49420cae3a8330..bb81d3393ac5c5 100644 ---- a/lib/btree.c -+++ b/lib/btree.c -@@ -43,7 +43,6 @@ - #include - #include - --#define MAX(a, b) ((a) > (b) ? (a) : (b)) - #define NODESIZE MAX(L1_CACHE_BYTES, 128) - - struct btree_geo { -diff --git a/lib/decompress_unlzma.c b/lib/decompress_unlzma.c -index 20a858031f12b7..9d34d35908daa8 100644 ---- a/lib/decompress_unlzma.c -+++ b/lib/decompress_unlzma.c -@@ -37,7 +37,9 @@ - - #include - -+#ifndef MIN - #define MIN(a, b) (((a) < (b)) ? (a) : (b)) -+#endif - - static long long INIT read_int(unsigned char *ptr, int size) - { -diff --git a/lib/vsprintf.c b/lib/vsprintf.c -index 2aa408441cd3e7..f4ab2750cfc129 100644 ---- a/lib/vsprintf.c -+++ b/lib/vsprintf.c -@@ -1079,7 +1079,7 @@ char *resource_string(char *buf, char *end, struct resource *res, - #define FLAG_BUF_SIZE (2 * sizeof(res->flags)) - #define DECODED_BUF_SIZE sizeof("[mem - 64bit pref window disabled]") - #define RAW_BUF_SIZE sizeof("[mem - flags 0x]") -- char sym[max(2*RSRC_BUF_SIZE + DECODED_BUF_SIZE, -+ char sym[MAX(2*RSRC_BUF_SIZE + DECODED_BUF_SIZE, - 2*RSRC_BUF_SIZE + FLAG_BUF_SIZE + RAW_BUF_SIZE)]; - - char *p = sym, *pend = sym + sizeof(sym); -diff --git a/mm/gup.c b/mm/gup.c -index 29c719b3ab31e1..53154b63295ab6 100644 ---- a/mm/gup.c -+++ b/mm/gup.c -@@ -1946,14 +1946,14 @@ struct page *get_dump_page(unsigned long addr) - /* - * Returns the number of collected pages. Return value is always >= 0. - */ --static void collect_longterm_unpinnable_pages( -+static unsigned long collect_longterm_unpinnable_pages( - struct list_head *movable_page_list, - unsigned long nr_pages, - struct page **pages) - { -+ unsigned long i, collected = 0; - struct folio *prev_folio = NULL; -- bool drain_allow = true; -- unsigned long i; -+ int drained = 0; - - for (i = 0; i < nr_pages; i++) { - struct folio *folio = page_folio(pages[i]); -@@ -1965,6 +1965,8 @@ static void collect_longterm_unpinnable_pages( - if (folio_is_longterm_pinnable(folio)) - continue; - -+ collected++; -+ - if (folio_is_device_coherent(folio)) - continue; - -@@ -1973,9 +1975,17 @@ static void collect_longterm_unpinnable_pages( - continue; - } - -- if (!folio_test_lru(folio) && drain_allow) { -+ if (drained == 0 && folio_may_be_lru_cached(folio) && -+ folio_ref_count(folio) != -+ folio_expected_ref_count(folio) + 1) { -+ lru_add_drain(); -+ drained = 1; -+ } -+ if (drained == 1 && folio_may_be_lru_cached(folio) && -+ folio_ref_count(folio) != -+ folio_expected_ref_count(folio) + 1) { - lru_add_drain_all(); -- drain_allow = false; -+ drained = 2; - } - - if (!folio_isolate_lru(folio)) -@@ -1986,6 +1996,8 @@ static void collect_longterm_unpinnable_pages( - NR_ISOLATED_ANON + folio_is_file_lru(folio), - folio_nr_pages(folio)); - } -+ -+ return collected; - } - - /* -@@ -2078,10 +2090,12 @@ static int migrate_longterm_unpinnable_pages( - static long check_and_migrate_movable_pages(unsigned long nr_pages, - struct page **pages) - { -+ unsigned long collected; - LIST_HEAD(movable_page_list); - -- collect_longterm_unpinnable_pages(&movable_page_list, nr_pages, pages); -- if (list_empty(&movable_page_list)) -+ collected = collect_longterm_unpinnable_pages(&movable_page_list, -+ nr_pages, pages); -+ if (!collected) - return 0; - - return migrate_longterm_unpinnable_pages(&movable_page_list, nr_pages, -diff --git a/mm/kmsan/core.c b/mm/kmsan/core.c -index 38a3bff23e8d00..38155d6982152a 100644 ---- a/mm/kmsan/core.c -+++ b/mm/kmsan/core.c -@@ -262,7 +262,8 @@ void kmsan_internal_set_shadow_origin(void *addr, size_t size, int b, - u32 origin, bool checked) - { - u64 address = (u64)addr; -- u32 *shadow_start, *origin_start; -+ void *shadow_start; -+ u32 *aligned_shadow, *origin_start; - size_t pad = 0; - - KMSAN_WARN_ON(!kmsan_metadata_is_contiguous(addr, size)); -@@ -281,9 +282,12 @@ void kmsan_internal_set_shadow_origin(void *addr, size_t size, int b, - } - __memset(shadow_start, b, size); - -- if (!IS_ALIGNED(address, KMSAN_ORIGIN_SIZE)) { -+ if (IS_ALIGNED(address, KMSAN_ORIGIN_SIZE)) { -+ aligned_shadow = shadow_start; -+ } else { - pad = address % KMSAN_ORIGIN_SIZE; - address -= pad; -+ aligned_shadow = shadow_start - pad; - size += pad; - } - size = ALIGN(size, KMSAN_ORIGIN_SIZE); -@@ -297,7 +301,7 @@ void kmsan_internal_set_shadow_origin(void *addr, size_t size, int b, - * corresponding shadow slot is zero. - */ - for (int i = 0; i < size / KMSAN_ORIGIN_SIZE; i++) { -- if (origin || !shadow_start[i]) -+ if (origin || !aligned_shadow[i]) - origin_start[i] = origin; - } - } -diff --git a/mm/kmsan/kmsan_test.c b/mm/kmsan/kmsan_test.c -index 312989aa2865c4..e98c89d3a73aa4 100644 ---- a/mm/kmsan/kmsan_test.c -+++ b/mm/kmsan/kmsan_test.c -@@ -523,6 +523,21 @@ DEFINE_TEST_MEMSETXX(16) - DEFINE_TEST_MEMSETXX(32) - DEFINE_TEST_MEMSETXX(64) - -+/* Test case: ensure that KMSAN does not access shadow memory out of bounds. */ -+static void test_memset_on_guarded_buffer(struct kunit *test) -+{ -+ void *buf = vmalloc(PAGE_SIZE); -+ -+ kunit_info(test, -+ "memset() on ends of guarded buffer should not crash\n"); -+ -+ for (size_t size = 0; size <= 128; size++) { -+ memset(buf, 0xff, size); -+ memset(buf + PAGE_SIZE - size, 0xff, size); -+ } -+ vfree(buf); -+} -+ - static noinline void fibonacci(int *array, int size, int start) - { - if (start < 2 || (start == size)) -@@ -602,6 +617,7 @@ static struct kunit_case kmsan_test_cases[] = { - KUNIT_CASE(test_memset16), - KUNIT_CASE(test_memset32), - KUNIT_CASE(test_memset64), -+ KUNIT_CASE(test_memset_on_guarded_buffer), - KUNIT_CASE(test_long_origin_chain), - KUNIT_CASE(test_stackdepot_roundtrip), - {}, -diff --git a/mm/migrate_device.c b/mm/migrate_device.c -index 8ac1f79f754a29..f209dc512d8216 100644 ---- a/mm/migrate_device.c -+++ b/mm/migrate_device.c -@@ -814,42 +814,40 @@ void migrate_device_finalize(unsigned long *src_pfns, - unsigned long i; - - for (i = 0; i < npages; i++) { -- struct folio *dst, *src; -+ struct folio *dst = NULL, *src = NULL; - struct page *newpage = migrate_pfn_to_page(dst_pfns[i]); - struct page *page = migrate_pfn_to_page(src_pfns[i]); - -+ if (newpage) -+ dst = page_folio(newpage); -+ - if (!page) { -- if (newpage) { -- unlock_page(newpage); -- put_page(newpage); -+ if (dst) { -+ folio_unlock(dst); -+ folio_put(dst); - } - continue; - } - -- if (!(src_pfns[i] & MIGRATE_PFN_MIGRATE) || !newpage) { -- if (newpage) { -- unlock_page(newpage); -- put_page(newpage); -+ src = page_folio(page); -+ -+ if (!(src_pfns[i] & MIGRATE_PFN_MIGRATE) || !dst) { -+ if (dst) { -+ folio_unlock(dst); -+ folio_put(dst); - } -- newpage = page; -+ dst = src; - } - -- src = page_folio(page); -- dst = page_folio(newpage); -+ if (!folio_is_zone_device(dst)) -+ folio_add_lru(dst); - remove_migration_ptes(src, dst, false); - folio_unlock(src); -+ folio_put(src); - -- if (is_zone_device_page(page)) -- put_page(page); -- else -- putback_lru_page(page); -- -- if (newpage != page) { -- unlock_page(newpage); -- if (is_zone_device_page(newpage)) -- put_page(newpage); -- else -- putback_lru_page(newpage); -+ if (dst != src) { -+ folio_unlock(dst); -+ folio_put(dst); - } - } - } -diff --git a/mm/mlock.c b/mm/mlock.c -index 06bdfab83b58af..6858095c20dd9c 100644 ---- a/mm/mlock.c -+++ b/mm/mlock.c -@@ -256,7 +256,7 @@ void mlock_folio(struct folio *folio) - - folio_get(folio); - if (!folio_batch_add(fbatch, mlock_lru(folio)) || -- folio_test_large(folio) || lru_cache_disabled()) -+ !folio_may_be_lru_cached(folio) || lru_cache_disabled()) - mlock_folio_batch(fbatch); - local_unlock(&mlock_fbatch.lock); - } -@@ -279,7 +279,7 @@ void mlock_new_folio(struct folio *folio) - - folio_get(folio); - if (!folio_batch_add(fbatch, mlock_new(folio)) || -- folio_test_large(folio) || lru_cache_disabled()) -+ !folio_may_be_lru_cached(folio) || lru_cache_disabled()) - mlock_folio_batch(fbatch); - local_unlock(&mlock_fbatch.lock); - } -@@ -300,7 +300,7 @@ void munlock_folio(struct folio *folio) - */ - folio_get(folio); - if (!folio_batch_add(fbatch, folio) || -- folio_test_large(folio) || lru_cache_disabled()) -+ !folio_may_be_lru_cached(folio) || lru_cache_disabled()) - mlock_folio_batch(fbatch); - local_unlock(&mlock_fbatch.lock); - } -diff --git a/mm/swap.c b/mm/swap.c -index 42082eba42de3e..8fde1a27aa4825 100644 ---- a/mm/swap.c -+++ b/mm/swap.c -@@ -220,8 +220,8 @@ static void folio_batch_move_lru(struct folio_batch *fbatch, move_fn_t move_fn) - static void folio_batch_add_and_move(struct folio_batch *fbatch, - struct folio *folio, move_fn_t move_fn) - { -- if (folio_batch_add(fbatch, folio) && !folio_test_large(folio) && -- !lru_cache_disabled()) -+ if (folio_batch_add(fbatch, folio) && -+ folio_may_be_lru_cached(folio) && !lru_cache_disabled()) - return; - folio_batch_move_lru(fbatch, move_fn); - } -diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c -index c82070167d8aa8..14327fc34aa713 100644 ---- a/mm/zsmalloc.c -+++ b/mm/zsmalloc.c -@@ -119,8 +119,6 @@ - #define ISOLATED_BITS 5 - #define MAGIC_VAL_BITS 8 - --#define MAX(a, b) ((a) >= (b) ? (a) : (b)) -- - #define ZS_MAX_PAGES_PER_ZSPAGE (_AC(CONFIG_ZSMALLOC_CHAIN_SIZE, UL)) - - /* ZS_MIN_ALLOC_SIZE must be multiple of ZS_ALIGN */ -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index 5eed23b8d6c332..7bda00dcb0b2f0 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -3048,8 +3048,18 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, void *data, - - hci_dev_lock(hdev); - -+ /* Check for existing connection: -+ * -+ * 1. If it doesn't exist then it must be receiver/slave role. -+ * 2. If it does exist confirm that it is connecting/BT_CONNECT in case -+ * of initiator/master role since there could be a collision where -+ * either side is attempting to connect or something like a fuzzing -+ * testing is trying to play tricks to destroy the hcon object before -+ * it even attempts to connect (e.g. hcon->state == BT_OPEN). -+ */ - conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr); -- if (!conn) { -+ if (!conn || -+ (conn->role == HCI_ROLE_MASTER && conn->state != BT_CONNECT)) { - /* In case of error status and there is no connection pending - * just unlock as there is nothing to cleanup. - */ -@@ -5615,8 +5625,18 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, - */ - hci_dev_clear_flag(hdev, HCI_LE_ADV); - -- conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr); -- if (!conn) { -+ /* Check for existing connection: -+ * -+ * 1. If it doesn't exist then use the role to create a new object. -+ * 2. If it does exist confirm that it is connecting/BT_CONNECT in case -+ * of initiator/master role since there could be a collision where -+ * either side is attempting to connect or something like a fuzzing -+ * testing is trying to play tricks to destroy the hcon object before -+ * it even attempts to connect (e.g. hcon->state == BT_OPEN). -+ */ -+ conn = hci_conn_hash_lookup_role(hdev, LE_LINK, role, bdaddr); -+ if (!conn || -+ (conn->role == HCI_ROLE_MASTER && conn->state != BT_CONNECT)) { - /* In case of error status and there is no connection pending - * just unlock as there is nothing to cleanup. - */ -diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c -index 7f3f700faebc24..dc9209f9f1a6a3 100644 ---- a/net/bluetooth/hci_sync.c -+++ b/net/bluetooth/hci_sync.c -@@ -2639,6 +2639,13 @@ static int hci_resume_advertising_sync(struct hci_dev *hdev) - hci_remove_ext_adv_instance_sync(hdev, adv->instance, - NULL); - } -+ -+ /* If current advertising instance is set to instance 0x00 -+ * then we need to re-enable it. -+ */ -+ if (!hdev->cur_adv_instance) -+ err = hci_enable_ext_advertising_sync(hdev, -+ hdev->cur_adv_instance); - } else { - /* Schedule for most recent instance to be restarted and begin - * the software rotation loop -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 21a83e26f004bb..867832f8bbaea9 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -6330,7 +6330,7 @@ struct sk_buff *alloc_skb_with_frags(unsigned long header_len, - return NULL; - - while (data_len) { -- if (nr_frags == MAX_SKB_FRAGS - 1) -+ if (nr_frags == MAX_SKB_FRAGS) - goto failure; - while (order && PAGE_ALIGN(data_len) < (PAGE_SIZE << order)) - order--; -diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c -index 8d41b039421976..fab550633ec9f3 100644 ---- a/net/ipv4/nexthop.c -+++ b/net/ipv4/nexthop.c -@@ -2136,6 +2136,13 @@ static int replace_nexthop_single(struct net *net, struct nexthop *old, - return -EINVAL; - } - -+ if (!list_empty(&old->grp_list) && -+ rtnl_dereference(new->nh_info)->fdb_nh != -+ rtnl_dereference(old->nh_info)->fdb_nh) { -+ NL_SET_ERR_MSG(extack, "Cannot change nexthop FDB status while in a group"); -+ return -EINVAL; -+ } -+ - err = call_nexthop_notifiers(net, NEXTHOP_EVENT_REPLACE, new, extack); - if (err) - return err; -diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c -index acfbe1f013d1b8..ded559f5576754 100644 ---- a/net/xfrm/xfrm_state.c -+++ b/net/xfrm/xfrm_state.c -@@ -2296,6 +2296,8 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high, - - for (h = 0; h < range; h++) { - u32 spi = (low == high) ? low : get_random_u32_inclusive(low, high); -+ if (spi == 0) -+ goto next; - newspi = htonl(spi); - - spin_lock_bh(&net->xfrm.xfrm_state_lock); -@@ -2311,6 +2313,7 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high, - xfrm_state_put(x0); - spin_unlock_bh(&net->xfrm.xfrm_state_lock); - -+next: - if (signal_pending(current)) { - err = -ERESTARTSYS; - goto unlock; -diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c -index 68c82e344d3baf..270a0be672b7ec 100644 ---- a/sound/usb/mixer_quirks.c -+++ b/sound/usb/mixer_quirks.c -@@ -16,6 +16,7 @@ - - #include - #include -+#include - #include - #include - #include -@@ -76,7 +77,8 @@ static int snd_create_std_mono_ctl_offset(struct usb_mixer_interface *mixer, - cval->idx_off = idx_off; - - /* get_min_max() is called only for integer volumes later, -- * so provide a short-cut for booleans */ -+ * so provide a short-cut for booleans -+ */ - cval->min = 0; - cval->max = 1; - cval->res = 0; -@@ -125,7 +127,7 @@ static int snd_create_std_mono_table(struct usb_mixer_interface *mixer, - { - int err; - -- while (t->name != NULL) { -+ while (t->name) { - err = snd_create_std_mono_ctl(mixer, t->unitid, t->control, - t->cmask, t->val_type, t->name, t->tlv_callback); - if (err < 0) -@@ -207,7 +209,6 @@ static void snd_usb_soundblaster_remote_complete(struct urb *urb) - if (code == rc->mute_code) - snd_usb_mixer_notify_id(mixer, rc->mute_mixer_id); - mixer->rc_code = code; -- wmb(); - wake_up(&mixer->rc_waitq); - } - -@@ -375,10 +376,10 @@ static int snd_audigy2nx_controls_create(struct usb_mixer_interface *mixer) - struct snd_kcontrol_new knew; - - /* USB X-Fi S51 doesn't have a CMSS LED */ -- if ((mixer->chip->usb_id == USB_ID(0x041e, 0x3042)) && i == 0) -+ if (mixer->chip->usb_id == USB_ID(0x041e, 0x3042) && i == 0) - continue; - /* USB X-Fi S51 Pro doesn't have one either */ -- if ((mixer->chip->usb_id == USB_ID(0x041e, 0x30df)) && i == 0) -+ if (mixer->chip->usb_id == USB_ID(0x041e, 0x30df) && i == 0) - continue; - if (i > 1 && /* Live24ext has 2 LEDs only */ - (mixer->chip->usb_id == USB_ID(0x041e, 0x3040) || -@@ -527,6 +528,265 @@ static int snd_emu0204_controls_create(struct usb_mixer_interface *mixer) - &snd_emu0204_control, NULL); - } - -+#if IS_REACHABLE(CONFIG_INPUT) -+/* -+ * Sony DualSense controller (PS5) jack detection -+ * -+ * Since this is an UAC 1 device, it doesn't support jack detection. -+ * However, the controller hid-playstation driver reports HP & MIC -+ * insert events through a dedicated input device. -+ */ -+ -+#define SND_DUALSENSE_JACK_OUT_TERM_ID 3 -+#define SND_DUALSENSE_JACK_IN_TERM_ID 4 -+ -+struct dualsense_mixer_elem_info { -+ struct usb_mixer_elem_info info; -+ struct input_handler ih; -+ struct input_device_id id_table[2]; -+ bool connected; -+}; -+ -+static void snd_dualsense_ih_event(struct input_handle *handle, -+ unsigned int type, unsigned int code, -+ int value) -+{ -+ struct dualsense_mixer_elem_info *mei; -+ struct usb_mixer_elem_list *me; -+ -+ if (type != EV_SW) -+ return; -+ -+ mei = container_of(handle->handler, struct dualsense_mixer_elem_info, ih); -+ me = &mei->info.head; -+ -+ if ((me->id == SND_DUALSENSE_JACK_OUT_TERM_ID && code == SW_HEADPHONE_INSERT) || -+ (me->id == SND_DUALSENSE_JACK_IN_TERM_ID && code == SW_MICROPHONE_INSERT)) { -+ mei->connected = !!value; -+ snd_ctl_notify(me->mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE, -+ &me->kctl->id); -+ } -+} -+ -+static bool snd_dualsense_ih_match(struct input_handler *handler, -+ struct input_dev *dev) -+{ -+ struct dualsense_mixer_elem_info *mei; -+ struct usb_device *snd_dev; -+ char *input_dev_path, *usb_dev_path; -+ size_t usb_dev_path_len; -+ bool match = false; -+ -+ mei = container_of(handler, struct dualsense_mixer_elem_info, ih); -+ snd_dev = mei->info.head.mixer->chip->dev; -+ -+ input_dev_path = kobject_get_path(&dev->dev.kobj, GFP_KERNEL); -+ if (!input_dev_path) { -+ dev_warn(&snd_dev->dev, "Failed to get input dev path\n"); -+ return false; -+ } -+ -+ usb_dev_path = kobject_get_path(&snd_dev->dev.kobj, GFP_KERNEL); -+ if (!usb_dev_path) { -+ dev_warn(&snd_dev->dev, "Failed to get USB dev path\n"); -+ goto free_paths; -+ } -+ -+ /* -+ * Ensure the VID:PID matched input device supposedly owned by the -+ * hid-playstation driver belongs to the actual hardware handled by -+ * the current USB audio device, which implies input_dev_path being -+ * a subpath of usb_dev_path. -+ * -+ * This verification is necessary when there is more than one identical -+ * controller attached to the host system. -+ */ -+ usb_dev_path_len = strlen(usb_dev_path); -+ if (usb_dev_path_len >= strlen(input_dev_path)) -+ goto free_paths; -+ -+ usb_dev_path[usb_dev_path_len] = '/'; -+ match = !memcmp(input_dev_path, usb_dev_path, usb_dev_path_len + 1); -+ -+free_paths: -+ kfree(input_dev_path); -+ kfree(usb_dev_path); -+ -+ return match; -+} -+ -+static int snd_dualsense_ih_connect(struct input_handler *handler, -+ struct input_dev *dev, -+ const struct input_device_id *id) -+{ -+ struct input_handle *handle; -+ int err; -+ -+ handle = kzalloc(sizeof(*handle), GFP_KERNEL); -+ if (!handle) -+ return -ENOMEM; -+ -+ handle->dev = dev; -+ handle->handler = handler; -+ handle->name = handler->name; -+ -+ err = input_register_handle(handle); -+ if (err) -+ goto err_free; -+ -+ err = input_open_device(handle); -+ if (err) -+ goto err_unregister; -+ -+ return 0; -+ -+err_unregister: -+ input_unregister_handle(handle); -+err_free: -+ kfree(handle); -+ return err; -+} -+ -+static void snd_dualsense_ih_disconnect(struct input_handle *handle) -+{ -+ input_close_device(handle); -+ input_unregister_handle(handle); -+ kfree(handle); -+} -+ -+static void snd_dualsense_ih_start(struct input_handle *handle) -+{ -+ struct dualsense_mixer_elem_info *mei; -+ struct usb_mixer_elem_list *me; -+ int status = -1; -+ -+ mei = container_of(handle->handler, struct dualsense_mixer_elem_info, ih); -+ me = &mei->info.head; -+ -+ if (me->id == SND_DUALSENSE_JACK_OUT_TERM_ID && -+ test_bit(SW_HEADPHONE_INSERT, handle->dev->swbit)) -+ status = test_bit(SW_HEADPHONE_INSERT, handle->dev->sw); -+ else if (me->id == SND_DUALSENSE_JACK_IN_TERM_ID && -+ test_bit(SW_MICROPHONE_INSERT, handle->dev->swbit)) -+ status = test_bit(SW_MICROPHONE_INSERT, handle->dev->sw); -+ -+ if (status >= 0) { -+ mei->connected = !!status; -+ snd_ctl_notify(me->mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE, -+ &me->kctl->id); -+ } -+} -+ -+static int snd_dualsense_jack_get(struct snd_kcontrol *kctl, -+ struct snd_ctl_elem_value *ucontrol) -+{ -+ struct dualsense_mixer_elem_info *mei = snd_kcontrol_chip(kctl); -+ -+ ucontrol->value.integer.value[0] = mei->connected; -+ -+ return 0; -+} -+ -+static const struct snd_kcontrol_new snd_dualsense_jack_control = { -+ .iface = SNDRV_CTL_ELEM_IFACE_CARD, -+ .access = SNDRV_CTL_ELEM_ACCESS_READ, -+ .info = snd_ctl_boolean_mono_info, -+ .get = snd_dualsense_jack_get, -+}; -+ -+static int snd_dualsense_resume_jack(struct usb_mixer_elem_list *list) -+{ -+ snd_ctl_notify(list->mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE, -+ &list->kctl->id); -+ return 0; -+} -+ -+static void snd_dualsense_mixer_elem_free(struct snd_kcontrol *kctl) -+{ -+ struct dualsense_mixer_elem_info *mei = snd_kcontrol_chip(kctl); -+ -+ if (mei->ih.event) -+ input_unregister_handler(&mei->ih); -+ -+ snd_usb_mixer_elem_free(kctl); -+} -+ -+static int snd_dualsense_jack_create(struct usb_mixer_interface *mixer, -+ const char *name, bool is_output) -+{ -+ struct dualsense_mixer_elem_info *mei; -+ struct input_device_id *idev_id; -+ struct snd_kcontrol *kctl; -+ int err; -+ -+ mei = kzalloc(sizeof(*mei), GFP_KERNEL); -+ if (!mei) -+ return -ENOMEM; -+ -+ snd_usb_mixer_elem_init_std(&mei->info.head, mixer, -+ is_output ? SND_DUALSENSE_JACK_OUT_TERM_ID : -+ SND_DUALSENSE_JACK_IN_TERM_ID); -+ -+ mei->info.head.resume = snd_dualsense_resume_jack; -+ mei->info.val_type = USB_MIXER_BOOLEAN; -+ mei->info.channels = 1; -+ mei->info.min = 0; -+ mei->info.max = 1; -+ -+ kctl = snd_ctl_new1(&snd_dualsense_jack_control, mei); -+ if (!kctl) { -+ kfree(mei); -+ return -ENOMEM; -+ } -+ -+ strscpy(kctl->id.name, name, sizeof(kctl->id.name)); -+ kctl->private_free = snd_dualsense_mixer_elem_free; -+ -+ err = snd_usb_mixer_add_control(&mei->info.head, kctl); -+ if (err) -+ return err; -+ -+ idev_id = &mei->id_table[0]; -+ idev_id->flags = INPUT_DEVICE_ID_MATCH_VENDOR | INPUT_DEVICE_ID_MATCH_PRODUCT | -+ INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_SWBIT; -+ idev_id->vendor = USB_ID_VENDOR(mixer->chip->usb_id); -+ idev_id->product = USB_ID_PRODUCT(mixer->chip->usb_id); -+ idev_id->evbit[BIT_WORD(EV_SW)] = BIT_MASK(EV_SW); -+ if (is_output) -+ idev_id->swbit[BIT_WORD(SW_HEADPHONE_INSERT)] = BIT_MASK(SW_HEADPHONE_INSERT); -+ else -+ idev_id->swbit[BIT_WORD(SW_MICROPHONE_INSERT)] = BIT_MASK(SW_MICROPHONE_INSERT); -+ -+ mei->ih.event = snd_dualsense_ih_event; -+ mei->ih.match = snd_dualsense_ih_match; -+ mei->ih.connect = snd_dualsense_ih_connect; -+ mei->ih.disconnect = snd_dualsense_ih_disconnect; -+ mei->ih.start = snd_dualsense_ih_start; -+ mei->ih.name = name; -+ mei->ih.id_table = mei->id_table; -+ -+ err = input_register_handler(&mei->ih); -+ if (err) { -+ dev_warn(&mixer->chip->dev->dev, -+ "Could not register input handler: %d\n", err); -+ mei->ih.event = NULL; -+ } -+ -+ return 0; -+} -+ -+static int snd_dualsense_controls_create(struct usb_mixer_interface *mixer) -+{ -+ int err; -+ -+ err = snd_dualsense_jack_create(mixer, "Headphone Jack", true); -+ if (err < 0) -+ return err; -+ -+ return snd_dualsense_jack_create(mixer, "Headset Mic Jack", false); -+} -+#endif /* IS_REACHABLE(CONFIG_INPUT) */ -+ - /* ASUS Xonar U1 / U3 controls */ - - static int snd_xonar_u1_switch_get(struct snd_kcontrol *kcontrol, -@@ -1733,7 +1993,8 @@ static int snd_microii_spdif_default_put(struct snd_kcontrol *kcontrol, - unsigned int pval, pval_old; - int err; - -- pval = pval_old = kcontrol->private_value; -+ pval = kcontrol->private_value; -+ pval_old = pval; - pval &= 0xfffff0f0; - pval |= (ucontrol->value.iec958.status[1] & 0x0f) << 8; - pval |= (ucontrol->value.iec958.status[0] & 0x0f); -@@ -3271,7 +3532,7 @@ static int snd_djm_controls_update(struct usb_mixer_interface *mixer, - int err; - const struct snd_djm_device *device = &snd_djm_devices[device_idx]; - -- if ((group >= device->ncontrols) || value >= device->controls[group].noptions) -+ if (group >= device->ncontrols || value >= device->controls[group].noptions) - return -EINVAL; - - err = snd_usb_lock_shutdown(mixer->chip); -@@ -3389,6 +3650,13 @@ int snd_usb_mixer_apply_create_quirk(struct usb_mixer_interface *mixer) - err = snd_emu0204_controls_create(mixer); - break; - -+#if IS_REACHABLE(CONFIG_INPUT) -+ case USB_ID(0x054c, 0x0ce6): /* Sony DualSense controller (PS5) */ -+ case USB_ID(0x054c, 0x0df2): /* Sony DualSense Edge controller (PS5) */ -+ err = snd_dualsense_controls_create(mixer); -+ break; -+#endif /* IS_REACHABLE(CONFIG_INPUT) */ -+ - case USB_ID(0x0763, 0x2030): /* M-Audio Fast Track C400 */ - case USB_ID(0x0763, 0x2031): /* M-Audio Fast Track C400 */ - err = snd_c400_create_mixer(mixer); -@@ -3546,7 +3814,8 @@ static void snd_dragonfly_quirk_db_scale(struct usb_mixer_interface *mixer, - struct snd_kcontrol *kctl) - { - /* Approximation using 10 ranges based on output measurement on hw v1.2. -- * This seems close to the cubic mapping e.g. alsamixer uses. */ -+ * This seems close to the cubic mapping e.g. alsamixer uses. -+ */ - static const DECLARE_TLV_DB_RANGE(scale, - 0, 1, TLV_DB_MINMAX_ITEM(-5300, -4970), - 2, 5, TLV_DB_MINMAX_ITEM(-4710, -4160), -@@ -3630,16 +3899,12 @@ void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer, - if (unitid == 7 && cval->control == UAC_FU_VOLUME) - snd_dragonfly_quirk_db_scale(mixer, cval, kctl); - break; -+ } -+ - /* lowest playback value is muted on some devices */ -- case USB_ID(0x0572, 0x1b09): /* Conexant Systems (Rockwell), Inc. */ -- case USB_ID(0x0d8c, 0x000c): /* C-Media */ -- case USB_ID(0x0d8c, 0x0014): /* C-Media */ -- case USB_ID(0x19f7, 0x0003): /* RODE NT-USB */ -- case USB_ID(0x2d99, 0x0026): /* HECATE G2 GAMING HEADSET */ -+ if (mixer->chip->quirk_flags & QUIRK_FLAG_MIXER_MIN_MUTE) - if (strstr(kctl->id.name, "Playback")) - cval->min_mute = 1; -- break; -- } - - /* ALSA-ify some Plantronics headset control names */ - if (USB_ID_VENDOR(mixer->chip->usb_id) == 0x047f && -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index f19c808444c97a..7d747677b58da8 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -2096,6 +2096,10 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { - QUIRK_FLAG_SET_IFACE_FIRST), - DEVICE_FLG(0x0556, 0x0014, /* Phoenix Audio TMX320VC */ - QUIRK_FLAG_GET_SAMPLE_RATE), -+ DEVICE_FLG(0x0572, 0x1b08, /* Conexant Systems (Rockwell), Inc. */ -+ QUIRK_FLAG_MIXER_MIN_MUTE), -+ DEVICE_FLG(0x0572, 0x1b09, /* Conexant Systems (Rockwell), Inc. */ -+ QUIRK_FLAG_MIXER_MIN_MUTE), - DEVICE_FLG(0x05a3, 0x9420, /* ELP HD USB Camera */ - QUIRK_FLAG_GET_SAMPLE_RATE), - DEVICE_FLG(0x05a7, 0x1020, /* Bose Companion 5 */ -@@ -2138,12 +2142,16 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { - QUIRK_FLAG_CTL_MSG_DELAY_1M), - DEVICE_FLG(0x0b0e, 0x0349, /* Jabra 550a */ - QUIRK_FLAG_CTL_MSG_DELAY_1M), -+ DEVICE_FLG(0x0bda, 0x498a, /* Realtek Semiconductor Corp. */ -+ QUIRK_FLAG_MIXER_MIN_MUTE), - DEVICE_FLG(0x0c45, 0x6340, /* Sonix HD USB Camera */ - QUIRK_FLAG_GET_SAMPLE_RATE), - DEVICE_FLG(0x0c45, 0x636b, /* Microdia JP001 USB Camera */ - QUIRK_FLAG_GET_SAMPLE_RATE), -- DEVICE_FLG(0x0d8c, 0x0014, /* USB Audio Device */ -- QUIRK_FLAG_CTL_MSG_DELAY_1M), -+ DEVICE_FLG(0x0d8c, 0x000c, /* C-Media */ -+ QUIRK_FLAG_MIXER_MIN_MUTE), -+ DEVICE_FLG(0x0d8c, 0x0014, /* C-Media */ -+ QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIXER_MIN_MUTE), - DEVICE_FLG(0x0ecb, 0x205c, /* JBL Quantum610 Wireless */ - QUIRK_FLAG_FIXED_RATE), - DEVICE_FLG(0x0ecb, 0x2069, /* JBL Quantum810 Wireless */ -@@ -2152,6 +2160,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { - QUIRK_FLAG_SHARE_MEDIA_DEVICE | QUIRK_FLAG_ALIGN_TRANSFER), - DEVICE_FLG(0x1101, 0x0003, /* Audioengine D1 */ - QUIRK_FLAG_GET_SAMPLE_RATE), -+ DEVICE_FLG(0x12d1, 0x3a07, /* Huawei Technologies Co., Ltd. */ -+ QUIRK_FLAG_MIXER_MIN_MUTE), - DEVICE_FLG(0x1224, 0x2a25, /* Jieli Technology USB PHY 2.0 */ - QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16), - DEVICE_FLG(0x1395, 0x740a, /* Sennheiser DECT */ -@@ -2190,6 +2200,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { - QUIRK_FLAG_ITF_USB_DSD_DAC | QUIRK_FLAG_CTL_MSG_DELAY), - DEVICE_FLG(0x1901, 0x0191, /* GE B850V3 CP2114 audio interface */ - QUIRK_FLAG_GET_SAMPLE_RATE), -+ DEVICE_FLG(0x19f7, 0x0003, /* RODE NT-USB */ -+ QUIRK_FLAG_MIXER_MIN_MUTE), - DEVICE_FLG(0x19f7, 0x0035, /* RODE NT-USB+ */ - QUIRK_FLAG_GET_SAMPLE_RATE), - DEVICE_FLG(0x1bcf, 0x2281, /* HD Webcam */ -@@ -2240,6 +2252,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { - QUIRK_FLAG_IGNORE_CTL_ERROR), - DEVICE_FLG(0x2912, 0x30c8, /* Audioengine D1 */ - QUIRK_FLAG_GET_SAMPLE_RATE), -+ DEVICE_FLG(0x2a70, 0x1881, /* OnePlus Technology (Shenzhen) Co., Ltd. BE02T */ -+ QUIRK_FLAG_MIXER_MIN_MUTE), - DEVICE_FLG(0x2b53, 0x0023, /* Fiero SC-01 (firmware v1.0.0 @ 48 kHz) */ - QUIRK_FLAG_GENERIC_IMPLICIT_FB), - DEVICE_FLG(0x2b53, 0x0024, /* Fiero SC-01 (firmware v1.0.0 @ 96 kHz) */ -@@ -2250,10 +2264,14 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { - QUIRK_FLAG_CTL_MSG_DELAY_1M), - DEVICE_FLG(0x2d95, 0x8021, /* VIVO USB-C-XE710 HEADSET */ - QUIRK_FLAG_CTL_MSG_DELAY_1M), -+ DEVICE_FLG(0x2d99, 0x0026, /* HECATE G2 GAMING HEADSET */ -+ QUIRK_FLAG_MIXER_MIN_MUTE), - DEVICE_FLG(0x2fc6, 0xf0b7, /* iBasso DC07 Pro */ - QUIRK_FLAG_CTL_MSG_DELAY_1M), - DEVICE_FLG(0x30be, 0x0101, /* Schiit Hel */ - QUIRK_FLAG_IGNORE_CTL_ERROR), -+ DEVICE_FLG(0x339b, 0x3a07, /* Synaptics HONOR USB-C HEADSET */ -+ QUIRK_FLAG_MIXER_MIN_MUTE), - DEVICE_FLG(0x413c, 0xa506, /* Dell AE515 sound bar */ - QUIRK_FLAG_GET_SAMPLE_RATE), - DEVICE_FLG(0x534d, 0x0021, /* MacroSilicon MS2100/MS2106 */ -@@ -2305,6 +2323,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { - QUIRK_FLAG_DSD_RAW), - VENDOR_FLG(0x2d87, /* Cayin device */ - QUIRK_FLAG_DSD_RAW), -+ VENDOR_FLG(0x2fc6, /* Comture-inc devices */ -+ QUIRK_FLAG_DSD_RAW), - VENDOR_FLG(0x3336, /* HEM devices */ - QUIRK_FLAG_DSD_RAW), - VENDOR_FLG(0x3353, /* Khadas devices */ -diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h -index ddfbe045e7a941..3c927316bc9929 100644 ---- a/sound/usb/usbaudio.h -+++ b/sound/usb/usbaudio.h -@@ -184,6 +184,9 @@ extern bool snd_usb_skip_validation; - * for the given endpoint. - * QUIRK_FLAG_MIC_RES_16 and QUIRK_FLAG_MIC_RES_384 - * Set the fixed resolution for Mic Capture Volume (mostly for webcams) -+ * QUIRK_FLAG_MIXER_MIN_MUTE -+ * Set minimum volume control value as mute for devices where the lowest -+ * playback value represents muted state instead of minimum audible volume - */ - - #define QUIRK_FLAG_GET_SAMPLE_RATE (1U << 0) -@@ -210,5 +213,6 @@ extern bool snd_usb_skip_validation; - #define QUIRK_FLAG_FIXED_RATE (1U << 21) - #define QUIRK_FLAG_MIC_RES_16 (1U << 22) - #define QUIRK_FLAG_MIC_RES_384 (1U << 23) -+#define QUIRK_FLAG_MIXER_MIN_MUTE (1U << 24) - - #endif /* __USBAUDIO_H */ -diff --git a/tools/testing/selftests/mm/mremap_test.c b/tools/testing/selftests/mm/mremap_test.c -index 5c3773de9f0f78..944645f9d2b3d7 100644 ---- a/tools/testing/selftests/mm/mremap_test.c -+++ b/tools/testing/selftests/mm/mremap_test.c -@@ -22,7 +22,9 @@ - #define VALIDATION_DEFAULT_THRESHOLD 4 /* 4MB */ - #define VALIDATION_NO_THRESHOLD 0 /* Verify the entire region */ - -+#ifndef MIN - #define MIN(X, Y) ((X) < (Y) ? (X) : (Y)) -+#endif - - struct config { - unsigned long long src_alignment; -diff --git a/tools/testing/selftests/net/fib_nexthops.sh b/tools/testing/selftests/net/fib_nexthops.sh -index a6f2c0b9555d12..e2e4fffd87e39a 100755 ---- a/tools/testing/selftests/net/fib_nexthops.sh -+++ b/tools/testing/selftests/net/fib_nexthops.sh -@@ -464,8 +464,8 @@ ipv6_fdb_grp_fcnal() - log_test $? 0 "Get Fdb nexthop group by id" - - # fdb nexthop group can only contain fdb nexthops -- run_cmd "$IP nexthop add id 63 via 2001:db8:91::4" -- run_cmd "$IP nexthop add id 64 via 2001:db8:91::5" -+ run_cmd "$IP nexthop add id 63 via 2001:db8:91::4 dev veth1" -+ run_cmd "$IP nexthop add id 64 via 2001:db8:91::5 dev veth1" - run_cmd "$IP nexthop add id 103 group 63/64 fdb" - log_test $? 2 "Fdb Nexthop group with non-fdb nexthops" - -@@ -544,15 +544,15 @@ ipv4_fdb_grp_fcnal() - log_test $? 0 "Get Fdb nexthop group by id" - - # fdb nexthop group can only contain fdb nexthops -- run_cmd "$IP nexthop add id 14 via 172.16.1.2" -- run_cmd "$IP nexthop add id 15 via 172.16.1.3" -+ run_cmd "$IP nexthop add id 14 via 172.16.1.2 dev veth1" -+ run_cmd "$IP nexthop add id 15 via 172.16.1.3 dev veth1" - run_cmd "$IP nexthop add id 103 group 14/15 fdb" - log_test $? 2 "Fdb Nexthop group with non-fdb nexthops" - - # Non fdb nexthop group can not contain fdb nexthops - run_cmd "$IP nexthop add id 16 via 172.16.1.2 fdb" - run_cmd "$IP nexthop add id 17 via 172.16.1.3 fdb" -- run_cmd "$IP nexthop add id 104 group 14/15" -+ run_cmd "$IP nexthop add id 104 group 16/17" - log_test $? 2 "Non-Fdb Nexthop group with fdb nexthops" - - # fdb nexthop cannot have blackhole -@@ -579,7 +579,7 @@ ipv4_fdb_grp_fcnal() - run_cmd "$BRIDGE fdb add 02:02:00:00:00:14 dev vx10 nhid 12 self" - log_test $? 255 "Fdb mac add with nexthop" - -- run_cmd "$IP ro add 172.16.0.0/22 nhid 15" -+ run_cmd "$IP ro add 172.16.0.0/22 nhid 16" - log_test $? 2 "Route add with fdb nexthop" - - run_cmd "$IP ro add 172.16.0.0/22 nhid 103" -diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c -index 15325ca35f1e2b..4390965c84c422 100644 ---- a/tools/testing/selftests/seccomp/seccomp_bpf.c -+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c -@@ -60,7 +60,9 @@ - #define SKIP(s, ...) XFAIL(s, ##__VA_ARGS__) - #endif - -+#ifndef MIN - #define MIN(X, Y) ((X) < (Y) ? (X) : (Y)) -+#endif - - #ifndef PR_SET_PTRACER - # define PR_SET_PTRACER 0x59616d61 diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.109-110.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.109-110.patch deleted file mode 100644 index 09637783c1..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.109-110.patch +++ /dev/null @@ -1,327 +0,0 @@ -diff --git a/Makefile b/Makefile -index afeacf5efc9553..196343089737f3 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 109 -+SUBLEVEL = 110 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/drivers/media/pci/b2c2/flexcop-pci.c b/drivers/media/pci/b2c2/flexcop-pci.c -index 486c8ec0fa60d9..ab53c5b02c48df 100644 ---- a/drivers/media/pci/b2c2/flexcop-pci.c -+++ b/drivers/media/pci/b2c2/flexcop-pci.c -@@ -411,7 +411,7 @@ static void flexcop_pci_remove(struct pci_dev *pdev) - struct flexcop_pci *fc_pci = pci_get_drvdata(pdev); - - if (irq_chk_intv > 0) -- cancel_delayed_work(&fc_pci->irq_check_work); -+ cancel_delayed_work_sync(&fc_pci->irq_check_work); - - flexcop_pci_dma_exit(fc_pci); - flexcop_device_exit(fc_pci->fc_dev); -diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c -index e5590a708f1c5d..f4deca8894e0f7 100644 ---- a/drivers/media/rc/imon.c -+++ b/drivers/media/rc/imon.c -@@ -536,7 +536,9 @@ static int display_open(struct inode *inode, struct file *file) - - mutex_lock(&ictx->lock); - -- if (!ictx->display_supported) { -+ if (ictx->disconnected) { -+ retval = -ENODEV; -+ } else if (!ictx->display_supported) { - pr_err("display not supported by device\n"); - retval = -ENODEV; - } else if (ictx->display_isopen) { -@@ -598,6 +600,9 @@ static int send_packet(struct imon_context *ictx) - int retval = 0; - struct usb_ctrlrequest *control_req = NULL; - -+ if (ictx->disconnected) -+ return -ENODEV; -+ - /* Check if we need to use control or interrupt urb */ - if (!ictx->tx_control) { - pipe = usb_sndintpipe(ictx->usbdev_intf0, -@@ -949,12 +954,14 @@ static ssize_t vfd_write(struct file *file, const char __user *buf, - static const unsigned char vfd_packet6[] = { - 0x01, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF }; - -- if (ictx->disconnected) -- return -ENODEV; -- - if (mutex_lock_interruptible(&ictx->lock)) - return -ERESTARTSYS; - -+ if (ictx->disconnected) { -+ retval = -ENODEV; -+ goto exit; -+ } -+ - if (!ictx->dev_present_intf0) { - pr_err_ratelimited("no iMON device present\n"); - retval = -ENODEV; -@@ -1029,11 +1036,13 @@ static ssize_t lcd_write(struct file *file, const char __user *buf, - int retval = 0; - struct imon_context *ictx = file->private_data; - -- if (ictx->disconnected) -- return -ENODEV; -- - mutex_lock(&ictx->lock); - -+ if (ictx->disconnected) { -+ retval = -ENODEV; -+ goto exit; -+ } -+ - if (!ictx->display_supported) { - pr_err_ratelimited("no iMON display present\n"); - retval = -ENODEV; -@@ -2499,7 +2508,11 @@ static void imon_disconnect(struct usb_interface *interface) - int ifnum; - - ictx = usb_get_intfdata(interface); -+ -+ mutex_lock(&ictx->lock); - ictx->disconnected = true; -+ mutex_unlock(&ictx->lock); -+ - dev = ictx->dev; - ifnum = interface->cur_altsetting->desc.bInterfaceNumber; - -diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c -index 09753993068a95..c7cee6b185264d 100644 ---- a/drivers/media/usb/uvc/uvc_driver.c -+++ b/drivers/media/usb/uvc/uvc_driver.c -@@ -135,6 +135,9 @@ struct uvc_entity *uvc_entity_by_id(struct uvc_device *dev, int id) - { - struct uvc_entity *entity; - -+ if (id == UVC_INVALID_ENTITY_ID) -+ return NULL; -+ - list_for_each_entry(entity, &dev->entities, list) { - if (entity->id == id) - return entity; -@@ -778,14 +781,27 @@ static const u8 uvc_media_transport_input_guid[16] = - UVC_GUID_UVC_MEDIA_TRANSPORT_INPUT; - static const u8 uvc_processing_guid[16] = UVC_GUID_UVC_PROCESSING; - --static struct uvc_entity *uvc_alloc_entity(u16 type, u16 id, -- unsigned int num_pads, unsigned int extra_size) -+static struct uvc_entity *uvc_alloc_new_entity(struct uvc_device *dev, u16 type, -+ u16 id, unsigned int num_pads, -+ unsigned int extra_size) - { - struct uvc_entity *entity; - unsigned int num_inputs; - unsigned int size; - unsigned int i; - -+ /* Per UVC 1.1+ spec 3.7.2, the ID should be non-zero. */ -+ if (id == 0) { -+ dev_err(&dev->intf->dev, "Found Unit with invalid ID 0\n"); -+ id = UVC_INVALID_ENTITY_ID; -+ } -+ -+ /* Per UVC 1.1+ spec 3.7.2, the ID is unique. */ -+ if (uvc_entity_by_id(dev, id)) { -+ dev_err(&dev->intf->dev, "Found multiple Units with ID %u\n", id); -+ id = UVC_INVALID_ENTITY_ID; -+ } -+ - extra_size = roundup(extra_size, sizeof(*entity->pads)); - if (num_pads) - num_inputs = type & UVC_TERM_OUTPUT ? num_pads : num_pads - 1; -@@ -795,7 +811,7 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u16 id, - + num_inputs; - entity = kzalloc(size, GFP_KERNEL); - if (entity == NULL) -- return NULL; -+ return ERR_PTR(-ENOMEM); - - entity->id = id; - entity->type = type; -@@ -907,10 +923,10 @@ static int uvc_parse_vendor_control(struct uvc_device *dev, - break; - } - -- unit = uvc_alloc_entity(UVC_VC_EXTENSION_UNIT, buffer[3], -- p + 1, 2*n); -- if (unit == NULL) -- return -ENOMEM; -+ unit = uvc_alloc_new_entity(dev, UVC_VC_EXTENSION_UNIT, -+ buffer[3], p + 1, 2 * n); -+ if (IS_ERR(unit)) -+ return PTR_ERR(unit); - - memcpy(unit->guid, &buffer[4], 16); - unit->extension.bNumControls = buffer[20]; -@@ -1019,10 +1035,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev, - return -EINVAL; - } - -- term = uvc_alloc_entity(type | UVC_TERM_INPUT, buffer[3], -- 1, n + p); -- if (term == NULL) -- return -ENOMEM; -+ term = uvc_alloc_new_entity(dev, type | UVC_TERM_INPUT, -+ buffer[3], 1, n + p); -+ if (IS_ERR(term)) -+ return PTR_ERR(term); - - if (UVC_ENTITY_TYPE(term) == UVC_ITT_CAMERA) { - term->camera.bControlSize = n; -@@ -1078,10 +1094,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev, - return 0; - } - -- term = uvc_alloc_entity(type | UVC_TERM_OUTPUT, buffer[3], -- 1, 0); -- if (term == NULL) -- return -ENOMEM; -+ term = uvc_alloc_new_entity(dev, type | UVC_TERM_OUTPUT, -+ buffer[3], 1, 0); -+ if (IS_ERR(term)) -+ return PTR_ERR(term); - - memcpy(term->baSourceID, &buffer[7], 1); - -@@ -1100,9 +1116,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev, - return -EINVAL; - } - -- unit = uvc_alloc_entity(buffer[2], buffer[3], p + 1, 0); -- if (unit == NULL) -- return -ENOMEM; -+ unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3], -+ p + 1, 0); -+ if (IS_ERR(unit)) -+ return PTR_ERR(unit); - - memcpy(unit->baSourceID, &buffer[5], p); - -@@ -1122,9 +1139,9 @@ static int uvc_parse_standard_control(struct uvc_device *dev, - return -EINVAL; - } - -- unit = uvc_alloc_entity(buffer[2], buffer[3], 2, n); -- if (unit == NULL) -- return -ENOMEM; -+ unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3], 2, n); -+ if (IS_ERR(unit)) -+ return PTR_ERR(unit); - - memcpy(unit->baSourceID, &buffer[4], 1); - unit->processing.wMaxMultiplier = -@@ -1151,9 +1168,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev, - return -EINVAL; - } - -- unit = uvc_alloc_entity(buffer[2], buffer[3], p + 1, n); -- if (unit == NULL) -- return -ENOMEM; -+ unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3], -+ p + 1, n); -+ if (IS_ERR(unit)) -+ return PTR_ERR(unit); - - memcpy(unit->guid, &buffer[4], 16); - unit->extension.bNumControls = buffer[20]; -@@ -1293,9 +1311,10 @@ static int uvc_gpio_parse(struct uvc_device *dev) - return dev_err_probe(&dev->intf->dev, irq, - "No IRQ for privacy GPIO\n"); - -- unit = uvc_alloc_entity(UVC_EXT_GPIO_UNIT, UVC_EXT_GPIO_UNIT_ID, 0, 1); -- if (!unit) -- return -ENOMEM; -+ unit = uvc_alloc_new_entity(dev, UVC_EXT_GPIO_UNIT, -+ UVC_EXT_GPIO_UNIT_ID, 0, 1); -+ if (IS_ERR(unit)) -+ return PTR_ERR(unit); - - unit->gpio.gpio_privacy = gpio_privacy; - unit->gpio.irq = irq; -diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h -index e99bfaa622669b..cbb5ce963cd097 100644 ---- a/drivers/media/usb/uvc/uvcvideo.h -+++ b/drivers/media/usb/uvc/uvcvideo.h -@@ -41,6 +41,8 @@ - #define UVC_EXT_GPIO_UNIT 0x7ffe - #define UVC_EXT_GPIO_UNIT_ID 0x100 - -+#define UVC_INVALID_ENTITY_ID 0xffff -+ - /* ------------------------------------------------------------------------ - * Driver specific constants. - */ -diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c -index 9a88774836c9db..eddcfd09c05b86 100644 ---- a/drivers/target/target_core_configfs.c -+++ b/drivers/target/target_core_configfs.c -@@ -2738,7 +2738,7 @@ static ssize_t target_lu_gp_members_show(struct config_item *item, char *page) - config_item_name(&dev->dev_group.cg_item)); - cur_len++; /* Extra byte for NULL terminator */ - -- if ((cur_len + len) > PAGE_SIZE) { -+ if ((cur_len + len) > PAGE_SIZE || cur_len > LU_GROUP_NAME_BUF) { - pr_warn("Ran out of lu_gp_show_attr" - "_members buffer\n"); - break; -diff --git a/include/crypto/sha256_base.h b/include/crypto/sha256_base.h -index ab904d82236fb8..0f5f3a6f79f0cf 100644 ---- a/include/crypto/sha256_base.h -+++ b/include/crypto/sha256_base.h -@@ -44,7 +44,7 @@ static inline int lib_sha256_base_do_update(struct sha256_state *sctx, - sctx->count += len; - - if (unlikely((partial + len) >= SHA256_BLOCK_SIZE)) { -- int blocks; -+ unsigned int blocks; - - if (partial) { - int p = SHA256_BLOCK_SIZE - partial; -diff --git a/scripts/gcc-plugins/gcc-common.h b/scripts/gcc-plugins/gcc-common.h -index 90e83d62adb547..de1e4c927cbc76 100644 ---- a/scripts/gcc-plugins/gcc-common.h -+++ b/scripts/gcc-plugins/gcc-common.h -@@ -196,10 +196,17 @@ inline bool is_a_helper::test(const_gimple gs) - } - #endif - -+#if BUILDING_GCC_VERSION < 16000 - #define TODO_verify_ssa TODO_verify_il - #define TODO_verify_flow TODO_verify_il - #define TODO_verify_stmts TODO_verify_il - #define TODO_verify_rtl_sharing TODO_verify_il -+#else -+#define TODO_verify_ssa 0 -+#define TODO_verify_flow 0 -+#define TODO_verify_stmts 0 -+#define TODO_verify_rtl_sharing 0 -+#endif - - #define INSN_DELETED_P(insn) (insn)->deleted() - -diff --git a/sound/soc/qcom/qdsp6/topology.c b/sound/soc/qcom/qdsp6/topology.c -index 70572c83e1017d..d4c3bc85fb3562 100644 ---- a/sound/soc/qcom/qdsp6/topology.c -+++ b/sound/soc/qcom/qdsp6/topology.c -@@ -586,8 +586,8 @@ static int audioreach_widget_load_module_common(struct snd_soc_component *compon - return PTR_ERR(cont); - - mod = audioreach_parse_common_tokens(apm, cont, &tplg_w->priv, w); -- if (IS_ERR(mod)) -- return PTR_ERR(mod); -+ if (IS_ERR_OR_NULL(mod)) -+ return mod ? PTR_ERR(mod) : -ENODEV; - - dobj = &w->dobj; - dobj->private = mod; diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.110-111.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.110-111.patch deleted file mode 100644 index c7965c371e..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.110-111.patch +++ /dev/null @@ -1,860 +0,0 @@ -diff --git a/Makefile b/Makefile -index 196343089737f3..9531c465e9c240 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 110 -+SUBLEVEL = 111 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c -index d0d836448a76b2..83827384982e49 100644 ---- a/arch/arm64/kernel/fpsimd.c -+++ b/arch/arm64/kernel/fpsimd.c -@@ -1873,13 +1873,17 @@ static void fpsimd_flush_cpu_state(void) - */ - void fpsimd_save_and_flush_cpu_state(void) - { -+ unsigned long flags; -+ - if (!system_supports_fpsimd()) - return; - WARN_ON(preemptible()); -- get_cpu_fpsimd_context(); -+ local_irq_save(flags); -+ __get_cpu_fpsimd_context(); - fpsimd_save(); - fpsimd_flush_cpu_state(); -- put_cpu_fpsimd_context(); -+ __put_cpu_fpsimd_context(); -+ local_irq_restore(flags); - } - - #ifdef CONFIG_KERNEL_MODE_NEON -diff --git a/arch/riscv/include/asm/processor.h b/arch/riscv/include/asm/processor.h -index 4f6af8c6cfa060..4747277983ad1a 100644 ---- a/arch/riscv/include/asm/processor.h -+++ b/arch/riscv/include/asm/processor.h -@@ -13,42 +13,19 @@ - - #include - --#ifdef CONFIG_64BIT --#define DEFAULT_MAP_WINDOW (UL(1) << (MMAP_VA_BITS - 1)) --#define STACK_TOP_MAX TASK_SIZE -- - #define arch_get_mmap_end(addr, len, flags) \ - ({ \ -- unsigned long mmap_end; \ -- typeof(addr) _addr = (addr); \ -- if ((_addr) == 0 || (IS_ENABLED(CONFIG_COMPAT) && is_compat_task())) \ -- mmap_end = STACK_TOP_MAX; \ -- else if ((_addr) >= VA_USER_SV57) \ -- mmap_end = STACK_TOP_MAX; \ -- else if ((((_addr) >= VA_USER_SV48)) && (VA_BITS >= VA_BITS_SV48)) \ -- mmap_end = VA_USER_SV48; \ -- else \ -- mmap_end = VA_USER_SV39; \ -- mmap_end; \ -+ STACK_TOP_MAX; \ - }) - - #define arch_get_mmap_base(addr, base) \ - ({ \ -- unsigned long mmap_base; \ -- typeof(addr) _addr = (addr); \ -- typeof(base) _base = (base); \ -- unsigned long rnd_gap = DEFAULT_MAP_WINDOW - (_base); \ -- if ((_addr) == 0 || (IS_ENABLED(CONFIG_COMPAT) && is_compat_task())) \ -- mmap_base = (_base); \ -- else if (((_addr) >= VA_USER_SV57) && (VA_BITS >= VA_BITS_SV57)) \ -- mmap_base = VA_USER_SV57 - rnd_gap; \ -- else if ((((_addr) >= VA_USER_SV48)) && (VA_BITS >= VA_BITS_SV48)) \ -- mmap_base = VA_USER_SV48 - rnd_gap; \ -- else \ -- mmap_base = VA_USER_SV39 - rnd_gap; \ -- mmap_base; \ -+ base; \ - }) - -+#ifdef CONFIG_64BIT -+#define DEFAULT_MAP_WINDOW (UL(1) << (MMAP_VA_BITS - 1)) -+#define STACK_TOP_MAX TASK_SIZE - #else - #define DEFAULT_MAP_WINDOW TASK_SIZE - #define STACK_TOP_MAX TASK_SIZE -diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index 2673cd5c46cb48..313cb2ffd6aae6 100644 ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -5134,12 +5134,11 @@ void init_decode_cache(struct x86_emulate_ctxt *ctxt) - ctxt->mem_read.end = 0; - } - --int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) -+int x86_emulate_insn(struct x86_emulate_ctxt *ctxt, bool check_intercepts) - { - const struct x86_emulate_ops *ops = ctxt->ops; - int rc = X86EMUL_CONTINUE; - int saved_dst_type = ctxt->dst.type; -- bool is_guest_mode = ctxt->ops->is_guest_mode(ctxt); - - ctxt->mem_read.pos = 0; - -@@ -5187,7 +5186,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) - fetch_possible_mmx_operand(&ctxt->dst); - } - -- if (unlikely(is_guest_mode) && ctxt->intercept) { -+ if (unlikely(check_intercepts) && ctxt->intercept) { - rc = emulator_check_intercept(ctxt, ctxt->intercept, - X86_ICPT_PRE_EXCEPT); - if (rc != X86EMUL_CONTINUE) -@@ -5216,7 +5215,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) - goto done; - } - -- if (unlikely(is_guest_mode) && (ctxt->d & Intercept)) { -+ if (unlikely(check_intercepts) && (ctxt->d & Intercept)) { - rc = emulator_check_intercept(ctxt, ctxt->intercept, - X86_ICPT_POST_EXCEPT); - if (rc != X86EMUL_CONTINUE) -@@ -5270,7 +5269,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) - - special_insn: - -- if (unlikely(is_guest_mode) && (ctxt->d & Intercept)) { -+ if (unlikely(check_intercepts) && (ctxt->d & Intercept)) { - rc = emulator_check_intercept(ctxt, ctxt->intercept, - X86_ICPT_POST_MEMACCESS); - if (rc != X86EMUL_CONTINUE) -diff --git a/arch/x86/kvm/kvm_emulate.h b/arch/x86/kvm/kvm_emulate.h -index be7aeb9b8ea3b1..b940ee604bd849 100644 ---- a/arch/x86/kvm/kvm_emulate.h -+++ b/arch/x86/kvm/kvm_emulate.h -@@ -220,7 +220,6 @@ struct x86_emulate_ops { - void (*set_nmi_mask)(struct x86_emulate_ctxt *ctxt, bool masked); - - bool (*is_smm)(struct x86_emulate_ctxt *ctxt); -- bool (*is_guest_mode)(struct x86_emulate_ctxt *ctxt); - int (*leave_smm)(struct x86_emulate_ctxt *ctxt); - void (*triple_fault)(struct x86_emulate_ctxt *ctxt); - int (*set_xcr)(struct x86_emulate_ctxt *ctxt, u32 index, u64 xcr); -@@ -498,7 +497,7 @@ bool x86_page_table_writing_insn(struct x86_emulate_ctxt *ctxt); - #define EMULATION_RESTART 1 - #define EMULATION_INTERCEPTED 2 - void init_decode_cache(struct x86_emulate_ctxt *ctxt); --int x86_emulate_insn(struct x86_emulate_ctxt *ctxt); -+int x86_emulate_insn(struct x86_emulate_ctxt *ctxt, bool check_intercepts); - int emulator_task_switch(struct x86_emulate_ctxt *ctxt, - u16 tss_selector, int idt_index, int reason, - bool has_error_code, u32 error_code); -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 7238686a49bb5a..71d60d4e991fd3 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -8308,11 +8308,6 @@ static bool emulator_is_smm(struct x86_emulate_ctxt *ctxt) - return is_smm(emul_to_vcpu(ctxt)); - } - --static bool emulator_is_guest_mode(struct x86_emulate_ctxt *ctxt) --{ -- return is_guest_mode(emul_to_vcpu(ctxt)); --} -- - #ifndef CONFIG_KVM_SMM - static int emulator_leave_smm(struct x86_emulate_ctxt *ctxt) - { -@@ -8379,7 +8374,6 @@ static const struct x86_emulate_ops emulate_ops = { - .guest_has_rdpid = emulator_guest_has_rdpid, - .set_nmi_mask = emulator_set_nmi_mask, - .is_smm = emulator_is_smm, -- .is_guest_mode = emulator_is_guest_mode, - .leave_smm = emulator_leave_smm, - .triple_fault = emulator_triple_fault, - .set_xcr = emulator_set_xcr, -@@ -8999,7 +8993,14 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, - ctxt->exception.address = 0; - } - -- r = x86_emulate_insn(ctxt); -+ /* -+ * Check L1's instruction intercepts when emulating instructions for -+ * L2, unless KVM is re-emulating a previously decoded instruction, -+ * e.g. to complete userspace I/O, in which case KVM has already -+ * checked the intercepts. -+ */ -+ r = x86_emulate_insn(ctxt, is_guest_mode(vcpu) && -+ !(emulation_type & EMULTYPE_NO_DECODE)); - - if (r == EMULATION_INTERCEPTED) - return 1; -diff --git a/crypto/rng.c b/crypto/rng.c -index 279dffdebf5981..e462031fef68c6 100644 ---- a/crypto/rng.c -+++ b/crypto/rng.c -@@ -197,6 +197,11 @@ int crypto_del_default_rng(void) - EXPORT_SYMBOL_GPL(crypto_del_default_rng); - #endif - -+static void rng_default_set_ent(struct crypto_rng *tfm, const u8 *data, -+ unsigned int len) -+{ -+} -+ - int crypto_register_rng(struct rng_alg *alg) - { - struct crypto_istat_rng *istat = rng_get_stat(alg); -@@ -212,6 +217,9 @@ int crypto_register_rng(struct rng_alg *alg) - if (IS_ENABLED(CONFIG_CRYPTO_STATS)) - memset(istat, 0, sizeof(*istat)); - -+ if (!alg->set_ent) -+ alg->set_ent = rng_default_set_ent; -+ - return crypto_register_alg(base); - } - EXPORT_SYMBOL_GPL(crypto_register_rng); -diff --git a/drivers/hid/hid-mcp2221.c b/drivers/hid/hid-mcp2221.c -index a985301a4135f5..d2d413c829f44a 100644 ---- a/drivers/hid/hid-mcp2221.c -+++ b/drivers/hid/hid-mcp2221.c -@@ -814,6 +814,10 @@ static int mcp2221_raw_event(struct hid_device *hdev, - } - if (data[2] == MCP2221_I2C_READ_COMPL || - data[2] == MCP2221_I2C_READ_PARTIAL) { -+ if (!mcp->rxbuf || mcp->rxbuf_idx < 0 || data[3] > 60) { -+ mcp->status = -EINVAL; -+ break; -+ } - buf = mcp->rxbuf; - memcpy(&buf[mcp->rxbuf_idx], &data[4], data[3]); - mcp->rxbuf_idx = mcp->rxbuf_idx + data[3]; -diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c -index 0bd76f8d4dc6b8..6442d41622eff9 100644 ---- a/drivers/md/dm-integrity.c -+++ b/drivers/md/dm-integrity.c -@@ -129,7 +129,7 @@ struct journal_sector { - commit_id_t commit_id; - }; - --#define MAX_TAG_SIZE (JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK])) -+#define MAX_TAG_SIZE 255 - - #define METADATA_PADDING_SECTORS 8 - -diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c -index 8a1a33862ba712..4b6ad85cf261de 100644 ---- a/drivers/media/i2c/tc358743.c -+++ b/drivers/media/i2c/tc358743.c -@@ -2180,10 +2180,10 @@ static int tc358743_probe(struct i2c_client *client) - err_work_queues: - cec_unregister_adapter(state->cec_adap); - if (!state->i2c_client->irq) { -- del_timer(&state->timer); -+ timer_delete_sync(&state->timer); - flush_work(&state->work_i2c_poll); - } -- cancel_delayed_work(&state->delayed_work_enable_hotplug); -+ cancel_delayed_work_sync(&state->delayed_work_enable_hotplug); - mutex_destroy(&state->confctl_mutex); - err_hdl: - media_entity_cleanup(&sd->entity); -diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c -index 2182e5b7b6064c..ec9a3cd4784e1f 100644 ---- a/drivers/media/tuners/xc5000.c -+++ b/drivers/media/tuners/xc5000.c -@@ -58,7 +58,7 @@ struct xc5000_priv { - struct dvb_frontend *fe; - struct delayed_work timer_sleep; - -- const struct firmware *firmware; -+ bool inited; - }; - - /* Misc Defines */ -@@ -1110,23 +1110,19 @@ static int xc_load_fw_and_init_tuner(struct dvb_frontend *fe, int force) - if (!force && xc5000_is_firmware_loaded(fe) == 0) - return 0; - -- if (!priv->firmware) { -- ret = request_firmware(&fw, desired_fw->name, -- priv->i2c_props.adap->dev.parent); -- if (ret) { -- pr_err("xc5000: Upload failed. rc %d\n", ret); -- return ret; -- } -- dprintk(1, "firmware read %zu bytes.\n", fw->size); -+ ret = request_firmware(&fw, desired_fw->name, -+ priv->i2c_props.adap->dev.parent); -+ if (ret) { -+ pr_err("xc5000: Upload failed. rc %d\n", ret); -+ return ret; -+ } -+ dprintk(1, "firmware read %zu bytes.\n", fw->size); - -- if (fw->size != desired_fw->size) { -- pr_err("xc5000: Firmware file with incorrect size\n"); -- release_firmware(fw); -- return -EINVAL; -- } -- priv->firmware = fw; -- } else -- fw = priv->firmware; -+ if (fw->size != desired_fw->size) { -+ pr_err("xc5000: Firmware file with incorrect size\n"); -+ release_firmware(fw); -+ return -EINVAL; -+ } - - /* Try up to 5 times to load firmware */ - for (i = 0; i < 5; i++) { -@@ -1204,6 +1200,7 @@ static int xc_load_fw_and_init_tuner(struct dvb_frontend *fe, int force) - } - - err: -+ release_firmware(fw); - if (!ret) - printk(KERN_INFO "xc5000: Firmware %s loaded and running.\n", - desired_fw->name); -@@ -1274,7 +1271,7 @@ static int xc5000_resume(struct dvb_frontend *fe) - - /* suspended before firmware is loaded. - Avoid firmware load in resume path. */ -- if (!priv->firmware) -+ if (!priv->inited) - return 0; - - return xc5000_set_params(fe); -@@ -1293,6 +1290,8 @@ static int xc5000_init(struct dvb_frontend *fe) - if (debug) - xc_debug_dump(priv); - -+ priv->inited = true; -+ - return 0; - } - -@@ -1305,11 +1304,7 @@ static void xc5000_release(struct dvb_frontend *fe) - mutex_lock(&xc5000_list_mutex); - - if (priv) { -- cancel_delayed_work(&priv->timer_sleep); -- if (priv->firmware) { -- release_firmware(priv->firmware); -- priv->firmware = NULL; -- } -+ cancel_delayed_work_sync(&priv->timer_sleep); - hybrid_tuner_release_state(priv); - } - -diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c -index e501b55678d1dc..ae4ebcee607792 100644 ---- a/drivers/net/can/rcar/rcar_canfd.c -+++ b/drivers/net/can/rcar/rcar_canfd.c -@@ -738,9 +738,6 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv) - /* Reset Global error flags */ - rcar_canfd_write(gpriv->base, RCANFD_GERFL, 0x0); - -- /* Set the controller into appropriate mode */ -- rcar_canfd_set_mode(gpriv); -- - /* Transition all Channels to reset mode */ - for_each_set_bit(ch, &gpriv->channels_mask, gpriv->info->max_channels) { - rcar_canfd_clear_bit(gpriv->base, -@@ -760,6 +757,10 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv) - return err; - } - } -+ -+ /* Set the controller into appropriate mode */ -+ rcar_canfd_set_mode(gpriv); -+ - return 0; - } - -diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c -index 57ea7dfe8a596f..1acd4fc7adc8bf 100644 ---- a/drivers/net/can/spi/hi311x.c -+++ b/drivers/net/can/spi/hi311x.c -@@ -545,8 +545,6 @@ static int hi3110_stop(struct net_device *net) - - priv->force_quit = 1; - free_irq(spi->irq, priv); -- destroy_workqueue(priv->wq); -- priv->wq = NULL; - - mutex_lock(&priv->hi3110_lock); - -@@ -771,34 +769,23 @@ static int hi3110_open(struct net_device *net) - goto out_close; - } - -- priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM, -- 0); -- if (!priv->wq) { -- ret = -ENOMEM; -- goto out_free_irq; -- } -- INIT_WORK(&priv->tx_work, hi3110_tx_work_handler); -- INIT_WORK(&priv->restart_work, hi3110_restart_work_handler); -- - ret = hi3110_hw_reset(spi); - if (ret) -- goto out_free_wq; -+ goto out_free_irq; - - ret = hi3110_setup(net); - if (ret) -- goto out_free_wq; -+ goto out_free_irq; - - ret = hi3110_set_normal_mode(spi); - if (ret) -- goto out_free_wq; -+ goto out_free_irq; - - netif_wake_queue(net); - mutex_unlock(&priv->hi3110_lock); - - return 0; - -- out_free_wq: -- destroy_workqueue(priv->wq); - out_free_irq: - free_irq(spi->irq, priv); - hi3110_hw_sleep(spi); -@@ -915,6 +902,15 @@ static int hi3110_can_probe(struct spi_device *spi) - if (ret) - goto out_clk; - -+ priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM, -+ 0); -+ if (!priv->wq) { -+ ret = -ENOMEM; -+ goto out_clk; -+ } -+ INIT_WORK(&priv->tx_work, hi3110_tx_work_handler); -+ INIT_WORK(&priv->restart_work, hi3110_restart_work_handler); -+ - priv->spi = spi; - mutex_init(&priv->hi3110_lock); - -@@ -950,6 +946,8 @@ static int hi3110_can_probe(struct spi_device *spi) - return 0; - - error_probe: -+ destroy_workqueue(priv->wq); -+ priv->wq = NULL; - hi3110_power_enable(priv->power, 0); - - out_clk: -@@ -970,6 +968,9 @@ static void hi3110_can_remove(struct spi_device *spi) - - hi3110_power_enable(priv->power, 0); - -+ destroy_workqueue(priv->wq); -+ priv->wq = NULL; -+ - clk_disable_unprepare(priv->clk); - - free_candev(net); -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c -index e6403d4c937c8c..a0c0932a85d1e9 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c -@@ -294,7 +294,6 @@ static const struct usb_device_id rtl8192c_usb_ids[] = { - {RTL_USB_DEVICE(0x050d, 0x1102, rtl92cu_hal_cfg)}, /*Belkin - Edimax*/ - {RTL_USB_DEVICE(0x050d, 0x11f2, rtl92cu_hal_cfg)}, /*Belkin - ISY*/ - {RTL_USB_DEVICE(0x06f8, 0xe033, rtl92cu_hal_cfg)}, /*Hercules - Edimax*/ -- {RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/ - {RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/ - {RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/ - {RTL_USB_DEVICE(0x0846, 0x9043, rtl92cu_hal_cfg)}, /*NG WNA1000Mv2*/ -diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c -index 6f5437d210a617..9fd2829ee2ab48 100644 ---- a/drivers/platform/x86/amd/pmc/pmc-quirks.c -+++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c -@@ -233,6 +233,14 @@ static const struct dmi_system_id fwbug_list[] = { - DMI_MATCH(DMI_BOARD_NAME, "WUJIE14-GX4HRXL"), - } - }, -+ { -+ .ident = "MECHREVO Yilong15Pro Series GM5HG7A", -+ .driver_data = &quirk_spurious_8042, -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "MECHREVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Yilong15Pro Series GM5HG7A"), -+ } -+ }, - /* https://bugzilla.kernel.org/show_bug.cgi?id=220116 */ - { - .ident = "PCSpecialist Lafite Pro V 14M", -@@ -242,6 +250,13 @@ static const struct dmi_system_id fwbug_list[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "Lafite Pro V 14M"), - } - }, -+ { -+ .ident = "TUXEDO Stellaris Slim 15 AMD Gen6", -+ .driver_data = &quirk_spurious_8042, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_NAME, "GMxHGxx"), -+ } -+ }, - { - .ident = "TUXEDO InfinityBook Pro 14/15 AMD Gen10", - .driver_data = &quirk_spurious_8042, -diff --git a/drivers/staging/axis-fifo/axis-fifo.c b/drivers/staging/axis-fifo/axis-fifo.c -index f667b3b62f1883..4c38eeda53c4e7 100644 ---- a/drivers/staging/axis-fifo/axis-fifo.c -+++ b/drivers/staging/axis-fifo/axis-fifo.c -@@ -42,7 +42,6 @@ - #define DRIVER_NAME "axis_fifo" - - #define READ_BUF_SIZE 128U /* read buffer length in words */ --#define WRITE_BUF_SIZE 128U /* write buffer length in words */ - - /* ---------------------------- - * IP register offsets -@@ -397,6 +396,7 @@ static ssize_t axis_fifo_read(struct file *f, char __user *buf, - } - - bytes_available = ioread32(fifo->base_addr + XLLF_RLR_OFFSET); -+ words_available = bytes_available / sizeof(u32); - if (!bytes_available) { - dev_err(fifo->dt_device, "received a packet of length 0\n"); - ret = -EIO; -@@ -407,7 +407,7 @@ static ssize_t axis_fifo_read(struct file *f, char __user *buf, - dev_err(fifo->dt_device, "user read buffer too small (available bytes=%zu user buffer bytes=%zu)\n", - bytes_available, len); - ret = -EINVAL; -- goto end_unlock; -+ goto err_flush_rx; - } - - if (bytes_available % sizeof(u32)) { -@@ -416,11 +416,9 @@ static ssize_t axis_fifo_read(struct file *f, char __user *buf, - */ - dev_err(fifo->dt_device, "received a packet that isn't word-aligned\n"); - ret = -EIO; -- goto end_unlock; -+ goto err_flush_rx; - } - -- words_available = bytes_available / sizeof(u32); -- - /* read data into an intermediate buffer, copying the contents - * to userspace when the buffer is full - */ -@@ -432,18 +430,23 @@ static ssize_t axis_fifo_read(struct file *f, char __user *buf, - tmp_buf[i] = ioread32(fifo->base_addr + - XLLF_RDFD_OFFSET); - } -+ words_available -= copy; - - if (copy_to_user(buf + copied * sizeof(u32), tmp_buf, - copy * sizeof(u32))) { - ret = -EFAULT; -- goto end_unlock; -+ goto err_flush_rx; - } - - copied += copy; -- words_available -= copy; - } -+ mutex_unlock(&fifo->read_lock); -+ -+ return bytes_available; - -- ret = bytes_available; -+err_flush_rx: -+ while (words_available--) -+ ioread32(fifo->base_addr + XLLF_RDFD_OFFSET); - - end_unlock: - mutex_unlock(&fifo->read_lock); -@@ -471,11 +474,8 @@ static ssize_t axis_fifo_write(struct file *f, const char __user *buf, - { - struct axis_fifo *fifo = (struct axis_fifo *)f->private_data; - unsigned int words_to_write; -- unsigned int copied; -- unsigned int copy; -- unsigned int i; -+ u32 *txbuf; - int ret; -- u32 tmp_buf[WRITE_BUF_SIZE]; - - if (len % sizeof(u32)) { - dev_err(fifo->dt_device, -@@ -491,11 +491,17 @@ static ssize_t axis_fifo_write(struct file *f, const char __user *buf, - return -EINVAL; - } - -- if (words_to_write > fifo->tx_fifo_depth) { -- dev_err(fifo->dt_device, "tried to write more words [%u] than slots in the fifo buffer [%u]\n", -- words_to_write, fifo->tx_fifo_depth); -+ /* -+ * In 'Store-and-Forward' mode, the maximum packet that can be -+ * transmitted is limited by the size of the FIFO, which is -+ * (C_TX_FIFO_DEPTH–4)*(data interface width/8) bytes. -+ * -+ * Do not attempt to send a packet larger than 'tx_fifo_depth - 4', -+ * otherwise a 'Transmit Packet Overrun Error' interrupt will be -+ * raised, which requires a reset of the TX circuit to recover. -+ */ -+ if (words_to_write > (fifo->tx_fifo_depth - 4)) - return -EINVAL; -- } - - if (fifo->write_flags & O_NONBLOCK) { - /* -@@ -534,32 +540,20 @@ static ssize_t axis_fifo_write(struct file *f, const char __user *buf, - } - } - -- /* write data from an intermediate buffer into the fifo IP, refilling -- * the buffer with userspace data as needed -- */ -- copied = 0; -- while (words_to_write > 0) { -- copy = min(words_to_write, WRITE_BUF_SIZE); -- -- if (copy_from_user(tmp_buf, buf + copied * sizeof(u32), -- copy * sizeof(u32))) { -- ret = -EFAULT; -- goto end_unlock; -- } -- -- for (i = 0; i < copy; i++) -- iowrite32(tmp_buf[i], fifo->base_addr + -- XLLF_TDFD_OFFSET); -- -- copied += copy; -- words_to_write -= copy; -+ txbuf = vmemdup_user(buf, len); -+ if (IS_ERR(txbuf)) { -+ ret = PTR_ERR(txbuf); -+ goto end_unlock; - } - -- ret = copied * sizeof(u32); -+ for (int i = 0; i < words_to_write; ++i) -+ iowrite32(txbuf[i], fifo->base_addr + XLLF_TDFD_OFFSET); - - /* write packet size to fifo */ -- iowrite32(ret, fifo->base_addr + XLLF_TLR_OFFSET); -+ iowrite32(len, fifo->base_addr + XLLF_TLR_OFFSET); - -+ ret = len; -+ kvfree(txbuf); - end_unlock: - mutex_unlock(&fifo->write_lock); - -diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig -index bdc568a4ab6693..4f57833e3ec742 100644 ---- a/drivers/tty/serial/Kconfig -+++ b/drivers/tty/serial/Kconfig -@@ -1405,7 +1405,7 @@ config SERIAL_STM32 - - config SERIAL_STM32_CONSOLE - bool "Support for console on STM32" -- depends on SERIAL_STM32=y -+ depends on SERIAL_STM32 - select SERIAL_CORE_CONSOLE - select SERIAL_EARLYCON - -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index ef546f660b9927..dca610369ca94a 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -2114,6 +2114,12 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) }, /* Simcom SIM7500/SIM7600 MBIM mode */ - { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9011, 0xff), /* Simcom SIM7500/SIM7600 RNDIS mode */ - .driver_info = RSVD(7) }, -+ { USB_DEVICE(0x1e0e, 0x9071), /* Simcom SIM8230 RMNET mode */ -+ .driver_info = RSVD(3) | RSVD(4) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9078, 0xff), /* Simcom SIM8230 ECM mode */ -+ .driver_info = RSVD(5) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x907b, 0xff), /* Simcom SIM8230 RNDIS mode */ -+ .driver_info = RSVD(5) }, - { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9205, 0xff) }, /* Simcom SIM7070/SIM7080/SIM7090 AT+ECM mode */ - { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9206, 0xff) }, /* Simcom SIM7070/SIM7080/SIM7090 AT-only mode */ - { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200), -diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c -index 28ac7995716e04..b8122582d75556 100644 ---- a/fs/btrfs/ref-verify.c -+++ b/fs/btrfs/ref-verify.c -@@ -990,11 +990,18 @@ int btrfs_build_ref_tree(struct btrfs_fs_info *fs_info) - if (!btrfs_test_opt(fs_info, REF_VERIFY)) - return 0; - -+ extent_root = btrfs_extent_root(fs_info, 0); -+ /* If the extent tree is damaged we cannot ignore it (IGNOREBADROOTS). */ -+ if (IS_ERR(extent_root)) { -+ btrfs_warn(fs_info, "ref-verify: extent tree not available, disabling"); -+ btrfs_clear_opt(fs_info->mount_opt, REF_VERIFY); -+ return 0; -+ } -+ - path = btrfs_alloc_path(); - if (!path) - return -ENOMEM; - -- extent_root = btrfs_extent_root(fs_info, 0); - eb = btrfs_read_lock_root_node(extent_root); - level = btrfs_header_level(eb); - path->nodes[level] = eb; -diff --git a/include/linux/device.h b/include/linux/device.h -index 3627b26b243e61..e5f1a773dc5470 100644 ---- a/include/linux/device.h -+++ b/include/linux/device.h -@@ -968,6 +968,9 @@ static inline bool device_pm_not_required(struct device *dev) - static inline void device_set_pm_not_required(struct device *dev) - { - dev->power.no_pm = true; -+#ifdef CONFIG_PM -+ dev->power.no_callbacks = true; -+#endif - } - - static inline void dev_pm_syscore_device(struct device *dev, bool val) -diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c -index d0eb03ada704dc..a1e3cb48621a90 100644 ---- a/net/9p/trans_fd.c -+++ b/net/9p/trans_fd.c -@@ -719,10 +719,10 @@ static int p9_fd_cancelled(struct p9_client *client, struct p9_req_t *req) - p9_debug(P9_DEBUG_TRANS, "client %p req %p\n", client, req); - - spin_lock(&m->req_lock); -- /* Ignore cancelled request if message has been received -- * before lock. -- */ -- if (req->status == REQ_STATUS_RCVD) { -+ /* Ignore cancelled request if status changed since the request was -+ * processed in p9_client_flush() -+ */ -+ if (req->status != REQ_STATUS_SENT) { - spin_unlock(&m->req_lock); - return 0; - } -diff --git a/sound/soc/amd/acp/amd.h b/sound/soc/amd/acp/amd.h -index d6cfae6ec5f74a..3f1761755b8660 100644 ---- a/sound/soc/amd/acp/amd.h -+++ b/sound/soc/amd/acp/amd.h -@@ -116,7 +116,7 @@ - #define PDM_DMA_INTR_MASK 0x10000 - #define PDM_DEC_64 0x2 - #define PDM_CLK_FREQ_MASK 0x07 --#define PDM_MISC_CTRL_MASK 0x10 -+#define PDM_MISC_CTRL_MASK 0x18 - #define PDM_ENABLE 0x01 - #define PDM_DISABLE 0x00 - #define DMA_EN_MASK 0x02 -diff --git a/sound/soc/codecs/rt5682s.c b/sound/soc/codecs/rt5682s.c -index 92c647d439ec7f..89de427c19e793 100644 ---- a/sound/soc/codecs/rt5682s.c -+++ b/sound/soc/codecs/rt5682s.c -@@ -653,14 +653,15 @@ static void rt5682s_sar_power_mode(struct snd_soc_component *component, int mode - switch (mode) { - case SAR_PWR_SAVING: - snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_3, -- RT5682S_CBJ_IN_BUF_MASK, RT5682S_CBJ_IN_BUF_DIS); -+ RT5682S_CBJ_IN_BUF_MASK, RT5682S_CBJ_IN_BUF_EN); - snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_1, -- RT5682S_MB1_PATH_MASK | RT5682S_MB2_PATH_MASK, -- RT5682S_CTRL_MB1_REG | RT5682S_CTRL_MB2_REG); -+ RT5682S_MB1_PATH_MASK | RT5682S_MB2_PATH_MASK | -+ RT5682S_VREF_POW_MASK, RT5682S_CTRL_MB1_FSM | -+ RT5682S_CTRL_MB2_FSM | RT5682S_VREF_POW_FSM); - snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, - RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK | - RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS | -- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU); -+ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU); - usleep_range(5000, 5500); - snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, - RT5682S_SAR_BUTDET_MASK, RT5682S_SAR_BUTDET_EN); -@@ -688,7 +689,7 @@ static void rt5682s_sar_power_mode(struct snd_soc_component *component, int mode - snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, - RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK | - RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS | -- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU); -+ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU); - break; - default: - dev_err(component->dev, "Invalid SAR Power mode: %d\n", mode); -@@ -725,7 +726,7 @@ static void rt5682s_disable_push_button_irq(struct snd_soc_component *component) - snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, - RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK | - RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS | -- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU); -+ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU); - } - - /** -@@ -786,7 +787,7 @@ static int rt5682s_headset_detect(struct snd_soc_component *component, int jack_ - jack_type = SND_JACK_HEADSET; - snd_soc_component_write(component, RT5682S_SAR_IL_CMD_3, 0x024c); - snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_1, -- RT5682S_FAST_OFF_MASK, RT5682S_FAST_OFF_EN); -+ RT5682S_FAST_OFF_MASK, RT5682S_FAST_OFF_DIS); - snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, - RT5682S_SAR_SEL_MB1_2_MASK, val << RT5682S_SAR_SEL_MB1_2_SFT); - rt5682s_enable_push_button_irq(component); -@@ -966,7 +967,7 @@ static int rt5682s_set_jack_detect(struct snd_soc_component *component, - RT5682S_EMB_JD_MASK | RT5682S_DET_TYPE | - RT5682S_POL_FAST_OFF_MASK | RT5682S_MIC_CAP_MASK, - RT5682S_EMB_JD_EN | RT5682S_DET_TYPE | -- RT5682S_POL_FAST_OFF_HIGH | RT5682S_MIC_CAP_HS); -+ RT5682S_POL_FAST_OFF_LOW | RT5682S_MIC_CAP_HS); - regmap_update_bits(rt5682s->regmap, RT5682S_SAR_IL_CMD_1, - RT5682S_SAR_POW_MASK, RT5682S_SAR_POW_EN); - regmap_update_bits(rt5682s->regmap, RT5682S_GPIO_CTRL_1, -diff --git a/sound/usb/midi.c b/sound/usb/midi.c -index 3059f814eb5c2d..fdf69917d19cc8 100644 ---- a/sound/usb/midi.c -+++ b/sound/usb/midi.c -@@ -1522,12 +1522,12 @@ static void snd_usbmidi_free(struct snd_usb_midi *umidi) - { - int i; - -+ if (!umidi->disconnected) -+ snd_usbmidi_disconnect(&umidi->list); -+ - for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) { - struct snd_usb_midi_endpoint *ep = &umidi->endpoints[i]; -- if (ep->out) -- snd_usbmidi_out_endpoint_delete(ep->out); -- if (ep->in) -- snd_usbmidi_in_endpoint_delete(ep->in); -+ kfree(ep->out); - } - mutex_destroy(&umidi->mutex); - kfree(umidi); -@@ -1553,7 +1553,7 @@ void snd_usbmidi_disconnect(struct list_head *p) - spin_unlock_irq(&umidi->disc_lock); - up_write(&umidi->disc_rwsem); - -- del_timer_sync(&umidi->error_timer); -+ timer_shutdown_sync(&umidi->error_timer); - - for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) { - struct snd_usb_midi_endpoint *ep = &umidi->endpoints[i]; -diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c -index 9ef569492560ef..ddaeb4eb3e2497 100644 ---- a/tools/lib/subcmd/help.c -+++ b/tools/lib/subcmd/help.c -@@ -75,6 +75,9 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes) - size_t ci, cj, ei; - int cmp; - -+ if (!excludes->cnt) -+ return; -+ - ci = cj = ei = 0; - while (ci < cmds->cnt && ei < excludes->cnt) { - cmp = strcmp(cmds->names[ci]->name, excludes->names[ei]->name); diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.111-112.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.111-112.patch deleted file mode 100644 index 3197a64c47..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.111-112.patch +++ /dev/null @@ -1,6153 +0,0 @@ -diff --git a/Documentation/trace/histogram-design.rst b/Documentation/trace/histogram-design.rst -index 5765eb3e9efa78..a30f4bed11b4ee 100644 ---- a/Documentation/trace/histogram-design.rst -+++ b/Documentation/trace/histogram-design.rst -@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking - trigger above. - - sched_waking histogram ------------------------:: -+---------------------- -+ -+.. code-block:: - - +------------------+ - | hist_data |<-------------------------------------------------------+ -diff --git a/Makefile b/Makefile -index 9531c465e9c240..64d76baa0e0c9b 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 111 -+SUBLEVEL = 112 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm/boot/dts/renesas/r8a7791-porter.dts b/arch/arm/boot/dts/renesas/r8a7791-porter.dts -index fcc9a2313e1dfd..0cd08f7b8d8e06 100644 ---- a/arch/arm/boot/dts/renesas/r8a7791-porter.dts -+++ b/arch/arm/boot/dts/renesas/r8a7791-porter.dts -@@ -266,7 +266,7 @@ vin0_pins: vin0 { - }; - - can0_pins: can0 { -- groups = "can0_data"; -+ groups = "can0_data_b"; - function = "can0"; - }; - -diff --git a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi -index c14d5b70c72f6c..56f704082f94a5 100644 ---- a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi -+++ b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi -@@ -270,7 +270,7 @@ &tps { - vcc7-supply = <&vbat>; - vccio-supply = <&vbat>; - -- ti,en-ck32k-xtal = <1>; -+ ti,en-ck32k-xtal; - - regulators { - vrtc_reg: regulator@0 { -diff --git a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts -index 72990e7ffe10ee..44718a4cec474c 100644 ---- a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts -+++ b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts -@@ -483,8 +483,6 @@ &mcasp1 { - - op-mode = <0>; /* MCASP_IIS_MODE */ - tdm-slots = <2>; -- /* 16 serializers */ -- num-serializer = <16>; - serial-dir = < /* 0: INACTIVE, 1: TX, 2: RX */ - 0 0 2 1 0 0 0 0 0 0 0 0 0 0 0 0 - >; -diff --git a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi -index a7f99ae0c1fe9a..78c657429f6410 100644 ---- a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi -+++ b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi -@@ -65,7 +65,7 @@ ads7846@0 { - ti,debounce-max = /bits/ 16 <10>; - ti,debounce-tol = /bits/ 16 <5>; - ti,debounce-rep = /bits/ 16 <1>; -- ti,keep-vref-on = <1>; -+ ti,keep-vref-on; - ti,settle-delay-usec = /bits/ 16 <150>; - - wakeup-source; -diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S -index e5869cca5e7916..94dece1839af34 100644 ---- a/arch/arm/mach-at91/pm_suspend.S -+++ b/arch/arm/mach-at91/pm_suspend.S -@@ -872,7 +872,7 @@ e_done: - /** - * at91_mckx_ps_restore: restore MCK1..4 settings - * -- * Side effects: overwrites tmp1, tmp2 -+ * Side effects: overwrites tmp1, tmp2 and tmp3 - */ - .macro at91_mckx_ps_restore - #ifdef CONFIG_SOC_SAMA7 -@@ -916,7 +916,7 @@ r_ps: - bic tmp3, tmp3, #AT91_PMC_MCR_V2_ID_MSK - orr tmp3, tmp3, tmp1 - orr tmp3, tmp3, #AT91_PMC_MCR_V2_CMD -- str tmp2, [pmc, #AT91_PMC_MCR_V2] -+ str tmp3, [pmc, #AT91_PMC_MCR_V2] - - wait_mckrdy tmp1 - -diff --git a/arch/arm64/boot/dts/apple/t8103-j457.dts b/arch/arm64/boot/dts/apple/t8103-j457.dts -index 152f95fd49a211..7089ccf3ce5566 100644 ---- a/arch/arm64/boot/dts/apple/t8103-j457.dts -+++ b/arch/arm64/boot/dts/apple/t8103-j457.dts -@@ -21,6 +21,14 @@ aliases { - }; - }; - -+/* -+ * Adjust pcie0's iommu-map to account for the disabled port01. -+ */ -+&pcie0 { -+ iommu-map = <0x100 &pcie0_dart_0 1 1>, -+ <0x200 &pcie0_dart_2 1 1>; -+}; -+ - &bluetooth0 { - brcm,board-type = "apple,santorini"; - }; -@@ -36,10 +44,10 @@ &wifi0 { - */ - - &port02 { -- bus-range = <3 3>; -+ bus-range = <2 2>; - status = "okay"; - ethernet0: ethernet@0,0 { -- reg = <0x30000 0x0 0x0 0x0 0x0>; -+ reg = <0x20000 0x0 0x0 0x0 0x0>; - /* To be filled by the loader */ - local-mac-address = [00 10 18 00 00 00]; - }; -diff --git a/arch/arm64/boot/dts/mediatek/mt6331.dtsi b/arch/arm64/boot/dts/mediatek/mt6331.dtsi -index d89858c73ab1b0..243afbffa21fd7 100644 ---- a/arch/arm64/boot/dts/mediatek/mt6331.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt6331.dtsi -@@ -6,12 +6,12 @@ - #include - - &pwrap { -- pmic: mt6331 { -+ pmic: pmic { - compatible = "mediatek,mt6331"; - interrupt-controller; - #interrupt-cells = <2>; - -- mt6331regulator: mt6331regulator { -+ mt6331regulator: regulators { - compatible = "mediatek,mt6331-regulator"; - - mt6331_vdvfs11_reg: buck-vdvfs11 { -@@ -258,7 +258,7 @@ mt6331_vrtc_reg: ldo-vrtc { - }; - - mt6331_vdig18_reg: ldo-vdig18 { -- regulator-name = "dvdd18_dig"; -+ regulator-name = "vdig18"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; - regulator-ramp-delay = <0>; -@@ -266,11 +266,11 @@ mt6331_vdig18_reg: ldo-vdig18 { - }; - }; - -- mt6331rtc: mt6331rtc { -+ mt6331rtc: rtc { - compatible = "mediatek,mt6331-rtc"; - }; - -- mt6331keys: mt6331keys { -+ mt6331keys: keys { - compatible = "mediatek,mt6331-keys"; - power { - linux,keycodes = ; -diff --git a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts -index b5746e6d0b15a5..110fae4ec11c95 100644 ---- a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts -+++ b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts -@@ -136,7 +136,7 @@ proximity@48 { - - &mmc0 { - /* eMMC controller */ -- mediatek,latch-ck = <0x14>; /* hs400 */ -+ mediatek,latch-ck = <4>; /* hs400 */ - mediatek,hs200-cmd-int-delay = <1>; - mediatek,hs400-cmd-int-delay = <1>; - mediatek,hs400-ds-dly3 = <0x1a>; -diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi -index 22604d3abde3bd..4b701afe995e2f 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi -@@ -1524,9 +1524,6 @@ pcie0: pcie@112f0000 { - - power-domains = <&spm MT8195_POWER_DOMAIN_PCIE_MAC_P0>; - -- resets = <&infracfg_ao MT8195_INFRA_RST2_PCIE_P0_SWRST>; -- reset-names = "mac"; -- - #interrupt-cells = <1>; - interrupt-map-mask = <0 0 0 7>; - interrupt-map = <0 0 0 1 &pcie_intc0 0>, -diff --git a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts -index cce642c5381280..3d3db33a64dc66 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts -+++ b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts -@@ -11,7 +11,7 @@ - - / { - model = "Pumpkin MT8516"; -- compatible = "mediatek,mt8516"; -+ compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516"; - - memory@40000000 { - device_type = "memory"; -diff --git a/arch/arm64/boot/dts/qcom/qcm2290.dtsi b/arch/arm64/boot/dts/qcom/qcm2290.dtsi -index 40a8506553ef5d..4051a7660eb063 100644 ---- a/arch/arm64/boot/dts/qcom/qcm2290.dtsi -+++ b/arch/arm64/boot/dts/qcom/qcm2290.dtsi -@@ -1107,6 +1107,7 @@ usb_dwc3: usb@4e00000 { - snps,has-lpm-erratum; - snps,hird-threshold = /bits/ 8 <0x10>; - snps,usb3_lpm_capable; -+ snps,parkmode-disable-ss-quirk; - maximum-speed = "super-speed"; - dr_mode = "otg"; - }; -diff --git a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi -index 83fce96a25752e..0234dbe95413cd 100644 ---- a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi -+++ b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi -@@ -38,7 +38,10 @@ hdmi_con_out: endpoint { - #if (SW_SCIF_CAN || SW_RSPI_CAN) - &canfd { - pinctrl-0 = <&can1_pins>; -- /delete-node/ channel@0; -+ -+ channel0 { -+ status = "disabled"; -+ }; - }; - #else - &canfd { -diff --git a/arch/loongarch/kernel/relocate.c b/arch/loongarch/kernel/relocate.c -index 0eddd4a66b8745..1432bb214e3f49 100644 ---- a/arch/loongarch/kernel/relocate.c -+++ b/arch/loongarch/kernel/relocate.c -@@ -124,6 +124,10 @@ static inline __init bool kaslr_disabled(void) - if (str == boot_command_line || (str > boot_command_line && *(str - 1) == ' ')) - return true; - -+ str = strstr(boot_command_line, "kexec_file"); -+ if (str == boot_command_line || (str > boot_command_line && *(str - 1) == ' ')) -+ return true; -+ - return false; - } - -diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S -index cbd42ea7c3f7c2..99357bfa8e82ad 100644 ---- a/arch/sparc/lib/M7memcpy.S -+++ b/arch/sparc/lib/M7memcpy.S -@@ -696,16 +696,16 @@ FUNC_NAME: - EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40) - faligndata %f24, %f26, %f10 - EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40) -- EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40) -+ EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32) - faligndata %f26, %f28, %f12 -- EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40) -+ EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32) - add %o4, 64, %o4 -- EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40) -+ EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24) - faligndata %f28, %f30, %f14 -- EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40) -- EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40) -+ EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24) -+ EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16) - add %o0, 64, %o0 -- EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40) -+ EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8) - fsrc2 %f30, %f14 - bgu,pt %xcc, .Lunalign_sloop - prefetch [%o4 + (8 * BLOCK_SIZE)], 20 -@@ -728,7 +728,7 @@ FUNC_NAME: - add %o4, 8, %o4 - faligndata %f0, %f2, %f16 - subcc %o5, 8, %o5 -- EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5) -+ EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8) - fsrc2 %f2, %f0 - bgu,pt %xcc, .Lunalign_by8 - add %o0, 8, %o0 -@@ -772,7 +772,7 @@ FUNC_NAME: - subcc %o5, 0x20, %o5 - EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) - EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) -- EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) -+ EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) - EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) - bne,pt %xcc, 1b - add %o0, 0x20, %o0 -@@ -804,12 +804,12 @@ FUNC_NAME: - brz,pt %o3, 2f - sub %o2, %o3, %o2 - --1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1) -+1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3) - add %o1, 1, %o1 - subcc %o3, 1, %o3 - add %o0, 1, %o0 - bne,pt %xcc, 1b -- EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1) -+ EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1) - 2: - and %o1, 0x7, %o3 - brz,pn %o3, .Lmedium_noprefetch_cp -diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S -index 64fbac28b3db18..207343367bb2da 100644 ---- a/arch/sparc/lib/Memcpy_utils.S -+++ b/arch/sparc/lib/Memcpy_utils.S -@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8) - ba,pt %xcc, __restore_asi - add %o2, 8, %o0 - ENDPROC(memcpy_retl_o2_plus_63_8) -+ENTRY(memcpy_retl_o2_plus_o3) -+ ba,pt %xcc, __restore_asi -+ add %o2, %o3, %o0 -+ENDPROC(memcpy_retl_o2_plus_o3) -+ENTRY(memcpy_retl_o2_plus_o3_plus_1) -+ add %o3, 1, %o3 -+ ba,pt %xcc, __restore_asi -+ add %o2, %o3, %o0 -+ENDPROC(memcpy_retl_o2_plus_o3_plus_1) - ENTRY(memcpy_retl_o2_plus_o5) - ba,pt %xcc, __restore_asi - add %o2, %o5, %o0 -diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S -index 7ad58ebe0d0096..df0ec1bd194892 100644 ---- a/arch/sparc/lib/NG4memcpy.S -+++ b/arch/sparc/lib/NG4memcpy.S -@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - subcc %o5, 0x20, %o5 - EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) - EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) -- EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) -+ EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) - EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) - bne,pt %icc, 1b - add %o0, 0x20, %o0 -diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S -index ee51c12306894e..bbd3ea0a64822c 100644 ---- a/arch/sparc/lib/NGmemcpy.S -+++ b/arch/sparc/lib/NGmemcpy.S -@@ -79,8 +79,8 @@ - #ifndef EX_RETVAL - #define EX_RETVAL(x) x - __restore_asi: -- ret - wr %g0, ASI_AIUS, %asi -+ ret - restore - ENTRY(NG_ret_i2_plus_i4_plus_1) - ba,pt %xcc, __restore_asi -@@ -125,15 +125,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56) - ba,pt %xcc, __restore_asi - add %i2, %g1, %i0 - ENDPROC(NG_ret_i2_plus_g1_minus_56) --ENTRY(NG_ret_i2_plus_i4) -+ENTRY(NG_ret_i2_plus_i4_plus_16) -+ add %i4, 16, %i4 - ba,pt %xcc, __restore_asi - add %i2, %i4, %i0 --ENDPROC(NG_ret_i2_plus_i4) --ENTRY(NG_ret_i2_plus_i4_minus_8) -- sub %i4, 8, %i4 -+ENDPROC(NG_ret_i2_plus_i4_plus_16) -+ENTRY(NG_ret_i2_plus_i4_plus_8) -+ add %i4, 8, %i4 - ba,pt %xcc, __restore_asi - add %i2, %i4, %i0 --ENDPROC(NG_ret_i2_plus_i4_minus_8) -+ENDPROC(NG_ret_i2_plus_i4_plus_8) - ENTRY(NG_ret_i2_plus_8) - ba,pt %xcc, __restore_asi - add %i2, 8, %i0 -@@ -160,6 +161,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4) - ba,pt %xcc, __restore_asi - add %i2, %i4, %i0 - ENDPROC(NG_ret_i2_and_7_plus_i4) -+ENTRY(NG_ret_i2_and_7_plus_i4_plus_8) -+ and %i2, 7, %i2 -+ add %i4, 8, %i4 -+ ba,pt %xcc, __restore_asi -+ add %i2, %i4, %i0 -+ENDPROC(NG_ret_i2_and_7_plus_i4) - #endif - - .align 64 -@@ -405,13 +412,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ - andn %i2, 0xf, %i4 - and %i2, 0xf, %i2 - 1: subcc %i4, 0x10, %i4 -- EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4) -+ EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16) - add %i1, 0x08, %i1 -- EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4) -+ EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16) - sub %i1, 0x08, %i1 -- EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4) -+ EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16) - add %i1, 0x8, %i1 -- EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8) -+ EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8) - bgu,pt %XCC, 1b - add %i1, 0x8, %i1 - 73: andcc %i2, 0x8, %g0 -@@ -468,7 +475,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ - subcc %i4, 0x8, %i4 - srlx %g3, %i3, %i5 - or %i5, %g2, %i5 -- EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4) -+ EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8) - add %o0, 0x8, %o0 - bgu,pt %icc, 1b - sllx %g3, %g1, %g2 -diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S -index 635398ec7540ee..154fbd35400ca8 100644 ---- a/arch/sparc/lib/U1memcpy.S -+++ b/arch/sparc/lib/U1memcpy.S -@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp) - retl - add %o0, %o2, %o0 - ENDPROC(U1_gs_40_fp) --ENTRY(U1_g3_0_fp) -- VISExitHalf -- retl -- add %g3, %o2, %o0 --ENDPROC(U1_g3_0_fp) - ENTRY(U1_g3_8_fp) - VISExitHalf - add %g3, 8, %g3 - retl - add %g3, %o2, %o0 - ENDPROC(U1_g3_8_fp) -+ENTRY(U1_g3_16_fp) -+ VISExitHalf -+ add %g3, 16, %g3 -+ retl -+ add %g3, %o2, %o0 -+ENDPROC(U1_g3_16_fp) - ENTRY(U1_o2_0_fp) - VISExitHalf - retl -@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - 62: FINISH_VISCHUNK(o0, f44, f46) - 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0) - --93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp) -+93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp) - add %o1, 8, %o1 - subcc %g3, 8, %g3 - faligndata %f0, %f2, %f8 -- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) -+ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) - bl,pn %xcc, 95f - add %o0, 8, %o0 -- EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp) -+ EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp) - add %o1, 8, %o1 - subcc %g3, 8, %g3 - faligndata %f2, %f0, %f8 -- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) -+ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) - bge,pt %xcc, 93b - add %o0, 8, %o0 - -diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S -index 9248d59c734ce2..bace3a18f836f1 100644 ---- a/arch/sparc/lib/U3memcpy.S -+++ b/arch/sparc/lib/U3memcpy.S -@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - faligndata %f10, %f12, %f26 - EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2) - -+ and %o2, 0x3f, %o2 - subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE - add %o1, 0x40, %o1 - bgu,pt %XCC, 1f -@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - * Also notice how this code is careful not to perform a - * load past the end of the src buffer. - */ -- and %o2, 0x3f, %o2 - andcc %o2, 0x38, %g2 - be,pn %XCC, 2f - subcc %g2, 0x8, %g2 -diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h -index 9d6411c6592050..00cefbb59fa98c 100644 ---- a/arch/x86/include/asm/segment.h -+++ b/arch/x86/include/asm/segment.h -@@ -244,7 +244,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node) - - static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node) - { -- unsigned int p; -+ unsigned long p; - - /* - * Load CPU and node number from the GDT. LSL is faster than RDTSCP -@@ -254,10 +254,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node) - * - * If RDPID is available, use it. - */ -- alternative_io ("lsl %[seg],%[p]", -- ".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */ -+ alternative_io ("lsl %[seg],%k[p]", -+ "rdpid %[p]", - X86_FEATURE_RDPID, -- [p] "=a" (p), [seg] "r" (__CPUNODE_SEG)); -+ [p] "=r" (p), [seg] "r" (__CPUNODE_SEG)); - - if (cpu) - *cpu = (p & VDSO_CPUNODE_MASK); -diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c -index 156e9bb07abf1a..2fb234ab467b16 100644 ---- a/block/blk-mq-sysfs.c -+++ b/block/blk-mq-sysfs.c -@@ -150,9 +150,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx) - return; - - hctx_for_each_ctx(hctx, ctx, i) -- kobject_del(&ctx->kobj); -+ if (ctx->kobj.state_in_sysfs) -+ kobject_del(&ctx->kobj); - -- kobject_del(&hctx->kobj); -+ if (hctx->kobj.state_in_sysfs) -+ kobject_del(&hctx->kobj); - } - - static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx) -diff --git a/block/blk-settings.c b/block/blk-settings.c -index 021994f6d2d829..a891f27ff834d0 100644 ---- a/block/blk-settings.c -+++ b/block/blk-settings.c -@@ -553,7 +553,8 @@ static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lb - int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, - sector_t start) - { -- unsigned int top, bottom, alignment, ret = 0; -+ unsigned int top, bottom, alignment; -+ int ret = 0; - - t->max_sectors = min_not_zero(t->max_sectors, b->max_sectors); - t->max_hw_sectors = min_not_zero(t->max_hw_sectors, b->max_hw_sectors); -diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c -index 0a7049b470c181..5201f47e31d8b0 100644 ---- a/crypto/asymmetric_keys/x509_cert_parser.c -+++ b/crypto/asymmetric_keys/x509_cert_parser.c -@@ -618,11 +618,14 @@ int x509_process_extension(void *context, size_t hdrlen, - /* - * Get hold of the basicConstraints - * v[1] is the encoding size -- * (Expect 0x2 or greater, making it 1 or more bytes) -+ * (Expect 0x00 for empty SEQUENCE with CA:FALSE, or -+ * 0x03 or greater for non-empty SEQUENCE) - * v[2] is the encoding type - * (Expect an ASN1_BOOL for the CA) -- * v[3] is the contents of the ASN1_BOOL -- * (Expect 1 if the CA is TRUE) -+ * v[3] is the length of the ASN1_BOOL -+ * (Expect 1 for a single byte boolean) -+ * v[4] is the contents of the ASN1_BOOL -+ * (Expect 0xFF if the CA is TRUE) - * vlen should match the entire extension size - */ - if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ)) -@@ -631,8 +634,13 @@ int x509_process_extension(void *context, size_t hdrlen, - return -EBADMSG; - if (v[1] != vlen - 2) - return -EBADMSG; -- if (vlen >= 4 && v[1] != 0 && v[2] == ASN1_BOOL && v[3] == 1) -+ /* Empty SEQUENCE means CA:FALSE (default value omitted per DER) */ -+ if (v[1] == 0) -+ return 0; -+ if (vlen >= 5 && v[2] == ASN1_BOOL && v[3] == 1 && v[4] == 0xFF) - ctx->cert->pub->key_eflags |= 1 << KEY_EFLAG_CA; -+ else -+ return -EBADMSG; - return 0; - } - -diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h -index 82563b44af3514..261dc8f87556df 100644 ---- a/drivers/acpi/acpica/aclocal.h -+++ b/drivers/acpi/acpica/aclocal.h -@@ -1139,7 +1139,7 @@ struct acpi_port_info { - #define ACPI_RESOURCE_NAME_PIN_GROUP_FUNCTION 0x91 - #define ACPI_RESOURCE_NAME_PIN_GROUP_CONFIG 0x92 - #define ACPI_RESOURCE_NAME_CLOCK_INPUT 0x93 --#define ACPI_RESOURCE_NAME_LARGE_MAX 0x94 -+#define ACPI_RESOURCE_NAME_LARGE_MAX 0x93 - - /***************************************************************************** - * -diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c -index a466ad6e5d93a9..5a1ced5bf7f6fa 100644 ---- a/drivers/acpi/nfit/core.c -+++ b/drivers/acpi/nfit/core.c -@@ -2643,7 +2643,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc, - if (ndr_desc->target_node == NUMA_NO_NODE) { - ndr_desc->target_node = phys_to_target_node(spa->address); - dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]", -- NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end); -+ NUMA_NO_NODE, ndr_desc->target_node, &res.start, &res.end); - } - - /* -diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c -index 0888e4d618d53a..b524cf27213d4f 100644 ---- a/drivers/acpi/processor_idle.c -+++ b/drivers/acpi/processor_idle.c -@@ -1410,6 +1410,9 @@ int acpi_processor_power_init(struct acpi_processor *pr) - if (retval) { - if (acpi_processor_registered == 0) - cpuidle_unregister_driver(&acpi_idle_driver); -+ -+ per_cpu(acpi_cpuidle_device, pr->id) = NULL; -+ kfree(dev); - return retval; - } - acpi_processor_registered++; -diff --git a/drivers/base/node.c b/drivers/base/node.c -index 4d588f4658c85c..47960a34305d3f 100644 ---- a/drivers/base/node.c -+++ b/drivers/base/node.c -@@ -878,6 +878,10 @@ int __register_one_node(int nid) - node_devices[nid] = node; - - error = register_node(node_devices[nid], nid); -+ if (error) { -+ node_devices[nid] = NULL; -+ return error; -+ } - - /* link cpu under this node */ - for_each_present_cpu(cpu) { -diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c -index baa31194cf20d5..ef5157fc8dcc51 100644 ---- a/drivers/base/power/main.c -+++ b/drivers/base/power/main.c -@@ -600,8 +600,20 @@ static void __device_resume_noirq(struct device *dev, pm_message_t state, bool a - if (dev->power.syscore || dev->power.direct_complete) - goto Out; - -- if (!dev->power.is_noirq_suspended) -+ if (!dev->power.is_noirq_suspended) { -+ /* -+ * This means that system suspend has been aborted in the noirq -+ * phase before invoking the noirq suspend callback for the -+ * device, so if device_suspend_late() has left it in suspend, -+ * device_resume_early() should leave it in suspend either in -+ * case the early resume of it depends on the noirq resume that -+ * has not run. -+ */ -+ if (dev_pm_skip_suspend(dev)) -+ dev->power.must_resume = false; -+ - goto Out; -+ } - - if (!dpm_wait_for_superior(dev, async)) - goto Out; -diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c -index 1209e01f8c7f97..9603c28a3ed823 100644 ---- a/drivers/base/regmap/regmap.c -+++ b/drivers/base/regmap/regmap.c -@@ -827,7 +827,7 @@ struct regmap *__regmap_init(struct device *dev, - map->read_flag_mask = bus->read_flag_mask; - } - -- if (config && config->read && config->write) { -+ if (config->read && config->write) { - map->reg_read = _regmap_bus_read; - if (config->reg_update_bits) - map->reg_update_bits = config->reg_update_bits; -diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c -index 3742ddf46c55ae..27a05b1521f693 100644 ---- a/drivers/block/nbd.c -+++ b/drivers/block/nbd.c -@@ -1128,6 +1128,14 @@ static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd, - if (!sock) - return NULL; - -+ if (!sk_is_tcp(sock->sk) && -+ !sk_is_stream_unix(sock->sk)) { -+ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: should be TCP or UNIX.\n"); -+ *err = -EINVAL; -+ sockfd_put(sock); -+ return NULL; -+ } -+ - if (sock->ops->shutdown == sock_no_shutdown) { - dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n"); - *err = -EINVAL; -diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c -index 97ed3bd9707f41..2dd254c720f5fa 100644 ---- a/drivers/block/null_blk/main.c -+++ b/drivers/block/null_blk/main.c -@@ -211,7 +211,7 @@ MODULE_PARM_DESC(discard, "Support discard operations (requires memory-backed nu - - static unsigned long g_cache_size; - module_param_named(cache_size, g_cache_size, ulong, 0444); --MODULE_PARM_DESC(mbps, "Cache size in MiB for memory-backed device. Default: 0 (none)"); -+MODULE_PARM_DESC(cache_size, "Cache size in MiB for memory-backed device. Default: 0 (none)"); - - static unsigned int g_mbps; - module_param_named(mbps, g_mbps, uint, 0444); -diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c -index 350e7b24ee2b09..03642df2df0bbf 100644 ---- a/drivers/bus/fsl-mc/fsl-mc-bus.c -+++ b/drivers/bus/fsl-mc/fsl-mc-bus.c -@@ -1103,6 +1103,9 @@ static int fsl_mc_bus_probe(struct platform_device *pdev) - * Get physical address of MC portal for the root DPRC: - */ - plat_res = platform_get_resource(pdev, IORESOURCE_MEM, 0); -+ if (!plat_res) -+ return -EINVAL; -+ - mc_portal_phys_addr = plat_res->start; - mc_portal_size = resource_size(plat_res); - mc_portal_base_phys_addr = mc_portal_phys_addr & ~0x3ffffff; -diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig -index 8de74dcfa18cf5..ece2d794174d40 100644 ---- a/drivers/char/hw_random/Kconfig -+++ b/drivers/char/hw_random/Kconfig -@@ -286,6 +286,7 @@ config HW_RANDOM_INGENIC_TRNG - config HW_RANDOM_NOMADIK - tristate "ST-Ericsson Nomadik Random Number Generator support" - depends on ARCH_NOMADIK || COMPILE_TEST -+ depends on ARM_AMBA - default HW_RANDOM - help - This driver provides kernel-side support for the Random Number -diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c -index 2f2f21f1b659e0..d7b42888f25c28 100644 ---- a/drivers/char/hw_random/ks-sa-rng.c -+++ b/drivers/char/hw_random/ks-sa-rng.c -@@ -240,6 +240,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev) - return -EINVAL; - } - -+ ks_sa_rng->clk = devm_clk_get_enabled(dev, NULL); -+ if (IS_ERR(ks_sa_rng->clk)) -+ return dev_err_probe(dev, PTR_ERR(ks_sa_rng->clk), "Failed to get clock\n"); -+ - pm_runtime_enable(dev); - ret = pm_runtime_resume_and_get(dev); - if (ret < 0) { -diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c -index 6ff77003a96eac..68325ebd56fe37 100644 ---- a/drivers/cpufreq/scmi-cpufreq.c -+++ b/drivers/cpufreq/scmi-cpufreq.c -@@ -15,6 +15,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -330,6 +331,15 @@ static bool scmi_dev_used_by_cpus(struct device *scmi_dev) - return true; - } - -+ /* -+ * Older Broadcom STB chips had a "clocks" property for CPU node(s) -+ * that did not match the SCMI performance protocol node, if we got -+ * there, it means we had such an older Device Tree, therefore return -+ * true to preserve backwards compatibility. -+ */ -+ if (of_machine_is_compatible("brcm,brcmstb")) -+ return true; -+ - return false; - } - -diff --git a/drivers/cpuidle/cpuidle-qcom-spm.c b/drivers/cpuidle/cpuidle-qcom-spm.c -index 1fc9968eae1996..b6b06a510fd866 100644 ---- a/drivers/cpuidle/cpuidle-qcom-spm.c -+++ b/drivers/cpuidle/cpuidle-qcom-spm.c -@@ -96,20 +96,23 @@ static int spm_cpuidle_register(struct device *cpuidle_dev, int cpu) - return -ENODEV; - - saw_node = of_parse_phandle(cpu_node, "qcom,saw", 0); -+ of_node_put(cpu_node); - if (!saw_node) - return -ENODEV; - - pdev = of_find_device_by_node(saw_node); - of_node_put(saw_node); -- of_node_put(cpu_node); - if (!pdev) - return -ENODEV; - - data = devm_kzalloc(cpuidle_dev, sizeof(*data), GFP_KERNEL); -- if (!data) -+ if (!data) { -+ put_device(&pdev->dev); - return -ENOMEM; -+ } - - data->spm = dev_get_drvdata(&pdev->dev); -+ put_device(&pdev->dev); - if (!data->spm) - return -EINVAL; - -diff --git a/drivers/crypto/hisilicon/debugfs.c b/drivers/crypto/hisilicon/debugfs.c -index bd205f1f2279e4..573c0033a5afe3 100644 ---- a/drivers/crypto/hisilicon/debugfs.c -+++ b/drivers/crypto/hisilicon/debugfs.c -@@ -865,6 +865,7 @@ static int qm_diff_regs_init(struct hisi_qm *qm, - dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs)); - ret = PTR_ERR(qm->debug.acc_diff_regs); - qm->debug.acc_diff_regs = NULL; -+ qm->debug.qm_diff_regs = NULL; - return ret; - } - -diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c -index 762a2a54ca8219..e3d113334d4e48 100644 ---- a/drivers/crypto/hisilicon/hpre/hpre_main.c -+++ b/drivers/crypto/hisilicon/hpre/hpre_main.c -@@ -689,6 +689,7 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm) - - /* Config data buffer pasid needed by Kunpeng 920 */ - hpre_config_pasid(qm); -+ hpre_open_sva_prefetch(qm); - - hpre_enable_clock_gate(qm); - -@@ -1366,8 +1367,6 @@ static int hpre_pf_probe_init(struct hpre *hpre) - if (ret) - return ret; - -- hpre_open_sva_prefetch(qm); -- - hisi_qm_dev_err_init(qm); - ret = hpre_show_last_regs_init(qm); - if (ret) -diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c -index 7921409791fb03..203240e78f6adb 100644 ---- a/drivers/crypto/hisilicon/qm.c -+++ b/drivers/crypto/hisilicon/qm.c -@@ -3748,6 +3748,10 @@ static ssize_t qm_get_qos_value(struct hisi_qm *qm, const char *buf, - } - - pdev = container_of(dev, struct pci_dev, dev); -+ if (pci_physfn(pdev) != qm->pdev) { -+ pci_err(qm->pdev, "the pdev input does not match the pf!\n"); -+ return -EINVAL; -+ } - - *fun_index = pdev->devfn; - -@@ -4363,9 +4367,6 @@ static void qm_restart_prepare(struct hisi_qm *qm) - { - u32 value; - -- if (qm->err_ini->open_sva_prefetch) -- qm->err_ini->open_sva_prefetch(qm); -- - if (qm->ver >= QM_HW_V3) - return; - -diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c -index 6aaaaf784ddc03..064fbc8db16fc8 100644 ---- a/drivers/crypto/hisilicon/sec2/sec_main.c -+++ b/drivers/crypto/hisilicon/sec2/sec_main.c -@@ -436,6 +436,45 @@ static void sec_set_endian(struct hisi_qm *qm) - writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG); - } - -+static void sec_close_sva_prefetch(struct hisi_qm *qm) -+{ -+ u32 val; -+ int ret; -+ -+ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) -+ return; -+ -+ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); -+ val |= SEC_PREFETCH_DISABLE; -+ writel(val, qm->io_base + SEC_PREFETCH_CFG); -+ -+ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS, -+ val, !(val & SEC_SVA_DISABLE_READY), -+ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); -+ if (ret) -+ pci_err(qm->pdev, "failed to close sva prefetch\n"); -+} -+ -+static void sec_open_sva_prefetch(struct hisi_qm *qm) -+{ -+ u32 val; -+ int ret; -+ -+ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) -+ return; -+ -+ /* Enable prefetch */ -+ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); -+ val &= SEC_PREFETCH_ENABLE; -+ writel(val, qm->io_base + SEC_PREFETCH_CFG); -+ -+ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG, -+ val, !(val & SEC_PREFETCH_DISABLE), -+ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); -+ if (ret) -+ pci_err(qm->pdev, "failed to open sva prefetch\n"); -+} -+ - static void sec_engine_sva_config(struct hisi_qm *qm) - { - u32 reg; -@@ -469,45 +508,7 @@ static void sec_engine_sva_config(struct hisi_qm *qm) - writel_relaxed(reg, qm->io_base + - SEC_INTERFACE_USER_CTRL1_REG); - } --} -- --static void sec_open_sva_prefetch(struct hisi_qm *qm) --{ -- u32 val; -- int ret; -- -- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) -- return; -- -- /* Enable prefetch */ -- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); -- val &= SEC_PREFETCH_ENABLE; -- writel(val, qm->io_base + SEC_PREFETCH_CFG); -- -- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG, -- val, !(val & SEC_PREFETCH_DISABLE), -- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); -- if (ret) -- pci_err(qm->pdev, "failed to open sva prefetch\n"); --} -- --static void sec_close_sva_prefetch(struct hisi_qm *qm) --{ -- u32 val; -- int ret; -- -- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) -- return; -- -- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); -- val |= SEC_PREFETCH_DISABLE; -- writel(val, qm->io_base + SEC_PREFETCH_CFG); -- -- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS, -- val, !(val & SEC_SVA_DISABLE_READY), -- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); -- if (ret) -- pci_err(qm->pdev, "failed to close sva prefetch\n"); -+ sec_open_sva_prefetch(qm); - } - - static void sec_enable_clock_gate(struct hisi_qm *qm) -@@ -1090,7 +1091,6 @@ static int sec_pf_probe_init(struct sec_dev *sec) - if (ret) - return ret; - -- sec_open_sva_prefetch(qm); - hisi_qm_dev_err_init(qm); - sec_debug_regs_clear(qm); - ret = sec_show_last_regs_init(qm); -diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c -index 66e553115adfd5..b70aa6032874e1 100644 ---- a/drivers/crypto/hisilicon/zip/zip_main.c -+++ b/drivers/crypto/hisilicon/zip/zip_main.c -@@ -469,10 +469,9 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg) - return false; - } - --static int hisi_zip_set_high_perf(struct hisi_qm *qm) -+static void hisi_zip_set_high_perf(struct hisi_qm *qm) - { - u32 val; -- int ret; - - val = readl_relaxed(qm->io_base + HZIP_HIGH_PERF_OFFSET); - if (perf_mode == HZIP_HIGH_COMP_PERF) -@@ -482,13 +481,6 @@ static int hisi_zip_set_high_perf(struct hisi_qm *qm) - - /* Set perf mode */ - writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET); -- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_HIGH_PERF_OFFSET, -- val, val == perf_mode, HZIP_DELAY_1_US, -- HZIP_POLL_TIMEOUT_US); -- if (ret) -- pci_err(qm->pdev, "failed to set perf mode\n"); -- -- return ret; - } - - static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm) -@@ -585,6 +577,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm) - writel(AXUSER_BASE, base + HZIP_DATA_WUSER_32_63); - writel(AXUSER_BASE, base + HZIP_SGL_RUSER_32_63); - } -+ hisi_zip_open_sva_prefetch(qm); - - /* let's open all compression/decompression cores */ - dcomp_bm = qm->cap_tables.dev_cap_table[ZIP_DECOMP_ENABLE_BITMAP_IDX].cap_val; -@@ -596,6 +589,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm) - CQC_CACHE_WB_ENABLE | FIELD_PREP(SQC_CACHE_WB_THRD, 1) | - FIELD_PREP(CQC_CACHE_WB_THRD, 1), base + QM_CACHE_CTL); - -+ hisi_zip_set_high_perf(qm); - hisi_zip_enable_clock_gate(qm); - - return 0; -@@ -1180,11 +1174,6 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip) - if (ret) - return ret; - -- ret = hisi_zip_set_high_perf(qm); -- if (ret) -- return ret; -- -- hisi_zip_open_sva_prefetch(qm); - hisi_qm_dev_err_init(qm); - hisi_zip_debug_regs_clear(qm); - -diff --git a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c -index b7322230353998..3b5d5b64e14142 100644 ---- a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c -+++ b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c -@@ -232,7 +232,7 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req) - struct device *dev = rctx->hcu_dev->dev; - unsigned int remainder = 0; - unsigned int total; -- size_t nents; -+ int nents; - size_t count; - int rc; - int i; -@@ -253,6 +253,9 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req) - /* Determine the number of scatter gather list entries to process. */ - nents = sg_nents_for_len(req->src, rctx->sg_data_total - remainder); - -+ if (nents < 0) -+ return nents; -+ - /* If there are entries to process, map them. */ - if (nents) { - rctx->sg_dma_nents = dma_map_sg(dev, req->src, nents, -diff --git a/drivers/devfreq/mtk-cci-devfreq.c b/drivers/devfreq/mtk-cci-devfreq.c -index 83a73f0ccd803b..eff9b2c06aef4d 100644 ---- a/drivers/devfreq/mtk-cci-devfreq.c -+++ b/drivers/devfreq/mtk-cci-devfreq.c -@@ -385,7 +385,8 @@ static int mtk_ccifreq_probe(struct platform_device *pdev) - out_free_resources: - if (regulator_is_enabled(drv->proc_reg)) - regulator_disable(drv->proc_reg); -- if (drv->sram_reg && regulator_is_enabled(drv->sram_reg)) -+ if (!IS_ERR_OR_NULL(drv->sram_reg) && -+ regulator_is_enabled(drv->sram_reg)) - regulator_disable(drv->sram_reg); - - return ret; -diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c -index 068597e8fce95a..3c70d860749757 100644 ---- a/drivers/edac/i10nm_base.c -+++ b/drivers/edac/i10nm_base.c -@@ -970,6 +970,15 @@ static bool i10nm_check_ecc(struct skx_imc *imc, int chan) - return !!GET_BITFIELD(mcmtr, 2, 2); - } - -+static bool i10nm_channel_disabled(struct skx_imc *imc, int chan) -+{ -+ u32 mcmtr = I10NM_GET_MCMTR(imc, chan); -+ -+ edac_dbg(1, "mc%d ch%d mcmtr reg %x\n", imc->mc, chan, mcmtr); -+ -+ return (mcmtr == ~0 || GET_BITFIELD(mcmtr, 18, 18)); -+} -+ - static int i10nm_get_dimm_config(struct mem_ctl_info *mci, - struct res_config *cfg) - { -@@ -983,6 +992,11 @@ static int i10nm_get_dimm_config(struct mem_ctl_info *mci, - if (!imc->mbase) - continue; - -+ if (i10nm_channel_disabled(imc, i)) { -+ edac_dbg(1, "mc%d ch%d is disabled.\n", imc->mc, i); -+ continue; -+ } -+ - ndimms = 0; - amap = I10NM_GET_AMAP(imc, i); - -diff --git a/drivers/firmware/meson/Kconfig b/drivers/firmware/meson/Kconfig -index f2fdd375664822..179f5d46d8ddff 100644 ---- a/drivers/firmware/meson/Kconfig -+++ b/drivers/firmware/meson/Kconfig -@@ -5,7 +5,7 @@ - config MESON_SM - tristate "Amlogic Secure Monitor driver" - depends on ARCH_MESON || COMPILE_TEST -- default y -+ default ARCH_MESON - depends on ARM64_4K_PAGES - help - Say y here to enable the Amlogic secure monitor driver -diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c -index 5534c769b65508..1e0189f90fd6ac 100644 ---- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c -+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c -@@ -625,7 +625,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev, - * - * @handle: handle used to pass amdgpu_device pointer - * -- * Initialize the hardware, boot up the VCPU and do some testing -+ * Initialize the hardware, boot up the VCPU and do some testing. -+ * -+ * On SI, the UVD is meant to be used in a specific power state, -+ * or alternatively the driver can manually enable its clock. -+ * In amdgpu we use the dedicated UVD power state when DPM is enabled. -+ * Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state -+ * for the SMU and afterwards enables the UVD clock. -+ * This is automatically done by amdgpu_uvd_ring_begin_use when work -+ * is submitted to the UVD ring. Here, we have to call it manually -+ * in order to power up UVD before firmware validation. -+ * -+ * Note that we must not disable the UVD clock here, as that would -+ * cause the ring test to fail. However, UVD is powered off -+ * automatically after the ring test: amdgpu_uvd_ring_end_use calls -+ * the UVD idle work handler which will disable the UVD clock when -+ * all fences are signalled. - */ - static int uvd_v3_1_hw_init(void *handle) - { -@@ -635,6 +650,15 @@ static int uvd_v3_1_hw_init(void *handle) - int r; - - uvd_v3_1_mc_resume(adev); -+ uvd_v3_1_enable_mgcg(adev, true); -+ -+ /* Make sure UVD is powered during FW validation. -+ * It's going to be automatically powered off after the ring test. -+ */ -+ if (adev->pm.dpm_enabled) -+ amdgpu_dpm_enable_uvd(adev, true); -+ else -+ amdgpu_asic_set_uvd_clocks(adev, 53300, 40000); - - r = uvd_v3_1_fw_validate(adev); - if (r) { -@@ -642,9 +666,6 @@ static int uvd_v3_1_hw_init(void *handle) - return r; - } - -- uvd_v3_1_enable_mgcg(adev, true); -- amdgpu_asic_set_uvd_clocks(adev, 53300, 40000); -- - uvd_v3_1_start(adev); - - r = amdgpu_ring_test_helper(ring); -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c -index b77b4723323164..3168d6fb11e76b 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c -@@ -4142,7 +4142,7 @@ svm_ioctl(struct kfd_process *p, enum kfd_ioctl_svm_op op, uint64_t start, - r = svm_range_get_attr(p, mm, start, size, nattrs, attrs); - break; - default: -- r = EINVAL; -+ r = -EINVAL; - break; - } - -diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c -index 9ba6cb67655f4a..6c75aa82327ac1 100644 ---- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c -+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c -@@ -139,7 +139,6 @@ void dml32_rq_dlg_get_rq_reg(display_rq_regs_st *rq_regs, - if (dual_plane) { - unsigned int p1_pte_row_height_linear = get_dpte_row_height_linear_c(mode_lib, e2e_pipe_param, - num_pipes, pipe_idx); -- ; - if (src->sw_mode == dm_sw_linear) - ASSERT(p1_pte_row_height_linear >= 8); - -diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c -index 42efe838fa85c5..2d2d2d5e676341 100644 ---- a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c -+++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c -@@ -66,6 +66,13 @@ u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev) - (amdgpu_crtc->v_border * 2)); - - vblank_time_us = vblank_in_pixels * 1000 / amdgpu_crtc->hw_mode.clock; -+ -+ /* we have issues with mclk switching with -+ * refresh rates over 120 hz on the non-DC code. -+ */ -+ if (drm_mode_vrefresh(&amdgpu_crtc->hw_mode) > 120) -+ vblank_time_us = 0; -+ - break; - } - } -diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c -index e7b1fa2feb9288..2863dc65ffc6fb 100644 ---- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c -+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c -@@ -3066,7 +3066,13 @@ static bool si_dpm_vblank_too_short(void *handle) - /* we never hit the non-gddr5 limit so disable it */ - u32 switch_limit = adev->gmc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 0; - -- if (vblank_time < switch_limit) -+ /* Consider zero vblank time too short and disable MCLK switching. -+ * Note that the vblank time is set to maximum when no displays are attached, -+ * so we'll still enable MCLK switching in that case. -+ */ -+ if (vblank_time == 0) -+ return true; -+ else if (vblank_time < switch_limit) - return true; - else - return false; -@@ -3424,12 +3430,14 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, - { - struct si_ps *ps = si_get_ps(rps); - struct amdgpu_clock_and_voltage_limits *max_limits; -+ struct amdgpu_connector *conn; - bool disable_mclk_switching = false; - bool disable_sclk_switching = false; - u32 mclk, sclk; - u16 vddc, vddci, min_vce_voltage = 0; - u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc; - u32 max_sclk = 0, max_mclk = 0; -+ u32 high_pixelclock_count = 0; - int i; - - if (adev->asic_type == CHIP_HAINAN) { -@@ -3457,6 +3465,35 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, - } - } - -+ /* We define "high pixelclock" for SI as higher than necessary for 4K 30Hz. -+ * For example, 4K 60Hz and 1080p 144Hz fall into this category. -+ * Find number of such displays connected. -+ */ -+ for (i = 0; i < adev->mode_info.num_crtc; i++) { -+ if (!(adev->pm.dpm.new_active_crtcs & (1 << i)) || -+ !adev->mode_info.crtcs[i]->enabled) -+ continue; -+ -+ conn = to_amdgpu_connector(adev->mode_info.crtcs[i]->connector); -+ -+ if (conn->pixelclock_for_modeset > 297000) -+ high_pixelclock_count++; -+ } -+ -+ /* These are some ad-hoc fixes to some issues observed with SI GPUs. -+ * They are necessary because we don't have something like dce_calcs -+ * for these GPUs to calculate bandwidth requirements. -+ */ -+ if (high_pixelclock_count) { -+ /* On Oland, we observe some flickering when two 4K 60Hz -+ * displays are connected, possibly because voltage is too low. -+ * Raise the voltage by requiring a higher SCLK. -+ * (Voltage cannot be adjusted independently without also SCLK.) -+ */ -+ if (high_pixelclock_count > 1 && adev->asic_type == CHIP_OLAND) -+ disable_sclk_switching = true; -+ } -+ - if (rps->vce_active) { - rps->evclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].evclk; - rps->ecclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].ecclk; -@@ -5617,14 +5654,10 @@ static int si_populate_smc_t(struct amdgpu_device *adev, - - static int si_disable_ulv(struct amdgpu_device *adev) - { -- struct si_power_info *si_pi = si_get_pi(adev); -- struct si_ulv_param *ulv = &si_pi->ulv; -- -- if (ulv->supported) -- return (amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV) == PPSMC_Result_OK) ? -- 0 : -EINVAL; -+ PPSMC_Result r; - -- return 0; -+ r = amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV); -+ return (r == PPSMC_Result_OK) ? 0 : -EINVAL; - } - - static bool si_is_state_ulv_compatible(struct amdgpu_device *adev, -@@ -5797,9 +5830,9 @@ static int si_upload_smc_data(struct amdgpu_device *adev) - { - struct amdgpu_crtc *amdgpu_crtc = NULL; - int i; -- -- if (adev->pm.dpm.new_active_crtc_count == 0) -- return 0; -+ u32 crtc_index = 0; -+ u32 mclk_change_block_cp_min = 0; -+ u32 mclk_change_block_cp_max = 0; - - for (i = 0; i < adev->mode_info.num_crtc; i++) { - if (adev->pm.dpm.new_active_crtcs & (1 << i)) { -@@ -5808,26 +5841,31 @@ static int si_upload_smc_data(struct amdgpu_device *adev) - } - } - -- if (amdgpu_crtc == NULL) -- return 0; -+ /* When a display is plugged in, program these so that the SMC -+ * performs MCLK switching when it doesn't cause flickering. -+ * When no display is plugged in, there is no need to restrict -+ * MCLK switching, so program them to zero. -+ */ -+ if (adev->pm.dpm.new_active_crtc_count && amdgpu_crtc) { -+ crtc_index = amdgpu_crtc->crtc_id; - -- if (amdgpu_crtc->line_time <= 0) -- return 0; -+ if (amdgpu_crtc->line_time) { -+ mclk_change_block_cp_min = 200 / amdgpu_crtc->line_time; -+ mclk_change_block_cp_max = 100 / amdgpu_crtc->line_time; -+ } -+ } - -- if (si_write_smc_soft_register(adev, -- SI_SMC_SOFT_REGISTER_crtc_index, -- amdgpu_crtc->crtc_id) != PPSMC_Result_OK) -- return 0; -+ si_write_smc_soft_register(adev, -+ SI_SMC_SOFT_REGISTER_crtc_index, -+ crtc_index); - -- if (si_write_smc_soft_register(adev, -- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min, -- amdgpu_crtc->wm_high / amdgpu_crtc->line_time) != PPSMC_Result_OK) -- return 0; -+ si_write_smc_soft_register(adev, -+ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min, -+ mclk_change_block_cp_min); - -- if (si_write_smc_soft_register(adev, -- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max, -- amdgpu_crtc->wm_low / amdgpu_crtc->line_time) != PPSMC_Result_OK) -- return 0; -+ si_write_smc_soft_register(adev, -+ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max, -+ mclk_change_block_cp_max); - - return 0; - } -diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig -index 3e6a4e2044c0eb..5a4d574b37b89f 100644 ---- a/drivers/gpu/drm/bridge/Kconfig -+++ b/drivers/gpu/drm/bridge/Kconfig -@@ -85,6 +85,7 @@ config DRM_ITE_IT6505 - select EXTCON - select CRYPTO - select CRYPTO_HASH -+ select REGMAP_I2C - help - ITE IT6505 DisplayPort bridge chip driver. - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c -index 0a45c546b03f2b..a5cd41c9224d75 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c -@@ -433,7 +433,7 @@ static void _dpu_encoder_phys_wb_handle_wbdone_timeout( - static int dpu_encoder_phys_wb_wait_for_commit_done( - struct dpu_encoder_phys *phys_enc) - { -- unsigned long ret; -+ int ret; - struct dpu_encoder_wait_info wait_info; - struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc); - -diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35560.c b/drivers/gpu/drm/panel/panel-novatek-nt35560.c -index 5bbea734123bc0..ee04c55175bb85 100644 ---- a/drivers/gpu/drm/panel/panel-novatek-nt35560.c -+++ b/drivers/gpu/drm/panel/panel-novatek-nt35560.c -@@ -161,7 +161,7 @@ static int nt35560_set_brightness(struct backlight_device *bl) - par = 0x00; - ret = mipi_dsi_dcs_write(dsi, MIPI_DCS_WRITE_CONTROL_DISPLAY, - &par, 1); -- if (ret) { -+ if (ret < 0) { - dev_err(nt->dev, "failed to disable display backlight (%d)\n", ret); - return ret; - } -diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c -index ac77d1246b9453..811265648a5828 100644 ---- a/drivers/gpu/drm/radeon/r600_cs.c -+++ b/drivers/gpu/drm/radeon/r600_cs.c -@@ -1408,7 +1408,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, - unsigned block_align, unsigned height_align, unsigned base_align, - unsigned *l0_size, unsigned *mipmap_size) - { -- unsigned offset, i, level; -+ unsigned offset, i; - unsigned width, height, depth, size; - unsigned blocksize; - unsigned nbx, nby; -@@ -1420,7 +1420,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, - w0 = r600_mip_minify(w0, 0); - h0 = r600_mip_minify(h0, 0); - d0 = r600_mip_minify(d0, 0); -- for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) { -+ for (i = 0, offset = 0; i < nlevels; i++) { - width = r600_mip_minify(w0, i); - nbx = r600_fmt_get_nblocksx(format, width); - -diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c -index c25a54d5b39ad5..0ba9195c9d713e 100644 ---- a/drivers/hwmon/mlxreg-fan.c -+++ b/drivers/hwmon/mlxreg-fan.c -@@ -113,8 +113,8 @@ struct mlxreg_fan { - int divider; - }; - --static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, -- unsigned long state); -+static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, -+ unsigned long state, bool thermal); - - static int - mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr, -@@ -224,8 +224,9 @@ mlxreg_fan_write(struct device *dev, enum hwmon_sensor_types type, u32 attr, - * last thermal state. - */ - if (pwm->last_hwmon_state >= pwm->last_thermal_state) -- return mlxreg_fan_set_cur_state(pwm->cdev, -- pwm->last_hwmon_state); -+ return _mlxreg_fan_set_cur_state(pwm->cdev, -+ pwm->last_hwmon_state, -+ false); - return 0; - } - return regmap_write(fan->regmap, pwm->reg, val); -@@ -357,9 +358,8 @@ static int mlxreg_fan_get_cur_state(struct thermal_cooling_device *cdev, - return 0; - } - --static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, -- unsigned long state) -- -+static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, -+ unsigned long state, bool thermal) - { - struct mlxreg_fan_pwm *pwm = cdev->devdata; - struct mlxreg_fan *fan = pwm->fan; -@@ -369,7 +369,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, - return -EINVAL; - - /* Save thermal state. */ -- pwm->last_thermal_state = state; -+ if (thermal) -+ pwm->last_thermal_state = state; - - state = max_t(unsigned long, state, pwm->last_hwmon_state); - err = regmap_write(fan->regmap, pwm->reg, -@@ -381,6 +382,13 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, - return 0; - } - -+static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, -+ unsigned long state) -+ -+{ -+ return _mlxreg_fan_set_cur_state(cdev, state, true); -+} -+ - static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = { - .get_max_state = mlxreg_fan_get_max_state, - .get_cur_state = mlxreg_fan_get_cur_state, -diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c -index 3b57851869eaae..a8369527372097 100644 ---- a/drivers/hwtracing/coresight/coresight-core.c -+++ b/drivers/hwtracing/coresight/coresight-core.c -@@ -1638,8 +1638,9 @@ struct coresight_device *coresight_register(struct coresight_desc *desc) - goto out_unlock; - } - -- if (csdev->type == CORESIGHT_DEV_TYPE_SINK || -- csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) { -+ if ((csdev->type == CORESIGHT_DEV_TYPE_SINK || -+ csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) && -+ sink_ops(csdev)->alloc_buffer) { - ret = etm_perf_add_symlink_sink(csdev); - - if (ret) { -diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c -index 05d9f87e35333c..e4d8d446ea4d32 100644 ---- a/drivers/hwtracing/coresight/coresight-etm4x-core.c -+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c -@@ -481,7 +481,8 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata) - etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR); - etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR); - } -- etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR); -+ if (drvdata->numextinsel) -+ etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR); - for (i = 0; i < drvdata->nr_cntr; i++) { - etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i)); - etm4x_relaxed_write32(csa, config->cntr_ctrl[i], TRCCNTCTLRn(i)); -@@ -1323,6 +1324,7 @@ static void etm4_init_arch_data(void *info) - etmidr5 = etm4x_relaxed_read32(csa, TRCIDR5); - /* NUMEXTIN, bits[8:0] number of external inputs implemented */ - drvdata->nr_ext_inp = FIELD_GET(TRCIDR5_NUMEXTIN_MASK, etmidr5); -+ drvdata->numextinsel = FIELD_GET(TRCIDR5_NUMEXTINSEL_MASK, etmidr5); - /* TRACEIDSIZE, bits[21:16] indicates the trace ID width */ - drvdata->trcid_size = FIELD_GET(TRCIDR5_TRACEIDSIZE_MASK, etmidr5); - /* ATBTRIG, bit[22] implementation can support ATB triggers? */ -@@ -1750,7 +1752,9 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata) - state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR); - state->trcseqstr = etm4x_read32(csa, TRCSEQSTR); - } -- state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR); -+ -+ if (drvdata->numextinsel) -+ state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR); - - for (i = 0; i < drvdata->nr_cntr; i++) { - state->trccntrldvr[i] = etm4x_read32(csa, TRCCNTRLDVRn(i)); -@@ -1882,7 +1886,8 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata) - etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR); - etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR); - } -- etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR); -+ if (drvdata->numextinsel) -+ etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR); - - for (i = 0; i < drvdata->nr_cntr; i++) { - etm4x_relaxed_write32(csa, state->trccntrldvr[i], TRCCNTRLDVRn(i)); -@@ -2113,6 +2118,10 @@ static int etm4_probe(struct device *dev) - if (WARN_ON(!drvdata)) - return -ENOMEM; - -+ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); -+ if (IS_ERR(drvdata->atclk)) -+ return PTR_ERR(drvdata->atclk); -+ - if (pm_save_enable == PARAM_PM_SAVE_FIRMWARE) - pm_save_enable = coresight_loses_context_with_cpu(dev) ? - PARAM_PM_SAVE_SELF_HOSTED : PARAM_PM_SAVE_NEVER; -@@ -2364,8 +2373,8 @@ static int etm4_runtime_suspend(struct device *dev) - { - struct etmv4_drvdata *drvdata = dev_get_drvdata(dev); - -- if (drvdata->pclk && !IS_ERR(drvdata->pclk)) -- clk_disable_unprepare(drvdata->pclk); -+ clk_disable_unprepare(drvdata->atclk); -+ clk_disable_unprepare(drvdata->pclk); - - return 0; - } -@@ -2373,11 +2382,17 @@ static int etm4_runtime_suspend(struct device *dev) - static int etm4_runtime_resume(struct device *dev) - { - struct etmv4_drvdata *drvdata = dev_get_drvdata(dev); -+ int ret; - -- if (drvdata->pclk && !IS_ERR(drvdata->pclk)) -- clk_prepare_enable(drvdata->pclk); -+ ret = clk_prepare_enable(drvdata->pclk); -+ if (ret) -+ return ret; - -- return 0; -+ ret = clk_prepare_enable(drvdata->atclk); -+ if (ret) -+ clk_disable_unprepare(drvdata->pclk); -+ -+ return ret; - } - #endif - -diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h -index 6b6760e49ed357..d8b8102d790ccb 100644 ---- a/drivers/hwtracing/coresight/coresight-etm4x.h -+++ b/drivers/hwtracing/coresight/coresight-etm4x.h -@@ -162,6 +162,7 @@ - #define TRCIDR4_NUMVMIDC_MASK GENMASK(31, 28) - - #define TRCIDR5_NUMEXTIN_MASK GENMASK(8, 0) -+#define TRCIDR5_NUMEXTINSEL_MASK GENMASK(11, 9) - #define TRCIDR5_TRACEIDSIZE_MASK GENMASK(21, 16) - #define TRCIDR5_ATBTRIG BIT(22) - #define TRCIDR5_LPOVERRIDE BIT(23) -@@ -919,7 +920,8 @@ struct etmv4_save_state { - - /** - * struct etm4_drvdata - specifics associated to an ETM component -- * @pclk APB clock if present, otherwise NULL -+ * @pclk: APB clock if present, otherwise NULL -+ * @atclk: Optional clock for the core parts of the ETMv4. - * @base: Memory mapped base address for this component. - * @csdev: Component vitals needed by the framework. - * @spinlock: Only one at a time pls. -@@ -987,6 +989,7 @@ struct etmv4_save_state { - */ - struct etmv4_drvdata { - struct clk *pclk; -+ struct clk *atclk; - void __iomem *base; - struct coresight_device *csdev; - spinlock_t spinlock; -@@ -999,6 +1002,7 @@ struct etmv4_drvdata { - u8 nr_cntr; - u8 nr_ext_inp; - u8 numcidc; -+ u8 numextinsel; - u8 numvmidc; - u8 nrseqstate; - u8 nr_event; -diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c -index e20c1c6acc7315..a564bd5c8b62d3 100644 ---- a/drivers/hwtracing/coresight/coresight-trbe.c -+++ b/drivers/hwtracing/coresight/coresight-trbe.c -@@ -21,7 +21,8 @@ - #include "coresight-self-hosted-trace.h" - #include "coresight-trbe.h" - --#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) -+#define PERF_IDX2OFF(idx, buf) \ -+ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) - - /* - * A padding packet that will help the user space tools -@@ -743,12 +744,12 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev, - - buf = kzalloc_node(sizeof(*buf), GFP_KERNEL, trbe_alloc_node(event)); - if (!buf) -- return ERR_PTR(-ENOMEM); -+ return NULL; - - pglist = kcalloc(nr_pages, sizeof(*pglist), GFP_KERNEL); - if (!pglist) { - kfree(buf); -- return ERR_PTR(-ENOMEM); -+ return NULL; - } - - for (i = 0; i < nr_pages; i++) -@@ -758,7 +759,7 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev, - if (!buf->trbe_base) { - kfree(pglist); - kfree(buf); -- return ERR_PTR(-ENOMEM); -+ return NULL; - } - buf->trbe_limit = buf->trbe_base + nr_pages * PAGE_SIZE; - buf->trbe_write = buf->trbe_base; -diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c -index 1ebcf5673a06b2..e6fa6cb1011ab1 100644 ---- a/drivers/i2c/busses/i2c-designware-platdrv.c -+++ b/drivers/i2c/busses/i2c-designware-platdrv.c -@@ -394,6 +394,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev) - - exit_probe: - dw_i2c_plat_pm_cleanup(dev); -+ i2c_dw_prepare_clk(dev, false); - exit_reset: - reset_control_assert(dev->rst); - return ret; -@@ -411,9 +412,11 @@ static void dw_i2c_plat_remove(struct platform_device *pdev) - i2c_dw_disable(dev); - - pm_runtime_dont_use_autosuspend(device); -- pm_runtime_put_sync(device); -+ pm_runtime_put_noidle(device); - dw_i2c_plat_pm_cleanup(dev); - -+ i2c_dw_prepare_clk(dev, false); -+ - i2c_dw_remove_lock_support(dev); - - reset_control_assert(dev->rst); -diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c -index 1a9b5a068ef1b2..6b788bca64d54c 100644 ---- a/drivers/i2c/busses/i2c-mt65xx.c -+++ b/drivers/i2c/busses/i2c-mt65xx.c -@@ -1243,6 +1243,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, - { - int ret; - int left_num = num; -+ bool write_then_read_en = false; - struct mtk_i2c *i2c = i2c_get_adapdata(adap); - - ret = clk_bulk_enable(I2C_MT65XX_CLK_MAX, i2c->clocks); -@@ -1256,6 +1257,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, - if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) && - msgs[0].addr == msgs[1].addr) { - i2c->auto_restart = 0; -+ write_then_read_en = true; - } - } - -@@ -1280,12 +1282,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, - else - i2c->op = I2C_MASTER_WR; - -- if (!i2c->auto_restart) { -- if (num > 1) { -- /* combined two messages into one transaction */ -- i2c->op = I2C_MASTER_WRRD; -- left_num--; -- } -+ if (write_then_read_en) { -+ /* combined two messages into one transaction */ -+ i2c->op = I2C_MASTER_WRRD; -+ left_num--; - } - - /* always use DMA mode. */ -@@ -1293,7 +1293,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, - if (ret < 0) - goto err_exit; - -- msgs++; -+ if (i2c->op == I2C_MASTER_WRRD) -+ msgs += 2; -+ else -+ msgs++; - } - /* the return value is number of executed messages */ - ret = num; -diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c -index d1630d47ef6fcf..277884b5e1ca4f 100644 ---- a/drivers/i3c/master/svc-i3c-master.c -+++ b/drivers/i3c/master/svc-i3c-master.c -@@ -369,6 +369,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master, - SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000); - if (ret) { - dev_err(master->dev, "Timeout when polling for COMPLETE\n"); -+ i3c_generic_ibi_recycle_slot(data->ibi_pool, slot); - return ret; - } - -@@ -430,9 +431,24 @@ static void svc_i3c_master_ibi_work(struct work_struct *work) - */ - writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS); - -- /* Acknowledge the incoming interrupt with the AUTOIBI mechanism */ -- writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI | -- SVC_I3C_MCTRL_IBIRESP_AUTO, -+ /* -+ * Write REQUEST_START_ADDR request to emit broadcast address for arbitration, -+ * instend of using AUTO_IBI. -+ * -+ * Using AutoIBI request may cause controller to remain in AutoIBI state when -+ * there is a glitch on SDA line (high->low->high). -+ * 1. SDA high->low, raising an interrupt to execute IBI isr. -+ * 2. SDA low->high. -+ * 3. IBI isr writes an AutoIBI request. -+ * 4. The controller will not start AutoIBI process because SDA is not low. -+ * 5. IBIWON polling times out. -+ * 6. Controller reamins in AutoIBI state and doesn't accept EmitStop request. -+ */ -+ writel(SVC_I3C_MCTRL_REQUEST_START_ADDR | -+ SVC_I3C_MCTRL_TYPE_I3C | -+ SVC_I3C_MCTRL_IBIRESP_MANUAL | -+ SVC_I3C_MCTRL_DIR(SVC_I3C_MCTRL_DIR_WRITE) | -+ SVC_I3C_MCTRL_ADDR(I3C_BROADCAST_ADDR), - master->regs + SVC_I3C_MCTRL); - - /* Wait for IBIWON, should take approximately 100us */ -@@ -452,10 +468,15 @@ static void svc_i3c_master_ibi_work(struct work_struct *work) - switch (ibitype) { - case SVC_I3C_MSTATUS_IBITYPE_IBI: - dev = svc_i3c_master_dev_from_addr(master, ibiaddr); -- if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) -+ if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) { - svc_i3c_master_nack_ibi(master); -- else -+ } else { -+ if (dev->info.bcr & I3C_BCR_IBI_PAYLOAD) -+ svc_i3c_master_ack_ibi(master, true); -+ else -+ svc_i3c_master_ack_ibi(master, false); - svc_i3c_master_handle_ibi(master, dev); -+ } - break; - case SVC_I3C_MSTATUS_IBITYPE_HOT_JOIN: - if (is_events_enabled(master, SVC_I3C_EVENT_HOTJOIN)) -diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c -index 8255035ff124f3..c7b2ab78709936 100644 ---- a/drivers/iio/inkern.c -+++ b/drivers/iio/inkern.c -@@ -9,6 +9,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -635,7 +636,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, - { - int scale_type, scale_val, scale_val2; - int offset_type, offset_val, offset_val2; -- s64 raw64 = raw; -+ s64 denominator, raw64 = raw; - - offset_type = iio_channel_read(chan, &offset_val, &offset_val2, - IIO_CHAN_INFO_OFFSET); -@@ -670,7 +671,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, - * If no channel scaling is available apply consumer scale to - * raw value and return. - */ -- *processed = raw * scale; -+ *processed = raw64 * scale; - return 0; - } - -@@ -679,20 +680,19 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, - *processed = raw64 * scale_val * scale; - break; - case IIO_VAL_INT_PLUS_MICRO: -- if (scale_val2 < 0) -- *processed = -raw64 * scale_val * scale; -- else -- *processed = raw64 * scale_val * scale; -- *processed += div_s64(raw64 * (s64)scale_val2 * scale, -- 1000000LL); -- break; - case IIO_VAL_INT_PLUS_NANO: -- if (scale_val2 < 0) -- *processed = -raw64 * scale_val * scale; -- else -- *processed = raw64 * scale_val * scale; -- *processed += div_s64(raw64 * (s64)scale_val2 * scale, -- 1000000000LL); -+ switch (scale_type) { -+ case IIO_VAL_INT_PLUS_MICRO: -+ denominator = MICRO; -+ break; -+ case IIO_VAL_INT_PLUS_NANO: -+ denominator = NANO; -+ break; -+ } -+ *processed = raw64 * scale * abs(scale_val); -+ *processed += div_s64(raw64 * scale * abs(scale_val2), denominator); -+ if (scale_val < 0 || scale_val2 < 0) -+ *processed *= -1; - break; - case IIO_VAL_FRACTIONAL: - *processed = div_s64(raw64 * (s64)scale_val * scale, -diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c -index f20dfe70fa0e4f..8bf705921618c2 100644 ---- a/drivers/infiniband/core/addr.c -+++ b/drivers/infiniband/core/addr.c -@@ -460,14 +460,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst, - { - int ret = 0; - -- if (ndev_flags & IFF_LOOPBACK) { -+ if (ndev_flags & IFF_LOOPBACK) - memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN); -- } else { -- if (!(ndev_flags & IFF_NOARP)) { -- /* If the device doesn't do ARP internally */ -- ret = fetch_ha(dst, addr, dst_in, seq); -- } -- } -+ else -+ ret = fetch_ha(dst, addr, dst_in, seq); - return ret; - } - -diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c -index d45e3909dafe1d..50bb3c43f40bf6 100644 ---- a/drivers/infiniband/core/cm.c -+++ b/drivers/infiniband/core/cm.c -@@ -1032,8 +1032,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id, - struct cm_id_private *cm_id_priv; - - cm_id_priv = container_of(cm_id, struct cm_id_private, id); -- pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__, -- cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount)); -+ pr_err_ratelimited("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__, -+ cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount)); - } - - static void cm_destroy_id(struct ib_cm_id *cm_id, int err) -diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c -index 8175dde60b0a84..9902bb96c74094 100644 ---- a/drivers/infiniband/core/sa_query.c -+++ b/drivers/infiniband/core/sa_query.c -@@ -1013,6 +1013,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, - if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX) - timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX; - -+ spin_lock_irqsave(&ib_nl_request_lock, flags); -+ - delta = timeout - sa_local_svc_timeout_ms; - if (delta < 0) - abs_delta = -delta; -@@ -1020,7 +1022,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, - abs_delta = delta; - - if (delta != 0) { -- spin_lock_irqsave(&ib_nl_request_lock, flags); - sa_local_svc_timeout_ms = timeout; - list_for_each_entry(query, &ib_nl_request_list, list) { - if (delta < 0 && abs_delta > query->timeout) -@@ -1038,9 +1039,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, - if (delay) - mod_delayed_work(ib_nl_wq, &ib_nl_timed_work, - (unsigned long)delay); -- spin_unlock_irqrestore(&ib_nl_request_lock, flags); - } - -+ spin_unlock_irqrestore(&ib_nl_request_lock, flags); -+ - settimeout_out: - return 0; - } -diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c -index e922fb87286547..0adb98b8dacc87 100644 ---- a/drivers/infiniband/hw/mlx5/main.c -+++ b/drivers/infiniband/hw/mlx5/main.c -@@ -1691,7 +1691,8 @@ static void deallocate_uars(struct mlx5_ib_dev *dev, - } - - static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, -- struct mlx5_core_dev *slave) -+ struct mlx5_core_dev *slave, -+ struct mlx5_ib_lb_state *lb_state) - { - int err; - -@@ -1703,6 +1704,7 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, - if (err) - goto out; - -+ lb_state->force_enable = true; - return 0; - - out: -@@ -1711,16 +1713,22 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, - } - - static void mlx5_ib_disable_lb_mp(struct mlx5_core_dev *master, -- struct mlx5_core_dev *slave) -+ struct mlx5_core_dev *slave, -+ struct mlx5_ib_lb_state *lb_state) - { - mlx5_nic_vport_update_local_lb(slave, false); - mlx5_nic_vport_update_local_lb(master, false); -+ -+ lb_state->force_enable = false; - } - - int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) - { - int err = 0; - -+ if (dev->lb.force_enable) -+ return 0; -+ - mutex_lock(&dev->lb.mutex); - if (td) - dev->lb.user_td++; -@@ -1742,6 +1750,9 @@ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) - - void mlx5_ib_disable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) - { -+ if (dev->lb.force_enable) -+ return; -+ - mutex_lock(&dev->lb.mutex); - if (td) - dev->lb.user_td--; -@@ -3251,7 +3262,7 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev, - - lockdep_assert_held(&mlx5_ib_multiport_mutex); - -- mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev); -+ mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb); - - mlx5_core_mp_event_replay(ibdev->mdev, - MLX5_DRIVER_EVENT_AFFILIATION_REMOVED, -@@ -3348,7 +3359,7 @@ static bool mlx5_ib_bind_slave_port(struct mlx5_ib_dev *ibdev, - MLX5_DRIVER_EVENT_AFFILIATION_DONE, - &key); - -- err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev); -+ err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb); - if (err) - goto unbind; - -diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h -index 94678e5c59dd59..9b780f48a382b5 100644 ---- a/drivers/infiniband/hw/mlx5/mlx5_ib.h -+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h -@@ -1065,6 +1065,7 @@ struct mlx5_ib_lb_state { - u32 user_td; - int qps; - bool enabled; -+ bool force_enable; - }; - - struct mlx5_ib_pf_eq { -diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c -index 80332638d9e3ac..be6cd8ce4d97ec 100644 ---- a/drivers/infiniband/sw/rxe/rxe_task.c -+++ b/drivers/infiniband/sw/rxe/rxe_task.c -@@ -132,8 +132,12 @@ static void do_task(struct rxe_task *task) - * yield the cpu and reschedule the task - */ - if (!ret) { -- task->state = TASK_STATE_IDLE; -- resched = 1; -+ if (task->state != TASK_STATE_DRAINING) { -+ task->state = TASK_STATE_IDLE; -+ resched = 1; -+ } else { -+ cont = 1; -+ } - goto exit; - } - -diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c -index fdbef3254e3086..1768b8695c45ad 100644 ---- a/drivers/infiniband/sw/siw/siw_verbs.c -+++ b/drivers/infiniband/sw/siw/siw_verbs.c -@@ -761,7 +761,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, - struct siw_wqe *wqe = tx_wqe(qp); - - unsigned long flags; -- int rv = 0; -+ int rv = 0, imm_err = 0; - - if (wr && !rdma_is_kernel_res(&qp->base_qp.res)) { - siw_dbg_qp(qp, "wr must be empty for user mapped sq\n"); -@@ -947,9 +947,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, - * Send directly if SQ processing is not in progress. - * Eventual immediate errors (rv < 0) do not affect the involved - * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ -- * processing, if new work is already pending. But rv must be passed -- * to caller. -+ * processing, if new work is already pending. But rv and pointer -+ * to failed work request must be passed to caller. - */ -+ if (unlikely(rv < 0)) { -+ /* -+ * Immediate error -+ */ -+ siw_dbg_qp(qp, "Immediate error %d\n", rv); -+ imm_err = rv; -+ *bad_wr = wr; -+ } - if (wqe->wr_status != SIW_WR_IDLE) { - spin_unlock_irqrestore(&qp->sq_lock, flags); - goto skip_direct_sending; -@@ -974,15 +982,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, - - up_read(&qp->state_lock); - -- if (rv >= 0) -- return 0; -- /* -- * Immediate error -- */ -- siw_dbg_qp(qp, "error %d\n", rv); -+ if (unlikely(imm_err)) -+ return imm_err; - -- *bad_wr = wr; -- return rv; -+ return (rv >= 0) ? 0 : rv; - } - - /* -diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c -index 2c973f15cab7da..edb62a284548b9 100644 ---- a/drivers/input/misc/uinput.c -+++ b/drivers/input/misc/uinput.c -@@ -775,6 +775,7 @@ static int uinput_ff_upload_to_user(char __user *buffer, - if (in_compat_syscall()) { - struct uinput_ff_upload_compat ff_up_compat; - -+ memset(&ff_up_compat, 0, sizeof(ff_up_compat)); - ff_up_compat.request_id = ff_up->request_id; - ff_up_compat.retval = ff_up->retval; - /* -diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c -index 20094b9899f093..176b1ab516853c 100644 ---- a/drivers/input/touchscreen/atmel_mxt_ts.c -+++ b/drivers/input/touchscreen/atmel_mxt_ts.c -@@ -3324,7 +3324,7 @@ static int mxt_probe(struct i2c_client *client) - if (data->reset_gpio) { - /* Wait a while and then de-assert the RESET GPIO line */ - msleep(MXT_RESET_GPIO_TIME); -- gpiod_set_value(data->reset_gpio, 0); -+ gpiod_set_value_cansleep(data->reset_gpio, 0); - msleep(MXT_RESET_INVALID_CHG); - } - -diff --git a/drivers/leds/flash/leds-qcom-flash.c b/drivers/leds/flash/leds-qcom-flash.c -index a619dbe0152434..07ca3e32d4becc 100644 ---- a/drivers/leds/flash/leds-qcom-flash.c -+++ b/drivers/leds/flash/leds-qcom-flash.c -@@ -1,6 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0-only - /* -- * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved. -+ * Copyright (c) 2022, 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved. - */ - - #include -@@ -114,36 +114,39 @@ enum { - REG_THERM_THRSH1, - REG_THERM_THRSH2, - REG_THERM_THRSH3, -+ REG_TORCH_CLAMP, - REG_MAX_COUNT, - }; - - static const struct reg_field mvflash_3ch_regs[REG_MAX_COUNT] = { -- REG_FIELD(0x08, 0, 7), /* status1 */ -- REG_FIELD(0x09, 0, 7), /* status2 */ -- REG_FIELD(0x0a, 0, 7), /* status3 */ -- REG_FIELD_ID(0x40, 0, 7, 3, 1), /* chan_timer */ -- REG_FIELD_ID(0x43, 0, 6, 3, 1), /* itarget */ -- REG_FIELD(0x46, 7, 7), /* module_en */ -- REG_FIELD(0x47, 0, 5), /* iresolution */ -- REG_FIELD_ID(0x49, 0, 2, 3, 1), /* chan_strobe */ -- REG_FIELD(0x4c, 0, 2), /* chan_en */ -- REG_FIELD(0x56, 0, 2), /* therm_thrsh1 */ -- REG_FIELD(0x57, 0, 2), /* therm_thrsh2 */ -- REG_FIELD(0x58, 0, 2), /* therm_thrsh3 */ -+ [REG_STATUS1] = REG_FIELD(0x08, 0, 7), -+ [REG_STATUS2] = REG_FIELD(0x09, 0, 7), -+ [REG_STATUS3] = REG_FIELD(0x0a, 0, 7), -+ [REG_CHAN_TIMER] = REG_FIELD_ID(0x40, 0, 7, 3, 1), -+ [REG_ITARGET] = REG_FIELD_ID(0x43, 0, 6, 3, 1), -+ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7), -+ [REG_IRESOLUTION] = REG_FIELD(0x47, 0, 5), -+ [REG_CHAN_STROBE] = REG_FIELD_ID(0x49, 0, 2, 3, 1), -+ [REG_CHAN_EN] = REG_FIELD(0x4c, 0, 2), -+ [REG_THERM_THRSH1] = REG_FIELD(0x56, 0, 2), -+ [REG_THERM_THRSH2] = REG_FIELD(0x57, 0, 2), -+ [REG_THERM_THRSH3] = REG_FIELD(0x58, 0, 2), -+ [REG_TORCH_CLAMP] = REG_FIELD(0xec, 0, 6), - }; - - static const struct reg_field mvflash_4ch_regs[REG_MAX_COUNT] = { -- REG_FIELD(0x06, 0, 7), /* status1 */ -- REG_FIELD(0x07, 0, 6), /* status2 */ -- REG_FIELD(0x09, 0, 7), /* status3 */ -- REG_FIELD_ID(0x3e, 0, 7, 4, 1), /* chan_timer */ -- REG_FIELD_ID(0x42, 0, 6, 4, 1), /* itarget */ -- REG_FIELD(0x46, 7, 7), /* module_en */ -- REG_FIELD(0x49, 0, 3), /* iresolution */ -- REG_FIELD_ID(0x4a, 0, 6, 4, 1), /* chan_strobe */ -- REG_FIELD(0x4e, 0, 3), /* chan_en */ -- REG_FIELD(0x7a, 0, 2), /* therm_thrsh1 */ -- REG_FIELD(0x78, 0, 2), /* therm_thrsh2 */ -+ [REG_STATUS1] = REG_FIELD(0x06, 0, 7), -+ [REG_STATUS2] = REG_FIELD(0x07, 0, 6), -+ [REG_STATUS3] = REG_FIELD(0x09, 0, 7), -+ [REG_CHAN_TIMER] = REG_FIELD_ID(0x3e, 0, 7, 4, 1), -+ [REG_ITARGET] = REG_FIELD_ID(0x42, 0, 6, 4, 1), -+ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7), -+ [REG_IRESOLUTION] = REG_FIELD(0x49, 0, 3), -+ [REG_CHAN_STROBE] = REG_FIELD_ID(0x4a, 0, 6, 4, 1), -+ [REG_CHAN_EN] = REG_FIELD(0x4e, 0, 3), -+ [REG_THERM_THRSH1] = REG_FIELD(0x7a, 0, 2), -+ [REG_THERM_THRSH2] = REG_FIELD(0x78, 0, 2), -+ [REG_TORCH_CLAMP] = REG_FIELD(0xed, 0, 6), - }; - - struct qcom_flash_data { -@@ -156,6 +159,7 @@ struct qcom_flash_data { - u8 max_channels; - u8 chan_en_bits; - u8 revision; -+ u8 torch_clamp; - }; - - struct qcom_flash_led { -@@ -702,6 +706,7 @@ static int qcom_flash_register_led_device(struct device *dev, - u32 current_ua, timeout_us; - u32 channels[4]; - int i, rc, count; -+ u8 torch_clamp; - - count = fwnode_property_count_u32(node, "led-sources"); - if (count <= 0) { -@@ -751,6 +756,12 @@ static int qcom_flash_register_led_device(struct device *dev, - current_ua = min_t(u32, current_ua, TORCH_CURRENT_MAX_UA * led->chan_count); - led->max_torch_current_ma = current_ua / UA_PER_MA; - -+ torch_clamp = (current_ua / led->chan_count) / TORCH_IRES_UA; -+ if (torch_clamp != 0) -+ torch_clamp--; -+ -+ flash_data->torch_clamp = max_t(u8, flash_data->torch_clamp, torch_clamp); -+ - if (fwnode_property_present(node, "flash-max-microamp")) { - flash->led_cdev.flags |= LED_DEV_CAP_FLASH; - -@@ -918,8 +929,7 @@ static int qcom_flash_led_probe(struct platform_device *pdev) - flash_data->leds_count++; - } - -- return 0; -- -+ return regmap_field_write(flash_data->r_fields[REG_TORCH_CLAMP], flash_data->torch_clamp); - release: - fwnode_handle_put(child); - while (flash_data->v4l2_flash[flash_data->leds_count] && flash_data->leds_count) -diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h -index e6757a30dccad1..8a42c1590ecef7 100644 ---- a/drivers/md/dm-core.h -+++ b/drivers/md/dm-core.h -@@ -161,6 +161,7 @@ struct mapped_device { - #define DMF_SUSPENDED_INTERNALLY 7 - #define DMF_POST_SUSPENDING 8 - #define DMF_EMULATE_ZONE_APPEND 9 -+#define DMF_QUEUE_STOPPED 10 - - void disable_discard(struct mapped_device *md); - void disable_write_zeroes(struct mapped_device *md); -diff --git a/drivers/md/dm.c b/drivers/md/dm.c -index 44424554e6b52a..f0c4c3553c0166 100644 ---- a/drivers/md/dm.c -+++ b/drivers/md/dm.c -@@ -2688,7 +2688,7 @@ static int __dm_suspend(struct mapped_device *md, struct dm_table *map, - { - bool do_lockfs = suspend_flags & DM_SUSPEND_LOCKFS_FLAG; - bool noflush = suspend_flags & DM_SUSPEND_NOFLUSH_FLAG; -- int r; -+ int r = 0; - - lockdep_assert_held(&md->suspend_lock); - -@@ -2740,8 +2740,10 @@ static int __dm_suspend(struct mapped_device *md, struct dm_table *map, - * Stop md->queue before flushing md->wq in case request-based - * dm defers requests to md->wq from md->queue. - */ -- if (dm_request_based(md)) -+ if (map && dm_request_based(md)) { - dm_stop_queue(md->queue); -+ set_bit(DMF_QUEUE_STOPPED, &md->flags); -+ } - - flush_workqueue(md->wq); - -@@ -2750,7 +2752,8 @@ static int __dm_suspend(struct mapped_device *md, struct dm_table *map, - * We call dm_wait_for_completion to wait for all existing requests - * to finish. - */ -- r = dm_wait_for_completion(md, task_state); -+ if (map) -+ r = dm_wait_for_completion(md, task_state); - if (!r) - set_bit(dmf_suspended_flag, &md->flags); - -@@ -2763,7 +2766,7 @@ static int __dm_suspend(struct mapped_device *md, struct dm_table *map, - if (r < 0) { - dm_queue_flush(md); - -- if (dm_request_based(md)) -+ if (test_and_clear_bit(DMF_QUEUE_STOPPED, &md->flags)) - dm_start_queue(md->queue); - - unlock_fs(md); -@@ -2847,7 +2850,7 @@ static int __dm_resume(struct mapped_device *md, struct dm_table *map) - * so that mapping of targets can work correctly. - * Request-based dm is queueing the deferred I/Os in its request_queue. - */ -- if (dm_request_based(md)) -+ if (test_and_clear_bit(DMF_QUEUE_STOPPED, &md->flags)) - dm_start_queue(md->queue); - - unlock_fs(md); -diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c -index b430046f9e2a9f..09293e90025d55 100644 ---- a/drivers/media/i2c/rj54n1cb0c.c -+++ b/drivers/media/i2c/rj54n1cb0c.c -@@ -1331,10 +1331,13 @@ static int rj54n1_probe(struct i2c_client *client) - V4L2_CID_GAIN, 0, 127, 1, 66); - v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops, - V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1); -- rj54n1->subdev.ctrl_handler = &rj54n1->hdl; -- if (rj54n1->hdl.error) -- return rj54n1->hdl.error; - -+ if (rj54n1->hdl.error) { -+ ret = rj54n1->hdl.error; -+ goto err_free_ctrl; -+ } -+ -+ rj54n1->subdev.ctrl_handler = &rj54n1->hdl; - rj54n1->clk_div = clk_div; - rj54n1->rect.left = RJ54N1_COLUMN_SKIP; - rj54n1->rect.top = RJ54N1_ROW_SKIP; -diff --git a/drivers/media/pci/zoran/zoran.h b/drivers/media/pci/zoran/zoran.h -index 56340553b28239..63592c4f9ed8c4 100644 ---- a/drivers/media/pci/zoran/zoran.h -+++ b/drivers/media/pci/zoran/zoran.h -@@ -154,12 +154,6 @@ struct zoran_jpg_settings { - - struct zoran; - --/* zoran_fh contains per-open() settings */ --struct zoran_fh { -- struct v4l2_fh fh; -- struct zoran *zr; --}; -- - struct card_info { - enum card_type type; - char name[32]; -diff --git a/drivers/media/pci/zoran/zoran_driver.c b/drivers/media/pci/zoran/zoran_driver.c -index fa672cc8bc678e..feb39854a989e6 100644 ---- a/drivers/media/pci/zoran/zoran_driver.c -+++ b/drivers/media/pci/zoran/zoran_driver.c -@@ -511,12 +511,11 @@ static int zoran_s_fmt_vid_cap(struct file *file, void *__fh, - struct v4l2_format *fmt) - { - struct zoran *zr = video_drvdata(file); -- struct zoran_fh *fh = __fh; - int i; - int res = 0; - - if (fmt->fmt.pix.pixelformat == V4L2_PIX_FMT_MJPEG) -- return zoran_s_fmt_vid_out(file, fh, fmt); -+ return zoran_s_fmt_vid_out(file, __fh, fmt); - - for (i = 0; i < NUM_FORMATS; i++) - if (fmt->fmt.pix.pixelformat == zoran_formats[i].fourcc) -diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c -index 0533d4a083d249..a078f1107300ee 100644 ---- a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c -+++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c -@@ -239,7 +239,7 @@ static int delta_mjpeg_ipc_open(struct delta_ctx *pctx) - return 0; - } - --static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au) -+static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, dma_addr_t pstart, dma_addr_t pend) - { - struct delta_dev *delta = pctx->dev; - struct delta_mjpeg_ctx *ctx = to_ctx(pctx); -@@ -256,8 +256,8 @@ static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au) - - memset(params, 0, sizeof(*params)); - -- params->picture_start_addr_p = (u32)(au->paddr); -- params->picture_end_addr_p = (u32)(au->paddr + au->size - 1); -+ params->picture_start_addr_p = pstart; -+ params->picture_end_addr_p = pend; - - /* - * !WARNING! -@@ -374,12 +374,14 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau) - struct delta_dev *delta = pctx->dev; - struct delta_mjpeg_ctx *ctx = to_ctx(pctx); - int ret; -- struct delta_au au = *pau; -+ void *au_vaddr = pau->vaddr; -+ dma_addr_t au_dma = pau->paddr; -+ size_t au_size = pau->size; - unsigned int data_offset = 0; - struct mjpeg_header *header = &ctx->header_struct; - - if (!ctx->header) { -- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size, -+ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size, - header, &data_offset); - if (ret) { - pctx->stream_errors++; -@@ -405,17 +407,17 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau) - goto err; - } - -- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size, -+ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size, - ctx->header, &data_offset); - if (ret) { - pctx->stream_errors++; - goto err; - } - -- au.paddr += data_offset; -- au.vaddr += data_offset; -+ au_dma += data_offset; -+ au_vaddr += data_offset; - -- ret = delta_mjpeg_ipc_decode(pctx, &au); -+ ret = delta_mjpeg_ipc_decode(pctx, au_dma, au_dma + au_size - 1); - if (ret) - goto err; - -diff --git a/drivers/mfd/rz-mtu3.c b/drivers/mfd/rz-mtu3.c -index f3dac4a29a8324..9cdfef610398f3 100644 ---- a/drivers/mfd/rz-mtu3.c -+++ b/drivers/mfd/rz-mtu3.c -@@ -32,7 +32,7 @@ static const unsigned long rz_mtu3_8bit_ch_reg_offs[][13] = { - [RZ_MTU3_CHAN_2] = MTU_8BIT_CH_1_2(0x204, 0x092, 0x205, 0x200, 0x20c, 0x201, 0x202), - [RZ_MTU3_CHAN_3] = MTU_8BIT_CH_3_4_6_7(0x008, 0x093, 0x02c, 0x000, 0x04c, 0x002, 0x004, 0x005, 0x038), - [RZ_MTU3_CHAN_4] = MTU_8BIT_CH_3_4_6_7(0x009, 0x094, 0x02d, 0x001, 0x04d, 0x003, 0x006, 0x007, 0x039), -- [RZ_MTU3_CHAN_5] = MTU_8BIT_CH_5(0xab2, 0x1eb, 0xab4, 0xab6, 0xa84, 0xa85, 0xa86, 0xa94, 0xa95, 0xa96, 0xaa4, 0xaa5, 0xaa6), -+ [RZ_MTU3_CHAN_5] = MTU_8BIT_CH_5(0xab2, 0x895, 0xab4, 0xab6, 0xa84, 0xa85, 0xa86, 0xa94, 0xa95, 0xa96, 0xaa4, 0xaa5, 0xaa6), - [RZ_MTU3_CHAN_6] = MTU_8BIT_CH_3_4_6_7(0x808, 0x893, 0x82c, 0x800, 0x84c, 0x802, 0x804, 0x805, 0x838), - [RZ_MTU3_CHAN_7] = MTU_8BIT_CH_3_4_6_7(0x809, 0x894, 0x82d, 0x801, 0x84d, 0x803, 0x806, 0x807, 0x839), - [RZ_MTU3_CHAN_8] = MTU_8BIT_CH_8(0x404, 0x098, 0x400, 0x406, 0x401, 0x402, 0x403) -diff --git a/drivers/mfd/vexpress-sysreg.c b/drivers/mfd/vexpress-sysreg.c -index eab82619ec314a..8e41942081138e 100644 ---- a/drivers/mfd/vexpress-sysreg.c -+++ b/drivers/mfd/vexpress-sysreg.c -@@ -90,6 +90,7 @@ static int vexpress_sysreg_probe(struct platform_device *pdev) - struct resource *mem; - void __iomem *base; - struct gpio_chip *mmc_gpio_chip; -+ int ret; - - mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (!mem) -@@ -110,7 +111,10 @@ static int vexpress_sysreg_probe(struct platform_device *pdev) - bgpio_init(mmc_gpio_chip, &pdev->dev, 0x4, base + SYS_MCI, - NULL, NULL, NULL, NULL, 0); - mmc_gpio_chip->ngpio = 2; -- devm_gpiochip_add_data(&pdev->dev, mmc_gpio_chip, NULL); -+ -+ ret = devm_gpiochip_add_data(&pdev->dev, mmc_gpio_chip, NULL); -+ if (ret) -+ return ret; - - return devm_mfd_add_devices(&pdev->dev, PLATFORM_DEVID_AUTO, - vexpress_sysreg_cells, -diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c -index fc021e265edc01..5e03a6ba55711a 100644 ---- a/drivers/misc/fastrpc.c -+++ b/drivers/misc/fastrpc.c -@@ -362,26 +362,21 @@ static int fastrpc_map_get(struct fastrpc_map *map) - - - static int fastrpc_map_lookup(struct fastrpc_user *fl, int fd, -- struct fastrpc_map **ppmap, bool take_ref) -+ struct fastrpc_map **ppmap) - { -- struct fastrpc_session_ctx *sess = fl->sctx; - struct fastrpc_map *map = NULL; -+ struct dma_buf *buf; - int ret = -ENOENT; - -+ buf = dma_buf_get(fd); -+ if (IS_ERR(buf)) -+ return PTR_ERR(buf); -+ - spin_lock(&fl->lock); - list_for_each_entry(map, &fl->maps, node) { -- if (map->fd != fd) -+ if (map->fd != fd || map->buf != buf) - continue; - -- if (take_ref) { -- ret = fastrpc_map_get(map); -- if (ret) { -- dev_dbg(sess->dev, "%s: Failed to get map fd=%d ret=%d\n", -- __func__, fd, ret); -- break; -- } -- } -- - *ppmap = map; - ret = 0; - break; -@@ -751,7 +746,7 @@ static const struct dma_buf_ops fastrpc_dma_buf_ops = { - .release = fastrpc_release, - }; - --static int fastrpc_map_create(struct fastrpc_user *fl, int fd, -+static int fastrpc_map_attach(struct fastrpc_user *fl, int fd, - u64 len, u32 attr, struct fastrpc_map **ppmap) - { - struct fastrpc_session_ctx *sess = fl->sctx; -@@ -759,9 +754,6 @@ static int fastrpc_map_create(struct fastrpc_user *fl, int fd, - struct sg_table *table; - int err = 0; - -- if (!fastrpc_map_lookup(fl, fd, ppmap, true)) -- return 0; -- - map = kzalloc(sizeof(*map), GFP_KERNEL); - if (!map) - return -ENOMEM; -@@ -838,6 +830,24 @@ static int fastrpc_map_create(struct fastrpc_user *fl, int fd, - return err; - } - -+static int fastrpc_map_create(struct fastrpc_user *fl, int fd, -+ u64 len, u32 attr, struct fastrpc_map **ppmap) -+{ -+ struct fastrpc_session_ctx *sess = fl->sctx; -+ int err = 0; -+ -+ if (!fastrpc_map_lookup(fl, fd, ppmap)) { -+ if (!fastrpc_map_get(*ppmap)) -+ return 0; -+ dev_dbg(sess->dev, "%s: Failed to get map fd=%d\n", -+ __func__, fd); -+ } -+ -+ err = fastrpc_map_attach(fl, fd, len, attr, ppmap); -+ -+ return err; -+} -+ - /* - * Fastrpc payload buffer with metadata looks like: - * -@@ -910,8 +920,12 @@ static int fastrpc_create_maps(struct fastrpc_invoke_ctx *ctx) - ctx->args[i].length == 0) - continue; - -- err = fastrpc_map_create(ctx->fl, ctx->args[i].fd, -- ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]); -+ if (i < ctx->nbufs) -+ err = fastrpc_map_create(ctx->fl, ctx->args[i].fd, -+ ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]); -+ else -+ err = fastrpc_map_attach(ctx->fl, ctx->args[i].fd, -+ ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]); - if (err) { - dev_err(dev, "Error Creating map %d\n", err); - return -EINVAL; -@@ -1067,6 +1081,7 @@ static int fastrpc_put_args(struct fastrpc_invoke_ctx *ctx, - struct fastrpc_phy_page *pages; - u64 *fdlist; - int i, inbufs, outbufs, handles; -+ int ret = 0; - - inbufs = REMOTE_SCALARS_INBUFS(ctx->sc); - outbufs = REMOTE_SCALARS_OUTBUFS(ctx->sc); -@@ -1082,23 +1097,26 @@ static int fastrpc_put_args(struct fastrpc_invoke_ctx *ctx, - u64 len = rpra[i].buf.len; - - if (!kernel) { -- if (copy_to_user((void __user *)dst, src, len)) -- return -EFAULT; -+ if (copy_to_user((void __user *)dst, src, len)) { -+ ret = -EFAULT; -+ goto cleanup_fdlist; -+ } - } else { - memcpy(dst, src, len); - } - } - } - -+cleanup_fdlist: - /* Clean up fdlist which is updated by DSP */ - for (i = 0; i < FASTRPC_MAX_FDLIST; i++) { - if (!fdlist[i]) - break; -- if (!fastrpc_map_lookup(fl, (int)fdlist[i], &mmap, false)) -+ if (!fastrpc_map_lookup(fl, (int)fdlist[i], &mmap)) - fastrpc_map_put(mmap); - } - -- return 0; -+ return ret; - } - - static int fastrpc_invoke_send(struct fastrpc_session_ctx *sctx, -diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c -index 500b1feaf1f6f5..fd7d5cd50d3966 100644 ---- a/drivers/misc/genwqe/card_ddcb.c -+++ b/drivers/misc/genwqe/card_ddcb.c -@@ -923,7 +923,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd, - } - if (cmd->asv_length > DDCB_ASV_LENGTH) { - dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n", -- __func__, cmd->asiv_length); -+ __func__, cmd->asv_length); - return -EINVAL; - } - rc = __genwqe_enqueue_ddcb(cd, req, f_flags); -diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c -index c5aff27ec4a895..14a09285f1551d 100644 ---- a/drivers/mtd/nand/raw/atmel/nand-controller.c -+++ b/drivers/mtd/nand/raw/atmel/nand-controller.c -@@ -1858,7 +1858,7 @@ atmel_nand_controller_legacy_add_nands(struct atmel_nand_controller *nc) - - static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc) - { -- struct device_node *np, *nand_np; -+ struct device_node *np; - struct device *dev = nc->dev; - int ret, reg_cells; - u32 val; -@@ -1885,7 +1885,7 @@ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc) - - reg_cells += val; - -- for_each_child_of_node(np, nand_np) { -+ for_each_child_of_node_scoped(np, nand_np) { - struct atmel_nand *nand; - - nand = atmel_nand_create(nc, nand_np, reg_cells); -diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c -index d901877544445e..82a7c52fdb7210 100644 ---- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c -+++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c -@@ -752,7 +752,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev) - - static u32 ena_get_rxfh_key_size(struct net_device *netdev) - { -- return ENA_HASH_KEY_SIZE; -+ struct ena_adapter *adapter = netdev_priv(netdev); -+ struct ena_rss *rss = &adapter->ena_dev->rss; -+ -+ return rss->hash_key ? ENA_HASH_KEY_SIZE : 0; - } - - static int ena_indirection_table_set(struct ena_adapter *adapter, -diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c -index f1208591ed67e3..1c3a5cf379cd03 100644 ---- a/drivers/net/ethernet/dlink/dl2k.c -+++ b/drivers/net/ethernet/dlink/dl2k.c -@@ -954,15 +954,18 @@ receive_packet (struct net_device *dev) - } else { - struct sk_buff *skb; - -+ skb = NULL; - /* Small skbuffs for short packets */ -- if (pkt_len > copy_thresh) { -+ if (pkt_len <= copy_thresh) -+ skb = netdev_alloc_skb_ip_align(dev, pkt_len); -+ if (!skb) { - dma_unmap_single(&np->pdev->dev, - desc_to_dma(desc), - np->rx_buf_sz, - DMA_FROM_DEVICE); - skb_put (skb = np->rx_skbuff[entry], pkt_len); - np->rx_skbuff[entry] = NULL; -- } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) { -+ } else { - dma_sync_single_for_cpu(&np->pdev->dev, - desc_to_dma(desc), - np->rx_buf_sz, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -index 5a2126679415c7..336e0a54b3dc2e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -@@ -289,6 +289,10 @@ static void poll_timeout(struct mlx5_cmd_work_ent *ent) - return; - } - cond_resched(); -+ if (mlx5_cmd_is_down(dev)) { -+ ent->ret = -ENXIO; -+ return; -+ } - } while (time_before(jiffies, poll_end)); - - ent->ret = -ETIMEDOUT; -@@ -1059,7 +1063,7 @@ static void cmd_work_handler(struct work_struct *work) - poll_timeout(ent); - /* make sure we read the descriptor after ownership is SW */ - rmb(); -- mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, (ent->ret == -ETIMEDOUT)); -+ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, !!ent->ret); - } - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h -index 66d276a1be836a..f4a19ffbb641c0 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h -@@ -66,23 +66,11 @@ struct mlx5e_port_buffer { - struct mlx5e_bufferx_reg buffer[MLX5E_MAX_NETWORK_BUFFER]; - }; - --#ifdef CONFIG_MLX5_CORE_EN_DCB - int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, - u32 change, unsigned int mtu, - struct ieee_pfc *pfc, - u32 *buffer_size, - u8 *prio2buffer); --#else --static inline int --mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, -- u32 change, unsigned int mtu, -- void *pfc, -- u32 *buffer_size, -- u8 *prio2buffer) --{ -- return 0; --} --#endif - - int mlx5e_port_query_buffer(struct mlx5e_priv *priv, - struct mlx5e_port_buffer *port_buffer); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 09ba60b2e744b1..5c6f01abdcb91d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -44,7 +44,6 @@ - #include "eswitch.h" - #include "en.h" - #include "en/txrx.h" --#include "en/port_buffer.h" - #include "en_tc.h" - #include "en_rep.h" - #include "en_accel/ipsec.h" -@@ -2723,11 +2722,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) - struct mlx5e_params *params = &priv->channels.params; - struct net_device *netdev = priv->netdev; - struct mlx5_core_dev *mdev = priv->mdev; -- u16 mtu, prev_mtu; -+ u16 mtu; - int err; - -- mlx5e_query_mtu(mdev, params, &prev_mtu); -- - err = mlx5e_set_mtu(mdev, params, params->sw_mtu); - if (err) - return err; -@@ -2737,18 +2734,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) - netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n", - __func__, mtu, params->sw_mtu); - -- if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) { -- err = mlx5e_port_manual_buffer_config(priv, 0, mtu, -- NULL, NULL, NULL); -- if (err) { -- netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n", -- __func__, mtu, err, prev_mtu); -- -- mlx5e_set_mtu(mdev, params, prev_mtu); -- return err; -- } -- } -- - params->sw_mtu = mtu; - return 0; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c -index 1547704c89767f..4d64d179b5dd7d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c -@@ -27,6 +27,7 @@ struct mlx5_fw_reset { - struct work_struct reset_reload_work; - struct work_struct reset_now_work; - struct work_struct reset_abort_work; -+ struct delayed_work reset_timeout_work; - unsigned long reset_flags; - u8 reset_method; - struct timer_list timer; -@@ -257,6 +258,8 @@ static int mlx5_sync_reset_clear_reset_requested(struct mlx5_core_dev *dev, bool - return -EALREADY; - } - -+ if (current_work() != &fw_reset->reset_timeout_work.work) -+ cancel_delayed_work(&fw_reset->reset_timeout_work); - mlx5_stop_sync_reset_poll(dev); - if (poll_health) - mlx5_start_health_poll(dev); -@@ -327,6 +330,11 @@ static int mlx5_sync_reset_set_reset_requested(struct mlx5_core_dev *dev) - } - mlx5_stop_health_poll(dev, true); - mlx5_start_sync_reset_poll(dev); -+ -+ if (!test_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS, -+ &fw_reset->reset_flags)) -+ schedule_delayed_work(&fw_reset->reset_timeout_work, -+ msecs_to_jiffies(mlx5_tout_ms(dev, PCI_SYNC_UPDATE))); - return 0; - } - -@@ -700,6 +708,19 @@ static void mlx5_sync_reset_events_handle(struct mlx5_fw_reset *fw_reset, struct - } - } - -+static void mlx5_sync_reset_timeout_work(struct work_struct *work) -+{ -+ struct delayed_work *dwork = container_of(work, struct delayed_work, -+ work); -+ struct mlx5_fw_reset *fw_reset = -+ container_of(dwork, struct mlx5_fw_reset, reset_timeout_work); -+ struct mlx5_core_dev *dev = fw_reset->dev; -+ -+ if (mlx5_sync_reset_clear_reset_requested(dev, true)) -+ return; -+ mlx5_core_warn(dev, "PCI Sync FW Update Reset Timeout.\n"); -+} -+ - static int fw_reset_event_notifier(struct notifier_block *nb, unsigned long action, void *data) - { - struct mlx5_fw_reset *fw_reset = mlx5_nb_cof(nb, struct mlx5_fw_reset, nb); -@@ -783,6 +804,7 @@ void mlx5_drain_fw_reset(struct mlx5_core_dev *dev) - cancel_work_sync(&fw_reset->reset_reload_work); - cancel_work_sync(&fw_reset->reset_now_work); - cancel_work_sync(&fw_reset->reset_abort_work); -+ cancel_delayed_work(&fw_reset->reset_timeout_work); - } - - static const struct devlink_param mlx5_fw_reset_devlink_params[] = { -@@ -826,6 +848,8 @@ int mlx5_fw_reset_init(struct mlx5_core_dev *dev) - INIT_WORK(&fw_reset->reset_reload_work, mlx5_sync_reset_reload_work); - INIT_WORK(&fw_reset->reset_now_work, mlx5_sync_reset_now_event); - INIT_WORK(&fw_reset->reset_abort_work, mlx5_sync_reset_abort_event); -+ INIT_DELAYED_WORK(&fw_reset->reset_timeout_work, -+ mlx5_sync_reset_timeout_work); - - init_completion(&fw_reset->done); - return 0; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c -index e0581c6f9cecd5..5df1472fe2be2f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c -@@ -489,9 +489,12 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev, - u32 func_id; - u32 npages; - u32 i = 0; -+ int err; - -- if (!mlx5_cmd_is_down(dev)) -- return mlx5_cmd_do(dev, in, in_size, out, out_size); -+ err = mlx5_cmd_do(dev, in, in_size, out, out_size); -+ /* If FW is gone (-ENXIO), proceed to forceful reclaim */ -+ if (err != -ENXIO) -+ return err; - - /* No hard feelings, we want our pages back! */ - npages = MLX5_GET(manage_pages_in, in, input_num_entries); -diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c -index e75cbb287625fc..87383f9d09ce30 100644 ---- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c -+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c -@@ -1413,7 +1413,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev) - struct nfp_net *nn = netdev_priv(netdev); - - if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY)) -- return -EOPNOTSUPP; -+ return 0; - - return nfp_net_rss_key_sz(nn); - } -diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c -index f4340d4ef7eeab..0516ef71a64cb0 100644 ---- a/drivers/net/usb/asix_devices.c -+++ b/drivers/net/usb/asix_devices.c -@@ -625,6 +625,21 @@ static void ax88772_suspend(struct usbnet *dev) - asix_read_medium_status(dev, 1)); - } - -+/* Notes on PM callbacks and locking context: -+ * -+ * - asix_suspend()/asix_resume() are invoked for both runtime PM and -+ * system-wide suspend/resume. For struct usb_driver the ->resume() -+ * callback does not receive pm_message_t, so the resume type cannot -+ * be distinguished here. -+ * -+ * - The MAC driver must hold RTNL when calling phylink interfaces such as -+ * phylink_suspend()/resume(). Those calls will also perform MDIO I/O. -+ * -+ * - Taking RTNL and doing MDIO from a runtime-PM resume callback (while -+ * the USB PM lock is held) is fragile. Since autosuspend brings no -+ * measurable power saving here, we block it by holding a PM usage -+ * reference in ax88772_bind(). -+ */ - static int asix_suspend(struct usb_interface *intf, pm_message_t message) - { - struct usbnet *dev = usb_get_intfdata(intf); -@@ -919,6 +934,13 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf) - if (ret) - goto initphy_err; - -+ /* Keep this interface runtime-PM active by taking a usage ref. -+ * Prevents runtime suspend while bound and avoids resume paths -+ * that could deadlock (autoresume under RTNL while USB PM lock -+ * is held, phylink/MDIO wants RTNL). -+ */ -+ pm_runtime_get_noresume(&intf->dev); -+ - return 0; - - initphy_err: -@@ -948,6 +970,8 @@ static void ax88772_unbind(struct usbnet *dev, struct usb_interface *intf) - phylink_destroy(priv->phylink); - ax88772_mdio_unregister(priv); - asix_rx_fixup_common_free(dev->driver_priv); -+ /* Drop the PM usage ref taken in bind() */ -+ pm_runtime_put(&intf->dev); - } - - static void ax88178_unbind(struct usbnet *dev, struct usb_interface *intf) -@@ -1600,6 +1624,11 @@ static struct usb_driver asix_driver = { - .resume = asix_resume, - .reset_resume = asix_resume, - .disconnect = usbnet_disconnect, -+ /* usbnet enables autosuspend by default (supports_autosuspend=1). -+ * We keep runtime-PM active for AX88772* by taking a PM usage -+ * reference in ax88772_bind() (pm_runtime_get_noresume()) and -+ * dropping it in unbind(), which effectively blocks autosuspend. -+ */ - .supports_autosuspend = 1, - .disable_hub_initiated_lpm = 1, - }; -diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c -index ddff6f19ff98eb..92add3daadbb18 100644 ---- a/drivers/net/usb/rtl8150.c -+++ b/drivers/net/usb/rtl8150.c -@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) - rtl8150_t *dev = netdev_priv(netdev); - u16 rx_creg = 0x9e; - -- netif_stop_queue(netdev); - if (netdev->flags & IFF_PROMISC) { - rx_creg |= 0x0001; - dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name); -@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) - rx_creg &= 0x00fc; - } - async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg); -- netif_wake_queue(netdev); - } - - static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, -diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c -index 818aea99f85eb3..340502c47a10d6 100644 ---- a/drivers/net/wireless/ath/ath10k/wmi.c -+++ b/drivers/net/wireless/ath/ath10k/wmi.c -@@ -1763,33 +1763,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch, - - int ath10k_wmi_wait_for_service_ready(struct ath10k *ar) - { -+ unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ; - unsigned long time_left, i; - -- time_left = wait_for_completion_timeout(&ar->wmi.service_ready, -- WMI_SERVICE_READY_TIMEOUT_HZ); -- if (!time_left) { -- /* Sometimes the PCI HIF doesn't receive interrupt -- * for the service ready message even if the buffer -- * was completed. PCIe sniffer shows that it's -- * because the corresponding CE ring doesn't fires -- * it. Workaround here by polling CE rings once. -- */ -- ath10k_warn(ar, "failed to receive service ready completion, polling..\n"); -- -+ /* Sometimes the PCI HIF doesn't receive interrupt -+ * for the service ready message even if the buffer -+ * was completed. PCIe sniffer shows that it's -+ * because the corresponding CE ring doesn't fires -+ * it. Workaround here by polling CE rings. Since -+ * the message could arrive at any time, continue -+ * polling until timeout. -+ */ -+ do { - for (i = 0; i < CE_COUNT; i++) - ath10k_hif_send_complete_check(ar, i, 1); - -+ /* The 100 ms granularity is a tradeoff considering scheduler -+ * overhead and response latency -+ */ - time_left = wait_for_completion_timeout(&ar->wmi.service_ready, -- WMI_SERVICE_READY_TIMEOUT_HZ); -- if (!time_left) { -- ath10k_warn(ar, "polling timed out\n"); -- return -ETIMEDOUT; -- } -- -- ath10k_warn(ar, "service ready completion received, continuing normally\n"); -- } -+ msecs_to_jiffies(100)); -+ if (time_left) -+ return 0; -+ } while (time_before(jiffies, timeout)); - -- return 0; -+ ath10k_warn(ar, "failed to receive service ready completion\n"); -+ return -ETIMEDOUT; - } - - int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar) -diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c -index 69eea0628e670e..df6e4a112ec48b 100644 ---- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c -+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c -@@ -659,10 +659,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy, - return; - } - -- /* Don't send world or same regdom info to firmware */ -- if (strncmp(request->alpha2, "00", 2) && -- strncmp(request->alpha2, adapter->country_code, -- sizeof(request->alpha2))) { -+ /* Don't send same regdom info to firmware */ -+ if (strncmp(request->alpha2, adapter->country_code, -+ sizeof(request->alpha2)) != 0) { - memcpy(adapter->country_code, request->alpha2, - sizeof(request->alpha2)); - mwifiex_send_domain_info_cmd_fw(wiphy); -diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c -index ba927033bbe8c3..1206769cdc7fd9 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c -@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev) - - return 0; - error: -- ieee80211_free_hw(mt76_hw(dev)); -+ mt76_free_device(mdev); - return ret; - } - -diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c -index 45165cf3e824e6..ae3e02efcc5d75 100644 ---- a/drivers/net/wireless/realtek/rtw89/ser.c -+++ b/drivers/net/wireless/realtek/rtw89/ser.c -@@ -207,7 +207,6 @@ static void rtw89_ser_hdl_work(struct work_struct *work) - - static int ser_send_msg(struct rtw89_ser *ser, u8 event) - { -- struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser); - struct ser_msg *msg = NULL; - - if (test_bit(RTW89_SER_DRV_STOP_RUN, ser->flags)) -@@ -223,7 +222,7 @@ static int ser_send_msg(struct rtw89_ser *ser, u8 event) - list_add(&msg->list, &ser->msg_q); - spin_unlock_irq(&ser->msg_q_lock); - -- ieee80211_queue_work(rtwdev->hw, &ser->ser_hdl_work); -+ schedule_work(&ser->ser_hdl_work); - return 0; - } - -diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c -index 570c58d2b5a585..a15e764bae35b7 100644 ---- a/drivers/nvme/target/fc.c -+++ b/drivers/nvme/target/fc.c -@@ -54,6 +54,8 @@ struct nvmet_fc_ls_req_op { /* for an LS RQST XMT */ - int ls_error; - struct list_head lsreq_list; /* tgtport->ls_req_list */ - bool req_queued; -+ -+ struct work_struct put_work; - }; - - -@@ -111,8 +113,6 @@ struct nvmet_fc_tgtport { - struct nvmet_fc_port_entry *pe; - struct kref ref; - u32 max_sg_cnt; -- -- struct work_struct put_work; - }; - - struct nvmet_fc_port_entry { -@@ -236,12 +236,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc); - static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue); - static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue); - static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport); --static void nvmet_fc_put_tgtport_work(struct work_struct *work) -+static void nvmet_fc_put_lsop_work(struct work_struct *work) - { -- struct nvmet_fc_tgtport *tgtport = -- container_of(work, struct nvmet_fc_tgtport, put_work); -+ struct nvmet_fc_ls_req_op *lsop = -+ container_of(work, struct nvmet_fc_ls_req_op, put_work); - -- nvmet_fc_tgtport_put(tgtport); -+ nvmet_fc_tgtport_put(lsop->tgtport); -+ kfree(lsop); - } - static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport); - static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport, -@@ -368,7 +369,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop) - DMA_BIDIRECTIONAL); - - out_putwork: -- queue_work(nvmet_wq, &tgtport->put_work); -+ queue_work(nvmet_wq, &lsop->put_work); - } - - static int -@@ -389,6 +390,7 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport, - lsreq->done = done; - lsop->req_queued = false; - INIT_LIST_HEAD(&lsop->lsreq_list); -+ INIT_WORK(&lsop->put_work, nvmet_fc_put_lsop_work); - - lsreq->rqstdma = fc_dma_map_single(tgtport->dev, lsreq->rqstaddr, - lsreq->rqstlen + lsreq->rsplen, -@@ -448,8 +450,6 @@ nvmet_fc_disconnect_assoc_done(struct nvmefc_ls_req *lsreq, int status) - __nvmet_fc_finish_ls_req(lsop); - - /* fc-nvme target doesn't care about success or failure of cmd */ -- -- kfree(lsop); - } - - /* -@@ -1407,7 +1407,6 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo, - kref_init(&newrec->ref); - ida_init(&newrec->assoc_cnt); - newrec->max_sg_cnt = template->max_sgl_segments; -- INIT_WORK(&newrec->put_work, nvmet_fc_put_tgtport_work); - - ret = nvmet_fc_alloc_ls_iodlist(newrec); - if (ret) { -diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c -index 416d6b45d1fe8d..115a21cf869ae6 100644 ---- a/drivers/pci/controller/dwc/pcie-tegra194.c -+++ b/drivers/pci/controller/dwc/pcie-tegra194.c -@@ -1734,9 +1734,9 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie) - ret); - } - -- ret = tegra_pcie_bpmp_set_pll_state(pcie, false); -+ ret = tegra_pcie_bpmp_set_ctrl_state(pcie, false); - if (ret) -- dev_err(pcie->dev, "Failed to turn off UPHY: %d\n", ret); -+ dev_err(pcie->dev, "Failed to disable controller: %d\n", ret); - - pcie->ep_state = EP_STATE_DISABLED; - dev_dbg(pcie->dev, "Uninitialization of endpoint is completed\n"); -diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c -index 038d974a318eaf..80d975dcb2ee27 100644 ---- a/drivers/pci/controller/pci-tegra.c -+++ b/drivers/pci/controller/pci-tegra.c -@@ -1343,7 +1343,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port) - unsigned int i; - int err; - -- port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL); -+ port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL); - if (!port->phys) - return -ENOMEM; - -diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c -index 2bec2e3af0bd62..affa78376b6a80 100644 ---- a/drivers/perf/arm_spe_pmu.c -+++ b/drivers/perf/arm_spe_pmu.c -@@ -96,7 +96,8 @@ struct arm_spe_pmu { - #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu)) - - /* Convert a free-running index from perf into an SPE buffer offset */ --#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) -+#define PERF_IDX2OFF(idx, buf) \ -+ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) - - /* Keep track of our dynamic hotplug state */ - static enum cpuhp_state arm_spe_pmu_online; -diff --git a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c -index 2354ce8b215943..9ef496092b7e6a 100644 ---- a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c -+++ b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c -@@ -122,6 +122,8 @@ struct rockchip_combphy_grfcfg { - struct combphy_reg pipe_xpcs_phy_ready; - struct combphy_reg pipe_pcie1l0_sel; - struct combphy_reg pipe_pcie1l1_sel; -+ struct combphy_reg u3otg0_port_en; -+ struct combphy_reg u3otg1_port_en; - }; - - struct rockchip_combphy_cfg { -@@ -431,6 +433,14 @@ static int rk3568_combphy_cfg(struct rockchip_combphy_priv *priv) - rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txcomp_sel, false); - rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txelec_sel, false); - rockchip_combphy_param_write(priv->phy_grf, &cfg->usb_mode_set, true); -+ switch (priv->id) { -+ case 0: -+ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg0_port_en, true); -+ break; -+ case 1: -+ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg1_port_en, true); -+ break; -+ } - break; - - case PHY_TYPE_SATA: -@@ -574,6 +584,8 @@ static const struct rockchip_combphy_grfcfg rk3568_combphy_grfcfgs = { - /* pipe-grf */ - .pipe_con0_for_sata = { 0x0000, 15, 0, 0x00, 0x2220 }, - .pipe_xpcs_phy_ready = { 0x0040, 2, 2, 0x00, 0x01 }, -+ .u3otg0_port_en = { 0x0104, 15, 0, 0x0181, 0x1100 }, -+ .u3otg1_port_en = { 0x0144, 15, 0, 0x0181, 0x1100 }, - }; - - static const struct rockchip_combphy_cfg rk3568_combphy_cfgs = { -diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c -index 51408996255bd3..e2601e45935e6d 100644 ---- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c -+++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c -@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 }; - static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 }; - static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 }; - -+static const unsigned int i2c_sck_d_pins[] = { GPIOX_11 }; -+static const unsigned int i2c_sda_d_pins[] = { GPIOX_10 }; -+ - static const unsigned int eth_mdio_pins[] = { GPIOZ_0 }; - static const unsigned int eth_mdc_pins[] = { GPIOZ_1 }; - static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 }; -@@ -411,6 +414,8 @@ static struct meson_pmx_group meson_gxl_periphs_groups[] = { - GPIO_GROUP(GPIO_TEST_N), - - /* Bank X */ -+ GROUP(i2c_sda_d, 5, 5), -+ GROUP(i2c_sck_d, 5, 4), - GROUP(sdio_d0, 5, 31), - GROUP(sdio_d1, 5, 30), - GROUP(sdio_d2, 5, 29), -@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = { - "i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19", - }; - -+static const char * const i2c_d_groups[] = { -+ "i2c_sck_d", "i2c_sda_d", -+}; -+ - static const char * const eth_groups[] = { - "eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv", - "eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3", -@@ -777,6 +786,7 @@ static struct meson_pmx_func meson_gxl_periphs_functions[] = { - FUNCTION(i2c_a), - FUNCTION(i2c_b), - FUNCTION(i2c_c), -+ FUNCTION(i2c_d), - FUNCTION(eth), - FUNCTION(pwm_a), - FUNCTION(pwm_b), -diff --git a/drivers/pinctrl/pinmux.c b/drivers/pinctrl/pinmux.c -index ab853d6c586b60..1c324d216ad773 100644 ---- a/drivers/pinctrl/pinmux.c -+++ b/drivers/pinctrl/pinmux.c -@@ -339,7 +339,7 @@ static int pinmux_func_name_to_selector(struct pinctrl_dev *pctldev, - while (selector < nfuncs) { - const char *fname = ops->get_function_name(pctldev, selector); - -- if (!strcmp(function, fname)) -+ if (fname && !strcmp(function, fname)) - return selector; - - selector++; -diff --git a/drivers/pinctrl/renesas/pinctrl.c b/drivers/pinctrl/renesas/pinctrl.c -index 4d9d58fc1356ff..852e179f9e3837 100644 ---- a/drivers/pinctrl/renesas/pinctrl.c -+++ b/drivers/pinctrl/renesas/pinctrl.c -@@ -730,7 +730,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group, - struct sh_pfc_pinctrl *pmx = pinctrl_dev_get_drvdata(pctldev); - const unsigned int *pins; - unsigned int num_pins; -- unsigned int i, ret; -+ unsigned int i; -+ int ret; - - pins = pmx->pfc->info->groups[group].pins; - num_pins = pmx->pfc->info->groups[group].nr_pins; -diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c -index 99f3ccdc30a6a7..434e3233c9f8c6 100644 ---- a/drivers/power/supply/cw2015_battery.c -+++ b/drivers/power/supply/cw2015_battery.c -@@ -702,8 +702,7 @@ static int cw_bat_probe(struct i2c_client *client) - if (!cw_bat->battery_workqueue) - return -ENOMEM; - -- devm_delayed_work_autocancel(&client->dev, -- &cw_bat->battery_delay_work, cw_bat_work); -+ devm_delayed_work_autocancel(&client->dev, &cw_bat->battery_delay_work, cw_bat_work); - queue_delayed_work(cw_bat->battery_workqueue, - &cw_bat->battery_delay_work, msecs_to_jiffies(10)); - return 0; -diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c -index 92d1b62ea239d7..e9389876229eaa 100644 ---- a/drivers/pps/kapi.c -+++ b/drivers/pps/kapi.c -@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info, - if (err < 0) { - pr_err("%s: unable to create char device\n", - info->name); -- goto kfree_pps; -+ goto pps_register_source_exit; - } - - dev_dbg(&pps->dev, "new PPS source %s\n", info->name); - - return pps; - --kfree_pps: -- kfree(pps); -- - pps_register_source_exit: - pr_err("%s: unable to register source\n", info->name); - -diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c -index e1689957736d95..9539695b337a81 100644 ---- a/drivers/pps/pps.c -+++ b/drivers/pps/pps.c -@@ -375,6 +375,7 @@ int pps_register_cdev(struct pps_device *pps) - pps->info.name); - err = -EBUSY; - } -+ kfree(pps); - goto out_unlock; - } - pps->id = err; -@@ -384,13 +385,11 @@ int pps_register_cdev(struct pps_device *pps) - pps->dev.devt = MKDEV(pps_major, pps->id); - dev_set_drvdata(&pps->dev, pps); - dev_set_name(&pps->dev, "pps%d", pps->id); -+ pps->dev.release = pps_device_destruct; - err = device_register(&pps->dev); - if (err) - goto free_idr; - -- /* Override the release function with our own */ -- pps->dev.release = pps_device_destruct; -- - pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major, - pps->id); - -diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c -index ecbfd7e954ecb8..d693b2d65cccf9 100644 ---- a/drivers/pwm/pwm-tiehrpwm.c -+++ b/drivers/pwm/pwm-tiehrpwm.c -@@ -167,7 +167,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div, - - *prescale_div = (1 << clkdiv) * - (hspclkdiv ? (hspclkdiv * 2) : 1); -- if (*prescale_div > rqst_prescaler) { -+ if (*prescale_div >= rqst_prescaler) { - *tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) | - (hspclkdiv << TBCTL_HSPCLKDIV_SHIFT); - return 0; -@@ -266,7 +266,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, - pc->period_cycles[pwm->hwpwm] = period_cycles; - - /* Configure clock prescaler to support Low frequency PWM wave */ -- if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval, -+ if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval, - &tb_divval)) { - dev_err(chip->dev, "Unsupported values\n"); - return -EINVAL; -diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-regulator.c -index 29ab217297d6dd..432654fbd7a126 100644 ---- a/drivers/regulator/scmi-regulator.c -+++ b/drivers/regulator/scmi-regulator.c -@@ -257,7 +257,8 @@ static int process_scmi_regulator_of_node(struct scmi_device *sdev, - struct device_node *np, - struct scmi_regulator_info *rinfo) - { -- u32 dom, ret; -+ u32 dom; -+ int ret; - - ret = of_property_read_u32(np, "reg", &dom); - if (ret) -diff --git a/drivers/remoteproc/pru_rproc.c b/drivers/remoteproc/pru_rproc.c -index 327f0c7ee3d6ba..7ffbae209a31fb 100644 ---- a/drivers/remoteproc/pru_rproc.c -+++ b/drivers/remoteproc/pru_rproc.c -@@ -340,7 +340,7 @@ EXPORT_SYMBOL_GPL(pru_rproc_put); - */ - int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c, u32 addr) - { -- struct pru_rproc *pru = rproc->priv; -+ struct pru_rproc *pru; - unsigned int reg; - u32 mask, set; - u16 idx; -@@ -352,6 +352,7 @@ int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c, u32 addr) - if (!rproc->dev.parent || !is_pru_rproc(rproc->dev.parent)) - return -ENODEV; - -+ pru = rproc->priv; - /* pointer is 16 bit and index is 8-bit so mask out the rest */ - idx_mask = (c >= PRU_C28) ? 0xFFFF : 0xFF; - -diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c -index 4ee5e67a9f03f5..769c6d6d6a7316 100644 ---- a/drivers/remoteproc/qcom_q6v5.c -+++ b/drivers/remoteproc/qcom_q6v5.c -@@ -156,9 +156,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout) - int ret; - - ret = wait_for_completion_timeout(&q6v5->start_done, timeout); -- if (!ret) -- disable_irq(q6v5->handover_irq); -- - return !ret ? -ETIMEDOUT : 0; - } - EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start); -diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c -index e8a4750f6ec473..7d6e4fe31ceed8 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_transport.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c -@@ -991,11 +991,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address, - list_for_each_entry_safe(mpt3sas_phy, next_phy, - &mpt3sas_port->phy_list, port_siblings) { - if ((ioc->logging_level & MPT_DEBUG_TRANSPORT)) -- dev_printk(KERN_INFO, &mpt3sas_port->port->dev, -- "remove: sas_addr(0x%016llx), phy(%d)\n", -- (unsigned long long) -- mpt3sas_port->remote_identify.sas_address, -- mpt3sas_phy->phy_id); -+ ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n", -+ (unsigned long long) mpt3sas_port->remote_identify.sas_address, -+ mpt3sas_phy->phy_id); - mpt3sas_phy->phy_belongs_to_port = 0; - if (!ioc->remove_host) - sas_port_delete_phy(mpt3sas_port->port, -diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c -index e824be9d9bbb94..9075836ccc3e24 100644 ---- a/drivers/scsi/myrs.c -+++ b/drivers/scsi/myrs.c -@@ -498,14 +498,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, - /* Temporary dma mapping, used only in the scope of this function */ - mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox), - &mbox_addr, GFP_KERNEL); -- if (dma_mapping_error(&pdev->dev, mbox_addr)) -+ if (!mbox) - return false; - - /* These are the base addresses for the command memory mailbox array */ - cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox); - cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size, - &cs->cmd_mbox_addr, GFP_KERNEL); -- if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) { -+ if (!cmd_mbox) { - dev_err(&pdev->dev, "Failed to map command mailbox\n"); - goto out_free; - } -@@ -520,7 +520,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, - cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox); - stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size, - &cs->stat_mbox_addr, GFP_KERNEL); -- if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) { -+ if (!stat_mbox) { - dev_err(&pdev->dev, "Failed to map status mailbox\n"); - goto out_free; - } -@@ -533,7 +533,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, - cs->fwstat_buf = dma_alloc_coherent(&pdev->dev, - sizeof(struct myrs_fwstat), - &cs->fwstat_addr, GFP_KERNEL); -- if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) { -+ if (!cs->fwstat_buf) { - dev_err(&pdev->dev, "Failed to map firmware health buffer\n"); - cs->fwstat_buf = NULL; - goto out_free; -diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c -index a9d6dac4133466..4daab8b6d67527 100644 ---- a/drivers/scsi/pm8001/pm8001_sas.c -+++ b/drivers/scsi/pm8001/pm8001_sas.c -@@ -703,6 +703,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) - unsigned long flags = 0; - struct pm8001_hba_info *pm8001_ha; - struct pm8001_device *pm8001_dev = dev->lldd_dev; -+ struct domain_device *parent_dev = dev->parent; - - pm8001_ha = pm8001_find_ha_by_dev(dev); - spin_lock_irqsave(&pm8001_ha->lock, flags); -@@ -719,7 +720,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) - spin_lock_irqsave(&pm8001_ha->lock, flags); - } - PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id); -- pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; -+ -+ /* -+ * The phy array only contains local phys. Thus, we cannot clear -+ * phy_attached for a device behind an expander. -+ */ -+ if (!(parent_dev && dev_is_expander(parent_dev->dev_type))) -+ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; - pm8001_free_dev(pm8001_dev); - } else { - pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n"); -diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c -index dcde55c8ee5dea..be20e2c457b8ea 100644 ---- a/drivers/scsi/qla2xxx/qla_edif.c -+++ b/drivers/scsi/qla2xxx/qla_edif.c -@@ -1797,7 +1797,7 @@ qla24xx_sadb_update(struct bsg_job *bsg_job) - switch (rval) { - case QLA_SUCCESS: - break; -- case EAGAIN: -+ case -EAGAIN: - msleep(EDIF_MSLEEP_INTERVAL); - cnt++; - if (cnt < EDIF_RETRY_COUNT) -@@ -3648,7 +3648,7 @@ int qla_edif_process_els(scsi_qla_host_t *vha, struct bsg_job *bsg_job) - p->e.extra_rx_xchg_address, p->e.extra_control_flags, - sp->handle, sp->remap.req.len, bsg_job); - break; -- case EAGAIN: -+ case -EAGAIN: - msleep(EDIF_MSLEEP_INTERVAL); - cnt++; - if (cnt < EDIF_RETRY_COUNT) -diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c -index 5fa2727c1bea76..e881d704b45d1b 100644 ---- a/drivers/scsi/qla2xxx/qla_init.c -+++ b/drivers/scsi/qla2xxx/qla_init.c -@@ -2059,11 +2059,11 @@ static void qla_marker_sp_done(srb_t *sp, int res) - int cnt = 5; \ - do { \ - if (_chip_gen != sp->vha->hw->chip_reset || _login_gen != sp->fcport->login_gen) {\ -- _rval = EINVAL; \ -+ _rval = -EINVAL; \ - break; \ - } \ - _rval = qla2x00_start_sp(_sp); \ -- if (_rval == EAGAIN) \ -+ if (_rval == -EAGAIN) \ - msleep(1); \ - else \ - break; \ -diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c -index 8f4cc136a9c9c4..080670cb2aa516 100644 ---- a/drivers/scsi/qla2xxx/qla_nvme.c -+++ b/drivers/scsi/qla2xxx/qla_nvme.c -@@ -420,7 +420,7 @@ static int qla_nvme_xmt_ls_rsp(struct nvme_fc_local_port *lport, - switch (rval) { - case QLA_SUCCESS: - break; -- case EAGAIN: -+ case -EAGAIN: - msleep(PURLS_MSLEEP_INTERVAL); - cnt++; - if (cnt < PURLS_RETRY_COUNT) -diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c -index 163a58eb02e0a2..d0ec42ec0d0419 100644 ---- a/drivers/soc/qcom/rpmh-rsc.c -+++ b/drivers/soc/qcom/rpmh-rsc.c -@@ -453,13 +453,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p) - - trace_rpmh_tx_done(drv, i, req); - -- /* -- * If wake tcs was re-purposed for sending active -- * votes, clear AMC trigger & enable modes and -+ /* Clear AMC trigger & enable modes and - * disable interrupt for this TCS - */ -- if (!drv->tcs[ACTIVE_TCS].num_tcs) -- __tcs_set_trigger(drv, i, false); -+ __tcs_set_trigger(drv, i, false); - skip: - /* Reclaim the TCS */ - write_tcs_reg(drv, drv->regs[RSC_DRV_CMD_ENABLE], i, 0); -diff --git a/drivers/thermal/qcom/Kconfig b/drivers/thermal/qcom/Kconfig -index 2c7f3f9a26ebbb..a6bb01082ec697 100644 ---- a/drivers/thermal/qcom/Kconfig -+++ b/drivers/thermal/qcom/Kconfig -@@ -34,7 +34,8 @@ config QCOM_SPMI_TEMP_ALARM - - config QCOM_LMH - tristate "Qualcomm Limits Management Hardware" -- depends on ARCH_QCOM && QCOM_SCM -+ depends on ARCH_QCOM || COMPILE_TEST -+ select QCOM_SCM - help - This enables initialization of Qualcomm limits management - hardware(LMh). LMh allows for hardware-enforced mitigation for cpus based on -diff --git a/drivers/thermal/qcom/lmh.c b/drivers/thermal/qcom/lmh.c -index d2d49264cf83a4..7c299184c59b1c 100644 ---- a/drivers/thermal/qcom/lmh.c -+++ b/drivers/thermal/qcom/lmh.c -@@ -5,6 +5,8 @@ - */ - #include - #include -+#include -+#include - #include - #include - #include -diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c -index 8559ba1361c645..901f5c8311fbf9 100644 ---- a/drivers/tty/n_gsm.c -+++ b/drivers/tty/n_gsm.c -@@ -460,6 +460,7 @@ static int gsm_send_packet(struct gsm_mux *gsm, struct gsm_msg *msg); - static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr); - static void gsmld_write_trigger(struct gsm_mux *gsm); - static void gsmld_write_task(struct work_struct *work); -+static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci); - - /** - * gsm_fcs_add - update FCS -@@ -2173,7 +2174,7 @@ static void gsm_dlci_open(struct gsm_dlci *dlci) - pr_debug("DLCI %d goes open.\n", dlci->addr); - /* Send current modem state */ - if (dlci->addr) { -- gsm_modem_update(dlci, 0); -+ gsm_modem_send_initial_msc(dlci); - } else { - /* Start keep-alive control */ - gsm->ka_num = 0; -@@ -4156,6 +4157,28 @@ static int gsm_modem_upd_via_msc(struct gsm_dlci *dlci, u8 brk) - return gsm_control_wait(dlci->gsm, ctrl); - } - -+/** -+ * gsm_modem_send_initial_msc - Send initial modem status message -+ * -+ * @dlci channel -+ * -+ * Send an initial MSC message after DLCI open to set the initial -+ * modem status lines. This is only done for basic mode. -+ * Does not wait for a response as we cannot block the input queue -+ * processing. -+ */ -+static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci) -+{ -+ u8 modembits[2]; -+ -+ if (dlci->adaption != 1 || dlci->gsm->encoding != GSM_BASIC_OPT) -+ return 0; -+ -+ modembits[0] = (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */ -+ modembits[1] = (gsm_encode_modem(dlci) << 1) | EA; -+ return gsm_control_command(dlci->gsm, CMD_MSC, (const u8 *)&modembits, 2); -+} -+ - /** - * gsm_modem_update - send modem status line state - * @dlci: channel -diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c -index e339abff926d32..e10dcdeeda2d32 100644 ---- a/drivers/tty/serial/max310x.c -+++ b/drivers/tty/serial/max310x.c -@@ -1659,6 +1659,8 @@ static int max310x_i2c_probe(struct i2c_client *client) - port_client = devm_i2c_new_dummy_device(&client->dev, - client->adapter, - port_addr); -+ if (IS_ERR(port_client)) -+ return PTR_ERR(port_client); - - regmaps[i] = devm_regmap_init_i2c(port_client, ®cfg_i2c); - } -diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c -index 17c1f85f2b7ba2..2724656bf63486 100644 ---- a/drivers/uio/uio_hv_generic.c -+++ b/drivers/uio/uio_hv_generic.c -@@ -96,7 +96,6 @@ static void hv_uio_channel_cb(void *context) - struct hv_device *hv_dev = chan->device_obj; - struct hv_uio_private_data *pdata = hv_get_drvdata(hv_dev); - -- chan->inbound.ring_buffer->interrupt_mask = 1; - virt_mb(); - - uio_event_notify(&pdata->info); -@@ -173,8 +172,6 @@ hv_uio_new_channel(struct vmbus_channel *new_sc) - return; - } - -- /* Disable interrupts on sub channel */ -- new_sc->inbound.ring_buffer->interrupt_mask = 1; - set_channel_read_mode(new_sc, HV_CALL_ISR); - - ret = sysfs_create_bin_file(&new_sc->kobj, &ring_buffer_bin_attr); -@@ -218,9 +215,7 @@ hv_uio_open(struct uio_info *info, struct inode *inode) - - ret = vmbus_connect_ring(dev->channel, - hv_uio_channel_cb, dev->channel); -- if (ret == 0) -- dev->channel->inbound.ring_buffer->interrupt_mask = 1; -- else -+ if (ret) - atomic_dec(&pdata->refcnt); - - return ret; -diff --git a/drivers/usb/cdns3/cdnsp-pci.c b/drivers/usb/cdns3/cdnsp-pci.c -index 159c2eae26608c..b9c74c1baccb28 100644 ---- a/drivers/usb/cdns3/cdnsp-pci.c -+++ b/drivers/usb/cdns3/cdnsp-pci.c -@@ -90,7 +90,7 @@ static int cdnsp_pci_probe(struct pci_dev *pdev, - cdnsp = kzalloc(sizeof(*cdnsp), GFP_KERNEL); - if (!cdnsp) { - ret = -ENOMEM; -- goto disable_pci; -+ goto put_pci; - } - } - -@@ -173,9 +173,6 @@ static int cdnsp_pci_probe(struct pci_dev *pdev, - if (!pci_is_enabled(func)) - kfree(cdnsp); - --disable_pci: -- pci_disable_device(pdev); -- - put_pci: - pci_dev_put(func); - -diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c -index 4c89f7629d5308..9e8af571448bfc 100644 ---- a/drivers/usb/gadget/configfs.c -+++ b/drivers/usb/gadget/configfs.c -@@ -1747,6 +1747,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget, - cdev->use_os_string = true; - cdev->b_vendor_code = gi->b_vendor_code; - memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN); -+ } else { -+ cdev->use_os_string = false; - } - - if (gadget_is_otg(gadget) && !otg_desc[0]) { -diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c -index cc1f579f02de1c..2d792ab271e2ae 100644 ---- a/drivers/usb/host/max3421-hcd.c -+++ b/drivers/usb/host/max3421-hcd.c -@@ -1916,7 +1916,7 @@ max3421_probe(struct spi_device *spi) - if (hcd) { - kfree(max3421_hcd->tx); - kfree(max3421_hcd->rx); -- if (max3421_hcd->spi_thread) -+ if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread)) - kthread_stop(max3421_hcd->spi_thread); - usb_put_hcd(hcd); - } -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index a21ac9d80275f7..6443e11eaac045 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -1224,19 +1224,16 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id, - * Stopped state, but it will soon change to Running. - * - * Assume this bug on unexpected Stop Endpoint failures. -- * Keep retrying until the EP starts and stops again. -+ * Keep retrying until the EP starts and stops again, on -+ * chips where this is known to help. Wait for 100ms. - */ -+ if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100))) -+ break; - fallthrough; - case EP_STATE_RUNNING: - /* Race, HW handled stop ep cmd before ep was running */ - xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n", - GET_EP_CTX_STATE(ep_ctx)); -- /* -- * Don't retry forever if we guessed wrong or a defective HC never starts -- * the EP or says 'Running' but fails the command. We must give back TDs. -- */ -- if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100))) -- break; - - command = xhci_alloc_command(xhci, false, GFP_ATOMIC); - if (!command) { -diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig -index 99b15b77dfd576..fe1b5fec1dfcab 100644 ---- a/drivers/usb/misc/Kconfig -+++ b/drivers/usb/misc/Kconfig -@@ -147,6 +147,7 @@ config USB_APPLEDISPLAY - config USB_QCOM_EUD - tristate "QCOM Embedded USB Debugger(EUD) Driver" - depends on ARCH_QCOM || COMPILE_TEST -+ select QCOM_SCM - select USB_ROLE_SWITCH - help - This module enables support for Qualcomm Technologies, Inc. -diff --git a/drivers/usb/misc/qcom_eud.c b/drivers/usb/misc/qcom_eud.c -index 7f371ea1248c32..cfb195a0f6ce22 100644 ---- a/drivers/usb/misc/qcom_eud.c -+++ b/drivers/usb/misc/qcom_eud.c -@@ -15,6 +15,7 @@ - #include - #include - #include -+#include - - #define EUD_REG_INT1_EN_MASK 0x0024 - #define EUD_REG_INT_STATUS_1 0x0044 -@@ -34,7 +35,7 @@ struct eud_chip { - struct device *dev; - struct usb_role_switch *role_sw; - void __iomem *base; -- void __iomem *mode_mgr; -+ phys_addr_t mode_mgr; - unsigned int int_status; - int irq; - bool enabled; -@@ -43,18 +44,29 @@ struct eud_chip { - - static int enable_eud(struct eud_chip *priv) - { -+ int ret; -+ -+ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 1); -+ if (ret) -+ return ret; -+ - writel(EUD_ENABLE, priv->base + EUD_REG_CSR_EUD_EN); - writel(EUD_INT_VBUS | EUD_INT_SAFE_MODE, - priv->base + EUD_REG_INT1_EN_MASK); -- writel(1, priv->mode_mgr + EUD_REG_EUD_EN2); - - return usb_role_switch_set_role(priv->role_sw, USB_ROLE_DEVICE); - } - --static void disable_eud(struct eud_chip *priv) -+static int disable_eud(struct eud_chip *priv) - { -+ int ret; -+ -+ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 0); -+ if (ret) -+ return ret; -+ - writel(0, priv->base + EUD_REG_CSR_EUD_EN); -- writel(0, priv->mode_mgr + EUD_REG_EUD_EN2); -+ return 0; - } - - static ssize_t enable_show(struct device *dev, -@@ -82,11 +94,12 @@ static ssize_t enable_store(struct device *dev, - chip->enabled = enable; - else - disable_eud(chip); -+ - } else { -- disable_eud(chip); -+ ret = disable_eud(chip); - } - -- return count; -+ return ret < 0 ? ret : count; - } - - static DEVICE_ATTR_RW(enable); -@@ -178,6 +191,7 @@ static void eud_role_switch_release(void *data) - static int eud_probe(struct platform_device *pdev) - { - struct eud_chip *chip; -+ struct resource *res; - int ret; - - chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL); -@@ -200,9 +214,10 @@ static int eud_probe(struct platform_device *pdev) - if (IS_ERR(chip->base)) - return PTR_ERR(chip->base); - -- chip->mode_mgr = devm_platform_ioremap_resource(pdev, 1); -- if (IS_ERR(chip->mode_mgr)) -- return PTR_ERR(chip->mode_mgr); -+ res = platform_get_resource(pdev, IORESOURCE_MEM, 1); -+ if (!res) -+ return -ENODEV; -+ chip->mode_mgr = res->start; - - chip->irq = platform_get_irq(pdev, 0); - ret = devm_request_threaded_irq(&pdev->dev, chip->irq, handle_eud_irq, -diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c -index c3ce6b1054f1c3..292c32ccae0502 100644 ---- a/drivers/usb/phy/phy-twl6030-usb.c -+++ b/drivers/usb/phy/phy-twl6030-usb.c -@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled) - - static int twl6030_usb_probe(struct platform_device *pdev) - { -- u32 ret; - struct twl6030_usb *twl; -- int status, err; -+ int status, err, ret; - struct device_node *np = pdev->dev.of_node; - struct device *dev = &pdev->dev; - -diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c -index 01db27cbf1d10d..3559781d01a38c 100644 ---- a/drivers/usb/typec/tipd/core.c -+++ b/drivers/usb/typec/tipd/core.c -@@ -488,24 +488,23 @@ static irqreturn_t cd321x_interrupt(int irq, void *data) - if (!event) - goto err_unlock; - -+ tps6598x_write64(tps, TPS_REG_INT_CLEAR1, event); -+ - if (!tps6598x_read_status(tps, &status)) -- goto err_clear_ints; -+ goto err_unlock; - - if (event & APPLE_CD_REG_INT_POWER_STATUS_UPDATE) - if (!tps6598x_read_power_status(tps)) -- goto err_clear_ints; -+ goto err_unlock; - - if (event & APPLE_CD_REG_INT_DATA_STATUS_UPDATE) - if (!tps6598x_read_data_status(tps)) -- goto err_clear_ints; -+ goto err_unlock; - - /* Handle plug insert or removal */ - if (event & APPLE_CD_REG_INT_PLUG_EVENT) - tps6598x_handle_plug_event(tps, status); - --err_clear_ints: -- tps6598x_write64(tps, TPS_REG_INT_CLEAR1, event); -- - err_unlock: - mutex_unlock(&tps->lock); - -@@ -552,25 +551,24 @@ static irqreturn_t tps6598x_interrupt(int irq, void *data) - if (!(event1[0] | event1[1] | event2[0] | event2[1])) - goto err_unlock; - -+ tps6598x_block_write(tps, TPS_REG_INT_CLEAR1, event1, intev_len); -+ tps6598x_block_write(tps, TPS_REG_INT_CLEAR2, event2, intev_len); -+ - if (!tps6598x_read_status(tps, &status)) -- goto err_clear_ints; -+ goto err_unlock; - - if ((event1[0] | event2[0]) & TPS_REG_INT_POWER_STATUS_UPDATE) - if (!tps6598x_read_power_status(tps)) -- goto err_clear_ints; -+ goto err_unlock; - - if ((event1[0] | event2[0]) & TPS_REG_INT_DATA_STATUS_UPDATE) - if (!tps6598x_read_data_status(tps)) -- goto err_clear_ints; -+ goto err_unlock; - - /* Handle plug insert or removal */ - if ((event1[0] | event2[0]) & TPS_REG_INT_PLUG_EVENT) - tps6598x_handle_plug_event(tps, status); - --err_clear_ints: -- tps6598x_block_write(tps, TPS_REG_INT_CLEAR1, event1, intev_len); -- tps6598x_block_write(tps, TPS_REG_INT_CLEAR2, event2, intev_len); -- - err_unlock: - mutex_unlock(&tps->lock); - -diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c -index 14a5f55f24fc8c..b22e0881bfaf38 100644 ---- a/drivers/usb/usbip/vhci_hcd.c -+++ b/drivers/usb/usbip/vhci_hcd.c -@@ -764,6 +764,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag - ctrlreq->wValue, vdev->rhport); - - vdev->udev = usb_get_dev(urb->dev); -+ /* -+ * NOTE: A similar operation has been done via -+ * USB_REQ_GET_DESCRIPTOR handler below, which is -+ * supposed to always precede USB_REQ_SET_ADDRESS. -+ * -+ * It's not entirely clear if operating on a different -+ * usb_device instance here is a real possibility, -+ * otherwise this call and vdev->udev assignment above -+ * should be dropped. -+ */ -+ dev_pm_syscore_device(&vdev->udev->dev, true); - usb_put_dev(old); - - spin_lock(&vdev->ud.lock); -@@ -784,6 +795,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag - "Not yet?:Get_Descriptor to device 0 (get max pipe size)\n"); - - vdev->udev = usb_get_dev(urb->dev); -+ /* -+ * Set syscore PM flag for the virtually attached -+ * devices to ensure they will not enter suspend on -+ * the client side. -+ * -+ * Note this doesn't have any impact on the physical -+ * devices attached to the host system on the server -+ * side, hence there is no need to undo the operation -+ * on disconnect. -+ */ -+ dev_pm_syscore_device(&vdev->udev->dev, true); - usb_put_dev(old); - goto out; - -diff --git a/drivers/vfio/pci/pds/dirty.c b/drivers/vfio/pci/pds/dirty.c -index 27607d7b9030a4..6adc5f1ae2eb99 100644 ---- a/drivers/vfio/pci/pds/dirty.c -+++ b/drivers/vfio/pci/pds/dirty.c -@@ -81,7 +81,7 @@ static int pds_vfio_dirty_alloc_bitmaps(struct pds_vfio_dirty *dirty, - - host_ack_bmp = vzalloc(bytes); - if (!host_ack_bmp) { -- bitmap_free(host_seq_bmp); -+ vfree(host_seq_bmp); - return -ENOMEM; - } - -diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c -index 7b8fd977f71ccf..134cc10af776bd 100644 ---- a/drivers/vhost/vringh.c -+++ b/drivers/vhost/vringh.c -@@ -1191,6 +1191,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst, - struct iov_iter iter; - u64 translated; - int ret; -+ size_t size; - - ret = iotlb_translate(vrh, (u64)(uintptr_t)src, - len - total_translated, &translated, -@@ -1208,9 +1209,9 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst, - translated); - } - -- ret = copy_from_iter(dst, translated, &iter); -- if (ret < 0) -- return ret; -+ size = copy_from_iter(dst, translated, &iter); -+ if (size != translated) -+ return -EFAULT; - - src += translated; - dst += translated; -@@ -1237,6 +1238,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst, - struct iov_iter iter; - u64 translated; - int ret; -+ size_t size; - - ret = iotlb_translate(vrh, (u64)(uintptr_t)dst, - len - total_translated, &translated, -@@ -1254,9 +1256,9 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst, - translated); - } - -- ret = copy_to_iter(src, translated, &iter); -- if (ret < 0) -- return ret; -+ size = copy_to_iter(src, translated, &iter); -+ if (size != translated) -+ return -EFAULT; - - src += translated; - dst += translated; -diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c -index 867f9f31137971..a4b497ecfa2051 100644 ---- a/drivers/watchdog/mpc8xxx_wdt.c -+++ b/drivers/watchdog/mpc8xxx_wdt.c -@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w) - ddata->swtc = tmp >> 16; - set_bit(WDOG_HW_RUNNING, &ddata->wdd.status); - -+ mpc8xxx_wdt_keepalive(ddata); -+ - return 0; - } - -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index b55d5e2abeb3cb..7afce7b744c018 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -1960,6 +1960,16 @@ static inline bool ext4_verity_in_progress(struct inode *inode) - - #define NEXT_ORPHAN(inode) EXT4_I(inode)->i_dtime - -+/* -+ * Check whether the inode is tracked as orphan (either in orphan file or -+ * orphan list). -+ */ -+static inline bool ext4_inode_orphan_tracked(struct inode *inode) -+{ -+ return ext4_test_inode_state(inode, EXT4_STATE_ORPHAN_FILE) || -+ !list_empty(&EXT4_I(inode)->i_orphan); -+} -+ - /* - * Codes for operating systems - */ -diff --git a/fs/ext4/file.c b/fs/ext4/file.c -index b37e0e4a71bfbe..0d387a5b5a678c 100644 ---- a/fs/ext4/file.c -+++ b/fs/ext4/file.c -@@ -354,7 +354,7 @@ static void ext4_inode_extension_cleanup(struct inode *inode, bool need_trunc) - * to cleanup the orphan list in ext4_handle_inode_extension(). Do it - * now. - */ -- if (!list_empty(&EXT4_I(inode)->i_orphan) && inode->i_nlink) { -+ if (ext4_inode_orphan_tracked(inode) && inode->i_nlink) { - handle_t *handle = ext4_journal_start(inode, EXT4_HT_INODE, 2); - - if (IS_ERR(handle)) { -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 886d4dfa737a27..63b1384823ba56 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -4370,7 +4370,7 @@ static int ext4_fill_raw_inode(struct inode *inode, struct ext4_inode *raw_inode - * old inodes get re-used with the upper 16 bits of the - * uid/gid intact. - */ -- if (ei->i_dtime && list_empty(&ei->i_orphan)) { -+ if (ei->i_dtime && !ext4_inode_orphan_tracked(inode)) { - raw_inode->i_uid_high = 0; - raw_inode->i_gid_high = 0; - } else { -diff --git a/fs/ext4/orphan.c b/fs/ext4/orphan.c -index a23b0c01f8096d..c53918768cb256 100644 ---- a/fs/ext4/orphan.c -+++ b/fs/ext4/orphan.c -@@ -109,11 +109,7 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode) - - WARN_ON_ONCE(!(inode->i_state & (I_NEW | I_FREEING)) && - !inode_is_locked(inode)); -- /* -- * Inode orphaned in orphan file or in orphan list? -- */ -- if (ext4_test_inode_state(inode, EXT4_STATE_ORPHAN_FILE) || -- !list_empty(&EXT4_I(inode)->i_orphan)) -+ if (ext4_inode_orphan_tracked(inode)) - return 0; - - /* -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 7e3906f1390975..527f53bfe1b1f0 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -1464,9 +1464,9 @@ static void ext4_free_in_core_inode(struct inode *inode) - - static void ext4_destroy_inode(struct inode *inode) - { -- if (!list_empty(&(EXT4_I(inode)->i_orphan))) { -+ if (ext4_inode_orphan_tracked(inode)) { - ext4_msg(inode->i_sb, KERN_ERR, -- "Inode %lu (%p): orphan list check failed!", -+ "Inode %lu (%p): inode tracked as orphan!", - inode->i_ino, EXT4_I(inode)); - print_hex_dump(KERN_INFO, "", DUMP_PREFIX_ADDRESS, 16, 4, - EXT4_I(inode), sizeof(struct ext4_inode_info), -diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c -index d37104aa847a74..fe23ebfc88ea14 100644 ---- a/fs/f2fs/data.c -+++ b/fs/f2fs/data.c -@@ -1751,12 +1751,13 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag) - if (map->m_flags & F2FS_MAP_MAPPED) { - unsigned int ofs = start_pgofs - map->m_lblk; - -- f2fs_update_read_extent_cache_range(&dn, -- start_pgofs, map->m_pblk + ofs, -- map->m_len - ofs); -+ if (map->m_len > ofs) -+ f2fs_update_read_extent_cache_range(&dn, -+ start_pgofs, map->m_pblk + ofs, -+ map->m_len - ofs); - } - if (map->m_next_extent) -- *map->m_next_extent = pgofs + 1; -+ *map->m_next_extent = is_hole ? pgofs + 1 : pgofs; - } - f2fs_put_dnode(&dn); - unlock_out: -diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h -index 7329f706da83c3..ab2ddd09d8131c 100644 ---- a/fs/f2fs/f2fs.h -+++ b/fs/f2fs/f2fs.h -@@ -2296,8 +2296,6 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi, - { - if (!inode) - return true; -- if (!test_opt(sbi, RESERVE_ROOT)) -- return false; - if (IS_NOQUOTA(inode)) - return true; - if (uid_eq(F2FS_OPTION(sbi).s_resuid, current_fsuid())) -@@ -2318,7 +2316,7 @@ static inline unsigned int get_available_block_count(struct f2fs_sb_info *sbi, - avail_user_block_count = sbi->user_block_count - - sbi->current_reserved_blocks; - -- if (!__allow_reserved_blocks(sbi, inode, cap)) -+ if (test_opt(sbi, RESERVE_ROOT) && !__allow_reserved_blocks(sbi, inode, cap)) - avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks; - - if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) { -diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c -index 031015823acb2b..6267ba6ef10839 100644 ---- a/fs/f2fs/file.c -+++ b/fs/f2fs/file.c -@@ -36,15 +36,23 @@ - #include - #include - --static void f2fs_zero_post_eof_page(struct inode *inode, loff_t new_size) -+static void f2fs_zero_post_eof_page(struct inode *inode, -+ loff_t new_size, bool lock) - { - loff_t old_size = i_size_read(inode); - - if (old_size >= new_size) - return; - -+ if (mapping_empty(inode->i_mapping)) -+ return; -+ -+ if (lock) -+ filemap_invalidate_lock(inode->i_mapping); - /* zero or drop pages only in range of [old_size, new_size] */ -- truncate_pagecache(inode, old_size); -+ truncate_inode_pages_range(inode->i_mapping, old_size, new_size); -+ if (lock) -+ filemap_invalidate_unlock(inode->i_mapping); - } - - static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf) -@@ -115,9 +123,7 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf) - - f2fs_bug_on(sbi, f2fs_has_inline_data(inode)); - -- filemap_invalidate_lock(inode->i_mapping); -- f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT); -- filemap_invalidate_unlock(inode->i_mapping); -+ f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT, true); - - file_update_time(vmf->vma->vm_file); - filemap_invalidate_lock_shared(inode->i_mapping); -@@ -844,8 +850,16 @@ int f2fs_truncate(struct inode *inode) - /* we should check inline_data size */ - if (!f2fs_may_inline_data(inode)) { - err = f2fs_convert_inline_inode(inode); -- if (err) -+ if (err) { -+ /* -+ * Always truncate page #0 to avoid page cache -+ * leak in evict() path. -+ */ -+ truncate_inode_pages_range(inode->i_mapping, -+ F2FS_BLK_TO_BYTES(0), -+ F2FS_BLK_END_BYTES(0)); - return err; -+ } - } - - err = f2fs_truncate_blocks(inode, i_size_read(inode), true); -@@ -1069,7 +1083,7 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, - filemap_invalidate_lock(inode->i_mapping); - - if (attr->ia_size > old_size) -- f2fs_zero_post_eof_page(inode, attr->ia_size); -+ f2fs_zero_post_eof_page(inode, attr->ia_size, false); - truncate_setsize(inode, attr->ia_size); - - if (attr->ia_size <= old_size) -@@ -1188,9 +1202,7 @@ static int f2fs_punch_hole(struct inode *inode, loff_t offset, loff_t len) - if (ret) - return ret; - -- filemap_invalidate_lock(inode->i_mapping); -- f2fs_zero_post_eof_page(inode, offset + len); -- filemap_invalidate_unlock(inode->i_mapping); -+ f2fs_zero_post_eof_page(inode, offset + len, true); - - pg_start = ((unsigned long long) offset) >> PAGE_SHIFT; - pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT; -@@ -1476,7 +1488,7 @@ static int f2fs_do_collapse(struct inode *inode, loff_t offset, loff_t len) - f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); - filemap_invalidate_lock(inode->i_mapping); - -- f2fs_zero_post_eof_page(inode, offset + len); -+ f2fs_zero_post_eof_page(inode, offset + len, false); - - f2fs_lock_op(sbi); - f2fs_drop_extent_tree(inode); -@@ -1600,9 +1612,7 @@ static int f2fs_zero_range(struct inode *inode, loff_t offset, loff_t len, - if (ret) - return ret; - -- filemap_invalidate_lock(mapping); -- f2fs_zero_post_eof_page(inode, offset + len); -- filemap_invalidate_unlock(mapping); -+ f2fs_zero_post_eof_page(inode, offset + len, true); - - pg_start = ((unsigned long long) offset) >> PAGE_SHIFT; - pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT; -@@ -1736,7 +1746,7 @@ static int f2fs_insert_range(struct inode *inode, loff_t offset, loff_t len) - f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); - filemap_invalidate_lock(mapping); - -- f2fs_zero_post_eof_page(inode, offset + len); -+ f2fs_zero_post_eof_page(inode, offset + len, false); - truncate_pagecache(inode, offset); - - while (!ret && idx > pg_start) { -@@ -1792,9 +1802,7 @@ static int f2fs_expand_inode_data(struct inode *inode, loff_t offset, - if (err) - return err; - -- filemap_invalidate_lock(inode->i_mapping); -- f2fs_zero_post_eof_page(inode, offset + len); -- filemap_invalidate_unlock(inode->i_mapping); -+ f2fs_zero_post_eof_page(inode, offset + len, true); - - f2fs_balance_fs(sbi, true); - -@@ -4710,9 +4718,8 @@ static ssize_t f2fs_write_checks(struct kiocb *iocb, struct iov_iter *from) - if (err) - return err; - -- filemap_invalidate_lock(inode->i_mapping); -- f2fs_zero_post_eof_page(inode, iocb->ki_pos + iov_iter_count(from)); -- filemap_invalidate_unlock(inode->i_mapping); -+ f2fs_zero_post_eof_page(inode, -+ iocb->ki_pos + iov_iter_count(from), true); - return count; - } - -diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c -index 687670075d2256..c4bc86c3535ba6 100644 ---- a/fs/gfs2/glock.c -+++ b/fs/gfs2/glock.c -@@ -811,8 +811,6 @@ __acquires(&gl->gl_lockref.lock) - clear_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags); - gfs2_glock_queue_work(gl, GL_GLOCK_DFT_HOLD); - return; -- } else { -- clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags); - } - } - -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 124b9cee6fed7d..94a1caf3266991 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -9226,7 +9226,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args - goto out; - if (rcvd->max_rqst_sz > sent->max_rqst_sz) - return -EINVAL; -- if (rcvd->max_resp_sz < sent->max_resp_sz) -+ if (rcvd->max_resp_sz > sent->max_resp_sz) - return -EINVAL; - if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached) - return -EINVAL; -diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c -index 191b91ffadbb21..f227db9f76c2b4 100644 ---- a/fs/ntfs3/index.c -+++ b/fs/ntfs3/index.c -@@ -1510,6 +1510,16 @@ static int indx_add_allocate(struct ntfs_index *indx, struct ntfs_inode *ni, - bmp_size = bmp_size_v = le32_to_cpu(bmp->res.data_size); - } - -+ /* -+ * Index blocks exist, but $BITMAP has zero valid bits. -+ * This implies an on-disk corruption and must be rejected. -+ */ -+ if (in->name == I30_NAME && -+ unlikely(bmp_size_v == 0 && indx->alloc_run.count)) { -+ err = -EINVAL; -+ goto out1; -+ } -+ - bit = bmp_size << 3; - } - -diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c -index 44e93ad491ba77..0139124578d9e2 100644 ---- a/fs/ntfs3/run.c -+++ b/fs/ntfs3/run.c -@@ -9,6 +9,7 @@ - #include - #include - #include -+#include - - #include "debug.h" - #include "ntfs.h" -@@ -982,12 +983,16 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, - - if (!dlcn) - return -EINVAL; -- lcn = prev_lcn + dlcn; -+ -+ if (check_add_overflow(prev_lcn, dlcn, &lcn)) -+ return -EINVAL; - prev_lcn = lcn; - } else - return -EINVAL; - -- next_vcn = vcn64 + len; -+ if (check_add_overflow(vcn64, len, &next_vcn)) -+ return -EINVAL; -+ - /* Check boundary. */ - if (next_vcn > evcn + 1) - return -EINVAL; -@@ -1151,7 +1156,8 @@ int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn) - return -EINVAL; - - run_buf += size_size + offset_size; -- vcn64 += len; -+ if (check_add_overflow(vcn64, len, &vcn64)) -+ return -EINVAL; - - #ifndef CONFIG_NTFS3_64BIT_CLUSTER - if (vcn64 > 0x100000000ull) -diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c -index 9b76ee66aeb2f4..38c0d6f64fce38 100644 ---- a/fs/ocfs2/stack_user.c -+++ b/fs/ocfs2/stack_user.c -@@ -1018,6 +1018,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn) - printk(KERN_ERR "ocfs2: Could not determine" - " locking version\n"); - user_cluster_disconnect(conn); -+ lc = NULL; - goto out; - } - wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0)); -diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c -index b74f7690473948..ee6a6ba13f89c8 100644 ---- a/fs/smb/client/smb2ops.c -+++ b/fs/smb/client/smb2ops.c -@@ -4152,7 +4152,7 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len, - static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst *rqst, - int num_rqst, const u8 *sig, u8 **iv, - struct aead_request **req, struct sg_table *sgt, -- unsigned int *num_sgs, size_t *sensitive_size) -+ unsigned int *num_sgs) - { - unsigned int req_size = sizeof(**req) + crypto_aead_reqsize(tfm); - unsigned int iv_size = crypto_aead_ivsize(tfm); -@@ -4169,9 +4169,8 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst - len += req_size; - len = ALIGN(len, __alignof__(struct scatterlist)); - len += array_size(*num_sgs, sizeof(struct scatterlist)); -- *sensitive_size = len; - -- p = kvzalloc(len, GFP_NOFS); -+ p = kzalloc(len, GFP_NOFS); - if (!p) - return ERR_PTR(-ENOMEM); - -@@ -4185,16 +4184,14 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst - - static void *smb2_get_aead_req(struct crypto_aead *tfm, struct smb_rqst *rqst, - int num_rqst, const u8 *sig, u8 **iv, -- struct aead_request **req, struct scatterlist **sgl, -- size_t *sensitive_size) -+ struct aead_request **req, struct scatterlist **sgl) - { - struct sg_table sgtable = {}; - unsigned int skip, num_sgs, i, j; - ssize_t rc; - void *p; - -- p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable, -- &num_sgs, sensitive_size); -+ p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable, &num_sgs); - if (IS_ERR(p)) - return ERR_CAST(p); - -@@ -4283,7 +4280,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, - DECLARE_CRYPTO_WAIT(wait); - unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize); - void *creq; -- size_t sensitive_size; - - rc = smb2_get_enc_key(server, le64_to_cpu(tr_hdr->SessionId), enc, key); - if (rc) { -@@ -4309,8 +4305,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, - return rc; - } - -- creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg, -- &sensitive_size); -+ creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg); - if (IS_ERR(creq)) - return PTR_ERR(creq); - -@@ -4340,7 +4335,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, - if (!rc && enc) - memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE); - -- kvfree_sensitive(creq, sensitive_size); -+ kfree_sensitive(creq); - return rc; - } - -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index ae47450dc40f82..93c31feab3564c 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -5596,7 +5596,8 @@ static int smb2_get_info_filesystem(struct ksmbd_work *work, - - if (!work->tcon->posix_extensions) { - pr_err("client doesn't negotiate with SMB3.1.1 POSIX Extensions\n"); -- rc = -EOPNOTSUPP; -+ path_put(&path); -+ return -EOPNOTSUPP; - } else { - info = (struct filesystem_posix_info *)(rsp->Buffer); - info->OptimalTransferSize = cpu_to_le32(stfs.f_bsize); -diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c -index 504e2a1cf33b84..31c1ac256e1be4 100644 ---- a/fs/smb/server/transport_rdma.c -+++ b/fs/smb/server/transport_rdma.c -@@ -152,6 +152,10 @@ struct smb_direct_transport { - struct work_struct disconnect_work; - - bool negotiation_requested; -+ -+ bool legacy_iwarp; -+ u8 initiator_depth; -+ u8 responder_resources; - }; - - #define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport)) -@@ -346,6 +350,9 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id) - t->cm_id = cm_id; - cm_id->context = t; - -+ t->initiator_depth = SMB_DIRECT_CM_INITIATOR_DEPTH; -+ t->responder_resources = 1; -+ - t->status = SMB_DIRECT_CS_NEW; - init_waitqueue_head(&t->wait_status); - -@@ -1623,21 +1630,21 @@ static int smb_direct_send_negotiate_response(struct smb_direct_transport *t, - static int smb_direct_accept_client(struct smb_direct_transport *t) - { - struct rdma_conn_param conn_param; -- struct ib_port_immutable port_immutable; -- u32 ird_ord_hdr[2]; -+ __be32 ird_ord_hdr[2]; - int ret; - -+ /* -+ * smb_direct_handle_connect_request() -+ * already negotiated t->initiator_depth -+ * and t->responder_resources -+ */ - memset(&conn_param, 0, sizeof(conn_param)); -- conn_param.initiator_depth = min_t(u8, t->cm_id->device->attrs.max_qp_rd_atom, -- SMB_DIRECT_CM_INITIATOR_DEPTH); -- conn_param.responder_resources = 0; -- -- t->cm_id->device->ops.get_port_immutable(t->cm_id->device, -- t->cm_id->port_num, -- &port_immutable); -- if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) { -- ird_ord_hdr[0] = conn_param.responder_resources; -- ird_ord_hdr[1] = 1; -+ conn_param.initiator_depth = t->initiator_depth; -+ conn_param.responder_resources = t->responder_resources; -+ -+ if (t->legacy_iwarp) { -+ ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources); -+ ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth); - conn_param.private_data = ird_ord_hdr; - conn_param.private_data_len = sizeof(ird_ord_hdr); - } else { -@@ -2023,10 +2030,13 @@ static bool rdma_frwr_is_supported(struct ib_device_attr *attrs) - return true; - } - --static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id) -+static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id, -+ struct rdma_cm_event *event) - { - struct smb_direct_transport *t; - struct task_struct *handler; -+ u8 peer_initiator_depth; -+ u8 peer_responder_resources; - int ret; - - if (!rdma_frwr_is_supported(&new_cm_id->device->attrs)) { -@@ -2040,6 +2050,67 @@ static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id) - if (!t) - return -ENOMEM; - -+ peer_initiator_depth = event->param.conn.initiator_depth; -+ peer_responder_resources = event->param.conn.responder_resources; -+ if (rdma_protocol_iwarp(new_cm_id->device, new_cm_id->port_num) && -+ event->param.conn.private_data_len == 8) { -+ /* -+ * Legacy clients with only iWarp MPA v1 support -+ * need a private blob in order to negotiate -+ * the IRD/ORD values. -+ */ -+ const __be32 *ird_ord_hdr = event->param.conn.private_data; -+ u32 ird32 = be32_to_cpu(ird_ord_hdr[0]); -+ u32 ord32 = be32_to_cpu(ird_ord_hdr[1]); -+ -+ /* -+ * cifs.ko sends the legacy IRD/ORD negotiation -+ * event if iWarp MPA v2 was used. -+ * -+ * Here we check that the values match and only -+ * mark the client as legacy if they don't match. -+ */ -+ if ((u32)event->param.conn.initiator_depth != ird32 || -+ (u32)event->param.conn.responder_resources != ord32) { -+ /* -+ * There are broken clients (old cifs.ko) -+ * using little endian and also -+ * struct rdma_conn_param only uses u8 -+ * for initiator_depth and responder_resources, -+ * so we truncate the value to U8_MAX. -+ * -+ * smb_direct_accept_client() will then -+ * do the real negotiation in order to -+ * select the minimum between client and -+ * server. -+ */ -+ ird32 = min_t(u32, ird32, U8_MAX); -+ ord32 = min_t(u32, ord32, U8_MAX); -+ -+ t->legacy_iwarp = true; -+ peer_initiator_depth = (u8)ird32; -+ peer_responder_resources = (u8)ord32; -+ } -+ } -+ -+ /* -+ * First set what the we as server are able to support -+ */ -+ t->initiator_depth = min_t(u8, t->initiator_depth, -+ new_cm_id->device->attrs.max_qp_rd_atom); -+ -+ /* -+ * negotiate the value by using the minimum -+ * between client and server if the client provided -+ * non 0 values. -+ */ -+ if (peer_initiator_depth != 0) -+ t->initiator_depth = min_t(u8, t->initiator_depth, -+ peer_initiator_depth); -+ if (peer_responder_resources != 0) -+ t->responder_resources = min_t(u8, t->responder_resources, -+ peer_responder_resources); -+ - ret = smb_direct_connect(t); - if (ret) - goto out_err; -@@ -2064,7 +2135,7 @@ static int smb_direct_listen_handler(struct rdma_cm_id *cm_id, - { - switch (event->event) { - case RDMA_CM_EVENT_CONNECT_REQUEST: { -- int ret = smb_direct_handle_connect_request(cm_id); -+ int ret = smb_direct_handle_connect_request(cm_id, event); - - if (ret) { - pr_err("Can't create transport: %d\n", ret); -diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c -index d5918eba27e371..53104f25de5116 100644 ---- a/fs/squashfs/inode.c -+++ b/fs/squashfs/inode.c -@@ -165,6 +165,7 @@ int squashfs_read_inode(struct inode *inode, long long ino) - squashfs_i(inode)->start = le32_to_cpu(sqsh_ino->start_block); - squashfs_i(inode)->block_list_start = block; - squashfs_i(inode)->offset = offset; -+ squashfs_i(inode)->parent = 0; - inode->i_data.a_ops = &squashfs_aops; - - TRACE("File inode %x:%x, start_block %llx, block_list_start " -@@ -212,6 +213,7 @@ int squashfs_read_inode(struct inode *inode, long long ino) - squashfs_i(inode)->start = le64_to_cpu(sqsh_ino->start_block); - squashfs_i(inode)->block_list_start = block; - squashfs_i(inode)->offset = offset; -+ squashfs_i(inode)->parent = 0; - inode->i_data.a_ops = &squashfs_aops; - - TRACE("File inode %x:%x, start_block %llx, block_list_start " -@@ -292,6 +294,7 @@ int squashfs_read_inode(struct inode *inode, long long ino) - inode->i_mode |= S_IFLNK; - squashfs_i(inode)->start = block; - squashfs_i(inode)->offset = offset; -+ squashfs_i(inode)->parent = 0; - - if (type == SQUASHFS_LSYMLINK_TYPE) { - __le32 xattr; -@@ -329,6 +332,7 @@ int squashfs_read_inode(struct inode *inode, long long ino) - set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); - rdev = le32_to_cpu(sqsh_ino->rdev); - init_special_inode(inode, inode->i_mode, new_decode_dev(rdev)); -+ squashfs_i(inode)->parent = 0; - - TRACE("Device inode %x:%x, rdev %x\n", - SQUASHFS_INODE_BLK(ino), offset, rdev); -@@ -353,6 +357,7 @@ int squashfs_read_inode(struct inode *inode, long long ino) - set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); - rdev = le32_to_cpu(sqsh_ino->rdev); - init_special_inode(inode, inode->i_mode, new_decode_dev(rdev)); -+ squashfs_i(inode)->parent = 0; - - TRACE("Device inode %x:%x, rdev %x\n", - SQUASHFS_INODE_BLK(ino), offset, rdev); -@@ -373,6 +378,7 @@ int squashfs_read_inode(struct inode *inode, long long ino) - inode->i_mode |= S_IFSOCK; - set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); - init_special_inode(inode, inode->i_mode, 0); -+ squashfs_i(inode)->parent = 0; - break; - } - case SQUASHFS_LFIFO_TYPE: -@@ -392,6 +398,7 @@ int squashfs_read_inode(struct inode *inode, long long ino) - inode->i_op = &squashfs_inode_ops; - set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); - init_special_inode(inode, inode->i_mode, 0); -+ squashfs_i(inode)->parent = 0; - break; - } - default: -diff --git a/fs/squashfs/squashfs_fs_i.h b/fs/squashfs/squashfs_fs_i.h -index 2c82d6f2a4561b..8e497ac07b9a83 100644 ---- a/fs/squashfs/squashfs_fs_i.h -+++ b/fs/squashfs/squashfs_fs_i.h -@@ -16,6 +16,7 @@ struct squashfs_inode_info { - u64 xattr; - unsigned int xattr_size; - int xattr_count; -+ int parent; - union { - struct { - u64 fragment_block; -@@ -27,7 +28,6 @@ struct squashfs_inode_info { - u64 dir_idx_start; - int dir_idx_offset; - int dir_idx_cnt; -- int parent; - }; - }; - struct inode vfs_inode; -diff --git a/fs/udf/inode.c b/fs/udf/inode.c -index 2f73119c7ec98a..848c46c5e9d3c3 100644 ---- a/fs/udf/inode.c -+++ b/fs/udf/inode.c -@@ -2265,6 +2265,9 @@ int udf_current_aext(struct inode *inode, struct extent_position *epos, - if (check_add_overflow(sizeof(struct allocExtDesc), - le32_to_cpu(header->lengthAllocDescs), &alen)) - return -1; -+ -+ if (alen > epos->bh->b_size) -+ return -1; - } - - switch (iinfo->i_alloc_type) { -diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h -index cf3f8b9bf43f08..010ac18c05916e 100644 ---- a/include/asm-generic/vmlinux.lds.h -+++ b/include/asm-generic/vmlinux.lds.h -@@ -351,6 +351,7 @@ - __start_once = .; \ - *(.data..once) \ - __end_once = .; \ -+ *(.data..do_once) \ - STRUCT_ALIGN(); \ - *(__tracepoints) \ - /* implement dynamic printk debug */ \ -diff --git a/include/linux/bpf.h b/include/linux/bpf.h -index 83da9c81fa86ad..0af6b2a5273adc 100644 ---- a/include/linux/bpf.h -+++ b/include/linux/bpf.h -@@ -269,6 +269,7 @@ struct bpf_map_owner { - bool xdp_has_frags; - u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE]; - const struct btf_type *attach_func_proto; -+ enum bpf_attach_type expected_attach_type; - }; - - struct bpf_map { -diff --git a/include/linux/once.h b/include/linux/once.h -index 30346fcdc7995d..449a0e34ad5ad9 100644 ---- a/include/linux/once.h -+++ b/include/linux/once.h -@@ -46,7 +46,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key, - #define DO_ONCE(func, ...) \ - ({ \ - bool ___ret = false; \ -- static bool __section(".data..once") ___done = false; \ -+ static bool __section(".data..do_once") ___done = false; \ - static DEFINE_STATIC_KEY_TRUE(___once_key); \ - if (static_branch_unlikely(&___once_key)) { \ - unsigned long ___flags; \ -@@ -64,7 +64,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key, - #define DO_ONCE_SLEEPABLE(func, ...) \ - ({ \ - bool ___ret = false; \ -- static bool __section(".data..once") ___done = false; \ -+ static bool __section(".data..do_once") ___done = false; \ - static DEFINE_STATIC_KEY_TRUE(___once_key); \ - if (static_branch_unlikely(&___once_key)) { \ - ___ret = __do_once_sleepable_start(&___done); \ -diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h -index 1646dadd7f37cf..3b1c8d93b2654c 100644 ---- a/include/trace/events/filelock.h -+++ b/include/trace/events/filelock.h -@@ -27,7 +27,8 @@ - { FL_SLEEP, "FL_SLEEP" }, \ - { FL_DOWNGRADE_PENDING, "FL_DOWNGRADE_PENDING" }, \ - { FL_UNLOCK_PENDING, "FL_UNLOCK_PENDING" }, \ -- { FL_OFDLCK, "FL_OFDLCK" }) -+ { FL_OFDLCK, "FL_OFDLCK" }, \ -+ { FL_RECLAIM, "FL_RECLAIM"}) - - #define show_fl_type(val) \ - __print_symbolic(val, \ -diff --git a/init/Kconfig b/init/Kconfig -index 8b630143c720f6..461591503bf43f 100644 ---- a/init/Kconfig -+++ b/init/Kconfig -@@ -1367,6 +1367,7 @@ config BOOT_CONFIG_EMBED_FILE - - config INITRAMFS_PRESERVE_MTIME - bool "Preserve cpio archive mtimes in initramfs" -+ depends on BLK_DEV_INITRD - default y - help - Each entry in an initramfs cpio archive carries an mtime value. When -diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c -index 3618be05fc3527..a343248c35ded6 100644 ---- a/kernel/bpf/core.c -+++ b/kernel/bpf/core.c -@@ -2279,6 +2279,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, - map->owner->type = prog_type; - map->owner->jited = fp->jited; - map->owner->xdp_has_frags = aux->xdp_has_frags; -+ map->owner->expected_attach_type = fp->expected_attach_type; - map->owner->attach_func_proto = aux->attach_func_proto; - for_each_cgroup_storage_type(i) { - map->owner->storage_cookie[i] = -@@ -2290,6 +2291,10 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, - ret = map->owner->type == prog_type && - map->owner->jited == fp->jited && - map->owner->xdp_has_frags == aux->xdp_has_frags; -+ if (ret && -+ map->map_type == BPF_MAP_TYPE_PROG_ARRAY && -+ map->owner->expected_attach_type != fp->expected_attach_type) -+ ret = false; - for_each_cgroup_storage_type(i) { - if (!ret) - break; -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index a6f825b7fbe6cd..5e644b1b12aaaa 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -13727,7 +13727,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) - } else { /* all other ALU ops: and, sub, xor, add, ... */ - - if (BPF_SRC(insn->code) == BPF_X) { -- if (insn->imm != 0 || insn->off > 1 || -+ if (insn->imm != 0 || (insn->off != 0 && insn->off != 1) || - (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) { - verbose(env, "BPF_ALU uses reserved fields\n"); - return -EINVAL; -@@ -13737,7 +13737,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) - if (err) - return err; - } else { -- if (insn->src_reg != BPF_REG_0 || insn->off > 1 || -+ if (insn->src_reg != BPF_REG_0 || (insn->off != 0 && insn->off != 1) || - (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) { - verbose(env, "BPF_ALU uses reserved fields\n"); - return -EINVAL; -diff --git a/kernel/seccomp.c b/kernel/seccomp.c -index 255999ba9190a6..1d26a0e978f269 100644 ---- a/kernel/seccomp.c -+++ b/kernel/seccomp.c -@@ -1099,7 +1099,7 @@ static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_kn - static bool should_sleep_killable(struct seccomp_filter *match, - struct seccomp_knotif *n) - { -- return match->wait_killable_recv && n->state == SECCOMP_NOTIFY_SENT; -+ return match->wait_killable_recv && n->state >= SECCOMP_NOTIFY_SENT; - } - - static int seccomp_do_user_notification(int this_syscall, -@@ -1146,13 +1146,11 @@ static int seccomp_do_user_notification(int this_syscall, - - if (err != 0) { - /* -- * Check to see if the notifcation got picked up and -- * whether we should switch to wait killable. -+ * Check to see whether we should switch to wait -+ * killable. Only return the interrupted error if not. - */ -- if (!wait_killable && should_sleep_killable(match, &n)) -- continue; -- -- goto interrupted; -+ if (!(!wait_killable && should_sleep_killable(match, &n))) -+ goto interrupted; - } - - addfd = list_first_entry_or_null(&n.addfd, -diff --git a/kernel/smp.c b/kernel/smp.c -index 3eeffeaf5450c6..13b376c7296a54 100644 ---- a/kernel/smp.c -+++ b/kernel/smp.c -@@ -862,16 +862,15 @@ static void smp_call_function_many_cond(const struct cpumask *mask, - * @mask: The set of cpus to run on (only runs on online subset). - * @func: The function to run. This must be fast and non-blocking. - * @info: An arbitrary pointer to pass to the function. -- * @wait: Bitmask that controls the operation. If %SCF_WAIT is set, wait -- * (atomically) until function has completed on other CPUs. If -- * %SCF_RUN_LOCAL is set, the function will also be run locally -- * if the local CPU is set in the @cpumask. -- * -- * If @wait is true, then returns once @func has returned. -+ * @wait: If true, wait (atomically) until function has completed -+ * on other CPUs. - * - * You must not call this function with disabled interrupts or from a - * hardware interrupt handler or from a bottom half handler. Preemption - * must be disabled when calling this function. -+ * -+ * @func is not called on the local CPU even if @mask contains it. Consider -+ * using on_each_cpu_cond_mask() instead if this is not desirable. - */ - void smp_call_function_many(const struct cpumask *mask, - smp_call_func_t func, void *info, bool wait) -diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c -index 8903db0b596026..a896b80252ae11 100644 ---- a/kernel/trace/bpf_trace.c -+++ b/kernel/trace/bpf_trace.c -@@ -2726,18 +2726,23 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link, - struct bpf_run_ctx *old_run_ctx; - int err; - -+ /* -+ * graph tracer framework ensures we won't migrate, so there is no need -+ * to use migrate_disable for bpf_prog_run again. The check here just for -+ * __this_cpu_inc_return. -+ */ -+ cant_sleep(); -+ - if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) { - err = 0; - goto out; - } - -- migrate_disable(); - rcu_read_lock(); - old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx); - err = bpf_prog_run(link->link.prog, regs); - bpf_reset_run_ctx(old_run_ctx); - rcu_read_unlock(); -- migrate_enable(); - - out: - __this_cpu_dec(bpf_prog_active); -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index d57d8f1c2dfea4..0c6745a6a13a59 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -6693,6 +6693,8 @@ long hugetlb_change_protection(struct vm_area_struct *vma, - psize); - } - spin_unlock(ptl); -+ -+ cond_resched(); - } - /* - * Must flush TLB before releasing i_mmap_rwsem: x86's huge_pmd_unshare -diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c -index dc9209f9f1a6a3..a128e5709fa153 100644 ---- a/net/bluetooth/hci_sync.c -+++ b/net/bluetooth/hci_sync.c -@@ -1347,7 +1347,7 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) - { - struct hci_cp_le_set_ext_adv_params cp; - struct hci_rp_le_set_ext_adv_params rp; -- bool connectable; -+ bool connectable, require_privacy; - u32 flags; - bdaddr_t random_addr; - u8 own_addr_type; -@@ -1385,10 +1385,12 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) - return -EPERM; - - /* Set require_privacy to true only when non-connectable -- * advertising is used. In that case it is fine to use a -- * non-resolvable private address. -+ * advertising is used and it is not periodic. -+ * In that case it is fine to use a non-resolvable private address. - */ -- err = hci_get_random_address(hdev, !connectable, -+ require_privacy = !connectable && !(adv && adv->periodic); -+ -+ err = hci_get_random_address(hdev, require_privacy, - adv_use_rpa(hdev, flags), adv, - &own_addr_type, &random_addr); - if (err < 0) -diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c -index b94d202bf3745c..69529a3049e741 100644 ---- a/net/bluetooth/iso.c -+++ b/net/bluetooth/iso.c -@@ -718,6 +718,13 @@ static void iso_sock_kill(struct sock *sk) - - BT_DBG("sk %p state %d", sk, sk->sk_state); - -+ /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */ -+ if (iso_pi(sk)->conn) { -+ iso_conn_lock(iso_pi(sk)->conn); -+ iso_pi(sk)->conn->sk = NULL; -+ iso_conn_unlock(iso_pi(sk)->conn); -+ } -+ - /* Kill poor orphan */ - bt_sock_unlink(&iso_sk_list, sk); - sock_set_flag(sk, SOCK_DEAD); -@@ -2084,7 +2091,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) - skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), - skb->len); - conn->rx_len -= skb->len; -- return; -+ break; - - case ISO_END: - skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), -diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c -index 9b01eaaa0eb2d6..54ddbb2635e2ff 100644 ---- a/net/bluetooth/mgmt.c -+++ b/net/bluetooth/mgmt.c -@@ -4405,13 +4405,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, - return -ENOMEM; - - #ifdef CONFIG_BT_FEATURE_DEBUG -- if (!hdev) { -- flags = bt_dbg_get() ? BIT(0) : 0; -+ flags = bt_dbg_get() ? BIT(0) : 0; - -- memcpy(rp->features[idx].uuid, debug_uuid, 16); -- rp->features[idx].flags = cpu_to_le32(flags); -- idx++; -- } -+ memcpy(rp->features[idx].uuid, debug_uuid, 16); -+ rp->features[idx].flags = cpu_to_le32(flags); -+ idx++; - #endif - - if (hdev && hci_dev_le_state_simultaneous(hdev)) { -diff --git a/net/core/filter.c b/net/core/filter.c -index 7afb7658c38835..b6dbcef649654c 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -9156,13 +9156,17 @@ static bool sock_addr_is_valid_access(int off, int size, - return false; - info->reg_type = PTR_TO_SOCKET; - break; -- default: -- if (type == BPF_READ) { -- if (size != size_default) -- return false; -- } else { -+ case bpf_ctx_range(struct bpf_sock_addr, user_family): -+ case bpf_ctx_range(struct bpf_sock_addr, family): -+ case bpf_ctx_range(struct bpf_sock_addr, type): -+ case bpf_ctx_range(struct bpf_sock_addr, protocol): -+ if (type != BPF_READ) - return false; -- } -+ if (size != size_default) -+ return false; -+ break; -+ default: -+ return false; - } - - return true; -diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c -index 4cb0c896caf978..5c848136bc2667 100644 ---- a/net/ipv4/ping.c -+++ b/net/ipv4/ping.c -@@ -77,6 +77,7 @@ static inline struct hlist_head *ping_hashslot(struct ping_table *table, - - int ping_get_port(struct sock *sk, unsigned short ident) - { -+ struct net *net = sock_net(sk); - struct inet_sock *isk, *isk2; - struct hlist_head *hlist; - struct sock *sk2 = NULL; -@@ -90,9 +91,10 @@ int ping_get_port(struct sock *sk, unsigned short ident) - for (i = 0; i < (1L << 16); i++, result++) { - if (!result) - result++; /* avoid zero */ -- hlist = ping_hashslot(&ping_table, sock_net(sk), -- result); -+ hlist = ping_hashslot(&ping_table, net, result); - sk_for_each(sk2, hlist) { -+ if (!net_eq(sock_net(sk2), net)) -+ continue; - isk2 = inet_sk(sk2); - - if (isk2->inet_num == result) -@@ -108,8 +110,10 @@ int ping_get_port(struct sock *sk, unsigned short ident) - if (i >= (1L << 16)) - goto fail; - } else { -- hlist = ping_hashslot(&ping_table, sock_net(sk), ident); -+ hlist = ping_hashslot(&ping_table, net, ident); - sk_for_each(sk2, hlist) { -+ if (!net_eq(sock_net(sk2), net)) -+ continue; - isk2 = inet_sk(sk2); - - /* BUG? Why is this reuse and not reuseaddr? ping.c -@@ -129,7 +133,7 @@ int ping_get_port(struct sock *sk, unsigned short ident) - pr_debug("was not hashed\n"); - sk_add_node_rcu(sk, hlist); - sock_set_flag(sk, SOCK_RCU_FREE); -- sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1); -+ sock_prot_inuse_add(net, sk->sk_prot, 1); - } - spin_unlock(&ping_table.lock); - return 0; -@@ -188,6 +192,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident) - } - - sk_for_each_rcu(sk, hslot) { -+ if (!net_eq(sock_net(sk), net)) -+ continue; - isk = inet_sk(sk); - - pr_debug("iterate\n"); -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 40a2f172be2cbd..7d824578f217a8 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -2786,8 +2786,8 @@ bool tcp_check_oom(struct sock *sk, int shift) - - void __tcp_close(struct sock *sk, long timeout) - { -+ bool data_was_unread = false; - struct sk_buff *skb; -- int data_was_unread = 0; - int state; - - WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK); -@@ -2806,11 +2806,12 @@ void __tcp_close(struct sock *sk, long timeout) - * reader process may not have drained the data yet! - */ - while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) { -- u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq; -+ u32 end_seq = TCP_SKB_CB(skb)->end_seq; - - if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) -- len--; -- data_was_unread += len; -+ end_seq--; -+ if (after(end_seq, tcp_sk(sk)->copied_seq)) -+ data_was_unread = true; - __kfree_skb(skb); - } - -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index 210337ef23cf5c..164c6e80498265 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -5219,12 +5219,20 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, - } - - rx.sdata = prev_sta->sdata; -+ if (!status->link_valid && prev_sta->sta.mlo) { -+ struct link_sta_info *link_sta; -+ -+ link_sta = link_sta_info_get_bss(rx.sdata, -+ hdr->addr2); -+ if (!link_sta) -+ continue; -+ -+ link_id = link_sta->link_id; -+ } -+ - if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) - goto out; - -- if (!status->link_valid && prev_sta->sta.mlo) -- continue; -- - ieee80211_prepare_and_rx_handle(&rx, skb, false); - - prev_sta = sta; -@@ -5232,10 +5240,18 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, - - if (prev_sta) { - rx.sdata = prev_sta->sdata; -- if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) -- goto out; -+ if (!status->link_valid && prev_sta->sta.mlo) { -+ struct link_sta_info *link_sta; -+ -+ link_sta = link_sta_info_get_bss(rx.sdata, -+ hdr->addr2); -+ if (!link_sta) -+ goto out; - -- if (!status->link_valid && prev_sta->sta.mlo) -+ link_id = link_sta->link_id; -+ } -+ -+ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) - goto out; - - if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) -diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h -index c2d88b1b06b872..20b223e6e93b9c 100644 ---- a/net/netfilter/ipset/ip_set_hash_gen.h -+++ b/net/netfilter/ipset/ip_set_hash_gen.h -@@ -62,7 +62,7 @@ struct hbucket { - : jhash_size((htable_bits) - HTABLE_REGION_BITS)) - #define ahash_sizeof_regions(htable_bits) \ - (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region)) --#define ahash_region(n, htable_bits) \ -+#define ahash_region(n) \ - ((n) / jhash_size(HTABLE_REGION_BITS)) - #define ahash_bucket_start(h, htable_bits) \ - ((htable_bits) < HTABLE_REGION_BITS ? 0 \ -@@ -701,7 +701,7 @@ mtype_resize(struct ip_set *set, bool retried) - #endif - key = HKEY(data, h->initval, htable_bits); - m = __ipset_dereference(hbucket(t, key)); -- nr = ahash_region(key, htable_bits); -+ nr = ahash_region(key); - if (!m) { - m = kzalloc(sizeof(*m) + - AHASH_INIT_SIZE * dsize, -@@ -851,7 +851,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext, - rcu_read_lock_bh(); - t = rcu_dereference_bh(h->table); - key = HKEY(value, h->initval, t->htable_bits); -- r = ahash_region(key, t->htable_bits); -+ r = ahash_region(key); - atomic_inc(&t->uref); - elements = t->hregion[r].elements; - maxelem = t->maxelem; -@@ -1049,7 +1049,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext, - rcu_read_lock_bh(); - t = rcu_dereference_bh(h->table); - key = HKEY(value, h->initval, t->htable_bits); -- r = ahash_region(key, t->htable_bits); -+ r = ahash_region(key); - atomic_inc(&t->uref); - rcu_read_unlock_bh(); - -diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c -index 8182833a358280..d9c3eefe8cbb0c 100644 ---- a/net/netfilter/ipvs/ip_vs_conn.c -+++ b/net/netfilter/ipvs/ip_vs_conn.c -@@ -884,7 +884,7 @@ static void ip_vs_conn_expire(struct timer_list *t) - * conntrack cleanup for the net. - */ - smp_rmb(); -- if (ipvs->enable) -+ if (READ_ONCE(ipvs->enable)) - ip_vs_conn_drop_conntrack(cp); - } - -@@ -1432,7 +1432,7 @@ void ip_vs_expire_nodest_conn_flush(struct netns_ipvs *ipvs) - cond_resched_rcu(); - - /* netns clean up started, abort delayed work */ -- if (!ipvs->enable) -+ if (!READ_ONCE(ipvs->enable)) - break; - } - rcu_read_unlock(); -diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c -index 3230506ae3ffd8..34c4648ba36ece 100644 ---- a/net/netfilter/ipvs/ip_vs_core.c -+++ b/net/netfilter/ipvs/ip_vs_core.c -@@ -1353,9 +1353,6 @@ ip_vs_out_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *stat - if (unlikely(!skb_dst(skb))) - return NF_ACCEPT; - -- if (!ipvs->enable) -- return NF_ACCEPT; -- - ip_vs_fill_iph_skb(af, skb, false, &iph); - #ifdef CONFIG_IP_VS_IPV6 - if (af == AF_INET6) { -@@ -1936,7 +1933,7 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state - return NF_ACCEPT; - } - /* ipvs enabled in this netns ? */ -- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable)) -+ if (unlikely(sysctl_backup_only(ipvs))) - return NF_ACCEPT; - - ip_vs_fill_iph_skb(af, skb, false, &iph); -@@ -2104,7 +2101,7 @@ ip_vs_forward_icmp(void *priv, struct sk_buff *skb, - int r; - - /* ipvs enabled in this netns ? */ -- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable)) -+ if (unlikely(sysctl_backup_only(ipvs))) - return NF_ACCEPT; - - if (state->pf == NFPROTO_IPV4) { -@@ -2291,7 +2288,7 @@ static int __net_init __ip_vs_init(struct net *net) - return -ENOMEM; - - /* Hold the beast until a service is registered */ -- ipvs->enable = 0; -+ WRITE_ONCE(ipvs->enable, 0); - ipvs->net = net; - /* Counters used for creating unique names */ - ipvs->gen = atomic_read(&ipvs_netns_cnt); -@@ -2363,7 +2360,7 @@ static void __net_exit __ip_vs_dev_cleanup_batch(struct list_head *net_list) - ipvs = net_ipvs(net); - ip_vs_unregister_hooks(ipvs, AF_INET); - ip_vs_unregister_hooks(ipvs, AF_INET6); -- ipvs->enable = 0; /* Disable packet reception */ -+ WRITE_ONCE(ipvs->enable, 0); /* Disable packet reception */ - smp_wmb(); - ip_vs_sync_net_cleanup(ipvs); - } -diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c -index ae76542de3e989..c82dcbb4dabce2 100644 ---- a/net/netfilter/ipvs/ip_vs_ctl.c -+++ b/net/netfilter/ipvs/ip_vs_ctl.c -@@ -256,7 +256,7 @@ static void est_reload_work_handler(struct work_struct *work) - struct ip_vs_est_kt_data *kd = ipvs->est_kt_arr[id]; - - /* netns clean up started, abort delayed work */ -- if (!ipvs->enable) -+ if (!READ_ONCE(ipvs->enable)) - goto unlock; - if (!kd) - continue; -@@ -1482,9 +1482,9 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u, - - *svc_p = svc; - -- if (!ipvs->enable) { -+ if (!READ_ONCE(ipvs->enable)) { - /* Now there is a service - full throttle */ -- ipvs->enable = 1; -+ WRITE_ONCE(ipvs->enable, 1); - - /* Start estimation for first time */ - ip_vs_est_reload_start(ipvs); -diff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c -index c5970ba416aea8..b48d3a09e21742 100644 ---- a/net/netfilter/ipvs/ip_vs_est.c -+++ b/net/netfilter/ipvs/ip_vs_est.c -@@ -230,7 +230,7 @@ static int ip_vs_estimation_kthread(void *data) - void ip_vs_est_reload_start(struct netns_ipvs *ipvs) - { - /* Ignore reloads before first service is added */ -- if (!ipvs->enable) -+ if (!READ_ONCE(ipvs->enable)) - return; - ip_vs_est_stopped_recalc(ipvs); - /* Bump the kthread configuration genid */ -@@ -304,7 +304,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs) - int i; - - if ((unsigned long)ipvs->est_kt_count >= ipvs->est_max_threads && -- ipvs->enable && ipvs->est_max_threads) -+ READ_ONCE(ipvs->enable) && ipvs->est_max_threads) - return -EINVAL; - - mutex_lock(&ipvs->est_mutex); -@@ -341,7 +341,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs) - } - - /* Start kthread tasks only when services are present */ -- if (ipvs->enable && !ip_vs_est_stopped(ipvs)) { -+ if (READ_ONCE(ipvs->enable) && !ip_vs_est_stopped(ipvs)) { - ret = ip_vs_est_kthread_start(ipvs, kd); - if (ret < 0) - goto out; -@@ -484,7 +484,7 @@ int ip_vs_start_estimator(struct netns_ipvs *ipvs, struct ip_vs_stats *stats) - struct ip_vs_estimator *est = &stats->est; - int ret; - -- if (!ipvs->est_max_threads && ipvs->enable) -+ if (!ipvs->est_max_threads && READ_ONCE(ipvs->enable)) - ipvs->est_max_threads = ip_vs_est_max_threads(ipvs); - - est->ktid = -1; -@@ -661,7 +661,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max) - /* Wait for cpufreq frequency transition */ - wait_event_idle_timeout(wq, kthread_should_stop(), - HZ / 50); -- if (!ipvs->enable || kthread_should_stop()) -+ if (!READ_ONCE(ipvs->enable) || kthread_should_stop()) - goto stop; - } - -@@ -679,7 +679,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max) - rcu_read_unlock(); - local_bh_enable(); - -- if (!ipvs->enable || kthread_should_stop()) -+ if (!READ_ONCE(ipvs->enable) || kthread_should_stop()) - goto stop; - cond_resched(); - -@@ -755,7 +755,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs) - mutex_lock(&ipvs->est_mutex); - for (id = 1; id < ipvs->est_kt_count; id++) { - /* netns clean up started, abort */ -- if (!ipvs->enable) -+ if (!READ_ONCE(ipvs->enable)) - goto unlock2; - kd = ipvs->est_kt_arr[id]; - if (!kd) -@@ -785,7 +785,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs) - id = ipvs->est_kt_count; - - next_kt: -- if (!ipvs->enable || kthread_should_stop()) -+ if (!READ_ONCE(ipvs->enable) || kthread_should_stop()) - goto unlock; - id--; - if (id < 0) -diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c -index ef1f45e43b6308..61d3797fb79954 100644 ---- a/net/netfilter/ipvs/ip_vs_ftp.c -+++ b/net/netfilter/ipvs/ip_vs_ftp.c -@@ -53,6 +53,7 @@ enum { - IP_VS_FTP_EPSV, - }; - -+static bool exiting_module; - /* - * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper - * First port is set to the default port. -@@ -605,7 +606,7 @@ static void __ip_vs_ftp_exit(struct net *net) - { - struct netns_ipvs *ipvs = net_ipvs(net); - -- if (!ipvs) -+ if (!ipvs || !exiting_module) - return; - - unregister_ip_vs_app(ipvs, &ip_vs_ftp); -@@ -627,6 +628,7 @@ static int __init ip_vs_ftp_init(void) - */ - static void __exit ip_vs_ftp_exit(void) - { -+ exiting_module = true; - unregister_pernet_subsys(&ip_vs_ftp_ops); - /* rcu_barrier() is called by netns */ - } -diff --git a/net/nfc/nci/ntf.c b/net/nfc/nci/ntf.c -index 994a0a1efb5890..cb2a672105dc1a 100644 ---- a/net/nfc/nci/ntf.c -+++ b/net/nfc/nci/ntf.c -@@ -27,11 +27,16 @@ - - /* Handle NCI Notification packets */ - --static void nci_core_reset_ntf_packet(struct nci_dev *ndev, -- const struct sk_buff *skb) -+static int nci_core_reset_ntf_packet(struct nci_dev *ndev, -+ const struct sk_buff *skb) - { - /* Handle NCI 2.x core reset notification */ -- const struct nci_core_reset_ntf *ntf = (void *)skb->data; -+ const struct nci_core_reset_ntf *ntf; -+ -+ if (skb->len < sizeof(struct nci_core_reset_ntf)) -+ return -EINVAL; -+ -+ ntf = (struct nci_core_reset_ntf *)skb->data; - - ndev->nci_ver = ntf->nci_ver; - pr_debug("nci_ver 0x%x, config_status 0x%x\n", -@@ -42,15 +47,22 @@ static void nci_core_reset_ntf_packet(struct nci_dev *ndev, - __le32_to_cpu(ntf->manufact_specific_info); - - nci_req_complete(ndev, NCI_STATUS_OK); -+ -+ return 0; - } - --static void nci_core_conn_credits_ntf_packet(struct nci_dev *ndev, -- struct sk_buff *skb) -+static int nci_core_conn_credits_ntf_packet(struct nci_dev *ndev, -+ struct sk_buff *skb) - { -- struct nci_core_conn_credit_ntf *ntf = (void *) skb->data; -+ struct nci_core_conn_credit_ntf *ntf; - struct nci_conn_info *conn_info; - int i; - -+ if (skb->len < sizeof(struct nci_core_conn_credit_ntf)) -+ return -EINVAL; -+ -+ ntf = (struct nci_core_conn_credit_ntf *)skb->data; -+ - pr_debug("num_entries %d\n", ntf->num_entries); - - if (ntf->num_entries > NCI_MAX_NUM_CONN) -@@ -68,7 +80,7 @@ static void nci_core_conn_credits_ntf_packet(struct nci_dev *ndev, - conn_info = nci_get_conn_info_by_conn_id(ndev, - ntf->conn_entries[i].conn_id); - if (!conn_info) -- return; -+ return 0; - - atomic_add(ntf->conn_entries[i].credits, - &conn_info->credits_cnt); -@@ -77,12 +89,19 @@ static void nci_core_conn_credits_ntf_packet(struct nci_dev *ndev, - /* trigger the next tx */ - if (!skb_queue_empty(&ndev->tx_q)) - queue_work(ndev->tx_wq, &ndev->tx_work); -+ -+ return 0; - } - --static void nci_core_generic_error_ntf_packet(struct nci_dev *ndev, -- const struct sk_buff *skb) -+static int nci_core_generic_error_ntf_packet(struct nci_dev *ndev, -+ const struct sk_buff *skb) - { -- __u8 status = skb->data[0]; -+ __u8 status; -+ -+ if (skb->len < 1) -+ return -EINVAL; -+ -+ status = skb->data[0]; - - pr_debug("status 0x%x\n", status); - -@@ -91,12 +110,19 @@ static void nci_core_generic_error_ntf_packet(struct nci_dev *ndev, - (the state remains the same) */ - nci_req_complete(ndev, status); - } -+ -+ return 0; - } - --static void nci_core_conn_intf_error_ntf_packet(struct nci_dev *ndev, -- struct sk_buff *skb) -+static int nci_core_conn_intf_error_ntf_packet(struct nci_dev *ndev, -+ struct sk_buff *skb) - { -- struct nci_core_intf_error_ntf *ntf = (void *) skb->data; -+ struct nci_core_intf_error_ntf *ntf; -+ -+ if (skb->len < sizeof(struct nci_core_intf_error_ntf)) -+ return -EINVAL; -+ -+ ntf = (struct nci_core_intf_error_ntf *)skb->data; - - ntf->conn_id = nci_conn_id(&ntf->conn_id); - -@@ -105,6 +131,8 @@ static void nci_core_conn_intf_error_ntf_packet(struct nci_dev *ndev, - /* complete the data exchange transaction, if exists */ - if (test_bit(NCI_DATA_EXCHANGE, &ndev->flags)) - nci_data_exchange_complete(ndev, NULL, ntf->conn_id, -EIO); -+ -+ return 0; - } - - static const __u8 * -@@ -329,13 +357,18 @@ void nci_clear_target_list(struct nci_dev *ndev) - ndev->n_targets = 0; - } - --static void nci_rf_discover_ntf_packet(struct nci_dev *ndev, -- const struct sk_buff *skb) -+static int nci_rf_discover_ntf_packet(struct nci_dev *ndev, -+ const struct sk_buff *skb) - { - struct nci_rf_discover_ntf ntf; -- const __u8 *data = skb->data; -+ const __u8 *data; - bool add_target = true; - -+ if (skb->len < sizeof(struct nci_rf_discover_ntf)) -+ return -EINVAL; -+ -+ data = skb->data; -+ - ntf.rf_discovery_id = *data++; - ntf.rf_protocol = *data++; - ntf.rf_tech_and_mode = *data++; -@@ -390,6 +423,8 @@ static void nci_rf_discover_ntf_packet(struct nci_dev *ndev, - nfc_targets_found(ndev->nfc_dev, ndev->targets, - ndev->n_targets); - } -+ -+ return 0; - } - - static int nci_extract_activation_params_iso_dep(struct nci_dev *ndev, -@@ -531,14 +566,19 @@ static int nci_store_general_bytes_nfc_dep(struct nci_dev *ndev, - return NCI_STATUS_OK; - } - --static void nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev, -- const struct sk_buff *skb) -+static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev, -+ const struct sk_buff *skb) - { - struct nci_conn_info *conn_info; - struct nci_rf_intf_activated_ntf ntf; -- const __u8 *data = skb->data; -+ const __u8 *data; - int err = NCI_STATUS_OK; - -+ if (skb->len < sizeof(struct nci_rf_intf_activated_ntf)) -+ return -EINVAL; -+ -+ data = skb->data; -+ - ntf.rf_discovery_id = *data++; - ntf.rf_interface = *data++; - ntf.rf_protocol = *data++; -@@ -645,7 +685,7 @@ static void nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev, - if (err == NCI_STATUS_OK) { - conn_info = ndev->rf_conn_info; - if (!conn_info) -- return; -+ return 0; - - conn_info->max_pkt_payload_len = ntf.max_data_pkt_payload_size; - conn_info->initial_num_credits = ntf.initial_num_credits; -@@ -691,19 +731,26 @@ static void nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev, - pr_err("error when signaling tm activation\n"); - } - } -+ -+ return 0; - } - --static void nci_rf_deactivate_ntf_packet(struct nci_dev *ndev, -- const struct sk_buff *skb) -+static int nci_rf_deactivate_ntf_packet(struct nci_dev *ndev, -+ const struct sk_buff *skb) - { - const struct nci_conn_info *conn_info; -- const struct nci_rf_deactivate_ntf *ntf = (void *)skb->data; -+ const struct nci_rf_deactivate_ntf *ntf; -+ -+ if (skb->len < sizeof(struct nci_rf_deactivate_ntf)) -+ return -EINVAL; -+ -+ ntf = (struct nci_rf_deactivate_ntf *)skb->data; - - pr_debug("entry, type 0x%x, reason 0x%x\n", ntf->type, ntf->reason); - - conn_info = ndev->rf_conn_info; - if (!conn_info) -- return; -+ return 0; - - /* drop tx data queue */ - skb_queue_purge(&ndev->tx_q); -@@ -735,14 +782,20 @@ static void nci_rf_deactivate_ntf_packet(struct nci_dev *ndev, - } - - nci_req_complete(ndev, NCI_STATUS_OK); -+ -+ return 0; - } - --static void nci_nfcee_discover_ntf_packet(struct nci_dev *ndev, -- const struct sk_buff *skb) -+static int nci_nfcee_discover_ntf_packet(struct nci_dev *ndev, -+ const struct sk_buff *skb) - { - u8 status = NCI_STATUS_OK; -- const struct nci_nfcee_discover_ntf *nfcee_ntf = -- (struct nci_nfcee_discover_ntf *)skb->data; -+ const struct nci_nfcee_discover_ntf *nfcee_ntf; -+ -+ if (skb->len < sizeof(struct nci_nfcee_discover_ntf)) -+ return -EINVAL; -+ -+ nfcee_ntf = (struct nci_nfcee_discover_ntf *)skb->data; - - /* NFCForum NCI 9.2.1 HCI Network Specific Handling - * If the NFCC supports the HCI Network, it SHALL return one, -@@ -753,6 +806,8 @@ static void nci_nfcee_discover_ntf_packet(struct nci_dev *ndev, - ndev->cur_params.id = nfcee_ntf->nfcee_id; - - nci_req_complete(ndev, status); -+ -+ return 0; - } - - void nci_ntf_packet(struct nci_dev *ndev, struct sk_buff *skb) -@@ -779,35 +834,43 @@ void nci_ntf_packet(struct nci_dev *ndev, struct sk_buff *skb) - - switch (ntf_opcode) { - case NCI_OP_CORE_RESET_NTF: -- nci_core_reset_ntf_packet(ndev, skb); -+ if (nci_core_reset_ntf_packet(ndev, skb)) -+ goto end; - break; - - case NCI_OP_CORE_CONN_CREDITS_NTF: -- nci_core_conn_credits_ntf_packet(ndev, skb); -+ if (nci_core_conn_credits_ntf_packet(ndev, skb)) -+ goto end; - break; - - case NCI_OP_CORE_GENERIC_ERROR_NTF: -- nci_core_generic_error_ntf_packet(ndev, skb); -+ if (nci_core_generic_error_ntf_packet(ndev, skb)) -+ goto end; - break; - - case NCI_OP_CORE_INTF_ERROR_NTF: -- nci_core_conn_intf_error_ntf_packet(ndev, skb); -+ if (nci_core_conn_intf_error_ntf_packet(ndev, skb)) -+ goto end; - break; - - case NCI_OP_RF_DISCOVER_NTF: -- nci_rf_discover_ntf_packet(ndev, skb); -+ if (nci_rf_discover_ntf_packet(ndev, skb)) -+ goto end; - break; - - case NCI_OP_RF_INTF_ACTIVATED_NTF: -- nci_rf_intf_activated_ntf_packet(ndev, skb); -+ if (nci_rf_intf_activated_ntf_packet(ndev, skb)) -+ goto end; - break; - - case NCI_OP_RF_DEACTIVATE_NTF: -- nci_rf_deactivate_ntf_packet(ndev, skb); -+ if (nci_rf_deactivate_ntf_packet(ndev, skb)) -+ goto end; - break; - - case NCI_OP_NFCEE_DISCOVER_NTF: -- nci_nfcee_discover_ntf_packet(ndev, skb); -+ if (nci_nfcee_discover_ntf_packet(ndev, skb)) -+ goto end; - break; - - case NCI_OP_RF_NFCEE_ACTION_NTF: -diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c -index cf30bd649e2704..d063b63516f818 100644 ---- a/net/sunrpc/auth_gss/svcauth_gss.c -+++ b/net/sunrpc/auth_gss/svcauth_gss.c -@@ -724,7 +724,7 @@ svcauth_gss_verify_header(struct svc_rqst *rqstp, struct rsc *rsci, - rqstp->rq_auth_stat = rpc_autherr_badverf; - return SVC_DENIED; - } -- if (flavor != RPC_AUTH_GSS) { -+ if (flavor != RPC_AUTH_GSS || checksum.len < XDR_UNIT) { - rqstp->rq_auth_stat = rpc_autherr_badverf; - return SVC_DENIED; - } -diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c -index b5b0d43bb8dcdd..c3f2717aebf254 100644 ---- a/sound/pci/lx6464es/lx_core.c -+++ b/sound/pci/lx6464es/lx_core.c -@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh) - /* low-level dsp access */ - int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version) - { -- u16 ret; -+ int ret; - - mutex_lock(&chip->msg_lock); - -@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version) - - int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq) - { -- u16 ret = 0; - u32 freq_raw = 0; - u32 freq = 0; - u32 frequency = 0; -+ int ret; - - mutex_lock(&chip->msg_lock); - -diff --git a/sound/soc/codecs/wcd934x.c b/sound/soc/codecs/wcd934x.c -index fe222c4b74c006..c04be088f17a2b 100644 ---- a/sound/soc/codecs/wcd934x.c -+++ b/sound/soc/codecs/wcd934x.c -@@ -5858,6 +5858,13 @@ static const struct snd_soc_component_driver wcd934x_component_drv = { - .endianness = 1, - }; - -+static void wcd934x_put_device_action(void *data) -+{ -+ struct device *dev = data; -+ -+ put_device(dev); -+} -+ - static int wcd934x_codec_parse_data(struct wcd934x_codec *wcd) - { - struct device *dev = &wcd->sdev->dev; -@@ -5878,11 +5885,13 @@ static int wcd934x_codec_parse_data(struct wcd934x_codec *wcd) - } - - slim_get_logical_addr(wcd->sidev); -- wcd->if_regmap = regmap_init_slimbus(wcd->sidev, -+ wcd->if_regmap = devm_regmap_init_slimbus(wcd->sidev, - &wcd934x_ifc_regmap_config); -- if (IS_ERR(wcd->if_regmap)) -+ if (IS_ERR(wcd->if_regmap)) { -+ put_device(&wcd->sidev->dev); - return dev_err_probe(dev, PTR_ERR(wcd->if_regmap), - "Failed to allocate ifc register map\n"); -+ } - - of_property_read_u32(dev->parent->of_node, "qcom,dmic-sample-rate", - &wcd->dmic_sample_rate); -@@ -5926,6 +5935,10 @@ static int wcd934x_codec_probe(struct platform_device *pdev) - return ret; - } - -+ ret = devm_add_action_or_reset(dev, wcd934x_put_device_action, &wcd->sidev->dev); -+ if (ret) -+ return ret; -+ - /* set default rate 9P6MHz */ - regmap_update_bits(wcd->regmap, WCD934X_CODEC_RPM_CLK_MCLK_CFG, - WCD934X_CODEC_RPM_CLK_MCLK_CFG_MCLK_MASK, -diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c -index 7a30d2d36f199b..fbd7e1f0783fd9 100644 ---- a/sound/soc/intel/boards/bytcht_es8316.c -+++ b/sound/soc/intel/boards/bytcht_es8316.c -@@ -46,7 +46,8 @@ enum { - BYT_CHT_ES8316_INTMIC_IN2_MAP, - }; - --#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & GENMASK(3, 0)) -+#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0) -+#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK) - #define BYT_CHT_ES8316_SSP0 BIT(16) - #define BYT_CHT_ES8316_MONO_SPEAKER BIT(17) - #define BYT_CHT_ES8316_JD_INVERTED BIT(18) -@@ -59,10 +60,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); - - static void log_quirks(struct device *dev) - { -- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP) -+ int map; -+ -+ map = BYT_CHT_ES8316_MAP(quirk); -+ switch (map) { -+ case BYT_CHT_ES8316_INTMIC_IN1_MAP: - dev_info(dev, "quirk IN1_MAP enabled"); -- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP) -+ break; -+ case BYT_CHT_ES8316_INTMIC_IN2_MAP: - dev_info(dev, "quirk IN2_MAP enabled"); -+ break; -+ default: -+ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map); -+ quirk &= ~BYT_CHT_ES8316_MAP_MASK; -+ quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP; -+ break; -+ } -+ - if (quirk & BYT_CHT_ES8316_SSP0) - dev_info(dev, "quirk SSP0 enabled"); - if (quirk & BYT_CHT_ES8316_MONO_SPEAKER) -diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c -index 6a85e8fdcae646..beca466dd468ec 100644 ---- a/sound/soc/intel/boards/bytcr_rt5640.c -+++ b/sound/soc/intel/boards/bytcr_rt5640.c -@@ -68,7 +68,8 @@ enum { - BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13), - }; - --#define BYT_RT5640_MAP(quirk) ((quirk) & GENMASK(3, 0)) -+#define BYT_RT5640_MAP_MASK GENMASK(3, 0) -+#define BYT_RT5640_MAP(quirk) ((quirk) & BYT_RT5640_MAP_MASK) - #define BYT_RT5640_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) - #define BYT_RT5640_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) - #define BYT_RT5640_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) -@@ -140,7 +141,9 @@ static void log_quirks(struct device *dev) - dev_info(dev, "quirk NO_INTERNAL_MIC_MAP enabled\n"); - break; - default: -- dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map); -+ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map); -+ byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK; -+ byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP; - break; - } - if (byt_rt5640_quirk & BYT_RT5640_HSMIC2_ON_IN1) -diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c -index 805afaf47b2904..2abe47303ecdb3 100644 ---- a/sound/soc/intel/boards/bytcr_rt5651.c -+++ b/sound/soc/intel/boards/bytcr_rt5651.c -@@ -58,7 +58,8 @@ enum { - BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13), - }; - --#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0)) -+#define BYT_RT5651_MAP_MASK GENMASK(3, 0) -+#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK) - #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) - #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) - #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) -@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); - - static void log_quirks(struct device *dev) - { -- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP) -+ int map; -+ -+ map = BYT_RT5651_MAP(byt_rt5651_quirk); -+ switch (map) { -+ case BYT_RT5651_DMIC_MAP: - dev_info(dev, "quirk DMIC_MAP enabled"); -- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP) -+ break; -+ case BYT_RT5651_IN1_MAP: - dev_info(dev, "quirk IN1_MAP enabled"); -- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP) -+ break; -+ case BYT_RT5651_IN2_MAP: - dev_info(dev, "quirk IN2_MAP enabled"); -- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP) -+ break; -+ case BYT_RT5651_IN1_IN2_MAP: - dev_info(dev, "quirk IN1_IN2_MAP enabled"); -+ break; -+ default: -+ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map); -+ byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK; -+ byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP; -+ break; -+ } -+ - if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) { - dev_info(dev, "quirk realtek,jack-detect-source %ld\n", - BYT_RT5651_JDSRC(byt_rt5651_quirk)); -diff --git a/sound/soc/sof/ipc3-topology.c b/sound/soc/sof/ipc3-topology.c -index 0e5ae7fa0ef7a7..0db8c4b2f0ff2e 100644 ---- a/sound/soc/sof/ipc3-topology.c -+++ b/sound/soc/sof/ipc3-topology.c -@@ -2394,11 +2394,6 @@ static int sof_ipc3_tear_down_all_pipelines(struct snd_sof_dev *sdev, bool verif - if (ret < 0) - return ret; - -- /* free all the scheduler widgets now */ -- ret = sof_ipc3_free_widgets_in_list(sdev, true, &dyn_widgets, verify); -- if (ret < 0) -- return ret; -- - /* - * Tear down all pipelines associated with PCMs that did not get suspended - * and unset the prepare flag so that they can be set up again during resume. -@@ -2414,6 +2409,11 @@ static int sof_ipc3_tear_down_all_pipelines(struct snd_sof_dev *sdev, bool verif - } - } - -+ /* free all the scheduler widgets now. This will also power down the secondary cores */ -+ ret = sof_ipc3_free_widgets_in_list(sdev, true, &dyn_widgets, verify); -+ if (ret < 0) -+ return ret; -+ - list_for_each_entry(sroute, &sdev->route_list, list) - sroute->setup = false; - -diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h -index a9d8b5b51f37f8..f24953f8b949c1 100644 ---- a/tools/include/nolibc/std.h -+++ b/tools/include/nolibc/std.h -@@ -33,6 +33,6 @@ typedef unsigned long nlink_t; - typedef signed long off_t; - typedef signed long blksize_t; - typedef signed long blkcnt_t; --typedef __kernel_old_time_t time_t; -+typedef __kernel_time_t time_t; - - #endif /* _NOLIBC_STD_H */ -diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c -index aefbfa2df6207c..95f2ffefff3ff7 100644 ---- a/tools/lib/bpf/libbpf.c -+++ b/tools/lib/bpf/libbpf.c -@@ -5013,6 +5013,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd) - return false; - } - -+ /* -+ * bpf_get_map_info_by_fd() for DEVMAP will always return flags with -+ * BPF_F_RDONLY_PROG set, but it generally is not set at map creation time. -+ * Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from -+ * bpf_get_map_info_by_fd() when checking for compatibility with an -+ * existing DEVMAP. -+ */ -+ if (map->def.type == BPF_MAP_TYPE_DEVMAP || map->def.type == BPF_MAP_TYPE_DEVMAP_HASH) -+ map_info.map_flags &= ~BPF_F_RDONLY_PROG; -+ - return (map_info.type == map->def.type && - map_info.key_size == map->def.key_size && - map_info.value_size == map->def.value_size && -diff --git a/tools/testing/nvdimm/test/ndtest.c b/tools/testing/nvdimm/test/ndtest.c -index 3eba10c1e3e8f6..e711a2584143f5 100644 ---- a/tools/testing/nvdimm/test/ndtest.c -+++ b/tools/testing/nvdimm/test/ndtest.c -@@ -845,11 +845,22 @@ static int ndtest_probe(struct platform_device *pdev) - - p->dcr_dma = devm_kcalloc(&p->pdev.dev, NUM_DCR, - sizeof(dma_addr_t), GFP_KERNEL); -+ if (!p->dcr_dma) { -+ rc = -ENOMEM; -+ goto err; -+ } - p->label_dma = devm_kcalloc(&p->pdev.dev, NUM_DCR, - sizeof(dma_addr_t), GFP_KERNEL); -+ if (!p->label_dma) { -+ rc = -ENOMEM; -+ goto err; -+ } - p->dimm_dma = devm_kcalloc(&p->pdev.dev, NUM_DCR, - sizeof(dma_addr_t), GFP_KERNEL); -- -+ if (!p->dimm_dma) { -+ rc = -ENOMEM; -+ goto err; -+ } - rc = ndtest_nvdimm_init(p); - if (rc) - goto err; -diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c -index 4435600ca400dd..e597861b26d6bf 100644 ---- a/tools/testing/selftests/arm64/pauth/exec_target.c -+++ b/tools/testing/selftests/arm64/pauth/exec_target.c -@@ -13,7 +13,12 @@ int main(void) - unsigned long hwcaps; - size_t val; - -- fread(&val, sizeof(size_t), 1, stdin); -+ size_t size = fread(&val, sizeof(size_t), 1, stdin); -+ -+ if (size != 1) { -+ fprintf(stderr, "Could not read input from stdin\n"); -+ return EXIT_FAILURE; -+ } - - /* don't try to execute illegal (unimplemented) instructions) caller - * should have checked this and keep worker simple -diff --git a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c -index 540181c115a85a..ef00d38b0a8d24 100644 ---- a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c -+++ b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c -@@ -23,7 +23,6 @@ struct { - - struct { - __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); -- __uint(max_entries, 2); - __type(key, int); - __type(value, __u32); - } perf_event_map SEC(".maps"); -diff --git a/tools/testing/selftests/bpf/test_tcpnotify_user.c b/tools/testing/selftests/bpf/test_tcpnotify_user.c -index 595194453ff8f8..35b4893ccdf8ae 100644 ---- a/tools/testing/selftests/bpf/test_tcpnotify_user.c -+++ b/tools/testing/selftests/bpf/test_tcpnotify_user.c -@@ -15,20 +15,18 @@ - #include - #include - #include --#include - #include --#include - --#include "bpf_util.h" - #include "cgroup_helpers.h" - - #include "test_tcpnotify.h" --#include "trace_helpers.h" - #include "testing_helpers.h" - - #define SOCKET_BUFFER_SIZE (getpagesize() < 8192L ? getpagesize() : 8192L) - - pthread_t tid; -+static bool exit_thread; -+ - int rx_callbacks; - - static void dummyfn(void *ctx, int cpu, void *data, __u32 size) -@@ -45,7 +43,7 @@ void tcp_notifier_poller(struct perf_buffer *pb) - { - int err; - -- while (1) { -+ while (!exit_thread) { - err = perf_buffer__poll(pb, 100); - if (err < 0 && err != -EINTR) { - printf("failed perf_buffer__poll: %d\n", err); -@@ -78,15 +76,10 @@ int main(int argc, char **argv) - int error = EXIT_FAILURE; - struct bpf_object *obj; - char test_script[80]; -- cpu_set_t cpuset; - __u32 key = 0; - - libbpf_set_strict_mode(LIBBPF_STRICT_ALL); - -- CPU_ZERO(&cpuset); -- CPU_SET(0, &cpuset); -- pthread_setaffinity_np(pthread_self(), sizeof(cpu_set_t), &cpuset); -- - cg_fd = cgroup_setup_and_join(cg_path); - if (cg_fd < 0) - goto err; -@@ -151,6 +144,13 @@ int main(int argc, char **argv) - - sleep(10); - -+ exit_thread = true; -+ int ret = pthread_join(tid, NULL); -+ if (ret) { -+ printf("FAILED: pthread_join\n"); -+ goto err; -+ } -+ - if (verify_result(&g)) { - printf("FAILED: Wrong stats Expected %d calls, got %d\n", - g.ncalls, rx_callbacks); -diff --git a/tools/testing/selftests/nolibc/nolibc-test.c b/tools/testing/selftests/nolibc/nolibc-test.c -index 4aaafbfc2f9735..a019de995e5dfd 100644 ---- a/tools/testing/selftests/nolibc/nolibc-test.c -+++ b/tools/testing/selftests/nolibc/nolibc-test.c -@@ -176,8 +176,8 @@ int expect_zr(int expr, int llen) - } - - --#define EXPECT_NZ(cond, expr, val) \ -- do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen; } while (0) -+#define EXPECT_NZ(cond, expr) \ -+ do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen); } while (0) - - static __attribute__((unused)) - int expect_nz(int expr, int llen) -diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c -index a1f506ba557864..4f09c5db0c7f30 100644 ---- a/tools/testing/selftests/watchdog/watchdog-test.c -+++ b/tools/testing/selftests/watchdog/watchdog-test.c -@@ -332,6 +332,12 @@ int main(int argc, char *argv[]) - if (oneshot) - goto end; - -+ /* Check if WDIOF_KEEPALIVEPING is supported */ -+ if (!(info.options & WDIOF_KEEPALIVEPING)) { -+ printf("WDIOC_KEEPALIVE not supported by this device\n"); -+ goto end; -+ } -+ - printf("Watchdog Ticking Away!\n"); - - /* diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.112-113.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.112-113.patch deleted file mode 100644 index 48d54ba46c..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.112-113.patch +++ /dev/null @@ -1,7576 +0,0 @@ -diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt -index 60d48ebbc2cb00..fff3ca50c6c26c 100644 ---- a/Documentation/admin-guide/kernel-parameters.txt -+++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -5638,6 +5638,9 @@ - - rootflags= [KNL] Set root filesystem mount option string - -+ initramfs_options= [KNL] -+ Specify mount options for for the initramfs mount. -+ - rootfstype= [KNL] Set root filesystem type - - rootwait [KNL] Wait (indefinitely) for root device to show up. -diff --git a/Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml b/Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml -index 5ac994b3c0aa15..b304bc5a08c402 100644 ---- a/Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml -+++ b/Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml -@@ -57,11 +57,24 @@ required: - - clocks - - clock-names - - '#phy-cells' -- - power-domains - - resets - - reset-names - - rockchip,grf - -+allOf: -+ - if: -+ properties: -+ compatible: -+ contains: -+ enum: -+ - rockchip,px30-csi-dphy -+ - rockchip,rk1808-csi-dphy -+ - rockchip,rk3326-csi-dphy -+ - rockchip,rk3368-csi-dphy -+ then: -+ required: -+ - power-domains -+ - additionalProperties: false - - examples: -diff --git a/Makefile b/Makefile -index 64d76baa0e0c9b..ab277ff8764317 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 112 -+SUBLEVEL = 113 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm/mach-omap2/pm33xx-core.c b/arch/arm/mach-omap2/pm33xx-core.c -index c907478be196ed..4abb86dc98fdac 100644 ---- a/arch/arm/mach-omap2/pm33xx-core.c -+++ b/arch/arm/mach-omap2/pm33xx-core.c -@@ -388,12 +388,15 @@ static int __init amx3_idle_init(struct device_node *cpu_node, int cpu) - if (!state_node) - break; - -- if (!of_device_is_available(state_node)) -+ if (!of_device_is_available(state_node)) { -+ of_node_put(state_node); - continue; -+ } - - if (i == CPUIDLE_STATE_MAX) { - pr_warn("%s: cpuidle states reached max possible\n", - __func__); -+ of_node_put(state_node); - break; - } - -@@ -403,6 +406,7 @@ static int __init amx3_idle_init(struct device_node *cpu_node, int cpu) - states[state_count].wfi_flags |= WFI_FLAG_WAKE_M3 | - WFI_FLAG_FLUSH_CACHE; - -+ of_node_put(state_node); - state_count++; - } - -diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi -index 6f5f96853ba1c2..701e139a9cbd06 100644 ---- a/arch/arm64/boot/dts/qcom/msm8916.dtsi -+++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi -@@ -1529,6 +1529,8 @@ mdss: display-subsystem@1a00000 { - - interrupts = ; - -+ resets = <&gcc GCC_MDSS_BCR>; -+ - interrupt-controller; - #interrupt-cells = <1>; - -diff --git a/arch/arm64/boot/dts/qcom/msm8939.dtsi b/arch/arm64/boot/dts/qcom/msm8939.dtsi -index c844e01f9aa15b..86432ed25b23a1 100644 ---- a/arch/arm64/boot/dts/qcom/msm8939.dtsi -+++ b/arch/arm64/boot/dts/qcom/msm8939.dtsi -@@ -1210,6 +1210,8 @@ mdss: display-subsystem@1a00000 { - - power-domains = <&gcc MDSS_GDSC>; - -+ resets = <&gcc GCC_MDSS_BCR>; -+ - #address-cells = <1>; - #size-cells = <1>; - #interrupt-cells = <1>; -diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi -index 64ea9d73d970a9..fa91e2036dd56f 100644 ---- a/arch/arm64/boot/dts/qcom/sdm845.dtsi -+++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi -@@ -5208,11 +5208,11 @@ slimbam: dma-controller@17184000 { - compatible = "qcom,bam-v1.7.4", "qcom,bam-v1.7.0"; - qcom,controlled-remotely; - reg = <0 0x17184000 0 0x2a000>; -- num-channels = <31>; -+ num-channels = <23>; - interrupts = ; - #dma-cells = <1>; - qcom,ee = <1>; -- qcom,num-ees = <2>; -+ qcom,num-ees = <4>; - iommus = <&apps_smmu 0x1806 0x0>; - }; - -diff --git a/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi -index 1497f7c8adfaf4..dfdc6e659cc464 100644 ---- a/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi -+++ b/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi -@@ -185,7 +185,7 @@ secure_proxy_sa3: mailbox@43600000 { - - main_pmx0: pinctrl@f4000 { - compatible = "pinctrl-single"; -- reg = <0x00 0xf4000 0x00 0x2ac>; -+ reg = <0x00 0xf4000 0x00 0x25c>; - #pinctrl-cells = <1>; - pinctrl-single,register-width = <32>; - pinctrl-single,function-mask = <0xffffffff>; -diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c -index 2ce9ef9d924aac..4561c4a670afbd 100644 ---- a/arch/arm64/kernel/cpufeature.c -+++ b/arch/arm64/kernel/cpufeature.c -@@ -2174,17 +2174,21 @@ static void bti_enable(const struct arm64_cpu_capabilities *__unused) - #ifdef CONFIG_ARM64_MTE - static void cpu_enable_mte(struct arm64_cpu_capabilities const *cap) - { -+ static bool cleared_zero_page = false; -+ - sysreg_clear_set(sctlr_el1, 0, SCTLR_ELx_ATA | SCTLR_EL1_ATA0); - - mte_cpu_setup(); - - /* - * Clear the tags in the zero page. This needs to be done via the -- * linear map which has the Tagged attribute. -+ * linear map which has the Tagged attribute. Since this page is -+ * always mapped as pte_special(), set_pte_at() will not attempt to -+ * clear the tags or set PG_mte_tagged. - */ -- if (try_page_mte_tagging(ZERO_PAGE(0))) { -+ if (!cleared_zero_page) { -+ cleared_zero_page = true; - mte_clear_page_tags(lm_alias(empty_zero_page)); -- set_page_mte_tagged(ZERO_PAGE(0)); - } - - kasan_init_hw_tags_cpu(); -diff --git a/arch/arm64/kernel/mte.c b/arch/arm64/kernel/mte.c -index 4edecaac8f919a..84ea9c50c076f0 100644 ---- a/arch/arm64/kernel/mte.c -+++ b/arch/arm64/kernel/mte.c -@@ -428,7 +428,8 @@ static int __access_remote_tags(struct mm_struct *mm, unsigned long addr, - put_page(page); - break; - } -- WARN_ON_ONCE(!page_mte_tagged(page)); -+ -+ WARN_ON_ONCE(!page_mte_tagged(page) && !is_zero_page(page)); - - /* limit access to the end of the page */ - offset = offset_in_page(addr); -diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c -index 70b91a8c6bb3f3..c0942cce3b6878 100644 ---- a/arch/arm64/kernel/probes/kprobes.c -+++ b/arch/arm64/kernel/probes/kprobes.c -@@ -131,9 +131,15 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p) - - void *alloc_insn_page(void) - { -- return __vmalloc_node_range(PAGE_SIZE, 1, VMALLOC_START, VMALLOC_END, -+ void *addr; -+ -+ addr = __vmalloc_node_range(PAGE_SIZE, 1, VMALLOC_START, VMALLOC_END, - GFP_KERNEL, PAGE_KERNEL_ROX, VM_FLUSH_RESET_PERMS, - NUMA_NO_NODE, __builtin_return_address(0)); -+ if (!addr) -+ return NULL; -+ set_memory_rox((unsigned long)addr, 1); -+ return addr; - } - - /* arm kprobe: install breakpoint in text */ -diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c -index 655dc2b1616f2c..31be0d00976e22 100644 ---- a/arch/loongarch/kernel/setup.c -+++ b/arch/loongarch/kernel/setup.c -@@ -363,10 +363,9 @@ void __init platform_init(void) - arch_reserve_vmcore(); - arch_parse_crashkernel(); - --#ifdef CONFIG_ACPI_TABLE_UPGRADE -- acpi_table_upgrade(); --#endif - #ifdef CONFIG_ACPI -+ acpi_table_upgrade(); -+ acpi_gbl_use_global_lock = false; - acpi_gbl_use_default_register_widths = false; - acpi_boot_table_init(); - #endif -diff --git a/arch/parisc/include/uapi/asm/ioctls.h b/arch/parisc/include/uapi/asm/ioctls.h -index 82d1148c6379a5..74b4027a4e8083 100644 ---- a/arch/parisc/include/uapi/asm/ioctls.h -+++ b/arch/parisc/include/uapi/asm/ioctls.h -@@ -10,10 +10,10 @@ - #define TCSETS _IOW('T', 17, struct termios) /* TCSETATTR */ - #define TCSETSW _IOW('T', 18, struct termios) /* TCSETATTRD */ - #define TCSETSF _IOW('T', 19, struct termios) /* TCSETATTRF */ --#define TCGETA _IOR('T', 1, struct termio) --#define TCSETA _IOW('T', 2, struct termio) --#define TCSETAW _IOW('T', 3, struct termio) --#define TCSETAF _IOW('T', 4, struct termio) -+#define TCGETA 0x40125401 -+#define TCSETA 0x80125402 -+#define TCSETAW 0x80125403 -+#define TCSETAF 0x80125404 - #define TCSBRK _IO('T', 5) - #define TCXONC _IO('T', 6) - #define TCFLSH _IO('T', 7) -diff --git a/arch/parisc/lib/memcpy.c b/arch/parisc/lib/memcpy.c -index 69d65ffab31263..03165c82dfdbd9 100644 ---- a/arch/parisc/lib/memcpy.c -+++ b/arch/parisc/lib/memcpy.c -@@ -41,7 +41,6 @@ unsigned long raw_copy_from_user(void *dst, const void __user *src, - mtsp(get_kernel_space(), SR_TEMP2); - - /* Check region is user accessible */ -- if (start) - while (start < end) { - if (!prober_user(SR_TEMP1, start)) { - newlen = (start - (unsigned long) src); -diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c -index 28fac477007316..5337ad8a2e340f 100644 ---- a/arch/powerpc/platforms/powernv/pci-ioda.c -+++ b/arch/powerpc/platforms/powernv/pci-ioda.c -@@ -1895,7 +1895,7 @@ static int pnv_irq_domain_alloc(struct irq_domain *domain, unsigned int virq, - return 0; - - out: -- irq_domain_free_irqs_parent(domain, virq, i - 1); -+ irq_domain_free_irqs_parent(domain, virq, i); - msi_bitmap_free_hwirqs(&phb->msi_bmp, hwirq, nr_irqs); - return ret; - } -diff --git a/arch/powerpc/platforms/pseries/msi.c b/arch/powerpc/platforms/pseries/msi.c -index fdcf10cd4d1270..b53f817fc421f8 100644 ---- a/arch/powerpc/platforms/pseries/msi.c -+++ b/arch/powerpc/platforms/pseries/msi.c -@@ -587,7 +587,7 @@ static int pseries_irq_domain_alloc(struct irq_domain *domain, unsigned int virq - - out: - /* TODO: handle RTAS cleanup in ->msi_finish() ? */ -- irq_domain_free_irqs_parent(domain, virq, i - 1); -+ irq_domain_free_irqs_parent(domain, virq, i); - return ret; - } - -diff --git a/arch/s390/net/bpf_jit.h b/arch/s390/net/bpf_jit.h -deleted file mode 100644 -index 7822ea92e54afd..00000000000000 ---- a/arch/s390/net/bpf_jit.h -+++ /dev/null -@@ -1,55 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/* -- * BPF Jit compiler defines -- * -- * Copyright IBM Corp. 2012,2015 -- * -- * Author(s): Martin Schwidefsky -- * Michael Holzheu -- */ -- --#ifndef __ARCH_S390_NET_BPF_JIT_H --#define __ARCH_S390_NET_BPF_JIT_H -- --#ifndef __ASSEMBLY__ -- --#include --#include -- --#endif /* __ASSEMBLY__ */ -- --/* -- * Stackframe layout (packed stack): -- * -- * ^ high -- * +---------------+ | -- * | old backchain | | -- * +---------------+ | -- * | r15 - r6 | | -- * +---------------+ | -- * | 4 byte align | | -- * | tail_call_cnt | | -- * BFP -> +===============+ | -- * | | | -- * | BPF stack | | -- * | | | -- * R15+160 -> +---------------+ | -- * | new backchain | | -- * R15+152 -> +---------------+ | -- * | + 152 byte SA | | -- * R15 -> +---------------+ + low -- * -- * We get 160 bytes stack space from calling function, but only use -- * 12 * 8 byte for old backchain, r15..r6, and tail_call_cnt. -- * -- * The stack size used by the BPF program ("BPF stack" above) is passed -- * via "aux->stack_depth". -- */ --#define STK_SPACE_ADD (160) --#define STK_160_UNUSED (160 - 12 * 8) --#define STK_OFF (STK_SPACE_ADD - STK_160_UNUSED) -- --#define STK_OFF_R6 (160 - 11 * 8) /* Offset of r6 on stack */ --#define STK_OFF_TCCNT (160 - 12 * 8) /* Offset of tail_call_cnt on stack */ -- --#endif /* __ARCH_S390_NET_BPF_JIT_H */ -diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c -index 2d8facfd4e4252..5a64d34a37482b 100644 ---- a/arch/s390/net/bpf_jit_comp.c -+++ b/arch/s390/net/bpf_jit_comp.c -@@ -31,11 +31,10 @@ - #include - #include - #include --#include "bpf_jit.h" - - struct bpf_jit { - u32 seen; /* Flags to remember seen eBPF instructions */ -- u32 seen_reg[16]; /* Array to remember which registers are used */ -+ u16 seen_regs; /* Mask to remember which registers are used */ - u32 *addrs; /* Array with relative instruction addresses */ - u8 *prg_buf; /* Start of program */ - int size; /* Size of program and literal pool */ -@@ -53,6 +52,7 @@ struct bpf_jit { - int excnt; /* Number of exception table entries */ - int prologue_plt_ret; /* Return address for prologue hotpatch PLT */ - int prologue_plt; /* Start of prologue hotpatch PLT */ -+ u32 frame_off; /* Offset of struct bpf_prog from %r15 */ - }; - - #define SEEN_MEM BIT(0) /* use mem[] for temporary storage */ -@@ -118,8 +118,8 @@ static inline void reg_set_seen(struct bpf_jit *jit, u32 b1) - { - u32 r1 = reg2hex[b1]; - -- if (r1 >= 6 && r1 <= 15 && !jit->seen_reg[r1]) -- jit->seen_reg[r1] = 1; -+ if (r1 >= 6 && r1 <= 15) -+ jit->seen_regs |= (1 << r1); - } - - #define REG_SET_SEEN(b1) \ -@@ -127,8 +127,6 @@ static inline void reg_set_seen(struct bpf_jit *jit, u32 b1) - reg_set_seen(jit, b1); \ - }) - --#define REG_SEEN(b1) jit->seen_reg[reg2hex[(b1)]] -- - /* - * EMIT macros for code generation - */ -@@ -400,12 +398,26 @@ static void jit_fill_hole(void *area, unsigned int size) - memset(area, 0, size); - } - -+/* -+ * Caller-allocated part of the frame. -+ * Thanks to packed stack, its otherwise unused initial part can be used for -+ * the BPF stack and for the next frame. -+ */ -+struct prog_frame { -+ u64 unused[8]; -+ /* BPF stack starts here and grows towards 0 */ -+ u32 tail_call_cnt; -+ u32 pad; -+ u64 r6[10]; /* r6 - r15 */ -+ u64 backchain; -+} __packed; -+ - /* - * Save registers from "rs" (register start) to "re" (register end) on stack - */ - static void save_regs(struct bpf_jit *jit, u32 rs, u32 re) - { -- u32 off = STK_OFF_R6 + (rs - 6) * 8; -+ u32 off = offsetof(struct prog_frame, r6) + (rs - 6) * 8; - - if (rs == re) - /* stg %rs,off(%r15) */ -@@ -418,12 +430,9 @@ static void save_regs(struct bpf_jit *jit, u32 rs, u32 re) - /* - * Restore registers from "rs" (register start) to "re" (register end) on stack - */ --static void restore_regs(struct bpf_jit *jit, u32 rs, u32 re, u32 stack_depth) -+static void restore_regs(struct bpf_jit *jit, u32 rs, u32 re) - { -- u32 off = STK_OFF_R6 + (rs - 6) * 8; -- -- if (jit->seen & SEEN_STACK) -- off += STK_OFF + stack_depth; -+ u32 off = jit->frame_off + offsetof(struct prog_frame, r6) + (rs - 6) * 8; - - if (rs == re) - /* lg %rs,off(%r15) */ -@@ -436,12 +445,12 @@ static void restore_regs(struct bpf_jit *jit, u32 rs, u32 re, u32 stack_depth) - /* - * Return first seen register (from start) - */ --static int get_start(struct bpf_jit *jit, int start) -+static int get_start(u16 seen_regs, int start) - { - int i; - - for (i = start; i <= 15; i++) { -- if (jit->seen_reg[i]) -+ if (seen_regs & (1 << i)) - return i; - } - return 0; -@@ -450,15 +459,15 @@ static int get_start(struct bpf_jit *jit, int start) - /* - * Return last seen register (from start) (gap >= 2) - */ --static int get_end(struct bpf_jit *jit, int start) -+static int get_end(u16 seen_regs, int start) - { - int i; - - for (i = start; i < 15; i++) { -- if (!jit->seen_reg[i] && !jit->seen_reg[i + 1]) -+ if (!(seen_regs & (3 << i))) - return i - 1; - } -- return jit->seen_reg[15] ? 15 : 14; -+ return (seen_regs & (1 << 15)) ? 15 : 14; - } - - #define REGS_SAVE 1 -@@ -467,8 +476,9 @@ static int get_end(struct bpf_jit *jit, int start) - * Save and restore clobbered registers (6-15) on stack. - * We save/restore registers in chunks with gap >= 2 registers. - */ --static void save_restore_regs(struct bpf_jit *jit, int op, u32 stack_depth) -+static void save_restore_regs(struct bpf_jit *jit, int op, u16 extra_regs) - { -+ u16 seen_regs = jit->seen_regs | extra_regs; - const int last = 15, save_restore_size = 6; - int re = 6, rs; - -@@ -482,14 +492,14 @@ static void save_restore_regs(struct bpf_jit *jit, int op, u32 stack_depth) - } - - do { -- rs = get_start(jit, re); -+ rs = get_start(seen_regs, re); - if (!rs) - break; -- re = get_end(jit, rs + 1); -+ re = get_end(seen_regs, rs + 1); - if (op == REGS_SAVE) - save_regs(jit, rs, re); - else -- restore_regs(jit, rs, re, stack_depth); -+ restore_regs(jit, rs, re); - re++; - } while (re <= last); - } -@@ -554,11 +564,12 @@ static void bpf_jit_plt(struct bpf_plt *plt, void *ret, void *target) - * Emit function prologue - * - * Save registers and create stack frame if necessary. -- * See stack frame layout description in "bpf_jit.h"! -+ * Stack frame layout is described by struct prog_frame. - */ --static void bpf_jit_prologue(struct bpf_jit *jit, struct bpf_prog *fp, -- u32 stack_depth) -+static void bpf_jit_prologue(struct bpf_jit *jit, struct bpf_prog *fp) - { -+ BUILD_BUG_ON(sizeof(struct prog_frame) != STACK_FRAME_OVERHEAD); -+ - /* No-op for hotpatching */ - /* brcl 0,prologue_plt */ - EMIT6_PCREL_RILC(0xc0040000, 0, jit->prologue_plt); -@@ -566,8 +577,9 @@ static void bpf_jit_prologue(struct bpf_jit *jit, struct bpf_prog *fp, - - if (fp->aux->func_idx == 0) { - /* Initialize the tail call counter in the main program. */ -- /* xc STK_OFF_TCCNT(4,%r15),STK_OFF_TCCNT(%r15) */ -- _EMIT6(0xd703f000 | STK_OFF_TCCNT, 0xf000 | STK_OFF_TCCNT); -+ /* xc tail_call_cnt(4,%r15),tail_call_cnt(%r15) */ -+ _EMIT6(0xd703f000 | offsetof(struct prog_frame, tail_call_cnt), -+ 0xf000 | offsetof(struct prog_frame, tail_call_cnt)); - } else { - /* - * Skip the tail call counter initialization in subprograms. -@@ -579,7 +591,7 @@ static void bpf_jit_prologue(struct bpf_jit *jit, struct bpf_prog *fp, - /* Tail calls have to skip above initialization */ - jit->tail_call_start = jit->prg; - /* Save registers */ -- save_restore_regs(jit, REGS_SAVE, stack_depth); -+ save_restore_regs(jit, REGS_SAVE, 0); - /* Setup literal pool */ - if (is_first_pass(jit) || (jit->seen & SEEN_LITERAL)) { - if (!is_first_pass(jit) && -@@ -597,13 +609,15 @@ static void bpf_jit_prologue(struct bpf_jit *jit, struct bpf_prog *fp, - if (is_first_pass(jit) || (jit->seen & SEEN_STACK)) { - /* lgr %w1,%r15 (backchain) */ - EMIT4(0xb9040000, REG_W1, REG_15); -- /* la %bfp,STK_160_UNUSED(%r15) (BPF frame pointer) */ -- EMIT4_DISP(0x41000000, BPF_REG_FP, REG_15, STK_160_UNUSED); -- /* aghi %r15,-STK_OFF */ -- EMIT4_IMM(0xa70b0000, REG_15, -(STK_OFF + stack_depth)); -- /* stg %w1,152(%r15) (backchain) */ -+ /* la %bfp,unused_end(%r15) (BPF frame pointer) */ -+ EMIT4_DISP(0x41000000, BPF_REG_FP, REG_15, -+ offsetofend(struct prog_frame, unused)); -+ /* aghi %r15,-frame_off */ -+ EMIT4_IMM(0xa70b0000, REG_15, -jit->frame_off); -+ /* stg %w1,backchain(%r15) */ - EMIT6_DISP_LH(0xe3000000, 0x0024, REG_W1, REG_0, -- REG_15, 152); -+ REG_15, -+ offsetof(struct prog_frame, backchain)); - } - } - -@@ -647,13 +661,13 @@ static void call_r1(struct bpf_jit *jit) - /* - * Function epilogue - */ --static void bpf_jit_epilogue(struct bpf_jit *jit, u32 stack_depth) -+static void bpf_jit_epilogue(struct bpf_jit *jit) - { - jit->exit_ip = jit->prg; - /* Load exit code: lgr %r2,%b0 */ - EMIT4(0xb9040000, REG_2, BPF_REG_0); - /* Restore registers */ -- save_restore_regs(jit, REGS_RESTORE, stack_depth); -+ save_restore_regs(jit, REGS_RESTORE, 0); - if (nospec_uses_trampoline()) { - jit->r14_thunk_ip = jit->prg; - /* Generate __s390_indirect_jump_r14 thunk */ -@@ -779,7 +793,7 @@ static int sign_extend(struct bpf_jit *jit, int r, u8 size, u8 flags) - * stack space for the large switch statement. - */ - static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, -- int i, bool extra_pass, u32 stack_depth) -+ int i, bool extra_pass) - { - struct bpf_insn *insn = &fp->insnsi[i]; - u32 dst_reg = insn->dst_reg; -@@ -1425,17 +1439,11 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, - jit->seen |= SEEN_FUNC; - /* - * Copy the tail call counter to where the callee expects it. -- * -- * Note 1: The callee can increment the tail call counter, but -- * we do not load it back, since the x86 JIT does not do this -- * either. -- * -- * Note 2: We assume that the verifier does not let us call the -- * main program, which clears the tail call counter on entry. - */ -- /* mvc STK_OFF_TCCNT(4,%r15),N(%r15) */ -- _EMIT6(0xd203f000 | STK_OFF_TCCNT, -- 0xf000 | (STK_OFF_TCCNT + STK_OFF + stack_depth)); -+ /* mvc tail_call_cnt(4,%r15),frame_off+tail_call_cnt(%r15) */ -+ _EMIT6(0xd203f000 | offsetof(struct prog_frame, tail_call_cnt), -+ 0xf000 | (jit->frame_off + -+ offsetof(struct prog_frame, tail_call_cnt))); - - /* Sign-extend the kfunc arguments. */ - if (insn->src_reg == BPF_PSEUDO_KFUNC_CALL) { -@@ -1457,6 +1465,22 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, - call_r1(jit); - /* lgr %b0,%r2: load return value into %b0 */ - EMIT4(0xb9040000, BPF_REG_0, REG_2); -+ -+ /* -+ * Copy the potentially updated tail call counter back. -+ */ -+ -+ if (insn->src_reg == BPF_PSEUDO_CALL) -+ /* -+ * mvc frame_off+tail_call_cnt(%r15), -+ * tail_call_cnt(4,%r15) -+ */ -+ _EMIT6(0xd203f000 | (jit->frame_off + -+ offsetof(struct prog_frame, -+ tail_call_cnt)), -+ 0xf000 | offsetof(struct prog_frame, -+ tail_call_cnt)); -+ - break; - } - case BPF_JMP | BPF_TAIL_CALL: { -@@ -1486,10 +1510,8 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, - * goto out; - */ - -- if (jit->seen & SEEN_STACK) -- off = STK_OFF_TCCNT + STK_OFF + stack_depth; -- else -- off = STK_OFF_TCCNT; -+ off = jit->frame_off + -+ offsetof(struct prog_frame, tail_call_cnt); - /* lhi %w0,1 */ - EMIT4_IMM(0xa7080000, REG_W0, 1); - /* laal %w1,%w0,off(%r15) */ -@@ -1519,7 +1541,7 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, - /* - * Restore registers before calling function - */ -- save_restore_regs(jit, REGS_RESTORE, stack_depth); -+ save_restore_regs(jit, REGS_RESTORE, 0); - - /* - * goto *(prog->bpf_func + tail_call_start); -@@ -1822,7 +1844,7 @@ static int bpf_set_addr(struct bpf_jit *jit, int i) - * Compile eBPF program into s390x code - */ - static int bpf_jit_prog(struct bpf_jit *jit, struct bpf_prog *fp, -- bool extra_pass, u32 stack_depth) -+ bool extra_pass) - { - int i, insn_count, lit32_size, lit64_size; - -@@ -1830,19 +1852,25 @@ static int bpf_jit_prog(struct bpf_jit *jit, struct bpf_prog *fp, - jit->lit64 = jit->lit64_start; - jit->prg = 0; - jit->excnt = 0; -+ if (is_first_pass(jit) || (jit->seen & SEEN_STACK)) -+ jit->frame_off = sizeof(struct prog_frame) - -+ offsetofend(struct prog_frame, unused) + -+ round_up(fp->aux->stack_depth, 8); -+ else -+ jit->frame_off = 0; - -- bpf_jit_prologue(jit, fp, stack_depth); -+ bpf_jit_prologue(jit, fp); - if (bpf_set_addr(jit, 0) < 0) - return -1; - for (i = 0; i < fp->len; i += insn_count) { -- insn_count = bpf_jit_insn(jit, fp, i, extra_pass, stack_depth); -+ insn_count = bpf_jit_insn(jit, fp, i, extra_pass); - if (insn_count < 0) - return -1; - /* Next instruction address */ - if (bpf_set_addr(jit, i + insn_count) < 0) - return -1; - } -- bpf_jit_epilogue(jit, stack_depth); -+ bpf_jit_epilogue(jit); - - lit32_size = jit->lit32 - jit->lit32_start; - lit64_size = jit->lit64 - jit->lit64_start; -@@ -1902,7 +1930,6 @@ static struct bpf_binary_header *bpf_jit_alloc(struct bpf_jit *jit, - */ - struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) - { -- u32 stack_depth = round_up(fp->aux->stack_depth, 8); - struct bpf_prog *tmp, *orig_fp = fp; - struct bpf_binary_header *header; - struct s390_jit_data *jit_data; -@@ -1955,7 +1982,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) - * - 3: Calculate program size and addrs array - */ - for (pass = 1; pass <= 3; pass++) { -- if (bpf_jit_prog(&jit, fp, extra_pass, stack_depth)) { -+ if (bpf_jit_prog(&jit, fp, extra_pass)) { - fp = orig_fp; - goto free_addrs; - } -@@ -1969,7 +1996,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) - goto free_addrs; - } - skip_init_ctx: -- if (bpf_jit_prog(&jit, fp, extra_pass, stack_depth)) { -+ if (bpf_jit_prog(&jit, fp, extra_pass)) { - bpf_jit_binary_free(header); - fp = orig_fp; - goto free_addrs; -@@ -2285,9 +2312,10 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, - /* stg %r1,backchain_off(%r15) */ - EMIT6_DISP_LH(0xe3000000, 0x0024, REG_1, REG_0, REG_15, - tjit->backchain_off); -- /* mvc tccnt_off(4,%r15),stack_size+STK_OFF_TCCNT(%r15) */ -+ /* mvc tccnt_off(4,%r15),stack_size+tail_call_cnt(%r15) */ - _EMIT6(0xd203f000 | tjit->tccnt_off, -- 0xf000 | (tjit->stack_size + STK_OFF_TCCNT)); -+ 0xf000 | (tjit->stack_size + -+ offsetof(struct prog_frame, tail_call_cnt))); - /* stmg %r2,%rN,fwd_reg_args_off(%r15) */ - if (nr_reg_args) - EMIT6_DISP_LH(0xeb000000, 0x0024, REG_2, -@@ -2424,8 +2452,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, - (nr_stack_args * sizeof(u64) - 1) << 16 | - tjit->stack_args_off, - 0xf000 | tjit->orig_stack_args_off); -- /* mvc STK_OFF_TCCNT(4,%r15),tccnt_off(%r15) */ -- _EMIT6(0xd203f000 | STK_OFF_TCCNT, 0xf000 | tjit->tccnt_off); -+ /* mvc tail_call_cnt(4,%r15),tccnt_off(%r15) */ -+ _EMIT6(0xd203f000 | offsetof(struct prog_frame, tail_call_cnt), -+ 0xf000 | tjit->tccnt_off); - /* lgr %r1,%r8 */ - EMIT4(0xb9040000, REG_1, REG_8); - /* %r1() */ -@@ -2433,6 +2462,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, - /* stg %r2,retval_off(%r15) */ - EMIT6_DISP_LH(0xe3000000, 0x0024, REG_2, REG_0, REG_15, - tjit->retval_off); -+ /* mvc tccnt_off(%r15),tail_call_cnt(4,%r15) */ -+ _EMIT6(0xd203f000 | tjit->tccnt_off, -+ 0xf000 | offsetof(struct prog_frame, tail_call_cnt)); - - im->ip_after_call = jit->prg_buf + jit->prg; - -@@ -2482,8 +2514,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, - if (flags & (BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_RET_FENTRY_RET)) - EMIT6_DISP_LH(0xe3000000, 0x0004, REG_2, REG_0, REG_15, - tjit->retval_off); -- /* mvc stack_size+STK_OFF_TCCNT(4,%r15),tccnt_off(%r15) */ -- _EMIT6(0xd203f000 | (tjit->stack_size + STK_OFF_TCCNT), -+ /* mvc stack_size+tail_call_cnt(4,%r15),tccnt_off(%r15) */ -+ _EMIT6(0xd203f000 | (tjit->stack_size + -+ offsetof(struct prog_frame, tail_call_cnt)), - 0xf000 | tjit->tccnt_off); - /* aghi %r15,stack_size */ - EMIT4_IMM(0xa70b0000, REG_15, tjit->stack_size); -diff --git a/arch/sparc/kernel/of_device_32.c b/arch/sparc/kernel/of_device_32.c -index 06012e68bdcaec..284a4cafa4324c 100644 ---- a/arch/sparc/kernel/of_device_32.c -+++ b/arch/sparc/kernel/of_device_32.c -@@ -387,6 +387,7 @@ static struct platform_device * __init scan_one_device(struct device_node *dp, - - if (of_device_register(op)) { - printk("%pOF: Could not register of device.\n", dp); -+ put_device(&op->dev); - kfree(op); - op = NULL; - } -diff --git a/arch/sparc/kernel/of_device_64.c b/arch/sparc/kernel/of_device_64.c -index d3842821a5a050..d2cd4f42e0cf07 100644 ---- a/arch/sparc/kernel/of_device_64.c -+++ b/arch/sparc/kernel/of_device_64.c -@@ -680,6 +680,7 @@ static struct platform_device * __init scan_one_device(struct device_node *dp, - - if (of_device_register(op)) { - printk("%pOF: Could not register of device.\n", dp); -+ put_device(&op->dev); - kfree(op); - op = NULL; - } -diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c -index 8dad5d0995dcce..5bf77c07f6b620 100644 ---- a/arch/sparc/mm/hugetlbpage.c -+++ b/arch/sparc/mm/hugetlbpage.c -@@ -133,6 +133,26 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr, - - static pte_t sun4u_hugepage_shift_to_tte(pte_t entry, unsigned int shift) - { -+ unsigned long hugepage_size = _PAGE_SZ4MB_4U; -+ -+ pte_val(entry) = pte_val(entry) & ~_PAGE_SZALL_4U; -+ -+ switch (shift) { -+ case HPAGE_256MB_SHIFT: -+ hugepage_size = _PAGE_SZ256MB_4U; -+ pte_val(entry) |= _PAGE_PMD_HUGE; -+ break; -+ case HPAGE_SHIFT: -+ pte_val(entry) |= _PAGE_PMD_HUGE; -+ break; -+ case HPAGE_64K_SHIFT: -+ hugepage_size = _PAGE_SZ64K_4U; -+ break; -+ default: -+ WARN_ONCE(1, "unsupported hugepage shift=%u\n", shift); -+ } -+ -+ pte_val(entry) = pte_val(entry) | hugepage_size; - return entry; - } - -diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h -index 723e48b57bd0f8..425980eacaa841 100644 ---- a/arch/x86/include/asm/msr-index.h -+++ b/arch/x86/include/asm/msr-index.h -@@ -661,6 +661,7 @@ - #define MSR_AMD64_PERF_CNTR_GLOBAL_STATUS 0xc0000300 - #define MSR_AMD64_PERF_CNTR_GLOBAL_CTL 0xc0000301 - #define MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR 0xc0000302 -+#define MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET 0xc0000303 - - /* AMD Last Branch Record MSRs */ - #define MSR_AMD64_LBR_SELECT 0xc000010e -diff --git a/arch/x86/kernel/umip.c b/arch/x86/kernel/umip.c -index 5a4b21389b1d98..d432f3824f0c29 100644 ---- a/arch/x86/kernel/umip.c -+++ b/arch/x86/kernel/umip.c -@@ -156,15 +156,26 @@ static int identify_insn(struct insn *insn) - if (!insn->modrm.nbytes) - return -EINVAL; - -- /* All the instructions of interest start with 0x0f. */ -- if (insn->opcode.bytes[0] != 0xf) -+ /* The instructions of interest have 2-byte opcodes: 0F 00 or 0F 01. */ -+ if (insn->opcode.nbytes < 2 || insn->opcode.bytes[0] != 0xf) - return -EINVAL; - - if (insn->opcode.bytes[1] == 0x1) { - switch (X86_MODRM_REG(insn->modrm.value)) { - case 0: -+ /* The reg form of 0F 01 /0 encodes VMX instructions. */ -+ if (X86_MODRM_MOD(insn->modrm.value) == 3) -+ return -EINVAL; -+ - return UMIP_INST_SGDT; - case 1: -+ /* -+ * The reg form of 0F 01 /1 encodes MONITOR/MWAIT, -+ * STAC/CLAC, and ENCLS. -+ */ -+ if (X86_MODRM_MOD(insn->modrm.value) == 3) -+ return -EINVAL; -+ - return UMIP_INST_SIDT; - case 4: - return UMIP_INST_SMSW; -diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c -index da2d82e3a8735e..f2cd8cfb0ef557 100644 ---- a/arch/x86/kvm/pmu.c -+++ b/arch/x86/kvm/pmu.c -@@ -588,6 +588,7 @@ int kvm_pmu_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - msr_info->data = pmu->global_ctrl; - break; - case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR: -+ case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET: - case MSR_CORE_PERF_GLOBAL_OVF_CTRL: - msr_info->data = 0; - break; -@@ -649,6 +650,10 @@ int kvm_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - if (!msr_info->host_initiated) - pmu->global_status &= ~data; - break; -+ case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET: -+ if (!msr_info->host_initiated) -+ pmu->global_status |= data & ~pmu->global_status_mask; -+ break; - default: - kvm_pmu_mark_pmc_in_use(vcpu, msr_info->index); - return static_call(kvm_x86_pmu_set_msr)(vcpu, msr_info); -diff --git a/arch/x86/kvm/svm/pmu.c b/arch/x86/kvm/svm/pmu.c -index 3fd47de14b38a3..0bad24f763d222 100644 ---- a/arch/x86/kvm/svm/pmu.c -+++ b/arch/x86/kvm/svm/pmu.c -@@ -117,6 +117,7 @@ static bool amd_is_valid_msr(struct kvm_vcpu *vcpu, u32 msr) - case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS: - case MSR_AMD64_PERF_CNTR_GLOBAL_CTL: - case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR: -+ case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET: - return pmu->version > 1; - default: - if (msr > MSR_F15H_PERF_CTR5 && -diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c -index 29566e457ec4b5..0833f2c1a9d68b 100644 ---- a/arch/x86/kvm/svm/svm.c -+++ b/arch/x86/kvm/svm/svm.c -@@ -4156,11 +4156,20 @@ static int svm_vcpu_pre_run(struct kvm_vcpu *vcpu) - - static fastpath_t svm_exit_handlers_fastpath(struct kvm_vcpu *vcpu) - { -+ struct vcpu_svm *svm = to_svm(vcpu); -+ -+ /* -+ * Next RIP must be provided as IRQs are disabled, and accessing guest -+ * memory to decode the instruction might fault, i.e. might sleep. -+ */ -+ if (!nrips || !svm->vmcb->control.next_rip) -+ return EXIT_FASTPATH_NONE; -+ - if (is_guest_mode(vcpu)) - return EXIT_FASTPATH_NONE; - -- if (to_svm(vcpu)->vmcb->control.exit_code == SVM_EXIT_MSR && -- to_svm(vcpu)->vmcb->control.exit_info_1) -+ if (svm->vmcb->control.exit_code == SVM_EXIT_MSR && -+ svm->vmcb->control.exit_info_1) - return handle_fastpath_set_msr_irqoff(vcpu); - - return EXIT_FASTPATH_NONE; -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 71d60d4e991fd3..a589a5781e9066 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -1495,6 +1495,7 @@ static const u32 msrs_to_save_pmu[] = { - MSR_AMD64_PERF_CNTR_GLOBAL_CTL, - MSR_AMD64_PERF_CNTR_GLOBAL_STATUS, - MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR, -+ MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET, - }; - - static u32 msrs_to_save[ARRAY_SIZE(msrs_to_save_base) + -@@ -7194,6 +7195,7 @@ static void kvm_probe_msr_to_save(u32 msr_index) - case MSR_AMD64_PERF_CNTR_GLOBAL_CTL: - case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS: - case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR: -+ case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET: - if (!kvm_cpu_cap_has(X86_FEATURE_PERFMON_V2)) - return; - break; -diff --git a/arch/xtensa/platforms/iss/simdisk.c b/arch/xtensa/platforms/iss/simdisk.c -index 178cf96ca10acb..f878bbb8b0ac2f 100644 ---- a/arch/xtensa/platforms/iss/simdisk.c -+++ b/arch/xtensa/platforms/iss/simdisk.c -@@ -230,10 +230,14 @@ static ssize_t proc_read_simdisk(struct file *file, char __user *buf, - static ssize_t proc_write_simdisk(struct file *file, const char __user *buf, - size_t count, loff_t *ppos) - { -- char *tmp = memdup_user_nul(buf, count); -+ char *tmp; - struct simdisk *dev = pde_data(file_inode(file)); - int err; - -+ if (count == 0 || count > PAGE_SIZE) -+ return -EINVAL; -+ -+ tmp = memdup_user_nul(buf, count); - if (IS_ERR(tmp)) - return PTR_ERR(tmp); - -diff --git a/block/blk-crypto-fallback.c b/block/blk-crypto-fallback.c -index e6468eab2681e9..7f1a9dba404979 100644 ---- a/block/blk-crypto-fallback.c -+++ b/block/blk-crypto-fallback.c -@@ -18,6 +18,7 @@ - #include - #include - #include -+#include - - #include "blk-cgroup.h" - #include "blk-crypto-internal.h" -@@ -229,7 +230,9 @@ static bool blk_crypto_fallback_split_bio_if_needed(struct bio **bio_ptr) - bio->bi_status = BLK_STS_RESOURCE; - return false; - } -+ - bio_chain(split_bio, bio); -+ trace_block_split(split_bio, bio->bi_iter.bi_sector); - submit_bio_noacct(bio); - *bio_ptr = split_bio; - } -diff --git a/crypto/essiv.c b/crypto/essiv.c -index f7d4ef4837e541..4dbec116ddc3e0 100644 ---- a/crypto/essiv.c -+++ b/crypto/essiv.c -@@ -186,9 +186,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) - const struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); - struct essiv_aead_request_ctx *rctx = aead_request_ctx(req); - struct aead_request *subreq = &rctx->aead_req; -+ int ivsize = crypto_aead_ivsize(tfm); -+ int ssize = req->assoclen - ivsize; - struct scatterlist *src = req->src; - int err; - -+ if (ssize < 0) -+ return -EINVAL; -+ - crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv); - - /* -@@ -198,19 +203,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) - */ - rctx->assoc = NULL; - if (req->src == req->dst || !enc) { -- scatterwalk_map_and_copy(req->iv, req->dst, -- req->assoclen - crypto_aead_ivsize(tfm), -- crypto_aead_ivsize(tfm), 1); -+ scatterwalk_map_and_copy(req->iv, req->dst, ssize, ivsize, 1); - } else { - u8 *iv = (u8 *)aead_request_ctx(req) + tctx->ivoffset; -- int ivsize = crypto_aead_ivsize(tfm); -- int ssize = req->assoclen - ivsize; - struct scatterlist *sg; - int nents; - -- if (ssize < 0) -- return -EINVAL; -- - nents = sg_nents_for_len(req->src, ssize); - if (nents < 0) - return -EINVAL; -diff --git a/drivers/acpi/acpi_dbg.c b/drivers/acpi/acpi_dbg.c -index d50261d05f3a1a..515b20d0b698a4 100644 ---- a/drivers/acpi/acpi_dbg.c -+++ b/drivers/acpi/acpi_dbg.c -@@ -569,11 +569,11 @@ static int acpi_aml_release(struct inode *inode, struct file *file) - return 0; - } - --static int acpi_aml_read_user(char __user *buf, int len) -+static ssize_t acpi_aml_read_user(char __user *buf, size_t len) - { -- int ret; - struct circ_buf *crc = &acpi_aml_io.out_crc; -- int n; -+ ssize_t ret; -+ size_t n; - char *p; - - ret = acpi_aml_lock_read(crc, ACPI_AML_OUT_USER); -@@ -582,7 +582,7 @@ static int acpi_aml_read_user(char __user *buf, int len) - /* sync head before removing logs */ - smp_rmb(); - p = &crc->buf[crc->tail]; -- n = min(len, circ_count_to_end(crc)); -+ n = min_t(size_t, len, circ_count_to_end(crc)); - if (copy_to_user(buf, p, n)) { - ret = -EFAULT; - goto out; -@@ -599,8 +599,8 @@ static int acpi_aml_read_user(char __user *buf, int len) - static ssize_t acpi_aml_read(struct file *file, char __user *buf, - size_t count, loff_t *ppos) - { -- int ret = 0; -- int size = 0; -+ ssize_t ret = 0; -+ ssize_t size = 0; - - if (!count) - return 0; -@@ -639,11 +639,11 @@ static ssize_t acpi_aml_read(struct file *file, char __user *buf, - return size > 0 ? size : ret; - } - --static int acpi_aml_write_user(const char __user *buf, int len) -+static ssize_t acpi_aml_write_user(const char __user *buf, size_t len) - { -- int ret; - struct circ_buf *crc = &acpi_aml_io.in_crc; -- int n; -+ ssize_t ret; -+ size_t n; - char *p; - - ret = acpi_aml_lock_write(crc, ACPI_AML_IN_USER); -@@ -652,7 +652,7 @@ static int acpi_aml_write_user(const char __user *buf, int len) - /* sync tail before inserting cmds */ - smp_mb(); - p = &crc->buf[crc->head]; -- n = min(len, circ_space_to_end(crc)); -+ n = min_t(size_t, len, circ_space_to_end(crc)); - if (copy_from_user(p, buf, n)) { - ret = -EFAULT; - goto out; -@@ -663,14 +663,14 @@ static int acpi_aml_write_user(const char __user *buf, int len) - ret = n; - out: - acpi_aml_unlock_fifo(ACPI_AML_IN_USER, ret >= 0); -- return n; -+ return ret; - } - - static ssize_t acpi_aml_write(struct file *file, const char __user *buf, - size_t count, loff_t *ppos) - { -- int ret = 0; -- int size = 0; -+ ssize_t ret = 0; -+ ssize_t size = 0; - - if (!count) - return 0; -diff --git a/drivers/acpi/acpi_tad.c b/drivers/acpi/acpi_tad.c -index 33c3b16af556b5..ecba82ac7cd5f9 100644 ---- a/drivers/acpi/acpi_tad.c -+++ b/drivers/acpi/acpi_tad.c -@@ -564,6 +564,9 @@ static int acpi_tad_remove(struct platform_device *pdev) - - pm_runtime_get_sync(dev); - -+ if (dd->capabilities & ACPI_TAD_RT) -+ sysfs_remove_group(&dev->kobj, &acpi_tad_time_attr_group); -+ - if (dd->capabilities & ACPI_TAD_DC_WAKE) - sysfs_remove_group(&dev->kobj, &acpi_tad_dc_attr_group); - -diff --git a/drivers/acpi/acpica/evglock.c b/drivers/acpi/acpica/evglock.c -index 989dc01af03fbb..bc205b3309043b 100644 ---- a/drivers/acpi/acpica/evglock.c -+++ b/drivers/acpi/acpica/evglock.c -@@ -42,6 +42,10 @@ acpi_status acpi_ev_init_global_lock_handler(void) - return_ACPI_STATUS(AE_OK); - } - -+ if (!acpi_gbl_use_global_lock) { -+ return_ACPI_STATUS(AE_OK); -+ } -+ - /* Attempt installation of the global lock handler */ - - status = acpi_install_fixed_event_handler(ACPI_EVENT_GLOBAL, -diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c -index e3cbaf3c3bbc15..a70b6db3bf0596 100644 ---- a/drivers/acpi/battery.c -+++ b/drivers/acpi/battery.c -@@ -94,7 +94,7 @@ enum { - - struct acpi_battery { - struct mutex lock; -- struct mutex sysfs_lock; -+ struct mutex update_lock; - struct power_supply *bat; - struct power_supply_desc bat_desc; - struct acpi_device *device; -@@ -888,15 +888,12 @@ static int sysfs_add_battery(struct acpi_battery *battery) - - static void sysfs_remove_battery(struct acpi_battery *battery) - { -- mutex_lock(&battery->sysfs_lock); -- if (!battery->bat) { -- mutex_unlock(&battery->sysfs_lock); -+ if (!battery->bat) - return; -- } -+ - battery_hook_remove_battery(battery); - power_supply_unregister(battery->bat); - battery->bat = NULL; -- mutex_unlock(&battery->sysfs_lock); - } - - static void find_battery(const struct dmi_header *dm, void *private) -@@ -1056,6 +1053,9 @@ static void acpi_battery_notify(acpi_handle handle, u32 event, void *data) - - if (!battery) - return; -+ -+ guard(mutex)(&battery->update_lock); -+ - old = battery->bat; - /* - * On Acer Aspire V5-573G notifications are sometimes triggered too -@@ -1078,21 +1078,22 @@ static void acpi_battery_notify(acpi_handle handle, u32 event, void *data) - } - - static int battery_notify(struct notifier_block *nb, -- unsigned long mode, void *_unused) -+ unsigned long mode, void *_unused) - { - struct acpi_battery *battery = container_of(nb, struct acpi_battery, - pm_nb); -- int result; - -- switch (mode) { -- case PM_POST_HIBERNATION: -- case PM_POST_SUSPEND: -+ if (mode == PM_POST_SUSPEND || mode == PM_POST_HIBERNATION) { -+ guard(mutex)(&battery->update_lock); -+ - if (!acpi_battery_present(battery)) - return 0; - - if (battery->bat) { - acpi_battery_refresh(battery); - } else { -+ int result; -+ - result = acpi_battery_get_info(battery); - if (result) - return result; -@@ -1104,7 +1105,6 @@ static int battery_notify(struct notifier_block *nb, - - acpi_battery_init_alarm(battery); - acpi_battery_get_state(battery); -- break; - } - - return 0; -@@ -1182,6 +1182,8 @@ static int acpi_battery_update_retry(struct acpi_battery *battery) - { - int retry, ret; - -+ guard(mutex)(&battery->update_lock); -+ - for (retry = 5; retry; retry--) { - ret = acpi_battery_update(battery, false); - if (!ret) -@@ -1192,6 +1194,13 @@ static int acpi_battery_update_retry(struct acpi_battery *battery) - return ret; - } - -+static void sysfs_battery_cleanup(struct acpi_battery *battery) -+{ -+ guard(mutex)(&battery->update_lock); -+ -+ sysfs_remove_battery(battery); -+} -+ - static int acpi_battery_add(struct acpi_device *device) - { - int result = 0; -@@ -1203,15 +1212,21 @@ static int acpi_battery_add(struct acpi_device *device) - if (device->dep_unmet) - return -EPROBE_DEFER; - -- battery = kzalloc(sizeof(struct acpi_battery), GFP_KERNEL); -+ battery = devm_kzalloc(&device->dev, sizeof(*battery), GFP_KERNEL); - if (!battery) - return -ENOMEM; - battery->device = device; - strcpy(acpi_device_name(device), ACPI_BATTERY_DEVICE_NAME); - strcpy(acpi_device_class(device), ACPI_BATTERY_CLASS); - device->driver_data = battery; -- mutex_init(&battery->lock); -- mutex_init(&battery->sysfs_lock); -+ result = devm_mutex_init(&device->dev, &battery->lock); -+ if (result) -+ return result; -+ -+ result = devm_mutex_init(&device->dev, &battery->update_lock); -+ if (result) -+ return result; -+ - if (acpi_has_method(battery->device->handle, "_BIX")) - set_bit(ACPI_BATTERY_XINFO_PRESENT, &battery->flags); - -@@ -1238,10 +1253,7 @@ static int acpi_battery_add(struct acpi_device *device) - device_init_wakeup(&device->dev, 0); - unregister_pm_notifier(&battery->pm_nb); - fail: -- sysfs_remove_battery(battery); -- mutex_destroy(&battery->lock); -- mutex_destroy(&battery->sysfs_lock); -- kfree(battery); -+ sysfs_battery_cleanup(battery); - - return result; - } -@@ -1260,11 +1272,10 @@ static void acpi_battery_remove(struct acpi_device *device) - - device_init_wakeup(&device->dev, 0); - unregister_pm_notifier(&battery->pm_nb); -- sysfs_remove_battery(battery); - -- mutex_destroy(&battery->lock); -- mutex_destroy(&battery->sysfs_lock); -- kfree(battery); -+ guard(mutex)(&battery->update_lock); -+ -+ sysfs_remove_battery(battery); - } - - #ifdef CONFIG_PM_SLEEP -@@ -1281,6 +1292,9 @@ static int acpi_battery_resume(struct device *dev) - return -EINVAL; - - battery->update_time = 0; -+ -+ guard(mutex)(&battery->update_lock); -+ - acpi_battery_update(battery, true); - return 0; - } -diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c -index dca5682308cb32..5898c3c8c2a7f2 100644 ---- a/drivers/acpi/property.c -+++ b/drivers/acpi/property.c -@@ -74,6 +74,7 @@ static bool acpi_nondev_subnode_extract(union acpi_object *desc, - struct fwnode_handle *parent) - { - struct acpi_data_node *dn; -+ acpi_handle scope = NULL; - bool result; - - dn = kzalloc(sizeof(*dn), GFP_KERNEL); -@@ -86,29 +87,35 @@ static bool acpi_nondev_subnode_extract(union acpi_object *desc, - INIT_LIST_HEAD(&dn->data.properties); - INIT_LIST_HEAD(&dn->data.subnodes); - -- result = acpi_extract_properties(handle, desc, &dn->data); -- -- if (handle) { -- acpi_handle scope; -- acpi_status status; -+ /* -+ * The scope for the completion of relative pathname segments and -+ * subnode object lookup is the one of the namespace node (device) -+ * containing the object that has returned the package. That is, it's -+ * the scope of that object's parent device. -+ */ -+ if (handle) -+ acpi_get_parent(handle, &scope); - -- /* -- * The scope for the subnode object lookup is the one of the -- * namespace node (device) containing the object that has -- * returned the package. That is, it's the scope of that -- * object's parent. -- */ -- status = acpi_get_parent(handle, &scope); -- if (ACPI_SUCCESS(status) -- && acpi_enumerate_nondev_subnodes(scope, desc, &dn->data, -- &dn->fwnode)) -- result = true; -- } else if (acpi_enumerate_nondev_subnodes(NULL, desc, &dn->data, -- &dn->fwnode)) { -+ /* -+ * Extract properties from the _DSD-equivalent package pointed to by -+ * desc and use scope (if not NULL) for the completion of relative -+ * pathname segments. -+ * -+ * The extracted properties will be held in the new data node dn. -+ */ -+ result = acpi_extract_properties(scope, desc, &dn->data); -+ /* -+ * Look for subnodes in the _DSD-equivalent package pointed to by desc -+ * and create child nodes of dn if there are any. -+ */ -+ if (acpi_enumerate_nondev_subnodes(scope, desc, &dn->data, &dn->fwnode)) - result = true; -- } - - if (result) { -+ /* -+ * This will be NULL if the desc package is embedded in an outer -+ * _DSD-equivalent package and its scope cannot be determined. -+ */ - dn->handle = handle; - dn->data.pointer = desc; - list_add_tail(&dn->sibling, list); -@@ -120,35 +127,21 @@ static bool acpi_nondev_subnode_extract(union acpi_object *desc, - return false; - } - --static bool acpi_nondev_subnode_data_ok(acpi_handle handle, -- const union acpi_object *link, -- struct list_head *list, -- struct fwnode_handle *parent) --{ -- struct acpi_buffer buf = { ACPI_ALLOCATE_BUFFER }; -- acpi_status status; -- -- status = acpi_evaluate_object_typed(handle, NULL, NULL, &buf, -- ACPI_TYPE_PACKAGE); -- if (ACPI_FAILURE(status)) -- return false; -- -- if (acpi_nondev_subnode_extract(buf.pointer, handle, link, list, -- parent)) -- return true; -- -- ACPI_FREE(buf.pointer); -- return false; --} -- - static bool acpi_nondev_subnode_ok(acpi_handle scope, - const union acpi_object *link, - struct list_head *list, - struct fwnode_handle *parent) - { -+ struct acpi_buffer buf = { ACPI_ALLOCATE_BUFFER }; - acpi_handle handle; - acpi_status status; - -+ /* -+ * If the scope is unknown, the _DSD-equivalent package being parsed -+ * was embedded in an outer _DSD-equivalent package as a result of -+ * direct evaluation of an object pointed to by a reference. In that -+ * case, using a pathname as the target object pointer is invalid. -+ */ - if (!scope) - return false; - -@@ -157,7 +150,17 @@ static bool acpi_nondev_subnode_ok(acpi_handle scope, - if (ACPI_FAILURE(status)) - return false; - -- return acpi_nondev_subnode_data_ok(handle, link, list, parent); -+ status = acpi_evaluate_object_typed(handle, NULL, NULL, &buf, -+ ACPI_TYPE_PACKAGE); -+ if (ACPI_FAILURE(status)) -+ return false; -+ -+ if (acpi_nondev_subnode_extract(buf.pointer, handle, link, list, -+ parent)) -+ return true; -+ -+ ACPI_FREE(buf.pointer); -+ return false; - } - - static bool acpi_add_nondev_subnodes(acpi_handle scope, -@@ -168,9 +171,12 @@ static bool acpi_add_nondev_subnodes(acpi_handle scope, - bool ret = false; - int i; - -+ /* -+ * Every element in the links package is expected to represent a link -+ * to a non-device node in a tree containing device-specific data. -+ */ - for (i = 0; i < links->package.count; i++) { - union acpi_object *link, *desc; -- acpi_handle handle; - bool result; - - link = &links->package.elements[i]; -@@ -178,26 +184,53 @@ static bool acpi_add_nondev_subnodes(acpi_handle scope, - if (link->package.count != 2) - continue; - -- /* The first one must be a string. */ -+ /* The first one (the key) must be a string. */ - if (link->package.elements[0].type != ACPI_TYPE_STRING) - continue; - -- /* The second one may be a string, a reference or a package. */ -+ /* The second one (the target) may be a string or a package. */ - switch (link->package.elements[1].type) { - case ACPI_TYPE_STRING: -+ /* -+ * The string is expected to be a full pathname or a -+ * pathname segment relative to the given scope. That -+ * pathname is expected to point to an object returning -+ * a package that contains _DSD-equivalent information. -+ */ - result = acpi_nondev_subnode_ok(scope, link, list, - parent); - break; -- case ACPI_TYPE_LOCAL_REFERENCE: -- handle = link->package.elements[1].reference.handle; -- result = acpi_nondev_subnode_data_ok(handle, link, list, -- parent); -- break; - case ACPI_TYPE_PACKAGE: -+ /* -+ * This happens when a reference is used in AML to -+ * point to the target. Since the target is expected -+ * to be a named object, a reference to it will cause it -+ * to be avaluated in place and its return package will -+ * be embedded in the links package at the location of -+ * the reference. -+ * -+ * The target package is expected to contain _DSD- -+ * equivalent information, but the scope in which it -+ * is located in the original AML is unknown. Thus -+ * it cannot contain pathname segments represented as -+ * strings because there is no way to build full -+ * pathnames out of them. -+ */ -+ acpi_handle_debug(scope, "subnode %s: Unknown scope\n", -+ link->package.elements[0].string.pointer); - desc = &link->package.elements[1]; - result = acpi_nondev_subnode_extract(desc, NULL, link, - list, parent); - break; -+ case ACPI_TYPE_LOCAL_REFERENCE: -+ /* -+ * It is not expected to see any local references in -+ * the links package because referencing a named object -+ * should cause it to be evaluated in place. -+ */ -+ acpi_handle_info(scope, "subnode %s: Unexpected reference\n", -+ link->package.elements[0].string.pointer); -+ fallthrough; - default: - result = false; - break; -@@ -357,6 +390,9 @@ static void acpi_untie_nondev_subnodes(struct acpi_device_data *data) - struct acpi_data_node *dn; - - list_for_each_entry(dn, &data->subnodes, sibling) { -+ if (!dn->handle) -+ continue; -+ - acpi_detach_data(dn->handle, acpi_nondev_subnode_tag); - - acpi_untie_nondev_subnodes(&dn->data); -@@ -371,6 +407,9 @@ static bool acpi_tie_nondev_subnodes(struct acpi_device_data *data) - acpi_status status; - bool ret; - -+ if (!dn->handle) -+ continue; -+ - status = acpi_attach_data(dn->handle, acpi_nondev_subnode_tag, dn); - if (ACPI_FAILURE(status) && status != AE_ALREADY_EXISTS) { - acpi_handle_err(dn->handle, "Can't tag data node\n"); -diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c -index c48f4d9f2c690b..558cfb3a06c5ea 100644 ---- a/drivers/bus/mhi/ep/main.c -+++ b/drivers/bus/mhi/ep/main.c -@@ -387,17 +387,13 @@ static int mhi_ep_read_channel(struct mhi_ep_cntrl *mhi_cntrl, - { - struct mhi_ep_chan *mhi_chan = &mhi_cntrl->mhi_chan[ring->ch_id]; - struct device *dev = &mhi_cntrl->mhi_dev->dev; -- size_t tr_len, read_offset, write_offset; -+ size_t tr_len, read_offset; - struct mhi_ep_buf_info buf_info = {}; - u32 len = MHI_EP_DEFAULT_MTU; - struct mhi_ring_element *el; -- bool tr_done = false; - void *buf_addr; -- u32 buf_left; - int ret; - -- buf_left = len; -- - do { - /* Don't process the transfer ring if the channel is not in RUNNING state */ - if (mhi_chan->state != MHI_CH_STATE_RUNNING) { -@@ -410,24 +406,23 @@ static int mhi_ep_read_channel(struct mhi_ep_cntrl *mhi_cntrl, - /* Check if there is data pending to be read from previous read operation */ - if (mhi_chan->tre_bytes_left) { - dev_dbg(dev, "TRE bytes remaining: %u\n", mhi_chan->tre_bytes_left); -- tr_len = min(buf_left, mhi_chan->tre_bytes_left); -+ tr_len = min(len, mhi_chan->tre_bytes_left); - } else { - mhi_chan->tre_loc = MHI_TRE_DATA_GET_PTR(el); - mhi_chan->tre_size = MHI_TRE_DATA_GET_LEN(el); - mhi_chan->tre_bytes_left = mhi_chan->tre_size; - -- tr_len = min(buf_left, mhi_chan->tre_size); -+ tr_len = min(len, mhi_chan->tre_size); - } - - read_offset = mhi_chan->tre_size - mhi_chan->tre_bytes_left; -- write_offset = len - buf_left; - - buf_addr = kmem_cache_zalloc(mhi_cntrl->tre_buf_cache, GFP_KERNEL); - if (!buf_addr) - return -ENOMEM; - - buf_info.host_addr = mhi_chan->tre_loc + read_offset; -- buf_info.dev_addr = buf_addr + write_offset; -+ buf_info.dev_addr = buf_addr; - buf_info.size = tr_len; - buf_info.cb = mhi_ep_read_completion; - buf_info.cb_buf = buf_addr; -@@ -443,16 +438,12 @@ static int mhi_ep_read_channel(struct mhi_ep_cntrl *mhi_cntrl, - goto err_free_buf_addr; - } - -- buf_left -= tr_len; - mhi_chan->tre_bytes_left -= tr_len; - -- if (!mhi_chan->tre_bytes_left) { -- if (MHI_TRE_DATA_GET_IEOT(el)) -- tr_done = true; -- -+ if (!mhi_chan->tre_bytes_left) - mhi_chan->rd_offset = (mhi_chan->rd_offset + 1) % ring->ring_size; -- } -- } while (buf_left && !tr_done); -+ /* Read until the some buffer is left or the ring becomes not empty */ -+ } while (!mhi_ep_queue_is_empty(mhi_chan->mhi_dev, DMA_TO_DEVICE)); - - return 0; - -@@ -486,15 +477,11 @@ static int mhi_ep_process_ch_ring(struct mhi_ep_ring *ring) - mhi_chan->xfer_cb(mhi_chan->mhi_dev, &result); - } else { - /* UL channel */ -- do { -- ret = mhi_ep_read_channel(mhi_cntrl, ring); -- if (ret < 0) { -- dev_err(&mhi_chan->mhi_dev->dev, "Failed to read channel\n"); -- return ret; -- } -- -- /* Read until the ring becomes empty */ -- } while (!mhi_ep_queue_is_empty(mhi_chan->mhi_dev, DMA_TO_DEVICE)); -+ ret = mhi_ep_read_channel(mhi_cntrl, ring); -+ if (ret < 0) { -+ dev_err(&mhi_chan->mhi_dev->dev, "Failed to read channel\n"); -+ return ret; -+ } - } - - return 0; -diff --git a/drivers/bus/mhi/host/init.c b/drivers/bus/mhi/host/init.c -index cfd17c02fe20ef..4af748ff509855 100644 ---- a/drivers/bus/mhi/host/init.c -+++ b/drivers/bus/mhi/host/init.c -@@ -164,7 +164,6 @@ void mhi_deinit_free_irq(struct mhi_controller *mhi_cntrl) - int mhi_init_irq_setup(struct mhi_controller *mhi_cntrl) - { - struct mhi_event *mhi_event = mhi_cntrl->mhi_event; -- struct device *dev = &mhi_cntrl->mhi_dev->dev; - unsigned long irq_flags = IRQF_SHARED | IRQF_NO_SUSPEND; - int i, ret; - -@@ -191,7 +190,7 @@ int mhi_init_irq_setup(struct mhi_controller *mhi_cntrl) - continue; - - if (mhi_event->irq >= mhi_cntrl->nr_irqs) { -- dev_err(dev, "irq %d not available for event ring\n", -+ dev_err(mhi_cntrl->cntrl_dev, "irq %d not available for event ring\n", - mhi_event->irq); - ret = -EINVAL; - goto error_request; -@@ -202,7 +201,7 @@ int mhi_init_irq_setup(struct mhi_controller *mhi_cntrl) - irq_flags, - "mhi", mhi_event); - if (ret) { -- dev_err(dev, "Error requesting irq:%d for ev:%d\n", -+ dev_err(mhi_cntrl->cntrl_dev, "Error requesting irq:%d for ev:%d\n", - mhi_cntrl->irq[mhi_event->irq], i); - goto error_request; - } -diff --git a/drivers/char/ipmi/ipmi_kcs_sm.c b/drivers/char/ipmi/ipmi_kcs_sm.c -index ecfcb50302f6ce..efda90dcf5b3d0 100644 ---- a/drivers/char/ipmi/ipmi_kcs_sm.c -+++ b/drivers/char/ipmi/ipmi_kcs_sm.c -@@ -122,10 +122,10 @@ struct si_sm_data { - unsigned long error0_timeout; - }; - --static unsigned int init_kcs_data_with_state(struct si_sm_data *kcs, -- struct si_sm_io *io, enum kcs_states state) -+static unsigned int init_kcs_data(struct si_sm_data *kcs, -+ struct si_sm_io *io) - { -- kcs->state = state; -+ kcs->state = KCS_IDLE; - kcs->io = io; - kcs->write_pos = 0; - kcs->write_count = 0; -@@ -140,12 +140,6 @@ static unsigned int init_kcs_data_with_state(struct si_sm_data *kcs, - return 2; - } - --static unsigned int init_kcs_data(struct si_sm_data *kcs, -- struct si_sm_io *io) --{ -- return init_kcs_data_with_state(kcs, io, KCS_IDLE); --} -- - static inline unsigned char read_status(struct si_sm_data *kcs) - { - return kcs->io->inputb(kcs->io, 1); -@@ -276,7 +270,7 @@ static int start_kcs_transaction(struct si_sm_data *kcs, unsigned char *data, - if (size > MAX_KCS_WRITE_SIZE) - return IPMI_REQ_LEN_EXCEEDED_ERR; - -- if (kcs->state != KCS_IDLE) { -+ if ((kcs->state != KCS_IDLE) && (kcs->state != KCS_HOSED)) { - dev_warn(kcs->io->dev, "KCS in invalid state %d\n", kcs->state); - return IPMI_NOT_IN_MY_STATE_ERR; - } -@@ -501,7 +495,7 @@ static enum si_sm_result kcs_event(struct si_sm_data *kcs, long time) - } - - if (kcs->state == KCS_HOSED) { -- init_kcs_data_with_state(kcs, kcs->io, KCS_ERROR0); -+ init_kcs_data(kcs, kcs->io); - return SI_SM_HOSED; - } - -diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c -index 96f175bd6d9fb7..b7d8bf202ed2d0 100644 ---- a/drivers/char/ipmi/ipmi_msghandler.c -+++ b/drivers/char/ipmi/ipmi_msghandler.c -@@ -39,7 +39,9 @@ - - #define IPMI_DRIVER_VERSION "39.2" - --static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void); -+static struct ipmi_recv_msg *ipmi_alloc_recv_msg(struct ipmi_user *user); -+static void ipmi_set_recv_msg_user(struct ipmi_recv_msg *msg, -+ struct ipmi_user *user); - static int ipmi_init_msghandler(void); - static void smi_recv_tasklet(struct tasklet_struct *t); - static void handle_new_recv_msgs(struct ipmi_smi *intf); -@@ -939,13 +941,11 @@ static int deliver_response(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) - * risk. At this moment, simply skip it in that case. - */ - ipmi_free_recv_msg(msg); -- atomic_dec(&msg->user->nr_msgs); - } else { - int index; - struct ipmi_user *user = acquire_ipmi_user(msg->user, &index); - - if (user) { -- atomic_dec(&user->nr_msgs); - user->handler->ipmi_recv_hndl(msg, user->handler_data); - release_ipmi_user(user, index); - } else { -@@ -1634,8 +1634,7 @@ int ipmi_set_gets_events(struct ipmi_user *user, bool val) - spin_unlock_irqrestore(&intf->events_lock, flags); - - list_for_each_entry_safe(msg, msg2, &msgs, link) { -- msg->user = user; -- kref_get(&user->refcount); -+ ipmi_set_recv_msg_user(msg, user); - deliver_local_response(intf, msg); - } - -@@ -2309,22 +2308,18 @@ static int i_ipmi_request(struct ipmi_user *user, - struct ipmi_recv_msg *recv_msg; - int rv = 0; - -- if (user) { -- if (atomic_add_return(1, &user->nr_msgs) > max_msgs_per_user) { -- /* Decrement will happen at the end of the routine. */ -- rv = -EBUSY; -- goto out; -- } -- } -- -- if (supplied_recv) -+ if (supplied_recv) { - recv_msg = supplied_recv; -- else { -- recv_msg = ipmi_alloc_recv_msg(); -- if (recv_msg == NULL) { -- rv = -ENOMEM; -- goto out; -+ recv_msg->user = user; -+ if (user) { -+ atomic_inc(&user->nr_msgs); -+ /* The put happens when the message is freed. */ -+ kref_get(&user->refcount); - } -+ } else { -+ recv_msg = ipmi_alloc_recv_msg(user); -+ if (IS_ERR(recv_msg)) -+ return PTR_ERR(recv_msg); - } - recv_msg->user_msg_data = user_msg_data; - -@@ -2335,8 +2330,7 @@ static int i_ipmi_request(struct ipmi_user *user, - if (smi_msg == NULL) { - if (!supplied_recv) - ipmi_free_recv_msg(recv_msg); -- rv = -ENOMEM; -- goto out; -+ return -ENOMEM; - } - } - -@@ -2346,10 +2340,6 @@ static int i_ipmi_request(struct ipmi_user *user, - goto out_err; - } - -- recv_msg->user = user; -- if (user) -- /* The put happens when the message is freed. */ -- kref_get(&user->refcount); - recv_msg->msgid = msgid; - /* - * Store the message to send in the receive message so timeout -@@ -2378,8 +2368,10 @@ static int i_ipmi_request(struct ipmi_user *user, - - if (rv) { - out_err: -- ipmi_free_smi_msg(smi_msg); -- ipmi_free_recv_msg(recv_msg); -+ if (!supplied_smi) -+ ipmi_free_smi_msg(smi_msg); -+ if (!supplied_recv) -+ ipmi_free_recv_msg(recv_msg); - } else { - dev_dbg(intf->si_dev, "Send: %*ph\n", - smi_msg->data_size, smi_msg->data); -@@ -2388,9 +2380,6 @@ static int i_ipmi_request(struct ipmi_user *user, - } - rcu_read_unlock(); - --out: -- if (rv && user) -- atomic_dec(&user->nr_msgs); - return rv; - } - -@@ -3883,7 +3872,7 @@ static int handle_ipmb_get_msg_cmd(struct ipmi_smi *intf, - unsigned char chan; - struct ipmi_user *user = NULL; - struct ipmi_ipmb_addr *ipmb_addr; -- struct ipmi_recv_msg *recv_msg; -+ struct ipmi_recv_msg *recv_msg = NULL; - - if (msg->rsp_size < 10) { - /* Message not big enough, just ignore it. */ -@@ -3904,9 +3893,8 @@ static int handle_ipmb_get_msg_cmd(struct ipmi_smi *intf, - rcvr = find_cmd_rcvr(intf, netfn, cmd, chan); - if (rcvr) { - user = rcvr->user; -- kref_get(&user->refcount); -- } else -- user = NULL; -+ recv_msg = ipmi_alloc_recv_msg(user); -+ } - rcu_read_unlock(); - - if (user == NULL) { -@@ -3941,47 +3929,41 @@ static int handle_ipmb_get_msg_cmd(struct ipmi_smi *intf, - rv = -1; - } - rcu_read_unlock(); -- } else { -- recv_msg = ipmi_alloc_recv_msg(); -- if (!recv_msg) { -- /* -- * We couldn't allocate memory for the -- * message, so requeue it for handling -- * later. -- */ -- rv = 1; -- kref_put(&user->refcount, free_user); -- } else { -- /* Extract the source address from the data. */ -- ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr; -- ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE; -- ipmb_addr->slave_addr = msg->rsp[6]; -- ipmb_addr->lun = msg->rsp[7] & 3; -- ipmb_addr->channel = msg->rsp[3] & 0xf; -+ } else if (!IS_ERR(recv_msg)) { -+ /* Extract the source address from the data. */ -+ ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr; -+ ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE; -+ ipmb_addr->slave_addr = msg->rsp[6]; -+ ipmb_addr->lun = msg->rsp[7] & 3; -+ ipmb_addr->channel = msg->rsp[3] & 0xf; - -- /* -- * Extract the rest of the message information -- * from the IPMB header. -- */ -- recv_msg->user = user; -- recv_msg->recv_type = IPMI_CMD_RECV_TYPE; -- recv_msg->msgid = msg->rsp[7] >> 2; -- recv_msg->msg.netfn = msg->rsp[4] >> 2; -- recv_msg->msg.cmd = msg->rsp[8]; -- recv_msg->msg.data = recv_msg->msg_data; -+ /* -+ * Extract the rest of the message information -+ * from the IPMB header. -+ */ -+ recv_msg->recv_type = IPMI_CMD_RECV_TYPE; -+ recv_msg->msgid = msg->rsp[7] >> 2; -+ recv_msg->msg.netfn = msg->rsp[4] >> 2; -+ recv_msg->msg.cmd = msg->rsp[8]; -+ recv_msg->msg.data = recv_msg->msg_data; - -- /* -- * We chop off 10, not 9 bytes because the checksum -- * at the end also needs to be removed. -- */ -- recv_msg->msg.data_len = msg->rsp_size - 10; -- memcpy(recv_msg->msg_data, &msg->rsp[9], -- msg->rsp_size - 10); -- if (deliver_response(intf, recv_msg)) -- ipmi_inc_stat(intf, unhandled_commands); -- else -- ipmi_inc_stat(intf, handled_commands); -- } -+ /* -+ * We chop off 10, not 9 bytes because the checksum -+ * at the end also needs to be removed. -+ */ -+ recv_msg->msg.data_len = msg->rsp_size - 10; -+ memcpy(recv_msg->msg_data, &msg->rsp[9], -+ msg->rsp_size - 10); -+ if (deliver_response(intf, recv_msg)) -+ ipmi_inc_stat(intf, unhandled_commands); -+ else -+ ipmi_inc_stat(intf, handled_commands); -+ } else { -+ /* -+ * We couldn't allocate memory for the message, so -+ * requeue it for handling later. -+ */ -+ rv = 1; - } - - return rv; -@@ -3994,7 +3976,7 @@ static int handle_ipmb_direct_rcv_cmd(struct ipmi_smi *intf, - int rv = 0; - struct ipmi_user *user = NULL; - struct ipmi_ipmb_direct_addr *daddr; -- struct ipmi_recv_msg *recv_msg; -+ struct ipmi_recv_msg *recv_msg = NULL; - unsigned char netfn = msg->rsp[0] >> 2; - unsigned char cmd = msg->rsp[3]; - -@@ -4003,9 +3985,8 @@ static int handle_ipmb_direct_rcv_cmd(struct ipmi_smi *intf, - rcvr = find_cmd_rcvr(intf, netfn, cmd, 0); - if (rcvr) { - user = rcvr->user; -- kref_get(&user->refcount); -- } else -- user = NULL; -+ recv_msg = ipmi_alloc_recv_msg(user); -+ } - rcu_read_unlock(); - - if (user == NULL) { -@@ -4032,44 +4013,38 @@ static int handle_ipmb_direct_rcv_cmd(struct ipmi_smi *intf, - rv = -1; - } - rcu_read_unlock(); -- } else { -- recv_msg = ipmi_alloc_recv_msg(); -- if (!recv_msg) { -- /* -- * We couldn't allocate memory for the -- * message, so requeue it for handling -- * later. -- */ -- rv = 1; -- kref_put(&user->refcount, free_user); -- } else { -- /* Extract the source address from the data. */ -- daddr = (struct ipmi_ipmb_direct_addr *)&recv_msg->addr; -- daddr->addr_type = IPMI_IPMB_DIRECT_ADDR_TYPE; -- daddr->channel = 0; -- daddr->slave_addr = msg->rsp[1]; -- daddr->rs_lun = msg->rsp[0] & 3; -- daddr->rq_lun = msg->rsp[2] & 3; -+ } else if (!IS_ERR(recv_msg)) { -+ /* Extract the source address from the data. */ -+ daddr = (struct ipmi_ipmb_direct_addr *)&recv_msg->addr; -+ daddr->addr_type = IPMI_IPMB_DIRECT_ADDR_TYPE; -+ daddr->channel = 0; -+ daddr->slave_addr = msg->rsp[1]; -+ daddr->rs_lun = msg->rsp[0] & 3; -+ daddr->rq_lun = msg->rsp[2] & 3; - -- /* -- * Extract the rest of the message information -- * from the IPMB header. -- */ -- recv_msg->user = user; -- recv_msg->recv_type = IPMI_CMD_RECV_TYPE; -- recv_msg->msgid = (msg->rsp[2] >> 2); -- recv_msg->msg.netfn = msg->rsp[0] >> 2; -- recv_msg->msg.cmd = msg->rsp[3]; -- recv_msg->msg.data = recv_msg->msg_data; -- -- recv_msg->msg.data_len = msg->rsp_size - 4; -- memcpy(recv_msg->msg_data, msg->rsp + 4, -- msg->rsp_size - 4); -- if (deliver_response(intf, recv_msg)) -- ipmi_inc_stat(intf, unhandled_commands); -- else -- ipmi_inc_stat(intf, handled_commands); -- } -+ /* -+ * Extract the rest of the message information -+ * from the IPMB header. -+ */ -+ recv_msg->recv_type = IPMI_CMD_RECV_TYPE; -+ recv_msg->msgid = (msg->rsp[2] >> 2); -+ recv_msg->msg.netfn = msg->rsp[0] >> 2; -+ recv_msg->msg.cmd = msg->rsp[3]; -+ recv_msg->msg.data = recv_msg->msg_data; -+ -+ recv_msg->msg.data_len = msg->rsp_size - 4; -+ memcpy(recv_msg->msg_data, msg->rsp + 4, -+ msg->rsp_size - 4); -+ if (deliver_response(intf, recv_msg)) -+ ipmi_inc_stat(intf, unhandled_commands); -+ else -+ ipmi_inc_stat(intf, handled_commands); -+ } else { -+ /* -+ * We couldn't allocate memory for the message, so -+ * requeue it for handling later. -+ */ -+ rv = 1; - } - - return rv; -@@ -4183,7 +4158,7 @@ static int handle_lan_get_msg_cmd(struct ipmi_smi *intf, - unsigned char chan; - struct ipmi_user *user = NULL; - struct ipmi_lan_addr *lan_addr; -- struct ipmi_recv_msg *recv_msg; -+ struct ipmi_recv_msg *recv_msg = NULL; - - if (msg->rsp_size < 12) { - /* Message not big enough, just ignore it. */ -@@ -4204,9 +4179,8 @@ static int handle_lan_get_msg_cmd(struct ipmi_smi *intf, - rcvr = find_cmd_rcvr(intf, netfn, cmd, chan); - if (rcvr) { - user = rcvr->user; -- kref_get(&user->refcount); -- } else -- user = NULL; -+ recv_msg = ipmi_alloc_recv_msg(user); -+ } - rcu_read_unlock(); - - if (user == NULL) { -@@ -4218,49 +4192,44 @@ static int handle_lan_get_msg_cmd(struct ipmi_smi *intf, - * them to be freed. - */ - rv = 0; -- } else { -- recv_msg = ipmi_alloc_recv_msg(); -- if (!recv_msg) { -- /* -- * We couldn't allocate memory for the -- * message, so requeue it for handling later. -- */ -- rv = 1; -- kref_put(&user->refcount, free_user); -- } else { -- /* Extract the source address from the data. */ -- lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr; -- lan_addr->addr_type = IPMI_LAN_ADDR_TYPE; -- lan_addr->session_handle = msg->rsp[4]; -- lan_addr->remote_SWID = msg->rsp[8]; -- lan_addr->local_SWID = msg->rsp[5]; -- lan_addr->lun = msg->rsp[9] & 3; -- lan_addr->channel = msg->rsp[3] & 0xf; -- lan_addr->privilege = msg->rsp[3] >> 4; -+ } else if (!IS_ERR(recv_msg)) { -+ /* Extract the source address from the data. */ -+ lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr; -+ lan_addr->addr_type = IPMI_LAN_ADDR_TYPE; -+ lan_addr->session_handle = msg->rsp[4]; -+ lan_addr->remote_SWID = msg->rsp[8]; -+ lan_addr->local_SWID = msg->rsp[5]; -+ lan_addr->lun = msg->rsp[9] & 3; -+ lan_addr->channel = msg->rsp[3] & 0xf; -+ lan_addr->privilege = msg->rsp[3] >> 4; - -- /* -- * Extract the rest of the message information -- * from the IPMB header. -- */ -- recv_msg->user = user; -- recv_msg->recv_type = IPMI_CMD_RECV_TYPE; -- recv_msg->msgid = msg->rsp[9] >> 2; -- recv_msg->msg.netfn = msg->rsp[6] >> 2; -- recv_msg->msg.cmd = msg->rsp[10]; -- recv_msg->msg.data = recv_msg->msg_data; -+ /* -+ * Extract the rest of the message information -+ * from the IPMB header. -+ */ -+ recv_msg->recv_type = IPMI_CMD_RECV_TYPE; -+ recv_msg->msgid = msg->rsp[9] >> 2; -+ recv_msg->msg.netfn = msg->rsp[6] >> 2; -+ recv_msg->msg.cmd = msg->rsp[10]; -+ recv_msg->msg.data = recv_msg->msg_data; - -- /* -- * We chop off 12, not 11 bytes because the checksum -- * at the end also needs to be removed. -- */ -- recv_msg->msg.data_len = msg->rsp_size - 12; -- memcpy(recv_msg->msg_data, &msg->rsp[11], -- msg->rsp_size - 12); -- if (deliver_response(intf, recv_msg)) -- ipmi_inc_stat(intf, unhandled_commands); -- else -- ipmi_inc_stat(intf, handled_commands); -- } -+ /* -+ * We chop off 12, not 11 bytes because the checksum -+ * at the end also needs to be removed. -+ */ -+ recv_msg->msg.data_len = msg->rsp_size - 12; -+ memcpy(recv_msg->msg_data, &msg->rsp[11], -+ msg->rsp_size - 12); -+ if (deliver_response(intf, recv_msg)) -+ ipmi_inc_stat(intf, unhandled_commands); -+ else -+ ipmi_inc_stat(intf, handled_commands); -+ } else { -+ /* -+ * We couldn't allocate memory for the message, so -+ * requeue it for handling later. -+ */ -+ rv = 1; - } - - return rv; -@@ -4282,7 +4251,7 @@ static int handle_oem_get_msg_cmd(struct ipmi_smi *intf, - unsigned char chan; - struct ipmi_user *user = NULL; - struct ipmi_system_interface_addr *smi_addr; -- struct ipmi_recv_msg *recv_msg; -+ struct ipmi_recv_msg *recv_msg = NULL; - - /* - * We expect the OEM SW to perform error checking -@@ -4311,9 +4280,8 @@ static int handle_oem_get_msg_cmd(struct ipmi_smi *intf, - rcvr = find_cmd_rcvr(intf, netfn, cmd, chan); - if (rcvr) { - user = rcvr->user; -- kref_get(&user->refcount); -- } else -- user = NULL; -+ recv_msg = ipmi_alloc_recv_msg(user); -+ } - rcu_read_unlock(); - - if (user == NULL) { -@@ -4326,48 +4294,42 @@ static int handle_oem_get_msg_cmd(struct ipmi_smi *intf, - */ - - rv = 0; -- } else { -- recv_msg = ipmi_alloc_recv_msg(); -- if (!recv_msg) { -- /* -- * We couldn't allocate memory for the -- * message, so requeue it for handling -- * later. -- */ -- rv = 1; -- kref_put(&user->refcount, free_user); -- } else { -- /* -- * OEM Messages are expected to be delivered via -- * the system interface to SMS software. We might -- * need to visit this again depending on OEM -- * requirements -- */ -- smi_addr = ((struct ipmi_system_interface_addr *) -- &recv_msg->addr); -- smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; -- smi_addr->channel = IPMI_BMC_CHANNEL; -- smi_addr->lun = msg->rsp[0] & 3; -- -- recv_msg->user = user; -- recv_msg->user_msg_data = NULL; -- recv_msg->recv_type = IPMI_OEM_RECV_TYPE; -- recv_msg->msg.netfn = msg->rsp[0] >> 2; -- recv_msg->msg.cmd = msg->rsp[1]; -- recv_msg->msg.data = recv_msg->msg_data; -+ } else if (!IS_ERR(recv_msg)) { -+ /* -+ * OEM Messages are expected to be delivered via -+ * the system interface to SMS software. We might -+ * need to visit this again depending on OEM -+ * requirements -+ */ -+ smi_addr = ((struct ipmi_system_interface_addr *) -+ &recv_msg->addr); -+ smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; -+ smi_addr->channel = IPMI_BMC_CHANNEL; -+ smi_addr->lun = msg->rsp[0] & 3; -+ -+ recv_msg->user_msg_data = NULL; -+ recv_msg->recv_type = IPMI_OEM_RECV_TYPE; -+ recv_msg->msg.netfn = msg->rsp[0] >> 2; -+ recv_msg->msg.cmd = msg->rsp[1]; -+ recv_msg->msg.data = recv_msg->msg_data; - -- /* -- * The message starts at byte 4 which follows the -- * Channel Byte in the "GET MESSAGE" command -- */ -- recv_msg->msg.data_len = msg->rsp_size - 4; -- memcpy(recv_msg->msg_data, &msg->rsp[4], -- msg->rsp_size - 4); -- if (deliver_response(intf, recv_msg)) -- ipmi_inc_stat(intf, unhandled_commands); -- else -- ipmi_inc_stat(intf, handled_commands); -- } -+ /* -+ * The message starts at byte 4 which follows the -+ * Channel Byte in the "GET MESSAGE" command -+ */ -+ recv_msg->msg.data_len = msg->rsp_size - 4; -+ memcpy(recv_msg->msg_data, &msg->rsp[4], -+ msg->rsp_size - 4); -+ if (deliver_response(intf, recv_msg)) -+ ipmi_inc_stat(intf, unhandled_commands); -+ else -+ ipmi_inc_stat(intf, handled_commands); -+ } else { -+ /* -+ * We couldn't allocate memory for the message, so -+ * requeue it for handling later. -+ */ -+ rv = 1; - } - - return rv; -@@ -4426,8 +4388,8 @@ static int handle_read_event_rsp(struct ipmi_smi *intf, - if (!user->gets_events) - continue; - -- recv_msg = ipmi_alloc_recv_msg(); -- if (!recv_msg) { -+ recv_msg = ipmi_alloc_recv_msg(user); -+ if (IS_ERR(recv_msg)) { - rcu_read_unlock(); - list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, - link) { -@@ -4446,8 +4408,6 @@ static int handle_read_event_rsp(struct ipmi_smi *intf, - deliver_count++; - - copy_event_into_recv_msg(recv_msg, msg); -- recv_msg->user = user; -- kref_get(&user->refcount); - list_add_tail(&recv_msg->link, &msgs); - } - srcu_read_unlock(&intf->users_srcu, index); -@@ -4463,8 +4423,8 @@ static int handle_read_event_rsp(struct ipmi_smi *intf, - * No one to receive the message, put it in queue if there's - * not already too many things in the queue. - */ -- recv_msg = ipmi_alloc_recv_msg(); -- if (!recv_msg) { -+ recv_msg = ipmi_alloc_recv_msg(NULL); -+ if (IS_ERR(recv_msg)) { - /* - * We couldn't allocate memory for the - * message, so requeue it for handling -@@ -5156,27 +5116,51 @@ static void free_recv_msg(struct ipmi_recv_msg *msg) - kfree(msg); - } - --static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void) -+static struct ipmi_recv_msg *ipmi_alloc_recv_msg(struct ipmi_user *user) - { - struct ipmi_recv_msg *rv; - -+ if (user) { -+ if (atomic_add_return(1, &user->nr_msgs) > max_msgs_per_user) { -+ atomic_dec(&user->nr_msgs); -+ return ERR_PTR(-EBUSY); -+ } -+ } -+ - rv = kmalloc(sizeof(struct ipmi_recv_msg), GFP_ATOMIC); -- if (rv) { -- rv->user = NULL; -- rv->done = free_recv_msg; -- atomic_inc(&recv_msg_inuse_count); -+ if (!rv) { -+ if (user) -+ atomic_dec(&user->nr_msgs); -+ return ERR_PTR(-ENOMEM); - } -+ -+ rv->user = user; -+ rv->done = free_recv_msg; -+ if (user) -+ kref_get(&user->refcount); -+ atomic_inc(&recv_msg_inuse_count); - return rv; - } - - void ipmi_free_recv_msg(struct ipmi_recv_msg *msg) - { -- if (msg->user && !oops_in_progress) -+ if (msg->user && !oops_in_progress) { -+ atomic_dec(&msg->user->nr_msgs); - kref_put(&msg->user->refcount, free_user); -+ } - msg->done(msg); - } - EXPORT_SYMBOL(ipmi_free_recv_msg); - -+static void ipmi_set_recv_msg_user(struct ipmi_recv_msg *msg, -+ struct ipmi_user *user) -+{ -+ WARN_ON_ONCE(msg->user); /* User should not be set. */ -+ msg->user = user; -+ atomic_inc(&user->nr_msgs); -+ kref_get(&user->refcount); -+} -+ - static atomic_t panic_done_count = ATOMIC_INIT(0); - - static void dummy_smi_done_handler(struct ipmi_smi_msg *msg) -diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c -index c71e61ccb95a2b..5e6ee5b82b8ff4 100644 ---- a/drivers/char/tpm/tpm_tis_core.c -+++ b/drivers/char/tpm/tpm_tis_core.c -@@ -977,8 +977,8 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, - * will call disable_irq which undoes all of the above. - */ - if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { -- tpm_tis_write8(priv, original_int_vec, -- TPM_INT_VECTOR(priv->locality)); -+ tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), -+ original_int_vec); - rc = -1; - } - -diff --git a/drivers/clk/at91/clk-peripheral.c b/drivers/clk/at91/clk-peripheral.c -index c173a44c800aa8..629f050a855aae 100644 ---- a/drivers/clk/at91/clk-peripheral.c -+++ b/drivers/clk/at91/clk-peripheral.c -@@ -279,8 +279,11 @@ static int clk_sam9x5_peripheral_determine_rate(struct clk_hw *hw, - long best_diff = LONG_MIN; - u32 shift; - -- if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) -- return parent_rate; -+ if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) { -+ req->rate = parent_rate; -+ -+ return 0; -+ } - - /* Fist step: check the available dividers. */ - for (shift = 0; shift <= PERIPHERAL_MAX_SHIFT; shift++) { -diff --git a/drivers/clk/mediatek/clk-mt8195-infra_ao.c b/drivers/clk/mediatek/clk-mt8195-infra_ao.c -index dfba6eb61ccfee..4ecdf9ae024439 100644 ---- a/drivers/clk/mediatek/clk-mt8195-infra_ao.c -+++ b/drivers/clk/mediatek/clk-mt8195-infra_ao.c -@@ -103,7 +103,7 @@ static const struct mtk_gate infra_ao_clks[] = { - GATE_INFRA_AO0(CLK_INFRA_AO_CQ_DMA_FPC, "infra_ao_cq_dma_fpc", "fpc", 28), - GATE_INFRA_AO0(CLK_INFRA_AO_UART5, "infra_ao_uart5", "top_uart", 29), - /* INFRA_AO1 */ -- GATE_INFRA_AO1(CLK_INFRA_AO_HDMI_26M, "infra_ao_hdmi_26m", "clk26m", 0), -+ GATE_INFRA_AO1(CLK_INFRA_AO_HDMI_26M, "infra_ao_hdmi_26m", "top_hdmi_xtal", 0), - GATE_INFRA_AO1(CLK_INFRA_AO_SPI0, "infra_ao_spi0", "top_spi", 1), - GATE_INFRA_AO1(CLK_INFRA_AO_MSDC0, "infra_ao_msdc0", "top_msdc50_0_hclk", 2), - GATE_INFRA_AO1(CLK_INFRA_AO_MSDC1, "infra_ao_msdc1", "top_axi", 4), -diff --git a/drivers/clk/mediatek/clk-mux.c b/drivers/clk/mediatek/clk-mux.c -index c93bc7f926e5d4..359f92df826b5e 100644 ---- a/drivers/clk/mediatek/clk-mux.c -+++ b/drivers/clk/mediatek/clk-mux.c -@@ -132,9 +132,7 @@ static int mtk_clk_mux_set_parent_setclr_lock(struct clk_hw *hw, u8 index) - static int mtk_clk_mux_determine_rate(struct clk_hw *hw, - struct clk_rate_request *req) - { -- struct mtk_clk_mux *mux = to_mtk_clk_mux(hw); -- -- return clk_mux_determine_rate_flags(hw, req, mux->data->flags); -+ return clk_mux_determine_rate_flags(hw, req, 0); - } - - const struct clk_ops mtk_mux_clr_set_upd_ops = { -diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c -index 69ebf65081b81f..bbd7d64038fab5 100644 ---- a/drivers/clk/nxp/clk-lpc18xx-cgu.c -+++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c -@@ -371,23 +371,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw, - return 0; - } - --static long lpc18xx_pll0_round_rate(struct clk_hw *hw, unsigned long rate, -- unsigned long *prate) -+static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, -+ struct clk_rate_request *req) - { - unsigned long m; - -- if (*prate < rate) { -+ if (req->best_parent_rate < req->rate) { - pr_warn("%s: pll dividers not supported\n", __func__); - return -EINVAL; - } - -- m = DIV_ROUND_UP_ULL(*prate, rate * 2); -- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { -- pr_warn("%s: unable to support rate %lu\n", __func__, rate); -+ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2); -+ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) { -+ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate); - return -EINVAL; - } - -- return 2 * *prate * m; -+ req->rate = 2 * req->best_parent_rate * m; -+ -+ return 0; - } - - static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, -@@ -403,7 +405,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, - } - - m = DIV_ROUND_UP_ULL(parent_rate, rate * 2); -- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { -+ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) { - pr_warn("%s: unable to support rate %lu\n", __func__, rate); - return -EINVAL; - } -@@ -444,7 +446,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, - - static const struct clk_ops lpc18xx_pll0_ops = { - .recalc_rate = lpc18xx_pll0_recalc_rate, -- .round_rate = lpc18xx_pll0_round_rate, -+ .determine_rate = lpc18xx_pll0_determine_rate, - .set_rate = lpc18xx_pll0_set_rate, - }; - -diff --git a/drivers/clk/tegra/clk-bpmp.c b/drivers/clk/tegra/clk-bpmp.c -index 7bfba0afd77831..4ec408c3a26aa4 100644 ---- a/drivers/clk/tegra/clk-bpmp.c -+++ b/drivers/clk/tegra/clk-bpmp.c -@@ -635,7 +635,7 @@ static int tegra_bpmp_register_clocks(struct tegra_bpmp *bpmp, - - bpmp->num_clocks = count; - -- bpmp->clocks = devm_kcalloc(bpmp->dev, count, sizeof(struct tegra_bpmp_clk), GFP_KERNEL); -+ bpmp->clocks = devm_kcalloc(bpmp->dev, count, sizeof(*bpmp->clocks), GFP_KERNEL); - if (!bpmp->clocks) - return -ENOMEM; - -diff --git a/drivers/clocksource/clps711x-timer.c b/drivers/clocksource/clps711x-timer.c -index e95fdc49c2269c..bbceb0289d457a 100644 ---- a/drivers/clocksource/clps711x-timer.c -+++ b/drivers/clocksource/clps711x-timer.c -@@ -78,24 +78,33 @@ static int __init clps711x_timer_init(struct device_node *np) - unsigned int irq = irq_of_parse_and_map(np, 0); - struct clk *clock = of_clk_get(np, 0); - void __iomem *base = of_iomap(np, 0); -+ int ret = 0; - - if (!base) - return -ENOMEM; -- if (!irq) -- return -EINVAL; -- if (IS_ERR(clock)) -- return PTR_ERR(clock); -+ if (!irq) { -+ ret = -EINVAL; -+ goto unmap_io; -+ } -+ if (IS_ERR(clock)) { -+ ret = PTR_ERR(clock); -+ goto unmap_io; -+ } - - switch (of_alias_get_id(np, "timer")) { - case CLPS711X_CLKSRC_CLOCKSOURCE: - clps711x_clksrc_init(clock, base); - break; - case CLPS711X_CLKSRC_CLOCKEVENT: -- return _clps711x_clkevt_init(clock, base, irq); -+ ret = _clps711x_clkevt_init(clock, base, irq); -+ break; - default: -- return -EINVAL; -+ ret = -EINVAL; -+ break; - } - -- return 0; -+unmap_io: -+ iounmap(base); -+ return ret; - } - TIMER_OF_DECLARE(clps711x, "cirrus,ep7209-timer", clps711x_timer_init); -diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c -index ed782c0b48af25..60b4e3b608c006 100644 ---- a/drivers/cpufreq/intel_pstate.c -+++ b/drivers/cpufreq/intel_pstate.c -@@ -1341,10 +1341,10 @@ static void update_qos_request(enum freq_qos_req_type type) - continue; - - req = policy->driver_data; -- cpufreq_cpu_put(policy); -- -- if (!req) -+ if (!req) { -+ cpufreq_cpu_put(policy); - continue; -+ } - - if (hwp_active) - intel_pstate_get_hwp_cap(cpu); -@@ -1360,6 +1360,8 @@ static void update_qos_request(enum freq_qos_req_type type) - - if (freq_qos_update_request(req, freq) < 0) - pr_warn("Failed to update freq constraint: CPU%d\n", i); -+ -+ cpufreq_cpu_put(policy); - } - } - -diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c -index 7b8fcfa55038bc..39186008afbfdf 100644 ---- a/drivers/cpufreq/tegra186-cpufreq.c -+++ b/drivers/cpufreq/tegra186-cpufreq.c -@@ -86,10 +86,14 @@ static int tegra186_cpufreq_set_target(struct cpufreq_policy *policy, - { - struct tegra186_cpufreq_data *data = cpufreq_get_driver_data(); - struct cpufreq_frequency_table *tbl = policy->freq_table + index; -- unsigned int edvd_offset = data->cpus[policy->cpu].edvd_offset; -+ unsigned int edvd_offset; - u32 edvd_val = tbl->driver_data; -+ u32 cpu; - -- writel(edvd_val, data->regs + edvd_offset); -+ for_each_cpu(cpu, policy->cpus) { -+ edvd_offset = data->cpus[cpu].edvd_offset; -+ writel(edvd_val, data->regs + edvd_offset); -+ } - - return 0; - } -diff --git a/drivers/crypto/aspeed/aspeed-hace-crypto.c b/drivers/crypto/aspeed/aspeed-hace-crypto.c -index f0eddb7854e5d8..15e843b4854d0a 100644 ---- a/drivers/crypto/aspeed/aspeed-hace-crypto.c -+++ b/drivers/crypto/aspeed/aspeed-hace-crypto.c -@@ -346,7 +346,7 @@ static int aspeed_sk_start_sg(struct aspeed_hace_dev *hace_dev) - - } else { - dma_unmap_sg(hace_dev->dev, req->dst, rctx->dst_nents, -- DMA_TO_DEVICE); -+ DMA_FROM_DEVICE); - dma_unmap_sg(hace_dev->dev, req->src, rctx->src_nents, - DMA_TO_DEVICE); - } -diff --git a/drivers/crypto/atmel-tdes.c b/drivers/crypto/atmel-tdes.c -index 099b32a10dd753..d234495f1115b8 100644 ---- a/drivers/crypto/atmel-tdes.c -+++ b/drivers/crypto/atmel-tdes.c -@@ -548,7 +548,7 @@ static int atmel_tdes_crypt_start(struct atmel_tdes_dev *dd) - - if (err && (dd->flags & TDES_FLAGS_FAST)) { - dma_unmap_sg(dd->dev, dd->in_sg, 1, DMA_TO_DEVICE); -- dma_unmap_sg(dd->dev, dd->out_sg, 1, DMA_TO_DEVICE); -+ dma_unmap_sg(dd->dev, dd->out_sg, 1, DMA_FROM_DEVICE); - } - - return err; -diff --git a/drivers/crypto/rockchip/rk3288_crypto_ahash.c b/drivers/crypto/rockchip/rk3288_crypto_ahash.c -index 29c9537216fa6d..8f3406289df430 100644 ---- a/drivers/crypto/rockchip/rk3288_crypto_ahash.c -+++ b/drivers/crypto/rockchip/rk3288_crypto_ahash.c -@@ -252,7 +252,7 @@ static void rk_hash_unprepare(struct crypto_engine *engine, void *breq) - struct rk_ahash_rctx *rctx = ahash_request_ctx(areq); - struct rk_crypto_info *rkc = rctx->dev; - -- dma_unmap_sg(rkc->dev, areq->src, rctx->nrsg, DMA_TO_DEVICE); -+ dma_unmap_sg(rkc->dev, areq->src, sg_nents(areq->src), DMA_TO_DEVICE); - } - - static int rk_hash_run(struct crypto_engine *engine, void *breq) -diff --git a/drivers/firmware/meson/meson_sm.c b/drivers/firmware/meson/meson_sm.c -index 9a2656d73600b5..b39f395c077eeb 100644 ---- a/drivers/firmware/meson/meson_sm.c -+++ b/drivers/firmware/meson/meson_sm.c -@@ -225,11 +225,16 @@ EXPORT_SYMBOL(meson_sm_call_write); - struct meson_sm_firmware *meson_sm_get(struct device_node *sm_node) - { - struct platform_device *pdev = of_find_device_by_node(sm_node); -+ struct meson_sm_firmware *fw; - - if (!pdev) - return NULL; - -- return platform_get_drvdata(pdev); -+ fw = platform_get_drvdata(pdev); -+ -+ put_device(&pdev->dev); -+ -+ return fw; - } - EXPORT_SYMBOL_GPL(meson_sm_get); - -diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c -index cfa7b0a50c8e33..03b16b8f639ad0 100644 ---- a/drivers/gpio/gpio-wcd934x.c -+++ b/drivers/gpio/gpio-wcd934x.c -@@ -102,7 +102,7 @@ static int wcd_gpio_probe(struct platform_device *pdev) - chip->base = -1; - chip->ngpio = WCD934X_NPINS; - chip->label = dev_name(dev); -- chip->can_sleep = false; -+ chip->can_sleep = true; - - return devm_gpiochip_add_data(dev, chip, data); - } -diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c -index 670d5ab9d9984f..f97c1826770825 100644 ---- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c -+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c -@@ -154,10 +154,13 @@ static bool dce60_setup_scaling_configuration( - REG_SET(SCL_BYPASS_CONTROL, 0, SCL_BYPASS_MODE, 0); - - if (data->taps.h_taps + data->taps.v_taps <= 2) { -- /* Set bypass */ -- -- /* DCE6 has no SCL_MODE register, skip scale mode programming */ -+ /* Disable scaler functionality */ -+ REG_WRITE(SCL_SCALER_ENABLE, 0); - -+ /* Clear registers that can cause glitches even when the scaler is off */ -+ REG_WRITE(SCL_TAP_CONTROL, 0); -+ REG_WRITE(SCL_AUTOMATIC_MODE_CONTROL, 0); -+ REG_WRITE(SCL_F_SHARP_CONTROL, 0); - return false; - } - -@@ -165,7 +168,7 @@ static bool dce60_setup_scaling_configuration( - SCL_H_NUM_OF_TAPS, data->taps.h_taps - 1, - SCL_V_NUM_OF_TAPS, data->taps.v_taps - 1); - -- /* DCE6 has no SCL_MODE register, skip scale mode programming */ -+ REG_WRITE(SCL_SCALER_ENABLE, 1); - - /* DCE6 has no SCL_BOUNDARY_MODE bit, skip replace out of bound pixels */ - -@@ -502,6 +505,8 @@ static void dce60_transform_set_scaler( - REG_SET(DC_LB_MEM_SIZE, 0, - DC_LB_MEM_SIZE, xfm_dce->lb_memory_size); - -+ REG_WRITE(SCL_UPDATE, 0x00010000); -+ - /* Clear SCL_F_SHARP_CONTROL value to 0 */ - REG_WRITE(SCL_F_SHARP_CONTROL, 0); - -@@ -527,8 +532,7 @@ static void dce60_transform_set_scaler( - if (coeffs_v != xfm_dce->filter_v || coeffs_h != xfm_dce->filter_h) { - /* 4. Program vertical filters */ - if (xfm_dce->filter_v == NULL) -- REG_SET(SCL_VERT_FILTER_CONTROL, 0, -- SCL_V_2TAP_HARDCODE_COEF_EN, 0); -+ REG_WRITE(SCL_VERT_FILTER_CONTROL, 0); - program_multi_taps_filter( - xfm_dce, - data->taps.v_taps, -@@ -542,8 +546,7 @@ static void dce60_transform_set_scaler( - - /* 5. Program horizontal filters */ - if (xfm_dce->filter_h == NULL) -- REG_SET(SCL_HORZ_FILTER_CONTROL, 0, -- SCL_H_2TAP_HARDCODE_COEF_EN, 0); -+ REG_WRITE(SCL_HORZ_FILTER_CONTROL, 0); - program_multi_taps_filter( - xfm_dce, - data->taps.h_taps, -@@ -566,6 +569,8 @@ static void dce60_transform_set_scaler( - /* DCE6 has no SCL_COEF_UPDATE_COMPLETE bit to flip to new coefficient memory */ - - /* DCE6 DATA_FORMAT register does not support ALPHA_EN */ -+ -+ REG_WRITE(SCL_UPDATE, 0); - } - #endif - -diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h -index cbce194ec7b82b..eb716e8337e236 100644 ---- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h -+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h -@@ -155,6 +155,9 @@ - SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \ - SRI(VIEWPORT_START, SCL, id), \ - SRI(VIEWPORT_SIZE, SCL, id), \ -+ SRI(SCL_SCALER_ENABLE, SCL, id), \ -+ SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \ -+ SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \ - SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \ - SRI(SCL_VERT_FILTER_SCALE_RATIO, SCL, id), \ - SRI(SCL_VERT_FILTER_INIT, SCL, id), \ -@@ -590,6 +593,7 @@ struct dce_transform_registers { - uint32_t SCL_VERT_FILTER_SCALE_RATIO; - uint32_t SCL_HORZ_FILTER_INIT; - #if defined(CONFIG_DRM_AMD_DC_SI) -+ uint32_t SCL_SCALER_ENABLE; - uint32_t SCL_HORZ_FILTER_INIT_RGB_LUMA; - uint32_t SCL_HORZ_FILTER_INIT_CHROMA; - #endif -diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h -index 9de01ae574c035..067eddd9c62d80 100644 ---- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h -+++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h -@@ -4115,6 +4115,7 @@ - #define mmSCL0_SCL_COEF_RAM_CONFLICT_STATUS 0x1B55 - #define mmSCL0_SCL_COEF_RAM_SELECT 0x1B40 - #define mmSCL0_SCL_COEF_RAM_TAP_DATA 0x1B41 -+#define mmSCL0_SCL_SCALER_ENABLE 0x1B42 - #define mmSCL0_SCL_CONTROL 0x1B44 - #define mmSCL0_SCL_DEBUG 0x1B6A - #define mmSCL0_SCL_DEBUG2 0x1B69 -@@ -4144,6 +4145,7 @@ - #define mmSCL1_SCL_COEF_RAM_CONFLICT_STATUS 0x1E55 - #define mmSCL1_SCL_COEF_RAM_SELECT 0x1E40 - #define mmSCL1_SCL_COEF_RAM_TAP_DATA 0x1E41 -+#define mmSCL1_SCL_SCALER_ENABLE 0x1E42 - #define mmSCL1_SCL_CONTROL 0x1E44 - #define mmSCL1_SCL_DEBUG 0x1E6A - #define mmSCL1_SCL_DEBUG2 0x1E69 -@@ -4173,6 +4175,7 @@ - #define mmSCL2_SCL_COEF_RAM_CONFLICT_STATUS 0x4155 - #define mmSCL2_SCL_COEF_RAM_SELECT 0x4140 - #define mmSCL2_SCL_COEF_RAM_TAP_DATA 0x4141 -+#define mmSCL2_SCL_SCALER_ENABLE 0x4142 - #define mmSCL2_SCL_CONTROL 0x4144 - #define mmSCL2_SCL_DEBUG 0x416A - #define mmSCL2_SCL_DEBUG2 0x4169 -@@ -4202,6 +4205,7 @@ - #define mmSCL3_SCL_COEF_RAM_CONFLICT_STATUS 0x4455 - #define mmSCL3_SCL_COEF_RAM_SELECT 0x4440 - #define mmSCL3_SCL_COEF_RAM_TAP_DATA 0x4441 -+#define mmSCL3_SCL_SCALER_ENABLE 0x4442 - #define mmSCL3_SCL_CONTROL 0x4444 - #define mmSCL3_SCL_DEBUG 0x446A - #define mmSCL3_SCL_DEBUG2 0x4469 -@@ -4231,6 +4235,7 @@ - #define mmSCL4_SCL_COEF_RAM_CONFLICT_STATUS 0x4755 - #define mmSCL4_SCL_COEF_RAM_SELECT 0x4740 - #define mmSCL4_SCL_COEF_RAM_TAP_DATA 0x4741 -+#define mmSCL4_SCL_SCALER_ENABLE 0x4742 - #define mmSCL4_SCL_CONTROL 0x4744 - #define mmSCL4_SCL_DEBUG 0x476A - #define mmSCL4_SCL_DEBUG2 0x4769 -@@ -4260,6 +4265,7 @@ - #define mmSCL5_SCL_COEF_RAM_CONFLICT_STATUS 0x4A55 - #define mmSCL5_SCL_COEF_RAM_SELECT 0x4A40 - #define mmSCL5_SCL_COEF_RAM_TAP_DATA 0x4A41 -+#define mmSCL5_SCL_SCALER_ENABLE 0x4A42 - #define mmSCL5_SCL_CONTROL 0x4A44 - #define mmSCL5_SCL_DEBUG 0x4A6A - #define mmSCL5_SCL_DEBUG2 0x4A69 -@@ -4287,6 +4293,7 @@ - #define mmSCL_COEF_RAM_CONFLICT_STATUS 0x1B55 - #define mmSCL_COEF_RAM_SELECT 0x1B40 - #define mmSCL_COEF_RAM_TAP_DATA 0x1B41 -+#define mmSCL_SCALER_ENABLE 0x1B42 - #define mmSCL_CONTROL 0x1B44 - #define mmSCL_DEBUG 0x1B6A - #define mmSCL_DEBUG2 0x1B69 -diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h -index bd8085ec54ed57..da5596fbfdcb31 100644 ---- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h -+++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h -@@ -8648,6 +8648,8 @@ - #define REGAMMA_LUT_INDEX__REGAMMA_LUT_INDEX__SHIFT 0x00000000 - #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK_MASK 0x00000007L - #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK__SHIFT 0x00000000 -+#define SCL_SCALER_ENABLE__SCL_SCALE_EN_MASK 0x00000001L -+#define SCL_SCALER_ENABLE__SCL_SCALE_EN__SHIFT 0x00000000 - #define SCL_ALU_CONTROL__SCL_ALU_DISABLE_MASK 0x00000001L - #define SCL_ALU_CONTROL__SCL_ALU_DISABLE__SHIFT 0x00000000 - #define SCL_BYPASS_CONTROL__SCL_BYPASS_MODE_MASK 0x00000003L -diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c -index 036ee034397283..11f164a15d7c21 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_bo.c -+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c -@@ -836,7 +836,7 @@ nouveau_bo_move_prep(struct nouveau_drm *drm, struct ttm_buffer_object *bo, - nvif_vmm_put(vmm, &old_mem->vma[1]); - nvif_vmm_put(vmm, &old_mem->vma[0]); - } -- return 0; -+ return ret; - } - - static int -diff --git a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c -index 92f4261305bd9d..f2ae5d17ea601e 100644 ---- a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c -+++ b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c -@@ -576,7 +576,10 @@ static int rcar_mipi_dsi_startup(struct rcar_mipi_dsi *dsi, - udelay(10); - rcar_mipi_dsi_clr(dsi, CLOCKSET1, CLOCKSET1_UPDATEPLL); - -- ppisetr = PPISETR_DLEN_3 | PPISETR_CLEN; -+ rcar_mipi_dsi_clr(dsi, TXSETR, TXSETR_LANECNT_MASK); -+ rcar_mipi_dsi_set(dsi, TXSETR, dsi->lanes - 1); -+ -+ ppisetr = ((BIT(dsi->lanes) - 1) & PPISETR_DLEN_MASK) | PPISETR_CLEN; - rcar_mipi_dsi_write(dsi, PPISETR, ppisetr); - - rcar_mipi_dsi_set(dsi, PHYSETUP, PHYSETUP_SHUTDOWNZ); -diff --git a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h -index a6b276f1d6ee15..a54c7eb4113b93 100644 ---- a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h -+++ b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h -@@ -12,6 +12,9 @@ - #define LINKSR_LPBUSY (1 << 1) - #define LINKSR_HSBUSY (1 << 0) - -+#define TXSETR 0x100 -+#define TXSETR_LANECNT_MASK (0x3 << 0) -+ - /* - * Video Mode Register - */ -@@ -80,10 +83,7 @@ - * PHY-Protocol Interface (PPI) Registers - */ - #define PPISETR 0x700 --#define PPISETR_DLEN_0 (0x1 << 0) --#define PPISETR_DLEN_1 (0x3 << 0) --#define PPISETR_DLEN_2 (0x7 << 0) --#define PPISETR_DLEN_3 (0xf << 0) -+#define PPISETR_DLEN_MASK (0xf << 0) - #define PPISETR_CLEN (1 << 8) - - #define PPICLCR 0x710 -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -index b129ce873af3f2..b235e7cc41f3f8 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -@@ -1514,6 +1514,7 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, - SVGA3dCmdHeader *header) - { - struct vmw_bo *vmw_bo = NULL; -+ struct vmw_resource *res; - struct vmw_surface *srf = NULL; - VMW_DECLARE_CMD_VAR(*cmd, SVGA3dCmdSurfaceDMA); - int ret; -@@ -1549,18 +1550,24 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, - - dirty = (cmd->body.transfer == SVGA3D_WRITE_HOST_VRAM) ? - VMW_RES_DIRTY_SET : 0; -- ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, -- dirty, user_surface_converter, -- &cmd->body.host.sid, NULL); -+ ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, dirty, -+ user_surface_converter, &cmd->body.host.sid, -+ NULL); - if (unlikely(ret != 0)) { - if (unlikely(ret != -ERESTARTSYS)) - VMW_DEBUG_USER("could not find surface for DMA.\n"); - return ret; - } - -- srf = vmw_res_to_srf(sw_context->res_cache[vmw_res_surface].res); -+ res = sw_context->res_cache[vmw_res_surface].res; -+ if (!res) { -+ VMW_DEBUG_USER("Invalid DMA surface.\n"); -+ return -EINVAL; -+ } - -- vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, header); -+ srf = vmw_res_to_srf(res); -+ vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, -+ header); - - return 0; - } -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c -index aaacbdcbd742fb..946f166d6fc765 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c -@@ -326,8 +326,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, - hash_add_rcu(ctx->sw_context->res_ht, &node->hash.head, node->hash.key); - } - node->res = vmw_resource_reference_unless_doomed(res); -- if (!node->res) -+ if (!node->res) { -+ hash_del_rcu(&node->hash.head); - return -ESRCH; -+ } - - node->first_usage = 1; - if (!res->dev_priv->has_mob) { -@@ -654,7 +656,7 @@ void vmw_validation_drop_ht(struct vmw_validation_context *ctx) - hash_del_rcu(&val->hash.head); - - list_for_each_entry(val, &ctx->resource_ctx_list, head) -- hash_del_rcu(&entry->hash.head); -+ hash_del_rcu(&val->hash.head); - - ctx->sw_context = NULL; - } -diff --git a/drivers/iio/adc/xilinx-ams.c b/drivers/iio/adc/xilinx-ams.c -index f52abf759260f2..5de86a953d4182 100644 ---- a/drivers/iio/adc/xilinx-ams.c -+++ b/drivers/iio/adc/xilinx-ams.c -@@ -118,7 +118,7 @@ - #define AMS_ALARM_THRESHOLD_OFF_10 0x10 - #define AMS_ALARM_THRESHOLD_OFF_20 0x20 - --#define AMS_ALARM_THR_DIRECT_MASK BIT(1) -+#define AMS_ALARM_THR_DIRECT_MASK BIT(0) - #define AMS_ALARM_THR_MIN 0x0000 - #define AMS_ALARM_THR_MAX (BIT(16) - 1) - -@@ -385,6 +385,29 @@ static void ams_update_pl_alarm(struct ams *ams, unsigned long alarm_mask) - ams_pl_update_reg(ams, AMS_REG_CONFIG3, AMS_REGCFG3_ALARM_MASK, cfg); - } - -+static void ams_unmask(struct ams *ams) -+{ -+ unsigned int status, unmask; -+ -+ status = readl(ams->base + AMS_ISR_0); -+ -+ /* Clear those bits which are not active anymore */ -+ unmask = (ams->current_masked_alarm ^ status) & ams->current_masked_alarm; -+ -+ /* Clear status of disabled alarm */ -+ unmask |= ams->intr_mask; -+ -+ ams->current_masked_alarm &= status; -+ -+ /* Also clear those which are masked out anyway */ -+ ams->current_masked_alarm &= ~ams->intr_mask; -+ -+ /* Clear the interrupts before we unmask them */ -+ writel(unmask, ams->base + AMS_ISR_0); -+ -+ ams_update_intrmask(ams, ~AMS_ALARM_MASK, ~AMS_ALARM_MASK); -+} -+ - static void ams_update_alarm(struct ams *ams, unsigned long alarm_mask) - { - unsigned long flags; -@@ -397,6 +420,7 @@ static void ams_update_alarm(struct ams *ams, unsigned long alarm_mask) - - spin_lock_irqsave(&ams->intr_lock, flags); - ams_update_intrmask(ams, AMS_ISR0_ALARM_MASK, ~alarm_mask); -+ ams_unmask(ams); - spin_unlock_irqrestore(&ams->intr_lock, flags); - } - -@@ -1025,28 +1049,9 @@ static void ams_handle_events(struct iio_dev *indio_dev, unsigned long events) - static void ams_unmask_worker(struct work_struct *work) - { - struct ams *ams = container_of(work, struct ams, ams_unmask_work.work); -- unsigned int status, unmask; - - spin_lock_irq(&ams->intr_lock); -- -- status = readl(ams->base + AMS_ISR_0); -- -- /* Clear those bits which are not active anymore */ -- unmask = (ams->current_masked_alarm ^ status) & ams->current_masked_alarm; -- -- /* Clear status of disabled alarm */ -- unmask |= ams->intr_mask; -- -- ams->current_masked_alarm &= status; -- -- /* Also clear those which are masked out anyway */ -- ams->current_masked_alarm &= ~ams->intr_mask; -- -- /* Clear the interrupts before we unmask them */ -- writel(unmask, ams->base + AMS_ISR_0); -- -- ams_update_intrmask(ams, ~AMS_ALARM_MASK, ~AMS_ALARM_MASK); -- -+ ams_unmask(ams); - spin_unlock_irq(&ams->intr_lock); - - /* If still pending some alarm re-trigger the timer */ -diff --git a/drivers/iio/dac/ad5360.c b/drivers/iio/dac/ad5360.c -index e0b7f658d61196..cf9cf90cd6e276 100644 ---- a/drivers/iio/dac/ad5360.c -+++ b/drivers/iio/dac/ad5360.c -@@ -262,7 +262,7 @@ static int ad5360_update_ctrl(struct iio_dev *indio_dev, unsigned int set, - unsigned int clr) - { - struct ad5360_state *st = iio_priv(indio_dev); -- unsigned int ret; -+ int ret; - - mutex_lock(&st->lock); - -diff --git a/drivers/iio/dac/ad5421.c b/drivers/iio/dac/ad5421.c -index 7644acfd879e04..9228e3cee1b850 100644 ---- a/drivers/iio/dac/ad5421.c -+++ b/drivers/iio/dac/ad5421.c -@@ -186,7 +186,7 @@ static int ad5421_update_ctrl(struct iio_dev *indio_dev, unsigned int set, - unsigned int clr) - { - struct ad5421_state *st = iio_priv(indio_dev); -- unsigned int ret; -+ int ret; - - mutex_lock(&st->lock); - -diff --git a/drivers/iio/frequency/adf4350.c b/drivers/iio/frequency/adf4350.c -index 4abf80f75ef5d9..03e75261e891fe 100644 ---- a/drivers/iio/frequency/adf4350.c -+++ b/drivers/iio/frequency/adf4350.c -@@ -143,6 +143,19 @@ static int adf4350_set_freq(struct adf4350_state *st, unsigned long long freq) - if (freq > ADF4350_MAX_OUT_FREQ || freq < st->min_out_freq) - return -EINVAL; - -+ st->r4_rf_div_sel = 0; -+ -+ /* -+ * !\TODO: The below computation is making sure we get a power of 2 -+ * shift (st->r4_rf_div_sel) so that freq becomes higher or equal to -+ * ADF4350_MIN_VCO_FREQ. This might be simplified with fls()/fls_long() -+ * and friends. -+ */ -+ while (freq < ADF4350_MIN_VCO_FREQ) { -+ freq <<= 1; -+ st->r4_rf_div_sel++; -+ } -+ - if (freq > ADF4350_MAX_FREQ_45_PRESC) { - prescaler = ADF4350_REG1_PRESCALER; - mdiv = 75; -@@ -151,13 +164,6 @@ static int adf4350_set_freq(struct adf4350_state *st, unsigned long long freq) - mdiv = 23; - } - -- st->r4_rf_div_sel = 0; -- -- while (freq < ADF4350_MIN_VCO_FREQ) { -- freq <<= 1; -- st->r4_rf_div_sel++; -- } -- - /* - * Allow a predefined reference division factor - * if not set, compute our own -diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c -index 91c181bb92869d..a1f055014cc652 100644 ---- a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c -+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c -@@ -747,10 +747,6 @@ static int inv_icm42600_resume(struct device *dev) - if (ret) - goto out_unlock; - -- pm_runtime_disable(dev); -- pm_runtime_set_active(dev); -- pm_runtime_enable(dev); -- - /* restore sensors state */ - ret = inv_icm42600_set_pwr_mgmt0(st, st->suspended.gyro, - st->suspended.accel, -diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c -index 88bccdbb0bed08..ac7b8fb36db8fb 100644 ---- a/drivers/iommu/intel/iommu.c -+++ b/drivers/iommu/intel/iommu.c -@@ -4415,7 +4415,7 @@ static struct iommu_device *intel_iommu_probe_device(struct device *dev) - } - - if (info->ats_supported && ecap_prs(iommu->ecap) && -- pci_pri_supported(pdev)) -+ ecap_pds(iommu->ecap) && pci_pri_supported(pdev)) - info->pri_supported = 1; - } - } -diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c -index 57289966915492..2d20cf9d84cead 100644 ---- a/drivers/irqchip/irq-sifive-plic.c -+++ b/drivers/irqchip/irq-sifive-plic.c -@@ -248,11 +248,11 @@ static int plic_irq_suspend(void) - - priv = per_cpu_ptr(&plic_handlers, smp_processor_id())->priv; - -- for (i = 0; i < priv->nr_irqs; i++) -- if (readl(priv->regs + PRIORITY_BASE + i * PRIORITY_PER_ID)) -- __set_bit(i, priv->prio_save); -- else -- __clear_bit(i, priv->prio_save); -+ /* irq ID 0 is reserved */ -+ for (i = 1; i < priv->nr_irqs; i++) { -+ __assign_bit(i, priv->prio_save, -+ readl(priv->regs + PRIORITY_BASE + i * PRIORITY_PER_ID)); -+ } - - for_each_cpu(cpu, cpu_present_mask) { - struct plic_handler *handler = per_cpu_ptr(&plic_handlers, cpu); -@@ -279,7 +279,8 @@ static void plic_irq_resume(void) - - priv = per_cpu_ptr(&plic_handlers, smp_processor_id())->priv; - -- for (i = 0; i < priv->nr_irqs; i++) { -+ /* irq ID 0 is reserved */ -+ for (i = 1; i < priv->nr_irqs; i++) { - index = BIT_WORD(i); - writel((priv->prio_save[index] & BIT_MASK(i)) ? 1 : 0, - priv->regs + PRIORITY_BASE + i * PRIORITY_PER_ID); -diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c -index e4fcac97dbfaa0..90f248ef2a1fcc 100644 ---- a/drivers/mailbox/zynqmp-ipi-mailbox.c -+++ b/drivers/mailbox/zynqmp-ipi-mailbox.c -@@ -616,11 +616,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) - i = pdata->num_mboxes; - for (; i >= 0; i--) { - ipi_mbox = &pdata->ipi_mboxes[i]; -- if (ipi_mbox->dev.parent) { -- mbox_controller_unregister(&ipi_mbox->mbox); -- if (device_is_registered(&ipi_mbox->dev)) -- device_unregister(&ipi_mbox->dev); -- } -+ if (device_is_registered(&ipi_mbox->dev)) -+ device_unregister(&ipi_mbox->dev); - } - } - -diff --git a/drivers/media/i2c/mt9v111.c b/drivers/media/i2c/mt9v111.c -index 1f7edc0f5b1abe..a184fd9fc6f3b3 100644 ---- a/drivers/media/i2c/mt9v111.c -+++ b/drivers/media/i2c/mt9v111.c -@@ -534,8 +534,8 @@ static int mt9v111_calc_frame_rate(struct mt9v111_dev *mt9v111, - static int mt9v111_hw_config(struct mt9v111_dev *mt9v111) - { - struct i2c_client *c = mt9v111->client; -- unsigned int ret; - u16 outfmtctrl2; -+ int ret; - - /* Force device reset. */ - ret = __mt9v111_hw_reset(mt9v111); -diff --git a/drivers/media/mc/mc-devnode.c b/drivers/media/mc/mc-devnode.c -index 94abd042045dab..6fd8885f5928e4 100644 ---- a/drivers/media/mc/mc-devnode.c -+++ b/drivers/media/mc/mc-devnode.c -@@ -50,11 +50,6 @@ static void media_devnode_release(struct device *cd) - { - struct media_devnode *devnode = to_media_devnode(cd); - -- mutex_lock(&media_devnode_lock); -- /* Mark device node number as free */ -- clear_bit(devnode->minor, media_devnode_nums); -- mutex_unlock(&media_devnode_lock); -- - /* Release media_devnode and perform other cleanups as needed. */ - if (devnode->release) - devnode->release(devnode); -@@ -283,6 +278,7 @@ void media_devnode_unregister(struct media_devnode *devnode) - /* Delete the cdev on this minor as well */ - cdev_device_del(&devnode->cdev, &devnode->dev); - devnode->media_dev = NULL; -+ clear_bit(devnode->minor, media_devnode_nums); - mutex_unlock(&media_devnode_lock); - - put_device(&devnode->dev); -diff --git a/drivers/media/mc/mc-entity.c b/drivers/media/mc/mc-entity.c -index 951b79ca125cdd..f885e718524c22 100644 ---- a/drivers/media/mc/mc-entity.c -+++ b/drivers/media/mc/mc-entity.c -@@ -678,7 +678,7 @@ static int media_pipeline_explore_next_link(struct media_pipeline *pipe, - * (already discovered through iterating over links) and pads - * not internally connected. - */ -- if (origin == local || !local->num_links || -+ if (origin == local || local->num_links || - !media_entity_has_pad_interdep(origin->entity, origin->index, - local->index)) - continue; -diff --git a/drivers/media/pci/cx18/cx18-queue.c b/drivers/media/pci/cx18/cx18-queue.c -index 013694bfcb1c1b..7cbb2d5869320b 100644 ---- a/drivers/media/pci/cx18/cx18-queue.c -+++ b/drivers/media/pci/cx18/cx18-queue.c -@@ -379,15 +379,22 @@ int cx18_stream_alloc(struct cx18_stream *s) - break; - } - -+ buf->dma_handle = dma_map_single(&s->cx->pci_dev->dev, -+ buf->buf, s->buf_size, -+ s->dma); -+ if (dma_mapping_error(&s->cx->pci_dev->dev, buf->dma_handle)) { -+ kfree(buf->buf); -+ kfree(mdl); -+ kfree(buf); -+ break; -+ } -+ - INIT_LIST_HEAD(&mdl->list); - INIT_LIST_HEAD(&mdl->buf_list); - mdl->id = s->mdl_base_idx; /* a somewhat safe value */ - cx18_enqueue(s, mdl, &s->q_idle); - - INIT_LIST_HEAD(&buf->list); -- buf->dma_handle = dma_map_single(&s->cx->pci_dev->dev, -- buf->buf, s->buf_size, -- s->dma); - cx18_buf_sync_for_cpu(s, buf); - list_add_tail(&buf->list, &s->buf_pool); - } -diff --git a/drivers/media/pci/ivtv/ivtv-irq.c b/drivers/media/pci/ivtv/ivtv-irq.c -index b7aaa8b4a7841d..e39bf64c5c715b 100644 ---- a/drivers/media/pci/ivtv/ivtv-irq.c -+++ b/drivers/media/pci/ivtv/ivtv-irq.c -@@ -351,7 +351,7 @@ void ivtv_dma_stream_dec_prepare(struct ivtv_stream *s, u32 offset, int lock) - - /* Insert buffer block for YUV if needed */ - if (s->type == IVTV_DEC_STREAM_TYPE_YUV && f->offset_y) { -- if (yi->blanking_dmaptr) { -+ if (yi->blanking_ptr) { - s->sg_pending[idx].src = yi->blanking_dmaptr; - s->sg_pending[idx].dst = offset; - s->sg_pending[idx].size = 720 * 16; -diff --git a/drivers/media/pci/ivtv/ivtv-yuv.c b/drivers/media/pci/ivtv/ivtv-yuv.c -index 2d9274537725af..71f0401066471a 100644 ---- a/drivers/media/pci/ivtv/ivtv-yuv.c -+++ b/drivers/media/pci/ivtv/ivtv-yuv.c -@@ -125,7 +125,7 @@ static int ivtv_yuv_prep_user_dma(struct ivtv *itv, struct ivtv_user_dma *dma, - ivtv_udma_fill_sg_array(dma, y_buffer_offset, uv_buffer_offset, y_size); - - /* If we've offset the y plane, ensure top area is blanked */ -- if (f->offset_y && yi->blanking_dmaptr) { -+ if (f->offset_y && yi->blanking_ptr) { - dma->SGarray[dma->SG_length].size = cpu_to_le32(720*16); - dma->SGarray[dma->SG_length].src = cpu_to_le32(yi->blanking_dmaptr); - dma->SGarray[dma->SG_length].dst = cpu_to_le32(IVTV_DECODER_OFFSET + yuv_offset[frame]); -@@ -929,6 +929,12 @@ static void ivtv_yuv_init(struct ivtv *itv) - yi->blanking_dmaptr = dma_map_single(&itv->pdev->dev, - yi->blanking_ptr, - 720 * 16, DMA_TO_DEVICE); -+ if (dma_mapping_error(&itv->pdev->dev, yi->blanking_dmaptr)) { -+ kfree(yi->blanking_ptr); -+ yi->blanking_ptr = NULL; -+ yi->blanking_dmaptr = 0; -+ IVTV_DEBUG_WARN("Failed to dma_map yuv blanking buffer\n"); -+ } - } else { - yi->blanking_dmaptr = 0; - IVTV_DEBUG_WARN("Failed to allocate yuv blanking buffer\n"); -diff --git a/drivers/media/platform/qcom/venus/firmware.c b/drivers/media/platform/qcom/venus/firmware.c -index fe7da2b3048299..01461b2fed51d8 100644 ---- a/drivers/media/platform/qcom/venus/firmware.c -+++ b/drivers/media/platform/qcom/venus/firmware.c -@@ -30,7 +30,7 @@ static void venus_reset_cpu(struct venus_core *core) - u32 fw_size = core->fw.mapped_mem_size; - void __iomem *wrapper_base; - -- if (IS_IRIS2_1(core)) -+ if (IS_IRIS2(core) || IS_IRIS2_1(core)) - wrapper_base = core->wrapper_tz_base; - else - wrapper_base = core->wrapper_base; -@@ -42,7 +42,7 @@ static void venus_reset_cpu(struct venus_core *core) - writel(fw_size, wrapper_base + WRAPPER_NONPIX_START_ADDR); - writel(fw_size, wrapper_base + WRAPPER_NONPIX_END_ADDR); - -- if (IS_IRIS2_1(core)) { -+ if (IS_IRIS2(core) || IS_IRIS2_1(core)) { - /* Bring XTSS out of reset */ - writel(0, wrapper_base + WRAPPER_TZ_XTSS_SW_RESET); - } else { -@@ -68,7 +68,7 @@ int venus_set_hw_state(struct venus_core *core, bool resume) - if (resume) { - venus_reset_cpu(core); - } else { -- if (IS_IRIS2_1(core)) -+ if (IS_IRIS2(core) || IS_IRIS2_1(core)) - writel(WRAPPER_XTSS_SW_RESET_BIT, - core->wrapper_tz_base + WRAPPER_TZ_XTSS_SW_RESET); - else -@@ -181,7 +181,7 @@ static int venus_shutdown_no_tz(struct venus_core *core) - void __iomem *wrapper_base = core->wrapper_base; - void __iomem *wrapper_tz_base = core->wrapper_tz_base; - -- if (IS_IRIS2_1(core)) { -+ if (IS_IRIS2(core) || IS_IRIS2_1(core)) { - /* Assert the reset to XTSS */ - reg = readl(wrapper_tz_base + WRAPPER_TZ_XTSS_SW_RESET); - reg |= WRAPPER_XTSS_SW_RESET_BIT; -diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c -index f8901d6fbe9bf1..ff3088691d5e18 100644 ---- a/drivers/media/rc/lirc_dev.c -+++ b/drivers/media/rc/lirc_dev.c -@@ -735,11 +735,11 @@ int lirc_register(struct rc_dev *dev) - - cdev_init(&dev->lirc_cdev, &lirc_fops); - -+ get_device(&dev->dev); -+ - err = cdev_device_add(&dev->lirc_cdev, &dev->lirc_dev); - if (err) -- goto out_ida; -- -- get_device(&dev->dev); -+ goto out_put_device; - - switch (dev->driver_type) { - case RC_DRIVER_SCANCODE: -@@ -763,7 +763,8 @@ int lirc_register(struct rc_dev *dev) - - return 0; - --out_ida: -+out_put_device: -+ put_device(&dev->lirc_dev); - ida_free(&lirc_ida, minor); - return err; - } -diff --git a/drivers/memory/samsung/exynos-srom.c b/drivers/memory/samsung/exynos-srom.c -index e73dd330af477d..d913fb901973f0 100644 ---- a/drivers/memory/samsung/exynos-srom.c -+++ b/drivers/memory/samsung/exynos-srom.c -@@ -121,20 +121,18 @@ static int exynos_srom_probe(struct platform_device *pdev) - return -ENOMEM; - - srom->dev = dev; -- srom->reg_base = of_iomap(np, 0); -- if (!srom->reg_base) { -+ srom->reg_base = devm_platform_ioremap_resource(pdev, 0); -+ if (IS_ERR(srom->reg_base)) { - dev_err(&pdev->dev, "iomap of exynos srom controller failed\n"); -- return -ENOMEM; -+ return PTR_ERR(srom->reg_base); - } - - platform_set_drvdata(pdev, srom); - - srom->reg_offset = exynos_srom_alloc_reg_dump(exynos_srom_offsets, - ARRAY_SIZE(exynos_srom_offsets)); -- if (!srom->reg_offset) { -- iounmap(srom->reg_base); -+ if (!srom->reg_offset) - return -ENOMEM; -- } - - for_each_child_of_node(np, child) { - if (exynos_srom_configure_bank(srom, child)) { -diff --git a/drivers/mfd/intel_soc_pmic_chtdc_ti.c b/drivers/mfd/intel_soc_pmic_chtdc_ti.c -index 992855bfda3e47..6daf33e07ea0a8 100644 ---- a/drivers/mfd/intel_soc_pmic_chtdc_ti.c -+++ b/drivers/mfd/intel_soc_pmic_chtdc_ti.c -@@ -81,8 +81,9 @@ static struct mfd_cell chtdc_ti_dev[] = { - static const struct regmap_config chtdc_ti_regmap_config = { - .reg_bits = 8, - .val_bits = 8, -- .max_register = 128, -- .cache_type = REGCACHE_NONE, -+ .max_register = 0xff, -+ /* The hardware does not support reading multiple registers at once */ -+ .use_single_read = true, - }; - - static const struct regmap_irq chtdc_ti_irqs[] = { -diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c -index 5e03a6ba55711a..a85442d74e0928 100644 ---- a/drivers/misc/fastrpc.c -+++ b/drivers/misc/fastrpc.c -@@ -322,11 +322,11 @@ static void fastrpc_free_map(struct kref *ref) - - perm.vmid = QCOM_SCM_VMID_HLOS; - perm.perm = QCOM_SCM_PERM_RWX; -- err = qcom_scm_assign_mem(map->phys, map->size, -+ err = qcom_scm_assign_mem(map->phys, map->len, - &src_perms, &perm, 1); - if (err) { -- dev_err(map->fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d", -- map->phys, map->size, err); -+ dev_err(map->fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d\n", -+ map->phys, map->len, err); - return; - } - } -@@ -752,7 +752,8 @@ static int fastrpc_map_attach(struct fastrpc_user *fl, int fd, - struct fastrpc_session_ctx *sess = fl->sctx; - struct fastrpc_map *map = NULL; - struct sg_table *table; -- int err = 0; -+ struct scatterlist *sgl = NULL; -+ int err = 0, sgl_index = 0; - - map = kzalloc(sizeof(*map), GFP_KERNEL); - if (!map) -@@ -789,7 +790,15 @@ static int fastrpc_map_attach(struct fastrpc_user *fl, int fd, - map->phys = sg_dma_address(map->table->sgl); - map->phys += ((u64)fl->sctx->sid << 32); - } -- map->size = len; -+ for_each_sg(map->table->sgl, sgl, map->table->nents, -+ sgl_index) -+ map->size += sg_dma_len(sgl); -+ if (len > map->size) { -+ dev_dbg(sess->dev, "Bad size passed len 0x%llx map size 0x%llx\n", -+ len, map->size); -+ err = -EINVAL; -+ goto map_err; -+ } - map->va = sg_virt(map->table->sgl); - map->len = len; - -@@ -806,10 +815,10 @@ static int fastrpc_map_attach(struct fastrpc_user *fl, int fd, - dst_perms[1].vmid = fl->cctx->vmperms[0].vmid; - dst_perms[1].perm = QCOM_SCM_PERM_RWX; - map->attr = attr; -- err = qcom_scm_assign_mem(map->phys, (u64)map->size, &src_perms, dst_perms, 2); -+ err = qcom_scm_assign_mem(map->phys, (u64)map->len, &src_perms, dst_perms, 2); - if (err) { -- dev_err(sess->dev, "Failed to assign memory with phys 0x%llx size 0x%llx err %d", -- map->phys, map->size, err); -+ dev_err(sess->dev, "Failed to assign memory with phys 0x%llx size 0x%llx err %d\n", -+ map->phys, map->len, err); - goto map_err; - } - } -@@ -1240,7 +1249,7 @@ static bool is_session_rejected(struct fastrpc_user *fl, bool unsigned_pd_reques - * that does not support unsigned PD offload - */ - if (!fl->cctx->unsigned_support || !unsigned_pd_request) { -- dev_err(&fl->cctx->rpdev->dev, "Error: Untrusted application trying to offload to signed PD"); -+ dev_err(&fl->cctx->rpdev->dev, "Error: Untrusted application trying to offload to signed PD\n"); - return true; - } - } -@@ -1304,7 +1313,7 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, - &src_perms, - fl->cctx->vmperms, fl->cctx->vmcount); - if (err) { -- dev_err(fl->sctx->dev, "Failed to assign memory with phys 0x%llx size 0x%llx err %d", -+ dev_err(fl->sctx->dev, "Failed to assign memory with phys 0x%llx size 0x%llx err %d\n", - fl->cctx->remote_heap->phys, fl->cctx->remote_heap->size, err); - goto err_map; - } -@@ -1358,7 +1367,7 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, - (u64)fl->cctx->remote_heap->size, - &src_perms, &dst_perms, 1); - if (err) -- dev_err(fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d", -+ dev_err(fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d\n", - fl->cctx->remote_heap->phys, fl->cctx->remote_heap->size, err); - } - err_map: -@@ -2063,7 +2072,7 @@ static int fastrpc_req_mem_map(struct fastrpc_user *fl, char __user *argp) - args[0].length = sizeof(req_msg); - - pages.addr = map->phys; -- pages.size = map->size; -+ pages.size = map->len; - - args[1].ptr = (u64) (uintptr_t) &pages; - args[1].length = sizeof(pages); -@@ -2078,7 +2087,7 @@ static int fastrpc_req_mem_map(struct fastrpc_user *fl, char __user *argp) - err = fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE, sc, &args[0]); - if (err) { - dev_err(dev, "mem mmap error, fd %d, vaddr %llx, size %lld\n", -- req.fd, req.vaddrin, map->size); -+ req.fd, req.vaddrin, map->len); - goto err_invoke; - } - -@@ -2091,7 +2100,7 @@ static int fastrpc_req_mem_map(struct fastrpc_user *fl, char __user *argp) - if (copy_to_user((void __user *)argp, &req, sizeof(req))) { - /* unmap the memory and release the buffer */ - req_unmap.vaddr = (uintptr_t) rsp_msg.vaddr; -- req_unmap.length = map->size; -+ req_unmap.length = map->len; - fastrpc_req_mem_unmap_impl(fl, &req_unmap); - return -EFAULT; - } -diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c -index cb87e827377934..2c58df6855f2a5 100644 ---- a/drivers/mmc/core/sdio.c -+++ b/drivers/mmc/core/sdio.c -@@ -945,7 +945,11 @@ static void mmc_sdio_remove(struct mmc_host *host) - */ - static int mmc_sdio_alive(struct mmc_host *host) - { -- return mmc_select_card(host->card); -+ if (!mmc_host_is_spi(host)) -+ return mmc_select_card(host->card); -+ else -+ return mmc_io_rw_direct(host->card, 0, 0, SDIO_CCCR_CCCR, 0, -+ NULL); - } - - /* -diff --git a/drivers/mtd/nand/raw/fsmc_nand.c b/drivers/mtd/nand/raw/fsmc_nand.c -index fe5912d31beea4..b0a70badf3eb77 100644 ---- a/drivers/mtd/nand/raw/fsmc_nand.c -+++ b/drivers/mtd/nand/raw/fsmc_nand.c -@@ -876,10 +876,14 @@ static int fsmc_nand_probe_config_dt(struct platform_device *pdev, - if (!of_property_read_u32(np, "bank-width", &val)) { - if (val == 2) { - nand->options |= NAND_BUSWIDTH_16; -- } else if (val != 1) { -+ } else if (val == 1) { -+ nand->options |= NAND_BUSWIDTH_AUTO; -+ } else { - dev_err(&pdev->dev, "invalid bank-width %u\n", val); - return -EINVAL; - } -+ } else { -+ nand->options |= NAND_BUSWIDTH_AUTO; - } - - if (of_property_read_bool(np, "nand-skip-bbtscan")) -diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c -index eee675a25b2c3c..ef9adecb639aec 100644 ---- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c -+++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c -@@ -483,10 +483,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev) - "missing 'reg' property in node %pOF\n", - tbi); - err = -EBUSY; -+ of_node_put(tbi); - goto error; - } - set_tbipa(*prop, pdev, - data->get_tbipa, priv->map, &res); -+ of_node_put(tbi); - } - } - -diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c -index 33bbcced81059a..275561272721e4 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c -+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c -@@ -1177,9 +1177,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv, - mlx4_unregister_mac(mdev->dev, priv->port, mac); - - hlist_del_rcu(&entry->hlist); -- kfree_rcu(entry, rcu); - en_dbg(DRV, priv, "Removed MAC %pM on port:%d\n", - entry->mac, priv->port); -+ kfree_rcu(entry, rcu); - ++removed; - } - } -diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c -index 0e8ff839cae234..3a340cb2b205f4 100644 ---- a/drivers/net/wireless/ath/ath11k/core.c -+++ b/drivers/net/wireless/ath/ath11k/core.c -@@ -1763,14 +1763,10 @@ static int ath11k_core_reconfigure_on_crash(struct ath11k_base *ab) - mutex_unlock(&ab->core_lock); - - ath11k_dp_free(ab); -- ath11k_hal_srng_deinit(ab); -+ ath11k_hal_srng_clear(ab); - - ab->free_vdev_map = (1LL << (ab->num_radios * TARGET_NUM_VDEVS(ab))) - 1; - -- ret = ath11k_hal_srng_init(ab); -- if (ret) -- return ret; -- - clear_bit(ATH11K_FLAG_CRASH_FLUSH, &ab->dev_flags); - - ret = ath11k_core_qmi_firmware_ready(ab); -diff --git a/drivers/net/wireless/ath/ath11k/hal.c b/drivers/net/wireless/ath/ath11k/hal.c -index 1215408d1a6abb..79cf65bc2e1724 100644 ---- a/drivers/net/wireless/ath/ath11k/hal.c -+++ b/drivers/net/wireless/ath/ath11k/hal.c -@@ -1356,6 +1356,22 @@ void ath11k_hal_srng_deinit(struct ath11k_base *ab) - } - EXPORT_SYMBOL(ath11k_hal_srng_deinit); - -+void ath11k_hal_srng_clear(struct ath11k_base *ab) -+{ -+ /* No need to memset rdp and wrp memory since each individual -+ * segment would get cleared in ath11k_hal_srng_src_hw_init() -+ * and ath11k_hal_srng_dst_hw_init(). -+ */ -+ memset(ab->hal.srng_list, 0, -+ sizeof(ab->hal.srng_list)); -+ memset(ab->hal.shadow_reg_addr, 0, -+ sizeof(ab->hal.shadow_reg_addr)); -+ ab->hal.avail_blk_resource = 0; -+ ab->hal.current_blk_index = 0; -+ ab->hal.num_shadow_reg_configured = 0; -+} -+EXPORT_SYMBOL(ath11k_hal_srng_clear); -+ - void ath11k_hal_dump_srng_stats(struct ath11k_base *ab) - { - struct hal_srng *srng; -diff --git a/drivers/net/wireless/ath/ath11k/hal.h b/drivers/net/wireless/ath/ath11k/hal.h -index 80447f488954a8..aa21eb1fdce159 100644 ---- a/drivers/net/wireless/ath/ath11k/hal.h -+++ b/drivers/net/wireless/ath/ath11k/hal.h -@@ -962,6 +962,7 @@ int ath11k_hal_srng_setup(struct ath11k_base *ab, enum hal_ring_type type, - struct hal_srng_params *params); - int ath11k_hal_srng_init(struct ath11k_base *ath11k); - void ath11k_hal_srng_deinit(struct ath11k_base *ath11k); -+void ath11k_hal_srng_clear(struct ath11k_base *ab); - void ath11k_hal_dump_srng_stats(struct ath11k_base *ab); - void ath11k_hal_srng_get_shadow_config(struct ath11k_base *ab, - u32 **cfg, u32 *len); -diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/usb.c b/drivers/net/wireless/mediatek/mt76/mt7921/usb.c -index 13e892d788b277..92281811103ef9 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7921/usb.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7921/usb.c -@@ -21,6 +21,9 @@ static const struct usb_device_id mt7921u_device_table[] = { - /* Netgear, Inc. [A8000,AXE3000] */ - { USB_DEVICE_AND_INTERFACE_INFO(0x0846, 0x9060, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)MT7921_FIRMWARE_WM }, -+ /* Netgear, Inc. A7500 */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x0846, 0x9065, 0xff, 0xff, 0xff), -+ .driver_info = (kernel_ulong_t)MT7921_FIRMWARE_WM }, - /* TP-Link TXE50UH */ - { USB_DEVICE_AND_INTERFACE_INFO(0x35bc, 0x0107, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)MT7921_FIRMWARE_WM }, -diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c -index 136dba6221d86a..053385c84bf848 100644 ---- a/drivers/nvme/host/pci.c -+++ b/drivers/nvme/host/pci.c -@@ -2986,10 +2986,12 @@ static unsigned long check_vendor_combination_bug(struct pci_dev *pdev) - * Exclude Samsung 990 Evo from NVME_QUIRK_SIMPLE_SUSPEND - * because of high power consumption (> 2 Watt) in s2idle - * sleep. Only some boards with Intel CPU are affected. -+ * (Note for testing: Samsung 990 Evo Plus has same PCI ID) - */ - if (dmi_match(DMI_BOARD_NAME, "DN50Z-140HC-YD") || - dmi_match(DMI_BOARD_NAME, "GMxPXxx") || - dmi_match(DMI_BOARD_NAME, "GXxMRXx") || -+ dmi_match(DMI_BOARD_NAME, "NS5X_NS7XAU") || - dmi_match(DMI_BOARD_NAME, "PH4PG31") || - dmi_match(DMI_BOARD_NAME, "PH4PRX1_PH6PRX1") || - dmi_match(DMI_BOARD_NAME, "PH6PG01_PH6PG71")) -diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c -index 5bfec440b4fd70..aae4e8ef9e3654 100644 ---- a/drivers/of/unittest.c -+++ b/drivers/of/unittest.c -@@ -3957,6 +3957,7 @@ static int of_unittest_pci_node_verify(struct pci_dev *pdev, bool add) - unittest(!np, "Child device tree node is not removed\n"); - child_dev = device_find_any_child(&pdev->dev); - unittest(!child_dev, "Child device is not removed\n"); -+ put_device(child_dev); - } - - failed: -diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c -index bf9a961c9f2766..9055ce34c636bd 100644 ---- a/drivers/pci/controller/dwc/pci-keystone.c -+++ b/drivers/pci/controller/dwc/pci-keystone.c -@@ -1213,8 +1213,8 @@ static int ks_pcie_probe(struct platform_device *pdev) - if (irq < 0) - return irq; - -- ret = request_irq(irq, ks_pcie_err_irq_handler, IRQF_SHARED, -- "ks-pcie-error-irq", ks_pcie); -+ ret = devm_request_irq(dev, irq, ks_pcie_err_irq_handler, IRQF_SHARED, -+ "ks-pcie-error-irq", ks_pcie); - if (ret < 0) { - dev_err(dev, "failed to request error IRQ %d\n", - irq); -diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c -index 115a21cf869ae6..c7d3e248a59a20 100644 ---- a/drivers/pci/controller/dwc/pcie-tegra194.c -+++ b/drivers/pci/controller/dwc/pcie-tegra194.c -@@ -1218,6 +1218,7 @@ static int tegra_pcie_bpmp_set_ctrl_state(struct tegra_pcie_dw *pcie, - struct mrq_uphy_response resp; - struct tegra_bpmp_message msg; - struct mrq_uphy_request req; -+ int err; - - /* - * Controller-5 doesn't need to have its state set by BPMP-FW in -@@ -1240,7 +1241,13 @@ static int tegra_pcie_bpmp_set_ctrl_state(struct tegra_pcie_dw *pcie, - msg.rx.data = &resp; - msg.rx.size = sizeof(resp); - -- return tegra_bpmp_transfer(pcie->bpmp, &msg); -+ err = tegra_bpmp_transfer(pcie->bpmp, &msg); -+ if (err) -+ return err; -+ if (msg.rx.ret) -+ return -EINVAL; -+ -+ return 0; - } - - static int tegra_pcie_bpmp_set_pll_state(struct tegra_pcie_dw *pcie, -@@ -1249,6 +1256,7 @@ static int tegra_pcie_bpmp_set_pll_state(struct tegra_pcie_dw *pcie, - struct mrq_uphy_response resp; - struct tegra_bpmp_message msg; - struct mrq_uphy_request req; -+ int err; - - memset(&req, 0, sizeof(req)); - memset(&resp, 0, sizeof(resp)); -@@ -1268,7 +1276,13 @@ static int tegra_pcie_bpmp_set_pll_state(struct tegra_pcie_dw *pcie, - msg.rx.data = &resp; - msg.rx.size = sizeof(resp); - -- return tegra_bpmp_transfer(pcie->bpmp, &msg); -+ err = tegra_bpmp_transfer(pcie->bpmp, &msg); -+ if (err) -+ return err; -+ if (msg.rx.ret) -+ return -EINVAL; -+ -+ return 0; - } - - static void tegra_pcie_downstream_dev_to_D0(struct tegra_pcie_dw *pcie) -@@ -1963,10 +1977,10 @@ static int tegra_pcie_ep_raise_legacy_irq(struct tegra_pcie_dw *pcie, u16 irq) - - static int tegra_pcie_ep_raise_msi_irq(struct tegra_pcie_dw *pcie, u16 irq) - { -- if (unlikely(irq > 31)) -+ if (unlikely(irq > 32)) - return -EINVAL; - -- appl_writel(pcie, BIT(irq), APPL_MSI_CTRL_1); -+ appl_writel(pcie, BIT(irq - 1), APPL_MSI_CTRL_1); - - return 0; - } -diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c -index 80d975dcb2ee27..da37569460b1ad 100644 ---- a/drivers/pci/controller/pci-tegra.c -+++ b/drivers/pci/controller/pci-tegra.c -@@ -14,6 +14,7 @@ - */ - - #include -+#include - #include - #include - #include -@@ -269,7 +270,7 @@ struct tegra_msi { - DECLARE_BITMAP(used, INT_PCI_MSI_NR); - struct irq_domain *domain; - struct mutex map_lock; -- spinlock_t mask_lock; -+ raw_spinlock_t mask_lock; - void *virt; - dma_addr_t phys; - int irq; -@@ -1604,14 +1605,13 @@ static void tegra_msi_irq_mask(struct irq_data *d) - struct tegra_msi *msi = irq_data_get_irq_chip_data(d); - struct tegra_pcie *pcie = msi_to_pcie(msi); - unsigned int index = d->hwirq / 32; -- unsigned long flags; - u32 value; - -- spin_lock_irqsave(&msi->mask_lock, flags); -- value = afi_readl(pcie, AFI_MSI_EN_VEC(index)); -- value &= ~BIT(d->hwirq % 32); -- afi_writel(pcie, value, AFI_MSI_EN_VEC(index)); -- spin_unlock_irqrestore(&msi->mask_lock, flags); -+ scoped_guard(raw_spinlock_irqsave, &msi->mask_lock) { -+ value = afi_readl(pcie, AFI_MSI_EN_VEC(index)); -+ value &= ~BIT(d->hwirq % 32); -+ afi_writel(pcie, value, AFI_MSI_EN_VEC(index)); -+ } - } - - static void tegra_msi_irq_unmask(struct irq_data *d) -@@ -1619,14 +1619,13 @@ static void tegra_msi_irq_unmask(struct irq_data *d) - struct tegra_msi *msi = irq_data_get_irq_chip_data(d); - struct tegra_pcie *pcie = msi_to_pcie(msi); - unsigned int index = d->hwirq / 32; -- unsigned long flags; - u32 value; - -- spin_lock_irqsave(&msi->mask_lock, flags); -- value = afi_readl(pcie, AFI_MSI_EN_VEC(index)); -- value |= BIT(d->hwirq % 32); -- afi_writel(pcie, value, AFI_MSI_EN_VEC(index)); -- spin_unlock_irqrestore(&msi->mask_lock, flags); -+ scoped_guard(raw_spinlock_irqsave, &msi->mask_lock) { -+ value = afi_readl(pcie, AFI_MSI_EN_VEC(index)); -+ value |= BIT(d->hwirq % 32); -+ afi_writel(pcie, value, AFI_MSI_EN_VEC(index)); -+ } - } - - static int tegra_msi_set_affinity(struct irq_data *d, const struct cpumask *mask, bool force) -@@ -1742,7 +1741,7 @@ static int tegra_pcie_msi_setup(struct tegra_pcie *pcie) - int err; - - mutex_init(&msi->map_lock); -- spin_lock_init(&msi->mask_lock); -+ raw_spin_lock_init(&msi->mask_lock); - - if (IS_ENABLED(CONFIG_PCI_MSI)) { - err = tegra_allocate_domains(msi); -diff --git a/drivers/pci/controller/pcie-rcar-host.c b/drivers/pci/controller/pcie-rcar-host.c -index 704ab5d723a959..77f6366e7db107 100644 ---- a/drivers/pci/controller/pcie-rcar-host.c -+++ b/drivers/pci/controller/pcie-rcar-host.c -@@ -12,6 +12,7 @@ - */ - - #include -+#include - #include - #include - #include -@@ -36,7 +37,7 @@ struct rcar_msi { - DECLARE_BITMAP(used, INT_PCI_MSI_NR); - struct irq_domain *domain; - struct mutex map_lock; -- spinlock_t mask_lock; -+ raw_spinlock_t mask_lock; - int irq1; - int irq2; - }; -@@ -50,20 +51,13 @@ struct rcar_pcie_host { - int (*phy_init_fn)(struct rcar_pcie_host *host); - }; - --static DEFINE_SPINLOCK(pmsr_lock); -- - static int rcar_pcie_wakeup(struct device *pcie_dev, void __iomem *pcie_base) - { -- unsigned long flags; - u32 pmsr, val; - int ret = 0; - -- spin_lock_irqsave(&pmsr_lock, flags); -- -- if (!pcie_base || pm_runtime_suspended(pcie_dev)) { -- ret = -EINVAL; -- goto unlock_exit; -- } -+ if (!pcie_base || pm_runtime_suspended(pcie_dev)) -+ return -EINVAL; - - pmsr = readl(pcie_base + PMSR); - -@@ -85,8 +79,6 @@ static int rcar_pcie_wakeup(struct device *pcie_dev, void __iomem *pcie_base) - writel(L1FAEG | PMEL1RX, pcie_base + PMSR); - } - --unlock_exit: -- spin_unlock_irqrestore(&pmsr_lock, flags); - return ret; - } - -@@ -633,28 +625,26 @@ static void rcar_msi_irq_mask(struct irq_data *d) - { - struct rcar_msi *msi = irq_data_get_irq_chip_data(d); - struct rcar_pcie *pcie = &msi_to_host(msi)->pcie; -- unsigned long flags; - u32 value; - -- spin_lock_irqsave(&msi->mask_lock, flags); -- value = rcar_pci_read_reg(pcie, PCIEMSIIER); -- value &= ~BIT(d->hwirq); -- rcar_pci_write_reg(pcie, value, PCIEMSIIER); -- spin_unlock_irqrestore(&msi->mask_lock, flags); -+ scoped_guard(raw_spinlock_irqsave, &msi->mask_lock) { -+ value = rcar_pci_read_reg(pcie, PCIEMSIIER); -+ value &= ~BIT(d->hwirq); -+ rcar_pci_write_reg(pcie, value, PCIEMSIIER); -+ } - } - - static void rcar_msi_irq_unmask(struct irq_data *d) - { - struct rcar_msi *msi = irq_data_get_irq_chip_data(d); - struct rcar_pcie *pcie = &msi_to_host(msi)->pcie; -- unsigned long flags; - u32 value; - -- spin_lock_irqsave(&msi->mask_lock, flags); -- value = rcar_pci_read_reg(pcie, PCIEMSIIER); -- value |= BIT(d->hwirq); -- rcar_pci_write_reg(pcie, value, PCIEMSIIER); -- spin_unlock_irqrestore(&msi->mask_lock, flags); -+ scoped_guard(raw_spinlock_irqsave, &msi->mask_lock) { -+ value = rcar_pci_read_reg(pcie, PCIEMSIIER); -+ value |= BIT(d->hwirq); -+ rcar_pci_write_reg(pcie, value, PCIEMSIIER); -+ } - } - - static int rcar_msi_set_affinity(struct irq_data *d, const struct cpumask *mask, bool force) -@@ -770,7 +760,7 @@ static int rcar_pcie_enable_msi(struct rcar_pcie_host *host) - int err; - - mutex_init(&msi->map_lock); -- spin_lock_init(&msi->mask_lock); -+ raw_spin_lock_init(&msi->mask_lock); - - err = of_address_to_resource(dev->of_node, 0, &res); - if (err) -diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c -index ac1dae113f2d9f..4cf20ca25ea74e 100644 ---- a/drivers/pci/endpoint/functions/pci-epf-test.c -+++ b/drivers/pci/endpoint/functions/pci-epf-test.c -@@ -282,17 +282,20 @@ static void pci_epf_test_clean_dma_chan(struct pci_epf_test *epf_test) - if (!epf_test->dma_supported) - return; - -- dma_release_channel(epf_test->dma_chan_tx); -- if (epf_test->dma_chan_tx == epf_test->dma_chan_rx) { -+ if (epf_test->dma_chan_tx) { -+ dma_release_channel(epf_test->dma_chan_tx); -+ if (epf_test->dma_chan_tx == epf_test->dma_chan_rx) { -+ epf_test->dma_chan_tx = NULL; -+ epf_test->dma_chan_rx = NULL; -+ return; -+ } - epf_test->dma_chan_tx = NULL; -- epf_test->dma_chan_rx = NULL; -- return; - } - -- dma_release_channel(epf_test->dma_chan_rx); -- epf_test->dma_chan_rx = NULL; -- -- return; -+ if (epf_test->dma_chan_rx) { -+ dma_release_channel(epf_test->dma_chan_rx); -+ epf_test->dma_chan_rx = NULL; -+ } - } - - static void pci_epf_test_print_rate(struct pci_epf_test *epf_test, -diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c -index 25dbe85c421758..f97c4f0e1c7a3d 100644 ---- a/drivers/pci/iov.c -+++ b/drivers/pci/iov.c -@@ -581,15 +581,18 @@ static int sriov_add_vfs(struct pci_dev *dev, u16 num_vfs) - if (dev->no_vf_scan) - return 0; - -+ pci_lock_rescan_remove(); - for (i = 0; i < num_vfs; i++) { - rc = pci_iov_add_virtfn(dev, i); - if (rc) - goto failed; - } -+ pci_unlock_rescan_remove(); - return 0; - failed: - while (i--) - pci_iov_remove_virtfn(dev, i); -+ pci_unlock_rescan_remove(); - - return rc; - } -@@ -709,8 +712,10 @@ static void sriov_del_vfs(struct pci_dev *dev) - struct pci_sriov *iov = dev->sriov; - int i; - -+ pci_lock_rescan_remove(); - for (i = 0; i < iov->num_VFs; i++) - pci_iov_remove_virtfn(dev, i); -+ pci_unlock_rescan_remove(); - } - - static void sriov_disable(struct pci_dev *dev) -diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c -index 9c59bf03d6579f..1705d2d0ed1268 100644 ---- a/drivers/pci/pci-driver.c -+++ b/drivers/pci/pci-driver.c -@@ -1612,6 +1612,7 @@ void pci_uevent_ers(struct pci_dev *pdev, enum pci_ers_result err_type) - switch (err_type) { - case PCI_ERS_RESULT_NONE: - case PCI_ERS_RESULT_CAN_RECOVER: -+ case PCI_ERS_RESULT_NEED_RESET: - envp[idx++] = "ERROR_EVENT=BEGIN_RECOVERY"; - envp[idx++] = "DEVICE_ONLINE=0"; - break; -diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c -index 92e8ac85f58e86..449d42744d336f 100644 ---- a/drivers/pci/pci-sysfs.c -+++ b/drivers/pci/pci-sysfs.c -@@ -196,8 +196,14 @@ static ssize_t max_link_width_show(struct device *dev, - struct device_attribute *attr, char *buf) - { - struct pci_dev *pdev = to_pci_dev(dev); -+ ssize_t ret; - -- return sysfs_emit(buf, "%u\n", pcie_get_width_cap(pdev)); -+ /* We read PCI_EXP_LNKCAP, so we need the device to be accessible. */ -+ pci_config_pm_runtime_get(pdev); -+ ret = sysfs_emit(buf, "%u\n", pcie_get_width_cap(pdev)); -+ pci_config_pm_runtime_put(pdev); -+ -+ return ret; - } - static DEVICE_ATTR_RO(max_link_width); - -@@ -209,7 +215,10 @@ static ssize_t current_link_speed_show(struct device *dev, - int err; - enum pci_bus_speed speed; - -+ pci_config_pm_runtime_get(pci_dev); - err = pcie_capability_read_word(pci_dev, PCI_EXP_LNKSTA, &linkstat); -+ pci_config_pm_runtime_put(pci_dev); -+ - if (err) - return -EINVAL; - -@@ -226,7 +235,10 @@ static ssize_t current_link_width_show(struct device *dev, - u16 linkstat; - int err; - -+ pci_config_pm_runtime_get(pci_dev); - err = pcie_capability_read_word(pci_dev, PCI_EXP_LNKSTA, &linkstat); -+ pci_config_pm_runtime_put(pci_dev); -+ - if (err) - return -EINVAL; - -@@ -242,7 +254,10 @@ static ssize_t secondary_bus_number_show(struct device *dev, - u8 sec_bus; - int err; - -+ pci_config_pm_runtime_get(pci_dev); - err = pci_read_config_byte(pci_dev, PCI_SECONDARY_BUS, &sec_bus); -+ pci_config_pm_runtime_put(pci_dev); -+ - if (err) - return -EINVAL; - -@@ -258,7 +273,10 @@ static ssize_t subordinate_bus_number_show(struct device *dev, - u8 sub_bus; - int err; - -+ pci_config_pm_runtime_get(pci_dev); - err = pci_read_config_byte(pci_dev, PCI_SUBORDINATE_BUS, &sub_bus); -+ pci_config_pm_runtime_put(pci_dev); -+ - if (err) - return -EINVAL; - -diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c -index eeb9ea9044b43d..8e700020ee0bc3 100644 ---- a/drivers/pci/pcie/aer.c -+++ b/drivers/pci/pcie/aer.c -@@ -38,7 +38,7 @@ - #define AER_ERROR_SOURCES_MAX 128 - - #define AER_MAX_TYPEOF_COR_ERRS 16 /* as per PCI_ERR_COR_STATUS */ --#define AER_MAX_TYPEOF_UNCOR_ERRS 27 /* as per PCI_ERR_UNCOR_STATUS*/ -+#define AER_MAX_TYPEOF_UNCOR_ERRS 32 /* as per PCI_ERR_UNCOR_STATUS*/ - - struct aer_err_source { - unsigned int status; -@@ -510,11 +510,11 @@ static const char *aer_uncorrectable_error_string[] = { - "AtomicOpBlocked", /* Bit Position 24 */ - "TLPBlockedErr", /* Bit Position 25 */ - "PoisonTLPBlocked", /* Bit Position 26 */ -- NULL, /* Bit Position 27 */ -- NULL, /* Bit Position 28 */ -- NULL, /* Bit Position 29 */ -- NULL, /* Bit Position 30 */ -- NULL, /* Bit Position 31 */ -+ "DMWrReqBlocked", /* Bit Position 27 */ -+ "IDECheck", /* Bit Position 28 */ -+ "MisIDETLP", /* Bit Position 29 */ -+ "PCRC_CHECK", /* Bit Position 30 */ -+ "TLPXlatBlocked", /* Bit Position 31 */ - }; - - static const char *aer_agent_string[] = { -diff --git a/drivers/pci/pcie/err.c b/drivers/pci/pcie/err.c -index 705893b5f7b09b..197191178cddc2 100644 ---- a/drivers/pci/pcie/err.c -+++ b/drivers/pci/pcie/err.c -@@ -108,6 +108,12 @@ static int report_normal_detected(struct pci_dev *dev, void *data) - return report_error_detected(dev, pci_channel_io_normal, data); - } - -+static int report_perm_failure_detected(struct pci_dev *dev, void *data) -+{ -+ pci_uevent_ers(dev, PCI_ERS_RESULT_DISCONNECT); -+ return 0; -+} -+ - static int report_mmio_enabled(struct pci_dev *dev, void *data) - { - struct pci_driver *pdrv; -@@ -275,7 +281,7 @@ pci_ers_result_t pcie_do_recovery(struct pci_dev *dev, - failed: - pci_walk_bridge(bridge, pci_pm_runtime_put, NULL); - -- pci_uevent_ers(bridge, PCI_ERS_RESULT_DISCONNECT); -+ pci_walk_bridge(bridge, report_perm_failure_detected, NULL); - - /* TODO: Should kernel panic here? */ - pci_info(bridge, "device recovery failed\n"); -diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.h b/drivers/pinctrl/samsung/pinctrl-samsung.h -index 9af93e3d8d9ff3..1efbae6c99876e 100644 ---- a/drivers/pinctrl/samsung/pinctrl-samsung.h -+++ b/drivers/pinctrl/samsung/pinctrl-samsung.h -@@ -352,10 +352,6 @@ extern const struct samsung_pinctrl_of_match_data exynos850_of_data; - extern const struct samsung_pinctrl_of_match_data exynosautov9_of_data; - extern const struct samsung_pinctrl_of_match_data fsd_of_data; - extern const struct samsung_pinctrl_of_match_data s3c64xx_of_data; --extern const struct samsung_pinctrl_of_match_data s3c2412_of_data; --extern const struct samsung_pinctrl_of_match_data s3c2416_of_data; --extern const struct samsung_pinctrl_of_match_data s3c2440_of_data; --extern const struct samsung_pinctrl_of_match_data s3c2450_of_data; - extern const struct samsung_pinctrl_of_match_data s5pv210_of_data; - - #endif /* __PINCTRL_SAMSUNG_H */ -diff --git a/drivers/power/supply/max77976_charger.c b/drivers/power/supply/max77976_charger.c -index 99659dc8f5a6df..56ab502e1a80b5 100644 ---- a/drivers/power/supply/max77976_charger.c -+++ b/drivers/power/supply/max77976_charger.c -@@ -292,10 +292,10 @@ static int max77976_get_property(struct power_supply *psy, - case POWER_SUPPLY_PROP_ONLINE: - err = max77976_get_online(chg, &val->intval); - break; -- case POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX: -+ case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT_MAX: - val->intval = MAX77976_CHG_CC_MAX; - break; -- case POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT: -+ case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT: - err = max77976_get_integer(chg, CHG_CC, - MAX77976_CHG_CC_MIN, - MAX77976_CHG_CC_MAX, -@@ -330,7 +330,7 @@ static int max77976_set_property(struct power_supply *psy, - int err = 0; - - switch (psp) { -- case POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT: -+ case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT: - err = max77976_set_integer(chg, CHG_CC, - MAX77976_CHG_CC_MIN, - MAX77976_CHG_CC_MAX, -@@ -355,7 +355,7 @@ static int max77976_property_is_writeable(struct power_supply *psy, - enum power_supply_property psp) - { - switch (psp) { -- case POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT: -+ case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT: - case POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT: - return true; - default: -@@ -368,8 +368,8 @@ static enum power_supply_property max77976_psy_props[] = { - POWER_SUPPLY_PROP_CHARGE_TYPE, - POWER_SUPPLY_PROP_HEALTH, - POWER_SUPPLY_PROP_ONLINE, -- POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT, -- POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX, -+ POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT, -+ POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT_MAX, - POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT, - POWER_SUPPLY_PROP_MODEL_NAME, - POWER_SUPPLY_PROP_MANUFACTURER, -diff --git a/drivers/pwm/pwm-berlin.c b/drivers/pwm/pwm-berlin.c -index 0971c666afd134..14729a6ae09a98 100644 ---- a/drivers/pwm/pwm-berlin.c -+++ b/drivers/pwm/pwm-berlin.c -@@ -273,7 +273,7 @@ static int berlin_pwm_suspend(struct device *dev) - if (!channel) - continue; - -- channel->enable = berlin_pwm_readl(bpc, i, BERLIN_PWM_ENABLE); -+ channel->enable = berlin_pwm_readl(bpc, i, BERLIN_PWM_EN); - channel->ctrl = berlin_pwm_readl(bpc, i, BERLIN_PWM_CONTROL); - channel->duty = berlin_pwm_readl(bpc, i, BERLIN_PWM_DUTY); - channel->tcnt = berlin_pwm_readl(bpc, i, BERLIN_PWM_TCNT); -@@ -304,7 +304,7 @@ static int berlin_pwm_resume(struct device *dev) - berlin_pwm_writel(bpc, i, channel->ctrl, BERLIN_PWM_CONTROL); - berlin_pwm_writel(bpc, i, channel->duty, BERLIN_PWM_DUTY); - berlin_pwm_writel(bpc, i, channel->tcnt, BERLIN_PWM_TCNT); -- berlin_pwm_writel(bpc, i, channel->enable, BERLIN_PWM_ENABLE); -+ berlin_pwm_writel(bpc, i, channel->enable, BERLIN_PWM_EN); - } - - return 0; -diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c -index 4a7c41a6c21e7d..93baffe110c00a 100644 ---- a/drivers/rtc/interface.c -+++ b/drivers/rtc/interface.c -@@ -443,6 +443,29 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) - else - err = rtc->ops->set_alarm(rtc->dev.parent, alarm); - -+ /* -+ * Check for potential race described above. If the waiting for next -+ * second, and the second just ticked since the check above, either -+ * -+ * 1) It ticked after the alarm was set, and an alarm irq should be -+ * generated. -+ * -+ * 2) It ticked before the alarm was set, and alarm irq most likely will -+ * not be generated. -+ * -+ * While we cannot easily check for which of these two scenarios we -+ * are in, we can return -ETIME to signal that the timer has already -+ * expired, which is true in both cases. -+ */ -+ if ((scheduled - now) <= 1) { -+ err = __rtc_read_time(rtc, &tm); -+ if (err) -+ return err; -+ now = rtc_tm_to_time64(&tm); -+ if (scheduled <= now) -+ return -ETIME; -+ } -+ - trace_rtc_set_alarm(rtc_tm_to_time64(&alarm->time), err); - return err; - } -@@ -594,6 +617,10 @@ int rtc_update_irq_enable(struct rtc_device *rtc, unsigned int enabled) - rtc->uie_rtctimer.node.expires = ktime_add(now, onesec); - rtc->uie_rtctimer.period = ktime_set(1, 0); - err = rtc_timer_enqueue(rtc, &rtc->uie_rtctimer); -+ if (!err && rtc->ops && rtc->ops->alarm_irq_enable) -+ err = rtc->ops->alarm_irq_enable(rtc->dev.parent, 1); -+ if (err) -+ goto out; - } else { - rtc_timer_remove(rtc, &rtc->uie_rtctimer); - } -diff --git a/drivers/rtc/rtc-optee.c b/drivers/rtc/rtc-optee.c -index 9f8b5d4a8f6b65..6b77c122fdc109 100644 ---- a/drivers/rtc/rtc-optee.c -+++ b/drivers/rtc/rtc-optee.c -@@ -320,6 +320,7 @@ static int optee_rtc_remove(struct device *dev) - { - struct optee_rtc *priv = dev_get_drvdata(dev); - -+ tee_shm_free(priv->shm); - tee_client_close_session(priv->ctx, priv->session_id); - tee_client_close_context(priv->ctx); - -diff --git a/drivers/rtc/rtc-x1205.c b/drivers/rtc/rtc-x1205.c -index 807f953ae0aedc..b7a7ea036f7adc 100644 ---- a/drivers/rtc/rtc-x1205.c -+++ b/drivers/rtc/rtc-x1205.c -@@ -669,7 +669,7 @@ static const struct i2c_device_id x1205_id[] = { - MODULE_DEVICE_TABLE(i2c, x1205_id); - - static const struct of_device_id x1205_dt_ids[] = { -- { .compatible = "xircom,x1205", }, -+ { .compatible = "xicor,x1205", }, - {}, - }; - MODULE_DEVICE_TABLE(of, x1205_dt_ids); -diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c -index 49c57a9c110b5f..42a89ab33e1c78 100644 ---- a/drivers/scsi/hpsa.c -+++ b/drivers/scsi/hpsa.c -@@ -6528,18 +6528,21 @@ static int hpsa_big_passthru_ioctl(struct ctlr_info *h, - while (left) { - sz = (left > ioc->malloc_size) ? ioc->malloc_size : left; - buff_size[sg_used] = sz; -- buff[sg_used] = kmalloc(sz, GFP_KERNEL); -- if (buff[sg_used] == NULL) { -- status = -ENOMEM; -- goto cleanup1; -- } -+ - if (ioc->Request.Type.Direction & XFER_WRITE) { -- if (copy_from_user(buff[sg_used], data_ptr, sz)) { -- status = -EFAULT; -+ buff[sg_used] = memdup_user(data_ptr, sz); -+ if (IS_ERR(buff[sg_used])) { -+ status = PTR_ERR(buff[sg_used]); - goto cleanup1; - } -- } else -- memset(buff[sg_used], 0, sz); -+ } else { -+ buff[sg_used] = kzalloc(sz, GFP_KERNEL); -+ if (!buff[sg_used]) { -+ status = -ENOMEM; -+ goto cleanup1; -+ } -+ } -+ - left -= sz; - data_ptr += sz; - sg_used++; -diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c -index 43ebb331e21673..47c4434dc7e796 100644 ---- a/drivers/scsi/mvsas/mv_init.c -+++ b/drivers/scsi/mvsas/mv_init.c -@@ -139,7 +139,7 @@ static void mvs_free(struct mvs_info *mvi) - if (mvi->shost) - scsi_host_put(mvi->shost); - list_for_each_entry(mwq, &mvi->wq_list, entry) -- cancel_delayed_work(&mwq->work_q); -+ cancel_delayed_work_sync(&mwq->work_q); - kfree(mvi->rsvd_tags); - kfree(mvi); - } -diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c -index bf9b816637d02e..7b809644436eb7 100644 ---- a/drivers/spi/spi-cadence-quadspi.c -+++ b/drivers/spi/spi-cadence-quadspi.c -@@ -687,6 +687,7 @@ static int cqspi_read_setup(struct cqspi_flash_pdata *f_pdata, - reg &= ~CQSPI_REG_SIZE_ADDRESS_MASK; - reg |= (op->addr.nbytes - 1); - writel(reg, reg_base + CQSPI_REG_SIZE); -+ readl(reg_base + CQSPI_REG_SIZE); /* Flush posted write. */ - return 0; - } - -@@ -726,6 +727,7 @@ static int cqspi_indirect_read_execute(struct cqspi_flash_pdata *f_pdata, - reinit_completion(&cqspi->transfer_complete); - writel(CQSPI_REG_INDIRECTRD_START_MASK, - reg_base + CQSPI_REG_INDIRECTRD); -+ readl(reg_base + CQSPI_REG_INDIRECTRD); /* Flush posted write. */ - - while (remaining > 0) { - if (!wait_for_completion_timeout(&cqspi->transfer_complete, -@@ -1004,6 +1006,7 @@ static int cqspi_write_setup(struct cqspi_flash_pdata *f_pdata, - reg &= ~CQSPI_REG_SIZE_ADDRESS_MASK; - reg |= (op->addr.nbytes - 1); - writel(reg, reg_base + CQSPI_REG_SIZE); -+ readl(reg_base + CQSPI_REG_SIZE); /* Flush posted write. */ - return 0; - } - -@@ -1029,6 +1032,8 @@ static int cqspi_indirect_write_execute(struct cqspi_flash_pdata *f_pdata, - reinit_completion(&cqspi->transfer_complete); - writel(CQSPI_REG_INDIRECTWR_START_MASK, - reg_base + CQSPI_REG_INDIRECTWR); -+ readl(reg_base + CQSPI_REG_INDIRECTWR); /* Flush posted write. */ -+ - /* - * As per 66AK2G02 TRM SPRUHY8F section 11.15.5.3 Indirect Access - * Controller programming sequence, couple of cycles of -diff --git a/drivers/video/fbdev/core/fb_cmdline.c b/drivers/video/fbdev/core/fb_cmdline.c -index 4d1634c492ec4d..594b60424d1c64 100644 ---- a/drivers/video/fbdev/core/fb_cmdline.c -+++ b/drivers/video/fbdev/core/fb_cmdline.c -@@ -40,7 +40,7 @@ int fb_get_options(const char *name, char **option) - bool enabled; - - if (name) -- is_of = strncmp(name, "offb", 4); -+ is_of = !strncmp(name, "offb", 4); - - enabled = __video_get_options(name, &options, is_of); - -diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c -index 9e3b5d21d09877..3a8f2e659e008d 100644 ---- a/drivers/xen/events/events_base.c -+++ b/drivers/xen/events/events_base.c -@@ -1326,14 +1326,17 @@ int bind_interdomain_evtchn_to_irq_lateeoi(struct xenbus_device *dev, - } - EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irq_lateeoi); - --static int find_virq(unsigned int virq, unsigned int cpu, evtchn_port_t *evtchn) -+static int find_virq(unsigned int virq, unsigned int cpu, evtchn_port_t *evtchn, -+ bool percpu) - { - struct evtchn_status status; - evtchn_port_t port; -- int rc = -ENOENT; -+ bool exists = false; - - memset(&status, 0, sizeof(status)); - for (port = 0; port < xen_evtchn_max_channels(); port++) { -+ int rc; -+ - status.dom = DOMID_SELF; - status.port = port; - rc = HYPERVISOR_event_channel_op(EVTCHNOP_status, &status); -@@ -1341,12 +1344,16 @@ static int find_virq(unsigned int virq, unsigned int cpu, evtchn_port_t *evtchn) - continue; - if (status.status != EVTCHNSTAT_virq) - continue; -- if (status.u.virq == virq && status.vcpu == xen_vcpu_nr(cpu)) { -+ if (status.u.virq != virq) -+ continue; -+ if (status.vcpu == xen_vcpu_nr(cpu)) { - *evtchn = port; -- break; -+ return 0; -+ } else if (!percpu) { -+ exists = true; - } - } -- return rc; -+ return exists ? -EEXIST : -ENOENT; - } - - /** -@@ -1393,8 +1400,11 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu) - evtchn = bind_virq.port; - else { - if (ret == -EEXIST) -- ret = find_virq(virq, cpu, &evtchn); -- BUG_ON(ret < 0); -+ ret = find_virq(virq, cpu, &evtchn, percpu); -+ if (ret) { -+ __unbind_from_irq(info, info->irq); -+ goto out; -+ } - } - - ret = xen_irq_info_virq_setup(info, cpu, evtchn, virq); -@@ -1799,9 +1809,20 @@ static int xen_rebind_evtchn_to_cpu(struct irq_info *info, unsigned int tcpu) - * virq or IPI channel, which don't actually need to be rebound. Ignore - * it, but don't do the xenlinux-level rebind in that case. - */ -- if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0) -+ if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0) { -+ int old_cpu = info->cpu; -+ - bind_evtchn_to_cpu(info, tcpu, false); - -+ if (info->type == IRQT_VIRQ) { -+ int virq = info->u.virq; -+ int irq = per_cpu(virq_to_irq, old_cpu)[virq]; -+ -+ per_cpu(virq_to_irq, old_cpu)[virq] = -1; -+ per_cpu(virq_to_irq, tcpu)[virq] = irq; -+ } -+ } -+ - do_unmask(info, EVT_MASK_REASON_TEMPORARY); - - return 0; -diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c -index c16df629907e13..55537b673990de 100644 ---- a/drivers/xen/manage.c -+++ b/drivers/xen/manage.c -@@ -116,7 +116,7 @@ static void do_suspend(void) - err = dpm_suspend_start(PMSG_FREEZE); - if (err) { - pr_err("%s: dpm_suspend_start %d\n", __func__, err); -- goto out_thaw; -+ goto out_resume_end; - } - - printk(KERN_DEBUG "suspending xenstore...\n"); -@@ -156,6 +156,7 @@ static void do_suspend(void) - else - xs_suspend_cancel(); - -+out_resume_end: - dpm_resume_end(si.cancelled ? PMSG_THAW : PMSG_RESTORE); - - out_thaw: -diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c -index 203e5964c9b0fc..5e46f8cd7ea073 100644 ---- a/fs/btrfs/export.c -+++ b/fs/btrfs/export.c -@@ -24,7 +24,11 @@ static int btrfs_encode_fh(struct inode *inode, u32 *fh, int *max_len, - int type; - - if (parent && (len < BTRFS_FID_SIZE_CONNECTABLE)) { -- *max_len = BTRFS_FID_SIZE_CONNECTABLE; -+ if (btrfs_root_id(BTRFS_I(inode)->root) != -+ btrfs_root_id(BTRFS_I(parent)->root)) -+ *max_len = BTRFS_FID_SIZE_CONNECTABLE_ROOT; -+ else -+ *max_len = BTRFS_FID_SIZE_CONNECTABLE; - return FILEID_INVALID; - } else if (len < BTRFS_FID_SIZE_NON_CONNECTABLE) { - *max_len = BTRFS_FID_SIZE_NON_CONNECTABLE; -@@ -46,6 +50,8 @@ static int btrfs_encode_fh(struct inode *inode, u32 *fh, int *max_len, - parent_root_id = BTRFS_I(parent)->root->root_key.objectid; - - if (parent_root_id != fid->root_objectid) { -+ if (*max_len < BTRFS_FID_SIZE_CONNECTABLE_ROOT) -+ return FILEID_INVALID; - fid->parent_root_objectid = parent_root_id; - len = BTRFS_FID_SIZE_CONNECTABLE_ROOT; - type = FILEID_BTRFS_WITH_PARENT_ROOT; -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index ccf94c5fbfdfd6..88ba277bc3a79e 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -364,6 +364,13 @@ noinline_for_stack bool find_lock_delalloc_range(struct inode *inode, - /* step one, find a bunch of delalloc bytes starting at start */ - delalloc_start = *start; - delalloc_end = 0; -+ -+ /* -+ * If @max_bytes is smaller than a block, btrfs_find_delalloc_range() can -+ * return early without handling any dirty ranges. -+ */ -+ ASSERT(max_bytes >= fs_info->sectorsize); -+ - found = btrfs_find_delalloc_range(tree, &delalloc_start, &delalloc_end, - max_bytes, &cached_state); - if (!found || delalloc_end <= *start || delalloc_start > orig_end) { -@@ -394,13 +401,14 @@ noinline_for_stack bool find_lock_delalloc_range(struct inode *inode, - delalloc_start, delalloc_end); - ASSERT(!ret || ret == -EAGAIN); - if (ret == -EAGAIN) { -- /* some of the pages are gone, lets avoid looping by -- * shortening the size of the delalloc range we're searching -+ /* -+ * Some of the pages are gone, lets avoid looping by -+ * shortening the size of the delalloc range we're searching. - */ - free_extent_state(cached_state); - cached_state = NULL; - if (!loops) { -- max_bytes = PAGE_SIZE; -+ max_bytes = fs_info->sectorsize; - loops = 1; - goto again; - } else { -diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c -index 2fbf97077ce910..3f06362985b5a6 100644 ---- a/fs/cramfs/inode.c -+++ b/fs/cramfs/inode.c -@@ -117,9 +117,18 @@ static struct inode *get_cramfs_inode(struct super_block *sb, - inode_nohighmem(inode); - inode->i_data.a_ops = &cramfs_aops; - break; -- default: -+ case S_IFCHR: -+ case S_IFBLK: -+ case S_IFIFO: -+ case S_IFSOCK: - init_special_inode(inode, cramfs_inode->mode, - old_decode_dev(cramfs_inode->size)); -+ break; -+ default: -+ printk(KERN_DEBUG "CRAMFS: Invalid file type 0%04o for inode %lu.\n", -+ inode->i_mode, inode->i_ino); -+ iget_failed(inode); -+ return ERR_PTR(-EIO); - } - - inode->i_mode = cramfs_inode->mode; -diff --git a/fs/ext4/fsmap.c b/fs/ext4/fsmap.c -index 1b68586f73f3fe..c970f41c50483e 100644 ---- a/fs/ext4/fsmap.c -+++ b/fs/ext4/fsmap.c -@@ -74,7 +74,8 @@ static int ext4_getfsmap_dev_compare(const void *p1, const void *p2) - static bool ext4_getfsmap_rec_before_low_key(struct ext4_getfsmap_info *info, - struct ext4_fsmap *rec) - { -- return rec->fmr_physical < info->gfi_low.fmr_physical; -+ return rec->fmr_physical + rec->fmr_length <= -+ info->gfi_low.fmr_physical; - } - - /* -@@ -200,15 +201,18 @@ static int ext4_getfsmap_meta_helper(struct super_block *sb, - ext4_group_first_block_no(sb, agno)); - fs_end = fs_start + EXT4_C2B(sbi, len); - -- /* Return relevant extents from the meta_list */ -+ /* -+ * Return relevant extents from the meta_list. We emit all extents that -+ * partially/fully overlap with the query range -+ */ - list_for_each_entry_safe(p, tmp, &info->gfi_meta_list, fmr_list) { -- if (p->fmr_physical < info->gfi_next_fsblk) { -+ if (p->fmr_physical + p->fmr_length <= info->gfi_next_fsblk) { - list_del(&p->fmr_list); - kfree(p); - continue; - } -- if (p->fmr_physical <= fs_start || -- p->fmr_physical + p->fmr_length <= fs_end) { -+ if (p->fmr_physical <= fs_end && -+ p->fmr_physical + p->fmr_length > fs_start) { - /* Emit the retained free extent record if present */ - if (info->gfi_lastfree.fmr_owner) { - error = ext4_getfsmap_helper(sb, info, -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 63b1384823ba56..91a9fa6f1ad4f0 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -3871,7 +3871,11 @@ int ext4_can_truncate(struct inode *inode) - * We have to make sure i_disksize gets properly updated before we truncate - * page cache due to hole punching or zero range. Otherwise i_disksize update - * can get lost as it may have been postponed to submission of writeback but -- * that will never happen after we truncate page cache. -+ * that will never happen if we remove the folio containing i_size from the -+ * page cache. Also if we punch hole within i_size but above i_disksize, -+ * following ext4_page_mkwrite() may mistakenly allocate written blocks over -+ * the hole and thus introduce allocated blocks beyond i_disksize which is -+ * not allowed (e2fsck would complain in case of crash). - */ - int ext4_update_disksize_before_punch(struct inode *inode, loff_t offset, - loff_t len) -@@ -3882,9 +3886,11 @@ int ext4_update_disksize_before_punch(struct inode *inode, loff_t offset, - loff_t size = i_size_read(inode); - - WARN_ON(!inode_is_locked(inode)); -- if (offset > size || offset + len < size) -+ if (offset > size) - return 0; - -+ if (offset + len < size) -+ size = offset + len; - if (EXT4_I(inode)->i_disksize >= size) - return 0; - -diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c -index 5e6b07b3496006..c566161127cd7a 100644 ---- a/fs/ext4/move_extent.c -+++ b/fs/ext4/move_extent.c -@@ -225,7 +225,7 @@ static int mext_page_mkuptodate(struct folio *folio, size_t from, size_t to) - do { - if (bh_offset(bh) + blocksize <= from) - continue; -- if (bh_offset(bh) > to) -+ if (bh_offset(bh) >= to) - break; - wait_on_buffer(bh); - if (buffer_uptodate(bh)) -diff --git a/fs/ext4/orphan.c b/fs/ext4/orphan.c -index c53918768cb256..05997b4d012038 100644 ---- a/fs/ext4/orphan.c -+++ b/fs/ext4/orphan.c -@@ -513,7 +513,7 @@ void ext4_release_orphan_info(struct super_block *sb) - return; - for (i = 0; i < oi->of_blocks; i++) - brelse(oi->of_binfo[i].ob_bh); -- kfree(oi->of_binfo); -+ kvfree(oi->of_binfo); - } - - static struct ext4_orphan_block_tail *ext4_orphan_block_tail( -@@ -584,9 +584,20 @@ int ext4_init_orphan_info(struct super_block *sb) - ext4_msg(sb, KERN_ERR, "get orphan inode failed"); - return PTR_ERR(inode); - } -+ /* -+ * This is just an artificial limit to prevent corrupted fs from -+ * consuming absurd amounts of memory when pinning blocks of orphan -+ * file in memory. -+ */ -+ if (inode->i_size > 8 << 20) { -+ ext4_msg(sb, KERN_ERR, "orphan file too big: %llu", -+ (unsigned long long)inode->i_size); -+ ret = -EFSCORRUPTED; -+ goto out_put; -+ } - oi->of_blocks = inode->i_size >> sb->s_blocksize_bits; - oi->of_csum_seed = EXT4_I(inode)->i_csum_seed; -- oi->of_binfo = kmalloc_array(oi->of_blocks, -+ oi->of_binfo = kvmalloc_array(oi->of_blocks, - sizeof(struct ext4_orphan_block), - GFP_KERNEL); - if (!oi->of_binfo) { -@@ -627,7 +638,7 @@ int ext4_init_orphan_info(struct super_block *sb) - out_free: - for (i--; i >= 0; i--) - brelse(oi->of_binfo[i].ob_bh); -- kfree(oi->of_binfo); -+ kvfree(oi->of_binfo); - out_put: - iput(inode); - return ret; -diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c -index ca22aa9e04b4b1..66933e55efb3bd 100644 ---- a/fs/ext4/xattr.c -+++ b/fs/ext4/xattr.c -@@ -251,6 +251,10 @@ check_xattrs(struct inode *inode, struct buffer_head *bh, - err_str = "invalid ea_ino"; - goto errout; - } -+ if (ea_ino && !size) { -+ err_str = "invalid size in ea xattr"; -+ goto errout; -+ } - if (size > EXT4_XATTR_SIZE_MAX) { - err_str = "e_value size too large"; - goto errout; -@@ -1036,7 +1040,7 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode, - int ref_change) - { - struct ext4_iloc iloc; -- s64 ref_count; -+ u64 ref_count; - int ret; - - inode_lock_nested(ea_inode, I_MUTEX_XATTR); -@@ -1046,13 +1050,17 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode, - goto out; - - ref_count = ext4_xattr_inode_get_ref(ea_inode); -+ if ((ref_count == 0 && ref_change < 0) || (ref_count == U64_MAX && ref_change > 0)) { -+ ext4_error_inode(ea_inode, __func__, __LINE__, 0, -+ "EA inode %lu ref wraparound: ref_count=%lld ref_change=%d", -+ ea_inode->i_ino, ref_count, ref_change); -+ ret = -EFSCORRUPTED; -+ goto out; -+ } - ref_count += ref_change; - ext4_xattr_inode_set_ref(ea_inode, ref_count); - - if (ref_change > 0) { -- WARN_ONCE(ref_count <= 0, "EA inode %lu ref_count=%lld", -- ea_inode->i_ino, ref_count); -- - if (ref_count == 1) { - WARN_ONCE(ea_inode->i_nlink, "EA inode %lu i_nlink=%u", - ea_inode->i_ino, ea_inode->i_nlink); -@@ -1061,9 +1069,6 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode, - ext4_orphan_del(handle, ea_inode); - } - } else { -- WARN_ONCE(ref_count < 0, "EA inode %lu ref_count=%lld", -- ea_inode->i_ino, ref_count); -- - if (ref_count == 0) { - WARN_ONCE(ea_inode->i_nlink != 1, - "EA inode %lu i_nlink=%u", -diff --git a/fs/file.c b/fs/file.c -index 0ce6a6930276d3..9b76b9644ac275 100644 ---- a/fs/file.c -+++ b/fs/file.c -@@ -1138,7 +1138,10 @@ int replace_fd(unsigned fd, struct file *file, unsigned flags) - err = expand_files(files, fd); - if (unlikely(err < 0)) - goto out_unlock; -- return do_dup2(files, file, fd, flags); -+ err = do_dup2(files, file, fd, flags); -+ if (err < 0) -+ return err; -+ return 0; - - out_unlock: - spin_unlock(&files->file_lock); -diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c -index ed110568d6127f..274fae88b498e4 100644 ---- a/fs/fs-writeback.c -+++ b/fs/fs-writeback.c -@@ -422,22 +422,23 @@ static bool inode_do_switch_wbs(struct inode *inode, - * Transfer to @new_wb's IO list if necessary. If the @inode is dirty, - * the specific list @inode was on is ignored and the @inode is put on - * ->b_dirty which is always correct including from ->b_dirty_time. -- * The transfer preserves @inode->dirtied_when ordering. If the @inode -- * was clean, it means it was on the b_attached list, so move it onto -- * the b_attached list of @new_wb. -+ * If the @inode was clean, it means it was on the b_attached list, so -+ * move it onto the b_attached list of @new_wb. - */ - if (!list_empty(&inode->i_io_list)) { - inode->i_wb = new_wb; - - if (inode->i_state & I_DIRTY_ALL) { -- struct inode *pos; -- -- list_for_each_entry(pos, &new_wb->b_dirty, i_io_list) -- if (time_after_eq(inode->dirtied_when, -- pos->dirtied_when)) -- break; -+ /* -+ * We need to keep b_dirty list sorted by -+ * dirtied_time_when. However properly sorting the -+ * inode in the list gets too expensive when switching -+ * many inodes. So just attach inode at the end of the -+ * dirty list and clobber the dirtied_time_when. -+ */ -+ inode->dirtied_time_when = jiffies; - inode_io_list_move_locked(inode, new_wb, -- pos->i_io_list.prev); -+ &new_wb->b_dirty); - } else { - inode_cgwb_move_to_attached(inode, new_wb); - } -@@ -479,6 +480,7 @@ static void inode_switch_wbs_work_fn(struct work_struct *work) - */ - down_read(&bdi->wb_switch_rwsem); - -+ inodep = isw->inodes; - /* - * By the time control reaches here, RCU grace period has passed - * since I_WB_SWITCH assertion and all wb stat update transactions -@@ -489,6 +491,7 @@ static void inode_switch_wbs_work_fn(struct work_struct *work) - * gives us exclusion against all wb related operations on @inode - * including IO list manipulations and stat updates. - */ -+relock: - if (old_wb < new_wb) { - spin_lock(&old_wb->list_lock); - spin_lock_nested(&new_wb->list_lock, SINGLE_DEPTH_NESTING); -@@ -497,10 +500,17 @@ static void inode_switch_wbs_work_fn(struct work_struct *work) - spin_lock_nested(&old_wb->list_lock, SINGLE_DEPTH_NESTING); - } - -- for (inodep = isw->inodes; *inodep; inodep++) { -+ while (*inodep) { - WARN_ON_ONCE((*inodep)->i_wb != old_wb); - if (inode_do_switch_wbs(*inodep, old_wb, new_wb)) - nr_switched++; -+ inodep++; -+ if (*inodep && need_resched()) { -+ spin_unlock(&new_wb->list_lock); -+ spin_unlock(&old_wb->list_lock); -+ cond_resched(); -+ goto relock; -+ } - } - - spin_unlock(&new_wb->list_lock); -diff --git a/fs/fsopen.c b/fs/fsopen.c -index ce03f6521c8870..3576b1084ec2fb 100644 ---- a/fs/fsopen.c -+++ b/fs/fsopen.c -@@ -18,50 +18,56 @@ - #include "internal.h" - #include "mount.h" - -+static inline const char *fetch_message_locked(struct fc_log *log, size_t len, -+ bool *need_free) -+{ -+ const char *p; -+ int index; -+ -+ if (unlikely(log->head == log->tail)) -+ return ERR_PTR(-ENODATA); -+ -+ index = log->tail & (ARRAY_SIZE(log->buffer) - 1); -+ p = log->buffer[index]; -+ if (unlikely(strlen(p) > len)) -+ return ERR_PTR(-EMSGSIZE); -+ -+ log->buffer[index] = NULL; -+ *need_free = log->need_free & (1 << index); -+ log->need_free &= ~(1 << index); -+ log->tail++; -+ -+ return p; -+} -+ - /* - * Allow the user to read back any error, warning or informational messages. -+ * Only one message is returned for each read(2) call. - */ - static ssize_t fscontext_read(struct file *file, - char __user *_buf, size_t len, loff_t *pos) - { - struct fs_context *fc = file->private_data; -- struct fc_log *log = fc->log.log; -- unsigned int logsize = ARRAY_SIZE(log->buffer); -- ssize_t ret; -- char *p; -+ ssize_t err; -+ const char *p __free(kfree) = NULL, *message; - bool need_free; -- int index, n; -+ int n; - -- ret = mutex_lock_interruptible(&fc->uapi_mutex); -- if (ret < 0) -- return ret; -- -- if (log->head == log->tail) { -- mutex_unlock(&fc->uapi_mutex); -- return -ENODATA; -- } -- -- index = log->tail & (logsize - 1); -- p = log->buffer[index]; -- need_free = log->need_free & (1 << index); -- log->buffer[index] = NULL; -- log->need_free &= ~(1 << index); -- log->tail++; -+ err = mutex_lock_interruptible(&fc->uapi_mutex); -+ if (err < 0) -+ return err; -+ message = fetch_message_locked(fc->log.log, len, &need_free); - mutex_unlock(&fc->uapi_mutex); -+ if (IS_ERR(message)) -+ return PTR_ERR(message); - -- ret = -EMSGSIZE; -- n = strlen(p); -- if (n > len) -- goto err_free; -- ret = -EFAULT; -- if (copy_to_user(_buf, p, n) != 0) -- goto err_free; -- ret = n; -- --err_free: - if (need_free) -- kfree(p); -- return ret; -+ p = message; -+ -+ n = strlen(message); -+ if (copy_to_user(_buf, message, n)) -+ return -EFAULT; -+ return n; - } - - static int fscontext_release(struct inode *inode, struct file *file) -diff --git a/fs/minix/inode.c b/fs/minix/inode.c -index df575473c1cc0b..ee8a6fe360e728 100644 ---- a/fs/minix/inode.c -+++ b/fs/minix/inode.c -@@ -470,8 +470,14 @@ void minix_set_inode(struct inode *inode, dev_t rdev) - inode->i_op = &minix_symlink_inode_operations; - inode_nohighmem(inode); - inode->i_mapping->a_ops = &minix_aops; -- } else -+ } else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) || -+ S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) { - init_special_inode(inode, inode->i_mode, rdev); -+ } else { -+ printk(KERN_DEBUG "MINIX-fs: Invalid file type 0%04o for inode %lu.\n", -+ inode->i_mode, inode->i_ino); -+ make_bad_inode(inode); -+ } - } - - /* -diff --git a/fs/namei.c b/fs/namei.c -index 155e4d09a5fb2c..02b0c273129824 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -1364,6 +1364,10 @@ static int follow_automount(struct path *path, int *count, unsigned lookup_flags - dentry->d_inode) - return -EISDIR; - -+ /* No need to trigger automounts if mountpoint crossing is disabled. */ -+ if (lookup_flags & LOOKUP_NO_XDEV) -+ return -EXDEV; -+ - if (count && (*count)++ >= MAXSYMLINKS) - return -ELOOP; - -@@ -1387,6 +1391,10 @@ static int __traverse_mounts(struct path *path, unsigned flags, bool *jumped, - /* Allow the filesystem to manage the transit without i_mutex - * being held. */ - if (flags & DCACHE_MANAGE_TRANSIT) { -+ if (lookup_flags & LOOKUP_NO_XDEV) { -+ ret = -EXDEV; -+ break; -+ } - ret = path->dentry->d_op->d_manage(path, false); - flags = smp_load_acquire(&path->dentry->d_flags); - if (ret < 0) -diff --git a/fs/namespace.c b/fs/namespace.c -index f79226472251ba..646d9e7d41ee8a 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -64,6 +64,15 @@ static int __init set_mphash_entries(char *str) - } - __setup("mphash_entries=", set_mphash_entries); - -+static char * __initdata initramfs_options; -+static int __init initramfs_options_setup(char *str) -+{ -+ initramfs_options = str; -+ return 1; -+} -+ -+__setup("initramfs_options=", initramfs_options_setup); -+ - static u64 event; - static DEFINE_IDA(mnt_id_ida); - static DEFINE_IDA(mnt_group_ida); -@@ -4728,7 +4737,7 @@ static void __init init_mount_tree(void) - struct mnt_namespace *ns; - struct path root; - -- mnt = vfs_kern_mount(&rootfs_fs_type, 0, "rootfs", NULL); -+ mnt = vfs_kern_mount(&rootfs_fs_type, 0, "rootfs", initramfs_options); - if (IS_ERR(mnt)) - panic("Can't create rootfs"); - -diff --git a/fs/nfsd/lockd.c b/fs/nfsd/lockd.c -index 46a7f9b813e527..b02886f38925f8 100644 ---- a/fs/nfsd/lockd.c -+++ b/fs/nfsd/lockd.c -@@ -48,6 +48,21 @@ nlm_fopen(struct svc_rqst *rqstp, struct nfs_fh *f, struct file **filp, - switch (nfserr) { - case nfs_ok: - return 0; -+ case nfserr_jukebox: -+ /* this error can indicate a presence of a conflicting -+ * delegation to an NLM lock request. Options are: -+ * (1) For now, drop this request and make the client -+ * retry. When delegation is returned, client's lock retry -+ * will complete. -+ * (2) NLM4_DENIED as per "spec" signals to the client -+ * that the lock is unavailable now but client can retry. -+ * Linux client implementation does not. It treats -+ * NLM4_DENIED same as NLM4_FAILED and errors the request. -+ * (3) For the future, treat this as blocked lock and try -+ * to callback when the delegation is returned but might -+ * not have a proper lock request to block on. -+ */ -+ fallthrough; - case nfserr_dropit: - return nlm_drop_reply; - case nfserr_stale: -diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c -index cd78b7ecbd4325..e9c1271b7ecc39 100644 ---- a/fs/nfsd/nfs4proc.c -+++ b/fs/nfsd/nfs4proc.c -@@ -1368,7 +1368,7 @@ static __be32 nfsd4_ssc_setup_dul(struct nfsd_net *nn, char *ipaddr, - return 0; - } - if (work) { -- strscpy(work->nsui_ipaddr, ipaddr, sizeof(work->nsui_ipaddr) - 1); -+ strscpy(work->nsui_ipaddr, ipaddr, sizeof(work->nsui_ipaddr)); - refcount_set(&work->nsui_refcnt, 2); - work->nsui_busy = true; - list_add_tail(&work->nsui_list, &nn->nfsd_ssc_mount_list); -diff --git a/fs/ntfs3/bitmap.c b/fs/ntfs3/bitmap.c -index cf4fe21a50399b..29b585f443f3eb 100644 ---- a/fs/ntfs3/bitmap.c -+++ b/fs/ntfs3/bitmap.c -@@ -1399,6 +1399,7 @@ int wnd_extend(struct wnd_bitmap *wnd, size_t new_bits) - mark_buffer_dirty(bh); - unlock_buffer(bh); - /* err = sync_dirty_buffer(bh); */ -+ put_bh(bh); - - b0 = 0; - bits -= op; -diff --git a/fs/smb/client/smb1ops.c b/fs/smb/client/smb1ops.c -index e62d9cc592e0c8..c80b291a14a576 100644 ---- a/fs/smb/client/smb1ops.c -+++ b/fs/smb/client/smb1ops.c -@@ -671,14 +671,72 @@ static int cifs_query_path_info(const unsigned int xid, - } - - #ifdef CONFIG_CIFS_XATTR -+ /* -+ * For non-symlink WSL reparse points it is required to fetch -+ * EA $LXMOD which contains in its S_DT part the mandatory file type. -+ */ -+ if (!rc && data->reparse_point) { -+ struct smb2_file_full_ea_info *ea; -+ u32 next = 0; -+ -+ ea = (struct smb2_file_full_ea_info *)data->wsl.eas; -+ do { -+ ea = (void *)((u8 *)ea + next); -+ next = le32_to_cpu(ea->next_entry_offset); -+ } while (next); -+ if (le16_to_cpu(ea->ea_value_length)) { -+ ea->next_entry_offset = cpu_to_le32(ALIGN(sizeof(*ea) + -+ ea->ea_name_length + 1 + -+ le16_to_cpu(ea->ea_value_length), 4)); -+ ea = (void *)((u8 *)ea + le32_to_cpu(ea->next_entry_offset)); -+ } -+ -+ rc = CIFSSMBQAllEAs(xid, tcon, full_path, SMB2_WSL_XATTR_MODE, -+ &ea->ea_data[SMB2_WSL_XATTR_NAME_LEN + 1], -+ SMB2_WSL_XATTR_MODE_SIZE, cifs_sb); -+ if (rc == SMB2_WSL_XATTR_MODE_SIZE) { -+ ea->next_entry_offset = cpu_to_le32(0); -+ ea->flags = 0; -+ ea->ea_name_length = SMB2_WSL_XATTR_NAME_LEN; -+ ea->ea_value_length = cpu_to_le16(SMB2_WSL_XATTR_MODE_SIZE); -+ memcpy(&ea->ea_data[0], SMB2_WSL_XATTR_MODE, SMB2_WSL_XATTR_NAME_LEN + 1); -+ data->wsl.eas_len += ALIGN(sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 + -+ SMB2_WSL_XATTR_MODE_SIZE, 4); -+ rc = 0; -+ } else if (rc >= 0) { -+ /* It is an error if EA $LXMOD has wrong size. */ -+ rc = -EINVAL; -+ } else { -+ /* -+ * In all other cases ignore error if fetching -+ * of EA $LXMOD failed. It is needed only for -+ * non-symlink WSL reparse points and wsl_to_fattr() -+ * handle the case when EA is missing. -+ */ -+ rc = 0; -+ } -+ } -+ - /* - * For WSL CHR and BLK reparse points it is required to fetch - * EA $LXDEV which contains major and minor device numbers. - */ - if (!rc && data->reparse_point) { - struct smb2_file_full_ea_info *ea; -+ u32 next = 0; - - ea = (struct smb2_file_full_ea_info *)data->wsl.eas; -+ do { -+ ea = (void *)((u8 *)ea + next); -+ next = le32_to_cpu(ea->next_entry_offset); -+ } while (next); -+ if (le16_to_cpu(ea->ea_value_length)) { -+ ea->next_entry_offset = cpu_to_le32(ALIGN(sizeof(*ea) + -+ ea->ea_name_length + 1 + -+ le16_to_cpu(ea->ea_value_length), 4)); -+ ea = (void *)((u8 *)ea + le32_to_cpu(ea->next_entry_offset)); -+ } -+ - rc = CIFSSMBQAllEAs(xid, tcon, full_path, SMB2_WSL_XATTR_DEV, - &ea->ea_data[SMB2_WSL_XATTR_NAME_LEN + 1], - SMB2_WSL_XATTR_DEV_SIZE, cifs_sb); -@@ -688,8 +746,8 @@ static int cifs_query_path_info(const unsigned int xid, - ea->ea_name_length = SMB2_WSL_XATTR_NAME_LEN; - ea->ea_value_length = cpu_to_le16(SMB2_WSL_XATTR_DEV_SIZE); - memcpy(&ea->ea_data[0], SMB2_WSL_XATTR_DEV, SMB2_WSL_XATTR_NAME_LEN + 1); -- data->wsl.eas_len = sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 + -- SMB2_WSL_XATTR_DEV_SIZE; -+ data->wsl.eas_len += ALIGN(sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 + -+ SMB2_WSL_XATTR_MODE_SIZE, 4); - rc = 0; - } else if (rc >= 0) { - /* It is an error if EA $LXDEV has wrong size. */ -diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c -index 79641d1ee86757..232a3c28905568 100644 ---- a/fs/smb/client/smb2inode.c -+++ b/fs/smb/client/smb2inode.c -@@ -1216,31 +1216,33 @@ int - smb2_set_file_info(struct inode *inode, const char *full_path, - FILE_BASIC_INFO *buf, const unsigned int xid) - { -- struct cifs_open_parms oparms; -+ struct kvec in_iov = { .iov_base = buf, .iov_len = sizeof(*buf), }; - struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb); -+ struct cifsFileInfo *cfile = NULL; -+ struct cifs_open_parms oparms; - struct tcon_link *tlink; - struct cifs_tcon *tcon; -- struct cifsFileInfo *cfile; -- struct kvec in_iov = { .iov_base = buf, .iov_len = sizeof(*buf), }; -- int rc; -- -- if ((buf->CreationTime == 0) && (buf->LastAccessTime == 0) && -- (buf->LastWriteTime == 0) && (buf->ChangeTime == 0) && -- (buf->Attributes == 0)) -- return 0; /* would be a no op, no sense sending this */ -+ int rc = 0; - - tlink = cifs_sb_tlink(cifs_sb); - if (IS_ERR(tlink)) - return PTR_ERR(tlink); - tcon = tlink_tcon(tlink); - -- cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile); -+ if ((buf->CreationTime == 0) && (buf->LastAccessTime == 0) && -+ (buf->LastWriteTime == 0) && (buf->ChangeTime == 0)) { -+ if (buf->Attributes == 0) -+ goto out; /* would be a no op, no sense sending this */ -+ cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile); -+ } -+ - oparms = CIFS_OPARMS(cifs_sb, tcon, full_path, FILE_WRITE_ATTRIBUTES, - FILE_OPEN, 0, ACL_NO_MODE); - rc = smb2_compound_op(xid, tcon, cifs_sb, - full_path, &oparms, &in_iov, - &(int){SMB2_OP_SET_INFO}, 1, - cfile, NULL, NULL, NULL); -+out: - cifs_put_tlink(tlink); - return rc; - } -diff --git a/fs/smb/server/ksmbd_netlink.h b/fs/smb/server/ksmbd_netlink.h -index f4e55199938d58..c6c1844d444822 100644 ---- a/fs/smb/server/ksmbd_netlink.h -+++ b/fs/smb/server/ksmbd_netlink.h -@@ -108,10 +108,11 @@ struct ksmbd_startup_request { - __u32 smb2_max_credits; /* MAX credits */ - __u32 smbd_max_io_size; /* smbd read write size */ - __u32 max_connections; /* Number of maximum simultaneous connections */ -- __u32 reserved[126]; /* Reserved room */ -+ __u32 max_ip_connections; /* Number of maximum connection per ip address */ -+ __u32 reserved[125]; /* Reserved room */ - __u32 ifc_list_sz; /* interfaces list size */ - __s8 ____payload[]; --}; -+} __packed; - - #define KSMBD_STARTUP_CONFIG_INTERFACES(s) ((s)->____payload) - -diff --git a/fs/smb/server/server.h b/fs/smb/server/server.h -index 4d06f2eb0d6adb..d0744498ceed66 100644 ---- a/fs/smb/server/server.h -+++ b/fs/smb/server/server.h -@@ -43,6 +43,7 @@ struct ksmbd_server_config { - unsigned int auth_mechs; - unsigned int max_connections; - unsigned int max_inflight_req; -+ unsigned int max_ip_connections; - - char *conf[SERVER_CONF_WORK_GROUP + 1]; - }; -diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c -index 281101fd1f76f1..80581a7bc1bcc7 100644 ---- a/fs/smb/server/transport_ipc.c -+++ b/fs/smb/server/transport_ipc.c -@@ -321,6 +321,9 @@ static int ipc_server_config_on_startup(struct ksmbd_startup_request *req) - if (req->max_connections) - server_conf.max_connections = req->max_connections; - -+ if (req->max_ip_connections) -+ server_conf.max_ip_connections = req->max_ip_connections; -+ - ret = ksmbd_set_netbios_name(req->netbios_name); - ret |= ksmbd_set_server_string(req->server_string); - ret |= ksmbd_set_work_group(req->work_group); -diff --git a/fs/smb/server/transport_tcp.c b/fs/smb/server/transport_tcp.c -index 53c536f2ce9f9c..c43a465114289b 100644 ---- a/fs/smb/server/transport_tcp.c -+++ b/fs/smb/server/transport_tcp.c -@@ -240,6 +240,7 @@ static int ksmbd_kthread_fn(void *p) - struct interface *iface = (struct interface *)p; - struct ksmbd_conn *conn; - int ret; -+ unsigned int max_ip_conns; - - while (!kthread_should_stop()) { - mutex_lock(&iface->sock_release_lock); -@@ -257,34 +258,39 @@ static int ksmbd_kthread_fn(void *p) - continue; - } - -+ if (!server_conf.max_ip_connections) -+ goto skip_max_ip_conns_limit; -+ - /* - * Limits repeated connections from clients with the same IP. - */ -+ max_ip_conns = 0; - down_read(&conn_list_lock); -- list_for_each_entry(conn, &conn_list, conns_list) -+ list_for_each_entry(conn, &conn_list, conns_list) { - #if IS_ENABLED(CONFIG_IPV6) - if (client_sk->sk->sk_family == AF_INET6) { - if (memcmp(&client_sk->sk->sk_v6_daddr, -- &conn->inet6_addr, 16) == 0) { -- ret = -EAGAIN; -- break; -- } -+ &conn->inet6_addr, 16) == 0) -+ max_ip_conns++; - } else if (inet_sk(client_sk->sk)->inet_daddr == -- conn->inet_addr) { -- ret = -EAGAIN; -- break; -- } -+ conn->inet_addr) -+ max_ip_conns++; - #else - if (inet_sk(client_sk->sk)->inet_daddr == -- conn->inet_addr) { -+ conn->inet_addr) -+ max_ip_conns++; -+#endif -+ if (server_conf.max_ip_connections <= max_ip_conns) { - ret = -EAGAIN; - break; - } --#endif -+ } - up_read(&conn_list_lock); - if (ret == -EAGAIN) - continue; - -+skip_max_ip_conns_limit: -+ - if (server_conf.max_connections && - atomic_inc_return(&active_num_conn) >= server_conf.max_connections) { - pr_info_ratelimited("Limit the maximum number of connections(%u)\n", -diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c -index 53104f25de5116..f5dcb8353f862f 100644 ---- a/fs/squashfs/inode.c -+++ b/fs/squashfs/inode.c -@@ -140,8 +140,17 @@ int squashfs_read_inode(struct inode *inode, long long ino) - if (err < 0) - goto failed_read; - -+ inode->i_size = le32_to_cpu(sqsh_ino->file_size); - frag = le32_to_cpu(sqsh_ino->fragment); - if (frag != SQUASHFS_INVALID_FRAG) { -+ /* -+ * the file cannot have a fragment (tailend) and have a -+ * file size a multiple of the block size -+ */ -+ if ((inode->i_size & (msblk->block_size - 1)) == 0) { -+ err = -EINVAL; -+ goto failed_read; -+ } - frag_offset = le32_to_cpu(sqsh_ino->offset); - frag_size = squashfs_frag_lookup(sb, frag, &frag_blk); - if (frag_size < 0) { -@@ -155,7 +164,6 @@ int squashfs_read_inode(struct inode *inode, long long ino) - } - - set_nlink(inode, 1); -- inode->i_size = le32_to_cpu(sqsh_ino->file_size); - inode->i_fop = &generic_ro_fops; - inode->i_mode |= S_IFREG; - inode->i_blocks = ((inode->i_size - 1) >> 9) + 1; -@@ -184,8 +192,21 @@ int squashfs_read_inode(struct inode *inode, long long ino) - if (err < 0) - goto failed_read; - -+ inode->i_size = le64_to_cpu(sqsh_ino->file_size); -+ if (inode->i_size < 0) { -+ err = -EINVAL; -+ goto failed_read; -+ } - frag = le32_to_cpu(sqsh_ino->fragment); - if (frag != SQUASHFS_INVALID_FRAG) { -+ /* -+ * the file cannot have a fragment (tailend) and have a -+ * file size a multiple of the block size -+ */ -+ if ((inode->i_size & (msblk->block_size - 1)) == 0) { -+ err = -EINVAL; -+ goto failed_read; -+ } - frag_offset = le32_to_cpu(sqsh_ino->offset); - frag_size = squashfs_frag_lookup(sb, frag, &frag_blk); - if (frag_size < 0) { -@@ -200,7 +221,6 @@ int squashfs_read_inode(struct inode *inode, long long ino) - - xattr_id = le32_to_cpu(sqsh_ino->xattr); - set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); -- inode->i_size = le64_to_cpu(sqsh_ino->file_size); - inode->i_op = &squashfs_inode_ops; - inode->i_fop = &generic_ro_fops; - inode->i_mode |= S_IFREG; -diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h -index 7e9e7e76904369..2b5891515f3d82 100644 ---- a/include/acpi/acpixf.h -+++ b/include/acpi/acpixf.h -@@ -213,6 +213,12 @@ ACPI_INIT_GLOBAL(u8, acpi_gbl_osi_data, 0); - */ - ACPI_INIT_GLOBAL(u8, acpi_gbl_reduced_hardware, FALSE); - -+/* -+ * ACPI Global Lock is mainly used for systems with SMM, so no-SMM systems -+ * (such as loong_arch) may not have and not use Global Lock. -+ */ -+ACPI_INIT_GLOBAL(u8, acpi_gbl_use_global_lock, TRUE); -+ - /* - * Maximum timeout for While() loop iterations before forced method abort. - * This mechanism is intended to prevent infinite loops during interpreter -diff --git a/include/asm-generic/io.h b/include/asm-generic/io.h -index bac63e874c7bf9..52db695436bb0b 100644 ---- a/include/asm-generic/io.h -+++ b/include/asm-generic/io.h -@@ -74,6 +74,7 @@ - #if IS_ENABLED(CONFIG_TRACE_MMIO_ACCESS) && !(defined(__DISABLE_TRACE_MMIO__)) - #include - -+#define rwmmio_tracepoint_enabled(tracepoint) tracepoint_enabled(tracepoint) - DECLARE_TRACEPOINT(rwmmio_write); - DECLARE_TRACEPOINT(rwmmio_post_write); - DECLARE_TRACEPOINT(rwmmio_read); -@@ -90,6 +91,7 @@ void log_post_read_mmio(u64 val, u8 width, const volatile void __iomem *addr, - - #else - -+#define rwmmio_tracepoint_enabled(tracepoint) false - static inline void log_write_mmio(u64 val, u8 width, volatile void __iomem *addr, - unsigned long caller_addr, unsigned long caller_addr0) {} - static inline void log_post_write_mmio(u64 val, u8 width, volatile void __iomem *addr, -@@ -188,11 +190,13 @@ static inline u8 readb(const volatile void __iomem *addr) - { - u8 val; - -- log_read_mmio(8, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_read)) -+ log_read_mmio(8, addr, _THIS_IP_, _RET_IP_); - __io_br(); - val = __raw_readb(addr); - __io_ar(val); -- log_post_read_mmio(val, 8, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) -+ log_post_read_mmio(val, 8, addr, _THIS_IP_, _RET_IP_); - return val; - } - #endif -@@ -203,11 +207,13 @@ static inline u16 readw(const volatile void __iomem *addr) - { - u16 val; - -- log_read_mmio(16, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_read)) -+ log_read_mmio(16, addr, _THIS_IP_, _RET_IP_); - __io_br(); - val = __le16_to_cpu((__le16 __force)__raw_readw(addr)); - __io_ar(val); -- log_post_read_mmio(val, 16, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) -+ log_post_read_mmio(val, 16, addr, _THIS_IP_, _RET_IP_); - return val; - } - #endif -@@ -218,11 +224,13 @@ static inline u32 readl(const volatile void __iomem *addr) - { - u32 val; - -- log_read_mmio(32, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_read)) -+ log_read_mmio(32, addr, _THIS_IP_, _RET_IP_); - __io_br(); - val = __le32_to_cpu((__le32 __force)__raw_readl(addr)); - __io_ar(val); -- log_post_read_mmio(val, 32, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) -+ log_post_read_mmio(val, 32, addr, _THIS_IP_, _RET_IP_); - return val; - } - #endif -@@ -234,11 +242,13 @@ static inline u64 readq(const volatile void __iomem *addr) - { - u64 val; - -- log_read_mmio(64, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_read)) -+ log_read_mmio(64, addr, _THIS_IP_, _RET_IP_); - __io_br(); - val = __le64_to_cpu((__le64 __force)__raw_readq(addr)); - __io_ar(val); -- log_post_read_mmio(val, 64, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) -+ log_post_read_mmio(val, 64, addr, _THIS_IP_, _RET_IP_); - return val; - } - #endif -@@ -248,11 +258,13 @@ static inline u64 readq(const volatile void __iomem *addr) - #define writeb writeb - static inline void writeb(u8 value, volatile void __iomem *addr) - { -- log_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_write)) -+ log_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); - __io_bw(); - __raw_writeb(value, addr); - __io_aw(); -- log_post_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) -+ log_post_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); - } - #endif - -@@ -260,11 +272,13 @@ static inline void writeb(u8 value, volatile void __iomem *addr) - #define writew writew - static inline void writew(u16 value, volatile void __iomem *addr) - { -- log_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_write)) -+ log_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); - __io_bw(); - __raw_writew((u16 __force)cpu_to_le16(value), addr); - __io_aw(); -- log_post_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) -+ log_post_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); - } - #endif - -@@ -272,11 +286,13 @@ static inline void writew(u16 value, volatile void __iomem *addr) - #define writel writel - static inline void writel(u32 value, volatile void __iomem *addr) - { -- log_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_write)) -+ log_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); - __io_bw(); - __raw_writel((u32 __force)__cpu_to_le32(value), addr); - __io_aw(); -- log_post_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) -+ log_post_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); - } - #endif - -@@ -285,11 +301,13 @@ static inline void writel(u32 value, volatile void __iomem *addr) - #define writeq writeq - static inline void writeq(u64 value, volatile void __iomem *addr) - { -- log_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_write)) -+ log_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); - __io_bw(); - __raw_writeq((u64 __force)__cpu_to_le64(value), addr); - __io_aw(); -- log_post_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) -+ log_post_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); - } - #endif - #endif /* CONFIG_64BIT */ -@@ -305,9 +323,11 @@ static inline u8 readb_relaxed(const volatile void __iomem *addr) - { - u8 val; - -- log_read_mmio(8, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_read)) -+ log_read_mmio(8, addr, _THIS_IP_, _RET_IP_); - val = __raw_readb(addr); -- log_post_read_mmio(val, 8, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) -+ log_post_read_mmio(val, 8, addr, _THIS_IP_, _RET_IP_); - return val; - } - #endif -@@ -318,9 +338,11 @@ static inline u16 readw_relaxed(const volatile void __iomem *addr) - { - u16 val; - -- log_read_mmio(16, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_read)) -+ log_read_mmio(16, addr, _THIS_IP_, _RET_IP_); - val = __le16_to_cpu((__le16 __force)__raw_readw(addr)); -- log_post_read_mmio(val, 16, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) -+ log_post_read_mmio(val, 16, addr, _THIS_IP_, _RET_IP_); - return val; - } - #endif -@@ -331,9 +353,11 @@ static inline u32 readl_relaxed(const volatile void __iomem *addr) - { - u32 val; - -- log_read_mmio(32, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_read)) -+ log_read_mmio(32, addr, _THIS_IP_, _RET_IP_); - val = __le32_to_cpu((__le32 __force)__raw_readl(addr)); -- log_post_read_mmio(val, 32, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) -+ log_post_read_mmio(val, 32, addr, _THIS_IP_, _RET_IP_); - return val; - } - #endif -@@ -344,9 +368,11 @@ static inline u64 readq_relaxed(const volatile void __iomem *addr) - { - u64 val; - -- log_read_mmio(64, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_read)) -+ log_read_mmio(64, addr, _THIS_IP_, _RET_IP_); - val = __le64_to_cpu((__le64 __force)__raw_readq(addr)); -- log_post_read_mmio(val, 64, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) -+ log_post_read_mmio(val, 64, addr, _THIS_IP_, _RET_IP_); - return val; - } - #endif -@@ -355,9 +381,11 @@ static inline u64 readq_relaxed(const volatile void __iomem *addr) - #define writeb_relaxed writeb_relaxed - static inline void writeb_relaxed(u8 value, volatile void __iomem *addr) - { -- log_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_write)) -+ log_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); - __raw_writeb(value, addr); -- log_post_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) -+ log_post_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); - } - #endif - -@@ -365,9 +393,11 @@ static inline void writeb_relaxed(u8 value, volatile void __iomem *addr) - #define writew_relaxed writew_relaxed - static inline void writew_relaxed(u16 value, volatile void __iomem *addr) - { -- log_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_write)) -+ log_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); - __raw_writew((u16 __force)cpu_to_le16(value), addr); -- log_post_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) -+ log_post_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); - } - #endif - -@@ -375,9 +405,11 @@ static inline void writew_relaxed(u16 value, volatile void __iomem *addr) - #define writel_relaxed writel_relaxed - static inline void writel_relaxed(u32 value, volatile void __iomem *addr) - { -- log_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_write)) -+ log_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); - __raw_writel((u32 __force)__cpu_to_le32(value), addr); -- log_post_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) -+ log_post_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); - } - #endif - -@@ -385,9 +417,11 @@ static inline void writel_relaxed(u32 value, volatile void __iomem *addr) - #define writeq_relaxed writeq_relaxed - static inline void writeq_relaxed(u64 value, volatile void __iomem *addr) - { -- log_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_write)) -+ log_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); - __raw_writeq((u64 __force)__cpu_to_le64(value), addr); -- log_post_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); -+ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) -+ log_post_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); - } - #endif - -diff --git a/include/linux/iio/frequency/adf4350.h b/include/linux/iio/frequency/adf4350.h -index de45cf2ee1e4f8..ce2086f97e3fcf 100644 ---- a/include/linux/iio/frequency/adf4350.h -+++ b/include/linux/iio/frequency/adf4350.h -@@ -51,7 +51,7 @@ - - /* REG3 Bit Definitions */ - #define ADF4350_REG3_12BIT_CLKDIV(x) ((x) << 3) --#define ADF4350_REG3_12BIT_CLKDIV_MODE(x) ((x) << 16) -+#define ADF4350_REG3_12BIT_CLKDIV_MODE(x) ((x) << 15) - #define ADF4350_REG3_12BIT_CSR_EN (1 << 18) - #define ADF4351_REG3_CHARGE_CANCELLATION_EN (1 << 21) - #define ADF4351_REG3_ANTI_BACKLASH_3ns_EN (1 << 22) -diff --git a/include/linux/ksm.h b/include/linux/ksm.h -index b9cdeba03668ae..f74c5222484017 100644 ---- a/include/linux/ksm.h -+++ b/include/linux/ksm.h -@@ -59,6 +59,12 @@ static inline int ksm_fork(struct mm_struct *mm, struct mm_struct *oldmm) - int ret; - - if (test_bit(MMF_VM_MERGEABLE, &oldmm->flags)) { -+ long nr_ksm_zero_pages = atomic_long_read(&mm->ksm_zero_pages); -+ -+ mm->ksm_merging_pages = 0; -+ mm->ksm_rmap_items = 0; -+ atomic_long_add(nr_ksm_zero_pages, &ksm_zero_pages); -+ - ret = __ksm_enter(mm); - if (ret) - return ret; -diff --git a/include/linux/sched.h b/include/linux/sched.h -index cb38eee732fd02..9559501236af08 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -2343,6 +2343,12 @@ enum rseq_event_mask { - RSEQ_EVENT_MIGRATE = (1U << RSEQ_EVENT_MIGRATE_BIT), - }; - -+#ifdef CONFIG_MEMBARRIER -+# define RSEQ_EVENT_GUARD irq -+#else -+# define RSEQ_EVENT_GUARD preempt -+#endif -+ - static inline void rseq_set_notify_resume(struct task_struct *t) - { - if (t->rseq) -@@ -2361,9 +2367,8 @@ static inline void rseq_handle_notify_resume(struct ksignal *ksig, - static inline void rseq_signal_deliver(struct ksignal *ksig, - struct pt_regs *regs) - { -- preempt_disable(); -- __set_bit(RSEQ_EVENT_SIGNAL_BIT, ¤t->rseq_event_mask); -- preempt_enable(); -+ scoped_guard(RSEQ_EVENT_GUARD) -+ __set_bit(RSEQ_EVENT_SIGNAL_BIT, ¤t->rseq_event_mask); - rseq_handle_notify_resume(ksig, regs); - } - -diff --git a/include/media/v4l2-subdev.h b/include/media/v4l2-subdev.h -index 0740dfc6c04881..61a497ec5a2a96 100644 ---- a/include/media/v4l2-subdev.h -+++ b/include/media/v4l2-subdev.h -@@ -1881,19 +1881,23 @@ extern const struct v4l2_subdev_ops v4l2_subdev_call_wrappers; - * - * Note: only legacy non-MC drivers may need this macro. - */ --#define v4l2_subdev_call_state_try(sd, o, f, args...) \ -- ({ \ -- int __result; \ -- static struct lock_class_key __key; \ -- const char *name = KBUILD_BASENAME \ -- ":" __stringify(__LINE__) ":state->lock"; \ -- struct v4l2_subdev_state *state = \ -- __v4l2_subdev_state_alloc(sd, name, &__key); \ -- v4l2_subdev_lock_state(state); \ -- __result = v4l2_subdev_call(sd, o, f, state, ##args); \ -- v4l2_subdev_unlock_state(state); \ -- __v4l2_subdev_state_free(state); \ -- __result; \ -+#define v4l2_subdev_call_state_try(sd, o, f, args...) \ -+ ({ \ -+ int __result; \ -+ static struct lock_class_key __key; \ -+ const char *name = KBUILD_BASENAME \ -+ ":" __stringify(__LINE__) ":state->lock"; \ -+ struct v4l2_subdev_state *state = \ -+ __v4l2_subdev_state_alloc(sd, name, &__key); \ -+ if (IS_ERR(state)) { \ -+ __result = PTR_ERR(state); \ -+ } else { \ -+ v4l2_subdev_lock_state(state); \ -+ __result = v4l2_subdev_call(sd, o, f, state, ##args); \ -+ v4l2_subdev_unlock_state(state); \ -+ __v4l2_subdev_state_free(state); \ -+ } \ -+ __result; \ - }) - - /** -diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h -index c0f4b91e4f5ece..32606d54306057 100644 ---- a/include/net/netfilter/nf_tables.h -+++ b/include/net/netfilter/nf_tables.h -@@ -955,8 +955,7 @@ struct nft_expr_ops { - const struct nft_expr *expr, - bool reset); - int (*validate)(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data); -+ const struct nft_expr *expr); - bool (*reduce)(struct nft_regs_track *track, - const struct nft_expr *expr); - bool (*gc)(struct net *net, -diff --git a/include/net/netfilter/nft_fib.h b/include/net/netfilter/nft_fib.h -index 167640b843ef8a..38cae7113de462 100644 ---- a/include/net/netfilter/nft_fib.h -+++ b/include/net/netfilter/nft_fib.h -@@ -21,9 +21,7 @@ nft_fib_is_loopback(const struct sk_buff *skb, const struct net_device *in) - int nft_fib_dump(struct sk_buff *skb, const struct nft_expr *expr, bool reset); - int nft_fib_init(const struct nft_ctx *ctx, const struct nft_expr *expr, - const struct nlattr * const tb[]); --int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, -- const struct nft_data **data); -- -+int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr); - - void nft_fib4_eval_type(const struct nft_expr *expr, struct nft_regs *regs, - const struct nft_pktinfo *pkt); -diff --git a/include/net/netfilter/nft_meta.h b/include/net/netfilter/nft_meta.h -index ba1238f12a487a..d602263590fed5 100644 ---- a/include/net/netfilter/nft_meta.h -+++ b/include/net/netfilter/nft_meta.h -@@ -41,8 +41,7 @@ void nft_meta_set_destroy(const struct nft_ctx *ctx, - const struct nft_expr *expr); - - int nft_meta_set_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data); -+ const struct nft_expr *expr); - - bool nft_meta_get_reduce(struct nft_regs_track *track, - const struct nft_expr *expr); -diff --git a/include/net/netfilter/nft_reject.h b/include/net/netfilter/nft_reject.h -index 6d9ba62efd7504..19060212988a1e 100644 ---- a/include/net/netfilter/nft_reject.h -+++ b/include/net/netfilter/nft_reject.h -@@ -15,8 +15,7 @@ struct nft_reject { - extern const struct nla_policy nft_reject_policy[]; - - int nft_reject_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data); -+ const struct nft_expr *expr); - - int nft_reject_init(const struct nft_ctx *ctx, - const struct nft_expr *expr, -diff --git a/init/main.c b/init/main.c -index c787e94cc8982b..20d2dd4d9b40f0 100644 ---- a/init/main.c -+++ b/init/main.c -@@ -530,6 +530,12 @@ static int __init unknown_bootoption(char *param, char *val, - const char *unused, void *arg) - { - size_t len = strlen(param); -+ /* -+ * Well-known bootloader identifiers: -+ * 1. LILO/Grub pass "BOOT_IMAGE=..."; -+ * 2. kexec/kdump (kexec-tools) pass "kexec". -+ */ -+ const char *bootloader[] = { "BOOT_IMAGE=", "kexec", NULL }; - - /* Handle params aliased to sysctls */ - if (sysctl_is_alias(param)) -@@ -537,6 +543,12 @@ static int __init unknown_bootoption(char *param, char *val, - - repair_env_string(param, val); - -+ /* Handle bootloader identifier */ -+ for (int i = 0; bootloader[i]; i++) { -+ if (strstarts(param, bootloader[i])) -+ return 0; -+ } -+ - /* Handle obsolete-style parameters */ - if (obsolete_checksetup(param)) - return 0; -diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c -index 99d0625b6c828f..9a9630adcba4f6 100644 ---- a/kernel/bpf/inode.c -+++ b/kernel/bpf/inode.c -@@ -607,7 +607,7 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root) - return 0; - } - --static void bpf_free_inode(struct inode *inode) -+static void bpf_destroy_inode(struct inode *inode) - { - enum bpf_type type; - -@@ -622,7 +622,7 @@ static const struct super_operations bpf_super_ops = { - .statfs = simple_statfs, - .drop_inode = generic_delete_inode, - .show_options = bpf_show_options, -- .free_inode = bpf_free_inode, -+ .destroy_inode = bpf_destroy_inode, - }; - - enum { -diff --git a/kernel/fork.c b/kernel/fork.c -index 0e20d7e9460848..2141ebb2ef92ad 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -1799,7 +1799,7 @@ static int copy_files(unsigned long clone_flags, struct task_struct *tsk, - return 0; - } - --static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk) -+static int copy_sighand(u64 clone_flags, struct task_struct *tsk) - { - struct sighand_struct *sig; - -diff --git a/kernel/pid.c b/kernel/pid.c -index 6500ef956f2f88..e57adc00cb779b 100644 ---- a/kernel/pid.c -+++ b/kernel/pid.c -@@ -477,7 +477,7 @@ pid_t pid_nr_ns(struct pid *pid, struct pid_namespace *ns) - struct upid *upid; - pid_t nr = 0; - -- if (pid && ns->level <= pid->level) { -+ if (pid && ns && ns->level <= pid->level) { - upid = &pid->numbers[ns->level]; - if (upid->ns == ns) - nr = upid->nr; -diff --git a/kernel/rseq.c b/kernel/rseq.c -index 23894ba8250cf9..810005f927d7cc 100644 ---- a/kernel/rseq.c -+++ b/kernel/rseq.c -@@ -255,12 +255,12 @@ static int rseq_need_restart(struct task_struct *t, u32 cs_flags) - - /* - * Load and clear event mask atomically with respect to -- * scheduler preemption. -+ * scheduler preemption and membarrier IPIs. - */ -- preempt_disable(); -- event_mask = t->rseq_event_mask; -- t->rseq_event_mask = 0; -- preempt_enable(); -+ scoped_guard(RSEQ_EVENT_GUARD) { -+ event_mask = t->rseq_event_mask; -+ t->rseq_event_mask = 0; -+ } - - return !!event_mask; - } -diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c -index a15cf7969953a5..5bb9735e19d2f5 100644 ---- a/kernel/sched/deadline.c -+++ b/kernel/sched/deadline.c -@@ -2214,6 +2214,25 @@ static int find_later_rq(struct task_struct *task) - return -1; - } - -+static struct task_struct *pick_next_pushable_dl_task(struct rq *rq) -+{ -+ struct task_struct *p; -+ -+ if (!has_pushable_dl_tasks(rq)) -+ return NULL; -+ -+ p = __node_2_pdl(rb_first_cached(&rq->dl.pushable_dl_tasks_root)); -+ -+ WARN_ON_ONCE(rq->cpu != task_cpu(p)); -+ WARN_ON_ONCE(task_current(rq, p)); -+ WARN_ON_ONCE(p->nr_cpus_allowed <= 1); -+ -+ WARN_ON_ONCE(!task_on_rq_queued(p)); -+ WARN_ON_ONCE(!dl_task(p)); -+ -+ return p; -+} -+ - /* Locks the rq it finds */ - static struct rq *find_lock_later_rq(struct task_struct *task, struct rq *rq) - { -@@ -2241,12 +2260,37 @@ static struct rq *find_lock_later_rq(struct task_struct *task, struct rq *rq) - - /* Retry if something changed. */ - if (double_lock_balance(rq, later_rq)) { -- if (unlikely(task_rq(task) != rq || -+ /* -+ * double_lock_balance had to release rq->lock, in the -+ * meantime, task may no longer be fit to be migrated. -+ * Check the following to ensure that the task is -+ * still suitable for migration: -+ * 1. It is possible the task was scheduled, -+ * migrate_disabled was set and then got preempted, -+ * so we must check the task migration disable -+ * flag. -+ * 2. The CPU picked is in the task's affinity. -+ * 3. For throttled task (dl_task_offline_migration), -+ * check the following: -+ * - the task is not on the rq anymore (it was -+ * migrated) -+ * - the task is not on CPU anymore -+ * - the task is still a dl task -+ * - the task is not queued on the rq anymore -+ * 4. For the non-throttled task (push_dl_task), the -+ * check to ensure that this task is still at the -+ * head of the pushable tasks list is enough. -+ */ -+ if (unlikely(is_migration_disabled(task) || - !cpumask_test_cpu(later_rq->cpu, &task->cpus_mask) || -- task_on_cpu(rq, task) || -- !dl_task(task) || -- is_migration_disabled(task) || -- !task_on_rq_queued(task))) { -+ (task->dl.dl_throttled && -+ (task_rq(task) != rq || -+ task_on_cpu(rq, task) || -+ !dl_task(task) || -+ !task_on_rq_queued(task))) || -+ (!task->dl.dl_throttled && -+ task != pick_next_pushable_dl_task(rq)))) { -+ - double_unlock_balance(rq, later_rq); - later_rq = NULL; - break; -@@ -2269,25 +2313,6 @@ static struct rq *find_lock_later_rq(struct task_struct *task, struct rq *rq) - return later_rq; - } - --static struct task_struct *pick_next_pushable_dl_task(struct rq *rq) --{ -- struct task_struct *p; -- -- if (!has_pushable_dl_tasks(rq)) -- return NULL; -- -- p = __node_2_pdl(rb_first_cached(&rq->dl.pushable_dl_tasks_root)); -- -- WARN_ON_ONCE(rq->cpu != task_cpu(p)); -- WARN_ON_ONCE(task_current(rq, p)); -- WARN_ON_ONCE(p->nr_cpus_allowed <= 1); -- -- WARN_ON_ONCE(!task_on_rq_queued(p)); -- WARN_ON_ONCE(!dl_task(p)); -- -- return p; --} -- - /* - * See if the non running -deadline tasks on this rq - * can be sent to some other CPU where they can preempt -diff --git a/kernel/sys.c b/kernel/sys.c -index 355de0b65c2358..47cb10a16b009d 100644 ---- a/kernel/sys.c -+++ b/kernel/sys.c -@@ -1689,6 +1689,7 @@ SYSCALL_DEFINE4(prlimit64, pid_t, pid, unsigned int, resource, - struct rlimit old, new; - struct task_struct *tsk; - unsigned int checkflags = 0; -+ bool need_tasklist; - int ret; - - if (old_rlim) -@@ -1715,8 +1716,25 @@ SYSCALL_DEFINE4(prlimit64, pid_t, pid, unsigned int, resource, - get_task_struct(tsk); - rcu_read_unlock(); - -- ret = do_prlimit(tsk, resource, new_rlim ? &new : NULL, -- old_rlim ? &old : NULL); -+ need_tasklist = !same_thread_group(tsk, current); -+ if (need_tasklist) { -+ /* -+ * Ensure we can't race with group exit or de_thread(), -+ * so tsk->group_leader can't be freed or changed until -+ * read_unlock(tasklist_lock) below. -+ */ -+ read_lock(&tasklist_lock); -+ if (!pid_alive(tsk)) -+ ret = -ESRCH; -+ } -+ -+ if (!ret) { -+ ret = do_prlimit(tsk, resource, new_rlim ? &new : NULL, -+ old_rlim ? &old : NULL); -+ } -+ -+ if (need_tasklist) -+ read_unlock(&tasklist_lock); - - if (!ret && old_rlim) { - rlim_to_rlim64(&old, &old64); -diff --git a/kernel/trace/trace_fprobe.c b/kernel/trace/trace_fprobe.c -index 93620a78358769..a233262f858c86 100644 ---- a/kernel/trace/trace_fprobe.c -+++ b/kernel/trace/trace_fprobe.c -@@ -342,12 +342,14 @@ static int fentry_dispatcher(struct fprobe *fp, unsigned long entry_ip, - void *entry_data) - { - struct trace_fprobe *tf = container_of(fp, struct trace_fprobe, fp); -+ unsigned int flags = trace_probe_load_flag(&tf->tp); - int ret = 0; - -- if (trace_probe_test_flag(&tf->tp, TP_FLAG_TRACE)) -+ if (flags & TP_FLAG_TRACE) - fentry_trace_func(tf, entry_ip, regs); -+ - #ifdef CONFIG_PERF_EVENTS -- if (trace_probe_test_flag(&tf->tp, TP_FLAG_PROFILE)) -+ if (flags & TP_FLAG_PROFILE) - ret = fentry_perf_func(tf, entry_ip, regs); - #endif - return ret; -@@ -359,11 +361,12 @@ static void fexit_dispatcher(struct fprobe *fp, unsigned long entry_ip, - void *entry_data) - { - struct trace_fprobe *tf = container_of(fp, struct trace_fprobe, fp); -+ unsigned int flags = trace_probe_load_flag(&tf->tp); - -- if (trace_probe_test_flag(&tf->tp, TP_FLAG_TRACE)) -+ if (flags & TP_FLAG_TRACE) - fexit_trace_func(tf, entry_ip, ret_ip, regs, entry_data); - #ifdef CONFIG_PERF_EVENTS -- if (trace_probe_test_flag(&tf->tp, TP_FLAG_PROFILE)) -+ if (flags & TP_FLAG_PROFILE) - fexit_perf_func(tf, entry_ip, ret_ip, regs, entry_data); - #endif - } -diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c -index 46491f3c1569cd..20dbe40ab15e8e 100644 ---- a/kernel/trace/trace_kprobe.c -+++ b/kernel/trace/trace_kprobe.c -@@ -1713,14 +1713,15 @@ static int kprobe_register(struct trace_event_call *event, - static int kprobe_dispatcher(struct kprobe *kp, struct pt_regs *regs) - { - struct trace_kprobe *tk = container_of(kp, struct trace_kprobe, rp.kp); -+ unsigned int flags = trace_probe_load_flag(&tk->tp); - int ret = 0; - - raw_cpu_inc(*tk->nhit); - -- if (trace_probe_test_flag(&tk->tp, TP_FLAG_TRACE)) -+ if (flags & TP_FLAG_TRACE) - kprobe_trace_func(tk, regs); - #ifdef CONFIG_PERF_EVENTS -- if (trace_probe_test_flag(&tk->tp, TP_FLAG_PROFILE)) -+ if (flags & TP_FLAG_PROFILE) - ret = kprobe_perf_func(tk, regs); - #endif - return ret; -@@ -1732,6 +1733,7 @@ kretprobe_dispatcher(struct kretprobe_instance *ri, struct pt_regs *regs) - { - struct kretprobe *rp = get_kretprobe(ri); - struct trace_kprobe *tk; -+ unsigned int flags; - - /* - * There is a small chance that get_kretprobe(ri) returns NULL when -@@ -1744,10 +1746,11 @@ kretprobe_dispatcher(struct kretprobe_instance *ri, struct pt_regs *regs) - tk = container_of(rp, struct trace_kprobe, rp); - raw_cpu_inc(*tk->nhit); - -- if (trace_probe_test_flag(&tk->tp, TP_FLAG_TRACE)) -+ flags = trace_probe_load_flag(&tk->tp); -+ if (flags & TP_FLAG_TRACE) - kretprobe_trace_func(tk, ri, regs); - #ifdef CONFIG_PERF_EVENTS -- if (trace_probe_test_flag(&tk->tp, TP_FLAG_PROFILE)) -+ if (flags & TP_FLAG_PROFILE) - kretprobe_perf_func(tk, ri, regs); - #endif - return 0; /* We don't tweak kernel, so just return 0 */ -diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h -index 48afed3c3f88ec..c71fa9c2f3815b 100644 ---- a/kernel/trace/trace_probe.h -+++ b/kernel/trace/trace_probe.h -@@ -268,16 +268,21 @@ struct event_file_link { - struct list_head list; - }; - -+static inline unsigned int trace_probe_load_flag(struct trace_probe *tp) -+{ -+ return smp_load_acquire(&tp->event->flags); -+} -+ - static inline bool trace_probe_test_flag(struct trace_probe *tp, - unsigned int flag) - { -- return !!(tp->event->flags & flag); -+ return !!(trace_probe_load_flag(tp) & flag); - } - - static inline void trace_probe_set_flag(struct trace_probe *tp, - unsigned int flag) - { -- tp->event->flags |= flag; -+ smp_store_release(&tp->event->flags, tp->event->flags | flag); - } - - static inline void trace_probe_clear_flag(struct trace_probe *tp, -diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c -index ecf04e81ddf705..03d79a9ebd8c82 100644 ---- a/kernel/trace/trace_uprobe.c -+++ b/kernel/trace/trace_uprobe.c -@@ -1514,6 +1514,7 @@ static int uprobe_dispatcher(struct uprobe_consumer *con, struct pt_regs *regs) - struct trace_uprobe *tu; - struct uprobe_dispatch_data udd; - struct uprobe_cpu_buffer *ucb = NULL; -+ unsigned int flags; - int ret = 0; - - tu = container_of(con, struct trace_uprobe, consumer); -@@ -1527,11 +1528,12 @@ static int uprobe_dispatcher(struct uprobe_consumer *con, struct pt_regs *regs) - if (WARN_ON_ONCE(!uprobe_cpu_buffer)) - return 0; - -- if (trace_probe_test_flag(&tu->tp, TP_FLAG_TRACE)) -+ flags = trace_probe_load_flag(&tu->tp); -+ if (flags & TP_FLAG_TRACE) - ret |= uprobe_trace_func(tu, regs, &ucb); - - #ifdef CONFIG_PERF_EVENTS -- if (trace_probe_test_flag(&tu->tp, TP_FLAG_PROFILE)) -+ if (flags & TP_FLAG_PROFILE) - ret |= uprobe_perf_func(tu, regs, &ucb); - #endif - uprobe_buffer_put(ucb); -@@ -1544,6 +1546,7 @@ static int uretprobe_dispatcher(struct uprobe_consumer *con, - struct trace_uprobe *tu; - struct uprobe_dispatch_data udd; - struct uprobe_cpu_buffer *ucb = NULL; -+ unsigned int flags; - - tu = container_of(con, struct trace_uprobe, consumer); - -@@ -1555,11 +1558,12 @@ static int uretprobe_dispatcher(struct uprobe_consumer *con, - if (WARN_ON_ONCE(!uprobe_cpu_buffer)) - return 0; - -- if (trace_probe_test_flag(&tu->tp, TP_FLAG_TRACE)) -+ flags = trace_probe_load_flag(&tu->tp); -+ if (flags & TP_FLAG_TRACE) - uretprobe_trace_func(tu, func, regs, &ucb); - - #ifdef CONFIG_PERF_EVENTS -- if (trace_probe_test_flag(&tu->tp, TP_FLAG_PROFILE)) -+ if (flags & TP_FLAG_PROFILE) - uretprobe_perf_func(tu, func, regs, &ucb); - #endif - uprobe_buffer_put(ucb); -diff --git a/lib/crypto/Makefile b/lib/crypto/Makefile -index 8d1446c2be7193..88246000c9d8eb 100644 ---- a/lib/crypto/Makefile -+++ b/lib/crypto/Makefile -@@ -30,6 +30,10 @@ obj-$(CONFIG_CRYPTO_LIB_CURVE25519_GENERIC) += libcurve25519-generic.o - libcurve25519-generic-y := curve25519-fiat32.o - libcurve25519-generic-$(CONFIG_ARCH_SUPPORTS_INT128) := curve25519-hacl64.o - libcurve25519-generic-y += curve25519-generic.o -+# clang versions prior to 18 may blow out the stack with KASAN -+ifeq ($(call clang-min-version, 180000),) -+KASAN_SANITIZE_curve25519-hacl64.o := n -+endif - - obj-$(CONFIG_CRYPTO_LIB_CURVE25519) += libcurve25519.o - libcurve25519-y += curve25519.o -diff --git a/lib/genalloc.c b/lib/genalloc.c -index 4fa5635bf81bd6..841f2978383334 100644 ---- a/lib/genalloc.c -+++ b/lib/genalloc.c -@@ -899,8 +899,11 @@ struct gen_pool *of_gen_pool_get(struct device_node *np, - if (!name) - name = of_node_full_name(np_pool); - } -- if (pdev) -+ if (pdev) { - pool = gen_pool_get(&pdev->dev, name); -+ put_device(&pdev->dev); -+ } -+ - of_node_put(np_pool); - - return pool; -diff --git a/mm/damon/vaddr.c b/mm/damon/vaddr.c -index 5764b9885e7d21..4d7dc9f65f682e 100644 ---- a/mm/damon/vaddr.c -+++ b/mm/damon/vaddr.c -@@ -324,10 +324,8 @@ static int damon_mkold_pmd_entry(pmd_t *pmd, unsigned long addr, - } - - pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl); -- if (!pte) { -- walk->action = ACTION_AGAIN; -+ if (!pte) - return 0; -- } - if (!pte_present(ptep_get(pte))) - goto out; - damon_ptep_mkold(pte, walk->vma, addr); -@@ -479,10 +477,8 @@ static int damon_young_pmd_entry(pmd_t *pmd, unsigned long addr, - #endif /* CONFIG_TRANSPARENT_HUGEPAGE */ - - pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl); -- if (!pte) { -- walk->action = ACTION_AGAIN; -+ if (!pte) - return 0; -- } - ptent = ptep_get(pte); - if (!pte_present(ptent)) - goto out; -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index 0c6745a6a13a59..532a840a426646 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -3298,6 +3298,9 @@ static void __init hugetlb_hstate_alloc_pages(struct hstate *h) - return; - } - -+ if (!h->max_huge_pages) -+ return; -+ - /* do node specific alloc */ - for_each_online_node(i) { - if (h->max_huge_pages_node[i] > 0) { -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 44011ebecddf01..93cb65c6553ec3 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -3738,7 +3738,7 @@ gfp_to_alloc_flags(gfp_t gfp_mask, unsigned int order) - if (!(gfp_mask & __GFP_NOMEMALLOC)) { - alloc_flags |= ALLOC_NON_BLOCK; - -- if (order > 0) -+ if (order > 0 && (alloc_flags & ALLOC_MIN_RESERVE)) - alloc_flags |= ALLOC_HIGHATOMIC; - } - -diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c -index a1c22eab71ffec..cc54b8267bcc7b 100644 ---- a/net/bridge/br_vlan.c -+++ b/net/bridge/br_vlan.c -@@ -1455,7 +1455,7 @@ void br_vlan_fill_forward_path_pvid(struct net_bridge *br, - if (!br_opt_get(br, BROPT_VLAN_ENABLED)) - return; - -- vg = br_vlan_group(br); -+ vg = br_vlan_group_rcu(br); - - if (idx >= 0 && - ctx->vlan[idx].proto == br->vlan_proto) { -diff --git a/net/bridge/netfilter/nft_meta_bridge.c b/net/bridge/netfilter/nft_meta_bridge.c -index bd4d1b4d745f64..affb740c8685eb 100644 ---- a/net/bridge/netfilter/nft_meta_bridge.c -+++ b/net/bridge/netfilter/nft_meta_bridge.c -@@ -168,8 +168,7 @@ static bool nft_meta_bridge_set_reduce(struct nft_regs_track *track, - } - - static int nft_meta_bridge_set_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data) -+ const struct nft_expr *expr) - { - struct nft_meta *priv = nft_expr_priv(expr); - unsigned int hooks; -@@ -179,7 +178,7 @@ static int nft_meta_bridge_set_validate(const struct nft_ctx *ctx, - hooks = 1 << NF_BR_PRE_ROUTING; - break; - default: -- return nft_meta_set_validate(ctx, expr, data); -+ return nft_meta_set_validate(ctx, expr); - } - - return nft_chain_validate_hooks(ctx->chain, hooks); -diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c -index 71b54fed7263df..1cb5c16e97b7fa 100644 ---- a/net/bridge/netfilter/nft_reject_bridge.c -+++ b/net/bridge/netfilter/nft_reject_bridge.c -@@ -170,8 +170,7 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr, - } - - static int nft_reject_bridge_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data) -+ const struct nft_expr *expr) - { - return nft_chain_validate_hooks(ctx->chain, (1 << NF_BR_PRE_ROUTING) | - (1 << NF_BR_LOCAL_IN)); -diff --git a/net/core/filter.c b/net/core/filter.c -index b6dbcef649654c..c2e888ea54abbf 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -2273,6 +2273,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev, - if (IS_ERR(dst)) - goto out_drop; - -+ skb_dst_drop(skb); - skb_dst_set(skb, dst); - } else if (nh->nh_family != AF_INET6) { - goto out_drop; -@@ -2382,6 +2383,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev, - goto out_drop; - } - -+ skb_dst_drop(skb); - skb_dst_set(skb, &rt->dst); - } - -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 7d824578f217a8..5dde0aed314405 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -1724,6 +1724,7 @@ EXPORT_SYMBOL(tcp_peek_len); - /* Make sure sk_rcvbuf is big enough to satisfy SO_RCVLOWAT hint */ - int tcp_set_rcvlowat(struct sock *sk, int val) - { -+ struct tcp_sock *tp = tcp_sk(sk); - int space, cap; - - if (sk->sk_userlocks & SOCK_RCVBUF_LOCK) -@@ -1742,7 +1743,9 @@ int tcp_set_rcvlowat(struct sock *sk, int val) - space = tcp_space_from_win(sk, val); - if (space > sk->sk_rcvbuf) { - WRITE_ONCE(sk->sk_rcvbuf, space); -- WRITE_ONCE(tcp_sk(sk)->window_clamp, val); -+ -+ if (tp->window_clamp && tp->window_clamp < val) -+ WRITE_ONCE(tp->window_clamp, val); - } - return 0; - } -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index c6d00817ad3fd9..8834cd41b38408 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -7200,7 +7200,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, - &foc, TCP_SYNACK_FASTOPEN, skb); - /* Add the child socket directly into the accept queue */ - if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) { -- reqsk_fastopen_remove(fastopen_sk, req, false); - bh_unlock_sock(fastopen_sk); - sock_put(fastopen_sk); - goto drop_and_free; -diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c -index 29c167e5fc0255..ab7bdb6531816d 100644 ---- a/net/mptcp/pm.c -+++ b/net/mptcp/pm.c -@@ -227,9 +227,12 @@ void mptcp_pm_add_addr_received(const struct sock *ssk, - } else { - __MPTCP_INC_STATS(sock_net((struct sock *)msk), MPTCP_MIB_ADDADDRDROP); - } -- /* id0 should not have a different address */ -+ /* - id0 should not have a different address -+ * - special case for C-flag: linked to fill_local_addresses_vec() -+ */ - } else if ((addr->id == 0 && !mptcp_pm_nl_is_init_remote_addr(msk, addr)) || -- (addr->id > 0 && !READ_ONCE(pm->accept_addr))) { -+ (addr->id > 0 && !READ_ONCE(pm->accept_addr) && -+ !mptcp_pm_add_addr_c_flag_case(msk))) { - mptcp_pm_announce_addr(msk, addr, true); - mptcp_pm_add_addr_send_ack(msk); - } else if (mptcp_pm_schedule_work(msk, MPTCP_PM_ADD_ADDR_RECEIVED)) { -diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c -index de24989b05a600..9d2c38421f7a2b 100644 ---- a/net/mptcp/pm_netlink.c -+++ b/net/mptcp/pm_netlink.c -@@ -675,10 +675,12 @@ static unsigned int fill_local_addresses_vec(struct mptcp_sock *msk, - struct mptcp_addr_info mpc_addr; - struct pm_nl_pernet *pernet; - unsigned int subflows_max; -+ bool c_flag_case; - int i = 0; - - pernet = pm_nl_get_pernet_from_msk(msk); - subflows_max = mptcp_pm_get_subflows_max(msk); -+ c_flag_case = remote->id && mptcp_pm_add_addr_c_flag_case(msk); - - mptcp_local_address((struct sock_common *)msk, &mpc_addr); - -@@ -691,11 +693,26 @@ static unsigned int fill_local_addresses_vec(struct mptcp_sock *msk, - continue; - - if (msk->pm.subflows < subflows_max) { -+ bool is_id0; -+ - msk->pm.subflows++; - addrs[i] = entry->addr; - -+ is_id0 = mptcp_addresses_equal(&entry->addr, -+ &mpc_addr, -+ entry->addr.port); -+ -+ if (c_flag_case && -+ (entry->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW)) { -+ __clear_bit(addrs[i].id, -+ msk->pm.id_avail_bitmap); -+ -+ if (!is_id0) -+ msk->pm.local_addr_used++; -+ } -+ - /* Special case for ID0: set the correct ID */ -- if (mptcp_addresses_equal(&entry->addr, &mpc_addr, entry->addr.port)) -+ if (is_id0) - addrs[i].id = 0; - - i++; -@@ -703,6 +720,39 @@ static unsigned int fill_local_addresses_vec(struct mptcp_sock *msk, - } - rcu_read_unlock(); - -+ /* Special case: peer sets the C flag, accept one ADD_ADDR if default -+ * limits are used -- accepting no ADD_ADDR -- and use subflow endpoints -+ */ -+ if (!i && c_flag_case) { -+ unsigned int local_addr_max = mptcp_pm_get_local_addr_max(msk); -+ -+ while (msk->pm.local_addr_used < local_addr_max && -+ msk->pm.subflows < subflows_max) { -+ struct mptcp_pm_addr_entry local; -+ -+ if (!select_local_address(pernet, msk, &local)) -+ break; -+ -+ __clear_bit(local.addr.id, msk->pm.id_avail_bitmap); -+ -+ if (!mptcp_pm_addr_families_match(sk, &local.addr, -+ remote)) -+ continue; -+ -+ if (mptcp_addresses_equal(&local.addr, &mpc_addr, -+ local.addr.port)) -+ continue; -+ -+ addrs[i] = local.addr; -+ -+ msk->pm.local_addr_used++; -+ msk->pm.subflows++; -+ i++; -+ } -+ -+ return i; -+ } -+ - /* If the array is empty, fill in the single - * 'IPADDRANY' local address - */ -diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h -index c5f41cdb36c4b1..1f213706dfaa52 100644 ---- a/net/mptcp/protocol.h -+++ b/net/mptcp/protocol.h -@@ -1080,6 +1080,14 @@ static inline void mptcp_pm_close_subflow(struct mptcp_sock *msk) - spin_unlock_bh(&msk->pm.lock); - } - -+static inline bool mptcp_pm_add_addr_c_flag_case(struct mptcp_sock *msk) -+{ -+ return READ_ONCE(msk->pm.remote_deny_join_id0) && -+ msk->pm.local_addr_used == 0 && -+ mptcp_pm_get_add_addr_accept_max(msk) == 0 && -+ msk->pm.subflows < mptcp_pm_get_subflows_max(msk); -+} -+ - void mptcp_sockopt_sync(struct mptcp_sock *msk, struct sock *ssk); - void mptcp_sockopt_sync_locked(struct mptcp_sock *msk, struct sock *ssk); - -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 4ffb5ef79ca13f..5ca1d775e976d4 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -3793,7 +3793,6 @@ static void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *r - int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) - { - struct nft_expr *expr, *last; -- const struct nft_data *data; - struct nft_rule *rule; - int err; - -@@ -3814,7 +3813,7 @@ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) - /* This may call nft_chain_validate() recursively, - * callers that do so must increment ctx->level. - */ -- err = expr->ops->validate(ctx, expr, &data); -+ err = expr->ops->validate(ctx, expr); - if (err < 0) - return err; - } -diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c -index d3d11dede54507..52cdfee17f73f1 100644 ---- a/net/netfilter/nft_compat.c -+++ b/net/netfilter/nft_compat.c -@@ -350,8 +350,7 @@ static int nft_target_dump(struct sk_buff *skb, - } - - static int nft_target_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data) -+ const struct nft_expr *expr) - { - struct xt_target *target = expr->ops->data; - unsigned int hook_mask = 0; -@@ -611,8 +610,7 @@ static int nft_match_large_dump(struct sk_buff *skb, - } - - static int nft_match_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data) -+ const struct nft_expr *expr) - { - struct xt_match *match = expr->ops->data; - unsigned int hook_mask = 0; -diff --git a/net/netfilter/nft_fib.c b/net/netfilter/nft_fib.c -index bf825f6cb974ea..507b7eba9bcdcb 100644 ---- a/net/netfilter/nft_fib.c -+++ b/net/netfilter/nft_fib.c -@@ -26,8 +26,7 @@ const struct nla_policy nft_fib_policy[NFTA_FIB_MAX + 1] = { - }; - EXPORT_SYMBOL(nft_fib_policy); - --int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, -- const struct nft_data **data) -+int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr) - { - const struct nft_fib *priv = nft_expr_priv(expr); - unsigned int hooks; -diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c -index 5a3d6854204202..1894032a7971c6 100644 ---- a/net/netfilter/nft_flow_offload.c -+++ b/net/netfilter/nft_flow_offload.c -@@ -385,8 +385,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, - } - - static int nft_flow_offload_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data) -+ const struct nft_expr *expr) - { - unsigned int hook_mask = (1 << NF_INET_FORWARD); - -diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c -index a5268e6dd32f1b..fa9e4ae00b16a9 100644 ---- a/net/netfilter/nft_fwd_netdev.c -+++ b/net/netfilter/nft_fwd_netdev.c -@@ -204,8 +204,7 @@ static int nft_fwd_neigh_dump(struct sk_buff *skb, - } - - static int nft_fwd_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data) -+ const struct nft_expr *expr) - { - return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS) | - (1 << NF_NETDEV_EGRESS)); -diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c -index ac2422c215e545..02ee5fb69871f8 100644 ---- a/net/netfilter/nft_immediate.c -+++ b/net/netfilter/nft_immediate.c -@@ -244,8 +244,7 @@ static int nft_immediate_dump(struct sk_buff *skb, - } - - static int nft_immediate_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **d) -+ const struct nft_expr *expr) - { - const struct nft_immediate_expr *priv = nft_expr_priv(expr); - struct nft_ctx *pctx = (struct nft_ctx *)ctx; -diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c -index 1b9edf2b339373..dd5441f92fdb06 100644 ---- a/net/netfilter/nft_lookup.c -+++ b/net/netfilter/nft_lookup.c -@@ -206,8 +206,7 @@ static int nft_lookup_dump(struct sk_buff *skb, - } - - static int nft_lookup_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **d) -+ const struct nft_expr *expr) - { - const struct nft_lookup *priv = nft_expr_priv(expr); - struct nft_set_iter iter; -diff --git a/net/netfilter/nft_masq.c b/net/netfilter/nft_masq.c -index 8a14aaca93bbdf..eee05394c53390 100644 ---- a/net/netfilter/nft_masq.c -+++ b/net/netfilter/nft_masq.c -@@ -27,8 +27,7 @@ static const struct nla_policy nft_masq_policy[NFTA_MASQ_MAX + 1] = { - }; - - static int nft_masq_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data) -+ const struct nft_expr *expr) - { - int err; - -diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c -index 9139ce38ea7b9a..dec76d28a0ac64 100644 ---- a/net/netfilter/nft_meta.c -+++ b/net/netfilter/nft_meta.c -@@ -581,8 +581,7 @@ static int nft_meta_get_validate_xfrm(const struct nft_ctx *ctx) - } - - static int nft_meta_get_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data) -+ const struct nft_expr *expr) - { - const struct nft_meta *priv = nft_expr_priv(expr); - -@@ -600,8 +599,7 @@ static int nft_meta_get_validate(const struct nft_ctx *ctx, - } - - int nft_meta_set_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data) -+ const struct nft_expr *expr) - { - struct nft_meta *priv = nft_expr_priv(expr); - unsigned int hooks; -diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c -index 808f5802c2704a..3d3e639a7a8370 100644 ---- a/net/netfilter/nft_nat.c -+++ b/net/netfilter/nft_nat.c -@@ -137,8 +137,7 @@ static const struct nla_policy nft_nat_policy[NFTA_NAT_MAX + 1] = { - }; - - static int nft_nat_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data) -+ const struct nft_expr *expr) - { - struct nft_nat *priv = nft_expr_priv(expr); - int err; -diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c -index 509011b1ef597c..08a27433e2f5fc 100644 ---- a/net/netfilter/nft_objref.c -+++ b/net/netfilter/nft_objref.c -@@ -22,6 +22,35 @@ void nft_objref_eval(const struct nft_expr *expr, - obj->ops->eval(obj, regs, pkt); - } - -+static int nft_objref_validate_obj_type(const struct nft_ctx *ctx, u32 type) -+{ -+ unsigned int hooks; -+ -+ switch (type) { -+ case NFT_OBJECT_SYNPROXY: -+ if (ctx->family != NFPROTO_IPV4 && -+ ctx->family != NFPROTO_IPV6 && -+ ctx->family != NFPROTO_INET) -+ return -EOPNOTSUPP; -+ -+ hooks = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD); -+ -+ return nft_chain_validate_hooks(ctx->chain, hooks); -+ default: -+ break; -+ } -+ -+ return 0; -+} -+ -+static int nft_objref_validate(const struct nft_ctx *ctx, -+ const struct nft_expr *expr) -+{ -+ struct nft_object *obj = nft_objref_priv(expr); -+ -+ return nft_objref_validate_obj_type(ctx, obj->ops->type->type); -+} -+ - static int nft_objref_init(const struct nft_ctx *ctx, - const struct nft_expr *expr, - const struct nlattr * const tb[]) -@@ -93,6 +122,7 @@ static const struct nft_expr_ops nft_objref_ops = { - .activate = nft_objref_activate, - .deactivate = nft_objref_deactivate, - .dump = nft_objref_dump, -+ .validate = nft_objref_validate, - .reduce = NFT_REDUCE_READONLY, - }; - -@@ -198,6 +228,14 @@ static void nft_objref_map_destroy(const struct nft_ctx *ctx, - nf_tables_destroy_set(ctx, priv->set); - } - -+static int nft_objref_map_validate(const struct nft_ctx *ctx, -+ const struct nft_expr *expr) -+{ -+ const struct nft_objref_map *priv = nft_expr_priv(expr); -+ -+ return nft_objref_validate_obj_type(ctx, priv->set->objtype); -+} -+ - static const struct nft_expr_ops nft_objref_map_ops = { - .type = &nft_objref_type, - .size = NFT_EXPR_SIZE(sizeof(struct nft_objref_map)), -@@ -207,6 +245,7 @@ static const struct nft_expr_ops nft_objref_map_ops = { - .deactivate = nft_objref_map_deactivate, - .destroy = nft_objref_map_destroy, - .dump = nft_objref_map_dump, -+ .validate = nft_objref_map_validate, - .reduce = NFT_REDUCE_READONLY, - }; - -diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c -index 7f61506e5b44bd..123b4f47ccef4c 100644 ---- a/net/netfilter/nft_osf.c -+++ b/net/netfilter/nft_osf.c -@@ -113,8 +113,7 @@ static int nft_osf_dump(struct sk_buff *skb, - } - - static int nft_osf_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data) -+ const struct nft_expr *expr) - { - unsigned int hooks; - -diff --git a/net/netfilter/nft_queue.c b/net/netfilter/nft_queue.c -index b2b8127c8d4381..b8ebb187814f29 100644 ---- a/net/netfilter/nft_queue.c -+++ b/net/netfilter/nft_queue.c -@@ -69,8 +69,7 @@ static void nft_queue_sreg_eval(const struct nft_expr *expr, - } - - static int nft_queue_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data) -+ const struct nft_expr *expr) - { - static const unsigned int supported_hooks = ((1 << NF_INET_PRE_ROUTING) | - (1 << NF_INET_LOCAL_IN) | -diff --git a/net/netfilter/nft_redir.c b/net/netfilter/nft_redir.c -index a58bd8d291ff2d..9051863509f319 100644 ---- a/net/netfilter/nft_redir.c -+++ b/net/netfilter/nft_redir.c -@@ -27,8 +27,7 @@ static const struct nla_policy nft_redir_policy[NFTA_REDIR_MAX + 1] = { - }; - - static int nft_redir_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data) -+ const struct nft_expr *expr) - { - int err; - -diff --git a/net/netfilter/nft_reject.c b/net/netfilter/nft_reject.c -index ed2e668474d677..196a92c7ea09b7 100644 ---- a/net/netfilter/nft_reject.c -+++ b/net/netfilter/nft_reject.c -@@ -24,8 +24,7 @@ const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = { - EXPORT_SYMBOL_GPL(nft_reject_policy); - - int nft_reject_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data) -+ const struct nft_expr *expr) - { - return nft_chain_validate_hooks(ctx->chain, - (1 << NF_INET_LOCAL_IN) | -diff --git a/net/netfilter/nft_reject_inet.c b/net/netfilter/nft_reject_inet.c -index 973fa31a9dd6cd..49020e67304ad7 100644 ---- a/net/netfilter/nft_reject_inet.c -+++ b/net/netfilter/nft_reject_inet.c -@@ -61,8 +61,7 @@ static void nft_reject_inet_eval(const struct nft_expr *expr, - } - - static int nft_reject_inet_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data) -+ const struct nft_expr *expr) - { - return nft_chain_validate_hooks(ctx->chain, - (1 << NF_INET_LOCAL_IN) | -diff --git a/net/netfilter/nft_reject_netdev.c b/net/netfilter/nft_reject_netdev.c -index 7865cd8b11bb6a..2558ce1505d989 100644 ---- a/net/netfilter/nft_reject_netdev.c -+++ b/net/netfilter/nft_reject_netdev.c -@@ -145,8 +145,7 @@ static void nft_reject_netdev_eval(const struct nft_expr *expr, - } - - static int nft_reject_netdev_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data) -+ const struct nft_expr *expr) - { - return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS)); - } -diff --git a/net/netfilter/nft_rt.c b/net/netfilter/nft_rt.c -index 2434c624aafde1..9525f1e02a7d83 100644 ---- a/net/netfilter/nft_rt.c -+++ b/net/netfilter/nft_rt.c -@@ -160,8 +160,7 @@ static int nft_rt_get_dump(struct sk_buff *skb, - return -1; - } - --static int nft_rt_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, -- const struct nft_data **data) -+static int nft_rt_validate(const struct nft_ctx *ctx, const struct nft_expr *expr) - { - const struct nft_rt *priv = nft_expr_priv(expr); - unsigned int hooks; -diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c -index 187b667bad6c34..35d0409b009501 100644 ---- a/net/netfilter/nft_socket.c -+++ b/net/netfilter/nft_socket.c -@@ -275,8 +275,7 @@ static bool nft_socket_reduce(struct nft_regs_track *track, - } - - static int nft_socket_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data) -+ const struct nft_expr *expr) - { - if (ctx->family != NFPROTO_IPV4 && - ctx->family != NFPROTO_IPV6 && -diff --git a/net/netfilter/nft_synproxy.c b/net/netfilter/nft_synproxy.c -index 1d737f89dfc18c..5d3e5182598596 100644 ---- a/net/netfilter/nft_synproxy.c -+++ b/net/netfilter/nft_synproxy.c -@@ -248,8 +248,7 @@ static void nft_synproxy_eval(const struct nft_expr *expr, - } - - static int nft_synproxy_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data) -+ const struct nft_expr *expr) - { - if (ctx->family != NFPROTO_IPV4 && - ctx->family != NFPROTO_IPV6 && -diff --git a/net/netfilter/nft_tproxy.c b/net/netfilter/nft_tproxy.c -index 71412adb73d414..ed344af2a439be 100644 ---- a/net/netfilter/nft_tproxy.c -+++ b/net/netfilter/nft_tproxy.c -@@ -313,8 +313,7 @@ static int nft_tproxy_dump(struct sk_buff *skb, - } - - static int nft_tproxy_validate(const struct nft_ctx *ctx, -- const struct nft_expr *expr, -- const struct nft_data **data) -+ const struct nft_expr *expr) - { - if (ctx->family != NFPROTO_IPV4 && - ctx->family != NFPROTO_IPV6 && -diff --git a/net/netfilter/nft_xfrm.c b/net/netfilter/nft_xfrm.c -index 1c866757db5524..8a07b46cc8fb73 100644 ---- a/net/netfilter/nft_xfrm.c -+++ b/net/netfilter/nft_xfrm.c -@@ -229,8 +229,7 @@ static int nft_xfrm_get_dump(struct sk_buff *skb, - return 0; - } - --static int nft_xfrm_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, -- const struct nft_data **data) -+static int nft_xfrm_validate(const struct nft_ctx *ctx, const struct nft_expr *expr) - { - const struct nft_xfrm *priv = nft_expr_priv(expr); - unsigned int hooks; -diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c -index 08527d882e56ef..eb2ed7db3fe16b 100644 ---- a/net/sctp/sm_make_chunk.c -+++ b/net/sctp/sm_make_chunk.c -@@ -31,6 +31,7 @@ - #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt - - #include -+#include - #include - #include - #include -@@ -1796,7 +1797,7 @@ struct sctp_association *sctp_unpack_cookie( - } - } - -- if (memcmp(digest, cookie->signature, SCTP_SIGNATURE_SIZE)) { -+ if (crypto_memneq(digest, cookie->signature, SCTP_SIGNATURE_SIZE)) { - *error = -SCTP_IERROR_BAD_SIG; - goto fail; - } -diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c -index 808863e047e0c0..cd18b22b2bbaee 100644 ---- a/net/sctp/sm_statefuns.c -+++ b/net/sctp/sm_statefuns.c -@@ -30,6 +30,7 @@ - - #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt - -+#include - #include - #include - #include -@@ -884,7 +885,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net, - return SCTP_DISPOSITION_CONSUME; - - nomem_authev: -- sctp_ulpevent_free(ai_ev); -+ if (ai_ev) -+ sctp_ulpevent_free(ai_ev); - nomem_aiev: - sctp_ulpevent_free(ev); - nomem_ev: -@@ -4415,7 +4417,7 @@ static enum sctp_ierror sctp_sf_authenticate( - sh_key, GFP_ATOMIC); - - /* Discard the packet if the digests do not match */ -- if (memcmp(save_digest, digest, sig_len)) { -+ if (crypto_memneq(save_digest, digest, sig_len)) { - kfree(save_digest); - return SCTP_IERROR_BAD_SIG; - } -diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trusted-keys/trusted_tpm1.c -index aa108bea6739b3..ddcbfaede6849a 100644 ---- a/security/keys/trusted-keys/trusted_tpm1.c -+++ b/security/keys/trusted-keys/trusted_tpm1.c -@@ -7,6 +7,7 @@ - */ - - #include -+#include - #include - #include - #include -@@ -241,7 +242,7 @@ int TSS_checkhmac1(unsigned char *buffer, - if (ret < 0) - goto out; - -- if (memcmp(testhmac, authdata, SHA1_DIGEST_SIZE)) -+ if (crypto_memneq(testhmac, authdata, SHA1_DIGEST_SIZE)) - ret = -EINVAL; - out: - kfree_sensitive(sdesc); -@@ -334,7 +335,7 @@ static int TSS_checkhmac2(unsigned char *buffer, - TPM_NONCE_SIZE, ononce, 1, continueflag1, 0, 0); - if (ret < 0) - goto out; -- if (memcmp(testhmac1, authdata1, SHA1_DIGEST_SIZE)) { -+ if (crypto_memneq(testhmac1, authdata1, SHA1_DIGEST_SIZE)) { - ret = -EINVAL; - goto out; - } -@@ -343,7 +344,7 @@ static int TSS_checkhmac2(unsigned char *buffer, - TPM_NONCE_SIZE, ononce, 1, continueflag2, 0, 0); - if (ret < 0) - goto out; -- if (memcmp(testhmac2, authdata2, SHA1_DIGEST_SIZE)) -+ if (crypto_memneq(testhmac2, authdata2, SHA1_DIGEST_SIZE)) - ret = -EINVAL; - out: - kfree_sensitive(sdesc); -diff --git a/sound/soc/sof/ipc4-topology.h b/sound/soc/sof/ipc4-topology.h -index 0fb759c6eeaf94..07bd84204baa7f 100644 ---- a/sound/soc/sof/ipc4-topology.h -+++ b/sound/soc/sof/ipc4-topology.h -@@ -59,8 +59,8 @@ - - #define SOF_IPC4_INVALID_NODE_ID 0xffffffff - --/* FW requires minimum 2ms DMA buffer size */ --#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 2 -+/* FW requires minimum 4ms DMA buffer size */ -+#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 4 - - /* - * The base of multi-gateways. Multi-gateways addressing starts from -diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile -index 4f869fff28fe43..17e03236e3461c 100644 ---- a/tools/build/feature/Makefile -+++ b/tools/build/feature/Makefile -@@ -306,10 +306,10 @@ $(OUTPUT)test-libbabeltrace.bin: - $(BUILD) # -lbabeltrace provided by $(FEATURE_CHECK_LDFLAGS-libbabeltrace) - - $(OUTPUT)test-compile-32.bin: -- $(CC) -m32 -o $@ test-compile.c -+ $(CC) -m32 -Wall -Werror -o $@ test-compile.c - - $(OUTPUT)test-compile-x32.bin: -- $(CC) -mx32 -o $@ test-compile.c -+ $(CC) -mx32 -Wall -Werror -o $@ test-compile.c - - $(OUTPUT)test-zlib.bin: - $(BUILD) -lz -diff --git a/tools/lib/perf/include/perf/event.h b/tools/lib/perf/include/perf/event.h -index ae64090184d328..b50960cce23f24 100644 ---- a/tools/lib/perf/include/perf/event.h -+++ b/tools/lib/perf/include/perf/event.h -@@ -285,6 +285,7 @@ struct perf_record_header_event_type { - struct perf_record_header_tracing_data { - struct perf_event_header header; - __u32 size; -+ __u32 pad; - }; - - #define PERF_RECORD_MISC_BUILD_ID_SIZE (1 << 15) -diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c -index 9692ebdd7f11e9..1512fedd90cf9a 100644 ---- a/tools/perf/builtin-stat.c -+++ b/tools/perf/builtin-stat.c -@@ -638,8 +638,7 @@ static enum counter_recovery stat_handle_error(struct evsel *counter) - * (behavior changed with commit b0a873e). - */ - if (errno == EINVAL || errno == ENOSYS || -- errno == ENOENT || errno == EOPNOTSUPP || -- errno == ENXIO) { -+ errno == ENOENT || errno == ENXIO) { - if (verbose > 0) - ui__warning("%s event is not supported by the kernel.\n", - evsel__name(counter)); -@@ -657,7 +656,7 @@ static enum counter_recovery stat_handle_error(struct evsel *counter) - if (verbose > 0) - ui__warning("%s\n", msg); - return COUNTER_RETRY; -- } else if (target__has_per_thread(&target) && -+ } else if (target__has_per_thread(&target) && errno != EOPNOTSUPP && - evsel_list->core.threads && - evsel_list->core.threads->err_thread != -1) { - /* -@@ -678,6 +677,19 @@ static enum counter_recovery stat_handle_error(struct evsel *counter) - return COUNTER_SKIP; - } - -+ if (errno == EOPNOTSUPP) { -+ if (verbose > 0) { -+ ui__warning("%s event is not supported by the kernel.\n", -+ evsel__name(counter)); -+ } -+ counter->supported = false; -+ counter->errored = true; -+ -+ if ((evsel__leader(counter) != counter) || -+ !(counter->core.leader->nr_members > 1)) -+ return COUNTER_SKIP; -+ } -+ - evsel__open_strerror(counter, &target, errno, msg, sizeof(msg)); - ui__error("%s\n", msg); - -diff --git a/tools/perf/tests/perf-record.c b/tools/perf/tests/perf-record.c -index 1c4feec1adff11..6e7f053006b4ff 100644 ---- a/tools/perf/tests/perf-record.c -+++ b/tools/perf/tests/perf-record.c -@@ -115,6 +115,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest - if (err < 0) { - pr_debug("sched__get_first_possible_cpu: %s\n", - str_error_r(errno, sbuf, sizeof(sbuf))); -+ evlist__cancel_workload(evlist); - goto out_delete_evlist; - } - -@@ -126,6 +127,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest - if (sched_setaffinity(evlist->workload.pid, cpu_mask_size, &cpu_mask) < 0) { - pr_debug("sched_setaffinity: %s\n", - str_error_r(errno, sbuf, sizeof(sbuf))); -+ evlist__cancel_workload(evlist); - goto out_delete_evlist; - } - -@@ -137,6 +139,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest - if (err < 0) { - pr_debug("perf_evlist__open: %s\n", - str_error_r(errno, sbuf, sizeof(sbuf))); -+ evlist__cancel_workload(evlist); - goto out_delete_evlist; - } - -@@ -149,6 +152,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest - if (err < 0) { - pr_debug("evlist__mmap: %s\n", - str_error_r(errno, sbuf, sizeof(sbuf))); -+ evlist__cancel_workload(evlist); - goto out_delete_evlist; - } - -diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh -index 3f1e67795490a0..62f13dfeae8e4d 100755 ---- a/tools/perf/tests/shell/stat.sh -+++ b/tools/perf/tests/shell/stat.sh -@@ -146,6 +146,34 @@ test_cputype() { - echo "cputype test [Success]" - } - -+test_hybrid() { -+ # Test the default stat command on hybrid devices opens one cycles event for -+ # each CPU type. -+ echo "hybrid test" -+ -+ # Count the number of core PMUs, assume minimum of 1 -+ pmus=$(ls /sys/bus/event_source/devices/*/cpus 2>/dev/null | wc -l) -+ if [ "$pmus" -lt 1 ] -+ then -+ pmus=1 -+ fi -+ -+ # Run default Perf stat -+ cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/[uH]*| cycles[:uH]* " -c) -+ -+ # The expectation is that default output will have a cycles events on each -+ # hybrid PMU. In situations with no cycles PMU events, like virtualized, this -+ # can fall back to task-clock and so the end count may be 0. Fail if neither -+ # condition holds. -+ if [ "$pmus" -ne "$cycles_events" ] && [ "0" -ne "$cycles_events" ] -+ then -+ echo "hybrid test [Found $pmus PMUs but $cycles_events cycles events. Failed]" -+ err=1 -+ return -+ fi -+ echo "hybrid test [Success]" -+} -+ - test_default_stat - test_stat_record_report - test_stat_record_script -@@ -153,4 +181,5 @@ test_stat_repeat_weak_groups - test_topdown_groups - test_topdown_weak_groups - test_cputype -+test_hybrid - exit $err -diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h -index 1443c28545a946..358c611eeddbb3 100644 ---- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h -+++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h -@@ -56,15 +56,15 @@ enum arm_spe_op_type { - ARM_SPE_OP_BR_INDIRECT = 1 << 17, - }; - --enum arm_spe_neoverse_data_source { -- ARM_SPE_NV_L1D = 0x0, -- ARM_SPE_NV_L2 = 0x8, -- ARM_SPE_NV_PEER_CORE = 0x9, -- ARM_SPE_NV_LOCAL_CLUSTER = 0xa, -- ARM_SPE_NV_SYS_CACHE = 0xb, -- ARM_SPE_NV_PEER_CLUSTER = 0xc, -- ARM_SPE_NV_REMOTE = 0xd, -- ARM_SPE_NV_DRAM = 0xe, -+enum arm_spe_common_data_source { -+ ARM_SPE_COMMON_DS_L1D = 0x0, -+ ARM_SPE_COMMON_DS_L2 = 0x8, -+ ARM_SPE_COMMON_DS_PEER_CORE = 0x9, -+ ARM_SPE_COMMON_DS_LOCAL_CLUSTER = 0xa, -+ ARM_SPE_COMMON_DS_SYS_CACHE = 0xb, -+ ARM_SPE_COMMON_DS_PEER_CLUSTER = 0xc, -+ ARM_SPE_COMMON_DS_REMOTE = 0xd, -+ ARM_SPE_COMMON_DS_DRAM = 0xe, - }; - - struct arm_spe_record { -diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c -index 9848310cee5f35..0302e6407b5a20 100644 ---- a/tools/perf/util/arm-spe.c -+++ b/tools/perf/util/arm-spe.c -@@ -411,15 +411,15 @@ static int arm_spe__synth_instruction_sample(struct arm_spe_queue *speq, - return arm_spe_deliver_synth_event(spe, speq, event, &sample); - } - --static const struct midr_range neoverse_spe[] = { -+static const struct midr_range common_ds_encoding_cpus[] = { - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), - {}, - }; - --static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *record, -- union perf_mem_data_src *data_src) -+static void arm_spe__synth_data_source_common(const struct arm_spe_record *record, -+ union perf_mem_data_src *data_src) - { - /* - * Even though four levels of cache hierarchy are possible, no known -@@ -441,17 +441,17 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec - } - - switch (record->source) { -- case ARM_SPE_NV_L1D: -+ case ARM_SPE_COMMON_DS_L1D: - data_src->mem_lvl = PERF_MEM_LVL_L1 | PERF_MEM_LVL_HIT; - data_src->mem_lvl_num = PERF_MEM_LVLNUM_L1; - data_src->mem_snoop = PERF_MEM_SNOOP_NONE; - break; -- case ARM_SPE_NV_L2: -+ case ARM_SPE_COMMON_DS_L2: - data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT; - data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2; - data_src->mem_snoop = PERF_MEM_SNOOP_NONE; - break; -- case ARM_SPE_NV_PEER_CORE: -+ case ARM_SPE_COMMON_DS_PEER_CORE: - data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT; - data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2; - data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; -@@ -460,8 +460,8 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec - * We don't know if this is L1, L2 but we do know it was a cache-2-cache - * transfer, so set SNOOPX_PEER - */ -- case ARM_SPE_NV_LOCAL_CLUSTER: -- case ARM_SPE_NV_PEER_CLUSTER: -+ case ARM_SPE_COMMON_DS_LOCAL_CLUSTER: -+ case ARM_SPE_COMMON_DS_PEER_CLUSTER: - data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT; - data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3; - data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; -@@ -469,7 +469,7 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec - /* - * System cache is assumed to be L3 - */ -- case ARM_SPE_NV_SYS_CACHE: -+ case ARM_SPE_COMMON_DS_SYS_CACHE: - data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT; - data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3; - data_src->mem_snoop = PERF_MEM_SNOOP_HIT; -@@ -478,13 +478,13 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec - * We don't know what level it hit in, except it came from the other - * socket - */ -- case ARM_SPE_NV_REMOTE: -- data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1; -- data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE; -+ case ARM_SPE_COMMON_DS_REMOTE: -+ data_src->mem_lvl = PERF_MEM_LVL_NA; -+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_NA; - data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; - data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; - break; -- case ARM_SPE_NV_DRAM: -+ case ARM_SPE_COMMON_DS_DRAM: - data_src->mem_lvl = PERF_MEM_LVL_LOC_RAM | PERF_MEM_LVL_HIT; - data_src->mem_lvl_num = PERF_MEM_LVLNUM_RAM; - data_src->mem_snoop = PERF_MEM_SNOOP_NONE; -@@ -514,13 +514,13 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco - } - - if (record->type & ARM_SPE_REMOTE_ACCESS) -- data_src->mem_lvl |= PERF_MEM_LVL_REM_CCE1; -+ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; - } - - static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr) - { - union perf_mem_data_src data_src = { .mem_op = PERF_MEM_OP_NA }; -- bool is_neoverse = is_midr_in_range_list(midr, neoverse_spe); -+ bool is_common = is_midr_in_range_list(midr, common_ds_encoding_cpus); - - /* Only synthesize data source for LDST operations */ - if (!is_ldst_op(record->op)) -@@ -533,8 +533,8 @@ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 m - else - return 0; - -- if (is_neoverse) -- arm_spe__synth_data_source_neoverse(record, &data_src); -+ if (is_common) -+ arm_spe__synth_data_source_common(record, &data_src); - else - arm_spe__synth_data_source_generic(record, &data_src); - -diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c -index 2a6295f1ac1bc0..6d1327f8c6043a 100644 ---- a/tools/perf/util/evsel.c -+++ b/tools/perf/util/evsel.c -@@ -2874,7 +2874,7 @@ bool evsel__fallback(struct evsel *evsel, int err, char *msg, size_t msgsize) - - /* If event has exclude user then don't exclude kernel. */ - if (evsel->core.attr.exclude_user) -- return false; -+ goto no_fallback; - - /* Is there already the separator in the name. */ - if (strchr(name, '/') || -@@ -2882,7 +2882,7 @@ bool evsel__fallback(struct evsel *evsel, int err, char *msg, size_t msgsize) - sep = ""; - - if (asprintf(&new_name, "%s%su", name, sep) < 0) -- return false; -+ goto no_fallback; - - free(evsel->name); - evsel->name = new_name; -@@ -2893,8 +2893,31 @@ bool evsel__fallback(struct evsel *evsel, int err, char *msg, size_t msgsize) - evsel->core.attr.exclude_hv = 1; - - return true; -- } -+ } else if (err == EOPNOTSUPP && !evsel->core.attr.exclude_guest && -+ !evsel->exclude_GH) { -+ const char *name = evsel__name(evsel); -+ char *new_name; -+ const char *sep = ":"; -+ -+ /* Is there already the separator in the name. */ -+ if (strchr(name, '/') || -+ (strchr(name, ':') && !evsel->is_libpfm_event)) -+ sep = ""; -+ -+ if (asprintf(&new_name, "%s%sH", name, sep) < 0) -+ goto no_fallback; - -+ free(evsel->name); -+ evsel->name = new_name; -+ /* Apple M1 requires exclude_guest */ -+ scnprintf(msg, msgsize, "Trying to fall back to excluding guest samples"); -+ evsel->core.attr.exclude_guest = 1; -+ -+ return true; -+ } -+no_fallback: -+ scnprintf(msg, msgsize, "No fallback found for '%s' for error %d", -+ evsel__name(evsel), err); - return false; - } - -@@ -3131,6 +3154,8 @@ bool evsel__is_hybrid(const struct evsel *evsel) - - struct evsel *evsel__leader(const struct evsel *evsel) - { -+ if (evsel->core.leader == NULL) -+ return NULL; - return container_of(evsel->core.leader, struct evsel, core); - } - -diff --git a/tools/perf/util/lzma.c b/tools/perf/util/lzma.c -index af9a97612f9df3..f61574d1581e3c 100644 ---- a/tools/perf/util/lzma.c -+++ b/tools/perf/util/lzma.c -@@ -113,7 +113,7 @@ bool lzma_is_compressed(const char *input) - ssize_t rc; - - if (fd < 0) -- return -1; -+ return false; - - rc = read(fd, buf, sizeof(buf)); - close(fd); -diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c -index 277b2cbd518611..e4d57e7df7ae10 100644 ---- a/tools/perf/util/session.c -+++ b/tools/perf/util/session.c -@@ -1662,7 +1662,7 @@ static s64 perf_session__process_user_event(struct perf_session *session, - struct perf_tool *tool = session->tool; - struct perf_sample sample = { .time = 0, }; - int fd = perf_data__fd(session->data); -- int err; -+ s64 err; - - if (event->header.type != PERF_RECORD_COMPRESSED || - tool->compressed == perf_session__process_compressed_event_stub) -diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py -index e837132d5031bd..eecb462c021cd9 100644 ---- a/tools/perf/util/setup.py -+++ b/tools/perf/util/setup.py -@@ -1,6 +1,7 @@ - from os import getenv, path - from subprocess import Popen, PIPE - from re import sub -+import shlex - - cc = getenv("CC") - -@@ -16,7 +17,9 @@ cc_is_clang = b"clang version" in Popen([cc, "-v"], stderr=PIPE).stderr.readline - src_feature_tests = getenv('srctree') + '/tools/build/feature' - - def clang_has_option(option): -- cc_output = Popen([cc, cc_options + option, path.join(src_feature_tests, "test-hello.c") ], stderr=PIPE).stderr.readlines() -+ cmd = shlex.split(f"{cc} {cc_options} {option}") -+ cmd.append(path.join(src_feature_tests, "test-hello.c")) -+ cc_output = Popen(cmd, stderr=PIPE).stderr.readlines() - return [o for o in cc_output if ((b"unknown argument" in o) or (b"is not supported" in o) or (b"unknown warning option" in o))] == [ ] - - if cc_is_clang: -diff --git a/tools/perf/util/zlib.c b/tools/perf/util/zlib.c -index 78d2297c1b6746..1f7c065230599d 100644 ---- a/tools/perf/util/zlib.c -+++ b/tools/perf/util/zlib.c -@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input) - ssize_t rc; - - if (fd < 0) -- return -1; -+ return false; - - rc = read(fd, buf, sizeof(buf)); - close(fd); -diff --git a/tools/testing/selftests/mm/madv_populate.c b/tools/testing/selftests/mm/madv_populate.c -index 17bcb07f19f349..7278623acf8c54 100644 ---- a/tools/testing/selftests/mm/madv_populate.c -+++ b/tools/testing/selftests/mm/madv_populate.c -@@ -264,23 +264,6 @@ static void test_softdirty(void) - munmap(addr, SIZE); - } - --static int system_has_softdirty(void) --{ -- /* -- * There is no way to check if the kernel supports soft-dirty, other -- * than by writing to a page and seeing if the bit was set. But the -- * tests are intended to check that the bit gets set when it should, so -- * doing that check would turn a potentially legitimate fail into a -- * skip. Fortunately, we know for sure that arm64 does not support -- * soft-dirty. So for now, let's just use the arch as a corse guide. -- */ --#if defined(__aarch64__) -- return 0; --#else -- return 1; --#endif --} -- - int main(int argc, char **argv) - { - int nr_tests = 16; -@@ -288,7 +271,7 @@ int main(int argc, char **argv) - - pagesize = getpagesize(); - -- if (system_has_softdirty()) -+ if (softdirty_supported()) - nr_tests += 5; - - ksft_print_header(); -@@ -300,7 +283,7 @@ int main(int argc, char **argv) - test_holes(); - test_populate_read(); - test_populate_write(); -- if (system_has_softdirty()) -+ if (softdirty_supported()) - test_softdirty(); - - err = ksft_get_fail_cnt(); -diff --git a/tools/testing/selftests/mm/soft-dirty.c b/tools/testing/selftests/mm/soft-dirty.c -index 7dbfa53d93a05f..7095b95d19ae2d 100644 ---- a/tools/testing/selftests/mm/soft-dirty.c -+++ b/tools/testing/selftests/mm/soft-dirty.c -@@ -193,8 +193,11 @@ int main(int argc, char **argv) - int pagesize; - - ksft_print_header(); -- ksft_set_plan(15); - -+ if (!softdirty_supported()) -+ ksft_exit_skip("soft-dirty is not support\n"); -+ -+ ksft_set_plan(15); - pagemap_fd = open(PAGEMAP_FILE_PATH, O_RDONLY); - if (pagemap_fd < 0) - ksft_exit_fail_msg("Failed to open %s\n", PAGEMAP_FILE_PATH); -diff --git a/tools/testing/selftests/mm/vm_util.c b/tools/testing/selftests/mm/vm_util.c -index 558c9cd8901c5a..b2af70d75711aa 100644 ---- a/tools/testing/selftests/mm/vm_util.c -+++ b/tools/testing/selftests/mm/vm_util.c -@@ -97,6 +97,42 @@ uint64_t read_pmd_pagesize(void) - return strtoul(buf, NULL, 10); - } - -+char *__get_smap_entry(void *addr, const char *pattern, char *buf, size_t len) -+{ -+ int ret; -+ FILE *fp; -+ char *entry = NULL; -+ char addr_pattern[MAX_LINE_LENGTH]; -+ -+ ret = snprintf(addr_pattern, MAX_LINE_LENGTH, "%08lx-", -+ (unsigned long)addr); -+ if (ret >= MAX_LINE_LENGTH) -+ ksft_exit_fail_msg("%s: Pattern is too long\n", __func__); -+ -+ fp = fopen(SMAP_FILE_PATH, "r"); -+ if (!fp) -+ ksft_exit_fail_msg("%s: Failed to open file %s\n", __func__, -+ SMAP_FILE_PATH); -+ -+ if (!check_for_pattern(fp, addr_pattern, buf, len)) -+ goto err_out; -+ -+ /* Fetch the pattern in the same block */ -+ if (!check_for_pattern(fp, pattern, buf, len)) -+ goto err_out; -+ -+ /* Trim trailing newline */ -+ entry = strchr(buf, '\n'); -+ if (entry) -+ *entry = '\0'; -+ -+ entry = buf + strlen(pattern); -+ -+err_out: -+ fclose(fp); -+ return entry; -+} -+ - bool __check_huge(void *addr, char *pattern, int nr_hpages, - uint64_t hpage_size) - { -@@ -269,3 +305,44 @@ int uffd_unregister(int uffd, void *addr, uint64_t len) - - return ret; - } -+ -+static bool check_vmflag(void *addr, const char *flag) -+{ -+ char buffer[MAX_LINE_LENGTH]; -+ const char *flags; -+ size_t flaglen; -+ -+ flags = __get_smap_entry(addr, "VmFlags:", buffer, sizeof(buffer)); -+ if (!flags) -+ ksft_exit_fail_msg("%s: No VmFlags for %p\n", __func__, addr); -+ -+ while (true) { -+ flags += strspn(flags, " "); -+ -+ flaglen = strcspn(flags, " "); -+ if (!flaglen) -+ return false; -+ -+ if (flaglen == strlen(flag) && !memcmp(flags, flag, flaglen)) -+ return true; -+ -+ flags += flaglen; -+ } -+} -+ -+bool softdirty_supported(void) -+{ -+ char *addr; -+ bool supported = false; -+ const size_t pagesize = getpagesize(); -+ -+ /* New mappings are expected to be marked with VM_SOFTDIRTY (sd). */ -+ addr = mmap(0, pagesize, PROT_READ | PROT_WRITE, -+ MAP_ANONYMOUS | MAP_PRIVATE, 0, 0); -+ if (!addr) -+ ksft_exit_fail_msg("mmap failed\n"); -+ -+ supported = check_vmflag(addr, "sd"); -+ munmap(addr, pagesize); -+ return supported; -+} -diff --git a/tools/testing/selftests/mm/vm_util.h b/tools/testing/selftests/mm/vm_util.h -index 0c603bec5e209c..9816d6e9bce6c9 100644 ---- a/tools/testing/selftests/mm/vm_util.h -+++ b/tools/testing/selftests/mm/vm_util.h -@@ -51,6 +51,7 @@ int uffd_register(int uffd, void *addr, uint64_t len, - int uffd_unregister(int uffd, void *addr, uint64_t len); - int uffd_register_with_ioctls(int uffd, void *addr, uint64_t len, - bool miss, bool wp, bool minor, uint64_t *ioctls); -+bool softdirty_supported(void); - - /* - * On ppc64 this will only work with radix 2M hugepage size -diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh -index 442b7220468afc..9a907d8260c9c7 100755 ---- a/tools/testing/selftests/net/mptcp/mptcp_join.sh -+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh -@@ -3234,6 +3234,17 @@ deny_join_id0_tests() - run_tests $ns1 $ns2 10.0.1.1 - chk_join_nr 1 1 1 - fi -+ -+ # default limits, server deny join id 0 + signal -+ if reset_with_allow_join_id0 "default limits, server deny join id 0" 0 1; then -+ pm_nl_set_limits $ns1 0 2 -+ pm_nl_set_limits $ns2 0 2 -+ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal -+ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow -+ pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow -+ run_tests $ns1 $ns2 10.0.1.1 -+ chk_join_nr 2 2 2 -+ fi - } - - fullmesh_tests() -diff --git a/tools/testing/selftests/rseq/rseq.c b/tools/testing/selftests/rseq/rseq.c -index f6156790c3b4df..05dc77fd527b3b 100644 ---- a/tools/testing/selftests/rseq/rseq.c -+++ b/tools/testing/selftests/rseq/rseq.c -@@ -40,9 +40,9 @@ - * Define weak versions to play nice with binaries that are statically linked - * against a libc that doesn't support registering its own rseq. - */ --__weak ptrdiff_t __rseq_offset; --__weak unsigned int __rseq_size; --__weak unsigned int __rseq_flags; -+extern __weak ptrdiff_t __rseq_offset; -+extern __weak unsigned int __rseq_size; -+extern __weak unsigned int __rseq_flags; - - static const ptrdiff_t *libc_rseq_offset_p = &__rseq_offset; - static const unsigned int *libc_rseq_size_p = &__rseq_size; -@@ -198,7 +198,7 @@ void rseq_init(void) - * libc not having registered a restartable sequence. Try to find the - * symbols if that's the case. - */ -- if (!*libc_rseq_size_p) { -+ if (!libc_rseq_size_p || !*libc_rseq_size_p) { - libc_rseq_offset_p = dlsym(RTLD_NEXT, "__rseq_offset"); - libc_rseq_size_p = dlsym(RTLD_NEXT, "__rseq_size"); - libc_rseq_flags_p = dlsym(RTLD_NEXT, "__rseq_flags"); diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.113-114.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.113-114.patch deleted file mode 100644 index b771fa25db..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.113-114.patch +++ /dev/null @@ -1,5730 +0,0 @@ -diff --git a/Documentation/arch/arm64/silicon-errata.rst b/Documentation/arch/arm64/silicon-errata.rst -index 8209c7a7c3970e..fbc833841bef53 100644 ---- a/Documentation/arch/arm64/silicon-errata.rst -+++ b/Documentation/arch/arm64/silicon-errata.rst -@@ -187,6 +187,8 @@ stable kernels. - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-V3 | #3312417 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Neoverse-V3AE | #3312417 | ARM64_ERRATUM_3194386 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | MMU-500 | #841119,826419 | N/A | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | MMU-600 | #1076982,1209401| N/A | -diff --git a/Documentation/networking/seg6-sysctl.rst b/Documentation/networking/seg6-sysctl.rst -index 07c20e470bafe6..1b6af4779be114 100644 ---- a/Documentation/networking/seg6-sysctl.rst -+++ b/Documentation/networking/seg6-sysctl.rst -@@ -25,6 +25,9 @@ seg6_require_hmac - INTEGER - - Default is 0. - -+/proc/sys/net/ipv6/seg6_* variables: -+==================================== -+ - seg6_flowlabel - INTEGER - Controls the behaviour of computing the flowlabel of outer - IPv6 header in case of SR T.encaps -diff --git a/Makefile b/Makefile -index ab277ff8764317..ad3952fb542d3a 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 113 -+SUBLEVEL = 114 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig -index 4ecba0690938c3..1be9f1f6b32005 100644 ---- a/arch/arm64/Kconfig -+++ b/arch/arm64/Kconfig -@@ -1094,6 +1094,7 @@ config ARM64_ERRATUM_3194386 - * ARM Neoverse-V1 erratum 3324341 - * ARM Neoverse V2 erratum 3324336 - * ARM Neoverse-V3 erratum 3312417 -+ * ARM Neoverse-V3AE erratum 3312417 - - On affected cores "MSR SSBS, #0" instructions may not affect - subsequent speculative instructions, which may permit unexepected -diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h -index d92a0203e5a93d..c279a0a9b3660e 100644 ---- a/arch/arm64/include/asm/cputype.h -+++ b/arch/arm64/include/asm/cputype.h -@@ -93,6 +93,7 @@ - #define ARM_CPU_PART_NEOVERSE_V2 0xD4F - #define ARM_CPU_PART_CORTEX_A720 0xD81 - #define ARM_CPU_PART_CORTEX_X4 0xD82 -+#define ARM_CPU_PART_NEOVERSE_V3AE 0xD83 - #define ARM_CPU_PART_NEOVERSE_V3 0xD84 - #define ARM_CPU_PART_CORTEX_X925 0xD85 - #define ARM_CPU_PART_CORTEX_A725 0xD87 -@@ -180,6 +181,7 @@ - #define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) - #define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720) - #define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) -+#define MIDR_NEOVERSE_V3AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3AE) - #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) - #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) - #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) -diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c -index 463b48d0f92500..23dcd0c4aad36d 100644 ---- a/arch/arm64/kernel/cpu_errata.c -+++ b/arch/arm64/kernel/cpu_errata.c -@@ -471,6 +471,7 @@ static const struct midr_range erratum_spec_ssbs_list[] = { - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2), - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3), -+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE), - {} - }; - #endif -diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c -index 297427ffc4e043..8a6ea7d2701887 100644 ---- a/arch/riscv/kernel/probes/kprobes.c -+++ b/arch/riscv/kernel/probes/kprobes.c -@@ -48,10 +48,15 @@ static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs) - post_kprobe_handler(p, kcb, regs); - } - --static bool __kprobes arch_check_kprobe(struct kprobe *p) -+static bool __kprobes arch_check_kprobe(unsigned long addr) - { -- unsigned long tmp = (unsigned long)p->addr - p->offset; -- unsigned long addr = (unsigned long)p->addr; -+ unsigned long tmp, offset; -+ -+ /* start iterating at the closest preceding symbol */ -+ if (!kallsyms_lookup_size_offset(addr, NULL, &offset)) -+ return false; -+ -+ tmp = addr - offset; - - while (tmp <= addr) { - if (tmp == addr) -@@ -70,7 +75,7 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p) - if ((unsigned long)insn & 0x1) - return -EILSEQ; - -- if (!arch_check_kprobe(p)) -+ if (!arch_check_kprobe((unsigned long)p->addr)) - return -EILSEQ; - - /* copy instruction */ -diff --git a/block/bdev.c b/block/bdev.c -index 5a54977518eeae..a8357b72a27b86 100644 ---- a/block/bdev.c -+++ b/block/bdev.c -@@ -147,9 +147,26 @@ int set_blocksize(struct block_device *bdev, int size) - - /* Don't change the size if it is same as current */ - if (bdev->bd_inode->i_blkbits != blksize_bits(size)) { -+ /* -+ * Flush and truncate the pagecache before we reconfigure the -+ * mapping geometry because folio sizes are variable now. If a -+ * reader has already allocated a folio whose size is smaller -+ * than the new min_order but invokes readahead after the new -+ * min_order becomes visible, readahead will think there are -+ * "zero" blocks per folio and crash. Take the inode and -+ * invalidation locks to avoid racing with -+ * read/write/fallocate. -+ */ -+ inode_lock(bdev->bd_inode); -+ filemap_invalidate_lock(bdev->bd_inode->i_mapping); -+ - sync_blockdev(bdev); -+ kill_bdev(bdev); -+ - bdev->bd_inode->i_blkbits = blksize_bits(size); - kill_bdev(bdev); -+ filemap_invalidate_unlock(bdev->bd_inode->i_mapping); -+ inode_unlock(bdev->bd_inode); - } - return 0; - } -diff --git a/block/blk-zoned.c b/block/blk-zoned.c -index 619ee41a51cc8c..644bfa1f6753ea 100644 ---- a/block/blk-zoned.c -+++ b/block/blk-zoned.c -@@ -401,6 +401,7 @@ int blkdev_zone_mgmt_ioctl(struct block_device *bdev, blk_mode_t mode, - op = REQ_OP_ZONE_RESET; - - /* Invalidate the page cache, including dirty pages. */ -+ inode_lock(bdev->bd_inode); - filemap_invalidate_lock(bdev->bd_inode->i_mapping); - ret = blkdev_truncate_zone_range(bdev, mode, &zrange); - if (ret) -@@ -423,8 +424,10 @@ int blkdev_zone_mgmt_ioctl(struct block_device *bdev, blk_mode_t mode, - GFP_KERNEL); - - fail: -- if (cmd == BLKRESETZONE) -+ if (cmd == BLKRESETZONE) { - filemap_invalidate_unlock(bdev->bd_inode->i_mapping); -+ inode_unlock(bdev->bd_inode); -+ } - - return ret; - } -diff --git a/block/fops.c b/block/fops.c -index 7c257eb3564d0c..088143fa9ac9e1 100644 ---- a/block/fops.c -+++ b/block/fops.c -@@ -681,7 +681,14 @@ static ssize_t blkdev_write_iter(struct kiocb *iocb, struct iov_iter *from) - ret = direct_write_fallback(iocb, from, ret, - blkdev_buffered_write(iocb, from)); - } else { -+ /* -+ * Take i_rwsem and invalidate_lock to avoid racing with -+ * set_blocksize changing i_blkbits/folio order and punching -+ * out the pagecache. -+ */ -+ inode_lock_shared(bd_inode); - ret = blkdev_buffered_write(iocb, from); -+ inode_unlock_shared(bd_inode); - } - - if (ret > 0) -@@ -693,6 +700,7 @@ static ssize_t blkdev_write_iter(struct kiocb *iocb, struct iov_iter *from) - static ssize_t blkdev_read_iter(struct kiocb *iocb, struct iov_iter *to) - { - struct block_device *bdev = I_BDEV(iocb->ki_filp->f_mapping->host); -+ struct inode *bd_inode = bdev->bd_inode; - loff_t size = bdev_nr_bytes(bdev); - loff_t pos = iocb->ki_pos; - size_t shorted = 0; -@@ -728,7 +736,13 @@ static ssize_t blkdev_read_iter(struct kiocb *iocb, struct iov_iter *to) - goto reexpand; - } - -+ /* -+ * Take i_rwsem and invalidate_lock to avoid racing with set_blocksize -+ * changing i_blkbits/folio order and punching out the pagecache. -+ */ -+ inode_lock_shared(bd_inode); - ret = filemap_read(iocb, to, ret); -+ inode_unlock_shared(bd_inode); - - reexpand: - if (unlikely(shorted)) -@@ -771,6 +785,7 @@ static long blkdev_fallocate(struct file *file, int mode, loff_t start, - if ((start | len) & (bdev_logical_block_size(bdev) - 1)) - return -EINVAL; - -+ inode_lock(inode); - filemap_invalidate_lock(inode->i_mapping); - - /* -@@ -811,6 +826,7 @@ static long blkdev_fallocate(struct file *file, int mode, loff_t start, - - fail: - filemap_invalidate_unlock(inode->i_mapping); -+ inode_unlock(inode); - return error; - } - -diff --git a/block/ioctl.c b/block/ioctl.c -index 231537f79a8cb4..024767fa1e52d5 100644 ---- a/block/ioctl.c -+++ b/block/ioctl.c -@@ -114,6 +114,7 @@ static int blk_ioctl_discard(struct block_device *bdev, blk_mode_t mode, - end > bdev_nr_bytes(bdev)) - return -EINVAL; - -+ inode_lock(inode); - filemap_invalidate_lock(inode->i_mapping); - err = truncate_bdev_range(bdev, mode, start, end - 1); - if (err) -@@ -121,6 +122,7 @@ static int blk_ioctl_discard(struct block_device *bdev, blk_mode_t mode, - err = blkdev_issue_discard(bdev, start >> 9, len >> 9, GFP_KERNEL); - fail: - filemap_invalidate_unlock(inode->i_mapping); -+ inode_unlock(inode); - return err; - } - -@@ -146,12 +148,14 @@ static int blk_ioctl_secure_erase(struct block_device *bdev, blk_mode_t mode, - end > bdev_nr_bytes(bdev)) - return -EINVAL; - -+ inode_lock(bdev->bd_inode); - filemap_invalidate_lock(bdev->bd_inode->i_mapping); - err = truncate_bdev_range(bdev, mode, start, end - 1); - if (!err) - err = blkdev_issue_secure_erase(bdev, start >> 9, len >> 9, - GFP_KERNEL); - filemap_invalidate_unlock(bdev->bd_inode->i_mapping); -+ inode_unlock(bdev->bd_inode); - return err; - } - -@@ -184,6 +188,7 @@ static int blk_ioctl_zeroout(struct block_device *bdev, blk_mode_t mode, - return -EINVAL; - - /* Invalidate the page cache, including dirty pages */ -+ inode_lock(inode); - filemap_invalidate_lock(inode->i_mapping); - err = truncate_bdev_range(bdev, mode, start, end); - if (err) -@@ -194,6 +199,7 @@ static int blk_ioctl_zeroout(struct block_device *bdev, blk_mode_t mode, - - fail: - filemap_invalidate_unlock(inode->i_mapping); -+ inode_unlock(inode); - return err; - } - -diff --git a/drivers/accel/qaic/qaic_control.c b/drivers/accel/qaic/qaic_control.c -index f3db3fa91dd52e..08b78f56785329 100644 ---- a/drivers/accel/qaic/qaic_control.c -+++ b/drivers/accel/qaic/qaic_control.c -@@ -407,7 +407,7 @@ static int find_and_map_user_pages(struct qaic_device *qdev, - return -EINVAL; - remaining = in_trans->size - resources->xferred_dma_size; - if (remaining == 0) -- return 0; -+ return -EINVAL; - - if (check_add_overflow(xfer_start_addr, remaining, &end)) - return -EINVAL; -diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c -index f53c14fb74fda7..5a33cee9a3947f 100644 ---- a/drivers/base/power/runtime.c -+++ b/drivers/base/power/runtime.c -@@ -1552,6 +1552,32 @@ void pm_runtime_enable(struct device *dev) - } - EXPORT_SYMBOL_GPL(pm_runtime_enable); - -+static void pm_runtime_set_suspended_action(void *data) -+{ -+ pm_runtime_set_suspended(data); -+} -+ -+/** -+ * devm_pm_runtime_set_active_enabled - set_active version of devm_pm_runtime_enable. -+ * -+ * @dev: Device to handle. -+ */ -+int devm_pm_runtime_set_active_enabled(struct device *dev) -+{ -+ int err; -+ -+ err = pm_runtime_set_active(dev); -+ if (err) -+ return err; -+ -+ err = devm_add_action_or_reset(dev, pm_runtime_set_suspended_action, dev); -+ if (err) -+ return err; -+ -+ return devm_pm_runtime_enable(dev); -+} -+EXPORT_SYMBOL_GPL(devm_pm_runtime_set_active_enabled); -+ - static void pm_runtime_disable_action(void *data) - { - pm_runtime_dont_use_autosuspend(data); -@@ -1574,6 +1600,24 @@ int devm_pm_runtime_enable(struct device *dev) - } - EXPORT_SYMBOL_GPL(devm_pm_runtime_enable); - -+static void pm_runtime_put_noidle_action(void *data) -+{ -+ pm_runtime_put_noidle(data); -+} -+ -+/** -+ * devm_pm_runtime_get_noresume - devres-enabled version of pm_runtime_get_noresume. -+ * -+ * @dev: Device to handle. -+ */ -+int devm_pm_runtime_get_noresume(struct device *dev) -+{ -+ pm_runtime_get_noresume(dev); -+ -+ return devm_add_action_or_reset(dev, pm_runtime_put_noidle_action, dev); -+} -+EXPORT_SYMBOL_GPL(devm_pm_runtime_get_noresume); -+ - /** - * pm_runtime_forbid - Block runtime PM of a device. - * @dev: Device to handle. -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index 1a2d227b7b7b96..4c21230aee460e 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -511,6 +511,8 @@ static const struct usb_device_id quirks_table[] = { - /* Realtek 8851BU Bluetooth devices */ - { USB_DEVICE(0x3625, 0x010b), .driver_info = BTUSB_REALTEK | - BTUSB_WIDEBAND_SPEECH }, -+ { USB_DEVICE(0x2001, 0x332a), .driver_info = BTUSB_REALTEK | -+ BTUSB_WIDEBAND_SPEECH }, - - /* Realtek 8852AE Bluetooth devices */ - { USB_DEVICE(0x0bda, 0x2852), .driver_info = BTUSB_REALTEK | -diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c -index ea32bdf7cc24e0..4d96eed64fe0ce 100644 ---- a/drivers/cpufreq/cppc_cpufreq.c -+++ b/drivers/cpufreq/cppc_cpufreq.c -@@ -344,6 +344,16 @@ static int cppc_verify_policy(struct cpufreq_policy_data *policy) - return 0; - } - -+static unsigned int __cppc_cpufreq_get_transition_delay_us(unsigned int cpu) -+{ -+ unsigned int transition_latency_ns = cppc_get_transition_latency(cpu); -+ -+ if (transition_latency_ns == CPUFREQ_ETERNAL) -+ return CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS / NSEC_PER_USEC; -+ -+ return transition_latency_ns / NSEC_PER_USEC; -+} -+ - /* - * The PCC subspace describes the rate at which platform can accept commands - * on the shared PCC channel (including READs which do not count towards freq -@@ -366,12 +376,12 @@ static unsigned int cppc_cpufreq_get_transition_delay_us(unsigned int cpu) - return 10000; - } - } -- return cppc_get_transition_latency(cpu) / NSEC_PER_USEC; -+ return __cppc_cpufreq_get_transition_delay_us(cpu); - } - #else - static unsigned int cppc_cpufreq_get_transition_delay_us(unsigned int cpu) - { -- return cppc_get_transition_latency(cpu) / NSEC_PER_USEC; -+ return __cppc_cpufreq_get_transition_delay_us(cpu); - } - #endif - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c -index a1f35510d53955..c94e1cc7e3a73a 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c -@@ -2285,10 +2285,9 @@ void amdgpu_amdkfd_gpuvm_unmap_gtt_bo_from_kernel(struct kgd_mem *mem) - int amdgpu_amdkfd_gpuvm_get_vm_fault_info(struct amdgpu_device *adev, - struct kfd_vm_fault_info *mem) - { -- if (atomic_read(&adev->gmc.vm_fault_info_updated) == 1) { -+ if (atomic_read_acquire(&adev->gmc.vm_fault_info_updated) == 1) { - *mem = *adev->gmc.vm_fault_info; -- mb(); /* make sure read happened */ -- atomic_set(&adev->gmc.vm_fault_info_updated, 0); -+ atomic_set_release(&adev->gmc.vm_fault_info_updated, 0); - } - return 0; - } -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c -index c83445c2e37f3d..d358a08b5e0067 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c -@@ -2012,7 +2012,7 @@ static int psp_securedisplay_initialize(struct psp_context *psp) - } - - ret = psp_ta_load(psp, &psp->securedisplay_context.context); -- if (!ret) { -+ if (!ret && !psp->securedisplay_context.context.resp_status) { - psp->securedisplay_context.context.initialized = true; - mutex_init(&psp->securedisplay_context.mutex); - } else -diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c -index fd905889a4c63b..e2ee10a98640ac 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c -@@ -1061,7 +1061,7 @@ static int gmc_v7_0_sw_init(void *handle) - GFP_KERNEL); - if (!adev->gmc.vm_fault_info) - return -ENOMEM; -- atomic_set(&adev->gmc.vm_fault_info_updated, 0); -+ atomic_set_release(&adev->gmc.vm_fault_info_updated, 0); - - return 0; - } -@@ -1290,7 +1290,7 @@ static int gmc_v7_0_process_interrupt(struct amdgpu_device *adev, - vmid = REG_GET_FIELD(status, VM_CONTEXT1_PROTECTION_FAULT_STATUS, - VMID); - if (amdgpu_amdkfd_is_kfd_vmid(adev, vmid) -- && !atomic_read(&adev->gmc.vm_fault_info_updated)) { -+ && !atomic_read_acquire(&adev->gmc.vm_fault_info_updated)) { - struct kfd_vm_fault_info *info = adev->gmc.vm_fault_info; - u32 protections = REG_GET_FIELD(status, - VM_CONTEXT1_PROTECTION_FAULT_STATUS, -@@ -1306,8 +1306,7 @@ static int gmc_v7_0_process_interrupt(struct amdgpu_device *adev, - info->prot_read = protections & 0x8 ? true : false; - info->prot_write = protections & 0x10 ? true : false; - info->prot_exec = protections & 0x20 ? true : false; -- mb(); -- atomic_set(&adev->gmc.vm_fault_info_updated, 1); -+ atomic_set_release(&adev->gmc.vm_fault_info_updated, 1); - } - - return 0; -diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c -index 0bebcdbb265807..ed268c5739eb8c 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c -@@ -1174,7 +1174,7 @@ static int gmc_v8_0_sw_init(void *handle) - GFP_KERNEL); - if (!adev->gmc.vm_fault_info) - return -ENOMEM; -- atomic_set(&adev->gmc.vm_fault_info_updated, 0); -+ atomic_set_release(&adev->gmc.vm_fault_info_updated, 0); - - return 0; - } -@@ -1465,7 +1465,7 @@ static int gmc_v8_0_process_interrupt(struct amdgpu_device *adev, - vmid = REG_GET_FIELD(status, VM_CONTEXT1_PROTECTION_FAULT_STATUS, - VMID); - if (amdgpu_amdkfd_is_kfd_vmid(adev, vmid) -- && !atomic_read(&adev->gmc.vm_fault_info_updated)) { -+ && !atomic_read_acquire(&adev->gmc.vm_fault_info_updated)) { - struct kfd_vm_fault_info *info = adev->gmc.vm_fault_info; - u32 protections = REG_GET_FIELD(status, - VM_CONTEXT1_PROTECTION_FAULT_STATUS, -@@ -1481,8 +1481,7 @@ static int gmc_v8_0_process_interrupt(struct amdgpu_device *adev, - info->prot_read = protections & 0x8 ? true : false; - info->prot_write = protections & 0x10 ? true : false; - info->prot_exec = protections & 0x20 ? true : false; -- mb(); -- atomic_set(&adev->gmc.vm_fault_info_updated, 1); -+ atomic_set_release(&adev->gmc.vm_fault_info_updated, 1); - } - - return 0; -diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c -index 53849fd3615f68..965ffcac17f860 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c -@@ -5437,8 +5437,7 @@ static int smu7_get_thermal_temperature_range(struct pp_hwmgr *hwmgr, - thermal_data->max = table_info->cac_dtp_table->usSoftwareShutdownTemp * - PP_TEMPERATURE_UNITS_PER_CENTIGRADES; - else if (hwmgr->pp_table_version == PP_TABLE_V0) -- thermal_data->max = data->thermal_temp_setting.temperature_shutdown * -- PP_TEMPERATURE_UNITS_PER_CENTIGRADES; -+ thermal_data->max = data->thermal_temp_setting.temperature_shutdown; - - thermal_data->sw_ctf_threshold = thermal_data->max; - -diff --git a/drivers/gpu/drm/bridge/lontium-lt9211.c b/drivers/gpu/drm/bridge/lontium-lt9211.c -index 4d404f5ef87ebb..ea192c90b543ef 100644 ---- a/drivers/gpu/drm/bridge/lontium-lt9211.c -+++ b/drivers/gpu/drm/bridge/lontium-lt9211.c -@@ -120,8 +120,7 @@ static int lt9211_read_chipid(struct lt9211 *ctx) - } - - /* Test for known Chip ID. */ -- if (chipid[0] != REG_CHIPID0_VALUE || chipid[1] != REG_CHIPID1_VALUE || -- chipid[2] != REG_CHIPID2_VALUE) { -+ if (chipid[0] != REG_CHIPID0_VALUE || chipid[1] != REG_CHIPID1_VALUE) { - dev_err(ctx->dev, "Unknown Chip ID: 0x%02x 0x%02x 0x%02x\n", - chipid[0], chipid[1], chipid[2]); - return -EINVAL; -diff --git a/drivers/gpu/drm/exynos/exynos7_drm_decon.c b/drivers/gpu/drm/exynos/exynos7_drm_decon.c -index 5f8e5e87d7cd63..0ed62cd51fb518 100644 ---- a/drivers/gpu/drm/exynos/exynos7_drm_decon.c -+++ b/drivers/gpu/drm/exynos/exynos7_drm_decon.c -@@ -51,7 +51,6 @@ struct decon_context { - void __iomem *regs; - unsigned long irq_flags; - bool i80_if; -- bool suspended; - wait_queue_head_t wait_vsync_queue; - atomic_t wait_vsync_event; - -@@ -81,13 +80,30 @@ static const enum drm_plane_type decon_win_types[WINDOWS_NR] = { - DRM_PLANE_TYPE_CURSOR, - }; - --static void decon_wait_for_vblank(struct exynos_drm_crtc *crtc) -+/** -+ * decon_shadow_protect_win() - disable updating values from shadow registers at vsync -+ * -+ * @ctx: display and enhancement controller context -+ * @win: window to protect registers for -+ * @protect: 1 to protect (disable updates) -+ */ -+static void decon_shadow_protect_win(struct decon_context *ctx, -+ unsigned int win, bool protect) - { -- struct decon_context *ctx = crtc->ctx; -+ u32 bits, val; - -- if (ctx->suspended) -- return; -+ bits = SHADOWCON_WINx_PROTECT(win); -+ -+ val = readl(ctx->regs + SHADOWCON); -+ if (protect) -+ val |= bits; -+ else -+ val &= ~bits; -+ writel(val, ctx->regs + SHADOWCON); -+} - -+static void decon_wait_for_vblank(struct decon_context *ctx) -+{ - atomic_set(&ctx->wait_vsync_event, 1); - - /* -@@ -100,25 +116,33 @@ static void decon_wait_for_vblank(struct exynos_drm_crtc *crtc) - DRM_DEV_DEBUG_KMS(ctx->dev, "vblank wait timed out.\n"); - } - --static void decon_clear_channels(struct exynos_drm_crtc *crtc) -+static void decon_clear_channels(struct decon_context *ctx) - { -- struct decon_context *ctx = crtc->ctx; - unsigned int win, ch_enabled = 0; -+ u32 val; - - /* Check if any channel is enabled. */ - for (win = 0; win < WINDOWS_NR; win++) { -- u32 val = readl(ctx->regs + WINCON(win)); -+ val = readl(ctx->regs + WINCON(win)); - - if (val & WINCONx_ENWIN) { -+ decon_shadow_protect_win(ctx, win, true); -+ - val &= ~WINCONx_ENWIN; - writel(val, ctx->regs + WINCON(win)); - ch_enabled = 1; -+ -+ decon_shadow_protect_win(ctx, win, false); - } - } - -+ val = readl(ctx->regs + DECON_UPDATE); -+ val |= DECON_UPDATE_STANDALONE_F; -+ writel(val, ctx->regs + DECON_UPDATE); -+ - /* Wait for vsync, as disable channel takes effect at next vsync */ - if (ch_enabled) -- decon_wait_for_vblank(ctx->crtc); -+ decon_wait_for_vblank(ctx); - } - - static int decon_ctx_initialize(struct decon_context *ctx, -@@ -126,7 +150,7 @@ static int decon_ctx_initialize(struct decon_context *ctx, - { - ctx->drm_dev = drm_dev; - -- decon_clear_channels(ctx->crtc); -+ decon_clear_channels(ctx); - - return exynos_drm_register_dma(drm_dev, ctx->dev, &ctx->dma_priv); - } -@@ -155,9 +179,6 @@ static void decon_commit(struct exynos_drm_crtc *crtc) - struct drm_display_mode *mode = &crtc->base.state->adjusted_mode; - u32 val, clkdiv; - -- if (ctx->suspended) -- return; -- - /* nothing to do if we haven't set the mode yet */ - if (mode->htotal == 0 || mode->vtotal == 0) - return; -@@ -219,9 +240,6 @@ static int decon_enable_vblank(struct exynos_drm_crtc *crtc) - struct decon_context *ctx = crtc->ctx; - u32 val; - -- if (ctx->suspended) -- return -EPERM; -- - if (!test_and_set_bit(0, &ctx->irq_flags)) { - val = readl(ctx->regs + VIDINTCON0); - -@@ -244,9 +262,6 @@ static void decon_disable_vblank(struct exynos_drm_crtc *crtc) - struct decon_context *ctx = crtc->ctx; - u32 val; - -- if (ctx->suspended) -- return; -- - if (test_and_clear_bit(0, &ctx->irq_flags)) { - val = readl(ctx->regs + VIDINTCON0); - -@@ -343,36 +358,11 @@ static void decon_win_set_colkey(struct decon_context *ctx, unsigned int win) - writel(keycon1, ctx->regs + WKEYCON1_BASE(win)); - } - --/** -- * decon_shadow_protect_win() - disable updating values from shadow registers at vsync -- * -- * @ctx: display and enhancement controller context -- * @win: window to protect registers for -- * @protect: 1 to protect (disable updates) -- */ --static void decon_shadow_protect_win(struct decon_context *ctx, -- unsigned int win, bool protect) --{ -- u32 bits, val; -- -- bits = SHADOWCON_WINx_PROTECT(win); -- -- val = readl(ctx->regs + SHADOWCON); -- if (protect) -- val |= bits; -- else -- val &= ~bits; -- writel(val, ctx->regs + SHADOWCON); --} -- - static void decon_atomic_begin(struct exynos_drm_crtc *crtc) - { - struct decon_context *ctx = crtc->ctx; - int i; - -- if (ctx->suspended) -- return; -- - for (i = 0; i < WINDOWS_NR; i++) - decon_shadow_protect_win(ctx, i, true); - } -@@ -392,9 +382,6 @@ static void decon_update_plane(struct exynos_drm_crtc *crtc, - unsigned int cpp = fb->format->cpp[0]; - unsigned int pitch = fb->pitches[0]; - -- if (ctx->suspended) -- return; -- - /* - * SHADOWCON/PRTCON register is used for enabling timing. - * -@@ -482,9 +469,6 @@ static void decon_disable_plane(struct exynos_drm_crtc *crtc, - unsigned int win = plane->index; - u32 val; - -- if (ctx->suspended) -- return; -- - /* protect windows */ - decon_shadow_protect_win(ctx, win, true); - -@@ -503,9 +487,6 @@ static void decon_atomic_flush(struct exynos_drm_crtc *crtc) - struct decon_context *ctx = crtc->ctx; - int i; - -- if (ctx->suspended) -- return; -- - for (i = 0; i < WINDOWS_NR; i++) - decon_shadow_protect_win(ctx, i, false); - exynos_crtc_handle_event(crtc); -@@ -533,9 +514,6 @@ static void decon_atomic_enable(struct exynos_drm_crtc *crtc) - struct decon_context *ctx = crtc->ctx; - int ret; - -- if (!ctx->suspended) -- return; -- - ret = pm_runtime_resume_and_get(ctx->dev); - if (ret < 0) { - DRM_DEV_ERROR(ctx->dev, "failed to enable DECON device.\n"); -@@ -549,8 +527,6 @@ static void decon_atomic_enable(struct exynos_drm_crtc *crtc) - decon_enable_vblank(ctx->crtc); - - decon_commit(ctx->crtc); -- -- ctx->suspended = false; - } - - static void decon_atomic_disable(struct exynos_drm_crtc *crtc) -@@ -558,9 +534,6 @@ static void decon_atomic_disable(struct exynos_drm_crtc *crtc) - struct decon_context *ctx = crtc->ctx; - int i; - -- if (ctx->suspended) -- return; -- - /* - * We need to make sure that all windows are disabled before we - * suspend that connector. Otherwise we might try to scan from -@@ -570,8 +543,6 @@ static void decon_atomic_disable(struct exynos_drm_crtc *crtc) - decon_disable_plane(crtc, &ctx->planes[i]); - - pm_runtime_put_sync(ctx->dev); -- -- ctx->suspended = true; - } - - static const struct exynos_drm_crtc_ops decon_crtc_ops = { -@@ -692,7 +663,6 @@ static int decon_probe(struct platform_device *pdev) - return -ENOMEM; - - ctx->dev = dev; -- ctx->suspended = true; - - i80_if_timings = of_get_child_by_name(dev->of_node, "i80-if-timings"); - if (i80_if_timings) -diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c -index 97eadd08181d61..38fad14ffd4356 100644 ---- a/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c -+++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c -@@ -1281,9 +1281,16 @@ static int ct_receive(struct intel_guc_ct *ct) - - static void ct_try_receive_message(struct intel_guc_ct *ct) - { -+ struct intel_guc *guc = ct_to_guc(ct); - int ret; - -- if (GEM_WARN_ON(!ct->enabled)) -+ if (!ct->enabled) { -+ GEM_WARN_ON(!guc_to_gt(guc)->uc.reset_in_progress); -+ return; -+ } -+ -+ /* When interrupt disabled, message handling is not expected */ -+ if (!guc->interrupts.enabled) - return; - - ret = ct_receive(ct); -diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c -index e7136b7759cb33..c50aafa0ecdb61 100644 ---- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c -+++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c -@@ -230,6 +230,8 @@ static int a6xx_gmu_start(struct a6xx_gmu *gmu) - if (ret) - DRM_DEV_ERROR(gmu->dev, "GMU firmware initialization timed out\n"); - -+ set_bit(GMU_STATUS_FW_START, &gmu->status); -+ - return ret; - } - -@@ -460,9 +462,10 @@ static int a6xx_rpmh_start(struct a6xx_gmu *gmu) - int ret; - u32 val; - -- gmu_write(gmu, REG_A6XX_GMU_RSCC_CONTROL_REQ, 1 << 1); -- /* Wait for the register to finish posting */ -- wmb(); -+ if (!test_and_clear_bit(GMU_STATUS_PDC_SLEEP, &gmu->status)) -+ return 0; -+ -+ gmu_write(gmu, REG_A6XX_GMU_RSCC_CONTROL_REQ, BIT(1)); - - ret = gmu_poll_timeout(gmu, REG_A6XX_GMU_RSCC_CONTROL_ACK, val, - val & (1 << 1), 100, 10000); -@@ -489,6 +492,9 @@ static void a6xx_rpmh_stop(struct a6xx_gmu *gmu) - int ret; - u32 val; - -+ if (test_and_clear_bit(GMU_STATUS_FW_START, &gmu->status)) -+ return; -+ - gmu_write(gmu, REG_A6XX_GMU_RSCC_CONTROL_REQ, 1); - - ret = gmu_poll_timeout_rscc(gmu, REG_A6XX_GPU_RSCC_RSC_STATUS0_DRV0, -@@ -497,6 +503,8 @@ static void a6xx_rpmh_stop(struct a6xx_gmu *gmu) - DRM_DEV_ERROR(gmu->dev, "Unable to power off the GPU RSC\n"); - - gmu_write(gmu, REG_A6XX_GMU_RSCC_CONTROL_REQ, 0); -+ -+ set_bit(GMU_STATUS_PDC_SLEEP, &gmu->status); - } - - static inline void pdc_write(void __iomem *ptr, u32 offset, u32 value) -@@ -617,8 +625,6 @@ static void a6xx_gmu_rpmh_init(struct a6xx_gmu *gmu) - /* ensure no writes happen before the uCode is fully written */ - wmb(); - -- a6xx_rpmh_stop(gmu); -- - err: - if (!IS_ERR_OR_NULL(pdcptr)) - iounmap(pdcptr); -@@ -755,22 +761,18 @@ static int a6xx_gmu_fw_start(struct a6xx_gmu *gmu, unsigned int state) - gmu_write(gmu, REG_A6XX_GPU_GMU_CX_GMU_CX_FAL_INTF, 1); - } - -- if (state == GMU_WARM_BOOT) { -- ret = a6xx_rpmh_start(gmu); -- if (ret) -- return ret; -- } else { -+ /* Turn on register retention */ -+ gmu_write(gmu, REG_A6XX_GMU_GENERAL_7, 1); -+ -+ ret = a6xx_rpmh_start(gmu); -+ if (ret) -+ return ret; -+ -+ if (state == GMU_COLD_BOOT) { - if (WARN(!adreno_gpu->fw[ADRENO_FW_GMU], - "GMU firmware is not loaded\n")) - return -ENOENT; - -- /* Turn on register retention */ -- gmu_write(gmu, REG_A6XX_GMU_GENERAL_7, 1); -- -- ret = a6xx_rpmh_start(gmu); -- if (ret) -- return ret; -- - ret = a6xx_gmu_fw_load(gmu); - if (ret) - return ret; -@@ -909,6 +911,8 @@ static void a6xx_gmu_force_off(struct a6xx_gmu *gmu) - - /* Reset GPU core blocks */ - a6xx_gpu_sw_reset(gpu, true); -+ -+ a6xx_rpmh_stop(gmu); - } - - static void a6xx_gmu_set_initial_freq(struct msm_gpu *gpu, struct a6xx_gmu *gmu) -diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.h b/drivers/gpu/drm/msm/adreno/a6xx_gmu.h -index 236f81a43caa62..6a28ecaf8594e9 100644 ---- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.h -+++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.h -@@ -96,6 +96,12 @@ struct a6xx_gmu { - /* For power domain callback */ - struct notifier_block pd_nb; - struct completion pd_gate; -+ -+/* To check if we can trigger sleep seq at PDC. Cleared in a6xx_rpmh_stop() */ -+#define GMU_STATUS_FW_START 0 -+/* To track if PDC sleep seq was done */ -+#define GMU_STATUS_PDC_SLEEP 1 -+ unsigned long status; - }; - - static inline u32 gmu_read(struct a6xx_gmu *gmu, u32 offset) -diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c -index 3664c1476a83ad..00bfc6f38f459d 100644 ---- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c -+++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c -@@ -1209,14 +1209,16 @@ static int hw_init(struct msm_gpu *gpu) - /* Clear GBIF halt in case GX domain was not collapsed */ - if (adreno_is_a619_holi(adreno_gpu)) { - gpu_write(gpu, REG_A6XX_GBIF_HALT, 0); -+ gpu_read(gpu, REG_A6XX_GBIF_HALT); -+ - gpu_write(gpu, REG_A6XX_RBBM_GPR0_CNTL, 0); -- /* Let's make extra sure that the GPU can access the memory.. */ -- mb(); -+ gpu_read(gpu, REG_A6XX_RBBM_GPR0_CNTL); - } else if (a6xx_has_gbif(adreno_gpu)) { - gpu_write(gpu, REG_A6XX_GBIF_HALT, 0); -+ gpu_read(gpu, REG_A6XX_GBIF_HALT); -+ - gpu_write(gpu, REG_A6XX_RBBM_GBIF_HALT, 0); -- /* Let's make extra sure that the GPU can access the memory.. */ -- mb(); -+ gpu_read(gpu, REG_A6XX_RBBM_GBIF_HALT); - } - - gpu_write(gpu, REG_A6XX_RBBM_SECVID_TSB_CNTL, 0); -diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c -index 0193d10867dd2f..97486eba01b7bf 100644 ---- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c -+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c -@@ -984,7 +984,7 @@ static int vop2_plane_atomic_check(struct drm_plane *plane, - return format; - - if (drm_rect_width(src) >> 16 < 4 || drm_rect_height(src) >> 16 < 4 || -- drm_rect_width(dest) < 4 || drm_rect_width(dest) < 4) { -+ drm_rect_width(dest) < 4 || drm_rect_height(dest) < 4) { - drm_err(vop2->drm, "Invalid size: %dx%d->%dx%d, min size is 4x4\n", - drm_rect_width(src) >> 16, drm_rect_height(src) >> 16, - drm_rect_width(dest), drm_rect_height(dest)); -diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c -index fa4652f2347189..4faa2108c0a73b 100644 ---- a/drivers/gpu/drm/scheduler/sched_main.c -+++ b/drivers/gpu/drm/scheduler/sched_main.c -@@ -783,13 +783,14 @@ int drm_sched_job_add_resv_dependencies(struct drm_sched_job *job, - dma_resv_assert_held(resv); - - dma_resv_for_each_fence(&cursor, resv, usage, fence) { -- /* Make sure to grab an additional ref on the added fence */ -- dma_fence_get(fence); -- ret = drm_sched_job_add_dependency(job, fence); -- if (ret) { -- dma_fence_put(fence); -+ /* -+ * As drm_sched_job_add_dependency always consumes the fence -+ * reference (even when it fails), and dma_resv_for_each_fence -+ * is not obtaining one, we need to grab one before calling. -+ */ -+ ret = drm_sched_job_add_dependency(job, dma_fence_get(fence)); -+ if (ret) - return ret; -- } - } - return 0; - } -diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c -index f5c217ac4bfaa7..f073d5621050a1 100644 ---- a/drivers/hid/hid-input.c -+++ b/drivers/hid/hid-input.c -@@ -622,7 +622,10 @@ static void hidinput_update_battery(struct hid_device *dev, unsigned int usage, - return; - } - -- if (value == 0 || value < dev->battery_min || value > dev->battery_max) -+ if ((usage & HID_USAGE_PAGE) == HID_UP_DIGITIZER && value == 0) -+ return; -+ -+ if (value < dev->battery_min || value > dev->battery_max) - return; - - capacity = hidinput_scale_battery_capacity(dev, value); -diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c -index a85581cd511fd3..b9e67b408a4b93 100644 ---- a/drivers/hid/hid-multitouch.c -+++ b/drivers/hid/hid-multitouch.c -@@ -83,9 +83,8 @@ enum latency_mode { - HID_LATENCY_HIGH = 1, - }; - --#define MT_IO_FLAGS_RUNNING 0 --#define MT_IO_FLAGS_ACTIVE_SLOTS 1 --#define MT_IO_FLAGS_PENDING_SLOTS 2 -+#define MT_IO_SLOTS_MASK GENMASK(7, 0) /* reserve first 8 bits for slot tracking */ -+#define MT_IO_FLAGS_RUNNING 32 - - static const bool mtrue = true; /* default for true */ - static const bool mfalse; /* default for false */ -@@ -161,7 +160,11 @@ struct mt_device { - struct mt_class mtclass; /* our mt device class */ - struct timer_list release_timer; /* to release sticky fingers */ - struct hid_device *hdev; /* hid_device we're attached to */ -- unsigned long mt_io_flags; /* mt flags (MT_IO_FLAGS_*) */ -+ unsigned long mt_io_flags; /* mt flags (MT_IO_FLAGS_RUNNING) -+ * first 8 bits are reserved for keeping the slot -+ * states, this is fine because we only support up -+ * to 250 slots (MT_MAX_MAXCONTACT) -+ */ - __u8 inputmode_value; /* InputMode HID feature value */ - __u8 maxcontacts; - bool is_buttonpad; /* is this device a button pad? */ -@@ -936,6 +939,7 @@ static void mt_release_pending_palms(struct mt_device *td, - - for_each_set_bit(slotnum, app->pending_palm_slots, td->maxcontacts) { - clear_bit(slotnum, app->pending_palm_slots); -+ clear_bit(slotnum, &td->mt_io_flags); - - input_mt_slot(input, slotnum); - input_mt_report_slot_inactive(input); -@@ -967,12 +971,6 @@ static void mt_sync_frame(struct mt_device *td, struct mt_application *app, - - app->num_received = 0; - app->left_button_state = 0; -- -- if (test_bit(MT_IO_FLAGS_ACTIVE_SLOTS, &td->mt_io_flags)) -- set_bit(MT_IO_FLAGS_PENDING_SLOTS, &td->mt_io_flags); -- else -- clear_bit(MT_IO_FLAGS_PENDING_SLOTS, &td->mt_io_flags); -- clear_bit(MT_IO_FLAGS_ACTIVE_SLOTS, &td->mt_io_flags); - } - - static int mt_compute_timestamp(struct mt_application *app, __s32 value) -@@ -1147,7 +1145,9 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input, - input_event(input, EV_ABS, ABS_MT_TOUCH_MAJOR, major); - input_event(input, EV_ABS, ABS_MT_TOUCH_MINOR, minor); - -- set_bit(MT_IO_FLAGS_ACTIVE_SLOTS, &td->mt_io_flags); -+ set_bit(slotnum, &td->mt_io_flags); -+ } else { -+ clear_bit(slotnum, &td->mt_io_flags); - } - - return 0; -@@ -1282,7 +1282,7 @@ static void mt_touch_report(struct hid_device *hid, - * defect. - */ - if (app->quirks & MT_QUIRK_STICKY_FINGERS) { -- if (test_bit(MT_IO_FLAGS_PENDING_SLOTS, &td->mt_io_flags)) -+ if (td->mt_io_flags & MT_IO_SLOTS_MASK) - mod_timer(&td->release_timer, - jiffies + msecs_to_jiffies(100)); - else -@@ -1658,6 +1658,7 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi) - case HID_CP_CONSUMER_CONTROL: - case HID_GD_WIRELESS_RADIO_CTLS: - case HID_GD_SYSTEM_MULTIAXIS: -+ case HID_DG_PEN: - /* already handled by hid core */ - break; - case HID_DG_TOUCHSCREEN: -@@ -1729,6 +1730,7 @@ static void mt_release_contacts(struct hid_device *hid) - for (i = 0; i < mt->num_slots; i++) { - input_mt_slot(input_dev, i); - input_mt_report_slot_inactive(input_dev); -+ clear_bit(i, &td->mt_io_flags); - } - input_mt_sync_frame(input_dev); - input_sync(input_dev); -@@ -1751,7 +1753,7 @@ static void mt_expired_timeout(struct timer_list *t) - */ - if (test_and_set_bit_lock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags)) - return; -- if (test_bit(MT_IO_FLAGS_PENDING_SLOTS, &td->mt_io_flags)) -+ if (td->mt_io_flags & MT_IO_SLOTS_MASK) - mt_release_contacts(hdev); - clear_bit_unlock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags); - } -diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600.h b/drivers/iio/imu/inv_icm42600/inv_icm42600.h -index 809734e566e332..e289afcb43e3c6 100644 ---- a/drivers/iio/imu/inv_icm42600/inv_icm42600.h -+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600.h -@@ -126,9 +126,9 @@ struct inv_icm42600_suspended { - * @suspended: suspended sensors configuration. - * @indio_gyro: gyroscope IIO device. - * @indio_accel: accelerometer IIO device. -- * @buffer: data transfer buffer aligned for DMA. -- * @fifo: FIFO management structure. - * @timestamp: interrupt timestamps. -+ * @fifo: FIFO management structure. -+ * @buffer: data transfer buffer aligned for DMA. - */ - struct inv_icm42600_state { - struct mutex lock; -@@ -142,12 +142,12 @@ struct inv_icm42600_state { - struct inv_icm42600_suspended suspended; - struct iio_dev *indio_gyro; - struct iio_dev *indio_accel; -- u8 buffer[2] __aligned(IIO_DMA_MINALIGN); -- struct inv_icm42600_fifo fifo; - struct { - s64 gyro; - s64 accel; - } timestamp; -+ struct inv_icm42600_fifo fifo; -+ u8 buffer[2] __aligned(IIO_DMA_MINALIGN); - }; - - /* Virtual register addresses: @bank on MSB (4 upper bits), @address on LSB */ -diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c -index a1f055014cc652..99eb651743f80f 100644 ---- a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c -+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c -@@ -567,20 +567,12 @@ static void inv_icm42600_disable_vdd_reg(void *_data) - static void inv_icm42600_disable_vddio_reg(void *_data) - { - struct inv_icm42600_state *st = _data; -- const struct device *dev = regmap_get_device(st->map); -- int ret; -- -- ret = regulator_disable(st->vddio_supply); -- if (ret) -- dev_err(dev, "failed to disable vddio error %d\n", ret); --} -+ struct device *dev = regmap_get_device(st->map); - --static void inv_icm42600_disable_pm(void *_data) --{ -- struct device *dev = _data; -+ if (pm_runtime_status_suspended(dev)) -+ return; - -- pm_runtime_put_sync(dev); -- pm_runtime_disable(dev); -+ regulator_disable(st->vddio_supply); - } - - int inv_icm42600_core_probe(struct regmap *regmap, int chip, int irq, -@@ -677,16 +669,14 @@ int inv_icm42600_core_probe(struct regmap *regmap, int chip, int irq, - return ret; - - /* setup runtime power management */ -- ret = pm_runtime_set_active(dev); -+ ret = devm_pm_runtime_set_active_enabled(dev); - if (ret) - return ret; -- pm_runtime_get_noresume(dev); -- pm_runtime_enable(dev); -+ - pm_runtime_set_autosuspend_delay(dev, INV_ICM42600_SUSPEND_DELAY_MS); - pm_runtime_use_autosuspend(dev); -- pm_runtime_put(dev); - -- return devm_add_action_or_reset(dev, inv_icm42600_disable_pm, dev); -+ return ret; - } - EXPORT_SYMBOL_NS_GPL(inv_icm42600_core_probe, IIO_ICM42600); - -@@ -697,17 +687,15 @@ EXPORT_SYMBOL_NS_GPL(inv_icm42600_core_probe, IIO_ICM42600); - static int inv_icm42600_suspend(struct device *dev) - { - struct inv_icm42600_state *st = dev_get_drvdata(dev); -- int ret; -+ int ret = 0; - - mutex_lock(&st->lock); - - st->suspended.gyro = st->conf.gyro.mode; - st->suspended.accel = st->conf.accel.mode; - st->suspended.temp = st->conf.temp_en; -- if (pm_runtime_suspended(dev)) { -- ret = 0; -+ if (pm_runtime_suspended(dev)) - goto out_unlock; -- } - - /* disable FIFO data streaming */ - if (st->fifo.on) { -@@ -739,10 +727,13 @@ static int inv_icm42600_resume(struct device *dev) - struct inv_icm42600_state *st = dev_get_drvdata(dev); - struct inv_sensors_timestamp *gyro_ts = iio_priv(st->indio_gyro); - struct inv_sensors_timestamp *accel_ts = iio_priv(st->indio_accel); -- int ret; -+ int ret = 0; - - mutex_lock(&st->lock); - -+ if (pm_runtime_suspended(dev)) -+ goto out_unlock; -+ - ret = inv_icm42600_enable_regulator_vddio(st); - if (ret) - goto out_unlock; -diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h -index 2810ebe9b5f75c..5a4676d5207935 100644 ---- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h -+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h -@@ -361,7 +361,7 @@ void mxc_isi_channel_get(struct mxc_isi_pipe *pipe); - void mxc_isi_channel_put(struct mxc_isi_pipe *pipe); - void mxc_isi_channel_enable(struct mxc_isi_pipe *pipe); - void mxc_isi_channel_disable(struct mxc_isi_pipe *pipe); --int mxc_isi_channel_chain(struct mxc_isi_pipe *pipe, bool bypass); -+int mxc_isi_channel_chain(struct mxc_isi_pipe *pipe); - void mxc_isi_channel_unchain(struct mxc_isi_pipe *pipe); - - void mxc_isi_channel_config(struct mxc_isi_pipe *pipe, -diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c -index 19e80b95ffeaa3..ece352171b936d 100644 ---- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c -+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c -@@ -589,7 +589,7 @@ void mxc_isi_channel_release(struct mxc_isi_pipe *pipe) - * - * TODO: Support secondary line buffer for downscaling YUV420 images. - */ --int mxc_isi_channel_chain(struct mxc_isi_pipe *pipe, bool bypass) -+int mxc_isi_channel_chain(struct mxc_isi_pipe *pipe) - { - /* Channel chaining requires both line and output buffer. */ - const u8 resources = MXC_ISI_CHANNEL_RES_OUTPUT_BUF -diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c -index cd6c52e9d158a7..81223d28ee56e8 100644 ---- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c -+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c -@@ -43,7 +43,6 @@ struct mxc_isi_m2m_ctx_queue_data { - struct v4l2_pix_format_mplane format; - const struct mxc_isi_format_info *info; - u32 sequence; -- bool streaming; - }; - - struct mxc_isi_m2m_ctx { -@@ -236,6 +235,65 @@ static void mxc_isi_m2m_vb2_buffer_queue(struct vb2_buffer *vb2) - v4l2_m2m_buf_queue(ctx->fh.m2m_ctx, vbuf); - } - -+static int mxc_isi_m2m_vb2_prepare_streaming(struct vb2_queue *q) -+{ -+ struct mxc_isi_m2m_ctx *ctx = vb2_get_drv_priv(q); -+ const struct v4l2_pix_format_mplane *out_pix = &ctx->queues.out.format; -+ const struct v4l2_pix_format_mplane *cap_pix = &ctx->queues.cap.format; -+ const struct mxc_isi_format_info *cap_info = ctx->queues.cap.info; -+ const struct mxc_isi_format_info *out_info = ctx->queues.out.info; -+ struct mxc_isi_m2m *m2m = ctx->m2m; -+ int ret; -+ -+ guard(mutex)(&m2m->lock); -+ -+ if (m2m->usage_count == INT_MAX) -+ return -EOVERFLOW; -+ -+ /* -+ * Acquire the pipe and initialize the channel with the first user of -+ * the M2M device. -+ */ -+ if (m2m->usage_count == 0) { -+ bool bypass = cap_pix->width == out_pix->width && -+ cap_pix->height == out_pix->height && -+ cap_info->encoding == out_info->encoding; -+ -+ ret = mxc_isi_channel_acquire(m2m->pipe, -+ &mxc_isi_m2m_frame_write_done, -+ bypass); -+ if (ret) -+ return ret; -+ -+ mxc_isi_channel_get(m2m->pipe); -+ } -+ -+ m2m->usage_count++; -+ -+ /* -+ * Allocate resources for the channel, counting how many users require -+ * buffer chaining. -+ */ -+ if (!ctx->chained && out_pix->width > MXC_ISI_MAX_WIDTH_UNCHAINED) { -+ ret = mxc_isi_channel_chain(m2m->pipe); -+ if (ret) -+ goto err_deinit; -+ -+ m2m->chained_count++; -+ ctx->chained = true; -+ } -+ -+ return 0; -+ -+err_deinit: -+ if (--m2m->usage_count == 0) { -+ mxc_isi_channel_put(m2m->pipe); -+ mxc_isi_channel_release(m2m->pipe); -+ } -+ -+ return ret; -+} -+ - static int mxc_isi_m2m_vb2_start_streaming(struct vb2_queue *q, - unsigned int count) - { -@@ -265,6 +323,35 @@ static void mxc_isi_m2m_vb2_stop_streaming(struct vb2_queue *q) - } - } - -+static void mxc_isi_m2m_vb2_unprepare_streaming(struct vb2_queue *q) -+{ -+ struct mxc_isi_m2m_ctx *ctx = vb2_get_drv_priv(q); -+ struct mxc_isi_m2m *m2m = ctx->m2m; -+ -+ guard(mutex)(&m2m->lock); -+ -+ /* -+ * If the last context is this one, reset it to make sure the device -+ * will be reconfigured when streaming is restarted. -+ */ -+ if (m2m->last_ctx == ctx) -+ m2m->last_ctx = NULL; -+ -+ /* Free the channel resources if this is the last chained context. */ -+ if (ctx->chained && --m2m->chained_count == 0) -+ mxc_isi_channel_unchain(m2m->pipe); -+ ctx->chained = false; -+ -+ /* Turn off the light with the last user. */ -+ if (--m2m->usage_count == 0) { -+ mxc_isi_channel_disable(m2m->pipe); -+ mxc_isi_channel_put(m2m->pipe); -+ mxc_isi_channel_release(m2m->pipe); -+ } -+ -+ WARN_ON(m2m->usage_count < 0); -+} -+ - static const struct vb2_ops mxc_isi_m2m_vb2_qops = { - .queue_setup = mxc_isi_m2m_vb2_queue_setup, - .buf_init = mxc_isi_m2m_vb2_buffer_init, -@@ -272,8 +359,10 @@ static const struct vb2_ops mxc_isi_m2m_vb2_qops = { - .buf_queue = mxc_isi_m2m_vb2_buffer_queue, - .wait_prepare = vb2_ops_wait_prepare, - .wait_finish = vb2_ops_wait_finish, -+ .prepare_streaming = mxc_isi_m2m_vb2_prepare_streaming, - .start_streaming = mxc_isi_m2m_vb2_start_streaming, - .stop_streaming = mxc_isi_m2m_vb2_stop_streaming, -+ .unprepare_streaming = mxc_isi_m2m_vb2_unprepare_streaming, - }; - - static int mxc_isi_m2m_queue_init(void *priv, struct vb2_queue *src_vq, -@@ -483,136 +572,6 @@ static int mxc_isi_m2m_s_fmt_vid(struct file *file, void *fh, - return 0; - } - --static int mxc_isi_m2m_streamon(struct file *file, void *fh, -- enum v4l2_buf_type type) --{ -- struct mxc_isi_m2m_ctx *ctx = to_isi_m2m_ctx(fh); -- struct mxc_isi_m2m_ctx_queue_data *q = mxc_isi_m2m_ctx_qdata(ctx, type); -- const struct v4l2_pix_format_mplane *out_pix = &ctx->queues.out.format; -- const struct v4l2_pix_format_mplane *cap_pix = &ctx->queues.cap.format; -- const struct mxc_isi_format_info *cap_info = ctx->queues.cap.info; -- const struct mxc_isi_format_info *out_info = ctx->queues.out.info; -- struct mxc_isi_m2m *m2m = ctx->m2m; -- bool bypass; -- int ret; -- -- if (q->streaming) -- return 0; -- -- mutex_lock(&m2m->lock); -- -- if (m2m->usage_count == INT_MAX) { -- ret = -EOVERFLOW; -- goto unlock; -- } -- -- bypass = cap_pix->width == out_pix->width && -- cap_pix->height == out_pix->height && -- cap_info->encoding == out_info->encoding; -- -- /* -- * Acquire the pipe and initialize the channel with the first user of -- * the M2M device. -- */ -- if (m2m->usage_count == 0) { -- ret = mxc_isi_channel_acquire(m2m->pipe, -- &mxc_isi_m2m_frame_write_done, -- bypass); -- if (ret) -- goto unlock; -- -- mxc_isi_channel_get(m2m->pipe); -- } -- -- m2m->usage_count++; -- -- /* -- * Allocate resources for the channel, counting how many users require -- * buffer chaining. -- */ -- if (!ctx->chained && out_pix->width > MXC_ISI_MAX_WIDTH_UNCHAINED) { -- ret = mxc_isi_channel_chain(m2m->pipe, bypass); -- if (ret) -- goto deinit; -- -- m2m->chained_count++; -- ctx->chained = true; -- } -- -- /* -- * Drop the lock to start the stream, as the .device_run() operation -- * needs to acquire it. -- */ -- mutex_unlock(&m2m->lock); -- ret = v4l2_m2m_ioctl_streamon(file, fh, type); -- if (ret) { -- /* Reacquire the lock for the cleanup path. */ -- mutex_lock(&m2m->lock); -- goto unchain; -- } -- -- q->streaming = true; -- -- return 0; -- --unchain: -- if (ctx->chained && --m2m->chained_count == 0) -- mxc_isi_channel_unchain(m2m->pipe); -- ctx->chained = false; -- --deinit: -- if (--m2m->usage_count == 0) { -- mxc_isi_channel_put(m2m->pipe); -- mxc_isi_channel_release(m2m->pipe); -- } -- --unlock: -- mutex_unlock(&m2m->lock); -- return ret; --} -- --static int mxc_isi_m2m_streamoff(struct file *file, void *fh, -- enum v4l2_buf_type type) --{ -- struct mxc_isi_m2m_ctx *ctx = to_isi_m2m_ctx(fh); -- struct mxc_isi_m2m_ctx_queue_data *q = mxc_isi_m2m_ctx_qdata(ctx, type); -- struct mxc_isi_m2m *m2m = ctx->m2m; -- -- v4l2_m2m_ioctl_streamoff(file, fh, type); -- -- if (!q->streaming) -- return 0; -- -- mutex_lock(&m2m->lock); -- -- /* -- * If the last context is this one, reset it to make sure the device -- * will be reconfigured when streaming is restarted. -- */ -- if (m2m->last_ctx == ctx) -- m2m->last_ctx = NULL; -- -- /* Free the channel resources if this is the last chained context. */ -- if (ctx->chained && --m2m->chained_count == 0) -- mxc_isi_channel_unchain(m2m->pipe); -- ctx->chained = false; -- -- /* Turn off the light with the last user. */ -- if (--m2m->usage_count == 0) { -- mxc_isi_channel_disable(m2m->pipe); -- mxc_isi_channel_put(m2m->pipe); -- mxc_isi_channel_release(m2m->pipe); -- } -- -- WARN_ON(m2m->usage_count < 0); -- -- mutex_unlock(&m2m->lock); -- -- q->streaming = false; -- -- return 0; --} -- - static const struct v4l2_ioctl_ops mxc_isi_m2m_ioctl_ops = { - .vidioc_querycap = mxc_isi_m2m_querycap, - -@@ -633,8 +592,8 @@ static const struct v4l2_ioctl_ops mxc_isi_m2m_ioctl_ops = { - .vidioc_prepare_buf = v4l2_m2m_ioctl_prepare_buf, - .vidioc_create_bufs = v4l2_m2m_ioctl_create_bufs, - -- .vidioc_streamon = mxc_isi_m2m_streamon, -- .vidioc_streamoff = mxc_isi_m2m_streamoff, -+ .vidioc_streamon = v4l2_m2m_ioctl_streamon, -+ .vidioc_streamoff = v4l2_m2m_ioctl_streamoff, - - .vidioc_subscribe_event = v4l2_ctrl_subscribe_event, - .vidioc_unsubscribe_event = v4l2_event_unsubscribe, -diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c -index 65d20e9bae69db..483523327c025f 100644 ---- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c -+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c -@@ -851,7 +851,7 @@ int mxc_isi_pipe_acquire(struct mxc_isi_pipe *pipe, - - /* Chain the channel if needed for wide resolutions. */ - if (sink_fmt->width > MXC_ISI_MAX_WIDTH_UNCHAINED) { -- ret = mxc_isi_channel_chain(pipe, bypass); -+ ret = mxc_isi_channel_chain(pipe); - if (ret) - mxc_isi_channel_release(pipe); - } -diff --git a/drivers/net/can/m_can/m_can_platform.c b/drivers/net/can/m_can/m_can_platform.c -index cdb28d6a092c6d..e5477775992e6e 100644 ---- a/drivers/net/can/m_can/m_can_platform.c -+++ b/drivers/net/can/m_can/m_can_platform.c -@@ -183,7 +183,7 @@ static void m_can_plat_remove(struct platform_device *pdev) - struct m_can_classdev *mcan_class = &priv->cdev; - - m_can_class_unregister(mcan_class); -- -+ pm_runtime_disable(mcan_class->dev); - m_can_class_free_dev(mcan_class->net); - } - -diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c -index de616d6589c0bb..9bd61fd8e5013f 100644 ---- a/drivers/net/can/usb/gs_usb.c -+++ b/drivers/net/can/usb/gs_usb.c -@@ -286,11 +286,6 @@ struct gs_host_frame { - #define GS_MAX_RX_URBS 30 - #define GS_NAPI_WEIGHT 32 - --/* Maximum number of interfaces the driver supports per device. -- * Current hardware only supports 3 interfaces. The future may vary. -- */ --#define GS_MAX_INTF 3 -- - struct gs_tx_context { - struct gs_can *dev; - unsigned int echo_id; -@@ -321,7 +316,6 @@ struct gs_can { - - /* usb interface struct */ - struct gs_usb { -- struct gs_can *canch[GS_MAX_INTF]; - struct usb_anchor rx_submitted; - struct usb_device *udev; - -@@ -333,9 +327,11 @@ struct gs_usb { - - unsigned int hf_size_rx; - u8 active_channels; -+ u8 channel_cnt; - - unsigned int pipe_in; - unsigned int pipe_out; -+ struct gs_can *canch[] __counted_by(channel_cnt); - }; - - /* 'allocate' a tx context. -@@ -596,7 +592,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) - } - - /* device reports out of range channel id */ -- if (hf->channel >= GS_MAX_INTF) -+ if (hf->channel >= parent->channel_cnt) - goto device_detach; - - dev = parent->canch[hf->channel]; -@@ -696,7 +692,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) - /* USB failure take down all interfaces */ - if (rc == -ENODEV) { - device_detach: -- for (rc = 0; rc < GS_MAX_INTF; rc++) { -+ for (rc = 0; rc < parent->channel_cnt; rc++) { - if (parent->canch[rc]) - netif_device_detach(parent->canch[rc]->netdev); - } -@@ -1246,6 +1242,7 @@ static struct gs_can *gs_make_candev(unsigned int channel, - - netdev->flags |= IFF_ECHO; /* we support full roundtrip echo */ - netdev->dev_id = channel; -+ netdev->dev_port = channel; - - /* dev setup */ - strcpy(dev->bt_const.name, KBUILD_MODNAME); -@@ -1457,17 +1454,19 @@ static int gs_usb_probe(struct usb_interface *intf, - icount = dconf.icount + 1; - dev_info(&intf->dev, "Configuring for %u interfaces\n", icount); - -- if (icount > GS_MAX_INTF) { -+ if (icount > type_max(parent->channel_cnt)) { - dev_err(&intf->dev, - "Driver cannot handle more that %u CAN interfaces\n", -- GS_MAX_INTF); -+ type_max(parent->channel_cnt)); - return -EINVAL; - } - -- parent = kzalloc(sizeof(*parent), GFP_KERNEL); -+ parent = kzalloc(struct_size(parent, canch, icount), GFP_KERNEL); - if (!parent) - return -ENOMEM; - -+ parent->channel_cnt = icount; -+ - init_usb_anchor(&parent->rx_submitted); - - usb_set_intfdata(intf, parent); -@@ -1528,7 +1527,7 @@ static void gs_usb_disconnect(struct usb_interface *intf) - return; - } - -- for (i = 0; i < GS_MAX_INTF; i++) -+ for (i = 0; i < parent->channel_cnt; i++) - if (parent->canch[i]) - gs_destroy_candev(parent->canch[i]); - -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c -index 34d45cebefb5d3..b4d57da71de2a1 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c -+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c -@@ -1172,7 +1172,6 @@ static void xgbe_free_rx_data(struct xgbe_prv_data *pdata) - - static int xgbe_phy_reset(struct xgbe_prv_data *pdata) - { -- pdata->phy_link = -1; - pdata->phy_speed = SPEED_UNKNOWN; - - return pdata->phy_if.phy_reset(pdata); -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c -index 8345d439184ebe..63012119f2c8eb 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c -+++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c -@@ -1664,6 +1664,7 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata) - pdata->phy.duplex = DUPLEX_FULL; - } - -+ pdata->phy_link = 0; - pdata->phy.link = 0; - - pdata->phy.pause_autoneg = pdata->pause_autoneg; -diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c -index b3878975bd9c05..ea4973096aa287 100644 ---- a/drivers/net/ethernet/broadcom/tg3.c -+++ b/drivers/net/ethernet/broadcom/tg3.c -@@ -5814,7 +5814,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset) - u32 current_speed = SPEED_UNKNOWN; - u8 current_duplex = DUPLEX_UNKNOWN; - bool current_link_up = false; -- u32 local_adv, remote_adv, sgsr; -+ u32 local_adv = 0, remote_adv = 0, sgsr; - - if ((tg3_asic_rev(tp) == ASIC_REV_5719 || - tg3_asic_rev(tp) == ASIC_REV_5720) && -@@ -5955,9 +5955,6 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset) - else - current_duplex = DUPLEX_HALF; - -- local_adv = 0; -- remote_adv = 0; -- - if (bmcr & BMCR_ANENABLE) { - u32 common; - -diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c -index 1c3a5cf379cd03..72c97dcd0fee0e 100644 ---- a/drivers/net/ethernet/dlink/dl2k.c -+++ b/drivers/net/ethernet/dlink/dl2k.c -@@ -498,25 +498,34 @@ static int alloc_list(struct net_device *dev) - for (i = 0; i < RX_RING_SIZE; i++) { - /* Allocated fixed size of skbuff */ - struct sk_buff *skb; -+ dma_addr_t addr; - - skb = netdev_alloc_skb_ip_align(dev, np->rx_buf_sz); - np->rx_skbuff[i] = skb; -- if (!skb) { -- free_list(dev); -- return -ENOMEM; -- } -+ if (!skb) -+ goto err_free_list; -+ -+ addr = dma_map_single(&np->pdev->dev, skb->data, -+ np->rx_buf_sz, DMA_FROM_DEVICE); -+ if (dma_mapping_error(&np->pdev->dev, addr)) -+ goto err_kfree_skb; - - np->rx_ring[i].next_desc = cpu_to_le64(np->rx_ring_dma + - ((i + 1) % RX_RING_SIZE) * - sizeof(struct netdev_desc)); - /* Rubicon now supports 40 bits of addressing space. */ -- np->rx_ring[i].fraginfo = -- cpu_to_le64(dma_map_single(&np->pdev->dev, skb->data, -- np->rx_buf_sz, DMA_FROM_DEVICE)); -+ np->rx_ring[i].fraginfo = cpu_to_le64(addr); - np->rx_ring[i].fraginfo |= cpu_to_le64((u64)np->rx_buf_sz << 48); - } - - return 0; -+ -+err_kfree_skb: -+ dev_kfree_skb(np->rx_skbuff[i]); -+ np->rx_skbuff[i] = NULL; -+err_free_list: -+ free_list(dev); -+ return -ENOMEM; - } - - static void rio_hw_init(struct net_device *dev) -diff --git a/drivers/net/ethernet/intel/ixgbevf/defines.h b/drivers/net/ethernet/intel/ixgbevf/defines.h -index 5f08779c0e4e31..e177d1d58696aa 100644 ---- a/drivers/net/ethernet/intel/ixgbevf/defines.h -+++ b/drivers/net/ethernet/intel/ixgbevf/defines.h -@@ -1,5 +1,5 @@ - /* SPDX-License-Identifier: GPL-2.0 */ --/* Copyright(c) 1999 - 2018 Intel Corporation. */ -+/* Copyright(c) 1999 - 2024 Intel Corporation. */ - - #ifndef _IXGBEVF_DEFINES_H_ - #define _IXGBEVF_DEFINES_H_ -@@ -16,6 +16,9 @@ - #define IXGBE_DEV_ID_X550_VF_HV 0x1564 - #define IXGBE_DEV_ID_X550EM_X_VF_HV 0x15A9 - -+#define IXGBE_DEV_ID_E610_VF 0x57AD -+#define IXGBE_SUBDEV_ID_E610_VF_HV 0x00FF -+ - #define IXGBE_VF_IRQ_CLEAR_MASK 7 - #define IXGBE_VF_MAX_TX_QUEUES 8 - #define IXGBE_VF_MAX_RX_QUEUES 8 -@@ -25,6 +28,7 @@ - - /* Link speed */ - typedef u32 ixgbe_link_speed; -+#define IXGBE_LINK_SPEED_UNKNOWN 0 - #define IXGBE_LINK_SPEED_1GB_FULL 0x0020 - #define IXGBE_LINK_SPEED_10GB_FULL 0x0080 - #define IXGBE_LINK_SPEED_100_FULL 0x0008 -diff --git a/drivers/net/ethernet/intel/ixgbevf/ipsec.c b/drivers/net/ethernet/intel/ixgbevf/ipsec.c -index f804b35d79c726..83b3243f172c72 100644 ---- a/drivers/net/ethernet/intel/ixgbevf/ipsec.c -+++ b/drivers/net/ethernet/intel/ixgbevf/ipsec.c -@@ -271,6 +271,9 @@ static int ixgbevf_ipsec_add_sa(struct xfrm_state *xs, - adapter = netdev_priv(dev); - ipsec = adapter->ipsec; - -+ if (!(adapter->pf_features & IXGBEVF_PF_SUP_IPSEC)) -+ return -EOPNOTSUPP; -+ - if (xs->id.proto != IPPROTO_ESP && xs->id.proto != IPPROTO_AH) { - NL_SET_ERR_MSG_MOD(extack, "Unsupported protocol for IPsec offload"); - return -EINVAL; -@@ -400,6 +403,9 @@ static void ixgbevf_ipsec_del_sa(struct xfrm_state *xs) - adapter = netdev_priv(dev); - ipsec = adapter->ipsec; - -+ if (!(adapter->pf_features & IXGBEVF_PF_SUP_IPSEC)) -+ return; -+ - if (xs->xso.dir == XFRM_DEV_OFFLOAD_IN) { - sa_idx = xs->xso.offload_handle - IXGBE_IPSEC_BASE_RX_INDEX; - -@@ -628,6 +634,10 @@ void ixgbevf_init_ipsec_offload(struct ixgbevf_adapter *adapter) - size_t size; - - switch (adapter->hw.api_version) { -+ case ixgbe_mbox_api_17: -+ if (!(adapter->pf_features & IXGBEVF_PF_SUP_IPSEC)) -+ return; -+ break; - case ixgbe_mbox_api_14: - break; - default: -diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h b/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h -index 130cb868774c40..f31068e24e867f 100644 ---- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h -+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h -@@ -1,5 +1,5 @@ - /* SPDX-License-Identifier: GPL-2.0 */ --/* Copyright(c) 1999 - 2018 Intel Corporation. */ -+/* Copyright(c) 1999 - 2024 Intel Corporation. */ - - #ifndef _IXGBEVF_H_ - #define _IXGBEVF_H_ -@@ -366,6 +366,13 @@ struct ixgbevf_adapter { - /* Interrupt Throttle Rate */ - u32 eitr_param; - -+ u32 pf_features; -+#define IXGBEVF_PF_SUP_IPSEC BIT(0) -+#define IXGBEVF_PF_SUP_ESX_MBX BIT(1) -+ -+#define IXGBEVF_SUPPORTED_FEATURES (IXGBEVF_PF_SUP_IPSEC | \ -+ IXGBEVF_PF_SUP_ESX_MBX) -+ - struct ixgbevf_hw_stats stats; - - unsigned long state; -@@ -418,6 +425,8 @@ enum ixgbevf_boards { - board_X550EM_x_vf, - board_X550EM_x_vf_hv, - board_x550em_a_vf, -+ board_e610_vf, -+ board_e610_vf_hv, - }; - - enum ixgbevf_xcast_modes { -@@ -434,11 +443,13 @@ extern const struct ixgbevf_info ixgbevf_X550EM_x_vf_info; - extern const struct ixgbe_mbx_operations ixgbevf_mbx_ops; - extern const struct ixgbe_mbx_operations ixgbevf_mbx_ops_legacy; - extern const struct ixgbevf_info ixgbevf_x550em_a_vf_info; -+extern const struct ixgbevf_info ixgbevf_e610_vf_info; - - extern const struct ixgbevf_info ixgbevf_82599_vf_hv_info; - extern const struct ixgbevf_info ixgbevf_X540_vf_hv_info; - extern const struct ixgbevf_info ixgbevf_X550_vf_hv_info; - extern const struct ixgbevf_info ixgbevf_X550EM_x_vf_hv_info; -+extern const struct ixgbevf_info ixgbevf_e610_vf_hv_info; - extern const struct ixgbe_mbx_operations ixgbevf_hv_mbx_ops; - - /* needed by ethtool.c */ -diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c -index a44e4bd561421a..72b17a0f052c2b 100644 ---- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c -+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c -@@ -1,5 +1,5 @@ - // SPDX-License-Identifier: GPL-2.0 --/* Copyright(c) 1999 - 2018 Intel Corporation. */ -+/* Copyright(c) 1999 - 2024 Intel Corporation. */ - - /****************************************************************************** - Copyright (c)2006 - 2007 Myricom, Inc. for some LRO specific code -@@ -39,7 +39,7 @@ static const char ixgbevf_driver_string[] = - "Intel(R) 10 Gigabit PCI Express Virtual Function Network Driver"; - - static char ixgbevf_copyright[] = -- "Copyright (c) 2009 - 2018 Intel Corporation."; -+ "Copyright (c) 2009 - 2024 Intel Corporation."; - - static const struct ixgbevf_info *ixgbevf_info_tbl[] = { - [board_82599_vf] = &ixgbevf_82599_vf_info, -@@ -51,6 +51,8 @@ static const struct ixgbevf_info *ixgbevf_info_tbl[] = { - [board_X550EM_x_vf] = &ixgbevf_X550EM_x_vf_info, - [board_X550EM_x_vf_hv] = &ixgbevf_X550EM_x_vf_hv_info, - [board_x550em_a_vf] = &ixgbevf_x550em_a_vf_info, -+ [board_e610_vf] = &ixgbevf_e610_vf_info, -+ [board_e610_vf_hv] = &ixgbevf_e610_vf_hv_info, - }; - - /* ixgbevf_pci_tbl - PCI Device ID Table -@@ -71,6 +73,9 @@ static const struct pci_device_id ixgbevf_pci_tbl[] = { - {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_X550EM_X_VF), board_X550EM_x_vf }, - {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_X550EM_X_VF_HV), board_X550EM_x_vf_hv}, - {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_X550EM_A_VF), board_x550em_a_vf }, -+ {PCI_VDEVICE_SUB(INTEL, IXGBE_DEV_ID_E610_VF, PCI_ANY_ID, -+ IXGBE_SUBDEV_ID_E610_VF_HV), board_e610_vf_hv}, -+ {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_E610_VF), board_e610_vf}, - /* required last entry */ - {0, } - }; -@@ -2270,10 +2275,36 @@ static void ixgbevf_init_last_counter_stats(struct ixgbevf_adapter *adapter) - adapter->stats.base_vfmprc = adapter->stats.last_vfmprc; - } - -+/** -+ * ixgbevf_set_features - Set features supported by PF -+ * @adapter: pointer to the adapter struct -+ * -+ * Negotiate with PF supported features and then set pf_features accordingly. -+ */ -+static void ixgbevf_set_features(struct ixgbevf_adapter *adapter) -+{ -+ u32 *pf_features = &adapter->pf_features; -+ struct ixgbe_hw *hw = &adapter->hw; -+ int err; -+ -+ err = hw->mac.ops.negotiate_features(hw, pf_features); -+ if (err && err != -EOPNOTSUPP) -+ netdev_dbg(adapter->netdev, -+ "PF feature negotiation failed.\n"); -+ -+ /* Address also pre API 1.7 cases */ -+ if (hw->api_version == ixgbe_mbox_api_14) -+ *pf_features |= IXGBEVF_PF_SUP_IPSEC; -+ else if (hw->api_version == ixgbe_mbox_api_15) -+ *pf_features |= IXGBEVF_PF_SUP_ESX_MBX; -+} -+ - static void ixgbevf_negotiate_api(struct ixgbevf_adapter *adapter) - { - struct ixgbe_hw *hw = &adapter->hw; - static const int api[] = { -+ ixgbe_mbox_api_17, -+ ixgbe_mbox_api_16, - ixgbe_mbox_api_15, - ixgbe_mbox_api_14, - ixgbe_mbox_api_13, -@@ -2293,7 +2324,9 @@ static void ixgbevf_negotiate_api(struct ixgbevf_adapter *adapter) - idx++; - } - -- if (hw->api_version >= ixgbe_mbox_api_15) { -+ ixgbevf_set_features(adapter); -+ -+ if (adapter->pf_features & IXGBEVF_PF_SUP_ESX_MBX) { - hw->mbx.ops.init_params(hw); - memcpy(&hw->mbx.ops, &ixgbevf_mbx_ops, - sizeof(struct ixgbe_mbx_operations)); -@@ -2650,6 +2683,8 @@ static void ixgbevf_set_num_queues(struct ixgbevf_adapter *adapter) - case ixgbe_mbox_api_13: - case ixgbe_mbox_api_14: - case ixgbe_mbox_api_15: -+ case ixgbe_mbox_api_16: -+ case ixgbe_mbox_api_17: - if (adapter->xdp_prog && - hw->mac.max_tx_queues == rss) - rss = rss > 3 ? 2 : 1; -@@ -4644,6 +4679,8 @@ static int ixgbevf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - case ixgbe_mbox_api_13: - case ixgbe_mbox_api_14: - case ixgbe_mbox_api_15: -+ case ixgbe_mbox_api_16: -+ case ixgbe_mbox_api_17: - netdev->max_mtu = IXGBE_MAX_JUMBO_FRAME_SIZE - - (ETH_HLEN + ETH_FCS_LEN); - break; -@@ -4694,6 +4731,9 @@ static int ixgbevf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - case ixgbe_mac_X540_vf: - dev_info(&pdev->dev, "Intel(R) X540 Virtual Function\n"); - break; -+ case ixgbe_mac_e610_vf: -+ dev_info(&pdev->dev, "Intel(R) E610 Virtual Function\n"); -+ break; - case ixgbe_mac_82599_vf: - default: - dev_info(&pdev->dev, "Intel(R) 82599 Virtual Function\n"); -diff --git a/drivers/net/ethernet/intel/ixgbevf/mbx.h b/drivers/net/ethernet/intel/ixgbevf/mbx.h -index 835bbcc5cc8e63..a8ed23ee66aa84 100644 ---- a/drivers/net/ethernet/intel/ixgbevf/mbx.h -+++ b/drivers/net/ethernet/intel/ixgbevf/mbx.h -@@ -66,6 +66,8 @@ enum ixgbe_pfvf_api_rev { - ixgbe_mbox_api_13, /* API version 1.3, linux/freebsd VF driver */ - ixgbe_mbox_api_14, /* API version 1.4, linux/freebsd VF driver */ - ixgbe_mbox_api_15, /* API version 1.5, linux/freebsd VF driver */ -+ ixgbe_mbox_api_16, /* API version 1.6, linux/freebsd VF driver */ -+ ixgbe_mbox_api_17, /* API version 1.7, linux/freebsd VF driver */ - /* This value should always be last */ - ixgbe_mbox_api_unknown, /* indicates that API version is not known */ - }; -@@ -102,6 +104,12 @@ enum ixgbe_pfvf_api_rev { - - #define IXGBE_VF_GET_LINK_STATE 0x10 /* get vf link state */ - -+/* mailbox API, version 1.6 VF requests */ -+#define IXGBE_VF_GET_PF_LINK_STATE 0x11 /* request PF to send link info */ -+ -+/* mailbox API, version 1.7 VF requests */ -+#define IXGBE_VF_FEATURES_NEGOTIATE 0x12 /* get features supported by PF*/ -+ - /* length of permanent address message returned from PF */ - #define IXGBE_VF_PERMADDR_MSG_LEN 4 - /* word in permanent address message with the current multicast type */ -diff --git a/drivers/net/ethernet/intel/ixgbevf/vf.c b/drivers/net/ethernet/intel/ixgbevf/vf.c -index 1641d00d8ed35c..65257107dfc8a4 100644 ---- a/drivers/net/ethernet/intel/ixgbevf/vf.c -+++ b/drivers/net/ethernet/intel/ixgbevf/vf.c -@@ -1,5 +1,5 @@ - // SPDX-License-Identifier: GPL-2.0 --/* Copyright(c) 1999 - 2018 Intel Corporation. */ -+/* Copyright(c) 1999 - 2024 Intel Corporation. */ - - #include "vf.h" - #include "ixgbevf.h" -@@ -313,6 +313,8 @@ int ixgbevf_get_reta_locked(struct ixgbe_hw *hw, u32 *reta, int num_rx_queues) - * is not supported for this device type. - */ - switch (hw->api_version) { -+ case ixgbe_mbox_api_17: -+ case ixgbe_mbox_api_16: - case ixgbe_mbox_api_15: - case ixgbe_mbox_api_14: - case ixgbe_mbox_api_13: -@@ -382,6 +384,8 @@ int ixgbevf_get_rss_key_locked(struct ixgbe_hw *hw, u8 *rss_key) - * or if the operation is not supported for this device type. - */ - switch (hw->api_version) { -+ case ixgbe_mbox_api_17: -+ case ixgbe_mbox_api_16: - case ixgbe_mbox_api_15: - case ixgbe_mbox_api_14: - case ixgbe_mbox_api_13: -@@ -552,6 +556,8 @@ static s32 ixgbevf_update_xcast_mode(struct ixgbe_hw *hw, int xcast_mode) - case ixgbe_mbox_api_13: - case ixgbe_mbox_api_14: - case ixgbe_mbox_api_15: -+ case ixgbe_mbox_api_16: -+ case ixgbe_mbox_api_17: - break; - default: - return -EOPNOTSUPP; -@@ -624,6 +630,85 @@ static s32 ixgbevf_hv_get_link_state_vf(struct ixgbe_hw *hw, bool *link_state) - return -EOPNOTSUPP; - } - -+/** -+ * ixgbevf_get_pf_link_state - Get PF's link status -+ * @hw: pointer to the HW structure -+ * @speed: link speed -+ * @link_up: indicate if link is up/down -+ * -+ * Ask PF to provide link_up state and speed of the link. -+ * -+ * Return: IXGBE_ERR_MBX in the case of mailbox error, -+ * -EOPNOTSUPP if the op is not supported or 0 on success. -+ */ -+static int ixgbevf_get_pf_link_state(struct ixgbe_hw *hw, ixgbe_link_speed *speed, -+ bool *link_up) -+{ -+ u32 msgbuf[3] = {}; -+ int err; -+ -+ switch (hw->api_version) { -+ case ixgbe_mbox_api_16: -+ case ixgbe_mbox_api_17: -+ break; -+ default: -+ return -EOPNOTSUPP; -+ } -+ -+ msgbuf[0] = IXGBE_VF_GET_PF_LINK_STATE; -+ -+ err = ixgbevf_write_msg_read_ack(hw, msgbuf, msgbuf, -+ ARRAY_SIZE(msgbuf)); -+ if (err || (msgbuf[0] & IXGBE_VT_MSGTYPE_FAILURE)) { -+ err = IXGBE_ERR_MBX; -+ *speed = IXGBE_LINK_SPEED_UNKNOWN; -+ /* No need to set @link_up to false as it will be done by -+ * ixgbe_check_mac_link_vf(). -+ */ -+ } else { -+ *speed = msgbuf[1]; -+ *link_up = msgbuf[2]; -+ } -+ -+ return err; -+} -+ -+/** -+ * ixgbevf_negotiate_features_vf - negotiate supported features with PF driver -+ * @hw: pointer to the HW structure -+ * @pf_features: bitmask of features supported by PF -+ * -+ * Return: IXGBE_ERR_MBX in the case of mailbox error, -+ * -EOPNOTSUPP if the op is not supported or 0 on success. -+ */ -+static int ixgbevf_negotiate_features_vf(struct ixgbe_hw *hw, u32 *pf_features) -+{ -+ u32 msgbuf[2] = {}; -+ int err; -+ -+ switch (hw->api_version) { -+ case ixgbe_mbox_api_17: -+ break; -+ default: -+ return -EOPNOTSUPP; -+ } -+ -+ msgbuf[0] = IXGBE_VF_FEATURES_NEGOTIATE; -+ msgbuf[1] = IXGBEVF_SUPPORTED_FEATURES; -+ -+ err = ixgbevf_write_msg_read_ack(hw, msgbuf, msgbuf, -+ ARRAY_SIZE(msgbuf)); -+ -+ if (err || (msgbuf[0] & IXGBE_VT_MSGTYPE_FAILURE)) { -+ err = IXGBE_ERR_MBX; -+ *pf_features = 0x0; -+ } else { -+ *pf_features = msgbuf[1]; -+ } -+ -+ return err; -+} -+ - /** - * ixgbevf_set_vfta_vf - Set/Unset VLAN filter table address - * @hw: pointer to the HW structure -@@ -658,6 +743,58 @@ static s32 ixgbevf_set_vfta_vf(struct ixgbe_hw *hw, u32 vlan, u32 vind, - return err; - } - -+/** -+ * ixgbe_read_vflinks - Read VFLINKS register -+ * @hw: pointer to the HW structure -+ * @speed: link speed -+ * @link_up: indicate if link is up/down -+ * -+ * Get linkup status and link speed from the VFLINKS register. -+ */ -+static void ixgbe_read_vflinks(struct ixgbe_hw *hw, ixgbe_link_speed *speed, -+ bool *link_up) -+{ -+ u32 vflinks = IXGBE_READ_REG(hw, IXGBE_VFLINKS); -+ -+ /* if link status is down no point in checking to see if PF is up */ -+ if (!(vflinks & IXGBE_LINKS_UP)) { -+ *link_up = false; -+ return; -+ } -+ -+ /* for SFP+ modules and DA cables on 82599 it can take up to 500usecs -+ * before the link status is correct -+ */ -+ if (hw->mac.type == ixgbe_mac_82599_vf) { -+ for (int i = 0; i < 5; i++) { -+ udelay(100); -+ vflinks = IXGBE_READ_REG(hw, IXGBE_VFLINKS); -+ -+ if (!(vflinks & IXGBE_LINKS_UP)) { -+ *link_up = false; -+ return; -+ } -+ } -+ } -+ -+ /* We reached this point so there's link */ -+ *link_up = true; -+ -+ switch (vflinks & IXGBE_LINKS_SPEED_82599) { -+ case IXGBE_LINKS_SPEED_10G_82599: -+ *speed = IXGBE_LINK_SPEED_10GB_FULL; -+ break; -+ case IXGBE_LINKS_SPEED_1G_82599: -+ *speed = IXGBE_LINK_SPEED_1GB_FULL; -+ break; -+ case IXGBE_LINKS_SPEED_100_82599: -+ *speed = IXGBE_LINK_SPEED_100_FULL; -+ break; -+ default: -+ *speed = IXGBE_LINK_SPEED_UNKNOWN; -+ } -+} -+ - /** - * ixgbevf_hv_set_vfta_vf - * Hyper-V variant - just a stub. - * @hw: unused -@@ -702,10 +839,10 @@ static s32 ixgbevf_check_mac_link_vf(struct ixgbe_hw *hw, - bool *link_up, - bool autoneg_wait_to_complete) - { -+ struct ixgbevf_adapter *adapter = hw->back; - struct ixgbe_mbx_info *mbx = &hw->mbx; - struct ixgbe_mac_info *mac = &hw->mac; - s32 ret_val = 0; -- u32 links_reg; - u32 in_msg = 0; - - /* If we were hit with a reset drop the link */ -@@ -715,43 +852,21 @@ static s32 ixgbevf_check_mac_link_vf(struct ixgbe_hw *hw, - if (!mac->get_link_status) - goto out; - -- /* if link status is down no point in checking to see if pf is up */ -- links_reg = IXGBE_READ_REG(hw, IXGBE_VFLINKS); -- if (!(links_reg & IXGBE_LINKS_UP)) -- goto out; -- -- /* for SFP+ modules and DA cables on 82599 it can take up to 500usecs -- * before the link status is correct -- */ -- if (mac->type == ixgbe_mac_82599_vf) { -- int i; -- -- for (i = 0; i < 5; i++) { -- udelay(100); -- links_reg = IXGBE_READ_REG(hw, IXGBE_VFLINKS); -- -- if (!(links_reg & IXGBE_LINKS_UP)) -- goto out; -- } -- } -- -- switch (links_reg & IXGBE_LINKS_SPEED_82599) { -- case IXGBE_LINKS_SPEED_10G_82599: -- *speed = IXGBE_LINK_SPEED_10GB_FULL; -- break; -- case IXGBE_LINKS_SPEED_1G_82599: -- *speed = IXGBE_LINK_SPEED_1GB_FULL; -- break; -- case IXGBE_LINKS_SPEED_100_82599: -- *speed = IXGBE_LINK_SPEED_100_FULL; -- break; -+ if (hw->mac.type == ixgbe_mac_e610_vf) { -+ ret_val = ixgbevf_get_pf_link_state(hw, speed, link_up); -+ if (ret_val) -+ goto out; -+ } else { -+ ixgbe_read_vflinks(hw, speed, link_up); -+ if (*link_up == false) -+ goto out; - } - - /* if the read failed it could just be a mailbox collision, best wait - * until we are called again and don't report an error - */ - if (mbx->ops.read(hw, &in_msg, 1)) { -- if (hw->api_version >= ixgbe_mbox_api_15) -+ if (adapter->pf_features & IXGBEVF_PF_SUP_ESX_MBX) - mac->get_link_status = false; - goto out; - } -@@ -951,6 +1066,8 @@ int ixgbevf_get_queues(struct ixgbe_hw *hw, unsigned int *num_tcs, - case ixgbe_mbox_api_13: - case ixgbe_mbox_api_14: - case ixgbe_mbox_api_15: -+ case ixgbe_mbox_api_16: -+ case ixgbe_mbox_api_17: - break; - default: - return 0; -@@ -1005,6 +1122,7 @@ static const struct ixgbe_mac_operations ixgbevf_mac_ops = { - .setup_link = ixgbevf_setup_mac_link_vf, - .check_link = ixgbevf_check_mac_link_vf, - .negotiate_api_version = ixgbevf_negotiate_api_version_vf, -+ .negotiate_features = ixgbevf_negotiate_features_vf, - .set_rar = ixgbevf_set_rar_vf, - .update_mc_addr_list = ixgbevf_update_mc_addr_list_vf, - .update_xcast_mode = ixgbevf_update_xcast_mode, -@@ -1076,3 +1194,13 @@ const struct ixgbevf_info ixgbevf_x550em_a_vf_info = { - .mac = ixgbe_mac_x550em_a_vf, - .mac_ops = &ixgbevf_mac_ops, - }; -+ -+const struct ixgbevf_info ixgbevf_e610_vf_info = { -+ .mac = ixgbe_mac_e610_vf, -+ .mac_ops = &ixgbevf_mac_ops, -+}; -+ -+const struct ixgbevf_info ixgbevf_e610_vf_hv_info = { -+ .mac = ixgbe_mac_e610_vf, -+ .mac_ops = &ixgbevf_hv_mac_ops, -+}; -diff --git a/drivers/net/ethernet/intel/ixgbevf/vf.h b/drivers/net/ethernet/intel/ixgbevf/vf.h -index b4eef5b6c172bd..4f19b8900c29a3 100644 ---- a/drivers/net/ethernet/intel/ixgbevf/vf.h -+++ b/drivers/net/ethernet/intel/ixgbevf/vf.h -@@ -1,5 +1,5 @@ - /* SPDX-License-Identifier: GPL-2.0 */ --/* Copyright(c) 1999 - 2018 Intel Corporation. */ -+/* Copyright(c) 1999 - 2024 Intel Corporation. */ - - #ifndef __IXGBE_VF_H__ - #define __IXGBE_VF_H__ -@@ -26,6 +26,7 @@ struct ixgbe_mac_operations { - s32 (*stop_adapter)(struct ixgbe_hw *); - s32 (*get_bus_info)(struct ixgbe_hw *); - s32 (*negotiate_api_version)(struct ixgbe_hw *hw, int api); -+ int (*negotiate_features)(struct ixgbe_hw *hw, u32 *pf_features); - - /* Link */ - s32 (*setup_link)(struct ixgbe_hw *, ixgbe_link_speed, bool, bool); -@@ -54,6 +55,8 @@ enum ixgbe_mac_type { - ixgbe_mac_X550_vf, - ixgbe_mac_X550EM_x_vf, - ixgbe_mac_x550em_a_vf, -+ ixgbe_mac_e610, -+ ixgbe_mac_e610_vf, - ixgbe_num_macs - }; - -diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c -index 5af932a5e70c44..3b90f257e94f85 100644 ---- a/drivers/net/ethernet/realtek/r8169_main.c -+++ b/drivers/net/ethernet/realtek/r8169_main.c -@@ -4919,8 +4919,9 @@ static int rtl8169_resume(struct device *device) - if (!device_may_wakeup(tp_to_dev(tp))) - clk_prepare_enable(tp->clk); - -- /* Reportedly at least Asus X453MA truncates packets otherwise */ -- if (tp->mac_version == RTL_GIGA_MAC_VER_37) -+ /* Some chip versions may truncate packets without this initialization */ -+ if (tp->mac_version == RTL_GIGA_MAC_VER_37 || -+ tp->mac_version == RTL_GIGA_MAC_VER_46) - rtl_init_rxcfg(tp); - - return rtl8169_runtime_resume(device); -diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c -index ec5689cd240aaf..121f1c15c67936 100644 ---- a/drivers/net/usb/lan78xx.c -+++ b/drivers/net/usb/lan78xx.c -@@ -1940,13 +1940,19 @@ static const struct ethtool_ops lan78xx_ethtool_ops = { - .get_regs = lan78xx_get_regs, - }; - --static void lan78xx_init_mac_address(struct lan78xx_net *dev) -+static int lan78xx_init_mac_address(struct lan78xx_net *dev) - { - u32 addr_lo, addr_hi; - u8 addr[6]; -+ int ret; -+ -+ ret = lan78xx_read_reg(dev, RX_ADDRL, &addr_lo); -+ if (ret < 0) -+ return ret; - -- lan78xx_read_reg(dev, RX_ADDRL, &addr_lo); -- lan78xx_read_reg(dev, RX_ADDRH, &addr_hi); -+ ret = lan78xx_read_reg(dev, RX_ADDRH, &addr_hi); -+ if (ret < 0) -+ return ret; - - addr[0] = addr_lo & 0xFF; - addr[1] = (addr_lo >> 8) & 0xFF; -@@ -1979,14 +1985,26 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev) - (addr[2] << 16) | (addr[3] << 24); - addr_hi = addr[4] | (addr[5] << 8); - -- lan78xx_write_reg(dev, RX_ADDRL, addr_lo); -- lan78xx_write_reg(dev, RX_ADDRH, addr_hi); -+ ret = lan78xx_write_reg(dev, RX_ADDRL, addr_lo); -+ if (ret < 0) -+ return ret; -+ -+ ret = lan78xx_write_reg(dev, RX_ADDRH, addr_hi); -+ if (ret < 0) -+ return ret; - } - -- lan78xx_write_reg(dev, MAF_LO(0), addr_lo); -- lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_); -+ ret = lan78xx_write_reg(dev, MAF_LO(0), addr_lo); -+ if (ret < 0) -+ return ret; -+ -+ ret = lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_); -+ if (ret < 0) -+ return ret; - - eth_hw_addr_set(dev->net, addr); -+ -+ return 0; - } - - /* MDIO read and write wrappers for phylib */ -@@ -2910,8 +2928,6 @@ static int lan78xx_reset(struct lan78xx_net *dev) - } - } while (buf & HW_CFG_LRST_); - -- lan78xx_init_mac_address(dev); -- - /* save DEVID for later usage */ - ret = lan78xx_read_reg(dev, ID_REV, &buf); - if (ret < 0) -@@ -2920,6 +2936,10 @@ static int lan78xx_reset(struct lan78xx_net *dev) - dev->chipid = (buf & ID_REV_CHIP_ID_MASK_) >> 16; - dev->chiprev = buf & ID_REV_CHIP_REV_MASK_; - -+ ret = lan78xx_init_mac_address(dev); -+ if (ret < 0) -+ return ret; -+ - /* Respond to the IN token with a NAK */ - ret = lan78xx_read_reg(dev, USB_CFG0, &buf); - if (ret < 0) -diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c -index 1e85cfe524e875..386376ceeda25d 100644 ---- a/drivers/net/usb/r8152.c -+++ b/drivers/net/usb/r8152.c -@@ -10104,7 +10104,12 @@ static int __init rtl8152_driver_init(void) - ret = usb_register_device_driver(&rtl8152_cfgselector_driver, THIS_MODULE); - if (ret) - return ret; -- return usb_register(&rtl8152_driver); -+ -+ ret = usb_register(&rtl8152_driver); -+ if (ret) -+ usb_deregister_device_driver(&rtl8152_cfgselector_driver); -+ -+ return ret; - } - - static void __exit rtl8152_driver_exit(void) -diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c -index 119afdfe4b91e9..57416bbf9344f0 100644 ---- a/drivers/nvme/host/multipath.c -+++ b/drivers/nvme/host/multipath.c -@@ -131,12 +131,14 @@ void nvme_mpath_start_request(struct request *rq) - struct nvme_ns *ns = rq->q->queuedata; - struct gendisk *disk = ns->head->disk; - -- if (READ_ONCE(ns->head->subsys->iopolicy) == NVME_IOPOLICY_QD) { -+ if ((READ_ONCE(ns->head->subsys->iopolicy) == NVME_IOPOLICY_QD) && -+ !(nvme_req(rq)->flags & NVME_MPATH_CNT_ACTIVE)) { - atomic_inc(&ns->ctrl->nr_active); - nvme_req(rq)->flags |= NVME_MPATH_CNT_ACTIVE; - } - -- if (!blk_queue_io_stat(disk->queue) || blk_rq_is_passthrough(rq)) -+ if (!blk_queue_io_stat(disk->queue) || blk_rq_is_passthrough(rq) || -+ (nvme_req(rq)->flags & NVME_MPATH_IO_STATS)) - return; - - nvme_req(rq)->flags |= NVME_MPATH_IO_STATS; -diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c -index f76a358e2b5b6f..753a4c615781f1 100644 ---- a/drivers/pci/controller/cadence/pci-j721e.c -+++ b/drivers/pci/controller/cadence/pci-j721e.c -@@ -48,6 +48,7 @@ enum link_status { - #define J721E_MODE_RC BIT(7) - #define LANE_COUNT(n) ((n) << 8) - -+#define ACSPCIE_PAD_DISABLE_MASK GENMASK(1, 0) - #define GENERATION_SEL_MASK GENMASK(1, 0) - - struct j721e_pcie { -@@ -225,6 +226,36 @@ static int j721e_pcie_set_lane_count(struct j721e_pcie *pcie, - return ret; - } - -+static int j721e_enable_acspcie_refclk(struct j721e_pcie *pcie, -+ struct regmap *syscon) -+{ -+ struct device *dev = pcie->cdns_pcie->dev; -+ struct device_node *node = dev->of_node; -+ u32 mask = ACSPCIE_PAD_DISABLE_MASK; -+ struct of_phandle_args args; -+ u32 val; -+ int ret; -+ -+ ret = of_parse_phandle_with_fixed_args(node, -+ "ti,syscon-acspcie-proxy-ctrl", -+ 1, 0, &args); -+ if (ret) { -+ dev_err(dev, -+ "ti,syscon-acspcie-proxy-ctrl has invalid arguments\n"); -+ return ret; -+ } -+ -+ /* Clear PAD IO disable bits to enable refclk output */ -+ val = ~(args.args[0]); -+ ret = regmap_update_bits(syscon, 0, mask, val); -+ if (ret) { -+ dev_err(dev, "failed to enable ACSPCIE refclk: %d\n", ret); -+ return ret; -+ } -+ -+ return 0; -+} -+ - static int j721e_pcie_ctrl_init(struct j721e_pcie *pcie) - { - struct device *dev = pcie->cdns_pcie->dev; -@@ -246,6 +277,25 @@ static int j721e_pcie_ctrl_init(struct j721e_pcie *pcie) - if (!ret) - offset = args.args[0]; - -+ /* -+ * The PCIe Controller's registers have different "reset-values" -+ * depending on the "strap" settings programmed into the PCIEn_CTRL -+ * register within the CTRL_MMR memory-mapped register space. -+ * The registers latch onto a "reset-value" based on the "strap" -+ * settings sampled after the PCIe Controller is powered on. -+ * To ensure that the "reset-values" are sampled accurately, power -+ * off the PCIe Controller before programming the "strap" settings -+ * and power it on after that. The runtime PM APIs namely -+ * pm_runtime_put_sync() and pm_runtime_get_sync() will decrement and -+ * increment the usage counter respectively, causing GENPD to power off -+ * and power on the PCIe Controller. -+ */ -+ ret = pm_runtime_put_sync(dev); -+ if (ret < 0) { -+ dev_err(dev, "Failed to power off PCIe Controller\n"); -+ return ret; -+ } -+ - ret = j721e_pcie_set_mode(pcie, syscon, offset); - if (ret < 0) { - dev_err(dev, "Failed to set pci mode\n"); -@@ -264,7 +314,19 @@ static int j721e_pcie_ctrl_init(struct j721e_pcie *pcie) - return ret; - } - -- return 0; -+ ret = pm_runtime_get_sync(dev); -+ if (ret < 0) { -+ dev_err(dev, "Failed to power on PCIe Controller\n"); -+ return ret; -+ } -+ -+ /* Enable ACSPCIE refclk output if the optional property exists */ -+ syscon = syscon_regmap_lookup_by_phandle_optional(node, -+ "ti,syscon-acspcie-proxy-ctrl"); -+ if (!syscon) -+ return 0; -+ -+ return j721e_enable_acspcie_refclk(pcie, syscon); - } - - static int cdns_ti_pcie_config_read(struct pci_bus *bus, unsigned int devfn, -diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c -index c7d3e248a59a20..ce2a7a6dab90c5 100644 ---- a/drivers/pci/controller/dwc/pcie-tegra194.c -+++ b/drivers/pci/controller/dwc/pcie-tegra194.c -@@ -1963,6 +1963,15 @@ static irqreturn_t tegra_pcie_ep_pex_rst_irq(int irq, void *arg) - return IRQ_HANDLED; - } - -+static void tegra_pcie_ep_init(struct dw_pcie_ep *ep) -+{ -+ struct dw_pcie *pci = to_dw_pcie_from_ep(ep); -+ enum pci_barno bar; -+ -+ for (bar = 0; bar < PCI_STD_NUM_BARS; bar++) -+ dw_pcie_ep_reset_bar(pci, bar); -+}; -+ - static int tegra_pcie_ep_raise_legacy_irq(struct tegra_pcie_dw *pcie, u16 irq) - { - /* Tegra194 supports only INTA */ -@@ -2036,6 +2045,7 @@ tegra_pcie_ep_get_features(struct dw_pcie_ep *ep) - } - - static const struct dw_pcie_ep_ops pcie_ep_ops = { -+ .ep_init = tegra_pcie_ep_init, - .raise_irq = tegra_pcie_ep_raise_irq, - .get_features = tegra_pcie_ep_get_features, - }; -diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c -index 449d42744d336f..300caafcfa1009 100644 ---- a/drivers/pci/pci-sysfs.c -+++ b/drivers/pci/pci-sysfs.c -@@ -186,9 +186,15 @@ static ssize_t max_link_speed_show(struct device *dev, - struct device_attribute *attr, char *buf) - { - struct pci_dev *pdev = to_pci_dev(dev); -+ ssize_t ret; -+ -+ /* We read PCI_EXP_LNKCAP, so we need the device to be accessible. */ -+ pci_config_pm_runtime_get(pdev); -+ ret = sysfs_emit(buf, "%s\n", -+ pci_speed_string(pcie_get_speed_cap(pdev))); -+ pci_config_pm_runtime_put(pdev); - -- return sysfs_emit(buf, "%s\n", -- pci_speed_string(pcie_get_speed_cap(pdev))); -+ return ret; - } - static DEVICE_ATTR_RO(max_link_speed); - -diff --git a/drivers/phy/cadence/cdns-dphy.c b/drivers/phy/cadence/cdns-dphy.c -index dddb66de6dba15..8d93a830ab8bff 100644 ---- a/drivers/phy/cadence/cdns-dphy.c -+++ b/drivers/phy/cadence/cdns-dphy.c -@@ -30,6 +30,7 @@ - - #define DPHY_CMN_SSM DPHY_PMA_CMN(0x20) - #define DPHY_CMN_SSM_EN BIT(0) -+#define DPHY_CMN_SSM_CAL_WAIT_TIME GENMASK(8, 1) - #define DPHY_CMN_TX_MODE_EN BIT(9) - - #define DPHY_CMN_PWM DPHY_PMA_CMN(0x40) -@@ -79,6 +80,7 @@ struct cdns_dphy_cfg { - u8 pll_ipdiv; - u8 pll_opdiv; - u16 pll_fbdiv; -+ u32 hs_clk_rate; - unsigned int nlanes; - }; - -@@ -99,6 +101,8 @@ struct cdns_dphy_ops { - void (*set_pll_cfg)(struct cdns_dphy *dphy, - const struct cdns_dphy_cfg *cfg); - unsigned long (*get_wakeup_time_ns)(struct cdns_dphy *dphy); -+ int (*wait_for_pll_lock)(struct cdns_dphy *dphy); -+ int (*wait_for_cmn_ready)(struct cdns_dphy *dphy); - }; - - struct cdns_dphy { -@@ -108,6 +112,8 @@ struct cdns_dphy { - struct clk *pll_ref_clk; - const struct cdns_dphy_ops *ops; - struct phy *phy; -+ bool is_configured; -+ bool is_powered; - }; - - /* Order of bands is important since the index is the band number. */ -@@ -154,6 +160,9 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy, - cfg->pll_ipdiv, - pll_ref_hz); - -+ cfg->hs_clk_rate = div_u64((u64)pll_ref_hz * cfg->pll_fbdiv, -+ 2 * cfg->pll_opdiv * cfg->pll_ipdiv); -+ - return 0; - } - -@@ -191,6 +200,16 @@ static unsigned long cdns_dphy_get_wakeup_time_ns(struct cdns_dphy *dphy) - return dphy->ops->get_wakeup_time_ns(dphy); - } - -+static int cdns_dphy_wait_for_pll_lock(struct cdns_dphy *dphy) -+{ -+ return dphy->ops->wait_for_pll_lock ? dphy->ops->wait_for_pll_lock(dphy) : 0; -+} -+ -+static int cdns_dphy_wait_for_cmn_ready(struct cdns_dphy *dphy) -+{ -+ return dphy->ops->wait_for_cmn_ready ? dphy->ops->wait_for_cmn_ready(dphy) : 0; -+} -+ - static unsigned long cdns_dphy_ref_get_wakeup_time_ns(struct cdns_dphy *dphy) - { - /* Default wakeup time is 800 ns (in a simulated environment). */ -@@ -232,7 +251,6 @@ static unsigned long cdns_dphy_j721e_get_wakeup_time_ns(struct cdns_dphy *dphy) - static void cdns_dphy_j721e_set_pll_cfg(struct cdns_dphy *dphy, - const struct cdns_dphy_cfg *cfg) - { -- u32 status; - - /* - * set the PWM and PLL Byteclk divider settings to recommended values -@@ -249,13 +267,6 @@ static void cdns_dphy_j721e_set_pll_cfg(struct cdns_dphy *dphy, - - writel(DPHY_TX_J721E_WIZ_LANE_RSTB, - dphy->regs + DPHY_TX_J721E_WIZ_RST_CTRL); -- -- readl_poll_timeout(dphy->regs + DPHY_TX_J721E_WIZ_PLL_CTRL, status, -- (status & DPHY_TX_WIZ_PLL_LOCK), 0, POLL_TIMEOUT_US); -- -- readl_poll_timeout(dphy->regs + DPHY_TX_J721E_WIZ_STATUS, status, -- (status & DPHY_TX_WIZ_O_CMN_READY), 0, -- POLL_TIMEOUT_US); - } - - static void cdns_dphy_j721e_set_psm_div(struct cdns_dphy *dphy, u8 div) -@@ -263,6 +274,23 @@ static void cdns_dphy_j721e_set_psm_div(struct cdns_dphy *dphy, u8 div) - writel(div, dphy->regs + DPHY_TX_J721E_WIZ_PSM_FREQ); - } - -+static int cdns_dphy_j721e_wait_for_pll_lock(struct cdns_dphy *dphy) -+{ -+ u32 status; -+ -+ return readl_poll_timeout(dphy->regs + DPHY_TX_J721E_WIZ_PLL_CTRL, status, -+ status & DPHY_TX_WIZ_PLL_LOCK, 0, POLL_TIMEOUT_US); -+} -+ -+static int cdns_dphy_j721e_wait_for_cmn_ready(struct cdns_dphy *dphy) -+{ -+ u32 status; -+ -+ return readl_poll_timeout(dphy->regs + DPHY_TX_J721E_WIZ_STATUS, status, -+ status & DPHY_TX_WIZ_O_CMN_READY, 0, -+ POLL_TIMEOUT_US); -+} -+ - /* - * This is the reference implementation of DPHY hooks. Specific integration of - * this IP may have to re-implement some of them depending on how they decided -@@ -278,6 +306,8 @@ static const struct cdns_dphy_ops j721e_dphy_ops = { - .get_wakeup_time_ns = cdns_dphy_j721e_get_wakeup_time_ns, - .set_pll_cfg = cdns_dphy_j721e_set_pll_cfg, - .set_psm_div = cdns_dphy_j721e_set_psm_div, -+ .wait_for_pll_lock = cdns_dphy_j721e_wait_for_pll_lock, -+ .wait_for_cmn_ready = cdns_dphy_j721e_wait_for_cmn_ready, - }; - - static int cdns_dphy_config_from_opts(struct phy *phy, -@@ -297,6 +327,7 @@ static int cdns_dphy_config_from_opts(struct phy *phy, - if (ret) - return ret; - -+ opts->hs_clk_rate = cfg->hs_clk_rate; - opts->wakeup = cdns_dphy_get_wakeup_time_ns(dphy) / 1000; - - return 0; -@@ -334,21 +365,36 @@ static int cdns_dphy_validate(struct phy *phy, enum phy_mode mode, int submode, - static int cdns_dphy_configure(struct phy *phy, union phy_configure_opts *opts) - { - struct cdns_dphy *dphy = phy_get_drvdata(phy); -- struct cdns_dphy_cfg cfg = { 0 }; -- int ret, band_ctrl; -- unsigned int reg; -+ int ret; - -- ret = cdns_dphy_config_from_opts(phy, &opts->mipi_dphy, &cfg); -- if (ret) -- return ret; -+ ret = cdns_dphy_config_from_opts(phy, &opts->mipi_dphy, &dphy->cfg); -+ if (!ret) -+ dphy->is_configured = true; -+ -+ return ret; -+} -+ -+static int cdns_dphy_power_on(struct phy *phy) -+{ -+ struct cdns_dphy *dphy = phy_get_drvdata(phy); -+ int ret; -+ u32 reg; -+ -+ if (!dphy->is_configured || dphy->is_powered) -+ return -EINVAL; -+ -+ clk_prepare_enable(dphy->psm_clk); -+ clk_prepare_enable(dphy->pll_ref_clk); - - /* - * Configure the internal PSM clk divider so that the DPHY has a - * 1MHz clk (or something close). - */ - ret = cdns_dphy_setup_psm(dphy); -- if (ret) -- return ret; -+ if (ret) { -+ dev_err(&dphy->phy->dev, "Failed to setup PSM with error %d\n", ret); -+ goto err_power_on; -+ } - - /* - * Configure attach clk lanes to data lanes: the DPHY has 2 clk lanes -@@ -363,40 +409,61 @@ static int cdns_dphy_configure(struct phy *phy, union phy_configure_opts *opts) - * Configure the DPHY PLL that will be used to generate the TX byte - * clk. - */ -- cdns_dphy_set_pll_cfg(dphy, &cfg); -+ cdns_dphy_set_pll_cfg(dphy, &dphy->cfg); - -- band_ctrl = cdns_dphy_tx_get_band_ctrl(opts->mipi_dphy.hs_clk_rate); -- if (band_ctrl < 0) -- return band_ctrl; -+ ret = cdns_dphy_tx_get_band_ctrl(dphy->cfg.hs_clk_rate); -+ if (ret < 0) { -+ dev_err(&dphy->phy->dev, "Failed to get band control value with error %d\n", ret); -+ goto err_power_on; -+ } - -- reg = FIELD_PREP(DPHY_BAND_CFG_LEFT_BAND, band_ctrl) | -- FIELD_PREP(DPHY_BAND_CFG_RIGHT_BAND, band_ctrl); -+ reg = FIELD_PREP(DPHY_BAND_CFG_LEFT_BAND, ret) | -+ FIELD_PREP(DPHY_BAND_CFG_RIGHT_BAND, ret); - writel(reg, dphy->regs + DPHY_BAND_CFG); - -- return 0; --} -+ /* Start TX state machine. */ -+ reg = readl(dphy->regs + DPHY_CMN_SSM); -+ writel((reg & DPHY_CMN_SSM_CAL_WAIT_TIME) | DPHY_CMN_SSM_EN | DPHY_CMN_TX_MODE_EN, -+ dphy->regs + DPHY_CMN_SSM); - --static int cdns_dphy_power_on(struct phy *phy) --{ -- struct cdns_dphy *dphy = phy_get_drvdata(phy); -+ ret = cdns_dphy_wait_for_pll_lock(dphy); -+ if (ret) { -+ dev_err(&dphy->phy->dev, "Failed to lock PLL with error %d\n", ret); -+ goto err_power_on; -+ } - -- clk_prepare_enable(dphy->psm_clk); -- clk_prepare_enable(dphy->pll_ref_clk); -+ ret = cdns_dphy_wait_for_cmn_ready(dphy); -+ if (ret) { -+ dev_err(&dphy->phy->dev, "O_CMN_READY signal failed to assert with error %d\n", -+ ret); -+ goto err_power_on; -+ } - -- /* Start TX state machine. */ -- writel(DPHY_CMN_SSM_EN | DPHY_CMN_TX_MODE_EN, -- dphy->regs + DPHY_CMN_SSM); -+ dphy->is_powered = true; - - return 0; -+ -+err_power_on: -+ clk_disable_unprepare(dphy->pll_ref_clk); -+ clk_disable_unprepare(dphy->psm_clk); -+ -+ return ret; - } - - static int cdns_dphy_power_off(struct phy *phy) - { - struct cdns_dphy *dphy = phy_get_drvdata(phy); -+ u32 reg; - - clk_disable_unprepare(dphy->pll_ref_clk); - clk_disable_unprepare(dphy->psm_clk); - -+ /* Stop TX state machine. */ -+ reg = readl(dphy->regs + DPHY_CMN_SSM); -+ writel(reg & ~DPHY_CMN_SSM_EN, dphy->regs + DPHY_CMN_SSM); -+ -+ dphy->is_powered = false; -+ - return 0; - } - -diff --git a/drivers/usb/gadget/function/f_acm.c b/drivers/usb/gadget/function/f_acm.c -index f616059c5e1e4c..a1adfd077c15be 100644 ---- a/drivers/usb/gadget/function/f_acm.c -+++ b/drivers/usb/gadget/function/f_acm.c -@@ -11,12 +11,15 @@ - - /* #define VERBOSE_DEBUG */ - -+#include - #include - #include - #include - #include - #include - -+#include -+ - #include "u_serial.h" - - -@@ -612,6 +615,7 @@ acm_bind(struct usb_configuration *c, struct usb_function *f) - struct usb_string *us; - int status; - struct usb_ep *ep; -+ struct usb_request *request __free(free_usb_request) = NULL; - - /* REVISIT might want instance-specific strings to help - * distinguish instances ... -@@ -629,7 +633,7 @@ acm_bind(struct usb_configuration *c, struct usb_function *f) - /* allocate instance-specific interface IDs, and patch descriptors */ - status = usb_interface_id(c, f); - if (status < 0) -- goto fail; -+ return status; - acm->ctrl_id = status; - acm_iad_descriptor.bFirstInterface = status; - -@@ -638,40 +642,38 @@ acm_bind(struct usb_configuration *c, struct usb_function *f) - - status = usb_interface_id(c, f); - if (status < 0) -- goto fail; -+ return status; - acm->data_id = status; - - acm_data_interface_desc.bInterfaceNumber = status; - acm_union_desc.bSlaveInterface0 = status; - acm_call_mgmt_descriptor.bDataInterface = status; - -- status = -ENODEV; -- - /* allocate instance-specific endpoints */ - ep = usb_ep_autoconfig(cdev->gadget, &acm_fs_in_desc); - if (!ep) -- goto fail; -+ return -ENODEV; - acm->port.in = ep; - - ep = usb_ep_autoconfig(cdev->gadget, &acm_fs_out_desc); - if (!ep) -- goto fail; -+ return -ENODEV; - acm->port.out = ep; - - ep = usb_ep_autoconfig(cdev->gadget, &acm_fs_notify_desc); - if (!ep) -- goto fail; -+ return -ENODEV; - acm->notify = ep; - - /* allocate notification */ -- acm->notify_req = gs_alloc_req(ep, -- sizeof(struct usb_cdc_notification) + 2, -- GFP_KERNEL); -- if (!acm->notify_req) -- goto fail; -+ request = gs_alloc_req(ep, -+ sizeof(struct usb_cdc_notification) + 2, -+ GFP_KERNEL); -+ if (!request) -+ return -ENODEV; - -- acm->notify_req->complete = acm_cdc_notify_complete; -- acm->notify_req->context = acm; -+ request->complete = acm_cdc_notify_complete; -+ request->context = acm; - - /* support all relevant hardware speeds... we expect that when - * hardware is dual speed, all bulk-capable endpoints work at -@@ -688,7 +690,9 @@ acm_bind(struct usb_configuration *c, struct usb_function *f) - status = usb_assign_descriptors(f, acm_fs_function, acm_hs_function, - acm_ss_function, acm_ss_function); - if (status) -- goto fail; -+ return status; -+ -+ acm->notify_req = no_free_ptr(request); - - dev_dbg(&cdev->gadget->dev, - "acm ttyGS%d: IN/%s OUT/%s NOTIFY/%s\n", -@@ -696,14 +700,6 @@ acm_bind(struct usb_configuration *c, struct usb_function *f) - acm->port.in->name, acm->port.out->name, - acm->notify->name); - return 0; -- --fail: -- if (acm->notify_req) -- gs_free_req(acm->notify, acm->notify_req); -- -- ERROR(cdev, "%s/%p: can't bind, err %d\n", f->name, f, status); -- -- return status; - } - - static void acm_unbind(struct usb_configuration *c, struct usb_function *f) -diff --git a/drivers/usb/gadget/function/f_ecm.c b/drivers/usb/gadget/function/f_ecm.c -index 2afc30de54ce2d..7bb63b9e3f78d9 100644 ---- a/drivers/usb/gadget/function/f_ecm.c -+++ b/drivers/usb/gadget/function/f_ecm.c -@@ -8,12 +8,15 @@ - - /* #define VERBOSE_DEBUG */ - -+#include - #include - #include - #include - #include - #include - -+#include -+ - #include "u_ether.h" - #include "u_ether_configfs.h" - #include "u_ecm.h" -@@ -678,6 +681,7 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f) - struct usb_ep *ep; - - struct f_ecm_opts *ecm_opts; -+ struct usb_request *request __free(free_usb_request) = NULL; - - if (!can_support_ecm(cdev->gadget)) - return -EINVAL; -@@ -711,7 +715,7 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f) - /* allocate instance-specific interface IDs */ - status = usb_interface_id(c, f); - if (status < 0) -- goto fail; -+ return status; - ecm->ctrl_id = status; - ecm_iad_descriptor.bFirstInterface = status; - -@@ -720,24 +724,22 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f) - - status = usb_interface_id(c, f); - if (status < 0) -- goto fail; -+ return status; - ecm->data_id = status; - - ecm_data_nop_intf.bInterfaceNumber = status; - ecm_data_intf.bInterfaceNumber = status; - ecm_union_desc.bSlaveInterface0 = status; - -- status = -ENODEV; -- - /* allocate instance-specific endpoints */ - ep = usb_ep_autoconfig(cdev->gadget, &fs_ecm_in_desc); - if (!ep) -- goto fail; -+ return -ENODEV; - ecm->port.in_ep = ep; - - ep = usb_ep_autoconfig(cdev->gadget, &fs_ecm_out_desc); - if (!ep) -- goto fail; -+ return -ENODEV; - ecm->port.out_ep = ep; - - /* NOTE: a status/notification endpoint is *OPTIONAL* but we -@@ -746,20 +748,18 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f) - */ - ep = usb_ep_autoconfig(cdev->gadget, &fs_ecm_notify_desc); - if (!ep) -- goto fail; -+ return -ENODEV; - ecm->notify = ep; - -- status = -ENOMEM; -- - /* allocate notification request and buffer */ -- ecm->notify_req = usb_ep_alloc_request(ep, GFP_KERNEL); -- if (!ecm->notify_req) -- goto fail; -- ecm->notify_req->buf = kmalloc(ECM_STATUS_BYTECOUNT, GFP_KERNEL); -- if (!ecm->notify_req->buf) -- goto fail; -- ecm->notify_req->context = ecm; -- ecm->notify_req->complete = ecm_notify_complete; -+ request = usb_ep_alloc_request(ep, GFP_KERNEL); -+ if (!request) -+ return -ENOMEM; -+ request->buf = kmalloc(ECM_STATUS_BYTECOUNT, GFP_KERNEL); -+ if (!request->buf) -+ return -ENOMEM; -+ request->context = ecm; -+ request->complete = ecm_notify_complete; - - /* support all relevant hardware speeds... we expect that when - * hardware is dual speed, all bulk-capable endpoints work at -@@ -778,7 +778,7 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f) - status = usb_assign_descriptors(f, ecm_fs_function, ecm_hs_function, - ecm_ss_function, ecm_ss_function); - if (status) -- goto fail; -+ return status; - - /* NOTE: all that is done without knowing or caring about - * the network link ... which is unavailable to this code -@@ -788,20 +788,12 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f) - ecm->port.open = ecm_open; - ecm->port.close = ecm_close; - -+ ecm->notify_req = no_free_ptr(request); -+ - DBG(cdev, "CDC Ethernet: IN/%s OUT/%s NOTIFY/%s\n", - ecm->port.in_ep->name, ecm->port.out_ep->name, - ecm->notify->name); - return 0; -- --fail: -- if (ecm->notify_req) { -- kfree(ecm->notify_req->buf); -- usb_ep_free_request(ecm->notify, ecm->notify_req); -- } -- -- ERROR(cdev, "%s: can't bind, err %d\n", f->name, status); -- -- return status; - } - - static inline struct f_ecm_opts *to_f_ecm_opts(struct config_item *item) -diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c -index f5731d465cd7b3..7aad737901e833 100644 ---- a/drivers/usb/gadget/function/f_ncm.c -+++ b/drivers/usb/gadget/function/f_ncm.c -@@ -11,6 +11,7 @@ - * Copyright (C) 2008 Nokia Corporation - */ - -+#include - #include - #include - #include -@@ -19,6 +20,7 @@ - #include - - #include -+#include - - #include "u_ether.h" - #include "u_ether_configfs.h" -@@ -1422,18 +1424,18 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f) - struct usb_ep *ep; - struct f_ncm_opts *ncm_opts; - -+ struct usb_os_desc_table *os_desc_table __free(kfree) = NULL; -+ struct usb_request *request __free(free_usb_request) = NULL; -+ - if (!can_support_ecm(cdev->gadget)) - return -EINVAL; - - ncm_opts = container_of(f->fi, struct f_ncm_opts, func_inst); - - if (cdev->use_os_string) { -- f->os_desc_table = kzalloc(sizeof(*f->os_desc_table), -- GFP_KERNEL); -- if (!f->os_desc_table) -+ os_desc_table = kzalloc(sizeof(*os_desc_table), GFP_KERNEL); -+ if (!os_desc_table) - return -ENOMEM; -- f->os_desc_n = 1; -- f->os_desc_table[0].os_desc = &ncm_opts->ncm_os_desc; - } - - mutex_lock(&ncm_opts->lock); -@@ -1443,16 +1445,15 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f) - mutex_unlock(&ncm_opts->lock); - - if (status) -- goto fail; -+ return status; - - ncm_opts->bound = true; - - us = usb_gstrings_attach(cdev, ncm_strings, - ARRAY_SIZE(ncm_string_defs)); -- if (IS_ERR(us)) { -- status = PTR_ERR(us); -- goto fail; -- } -+ if (IS_ERR(us)) -+ return PTR_ERR(us); -+ - ncm_control_intf.iInterface = us[STRING_CTRL_IDX].id; - ncm_data_nop_intf.iInterface = us[STRING_DATA_IDX].id; - ncm_data_intf.iInterface = us[STRING_DATA_IDX].id; -@@ -1462,55 +1463,47 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f) - /* allocate instance-specific interface IDs */ - status = usb_interface_id(c, f); - if (status < 0) -- goto fail; -+ return status; - ncm->ctrl_id = status; - ncm_iad_desc.bFirstInterface = status; - - ncm_control_intf.bInterfaceNumber = status; - ncm_union_desc.bMasterInterface0 = status; - -- if (cdev->use_os_string) -- f->os_desc_table[0].if_id = -- ncm_iad_desc.bFirstInterface; -- - status = usb_interface_id(c, f); - if (status < 0) -- goto fail; -+ return status; - ncm->data_id = status; - - ncm_data_nop_intf.bInterfaceNumber = status; - ncm_data_intf.bInterfaceNumber = status; - ncm_union_desc.bSlaveInterface0 = status; - -- status = -ENODEV; -- - /* allocate instance-specific endpoints */ - ep = usb_ep_autoconfig(cdev->gadget, &fs_ncm_in_desc); - if (!ep) -- goto fail; -+ return -ENODEV; - ncm->port.in_ep = ep; - - ep = usb_ep_autoconfig(cdev->gadget, &fs_ncm_out_desc); - if (!ep) -- goto fail; -+ return -ENODEV; - ncm->port.out_ep = ep; - - ep = usb_ep_autoconfig(cdev->gadget, &fs_ncm_notify_desc); - if (!ep) -- goto fail; -+ return -ENODEV; - ncm->notify = ep; - -- status = -ENOMEM; -- - /* allocate notification request and buffer */ -- ncm->notify_req = usb_ep_alloc_request(ep, GFP_KERNEL); -- if (!ncm->notify_req) -- goto fail; -- ncm->notify_req->buf = kmalloc(NCM_STATUS_BYTECOUNT, GFP_KERNEL); -- if (!ncm->notify_req->buf) -- goto fail; -- ncm->notify_req->context = ncm; -- ncm->notify_req->complete = ncm_notify_complete; -+ request = usb_ep_alloc_request(ep, GFP_KERNEL); -+ if (!request) -+ return -ENOMEM; -+ request->buf = kmalloc(NCM_STATUS_BYTECOUNT, GFP_KERNEL); -+ if (!request->buf) -+ return -ENOMEM; -+ request->context = ncm; -+ request->complete = ncm_notify_complete; - - /* - * support all relevant hardware speeds... we expect that when -@@ -1530,7 +1523,7 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f) - status = usb_assign_descriptors(f, ncm_fs_function, ncm_hs_function, - ncm_ss_function, ncm_ss_function); - if (status) -- goto fail; -+ return status; - - /* - * NOTE: all that is done without knowing or caring about -@@ -1544,23 +1537,18 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f) - hrtimer_init(&ncm->task_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT); - ncm->task_timer.function = ncm_tx_timeout; - -+ if (cdev->use_os_string) { -+ os_desc_table[0].os_desc = &ncm_opts->ncm_os_desc; -+ os_desc_table[0].if_id = ncm_iad_desc.bFirstInterface; -+ f->os_desc_table = no_free_ptr(os_desc_table); -+ f->os_desc_n = 1; -+ } -+ ncm->notify_req = no_free_ptr(request); -+ - DBG(cdev, "CDC Network: IN/%s OUT/%s NOTIFY/%s\n", - ncm->port.in_ep->name, ncm->port.out_ep->name, - ncm->notify->name); - return 0; -- --fail: -- kfree(f->os_desc_table); -- f->os_desc_n = 0; -- -- if (ncm->notify_req) { -- kfree(ncm->notify_req->buf); -- usb_ep_free_request(ncm->notify, ncm->notify_req); -- } -- -- ERROR(cdev, "%s: can't bind, err %d\n", f->name, status); -- -- return status; - } - - static inline struct f_ncm_opts *to_f_ncm_opts(struct config_item *item) -diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c -index b47f99d17ee9a5..ef7e734511ab2e 100644 ---- a/drivers/usb/gadget/function/f_rndis.c -+++ b/drivers/usb/gadget/function/f_rndis.c -@@ -19,6 +19,8 @@ - - #include - -+#include -+ - #include "u_ether.h" - #include "u_ether_configfs.h" - #include "u_rndis.h" -@@ -662,6 +664,8 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f) - struct usb_ep *ep; - - struct f_rndis_opts *rndis_opts; -+ struct usb_os_desc_table *os_desc_table __free(kfree) = NULL; -+ struct usb_request *request __free(free_usb_request) = NULL; - - if (!can_support_rndis(c)) - return -EINVAL; -@@ -669,12 +673,9 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f) - rndis_opts = container_of(f->fi, struct f_rndis_opts, func_inst); - - if (cdev->use_os_string) { -- f->os_desc_table = kzalloc(sizeof(*f->os_desc_table), -- GFP_KERNEL); -- if (!f->os_desc_table) -+ os_desc_table = kzalloc(sizeof(*os_desc_table), GFP_KERNEL); -+ if (!os_desc_table) - return -ENOMEM; -- f->os_desc_n = 1; -- f->os_desc_table[0].os_desc = &rndis_opts->rndis_os_desc; - } - - rndis_iad_descriptor.bFunctionClass = rndis_opts->class; -@@ -692,16 +693,14 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f) - gether_set_gadget(rndis_opts->net, cdev->gadget); - status = gether_register_netdev(rndis_opts->net); - if (status) -- goto fail; -+ return status; - rndis_opts->bound = true; - } - - us = usb_gstrings_attach(cdev, rndis_strings, - ARRAY_SIZE(rndis_string_defs)); -- if (IS_ERR(us)) { -- status = PTR_ERR(us); -- goto fail; -- } -+ if (IS_ERR(us)) -+ return PTR_ERR(us); - rndis_control_intf.iInterface = us[0].id; - rndis_data_intf.iInterface = us[1].id; - rndis_iad_descriptor.iFunction = us[2].id; -@@ -709,36 +708,30 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f) - /* allocate instance-specific interface IDs */ - status = usb_interface_id(c, f); - if (status < 0) -- goto fail; -+ return status; - rndis->ctrl_id = status; - rndis_iad_descriptor.bFirstInterface = status; - - rndis_control_intf.bInterfaceNumber = status; - rndis_union_desc.bMasterInterface0 = status; - -- if (cdev->use_os_string) -- f->os_desc_table[0].if_id = -- rndis_iad_descriptor.bFirstInterface; -- - status = usb_interface_id(c, f); - if (status < 0) -- goto fail; -+ return status; - rndis->data_id = status; - - rndis_data_intf.bInterfaceNumber = status; - rndis_union_desc.bSlaveInterface0 = status; - -- status = -ENODEV; -- - /* allocate instance-specific endpoints */ - ep = usb_ep_autoconfig(cdev->gadget, &fs_in_desc); - if (!ep) -- goto fail; -+ return -ENODEV; - rndis->port.in_ep = ep; - - ep = usb_ep_autoconfig(cdev->gadget, &fs_out_desc); - if (!ep) -- goto fail; -+ return -ENODEV; - rndis->port.out_ep = ep; - - /* NOTE: a status/notification endpoint is, strictly speaking, -@@ -747,21 +740,19 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f) - */ - ep = usb_ep_autoconfig(cdev->gadget, &fs_notify_desc); - if (!ep) -- goto fail; -+ return -ENODEV; - rndis->notify = ep; - -- status = -ENOMEM; -- - /* allocate notification request and buffer */ -- rndis->notify_req = usb_ep_alloc_request(ep, GFP_KERNEL); -- if (!rndis->notify_req) -- goto fail; -- rndis->notify_req->buf = kmalloc(STATUS_BYTECOUNT, GFP_KERNEL); -- if (!rndis->notify_req->buf) -- goto fail; -- rndis->notify_req->length = STATUS_BYTECOUNT; -- rndis->notify_req->context = rndis; -- rndis->notify_req->complete = rndis_response_complete; -+ request = usb_ep_alloc_request(ep, GFP_KERNEL); -+ if (!request) -+ return -ENOMEM; -+ request->buf = kmalloc(STATUS_BYTECOUNT, GFP_KERNEL); -+ if (!request->buf) -+ return -ENOMEM; -+ request->length = STATUS_BYTECOUNT; -+ request->context = rndis; -+ request->complete = rndis_response_complete; - - /* support all relevant hardware speeds... we expect that when - * hardware is dual speed, all bulk-capable endpoints work at -@@ -778,7 +769,7 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f) - status = usb_assign_descriptors(f, eth_fs_function, eth_hs_function, - eth_ss_function, eth_ss_function); - if (status) -- goto fail; -+ return status; - - rndis->port.open = rndis_open; - rndis->port.close = rndis_close; -@@ -789,9 +780,18 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f) - if (rndis->manufacturer && rndis->vendorID && - rndis_set_param_vendor(rndis->params, rndis->vendorID, - rndis->manufacturer)) { -- status = -EINVAL; -- goto fail_free_descs; -+ usb_free_all_descriptors(f); -+ return -EINVAL; -+ } -+ -+ if (cdev->use_os_string) { -+ os_desc_table[0].os_desc = &rndis_opts->rndis_os_desc; -+ os_desc_table[0].if_id = rndis_iad_descriptor.bFirstInterface; -+ f->os_desc_table = no_free_ptr(os_desc_table); -+ f->os_desc_n = 1; -+ - } -+ rndis->notify_req = no_free_ptr(request); - - /* NOTE: all that is done without knowing or caring about - * the network link ... which is unavailable to this code -@@ -802,21 +802,6 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f) - rndis->port.in_ep->name, rndis->port.out_ep->name, - rndis->notify->name); - return 0; -- --fail_free_descs: -- usb_free_all_descriptors(f); --fail: -- kfree(f->os_desc_table); -- f->os_desc_n = 0; -- -- if (rndis->notify_req) { -- kfree(rndis->notify_req->buf); -- usb_ep_free_request(rndis->notify, rndis->notify_req); -- } -- -- ERROR(cdev, "%s: can't bind, err %d\n", f->name, status); -- -- return status; - } - - void rndis_borrow_net(struct usb_function_instance *f, struct net_device *net) -diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c -index a4120a25428e5d..25bbb7a440ce28 100644 ---- a/drivers/usb/gadget/udc/core.c -+++ b/drivers/usb/gadget/udc/core.c -@@ -194,6 +194,9 @@ struct usb_request *usb_ep_alloc_request(struct usb_ep *ep, - - req = ep->ops->alloc_request(ep, gfp_flags); - -+ if (req) -+ req->ep = ep; -+ - trace_usb_ep_alloc_request(ep, req, req ? 0 : -ENOMEM); - - return req; -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index 88ba277bc3a79e..2d6ccc21a8229f 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -985,7 +985,7 @@ static void btrfs_readahead_expand(struct readahead_control *ractl, - { - const u64 ra_pos = readahead_pos(ractl); - const u64 ra_end = ra_pos + readahead_length(ractl); -- const u64 em_end = em->start + em->ram_bytes; -+ const u64 em_end = em->start + em->len; - - /* No expansion for holes and inline extents. */ - if (em->block_start > EXTENT_MAP_LAST_BYTE) -diff --git a/fs/btrfs/free-space-tree.c b/fs/btrfs/free-space-tree.c -index 8efe3a9369df04..1fb635a9997600 100644 ---- a/fs/btrfs/free-space-tree.c -+++ b/fs/btrfs/free-space-tree.c -@@ -1108,14 +1108,15 @@ static int populate_free_space_tree(struct btrfs_trans_handle *trans, - * If ret is 1 (no key found), it means this is an empty block group, - * without any extents allocated from it and there's no block group - * item (key BTRFS_BLOCK_GROUP_ITEM_KEY) located in the extent tree -- * because we are using the block group tree feature, so block group -- * items are stored in the block group tree. It also means there are no -- * extents allocated for block groups with a start offset beyond this -- * block group's end offset (this is the last, highest, block group). -+ * because we are using the block group tree feature (so block group -+ * items are stored in the block group tree) or this is a new block -+ * group created in the current transaction and its block group item -+ * was not yet inserted in the extent tree (that happens in -+ * btrfs_create_pending_block_groups() -> insert_block_group_item()). -+ * It also means there are no extents allocated for block groups with a -+ * start offset beyond this block group's end offset (this is the last, -+ * highest, block group). - */ -- if (!btrfs_fs_compat_ro(trans->fs_info, BLOCK_GROUP_TREE)) -- ASSERT(ret == 0); -- - start = block_group->start; - end = block_group->start + block_group->length; - while (ret == 0) { -diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c -index 8cc1f4b832773e..b21b5e0f89054f 100644 ---- a/fs/btrfs/relocation.c -+++ b/fs/btrfs/relocation.c -@@ -3877,6 +3877,7 @@ static noinline_for_stack struct inode *create_reloc_inode( - /* - * Mark start of chunk relocation that is cancellable. Check if the cancellation - * has been requested meanwhile and don't start in that case. -+ * NOTE: if this returns an error, reloc_chunk_end() must not be called. - * - * Return: - * 0 success -@@ -3893,10 +3894,8 @@ static int reloc_chunk_start(struct btrfs_fs_info *fs_info) - - if (atomic_read(&fs_info->reloc_cancel_req) > 0) { - btrfs_info(fs_info, "chunk relocation canceled on start"); -- /* -- * On cancel, clear all requests but let the caller mark -- * the end after cleanup operations. -- */ -+ /* On cancel, clear all requests. */ -+ clear_and_wake_up_bit(BTRFS_FS_RELOC_RUNNING, &fs_info->flags); - atomic_set(&fs_info->reloc_cancel_req, 0); - return -ECANCELED; - } -@@ -3905,9 +3904,11 @@ static int reloc_chunk_start(struct btrfs_fs_info *fs_info) - - /* - * Mark end of chunk relocation that is cancellable and wake any waiters. -+ * NOTE: call only if a previous call to reloc_chunk_start() succeeded. - */ - static void reloc_chunk_end(struct btrfs_fs_info *fs_info) - { -+ ASSERT(test_bit(BTRFS_FS_RELOC_RUNNING, &fs_info->flags)); - /* Requested after start, clear bit first so any waiters can continue */ - if (atomic_read(&fs_info->reloc_cancel_req) > 0) - btrfs_info(fs_info, "chunk relocation canceled during operation"); -@@ -4119,9 +4120,9 @@ int btrfs_relocate_block_group(struct btrfs_fs_info *fs_info, u64 group_start) - if (err && rw) - btrfs_dec_block_group_ro(rc->block_group); - iput(rc->data_inode); -+ reloc_chunk_end(fs_info); - out_put_bg: - btrfs_put_block_group(bg); -- reloc_chunk_end(fs_info); - free_reloc_control(rc); - return err; - } -@@ -4311,8 +4312,8 @@ int btrfs_recover_relocation(struct btrfs_fs_info *fs_info) - err = ret; - out_unset: - unset_reloc_control(rc); --out_end: - reloc_chunk_end(fs_info); -+out_end: - free_reloc_control(rc); - out: - free_reloc_roots(&reloc_roots); -diff --git a/fs/dax.c b/fs/dax.c -index 8c09578fa03573..e1451efaab1403 100644 ---- a/fs/dax.c -+++ b/fs/dax.c -@@ -1578,7 +1578,7 @@ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter, - if (iov_iter_rw(iter) == WRITE) { - lockdep_assert_held_write(&iomi.inode->i_rwsem); - iomi.flags |= IOMAP_WRITE; -- } else { -+ } else if (!sb_rdonly(iomi.inode->i_sb)) { - lockdep_assert_held(&iomi.inode->i_rwsem); - } - -diff --git a/fs/dcache.c b/fs/dcache.c -index 4030c010a76820..74d49b2b3b6e22 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -1861,6 +1861,8 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name) - __dget_dlock(parent); - dentry->d_parent = parent; - list_add(&dentry->d_child, &parent->d_subdirs); -+ if (parent->d_flags & DCACHE_DISCONNECTED) -+ dentry->d_flags |= DCACHE_DISCONNECTED; - spin_unlock(&parent->d_lock); - - return dentry; -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 6b2d655c1cefcd..1e80a9b1d1263f 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -45,10 +45,10 @@ - * - * 1) epnested_mutex (mutex) - * 2) ep->mtx (mutex) -- * 3) ep->lock (rwlock) -+ * 3) ep->lock (spinlock) - * - * The acquire order is the one listed above, from 1 to 3. -- * We need a rwlock (ep->lock) because we manipulate objects -+ * We need a spinlock (ep->lock) because we manipulate objects - * from inside the poll callback, that might be triggered from - * a wake_up() that in turn might be called from IRQ context. - * So we can't sleep inside the poll callback and hence we need -@@ -194,7 +194,7 @@ struct eventpoll { - struct list_head rdllist; - - /* Lock which protects rdllist and ovflist */ -- rwlock_t lock; -+ spinlock_t lock; - - /* RB tree root used to store monitored fd structs */ - struct rb_root_cached rbr; -@@ -206,7 +206,7 @@ struct eventpoll { - */ - struct epitem *ovflist; - -- /* wakeup_source used when ep_scan_ready_list is running */ -+ /* wakeup_source used when ep_send_events or __ep_eventpoll_poll is running */ - struct wakeup_source *ws; - - /* The user that created the eventpoll descriptor */ -@@ -625,10 +625,10 @@ static void ep_start_scan(struct eventpoll *ep, struct list_head *txlist) - * in a lockless way. - */ - lockdep_assert_irqs_enabled(); -- write_lock_irq(&ep->lock); -+ spin_lock_irq(&ep->lock); - list_splice_init(&ep->rdllist, txlist); - WRITE_ONCE(ep->ovflist, NULL); -- write_unlock_irq(&ep->lock); -+ spin_unlock_irq(&ep->lock); - } - - static void ep_done_scan(struct eventpoll *ep, -@@ -636,7 +636,7 @@ static void ep_done_scan(struct eventpoll *ep, - { - struct epitem *epi, *nepi; - -- write_lock_irq(&ep->lock); -+ spin_lock_irq(&ep->lock); - /* - * During the time we spent inside the "sproc" callback, some - * other events might have been queued by the poll callback. -@@ -677,7 +677,7 @@ static void ep_done_scan(struct eventpoll *ep, - wake_up(&ep->wq); - } - -- write_unlock_irq(&ep->lock); -+ spin_unlock_irq(&ep->lock); - } - - static void epi_rcu_free(struct rcu_head *head) -@@ -757,10 +757,10 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) - - rb_erase_cached(&epi->rbn, &ep->rbr); - -- write_lock_irq(&ep->lock); -+ spin_lock_irq(&ep->lock); - if (ep_is_linked(epi)) - list_del_init(&epi->rdllink); -- write_unlock_irq(&ep->lock); -+ spin_unlock_irq(&ep->lock); - - wakeup_source_unregister(ep_wakeup_source(epi)); - /* -@@ -1018,7 +1018,7 @@ static int ep_alloc(struct eventpoll **pep) - return -ENOMEM; - - mutex_init(&ep->mtx); -- rwlock_init(&ep->lock); -+ spin_lock_init(&ep->lock); - init_waitqueue_head(&ep->wq); - init_waitqueue_head(&ep->poll_wait); - INIT_LIST_HEAD(&ep->rdllist); -@@ -1105,100 +1105,10 @@ struct file *get_epoll_tfile_raw_ptr(struct file *file, int tfd, - } - #endif /* CONFIG_KCMP */ - --/* -- * Adds a new entry to the tail of the list in a lockless way, i.e. -- * multiple CPUs are allowed to call this function concurrently. -- * -- * Beware: it is necessary to prevent any other modifications of the -- * existing list until all changes are completed, in other words -- * concurrent list_add_tail_lockless() calls should be protected -- * with a read lock, where write lock acts as a barrier which -- * makes sure all list_add_tail_lockless() calls are fully -- * completed. -- * -- * Also an element can be locklessly added to the list only in one -- * direction i.e. either to the tail or to the head, otherwise -- * concurrent access will corrupt the list. -- * -- * Return: %false if element has been already added to the list, %true -- * otherwise. -- */ --static inline bool list_add_tail_lockless(struct list_head *new, -- struct list_head *head) --{ -- struct list_head *prev; -- -- /* -- * This is simple 'new->next = head' operation, but cmpxchg() -- * is used in order to detect that same element has been just -- * added to the list from another CPU: the winner observes -- * new->next == new. -- */ -- if (!try_cmpxchg(&new->next, &new, head)) -- return false; -- -- /* -- * Initially ->next of a new element must be updated with the head -- * (we are inserting to the tail) and only then pointers are atomically -- * exchanged. XCHG guarantees memory ordering, thus ->next should be -- * updated before pointers are actually swapped and pointers are -- * swapped before prev->next is updated. -- */ -- -- prev = xchg(&head->prev, new); -- -- /* -- * It is safe to modify prev->next and new->prev, because a new element -- * is added only to the tail and new->next is updated before XCHG. -- */ -- -- prev->next = new; -- new->prev = prev; -- -- return true; --} -- --/* -- * Chains a new epi entry to the tail of the ep->ovflist in a lockless way, -- * i.e. multiple CPUs are allowed to call this function concurrently. -- * -- * Return: %false if epi element has been already chained, %true otherwise. -- */ --static inline bool chain_epi_lockless(struct epitem *epi) --{ -- struct eventpoll *ep = epi->ep; -- -- /* Fast preliminary check */ -- if (epi->next != EP_UNACTIVE_PTR) -- return false; -- -- /* Check that the same epi has not been just chained from another CPU */ -- if (cmpxchg(&epi->next, EP_UNACTIVE_PTR, NULL) != EP_UNACTIVE_PTR) -- return false; -- -- /* Atomically exchange tail */ -- epi->next = xchg(&ep->ovflist, epi); -- -- return true; --} -- - /* - * This is the callback that is passed to the wait queue wakeup - * mechanism. It is called by the stored file descriptors when they - * have events to report. -- * -- * This callback takes a read lock in order not to contend with concurrent -- * events from another file descriptor, thus all modifications to ->rdllist -- * or ->ovflist are lockless. Read lock is paired with the write lock from -- * ep_scan_ready_list(), which stops all list modifications and guarantees -- * that lists state is seen correctly. -- * -- * Another thing worth to mention is that ep_poll_callback() can be called -- * concurrently for the same @epi from different CPUs if poll table was inited -- * with several wait queues entries. Plural wakeup from different CPUs of a -- * single wait queue is serialized by wq.lock, but the case when multiple wait -- * queues are used should be detected accordingly. This is detected using -- * cmpxchg() operation. - */ - static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, void *key) - { -@@ -1209,7 +1119,7 @@ static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, v - unsigned long flags; - int ewake = 0; - -- read_lock_irqsave(&ep->lock, flags); -+ spin_lock_irqsave(&ep->lock, flags); - - ep_set_busy_poll_napi_id(epi); - -@@ -1238,12 +1148,15 @@ static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, v - * chained in ep->ovflist and requeued later on. - */ - if (READ_ONCE(ep->ovflist) != EP_UNACTIVE_PTR) { -- if (chain_epi_lockless(epi)) -+ if (epi->next == EP_UNACTIVE_PTR) { -+ epi->next = READ_ONCE(ep->ovflist); -+ WRITE_ONCE(ep->ovflist, epi); - ep_pm_stay_awake_rcu(epi); -+ } - } else if (!ep_is_linked(epi)) { - /* In the usual case, add event to ready list. */ -- if (list_add_tail_lockless(&epi->rdllink, &ep->rdllist)) -- ep_pm_stay_awake_rcu(epi); -+ list_add_tail(&epi->rdllink, &ep->rdllist); -+ ep_pm_stay_awake_rcu(epi); - } - - /* -@@ -1276,7 +1189,7 @@ static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, v - pwake++; - - out_unlock: -- read_unlock_irqrestore(&ep->lock, flags); -+ spin_unlock_irqrestore(&ep->lock, flags); - - /* We have to call this outside the lock */ - if (pwake) -@@ -1611,7 +1524,7 @@ static int ep_insert(struct eventpoll *ep, const struct epoll_event *event, - } - - /* We have to drop the new item inside our item list to keep track of it */ -- write_lock_irq(&ep->lock); -+ spin_lock_irq(&ep->lock); - - /* record NAPI ID of new item if present */ - ep_set_busy_poll_napi_id(epi); -@@ -1628,7 +1541,7 @@ static int ep_insert(struct eventpoll *ep, const struct epoll_event *event, - pwake++; - } - -- write_unlock_irq(&ep->lock); -+ spin_unlock_irq(&ep->lock); - - /* We have to call this outside the lock */ - if (pwake) -@@ -1692,7 +1605,7 @@ static int ep_modify(struct eventpoll *ep, struct epitem *epi, - * list, push it inside. - */ - if (ep_item_poll(epi, &pt, 1)) { -- write_lock_irq(&ep->lock); -+ spin_lock_irq(&ep->lock); - if (!ep_is_linked(epi)) { - list_add_tail(&epi->rdllink, &ep->rdllist); - ep_pm_stay_awake(epi); -@@ -1703,7 +1616,7 @@ static int ep_modify(struct eventpoll *ep, struct epitem *epi, - if (waitqueue_active(&ep->poll_wait)) - pwake++; - } -- write_unlock_irq(&ep->lock); -+ spin_unlock_irq(&ep->lock); - } - - /* We have to call this outside the lock */ -@@ -1792,7 +1705,7 @@ static int ep_send_events(struct eventpoll *ep, - * availability. At this point, no one can insert - * into ep->rdllist besides us. The epoll_ctl() - * callers are locked out by -- * ep_scan_ready_list() holding "mtx" and the -+ * ep_send_events() holding "mtx" and the - * poll callback will queue them in ep->ovflist. - */ - list_add_tail(&epi->rdllink, &ep->rdllist); -@@ -1936,7 +1849,7 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, - init_wait(&wait); - wait.func = ep_autoremove_wake_function; - -- write_lock_irq(&ep->lock); -+ spin_lock_irq(&ep->lock); - /* - * Barrierless variant, waitqueue_active() is called under - * the same lock on wakeup ep_poll_callback() side, so it -@@ -1945,7 +1858,7 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, - __set_current_state(TASK_INTERRUPTIBLE); - - /* -- * Do the final check under the lock. ep_scan_ready_list() -+ * Do the final check under the lock. ep_start/done_scan() - * plays with two lists (->rdllist and ->ovflist) and there - * is always a race when both lists are empty for short - * period of time although events are pending, so lock is -@@ -1955,7 +1868,7 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, - if (!eavail) - __add_wait_queue_exclusive(&ep->wq, &wait); - -- write_unlock_irq(&ep->lock); -+ spin_unlock_irq(&ep->lock); - - if (!eavail) - timed_out = !schedule_hrtimeout_range(to, slack, -@@ -1970,7 +1883,7 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, - eavail = 1; - - if (!list_empty_careful(&wait.entry)) { -- write_lock_irq(&ep->lock); -+ spin_lock_irq(&ep->lock); - /* - * If the thread timed out and is not on the wait queue, - * it means that the thread was woken up after its -@@ -1981,7 +1894,7 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, - if (timed_out) - eavail = list_empty(&wait.entry); - __remove_wait_queue(&ep->wq, &wait); -- write_unlock_irq(&ep->lock); -+ spin_unlock_irq(&ep->lock); - } - } - } -diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c -index d1a2e662440178..32f59295cfa05a 100644 ---- a/fs/ext4/ext4_jbd2.c -+++ b/fs/ext4/ext4_jbd2.c -@@ -277,9 +277,16 @@ int __ext4_forget(const char *where, unsigned int line, handle_t *handle, - bh, is_metadata, inode->i_mode, - test_opt(inode->i_sb, DATA_FLAGS)); - -- /* In the no journal case, we can just do a bforget and return */ -+ /* -+ * In the no journal case, we should wait for the ongoing buffer -+ * to complete and do a forget. -+ */ - if (!ext4_handle_valid(handle)) { -- bforget(bh); -+ if (bh) { -+ clear_buffer_dirty(bh); -+ wait_on_buffer(bh); -+ __bforget(bh); -+ } - return 0; - } - -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 91a9fa6f1ad4f0..563cd072642468 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -4944,6 +4944,14 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, - } - ei->i_flags = le32_to_cpu(raw_inode->i_flags); - ext4_set_inode_flags(inode, true); -+ /* Detect invalid flag combination - can't have both inline data and extents */ -+ if (ext4_test_inode_flag(inode, EXT4_INODE_INLINE_DATA) && -+ ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) { -+ ext4_error_inode(inode, function, line, 0, -+ "inode has both inline data and extents flags"); -+ ret = -EFSCORRUPTED; -+ goto bad_inode; -+ } - inode->i_blocks = ext4_inode_blocks(raw_inode, ei); - ei->i_file_acl = le32_to_cpu(raw_inode->i_file_acl_lo); - if (ext4_has_feature_64bit(sb)) -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 527f53bfe1b1f0..16a6c249580e3c 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -2506,7 +2506,7 @@ static int parse_apply_sb_mount_options(struct super_block *sb, - struct ext4_fs_context *m_ctx) - { - struct ext4_sb_info *sbi = EXT4_SB(sb); -- char *s_mount_opts = NULL; -+ char s_mount_opts[65]; - struct ext4_fs_context *s_ctx = NULL; - struct fs_context *fc = NULL; - int ret = -ENOMEM; -@@ -2514,15 +2514,11 @@ static int parse_apply_sb_mount_options(struct super_block *sb, - if (!sbi->s_es->s_mount_opts[0]) - return 0; - -- s_mount_opts = kstrndup(sbi->s_es->s_mount_opts, -- sizeof(sbi->s_es->s_mount_opts), -- GFP_KERNEL); -- if (!s_mount_opts) -- return ret; -+ strscpy_pad(s_mount_opts, sbi->s_es->s_mount_opts, sizeof(s_mount_opts)); - - fc = kzalloc(sizeof(struct fs_context), GFP_KERNEL); - if (!fc) -- goto out_free; -+ return -ENOMEM; - - s_ctx = kzalloc(sizeof(struct ext4_fs_context), GFP_KERNEL); - if (!s_ctx) -@@ -2554,11 +2550,8 @@ static int parse_apply_sb_mount_options(struct super_block *sb, - ret = 0; - - out_free: -- if (fc) { -- ext4_fc_free(fc); -- kfree(fc); -- } -- kfree(s_mount_opts); -+ ext4_fc_free(fc); -+ kfree(fc); - return ret; - } - -diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c -index fe23ebfc88ea14..f5252f3e840a5c 100644 ---- a/fs/f2fs/data.c -+++ b/fs/f2fs/data.c -@@ -1506,8 +1506,8 @@ static bool f2fs_map_blocks_cached(struct inode *inode, - struct f2fs_dev_info *dev = &sbi->devs[bidx]; - - map->m_bdev = dev->bdev; -- map->m_pblk -= dev->start_blk; - map->m_len = min(map->m_len, dev->end_blk + 1 - map->m_pblk); -+ map->m_pblk -= dev->start_blk; - } else { - map->m_bdev = inode->i_sb->s_bdev; - } -diff --git a/fs/hfsplus/unicode.c b/fs/hfsplus/unicode.c -index 36b6cf2a3abba4..ebd326799f35ac 100644 ---- a/fs/hfsplus/unicode.c -+++ b/fs/hfsplus/unicode.c -@@ -40,6 +40,18 @@ int hfsplus_strcasecmp(const struct hfsplus_unistr *s1, - p1 = s1->unicode; - p2 = s2->unicode; - -+ if (len1 > HFSPLUS_MAX_STRLEN) { -+ len1 = HFSPLUS_MAX_STRLEN; -+ pr_err("invalid length %u has been corrected to %d\n", -+ be16_to_cpu(s1->length), len1); -+ } -+ -+ if (len2 > HFSPLUS_MAX_STRLEN) { -+ len2 = HFSPLUS_MAX_STRLEN; -+ pr_err("invalid length %u has been corrected to %d\n", -+ be16_to_cpu(s2->length), len2); -+ } -+ - while (1) { - c1 = c2 = 0; - -@@ -74,6 +86,18 @@ int hfsplus_strcmp(const struct hfsplus_unistr *s1, - p1 = s1->unicode; - p2 = s2->unicode; - -+ if (len1 > HFSPLUS_MAX_STRLEN) { -+ len1 = HFSPLUS_MAX_STRLEN; -+ pr_err("invalid length %u has been corrected to %d\n", -+ be16_to_cpu(s1->length), len1); -+ } -+ -+ if (len2 > HFSPLUS_MAX_STRLEN) { -+ len2 = HFSPLUS_MAX_STRLEN; -+ pr_err("invalid length %u has been corrected to %d\n", -+ be16_to_cpu(s2->length), len2); -+ } -+ - for (len = min(len1, len2); len > 0; len--) { - c1 = be16_to_cpu(*p1); - c2 = be16_to_cpu(*p2); -diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c -index c2b8ad0b24c443..82bd29c170855a 100644 ---- a/fs/jbd2/transaction.c -+++ b/fs/jbd2/transaction.c -@@ -1649,6 +1649,7 @@ int jbd2_journal_forget(handle_t *handle, struct buffer_head *bh) - int drop_reserve = 0; - int err = 0; - int was_modified = 0; -+ int wait_for_writeback = 0; - - if (is_handle_aborted(handle)) - return -EROFS; -@@ -1772,18 +1773,22 @@ int jbd2_journal_forget(handle_t *handle, struct buffer_head *bh) - } - - /* -- * The buffer is still not written to disk, we should -- * attach this buffer to current transaction so that the -- * buffer can be checkpointed only after the current -- * transaction commits. -+ * The buffer has not yet been written to disk. We should -+ * either clear the buffer or ensure that the ongoing I/O -+ * is completed, and attach this buffer to current -+ * transaction so that the buffer can be checkpointed only -+ * after the current transaction commits. - */ - clear_buffer_dirty(bh); -+ wait_for_writeback = 1; - __jbd2_journal_file_buffer(jh, transaction, BJ_Forget); - spin_unlock(&journal->j_list_lock); - } - drop: - __brelse(bh); - spin_unlock(&jh->b_state_lock); -+ if (wait_for_writeback) -+ wait_on_buffer(bh); - jbd2_journal_put_journal_head(jh); - if (drop_reserve) { - /* no need to reserve log space for this block -bzzz */ -diff --git a/fs/nfsd/blocklayout.c b/fs/nfsd/blocklayout.c -index 01d7fd108cf3df..59f119cce3dc61 100644 ---- a/fs/nfsd/blocklayout.c -+++ b/fs/nfsd/blocklayout.c -@@ -117,7 +117,6 @@ static __be32 - nfsd4_block_commit_blocks(struct inode *inode, struct nfsd4_layoutcommit *lcp, - struct iomap *iomaps, int nr_iomaps) - { -- loff_t new_size = lcp->lc_last_wr + 1; - struct iattr iattr = { .ia_valid = 0 }; - int error; - -@@ -127,9 +126,9 @@ nfsd4_block_commit_blocks(struct inode *inode, struct nfsd4_layoutcommit *lcp, - iattr.ia_valid |= ATTR_ATIME | ATTR_CTIME | ATTR_MTIME; - iattr.ia_atime = iattr.ia_ctime = iattr.ia_mtime = lcp->lc_mtime; - -- if (new_size > i_size_read(inode)) { -+ if (lcp->lc_size_chg) { - iattr.ia_valid |= ATTR_SIZE; -- iattr.ia_size = new_size; -+ iattr.ia_size = lcp->lc_newsize; - } - - error = inode->i_sb->s_export_op->commit_blocks(inode, iomaps, -diff --git a/fs/nfsd/blocklayoutxdr.c b/fs/nfsd/blocklayoutxdr.c -index 1ed2f691ebb908..dd35c472eb37de 100644 ---- a/fs/nfsd/blocklayoutxdr.c -+++ b/fs/nfsd/blocklayoutxdr.c -@@ -29,8 +29,7 @@ nfsd4_block_encode_layoutget(struct xdr_stream *xdr, - *p++ = cpu_to_be32(len); - *p++ = cpu_to_be32(1); /* we always return a single extent */ - -- p = xdr_encode_opaque_fixed(p, &b->vol_id, -- sizeof(struct nfsd4_deviceid)); -+ p = svcxdr_encode_deviceid4(p, &b->vol_id); - p = xdr_encode_hyper(p, b->foff); - p = xdr_encode_hyper(p, b->len); - p = xdr_encode_hyper(p, b->soff); -@@ -145,9 +144,7 @@ nfsd4_block_decode_layoutupdate(__be32 *p, u32 len, struct iomap **iomapp, - for (i = 0; i < nr_iomaps; i++) { - struct pnfs_block_extent bex; - -- memcpy(&bex.vol_id, p, sizeof(struct nfsd4_deviceid)); -- p += XDR_QUADLEN(sizeof(struct nfsd4_deviceid)); -- -+ p = svcxdr_decode_deviceid4(p, &bex.vol_id); - p = xdr_decode_hyper(p, &bex.foff); - if (bex.foff & (block_size - 1)) { - dprintk("%s: unaligned offset 0x%llx\n", -diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c -index 4b5d998cbc2f44..f4e77859aa8599 100644 ---- a/fs/nfsd/export.c -+++ b/fs/nfsd/export.c -@@ -1071,28 +1071,62 @@ static struct svc_export *exp_find(struct cache_detail *cd, - return exp; - } - --__be32 check_nfsd_access(struct svc_export *exp, struct svc_rqst *rqstp) -+/** -+ * check_xprtsec_policy - check if access to export is allowed by the -+ * xprtsec policy -+ * @exp: svc_export that is being accessed. -+ * @rqstp: svc_rqst attempting to access @exp. -+ * -+ * Helper function for check_nfsd_access(). Note that callers should be -+ * using check_nfsd_access() instead of calling this function directly. The -+ * one exception is fh_verify() since it has logic that may result in one -+ * or both of the helpers being skipped. -+ * -+ * Return values: -+ * %nfs_ok if access is granted, or -+ * %nfserr_acces or %nfserr_wrongsec if access is denied -+ */ -+__be32 check_xprtsec_policy(struct svc_export *exp, struct svc_rqst *rqstp) - { -- struct exp_flavor_info *f, *end = exp->ex_flavors + exp->ex_nflavors; - struct svc_xprt *xprt = rqstp->rq_xprt; - - if (exp->ex_xprtsec_modes & NFSEXP_XPRTSEC_NONE) { - if (!test_bit(XPT_TLS_SESSION, &xprt->xpt_flags)) -- goto ok; -+ return nfs_ok; - } - if (exp->ex_xprtsec_modes & NFSEXP_XPRTSEC_TLS) { - if (test_bit(XPT_TLS_SESSION, &xprt->xpt_flags) && - !test_bit(XPT_PEER_AUTH, &xprt->xpt_flags)) -- goto ok; -+ return nfs_ok; - } - if (exp->ex_xprtsec_modes & NFSEXP_XPRTSEC_MTLS) { - if (test_bit(XPT_TLS_SESSION, &xprt->xpt_flags) && - test_bit(XPT_PEER_AUTH, &xprt->xpt_flags)) -- goto ok; -+ return nfs_ok; - } -- goto denied; - --ok: -+ return rqstp->rq_vers < 4 ? nfserr_acces : nfserr_wrongsec; -+} -+ -+/** -+ * check_security_flavor - check if access to export is allowed by the -+ * xprtsec policy -+ * @exp: svc_export that is being accessed. -+ * @rqstp: svc_rqst attempting to access @exp. -+ * -+ * Helper function for check_nfsd_access(). Note that callers should be -+ * using check_nfsd_access() instead of calling this function directly. The -+ * one exception is fh_verify() since it has logic that may result in one -+ * or both of the helpers being skipped. -+ * -+ * Return values: -+ * %nfs_ok if access is granted, or -+ * %nfserr_acces or %nfserr_wrongsec if access is denied -+ */ -+__be32 check_security_flavor(struct svc_export *exp, struct svc_rqst *rqstp) -+{ -+ struct exp_flavor_info *f, *end = exp->ex_flavors + exp->ex_nflavors; -+ - /* legacy gss-only clients are always OK: */ - if (exp->ex_client == rqstp->rq_gssclient) - return 0; -@@ -1117,10 +1151,20 @@ __be32 check_nfsd_access(struct svc_export *exp, struct svc_rqst *rqstp) - if (nfsd4_spo_must_allow(rqstp)) - return 0; - --denied: - return rqstp->rq_vers < 4 ? nfserr_acces : nfserr_wrongsec; - } - -+__be32 check_nfsd_access(struct svc_export *exp, struct svc_rqst *rqstp) -+{ -+ __be32 status; -+ -+ status = check_xprtsec_policy(exp, rqstp); -+ if (status != nfs_ok) -+ return status; -+ -+ return check_security_flavor(exp, rqstp); -+} -+ - /* - * Uses rq_client and rq_gssclient to find an export; uses rq_client (an - * auth_unix client) if it's available and has secinfo information; -diff --git a/fs/nfsd/export.h b/fs/nfsd/export.h -index ca9dc230ae3d0b..4a48b2ad56067f 100644 ---- a/fs/nfsd/export.h -+++ b/fs/nfsd/export.h -@@ -100,6 +100,8 @@ struct svc_expkey { - #define EX_WGATHER(exp) ((exp)->ex_flags & NFSEXP_GATHERED_WRITES) - - int nfsexp_flags(struct svc_rqst *rqstp, struct svc_export *exp); -+__be32 check_xprtsec_policy(struct svc_export *exp, struct svc_rqst *rqstp); -+__be32 check_security_flavor(struct svc_export *exp, struct svc_rqst *rqstp); - __be32 check_nfsd_access(struct svc_export *exp, struct svc_rqst *rqstp); - - /* -diff --git a/fs/nfsd/flexfilelayout.c b/fs/nfsd/flexfilelayout.c -index 3ca5304440ff0a..0bc52e6bec394d 100644 ---- a/fs/nfsd/flexfilelayout.c -+++ b/fs/nfsd/flexfilelayout.c -@@ -125,6 +125,13 @@ nfsd4_ff_proc_getdeviceinfo(struct super_block *sb, struct svc_rqst *rqstp, - return 0; - } - -+static __be32 -+nfsd4_ff_proc_layoutcommit(struct inode *inode, -+ struct nfsd4_layoutcommit *lcp) -+{ -+ return nfs_ok; -+} -+ - const struct nfsd4_layout_ops ff_layout_ops = { - .notify_types = - NOTIFY_DEVICEID4_DELETE | NOTIFY_DEVICEID4_CHANGE, -@@ -133,4 +140,5 @@ const struct nfsd4_layout_ops ff_layout_ops = { - .encode_getdeviceinfo = nfsd4_ff_encode_getdeviceinfo, - .proc_layoutget = nfsd4_ff_proc_layoutget, - .encode_layoutget = nfsd4_ff_encode_layoutget, -+ .proc_layoutcommit = nfsd4_ff_proc_layoutcommit, - }; -diff --git a/fs/nfsd/flexfilelayoutxdr.c b/fs/nfsd/flexfilelayoutxdr.c -index bb205328e043da..223a10f37898ef 100644 ---- a/fs/nfsd/flexfilelayoutxdr.c -+++ b/fs/nfsd/flexfilelayoutxdr.c -@@ -54,8 +54,7 @@ nfsd4_ff_encode_layoutget(struct xdr_stream *xdr, - *p++ = cpu_to_be32(1); /* single mirror */ - *p++ = cpu_to_be32(1); /* single data server */ - -- p = xdr_encode_opaque_fixed(p, &fl->deviceid, -- sizeof(struct nfsd4_deviceid)); -+ p = svcxdr_encode_deviceid4(p, &fl->deviceid); - - *p++ = cpu_to_be32(1); /* efficiency */ - -diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c -index e8a80052cb1ba9..308214378fd352 100644 ---- a/fs/nfsd/nfs4layouts.c -+++ b/fs/nfsd/nfs4layouts.c -@@ -120,7 +120,6 @@ nfsd4_set_deviceid(struct nfsd4_deviceid *id, const struct svc_fh *fhp, - - id->fsid_idx = fhp->fh_export->ex_devid_map->idx; - id->generation = device_generation; -- id->pad = 0; - return 0; - } - -diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c -index e9c1271b7ecc39..836367d839bda1 100644 ---- a/fs/nfsd/nfs4proc.c -+++ b/fs/nfsd/nfs4proc.c -@@ -2308,7 +2308,6 @@ nfsd4_layoutcommit(struct svc_rqst *rqstp, - const struct nfsd4_layout_seg *seg = &lcp->lc_seg; - struct svc_fh *current_fh = &cstate->current_fh; - const struct nfsd4_layout_ops *ops; -- loff_t new_size = lcp->lc_last_wr + 1; - struct inode *inode; - struct nfs4_layout_stateid *ls; - __be32 nfserr; -@@ -2324,18 +2323,20 @@ nfsd4_layoutcommit(struct svc_rqst *rqstp, - goto out; - inode = d_inode(current_fh->fh_dentry); - -- nfserr = nfserr_inval; -- if (new_size <= seg->offset) { -- dprintk("pnfsd: last write before layout segment\n"); -- goto out; -- } -- if (new_size > seg->offset + seg->length) { -- dprintk("pnfsd: last write beyond layout segment\n"); -- goto out; -- } -- if (!lcp->lc_newoffset && new_size > i_size_read(inode)) { -- dprintk("pnfsd: layoutcommit beyond EOF\n"); -- goto out; -+ lcp->lc_size_chg = false; -+ if (lcp->lc_newoffset) { -+ loff_t new_size = lcp->lc_last_wr + 1; -+ -+ nfserr = nfserr_inval; -+ if (new_size <= seg->offset) -+ goto out; -+ if (new_size > seg->offset + seg->length) -+ goto out; -+ -+ if (new_size > i_size_read(inode)) { -+ lcp->lc_size_chg = true; -+ lcp->lc_newsize = new_size; -+ } - } - - nfserr = nfsd4_preprocess_layout_stateid(rqstp, cstate, &lcp->lc_sid, -@@ -2352,13 +2353,6 @@ nfsd4_layoutcommit(struct svc_rqst *rqstp, - /* LAYOUTCOMMIT does not require any serialization */ - mutex_unlock(&ls->ls_mutex); - -- if (new_size > i_size_read(inode)) { -- lcp->lc_size_chg = 1; -- lcp->lc_newsize = new_size; -- } else { -- lcp->lc_size_chg = 0; -- } -- - nfserr = ops->proc_layoutcommit(inode, lcp); - nfs4_put_stid(&ls->ls_stid); - out: -diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c -index 76dfbb99277f05..3eff780fd8da0a 100644 ---- a/fs/nfsd/nfs4xdr.c -+++ b/fs/nfsd/nfs4xdr.c -@@ -566,18 +566,6 @@ nfsd4_decode_state_owner4(struct nfsd4_compoundargs *argp, - } - - #ifdef CONFIG_NFSD_PNFS --static __be32 --nfsd4_decode_deviceid4(struct nfsd4_compoundargs *argp, -- struct nfsd4_deviceid *devid) --{ -- __be32 *p; -- -- p = xdr_inline_decode(argp->xdr, NFS4_DEVICEID4_SIZE); -- if (!p) -- return nfserr_bad_xdr; -- memcpy(devid, p, sizeof(*devid)); -- return nfs_ok; --} - - static __be32 - nfsd4_decode_layoutupdate4(struct nfsd4_compoundargs *argp, -@@ -1733,7 +1721,7 @@ nfsd4_decode_getdeviceinfo(struct nfsd4_compoundargs *argp, - __be32 status; - - memset(gdev, 0, sizeof(*gdev)); -- status = nfsd4_decode_deviceid4(argp, &gdev->gd_devid); -+ status = nfsd4_decode_deviceid4(argp->xdr, &gdev->gd_devid); - if (status) - return status; - if (xdr_stream_decode_u32(argp->xdr, &gdev->gd_layout_type) < 0) -diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c -index c2495d98c18928..283c1a60c84603 100644 ---- a/fs/nfsd/nfsfh.c -+++ b/fs/nfsd/nfsfh.c -@@ -370,6 +370,16 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type, int access) - if (error) - goto out; - -+ /* -+ * NLM is allowed to bypass the xprtsec policy check because lockd -+ * doesn't support xprtsec. -+ */ -+ if (!(access & NFSD_MAY_LOCK)) { -+ error = check_xprtsec_policy(exp, rqstp); -+ if (error) -+ goto out; -+ } -+ - /* - * pseudoflavor restrictions are not enforced on NLM, - * which clients virtually always use auth_sys for, -@@ -386,7 +396,7 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type, int access) - && exp->ex_path.dentry == dentry) - goto skip_pseudoflavor_check; - -- error = check_nfsd_access(exp, rqstp); -+ error = check_security_flavor(exp, rqstp); - if (error) - goto out; - -diff --git a/fs/nfsd/xdr4.h b/fs/nfsd/xdr4.h -index 144e05efd14c35..a83a52b0f51816 100644 ---- a/fs/nfsd/xdr4.h -+++ b/fs/nfsd/xdr4.h -@@ -459,9 +459,43 @@ struct nfsd4_reclaim_complete { - struct nfsd4_deviceid { - u64 fsid_idx; - u32 generation; -- u32 pad; - }; - -+static inline __be32 * -+svcxdr_encode_deviceid4(__be32 *p, const struct nfsd4_deviceid *devid) -+{ -+ __be64 *q = (__be64 *)p; -+ -+ *q = (__force __be64)devid->fsid_idx; -+ p += 2; -+ *p++ = (__force __be32)devid->generation; -+ *p++ = xdr_zero; -+ return p; -+} -+ -+static inline __be32 * -+svcxdr_decode_deviceid4(__be32 *p, struct nfsd4_deviceid *devid) -+{ -+ __be64 *q = (__be64 *)p; -+ -+ devid->fsid_idx = (__force u64)(*q); -+ p += 2; -+ devid->generation = (__force u32)(*p++); -+ p++; /* NFSD does not use the remaining octets */ -+ return p; -+} -+ -+static inline __be32 -+nfsd4_decode_deviceid4(struct xdr_stream *xdr, struct nfsd4_deviceid *devid) -+{ -+ __be32 *p = xdr_inline_decode(xdr, NFS4_DEVICEID4_SIZE); -+ -+ if (unlikely(!p)) -+ return nfserr_bad_xdr; -+ svcxdr_decode_deviceid4(p, devid); -+ return nfs_ok; -+} -+ - struct nfsd4_layout_seg { - u32 iomode; - u64 offset; -diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c -index be41e26b782469..05fdbbc63e1f5f 100644 ---- a/fs/nilfs2/the_nilfs.c -+++ b/fs/nilfs2/the_nilfs.c -@@ -680,8 +680,6 @@ int init_nilfs(struct the_nilfs *nilfs, struct super_block *sb, char *data) - int blocksize; - int err; - -- down_write(&nilfs->ns_sem); -- - blocksize = sb_min_blocksize(sb, NILFS_MIN_BLOCK_SIZE); - if (!blocksize) { - nilfs_err(sb, "unable to set blocksize"); -@@ -757,7 +755,6 @@ int init_nilfs(struct the_nilfs *nilfs, struct super_block *sb, char *data) - set_nilfs_init(nilfs); - err = 0; - out: -- up_write(&nilfs->ns_sem); - return err; - - failed_sbh: -diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c -index e585e77cdc88e1..18dba873a1633f 100644 ---- a/fs/ocfs2/super.c -+++ b/fs/ocfs2/super.c -@@ -1571,15 +1571,13 @@ static int __init ocfs2_init(void) - - ocfs2_set_locking_protocol(); - -- status = register_quota_format(&ocfs2_quota_format); -- if (status < 0) -- goto out3; -+ register_quota_format(&ocfs2_quota_format); -+ - status = register_filesystem(&ocfs2_fs_type); - if (!status) - return 0; - - unregister_quota_format(&ocfs2_quota_format); --out3: - debugfs_remove(ocfs2_debugfs_root); - ocfs2_free_mem_caches(); - out2: -diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c -index 67562c78e57d53..42a7d0a71b22ee 100644 ---- a/fs/quota/dquot.c -+++ b/fs/quota/dquot.c -@@ -163,13 +163,15 @@ static struct quota_module_name module_names[] = INIT_QUOTA_MODULE_NAMES; - /* SLAB cache for dquot structures */ - static struct kmem_cache *dquot_cachep; - --int register_quota_format(struct quota_format_type *fmt) -+/* workqueue for work quota_release_work*/ -+static struct workqueue_struct *quota_unbound_wq; -+ -+void register_quota_format(struct quota_format_type *fmt) - { - spin_lock(&dq_list_lock); - fmt->qf_next = quota_formats; - quota_formats = fmt; - spin_unlock(&dq_list_lock); -- return 0; - } - EXPORT_SYMBOL(register_quota_format); - -@@ -892,7 +894,7 @@ void dqput(struct dquot *dquot) - put_releasing_dquots(dquot); - atomic_dec(&dquot->dq_count); - spin_unlock(&dq_list_lock); -- queue_delayed_work(system_unbound_wq, "a_release_work, 1); -+ queue_delayed_work(quota_unbound_wq, "a_release_work, 1); - } - EXPORT_SYMBOL(dqput); - -@@ -3047,6 +3049,11 @@ static int __init dquot_init(void) - if (register_shrinker(&dqcache_shrinker, "dquota-cache")) - panic("Cannot register dquot shrinker"); - -+ quota_unbound_wq = alloc_workqueue("quota_events_unbound", -+ WQ_UNBOUND | WQ_MEM_RECLAIM, WQ_MAX_ACTIVE); -+ if (!quota_unbound_wq) -+ panic("Cannot create quota_unbound_wq\n"); -+ - return 0; - } - fs_initcall(dquot_init); -diff --git a/fs/quota/quota_v1.c b/fs/quota/quota_v1.c -index a0db3f195e9511..8aaf4a501fc0d9 100644 ---- a/fs/quota/quota_v1.c -+++ b/fs/quota/quota_v1.c -@@ -229,7 +229,8 @@ static struct quota_format_type v1_quota_format = { - - static int __init init_v1_quota_format(void) - { -- return register_quota_format(&v1_quota_format); -+ register_quota_format(&v1_quota_format); -+ return 0; - } - - static void __exit exit_v1_quota_format(void) -diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c -index 7978ab671e0c6a..d73f4432927719 100644 ---- a/fs/quota/quota_v2.c -+++ b/fs/quota/quota_v2.c -@@ -422,12 +422,9 @@ static struct quota_format_type v2r1_quota_format = { - - static int __init init_v2_quota_format(void) - { -- int ret; -- -- ret = register_quota_format(&v2r0_quota_format); -- if (ret) -- return ret; -- return register_quota_format(&v2r1_quota_format); -+ register_quota_format(&v2r0_quota_format); -+ register_quota_format(&v2r1_quota_format); -+ return 0; - } - - static void __exit exit_v2_quota_format(void) -diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c -index 6c16c4f34d8824..e55852aa49f919 100644 ---- a/fs/smb/client/inode.c -+++ b/fs/smb/client/inode.c -@@ -2319,8 +2319,10 @@ cifs_do_rename(const unsigned int xid, struct dentry *from_dentry, - tcon = tlink_tcon(tlink); - server = tcon->ses->server; - -- if (!server->ops->rename) -- return -ENOSYS; -+ if (!server->ops->rename) { -+ rc = -ENOSYS; -+ goto do_rename_exit; -+ } - - /* try path-based rename first */ - rc = server->ops->rename(xid, tcon, from_dentry, -diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c -index ad77952f6d810b..9b5aeafe220bd9 100644 ---- a/fs/smb/client/misc.c -+++ b/fs/smb/client/misc.c -@@ -922,6 +922,14 @@ parse_dfs_referrals(struct get_dfs_referral_rsp *rsp, u32 rsp_size, - char *data_end; - struct dfs_referral_level_3 *ref; - -+ if (rsp_size < sizeof(*rsp)) { -+ cifs_dbg(VFS | ONCE, -+ "%s: header is malformed (size is %u, must be %zu)\n", -+ __func__, rsp_size, sizeof(*rsp)); -+ rc = -EINVAL; -+ goto parse_DFS_referrals_exit; -+ } -+ - *num_of_nodes = le16_to_cpu(rsp->NumberOfReferrals); - - if (*num_of_nodes < 1) { -@@ -931,6 +939,15 @@ parse_dfs_referrals(struct get_dfs_referral_rsp *rsp, u32 rsp_size, - goto parse_DFS_referrals_exit; - } - -+ if (sizeof(*rsp) + *num_of_nodes * sizeof(REFERRAL3) > rsp_size) { -+ cifs_dbg(VFS | ONCE, -+ "%s: malformed buffer (size is %u, must be at least %zu)\n", -+ __func__, rsp_size, -+ sizeof(*rsp) + *num_of_nodes * sizeof(REFERRAL3)); -+ rc = -EINVAL; -+ goto parse_DFS_referrals_exit; -+ } -+ - ref = (struct dfs_referral_level_3 *) &(rsp->referrals); - if (ref->VersionNumber != cpu_to_le16(3)) { - cifs_dbg(VFS, "Referrals of V%d version are not supported, should be V3\n", -diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c -index ee6a6ba13f89c8..b02114b734dcdb 100644 ---- a/fs/smb/client/smb2ops.c -+++ b/fs/smb/client/smb2ops.c -@@ -3072,8 +3072,7 @@ get_smb2_acl_by_path(struct cifs_sb_info *cifs_sb, - utf16_path = cifs_convert_path_to_utf16(path, cifs_sb); - if (!utf16_path) { - rc = -ENOMEM; -- free_xid(xid); -- return ERR_PTR(rc); -+ goto put_tlink; - } - - oparms = (struct cifs_open_parms) { -@@ -3105,6 +3104,7 @@ get_smb2_acl_by_path(struct cifs_sb_info *cifs_sb, - SMB2_close(xid, tcon, fid.persistent_fid, fid.volatile_fid); - } - -+put_tlink: - cifs_put_tlink(tlink); - free_xid(xid); - -@@ -3145,8 +3145,7 @@ set_smb2_acl(struct smb_ntsd *pnntsd, __u32 acllen, - utf16_path = cifs_convert_path_to_utf16(path, cifs_sb); - if (!utf16_path) { - rc = -ENOMEM; -- free_xid(xid); -- return rc; -+ goto put_tlink; - } - - oparms = (struct cifs_open_parms) { -@@ -3167,6 +3166,7 @@ set_smb2_acl(struct smb_ntsd *pnntsd, __u32 acllen, - SMB2_close(xid, tcon, fid.persistent_fid, fid.volatile_fid); - } - -+put_tlink: - cifs_put_tlink(tlink); - free_xid(xid); - return rc; -diff --git a/fs/smb/server/ksmbd_netlink.h b/fs/smb/server/ksmbd_netlink.h -index c6c1844d444822..363501fc308aa3 100644 ---- a/fs/smb/server/ksmbd_netlink.h -+++ b/fs/smb/server/ksmbd_netlink.h -@@ -108,8 +108,9 @@ struct ksmbd_startup_request { - __u32 smb2_max_credits; /* MAX credits */ - __u32 smbd_max_io_size; /* smbd read write size */ - __u32 max_connections; /* Number of maximum simultaneous connections */ -+ __s8 bind_interfaces_only; - __u32 max_ip_connections; /* Number of maximum connection per ip address */ -- __u32 reserved[125]; /* Reserved room */ -+ __s8 reserved[499]; /* Reserved room */ - __u32 ifc_list_sz; /* interfaces list size */ - __s8 ____payload[]; - } __packed; -diff --git a/fs/smb/server/server.h b/fs/smb/server/server.h -index d0744498ceed66..48bd203abb441f 100644 ---- a/fs/smb/server/server.h -+++ b/fs/smb/server/server.h -@@ -46,6 +46,7 @@ struct ksmbd_server_config { - unsigned int max_ip_connections; - - char *conf[SERVER_CONF_WORK_GROUP + 1]; -+ bool bind_interfaces_only; - }; - - extern struct ksmbd_server_config server_conf; -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index 93c31feab3564c..9a58c5a6f9866f 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -38,6 +38,7 @@ - #include "mgmt/user_session.h" - #include "mgmt/ksmbd_ida.h" - #include "ndr.h" -+#include "transport_tcp.h" - - static void __wbuf(struct ksmbd_work *work, void **req, void **rsp) - { -@@ -7790,6 +7791,9 @@ static int fsctl_query_iface_info_ioctl(struct ksmbd_conn *conn, - if (netdev->type == ARPHRD_LOOPBACK) - continue; - -+ if (!ksmbd_find_netdev_name_iface_list(netdev->name)) -+ continue; -+ - flags = dev_get_flags(netdev); - if (!(flags & IFF_RUNNING)) - continue; -diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c -index 80581a7bc1bcc7..354f7144c59049 100644 ---- a/fs/smb/server/transport_ipc.c -+++ b/fs/smb/server/transport_ipc.c -@@ -327,6 +327,7 @@ static int ipc_server_config_on_startup(struct ksmbd_startup_request *req) - ret = ksmbd_set_netbios_name(req->netbios_name); - ret |= ksmbd_set_server_string(req->server_string); - ret |= ksmbd_set_work_group(req->work_group); -+ server_conf.bind_interfaces_only = req->bind_interfaces_only; - ret |= ksmbd_tcp_set_interfaces(KSMBD_STARTUP_CONFIG_INTERFACES(req), - req->ifc_list_sz); - out: -diff --git a/fs/smb/server/transport_tcp.c b/fs/smb/server/transport_tcp.c -index c43a465114289b..665d21d40e7a17 100644 ---- a/fs/smb/server/transport_tcp.c -+++ b/fs/smb/server/transport_tcp.c -@@ -551,30 +551,37 @@ static int create_socket(struct interface *iface) - return ret; - } - -+struct interface *ksmbd_find_netdev_name_iface_list(char *netdev_name) -+{ -+ struct interface *iface; -+ -+ list_for_each_entry(iface, &iface_list, entry) -+ if (!strcmp(iface->name, netdev_name)) -+ return iface; -+ return NULL; -+} -+ - static int ksmbd_netdev_event(struct notifier_block *nb, unsigned long event, - void *ptr) - { - struct net_device *netdev = netdev_notifier_info_to_dev(ptr); - struct interface *iface; -- int ret, found = 0; -+ int ret; - - switch (event) { - case NETDEV_UP: - if (netif_is_bridge_port(netdev)) - return NOTIFY_OK; - -- list_for_each_entry(iface, &iface_list, entry) { -- if (!strcmp(iface->name, netdev->name)) { -- found = 1; -- if (iface->state != IFACE_STATE_DOWN) -- break; -- ret = create_socket(iface); -- if (ret) -- return NOTIFY_OK; -- break; -- } -+ iface = ksmbd_find_netdev_name_iface_list(netdev->name); -+ if (iface && iface->state == IFACE_STATE_DOWN) { -+ ksmbd_debug(CONN, "netdev-up event: netdev(%s) is going up\n", -+ iface->name); -+ ret = create_socket(iface); -+ if (ret) -+ return NOTIFY_OK; - } -- if (!found && bind_additional_ifaces) { -+ if (!iface && bind_additional_ifaces) { - iface = alloc_iface(kstrdup(netdev->name, GFP_KERNEL)); - if (!iface) - return NOTIFY_OK; -@@ -584,19 +591,19 @@ static int ksmbd_netdev_event(struct notifier_block *nb, unsigned long event, - } - break; - case NETDEV_DOWN: -- list_for_each_entry(iface, &iface_list, entry) { -- if (!strcmp(iface->name, netdev->name) && -- iface->state == IFACE_STATE_CONFIGURED) { -- tcp_stop_kthread(iface->ksmbd_kthread); -- iface->ksmbd_kthread = NULL; -- mutex_lock(&iface->sock_release_lock); -- tcp_destroy_socket(iface->ksmbd_socket); -- iface->ksmbd_socket = NULL; -- mutex_unlock(&iface->sock_release_lock); -- -- iface->state = IFACE_STATE_DOWN; -- break; -- } -+ iface = ksmbd_find_netdev_name_iface_list(netdev->name); -+ if (iface && iface->state == IFACE_STATE_CONFIGURED) { -+ ksmbd_debug(CONN, "netdev-down event: netdev(%s) is going down\n", -+ iface->name); -+ tcp_stop_kthread(iface->ksmbd_kthread); -+ iface->ksmbd_kthread = NULL; -+ mutex_lock(&iface->sock_release_lock); -+ tcp_destroy_socket(iface->ksmbd_socket); -+ iface->ksmbd_socket = NULL; -+ mutex_unlock(&iface->sock_release_lock); -+ -+ iface->state = IFACE_STATE_DOWN; -+ break; - } - break; - } -@@ -665,18 +672,6 @@ int ksmbd_tcp_set_interfaces(char *ifc_list, int ifc_list_sz) - int sz = 0; - - if (!ifc_list_sz) { -- struct net_device *netdev; -- -- rtnl_lock(); -- for_each_netdev(&init_net, netdev) { -- if (netif_is_bridge_port(netdev)) -- continue; -- if (!alloc_iface(kstrdup(netdev->name, GFP_KERNEL))) { -- rtnl_unlock(); -- return -ENOMEM; -- } -- } -- rtnl_unlock(); - bind_additional_ifaces = 1; - return 0; - } -diff --git a/fs/smb/server/transport_tcp.h b/fs/smb/server/transport_tcp.h -index 5925ec5df47552..bf6a3d71f7a040 100644 ---- a/fs/smb/server/transport_tcp.h -+++ b/fs/smb/server/transport_tcp.h -@@ -8,6 +8,7 @@ - - int ksmbd_tcp_set_interfaces(char *ifc_list, int ifc_list_sz); - void ksmbd_free_transport(struct ksmbd_transport *kt); -+struct interface *ksmbd_find_netdev_name_iface_list(char *netdev_name); - int ksmbd_tcp_init(void); - void ksmbd_tcp_destroy(void); - -diff --git a/fs/xfs/libxfs/xfs_log_format.h b/fs/xfs/libxfs/xfs_log_format.h -index 269573c828085f..e267fc9d3108f4 100644 ---- a/fs/xfs/libxfs/xfs_log_format.h -+++ b/fs/xfs/libxfs/xfs_log_format.h -@@ -171,12 +171,40 @@ typedef struct xlog_rec_header { - __be32 h_prev_block; /* block number to previous LR : 4 */ - __be32 h_num_logops; /* number of log operations in this LR : 4 */ - __be32 h_cycle_data[XLOG_HEADER_CYCLE_SIZE / BBSIZE]; -- /* new fields */ -+ -+ /* fields added by the Linux port: */ - __be32 h_fmt; /* format of log record : 4 */ - uuid_t h_fs_uuid; /* uuid of FS : 16 */ -+ -+ /* fields added for log v2: */ - __be32 h_size; /* iclog size : 4 */ -+ -+ /* -+ * When h_size added for log v2 support, it caused structure to have -+ * a different size on i386 vs all other architectures because the -+ * sum of the size ofthe member is not aligned by that of the largest -+ * __be64-sized member, and i386 has really odd struct alignment rules. -+ * -+ * Due to the way the log headers are placed out on-disk that alone is -+ * not a problem becaue the xlog_rec_header always sits alone in a -+ * BBSIZEs area, and the rest of that area is padded with zeroes. -+ * But xlog_cksum used to calculate the checksum based on the structure -+ * size, and thus gives different checksums for i386 vs the rest. -+ * We now do two checksum validation passes for both sizes to allow -+ * moving v5 file systems with unclean logs between i386 and other -+ * (little-endian) architectures. -+ */ -+ __u32 h_pad0; - } xlog_rec_header_t; - -+#ifdef __i386__ -+#define XLOG_REC_SIZE offsetofend(struct xlog_rec_header, h_size) -+#define XLOG_REC_SIZE_OTHER sizeof(struct xlog_rec_header) -+#else -+#define XLOG_REC_SIZE sizeof(struct xlog_rec_header) -+#define XLOG_REC_SIZE_OTHER offsetofend(struct xlog_rec_header, h_size) -+#endif /* __i386__ */ -+ - typedef struct xlog_rec_ext_header { - __be32 xh_cycle; /* write cycle of log : 4 */ - __be32 xh_cycle_data[XLOG_HEADER_CYCLE_SIZE / BBSIZE]; /* : 256 */ -diff --git a/fs/xfs/scrub/reap.c b/fs/xfs/scrub/reap.c -index 822f5adf7f7cc9..b968f7bc202cfd 100644 ---- a/fs/xfs/scrub/reap.c -+++ b/fs/xfs/scrub/reap.c -@@ -20,6 +20,7 @@ - #include "xfs_ialloc_btree.h" - #include "xfs_rmap.h" - #include "xfs_rmap_btree.h" -+#include "xfs_refcount.h" - #include "xfs_refcount_btree.h" - #include "xfs_extent_busy.h" - #include "xfs_ag.h" -@@ -376,9 +377,21 @@ xreap_agextent_iter( - if (crosslinked) { - trace_xreap_dispose_unmap_extent(sc->sa.pag, agbno, *aglenp); - -- rs->force_roll = true; -- return xfs_rmap_free(sc->tp, sc->sa.agf_bp, sc->sa.pag, agbno, -- *aglenp, rs->oinfo); -+ if (rs->oinfo == &XFS_RMAP_OINFO_COW) { -+ /* -+ * If we're unmapping CoW staging extents, remove the -+ * records from the refcountbt, which will remove the -+ * rmap record as well. -+ */ -+ xfs_refcount_free_cow_extent(sc->tp, fsbno, *aglenp); -+ rs->force_roll = true; -+ return 0; -+ } -+ -+ xfs_rmap_free_extent(sc->tp, sc->sa.pag->pag_agno, agbno, -+ *aglenp, rs->oinfo->oi_owner); -+ rs->deferred++; -+ return 0; - } - - trace_xreap_dispose_free_extent(sc->sa.pag, agbno, *aglenp); -diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c -index a1650fc81382f9..d03976b8218027 100644 ---- a/fs/xfs/xfs_log.c -+++ b/fs/xfs/xfs_log.c -@@ -1807,13 +1807,13 @@ xlog_cksum( - struct xlog *log, - struct xlog_rec_header *rhead, - char *dp, -- int size) -+ unsigned int hdrsize, -+ unsigned int size) - { - uint32_t crc; - - /* first generate the crc for the record header ... */ -- crc = xfs_start_cksum_update((char *)rhead, -- sizeof(struct xlog_rec_header), -+ crc = xfs_start_cksum_update((char *)rhead, hdrsize, - offsetof(struct xlog_rec_header, h_crc)); - - /* ... then for additional cycle data for v2 logs ... */ -@@ -2077,7 +2077,7 @@ xlog_sync( - - /* calculcate the checksum */ - iclog->ic_header.h_crc = xlog_cksum(log, &iclog->ic_header, -- iclog->ic_datap, size); -+ iclog->ic_datap, XLOG_REC_SIZE, size); - /* - * Intentionally corrupt the log record CRC based on the error injection - * frequency, if defined. This facilitates testing log recovery in the -diff --git a/fs/xfs/xfs_log_priv.h b/fs/xfs/xfs_log_priv.h -index e30c06ec20e33b..a183bfb36470ad 100644 ---- a/fs/xfs/xfs_log_priv.h -+++ b/fs/xfs/xfs_log_priv.h -@@ -503,8 +503,8 @@ xlog_recover_finish( - extern void - xlog_recover_cancel(struct xlog *); - --extern __le32 xlog_cksum(struct xlog *log, struct xlog_rec_header *rhead, -- char *dp, int size); -+__le32 xlog_cksum(struct xlog *log, struct xlog_rec_header *rhead, -+ char *dp, unsigned int hdrsize, unsigned int size); - - extern struct kmem_cache *xfs_log_ticket_cache; - struct xlog_ticket *xlog_ticket_alloc(struct xlog *log, int unit_bytes, -diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c -index 60382eb4996105..f708bf4104b1a3 100644 ---- a/fs/xfs/xfs_log_recover.c -+++ b/fs/xfs/xfs_log_recover.c -@@ -2860,20 +2860,34 @@ xlog_recover_process( - int pass, - struct list_head *buffer_list) - { -- __le32 old_crc = rhead->h_crc; -- __le32 crc; -+ __le32 expected_crc = rhead->h_crc, crc, other_crc; - -- crc = xlog_cksum(log, rhead, dp, be32_to_cpu(rhead->h_len)); -+ crc = xlog_cksum(log, rhead, dp, XLOG_REC_SIZE, -+ be32_to_cpu(rhead->h_len)); -+ -+ /* -+ * Look at the end of the struct xlog_rec_header definition in -+ * xfs_log_format.h for the glory details. -+ */ -+ if (expected_crc && crc != expected_crc) { -+ other_crc = xlog_cksum(log, rhead, dp, XLOG_REC_SIZE_OTHER, -+ be32_to_cpu(rhead->h_len)); -+ if (other_crc == expected_crc) { -+ xfs_notice_once(log->l_mp, -+ "Fixing up incorrect CRC due to padding."); -+ crc = other_crc; -+ } -+ } - - /* - * Nothing else to do if this is a CRC verification pass. Just return - * if this a record with a non-zero crc. Unfortunately, mkfs always -- * sets old_crc to 0 so we must consider this valid even on v5 supers. -- * Otherwise, return EFSBADCRC on failure so the callers up the stack -- * know precisely what failed. -+ * sets expected_crc to 0 so we must consider this valid even on v5 -+ * supers. Otherwise, return EFSBADCRC on failure so the callers up the -+ * stack know precisely what failed. - */ - if (pass == XLOG_RECOVER_CRCPASS) { -- if (old_crc && crc != old_crc) -+ if (expected_crc && crc != expected_crc) - return -EFSBADCRC; - return 0; - } -@@ -2884,11 +2898,11 @@ xlog_recover_process( - * zero CRC check prevents warnings from being emitted when upgrading - * the kernel from one that does not add CRCs by default. - */ -- if (crc != old_crc) { -- if (old_crc || xfs_has_crc(log->l_mp)) { -+ if (crc != expected_crc) { -+ if (expected_crc || xfs_has_crc(log->l_mp)) { - xfs_alert(log->l_mp, - "log record CRC mismatch: found 0x%x, expected 0x%x.", -- le32_to_cpu(old_crc), -+ le32_to_cpu(expected_crc), - le32_to_cpu(crc)); - xfs_hex_dump(dp, 32); - } -diff --git a/fs/xfs/xfs_ondisk.h b/fs/xfs/xfs_ondisk.h -index c4cc99b70dd303..618bf4f03f280f 100644 ---- a/fs/xfs/xfs_ondisk.h -+++ b/fs/xfs/xfs_ondisk.h -@@ -143,6 +143,8 @@ xfs_check_ondisk_structs(void) - XFS_CHECK_STRUCT_SIZE(struct xfs_rud_log_format, 16); - XFS_CHECK_STRUCT_SIZE(struct xfs_map_extent, 32); - XFS_CHECK_STRUCT_SIZE(struct xfs_phys_extent, 16); -+ XFS_CHECK_STRUCT_SIZE(struct xlog_rec_header, 328); -+ XFS_CHECK_STRUCT_SIZE(struct xlog_rec_ext_header, 260); - - XFS_CHECK_OFFSET(struct xfs_bui_log_format, bui_extents, 16); - XFS_CHECK_OFFSET(struct xfs_cui_log_format, cui_extents, 16); -diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h -index bfecd9dcb55297..1f94fe8559a9a8 100644 ---- a/include/linux/cpufreq.h -+++ b/include/linux/cpufreq.h -@@ -32,6 +32,9 @@ - */ - - #define CPUFREQ_ETERNAL (-1) -+ -+#define CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS NSEC_PER_MSEC -+ - #define CPUFREQ_NAME_LEN 16 - /* Print length for names. Extra 1 space for accommodating '\n' in prints */ - #define CPUFREQ_NAME_PLEN (CPUFREQ_NAME_LEN + 1) -diff --git a/include/linux/mm.h b/include/linux/mm.h -index ba77f08900ca2e..fa5b11452ae627 100644 ---- a/include/linux/mm.h -+++ b/include/linux/mm.h -@@ -315,7 +315,7 @@ extern unsigned int kobjsize(const void *objp); - #define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */ - #define VM_HUGEPAGE 0x20000000 /* MADV_HUGEPAGE marked this vma */ - #define VM_NOHUGEPAGE 0x40000000 /* MADV_NOHUGEPAGE marked this vma */ --#define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */ -+#define VM_MERGEABLE BIT(31) /* KSM may merge identical pages */ - - #ifdef CONFIG_ARCH_USES_HIGH_VMA_FLAGS - #define VM_HIGH_ARCH_BIT_0 32 /* bit only usable on 64-bit architectures */ -diff --git a/include/linux/pci.h b/include/linux/pci.h -index 0511f6f9a4e6ad..e4338237a05454 100644 ---- a/include/linux/pci.h -+++ b/include/linux/pci.h -@@ -1034,6 +1034,20 @@ static inline struct pci_driver *to_pci_driver(struct device_driver *drv) - .vendor = PCI_VENDOR_ID_##vend, .device = (dev), \ - .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID, 0, 0 - -+/** -+ * PCI_VDEVICE_SUB - describe a specific PCI device/subdevice in a short form -+ * @vend: the vendor name -+ * @dev: the 16 bit PCI Device ID -+ * @subvend: the 16 bit PCI Subvendor ID -+ * @subdev: the 16 bit PCI Subdevice ID -+ * -+ * Generate the pci_device_id struct layout for the specific PCI -+ * device/subdevice. Private data may follow the output. -+ */ -+#define PCI_VDEVICE_SUB(vend, dev, subvend, subdev) \ -+ .vendor = PCI_VENDOR_ID_##vend, .device = (dev), \ -+ .subvendor = (subvend), .subdevice = (subdev), 0, 0 -+ - /** - * PCI_DEVICE_DATA - macro used to describe a specific PCI device in very short form - * @vend: the vendor name (without PCI_VENDOR_ID_ prefix) -diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h -index 4b74f0f012a59f..c3a462ff1206e7 100644 ---- a/include/linux/pm_runtime.h -+++ b/include/linux/pm_runtime.h -@@ -94,7 +94,9 @@ extern void pm_runtime_new_link(struct device *dev); - extern void pm_runtime_drop_link(struct device_link *link); - extern void pm_runtime_release_supplier(struct device_link *link); - -+int devm_pm_runtime_set_active_enabled(struct device *dev); - extern int devm_pm_runtime_enable(struct device *dev); -+int devm_pm_runtime_get_noresume(struct device *dev); - - /** - * pm_suspend_ignore_children - Set runtime PM behavior regarding children. -@@ -278,7 +280,9 @@ static inline void __pm_runtime_disable(struct device *dev, bool c) {} - static inline void pm_runtime_allow(struct device *dev) {} - static inline void pm_runtime_forbid(struct device *dev) {} - -+static inline int devm_pm_runtime_set_active_enabled(struct device *dev) { return 0; } - static inline int devm_pm_runtime_enable(struct device *dev) { return 0; } -+static inline int devm_pm_runtime_get_noresume(struct device *dev) { return 0; } - - static inline void pm_suspend_ignore_children(struct device *dev, bool enable) {} - static inline void pm_runtime_get_noresume(struct device *dev) {} -diff --git a/include/linux/quota.h b/include/linux/quota.h -index 07071e64abf3d6..89a0d83ddad082 100644 ---- a/include/linux/quota.h -+++ b/include/linux/quota.h -@@ -526,7 +526,7 @@ struct quota_info { - const struct quota_format_ops *ops[MAXQUOTAS]; /* Operations for each type */ - }; - --int register_quota_format(struct quota_format_type *fmt); -+void register_quota_format(struct quota_format_type *fmt); - void unregister_quota_format(struct quota_format_type *fmt); - - struct quota_module_name { -diff --git a/include/linux/usb/gadget.h b/include/linux/usb/gadget.h -index 75bda0783395a0..aa831e16c3d39d 100644 ---- a/include/linux/usb/gadget.h -+++ b/include/linux/usb/gadget.h -@@ -15,6 +15,7 @@ - #ifndef __LINUX_USB_GADGET_H - #define __LINUX_USB_GADGET_H - -+#include - #include - #include - #include -@@ -32,6 +33,7 @@ struct usb_ep; - - /** - * struct usb_request - describes one i/o request -+ * @ep: The associated endpoint set by usb_ep_alloc_request(). - * @buf: Buffer used for data. Always provide this; some controllers - * only use PIO, or don't use DMA for some endpoints. - * @dma: DMA address corresponding to 'buf'. If you don't set this -@@ -97,6 +99,7 @@ struct usb_ep; - */ - - struct usb_request { -+ struct usb_ep *ep; - void *buf; - unsigned length; - dma_addr_t dma; -@@ -289,6 +292,28 @@ static inline void usb_ep_fifo_flush(struct usb_ep *ep) - - /*-------------------------------------------------------------------------*/ - -+/** -+ * free_usb_request - frees a usb_request object and its buffer -+ * @req: the request being freed -+ * -+ * This helper function frees both the request's buffer and the request object -+ * itself by calling usb_ep_free_request(). Its signature is designed to be used -+ * with DEFINE_FREE() to enable automatic, scope-based cleanup for usb_request -+ * pointers. -+ */ -+static inline void free_usb_request(struct usb_request *req) -+{ -+ if (!req) -+ return; -+ -+ kfree(req->buf); -+ usb_ep_free_request(req->ep, req); -+} -+ -+DEFINE_FREE(free_usb_request, struct usb_request *, free_usb_request(_T)) -+ -+/*-------------------------------------------------------------------------*/ -+ - struct usb_dcd_config_params { - __u8 bU1devExitLat; /* U1 Device exit Latency */ - #define USB_DEFAULT_U1_DEV_EXIT_LAT 0x01 /* Less then 1 microsec */ -diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h -index 006a61ddd36fa4..3d36794cb1899a 100644 ---- a/include/net/ip_tunnels.h -+++ b/include/net/ip_tunnels.h -@@ -489,6 +489,21 @@ struct metadata_dst *iptunnel_metadata_reply(struct metadata_dst *md, - int skb_tunnel_check_pmtu(struct sk_buff *skb, struct dst_entry *encap_dst, - int headroom, bool reply); - -+static inline void ip_tunnel_adj_headroom(struct net_device *dev, -+ unsigned int headroom) -+{ -+ /* we must cap headroom to some upperlimit, else pskb_expand_head -+ * will overflow header offsets in skb_headers_offset_update(). -+ */ -+ const unsigned int max_allowed = 512; -+ -+ if (headroom > max_allowed) -+ headroom = max_allowed; -+ -+ if (headroom > READ_ONCE(dev->needed_headroom)) -+ WRITE_ONCE(dev->needed_headroom, headroom); -+} -+ - int iptunnel_handle_offloads(struct sk_buff *skb, int gso_type_mask); - - static inline int iptunnel_pull_offloads(struct sk_buff *skb) -diff --git a/kernel/padata.c b/kernel/padata.c -index 93cd7704ab63e6..9260ab0b39eb5d 100644 ---- a/kernel/padata.c -+++ b/kernel/padata.c -@@ -290,7 +290,11 @@ static struct padata_priv *padata_find_next(struct parallel_data *pd, - if (remove_object) { - list_del_init(&padata->list); - ++pd->processed; -- pd->cpu = cpumask_next_wrap(cpu, pd->cpumask.pcpu, -1, false); -+ /* When sequence wraps around, reset to the first CPU. */ -+ if (unlikely(pd->processed == 0)) -+ pd->cpu = cpumask_first(pd->cpumask.pcpu); -+ else -+ pd->cpu = cpumask_next_wrap(cpu, pd->cpumask.pcpu, -1, false); - } - - spin_unlock(&reorder->lock); -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 1cf43e91ae9de8..58231999d929ea 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -4829,7 +4829,7 @@ static inline unsigned long cfs_rq_load_avg(struct cfs_rq *cfs_rq) - return cfs_rq->avg.load_avg; - } - --static int newidle_balance(struct rq *this_rq, struct rq_flags *rf); -+static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf); - - static inline unsigned long task_util(struct task_struct *p) - { -@@ -5158,7 +5158,7 @@ attach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {} - static inline void - detach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {} - --static inline int newidle_balance(struct rq *rq, struct rq_flags *rf) -+static inline int sched_balance_newidle(struct rq *rq, struct rq_flags *rf) - { - return 0; - } -@@ -8281,7 +8281,7 @@ balance_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf) - if (rq->nr_running) - return 1; - -- return newidle_balance(rq, rf) != 0; -+ return sched_balance_newidle(rq, rf) != 0; - } - #endif /* CONFIG_SMP */ - -@@ -8528,21 +8528,21 @@ done: __maybe_unused; - return p; - - idle: -- if (!rf) -- return NULL; -- -- new_tasks = newidle_balance(rq, rf); -+ if (rf) { -+ new_tasks = sched_balance_newidle(rq, rf); - -- /* -- * Because newidle_balance() releases (and re-acquires) rq->lock, it is -- * possible for any higher priority task to appear. In that case we -- * must re-start the pick_next_entity() loop. -- */ -- if (new_tasks < 0) -- return RETRY_TASK; -+ /* -+ * Because sched_balance_newidle() releases (and re-acquires) -+ * rq->lock, it is possible for any higher priority task to -+ * appear. In that case we must re-start the pick_next_entity() -+ * loop. -+ */ -+ if (new_tasks < 0) -+ return RETRY_TASK; - -- if (new_tasks > 0) -- goto again; -+ if (new_tasks > 0) -+ goto again; -+ } - - /* - * rq is about to be idle, check if we need to update the -@@ -11542,7 +11542,7 @@ static int load_balance(int this_cpu, struct rq *this_rq, - ld_moved = 0; - - /* -- * newidle_balance() disregards balance intervals, so we could -+ * sched_balance_newidle() disregards balance intervals, so we could - * repeatedly reach this code, which would lead to balance_interval - * skyrocketing in a short amount of time. Skip the balance_interval - * increase logic to avoid that. -@@ -12308,7 +12308,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { } - #endif /* CONFIG_NO_HZ_COMMON */ - - /* -- * newidle_balance is called by schedule() if this_cpu is about to become -+ * sched_balance_newidle is called by schedule() if this_cpu is about to become - * idle. Attempts to pull tasks from other CPUs. - * - * Returns: -@@ -12316,7 +12316,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { } - * 0 - failed, no new tasks - * > 0 - success, new (fair) tasks present - */ --static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) -+static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf) - { - unsigned long next_balance = jiffies + HZ; - int this_cpu = this_rq->cpu; -diff --git a/mm/shmem.c b/mm/shmem.c -index ecf1011cc3e296..2260def68090c7 100644 ---- a/mm/shmem.c -+++ b/mm/shmem.c -@@ -4617,11 +4617,7 @@ void __init shmem_init(void) - shmem_init_inodecache(); - - #ifdef CONFIG_TMPFS_QUOTA -- error = register_quota_format(&shmem_quota_format); -- if (error < 0) { -- pr_err("Could not register quota format\n"); -- goto out3; -- } -+ register_quota_format(&shmem_quota_format); - #endif - - error = register_filesystem(&shmem_fs_type); -@@ -4650,7 +4646,6 @@ void __init shmem_init(void) - out2: - #ifdef CONFIG_TMPFS_QUOTA - unregister_quota_format(&shmem_quota_format); --out3: - #endif - shmem_destroy_inodecache(); - shm_mnt = ERR_PTR(error); -diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c -index b5d64cd3ab0a23..090403c8cc6c3d 100644 ---- a/net/ipv4/ip_tunnel.c -+++ b/net/ipv4/ip_tunnel.c -@@ -567,20 +567,6 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, - return 0; - } - --static void ip_tunnel_adj_headroom(struct net_device *dev, unsigned int headroom) --{ -- /* we must cap headroom to some upperlimit, else pskb_expand_head -- * will overflow header offsets in skb_headers_offset_update(). -- */ -- static const unsigned int max_allowed = 512; -- -- if (headroom > max_allowed) -- headroom = max_allowed; -- -- if (headroom > READ_ONCE(dev->needed_headroom)) -- WRITE_ONCE(dev->needed_headroom, headroom); --} -- - void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, - u8 proto, int tunnel_hlen) - { -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index 560273e7f77365..88551db62ca29d 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -2189,7 +2189,8 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, - u32 max_segs) - { - const struct inet_connection_sock *icsk = inet_csk(sk); -- u32 send_win, cong_win, limit, in_flight; -+ u32 send_win, cong_win, limit, in_flight, threshold; -+ u64 srtt_in_ns, expected_ack, how_far_is_the_ack; - struct tcp_sock *tp = tcp_sk(sk); - struct sk_buff *head; - int win_divisor; -@@ -2251,9 +2252,19 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, - head = tcp_rtx_queue_head(sk); - if (!head) - goto send_now; -- delta = tp->tcp_clock_cache - head->tstamp; -- /* If next ACK is likely to come too late (half srtt), do not defer */ -- if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0) -+ -+ srtt_in_ns = (u64)(NSEC_PER_USEC >> 3) * tp->srtt_us; -+ /* When is the ACK expected ? */ -+ expected_ack = head->tstamp + srtt_in_ns; -+ /* How far from now is the ACK expected ? */ -+ how_far_is_the_ack = expected_ack - tp->tcp_clock_cache; -+ -+ /* If next ACK is likely to come too late, -+ * ie in more than min(1ms, half srtt), do not defer. -+ */ -+ threshold = min(srtt_in_ns >> 1, NSEC_PER_MSEC); -+ -+ if ((s64)(how_far_is_the_ack - threshold) > 0) - goto send_now; - - /* Ok, it looks like it is advisable to defer. -diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index d645d022ce7745..e635ddd41aba6c 100644 ---- a/net/ipv6/ip6_tunnel.c -+++ b/net/ipv6/ip6_tunnel.c -@@ -1255,8 +1255,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, - */ - max_headroom = LL_RESERVED_SPACE(dst->dev) + sizeof(struct ipv6hdr) - + dst->header_len + t->hlen; -- if (max_headroom > READ_ONCE(dev->needed_headroom)) -- WRITE_ONCE(dev->needed_headroom, max_headroom); -+ ip_tunnel_adj_headroom(dev, max_headroom); - - err = ip6_tnl_encap(skb, t, &proto, fl6); - if (err) -diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c -index d7dea82bcf5653..c7ee44bd320649 100644 ---- a/net/tls/tls_main.c -+++ b/net/tls/tls_main.c -@@ -254,12 +254,9 @@ int tls_process_cmsg(struct sock *sk, struct msghdr *msg, - if (msg->msg_flags & MSG_MORE) - return -EINVAL; - -- rc = tls_handle_open_record(sk, msg->msg_flags); -- if (rc) -- return rc; -- - *record_type = *(unsigned char *)CMSG_DATA(cmsg); -- rc = 0; -+ -+ rc = tls_handle_open_record(sk, msg->msg_flags); - break; - default: - return -EINVAL; -diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c -index 435235a351e2f4..410e39e4b79fd2 100644 ---- a/net/tls/tls_sw.c -+++ b/net/tls/tls_sw.c -@@ -1054,7 +1054,7 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, - if (ret == -EINPROGRESS) - num_async++; - else if (ret != -EAGAIN) -- goto send_end; -+ goto end; - } - } - -@@ -1112,8 +1112,11 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, - goto send_end; - tls_ctx->pending_open_record_frags = true; - -- if (sk_msg_full(msg_pl)) -+ if (sk_msg_full(msg_pl)) { - full_record = true; -+ sk_msg_trim(sk, msg_en, -+ msg_pl->sg.size + prot->overhead_size); -+ } - - if (full_record || eor) - goto copied; -@@ -1149,6 +1152,13 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, - } else if (ret != -EAGAIN) - goto send_end; - } -+ -+ /* Transmit if any encryptions have completed */ -+ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) { -+ cancel_delayed_work(&ctx->tx_work.work); -+ tls_tx_records(sk, msg->msg_flags); -+ } -+ - continue; - rollback_iter: - copied -= try_to_copy; -@@ -1204,6 +1214,12 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, - goto send_end; - } - } -+ -+ /* Transmit if any encryptions have completed */ -+ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) { -+ cancel_delayed_work(&ctx->tx_work.work); -+ tls_tx_records(sk, msg->msg_flags); -+ } - } - - continue; -@@ -1223,9 +1239,10 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, - goto alloc_encrypted; - } - -+send_end: - if (!num_async) { -- goto send_end; -- } else if (num_zc) { -+ goto end; -+ } else if (num_zc || eor) { - int err; - - /* Wait for pending encryptions to get completed */ -@@ -1242,7 +1259,7 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, - tls_tx_records(sk, msg->msg_flags); - } - --send_end: -+end: - ret = sk_stream_error(sk, msg->msg_flags, ret); - return copied > 0 ? copied : ret; - } -@@ -1633,8 +1650,10 @@ static int tls_decrypt_sg(struct sock *sk, struct iov_iter *out_iov, - - if (unlikely(darg->async)) { - err = tls_strp_msg_hold(&ctx->strp, &ctx->async_hold); -- if (err) -- __skb_queue_tail(&ctx->async_hold, darg->skb); -+ if (err) { -+ err = tls_decrypt_async_wait(ctx); -+ darg->async = false; -+ } - return err; - } - -diff --git a/rust/bindings/bindings_helper.h b/rust/bindings/bindings_helper.h -index c91a3c24f6070a..5416f21918e047 100644 ---- a/rust/bindings/bindings_helper.h -+++ b/rust/bindings/bindings_helper.h -@@ -12,8 +12,10 @@ - #include - #include - #include -+#include - - /* `bindgen` gets confused at certain things. */ - const size_t BINDINGS_ARCH_SLAB_MINALIGN = ARCH_SLAB_MINALIGN; - const gfp_t BINDINGS_GFP_KERNEL = GFP_KERNEL; - const gfp_t BINDINGS___GFP_ZERO = __GFP_ZERO; -+const vm_flags_t BINDINGS_VM_MERGEABLE = VM_MERGEABLE; -diff --git a/rust/bindings/lib.rs b/rust/bindings/lib.rs -index 9bcbea04dac305..7d9078b94a8f08 100644 ---- a/rust/bindings/lib.rs -+++ b/rust/bindings/lib.rs -@@ -51,3 +51,4 @@ mod bindings_helper { - - pub const GFP_KERNEL: gfp_t = BINDINGS_GFP_KERNEL; - pub const __GFP_ZERO: gfp_t = BINDINGS___GFP_ZERO; -+pub const VM_MERGEABLE: vm_flags_t = BINDINGS_VM_MERGEABLE; -diff --git a/sound/firewire/amdtp-stream.h b/sound/firewire/amdtp-stream.h -index 775db3fc4959f5..ec10270c2cce3d 100644 ---- a/sound/firewire/amdtp-stream.h -+++ b/sound/firewire/amdtp-stream.h -@@ -32,7 +32,7 @@ - * allows 5 times as large as IEC 61883-6 defines. - * @CIP_HEADER_WITHOUT_EOH: Only for in-stream. CIP Header doesn't include - * valid EOH. -- * @CIP_NO_HEADERS: a lack of headers in packets -+ * @CIP_NO_HEADER: a lack of headers in packets - * @CIP_UNALIGHED_DBC: Only for in-stream. The value of dbc is not alighed to - * the value of current SYT_INTERVAL; e.g. initial value is not zero. - * @CIP_UNAWARE_SYT: For outgoing packet, the value in SYT field of CIP is 0xffff. -diff --git a/sound/soc/codecs/idt821034.c b/sound/soc/codecs/idt821034.c -index 2cc7b9166e695f..068a5448e273ea 100644 ---- a/sound/soc/codecs/idt821034.c -+++ b/sound/soc/codecs/idt821034.c -@@ -548,14 +548,14 @@ static int idt821034_kctrl_mute_put(struct snd_kcontrol *kcontrol, - return ret; - } - --static const DECLARE_TLV_DB_LINEAR(idt821034_gain_in, -6520, 1306); --#define IDT821034_GAIN_IN_MIN_RAW 1 /* -65.20 dB -> 10^(-65.2/20.0) * 1820 = 1 */ --#define IDT821034_GAIN_IN_MAX_RAW 8191 /* 13.06 dB -> 10^(13.06/20.0) * 1820 = 8191 */ -+static const DECLARE_TLV_DB_LINEAR(idt821034_gain_in, -300, 1300); -+#define IDT821034_GAIN_IN_MIN_RAW 1288 /* -3.0 dB -> 10^(-3.0/20.0) * 1820 = 1288 */ -+#define IDT821034_GAIN_IN_MAX_RAW 8130 /* 13.0 dB -> 10^(13.0/20.0) * 1820 = 8130 */ - #define IDT821034_GAIN_IN_INIT_RAW 1820 /* 0dB -> 10^(0/20) * 1820 = 1820 */ - --static const DECLARE_TLV_DB_LINEAR(idt821034_gain_out, -6798, 1029); --#define IDT821034_GAIN_OUT_MIN_RAW 1 /* -67.98 dB -> 10^(-67.98/20.0) * 2506 = 1*/ --#define IDT821034_GAIN_OUT_MAX_RAW 8191 /* 10.29 dB -> 10^(10.29/20.0) * 2506 = 8191 */ -+static const DECLARE_TLV_DB_LINEAR(idt821034_gain_out, -1300, 300); -+#define IDT821034_GAIN_OUT_MIN_RAW 561 /* -13.0 dB -> 10^(-13.0/20.0) * 2506 = 561 */ -+#define IDT821034_GAIN_OUT_MAX_RAW 3540 /* 3.0 dB -> 10^(3.0/20.0) * 2506 = 3540 */ - #define IDT821034_GAIN_OUT_INIT_RAW 2506 /* 0dB -> 10^(0/20) * 2506 = 2506 */ - - static const struct snd_kcontrol_new idt821034_controls[] = { -diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c -index f307374834b557..48ed75c3a7db2b 100644 ---- a/sound/soc/codecs/nau8821.c -+++ b/sound/soc/codecs/nau8821.c -@@ -26,7 +26,8 @@ - #include - #include "nau8821.h" - --#define NAU8821_JD_ACTIVE_HIGH BIT(0) -+#define NAU8821_QUIRK_JD_ACTIVE_HIGH BIT(0) -+#define NAU8821_QUIRK_JD_DB_BYPASS BIT(1) - - static int nau8821_quirk; - static int quirk_override = -1; -@@ -1030,12 +1031,17 @@ static bool nau8821_is_jack_inserted(struct regmap *regmap) - return active_high == is_high; - } - --static void nau8821_int_status_clear_all(struct regmap *regmap) -+static void nau8821_irq_status_clear(struct regmap *regmap, int active_irq) - { -- int active_irq, clear_irq, i; -+ int clear_irq, i; - -- /* Reset the intrruption status from rightmost bit if the corres- -- * ponding irq event occurs. -+ if (active_irq) { -+ regmap_write(regmap, NAU8821_R11_INT_CLR_KEY_STATUS, active_irq); -+ return; -+ } -+ -+ /* Reset the interruption status from rightmost bit if the -+ * corresponding irq event occurs. - */ - regmap_read(regmap, NAU8821_R10_IRQ_STATUS, &active_irq); - for (i = 0; i < NAU8821_REG_DATA_LEN; i++) { -@@ -1062,7 +1068,7 @@ static void nau8821_eject_jack(struct nau8821 *nau8821) - snd_soc_dapm_sync(dapm); - - /* Clear all interruption status */ -- nau8821_int_status_clear_all(regmap); -+ nau8821_irq_status_clear(regmap, 0); - - /* Enable the insertion interruption, disable the ejection inter- - * ruption, and then bypass de-bounce circuit. -@@ -1166,9 +1172,10 @@ static void nau8821_setup_inserted_irq(struct nau8821 *nau8821) - regmap_update_bits(regmap, NAU8821_R1D_I2S_PCM_CTRL2, - NAU8821_I2S_MS_MASK, NAU8821_I2S_MS_SLAVE); - -- /* Not bypass de-bounce circuit */ -- regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL, -- NAU8821_JACK_DET_DB_BYPASS, 0); -+ /* Do not bypass de-bounce circuit */ -+ if (!(nau8821_quirk & NAU8821_QUIRK_JD_DB_BYPASS)) -+ regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL, -+ NAU8821_JACK_DET_DB_BYPASS, 0); - - regmap_update_bits(regmap, NAU8821_R0F_INTERRUPT_MASK, - NAU8821_IRQ_EJECT_EN, 0); -@@ -1191,6 +1198,7 @@ static irqreturn_t nau8821_interrupt(int irq, void *data) - - if ((active_irq & NAU8821_JACK_EJECT_IRQ_MASK) == - NAU8821_JACK_EJECT_DETECTED) { -+ cancel_work_sync(&nau8821->jdet_work); - regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1, - NAU8821_MICDET_MASK, NAU8821_MICDET_DIS); - nau8821_eject_jack(nau8821); -@@ -1205,11 +1213,11 @@ static irqreturn_t nau8821_interrupt(int irq, void *data) - clear_irq = NAU8821_KEY_RELEASE_IRQ; - } else if ((active_irq & NAU8821_JACK_INSERT_IRQ_MASK) == - NAU8821_JACK_INSERT_DETECTED) { -+ cancel_work_sync(&nau8821->jdet_work); - regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1, - NAU8821_MICDET_MASK, NAU8821_MICDET_EN); - if (nau8821_is_jack_inserted(regmap)) { - /* detect microphone and jack type */ -- cancel_work_sync(&nau8821->jdet_work); - schedule_work(&nau8821->jdet_work); - /* Turn off insertion interruption at manual mode */ - regmap_update_bits(regmap, -@@ -1527,7 +1535,7 @@ static int nau8821_resume_setup(struct nau8821 *nau8821) - nau8821_configure_sysclk(nau8821, NAU8821_CLK_DIS, 0); - if (nau8821->irq) { - /* Clear all interruption status */ -- nau8821_int_status_clear_all(regmap); -+ nau8821_irq_status_clear(regmap, 0); - - /* Enable both insertion and ejection interruptions, and then - * bypass de-bounce circuit. -@@ -1848,7 +1856,23 @@ static const struct dmi_system_id nau8821_quirk_table[] = { - DMI_MATCH(DMI_SYS_VENDOR, "Positivo Tecnologia SA"), - DMI_MATCH(DMI_BOARD_NAME, "CW14Q01P-V2"), - }, -- .driver_data = (void *)(NAU8821_JD_ACTIVE_HIGH), -+ .driver_data = (void *)(NAU8821_QUIRK_JD_ACTIVE_HIGH), -+ }, -+ { -+ /* Valve Steam Deck LCD */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Valve"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Jupiter"), -+ }, -+ .driver_data = (void *)(NAU8821_QUIRK_JD_DB_BYPASS), -+ }, -+ { -+ /* Valve Steam Deck OLED */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Valve"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Galileo"), -+ }, -+ .driver_data = (void *)(NAU8821_QUIRK_JD_DB_BYPASS), - }, - {} - }; -@@ -1890,9 +1914,12 @@ static int nau8821_i2c_probe(struct i2c_client *i2c) - - nau8821_check_quirks(); - -- if (nau8821_quirk & NAU8821_JD_ACTIVE_HIGH) -+ if (nau8821_quirk & NAU8821_QUIRK_JD_ACTIVE_HIGH) - nau8821->jkdet_polarity = 0; - -+ if (nau8821_quirk & NAU8821_QUIRK_JD_DB_BYPASS) -+ dev_dbg(dev, "Force bypassing jack detection debounce circuit\n"); -+ - nau8821_print_device_properties(nau8821); - - nau8821_reset_chip(nau8821->regmap); -diff --git a/sound/usb/card.c b/sound/usb/card.c -index 7743ea983b1a81..9335bc20c56dfe 100644 ---- a/sound/usb/card.c -+++ b/sound/usb/card.c -@@ -754,10 +754,16 @@ get_alias_quirk(struct usb_device *dev, unsigned int id) - */ - static int try_to_register_card(struct snd_usb_audio *chip, int ifnum) - { -+ struct usb_interface *iface; -+ - if (check_delayed_register_option(chip) == ifnum || -- chip->last_iface == ifnum || -- usb_interface_claimed(usb_ifnum_to_if(chip->dev, chip->last_iface))) -+ chip->last_iface == ifnum) -+ return snd_card_register(chip->card); -+ -+ iface = usb_ifnum_to_if(chip->dev, chip->last_iface); -+ if (iface && usb_interface_claimed(iface)) - return snd_card_register(chip->card); -+ - return 0; - } - -diff --git a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c -index bb143de68875cc..e27d66b75fb1fc 100644 ---- a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c -+++ b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c -@@ -144,11 +144,17 @@ static void test_parse_test_list_file(void) - if (!ASSERT_OK(ferror(fp), "prepare tmp")) - goto out_fclose; - -+ if (!ASSERT_OK(fsync(fileno(fp)), "fsync tmp")) -+ goto out_fclose; -+ - init_test_filter_set(&set); - -- ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file"); -+ if (!ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file")) -+ goto out_fclose; -+ -+ if (!ASSERT_EQ(set.cnt, 4, "test count")) -+ goto out_free_set; - -- ASSERT_EQ(set.cnt, 4, "test count"); - ASSERT_OK(strcmp("test_with_spaces", set.tests[0].name), "test 0 name"); - ASSERT_EQ(set.tests[0].subtest_cnt, 0, "test 0 subtest count"); - ASSERT_OK(strcmp("testA", set.tests[1].name), "test 1 name"); -@@ -158,8 +164,8 @@ static void test_parse_test_list_file(void) - ASSERT_OK(strcmp("testB", set.tests[2].name), "test 2 name"); - ASSERT_OK(strcmp("testC_no_eof_newline", set.tests[3].name), "test 3 name"); - -+out_free_set: - free_test_filter_set(&set); -- - out_fclose: - fclose(fp); - out_remove: diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.114-115.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.114-115.patch deleted file mode 100644 index 36656e64a3..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.114-115.patch +++ /dev/null @@ -1,3794 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/usb/fsl,imx8mp-dwc3.yaml b/Documentation/devicetree/bindings/usb/fsl,imx8mp-dwc3.yaml -index 9ea1e4cd0709c9..69be6affa9b534 100644 ---- a/Documentation/devicetree/bindings/usb/fsl,imx8mp-dwc3.yaml -+++ b/Documentation/devicetree/bindings/usb/fsl,imx8mp-dwc3.yaml -@@ -85,13 +85,21 @@ required: - - reg - - "#address-cells" - - "#size-cells" -- - dma-ranges - - ranges - - clocks - - clock-names - - interrupts - - power-domains - -+allOf: -+ - if: -+ properties: -+ compatible: -+ const: fsl,imx8mp-dwc3 -+ then: -+ required: -+ - dma-ranges -+ - additionalProperties: false - - examples: -diff --git a/Makefile b/Makefile -index ad3952fb542d3a..85d8fa82569578 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 114 -+SUBLEVEL = 115 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -@@ -1358,11 +1358,11 @@ endif - - tools/: FORCE - $(Q)mkdir -p $(objtree)/tools -- $(Q)$(MAKE) LDFLAGS= O=$(abspath $(objtree)) subdir=tools -C $(srctree)/tools/ -+ $(Q)$(MAKE) O=$(abspath $(objtree)) subdir=tools -C $(srctree)/tools/ - - tools/%: FORCE - $(Q)mkdir -p $(objtree)/tools -- $(Q)$(MAKE) LDFLAGS= O=$(abspath $(objtree)) subdir=tools -C $(srctree)/tools/ $* -+ $(Q)$(MAKE) O=$(abspath $(objtree)) subdir=tools -C $(srctree)/tools/ $* - - # --------------------------------------------------------------------------- - # Kernel selftest -diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h -index 0212129b13d074..92e43b3a10df9b 100644 ---- a/arch/arm64/include/asm/pgtable.h -+++ b/arch/arm64/include/asm/pgtable.h -@@ -184,7 +184,8 @@ static inline pmd_t set_pmd_bit(pmd_t pmd, pgprot_t prot) - static inline pte_t pte_mkwrite_novma(pte_t pte) - { - pte = set_pte_bit(pte, __pgprot(PTE_WRITE)); -- pte = clear_pte_bit(pte, __pgprot(PTE_RDONLY)); -+ if (pte_sw_dirty(pte)) -+ pte = clear_pte_bit(pte, __pgprot(PTE_RDONLY)); - return pte; - } - -diff --git a/arch/m68k/include/asm/bitops.h b/arch/m68k/include/asm/bitops.h -index e984af71df6bee..d86aa744cb8fc4 100644 ---- a/arch/m68k/include/asm/bitops.h -+++ b/arch/m68k/include/asm/bitops.h -@@ -329,12 +329,12 @@ arch___test_and_change_bit(unsigned long nr, volatile unsigned long *addr) - #include - #else - --static inline int find_first_zero_bit(const unsigned long *vaddr, -- unsigned size) -+static inline unsigned long find_first_zero_bit(const unsigned long *vaddr, -+ unsigned long size) - { - const unsigned long *p = vaddr; -- int res = 32; -- unsigned int words; -+ unsigned long res = 32; -+ unsigned long words; - unsigned long num; - - if (!size) -@@ -355,8 +355,9 @@ static inline int find_first_zero_bit(const unsigned long *vaddr, - } - #define find_first_zero_bit find_first_zero_bit - --static inline int find_next_zero_bit(const unsigned long *vaddr, int size, -- int offset) -+static inline unsigned long find_next_zero_bit(const unsigned long *vaddr, -+ unsigned long size, -+ unsigned long offset) - { - const unsigned long *p = vaddr + (offset >> 5); - int bit = offset & 31UL, res; -@@ -385,11 +386,12 @@ static inline int find_next_zero_bit(const unsigned long *vaddr, int size, - } - #define find_next_zero_bit find_next_zero_bit - --static inline int find_first_bit(const unsigned long *vaddr, unsigned size) -+static inline unsigned long find_first_bit(const unsigned long *vaddr, -+ unsigned long size) - { - const unsigned long *p = vaddr; -- int res = 32; -- unsigned int words; -+ unsigned long res = 32; -+ unsigned long words; - unsigned long num; - - if (!size) -@@ -410,8 +412,9 @@ static inline int find_first_bit(const unsigned long *vaddr, unsigned size) - } - #define find_first_bit find_first_bit - --static inline int find_next_bit(const unsigned long *vaddr, int size, -- int offset) -+static inline unsigned long find_next_bit(const unsigned long *vaddr, -+ unsigned long size, -+ unsigned long offset) - { - const unsigned long *p = vaddr + (offset >> 5); - int bit = offset & 31UL, res; -diff --git a/arch/mips/mti-malta/malta-setup.c b/arch/mips/mti-malta/malta-setup.c -index 21cb3ac1237b76..020c38e6c5de08 100644 ---- a/arch/mips/mti-malta/malta-setup.c -+++ b/arch/mips/mti-malta/malta-setup.c -@@ -47,7 +47,7 @@ static struct resource standard_io_resources[] = { - .name = "keyboard", - .start = 0x60, - .end = 0x6f, -- .flags = IORESOURCE_IO | IORESOURCE_BUSY -+ .flags = IORESOURCE_IO - }, - { - .name = "dma page reg", -diff --git a/arch/nios2/kernel/setup.c b/arch/nios2/kernel/setup.c -index 8582ed9658447b..5308c761228173 100644 ---- a/arch/nios2/kernel/setup.c -+++ b/arch/nios2/kernel/setup.c -@@ -147,6 +147,20 @@ static void __init find_limits(unsigned long *min, unsigned long *max_low, - *max_high = PFN_DOWN(memblock_end_of_DRAM()); - } - -+static void __init adjust_lowmem_bounds(void) -+{ -+ phys_addr_t block_start, block_end; -+ u64 i; -+ phys_addr_t memblock_limit = 0; -+ -+ for_each_mem_range(i, &block_start, &block_end) { -+ if (block_end > memblock_limit) -+ memblock_limit = block_end; -+ } -+ -+ memblock_set_current_limit(memblock_limit); -+} -+ - void __init setup_arch(char **cmdline_p) - { - console_verbose(); -@@ -160,6 +174,7 @@ void __init setup_arch(char **cmdline_p) - /* Keep a copy of command line */ - *cmdline_p = boot_command_line; - -+ adjust_lowmem_bounds(); - find_limits(&min_low_pfn, &max_low_pfn, &max_pfn); - max_mapnr = max_low_pfn; - -diff --git a/arch/powerpc/include/asm/pgtable.h b/arch/powerpc/include/asm/pgtable.h -index d0ee46de248eaf..74502f91ed9362 100644 ---- a/arch/powerpc/include/asm/pgtable.h -+++ b/arch/powerpc/include/asm/pgtable.h -@@ -20,18 +20,6 @@ struct mm_struct; - #include - #endif /* !CONFIG_PPC_BOOK3S */ - --/* -- * Protection used for kernel text. We want the debuggers to be able to -- * set breakpoints anywhere, so don't write protect the kernel text -- * on platforms where such control is possible. -- */ --#if defined(CONFIG_KGDB) || defined(CONFIG_XMON) || defined(CONFIG_BDI_SWITCH) || \ -- defined(CONFIG_KPROBES) || defined(CONFIG_DYNAMIC_FTRACE) --#define PAGE_KERNEL_TEXT PAGE_KERNEL_X --#else --#define PAGE_KERNEL_TEXT PAGE_KERNEL_ROX --#endif -- - /* Make modules code happy. We don't set RO yet */ - #define PAGE_KERNEL_EXEC PAGE_KERNEL_X - -diff --git a/arch/powerpc/mm/book3s32/mmu.c b/arch/powerpc/mm/book3s32/mmu.c -index 850783cfa9c730..1b1848761a0008 100644 ---- a/arch/powerpc/mm/book3s32/mmu.c -+++ b/arch/powerpc/mm/book3s32/mmu.c -@@ -204,7 +204,7 @@ void mmu_mark_initmem_nx(void) - - for (i = 0; i < nb - 1 && base < top;) { - size = bat_block_size(base, top); -- setibat(i++, PAGE_OFFSET + base, base, size, PAGE_KERNEL_TEXT); -+ setibat(i++, PAGE_OFFSET + base, base, size, PAGE_KERNEL_X); - base += size; - } - if (base < top) { -@@ -215,7 +215,7 @@ void mmu_mark_initmem_nx(void) - pr_warn("Some RW data is getting mapped X. " - "Adjust CONFIG_DATA_SHIFT to avoid that.\n"); - } -- setibat(i++, PAGE_OFFSET + base, base, size, PAGE_KERNEL_TEXT); -+ setibat(i++, PAGE_OFFSET + base, base, size, PAGE_KERNEL_X); - base += size; - } - for (; i < nb; i++) -diff --git a/arch/powerpc/mm/pgtable_32.c b/arch/powerpc/mm/pgtable_32.c -index 5c02fd08d61eff..69fac96c2dcd12 100644 ---- a/arch/powerpc/mm/pgtable_32.c -+++ b/arch/powerpc/mm/pgtable_32.c -@@ -109,7 +109,7 @@ static void __init __mapin_ram_chunk(unsigned long offset, unsigned long top) - p = memstart_addr + s; - for (; s < top; s += PAGE_SIZE) { - ktext = core_kernel_text(v); -- map_kernel_page(v, p, ktext ? PAGE_KERNEL_TEXT : PAGE_KERNEL); -+ map_kernel_page(v, p, ktext ? PAGE_KERNEL_X : PAGE_KERNEL); - v += PAGE_SIZE; - p += PAGE_SIZE; - } -diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h -index 332a6bf72b1d54..987cfe87e78252 100644 ---- a/arch/riscv/include/asm/pgtable.h -+++ b/arch/riscv/include/asm/pgtable.h -@@ -618,6 +618,8 @@ static inline pgprot_t pgprot_writecombine(pgprot_t _prot) - return __pgprot(prot); - } - -+#define pgprot_dmacoherent pgprot_writecombine -+ - /* - * THP functions - */ -diff --git a/arch/riscv/kernel/cpu.c b/arch/riscv/kernel/cpu.c -index 88732abecd0230..93e794d0e5231b 100644 ---- a/arch/riscv/kernel/cpu.c -+++ b/arch/riscv/kernel/cpu.c -@@ -61,10 +61,8 @@ int __init riscv_early_of_processor_hartid(struct device_node *node, unsigned lo - return -ENODEV; - } - -- if (!of_device_is_available(node)) { -- pr_info("CPU with hartid=%lu is not available\n", *hart); -+ if (!of_device_is_available(node)) - return -ENODEV; -- } - - if (of_property_read_string(node, "riscv,isa-base", &isa)) - goto old_interface; -diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c -index 2cb30d9c5b4ae7..e689e3981bd9e1 100644 ---- a/arch/x86/kernel/cpu/microcode/amd.c -+++ b/arch/x86/kernel/cpu/microcode/amd.c -@@ -184,7 +184,7 @@ static bool need_sha_check(u32 cur_rev) - } - - switch (cur_rev >> 8) { -- case 0x80012: return cur_rev <= 0x800126f; break; -+ case 0x80012: return cur_rev <= 0x8001277; break; - case 0x80082: return cur_rev <= 0x800820f; break; - case 0x83010: return cur_rev <= 0x830107c; break; - case 0x86001: return cur_rev <= 0x860010e; break; -diff --git a/arch/x86/kernel/cpu/resctrl/monitor.c b/arch/x86/kernel/cpu/resctrl/monitor.c -index 3a6c069614eb84..976bdf15be22fd 100644 ---- a/arch/x86/kernel/cpu/resctrl/monitor.c -+++ b/arch/x86/kernel/cpu/resctrl/monitor.c -@@ -241,11 +241,15 @@ int resctrl_arch_rmid_read(struct rdt_resource *r, struct rdt_domain *d, - if (!cpumask_test_cpu(smp_processor_id(), &d->cpu_mask)) - return -EINVAL; - -+ am = get_arch_mbm_state(hw_dom, rmid, eventid); -+ - ret = __rmid_read(rmid, eventid, &msr_val); -- if (ret) -+ if (ret) { -+ if (am && ret == -EINVAL) -+ am->prev_msr = 0; - return ret; -+ } - -- am = get_arch_mbm_state(hw_dom, rmid, eventid); - if (am) { - am->chunks += mbm_overflow_count(am->prev_msr, msr_val, - hw_res->mbm_width); -diff --git a/drivers/acpi/acpica/tbprint.c b/drivers/acpi/acpica/tbprint.c -index 58b02e4b254b88..544964c9c530ae 100644 ---- a/drivers/acpi/acpica/tbprint.c -+++ b/drivers/acpi/acpica/tbprint.c -@@ -95,6 +95,11 @@ acpi_tb_print_table_header(acpi_physical_address address, - { - struct acpi_table_header local_header; - -+#pragma GCC diagnostic push -+#if defined(__GNUC__) && __GNUC__ >= 11 -+#pragma GCC diagnostic ignored "-Wstringop-overread" -+#endif -+ - if (ACPI_COMPARE_NAMESEG(header->signature, ACPI_SIG_FACS)) { - - /* FACS only has signature and length fields */ -@@ -135,4 +140,5 @@ acpi_tb_print_table_header(acpi_physical_address address, - local_header.asl_compiler_id, - local_header.asl_compiler_revision)); - } -+#pragma GCC diagnostic pop - } -diff --git a/drivers/android/binder.c b/drivers/android/binder.c -index 94f10c6eb336a5..e5096fcfad5760 100644 ---- a/drivers/android/binder.c -+++ b/drivers/android/binder.c -@@ -846,17 +846,8 @@ static int binder_inc_node_nilocked(struct binder_node *node, int strong, - } else { - if (!internal) - node->local_weak_refs++; -- if (!node->has_weak_ref && list_empty(&node->work.entry)) { -- if (target_list == NULL) { -- pr_err("invalid inc weak node for %d\n", -- node->debug_id); -- return -EINVAL; -- } -- /* -- * See comment above -- */ -+ if (!node->has_weak_ref && target_list && list_empty(&node->work.entry)) - binder_enqueue_work_ilocked(&node->work, target_list); -- } - } - return 0; - } -diff --git a/drivers/base/arch_topology.c b/drivers/base/arch_topology.c -index 2aa0c642529021..3a14ed36eb92d7 100644 ---- a/drivers/base/arch_topology.c -+++ b/drivers/base/arch_topology.c -@@ -326,7 +326,7 @@ bool __init topology_parse_cpu_capacity(struct device_node *cpu_node, int cpu) - * frequency (by keeping the initial capacity_freq_ref value). - */ - cpu_clk = of_clk_get(cpu_node, 0); -- if (!PTR_ERR_OR_ZERO(cpu_clk)) { -+ if (!IS_ERR_OR_NULL(cpu_clk)) { - per_cpu(capacity_freq_ref, cpu) = - clk_get_rate(cpu_clk) / HZ_PER_KHZ; - clk_put(cpu_clk); -diff --git a/drivers/base/devcoredump.c b/drivers/base/devcoredump.c -index 7e2d1f0d903a6e..6e6bf8be00664f 100644 ---- a/drivers/base/devcoredump.c -+++ b/drivers/base/devcoredump.c -@@ -26,50 +26,46 @@ struct devcd_entry { - void *data; - size_t datalen; - /* -- * Here, mutex is required to serialize the calls to del_wk work between -- * user/kernel space which happens when devcd is added with device_add() -- * and that sends uevent to user space. User space reads the uevents, -- * and calls to devcd_data_write() which try to modify the work which is -- * not even initialized/queued from devcoredump. -+ * There are 2 races for which mutex is required. - * -+ * The first race is between device creation and userspace writing to -+ * schedule immediately destruction. - * -+ * This race is handled by arming the timer before device creation, but -+ * when device creation fails the timer still exists. - * -- * cpu0(X) cpu1(Y) -+ * To solve this, hold the mutex during device_add(), and set -+ * init_completed on success before releasing the mutex. - * -- * dev_coredump() uevent sent to user space -- * device_add() ======================> user space process Y reads the -- * uevents writes to devcd fd -- * which results into writes to -+ * That way the timer will never fire until device_add() is called, -+ * it will do nothing if init_completed is not set. The timer is also -+ * cancelled in that case. - * -- * devcd_data_write() -- * mod_delayed_work() -- * try_to_grab_pending() -- * del_timer() -- * debug_assert_init() -- * INIT_DELAYED_WORK() -- * schedule_delayed_work() -- * -- * -- * Also, mutex alone would not be enough to avoid scheduling of -- * del_wk work after it get flush from a call to devcd_free() -- * mentioned as below. -- * -- * disabled_store() -- * devcd_free() -- * mutex_lock() devcd_data_write() -- * flush_delayed_work() -- * mutex_unlock() -- * mutex_lock() -- * mod_delayed_work() -- * mutex_unlock() -- * So, delete_work flag is required. -+ * The second race involves multiple parallel invocations of devcd_free(), -+ * add a deleted flag so only 1 can call the destructor. - */ - struct mutex mutex; -- bool delete_work; -+ bool init_completed, deleted; - struct module *owner; - ssize_t (*read)(char *buffer, loff_t offset, size_t count, - void *data, size_t datalen); - void (*free)(void *data); -+ /* -+ * If nothing interferes and device_add() was returns success, -+ * del_wk will destroy the device after the timer fires. -+ * -+ * Multiple userspace processes can interfere in the working of the timer: -+ * - Writing to the coredump will reschedule the timer to run immediately, -+ * if still armed. -+ * -+ * This is handled by using "if (cancel_delayed_work()) { -+ * schedule_delayed_work() }", to prevent re-arming after having -+ * been previously fired. -+ * - Writing to /sys/class/devcoredump/disabled will destroy the -+ * coredump synchronously. -+ * This is handled by using disable_delayed_work_sync(), and then -+ * checking if deleted flag is set with &devcd->mutex held. -+ */ - struct delayed_work del_wk; - struct device *failing_dev; - }; -@@ -98,14 +94,27 @@ static void devcd_dev_release(struct device *dev) - kfree(devcd); - } - -+static void __devcd_del(struct devcd_entry *devcd) -+{ -+ devcd->deleted = true; -+ device_del(&devcd->devcd_dev); -+ put_device(&devcd->devcd_dev); -+} -+ - static void devcd_del(struct work_struct *wk) - { - struct devcd_entry *devcd; -+ bool init_completed; - - devcd = container_of(wk, struct devcd_entry, del_wk.work); - -- device_del(&devcd->devcd_dev); -- put_device(&devcd->devcd_dev); -+ /* devcd->mutex serializes against dev_coredumpm_timeout */ -+ mutex_lock(&devcd->mutex); -+ init_completed = devcd->init_completed; -+ mutex_unlock(&devcd->mutex); -+ -+ if (init_completed) -+ __devcd_del(devcd); - } - - static ssize_t devcd_data_read(struct file *filp, struct kobject *kobj, -@@ -125,12 +134,12 @@ static ssize_t devcd_data_write(struct file *filp, struct kobject *kobj, - struct device *dev = kobj_to_dev(kobj); - struct devcd_entry *devcd = dev_to_devcd(dev); - -- mutex_lock(&devcd->mutex); -- if (!devcd->delete_work) { -- devcd->delete_work = true; -- mod_delayed_work(system_wq, &devcd->del_wk, 0); -- } -- mutex_unlock(&devcd->mutex); -+ /* -+ * Although it's tempting to use mod_delayed work here, -+ * that will cause a reschedule if the timer already fired. -+ */ -+ if (cancel_delayed_work(&devcd->del_wk)) -+ schedule_delayed_work(&devcd->del_wk, 0); - - return count; - } -@@ -158,11 +167,21 @@ static int devcd_free(struct device *dev, void *data) - { - struct devcd_entry *devcd = dev_to_devcd(dev); - -+ /* -+ * To prevent a race with devcd_data_write(), cancel work and -+ * complete manually instead. -+ * -+ * We cannot rely on the return value of -+ * cancel_delayed_work_sync() here, because it might be in the -+ * middle of a cancel_delayed_work + schedule_delayed_work pair. -+ * -+ * devcd->mutex here guards against multiple parallel invocations -+ * of devcd_free(). -+ */ -+ cancel_delayed_work_sync(&devcd->del_wk); - mutex_lock(&devcd->mutex); -- if (!devcd->delete_work) -- devcd->delete_work = true; -- -- flush_delayed_work(&devcd->del_wk); -+ if (!devcd->deleted) -+ __devcd_del(devcd); - mutex_unlock(&devcd->mutex); - return 0; - } -@@ -186,12 +205,10 @@ static ssize_t disabled_show(const struct class *class, const struct class_attri - * put_device() <- last reference - * error = fn(dev, data) devcd_dev_release() - * devcd_free(dev, data) kfree(devcd) -- * mutex_lock(&devcd->mutex); - * - * -- * In the above diagram, It looks like disabled_store() would be racing with parallely -- * running devcd_del() and result in memory abort while acquiring devcd->mutex which -- * is called after kfree of devcd memory after dropping its last reference with -+ * In the above diagram, it looks like disabled_store() would be racing with parallelly -+ * running devcd_del() and result in memory abort after dropping its last reference with - * put_device(). However, this will not happens as fn(dev, data) runs - * with its own reference to device via klist_node so it is not its last reference. - * so, above situation would not occur. -@@ -352,7 +369,7 @@ void dev_coredumpm(struct device *dev, struct module *owner, - devcd->read = read; - devcd->free = free; - devcd->failing_dev = get_device(dev); -- devcd->delete_work = false; -+ devcd->deleted = false; - - mutex_init(&devcd->mutex); - device_initialize(&devcd->devcd_dev); -@@ -361,8 +378,14 @@ void dev_coredumpm(struct device *dev, struct module *owner, - atomic_inc_return(&devcd_count)); - devcd->devcd_dev.class = &devcd_class; - -- mutex_lock(&devcd->mutex); - dev_set_uevent_suppress(&devcd->devcd_dev, true); -+ -+ /* devcd->mutex prevents devcd_del() completing until init finishes */ -+ mutex_lock(&devcd->mutex); -+ devcd->init_completed = false; -+ INIT_DELAYED_WORK(&devcd->del_wk, devcd_del); -+ schedule_delayed_work(&devcd->del_wk, DEVCD_TIMEOUT); -+ - if (device_add(&devcd->devcd_dev)) - goto put_device; - -@@ -379,13 +402,20 @@ void dev_coredumpm(struct device *dev, struct module *owner, - - dev_set_uevent_suppress(&devcd->devcd_dev, false); - kobject_uevent(&devcd->devcd_dev.kobj, KOBJ_ADD); -- INIT_DELAYED_WORK(&devcd->del_wk, devcd_del); -- schedule_delayed_work(&devcd->del_wk, DEVCD_TIMEOUT); -+ -+ /* -+ * Safe to run devcd_del() now that we are done with devcd_dev. -+ * Alternatively we could have taken a ref on devcd_dev before -+ * dropping the lock. -+ */ -+ devcd->init_completed = true; - mutex_unlock(&devcd->mutex); - return; - put_device: -- put_device(&devcd->devcd_dev); - mutex_unlock(&devcd->mutex); -+ cancel_delayed_work_sync(&devcd->del_wk); -+ put_device(&devcd->devcd_dev); -+ - put_module: - module_put(owner); - free: -diff --git a/drivers/comedi/comedi_buf.c b/drivers/comedi/comedi_buf.c -index 393966c097405d..ef38e9ad98f62b 100644 ---- a/drivers/comedi/comedi_buf.c -+++ b/drivers/comedi/comedi_buf.c -@@ -368,7 +368,7 @@ static unsigned int comedi_buf_munge(struct comedi_subdevice *s, - unsigned int count = 0; - const unsigned int num_sample_bytes = comedi_bytes_per_sample(s); - -- if (!s->munge || (async->cmd.flags & CMDF_RAWDATA)) { -+ if (!s->munge || (async->cmd.flags & CMDF_RAWDATA) || async->cmd.chanlist_len == 0) { - async->munge_count += num_bytes; - return num_bytes; - } -diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c -index 92f9c00ad5f9fb..cafe6eed3349f4 100644 ---- a/drivers/cpuidle/governors/menu.c -+++ b/drivers/cpuidle/governors/menu.c -@@ -230,20 +230,17 @@ static unsigned int get_typical_interval(struct menu_device *data) - * - * This can deal with workloads that have long pauses interspersed - * with sporadic activity with a bunch of short pauses. -+ * -+ * However, if the number of remaining samples is too small to exclude -+ * any more outliers, allow the deepest available idle state to be -+ * selected because there are systems where the time spent by CPUs in -+ * deep idle states is correlated to the maximum frequency the CPUs -+ * can get to. On those systems, shallow idle states should be avoided -+ * unless there is a clear indication that the given CPU is most likley -+ * going to be woken up shortly. - */ -- if (divisor * 4 <= INTERVALS * 3) { -- /* -- * If there are sufficiently many data points still under -- * consideration after the outliers have been eliminated, -- * returning without a prediction would be a mistake because it -- * is likely that the next interval will not exceed the current -- * maximum, so return the latter in that case. -- */ -- if (divisor >= INTERVALS / 2) -- return max; -- -+ if (divisor * 4 <= INTERVALS * 3) - return UINT_MAX; -- } - - thresh = max - 1; - goto again; -diff --git a/drivers/firmware/arm_scmi/common.h b/drivers/firmware/arm_scmi/common.h -index 6c223487121544..dc95652fff4009 100644 ---- a/drivers/firmware/arm_scmi/common.h -+++ b/drivers/firmware/arm_scmi/common.h -@@ -321,10 +321,28 @@ enum debug_counters { - SCMI_DEBUG_COUNTERS_LAST - }; - --static inline void scmi_inc_count(atomic_t *arr, int stat) -+/** -+ * struct scmi_debug_info - Debug common info -+ * @top_dentry: A reference to the top debugfs dentry -+ * @name: Name of this SCMI instance -+ * @type: Type of this SCMI instance -+ * @is_atomic: Flag to state if the transport of this instance is atomic -+ * @counters: An array of atomic_c's used for tracking statistics (if enabled) -+ */ -+struct scmi_debug_info { -+ struct dentry *top_dentry; -+ const char *name; -+ const char *type; -+ bool is_atomic; -+ atomic_t counters[SCMI_DEBUG_COUNTERS_LAST]; -+}; -+ -+static inline void scmi_inc_count(struct scmi_debug_info *dbg, int stat) - { -- if (IS_ENABLED(CONFIG_ARM_SCMI_DEBUG_COUNTERS)) -- atomic_inc(&arr[stat]); -+ if (IS_ENABLED(CONFIG_ARM_SCMI_DEBUG_COUNTERS)) { -+ if (dbg) -+ atomic_inc(&dbg->counters[stat]); -+ } - } - - enum scmi_bad_msg { -diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c -index d1fd2e492909e5..fbe893734411c8 100644 ---- a/drivers/firmware/arm_scmi/driver.c -+++ b/drivers/firmware/arm_scmi/driver.c -@@ -102,22 +102,6 @@ struct scmi_protocol_instance { - - #define ph_to_pi(h) container_of(h, struct scmi_protocol_instance, ph) - --/** -- * struct scmi_debug_info - Debug common info -- * @top_dentry: A reference to the top debugfs dentry -- * @name: Name of this SCMI instance -- * @type: Type of this SCMI instance -- * @is_atomic: Flag to state if the transport of this instance is atomic -- * @counters: An array of atomic_c's used for tracking statistics (if enabled) -- */ --struct scmi_debug_info { -- struct dentry *top_dentry; -- const char *name; -- const char *type; -- bool is_atomic; -- atomic_t counters[SCMI_DEBUG_COUNTERS_LAST]; --}; -- - /** - * struct scmi_info - Structure representing a SCMI instance - * -@@ -643,6 +627,7 @@ __scmi_xfer_put(struct scmi_xfers_info *minfo, struct scmi_xfer *xfer) - hash_del(&xfer->node); - xfer->pending = false; - } -+ xfer->flags = 0; - hlist_add_head(&xfer->node, &minfo->free_xfers); - } - spin_unlock_irqrestore(&minfo->xfer_lock, flags); -@@ -661,8 +646,6 @@ void scmi_xfer_raw_put(const struct scmi_handle *handle, struct scmi_xfer *xfer) - { - struct scmi_info *info = handle_to_scmi_info(handle); - -- xfer->flags &= ~SCMI_XFER_FLAG_IS_RAW; -- xfer->flags &= ~SCMI_XFER_FLAG_CHAN_SET; - return __scmi_xfer_put(&info->tx_minfo, xfer); - } - -@@ -856,7 +839,7 @@ scmi_xfer_command_acquire(struct scmi_chan_info *cinfo, u32 msg_hdr) - spin_unlock_irqrestore(&minfo->xfer_lock, flags); - - scmi_bad_message_trace(cinfo, msg_hdr, MSG_UNEXPECTED); -- scmi_inc_count(info->dbg->counters, ERR_MSG_UNEXPECTED); -+ scmi_inc_count(info->dbg, ERR_MSG_UNEXPECTED); - - return xfer; - } -@@ -884,7 +867,7 @@ scmi_xfer_command_acquire(struct scmi_chan_info *cinfo, u32 msg_hdr) - msg_type, xfer_id, msg_hdr, xfer->state); - - scmi_bad_message_trace(cinfo, msg_hdr, MSG_INVALID); -- scmi_inc_count(info->dbg->counters, ERR_MSG_INVALID); -+ scmi_inc_count(info->dbg, ERR_MSG_INVALID); - - - /* On error the refcount incremented above has to be dropped */ -@@ -930,7 +913,7 @@ static void scmi_handle_notification(struct scmi_chan_info *cinfo, - PTR_ERR(xfer)); - - scmi_bad_message_trace(cinfo, msg_hdr, MSG_NOMEM); -- scmi_inc_count(info->dbg->counters, ERR_MSG_NOMEM); -+ scmi_inc_count(info->dbg, ERR_MSG_NOMEM); - - scmi_clear_channel(info, cinfo); - return; -@@ -946,7 +929,7 @@ static void scmi_handle_notification(struct scmi_chan_info *cinfo, - trace_scmi_msg_dump(info->id, cinfo->id, xfer->hdr.protocol_id, - xfer->hdr.id, "NOTI", xfer->hdr.seq, - xfer->hdr.status, xfer->rx.buf, xfer->rx.len); -- scmi_inc_count(info->dbg->counters, NOTIFICATION_OK); -+ scmi_inc_count(info->dbg, NOTIFICATION_OK); - - scmi_notify(cinfo->handle, xfer->hdr.protocol_id, - xfer->hdr.id, xfer->rx.buf, xfer->rx.len, ts); -@@ -1006,10 +989,10 @@ static void scmi_handle_response(struct scmi_chan_info *cinfo, - if (xfer->hdr.type == MSG_TYPE_DELAYED_RESP) { - scmi_clear_channel(info, cinfo); - complete(xfer->async_done); -- scmi_inc_count(info->dbg->counters, DELAYED_RESPONSE_OK); -+ scmi_inc_count(info->dbg, DELAYED_RESPONSE_OK); - } else { - complete(&xfer->done); -- scmi_inc_count(info->dbg->counters, RESPONSE_OK); -+ scmi_inc_count(info->dbg, RESPONSE_OK); - } - - if (IS_ENABLED(CONFIG_ARM_SCMI_RAW_MODE_SUPPORT)) { -@@ -1117,7 +1100,7 @@ static int scmi_wait_for_reply(struct device *dev, const struct scmi_desc *desc, - "timed out in resp(caller: %pS) - polling\n", - (void *)_RET_IP_); - ret = -ETIMEDOUT; -- scmi_inc_count(info->dbg->counters, XFERS_RESPONSE_POLLED_TIMEOUT); -+ scmi_inc_count(info->dbg, XFERS_RESPONSE_POLLED_TIMEOUT); - } - } - -@@ -1142,7 +1125,7 @@ static int scmi_wait_for_reply(struct device *dev, const struct scmi_desc *desc, - "RESP" : "resp", - xfer->hdr.seq, xfer->hdr.status, - xfer->rx.buf, xfer->rx.len); -- scmi_inc_count(info->dbg->counters, RESPONSE_POLLED_OK); -+ scmi_inc_count(info->dbg, RESPONSE_POLLED_OK); - - if (IS_ENABLED(CONFIG_ARM_SCMI_RAW_MODE_SUPPORT)) { - struct scmi_info *info = -@@ -1160,7 +1143,7 @@ static int scmi_wait_for_reply(struct device *dev, const struct scmi_desc *desc, - dev_err(dev, "timed out in resp(caller: %pS)\n", - (void *)_RET_IP_); - ret = -ETIMEDOUT; -- scmi_inc_count(info->dbg->counters, XFERS_RESPONSE_TIMEOUT); -+ scmi_inc_count(info->dbg, XFERS_RESPONSE_TIMEOUT); - } - } - -@@ -1244,13 +1227,13 @@ static int do_xfer(const struct scmi_protocol_handle *ph, - !is_transport_polling_capable(info->desc)) { - dev_warn_once(dev, - "Polling mode is not supported by transport.\n"); -- scmi_inc_count(info->dbg->counters, SENT_FAIL_POLLING_UNSUPPORTED); -+ scmi_inc_count(info->dbg, SENT_FAIL_POLLING_UNSUPPORTED); - return -EINVAL; - } - - cinfo = idr_find(&info->tx_idr, pi->proto->id); - if (unlikely(!cinfo)) { -- scmi_inc_count(info->dbg->counters, SENT_FAIL_CHANNEL_NOT_FOUND); -+ scmi_inc_count(info->dbg, SENT_FAIL_CHANNEL_NOT_FOUND); - return -EINVAL; - } - /* True ONLY if also supported by transport. */ -@@ -1284,19 +1267,19 @@ static int do_xfer(const struct scmi_protocol_handle *ph, - ret = info->desc->ops->send_message(cinfo, xfer); - if (ret < 0) { - dev_dbg(dev, "Failed to send message %d\n", ret); -- scmi_inc_count(info->dbg->counters, SENT_FAIL); -+ scmi_inc_count(info->dbg, SENT_FAIL); - return ret; - } - - trace_scmi_msg_dump(info->id, cinfo->id, xfer->hdr.protocol_id, - xfer->hdr.id, "CMND", xfer->hdr.seq, - xfer->hdr.status, xfer->tx.buf, xfer->tx.len); -- scmi_inc_count(info->dbg->counters, SENT_OK); -+ scmi_inc_count(info->dbg, SENT_OK); - - ret = scmi_wait_for_message_response(cinfo, xfer); - if (!ret && xfer->hdr.status) { - ret = scmi_to_linux_errno(xfer->hdr.status); -- scmi_inc_count(info->dbg->counters, ERR_PROTOCOL); -+ scmi_inc_count(info->dbg, ERR_PROTOCOL); - } - - if (info->desc->ops->mark_txdone) -diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig -index ebd4e113dc2654..de051a085e63fa 100644 ---- a/drivers/gpio/Kconfig -+++ b/drivers/gpio/Kconfig -@@ -1313,9 +1313,9 @@ config GPIO_KEMPLD - - config GPIO_LJCA - tristate "INTEL La Jolla Cove Adapter GPIO support" -- depends on MFD_LJCA -+ depends on USB_LJCA - select GPIOLIB_IRQCHIP -- default MFD_LJCA -+ default USB_LJCA - help - Select this option to enable GPIO driver for the INTEL - La Jolla Cove Adapter (LJCA) board. -diff --git a/drivers/gpio/gpio-104-idio-16.c b/drivers/gpio/gpio-104-idio-16.c -index f03ccd0f534cff..f60872d1e8a580 100644 ---- a/drivers/gpio/gpio-104-idio-16.c -+++ b/drivers/gpio/gpio-104-idio-16.c -@@ -59,6 +59,7 @@ static const struct regmap_config idio_16_regmap_config = { - .reg_stride = 1, - .val_bits = 8, - .io_port = true, -+ .max_register = 0x5, - .wr_table = &idio_16_wr_table, - .rd_table = &idio_16_rd_table, - .volatile_table = &idio_16_rd_table, -diff --git a/drivers/gpio/gpio-ljca.c b/drivers/gpio/gpio-ljca.c -index 87863f0230f5cf..c3a595c6f6c723 100644 ---- a/drivers/gpio/gpio-ljca.c -+++ b/drivers/gpio/gpio-ljca.c -@@ -6,6 +6,7 @@ - */ - - #include -+#include - #include - #include - #include -@@ -13,19 +14,18 @@ - #include - #include - #include --#include - #include --#include - #include - #include -+#include - - /* GPIO commands */ --#define LJCA_GPIO_CONFIG 1 --#define LJCA_GPIO_READ 2 --#define LJCA_GPIO_WRITE 3 --#define LJCA_GPIO_INT_EVENT 4 --#define LJCA_GPIO_INT_MASK 5 --#define LJCA_GPIO_INT_UNMASK 6 -+#define LJCA_GPIO_CONFIG 1 -+#define LJCA_GPIO_READ 2 -+#define LJCA_GPIO_WRITE 3 -+#define LJCA_GPIO_INT_EVENT 4 -+#define LJCA_GPIO_INT_MASK 5 -+#define LJCA_GPIO_INT_UNMASK 6 - - #define LJCA_GPIO_CONF_DISABLE BIT(0) - #define LJCA_GPIO_CONF_INPUT BIT(1) -@@ -36,89 +36,93 @@ - #define LJCA_GPIO_CONF_INTERRUPT BIT(6) - #define LJCA_GPIO_INT_TYPE BIT(7) - --#define LJCA_GPIO_CONF_EDGE FIELD_PREP(LJCA_GPIO_INT_TYPE, 1) --#define LJCA_GPIO_CONF_LEVEL FIELD_PREP(LJCA_GPIO_INT_TYPE, 0) -+#define LJCA_GPIO_CONF_EDGE FIELD_PREP(LJCA_GPIO_INT_TYPE, 1) -+#define LJCA_GPIO_CONF_LEVEL FIELD_PREP(LJCA_GPIO_INT_TYPE, 0) - - /* Intentional overlap with PULLUP / PULLDOWN */ --#define LJCA_GPIO_CONF_SET BIT(3) --#define LJCA_GPIO_CONF_CLR BIT(4) -+#define LJCA_GPIO_CONF_SET BIT(3) -+#define LJCA_GPIO_CONF_CLR BIT(4) - --struct gpio_op { -+#define LJCA_GPIO_BUF_SIZE 60u -+ -+struct ljca_gpio_op { - u8 index; - u8 value; - } __packed; - --struct gpio_packet { -+struct ljca_gpio_packet { - u8 num; -- struct gpio_op item[]; -+ struct ljca_gpio_op item[] __counted_by(num); - } __packed; - --#define LJCA_GPIO_BUF_SIZE 60 - struct ljca_gpio_dev { -- struct platform_device *pdev; -+ struct ljca_client *ljca; - struct gpio_chip gc; - struct ljca_gpio_info *gpio_info; - DECLARE_BITMAP(unmasked_irqs, LJCA_MAX_GPIO_NUM); - DECLARE_BITMAP(enabled_irqs, LJCA_MAX_GPIO_NUM); - DECLARE_BITMAP(reenable_irqs, LJCA_MAX_GPIO_NUM); -+ DECLARE_BITMAP(output_enabled, LJCA_MAX_GPIO_NUM); - u8 *connect_mode; -- /* mutex to protect irq bus */ -+ /* protect irq bus */ - struct mutex irq_lock; - struct work_struct work; -- /* lock to protect package transfer to Hardware */ -+ /* protect package transfer to hardware */ - struct mutex trans_lock; - - u8 obuf[LJCA_GPIO_BUF_SIZE]; - u8 ibuf[LJCA_GPIO_BUF_SIZE]; - }; - --static int gpio_config(struct ljca_gpio_dev *ljca_gpio, u8 gpio_id, u8 config) -+static int ljca_gpio_config(struct ljca_gpio_dev *ljca_gpio, u8 gpio_id, -+ u8 config) - { -- struct gpio_packet *packet = (struct gpio_packet *)ljca_gpio->obuf; -+ struct ljca_gpio_packet *packet = -+ (struct ljca_gpio_packet *)ljca_gpio->obuf; - int ret; - - mutex_lock(&ljca_gpio->trans_lock); -+ packet->num = 1; - packet->item[0].index = gpio_id; - packet->item[0].value = config | ljca_gpio->connect_mode[gpio_id]; -- packet->num = 1; - -- ret = ljca_transfer(ljca_gpio->gpio_info->ljca, LJCA_GPIO_CONFIG, packet, -- struct_size(packet, item, packet->num), NULL, NULL); -+ ret = ljca_transfer(ljca_gpio->ljca, LJCA_GPIO_CONFIG, (u8 *)packet, -+ struct_size(packet, item, packet->num), NULL, 0); - mutex_unlock(&ljca_gpio->trans_lock); -- return ret; -+ -+ return ret < 0 ? ret : 0; - } - - static int ljca_gpio_read(struct ljca_gpio_dev *ljca_gpio, u8 gpio_id) - { -- struct gpio_packet *packet = (struct gpio_packet *)ljca_gpio->obuf; -- struct gpio_packet *ack_packet = (struct gpio_packet *)ljca_gpio->ibuf; -- unsigned int ibuf_len = LJCA_GPIO_BUF_SIZE; -+ struct ljca_gpio_packet *ack_packet = -+ (struct ljca_gpio_packet *)ljca_gpio->ibuf; -+ struct ljca_gpio_packet *packet = -+ (struct ljca_gpio_packet *)ljca_gpio->obuf; - int ret; - - mutex_lock(&ljca_gpio->trans_lock); - packet->num = 1; - packet->item[0].index = gpio_id; -- ret = ljca_transfer(ljca_gpio->gpio_info->ljca, LJCA_GPIO_READ, packet, -- struct_size(packet, item, packet->num), ljca_gpio->ibuf, &ibuf_len); -- if (ret) -- goto out_unlock; -- -- if (!ibuf_len || ack_packet->num != packet->num) { -- dev_err(&ljca_gpio->pdev->dev, "failed gpio_id:%u %u", gpio_id, ack_packet->num); -- ret = -EIO; -+ ret = ljca_transfer(ljca_gpio->ljca, LJCA_GPIO_READ, (u8 *)packet, -+ struct_size(packet, item, packet->num), -+ ljca_gpio->ibuf, LJCA_GPIO_BUF_SIZE); -+ -+ if (ret <= 0 || ack_packet->num != packet->num) { -+ dev_err(&ljca_gpio->ljca->auxdev.dev, -+ "read package error, gpio_id: %u num: %u ret: %d\n", -+ gpio_id, ack_packet->num, ret); -+ ret = ret < 0 ? ret : -EIO; - } -- --out_unlock: - mutex_unlock(&ljca_gpio->trans_lock); -- if (ret) -- return ret; -- return ack_packet->item[0].value > 0; -+ -+ return ret < 0 ? ret : ack_packet->item[0].value > 0; - } - --static int ljca_gpio_write(struct ljca_gpio_dev *ljca_gpio, u8 gpio_id, -- int value) -+static int ljca_gpio_write(struct ljca_gpio_dev *ljca_gpio, u8 gpio_id, int value) - { -- struct gpio_packet *packet = (struct gpio_packet *)ljca_gpio->obuf; -+ struct ljca_gpio_packet *packet = -+ (struct ljca_gpio_packet *)ljca_gpio->obuf; - int ret; - - mutex_lock(&ljca_gpio->trans_lock); -@@ -126,10 +130,11 @@ static int ljca_gpio_write(struct ljca_gpio_dev *ljca_gpio, u8 gpio_id, - packet->item[0].index = gpio_id; - packet->item[0].value = value & 1; - -- ret = ljca_transfer(ljca_gpio->gpio_info->ljca, LJCA_GPIO_WRITE, packet, -- struct_size(packet, item, packet->num), NULL, NULL); -+ ret = ljca_transfer(ljca_gpio->ljca, LJCA_GPIO_WRITE, (u8 *)packet, -+ struct_size(packet, item, packet->num), NULL, 0); - mutex_unlock(&ljca_gpio->trans_lock); -- return ret; -+ -+ return ret < 0 ? ret : 0; - } - - static int ljca_gpio_get_value(struct gpio_chip *chip, unsigned int offset) -@@ -147,16 +152,24 @@ static void ljca_gpio_set_value(struct gpio_chip *chip, unsigned int offset, - - ret = ljca_gpio_write(ljca_gpio, offset, val); - if (ret) -- dev_err(chip->parent, "offset:%u val:%d set value failed %d\n", offset, val, ret); -+ dev_err(chip->parent, -+ "set value failed offset: %u val: %d ret: %d\n", -+ offset, val, ret); - } - --static int ljca_gpio_direction_input(struct gpio_chip *chip, -- unsigned int offset) -+static int ljca_gpio_direction_input(struct gpio_chip *chip, unsigned int offset) - { - struct ljca_gpio_dev *ljca_gpio = gpiochip_get_data(chip); - u8 config = LJCA_GPIO_CONF_INPUT | LJCA_GPIO_CONF_CLR; -+ int ret; - -- return gpio_config(ljca_gpio, offset, config); -+ ret = ljca_gpio_config(ljca_gpio, offset, config); -+ if (ret) -+ return ret; -+ -+ clear_bit(offset, ljca_gpio->output_enabled); -+ -+ return 0; - } - - static int ljca_gpio_direction_output(struct gpio_chip *chip, -@@ -166,14 +179,26 @@ static int ljca_gpio_direction_output(struct gpio_chip *chip, - u8 config = LJCA_GPIO_CONF_OUTPUT | LJCA_GPIO_CONF_CLR; - int ret; - -- ret = gpio_config(ljca_gpio, offset, config); -+ ret = ljca_gpio_config(ljca_gpio, offset, config); - if (ret) - return ret; - - ljca_gpio_set_value(chip, offset, val); -+ set_bit(offset, ljca_gpio->output_enabled); -+ - return 0; - } - -+static int ljca_gpio_get_direction(struct gpio_chip *chip, unsigned int offset) -+{ -+ struct ljca_gpio_dev *ljca_gpio = gpiochip_get_data(chip); -+ -+ if (test_bit(offset, ljca_gpio->output_enabled)) -+ return GPIO_LINE_DIRECTION_OUT; -+ -+ return GPIO_LINE_DIRECTION_IN; -+} -+ - static int ljca_gpio_set_config(struct gpio_chip *chip, unsigned int offset, - unsigned long config) - { -@@ -197,7 +222,8 @@ static int ljca_gpio_set_config(struct gpio_chip *chip, unsigned int offset, - return 0; - } - --static int ljca_gpio_init_valid_mask(struct gpio_chip *chip, unsigned long *valid_mask, -+static int ljca_gpio_init_valid_mask(struct gpio_chip *chip, -+ unsigned long *valid_mask, - unsigned int ngpios) - { - struct ljca_gpio_dev *ljca_gpio = gpiochip_get_data(chip); -@@ -208,15 +234,18 @@ static int ljca_gpio_init_valid_mask(struct gpio_chip *chip, unsigned long *vali - return 0; - } - --static void ljca_gpio_irq_init_valid_mask(struct gpio_chip *chip, unsigned long *valid_mask, -+static void ljca_gpio_irq_init_valid_mask(struct gpio_chip *chip, -+ unsigned long *valid_mask, - unsigned int ngpios) - { - ljca_gpio_init_valid_mask(chip, valid_mask, ngpios); - } - --static int ljca_enable_irq(struct ljca_gpio_dev *ljca_gpio, int gpio_id, bool enable) -+static int ljca_enable_irq(struct ljca_gpio_dev *ljca_gpio, int gpio_id, -+ bool enable) - { -- struct gpio_packet *packet = (struct gpio_packet *)ljca_gpio->obuf; -+ struct ljca_gpio_packet *packet = -+ (struct ljca_gpio_packet *)ljca_gpio->obuf; - int ret; - - mutex_lock(&ljca_gpio->trans_lock); -@@ -224,18 +253,20 @@ static int ljca_enable_irq(struct ljca_gpio_dev *ljca_gpio, int gpio_id, bool en - packet->item[0].index = gpio_id; - packet->item[0].value = 0; - -- ret = ljca_transfer(ljca_gpio->gpio_info->ljca, -- enable ? LJCA_GPIO_INT_UNMASK : LJCA_GPIO_INT_MASK, packet, -- struct_size(packet, item, packet->num), NULL, NULL); -+ ret = ljca_transfer(ljca_gpio->ljca, -+ enable ? LJCA_GPIO_INT_UNMASK : LJCA_GPIO_INT_MASK, -+ (u8 *)packet, struct_size(packet, item, packet->num), -+ NULL, 0); - mutex_unlock(&ljca_gpio->trans_lock); -- return ret; -+ -+ return ret < 0 ? ret : 0; - } - - static void ljca_gpio_async(struct work_struct *work) - { -- struct ljca_gpio_dev *ljca_gpio = container_of(work, struct ljca_gpio_dev, work); -- int gpio_id; -- int unmasked; -+ struct ljca_gpio_dev *ljca_gpio = -+ container_of(work, struct ljca_gpio_dev, work); -+ int gpio_id, unmasked; - - for_each_set_bit(gpio_id, ljca_gpio->reenable_irqs, ljca_gpio->gc.ngpio) { - clear_bit(gpio_id, ljca_gpio->reenable_irqs); -@@ -245,25 +276,19 @@ static void ljca_gpio_async(struct work_struct *work) - } - } - --static void ljca_gpio_event_cb(void *context, u8 cmd, const void *evt_data, int len) -+static void ljca_gpio_event_cb(void *context, u8 cmd, const void *evt_data, -+ int len) - { -- const struct gpio_packet *packet = evt_data; -+ const struct ljca_gpio_packet *packet = evt_data; - struct ljca_gpio_dev *ljca_gpio = context; - int i; -- int irq; - - if (cmd != LJCA_GPIO_INT_EVENT) - return; - - for (i = 0; i < packet->num; i++) { -- irq = irq_find_mapping(ljca_gpio->gc.irq.domain, packet->item[i].index); -- if (!irq) { -- dev_err(ljca_gpio->gc.parent, "gpio_id %u does not mapped to IRQ yet\n", -- packet->item[i].index); -- return; -- } -- -- generic_handle_domain_irq(ljca_gpio->gc.irq.domain, irq); -+ generic_handle_domain_irq(ljca_gpio->gc.irq.domain, -+ packet->item[i].index); - set_bit(packet->item[i].index, ljca_gpio->reenable_irqs); - } - -@@ -299,18 +324,22 @@ static int ljca_irq_set_type(struct irq_data *irqd, unsigned int type) - ljca_gpio->connect_mode[gpio_id] = LJCA_GPIO_CONF_INTERRUPT; - switch (type) { - case IRQ_TYPE_LEVEL_HIGH: -- ljca_gpio->connect_mode[gpio_id] |= (LJCA_GPIO_CONF_LEVEL | LJCA_GPIO_CONF_PULLUP); -+ ljca_gpio->connect_mode[gpio_id] |= -+ (LJCA_GPIO_CONF_LEVEL | LJCA_GPIO_CONF_PULLUP); - break; - case IRQ_TYPE_LEVEL_LOW: -- ljca_gpio->connect_mode[gpio_id] |= (LJCA_GPIO_CONF_LEVEL | LJCA_GPIO_CONF_PULLDOWN); -+ ljca_gpio->connect_mode[gpio_id] |= -+ (LJCA_GPIO_CONF_LEVEL | LJCA_GPIO_CONF_PULLDOWN); - break; - case IRQ_TYPE_EDGE_BOTH: - break; - case IRQ_TYPE_EDGE_RISING: -- ljca_gpio->connect_mode[gpio_id] |= (LJCA_GPIO_CONF_EDGE | LJCA_GPIO_CONF_PULLUP); -+ ljca_gpio->connect_mode[gpio_id] |= -+ (LJCA_GPIO_CONF_EDGE | LJCA_GPIO_CONF_PULLUP); - break; - case IRQ_TYPE_EDGE_FALLING: -- ljca_gpio->connect_mode[gpio_id] |= (LJCA_GPIO_CONF_EDGE | LJCA_GPIO_CONF_PULLDOWN); -+ ljca_gpio->connect_mode[gpio_id] |= -+ (LJCA_GPIO_CONF_EDGE | LJCA_GPIO_CONF_PULLDOWN); - break; - default: - return -EINVAL; -@@ -332,15 +361,14 @@ static void ljca_irq_bus_unlock(struct irq_data *irqd) - struct gpio_chip *gc = irq_data_get_irq_chip_data(irqd); - struct ljca_gpio_dev *ljca_gpio = gpiochip_get_data(gc); - int gpio_id = irqd_to_hwirq(irqd); -- int enabled; -- int unmasked; -+ int enabled, unmasked; - - enabled = test_bit(gpio_id, ljca_gpio->enabled_irqs); - unmasked = test_bit(gpio_id, ljca_gpio->unmasked_irqs); - - if (enabled != unmasked) { - if (unmasked) { -- gpio_config(ljca_gpio, gpio_id, 0); -+ ljca_gpio_config(ljca_gpio, gpio_id, 0); - ljca_enable_irq(ljca_gpio, gpio_id, true); - set_bit(gpio_id, ljca_gpio->enabled_irqs); - } else { -@@ -363,43 +391,48 @@ static const struct irq_chip ljca_gpio_irqchip = { - GPIOCHIP_IRQ_RESOURCE_HELPERS, - }; - --static int ljca_gpio_probe(struct platform_device *pdev) -+static int ljca_gpio_probe(struct auxiliary_device *auxdev, -+ const struct auxiliary_device_id *aux_dev_id) - { -+ struct ljca_client *ljca = auxiliary_dev_to_ljca_client(auxdev); - struct ljca_gpio_dev *ljca_gpio; - struct gpio_irq_chip *girq; - int ret; - -- ljca_gpio = devm_kzalloc(&pdev->dev, sizeof(*ljca_gpio), GFP_KERNEL); -+ ljca_gpio = devm_kzalloc(&auxdev->dev, sizeof(*ljca_gpio), GFP_KERNEL); - if (!ljca_gpio) - return -ENOMEM; - -- ljca_gpio->gpio_info = dev_get_platdata(&pdev->dev); -- ljca_gpio->connect_mode = devm_kcalloc(&pdev->dev, ljca_gpio->gpio_info->num, -- sizeof(*ljca_gpio->connect_mode), GFP_KERNEL); -+ ljca_gpio->ljca = ljca; -+ ljca_gpio->gpio_info = dev_get_platdata(&auxdev->dev); -+ ljca_gpio->connect_mode = devm_kcalloc(&auxdev->dev, -+ ljca_gpio->gpio_info->num, -+ sizeof(*ljca_gpio->connect_mode), -+ GFP_KERNEL); - if (!ljca_gpio->connect_mode) - return -ENOMEM; - - mutex_init(&ljca_gpio->irq_lock); - mutex_init(&ljca_gpio->trans_lock); -- ljca_gpio->pdev = pdev; - ljca_gpio->gc.direction_input = ljca_gpio_direction_input; - ljca_gpio->gc.direction_output = ljca_gpio_direction_output; -+ ljca_gpio->gc.get_direction = ljca_gpio_get_direction; - ljca_gpio->gc.get = ljca_gpio_get_value; - ljca_gpio->gc.set = ljca_gpio_set_value; - ljca_gpio->gc.set_config = ljca_gpio_set_config; - ljca_gpio->gc.init_valid_mask = ljca_gpio_init_valid_mask; - ljca_gpio->gc.can_sleep = true; -- ljca_gpio->gc.parent = &pdev->dev; -+ ljca_gpio->gc.parent = &auxdev->dev; - - ljca_gpio->gc.base = -1; - ljca_gpio->gc.ngpio = ljca_gpio->gpio_info->num; -- ljca_gpio->gc.label = ACPI_COMPANION(&pdev->dev) ? -- acpi_dev_name(ACPI_COMPANION(&pdev->dev)) : -- dev_name(&pdev->dev); -+ ljca_gpio->gc.label = ACPI_COMPANION(&auxdev->dev) ? -+ acpi_dev_name(ACPI_COMPANION(&auxdev->dev)) : -+ dev_name(&auxdev->dev); - ljca_gpio->gc.owner = THIS_MODULE; - -- platform_set_drvdata(pdev, ljca_gpio); -- ljca_register_event_cb(ljca_gpio->gpio_info->ljca, ljca_gpio_event_cb, ljca_gpio); -+ auxiliary_set_drvdata(auxdev, ljca_gpio); -+ ljca_register_event_cb(ljca, ljca_gpio_event_cb, ljca_gpio); - - girq = &ljca_gpio->gc.irq; - gpio_irq_chip_set_chip(girq, &ljca_gpio_irqchip); -@@ -413,7 +446,7 @@ static int ljca_gpio_probe(struct platform_device *pdev) - INIT_WORK(&ljca_gpio->work, ljca_gpio_async); - ret = gpiochip_add_data(&ljca_gpio->gc, ljca_gpio); - if (ret) { -- ljca_unregister_event_cb(ljca_gpio->gpio_info->ljca); -+ ljca_unregister_event_cb(ljca); - mutex_destroy(&ljca_gpio->irq_lock); - mutex_destroy(&ljca_gpio->trans_lock); - } -@@ -421,34 +454,33 @@ static int ljca_gpio_probe(struct platform_device *pdev) - return ret; - } - --static int ljca_gpio_remove(struct platform_device *pdev) -+static void ljca_gpio_remove(struct auxiliary_device *auxdev) - { -- struct ljca_gpio_dev *ljca_gpio = platform_get_drvdata(pdev); -+ struct ljca_gpio_dev *ljca_gpio = auxiliary_get_drvdata(auxdev); - - gpiochip_remove(&ljca_gpio->gc); -- ljca_unregister_event_cb(ljca_gpio->gpio_info->ljca); -+ ljca_unregister_event_cb(ljca_gpio->ljca); -+ cancel_work_sync(&ljca_gpio->work); - mutex_destroy(&ljca_gpio->irq_lock); - mutex_destroy(&ljca_gpio->trans_lock); -- return 0; - } - --#define LJCA_GPIO_DRV_NAME "ljca-gpio" --static const struct platform_device_id ljca_gpio_id[] = { -- { LJCA_GPIO_DRV_NAME, 0 }, -- { /* sentinel */ } -+static const struct auxiliary_device_id ljca_gpio_id_table[] = { -+ { "usb_ljca.ljca-gpio", 0 }, -+ { /* sentinel */ }, - }; --MODULE_DEVICE_TABLE(platform, ljca_gpio_id); -+MODULE_DEVICE_TABLE(auxiliary, ljca_gpio_id_table); - --static struct platform_driver ljca_gpio_driver = { -- .driver.name = LJCA_GPIO_DRV_NAME, -+static struct auxiliary_driver ljca_gpio_driver = { - .probe = ljca_gpio_probe, - .remove = ljca_gpio_remove, -+ .id_table = ljca_gpio_id_table, - }; --module_platform_driver(ljca_gpio_driver); -+module_auxiliary_driver(ljca_gpio_driver); - --MODULE_AUTHOR("Ye Xiang "); --MODULE_AUTHOR("Wang Zhifeng "); --MODULE_AUTHOR("Zhang Lixu "); -+MODULE_AUTHOR("Wentong Wu "); -+MODULE_AUTHOR("Zhifeng Wang "); -+MODULE_AUTHOR("Lixu Zhang "); - MODULE_DESCRIPTION("Intel La Jolla Cove Adapter USB-GPIO driver"); - MODULE_LICENSE("GPL"); - MODULE_IMPORT_NS(LJCA); -diff --git a/drivers/gpio/gpio-pci-idio-16.c b/drivers/gpio/gpio-pci-idio-16.c -index 44c0a21b1d1d9f..5827b18d190bdd 100644 ---- a/drivers/gpio/gpio-pci-idio-16.c -+++ b/drivers/gpio/gpio-pci-idio-16.c -@@ -41,6 +41,7 @@ static const struct regmap_config idio_16_regmap_config = { - .reg_stride = 1, - .val_bits = 8, - .io_port = true, -+ .max_register = 0x7, - .wr_table = &idio_16_wr_table, - .rd_table = &idio_16_rd_table, - .volatile_table = &idio_16_rd_table, -diff --git a/drivers/hwmon/sht3x.c b/drivers/hwmon/sht3x.c -index 79657910b79e64..d8a86e60cf8c1a 100644 ---- a/drivers/hwmon/sht3x.c -+++ b/drivers/hwmon/sht3x.c -@@ -288,24 +288,26 @@ static struct sht3x_data *sht3x_update_client(struct device *dev) - return data; - } - --static int temp1_input_read(struct device *dev) -+static int temp1_input_read(struct device *dev, long *temp) - { - struct sht3x_data *data = sht3x_update_client(dev); - - if (IS_ERR(data)) - return PTR_ERR(data); - -- return data->temperature; -+ *temp = data->temperature; -+ return 0; - } - --static int humidity1_input_read(struct device *dev) -+static int humidity1_input_read(struct device *dev, long *humidity) - { - struct sht3x_data *data = sht3x_update_client(dev); - - if (IS_ERR(data)) - return PTR_ERR(data); - -- return data->humidity; -+ *humidity = data->humidity; -+ return 0; - } - - /* -@@ -703,6 +705,7 @@ static int sht3x_read(struct device *dev, enum hwmon_sensor_types type, - u32 attr, int channel, long *val) - { - enum sht3x_limits index; -+ int ret; - - switch (type) { - case hwmon_chip: -@@ -717,10 +720,12 @@ static int sht3x_read(struct device *dev, enum hwmon_sensor_types type, - case hwmon_temp: - switch (attr) { - case hwmon_temp_input: -- *val = temp1_input_read(dev); -- break; -+ return temp1_input_read(dev, val); - case hwmon_temp_alarm: -- *val = temp1_alarm_read(dev); -+ ret = temp1_alarm_read(dev); -+ if (ret < 0) -+ return ret; -+ *val = ret; - break; - case hwmon_temp_max: - index = limit_max; -@@ -745,10 +750,12 @@ static int sht3x_read(struct device *dev, enum hwmon_sensor_types type, - case hwmon_humidity: - switch (attr) { - case hwmon_humidity_input: -- *val = humidity1_input_read(dev); -- break; -+ return humidity1_input_read(dev, val); - case hwmon_humidity_alarm: -- *val = humidity1_alarm_read(dev); -+ ret = humidity1_alarm_read(dev); -+ if (ret < 0) -+ return ret; -+ *val = ret; - break; - case hwmon_humidity_max: - index = limit_max; -diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c -index a85442d74e0928..c110fb606dfb8b 100644 ---- a/drivers/misc/fastrpc.c -+++ b/drivers/misc/fastrpc.c -@@ -383,6 +383,8 @@ static int fastrpc_map_lookup(struct fastrpc_user *fl, int fd, - } - spin_unlock(&fl->lock); - -+ dma_buf_put(buf); -+ - return ret; - } - -diff --git a/drivers/misc/lkdtm/fortify.c b/drivers/misc/lkdtm/fortify.c -index 0159276656780d..00ed2147113e69 100644 ---- a/drivers/misc/lkdtm/fortify.c -+++ b/drivers/misc/lkdtm/fortify.c -@@ -44,6 +44,9 @@ static void lkdtm_FORTIFY_STR_MEMBER(void) - char *src; - - src = kmalloc(size, GFP_KERNEL); -+ if (!src) -+ return; -+ - strscpy(src, "over ten bytes", size); - size = strlen(src) + 1; - -@@ -109,6 +112,9 @@ static void lkdtm_FORTIFY_MEM_MEMBER(void) - char *src; - - src = kmalloc(size, GFP_KERNEL); -+ if (!src) -+ return; -+ - strscpy(src, "over ten bytes", size); - size = strlen(src) + 1; - -diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h -index 4adfa5af162f1d..fcfc6c7e6dc8af 100644 ---- a/drivers/misc/mei/hw-me-regs.h -+++ b/drivers/misc/mei/hw-me-regs.h -@@ -120,6 +120,8 @@ - #define MEI_DEV_ID_PTL_H 0xE370 /* Panther Lake H */ - #define MEI_DEV_ID_PTL_P 0xE470 /* Panther Lake P */ - -+#define MEI_DEV_ID_WCL_P 0x4D70 /* Wildcat Lake P */ -+ - /* - * MEI HW Section - */ -diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c -index 93b98a7f4c7fd9..1a1df0390a40d0 100644 ---- a/drivers/misc/mei/pci-me.c -+++ b/drivers/misc/mei/pci-me.c -@@ -127,6 +127,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = { - {MEI_PCI_DEVICE(MEI_DEV_ID_PTL_H, MEI_ME_PCH15_CFG)}, - {MEI_PCI_DEVICE(MEI_DEV_ID_PTL_P, MEI_ME_PCH15_CFG)}, - -+ {MEI_PCI_DEVICE(MEI_DEV_ID_WCL_P, MEI_ME_PCH15_CFG)}, -+ - /* required last entry */ - {0, } - }; -diff --git a/drivers/most/most_usb.c b/drivers/most/most_usb.c -index 485d5ca399513c..988e33f2797046 100644 ---- a/drivers/most/most_usb.c -+++ b/drivers/most/most_usb.c -@@ -929,6 +929,10 @@ static void release_mdev(struct device *dev) - { - struct most_dev *mdev = to_mdev_from_dev(dev); - -+ kfree(mdev->busy_urbs); -+ kfree(mdev->cap); -+ kfree(mdev->conf); -+ kfree(mdev->ep_address); - kfree(mdev); - } - /** -@@ -1093,7 +1097,7 @@ hdm_probe(struct usb_interface *interface, const struct usb_device_id *id) - err_free_conf: - kfree(mdev->conf); - err_free_mdev: -- put_device(&mdev->dev); -+ kfree(mdev); - return ret; - } - -@@ -1121,13 +1125,6 @@ static void hdm_disconnect(struct usb_interface *interface) - if (mdev->dci) - device_unregister(&mdev->dci->dev); - most_deregister_interface(&mdev->iface); -- -- kfree(mdev->busy_urbs); -- kfree(mdev->cap); -- kfree(mdev->conf); -- kfree(mdev->ep_address); -- put_device(&mdev->dci->dev); -- put_device(&mdev->dev); - } - - static int hdm_suspend(struct usb_interface *interface, pm_message_t message) -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index f7ed129fc8110a..9aa328b958be47 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -2874,7 +2874,7 @@ static void bond_mii_monitor(struct work_struct *work) - { - struct bonding *bond = container_of(work, struct bonding, - mii_work.work); -- bool should_notify_peers = false; -+ bool should_notify_peers; - bool commit; - unsigned long delay; - struct slave *slave; -@@ -2886,30 +2886,33 @@ static void bond_mii_monitor(struct work_struct *work) - goto re_arm; - - rcu_read_lock(); -+ - should_notify_peers = bond_should_notify_peers(bond); - commit = !!bond_miimon_inspect(bond); -- if (bond->send_peer_notif) { -- rcu_read_unlock(); -- if (rtnl_trylock()) { -- bond->send_peer_notif--; -- rtnl_unlock(); -- } -- } else { -- rcu_read_unlock(); -- } - -- if (commit) { -+ rcu_read_unlock(); -+ -+ if (commit || bond->send_peer_notif) { - /* Race avoidance with bond_close cancel of workqueue */ - if (!rtnl_trylock()) { - delay = 1; -- should_notify_peers = false; - goto re_arm; - } - -- bond_for_each_slave(bond, slave, iter) { -- bond_commit_link_state(slave, BOND_SLAVE_NOTIFY_LATER); -+ if (commit) { -+ bond_for_each_slave(bond, slave, iter) { -+ bond_commit_link_state(slave, -+ BOND_SLAVE_NOTIFY_LATER); -+ } -+ bond_miimon_commit(bond); -+ } -+ -+ if (bond->send_peer_notif) { -+ bond->send_peer_notif--; -+ if (should_notify_peers) -+ call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, -+ bond->dev); - } -- bond_miimon_commit(bond); - - rtnl_unlock(); /* might sleep, hold no other locks */ - } -@@ -2917,13 +2920,6 @@ static void bond_mii_monitor(struct work_struct *work) - re_arm: - if (bond->params.miimon) - queue_delayed_work(bond->wq, &bond->mii_work, delay); -- -- if (should_notify_peers) { -- if (!rtnl_trylock()) -- return; -- call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, bond->dev); -- rtnl_unlock(); -- } - } - - static int bond_upper_dev_walk(struct net_device *upper, -diff --git a/drivers/net/can/bxcan.c b/drivers/net/can/bxcan.c -index 49cf9682b9254c..247d02447fc3f1 100644 ---- a/drivers/net/can/bxcan.c -+++ b/drivers/net/can/bxcan.c -@@ -842,7 +842,7 @@ static netdev_tx_t bxcan_start_xmit(struct sk_buff *skb, - u32 id; - int i, j; - -- if (can_dropped_invalid_skb(ndev, skb)) -+ if (can_dev_dropped_skb(ndev, skb)) - return NETDEV_TX_OK; - - if (bxcan_tx_busy(priv)) -diff --git a/drivers/net/can/dev/netlink.c b/drivers/net/can/dev/netlink.c -index abe8dc051d94f1..77d165ed0d5341 100644 ---- a/drivers/net/can/dev/netlink.c -+++ b/drivers/net/can/dev/netlink.c -@@ -285,7 +285,9 @@ static int can_changelink(struct net_device *dev, struct nlattr *tb[], - } - - if (data[IFLA_CAN_RESTART_MS]) { -- if (!priv->do_set_mode) { -+ unsigned int restart_ms = nla_get_u32(data[IFLA_CAN_RESTART_MS]); -+ -+ if (restart_ms != 0 && !priv->do_set_mode) { - NL_SET_ERR_MSG(extack, - "Device doesn't support restart from Bus Off"); - return -EOPNOTSUPP; -@@ -294,7 +296,7 @@ static int can_changelink(struct net_device *dev, struct nlattr *tb[], - /* Do not allow changing restart delay while running */ - if (dev->flags & IFF_UP) - return -EBUSY; -- priv->restart_ms = nla_get_u32(data[IFLA_CAN_RESTART_MS]); -+ priv->restart_ms = restart_ms; - } - - if (data[IFLA_CAN_RESTART]) { -diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c -index 0d201a57d7e29e..dd9c50d3ec0f03 100644 ---- a/drivers/net/ethernet/amazon/ena/ena_netdev.c -+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c -@@ -1310,7 +1310,7 @@ static int ena_clean_rx_irq(struct ena_ring *rx_ring, struct napi_struct *napi, - } - - if (xdp_flags & ENA_XDP_REDIRECT) -- xdp_do_flush_map(); -+ xdp_do_flush(); - - return work_done; - -diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c -index 81a99f4824d054..61bd2389ef4b54 100644 ---- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c -+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c -@@ -1077,8 +1077,7 @@ static int dpaa2_eth_build_single_fd(struct dpaa2_eth_priv *priv, - dma_addr_t addr; - - buffer_start = skb->data - dpaa2_eth_needed_headroom(skb); -- aligned_start = PTR_ALIGN(buffer_start - DPAA2_ETH_TX_BUF_ALIGN, -- DPAA2_ETH_TX_BUF_ALIGN); -+ aligned_start = PTR_ALIGN(buffer_start, DPAA2_ETH_TX_BUF_ALIGN); - if (aligned_start >= skb->head) - buffer_start = aligned_start; - else -diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c -index 0c09d82dbf00d4..7accf3a3e9f0dd 100644 ---- a/drivers/net/ethernet/freescale/enetc/enetc.c -+++ b/drivers/net/ethernet/freescale/enetc/enetc.c -@@ -1246,6 +1246,8 @@ static int enetc_clean_rx_ring(struct enetc_bdr *rx_ring, - /* next descriptor to process */ - i = rx_ring->next_to_clean; - -+ enetc_lock_mdio(); -+ - while (likely(rx_frm_cnt < work_limit)) { - union enetc_rx_bd *rxbd; - struct sk_buff *skb; -@@ -1281,7 +1283,9 @@ static int enetc_clean_rx_ring(struct enetc_bdr *rx_ring, - rx_byte_cnt += skb->len + ETH_HLEN; - rx_frm_cnt++; - -+ enetc_unlock_mdio(); - napi_gro_receive(napi, skb); -+ enetc_lock_mdio(); - } - - rx_ring->next_to_clean = i; -@@ -1289,6 +1293,8 @@ static int enetc_clean_rx_ring(struct enetc_bdr *rx_ring, - rx_ring->stats.packets += rx_frm_cnt; - rx_ring->stats.bytes += rx_byte_cnt; - -+ enetc_unlock_mdio(); -+ - return rx_frm_cnt; - } - -@@ -1598,6 +1604,8 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring, - /* next descriptor to process */ - i = rx_ring->next_to_clean; - -+ enetc_lock_mdio(); -+ - while (likely(rx_frm_cnt < work_limit)) { - union enetc_rx_bd *rxbd, *orig_rxbd; - int orig_i, orig_cleaned_cnt; -@@ -1657,7 +1665,9 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring, - if (unlikely(!skb)) - goto out; - -+ enetc_unlock_mdio(); - napi_gro_receive(napi, skb); -+ enetc_lock_mdio(); - break; - case XDP_TX: - tx_ring = priv->xdp_tx_ring[rx_ring->index]; -@@ -1692,7 +1702,9 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring, - } - break; - case XDP_REDIRECT: -+ enetc_unlock_mdio(); - err = xdp_do_redirect(rx_ring->ndev, &xdp_buff, prog); -+ enetc_lock_mdio(); - if (unlikely(err)) { - enetc_xdp_drop(rx_ring, orig_i, i); - rx_ring->stats.xdp_redirect_failures++; -@@ -1712,8 +1724,11 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring, - rx_ring->stats.packets += rx_frm_cnt; - rx_ring->stats.bytes += rx_byte_cnt; - -- if (xdp_redirect_frm_cnt) -- xdp_do_flush_map(); -+ if (xdp_redirect_frm_cnt) { -+ enetc_unlock_mdio(); -+ xdp_do_flush(); -+ enetc_lock_mdio(); -+ } - - if (xdp_tx_frm_cnt) - enetc_update_tx_ring_tail(tx_ring); -@@ -1722,6 +1737,8 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring, - enetc_refill_rx_ring(rx_ring, enetc_bd_unused(rx_ring) - - rx_ring->xdp.xdp_tx_in_flight); - -+ enetc_unlock_mdio(); -+ - return rx_frm_cnt; - } - -@@ -1740,6 +1757,7 @@ static int enetc_poll(struct napi_struct *napi, int budget) - for (i = 0; i < v->count_tx_rings; i++) - if (!enetc_clean_tx_ring(&v->tx_ring[i], budget)) - complete = false; -+ enetc_unlock_mdio(); - - prog = rx_ring->xdp.prog; - if (prog) -@@ -1751,10 +1769,8 @@ static int enetc_poll(struct napi_struct *napi, int budget) - if (work_done) - v->rx_napi_work = true; - -- if (!complete) { -- enetc_unlock_mdio(); -+ if (!complete) - return budget; -- } - - napi_complete_done(napi, work_done); - -@@ -1763,6 +1779,7 @@ static int enetc_poll(struct napi_struct *napi, int budget) - - v->rx_napi_work = false; - -+ enetc_lock_mdio(); - /* enable interrupts */ - enetc_wr_reg_hot(v->rbier, ENETC_RBIER_RXTIE); - -diff --git a/drivers/net/ethernet/freescale/enetc/enetc.h b/drivers/net/ethernet/freescale/enetc/enetc.h -index 860ecee302f1a6..dcf3e4b4e3f555 100644 ---- a/drivers/net/ethernet/freescale/enetc/enetc.h -+++ b/drivers/net/ethernet/freescale/enetc/enetc.h -@@ -41,7 +41,7 @@ struct enetc_tx_swbd { - }; - - #define ENETC_RX_MAXFRM_SIZE ENETC_MAC_MAXFRM_SIZE --#define ENETC_RXB_TRUESIZE 2048 /* PAGE_SIZE >> 1 */ -+#define ENETC_RXB_TRUESIZE (PAGE_SIZE >> 1) - #define ENETC_RXB_PAD NET_SKB_PAD /* add extra space if needed */ - #define ENETC_RXB_DMA_SIZE \ - (SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - ENETC_RXB_PAD) -diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c -index 8352d9b6469f2a..64cd72c1947837 100644 ---- a/drivers/net/ethernet/freescale/fec_main.c -+++ b/drivers/net/ethernet/freescale/fec_main.c -@@ -1904,7 +1904,7 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id) - rxq->bd.cur = bdp; - - if (xdp_result & FEC_ENET_XDP_REDIR) -- xdp_do_flush_map(); -+ xdp_do_flush(); - - return pkt_received; - } -diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c -index 6a9b47b005d29b..99604379c87b6c 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c -@@ -2398,7 +2398,7 @@ void i40e_update_rx_stats(struct i40e_ring *rx_ring, - void i40e_finalize_xdp_rx(struct i40e_ring *rx_ring, unsigned int xdp_res) - { - if (xdp_res & I40E_XDP_REDIR) -- xdp_do_flush_map(); -+ xdp_do_flush(); - - if (xdp_res & I40E_XDP_TX) { - struct i40e_ring *xdp_ring = -diff --git a/drivers/net/ethernet/intel/ice/ice_txrx_lib.c b/drivers/net/ethernet/intel/ice/ice_txrx_lib.c -index c8322fb6f2b37f..7e06373e14d98e 100644 ---- a/drivers/net/ethernet/intel/ice/ice_txrx_lib.c -+++ b/drivers/net/ethernet/intel/ice/ice_txrx_lib.c -@@ -450,7 +450,7 @@ void ice_finalize_xdp_rx(struct ice_tx_ring *xdp_ring, unsigned int xdp_res, - struct ice_tx_buf *tx_buf = &xdp_ring->tx_buf[first_idx]; - - if (xdp_res & ICE_XDP_REDIR) -- xdp_do_flush_map(); -+ xdp_do_flush(); - - if (xdp_res & ICE_XDP_TX) { - if (static_branch_unlikely(&ice_xdp_locking_key)) -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -index f245f3df40fcac..99876b765b08bc 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -@@ -2421,7 +2421,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector, - } - - if (xdp_xmit & IXGBE_XDP_REDIR) -- xdp_do_flush_map(); -+ xdp_do_flush(); - - if (xdp_xmit & IXGBE_XDP_TX) { - struct ixgbe_ring *ring = ixgbe_determine_xdp_ring(adapter); -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c -index 7ef82c30e85712..9fdd19acf2242f 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c -@@ -351,7 +351,7 @@ int ixgbe_clean_rx_irq_zc(struct ixgbe_q_vector *q_vector, - } - - if (xdp_xmit & IXGBE_XDP_REDIR) -- xdp_do_flush_map(); -+ xdp_do_flush(); - - if (xdp_xmit & IXGBE_XDP_TX) { - struct ixgbe_ring *ring = ixgbe_determine_xdp_ring(adapter); -diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c -index 165f76d1231c19..2941721b65152e 100644 ---- a/drivers/net/ethernet/marvell/mvneta.c -+++ b/drivers/net/ethernet/marvell/mvneta.c -@@ -2520,7 +2520,7 @@ static int mvneta_rx_swbm(struct napi_struct *napi, - mvneta_xdp_put_buff(pp, rxq, &xdp_buf, -1); - - if (ps.xdp_redirect) -- xdp_do_flush_map(); -+ xdp_do_flush(); - - if (ps.rx_packets) - mvneta_update_stats(pp, &ps); -diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c -index fce57faf345ce4..aabc39f7690f8e 100644 ---- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c -+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c -@@ -4055,7 +4055,7 @@ static int mvpp2_rx(struct mvpp2_port *port, struct napi_struct *napi, - } - - if (xdp_ret & MVPP2_XDP_REDIR) -- xdp_do_flush_map(); -+ xdp_do_flush(); - - if (ps.rx_packets) { - struct mvpp2_pcpu_stats *stats = this_cpu_ptr(port->stats); -diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c -index aefe2af6f01d41..c843e6531449ba 100644 ---- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c -+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c -@@ -2221,7 +2221,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget, - net_dim(ð->rx_dim, dim_sample); - - if (xdp_flush) -- xdp_do_flush_map(); -+ xdp_do_flush(); - - return done; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index 9cf33ae48c216f..455d02b6500d05 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -519,6 +519,12 @@ struct mlx5e_xdpsq { - struct mlx5e_channel *channel; - } ____cacheline_aligned_in_smp; - -+struct mlx5e_xdp_buff { -+ struct xdp_buff xdp; -+ struct mlx5_cqe64 *cqe; -+ struct mlx5e_rq *rq; -+}; -+ - struct mlx5e_ktls_resync_resp; - - struct mlx5e_icosq { -@@ -717,6 +723,7 @@ struct mlx5e_rq { - struct mlx5e_xdpsq *xdpsq; - DECLARE_BITMAP(flags, 8); - struct page_pool *page_pool; -+ struct mlx5e_xdp_buff mxbuf; - - /* AF_XDP zero-copy */ - struct xsk_buff_pool *xsk_pool; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -index dcd5db907f1028..9c22d64af68534 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -@@ -98,7 +98,7 @@ u8 mlx5e_mpwrq_umr_entry_size(enum mlx5e_mpwrq_umr_mode mode) - return sizeof(struct mlx5_ksm) * 4; - } - WARN_ONCE(1, "MPWRQ UMR mode %d is not known\n", mode); -- return 0; -+ return 1; - } - - u8 mlx5e_mpwrq_log_wqe_sz(struct mlx5_core_dev *mdev, u8 page_shift, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c -index b723ff5e5249cf..13c7ed1bb37e93 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c -@@ -895,7 +895,7 @@ void mlx5e_xdp_rx_poll_complete(struct mlx5e_rq *rq) - mlx5e_xmit_xdp_doorbell(xdpsq); - - if (test_bit(MLX5E_RQ_FLAG_XDP_REDIRECT, rq->flags)) { -- xdp_do_flush_map(); -+ xdp_do_flush(); - __clear_bit(MLX5E_RQ_FLAG_XDP_REDIRECT, rq->flags); - } - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h -index ecfe93a479da8e..38e9ff6aa3aee2 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h -@@ -44,12 +44,6 @@ - (MLX5E_XDP_INLINE_WQE_MAX_DS_CNT * MLX5_SEND_WQE_DS - \ - sizeof(struct mlx5_wqe_inline_seg)) - --struct mlx5e_xdp_buff { -- struct xdp_buff xdp; -- struct mlx5_cqe64 *cqe; -- struct mlx5e_rq *rq; --}; -- - /* XDP packets can be transmitted in different ways. On completion, we need to - * distinguish between them to clean up things in a proper way. - */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -index 8278395ee20a01..fcf7437174e189 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -@@ -1697,17 +1697,17 @@ mlx5e_skb_from_cqe_linear(struct mlx5e_rq *rq, struct mlx5e_wqe_frag_info *wi, - - prog = rcu_dereference(rq->xdp_prog); - if (prog) { -- struct mlx5e_xdp_buff mxbuf; -+ struct mlx5e_xdp_buff *mxbuf = &rq->mxbuf; - - net_prefetchw(va); /* xdp_frame data area */ - mlx5e_fill_mxbuf(rq, cqe, va, rx_headroom, rq->buff.frame0_sz, -- cqe_bcnt, &mxbuf); -- if (mlx5e_xdp_handle(rq, prog, &mxbuf)) -+ cqe_bcnt, mxbuf); -+ if (mlx5e_xdp_handle(rq, prog, mxbuf)) - return NULL; /* page/packet was consumed by XDP */ - -- rx_headroom = mxbuf.xdp.data - mxbuf.xdp.data_hard_start; -- metasize = mxbuf.xdp.data - mxbuf.xdp.data_meta; -- cqe_bcnt = mxbuf.xdp.data_end - mxbuf.xdp.data; -+ rx_headroom = mxbuf->xdp.data - mxbuf->xdp.data_hard_start; -+ metasize = mxbuf->xdp.data - mxbuf->xdp.data_meta; -+ cqe_bcnt = mxbuf->xdp.data_end - mxbuf->xdp.data; - } - frag_size = MLX5_SKB_FRAG_SZ(rx_headroom + cqe_bcnt); - skb = mlx5e_build_linear_skb(rq, va, frag_size, rx_headroom, cqe_bcnt, metasize); -@@ -1726,11 +1726,11 @@ mlx5e_skb_from_cqe_nonlinear(struct mlx5e_rq *rq, struct mlx5e_wqe_frag_info *wi - struct mlx5_cqe64 *cqe, u32 cqe_bcnt) - { - struct mlx5e_rq_frag_info *frag_info = &rq->wqe.info.arr[0]; -+ struct mlx5e_xdp_buff *mxbuf = &rq->mxbuf; - struct mlx5e_wqe_frag_info *head_wi = wi; - u16 rx_headroom = rq->buff.headroom; - struct mlx5e_frag_page *frag_page; - struct skb_shared_info *sinfo; -- struct mlx5e_xdp_buff mxbuf; - u32 frag_consumed_bytes; - struct bpf_prog *prog; - struct sk_buff *skb; -@@ -1750,8 +1750,8 @@ mlx5e_skb_from_cqe_nonlinear(struct mlx5e_rq *rq, struct mlx5e_wqe_frag_info *wi - net_prefetch(va + rx_headroom); - - mlx5e_fill_mxbuf(rq, cqe, va, rx_headroom, rq->buff.frame0_sz, -- frag_consumed_bytes, &mxbuf); -- sinfo = xdp_get_shared_info_from_buff(&mxbuf.xdp); -+ frag_consumed_bytes, mxbuf); -+ sinfo = xdp_get_shared_info_from_buff(&mxbuf->xdp); - truesize = 0; - - cqe_bcnt -= frag_consumed_bytes; -@@ -1763,8 +1763,9 @@ mlx5e_skb_from_cqe_nonlinear(struct mlx5e_rq *rq, struct mlx5e_wqe_frag_info *wi - - frag_consumed_bytes = min_t(u32, frag_info->frag_size, cqe_bcnt); - -- mlx5e_add_skb_shared_info_frag(rq, sinfo, &mxbuf.xdp, frag_page, -- wi->offset, frag_consumed_bytes); -+ mlx5e_add_skb_shared_info_frag(rq, sinfo, &mxbuf->xdp, -+ frag_page, wi->offset, -+ frag_consumed_bytes); - truesize += frag_info->frag_stride; - - cqe_bcnt -= frag_consumed_bytes; -@@ -1773,31 +1774,46 @@ mlx5e_skb_from_cqe_nonlinear(struct mlx5e_rq *rq, struct mlx5e_wqe_frag_info *wi - } - - prog = rcu_dereference(rq->xdp_prog); -- if (prog && mlx5e_xdp_handle(rq, prog, &mxbuf)) { -- if (__test_and_clear_bit(MLX5E_RQ_FLAG_XDP_XMIT, rq->flags)) { -- struct mlx5e_wqe_frag_info *pwi; -+ if (prog) { -+ u8 nr_frags_free, old_nr_frags = sinfo->nr_frags; -+ -+ if (mlx5e_xdp_handle(rq, prog, mxbuf)) { -+ if (__test_and_clear_bit(MLX5E_RQ_FLAG_XDP_XMIT, -+ rq->flags)) { -+ struct mlx5e_wqe_frag_info *pwi; -+ -+ wi -= old_nr_frags - sinfo->nr_frags; -+ -+ for (pwi = head_wi; pwi < wi; pwi++) -+ pwi->frag_page->frags++; -+ } -+ return NULL; /* page/packet was consumed by XDP */ -+ } - -- for (pwi = head_wi; pwi < wi; pwi++) -- pwi->frag_page->frags++; -+ nr_frags_free = old_nr_frags - sinfo->nr_frags; -+ if (unlikely(nr_frags_free)) { -+ wi -= nr_frags_free; -+ truesize -= nr_frags_free * frag_info->frag_stride; - } -- return NULL; /* page/packet was consumed by XDP */ - } - -- skb = mlx5e_build_linear_skb(rq, mxbuf.xdp.data_hard_start, rq->buff.frame0_sz, -- mxbuf.xdp.data - mxbuf.xdp.data_hard_start, -- mxbuf.xdp.data_end - mxbuf.xdp.data, -- mxbuf.xdp.data - mxbuf.xdp.data_meta); -+ skb = mlx5e_build_linear_skb( -+ rq, mxbuf->xdp.data_hard_start, rq->buff.frame0_sz, -+ mxbuf->xdp.data - mxbuf->xdp.data_hard_start, -+ mxbuf->xdp.data_end - mxbuf->xdp.data, -+ mxbuf->xdp.data - mxbuf->xdp.data_meta); - if (unlikely(!skb)) - return NULL; - - skb_mark_for_recycle(skb); - head_wi->frag_page->frags++; - -- if (xdp_buff_has_frags(&mxbuf.xdp)) { -+ if (xdp_buff_has_frags(&mxbuf->xdp)) { - /* sinfo->nr_frags is reset by build_skb, calculate again. */ - xdp_update_skb_shared_info(skb, wi - head_wi - 1, - sinfo->xdp_frags_size, truesize, -- xdp_buff_is_frag_pfmemalloc(&mxbuf.xdp)); -+ xdp_buff_is_frag_pfmemalloc( -+ &mxbuf->xdp)); - - for (struct mlx5e_wqe_frag_info *pwi = head_wi + 1; pwi < wi; pwi++) - pwi->frag_page->frags++; -@@ -2003,11 +2019,12 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *w - struct mlx5e_frag_page *frag_page = &wi->alloc_units.frag_pages[page_idx]; - u16 headlen = min_t(u16, MLX5E_RX_MAX_HEAD, cqe_bcnt); - struct mlx5e_frag_page *head_page = frag_page; -+ struct mlx5e_xdp_buff *mxbuf = &rq->mxbuf; - u32 frag_offset = head_offset; - u32 byte_cnt = cqe_bcnt; - struct skb_shared_info *sinfo; -- struct mlx5e_xdp_buff mxbuf; - unsigned int truesize = 0; -+ u32 pg_consumed_bytes; - struct bpf_prog *prog; - struct sk_buff *skb; - u32 linear_frame_sz; -@@ -2052,20 +2069,23 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *w - } - } - -- mlx5e_fill_mxbuf(rq, cqe, va, linear_hr, linear_frame_sz, linear_data_len, &mxbuf); -+ mlx5e_fill_mxbuf(rq, cqe, va, linear_hr, linear_frame_sz, -+ linear_data_len, mxbuf); - -- sinfo = xdp_get_shared_info_from_buff(&mxbuf.xdp); -+ sinfo = xdp_get_shared_info_from_buff(&mxbuf->xdp); - - while (byte_cnt) { - /* Non-linear mode, hence non-XSK, which always uses PAGE_SIZE. */ -- u32 pg_consumed_bytes = min_t(u32, PAGE_SIZE - frag_offset, byte_cnt); -+ pg_consumed_bytes = -+ min_t(u32, PAGE_SIZE - frag_offset, byte_cnt); - - if (test_bit(MLX5E_RQ_STATE_SHAMPO, &rq->state)) - truesize += pg_consumed_bytes; - else - truesize += ALIGN(pg_consumed_bytes, BIT(rq->mpwqe.log_stride_sz)); - -- mlx5e_add_skb_shared_info_frag(rq, sinfo, &mxbuf.xdp, frag_page, frag_offset, -+ mlx5e_add_skb_shared_info_frag(rq, sinfo, &mxbuf->xdp, -+ frag_page, frag_offset, - pg_consumed_bytes); - byte_cnt -= pg_consumed_bytes; - frag_offset = 0; -@@ -2073,10 +2093,15 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *w - } - - if (prog) { -- if (mlx5e_xdp_handle(rq, prog, &mxbuf)) { -+ u8 nr_frags_free, old_nr_frags = sinfo->nr_frags; -+ u32 len; -+ -+ if (mlx5e_xdp_handle(rq, prog, mxbuf)) { - if (__test_and_clear_bit(MLX5E_RQ_FLAG_XDP_XMIT, rq->flags)) { - struct mlx5e_frag_page *pfp; - -+ frag_page -= old_nr_frags - sinfo->nr_frags; -+ - for (pfp = head_page; pfp < frag_page; pfp++) - pfp->frags++; - -@@ -2086,10 +2111,20 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *w - return NULL; /* page/packet was consumed by XDP */ - } - -- skb = mlx5e_build_linear_skb(rq, mxbuf.xdp.data_hard_start, -- linear_frame_sz, -- mxbuf.xdp.data - mxbuf.xdp.data_hard_start, 0, -- mxbuf.xdp.data - mxbuf.xdp.data_meta); -+ nr_frags_free = old_nr_frags - sinfo->nr_frags; -+ if (unlikely(nr_frags_free)) { -+ frag_page -= nr_frags_free; -+ truesize -= (nr_frags_free - 1) * PAGE_SIZE + -+ ALIGN(pg_consumed_bytes, -+ BIT(rq->mpwqe.log_stride_sz)); -+ } -+ -+ len = mxbuf->xdp.data_end - mxbuf->xdp.data; -+ -+ skb = mlx5e_build_linear_skb( -+ rq, mxbuf->xdp.data_hard_start, linear_frame_sz, -+ mxbuf->xdp.data - mxbuf->xdp.data_hard_start, len, -+ mxbuf->xdp.data - mxbuf->xdp.data_meta); - if (unlikely(!skb)) { - mlx5e_page_release_fragmented(rq, &wi->linear_page); - return NULL; -@@ -2099,29 +2134,34 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *w - wi->linear_page.frags++; - mlx5e_page_release_fragmented(rq, &wi->linear_page); - -- if (xdp_buff_has_frags(&mxbuf.xdp)) { -+ if (xdp_buff_has_frags(&mxbuf->xdp)) { - struct mlx5e_frag_page *pagep; - - /* sinfo->nr_frags is reset by build_skb, calculate again. */ - xdp_update_skb_shared_info(skb, frag_page - head_page, - sinfo->xdp_frags_size, truesize, -- xdp_buff_is_frag_pfmemalloc(&mxbuf.xdp)); -+ xdp_buff_is_frag_pfmemalloc( -+ &mxbuf->xdp)); - - pagep = head_page; - do - pagep->frags++; - while (++pagep < frag_page); -+ -+ headlen = min_t(u16, MLX5E_RX_MAX_HEAD - len, -+ skb->data_len); -+ __pskb_pull_tail(skb, headlen); - } -- __pskb_pull_tail(skb, headlen); - } else { - dma_addr_t addr; - -- if (xdp_buff_has_frags(&mxbuf.xdp)) { -+ if (xdp_buff_has_frags(&mxbuf->xdp)) { - struct mlx5e_frag_page *pagep; - - xdp_update_skb_shared_info(skb, sinfo->nr_frags, - sinfo->xdp_frags_size, truesize, -- xdp_buff_is_frag_pfmemalloc(&mxbuf.xdp)); -+ xdp_buff_is_frag_pfmemalloc( -+ &mxbuf->xdp)); - - pagep = frag_page - sinfo->nr_frags; - do -@@ -2171,20 +2211,20 @@ mlx5e_skb_from_cqe_mpwrq_linear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *wi, - - prog = rcu_dereference(rq->xdp_prog); - if (prog) { -- struct mlx5e_xdp_buff mxbuf; -+ struct mlx5e_xdp_buff *mxbuf = &rq->mxbuf; - - net_prefetchw(va); /* xdp_frame data area */ - mlx5e_fill_mxbuf(rq, cqe, va, rx_headroom, rq->buff.frame0_sz, -- cqe_bcnt, &mxbuf); -- if (mlx5e_xdp_handle(rq, prog, &mxbuf)) { -+ cqe_bcnt, mxbuf); -+ if (mlx5e_xdp_handle(rq, prog, mxbuf)) { - if (__test_and_clear_bit(MLX5E_RQ_FLAG_XDP_XMIT, rq->flags)) - frag_page->frags++; - return NULL; /* page/packet was consumed by XDP */ - } - -- rx_headroom = mxbuf.xdp.data - mxbuf.xdp.data_hard_start; -- metasize = mxbuf.xdp.data - mxbuf.xdp.data_meta; -- cqe_bcnt = mxbuf.xdp.data_end - mxbuf.xdp.data; -+ rx_headroom = mxbuf->xdp.data - mxbuf->xdp.data_hard_start; -+ metasize = mxbuf->xdp.data - mxbuf->xdp.data_meta; -+ cqe_bcnt = mxbuf->xdp.data_end - mxbuf->xdp.data; - } - frag_size = MLX5_SKB_FRAG_SZ(rx_headroom + cqe_bcnt); - skb = mlx5e_build_linear_skb(rq, va, frag_size, rx_headroom, cqe_bcnt, metasize); -diff --git a/drivers/net/ethernet/netronome/nfp/nfd3/xsk.c b/drivers/net/ethernet/netronome/nfp/nfd3/xsk.c -index 5d9db8c2a5b437..45be6954d5aaea 100644 ---- a/drivers/net/ethernet/netronome/nfp/nfd3/xsk.c -+++ b/drivers/net/ethernet/netronome/nfp/nfd3/xsk.c -@@ -256,7 +256,7 @@ nfp_nfd3_xsk_rx(struct nfp_net_rx_ring *rx_ring, int budget, - nfp_net_xsk_rx_ring_fill_freelist(r_vec->rx_ring); - - if (xdp_redir) -- xdp_do_flush_map(); -+ xdp_do_flush(); - - if (tx_ring->wr_ptr_add) - nfp_net_tx_xmit_more_flush(tx_ring); -diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c -index 58fdc4f8dd4835..085d81576f1a47 100644 ---- a/drivers/net/ethernet/renesas/ravb_main.c -+++ b/drivers/net/ethernet/renesas/ravb_main.c -@@ -2038,15 +2038,35 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev) - - skb_tx_timestamp(skb); - } -- /* Descriptor type must be set after all the above writes */ -- dma_wmb(); -+ - if (num_tx_desc > 1) { - desc->die_dt = DT_FEND; - desc--; -+ /* When using multi-descriptors, DT_FEND needs to get written -+ * before DT_FSTART, but the compiler may reorder the memory -+ * writes in an attempt to optimize the code. -+ * Use a dma_wmb() barrier to make sure DT_FEND and DT_FSTART -+ * are written exactly in the order shown in the code. -+ * This is particularly important for cases where the DMA engine -+ * is already running when we are running this code. If the DMA -+ * sees DT_FSTART without the corresponding DT_FEND it will enter -+ * an error condition. -+ */ -+ dma_wmb(); - desc->die_dt = DT_FSTART; - } else { -+ /* Descriptor type must be set after all the above writes */ -+ dma_wmb(); - desc->die_dt = DT_FSINGLE; - } -+ -+ /* Before ringing the doorbell we need to make sure that the latest -+ * writes have been committed to memory, otherwise it could delay -+ * things until the doorbell is rang again. -+ * This is in replacement of the read operation mentioned in the HW -+ * manuals. -+ */ -+ dma_wmb(); - ravb_modify(ndev, TCCR, TCCR_TSRQ0 << q, TCCR_TSRQ0 << q); - - priv->cur_tx[q] += num_tx_desc; -diff --git a/drivers/net/ethernet/sfc/efx_channels.c b/drivers/net/ethernet/sfc/efx_channels.c -index 8d2d7ea2ebefc6..c9e17a8208a901 100644 ---- a/drivers/net/ethernet/sfc/efx_channels.c -+++ b/drivers/net/ethernet/sfc/efx_channels.c -@@ -1260,7 +1260,7 @@ static int efx_poll(struct napi_struct *napi, int budget) - - spent = efx_process_channel(channel, budget); - -- xdp_do_flush_map(); -+ xdp_do_flush(); - - if (spent < budget) { - if (efx_channel_has_rx_queue(channel) && -diff --git a/drivers/net/ethernet/sfc/siena/efx_channels.c b/drivers/net/ethernet/sfc/siena/efx_channels.c -index 1776f7f8a7a90e..a7346e965bfe70 100644 ---- a/drivers/net/ethernet/sfc/siena/efx_channels.c -+++ b/drivers/net/ethernet/sfc/siena/efx_channels.c -@@ -1285,7 +1285,7 @@ static int efx_poll(struct napi_struct *napi, int budget) - - spent = efx_process_channel(channel, budget); - -- xdp_do_flush_map(); -+ xdp_do_flush(); - - if (spent < budget) { - if (efx_channel_has_rx_queue(channel) && -diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c -index f358ea00319369..b834b129639f01 100644 ---- a/drivers/net/ethernet/socionext/netsec.c -+++ b/drivers/net/ethernet/socionext/netsec.c -@@ -780,7 +780,7 @@ static void netsec_finalize_xdp_rx(struct netsec_priv *priv, u32 xdp_res, - u16 pkts) - { - if (xdp_res & NETSEC_XDP_REDIR) -- xdp_do_flush_map(); -+ xdp_do_flush(); - - if (xdp_res & NETSEC_XDP_TX) - netsec_xdp_ring_tx_db(priv, pkts); -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c -index d920a50dd16c7c..bab315517bad91 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c -@@ -1565,14 +1565,15 @@ static int gmac_clk_enable(struct rk_priv_data *bsp_priv, bool enable) - } - } else { - if (bsp_priv->clk_enabled) { -+ if (bsp_priv->ops && bsp_priv->ops->set_clock_selection) { -+ bsp_priv->ops->set_clock_selection(bsp_priv, -+ bsp_priv->clock_input, false); -+ } -+ - clk_bulk_disable_unprepare(bsp_priv->num_clks, - bsp_priv->clks); - clk_disable_unprepare(bsp_priv->clk_phy); - -- if (bsp_priv->ops && bsp_priv->ops->set_clock_selection) -- bsp_priv->ops->set_clock_selection(bsp_priv, -- bsp_priv->clock_input, false); -- - bsp_priv->clk_enabled = false; - } - } -diff --git a/drivers/net/ethernet/ti/cpsw_priv.c b/drivers/net/ethernet/ti/cpsw_priv.c -index 0ec85635dfd60a..764ed298b57081 100644 ---- a/drivers/net/ethernet/ti/cpsw_priv.c -+++ b/drivers/net/ethernet/ti/cpsw_priv.c -@@ -1360,7 +1360,7 @@ int cpsw_run_xdp(struct cpsw_priv *priv, int ch, struct xdp_buff *xdp, - * particular hardware is sharing a common queue, so the - * incoming device might change per packet. - */ -- xdp_do_flush_map(); -+ xdp_do_flush(); - break; - default: - bpf_warn_invalid_xdp_action(ndev, prog, act); -diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c -index 92add3daadbb18..278e6cb6f4d99a 100644 ---- a/drivers/net/usb/rtl8150.c -+++ b/drivers/net/usb/rtl8150.c -@@ -685,9 +685,16 @@ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, - rtl8150_t *dev = netdev_priv(netdev); - int count, res; - -+ /* pad the frame and ensure terminating USB packet, datasheet 9.2.3 */ -+ count = max(skb->len, ETH_ZLEN); -+ if (count % 64 == 0) -+ count++; -+ if (skb_padto(skb, count)) { -+ netdev->stats.tx_dropped++; -+ return NETDEV_TX_OK; -+ } -+ - netif_stop_queue(netdev); -- count = (skb->len < 60) ? 60 : skb->len; -- count = (count & 0x3f) ? count : count + 1; - dev->tx_skb = skb; - usb_fill_bulk_urb(dev->tx_urb, dev->udev, usb_sndbulkpipe(dev->udev, 2), - skb->data, count, write_bulk_callback, dev); -diff --git a/drivers/perf/hisilicon/hisi_uncore_pmu.c b/drivers/perf/hisilicon/hisi_uncore_pmu.c -index 04031450d5feca..c3013059cca82a 100644 ---- a/drivers/perf/hisilicon/hisi_uncore_pmu.c -+++ b/drivers/perf/hisilicon/hisi_uncore_pmu.c -@@ -212,7 +212,7 @@ int hisi_uncore_pmu_event_init(struct perf_event *event) - return -EINVAL; - - hisi_pmu = to_hisi_pmu(event->pmu); -- if (event->attr.config > hisi_pmu->check_event) -+ if ((event->attr.config & HISI_EVENTID_MASK) > hisi_pmu->check_event) - return -EINVAL; - - if (hisi_pmu->on_cpu == -1) -diff --git a/drivers/perf/hisilicon/hisi_uncore_pmu.h b/drivers/perf/hisilicon/hisi_uncore_pmu.h -index 92402aa69d70f5..67d1c3d3a41c0a 100644 ---- a/drivers/perf/hisilicon/hisi_uncore_pmu.h -+++ b/drivers/perf/hisilicon/hisi_uncore_pmu.h -@@ -43,7 +43,8 @@ - return FIELD_GET(GENMASK_ULL(hi, lo), event->attr.config); \ - } - --#define HISI_GET_EVENTID(ev) (ev->hw.config_base & 0xff) -+#define HISI_EVENTID_MASK GENMASK(7, 0) -+#define HISI_GET_EVENTID(ev) ((ev)->hw.config_base & HISI_EVENTID_MASK) - - #define HISI_PMU_EVTYPE_BITS 8 - #define HISI_PMU_EVTYPE_SHIFT(idx) ((idx) % 4 * HISI_PMU_EVTYPE_BITS) -diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c -index 6b374026cd4f44..3942aa49217696 100644 ---- a/drivers/s390/cio/device.c -+++ b/drivers/s390/cio/device.c -@@ -1318,23 +1318,34 @@ void ccw_device_schedule_recovery(void) - spin_unlock_irqrestore(&recovery_lock, flags); - } - --static int purge_fn(struct device *dev, void *data) -+static int purge_fn(struct subchannel *sch, void *data) - { -- struct ccw_device *cdev = to_ccwdev(dev); -- struct ccw_dev_id *id = &cdev->private->dev_id; -- struct subchannel *sch = to_subchannel(cdev->dev.parent); -+ struct ccw_device *cdev; - -- spin_lock_irq(cdev->ccwlock); -- if (is_blacklisted(id->ssid, id->devno) && -- (cdev->private->state == DEV_STATE_OFFLINE) && -- (atomic_cmpxchg(&cdev->private->onoff, 0, 1) == 0)) { -- CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x\n", id->ssid, -- id->devno); -+ spin_lock_irq(sch->lock); -+ if (sch->st != SUBCHANNEL_TYPE_IO || !sch->schib.pmcw.dnv) -+ goto unlock; -+ -+ if (!is_blacklisted(sch->schid.ssid, sch->schib.pmcw.dev)) -+ goto unlock; -+ -+ cdev = sch_get_cdev(sch); -+ if (cdev) { -+ if (cdev->private->state != DEV_STATE_OFFLINE) -+ goto unlock; -+ -+ if (atomic_cmpxchg(&cdev->private->onoff, 0, 1) != 0) -+ goto unlock; - ccw_device_sched_todo(cdev, CDEV_TODO_UNREG); -- css_sched_sch_todo(sch, SCH_TODO_UNREG); - atomic_set(&cdev->private->onoff, 0); - } -- spin_unlock_irq(cdev->ccwlock); -+ -+ css_sched_sch_todo(sch, SCH_TODO_UNREG); -+ CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x%s\n", sch->schid.ssid, -+ sch->schib.pmcw.dev, cdev ? "" : " (no cdev)"); -+ -+unlock: -+ spin_unlock_irq(sch->lock); - /* Abort loop in case of pending signal. */ - if (signal_pending(current)) - return -EINTR; -@@ -1350,7 +1361,7 @@ static int purge_fn(struct device *dev, void *data) - int ccw_purge_blacklisted(void) - { - CIO_MSG_EVENT(2, "ccw: purging blacklisted devices\n"); -- bus_for_each_dev(&ccw_bus_type, NULL, NULL, purge_fn); -+ for_each_subchannel_staged(purge_fn, NULL, NULL); - return 0; - } - -diff --git a/drivers/spi/spi-nxp-fspi.c b/drivers/spi/spi-nxp-fspi.c -index bc6c086ddd43f4..731504ec7ef8b0 100644 ---- a/drivers/spi/spi-nxp-fspi.c -+++ b/drivers/spi/spi-nxp-fspi.c -@@ -665,6 +665,12 @@ static void nxp_fspi_dll_calibration(struct nxp_fspi *f) - 0, POLL_TOUT, true); - if (ret) - dev_warn(f->dev, "DLL lock failed, please fix it!\n"); -+ -+ /* -+ * For ERR050272, DLL lock status bit is not accurate, -+ * wait for 4us more as a workaround. -+ */ -+ udelay(4); - } - - /* -diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c -index eaf4a907380aa4..57b27f9ea1f034 100644 ---- a/drivers/tty/serial/8250/8250_dw.c -+++ b/drivers/tty/serial/8250/8250_dw.c -@@ -653,7 +653,9 @@ static int dw8250_probe(struct platform_device *pdev) - if (IS_ERR(data->rst)) - return PTR_ERR(data->rst); - -- reset_control_deassert(data->rst); -+ err = reset_control_deassert(data->rst); -+ if (err) -+ return dev_err_probe(dev, err, "failed to deassert resets\n"); - - err = devm_add_action_or_reset(dev, dw8250_reset_control_assert, data->rst); - if (err) -diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c -index 27430fdd9e761c..e79ee33d432c90 100644 ---- a/drivers/tty/serial/8250/8250_exar.c -+++ b/drivers/tty/serial/8250/8250_exar.c -@@ -33,6 +33,8 @@ - #define PCI_DEVICE_ID_ACCESSIO_COM_4SM 0x10db - #define PCI_DEVICE_ID_ACCESSIO_COM_8SM 0x10ea - -+#define PCI_DEVICE_ID_ADVANTECH_XR17V352 0x0018 -+ - #define PCI_DEVICE_ID_COMMTECH_4224PCI335 0x0002 - #define PCI_DEVICE_ID_COMMTECH_4222PCI335 0x0004 - #define PCI_DEVICE_ID_COMMTECH_2324PCI335 0x000a -@@ -845,6 +847,12 @@ static const struct exar8250_board pbn_fastcom35x_8 = { - .exit = pci_xr17v35x_exit, - }; - -+static const struct exar8250_board pbn_adv_XR17V352 = { -+ .num_ports = 2, -+ .setup = pci_xr17v35x_setup, -+ .exit = pci_xr17v35x_exit, -+}; -+ - static const struct exar8250_board pbn_exar_XR17V4358 = { - .num_ports = 12, - .setup = pci_xr17v35x_setup, -@@ -914,6 +922,9 @@ static const struct pci_device_id exar_pci_tbl[] = { - USR_DEVICE(XR17C152, 2980, pbn_exar_XR17C15x), - USR_DEVICE(XR17C152, 2981, pbn_exar_XR17C15x), - -+ /* ADVANTECH devices */ -+ EXAR_DEVICE(ADVANTECH, XR17V352, pbn_adv_XR17V352), -+ - /* Exar Corp. XR17C15[248] Dual/Quad/Octal UART */ - EXAR_DEVICE(EXAR, XR17C152, pbn_exar_XR17C15x), - EXAR_DEVICE(EXAR, XR17C154, pbn_exar_XR17C15x), -diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c -index 28f9a2679a20e8..c4a2a3e289c14e 100644 ---- a/drivers/tty/serial/8250/8250_mtk.c -+++ b/drivers/tty/serial/8250/8250_mtk.c -@@ -435,6 +435,7 @@ static int __maybe_unused mtk8250_runtime_suspend(struct device *dev) - while - (serial_in(up, MTK_UART_DEBUG0)); - -+ clk_disable_unprepare(data->uart_clk); - clk_disable_unprepare(data->bus_clk); - - return 0; -@@ -445,6 +446,7 @@ static int __maybe_unused mtk8250_runtime_resume(struct device *dev) - struct mtk8250_data *data = dev_get_drvdata(dev); - - clk_prepare_enable(data->bus_clk); -+ clk_prepare_enable(data->uart_clk); - - return 0; - } -@@ -475,13 +477,13 @@ static int mtk8250_probe_of(struct platform_device *pdev, struct uart_port *p, - int dmacnt; - #endif - -- data->uart_clk = devm_clk_get(&pdev->dev, "baud"); -+ data->uart_clk = devm_clk_get_enabled(&pdev->dev, "baud"); - if (IS_ERR(data->uart_clk)) { - /* - * For compatibility with older device trees try unnamed - * clk when no baud clk can be found. - */ -- data->uart_clk = devm_clk_get(&pdev->dev, NULL); -+ data->uart_clk = devm_clk_get_enabled(&pdev->dev, NULL); - if (IS_ERR(data->uart_clk)) { - dev_warn(&pdev->dev, "Can't get uart clock\n"); - return PTR_ERR(data->uart_clk); -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index c0fd8ab3fe8fc2..c322d0c1d965a8 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -464,6 +464,8 @@ static const struct usb_device_id usb_quirk_list[] = { - /* Huawei 4G LTE module */ - { USB_DEVICE(0x12d1, 0x15bb), .driver_info = - USB_QUIRK_DISCONNECT_SUSPEND }, -+ { USB_DEVICE(0x12d1, 0x15c1), .driver_info = -+ USB_QUIRK_DISCONNECT_SUSPEND }, - { USB_DEVICE(0x12d1, 0x15c3), .driver_info = - USB_QUIRK_DISCONNECT_SUSPEND }, - -diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c -index ea106ad665a1fa..2deab4a6030d77 100644 ---- a/drivers/usb/gadget/legacy/raw_gadget.c -+++ b/drivers/usb/gadget/legacy/raw_gadget.c -@@ -620,8 +620,6 @@ static void *raw_alloc_io_data(struct usb_raw_ep_io *io, void __user *ptr, - return ERR_PTR(-EINVAL); - if (!usb_raw_io_flags_valid(io->flags)) - return ERR_PTR(-EINVAL); -- if (io->length > PAGE_SIZE) -- return ERR_PTR(-EINVAL); - if (get_from_user) - data = memdup_user(ptr + sizeof(*io), io->length); - else { -diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c -index 764657070883c1..bfd437269800cf 100644 ---- a/drivers/usb/host/xhci-dbgcap.c -+++ b/drivers/usb/host/xhci-dbgcap.c -@@ -1319,8 +1319,15 @@ int xhci_dbc_suspend(struct xhci_hcd *xhci) - if (!dbc) - return 0; - -- if (dbc->state == DS_CONFIGURED) -+ switch (dbc->state) { -+ case DS_ENABLED: -+ case DS_CONNECTED: -+ case DS_CONFIGURED: - dbc->resume_required = 1; -+ break; -+ default: -+ break; -+ } - - xhci_dbc_stop(dbc); - -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index dca610369ca94a..e9d0d8591a01f2 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -273,6 +273,7 @@ static void option_instat_callback(struct urb *urb); - #define QUECTEL_PRODUCT_EM05CN 0x0312 - #define QUECTEL_PRODUCT_EM05G_GR 0x0313 - #define QUECTEL_PRODUCT_EM05G_RS 0x0314 -+#define QUECTEL_PRODUCT_RG255C 0x0316 - #define QUECTEL_PRODUCT_EM12 0x0512 - #define QUECTEL_PRODUCT_RM500Q 0x0800 - #define QUECTEL_PRODUCT_RM520N 0x0801 -@@ -617,6 +618,7 @@ static void option_instat_callback(struct urb *urb); - #define UNISOC_VENDOR_ID 0x1782 - /* TOZED LT70-C based on UNISOC SL8563 uses UNISOC's vendor ID */ - #define TOZED_PRODUCT_LT70C 0x4055 -+#define UNISOC_PRODUCT_UIS7720 0x4064 - /* Luat Air72*U series based on UNISOC UIS8910 uses UNISOC's vendor ID */ - #define LUAT_PRODUCT_AIR720U 0x4e00 - -@@ -1270,6 +1272,9 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) }, - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG650V, 0xff, 0xff, 0x30) }, - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG650V, 0xff, 0, 0) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG255C, 0xff, 0xff, 0x30) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG255C, 0xff, 0, 0) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG255C, 0xff, 0xff, 0x40) }, - - { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, - { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, -@@ -1398,10 +1403,14 @@ static const struct usb_device_id option_ids[] = { - .driver_info = RSVD(0) | NCTRL(3) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a2, 0xff), /* Telit FN920C04 (MBIM) */ - .driver_info = NCTRL(4) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a3, 0xff), /* Telit FN920C04 (ECM) */ -+ .driver_info = NCTRL(4) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a4, 0xff), /* Telit FN20C04 (rmnet) */ - .driver_info = RSVD(0) | NCTRL(3) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a7, 0xff), /* Telit FN920C04 (MBIM) */ - .driver_info = NCTRL(4) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a8, 0xff), /* Telit FN920C04 (ECM) */ -+ .driver_info = NCTRL(4) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a9, 0xff), /* Telit FN20C04 (rmnet) */ - .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10aa, 0xff), /* Telit FN920C04 (MBIM) */ -@@ -2466,6 +2475,7 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9291, 0xff, 0xff, 0x30) }, - { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9291, 0xff, 0xff, 0x40) }, - { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, UNISOC_PRODUCT_UIS7720, 0xff, 0, 0) }, - { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, - { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0530, 0xff), /* TCL IK512 MBIM */ - .driver_info = NCTRL(1) }, -diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c -index 5774b50eeaf7f7..2e39686e01c9e0 100644 ---- a/drivers/usb/typec/tcpm/tcpm.c -+++ b/drivers/usb/typec/tcpm/tcpm.c -@@ -6636,9 +6636,9 @@ struct tcpm_port *tcpm_register_port(struct device *dev, struct tcpc_dev *tcpc) - port->partner_desc.identity = &port->partner_ident; - port->port_type = port->typec_caps.type; - -- port->role_sw = usb_role_switch_get(port->dev); -+ port->role_sw = fwnode_usb_role_switch_get(tcpc->fwnode); - if (!port->role_sw) -- port->role_sw = fwnode_usb_role_switch_get(tcpc->fwnode); -+ port->role_sw = usb_role_switch_get(port->dev); - if (IS_ERR(port->role_sw)) { - err = PTR_ERR(port->role_sw); - goto out_destroy_wq; -diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c -index 0455dddb0797c9..0b17657690d4d5 100644 ---- a/fs/dlm/lockspace.c -+++ b/fs/dlm/lockspace.c -@@ -802,7 +802,7 @@ static int release_lockspace(struct dlm_ls *ls, int force) - - dlm_device_deregister(ls); - -- if (force < 3 && dlm_user_daemon_available()) -+ if (force != 3 && dlm_user_daemon_available()) - do_uevent(ls, 0); - - dlm_recoverd_stop(ls); -diff --git a/fs/exec.c b/fs/exec.c -index ee71a315cc51f5..a7dfac338a22c8 100644 ---- a/fs/exec.c -+++ b/fs/exec.c -@@ -748,7 +748,7 @@ int setup_arg_pages(struct linux_binprm *bprm, - unsigned long stack_top, - int executable_stack) - { -- unsigned long ret; -+ int ret; - unsigned long stack_shift; - struct mm_struct *mm = current->mm; - struct vm_area_struct *vma = bprm->vma; -diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c -index 0b84284ece98fa..387d43aa89e3d3 100644 ---- a/fs/fuse/dir.c -+++ b/fs/fuse/dir.c -@@ -634,7 +634,7 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, - goto out_err; - - err = -ENOMEM; -- ff = fuse_file_alloc(fm); -+ ff = fuse_file_alloc(fm, true); - if (!ff) - goto out_put_forget_req; - -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index 952c99fcb636dc..2055af1ffaf339 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -55,7 +55,7 @@ struct fuse_release_args { - struct inode *inode; - }; - --struct fuse_file *fuse_file_alloc(struct fuse_mount *fm) -+struct fuse_file *fuse_file_alloc(struct fuse_mount *fm, bool release) - { - struct fuse_file *ff; - -@@ -64,11 +64,13 @@ struct fuse_file *fuse_file_alloc(struct fuse_mount *fm) - return NULL; - - ff->fm = fm; -- ff->release_args = kzalloc(sizeof(*ff->release_args), -- GFP_KERNEL_ACCOUNT); -- if (!ff->release_args) { -- kfree(ff); -- return NULL; -+ if (release) { -+ ff->release_args = kzalloc(sizeof(*ff->release_args), -+ GFP_KERNEL_ACCOUNT); -+ if (!ff->release_args) { -+ kfree(ff); -+ return NULL; -+ } - } - - INIT_LIST_HEAD(&ff->write_entry); -@@ -104,14 +106,14 @@ static void fuse_release_end(struct fuse_mount *fm, struct fuse_args *args, - kfree(ra); - } - --static void fuse_file_put(struct fuse_file *ff, bool sync, bool isdir) -+static void fuse_file_put(struct fuse_file *ff, bool sync) - { - if (refcount_dec_and_test(&ff->count)) { -- struct fuse_args *args = &ff->release_args->args; -+ struct fuse_release_args *ra = ff->release_args; -+ struct fuse_args *args = (ra ? &ra->args : NULL); - -- if (isdir ? ff->fm->fc->no_opendir : ff->fm->fc->no_open) { -- /* Do nothing when client does not implement 'open' */ -- fuse_release_end(ff->fm, args, 0); -+ if (!args) { -+ /* Do nothing when server does not implement 'open' */ - } else if (sync) { - fuse_simple_request(ff->fm, args); - fuse_release_end(ff->fm, args, 0); -@@ -131,15 +133,16 @@ struct fuse_file *fuse_file_open(struct fuse_mount *fm, u64 nodeid, - struct fuse_conn *fc = fm->fc; - struct fuse_file *ff; - int opcode = isdir ? FUSE_OPENDIR : FUSE_OPEN; -+ bool open = isdir ? !fc->no_opendir : !fc->no_open; - -- ff = fuse_file_alloc(fm); -+ ff = fuse_file_alloc(fm, open); - if (!ff) - return ERR_PTR(-ENOMEM); - - ff->fh = 0; - /* Default for no-open */ - ff->open_flags = FOPEN_KEEP_CACHE | (isdir ? FOPEN_CACHE_DIR : 0); -- if (isdir ? !fc->no_opendir : !fc->no_open) { -+ if (open) { - struct fuse_open_out outarg; - int err; - -@@ -147,11 +150,13 @@ struct fuse_file *fuse_file_open(struct fuse_mount *fm, u64 nodeid, - if (!err) { - ff->fh = outarg.fh; - ff->open_flags = outarg.open_flags; -- - } else if (err != -ENOSYS) { - fuse_file_free(ff); - return ERR_PTR(err); - } else { -+ /* No release needed */ -+ kfree(ff->release_args); -+ ff->release_args = NULL; - if (isdir) - fc->no_opendir = 1; - else -@@ -273,7 +278,7 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir) - } - - static void fuse_prepare_release(struct fuse_inode *fi, struct fuse_file *ff, -- unsigned int flags, int opcode) -+ unsigned int flags, int opcode, bool sync) - { - struct fuse_conn *fc = ff->fm->fc; - struct fuse_release_args *ra = ff->release_args; -@@ -291,6 +296,9 @@ static void fuse_prepare_release(struct fuse_inode *fi, struct fuse_file *ff, - - wake_up_interruptible_all(&ff->poll_wait); - -+ if (!ra) -+ return; -+ - ra->inarg.fh = ff->fh; - ra->inarg.flags = flags; - ra->args.in_numargs = 1; -@@ -300,6 +308,13 @@ static void fuse_prepare_release(struct fuse_inode *fi, struct fuse_file *ff, - ra->args.nodeid = ff->nodeid; - ra->args.force = true; - ra->args.nocreds = true; -+ -+ /* -+ * Hold inode until release is finished. -+ * From fuse_sync_release() the refcount is 1 and everything's -+ * synchronous, so we are fine with not doing igrab() here. -+ */ -+ ra->inode = sync ? NULL : igrab(&fi->inode); - } - - void fuse_file_release(struct inode *inode, struct fuse_file *ff, -@@ -309,14 +324,12 @@ void fuse_file_release(struct inode *inode, struct fuse_file *ff, - struct fuse_release_args *ra = ff->release_args; - int opcode = isdir ? FUSE_RELEASEDIR : FUSE_RELEASE; - -- fuse_prepare_release(fi, ff, open_flags, opcode); -+ fuse_prepare_release(fi, ff, open_flags, opcode, false); - -- if (ff->flock) { -+ if (ra && ff->flock) { - ra->inarg.release_flags |= FUSE_RELEASE_FLOCK_UNLOCK; - ra->inarg.lock_owner = fuse_lock_owner_id(ff->fm->fc, id); - } -- /* Hold inode until release is finished */ -- ra->inode = igrab(inode); - - /* - * Normally this will send the RELEASE request, however if -@@ -326,8 +339,14 @@ void fuse_file_release(struct inode *inode, struct fuse_file *ff, - * Make the release synchronous if this is a fuseblk mount, - * synchronous RELEASE is allowed (and desirable) in this case - * because the server can be trusted not to screw up. -+ * -+ * Always use the asynchronous file put because the current thread -+ * might be the fuse server. This can happen if a process starts some -+ * aio and closes the fd before the aio completes. Since aio takes its -+ * own ref to the file, the IO completion has to drop the ref, which is -+ * how the fuse server can end up closing its clients' files. - */ -- fuse_file_put(ff, ff->fm->fc->destroy, isdir); -+ fuse_file_put(ff, false); - } - - void fuse_release_common(struct file *file, bool isdir) -@@ -362,12 +381,8 @@ void fuse_sync_release(struct fuse_inode *fi, struct fuse_file *ff, - unsigned int flags) - { - WARN_ON(refcount_read(&ff->count) > 1); -- fuse_prepare_release(fi, ff, flags, FUSE_RELEASE); -- /* -- * iput(NULL) is a no-op and since the refcount is 1 and everything's -- * synchronous, we are fine with not doing igrab() here" -- */ -- fuse_file_put(ff, true, false); -+ fuse_prepare_release(fi, ff, flags, FUSE_RELEASE, true); -+ fuse_file_put(ff, true); - } - EXPORT_SYMBOL_GPL(fuse_sync_release); - -@@ -924,7 +939,7 @@ static void fuse_readpages_end(struct fuse_mount *fm, struct fuse_args *args, - put_page(page); - } - if (ia->ff) -- fuse_file_put(ia->ff, false, false); -+ fuse_file_put(ia->ff, false); - - fuse_io_free(ia); - } -@@ -1666,7 +1681,7 @@ static void fuse_writepage_free(struct fuse_writepage_args *wpa) - __free_page(ap->pages[i]); - - if (wpa->ia.ff) -- fuse_file_put(wpa->ia.ff, false, false); -+ fuse_file_put(wpa->ia.ff, false); - - kfree(ap->pages); - kfree(wpa); -@@ -1914,7 +1929,7 @@ int fuse_write_inode(struct inode *inode, struct writeback_control *wbc) - ff = __fuse_write_file_get(fi); - err = fuse_flush_times(inode, ff); - if (ff) -- fuse_file_put(ff, false, false); -+ fuse_file_put(ff, false); - - return err; - } -@@ -2312,7 +2327,7 @@ static int fuse_writepages(struct address_space *mapping, - fuse_writepages_send(&data); - } - if (data.ff) -- fuse_file_put(data.ff, false, false); -+ fuse_file_put(data.ff, false); - - kfree(data.orig_pages); - out: -diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h -index 4ce1a6fdc94f03..aa12ff6de70686 100644 ---- a/fs/fuse/fuse_i.h -+++ b/fs/fuse/fuse_i.h -@@ -1036,7 +1036,7 @@ void fuse_read_args_fill(struct fuse_io_args *ia, struct file *file, loff_t pos, - */ - int fuse_open_common(struct inode *inode, struct file *file, bool isdir); - --struct fuse_file *fuse_file_alloc(struct fuse_mount *fm); -+struct fuse_file *fuse_file_alloc(struct fuse_mount *fm, bool release); - void fuse_file_free(struct fuse_file *ff); - void fuse_finish_open(struct inode *inode, struct file *file); - -diff --git a/fs/hfs/bfind.c b/fs/hfs/bfind.c -index 34e9804e0f3601..e46f650b5e9c26 100644 ---- a/fs/hfs/bfind.c -+++ b/fs/hfs/bfind.c -@@ -21,7 +21,7 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) - - fd->tree = tree; - fd->bnode = NULL; -- ptr = kmalloc(tree->max_key_len * 2 + 4, GFP_KERNEL); -+ ptr = kzalloc(tree->max_key_len * 2 + 4, GFP_KERNEL); - if (!ptr) - return -ENOMEM; - fd->search_key = ptr; -@@ -115,6 +115,12 @@ int hfs_brec_find(struct hfs_find_data *fd) - __be32 data; - int height, res; - -+ fd->record = -1; -+ fd->keyoffset = -1; -+ fd->keylength = -1; -+ fd->entryoffset = -1; -+ fd->entrylength = -1; -+ - tree = fd->tree; - if (fd->bnode) - hfs_bnode_put(fd->bnode); -diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c -index 896396554bcc17..b01db1fae147cd 100644 ---- a/fs/hfs/brec.c -+++ b/fs/hfs/brec.c -@@ -179,6 +179,7 @@ int hfs_brec_remove(struct hfs_find_data *fd) - struct hfs_btree *tree; - struct hfs_bnode *node, *parent; - int end_off, rec_off, data_off, size; -+ int src, dst, len; - - tree = fd->tree; - node = fd->bnode; -@@ -208,10 +209,14 @@ int hfs_brec_remove(struct hfs_find_data *fd) - } - hfs_bnode_write_u16(node, offsetof(struct hfs_bnode_desc, num_recs), node->num_recs); - -- if (rec_off == end_off) -- goto skip; - size = fd->keylength + fd->entrylength; - -+ if (rec_off == end_off) { -+ src = fd->keyoffset; -+ hfs_bnode_clear(node, src, size); -+ goto skip; -+ } -+ - do { - data_off = hfs_bnode_read_u16(node, rec_off); - hfs_bnode_write_u16(node, rec_off + 2, data_off - size); -@@ -219,9 +224,23 @@ int hfs_brec_remove(struct hfs_find_data *fd) - } while (rec_off >= end_off); - - /* fill hole */ -- hfs_bnode_move(node, fd->keyoffset, fd->keyoffset + size, -- data_off - fd->keyoffset - size); -+ dst = fd->keyoffset; -+ src = fd->keyoffset + size; -+ len = data_off - src; -+ -+ hfs_bnode_move(node, dst, src, len); -+ -+ src = dst + len; -+ len = data_off - src; -+ -+ hfs_bnode_clear(node, src, len); -+ - skip: -+ /* -+ * Remove the obsolete offset to free space. -+ */ -+ hfs_bnode_write_u16(node, end_off, 0); -+ - hfs_bnode_dump(node); - if (!fd->record) - hfs_brec_update_parent(fd); -diff --git a/fs/hfs/mdb.c b/fs/hfs/mdb.c -index 8082eb01127cdf..bf811347bb07d3 100644 ---- a/fs/hfs/mdb.c -+++ b/fs/hfs/mdb.c -@@ -172,7 +172,7 @@ int hfs_mdb_get(struct super_block *sb) - pr_warn("continuing without an alternate MDB\n"); - } - -- HFS_SB(sb)->bitmap = kmalloc(8192, GFP_KERNEL); -+ HFS_SB(sb)->bitmap = kzalloc(8192, GFP_KERNEL); - if (!HFS_SB(sb)->bitmap) - goto out; - -diff --git a/fs/hfsplus/bfind.c b/fs/hfsplus/bfind.c -index 901e83d65d2021..26ebac4c604242 100644 ---- a/fs/hfsplus/bfind.c -+++ b/fs/hfsplus/bfind.c -@@ -18,7 +18,7 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) - - fd->tree = tree; - fd->bnode = NULL; -- ptr = kmalloc(tree->max_key_len * 2 + 4, GFP_KERNEL); -+ ptr = kzalloc(tree->max_key_len * 2 + 4, GFP_KERNEL); - if (!ptr) - return -ENOMEM; - fd->search_key = ptr; -@@ -158,6 +158,12 @@ int hfs_brec_find(struct hfs_find_data *fd, search_strategy_t do_key_compare) - __be32 data; - int height, res; - -+ fd->record = -1; -+ fd->keyoffset = -1; -+ fd->keylength = -1; -+ fd->entryoffset = -1; -+ fd->entrylength = -1; -+ - tree = fd->tree; - if (fd->bnode) - hfs_bnode_put(fd->bnode); -diff --git a/fs/hfsplus/bnode.c b/fs/hfsplus/bnode.c -index 14f4995588ff03..407d5152eb411e 100644 ---- a/fs/hfsplus/bnode.c -+++ b/fs/hfsplus/bnode.c -@@ -18,47 +18,6 @@ - #include "hfsplus_fs.h" - #include "hfsplus_raw.h" - --static inline --bool is_bnode_offset_valid(struct hfs_bnode *node, int off) --{ -- bool is_valid = off < node->tree->node_size; -- -- if (!is_valid) { -- pr_err("requested invalid offset: " -- "NODE: id %u, type %#x, height %u, " -- "node_size %u, offset %d\n", -- node->this, node->type, node->height, -- node->tree->node_size, off); -- } -- -- return is_valid; --} -- --static inline --int check_and_correct_requested_length(struct hfs_bnode *node, int off, int len) --{ -- unsigned int node_size; -- -- if (!is_bnode_offset_valid(node, off)) -- return 0; -- -- node_size = node->tree->node_size; -- -- if ((off + len) > node_size) { -- int new_len = (int)node_size - off; -- -- pr_err("requested length has been corrected: " -- "NODE: id %u, type %#x, height %u, " -- "node_size %u, offset %d, " -- "requested_len %d, corrected_len %d\n", -- node->this, node->type, node->height, -- node->tree->node_size, off, len, new_len); -- -- return new_len; -- } -- -- return len; --} - - /* Copy a specified range of bytes from the raw data of a node */ - void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len) -diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c -index 9e1732a2b92a8c..fe6a54c4083c34 100644 ---- a/fs/hfsplus/btree.c -+++ b/fs/hfsplus/btree.c -@@ -393,6 +393,12 @@ struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree) - len = hfs_brec_lenoff(node, 2, &off16); - off = off16; - -+ if (!is_bnode_offset_valid(node, off)) { -+ hfs_bnode_put(node); -+ return ERR_PTR(-EIO); -+ } -+ len = check_and_correct_requested_length(node, off, len); -+ - off += node->page_offset; - pagep = node->page + (off >> PAGE_SHIFT); - data = kmap_local_page(*pagep); -diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h -index 1473b04fc0f311..e67b35cb5ccc7a 100644 ---- a/fs/hfsplus/hfsplus_fs.h -+++ b/fs/hfsplus/hfsplus_fs.h -@@ -574,6 +574,48 @@ hfsplus_btree_lock_class(struct hfs_btree *tree) - return class; - } - -+static inline -+bool is_bnode_offset_valid(struct hfs_bnode *node, int off) -+{ -+ bool is_valid = off < node->tree->node_size; -+ -+ if (!is_valid) { -+ pr_err("requested invalid offset: " -+ "NODE: id %u, type %#x, height %u, " -+ "node_size %u, offset %d\n", -+ node->this, node->type, node->height, -+ node->tree->node_size, off); -+ } -+ -+ return is_valid; -+} -+ -+static inline -+int check_and_correct_requested_length(struct hfs_bnode *node, int off, int len) -+{ -+ unsigned int node_size; -+ -+ if (!is_bnode_offset_valid(node, off)) -+ return 0; -+ -+ node_size = node->tree->node_size; -+ -+ if ((off + len) > node_size) { -+ int new_len = (int)node_size - off; -+ -+ pr_err("requested length has been corrected: " -+ "NODE: id %u, type %#x, height %u, " -+ "node_size %u, offset %d, " -+ "requested_len %d, corrected_len %d\n", -+ node->this, node->type, node->height, -+ node->tree->node_size, off, len, new_len); -+ -+ return new_len; -+ } -+ -+ return len; -+} -+ - /* compatibility */ - #define hfsp_mt2ut(t) (struct timespec64){ .tv_sec = __hfsp_mt2ut(t) } - #define hfsp_ut2mt(t) __hfsp_ut2mt((t).tv_sec) -diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c -index 1986b4f18a9013..7e889820a63d0b 100644 ---- a/fs/hfsplus/super.c -+++ b/fs/hfsplus/super.c -@@ -67,13 +67,26 @@ struct inode *hfsplus_iget(struct super_block *sb, unsigned long ino) - if (!(inode->i_state & I_NEW)) - return inode; - -- INIT_LIST_HEAD(&HFSPLUS_I(inode)->open_dir_list); -- spin_lock_init(&HFSPLUS_I(inode)->open_dir_lock); -- mutex_init(&HFSPLUS_I(inode)->extents_lock); -- HFSPLUS_I(inode)->flags = 0; -+ atomic_set(&HFSPLUS_I(inode)->opencnt, 0); -+ HFSPLUS_I(inode)->first_blocks = 0; -+ HFSPLUS_I(inode)->clump_blocks = 0; -+ HFSPLUS_I(inode)->alloc_blocks = 0; -+ HFSPLUS_I(inode)->cached_start = U32_MAX; -+ HFSPLUS_I(inode)->cached_blocks = 0; -+ memset(HFSPLUS_I(inode)->first_extents, 0, sizeof(hfsplus_extent_rec)); -+ memset(HFSPLUS_I(inode)->cached_extents, 0, sizeof(hfsplus_extent_rec)); - HFSPLUS_I(inode)->extent_state = 0; -+ mutex_init(&HFSPLUS_I(inode)->extents_lock); - HFSPLUS_I(inode)->rsrc_inode = NULL; -- atomic_set(&HFSPLUS_I(inode)->opencnt, 0); -+ HFSPLUS_I(inode)->create_date = 0; -+ HFSPLUS_I(inode)->linkid = 0; -+ HFSPLUS_I(inode)->flags = 0; -+ HFSPLUS_I(inode)->fs_blocks = 0; -+ HFSPLUS_I(inode)->userflags = 0; -+ HFSPLUS_I(inode)->subfolders = 0; -+ INIT_LIST_HEAD(&HFSPLUS_I(inode)->open_dir_list); -+ spin_lock_init(&HFSPLUS_I(inode)->open_dir_lock); -+ HFSPLUS_I(inode)->phys_size = 0; - - if (inode->i_ino >= HFSPLUS_FIRSTUSER_CNID || - inode->i_ino == HFSPLUS_ROOT_CNID) { -@@ -525,7 +538,7 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent) - if (!hfs_brec_read(&fd, &entry, sizeof(entry))) { - hfs_find_exit(&fd); - if (entry.type != cpu_to_be16(HFSPLUS_FOLDER)) { -- err = -EINVAL; -+ err = -EIO; - goto out_put_root; - } - inode = hfsplus_iget(sb, be32_to_cpu(entry.folder.id)); -diff --git a/fs/notify/fdinfo.c b/fs/notify/fdinfo.c -index 26655572975d3d..1aa7de55094cd9 100644 ---- a/fs/notify/fdinfo.c -+++ b/fs/notify/fdinfo.c -@@ -17,6 +17,7 @@ - #include "fanotify/fanotify.h" - #include "fdinfo.h" - #include "fsnotify.h" -+#include "../internal.h" - - #if defined(CONFIG_PROC_FS) - -@@ -50,7 +51,12 @@ static void show_mark_fhandle(struct seq_file *m, struct inode *inode) - f.handle.handle_bytes = sizeof(f.pad); - size = f.handle.handle_bytes >> 2; - -+ if (!super_trylock_shared(inode->i_sb)) -+ return; -+ - ret = exportfs_encode_fid(inode, (struct fid *)f.handle.f_handle, &size); -+ up_read(&inode->i_sb->s_umount); -+ - if ((ret == FILEID_INVALID) || (ret < 0)) - return; - -diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c -index 1f9ed117e78b61..2f34074f0078bf 100644 ---- a/fs/ocfs2/move_extents.c -+++ b/fs/ocfs2/move_extents.c -@@ -868,6 +868,11 @@ static int __ocfs2_move_extents_range(struct buffer_head *di_bh, - mlog_errno(ret); - goto out; - } -+ /* -+ * Invalidate extent cache after moving/defragging to prevent -+ * stale cached data with outdated extent flags. -+ */ -+ ocfs2_extent_map_trunc(inode, cpos); - - context->clusters_moved += alloc_size; - next: -diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h -index 4bafb1adfb2235..6168c6d62b5e59 100644 ---- a/fs/smb/client/cifsglob.h -+++ b/fs/smb/client/cifsglob.h -@@ -703,7 +703,7 @@ struct TCP_Server_Info { - bool nosharesock; - bool tcp_nodelay; - bool terminate; -- unsigned int credits; /* send no more requests at once */ -+ int credits; /* send no more requests at once */ - unsigned int max_credits; /* can override large 32000 default at mnt */ - unsigned int in_flight; /* number of requests on the wire to server */ - unsigned int max_in_flight; /* max number of requests that were on wire */ -diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c -index 354f7144c59049..36e1e52c30a0fb 100644 ---- a/fs/smb/server/transport_ipc.c -+++ b/fs/smb/server/transport_ipc.c -@@ -249,10 +249,16 @@ static void ipc_msg_handle_free(int handle) - - static int handle_response(int type, void *payload, size_t sz) - { -- unsigned int handle = *(unsigned int *)payload; -+ unsigned int handle; - struct ipc_msg_table_entry *entry; - int ret = 0; - -+ /* Prevent 4-byte read beyond declared payload size */ -+ if (sz < sizeof(unsigned int)) -+ return -EINVAL; -+ -+ handle = *(unsigned int *)payload; -+ - ipc_update_last_active(); - down_read(&ipc_msg_table_lock); - hash_for_each_possible(ipc_msg_table, entry, ipc_table_hlist, handle) { -diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c -index 31c1ac256e1be4..91e85a1a154fdf 100644 ---- a/fs/smb/server/transport_rdma.c -+++ b/fs/smb/server/transport_rdma.c -@@ -938,12 +938,15 @@ static int smb_direct_flush_send_list(struct smb_direct_transport *t, - struct smb_direct_sendmsg, - list); - -+ if (send_ctx->need_invalidate_rkey) { -+ first->wr.opcode = IB_WR_SEND_WITH_INV; -+ first->wr.ex.invalidate_rkey = send_ctx->remote_key; -+ send_ctx->need_invalidate_rkey = false; -+ send_ctx->remote_key = 0; -+ } -+ - last->wr.send_flags = IB_SEND_SIGNALED; - last->wr.wr_cqe = &last->cqe; -- if (is_last && send_ctx->need_invalidate_rkey) { -- last->wr.opcode = IB_WR_SEND_WITH_INV; -- last->wr.ex.invalidate_rkey = send_ctx->remote_key; -- } - - ret = smb_direct_post_send(t, &first->wr); - if (!ret) { -diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c -index a726fbba49e40a..9038e82fc6050c 100644 ---- a/fs/xfs/xfs_super.c -+++ b/fs/xfs/xfs_super.c -@@ -1230,16 +1230,25 @@ suffix_kstrtoint( - static inline void - xfs_fs_warn_deprecated( - struct fs_context *fc, -- struct fs_parameter *param, -- uint64_t flag, -- bool value) -+ struct fs_parameter *param) - { -- /* Don't print the warning if reconfiguring and current mount point -- * already had the flag set -+ /* -+ * Always warn about someone passing in a deprecated mount option. -+ * Previously we wouldn't print the warning if we were reconfiguring -+ * and current mount point already had the flag set, but that was not -+ * the right thing to do. -+ * -+ * Many distributions mount the root filesystem with no options in the -+ * initramfs and rely on mount -a to remount the root fs with the -+ * options in fstab. However, the old behavior meant that there would -+ * never be a warning about deprecated mount options for the root fs in -+ * /etc/fstab. On a single-fs system, that means no warning at all. -+ * -+ * Compounding this problem are distribution scripts that copy -+ * /proc/mounts to fstab, which means that we can't remove mount -+ * options unless we're 100% sure they have only ever been advertised -+ * in /proc/mounts in response to explicitly provided mount options. - */ -- if ((fc->purpose & FS_CONTEXT_FOR_RECONFIGURE) && -- !!(XFS_M(fc->root->d_sb)->m_features & flag) == value) -- return; - xfs_warn(fc->s_fs_info, "%s mount option is deprecated.", param->key); - } - -@@ -1378,19 +1387,19 @@ xfs_fs_parse_param( - #endif - /* Following mount options will be removed in September 2025 */ - case Opt_ikeep: -- xfs_fs_warn_deprecated(fc, param, XFS_FEAT_IKEEP, true); -+ xfs_fs_warn_deprecated(fc, param); - parsing_mp->m_features |= XFS_FEAT_IKEEP; - return 0; - case Opt_noikeep: -- xfs_fs_warn_deprecated(fc, param, XFS_FEAT_IKEEP, false); -+ xfs_fs_warn_deprecated(fc, param); - parsing_mp->m_features &= ~XFS_FEAT_IKEEP; - return 0; - case Opt_attr2: -- xfs_fs_warn_deprecated(fc, param, XFS_FEAT_ATTR2, true); -+ xfs_fs_warn_deprecated(fc, param); - parsing_mp->m_features |= XFS_FEAT_ATTR2; - return 0; - case Opt_noattr2: -- xfs_fs_warn_deprecated(fc, param, XFS_FEAT_NOATTR2, true); -+ xfs_fs_warn_deprecated(fc, param); - parsing_mp->m_features |= XFS_FEAT_NOATTR2; - return 0; - default: -diff --git a/io_uring/filetable.c b/io_uring/filetable.c -index 6e86e6188dbeeb..ff74d41d9e53c5 100644 ---- a/io_uring/filetable.c -+++ b/io_uring/filetable.c -@@ -62,7 +62,7 @@ void io_free_file_tables(struct io_file_table *table) - - static int io_install_fixed_file(struct io_ring_ctx *ctx, struct file *file, - u32 slot_index) -- __must_hold(&req->ctx->uring_lock) -+ __must_hold(&ctx->uring_lock) - { - struct io_fixed_file *file_slot; - int ret; -diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c -index 958d4aa77dcad8..ca2e8153bd1cca 100644 ---- a/kernel/dma/debug.c -+++ b/kernel/dma/debug.c -@@ -23,6 +23,7 @@ - #include - #include - #include -+#include - #include - #include "debug.h" - -@@ -601,7 +602,9 @@ static void add_dma_entry(struct dma_debug_entry *entry, unsigned long attrs) - if (rc == -ENOMEM) { - pr_err_once("cacheline tracking ENOMEM, dma-debug disabled\n"); - global_disable = true; -- } else if (rc == -EEXIST && !(attrs & DMA_ATTR_SKIP_CPU_SYNC)) { -+ } else if (rc == -EEXIST && !(attrs & DMA_ATTR_SKIP_CPU_SYNC) && -+ !(IS_ENABLED(CONFIG_DMA_BOUNCE_UNALIGNED_KMALLOC) && -+ is_swiotlb_active(entry->dev))) { - err_printk(entry->dev, entry, - "cacheline tracking EEXIST, overlapping mappings aren't supported\n"); - } -diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h -index f7cb505ab337a5..64634314a89cea 100644 ---- a/kernel/sched/sched.h -+++ b/kernel/sched/sched.h -@@ -3435,11 +3435,9 @@ static inline int __mm_cid_get(struct rq *rq, struct mm_struct *mm) - static inline int mm_cid_get(struct rq *rq, struct mm_struct *mm) - { - struct mm_cid __percpu *pcpu_cid = mm->pcpu_cid; -- struct cpumask *cpumask; - int cid; - - lockdep_assert_rq_held(rq); -- cpumask = mm_cidmask(mm); - cid = __this_cpu_read(pcpu_cid->cid); - if (mm_cid_is_valid(cid)) { - mm_cid_snapshot_time(rq, mm); -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index 26c520d1af6e61..1613563132035b 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -4383,9 +4383,6 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh, - int err; - u16 vid; - -- if (!netlink_capable(skb, CAP_NET_ADMIN)) -- return -EPERM; -- - if (!del_bulk) { - err = nlmsg_parse_deprecated(nlh, sizeof(*ndm), tb, NDA_MAX, - NULL, extack); -diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c -index 5c165218180588..f5a7d5a3875555 100644 ---- a/net/sctp/inqueue.c -+++ b/net/sctp/inqueue.c -@@ -169,13 +169,14 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue) - chunk->head_skb = chunk->skb; - - /* skbs with "cover letter" */ -- if (chunk->head_skb && chunk->skb->data_len == chunk->skb->len) -+ if (chunk->head_skb && chunk->skb->data_len == chunk->skb->len) { -+ if (WARN_ON(!skb_shinfo(chunk->skb)->frag_list)) { -+ __SCTP_INC_STATS(dev_net(chunk->skb->dev), -+ SCTP_MIB_IN_PKT_DISCARDS); -+ sctp_chunk_free(chunk); -+ goto next_chunk; -+ } - chunk->skb = skb_shinfo(chunk->skb)->frag_list; -- -- if (WARN_ON(!chunk->skb)) { -- __SCTP_INC_STATS(dev_net(chunk->skb->dev), SCTP_MIB_IN_PKT_DISCARDS); -- sctp_chunk_free(chunk); -- goto next_chunk; - } - } - -diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c -index f95ac11a7e0de4..64790062cfa2eb 100644 ---- a/net/vmw_vsock/af_vsock.c -+++ b/net/vmw_vsock/af_vsock.c -@@ -486,12 +486,26 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk) - goto err; - } - -- if (vsk->transport) { -- if (vsk->transport == new_transport) { -- ret = 0; -- goto err; -- } -+ if (vsk->transport && vsk->transport == new_transport) { -+ ret = 0; -+ goto err; -+ } - -+ /* We increase the module refcnt to prevent the transport unloading -+ * while there are open sockets assigned to it. -+ */ -+ if (!new_transport || !try_module_get(new_transport->module)) { -+ ret = -ENODEV; -+ goto err; -+ } -+ -+ /* It's safe to release the mutex after a successful try_module_get(). -+ * Whichever transport `new_transport` points at, it won't go away until -+ * the last module_put() below or in vsock_deassign_transport(). -+ */ -+ mutex_unlock(&vsock_register_mutex); -+ -+ if (vsk->transport) { - /* transport->release() must be called with sock lock acquired. - * This path can only be taken during vsock_connect(), where we - * have already held the sock lock. In the other cases, this -@@ -511,20 +525,6 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk) - vsk->peer_shutdown = 0; - } - -- /* We increase the module refcnt to prevent the transport unloading -- * while there are open sockets assigned to it. -- */ -- if (!new_transport || !try_module_get(new_transport->module)) { -- ret = -ENODEV; -- goto err; -- } -- -- /* It's safe to release the mutex after a successful try_module_get(). -- * Whichever transport `new_transport` points at, it won't go away until -- * the last module_put() below or in vsock_deassign_transport(). -- */ -- mutex_unlock(&vsock_register_mutex); -- - if (sk->sk_type == SOCK_SEQPACKET) { - if (!new_transport->seqpacket_allow || - !new_transport->seqpacket_allow(remote_cid)) { -diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh -index 9a907d8260c9c7..d30314532bb71d 100755 ---- a/tools/testing/selftests/net/mptcp/mptcp_join.sh -+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh -@@ -3737,7 +3737,7 @@ endpoint_tests() - # subflow_rebuild_header is needed to support the implicit flag - # userspace pm type prevents add_addr - if reset "implicit EP" && -- mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then -+ continue_if mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then - pm_nl_set_limits $ns1 2 2 - pm_nl_set_limits $ns2 2 2 - pm_nl_add_endpoint $ns1 10.0.2.1 flags signal -@@ -3762,7 +3762,7 @@ endpoint_tests() - fi - - if reset_with_tcp_filter "delete and re-add" ns2 10.0.3.2 REJECT OUTPUT && -- mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then -+ continue_if mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then - start_events - pm_nl_set_limits $ns1 0 3 - pm_nl_set_limits $ns2 0 3 -@@ -3910,7 +3910,7 @@ endpoint_tests() - - # flush and re-add - if reset_with_tcp_filter "flush re-add" ns2 10.0.3.2 REJECT OUTPUT && -- mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then -+ continue_if mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then - pm_nl_set_limits $ns1 0 2 - pm_nl_set_limits $ns2 1 2 - # broadcast IP: no packet for this address will be received on ns1 -diff --git a/tools/testing/selftests/net/sctp_hello.c b/tools/testing/selftests/net/sctp_hello.c -index f02f1f95d2275e..a04dac0b8027d9 100644 ---- a/tools/testing/selftests/net/sctp_hello.c -+++ b/tools/testing/selftests/net/sctp_hello.c -@@ -29,7 +29,6 @@ static void set_addr(struct sockaddr_storage *ss, char *ip, char *port, int *len - static int do_client(int argc, char *argv[]) - { - struct sockaddr_storage ss; -- char buf[] = "hello"; - int csk, ret, len; - - if (argc < 5) { -@@ -56,16 +55,10 @@ static int do_client(int argc, char *argv[]) - - set_addr(&ss, argv[3], argv[4], &len); - ret = connect(csk, (struct sockaddr *)&ss, len); -- if (ret < 0) { -- printf("failed to connect to peer\n"); -+ if (ret < 0) - return -1; -- } - -- ret = send(csk, buf, strlen(buf) + 1, 0); -- if (ret < 0) { -- printf("failed to send msg %d\n", ret); -- return -1; -- } -+ recv(csk, NULL, 0, 0); - close(csk); - - return 0; -@@ -75,7 +68,6 @@ int main(int argc, char *argv[]) - { - struct sockaddr_storage ss; - int lsk, csk, ret, len; -- char buf[20]; - - if (argc < 2 || (strcmp(argv[1], "server") && strcmp(argv[1], "client"))) { - printf("%s server|client ...\n", argv[0]); -@@ -125,11 +117,6 @@ int main(int argc, char *argv[]) - return -1; - } - -- ret = recv(csk, buf, sizeof(buf), 0); -- if (ret <= 0) { -- printf("failed to recv msg %d\n", ret); -- return -1; -- } - close(csk); - close(lsk); - -diff --git a/tools/testing/selftests/net/sctp_vrf.sh b/tools/testing/selftests/net/sctp_vrf.sh -index c721e952e5f301..667b211aa8a11c 100755 ---- a/tools/testing/selftests/net/sctp_vrf.sh -+++ b/tools/testing/selftests/net/sctp_vrf.sh -@@ -6,13 +6,11 @@ - # SERVER_NS - # CLIENT_NS2 (veth1) <---> (veth2) -> vrf_s2 - --CLIENT_NS1="client-ns1" --CLIENT_NS2="client-ns2" -+source lib.sh - CLIENT_IP4="10.0.0.1" - CLIENT_IP6="2000::1" - CLIENT_PORT=1234 - --SERVER_NS="server-ns" - SERVER_IP4="10.0.0.2" - SERVER_IP6="2000::2" - SERVER_PORT=1234 -@@ -20,13 +18,11 @@ SERVER_PORT=1234 - setup() { - modprobe sctp - modprobe sctp_diag -- ip netns add $CLIENT_NS1 -- ip netns add $CLIENT_NS2 -- ip netns add $SERVER_NS -+ setup_ns CLIENT_NS1 CLIENT_NS2 SERVER_NS - -- ip net exec $CLIENT_NS1 sysctl -w net.ipv6.conf.default.accept_dad=0 2>&1 >/dev/null -- ip net exec $CLIENT_NS2 sysctl -w net.ipv6.conf.default.accept_dad=0 2>&1 >/dev/null -- ip net exec $SERVER_NS sysctl -w net.ipv6.conf.default.accept_dad=0 2>&1 >/dev/null -+ ip net exec $CLIENT_NS1 sysctl -wq net.ipv6.conf.default.accept_dad=0 -+ ip net exec $CLIENT_NS2 sysctl -wq net.ipv6.conf.default.accept_dad=0 -+ ip net exec $SERVER_NS sysctl -wq net.ipv6.conf.default.accept_dad=0 - - ip -n $SERVER_NS link add veth1 type veth peer name veth1 netns $CLIENT_NS1 - ip -n $SERVER_NS link add veth2 type veth peer name veth1 netns $CLIENT_NS2 -@@ -66,19 +62,40 @@ setup() { - } - - cleanup() { -- ip netns exec $SERVER_NS pkill sctp_hello 2>&1 >/dev/null -- ip netns del "$CLIENT_NS1" -- ip netns del "$CLIENT_NS2" -- ip netns del "$SERVER_NS" -+ wait_client $CLIENT_NS1 -+ wait_client $CLIENT_NS2 -+ stop_server -+ cleanup_ns $CLIENT_NS1 $CLIENT_NS2 $SERVER_NS - } - --wait_server() { -+start_server() { - local IFACE=$1 - local CNT=0 - -- until ip netns exec $SERVER_NS ss -lS src $SERVER_IP:$SERVER_PORT | \ -- grep LISTEN | grep "$IFACE" 2>&1 >/dev/null; do -- [ $((CNT++)) = "20" ] && { RET=3; return $RET; } -+ ip netns exec $SERVER_NS ./sctp_hello server $AF $SERVER_IP $SERVER_PORT $IFACE & -+ disown -+ until ip netns exec $SERVER_NS ss -SlH | grep -q "$IFACE"; do -+ [ $((CNT++)) -eq 30 ] && { RET=3; return $RET; } -+ sleep 0.1 -+ done -+} -+ -+stop_server() { -+ local CNT=0 -+ -+ ip netns exec $SERVER_NS pkill sctp_hello -+ while ip netns exec $SERVER_NS ss -SaH | grep -q .; do -+ [ $((CNT++)) -eq 30 ] && break -+ sleep 0.1 -+ done -+} -+ -+wait_client() { -+ local CLIENT_NS=$1 -+ local CNT=0 -+ -+ while ip netns exec $CLIENT_NS ss -SaH | grep -q .; do -+ [ $((CNT++)) -eq 30 ] && break - sleep 0.1 - done - } -@@ -87,14 +104,12 @@ do_test() { - local CLIENT_NS=$1 - local IFACE=$2 - -- ip netns exec $SERVER_NS pkill sctp_hello 2>&1 >/dev/null -- ip netns exec $SERVER_NS ./sctp_hello server $AF $SERVER_IP \ -- $SERVER_PORT $IFACE 2>&1 >/dev/null & -- disown -- wait_server $IFACE || return $RET -+ start_server $IFACE || return $RET - timeout 3 ip netns exec $CLIENT_NS ./sctp_hello client $AF \ -- $SERVER_IP $SERVER_PORT $CLIENT_IP $CLIENT_PORT 2>&1 >/dev/null -+ $SERVER_IP $SERVER_PORT $CLIENT_IP $CLIENT_PORT - RET=$? -+ wait_client $CLIENT_NS -+ stop_server - return $RET - } - -@@ -102,25 +117,21 @@ do_testx() { - local IFACE1=$1 - local IFACE2=$2 - -- ip netns exec $SERVER_NS pkill sctp_hello 2>&1 >/dev/null -- ip netns exec $SERVER_NS ./sctp_hello server $AF $SERVER_IP \ -- $SERVER_PORT $IFACE1 2>&1 >/dev/null & -- disown -- wait_server $IFACE1 || return $RET -- ip netns exec $SERVER_NS ./sctp_hello server $AF $SERVER_IP \ -- $SERVER_PORT $IFACE2 2>&1 >/dev/null & -- disown -- wait_server $IFACE2 || return $RET -+ start_server $IFACE1 || return $RET -+ start_server $IFACE2 || return $RET - timeout 3 ip netns exec $CLIENT_NS1 ./sctp_hello client $AF \ -- $SERVER_IP $SERVER_PORT $CLIENT_IP $CLIENT_PORT 2>&1 >/dev/null && \ -+ $SERVER_IP $SERVER_PORT $CLIENT_IP $CLIENT_PORT && \ - timeout 3 ip netns exec $CLIENT_NS2 ./sctp_hello client $AF \ -- $SERVER_IP $SERVER_PORT $CLIENT_IP $CLIENT_PORT 2>&1 >/dev/null -+ $SERVER_IP $SERVER_PORT $CLIENT_IP $CLIENT_PORT - RET=$? -+ wait_client $CLIENT_NS1 -+ wait_client $CLIENT_NS2 -+ stop_server - return $RET - } - - testup() { -- ip netns exec $SERVER_NS sysctl -w net.sctp.l3mdev_accept=1 2>&1 >/dev/null -+ ip netns exec $SERVER_NS sysctl -wq net.sctp.l3mdev_accept=1 - echo -n "TEST 01: nobind, connect from client 1, l3mdev_accept=1, Y " - do_test $CLIENT_NS1 || { echo "[FAIL]"; return $RET; } - echo "[PASS]" -@@ -129,7 +140,7 @@ testup() { - do_test $CLIENT_NS2 && { echo "[FAIL]"; return $RET; } - echo "[PASS]" - -- ip netns exec $SERVER_NS sysctl -w net.sctp.l3mdev_accept=0 2>&1 >/dev/null -+ ip netns exec $SERVER_NS sysctl -wq net.sctp.l3mdev_accept=0 - echo -n "TEST 03: nobind, connect from client 1, l3mdev_accept=0, N " - do_test $CLIENT_NS1 && { echo "[FAIL]"; return $RET; } - echo "[PASS]" -@@ -166,7 +177,7 @@ testup() { - do_testx vrf-1 vrf-2 || { echo "[FAIL]"; return $RET; } - echo "[PASS]" - -- echo -n "TEST 12: bind vrf-2 & 1 in server, connect from client 1 & 2, N " -+ echo -n "TEST 12: bind vrf-2 & 1 in server, connect from client 1 & 2, Y " - do_testx vrf-2 vrf-1 || { echo "[FAIL]"; return $RET; } - echo "[PASS]" - } diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.115-116.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.115-116.patch deleted file mode 100644 index ae809f2039..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.115-116.patch +++ /dev/null @@ -1,1467 +0,0 @@ -diff --git a/Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd b/Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd -index 5a775b8f654351..fc82aa4e54b005 100644 ---- a/Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd -+++ b/Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd -@@ -75,3 +75,13 @@ Description: - The default value is 1 (GNU Remote Debug command). - Other permissible value is 0 which is for vendor defined debug - target. -+ -+What: /sys/bus/pci/drivers/xhci_hcd/.../dbc_poll_interval_ms -+Date: February 2024 -+Contact: Mathias Nyman -+Description: -+ This attribute adjust the polling interval used to check for -+ DbC events. Unit is milliseconds. Accepted values range from 0 -+ up to 5000. The default value is 64 ms. -+ This polling interval is used while DbC is enabled but has no -+ active data transfers. -diff --git a/Makefile b/Makefile -index 85d8fa82569578..f28f1f9f5f4e6d 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 115 -+SUBLEVEL = 116 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/alpha/kernel/asm-offsets.c b/arch/alpha/kernel/asm-offsets.c -index 11c35cf45b4610..cb205f22096d78 100644 ---- a/arch/alpha/kernel/asm-offsets.c -+++ b/arch/alpha/kernel/asm-offsets.c -@@ -4,6 +4,7 @@ - * This code generates raw asm output which is post-processed to extract - * and format the required data. - */ -+#define COMPILE_OFFSETS - - #include - #include -diff --git a/arch/arc/kernel/asm-offsets.c b/arch/arc/kernel/asm-offsets.c -index f77deb7991757e..2978da85fcb65b 100644 ---- a/arch/arc/kernel/asm-offsets.c -+++ b/arch/arc/kernel/asm-offsets.c -@@ -2,6 +2,7 @@ - /* - * Copyright (C) 2004, 2007-2010, 2011-2012 Synopsys, Inc. (www.synopsys.com) - */ -+#define COMPILE_OFFSETS - - #include - #include -diff --git a/arch/arm/kernel/asm-offsets.c b/arch/arm/kernel/asm-offsets.c -index 219cbc7e5d134b..3840e1e22b7517 100644 ---- a/arch/arm/kernel/asm-offsets.c -+++ b/arch/arm/kernel/asm-offsets.c -@@ -7,6 +7,8 @@ - * This code generates raw asm output which is post-processed to extract - * and format the required data. - */ -+#define COMPILE_OFFSETS -+ - #include - #include - #include -diff --git a/arch/arm64/kernel/asm-offsets.c b/arch/arm64/kernel/asm-offsets.c -index 5ff1942b04fcfd..ea2d740db81c52 100644 ---- a/arch/arm64/kernel/asm-offsets.c -+++ b/arch/arm64/kernel/asm-offsets.c -@@ -6,6 +6,7 @@ - * 2001-2002 Keith Owens - * Copyright (C) 2012 ARM Ltd. - */ -+#define COMPILE_OFFSETS - - #include - #include -diff --git a/arch/csky/kernel/asm-offsets.c b/arch/csky/kernel/asm-offsets.c -index d1e9035794733d..5525c8e7e1d9ea 100644 ---- a/arch/csky/kernel/asm-offsets.c -+++ b/arch/csky/kernel/asm-offsets.c -@@ -1,5 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0 - // Copyright (C) 2018 Hangzhou C-SKY Microsystems co.,ltd. -+#define COMPILE_OFFSETS - - #include - #include -diff --git a/arch/hexagon/kernel/asm-offsets.c b/arch/hexagon/kernel/asm-offsets.c -index 03a7063f945614..50eea9fa6f1375 100644 ---- a/arch/hexagon/kernel/asm-offsets.c -+++ b/arch/hexagon/kernel/asm-offsets.c -@@ -8,6 +8,7 @@ - * - * Copyright (c) 2010-2012, The Linux Foundation. All rights reserved. - */ -+#define COMPILE_OFFSETS - - #include - #include -diff --git a/arch/loongarch/kernel/asm-offsets.c b/arch/loongarch/kernel/asm-offsets.c -index 8da0726777edb4..110afd3cc8f348 100644 ---- a/arch/loongarch/kernel/asm-offsets.c -+++ b/arch/loongarch/kernel/asm-offsets.c -@@ -4,6 +4,8 @@ - * - * Copyright (C) 2020-2022 Loongson Technology Corporation Limited - */ -+#define COMPILE_OFFSETS -+ - #include - #include - #include -diff --git a/arch/m68k/kernel/asm-offsets.c b/arch/m68k/kernel/asm-offsets.c -index 906d7323053744..67a1990f9d748f 100644 ---- a/arch/m68k/kernel/asm-offsets.c -+++ b/arch/m68k/kernel/asm-offsets.c -@@ -9,6 +9,7 @@ - * #defines from the assembly-language output. - */ - -+#define COMPILE_OFFSETS - #define ASM_OFFSETS_C - - #include -diff --git a/arch/microblaze/kernel/asm-offsets.c b/arch/microblaze/kernel/asm-offsets.c -index 104c3ac5f30c88..b4b67d58e7f6ae 100644 ---- a/arch/microblaze/kernel/asm-offsets.c -+++ b/arch/microblaze/kernel/asm-offsets.c -@@ -7,6 +7,7 @@ - * License. See the file "COPYING" in the main directory of this archive - * for more details. - */ -+#define COMPILE_OFFSETS - - #include - #include -diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c -index cb1045ebab0621..22c99a2cd5707b 100644 ---- a/arch/mips/kernel/asm-offsets.c -+++ b/arch/mips/kernel/asm-offsets.c -@@ -9,6 +9,8 @@ - * Kevin Kissell, kevink@mips.com and Carsten Langgaard, carstenl@mips.com - * Copyright (C) 2000 MIPS Technologies, Inc. - */ -+#define COMPILE_OFFSETS -+ - #include - #include - #include -diff --git a/arch/nios2/kernel/asm-offsets.c b/arch/nios2/kernel/asm-offsets.c -index e3d9b7b6fb48aa..88190b503ce5de 100644 ---- a/arch/nios2/kernel/asm-offsets.c -+++ b/arch/nios2/kernel/asm-offsets.c -@@ -2,6 +2,7 @@ - /* - * Copyright (C) 2011 Tobias Klauser - */ -+#define COMPILE_OFFSETS - - #include - #include -diff --git a/arch/openrisc/kernel/asm-offsets.c b/arch/openrisc/kernel/asm-offsets.c -index 710651d5aaae10..3cc826f2216b10 100644 ---- a/arch/openrisc/kernel/asm-offsets.c -+++ b/arch/openrisc/kernel/asm-offsets.c -@@ -18,6 +18,7 @@ - * compile this file to assembler, and then extract the - * #defines from the assembly-language output. - */ -+#define COMPILE_OFFSETS - - #include - #include -diff --git a/arch/parisc/kernel/asm-offsets.c b/arch/parisc/kernel/asm-offsets.c -index 757816a7bd4b28..9abfe65492c65e 100644 ---- a/arch/parisc/kernel/asm-offsets.c -+++ b/arch/parisc/kernel/asm-offsets.c -@@ -13,6 +13,7 @@ - * Copyright (C) 2002 Randolph Chung - * Copyright (C) 2003 James Bottomley - */ -+#define COMPILE_OFFSETS - - #include - #include -diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c -index 2affd30468bc4c..e2cee2f2ededdb 100644 ---- a/arch/powerpc/kernel/asm-offsets.c -+++ b/arch/powerpc/kernel/asm-offsets.c -@@ -8,6 +8,7 @@ - * compile this file to assembler, and then extract the - * #defines from the assembly-language output. - */ -+#define COMPILE_OFFSETS - - #include - #include -diff --git a/arch/riscv/kernel/asm-offsets.c b/arch/riscv/kernel/asm-offsets.c -index 6a992cba2f2876..e4589457e6085d 100644 ---- a/arch/riscv/kernel/asm-offsets.c -+++ b/arch/riscv/kernel/asm-offsets.c -@@ -3,6 +3,7 @@ - * Copyright (C) 2012 Regents of the University of California - * Copyright (C) 2017 SiFive - */ -+#define COMPILE_OFFSETS - - #include - #include -diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c -index fa5f6885c74aa1..73a989dcfe2082 100644 ---- a/arch/s390/kernel/asm-offsets.c -+++ b/arch/s390/kernel/asm-offsets.c -@@ -4,6 +4,7 @@ - * This code generates raw asm output which is post-processed to extract - * and format the required data. - */ -+#define COMPILE_OFFSETS - - #define ASM_OFFSETS_C - -diff --git a/arch/sh/kernel/asm-offsets.c b/arch/sh/kernel/asm-offsets.c -index a0322e8328456e..429b6a76314684 100644 ---- a/arch/sh/kernel/asm-offsets.c -+++ b/arch/sh/kernel/asm-offsets.c -@@ -8,6 +8,7 @@ - * compile this file to assembler, and then extract the - * #defines from the assembly-language output. - */ -+#define COMPILE_OFFSETS - - #include - #include -diff --git a/arch/sparc/kernel/asm-offsets.c b/arch/sparc/kernel/asm-offsets.c -index 5784f2df489a4d..f1e27a7f800f41 100644 ---- a/arch/sparc/kernel/asm-offsets.c -+++ b/arch/sparc/kernel/asm-offsets.c -@@ -10,6 +10,7 @@ - * - * On sparc, thread_info data is static and TI_XXX offsets are computed by hand. - */ -+#define COMPILE_OFFSETS - - #include - #include -diff --git a/arch/um/kernel/asm-offsets.c b/arch/um/kernel/asm-offsets.c -index 1fb12235ab9c84..a69873aa697f4f 100644 ---- a/arch/um/kernel/asm-offsets.c -+++ b/arch/um/kernel/asm-offsets.c -@@ -1 +1,3 @@ -+#define COMPILE_OFFSETS -+ - #include -diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c -index 315926ccea0fa3..ef1d3a5024ed4b 100644 ---- a/arch/x86/kernel/cpu/bugs.c -+++ b/arch/x86/kernel/cpu/bugs.c -@@ -1185,8 +1185,10 @@ static void __init retbleed_select_mitigation(void) - retbleed_mitigation = RETBLEED_MITIGATION_EIBRS; - break; - default: -- if (retbleed_mitigation != RETBLEED_MITIGATION_STUFF) -+ if (retbleed_mitigation != RETBLEED_MITIGATION_STUFF) { - pr_err(RETBLEED_INTEL_MSG); -+ retbleed_mitigation = RETBLEED_MITIGATION_NONE; -+ } - } - } - -@@ -1592,7 +1594,7 @@ spectre_v2_user_select_mitigation(void) - static const char * const spectre_v2_strings[] = { - [SPECTRE_V2_NONE] = "Vulnerable", - [SPECTRE_V2_RETPOLINE] = "Mitigation: Retpolines", -- [SPECTRE_V2_LFENCE] = "Mitigation: LFENCE", -+ [SPECTRE_V2_LFENCE] = "Vulnerable: LFENCE", - [SPECTRE_V2_EIBRS] = "Mitigation: Enhanced / Automatic IBRS", - [SPECTRE_V2_EIBRS_LFENCE] = "Mitigation: Enhanced / Automatic IBRS + LFENCE", - [SPECTRE_V2_EIBRS_RETPOLINE] = "Mitigation: Enhanced / Automatic IBRS + Retpolines", -@@ -3220,9 +3222,6 @@ static const char *spectre_bhi_state(void) - - static ssize_t spectre_v2_show_state(char *buf) - { -- if (spectre_v2_enabled == SPECTRE_V2_LFENCE) -- return sysfs_emit(buf, "Vulnerable: LFENCE\n"); -- - if (spectre_v2_enabled == SPECTRE_V2_EIBRS && unprivileged_ebpf_enabled()) - return sysfs_emit(buf, "Vulnerable: eIBRS with unprivileged eBPF\n"); - -diff --git a/arch/xtensa/kernel/asm-offsets.c b/arch/xtensa/kernel/asm-offsets.c -index da38de20ae598b..cfbced95e944a4 100644 ---- a/arch/xtensa/kernel/asm-offsets.c -+++ b/arch/xtensa/kernel/asm-offsets.c -@@ -11,6 +11,7 @@ - * - * Chris Zankel - */ -+#define COMPILE_OFFSETS - - #include - #include -diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c -index 15f63452a9bec8..b01436d9ddaed8 100644 ---- a/drivers/edac/edac_mc_sysfs.c -+++ b/drivers/edac/edac_mc_sysfs.c -@@ -306,6 +306,14 @@ DEVICE_CHANNEL(ch10_dimm_label, S_IRUGO | S_IWUSR, - channel_dimm_label_show, channel_dimm_label_store, 10); - DEVICE_CHANNEL(ch11_dimm_label, S_IRUGO | S_IWUSR, - channel_dimm_label_show, channel_dimm_label_store, 11); -+DEVICE_CHANNEL(ch12_dimm_label, S_IRUGO | S_IWUSR, -+ channel_dimm_label_show, channel_dimm_label_store, 12); -+DEVICE_CHANNEL(ch13_dimm_label, S_IRUGO | S_IWUSR, -+ channel_dimm_label_show, channel_dimm_label_store, 13); -+DEVICE_CHANNEL(ch14_dimm_label, S_IRUGO | S_IWUSR, -+ channel_dimm_label_show, channel_dimm_label_store, 14); -+DEVICE_CHANNEL(ch15_dimm_label, S_IRUGO | S_IWUSR, -+ channel_dimm_label_show, channel_dimm_label_store, 15); - - /* Total possible dynamic DIMM Label attribute file table */ - static struct attribute *dynamic_csrow_dimm_attr[] = { -@@ -321,6 +329,10 @@ static struct attribute *dynamic_csrow_dimm_attr[] = { - &dev_attr_legacy_ch9_dimm_label.attr.attr, - &dev_attr_legacy_ch10_dimm_label.attr.attr, - &dev_attr_legacy_ch11_dimm_label.attr.attr, -+ &dev_attr_legacy_ch12_dimm_label.attr.attr, -+ &dev_attr_legacy_ch13_dimm_label.attr.attr, -+ &dev_attr_legacy_ch14_dimm_label.attr.attr, -+ &dev_attr_legacy_ch15_dimm_label.attr.attr, - NULL - }; - -@@ -349,6 +361,14 @@ DEVICE_CHANNEL(ch10_ce_count, S_IRUGO, - channel_ce_count_show, NULL, 10); - DEVICE_CHANNEL(ch11_ce_count, S_IRUGO, - channel_ce_count_show, NULL, 11); -+DEVICE_CHANNEL(ch12_ce_count, S_IRUGO, -+ channel_ce_count_show, NULL, 12); -+DEVICE_CHANNEL(ch13_ce_count, S_IRUGO, -+ channel_ce_count_show, NULL, 13); -+DEVICE_CHANNEL(ch14_ce_count, S_IRUGO, -+ channel_ce_count_show, NULL, 14); -+DEVICE_CHANNEL(ch15_ce_count, S_IRUGO, -+ channel_ce_count_show, NULL, 15); - - /* Total possible dynamic ce_count attribute file table */ - static struct attribute *dynamic_csrow_ce_count_attr[] = { -@@ -364,6 +384,10 @@ static struct attribute *dynamic_csrow_ce_count_attr[] = { - &dev_attr_legacy_ch9_ce_count.attr.attr, - &dev_attr_legacy_ch10_ce_count.attr.attr, - &dev_attr_legacy_ch11_ce_count.attr.attr, -+ &dev_attr_legacy_ch12_ce_count.attr.attr, -+ &dev_attr_legacy_ch13_ce_count.attr.attr, -+ &dev_attr_legacy_ch14_ce_count.attr.attr, -+ &dev_attr_legacy_ch15_ce_count.attr.attr, - NULL - }; - -diff --git a/drivers/gpio/gpio-idio-16.c b/drivers/gpio/gpio-idio-16.c -index 53b1eb876a1257..e978fd0898aaa6 100644 ---- a/drivers/gpio/gpio-idio-16.c -+++ b/drivers/gpio/gpio-idio-16.c -@@ -3,6 +3,7 @@ - * GPIO library for the ACCES IDIO-16 family - * Copyright (C) 2022 William Breathitt Gray - */ -+#include - #include - #include - #include -@@ -106,6 +107,7 @@ int devm_idio_16_regmap_register(struct device *const dev, - struct idio_16_data *data; - struct regmap_irq_chip *chip; - struct regmap_irq_chip_data *chip_data; -+ DECLARE_BITMAP(fixed_direction_output, IDIO_16_NGPIO); - - if (!config->parent) - return -EINVAL; -@@ -163,6 +165,9 @@ int devm_idio_16_regmap_register(struct device *const dev, - gpio_config.irq_domain = regmap_irq_get_domain(chip_data); - gpio_config.reg_mask_xlate = idio_16_reg_mask_xlate; - -+ bitmap_from_u64(fixed_direction_output, GENMASK_U64(15, 0)); -+ gpio_config.fixed_direction_output = fixed_direction_output; -+ - return PTR_ERR_OR_ZERO(devm_gpio_regmap_register(dev, &gpio_config)); - } - EXPORT_SYMBOL_GPL(devm_idio_16_regmap_register); -diff --git a/drivers/gpio/gpio-regmap.c b/drivers/gpio/gpio-regmap.c -index c08c8e528867ee..fd986afa7db5f0 100644 ---- a/drivers/gpio/gpio-regmap.c -+++ b/drivers/gpio/gpio-regmap.c -@@ -29,6 +29,12 @@ struct gpio_regmap { - unsigned int reg_clr_base; - unsigned int reg_dir_in_base; - unsigned int reg_dir_out_base; -+ unsigned long *fixed_direction_output; -+ -+#ifdef CONFIG_REGMAP_IRQ -+ int regmap_irq_line; -+ struct regmap_irq_chip_data *irq_chip_data; -+#endif - - int (*reg_mask_xlate)(struct gpio_regmap *gpio, unsigned int base, - unsigned int offset, unsigned int *reg, -@@ -117,6 +123,13 @@ static int gpio_regmap_get_direction(struct gpio_chip *chip, - unsigned int base, val, reg, mask; - int invert, ret; - -+ if (gpio->fixed_direction_output) { -+ if (test_bit(offset, gpio->fixed_direction_output)) -+ return GPIO_LINE_DIRECTION_OUT; -+ else -+ return GPIO_LINE_DIRECTION_IN; -+ } -+ - if (gpio->reg_dat_base && !gpio->reg_set_base) - return GPIO_LINE_DIRECTION_IN; - if (gpio->reg_set_base && !gpio->reg_dat_base) -@@ -203,6 +216,7 @@ EXPORT_SYMBOL_GPL(gpio_regmap_get_drvdata); - */ - struct gpio_regmap *gpio_regmap_register(const struct gpio_regmap_config *config) - { -+ struct irq_domain *irq_domain; - struct gpio_regmap *gpio; - struct gpio_chip *chip; - int ret; -@@ -274,12 +288,37 @@ struct gpio_regmap *gpio_regmap_register(const struct gpio_regmap_config *config - chip->direction_output = gpio_regmap_direction_output; - } - -+ if (config->fixed_direction_output) { -+ gpio->fixed_direction_output = bitmap_alloc(chip->ngpio, -+ GFP_KERNEL); -+ if (!gpio->fixed_direction_output) { -+ ret = -ENOMEM; -+ goto err_free_gpio; -+ } -+ bitmap_copy(gpio->fixed_direction_output, -+ config->fixed_direction_output, chip->ngpio); -+ } -+ - ret = gpiochip_add_data(chip, gpio); - if (ret < 0) -- goto err_free_gpio; -+ goto err_free_bitmap; -+ -+#ifdef CONFIG_REGMAP_IRQ -+ if (config->regmap_irq_chip) { -+ gpio->regmap_irq_line = config->regmap_irq_line; -+ ret = regmap_add_irq_chip_fwnode(dev_fwnode(config->parent), config->regmap, -+ config->regmap_irq_line, config->regmap_irq_flags, -+ 0, config->regmap_irq_chip, &gpio->irq_chip_data); -+ if (ret) -+ goto err_free_bitmap; - -- if (config->irq_domain) { -- ret = gpiochip_irqchip_add_domain(chip, config->irq_domain); -+ irq_domain = regmap_irq_get_domain(gpio->irq_chip_data); -+ } else -+#endif -+ irq_domain = config->irq_domain; -+ -+ if (irq_domain) { -+ ret = gpiochip_irqchip_add_domain(chip, irq_domain); - if (ret) - goto err_remove_gpiochip; - } -@@ -288,6 +327,8 @@ struct gpio_regmap *gpio_regmap_register(const struct gpio_regmap_config *config - - err_remove_gpiochip: - gpiochip_remove(chip); -+err_free_bitmap: -+ bitmap_free(gpio->fixed_direction_output); - err_free_gpio: - kfree(gpio); - return ERR_PTR(ret); -@@ -300,7 +341,13 @@ EXPORT_SYMBOL_GPL(gpio_regmap_register); - */ - void gpio_regmap_unregister(struct gpio_regmap *gpio) - { -+#ifdef CONFIG_REGMAP_IRQ -+ if (gpio->irq_chip_data) -+ regmap_del_irq_chip(gpio->regmap_irq_line, gpio->irq_chip_data); -+#endif -+ - gpiochip_remove(&gpio->gpio_chip); -+ bitmap_free(gpio->fixed_direction_output); - kfree(gpio); - } - EXPORT_SYMBOL_GPL(gpio_regmap_unregister); -diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c -index 66a88bba8f15b8..b5f9a40f4a8196 100644 ---- a/drivers/tty/serial/sc16is7xx.c -+++ b/drivers/tty/serial/sc16is7xx.c -@@ -329,8 +329,9 @@ struct sc16is7xx_one { - struct kthread_work reg_work; - struct kthread_delayed_work ms_work; - struct sc16is7xx_one_config config; -- bool irda_mode; - unsigned int old_mctrl; -+ u8 old_lcr; /* Value before EFR access. */ -+ bool irda_mode; - }; - - struct sc16is7xx_port { -@@ -355,10 +356,6 @@ static struct uart_driver sc16is7xx_uart = { - .nr = SC16IS7XX_MAX_DEVS, - }; - --static void sc16is7xx_ier_set(struct uart_port *port, u8 bit); --static void sc16is7xx_stop_tx(struct uart_port *port); -- --#define to_sc16is7xx_port(p,e) ((container_of((p), struct sc16is7xx_port, e))) - #define to_sc16is7xx_one(p,e) ((container_of((p), struct sc16is7xx_one, e))) - - static u8 sc16is7xx_port_read(struct uart_port *port, u8 reg) -@@ -416,6 +413,85 @@ static void sc16is7xx_power(struct uart_port *port, int on) - on ? 0 : SC16IS7XX_IER_SLEEP_BIT); - } - -+/* -+ * In an amazing feat of design, the Enhanced Features Register (EFR) -+ * shares the address of the Interrupt Identification Register (IIR). -+ * Access to EFR is switched on by writing a magic value (0xbf) to the -+ * Line Control Register (LCR). Any interrupt firing during this time will -+ * see the EFR where it expects the IIR to be, leading to -+ * "Unexpected interrupt" messages. -+ * -+ * Prevent this possibility by claiming a mutex while accessing the EFR, -+ * and claiming the same mutex from within the interrupt handler. This is -+ * similar to disabling the interrupt, but that doesn't work because the -+ * bulk of the interrupt processing is run as a workqueue job in thread -+ * context. -+ */ -+static void sc16is7xx_efr_lock(struct uart_port *port) -+{ -+ struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); -+ -+ mutex_lock(&one->efr_lock); -+ -+ /* Backup content of LCR. */ -+ one->old_lcr = sc16is7xx_port_read(port, SC16IS7XX_LCR_REG); -+ -+ /* Enable access to Enhanced register set */ -+ sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, SC16IS7XX_LCR_CONF_MODE_B); -+ -+ /* Disable cache updates when writing to EFR registers */ -+ regcache_cache_bypass(one->regmap, true); -+} -+ -+static void sc16is7xx_efr_unlock(struct uart_port *port) -+{ -+ struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); -+ -+ /* Re-enable cache updates when writing to normal registers */ -+ regcache_cache_bypass(one->regmap, false); -+ -+ /* Restore original content of LCR */ -+ sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, one->old_lcr); -+ -+ mutex_unlock(&one->efr_lock); -+} -+ -+static void sc16is7xx_ier_clear(struct uart_port *port, u8 bit) -+{ -+ struct sc16is7xx_port *s = dev_get_drvdata(port->dev); -+ struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); -+ -+ lockdep_assert_held_once(&port->lock); -+ -+ one->config.flags |= SC16IS7XX_RECONF_IER; -+ one->config.ier_mask |= bit; -+ one->config.ier_val &= ~bit; -+ kthread_queue_work(&s->kworker, &one->reg_work); -+} -+ -+static void sc16is7xx_ier_set(struct uart_port *port, u8 bit) -+{ -+ struct sc16is7xx_port *s = dev_get_drvdata(port->dev); -+ struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); -+ -+ lockdep_assert_held_once(&port->lock); -+ -+ one->config.flags |= SC16IS7XX_RECONF_IER; -+ one->config.ier_mask |= bit; -+ one->config.ier_val |= bit; -+ kthread_queue_work(&s->kworker, &one->reg_work); -+} -+ -+static void sc16is7xx_stop_tx(struct uart_port *port) -+{ -+ sc16is7xx_ier_clear(port, SC16IS7XX_IER_THRI_BIT); -+} -+ -+static void sc16is7xx_stop_rx(struct uart_port *port) -+{ -+ sc16is7xx_ier_clear(port, SC16IS7XX_IER_RDI_BIT); -+} -+ - static const struct sc16is7xx_devtype sc16is74x_devtype = { - .name = "SC16IS74X", - .nr_gpio = 0, -@@ -506,40 +582,6 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) - div /= prescaler; - } - -- /* In an amazing feat of design, the Enhanced Features Register shares -- * the address of the Interrupt Identification Register, and is -- * switched in by writing a magic value (0xbf) to the Line Control -- * Register. Any interrupt firing during this time will see the EFR -- * where it expects the IIR to be, leading to "Unexpected interrupt" -- * messages. -- * -- * Prevent this possibility by claiming a mutex while accessing the -- * EFR, and claiming the same mutex from within the interrupt handler. -- * This is similar to disabling the interrupt, but that doesn't work -- * because the bulk of the interrupt processing is run as a workqueue -- * job in thread context. -- */ -- mutex_lock(&one->efr_lock); -- -- lcr = sc16is7xx_port_read(port, SC16IS7XX_LCR_REG); -- -- /* Open the LCR divisors for configuration */ -- sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, -- SC16IS7XX_LCR_CONF_MODE_B); -- -- /* Enable enhanced features */ -- regcache_cache_bypass(one->regmap, true); -- sc16is7xx_port_update(port, SC16IS7XX_EFR_REG, -- SC16IS7XX_EFR_ENABLE_BIT, -- SC16IS7XX_EFR_ENABLE_BIT); -- -- regcache_cache_bypass(one->regmap, false); -- -- /* Put LCR back to the normal mode */ -- sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr); -- -- mutex_unlock(&one->efr_lock); -- - /* If bit MCR_CLKSEL is set, the divide by 4 prescaler is activated. */ - sc16is7xx_port_update(port, SC16IS7XX_MCR_REG, - SC16IS7XX_MCR_CLKSEL_BIT, -@@ -547,7 +589,8 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) - - mutex_lock(&one->efr_lock); - -- /* Open the LCR divisors for configuration */ -+ /* Backup LCR and access special register set (DLL/DLH) */ -+ lcr = sc16is7xx_port_read(port, SC16IS7XX_LCR_REG); - sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, - SC16IS7XX_LCR_CONF_MODE_A); - -@@ -557,7 +600,7 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) - sc16is7xx_port_write(port, SC16IS7XX_DLL_REG, div % 256); - regcache_cache_bypass(one->regmap, false); - -- /* Put LCR back to the normal mode */ -+ /* Restore LCR and access to general register set */ - sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr); - - mutex_unlock(&one->efr_lock); -@@ -889,42 +932,6 @@ static void sc16is7xx_reg_proc(struct kthread_work *ws) - sc16is7xx_reconf_rs485(&one->port); - } - --static void sc16is7xx_ier_clear(struct uart_port *port, u8 bit) --{ -- struct sc16is7xx_port *s = dev_get_drvdata(port->dev); -- struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); -- -- lockdep_assert_held_once(&port->lock); -- -- one->config.flags |= SC16IS7XX_RECONF_IER; -- one->config.ier_mask |= bit; -- one->config.ier_val &= ~bit; -- kthread_queue_work(&s->kworker, &one->reg_work); --} -- --static void sc16is7xx_ier_set(struct uart_port *port, u8 bit) --{ -- struct sc16is7xx_port *s = dev_get_drvdata(port->dev); -- struct sc16is7xx_one *one = to_sc16is7xx_one(port, port); -- -- lockdep_assert_held_once(&port->lock); -- -- one->config.flags |= SC16IS7XX_RECONF_IER; -- one->config.ier_mask |= bit; -- one->config.ier_val |= bit; -- kthread_queue_work(&s->kworker, &one->reg_work); --} -- --static void sc16is7xx_stop_tx(struct uart_port *port) --{ -- sc16is7xx_ier_clear(port, SC16IS7XX_IER_THRI_BIT); --} -- --static void sc16is7xx_stop_rx(struct uart_port *port) --{ -- sc16is7xx_ier_clear(port, SC16IS7XX_IER_RDI_BIT); --} -- - static void sc16is7xx_ms_proc(struct kthread_work *ws) - { - struct sc16is7xx_one *one = to_sc16is7xx_one(ws, ms_work.work); -@@ -1074,17 +1081,7 @@ static void sc16is7xx_set_termios(struct uart_port *port, - if (!(termios->c_cflag & CREAD)) - port->ignore_status_mask |= SC16IS7XX_LSR_BRK_ERROR_MASK; - -- /* As above, claim the mutex while accessing the EFR. */ -- mutex_lock(&one->efr_lock); -- -- sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, -- SC16IS7XX_LCR_CONF_MODE_B); -- - /* Configure flow control */ -- regcache_cache_bypass(one->regmap, true); -- sc16is7xx_port_write(port, SC16IS7XX_XON1_REG, termios->c_cc[VSTART]); -- sc16is7xx_port_write(port, SC16IS7XX_XOFF1_REG, termios->c_cc[VSTOP]); -- - port->status &= ~(UPSTAT_AUTOCTS | UPSTAT_AUTORTS); - if (termios->c_cflag & CRTSCTS) { - flow |= SC16IS7XX_EFR_AUTOCTS_BIT | -@@ -1096,16 +1093,16 @@ static void sc16is7xx_set_termios(struct uart_port *port, - if (termios->c_iflag & IXOFF) - flow |= SC16IS7XX_EFR_SWFLOW1_BIT; - -- sc16is7xx_port_update(port, -- SC16IS7XX_EFR_REG, -- SC16IS7XX_EFR_FLOWCTRL_BITS, -- flow); -- regcache_cache_bypass(one->regmap, false); -- - /* Update LCR register */ - sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr); - -- mutex_unlock(&one->efr_lock); -+ /* Update EFR registers */ -+ sc16is7xx_efr_lock(port); -+ sc16is7xx_port_write(port, SC16IS7XX_XON1_REG, termios->c_cc[VSTART]); -+ sc16is7xx_port_write(port, SC16IS7XX_XOFF1_REG, termios->c_cc[VSTOP]); -+ sc16is7xx_port_update(port, SC16IS7XX_EFR_REG, -+ SC16IS7XX_EFR_FLOWCTRL_BITS, flow); -+ sc16is7xx_efr_unlock(port); - - /* Get baud rate generator configuration */ - baud = uart_get_baud_rate(port, termios, old, -diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c -index bfd437269800cf..4d975b26a185cf 100644 ---- a/drivers/usb/host/xhci-dbgcap.c -+++ b/drivers/usb/host/xhci-dbgcap.c -@@ -665,7 +665,8 @@ static int xhci_dbc_start(struct xhci_dbc *dbc) - return ret; - } - -- return mod_delayed_work(system_wq, &dbc->event_work, 1); -+ return mod_delayed_work(system_wq, &dbc->event_work, -+ msecs_to_jiffies(dbc->poll_interval)); - } - - static void xhci_dbc_stop(struct xhci_dbc *dbc) -@@ -854,6 +855,7 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc) - { - dma_addr_t deq; - union xhci_trb *evt; -+ enum evtreturn ret = EVT_DONE; - u32 ctrl, portsc; - bool update_erdp = false; - -@@ -878,7 +880,8 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc) - dev_info(dbc->dev, "DbC configured\n"); - portsc = readl(&dbc->regs->portsc); - writel(portsc, &dbc->regs->portsc); -- return EVT_GSER; -+ ret = EVT_GSER; -+ break; - } - - return EVT_DONE; -@@ -938,6 +941,8 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc) - break; - case TRB_TYPE(TRB_TRANSFER): - dbc_handle_xfer_event(dbc, evt); -+ if (ret != EVT_GSER) -+ ret = EVT_XFER_DONE; - break; - default: - break; -@@ -956,7 +961,7 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc) - lo_hi_writeq(deq, &dbc->regs->erdp); - } - -- return EVT_DONE; -+ return ret; - } - - static void xhci_dbc_handle_events(struct work_struct *work) -@@ -964,8 +969,11 @@ static void xhci_dbc_handle_events(struct work_struct *work) - enum evtreturn evtr; - struct xhci_dbc *dbc; - unsigned long flags; -+ unsigned int poll_interval; -+ unsigned long busypoll_timelimit; - - dbc = container_of(to_delayed_work(work), struct xhci_dbc, event_work); -+ poll_interval = dbc->poll_interval; - - spin_lock_irqsave(&dbc->lock, flags); - evtr = xhci_dbc_do_handle_events(dbc); -@@ -981,13 +989,28 @@ static void xhci_dbc_handle_events(struct work_struct *work) - dbc->driver->disconnect(dbc); - break; - case EVT_DONE: -+ /* -+ * Set fast poll rate if there are pending out transfers, or -+ * a transfer was recently processed -+ */ -+ busypoll_timelimit = dbc->xfer_timestamp + -+ msecs_to_jiffies(DBC_XFER_INACTIVITY_TIMEOUT); -+ -+ if (!list_empty(&dbc->eps[BULK_OUT].list_pending) || -+ time_is_after_jiffies(busypoll_timelimit)) -+ poll_interval = 0; -+ break; -+ case EVT_XFER_DONE: -+ dbc->xfer_timestamp = jiffies; -+ poll_interval = 0; - break; - default: - dev_info(dbc->dev, "stop handling dbc events\n"); - return; - } - -- mod_delayed_work(system_wq, &dbc->event_work, 1); -+ mod_delayed_work(system_wq, &dbc->event_work, -+ msecs_to_jiffies(poll_interval)); - } - - static ssize_t dbc_show(struct device *dev, -@@ -1206,11 +1229,48 @@ static ssize_t dbc_bInterfaceProtocol_store(struct device *dev, - return size; - } - -+static ssize_t dbc_poll_interval_ms_show(struct device *dev, -+ struct device_attribute *attr, -+ char *buf) -+{ -+ struct xhci_dbc *dbc; -+ struct xhci_hcd *xhci; -+ -+ xhci = hcd_to_xhci(dev_get_drvdata(dev)); -+ dbc = xhci->dbc; -+ -+ return sysfs_emit(buf, "%u\n", dbc->poll_interval); -+} -+ -+static ssize_t dbc_poll_interval_ms_store(struct device *dev, -+ struct device_attribute *attr, -+ const char *buf, size_t size) -+{ -+ struct xhci_dbc *dbc; -+ struct xhci_hcd *xhci; -+ u32 value; -+ int ret; -+ -+ ret = kstrtou32(buf, 0, &value); -+ if (ret || value > DBC_POLL_INTERVAL_MAX) -+ return -EINVAL; -+ -+ xhci = hcd_to_xhci(dev_get_drvdata(dev)); -+ dbc = xhci->dbc; -+ -+ dbc->poll_interval = value; -+ -+ mod_delayed_work(system_wq, &dbc->event_work, 0); -+ -+ return size; -+} -+ - static DEVICE_ATTR_RW(dbc); - static DEVICE_ATTR_RW(dbc_idVendor); - static DEVICE_ATTR_RW(dbc_idProduct); - static DEVICE_ATTR_RW(dbc_bcdDevice); - static DEVICE_ATTR_RW(dbc_bInterfaceProtocol); -+static DEVICE_ATTR_RW(dbc_poll_interval_ms); - - static struct attribute *dbc_dev_attributes[] = { - &dev_attr_dbc.attr, -@@ -1218,6 +1278,7 @@ static struct attribute *dbc_dev_attributes[] = { - &dev_attr_dbc_idProduct.attr, - &dev_attr_dbc_bcdDevice.attr, - &dev_attr_dbc_bInterfaceProtocol.attr, -+ &dev_attr_dbc_poll_interval_ms.attr, - NULL - }; - -@@ -1242,6 +1303,7 @@ xhci_alloc_dbc(struct device *dev, void __iomem *base, const struct dbc_driver * - dbc->idVendor = DBC_VENDOR_ID; - dbc->bcdDevice = DBC_DEVICE_REV; - dbc->bInterfaceProtocol = DBC_PROTOCOL; -+ dbc->poll_interval = DBC_POLL_INTERVAL_DEFAULT; - - if (readl(&dbc->regs->control) & DBC_CTRL_DBC_ENABLE) - goto err; -diff --git a/drivers/usb/host/xhci-dbgcap.h b/drivers/usb/host/xhci-dbgcap.h -index 2de0dc49a3e9f7..1fab3eb9c831d3 100644 ---- a/drivers/usb/host/xhci-dbgcap.h -+++ b/drivers/usb/host/xhci-dbgcap.h -@@ -93,7 +93,9 @@ struct dbc_ep { - - #define DBC_QUEUE_SIZE 16 - #define DBC_WRITE_BUF_SIZE 8192 -- -+#define DBC_POLL_INTERVAL_DEFAULT 64 /* milliseconds */ -+#define DBC_POLL_INTERVAL_MAX 5000 /* milliseconds */ -+#define DBC_XFER_INACTIVITY_TIMEOUT 10 /* milliseconds */ - /* - * Private structure for DbC hardware state: - */ -@@ -139,6 +141,8 @@ struct xhci_dbc { - - enum dbc_state state; - struct delayed_work event_work; -+ unsigned int poll_interval; /* ms */ -+ unsigned long xfer_timestamp; - unsigned resume_required:1; - struct dbc_ep eps[2]; - -@@ -184,6 +188,7 @@ struct dbc_request { - enum evtreturn { - EVT_ERR = -1, - EVT_DONE, -+ EVT_XFER_DONE, - EVT_GSER, - EVT_DISC, - }; -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index bb5f7911d473cb..7ad1734cbbfc91 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -2080,10 +2080,10 @@ static int btrfs_replay_log(struct btrfs_fs_info *fs_info, - - /* returns with log_tree_root freed on success */ - ret = btrfs_recover_log_trees(log_tree_root); -+ btrfs_put_root(log_tree_root); - if (ret) { - btrfs_handle_fs_error(fs_info, ret, - "Failed to recover log tree"); -- btrfs_put_root(log_tree_root); - return ret; - } - -diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c -index 8248113eb067fa..5e3d1a87b7e9da 100644 ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -4175,7 +4175,8 @@ static int prepare_allocation_clustered(struct btrfs_fs_info *fs_info, - } - - static int prepare_allocation_zoned(struct btrfs_fs_info *fs_info, -- struct find_free_extent_ctl *ffe_ctl) -+ struct find_free_extent_ctl *ffe_ctl, -+ struct btrfs_space_info *space_info) - { - if (ffe_ctl->for_treelog) { - spin_lock(&fs_info->treelog_bg_lock); -@@ -4199,6 +4200,7 @@ static int prepare_allocation_zoned(struct btrfs_fs_info *fs_info, - u64 avail = block_group->zone_capacity - block_group->alloc_offset; - - if (block_group_bits(block_group, ffe_ctl->flags) && -+ block_group->space_info == space_info && - avail >= ffe_ctl->num_bytes) { - ffe_ctl->hint_byte = block_group->start; - break; -@@ -4220,7 +4222,7 @@ static int prepare_allocation(struct btrfs_fs_info *fs_info, - return prepare_allocation_clustered(fs_info, ffe_ctl, - space_info, ins); - case BTRFS_EXTENT_ALLOC_ZONED: -- return prepare_allocation_zoned(fs_info, ffe_ctl); -+ return prepare_allocation_zoned(fs_info, ffe_ctl, space_info); - default: - BUG(); - } -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index ee5ffeab85bb78..b1be3e0fe72823 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -3051,9 +3051,10 @@ int btrfs_finish_one_ordered(struct btrfs_ordered_extent *ordered_extent) - goto out; - } - -- if (btrfs_is_zoned(fs_info)) -- btrfs_zone_finish_endio(fs_info, ordered_extent->disk_bytenr, -- ordered_extent->disk_num_bytes); -+ ret = btrfs_zone_finish_endio(fs_info, ordered_extent->disk_bytenr, -+ ordered_extent->disk_num_bytes); -+ if (ret) -+ goto out; - - if (test_bit(BTRFS_ORDERED_TRUNCATED, &ordered_extent->flags)) { - truncated = true; -diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c -index 7632d652a1257d..4a5a5ee360e579 100644 ---- a/fs/btrfs/scrub.c -+++ b/fs/btrfs/scrub.c -@@ -1271,8 +1271,7 @@ static void scrub_throttle_dev_io(struct scrub_ctx *sctx, struct btrfs_device *d - * Slice is divided into intervals when the IO is submitted, adjust by - * bwlimit and maximum of 64 intervals. - */ -- div = max_t(u32, 1, (u32)(bwlimit / (16 * 1024 * 1024))); -- div = min_t(u32, 64, div); -+ div = clamp(bwlimit / (16 * 1024 * 1024), 1, 64); - - /* Start new epoch, set deadline */ - now = ktime_get(); -diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c -index 3989cb19cdae70..20add63421b3d8 100644 ---- a/fs/btrfs/transaction.c -+++ b/fs/btrfs/transaction.c -@@ -1796,7 +1796,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans, - } - /* see comments in should_cow_block() */ - set_bit(BTRFS_ROOT_FORCE_COW, &root->state); -- smp_wmb(); -+ smp_mb__after_atomic(); - - btrfs_set_root_node(new_root_item, tmp); - /* record when the snapshot was created in key.offset */ -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index 4b53e19f7520fe..5512991b24faa8 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -2493,15 +2493,13 @@ static int replay_one_buffer(struct btrfs_root *log, struct extent_buffer *eb, - int i; - int ret; - -+ if (level != 0) -+ return 0; -+ - ret = btrfs_read_extent_buffer(eb, &check); - if (ret) - return ret; - -- level = btrfs_header_level(eb); -- -- if (level != 0) -- return 0; -- - path = btrfs_alloc_path(); - if (!path) - return -ENOMEM; -@@ -7422,7 +7420,6 @@ int btrfs_recover_log_trees(struct btrfs_root *log_root_tree) - - log_root_tree->log_root = NULL; - clear_bit(BTRFS_FS_LOG_RECOVERING, &fs_info->flags); -- btrfs_put_root(log_root_tree); - - return 0; - error: -diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c -index 3622ba1d8e09f4..6e8b8c46ba18f6 100644 ---- a/fs/btrfs/zoned.c -+++ b/fs/btrfs/zoned.c -@@ -2263,16 +2263,17 @@ bool btrfs_can_activate_zone(struct btrfs_fs_devices *fs_devices, u64 flags) - return ret; - } - --void btrfs_zone_finish_endio(struct btrfs_fs_info *fs_info, u64 logical, u64 length) -+int btrfs_zone_finish_endio(struct btrfs_fs_info *fs_info, u64 logical, u64 length) - { - struct btrfs_block_group *block_group; - u64 min_alloc_bytes; - - if (!btrfs_is_zoned(fs_info)) -- return; -+ return 0; - - block_group = btrfs_lookup_block_group(fs_info, logical); -- ASSERT(block_group); -+ if (WARN_ON_ONCE(!block_group)) -+ return -ENOENT; - - /* No MIXED_BG on zoned btrfs. */ - if (block_group->flags & BTRFS_BLOCK_GROUP_DATA) -@@ -2289,6 +2290,7 @@ void btrfs_zone_finish_endio(struct btrfs_fs_info *fs_info, u64 logical, u64 len - - out: - btrfs_put_block_group(block_group); -+ return 0; - } - - static void btrfs_zone_finish_endio_workfn(struct work_struct *work) -diff --git a/fs/btrfs/zoned.h b/fs/btrfs/zoned.h -index 448955641d1143..c18f31d3dc25f6 100644 ---- a/fs/btrfs/zoned.h -+++ b/fs/btrfs/zoned.h -@@ -71,7 +71,7 @@ int btrfs_sync_zone_write_pointer(struct btrfs_device *tgt_dev, u64 logical, - bool btrfs_zone_activate(struct btrfs_block_group *block_group); - int btrfs_zone_finish(struct btrfs_block_group *block_group); - bool btrfs_can_activate_zone(struct btrfs_fs_devices *fs_devices, u64 flags); --void btrfs_zone_finish_endio(struct btrfs_fs_info *fs_info, u64 logical, -+int btrfs_zone_finish_endio(struct btrfs_fs_info *fs_info, u64 logical, - u64 length); - void btrfs_schedule_zone_finish_bg(struct btrfs_block_group *bg, - struct extent_buffer *eb); -@@ -227,8 +227,11 @@ static inline bool btrfs_can_activate_zone(struct btrfs_fs_devices *fs_devices, - return true; - } - --static inline void btrfs_zone_finish_endio(struct btrfs_fs_info *fs_info, -- u64 logical, u64 length) { } -+static inline int btrfs_zone_finish_endio(struct btrfs_fs_info *fs_info, -+ u64 logical, u64 length) -+{ -+ return 0; -+} - - static inline void btrfs_schedule_zone_finish_bg(struct btrfs_block_group *bg, - struct extent_buffer *eb) { } -diff --git a/include/linux/audit.h b/include/linux/audit.h -index 335e1ba5a23271..7ca75f8873799d 100644 ---- a/include/linux/audit.h -+++ b/include/linux/audit.h -@@ -526,7 +526,7 @@ static inline void audit_log_kern_module(const char *name) - - static inline void audit_fanotify(u32 response, struct fanotify_response_info_audit_rule *friar) - { -- if (!audit_dummy_context()) -+ if (audit_enabled) - __audit_fanotify(response, friar); - } - -diff --git a/include/linux/bitops.h b/include/linux/bitops.h -index f7f5a783da2aa8..b2342eebc8d226 100644 ---- a/include/linux/bitops.h -+++ b/include/linux/bitops.h -@@ -15,7 +15,6 @@ - # define aligned_byte_mask(n) (~0xffUL << (BITS_PER_LONG - 8 - 8*(n))) - #endif - --#define BITS_PER_TYPE(type) (sizeof(type) * BITS_PER_BYTE) - #define BITS_TO_LONGS(nr) __KERNEL_DIV_ROUND_UP(nr, BITS_PER_TYPE(long)) - #define BITS_TO_U64(nr) __KERNEL_DIV_ROUND_UP(nr, BITS_PER_TYPE(u64)) - #define BITS_TO_U32(nr) __KERNEL_DIV_ROUND_UP(nr, BITS_PER_TYPE(u32)) -diff --git a/include/linux/bits.h b/include/linux/bits.h -index 7c0cf5031abe87..09e167bc453046 100644 ---- a/include/linux/bits.h -+++ b/include/linux/bits.h -@@ -11,6 +11,7 @@ - #define BIT_ULL_MASK(nr) (ULL(1) << ((nr) % BITS_PER_LONG_LONG)) - #define BIT_ULL_WORD(nr) ((nr) / BITS_PER_LONG_LONG) - #define BITS_PER_BYTE 8 -+#define BITS_PER_TYPE(type) (sizeof(type) * BITS_PER_BYTE) - - /* - * Create a contiguous bitmask starting at bit position @l and ending at -@@ -18,17 +19,50 @@ - * GENMASK_ULL(39, 21) gives us the 64bit vector 0x000000ffffe00000. - */ - #if !defined(__ASSEMBLY__) -+ -+/* -+ * Missing asm support -+ * -+ * GENMASK_U*() depend on BITS_PER_TYPE() which relies on sizeof(), -+ * something not available in asm. Nevertheless, fixed width integers is a C -+ * concept. Assembly code can rely on the long and long long versions instead. -+ */ -+ - #include -+#include - #define GENMASK_INPUT_CHECK(h, l) \ - (BUILD_BUG_ON_ZERO(__builtin_choose_expr( \ - __is_constexpr((l) > (h)), (l) > (h), 0))) --#else -+ -+/* -+ * Generate a mask for the specified type @t. Additional checks are made to -+ * guarantee the value returned fits in that type, relying on -+ * -Wshift-count-overflow compiler check to detect incompatible arguments. -+ * For example, all these create build errors or warnings: -+ * -+ * - GENMASK(15, 20): wrong argument order -+ * - GENMASK(72, 15): doesn't fit unsigned long -+ * - GENMASK_U32(33, 15): doesn't fit in a u32 -+ */ -+#define GENMASK_TYPE(t, h, l) \ -+ ((t)(GENMASK_INPUT_CHECK(h, l) + \ -+ (type_max(t) << (l) & \ -+ type_max(t) >> (BITS_PER_TYPE(t) - 1 - (h))))) -+ -+#define GENMASK_U8(h, l) GENMASK_TYPE(u8, h, l) -+#define GENMASK_U16(h, l) GENMASK_TYPE(u16, h, l) -+#define GENMASK_U32(h, l) GENMASK_TYPE(u32, h, l) -+#define GENMASK_U64(h, l) GENMASK_TYPE(u64, h, l) -+ -+#else /* defined(__ASSEMBLY__) */ -+ - /* - * BUILD_BUG_ON_ZERO is not available in h files included from asm files, - * disable the input check if that is the case. - */ - #define GENMASK_INPUT_CHECK(h, l) 0 --#endif -+ -+#endif /* !defined(__ASSEMBLY__) */ - - #define __GENMASK(h, l) \ - (((~UL(0)) - (UL(1) << (l)) + 1) & \ -diff --git a/include/linux/gpio/regmap.h b/include/linux/gpio/regmap.h -index a9f7b7faf57b0d..cf55202aaec264 100644 ---- a/include/linux/gpio/regmap.h -+++ b/include/linux/gpio/regmap.h -@@ -37,9 +37,18 @@ struct regmap; - * offset to a register/bitmask pair. If not - * given the default gpio_regmap_simple_xlate() - * is used. -+ * @fixed_direction_output: -+ * (Optional) Bitmap representing the fixed direction of -+ * the GPIO lines. Useful when there are GPIO lines with a -+ * fixed direction mixed together in the same register. - * @drvdata: (Optional) Pointer to driver specific data which is - * not used by gpio-remap but is provided "as is" to the - * driver callback(s). -+ * @regmap_irq_chip: (Optional) Pointer on an regmap_irq_chip structure. If -+ * set, a regmap-irq device will be created and the IRQ -+ * domain will be set accordingly. -+ * @regmap_irq_line (Optional) The IRQ the device uses to signal interrupts. -+ * @regmap_irq_flags (Optional) The IRQF_ flags to use for the interrupt. - * - * The ->reg_mask_xlate translates a given base address and GPIO offset to - * register and mask pair. The base address is one of the given register -@@ -77,6 +86,13 @@ struct gpio_regmap_config { - int reg_stride; - int ngpio_per_reg; - struct irq_domain *irq_domain; -+ unsigned long *fixed_direction_output; -+ -+#ifdef CONFIG_REGMAP_IRQ -+ struct regmap_irq_chip *regmap_irq_chip; -+ int regmap_irq_line; -+ unsigned long regmap_irq_flags; -+#endif - - int (*reg_mask_xlate)(struct gpio_regmap *gpio, unsigned int base, - unsigned int offset, unsigned int *reg, -diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h -index 15960564e0c364..4d72d24b1f33e7 100644 ---- a/include/net/pkt_sched.h -+++ b/include/net/pkt_sched.h -@@ -112,7 +112,6 @@ struct qdisc_rate_table *qdisc_get_rtab(struct tc_ratespec *r, - struct netlink_ext_ack *extack); - void qdisc_put_rtab(struct qdisc_rate_table *tab); - void qdisc_put_stab(struct qdisc_size_table *tab); --void qdisc_warn_nonwc(const char *txt, struct Qdisc *qdisc); - bool sch_direct_xmit(struct sk_buff *skb, struct Qdisc *q, - struct net_device *dev, struct netdev_queue *txq, - spinlock_t *root_lock, bool validate); -@@ -306,4 +305,28 @@ static inline bool tc_qdisc_stats_dump(struct Qdisc *sch, - return true; - } - -+static inline void qdisc_warn_nonwc(const char *txt, struct Qdisc *qdisc) -+{ -+ if (!(qdisc->flags & TCQ_F_WARN_NONWC)) { -+ pr_warn("%s: %s qdisc %X: is non-work-conserving?\n", -+ txt, qdisc->ops->id, qdisc->handle >> 16); -+ qdisc->flags |= TCQ_F_WARN_NONWC; -+ } -+} -+ -+static inline unsigned int qdisc_peek_len(struct Qdisc *sch) -+{ -+ struct sk_buff *skb; -+ unsigned int len; -+ -+ skb = sch->ops->peek(sch); -+ if (unlikely(skb == NULL)) { -+ qdisc_warn_nonwc("qdisc_peek_len", sch); -+ return 0; -+ } -+ len = qdisc_pkt_len(skb); -+ -+ return len; -+} -+ - #endif -diff --git a/kernel/events/callchain.c b/kernel/events/callchain.c -index 1273be84392cfc..ee01cfcc35064a 100644 ---- a/kernel/events/callchain.c -+++ b/kernel/events/callchain.c -@@ -184,6 +184,10 @@ get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool kernel, bool user, - struct perf_callchain_entry_ctx ctx; - int rctx; - -+ /* crosstask is not supported for user stacks */ -+ if (crosstask && user && !kernel) -+ return NULL; -+ - entry = get_callchain_entry(&rctx); - if (!entry) - return NULL; -@@ -200,18 +204,15 @@ get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool kernel, bool user, - perf_callchain_kernel(&ctx, regs); - } - -- if (user) { -+ if (user && !crosstask) { - if (!user_mode(regs)) { -- if (current->mm) -- regs = task_pt_regs(current); -- else -+ if (current->flags & (PF_KTHREAD | PF_USER_WORKER)) - regs = NULL; -+ else -+ regs = task_pt_regs(current); - } - - if (regs) { -- if (crosstask) -- goto exit_put; -- - if (add_mark) - perf_callchain_store_context(&ctx, PERF_CONTEXT_USER); - -@@ -219,7 +220,6 @@ get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool kernel, bool user, - } - } - --exit_put: - put_callchain_entry(rctx); - - return entry; -diff --git a/kernel/events/core.c b/kernel/events/core.c -index b73f5c44113d64..c9a3fb6fdb2f64 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -6985,7 +6985,7 @@ static void perf_sample_regs_user(struct perf_regs *regs_user, - if (user_mode(regs)) { - regs_user->abi = perf_reg_abi(current); - regs_user->regs = regs; -- } else if (!(current->flags & PF_KTHREAD)) { -+ } else if (!(current->flags & (PF_KTHREAD | PF_USER_WORKER))) { - perf_get_regs_user(regs_user, regs); - } else { - regs_user->abi = PERF_SAMPLE_REGS_ABI_NONE; -@@ -7612,7 +7612,7 @@ static u64 perf_virt_to_phys(u64 virt) - * Try IRQ-safe get_user_page_fast_only first. - * If failed, leave phys_addr as 0. - */ -- if (current->mm != NULL) { -+ if (!(current->flags & (PF_KTHREAD | PF_USER_WORKER))) { - struct page *p; - - pagefault_disable(); -@@ -7724,7 +7724,8 @@ struct perf_callchain_entry * - perf_callchain(struct perf_event *event, struct pt_regs *regs) - { - bool kernel = !event->attr.exclude_callchain_kernel; -- bool user = !event->attr.exclude_callchain_user; -+ bool user = !event->attr.exclude_callchain_user && -+ !(current->flags & (PF_KTHREAD | PF_USER_WORKER)); - /* Disallow cross-task user callchains. */ - bool crosstask = event->ctx->task && event->ctx->task != current; - const u32 max_stack = event->attr.sample_max_stack; -diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c -index 9d2c38421f7a2b..7fd6714f41fe79 100644 ---- a/net/mptcp/pm_netlink.c -+++ b/net/mptcp/pm_netlink.c -@@ -619,6 +619,10 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) - } - - subflow: -+ /* No need to try establishing subflows to remote id0 if not allowed */ -+ if (mptcp_pm_add_addr_c_flag_case(msk)) -+ goto exit; -+ - /* check if should create a new subflow */ - while (msk->pm.local_addr_used < local_addr_max && - msk->pm.subflows < subflows_max) { -@@ -650,6 +654,8 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) - __mptcp_subflow_connect(sk, &local.addr, &addrs[i]); - spin_lock_bh(&msk->pm.lock); - } -+ -+exit: - mptcp_pm_nl_check_work_pending(msk); - } - -diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c -index a300e8c1b53aaa..b20dc987b907fc 100644 ---- a/net/sched/sch_api.c -+++ b/net/sched/sch_api.c -@@ -599,16 +599,6 @@ void __qdisc_calculate_pkt_len(struct sk_buff *skb, - qdisc_skb_cb(skb)->pkt_len = pkt_len; - } - --void qdisc_warn_nonwc(const char *txt, struct Qdisc *qdisc) --{ -- if (!(qdisc->flags & TCQ_F_WARN_NONWC)) { -- pr_warn("%s: %s qdisc %X: is non-work-conserving?\n", -- txt, qdisc->ops->id, qdisc->handle >> 16); -- qdisc->flags |= TCQ_F_WARN_NONWC; -- } --} --EXPORT_SYMBOL(qdisc_warn_nonwc); -- - static enum hrtimer_restart qdisc_watchdog(struct hrtimer *timer) - { - struct qdisc_watchdog *wd = container_of(timer, struct qdisc_watchdog, -diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c -index afcb83d469ff60..751b1e2c35b3f9 100644 ---- a/net/sched/sch_hfsc.c -+++ b/net/sched/sch_hfsc.c -@@ -835,22 +835,6 @@ update_vf(struct hfsc_class *cl, unsigned int len, u64 cur_time) - } - } - --static unsigned int --qdisc_peek_len(struct Qdisc *sch) --{ -- struct sk_buff *skb; -- unsigned int len; -- -- skb = sch->ops->peek(sch); -- if (unlikely(skb == NULL)) { -- qdisc_warn_nonwc("qdisc_peek_len", sch); -- return 0; -- } -- len = qdisc_pkt_len(skb); -- -- return len; --} -- - static void - hfsc_adjust_levels(struct hfsc_class *cl) - { -diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c -index c3f9a6375b4ea6..69fdbbbb3b6346 100644 ---- a/net/sched/sch_qfq.c -+++ b/net/sched/sch_qfq.c -@@ -1002,7 +1002,7 @@ static struct sk_buff *agg_dequeue(struct qfq_aggregate *agg, - - if (cl->qdisc->q.qlen == 0) /* no more packets, remove from list */ - list_del_init(&cl->alist); -- else if (cl->deficit < qdisc_pkt_len(cl->qdisc->ops->peek(cl->qdisc))) { -+ else if (cl->deficit < qdisc_peek_len(cl->qdisc)) { - cl->deficit += agg->lmax; - list_move_tail(&cl->alist, &agg->active); - } -diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh -index d30314532bb71d..b9cc3d51dc2857 100755 ---- a/tools/testing/selftests/net/mptcp/mptcp_join.sh -+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh -@@ -3837,7 +3837,8 @@ endpoint_tests() - - # remove and re-add - if reset_with_events "delete re-add signal" && -- mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then -+ continue_if mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then -+ ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=0 - pm_nl_set_limits $ns1 0 3 - pm_nl_set_limits $ns2 3 3 - pm_nl_add_endpoint $ns1 10.0.2.1 id 1 flags signal diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.116-117-fixed.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.116-117-fixed.patch deleted file mode 100644 index c9c5f569ab..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.116-117-fixed.patch +++ /dev/null @@ -1,18588 +0,0 @@ -diff --git a/Documentation/admin-guide/cgroup-v2.rst b/Documentation/admin-guide/cgroup-v2.rst -index b26b5274eaaf14..622a7f28db1fd5 100644 ---- a/Documentation/admin-guide/cgroup-v2.rst -+++ b/Documentation/admin-guide/cgroup-v2.rst -@@ -1532,6 +1532,15 @@ PAGE_SIZE multiple when read back. - collapsing an existing range of pages. This counter is not - present when CONFIG_TRANSPARENT_HUGEPAGE is not set. - -+ thp_swpout (npn) -+ Number of transparent hugepages which are swapout in one piece -+ without splitting. -+ -+ thp_swpout_fallback (npn) -+ Number of transparent hugepages which were split before swapout. -+ Usually because failed to allocate some continuous swap space -+ for the huge page. -+ - memory.numa_stat - A read-only nested-keyed file which exists on non-root cgroups. - -diff --git a/MAINTAINERS b/MAINTAINERS -index 294d2ce29b7356..c1aafeb3babf98 100644 ---- a/MAINTAINERS -+++ b/MAINTAINERS -@@ -14725,6 +14725,7 @@ NETDEVSIM - M: Jakub Kicinski - S: Maintained - F: drivers/net/netdevsim/* -+F: tools/testing/selftests/drivers/net/netdevsim/* - - NETEM NETWORK EMULATOR - M: Stephen Hemminger -diff --git a/Makefile b/Makefile -index f28f1f9f5f4e6d..a849399cebf8fd 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 116 -+SUBLEVEL = 117 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h -index f5a936496f0600..24981bba974d3f 100644 ---- a/arch/arc/include/asm/bitops.h -+++ b/arch/arc/include/asm/bitops.h -@@ -133,6 +133,8 @@ static inline __attribute__ ((const)) int fls(unsigned int x) - */ - static inline __attribute__ ((const)) unsigned long __fls(unsigned long x) - { -+ if (__builtin_constant_p(x)) -+ return x ? BITS_PER_LONG - 1 - __builtin_clzl(x) : 0; - /* FLS insn has exactly same semantics as the API */ - return __builtin_arc_fls(x); - } -diff --git a/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts b/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts -index ac44c745bdf8e6..a39a021a39107e 100644 ---- a/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts -+++ b/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts -@@ -55,8 +55,8 @@ &gmac0 { - mdio { - /delete-node/ switch@1e; - -- bcm54210e: ethernet-phy@0 { -- reg = <0>; -+ bcm54210e: ethernet-phy@25 { -+ reg = <25>; - }; - }; - }; -diff --git a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts -index a3757b7daeda49..071a31191ec271 100644 ---- a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts -+++ b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts -@@ -502,6 +502,9 @@ magnetometer@e { - compatible = "asahi-kasei,ak8974"; - reg = <0xe>; - -+ interrupt-parent = <&gpio>; -+ interrupts = ; -+ - avdd-supply = <&vdd_3v3_sys>; - dvdd-supply = <&vdd_1v8_sys>; - -@@ -515,7 +518,7 @@ wm8903: audio-codec@1a { - reg = <0x1a>; - - interrupt-parent = <&gpio>; -- interrupts = ; -+ interrupts = ; - - gpio-controller; - #gpio-cells = <2>; -diff --git a/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts b/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts -index 5d4b29d765853e..6cc4c2f08b15dc 100644 ---- a/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts -+++ b/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts -@@ -259,7 +259,7 @@ &audmux { - pinctrl-0 = <&pinctrl_audmux>; - status = "okay"; - -- ssi2 { -+ mux-ssi2 { - fsl,audmux-port = <1>; - fsl,port-config = < - (IMX_AUDMUX_V2_PTCR_SYN | -@@ -271,7 +271,7 @@ IMX_AUDMUX_V2_PDCR_RXDSEL(2) - >; - }; - -- aud3 { -+ mux-aud3 { - fsl,audmux-port = <2>; - fsl,port-config = < - IMX_AUDMUX_V2_PTCR_SYN -diff --git a/arch/arm/crypto/Kconfig b/arch/arm/crypto/Kconfig -index 847b7a0033569c..1f684e29cff2e3 100644 ---- a/arch/arm/crypto/Kconfig -+++ b/arch/arm/crypto/Kconfig -@@ -4,7 +4,7 @@ menu "Accelerated Cryptographic Algorithms for CPU (arm)" - - config CRYPTO_CURVE25519_NEON - tristate "Public key crypto: Curve25519 (NEON)" -- depends on KERNEL_MODE_NEON -+ depends on KERNEL_MODE_NEON && !CPU_BIG_ENDIAN - select CRYPTO_LIB_CURVE25519_GENERIC - select CRYPTO_ARCH_HAVE_LIB_CURVE25519 - help -diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S -index 94dece1839af34..99aaf5cf896966 100644 ---- a/arch/arm/mach-at91/pm_suspend.S -+++ b/arch/arm/mach-at91/pm_suspend.S -@@ -689,6 +689,10 @@ sr_dis_exit: - bic tmp2, tmp2, #AT91_PMC_PLL_UPDT_ID - str tmp2, [pmc, #AT91_PMC_PLL_UPDT] - -+ /* save acr */ -+ ldr tmp2, [pmc, #AT91_PMC_PLL_ACR] -+ str tmp2, .saved_acr -+ - /* save div. */ - mov tmp1, #0 - ldr tmp2, [pmc, #AT91_PMC_PLL_CTRL0] -@@ -758,7 +762,7 @@ sr_dis_exit: - str tmp1, [pmc, #AT91_PMC_PLL_UPDT] - - /* step 2. */ -- ldr tmp1, =AT91_PMC_PLL_ACR_DEFAULT_PLLA -+ ldr tmp1, .saved_acr - str tmp1, [pmc, #AT91_PMC_PLL_ACR] - - /* step 3. */ -@@ -1134,6 +1138,8 @@ ENDPROC(at91_pm_suspend_in_sram) - .word 0 - .saved_mckr: - .word 0 -+.saved_acr: -+ .word 0 - .saved_pllar: - .word 0 - .saved_sam9_lpr: -diff --git a/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts b/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts -index 6a02db4f073f29..a5426b82552ed8 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts -+++ b/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts -@@ -482,6 +482,8 @@ &i2s0_8ch { - }; - - &i2s1_8ch { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&i2s1m0_sclktx &i2s1m0_lrcktx &i2s1m0_sdi0 &i2s1m0_sdo0>; - rockchip,trcm-sync-tx-only; - status = "okay"; - }; -diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts -index 50c384aa253e40..8c3f9735e563b9 100644 ---- a/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts -+++ b/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts -@@ -808,8 +808,8 @@ conf-tx { - pins = "MIO54", "MIO56", "MIO57", "MIO58", "MIO59", - "MIO60", "MIO61", "MIO62", "MIO63"; - bias-disable; -- drive-strength = <4>; -- slew-rate = ; -+ drive-strength = <12>; -+ slew-rate = ; - }; - }; - -diff --git a/arch/loongarch/include/asm/hw_breakpoint.h b/arch/loongarch/include/asm/hw_breakpoint.h -index 13b2462f3d8c9d..5faa97a87a9e2d 100644 ---- a/arch/loongarch/include/asm/hw_breakpoint.h -+++ b/arch/loongarch/include/asm/hw_breakpoint.h -@@ -134,13 +134,13 @@ static inline void hw_breakpoint_thread_switch(struct task_struct *next) - /* Determine number of BRP registers available. */ - static inline int get_num_brps(void) - { -- return csr_read64(LOONGARCH_CSR_FWPC) & CSR_FWPC_NUM; -+ return csr_read32(LOONGARCH_CSR_FWPC) & CSR_FWPC_NUM; - } - - /* Determine number of WRP registers available. */ - static inline int get_num_wrps(void) - { -- return csr_read64(LOONGARCH_CSR_MWPC) & CSR_MWPC_NUM; -+ return csr_read32(LOONGARCH_CSR_MWPC) & CSR_MWPC_NUM; - } - - #endif /* __KERNEL__ */ -diff --git a/arch/loongarch/include/asm/pgtable.h b/arch/loongarch/include/asm/pgtable.h -index 29d9b12298bc84..fc51c6df7e998c 100644 ---- a/arch/loongarch/include/asm/pgtable.h -+++ b/arch/loongarch/include/asm/pgtable.h -@@ -448,6 +448,9 @@ static inline unsigned long pte_accessible(struct mm_struct *mm, pte_t a) - - static inline pte_t pte_modify(pte_t pte, pgprot_t newprot) - { -+ if (pte_val(pte) & _PAGE_DIRTY) -+ pte_val(pte) |= _PAGE_MODIFIED; -+ - return __pte((pte_val(pte) & _PAGE_CHG_MASK) | - (pgprot_val(newprot) & ~_PAGE_CHG_MASK)); - } -@@ -570,9 +573,11 @@ static inline struct page *pmd_page(pmd_t pmd) - - static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot) - { -- pmd_val(pmd) = (pmd_val(pmd) & _HPAGE_CHG_MASK) | -- (pgprot_val(newprot) & ~_HPAGE_CHG_MASK); -- return pmd; -+ if (pmd_val(pmd) & _PAGE_DIRTY) -+ pmd_val(pmd) |= _PAGE_MODIFIED; -+ -+ return __pmd((pmd_val(pmd) & _HPAGE_CHG_MASK) | -+ (pgprot_val(newprot) & ~_HPAGE_CHG_MASK)); - } - - static inline pmd_t pmd_mkinvalid(pmd_t pmd) -diff --git a/arch/loongarch/kernel/traps.c b/arch/loongarch/kernel/traps.c -index 2b4b99b4e6c94e..d7291b8ea65aac 100644 ---- a/arch/loongarch/kernel/traps.c -+++ b/arch/loongarch/kernel/traps.c -@@ -1097,8 +1097,8 @@ static void configure_exception_vector(void) - tlbrentry = (unsigned long)exception_handlers + 80*VECSIZE; - - csr_write64(eentry, LOONGARCH_CSR_EENTRY); -- csr_write64(eentry, LOONGARCH_CSR_MERRENTRY); -- csr_write64(tlbrentry, LOONGARCH_CSR_TLBRENTRY); -+ csr_write64(__pa(eentry), LOONGARCH_CSR_MERRENTRY); -+ csr_write64(__pa(tlbrentry), LOONGARCH_CSR_TLBRENTRY); - } - - void per_cpu_trap_init(int cpu) -diff --git a/arch/mips/boot/dts/lantiq/danube.dtsi b/arch/mips/boot/dts/lantiq/danube.dtsi -index 7a7ba66aa5349d..650400bd5725fa 100644 ---- a/arch/mips/boot/dts/lantiq/danube.dtsi -+++ b/arch/mips/boot/dts/lantiq/danube.dtsi -@@ -5,8 +5,12 @@ / { - compatible = "lantiq,xway", "lantiq,danube"; - - cpus { -+ #address-cells = <1>; -+ #size-cells = <0>; -+ - cpu@0 { - compatible = "mips,mips24Kc"; -+ reg = <0>; - }; - }; - -@@ -100,6 +104,8 @@ pci0: pci@e105400 { - 0x1000000 0 0x00000000 0xae00000 0 0x200000>; /* io space */ - reg = <0x7000000 0x8000 /* config space */ - 0xe105400 0x400>; /* pci bridge */ -+ -+ device_type = "pci"; - }; - }; - }; -diff --git a/arch/mips/boot/dts/lantiq/danube_easy50712.dts b/arch/mips/boot/dts/lantiq/danube_easy50712.dts -index c4d7aa5753b043..c9f7886f57b8ce 100644 ---- a/arch/mips/boot/dts/lantiq/danube_easy50712.dts -+++ b/arch/mips/boot/dts/lantiq/danube_easy50712.dts -@@ -4,6 +4,8 @@ - /include/ "danube.dtsi" - - / { -+ model = "Intel EASY50712"; -+ - chosen { - bootargs = "console=ttyLTQ0,115200 init=/etc/preinit"; - }; -@@ -94,7 +96,7 @@ ethernet@e180000 { - lantiq,tx-burst-length = <4>; - }; - -- stp0: stp@e100bb0 { -+ stp0: gpio@e100bb0 { - #gpio-cells = <2>; - compatible = "lantiq,gpio-stp-xway"; - gpio-controller; -diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c -index 4c72b59fdf98cc..492f375bf12903 100644 ---- a/arch/mips/lantiq/xway/sysctrl.c -+++ b/arch/mips/lantiq/xway/sysctrl.c -@@ -466,7 +466,7 @@ void __init ltq_soc_init(void) - /* add our generic xway clocks */ - clkdev_add_pmu("10000000.fpi", NULL, 0, 0, PMU_FPI); - clkdev_add_pmu("1e100a00.gptu", NULL, 1, 0, PMU_GPT); -- clkdev_add_pmu("1e100bb0.stp", NULL, 1, 0, PMU_STP); -+ clkdev_add_pmu("1e100bb0.gpio", NULL, 1, 0, PMU_STP); - clkdev_add_pmu("1e100c00.serial", NULL, 0, 0, PMU_ASC1); - clkdev_add_pmu("1e104100.dma", NULL, 1, 0, PMU_DMA); - clkdev_add_pmu("1e100800.spi", NULL, 1, 0, PMU_SPI); -diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c -index 9ba4adc214af7c..cc8bedf410ea70 100644 ---- a/arch/powerpc/kernel/eeh_driver.c -+++ b/arch/powerpc/kernel/eeh_driver.c -@@ -334,7 +334,7 @@ static enum pci_ers_result eeh_report_error(struct eeh_dev *edev, - rc = driver->err_handler->error_detected(pdev, pci_channel_io_frozen); - - edev->in_error = true; -- pci_uevent_ers(pdev, PCI_ERS_RESULT_NONE); -+ pci_uevent_ers(pdev, rc); - return rc; - } - -diff --git a/arch/riscv/kernel/cpu-hotplug.c b/arch/riscv/kernel/cpu-hotplug.c -index 6b710ef9d9aef5..2114903ee3ad40 100644 ---- a/arch/riscv/kernel/cpu-hotplug.c -+++ b/arch/riscv/kernel/cpu-hotplug.c -@@ -61,6 +61,7 @@ void arch_cpuhp_cleanup_dead_cpu(unsigned int cpu) - - pr_notice("CPU%u: off\n", cpu); - -+ clear_tasks_mm_cpumask(cpu); - /* Verify from the firmware if the cpu is really stopped*/ - if (cpu_ops[cpu]->cpu_is_stopped) - ret = cpu_ops[cpu]->cpu_is_stopped(cpu); -diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S -index 1f90fee24a8ba8..11b2b1a3897df9 100644 ---- a/arch/riscv/kernel/entry.S -+++ b/arch/riscv/kernel/entry.S -@@ -82,7 +82,6 @@ _save_context: - la gp, __global_pointer$ - .option pop - move a0, sp /* pt_regs */ -- la ra, ret_from_exception - - /* - * MSB of cause differentiates between -@@ -91,7 +90,8 @@ _save_context: - bge s4, zero, 1f - - /* Handle interrupts */ -- tail do_irq -+ call do_irq -+ j ret_from_exception - 1: - /* Handle other exceptions */ - slli t0, s4, RISCV_LGPTR -@@ -99,11 +99,14 @@ _save_context: - la t2, excp_vect_table_end - add t0, t1, t0 - /* Check if exception code lies within bounds */ -- bgeu t0, t2, 1f -- REG_L t0, 0(t0) -- jr t0 --1: -- tail do_trap_unknown -+ bgeu t0, t2, 3f -+ REG_L t1, 0(t0) -+2: jalr t1 -+ j ret_from_exception -+3: -+ -+ la t1, do_trap_unknown -+ j 2b - SYM_CODE_END(handle_exception) - ASM_NOKPROBE(handle_exception) - -@@ -171,6 +174,7 @@ SYM_CODE_START_NOALIGN(ret_from_exception) - #else - sret - #endif -+SYM_INNER_LABEL(ret_from_exception_end, SYM_L_GLOBAL) - SYM_CODE_END(ret_from_exception) - ASM_NOKPROBE(ret_from_exception) - -diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c -index f598e0eb3b0a04..ee269b1c99a190 100644 ---- a/arch/riscv/kernel/setup.c -+++ b/arch/riscv/kernel/setup.c -@@ -318,11 +318,14 @@ void __init setup_arch(char **cmdline_p) - /* Parse the ACPI tables for possible boot-time configuration */ - acpi_boot_table_init(); - -+ if (acpi_disabled) { - #if IS_ENABLED(CONFIG_BUILTIN_DTB) -- unflatten_and_copy_device_tree(); -+ unflatten_and_copy_device_tree(); - #else -- unflatten_device_tree(); -+ unflatten_device_tree(); - #endif -+ } -+ - misc_mem_init(); - - init_resources(); -diff --git a/arch/riscv/kernel/stacktrace.c b/arch/riscv/kernel/stacktrace.c -index 10e311b2759d39..124ad8fe626fbe 100644 ---- a/arch/riscv/kernel/stacktrace.c -+++ b/arch/riscv/kernel/stacktrace.c -@@ -16,7 +16,24 @@ - - #ifdef CONFIG_FRAME_POINTER - --extern asmlinkage void ret_from_exception(void); -+/* -+ * This disables KASAN checking when reading a value from another task's stack, -+ * since the other task could be running on another CPU and could have poisoned -+ * the stack in the meantime. -+ */ -+#define READ_ONCE_TASK_STACK(task, x) \ -+({ \ -+ unsigned long val; \ -+ unsigned long addr = x; \ -+ if ((task) == current) \ -+ val = READ_ONCE(addr); \ -+ else \ -+ val = READ_ONCE_NOCHECK(addr); \ -+ val; \ -+}) -+ -+extern asmlinkage void handle_exception(void); -+extern unsigned long ret_from_exception_end; - - static inline int fp_is_valid(unsigned long fp, unsigned long sp) - { -@@ -68,10 +85,12 @@ void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs, - fp = frame->ra; - pc = regs->ra; - } else { -- fp = frame->fp; -- pc = ftrace_graph_ret_addr(current, &graph_idx, frame->ra, -+ fp = READ_ONCE_TASK_STACK(task, frame->fp); -+ pc = READ_ONCE_TASK_STACK(task, frame->ra); -+ pc = ftrace_graph_ret_addr(current, &graph_idx, pc, - &frame->ra); -- if (pc == (unsigned long)ret_from_exception) { -+ if (pc >= (unsigned long)handle_exception && -+ pc < (unsigned long)&ret_from_exception_end) { - if (unlikely(!__kernel_text_address(pc) || !fn(arg, pc))) - break; - -diff --git a/arch/riscv/mm/ptdump.c b/arch/riscv/mm/ptdump.c -index e9090b38f8117c..52cc3d9380c084 100644 ---- a/arch/riscv/mm/ptdump.c -+++ b/arch/riscv/mm/ptdump.c -@@ -22,7 +22,7 @@ - #define pt_dump_seq_puts(m, fmt) \ - ({ \ - if (m) \ -- seq_printf(m, fmt); \ -+ seq_puts(m, fmt); \ - }) - - /* -diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c -index 16eb4cd11cbd67..5426dc2697f94e 100644 ---- a/arch/riscv/net/bpf_jit_comp64.c -+++ b/arch/riscv/net/bpf_jit_comp64.c -@@ -855,10 +855,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, - stack_size += 16; - - save_ret = flags & (BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_RET_FENTRY_RET); -- if (save_ret) { -+ if (save_ret) - stack_size += 16; /* Save both A5 (BPF R0) and A0 */ -- retval_off = stack_size; -- } -+ retval_off = stack_size; - - stack_size += nregs * 8; - args_off = stack_size; -diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig -index bd4782f23f66df..e99dae26500d26 100644 ---- a/arch/s390/Kconfig -+++ b/arch/s390/Kconfig -@@ -128,7 +128,6 @@ config S390 - select ARCH_WANT_DEFAULT_BPF_JIT - select ARCH_WANT_IPC_PARSE_VERSION - select ARCH_WANT_KERNEL_PMD_MKWRITE -- select ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - select BUILDTIME_TABLE_SORT - select CLONE_BACKWARDS2 - select DMA_OPS if PCI -diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h -index b248694e00247b..30e8e6baa5f856 100644 ---- a/arch/s390/include/asm/pci.h -+++ b/arch/s390/include/asm/pci.h -@@ -138,7 +138,6 @@ struct zpci_dev { - u8 has_resources : 1; - u8 is_physfn : 1; - u8 util_str_avail : 1; -- u8 irqs_registered : 1; - u8 reserved : 2; - unsigned int devfn; /* DEVFN part of the RID*/ - -diff --git a/arch/s390/pci/pci_event.c b/arch/s390/pci/pci_event.c -index d969f36bf186f2..bd4172db263450 100644 ---- a/arch/s390/pci/pci_event.c -+++ b/arch/s390/pci/pci_event.c -@@ -83,6 +83,7 @@ static pci_ers_result_t zpci_event_notify_error_detected(struct pci_dev *pdev, - pci_ers_result_t ers_res = PCI_ERS_RESULT_DISCONNECT; - - ers_res = driver->err_handler->error_detected(pdev, pdev->error_state); -+ pci_uevent_ers(pdev, ers_res); - if (ers_result_indicates_abort(ers_res)) - pr_info("%s: Automatic recovery failed after initial reporting\n", pci_name(pdev)); - else if (ers_res == PCI_ERS_RESULT_NEED_RESET) -@@ -173,7 +174,7 @@ static pci_ers_result_t zpci_event_attempt_error_recovery(struct pci_dev *pdev) - * is unbound or probed and that userspace can't access its - * configuration space while we perform recovery. - */ -- pci_dev_lock(pdev); -+ device_lock(&pdev->dev); - if (pdev->error_state == pci_channel_io_perm_failure) { - ers_res = PCI_ERS_RESULT_DISCONNECT; - goto out_unlock; -@@ -212,6 +213,7 @@ static pci_ers_result_t zpci_event_attempt_error_recovery(struct pci_dev *pdev) - ers_res = zpci_event_do_reset(pdev, driver); - - if (ers_res != PCI_ERS_RESULT_RECOVERED) { -+ pci_uevent_ers(pdev, PCI_ERS_RESULT_DISCONNECT); - pr_err("%s: Automatic recovery failed; operator intervention is required\n", - pci_name(pdev)); - goto out_unlock; -@@ -220,8 +222,9 @@ static pci_ers_result_t zpci_event_attempt_error_recovery(struct pci_dev *pdev) - pr_info("%s: The device is ready to resume operations\n", pci_name(pdev)); - if (driver->err_handler->resume) - driver->err_handler->resume(pdev); -+ pci_uevent_ers(pdev, PCI_ERS_RESULT_RECOVERED); - out_unlock: -- pci_dev_unlock(pdev); -+ device_unlock(&pdev->dev); - - return ers_res; - } -diff --git a/arch/s390/pci/pci_irq.c b/arch/s390/pci/pci_irq.c -index 84482a92133220..e73be96ce5fe64 100644 ---- a/arch/s390/pci/pci_irq.c -+++ b/arch/s390/pci/pci_irq.c -@@ -107,9 +107,6 @@ static int zpci_set_irq(struct zpci_dev *zdev) - else - rc = zpci_set_airq(zdev); - -- if (!rc) -- zdev->irqs_registered = 1; -- - return rc; - } - -@@ -123,9 +120,6 @@ static int zpci_clear_irq(struct zpci_dev *zdev) - else - rc = zpci_clear_airq(zdev); - -- if (!rc) -- zdev->irqs_registered = 0; -- - return rc; - } - -@@ -427,8 +421,7 @@ bool arch_restore_msi_irqs(struct pci_dev *pdev) - { - struct zpci_dev *zdev = to_zpci(pdev); - -- if (!zdev->irqs_registered) -- zpci_set_irq(zdev); -+ zpci_set_irq(zdev); - return true; - } - -diff --git a/arch/sparc/include/asm/elf_64.h b/arch/sparc/include/asm/elf_64.h -index 8fb09eec8c3e79..694ed081cf8d99 100644 ---- a/arch/sparc/include/asm/elf_64.h -+++ b/arch/sparc/include/asm/elf_64.h -@@ -58,6 +58,7 @@ - #define R_SPARC_7 43 - #define R_SPARC_5 44 - #define R_SPARC_6 45 -+#define R_SPARC_UA64 54 - - /* Bits present in AT_HWCAP, primarily for Sparc32. */ - #define HWCAP_SPARC_FLUSH 0x00000001 -diff --git a/arch/sparc/include/asm/io_64.h b/arch/sparc/include/asm/io_64.h -index 9303270b22f3cf..f9d370324729e7 100644 ---- a/arch/sparc/include/asm/io_64.h -+++ b/arch/sparc/include/asm/io_64.h -@@ -250,19 +250,19 @@ void insl(unsigned long, void *, unsigned long); - #define insw insw - #define insl insl - --static inline void readsb(void __iomem *port, void *buf, unsigned long count) -+static inline void readsb(const volatile void __iomem *port, void *buf, unsigned long count) - { - insb((unsigned long __force)port, buf, count); - } - #define readsb readsb - --static inline void readsw(void __iomem *port, void *buf, unsigned long count) -+static inline void readsw(const volatile void __iomem *port, void *buf, unsigned long count) - { - insw((unsigned long __force)port, buf, count); - } - #define readsw readsw - --static inline void readsl(void __iomem *port, void *buf, unsigned long count) -+static inline void readsl(const volatile void __iomem *port, void *buf, unsigned long count) - { - insl((unsigned long __force)port, buf, count); - } -diff --git a/arch/sparc/kernel/module.c b/arch/sparc/kernel/module.c -index 66c45a2764bc89..a7780907fc2f96 100644 ---- a/arch/sparc/kernel/module.c -+++ b/arch/sparc/kernel/module.c -@@ -117,6 +117,7 @@ int apply_relocate_add(Elf_Shdr *sechdrs, - break; - #ifdef CONFIG_SPARC64 - case R_SPARC_64: -+ case R_SPARC_UA64: - location[0] = v >> 56; - location[1] = v >> 48; - location[2] = v >> 40; -diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c -index 277cea3d30eb59..8006a5bd578c27 100644 ---- a/arch/um/drivers/ssl.c -+++ b/arch/um/drivers/ssl.c -@@ -199,4 +199,7 @@ static int ssl_non_raw_setup(char *str) - return 1; - } - __setup("ssl-non-raw", ssl_non_raw_setup); --__channel_help(ssl_non_raw_setup, "set serial lines to non-raw mode"); -+__uml_help(ssl_non_raw_setup, -+"ssl-non-raw\n" -+" Set serial lines to non-raw mode.\n\n" -+); -diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c -index 2fb7d53cf3338d..95e053b0a4bc08 100644 ---- a/arch/x86/entry/vsyscall/vsyscall_64.c -+++ b/arch/x86/entry/vsyscall/vsyscall_64.c -@@ -124,7 +124,12 @@ bool emulate_vsyscall(unsigned long error_code, - if ((error_code & (X86_PF_WRITE | X86_PF_USER)) != X86_PF_USER) - return false; - -- if (!(error_code & X86_PF_INSTR)) { -+ /* -+ * Assume that faults at regs->ip are because of an -+ * instruction fetch. Return early and avoid -+ * emulation for faults during data accesses: -+ */ -+ if (address != regs->ip) { - /* Failed vsyscall read */ - if (vsyscall_mode == EMULATE) - return false; -@@ -136,13 +141,19 @@ bool emulate_vsyscall(unsigned long error_code, - return false; - } - -+ /* -+ * X86_PF_INSTR is only set when NX is supported. When -+ * available, use it to double-check that the emulation code -+ * is only being used for instruction fetches: -+ */ -+ if (cpu_feature_enabled(X86_FEATURE_NX)) -+ WARN_ON_ONCE(!(error_code & X86_PF_INSTR)); -+ - /* - * No point in checking CS -- the only way to get here is a user mode - * trap to a high address, which means that we're in 64-bit user code. - */ - -- WARN_ON_ONCE(address != regs->ip); -- - if (vsyscall_mode == NONE) { - warn_bad_vsyscall(KERN_INFO, regs, - "vsyscall attempted with vsyscall=none"); -diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c -index e689e3981bd9e1..f9b6e2043e6b2b 100644 ---- a/arch/x86/kernel/cpu/microcode/amd.c -+++ b/arch/x86/kernel/cpu/microcode/amd.c -@@ -210,10 +210,13 @@ static bool need_sha_check(u32 cur_rev) - case 0xaa001: return cur_rev <= 0xaa00116; break; - case 0xaa002: return cur_rev <= 0xaa00218; break; - case 0xb0021: return cur_rev <= 0xb002146; break; -+ case 0xb0081: return cur_rev <= 0xb008111; break; - case 0xb1010: return cur_rev <= 0xb101046; break; - case 0xb2040: return cur_rev <= 0xb204031; break; - case 0xb4040: return cur_rev <= 0xb404031; break; -+ case 0xb4041: return cur_rev <= 0xb404101; break; - case 0xb6000: return cur_rev <= 0xb600031; break; -+ case 0xb6080: return cur_rev <= 0xb608031; break; - case 0xb7000: return cur_rev <= 0xb700031; break; - default: break; - } -diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c -index aaed20f46be4ce..175c14567cf142 100644 ---- a/arch/x86/kernel/fpu/core.c -+++ b/arch/x86/kernel/fpu/core.c -@@ -757,6 +757,9 @@ void fpu__clear_user_states(struct fpu *fpu) - !fpregs_state_valid(fpu, smp_processor_id())) - os_xrstor_supervisor(fpu->fpstate); - -+ /* Ensure XFD state is in sync before reloading XSTATE */ -+ xfd_update_state(fpu->fpstate); -+ - /* Reset user states in registers. */ - restore_fpregs_from_init_fpstate(XFEATURE_MASK_USER_RESTORE); - -diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c -index b8ab9ee5896c19..b5ef2c2899f2a4 100644 ---- a/arch/x86/kernel/kvm.c -+++ b/arch/x86/kernel/kvm.c -@@ -1066,16 +1066,6 @@ static void kvm_wait(u8 *ptr, u8 val) - */ - void __init kvm_spinlock_init(void) - { -- /* -- * In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an -- * advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is -- * preferred over native qspinlock when vCPU is preempted. -- */ -- if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT)) { -- pr_info("PV spinlocks disabled, no host support\n"); -- return; -- } -- - /* - * Disable PV spinlocks and use native qspinlock when dedicated pCPUs - * are available. -@@ -1095,6 +1085,16 @@ void __init kvm_spinlock_init(void) - goto out; - } - -+ /* -+ * In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an -+ * advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is -+ * preferred over native qspinlock when vCPU is preempted. -+ */ -+ if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT)) { -+ pr_info("PV spinlocks disabled, no host support\n"); -+ return; -+ } -+ - pr_info("PV spinlocks enabled\n"); - - __pv_init_lock_hash(); -diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c -index 0833f2c1a9d68b..99180d0af3ea61 100644 ---- a/arch/x86/kvm/svm/svm.c -+++ b/arch/x86/kvm/svm/svm.c -@@ -3183,7 +3183,11 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr) - if (data & DEBUGCTL_RESERVED_BITS) - return 1; - -+ if (svm_get_lbr_vmcb(svm)->save.dbgctl == data) -+ break; -+ - svm_get_lbr_vmcb(svm)->save.dbgctl = data; -+ vmcb_mark_dirty(svm->vmcb, VMCB_LBR); - svm_update_lbrv(vcpu); - break; - case MSR_VM_HSAVE_PA: -diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c -index 07592eef253c21..0be138fbd0a058 100644 ---- a/arch/x86/net/bpf_jit_comp.c -+++ b/arch/x86/net/bpf_jit_comp.c -@@ -1995,7 +1995,7 @@ st: if (is_imm8(insn->off)) - ctx->cleanup_addr = proglen; - - if (bpf_prog_was_classic(bpf_prog) && -- !capable(CAP_SYS_ADMIN)) { -+ !ns_capable_noaudit(&init_user_ns, CAP_SYS_ADMIN)) { - u8 *ip = image + addrs[i - 1]; - - if (emit_spectre_bhb_barrier(&prog, ip, bpf_prog)) -diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c -index 64551b0aa51e66..75e9d5a9d707c4 100644 ---- a/block/blk-cgroup.c -+++ b/block/blk-cgroup.c -@@ -848,14 +848,8 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, - disk = ctx->bdev->bd_disk; - q = disk->queue; - -- /* -- * blkcg_deactivate_policy() requires queue to be frozen, we can grab -- * q_usage_counter to prevent concurrent with blkcg_deactivate_policy(). -- */ -- ret = blk_queue_enter(q, 0); -- if (ret) -- goto fail; -- -+ /* Prevent concurrent with blkcg_deactivate_policy() */ -+ mutex_lock(&q->blkcg_mutex); - spin_lock_irq(&q->queue_lock); - - if (!blkcg_policy_enabled(q, pol)) { -@@ -885,16 +879,16 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, - /* Drop locks to do new blkg allocation with GFP_KERNEL. */ - spin_unlock_irq(&q->queue_lock); - -- new_blkg = blkg_alloc(pos, disk, GFP_KERNEL); -+ new_blkg = blkg_alloc(pos, disk, GFP_NOIO); - if (unlikely(!new_blkg)) { - ret = -ENOMEM; -- goto fail_exit_queue; -+ goto fail_exit; - } - - if (radix_tree_preload(GFP_KERNEL)) { - blkg_free(new_blkg); - ret = -ENOMEM; -- goto fail_exit_queue; -+ goto fail_exit; - } - - spin_lock_irq(&q->queue_lock); -@@ -922,7 +916,7 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, - goto success; - } - success: -- blk_queue_exit(q); -+ mutex_unlock(&q->blkcg_mutex); - ctx->blkg = blkg; - return 0; - -@@ -930,9 +924,8 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, - radix_tree_preload_end(); - fail_unlock: - spin_unlock_irq(&q->queue_lock); --fail_exit_queue: -- blk_queue_exit(q); --fail: -+fail_exit: -+ mutex_unlock(&q->blkcg_mutex); - /* - * If queue was bypassing, we should retry. Do so after a - * short msleep(). It isn't strictly necessary but queue -diff --git a/drivers/accel/habanalabs/common/memory.c b/drivers/accel/habanalabs/common/memory.c -index 5b7d9a351133fe..33a4246dd73589 100644 ---- a/drivers/accel/habanalabs/common/memory.c -+++ b/drivers/accel/habanalabs/common/memory.c -@@ -2323,7 +2323,7 @@ static int get_user_memory(struct hl_device *hdev, u64 addr, u64 size, - if (rc < 0) - goto destroy_pages; - npages = rc; -- rc = -EFAULT; -+ rc = -ENOMEM; - goto put_pages; - } - userptr->npages = npages; -diff --git a/drivers/accel/habanalabs/gaudi/gaudi.c b/drivers/accel/habanalabs/gaudi/gaudi.c -index 056e2ef44afb50..ceed6cfe2f9190 100644 ---- a/drivers/accel/habanalabs/gaudi/gaudi.c -+++ b/drivers/accel/habanalabs/gaudi/gaudi.c -@@ -4173,10 +4173,29 @@ static int gaudi_mmap(struct hl_device *hdev, struct vm_area_struct *vma, - vm_flags_set(vma, VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP | - VM_DONTCOPY | VM_NORESERVE); - -+#ifdef _HAS_DMA_MMAP_COHERENT -+ /* -+ * If dma_alloc_coherent() returns a vmalloc address, set VM_MIXEDMAP -+ * so vm_insert_page() can handle it safely. Without this, the kernel -+ * may BUG_ON due to VM_PFNMAP. -+ */ -+ if (is_vmalloc_addr(cpu_addr)) -+ vm_flags_set(vma, VM_MIXEDMAP); -+ - rc = dma_mmap_coherent(hdev->dev, vma, cpu_addr, - (dma_addr - HOST_PHYS_BASE), size); - if (rc) - dev_err(hdev->dev, "dma_mmap_coherent error %d", rc); -+#else -+ -+ rc = remap_pfn_range(vma, vma->vm_start, -+ virt_to_phys(cpu_addr) >> PAGE_SHIFT, -+ size, vma->vm_page_prot); -+ if (rc) -+ dev_err(hdev->dev, "remap_pfn_range error %d", rc); -+ -+ #endif -+ - - return rc; - } -diff --git a/drivers/accel/habanalabs/gaudi2/gaudi2.c b/drivers/accel/habanalabs/gaudi2/gaudi2.c -index 31c74ca70a2e5c..44b5678ea615c4 100644 ---- a/drivers/accel/habanalabs/gaudi2/gaudi2.c -+++ b/drivers/accel/habanalabs/gaudi2/gaudi2.c -@@ -2985,7 +2985,6 @@ static int gaudi2_early_init(struct hl_device *hdev) - rc = hl_fw_read_preboot_status(hdev); - if (rc) { - if (hdev->reset_on_preboot_fail) -- /* we are already on failure flow, so don't check if hw_fini fails. */ - hdev->asic_funcs->hw_fini(hdev, true, false); - goto pci_fini; - } -@@ -2997,6 +2996,13 @@ static int gaudi2_early_init(struct hl_device *hdev) - dev_err(hdev->dev, "failed to reset HW in dirty state (%d)\n", rc); - goto pci_fini; - } -+ -+ rc = hl_fw_read_preboot_status(hdev); -+ if (rc) { -+ if (hdev->reset_on_preboot_fail) -+ hdev->asic_funcs->hw_fini(hdev, true, false); -+ goto pci_fini; -+ } - } - - return 0; -@@ -6339,6 +6345,13 @@ static int gaudi2_mmap(struct hl_device *hdev, struct vm_area_struct *vma, - VM_DONTCOPY | VM_NORESERVE); - - #ifdef _HAS_DMA_MMAP_COHERENT -+ /* -+ * If dma_alloc_coherent() returns a vmalloc address, set VM_MIXEDMAP -+ * so vm_insert_page() can handle it safely. Without this, the kernel -+ * may BUG_ON due to VM_PFNMAP. -+ */ -+ if (is_vmalloc_addr(cpu_addr)) -+ vm_flags_set(vma, VM_MIXEDMAP); - - rc = dma_mmap_coherent(hdev->dev, vma, cpu_addr, dma_addr, size); - if (rc) -diff --git a/drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c b/drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c -index 25b5368f37dde9..9ff00b65ae34bc 100644 ---- a/drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c -+++ b/drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c -@@ -2409,7 +2409,7 @@ static int gaudi2_config_bmon(struct hl_device *hdev, struct hl_debug_params *pa - WREG32(base_reg + mmBMON_ADDRH_E3_OFFSET, 0); - WREG32(base_reg + mmBMON_REDUCTION_OFFSET, 0); - WREG32(base_reg + mmBMON_STM_TRC_OFFSET, 0x7 | (0xA << 8)); -- WREG32(base_reg + mmBMON_CR_OFFSET, 0x77 | 0xf << 24); -+ WREG32(base_reg + mmBMON_CR_OFFSET, 0x41); - } - - return 0; -diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c -index a971770e24ff90..841db33e947560 100644 ---- a/drivers/acpi/acpi_video.c -+++ b/drivers/acpi/acpi_video.c -@@ -1952,8 +1952,10 @@ static void acpi_video_bus_remove_notify_handler(struct acpi_video_bus *video) - struct acpi_video_device *dev; - - mutex_lock(&video->device_list_lock); -- list_for_each_entry(dev, &video->video_device_list, entry) -+ list_for_each_entry(dev, &video->video_device_list, entry) { - acpi_video_dev_remove_notify_handler(dev); -+ cancel_delayed_work_sync(&dev->switch_brightness_work); -+ } - mutex_unlock(&video->device_list_lock); - - acpi_video_bus_stop_devices(video); -diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c -index a232746d150a75..6168597a96e6fe 100644 ---- a/drivers/acpi/acpica/dsmethod.c -+++ b/drivers/acpi/acpica/dsmethod.c -@@ -462,7 +462,6 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread, - struct acpi_walk_state *next_walk_state = NULL; - union acpi_operand_object *obj_desc; - struct acpi_evaluate_info *info; -- u32 i; - - ACPI_FUNCTION_TRACE_PTR(ds_call_control_method, this_walk_state); - -@@ -546,14 +545,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread, - * Delete the operands on the previous walkstate operand stack - * (they were copied to new objects) - */ -- for (i = 0; i < obj_desc->method.param_count; i++) { -- acpi_ut_remove_reference(this_walk_state->operands[i]); -- this_walk_state->operands[i] = NULL; -- } -- -- /* Clear the operand stack */ -- -- this_walk_state->num_operands = 0; -+ acpi_ds_clear_operands(this_walk_state); - - ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH, - "**** Begin nested execution of [%4.4s] **** WalkState=%p\n", -diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c -index 906a7bfa448b31..c760e38df981f3 100644 ---- a/drivers/acpi/button.c -+++ b/drivers/acpi/button.c -@@ -603,8 +603,10 @@ static int acpi_button_add(struct acpi_device *device) - - input_set_drvdata(input, device); - error = input_register_device(input); -- if (error) -+ if (error) { -+ input_free_device(input); - goto err_remove_fs; -+ } - - switch (device->device_type) { - case ACPI_BUS_TYPE_POWER_BUTTON: -diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c -index 10d531427ba77d..888c7838579a87 100644 ---- a/drivers/acpi/cppc_acpi.c -+++ b/drivers/acpi/cppc_acpi.c -@@ -445,7 +445,7 @@ bool acpi_cpc_valid(void) - if (acpi_disabled) - return false; - -- for_each_present_cpu(cpu) { -+ for_each_online_cpu(cpu) { - cpc_ptr = per_cpu(cpc_desc_ptr, cpu); - if (!cpc_ptr) - return false; -@@ -461,7 +461,7 @@ bool cppc_allow_fast_switch(void) - struct cpc_desc *cpc_ptr; - int cpu; - -- for_each_present_cpu(cpu) { -+ for_each_online_cpu(cpu) { - cpc_ptr = per_cpu(cpc_desc_ptr, cpu); - desired_reg = &cpc_ptr->cpc_regs[DESIRED_PERF]; - if (!CPC_IN_SYSTEM_MEMORY(desired_reg) && -@@ -1368,7 +1368,7 @@ bool cppc_perf_ctrs_in_pcc(void) - { - int cpu; - -- for_each_present_cpu(cpu) { -+ for_each_online_cpu(cpu) { - struct cpc_register_resource *ref_perf_reg; - struct cpc_desc *cpc_desc; - -diff --git a/drivers/acpi/numa/hmat.c b/drivers/acpi/numa/hmat.c -index bba268ecd802f4..1d6450c139225d 100644 ---- a/drivers/acpi/numa/hmat.c -+++ b/drivers/acpi/numa/hmat.c -@@ -24,6 +24,7 @@ - #include - #include - #include -+#include - - static u8 hmat_revision; - static int hmat_disable __initdata; -@@ -57,14 +58,20 @@ struct target_cache { - struct node_cache_attrs cache_attrs; - }; - -+enum { -+ NODE_ACCESS_CLASS_GENPORT_SINK = ACCESS_COORDINATE_MAX, -+ NODE_ACCESS_CLASS_MAX, -+}; -+ - struct memory_target { - struct list_head node; - unsigned int memory_pxm; - unsigned int processor_pxm; - struct resource memregions; -- struct node_hmem_attrs hmem_attrs[2]; -+ struct access_coordinate coord[NODE_ACCESS_CLASS_MAX]; - struct list_head caches; - struct node_cache_attrs cache_attrs; -+ u8 gen_port_device_handle[ACPI_SRAT_DEVICE_HANDLE_SIZE]; - bool registered; - }; - -@@ -119,8 +126,7 @@ static __init void alloc_memory_initiator(unsigned int cpu_pxm) - list_add_tail(&initiator->node, &initiators); - } - --static __init void alloc_memory_target(unsigned int mem_pxm, -- resource_size_t start, resource_size_t len) -+static __init struct memory_target *alloc_target(unsigned int mem_pxm) - { - struct memory_target *target; - -@@ -128,7 +134,7 @@ static __init void alloc_memory_target(unsigned int mem_pxm, - if (!target) { - target = kzalloc(sizeof(*target), GFP_KERNEL); - if (!target) -- return; -+ return NULL; - target->memory_pxm = mem_pxm; - target->processor_pxm = PXM_INVAL; - target->memregions = (struct resource) { -@@ -141,6 +147,19 @@ static __init void alloc_memory_target(unsigned int mem_pxm, - INIT_LIST_HEAD(&target->caches); - } - -+ return target; -+} -+ -+static __init void alloc_memory_target(unsigned int mem_pxm, -+ resource_size_t start, -+ resource_size_t len) -+{ -+ struct memory_target *target; -+ -+ target = alloc_target(mem_pxm); -+ if (!target) -+ return; -+ - /* - * There are potentially multiple ranges per PXM, so record each - * in the per-target memregions resource tree. -@@ -151,6 +170,18 @@ static __init void alloc_memory_target(unsigned int mem_pxm, - start, start + len, mem_pxm); - } - -+static __init void alloc_genport_target(unsigned int mem_pxm, u8 *handle) -+{ -+ struct memory_target *target; -+ -+ target = alloc_target(mem_pxm); -+ if (!target) -+ return; -+ -+ memcpy(target->gen_port_device_handle, handle, -+ ACPI_SRAT_DEVICE_HANDLE_SIZE); -+} -+ - static __init const char *hmat_data_type(u8 type) - { - switch (type) { -@@ -227,24 +258,24 @@ static void hmat_update_target_access(struct memory_target *target, - { - switch (type) { - case ACPI_HMAT_ACCESS_LATENCY: -- target->hmem_attrs[access].read_latency = value; -- target->hmem_attrs[access].write_latency = value; -+ target->coord[access].read_latency = value; -+ target->coord[access].write_latency = value; - break; - case ACPI_HMAT_READ_LATENCY: -- target->hmem_attrs[access].read_latency = value; -+ target->coord[access].read_latency = value; - break; - case ACPI_HMAT_WRITE_LATENCY: -- target->hmem_attrs[access].write_latency = value; -+ target->coord[access].write_latency = value; - break; - case ACPI_HMAT_ACCESS_BANDWIDTH: -- target->hmem_attrs[access].read_bandwidth = value; -- target->hmem_attrs[access].write_bandwidth = value; -+ target->coord[access].read_bandwidth = value; -+ target->coord[access].write_bandwidth = value; - break; - case ACPI_HMAT_READ_BANDWIDTH: -- target->hmem_attrs[access].read_bandwidth = value; -+ target->coord[access].read_bandwidth = value; - break; - case ACPI_HMAT_WRITE_BANDWIDTH: -- target->hmem_attrs[access].write_bandwidth = value; -+ target->coord[access].write_bandwidth = value; - break; - default: - break; -@@ -290,11 +321,28 @@ static __init void hmat_add_locality(struct acpi_hmat_locality *hmat_loc) - } - } - -+static __init void hmat_update_target(unsigned int tgt_pxm, unsigned int init_pxm, -+ u8 mem_hier, u8 type, u32 value) -+{ -+ struct memory_target *target = find_mem_target(tgt_pxm); -+ -+ if (mem_hier != ACPI_HMAT_MEMORY) -+ return; -+ -+ if (target && target->processor_pxm == init_pxm) { -+ hmat_update_target_access(target, type, value, -+ ACCESS_COORDINATE_LOCAL); -+ /* If the node has a CPU, update access 1 */ -+ if (node_state(pxm_to_node(init_pxm), N_CPU)) -+ hmat_update_target_access(target, type, value, -+ ACCESS_COORDINATE_CPU); -+ } -+} -+ - static __init int hmat_parse_locality(union acpi_subtable_headers *header, - const unsigned long end) - { - struct acpi_hmat_locality *hmat_loc = (void *)header; -- struct memory_target *target; - unsigned int init, targ, total_size, ipds, tpds; - u32 *inits, *targs, value; - u16 *entries; -@@ -335,15 +383,8 @@ static __init int hmat_parse_locality(union acpi_subtable_headers *header, - inits[init], targs[targ], value, - hmat_data_type_suffix(type)); - -- if (mem_hier == ACPI_HMAT_MEMORY) { -- target = find_mem_target(targs[targ]); -- if (target && target->processor_pxm == inits[init]) { -- hmat_update_target_access(target, type, value, 0); -- /* If the node has a CPU, update access 1 */ -- if (node_state(pxm_to_node(inits[init]), N_CPU)) -- hmat_update_target_access(target, type, value, 1); -- } -- } -+ hmat_update_target(targs[targ], inits[init], -+ mem_hier, type, value); - } - } - -@@ -490,6 +531,27 @@ static __init int srat_parse_mem_affinity(union acpi_subtable_headers *header, - return 0; - } - -+static __init int srat_parse_genport_affinity(union acpi_subtable_headers *header, -+ const unsigned long end) -+{ -+ struct acpi_srat_generic_affinity *ga = (void *)header; -+ -+ if (!ga) -+ return -EINVAL; -+ -+ if (!(ga->flags & ACPI_SRAT_GENERIC_AFFINITY_ENABLED)) -+ return 0; -+ -+ /* Skip PCI device_handle for now */ -+ if (ga->device_handle_type != 0) -+ return 0; -+ -+ alloc_genport_target(ga->proximity_domain, -+ (u8 *)ga->device_handle); -+ -+ return 0; -+} -+ - static u32 hmat_initiator_perf(struct memory_target *target, - struct memory_initiator *initiator, - struct acpi_hmat_locality *hmat_loc) -@@ -582,28 +644,31 @@ static int initiators_to_nodemask(unsigned long *p_nodes) - return 0; - } - --static void hmat_register_target_initiators(struct memory_target *target) -+static void hmat_update_target_attrs(struct memory_target *target, -+ unsigned long *p_nodes, int access) - { -- static DECLARE_BITMAP(p_nodes, MAX_NUMNODES); - struct memory_initiator *initiator; -- unsigned int mem_nid, cpu_nid; -+ unsigned int cpu_nid; - struct memory_locality *loc = NULL; - u32 best = 0; -- bool access0done = false; - int i; - -- mem_nid = pxm_to_node(target->memory_pxm); -+ /* Don't update for generic port if there's no device handle */ -+ if (access == NODE_ACCESS_CLASS_GENPORT_SINK && -+ !(*(u16 *)target->gen_port_device_handle)) -+ return; -+ -+ bitmap_zero(p_nodes, MAX_NUMNODES); - /* -- * If the Address Range Structure provides a local processor pxm, link -+ * If the Address Range Structure provides a local processor pxm, set - * only that one. Otherwise, find the best performance attributes and -- * register all initiators that match. -+ * collect all initiators that match. - */ - if (target->processor_pxm != PXM_INVAL) { - cpu_nid = pxm_to_node(target->processor_pxm); -- register_memory_node_under_compute_node(mem_nid, cpu_nid, 0); -- access0done = true; -- if (node_state(cpu_nid, N_CPU)) { -- register_memory_node_under_compute_node(mem_nid, cpu_nid, 1); -+ if (access == ACCESS_COORDINATE_LOCAL || -+ node_state(cpu_nid, N_CPU)) { -+ set_bit(target->processor_pxm, p_nodes); - return; - } - } -@@ -617,47 +682,10 @@ static void hmat_register_target_initiators(struct memory_target *target) - * We'll also use the sorting to prime the candidate nodes with known - * initiators. - */ -- bitmap_zero(p_nodes, MAX_NUMNODES); - list_sort(NULL, &initiators, initiator_cmp); - if (initiators_to_nodemask(p_nodes) < 0) - return; - -- if (!access0done) { -- for (i = WRITE_LATENCY; i <= READ_BANDWIDTH; i++) { -- loc = localities_types[i]; -- if (!loc) -- continue; -- -- best = 0; -- list_for_each_entry(initiator, &initiators, node) { -- u32 value; -- -- if (!test_bit(initiator->processor_pxm, p_nodes)) -- continue; -- -- value = hmat_initiator_perf(target, initiator, -- loc->hmat_loc); -- if (hmat_update_best(loc->hmat_loc->data_type, value, &best)) -- bitmap_clear(p_nodes, 0, initiator->processor_pxm); -- if (value != best) -- clear_bit(initiator->processor_pxm, p_nodes); -- } -- if (best) -- hmat_update_target_access(target, loc->hmat_loc->data_type, -- best, 0); -- } -- -- for_each_set_bit(i, p_nodes, MAX_NUMNODES) { -- cpu_nid = pxm_to_node(i); -- register_memory_node_under_compute_node(mem_nid, cpu_nid, 0); -- } -- } -- -- /* Access 1 ignores Generic Initiators */ -- bitmap_zero(p_nodes, MAX_NUMNODES); -- if (initiators_to_nodemask(p_nodes) < 0) -- return; -- - for (i = WRITE_LATENCY; i <= READ_BANDWIDTH; i++) { - loc = localities_types[i]; - if (!loc) -@@ -667,7 +695,8 @@ static void hmat_register_target_initiators(struct memory_target *target) - list_for_each_entry(initiator, &initiators, node) { - u32 value; - -- if (!initiator->has_cpu) { -+ if (access == ACCESS_COORDINATE_CPU && -+ !initiator->has_cpu) { - clear_bit(initiator->processor_pxm, p_nodes); - continue; - } -@@ -681,14 +710,43 @@ static void hmat_register_target_initiators(struct memory_target *target) - clear_bit(initiator->processor_pxm, p_nodes); - } - if (best) -- hmat_update_target_access(target, loc->hmat_loc->data_type, best, 1); -+ hmat_update_target_access(target, loc->hmat_loc->data_type, best, access); - } -+} -+ -+static void __hmat_register_target_initiators(struct memory_target *target, -+ unsigned long *p_nodes, -+ int access) -+{ -+ unsigned int mem_nid, cpu_nid; -+ int i; -+ -+ mem_nid = pxm_to_node(target->memory_pxm); -+ hmat_update_target_attrs(target, p_nodes, access); - for_each_set_bit(i, p_nodes, MAX_NUMNODES) { - cpu_nid = pxm_to_node(i); -- register_memory_node_under_compute_node(mem_nid, cpu_nid, 1); -+ register_memory_node_under_compute_node(mem_nid, cpu_nid, access); - } - } - -+static void hmat_update_generic_target(struct memory_target *target) -+{ -+ static DECLARE_BITMAP(p_nodes, MAX_NUMNODES); -+ -+ hmat_update_target_attrs(target, p_nodes, -+ NODE_ACCESS_CLASS_GENPORT_SINK); -+} -+ -+static void hmat_register_target_initiators(struct memory_target *target) -+{ -+ static DECLARE_BITMAP(p_nodes, MAX_NUMNODES); -+ -+ __hmat_register_target_initiators(target, p_nodes, -+ ACCESS_COORDINATE_LOCAL); -+ __hmat_register_target_initiators(target, p_nodes, -+ ACCESS_COORDINATE_CPU); -+} -+ - static void hmat_register_target_cache(struct memory_target *target) - { - unsigned mem_nid = pxm_to_node(target->memory_pxm); -@@ -701,7 +759,7 @@ static void hmat_register_target_cache(struct memory_target *target) - static void hmat_register_target_perf(struct memory_target *target, int access) - { - unsigned mem_nid = pxm_to_node(target->memory_pxm); -- node_set_perf_attrs(mem_nid, &target->hmem_attrs[access], access); -+ node_set_perf_attrs(mem_nid, &target->coord[access], access); - } - - static void hmat_register_target_devices(struct memory_target *target) -@@ -722,10 +780,32 @@ static void hmat_register_target_devices(struct memory_target *target) - } - } - --static void hmat_register_target(struct memory_target *target) -+static void hmat_hotplug_target(struct memory_target *target) - { - int nid = pxm_to_node(target->memory_pxm); - -+ /* -+ * Skip offline nodes. This can happen when memory marked EFI_MEMORY_SP, -+ * "specific purpose", is applied to all the memory in a proximity -+ * domain leading to * the node being marked offline / unplugged, or if -+ * memory-only "hotplug" node is offline. -+ */ -+ if (nid == NUMA_NO_NODE || !node_online(nid)) -+ return; -+ -+ guard(mutex)(&target_lock); -+ if (target->registered) -+ return; -+ -+ hmat_register_target_initiators(target); -+ hmat_register_target_cache(target); -+ hmat_register_target_perf(target, ACCESS_COORDINATE_LOCAL); -+ hmat_register_target_perf(target, ACCESS_COORDINATE_CPU); -+ target->registered = true; -+} -+ -+static void hmat_register_target(struct memory_target *target) -+{ - /* - * Devices may belong to either an offline or online - * node, so unconditionally add them. -@@ -733,24 +813,17 @@ static void hmat_register_target(struct memory_target *target) - hmat_register_target_devices(target); - - /* -- * Skip offline nodes. This can happen when memory -- * marked EFI_MEMORY_SP, "specific purpose", is applied -- * to all the memory in a proximity domain leading to -- * the node being marked offline / unplugged, or if -- * memory-only "hotplug" node is offline. -+ * Register generic port perf numbers. The nid may not be -+ * initialized and is still NUMA_NO_NODE. - */ -- if (nid == NUMA_NO_NODE || !node_online(nid)) -- return; -- - mutex_lock(&target_lock); -- if (!target->registered) { -- hmat_register_target_initiators(target); -- hmat_register_target_cache(target); -- hmat_register_target_perf(target, 0); -- hmat_register_target_perf(target, 1); -+ if (*(u16 *)target->gen_port_device_handle) { -+ hmat_update_generic_target(target); - target->registered = true; - } - mutex_unlock(&target_lock); -+ -+ hmat_hotplug_target(target); - } - - static void hmat_register_targets(void) -@@ -776,10 +849,65 @@ static int hmat_callback(struct notifier_block *self, - if (!target) - return NOTIFY_OK; - -- hmat_register_target(target); -+ hmat_hotplug_target(target); - return NOTIFY_OK; - } - -+static int hmat_set_default_dram_perf(void) -+{ -+ int rc; -+ int nid, pxm; -+ struct memory_target *target; -+ struct access_coordinate *attrs; -+ -+ if (!default_dram_type) -+ return -EIO; -+ -+ for_each_node_mask(nid, default_dram_type->nodes) { -+ pxm = node_to_pxm(nid); -+ target = find_mem_target(pxm); -+ if (!target) -+ continue; -+ attrs = &target->coord[1]; -+ rc = mt_set_default_dram_perf(nid, attrs, "ACPI HMAT"); -+ if (rc) -+ return rc; -+ } -+ -+ return 0; -+} -+ -+static int hmat_calculate_adistance(struct notifier_block *self, -+ unsigned long nid, void *data) -+{ -+ static DECLARE_BITMAP(p_nodes, MAX_NUMNODES); -+ struct memory_target *target; -+ struct access_coordinate *perf; -+ int *adist = data; -+ int pxm; -+ -+ pxm = node_to_pxm(nid); -+ target = find_mem_target(pxm); -+ if (!target) -+ return NOTIFY_OK; -+ -+ mutex_lock(&target_lock); -+ hmat_update_target_attrs(target, p_nodes, ACCESS_COORDINATE_CPU); -+ mutex_unlock(&target_lock); -+ -+ perf = &target->coord[1]; -+ -+ if (mt_perf_to_adistance(perf, adist)) -+ return NOTIFY_OK; -+ -+ return NOTIFY_STOP; -+} -+ -+static struct notifier_block hmat_adist_nb __meminitdata = { -+ .notifier_call = hmat_calculate_adistance, -+ .priority = 100, -+}; -+ - static __init void hmat_free_structures(void) - { - struct memory_target *target, *tnext; -@@ -835,6 +963,13 @@ static __init int hmat_init(void) - ACPI_SRAT_TYPE_MEMORY_AFFINITY, - srat_parse_mem_affinity, 0) < 0) - goto out_put; -+ -+ if (acpi_table_parse_entries(ACPI_SIG_SRAT, -+ sizeof(struct acpi_table_srat), -+ ACPI_SRAT_TYPE_GENERIC_PORT_AFFINITY, -+ srat_parse_genport_affinity, 0) < 0) -+ goto out_put; -+ - acpi_put_table(tbl); - - status = acpi_get_table(ACPI_SIG_HMAT, 0, &tbl); -@@ -862,8 +997,13 @@ static __init int hmat_init(void) - hmat_register_targets(); - - /* Keep the table and structures if the notifier may use them */ -- if (!hotplug_memory_notifier(hmat_callback, HMAT_CALLBACK_PRI)) -- return 0; -+ if (hotplug_memory_notifier(hmat_callback, HMAT_CALLBACK_PRI)) -+ goto out_put; -+ -+ if (!hmat_set_default_dram_perf()) -+ register_mt_adistance_algorithm(&hmat_adist_nb); -+ -+ return 0; - out_put: - hmat_free_structures(); - acpi_put_table(tbl); -diff --git a/drivers/acpi/numa/srat.c b/drivers/acpi/numa/srat.c -index a44c0761fd1c06..848942bf883cb6 100644 ---- a/drivers/acpi/numa/srat.c -+++ b/drivers/acpi/numa/srat.c -@@ -140,7 +140,7 @@ acpi_table_print_srat_entry(struct acpi_subtable_header *header) - struct acpi_srat_generic_affinity *p = - (struct acpi_srat_generic_affinity *)header; - -- if (p->device_handle_type == 0) { -+ if (p->device_handle_type == 1) { - /* - * For pci devices this may be the only place they - * are assigned a proximity domain -diff --git a/drivers/acpi/prmt.c b/drivers/acpi/prmt.c -index eb8f2a1ce1388d..6efaeda01d166c 100644 ---- a/drivers/acpi/prmt.c -+++ b/drivers/acpi/prmt.c -@@ -150,15 +150,28 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end) - th = &tm->handlers[cur_handler]; - - guid_copy(&th->guid, (guid_t *)handler_info->handler_guid); -+ -+ /* -+ * Print an error message if handler_address is NULL, the parse of VA also -+ * can be skipped. -+ */ -+ if (unlikely(!handler_info->handler_address)) { -+ pr_info("Skipping handler with NULL address for GUID: %pUL", -+ (guid_t *)handler_info->handler_guid); -+ continue; -+ } -+ - th->handler_addr = - (void *)efi_pa_va_lookup(&th->guid, handler_info->handler_address); - /* -- * Print a warning message if handler_addr is zero which is not expected to -- * ever happen. -+ * Print a warning message and skip the parse of VA if handler_addr is zero -+ * which is not expected to ever happen. - */ -- if (unlikely(!th->handler_addr)) -+ if (unlikely(!th->handler_addr)) { - pr_warn("Failed to find VA of handler for GUID: %pUL, PA: 0x%llx", - &th->guid, handler_info->handler_address); -+ continue; -+ } - - th->static_data_buffer_addr = - efi_pa_va_lookup(&th->guid, handler_info->static_data_buffer_address); -diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c -index 5898c3c8c2a7f2..d02b332744e641 100644 ---- a/drivers/acpi/property.c -+++ b/drivers/acpi/property.c -@@ -1286,6 +1286,28 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode, - return NULL; - } - -+/* -+ * acpi_get_next_present_subnode - Return the next present child node handle -+ * @fwnode: Firmware node to find the next child node for. -+ * @child: Handle to one of the device's child nodes or a null handle. -+ * -+ * Like acpi_get_next_subnode(), but the device nodes returned by -+ * acpi_get_next_present_subnode() are guaranteed to be present. -+ * -+ * Returns: The fwnode handle of the next present sub-node. -+ */ -+static struct fwnode_handle * -+acpi_get_next_present_subnode(const struct fwnode_handle *fwnode, -+ struct fwnode_handle *child) -+{ -+ do { -+ child = acpi_get_next_subnode(fwnode, child); -+ } while (is_acpi_device_node(child) && -+ !acpi_device_is_present(to_acpi_device_node(child))); -+ -+ return child; -+} -+ - /** - * acpi_node_get_parent - Return parent fwnode of this fwnode - * @fwnode: Firmware node whose parent to get -@@ -1629,7 +1651,7 @@ static int acpi_fwnode_irq_get(const struct fwnode_handle *fwnode, - .property_read_string_array = \ - acpi_fwnode_property_read_string_array, \ - .get_parent = acpi_node_get_parent, \ -- .get_next_child_node = acpi_get_next_subnode, \ -+ .get_next_child_node = acpi_get_next_present_subnode, \ - .get_named_child_node = acpi_fwnode_get_named_child_node, \ - .get_name = acpi_fwnode_get_name, \ - .get_name_prefix = acpi_fwnode_get_name_prefix, \ -diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c -index c0c5c5c58ae1e7..5b5986e10c2d7f 100644 ---- a/drivers/acpi/scan.c -+++ b/drivers/acpi/scan.c -@@ -784,6 +784,8 @@ static bool acpi_info_matches_ids(struct acpi_device_info *info, - static const char * const acpi_ignore_dep_ids[] = { - "PNP0D80", /* Windows-compatible System Power Management Controller */ - "INT33BD", /* Intel Baytrail Mailbox Device */ -+ "INTC10DE", /* Intel CVS LNL */ -+ "INTC10E0", /* Intel CVS ARL */ - "LATT2021", /* Lattice FW Update Client Driver */ - NULL - }; -diff --git a/drivers/base/node.c b/drivers/base/node.c -index 47960a34305d3f..2b398c8a0f06c3 100644 ---- a/drivers/base/node.c -+++ b/drivers/base/node.c -@@ -74,14 +74,14 @@ static BIN_ATTR_RO(cpulist, CPULIST_FILE_MAX_BYTES); - * @dev: Device for this memory access class - * @list_node: List element in the node's access list - * @access: The access class rank -- * @hmem_attrs: Heterogeneous memory performance attributes -+ * @coord: Heterogeneous memory performance coordinates - */ - struct node_access_nodes { - struct device dev; - struct list_head list_node; - unsigned int access; - #ifdef CONFIG_HMEM_REPORTING -- struct node_hmem_attrs hmem_attrs; -+ struct access_coordinate coord; - #endif - }; - #define to_access_nodes(dev) container_of(dev, struct node_access_nodes, dev) -@@ -126,7 +126,7 @@ static void node_access_release(struct device *dev) - } - - static struct node_access_nodes *node_init_node_access(struct node *node, -- unsigned int access) -+ enum access_coordinate_class access) - { - struct node_access_nodes *access_node; - struct device *dev; -@@ -167,7 +167,7 @@ static ssize_t property##_show(struct device *dev, \ - char *buf) \ - { \ - return sysfs_emit(buf, "%u\n", \ -- to_access_nodes(dev)->hmem_attrs.property); \ -+ to_access_nodes(dev)->coord.property); \ - } \ - static DEVICE_ATTR_RO(property) - -@@ -187,11 +187,11 @@ static struct attribute *access_attrs[] = { - /** - * node_set_perf_attrs - Set the performance values for given access class - * @nid: Node identifier to be set -- * @hmem_attrs: Heterogeneous memory performance attributes -+ * @coord: Heterogeneous memory performance coordinates - * @access: The access class the for the given attributes - */ --void node_set_perf_attrs(unsigned int nid, struct node_hmem_attrs *hmem_attrs, -- unsigned int access) -+void node_set_perf_attrs(unsigned int nid, struct access_coordinate *coord, -+ enum access_coordinate_class access) - { - struct node_access_nodes *c; - struct node *node; -@@ -205,7 +205,7 @@ void node_set_perf_attrs(unsigned int nid, struct node_hmem_attrs *hmem_attrs, - if (!c) - return; - -- c->hmem_attrs = *hmem_attrs; -+ c->coord = *coord; - for (i = 0; access_attrs[i] != NULL; i++) { - if (sysfs_add_file_to_group(&c->dev.kobj, access_attrs[i], - "initiators")) { -@@ -689,7 +689,7 @@ int register_cpu_under_node(unsigned int cpu, unsigned int nid) - */ - int register_memory_node_under_compute_node(unsigned int mem_nid, - unsigned int cpu_nid, -- unsigned int access) -+ enum access_coordinate_class access) - { - struct node *init_node, *targ_node; - struct node_access_nodes *initiator, *target; -diff --git a/drivers/base/regmap/regmap-slimbus.c b/drivers/base/regmap/regmap-slimbus.c -index 8075db788b39ad..6a864433cdd9bc 100644 ---- a/drivers/base/regmap/regmap-slimbus.c -+++ b/drivers/base/regmap/regmap-slimbus.c -@@ -48,8 +48,7 @@ struct regmap *__regmap_init_slimbus(struct slim_device *slimbus, - if (IS_ERR(bus)) - return ERR_CAST(bus); - -- return __regmap_init(&slimbus->dev, bus, &slimbus->dev, config, -- lock_key, lock_name); -+ return __regmap_init(&slimbus->dev, bus, slimbus, config, lock_key, lock_name); - } - EXPORT_SYMBOL_GPL(__regmap_init_slimbus); - -@@ -63,8 +62,7 @@ struct regmap *__devm_regmap_init_slimbus(struct slim_device *slimbus, - if (IS_ERR(bus)) - return ERR_CAST(bus); - -- return __devm_regmap_init(&slimbus->dev, bus, &slimbus, config, -- lock_key, lock_name); -+ return __devm_regmap_init(&slimbus->dev, bus, slimbus, config, lock_key, lock_name); - } - EXPORT_SYMBOL_GPL(__devm_regmap_init_slimbus); - -diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c -index f9a3444753c2bb..97659b4792e696 100644 ---- a/drivers/bluetooth/btmtksdio.c -+++ b/drivers/bluetooth/btmtksdio.c -@@ -1257,6 +1257,12 @@ static void btmtksdio_cmd_timeout(struct hci_dev *hdev) - - sdio_claim_host(bdev->func); - -+ /* set drv_pmctrl if BT is closed before doing reset */ -+ if (!test_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state)) { -+ sdio_enable_func(bdev->func); -+ btmtksdio_drv_pmctrl(bdev); -+ } -+ - sdio_writel(bdev->func, C_INT_EN_CLR, MTK_REG_CHLPCR, NULL); - skb_queue_purge(&bdev->txq); - cancel_work_sync(&bdev->txrx_work); -@@ -1272,6 +1278,12 @@ static void btmtksdio_cmd_timeout(struct hci_dev *hdev) - goto err; - } - -+ /* set fw_pmctrl back if BT is closed after doing reset */ -+ if (!test_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state)) { -+ btmtksdio_fw_pmctrl(bdev); -+ sdio_disable_func(bdev->func); -+ } -+ - clear_bit(BTMTKSDIO_PATCH_ENABLED, &bdev->tx_state); - err: - sdio_release_host(bdev->func); -diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c -index 7f67e460f7f491..24dae5440c036c 100644 ---- a/drivers/bluetooth/btrtl.c -+++ b/drivers/bluetooth/btrtl.c -@@ -604,8 +604,10 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev, - len += entry->len; - } - -- if (!len) -+ if (!len) { -+ kvfree(ptr); - return -EPERM; -+ } - - *_buf = ptr; - return len; -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index 4c21230aee460e..74d264b64b5342 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -65,6 +65,7 @@ static struct usb_driver btusb_driver; - #define BTUSB_INTEL_BROKEN_INITIAL_NCMD BIT(25) - #define BTUSB_INTEL_NO_WBS_SUPPORT BIT(26) - #define BTUSB_ACTIONS_SEMI BIT(27) -+#define BTUSB_BARROT BIT(28) - - static const struct usb_device_id btusb_table[] = { - /* Generic Bluetooth USB device */ -@@ -770,6 +771,10 @@ static const struct usb_device_id quirks_table[] = { - { USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK | - BTUSB_WIDEBAND_SPEECH }, - -+ /* Barrot Technology Bluetooth devices */ -+ { USB_DEVICE(0x33fa, 0x0010), .driver_info = BTUSB_BARROT }, -+ { USB_DEVICE(0x33fa, 0x0012), .driver_info = BTUSB_BARROT }, -+ - /* Actions Semiconductor ATS2851 based devices */ - { USB_DEVICE(0x10d7, 0xb012), .driver_info = BTUSB_ACTIONS_SEMI }, - -@@ -1167,6 +1172,18 @@ static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count) - } - - if (!hci_skb_expect(skb)) { -+ /* Each chunk should correspond to at least 1 or more -+ * events so if there are still bytes left that doesn't -+ * constitute a new event this is likely a bug in the -+ * controller. -+ */ -+ if (count && count < HCI_EVENT_HDR_SIZE) { -+ bt_dev_warn(data->hdev, -+ "Unexpected continuation: %d bytes", -+ count); -+ count = 0; -+ } -+ - /* Complete frame */ - btusb_recv_event(data, skb); - skb = NULL; -@@ -4696,6 +4713,11 @@ static void btusb_disconnect(struct usb_interface *intf) - - hci_unregister_dev(hdev); - -+ if (data->oob_wake_irq) -+ device_init_wakeup(&data->udev->dev, false); -+ if (data->reset_gpio) -+ gpiod_put(data->reset_gpio); -+ - if (intf == data->intf) { - if (data->isoc) - usb_driver_release_interface(&btusb_driver, data->isoc); -@@ -4706,17 +4728,11 @@ static void btusb_disconnect(struct usb_interface *intf) - usb_driver_release_interface(&btusb_driver, data->diag); - usb_driver_release_interface(&btusb_driver, data->intf); - } else if (intf == data->diag) { -- usb_driver_release_interface(&btusb_driver, data->intf); - if (data->isoc) - usb_driver_release_interface(&btusb_driver, data->isoc); -+ usb_driver_release_interface(&btusb_driver, data->intf); - } - -- if (data->oob_wake_irq) -- device_init_wakeup(&data->udev->dev, false); -- -- if (data->reset_gpio) -- gpiod_put(data->reset_gpio); -- - hci_free_dev(hdev); - } - -diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c -index 2a5a27d713f8a0..e991d9e6248694 100644 ---- a/drivers/bluetooth/hci_bcsp.c -+++ b/drivers/bluetooth/hci_bcsp.c -@@ -582,6 +582,9 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count) - struct bcsp_struct *bcsp = hu->priv; - const unsigned char *ptr; - -+ if (!test_bit(HCI_UART_REGISTERED, &hu->flags)) -+ return -EUNATCH; -+ - BT_DBG("hu %p count %d rx_state %d rx_count %ld", - hu, count, bcsp->rx_state, bcsp->rx_count); - -diff --git a/drivers/char/misc.c b/drivers/char/misc.c -index 30178e20d962d4..8d8c4bcf07e1c2 100644 ---- a/drivers/char/misc.c -+++ b/drivers/char/misc.c -@@ -58,9 +58,8 @@ static LIST_HEAD(misc_list); - static DEFINE_MUTEX(misc_mtx); - - /* -- * Assigned numbers, used for dynamic minors -+ * Assigned numbers. - */ --#define DYNAMIC_MINORS 128 /* like dynamic majors */ - static DEFINE_IDA(misc_minors_ida); - - static int misc_minor_alloc(int minor) -@@ -69,34 +68,17 @@ static int misc_minor_alloc(int minor) - - if (minor == MISC_DYNAMIC_MINOR) { - /* allocate free id */ -- ret = ida_alloc_max(&misc_minors_ida, DYNAMIC_MINORS - 1, GFP_KERNEL); -- if (ret >= 0) { -- ret = DYNAMIC_MINORS - ret - 1; -- } else { -- ret = ida_alloc_range(&misc_minors_ida, MISC_DYNAMIC_MINOR + 1, -- MINORMASK, GFP_KERNEL); -- } -+ ret = ida_alloc_range(&misc_minors_ida, MISC_DYNAMIC_MINOR + 1, -+ MINORMASK, GFP_KERNEL); - } else { -- /* specific minor, check if it is in dynamic or misc dynamic range */ -- if (minor < DYNAMIC_MINORS) { -- minor = DYNAMIC_MINORS - minor - 1; -- ret = ida_alloc_range(&misc_minors_ida, minor, minor, GFP_KERNEL); -- } else if (minor > MISC_DYNAMIC_MINOR) { -- ret = ida_alloc_range(&misc_minors_ida, minor, minor, GFP_KERNEL); -- } else { -- /* case of non-dynamic minors, no need to allocate id */ -- ret = 0; -- } -+ ret = ida_alloc_range(&misc_minors_ida, minor, minor, GFP_KERNEL); - } - return ret; - } - - static void misc_minor_free(int minor) - { -- if (minor < DYNAMIC_MINORS) -- ida_free(&misc_minors_ida, DYNAMIC_MINORS - minor - 1); -- else if (minor > MISC_DYNAMIC_MINOR) -- ida_free(&misc_minors_ida, minor); -+ ida_free(&misc_minors_ida, minor); - } - - #ifdef CONFIG_PROC_FS -@@ -150,7 +132,8 @@ static int misc_open(struct inode *inode, struct file *file) - break; - } - -- if (!new_fops) { -+ /* Only request module for fixed minor code */ -+ if (!new_fops && minor < MISC_DYNAMIC_MINOR) { - mutex_unlock(&misc_mtx); - request_module("char-major-%d-%d", MISC_MAJOR, minor); - mutex_lock(&misc_mtx); -@@ -162,10 +145,11 @@ static int misc_open(struct inode *inode, struct file *file) - new_fops = fops_get(iter->fops); - break; - } -- if (!new_fops) -- goto fail; - } - -+ if (!new_fops) -+ goto fail; -+ - /* - * Place the miscdevice in the file's - * private_data so it can be used by the -@@ -297,9 +281,11 @@ void misc_deregister(struct miscdevice *misc) - return; - - mutex_lock(&misc_mtx); -- list_del(&misc->list); -+ list_del_init(&misc->list); - device_destroy(&misc_class, MKDEV(MISC_MAJOR, misc->minor)); - misc_minor_free(misc->minor); -+ if (misc->minor > MISC_DYNAMIC_MINOR) -+ misc->minor = MISC_DYNAMIC_MINOR; - mutex_unlock(&misc_mtx); - } - EXPORT_SYMBOL(misc_deregister); -diff --git a/drivers/clk/at91/clk-master.c b/drivers/clk/at91/clk-master.c -index 15c46489ba8501..4c87a0f789de1c 100644 ---- a/drivers/clk/at91/clk-master.c -+++ b/drivers/clk/at91/clk-master.c -@@ -580,6 +580,9 @@ clk_sama7g5_master_recalc_rate(struct clk_hw *hw, - { - struct clk_master *master = to_clk_master(hw); - -+ if (master->div == MASTER_PRES_MAX) -+ return DIV_ROUND_CLOSEST_ULL(parent_rate, 3); -+ - return DIV_ROUND_CLOSEST_ULL(parent_rate, (1 << master->div)); - } - -diff --git a/drivers/clk/at91/clk-sam9x60-pll.c b/drivers/clk/at91/clk-sam9x60-pll.c -index ff65f7b916f077..57d7aef1ea8658 100644 ---- a/drivers/clk/at91/clk-sam9x60-pll.c -+++ b/drivers/clk/at91/clk-sam9x60-pll.c -@@ -90,8 +90,8 @@ static int sam9x60_frac_pll_set(struct sam9x60_pll_core *core) - - spin_lock_irqsave(core->lock, flags); - -- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, -- AT91_PMC_PLL_UPDT_ID_MSK, core->id); -+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, -+ AT91_PMC_PLL_UPDT_ID_MSK, core->id); - regmap_read(regmap, AT91_PMC_PLL_CTRL1, &val); - cmul = (val & core->layout->mul_mask) >> core->layout->mul_shift; - cfrac = (val & core->layout->frac_mask) >> core->layout->frac_shift; -@@ -125,17 +125,17 @@ static int sam9x60_frac_pll_set(struct sam9x60_pll_core *core) - udelay(10); - } - -- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, -- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, -- AT91_PMC_PLL_UPDT_UPDATE | core->id); -+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, -+ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, -+ AT91_PMC_PLL_UPDT_UPDATE | core->id); - - regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, - AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL, - AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL); - -- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, -- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, -- AT91_PMC_PLL_UPDT_UPDATE | core->id); -+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, -+ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, -+ AT91_PMC_PLL_UPDT_UPDATE | core->id); - - while (!sam9x60_pll_ready(regmap, core->id)) - cpu_relax(); -@@ -161,8 +161,8 @@ static void sam9x60_frac_pll_unprepare(struct clk_hw *hw) - - spin_lock_irqsave(core->lock, flags); - -- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, -- AT91_PMC_PLL_UPDT_ID_MSK, core->id); -+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, -+ AT91_PMC_PLL_UPDT_ID_MSK, core->id); - - regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, AT91_PMC_PLL_CTRL0_ENPLL, 0); - -@@ -170,9 +170,9 @@ static void sam9x60_frac_pll_unprepare(struct clk_hw *hw) - regmap_update_bits(regmap, AT91_PMC_PLL_ACR, - AT91_PMC_PLL_ACR_UTMIBG | AT91_PMC_PLL_ACR_UTMIVR, 0); - -- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, -- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, -- AT91_PMC_PLL_UPDT_UPDATE | core->id); -+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, -+ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, -+ AT91_PMC_PLL_UPDT_UPDATE | core->id); - - spin_unlock_irqrestore(core->lock, flags); - } -@@ -257,8 +257,8 @@ static int sam9x60_frac_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate, - - spin_lock_irqsave(core->lock, irqflags); - -- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, -- core->id); -+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, -+ core->id); - regmap_read(regmap, AT91_PMC_PLL_CTRL1, &val); - cmul = (val & core->layout->mul_mask) >> core->layout->mul_shift; - cfrac = (val & core->layout->frac_mask) >> core->layout->frac_shift; -@@ -270,18 +270,18 @@ static int sam9x60_frac_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate, - (frac->mul << core->layout->mul_shift) | - (frac->frac << core->layout->frac_shift)); - -- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, -- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, -- AT91_PMC_PLL_UPDT_UPDATE | core->id); -+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, -+ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, -+ AT91_PMC_PLL_UPDT_UPDATE | core->id); - - regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, - AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL, - AT91_PMC_PLL_CTRL0_ENLOCK | - AT91_PMC_PLL_CTRL0_ENPLL); - -- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, -- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, -- AT91_PMC_PLL_UPDT_UPDATE | core->id); -+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, -+ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, -+ AT91_PMC_PLL_UPDT_UPDATE | core->id); - - while (!sam9x60_pll_ready(regmap, core->id)) - cpu_relax(); -@@ -333,7 +333,10 @@ static const struct clk_ops sam9x60_frac_pll_ops_chg = { - .restore_context = sam9x60_frac_pll_restore_context, - }; - --/* This function should be called with spinlock acquired. */ -+/* This function should be called with spinlock acquired. -+ * Warning: this function must be called only if the same PLL ID was set in -+ * PLL_UPDT register previously. -+ */ - static void sam9x60_div_pll_set_div(struct sam9x60_pll_core *core, u32 div, - bool enable) - { -@@ -345,9 +348,9 @@ static void sam9x60_div_pll_set_div(struct sam9x60_pll_core *core, u32 div, - core->layout->div_mask | ena_msk, - (div << core->layout->div_shift) | ena_val); - -- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, -- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, -- AT91_PMC_PLL_UPDT_UPDATE | core->id); -+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, -+ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, -+ AT91_PMC_PLL_UPDT_UPDATE | core->id); - - while (!sam9x60_pll_ready(regmap, core->id)) - cpu_relax(); -@@ -361,8 +364,8 @@ static int sam9x60_div_pll_set(struct sam9x60_pll_core *core) - unsigned int val, cdiv; - - spin_lock_irqsave(core->lock, flags); -- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, -- AT91_PMC_PLL_UPDT_ID_MSK, core->id); -+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, -+ AT91_PMC_PLL_UPDT_ID_MSK, core->id); - regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val); - cdiv = (val & core->layout->div_mask) >> core->layout->div_shift; - -@@ -393,15 +396,15 @@ static void sam9x60_div_pll_unprepare(struct clk_hw *hw) - - spin_lock_irqsave(core->lock, flags); - -- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, -- AT91_PMC_PLL_UPDT_ID_MSK, core->id); -+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, -+ AT91_PMC_PLL_UPDT_ID_MSK, core->id); - - regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, - core->layout->endiv_mask, 0); - -- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, -- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, -- AT91_PMC_PLL_UPDT_UPDATE | core->id); -+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, -+ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK, -+ AT91_PMC_PLL_UPDT_UPDATE | core->id); - - spin_unlock_irqrestore(core->lock, flags); - } -@@ -507,8 +510,8 @@ static int sam9x60_div_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate, - div->div = DIV_ROUND_CLOSEST(parent_rate, rate) - 1; - - spin_lock_irqsave(core->lock, irqflags); -- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, -- core->id); -+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, -+ core->id); - regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val); - cdiv = (val & core->layout->div_mask) >> core->layout->div_shift; - -@@ -563,8 +566,8 @@ static int sam9x60_div_pll_notifier_fn(struct notifier_block *notifier, - div->div = div->safe_div; - - spin_lock_irqsave(core.lock, irqflags); -- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, -- core.id); -+ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK, -+ core.id); - regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val); - cdiv = (val & core.layout->div_mask) >> core.layout->div_shift; - -diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c -index fdc8ccc586c994..ec1717ddaf275e 100644 ---- a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c -+++ b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c -@@ -325,6 +325,13 @@ static const struct sun6i_rtc_match_data sun50i_r329_rtc_ccu_data = { - .osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents), - }; - -+static const struct sun6i_rtc_match_data sun55i_a523_rtc_ccu_data = { -+ .have_ext_osc32k = true, -+ .have_iosc_calibration = true, -+ .osc32k_fanout_parents = sun50i_r329_osc32k_fanout_parents, -+ .osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents), -+}; -+ - static const struct of_device_id sun6i_rtc_ccu_match[] = { - { - .compatible = "allwinner,sun50i-h616-rtc", -@@ -334,6 +341,10 @@ static const struct of_device_id sun6i_rtc_ccu_match[] = { - .compatible = "allwinner,sun50i-r329-rtc", - .data = &sun50i_r329_rtc_ccu_data, - }, -+ { -+ .compatible = "allwinner,sun55i-a523-rtc", -+ .data = &sun55i_a523_rtc_ccu_data, -+ }, - {}, - }; - -diff --git a/drivers/clk/ti/clk-33xx.c b/drivers/clk/ti/clk-33xx.c -index 85c50ea39e6da0..9269e6a0db6a4e 100644 ---- a/drivers/clk/ti/clk-33xx.c -+++ b/drivers/clk/ti/clk-33xx.c -@@ -258,6 +258,8 @@ static const char *enable_init_clks[] = { - "dpll_ddr_m2_ck", - "dpll_mpu_m2_ck", - "l3_gclk", -+ /* WKUP_DEBUGSS_CLKCTRL - disable fails, AM335x Errata Advisory 1.0.42 */ -+ "l3-aon-clkctrl:0000:0", - /* AM3_L3_L3_MAIN_CLKCTRL, needed during suspend */ - "l3-clkctrl:00bc:0", - "l4hs_gclk", -diff --git a/drivers/clocksource/timer-vf-pit.c b/drivers/clocksource/timer-vf-pit.c -index 911c92146eca6d..8041a8f62d1fa4 100644 ---- a/drivers/clocksource/timer-vf-pit.c -+++ b/drivers/clocksource/timer-vf-pit.c -@@ -35,30 +35,30 @@ static unsigned long cycle_per_jiffy; - - static inline void pit_timer_enable(void) - { -- __raw_writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL); -+ writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL); - } - - static inline void pit_timer_disable(void) - { -- __raw_writel(0, clkevt_base + PITTCTRL); -+ writel(0, clkevt_base + PITTCTRL); - } - - static inline void pit_irq_acknowledge(void) - { -- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG); -+ writel(PITTFLG_TIF, clkevt_base + PITTFLG); - } - - static u64 notrace pit_read_sched_clock(void) - { -- return ~__raw_readl(clksrc_base + PITCVAL); -+ return ~readl(clksrc_base + PITCVAL); - } - - static int __init pit_clocksource_init(unsigned long rate) - { - /* set the max load value and start the clock source counter */ -- __raw_writel(0, clksrc_base + PITTCTRL); -- __raw_writel(~0UL, clksrc_base + PITLDVAL); -- __raw_writel(PITTCTRL_TEN, clksrc_base + PITTCTRL); -+ writel(0, clksrc_base + PITTCTRL); -+ writel(~0UL, clksrc_base + PITLDVAL); -+ writel(PITTCTRL_TEN, clksrc_base + PITTCTRL); - - sched_clock_register(pit_read_sched_clock, 32, rate); - return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate, -@@ -76,7 +76,7 @@ static int pit_set_next_event(unsigned long delta, - * hardware requirement. - */ - pit_timer_disable(); -- __raw_writel(delta - 1, clkevt_base + PITLDVAL); -+ writel(delta - 1, clkevt_base + PITLDVAL); - pit_timer_enable(); - - return 0; -@@ -125,8 +125,8 @@ static struct clock_event_device clockevent_pit = { - - static int __init pit_clockevent_init(unsigned long rate, int irq) - { -- __raw_writel(0, clkevt_base + PITTCTRL); -- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG); -+ writel(0, clkevt_base + PITTCTRL); -+ writel(PITTFLG_TIF, clkevt_base + PITTFLG); - - BUG_ON(request_irq(irq, pit_timer_interrupt, IRQF_TIMER | IRQF_IRQPOLL, - "VF pit timer", &clockevent_pit)); -@@ -183,7 +183,7 @@ static int __init pit_timer_init(struct device_node *np) - cycle_per_jiffy = clk_rate / (HZ); - - /* enable the pit module */ -- __raw_writel(~PITMCR_MDIS, timer_base + PITMCR); -+ writel(~PITMCR_MDIS, timer_base + PITMCR); - - ret = pit_clocksource_init(clk_rate); - if (ret) -diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c -index 4c57c6725c134c..1412d4617a04ad 100644 ---- a/drivers/cpufreq/longhaul.c -+++ b/drivers/cpufreq/longhaul.c -@@ -953,6 +953,9 @@ static void __exit longhaul_exit(void) - struct cpufreq_policy *policy = cpufreq_cpu_get(0); - int i; - -+ if (unlikely(!policy)) -+ return; -+ - for (i = 0; i < numscales; i++) { - if (mults[i] == maxmult) { - struct cpufreq_freqs freqs; -diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c -index 39186008afbfdf..233c82a8340861 100644 ---- a/drivers/cpufreq/tegra186-cpufreq.c -+++ b/drivers/cpufreq/tegra186-cpufreq.c -@@ -132,13 +132,14 @@ static struct cpufreq_driver tegra186_cpufreq_driver = { - - static struct cpufreq_frequency_table *init_vhint_table( - struct platform_device *pdev, struct tegra_bpmp *bpmp, -- struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id) -+ struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id, -+ int *num_rates) - { - struct cpufreq_frequency_table *table; - struct mrq_cpu_vhint_request req; - struct tegra_bpmp_message msg; - struct cpu_vhint_data *data; -- int err, i, j, num_rates = 0; -+ int err, i, j; - dma_addr_t phys; - void *virt; - -@@ -168,6 +169,7 @@ static struct cpufreq_frequency_table *init_vhint_table( - goto free; - } - -+ *num_rates = 0; - for (i = data->vfloor; i <= data->vceil; i++) { - u16 ndiv = data->ndiv[i]; - -@@ -178,10 +180,10 @@ static struct cpufreq_frequency_table *init_vhint_table( - if (i > 0 && ndiv == data->ndiv[i - 1]) - continue; - -- num_rates++; -+ (*num_rates)++; - } - -- table = devm_kcalloc(&pdev->dev, num_rates + 1, sizeof(*table), -+ table = devm_kcalloc(&pdev->dev, *num_rates + 1, sizeof(*table), - GFP_KERNEL); - if (!table) { - table = ERR_PTR(-ENOMEM); -@@ -223,7 +225,9 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev) - { - struct tegra186_cpufreq_data *data; - struct tegra_bpmp *bpmp; -- unsigned int i = 0, err; -+ unsigned int i = 0, err, edvd_offset; -+ int num_rates = 0; -+ u32 edvd_val, cpu; - - data = devm_kzalloc(&pdev->dev, - struct_size(data, clusters, TEGRA186_NUM_CLUSTERS), -@@ -246,10 +250,21 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev) - for (i = 0; i < TEGRA186_NUM_CLUSTERS; i++) { - struct tegra186_cpufreq_cluster *cluster = &data->clusters[i]; - -- cluster->table = init_vhint_table(pdev, bpmp, cluster, i); -+ cluster->table = init_vhint_table(pdev, bpmp, cluster, i, &num_rates); - if (IS_ERR(cluster->table)) { - err = PTR_ERR(cluster->table); - goto put_bpmp; -+ } else if (!num_rates) { -+ err = -EINVAL; -+ goto put_bpmp; -+ } -+ -+ for (cpu = 0; cpu < ARRAY_SIZE(tegra186_cpus); cpu++) { -+ if (data->cpus[cpu].bpmp_cluster_id == i) { -+ edvd_val = cluster->table[num_rates - 1].driver_data; -+ edvd_offset = data->cpus[cpu].edvd_offset; -+ writel(edvd_val, data->regs + edvd_offset); -+ } - } - } - -diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c -index 737a026ef58a38..6704d610573ad6 100644 ---- a/drivers/cpuidle/cpuidle.c -+++ b/drivers/cpuidle/cpuidle.c -@@ -634,8 +634,14 @@ static void __cpuidle_device_init(struct cpuidle_device *dev) - static int __cpuidle_register_device(struct cpuidle_device *dev) - { - struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev); -+ unsigned int cpu = dev->cpu; - int i, ret; - -+ if (per_cpu(cpuidle_devices, cpu)) { -+ pr_info("CPU%d: cpuidle device already registered\n", cpu); -+ return -EEXIST; -+ } -+ - if (!try_module_get(drv->owner)) - return -EINVAL; - -@@ -647,7 +653,7 @@ static int __cpuidle_register_device(struct cpuidle_device *dev) - dev->states_usage[i].disable |= CPUIDLE_STATE_DISABLED_BY_USER; - } - -- per_cpu(cpuidle_devices, dev->cpu) = dev; -+ per_cpu(cpuidle_devices, cpu) = dev; - list_add(&dev->device_list, &cpuidle_detected_devices); - - ret = cpuidle_coupled_register_device(dev); -diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c -index cafe6eed3349f4..8c591dde610232 100644 ---- a/drivers/cpuidle/governors/menu.c -+++ b/drivers/cpuidle/governors/menu.c -@@ -348,45 +348,50 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev, - if (s->exit_latency_ns > latency_req) - break; - -- if (s->target_residency_ns > predicted_ns) { -- /* -- * Use a physical idle state, not busy polling, unless -- * a timer is going to trigger soon enough. -- */ -- if ((drv->states[idx].flags & CPUIDLE_FLAG_POLLING) && -- s->target_residency_ns <= data->next_timer_ns) { -- predicted_ns = s->target_residency_ns; -- idx = i; -- break; -- } -- if (predicted_ns < TICK_NSEC) -- break; -- -- if (!tick_nohz_tick_stopped()) { -- /* -- * If the state selected so far is shallow, -- * waking up early won't hurt, so retain the -- * tick in that case and let the governor run -- * again in the next iteration of the loop. -- */ -- predicted_ns = drv->states[idx].target_residency_ns; -- break; -- } -+ if (s->target_residency_ns <= predicted_ns) { -+ idx = i; -+ continue; -+ } -+ -+ /* -+ * Use a physical idle state, not busy polling, unless a timer -+ * is going to trigger soon enough or the exit latency of the -+ * idle state in question is greater than the predicted idle -+ * duration. -+ */ -+ if ((drv->states[idx].flags & CPUIDLE_FLAG_POLLING) && -+ s->target_residency_ns <= data->next_timer_ns && -+ s->exit_latency_ns <= predicted_ns) { -+ predicted_ns = s->target_residency_ns; -+ idx = i; -+ break; -+ } - -+ if (predicted_ns < TICK_NSEC) -+ break; -+ -+ if (!tick_nohz_tick_stopped()) { - /* -- * If the state selected so far is shallow and this -- * state's target residency matches the time till the -- * closest timer event, select this one to avoid getting -- * stuck in the shallow one for too long. -+ * If the state selected so far is shallow, waking up -+ * early won't hurt, so retain the tick in that case and -+ * let the governor run again in the next iteration of -+ * the idle loop. - */ -- if (drv->states[idx].target_residency_ns < TICK_NSEC && -- s->target_residency_ns <= delta_tick) -- idx = i; -- -- return idx; -+ predicted_ns = drv->states[idx].target_residency_ns; -+ break; - } - -- idx = i; -+ /* -+ * If the state selected so far is shallow and this state's -+ * target residency matches the time till the closest timer -+ * event, select this one to avoid getting stuck in the shallow -+ * one for too long. -+ */ -+ if (drv->states[idx].target_residency_ns < TICK_NSEC && -+ s->target_residency_ns <= delta_tick) -+ idx = i; -+ -+ return idx; - } - - if (idx == -1) -diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c -index 9e093d44a06629..31f2b4adf3d9ae 100644 ---- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c -+++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c -@@ -264,7 +264,6 @@ static int sun8i_ce_cipher_prepare(struct crypto_engine *engine, void *async_req - goto theend_sgs; - } - -- chan->timeout = areq->cryptlen; - rctx->nr_sgs = ns; - rctx->nr_sgd = nd; - return 0; -diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c -index d4ccd5254280bc..eba186c5c62513 100644 ---- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c -+++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c -@@ -186,11 +186,10 @@ int sun8i_ce_run_task(struct sun8i_ce_dev *ce, int flow, const char *name) - mutex_unlock(&ce->mlock); - - wait_for_completion_interruptible_timeout(&ce->chanlist[flow].complete, -- msecs_to_jiffies(ce->chanlist[flow].timeout)); -+ msecs_to_jiffies(CE_DMA_TIMEOUT_MS)); - - if (ce->chanlist[flow].status == 0) { -- dev_err(ce->dev, "DMA timeout for %s (tm=%d) on flow %d\n", name, -- ce->chanlist[flow].timeout, flow); -+ dev_err(ce->dev, "DMA timeout for %s on flow %d\n", name, flow); - err = -EFAULT; - } - /* No need to lock for this read, the channel is locked so -diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c -index ebc857ed10e11e..8ee1e94335c376 100644 ---- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c -+++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c -@@ -457,8 +457,6 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq) - else - cet->t_dlen = cpu_to_le32(areq->nbytes / 4 + j); - -- chan->timeout = areq->nbytes; -- - err = sun8i_ce_run_task(ce, flow, crypto_ahash_alg_name(tfm)); - - dma_unmap_single(ce->dev, addr_pad, j * 4, DMA_TO_DEVICE); -diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c -index 80815379f6fc55..b571d1d0c4c4ca 100644 ---- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c -+++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c -@@ -137,7 +137,6 @@ int sun8i_ce_prng_generate(struct crypto_rng *tfm, const u8 *src, - - cet->t_dst[0].addr = cpu_to_le32(dma_dst); - cet->t_dst[0].len = cpu_to_le32(todo / 4); -- ce->chanlist[flow].timeout = 2000; - - err = sun8i_ce_run_task(ce, 3, "PRNG"); - mutex_unlock(&ce->rnglock); -diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c -index 9c35f2a83eda85..630a0b84b494d8 100644 ---- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c -+++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c -@@ -79,7 +79,6 @@ static int sun8i_ce_trng_read(struct hwrng *rng, void *data, size_t max, bool wa - - cet->t_dst[0].addr = cpu_to_le32(dma_dst); - cet->t_dst[0].len = cpu_to_le32(todo / 4); -- ce->chanlist[flow].timeout = todo; - - err = sun8i_ce_run_task(ce, 3, "TRNG"); - mutex_unlock(&ce->rnglock); -diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h -index 65cc1278ee1555..d817ce445f4a39 100644 ---- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h -+++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h -@@ -106,6 +106,7 @@ - #define MAX_SG 8 - - #define CE_MAX_CLOCKS 4 -+#define CE_DMA_TIMEOUT_MS 3000 - - #define MAXFLOW 4 - -@@ -195,7 +196,6 @@ struct sun8i_ce_flow { - struct completion complete; - int status; - dma_addr_t t_phy; -- int timeout; - struct ce_task *tl; - void *backup_iv; - void *bounce_iv; -diff --git a/drivers/crypto/aspeed/aspeed-acry.c b/drivers/crypto/aspeed/aspeed-acry.c -index 247c568aa8dfe3..8ca0913d94abfe 100644 ---- a/drivers/crypto/aspeed/aspeed-acry.c -+++ b/drivers/crypto/aspeed/aspeed-acry.c -@@ -789,28 +789,24 @@ static int aspeed_acry_probe(struct platform_device *pdev) - err_engine_rsa_start: - crypto_engine_exit(acry_dev->crypt_engine_rsa); - clk_exit: -- clk_disable_unprepare(acry_dev->clk); - - return rc; - } - --static int aspeed_acry_remove(struct platform_device *pdev) -+static void aspeed_acry_remove(struct platform_device *pdev) - { - struct aspeed_acry_dev *acry_dev = platform_get_drvdata(pdev); - - aspeed_acry_unregister(acry_dev); - crypto_engine_exit(acry_dev->crypt_engine_rsa); - tasklet_kill(&acry_dev->done_task); -- clk_disable_unprepare(acry_dev->clk); -- -- return 0; - } - - MODULE_DEVICE_TABLE(of, aspeed_acry_of_matches); - - static struct platform_driver aspeed_acry_driver = { - .probe = aspeed_acry_probe, -- .remove = aspeed_acry_remove, -+ .remove_new = aspeed_acry_remove, - .driver = { - .name = KBUILD_MODNAME, - .of_match_table = aspeed_acry_of_matches, -diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c -index bdf367f3f67980..eb880f0435ee9f 100644 ---- a/drivers/crypto/caam/ctrl.c -+++ b/drivers/crypto/caam/ctrl.c -@@ -692,12 +692,12 @@ static int caam_ctrl_rng_init(struct device *dev) - */ - if (needs_entropy_delay_adjustment()) - ent_delay = 12000; -- if (!(ctrlpriv->rng4_sh_init || inst_handles)) { -+ if (!inst_handles) { - dev_info(dev, - "Entropy delay = %u\n", - ent_delay); - kick_trng(dev, ent_delay); -- ent_delay += 400; -+ ent_delay = ent_delay * 2; - } - /* - * if instantiate_rng(...) fails, the loop will rerun -diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c -index 203240e78f6adb..a2c6b28f4b84bc 100644 ---- a/drivers/crypto/hisilicon/qm.c -+++ b/drivers/crypto/hisilicon/qm.c -@@ -3750,10 +3750,12 @@ static ssize_t qm_get_qos_value(struct hisi_qm *qm, const char *buf, - pdev = container_of(dev, struct pci_dev, dev); - if (pci_physfn(pdev) != qm->pdev) { - pci_err(qm->pdev, "the pdev input does not match the pf!\n"); -+ put_device(dev); - return -EINVAL; - } - - *fun_index = pdev->devfn; -+ put_device(dev); - - return 0; - } -diff --git a/drivers/crypto/intel/qat/qat_common/qat_uclo.c b/drivers/crypto/intel/qat/qat_common/qat_uclo.c -index 4bd150d1441a02..473e1ab9b8baac 100644 ---- a/drivers/crypto/intel/qat/qat_common/qat_uclo.c -+++ b/drivers/crypto/intel/qat/qat_common/qat_uclo.c -@@ -1745,7 +1745,7 @@ static int qat_uclo_map_objs_from_mof(struct icp_qat_mof_handle *mobj_handle) - if (sobj_hdr) - sobj_chunk_num = sobj_hdr->num_chunks; - -- mobj_hdr = kzalloc((uobj_chunk_num + sobj_chunk_num) * -+ mobj_hdr = kcalloc(size_add(uobj_chunk_num, sobj_chunk_num), - sizeof(*mobj_hdr), GFP_KERNEL); - if (!mobj_hdr) - return -ENOMEM; -diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c -index 68236247059d13..9ae789d4aca7b6 100644 ---- a/drivers/dma/dw-edma/dw-edma-core.c -+++ b/drivers/dma/dw-edma/dw-edma-core.c -@@ -595,6 +595,25 @@ dw_edma_device_prep_interleaved_dma(struct dma_chan *dchan, - return dw_edma_device_transfer(&xfer); - } - -+static void dw_hdma_set_callback_result(struct virt_dma_desc *vd, -+ enum dmaengine_tx_result result) -+{ -+ u32 residue = 0; -+ struct dw_edma_desc *desc; -+ struct dmaengine_result *res; -+ -+ if (!vd->tx.callback_result) -+ return; -+ -+ desc = vd2dw_edma_desc(vd); -+ if (desc) -+ residue = desc->alloc_sz - desc->xfer_sz; -+ -+ res = &vd->tx_result; -+ res->result = result; -+ res->residue = residue; -+} -+ - static void dw_edma_done_interrupt(struct dw_edma_chan *chan) - { - struct dw_edma_desc *desc; -@@ -608,6 +627,8 @@ static void dw_edma_done_interrupt(struct dw_edma_chan *chan) - case EDMA_REQ_NONE: - desc = vd2dw_edma_desc(vd); - if (!desc->chunks_alloc) { -+ dw_hdma_set_callback_result(vd, -+ DMA_TRANS_NOERROR); - list_del(&vd->node); - vchan_cookie_complete(vd); - } -@@ -644,6 +665,7 @@ static void dw_edma_abort_interrupt(struct dw_edma_chan *chan) - spin_lock_irqsave(&chan->vc.lock, flags); - vd = vchan_next_desc(&chan->vc); - if (vd) { -+ dw_hdma_set_callback_result(vd, DMA_TRANS_ABORTED); - list_del(&vd->node); - vchan_cookie_complete(vd); - } -diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c -index ca0ba1d462832d..8b215cbca1186b 100644 ---- a/drivers/dma/mv_xor.c -+++ b/drivers/dma/mv_xor.c -@@ -1013,7 +1013,7 @@ static int mv_xor_channel_remove(struct mv_xor_chan *mv_chan) - - dma_async_device_unregister(&mv_chan->dmadev); - -- dma_free_coherent(dev, MV_XOR_POOL_SIZE, -+ dma_free_wc(dev, MV_XOR_POOL_SIZE, - mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool); - dma_unmap_single(dev, mv_chan->dummy_src_addr, - MV_XOR_MIN_BYTE_COUNT, DMA_FROM_DEVICE); -@@ -1163,7 +1163,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev, - err_free_irq: - free_irq(mv_chan->irq, mv_chan); - err_free_dma: -- dma_free_coherent(&pdev->dev, MV_XOR_POOL_SIZE, -+ dma_free_wc(&pdev->dev, MV_XOR_POOL_SIZE, - mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool); - err_unmap_dst: - dma_unmap_single(dma_dev->dev, mv_chan->dummy_dst_addr, -diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c -index 588c5f409a8087..8d796504cb7f1a 100644 ---- a/drivers/dma/sh/shdma-base.c -+++ b/drivers/dma/sh/shdma-base.c -@@ -129,12 +129,25 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx) - const struct shdma_ops *ops = sdev->ops; - dev_dbg(schan->dev, "Bring up channel %d\n", - schan->id); -- /* -- * TODO: .xfer_setup() might fail on some platforms. -- * Make it int then, on error remove chunks from the -- * queue again -- */ -- ops->setup_xfer(schan, schan->slave_id); -+ -+ ret = ops->setup_xfer(schan, schan->slave_id); -+ if (ret < 0) { -+ dev_err(schan->dev, "setup_xfer failed: %d\n", ret); -+ -+ /* Remove chunks from the queue and mark them as idle */ -+ list_for_each_entry_safe(chunk, c, &schan->ld_queue, node) { -+ if (chunk->cookie == cookie) { -+ chunk->mark = DESC_IDLE; -+ list_move(&chunk->node, &schan->ld_free); -+ } -+ } -+ -+ schan->pm_state = SHDMA_PM_ESTABLISHED; -+ ret = pm_runtime_put(schan->dev); -+ -+ spin_unlock_irq(&schan->chan_lock); -+ return ret; -+ } - - if (schan->pm_state == SHDMA_PM_PENDING) - shdma_chan_xfer_ld_queue(schan); -diff --git a/drivers/dma/sh/shdmac.c b/drivers/dma/sh/shdmac.c -index 00067b29e23223..d8210488dd40c7 100644 ---- a/drivers/dma/sh/shdmac.c -+++ b/drivers/dma/sh/shdmac.c -@@ -300,21 +300,30 @@ static bool sh_dmae_channel_busy(struct shdma_chan *schan) - return dmae_is_busy(sh_chan); - } - --static void sh_dmae_setup_xfer(struct shdma_chan *schan, -- int slave_id) -+static int sh_dmae_setup_xfer(struct shdma_chan *schan, int slave_id) - { - struct sh_dmae_chan *sh_chan = container_of(schan, struct sh_dmae_chan, - shdma_chan); - -+ int ret = 0; - if (slave_id >= 0) { - const struct sh_dmae_slave_config *cfg = - sh_chan->config; - -- dmae_set_dmars(sh_chan, cfg->mid_rid); -- dmae_set_chcr(sh_chan, cfg->chcr); -+ ret = dmae_set_dmars(sh_chan, cfg->mid_rid); -+ if (ret < 0) -+ goto END; -+ -+ ret = dmae_set_chcr(sh_chan, cfg->chcr); -+ if (ret < 0) -+ goto END; -+ - } else { - dmae_init(sh_chan); - } -+ -+END: -+ return ret; - } - - /* -diff --git a/drivers/edac/altera_edac.c b/drivers/edac/altera_edac.c -index 233e58278943e0..4f8f87207b67b8 100644 ---- a/drivers/edac/altera_edac.c -+++ b/drivers/edac/altera_edac.c -@@ -1194,10 +1194,22 @@ altr_check_ocram_deps_init(struct altr_edac_device_dev *device) - if (ret) - return ret; - -- /* Verify OCRAM has been initialized */ -+ /* -+ * Verify that OCRAM has been initialized. -+ * During a warm reset, OCRAM contents are retained, but the control -+ * and status registers are reset to their default values. Therefore, -+ * ECC must be explicitly re-enabled in the control register. -+ * Error condition: if INITCOMPLETEA is clear and ECC_EN is already set. -+ */ - if (!ecc_test_bits(ALTR_A10_ECC_INITCOMPLETEA, -- (base + ALTR_A10_ECC_INITSTAT_OFST))) -- return -ENODEV; -+ (base + ALTR_A10_ECC_INITSTAT_OFST))) { -+ if (!ecc_test_bits(ALTR_A10_ECC_EN, -+ (base + ALTR_A10_ECC_CTRL_OFST))) -+ ecc_set_bits(ALTR_A10_ECC_EN, -+ (base + ALTR_A10_ECC_CTRL_OFST)); -+ else -+ return -ENODEV; -+ } - - /* Enable IRQ on Single Bit Error */ - writel(ALTR_A10_ECC_SERRINTEN, (base + ALTR_A10_ECC_ERRINTENS_OFST)); -@@ -1367,7 +1379,7 @@ static const struct edac_device_prv_data a10_enetecc_data = { - .ue_set_mask = ALTR_A10_ECC_TDERRA, - .set_err_ofst = ALTR_A10_ECC_INTTEST_OFST, - .ecc_irq_handler = altr_edac_a10_ecc_irq, -- .inject_fops = &altr_edac_a10_device_inject2_fops, -+ .inject_fops = &altr_edac_a10_device_inject_fops, - }; - - #endif /* CONFIG_EDAC_ALTERA_ETHERNET */ -@@ -1457,7 +1469,7 @@ static const struct edac_device_prv_data a10_usbecc_data = { - .ue_set_mask = ALTR_A10_ECC_TDERRA, - .set_err_ofst = ALTR_A10_ECC_INTTEST_OFST, - .ecc_irq_handler = altr_edac_a10_ecc_irq, -- .inject_fops = &altr_edac_a10_device_inject2_fops, -+ .inject_fops = &altr_edac_a10_device_inject_fops, - }; - - #endif /* CONFIG_EDAC_ALTERA_USB */ -diff --git a/drivers/extcon/extcon-adc-jack.c b/drivers/extcon/extcon-adc-jack.c -index 0317b614b68052..26b083ccc94b2c 100644 ---- a/drivers/extcon/extcon-adc-jack.c -+++ b/drivers/extcon/extcon-adc-jack.c -@@ -162,6 +162,8 @@ static int adc_jack_remove(struct platform_device *pdev) - { - struct adc_jack_data *data = platform_get_drvdata(pdev); - -+ if (data->wakeup_source) -+ device_init_wakeup(&pdev->dev, false); - free_irq(data->irq, data); - cancel_work_sync(&data->handler.work); - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c -index d34037b85cf859..52c093e42531bd 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c -@@ -1205,29 +1205,69 @@ static void amdgpu_connector_dvi_force(struct drm_connector *connector) - amdgpu_connector->use_digital = true; - } - -+/** -+ * amdgpu_max_hdmi_pixel_clock - Return max supported HDMI (TMDS) pixel clock -+ * @adev: pointer to amdgpu_device -+ * -+ * Return: maximum supported HDMI (TMDS) pixel clock in KHz. -+ */ -+static int amdgpu_max_hdmi_pixel_clock(const struct amdgpu_device *adev) -+{ -+ if (adev->asic_type >= CHIP_POLARIS10) -+ return 600000; -+ else if (adev->asic_type >= CHIP_TONGA) -+ return 300000; -+ else -+ return 297000; -+} -+ -+/** -+ * amdgpu_connector_dvi_mode_valid - Validate a mode on DVI/HDMI connectors -+ * @connector: DRM connector to validate the mode on -+ * @mode: display mode to validate -+ * -+ * Validate the given display mode on DVI and HDMI connectors, including -+ * analog signals on DVI-I. -+ * -+ * Return: drm_mode_status indicating whether the mode is valid. -+ */ - static enum drm_mode_status amdgpu_connector_dvi_mode_valid(struct drm_connector *connector, - struct drm_display_mode *mode) - { - struct drm_device *dev = connector->dev; - struct amdgpu_device *adev = drm_to_adev(dev); - struct amdgpu_connector *amdgpu_connector = to_amdgpu_connector(connector); -+ const int max_hdmi_pixel_clock = amdgpu_max_hdmi_pixel_clock(adev); -+ const int max_dvi_single_link_pixel_clock = 165000; -+ int max_digital_pixel_clock_khz; - - /* XXX check mode bandwidth */ - -- if (amdgpu_connector->use_digital && (mode->clock > 165000)) { -- if ((amdgpu_connector->connector_object_id == CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I) || -- (amdgpu_connector->connector_object_id == CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_D) || -- (amdgpu_connector->connector_object_id == CONNECTOR_OBJECT_ID_HDMI_TYPE_B)) { -- return MODE_OK; -- } else if (connector->display_info.is_hdmi) { -- /* HDMI 1.3+ supports max clock of 340 Mhz */ -- if (mode->clock > 340000) -- return MODE_CLOCK_HIGH; -- else -- return MODE_OK; -- } else { -- return MODE_CLOCK_HIGH; -+ if (amdgpu_connector->use_digital) { -+ switch (amdgpu_connector->connector_object_id) { -+ case CONNECTOR_OBJECT_ID_HDMI_TYPE_A: -+ max_digital_pixel_clock_khz = max_hdmi_pixel_clock; -+ break; -+ case CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I: -+ case CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_D: -+ max_digital_pixel_clock_khz = max_dvi_single_link_pixel_clock; -+ break; -+ case CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I: -+ case CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_D: -+ case CONNECTOR_OBJECT_ID_HDMI_TYPE_B: -+ max_digital_pixel_clock_khz = max_dvi_single_link_pixel_clock * 2; -+ break; - } -+ -+ /* When the display EDID claims that it's an HDMI display, -+ * we use the HDMI encoder mode of the display HW, -+ * so we should verify against the max HDMI clock here. -+ */ -+ if (connector->display_info.is_hdmi) -+ max_digital_pixel_clock_khz = max_hdmi_pixel_clock; -+ -+ if (mode->clock > max_digital_pixel_clock_khz) -+ return MODE_CLOCK_HIGH; - } - - /* check against the max pixel clock */ -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c -index 13c97ba7a820b4..05712d322024a2 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c -@@ -286,7 +286,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p, - } - } - -- if (!p->gang_size) { -+ if (!p->gang_size || (amdgpu_sriov_vf(p->adev) && p->gang_size > 1)) { - ret = -EINVAL; - goto free_all_kdata; - } -@@ -690,7 +690,7 @@ static void amdgpu_cs_get_threshold_for_moves(struct amdgpu_device *adev, - */ - const s64 us_upper_bound = 200000; - -- if (!adev->mm_stats.log2_max_MBps) { -+ if ((!adev->mm_stats.log2_max_MBps) || !ttm_resource_manager_used(&adev->mman.vram_mgr.manager)) { - *max_bytes = 0; - *max_vis_bytes = 0; - return; -@@ -1732,30 +1732,21 @@ int amdgpu_cs_wait_fences_ioctl(struct drm_device *dev, void *data, - { - struct amdgpu_device *adev = drm_to_adev(dev); - union drm_amdgpu_wait_fences *wait = data; -- uint32_t fence_count = wait->in.fence_count; -- struct drm_amdgpu_fence *fences_user; - struct drm_amdgpu_fence *fences; - int r; - - /* Get the fences from userspace */ -- fences = kmalloc_array(fence_count, sizeof(struct drm_amdgpu_fence), -- GFP_KERNEL); -- if (fences == NULL) -- return -ENOMEM; -- -- fences_user = u64_to_user_ptr(wait->in.fences); -- if (copy_from_user(fences, fences_user, -- sizeof(struct drm_amdgpu_fence) * fence_count)) { -- r = -EFAULT; -- goto err_free_fences; -- } -+ fences = memdup_array_user(u64_to_user_ptr(wait->in.fences), -+ wait->in.fence_count, -+ sizeof(struct drm_amdgpu_fence)); -+ if (IS_ERR(fences)) -+ return PTR_ERR(fences); - - if (wait->in.wait_all) - r = amdgpu_cs_wait_all_fences(adev, filp, wait, fences); - else - r = amdgpu_cs_wait_any_fence(adev, filp, wait, fences); - --err_free_fences: - kfree(fences); - - return r; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -index 200b59318759da..b2a1dc193cb8f6 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -@@ -93,6 +93,7 @@ MODULE_FIRMWARE("amdgpu/picasso_gpu_info.bin"); - MODULE_FIRMWARE("amdgpu/raven2_gpu_info.bin"); - MODULE_FIRMWARE("amdgpu/arcturus_gpu_info.bin"); - MODULE_FIRMWARE("amdgpu/navi12_gpu_info.bin"); -+MODULE_FIRMWARE("amdgpu/cyan_skillfish_gpu_info.bin"); - - #define AMDGPU_RESUME_MS 2000 - #define AMDGPU_MAX_RETRY_LIMIT 2 -@@ -1939,6 +1940,9 @@ static int amdgpu_device_parse_gpu_info_fw(struct amdgpu_device *adev) - case CHIP_NAVI12: - chip_name = "navi12"; - break; -+ case CHIP_CYAN_SKILLFISH: -+ chip_name = "cyan_skillfish"; -+ break; - } - - snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_gpu_info.bin", chip_name); -@@ -4109,6 +4113,10 @@ static int amdgpu_device_evict_resources(struct amdgpu_device *adev) - if ((adev->in_s3 || adev->in_s0ix) && (adev->flags & AMD_IS_APU)) - return 0; - -+ /* No need to evict when going to S5 through S4 callbacks */ -+ if (system_state == SYSTEM_POWER_OFF) -+ return 0; -+ - ret = amdgpu_ttm_evict_resources(adev, TTM_PL_VRAM); - if (ret) - DRM_WARN("evicting device resources failed\n"); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c -index b04d789bfd1005..2e492f779b54ce 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c -@@ -1819,13 +1819,16 @@ static int amdgpu_discovery_set_smu_ip_blocks(struct amdgpu_device *adev) - case IP_VERSION(11, 0, 5): - case IP_VERSION(11, 0, 9): - case IP_VERSION(11, 0, 7): -- case IP_VERSION(11, 0, 8): - case IP_VERSION(11, 0, 11): - case IP_VERSION(11, 0, 12): - case IP_VERSION(11, 0, 13): - case IP_VERSION(11, 5, 0): - amdgpu_device_ip_block_add(adev, &smu_v11_0_ip_block); - break; -+ case IP_VERSION(11, 0, 8): -+ if (adev->apu_flags & AMD_APU_IS_CYAN_SKILLFISH2) -+ amdgpu_device_ip_block_add(adev, &smu_v11_0_ip_block); -+ break; - case IP_VERSION(12, 0, 0): - case IP_VERSION(12, 0, 1): - amdgpu_device_ip_block_add(adev, &smu_v12_0_ip_block); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -index 940411f8e99be0..b15ce4df747986 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -@@ -1983,6 +1983,11 @@ static const struct pci_device_id pciidlist[] = { - {0x1002, 0x7410, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ALDEBARAN}, - - /* CYAN_SKILLFISH */ -+ {0x1002, 0x13DB, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU}, -+ {0x1002, 0x13F9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU}, -+ {0x1002, 0x13FA, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU}, -+ {0x1002, 0x13FB, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU}, -+ {0x1002, 0x13FC, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU}, - {0x1002, 0x13FE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU}, - {0x1002, 0x143F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU}, - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c -index 2ff2897fd1db6c..cd8fa1164d540e 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c -@@ -87,10 +87,12 @@ static void amdgpu_jpeg_idle_work_handler(struct work_struct *work) - fences += amdgpu_fence_count_emitted(&adev->jpeg.inst[i].ring_dec[j]); - } - -- if (!fences && !atomic_read(&adev->jpeg.total_submission_cnt)) -+ if (!fences && !atomic_read(&adev->jpeg.total_submission_cnt)) { -+ mutex_lock(&adev->jpeg.jpeg_pg_lock); - amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_JPEG, - AMD_PG_STATE_GATE); -- else -+ mutex_unlock(&adev->jpeg.jpeg_pg_lock); -+ } else - schedule_delayed_work(&adev->jpeg.idle_work, JPEG_IDLE_TIMEOUT); - } - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -index 5797055b1148f7..1f0de6e717112e 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -@@ -651,7 +651,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) - ui64 = atomic64_read(&adev->num_vram_cpu_page_faults); - return copy_to_user(out, &ui64, min(size, 8u)) ? -EFAULT : 0; - case AMDGPU_INFO_VRAM_USAGE: -- ui64 = ttm_resource_manager_usage(&adev->mman.vram_mgr.manager); -+ ui64 = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ? -+ ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) : 0; - return copy_to_user(out, &ui64, min(size, 8u)) ? -EFAULT : 0; - case AMDGPU_INFO_VIS_VRAM_USAGE: - ui64 = amdgpu_vram_mgr_vis_usage(&adev->mman.vram_mgr); -@@ -697,8 +698,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) - mem.vram.usable_heap_size = adev->gmc.real_vram_size - - atomic64_read(&adev->vram_pin_size) - - AMDGPU_VM_RESERVED_VRAM; -- mem.vram.heap_usage = -- ttm_resource_manager_usage(vram_man); -+ mem.vram.heap_usage = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ? -+ ttm_resource_manager_usage(vram_man) : 0; - mem.vram.max_allocation = mem.vram.usable_heap_size * 3 / 4; - - mem.cpu_accessible_vram.total_heap_size = -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c -index d358a08b5e0067..08886e0ee6428b 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c -@@ -2015,8 +2015,11 @@ static int psp_securedisplay_initialize(struct psp_context *psp) - if (!ret && !psp->securedisplay_context.context.resp_status) { - psp->securedisplay_context.context.initialized = true; - mutex_init(&psp->securedisplay_context.mutex); -- } else -+ } else { -+ /* don't try again */ -+ psp->securedisplay_context.context.bin_desc.size_bytes = 0; - return ret; -+ } - - mutex_lock(&psp->securedisplay_context.mutex); - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c -index 7cb4b4118335a6..5a4b1b625f0371 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c -@@ -604,8 +604,8 @@ static int amdgpu_virt_write_vf2pf_data(struct amdgpu_device *adev) - vf2pf_info->driver_cert = 0; - vf2pf_info->os_info.all = 0; - -- vf2pf_info->fb_usage = -- ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) >> 20; -+ vf2pf_info->fb_usage = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ? -+ ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) >> 20 : 0; - vf2pf_info->fb_vis_usage = - amdgpu_vram_mgr_vis_usage(&adev->mman.vram_mgr) >> 20; - vf2pf_info->fb_size = adev->gmc.real_vram_size >> 20; -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c -index 35dc926f234e39..2e194aa608489d 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c -@@ -1085,7 +1085,12 @@ static int kfd_ioctl_alloc_memory_of_gpu(struct file *filep, - svm_range_list_lock_and_flush_work(&p->svms, current->mm); - mutex_lock(&p->svms.lock); - mmap_write_unlock(current->mm); -- if (interval_tree_iter_first(&p->svms.objects, -+ -+ /* Skip a special case that allocates VRAM without VA, -+ * VA will be invalid of 0. -+ */ -+ if (!(!args->va_addr && (flags & KFD_IOC_ALLOC_MEM_FLAGS_VRAM)) && -+ interval_tree_iter_first(&p->svms.objects, - args->va_addr >> PAGE_SHIFT, - (args->va_addr + args->size - 1) >> PAGE_SHIFT)) { - pr_err("Address: 0x%llx already allocated by SVM\n", -@@ -2567,8 +2572,8 @@ static int criu_restore(struct file *filep, - pr_debug("CRIU restore (num_devices:%u num_bos:%u num_objects:%u priv_data_size:%llu)\n", - args->num_devices, args->num_bos, args->num_objects, args->priv_data_size); - -- if (!args->bos || !args->devices || !args->priv_data || !args->priv_data_size || -- !args->num_devices || !args->num_bos) -+ if ((args->num_bos > 0 && !args->bos) || !args->devices || !args->priv_data || -+ !args->priv_data_size || !args->num_devices) - return -EINVAL; - - mutex_lock(&p->mutex); -@@ -3252,8 +3257,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg) - int retcode = -EINVAL; - bool ptrace_attached = false; - -- if (nr >= AMDKFD_CORE_IOCTL_COUNT) -+ if (nr >= AMDKFD_CORE_IOCTL_COUNT) { -+ retcode = -ENOTTY; - goto err_i1; -+ } - - if ((nr >= AMDKFD_COMMAND_START) && (nr < AMDKFD_COMMAND_END)) { - u32 amdkfd_size; -@@ -3266,8 +3273,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg) - asize = amdkfd_size; - - cmd = ioctl->cmd; -- } else -+ } else { -+ retcode = -ENOTTY; - goto err_i1; -+ } - - dev_dbg(kfd_device, "ioctl cmd 0x%x (#0x%x), arg 0x%lx\n", cmd, nr, arg); - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c -index 2786d47961e075..6af65db4de9479 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c -@@ -1017,7 +1017,15 @@ void kgd2kfd_interrupt(struct kfd_dev *kfd, const void *ih_ring_entry) - } - - for (i = 0; i < kfd->num_nodes; i++) { -- node = kfd->nodes[i]; -+ /* Race if another thread in b/w -+ * kfd_cleanup_nodes and kfree(kfd), -+ * when kfd->nodes[i] = NULL -+ */ -+ if (kfd->nodes[i]) -+ node = kfd->nodes[i]; -+ else -+ return; -+ - spin_lock_irqsave(&node->interrupt_lock, flags); - - if (node->interrupts_active -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h -index 27c9d5c43765af..b475c2ab9768af 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h -@@ -111,7 +111,14 @@ - - #define KFD_KERNEL_QUEUE_SIZE 2048 - --#define KFD_UNMAP_LATENCY_MS (4000) -+/* KFD_UNMAP_LATENCY_MS is the timeout CP waiting for SDMA preemption. One XCC -+ * can be associated to 2 SDMA engines. queue_preemption_timeout_ms is the time -+ * driver waiting for CP returning the UNMAP_QUEUE fence. Thus the math is -+ * queue_preemption_timeout_ms = sdma_preemption_time * 2 + cp workload -+ * The format here makes CP workload 10% of total timeout -+ */ -+#define KFD_UNMAP_LATENCY_MS \ -+ ((queue_preemption_timeout_ms - queue_preemption_timeout_ms / 10) >> 1) - - #define KFD_MAX_SDMA_QUEUES 128 - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c -index 3168d6fb11e76b..9ba9732f0172ac 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c -@@ -1709,6 +1709,29 @@ static int svm_range_validate_and_map(struct mm_struct *mm, - - next = min(vma->vm_end, end); - npages = (next - addr) >> PAGE_SHIFT; -+ /* HMM requires at least READ permissions. If provided with PROT_NONE, -+ * unmap the memory. If it's not already mapped, this is a no-op -+ * If PROT_WRITE is provided without READ, warn first then unmap -+ */ -+ if (!(vma->vm_flags & VM_READ)) { -+ unsigned long e, s; -+ -+ svm_range_lock(prange); -+ if (vma->vm_flags & VM_WRITE) -+ pr_debug("VM_WRITE without VM_READ is not supported"); -+ s = max(start, prange->start); -+ e = min(end, prange->last); -+ if (e >= s) -+ r = svm_range_unmap_from_gpus(prange, s, e, -+ KFD_SVM_UNMAP_TRIGGER_UNMAP_FROM_CPU); -+ svm_range_unlock(prange); -+ /* If unmap returns non-zero, we'll bail on the next for loop -+ * iteration, so just leave r and continue -+ */ -+ addr = next; -+ continue; -+ } -+ - WRITE_ONCE(p->svms.faulting_task, current); - r = amdgpu_hmm_range_get_pages(&prange->notifier, addr, npages, - readonly, owner, NULL, -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 8421e5f0737bfc..faef07fdfd3027 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -2993,6 +2993,7 @@ static int dm_resume(void *handle) - /* Do mst topology probing after resuming cached state*/ - drm_connector_list_iter_begin(ddev, &iter); - drm_for_each_connector_iter(connector, &iter) { -+ bool init = false; - - if (connector->connector_type == DRM_MODE_CONNECTOR_WRITEBACK) - continue; -@@ -3002,7 +3003,14 @@ static int dm_resume(void *handle) - aconnector->mst_root) - continue; - -- drm_dp_mst_topology_queue_probe(&aconnector->mst_mgr); -+ scoped_guard(mutex, &aconnector->mst_mgr.lock) { -+ init = !aconnector->mst_mgr.mst_primary; -+ } -+ if (init) -+ dm_helpers_dp_mst_start_top_mgr(aconnector->dc_link->ctx, -+ aconnector->dc_link, false); -+ else -+ drm_dp_mst_topology_queue_probe(&aconnector->mst_mgr); - } - drm_connector_list_iter_end(&iter); - -@@ -9243,6 +9251,8 @@ static void get_freesync_config_for_crtc( - } else { - config.state = VRR_STATE_INACTIVE; - } -+ } else { -+ config.state = VRR_STATE_UNSUPPORTED; - } - out: - new_crtc_state->freesync_config = config; -@@ -10838,7 +10848,7 @@ void amdgpu_dm_update_freesync_caps(struct drm_connector *connector, - - dm_con_state = to_dm_connector_state(connector->state); - -- if (!adev->dm.freesync_module) -+ if (!adev->dm.freesync_module || !dc_supports_vrr(sink->ctx->dce_version)) - goto update; - - /* Some eDP panels only have the refresh rate range info in DisplayID */ -diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c -index a5489fe6875f45..086f60e1dd1730 100644 ---- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c -@@ -561,6 +561,7 @@ static void vg_clk_mgr_helper_populate_bw_params( - { - int i, j; - struct clk_bw_params *bw_params = clk_mgr->base.bw_params; -+ uint32_t max_dispclk = 0, max_dppclk = 0; - - j = -1; - -@@ -581,6 +582,15 @@ static void vg_clk_mgr_helper_populate_bw_params( - return; - } - -+ /* dispclk and dppclk can be max at any voltage, same number of levels for both */ -+ if (clock_table->NumDispClkLevelsEnabled <= VG_NUM_DISPCLK_DPM_LEVELS && -+ clock_table->NumDispClkLevelsEnabled <= VG_NUM_DPPCLK_DPM_LEVELS) { -+ max_dispclk = find_max_clk_value(clock_table->DispClocks, clock_table->NumDispClkLevelsEnabled); -+ max_dppclk = find_max_clk_value(clock_table->DppClocks, clock_table->NumDispClkLevelsEnabled); -+ } else { -+ ASSERT(0); -+ } -+ - bw_params->clk_table.num_entries = j + 1; - - for (i = 0; i < bw_params->clk_table.num_entries - 1; i++, j--) { -@@ -588,11 +598,17 @@ static void vg_clk_mgr_helper_populate_bw_params( - bw_params->clk_table.entries[i].memclk_mhz = clock_table->DfPstateTable[j].memclk; - bw_params->clk_table.entries[i].voltage = clock_table->DfPstateTable[j].voltage; - bw_params->clk_table.entries[i].dcfclk_mhz = find_dcfclk_for_voltage(clock_table, clock_table->DfPstateTable[j].voltage); -+ -+ /* Now update clocks we do read */ -+ bw_params->clk_table.entries[i].dispclk_mhz = max_dispclk; -+ bw_params->clk_table.entries[i].dppclk_mhz = max_dppclk; - } - bw_params->clk_table.entries[i].fclk_mhz = clock_table->DfPstateTable[j].fclk; - bw_params->clk_table.entries[i].memclk_mhz = clock_table->DfPstateTable[j].memclk; - bw_params->clk_table.entries[i].voltage = clock_table->DfPstateTable[j].voltage; - bw_params->clk_table.entries[i].dcfclk_mhz = find_max_clk_value(clock_table->DcfClocks, VG_NUM_DCFCLK_DPM_LEVELS); -+ bw_params->clk_table.entries[i].dispclk_mhz = find_max_clk_value(clock_table->DispClocks, VG_NUM_DISPCLK_DPM_LEVELS); -+ bw_params->clk_table.entries[i].dppclk_mhz = find_max_clk_value(clock_table->DppClocks, VG_NUM_DPPCLK_DPM_LEVELS); - - bw_params->vram_type = bios_info->memory_type; - bw_params->num_channels = bios_info->ma_channel_number; -diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c -index 640d010b52bec3..31c53491b83747 100644 ---- a/drivers/gpu/drm/amd/display/dc/core/dc.c -+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c -@@ -2068,6 +2068,18 @@ enum dc_status dc_commit_streams(struct dc *dc, - goto fail; - } - -+ /* -+ * If not already seamless, make transition seamless by inserting intermediate minimal transition -+ */ -+ if (dc->hwss.is_pipe_topology_transition_seamless && -+ !dc->hwss.is_pipe_topology_transition_seamless(dc, dc->current_state, context)) { -+ res = commit_minimal_transition_state(dc, context); -+ if (res != DC_OK) { -+ BREAK_TO_DEBUGGER(); -+ goto fail; -+ } -+ } -+ - res = dc_commit_state_no_check(dc, context); - - for (i = 0; i < stream_count; i++) { -@@ -2940,6 +2952,9 @@ static void copy_stream_update_to_stream(struct dc *dc, - if (update->adaptive_sync_infopacket) - stream->adaptive_sync_infopacket = *update->adaptive_sync_infopacket; - -+ if (update->avi_infopacket) -+ stream->avi_infopacket = *update->avi_infopacket; -+ - if (update->dither_option) - stream->dither_option = *update->dither_option; - -@@ -3146,7 +3161,8 @@ static void commit_planes_do_stream_update(struct dc *dc, - stream_update->vsp_infopacket || - stream_update->hfvsif_infopacket || - stream_update->adaptive_sync_infopacket || -- stream_update->vtem_infopacket) { -+ stream_update->vtem_infopacket || -+ stream_update->avi_infopacket) { - resource_build_info_frame(pipe_ctx); - dc->hwss.update_info_frame(pipe_ctx); - -@@ -4229,6 +4245,7 @@ static bool full_update_required(struct dc *dc, - stream_update->hfvsif_infopacket || - stream_update->vtem_infopacket || - stream_update->adaptive_sync_infopacket || -+ stream_update->avi_infopacket || - stream_update->dpms_off || - stream_update->allow_freesync || - stream_update->vrr_active_variable || -diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -index 2f25f7096c4d63..802c0e19d03b3c 100644 ---- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -@@ -150,7 +150,13 @@ enum dce_version resource_parse_asic_id(struct hw_asic_id asic_id) - - case FAMILY_NV: - dc_version = DCN_VERSION_2_0; -- if (asic_id.chip_id == DEVICE_ID_NV_13FE || asic_id.chip_id == DEVICE_ID_NV_143F) { -+ if (asic_id.chip_id == DEVICE_ID_NV_13FE || -+ asic_id.chip_id == DEVICE_ID_NV_143F || -+ asic_id.chip_id == DEVICE_ID_NV_13F9 || -+ asic_id.chip_id == DEVICE_ID_NV_13FA || -+ asic_id.chip_id == DEVICE_ID_NV_13FB || -+ asic_id.chip_id == DEVICE_ID_NV_13FC || -+ asic_id.chip_id == DEVICE_ID_NV_13DB) { - dc_version = DCN_VERSION_2_01; - break; - } -@@ -3219,8 +3225,14 @@ static void set_avi_info_frame( - unsigned int fr_ind = pipe_ctx->stream->timing.fr_index; - enum dc_timing_3d_format format; - -+ if (stream->avi_infopacket.valid) { -+ *info_packet = stream->avi_infopacket; -+ return; -+ } -+ - memset(&hdmi_info, 0, sizeof(union hdmi_info_packet)); - -+ - color_space = pipe_ctx->stream->output_color_space; - if (color_space == COLOR_SPACE_UNKNOWN) - color_space = (stream->timing.pixel_encoding == PIXEL_ENCODING_RGB) ? -diff --git a/drivers/gpu/drm/amd/display/dc/dc_helper.c b/drivers/gpu/drm/amd/display/dc/dc_helper.c -index 3907eeff560ce7..0713a503f7f6d4 100644 ---- a/drivers/gpu/drm/amd/display/dc/dc_helper.c -+++ b/drivers/gpu/drm/amd/display/dc/dc_helper.c -@@ -744,3 +744,8 @@ char *dce_version_to_string(const int version) - return "Unknown"; - } - } -+ -+bool dc_supports_vrr(const enum dce_version v) -+{ -+ return v >= DCE_VERSION_8_0; -+} -diff --git a/drivers/gpu/drm/amd/display/dc/dc_stream.h b/drivers/gpu/drm/amd/display/dc/dc_stream.h -index d5b3e3a32cc6d4..ad020cc2463764 100644 ---- a/drivers/gpu/drm/amd/display/dc/dc_stream.h -+++ b/drivers/gpu/drm/amd/display/dc/dc_stream.h -@@ -197,6 +197,7 @@ struct dc_stream_state { - struct dc_info_packet hfvsif_infopacket; - struct dc_info_packet vtem_infopacket; - struct dc_info_packet adaptive_sync_infopacket; -+ struct dc_info_packet avi_infopacket; - uint8_t dsc_packed_pps[128]; - struct rect src; /* composition area */ - struct rect dst; /* stream addressable area */ -@@ -323,6 +324,8 @@ struct dc_stream_update { - struct dc_info_packet *hfvsif_infopacket; - struct dc_info_packet *vtem_infopacket; - struct dc_info_packet *adaptive_sync_infopacket; -+ struct dc_info_packet *avi_infopacket; -+ - bool *dpms_off; - bool integer_scaling_update; - bool *allow_freesync; -diff --git a/drivers/gpu/drm/amd/display/dc/dm_services.h b/drivers/gpu/drm/amd/display/dc/dm_services.h -index d0eed3b4771e6f..f2ab2c42781a44 100644 ---- a/drivers/gpu/drm/amd/display/dc/dm_services.h -+++ b/drivers/gpu/drm/amd/display/dc/dm_services.h -@@ -294,4 +294,6 @@ void dm_dtn_log_end(struct dc_context *ctx, - - char *dce_version_to_string(const int version); - -+bool dc_supports_vrr(const enum dce_version v); -+ - #endif /* __DM_SERVICES_H__ */ -diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c -index 6ce90678b33c03..dc7435d5ef4df7 100644 ---- a/drivers/gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c -+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c -@@ -326,7 +326,7 @@ void dcn301_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_param - struct dcn301_resource_pool *pool = TO_DCN301_RES_POOL(dc->res_pool); - struct clk_limit_table *clk_table = &bw_params->clk_table; - unsigned int i, closest_clk_lvl; -- int j; -+ int j = 0, max_dispclk_mhz = 0, max_dppclk_mhz = 0; - - dc_assert_fp_enabled(); - -@@ -338,6 +338,15 @@ void dcn301_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_param - dcn3_01_soc.num_chans = bw_params->num_channels; - - ASSERT(clk_table->num_entries); -+ -+ /* Prepass to find max clocks independent of voltage level. */ -+ for (i = 0; i < clk_table->num_entries; ++i) { -+ if (clk_table->entries[i].dispclk_mhz > max_dispclk_mhz) -+ max_dispclk_mhz = clk_table->entries[i].dispclk_mhz; -+ if (clk_table->entries[i].dppclk_mhz > max_dppclk_mhz) -+ max_dppclk_mhz = clk_table->entries[i].dppclk_mhz; -+ } -+ - for (i = 0; i < clk_table->num_entries; i++) { - /* loop backwards*/ - for (closest_clk_lvl = 0, j = dcn3_01_soc.num_states - 1; j >= 0; j--) { -@@ -353,8 +362,13 @@ void dcn301_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_param - s[i].socclk_mhz = clk_table->entries[i].socclk_mhz; - s[i].dram_speed_mts = clk_table->entries[i].memclk_mhz * 2; - -- s[i].dispclk_mhz = dcn3_01_soc.clock_limits[closest_clk_lvl].dispclk_mhz; -- s[i].dppclk_mhz = dcn3_01_soc.clock_limits[closest_clk_lvl].dppclk_mhz; -+ /* Clocks independent of voltage level. */ -+ s[i].dispclk_mhz = max_dispclk_mhz ? max_dispclk_mhz : -+ dcn3_01_soc.clock_limits[closest_clk_lvl].dispclk_mhz; -+ -+ s[i].dppclk_mhz = max_dppclk_mhz ? max_dppclk_mhz : -+ dcn3_01_soc.clock_limits[closest_clk_lvl].dppclk_mhz; -+ - s[i].dram_bw_per_chan_gbps = - dcn3_01_soc.clock_limits[closest_clk_lvl].dram_bw_per_chan_gbps; - s[i].dscclk_mhz = dcn3_01_soc.clock_limits[closest_clk_lvl].dscclk_mhz; -diff --git a/drivers/gpu/drm/amd/display/dc/link/link_detection.c b/drivers/gpu/drm/amd/display/dc/link/link_detection.c -index c7a9e286a5d4d3..2d98f539a100ae 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/link_detection.c -+++ b/drivers/gpu/drm/amd/display/dc/link/link_detection.c -@@ -1113,6 +1113,11 @@ static bool detect_link_and_local_sink(struct dc_link *link, - if (sink->sink_signal == SIGNAL_TYPE_HDMI_TYPE_A && - !sink->edid_caps.edid_hdmi) - sink->sink_signal = SIGNAL_TYPE_DVI_SINGLE_LINK; -+ else if (dc_is_dvi_signal(sink->sink_signal) && -+ dc_is_dvi_signal(link->connector_signal) && -+ aud_support->hdmi_audio_native && -+ sink->edid_caps.edid_hdmi) -+ sink->sink_signal = SIGNAL_TYPE_HDMI_TYPE_A; - - if (link->local_sink && dc_is_dp_signal(sink_caps.signal)) - dp_trace_init(link); -diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c -index 51e88efee11e4a..08c2f117241407 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c -+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c -@@ -974,14 +974,19 @@ void repeater_training_done(struct dc_link *link, uint32_t offset) - static void dpcd_exit_training_mode(struct dc_link *link, enum dp_link_encoding encoding) - { - uint8_t sink_status = 0; -- uint8_t i; -+ uint32_t i; -+ uint8_t lttpr_count = dp_parse_lttpr_repeater_count(link->dpcd_caps.lttpr_caps.phy_repeater_cnt); -+ uint32_t intra_hop_disable_time_ms = (lttpr_count > 0 ? lttpr_count * 300 : 10); -+ -+ // Each hop could theoretically take over 256ms (max 128b/132b AUX RD INTERVAL) -+ // To be safe, allow 300ms per LTTPR and 10ms for no LTTPR case - - /* clear training pattern set */ - dpcd_set_training_pattern(link, DP_TRAINING_PATTERN_VIDEOIDLE); - - if (encoding == DP_128b_132b_ENCODING) { - /* poll for intra-hop disable */ -- for (i = 0; i < 10; i++) { -+ for (i = 0; i < intra_hop_disable_time_ms; i++) { - if ((core_link_read_dpcd(link, DP_SINK_STATUS, &sink_status, 1) == DC_OK) && - (sink_status & DP_INTRA_HOP_AUX_REPLY_INDICATION) == 0) - break; -diff --git a/drivers/gpu/drm/amd/display/include/dal_asic_id.h b/drivers/gpu/drm/amd/display/include/dal_asic_id.h -index e317089cf6ee7f..b913d08a5e0380 100644 ---- a/drivers/gpu/drm/amd/display/include/dal_asic_id.h -+++ b/drivers/gpu/drm/amd/display/include/dal_asic_id.h -@@ -213,6 +213,11 @@ enum { - #endif - #define DEVICE_ID_NV_13FE 0x13FE // CYAN_SKILLFISH - #define DEVICE_ID_NV_143F 0x143F -+#define DEVICE_ID_NV_13F9 0x13F9 -+#define DEVICE_ID_NV_13FA 0x13FA -+#define DEVICE_ID_NV_13FB 0x13FB -+#define DEVICE_ID_NV_13FC 0x13FC -+#define DEVICE_ID_NV_13DB 0x13DB - #define FAMILY_VGH 144 - #define DEVICE_ID_VGH_163F 0x163F - #define DEVICE_ID_VGH_1435 0x1435 -diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c -index 2863dc65ffc6fb..e5f68b2b8def3b 100644 ---- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c -+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c -@@ -3485,6 +3485,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, - * for these GPUs to calculate bandwidth requirements. - */ - if (high_pixelclock_count) { -+ /* Work around flickering lines at the bottom edge -+ * of the screen when using a single 4K 60Hz monitor. -+ */ -+ disable_mclk_switching = true; -+ - /* On Oland, we observe some flickering when two 4K 60Hz - * displays are connected, possibly because voltage is too low. - * Raise the voltage by requiring a higher SCLK. -diff --git a/drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c b/drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c -index 5e43ad2b295641..e7e497b166b3eb 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c -@@ -2024,7 +2024,7 @@ static int fiji_init_smc_table(struct pp_hwmgr *hwmgr) - table->VoltageResponseTime = 0; - table->PhaseResponseTime = 0; - table->MemoryThermThrottleEnable = 1; -- table->PCIeBootLinkLevel = 0; /* 0:Gen1 1:Gen2 2:Gen3*/ -+ table->PCIeBootLinkLevel = (uint8_t) (data->dpm_table.pcie_speed_table.count); - table->PCIeGenInterval = 1; - table->VRConfig = 0; - -diff --git a/drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c b/drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c -index 97d9802fe6731f..43458f1b0077dd 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c -@@ -2028,7 +2028,7 @@ static int iceland_init_smc_table(struct pp_hwmgr *hwmgr) - table->VoltageResponseTime = 0; - table->PhaseResponseTime = 0; - table->MemoryThermThrottleEnable = 1; -- table->PCIeBootLinkLevel = 0; -+ table->PCIeBootLinkLevel = (uint8_t) (data->dpm_table.pcie_speed_table.count); - table->PCIeGenInterval = 1; - - result = iceland_populate_smc_svi2_config(hwmgr, table); -diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c -index 0cdf3257b19b3b..a47898487de09b 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c -@@ -2376,7 +2376,7 @@ static ssize_t arcturus_get_gpu_metrics(struct smu_context *smu, - - ret = smu_cmn_get_metrics_table(smu, - &metrics, -- true); -+ false); - if (ret) - return ret; - -diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c -index b2256178014990..d1fd643e7a48c8 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c -@@ -1737,7 +1737,7 @@ static ssize_t aldebaran_get_gpu_metrics(struct smu_context *smu, - - ret = smu_cmn_get_metrics_table(smu, - &metrics, -- true); -+ false); - if (ret) - return ret; - -diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c -index c1962f1974c6fe..2c9612b5f15689 100644 ---- a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c -+++ b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c -@@ -870,7 +870,7 @@ int smu_cmn_update_table(struct smu_context *smu, - table_index); - uint32_t table_size; - int ret = 0; -- if (!table_data || table_id >= SMU_TABLE_COUNT || table_id < 0) -+ if (!table_data || table_index >= SMU_TABLE_COUNT || table_id < 0) - return -EINVAL; - - table_size = smu_table->tables[table_index].size; -diff --git a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c -index 89eed0668bfb24..ddfbb2009c8d38 100644 ---- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c -+++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c -@@ -833,7 +833,13 @@ static void cdns_dsi_bridge_enable(struct drm_bridge *bridge) - - tx_byte_period = DIV_ROUND_DOWN_ULL((u64)NSEC_PER_SEC * 8, - phy_cfg->hs_clk_rate); -- reg_wakeup = (phy_cfg->hs_prepare + phy_cfg->hs_zero) / tx_byte_period; -+ -+ /* -+ * Estimated time [in clock cycles] to perform LP->HS on D-PHY. -+ * It is not clear how to calculate this, so for now, -+ * set it to 1/10 of the total number of clocks in a line. -+ */ -+ reg_wakeup = dsi_cfg.htotal / nlanes / 10; - writel(REG_WAKEUP_TIME(reg_wakeup) | REG_LINE_DURATION(tmp), - dsi->regs + VID_DPHY_TIME); - -@@ -953,10 +959,6 @@ static int cdns_dsi_attach(struct mipi_dsi_host *host, - if (output->dev) - return -EBUSY; - -- /* We do not support burst mode yet. */ -- if (dev->mode_flags & MIPI_DSI_MODE_VIDEO_BURST) -- return -ENOTSUPP; -- - /* - * The host <-> device link might be described using an OF-graph - * representation, in this case we extract the device of_node from -diff --git a/drivers/gpu/drm/bridge/display-connector.c b/drivers/gpu/drm/bridge/display-connector.c -index 08bd5695ddae0f..0f3714aae60891 100644 ---- a/drivers/gpu/drm/bridge/display-connector.c -+++ b/drivers/gpu/drm/bridge/display-connector.c -@@ -363,7 +363,8 @@ static int display_connector_probe(struct platform_device *pdev) - if (conn->bridge.ddc) - conn->bridge.ops |= DRM_BRIDGE_OP_EDID - | DRM_BRIDGE_OP_DETECT; -- if (conn->hpd_gpio) -+ /* Detecting the monitor requires reading DPCD */ -+ if (conn->hpd_gpio && type != DRM_MODE_CONNECTOR_DisplayPort) - conn->bridge.ops |= DRM_BRIDGE_OP_DETECT; - if (conn->hpd_irq >= 0) - conn->bridge.ops |= DRM_BRIDGE_OP_HPD; -diff --git a/drivers/gpu/drm/drm_gem_atomic_helper.c b/drivers/gpu/drm/drm_gem_atomic_helper.c -index 5d4b9cd077f7a6..e0ea3c661cb778 100644 ---- a/drivers/gpu/drm/drm_gem_atomic_helper.c -+++ b/drivers/gpu/drm/drm_gem_atomic_helper.c -@@ -301,7 +301,11 @@ EXPORT_SYMBOL(drm_gem_destroy_shadow_plane_state); - void __drm_gem_reset_shadow_plane(struct drm_plane *plane, - struct drm_shadow_plane_state *shadow_plane_state) - { -- __drm_atomic_helper_plane_reset(plane, &shadow_plane_state->base); -+ if (shadow_plane_state) { -+ __drm_atomic_helper_plane_reset(plane, &shadow_plane_state->base); -+ } else { -+ __drm_atomic_helper_plane_reset(plane, NULL); -+ } - } - EXPORT_SYMBOL(__drm_gem_reset_shadow_plane); - -diff --git a/drivers/gpu/drm/etnaviv/etnaviv_buffer.c b/drivers/gpu/drm/etnaviv/etnaviv_buffer.c -index b13a17276d07cd..88385dc3b30d85 100644 ---- a/drivers/gpu/drm/etnaviv/etnaviv_buffer.c -+++ b/drivers/gpu/drm/etnaviv/etnaviv_buffer.c -@@ -347,7 +347,7 @@ void etnaviv_buffer_queue(struct etnaviv_gpu *gpu, u32 exec_state, - u32 link_target, link_dwords; - bool switch_context = gpu->exec_state != exec_state; - bool switch_mmu_context = gpu->mmu_context != mmu_context; -- unsigned int new_flush_seq = READ_ONCE(gpu->mmu_context->flush_seq); -+ unsigned int new_flush_seq = READ_ONCE(mmu_context->flush_seq); - bool need_flush = switch_mmu_context || gpu->flush_seq != new_flush_seq; - bool has_blt = !!(gpu->identity.minor_features5 & - chipMinorFeatures5_BLT_ENGINE); -diff --git a/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c b/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c -index 7c9be4fd1c8c44..7a950c1502b6e6 100644 ---- a/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c -+++ b/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c -@@ -208,7 +208,7 @@ static u64 div_u64_roundup(u64 nom, u32 den) - - u64 intel_gt_clock_interval_to_ns(const struct intel_gt *gt, u64 count) - { -- return div_u64_roundup(count * NSEC_PER_SEC, gt->clock_frequency); -+ return mul_u64_u32_div(count, NSEC_PER_SEC, gt->clock_frequency); - } - - u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count) -@@ -218,7 +218,7 @@ u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count) - - u64 intel_gt_ns_to_clock_interval(const struct intel_gt *gt, u64 ns) - { -- return div_u64_roundup(gt->clock_frequency * ns, NSEC_PER_SEC); -+ return mul_u64_u32_div(ns, gt->clock_frequency, NSEC_PER_SEC); - } - - u64 intel_gt_ns_to_pm_interval(const struct intel_gt *gt, u64 ns) -diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c -index 46e4a45e3c72ae..772594360d57e0 100644 ---- a/drivers/gpu/drm/i915/i915_vma.c -+++ b/drivers/gpu/drm/i915/i915_vma.c -@@ -1586,8 +1586,20 @@ int i915_vma_pin_ww(struct i915_vma *vma, struct i915_gem_ww_ctx *ww, - err_vma_res: - i915_vma_resource_free(vma_res); - err_fence: -- if (work) -- dma_fence_work_commit_imm(&work->base); -+ if (work) { -+ /* -+ * When pinning VMA to GGTT on CHV or BXT with VTD enabled, -+ * commit VMA binding asynchronously to avoid risk of lock -+ * inversion among reservation_ww locks held here and -+ * cpu_hotplug_lock acquired from stop_machine(), which we -+ * wrap around GGTT updates when running in those environments. -+ */ -+ if (i915_vma_is_ggtt(vma) && -+ intel_vm_no_concurrent_access_wa(vma->vm->i915)) -+ dma_fence_work_commit(&work->base); -+ else -+ dma_fence_work_commit_imm(&work->base); -+ } - err_rpm: - intel_runtime_pm_put(&vma->vm->i915->runtime_pm, wakeref); - -diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c -index f1f73c1e7b5cbf..83dcc475769b1e 100644 ---- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c -+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c -@@ -655,10 +655,6 @@ static int mtk_drm_bind(struct device *dev) - for (i = 0; i < private->data->mmsys_dev_num; i++) - private->all_drm_private[i]->drm = NULL; - err_put_dev: -- for (i = 0; i < private->data->mmsys_dev_num; i++) { -- /* For device_find_child in mtk_drm_get_all_priv() */ -- put_device(private->all_drm_private[i]->dev); -- } - put_device(private->mutex_dev); - return ret; - } -@@ -666,18 +662,12 @@ static int mtk_drm_bind(struct device *dev) - static void mtk_drm_unbind(struct device *dev) - { - struct mtk_drm_private *private = dev_get_drvdata(dev); -- int i; - - /* for multi mmsys dev, unregister drm dev in mmsys master */ - if (private->drm_master) { - drm_dev_unregister(private->drm); - mtk_drm_kms_deinit(private->drm); - drm_dev_put(private->drm); -- -- for (i = 0; i < private->data->mmsys_dev_num; i++) { -- /* For device_find_child in mtk_drm_get_all_priv() */ -- put_device(private->all_drm_private[i]->dev); -- } - put_device(private->mutex_dev); - } - private->mtk_drm_bound = false; -diff --git a/drivers/gpu/drm/mediatek/mtk_drm_plane.c b/drivers/gpu/drm/mediatek/mtk_drm_plane.c -index f10d4cc6c2234f..32038cff273083 100644 ---- a/drivers/gpu/drm/mediatek/mtk_drm_plane.c -+++ b/drivers/gpu/drm/mediatek/mtk_drm_plane.c -@@ -21,9 +21,6 @@ - - static const u64 modifiers[] = { - DRM_FORMAT_MOD_LINEAR, -- DRM_FORMAT_MOD_ARM_AFBC(AFBC_FORMAT_MOD_BLOCK_SIZE_32x8 | -- AFBC_FORMAT_MOD_SPLIT | -- AFBC_FORMAT_MOD_SPARSE), - DRM_FORMAT_MOD_INVALID, - }; - -@@ -71,26 +68,7 @@ static bool mtk_plane_format_mod_supported(struct drm_plane *plane, - uint32_t format, - uint64_t modifier) - { -- if (modifier == DRM_FORMAT_MOD_LINEAR) -- return true; -- -- if (modifier != DRM_FORMAT_MOD_ARM_AFBC( -- AFBC_FORMAT_MOD_BLOCK_SIZE_32x8 | -- AFBC_FORMAT_MOD_SPLIT | -- AFBC_FORMAT_MOD_SPARSE)) -- return false; -- -- if (format != DRM_FORMAT_XRGB8888 && -- format != DRM_FORMAT_ARGB8888 && -- format != DRM_FORMAT_BGRX8888 && -- format != DRM_FORMAT_BGRA8888 && -- format != DRM_FORMAT_ABGR8888 && -- format != DRM_FORMAT_XBGR8888 && -- format != DRM_FORMAT_RGB888 && -- format != DRM_FORMAT_BGR888) -- return false; -- -- return true; -+ return modifier == DRM_FORMAT_MOD_LINEAR; - } - - static void mtk_drm_plane_destroy_state(struct drm_plane *plane, -diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c -index c50aafa0ecdb61..e816ddcac2f8d5 100644 ---- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c -+++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c -@@ -693,6 +693,9 @@ static bool fw_block_mem(struct a6xx_gmu_bo *bo, const struct block_header *blk) - return true; - } - -+#define NEXT_BLK(blk) \ -+ ((const struct block_header *)((const char *)(blk) + sizeof(*(blk)) + (blk)->size)) -+ - static int a6xx_gmu_fw_load(struct a6xx_gmu *gmu) - { - struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu); -@@ -723,7 +726,7 @@ static int a6xx_gmu_fw_load(struct a6xx_gmu *gmu) - - for (blk = (const struct block_header *) fw_image->data; - (const u8*) blk < fw_image->data + fw_image->size; -- blk = (const struct block_header *) &blk->data[blk->size >> 2]) { -+ blk = NEXT_BLK(blk)) { - if (blk->size == 0) - continue; - -diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c -index 00bfc6f38f459d..4654c0f362c7de 100644 ---- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c -+++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c -@@ -1702,6 +1702,9 @@ static void a6xx_fault_detect_irq(struct msm_gpu *gpu) - /* Turn off the hangcheck timer to keep it from bothering us */ - del_timer(&gpu->hangcheck_timer); - -+ /* Turn off interrupts to avoid triggering recovery again */ -+ gpu_write(gpu, REG_A6XX_RBBM_INT_0_MASK, 0); -+ - kthread_queue_work(gpu->worker, &gpu->recover_work); - } - -diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c -index f72ce6a3c456d5..bed9867ced6d4e 100644 ---- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c -+++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c -@@ -445,6 +445,10 @@ static int dsi_pll_7nm_vco_prepare(struct clk_hw *hw) - if (pll_7nm->slave) - dsi_pll_enable_global_clk(pll_7nm->slave); - -+ writel(0x1, pll_7nm->phy->base + REG_DSI_7nm_PHY_CMN_RBUF_CTRL); -+ if (pll_7nm->slave) -+ writel(0x1, pll_7nm->slave->phy->base + REG_DSI_7nm_PHY_CMN_RBUF_CTRL); -+ - error: - return rc; - } -@@ -793,6 +797,12 @@ static int dsi_pll_7nm_init(struct msm_dsi_phy *phy) - - /* TODO: Remove this when we have proper display handover support */ - msm_dsi_phy_pll_save_state(phy); -+ /* -+ * Store also proper vco_current_rate, because its value will be used in -+ * dsi_7nm_pll_restore_state(). -+ */ -+ if (!dsi_pll_7nm_vco_recalc_rate(&pll_7nm->clk_hw, VCO_REF_CLK_RATE)) -+ pll_7nm->vco_current_rate = pll_7nm->phy->cfg->min_pll_rate; - - return 0; - } -diff --git a/drivers/gpu/drm/nouveau/nvkm/core/enum.c b/drivers/gpu/drm/nouveau/nvkm/core/enum.c -index b9581feb24ccb7..a23b40b27b81bc 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/core/enum.c -+++ b/drivers/gpu/drm/nouveau/nvkm/core/enum.c -@@ -44,7 +44,7 @@ nvkm_snprintbf(char *data, int size, const struct nvkm_bitfield *bf, u32 value) - bool space = false; - while (size >= 1 && bf->name) { - if (value & bf->mask) { -- int this = snprintf(data, size, "%s%s", -+ int this = scnprintf(data, size, "%s%s", - space ? " " : "", bf->name); - size -= this; - data += this; -diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c -index 245a1ef5278e88..6855fbb7e6a3bd 100644 ---- a/drivers/gpu/drm/scheduler/sched_entity.c -+++ b/drivers/gpu/drm/scheduler/sched_entity.c -@@ -163,26 +163,15 @@ int drm_sched_entity_error(struct drm_sched_entity *entity) - } - EXPORT_SYMBOL(drm_sched_entity_error); - -+static void drm_sched_entity_kill_jobs_cb(struct dma_fence *f, -+ struct dma_fence_cb *cb); -+ - static void drm_sched_entity_kill_jobs_work(struct work_struct *wrk) - { - struct drm_sched_job *job = container_of(wrk, typeof(*job), work); -- -- drm_sched_fence_scheduled(job->s_fence, NULL); -- drm_sched_fence_finished(job->s_fence, -ESRCH); -- WARN_ON(job->s_fence->parent); -- job->sched->ops->free_job(job); --} -- --/* Signal the scheduler finished fence when the entity in question is killed. */ --static void drm_sched_entity_kill_jobs_cb(struct dma_fence *f, -- struct dma_fence_cb *cb) --{ -- struct drm_sched_job *job = container_of(cb, struct drm_sched_job, -- finish_cb); -+ struct dma_fence *f; - unsigned long index; - -- dma_fence_put(f); -- - /* Wait for all dependencies to avoid data corruptions */ - xa_for_each(&job->dependencies, index, f) { - struct drm_sched_fence *s_fence = to_drm_sched_fence(f); -@@ -210,6 +199,21 @@ static void drm_sched_entity_kill_jobs_cb(struct dma_fence *f, - dma_fence_put(f); - } - -+ drm_sched_fence_scheduled(job->s_fence, NULL); -+ drm_sched_fence_finished(job->s_fence, -ESRCH); -+ WARN_ON(job->s_fence->parent); -+ job->sched->ops->free_job(job); -+} -+ -+/* Signal the scheduler finished fence when the entity in question is killed. */ -+static void drm_sched_entity_kill_jobs_cb(struct dma_fence *f, -+ struct dma_fence_cb *cb) -+{ -+ struct drm_sched_job *job = container_of(cb, struct drm_sched_job, -+ finish_cb); -+ -+ dma_fence_put(f); -+ - INIT_WORK(&job->work, drm_sched_entity_kill_jobs_work); - schedule_work(&job->work); - } -@@ -531,10 +535,11 @@ void drm_sched_entity_select_rq(struct drm_sched_entity *entity) - drm_sched_rq_remove_entity(entity->rq, entity); - entity->rq = rq; - } -- spin_unlock(&entity->rq_lock); - - if (entity->num_sched_list == 1) - entity->sched_list = NULL; -+ -+ spin_unlock(&entity->rq_lock); - } - - /** -diff --git a/drivers/gpu/drm/tidss/tidss_crtc.c b/drivers/gpu/drm/tidss/tidss_crtc.c -index 1baa4ace12e150..356b7566013b1b 100644 ---- a/drivers/gpu/drm/tidss/tidss_crtc.c -+++ b/drivers/gpu/drm/tidss/tidss_crtc.c -@@ -91,7 +91,7 @@ static int tidss_crtc_atomic_check(struct drm_crtc *crtc, - struct dispc_device *dispc = tidss->dispc; - struct tidss_crtc *tcrtc = to_tidss_crtc(crtc); - u32 hw_videoport = tcrtc->hw_videoport; -- const struct drm_display_mode *mode; -+ struct drm_display_mode *mode; - enum drm_mode_status ok; - - dev_dbg(ddev->dev, "%s\n", __func__); -@@ -108,6 +108,9 @@ static int tidss_crtc_atomic_check(struct drm_crtc *crtc, - return -EINVAL; - } - -+ if (drm_atomic_crtc_needs_modeset(crtc_state)) -+ drm_mode_set_crtcinfo(mode, 0); -+ - return dispc_vp_bus_check(dispc, hw_videoport, crtc_state); - } - -@@ -229,7 +232,7 @@ static void tidss_crtc_atomic_enable(struct drm_crtc *crtc, - tidss_runtime_get(tidss); - - r = dispc_vp_set_clk_rate(tidss->dispc, tcrtc->hw_videoport, -- mode->clock * 1000); -+ mode->crtc_clock * 1000); - if (r != 0) - return; - -diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c -index 355c64bafb82b8..8a702f4059b952 100644 ---- a/drivers/gpu/drm/tidss/tidss_dispc.c -+++ b/drivers/gpu/drm/tidss/tidss_dispc.c -@@ -1030,13 +1030,13 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport, - - dispc_set_num_datalines(dispc, hw_videoport, fmt->data_width); - -- hfp = mode->hsync_start - mode->hdisplay; -- hsw = mode->hsync_end - mode->hsync_start; -- hbp = mode->htotal - mode->hsync_end; -+ hfp = mode->crtc_hsync_start - mode->crtc_hdisplay; -+ hsw = mode->crtc_hsync_end - mode->crtc_hsync_start; -+ hbp = mode->crtc_htotal - mode->crtc_hsync_end; - -- vfp = mode->vsync_start - mode->vdisplay; -- vsw = mode->vsync_end - mode->vsync_start; -- vbp = mode->vtotal - mode->vsync_end; -+ vfp = mode->crtc_vsync_start - mode->crtc_vdisplay; -+ vsw = mode->crtc_vsync_end - mode->crtc_vsync_start; -+ vbp = mode->crtc_vtotal - mode->crtc_vsync_end; - - dispc_vp_write(dispc, hw_videoport, DISPC_VP_TIMING_H, - FLD_VAL(hsw - 1, 7, 0) | -@@ -1078,8 +1078,8 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport, - FLD_VAL(ivs, 12, 12)); - - dispc_vp_write(dispc, hw_videoport, DISPC_VP_SIZE_SCREEN, -- FLD_VAL(mode->hdisplay - 1, 11, 0) | -- FLD_VAL(mode->vdisplay - 1, 27, 16)); -+ FLD_VAL(mode->crtc_hdisplay - 1, 11, 0) | -+ FLD_VAL(mode->crtc_vdisplay - 1, 27, 16)); - - VP_REG_FLD_MOD(dispc, hw_videoport, DISPC_VP_CONTROL, 1, 0, 0); - } -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -index b235e7cc41f3f8..92b3e44d022fea 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -@@ -3683,6 +3683,11 @@ static int vmw_cmd_check(struct vmw_private *dev_priv, - - - cmd_id = header->id; -+ if (header->size > SVGA_CMD_MAX_DATASIZE) { -+ VMW_DEBUG_USER("SVGA3D command: %d is too big.\n", -+ cmd_id + SVGA_3D_CMD_BASE); -+ return -E2BIG; -+ } - *size = header->size + sizeof(SVGA3dCmdHeader); - - cmd_id -= SVGA_3D_CMD_BASE; -diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c -index a8d440f6e804fb..d971e339b5eac7 100644 ---- a/drivers/hid/hid-asus.c -+++ b/drivers/hid/hid-asus.c -@@ -1282,9 +1282,6 @@ static const struct hid_device_id asus_devices[] = { - { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, - USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD2), - QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD }, -- { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, -- USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD3), -- QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD }, - { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, - USB_DEVICE_ID_ASUSTEK_ROG_Z13_LIGHTBAR), - QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD }, -@@ -1314,6 +1311,9 @@ static const struct hid_device_id asus_devices[] = { - * Note bind to the HID_GROUP_GENERIC group, so that we only bind to the keyboard - * part, while letting hid-multitouch.c handle the touchpad. - */ -+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, -+ USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_ROG_Z13_FOLIO), -+ QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD }, - { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, - USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_T101HA_KEYBOARD) }, - { } -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index 3f74633070b6ec..fbbab353f040a8 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -213,7 +213,7 @@ - #define USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD3 0x1822 - #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD 0x1866 - #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD2 0x19b6 --#define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD3 0x1a30 -+#define USB_DEVICE_ID_ASUSTEK_ROG_Z13_FOLIO 0x1a30 - #define USB_DEVICE_ID_ASUSTEK_ROG_Z13_LIGHTBAR 0x18c6 - #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY 0x1abe - #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X 0x1b4c -@@ -332,6 +332,9 @@ - #define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500 - #define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff - -+#define USB_VENDOR_ID_COOLER_MASTER 0x2516 -+#define USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE 0x01b7 -+ - #define USB_VENDOR_ID_CORSAIR 0x1b1c - #define USB_DEVICE_ID_CORSAIR_K90 0x1b02 - #define USB_DEVICE_ID_CORSAIR_K70R 0x1b09 -@@ -1400,6 +1403,7 @@ - - #define USB_VENDOR_ID_VRS 0x0483 - #define USB_DEVICE_ID_VRS_DFP 0xa355 -+#define USB_DEVICE_ID_VRS_R295 0xa44c - - #define USB_VENDOR_ID_VTL 0x0306 - #define USB_DEVICE_ID_VTL_MULTITOUCH_FF3F 0xff3f -diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c -index a1128c5315fffa..3c41f6841f7753 100644 ---- a/drivers/hid/hid-ntrig.c -+++ b/drivers/hid/hid-ntrig.c -@@ -142,13 +142,13 @@ static void ntrig_report_version(struct hid_device *hdev) - int ret; - char buf[20]; - struct usb_device *usb_dev = hid_to_usb_dev(hdev); -- unsigned char *data = kmalloc(8, GFP_KERNEL); -+ unsigned char *data __free(kfree) = kmalloc(8, GFP_KERNEL); - - if (!hid_is_usb(hdev)) - return; - - if (!data) -- goto err_free; -+ return; - - ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0), - USB_REQ_CLEAR_FEATURE, -@@ -163,9 +163,6 @@ static void ntrig_report_version(struct hid_device *hdev) - hid_info(hdev, "Firmware version: %s (%02x%02x %02x%02x)\n", - buf, data[2], data[3], data[4], data[5]); - } -- --err_free: -- kfree(data); - } - - static ssize_t show_phys_width(struct device *dev, -diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c -index 64f9728018b885..75480ec3c15a2d 100644 ---- a/drivers/hid/hid-quirks.c -+++ b/drivers/hid/hid-quirks.c -@@ -57,6 +57,7 @@ static const struct hid_device_id hid_quirks[] = { - { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET }, - { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET }, - { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_COOLER_MASTER, USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE), HID_QUIRK_ALWAYS_POLL }, - { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS }, - { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL }, - { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS }, -@@ -206,6 +207,7 @@ static const struct hid_device_id hid_quirks[] = { - { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5), HID_QUIRK_MULTI_INPUT }, - { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWA60), HID_QUIRK_MULTI_INPUT }, - { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_WP5540), HID_QUIRK_MULTI_INPUT }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_VRS, USB_DEVICE_ID_VRS_R295), HID_QUIRK_ALWAYS_POLL }, - { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_10_6_INCH), HID_QUIRK_MULTI_INPUT }, - { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_14_1_INCH), HID_QUIRK_MULTI_INPUT }, - { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET), HID_QUIRK_MULTI_INPUT }, -diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c -index 9859dad36495ad..eee05d668e361d 100644 ---- a/drivers/hid/hid-uclogic-params.c -+++ b/drivers/hid/hid-uclogic-params.c -@@ -1364,8 +1364,10 @@ static int uclogic_params_ugee_v2_init_event_hooks(struct hid_device *hdev, - event_hook->hdev = hdev; - event_hook->size = ARRAY_SIZE(reconnect_event); - event_hook->event = kmemdup(reconnect_event, event_hook->size, GFP_KERNEL); -- if (!event_hook->event) -+ if (!event_hook->event) { -+ kfree(event_hook); - return -ENOMEM; -+ } - - list_add_tail(&event_hook->list, &p->event_hooks->list); - -diff --git a/drivers/hid/i2c-hid/i2c-hid-acpi.c b/drivers/hid/i2c-hid/i2c-hid-acpi.c -index 1b49243adb16a5..abd700a101f46c 100644 ---- a/drivers/hid/i2c-hid/i2c-hid-acpi.c -+++ b/drivers/hid/i2c-hid/i2c-hid-acpi.c -@@ -76,6 +76,13 @@ static int i2c_hid_acpi_get_descriptor(struct i2c_hid_acpi *ihid_acpi) - return hid_descriptor_address; - } - -+static void i2c_hid_acpi_restore_sequence(struct i2chid_ops *ops) -+{ -+ struct i2c_hid_acpi *ihid_acpi = container_of(ops, struct i2c_hid_acpi, ops); -+ -+ i2c_hid_acpi_get_descriptor(ihid_acpi); -+} -+ - static void i2c_hid_acpi_shutdown_tail(struct i2chid_ops *ops) - { - struct i2c_hid_acpi *ihid_acpi = container_of(ops, struct i2c_hid_acpi, ops); -@@ -96,6 +103,7 @@ static int i2c_hid_acpi_probe(struct i2c_client *client) - - ihid_acpi->adev = ACPI_COMPANION(dev); - ihid_acpi->ops.shutdown_tail = i2c_hid_acpi_shutdown_tail; -+ ihid_acpi->ops.restore_sequence = i2c_hid_acpi_restore_sequence; - - ret = i2c_hid_acpi_get_descriptor(ihid_acpi); - if (ret < 0) -diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c -index 3dcdd3368b463e..172b783274201b 100644 ---- a/drivers/hid/i2c-hid/i2c-hid-core.c -+++ b/drivers/hid/i2c-hid/i2c-hid-core.c -@@ -937,6 +937,14 @@ static void i2c_hid_core_shutdown_tail(struct i2c_hid *ihid) - ihid->ops->shutdown_tail(ihid->ops); - } - -+static void i2c_hid_core_restore_sequence(struct i2c_hid *ihid) -+{ -+ if (!ihid->ops->restore_sequence) -+ return; -+ -+ ihid->ops->restore_sequence(ihid->ops); -+} -+ - static int i2c_hid_core_suspend(struct i2c_hid *ihid, bool force_poweroff) - { - struct i2c_client *client = ihid->client; -@@ -1320,8 +1328,26 @@ static int i2c_hid_core_pm_resume(struct device *dev) - return i2c_hid_core_resume(ihid); - } - -+static int i2c_hid_core_pm_restore(struct device *dev) -+{ -+ struct i2c_client *client = to_i2c_client(dev); -+ struct i2c_hid *ihid = i2c_get_clientdata(client); -+ -+ if (ihid->is_panel_follower) -+ return 0; -+ -+ i2c_hid_core_restore_sequence(ihid); -+ -+ return i2c_hid_core_resume(ihid); -+} -+ - const struct dev_pm_ops i2c_hid_core_pm = { -- SYSTEM_SLEEP_PM_OPS(i2c_hid_core_pm_suspend, i2c_hid_core_pm_resume) -+ .suspend = pm_sleep_ptr(i2c_hid_core_pm_suspend), -+ .resume = pm_sleep_ptr(i2c_hid_core_pm_resume), -+ .freeze = pm_sleep_ptr(i2c_hid_core_pm_suspend), -+ .thaw = pm_sleep_ptr(i2c_hid_core_pm_resume), -+ .poweroff = pm_sleep_ptr(i2c_hid_core_pm_suspend), -+ .restore = pm_sleep_ptr(i2c_hid_core_pm_restore), - }; - EXPORT_SYMBOL_GPL(i2c_hid_core_pm); - -diff --git a/drivers/hid/i2c-hid/i2c-hid.h b/drivers/hid/i2c-hid/i2c-hid.h -index 2c7b66d5caa0f9..1724a435c783aa 100644 ---- a/drivers/hid/i2c-hid/i2c-hid.h -+++ b/drivers/hid/i2c-hid/i2c-hid.h -@@ -27,11 +27,13 @@ static inline u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product) - * @power_up: do sequencing to power up the device. - * @power_down: do sequencing to power down the device. - * @shutdown_tail: called at the end of shutdown. -+ * @restore_sequence: hibernation restore sequence. - */ - struct i2chid_ops { - int (*power_up)(struct i2chid_ops *ops); - void (*power_down)(struct i2chid_ops *ops); - void (*shutdown_tail)(struct i2chid_ops *ops); -+ void (*restore_sequence)(struct i2chid_ops *ops); - }; - - int i2c_hid_core_probe(struct i2c_client *client, struct i2chid_ops *ops, -diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c -index ce2f14a62754ee..bc2197f1dfb7f5 100644 ---- a/drivers/hwmon/asus-ec-sensors.c -+++ b/drivers/hwmon/asus-ec-sensors.c -@@ -49,7 +49,7 @@ static char *mutex_path_override; - */ - #define ASUS_EC_MAX_BANK 3 - --#define ACPI_LOCK_DELAY_MS 500 -+#define ACPI_LOCK_DELAY_MS 800 - - /* ACPI mutex for locking access to the EC for the firmware */ - #define ASUS_HW_ACCESS_MUTEX_ASMX "\\AMW0.ASMX" -diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c -index 8d94ecc3cc468c..9844843bdfadcd 100644 ---- a/drivers/hwmon/dell-smm-hwmon.c -+++ b/drivers/hwmon/dell-smm-hwmon.c -@@ -1158,6 +1158,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = { - }, - .driver_data = (void *)&i8k_config_data[DELL_PRECISION_490], - }, -+ { -+ .ident = "Dell OptiPlex 7040", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), -+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7040"), -+ }, -+ }, - { - .ident = "Dell Precision", - .matches = { -diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c -index c906731c6c2d3e..dc82e33d59c5fc 100644 ---- a/drivers/hwmon/k10temp.c -+++ b/drivers/hwmon/k10temp.c -@@ -84,6 +84,13 @@ static DEFINE_MUTEX(nb_smu_ind_mutex); - */ - #define AMD_I3255_STR "3255" - -+/* -+ * PCI Device IDs for AMD's Family 1Ah-based SOCs. -+ * Defining locally as IDs are not shared. -+ */ -+#define PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3 0x12cb -+#define PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3 0x127b -+ - struct k10temp_data { - struct pci_dev *pdev; - void (*read_htcreg)(struct pci_dev *pdev, u32 *regval); -@@ -545,7 +552,10 @@ static const struct pci_device_id k10temp_id_table[] = { - { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_19H_M78H_DF_F3) }, - { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M00H_DF_F3) }, - { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) }, -+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3) }, - { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) }, -+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M70H_DF_F3) }, -+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3) }, - { PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) }, - {} - }; -diff --git a/drivers/hwmon/sbtsi_temp.c b/drivers/hwmon/sbtsi_temp.c -index dd85cf89f008a9..7c49fcf8641433 100644 ---- a/drivers/hwmon/sbtsi_temp.c -+++ b/drivers/hwmon/sbtsi_temp.c -@@ -14,6 +14,7 @@ - #include - #include - #include -+#include - - /* - * SB-TSI registers only support SMBus byte data access. "_INT" registers are -@@ -29,8 +30,22 @@ - #define SBTSI_REG_TEMP_HIGH_DEC 0x13 /* RW */ - #define SBTSI_REG_TEMP_LOW_DEC 0x14 /* RW */ - -+/* -+ * Bit for reporting value with temperature measurement range. -+ * bit == 0: Use default temperature range (0C to 255.875C). -+ * bit == 1: Use extended temperature range (-49C to +206.875C). -+ */ -+#define SBTSI_CONFIG_EXT_RANGE_SHIFT 2 -+/* -+ * ReadOrder bit specifies the reading order of integer and decimal part of -+ * CPU temperature for atomic reads. If bit == 0, reading integer part triggers -+ * latching of the decimal part, so integer part should be read first. -+ * If bit == 1, read order should be reversed. -+ */ - #define SBTSI_CONFIG_READ_ORDER_SHIFT 5 - -+#define SBTSI_TEMP_EXT_RANGE_ADJ 49000 -+ - #define SBTSI_TEMP_MIN 0 - #define SBTSI_TEMP_MAX 255875 - -@@ -38,6 +53,8 @@ - struct sbtsi_data { - struct i2c_client *client; - struct mutex lock; -+ bool ext_range_mode; -+ bool read_order; - }; - - /* -@@ -74,23 +91,11 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type, - { - struct sbtsi_data *data = dev_get_drvdata(dev); - s32 temp_int, temp_dec; -- int err; - - switch (attr) { - case hwmon_temp_input: -- /* -- * ReadOrder bit specifies the reading order of integer and -- * decimal part of CPU temp for atomic reads. If bit == 0, -- * reading integer part triggers latching of the decimal part, -- * so integer part should be read first. If bit == 1, read -- * order should be reversed. -- */ -- err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG); -- if (err < 0) -- return err; -- - mutex_lock(&data->lock); -- if (err & BIT(SBTSI_CONFIG_READ_ORDER_SHIFT)) { -+ if (data->read_order) { - temp_dec = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_DEC); - temp_int = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_INT); - } else { -@@ -122,6 +127,8 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type, - return temp_dec; - - *val = sbtsi_reg_to_mc(temp_int, temp_dec); -+ if (data->ext_range_mode) -+ *val -= SBTSI_TEMP_EXT_RANGE_ADJ; - - return 0; - } -@@ -146,6 +153,8 @@ static int sbtsi_write(struct device *dev, enum hwmon_sensor_types type, - return -EINVAL; - } - -+ if (data->ext_range_mode) -+ val += SBTSI_TEMP_EXT_RANGE_ADJ; - val = clamp_val(val, SBTSI_TEMP_MIN, SBTSI_TEMP_MAX); - sbtsi_mc_to_reg(val, &temp_int, &temp_dec); - -@@ -203,6 +212,7 @@ static int sbtsi_probe(struct i2c_client *client) - struct device *dev = &client->dev; - struct device *hwmon_dev; - struct sbtsi_data *data; -+ int err; - - data = devm_kzalloc(dev, sizeof(struct sbtsi_data), GFP_KERNEL); - if (!data) -@@ -211,8 +221,14 @@ static int sbtsi_probe(struct i2c_client *client) - data->client = client; - mutex_init(&data->lock); - -- hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data, &sbtsi_chip_info, -- NULL); -+ err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG); -+ if (err < 0) -+ return err; -+ data->ext_range_mode = FIELD_GET(BIT(SBTSI_CONFIG_EXT_RANGE_SHIFT), err); -+ data->read_order = FIELD_GET(BIT(SBTSI_CONFIG_READ_ORDER_SHIFT), err); -+ -+ hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data, -+ &sbtsi_chip_info, NULL); - - return PTR_ERR_OR_ZERO(hwmon_dev); - } -diff --git a/drivers/hwmon/sy7636a-hwmon.c b/drivers/hwmon/sy7636a-hwmon.c -index ed110884786b48..a12fc0ce70e76e 100644 ---- a/drivers/hwmon/sy7636a-hwmon.c -+++ b/drivers/hwmon/sy7636a-hwmon.c -@@ -104,3 +104,4 @@ module_platform_driver(sy7636a_sensor_driver); - - MODULE_DESCRIPTION("SY7636A sensor driver"); - MODULE_LICENSE("GPL"); -+MODULE_ALIAS("platform:sy7636a-temperature"); -diff --git a/drivers/iio/adc/imx93_adc.c b/drivers/iio/adc/imx93_adc.c -index 512d7b95b08e6f..2303ae19c602ea 100644 ---- a/drivers/iio/adc/imx93_adc.c -+++ b/drivers/iio/adc/imx93_adc.c -@@ -38,6 +38,7 @@ - #define IMX93_ADC_PCDR6 0x118 - #define IMX93_ADC_PCDR7 0x11c - #define IMX93_ADC_CALSTAT 0x39C -+#define IMX93_ADC_CALCFG0 0x3A0 - - /* ADC bit shift */ - #define IMX93_ADC_MCR_MODE_MASK BIT(29) -@@ -58,6 +59,8 @@ - #define IMX93_ADC_IMR_ECH_MASK BIT(0) - #define IMX93_ADC_PCDR_CDATA_MASK GENMASK(11, 0) - -+#define IMX93_ADC_CALCFG0_LDFAIL_MASK BIT(4) -+ - /* ADC status */ - #define IMX93_ADC_MSR_ADCSTATUS_IDLE 0 - #define IMX93_ADC_MSR_ADCSTATUS_POWER_DOWN 1 -@@ -145,7 +148,7 @@ static void imx93_adc_config_ad_clk(struct imx93_adc *adc) - - static int imx93_adc_calibration(struct imx93_adc *adc) - { -- u32 mcr, msr; -+ u32 mcr, msr, calcfg; - int ret; - - /* make sure ADC in power down mode */ -@@ -158,6 +161,11 @@ static int imx93_adc_calibration(struct imx93_adc *adc) - - imx93_adc_power_up(adc); - -+ /* Enable loading of calibrated values even in fail condition */ -+ calcfg = readl(adc->regs + IMX93_ADC_CALCFG0); -+ calcfg |= IMX93_ADC_CALCFG0_LDFAIL_MASK; -+ writel(calcfg, adc->regs + IMX93_ADC_CALCFG0); -+ - /* - * TODO: we use the default TSAMP/NRSMPL/AVGEN in MCR, - * can add the setting of these bit if need in future. -@@ -180,9 +188,13 @@ static int imx93_adc_calibration(struct imx93_adc *adc) - /* check whether calbration is success or not */ - msr = readl(adc->regs + IMX93_ADC_MSR); - if (msr & IMX93_ADC_MSR_CALFAIL_MASK) { -+ /* -+ * Only give warning here, this means the noise of the -+ * reference voltage do not meet the requirement: -+ * ADC reference voltage Noise < 1.8V * 1/2^ENOB -+ * And the resault of ADC is not that accurate. -+ */ - dev_warn(adc->dev, "ADC calibration failed!\n"); -- imx93_adc_power_down(adc); -- return -EAGAIN; - } - - return 0; -diff --git a/drivers/iio/adc/spear_adc.c b/drivers/iio/adc/spear_adc.c -index ad54ef79810905..602ed05552bfd4 100644 ---- a/drivers/iio/adc/spear_adc.c -+++ b/drivers/iio/adc/spear_adc.c -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -29,9 +30,9 @@ - - /* Bit definitions for SPEAR_ADC_STATUS */ - #define SPEAR_ADC_STATUS_START_CONVERSION BIT(0) --#define SPEAR_ADC_STATUS_CHANNEL_NUM(x) ((x) << 1) -+#define SPEAR_ADC_STATUS_CHANNEL_NUM_MASK GENMASK(3, 1) - #define SPEAR_ADC_STATUS_ADC_ENABLE BIT(4) --#define SPEAR_ADC_STATUS_AVG_SAMPLE(x) ((x) << 5) -+#define SPEAR_ADC_STATUS_AVG_SAMPLE_MASK GENMASK(8, 5) - #define SPEAR_ADC_STATUS_VREF_INTERNAL BIT(9) - - #define SPEAR_ADC_DATA_MASK 0x03ff -@@ -157,8 +158,8 @@ static int spear_adc_read_raw(struct iio_dev *indio_dev, - case IIO_CHAN_INFO_RAW: - mutex_lock(&st->lock); - -- status = SPEAR_ADC_STATUS_CHANNEL_NUM(chan->channel) | -- SPEAR_ADC_STATUS_AVG_SAMPLE(st->avg_samples) | -+ status = FIELD_PREP(SPEAR_ADC_STATUS_CHANNEL_NUM_MASK, chan->channel) | -+ FIELD_PREP(SPEAR_ADC_STATUS_AVG_SAMPLE_MASK, st->avg_samples) | - SPEAR_ADC_STATUS_START_CONVERSION | - SPEAR_ADC_STATUS_ADC_ENABLE; - if (st->vref_external == 0) -diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -index 4a10b826d15a38..f1d4494c7d0082 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -@@ -161,6 +161,8 @@ static void set_frmr_seg(struct hns_roce_v2_rc_send_wqe *rc_sq_wqe, - hr_reg_write(fseg, FRMR_PBL_BUF_PG_SZ, - to_hr_hw_page_shift(mr->pbl_mtr.hem_cfg.buf_pg_shift)); - hr_reg_clear(fseg, FRMR_BLK_MODE); -+ hr_reg_clear(fseg, FRMR_BLOCK_SIZE); -+ hr_reg_clear(fseg, FRMR_ZBVA); - } - - static void set_atomic_seg(const struct ib_send_wr *wr, -@@ -335,9 +337,6 @@ static int set_rwqe_data_seg(struct ib_qp *ibqp, const struct ib_send_wr *wr, - int j = 0; - int i; - -- hr_reg_write(rc_sq_wqe, RC_SEND_WQE_MSG_START_SGE_IDX, -- (*sge_ind) & (qp->sge.sge_cnt - 1)); -- - hr_reg_write(rc_sq_wqe, RC_SEND_WQE_INLINE, - !!(wr->send_flags & IB_SEND_INLINE)); - if (wr->send_flags & IB_SEND_INLINE) -@@ -586,6 +585,9 @@ static inline int set_rc_wqe(struct hns_roce_qp *qp, - hr_reg_write(rc_sq_wqe, RC_SEND_WQE_CQE, - (wr->send_flags & IB_SEND_SIGNALED) ? 1 : 0); - -+ hr_reg_write(rc_sq_wqe, RC_SEND_WQE_MSG_START_SGE_IDX, -+ curr_idx & (qp->sge.sge_cnt - 1)); -+ - if (wr->opcode == IB_WR_ATOMIC_CMP_AND_SWP || - wr->opcode == IB_WR_ATOMIC_FETCH_AND_ADD) { - if (msg_len != ATOMIC_WR_LEN) -@@ -734,6 +736,9 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp, - owner_bit = - ~(((qp->sq.head + nreq) >> ilog2(qp->sq.wqe_cnt)) & 0x1); - -+ /* RC and UD share the same DirectWQE field layout */ -+ ((struct hns_roce_v2_rc_send_wqe *)wqe)->byte_4 = 0; -+ - /* Corresponding to the QP type, wqe process separately */ - if (ibqp->qp_type == IB_QPT_RC) - ret = set_rc_wqe(qp, wr, wqe, &sge_idx, owner_bit); -diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c -index 0cad6fc7bf32c3..26784b296ffa6b 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_qp.c -+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c -@@ -654,7 +654,6 @@ static int set_user_sq_size(struct hns_roce_dev *hr_dev, - - hr_qp->sq.wqe_shift = ucmd->log_sq_stride; - hr_qp->sq.wqe_cnt = cnt; -- cap->max_send_sge = hr_qp->sq.max_gs; - - return 0; - } -@@ -736,7 +735,6 @@ static int set_kernel_sq_size(struct hns_roce_dev *hr_dev, - - /* sync the parameters of kernel QP to user's configuration */ - cap->max_send_wr = cnt; -- cap->max_send_sge = hr_qp->sq.max_gs; - - return 0; - } -diff --git a/drivers/infiniband/hw/irdma/pble.c b/drivers/infiniband/hw/irdma/pble.c -index c0bef11436b940..fa096557adc83b 100644 ---- a/drivers/infiniband/hw/irdma/pble.c -+++ b/drivers/infiniband/hw/irdma/pble.c -@@ -71,7 +71,7 @@ int irdma_hmc_init_pble(struct irdma_sc_dev *dev, - static void get_sd_pd_idx(struct irdma_hmc_pble_rsrc *pble_rsrc, - struct sd_pd_idx *idx) - { -- idx->sd_idx = (u32)pble_rsrc->next_fpm_addr / IRDMA_HMC_DIRECT_BP_SIZE; -+ idx->sd_idx = pble_rsrc->next_fpm_addr / IRDMA_HMC_DIRECT_BP_SIZE; - idx->pd_idx = (u32)(pble_rsrc->next_fpm_addr / IRDMA_HMC_PAGED_BP_SIZE); - idx->rel_pd_idx = (idx->pd_idx % IRDMA_HMC_PD_CNT_IN_SD); - } -diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c -index 38cecb28d322e4..29540b2b2373c8 100644 ---- a/drivers/infiniband/hw/irdma/verbs.c -+++ b/drivers/infiniband/hw/irdma/verbs.c -@@ -2077,6 +2077,7 @@ static int irdma_create_cq(struct ib_cq *ibcq, - spin_lock_init(&iwcq->lock); - INIT_LIST_HEAD(&iwcq->resize_list); - INIT_LIST_HEAD(&iwcq->cmpl_generated); -+ iwcq->cq_num = cq_num; - info.dev = dev; - ukinfo->cq_size = max(entries, 4); - ukinfo->cq_id = cq_num; -@@ -2115,8 +2116,6 @@ static int irdma_create_cq(struct ib_cq *ibcq, - goto cq_free_rsrc; - } - -- iwcq->iwpbl = iwpbl; -- iwcq->cq_mem_size = 0; - cqmr = &iwpbl->cq_mr; - - if (rf->sc_dev.hw_attrs.uk_attrs.feature_flags & -@@ -2131,7 +2130,6 @@ static int irdma_create_cq(struct ib_cq *ibcq, - err_code = -EPROTO; - goto cq_free_rsrc; - } -- iwcq->iwpbl_shadow = iwpbl_shadow; - cqmr_shadow = &iwpbl_shadow->cq_mr; - info.shadow_area_pa = cqmr_shadow->cq_pbl.addr; - cqmr->split = true; -diff --git a/drivers/infiniband/hw/irdma/verbs.h b/drivers/infiniband/hw/irdma/verbs.h -index 20297a14c9a61d..bb9ab945938e05 100644 ---- a/drivers/infiniband/hw/irdma/verbs.h -+++ b/drivers/infiniband/hw/irdma/verbs.h -@@ -113,21 +113,15 @@ struct irdma_mr { - struct irdma_cq { - struct ib_cq ibcq; - struct irdma_sc_cq sc_cq; -- u16 cq_head; -- u16 cq_size; -- u16 cq_num; -+ u32 cq_num; - bool user_mode; - atomic_t armed; - enum irdma_cmpl_notify last_notify; -- u32 polled_cmpls; -- u32 cq_mem_size; - struct irdma_dma_mem kmem; - struct irdma_dma_mem kmem_shadow; - struct completion free_cq; - refcount_t refcnt; - spinlock_t lock; /* for poll cq */ -- struct irdma_pbl *iwpbl; -- struct irdma_pbl *iwpbl_shadow; - struct list_head resize_list; - struct irdma_cq_poll_info cur_cqe; - struct list_head cmpl_generated; -diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c -index 431cea41df2af1..1897619209f147 100644 ---- a/drivers/iommu/amd/init.c -+++ b/drivers/iommu/amd/init.c -@@ -840,11 +840,16 @@ static void iommu_enable_command_buffer(struct amd_iommu *iommu) - - BUG_ON(iommu->cmd_buf == NULL); - -- entry = iommu_virt_to_phys(iommu->cmd_buf); -- entry |= MMIO_CMD_SIZE_512; -- -- memcpy_toio(iommu->mmio_base + MMIO_CMD_BUF_OFFSET, -- &entry, sizeof(entry)); -+ if (!is_kdump_kernel()) { -+ /* -+ * Command buffer is re-used for kdump kernel and setting -+ * of MMIO register is not required. -+ */ -+ entry = iommu_virt_to_phys(iommu->cmd_buf); -+ entry |= MMIO_CMD_SIZE_512; -+ memcpy_toio(iommu->mmio_base + MMIO_CMD_BUF_OFFSET, -+ &entry, sizeof(entry)); -+ } - - amd_iommu_reset_cmd_buffer(iommu); - } -@@ -893,10 +898,15 @@ static void iommu_enable_event_buffer(struct amd_iommu *iommu) - - BUG_ON(iommu->evt_buf == NULL); - -- entry = iommu_virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK; -- -- memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET, -- &entry, sizeof(entry)); -+ if (!is_kdump_kernel()) { -+ /* -+ * Event buffer is re-used for kdump kernel and setting -+ * of MMIO register is not required. -+ */ -+ entry = iommu_virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK; -+ memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET, -+ &entry, sizeof(entry)); -+ } - - /* set head and tail to zero manually */ - writel(0x00, iommu->mmio_base + MMIO_EVT_HEAD_OFFSET); -diff --git a/drivers/iommu/apple-dart.c b/drivers/iommu/apple-dart.c -index 0b892750842746..0ea450cbb77868 100644 ---- a/drivers/iommu/apple-dart.c -+++ b/drivers/iommu/apple-dart.c -@@ -121,6 +121,8 @@ - #define DART_T8110_ERROR_ADDR_LO 0x170 - #define DART_T8110_ERROR_ADDR_HI 0x174 - -+#define DART_T8110_ERROR_STREAMS 0x1c0 -+ - #define DART_T8110_PROTECT 0x200 - #define DART_T8110_UNPROTECT 0x204 - #define DART_T8110_PROTECT_LOCK 0x208 -@@ -1041,6 +1043,9 @@ static irqreturn_t apple_dart_t8110_irq(int irq, void *dev) - error, stream_idx, error_code, fault_name, addr); - - writel(error, dart->regs + DART_T8110_ERROR); -+ for (int i = 0; i < BITS_TO_U32(dart->num_streams); i++) -+ writel(U32_MAX, dart->regs + DART_T8110_ERROR_STREAMS + 4 * i); -+ - return IRQ_HANDLED; - } - -diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c -index 1f925285104eee..aa9cfcb6039e24 100644 ---- a/drivers/iommu/intel/debugfs.c -+++ b/drivers/iommu/intel/debugfs.c -@@ -562,17 +562,11 @@ DEFINE_SHOW_ATTRIBUTE(ir_translation_struct); - static void latency_show_one(struct seq_file *m, struct intel_iommu *iommu, - struct dmar_drhd_unit *drhd) - { -- int ret; -- - seq_printf(m, "IOMMU: %s Register Base Address: %llx\n", - iommu->name, drhd->reg_base_addr); - -- ret = dmar_latency_snapshot(iommu, debug_buf, DEBUG_BUFFER_SIZE); -- if (ret < 0) -- seq_puts(m, "Failed to get latency snapshot"); -- else -- seq_puts(m, debug_buf); -- seq_puts(m, "\n"); -+ dmar_latency_snapshot(iommu, debug_buf, DEBUG_BUFFER_SIZE); -+ seq_printf(m, "%s\n", debug_buf); - } - - static int latency_show(struct seq_file *m, void *v) -diff --git a/drivers/iommu/intel/perf.c b/drivers/iommu/intel/perf.c -index 94ee70ac38e301..ae64e1123f2571 100644 ---- a/drivers/iommu/intel/perf.c -+++ b/drivers/iommu/intel/perf.c -@@ -113,7 +113,7 @@ static char *latency_type_names[] = { - " svm_prq" - }; - --int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size) -+void dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size) - { - struct latency_statistic *lstat = iommu->perf_statistic; - unsigned long flags; -@@ -122,7 +122,7 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size) - memset(str, 0, size); - - for (i = 0; i < COUNTS_NUM; i++) -- bytes += snprintf(str + bytes, size - bytes, -+ bytes += scnprintf(str + bytes, size - bytes, - "%s", latency_counter_names[i]); - - spin_lock_irqsave(&latency_lock, flags); -@@ -130,7 +130,7 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size) - if (!dmar_latency_enabled(iommu, i)) - continue; - -- bytes += snprintf(str + bytes, size - bytes, -+ bytes += scnprintf(str + bytes, size - bytes, - "\n%s", latency_type_names[i]); - - for (j = 0; j < COUNTS_NUM; j++) { -@@ -156,11 +156,9 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size) - break; - } - -- bytes += snprintf(str + bytes, size - bytes, -+ bytes += scnprintf(str + bytes, size - bytes, - "%12lld", val); - } - } - spin_unlock_irqrestore(&latency_lock, flags); -- -- return bytes; - } -diff --git a/drivers/iommu/intel/perf.h b/drivers/iommu/intel/perf.h -index fd6db8049d1a77..1e481e9e4ad04d 100644 ---- a/drivers/iommu/intel/perf.h -+++ b/drivers/iommu/intel/perf.h -@@ -41,7 +41,7 @@ void dmar_latency_disable(struct intel_iommu *iommu, enum latency_type type); - bool dmar_latency_enabled(struct intel_iommu *iommu, enum latency_type type); - void dmar_latency_update(struct intel_iommu *iommu, enum latency_type type, - u64 latency); --int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size); -+void dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size); - #else - static inline int - dmar_latency_enable(struct intel_iommu *iommu, enum latency_type type) -@@ -65,9 +65,8 @@ dmar_latency_update(struct intel_iommu *iommu, enum latency_type type, u64 laten - { - } - --static inline int -+static inline void - dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size) - { -- return 0; - } - #endif /* CONFIG_DMAR_PERF */ -diff --git a/drivers/iommu/iommufd/io_pagetable.c b/drivers/iommu/iommufd/io_pagetable.c -index f058405c5fbb66..6bd37343061e00 100644 ---- a/drivers/iommu/iommufd/io_pagetable.c -+++ b/drivers/iommu/iommufd/io_pagetable.c -@@ -488,7 +488,8 @@ static int iopt_unmap_iova_range(struct io_pagetable *iopt, unsigned long start, - struct iopt_area *area; - unsigned long unmapped_bytes = 0; - unsigned int tries = 0; -- int rc = -ENOENT; -+ /* If there are no mapped entries then success */ -+ int rc = 0; - - /* - * The domains_rwsem must be held in read mode any time any area->pages -@@ -552,8 +553,6 @@ static int iopt_unmap_iova_range(struct io_pagetable *iopt, unsigned long start, - - down_write(&iopt->iova_rwsem); - } -- if (unmapped_bytes) -- rc = 0; - - out_unlock_iova: - up_write(&iopt->iova_rwsem); -@@ -590,13 +589,8 @@ int iopt_unmap_iova(struct io_pagetable *iopt, unsigned long iova, - - int iopt_unmap_all(struct io_pagetable *iopt, unsigned long *unmapped) - { -- int rc; -- -- rc = iopt_unmap_iova_range(iopt, 0, ULONG_MAX, unmapped); - /* If the IOVAs are empty then unmap all succeeds */ -- if (rc == -ENOENT) -- return 0; -- return rc; -+ return iopt_unmap_iova_range(iopt, 0, ULONG_MAX, unmapped); - } - - /* The caller must always free all the nodes in the allowed_iova rb_root. */ -diff --git a/drivers/iommu/iommufd/ioas.c b/drivers/iommu/iommufd/ioas.c -index 0407e2b758ef43..18bbbeef5cccd2 100644 ---- a/drivers/iommu/iommufd/ioas.c -+++ b/drivers/iommu/iommufd/ioas.c -@@ -317,6 +317,10 @@ int iommufd_ioas_unmap(struct iommufd_ucmd *ucmd) - &unmapped); - if (rc) - goto out_put; -+ if (!unmapped) { -+ rc = -ENOENT; -+ goto out_put; -+ } - } - - cmd->length = unmapped; -diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c -index 683e8721e3b498..4bce4758241718 100644 ---- a/drivers/irqchip/irq-gic-v2m.c -+++ b/drivers/irqchip/irq-gic-v2m.c -@@ -179,14 +179,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq, - { - msi_alloc_info_t *info = args; - struct v2m_data *v2m = NULL, *tmp; -- int hwirq, offset, i, err = 0; -+ int hwirq, i, err = 0; -+ unsigned long offset; -+ unsigned long align_mask = nr_irqs - 1; - - spin_lock(&v2m_lock); - list_for_each_entry(tmp, &v2m_nodes, entry) { -- offset = bitmap_find_free_region(tmp->bm, tmp->nr_spis, -- get_count_order(nr_irqs)); -- if (offset >= 0) { -+ unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask); -+ -+ offset = bitmap_find_next_zero_area_off(tmp->bm, tmp->nr_spis, 0, -+ nr_irqs, align_mask, align_off); -+ if (offset < tmp->nr_spis) { - v2m = tmp; -+ bitmap_set(v2m->bm, offset, nr_irqs); - break; - } - } -diff --git a/drivers/irqchip/irq-loongson-pch-lpc.c b/drivers/irqchip/irq-loongson-pch-lpc.c -index 9b35492fb6be9e..1e9fcea1826f8f 100644 ---- a/drivers/irqchip/irq-loongson-pch-lpc.c -+++ b/drivers/irqchip/irq-loongson-pch-lpc.c -@@ -198,8 +198,13 @@ int __init pch_lpc_acpi_init(struct irq_domain *parent, - goto iounmap_base; - } - -- priv->lpc_domain = irq_domain_create_linear(irq_handle, LPC_COUNT, -- &pch_lpc_domain_ops, priv); -+ /* -+ * The LPC interrupt controller is a legacy i8259-compatible device, -+ * which requires a static 1:1 mapping for IRQs 0-15. -+ * Use irq_domain_create_legacy to establish this static mapping early. -+ */ -+ priv->lpc_domain = irq_domain_create_legacy(irq_handle, LPC_COUNT, 0, 0, -+ &pch_lpc_domain_ops, priv); - if (!priv->lpc_domain) { - pr_err("Failed to create IRQ domain\n"); - goto free_irq_handle; -diff --git a/drivers/irqchip/irq-riscv-intc.c b/drivers/irqchip/irq-riscv-intc.c -index 627beae9649a21..84cb9cda365ada 100644 ---- a/drivers/irqchip/irq-riscv-intc.c -+++ b/drivers/irqchip/irq-riscv-intc.c -@@ -149,7 +149,8 @@ static int riscv_intc_domain_alloc(struct irq_domain *domain, - static const struct irq_domain_ops riscv_intc_domain_ops = { - .map = riscv_intc_domain_map, - .xlate = irq_domain_xlate_onecell, -- .alloc = riscv_intc_domain_alloc -+ .alloc = riscv_intc_domain_alloc, -+ .free = irq_domain_free_irqs_top, - }; - - static struct fwnode_handle *riscv_intc_hwnode(void) -diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c -index 2d20cf9d84cead..a8f5cfad16f7de 100644 ---- a/drivers/irqchip/irq-sifive-plic.c -+++ b/drivers/irqchip/irq-sifive-plic.c -@@ -176,12 +176,14 @@ static int plic_set_affinity(struct irq_data *d, - if (cpu >= nr_cpu_ids) - return -EINVAL; - -- plic_irq_disable(d); -+ /* Invalidate the original routing entry */ -+ plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 0); - - irq_data_update_effective_affinity(d, cpumask_of(cpu)); - -+ /* Setting the new routing entry if irq is enabled */ - if (!irqd_irq_disabled(d)) -- plic_irq_enable(d); -+ plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 1); - - return IRQ_SET_MASK_OK_DONE; - } -diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c -index b82b89888a5e04..c55438e1f67801 100644 ---- a/drivers/isdn/hardware/mISDN/hfcsusb.c -+++ b/drivers/isdn/hardware/mISDN/hfcsusb.c -@@ -1903,13 +1903,13 @@ setup_instance(struct hfcsusb *hw, struct device *parent) - mISDN_freebchannel(&hw->bch[1]); - mISDN_freebchannel(&hw->bch[0]); - mISDN_freedchannel(&hw->dch); -- kfree(hw); - return err; - } - - static int - hfcsusb_probe(struct usb_interface *intf, const struct usb_device_id *id) - { -+ int err; - struct hfcsusb *hw; - struct usb_device *dev = interface_to_usbdev(intf); - struct usb_host_interface *iface = intf->cur_altsetting; -@@ -2100,20 +2100,28 @@ hfcsusb_probe(struct usb_interface *intf, const struct usb_device_id *id) - if (!hw->ctrl_urb) { - pr_warn("%s: No memory for control urb\n", - driver_info->vend_name); -- kfree(hw); -- return -ENOMEM; -+ err = -ENOMEM; -+ goto err_free_hw; - } - - pr_info("%s: %s: detected \"%s\" (%s, if=%d alt=%d)\n", - hw->name, __func__, driver_info->vend_name, - conf_str[small_match], ifnum, alt_used); - -- if (setup_instance(hw, dev->dev.parent)) -- return -EIO; -+ if (setup_instance(hw, dev->dev.parent)) { -+ err = -EIO; -+ goto err_free_urb; -+ } - - hw->intf = intf; - usb_set_intfdata(hw->intf, hw); - return 0; -+ -+err_free_urb: -+ usb_free_urb(hw->ctrl_urb); -+err_free_hw: -+ kfree(hw); -+ return err; - } - - /* function called when an active device is removed */ -diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig -index 53b443be5a59ee..d4082a86fcedb5 100644 ---- a/drivers/media/i2c/Kconfig -+++ b/drivers/media/i2c/Kconfig -@@ -27,7 +27,7 @@ config VIDEO_IR_I2C - - menuconfig VIDEO_CAMERA_SENSOR - bool "Camera sensor devices" -- depends on MEDIA_CAMERA_SUPPORT && I2C -+ depends on MEDIA_CAMERA_SUPPORT && I2C && HAVE_CLK - select MEDIA_CONTROLLER - select V4L2_FWNODE - select VIDEO_V4L2_SUBDEV_API -diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c -index 114ac0c263fb2b..ecb0e7b1f2a5fc 100644 ---- a/drivers/media/i2c/adv7180.c -+++ b/drivers/media/i2c/adv7180.c -@@ -356,32 +356,27 @@ static inline struct adv7180_state *to_state(struct v4l2_subdev *sd) - static int adv7180_querystd(struct v4l2_subdev *sd, v4l2_std_id *std) - { - struct adv7180_state *state = to_state(sd); -- int err = mutex_lock_interruptible(&state->mutex); -- if (err) -- return err; -- -- if (state->streaming) { -- err = -EBUSY; -- goto unlock; -- } -+ int ret; - -- err = adv7180_set_video_standard(state, -- ADV7180_STD_AD_PAL_BG_NTSC_J_SECAM); -- if (err) -- goto unlock; -+ guard(mutex)(&state->mutex); - -- msleep(100); -- __adv7180_status(state, NULL, std); -+ /* -+ * We can't sample the standard if the device is streaming as that would -+ * interfere with the capture session as the VID_SEL reg is touched. -+ */ -+ if (state->streaming) -+ return -EBUSY; - -- err = v4l2_std_to_adv7180(state->curr_norm); -- if (err < 0) -- goto unlock; -+ /* Set the standard to autodetect PAL B/G/H/I/D, NTSC J or SECAM */ -+ ret = adv7180_set_video_standard(state, -+ ADV7180_STD_AD_PAL_BG_NTSC_J_SECAM); -+ if (ret) -+ return ret; - -- err = adv7180_set_video_standard(state, err); -+ /* Allow some time for the autodetection to run. */ -+ msleep(100); - --unlock: -- mutex_unlock(&state->mutex); -- return err; -+ return __adv7180_status(state, NULL, std); - } - - static int adv7180_s_routing(struct v4l2_subdev *sd, u32 input, -@@ -803,12 +798,7 @@ static int adv7180_set_pad_format(struct v4l2_subdev *sd, - ret = adv7180_mbus_fmt(sd, &format->format); - - if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE) { -- if (state->field != format->format.field) { -- state->field = format->format.field; -- adv7180_set_power(state, false); -- adv7180_set_field_mode(state); -- adv7180_set_power(state, true); -- } -+ state->field = format->format.field; - } else { - framefmt = v4l2_subdev_get_try_format(sd, sd_state, 0); - *framefmt = format->format; -@@ -1568,6 +1558,8 @@ static int adv7180_suspend(struct device *dev) - struct v4l2_subdev *sd = dev_get_drvdata(dev); - struct adv7180_state *state = to_state(sd); - -+ guard(mutex)(&state->mutex); -+ - return adv7180_set_power(state, false); - } - -@@ -1581,6 +1573,8 @@ static int adv7180_resume(struct device *dev) - if (ret < 0) - return ret; - -+ guard(mutex)(&state->mutex); -+ - ret = adv7180_set_power(state, state->powered); - if (ret) - return ret; -diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c -index b37a2aaf8ac047..a8026f0f980f98 100644 ---- a/drivers/media/i2c/ir-kbd-i2c.c -+++ b/drivers/media/i2c/ir-kbd-i2c.c -@@ -321,9 +321,9 @@ static int get_key_avermedia_cardbus(struct IR_i2c *ir, enum rc_proto *protocol, - - static int ir_key_poll(struct IR_i2c *ir) - { -- enum rc_proto protocol; -- u32 scancode; -- u8 toggle; -+ enum rc_proto protocol = 0; -+ u32 scancode = 0; -+ u8 toggle = 0; - int rc; - - dev_dbg(&ir->rc->dev, "%s\n", __func__); -diff --git a/drivers/media/i2c/og01a1b.c b/drivers/media/i2c/og01a1b.c -index 365ce568458360..9bd204911651ea 100644 ---- a/drivers/media/i2c/og01a1b.c -+++ b/drivers/media/i2c/og01a1b.c -@@ -676,7 +676,7 @@ static void og01a1b_update_pad_format(const struct og01a1b_mode *mode, - { - fmt->width = mode->width; - fmt->height = mode->height; -- fmt->code = MEDIA_BUS_FMT_SGRBG10_1X10; -+ fmt->code = MEDIA_BUS_FMT_Y10_1X10; - fmt->field = V4L2_FIELD_NONE; - } - -@@ -867,7 +867,7 @@ static int og01a1b_enum_mbus_code(struct v4l2_subdev *sd, - if (code->index > 0) - return -EINVAL; - -- code->code = MEDIA_BUS_FMT_SGRBG10_1X10; -+ code->code = MEDIA_BUS_FMT_Y10_1X10; - - return 0; - } -@@ -879,7 +879,7 @@ static int og01a1b_enum_frame_size(struct v4l2_subdev *sd, - if (fse->index >= ARRAY_SIZE(supported_modes)) - return -EINVAL; - -- if (fse->code != MEDIA_BUS_FMT_SGRBG10_1X10) -+ if (fse->code != MEDIA_BUS_FMT_Y10_1X10) - return -EINVAL; - - fse->min_width = supported_modes[fse->index].width; -diff --git a/drivers/media/i2c/ov08x40.c b/drivers/media/i2c/ov08x40.c -index 637da4df69011d..4d15fa6ac311e6 100644 ---- a/drivers/media/i2c/ov08x40.c -+++ b/drivers/media/i2c/ov08x40.c -@@ -2643,7 +2643,7 @@ static int ov08x40_set_ctrl_hflip(struct ov08x40 *ov08x, u32 ctrl_val) - - return ov08x40_write_reg(ov08x, OV08X40_REG_MIRROR, - OV08X40_REG_VALUE_08BIT, -- ctrl_val ? val | BIT(2) : val & ~BIT(2)); -+ ctrl_val ? val & ~BIT(2) : val | BIT(2)); - } - - static int ov08x40_set_ctrl_vflip(struct ov08x40 *ov08x, u32 ctrl_val) -diff --git a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c -index 8f346d7da9c8de..269a799ec046c6 100644 ---- a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c -+++ b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c -@@ -148,14 +148,12 @@ static int snd_ivtv_pcm_capture_open(struct snd_pcm_substream *substream) - - s = &itv->streams[IVTV_ENC_STREAM_TYPE_PCM]; - -- v4l2_fh_init(&item.fh, &s->vdev); - item.itv = itv; - item.type = s->type; - - /* See if the stream is available */ - if (ivtv_claim_stream(&item, item.type)) { - /* No, it's already in use */ -- v4l2_fh_exit(&item.fh); - snd_ivtv_unlock(itvsc); - return -EBUSY; - } -diff --git a/drivers/media/pci/ivtv/ivtv-driver.h b/drivers/media/pci/ivtv/ivtv-driver.h -index ce3a7ca51736e5..df2dcef1af3f01 100644 ---- a/drivers/media/pci/ivtv/ivtv-driver.h -+++ b/drivers/media/pci/ivtv/ivtv-driver.h -@@ -322,6 +322,7 @@ struct ivtv_queue { - }; - - struct ivtv; /* forward reference */ -+struct ivtv_open_id; - - struct ivtv_stream { - /* These first four fields are always set, even if the stream -@@ -331,7 +332,7 @@ struct ivtv_stream { - const char *name; /* name of the stream */ - int type; /* stream type */ - -- struct v4l2_fh *fh; /* pointer to the streaming filehandle */ -+ struct ivtv_open_id *id; /* pointer to the streaming ivtv_open_id */ - spinlock_t qlock; /* locks access to the queues */ - unsigned long s_flags; /* status flags, see above */ - int dma; /* can be PCI_DMA_TODEVICE, PCI_DMA_FROMDEVICE or PCI_DMA_NONE */ -diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c -index 4202c3a47d33e6..7ed0d2d85253e5 100644 ---- a/drivers/media/pci/ivtv/ivtv-fileops.c -+++ b/drivers/media/pci/ivtv/ivtv-fileops.c -@@ -38,16 +38,16 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type) - - if (test_and_set_bit(IVTV_F_S_CLAIMED, &s->s_flags)) { - /* someone already claimed this stream */ -- if (s->fh == &id->fh) { -+ if (s->id == id) { - /* yes, this file descriptor did. So that's OK. */ - return 0; - } -- if (s->fh == NULL && (type == IVTV_DEC_STREAM_TYPE_VBI || -+ if (s->id == NULL && (type == IVTV_DEC_STREAM_TYPE_VBI || - type == IVTV_ENC_STREAM_TYPE_VBI)) { - /* VBI is handled already internally, now also assign - the file descriptor to this stream for external - reading of the stream. */ -- s->fh = &id->fh; -+ s->id = id; - IVTV_DEBUG_INFO("Start Read VBI\n"); - return 0; - } -@@ -55,7 +55,7 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type) - IVTV_DEBUG_INFO("Stream %d is busy\n", type); - return -EBUSY; - } -- s->fh = &id->fh; -+ s->id = id; - if (type == IVTV_DEC_STREAM_TYPE_VBI) { - /* Enable reinsertion interrupt */ - ivtv_clear_irq_mask(itv, IVTV_IRQ_DEC_VBI_RE_INSERT); -@@ -93,7 +93,7 @@ void ivtv_release_stream(struct ivtv_stream *s) - struct ivtv *itv = s->itv; - struct ivtv_stream *s_vbi; - -- s->fh = NULL; -+ s->id = NULL; - if ((s->type == IVTV_DEC_STREAM_TYPE_VBI || s->type == IVTV_ENC_STREAM_TYPE_VBI) && - test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) { - /* this stream is still in use internally */ -@@ -125,7 +125,7 @@ void ivtv_release_stream(struct ivtv_stream *s) - /* was already cleared */ - return; - } -- if (s_vbi->fh) { -+ if (s_vbi->id) { - /* VBI stream still claimed by a file descriptor */ - return; - } -@@ -349,7 +349,7 @@ static ssize_t ivtv_read(struct ivtv_stream *s, char __user *ubuf, size_t tot_co - size_t tot_written = 0; - int single_frame = 0; - -- if (atomic_read(&itv->capturing) == 0 && s->fh == NULL) { -+ if (atomic_read(&itv->capturing) == 0 && s->id == NULL) { - /* shouldn't happen */ - IVTV_DEBUG_WARN("Stream %s not initialized before read\n", s->name); - return -EIO; -@@ -819,7 +819,7 @@ void ivtv_stop_capture(struct ivtv_open_id *id, int gop_end) - id->type == IVTV_ENC_STREAM_TYPE_VBI) && - test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) { - /* Also used internally, don't stop capturing */ -- s->fh = NULL; -+ s->id = NULL; - } - else { - ivtv_stop_v4l2_encode_stream(s, gop_end); -@@ -903,7 +903,7 @@ int ivtv_v4l2_close(struct file *filp) - v4l2_fh_exit(fh); - - /* Easy case first: this stream was never claimed by us */ -- if (s->fh != &id->fh) -+ if (s->id != id) - goto close_done; - - /* 'Unclaim' this stream */ -diff --git a/drivers/media/pci/ivtv/ivtv-irq.c b/drivers/media/pci/ivtv/ivtv-irq.c -index e39bf64c5c715b..404335e5aff4ec 100644 ---- a/drivers/media/pci/ivtv/ivtv-irq.c -+++ b/drivers/media/pci/ivtv/ivtv-irq.c -@@ -305,7 +305,7 @@ static void dma_post(struct ivtv_stream *s) - ivtv_process_vbi_data(itv, buf, 0, s->type); - s->q_dma.bytesused += buf->bytesused; - } -- if (s->fh == NULL) { -+ if (s->id == NULL) { - ivtv_queue_move(s, &s->q_dma, NULL, &s->q_free, 0); - return; - } -@@ -330,7 +330,7 @@ static void dma_post(struct ivtv_stream *s) - set_bit(IVTV_F_I_HAVE_WORK, &itv->i_flags); - } - -- if (s->fh) -+ if (s->id) - wake_up(&s->waitq); - } - -diff --git a/drivers/media/platform/amphion/vpu_v4l2.c b/drivers/media/platform/amphion/vpu_v4l2.c -index 61d27b63b99d47..75084ba8f93b63 100644 ---- a/drivers/media/platform/amphion/vpu_v4l2.c -+++ b/drivers/media/platform/amphion/vpu_v4l2.c -@@ -693,8 +693,6 @@ static int vpu_v4l2_release(struct vpu_inst *inst) - - v4l2_ctrl_handler_free(&inst->ctrl_handler); - mutex_destroy(&inst->lock); -- v4l2_fh_del(&inst->fh); -- v4l2_fh_exit(&inst->fh); - - call_void_vop(inst, cleanup); - -@@ -763,6 +761,8 @@ int vpu_v4l2_open(struct file *file, struct vpu_inst *inst) - - return 0; - error: -+ v4l2_fh_del(&inst->fh); -+ v4l2_fh_exit(&inst->fh); - vpu_inst_put(inst); - return ret; - } -@@ -782,6 +782,9 @@ int vpu_v4l2_close(struct file *file) - call_void_vop(inst, release); - vpu_inst_unlock(inst); - -+ v4l2_fh_del(&inst->fh); -+ v4l2_fh_exit(&inst->fh); -+ - vpu_inst_unregister(inst); - vpu_inst_put(inst); - -diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c -index 1874c976081f8e..35833ee8beb517 100644 ---- a/drivers/media/platform/verisilicon/hantro_drv.c -+++ b/drivers/media/platform/verisilicon/hantro_drv.c -@@ -910,6 +910,8 @@ static int hantro_add_func(struct hantro_dev *vpu, unsigned int funcid) - vpu->decoder = func; - v4l2_disable_ioctl(vfd, VIDIOC_TRY_ENCODER_CMD); - v4l2_disable_ioctl(vfd, VIDIOC_ENCODER_CMD); -+ v4l2_disable_ioctl(vfd, VIDIOC_G_SELECTION); -+ v4l2_disable_ioctl(vfd, VIDIOC_S_SELECTION); - } - - video_set_drvdata(vfd, vpu); -diff --git a/drivers/media/platform/verisilicon/hantro_v4l2.c b/drivers/media/platform/verisilicon/hantro_v4l2.c -index db145519fc5d38..52009c5b0db4b5 100644 ---- a/drivers/media/platform/verisilicon/hantro_v4l2.c -+++ b/drivers/media/platform/verisilicon/hantro_v4l2.c -@@ -655,8 +655,7 @@ static int vidioc_g_selection(struct file *file, void *priv, - struct hantro_ctx *ctx = fh_to_ctx(priv); - - /* Crop only supported on source. */ -- if (!ctx->is_encoder || -- sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT) -+ if (sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT) - return -EINVAL; - - switch (sel->target) { -@@ -688,8 +687,7 @@ static int vidioc_s_selection(struct file *file, void *priv, - struct vb2_queue *vq; - - /* Crop only supported on source. */ -- if (!ctx->is_encoder || -- sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT) -+ if (sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT) - return -EINVAL; - - /* Change not allowed if the queue is streaming. */ -diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c -index f4deca8894e0f7..bb4aabb08c06ef 100644 ---- a/drivers/media/rc/imon.c -+++ b/drivers/media/rc/imon.c -@@ -650,12 +650,15 @@ static int send_packet(struct imon_context *ictx) - smp_rmb(); /* ensure later readers know we're not busy */ - pr_err_ratelimited("error submitting urb(%d)\n", retval); - } else { -- /* Wait for transmission to complete (or abort) */ -- retval = wait_for_completion_interruptible( -- &ictx->tx.finished); -- if (retval) { -+ /* Wait for transmission to complete (or abort or timeout) */ -+ retval = wait_for_completion_interruptible_timeout(&ictx->tx.finished, 10 * HZ); -+ if (retval <= 0) { - usb_kill_urb(ictx->tx_urb); - pr_err_ratelimited("task interrupted\n"); -+ if (retval < 0) -+ ictx->tx.status = retval; -+ else -+ ictx->tx.status = -ETIMEDOUT; - } - - ictx->tx.busy = false; -@@ -1754,14 +1757,6 @@ static void usb_rx_callback_intf0(struct urb *urb) - if (!ictx) - return; - -- /* -- * if we get a callback before we're done configuring the hardware, we -- * can't yet process the data, as there's nowhere to send it, but we -- * still need to submit a new rx URB to avoid wedging the hardware -- */ -- if (!ictx->dev_present_intf0) -- goto out; -- - switch (urb->status) { - case -ENOENT: /* usbcore unlink successful! */ - return; -@@ -1770,16 +1765,29 @@ static void usb_rx_callback_intf0(struct urb *urb) - break; - - case 0: -- imon_incoming_packet(ictx, urb, intfnum); -+ /* -+ * if we get a callback before we're done configuring the hardware, we -+ * can't yet process the data, as there's nowhere to send it, but we -+ * still need to submit a new rx URB to avoid wedging the hardware -+ */ -+ if (ictx->dev_present_intf0) -+ imon_incoming_packet(ictx, urb, intfnum); - break; - -+ case -ECONNRESET: -+ case -EILSEQ: -+ case -EPROTO: -+ case -EPIPE: -+ dev_warn(ictx->dev, "imon %s: status(%d)\n", -+ __func__, urb->status); -+ return; -+ - default: - dev_warn(ictx->dev, "imon %s: status(%d): ignored\n", - __func__, urb->status); - break; - } - --out: - usb_submit_urb(ictx->rx_urb_intf0, GFP_ATOMIC); - } - -@@ -1795,14 +1803,6 @@ static void usb_rx_callback_intf1(struct urb *urb) - if (!ictx) - return; - -- /* -- * if we get a callback before we're done configuring the hardware, we -- * can't yet process the data, as there's nowhere to send it, but we -- * still need to submit a new rx URB to avoid wedging the hardware -- */ -- if (!ictx->dev_present_intf1) -- goto out; -- - switch (urb->status) { - case -ENOENT: /* usbcore unlink successful! */ - return; -@@ -1811,16 +1811,29 @@ static void usb_rx_callback_intf1(struct urb *urb) - break; - - case 0: -- imon_incoming_packet(ictx, urb, intfnum); -+ /* -+ * if we get a callback before we're done configuring the hardware, we -+ * can't yet process the data, as there's nowhere to send it, but we -+ * still need to submit a new rx URB to avoid wedging the hardware -+ */ -+ if (ictx->dev_present_intf1) -+ imon_incoming_packet(ictx, urb, intfnum); - break; - -+ case -ECONNRESET: -+ case -EILSEQ: -+ case -EPROTO: -+ case -EPIPE: -+ dev_warn(ictx->dev, "imon %s: status(%d)\n", -+ __func__, urb->status); -+ return; -+ - default: - dev_warn(ictx->dev, "imon %s: status(%d): ignored\n", - __func__, urb->status); - break; - } - --out: - usb_submit_urb(ictx->rx_urb_intf1, GFP_ATOMIC); - } - -diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c -index 9f2947af33aa7c..880981e1c507e1 100644 ---- a/drivers/media/rc/redrat3.c -+++ b/drivers/media/rc/redrat3.c -@@ -422,7 +422,7 @@ static int redrat3_send_cmd(int cmd, struct redrat3_dev *rr3) - static int redrat3_enable_detector(struct redrat3_dev *rr3) - { - struct device *dev = rr3->dev; -- u8 ret; -+ int ret; - - ret = redrat3_send_cmd(RR3_RC_DET_ENABLE, rr3); - if (ret != 0) -diff --git a/drivers/media/tuners/xc4000.c b/drivers/media/tuners/xc4000.c -index 29bc63021c5aae..6fb3550811a283 100644 ---- a/drivers/media/tuners/xc4000.c -+++ b/drivers/media/tuners/xc4000.c -@@ -1087,12 +1087,12 @@ static int check_firmware(struct dvb_frontend *fe, unsigned int type, - - static void xc_debug_dump(struct xc4000_priv *priv) - { -- u16 adc_envelope; -+ u16 adc_envelope = 0; - u32 freq_error_hz = 0; -- u16 lock_status; -+ u16 lock_status = 0; - u32 hsync_freq_hz = 0; -- u16 frame_lines; -- u16 quality; -+ u16 frame_lines = 0; -+ u16 quality = 0; - u16 signal = 0; - u16 noise = 0; - u8 hw_majorversion = 0, hw_minorversion = 0; -diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c -index ec9a3cd4784e1f..a28481edd22ed0 100644 ---- a/drivers/media/tuners/xc5000.c -+++ b/drivers/media/tuners/xc5000.c -@@ -622,14 +622,14 @@ static int xc5000_fwupload(struct dvb_frontend *fe, - - static void xc_debug_dump(struct xc5000_priv *priv) - { -- u16 adc_envelope; -+ u16 adc_envelope = 0; - u32 freq_error_hz = 0; -- u16 lock_status; -+ u16 lock_status = 0; - u32 hsync_freq_hz = 0; -- u16 frame_lines; -- u16 quality; -- u16 snr; -- u16 totalgain; -+ u16 frame_lines = 0; -+ u16 quality = 0; -+ u16 snr = 0; -+ u16 totalgain = 0; - u8 hw_majorversion = 0, hw_minorversion = 0; - u8 fw_majorversion = 0, fw_minorversion = 0; - u16 fw_buildversion = 0; -diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c -index c7cee6b185264d..a4b9a7ca4e50f9 100644 ---- a/drivers/media/usb/uvc/uvc_driver.c -+++ b/drivers/media/usb/uvc/uvc_driver.c -@@ -165,13 +165,26 @@ static struct uvc_entity *uvc_entity_by_reference(struct uvc_device *dev, - - static struct uvc_streaming *uvc_stream_by_id(struct uvc_device *dev, int id) - { -- struct uvc_streaming *stream; -+ struct uvc_streaming *stream, *last_stream; -+ unsigned int count = 0; - - list_for_each_entry(stream, &dev->streams, list) { -+ count += 1; -+ last_stream = stream; - if (stream->header.bTerminalLink == id) - return stream; - } - -+ /* -+ * If the streaming entity is referenced by an invalid ID, notify the -+ * user and use heuristics to guess the correct entity. -+ */ -+ if (count == 1 && id == UVC_INVALID_ENTITY_ID) { -+ dev_warn(&dev->intf->dev, -+ "UVC non compliance: Invalid USB header. The streaming entity has an invalid ID, guessing the correct one."); -+ return last_stream; -+ } -+ - return NULL; - } - -diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c -index e0895e979e35b3..65af43201b6933 100644 ---- a/drivers/memstick/core/memstick.c -+++ b/drivers/memstick/core/memstick.c -@@ -367,7 +367,9 @@ int memstick_set_rw_addr(struct memstick_dev *card) - { - card->next_request = h_memstick_set_rw_addr; - memstick_new_req(card->host); -- wait_for_completion(&card->mrq_complete); -+ if (!wait_for_completion_timeout(&card->mrq_complete, -+ msecs_to_jiffies(500))) -+ card->current_mrq.error = -ETIMEDOUT; - - return card->current_mrq.error; - } -@@ -401,7 +403,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host) - - card->next_request = h_memstick_read_dev_id; - memstick_new_req(host); -- wait_for_completion(&card->mrq_complete); -+ if (!wait_for_completion_timeout(&card->mrq_complete, -+ msecs_to_jiffies(500))) -+ card->current_mrq.error = -ETIMEDOUT; - - if (card->current_mrq.error) - goto err_out; -diff --git a/drivers/mfd/da9063-i2c.c b/drivers/mfd/da9063-i2c.c -index d715cf9a9e6883..7b829bfe04bc7b 100644 ---- a/drivers/mfd/da9063-i2c.c -+++ b/drivers/mfd/da9063-i2c.c -@@ -37,9 +37,13 @@ enum da9063_page_sel_buf_fmt { - DA9063_PAGE_SEL_BUF_SIZE, - }; - -+enum da9063_page_sel_msgs { -+ DA9063_PAGE_SEL_MSG = 0, -+ DA9063_PAGE_SEL_CNT, -+}; -+ - enum da9063_paged_read_msgs { -- DA9063_PAGED_READ_MSG_PAGE_SEL = 0, -- DA9063_PAGED_READ_MSG_REG_SEL, -+ DA9063_PAGED_READ_MSG_REG_SEL = 0, - DA9063_PAGED_READ_MSG_DATA, - DA9063_PAGED_READ_MSG_CNT, - }; -@@ -65,10 +69,21 @@ static int da9063_i2c_blockreg_read(struct i2c_client *client, u16 addr, - (page_num << DA9063_I2C_PAGE_SEL_SHIFT) & DA9063_REG_PAGE_MASK; - - /* Write reg address, page selection */ -- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].addr = client->addr; -- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].flags = 0; -- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].len = DA9063_PAGE_SEL_BUF_SIZE; -- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].buf = page_sel_buf; -+ xfer[DA9063_PAGE_SEL_MSG].addr = client->addr; -+ xfer[DA9063_PAGE_SEL_MSG].flags = 0; -+ xfer[DA9063_PAGE_SEL_MSG].len = DA9063_PAGE_SEL_BUF_SIZE; -+ xfer[DA9063_PAGE_SEL_MSG].buf = page_sel_buf; -+ -+ ret = i2c_transfer(client->adapter, xfer, DA9063_PAGE_SEL_CNT); -+ if (ret < 0) { -+ dev_err(&client->dev, "Page switch failed: %d\n", ret); -+ return ret; -+ } -+ -+ if (ret != DA9063_PAGE_SEL_CNT) { -+ dev_err(&client->dev, "Page switch failed to complete\n"); -+ return -EIO; -+ } - - /* Select register address */ - xfer[DA9063_PAGED_READ_MSG_REG_SEL].addr = client->addr; -diff --git a/drivers/mfd/madera-core.c b/drivers/mfd/madera-core.c -index bdbd5bfc971456..2f74a8c644a32a 100644 ---- a/drivers/mfd/madera-core.c -+++ b/drivers/mfd/madera-core.c -@@ -456,7 +456,7 @@ int madera_dev_init(struct madera *madera) - struct device *dev = madera->dev; - unsigned int hwid; - int (*patch_fn)(struct madera *) = NULL; -- const struct mfd_cell *mfd_devs; -+ const struct mfd_cell *mfd_devs = NULL; - int n_devs = 0; - int i, ret; - -@@ -670,7 +670,7 @@ int madera_dev_init(struct madera *madera) - goto err_reset; - } - -- if (!n_devs) { -+ if (!n_devs || !mfd_devs) { - dev_err(madera->dev, "Device ID 0x%x not a %s\n", hwid, - madera->type_name); - ret = -ENODEV; -diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c -index fe018bedab9837..7e2ca397588250 100644 ---- a/drivers/mfd/stmpe-i2c.c -+++ b/drivers/mfd/stmpe-i2c.c -@@ -137,3 +137,4 @@ module_exit(stmpe_exit); - - MODULE_DESCRIPTION("STMPE MFD I2C Interface Driver"); - MODULE_AUTHOR("Rabin Vincent "); -+MODULE_LICENSE("GPL"); -diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c -index 9c3cf58457a7db..be6a84a3062cce 100644 ---- a/drivers/mfd/stmpe.c -+++ b/drivers/mfd/stmpe.c -@@ -1485,6 +1485,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum) - - void stmpe_remove(struct stmpe *stmpe) - { -+ if (stmpe->domain) -+ irq_domain_remove(stmpe->domain); -+ - if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio)) - regulator_disable(stmpe->vio); - if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc)) -diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c -index 597b00e8c9539d..cffacf4434b55f 100644 ---- a/drivers/mmc/host/renesas_sdhi_core.c -+++ b/drivers/mmc/host/renesas_sdhi_core.c -@@ -220,7 +220,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host, - clk &= ~0xff; - } - -- sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk & CLK_CTL_DIV_MASK); -+ clock = clk & CLK_CTL_DIV_MASK; -+ if (clock != 0xff) -+ host->mmc->actual_clock /= (1 << (ffs(clock) + 1)); -+ -+ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clock); - if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2)) - usleep_range(10000, 11000); - -diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c -index c2144a3efb308e..74234ee5f60894 100644 ---- a/drivers/mmc/host/sdhci-msm.c -+++ b/drivers/mmc/host/sdhci-msm.c -@@ -81,6 +81,7 @@ - #define CORE_IO_PAD_PWR_SWITCH_EN BIT(15) - #define CORE_IO_PAD_PWR_SWITCH BIT(16) - #define CORE_HC_SELECT_IN_EN BIT(18) -+#define CORE_HC_SELECT_IN_SDR50 (4 << 19) - #define CORE_HC_SELECT_IN_HS400 (6 << 19) - #define CORE_HC_SELECT_IN_MASK (7 << 19) - -@@ -1133,6 +1134,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host) - { - struct mmc_ios *ios = &host->mmc->ios; - -+ if (ios->timing == MMC_TIMING_UHS_SDR50 && -+ host->flags & SDHCI_SDR50_NEEDS_TUNING) -+ return true; -+ - /* - * Tuning is required for SDR104, HS200 and HS400 cards and - * if clock frequency is greater than 100MHz in these modes. -@@ -1201,6 +1206,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode) - struct mmc_ios ios = host->mmc->ios; - struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); - struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host); -+ const struct sdhci_msm_offset *msm_offset = msm_host->offset; -+ u32 config; - - if (!sdhci_msm_is_tuning_needed(host)) { - msm_host->use_cdr = false; -@@ -1217,6 +1224,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode) - */ - msm_host->tuning_done = 0; - -+ if (ios.timing == MMC_TIMING_UHS_SDR50 && -+ host->flags & SDHCI_SDR50_NEEDS_TUNING) { -+ config = readl_relaxed(host->ioaddr + msm_offset->core_vendor_spec); -+ config &= ~CORE_HC_SELECT_IN_MASK; -+ config |= CORE_HC_SELECT_IN_EN | CORE_HC_SELECT_IN_SDR50; -+ writel_relaxed(config, host->ioaddr + msm_offset->core_vendor_spec); -+ } -+ - /* - * For HS400 tuning in HS200 timing requires: - * - select MCLK/2 in VENDOR_SPEC -diff --git a/drivers/mmc/host/sdhci-of-dwcmshc.c b/drivers/mmc/host/sdhci-of-dwcmshc.c -index a0524127ca073d..4c6fa92a95a6e5 100644 ---- a/drivers/mmc/host/sdhci-of-dwcmshc.c -+++ b/drivers/mmc/host/sdhci-of-dwcmshc.c -@@ -54,7 +54,7 @@ - #define DLL_TXCLK_TAPNUM_DEFAULT 0x10 - #define DLL_TXCLK_TAPNUM_90_DEGREES 0xA - #define DLL_TXCLK_TAPNUM_FROM_SW BIT(24) --#define DLL_STRBIN_TAPNUM_DEFAULT 0x8 -+#define DLL_STRBIN_TAPNUM_DEFAULT 0x4 - #define DLL_STRBIN_TAPNUM_FROM_SW BIT(24) - #define DLL_STRBIN_DELAY_NUM_SEL BIT(26) - #define DLL_STRBIN_DELAY_NUM_OFFSET 16 -diff --git a/drivers/mtd/nand/onenand/onenand_samsung.c b/drivers/mtd/nand/onenand/onenand_samsung.c -index fd6890a03d5571..0e21d443078e41 100644 ---- a/drivers/mtd/nand/onenand/onenand_samsung.c -+++ b/drivers/mtd/nand/onenand/onenand_samsung.c -@@ -906,7 +906,7 @@ static int s3c_onenand_probe(struct platform_device *pdev) - err = devm_request_irq(&pdev->dev, r->start, - s5pc110_onenand_irq, - IRQF_SHARED, "onenand", -- &onenand); -+ onenand); - if (err) { - dev_err(&pdev->dev, "failed to get irq\n"); - return err; -diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c -index b00bac4686773d..ffe8db7c2f1f40 100644 ---- a/drivers/net/dsa/b53/b53_common.c -+++ b/drivers/net/dsa/b53/b53_common.c -@@ -349,11 +349,11 @@ static void b53_set_forwarding(struct b53_device *dev, int enable) - * frames should be flooded or not. - */ - b53_read8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, &mgmt); -- mgmt |= B53_UC_FWD_EN | B53_MC_FWD_EN | B53_IPMC_FWD_EN; -+ mgmt |= B53_UC_FWD_EN | B53_MC_FWD_EN | B53_IP_MC; - b53_write8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, mgmt); - } else { - b53_read8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, &mgmt); -- mgmt |= B53_IP_MCAST_25; -+ mgmt |= B53_IP_MC; - b53_write8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, mgmt); - } - } -@@ -1215,6 +1215,10 @@ static void b53_force_port_config(struct b53_device *dev, int port, - else - reg &= ~PORT_OVERRIDE_FULL_DUPLEX; - -+ reg &= ~(0x3 << GMII_PO_SPEED_S); -+ if (is5301x(dev) || is58xx(dev)) -+ reg &= ~PORT_OVERRIDE_SPEED_2000M; -+ - switch (speed) { - case 2000: - reg |= PORT_OVERRIDE_SPEED_2000M; -@@ -1233,6 +1237,11 @@ static void b53_force_port_config(struct b53_device *dev, int port, - return; - } - -+ if (is5325(dev)) -+ reg &= ~PORT_OVERRIDE_LP_FLOW_25; -+ else -+ reg &= ~(PORT_OVERRIDE_RX_FLOW | PORT_OVERRIDE_TX_FLOW); -+ - if (rx_pause) { - if (is5325(dev)) - reg |= PORT_OVERRIDE_LP_FLOW_25; -@@ -1807,7 +1816,7 @@ static int b53_arl_search_wait(struct b53_device *dev) - do { - b53_read8(dev, B53_ARLIO_PAGE, B53_ARL_SRCH_CTL, ®); - if (!(reg & ARL_SRCH_STDN)) -- return 0; -+ return -ENOENT; - - if (reg & ARL_SRCH_VLID) - return 0; -diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h -index 3179fe58de6b62..38e2d60dab7d59 100644 ---- a/drivers/net/dsa/b53/b53_regs.h -+++ b/drivers/net/dsa/b53/b53_regs.h -@@ -104,8 +104,7 @@ - - /* IP Multicast control (8 bit) */ - #define B53_IP_MULTICAST_CTRL 0x21 --#define B53_IP_MCAST_25 BIT(0) --#define B53_IPMC_FWD_EN BIT(1) -+#define B53_IP_MC BIT(0) - #define B53_UC_FWD_EN BIT(6) - #define B53_MC_FWD_EN BIT(7) - -diff --git a/drivers/net/dsa/dsa_loop.c b/drivers/net/dsa/dsa_loop.c -index 5b139f2206b6ef..48cf9d300bbf56 100644 ---- a/drivers/net/dsa/dsa_loop.c -+++ b/drivers/net/dsa/dsa_loop.c -@@ -378,13 +378,10 @@ static struct mdio_driver dsa_loop_drv = { - - static void dsa_loop_phydevs_unregister(void) - { -- unsigned int i; -- -- for (i = 0; i < NUM_FIXED_PHYS; i++) -- if (!IS_ERR(phydevs[i])) { -+ for (int i = 0; i < NUM_FIXED_PHYS; i++) { -+ if (!IS_ERR(phydevs[i])) - fixed_phy_unregister(phydevs[i]); -- phy_device_free(phydevs[i]); -- } -+ } - } - - static int __init dsa_loop_init(void) -diff --git a/drivers/net/dsa/microchip/ksz9477.c b/drivers/net/dsa/microchip/ksz9477.c -index 59134d117846d1..a11f2c1aabacab 100644 ---- a/drivers/net/dsa/microchip/ksz9477.c -+++ b/drivers/net/dsa/microchip/ksz9477.c -@@ -1087,9 +1087,15 @@ void ksz9477_config_cpu_port(struct dsa_switch *ds) - } - } - -+#define RESV_MCAST_CNT 8 -+ -+static u8 reserved_mcast_map[RESV_MCAST_CNT] = { 0, 1, 3, 16, 32, 33, 2, 17 }; -+ - int ksz9477_enable_stp_addr(struct ksz_device *dev) - { -+ u8 i, ports, update; - const u32 *masks; -+ bool override; - u32 data; - int ret; - -@@ -1098,23 +1104,87 @@ int ksz9477_enable_stp_addr(struct ksz_device *dev) - /* Enable Reserved multicast table */ - ksz_cfg(dev, REG_SW_LUE_CTRL_0, SW_RESV_MCAST_ENABLE, true); - -- /* Set the Override bit for forwarding BPDU packet to CPU */ -- ret = ksz_write32(dev, REG_SW_ALU_VAL_B, -- ALU_V_OVERRIDE | BIT(dev->cpu_port)); -- if (ret < 0) -- return ret; -+ /* The reserved multicast address table has 8 entries. Each entry has -+ * a default value of which port to forward. It is assumed the host -+ * port is the last port in most of the switches, but that is not the -+ * case for KSZ9477 or maybe KSZ9897. For LAN937X family the default -+ * port is port 5, the first RGMII port. It is okay for LAN9370, a -+ * 5-port switch, but may not be correct for the other 8-port -+ * versions. It is necessary to update the whole table to forward to -+ * the right ports. -+ * Furthermore PTP messages can use a reserved multicast address and -+ * the host will not receive them if this table is not correct. -+ */ -+ for (i = 0; i < RESV_MCAST_CNT; i++) { -+ data = reserved_mcast_map[i] << -+ dev->info->shifts[ALU_STAT_INDEX]; -+ data |= ALU_STAT_START | -+ masks[ALU_STAT_DIRECT] | -+ masks[ALU_RESV_MCAST_ADDR] | -+ masks[ALU_STAT_READ]; -+ ret = ksz_write32(dev, REG_SW_ALU_STAT_CTRL__4, data); -+ if (ret < 0) -+ return ret; - -- data = ALU_STAT_START | ALU_RESV_MCAST_ADDR | masks[ALU_STAT_WRITE]; -+ /* wait to be finished */ -+ ret = ksz9477_wait_alu_sta_ready(dev); -+ if (ret < 0) -+ return ret; - -- ret = ksz_write32(dev, REG_SW_ALU_STAT_CTRL__4, data); -- if (ret < 0) -- return ret; -+ ret = ksz_read32(dev, REG_SW_ALU_VAL_B, &data); -+ if (ret < 0) -+ return ret; - -- /* wait to be finished */ -- ret = ksz9477_wait_alu_sta_ready(dev); -- if (ret < 0) { -- dev_err(dev->dev, "Failed to update Reserved Multicast table\n"); -- return ret; -+ override = false; -+ ports = data & dev->port_mask; -+ switch (i) { -+ case 0: -+ case 6: -+ /* Change the host port. */ -+ update = BIT(dev->cpu_port); -+ override = true; -+ break; -+ case 2: -+ /* Change the host port. */ -+ update = BIT(dev->cpu_port); -+ break; -+ case 4: -+ case 5: -+ case 7: -+ /* Skip the host port. */ -+ update = dev->port_mask & ~BIT(dev->cpu_port); -+ break; -+ default: -+ update = ports; -+ break; -+ } -+ if (update != ports || override) { -+ data &= ~dev->port_mask; -+ data |= update; -+ /* Set Override bit to receive frame even when port is -+ * closed. -+ */ -+ if (override) -+ data |= ALU_V_OVERRIDE; -+ ret = ksz_write32(dev, REG_SW_ALU_VAL_B, data); -+ if (ret < 0) -+ return ret; -+ -+ data = reserved_mcast_map[i] << -+ dev->info->shifts[ALU_STAT_INDEX]; -+ data |= ALU_STAT_START | -+ masks[ALU_STAT_DIRECT] | -+ masks[ALU_RESV_MCAST_ADDR] | -+ masks[ALU_STAT_WRITE]; -+ ret = ksz_write32(dev, REG_SW_ALU_STAT_CTRL__4, data); -+ if (ret < 0) -+ return ret; -+ -+ /* wait to be finished */ -+ ret = ksz9477_wait_alu_sta_ready(dev); -+ if (ret < 0) -+ return ret; -+ } - } - - return 0; -diff --git a/drivers/net/dsa/microchip/ksz9477_reg.h b/drivers/net/dsa/microchip/ksz9477_reg.h -index d0886ed984c578..c3ad8ce707f854 100644 ---- a/drivers/net/dsa/microchip/ksz9477_reg.h -+++ b/drivers/net/dsa/microchip/ksz9477_reg.h -@@ -2,7 +2,7 @@ - /* - * Microchip KSZ9477 register definitions - * -- * Copyright (C) 2017-2024 Microchip Technology Inc. -+ * Copyright (C) 2017-2025 Microchip Technology Inc. - */ - - #ifndef __KSZ9477_REGS_H -@@ -422,7 +422,6 @@ - - #define ALU_RESV_MCAST_INDEX_M (BIT(6) - 1) - #define ALU_STAT_START BIT(7) --#define ALU_RESV_MCAST_ADDR BIT(1) - - #define REG_SW_ALU_VAL_A 0x0420 - -diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c -index 997c225dfba4de..cff83a8fb7d28a 100644 ---- a/drivers/net/dsa/microchip/ksz_common.c -+++ b/drivers/net/dsa/microchip/ksz_common.c -@@ -437,6 +437,8 @@ static const u16 ksz9477_regs[] = { - static const u32 ksz9477_masks[] = { - [ALU_STAT_WRITE] = 0, - [ALU_STAT_READ] = 1, -+ [ALU_STAT_DIRECT] = 0, -+ [ALU_RESV_MCAST_ADDR] = BIT(1), - [P_MII_TX_FLOW_CTRL] = BIT(5), - [P_MII_RX_FLOW_CTRL] = BIT(3), - }; -@@ -464,6 +466,8 @@ static const u8 ksz9477_xmii_ctrl1[] = { - static const u32 lan937x_masks[] = { - [ALU_STAT_WRITE] = 1, - [ALU_STAT_READ] = 2, -+ [ALU_STAT_DIRECT] = BIT(3), -+ [ALU_RESV_MCAST_ADDR] = BIT(2), - [P_MII_TX_FLOW_CTRL] = BIT(5), - [P_MII_RX_FLOW_CTRL] = BIT(3), - }; -diff --git a/drivers/net/dsa/microchip/ksz_common.h b/drivers/net/dsa/microchip/ksz_common.h -index a4de58847deab3..0e51f2277381db 100644 ---- a/drivers/net/dsa/microchip/ksz_common.h -+++ b/drivers/net/dsa/microchip/ksz_common.h -@@ -255,6 +255,8 @@ enum ksz_masks { - DYNAMIC_MAC_TABLE_TIMESTAMP, - ALU_STAT_WRITE, - ALU_STAT_READ, -+ ALU_STAT_DIRECT, -+ ALU_RESV_MCAST_ADDR, - P_MII_TX_FLOW_CTRL, - P_MII_RX_FLOW_CTRL, - }; -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c -index bbe8657f6545b3..404b433f1bc08e 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c -@@ -917,9 +917,9 @@ static void bnxt_ptp_free(struct bnxt *bp) - if (ptp->ptp_clock) { - ptp_clock_unregister(ptp->ptp_clock); - ptp->ptp_clock = NULL; -- kfree(ptp->ptp_info.pin_config); -- ptp->ptp_info.pin_config = NULL; - } -+ kfree(ptp->ptp_info.pin_config); -+ ptp->ptp_info.pin_config = NULL; - } - - int bnxt_ptp_init(struct bnxt *bp) -diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c -index b836ab2a649a2b..7593255e6e53d0 100644 ---- a/drivers/net/ethernet/cadence/macb_main.c -+++ b/drivers/net/ethernet/cadence/macb_main.c -@@ -281,9 +281,9 @@ static void macb_set_hwaddr(struct macb *bp) - u32 bottom; - u16 top; - -- bottom = cpu_to_le32(*((u32 *)bp->dev->dev_addr)); -+ bottom = get_unaligned_le32(bp->dev->dev_addr); - macb_or_gem_writel(bp, SA1B, bottom); -- top = cpu_to_le16(*((u16 *)(bp->dev->dev_addr + 4))); -+ top = get_unaligned_le16(bp->dev->dev_addr + 4); - macb_or_gem_writel(bp, SA1T, top); - - if (gem_has_ptp(bp)) { -diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c -index 64cd72c1947837..ee0306ab977148 100644 ---- a/drivers/net/ethernet/freescale/fec_main.c -+++ b/drivers/net/ethernet/freescale/fec_main.c -@@ -1776,6 +1776,8 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id) - ndev->stats.rx_packets++; - pkt_len = fec16_to_cpu(bdp->cbd_datlen); - ndev->stats.rx_bytes += pkt_len; -+ if (fep->quirks & FEC_QUIRK_HAS_RACC) -+ ndev->stats.rx_bytes -= 2; - - index = fec_enet_get_bd_index(bdp, &rxq->bd); - page = rxq->rx_skb_info[index].page; -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -index 789f72d1067f8a..2fa64099e8be2f 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -@@ -9346,8 +9346,7 @@ static int hclge_mii_ioctl(struct hclge_dev *hdev, struct ifreq *ifr, int cmd) - /* this command reads phy id and register at the same time */ - fallthrough; - case SIOCGMIIREG: -- data->val_out = hclge_read_phy_reg(hdev, data->reg_num); -- return 0; -+ return hclge_read_phy_reg(hdev, data->reg_num, &data->val_out); - - case SIOCSMIIREG: - return hclge_write_phy_reg(hdev, data->reg_num, data->val_in); -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c -index 80079657afebe0..b8dbf932caf942 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c -@@ -274,7 +274,7 @@ void hclge_mac_stop_phy(struct hclge_dev *hdev) - phy_stop(phydev); - } - --u16 hclge_read_phy_reg(struct hclge_dev *hdev, u16 reg_addr) -+int hclge_read_phy_reg(struct hclge_dev *hdev, u16 reg_addr, u16 *val) - { - struct hclge_phy_reg_cmd *req; - struct hclge_desc desc; -@@ -286,11 +286,14 @@ u16 hclge_read_phy_reg(struct hclge_dev *hdev, u16 reg_addr) - req->reg_addr = cpu_to_le16(reg_addr); - - ret = hclge_cmd_send(&hdev->hw, &desc, 1); -- if (ret) -+ if (ret) { - dev_err(&hdev->pdev->dev, - "failed to read phy reg, ret = %d.\n", ret); -+ return ret; -+ } - -- return le16_to_cpu(req->reg_val); -+ *val = le16_to_cpu(req->reg_val); -+ return 0; - } - - int hclge_write_phy_reg(struct hclge_dev *hdev, u16 reg_addr, u16 val) -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h -index 4200d0b6d9317b..21d434c82475b3 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h -@@ -13,7 +13,7 @@ int hclge_mac_connect_phy(struct hnae3_handle *handle); - void hclge_mac_disconnect_phy(struct hnae3_handle *handle); - void hclge_mac_start_phy(struct hclge_dev *hdev); - void hclge_mac_stop_phy(struct hclge_dev *hdev); --u16 hclge_read_phy_reg(struct hclge_dev *hdev, u16 reg_addr); -+int hclge_read_phy_reg(struct hclge_dev *hdev, u16 reg_addr, u16 *val); - int hclge_write_phy_reg(struct hclge_dev *hdev, u16 reg_addr, u16 val); - - #endif -diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.c b/drivers/net/ethernet/intel/fm10k/fm10k_common.c -index f51a63fca513e9..1f919a50c76535 100644 ---- a/drivers/net/ethernet/intel/fm10k/fm10k_common.c -+++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.c -@@ -447,17 +447,16 @@ void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q, - /** - * fm10k_unbind_hw_stats_q - Unbind the queue counters from their queues - * @q: pointer to the ring of hardware statistics queue -- * @idx: index pointing to the start of the ring iteration - * @count: number of queues to iterate over - * - * Function invalidates the index values for the queues so any updates that - * may have happened are ignored and the base for the queue stats is reset. - **/ --void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 idx, u32 count) -+void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 count) - { - u32 i; - -- for (i = 0; i < count; i++, idx++, q++) { -+ for (i = 0; i < count; i++, q++) { - q->rx_stats_idx = 0; - q->tx_stats_idx = 0; - } -diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.h b/drivers/net/ethernet/intel/fm10k/fm10k_common.h -index 4c48fb73b3e78c..13fca6a91a01bd 100644 ---- a/drivers/net/ethernet/intel/fm10k/fm10k_common.h -+++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.h -@@ -43,6 +43,6 @@ u32 fm10k_read_hw_stats_32b(struct fm10k_hw *hw, u32 addr, - void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q, - u32 idx, u32 count); - #define fm10k_unbind_hw_stats_32b(s) ((s)->base_h = 0) --void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 idx, u32 count); -+void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 count); - s32 fm10k_get_host_state_generic(struct fm10k_hw *hw, bool *host_ready); - #endif /* _FM10K_COMMON_H_ */ -diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c -index aed5e0bf6313e9..b51b6003ad0320 100644 ---- a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c -+++ b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c -@@ -1510,7 +1510,7 @@ static void fm10k_rebind_hw_stats_pf(struct fm10k_hw *hw, - fm10k_unbind_hw_stats_32b(&stats->nodesc_drop); - - /* Unbind Queue Statistics */ -- fm10k_unbind_hw_stats_q(stats->q, 0, hw->mac.max_queues); -+ fm10k_unbind_hw_stats_q(stats->q, hw->mac.max_queues); - - /* Reinitialize bases for all stats */ - fm10k_update_hw_stats_pf(hw, stats); -diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c -index 7fb1961f292101..6861a0bdc14e18 100644 ---- a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c -+++ b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c -@@ -465,7 +465,7 @@ static void fm10k_rebind_hw_stats_vf(struct fm10k_hw *hw, - struct fm10k_hw_stats *stats) - { - /* Unbind Queue Statistics */ -- fm10k_unbind_hw_stats_q(stats->q, 0, hw->mac.max_queues); -+ fm10k_unbind_hw_stats_q(stats->q, hw->mac.max_queues); - - /* Reinitialize bases for all stats */ - fm10k_update_hw_stats_vf(hw, stats); -diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c -index e1a68fb5e9fff0..e846246261b940 100644 ---- a/drivers/net/ethernet/intel/ice/ice_main.c -+++ b/drivers/net/ethernet/intel/ice/ice_main.c -@@ -8765,7 +8765,7 @@ static int ice_create_q_channels(struct ice_vsi *vsi) - list_add_tail(&ch->list, &vsi->ch_list); - vsi->tc_map_vsi[i] = ch->ch_vsi; - dev_dbg(ice_pf_to_dev(pf), -- "successfully created channel: VSI %pK\n", ch->ch_vsi); -+ "successfully created channel: VSI %p\n", ch->ch_vsi); - } - return 0; - -diff --git a/drivers/net/ethernet/intel/ice/ice_trace.h b/drivers/net/ethernet/intel/ice/ice_trace.h -index b2f5c9fe01492d..a41e210a310d19 100644 ---- a/drivers/net/ethernet/intel/ice/ice_trace.h -+++ b/drivers/net/ethernet/intel/ice/ice_trace.h -@@ -130,7 +130,7 @@ DECLARE_EVENT_CLASS(ice_tx_template, - __entry->buf = buf; - __assign_str(devname, ring->netdev->name);), - -- TP_printk("netdev: %s ring: %pK desc: %pK buf %pK", __get_str(devname), -+ TP_printk("netdev: %s ring: %p desc: %p buf %p", __get_str(devname), - __entry->ring, __entry->desc, __entry->buf) - ); - -@@ -158,7 +158,7 @@ DECLARE_EVENT_CLASS(ice_rx_template, - __entry->desc = desc; - __assign_str(devname, ring->netdev->name);), - -- TP_printk("netdev: %s ring: %pK desc: %pK", __get_str(devname), -+ TP_printk("netdev: %s ring: %p desc: %p", __get_str(devname), - __entry->ring, __entry->desc) - ); - DEFINE_EVENT(ice_rx_template, ice_clean_rx_irq, -@@ -182,7 +182,7 @@ DECLARE_EVENT_CLASS(ice_rx_indicate_template, - __entry->skb = skb; - __assign_str(devname, ring->netdev->name);), - -- TP_printk("netdev: %s ring: %pK desc: %pK skb %pK", __get_str(devname), -+ TP_printk("netdev: %s ring: %p desc: %p skb %p", __get_str(devname), - __entry->ring, __entry->desc, __entry->skb) - ); - -@@ -205,7 +205,7 @@ DECLARE_EVENT_CLASS(ice_xmit_template, - __entry->skb = skb; - __assign_str(devname, ring->netdev->name);), - -- TP_printk("netdev: %s skb: %pK ring: %pK", __get_str(devname), -+ TP_printk("netdev: %s skb: %p ring: %p", __get_str(devname), - __entry->skb, __entry->ring) - ); - -@@ -228,7 +228,7 @@ DECLARE_EVENT_CLASS(ice_tx_tstamp_template, - TP_fast_assign(__entry->skb = skb; - __entry->idx = idx;), - -- TP_printk("skb %pK idx %d", -+ TP_printk("skb %p idx %d", - __entry->skb, __entry->idx) - ); - #define DEFINE_TX_TSTAMP_OP_EVENT(name) \ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -index 8705cffc747ffb..29e633e6dd3f04 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -@@ -587,32 +587,55 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev, - struct mlx5_core_dev *mdev = priv->mdev; - u8 max_bw_value[IEEE_8021QAZ_MAX_TCS]; - u8 max_bw_unit[IEEE_8021QAZ_MAX_TCS]; -- __u64 upper_limit_mbps = roundup(255 * MLX5E_100MB, MLX5E_1GB); -+ __u64 upper_limit_mbps; -+ __u64 upper_limit_gbps; - int i; -+ struct { -+ int scale; -+ const char *units_str; -+ } units[] = { -+ [MLX5_100_MBPS_UNIT] = { -+ .scale = 100, -+ .units_str = "Mbps", -+ }, -+ [MLX5_GBPS_UNIT] = { -+ .scale = 1, -+ .units_str = "Gbps", -+ }, -+ }; - - memset(max_bw_value, 0, sizeof(max_bw_value)); - memset(max_bw_unit, 0, sizeof(max_bw_unit)); -+ upper_limit_mbps = 255 * MLX5E_100MB; -+ upper_limit_gbps = 255 * MLX5E_1GB; - - for (i = 0; i <= mlx5_max_tc(mdev); i++) { - if (!maxrate->tc_maxrate[i]) { - max_bw_unit[i] = MLX5_BW_NO_LIMIT; - continue; - } -- if (maxrate->tc_maxrate[i] < upper_limit_mbps) { -+ if (maxrate->tc_maxrate[i] <= upper_limit_mbps) { - max_bw_value[i] = div_u64(maxrate->tc_maxrate[i], - MLX5E_100MB); - max_bw_value[i] = max_bw_value[i] ? max_bw_value[i] : 1; - max_bw_unit[i] = MLX5_100_MBPS_UNIT; -- } else { -+ } else if (max_bw_value[i] <= upper_limit_gbps) { - max_bw_value[i] = div_u64(maxrate->tc_maxrate[i], - MLX5E_1GB); - max_bw_unit[i] = MLX5_GBPS_UNIT; -+ } else { -+ netdev_err(netdev, -+ "tc_%d maxrate %llu Kbps exceeds limit %llu\n", -+ i, maxrate->tc_maxrate[i], -+ upper_limit_gbps); -+ return -EINVAL; - } - } - - for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) { -- netdev_dbg(netdev, "%s: tc_%d <=> max_bw %d Gbps\n", -- __func__, i, max_bw_value[i]); -+ netdev_dbg(netdev, "%s: tc_%d <=> max_bw %u %s\n", __func__, i, -+ max_bw_value[i] * units[max_bw_unit[i]].scale, -+ units[max_bw_unit[i]].units_str); - } - - return mlx5_modify_port_ets_rate_limit(mdev, max_bw_value, max_bw_unit); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -index 54379297a7489e..ccd2ebfd267375 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -@@ -1839,12 +1839,12 @@ static int mlx5e_get_module_eeprom_by_page(struct net_device *netdev, - if (!size_read) - return i; - -- if (size_read == -EINVAL) -- return -EINVAL; - if (size_read < 0) { -- netdev_err(priv->netdev, "%s: mlx5_query_module_eeprom_by_page failed:0x%x\n", -- __func__, size_read); -- return i; -+ NL_SET_ERR_MSG_FMT_MOD( -+ extack, -+ "Query module eeprom by page failed, read %u bytes, err %d\n", -+ i, size_read); -+ return size_read; - } - - i += size_read; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -index fcf7437174e189..1d586451900b8d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -@@ -2321,7 +2321,10 @@ mlx5e_hw_gro_skb_has_enough_space(struct sk_buff *skb, u16 data_bcnt) - { - int nr_frags = skb_shinfo(skb)->nr_frags; - -- return PAGE_SIZE * nr_frags + data_bcnt <= GRO_LEGACY_MAX_SIZE; -+ if (PAGE_SIZE >= GRO_LEGACY_MAX_SIZE) -+ return skb->len + data_bcnt <= GRO_LEGACY_MAX_SIZE; -+ else -+ return PAGE_SIZE * nr_frags + data_bcnt <= GRO_LEGACY_MAX_SIZE; - } - - static void -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c -index 4b96ad657145b8..1c69244e00d75e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c -@@ -1339,16 +1339,13 @@ static void fec_set_rs_stats(struct ethtool_fec_stats *fec_stats, u32 *ppcnt) - } - - static void fec_set_block_stats(struct mlx5e_priv *priv, -+ int mode, - struct ethtool_fec_stats *fec_stats) - { - struct mlx5_core_dev *mdev = priv->mdev; - u32 out[MLX5_ST_SZ_DW(ppcnt_reg)] = {}; - u32 in[MLX5_ST_SZ_DW(ppcnt_reg)] = {}; - int sz = MLX5_ST_SZ_BYTES(ppcnt_reg); -- int mode = fec_active_mode(mdev); -- -- if (mode == MLX5E_FEC_NOFEC) -- return; - - MLX5_SET(ppcnt_reg, in, local_port, 1); - MLX5_SET(ppcnt_reg, in, grp, MLX5_PHYSICAL_LAYER_COUNTERS_GROUP); -@@ -1389,11 +1386,14 @@ static void fec_set_corrected_bits_total(struct mlx5e_priv *priv, - void mlx5e_stats_fec_get(struct mlx5e_priv *priv, - struct ethtool_fec_stats *fec_stats) - { -- if (!MLX5_CAP_PCAM_FEATURE(priv->mdev, ppcnt_statistical_group)) -+ int mode = fec_active_mode(priv->mdev); -+ -+ if (mode == MLX5E_FEC_NOFEC || -+ !MLX5_CAP_PCAM_FEATURE(priv->mdev, ppcnt_statistical_group)) - return; - - fec_set_corrected_bits_total(priv, fec_stats); -- fec_set_block_stats(priv, fec_stats); -+ fec_set_block_stats(priv, mode, fec_stats); - } - - #define PPORT_ETH_EXT_OFF(c) \ -diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c b/drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c -index 06811c60d598e1..df10a0b68a08e6 100644 ---- a/drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c -+++ b/drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c -@@ -294,7 +294,7 @@ static void lan966x_stats_update(struct lan966x *lan966x) - { - int i, j; - -- mutex_lock(&lan966x->stats_lock); -+ spin_lock(&lan966x->stats_lock); - - for (i = 0; i < lan966x->num_phys_ports; i++) { - uint idx = i * lan966x->num_stats; -@@ -310,7 +310,7 @@ static void lan966x_stats_update(struct lan966x *lan966x) - } - } - -- mutex_unlock(&lan966x->stats_lock); -+ spin_unlock(&lan966x->stats_lock); - } - - static int lan966x_get_sset_count(struct net_device *dev, int sset) -@@ -365,7 +365,7 @@ static void lan966x_get_eth_mac_stats(struct net_device *dev, - - idx = port->chip_port * lan966x->num_stats; - -- mutex_lock(&lan966x->stats_lock); -+ spin_lock(&lan966x->stats_lock); - - mac_stats->FramesTransmittedOK = - lan966x->stats[idx + SYS_COUNT_TX_UC] + -@@ -424,7 +424,7 @@ static void lan966x_get_eth_mac_stats(struct net_device *dev, - lan966x->stats[idx + SYS_COUNT_RX_LONG] + - lan966x->stats[idx + SYS_COUNT_RX_PMAC_LONG]; - -- mutex_unlock(&lan966x->stats_lock); -+ spin_unlock(&lan966x->stats_lock); - } - - static const struct ethtool_rmon_hist_range lan966x_rmon_ranges[] = { -@@ -450,7 +450,7 @@ static void lan966x_get_eth_rmon_stats(struct net_device *dev, - - idx = port->chip_port * lan966x->num_stats; - -- mutex_lock(&lan966x->stats_lock); -+ spin_lock(&lan966x->stats_lock); - - rmon_stats->undersize_pkts = - lan966x->stats[idx + SYS_COUNT_RX_SHORT] + -@@ -508,7 +508,7 @@ static void lan966x_get_eth_rmon_stats(struct net_device *dev, - lan966x->stats[idx + SYS_COUNT_TX_SZ_1024_1526] + - lan966x->stats[idx + SYS_COUNT_TX_PMAC_SZ_1024_1526]; - -- mutex_unlock(&lan966x->stats_lock); -+ spin_unlock(&lan966x->stats_lock); - - *ranges = lan966x_rmon_ranges; - } -@@ -614,7 +614,7 @@ void lan966x_stats_get(struct net_device *dev, - - idx = port->chip_port * lan966x->num_stats; - -- mutex_lock(&lan966x->stats_lock); -+ spin_lock(&lan966x->stats_lock); - - stats->rx_bytes = lan966x->stats[idx + SYS_COUNT_RX_OCT] + - lan966x->stats[idx + SYS_COUNT_RX_PMAC_OCT]; -@@ -696,7 +696,7 @@ void lan966x_stats_get(struct net_device *dev, - - stats->collisions = lan966x->stats[idx + SYS_COUNT_TX_COL]; - -- mutex_unlock(&lan966x->stats_lock); -+ spin_unlock(&lan966x->stats_lock); - } - - int lan966x_stats_init(struct lan966x *lan966x) -@@ -712,7 +712,7 @@ int lan966x_stats_init(struct lan966x *lan966x) - return -ENOMEM; - - /* Init stats worker */ -- mutex_init(&lan966x->stats_lock); -+ spin_lock_init(&lan966x->stats_lock); - snprintf(queue_name, sizeof(queue_name), "%s-stats", - dev_name(lan966x->dev)); - lan966x->stats_queue = create_singlethread_workqueue(queue_name); -diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_main.c b/drivers/net/ethernet/microchip/lan966x/lan966x_main.c -index b424e75fd40c46..5466f14e000ce5 100644 ---- a/drivers/net/ethernet/microchip/lan966x/lan966x_main.c -+++ b/drivers/net/ethernet/microchip/lan966x/lan966x_main.c -@@ -1263,7 +1263,6 @@ static int lan966x_probe(struct platform_device *pdev) - - cancel_delayed_work_sync(&lan966x->stats_work); - destroy_workqueue(lan966x->stats_queue); -- mutex_destroy(&lan966x->stats_lock); - - debugfs_remove_recursive(lan966x->debugfs_root); - -@@ -1281,7 +1280,6 @@ static int lan966x_remove(struct platform_device *pdev) - - cancel_delayed_work_sync(&lan966x->stats_work); - destroy_workqueue(lan966x->stats_queue); -- mutex_destroy(&lan966x->stats_lock); - - lan966x_mac_purge_entries(lan966x); - lan966x_mdb_deinit(lan966x); -diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_main.h b/drivers/net/ethernet/microchip/lan966x/lan966x_main.h -index 5a16d76eb000d6..1f5a18b205bf20 100644 ---- a/drivers/net/ethernet/microchip/lan966x/lan966x_main.h -+++ b/drivers/net/ethernet/microchip/lan966x/lan966x_main.h -@@ -347,8 +347,8 @@ struct lan966x { - const struct lan966x_stat_layout *stats_layout; - u32 num_stats; - -- /* workqueue for reading stats */ -- struct mutex stats_lock; -+ /* lock for reading stats */ -+ spinlock_t stats_lock; - u64 *stats; - struct delayed_work stats_work; - struct workqueue_struct *stats_queue; -diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_vcap_impl.c b/drivers/net/ethernet/microchip/lan966x/lan966x_vcap_impl.c -index a4414f63c9b1cc..c266f903ea8a6f 100644 ---- a/drivers/net/ethernet/microchip/lan966x/lan966x_vcap_impl.c -+++ b/drivers/net/ethernet/microchip/lan966x/lan966x_vcap_impl.c -@@ -403,11 +403,11 @@ static void lan966x_es0_read_esdx_counter(struct lan966x *lan966x, - u32 counter; - - id = id & 0xff; /* counter limit */ -- mutex_lock(&lan966x->stats_lock); -+ spin_lock(&lan966x->stats_lock); - lan_wr(SYS_STAT_CFG_STAT_VIEW_SET(id), lan966x, SYS_STAT_CFG); - counter = lan_rd(lan966x, SYS_CNT(LAN966X_STAT_ESDX_GRN_PKTS)) + - lan_rd(lan966x, SYS_CNT(LAN966X_STAT_ESDX_YEL_PKTS)); -- mutex_unlock(&lan966x->stats_lock); -+ spin_unlock(&lan966x->stats_lock); - if (counter) - admin->cache.counter = counter; - } -@@ -417,14 +417,14 @@ static void lan966x_es0_write_esdx_counter(struct lan966x *lan966x, - { - id = id & 0xff; /* counter limit */ - -- mutex_lock(&lan966x->stats_lock); -+ spin_lock(&lan966x->stats_lock); - lan_wr(SYS_STAT_CFG_STAT_VIEW_SET(id), lan966x, SYS_STAT_CFG); - lan_wr(0, lan966x, SYS_CNT(LAN966X_STAT_ESDX_GRN_BYTES)); - lan_wr(admin->cache.counter, lan966x, - SYS_CNT(LAN966X_STAT_ESDX_GRN_PKTS)); - lan_wr(0, lan966x, SYS_CNT(LAN966X_STAT_ESDX_YEL_BYTES)); - lan_wr(0, lan966x, SYS_CNT(LAN966X_STAT_ESDX_YEL_PKTS)); -- mutex_unlock(&lan966x->stats_lock); -+ spin_unlock(&lan966x->stats_lock); - } - - static void lan966x_vcap_cache_write(struct net_device *dev, -diff --git a/drivers/net/ethernet/microchip/sparx5/Kconfig b/drivers/net/ethernet/microchip/sparx5/Kconfig -index f58c506bda228c..15b27fc57aeddb 100644 ---- a/drivers/net/ethernet/microchip/sparx5/Kconfig -+++ b/drivers/net/ethernet/microchip/sparx5/Kconfig -@@ -3,7 +3,7 @@ config SPARX5_SWITCH - depends on NET_SWITCHDEV - depends on HAS_IOMEM - depends on OF -- depends on ARCH_SPARX5 || COMPILE_TEST -+ depends on ARCH_SPARX5 || ARCH_LAN969X || COMPILE_TEST - depends on PTP_1588_CLOCK_OPTIONAL - depends on BRIDGE || BRIDGE=n - select PHYLINK -diff --git a/drivers/net/ethernet/realtek/Kconfig b/drivers/net/ethernet/realtek/Kconfig -index 93d9df55b361a9..01811924c4db43 100644 ---- a/drivers/net/ethernet/realtek/Kconfig -+++ b/drivers/net/ethernet/realtek/Kconfig -@@ -58,7 +58,7 @@ config 8139TOO - config 8139TOO_PIO - bool "Use PIO instead of MMIO" - default y -- depends on 8139TOO -+ depends on 8139TOO && !NO_IOPORT_MAP - help - This instructs the driver to use programmed I/O ports (PIO) instead - of PCI shared memory (MMIO). This can possibly solve some problems -diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c -index 3b90f257e94f85..f4353ccb1b87fb 100644 ---- a/drivers/net/ethernet/realtek/r8169_main.c -+++ b/drivers/net/ethernet/realtek/r8169_main.c -@@ -3362,7 +3362,7 @@ static void rtl_hw_start_8168h_1(struct rtl8169_private *tp) - r8168_mac_ocp_modify(tp, 0xd412, 0x0fff, sw_cnt_1ms_ini); - } - -- r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0070); -+ r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000); - r8168_mac_ocp_modify(tp, 0xe052, 0x6000, 0x8008); - r8168_mac_ocp_modify(tp, 0xe0d6, 0x01ff, 0x017f); - r8168_mac_ocp_modify(tp, 0xd420, 0x0fff, 0x047f); -@@ -3467,7 +3467,7 @@ static void rtl_hw_start_8117(struct rtl8169_private *tp) - r8168_mac_ocp_modify(tp, 0xd412, 0x0fff, sw_cnt_1ms_ini); - } - -- r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0070); -+ r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000); - r8168_mac_ocp_write(tp, 0xea80, 0x0003); - r8168_mac_ocp_modify(tp, 0xe052, 0x0000, 0x0009); - r8168_mac_ocp_modify(tp, 0xd420, 0x0fff, 0x047f); -@@ -3660,7 +3660,7 @@ static void rtl_hw_start_8125_common(struct rtl8169_private *tp) - r8168_mac_ocp_modify(tp, 0xc0b4, 0x0000, 0x000c); - r8168_mac_ocp_modify(tp, 0xeb6a, 0x00ff, 0x0033); - r8168_mac_ocp_modify(tp, 0xeb50, 0x03e0, 0x0040); -- r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0030); -+ r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000); - r8168_mac_ocp_modify(tp, 0xe040, 0x1000, 0x0000); - r8168_mac_ocp_modify(tp, 0xea1c, 0x0003, 0x0001); - r8168_mac_ocp_modify(tp, 0xe0c0, 0x4f0f, 0x4403); -diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c -index 0c0fd68ded423d..4597c4e9b297bc 100644 ---- a/drivers/net/ethernet/renesas/sh_eth.c -+++ b/drivers/net/ethernet/renesas/sh_eth.c -@@ -2360,6 +2360,7 @@ static int sh_eth_set_ringparam(struct net_device *ndev, - return 0; - } - -+#ifdef CONFIG_PM_SLEEP - static void sh_eth_get_wol(struct net_device *ndev, struct ethtool_wolinfo *wol) - { - struct sh_eth_private *mdp = netdev_priv(ndev); -@@ -2386,6 +2387,7 @@ static int sh_eth_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol) - - return 0; - } -+#endif - - static const struct ethtool_ops sh_eth_ethtool_ops = { - .get_regs_len = sh_eth_get_regs_len, -@@ -2401,8 +2403,10 @@ static const struct ethtool_ops sh_eth_ethtool_ops = { - .set_ringparam = sh_eth_set_ringparam, - .get_link_ksettings = phy_ethtool_get_link_ksettings, - .set_link_ksettings = phy_ethtool_set_link_ksettings, -+#ifdef CONFIG_PM_SLEEP - .get_wol = sh_eth_get_wol, - .set_wol = sh_eth_set_wol, -+#endif - }; - - /* network device open function */ -diff --git a/drivers/net/ethernet/sfc/mae.c b/drivers/net/ethernet/sfc/mae.c -index c3e2b4a21d1055..3b08e36e1ef87a 100644 ---- a/drivers/net/ethernet/sfc/mae.c -+++ b/drivers/net/ethernet/sfc/mae.c -@@ -1101,6 +1101,9 @@ void efx_mae_remove_mport(void *desc, void *arg) - kfree(mport); - } - -+/* -+ * Takes ownership of @desc, even if it returns an error -+ */ - static int efx_mae_process_mport(struct efx_nic *efx, - struct mae_mport_desc *desc) - { -@@ -1111,6 +1114,7 @@ static int efx_mae_process_mport(struct efx_nic *efx, - if (!IS_ERR_OR_NULL(mport)) { - netif_err(efx, drv, efx->net_dev, - "mport with id %u does exist!!!\n", desc->mport_id); -+ kfree(desc); - return -EEXIST; - } - -diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c -index cb590db625e837..90a8eb517033e6 100644 ---- a/drivers/net/ethernet/smsc/smsc911x.c -+++ b/drivers/net/ethernet/smsc/smsc911x.c -@@ -2162,10 +2162,20 @@ static const struct net_device_ops smsc911x_netdev_ops = { - static void smsc911x_read_mac_address(struct net_device *dev) - { - struct smsc911x_data *pdata = netdev_priv(dev); -- u32 mac_high16 = smsc911x_mac_read(pdata, ADDRH); -- u32 mac_low32 = smsc911x_mac_read(pdata, ADDRL); -+ u32 mac_high16, mac_low32; - u8 addr[ETH_ALEN]; - -+ mac_high16 = smsc911x_mac_read(pdata, ADDRH); -+ mac_low32 = smsc911x_mac_read(pdata, ADDRL); -+ -+ /* The first mac_read in some setups can incorrectly read 0. Re-read it -+ * to get the full MAC if this is observed. -+ */ -+ if (mac_high16 == 0) { -+ SMSC_TRACE(pdata, probe, "Re-read MAC ADDRH\n"); -+ mac_high16 = smsc911x_mac_read(pdata, ADDRH); -+ } -+ - addr[0] = (u8)(mac_low32); - addr[1] = (u8)(mac_low32 >> 8); - addr[2] = (u8)(mac_low32 >> 16); -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index f3155d69a013c6..56a61599d0b6f3 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -3516,7 +3516,6 @@ static int stmmac_request_irq_multi_msi(struct net_device *dev) - { - struct stmmac_priv *priv = netdev_priv(dev); - enum request_irq_err irq_err; -- cpumask_t cpu_mask; - int irq_idx = 0; - char *int_name; - int ret; -@@ -3628,9 +3627,8 @@ static int stmmac_request_irq_multi_msi(struct net_device *dev) - irq_idx = i; - goto irq_error; - } -- cpumask_clear(&cpu_mask); -- cpumask_set_cpu(i % num_online_cpus(), &cpu_mask); -- irq_set_affinity_hint(priv->rx_irq[i], &cpu_mask); -+ irq_set_affinity_hint(priv->rx_irq[i], -+ cpumask_of(i % num_online_cpus())); - } - - /* Request Tx MSI irq */ -@@ -3653,9 +3651,8 @@ static int stmmac_request_irq_multi_msi(struct net_device *dev) - irq_idx = i; - goto irq_error; - } -- cpumask_clear(&cpu_mask); -- cpumask_set_cpu(i % num_online_cpus(), &cpu_mask); -- irq_set_affinity_hint(priv->tx_irq[i], &cpu_mask); -+ irq_set_affinity_hint(priv->tx_irq[i], -+ cpumask_of(i % num_online_cpus())); - } - - return 0; -@@ -5527,7 +5524,8 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) - stmmac_rx_vlan(priv->dev, skb); - skb->protocol = eth_type_trans(skb, priv->dev); - -- if (unlikely(!coe) || !stmmac_has_ip_ethertype(skb)) -+ if (unlikely(!coe) || !stmmac_has_ip_ethertype(skb) || -+ (status & csum_none)) - skb_checksum_none_assert(skb); - else - skb->ip_summed = CHECKSUM_UNNECESSARY; -@@ -7901,7 +7899,14 @@ int stmmac_resume(struct device *dev) - stmmac_free_tx_skbufs(priv); - stmmac_clear_descriptors(priv, &priv->dma_conf); - -- stmmac_hw_setup(ndev, false); -+ ret = stmmac_hw_setup(ndev, false); -+ if (ret < 0) { -+ netdev_err(priv->dev, "%s: Hw setup failed\n", __func__); -+ mutex_unlock(&priv->lock); -+ rtnl_unlock(); -+ return ret; -+ } -+ - stmmac_init_coalesce(priv); - stmmac_set_rx_mode(ndev); - -diff --git a/drivers/net/ethernet/wangxun/libwx/wx_hw.c b/drivers/net/ethernet/wangxun/libwx/wx_hw.c -index 663a8988d27a73..7feb991a95924f 100644 ---- a/drivers/net/ethernet/wangxun/libwx/wx_hw.c -+++ b/drivers/net/ethernet/wangxun/libwx/wx_hw.c -@@ -1667,7 +1667,8 @@ int wx_sw_init(struct wx *wx) - wx->oem_svid = pdev->subsystem_vendor; - wx->oem_ssid = pdev->subsystem_device; - wx->bus.device = PCI_SLOT(pdev->devfn); -- wx->bus.func = PCI_FUNC(pdev->devfn); -+ wx->bus.func = FIELD_GET(WX_CFG_PORT_ST_LANID, -+ rd32(wx, WX_CFG_PORT_ST)); - - if (wx->oem_svid == PCI_VENDOR_ID_WANGXUN) { - wx->subsystem_vendor_id = pdev->subsystem_vendor; -diff --git a/drivers/net/ethernet/wangxun/libwx/wx_type.h b/drivers/net/ethernet/wangxun/libwx/wx_type.h -index 0fef9dfdd9a6b7..ee95706b446306 100644 ---- a/drivers/net/ethernet/wangxun/libwx/wx_type.h -+++ b/drivers/net/ethernet/wangxun/libwx/wx_type.h -@@ -65,6 +65,8 @@ - #define WX_CFG_PORT_CTL_DRV_LOAD BIT(3) - #define WX_CFG_PORT_CTL_QINQ BIT(2) - #define WX_CFG_PORT_CTL_D_VLAN BIT(0) /* double vlan*/ -+#define WX_CFG_PORT_ST 0x14404 -+#define WX_CFG_PORT_ST_LANID GENMASK(9, 8) - #define WX_CFG_TAG_TPID(_i) (0x14430 + ((_i) * 4)) - #define WX_CFG_PORT_CTL_NUM_VT_MASK GENMASK(13, 12) /* number of TVs */ - -@@ -363,8 +365,6 @@ enum WX_MSCA_CMD_value { - #define TXD_USE_COUNT(S) DIV_ROUND_UP((S), WX_MAX_DATA_PER_TXD) - #define DESC_NEEDED (MAX_SKB_FRAGS + 4) - --#define WX_CFG_PORT_ST 0x14404 -- - /******************* Receive Descriptor bit definitions **********************/ - #define WX_RXD_STAT_DD BIT(0) /* Done */ - #define WX_RXD_STAT_EOP BIT(1) /* End of Packet */ -diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c -index 6ed38a3cdd734e..6cecdfa8631d72 100644 ---- a/drivers/net/hamradio/6pack.c -+++ b/drivers/net/hamradio/6pack.c -@@ -121,8 +121,6 @@ struct sixpack { - - struct timer_list tx_t; - struct timer_list resync_t; -- refcount_t refcnt; -- struct completion dead; - spinlock_t lock; - }; - -@@ -359,42 +357,13 @@ static void sp_bump(struct sixpack *sp, char cmd) - - /* ----------------------------------------------------------------------- */ - --/* -- * We have a potential race on dereferencing tty->disc_data, because the tty -- * layer provides no locking at all - thus one cpu could be running -- * sixpack_receive_buf while another calls sixpack_close, which zeroes -- * tty->disc_data and frees the memory that sixpack_receive_buf is using. The -- * best way to fix this is to use a rwlock in the tty struct, but for now we -- * use a single global rwlock for all ttys in ppp line discipline. -- */ --static DEFINE_RWLOCK(disc_data_lock); -- --static struct sixpack *sp_get(struct tty_struct *tty) --{ -- struct sixpack *sp; -- -- read_lock(&disc_data_lock); -- sp = tty->disc_data; -- if (sp) -- refcount_inc(&sp->refcnt); -- read_unlock(&disc_data_lock); -- -- return sp; --} -- --static void sp_put(struct sixpack *sp) --{ -- if (refcount_dec_and_test(&sp->refcnt)) -- complete(&sp->dead); --} -- - /* - * Called by the TTY driver when there's room for more data. If we have - * more packets to send, we send them here. - */ - static void sixpack_write_wakeup(struct tty_struct *tty) - { -- struct sixpack *sp = sp_get(tty); -+ struct sixpack *sp = tty->disc_data; - int actual; - - if (!sp) -@@ -406,7 +375,7 @@ static void sixpack_write_wakeup(struct tty_struct *tty) - clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); - sp->tx_enable = 0; - netif_wake_queue(sp->dev); -- goto out; -+ return; - } - - if (sp->tx_enable) { -@@ -414,9 +383,6 @@ static void sixpack_write_wakeup(struct tty_struct *tty) - sp->xleft -= actual; - sp->xhead += actual; - } -- --out: -- sp_put(sp); - } - - /* ----------------------------------------------------------------------- */ -@@ -436,7 +402,7 @@ static void sixpack_receive_buf(struct tty_struct *tty, const u8 *cp, - if (!count) - return; - -- sp = sp_get(tty); -+ sp = tty->disc_data; - if (!sp) - return; - -@@ -452,7 +418,6 @@ static void sixpack_receive_buf(struct tty_struct *tty, const u8 *cp, - } - sixpack_decode(sp, cp, count1); - -- sp_put(sp); - tty_unthrottle(tty); - } - -@@ -567,8 +532,6 @@ static int sixpack_open(struct tty_struct *tty) - - spin_lock_init(&sp->lock); - spin_lock_init(&sp->rxlock); -- refcount_set(&sp->refcnt, 1); -- init_completion(&sp->dead); - - /* !!! length of the buffers. MTU is IP MTU, not PACLEN! */ - -@@ -650,19 +613,11 @@ static void sixpack_close(struct tty_struct *tty) - { - struct sixpack *sp; - -- write_lock_irq(&disc_data_lock); - sp = tty->disc_data; -- tty->disc_data = NULL; -- write_unlock_irq(&disc_data_lock); - if (!sp) - return; - -- /* -- * We have now ensured that nobody can start using ap from now on, but -- * we have to wait for all existing users to finish. -- */ -- if (!refcount_dec_and_test(&sp->refcnt)) -- wait_for_completion(&sp->dead); -+ tty->disc_data = NULL; - - /* We must stop the queue to avoid potentially scribbling - * on the free buffers. The sp->dead completion is not sufficient -@@ -686,7 +641,7 @@ static void sixpack_close(struct tty_struct *tty) - static int sixpack_ioctl(struct tty_struct *tty, unsigned int cmd, - unsigned long arg) - { -- struct sixpack *sp = sp_get(tty); -+ struct sixpack *sp = tty->disc_data; - struct net_device *dev; - unsigned int tmp, err; - -@@ -738,8 +693,6 @@ static int sixpack_ioctl(struct tty_struct *tty, unsigned int cmd, - err = tty_mode_ioctl(tty, cmd, arg); - } - -- sp_put(sp); -- - return err; - } - -diff --git a/drivers/net/ipvlan/ipvlan_l3s.c b/drivers/net/ipvlan/ipvlan_l3s.c -index d5b05e8032199a..ca35a50bb64053 100644 ---- a/drivers/net/ipvlan/ipvlan_l3s.c -+++ b/drivers/net/ipvlan/ipvlan_l3s.c -@@ -224,5 +224,4 @@ void ipvlan_l3s_unregister(struct ipvl_port *port) - - dev->priv_flags &= ~IFF_L3MDEV_RX_HANDLER; - ipvlan_unregister_nf_hook(read_pnet(&port->pnet)); -- dev->l3mdev_ops = NULL; - } -diff --git a/drivers/net/mdio/of_mdio.c b/drivers/net/mdio/of_mdio.c -index 7eb32ebb846d86..15b72203a2584e 100644 ---- a/drivers/net/mdio/of_mdio.c -+++ b/drivers/net/mdio/of_mdio.c -@@ -440,6 +440,5 @@ void of_phy_deregister_fixed_link(struct device_node *np) - fixed_phy_unregister(phydev); - - put_device(&phydev->mdio.dev); /* of_phy_find_device() */ -- phy_device_free(phydev); /* fixed_phy_register() */ - } - EXPORT_SYMBOL(of_phy_deregister_fixed_link); -diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c -index e397e7d642d925..a778379108ef13 100644 ---- a/drivers/net/phy/dp83867.c -+++ b/drivers/net/phy/dp83867.c -@@ -774,6 +774,14 @@ static int dp83867_config_init(struct phy_device *phydev) - return ret; - } - -+ /* Although the DP83867 reports EEE capability through the -+ * MDIO_PCS_EEE_ABLE and MDIO_AN_EEE_ADV registers, the feature -+ * is not actually implemented in hardware. -+ */ -+ linkmode_zero(phydev->supported_eee); -+ linkmode_zero(phydev->advertising_eee); -+ phydev->eee_enabled = false; -+ - if (phy_interface_is_rgmii(phydev) || - phydev->interface == PHY_INTERFACE_MODE_SGMII) { - val = phy_read(phydev, MII_DP83867_PHYCTRL); -diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c -index aef739c20ac4d5..4694fb3eaa2ff8 100644 ---- a/drivers/net/phy/fixed_phy.c -+++ b/drivers/net/phy/fixed_phy.c -@@ -329,6 +329,7 @@ void fixed_phy_unregister(struct phy_device *phy) - phy_device_remove(phy); - of_node_put(phy->mdio.dev.of_node); - fixed_phy_del(phy->mdio.addr); -+ phy_device_free(phy); - } - EXPORT_SYMBOL_GPL(fixed_phy_unregister); - -diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c -index eba652a4c1d887..760d0d2f791ca1 100644 ---- a/drivers/net/phy/marvell.c -+++ b/drivers/net/phy/marvell.c -@@ -1802,6 +1802,43 @@ static int marvell_resume(struct phy_device *phydev) - return err; - } - -+/* m88e1510_resume -+ * -+ * The 88e1510 PHY has an erratum where the phy downshift counter is not cleared -+ * after phy being suspended(BMCR_PDOWN set) and then later resumed(BMCR_PDOWN -+ * cleared). This can cause the link to intermittently downshift to a lower speed. -+ * -+ * Disabling and re-enabling the downshift feature clears the counter, allowing -+ * the PHY to retry gigabit link negotiation up to the programmed retry count -+ * before downshifting. This behavior has been observed on copper links. -+ */ -+static int m88e1510_resume(struct phy_device *phydev) -+{ -+ int err; -+ u8 cnt = 0; -+ -+ err = marvell_resume(phydev); -+ if (err < 0) -+ return err; -+ -+ /* read downshift counter value */ -+ err = m88e1011_get_downshift(phydev, &cnt); -+ if (err < 0) -+ return err; -+ -+ if (cnt) { -+ /* downshift disabled */ -+ err = m88e1011_set_downshift(phydev, 0); -+ if (err < 0) -+ return err; -+ -+ /* downshift enabled, with previous counter value */ -+ err = m88e1011_set_downshift(phydev, cnt); -+ } -+ -+ return err; -+} -+ - static int marvell_aneg_done(struct phy_device *phydev) - { - int retval = phy_read(phydev, MII_M1011_PHY_STATUS); -@@ -3506,7 +3543,7 @@ static struct phy_driver marvell_drivers[] = { - .handle_interrupt = marvell_handle_interrupt, - .get_wol = m88e1318_get_wol, - .set_wol = m88e1318_set_wol, -- .resume = marvell_resume, -+ .resume = m88e1510_resume, - .suspend = marvell_suspend, - .read_page = marvell_read_page, - .write_page = marvell_write_page, -diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c -index f1fac89721ed93..7da30a6752beef 100644 ---- a/drivers/net/phy/mdio_bus.c -+++ b/drivers/net/phy/mdio_bus.c -@@ -81,8 +81,11 @@ int mdiobus_register_device(struct mdio_device *mdiodev) - return err; - - err = mdiobus_register_reset(mdiodev); -- if (err) -+ if (err) { -+ gpiod_put(mdiodev->reset_gpio); -+ mdiodev->reset_gpio = NULL; - return err; -+ } - - /* Assert the reset signal */ - mdio_device_reset(mdiodev, 1); -diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c -index df54c137c5f5f8..cf171bdd667aa8 100644 ---- a/drivers/net/phy/phy.c -+++ b/drivers/net/phy/phy.c -@@ -1482,6 +1482,19 @@ void phy_state_machine(struct work_struct *work) - } - break; - case PHY_HALTED: -+ if (phydev->link) { -+ if (phydev->autoneg == AUTONEG_ENABLE) { -+ phydev->speed = SPEED_UNKNOWN; -+ phydev->duplex = DUPLEX_UNKNOWN; -+ } -+ if (phydev->master_slave_state != -+ MASTER_SLAVE_STATE_UNSUPPORTED) -+ phydev->master_slave_state = -+ MASTER_SLAVE_STATE_UNKNOWN; -+ phydev->mdix = ETH_TP_MDI_INVALID; -+ linkmode_zero(phydev->lp_advertising); -+ } -+ fallthrough; - case PHY_ERROR: - if (phydev->link) { - phydev->link = 0; -diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c -index 0516ef71a64cb0..f70b8ab0ccd264 100644 ---- a/drivers/net/usb/asix_devices.c -+++ b/drivers/net/usb/asix_devices.c -@@ -230,7 +230,9 @@ static int ax88172_bind(struct usbnet *dev, struct usb_interface *intf) - int i; - unsigned long gpio_bits = dev->driver_info->data; - -- usbnet_get_endpoints(dev,intf); -+ ret = usbnet_get_endpoints(dev, intf); -+ if (ret) -+ goto out; - - /* Toggle the GPIOs in a manufacturer/model specific way */ - for (i = 2; i >= 0; i--) { -@@ -848,7 +850,9 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf) - - dev->driver_priv = priv; - -- usbnet_get_endpoints(dev, intf); -+ ret = usbnet_get_endpoints(dev, intf); -+ if (ret) -+ return ret; - - /* Maybe the boot loader passed the MAC address via device tree */ - if (!eth_platform_get_mac_address(&dev->udev->dev, buf)) { -@@ -1281,7 +1285,9 @@ static int ax88178_bind(struct usbnet *dev, struct usb_interface *intf) - int ret; - u8 buf[ETH_ALEN] = {0}; - -- usbnet_get_endpoints(dev,intf); -+ ret = usbnet_get_endpoints(dev, intf); -+ if (ret) -+ return ret; - - /* Get the MAC address */ - ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf, 0); -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index eba755b584a459..73df808978b207 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -192,6 +192,12 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb) - if (!skbn) - return 0; - -+ /* Raw IP packets don't have a MAC header, but other subsystems -+ * (like xfrm) may still access MAC header offsets, so they must -+ * be initialized. -+ */ -+ skb_reset_mac_header(skbn); -+ - switch (skb->data[offset + qmimux_hdr_sz] & 0xf0) { - case 0x40: - skbn->protocol = htons(ETH_P_IP); -diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c -index fd6b5865ac5135..e6a1864f03f948 100644 ---- a/drivers/net/usb/usbnet.c -+++ b/drivers/net/usb/usbnet.c -@@ -1650,6 +1650,8 @@ void usbnet_disconnect (struct usb_interface *intf) - net = dev->net; - unregister_netdev (net); - -+ cancel_work_sync(&dev->kevent); -+ - while ((urb = usb_get_from_anchor(&dev->deferred))) { - dev_kfree_skb(urb->context); - kfree(urb->sg); -diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c -index 5a949f9446a8ed..caae11ba2f8bed 100644 ---- a/drivers/net/virtio_net.c -+++ b/drivers/net/virtio_net.c -@@ -591,17 +591,6 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi, - goto ok; - } - -- /* -- * Verify that we can indeed put this data into a skb. -- * This is here to handle cases when the device erroneously -- * tries to receive more than is possible. This is usually -- * the case of a broken device. -- */ -- if (unlikely(len > MAX_SKB_FRAGS * PAGE_SIZE)) { -- net_dbg_ratelimited("%s: too much data\n", skb->dev->name); -- dev_kfree_skb(skb); -- return NULL; -- } - BUG_ON(offset >= PAGE_SIZE); - while (len) { - unsigned int frag_size = min((unsigned)PAGE_SIZE - offset, len); -@@ -1344,9 +1333,19 @@ static struct sk_buff *receive_big(struct net_device *dev, - struct virtnet_rq_stats *stats) - { - struct page *page = buf; -- struct sk_buff *skb = -- page_to_skb(vi, rq, page, 0, len, PAGE_SIZE, 0); -+ struct sk_buff *skb; -+ -+ /* Make sure that len does not exceed the size allocated in -+ * add_recvbuf_big. -+ */ -+ if (unlikely(len > (vi->big_packets_num_skbfrags + 1) * PAGE_SIZE)) { -+ pr_debug("%s: rx error: len %u exceeds allocated size %lu\n", -+ dev->name, len, -+ (vi->big_packets_num_skbfrags + 1) * PAGE_SIZE); -+ goto err; -+ } - -+ skb = page_to_skb(vi, rq, page, 0, len, PAGE_SIZE, 0); - u64_stats_add(&stats->bytes, len - vi->hdr_len); - if (unlikely(!skb)) - goto err; -@@ -1822,22 +1821,28 @@ static void receive_buf(struct virtnet_info *vi, struct receive_queue *rq, - return; - } - -- /* 1. Save the flags early, as the XDP program might overwrite them. -+ /* About the flags below: -+ * 1. Save the flags early, as the XDP program might overwrite them. - * These flags ensure packets marked as VIRTIO_NET_HDR_F_DATA_VALID - * stay valid after XDP processing. - * 2. XDP doesn't work with partially checksummed packets (refer to - * virtnet_xdp_set()), so packets marked as - * VIRTIO_NET_HDR_F_NEEDS_CSUM get dropped during XDP processing. - */ -- flags = ((struct virtio_net_common_hdr *)buf)->hdr.flags; - -- if (vi->mergeable_rx_bufs) -+ if (vi->mergeable_rx_bufs) { -+ flags = ((struct virtio_net_common_hdr *)buf)->hdr.flags; - skb = receive_mergeable(dev, vi, rq, buf, ctx, len, xdp_xmit, - stats); -- else if (vi->big_packets) -+ } else if (vi->big_packets) { -+ void *p = page_address((struct page *)buf); -+ -+ flags = ((struct virtio_net_common_hdr *)p)->hdr.flags; - skb = receive_big(dev, vi, rq, buf, len, stats); -- else -+ } else { -+ flags = ((struct virtio_net_common_hdr *)buf)->hdr.flags; - skb = receive_small(dev, vi, rq, buf, ctx, len, xdp_xmit, stats); -+ } - - if (unlikely(!skb)) - return; -diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c -index 655fb5cdf01f86..233e5c619fa4ee 100644 ---- a/drivers/net/wireless/ath/ath10k/mac.c -+++ b/drivers/net/wireless/ath/ath10k/mac.c -@@ -14,6 +14,7 @@ - #include - #include - #include -+#include - - #include "hif.h" - #include "core.h" -@@ -287,8 +288,15 @@ static int ath10k_send_key(struct ath10k_vif *arvif, - key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV; - - if (cmd == DISABLE_KEY) { -- arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE]; -- arg.key_data = NULL; -+ if (flags & WMI_KEY_GROUP) { -+ /* Not all hardware handles group-key deletion operation -+ * correctly. Replace the key with a junk value to invalidate it. -+ */ -+ get_random_bytes(key->key, key->keylen); -+ } else { -+ arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE]; -+ arg.key_data = NULL; -+ } - } - - return ath10k_wmi_vdev_install_key(arvif->ar, &arg); -diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c -index 340502c47a10d6..c7c96d210061d1 100644 ---- a/drivers/net/wireless/ath/ath10k/wmi.c -+++ b/drivers/net/wireless/ath/ath10k/wmi.c -@@ -1763,32 +1763,33 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch, - - int ath10k_wmi_wait_for_service_ready(struct ath10k *ar) - { -- unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ; - unsigned long time_left, i; - -- /* Sometimes the PCI HIF doesn't receive interrupt -- * for the service ready message even if the buffer -- * was completed. PCIe sniffer shows that it's -- * because the corresponding CE ring doesn't fires -- * it. Workaround here by polling CE rings. Since -- * the message could arrive at any time, continue -- * polling until timeout. -- */ -- do { -+ time_left = wait_for_completion_timeout(&ar->wmi.service_ready, -+ WMI_SERVICE_READY_TIMEOUT_HZ); -+ if (!time_left) { -+ /* Sometimes the PCI HIF doesn't receive interrupt -+ * for the service ready message even if the buffer -+ * was completed. PCIe sniffer shows that it's -+ * because the corresponding CE ring doesn't fires -+ * it. Workaround here by polling CE rings once. -+ */ -+ ath10k_warn(ar, "failed to receive service ready completion, polling..\n"); -+ - for (i = 0; i < CE_COUNT; i++) - ath10k_hif_send_complete_check(ar, i, 1); - -- /* The 100 ms granularity is a tradeoff considering scheduler -- * overhead and response latency -- */ - time_left = wait_for_completion_timeout(&ar->wmi.service_ready, -- msecs_to_jiffies(100)); -- if (time_left) -- return 0; -- } while (time_before(jiffies, timeout)); -+ WMI_SERVICE_READY_TIMEOUT_HZ); -+ if (!time_left) { -+ ath10k_warn(ar, "polling timed out\n"); -+ return -ETIMEDOUT; -+ } - -- ath10k_warn(ar, "failed to receive service ready completion\n"); -- return -ETIMEDOUT; -+ ath10k_warn(ar, "service ready completion received, continuing normally\n"); -+ } -+ -+ return 0; - } - - int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar) -@@ -1936,6 +1937,7 @@ int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id) - if (cmd_id == WMI_CMD_UNSUPPORTED) { - ath10k_warn(ar, "wmi command %d is not supported by firmware\n", - cmd_id); -+ dev_kfree_skb_any(skb); - return ret; - } - -diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c -index 3a340cb2b205f4..355424baeedde2 100644 ---- a/drivers/net/wireless/ath/ath11k/core.c -+++ b/drivers/net/wireless/ath/ath11k/core.c -@@ -707,42 +707,84 @@ static const struct ath11k_hw_params ath11k_hw_params[] = { - static const struct dmi_system_id ath11k_pm_quirk_table[] = { - { - .driver_data = (void *)ATH11K_PM_WOW, -- .matches = { -+ .matches = { /* X13 G4 AMD #1 */ -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "21J3"), -+ }, -+ }, -+ { -+ .driver_data = (void *)ATH11K_PM_WOW, -+ .matches = { /* X13 G4 AMD #2 */ - DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), - DMI_MATCH(DMI_PRODUCT_NAME, "21J4"), - }, - }, - { - .driver_data = (void *)ATH11K_PM_WOW, -- .matches = { -+ .matches = { /* T14 G4 AMD #1 */ -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "21K3"), -+ }, -+ }, -+ { -+ .driver_data = (void *)ATH11K_PM_WOW, -+ .matches = { /* T14 G4 AMD #2 */ - DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), - DMI_MATCH(DMI_PRODUCT_NAME, "21K4"), - }, - }, - { - .driver_data = (void *)ATH11K_PM_WOW, -- .matches = { -+ .matches = { /* P14s G4 AMD #1 */ -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "21K5"), -+ }, -+ }, -+ { -+ .driver_data = (void *)ATH11K_PM_WOW, -+ .matches = { /* P14s G4 AMD #2 */ - DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), - DMI_MATCH(DMI_PRODUCT_NAME, "21K6"), - }, - }, - { - .driver_data = (void *)ATH11K_PM_WOW, -- .matches = { -+ .matches = { /* T16 G2 AMD #1 */ -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "21K7"), -+ }, -+ }, -+ { -+ .driver_data = (void *)ATH11K_PM_WOW, -+ .matches = { /* T16 G2 AMD #2 */ - DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), - DMI_MATCH(DMI_PRODUCT_NAME, "21K8"), - }, - }, - { - .driver_data = (void *)ATH11K_PM_WOW, -- .matches = { -+ .matches = { /* P16s G2 AMD #1 */ -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "21K9"), -+ }, -+ }, -+ { -+ .driver_data = (void *)ATH11K_PM_WOW, -+ .matches = { /* P16s G2 AMD #2 */ - DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), - DMI_MATCH(DMI_PRODUCT_NAME, "21KA"), - }, - }, - { - .driver_data = (void *)ATH11K_PM_WOW, -- .matches = { -+ .matches = { /* T14s G4 AMD #1 */ -+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "21F8"), -+ }, -+ }, -+ { -+ .driver_data = (void *)ATH11K_PM_WOW, -+ .matches = { /* T14s G4 AMD #2 */ - DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), - DMI_MATCH(DMI_PRODUCT_NAME, "21F9"), - }, -diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c -index 31dbabc9eaf330..16687223bdcba6 100644 ---- a/drivers/net/wireless/ath/ath11k/wmi.c -+++ b/drivers/net/wireless/ath/ath11k/wmi.c -@@ -5841,6 +5841,9 @@ static int wmi_process_mgmt_tx_comp(struct ath11k *ar, - dma_unmap_single(ar->ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE); - - info = IEEE80211_SKB_CB(msdu); -+ memset(&info->status, 0, sizeof(info->status)); -+ info->status.rates[0].idx = -1; -+ - if ((!(info->flags & IEEE80211_TX_CTL_NO_ACK)) && - !tx_compl_param->status) { - info->flags |= IEEE80211_TX_STAT_ACK; -diff --git a/drivers/net/wireless/ath/ath12k/dp.h b/drivers/net/wireless/ath/ath12k/dp.h -index 61f765432516bb..284032db0b98d2 100644 ---- a/drivers/net/wireless/ath/ath12k/dp.h -+++ b/drivers/net/wireless/ath/ath12k/dp.h -@@ -162,7 +162,7 @@ struct ath12k_pdev_dp { - #define DP_REO_REINJECT_RING_SIZE 32 - #define DP_RX_RELEASE_RING_SIZE 1024 - #define DP_REO_EXCEPTION_RING_SIZE 128 --#define DP_REO_CMD_RING_SIZE 128 -+#define DP_REO_CMD_RING_SIZE 256 - #define DP_REO_STATUS_RING_SIZE 2048 - #define DP_RXDMA_BUF_RING_SIZE 4096 - #define DP_RXDMA_REFILL_RING_SIZE 2048 -diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c -index e1db6e69d22076..010413bfdb1412 100644 ---- a/drivers/net/wireless/ath/ath12k/mac.c -+++ b/drivers/net/wireless/ath/ath12k/mac.c -@@ -4743,23 +4743,32 @@ static void ath12k_mgmt_over_wmi_tx_drop(struct ath12k *ar, struct sk_buff *skb) - wake_up(&ar->txmgmt_empty_waitq); - } - --int ath12k_mac_tx_mgmt_pending_free(int buf_id, void *skb, void *ctx) -+static void ath12k_mac_tx_mgmt_free(struct ath12k *ar, int buf_id) - { -- struct sk_buff *msdu = skb; -+ struct sk_buff *msdu; - struct ieee80211_tx_info *info; -- struct ath12k *ar = ctx; -- struct ath12k_base *ab = ar->ab; - - spin_lock_bh(&ar->txmgmt_idr_lock); -- idr_remove(&ar->txmgmt_idr, buf_id); -+ msdu = idr_remove(&ar->txmgmt_idr, buf_id); - spin_unlock_bh(&ar->txmgmt_idr_lock); -- dma_unmap_single(ab->dev, ATH12K_SKB_CB(msdu)->paddr, msdu->len, -+ -+ if (!msdu) -+ return; -+ -+ dma_unmap_single(ar->ab->dev, ATH12K_SKB_CB(msdu)->paddr, msdu->len, - DMA_TO_DEVICE); - - info = IEEE80211_SKB_CB(msdu); - memset(&info->status, 0, sizeof(info->status)); - -- ath12k_mgmt_over_wmi_tx_drop(ar, skb); -+ ath12k_mgmt_over_wmi_tx_drop(ar, msdu); -+} -+ -+int ath12k_mac_tx_mgmt_pending_free(int buf_id, void *skb, void *ctx) -+{ -+ struct ath12k *ar = ctx; -+ -+ ath12k_mac_tx_mgmt_free(ar, buf_id); - - return 0; - } -@@ -4768,17 +4777,10 @@ static int ath12k_mac_vif_txmgmt_idr_remove(int buf_id, void *skb, void *ctx) - { - struct ieee80211_vif *vif = ctx; - struct ath12k_skb_cb *skb_cb = ATH12K_SKB_CB(skb); -- struct sk_buff *msdu = skb; - struct ath12k *ar = skb_cb->ar; -- struct ath12k_base *ab = ar->ab; - -- if (skb_cb->vif == vif) { -- spin_lock_bh(&ar->txmgmt_idr_lock); -- idr_remove(&ar->txmgmt_idr, buf_id); -- spin_unlock_bh(&ar->txmgmt_idr_lock); -- dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, -- DMA_TO_DEVICE); -- } -+ if (skb_cb->vif == vif) -+ ath12k_mac_tx_mgmt_free(ar, buf_id); - - return 0; - } -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -index e883cf80f506d1..c7f62226ebbcc5 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -@@ -5594,8 +5594,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev, - brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n", - *cookie, le16_to_cpu(action_frame->len), freq); - -- ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg), -- af_params); -+ ack = brcmf_p2p_send_action_frame(vif->ifp, af_params); - - cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack, - GFP_KERNEL); -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c -index d4492d02e4ea12..33f27c83c33ebc 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c -@@ -1529,6 +1529,7 @@ int brcmf_p2p_notify_action_tx_complete(struct brcmf_if *ifp, - /** - * brcmf_p2p_tx_action_frame() - send action frame over fil. - * -+ * @ifp: interface to transmit on. - * @p2p: p2p info struct for vif. - * @af_params: action frame data/info. - * -@@ -1538,12 +1539,11 @@ int brcmf_p2p_notify_action_tx_complete(struct brcmf_if *ifp, - * The WLC_E_ACTION_FRAME_COMPLETE event will be received when the action - * frame is transmitted. - */ --static s32 brcmf_p2p_tx_action_frame(struct brcmf_p2p_info *p2p, -+static s32 brcmf_p2p_tx_action_frame(struct brcmf_if *ifp, -+ struct brcmf_p2p_info *p2p, - struct brcmf_fil_af_params_le *af_params) - { - struct brcmf_pub *drvr = p2p->cfg->pub; -- struct brcmf_cfg80211_vif *vif; -- struct brcmf_p2p_action_frame *p2p_af; - s32 err = 0; - - brcmf_dbg(TRACE, "Enter\n"); -@@ -1552,14 +1552,7 @@ static s32 brcmf_p2p_tx_action_frame(struct brcmf_p2p_info *p2p, - clear_bit(BRCMF_P2P_STATUS_ACTION_TX_COMPLETED, &p2p->status); - clear_bit(BRCMF_P2P_STATUS_ACTION_TX_NOACK, &p2p->status); - -- /* check if it is a p2p_presence response */ -- p2p_af = (struct brcmf_p2p_action_frame *)af_params->action_frame.data; -- if (p2p_af->subtype == P2P_AF_PRESENCE_RSP) -- vif = p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif; -- else -- vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif; -- -- err = brcmf_fil_bsscfg_data_set(vif->ifp, "actframe", af_params, -+ err = brcmf_fil_bsscfg_data_set(ifp, "actframe", af_params, - sizeof(*af_params)); - if (err) { - bphy_err(drvr, " sending action frame has failed\n"); -@@ -1711,16 +1704,14 @@ static bool brcmf_p2p_check_dwell_overflow(u32 requested_dwell, - /** - * brcmf_p2p_send_action_frame() - send action frame . - * -- * @cfg: driver private data for cfg80211 interface. -- * @ndev: net device to transmit on. -+ * @ifp: interface to transmit on. - * @af_params: configuration data for action frame. - */ --bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg, -- struct net_device *ndev, -+bool brcmf_p2p_send_action_frame(struct brcmf_if *ifp, - struct brcmf_fil_af_params_le *af_params) - { -+ struct brcmf_cfg80211_info *cfg = ifp->drvr->config; - struct brcmf_p2p_info *p2p = &cfg->p2p; -- struct brcmf_if *ifp = netdev_priv(ndev); - struct brcmf_fil_action_frame_le *action_frame; - struct brcmf_config_af_params config_af_params; - struct afx_hdl *afx_hdl = &p2p->afx_hdl; -@@ -1857,7 +1848,7 @@ bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg, - if (af_params->channel) - msleep(P2P_AF_RETRY_DELAY_TIME); - -- ack = !brcmf_p2p_tx_action_frame(p2p, af_params); -+ ack = !brcmf_p2p_tx_action_frame(ifp, p2p, af_params); - tx_retry++; - dwell_overflow = brcmf_p2p_check_dwell_overflow(requested_dwell, - dwell_jiffies); -@@ -2217,7 +2208,6 @@ static struct wireless_dev *brcmf_p2p_create_p2pdev(struct brcmf_p2p_info *p2p, - - WARN_ON(p2p_ifp->bsscfgidx != bsscfgidx); - -- init_completion(&p2p->send_af_done); - INIT_WORK(&p2p->afx_hdl.afx_work, brcmf_p2p_afx_handler); - init_completion(&p2p->afx_hdl.act_frm_scan); - init_completion(&p2p->wait_next_af); -@@ -2513,6 +2503,8 @@ s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg, bool p2pdev_forced) - pri_ifp = brcmf_get_ifp(cfg->pub, 0); - p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif = pri_ifp->vif; - -+ init_completion(&p2p->send_af_done); -+ - if (p2pdev_forced) { - err_ptr = brcmf_p2p_create_p2pdev(p2p, NULL, NULL); - if (IS_ERR(err_ptr)) { -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h -index d2ecee565bf2e2..d3137ebd715825 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h -@@ -168,8 +168,7 @@ int brcmf_p2p_notify_action_frame_rx(struct brcmf_if *ifp, - int brcmf_p2p_notify_action_tx_complete(struct brcmf_if *ifp, - const struct brcmf_event_msg *e, - void *data); --bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg, -- struct net_device *ndev, -+bool brcmf_p2p_send_action_frame(struct brcmf_if *ifp, - struct brcmf_fil_af_params_le *af_params); - bool brcmf_p2p_scan_finding_common_channel(struct brcmf_cfg80211_info *cfg, - struct brcmf_bss_info_le *bi); -diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c -index 15b7d22d3639f2..ae7a01c7ce36d6 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c -@@ -135,6 +135,8 @@ mt7921_init_he_caps(struct mt792x_phy *phy, enum nl80211_band band, - if (is_mt7922(phy->mt76->dev)) { - he_cap_elem->phy_cap_info[0] |= - IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G; -+ he_cap_elem->phy_cap_info[4] |= -+ IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_4; - he_cap_elem->phy_cap_info[8] |= - IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU | - IEEE80211_HE_PHY_CAP8_80MHZ_IN_160MHZ_HE_PPDU; -diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c -index 375a3d6f4b384b..fa81a1c30704bd 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c -@@ -730,7 +730,6 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band, - eht_cap->has_eht = true; - - eht_cap_elem->mac_cap_info[0] = -- IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS | - IEEE80211_EHT_MAC_CAP0_OM_CONTROL | - u8_encode_bits(IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_11454, - IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK); -diff --git a/drivers/net/wireless/realtek/rtw88/sdio.c b/drivers/net/wireless/realtek/rtw88/sdio.c -index 832a427279b40a..df4248744d87a0 100644 ---- a/drivers/net/wireless/realtek/rtw88/sdio.c -+++ b/drivers/net/wireless/realtek/rtw88/sdio.c -@@ -143,6 +143,10 @@ static u32 rtw_sdio_to_io_address(struct rtw_dev *rtwdev, u32 addr, - - static bool rtw_sdio_use_direct_io(struct rtw_dev *rtwdev, u32 addr) - { -+ if (!test_bit(RTW_FLAG_POWERON, rtwdev->flags) && -+ !rtw_sdio_is_bus_addr(addr)) -+ return false; -+ - return !rtw_sdio_is_sdio30_supported(rtwdev) || - rtw_sdio_is_bus_addr(addr); - } -diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c -index f5f48f7e6d26e3..1214e7dcc81249 100644 ---- a/drivers/net/wireless/virtual/mac80211_hwsim.c -+++ b/drivers/net/wireless/virtual/mac80211_hwsim.c -@@ -6189,14 +6189,15 @@ static struct genl_family hwsim_genl_family __ro_after_init = { - .n_mcgrps = ARRAY_SIZE(hwsim_mcgrps), - }; - --static void remove_user_radios(u32 portid) -+static void remove_user_radios(u32 portid, int netgroup) - { - struct mac80211_hwsim_data *entry, *tmp; - LIST_HEAD(list); - - spin_lock_bh(&hwsim_radio_lock); - list_for_each_entry_safe(entry, tmp, &hwsim_radios, list) { -- if (entry->destroy_on_close && entry->portid == portid) { -+ if (entry->destroy_on_close && entry->portid == portid && -+ entry->netgroup == netgroup) { - list_move(&entry->list, &list); - rhashtable_remove_fast(&hwsim_radios_rht, &entry->rht, - hwsim_rht_params); -@@ -6221,7 +6222,7 @@ static int mac80211_hwsim_netlink_notify(struct notifier_block *nb, - if (state != NETLINK_URELEASE) - return NOTIFY_DONE; - -- remove_user_radios(notify->portid); -+ remove_user_radios(notify->portid, hwsim_net_get_netgroup(notify->net)); - - if (notify->portid == hwsim_net_get_wmediumd(notify->net)) { - printk(KERN_INFO "mac80211_hwsim: wmediumd released netlink" -diff --git a/drivers/ntb/hw/epf/ntb_hw_epf.c b/drivers/ntb/hw/epf/ntb_hw_epf.c -index b640aa0bf45e61..5e79cfce8649c1 100644 ---- a/drivers/ntb/hw/epf/ntb_hw_epf.c -+++ b/drivers/ntb/hw/epf/ntb_hw_epf.c -@@ -49,6 +49,7 @@ - #define NTB_EPF_COMMAND_TIMEOUT 1000 /* 1 Sec */ - - enum pci_barno { -+ NO_BAR = -1, - BAR_0, - BAR_1, - BAR_2, -@@ -57,16 +58,26 @@ enum pci_barno { - BAR_5, - }; - -+enum epf_ntb_bar { -+ BAR_CONFIG, -+ BAR_PEER_SPAD, -+ BAR_DB, -+ BAR_MW1, -+ BAR_MW2, -+ BAR_MW3, -+ BAR_MW4, -+ NTB_BAR_NUM, -+}; -+ -+#define NTB_EPF_MAX_MW_COUNT (NTB_BAR_NUM - BAR_MW1) -+ - struct ntb_epf_dev { - struct ntb_dev ntb; - struct device *dev; - /* Mutex to protect providing commands to NTB EPF */ - struct mutex cmd_lock; - -- enum pci_barno ctrl_reg_bar; -- enum pci_barno peer_spad_reg_bar; -- enum pci_barno db_reg_bar; -- enum pci_barno mw_bar; -+ const enum pci_barno *barno_map; - - unsigned int mw_count; - unsigned int spad_count; -@@ -85,17 +96,6 @@ struct ntb_epf_dev { - - #define ntb_ndev(__ntb) container_of(__ntb, struct ntb_epf_dev, ntb) - --struct ntb_epf_data { -- /* BAR that contains both control region and self spad region */ -- enum pci_barno ctrl_reg_bar; -- /* BAR that contains peer spad region */ -- enum pci_barno peer_spad_reg_bar; -- /* BAR that contains Doorbell region and Memory window '1' */ -- enum pci_barno db_reg_bar; -- /* BAR that contains memory windows*/ -- enum pci_barno mw_bar; --}; -- - static int ntb_epf_send_command(struct ntb_epf_dev *ndev, u32 command, - u32 argument) - { -@@ -144,7 +144,7 @@ static int ntb_epf_mw_to_bar(struct ntb_epf_dev *ndev, int idx) - return -EINVAL; - } - -- return idx + 2; -+ return ndev->barno_map[BAR_MW1 + idx]; - } - - static int ntb_epf_mw_count(struct ntb_dev *ntb, int pidx) -@@ -413,7 +413,9 @@ static int ntb_epf_mw_set_trans(struct ntb_dev *ntb, int pidx, int idx, - return -EINVAL; - } - -- bar = idx + ndev->mw_bar; -+ bar = ntb_epf_mw_to_bar(ndev, idx); -+ if (bar < 0) -+ return bar; - - mw_size = pci_resource_len(ntb->pdev, bar); - -@@ -455,7 +457,9 @@ static int ntb_epf_peer_mw_get_addr(struct ntb_dev *ntb, int idx, - if (idx == 0) - offset = readl(ndev->ctrl_reg + NTB_EPF_MW1_OFFSET); - -- bar = idx + ndev->mw_bar; -+ bar = ntb_epf_mw_to_bar(ndev, idx); -+ if (bar < 0) -+ return bar; - - if (base) - *base = pci_resource_start(ndev->ntb.pdev, bar) + offset; -@@ -560,6 +564,11 @@ static int ntb_epf_init_dev(struct ntb_epf_dev *ndev) - ndev->mw_count = readl(ndev->ctrl_reg + NTB_EPF_MW_COUNT); - ndev->spad_count = readl(ndev->ctrl_reg + NTB_EPF_SPAD_COUNT); - -+ if (ndev->mw_count > NTB_EPF_MAX_MW_COUNT) { -+ dev_err(dev, "Unsupported MW count: %u\n", ndev->mw_count); -+ return -EINVAL; -+ } -+ - return 0; - } - -@@ -596,14 +605,15 @@ static int ntb_epf_init_pci(struct ntb_epf_dev *ndev, - dev_warn(&pdev->dev, "Cannot DMA highmem\n"); - } - -- ndev->ctrl_reg = pci_iomap(pdev, ndev->ctrl_reg_bar, 0); -+ ndev->ctrl_reg = pci_iomap(pdev, ndev->barno_map[BAR_CONFIG], 0); - if (!ndev->ctrl_reg) { - ret = -EIO; - goto err_pci_regions; - } - -- if (ndev->peer_spad_reg_bar) { -- ndev->peer_spad_reg = pci_iomap(pdev, ndev->peer_spad_reg_bar, 0); -+ if (ndev->barno_map[BAR_PEER_SPAD] != ndev->barno_map[BAR_CONFIG]) { -+ ndev->peer_spad_reg = pci_iomap(pdev, -+ ndev->barno_map[BAR_PEER_SPAD], 0); - if (!ndev->peer_spad_reg) { - ret = -EIO; - goto err_pci_regions; -@@ -614,7 +624,7 @@ static int ntb_epf_init_pci(struct ntb_epf_dev *ndev, - ndev->peer_spad_reg = ndev->ctrl_reg + spad_off + spad_sz; - } - -- ndev->db_reg = pci_iomap(pdev, ndev->db_reg_bar, 0); -+ ndev->db_reg = pci_iomap(pdev, ndev->barno_map[BAR_DB], 0); - if (!ndev->db_reg) { - ret = -EIO; - goto err_pci_regions; -@@ -659,12 +669,7 @@ static void ntb_epf_cleanup_isr(struct ntb_epf_dev *ndev) - static int ntb_epf_pci_probe(struct pci_dev *pdev, - const struct pci_device_id *id) - { -- enum pci_barno peer_spad_reg_bar = BAR_1; -- enum pci_barno ctrl_reg_bar = BAR_0; -- enum pci_barno db_reg_bar = BAR_2; -- enum pci_barno mw_bar = BAR_2; - struct device *dev = &pdev->dev; -- struct ntb_epf_data *data; - struct ntb_epf_dev *ndev; - int ret; - -@@ -675,18 +680,10 @@ static int ntb_epf_pci_probe(struct pci_dev *pdev, - if (!ndev) - return -ENOMEM; - -- data = (struct ntb_epf_data *)id->driver_data; -- if (data) { -- peer_spad_reg_bar = data->peer_spad_reg_bar; -- ctrl_reg_bar = data->ctrl_reg_bar; -- db_reg_bar = data->db_reg_bar; -- mw_bar = data->mw_bar; -- } -+ ndev->barno_map = (const enum pci_barno *)id->driver_data; -+ if (!ndev->barno_map) -+ return -EINVAL; - -- ndev->peer_spad_reg_bar = peer_spad_reg_bar; -- ndev->ctrl_reg_bar = ctrl_reg_bar; -- ndev->db_reg_bar = db_reg_bar; -- ndev->mw_bar = mw_bar; - ndev->dev = dev; - - ntb_epf_init_struct(ndev, pdev); -@@ -730,30 +727,36 @@ static void ntb_epf_pci_remove(struct pci_dev *pdev) - ntb_epf_deinit_pci(ndev); - } - --static const struct ntb_epf_data j721e_data = { -- .ctrl_reg_bar = BAR_0, -- .peer_spad_reg_bar = BAR_1, -- .db_reg_bar = BAR_2, -- .mw_bar = BAR_2, -+static const enum pci_barno j721e_map[NTB_BAR_NUM] = { -+ [BAR_CONFIG] = BAR_0, -+ [BAR_PEER_SPAD] = BAR_1, -+ [BAR_DB] = BAR_2, -+ [BAR_MW1] = BAR_2, -+ [BAR_MW2] = BAR_3, -+ [BAR_MW3] = BAR_4, -+ [BAR_MW4] = BAR_5 - }; - --static const struct ntb_epf_data mx8_data = { -- .ctrl_reg_bar = BAR_0, -- .peer_spad_reg_bar = BAR_0, -- .db_reg_bar = BAR_2, -- .mw_bar = BAR_4, -+static const enum pci_barno mx8_map[NTB_BAR_NUM] = { -+ [BAR_CONFIG] = BAR_0, -+ [BAR_PEER_SPAD] = BAR_0, -+ [BAR_DB] = BAR_2, -+ [BAR_MW1] = BAR_4, -+ [BAR_MW2] = BAR_5, -+ [BAR_MW3] = NO_BAR, -+ [BAR_MW4] = NO_BAR - }; - - static const struct pci_device_id ntb_epf_pci_tbl[] = { - { - PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_J721E), - .class = PCI_CLASS_MEMORY_RAM << 8, .class_mask = 0xffff00, -- .driver_data = (kernel_ulong_t)&j721e_data, -+ .driver_data = (kernel_ulong_t)j721e_map, - }, - { - PCI_DEVICE(PCI_VENDOR_ID_FREESCALE, 0x0809), - .class = PCI_CLASS_MEMORY_RAM << 8, .class_mask = 0xffff00, -- .driver_data = (kernel_ulong_t)&mx8_data, -+ .driver_data = (kernel_ulong_t)mx8_map, - }, - { }, - }; -diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c -index 13221cc0d17d43..78d00e25a17909 100644 ---- a/drivers/nvme/host/core.c -+++ b/drivers/nvme/host/core.c -@@ -4414,8 +4414,14 @@ void nvme_start_ctrl(struct nvme_ctrl *ctrl) - * checking that they started once before, hence are reconnecting back. - */ - if (test_bit(NVME_CTRL_STARTED_ONCE, &ctrl->flags) && -- nvme_discovery_ctrl(ctrl)) -+ nvme_discovery_ctrl(ctrl)) { -+ if (!ctrl->kato) { -+ nvme_stop_keep_alive(ctrl); -+ ctrl->kato = NVME_DEFAULT_KATO; -+ nvme_start_keep_alive(ctrl); -+ } - nvme_change_uevent(ctrl, "NVME_EVENT=rediscover"); -+ } - - if (ctrl->queue_count > 1) { - nvme_queue_scan(ctrl); -diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c -index 3e0da2422b3343..bf9ab07257642c 100644 ---- a/drivers/nvme/host/fc.c -+++ b/drivers/nvme/host/fc.c -@@ -3024,11 +3024,17 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl) - - ++ctrl->ctrl.nr_reconnects; - -- if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE) -+ spin_lock_irqsave(&ctrl->rport->lock, flags); -+ if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE) { -+ spin_unlock_irqrestore(&ctrl->rport->lock, flags); - return -ENODEV; -+ } - -- if (nvme_fc_ctlr_active_on_rport(ctrl)) -+ if (nvme_fc_ctlr_active_on_rport(ctrl)) { -+ spin_unlock_irqrestore(&ctrl->rport->lock, flags); - return -ENOTUNIQ; -+ } -+ spin_unlock_irqrestore(&ctrl->rport->lock, flags); - - dev_info(ctrl->ctrl.device, - "NVME-FC{%d}: create association : host wwpn 0x%016llx " -diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c -index a15e764bae35b7..188b9f1bdaca14 100644 ---- a/drivers/nvme/target/fc.c -+++ b/drivers/nvme/target/fc.c -@@ -1090,6 +1090,14 @@ nvmet_fc_delete_assoc_work(struct work_struct *work) - static void - nvmet_fc_schedule_delete_assoc(struct nvmet_fc_tgt_assoc *assoc) - { -+ int terminating; -+ -+ terminating = atomic_xchg(&assoc->terminating, 1); -+ -+ /* if already terminating, do nothing */ -+ if (terminating) -+ return; -+ - nvmet_fc_tgtport_get(assoc->tgtport); - if (!queue_work(nvmet_wq, &assoc->del_work)) - nvmet_fc_tgtport_put(assoc->tgtport); -@@ -1209,13 +1217,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc) - { - struct nvmet_fc_tgtport *tgtport = assoc->tgtport; - unsigned long flags; -- int i, terminating; -- -- terminating = atomic_xchg(&assoc->terminating, 1); -- -- /* if already terminating, do nothing */ -- if (terminating) -- return; -+ int i; - - spin_lock_irqsave(&tgtport->lock, flags); - list_del_rcu(&assoc->a_list); -diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c -index 741e10a575ec75..675b7ea6ff7844 100644 ---- a/drivers/pci/controller/cadence/pcie-cadence-host.c -+++ b/drivers/pci/controller/cadence/pcie-cadence-host.c -@@ -452,7 +452,7 @@ static int cdns_pcie_host_init_address_translation(struct cdns_pcie_rc *rc) - cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_PCI_ADDR1(0), addr1); - cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_DESC1(0), desc1); - -- if (pcie->ops->cpu_addr_fixup) -+ if (pcie->ops && pcie->ops->cpu_addr_fixup) - cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr); - - addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(12) | -diff --git a/drivers/pci/controller/cadence/pcie-cadence.c b/drivers/pci/controller/cadence/pcie-cadence.c -index 4251fac5e31065..a1b66dbfc10f82 100644 ---- a/drivers/pci/controller/cadence/pcie-cadence.c -+++ b/drivers/pci/controller/cadence/pcie-cadence.c -@@ -90,7 +90,7 @@ void cdns_pcie_set_outbound_region(struct cdns_pcie *pcie, u8 busnr, u8 fn, - cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_DESC1(r), desc1); - - /* Set the CPU address */ -- if (pcie->ops->cpu_addr_fixup) -+ if (pcie->ops && pcie->ops->cpu_addr_fixup) - cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr); - - addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(nbits) | -@@ -120,7 +120,7 @@ void cdns_pcie_set_outbound_region_for_normal_msg(struct cdns_pcie *pcie, - } - - /* Set the CPU address */ -- if (pcie->ops->cpu_addr_fixup) -+ if (pcie->ops && pcie->ops->cpu_addr_fixup) - cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr); - - addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(17) | -diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/pci/controller/cadence/pcie-cadence.h -index 9efb71cbe6996c..d2c310b7fc99bd 100644 ---- a/drivers/pci/controller/cadence/pcie-cadence.h -+++ b/drivers/pci/controller/cadence/pcie-cadence.h -@@ -494,7 +494,7 @@ static inline u32 cdns_pcie_ep_fn_readl(struct cdns_pcie *pcie, u8 fn, u32 reg) - - static inline int cdns_pcie_start_link(struct cdns_pcie *pcie) - { -- if (pcie->ops->start_link) -+ if (pcie->ops && pcie->ops->start_link) - return pcie->ops->start_link(pcie); - - return 0; -@@ -502,13 +502,13 @@ static inline int cdns_pcie_start_link(struct cdns_pcie *pcie) - - static inline void cdns_pcie_stop_link(struct cdns_pcie *pcie) - { -- if (pcie->ops->stop_link) -+ if (pcie->ops && pcie->ops->stop_link) - pcie->ops->stop_link(pcie); - } - - static inline bool cdns_pcie_link_up(struct cdns_pcie *pcie) - { -- if (pcie->ops->link_up) -+ if (pcie->ops && pcie->ops->link_up) - return pcie->ops->link_up(pcie); - - return true; -diff --git a/drivers/pci/controller/dwc/pcie-designware.c b/drivers/pci/controller/dwc/pcie-designware.c -index 717af1b757f0a5..46b12e157bebe9 100644 ---- a/drivers/pci/controller/dwc/pcie-designware.c -+++ b/drivers/pci/controller/dwc/pcie-designware.c -@@ -927,9 +927,7 @@ static int dw_pcie_edma_irq_verify(struct dw_pcie *pci) - char name[6]; - int ret; - -- if (pci->edma.nr_irqs == 1) -- return 0; -- else if (pci->edma.nr_irqs > 1) -+ if (pci->edma.nr_irqs > 1) - return pci->edma.nr_irqs != ch_cnt ? -EINVAL : 0; - - ret = platform_get_irq_byname_optional(pdev, "dma"); -diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c -index b8becc7257cda8..0f1e431bbfc20a 100644 ---- a/drivers/pci/p2pdma.c -+++ b/drivers/pci/p2pdma.c -@@ -351,7 +351,7 @@ int pci_p2pdma_add_resource(struct pci_dev *pdev, int bar, size_t size, - pages_free: - devm_memunmap_pages(&pdev->dev, pgmap); - pgmap_free: -- devm_kfree(&pdev->dev, pgmap); -+ devm_kfree(&pdev->dev, p2p_pgmap); - return error; - } - EXPORT_SYMBOL_GPL(pci_p2pdma_add_resource); -diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c -index 1705d2d0ed1268..11a90b55c1873c 100644 ---- a/drivers/pci/pci-driver.c -+++ b/drivers/pci/pci-driver.c -@@ -1598,7 +1598,7 @@ static int pci_uevent(const struct device *dev, struct kobj_uevent_env *env) - return 0; - } - --#if defined(CONFIG_PCIEAER) || defined(CONFIG_EEH) -+#if defined(CONFIG_PCIEAER) || defined(CONFIG_EEH) || defined(CONFIG_S390) - /** - * pci_uevent_ers - emit a uevent during recovery path of PCI device - * @pdev: PCI device undergoing error recovery -diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c -index df7f7e2ed0064a..9a3f6bb60eb4d8 100644 ---- a/drivers/pci/pci.c -+++ b/drivers/pci/pci.c -@@ -1257,6 +1257,11 @@ int pci_power_up(struct pci_dev *dev) - return -EIO; - } - -+ if (pci_dev_is_disconnected(dev)) { -+ dev->current_state = PCI_D3cold; -+ return -EIO; -+ } -+ - pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &pmcsr); - if (PCI_POSSIBLE_ERROR(pmcsr)) { - pci_err(dev, "Unable to change power state from %s to D0, device inaccessible\n", -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index d67ea16e69e6ac..30a5f809ee798d 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -2712,6 +2712,7 @@ static void quirk_disable_msi(struct pci_dev *dev) - DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8131_BRIDGE, quirk_disable_msi); - DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, 0xa238, quirk_disable_msi); - DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x5a3f, quirk_disable_msi); -+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_RDC, 0x1031, quirk_disable_msi); - - /* - * The APC bridge device in AMD 780 family northbridges has some random -@@ -3824,7 +3825,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcf80, quirk_no_pm_reset); - */ - static void quirk_thunderbolt_hotplug_msi(struct pci_dev *pdev) - { -- if (pdev->is_hotplug_bridge && -+ if (pdev->is_pciehp && - (pdev->device != PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C || - pdev->revision <= 1)) - pdev->no_msi = 1; -diff --git a/drivers/phy/cadence/cdns-dphy.c b/drivers/phy/cadence/cdns-dphy.c -index 8d93a830ab8bff..a24df36e5c3766 100644 ---- a/drivers/phy/cadence/cdns-dphy.c -+++ b/drivers/phy/cadence/cdns-dphy.c -@@ -145,7 +145,7 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy, - - dlane_bps = opts->hs_clk_rate; - -- if (dlane_bps > 2500000000UL || dlane_bps < 160000000UL) -+ if (dlane_bps > 2500000000UL || dlane_bps < 80000000UL) - return -EINVAL; - else if (dlane_bps >= 1250000000) - cfg->pll_opdiv = 1; -@@ -155,6 +155,8 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy, - cfg->pll_opdiv = 4; - else if (dlane_bps >= 160000000) - cfg->pll_opdiv = 8; -+ else if (dlane_bps >= 80000000) -+ cfg->pll_opdiv = 16; - - cfg->pll_fbdiv = DIV_ROUND_UP_ULL(dlane_bps * 2 * cfg->pll_opdiv * - cfg->pll_ipdiv, -diff --git a/drivers/phy/renesas/r8a779f0-ether-serdes.c b/drivers/phy/renesas/r8a779f0-ether-serdes.c -index 683b19bc411a84..59546301a6b9ee 100644 ---- a/drivers/phy/renesas/r8a779f0-ether-serdes.c -+++ b/drivers/phy/renesas/r8a779f0-ether-serdes.c -@@ -49,6 +49,13 @@ static void r8a779f0_eth_serdes_write32(void __iomem *addr, u32 offs, u32 bank, - iowrite32(data, addr + offs); - } - -+static u32 r8a779f0_eth_serdes_read32(void __iomem *addr, u32 offs, u32 bank) -+{ -+ iowrite32(bank, addr + R8A779F0_ETH_SERDES_BANK_SELECT); -+ -+ return ioread32(addr + offs); -+} -+ - static int - r8a779f0_eth_serdes_reg_wait(struct r8a779f0_eth_serdes_channel *channel, - u32 offs, u32 bank, u32 mask, u32 expected) -@@ -261,6 +268,7 @@ static int r8a779f0_eth_serdes_hw_init_late(struct r8a779f0_eth_serdes_channel - *channel) - { - int ret; -+ u32 val; - - ret = r8a779f0_eth_serdes_chan_setting(channel); - if (ret) -@@ -274,6 +282,26 @@ static int r8a779f0_eth_serdes_hw_init_late(struct r8a779f0_eth_serdes_channel - - r8a779f0_eth_serdes_write32(channel->addr, 0x03d0, 0x380, 0x0000); - -+ val = r8a779f0_eth_serdes_read32(channel->addr, 0x00c0, 0x180); -+ r8a779f0_eth_serdes_write32(channel->addr, 0x00c0, 0x180, val | BIT(8)); -+ ret = r8a779f0_eth_serdes_reg_wait(channel, 0x0100, 0x180, BIT(0), 1); -+ if (ret) -+ return ret; -+ r8a779f0_eth_serdes_write32(channel->addr, 0x00c0, 0x180, val & ~BIT(8)); -+ ret = r8a779f0_eth_serdes_reg_wait(channel, 0x0100, 0x180, BIT(0), 0); -+ if (ret) -+ return ret; -+ -+ val = r8a779f0_eth_serdes_read32(channel->addr, 0x0144, 0x180); -+ r8a779f0_eth_serdes_write32(channel->addr, 0x0144, 0x180, val | BIT(4)); -+ ret = r8a779f0_eth_serdes_reg_wait(channel, 0x0180, 0x180, BIT(0), 1); -+ if (ret) -+ return ret; -+ r8a779f0_eth_serdes_write32(channel->addr, 0x0144, 0x180, val & ~BIT(4)); -+ ret = r8a779f0_eth_serdes_reg_wait(channel, 0x0180, 0x180, BIT(0), 0); -+ if (ret) -+ return ret; -+ - return r8a779f0_eth_serdes_monitor_linkup(channel); - } - -diff --git a/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c b/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c -index 98c92d6c482fef..279e19e7546b66 100644 ---- a/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c -+++ b/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c -@@ -87,10 +87,11 @@ struct dphy_reg { - u32 offset; - u32 mask; - u32 shift; -+ u8 valid; - }; - - #define PHY_REG(_offset, _width, _shift) \ -- { .offset = _offset, .mask = BIT(_width) - 1, .shift = _shift, } -+ { .offset = _offset, .mask = BIT(_width) - 1, .shift = _shift, .valid = 1, } - - static const struct dphy_reg rk1808_grf_dphy_regs[] = { - [GRF_DPHY_CSIPHY_FORCERXMODE] = PHY_REG(RK1808_GRF_PD_VI_CON_OFFSET, 4, 0), -@@ -145,7 +146,7 @@ static inline void write_grf_reg(struct rockchip_inno_csidphy *priv, - const struct dphy_drv_data *drv_data = priv->drv_data; - const struct dphy_reg *reg = &drv_data->grf_regs[index]; - -- if (reg->offset) -+ if (reg->valid) - regmap_write(priv->grf, reg->offset, - HIWORD_UPDATE(value, reg->mask, reg->shift)); - } -diff --git a/drivers/pinctrl/pinctrl-keembay.c b/drivers/pinctrl/pinctrl-keembay.c -index 152c35bce8ecc0..94b11a23829f65 100644 ---- a/drivers/pinctrl/pinctrl-keembay.c -+++ b/drivers/pinctrl/pinctrl-keembay.c -@@ -1606,7 +1606,8 @@ static int keembay_build_functions(struct keembay_pinctrl *kpc) - * being part of 8 (hw maximum) globally unique muxes. - */ - kpc->nfuncs = 0; -- keembay_funcs = kcalloc(kpc->npins * 8, sizeof(*keembay_funcs), GFP_KERNEL); -+ keembay_funcs = devm_kcalloc(kpc->dev, kpc->npins * 8, -+ sizeof(*keembay_funcs), GFP_KERNEL); - if (!keembay_funcs) - return -ENOMEM; - -@@ -1637,7 +1638,9 @@ static int keembay_build_functions(struct keembay_pinctrl *kpc) - } - - /* Reallocate memory based on actual number of functions */ -- new_funcs = krealloc(keembay_funcs, kpc->nfuncs * sizeof(*new_funcs), GFP_KERNEL); -+ new_funcs = devm_krealloc_array(kpc->dev, keembay_funcs, -+ kpc->nfuncs, sizeof(*new_funcs), -+ GFP_KERNEL); - if (!new_funcs) { - kfree(keembay_funcs); - return -ENOMEM; -diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c -index 6c670203b3ac28..7684039be10cb2 100644 ---- a/drivers/pinctrl/pinctrl-single.c -+++ b/drivers/pinctrl/pinctrl-single.c -@@ -587,8 +587,10 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev, - break; - case PIN_CONFIG_BIAS_PULL_DOWN: - case PIN_CONFIG_BIAS_PULL_UP: -- if (arg) -+ if (arg) { - pcs_pinconf_clear_bias(pctldev, pin); -+ data = pcs->read(pcs->base + offset); -+ } - fallthrough; - case PIN_CONFIG_INPUT_SCHMITT_ENABLE: - data &= ~func->conf[i].mask; -diff --git a/drivers/pmdomain/apple/pmgr-pwrstate.c b/drivers/pmdomain/apple/pmgr-pwrstate.c -index d62a776c89a121..e592f819c8fa07 100644 ---- a/drivers/pmdomain/apple/pmgr-pwrstate.c -+++ b/drivers/pmdomain/apple/pmgr-pwrstate.c -@@ -306,6 +306,7 @@ static int apple_pmgr_ps_probe(struct platform_device *pdev) - } - - static const struct of_device_id apple_pmgr_ps_of_match[] = { -+ { .compatible = "apple,t8103-pmgr-pwrstate" }, - { .compatible = "apple,pmgr-pwrstate" }, - {} - }; -diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qcom_battmgr.c -index 190e8a4cfa97f4..0c993780d3ef29 100644 ---- a/drivers/power/supply/qcom_battmgr.c -+++ b/drivers/power/supply/qcom_battmgr.c -@@ -29,8 +29,9 @@ enum qcom_battmgr_variant { - #define NOTIF_BAT_PROPERTY 0x30 - #define NOTIF_USB_PROPERTY 0x32 - #define NOTIF_WLS_PROPERTY 0x34 --#define NOTIF_BAT_INFO 0x81 - #define NOTIF_BAT_STATUS 0x80 -+#define NOTIF_BAT_INFO 0x81 -+#define NOTIF_BAT_CHARGING_STATE 0x83 - - #define BATTMGR_BAT_INFO 0x9 - -@@ -940,12 +941,14 @@ static void qcom_battmgr_notification(struct qcom_battmgr *battmgr, - } - - notification = le32_to_cpu(msg->notification); -+ notification &= 0xff; - switch (notification) { - case NOTIF_BAT_INFO: - battmgr->info.valid = false; - fallthrough; - case NOTIF_BAT_STATUS: - case NOTIF_BAT_PROPERTY: -+ case NOTIF_BAT_CHARGING_STATE: - power_supply_changed(battmgr->bat_psy); - break; - case NOTIF_USB_PROPERTY: -@@ -975,7 +978,8 @@ static void qcom_battmgr_sc8280xp_strcpy(char *dest, const char *src) - - static unsigned int qcom_battmgr_sc8280xp_parse_technology(const char *chemistry) - { -- if (!strncmp(chemistry, "LIO", BATTMGR_CHEMISTRY_LEN)) -+ if ((!strncmp(chemistry, "LIO", BATTMGR_CHEMISTRY_LEN)) || -+ (!strncmp(chemistry, "OOI", BATTMGR_CHEMISTRY_LEN))) - return POWER_SUPPLY_TECHNOLOGY_LION; - if (!strncmp(chemistry, "LIP", BATTMGR_CHEMISTRY_LEN)) - return POWER_SUPPLY_TECHNOLOGY_LIPO; -diff --git a/drivers/power/supply/sbs-charger.c b/drivers/power/supply/sbs-charger.c -index f4adde4492707b..d405c3657ce93c 100644 ---- a/drivers/power/supply/sbs-charger.c -+++ b/drivers/power/supply/sbs-charger.c -@@ -154,8 +154,7 @@ static const struct regmap_config sbs_regmap = { - .val_format_endian = REGMAP_ENDIAN_LITTLE, /* since based on SMBus */ - }; - --static const struct power_supply_desc sbs_desc = { -- .name = "sbs-charger", -+static const struct power_supply_desc sbs_default_desc = { - .type = POWER_SUPPLY_TYPE_MAINS, - .properties = sbs_properties, - .num_properties = ARRAY_SIZE(sbs_properties), -@@ -165,9 +164,20 @@ static const struct power_supply_desc sbs_desc = { - static int sbs_probe(struct i2c_client *client) - { - struct power_supply_config psy_cfg = {}; -+ struct power_supply_desc *sbs_desc; - struct sbs_info *chip; - int ret, val; - -+ sbs_desc = devm_kmemdup(&client->dev, &sbs_default_desc, -+ sizeof(*sbs_desc), GFP_KERNEL); -+ if (!sbs_desc) -+ return -ENOMEM; -+ -+ sbs_desc->name = devm_kasprintf(&client->dev, GFP_KERNEL, "sbs-%s", -+ dev_name(&client->dev)); -+ if (!sbs_desc->name) -+ return -ENOMEM; -+ - chip = devm_kzalloc(&client->dev, sizeof(struct sbs_info), GFP_KERNEL); - if (!chip) - return -ENOMEM; -@@ -191,7 +201,7 @@ static int sbs_probe(struct i2c_client *client) - return dev_err_probe(&client->dev, ret, "Failed to get device status\n"); - chip->last_state = val; - -- chip->power_supply = devm_power_supply_register(&client->dev, &sbs_desc, &psy_cfg); -+ chip->power_supply = devm_power_supply_register(&client->dev, sbs_desc, &psy_cfg); - if (IS_ERR(chip->power_supply)) - return dev_err_probe(&client->dev, PTR_ERR(chip->power_supply), - "Failed to register power supply\n"); -diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c -index 0682bb340221ab..d252d018bfe77e 100644 ---- a/drivers/ptp/ptp_clock.c -+++ b/drivers/ptp/ptp_clock.c -@@ -83,6 +83,9 @@ static int ptp_clock_settime(struct posix_clock *pc, const struct timespec64 *tp - return -EBUSY; - } - -+ if (!timespec64_valid_settod(tp)) -+ return -EINVAL; -+ - return ptp->info->settime64(ptp->info, tp); - } - -@@ -113,7 +116,7 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct __kernel_timex *tx) - ops = ptp->info; - - if (tx->modes & ADJ_SETOFFSET) { -- struct timespec64 ts; -+ struct timespec64 ts, ts2; - ktime_t kt; - s64 delta; - -@@ -126,6 +129,14 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct __kernel_timex *tx) - if ((unsigned long) ts.tv_nsec >= NSEC_PER_SEC) - return -EINVAL; - -+ /* Make sure the offset is valid */ -+ err = ptp_clock_gettime(pc, &ts2); -+ if (err) -+ return err; -+ ts2 = timespec64_add(ts2, ts); -+ if (!timespec64_valid_settod(&ts2)) -+ return -EINVAL; -+ - kt = timespec64_to_ktime(ts); - delta = ktime_to_ns(kt); - err = ops->adjtime(ops, delta); -diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c -index 55130efae9b8b6..4477bdeb9e60f5 100644 ---- a/drivers/regulator/fixed.c -+++ b/drivers/regulator/fixed.c -@@ -286,6 +286,7 @@ static int reg_fixed_voltage_probe(struct platform_device *pdev) - ret = dev_err_probe(&pdev->dev, PTR_ERR(drvdata->dev), - "Failed to register regulator: %ld\n", - PTR_ERR(drvdata->dev)); -+ gpiod_put(cfg.ena_gpiod); - return ret; - } - -diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c -index 769c6d6d6a7316..58d5b85e58cdad 100644 ---- a/drivers/remoteproc/qcom_q6v5.c -+++ b/drivers/remoteproc/qcom_q6v5.c -@@ -164,6 +164,11 @@ static irqreturn_t q6v5_handover_interrupt(int irq, void *data) - { - struct qcom_q6v5 *q6v5 = data; - -+ if (q6v5->handover_issued) { -+ dev_err(q6v5->dev, "Handover signaled, but it already happened\n"); -+ return IRQ_HANDLED; -+ } -+ - if (q6v5->handover) - q6v5->handover(q6v5); - -diff --git a/drivers/remoteproc/wkup_m3_rproc.c b/drivers/remoteproc/wkup_m3_rproc.c -index 36a55f7ffa64d5..c39bd2bf2c1e78 100644 ---- a/drivers/remoteproc/wkup_m3_rproc.c -+++ b/drivers/remoteproc/wkup_m3_rproc.c -@@ -148,7 +148,9 @@ static int wkup_m3_rproc_probe(struct platform_device *pdev) - return -ENODEV; - } - -- pm_runtime_enable(&pdev->dev); -+ ret = devm_pm_runtime_enable(dev); -+ if (ret < 0) -+ return dev_err_probe(dev, ret, "Failed to enable runtime PM\n"); - ret = pm_runtime_get_sync(&pdev->dev); - if (ret < 0) { - dev_err(&pdev->dev, "pm_runtime_get_sync() failed\n"); -@@ -219,7 +221,6 @@ static int wkup_m3_rproc_probe(struct platform_device *pdev) - rproc_free(rproc); - err: - pm_runtime_put_noidle(dev); -- pm_runtime_disable(dev); - return ret; - } - -@@ -230,7 +231,6 @@ static void wkup_m3_rproc_remove(struct platform_device *pdev) - rproc_del(rproc); - rproc_free(rproc); - pm_runtime_put_sync(&pdev->dev); -- pm_runtime_disable(&pdev->dev); - } - - #ifdef CONFIG_PM -diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c -index 502571f0c203fa..05a54f4d4d9a6a 100644 ---- a/drivers/rtc/rtc-pcf2127.c -+++ b/drivers/rtc/rtc-pcf2127.c -@@ -41,6 +41,7 @@ - #define PCF2127_BIT_CTRL2_AF BIT(4) - #define PCF2127_BIT_CTRL2_TSF2 BIT(5) - #define PCF2127_BIT_CTRL2_WDTF BIT(6) -+#define PCF2127_BIT_CTRL2_MSF BIT(7) - /* Control register 3 */ - #define PCF2127_REG_CTRL3 0x02 - #define PCF2127_BIT_CTRL3_BLIE BIT(0) -@@ -94,7 +95,8 @@ - #define PCF2127_CTRL2_IRQ_MASK ( \ - PCF2127_BIT_CTRL2_AF | \ - PCF2127_BIT_CTRL2_WDTF | \ -- PCF2127_BIT_CTRL2_TSF2) -+ PCF2127_BIT_CTRL2_TSF2 | \ -+ PCF2127_BIT_CTRL2_MSF) - - #define PCF2127_MAX_TS_SUPPORTED 4 - -@@ -526,6 +528,21 @@ static int pcf2127_watchdog_init(struct device *dev, struct pcf2127 *pcf2127) - set_bit(WDOG_HW_RUNNING, &pcf2127->wdd.status); - } - -+ /* -+ * When using interrupt pin (INT A) as watchdog output, only allow -+ * watchdog interrupt (PCF2131_BIT_INT_WD_CD) and disable (mask) all -+ * other interrupts. -+ */ -+ if (pcf2127->cfg->type == PCF2131) { -+ ret = regmap_write(pcf2127->regmap, -+ PCF2131_REG_INT_A_MASK1, -+ PCF2131_BIT_INT_BLIE | -+ PCF2131_BIT_INT_BIE | -+ PCF2131_BIT_INT_AIE | -+ PCF2131_BIT_INT_SI | -+ PCF2131_BIT_INT_MI); -+ } -+ - return devm_watchdog_register_device(dev, &pcf2127->wdd); - } - -diff --git a/drivers/rtc/rtc-rx8025.c b/drivers/rtc/rtc-rx8025.c -index aabe62c283a150..7e9f7cb90c2887 100644 ---- a/drivers/rtc/rtc-rx8025.c -+++ b/drivers/rtc/rtc-rx8025.c -@@ -316,7 +316,7 @@ static int rx8025_init_client(struct i2c_client *client) - return hour_reg; - rx8025->is_24 = (hour_reg & RX8035_BIT_HOUR_1224); - } else { -- rx8025->is_24 = (ctrl[1] & RX8025_BIT_CTRL1_1224); -+ rx8025->is_24 = (ctrl[0] & RX8025_BIT_CTRL1_1224); - } - out: - return err; -diff --git a/drivers/scsi/libfc/fc_encode.h b/drivers/scsi/libfc/fc_encode.h -index 7dcac3b6baa7ee..992250ca8b9fd4 100644 ---- a/drivers/scsi/libfc/fc_encode.h -+++ b/drivers/scsi/libfc/fc_encode.h -@@ -354,7 +354,7 @@ static inline int fc_ct_ms_fill(struct fc_lport *lport, - put_unaligned_be16(len, &entry->len); - snprintf((char *)&entry->value, - FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN, -- "%s v%s", -+ "%.62s v%.62s", - init_utsname()->sysname, - init_utsname()->release); - -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.h b/drivers/scsi/lpfc/lpfc_debugfs.h -index 8d2e8d05bbc05f..52b14671eaa941 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.h -+++ b/drivers/scsi/lpfc/lpfc_debugfs.h -@@ -44,6 +44,9 @@ - /* hbqinfo output buffer size */ - #define LPFC_HBQINFO_SIZE 8192 - -+/* hdwqinfo output buffer size */ -+#define LPFC_HDWQINFO_SIZE 8192 -+ - /* nvmestat output buffer size */ - #define LPFC_NVMESTAT_SIZE 8192 - #define LPFC_IOKTIME_SIZE 8192 -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index ebe84bb7bb3ddf..2e9972a5878103 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -12094,7 +12094,11 @@ lpfc_sli4_els_xri_aborted(struct lpfc_hba *phba, - sglq_entry->state = SGL_FREED; - spin_unlock_irqrestore(&phba->sli4_hba.sgl_list_lock, - iflag); -- -+ lpfc_printf_log(phba, KERN_INFO, LOG_ELS | LOG_SLI | -+ LOG_DISCOVERY | LOG_NODE, -+ "0732 ELS XRI ABORT on Node: ndlp=x%px " -+ "xri=x%x\n", -+ ndlp, xri); - if (ndlp) { - lpfc_set_rrq_active(phba, ndlp, - sglq_entry->sli4_lxritag, -diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c -index 7c8e0e1d36da9b..b0eac09de5ad50 100644 ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -3047,13 +3047,6 @@ lpfc_cleanup(struct lpfc_vport *vport) - lpfc_vmid_vport_cleanup(vport); - - list_for_each_entry_safe(ndlp, next_ndlp, &vport->fc_nodes, nlp_listp) { -- if (vport->port_type != LPFC_PHYSICAL_PORT && -- ndlp->nlp_DID == Fabric_DID) { -- /* Just free up ndlp with Fabric_DID for vports */ -- lpfc_nlp_put(ndlp); -- continue; -- } -- - if (ndlp->nlp_DID == Fabric_Cntl_DID && - ndlp->nlp_state == NLP_STE_UNUSED_NODE) { - lpfc_nlp_put(ndlp); -diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c -index dcbb2432c978bc..4734694f59a4c6 100644 ---- a/drivers/scsi/lpfc/lpfc_scsi.c -+++ b/drivers/scsi/lpfc/lpfc_scsi.c -@@ -5920,7 +5920,7 @@ lpfc_chk_tgt_mapped(struct lpfc_vport *vport, struct fc_rport *rport) - /** - * lpfc_reset_flush_io_context - - * @vport: The virtual port (scsi_host) for the flush context -- * @tgt_id: If aborting by Target contect - specifies the target id -+ * @tgt_id: If aborting by Target context - specifies the target id - * @lun_id: If aborting by Lun context - specifies the lun id - * @context: specifies the context level to flush at. - * -@@ -6094,8 +6094,14 @@ lpfc_target_reset_handler(struct scsi_cmnd *cmnd) - pnode->nlp_fcp_info &= ~NLP_FCP_2_DEVICE; - spin_unlock_irqrestore(&pnode->lock, flags); - } -- lpfc_reset_flush_io_context(vport, tgt_id, lun_id, -- LPFC_CTX_TGT); -+ status = lpfc_reset_flush_io_context(vport, tgt_id, lun_id, -+ LPFC_CTX_TGT); -+ if (status != SUCCESS) { -+ lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP, -+ "0726 Target Reset flush status x%x\n", -+ status); -+ return status; -+ } - return FAST_IO_FAIL; - } - -@@ -6191,7 +6197,7 @@ lpfc_host_reset_handler(struct scsi_cmnd *cmnd) - int rc, ret = SUCCESS; - - lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP, -- "3172 SCSI layer issued Host Reset Data:\n"); -+ "3172 SCSI layer issued Host Reset\n"); - - lpfc_offline_prep(phba, LPFC_MBX_WAIT); - lpfc_offline(phba); -diff --git a/drivers/scsi/mpi3mr/mpi3mr_fw.c b/drivers/scsi/mpi3mr/mpi3mr_fw.c -index b03e4b8cb67d66..b6ae7ba6de5233 100644 ---- a/drivers/scsi/mpi3mr/mpi3mr_fw.c -+++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c -@@ -2117,6 +2117,8 @@ static int mpi3mr_create_op_queues(struct mpi3mr_ioc *mrioc) - { - int retval = 0; - u16 num_queues = 0, i = 0, msix_count_op_q = 1; -+ u32 ioc_status; -+ enum mpi3mr_iocstate ioc_state; - - num_queues = min_t(int, mrioc->facts.max_op_reply_q, - mrioc->facts.max_op_req_q); -@@ -2172,6 +2174,14 @@ static int mpi3mr_create_op_queues(struct mpi3mr_ioc *mrioc) - retval = -1; - goto out_failed; - } -+ ioc_status = readl(&mrioc->sysif_regs->ioc_status); -+ ioc_state = mpi3mr_get_iocstate(mrioc); -+ if ((ioc_status & MPI3_SYSIF_IOC_STATUS_RESET_HISTORY) || -+ ioc_state != MRIOC_STATE_READY) { -+ mpi3mr_print_fault_info(mrioc); -+ retval = -1; -+ goto out_failed; -+ } - mrioc->num_op_reply_q = mrioc->num_op_req_q = i; - ioc_info(mrioc, - "successfully created %d operational queue pairs(default/polled) queue = (%d/%d)\n", -diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c -index 7d6e4fe31ceed8..02c970575464c9 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_transport.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c -@@ -166,6 +166,9 @@ _transport_convert_phy_link_rate(u8 link_rate) - case MPI25_SAS_NEG_LINK_RATE_12_0: - rc = SAS_LINK_RATE_12_0_GBPS; - break; -+ case MPI26_SAS_NEG_LINK_RATE_22_5: -+ rc = SAS_LINK_RATE_22_5_GBPS; -+ break; - case MPI2_SAS_NEG_LINK_RATE_PHY_DISABLED: - rc = SAS_PHY_DISABLED; - break; -diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c -index 5c26a13ffbd261..d3ff212d28b2e1 100644 ---- a/drivers/scsi/pm8001/pm8001_ctl.c -+++ b/drivers/scsi/pm8001/pm8001_ctl.c -@@ -534,23 +534,25 @@ static ssize_t pm8001_ctl_iop_log_show(struct device *cdev, - char *str = buf; - u32 read_size = - pm8001_ha->main_cfg_tbl.pm80xx_tbl.event_log_size / 1024; -- static u32 start, end, count; - u32 max_read_times = 32; - u32 max_count = (read_size * 1024) / (max_read_times * 4); - u32 *temp = (u32 *)pm8001_ha->memoryMap.region[IOP].virt_ptr; - -- if ((count % max_count) == 0) { -- start = 0; -- end = max_read_times; -- count = 0; -+ mutex_lock(&pm8001_ha->iop_log_lock); -+ -+ if ((pm8001_ha->iop_log_count % max_count) == 0) { -+ pm8001_ha->iop_log_start = 0; -+ pm8001_ha->iop_log_end = max_read_times; -+ pm8001_ha->iop_log_count = 0; - } else { -- start = end; -- end = end + max_read_times; -+ pm8001_ha->iop_log_start = pm8001_ha->iop_log_end; -+ pm8001_ha->iop_log_end = pm8001_ha->iop_log_end + max_read_times; - } - -- for (; start < end; start++) -- str += sprintf(str, "%08x ", *(temp+start)); -- count++; -+ for (; pm8001_ha->iop_log_start < pm8001_ha->iop_log_end; pm8001_ha->iop_log_start++) -+ str += sprintf(str, "%08x ", *(temp+pm8001_ha->iop_log_start)); -+ pm8001_ha->iop_log_count++; -+ mutex_unlock(&pm8001_ha->iop_log_lock); - return str - buf; - } - static DEVICE_ATTR(iop_log, S_IRUGO, pm8001_ctl_iop_log_show, NULL); -@@ -680,7 +682,7 @@ static int pm8001_set_nvmd(struct pm8001_hba_info *pm8001_ha) - struct pm8001_ioctl_payload *payload; - DECLARE_COMPLETION_ONSTACK(completion); - u8 *ioctlbuffer; -- u32 ret; -+ int ret; - u32 length = 1024 * 5 + sizeof(*payload) - 1; - - if (pm8001_ha->fw_image->size > 4096) { -diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c -index c2f6151cbd2d02..00664bd2caab18 100644 ---- a/drivers/scsi/pm8001/pm8001_init.c -+++ b/drivers/scsi/pm8001/pm8001_init.c -@@ -529,6 +529,7 @@ static struct pm8001_hba_info *pm8001_pci_alloc(struct pci_dev *pdev, - pm8001_ha->id = pm8001_id++; - pm8001_ha->logging_level = logging_level; - pm8001_ha->non_fatal_count = 0; -+ mutex_init(&pm8001_ha->iop_log_lock); - if (link_rate >= 1 && link_rate <= 15) - pm8001_ha->link_rate = (link_rate << 8); - else { -diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h -index 2fadd353f1c13d..72cd1523235ca3 100644 ---- a/drivers/scsi/pm8001/pm8001_sas.h -+++ b/drivers/scsi/pm8001/pm8001_sas.h -@@ -543,6 +543,10 @@ struct pm8001_hba_info { - u32 ci_offset; - u32 pi_offset; - u32 max_memcnt; -+ u32 iop_log_start; -+ u32 iop_log_end; -+ u32 iop_log_count; -+ struct mutex iop_log_lock; - }; - - struct pm8001_work { -diff --git a/drivers/soc/aspeed/aspeed-socinfo.c b/drivers/soc/aspeed/aspeed-socinfo.c -index 3f759121dc00a4..67e9ac3d08ecc8 100644 ---- a/drivers/soc/aspeed/aspeed-socinfo.c -+++ b/drivers/soc/aspeed/aspeed-socinfo.c -@@ -27,6 +27,10 @@ static struct { - { "AST2620", 0x05010203 }, - { "AST2605", 0x05030103 }, - { "AST2625", 0x05030403 }, -+ /* AST2700 */ -+ { "AST2750", 0x06000003 }, -+ { "AST2700", 0x06000103 }, -+ { "AST2720", 0x06000203 }, - }; - - static const char *siliconid_to_name(u32 siliconid) -diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c -index 2e8568d6cde948..aead7dd482ea34 100644 ---- a/drivers/soc/qcom/smem.c -+++ b/drivers/soc/qcom/smem.c -@@ -870,7 +870,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem) - if (IS_ERR_OR_NULL(ptable)) - return SMEM_ITEM_COUNT; - -- info = (struct smem_info *)&ptable->entry[ptable->num_entries]; -+ info = (struct smem_info *)&ptable->entry[le32_to_cpu(ptable->num_entries)]; - if (memcmp(info->magic, SMEM_INFO_MAGIC, sizeof(info->magic))) - return SMEM_ITEM_COUNT; - -diff --git a/drivers/soc/tegra/fuse/fuse-tegra30.c b/drivers/soc/tegra/fuse/fuse-tegra30.c -index 402cf939c03263..a6b3217c3ccef6 100644 ---- a/drivers/soc/tegra/fuse/fuse-tegra30.c -+++ b/drivers/soc/tegra/fuse/fuse-tegra30.c -@@ -116,6 +116,124 @@ const struct tegra_fuse_soc tegra30_fuse_soc = { - #endif - - #ifdef CONFIG_ARCH_TEGRA_114_SOC -+static const struct nvmem_cell_info tegra114_fuse_cells[] = { -+ { -+ .name = "tsensor-cpu1", -+ .offset = 0x084, -+ .bytes = 4, -+ .bit_offset = 0, -+ .nbits = 32, -+ }, { -+ .name = "tsensor-cpu2", -+ .offset = 0x088, -+ .bytes = 4, -+ .bit_offset = 0, -+ .nbits = 32, -+ }, { -+ .name = "tsensor-common", -+ .offset = 0x08c, -+ .bytes = 4, -+ .bit_offset = 0, -+ .nbits = 32, -+ }, { -+ .name = "tsensor-cpu0", -+ .offset = 0x098, -+ .bytes = 4, -+ .bit_offset = 0, -+ .nbits = 32, -+ }, { -+ .name = "xusb-pad-calibration", -+ .offset = 0x0f0, -+ .bytes = 4, -+ .bit_offset = 0, -+ .nbits = 32, -+ }, { -+ .name = "tsensor-cpu3", -+ .offset = 0x12c, -+ .bytes = 4, -+ .bit_offset = 0, -+ .nbits = 32, -+ }, { -+ .name = "tsensor-gpu", -+ .offset = 0x154, -+ .bytes = 4, -+ .bit_offset = 0, -+ .nbits = 32, -+ }, { -+ .name = "tsensor-mem0", -+ .offset = 0x158, -+ .bytes = 4, -+ .bit_offset = 0, -+ .nbits = 32, -+ }, { -+ .name = "tsensor-mem1", -+ .offset = 0x15c, -+ .bytes = 4, -+ .bit_offset = 0, -+ .nbits = 32, -+ }, { -+ .name = "tsensor-pllx", -+ .offset = 0x160, -+ .bytes = 4, -+ .bit_offset = 0, -+ .nbits = 32, -+ }, -+}; -+ -+static const struct nvmem_cell_lookup tegra114_fuse_lookups[] = { -+ { -+ .nvmem_name = "fuse", -+ .cell_name = "xusb-pad-calibration", -+ .dev_id = "7009f000.padctl", -+ .con_id = "calibration", -+ }, { -+ .nvmem_name = "fuse", -+ .cell_name = "tsensor-common", -+ .dev_id = "700e2000.thermal-sensor", -+ .con_id = "common", -+ }, { -+ .nvmem_name = "fuse", -+ .cell_name = "tsensor-cpu0", -+ .dev_id = "700e2000.thermal-sensor", -+ .con_id = "cpu0", -+ }, { -+ .nvmem_name = "fuse", -+ .cell_name = "tsensor-cpu1", -+ .dev_id = "700e2000.thermal-sensor", -+ .con_id = "cpu1", -+ }, { -+ .nvmem_name = "fuse", -+ .cell_name = "tsensor-cpu2", -+ .dev_id = "700e2000.thermal-sensor", -+ .con_id = "cpu2", -+ }, { -+ .nvmem_name = "fuse", -+ .cell_name = "tsensor-cpu3", -+ .dev_id = "700e2000.thermal-sensor", -+ .con_id = "cpu3", -+ }, { -+ .nvmem_name = "fuse", -+ .cell_name = "tsensor-mem0", -+ .dev_id = "700e2000.thermal-sensor", -+ .con_id = "mem0", -+ }, { -+ .nvmem_name = "fuse", -+ .cell_name = "tsensor-mem1", -+ .dev_id = "700e2000.thermal-sensor", -+ .con_id = "mem1", -+ }, { -+ .nvmem_name = "fuse", -+ .cell_name = "tsensor-gpu", -+ .dev_id = "700e2000.thermal-sensor", -+ .con_id = "gpu", -+ }, { -+ .nvmem_name = "fuse", -+ .cell_name = "tsensor-pllx", -+ .dev_id = "700e2000.thermal-sensor", -+ .con_id = "pllx", -+ }, -+}; -+ - static const struct tegra_fuse_info tegra114_fuse_info = { - .read = tegra30_fuse_read, - .size = 0x2a0, -@@ -126,6 +244,10 @@ const struct tegra_fuse_soc tegra114_fuse_soc = { - .init = tegra30_fuse_init, - .speedo_init = tegra114_init_speedo_data, - .info = &tegra114_fuse_info, -+ .lookups = tegra114_fuse_lookups, -+ .num_lookups = ARRAY_SIZE(tegra114_fuse_lookups), -+ .cells = tegra114_fuse_cells, -+ .num_cells = ARRAY_SIZE(tegra114_fuse_cells), - .soc_attr_group = &tegra_soc_attr_group, - .clk_suspend_on = false, - }; -diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c -index 69b6c87c5525e0..41e1fb27a9f348 100644 ---- a/drivers/spi/spi-loopback-test.c -+++ b/drivers/spi/spi-loopback-test.c -@@ -447,7 +447,7 @@ static void spi_test_dump_message(struct spi_device *spi, - int i; - u8 b; - -- dev_info(&spi->dev, " spi_msg@%pK\n", msg); -+ dev_info(&spi->dev, " spi_msg@%p\n", msg); - if (msg->status) - dev_info(&spi->dev, " status: %i\n", - msg->status); -@@ -457,15 +457,15 @@ static void spi_test_dump_message(struct spi_device *spi, - msg->actual_length); - - list_for_each_entry(xfer, &msg->transfers, transfer_list) { -- dev_info(&spi->dev, " spi_transfer@%pK\n", xfer); -+ dev_info(&spi->dev, " spi_transfer@%p\n", xfer); - dev_info(&spi->dev, " len: %i\n", xfer->len); -- dev_info(&spi->dev, " tx_buf: %pK\n", xfer->tx_buf); -+ dev_info(&spi->dev, " tx_buf: %p\n", xfer->tx_buf); - if (dump_data && xfer->tx_buf) - spi_test_print_hex_dump(" TX: ", - xfer->tx_buf, - xfer->len); - -- dev_info(&spi->dev, " rx_buf: %pK\n", xfer->rx_buf); -+ dev_info(&spi->dev, " rx_buf: %p\n", xfer->rx_buf); - if (dump_data && xfer->rx_buf) - spi_test_print_hex_dump(" RX: ", - xfer->rx_buf, -@@ -559,7 +559,7 @@ static int spi_check_rx_ranges(struct spi_device *spi, - /* if still not found then something has modified too much */ - /* we could list the "closest" transfer here... */ - dev_err(&spi->dev, -- "loopback strangeness - rx changed outside of allowed range at: %pK\n", -+ "loopback strangeness - rx changed outside of allowed range at: %p\n", - addr); - /* do not return, only set ret, - * so that we list all addresses -@@ -697,7 +697,7 @@ static int spi_test_translate(struct spi_device *spi, - } - - dev_err(&spi->dev, -- "PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n", -+ "PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n", - *ptr, *ptr + len, - RX(0), RX(SPI_TEST_MAX_SIZE), - TX(0), TX(SPI_TEST_MAX_SIZE)); -diff --git a/drivers/spi/spi-rpc-if.c b/drivers/spi/spi-rpc-if.c -index 7cce2d2ab9ca61..a1696672d12fea 100644 ---- a/drivers/spi/spi-rpc-if.c -+++ b/drivers/spi/spi-rpc-if.c -@@ -193,6 +193,8 @@ static int __maybe_unused rpcif_spi_resume(struct device *dev) - { - struct spi_controller *ctlr = dev_get_drvdata(dev); - -+ rpcif_hw_init(dev, false); -+ - return spi_controller_resume(ctlr); - } - -diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c -index cfb6755c0730f4..5adba36255a1aa 100644 ---- a/drivers/spi/spi.c -+++ b/drivers/spi/spi.c -@@ -2716,6 +2716,16 @@ static acpi_status acpi_register_spi_device(struct spi_controller *ctlr, - acpi_set_modalias(adev, acpi_device_hid(adev), spi->modalias, - sizeof(spi->modalias)); - -+ /* -+ * This gets re-tried in spi_probe() for -EPROBE_DEFER handling in case -+ * the GPIO controller does not have a driver yet. This needs to be done -+ * here too, because this call sets the GPIO direction and/or bias. -+ * Setting these needs to be done even if there is no driver, in which -+ * case spi_probe() will never get called. -+ */ -+ if (spi->irq < 0) -+ spi->irq = acpi_dev_gpio_irq_get(adev, 0); -+ - acpi_device_set_enumerated(adev); - - adev->power.flags.ignore_parent = true; -diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c -index d7ad16f262b2eb..976912f3bb5b4f 100644 ---- a/drivers/tee/tee_core.c -+++ b/drivers/tee/tee_core.c -@@ -889,7 +889,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc, - - if (!teedesc || !teedesc->name || !teedesc->ops || - !teedesc->ops->get_version || !teedesc->ops->open || -- !teedesc->ops->release || !pool) -+ !teedesc->ops->release) - return ERR_PTR(-EINVAL); - - teedev = kzalloc(sizeof(*teedev), GFP_KERNEL); -diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c -index b92a8a5b2e8c97..bf35fd23b5e160 100644 ---- a/drivers/thunderbolt/tb.c -+++ b/drivers/thunderbolt/tb.c -@@ -3022,7 +3022,7 @@ static bool tb_apple_add_links(struct tb_nhi *nhi) - if (!pci_is_pcie(pdev)) - continue; - if (pci_pcie_type(pdev) != PCI_EXP_TYPE_DOWNSTREAM || -- !pdev->is_hotplug_bridge) -+ !pdev->is_pciehp) - continue; - - link = device_link_add(&pdev->dev, &nhi->pdev->dev, -diff --git a/drivers/ufs/core/ufshcd-crypto.c b/drivers/ufs/core/ufshcd-crypto.c -index f2c4422cab8640..a714dad82cd1fe 100644 ---- a/drivers/ufs/core/ufshcd-crypto.c -+++ b/drivers/ufs/core/ufshcd-crypto.c -@@ -95,8 +95,12 @@ static int ufshcd_crypto_keyslot_program(struct blk_crypto_profile *profile, - return err; - } - --static int ufshcd_clear_keyslot(struct ufs_hba *hba, int slot) -+static int ufshcd_crypto_keyslot_evict(struct blk_crypto_profile *profile, -+ const struct blk_crypto_key *key, -+ unsigned int slot) - { -+ struct ufs_hba *hba = -+ container_of(profile, struct ufs_hba, crypto_profile); - /* - * Clear the crypto cfg on the device. Clearing CFGE - * might not be sufficient, so just clear the entire cfg. -@@ -106,16 +110,10 @@ static int ufshcd_clear_keyslot(struct ufs_hba *hba, int slot) - return ufshcd_program_key(hba, &cfg, slot); - } - --static int ufshcd_crypto_keyslot_evict(struct blk_crypto_profile *profile, -- const struct blk_crypto_key *key, -- unsigned int slot) --{ -- struct ufs_hba *hba = -- container_of(profile, struct ufs_hba, crypto_profile); -- -- return ufshcd_clear_keyslot(hba, slot); --} -- -+/* -+ * Reprogram the keyslots if needed, and return true if CRYPTO_GENERAL_ENABLE -+ * should be used in the host controller initialization sequence. -+ */ - bool ufshcd_crypto_enable(struct ufs_hba *hba) - { - if (!(hba->caps & UFSHCD_CAP_CRYPTO)) -@@ -123,6 +121,10 @@ bool ufshcd_crypto_enable(struct ufs_hba *hba) - - /* Reset might clear all keys, so reprogram all the keys. */ - blk_crypto_reprogram_all_keys(&hba->crypto_profile); -+ -+ if (hba->quirks & UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE) -+ return false; -+ - return true; - } - -@@ -159,6 +161,9 @@ int ufshcd_hba_init_crypto_capabilities(struct ufs_hba *hba) - int err = 0; - enum blk_crypto_mode_num blk_mode_num; - -+ if (hba->quirks & UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE) -+ return 0; -+ - /* - * Don't use crypto if either the hardware doesn't advertise the - * standard crypto capability bit *or* if the vendor specific driver -@@ -228,9 +233,10 @@ void ufshcd_init_crypto(struct ufs_hba *hba) - if (!(hba->caps & UFSHCD_CAP_CRYPTO)) - return; - -- /* Clear all keyslots - the number of keyslots is (CFGC + 1) */ -- for (slot = 0; slot < hba->crypto_capabilities.config_count + 1; slot++) -- ufshcd_clear_keyslot(hba, slot); -+ /* Clear all keyslots. */ -+ for (slot = 0; slot < hba->crypto_profile.num_slots; slot++) -+ hba->crypto_profile.ll_ops.keyslot_evict(&hba->crypto_profile, -+ NULL, slot); - } - - void ufshcd_crypto_register(struct ufs_hba *hba, struct request_queue *q) -diff --git a/drivers/ufs/core/ufshcd-crypto.h b/drivers/ufs/core/ufshcd-crypto.h -index be8596f20ba2f2..89bb97c14c15b6 100644 ---- a/drivers/ufs/core/ufshcd-crypto.h -+++ b/drivers/ufs/core/ufshcd-crypto.h -@@ -37,6 +37,33 @@ ufshcd_prepare_req_desc_hdr_crypto(struct ufshcd_lrb *lrbp, - h->dunu = cpu_to_le32(upper_32_bits(lrbp->data_unit_num)); - } - -+static inline int ufshcd_crypto_fill_prdt(struct ufs_hba *hba, -+ struct ufshcd_lrb *lrbp) -+{ -+ struct scsi_cmnd *cmd = lrbp->cmd; -+ const struct bio_crypt_ctx *crypt_ctx = scsi_cmd_to_rq(cmd)->crypt_ctx; -+ -+ if (crypt_ctx && hba->vops && hba->vops->fill_crypto_prdt) -+ return hba->vops->fill_crypto_prdt(hba, crypt_ctx, -+ lrbp->ucd_prdt_ptr, -+ scsi_sg_count(cmd)); -+ return 0; -+} -+ -+static inline void ufshcd_crypto_clear_prdt(struct ufs_hba *hba, -+ struct ufshcd_lrb *lrbp) -+{ -+ if (!(hba->quirks & UFSHCD_QUIRK_KEYS_IN_PRDT)) -+ return; -+ -+ if (!(scsi_cmd_to_rq(lrbp->cmd)->crypt_ctx)) -+ return; -+ -+ /* Zeroize the PRDT because it can contain cryptographic keys. */ -+ memzero_explicit(lrbp->ucd_prdt_ptr, -+ ufshcd_sg_entry_size(hba) * scsi_sg_count(lrbp->cmd)); -+} -+ - bool ufshcd_crypto_enable(struct ufs_hba *hba); - - int ufshcd_hba_init_crypto_capabilities(struct ufs_hba *hba); -@@ -54,6 +81,15 @@ static inline void - ufshcd_prepare_req_desc_hdr_crypto(struct ufshcd_lrb *lrbp, - struct request_desc_header *h) { } - -+static inline int ufshcd_crypto_fill_prdt(struct ufs_hba *hba, -+ struct ufshcd_lrb *lrbp) -+{ -+ return 0; -+} -+ -+static inline void ufshcd_crypto_clear_prdt(struct ufs_hba *hba, -+ struct ufshcd_lrb *lrbp) { } -+ - static inline bool ufshcd_crypto_enable(struct ufs_hba *hba) - { - return false; -diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c -index 7dcdaac31546ba..01a7c1720ce150 100644 ---- a/drivers/ufs/core/ufshcd.c -+++ b/drivers/ufs/core/ufshcd.c -@@ -275,6 +275,9 @@ static const struct ufs_dev_quirk ufs_fixups[] = { - { .wmanufacturerid = UFS_VENDOR_TOSHIBA, - .model = "THGLF2G9D8KBADG", - .quirk = UFS_DEVICE_QUIRK_PA_TACTIVATE }, -+ { .wmanufacturerid = UFS_VENDOR_TOSHIBA, -+ .model = "THGJFJT1E45BATP", -+ .quirk = UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT }, - {} - }; - -@@ -2365,7 +2368,11 @@ static inline int ufshcd_hba_capabilities(struct ufs_hba *hba) - * 0h: legacy single doorbell support is available - * 1h: indicate that legacy single doorbell support has been removed - */ -- hba->lsdb_sup = !FIELD_GET(MASK_LSDB_SUPPORT, hba->capabilities); -+ if (!(hba->quirks & UFSHCD_QUIRK_BROKEN_LSDBS_CAP)) -+ hba->lsdb_sup = !FIELD_GET(MASK_LSDB_SUPPORT, hba->capabilities); -+ else -+ hba->lsdb_sup = true; -+ - if (!hba->mcq_sup) - return 0; - -@@ -2586,7 +2593,7 @@ static int ufshcd_map_sg(struct ufs_hba *hba, struct ufshcd_lrb *lrbp) - - ufshcd_sgl_to_prdt(hba, lrbp, sg_segments, scsi_sglist(cmd)); - -- return 0; -+ return ufshcd_crypto_fill_prdt(hba, lrbp); - } - - /** -@@ -4176,8 +4183,8 @@ int ufshcd_dme_get_attr(struct ufs_hba *hba, u32 attr_sel, - get, UIC_GET_ATTR_ID(attr_sel), - UFS_UIC_COMMAND_RETRIES - retries); - -- if (mib_val && !ret) -- *mib_val = uic_cmd.argument3; -+ if (mib_val) -+ *mib_val = ret == 0 ? uic_cmd.argument3 : 0; - - if (peer && (hba->quirks & UFSHCD_QUIRK_DME_PEER_ACCESS_AUTO_MODE) - && pwr_mode_change) -@@ -4973,7 +4980,8 @@ static int ufshcd_link_startup(struct ufs_hba *hba) - * If UFS device isn't active then we will have to issue link startup - * 2 times to make sure the device state move to active. - */ -- if (!ufshcd_is_ufs_dev_active(hba)) -+ if (!(hba->quirks & UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE) && -+ !ufshcd_is_ufs_dev_active(hba)) - link_startup_again = true; - - link_startup: -@@ -5509,6 +5517,7 @@ void ufshcd_release_scsi_cmd(struct ufs_hba *hba, - struct scsi_cmnd *cmd = lrbp->cmd; - - scsi_dma_unmap(cmd); -+ ufshcd_crypto_clear_prdt(hba, lrbp); - ufshcd_release(hba); - ufshcd_clk_scaling_update_busy(hba); - } -@@ -6341,13 +6350,14 @@ void ufshcd_schedule_eh_work(struct ufs_hba *hba) - } - } - --static void ufshcd_force_error_recovery(struct ufs_hba *hba) -+void ufshcd_force_error_recovery(struct ufs_hba *hba) - { - spin_lock_irq(hba->host->host_lock); - hba->force_reset = true; - ufshcd_schedule_eh_work(hba); - spin_unlock_irq(hba->host->host_lock); - } -+EXPORT_SYMBOL_GPL(ufshcd_force_error_recovery); - - static void ufshcd_clk_scaling_allow(struct ufs_hba *hba, bool allow) - { -@@ -8730,7 +8740,8 @@ static void ufshcd_set_timestamp_attr(struct ufs_hba *hba) - struct ufs_dev_info *dev_info = &hba->dev_info; - struct utp_upiu_query_v4_0 *upiu_data; - -- if (dev_info->wspecversion < 0x400) -+ if (dev_info->wspecversion < 0x400 || -+ hba->dev_quirks & UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT) - return; - - ufshcd_hold(hba); -diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c -index 2383ecd88f1cba..8b4a3cc8125310 100644 ---- a/drivers/ufs/host/ufs-mediatek.c -+++ b/drivers/ufs/host/ufs-mediatek.c -@@ -847,6 +847,69 @@ static void ufs_mtk_vreg_fix_vccqx(struct ufs_hba *hba) - } - } - -+static void ufs_mtk_setup_clk_gating(struct ufs_hba *hba) -+{ -+ unsigned long flags; -+ u32 ah_ms = 10; -+ u32 ah_scale, ah_timer; -+ u32 scale_us[] = {1, 10, 100, 1000, 10000, 100000}; -+ -+ if (ufshcd_is_clkgating_allowed(hba)) { -+ if (ufshcd_is_auto_hibern8_supported(hba) && hba->ahit) { -+ ah_scale = FIELD_GET(UFSHCI_AHIBERN8_SCALE_MASK, -+ hba->ahit); -+ ah_timer = FIELD_GET(UFSHCI_AHIBERN8_TIMER_MASK, -+ hba->ahit); -+ if (ah_scale <= 5) -+ ah_ms = ah_timer * scale_us[ah_scale] / 1000; -+ } -+ -+ spin_lock_irqsave(hba->host->host_lock, flags); -+ hba->clk_gating.delay_ms = max(ah_ms, 10U); -+ spin_unlock_irqrestore(hba->host->host_lock, flags); -+ } -+} -+ -+/* Convert microseconds to Auto-Hibernate Idle Timer register value */ -+static u32 ufs_mtk_us_to_ahit(unsigned int timer) -+{ -+ unsigned int scale; -+ -+ for (scale = 0; timer > UFSHCI_AHIBERN8_TIMER_MASK; ++scale) -+ timer /= UFSHCI_AHIBERN8_SCALE_FACTOR; -+ -+ return FIELD_PREP(UFSHCI_AHIBERN8_TIMER_MASK, timer) | -+ FIELD_PREP(UFSHCI_AHIBERN8_SCALE_MASK, scale); -+} -+ -+static void ufs_mtk_fix_ahit(struct ufs_hba *hba) -+{ -+ unsigned int us; -+ -+ if (ufshcd_is_auto_hibern8_supported(hba)) { -+ switch (hba->dev_info.wmanufacturerid) { -+ case UFS_VENDOR_SAMSUNG: -+ /* configure auto-hibern8 timer to 3.5 ms */ -+ us = 3500; -+ break; -+ -+ case UFS_VENDOR_MICRON: -+ /* configure auto-hibern8 timer to 2 ms */ -+ us = 2000; -+ break; -+ -+ default: -+ /* configure auto-hibern8 timer to 1 ms */ -+ us = 1000; -+ break; -+ } -+ -+ hba->ahit = ufs_mtk_us_to_ahit(us); -+ } -+ -+ ufs_mtk_setup_clk_gating(hba); -+} -+ - static void ufs_mtk_init_mcq_irq(struct ufs_hba *hba) - { - struct ufs_mtk_host *host = ufshcd_get_variant(hba); -@@ -1028,6 +1091,28 @@ static int ufs_mtk_pre_pwr_change(struct ufs_hba *hba, - ufshcd_dme_set(hba, UIC_ARG_MIB(PA_TXHSADAPTTYPE), - PA_NO_ADAPT); - -+ if (!(hba->quirks & UFSHCD_QUIRK_SKIP_DEF_UNIPRO_TIMEOUT_SETTING)) { -+ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA0), -+ DL_FC0ProtectionTimeOutVal_Default); -+ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA1), -+ DL_TC0ReplayTimeOutVal_Default); -+ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA2), -+ DL_AFC0ReqTimeOutVal_Default); -+ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA3), -+ DL_FC1ProtectionTimeOutVal_Default); -+ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA4), -+ DL_TC1ReplayTimeOutVal_Default); -+ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA5), -+ DL_AFC1ReqTimeOutVal_Default); -+ -+ ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalFC0ProtectionTimeOutVal), -+ DL_FC0ProtectionTimeOutVal_Default); -+ ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalTC0ReplayTimeOutVal), -+ DL_TC0ReplayTimeOutVal_Default); -+ ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalAFC0ReqTimeOutVal), -+ DL_AFC0ReqTimeOutVal_Default); -+ } -+ - ret = ufshcd_uic_change_pwr_mode(hba, - FASTAUTO_MODE << 4 | FASTAUTO_MODE); - -@@ -1046,19 +1131,49 @@ static int ufs_mtk_pre_pwr_change(struct ufs_hba *hba, - return ret; - } - -+static int ufs_mtk_auto_hibern8_disable(struct ufs_hba *hba) -+{ -+ int ret; -+ -+ /* disable auto-hibern8 */ -+ ufshcd_writel(hba, 0, REG_AUTO_HIBERNATE_IDLE_TIMER); -+ -+ /* wait host return to idle state when auto-hibern8 off */ -+ ufs_mtk_wait_idle_state(hba, 5); -+ -+ ret = ufs_mtk_wait_link_state(hba, VS_LINK_UP, 100); -+ if (ret) { -+ dev_warn(hba->dev, "exit h8 state fail, ret=%d\n", ret); -+ -+ ufshcd_force_error_recovery(hba); -+ -+ /* trigger error handler and break suspend */ -+ ret = -EBUSY; -+ } -+ -+ return ret; -+} -+ - static int ufs_mtk_pwr_change_notify(struct ufs_hba *hba, - enum ufs_notify_change_status stage, - struct ufs_pa_layer_attr *dev_max_params, - struct ufs_pa_layer_attr *dev_req_params) - { - int ret = 0; -+ static u32 reg; - - switch (stage) { - case PRE_CHANGE: -+ if (ufshcd_is_auto_hibern8_supported(hba)) { -+ reg = ufshcd_readl(hba, REG_AUTO_HIBERNATE_IDLE_TIMER); -+ ufs_mtk_auto_hibern8_disable(hba); -+ } - ret = ufs_mtk_pre_pwr_change(hba, dev_max_params, - dev_req_params); - break; - case POST_CHANGE: -+ if (ufshcd_is_auto_hibern8_supported(hba)) -+ ufshcd_writel(hba, reg, REG_AUTO_HIBERNATE_IDLE_TIMER); - break; - default: - ret = -EINVAL; -@@ -1119,32 +1234,10 @@ static int ufs_mtk_pre_link(struct ufs_hba *hba) - - return ret; - } -- --static void ufs_mtk_setup_clk_gating(struct ufs_hba *hba) --{ -- u32 ah_ms; -- -- if (ufshcd_is_clkgating_allowed(hba)) { -- if (ufshcd_is_auto_hibern8_supported(hba) && hba->ahit) -- ah_ms = FIELD_GET(UFSHCI_AHIBERN8_TIMER_MASK, -- hba->ahit); -- else -- ah_ms = 10; -- ufshcd_clkgate_delay_set(hba->dev, ah_ms + 5); -- } --} -- - static void ufs_mtk_post_link(struct ufs_hba *hba) - { - /* enable unipro clock gating feature */ - ufs_mtk_cfg_unipro_cg(hba, true); -- -- /* will be configured during probe hba */ -- if (ufshcd_is_auto_hibern8_supported(hba)) -- hba->ahit = FIELD_PREP(UFSHCI_AHIBERN8_TIMER_MASK, 10) | -- FIELD_PREP(UFSHCI_AHIBERN8_SCALE_MASK, 3); -- -- ufs_mtk_setup_clk_gating(hba); - } - - static int ufs_mtk_link_startup_notify(struct ufs_hba *hba, -@@ -1171,11 +1264,11 @@ static int ufs_mtk_device_reset(struct ufs_hba *hba) - { - struct arm_smccc_res res; - -- /* disable hba before device reset */ -- ufshcd_hba_stop(hba); -- - ufs_mtk_device_reset_ctrl(0, res); - -+ /* disable hba in middle of device reset */ -+ ufshcd_hba_stop(hba); -+ - /* - * The reset signal is active low. UFS devices shall detect - * more than or equal to 1us of positive or negative RST_n -@@ -1253,6 +1346,9 @@ static void ufs_mtk_vccqx_set_lpm(struct ufs_hba *hba, bool lpm) - { - struct ufs_vreg *vccqx = NULL; - -+ if (!hba->vreg_info.vccq && !hba->vreg_info.vccq2) -+ return; -+ - if (hba->vreg_info.vccq) - vccqx = hba->vreg_info.vccq; - else -@@ -1297,21 +1393,6 @@ static void ufs_mtk_dev_vreg_set_lpm(struct ufs_hba *hba, bool lpm) - } - } - --static void ufs_mtk_auto_hibern8_disable(struct ufs_hba *hba) --{ -- int ret; -- -- /* disable auto-hibern8 */ -- ufshcd_writel(hba, 0, REG_AUTO_HIBERNATE_IDLE_TIMER); -- -- /* wait host return to idle state when auto-hibern8 off */ -- ufs_mtk_wait_idle_state(hba, 5); -- -- ret = ufs_mtk_wait_link_state(hba, VS_LINK_UP, 100); -- if (ret) -- dev_warn(hba->dev, "exit h8 state fail, ret=%d\n", ret); --} -- - static int ufs_mtk_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op, - enum ufs_notify_change_status status) - { -@@ -1320,7 +1401,7 @@ static int ufs_mtk_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op, - - if (status == PRE_CHANGE) { - if (ufshcd_is_auto_hibern8_supported(hba)) -- ufs_mtk_auto_hibern8_disable(hba); -+ return ufs_mtk_auto_hibern8_disable(hba); - return 0; - } - -@@ -1378,8 +1459,21 @@ static int ufs_mtk_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op) - } - - return 0; -+ - fail: -- return ufshcd_link_recovery(hba); -+ /* -+ * Check if the platform (parent) device has resumed, and ensure that -+ * power, clock, and MTCMOS are all turned on. -+ */ -+ err = ufshcd_link_recovery(hba); -+ if (err) { -+ dev_err(hba->dev, "Device PM: req=%d, status:%d, err:%d\n", -+ hba->dev->power.request, -+ hba->dev->power.runtime_status, -+ hba->dev->power.runtime_error); -+ } -+ -+ return 0; /* Cannot return a failure, otherwise, the I/O will hang. */ - } - - static void ufs_mtk_dbg_register_dump(struct ufs_hba *hba) -@@ -1444,6 +1538,7 @@ static void ufs_mtk_fixup_dev_quirks(struct ufs_hba *hba) - - ufs_mtk_vreg_fix_vcc(hba); - ufs_mtk_vreg_fix_vccqx(hba); -+ ufs_mtk_fix_ahit(hba); - } - - static void ufs_mtk_event_notify(struct ufs_hba *hba, -diff --git a/drivers/ufs/host/ufshcd-pci.c b/drivers/ufs/host/ufshcd-pci.c -index c38ea3395b2c10..4ecaaf52b3e95e 100644 ---- a/drivers/ufs/host/ufshcd-pci.c -+++ b/drivers/ufs/host/ufshcd-pci.c -@@ -15,6 +15,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -34,6 +35,7 @@ struct intel_host { - u32 dsm_fns; - u32 active_ltr; - u32 idle_ltr; -+ int saved_spm_lvl; - struct dentry *debugfs_root; - struct gpio_desc *reset_gpio; - }; -@@ -375,6 +377,7 @@ static int ufs_intel_common_init(struct ufs_hba *hba) - host = devm_kzalloc(hba->dev, sizeof(*host), GFP_KERNEL); - if (!host) - return -ENOMEM; -+ host->saved_spm_lvl = -1; - ufshcd_set_variant(hba, host); - intel_dsm_init(host, hba->dev); - if (INTEL_DSM_SUPPORTED(host, RESET)) { -@@ -460,7 +463,8 @@ static int ufs_intel_lkf_init(struct ufs_hba *hba) - static int ufs_intel_adl_init(struct ufs_hba *hba) - { - hba->nop_out_timeout = 200; -- hba->quirks |= UFSHCD_QUIRK_BROKEN_AUTO_HIBERN8; -+ hba->quirks |= UFSHCD_QUIRK_BROKEN_AUTO_HIBERN8 | -+ UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE; - hba->caps |= UFSHCD_CAP_WB_EN; - return ufs_intel_common_init(hba); - } -@@ -542,6 +546,66 @@ static int ufshcd_pci_restore(struct device *dev) - - return ufshcd_system_resume(dev); - } -+ -+static int ufs_intel_suspend_prepare(struct device *dev) -+{ -+ struct ufs_hba *hba = dev_get_drvdata(dev); -+ struct intel_host *host = ufshcd_get_variant(hba); -+ int err; -+ -+ /* -+ * Only s2idle (S0ix) retains link state. Force power-off -+ * (UFS_PM_LVL_5) for any other case. -+ */ -+ if (pm_suspend_target_state != PM_SUSPEND_TO_IDLE && hba->spm_lvl < UFS_PM_LVL_5) { -+ host->saved_spm_lvl = hba->spm_lvl; -+ hba->spm_lvl = UFS_PM_LVL_5; -+ } -+ -+ err = ufshcd_suspend_prepare(dev); -+ -+ if (err < 0 && host->saved_spm_lvl != -1) { -+ hba->spm_lvl = host->saved_spm_lvl; -+ host->saved_spm_lvl = -1; -+ } -+ -+ return err; -+} -+ -+static void ufs_intel_resume_complete(struct device *dev) -+{ -+ struct ufs_hba *hba = dev_get_drvdata(dev); -+ struct intel_host *host = ufshcd_get_variant(hba); -+ -+ ufshcd_resume_complete(dev); -+ -+ if (host->saved_spm_lvl != -1) { -+ hba->spm_lvl = host->saved_spm_lvl; -+ host->saved_spm_lvl = -1; -+ } -+} -+ -+static int ufshcd_pci_suspend_prepare(struct device *dev) -+{ -+ struct ufs_hba *hba = dev_get_drvdata(dev); -+ -+ if (!strcmp(hba->vops->name, "intel-pci")) -+ return ufs_intel_suspend_prepare(dev); -+ -+ return ufshcd_suspend_prepare(dev); -+} -+ -+static void ufshcd_pci_resume_complete(struct device *dev) -+{ -+ struct ufs_hba *hba = dev_get_drvdata(dev); -+ -+ if (!strcmp(hba->vops->name, "intel-pci")) { -+ ufs_intel_resume_complete(dev); -+ return; -+ } -+ -+ ufshcd_resume_complete(dev); -+} - #endif - - /** -@@ -624,8 +688,8 @@ static const struct dev_pm_ops ufshcd_pci_pm_ops = { - .thaw = ufshcd_system_resume, - .poweroff = ufshcd_system_suspend, - .restore = ufshcd_pci_restore, -- .prepare = ufshcd_suspend_prepare, -- .complete = ufshcd_resume_complete, -+ .prepare = ufshcd_pci_suspend_prepare, -+ .complete = ufshcd_pci_resume_complete, - #endif - }; - -diff --git a/drivers/usb/cdns3/cdnsp-gadget.c b/drivers/usb/cdns3/cdnsp-gadget.c -index 38e693cd3efc05..fb192b120d77fe 100644 ---- a/drivers/usb/cdns3/cdnsp-gadget.c -+++ b/drivers/usb/cdns3/cdnsp-gadget.c -@@ -1975,7 +1975,10 @@ static int __cdnsp_gadget_init(struct cdns *cdns) - return 0; - - del_gadget: -- usb_del_gadget_udc(&pdev->gadget); -+ usb_del_gadget(&pdev->gadget); -+ cdnsp_gadget_free_endpoints(pdev); -+ usb_put_gadget(&pdev->gadget); -+ goto halt_pdev; - free_endpoints: - cdnsp_gadget_free_endpoints(pdev); - halt_pdev: -@@ -1997,8 +2000,9 @@ static void cdnsp_gadget_exit(struct cdns *cdns) - devm_free_irq(pdev->dev, cdns->dev_irq, pdev); - pm_runtime_mark_last_busy(cdns->dev); - pm_runtime_put_autosuspend(cdns->dev); -- usb_del_gadget_udc(&pdev->gadget); -+ usb_del_gadget(&pdev->gadget); - cdnsp_gadget_free_endpoints(pdev); -+ usb_put_gadget(&pdev->gadget); - cdnsp_mem_cleanup(pdev); - kfree(pdev); - cdns->gadget_dev = NULL; -diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c -index 4a88546b1b1576..14424e395f2a96 100644 ---- a/drivers/usb/gadget/function/f_fs.c -+++ b/drivers/usb/gadget/function/f_fs.c -@@ -1941,7 +1941,12 @@ static int ffs_func_eps_enable(struct ffs_function *func) - ep = func->eps; - epfile = ffs->epfiles; - count = ffs->eps_count; -- while(count--) { -+ if (!epfile) { -+ ret = -ENOMEM; -+ goto done; -+ } -+ -+ while (count--) { - ep->ep->driver_data = ep; - - ret = config_ep_by_speed(func->gadget, &func->function, ep->ep); -@@ -1965,6 +1970,7 @@ static int ffs_func_eps_enable(struct ffs_function *func) - } - - wake_up_interruptible(&ffs->wait); -+done: - spin_unlock_irqrestore(&func->ffs->eps_lock, flags); - - return ret; -diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c -index 2f1ec03d17d6db..d8dafebeabea48 100644 ---- a/drivers/usb/gadget/function/f_hid.c -+++ b/drivers/usb/gadget/function/f_hid.c -@@ -494,7 +494,7 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer, - } - - req->status = 0; -- req->zero = 0; -+ req->zero = 1; - req->length = count; - req->complete = f_hidg_req_complete; - req->context = hidg; -@@ -765,7 +765,7 @@ static int hidg_setup(struct usb_function *f, - return -EOPNOTSUPP; - - respond: -- req->zero = 0; -+ req->zero = 1; - req->length = length; - status = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC); - if (status < 0) -diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c -index 7aad737901e833..1da4e59338c567 100644 ---- a/drivers/usb/gadget/function/f_ncm.c -+++ b/drivers/usb/gadget/function/f_ncm.c -@@ -1449,6 +1449,8 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f) - - ncm_opts->bound = true; - -+ ncm_string_defs[1].s = ncm->ethaddr; -+ - us = usb_gstrings_attach(cdev, ncm_strings, - ARRAY_SIZE(ncm_string_defs)); - if (IS_ERR(us)) -@@ -1696,7 +1698,6 @@ static struct usb_function *ncm_alloc(struct usb_function_instance *fi) - mutex_unlock(&opts->lock); - return ERR_PTR(-EINVAL); - } -- ncm_string_defs[STRING_MAC_IDX].s = ncm->ethaddr; - - spin_lock_init(&ncm->lock); - ncm_reset_values(ncm); -diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c -index b350ee080236e2..64383566cfb771 100644 ---- a/drivers/usb/host/xhci-plat.c -+++ b/drivers/usb/host/xhci-plat.c -@@ -168,6 +168,7 @@ int xhci_plat_probe(struct platform_device *pdev, struct device *sysdev, const s - return ret; - - pm_runtime_set_active(&pdev->dev); -+ pm_runtime_use_autosuspend(&pdev->dev); - pm_runtime_enable(&pdev->dev); - pm_runtime_get_noresume(&pdev->dev); - -diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c -index 4e30de4db1c0a8..dabe1a5c6ae567 100644 ---- a/drivers/usb/mon/mon_bin.c -+++ b/drivers/usb/mon/mon_bin.c -@@ -68,18 +68,20 @@ - * The magic limit was calculated so that it allows the monitoring - * application to pick data once in two ticks. This way, another application, - * which presumably drives the bus, gets to hog CPU, yet we collect our data. -- * If HZ is 100, a 480 mbit/s bus drives 614 KB every jiffy. USB has an -- * enormous overhead built into the bus protocol, so we need about 1000 KB. -+ * -+ * Originally, for a 480 Mbit/s bus this required a buffer of about 1 MB. For -+ * modern 20 Gbps buses, this value increases to over 50 MB. The maximum -+ * buffer size is set to 64 MiB to accommodate this. - * - * This is still too much for most cases, where we just snoop a few - * descriptor fetches for enumeration. So, the default is a "reasonable" -- * amount for systems with HZ=250 and incomplete bus saturation. -+ * amount for typical, low-throughput use cases. - * - * XXX What about multi-megabyte URBs which take minutes to transfer? - */ --#define BUFF_MAX CHUNK_ALIGN(1200*1024) --#define BUFF_DFL CHUNK_ALIGN(300*1024) --#define BUFF_MIN CHUNK_ALIGN(8*1024) -+#define BUFF_MAX CHUNK_ALIGN(64*1024*1024) -+#define BUFF_DFL CHUNK_ALIGN(300*1024) -+#define BUFF_MIN CHUNK_ALIGN(8*1024) - - /* - * The per-event API header (2 per URB). -diff --git a/drivers/vfio/iova_bitmap.c b/drivers/vfio/iova_bitmap.c -index 38b51613ecca90..3f48125e2b9f0f 100644 ---- a/drivers/vfio/iova_bitmap.c -+++ b/drivers/vfio/iova_bitmap.c -@@ -127,9 +127,8 @@ struct iova_bitmap { - static unsigned long iova_bitmap_offset_to_index(struct iova_bitmap *bitmap, - unsigned long iova) - { -- unsigned long pgsize = 1UL << bitmap->mapped.pgshift; -- -- return iova / (BITS_PER_TYPE(*bitmap->bitmap) * pgsize); -+ return (iova >> bitmap->mapped.pgshift) / -+ BITS_PER_TYPE(*bitmap->bitmap); - } - - /* -diff --git a/drivers/vfio/vfio_main.c b/drivers/vfio/vfio_main.c -index edb631e5e7ec99..6dfb290c339f99 100644 ---- a/drivers/vfio/vfio_main.c -+++ b/drivers/vfio/vfio_main.c -@@ -1195,7 +1195,7 @@ static int vfio_ioctl_device_feature(struct vfio_device *device, - feature.argsz - minsz); - default: - if (unlikely(!device->ops->device_feature)) -- return -EINVAL; -+ return -ENOTTY; - return device->ops->device_feature(device, feature.flags, - arg->data, - feature.argsz - minsz); -diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c -index 7075bfab59c4dc..d191560ce285f9 100644 ---- a/drivers/video/backlight/lp855x_bl.c -+++ b/drivers/video/backlight/lp855x_bl.c -@@ -22,7 +22,7 @@ - #define LP855X_DEVICE_CTRL 0x01 - #define LP855X_EEPROM_START 0xA0 - #define LP855X_EEPROM_END 0xA7 --#define LP8556_EPROM_START 0xA0 -+#define LP8556_EPROM_START 0x98 - #define LP8556_EPROM_END 0xAF - - /* LP8555/7 Registers */ -diff --git a/drivers/video/fbdev/aty/atyfb_base.c b/drivers/video/fbdev/aty/atyfb_base.c -index 3dcf83f5e7b4a1..297ba9517b88a7 100644 ---- a/drivers/video/fbdev/aty/atyfb_base.c -+++ b/drivers/video/fbdev/aty/atyfb_base.c -@@ -2611,8 +2611,12 @@ static int aty_init(struct fb_info *info) - pr_cont("\n"); - } - #endif -- if (par->pll_ops->init_pll) -- par->pll_ops->init_pll(info, &par->pll); -+ if (par->pll_ops->init_pll) { -+ ret = par->pll_ops->init_pll(info, &par->pll); -+ if (ret) -+ return ret; -+ } -+ - if (par->pll_ops->resume_pll) - par->pll_ops->resume_pll(info, &par->pll); - -diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c -index 42e681a78136ab..8563264d11fac6 100644 ---- a/drivers/video/fbdev/core/bitblit.c -+++ b/drivers/video/fbdev/core/bitblit.c -@@ -79,12 +79,16 @@ static inline void bit_putcs_aligned(struct vc_data *vc, struct fb_info *info, - struct fb_image *image, u8 *buf, u8 *dst) - { - u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff; -+ unsigned int charcnt = vc->vc_font.charcount; - u32 idx = vc->vc_font.width >> 3; - u8 *src; - - while (cnt--) { -- src = vc->vc_font.data + (scr_readw(s++)& -- charmask)*cellsize; -+ u16 ch = scr_readw(s++) & charmask; -+ -+ if (ch >= charcnt) -+ ch = 0; -+ src = vc->vc_font.data + (unsigned int)ch * cellsize; - - if (attr) { - update_attr(buf, src, attr, vc); -@@ -112,14 +116,18 @@ static inline void bit_putcs_unaligned(struct vc_data *vc, - u8 *dst) - { - u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff; -+ unsigned int charcnt = vc->vc_font.charcount; - u32 shift_low = 0, mod = vc->vc_font.width % 8; - u32 shift_high = 8; - u32 idx = vc->vc_font.width >> 3; - u8 *src; - - while (cnt--) { -- src = vc->vc_font.data + (scr_readw(s++)& -- charmask)*cellsize; -+ u16 ch = scr_readw(s++) & charmask; -+ -+ if (ch >= charcnt) -+ ch = 0; -+ src = vc->vc_font.data + (unsigned int)ch * cellsize; - - if (attr) { - update_attr(buf, src, attr, vc); -@@ -160,6 +168,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, - image.height = vc->vc_font.height; - image.depth = 1; - -+ if (image.dy >= info->var.yres) -+ return; -+ -+ image.height = min(image.height, info->var.yres - image.dy); -+ - if (attribute) { - buf = kmalloc(cellsize, GFP_ATOMIC); - if (!buf) -@@ -173,6 +186,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, - cnt = count; - - image.width = vc->vc_font.width * cnt; -+ -+ if (image.dx >= info->var.xres) -+ break; -+ -+ if (image.dx + image.width > info->var.xres) { -+ image.width = info->var.xres - image.dx; -+ cnt = image.width / vc->vc_font.width; -+ if (cnt == 0) -+ break; -+ image.width = cnt * vc->vc_font.width; -+ } -+ - pitch = DIV_ROUND_UP(image.width, 8) + scan_align; - pitch &= ~scan_align; - size = pitch * image.height + buf_align; -diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c -index b49f15a3442eab..78a5b22c8d1507 100644 ---- a/drivers/video/fbdev/core/fbcon.c -+++ b/drivers/video/fbdev/core/fbcon.c -@@ -2824,6 +2824,25 @@ int fbcon_mode_deleted(struct fb_info *info, - return found; - } - -+static void fbcon_delete_mode(struct fb_videomode *m) -+{ -+ struct fbcon_display *p; -+ -+ for (int i = first_fb_vc; i <= last_fb_vc; i++) { -+ p = &fb_display[i]; -+ if (p->mode == m) -+ p->mode = NULL; -+ } -+} -+ -+void fbcon_delete_modelist(struct list_head *head) -+{ -+ struct fb_modelist *modelist; -+ -+ list_for_each_entry(modelist, head, list) -+ fbcon_delete_mode(&modelist->mode); -+} -+ - #ifdef CONFIG_VT_HW_CONSOLE_BINDING - static void fbcon_unbind(void) - { -diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c -index 942b942f6bf9af..34b8e93f89a43c 100644 ---- a/drivers/video/fbdev/core/fbmem.c -+++ b/drivers/video/fbdev/core/fbmem.c -@@ -1030,6 +1030,7 @@ static void do_unregister_framebuffer(struct fb_info *fb_info) - fb_info->pixmap.addr = NULL; - } - -+ fbcon_delete_modelist(&fb_info->modelist); - fb_destroy_modelist(&fb_info->modelist); - registered_fb[fb_info->node] = NULL; - num_registered_fb--; -diff --git a/drivers/video/fbdev/pvr2fb.c b/drivers/video/fbdev/pvr2fb.c -index 6307364e4a49c5..7ae37f91b42c78 100644 ---- a/drivers/video/fbdev/pvr2fb.c -+++ b/drivers/video/fbdev/pvr2fb.c -@@ -192,7 +192,7 @@ static unsigned long pvr2fb_map; - - #ifdef CONFIG_PVR2_DMA - static unsigned int shdma = PVR2_CASCADE_CHAN; --static unsigned int pvr2dma = ONCHIP_NR_DMA_CHANNELS; -+static unsigned int pvr2dma = CONFIG_NR_ONCHIP_DMA_CHANNELS; - #endif - - static struct fb_videomode pvr2_modedb[] = { -diff --git a/drivers/video/fbdev/valkyriefb.c b/drivers/video/fbdev/valkyriefb.c -index 91d070ef69897d..6ff059ee169418 100644 ---- a/drivers/video/fbdev/valkyriefb.c -+++ b/drivers/video/fbdev/valkyriefb.c -@@ -329,11 +329,13 @@ static int __init valkyriefb_init(void) - - if (of_address_to_resource(dp, 0, &r)) { - printk(KERN_ERR "can't find address for valkyrie\n"); -+ of_node_put(dp); - return 0; - } - - frame_buffer_phys = r.start; - cmap_regs_phys = r.start + 0x304000; -+ of_node_put(dp); - } - #endif /* ppc (!CONFIG_MAC) */ - -diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c -index 0b4bd883ff28a8..183d77a6c4b31b 100644 ---- a/drivers/watchdog/s3c2410_wdt.c -+++ b/drivers/watchdog/s3c2410_wdt.c -@@ -26,6 +26,7 @@ - #include - #include - #include -+#include - - #define S3C2410_WTCON 0x00 - #define S3C2410_WTDAT 0x04 -@@ -302,9 +303,14 @@ static inline unsigned long s3c2410wdt_get_freq(struct s3c2410_wdt *wdt) - static inline unsigned int s3c2410wdt_max_timeout(struct s3c2410_wdt *wdt) - { - const unsigned long freq = s3c2410wdt_get_freq(wdt); -+ const u64 n_max = (u64)(S3C2410_WTCON_PRESCALE_MAX + 1) * -+ S3C2410_WTCON_MAXDIV * S3C2410_WTCNT_MAXCNT; -+ u64 t_max = div64_ul(n_max, freq); - -- return S3C2410_WTCNT_MAXCNT / (freq / (S3C2410_WTCON_PRESCALE_MAX + 1) -- / S3C2410_WTCON_MAXDIV); -+ if (t_max > UINT_MAX) -+ t_max = UINT_MAX; -+ -+ return t_max; - } - - static int s3c2410wdt_disable_wdt_reset(struct s3c2410_wdt *wdt, bool mask) -diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c -index d525957594b6b5..be61810cb7798f 100644 ---- a/fs/9p/v9fs.c -+++ b/fs/9p/v9fs.c -@@ -561,7 +561,7 @@ static ssize_t caches_show(struct kobject *kobj, - spin_lock(&v9fs_sessionlist_lock); - list_for_each_entry(v9ses, &v9fs_sessionlist, slist) { - if (v9ses->cachetag) { -- n = snprintf(buf, limit, "%s\n", v9ses->cachetag); -+ n = snprintf(buf + count, limit, "%s\n", v9ses->cachetag); - if (n < 0) { - count = n; - break; -@@ -597,13 +597,16 @@ static const struct attribute_group v9fs_attr_group = { - - static int __init v9fs_sysfs_init(void) - { -+ int ret; -+ - v9fs_kobj = kobject_create_and_add("9p", fs_kobj); - if (!v9fs_kobj) - return -ENOMEM; - -- if (sysfs_create_group(v9fs_kobj, &v9fs_attr_group)) { -+ ret = sysfs_create_group(v9fs_kobj, &v9fs_attr_group); -+ if (ret) { - kobject_put(v9fs_kobj); -- return -ENOMEM; -+ return ret; - } - - return 0; -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index 2d6ccc21a8229f..fab8ffb3a2f827 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -1751,6 +1751,14 @@ static noinline_for_stack void write_one_eb(struct extent_buffer *eb, - unlock_page(p); - } - } -+ /* -+ * If the fs is already in error status, do not submit any writeback -+ * but immediately finish it. -+ */ -+ if (unlikely(BTRFS_FS_ERROR(fs_info))) { -+ btrfs_bio_end_io(bbio, errno_to_blk_status(BTRFS_FS_ERROR(fs_info))); -+ return; -+ } - btrfs_submit_bio(bbio, 0); - } - -diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c -index e794606e7c780b..9ef543db8aab91 100644 ---- a/fs/btrfs/file.c -+++ b/fs/btrfs/file.c -@@ -2825,12 +2825,22 @@ static int btrfs_fallocate_update_isize(struct inode *inode, - { - struct btrfs_trans_handle *trans; - struct btrfs_root *root = BTRFS_I(inode)->root; -+ u64 range_start; -+ u64 range_end; - int ret; - int ret2; - - if (mode & FALLOC_FL_KEEP_SIZE || end <= i_size_read(inode)) - return 0; - -+ range_start = round_down(i_size_read(inode), root->fs_info->sectorsize); -+ range_end = round_up(end, root->fs_info->sectorsize); -+ -+ ret = btrfs_inode_set_file_extent_range(BTRFS_I(inode), range_start, -+ range_end - range_start); -+ if (ret) -+ return ret; -+ - trans = btrfs_start_transaction(root, 1); - if (IS_ERR(trans)) - return PTR_ERR(trans); -diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c -index 4a5a5ee360e579..a69dce114c5bae 100644 ---- a/fs/btrfs/scrub.c -+++ b/fs/btrfs/scrub.c -@@ -2000,6 +2000,7 @@ static int scrub_raid56_parity_stripe(struct scrub_ctx *sctx, - ret = btrfs_map_block(fs_info, BTRFS_MAP_WRITE, full_stripe_start, - &length, &bioc, NULL, NULL, 1); - if (ret < 0) { -+ bio_put(bio); - btrfs_put_bioc(bioc); - btrfs_bio_counter_dec(fs_info); - goto out; -@@ -2009,6 +2010,7 @@ static int scrub_raid56_parity_stripe(struct scrub_ctx *sctx, - btrfs_put_bioc(bioc); - if (!rbio) { - ret = -ENOMEM; -+ bio_put(bio); - btrfs_bio_counter_dec(fs_info); - goto out; - } -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index 5512991b24faa8..256116a6e07c6a 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -6765,7 +6765,7 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans, - * a power failure unless the log was synced as part of an fsync - * against any other unrelated inode. - */ -- if (inode_only != LOG_INODE_EXISTS) -+ if (!ctx->logging_new_name && inode_only != LOG_INODE_EXISTS) - inode->last_log_commit = inode->last_sub_trans; - spin_unlock(&inode->lock); - -diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c -index 1395b71df5ccc2..529dd07fa459f1 100644 ---- a/fs/ceph/dir.c -+++ b/fs/ceph/dir.c -@@ -1213,8 +1213,7 @@ static void ceph_async_unlink_cb(struct ceph_mds_client *mdsc, - spin_unlock(&fsc->async_unlink_conflict_lock); - - spin_lock(&dentry->d_lock); -- di->flags &= ~CEPH_DENTRY_ASYNC_UNLINK; -- wake_up_bit(&di->flags, CEPH_DENTRY_ASYNC_UNLINK_BIT); -+ clear_and_wake_up_bit(CEPH_DENTRY_ASYNC_UNLINK_BIT, &di->flags); - spin_unlock(&dentry->d_lock); - - synchronize_rcu(); -diff --git a/fs/ceph/file.c b/fs/ceph/file.c -index e12657b4c3e042..0ec78d87519ba7 100644 ---- a/fs/ceph/file.c -+++ b/fs/ceph/file.c -@@ -539,8 +539,7 @@ static void wake_async_create_waiters(struct inode *inode, - - spin_lock(&ci->i_ceph_lock); - if (ci->i_ceph_flags & CEPH_I_ASYNC_CREATE) { -- ci->i_ceph_flags &= ~CEPH_I_ASYNC_CREATE; -- wake_up_bit(&ci->i_ceph_flags, CEPH_ASYNC_CREATE_BIT); -+ clear_and_wake_up_bit(CEPH_ASYNC_CREATE_BIT, &ci->i_ceph_flags); - - if (ci->i_ceph_flags & CEPH_I_ASYNC_CHECK_CAPS) { - ci->i_ceph_flags &= ~CEPH_I_ASYNC_CHECK_CAPS; -@@ -716,8 +715,7 @@ static int ceph_finish_async_create(struct inode *dir, struct inode *inode, - } - - spin_lock(&dentry->d_lock); -- di->flags &= ~CEPH_DENTRY_ASYNC_CREATE; -- wake_up_bit(&di->flags, CEPH_DENTRY_ASYNC_CREATE_BIT); -+ clear_and_wake_up_bit(CEPH_DENTRY_ASYNC_CREATE_BIT, &di->flags); - spin_unlock(&dentry->d_lock); - - return ret; -diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c -index cb51c7e9c8e22c..02f5fbe83aa46d 100644 ---- a/fs/ceph/locks.c -+++ b/fs/ceph/locks.c -@@ -219,7 +219,10 @@ static int ceph_lock_wait_for_completion(struct ceph_mds_client *mdsc, - if (err && err != -ERESTARTSYS) - return err; - -- wait_for_completion_killable(&req->r_safe_completion); -+ err = wait_for_completion_killable(&req->r_safe_completion); -+ if (err) -+ return err; -+ - return 0; - } - -diff --git a/fs/exfat/fatent.c b/fs/exfat/fatent.c -index 407880901ee3fb..e5f4ce8c38e1a7 100644 ---- a/fs/exfat/fatent.c -+++ b/fs/exfat/fatent.c -@@ -89,35 +89,36 @@ int exfat_ent_get(struct super_block *sb, unsigned int loc, - int err; - - if (!is_valid_cluster(sbi, loc)) { -- exfat_fs_error(sb, "invalid access to FAT (entry 0x%08x)", -+ exfat_fs_error_ratelimit(sb, -+ "invalid access to FAT (entry 0x%08x)", - loc); - return -EIO; - } - - err = __exfat_ent_get(sb, loc, content); - if (err) { -- exfat_fs_error(sb, -+ exfat_fs_error_ratelimit(sb, - "failed to access to FAT (entry 0x%08x, err:%d)", - loc, err); - return err; - } - - if (*content == EXFAT_FREE_CLUSTER) { -- exfat_fs_error(sb, -+ exfat_fs_error_ratelimit(sb, - "invalid access to FAT free cluster (entry 0x%08x)", - loc); - return -EIO; - } - - if (*content == EXFAT_BAD_CLUSTER) { -- exfat_fs_error(sb, -+ exfat_fs_error_ratelimit(sb, - "invalid access to FAT bad cluster (entry 0x%08x)", - loc); - return -EIO; - } - - if (*content != EXFAT_EOF_CLUSTER && !is_valid_cluster(sbi, *content)) { -- exfat_fs_error(sb, -+ exfat_fs_error_ratelimit(sb, - "invalid access to FAT (entry 0x%08x) bogus content (0x%08x)", - loc, *content); - return -EIO; -diff --git a/fs/ext4/fast_commit.c b/fs/ext4/fast_commit.c -index b527f4ab47e021..62a6960242c5a6 100644 ---- a/fs/ext4/fast_commit.c -+++ b/fs/ext4/fast_commit.c -@@ -675,7 +675,7 @@ void ext4_fc_track_range(handle_t *handle, struct inode *inode, ext4_lblk_t star - - static void ext4_fc_submit_bh(struct super_block *sb, bool is_tail) - { -- blk_opf_t write_flags = REQ_SYNC; -+ blk_opf_t write_flags = JBD2_JOURNAL_REQ_FLAGS; - struct buffer_head *bh = EXT4_SB(sb)->s_fc_bh; - - /* Add REQ_FUA | REQ_PREFLUSH only its tail */ -diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c -index 66933e55efb3bd..307081c9943743 100644 ---- a/fs/ext4/xattr.c -+++ b/fs/ext4/xattr.c -@@ -1552,7 +1552,7 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value, - WARN_ON_ONCE(ext4_handle_valid(journal_current_handle()) && - !(current->flags & PF_MEMALLOC_NOFS)); - -- ea_data = kvmalloc(value_len, GFP_KERNEL); -+ ea_data = kvmalloc(value_len, GFP_NOFS); - if (!ea_data) { - mb_cache_entry_put(ea_inode_cache, ce); - return NULL; -diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c -index e962de4ecaa2f6..c3b2f78ca4e3e2 100644 ---- a/fs/f2fs/compress.c -+++ b/fs/f2fs/compress.c -@@ -1209,7 +1209,7 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock) - int i; - - for (i = cluster_size - 1; i >= 0; i--) { -- loff_t start = rpages[i]->index << PAGE_SHIFT; -+ loff_t start = (loff_t)rpages[i]->index << PAGE_SHIFT; - - if (from <= start) { - zero_user_segment(rpages[i], 0, PAGE_SIZE); -diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c -index 6a77581106a9e4..79d07c786f6aec 100644 ---- a/fs/f2fs/extent_cache.c -+++ b/fs/f2fs/extent_cache.c -@@ -562,7 +562,13 @@ static struct extent_node *__insert_extent_tree(struct f2fs_sb_info *sbi, - p = &(*p)->rb_right; - leftmost = false; - } else { -+ f2fs_err_ratelimited(sbi, "%s: corrupted extent, type: %d, " -+ "extent node in rb tree [%u, %u, %u], age [%llu, %llu], " -+ "extent node to insert [%u, %u, %u], age [%llu, %llu]", -+ __func__, et->type, en->ei.fofs, en->ei.blk, en->ei.len, en->ei.age, -+ en->ei.last_blocks, ei->fofs, ei->blk, ei->len, ei->age, ei->last_blocks); - f2fs_bug_on(sbi, 1); -+ return NULL; - } - } - -diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c -index 735abf426a0640..96050028d91b0e 100644 ---- a/fs/fuse/inode.c -+++ b/fs/fuse/inode.c -@@ -94,14 +94,11 @@ static struct inode *fuse_alloc_inode(struct super_block *sb) - if (!fi) - return NULL; - -- fi->i_time = 0; -+ /* Initialize private data (i.e. everything except fi->inode) */ -+ BUILD_BUG_ON(offsetof(struct fuse_inode, inode) != 0); -+ memset((void *) fi + sizeof(fi->inode), 0, sizeof(*fi) - sizeof(fi->inode)); -+ - fi->inval_mask = ~0; -- fi->nodeid = 0; -- fi->nlookup = 0; -- fi->attr_version = 0; -- fi->orig_ino = 0; -- fi->state = 0; -- fi->submount_lookup = NULL; - mutex_init(&fi->mutex); - spin_lock_init(&fi->lock); - fi->forget = fuse_alloc_forget(); -diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c -index f4eb8d6f598944..6cf17fe239c9a3 100644 ---- a/fs/hpfs/namei.c -+++ b/fs/hpfs/namei.c -@@ -52,8 +52,10 @@ static int hpfs_mkdir(struct mnt_idmap *idmap, struct inode *dir, - dee.fnode = cpu_to_le32(fno); - dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); - result = new_inode(dir->i_sb); -- if (!result) -+ if (!result) { -+ err = -ENOMEM; - goto bail2; -+ } - hpfs_init_inode(result); - result->i_ino = fno; - hpfs_i(result)->i_parent_dir = dir->i_ino; -@@ -153,9 +155,10 @@ static int hpfs_create(struct mnt_idmap *idmap, struct inode *dir, - dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); - - result = new_inode(dir->i_sb); -- if (!result) -+ if (!result) { -+ err = -ENOMEM; - goto bail1; -- -+ } - hpfs_init_inode(result); - result->i_ino = fno; - result->i_mode |= S_IFREG; -@@ -239,9 +242,10 @@ static int hpfs_mknod(struct mnt_idmap *idmap, struct inode *dir, - dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); - - result = new_inode(dir->i_sb); -- if (!result) -+ if (!result) { -+ err = -ENOMEM; - goto bail1; -- -+ } - hpfs_init_inode(result); - result->i_ino = fno; - hpfs_i(result)->i_parent_dir = dir->i_ino; -@@ -314,8 +318,10 @@ static int hpfs_symlink(struct mnt_idmap *idmap, struct inode *dir, - dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb)); - - result = new_inode(dir->i_sb); -- if (!result) -+ if (!result) { -+ err = -ENOMEM; - goto bail1; -+ } - result->i_ino = fno; - hpfs_init_inode(result); - hpfs_i(result)->i_parent_dir = dir->i_ino; -diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c -index 66c38ef5e57111..1e6c1d1a15a6a6 100644 ---- a/fs/jfs/inode.c -+++ b/fs/jfs/inode.c -@@ -59,9 +59,15 @@ struct inode *jfs_iget(struct super_block *sb, unsigned long ino) - */ - inode->i_link[inode->i_size] = '\0'; - } -- } else { -+ } else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) || -+ S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) { - inode->i_op = &jfs_file_inode_operations; - init_special_inode(inode, inode->i_mode, inode->i_rdev); -+ } else { -+ printk(KERN_DEBUG "JFS: Invalid file type 0%04o for inode %lu.\n", -+ inode->i_mode, inode->i_ino); -+ iget_failed(inode); -+ return ERR_PTR(-EIO); - } - unlock_new_inode(inode); - return inode; -diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c -index dccc8b3f104593..42fb833ef28347 100644 ---- a/fs/jfs/jfs_txnmgr.c -+++ b/fs/jfs/jfs_txnmgr.c -@@ -272,14 +272,15 @@ int txInit(void) - if (TxBlock == NULL) - return -ENOMEM; - -- for (k = 1; k < nTxBlock - 1; k++) { -- TxBlock[k].next = k + 1; -+ for (k = 0; k < nTxBlock; k++) { - init_waitqueue_head(&TxBlock[k].gcwait); - init_waitqueue_head(&TxBlock[k].waitor); - } -+ -+ for (k = 1; k < nTxBlock - 1; k++) { -+ TxBlock[k].next = k + 1; -+ } - TxBlock[k].next = 0; -- init_waitqueue_head(&TxBlock[k].gcwait); -- init_waitqueue_head(&TxBlock[k].waitor); - - TxAnchor.freetid = 1; - init_waitqueue_head(&TxAnchor.freewait); -diff --git a/fs/nfs/nfs3client.c b/fs/nfs/nfs3client.c -index 674c012868b1a2..1aa4c43c9b3b41 100644 ---- a/fs/nfs/nfs3client.c -+++ b/fs/nfs/nfs3client.c -@@ -2,6 +2,7 @@ - #include - #include - #include -+#include - #include "internal.h" - #include "nfs3_fs.h" - #include "netns.h" -@@ -98,7 +99,11 @@ struct nfs_client *nfs3_set_ds_client(struct nfs_server *mds_srv, - .net = mds_clp->cl_net, - .timeparms = &ds_timeout, - .cred = mds_srv->cred, -- .xprtsec = mds_clp->cl_xprtsec, -+ .xprtsec = { -+ .policy = RPC_XPRTSEC_NONE, -+ .cert_serial = TLS_NO_CERT, -+ .privkey_serial = TLS_NO_PRIVKEY, -+ }, - .connect_timeout = connect_timeout, - .reconnect_timeout = connect_timeout, - }; -@@ -111,8 +116,14 @@ struct nfs_client *nfs3_set_ds_client(struct nfs_server *mds_srv, - cl_init.hostname = buf; - - switch (ds_proto) { -- case XPRT_TRANSPORT_TCP: - case XPRT_TRANSPORT_TCP_TLS: -+ if (mds_clp->cl_xprtsec.policy != RPC_XPRTSEC_NONE) -+ cl_init.xprtsec = mds_clp->cl_xprtsec; -+ else -+ ds_proto = XPRT_TRANSPORT_TCP; -+ fallthrough; -+ case XPRT_TRANSPORT_RDMA: -+ case XPRT_TRANSPORT_TCP: - if (mds_clp->cl_nconnect > 1) - cl_init.nconnect = mds_clp->cl_nconnect; - } -diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c -index f6dc42de48f03d..b14688da814d6c 100644 ---- a/fs/nfs/nfs4client.c -+++ b/fs/nfs/nfs4client.c -@@ -11,6 +11,7 @@ - #include - #include - #include -+#include - #include "internal.h" - #include "callback.h" - #include "delegation.h" -@@ -222,6 +223,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init) - clp->cl_state = 1 << NFS4CLNT_LEASE_EXPIRED; - clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion]; - clp->cl_mig_gen = 1; -+ clp->cl_last_renewal = jiffies; - #if IS_ENABLED(CONFIG_NFS_V4_1) - init_waitqueue_head(&clp->cl_lock_waitq); - #endif -@@ -923,6 +925,7 @@ static int nfs4_set_client(struct nfs_server *server, - else - cl_init.max_connect = max_connect; - switch (proto) { -+ case XPRT_TRANSPORT_RDMA: - case XPRT_TRANSPORT_TCP: - case XPRT_TRANSPORT_TCP_TLS: - cl_init.nconnect = nconnect; -@@ -990,7 +993,11 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv, - .net = mds_clp->cl_net, - .timeparms = &ds_timeout, - .cred = mds_srv->cred, -- .xprtsec = mds_srv->nfs_client->cl_xprtsec, -+ .xprtsec = { -+ .policy = RPC_XPRTSEC_NONE, -+ .cert_serial = TLS_NO_CERT, -+ .privkey_serial = TLS_NO_PRIVKEY, -+ }, - }; - char buf[INET6_ADDRSTRLEN + 1]; - -@@ -999,8 +1006,14 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv, - cl_init.hostname = buf; - - switch (ds_proto) { -- case XPRT_TRANSPORT_TCP: - case XPRT_TRANSPORT_TCP_TLS: -+ if (mds_srv->nfs_client->cl_xprtsec.policy != RPC_XPRTSEC_NONE) -+ cl_init.xprtsec = mds_srv->nfs_client->cl_xprtsec; -+ else -+ ds_proto = XPRT_TRANSPORT_TCP; -+ fallthrough; -+ case XPRT_TRANSPORT_RDMA: -+ case XPRT_TRANSPORT_TCP: - if (mds_clp->cl_nconnect > 1) { - cl_init.nconnect = mds_clp->cl_nconnect; - cl_init.max_connect = NFS_MAX_TRANSPORTS; -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 94a1caf3266991..a0a71a163ffed0 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -362,7 +362,9 @@ static void nfs4_setup_readdir(u64 cookie, __be32 *verifier, struct dentry *dent - *p++ = htonl(attrs); /* bitmap */ - *p++ = htonl(12); /* attribute buffer length */ - *p++ = htonl(NF4DIR); -+ spin_lock(&dentry->d_lock); - p = xdr_encode_hyper(p, NFS_FILEID(d_inode(dentry->d_parent))); -+ spin_unlock(&dentry->d_lock); - - readdir->pgbase = (char *)p - (char *)start; - readdir->count -= readdir->pgbase; -@@ -4576,16 +4578,19 @@ static int _nfs4_proc_lookupp(struct inode *inode, - }; - unsigned short task_flags = 0; - -- if (NFS_SERVER(inode)->flags & NFS_MOUNT_SOFTREVAL) -+ if (server->flags & NFS_MOUNT_SOFTREVAL) - task_flags |= RPC_TASK_TIMEOUT; -+ if (server->caps & NFS_CAP_MOVEABLE) -+ task_flags |= RPC_TASK_MOVEABLE; - - args.bitmask = nfs4_bitmask(server, fattr->label); - - nfs_fattr_init(fattr); -+ nfs4_init_sequence(&args.seq_args, &res.seq_res, 0, 0); - - dprintk("NFS call lookupp ino=0x%lx\n", inode->i_ino); -- status = nfs4_call_sync(clnt, server, &msg, &args.seq_args, -- &res.seq_res, task_flags); -+ status = nfs4_do_call_sync(clnt, server, &msg, &args.seq_args, -+ &res.seq_res, task_flags); - dprintk("NFS reply lookupp: %d\n", status); - return status; - } -@@ -7658,10 +7663,10 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state, - return err; - do { - err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW); -- if (err != -NFS4ERR_DELAY) -+ if (err != -NFS4ERR_DELAY && err != -NFS4ERR_GRACE) - break; - ssleep(1); -- } while (err == -NFS4ERR_DELAY); -+ } while (err == -NFS4ERR_DELAY || err == -NFSERR_GRACE); - return nfs4_handle_delegation_recall_error(server, state, stateid, fl, err); - } - -diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c -index 9fc71dc090c254..78d52c2006dcc9 100644 ---- a/fs/nfs/nfs4state.c -+++ b/fs/nfs/nfs4state.c -@@ -2746,6 +2746,9 @@ static void nfs4_state_manager(struct nfs_client *clp) - case -ENETUNREACH: - nfs_mark_client_ready(clp, -EIO); - break; -+ case -EINVAL: -+ nfs_mark_client_ready(clp, status); -+ break; - default: - ssleep(1); - break; -diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c -index 1b317c44da126b..5314dabb725d80 100644 ---- a/fs/nfs/pnfs_nfs.c -+++ b/fs/nfs/pnfs_nfs.c -@@ -914,7 +914,10 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv, - u32 minor_version) - { - struct nfs_client *clp = ERR_PTR(-EIO); -+ struct nfs_client *mds_clp = mds_srv->nfs_client; -+ enum xprtsec_policies xprtsec_policy = mds_clp->cl_xprtsec.policy; - struct nfs4_pnfs_ds_addr *da; -+ int ds_proto; - int status = 0; - - dprintk("--> %s DS %s\n", __func__, ds->ds_remotestr); -@@ -942,12 +945,8 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv, - .data = &xprtdata, - }; - -- if (da->da_transport != clp->cl_proto && -- clp->cl_proto != XPRT_TRANSPORT_TCP_TLS) -- continue; -- if (da->da_transport == XPRT_TRANSPORT_TCP && -- mds_srv->nfs_client->cl_proto == -- XPRT_TRANSPORT_TCP_TLS) { -+ if (xprt_args.ident == XPRT_TRANSPORT_TCP && -+ clp->cl_proto == XPRT_TRANSPORT_TCP_TLS) { - struct sockaddr *addr = - (struct sockaddr *)&da->da_addr; - struct sockaddr_in *sin = -@@ -978,7 +977,10 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv, - xprt_args.ident = XPRT_TRANSPORT_TCP_TLS; - xprt_args.servername = servername; - } -- if (da->da_addr.ss_family != clp->cl_addr.ss_family) -+ if (xprt_args.ident != clp->cl_proto) -+ continue; -+ if (xprt_args.dstaddr->sa_family != -+ clp->cl_addr.ss_family) - continue; - - /** -@@ -992,15 +994,14 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv, - if (xprtdata.cred) - put_cred(xprtdata.cred); - } else { -- if (da->da_transport == XPRT_TRANSPORT_TCP && -- mds_srv->nfs_client->cl_proto == -- XPRT_TRANSPORT_TCP_TLS) -- da->da_transport = XPRT_TRANSPORT_TCP_TLS; -- clp = nfs4_set_ds_client(mds_srv, -- &da->da_addr, -- da->da_addrlen, -- da->da_transport, timeo, -- retrans, minor_version); -+ ds_proto = da->da_transport; -+ if (ds_proto == XPRT_TRANSPORT_TCP && -+ xprtsec_policy != RPC_XPRTSEC_NONE) -+ ds_proto = XPRT_TRANSPORT_TCP_TLS; -+ -+ clp = nfs4_set_ds_client(mds_srv, &da->da_addr, -+ da->da_addrlen, ds_proto, -+ timeo, retrans, minor_version); - if (IS_ERR(clp)) - continue; - -@@ -1011,7 +1012,6 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv, - clp = ERR_PTR(-EIO); - continue; - } -- - } - } - -diff --git a/fs/nfs/sysfs.c b/fs/nfs/sysfs.c -index 784f7c1d003bfc..53d4cdf28ee008 100644 ---- a/fs/nfs/sysfs.c -+++ b/fs/nfs/sysfs.c -@@ -189,6 +189,7 @@ static struct nfs_netns_client *nfs_netns_client_alloc(struct kobject *parent, - return p; - - kobject_put(&p->kobject); -+ kobject_put(&p->nfs_net_kobj); - } - return NULL; - } -diff --git a/fs/nfs/write.c b/fs/nfs/write.c -index cb1e9996fcc8ec..ef69b15aa72e5f 100644 ---- a/fs/nfs/write.c -+++ b/fs/nfs/write.c -@@ -1638,7 +1638,8 @@ static int nfs_writeback_done(struct rpc_task *task, - /* Deal with the suid/sgid bit corner case */ - if (nfs_should_remove_suid(inode)) { - spin_lock(&inode->i_lock); -- nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE); -+ nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE -+ | NFS_INO_REVAL_FORCED); - spin_unlock(&inode->i_lock); - } - return 0; -diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c -index 836367d839bda1..886c0926754426 100644 ---- a/fs/nfsd/nfs4proc.c -+++ b/fs/nfsd/nfs4proc.c -@@ -978,10 +978,11 @@ nfsd4_read(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, - static void - nfsd4_read_release(union nfsd4_op_u *u) - { -- if (u->read.rd_nf) -+ if (u->read.rd_nf) { -+ trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp, -+ u->read.rd_offset, u->read.rd_length); - nfsd_file_put(u->read.rd_nf); -- trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp, -- u->read.rd_offset, u->read.rd_length); -+ } - } - - static __be32 -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index 4aeb08040f3e5a..e6d0c3b1169aaa 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -1496,7 +1496,8 @@ static void nfs4_free_ol_stateid(struct nfs4_stid *stid) - release_all_access(stp); - if (stp->st_stateowner) - nfs4_put_stateowner(stp->st_stateowner); -- WARN_ON(!list_empty(&stid->sc_cp_list)); -+ if (!list_empty(&stid->sc_cp_list)) -+ nfs4_free_cpntf_statelist(stid->sc_client->net, stid); - kmem_cache_free(stateid_slab, stid); - } - -diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c -index 0150a221020988..a967babea8a59d 100644 ---- a/fs/ntfs3/inode.c -+++ b/fs/ntfs3/inode.c -@@ -464,6 +464,7 @@ static struct inode *ntfs_read_mft(struct inode *inode, - fname->home.seq == cpu_to_le16(MFT_REC_EXTEND)) { - /* Records in $Extend are not a files or general directories. */ - inode->i_op = &ntfs_file_inode_operations; -+ mode = S_IFREG; - } else { - err = -EINVAL; - goto out; -diff --git a/fs/open.c b/fs/open.c -index f9ac703ec1b2d3..b5ea1dcbfb2242 100644 ---- a/fs/open.c -+++ b/fs/open.c -@@ -1029,18 +1029,20 @@ EXPORT_SYMBOL(finish_open); - * finish_no_open - finish ->atomic_open() without opening the file - * - * @file: file pointer -- * @dentry: dentry or NULL (as returned from ->lookup()) -+ * @dentry: dentry, ERR_PTR(-E...) or NULL (as returned from ->lookup()) - * -- * This can be used to set the result of a successful lookup in ->atomic_open(). -+ * This can be used to set the result of a lookup in ->atomic_open(). - * - * NB: unlike finish_open() this function does consume the dentry reference and - * the caller need not dput() it. - * -- * Returns "0" which must be the return value of ->atomic_open() after having -- * called this function. -+ * Returns 0 or -E..., which must be the return value of ->atomic_open() after -+ * having called this function. - */ - int finish_no_open(struct file *file, struct dentry *dentry) - { -+ if (IS_ERR(dentry)) -+ return PTR_ERR(dentry); - file->f_path.dentry = dentry; - return 0; - } -diff --git a/fs/orangefs/xattr.c b/fs/orangefs/xattr.c -index 68b62689a63e24..15738379f55116 100644 ---- a/fs/orangefs/xattr.c -+++ b/fs/orangefs/xattr.c -@@ -54,7 +54,9 @@ static inline int convert_to_internal_xattr_flags(int setxattr_flags) - static unsigned int xattr_key(const char *key) - { - unsigned int i = 0; -- while (key) -+ if (!key) -+ return 0; -+ while (*key) - i += *key++; - return i % 16; - } -@@ -175,8 +177,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name, - cx->length = -1; - cx->timeout = jiffies + - orangefs_getattr_timeout_msecs*HZ/1000; -- hash_add(orangefs_inode->xattr_cache, &cx->node, -- xattr_key(cx->key)); -+ hlist_add_head( &cx->node, -+ &orangefs_inode->xattr_cache[xattr_key(cx->key)]); - } - } - goto out_release_op; -@@ -229,8 +231,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name, - memcpy(cx->val, buffer, length); - cx->length = length; - cx->timeout = jiffies + HZ; -- hash_add(orangefs_inode->xattr_cache, &cx->node, -- xattr_key(cx->key)); -+ hlist_add_head(&cx->node, -+ &orangefs_inode->xattr_cache[xattr_key(cx->key)]); - } - } - -diff --git a/fs/proc/generic.c b/fs/proc/generic.c -index 4cadd2fd23d8f8..9eff57c7aef3a5 100644 ---- a/fs/proc/generic.c -+++ b/fs/proc/generic.c -@@ -694,6 +694,12 @@ void pde_put(struct proc_dir_entry *pde) - } - } - -+static void pde_erase(struct proc_dir_entry *pde, struct proc_dir_entry *parent) -+{ -+ rb_erase(&pde->subdir_node, &parent->subdir); -+ RB_CLEAR_NODE(&pde->subdir_node); -+} -+ - /* - * Remove a /proc entry and free it if it's not currently in use. - */ -@@ -716,7 +722,7 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent) - WARN(1, "removing permanent /proc entry '%s'", de->name); - de = NULL; - } else { -- rb_erase(&de->subdir_node, &parent->subdir); -+ pde_erase(de, parent); - if (S_ISDIR(de->mode)) - parent->nlink--; - } -@@ -760,7 +766,7 @@ int remove_proc_subtree(const char *name, struct proc_dir_entry *parent) - root->parent->name, root->name); - return -EINVAL; - } -- rb_erase(&root->subdir_node, &parent->subdir); -+ pde_erase(root, parent); - - de = root; - while (1) { -@@ -772,7 +778,7 @@ int remove_proc_subtree(const char *name, struct proc_dir_entry *parent) - next->parent->name, next->name); - return -EINVAL; - } -- rb_erase(&next->subdir_node, &de->subdir); -+ pde_erase(next, de); - de = next; - continue; - } -diff --git a/fs/smb/client/cached_dir.c b/fs/smb/client/cached_dir.c -index d64742ba371aa5..539a9038fb0dd2 100644 ---- a/fs/smb/client/cached_dir.c -+++ b/fs/smb/client/cached_dir.c -@@ -362,11 +362,11 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, - * lease. Release one here, and the second below. - */ - cfid->has_lease = false; -- kref_put(&cfid->refcount, smb2_close_cached_fid); -+ close_cached_dir(cfid); - } - spin_unlock(&cfids->cfid_list_lock); - -- kref_put(&cfid->refcount, smb2_close_cached_fid); -+ close_cached_dir(cfid); - } else { - *ret_cfid = cfid; - atomic_inc(&tcon->num_remote_opens); -@@ -406,12 +406,14 @@ int open_cached_dir_by_dentry(struct cifs_tcon *tcon, - - static void - smb2_close_cached_fid(struct kref *ref) -+__releases(&cfid->cfids->cfid_list_lock) - { - struct cached_fid *cfid = container_of(ref, struct cached_fid, - refcount); - int rc; - -- spin_lock(&cfid->cfids->cfid_list_lock); -+ lockdep_assert_held(&cfid->cfids->cfid_list_lock); -+ - if (cfid->on_list) { - list_del(&cfid->entry); - cfid->on_list = false; -@@ -446,7 +448,7 @@ void drop_cached_dir_by_name(const unsigned int xid, struct cifs_tcon *tcon, - spin_lock(&cfid->cfids->cfid_list_lock); - if (cfid->has_lease) { - cfid->has_lease = false; -- kref_put(&cfid->refcount, smb2_close_cached_fid); -+ close_cached_dir(cfid); - } - spin_unlock(&cfid->cfids->cfid_list_lock); - close_cached_dir(cfid); -@@ -455,7 +457,7 @@ void drop_cached_dir_by_name(const unsigned int xid, struct cifs_tcon *tcon, - - void close_cached_dir(struct cached_fid *cfid) - { -- kref_put(&cfid->refcount, smb2_close_cached_fid); -+ kref_put_lock(&cfid->refcount, smb2_close_cached_fid, &cfid->cfids->cfid_list_lock); - } - - /* -@@ -566,7 +568,7 @@ cached_dir_offload_close(struct work_struct *work) - - WARN_ON(cfid->on_list); - -- kref_put(&cfid->refcount, smb2_close_cached_fid); -+ close_cached_dir(cfid); - cifs_put_tcon(tcon, netfs_trace_tcon_ref_put_cached_close); - } - -@@ -743,7 +745,7 @@ static void cfids_laundromat_worker(struct work_struct *work) - * Drop the ref-count from above, either the lease-ref (if there - * was one) or the extra one acquired. - */ -- kref_put(&cfid->refcount, smb2_close_cached_fid); -+ close_cached_dir(cfid); - } - queue_delayed_work(cfid_put_wq, &cfids->laundromat_work, - dir_cache_timeout * HZ); -diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c -index 1058066913dd60..92e43589fd83f1 100644 ---- a/fs/smb/client/file.c -+++ b/fs/smb/client/file.c -@@ -37,6 +37,81 @@ - #include "cifs_ioctl.h" - #include "cached_dir.h" - -+/* -+ * Allocate a bio_vec array and extract up to sg_max pages from a KVEC-type -+ * iterator and add them to the array. This can deal with vmalloc'd buffers as -+ * well as kmalloc'd or static buffers. The pages are not pinned. -+ */ -+static ssize_t extract_kvec_to_bvec(struct iov_iter *iter, ssize_t maxsize, -+ unsigned int bc_max, -+ struct bio_vec **_bv, unsigned int *_bc) -+{ -+ const struct kvec *kv = iter->kvec; -+ struct bio_vec *bv; -+ unsigned long start = iter->iov_offset; -+ unsigned int i, bc = 0; -+ ssize_t ret = 0; -+ -+ bc_max = iov_iter_npages(iter, bc_max); -+ if (bc_max == 0) { -+ *_bv = NULL; -+ *_bc = 0; -+ return 0; -+ } -+ -+ bv = kvmalloc(array_size(bc_max, sizeof(*bv)), GFP_NOFS); -+ if (!bv) { -+ *_bv = NULL; -+ *_bc = 0; -+ return -ENOMEM; -+ } -+ *_bv = bv; -+ -+ for (i = 0; i < iter->nr_segs; i++) { -+ struct page *page; -+ unsigned long kaddr; -+ size_t off, len, seg; -+ -+ len = kv[i].iov_len; -+ if (start >= len) { -+ start -= len; -+ continue; -+ } -+ -+ kaddr = (unsigned long)kv[i].iov_base + start; -+ off = kaddr & ~PAGE_MASK; -+ len = min_t(size_t, maxsize, len - start); -+ kaddr &= PAGE_MASK; -+ -+ maxsize -= len; -+ ret += len; -+ do { -+ seg = umin(len, PAGE_SIZE - off); -+ if (is_vmalloc_or_module_addr((void *)kaddr)) -+ page = vmalloc_to_page((void *)kaddr); -+ else -+ page = virt_to_page((void *)kaddr); -+ -+ bvec_set_page(bv, page, len, off); -+ bv++; -+ bc++; -+ -+ len -= seg; -+ kaddr += PAGE_SIZE; -+ off = 0; -+ } while (len > 0 && bc < bc_max); -+ -+ if (maxsize <= 0 || bc >= bc_max) -+ break; -+ start = 0; -+ } -+ -+ if (ret > 0) -+ iov_iter_advance(iter, ret); -+ *_bc = bc; -+ return ret; -+} -+ - /* - * Remove the dirty flags from a span of pages. - */ -@@ -2747,8 +2822,10 @@ static void cifs_extend_writeback(struct address_space *mapping, - loff_t start, - int max_pages, - loff_t max_len, -- size_t *_len) -+ size_t *_len, -+ unsigned long long i_size) - { -+ struct inode *inode = mapping->host; - struct folio_batch batch; - struct folio *folio; - unsigned int nr_pages; -@@ -2779,7 +2856,7 @@ static void cifs_extend_writeback(struct address_space *mapping, - - if (!folio_try_get(folio)) { - xas_reset(xas); -- continue; -+ break; - } - nr_pages = folio_nr_pages(folio); - if (nr_pages > max_pages) { -@@ -2799,6 +2876,15 @@ static void cifs_extend_writeback(struct address_space *mapping, - xas_reset(xas); - break; - } -+ -+ /* if file size is changing, stop extending */ -+ if (i_size_read(inode) != i_size) { -+ folio_unlock(folio); -+ folio_put(folio); -+ xas_reset(xas); -+ break; -+ } -+ - if (!folio_test_dirty(folio) || - folio_test_writeback(folio)) { - folio_unlock(folio); -@@ -2934,7 +3020,8 @@ static ssize_t cifs_write_back_from_locked_folio(struct address_space *mapping, - - if (max_pages > 0) - cifs_extend_writeback(mapping, xas, &count, start, -- max_pages, max_len, &len); -+ max_pages, max_len, &len, -+ i_size); - } - } - len = min_t(unsigned long long, len, i_size - start); -@@ -4318,11 +4405,27 @@ static ssize_t __cifs_readv( - ctx->bv = (void *)ctx->iter.bvec; - ctx->bv_need_unpin = iov_iter_extract_will_pin(to); - ctx->should_dirty = true; -- } else if ((iov_iter_is_bvec(to) || iov_iter_is_kvec(to)) && -- !is_sync_kiocb(iocb)) { -+ } else if (iov_iter_is_kvec(to)) { -+ /* -+ * Extract a KVEC-type iterator into a BVEC-type iterator. We -+ * assume that the storage will be retained by the caller; in -+ * any case, we may or may not be able to pin the pages, so we -+ * don't try. -+ */ -+ unsigned int bc; -+ -+ rc = extract_kvec_to_bvec(to, iov_iter_count(to), INT_MAX, -+ &ctx->bv, &bc); -+ if (rc < 0) { -+ kref_put(&ctx->refcount, cifs_aio_ctx_release); -+ return rc; -+ } -+ -+ iov_iter_bvec(&ctx->iter, ITER_DEST, ctx->bv, bc, rc); -+ } else if (iov_iter_is_bvec(to) && !is_sync_kiocb(iocb)) { - /* - * If the op is asynchronous, we need to copy the list attached -- * to a BVEC/KVEC-type iterator, but we assume that the storage -+ * to a BVEC-type iterator, but we assume that the storage - * will be retained by the caller; in any case, we may or may - * not be able to pin the pages, so we don't try. - */ -diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c -index 137d03781d5268..cf233cb9c19436 100644 ---- a/fs/smb/client/fs_context.c -+++ b/fs/smb/client/fs_context.c -@@ -1361,12 +1361,14 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, - cifs_errorf(fc, "Unknown error parsing devname\n"); - goto cifs_parse_mount_err; - } -+ kfree(ctx->source); - ctx->source = smb3_fs_context_fullpath(ctx, '/'); - if (IS_ERR(ctx->source)) { - ctx->source = NULL; - cifs_errorf(fc, "OOM when copying UNC string\n"); - goto cifs_parse_mount_err; - } -+ kfree(fc->source); - fc->source = kstrdup(ctx->source, GFP_KERNEL); - if (fc->source == NULL) { - cifs_errorf(fc, "OOM when copying UNC string\n"); -diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c -index 232a3c28905568..d6086394d0b844 100644 ---- a/fs/smb/client/smb2inode.c -+++ b/fs/smb/client/smb2inode.c -@@ -1128,6 +1128,8 @@ static int smb2_set_path_attr(const unsigned int xid, struct cifs_tcon *tcon, - smb2_to_name = cifs_convert_path_to_utf16(to_name, cifs_sb); - if (smb2_to_name == NULL) { - rc = -ENOMEM; -+ if (cfile) -+ cifsFileInfo_put(cfile); - goto smb2_rename_path; - } - in_iov.iov_base = smb2_to_name; -diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c -index b02114b734dcdb..138b3ed08217c9 100644 ---- a/fs/smb/client/smb2ops.c -+++ b/fs/smb/client/smb2ops.c -@@ -2663,11 +2663,12 @@ smb2_query_info_compound(const unsigned int xid, struct cifs_tcon *tcon, - struct cifs_fid fid; - int rc; - __le16 *utf16_path; -- struct cached_fid *cfid = NULL; -+ struct cached_fid *cfid; - int retries = 0, cur_sleep = 1; - - replay_again: - /* reinitialize for possible replay */ -+ cfid = NULL; - flags = CIFS_CP_CREATE_CLOSE_OP; - oplock = SMB2_OPLOCK_LEVEL_NONE; - server = cifs_pick_channel(ses); -diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c -index e58cad5d735a22..a8890ae2171445 100644 ---- a/fs/smb/client/smb2pdu.c -+++ b/fs/smb/client/smb2pdu.c -@@ -4068,9 +4068,12 @@ SMB2_change_notify(const unsigned int xid, struct cifs_tcon *tcon, - - smb_rsp = (struct smb2_change_notify_rsp *)rsp_iov.iov_base; - -- smb2_validate_iov(le16_to_cpu(smb_rsp->OutputBufferOffset), -- le32_to_cpu(smb_rsp->OutputBufferLength), &rsp_iov, -+ rc = smb2_validate_iov(le16_to_cpu(smb_rsp->OutputBufferOffset), -+ le32_to_cpu(smb_rsp->OutputBufferLength), -+ &rsp_iov, - sizeof(struct file_notify_information)); -+ if (rc) -+ goto cnotify_exit; - - *out_data = kmemdup((char *)smb_rsp + le16_to_cpu(smb_rsp->OutputBufferOffset), - le32_to_cpu(smb_rsp->OutputBufferLength), GFP_KERNEL); -diff --git a/fs/smb/client/transport.c b/fs/smb/client/transport.c -index 7b2560612bd6aa..7fee8e2c723a8d 100644 ---- a/fs/smb/client/transport.c -+++ b/fs/smb/client/transport.c -@@ -22,6 +22,7 @@ - #include - #include - #include -+#include - #include "cifspdu.h" - #include "cifsglob.h" - #include "cifsproto.h" -@@ -211,9 +212,16 @@ smb_send_kvec(struct TCP_Server_Info *server, struct msghdr *smb_msg, - * send a packet. In most cases if we fail to send - * after the retries we will kill the socket and - * reconnect which may clear the network problem. -+ * -+ * Even if regular signals are masked, EINTR might be -+ * propagated from sk_stream_wait_memory() to here when -+ * TIF_NOTIFY_SIGNAL is used for task work. For example, -+ * certain io_uring completions will use that. Treat -+ * having EINTR with pending task work the same as EAGAIN -+ * to avoid unnecessary reconnects. - */ - rc = sock_sendmsg(ssocket, smb_msg); -- if (rc == -EAGAIN) { -+ if (rc == -EAGAIN || unlikely(rc == -EINTR && task_work_pending(current))) { - retries++; - if (retries >= 14 || - (!server->noblocksnd && (retries > 2))) { -@@ -1038,7 +1046,7 @@ struct TCP_Server_Info *cifs_pick_channel(struct cifs_ses *ses) - if (!server || server->terminate) - continue; - -- if (CIFS_CHAN_NEEDS_RECONNECT(ses, i)) -+ if (CIFS_CHAN_NEEDS_RECONNECT(ses, cur)) - continue; - - /* -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index 9a58c5a6f9866f..9f64808c7917c3 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -1793,6 +1793,7 @@ int smb2_sess_setup(struct ksmbd_work *work) - - if (ksmbd_conn_need_reconnect(conn)) { - rc = -EFAULT; -+ ksmbd_user_session_put(sess); - sess = NULL; - goto out_err; - } -@@ -6772,6 +6773,7 @@ int smb2_read(struct ksmbd_work *work) - - nbytes = ksmbd_vfs_read(work, fp, length, &offset, aux_payload_buf); - if (nbytes < 0) { -+ kvfree(aux_payload_buf); - err = nbytes; - goto out; - } -diff --git a/fs/smb/server/transport_tcp.c b/fs/smb/server/transport_tcp.c -index 665d21d40e7a17..08275db6446c2b 100644 ---- a/fs/smb/server/transport_tcp.c -+++ b/fs/smb/server/transport_tcp.c -@@ -286,8 +286,11 @@ static int ksmbd_kthread_fn(void *p) - } - } - up_read(&conn_list_lock); -- if (ret == -EAGAIN) -+ if (ret == -EAGAIN) { -+ /* Per-IP limit hit: release the just-accepted socket. */ -+ sock_release(client_sk); - continue; -+ } - - skip_max_ip_conns_limit: - -@@ -476,12 +479,13 @@ static int create_socket(struct interface *iface) - struct socket *ksmbd_socket; - bool ipv4 = false; - -- ret = sock_create(PF_INET6, SOCK_STREAM, IPPROTO_TCP, &ksmbd_socket); -+ ret = sock_create_kern(current->nsproxy->net_ns, PF_INET6, SOCK_STREAM, -+ IPPROTO_TCP, &ksmbd_socket); - if (ret) { - if (ret != -EAFNOSUPPORT) - pr_err("Can't create socket for ipv6, fallback to ipv4: %d\n", ret); -- ret = sock_create(PF_INET, SOCK_STREAM, IPPROTO_TCP, -- &ksmbd_socket); -+ ret = sock_create_kern(current->nsproxy->net_ns, PF_INET, -+ SOCK_STREAM, IPPROTO_TCP, &ksmbd_socket); - if (ret) { - pr_err("Can't create socket for ipv4: %d\n", ret); - goto out_clear; -diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h -index b9c0b3281ace16..d328b318e44b1a 100644 ---- a/include/linux/blk_types.h -+++ b/include/linux/blk_types.h -@@ -384,15 +384,15 @@ enum req_op { - /* write the zero filled sector many times */ - REQ_OP_WRITE_ZEROES = (__force blk_opf_t)9, - /* Open a zone */ -- REQ_OP_ZONE_OPEN = (__force blk_opf_t)10, -+ REQ_OP_ZONE_OPEN = (__force blk_opf_t)11, - /* Close a zone */ -- REQ_OP_ZONE_CLOSE = (__force blk_opf_t)11, -+ REQ_OP_ZONE_CLOSE = (__force blk_opf_t)13, - /* Transition a zone to full */ -- REQ_OP_ZONE_FINISH = (__force blk_opf_t)13, -+ REQ_OP_ZONE_FINISH = (__force blk_opf_t)15, - /* reset a zone write pointer */ -- REQ_OP_ZONE_RESET = (__force blk_opf_t)15, -+ REQ_OP_ZONE_RESET = (__force blk_opf_t)17, - /* reset all the zone present on the device */ -- REQ_OP_ZONE_RESET_ALL = (__force blk_opf_t)17, -+ REQ_OP_ZONE_RESET_ALL = (__force blk_opf_t)19, - - /* Driver private requests */ - REQ_OP_DRV_IN = (__force blk_opf_t)34, -@@ -517,6 +517,7 @@ static inline bool op_is_zone_mgmt(enum req_op op) - { - switch (op & REQ_OP_MASK) { - case REQ_OP_ZONE_RESET: -+ case REQ_OP_ZONE_RESET_ALL: - case REQ_OP_ZONE_OPEN: - case REQ_OP_ZONE_CLOSE: - case REQ_OP_ZONE_FINISH: -diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h -index b307013b9c6c9a..fa87b6a15082c6 100644 ---- a/include/linux/cgroup.h -+++ b/include/linux/cgroup.h -@@ -633,6 +633,7 @@ static inline void cgroup_kthread_ready(void) - } - - void cgroup_path_from_kernfs_id(u64 id, char *buf, size_t buflen); -+struct cgroup *__cgroup_get_from_id(u64 id); - struct cgroup *cgroup_get_from_id(u64 id); - #else /* !CONFIG_CGROUPS */ - -diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h -index 02f616dfb15f4d..5c8aca9c345660 100644 ---- a/include/linux/compiler_types.h -+++ b/include/linux/compiler_types.h -@@ -229,10 +229,9 @@ struct ftrace_likely_data { - /* - * GCC does not warn about unused static inline functions for -Wunused-function. - * Suppress the warning in clang as well by using __maybe_unused, but enable it -- * for W=1 build. This will allow clang to find unused functions. Remove the -- * __inline_maybe_unused entirely after fixing most of -Wunused-function warnings. -+ * for W=2 build. This will allow clang to find unused functions. - */ --#ifdef KBUILD_EXTRA_WARN1 -+#ifdef KBUILD_EXTRA_WARN2 - #define __inline_maybe_unused - #else - #define __inline_maybe_unused __maybe_unused -diff --git a/include/linux/fbcon.h b/include/linux/fbcon.h -index 2382dec6d6ab8e..fb0fc2736b8015 100644 ---- a/include/linux/fbcon.h -+++ b/include/linux/fbcon.h -@@ -11,6 +11,7 @@ void fbcon_suspended(struct fb_info *info); - void fbcon_resumed(struct fb_info *info); - int fbcon_mode_deleted(struct fb_info *info, - struct fb_videomode *mode); -+void fbcon_delete_modelist(struct list_head *head); - void fbcon_new_modelist(struct fb_info *info); - void fbcon_get_requirement(struct fb_info *info, - struct fb_blit_caps *caps); -@@ -31,6 +32,7 @@ static inline void fbcon_suspended(struct fb_info *info) {} - static inline void fbcon_resumed(struct fb_info *info) {} - static inline int fbcon_mode_deleted(struct fb_info *info, - struct fb_videomode *mode) { return 0; } -+static inline void fbcon_delete_modelist(struct list_head *head) {} - static inline void fbcon_new_modelist(struct fb_info *info) {} - static inline void fbcon_get_requirement(struct fb_info *info, - struct fb_blit_caps *caps) {} -diff --git a/include/linux/filter.h b/include/linux/filter.h -index adf65eacade062..ad5a3d68b55523 100644 ---- a/include/linux/filter.h -+++ b/include/linux/filter.h -@@ -685,6 +685,26 @@ static inline void bpf_compute_data_pointers(struct sk_buff *skb) - cb->data_end = skb->data + skb_headlen(skb); - } - -+static inline int bpf_prog_run_data_pointers( -+ const struct bpf_prog *prog, -+ struct sk_buff *skb) -+{ -+ struct bpf_skb_data_end *cb = (struct bpf_skb_data_end *)skb->cb; -+ void *save_data_meta, *save_data_end; -+ int res; -+ -+ save_data_meta = cb->data_meta; -+ save_data_end = cb->data_end; -+ -+ bpf_compute_data_pointers(skb); -+ res = bpf_prog_run(prog, skb); -+ -+ cb->data_meta = save_data_meta; -+ cb->data_end = save_data_end; -+ -+ return res; -+} -+ - /* Similar to bpf_compute_data_pointers(), except that save orginal - * data in cb->data and cb->meta_data for restore. - */ -@@ -1065,7 +1085,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other); - static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen, - u32 pass, void *image) - { -- pr_err("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n", flen, -+ pr_err("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n", flen, - proglen, pass, image, current->comm, task_pid_nr(current)); - - if (image) -diff --git a/include/linux/map_benchmark.h b/include/linux/map_benchmark.h -index 62674c83bde4ef..48e2ff95332f37 100644 ---- a/include/linux/map_benchmark.h -+++ b/include/linux/map_benchmark.h -@@ -27,5 +27,6 @@ struct map_benchmark { - __u32 dma_dir; /* DMA data direction */ - __u32 dma_trans_ns; /* time for DMA transmission in ns */ - __u32 granule; /* how many PAGE_SIZE will do map/unmap once a time */ -+ __u8 expansion[76]; /* For future use */ - }; - #endif /* _KERNEL_DMA_BENCHMARK_H */ -diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h -index b1fdb1554f2f9c..8aee8b75aad01c 100644 ---- a/include/linux/memcontrol.h -+++ b/include/linux/memcontrol.h -@@ -1039,8 +1039,8 @@ static inline unsigned long lruvec_page_state_local(struct lruvec *lruvec, - return x; - } - --void mem_cgroup_flush_stats(void); --void mem_cgroup_flush_stats_ratelimited(void); -+void mem_cgroup_flush_stats(struct mem_cgroup *memcg); -+void mem_cgroup_flush_stats_ratelimited(struct mem_cgroup *memcg); - - void __mod_memcg_lruvec_state(struct lruvec *lruvec, enum node_stat_item idx, - int val); -@@ -1515,11 +1515,11 @@ static inline unsigned long lruvec_page_state_local(struct lruvec *lruvec, - return node_page_state(lruvec_pgdat(lruvec), idx); - } - --static inline void mem_cgroup_flush_stats(void) -+static inline void mem_cgroup_flush_stats(struct mem_cgroup *memcg) - { - } - --static inline void mem_cgroup_flush_stats_ratelimited(void) -+static inline void mem_cgroup_flush_stats_ratelimited(struct mem_cgroup *memcg) - { - } - -diff --git a/include/linux/memory-tiers.h b/include/linux/memory-tiers.h -index 437441cdf78fb6..b3cbeb46ddeee8 100644 ---- a/include/linux/memory-tiers.h -+++ b/include/linux/memory-tiers.h -@@ -6,6 +6,7 @@ - #include - #include - #include -+#include - /* - * Each tier cover a abstrace distance chunk size of 128 - */ -@@ -17,7 +18,7 @@ - * adistance value (slightly faster) than default DRAM adistance to be part of - * the same memory tier. - */ --#define MEMTIER_ADISTANCE_DRAM ((4 * MEMTIER_CHUNK_SIZE) + (MEMTIER_CHUNK_SIZE >> 1)) -+#define MEMTIER_ADISTANCE_DRAM ((4L * MEMTIER_CHUNK_SIZE) + (MEMTIER_CHUNK_SIZE >> 1)) - - struct memory_tier; - struct memory_dev_type { -@@ -30,12 +31,21 @@ struct memory_dev_type { - struct kref kref; - }; - -+struct access_coordinate; -+ - #ifdef CONFIG_NUMA - extern bool numa_demotion_enabled; -+extern struct memory_dev_type *default_dram_type; - struct memory_dev_type *alloc_memory_type(int adistance); - void put_memory_type(struct memory_dev_type *memtype); - void init_node_memory_type(int node, struct memory_dev_type *default_type); - void clear_node_memory_type(int node, struct memory_dev_type *memtype); -+int register_mt_adistance_algorithm(struct notifier_block *nb); -+int unregister_mt_adistance_algorithm(struct notifier_block *nb); -+int mt_calc_adistance(int node, int *adist); -+int mt_set_default_dram_perf(int nid, struct access_coordinate *perf, -+ const char *source); -+int mt_perf_to_adistance(struct access_coordinate *perf, int *adist); - #ifdef CONFIG_MIGRATION - int next_demotion_node(int node); - void node_get_allowed_targets(pg_data_t *pgdat, nodemask_t *targets); -@@ -60,6 +70,7 @@ static inline bool node_is_toptier(int node) - #else - - #define numa_demotion_enabled false -+#define default_dram_type NULL - /* - * CONFIG_NUMA implementation returns non NULL error. - */ -@@ -97,5 +108,31 @@ static inline bool node_is_toptier(int node) - { - return true; - } -+ -+static inline int register_mt_adistance_algorithm(struct notifier_block *nb) -+{ -+ return 0; -+} -+ -+static inline int unregister_mt_adistance_algorithm(struct notifier_block *nb) -+{ -+ return 0; -+} -+ -+static inline int mt_calc_adistance(int node, int *adist) -+{ -+ return NOTIFY_DONE; -+} -+ -+static inline int mt_set_default_dram_perf(int nid, struct access_coordinate *perf, -+ const char *source) -+{ -+ return -EIO; -+} -+ -+static inline int mt_perf_to_adistance(struct access_coordinate *perf, int *adist) -+{ -+ return -EIO; -+} - #endif /* CONFIG_NUMA */ - #endif /* _LINUX_MEMORY_TIERS_H */ -diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h -index 3ddf205b7e2c38..f0dddb88528050 100644 ---- a/include/linux/netpoll.h -+++ b/include/linux/netpoll.h -@@ -32,6 +32,7 @@ struct netpoll { - bool ipv6; - u16 local_port, remote_port; - u8 remote_mac[ETH_ALEN]; -+ struct sk_buff_head skb_pool; - }; - - struct netpoll_info { -diff --git a/include/linux/node.h b/include/linux/node.h -index 427a5975cf4050..dfc004e4bee747 100644 ---- a/include/linux/node.h -+++ b/include/linux/node.h -@@ -20,20 +20,32 @@ - #include - - /** -- * struct node_hmem_attrs - heterogeneous memory performance attributes -+ * struct access_coordinate - generic performance coordinates container - * - * @read_bandwidth: Read bandwidth in MB/s - * @write_bandwidth: Write bandwidth in MB/s - * @read_latency: Read latency in nanoseconds - * @write_latency: Write latency in nanoseconds - */ --struct node_hmem_attrs { -+struct access_coordinate { - unsigned int read_bandwidth; - unsigned int write_bandwidth; - unsigned int read_latency; - unsigned int write_latency; - }; - -+/* -+ * ACCESS_COORDINATE_LOCAL correlates to ACCESS CLASS 0 -+ * - access_coordinate between target node and nearest initiator node -+ * ACCESS_COORDINATE_CPU correlates to ACCESS CLASS 1 -+ * - access_coordinate between target node and nearest CPU node -+ */ -+enum access_coordinate_class { -+ ACCESS_COORDINATE_LOCAL, -+ ACCESS_COORDINATE_CPU, -+ ACCESS_COORDINATE_MAX -+}; -+ - enum cache_indexing { - NODE_CACHE_DIRECT_MAP, - NODE_CACHE_INDEXED, -@@ -65,8 +77,8 @@ struct node_cache_attrs { - - #ifdef CONFIG_HMEM_REPORTING - void node_add_cache(unsigned int nid, struct node_cache_attrs *cache_attrs); --void node_set_perf_attrs(unsigned int nid, struct node_hmem_attrs *hmem_attrs, -- unsigned access); -+void node_set_perf_attrs(unsigned int nid, struct access_coordinate *coord, -+ enum access_coordinate_class access); - #else - static inline void node_add_cache(unsigned int nid, - struct node_cache_attrs *cache_attrs) -@@ -74,8 +86,8 @@ static inline void node_add_cache(unsigned int nid, - } - - static inline void node_set_perf_attrs(unsigned int nid, -- struct node_hmem_attrs *hmem_attrs, -- unsigned access) -+ struct access_coordinate *coord, -+ enum access_coordinate_class access) - { - } - #endif -@@ -137,7 +149,7 @@ extern void unregister_memory_block_under_nodes(struct memory_block *mem_blk); - - extern int register_memory_node_under_compute_node(unsigned int mem_nid, - unsigned int cpu_nid, -- unsigned access); -+ enum access_coordinate_class access); - #else - static inline void node_dev_init(void) - { -diff --git a/include/linux/pci.h b/include/linux/pci.h -index e4338237a05454..052d956d3ba1f2 100644 ---- a/include/linux/pci.h -+++ b/include/linux/pci.h -@@ -2667,7 +2667,7 @@ static inline bool pci_is_thunderbolt_attached(struct pci_dev *pdev) - return false; - } - --#if defined(CONFIG_PCIEPORTBUS) || defined(CONFIG_EEH) -+#if defined(CONFIG_PCIEPORTBUS) || defined(CONFIG_EEH) || defined(CONFIG_S390) - void pci_uevent_ers(struct pci_dev *pdev, enum pci_ers_result err_type); - #endif - -diff --git a/include/linux/shdma-base.h b/include/linux/shdma-base.h -index 6dfd05ef5c2d9f..03ba4dab2ef731 100644 ---- a/include/linux/shdma-base.h -+++ b/include/linux/shdma-base.h -@@ -96,7 +96,7 @@ struct shdma_ops { - int (*desc_setup)(struct shdma_chan *, struct shdma_desc *, - dma_addr_t, dma_addr_t, size_t *); - int (*set_slave)(struct shdma_chan *, int, dma_addr_t, bool); -- void (*setup_xfer)(struct shdma_chan *, int); -+ int (*setup_xfer)(struct shdma_chan *, int); - void (*start_xfer)(struct shdma_chan *, struct shdma_desc *); - struct shdma_desc *(*embedded_desc)(void *, int); - bool (*chan_irq)(struct shdma_chan *, int); -diff --git a/include/linux/swap.h b/include/linux/swap.h -index d7a5b7817987d8..ff91337695b434 100644 ---- a/include/linux/swap.h -+++ b/include/linux/swap.h -@@ -343,7 +343,8 @@ static inline swp_entry_t page_swap_entry(struct page *page) - } - - /* linux/mm/workingset.c */ --bool workingset_test_recent(void *shadow, bool file, bool *workingset); -+bool workingset_test_recent(void *shadow, bool file, bool *workingset, -+ bool flush); - void workingset_age_nonresident(struct lruvec *lruvec, unsigned long nr_pages); - void *workingset_eviction(struct folio *folio, struct mem_cgroup *target_memcg); - void workingset_refault(struct folio *folio, void *shadow); -diff --git a/include/linux/vm_event_item.h b/include/linux/vm_event_item.h -index 8abfa124004003..b61796a35d2bab 100644 ---- a/include/linux/vm_event_item.h -+++ b/include/linux/vm_event_item.h -@@ -145,6 +145,7 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT, - #ifdef CONFIG_ZSWAP - ZSWPIN, - ZSWPOUT, -+ ZSWPWB, - #endif - #ifdef CONFIG_X86 - DIRECT_MAP_LEVEL2_SPLIT, -diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h -index 4c084a03d6bb75..b25746b91986c2 100644 ---- a/include/net/bluetooth/hci.h -+++ b/include/net/bluetooth/hci.h -@@ -392,6 +392,7 @@ enum { - HCI_USER_CHANNEL, - HCI_EXT_CONFIGURED, - HCI_LE_ADV, -+ HCI_LE_ADV_0, - HCI_LE_PER_ADV, - HCI_LE_SCAN, - HCI_SSP_ENABLED, -diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h -index 62135b7782f5be..a2a6fb20f49647 100644 ---- a/include/net/bluetooth/hci_core.h -+++ b/include/net/bluetooth/hci_core.h -@@ -29,6 +29,7 @@ - #include - #include - #include -+#include - #include - - #include -@@ -95,6 +96,7 @@ struct discovery_state { - unsigned long scan_start; - unsigned long scan_duration; - unsigned long name_resolve_timeout; -+ spinlock_t lock; - }; - - #define SUSPEND_NOTIFIER_TIMEOUT msecs_to_jiffies(2000) /* 2 seconds */ -@@ -240,6 +242,7 @@ struct adv_info { - bool enabled; - bool pending; - bool periodic; -+ bool periodic_enabled; - __u8 mesh; - __u8 instance; - __u32 flags; -@@ -869,6 +872,7 @@ static inline void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, - - static inline void discovery_init(struct hci_dev *hdev) - { -+ spin_lock_init(&hdev->discovery.lock); - hdev->discovery.state = DISCOVERY_STOPPED; - INIT_LIST_HEAD(&hdev->discovery.all); - INIT_LIST_HEAD(&hdev->discovery.unknown); -@@ -883,8 +887,12 @@ static inline void hci_discovery_filter_clear(struct hci_dev *hdev) - hdev->discovery.report_invalid_rssi = true; - hdev->discovery.rssi = HCI_RSSI_INVALID; - hdev->discovery.uuid_count = 0; -+ -+ spin_lock(&hdev->discovery.lock); - kfree(hdev->discovery.uuids); - hdev->discovery.uuids = NULL; -+ spin_unlock(&hdev->discovery.lock); -+ - hdev->discovery.scan_start = 0; - hdev->discovery.scan_duration = 0; - } -diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h -index d382679efd2b1c..e083f0fa0113a9 100644 ---- a/include/net/bluetooth/mgmt.h -+++ b/include/net/bluetooth/mgmt.h -@@ -774,7 +774,7 @@ struct mgmt_adv_pattern { - __u8 ad_type; - __u8 offset; - __u8 length; -- __u8 value[31]; -+ __u8 value[HCI_MAX_AD_LENGTH]; - } __packed; - - #define MGMT_OP_ADD_ADV_PATTERNS_MONITOR 0x0052 -diff --git a/include/net/cls_cgroup.h b/include/net/cls_cgroup.h -index 7e78e7d6f01524..668aeee9b3f662 100644 ---- a/include/net/cls_cgroup.h -+++ b/include/net/cls_cgroup.h -@@ -63,7 +63,7 @@ static inline u32 task_get_classid(const struct sk_buff *skb) - * calls by looking at the number of nested bh disable calls because - * softirqs always disables bh. - */ -- if (in_serving_softirq()) { -+ if (softirq_count()) { - struct sock *sk = skb_to_full_sk(skb); - - /* If there is an sock_cgroup_classid we'll use that. */ -diff --git a/include/net/gro.h b/include/net/gro.h -index 018343254c90a6..9260ed367c9190 100644 ---- a/include/net/gro.h -+++ b/include/net/gro.h -@@ -10,6 +10,9 @@ - #include - #include - -+/* This should be increased if a protocol with a bigger head is added. */ -+#define GRO_MAX_HEAD (MAX_HEADER + 128) -+ - struct napi_gro_cb { - union { - struct { -diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h -index ea8595651c3846..e066bdbc807bed 100644 ---- a/include/net/nfc/nci_core.h -+++ b/include/net/nfc/nci_core.h -@@ -52,7 +52,7 @@ enum nci_state { - #define NCI_RF_DISC_SELECT_TIMEOUT 5000 - #define NCI_RF_DEACTIVATE_TIMEOUT 30000 - #define NCI_CMD_TIMEOUT 5000 --#define NCI_DATA_TIMEOUT 700 -+#define NCI_DATA_TIMEOUT 3000 - - struct nci_dev; - -diff --git a/include/net/tc_act/tc_connmark.h b/include/net/tc_act/tc_connmark.h -index e8dd77a9674803..a5ce83f3eea4bf 100644 ---- a/include/net/tc_act/tc_connmark.h -+++ b/include/net/tc_act/tc_connmark.h -@@ -7,6 +7,7 @@ - struct tcf_connmark_parms { - struct net *net; - u16 zone; -+ int action; - struct rcu_head rcu; - }; - -diff --git a/include/net/xdp.h b/include/net/xdp.h -index b39ac83618a550..3d8989096b5d29 100644 ---- a/include/net/xdp.h -+++ b/include/net/xdp.h -@@ -113,6 +113,11 @@ static __always_inline void xdp_buff_set_frag_pfmemalloc(struct xdp_buff *xdp) - xdp->flags |= XDP_FLAGS_FRAGS_PF_MEMALLOC; - } - -+static __always_inline void xdp_buff_clear_frag_pfmemalloc(struct xdp_buff *xdp) -+{ -+ xdp->flags &= ~XDP_FLAGS_FRAGS_PF_MEMALLOC; -+} -+ - static __always_inline void - xdp_init_buff(struct xdp_buff *xdp, u32 frame_sz, struct xdp_rxq_info *rxq) - { -diff --git a/include/ufs/ufs_quirks.h b/include/ufs/ufs_quirks.h -index f52de5ed1b3b6e..83563247c36cb2 100644 ---- a/include/ufs/ufs_quirks.h -+++ b/include/ufs/ufs_quirks.h -@@ -113,4 +113,7 @@ struct ufs_dev_quirk { - */ - #define UFS_DEVICE_QUIRK_PA_HIBER8TIME (1 << 12) - -+/* Some UFS 4 devices do not support the qTimestamp attribute */ -+#define UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT (1 << 13) -+ - #endif /* UFS_QUIRKS_H_ */ -diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h -index e9db9682316a2a..78380fc2374ea5 100644 ---- a/include/ufs/ufshcd.h -+++ b/include/ufs/ufshcd.h -@@ -323,6 +323,7 @@ struct ufs_pwr_mode_info { - * @device_reset: called to issue a reset pulse on the UFS device - * @config_scaling_param: called to configure clock scaling parameters - * @program_key: program or evict an inline encryption key -+ * @fill_crypto_prdt: initialize crypto-related fields in the PRDT - * @event_notify: called to notify important events - * @mcq_config_resource: called to configure MCQ platform resources - * @get_hba_mac: called to get vendor specific mac value, mandatory for mcq mode -@@ -366,6 +367,9 @@ struct ufs_hba_variant_ops { - struct devfreq_simple_ondemand_data *data); - int (*program_key)(struct ufs_hba *hba, - const union ufs_crypto_cfg_entry *cfg, int slot); -+ int (*fill_crypto_prdt)(struct ufs_hba *hba, -+ const struct bio_crypt_ctx *crypt_ctx, -+ void *prdt, unsigned int num_segments); - void (*event_notify)(struct ufs_hba *hba, - enum ufs_event_type evt, void *data); - int (*mcq_config_resource)(struct ufs_hba *hba); -@@ -642,6 +646,45 @@ enum ufshcd_quirks { - * thus need this quirk to skip related flow. - */ - UFSHCD_QUIRK_MCQ_BROKEN_RTC = 1 << 21, -+ -+ /* -+ * This quirk needs to be enabled if the host controller supports inline -+ * encryption but it needs to initialize the crypto capabilities in a -+ * nonstandard way and/or needs to override blk_crypto_ll_ops. If -+ * enabled, the standard code won't initialize the blk_crypto_profile; -+ * ufs_hba_variant_ops::init() must do it instead. -+ */ -+ UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE = 1 << 22, -+ -+ /* -+ * This quirk needs to be enabled if the host controller supports inline -+ * encryption but does not support the CRYPTO_GENERAL_ENABLE bit, i.e. -+ * host controller initialization fails if that bit is set. -+ */ -+ UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE = 1 << 23, -+ -+ /* -+ * This quirk needs to be enabled if the host controller driver copies -+ * cryptographic keys into the PRDT in order to send them to hardware, -+ * and therefore the PRDT should be zeroized after each request (as per -+ * the standard best practice for managing keys). -+ */ -+ UFSHCD_QUIRK_KEYS_IN_PRDT = 1 << 24, -+ -+ /* -+ * This quirk indicates that the controller reports the value 1 (not -+ * supported) in the Legacy Single DoorBell Support (LSDBS) bit of the -+ * Controller Capabilities register although it supports the legacy -+ * single doorbell mode. -+ */ -+ UFSHCD_QUIRK_BROKEN_LSDBS_CAP = 1 << 25, -+ -+ /* -+ * This quirk indicates that DME_LINKSTARTUP should not be issued a 2nd -+ * time (refer link_startup_again) after the 1st time was successful, -+ * because it causes link startup to become unreliable. -+ */ -+ UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE = 1 << 26, - }; - - enum ufshcd_caps { -@@ -1425,5 +1468,6 @@ int __ufshcd_write_ee_control(struct ufs_hba *hba, u32 ee_ctrl_mask); - int ufshcd_write_ee_control(struct ufs_hba *hba); - int ufshcd_update_ee_control(struct ufs_hba *hba, u16 *mask, - const u16 *other_mask, u16 set, u16 clr); -+void ufshcd_force_error_recovery(struct ufs_hba *hba); - - #endif /* End of Header */ -diff --git a/include/ufs/ufshci.h b/include/ufs/ufshci.h -index ae93b30d25893e..725437f02b1fa9 100644 ---- a/include/ufs/ufshci.h -+++ b/include/ufs/ufshci.h -@@ -182,6 +182,7 @@ static inline u32 ufshci_version(u32 major, u32 minor) - #define UTP_TASK_REQ_COMPL 0x200 - #define UIC_COMMAND_COMPL 0x400 - #define DEVICE_FATAL_ERROR 0x800 -+#define UTP_ERROR 0x1000 - #define CONTROLLER_FATAL_ERROR 0x10000 - #define SYSTEM_BUS_FATAL_ERROR 0x20000 - #define CRYPTO_ENGINE_FATAL_ERROR 0x40000 -@@ -201,7 +202,8 @@ static inline u32 ufshci_version(u32 major, u32 minor) - CONTROLLER_FATAL_ERROR |\ - SYSTEM_BUS_FATAL_ERROR |\ - CRYPTO_ENGINE_FATAL_ERROR |\ -- UIC_LINK_LOST) -+ UIC_LINK_LOST |\ -+ UTP_ERROR) - - /* HCS - Host Controller Status 30h */ - #define DEVICE_PRESENT 0x1 -diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c -index 90c281e1379eeb..2cfbc48b824259 100644 ---- a/kernel/bpf/helpers.c -+++ b/kernel/bpf/helpers.c -@@ -2276,7 +2276,7 @@ __bpf_kfunc struct cgroup *bpf_cgroup_from_id(u64 cgid) - { - struct cgroup *cgrp; - -- cgrp = cgroup_get_from_id(cgid); -+ cgrp = __cgroup_get_from_id(cgid); - if (IS_ERR(cgrp)) - return NULL; - return cgrp; -diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c -index 6aff5ee483b60e..c0c5e9b313e433 100644 ---- a/kernel/bpf/ringbuf.c -+++ b/kernel/bpf/ringbuf.c -@@ -215,6 +215,8 @@ static struct bpf_map *ringbuf_map_alloc(union bpf_attr *attr) - - static void bpf_ringbuf_free(struct bpf_ringbuf *rb) - { -+ irq_work_sync(&rb->work); -+ - /* copy pages pointer and nr_pages to local variable, as we are going - * to unmap rb itself with vunmap() below - */ -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index 5e644b1b12aaaa..45b2f06de452ce 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -7839,7 +7839,7 @@ static int widen_imprecise_scalars(struct bpf_verifier_env *env, - struct bpf_verifier_state *cur) - { - struct bpf_func_state *fold, *fcur; -- int i, fr; -+ int i, fr, num_slots; - - reset_idmap_scratch(env); - for (fr = old->curframe; fr >= 0; fr--) { -@@ -7852,7 +7852,9 @@ static int widen_imprecise_scalars(struct bpf_verifier_env *env, - &fcur->regs[i], - &env->idmap_scratch); - -- for (i = 0; i < fold->allocated_stack / BPF_REG_SIZE; i++) { -+ num_slots = min(fold->allocated_stack / BPF_REG_SIZE, -+ fcur->allocated_stack / BPF_REG_SIZE); -+ for (i = 0; i < num_slots; i++) { - if (!is_spilled_reg(&fold->stack[i]) || - !is_spilled_reg(&fcur->stack[i])) - continue; -diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c -index 5135838b5899f8..476be99dbcf1bf 100644 ---- a/kernel/cgroup/cgroup.c -+++ b/kernel/cgroup/cgroup.c -@@ -6220,15 +6220,15 @@ void cgroup_path_from_kernfs_id(u64 id, char *buf, size_t buflen) - } - - /* -- * cgroup_get_from_id : get the cgroup associated with cgroup id -+ * __cgroup_get_from_id : get the cgroup associated with cgroup id - * @id: cgroup id - * On success return the cgrp or ERR_PTR on failure -- * Only cgroups within current task's cgroup NS are valid. -+ * There are no cgroup NS restrictions. - */ --struct cgroup *cgroup_get_from_id(u64 id) -+struct cgroup *__cgroup_get_from_id(u64 id) - { - struct kernfs_node *kn; -- struct cgroup *cgrp, *root_cgrp; -+ struct cgroup *cgrp; - - kn = kernfs_find_and_get_node_by_id(cgrp_dfl_root.kf_root, id); - if (!kn) -@@ -6250,6 +6250,22 @@ struct cgroup *cgroup_get_from_id(u64 id) - - if (!cgrp) - return ERR_PTR(-ENOENT); -+ return cgrp; -+} -+ -+/* -+ * cgroup_get_from_id : get the cgroup associated with cgroup id -+ * @id: cgroup id -+ * On success return the cgrp or ERR_PTR on failure -+ * Only cgroups within current task's cgroup NS are valid. -+ */ -+struct cgroup *cgroup_get_from_id(u64 id) -+{ -+ struct cgroup *cgrp, *root_cgrp; -+ -+ cgrp = __cgroup_get_from_id(id); -+ if (IS_ERR(cgrp)) -+ return cgrp; - - root_cgrp = current_cgns_cgroup_dfl(); - if (!cgroup_is_descendant(cgrp, root_cgrp)) { -diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c -index a554f43d3ceb9e..6304238293ae10 100644 ---- a/kernel/events/uprobes.c -+++ b/kernel/events/uprobes.c -@@ -2255,6 +2255,13 @@ static void handle_swbp(struct pt_regs *regs) - - handler_chain(uprobe, regs); - -+ /* -+ * If user decided to take execution elsewhere, it makes little sense -+ * to execute the original instruction, so let's skip it. -+ */ -+ if (instruction_pointer(regs) != bp_vaddr) -+ goto out; -+ - if (arch_uprobe_skip_sstep(&uprobe->arch, regs)) - goto out; - -diff --git a/kernel/futex/syscalls.c b/kernel/futex/syscalls.c -index a8074079b09e87..48feaa545b3c7f 100644 ---- a/kernel/futex/syscalls.c -+++ b/kernel/futex/syscalls.c -@@ -40,6 +40,56 @@ SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head, - return 0; - } - -+static inline void __user *futex_task_robust_list(struct task_struct *p, bool compat) -+{ -+#ifdef CONFIG_COMPAT -+ if (compat) -+ return p->compat_robust_list; -+#endif -+ return p->robust_list; -+} -+ -+static void __user *futex_get_robust_list_common(int pid, bool compat) -+{ -+ struct task_struct *p = current; -+ void __user *head; -+ int ret; -+ -+ scoped_guard(rcu) { -+ if (pid) { -+ p = find_task_by_vpid(pid); -+ if (!p) -+ return (void __user *)ERR_PTR(-ESRCH); -+ } -+ get_task_struct(p); -+ } -+ -+ /* -+ * Hold exec_update_lock to serialize with concurrent exec() -+ * so ptrace_may_access() is checked against stable credentials -+ */ -+ ret = down_read_killable(&p->signal->exec_update_lock); -+ if (ret) -+ goto err_put; -+ -+ ret = -EPERM; -+ if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS)) -+ goto err_unlock; -+ -+ head = futex_task_robust_list(p, compat); -+ -+ up_read(&p->signal->exec_update_lock); -+ put_task_struct(p); -+ -+ return head; -+ -+err_unlock: -+ up_read(&p->signal->exec_update_lock); -+err_put: -+ put_task_struct(p); -+ return (void __user *)ERR_PTR(ret); -+} -+ - /** - * sys_get_robust_list() - Get the robust-futex list head of a task - * @pid: pid of the process [zero for current task] -@@ -50,36 +100,14 @@ SYSCALL_DEFINE3(get_robust_list, int, pid, - struct robust_list_head __user * __user *, head_ptr, - size_t __user *, len_ptr) - { -- struct robust_list_head __user *head; -- unsigned long ret; -- struct task_struct *p; -- -- rcu_read_lock(); -- -- ret = -ESRCH; -- if (!pid) -- p = current; -- else { -- p = find_task_by_vpid(pid); -- if (!p) -- goto err_unlock; -- } -- -- ret = -EPERM; -- if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS)) -- goto err_unlock; -+ struct robust_list_head __user *head = futex_get_robust_list_common(pid, false); - -- head = p->robust_list; -- rcu_read_unlock(); -+ if (IS_ERR(head)) -+ return PTR_ERR(head); - - if (put_user(sizeof(*head), len_ptr)) - return -EFAULT; - return put_user(head, head_ptr); -- --err_unlock: -- rcu_read_unlock(); -- -- return ret; - } - - long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout, -@@ -322,36 +350,14 @@ COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid, - compat_uptr_t __user *, head_ptr, - compat_size_t __user *, len_ptr) - { -- struct compat_robust_list_head __user *head; -- unsigned long ret; -- struct task_struct *p; -- -- rcu_read_lock(); -- -- ret = -ESRCH; -- if (!pid) -- p = current; -- else { -- p = find_task_by_vpid(pid); -- if (!p) -- goto err_unlock; -- } -- -- ret = -EPERM; -- if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS)) -- goto err_unlock; -+ struct compat_robust_list_head __user *head = futex_get_robust_list_common(pid, true); - -- head = p->compat_robust_list; -- rcu_read_unlock(); -+ if (IS_ERR(head)) -+ return PTR_ERR(head); - - if (put_user(sizeof(*head), len_ptr)) - return -EFAULT; - return put_user(ptr_to_compat(head), head_ptr); -- --err_unlock: -- rcu_read_unlock(); -- -- return ret; - } - #endif /* CONFIG_COMPAT */ - -diff --git a/kernel/gcov/gcc_4_7.c b/kernel/gcov/gcc_4_7.c -index fd75b4a484d76a..bbccbae331d72b 100644 ---- a/kernel/gcov/gcc_4_7.c -+++ b/kernel/gcov/gcc_4_7.c -@@ -18,7 +18,9 @@ - #include - #include "gcov.h" - --#if (__GNUC__ >= 14) -+#if (__GNUC__ >= 15) -+#define GCOV_COUNTERS 10 -+#elif (__GNUC__ >= 14) - #define GCOV_COUNTERS 9 - #elif (__GNUC__ >= 10) - #define GCOV_COUNTERS 8 -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 58231999d929ea..7f23b866c3d4c8 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -4836,6 +4836,11 @@ static inline unsigned long task_util(struct task_struct *p) - return READ_ONCE(p->se.avg.util_avg); - } - -+static inline unsigned long task_runnable(struct task_struct *p) -+{ -+ return READ_ONCE(p->se.avg.runnable_avg); -+} -+ - static inline unsigned long _task_util_est(struct task_struct *p) - { - struct util_est ue = READ_ONCE(p->se.avg.util_est); -@@ -4954,6 +4959,14 @@ static inline void util_est_update(struct cfs_rq *cfs_rq, - if (task_util(p) > arch_scale_cpu_capacity(cpu_of(rq_of(cfs_rq)))) - return; - -+ /* -+ * To avoid underestimate of task utilization, skip updates of EWMA if -+ * we cannot grant that thread got all CPU time it wanted. -+ */ -+ if ((ue.enqueued + UTIL_EST_MARGIN) < task_runnable(p)) -+ goto done; -+ -+ - /* - * Update Task's estimated utilization - * -@@ -9152,7 +9165,7 @@ static int detach_tasks(struct lb_env *env) - case migrate_util: - util = task_util_est(p); - -- if (util > env->imbalance) -+ if (shr_bound(util, env->sd->nr_balance_failed) > env->imbalance) - goto next; - - env->imbalance -= util; -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 15785a729a0cdf..398992597685b6 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -6873,6 +6873,8 @@ void ftrace_module_enable(struct module *mod) - if (!within_module(rec->ip, mod)) - break; - -+ cond_resched(); -+ - /* Weak functions should still be ignored */ - if (!test_for_valid_rec(rec)) { - /* Clear all other flags. Should not be enabled anyway */ -diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c -index 88985aefb71ff8..e6d2f2a94235fa 100644 ---- a/kernel/trace/trace_events_hist.c -+++ b/kernel/trace/trace_events_hist.c -@@ -3258,14 +3258,16 @@ static struct field_var *create_field_var(struct hist_trigger_data *hist_data, - var = create_var(hist_data, file, field_name, val->size, val->type); - if (IS_ERR(var)) { - hist_err(tr, HIST_ERR_VAR_CREATE_FIND_FAIL, errpos(field_name)); -- kfree(val); -+ destroy_hist_field(val, 0); - ret = PTR_ERR(var); - goto err; - } - - field_var = kzalloc(sizeof(struct field_var), GFP_KERNEL); - if (!field_var) { -- kfree(val); -+ destroy_hist_field(val, 0); -+ kfree_const(var->type); -+ kfree(var->var.name); - kfree(var); - ret = -ENOMEM; - goto err; -diff --git a/lib/crypto/Makefile b/lib/crypto/Makefile -index 88246000c9d8eb..b1b81998e101ed 100644 ---- a/lib/crypto/Makefile -+++ b/lib/crypto/Makefile -@@ -31,7 +31,7 @@ libcurve25519-generic-y := curve25519-fiat32.o - libcurve25519-generic-$(CONFIG_ARCH_SUPPORTS_INT128) := curve25519-hacl64.o - libcurve25519-generic-y += curve25519-generic.o - # clang versions prior to 18 may blow out the stack with KASAN --ifeq ($(call clang-min-version, 180000),) -+ifeq ($(CONFIG_CC_IS_CLANG)_$(call clang-min-version, 180000),y_) - KASAN_SANITIZE_curve25519-hacl64.o := n - endif - -diff --git a/mm/filemap.c b/mm/filemap.c -index ab24dbf5e747ef..1c229b261a62be 100644 ---- a/mm/filemap.c -+++ b/mm/filemap.c -@@ -3608,19 +3608,33 @@ vm_fault_t filemap_map_pages(struct vm_fault *vmf, - struct vm_area_struct *vma = vmf->vma; - struct file *file = vma->vm_file; - struct address_space *mapping = file->f_mapping; -- pgoff_t last_pgoff = start_pgoff; -+ pgoff_t file_end, last_pgoff = start_pgoff; - unsigned long addr; - XA_STATE(xas, &mapping->i_pages, start_pgoff); - struct folio *folio; - vm_fault_t ret = 0; - unsigned int nr_pages = 0, mmap_miss = 0, mmap_miss_saved; -+ bool can_map_large; - - rcu_read_lock(); - folio = next_uptodate_folio(&xas, mapping, end_pgoff); - if (!folio) - goto out; - -- if (filemap_map_pmd(vmf, folio, start_pgoff)) { -+ file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1; -+ end_pgoff = min(end_pgoff, file_end); -+ -+ /* -+ * Do not allow to map with PTEs beyond i_size and with PMD -+ * across i_size to preserve SIGBUS semantics. -+ * -+ * Make an exception for shmem/tmpfs that for long time -+ * intentionally mapped with PMDs across i_size. -+ */ -+ can_map_large = shmem_mapping(mapping) || -+ file_end >= folio_next_index(folio); -+ -+ if (can_map_large && filemap_map_pmd(vmf, folio, start_pgoff)) { - ret = VM_FAULT_NOPAGE; - goto out; - } -@@ -3632,6 +3646,7 @@ vm_fault_t filemap_map_pages(struct vm_fault *vmf, - folio_put(folio); - goto out; - } -+ - do { - unsigned long end; - -@@ -4195,6 +4210,9 @@ static void filemap_cachestat(struct address_space *mapping, - XA_STATE(xas, &mapping->i_pages, first_index); - struct folio *folio; - -+ /* Flush stats (and potentially sleep) outside the RCU read section. */ -+ mem_cgroup_flush_stats_ratelimited(NULL); -+ - rcu_read_lock(); - xas_for_each(&xas, folio, last_index) { - int order; -@@ -4258,7 +4276,7 @@ static void filemap_cachestat(struct address_space *mapping, - goto resched; - } - #endif -- if (workingset_test_recent(shadow, true, &workingset)) -+ if (workingset_test_recent(shadow, true, &workingset, false)) - cs->nr_recently_evicted += nr_pages; - - goto resched; -diff --git a/mm/memcontrol.c b/mm/memcontrol.c -index 2d2cada8a8a4c8..41207e680e7d96 100644 ---- a/mm/memcontrol.c -+++ b/mm/memcontrol.c -@@ -570,6 +570,92 @@ mem_cgroup_largest_soft_limit_node(struct mem_cgroup_tree_per_node *mctz) - return mz; - } - -+/* Subset of vm_event_item to report for memcg event stats */ -+static const unsigned int memcg_vm_event_stat[] = { -+ PGPGIN, -+ PGPGOUT, -+ PGSCAN_KSWAPD, -+ PGSCAN_DIRECT, -+ PGSCAN_KHUGEPAGED, -+ PGSTEAL_KSWAPD, -+ PGSTEAL_DIRECT, -+ PGSTEAL_KHUGEPAGED, -+ PGFAULT, -+ PGMAJFAULT, -+ PGREFILL, -+ PGACTIVATE, -+ PGDEACTIVATE, -+ PGLAZYFREE, -+ PGLAZYFREED, -+#if defined(CONFIG_MEMCG_KMEM) && defined(CONFIG_ZSWAP) -+ ZSWPIN, -+ ZSWPOUT, -+ ZSWPWB, -+#endif -+#ifdef CONFIG_TRANSPARENT_HUGEPAGE -+ THP_FAULT_ALLOC, -+ THP_COLLAPSE_ALLOC, -+ THP_SWPOUT, -+ THP_SWPOUT_FALLBACK, -+#endif -+}; -+ -+#define NR_MEMCG_EVENTS ARRAY_SIZE(memcg_vm_event_stat) -+static int mem_cgroup_events_index[NR_VM_EVENT_ITEMS] __read_mostly; -+ -+static void init_memcg_events(void) -+{ -+ int i; -+ -+ for (i = 0; i < NR_MEMCG_EVENTS; ++i) -+ mem_cgroup_events_index[memcg_vm_event_stat[i]] = i + 1; -+} -+ -+static inline int memcg_events_index(enum vm_event_item idx) -+{ -+ return mem_cgroup_events_index[idx] - 1; -+} -+ -+struct memcg_vmstats_percpu { -+ /* Stats updates since the last flush */ -+ unsigned int stats_updates; -+ -+ /* Cached pointers for fast iteration in memcg_rstat_updated() */ -+ struct memcg_vmstats_percpu *parent; -+ struct memcg_vmstats *vmstats; -+ -+ /* The above should fit a single cacheline for memcg_rstat_updated() */ -+ -+ /* Local (CPU and cgroup) page state & events */ -+ long state[MEMCG_NR_STAT]; -+ unsigned long events[NR_MEMCG_EVENTS]; -+ -+ /* Delta calculation for lockless upward propagation */ -+ long state_prev[MEMCG_NR_STAT]; -+ unsigned long events_prev[NR_MEMCG_EVENTS]; -+ -+ /* Cgroup1: threshold notifications & softlimit tree updates */ -+ unsigned long nr_page_events; -+ unsigned long targets[MEM_CGROUP_NTARGETS]; -+} ____cacheline_aligned; -+ -+struct memcg_vmstats { -+ /* Aggregated (CPU and subtree) page state & events */ -+ long state[MEMCG_NR_STAT]; -+ unsigned long events[NR_MEMCG_EVENTS]; -+ -+ /* Non-hierarchical (CPU aggregated) page state & events */ -+ long state_local[MEMCG_NR_STAT]; -+ unsigned long events_local[NR_MEMCG_EVENTS]; -+ -+ /* Pending child counts during tree propagation */ -+ long state_pending[MEMCG_NR_STAT]; -+ unsigned long events_pending[NR_MEMCG_EVENTS]; -+ -+ /* Stats updates since the last flush */ -+ atomic64_t stats_updates; -+}; -+ - /* - * memcg and lruvec stats flushing - * -@@ -587,10 +673,7 @@ mem_cgroup_largest_soft_limit_node(struct mem_cgroup_tree_per_node *mctz) - */ - static void flush_memcg_stats_dwork(struct work_struct *w); - static DECLARE_DEFERRABLE_WORK(stats_flush_dwork, flush_memcg_stats_dwork); --static DEFINE_PER_CPU(unsigned int, stats_updates); --static atomic_t stats_flush_ongoing = ATOMIC_INIT(0); --static atomic_t stats_flush_threshold = ATOMIC_INIT(0); --static u64 flush_next_time; -+static u64 flush_last_time; - - #define FLUSH_TIME (2UL*HZ) - -@@ -616,141 +699,87 @@ static void memcg_stats_unlock(void) - preempt_enable_nested(); - } - -+ -+static bool memcg_vmstats_needs_flush(struct memcg_vmstats *vmstats) -+{ -+ return atomic64_read(&vmstats->stats_updates) > -+ MEMCG_CHARGE_BATCH * num_online_cpus(); -+} -+ - static inline void memcg_rstat_updated(struct mem_cgroup *memcg, int val) - { -- unsigned int x; -+ struct memcg_vmstats_percpu *statc; -+ int cpu = smp_processor_id(); -+ unsigned int stats_updates; - - if (!val) - return; - -- cgroup_rstat_updated(memcg->css.cgroup, smp_processor_id()); -+ cgroup_rstat_updated(memcg->css.cgroup, cpu); -+ statc = this_cpu_ptr(memcg->vmstats_percpu); -+ for (; statc; statc = statc->parent) { -+ stats_updates = READ_ONCE(statc->stats_updates) + abs(val); -+ WRITE_ONCE(statc->stats_updates, stats_updates); -+ if (stats_updates < MEMCG_CHARGE_BATCH) -+ continue; - -- x = __this_cpu_add_return(stats_updates, abs(val)); -- if (x > MEMCG_CHARGE_BATCH) { - /* -- * If stats_flush_threshold exceeds the threshold -- * (>num_online_cpus()), cgroup stats update will be triggered -- * in __mem_cgroup_flush_stats(). Increasing this var further -- * is redundant and simply adds overhead in atomic update. -+ * If @memcg is already flush-able, increasing stats_updates is -+ * redundant. Avoid the overhead of the atomic update. - */ -- if (atomic_read(&stats_flush_threshold) <= num_online_cpus()) -- atomic_add(x / MEMCG_CHARGE_BATCH, &stats_flush_threshold); -- __this_cpu_write(stats_updates, 0); -+ if (!memcg_vmstats_needs_flush(statc->vmstats)) -+ atomic64_add(stats_updates, -+ &statc->vmstats->stats_updates); -+ WRITE_ONCE(statc->stats_updates, 0); - } - } - --static void do_flush_stats(void) -+static void do_flush_stats(struct mem_cgroup *memcg) - { -- /* -- * We always flush the entire tree, so concurrent flushers can just -- * skip. This avoids a thundering herd problem on the rstat global lock -- * from memcg flushers (e.g. reclaim, refault, etc). -- */ -- if (atomic_read(&stats_flush_ongoing) || -- atomic_xchg(&stats_flush_ongoing, 1)) -- return; -- -- WRITE_ONCE(flush_next_time, jiffies_64 + 2*FLUSH_TIME); -- -- cgroup_rstat_flush(root_mem_cgroup->css.cgroup); -+ if (mem_cgroup_is_root(memcg)) -+ WRITE_ONCE(flush_last_time, jiffies_64); - -- atomic_set(&stats_flush_threshold, 0); -- atomic_set(&stats_flush_ongoing, 0); -+ cgroup_rstat_flush(memcg->css.cgroup); - } - --void mem_cgroup_flush_stats(void) -+/* -+ * mem_cgroup_flush_stats - flush the stats of a memory cgroup subtree -+ * @memcg: root of the subtree to flush -+ * -+ * Flushing is serialized by the underlying global rstat lock. There is also a -+ * minimum amount of work to be done even if there are no stat updates to flush. -+ * Hence, we only flush the stats if the updates delta exceeds a threshold. This -+ * avoids unnecessary work and contention on the underlying lock. -+ */ -+void mem_cgroup_flush_stats(struct mem_cgroup *memcg) - { -- if (atomic_read(&stats_flush_threshold) > num_online_cpus()) -- do_flush_stats(); -+ if (mem_cgroup_disabled()) -+ return; -+ -+ if (!memcg) -+ memcg = root_mem_cgroup; -+ -+ if (memcg_vmstats_needs_flush(memcg->vmstats)) -+ do_flush_stats(memcg); - } - --void mem_cgroup_flush_stats_ratelimited(void) -+void mem_cgroup_flush_stats_ratelimited(struct mem_cgroup *memcg) - { -- if (time_after64(jiffies_64, READ_ONCE(flush_next_time))) -- mem_cgroup_flush_stats(); -+ /* Only flush if the periodic flusher is one full cycle late */ -+ if (time_after64(jiffies_64, READ_ONCE(flush_last_time) + 2*FLUSH_TIME)) -+ mem_cgroup_flush_stats(memcg); - } - - static void flush_memcg_stats_dwork(struct work_struct *w) - { - /* -- * Always flush here so that flushing in latency-sensitive paths is -- * as cheap as possible. -+ * Deliberately ignore memcg_vmstats_needs_flush() here so that flushing -+ * in latency-sensitive paths is as cheap as possible. - */ -- do_flush_stats(); -+ do_flush_stats(root_mem_cgroup); - queue_delayed_work(system_unbound_wq, &stats_flush_dwork, FLUSH_TIME); - } - --/* Subset of vm_event_item to report for memcg event stats */ --static const unsigned int memcg_vm_event_stat[] = { -- PGPGIN, -- PGPGOUT, -- PGSCAN_KSWAPD, -- PGSCAN_DIRECT, -- PGSCAN_KHUGEPAGED, -- PGSTEAL_KSWAPD, -- PGSTEAL_DIRECT, -- PGSTEAL_KHUGEPAGED, -- PGFAULT, -- PGMAJFAULT, -- PGREFILL, -- PGACTIVATE, -- PGDEACTIVATE, -- PGLAZYFREE, -- PGLAZYFREED, --#if defined(CONFIG_MEMCG_KMEM) && defined(CONFIG_ZSWAP) -- ZSWPIN, -- ZSWPOUT, --#endif --#ifdef CONFIG_TRANSPARENT_HUGEPAGE -- THP_FAULT_ALLOC, -- THP_COLLAPSE_ALLOC, --#endif --}; -- --#define NR_MEMCG_EVENTS ARRAY_SIZE(memcg_vm_event_stat) --static int mem_cgroup_events_index[NR_VM_EVENT_ITEMS] __read_mostly; -- --static void init_memcg_events(void) --{ -- int i; -- -- for (i = 0; i < NR_MEMCG_EVENTS; ++i) -- mem_cgroup_events_index[memcg_vm_event_stat[i]] = i + 1; --} -- --static inline int memcg_events_index(enum vm_event_item idx) --{ -- return mem_cgroup_events_index[idx] - 1; --} -- --struct memcg_vmstats_percpu { -- /* Local (CPU and cgroup) page state & events */ -- long state[MEMCG_NR_STAT]; -- unsigned long events[NR_MEMCG_EVENTS]; -- -- /* Delta calculation for lockless upward propagation */ -- long state_prev[MEMCG_NR_STAT]; -- unsigned long events_prev[NR_MEMCG_EVENTS]; -- -- /* Cgroup1: threshold notifications & softlimit tree updates */ -- unsigned long nr_page_events; -- unsigned long targets[MEM_CGROUP_NTARGETS]; --}; -- --struct memcg_vmstats { -- /* Aggregated (CPU and subtree) page state & events */ -- long state[MEMCG_NR_STAT]; -- unsigned long events[NR_MEMCG_EVENTS]; -- -- /* Non-hierarchical (CPU aggregated) page state & events */ -- long state_local[MEMCG_NR_STAT]; -- unsigned long events_local[NR_MEMCG_EVENTS]; -- -- /* Pending child counts during tree propagation */ -- long state_pending[MEMCG_NR_STAT]; -- unsigned long events_pending[NR_MEMCG_EVENTS]; --}; -- - unsigned long memcg_page_state(struct mem_cgroup *memcg, int idx) - { - long x = READ_ONCE(memcg->vmstats->state[idx]); -@@ -1579,7 +1608,7 @@ static void memcg_stat_format(struct mem_cgroup *memcg, struct seq_buf *s) - * - * Current memory state: - */ -- mem_cgroup_flush_stats(); -+ mem_cgroup_flush_stats(memcg); - - for (i = 0; i < ARRAY_SIZE(memory_stats); i++) { - u64 size; -@@ -4029,7 +4058,7 @@ static int memcg_numa_stat_show(struct seq_file *m, void *v) - int nid; - struct mem_cgroup *memcg = mem_cgroup_from_seq(m); - -- mem_cgroup_flush_stats(); -+ mem_cgroup_flush_stats(memcg); - - for (stat = stats; stat < stats + ARRAY_SIZE(stats); stat++) { - seq_printf(m, "%s=%lu", stat->name, -@@ -4104,7 +4133,7 @@ static void memcg1_stat_format(struct mem_cgroup *memcg, struct seq_buf *s) - - BUILD_BUG_ON(ARRAY_SIZE(memcg1_stat_names) != ARRAY_SIZE(memcg1_stats)); - -- mem_cgroup_flush_stats(); -+ mem_cgroup_flush_stats(memcg); - - for (i = 0; i < ARRAY_SIZE(memcg1_stats); i++) { - unsigned long nr; -@@ -4606,7 +4635,7 @@ void mem_cgroup_wb_stats(struct bdi_writeback *wb, unsigned long *pfilepages, - struct mem_cgroup *memcg = mem_cgroup_from_css(wb->memcg_css); - struct mem_cgroup *parent; - -- mem_cgroup_flush_stats(); -+ mem_cgroup_flush_stats(memcg); - - *pdirty = memcg_page_state(memcg, NR_FILE_DIRTY); - *pwriteback = memcg_page_state(memcg, NR_WRITEBACK); -@@ -5306,10 +5335,11 @@ static void mem_cgroup_free(struct mem_cgroup *memcg) - __mem_cgroup_free(memcg); - } - --static struct mem_cgroup *mem_cgroup_alloc(void) -+static struct mem_cgroup *mem_cgroup_alloc(struct mem_cgroup *parent) - { -+ struct memcg_vmstats_percpu *statc, *pstatc; - struct mem_cgroup *memcg; -- int node; -+ int node, cpu; - int __maybe_unused i; - long error = -ENOMEM; - -@@ -5332,6 +5362,14 @@ static struct mem_cgroup *mem_cgroup_alloc(void) - if (!memcg->vmstats_percpu) - goto fail; - -+ for_each_possible_cpu(cpu) { -+ if (parent) -+ pstatc = per_cpu_ptr(parent->vmstats_percpu, cpu); -+ statc = per_cpu_ptr(memcg->vmstats_percpu, cpu); -+ statc->parent = parent ? pstatc : NULL; -+ statc->vmstats = memcg->vmstats; -+ } -+ - for_each_node(node) - if (alloc_mem_cgroup_per_node_info(memcg, node)) - goto fail; -@@ -5377,7 +5415,7 @@ mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css) - struct mem_cgroup *memcg, *old_memcg; - - old_memcg = set_active_memcg(parent); -- memcg = mem_cgroup_alloc(); -+ memcg = mem_cgroup_alloc(parent); - set_active_memcg(old_memcg); - if (IS_ERR(memcg)) - return ERR_CAST(memcg); -@@ -5654,6 +5692,10 @@ static void mem_cgroup_css_rstat_flush(struct cgroup_subsys_state *css, int cpu) - } - } - } -+ WRITE_ONCE(statc->stats_updates, 0); -+ /* We are in a per-cpu loop here, only do the atomic write once */ -+ if (atomic64_read(&memcg->vmstats->stats_updates)) -+ atomic64_set(&memcg->vmstats->stats_updates, 0); - } - - #ifdef CONFIG_MMU -@@ -6682,7 +6724,7 @@ static int memory_numa_stat_show(struct seq_file *m, void *v) - int i; - struct mem_cgroup *memcg = mem_cgroup_from_seq(m); - -- mem_cgroup_flush_stats(); -+ mem_cgroup_flush_stats(memcg); - - for (i = 0; i < ARRAY_SIZE(memory_stats); i++) { - int nid; -@@ -7846,7 +7888,11 @@ bool obj_cgroup_may_zswap(struct obj_cgroup *objcg) - break; - } - -- cgroup_rstat_flush(memcg->css.cgroup); -+ /* -+ * mem_cgroup_flush_stats() ignores small changes. Use -+ * do_flush_stats() directly to get accurate stats for charging. -+ */ -+ do_flush_stats(memcg); - pages = memcg_page_state(memcg, MEMCG_ZSWAP_B) / PAGE_SIZE; - if (pages < max) - continue; -@@ -7911,8 +7957,10 @@ void obj_cgroup_uncharge_zswap(struct obj_cgroup *objcg, size_t size) - static u64 zswap_current_read(struct cgroup_subsys_state *css, - struct cftype *cft) - { -- cgroup_rstat_flush(css->cgroup); -- return memcg_page_state(mem_cgroup_from_css(css), MEMCG_ZSWAP_B); -+ struct mem_cgroup *memcg = mem_cgroup_from_css(css); -+ -+ mem_cgroup_flush_stats(memcg); -+ return memcg_page_state(memcg, MEMCG_ZSWAP_B); - } - - static int zswap_max_show(struct seq_file *m, void *v) -diff --git a/mm/memory-tiers.c b/mm/memory-tiers.c -index 37a4f59d9585b9..93cb8eed4bc233 100644 ---- a/mm/memory-tiers.c -+++ b/mm/memory-tiers.c -@@ -5,6 +5,7 @@ - #include - #include - #include -+#include - - #include "internal.h" - -@@ -36,7 +37,7 @@ struct node_memory_type_map { - static DEFINE_MUTEX(memory_tier_lock); - static LIST_HEAD(memory_tiers); - static struct node_memory_type_map node_memory_types[MAX_NUMNODES]; --static struct memory_dev_type *default_dram_type; -+struct memory_dev_type *default_dram_type; - - static struct bus_type memory_tier_subsys = { - .name = "memory_tiering", -@@ -105,6 +106,13 @@ static int top_tier_adistance; - static struct demotion_nodes *node_demotion __read_mostly; - #endif /* CONFIG_MIGRATION */ - -+static BLOCKING_NOTIFIER_HEAD(mt_adistance_algorithms); -+ -+static bool default_dram_perf_error; -+static struct access_coordinate default_dram_perf; -+static int default_dram_perf_ref_nid = NUMA_NO_NODE; -+static const char *default_dram_perf_ref_source; -+ - static inline struct memory_tier *to_memory_tier(struct device *device) - { - return container_of(device, struct memory_tier, dev); -@@ -592,6 +600,158 @@ void clear_node_memory_type(int node, struct memory_dev_type *memtype) - } - EXPORT_SYMBOL_GPL(clear_node_memory_type); - -+static void dump_hmem_attrs(struct access_coordinate *coord, const char *prefix) -+{ -+ pr_info( -+"%sread_latency: %u, write_latency: %u, read_bandwidth: %u, write_bandwidth: %u\n", -+ prefix, coord->read_latency, coord->write_latency, -+ coord->read_bandwidth, coord->write_bandwidth); -+} -+ -+int mt_set_default_dram_perf(int nid, struct access_coordinate *perf, -+ const char *source) -+{ -+ int rc = 0; -+ -+ mutex_lock(&memory_tier_lock); -+ if (default_dram_perf_error) { -+ rc = -EIO; -+ goto out; -+ } -+ -+ if (perf->read_latency + perf->write_latency == 0 || -+ perf->read_bandwidth + perf->write_bandwidth == 0) { -+ rc = -EINVAL; -+ goto out; -+ } -+ -+ if (default_dram_perf_ref_nid == NUMA_NO_NODE) { -+ default_dram_perf = *perf; -+ default_dram_perf_ref_nid = nid; -+ default_dram_perf_ref_source = kstrdup(source, GFP_KERNEL); -+ goto out; -+ } -+ -+ /* -+ * The performance of all default DRAM nodes is expected to be -+ * same (that is, the variation is less than 10%). And it -+ * will be used as base to calculate the abstract distance of -+ * other memory nodes. -+ */ -+ if (abs(perf->read_latency - default_dram_perf.read_latency) * 10 > -+ default_dram_perf.read_latency || -+ abs(perf->write_latency - default_dram_perf.write_latency) * 10 > -+ default_dram_perf.write_latency || -+ abs(perf->read_bandwidth - default_dram_perf.read_bandwidth) * 10 > -+ default_dram_perf.read_bandwidth || -+ abs(perf->write_bandwidth - default_dram_perf.write_bandwidth) * 10 > -+ default_dram_perf.write_bandwidth) { -+ pr_info( -+"memory-tiers: the performance of DRAM node %d mismatches that of the reference\n" -+"DRAM node %d.\n", nid, default_dram_perf_ref_nid); -+ pr_info(" performance of reference DRAM node %d from %s:\n", -+ default_dram_perf_ref_nid, default_dram_perf_ref_source); -+ dump_hmem_attrs(&default_dram_perf, " "); -+ pr_info(" performance of DRAM node %d from %s:\n", nid, source); -+ dump_hmem_attrs(perf, " "); -+ pr_info( -+" disable default DRAM node performance based abstract distance algorithm.\n"); -+ default_dram_perf_error = true; -+ rc = -EINVAL; -+ } -+ -+out: -+ mutex_unlock(&memory_tier_lock); -+ return rc; -+} -+ -+int mt_perf_to_adistance(struct access_coordinate *perf, int *adist) -+{ -+ if (default_dram_perf_error) -+ return -EIO; -+ -+ if (default_dram_perf_ref_nid == NUMA_NO_NODE) -+ return -ENOENT; -+ -+ if (perf->read_latency + perf->write_latency == 0 || -+ perf->read_bandwidth + perf->write_bandwidth == 0) -+ return -EINVAL; -+ -+ mutex_lock(&memory_tier_lock); -+ /* -+ * The abstract distance of a memory node is in direct proportion to -+ * its memory latency (read + write) and inversely proportional to its -+ * memory bandwidth (read + write). The abstract distance, memory -+ * latency, and memory bandwidth of the default DRAM nodes are used as -+ * the base. -+ */ -+ *adist = MEMTIER_ADISTANCE_DRAM * -+ (perf->read_latency + perf->write_latency) / -+ (default_dram_perf.read_latency + default_dram_perf.write_latency) * -+ (default_dram_perf.read_bandwidth + default_dram_perf.write_bandwidth) / -+ (perf->read_bandwidth + perf->write_bandwidth); -+ mutex_unlock(&memory_tier_lock); -+ -+ return 0; -+} -+EXPORT_SYMBOL_GPL(mt_perf_to_adistance); -+ -+/** -+ * register_mt_adistance_algorithm() - Register memory tiering abstract distance algorithm -+ * @nb: The notifier block which describe the algorithm -+ * -+ * Return: 0 on success, errno on error. -+ * -+ * Every memory tiering abstract distance algorithm provider needs to -+ * register the algorithm with register_mt_adistance_algorithm(). To -+ * calculate the abstract distance for a specified memory node, the -+ * notifier function will be called unless some high priority -+ * algorithm has provided result. The prototype of the notifier -+ * function is as follows, -+ * -+ * int (*algorithm_notifier)(struct notifier_block *nb, -+ * unsigned long nid, void *data); -+ * -+ * Where "nid" specifies the memory node, "data" is the pointer to the -+ * returned abstract distance (that is, "int *adist"). If the -+ * algorithm provides the result, NOTIFY_STOP should be returned. -+ * Otherwise, return_value & %NOTIFY_STOP_MASK == 0 to allow the next -+ * algorithm in the chain to provide the result. -+ */ -+int register_mt_adistance_algorithm(struct notifier_block *nb) -+{ -+ return blocking_notifier_chain_register(&mt_adistance_algorithms, nb); -+} -+EXPORT_SYMBOL_GPL(register_mt_adistance_algorithm); -+ -+/** -+ * unregister_mt_adistance_algorithm() - Unregister memory tiering abstract distance algorithm -+ * @nb: the notifier block which describe the algorithm -+ * -+ * Return: 0 on success, errno on error. -+ */ -+int unregister_mt_adistance_algorithm(struct notifier_block *nb) -+{ -+ return blocking_notifier_chain_unregister(&mt_adistance_algorithms, nb); -+} -+EXPORT_SYMBOL_GPL(unregister_mt_adistance_algorithm); -+ -+/** -+ * mt_calc_adistance() - Calculate abstract distance with registered algorithms -+ * @node: the node to calculate abstract distance for -+ * @adist: the returned abstract distance -+ * -+ * Return: if return_value & %NOTIFY_STOP_MASK != 0, then some -+ * abstract distance algorithm provides the result, and return it via -+ * @adist. Otherwise, no algorithm can provide the result and @adist -+ * will be kept as it is. -+ */ -+int mt_calc_adistance(int node, int *adist) -+{ -+ return blocking_notifier_call_chain(&mt_adistance_algorithms, node, adist); -+} -+EXPORT_SYMBOL_GPL(mt_calc_adistance); -+ - static int __meminit memtier_hotplug_callback(struct notifier_block *self, - unsigned long action, void *_arg) - { -diff --git a/mm/memory.c b/mm/memory.c -index 8b80db7115e5fe..fd917a5bc9617a 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -67,6 +67,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -4435,6 +4436,8 @@ static bool vmf_pte_changed(struct vm_fault *vmf) - vm_fault_t finish_fault(struct vm_fault *vmf) - { - struct vm_area_struct *vma = vmf->vma; -+ bool needs_fallback = false; -+ struct folio *folio; - struct page *page; - vm_fault_t ret; - -@@ -4444,6 +4447,8 @@ vm_fault_t finish_fault(struct vm_fault *vmf) - else - page = vmf->page; - -+ folio = page_folio(page); -+ - /* - * check even for read faults because we might have lost our CoWed - * page -@@ -4454,8 +4459,25 @@ vm_fault_t finish_fault(struct vm_fault *vmf) - return ret; - } - -+ if (!needs_fallback && vma->vm_file) { -+ struct address_space *mapping = vma->vm_file->f_mapping; -+ pgoff_t file_end; -+ -+ file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE); -+ -+ /* -+ * Do not allow to map with PTEs beyond i_size and with PMD -+ * across i_size to preserve SIGBUS semantics. -+ * -+ * Make an exception for shmem/tmpfs that for long time -+ * intentionally mapped with PMDs across i_size. -+ */ -+ needs_fallback = !shmem_mapping(mapping) && -+ file_end < folio_next_index(folio); -+ } -+ - if (pmd_none(*vmf->pmd)) { -- if (PageTransCompound(page)) { -+ if (!needs_fallback && PageTransCompound(page)) { - ret = do_set_pmd(vmf, page); - if (ret != VM_FAULT_FALLBACK) - return ret; -diff --git a/mm/mm_init.c b/mm/mm_init.c -index 77fd04c83d046d..f5519ca1263e75 100644 ---- a/mm/mm_init.c -+++ b/mm/mm_init.c -@@ -2546,7 +2546,7 @@ void *__init alloc_large_system_hash(const char *tablename, - panic("Failed to allocate %s hash table\n", tablename); - - pr_info("%s hash table entries: %ld (order: %d, %lu bytes, %s)\n", -- tablename, 1UL << log2qty, ilog2(size) - PAGE_SHIFT, size, -+ tablename, 1UL << log2qty, get_order(size), size, - virt ? (huge ? "vmalloc hugepage" : "vmalloc") : "linear"); - - if (_hash_shift) -diff --git a/mm/page_io.c b/mm/page_io.c -index fe4c21af23f269..cb559ae324c672 100644 ---- a/mm/page_io.c -+++ b/mm/page_io.c -@@ -208,8 +208,10 @@ int swap_writepage(struct page *page, struct writeback_control *wbc) - static inline void count_swpout_vm_event(struct folio *folio) - { - #ifdef CONFIG_TRANSPARENT_HUGEPAGE -- if (unlikely(folio_test_pmd_mappable(folio))) -+ if (unlikely(folio_test_pmd_mappable(folio))) { -+ count_memcg_folio_events(folio, THP_SWPOUT, 1); - count_vm_event(THP_SWPOUT); -+ } - #endif - count_vm_events(PSWPOUT, folio_nr_pages(folio)); - } -@@ -278,9 +280,6 @@ static void sio_write_complete(struct kiocb *iocb, long ret) - set_page_dirty(page); - ClearPageReclaim(page); - } -- } else { -- for (p = 0; p < sio->pages; p++) -- count_swpout_vm_event(page_folio(sio->bvec[p].bv_page)); - } - - for (p = 0; p < sio->pages; p++) -@@ -296,6 +295,7 @@ static void swap_writepage_fs(struct page *page, struct writeback_control *wbc) - struct file *swap_file = sis->swap_file; - loff_t pos = page_file_offset(page); - -+ count_swpout_vm_event(page_folio(page)); - set_page_writeback(page); - unlock_page(page); - if (wbc->swap_plug) -diff --git a/mm/percpu.c b/mm/percpu.c -index 38d5121c2b652a..54c2988a74967c 100644 ---- a/mm/percpu.c -+++ b/mm/percpu.c -@@ -1734,7 +1734,7 @@ static void __percpu *pcpu_alloc(size_t size, size_t align, bool reserved, - gfp = current_gfp_context(gfp); - /* whitelisted flags that can be passed to the backing allocators */ - pcpu_gfp = gfp & (GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN); -- is_atomic = (gfp & GFP_KERNEL) != GFP_KERNEL; -+ is_atomic = !gfpflags_allow_blocking(gfp); - do_warn = !(gfp & __GFP_NOWARN); - - /* -@@ -2231,7 +2231,12 @@ static void pcpu_balance_workfn(struct work_struct *work) - * to grow other chunks. This then gives pcpu_reclaim_populated() time - * to move fully free chunks to the active list to be freed if - * appropriate. -+ * -+ * Enforce GFP_NOIO allocations because we have pcpu_alloc users -+ * constrained to GFP_NOIO/NOFS contexts and they could form lock -+ * dependency through pcpu_alloc_mutex - */ -+ unsigned int flags = memalloc_noio_save(); - mutex_lock(&pcpu_alloc_mutex); - spin_lock_irq(&pcpu_lock); - -@@ -2242,6 +2247,7 @@ static void pcpu_balance_workfn(struct work_struct *work) - - spin_unlock_irq(&pcpu_lock); - mutex_unlock(&pcpu_alloc_mutex); -+ memalloc_noio_restore(flags); - } - - /** -diff --git a/mm/secretmem.c b/mm/secretmem.c -index 4bedf491a8a742..f64ea1cde2f92f 100644 ---- a/mm/secretmem.c -+++ b/mm/secretmem.c -@@ -84,13 +84,13 @@ static vm_fault_t secretmem_fault(struct vm_fault *vmf) - __folio_mark_uptodate(folio); - err = filemap_add_folio(mapping, folio, offset, gfp); - if (unlikely(err)) { -- folio_put(folio); - /* - * If a split of large page was required, it - * already happened when we marked the page invalid - * which guarantees that this call won't fail - */ - set_direct_map_default_noflush(page); -+ folio_put(folio); - if (err == -EEXIST) - goto retry; - -diff --git a/mm/truncate.c b/mm/truncate.c -index 70c09213bb9200..6a82e981b63cef 100644 ---- a/mm/truncate.c -+++ b/mm/truncate.c -@@ -196,6 +196,31 @@ int truncate_inode_folio(struct address_space *mapping, struct folio *folio) - return 0; - } - -+static int try_folio_split_or_unmap(struct folio *folio) -+{ -+ enum ttu_flags ttu_flags = -+ TTU_SYNC | -+ TTU_SPLIT_HUGE_PMD | -+ TTU_IGNORE_MLOCK; -+ int ret; -+ -+ ret = split_folio(folio); -+ -+ /* -+ * If the split fails, unmap the folio, so it will be refaulted -+ * with PTEs to respect SIGBUS semantics. -+ * -+ * Make an exception for shmem/tmpfs that for long time -+ * intentionally mapped with PMDs across i_size. -+ */ -+ if (ret && !shmem_mapping(folio->mapping)) { -+ try_to_unmap(folio, ttu_flags); -+ WARN_ON(folio_mapped(folio)); -+ } -+ -+ return ret; -+} -+ - /* - * Handle partial folios. The folio may be entirely within the - * range if a split has raced with us. If not, we zero the part of the -@@ -239,7 +264,7 @@ bool truncate_inode_partial_folio(struct folio *folio, loff_t start, loff_t end) - folio_invalidate(folio, offset, length); - if (!folio_test_large(folio)) - return true; -- if (split_folio(folio) == 0) -+ if (try_folio_split_or_unmap(folio) == 0) - return true; - if (folio_test_dirty(folio)) - return false; -diff --git a/mm/vmscan.c b/mm/vmscan.c -index 258f5472f1e900..aba757e5c59784 100644 ---- a/mm/vmscan.c -+++ b/mm/vmscan.c -@@ -1922,6 +1922,7 @@ static unsigned int shrink_folio_list(struct list_head *folio_list, - folio_list)) - goto activate_locked; - #ifdef CONFIG_TRANSPARENT_HUGEPAGE -+ count_memcg_folio_events(folio, THP_SWPOUT_FALLBACK, 1); - count_vm_event(THP_SWPOUT_FALLBACK); - #endif - if (!add_to_swap(folio)) -@@ -2910,7 +2911,7 @@ static void prepare_scan_count(pg_data_t *pgdat, struct scan_control *sc) - * Flush the memory cgroup stats, so that we read accurate per-memcg - * lruvec stats for heuristics. - */ -- mem_cgroup_flush_stats(); -+ mem_cgroup_flush_stats(sc->target_mem_cgroup); - - /* - * Determine the scan balance between anon and file LRUs. -diff --git a/mm/vmstat.c b/mm/vmstat.c -index 57891697846b93..3630c6e2bb41a4 100644 ---- a/mm/vmstat.c -+++ b/mm/vmstat.c -@@ -1397,6 +1397,7 @@ const char * const vmstat_text[] = { - #ifdef CONFIG_ZSWAP - "zswpin", - "zswpout", -+ "zswpwb", - #endif - #ifdef CONFIG_X86 - "direct_map_level2_splits", -diff --git a/mm/workingset.c b/mm/workingset.c -index 9110957bec5b30..1cdbc1fb587312 100644 ---- a/mm/workingset.c -+++ b/mm/workingset.c -@@ -411,10 +411,12 @@ void *workingset_eviction(struct folio *folio, struct mem_cgroup *target_memcg) - * @file: whether the corresponding folio is from the file lru. - * @workingset: where the workingset value unpacked from shadow should - * be stored. -+ * @flush: whether to flush cgroup rstat. - * - * Return: true if the shadow is for a recently evicted folio; false otherwise. - */ --bool workingset_test_recent(void *shadow, bool file, bool *workingset) -+bool workingset_test_recent(void *shadow, bool file, bool *workingset, -+ bool flush) - { - struct mem_cgroup *eviction_memcg; - struct lruvec *eviction_lruvec; -@@ -425,8 +427,16 @@ bool workingset_test_recent(void *shadow, bool file, bool *workingset) - struct pglist_data *pgdat; - unsigned long eviction; - -- if (lru_gen_enabled()) -- return lru_gen_test_recent(shadow, file, &eviction_lruvec, &eviction, workingset); -+ rcu_read_lock(); -+ -+ if (lru_gen_enabled()) { -+ bool recent = lru_gen_test_recent(shadow, file, -+ &eviction_lruvec, &eviction, workingset); -+ -+ rcu_read_unlock(); -+ return recent; -+ } -+ - - unpack_shadow(shadow, &memcgid, &pgdat, &eviction, workingset); - eviction <<= bucket_order; -@@ -448,8 +458,26 @@ bool workingset_test_recent(void *shadow, bool file, bool *workingset) - * configurations instead. - */ - eviction_memcg = mem_cgroup_from_id(memcgid); -- if (!mem_cgroup_disabled() && !eviction_memcg) -+ if (!mem_cgroup_disabled() && -+ (!eviction_memcg || !mem_cgroup_tryget(eviction_memcg))) { -+ rcu_read_unlock(); - return false; -+ } -+ -+ rcu_read_unlock(); -+ -+ /* -+ * Flush stats (and potentially sleep) outside the RCU read section. -+ * -+ * Note that workingset_test_recent() itself might be called in RCU read -+ * section (for e.g, in cachestat) - these callers need to skip flushing -+ * stats (via the flush argument). -+ * -+ * XXX: With per-memcg flushing and thresholding, is ratelimiting -+ * still needed here? -+ */ -+ if (flush) -+ mem_cgroup_flush_stats_ratelimited(eviction_memcg); - - eviction_lruvec = mem_cgroup_lruvec(eviction_memcg, pgdat); - refault = atomic_long_read(&eviction_lruvec->nonresident_age); -@@ -493,6 +521,7 @@ bool workingset_test_recent(void *shadow, bool file, bool *workingset) - } - } - -+ mem_cgroup_put(eviction_memcg); - return refault_distance <= workingset_size; - } - -@@ -519,19 +548,16 @@ void workingset_refault(struct folio *folio, void *shadow) - return; - } - -- /* Flush stats (and potentially sleep) before holding RCU read lock */ -- mem_cgroup_flush_stats_ratelimited(); -- -- rcu_read_lock(); -- - /* - * The activation decision for this folio is made at the level - * where the eviction occurred, as that is where the LRU order - * during folio reclaim is being determined. - * - * However, the cgroup that will own the folio is the one that -- * is actually experiencing the refault event. -+ * is actually experiencing the refault event. Make sure the folio is -+ * locked to guarantee folio_memcg() stability throughout. - */ -+ VM_BUG_ON_FOLIO(!folio_test_locked(folio), folio); - nr = folio_nr_pages(folio); - memcg = folio_memcg(folio); - pgdat = folio_pgdat(folio); -@@ -539,8 +565,8 @@ void workingset_refault(struct folio *folio, void *shadow) - - mod_lruvec_state(lruvec, WORKINGSET_REFAULT_BASE + file, nr); - -- if (!workingset_test_recent(shadow, file, &workingset)) -- goto out; -+ if (!workingset_test_recent(shadow, file, &workingset, true)) -+ return; - - folio_set_active(folio); - workingset_age_nonresident(lruvec, nr); -@@ -556,8 +582,6 @@ void workingset_refault(struct folio *folio, void *shadow) - lru_note_cost_refault(folio); - mod_lruvec_state(lruvec, WORKINGSET_RESTORE_BASE + file, nr); - } --out: -- rcu_read_unlock(); - } - - /** -@@ -664,7 +688,7 @@ static unsigned long count_shadow_nodes(struct shrinker *shrinker, - struct lruvec *lruvec; - int i; - -- mem_cgroup_flush_stats_ratelimited(); -+ mem_cgroup_flush_stats_ratelimited(sc->memcg); - lruvec = mem_cgroup_lruvec(sc->memcg, NODE_DATA(sc->nid)); - for (pages = 0, i = 0; i < NR_LRU_LISTS; i++) - pages += lruvec_page_state_local(lruvec, -diff --git a/mm/zswap.c b/mm/zswap.c -index 69681b9173fdcb..a3459440fc313c 100644 ---- a/mm/zswap.c -+++ b/mm/zswap.c -@@ -674,6 +674,10 @@ static int zswap_reclaim_entry(struct zswap_pool *pool) - goto put_unlock; - } - -+ if (entry->objcg) -+ count_objcg_event(entry->objcg, ZSWPWB); -+ -+ count_vm_event(ZSWPWB); - /* - * Writeback started successfully, the page now belongs to the - * swapcache. Drop the entry from zswap - unless invalidate already -diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c -index 422f726346ea51..7c77482f315948 100644 ---- a/net/8021q/vlan.c -+++ b/net/8021q/vlan.c -@@ -194,6 +194,8 @@ int register_vlan_dev(struct net_device *dev, struct netlink_ext_ack *extack) - vlan_group_set_device(grp, vlan->vlan_proto, vlan_id, dev); - grp->nr_vlan_devs++; - -+ netdev_update_features(dev); -+ - return 0; - - out_unregister_netdev: -diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c -index 13b752c169bed7..e65d4754c94f4c 100644 ---- a/net/bluetooth/6lowpan.c -+++ b/net/bluetooth/6lowpan.c -@@ -52,6 +52,11 @@ static bool enable_6lowpan; - static struct l2cap_chan *listen_chan; - static DEFINE_MUTEX(set_lock); - -+enum { -+ LOWPAN_PEER_CLOSING, -+ LOWPAN_PEER_MAXBITS -+}; -+ - struct lowpan_peer { - struct list_head list; - struct rcu_head rcu; -@@ -60,6 +65,8 @@ struct lowpan_peer { - /* peer addresses in various formats */ - unsigned char lladdr[ETH_ALEN]; - struct in6_addr peer_addr; -+ -+ DECLARE_BITMAP(flags, LOWPAN_PEER_MAXBITS); - }; - - struct lowpan_btle_dev { -@@ -288,6 +295,7 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev, - local_skb->pkt_type = PACKET_HOST; - local_skb->dev = dev; - -+ skb_reset_mac_header(local_skb); - skb_set_transport_header(local_skb, sizeof(struct ipv6hdr)); - - if (give_skb_to_upper(local_skb, dev) != NET_RX_SUCCESS) { -@@ -955,10 +963,11 @@ static struct l2cap_chan *bt_6lowpan_listen(void) - } - - static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type, -- struct l2cap_conn **conn) -+ struct l2cap_conn **conn, bool disconnect) - { - struct hci_conn *hcon; - struct hci_dev *hdev; -+ int le_addr_type; - int n; - - n = sscanf(buf, "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx %hhu", -@@ -969,13 +978,32 @@ static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type, - if (n < 7) - return -EINVAL; - -+ if (disconnect) { -+ /* The "disconnect" debugfs command has used different address -+ * type constants than "connect" since 2015. Let's retain that -+ * for now even though it's obviously buggy... -+ */ -+ *addr_type += 1; -+ } -+ -+ switch (*addr_type) { -+ case BDADDR_LE_PUBLIC: -+ le_addr_type = ADDR_LE_DEV_PUBLIC; -+ break; -+ case BDADDR_LE_RANDOM: -+ le_addr_type = ADDR_LE_DEV_RANDOM; -+ break; -+ default: -+ return -EINVAL; -+ } -+ - /* The LE_PUBLIC address type is ignored because of BDADDR_ANY */ - hdev = hci_get_route(addr, BDADDR_ANY, BDADDR_LE_PUBLIC); - if (!hdev) - return -ENOENT; - - hci_dev_lock(hdev); -- hcon = hci_conn_hash_lookup_le(hdev, addr, *addr_type); -+ hcon = hci_conn_hash_lookup_le(hdev, addr, le_addr_type); - hci_dev_unlock(hdev); - hci_dev_put(hdev); - -@@ -992,41 +1020,52 @@ static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type, - static void disconnect_all_peers(void) - { - struct lowpan_btle_dev *entry; -- struct lowpan_peer *peer, *tmp_peer, *new_peer; -- struct list_head peers; -- -- INIT_LIST_HEAD(&peers); -+ struct lowpan_peer *peer; -+ int nchans; - -- /* We make a separate list of peers as the close_cb() will -- * modify the device peers list so it is better not to mess -- * with the same list at the same time. -+ /* l2cap_chan_close() cannot be called from RCU, and lock ordering -+ * chan->lock > devices_lock prevents taking write side lock, so copy -+ * then close. - */ - - rcu_read_lock(); -+ list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) -+ list_for_each_entry_rcu(peer, &entry->peers, list) -+ clear_bit(LOWPAN_PEER_CLOSING, peer->flags); -+ rcu_read_unlock(); - -- list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) { -- list_for_each_entry_rcu(peer, &entry->peers, list) { -- new_peer = kmalloc(sizeof(*new_peer), GFP_ATOMIC); -- if (!new_peer) -- break; -+ do { -+ struct l2cap_chan *chans[32]; -+ int i; - -- new_peer->chan = peer->chan; -- INIT_LIST_HEAD(&new_peer->list); -+ nchans = 0; - -- list_add(&new_peer->list, &peers); -- } -- } -+ spin_lock(&devices_lock); - -- rcu_read_unlock(); -+ list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) { -+ list_for_each_entry_rcu(peer, &entry->peers, list) { -+ if (test_and_set_bit(LOWPAN_PEER_CLOSING, -+ peer->flags)) -+ continue; - -- spin_lock(&devices_lock); -- list_for_each_entry_safe(peer, tmp_peer, &peers, list) { -- l2cap_chan_close(peer->chan, ENOENT); -+ l2cap_chan_hold(peer->chan); -+ chans[nchans++] = peer->chan; - -- list_del_rcu(&peer->list); -- kfree_rcu(peer, rcu); -- } -- spin_unlock(&devices_lock); -+ if (nchans >= ARRAY_SIZE(chans)) -+ goto done; -+ } -+ } -+ -+done: -+ spin_unlock(&devices_lock); -+ -+ for (i = 0; i < nchans; ++i) { -+ l2cap_chan_lock(chans[i]); -+ l2cap_chan_close(chans[i], ENOENT); -+ l2cap_chan_unlock(chans[i]); -+ l2cap_chan_put(chans[i]); -+ } -+ } while (nchans); - } - - struct set_enable { -@@ -1102,7 +1141,7 @@ static ssize_t lowpan_control_write(struct file *fp, - buf[buf_size] = '\0'; - - if (memcmp(buf, "connect ", 8) == 0) { -- ret = get_l2cap_conn(&buf[8], &addr, &addr_type, &conn); -+ ret = get_l2cap_conn(&buf[8], &addr, &addr_type, &conn, false); - if (ret == -EINVAL) - return ret; - -@@ -1139,7 +1178,7 @@ static ssize_t lowpan_control_write(struct file *fp, - } - - if (memcmp(buf, "disconnect ", 11) == 0) { -- ret = get_l2cap_conn(&buf[11], &addr, &addr_type, &conn); -+ ret = get_l2cap_conn(&buf[11], &addr, &addr_type, &conn, true); - if (ret < 0) - return ret; - -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index 7bda00dcb0b2f0..4aa445e7f56bc2 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -1596,8 +1596,10 @@ static u8 hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev, void *data, - - hci_dev_set_flag(hdev, HCI_LE_ADV); - -- if (adv && !adv->periodic) -+ if (adv) - adv->enabled = true; -+ else if (!set->handle) -+ hci_dev_set_flag(hdev, HCI_LE_ADV_0); - - conn = hci_lookup_le_connect(hdev); - if (conn) -@@ -1608,6 +1610,8 @@ static u8 hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev, void *data, - if (cp->num_of_sets) { - if (adv) - adv->enabled = false; -+ else if (!set->handle) -+ hci_dev_clear_flag(hdev, HCI_LE_ADV_0); - - /* If just one instance was disabled check if there are - * any other instance enabled before clearing HCI_LE_ADV -@@ -3949,8 +3953,11 @@ static u8 hci_cc_le_set_per_adv_enable(struct hci_dev *hdev, void *data, - hci_dev_set_flag(hdev, HCI_LE_PER_ADV); - - if (adv) -- adv->enabled = true; -+ adv->periodic_enabled = true; - } else { -+ if (adv) -+ adv->periodic_enabled = false; -+ - /* If just one instance was disabled check if there are - * any other instance enabled before clearing HCI_LE_PER_ADV. - * The current periodic adv instance will be marked as -@@ -4201,6 +4208,13 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, void *data, - } - - if (i == ARRAY_SIZE(hci_cc_table)) { -+ if (!skb->len) { -+ bt_dev_err(hdev, "Unexpected cc 0x%4.4x with no status", -+ *opcode); -+ *status = HCI_ERROR_UNSPECIFIED; -+ return; -+ } -+ - /* Unknown opcode, assume byte 0 contains the status, so - * that e.g. __hci_cmd_sync() properly returns errors - * for vendor specific commands send by HCI drivers. -diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c -index a128e5709fa153..f0eb52d5c05811 100644 ---- a/net/bluetooth/hci_sync.c -+++ b/net/bluetooth/hci_sync.c -@@ -881,11 +881,17 @@ bool hci_cmd_sync_dequeue_once(struct hci_dev *hdev, - { - struct hci_cmd_sync_work_entry *entry; - -- entry = hci_cmd_sync_lookup_entry(hdev, func, data, destroy); -- if (!entry) -+ mutex_lock(&hdev->cmd_sync_work_lock); -+ -+ entry = _hci_cmd_sync_lookup_entry(hdev, func, data, destroy); -+ if (!entry) { -+ mutex_unlock(&hdev->cmd_sync_work_lock); - return false; -+ } - -- hci_cmd_sync_cancel_entry(hdev, entry); -+ _hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED); -+ -+ mutex_unlock(&hdev->cmd_sync_work_lock); - - return true; - } -@@ -1625,7 +1631,7 @@ int hci_disable_per_advertising_sync(struct hci_dev *hdev, u8 instance) - - /* If periodic advertising already disabled there is nothing to do. */ - adv = hci_find_adv_instance(hdev, instance); -- if (!adv || !adv->periodic || !adv->enabled) -+ if (!adv || !adv->periodic_enabled) - return 0; - - memset(&cp, 0, sizeof(cp)); -@@ -1694,7 +1700,7 @@ static int hci_enable_per_advertising_sync(struct hci_dev *hdev, u8 instance) - - /* If periodic advertising already enabled there is nothing to do. */ - adv = hci_find_adv_instance(hdev, instance); -- if (adv && adv->periodic && adv->enabled) -+ if (adv && adv->periodic_enabled) - return 0; - - memset(&cp, 0, sizeof(cp)); -@@ -2645,9 +2651,8 @@ static int hci_resume_advertising_sync(struct hci_dev *hdev) - /* If current advertising instance is set to instance 0x00 - * then we need to re-enable it. - */ -- if (!hdev->cur_adv_instance) -- err = hci_enable_ext_advertising_sync(hdev, -- hdev->cur_adv_instance); -+ if (hci_dev_test_and_clear_flag(hdev, HCI_LE_ADV_0)) -+ err = hci_enable_ext_advertising_sync(hdev, 0x00); - } else { - /* Schedule for most recent instance to be restarted and begin - * the software rotation loop -diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c -index 69529a3049e741..1469e9b69e631c 100644 ---- a/net/bluetooth/iso.c -+++ b/net/bluetooth/iso.c -@@ -1782,7 +1782,13 @@ static void iso_conn_ready(struct iso_conn *conn) - } - - bacpy(&iso_pi(sk)->dst, &hcon->dst); -- iso_pi(sk)->dst_type = hcon->dst_type; -+ -+ /* Convert from HCI to three-value type */ -+ if (hcon->dst_type == ADDR_LE_DEV_PUBLIC) -+ iso_pi(sk)->dst_type = BDADDR_LE_PUBLIC; -+ else -+ iso_pi(sk)->dst_type = BDADDR_LE_RANDOM; -+ - iso_pi(sk)->sync_handle = iso_pi(parent)->sync_handle; - memcpy(iso_pi(sk)->base, iso_pi(parent)->base, iso_pi(parent)->base_len); - iso_pi(sk)->base_len = iso_pi(parent)->base_len; -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index dabc07700197c5..ad46112cb596bf 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -497,6 +497,7 @@ void l2cap_chan_hold(struct l2cap_chan *c) - - kref_get(&c->kref); - } -+EXPORT_SYMBOL_GPL(l2cap_chan_hold); - - struct l2cap_chan *l2cap_chan_hold_unless_zero(struct l2cap_chan *c) - { -diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c -index 54ddbb2635e2ff..7de0a0d752629f 100644 ---- a/net/bluetooth/mgmt.c -+++ b/net/bluetooth/mgmt.c -@@ -5358,9 +5358,9 @@ static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, - for (i = 0; i < pattern_count; i++) { - offset = patterns[i].offset; - length = patterns[i].length; -- if (offset >= HCI_MAX_EXT_AD_LENGTH || -- length > HCI_MAX_EXT_AD_LENGTH || -- (offset + length) > HCI_MAX_EXT_AD_LENGTH) -+ if (offset >= HCI_MAX_AD_LENGTH || -+ length > HCI_MAX_AD_LENGTH || -+ (offset + length) > HCI_MAX_AD_LENGTH) - return MGMT_STATUS_INVALID_PARAMS; - - p = kmalloc(sizeof(*p), GFP_KERNEL); -@@ -9440,6 +9440,7 @@ void mgmt_index_removed(struct hci_dev *hdev) - cancel_delayed_work_sync(&hdev->discov_off); - cancel_delayed_work_sync(&hdev->service_cache); - cancel_delayed_work_sync(&hdev->rpa_expired); -+ cancel_delayed_work_sync(&hdev->mesh_send_done); - } - - void mgmt_power_on(struct hci_dev *hdev, int err) -diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c -index 94ec913dfb76e8..e258ca19147050 100644 ---- a/net/bluetooth/rfcomm/tty.c -+++ b/net/bluetooth/rfcomm/tty.c -@@ -651,8 +651,8 @@ static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig) - tty_port_tty_hangup(&dev->port, true); - - dev->modem_status = -- ((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) | -- ((v24_sig & RFCOMM_V24_RTR) ? (TIOCM_RTS | TIOCM_CTS) : 0) | -+ ((v24_sig & RFCOMM_V24_RTC) ? TIOCM_DSR : 0) | -+ ((v24_sig & RFCOMM_V24_RTR) ? TIOCM_CTS : 0) | - ((v24_sig & RFCOMM_V24_IC) ? TIOCM_RI : 0) | - ((v24_sig & RFCOMM_V24_DV) ? TIOCM_CD : 0); - } -@@ -1063,10 +1063,14 @@ static void rfcomm_tty_hangup(struct tty_struct *tty) - static int rfcomm_tty_tiocmget(struct tty_struct *tty) - { - struct rfcomm_dev *dev = tty->driver_data; -+ struct rfcomm_dlc *dlc = dev->dlc; -+ u8 v24_sig; - - BT_DBG("tty %p dev %p", tty, dev); - -- return dev->modem_status; -+ rfcomm_dlc_get_modem_status(dlc, &v24_sig); -+ -+ return (v24_sig & (TIOCM_DTR | TIOCM_RTS)) | dev->modem_status; - } - - static int rfcomm_tty_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear) -@@ -1079,23 +1083,15 @@ static int rfcomm_tty_tiocmset(struct tty_struct *tty, unsigned int set, unsigne - - rfcomm_dlc_get_modem_status(dlc, &v24_sig); - -- if (set & TIOCM_DSR || set & TIOCM_DTR) -+ if (set & TIOCM_DTR) - v24_sig |= RFCOMM_V24_RTC; -- if (set & TIOCM_RTS || set & TIOCM_CTS) -+ if (set & TIOCM_RTS) - v24_sig |= RFCOMM_V24_RTR; -- if (set & TIOCM_RI) -- v24_sig |= RFCOMM_V24_IC; -- if (set & TIOCM_CD) -- v24_sig |= RFCOMM_V24_DV; - -- if (clear & TIOCM_DSR || clear & TIOCM_DTR) -+ if (clear & TIOCM_DTR) - v24_sig &= ~RFCOMM_V24_RTC; -- if (clear & TIOCM_RTS || clear & TIOCM_CTS) -+ if (clear & TIOCM_RTS) - v24_sig &= ~RFCOMM_V24_RTR; -- if (clear & TIOCM_RI) -- v24_sig &= ~RFCOMM_V24_IC; -- if (clear & TIOCM_CD) -- v24_sig &= ~RFCOMM_V24_DV; - - rfcomm_dlc_set_modem_status(dlc, v24_sig); - -diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c -index 64d4d57c7033a3..6635d155e360be 100644 ---- a/net/bluetooth/sco.c -+++ b/net/bluetooth/sco.c -@@ -433,6 +433,13 @@ static void sco_sock_kill(struct sock *sk) - - BT_DBG("sk %p state %d", sk, sk->sk_state); - -+ /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */ -+ if (sco_pi(sk)->conn) { -+ sco_conn_lock(sco_pi(sk)->conn); -+ sco_pi(sk)->conn->sk = NULL; -+ sco_conn_unlock(sco_pi(sk)->conn); -+ } -+ - /* Kill poor orphan */ - bt_sock_unlink(&sco_sk_list, sk); - sock_set_flag(sk, SOCK_DEAD); -diff --git a/net/bridge/br.c b/net/bridge/br.c -index a45db67197226b..d466febcf9abe8 100644 ---- a/net/bridge/br.c -+++ b/net/bridge/br.c -@@ -37,6 +37,11 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v - int err; - - if (netif_is_bridge_master(dev)) { -+ struct net_bridge *br = netdev_priv(dev); -+ -+ if (event == NETDEV_REGISTER) -+ br_fdb_change_mac_address(br, dev->dev_addr); -+ - err = br_vlan_bridge_event(dev, event, ptr); - if (err) - return notifier_from_errno(err); -diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c -index e19b583ff2c6d0..e9f09cdb9848e8 100644 ---- a/net/bridge/br_forward.c -+++ b/net/bridge/br_forward.c -@@ -25,7 +25,7 @@ static inline int should_deliver(const struct net_bridge_port *p, - - vg = nbp_vlan_group_rcu(p); - return ((p->flags & BR_HAIRPIN_MODE) || skb->dev != p->dev) && -- (br_mst_is_enabled(p->br) || p->state == BR_STATE_FORWARDING) && -+ (br_mst_is_enabled(p) || p->state == BR_STATE_FORWARDING) && - br_allowed_egress(vg, skb) && nbp_switchdev_allowed_egress(p, skb) && - !br_skb_isolated(p, skb); - } -@@ -148,7 +148,8 @@ void br_forward(const struct net_bridge_port *to, - goto out; - - /* redirect to backup link if the destination port is down */ -- if (rcu_access_pointer(to->backup_port) && !netif_carrier_ok(to->dev)) { -+ if (rcu_access_pointer(to->backup_port) && -+ (!netif_carrier_ok(to->dev) || !netif_running(to->dev))) { - struct net_bridge_port *backup_port; - - backup_port = rcu_dereference(to->backup_port); -diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c -index 2450690f98cfa5..6ffc81eedf0748 100644 ---- a/net/bridge/br_if.c -+++ b/net/bridge/br_if.c -@@ -386,6 +386,7 @@ void br_dev_delete(struct net_device *dev, struct list_head *head) - del_nbp(p); - } - -+ br_mst_uninit(br); - br_recalculate_neigh_suppress_enabled(br); - - br_fdb_delete_by_port(br, NULL, 0, 1); -diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c -index e09000e38d071d..951330c1a813b2 100644 ---- a/net/bridge/br_input.c -+++ b/net/bridge/br_input.c -@@ -93,7 +93,7 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb - - br = p->br; - -- if (br_mst_is_enabled(br)) { -+ if (br_mst_is_enabled(p)) { - state = BR_STATE_FORWARDING; - } else { - if (p->state == BR_STATE_DISABLED) -@@ -411,7 +411,7 @@ static rx_handler_result_t br_handle_frame(struct sk_buff **pskb) - return RX_HANDLER_PASS; - - forward: -- if (br_mst_is_enabled(p->br)) -+ if (br_mst_is_enabled(p)) - goto defer_stp_filtering; - - switch (p->state) { -diff --git a/net/bridge/br_mst.c b/net/bridge/br_mst.c -index 3f24b4ee49c274..43a300ae6bfafc 100644 ---- a/net/bridge/br_mst.c -+++ b/net/bridge/br_mst.c -@@ -22,6 +22,12 @@ bool br_mst_enabled(const struct net_device *dev) - } - EXPORT_SYMBOL_GPL(br_mst_enabled); - -+void br_mst_uninit(struct net_bridge *br) -+{ -+ if (br_opt_get(br, BROPT_MST_ENABLED)) -+ static_branch_dec(&br_mst_used); -+} -+ - int br_mst_get_info(const struct net_device *dev, u16 msti, unsigned long *vids) - { - const struct net_bridge_vlan_group *vg; -@@ -225,9 +231,9 @@ int br_mst_set_enabled(struct net_bridge *br, bool on, - return err; - - if (on) -- static_branch_enable(&br_mst_used); -+ static_branch_inc(&br_mst_used); - else -- static_branch_disable(&br_mst_used); -+ static_branch_dec(&br_mst_used); - - br_opt_toggle(br, BROPT_MST_ENABLED, on); - return 0; -diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h -index ef98ec4c3f51d4..c8a4e3b39b0e2e 100644 ---- a/net/bridge/br_private.h -+++ b/net/bridge/br_private.h -@@ -1880,10 +1880,12 @@ static inline bool br_vlan_state_allowed(u8 state, bool learn_allow) - /* br_mst.c */ - #ifdef CONFIG_BRIDGE_VLAN_FILTERING - DECLARE_STATIC_KEY_FALSE(br_mst_used); --static inline bool br_mst_is_enabled(struct net_bridge *br) -+static inline bool br_mst_is_enabled(const struct net_bridge_port *p) - { -+ /* check the port's vlan group to avoid racing with port deletion */ - return static_branch_unlikely(&br_mst_used) && -- br_opt_get(br, BROPT_MST_ENABLED); -+ br_opt_get(p->br, BROPT_MST_ENABLED) && -+ rcu_access_pointer(p->vlgrp); - } - - int br_mst_set_state(struct net_bridge_port *p, u16 msti, u8 state, -@@ -1897,8 +1899,9 @@ int br_mst_fill_info(struct sk_buff *skb, - const struct net_bridge_vlan_group *vg); - int br_mst_process(struct net_bridge_port *p, const struct nlattr *mst_attr, - struct netlink_ext_ack *extack); -+void br_mst_uninit(struct net_bridge *br); - #else --static inline bool br_mst_is_enabled(struct net_bridge *br) -+static inline bool br_mst_is_enabled(const struct net_bridge_port *p) - { - return false; - } -@@ -1932,6 +1935,10 @@ static inline int br_mst_process(struct net_bridge_port *p, - { - return -EOPNOTSUPP; - } -+ -+static inline void br_mst_uninit(struct net_bridge *br) -+{ -+} - #endif - - struct nf_br_ops { -diff --git a/net/core/filter.c b/net/core/filter.c -index c2e888ea54abbf..0564ee6ac87315 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -4203,6 +4203,7 @@ static int bpf_xdp_frags_shrink_tail(struct xdp_buff *xdp, int offset) - - if (unlikely(!sinfo->nr_frags)) { - xdp_buff_clear_frags_flag(xdp); -+ xdp_buff_clear_frag_pfmemalloc(xdp); - xdp->data_end -= offset; - } - -diff --git a/net/core/gro.c b/net/core/gro.c -index 397cf598425034..b8cc44406e69bf 100644 ---- a/net/core/gro.c -+++ b/net/core/gro.c -@@ -6,9 +6,6 @@ - - #define MAX_GRO_SKBS 8 - --/* This should be increased if a protocol with a bigger head is added. */ --#define GRO_MAX_HEAD (MAX_HEADER + 128) -- - static DEFINE_SPINLOCK(offload_lock); - struct list_head offload_base __read_mostly = LIST_HEAD_INIT(offload_base); - /* Maximum number of GRO_NORMAL skbs to batch up for list-RX */ -diff --git a/net/core/netpoll.c b/net/core/netpoll.c -index 2bdb1e84c6c8a8..a78340bb25ba6b 100644 ---- a/net/core/netpoll.c -+++ b/net/core/netpoll.c -@@ -45,11 +45,6 @@ - - #define MAX_UDP_CHUNK 1460 - #define MAX_SKBS 32 -- --static struct sk_buff_head skb_pool; -- --DEFINE_STATIC_SRCU(netpoll_srcu); -- - #define USEC_PER_POLL 50 - - #define MAX_SKB_SIZE \ -@@ -220,41 +215,41 @@ EXPORT_SYMBOL(netpoll_poll_dev); - void netpoll_poll_disable(struct net_device *dev) - { - struct netpoll_info *ni; -- int idx; -+ - might_sleep(); -- idx = srcu_read_lock(&netpoll_srcu); -- ni = srcu_dereference(dev->npinfo, &netpoll_srcu); -+ ni = rtnl_dereference(dev->npinfo); - if (ni) - down(&ni->dev_lock); -- srcu_read_unlock(&netpoll_srcu, idx); - } - EXPORT_SYMBOL(netpoll_poll_disable); - - void netpoll_poll_enable(struct net_device *dev) - { - struct netpoll_info *ni; -- rcu_read_lock(); -- ni = rcu_dereference(dev->npinfo); -+ -+ ni = rtnl_dereference(dev->npinfo); - if (ni) - up(&ni->dev_lock); -- rcu_read_unlock(); - } - EXPORT_SYMBOL(netpoll_poll_enable); - --static void refill_skbs(void) -+static void refill_skbs(struct netpoll *np) - { -+ struct sk_buff_head *skb_pool; - struct sk_buff *skb; - unsigned long flags; - -- spin_lock_irqsave(&skb_pool.lock, flags); -- while (skb_pool.qlen < MAX_SKBS) { -+ skb_pool = &np->skb_pool; -+ -+ spin_lock_irqsave(&skb_pool->lock, flags); -+ while (skb_pool->qlen < MAX_SKBS) { - skb = alloc_skb(MAX_SKB_SIZE, GFP_ATOMIC); - if (!skb) - break; - -- __skb_queue_tail(&skb_pool, skb); -+ __skb_queue_tail(skb_pool, skb); - } -- spin_unlock_irqrestore(&skb_pool.lock, flags); -+ spin_unlock_irqrestore(&skb_pool->lock, flags); - } - - static void zap_completion_queue(void) -@@ -291,12 +286,12 @@ static struct sk_buff *find_skb(struct netpoll *np, int len, int reserve) - struct sk_buff *skb; - - zap_completion_queue(); -- refill_skbs(); -+ refill_skbs(np); - repeat: - - skb = alloc_skb(len, GFP_ATOMIC); - if (!skb) -- skb = skb_dequeue(&skb_pool); -+ skb = skb_dequeue(&np->skb_pool); - - if (!skb) { - if (++count < 10) { -@@ -543,6 +538,14 @@ static int netpoll_parse_ip_addr(const char *str, union inet_addr *addr) - return -1; - } - -+static void skb_pool_flush(struct netpoll *np) -+{ -+ struct sk_buff_head *skb_pool; -+ -+ skb_pool = &np->skb_pool; -+ skb_queue_purge_reason(skb_pool, SKB_CONSUMED); -+} -+ - int netpoll_parse_options(struct netpoll *np, char *opt) - { - char *cur=opt, *delim; -@@ -631,6 +634,8 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev) - const struct net_device_ops *ops; - int err; - -+ skb_queue_head_init(&np->skb_pool); -+ - if (ndev->priv_flags & IFF_DISABLE_NETPOLL) { - np_err(np, "%s doesn't support polling, aborting\n", - ndev->name); -@@ -666,6 +671,9 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev) - strscpy(np->dev_name, ndev->name, IFNAMSIZ); - npinfo->netpoll = np; - -+ /* fill up the skb queue */ -+ refill_skbs(np); -+ - /* last thing to do is link it to the net device structure */ - rcu_assign_pointer(ndev->npinfo, npinfo); - -@@ -784,12 +792,9 @@ int netpoll_setup(struct netpoll *np) - } - } - -- /* fill up the skb queue */ -- refill_skbs(); -- - err = __netpoll_setup(np, ndev); - if (err) -- goto put; -+ goto flush; - rtnl_unlock(); - - /* Make sure all NAPI polls which started before dev->npinfo -@@ -800,6 +805,8 @@ int netpoll_setup(struct netpoll *np) - - return 0; - -+flush: -+ skb_pool_flush(np); - put: - DEBUG_NET_WARN_ON_ONCE(np->dev); - if (ip_overwritten) -@@ -811,13 +818,6 @@ int netpoll_setup(struct netpoll *np) - } - EXPORT_SYMBOL(netpoll_setup); - --static int __init netpoll_init(void) --{ -- skb_queue_head_init(&skb_pool); -- return 0; --} --core_initcall(netpoll_init); -- - static void rcu_cleanup_netpoll_info(struct rcu_head *rcu_head) - { - struct netpoll_info *npinfo = -@@ -843,8 +843,10 @@ void __netpoll_cleanup(struct netpoll *np) - if (!npinfo) - return; - -- synchronize_srcu(&netpoll_srcu); -- -+ /* At this point, there is a single npinfo instance per netdevice, and -+ * its refcnt tracks how many netpoll structures are linked to it. We -+ * only perform npinfo cleanup when the refcnt decrements to zero. -+ */ - if (refcount_dec_and_test(&npinfo->refcnt)) { - const struct net_device_ops *ops; - -@@ -854,8 +856,9 @@ void __netpoll_cleanup(struct netpoll *np) - - RCU_INIT_POINTER(np->dev->npinfo, NULL); - call_rcu(&npinfo->rcu, rcu_cleanup_netpoll_info); -- } else -- RCU_INIT_POINTER(np->dev->npinfo, NULL); -+ } -+ -+ skb_pool_flush(np); - } - EXPORT_SYMBOL_GPL(__netpoll_cleanup); - -diff --git a/net/core/page_pool.c b/net/core/page_pool.c -index 2f2f63c8cf4b07..0188d7f007857e 100644 ---- a/net/core/page_pool.c -+++ b/net/core/page_pool.c -@@ -180,11 +180,7 @@ static int page_pool_init(struct page_pool *pool, - return -EINVAL; - - if (pool->p.pool_size) -- ring_qsize = pool->p.pool_size; -- -- /* Sanity limit mem that can be pinned down */ -- if (ring_qsize > 32768) -- return -E2BIG; -+ ring_qsize = min(pool->p.pool_size, 16384); - - /* DMA direction is either DMA_FROM_DEVICE or DMA_BIDIRECTIONAL. - * DMA_BIDIRECTIONAL is for allowing page used for DMA sending, -@@ -422,6 +418,12 @@ static struct page *__page_pool_alloc_pages_slow(struct page_pool *pool, - struct page *page; - int i, nr_pages; - -+ /* Unconditionally set NOWARN if allocating from NAPI. -+ * Drivers forget to set it, and OOM reports on packet Rx are useless. -+ */ -+ if ((gfp & GFP_ATOMIC) == GFP_ATOMIC) -+ gfp |= __GFP_NOWARN; -+ - /* Don't support bulk alloc for high-order pages */ - if (unlikely(pp_order)) - return __page_pool_alloc_page_order(pool, gfp); -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 867832f8bbaea9..073e2c52740796 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -67,6 +67,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -96,7 +97,9 @@ static struct kmem_cache *skbuff_ext_cache __ro_after_init; - - static struct kmem_cache *skb_small_head_cache __ro_after_init; - --#define SKB_SMALL_HEAD_SIZE SKB_HEAD_ALIGN(MAX_TCP_HEADER) -+#define GRO_MAX_HEAD_PAD (GRO_MAX_HEAD + NET_SKB_PAD + NET_IP_ALIGN) -+#define SKB_SMALL_HEAD_SIZE SKB_HEAD_ALIGN(max(MAX_TCP_HEADER, \ -+ GRO_MAX_HEAD_PAD)) - - /* We want SKB_SMALL_HEAD_CACHE_SIZE to not be a power of two. - * This should ensure that SKB_SMALL_HEAD_HEADROOM is a unique -@@ -708,7 +711,7 @@ struct sk_buff *__netdev_alloc_skb(struct net_device *dev, unsigned int len, - /* If requested length is either too small or too big, - * we use kmalloc() for skb->head allocation. - */ -- if (len <= SKB_WITH_OVERHEAD(1024) || -+ if (len <= SKB_WITH_OVERHEAD(SKB_SMALL_HEAD_CACHE_SIZE) || - len > SKB_WITH_OVERHEAD(PAGE_SIZE) || - (gfp_mask & (__GFP_DIRECT_RECLAIM | GFP_DMA))) { - skb = __alloc_skb(len, gfp_mask, SKB_ALLOC_RX, NUMA_NO_NODE); -@@ -785,7 +788,8 @@ struct sk_buff *__napi_alloc_skb(struct napi_struct *napi, unsigned int len, - * When the small frag allocator is available, prefer it over kmalloc - * for small fragments - */ -- if ((!NAPI_HAS_SMALL_PAGE_FRAG && len <= SKB_WITH_OVERHEAD(1024)) || -+ if ((!NAPI_HAS_SMALL_PAGE_FRAG && -+ len <= SKB_WITH_OVERHEAD(SKB_SMALL_HEAD_CACHE_SIZE)) || - len > SKB_WITH_OVERHEAD(PAGE_SIZE) || - (gfp_mask & (__GFP_DIRECT_RECLAIM | GFP_DMA))) { - skb = __alloc_skb(len, gfp_mask, SKB_ALLOC_RX | SKB_ALLOC_NAPI, -diff --git a/net/core/sock.c b/net/core/sock.c -index 9918a9a337b616..91f101231309d4 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -2996,23 +2996,27 @@ void __release_sock(struct sock *sk) - __acquires(&sk->sk_lock.slock) - { - struct sk_buff *skb, *next; -+ int nb = 0; - - while ((skb = sk->sk_backlog.head) != NULL) { - sk->sk_backlog.head = sk->sk_backlog.tail = NULL; - - spin_unlock_bh(&sk->sk_lock.slock); - -- do { -+ while (1) { - next = skb->next; - prefetch(next); - DEBUG_NET_WARN_ON_ONCE(skb_dst_is_noref(skb)); - skb_mark_not_on_list(skb); - sk_backlog_rcv(sk, skb); - -- cond_resched(); -- - skb = next; -- } while (skb != NULL); -+ if (!skb) -+ break; -+ -+ if (!(++nb & 15)) -+ cond_resched(); -+ } - - spin_lock_bh(&sk->sk_lock.slock); - } -@@ -3141,8 +3145,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind) - } - } - -- if (kind == SK_MEM_SEND || (kind == SK_MEM_RECV && charged)) -- trace_sock_exceed_buf_limit(sk, prot, allocated, kind); -+ trace_sock_exceed_buf_limit(sk, prot, allocated, kind); - - sk_memory_allocated_sub(sk, amt); - -diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c -index 07736edc8b6a5d..c9bf1a9a6c99b9 100644 ---- a/net/dsa/dsa.c -+++ b/net/dsa/dsa.c -@@ -1613,6 +1613,7 @@ EXPORT_SYMBOL_GPL(dsa_unregister_switch); - void dsa_switch_shutdown(struct dsa_switch *ds) - { - struct net_device *master, *slave_dev; -+ LIST_HEAD(close_list); - struct dsa_port *dp; - - mutex_lock(&dsa2_mutex); -@@ -1622,10 +1623,16 @@ void dsa_switch_shutdown(struct dsa_switch *ds) - - rtnl_lock(); - -+ dsa_switch_for_each_cpu_port(dp, ds) -+ list_add(&dp->master->close_list, &close_list); -+ -+ dev_close_many(&close_list, true); -+ - dsa_switch_for_each_user_port(dp, ds) { - master = dsa_port_to_master(dp); - slave_dev = dp->slave; - -+ netif_device_detach(slave_dev); - netdev_upper_dev_unlink(master, slave_dev); - } - -diff --git a/net/dsa/tag_brcm.c b/net/dsa/tag_brcm.c -index 146c1dbd15a93f..385581cf3b7ba0 100644 ---- a/net/dsa/tag_brcm.c -+++ b/net/dsa/tag_brcm.c -@@ -255,12 +255,14 @@ static struct sk_buff *brcm_leg_tag_rcv(struct sk_buff *skb, - { - int len = BRCM_LEG_TAG_LEN; - int source_port; -+ __be16 *proto; - u8 *brcm_tag; - - if (unlikely(!pskb_may_pull(skb, BRCM_LEG_TAG_LEN + VLAN_HLEN))) - return NULL; - - brcm_tag = dsa_etype_header_pos_rx(skb); -+ proto = (__be16 *)(brcm_tag + BRCM_LEG_TAG_LEN); - - source_port = brcm_tag[5] & BRCM_LEG_PORT_ID; - -@@ -268,8 +270,12 @@ static struct sk_buff *brcm_leg_tag_rcv(struct sk_buff *skb, - if (!skb->dev) - return NULL; - -- /* VLAN tag is added by BCM63xx internal switch */ -- if (netdev_uses_dsa(skb->dev)) -+ /* The internal switch in BCM63XX SoCs always tags on egress on the CPU -+ * port. We use VID 0 internally for untagged traffic, so strip the tag -+ * if the TCI field is all 0, and keep it otherwise to also retain -+ * e.g. 802.1p tagged packets. -+ */ -+ if (proto[0] == htons(ETH_P_8021Q) && proto[1] == 0) - len += VLAN_HLEN; - - /* Remove Broadcom tag and update checksum */ -diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c -index 049c3adeb85044..b4a6e26ec2871b 100644 ---- a/net/ethernet/eth.c -+++ b/net/ethernet/eth.c -@@ -615,7 +615,10 @@ EXPORT_SYMBOL(fwnode_get_mac_address); - */ - int device_get_mac_address(struct device *dev, char *addr) - { -- return fwnode_get_mac_address(dev_fwnode(dev), addr); -+ if (!fwnode_get_mac_address(dev_fwnode(dev), addr)) -+ return 0; -+ -+ return nvmem_get_mac_address(dev, addr); - } - EXPORT_SYMBOL(device_get_mac_address); - -diff --git a/net/handshake/tlshd.c b/net/handshake/tlshd.c -index bbfb4095ddd6b4..06916a80cc1309 100644 ---- a/net/handshake/tlshd.c -+++ b/net/handshake/tlshd.c -@@ -254,6 +254,7 @@ static int tls_handshake_accept(struct handshake_req *req, - - out_cancel: - genlmsg_cancel(msg, hdr); -+ nlmsg_free(msg); - out: - return ret; - } -diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c -index 5514b5bedc9298..70e958caa956d7 100644 ---- a/net/hsr/hsr_device.c -+++ b/net/hsr/hsr_device.c -@@ -313,6 +313,9 @@ static void send_hsr_supervision_frame(struct hsr_port *master, - } - - hsr_stag = skb_put(skb, sizeof(struct hsr_sup_tag)); -+ skb_set_network_header(skb, ETH_HLEN + HSR_HLEN); -+ skb_reset_mac_len(skb); -+ - set_hsr_stag_path(hsr_stag, (hsr->prot_version ? 0x0 : 0xf)); - set_hsr_stag_HSR_ver(hsr_stag, hsr->prot_version); - -diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c -index 49fd664f50fc01..2caf6a2a819b21 100644 ---- a/net/ipv4/esp4.c -+++ b/net/ipv4/esp4.c -@@ -152,8 +152,10 @@ static int esp_output_tcp_finish(struct xfrm_state *x, struct sk_buff *skb) - - sk = esp_find_tcp_sk(x); - err = PTR_ERR_OR_ZERO(sk); -- if (err) -+ if (err) { -+ kfree_skb(skb); - goto out; -+ } - - bh_lock_sock(sk); - if (sock_owned_by_user(sk)) -diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c -index 2d663fe50f876c..2064b401304129 100644 ---- a/net/ipv4/netfilter/nf_reject_ipv4.c -+++ b/net/ipv4/netfilter/nf_reject_ipv4.c -@@ -71,6 +71,27 @@ struct sk_buff *nf_reject_skb_v4_tcp_reset(struct net *net, - } - EXPORT_SYMBOL_GPL(nf_reject_skb_v4_tcp_reset); - -+static bool nf_skb_is_icmp_unreach(const struct sk_buff *skb) -+{ -+ const struct iphdr *iph = ip_hdr(skb); -+ u8 *tp, _type; -+ int thoff; -+ -+ if (iph->protocol != IPPROTO_ICMP) -+ return false; -+ -+ thoff = skb_network_offset(skb) + sizeof(*iph); -+ -+ tp = skb_header_pointer(skb, -+ thoff + offsetof(struct icmphdr, type), -+ sizeof(_type), &_type); -+ -+ if (!tp) -+ return false; -+ -+ return *tp == ICMP_DEST_UNREACH; -+} -+ - struct sk_buff *nf_reject_skb_v4_unreach(struct net *net, - struct sk_buff *oldskb, - const struct net_device *dev, -@@ -91,6 +112,10 @@ struct sk_buff *nf_reject_skb_v4_unreach(struct net *net, - if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET)) - return NULL; - -+ /* don't reply to ICMP_DEST_UNREACH with ICMP_DEST_UNREACH. */ -+ if (nf_skb_is_icmp_unreach(oldskb)) -+ return NULL; -+ - /* RFC says return as much as we can without exceeding 576 bytes. */ - len = min_t(unsigned int, 536, oldskb->len); - -diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c -index fab550633ec9f3..99385fe34a1e57 100644 ---- a/net/ipv4/nexthop.c -+++ b/net/ipv4/nexthop.c -@@ -1835,6 +1835,12 @@ static void remove_nexthop_from_groups(struct net *net, struct nexthop *nh, - { - struct nh_grp_entry *nhge, *tmp; - -+ /* If there is nothing to do, let's avoid the costly call to -+ * synchronize_net() -+ */ -+ if (list_empty(&nh->grp_list)) -+ return; -+ - list_for_each_entry_safe(nhge, tmp, &nh->grp_list, nh_list) - remove_nh_grp_entry(net, nhge, nlinfo); - -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 20f5c8307443d3..fcabacec89c73e 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -617,6 +617,11 @@ static void fnhe_remove_oldest(struct fnhe_hash_bucket *hash) - oldest_p = fnhe_p; - } - } -+ -+ /* Clear oldest->fnhe_daddr to prevent this fnhe from being -+ * rebound with new dsts in rt_bind_exception(). -+ */ -+ oldest->fnhe_daddr = 0; - fnhe_flush_routes(oldest); - *oldest_p = oldest->fnhe_next; - kfree_rcu(oldest, rcu); -diff --git a/net/ipv4/udp_tunnel_nic.c b/net/ipv4/udp_tunnel_nic.c -index 02921974978501..a08b0b6e0727c9 100644 ---- a/net/ipv4/udp_tunnel_nic.c -+++ b/net/ipv4/udp_tunnel_nic.c -@@ -899,7 +899,7 @@ udp_tunnel_nic_netdevice_event(struct notifier_block *unused, - - err = udp_tunnel_nic_register(dev); - if (err) -- netdev_WARN(dev, "failed to register for UDP tunnel offloads: %d", err); -+ netdev_warn(dev, "failed to register for UDP tunnel offloads: %d", err); - return notifier_from_errno(err); - } - /* All other events will need the udp_tunnel_nic state */ -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 1c3b0ba289fbd4..0e49ee83533b51 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -7102,7 +7102,9 @@ static const struct ctl_table addrconf_sysctl[] = { - .data = &ipv6_devconf.rpl_seg_enabled, - .maxlen = sizeof(int), - .mode = 0644, -- .proc_handler = proc_dointvec, -+ .proc_handler = proc_dointvec_minmax, -+ .extra1 = SYSCTL_ZERO, -+ .extra2 = SYSCTL_ONE, - }, - { - .procname = "ioam6_enabled", -diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c -index 01005035ad1018..5361e2107458f5 100644 ---- a/net/ipv6/ah6.c -+++ b/net/ipv6/ah6.c -@@ -46,6 +46,34 @@ struct ah_skb_cb { - - #define AH_SKB_CB(__skb) ((struct ah_skb_cb *)&((__skb)->cb[0])) - -+/* Helper to save IPv6 addresses and extension headers to temporary storage */ -+static inline void ah6_save_hdrs(struct tmp_ext *iph_ext, -+ struct ipv6hdr *top_iph, int extlen) -+{ -+ if (!extlen) -+ return; -+ -+#if IS_ENABLED(CONFIG_IPV6_MIP6) -+ iph_ext->saddr = top_iph->saddr; -+#endif -+ iph_ext->daddr = top_iph->daddr; -+ memcpy(&iph_ext->hdrs, top_iph + 1, extlen - sizeof(*iph_ext)); -+} -+ -+/* Helper to restore IPv6 addresses and extension headers from temporary storage */ -+static inline void ah6_restore_hdrs(struct ipv6hdr *top_iph, -+ struct tmp_ext *iph_ext, int extlen) -+{ -+ if (!extlen) -+ return; -+ -+#if IS_ENABLED(CONFIG_IPV6_MIP6) -+ top_iph->saddr = iph_ext->saddr; -+#endif -+ top_iph->daddr = iph_ext->daddr; -+ memcpy(top_iph + 1, &iph_ext->hdrs, extlen - sizeof(*iph_ext)); -+} -+ - static void *ah_alloc_tmp(struct crypto_ahash *ahash, int nfrags, - unsigned int size) - { -@@ -304,13 +332,7 @@ static void ah6_output_done(void *data, int err) - memcpy(ah->auth_data, icv, ahp->icv_trunc_len); - memcpy(top_iph, iph_base, IPV6HDR_BASELEN); - -- if (extlen) { --#if IS_ENABLED(CONFIG_IPV6_MIP6) -- memcpy(&top_iph->saddr, iph_ext, extlen); --#else -- memcpy(&top_iph->daddr, iph_ext, extlen); --#endif -- } -+ ah6_restore_hdrs(top_iph, iph_ext, extlen); - - kfree(AH_SKB_CB(skb)->tmp); - xfrm_output_resume(skb->sk, skb, err); -@@ -381,12 +403,8 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb) - */ - memcpy(iph_base, top_iph, IPV6HDR_BASELEN); - -+ ah6_save_hdrs(iph_ext, top_iph, extlen); - if (extlen) { --#if IS_ENABLED(CONFIG_IPV6_MIP6) -- memcpy(iph_ext, &top_iph->saddr, extlen); --#else -- memcpy(iph_ext, &top_iph->daddr, extlen); --#endif - err = ipv6_clear_mutable_options(top_iph, - extlen - sizeof(*iph_ext) + - sizeof(*top_iph), -@@ -437,13 +455,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb) - memcpy(ah->auth_data, icv, ahp->icv_trunc_len); - memcpy(top_iph, iph_base, IPV6HDR_BASELEN); - -- if (extlen) { --#if IS_ENABLED(CONFIG_IPV6_MIP6) -- memcpy(&top_iph->saddr, iph_ext, extlen); --#else -- memcpy(&top_iph->daddr, iph_ext, extlen); --#endif -- } -+ ah6_restore_hdrs(top_iph, iph_ext, extlen); - - out_free: - kfree(iph_base); -diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c -index 7e4c8628cf9835..2caaab61b9967c 100644 ---- a/net/ipv6/esp6.c -+++ b/net/ipv6/esp6.c -@@ -169,8 +169,10 @@ static int esp_output_tcp_finish(struct xfrm_state *x, struct sk_buff *skb) - - sk = esp6_find_tcp_sk(x); - err = PTR_ERR_OR_ZERO(sk); -- if (err) -+ if (err) { -+ kfree_skb(skb); - goto out; -+ } - - bh_lock_sock(sk); - if (sock_owned_by_user(sk)) -diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c -index f3579bccf0a516..a19ca1907de360 100644 ---- a/net/ipv6/netfilter/nf_reject_ipv6.c -+++ b/net/ipv6/netfilter/nf_reject_ipv6.c -@@ -91,6 +91,32 @@ struct sk_buff *nf_reject_skb_v6_tcp_reset(struct net *net, - } - EXPORT_SYMBOL_GPL(nf_reject_skb_v6_tcp_reset); - -+static bool nf_skb_is_icmp6_unreach(const struct sk_buff *skb) -+{ -+ const struct ipv6hdr *ip6h = ipv6_hdr(skb); -+ u8 proto = ip6h->nexthdr; -+ u8 _type, *tp; -+ int thoff; -+ __be16 fo; -+ -+ thoff = ipv6_skip_exthdr(skb, ((u8 *)(ip6h + 1) - skb->data), &proto, &fo); -+ -+ if (thoff < 0 || thoff >= skb->len || fo != 0) -+ return false; -+ -+ if (proto != IPPROTO_ICMPV6) -+ return false; -+ -+ tp = skb_header_pointer(skb, -+ thoff + offsetof(struct icmp6hdr, icmp6_type), -+ sizeof(_type), &_type); -+ -+ if (!tp) -+ return false; -+ -+ return *tp == ICMPV6_DEST_UNREACH; -+} -+ - struct sk_buff *nf_reject_skb_v6_unreach(struct net *net, - struct sk_buff *oldskb, - const struct net_device *dev, -@@ -104,6 +130,10 @@ struct sk_buff *nf_reject_skb_v6_unreach(struct net *net, - if (!nf_reject_ip6hdr_validate(oldskb)) - return NULL; - -+ /* Don't reply to ICMPV6_DEST_UNREACH with ICMPV6_DEST_UNREACH */ -+ if (nf_skb_is_icmp6_unreach(oldskb)) -+ return NULL; -+ - /* Include "As much of invoking packet as possible without the ICMPv6 - * packet exceeding the minimum IPv6 MTU" in the ICMP payload. - */ -diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c -index 4f526606bc8943..7d72633ea01982 100644 ---- a/net/ipv6/raw.c -+++ b/net/ipv6/raw.c -@@ -438,7 +438,7 @@ static int rawv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, - if (flags & MSG_ERRQUEUE) - return ipv6_recv_error(sk, msg, len, addr_len); - -- if (np->rxpmtu && np->rxopt.bits.rxpmtu) -+ if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu)) - return ipv6_recv_rxpmtu(sk, msg, len, addr_len); - - skb = skb_recv_datagram(sk, flags, &err); -diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c -index 9ff8e723402ba8..6df2459f25618e 100644 ---- a/net/ipv6/udp.c -+++ b/net/ipv6/udp.c -@@ -347,7 +347,7 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, - if (flags & MSG_ERRQUEUE) - return ipv6_recv_error(sk, msg, len, addr_len); - -- if (np->rxpmtu && np->rxopt.bits.rxpmtu) -+ if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu)) - return ipv6_recv_rxpmtu(sk, msg, len, addr_len); - - try_again: -diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c -index eaa4e5c6a5c3ac..a531fb2b14deea 100644 ---- a/net/mac80211/iface.c -+++ b/net/mac80211/iface.c -@@ -216,6 +216,10 @@ static int ieee80211_can_powered_addr_change(struct ieee80211_sub_if_data *sdata - - mutex_lock(&local->mtx); - -+ /* if any stations are set known (so they know this vif too), reject */ -+ if (sta_info_get_by_idx(sdata, 0)) -+ return -EBUSY; -+ - /* First check no ROC work is happening on this iface */ - list_for_each_entry(roc, &local->roc_list, list) { - if (roc->sdata != sdata) -@@ -235,12 +239,16 @@ static int ieee80211_can_powered_addr_change(struct ieee80211_sub_if_data *sdata - ret = -EBUSY; - } - -+ /* -+ * More interface types could be added here but changing the -+ * address while powered makes the most sense in client modes. -+ */ - switch (sdata->vif.type) { - case NL80211_IFTYPE_STATION: - case NL80211_IFTYPE_P2P_CLIENT: -- /* More interface types could be added here but changing the -- * address while powered makes the most sense in client modes. -- */ -+ /* refuse while connecting */ -+ if (sdata->u.mgd.auth_data || sdata->u.mgd.assoc_data) -+ return -EBUSY; - break; - default: - ret = -EOPNOTSUPP; -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index 295c2fdbd3c742..aa7cee830b0045 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -4507,7 +4507,7 @@ static u8 ieee80211_max_rx_chains(struct ieee80211_link_data *link, - he_cap_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, - ies->data, ies->len); - -- if (!he_cap_elem || he_cap_elem->datalen < sizeof(*he_cap)) -+ if (!he_cap_elem || he_cap_elem->datalen < sizeof(*he_cap) + 1) - return chains; - - /* skip one byte ext_tag_id */ -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index 164c6e80498265..e6a0a65d4d43ab 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -5341,10 +5341,14 @@ void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta, - if (WARN_ON(!local->started)) - goto drop; - -- if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) { -+ if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC) && -+ !(status->flag & RX_FLAG_NO_PSDU && -+ status->zero_length_psdu_type == -+ IEEE80211_RADIOTAP_ZERO_LEN_PSDU_NOT_CAPTURED))) { - /* -- * Validate the rate, unless a PLCP error means that -- * we probably can't have a valid rate here anyway. -+ * Validate the rate, unless there was a PLCP error which may -+ * have an invalid rate or the PSDU was not capture and may be -+ * missing rate information. - */ - - switch (status->encoding) { -diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c -index 643d64bdef2ea7..6b4b0c40570cef 100644 ---- a/net/mptcp/protocol.c -+++ b/net/mptcp/protocol.c -@@ -1044,7 +1044,7 @@ static void __mptcp_clean_una(struct sock *sk) - if (WARN_ON_ONCE(!msk->recovery)) - break; - -- WRITE_ONCE(msk->first_pending, mptcp_send_next(sk)); -+ msk->first_pending = mptcp_send_next(sk); - } - - dfrag_clear(sk, dfrag); -@@ -1335,7 +1335,12 @@ static int mptcp_sendmsg_frag(struct sock *sk, struct sock *ssk, - if (copy == 0) { - u64 snd_una = READ_ONCE(msk->snd_una); - -- if (snd_una != msk->snd_nxt || tcp_write_queue_tail(ssk)) { -+ /* No need for zero probe if there are any data pending -+ * either at the msk or ssk level; skb is the current write -+ * queue tail and can be empty at this point. -+ */ -+ if (snd_una != msk->snd_nxt || skb->len || -+ skb != tcp_send_head(ssk)) { - tcp_remove_empty_skb(ssk); - return 0; - } -@@ -1588,7 +1593,7 @@ static int __subflow_push_pending(struct sock *sk, struct sock *ssk, - - mptcp_update_post_push(msk, dfrag, ret); - } -- WRITE_ONCE(msk->first_pending, mptcp_send_next(sk)); -+ msk->first_pending = mptcp_send_next(sk); - - if (msk->snd_burst <= 0 || - !sk_stream_memory_free(ssk) || -@@ -1900,7 +1905,7 @@ static int mptcp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) - get_page(dfrag->page); - list_add_tail(&dfrag->list, &msk->rtx_queue); - if (!msk->first_pending) -- WRITE_ONCE(msk->first_pending, dfrag); -+ msk->first_pending = dfrag; - } - pr_debug("msk=%p dfrag at seq=%llu len=%u sent=%u new=%d\n", msk, - dfrag->data_seq, dfrag->data_len, dfrag->already_sent, -@@ -1935,19 +1940,35 @@ static void mptcp_rcv_space_adjust(struct mptcp_sock *msk, int copied); - - static int __mptcp_recvmsg_mskq(struct mptcp_sock *msk, - struct msghdr *msg, -- size_t len, int flags, -+ size_t len, int flags, int copied_total, - struct scm_timestamping_internal *tss, - int *cmsg_flags) - { - struct sk_buff *skb, *tmp; -+ int total_data_len = 0; - int copied = 0; - - skb_queue_walk_safe(&msk->receive_queue, skb, tmp) { -- u32 offset = MPTCP_SKB_CB(skb)->offset; -+ u32 delta, offset = MPTCP_SKB_CB(skb)->offset; - u32 data_len = skb->len - offset; -- u32 count = min_t(size_t, len - copied, data_len); -+ u32 count; - int err; - -+ if (flags & MSG_PEEK) { -+ /* skip already peeked skbs */ -+ if (total_data_len + data_len <= copied_total) { -+ total_data_len += data_len; -+ continue; -+ } -+ -+ /* skip the already peeked data in the current skb */ -+ delta = copied_total - total_data_len; -+ offset += delta; -+ data_len -= delta; -+ } -+ -+ count = min_t(size_t, len - copied, data_len); -+ - if (!(flags & MSG_TRUNC)) { - err = skb_copy_datagram_msg(skb, offset, msg, count); - if (unlikely(err < 0)) { -@@ -1964,22 +1985,19 @@ static int __mptcp_recvmsg_mskq(struct mptcp_sock *msk, - - copied += count; - -- if (count < data_len) { -- if (!(flags & MSG_PEEK)) { -+ if (!(flags & MSG_PEEK)) { -+ msk->bytes_consumed += count; -+ if (count < data_len) { - MPTCP_SKB_CB(skb)->offset += count; - MPTCP_SKB_CB(skb)->map_seq += count; -- msk->bytes_consumed += count; -+ break; - } -- break; -- } - -- if (!(flags & MSG_PEEK)) { - /* we will bulk release the skb memory later */ - skb->destructor = NULL; - WRITE_ONCE(msk->rmem_released, msk->rmem_released + skb->truesize); - __skb_unlink(skb, &msk->receive_queue); - __kfree_skb(skb); -- msk->bytes_consumed += count; - } - - if (copied >= len) -@@ -2203,7 +2221,8 @@ static int mptcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, - while (copied < len) { - int err, bytes_read; - -- bytes_read = __mptcp_recvmsg_mskq(msk, msg, len - copied, flags, &tss, &cmsg_flags); -+ bytes_read = __mptcp_recvmsg_mskq(msk, msg, len - copied, flags, -+ copied, &tss, &cmsg_flags); - if (unlikely(bytes_read < 0)) { - if (!copied) - copied = bytes_read; -@@ -2899,7 +2918,7 @@ static void __mptcp_clear_xmit(struct sock *sk) - struct mptcp_sock *msk = mptcp_sk(sk); - struct mptcp_data_frag *dtmp, *dfrag; - -- WRITE_ONCE(msk->first_pending, NULL); -+ msk->first_pending = NULL; - list_for_each_entry_safe(dfrag, dtmp, &msk->rtx_queue, list) - dfrag_clear(sk, dfrag); - } -@@ -3456,9 +3475,6 @@ void __mptcp_data_acked(struct sock *sk) - - void __mptcp_check_push(struct sock *sk, struct sock *ssk) - { -- if (!mptcp_send_head(sk)) -- return; -- - if (!sock_owned_by_user(sk)) - __mptcp_subflow_push_pending(sk, ssk, false); - else -diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h -index 1f213706dfaa52..dc98f588c8a829 100644 ---- a/net/mptcp/protocol.h -+++ b/net/mptcp/protocol.h -@@ -379,7 +379,7 @@ static inline struct mptcp_data_frag *mptcp_send_head(const struct sock *sk) - { - const struct mptcp_sock *msk = mptcp_sk(sk); - -- return READ_ONCE(msk->first_pending); -+ return msk->first_pending; - } - - static inline struct mptcp_data_frag *mptcp_send_next(struct sock *sk) -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 5ca1d775e976d4..80443b4eaeff0e 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -2576,6 +2576,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, - struct nft_chain *chain = ctx->chain; - struct nft_chain_hook hook = {}; - struct nft_stats *stats = NULL; -+ struct nftables_pernet *nft_net; - struct nft_hook *h, *next; - struct nf_hook_ops *ops; - struct nft_trans *trans; -@@ -2616,6 +2617,20 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, - if (nft_hook_list_find(&basechain->hook_list, h)) { - list_del(&h->list); - kfree(h); -+ continue; -+ } -+ -+ nft_net = nft_pernet(ctx->net); -+ list_for_each_entry(trans, &nft_net->commit_list, list) { -+ if (trans->msg_type != NFT_MSG_NEWCHAIN || -+ trans->ctx.table != ctx->table || -+ !nft_trans_chain_update(trans)) -+ continue; -+ -+ if (nft_hook_list_find(&nft_trans_chain_hooks(trans), h)) { -+ nft_chain_release_hook(&hook); -+ return -EEXIST; -+ } - } - } - } else { -@@ -8493,6 +8508,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, - { - const struct nlattr * const *nla = ctx->nla; - struct nft_flowtable_hook flowtable_hook; -+ struct nftables_pernet *nft_net; - struct nft_hook *hook, *next; - struct nft_trans *trans; - bool unregister = false; -@@ -8508,6 +8524,20 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, - if (nft_hook_list_find(&flowtable->hook_list, hook)) { - list_del(&hook->list); - kfree(hook); -+ continue; -+ } -+ -+ nft_net = nft_pernet(ctx->net); -+ list_for_each_entry(trans, &nft_net->commit_list, list) { -+ if (trans->msg_type != NFT_MSG_NEWFLOWTABLE || -+ trans->ctx.table != ctx->table || -+ !nft_trans_flowtable_update(trans)) -+ continue; -+ -+ if (nft_hook_list_find(&nft_trans_flowtable_hooks(trans), hook)) { -+ err = -EEXIST; -+ goto err_flowtable_update_hook; -+ } - } - } - -diff --git a/net/rds/rds.h b/net/rds/rds.h -index dc360252c51573..5b1c072e2e7ff4 100644 ---- a/net/rds/rds.h -+++ b/net/rds/rds.h -@@ -93,7 +93,7 @@ enum { - - /* Max number of multipaths per RDS connection. Must be a power of 2 */ - #define RDS_MPATH_WORKERS 8 --#define RDS_MPATH_HASH(rs, n) (jhash_1word((rs)->rs_bound_port, \ -+#define RDS_MPATH_HASH(rs, n) (jhash_1word(ntohs((rs)->rs_bound_port), \ - (rs)->rs_hash_initval) & ((n) - 1)) - - #define IS_CANONICAL(laddr, faddr) (htonl(laddr) < htonl(faddr)) -diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c -index ac87fcff4795e8..a1c0e8a9fc8c2f 100644 ---- a/net/sched/act_bpf.c -+++ b/net/sched/act_bpf.c -@@ -47,12 +47,10 @@ TC_INDIRECT_SCOPE int tcf_bpf_act(struct sk_buff *skb, - filter = rcu_dereference(prog->filter); - if (at_ingress) { - __skb_push(skb, skb->mac_len); -- bpf_compute_data_pointers(skb); -- filter_res = bpf_prog_run(filter, skb); -+ filter_res = bpf_prog_run_data_pointers(filter, skb); - __skb_pull(skb, skb->mac_len); - } else { -- bpf_compute_data_pointers(skb); -- filter_res = bpf_prog_run(filter, skb); -+ filter_res = bpf_prog_run_data_pointers(filter, skb); - } - if (unlikely(!skb->tstamp && skb->tstamp_type)) - skb->tstamp_type = SKB_CLOCK_REALTIME; -diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c -index 0d7aee8933c5ff..d90a2fa5966b7f 100644 ---- a/net/sched/act_connmark.c -+++ b/net/sched/act_connmark.c -@@ -88,7 +88,7 @@ TC_INDIRECT_SCOPE int tcf_connmark_act(struct sk_buff *skb, - /* using overlimits stats to count how many packets marked */ - tcf_action_inc_overlimit_qstats(&ca->common); - out: -- return READ_ONCE(ca->tcf_action); -+ return parms->action; - } - - static const struct nla_policy connmark_policy[TCA_CONNMARK_MAX + 1] = { -@@ -167,6 +167,8 @@ static int tcf_connmark_init(struct net *net, struct nlattr *nla, - if (err < 0) - goto release_idr; - -+ nparms->action = parm->action; -+ - spin_lock_bh(&ci->tcf_lock); - goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch); - oparms = rcu_replace_pointer(ci->parms, nparms, lockdep_is_held(&ci->tcf_lock)); -@@ -190,20 +192,22 @@ static int tcf_connmark_init(struct net *net, struct nlattr *nla, - static inline int tcf_connmark_dump(struct sk_buff *skb, struct tc_action *a, - int bind, int ref) - { -+ const struct tcf_connmark_info *ci = to_connmark(a); - unsigned char *b = skb_tail_pointer(skb); -- struct tcf_connmark_info *ci = to_connmark(a); -- struct tc_connmark opt = { -- .index = ci->tcf_index, -- .refcnt = refcount_read(&ci->tcf_refcnt) - ref, -- .bindcnt = atomic_read(&ci->tcf_bindcnt) - bind, -- }; -- struct tcf_connmark_parms *parms; -+ const struct tcf_connmark_parms *parms; -+ struct tc_connmark opt; - struct tcf_t t; - -- spin_lock_bh(&ci->tcf_lock); -- parms = rcu_dereference_protected(ci->parms, lockdep_is_held(&ci->tcf_lock)); -+ memset(&opt, 0, sizeof(opt)); - -- opt.action = ci->tcf_action; -+ opt.index = ci->tcf_index; -+ opt.refcnt = refcount_read(&ci->tcf_refcnt) - ref; -+ opt.bindcnt = atomic_read(&ci->tcf_bindcnt) - bind; -+ -+ rcu_read_lock(); -+ parms = rcu_dereference(ci->parms); -+ -+ opt.action = parms->action; - opt.zone = parms->zone; - if (nla_put(skb, TCA_CONNMARK_PARMS, sizeof(opt), &opt)) - goto nla_put_failure; -@@ -212,12 +216,12 @@ static inline int tcf_connmark_dump(struct sk_buff *skb, struct tc_action *a, - if (nla_put_64bit(skb, TCA_CONNMARK_TM, sizeof(t), &t, - TCA_CONNMARK_PAD)) - goto nla_put_failure; -- spin_unlock_bh(&ci->tcf_lock); -+ rcu_read_unlock(); - - return skb->len; - - nla_put_failure: -- spin_unlock_bh(&ci->tcf_lock); -+ rcu_read_unlock(); - nlmsg_trim(skb, b); - return -1; - } -diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c -index bc7611b0744c41..431921204f6603 100644 ---- a/net/sched/act_ife.c -+++ b/net/sched/act_ife.c -@@ -644,13 +644,15 @@ static int tcf_ife_dump(struct sk_buff *skb, struct tc_action *a, int bind, - unsigned char *b = skb_tail_pointer(skb); - struct tcf_ife_info *ife = to_ife(a); - struct tcf_ife_params *p; -- struct tc_ife opt = { -- .index = ife->tcf_index, -- .refcnt = refcount_read(&ife->tcf_refcnt) - ref, -- .bindcnt = atomic_read(&ife->tcf_bindcnt) - bind, -- }; -+ struct tc_ife opt; - struct tcf_t t; - -+ memset(&opt, 0, sizeof(opt)); -+ -+ opt.index = ife->tcf_index, -+ opt.refcnt = refcount_read(&ife->tcf_refcnt) - ref, -+ opt.bindcnt = atomic_read(&ife->tcf_bindcnt) - bind, -+ - spin_lock_bh(&ife->tcf_lock); - opt.action = ife->tcf_action; - p = rcu_dereference_protected(ife->params, -diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c -index db7151c6b70b79..29dfe6767f108c 100644 ---- a/net/sched/cls_bpf.c -+++ b/net/sched/cls_bpf.c -@@ -97,12 +97,10 @@ TC_INDIRECT_SCOPE int cls_bpf_classify(struct sk_buff *skb, - } else if (at_ingress) { - /* It is safe to push/pull even if skb_shared() */ - __skb_push(skb, skb->mac_len); -- bpf_compute_data_pointers(skb); -- filter_res = bpf_prog_run(prog->filter, skb); -+ filter_res = bpf_prog_run_data_pointers(prog->filter, skb); - __skb_pull(skb, skb->mac_len); - } else { -- bpf_compute_data_pointers(skb); -- filter_res = bpf_prog_run(prog->filter, skb); -+ filter_res = bpf_prog_run_data_pointers(prog->filter, skb); - } - if (unlikely(!skb->tstamp && skb->tstamp_type)) - skb->tstamp_type = SKB_CLOCK_REALTIME; -diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c -index b51af871a621ca..1b51b3038b4bd6 100644 ---- a/net/sched/sch_generic.c -+++ b/net/sched/sch_generic.c -@@ -178,9 +178,10 @@ static inline void dev_requeue_skb(struct sk_buff *skb, struct Qdisc *q) - static void try_bulk_dequeue_skb(struct Qdisc *q, - struct sk_buff *skb, - const struct netdev_queue *txq, -- int *packets) -+ int *packets, int budget) - { - int bytelimit = qdisc_avail_bulklimit(txq) - skb->len; -+ int cnt = 0; - - while (bytelimit > 0) { - struct sk_buff *nskb = q->dequeue(q); -@@ -191,8 +192,10 @@ static void try_bulk_dequeue_skb(struct Qdisc *q, - bytelimit -= nskb->len; /* covers GSO len */ - skb->next = nskb; - skb = nskb; -- (*packets)++; /* GSO counts as one pkt */ -+ if (++cnt >= budget) -+ break; - } -+ (*packets) += cnt; - skb_mark_not_on_list(skb); - } - -@@ -226,7 +229,7 @@ static void try_bulk_dequeue_skb_slow(struct Qdisc *q, - * A requeued skb (via q->gso_skb) can also be a SKB list. - */ - static struct sk_buff *dequeue_skb(struct Qdisc *q, bool *validate, -- int *packets) -+ int *packets, int budget) - { - const struct netdev_queue *txq = q->dev_queue; - struct sk_buff *skb = NULL; -@@ -293,7 +296,7 @@ static struct sk_buff *dequeue_skb(struct Qdisc *q, bool *validate, - if (skb) { - bulk: - if (qdisc_may_bulk(q)) -- try_bulk_dequeue_skb(q, skb, txq, packets); -+ try_bulk_dequeue_skb(q, skb, txq, packets, budget); - else - try_bulk_dequeue_skb_slow(q, skb, packets); - } -@@ -385,7 +388,7 @@ bool sch_direct_xmit(struct sk_buff *skb, struct Qdisc *q, - * >0 - queue is not empty. - * - */ --static inline bool qdisc_restart(struct Qdisc *q, int *packets) -+static inline bool qdisc_restart(struct Qdisc *q, int *packets, int budget) - { - spinlock_t *root_lock = NULL; - struct netdev_queue *txq; -@@ -394,7 +397,7 @@ static inline bool qdisc_restart(struct Qdisc *q, int *packets) - bool validate; - - /* Dequeue packet */ -- skb = dequeue_skb(q, &validate, packets); -+ skb = dequeue_skb(q, &validate, packets, budget); - if (unlikely(!skb)) - return false; - -@@ -412,7 +415,7 @@ void __qdisc_run(struct Qdisc *q) - int quota = READ_ONCE(dev_tx_weight); - int packets; - -- while (qdisc_restart(q, &packets)) { -+ while (qdisc_restart(q, &packets, quota)) { - quota -= packets; - if (quota <= 0) { - if (q->flags & TCQ_F_NOLOCK) -diff --git a/net/sctp/diag.c b/net/sctp/diag.c -index c3d6b92dd3862f..ad3e1462a896ed 100644 ---- a/net/sctp/diag.c -+++ b/net/sctp/diag.c -@@ -73,19 +73,26 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb, - struct nlattr *attr; - void *info = NULL; - -+ rcu_read_lock(); - list_for_each_entry_rcu(laddr, address_list, list) - addrcnt++; -+ rcu_read_unlock(); - - attr = nla_reserve(skb, INET_DIAG_LOCALS, addrlen * addrcnt); - if (!attr) - return -EMSGSIZE; - - info = nla_data(attr); -+ rcu_read_lock(); - list_for_each_entry_rcu(laddr, address_list, list) { - memcpy(info, &laddr->a, sizeof(laddr->a)); - memset(info + sizeof(laddr->a), 0, addrlen - sizeof(laddr->a)); - info += addrlen; -+ -+ if (!--addrcnt) -+ break; - } -+ rcu_read_unlock(); - - return 0; - } -@@ -223,14 +230,15 @@ struct sctp_comm_param { - bool net_admin; - }; - --static size_t inet_assoc_attr_size(struct sctp_association *asoc) -+static size_t inet_assoc_attr_size(struct sock *sk, -+ struct sctp_association *asoc) - { - int addrlen = sizeof(struct sockaddr_storage); - int addrcnt = 0; - struct sctp_sockaddr_entry *laddr; - - list_for_each_entry_rcu(laddr, &asoc->base.bind_addr.address_list, -- list) -+ list, lockdep_sock_is_held(sk)) - addrcnt++; - - return nla_total_size(sizeof(struct sctp_info)) -@@ -256,11 +264,14 @@ static int sctp_sock_dump_one(struct sctp_endpoint *ep, struct sctp_transport *t - if (err) - return err; - -- rep = nlmsg_new(inet_assoc_attr_size(assoc), GFP_KERNEL); -- if (!rep) -+ lock_sock(sk); -+ -+ rep = nlmsg_new(inet_assoc_attr_size(sk, assoc), GFP_KERNEL); -+ if (!rep) { -+ release_sock(sk); - return -ENOMEM; -+ } - -- lock_sock(sk); - if (ep != assoc->ep) { - err = -EAGAIN; - goto out; -diff --git a/net/sctp/transport.c b/net/sctp/transport.c -index 31eca29b6cfbfb..abb44c0ac1a0ba 100644 ---- a/net/sctp/transport.c -+++ b/net/sctp/transport.c -@@ -495,6 +495,7 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt) - - if (tp->rttvar || tp->srtt) { - struct net *net = tp->asoc->base.net; -+ unsigned int rto_beta, rto_alpha; - /* 6.3.1 C3) When a new RTT measurement R' is made, set - * RTTVAR <- (1 - RTO.Beta) * RTTVAR + RTO.Beta * |SRTT - R'| - * SRTT <- (1 - RTO.Alpha) * SRTT + RTO.Alpha * R' -@@ -506,10 +507,14 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt) - * For example, assuming the default value of RTO.Alpha of - * 1/8, rto_alpha would be expressed as 3. - */ -- tp->rttvar = tp->rttvar - (tp->rttvar >> net->sctp.rto_beta) -- + (((__u32)abs((__s64)tp->srtt - (__s64)rtt)) >> net->sctp.rto_beta); -- tp->srtt = tp->srtt - (tp->srtt >> net->sctp.rto_alpha) -- + (rtt >> net->sctp.rto_alpha); -+ rto_beta = READ_ONCE(net->sctp.rto_beta); -+ if (rto_beta < 32) -+ tp->rttvar = tp->rttvar - (tp->rttvar >> rto_beta) -+ + (((__u32)abs((__s64)tp->srtt - (__s64)rtt)) >> rto_beta); -+ rto_alpha = READ_ONCE(net->sctp.rto_alpha); -+ if (rto_alpha < 32) -+ tp->srtt = tp->srtt - (tp->srtt >> rto_alpha) -+ + (rtt >> rto_alpha); - } else { - /* 6.3.1 C2) When the first RTT measurement R is made, set - * SRTT <- R, RTTVAR <- R/2. -diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c -index 4f485b9b31b288..2f748226f14335 100644 ---- a/net/smc/smc_clc.c -+++ b/net/smc/smc_clc.c -@@ -883,6 +883,7 @@ int smc_clc_send_proposal(struct smc_sock *smc, struct smc_init_info *ini) - return SMC_CLC_DECL_CNFERR; - } - pclc_base->hdr.typev1 = SMC_TYPE_N; -+ ini->smc_type_v1 = SMC_TYPE_N; - } else { - pclc_base->iparea_offset = htons(sizeof(*pclc_smcd)); - plen += sizeof(*pclc_prfx) + -diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c -index 95696f42647ec1..b61384b08e7c3a 100644 ---- a/net/strparser/strparser.c -+++ b/net/strparser/strparser.c -@@ -238,7 +238,7 @@ static int __strp_recv(read_descriptor_t *desc, struct sk_buff *orig_skb, - strp_parser_err(strp, -EMSGSIZE, desc); - break; - } else if (len <= (ssize_t)head->len - -- skb->len - stm->strp.offset) { -+ (ssize_t)skb->len - stm->strp.offset) { - /* Length must be into new skb (and also - * greater than zero) - */ -diff --git a/net/tipc/net.c b/net/tipc/net.c -index 0e95572e56b41e..7e65d0b0c4a8d1 100644 ---- a/net/tipc/net.c -+++ b/net/tipc/net.c -@@ -145,7 +145,9 @@ void tipc_net_finalize_work(struct work_struct *work) - { - struct tipc_net *tn = container_of(work, struct tipc_net, work); - -+ rtnl_lock(); - tipc_net_finalize(tipc_link_net(tn->bcl), tn->trial_addr); -+ rtnl_unlock(); - } - - void tipc_net_stop(struct net *net) -diff --git a/net/unix/garbage.c b/net/unix/garbage.c -index 0068e758be4ddb..66fd606c43f45d 100644 ---- a/net/unix/garbage.c -+++ b/net/unix/garbage.c -@@ -136,6 +136,7 @@ enum unix_vertex_index { - }; - - static unsigned long unix_vertex_unvisited_index = UNIX_VERTEX_INDEX_MARK1; -+static unsigned long unix_vertex_max_scc_index = UNIX_VERTEX_INDEX_START; - - static void unix_add_edge(struct scm_fp_list *fpl, struct unix_edge *edge) - { -@@ -144,6 +145,7 @@ static void unix_add_edge(struct scm_fp_list *fpl, struct unix_edge *edge) - if (!vertex) { - vertex = list_first_entry(&fpl->vertices, typeof(*vertex), entry); - vertex->index = unix_vertex_unvisited_index; -+ vertex->scc_index = ++unix_vertex_max_scc_index; - vertex->out_degree = 0; - INIT_LIST_HEAD(&vertex->edges); - INIT_LIST_HEAD(&vertex->scc_entry); -@@ -480,10 +482,15 @@ static void __unix_walk_scc(struct unix_vertex *vertex, unsigned long *last_inde - scc_dead = unix_vertex_dead(v); - } - -- if (scc_dead) -+ if (scc_dead) { - unix_collect_skb(&scc, hitlist); -- else if (!unix_graph_maybe_cyclic) -- unix_graph_maybe_cyclic = unix_scc_cyclic(&scc); -+ } else { -+ if (unix_vertex_max_scc_index < vertex->scc_index) -+ unix_vertex_max_scc_index = vertex->scc_index; -+ -+ if (!unix_graph_maybe_cyclic) -+ unix_graph_maybe_cyclic = unix_scc_cyclic(&scc); -+ } - - list_del(&scc); - } -@@ -498,6 +505,7 @@ static void unix_walk_scc(struct sk_buff_head *hitlist) - unsigned long last_index = UNIX_VERTEX_INDEX_START; - - unix_graph_maybe_cyclic = false; -+ unix_vertex_max_scc_index = UNIX_VERTEX_INDEX_START; - - /* Visit every vertex exactly once. - * __unix_walk_scc() moves visited vertices to unix_visited_vertices. -diff --git a/net/xfrm/espintcp.c b/net/xfrm/espintcp.c -index d3b3f9e720b3b6..427072285b8c7f 100644 ---- a/net/xfrm/espintcp.c -+++ b/net/xfrm/espintcp.c -@@ -169,8 +169,10 @@ int espintcp_queue_out(struct sock *sk, struct sk_buff *skb) - { - struct espintcp_ctx *ctx = espintcp_getctx(sk); - -- if (skb_queue_len(&ctx->out_queue) >= READ_ONCE(netdev_max_backlog)) -+ if (skb_queue_len(&ctx->out_queue) >= READ_ONCE(netdev_max_backlog)) { -+ kfree_skb(skb); - return -ENOBUFS; -+ } - - __skb_queue_tail(&ctx->out_queue, skb); - -diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c -index 870dde67707b1f..0acf7d6baa37fb 100644 ---- a/security/integrity/ima/ima_appraise.c -+++ b/security/integrity/ima/ima_appraise.c -@@ -671,6 +671,15 @@ static int ima_protect_xattr(struct dentry *dentry, const char *xattr_name, - return 0; - } - -+/* -+ * ima_reset_appraise_flags - reset ima_iint_cache flags -+ * -+ * @digsig: whether to clear/set IMA_DIGSIG flag, tristate values -+ * 0: clear IMA_DIGSIG -+ * 1: set IMA_DIGSIG -+ * -1: don't change IMA_DIGSIG -+ * -+ */ - static void ima_reset_appraise_flags(struct inode *inode, int digsig) - { - struct integrity_iint_cache *iint; -@@ -683,9 +692,9 @@ static void ima_reset_appraise_flags(struct inode *inode, int digsig) - return; - iint->measured_pcrs = 0; - set_bit(IMA_CHANGE_XATTR, &iint->atomic_flags); -- if (digsig) -+ if (digsig == 1) - set_bit(IMA_DIGSIG, &iint->atomic_flags); -- else -+ else if (digsig == 0) - clear_bit(IMA_DIGSIG, &iint->atomic_flags); - } - -@@ -770,6 +779,8 @@ int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name, - digsig = (xvalue->type == EVM_IMA_XATTR_DIGSIG); - } else if (!strcmp(xattr_name, XATTR_NAME_EVM) && xattr_value_len > 0) { - digsig = (xvalue->type == EVM_XATTR_PORTABLE_DIGSIG); -+ } else { -+ digsig = -1; - } - if (result == 1 || evm_revalidate_status(xattr_name)) { - ima_reset_appraise_flags(d_backing_inode(dentry), digsig); -@@ -783,18 +794,20 @@ int ima_inode_set_acl(struct mnt_idmap *idmap, struct dentry *dentry, - const char *acl_name, struct posix_acl *kacl) - { - if (evm_revalidate_status(acl_name)) -- ima_reset_appraise_flags(d_backing_inode(dentry), 0); -+ ima_reset_appraise_flags(d_backing_inode(dentry), -1); - - return 0; - } - - int ima_inode_removexattr(struct dentry *dentry, const char *xattr_name) - { -- int result; -+ int result, digsig = -1; - - result = ima_protect_xattr(dentry, xattr_name, NULL, 0); - if (result == 1 || evm_revalidate_status(xattr_name)) { -- ima_reset_appraise_flags(d_backing_inode(dentry), 0); -+ if (!strcmp(xattr_name, XATTR_NAME_IMA)) -+ digsig = 0; -+ ima_reset_appraise_flags(d_backing_inode(dentry), digsig); - if (result == 1) - result = 0; - } -diff --git a/sound/drivers/serial-generic.c b/sound/drivers/serial-generic.c -index c8db6c75d133d1..8b8e9e871ed37c 100644 ---- a/sound/drivers/serial-generic.c -+++ b/sound/drivers/serial-generic.c -@@ -37,6 +37,8 @@ MODULE_LICENSE("GPL"); - #define SERIAL_TX_STATE_ACTIVE 1 - #define SERIAL_TX_STATE_WAKEUP 2 - -+#define INTERNAL_BUF_SIZE 256 -+ - struct snd_serial_generic { - struct serdev_device *serdev; - -@@ -51,6 +53,7 @@ struct snd_serial_generic { - struct work_struct tx_work; - unsigned long tx_state; - -+ char tx_buf[INTERNAL_BUF_SIZE]; - }; - - static void snd_serial_generic_tx_wakeup(struct snd_serial_generic *drvdata) -@@ -61,11 +64,8 @@ static void snd_serial_generic_tx_wakeup(struct snd_serial_generic *drvdata) - schedule_work(&drvdata->tx_work); - } - --#define INTERNAL_BUF_SIZE 256 -- - static void snd_serial_generic_tx_work(struct work_struct *work) - { -- static char buf[INTERNAL_BUF_SIZE]; - int num_bytes; - struct snd_serial_generic *drvdata = container_of(work, struct snd_serial_generic, - tx_work); -@@ -78,8 +78,10 @@ static void snd_serial_generic_tx_work(struct work_struct *work) - if (!test_bit(SERIAL_MODE_OUTPUT_OPEN, &drvdata->filemode)) - break; - -- num_bytes = snd_rawmidi_transmit_peek(substream, buf, INTERNAL_BUF_SIZE); -- num_bytes = serdev_device_write_buf(drvdata->serdev, buf, num_bytes); -+ num_bytes = snd_rawmidi_transmit_peek(substream, drvdata->tx_buf, -+ INTERNAL_BUF_SIZE); -+ num_bytes = serdev_device_write_buf(drvdata->serdev, drvdata->tx_buf, -+ num_bytes); - - if (!num_bytes) - break; -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 5fe6b71d90f4f4..65c9d47f03af57 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -3644,6 +3644,15 @@ static void alc256_shutup(struct hda_codec *codec) - hp_pin = 0x21; - - alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x1); /* Low power */ -+ -+ /* 3k pull low control for Headset jack. */ -+ /* NOTE: call this before clearing the pin, otherwise codec stalls */ -+ /* If disable 3k pulldown control for alc257, the Mic detection will not work correctly -+ * when booting with headset plugged. So skip setting it for the codec alc257 -+ */ -+ if (spec->en_3kpull_low) -+ alc_update_coef_idx(codec, 0x46, 0, 3 << 12); -+ - hp_pin_sense = snd_hda_jack_detect(codec, hp_pin); - - if (hp_pin_sense) { -@@ -3654,14 +3663,6 @@ static void alc256_shutup(struct hda_codec *codec) - - msleep(75); - -- /* 3k pull low control for Headset jack. */ -- /* NOTE: call this before clearing the pin, otherwise codec stalls */ -- /* If disable 3k pulldown control for alc257, the Mic detection will not work correctly -- * when booting with headset plugged. So skip setting it for the codec alc257 -- */ -- if (spec->en_3kpull_low) -- alc_update_coef_idx(codec, 0x46, 0, 3 << 12); -- - if (!spec->no_shutup_pins) - snd_hda_codec_write(codec, hp_pin, 0, - AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); -diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c -index 188b8b43c524f2..b7529e29005725 100644 ---- a/sound/soc/codecs/cs4271.c -+++ b/sound/soc/codecs/cs4271.c -@@ -594,17 +594,17 @@ static int cs4271_component_probe(struct snd_soc_component *component) - - ret = regcache_sync(cs4271->regmap); - if (ret < 0) -- return ret; -+ goto err_disable_regulator; - - ret = regmap_update_bits(cs4271->regmap, CS4271_MODE2, - CS4271_MODE2_PDN | CS4271_MODE2_CPEN, - CS4271_MODE2_PDN | CS4271_MODE2_CPEN); - if (ret < 0) -- return ret; -+ goto err_disable_regulator; - ret = regmap_update_bits(cs4271->regmap, CS4271_MODE2, - CS4271_MODE2_PDN, 0); - if (ret < 0) -- return ret; -+ goto err_disable_regulator; - /* Power-up sequence requires 85 uS */ - udelay(85); - -@@ -614,6 +614,10 @@ static int cs4271_component_probe(struct snd_soc_component *component) - CS4271_MODE2_MUTECAEQUB); - - return 0; -+ -+err_disable_regulator: -+ regulator_bulk_disable(ARRAY_SIZE(cs4271->supplies), cs4271->supplies); -+ return ret; - } - - static void cs4271_component_remove(struct snd_soc_component *component) -diff --git a/sound/soc/codecs/lpass-va-macro.c b/sound/soc/codecs/lpass-va-macro.c -index b71ef03c4aef02..c7d6696b1bfdff 100644 ---- a/sound/soc/codecs/lpass-va-macro.c -+++ b/sound/soc/codecs/lpass-va-macro.c -@@ -1555,7 +1555,7 @@ static int va_macro_probe(struct platform_device *pdev) - if (ret) - goto err_clkout; - -- va->fsgen = clk_hw_get_clk(&va->hw, "fsgen"); -+ va->fsgen = devm_clk_hw_get_clk(dev, &va->hw, "fsgen"); - if (IS_ERR(va->fsgen)) { - ret = PTR_ERR(va->fsgen); - goto err_clkout; -diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c -index 2adf744c652634..4023b88e7bc13a 100644 ---- a/sound/soc/codecs/max98090.c -+++ b/sound/soc/codecs/max98090.c -@@ -1234,9 +1234,11 @@ static const struct snd_soc_dapm_widget max98091_dapm_widgets[] = { - SND_SOC_DAPM_INPUT("DMIC4"), - - SND_SOC_DAPM_SUPPLY("DMIC3_ENA", M98090_REG_DIGITAL_MIC_ENABLE, -- M98090_DIGMIC3_SHIFT, 0, NULL, 0), -+ M98090_DIGMIC3_SHIFT, 0, max98090_shdn_event, -+ SND_SOC_DAPM_POST_PMU), - SND_SOC_DAPM_SUPPLY("DMIC4_ENA", M98090_REG_DIGITAL_MIC_ENABLE, -- M98090_DIGMIC4_SHIFT, 0, NULL, 0), -+ M98090_DIGMIC4_SHIFT, 0, max98090_shdn_event, -+ SND_SOC_DAPM_POST_PMU), - }; - - static const struct snd_soc_dapm_route max98090_dapm_routes[] = { -diff --git a/sound/soc/codecs/tas2781-i2c.c b/sound/soc/codecs/tas2781-i2c.c -index 43775c19444525..836cf06a452667 100644 ---- a/sound/soc/codecs/tas2781-i2c.c -+++ b/sound/soc/codecs/tas2781-i2c.c -@@ -616,7 +616,8 @@ static void tasdevice_parse_dt(struct tasdevice_priv *tas_priv) - { - struct i2c_client *client = (struct i2c_client *)tas_priv->client; - unsigned int dev_addrs[TASDEVICE_MAX_CHANNELS]; -- int i, ndev = 0; -+ int ndev = 0; -+ int i, rc; - - if (tas_priv->isacpi) { - ndev = device_property_read_u32_array(&client->dev, -@@ -627,8 +628,12 @@ static void tasdevice_parse_dt(struct tasdevice_priv *tas_priv) - } else { - ndev = (ndev < ARRAY_SIZE(dev_addrs)) - ? ndev : ARRAY_SIZE(dev_addrs); -- ndev = device_property_read_u32_array(&client->dev, -+ rc = device_property_read_u32_array(&client->dev, - "ti,audio-slots", dev_addrs, ndev); -+ if (rc != 0) { -+ ndev = 1; -+ dev_addrs[0] = client->addr; -+ } - } - - tas_priv->irq = -diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c -index 56e795a00e22fd..591f6c9f9d3a60 100644 ---- a/sound/soc/codecs/tlv320aic3x.c -+++ b/sound/soc/codecs/tlv320aic3x.c -@@ -121,6 +121,16 @@ static const struct reg_default aic3x_reg[] = { - { 108, 0x00 }, { 109, 0x00 }, - }; - -+static const struct reg_sequence aic3007_class_d[] = { -+ /* Class-D speaker driver init; datasheet p. 46 */ -+ { AIC3X_PAGE_SELECT, 0x0D }, -+ { 0xD, 0x0D }, -+ { 0x8, 0x5C }, -+ { 0x8, 0x5D }, -+ { 0x8, 0x5C }, -+ { AIC3X_PAGE_SELECT, 0x00 }, -+}; -+ - static bool aic3x_volatile_reg(struct device *dev, unsigned int reg) - { - switch (reg) { -@@ -1393,6 +1403,10 @@ static int aic3x_set_power(struct snd_soc_component *component, int power) - gpiod_set_value(aic3x->gpio_reset, 0); - } - -+ if (aic3x->model == AIC3X_MODEL_3007) -+ regmap_multi_reg_write_bypassed(aic3x->regmap, aic3007_class_d, -+ ARRAY_SIZE(aic3007_class_d)); -+ - /* Sync reg_cache with the hardware */ - regcache_cache_only(aic3x->regmap, false); - regcache_sync(aic3x->regmap); -@@ -1723,17 +1737,6 @@ static void aic3x_configure_ocmv(struct device *dev, struct aic3x_priv *aic3x) - } - } - -- --static const struct reg_sequence aic3007_class_d[] = { -- /* Class-D speaker driver init; datasheet p. 46 */ -- { AIC3X_PAGE_SELECT, 0x0D }, -- { 0xD, 0x0D }, -- { 0x8, 0x5C }, -- { 0x8, 0x5D }, -- { 0x8, 0x5C }, -- { AIC3X_PAGE_SELECT, 0x00 }, --}; -- - int aic3x_probe(struct device *dev, struct regmap *regmap, kernel_ulong_t driver_data) - { - struct aic3x_priv *aic3x; -@@ -1825,13 +1828,6 @@ int aic3x_probe(struct device *dev, struct regmap *regmap, kernel_ulong_t driver - - aic3x_configure_ocmv(dev, aic3x); - -- if (aic3x->model == AIC3X_MODEL_3007) { -- ret = regmap_register_patch(aic3x->regmap, aic3007_class_d, -- ARRAY_SIZE(aic3007_class_d)); -- if (ret != 0) -- dev_err(dev, "Failed to init class D: %d\n", ret); -- } -- - ret = devm_snd_soc_register_component(dev, &soc_component_dev_aic3x, &aic3x_dai, 1); - if (ret) - return ret; -diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c -index a6948a57636ab5..0de878d64a3bd1 100644 ---- a/sound/soc/fsl/fsl_sai.c -+++ b/sound/soc/fsl/fsl_sai.c -@@ -322,7 +322,6 @@ static int fsl_sai_set_dai_fmt_tr(struct snd_soc_dai *cpu_dai, - break; - case SND_SOC_DAIFMT_PDM: - val_cr2 |= FSL_SAI_CR2_BCP; -- val_cr4 &= ~FSL_SAI_CR4_MF; - sai->is_pdm_mode = true; - break; - case SND_SOC_DAIFMT_RIGHT_J: -@@ -597,7 +596,7 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream, - val_cr5 |= FSL_SAI_CR5_WNW(slot_width); - val_cr5 |= FSL_SAI_CR5_W0W(slot_width); - -- if (sai->is_lsb_first || sai->is_pdm_mode) -+ if (sai->is_lsb_first) - val_cr5 |= FSL_SAI_CR5_FBT(0); - else - val_cr5 |= FSL_SAI_CR5_FBT(word_width - 1); -diff --git a/sound/soc/intel/avs/pcm.c b/sound/soc/intel/avs/pcm.c -index 781019685b941f..9251c38cf9d126 100644 ---- a/sound/soc/intel/avs/pcm.c -+++ b/sound/soc/intel/avs/pcm.c -@@ -611,6 +611,8 @@ static int avs_dai_fe_prepare(struct snd_pcm_substream *substream, struct snd_so - data = snd_soc_dai_get_dma_data(dai, substream); - host_stream = data->host_stream; - -+ if (runtime->state == SNDRV_PCM_STATE_XRUN) -+ hdac_stream(host_stream)->prepared = false; - if (hdac_stream(host_stream)->prepared) - return 0; - -diff --git a/sound/soc/meson/aiu-encoder-i2s.c b/sound/soc/meson/aiu-encoder-i2s.c -index a0dd914c8ed136..3b4061508c1804 100644 ---- a/sound/soc/meson/aiu-encoder-i2s.c -+++ b/sound/soc/meson/aiu-encoder-i2s.c -@@ -236,8 +236,12 @@ static int aiu_encoder_i2s_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) - inv == SND_SOC_DAIFMT_IB_IF) - val |= AIU_CLK_CTRL_LRCLK_INVERT; - -- if (inv == SND_SOC_DAIFMT_IB_NF || -- inv == SND_SOC_DAIFMT_IB_IF) -+ /* -+ * The SoC changes data on the rising edge of the bitclock -+ * so an inversion of the bitclock is required in normal mode -+ */ -+ if (inv == SND_SOC_DAIFMT_NB_NF || -+ inv == SND_SOC_DAIFMT_NB_IF) - val |= AIU_CLK_CTRL_AOCLK_INVERT; - - /* Signal skew */ -@@ -328,4 +332,3 @@ const struct snd_soc_dai_ops aiu_encoder_i2s_dai_ops = { - .startup = aiu_encoder_i2s_startup, - .shutdown = aiu_encoder_i2s_shutdown, - }; -- -diff --git a/sound/soc/qcom/qdsp6/q6asm.c b/sound/soc/qcom/qdsp6/q6asm.c -index 195780f75d05d2..9f53cffe5184e3 100644 ---- a/sound/soc/qcom/qdsp6/q6asm.c -+++ b/sound/soc/qcom/qdsp6/q6asm.c -@@ -376,9 +376,9 @@ static void q6asm_audio_client_free_buf(struct audio_client *ac, - - spin_lock_irqsave(&ac->lock, flags); - port->num_periods = 0; -+ spin_unlock_irqrestore(&ac->lock, flags); - kfree(port->buf); - port->buf = NULL; -- spin_unlock_irqrestore(&ac->lock, flags); - } - - /** -diff --git a/sound/soc/qcom/sc8280xp.c b/sound/soc/qcom/sc8280xp.c -index d5cc967992d161..ee195a54d0c3b1 100644 ---- a/sound/soc/qcom/sc8280xp.c -+++ b/sound/soc/qcom/sc8280xp.c -@@ -7,6 +7,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -58,8 +59,10 @@ static int sc8280xp_be_hw_params_fixup(struct snd_soc_pcm_runtime *rtd, - SNDRV_PCM_HW_PARAM_RATE); - struct snd_interval *channels = hw_param_interval(params, - SNDRV_PCM_HW_PARAM_CHANNELS); -+ struct snd_mask *fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT); - - rate->min = rate->max = 48000; -+ snd_mask_set_format(fmt, SNDRV_PCM_FORMAT_S16_LE); - channels->min = 2; - channels->max = 2; - switch (cpu_dai->id) { -diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c -index dcbcd1a59a3aae..351e96163406b0 100644 ---- a/sound/soc/stm/stm32_sai_sub.c -+++ b/sound/soc/stm/stm32_sai_sub.c -@@ -551,6 +551,14 @@ static int stm32_sai_set_sysclk(struct snd_soc_dai *cpu_dai, - struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai); - int ret; - -+ /* -+ * The mclk rate is determined at runtime from the audio stream rate. -+ * Skip calls to the set_sysclk callback that are not relevant during the -+ * initialization phase. -+ */ -+ if (!snd_soc_card_is_instantiated(cpu_dai->component->card)) -+ return 0; -+ - if (dir == SND_SOC_CLOCK_OUT && sai->sai_mclk) { - ret = stm32_sai_sub_reg_up(sai, STM_SAI_CR1_REGX, - SAI_XCR1_NODIV, -diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c -index f71f6ff3e2b0f7..b05ad2eb623db6 100644 ---- a/sound/usb/endpoint.c -+++ b/sound/usb/endpoint.c -@@ -1383,6 +1383,11 @@ int snd_usb_endpoint_set_params(struct snd_usb_audio *chip, - ep->sample_rem = ep->cur_rate % ep->pps; - ep->packsize[0] = ep->cur_rate / ep->pps; - ep->packsize[1] = (ep->cur_rate + (ep->pps - 1)) / ep->pps; -+ if (ep->packsize[1] > ep->maxpacksize) { -+ usb_audio_dbg(chip, "Too small maxpacksize %u for rate %u / pps %u\n", -+ ep->maxpacksize, ep->cur_rate, ep->pps); -+ return -EINVAL; -+ } - - /* calculate the frequency in 16.16 format */ - ep->freqm = ep->freqn; -diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c -index b8fa0a866153b0..787cdeddbdf443 100644 ---- a/sound/usb/mixer.c -+++ b/sound/usb/mixer.c -@@ -1191,6 +1191,13 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, - cval->res = 1; - } - break; -+ case USB_ID(0x3302, 0x12db): /* MOONDROP Quark2 */ -+ if (!strcmp(kctl->id.name, "PCM Playback Volume")) { -+ usb_audio_info(chip, -+ "set volume quirk for MOONDROP Quark2\n"); -+ cval->min = -14208; /* Mute under it */ -+ } -+ break; - } - } - -@@ -3072,6 +3079,8 @@ static int snd_usb_mixer_controls_badd(struct usb_mixer_interface *mixer, - int i; - - assoc = usb_ifnum_to_if(dev, ctrlif)->intf_assoc; -+ if (!assoc) -+ return -EINVAL; - - /* Detect BADD capture/playback channels from AS EP descriptors */ - for (i = 0; i < assoc->bInterfaceCount; i++) { -diff --git a/sound/usb/mixer_s1810c.c b/sound/usb/mixer_s1810c.c -index fac4bbc6b27577..2413a6d96971cb 100644 ---- a/sound/usb/mixer_s1810c.c -+++ b/sound/usb/mixer_s1810c.c -@@ -93,6 +93,7 @@ struct s1810c_ctl_packet { - - #define SC1810C_CTL_LINE_SW 0 - #define SC1810C_CTL_MUTE_SW 1 -+#define SC1824C_CTL_MONO_SW 2 - #define SC1810C_CTL_AB_SW 3 - #define SC1810C_CTL_48V_SW 4 - -@@ -123,6 +124,7 @@ struct s1810c_state_packet { - #define SC1810C_STATE_48V_SW 58 - #define SC1810C_STATE_LINE_SW 59 - #define SC1810C_STATE_MUTE_SW 60 -+#define SC1824C_STATE_MONO_SW 61 - #define SC1810C_STATE_AB_SW 62 - - struct s1810_mixer_state { -@@ -181,7 +183,7 @@ snd_sc1810c_get_status_field(struct usb_device *dev, - - pkt_out.fields[SC1810C_STATE_F1_IDX] = SC1810C_SET_STATE_F1; - pkt_out.fields[SC1810C_STATE_F2_IDX] = SC1810C_SET_STATE_F2; -- ret = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0), -+ ret = snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0), - SC1810C_SET_STATE_REQ, - SC1810C_SET_STATE_REQTYPE, - (*seqnum), 0, &pkt_out, sizeof(pkt_out)); -@@ -502,6 +504,15 @@ static const struct snd_kcontrol_new snd_s1810c_mute_sw = { - .private_value = (SC1810C_STATE_MUTE_SW | SC1810C_CTL_MUTE_SW << 8) - }; - -+static const struct snd_kcontrol_new snd_s1824c_mono_sw = { -+ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, -+ .name = "Mono Main Out Switch", -+ .info = snd_ctl_boolean_mono_info, -+ .get = snd_s1810c_switch_get, -+ .put = snd_s1810c_switch_set, -+ .private_value = (SC1824C_STATE_MONO_SW | SC1824C_CTL_MONO_SW << 8) -+}; -+ - static const struct snd_kcontrol_new snd_s1810c_48v_sw = { - .iface = SNDRV_CTL_ELEM_IFACE_MIXER, - .name = "48V Phantom Power On Mic Inputs Switch", -@@ -588,8 +599,17 @@ int snd_sc1810_init_mixer(struct usb_mixer_interface *mixer) - if (ret < 0) - return ret; - -- ret = snd_s1810c_switch_init(mixer, &snd_s1810c_ab_sw); -- if (ret < 0) -- return ret; -+ // The 1824c has a Mono Main switch instead of a -+ // A/B select switch. -+ if (mixer->chip->usb_id == USB_ID(0x194f, 0x010d)) { -+ ret = snd_s1810c_switch_init(mixer, &snd_s1824c_mono_sw); -+ if (ret < 0) -+ return ret; -+ } else if (mixer->chip->usb_id == USB_ID(0x194f, 0x010c)) { -+ ret = snd_s1810c_switch_init(mixer, &snd_s1810c_ab_sw); -+ if (ret < 0) -+ return ret; -+ } -+ - return ret; - } -diff --git a/sound/usb/validate.c b/sound/usb/validate.c -index a0d55b77c9941d..4bb4893f6e74f7 100644 ---- a/sound/usb/validate.c -+++ b/sound/usb/validate.c -@@ -266,7 +266,11 @@ static const struct usb_desc_validator audio_validators[] = { - FUNC(UAC_VERSION_2, UAC_MIXER_UNIT, validate_mixer_unit), - FUNC(UAC_VERSION_2, UAC_SELECTOR_UNIT, validate_selector_unit), - FUNC(UAC_VERSION_2, UAC_FEATURE_UNIT, validate_uac2_feature_unit), -- /* UAC_VERSION_2, UAC2_EFFECT_UNIT: not implemented yet */ -+ /* just a stop-gap, it should be a proper function for the array -+ * once if the unit is really parsed/used -+ */ -+ FIXED(UAC_VERSION_2, UAC2_EFFECT_UNIT, -+ struct uac2_effect_unit_descriptor), - FUNC(UAC_VERSION_2, UAC2_PROCESSING_UNIT_V2, validate_processing_unit), - FUNC(UAC_VERSION_2, UAC2_EXTENSION_UNIT_V2, validate_processing_unit), - FIXED(UAC_VERSION_2, UAC2_CLOCK_SOURCE, -@@ -286,7 +290,8 @@ static const struct usb_desc_validator audio_validators[] = { - FUNC(UAC_VERSION_3, UAC3_MIXER_UNIT, validate_mixer_unit), - FUNC(UAC_VERSION_3, UAC3_SELECTOR_UNIT, validate_selector_unit), - FUNC(UAC_VERSION_3, UAC3_FEATURE_UNIT, validate_uac3_feature_unit), -- /* UAC_VERSION_3, UAC3_EFFECT_UNIT: not implemented yet */ -+ FIXED(UAC_VERSION_3, UAC3_EFFECT_UNIT, -+ struct uac2_effect_unit_descriptor), /* sharing the same struct */ - FUNC(UAC_VERSION_3, UAC3_PROCESSING_UNIT, validate_processing_unit), - FUNC(UAC_VERSION_3, UAC3_EXTENSION_UNIT, validate_processing_unit), - FIXED(UAC_VERSION_3, UAC3_CLOCK_SOURCE, -diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c -index 1b7f6971460419..42c7b70f6996cb 100644 ---- a/tools/bpf/bpftool/btf_dumper.c -+++ b/tools/bpf/bpftool/btf_dumper.c -@@ -38,7 +38,7 @@ static int dump_prog_id_as_func_ptr(const struct btf_dumper *d, - __u32 info_len = sizeof(info); - const char *prog_name = NULL; - struct btf *prog_btf = NULL; -- struct bpf_func_info finfo; -+ struct bpf_func_info finfo = {}; - __u32 finfo_rec_size; - char prog_str[1024]; - int err; -diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c -index 174e076e56af2a..90fa7a8d0f4b36 100644 ---- a/tools/bpf/bpftool/prog.c -+++ b/tools/bpf/bpftool/prog.c -@@ -2203,7 +2203,7 @@ static void profile_print_readings(void) - - static char *profile_target_name(int tgt_fd) - { -- struct bpf_func_info func_info; -+ struct bpf_func_info func_info = {}; - struct bpf_prog_info info = {}; - __u32 info_len = sizeof(info); - const struct btf_type *t; -diff --git a/tools/include/linux/bitmap.h b/tools/include/linux/bitmap.h -index 210c13b1b8570b..926f3117d8e4fd 100644 ---- a/tools/include/linux/bitmap.h -+++ b/tools/include/linux/bitmap.h -@@ -3,6 +3,7 @@ - #define _TOOLS_LINUX_BITMAP_H - - #include -+#include - #include - #include - #include -diff --git a/tools/lib/bpf/bpf_tracing.h b/tools/lib/bpf/bpf_tracing.h -index 1c13f8e88833b4..66b925bd954eb5 100644 ---- a/tools/lib/bpf/bpf_tracing.h -+++ b/tools/lib/bpf/bpf_tracing.h -@@ -311,7 +311,7 @@ struct pt_regs___arm64 { - #define __PT_RET_REG regs[31] - #define __PT_FP_REG __unsupported__ - #define __PT_RC_REG gpr[3] --#define __PT_SP_REG sp -+#define __PT_SP_REG gpr[1] - #define __PT_IP_REG nip - - #elif defined(bpf_target_sparc) -diff --git a/tools/lib/thermal/Makefile b/tools/lib/thermal/Makefile -index 8890fd57b110cc..8d21ea1950a310 100644 ---- a/tools/lib/thermal/Makefile -+++ b/tools/lib/thermal/Makefile -@@ -59,8 +59,12 @@ else - CFLAGS := -g -Wall - endif - -+NL3_CFLAGS = $(shell pkg-config --cflags libnl-3.0 2>/dev/null) -+ifeq ($(NL3_CFLAGS),) -+NL3_CFLAGS = -I/usr/include/libnl3 -+endif -+ - INCLUDES = \ ---I/usr/include/libnl3 \ - -I$(srctree)/tools/lib/thermal/include \ - -I$(srctree)/tools/lib/ \ - -I$(srctree)/tools/include \ -@@ -72,6 +76,7 @@ INCLUDES = \ - override CFLAGS += $(EXTRA_WARNINGS) - override CFLAGS += -Werror -Wall - override CFLAGS += -fPIC -+override CFLAGS += $(NL3_CFLAGS) - override CFLAGS += $(INCLUDES) - override CFLAGS += -fvisibility=hidden - override CFGLAS += -Wl,-L. -@@ -147,7 +152,7 @@ endef - install_lib: libs - $(call QUIET_INSTALL, $(LIBTHERMAL_ALL)) \ - $(call do_install_mkdir,$(libdir_SQ)); \ -- cp -fpR $(LIBTHERMAL_ALL) $(DESTDIR)$(libdir_SQ) -+ cp -fR --preserve=mode,timestamp $(LIBTHERMAL_ALL) $(DESTDIR)$(libdir_SQ) - - install_headers: - $(call QUIET_INSTALL, headers) \ -diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c -index 4f0bbebcb6d62d..ea24f21aafc3e3 100644 ---- a/tools/perf/util/symbol.c -+++ b/tools/perf/util/symbol.c -@@ -1366,7 +1366,6 @@ static int dso__load_kcore(struct dso *dso, struct map *map, - goto out_err; - } - } -- map__zput(new_node->map); - free(new_node); - } - -diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c -index 479c5971aa6da2..c15d0de12357fb 100644 ---- a/tools/power/cpupower/lib/cpuidle.c -+++ b/tools/power/cpupower/lib/cpuidle.c -@@ -231,6 +231,7 @@ int cpuidle_state_disable(unsigned int cpu, - { - char value[SYSFS_PATH_MAX]; - int bytes_written; -+ int len; - - if (cpuidle_state_count(cpu) <= idlestate) - return -1; -@@ -239,10 +240,10 @@ int cpuidle_state_disable(unsigned int cpu, - idlestate_value_files[IDLESTATE_DISABLE])) - return -2; - -- snprintf(value, SYSFS_PATH_MAX, "%u", disable); -+ len = snprintf(value, SYSFS_PATH_MAX, "%u", disable); - - bytes_written = cpuidle_state_write_file(cpu, idlestate, "disable", -- value, sizeof(disable)); -+ value, len); - if (bytes_written) - return 0; - return -3; -diff --git a/tools/power/cpupower/lib/cpupower.c b/tools/power/cpupower/lib/cpupower.c -index 7a2ef691b20e1d..c2a7af89a67bb0 100644 ---- a/tools/power/cpupower/lib/cpupower.c -+++ b/tools/power/cpupower/lib/cpupower.c -@@ -55,7 +55,7 @@ unsigned int cpupower_write_sysfs(const char *path, char *buf, size_t buflen) - if (numwritten < 1) { - perror(path); - close(fd); -- return -1; -+ return 0; - } - - close(fd); -diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c -index ebda9c366b2ba3..891738116c8b29 100644 ---- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c -+++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c -@@ -62,6 +62,7 @@ unsigned char turbo_update_value; - unsigned char update_hwp_epp; - unsigned char update_hwp_min; - unsigned char update_hwp_max; -+unsigned char hwp_limits_done_via_sysfs; - unsigned char update_hwp_desired; - unsigned char update_hwp_window; - unsigned char update_hwp_use_pkg; -@@ -630,7 +631,7 @@ void cmdline(int argc, char **argv) - */ - FILE *fopen_or_die(const char *path, const char *mode) - { -- FILE *filep = fopen(path, "r"); -+ FILE *filep = fopen(path, mode); - - if (!filep) - err(1, "%s: open failed", path); -@@ -644,7 +645,7 @@ void err_on_hypervisor(void) - char *buffer; - - /* On VMs /proc/cpuinfo contains a "flags" entry for hypervisor */ -- cpuinfo = fopen_or_die("/proc/cpuinfo", "ro"); -+ cpuinfo = fopen_or_die("/proc/cpuinfo", "r"); - - buffer = malloc(4096); - if (!buffer) { -@@ -951,8 +952,10 @@ int ratio_2_sysfs_khz(int ratio) - } - /* - * If HWP is enabled and cpufreq sysfs attribtes are present, -- * then update sysfs, so that it will not become -- * stale when we write to MSRs. -+ * then update via sysfs. The intel_pstate driver may modify (clip) -+ * this request, say, when HWP_CAP is outside of PLATFORM_INFO limits, -+ * and the driver-chosen value takes precidence. -+ * - * (intel_pstate's max_perf_pct and min_perf_pct will follow cpufreq, - * so we don't have to touch that.) - */ -@@ -1007,6 +1010,8 @@ int update_sysfs(int cpu) - if (update_hwp_max) - update_cpufreq_scaling_freq(1, cpu, req_update.hwp_max); - -+ hwp_limits_done_via_sysfs = 1; -+ - return 0; - } - -@@ -1085,10 +1090,10 @@ int update_hwp_request(int cpu) - if (debug) - print_hwp_request(cpu, &req, "old: "); - -- if (update_hwp_min) -+ if (update_hwp_min && !hwp_limits_done_via_sysfs) - req.hwp_min = req_update.hwp_min; - -- if (update_hwp_max) -+ if (update_hwp_max && !hwp_limits_done_via_sysfs) - req.hwp_max = req_update.hwp_max; - - if (update_hwp_desired) -@@ -1166,13 +1171,18 @@ int update_hwp_request_pkg(int pkg) - - int enable_hwp_on_cpu(int cpu) - { -- unsigned long long msr; -+ unsigned long long old_msr, new_msr; -+ -+ get_msr(cpu, MSR_PM_ENABLE, &old_msr); -+ -+ if (old_msr & 1) -+ return 0; /* already enabled */ - -- get_msr(cpu, MSR_PM_ENABLE, &msr); -- put_msr(cpu, MSR_PM_ENABLE, 1); -+ new_msr = old_msr | 1; -+ put_msr(cpu, MSR_PM_ENABLE, new_msr); - - if (verbose) -- printf("cpu%d: MSR_PM_ENABLE old: %d new: %d\n", cpu, (unsigned int) msr, 1); -+ printf("cpu%d: MSR_PM_ENABLE old: %llX new: %llX\n", cpu, old_msr, new_msr); - - return 0; - } -diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile -index 5b61b8bb29f846..a670d5de302b96 100644 ---- a/tools/testing/selftests/Makefile -+++ b/tools/testing/selftests/Makefile -@@ -269,7 +269,7 @@ gen_tar: install - @echo "Created ${TAR_PATH}" - - clean: -- @for TARGET in $(TARGETS); do \ -+ @for TARGET in $(TARGETS) $(INSTALL_DEP_TARGETS); do \ - BUILD_TARGET=$$BUILD/$$TARGET; \ - $(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET clean;\ - done; -diff --git a/tools/testing/selftests/bpf/test_lirc_mode2_user.c b/tools/testing/selftests/bpf/test_lirc_mode2_user.c -index 4694422aa76c36..88e4aeab21b7bc 100644 ---- a/tools/testing/selftests/bpf/test_lirc_mode2_user.c -+++ b/tools/testing/selftests/bpf/test_lirc_mode2_user.c -@@ -74,7 +74,7 @@ int main(int argc, char **argv) - - /* Let's try detach it before it was ever attached */ - ret = bpf_prog_detach2(progfd, lircfd, BPF_LIRC_MODE2); -- if (ret != -1 || errno != ENOENT) { -+ if (ret != -ENOENT) { - printf("bpf_prog_detach2 not attached should fail: %m\n"); - return 1; - } -diff --git a/tools/testing/selftests/bpf/test_xsk.sh b/tools/testing/selftests/bpf/test_xsk.sh -index 2aa5a3445056ac..f4205823175a93 100755 ---- a/tools/testing/selftests/bpf/test_xsk.sh -+++ b/tools/testing/selftests/bpf/test_xsk.sh -@@ -203,4 +203,6 @@ done - - if [ $failures -eq 0 ]; then - echo "All tests successful!" -+else -+ exit 1 - fi -diff --git a/tools/testing/selftests/drivers/net/netdevsim/Makefile b/tools/testing/selftests/drivers/net/netdevsim/Makefile -new file mode 100644 -index 00000000000000..50932e13cb5a8b ---- /dev/null -+++ b/tools/testing/selftests/drivers/net/netdevsim/Makefile -@@ -0,0 +1,21 @@ -+# SPDX-License-Identifier: GPL-2.0+ OR MIT -+ -+TEST_PROGS = devlink.sh \ -+ devlink_in_netns.sh \ -+ devlink_trap.sh \ -+ ethtool-coalesce.sh \ -+ ethtool-fec.sh \ -+ ethtool-pause.sh \ -+ ethtool-ring.sh \ -+ fib.sh \ -+ hw_stats_l3.sh \ -+ nexthop.sh \ -+ psample.sh \ -+ tc-mq-visibility.sh \ -+ udp_tunnel_nic.sh \ -+ -+TEST_FILES := \ -+ ethtool-common.sh -+# end of TEST_FILES -+ -+include ../../../lib.mk -diff --git a/tools/testing/selftests/drivers/net/netdevsim/settings b/tools/testing/selftests/drivers/net/netdevsim/settings -new file mode 100644 -index 00000000000000..a62d2fa1275c6b ---- /dev/null -+++ b/tools/testing/selftests/drivers/net/netdevsim/settings -@@ -0,0 +1 @@ -+timeout=600 -diff --git a/tools/testing/selftests/ftrace/test.d/filter/event-filter-function.tc b/tools/testing/selftests/ftrace/test.d/filter/event-filter-function.tc -index 118247b8dd84d8..ed791b995a43fc 100644 ---- a/tools/testing/selftests/ftrace/test.d/filter/event-filter-function.tc -+++ b/tools/testing/selftests/ftrace/test.d/filter/event-filter-function.tc -@@ -20,6 +20,10 @@ sample_events() { - echo 0 > tracing_on - echo 0 > events/enable - -+# Clear functions caused by page cache; run sample_events twice -+sample_events -+sample_events -+ - echo "Get the most frequently calling function" - echo > trace - sample_events -diff --git a/tools/testing/selftests/iommu/iommufd.c b/tools/testing/selftests/iommu/iommufd.c -index 890a81f4ff6184..67fcc99fbd6d34 100644 ---- a/tools/testing/selftests/iommu/iommufd.c -+++ b/tools/testing/selftests/iommu/iommufd.c -@@ -1728,6 +1728,8 @@ TEST_F(vfio_compat_mock_domain, map) - ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_MAP_DMA, &map_cmd)); - ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_UNMAP_DMA, &unmap_cmd)); - ASSERT_EQ(BUFFER_SIZE, unmap_cmd.size); -+ /* Unmap of empty is success */ -+ ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_UNMAP_DMA, &unmap_cmd)); - - /* UNMAP_FLAG_ALL requres 0 iova/size */ - ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_MAP_DMA, &map_cmd)); -diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh -index d32a14ba069ac5..5d8f50cd38b7ed 100755 ---- a/tools/testing/selftests/net/fcnal-test.sh -+++ b/tools/testing/selftests/net/fcnal-test.sh -@@ -194,7 +194,7 @@ show_hint() - kill_procs() - { - killall nettest ping ping6 >/dev/null 2>&1 -- sleep 1 -+ slowwait 2 sh -c 'test -z "$(pgrep '"'^(nettest|ping|ping6)$'"')"' - } - - do_run_cmd() -@@ -423,6 +423,8 @@ create_ns() - ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.keep_addr_on_down=1 - ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.forwarding=1 - ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.forwarding=1 -+ ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.accept_dad=0 -+ ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.accept_dad=0 - } - - # create veth pair to connect namespaces and apply addresses. -@@ -865,7 +867,7 @@ ipv4_tcp_md5_novrf() - # basic use case - log_start - run_cmd nettest -s -M ${MD5_PW} -m ${NSB_IP} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} - log_test $? 0 "MD5: Single address config" - -@@ -873,7 +875,7 @@ ipv4_tcp_md5_novrf() - log_start - show_hint "Should timeout due to MD5 mismatch" - run_cmd nettest -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} - log_test $? 2 "MD5: Server no config, client uses password" - -@@ -881,7 +883,7 @@ ipv4_tcp_md5_novrf() - log_start - show_hint "Should timeout since client uses wrong password" - run_cmd nettest -s -M ${MD5_PW} -m ${NSB_IP} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} - log_test $? 2 "MD5: Client uses wrong password" - -@@ -889,7 +891,7 @@ ipv4_tcp_md5_novrf() - log_start - show_hint "Should timeout due to MD5 mismatch" - run_cmd nettest -s -M ${MD5_PW} -m ${NSB_LO_IP} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} - log_test $? 2 "MD5: Client address does not match address configured with password" - -@@ -900,7 +902,7 @@ ipv4_tcp_md5_novrf() - # client in prefix - log_start - run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} - log_test $? 0 "MD5: Prefix config" - -@@ -908,7 +910,7 @@ ipv4_tcp_md5_novrf() - log_start - show_hint "Should timeout since client uses wrong password" - run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} - log_test $? 2 "MD5: Prefix config, client uses wrong password" - -@@ -916,7 +918,7 @@ ipv4_tcp_md5_novrf() - log_start - show_hint "Should timeout due to MD5 mismatch" - run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -c ${NSB_LO_IP} -r ${NSA_IP} -X ${MD5_PW} - log_test $? 2 "MD5: Prefix config, client address not in configured prefix" - } -@@ -933,7 +935,7 @@ ipv4_tcp_md5() - # basic use case - log_start - run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} - log_test $? 0 "MD5: VRF: Single address config" - -@@ -941,7 +943,7 @@ ipv4_tcp_md5() - log_start - show_hint "Should timeout since server does not have MD5 auth" - run_cmd nettest -s -I ${VRF} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} - log_test $? 2 "MD5: VRF: Server no config, client uses password" - -@@ -949,7 +951,7 @@ ipv4_tcp_md5() - log_start - show_hint "Should timeout since client uses wrong password" - run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} - log_test $? 2 "MD5: VRF: Client uses wrong password" - -@@ -957,7 +959,7 @@ ipv4_tcp_md5() - log_start - show_hint "Should timeout since server config differs from client" - run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_LO_IP} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} - log_test $? 2 "MD5: VRF: Client address does not match address configured with password" - -@@ -968,7 +970,7 @@ ipv4_tcp_md5() - # client in prefix - log_start - run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} - log_test $? 0 "MD5: VRF: Prefix config" - -@@ -976,7 +978,7 @@ ipv4_tcp_md5() - log_start - show_hint "Should timeout since client uses wrong password" - run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} - log_test $? 2 "MD5: VRF: Prefix config, client uses wrong password" - -@@ -984,7 +986,7 @@ ipv4_tcp_md5() - log_start - show_hint "Should timeout since client address is outside of prefix" - run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -c ${NSB_LO_IP} -r ${NSA_IP} -X ${MD5_PW} - log_test $? 2 "MD5: VRF: Prefix config, client address not in configured prefix" - -@@ -995,14 +997,14 @@ ipv4_tcp_md5() - log_start - run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} & - run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} - log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF" - - log_start - run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} & - run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} - log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF" - -@@ -1010,7 +1012,7 @@ ipv4_tcp_md5() - show_hint "Should timeout since client in default VRF uses VRF password" - run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} & - run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW} - log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF with VRF pw" - -@@ -1018,21 +1020,21 @@ ipv4_tcp_md5() - show_hint "Should timeout since client in VRF uses default VRF password" - run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} & - run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} - log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF with default VRF pw" - - log_start - run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} & - run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} - log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF" - - log_start - run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} & - run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} - log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF" - -@@ -1040,7 +1042,7 @@ ipv4_tcp_md5() - show_hint "Should timeout since client in default VRF uses VRF password" - run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} & - run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW} - log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF with VRF pw" - -@@ -1048,7 +1050,7 @@ ipv4_tcp_md5() - show_hint "Should timeout since client in VRF uses default VRF password" - run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} & - run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} - log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF with default VRF pw" - -@@ -1072,14 +1074,14 @@ test_ipv4_md5_vrf__vrf_server__no_bind_ifindex() - log_start - show_hint "Simulates applications using VRF without TCP_MD5SIG_FLAG_IFINDEX" - run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} - log_test $? 0 "MD5: VRF: VRF-bound server, unbound key accepts connection" - - log_start - show_hint "Binding both the socket and the key is not required but it works" - run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} - log_test $? 0 "MD5: VRF: VRF-bound server, bound key accepts connection" - } -@@ -1093,25 +1095,25 @@ test_ipv4_md5_vrf__global_server__bind_ifindex0() - - log_start - run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} - log_test $? 2 "MD5: VRF: Global server, Key bound to ifindex=0 rejects VRF connection" - - log_start - run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW} - log_test $? 0 "MD5: VRF: Global server, key bound to ifindex=0 accepts non-VRF connection" - log_start - - run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} - log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts VRF connection" - - log_start - run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW} - log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts non-VRF connection" - -@@ -1183,7 +1185,7 @@ ipv4_tcp_novrf() - do - log_start - run_cmd nettest -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${a} - log_test_addr ${a} $? 0 "Global server" - done -@@ -1191,7 +1193,7 @@ ipv4_tcp_novrf() - a=${NSA_IP} - log_start - run_cmd nettest -s -I ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${a} - log_test_addr ${a} $? 0 "Device server" - -@@ -1211,13 +1213,13 @@ ipv4_tcp_novrf() - do - log_start - run_cmd_nsb nettest -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 tcp - run_cmd nettest -r ${a} -0 ${NSA_IP} - log_test_addr ${a} $? 0 "Client" - - log_start - run_cmd_nsb nettest -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 tcp - run_cmd nettest -r ${a} -d ${NSA_DEV} - log_test_addr ${a} $? 0 "Client, device bind" - -@@ -1239,7 +1241,7 @@ ipv4_tcp_novrf() - do - log_start - run_cmd nettest -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -r ${a} -0 ${a} -1 ${a} - log_test_addr ${a} $? 0 "Global server, local connection" - done -@@ -1247,7 +1249,7 @@ ipv4_tcp_novrf() - a=${NSA_IP} - log_start - run_cmd nettest -s -I ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -r ${a} -0 ${a} - log_test_addr ${a} $? 0 "Device server, unbound client, local connection" - -@@ -1256,7 +1258,7 @@ ipv4_tcp_novrf() - log_start - show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope" - run_cmd nettest -s -I ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -r ${a} - log_test_addr ${a} $? 1 "Device server, unbound client, local connection" - done -@@ -1264,7 +1266,7 @@ ipv4_tcp_novrf() - a=${NSA_IP} - log_start - run_cmd nettest -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -r ${a} -0 ${a} -d ${NSA_DEV} - log_test_addr ${a} $? 0 "Global server, device client, local connection" - -@@ -1273,7 +1275,7 @@ ipv4_tcp_novrf() - log_start - show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope" - run_cmd nettest -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -r ${a} -d ${NSA_DEV} - log_test_addr ${a} $? 1 "Global server, device client, local connection" - done -@@ -1281,7 +1283,7 @@ ipv4_tcp_novrf() - a=${NSA_IP} - log_start - run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -d ${NSA_DEV} -r ${a} -0 ${a} - log_test_addr ${a} $? 0 "Device server, device client, local connection" - -@@ -1313,19 +1315,19 @@ ipv4_tcp_vrf() - log_start - show_hint "Should fail 'Connection refused' since global server with VRF is disabled" - run_cmd nettest -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${a} - log_test_addr ${a} $? 1 "Global server" - - log_start - run_cmd nettest -s -I ${VRF} -3 ${VRF} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${a} - log_test_addr ${a} $? 0 "VRF server" - - log_start - run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${a} - log_test_addr ${a} $? 0 "Device server" - -@@ -1342,7 +1344,7 @@ ipv4_tcp_vrf() - log_start - show_hint "Should fail 'Connection refused' since global server with VRF is disabled" - run_cmd nettest -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -r ${a} -d ${NSA_DEV} - log_test_addr ${a} $? 1 "Global server, local connection" - -@@ -1364,14 +1366,14 @@ ipv4_tcp_vrf() - log_start - show_hint "client socket should be bound to VRF" - run_cmd nettest -s -3 ${VRF} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${a} - log_test_addr ${a} $? 0 "Global server" - - log_start - show_hint "client socket should be bound to VRF" - run_cmd nettest -s -I ${VRF} -3 ${VRF} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${a} - log_test_addr ${a} $? 0 "VRF server" - -@@ -1386,7 +1388,7 @@ ipv4_tcp_vrf() - log_start - show_hint "client socket should be bound to device" - run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${a} - log_test_addr ${a} $? 0 "Device server" - -@@ -1396,7 +1398,7 @@ ipv4_tcp_vrf() - log_start - show_hint "Should fail 'Connection refused' since client is not bound to VRF" - run_cmd nettest -s -I ${VRF} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -r ${a} - log_test_addr ${a} $? 1 "Global server, local connection" - done -@@ -1408,13 +1410,13 @@ ipv4_tcp_vrf() - do - log_start - run_cmd_nsb nettest -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 tcp - run_cmd nettest -r ${a} -d ${VRF} - log_test_addr ${a} $? 0 "Client, VRF bind" - - log_start - run_cmd_nsb nettest -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 tcp - run_cmd nettest -r ${a} -d ${NSA_DEV} - log_test_addr ${a} $? 0 "Client, device bind" - -@@ -1433,7 +1435,7 @@ ipv4_tcp_vrf() - do - log_start - run_cmd nettest -s -I ${VRF} -3 ${VRF} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -r ${a} -d ${VRF} -0 ${a} - log_test_addr ${a} $? 0 "VRF server, VRF client, local connection" - done -@@ -1441,26 +1443,26 @@ ipv4_tcp_vrf() - a=${NSA_IP} - log_start - run_cmd nettest -s -I ${VRF} -3 ${VRF} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -r ${a} -d ${NSA_DEV} -0 ${a} - log_test_addr ${a} $? 0 "VRF server, device client, local connection" - - log_start - show_hint "Should fail 'No route to host' since client is out of VRF scope" - run_cmd nettest -s -I ${VRF} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -r ${a} - log_test_addr ${a} $? 1 "VRF server, unbound client, local connection" - - log_start - run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -r ${a} -d ${VRF} -0 ${a} - log_test_addr ${a} $? 0 "Device server, VRF client, local connection" - - log_start - run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -r ${a} -d ${NSA_DEV} -0 ${a} - log_test_addr ${a} $? 0 "Device server, device client, local connection" - } -@@ -1499,7 +1501,7 @@ ipv4_udp_novrf() - do - log_start - run_cmd nettest -D -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd_nsb nettest -D -r ${a} - log_test_addr ${a} $? 0 "Global server" - -@@ -1512,7 +1514,7 @@ ipv4_udp_novrf() - a=${NSA_IP} - log_start - run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd_nsb nettest -D -r ${a} - log_test_addr ${a} $? 0 "Device server" - -@@ -1523,31 +1525,31 @@ ipv4_udp_novrf() - do - log_start - run_cmd_nsb nettest -D -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 udp - run_cmd nettest -D -r ${a} -0 ${NSA_IP} - log_test_addr ${a} $? 0 "Client" - - log_start - run_cmd_nsb nettest -D -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 udp - run_cmd nettest -D -r ${a} -d ${NSA_DEV} -0 ${NSA_IP} - log_test_addr ${a} $? 0 "Client, device bind" - - log_start - run_cmd_nsb nettest -D -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 udp - run_cmd nettest -D -r ${a} -d ${NSA_DEV} -C -0 ${NSA_IP} - log_test_addr ${a} $? 0 "Client, device send via cmsg" - - log_start - run_cmd_nsb nettest -D -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 udp - run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP} - log_test_addr ${a} $? 0 "Client, device bind via IP_UNICAST_IF" - - log_start - run_cmd_nsb nettest -D -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 udp - run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP} -U - log_test_addr ${a} $? 0 "Client, device bind via IP_UNICAST_IF, with connect()" - -@@ -1570,7 +1572,7 @@ ipv4_udp_novrf() - do - log_start - run_cmd nettest -D -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -r ${a} -0 ${a} -1 ${a} - log_test_addr ${a} $? 0 "Global server, local connection" - done -@@ -1578,7 +1580,7 @@ ipv4_udp_novrf() - a=${NSA_IP} - log_start - run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -r ${a} - log_test_addr ${a} $? 0 "Device server, unbound client, local connection" - -@@ -1587,7 +1589,7 @@ ipv4_udp_novrf() - log_start - show_hint "Should fail 'Connection refused' since address is out of device scope" - run_cmd nettest -s -D -I ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -r ${a} - log_test_addr ${a} $? 1 "Device server, unbound client, local connection" - done -@@ -1595,25 +1597,25 @@ ipv4_udp_novrf() - a=${NSA_IP} - log_start - run_cmd nettest -s -D & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -d ${NSA_DEV} -r ${a} - log_test_addr ${a} $? 0 "Global server, device client, local connection" - - log_start - run_cmd nettest -s -D & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -d ${NSA_DEV} -C -r ${a} - log_test_addr ${a} $? 0 "Global server, device send via cmsg, local connection" - - log_start - run_cmd nettest -s -D & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -d ${NSA_DEV} -S -r ${a} - log_test_addr ${a} $? 0 "Global server, device client via IP_UNICAST_IF, local connection" - - log_start - run_cmd nettest -s -D & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -d ${NSA_DEV} -S -r ${a} -U - log_test_addr ${a} $? 0 "Global server, device client via IP_UNICAST_IF, local connection, with connect()" - -@@ -1626,28 +1628,28 @@ ipv4_udp_novrf() - log_start - show_hint "Should fail since addresses on loopback are out of device scope" - run_cmd nettest -D -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -r ${a} -d ${NSA_DEV} - log_test_addr ${a} $? 2 "Global server, device client, local connection" - - log_start - show_hint "Should fail since addresses on loopback are out of device scope" - run_cmd nettest -D -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -r ${a} -d ${NSA_DEV} -C - log_test_addr ${a} $? 1 "Global server, device send via cmsg, local connection" - - log_start - show_hint "Should fail since addresses on loopback are out of device scope" - run_cmd nettest -D -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S - log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection" - - log_start - show_hint "Should fail since addresses on loopback are out of device scope" - run_cmd nettest -D -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -U - log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection, with connect()" - -@@ -1657,7 +1659,7 @@ ipv4_udp_novrf() - a=${NSA_IP} - log_start - run_cmd nettest -D -s -I ${NSA_DEV} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -d ${NSA_DEV} -r ${a} -0 ${a} - log_test_addr ${a} $? 0 "Device server, device client, local conn" - -@@ -1699,19 +1701,19 @@ ipv4_udp_vrf() - log_start - show_hint "Fails because ingress is in a VRF and global server is disabled" - run_cmd nettest -D -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd_nsb nettest -D -r ${a} - log_test_addr ${a} $? 1 "Global server" - - log_start - run_cmd nettest -D -I ${VRF} -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd_nsb nettest -D -r ${a} - log_test_addr ${a} $? 0 "VRF server" - - log_start - run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd_nsb nettest -D -r ${a} - log_test_addr ${a} $? 0 "Enslaved device server" - -@@ -1723,7 +1725,7 @@ ipv4_udp_vrf() - log_start - show_hint "Should fail 'Connection refused' since global server is out of scope" - run_cmd nettest -D -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -d ${VRF} -r ${a} - log_test_addr ${a} $? 1 "Global server, VRF client, local connection" - done -@@ -1731,26 +1733,26 @@ ipv4_udp_vrf() - a=${NSA_IP} - log_start - run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -d ${VRF} -r ${a} - log_test_addr ${a} $? 0 "VRF server, VRF client, local conn" - - log_start - run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -d ${NSA_DEV} -r ${a} - log_test_addr ${a} $? 0 "VRF server, enslaved device client, local connection" - - a=${NSA_IP} - log_start - run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -d ${VRF} -r ${a} - log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn" - - log_start - run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -d ${NSA_DEV} -r ${a} - log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn" - -@@ -1765,19 +1767,19 @@ ipv4_udp_vrf() - do - log_start - run_cmd nettest -D -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd_nsb nettest -D -r ${a} - log_test_addr ${a} $? 0 "Global server" - - log_start - run_cmd nettest -D -I ${VRF} -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd_nsb nettest -D -r ${a} - log_test_addr ${a} $? 0 "VRF server" - - log_start - run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd_nsb nettest -D -r ${a} - log_test_addr ${a} $? 0 "Enslaved device server" - -@@ -1792,13 +1794,13 @@ ipv4_udp_vrf() - # - log_start - run_cmd_nsb nettest -D -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 udp - run_cmd nettest -d ${VRF} -D -r ${NSB_IP} -1 ${NSA_IP} - log_test $? 0 "VRF client" - - log_start - run_cmd_nsb nettest -D -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 udp - run_cmd nettest -d ${NSA_DEV} -D -r ${NSB_IP} -1 ${NSA_IP} - log_test $? 0 "Enslaved device client" - -@@ -1819,31 +1821,31 @@ ipv4_udp_vrf() - a=${NSA_IP} - log_start - run_cmd nettest -D -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -d ${VRF} -r ${a} - log_test_addr ${a} $? 0 "Global server, VRF client, local conn" - - log_start - run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -d ${VRF} -r ${a} - log_test_addr ${a} $? 0 "VRF server, VRF client, local conn" - - log_start - run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -d ${NSA_DEV} -r ${a} - log_test_addr ${a} $? 0 "VRF server, device client, local conn" - - log_start - run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -d ${VRF} -r ${a} - log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn" - - log_start - run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -d ${NSA_DEV} -r ${a} - log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn" - -@@ -1851,7 +1853,7 @@ ipv4_udp_vrf() - do - log_start - run_cmd nettest -D -s -3 ${VRF} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -d ${VRF} -r ${a} - log_test_addr ${a} $? 0 "Global server, VRF client, local conn" - done -@@ -1860,7 +1862,7 @@ ipv4_udp_vrf() - do - log_start - run_cmd nettest -s -D -I ${VRF} -3 ${VRF} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -D -d ${VRF} -r ${a} - log_test_addr ${a} $? 0 "VRF server, VRF client, local conn" - done -@@ -2083,7 +2085,7 @@ ipv4_rt() - do - log_start - run_cmd nettest ${varg} -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest ${varg} -r ${a} & - sleep 3 - run_cmd ip link del ${VRF} -@@ -2097,7 +2099,7 @@ ipv4_rt() - do - log_start - run_cmd nettest ${varg} -s -I ${VRF} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest ${varg} -r ${a} & - sleep 3 - run_cmd ip link del ${VRF} -@@ -2110,7 +2112,7 @@ ipv4_rt() - a=${NSA_IP} - log_start - run_cmd nettest ${varg} -s -I ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest ${varg} -r ${a} & - sleep 3 - run_cmd ip link del ${VRF} -@@ -2124,7 +2126,7 @@ ipv4_rt() - # - log_start - run_cmd_nsb nettest ${varg} -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 tcp - run_cmd nettest ${varg} -d ${VRF} -r ${NSB_IP} & - sleep 3 - run_cmd ip link del ${VRF} -@@ -2135,7 +2137,7 @@ ipv4_rt() - - log_start - run_cmd_nsb nettest ${varg} -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 tcp - run_cmd nettest ${varg} -d ${NSA_DEV} -r ${NSB_IP} & - sleep 3 - run_cmd ip link del ${VRF} -@@ -2151,7 +2153,7 @@ ipv4_rt() - do - log_start - run_cmd nettest ${varg} -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest ${varg} -d ${VRF} -r ${a} & - sleep 3 - run_cmd ip link del ${VRF} -@@ -2165,7 +2167,7 @@ ipv4_rt() - do - log_start - run_cmd nettest ${varg} -I ${VRF} -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest ${varg} -d ${VRF} -r ${a} & - sleep 3 - run_cmd ip link del ${VRF} -@@ -2179,7 +2181,7 @@ ipv4_rt() - log_start - - run_cmd nettest ${varg} -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} & - sleep 3 - run_cmd ip link del ${VRF} -@@ -2190,7 +2192,7 @@ ipv4_rt() - - log_start - run_cmd nettest ${varg} -I ${VRF} -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} & - sleep 3 - run_cmd ip link del ${VRF} -@@ -2201,7 +2203,7 @@ ipv4_rt() - - log_start - run_cmd nettest ${varg} -I ${NSA_DEV} -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} & - sleep 3 - run_cmd ip link del ${VRF} -@@ -2551,7 +2553,7 @@ ipv6_tcp_md5_novrf() - # basic use case - log_start - run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_IP6} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} - log_test $? 0 "MD5: Single address config" - -@@ -2559,7 +2561,7 @@ ipv6_tcp_md5_novrf() - log_start - show_hint "Should timeout due to MD5 mismatch" - run_cmd nettest -6 -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} - log_test $? 2 "MD5: Server no config, client uses password" - -@@ -2567,7 +2569,7 @@ ipv6_tcp_md5_novrf() - log_start - show_hint "Should timeout since client uses wrong password" - run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_IP6} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} - log_test $? 2 "MD5: Client uses wrong password" - -@@ -2575,7 +2577,7 @@ ipv6_tcp_md5_novrf() - log_start - show_hint "Should timeout due to MD5 mismatch" - run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_LO_IP6} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} - log_test $? 2 "MD5: Client address does not match address configured with password" - -@@ -2586,7 +2588,7 @@ ipv6_tcp_md5_novrf() - # client in prefix - log_start - run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} - log_test $? 0 "MD5: Prefix config" - -@@ -2594,7 +2596,7 @@ ipv6_tcp_md5_novrf() - log_start - show_hint "Should timeout since client uses wrong password" - run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} - log_test $? 2 "MD5: Prefix config, client uses wrong password" - -@@ -2602,7 +2604,7 @@ ipv6_tcp_md5_novrf() - log_start - show_hint "Should timeout due to MD5 mismatch" - run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -c ${NSB_LO_IP6} -r ${NSA_IP6} -X ${MD5_PW} - log_test $? 2 "MD5: Prefix config, client address not in configured prefix" - } -@@ -2619,7 +2621,7 @@ ipv6_tcp_md5() - # basic use case - log_start - run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} - log_test $? 0 "MD5: VRF: Single address config" - -@@ -2627,7 +2629,7 @@ ipv6_tcp_md5() - log_start - show_hint "Should timeout since server does not have MD5 auth" - run_cmd nettest -6 -s -I ${VRF} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} - log_test $? 2 "MD5: VRF: Server no config, client uses password" - -@@ -2635,7 +2637,7 @@ ipv6_tcp_md5() - log_start - show_hint "Should timeout since client uses wrong password" - run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} - log_test $? 2 "MD5: VRF: Client uses wrong password" - -@@ -2643,7 +2645,7 @@ ipv6_tcp_md5() - log_start - show_hint "Should timeout since server config differs from client" - run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_LO_IP6} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} - log_test $? 2 "MD5: VRF: Client address does not match address configured with password" - -@@ -2654,7 +2656,7 @@ ipv6_tcp_md5() - # client in prefix - log_start - run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} - log_test $? 0 "MD5: VRF: Prefix config" - -@@ -2662,7 +2664,7 @@ ipv6_tcp_md5() - log_start - show_hint "Should timeout since client uses wrong password" - run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} - log_test $? 2 "MD5: VRF: Prefix config, client uses wrong password" - -@@ -2670,7 +2672,7 @@ ipv6_tcp_md5() - log_start - show_hint "Should timeout since client address is outside of prefix" - run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -c ${NSB_LO_IP6} -r ${NSA_IP6} -X ${MD5_PW} - log_test $? 2 "MD5: VRF: Prefix config, client address not in configured prefix" - -@@ -2681,14 +2683,14 @@ ipv6_tcp_md5() - log_start - run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} & - run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} - log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF" - - log_start - run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} & - run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} - log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF" - -@@ -2696,7 +2698,7 @@ ipv6_tcp_md5() - show_hint "Should timeout since client in default VRF uses VRF password" - run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} & - run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_PW} - log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF with VRF pw" - -@@ -2704,21 +2706,21 @@ ipv6_tcp_md5() - show_hint "Should timeout since client in VRF uses default VRF password" - run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} & - run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} - log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF with default VRF pw" - - log_start - run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} & - run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} - log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF" - - log_start - run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} & - run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} - log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF" - -@@ -2726,7 +2728,7 @@ ipv6_tcp_md5() - show_hint "Should timeout since client in default VRF uses VRF password" - run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} & - run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_PW} - log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF with VRF pw" - -@@ -2734,7 +2736,7 @@ ipv6_tcp_md5() - show_hint "Should timeout since client in VRF uses default VRF password" - run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} & - run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} - log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF with default VRF pw" - -@@ -2762,7 +2764,7 @@ ipv6_tcp_novrf() - do - log_start - run_cmd nettest -6 -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${a} - log_test_addr ${a} $? 0 "Global server" - done -@@ -2783,7 +2785,7 @@ ipv6_tcp_novrf() - do - log_start - run_cmd_nsb nettest -6 -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 tcp - run_cmd nettest -6 -r ${a} - log_test_addr ${a} $? 0 "Client" - done -@@ -2792,7 +2794,7 @@ ipv6_tcp_novrf() - do - log_start - run_cmd_nsb nettest -6 -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 tcp - run_cmd nettest -6 -r ${a} -d ${NSA_DEV} - log_test_addr ${a} $? 0 "Client, device bind" - done -@@ -2812,7 +2814,7 @@ ipv6_tcp_novrf() - do - log_start - run_cmd nettest -6 -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -6 -r ${a} - log_test_addr ${a} $? 0 "Global server, local connection" - done -@@ -2820,7 +2822,7 @@ ipv6_tcp_novrf() - a=${NSA_IP6} - log_start - run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -6 -r ${a} -0 ${a} - log_test_addr ${a} $? 0 "Device server, unbound client, local connection" - -@@ -2829,7 +2831,7 @@ ipv6_tcp_novrf() - log_start - show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope" - run_cmd nettest -6 -s -I ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -6 -r ${a} - log_test_addr ${a} $? 1 "Device server, unbound client, local connection" - done -@@ -2837,7 +2839,7 @@ ipv6_tcp_novrf() - a=${NSA_IP6} - log_start - run_cmd nettest -6 -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a} - log_test_addr ${a} $? 0 "Global server, device client, local connection" - -@@ -2846,7 +2848,7 @@ ipv6_tcp_novrf() - log_start - show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope" - run_cmd nettest -6 -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -6 -r ${a} -d ${NSA_DEV} - log_test_addr ${a} $? 1 "Global server, device client, local connection" - done -@@ -2855,7 +2857,7 @@ ipv6_tcp_novrf() - do - log_start - run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -6 -d ${NSA_DEV} -r ${a} - log_test_addr ${a} $? 0 "Device server, device client, local conn" - done -@@ -2888,7 +2890,7 @@ ipv6_tcp_vrf() - log_start - show_hint "Should fail 'Connection refused' since global server with VRF is disabled" - run_cmd nettest -6 -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${a} - log_test_addr ${a} $? 1 "Global server" - done -@@ -2897,7 +2899,7 @@ ipv6_tcp_vrf() - do - log_start - run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${a} - log_test_addr ${a} $? 0 "VRF server" - done -@@ -2906,7 +2908,7 @@ ipv6_tcp_vrf() - a=${NSA_LINKIP6}%${NSB_DEV} - log_start - run_cmd nettest -6 -s -I ${VRF} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${a} - log_test_addr ${a} $? 0 "VRF server" - -@@ -2914,7 +2916,7 @@ ipv6_tcp_vrf() - do - log_start - run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${a} - log_test_addr ${a} $? 0 "Device server" - done -@@ -2933,7 +2935,7 @@ ipv6_tcp_vrf() - log_start - show_hint "Should fail 'Connection refused' since global server with VRF is disabled" - run_cmd nettest -6 -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -6 -r ${a} -d ${NSA_DEV} - log_test_addr ${a} $? 1 "Global server, local connection" - -@@ -2954,7 +2956,7 @@ ipv6_tcp_vrf() - do - log_start - run_cmd nettest -6 -s -3 ${VRF} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${a} - log_test_addr ${a} $? 0 "Global server" - done -@@ -2963,7 +2965,7 @@ ipv6_tcp_vrf() - do - log_start - run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${a} - log_test_addr ${a} $? 0 "VRF server" - done -@@ -2972,13 +2974,13 @@ ipv6_tcp_vrf() - a=${NSA_LINKIP6}%${NSB_DEV} - log_start - run_cmd nettest -6 -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${a} - log_test_addr ${a} $? 0 "Global server" - - log_start - run_cmd nettest -6 -s -I ${VRF} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${a} - log_test_addr ${a} $? 0 "VRF server" - -@@ -2986,7 +2988,7 @@ ipv6_tcp_vrf() - do - log_start - run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${a} - log_test_addr ${a} $? 0 "Device server" - done -@@ -3006,7 +3008,7 @@ ipv6_tcp_vrf() - log_start - show_hint "Fails 'Connection refused' since client is not in VRF" - run_cmd nettest -6 -s -I ${VRF} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -6 -r ${a} - log_test_addr ${a} $? 1 "Global server, local connection" - done -@@ -3019,7 +3021,7 @@ ipv6_tcp_vrf() - do - log_start - run_cmd_nsb nettest -6 -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 tcp - run_cmd nettest -6 -r ${a} -d ${VRF} - log_test_addr ${a} $? 0 "Client, VRF bind" - done -@@ -3028,7 +3030,7 @@ ipv6_tcp_vrf() - log_start - show_hint "Fails since VRF device does not allow linklocal addresses" - run_cmd_nsb nettest -6 -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 tcp - run_cmd nettest -6 -r ${a} -d ${VRF} - log_test_addr ${a} $? 1 "Client, VRF bind" - -@@ -3036,7 +3038,7 @@ ipv6_tcp_vrf() - do - log_start - run_cmd_nsb nettest -6 -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 tcp - run_cmd nettest -6 -r ${a} -d ${NSA_DEV} - log_test_addr ${a} $? 0 "Client, device bind" - done -@@ -3061,7 +3063,7 @@ ipv6_tcp_vrf() - do - log_start - run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -6 -r ${a} -d ${VRF} -0 ${a} - log_test_addr ${a} $? 0 "VRF server, VRF client, local connection" - done -@@ -3069,7 +3071,7 @@ ipv6_tcp_vrf() - a=${NSA_IP6} - log_start - run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a} - log_test_addr ${a} $? 0 "VRF server, device client, local connection" - -@@ -3077,13 +3079,13 @@ ipv6_tcp_vrf() - log_start - show_hint "Should fail since unbound client is out of VRF scope" - run_cmd nettest -6 -s -I ${VRF} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -6 -r ${a} - log_test_addr ${a} $? 1 "VRF server, unbound client, local connection" - - log_start - run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -6 -r ${a} -d ${VRF} -0 ${a} - log_test_addr ${a} $? 0 "Device server, VRF client, local connection" - -@@ -3091,7 +3093,7 @@ ipv6_tcp_vrf() - do - log_start - run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a} - log_test_addr ${a} $? 0 "Device server, device client, local connection" - done -@@ -3131,13 +3133,13 @@ ipv6_udp_novrf() - do - log_start - run_cmd nettest -6 -D -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd_nsb nettest -6 -D -r ${a} - log_test_addr ${a} $? 0 "Global server" - - log_start - run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd_nsb nettest -6 -D -r ${a} - log_test_addr ${a} $? 0 "Device server" - done -@@ -3145,7 +3147,7 @@ ipv6_udp_novrf() - a=${NSA_LO_IP6} - log_start - run_cmd nettest -6 -D -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd_nsb nettest -6 -D -r ${a} - log_test_addr ${a} $? 0 "Global server" - -@@ -3155,7 +3157,7 @@ ipv6_udp_novrf() - #log_start - #show_hint "Should fail since loopback address is out of scope" - #run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & -- #sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - #run_cmd_nsb nettest -6 -D -r ${a} - #log_test_addr ${a} $? 1 "Device server" - -@@ -3175,25 +3177,25 @@ ipv6_udp_novrf() - do - log_start - run_cmd_nsb nettest -6 -D -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 udp - run_cmd nettest -6 -D -r ${a} -0 ${NSA_IP6} - log_test_addr ${a} $? 0 "Client" - - log_start - run_cmd_nsb nettest -6 -D -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 udp - run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -0 ${NSA_IP6} - log_test_addr ${a} $? 0 "Client, device bind" - - log_start - run_cmd_nsb nettest -6 -D -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 udp - run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -C -0 ${NSA_IP6} - log_test_addr ${a} $? 0 "Client, device send via cmsg" - - log_start - run_cmd_nsb nettest -6 -D -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 udp - run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP6} - log_test_addr ${a} $? 0 "Client, device bind via IPV6_UNICAST_IF" - -@@ -3215,7 +3217,7 @@ ipv6_udp_novrf() - do - log_start - run_cmd nettest -6 -D -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -r ${a} -0 ${a} -1 ${a} - log_test_addr ${a} $? 0 "Global server, local connection" - done -@@ -3223,7 +3225,7 @@ ipv6_udp_novrf() - a=${NSA_IP6} - log_start - run_cmd nettest -6 -s -D -I ${NSA_DEV} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -r ${a} - log_test_addr ${a} $? 0 "Device server, unbound client, local connection" - -@@ -3232,7 +3234,7 @@ ipv6_udp_novrf() - log_start - show_hint "Should fail 'Connection refused' since address is out of device scope" - run_cmd nettest -6 -s -D -I ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -r ${a} - log_test_addr ${a} $? 1 "Device server, local connection" - done -@@ -3240,19 +3242,19 @@ ipv6_udp_novrf() - a=${NSA_IP6} - log_start - run_cmd nettest -6 -s -D & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} - log_test_addr ${a} $? 0 "Global server, device client, local connection" - - log_start - run_cmd nettest -6 -s -D & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -d ${NSA_DEV} -C -r ${a} - log_test_addr ${a} $? 0 "Global server, device send via cmsg, local connection" - - log_start - run_cmd nettest -6 -s -D & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -d ${NSA_DEV} -S -r ${a} - log_test_addr ${a} $? 0 "Global server, device client via IPV6_UNICAST_IF, local connection" - -@@ -3261,28 +3263,28 @@ ipv6_udp_novrf() - log_start - show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope" - run_cmd nettest -6 -D -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} - log_test_addr ${a} $? 1 "Global server, device client, local connection" - - log_start - show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope" - run_cmd nettest -6 -D -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -C - log_test_addr ${a} $? 1 "Global server, device send via cmsg, local connection" - - log_start - show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope" - run_cmd nettest -6 -D -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S - log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection" - - log_start - show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope" - run_cmd nettest -6 -D -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S -U - log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection, with connect()" - done -@@ -3290,7 +3292,7 @@ ipv6_udp_novrf() - a=${NSA_IP6} - log_start - run_cmd nettest -6 -D -s -I ${NSA_DEV} -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} -0 ${a} - log_test_addr ${a} $? 0 "Device server, device client, local conn" - -@@ -3304,7 +3306,7 @@ ipv6_udp_novrf() - run_cmd_nsb ip -6 ro add ${NSA_IP6}/128 dev ${NSB_DEV} - log_start - run_cmd nettest -6 -s -D & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd_nsb nettest -6 -D -r ${NSA_IP6} - log_test $? 0 "UDP in - LLA to GUA" - -@@ -3328,7 +3330,7 @@ ipv6_udp_vrf() - log_start - show_hint "Should fail 'Connection refused' since global server is disabled" - run_cmd nettest -6 -D -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd_nsb nettest -6 -D -r ${a} - log_test_addr ${a} $? 1 "Global server" - done -@@ -3337,7 +3339,7 @@ ipv6_udp_vrf() - do - log_start - run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd_nsb nettest -6 -D -r ${a} - log_test_addr ${a} $? 0 "VRF server" - done -@@ -3346,7 +3348,7 @@ ipv6_udp_vrf() - do - log_start - run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd_nsb nettest -6 -D -r ${a} - log_test_addr ${a} $? 0 "Enslaved device server" - done -@@ -3368,7 +3370,7 @@ ipv6_udp_vrf() - log_start - show_hint "Should fail 'Connection refused' since global server is disabled" - run_cmd nettest -6 -D -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -d ${VRF} -r ${a} - log_test_addr ${a} $? 1 "Global server, VRF client, local conn" - done -@@ -3377,7 +3379,7 @@ ipv6_udp_vrf() - do - log_start - run_cmd nettest -6 -D -I ${VRF} -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -d ${VRF} -r ${a} - log_test_addr ${a} $? 0 "VRF server, VRF client, local conn" - done -@@ -3386,25 +3388,25 @@ ipv6_udp_vrf() - log_start - show_hint "Should fail 'Connection refused' since global server is disabled" - run_cmd nettest -6 -D -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} - log_test_addr ${a} $? 1 "Global server, device client, local conn" - - log_start - run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} - log_test_addr ${a} $? 0 "VRF server, device client, local conn" - - log_start - run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -d ${VRF} -r ${a} - log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn" - - log_start - run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} - log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn" - -@@ -3419,7 +3421,7 @@ ipv6_udp_vrf() - do - log_start - run_cmd nettest -6 -D -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd_nsb nettest -6 -D -r ${a} - log_test_addr ${a} $? 0 "Global server" - done -@@ -3428,7 +3430,7 @@ ipv6_udp_vrf() - do - log_start - run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd_nsb nettest -6 -D -r ${a} - log_test_addr ${a} $? 0 "VRF server" - done -@@ -3437,7 +3439,7 @@ ipv6_udp_vrf() - do - log_start - run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd_nsb nettest -6 -D -r ${a} - log_test_addr ${a} $? 0 "Enslaved device server" - done -@@ -3455,7 +3457,7 @@ ipv6_udp_vrf() - # - log_start - run_cmd_nsb nettest -6 -D -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 udp - run_cmd nettest -6 -D -d ${VRF} -r ${NSB_IP6} - log_test $? 0 "VRF client" - -@@ -3466,7 +3468,7 @@ ipv6_udp_vrf() - - log_start - run_cmd_nsb nettest -6 -D -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 udp - run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_IP6} - log_test $? 0 "Enslaved device client" - -@@ -3481,13 +3483,13 @@ ipv6_udp_vrf() - a=${NSA_IP6} - log_start - run_cmd nettest -6 -D -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -d ${VRF} -r ${a} - log_test_addr ${a} $? 0 "Global server, VRF client, local conn" - - #log_start - run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -d ${VRF} -r ${a} - log_test_addr ${a} $? 0 "VRF server, VRF client, local conn" - -@@ -3495,13 +3497,13 @@ ipv6_udp_vrf() - a=${VRF_IP6} - log_start - run_cmd nettest -6 -D -s -3 ${VRF} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -d ${VRF} -r ${a} - log_test_addr ${a} $? 0 "Global server, VRF client, local conn" - - log_start - run_cmd nettest -6 -D -I ${VRF} -s -3 ${VRF} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -d ${VRF} -r ${a} - log_test_addr ${a} $? 0 "VRF server, VRF client, local conn" - -@@ -3517,25 +3519,25 @@ ipv6_udp_vrf() - a=${NSA_IP6} - log_start - run_cmd nettest -6 -D -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} - log_test_addr ${a} $? 0 "Global server, device client, local conn" - - log_start - run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} - log_test_addr ${a} $? 0 "VRF server, device client, local conn" - - log_start - run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -d ${VRF} -r ${a} - log_test_addr ${a} $? 0 "Device server, VRF client, local conn" - - log_start - run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} - log_test_addr ${a} $? 0 "Device server, device client, local conn" - -@@ -3547,7 +3549,7 @@ ipv6_udp_vrf() - # link local addresses - log_start - run_cmd nettest -6 -D -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd_nsb nettest -6 -D -d ${NSB_DEV} -r ${NSA_LINKIP6} - log_test $? 0 "Global server, linklocal IP" - -@@ -3558,7 +3560,7 @@ ipv6_udp_vrf() - - log_start - run_cmd_nsb nettest -6 -D -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 udp - run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_LINKIP6} - log_test $? 0 "Enslaved device client, linklocal IP" - -@@ -3569,7 +3571,7 @@ ipv6_udp_vrf() - - log_start - run_cmd nettest -6 -D -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSA_LINKIP6} - log_test $? 0 "Enslaved device client, local conn - linklocal IP" - -@@ -3582,7 +3584,7 @@ ipv6_udp_vrf() - run_cmd_nsb ip -6 ro add ${NSA_IP6}/128 dev ${NSB_DEV} - log_start - run_cmd nettest -6 -s -D & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 udp - run_cmd_nsb nettest -6 -D -r ${NSA_IP6} - log_test $? 0 "UDP in - LLA to GUA" - -@@ -3761,7 +3763,7 @@ ipv6_rt() - do - log_start - run_cmd nettest ${varg} -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest ${varg} -r ${a} & - sleep 3 - run_cmd ip link del ${VRF} -@@ -3775,7 +3777,7 @@ ipv6_rt() - do - log_start - run_cmd nettest ${varg} -I ${VRF} -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest ${varg} -r ${a} & - sleep 3 - run_cmd ip link del ${VRF} -@@ -3789,7 +3791,7 @@ ipv6_rt() - do - log_start - run_cmd nettest ${varg} -I ${NSA_DEV} -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest ${varg} -r ${a} & - sleep 3 - run_cmd ip link del ${VRF} -@@ -3804,7 +3806,7 @@ ipv6_rt() - # - log_start - run_cmd_nsb nettest ${varg} -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 tcp - run_cmd nettest ${varg} -d ${VRF} -r ${NSB_IP6} & - sleep 3 - run_cmd ip link del ${VRF} -@@ -3815,7 +3817,7 @@ ipv6_rt() - - log_start - run_cmd_nsb nettest ${varg} -s & -- sleep 1 -+ wait_local_port_listen ${NSB} 12345 tcp - run_cmd nettest ${varg} -d ${NSA_DEV} -r ${NSB_IP6} & - sleep 3 - run_cmd ip link del ${VRF} -@@ -3832,7 +3834,7 @@ ipv6_rt() - do - log_start - run_cmd nettest ${varg} -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest ${varg} -d ${VRF} -r ${a} & - sleep 3 - run_cmd ip link del ${VRF} -@@ -3846,7 +3848,7 @@ ipv6_rt() - do - log_start - run_cmd nettest ${varg} -I ${VRF} -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest ${varg} -d ${VRF} -r ${a} & - sleep 3 - run_cmd ip link del ${VRF} -@@ -3859,7 +3861,7 @@ ipv6_rt() - a=${NSA_IP6} - log_start - run_cmd nettest ${varg} -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} & - sleep 3 - run_cmd ip link del ${VRF} -@@ -3870,7 +3872,7 @@ ipv6_rt() - - log_start - run_cmd nettest ${varg} -I ${VRF} -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} & - sleep 3 - run_cmd ip link del ${VRF} -@@ -3881,7 +3883,7 @@ ipv6_rt() - - log_start - run_cmd nettest ${varg} -I ${NSA_DEV} -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} & - sleep 3 - run_cmd ip link del ${VRF} -@@ -3940,7 +3942,7 @@ netfilter_tcp_reset() - do - log_start - run_cmd nettest -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -r ${a} - log_test_addr ${a} $? 1 "Global server, reject with TCP-reset on Rx" - done -@@ -3958,7 +3960,7 @@ netfilter_icmp() - do - log_start - run_cmd nettest ${arg} -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest ${arg} -r ${a} - log_test_addr ${a} $? 1 "Global ${stype} server, Rx reject icmp-port-unreach" - done -@@ -3997,7 +3999,7 @@ netfilter_tcp6_reset() - do - log_start - run_cmd nettest -6 -s & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 -r ${a} - log_test_addr ${a} $? 1 "Global server, reject with TCP-reset on Rx" - done -@@ -4015,7 +4017,7 @@ netfilter_icmp6() - do - log_start - run_cmd nettest -6 -s ${arg} & -- sleep 1 -+ wait_local_port_listen ${NSA} 12345 tcp - run_cmd_nsb nettest -6 ${arg} -r ${a} - log_test_addr ${a} $? 1 "Global ${stype} server, Rx reject icmp-port-unreach" - done -@@ -4211,12 +4213,12 @@ use_case_snat_on_vrf() - run_cmd ip6tables -t nat -A POSTROUTING -p tcp -m tcp --dport ${port} -j SNAT --to-source ${NSA_LO_IP6} -o ${VRF} - - run_cmd_nsb nettest -s -l ${NSB_IP} -p ${port} & -- sleep 1 -+ wait_local_port_listen ${NSB} ${port} tcp - run_cmd nettest -d ${VRF} -r ${NSB_IP} -p ${port} - log_test $? 0 "IPv4 TCP connection over VRF with SNAT" - - run_cmd_nsb nettest -6 -s -l ${NSB_IP6} -p ${port} & -- sleep 1 -+ wait_local_port_listen ${NSB} ${port} tcp - run_cmd nettest -6 -d ${VRF} -r ${NSB_IP6} -p ${port} - log_test $? 0 "IPv6 TCP connection over VRF with SNAT" - -diff --git a/tools/testing/selftests/net/forwarding/local_termination.sh b/tools/testing/selftests/net/forwarding/local_termination.sh -index 9b5a63519b949e..6cde61f10fd0e2 100755 ---- a/tools/testing/selftests/net/forwarding/local_termination.sh -+++ b/tools/testing/selftests/net/forwarding/local_termination.sh -@@ -108,6 +108,8 @@ run_test() - local smac=$(mac_get $h1) - local rcv_dmac=$(mac_get $rcv_if_name) - -+ setup_wait -+ - tcpdump_start $rcv_if_name - - mc_route_prepare $h1 -diff --git a/tools/testing/selftests/net/gro.c b/tools/testing/selftests/net/gro.c -index 30024d0ed37391..8dd6857e52cb56 100644 ---- a/tools/testing/selftests/net/gro.c -+++ b/tools/testing/selftests/net/gro.c -@@ -71,6 +71,12 @@ - #define MAX_PAYLOAD (IP_MAXPACKET - sizeof(struct tcphdr) - sizeof(struct ipv6hdr)) - #define NUM_LARGE_PKT (MAX_PAYLOAD / MSS) - #define MAX_HDR_LEN (ETH_HLEN + sizeof(struct ipv6hdr) + sizeof(struct tcphdr)) -+#define MIN_EXTHDR_SIZE 8 -+#define EXT_PAYLOAD_1 "\x00\x00\x00\x00\x00\x00" -+#define EXT_PAYLOAD_2 "\x11\x11\x11\x11\x11\x11" -+ -+#define ipv6_optlen(p) (((p)->hdrlen+1) << 3) /* calculate IPv6 extension header len */ -+#define BUILD_BUG_ON(condition) ((void)sizeof(char[1 - 2*!!(condition)])) - - static const char *addr6_src = "fdaa::2"; - static const char *addr6_dst = "fdaa::1"; -@@ -104,7 +110,7 @@ static void setup_sock_filter(int fd) - const int dport_off = tcp_offset + offsetof(struct tcphdr, dest); - const int ethproto_off = offsetof(struct ethhdr, h_proto); - int optlen = 0; -- int ipproto_off; -+ int ipproto_off, opt_ipproto_off; - int next_off; - - if (proto == PF_INET) -@@ -116,14 +122,30 @@ static void setup_sock_filter(int fd) - if (strcmp(testname, "ip") == 0) { - if (proto == PF_INET) - optlen = sizeof(struct ip_timestamp); -- else -- optlen = sizeof(struct ip6_frag); -+ else { -+ BUILD_BUG_ON(sizeof(struct ip6_hbh) > MIN_EXTHDR_SIZE); -+ BUILD_BUG_ON(sizeof(struct ip6_dest) > MIN_EXTHDR_SIZE); -+ BUILD_BUG_ON(sizeof(struct ip6_frag) > MIN_EXTHDR_SIZE); -+ -+ /* same size for HBH and Fragment extension header types */ -+ optlen = MIN_EXTHDR_SIZE; -+ opt_ipproto_off = ETH_HLEN + sizeof(struct ipv6hdr) -+ + offsetof(struct ip6_ext, ip6e_nxt); -+ } - } - -+ /* this filter validates the following: -+ * - packet is IPv4/IPv6 according to the running test. -+ * - packet is TCP. Also handles the case of one extension header and then TCP. -+ * - checks the packet tcp dport equals to DPORT. Also handles the case of one -+ * extension header and then TCP. -+ */ - struct sock_filter filter[] = { - BPF_STMT(BPF_LD + BPF_H + BPF_ABS, ethproto_off), -- BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, ntohs(ethhdr_proto), 0, 7), -+ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, ntohs(ethhdr_proto), 0, 9), - BPF_STMT(BPF_LD + BPF_B + BPF_ABS, ipproto_off), -+ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, IPPROTO_TCP, 2, 0), -+ BPF_STMT(BPF_LD + BPF_B + BPF_ABS, opt_ipproto_off), - BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, IPPROTO_TCP, 0, 5), - BPF_STMT(BPF_LD + BPF_H + BPF_ABS, dport_off), - BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, DPORT, 2, 0), -@@ -576,6 +598,39 @@ static void add_ipv4_ts_option(void *buf, void *optpkt) - iph->check = checksum_fold(iph, sizeof(struct iphdr) + optlen, 0); - } - -+static void add_ipv6_exthdr(void *buf, void *optpkt, __u8 exthdr_type, char *ext_payload) -+{ -+ struct ipv6_opt_hdr *exthdr = (struct ipv6_opt_hdr *)(optpkt + tcp_offset); -+ struct ipv6hdr *iph = (struct ipv6hdr *)(optpkt + ETH_HLEN); -+ char *exthdr_payload_start = (char *)(exthdr + 1); -+ -+ exthdr->hdrlen = 0; -+ exthdr->nexthdr = IPPROTO_TCP; -+ -+ memcpy(exthdr_payload_start, ext_payload, MIN_EXTHDR_SIZE - sizeof(*exthdr)); -+ -+ memcpy(optpkt, buf, tcp_offset); -+ memcpy(optpkt + tcp_offset + MIN_EXTHDR_SIZE, buf + tcp_offset, -+ sizeof(struct tcphdr) + PAYLOAD_LEN); -+ -+ iph->nexthdr = exthdr_type; -+ iph->payload_len = htons(ntohs(iph->payload_len) + MIN_EXTHDR_SIZE); -+} -+ -+static void send_ipv6_exthdr(int fd, struct sockaddr_ll *daddr, char *ext_data1, char *ext_data2) -+{ -+ static char buf[MAX_HDR_LEN + PAYLOAD_LEN]; -+ static char exthdr_pck[sizeof(buf) + MIN_EXTHDR_SIZE]; -+ -+ create_packet(buf, 0, 0, PAYLOAD_LEN, 0); -+ add_ipv6_exthdr(buf, exthdr_pck, IPPROTO_DSTOPTS, ext_data1); -+ write_packet(fd, exthdr_pck, total_hdr_len + PAYLOAD_LEN + MIN_EXTHDR_SIZE, daddr); -+ -+ create_packet(buf, PAYLOAD_LEN * 1, 0, PAYLOAD_LEN, 0); -+ add_ipv6_exthdr(buf, exthdr_pck, IPPROTO_DSTOPTS, ext_data2); -+ write_packet(fd, exthdr_pck, total_hdr_len + PAYLOAD_LEN + MIN_EXTHDR_SIZE, daddr); -+} -+ - /* IPv4 options shouldn't coalesce */ - static void send_ip_options(int fd, struct sockaddr_ll *daddr) - { -@@ -697,7 +752,7 @@ static void send_fragment6(int fd, struct sockaddr_ll *daddr) - create_packet(buf, PAYLOAD_LEN * i, 0, PAYLOAD_LEN, 0); - write_packet(fd, buf, bufpkt_len, daddr); - } -- -+ sleep(1); - create_packet(buf, PAYLOAD_LEN * 2, 0, PAYLOAD_LEN, 0); - memset(extpkt, 0, extpkt_len); - -@@ -760,6 +815,7 @@ static void check_recv_pkts(int fd, int *correct_payload, - vlog("}, Total %d packets\nReceived {", correct_num_pkts); - - while (1) { -+ ip_ext_len = 0; - pkt_size = recv(fd, buffer, IP_MAXPACKET + ETH_HLEN + 1, 0); - if (pkt_size < 0) - error(1, errno, "could not receive"); -@@ -767,7 +823,7 @@ static void check_recv_pkts(int fd, int *correct_payload, - if (iph->version == 4) - ip_ext_len = (iph->ihl - 5) * 4; - else if (ip6h->version == 6 && ip6h->nexthdr != IPPROTO_TCP) -- ip_ext_len = sizeof(struct ip6_frag); -+ ip_ext_len = MIN_EXTHDR_SIZE; - - tcph = (struct tcphdr *)(buffer + tcp_offset + ip_ext_len); - -@@ -802,6 +858,7 @@ static void check_recv_pkts(int fd, int *correct_payload, - - static void gro_sender(void) - { -+ const int fin_delay_us = 100 * 1000; - static char fin_pkt[MAX_HDR_LEN]; - struct sockaddr_ll daddr = {}; - int txfd = -1; -@@ -845,15 +902,22 @@ static void gro_sender(void) - write_packet(txfd, fin_pkt, total_hdr_len, &daddr); - } else if (strcmp(testname, "tcp") == 0) { - send_changed_checksum(txfd, &daddr); -+ /* Adding sleep before sending FIN so that it is not -+ * received prior to other packets. -+ */ -+ usleep(fin_delay_us); - write_packet(txfd, fin_pkt, total_hdr_len, &daddr); - - send_changed_seq(txfd, &daddr); -+ usleep(fin_delay_us); - write_packet(txfd, fin_pkt, total_hdr_len, &daddr); - - send_changed_ts(txfd, &daddr); -+ usleep(fin_delay_us); - write_packet(txfd, fin_pkt, total_hdr_len, &daddr); - - send_diff_opt(txfd, &daddr); -+ usleep(fin_delay_us); - write_packet(txfd, fin_pkt, total_hdr_len, &daddr); - } else if (strcmp(testname, "ip") == 0) { - send_changed_ECN(txfd, &daddr); -@@ -880,7 +944,21 @@ static void gro_sender(void) - sleep(1); - write_packet(txfd, fin_pkt, total_hdr_len, &daddr); - } else if (proto == PF_INET6) { -+ sleep(1); - send_fragment6(txfd, &daddr); -+ sleep(1); -+ write_packet(txfd, fin_pkt, total_hdr_len, &daddr); -+ -+ sleep(1); -+ /* send IPv6 packets with ext header with same payload */ -+ send_ipv6_exthdr(txfd, &daddr, EXT_PAYLOAD_1, EXT_PAYLOAD_1); -+ sleep(1); -+ write_packet(txfd, fin_pkt, total_hdr_len, &daddr); -+ -+ sleep(1); -+ /* send IPv6 packets with ext header with different payload */ -+ send_ipv6_exthdr(txfd, &daddr, EXT_PAYLOAD_1, EXT_PAYLOAD_2); -+ sleep(1); - write_packet(txfd, fin_pkt, total_hdr_len, &daddr); - } - } else if (strcmp(testname, "large") == 0) { -@@ -997,6 +1075,17 @@ static void gro_receiver(void) - */ - printf("fragmented ip6 doesn't coalesce: "); - correct_payload[0] = PAYLOAD_LEN * 2; -+ correct_payload[1] = PAYLOAD_LEN; -+ correct_payload[2] = PAYLOAD_LEN; -+ check_recv_pkts(rxfd, correct_payload, 3); -+ -+ printf("ipv6 with ext header does coalesce: "); -+ correct_payload[0] = PAYLOAD_LEN * 2; -+ check_recv_pkts(rxfd, correct_payload, 1); -+ -+ printf("ipv6 with ext header with different payloads doesn't coalesce: "); -+ correct_payload[0] = PAYLOAD_LEN; -+ correct_payload[1] = PAYLOAD_LEN; - check_recv_pkts(rxfd, correct_payload, 2); - } - } else if (strcmp(testname, "large") == 0) { -diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.c b/tools/testing/selftests/net/mptcp/mptcp_connect.c -index fc9eff0e89e226..20c29324b814f0 100644 ---- a/tools/testing/selftests/net/mptcp/mptcp_connect.c -+++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c -@@ -696,8 +696,14 @@ static int copyfd_io_poll(int infd, int peerfd, int outfd, - - bw = do_rnd_write(peerfd, winfo->buf + winfo->off, winfo->len); - if (bw < 0) { -- if (cfg_rcv_trunc) -- return 0; -+ /* expected reset, continue to read */ -+ if (cfg_rcv_trunc && -+ (errno == ECONNRESET || -+ errno == EPIPE)) { -+ fds.events &= ~POLLOUT; -+ continue; -+ } -+ - perror("write"); - return 111; - } -@@ -723,8 +729,10 @@ static int copyfd_io_poll(int infd, int peerfd, int outfd, - } - - if (fds.revents & (POLLERR | POLLNVAL)) { -- if (cfg_rcv_trunc) -- return 0; -+ if (cfg_rcv_trunc) { -+ fds.events &= ~(POLLERR | POLLNVAL); -+ continue; -+ } - fprintf(stderr, "Unexpected revents: " - "POLLERR/POLLNVAL(%x)\n", fds.revents); - return 5; -@@ -1419,7 +1427,7 @@ static void parse_opts(int argc, char **argv) - */ - if (cfg_truncate < 0) { - cfg_rcv_trunc = true; -- signal(SIGPIPE, handle_signal); -+ signal(SIGPIPE, SIG_IGN); - } - break; - case 'j': -diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.sh b/tools/testing/selftests/net/mptcp/mptcp_connect.sh -index 3763ffa214d53f..f475b27185dec9 100755 ---- a/tools/testing/selftests/net/mptcp/mptcp_connect.sh -+++ b/tools/testing/selftests/net/mptcp/mptcp_connect.sh -@@ -516,7 +516,7 @@ do_transfer() - "${stat_synrx_now_l}" "${expect_synrx}" 1>&2 - retc=1 - fi -- if [ ${stat_ackrx_now_l} -lt ${expect_ackrx} ] && [ ${stat_ooo_now} -eq 0 ]; then -+ if [ ${stat_ackrx_now_l} -lt ${expect_ackrx} ]; then - if [ ${stat_ooo_now} -eq 0 ]; then - printf "[ FAIL ] lower MPC ACK rx (%d) than expected (%d)\n" \ - "${stat_ackrx_now_l}" "${expect_ackrx}" 1>&2 -diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh -index b9cc3d51dc2857..250577b11a91b7 100755 ---- a/tools/testing/selftests/net/mptcp/mptcp_join.sh -+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh -@@ -2361,7 +2361,7 @@ remove_tests() - if reset "remove single subflow"; then - pm_nl_set_limits $ns1 0 1 - pm_nl_set_limits $ns2 0 1 -- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow -+ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup - addr_nr_ns2=-1 speed=slow \ - run_tests $ns1 $ns2 10.0.1.1 - chk_join_nr 1 1 1 -@@ -2374,8 +2374,8 @@ remove_tests() - if reset "remove multiple subflows"; then - pm_nl_set_limits $ns1 0 2 - pm_nl_set_limits $ns2 0 2 -- pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow -- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow -+ pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow,backup -+ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup - addr_nr_ns2=-2 speed=slow \ - run_tests $ns1 $ns2 10.0.1.1 - chk_join_nr 2 2 2 -@@ -2386,7 +2386,7 @@ remove_tests() - # single address, remove - if reset "remove single address"; then - pm_nl_set_limits $ns1 0 1 -- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal -+ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup - pm_nl_set_limits $ns2 1 1 - addr_nr_ns1=-1 speed=slow \ - run_tests $ns1 $ns2 10.0.1.1 -@@ -2399,9 +2399,9 @@ remove_tests() - # subflow and signal, remove - if reset "remove subflow and signal"; then - pm_nl_set_limits $ns1 0 2 -- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal -+ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup - pm_nl_set_limits $ns2 1 2 -- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow -+ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup - addr_nr_ns1=-1 addr_nr_ns2=-1 speed=slow \ - run_tests $ns1 $ns2 10.0.1.1 - chk_join_nr 2 2 2 -@@ -2413,10 +2413,10 @@ remove_tests() - # subflows and signal, remove - if reset "remove subflows and signal"; then - pm_nl_set_limits $ns1 0 3 -- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal -+ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup - pm_nl_set_limits $ns2 1 3 -- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow -- pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow -+ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup -+ pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow,backup - addr_nr_ns1=-1 addr_nr_ns2=-2 speed=10 \ - run_tests $ns1 $ns2 10.0.1.1 - chk_join_nr 3 3 3 -@@ -2428,9 +2428,9 @@ remove_tests() - # addresses remove - if reset "remove addresses"; then - pm_nl_set_limits $ns1 3 3 -- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal id 250 -- pm_nl_add_endpoint $ns1 10.0.3.1 flags signal -- pm_nl_add_endpoint $ns1 10.0.4.1 flags signal -+ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup id 250 -+ pm_nl_add_endpoint $ns1 10.0.3.1 flags signal,backup -+ pm_nl_add_endpoint $ns1 10.0.4.1 flags signal,backup - pm_nl_set_limits $ns2 3 3 - addr_nr_ns1=-3 speed=10 \ - run_tests $ns1 $ns2 10.0.1.1 -@@ -2443,10 +2443,10 @@ remove_tests() - # invalid addresses remove - if reset "remove invalid addresses"; then - pm_nl_set_limits $ns1 3 3 -- pm_nl_add_endpoint $ns1 10.0.12.1 flags signal -+ pm_nl_add_endpoint $ns1 10.0.12.1 flags signal,backup - # broadcast IP: no packet for this address will be received on ns1 -- pm_nl_add_endpoint $ns1 224.0.0.1 flags signal -- pm_nl_add_endpoint $ns1 10.0.3.1 flags signal -+ pm_nl_add_endpoint $ns1 224.0.0.1 flags signal,backup -+ pm_nl_add_endpoint $ns1 10.0.3.1 flags signal,backup - pm_nl_set_limits $ns2 2 2 - addr_nr_ns1=-3 speed=10 \ - run_tests $ns1 $ns2 10.0.1.1 -@@ -2459,10 +2459,10 @@ remove_tests() - # subflows and signal, flush - if reset "flush subflows and signal"; then - pm_nl_set_limits $ns1 0 3 -- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal -+ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup - pm_nl_set_limits $ns2 1 3 -- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow -- pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow -+ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup -+ pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow,backup - addr_nr_ns1=-8 addr_nr_ns2=-8 speed=slow \ - run_tests $ns1 $ns2 10.0.1.1 - chk_join_nr 3 3 3 -@@ -2475,9 +2475,9 @@ remove_tests() - if reset "flush subflows"; then - pm_nl_set_limits $ns1 3 3 - pm_nl_set_limits $ns2 3 3 -- pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow id 150 -- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow -- pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow -+ pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow,backup id 150 -+ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup -+ pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow,backup - addr_nr_ns1=-8 addr_nr_ns2=-8 speed=slow \ - run_tests $ns1 $ns2 10.0.1.1 - chk_join_nr 3 3 3 -@@ -2494,9 +2494,9 @@ remove_tests() - # addresses flush - if reset "flush addresses"; then - pm_nl_set_limits $ns1 3 3 -- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal id 250 -- pm_nl_add_endpoint $ns1 10.0.3.1 flags signal -- pm_nl_add_endpoint $ns1 10.0.4.1 flags signal -+ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup id 250 -+ pm_nl_add_endpoint $ns1 10.0.3.1 flags signal,backup -+ pm_nl_add_endpoint $ns1 10.0.4.1 flags signal,backup - pm_nl_set_limits $ns2 3 3 - addr_nr_ns1=-8 addr_nr_ns2=-8 speed=slow \ - run_tests $ns1 $ns2 10.0.1.1 -@@ -2509,9 +2509,9 @@ remove_tests() - # invalid addresses flush - if reset "flush invalid addresses"; then - pm_nl_set_limits $ns1 3 3 -- pm_nl_add_endpoint $ns1 10.0.12.1 flags signal -- pm_nl_add_endpoint $ns1 10.0.3.1 flags signal -- pm_nl_add_endpoint $ns1 10.0.14.1 flags signal -+ pm_nl_add_endpoint $ns1 10.0.12.1 flags signal,backup -+ pm_nl_add_endpoint $ns1 10.0.3.1 flags signal,backup -+ pm_nl_add_endpoint $ns1 10.0.14.1 flags signal,backup - pm_nl_set_limits $ns2 3 3 - addr_nr_ns1=-8 speed=slow \ - run_tests $ns1 $ns2 10.0.1.1 -diff --git a/tools/testing/selftests/net/psock_tpacket.c b/tools/testing/selftests/net/psock_tpacket.c -index 404a2ce759ab61..ca0d9a5a9e08c1 100644 ---- a/tools/testing/selftests/net/psock_tpacket.c -+++ b/tools/testing/selftests/net/psock_tpacket.c -@@ -22,6 +22,7 @@ - * - TPACKET_V3: RX_RING - */ - -+#undef NDEBUG - #include - #include - #include -@@ -33,7 +34,6 @@ - #include - #include - #include --#include - #include - #include - #include -@@ -785,7 +785,7 @@ static int test_kernel_bit_width(void) - - static int test_user_bit_width(void) - { -- return __WORDSIZE; -+ return sizeof(long) * 8; - } - - static const char *tpacket_str[] = { -diff --git a/tools/testing/selftests/net/traceroute.sh b/tools/testing/selftests/net/traceroute.sh -index de9ca97abc3062..9cb5e96e64333e 100755 ---- a/tools/testing/selftests/net/traceroute.sh -+++ b/tools/testing/selftests/net/traceroute.sh -@@ -209,11 +209,6 @@ setup_traceroute6() - - run_traceroute6() - { -- if [ ! -x "$(command -v traceroute6)" ]; then -- echo "SKIP: Could not run IPV6 test without traceroute6" -- return -- fi -- - setup_traceroute6 - - # traceroute6 host-2 from host-1 (expects 2000:102::2) -@@ -278,11 +273,6 @@ setup_traceroute() - - run_traceroute() - { -- if [ ! -x "$(command -v traceroute)" ]; then -- echo "SKIP: Could not run IPV4 test without traceroute" -- return -- fi -- - setup_traceroute - - # traceroute host-2 from host-1 (expects 1.0.1.1). Takes a while. -@@ -316,6 +306,9 @@ do - esac - done - -+require_command traceroute6 -+require_command traceroute -+ - run_tests - - printf "\nTests passed: %3d\n" ${nsuccess} -diff --git a/tools/testing/selftests/user_events/perf_test.c b/tools/testing/selftests/user_events/perf_test.c -index 5288e768b207a9..68625362add283 100644 ---- a/tools/testing/selftests/user_events/perf_test.c -+++ b/tools/testing/selftests/user_events/perf_test.c -@@ -236,7 +236,7 @@ TEST_F(user, perf_empty_events) { - ASSERT_EQ(1 << reg.enable_bit, self->check); - - /* Ensure write shows up at correct offset */ -- ASSERT_NE(-1, write(self->data_fd, ®.write_index, -+ ASSERT_NE(-1, write(self->data_fd, (void *)®.write_index, - sizeof(reg.write_index))); - val = (void *)(((char *)perf_page) + perf_page->data_offset); - ASSERT_EQ(PERF_RECORD_SAMPLE, *val); -diff --git a/usr/include/headers_check.pl b/usr/include/headers_check.pl -index b6aec5e4365f9b..682980781eb37a 100755 ---- a/usr/include/headers_check.pl -+++ b/usr/include/headers_check.pl -@@ -160,6 +160,8 @@ sub check_sizetypes - if (my $included = ($line =~ /^\s*#\s*include\s+[<"](\S+)[>"]/)[0]) { - check_include_typesh($included); - } -+ # strip single-line comments, as types may be referenced within them -+ $line =~ s@/\*.*?\*/@@; - if ($line =~ m/__[us](8|16|32|64)\b/) { - printf STDERR "$filename:$lineno: " . - "found __[us]{8,16,32,64} type " . diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.117-118-fixed.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.117-118-fixed.patch deleted file mode 100644 index 6e51fdc3cf..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.117-118-fixed.patch +++ /dev/null @@ -1,2950 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/pinctrl/toshiba,visconti-pinctrl.yaml b/Documentation/devicetree/bindings/pinctrl/toshiba,visconti-pinctrl.yaml -index 19d47fd414bc06..ce04d2eadec9d5 100644 ---- a/Documentation/devicetree/bindings/pinctrl/toshiba,visconti-pinctrl.yaml -+++ b/Documentation/devicetree/bindings/pinctrl/toshiba,visconti-pinctrl.yaml -@@ -50,18 +50,20 @@ patternProperties: - groups: - description: - Name of the pin group to use for the functions. -- $ref: /schemas/types.yaml#/definitions/string -- enum: [i2c0_grp, i2c1_grp, i2c2_grp, i2c3_grp, i2c4_grp, -- i2c5_grp, i2c6_grp, i2c7_grp, i2c8_grp, -- spi0_grp, spi0_cs0_grp, spi0_cs1_grp, spi0_cs2_grp, -- spi1_grp, spi2_grp, spi3_grp, spi4_grp, spi5_grp, spi6_grp, -- uart0_grp, uart1_grp, uart2_grp, uart3_grp, -- pwm0_gpio4_grp, pwm0_gpio8_grp, pwm0_gpio12_grp, -- pwm0_gpio16_grp, pwm1_gpio5_grp, pwm1_gpio9_grp, -- pwm1_gpio13_grp, pwm1_gpio17_grp, pwm2_gpio6_grp, -- pwm2_gpio10_grp, pwm2_gpio14_grp, pwm2_gpio18_grp, -- pwm3_gpio7_grp, pwm3_gpio11_grp, pwm3_gpio15_grp, -- pwm3_gpio19_grp, pcmif_out_grp, pcmif_in_grp] -+ items: -+ enum: [i2c0_grp, i2c1_grp, i2c2_grp, i2c3_grp, i2c4_grp, -+ i2c5_grp, i2c6_grp, i2c7_grp, i2c8_grp, -+ spi0_grp, spi0_cs0_grp, spi0_cs1_grp, spi0_cs2_grp, -+ spi1_grp, spi2_grp, spi3_grp, spi4_grp, spi5_grp, spi6_grp, -+ uart0_grp, uart1_grp, uart2_grp, uart3_grp, -+ pwm0_gpio4_grp, pwm0_gpio8_grp, pwm0_gpio12_grp, -+ pwm0_gpio16_grp, pwm1_gpio5_grp, pwm1_gpio9_grp, -+ pwm1_gpio13_grp, pwm1_gpio17_grp, pwm2_gpio6_grp, -+ pwm2_gpio10_grp, pwm2_gpio14_grp, pwm2_gpio18_grp, -+ pwm3_gpio7_grp, pwm3_gpio11_grp, pwm3_gpio15_grp, -+ pwm3_gpio19_grp, pcmif_out_grp, pcmif_in_grp] -+ minItems: 1 -+ maxItems: 8 - - drive-strength: - enum: [2, 4, 6, 8, 16, 24, 32] -diff --git a/Makefile b/Makefile -index a849399cebf8fd..b13776e2b581c4 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 117 -+SUBLEVEL = 118 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c -index 8d21ab904f1a98..eacf4ba1d88e9a 100644 ---- a/arch/arm64/kvm/hyp/nvhe/ffa.c -+++ b/arch/arm64/kvm/hyp/nvhe/ffa.c -@@ -425,7 +425,7 @@ static void __do_ffa_mem_xfer(const u64 func_id, - DECLARE_REG(u32, npages_mbz, ctxt, 4); - struct ffa_composite_mem_region *reg; - struct ffa_mem_region *buf; -- u32 offset, nr_ranges; -+ u32 offset, nr_ranges, checked_offset; - int ret = 0; - - if (addr_mbz || npages_mbz || fraglen > len || -@@ -460,7 +460,12 @@ static void __do_ffa_mem_xfer(const u64 func_id, - goto out_unlock; - } - -- if (fraglen < offset + sizeof(struct ffa_composite_mem_region)) { -+ if (check_add_overflow(offset, sizeof(struct ffa_composite_mem_region), &checked_offset)) { -+ ret = FFA_RET_INVALID_PARAMETERS; -+ goto out_unlock; -+ } -+ -+ if (fraglen < checked_offset) { - ret = FFA_RET_INVALID_PARAMETERS; - goto out_unlock; - } -diff --git a/arch/loongarch/include/uapi/asm/ptrace.h b/arch/loongarch/include/uapi/asm/ptrace.h -index aafb3cd9e943e5..215e0f9e8aa32a 100644 ---- a/arch/loongarch/include/uapi/asm/ptrace.h -+++ b/arch/loongarch/include/uapi/asm/ptrace.h -@@ -10,10 +10,6 @@ - - #include - --#ifndef __KERNEL__ --#include --#endif -- - /* - * For PTRACE_{POKE,PEEK}USR. 0 - 31 are GPRs, - * 32 is syscall's original ARG0, 33 is PC, 34 is BADVADDR. -@@ -41,44 +37,44 @@ struct user_pt_regs { - } __attribute__((aligned(8))); - - struct user_fp_state { -- uint64_t fpr[32]; -- uint64_t fcc; -- uint32_t fcsr; -+ __u64 fpr[32]; -+ __u64 fcc; -+ __u32 fcsr; - }; - - struct user_lsx_state { - /* 32 registers, 128 bits width per register. */ -- uint64_t vregs[32*2]; -+ __u64 vregs[32*2]; - }; - - struct user_lasx_state { - /* 32 registers, 256 bits width per register. */ -- uint64_t vregs[32*4]; -+ __u64 vregs[32*4]; - }; - - struct user_lbt_state { -- uint64_t scr[4]; -- uint32_t eflags; -- uint32_t ftop; -+ __u64 scr[4]; -+ __u32 eflags; -+ __u32 ftop; - }; - - struct user_watch_state { -- uint64_t dbg_info; -+ __u64 dbg_info; - struct { -- uint64_t addr; -- uint64_t mask; -- uint32_t ctrl; -- uint32_t pad; -+ __u64 addr; -+ __u64 mask; -+ __u32 ctrl; -+ __u32 pad; - } dbg_regs[8]; - }; - - struct user_watch_state_v2 { -- uint64_t dbg_info; -+ __u64 dbg_info; - struct { -- uint64_t addr; -- uint64_t mask; -- uint32_t ctrl; -- uint32_t pad; -+ __u64 addr; -+ __u64 mask; -+ __u32 ctrl; -+ __u32 pad; - } dbg_regs[14]; - }; - -diff --git a/arch/loongarch/pci/pci.c b/arch/loongarch/pci/pci.c -index 2726639150bc7a..927dd31f82b93e 100644 ---- a/arch/loongarch/pci/pci.c -+++ b/arch/loongarch/pci/pci.c -@@ -51,11 +51,11 @@ static int __init pcibios_init(void) - */ - lsize = cpu_last_level_cache_line_size(); - -- BUG_ON(!lsize); -+ if (lsize) { -+ pci_dfl_cache_line_size = lsize >> 2; - -- pci_dfl_cache_line_size = lsize >> 2; -- -- pr_debug("PCI: pci_cache_line_size set to %d bytes\n", lsize); -+ pr_debug("PCI: pci_cache_line_size set to %d bytes\n", lsize); -+ } - - return 0; - } -diff --git a/arch/mips/mti-malta/malta-init.c b/arch/mips/mti-malta/malta-init.c -index 000d6d50520a89..82b0fd8576a241 100644 ---- a/arch/mips/mti-malta/malta-init.c -+++ b/arch/mips/mti-malta/malta-init.c -@@ -241,16 +241,22 @@ mips_pci_controller: - #endif - - /* -- * Setup the Malta max (2GB) memory for PCI DMA in host bridge -- * in transparent addressing mode. -+ * Set up memory mapping in host bridge for PCI DMA masters, -+ * in transparent addressing mode. For EVA use the Malta -+ * maximum of 2 GiB memory in the alias space at 0x80000000 -+ * as per PHYS_OFFSET. Otherwise use 256 MiB of memory in -+ * the regular space, avoiding mapping the PCI MMIO window -+ * for DMA as it seems to confuse the system controller's -+ * logic, causing PCI MMIO to stop working. - */ -- mask = PHYS_OFFSET | PCI_BASE_ADDRESS_MEM_PREFETCH; -- MSC_WRITE(MSC01_PCI_BAR0, mask); -- MSC_WRITE(MSC01_PCI_HEAD4, mask); -+ mask = PHYS_OFFSET ? PHYS_OFFSET : 0xf0000000; -+ MSC_WRITE(MSC01_PCI_BAR0, -+ mask | PCI_BASE_ADDRESS_MEM_PREFETCH); -+ MSC_WRITE(MSC01_PCI_HEAD4, -+ PHYS_OFFSET | PCI_BASE_ADDRESS_MEM_PREFETCH); - -- mask &= MSC01_PCI_BAR0_SIZE_MSK; - MSC_WRITE(MSC01_PCI_P2SCMSKL, mask); -- MSC_WRITE(MSC01_PCI_P2SCMAPL, mask); -+ MSC_WRITE(MSC01_PCI_P2SCMAPL, PHYS_OFFSET); - - /* Don't handle target retries indefinitely. */ - if ((data & MSC01_PCI_CFG_MAXRTRY_MSK) == -diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h -index da2e91b5b19250..2cc9d7bb1b2ac0 100644 ---- a/arch/s390/include/asm/pgtable.h -+++ b/arch/s390/include/asm/pgtable.h -@@ -1065,17 +1065,15 @@ static inline pte_t pte_mkhuge(pte_t pte) - #define IPTE_NODAT 0x400 - #define IPTE_GUEST_ASCE 0x800 - --static __always_inline void __ptep_rdp(unsigned long addr, pte_t *ptep, -- unsigned long opt, unsigned long asce, -- int local) -+static __always_inline void __ptep_rdp(unsigned long addr, pte_t *ptep, int local) - { - unsigned long pto; - - pto = __pa(ptep) & ~(PTRS_PER_PTE * sizeof(pte_t) - 1); -- asm volatile(".insn rrf,0xb98b0000,%[r1],%[r2],%[asce],%[m4]" -+ asm volatile(".insn rrf,0xb98b0000,%[r1],%[r2],%%r0,%[m4]" - : "+m" (*ptep) -- : [r1] "a" (pto), [r2] "a" ((addr & PAGE_MASK) | opt), -- [asce] "a" (asce), [m4] "i" (local)); -+ : [r1] "a" (pto), [r2] "a" (addr & PAGE_MASK), -+ [m4] "i" (local)); - } - - static __always_inline void __ptep_ipte(unsigned long address, pte_t *ptep, -@@ -1259,7 +1257,7 @@ static inline void flush_tlb_fix_spurious_fault(struct vm_area_struct *vma, - * A local RDP can be used to do the flush. - */ - if (MACHINE_HAS_RDP && !(pte_val(*ptep) & _PAGE_PROTECT)) -- __ptep_rdp(address, ptep, 0, 0, 1); -+ __ptep_rdp(address, ptep, 1); - } - #define flush_tlb_fix_spurious_fault flush_tlb_fix_spurious_fault - -diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c -index 5e349869590a83..1fb435b3913cdd 100644 ---- a/arch/s390/mm/pgtable.c -+++ b/arch/s390/mm/pgtable.c -@@ -312,9 +312,9 @@ void ptep_reset_dat_prot(struct mm_struct *mm, unsigned long addr, pte_t *ptep, - preempt_disable(); - atomic_inc(&mm->context.flush_count); - if (cpumask_equal(mm_cpumask(mm), cpumask_of(smp_processor_id()))) -- __ptep_rdp(addr, ptep, 0, 0, 1); -+ __ptep_rdp(addr, ptep, 1); - else -- __ptep_rdp(addr, ptep, 0, 0, 0); -+ __ptep_rdp(addr, ptep, 0); - /* - * PTE is not invalidated by RDP, only _PAGE_PROTECT is cleared. That - * means it is still valid and active, and must not be changed according -diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c -index f9b6e2043e6b2b..9952c774eaa697 100644 ---- a/arch/x86/kernel/cpu/microcode/amd.c -+++ b/arch/x86/kernel/cpu/microcode/amd.c -@@ -226,6 +226,24 @@ static bool need_sha_check(u32 cur_rev) - return true; - } - -+static bool cpu_has_entrysign(void) -+{ -+ unsigned int fam = x86_family(bsp_cpuid_1_eax); -+ unsigned int model = x86_model(bsp_cpuid_1_eax); -+ -+ if (fam == 0x17 || fam == 0x19) -+ return true; -+ -+ if (fam == 0x1a) { -+ if (model <= 0x2f || -+ (0x40 <= model && model <= 0x4f) || -+ (0x60 <= model && model <= 0x6f)) -+ return true; -+ } -+ -+ return false; -+} -+ - static bool verify_sha256_digest(u32 patch_id, u32 cur_rev, const u8 *data, unsigned int len) - { - struct patch_digest *pd = NULL; -@@ -233,7 +251,7 @@ static bool verify_sha256_digest(u32 patch_id, u32 cur_rev, const u8 *data, unsi - struct sha256_state s; - int i; - -- if (x86_family(bsp_cpuid_1_eax) < 0x17) -+ if (!cpu_has_entrysign()) - return true; - - if (!need_sha_check(cur_rev)) -diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c -index 0b2f1e269ca496..8f6a7acf770e4a 100644 ---- a/drivers/ata/libata-scsi.c -+++ b/drivers/ata/libata-scsi.c -@@ -992,6 +992,13 @@ static void ata_gen_ata_sense(struct ata_queued_cmd *qc) - return; - } - -+ if (ata_id_is_locked(dev->id)) { -+ /* Security locked */ -+ /* LOGICAL UNIT ACCESS NOT AUTHORIZED */ -+ ata_scsi_set_sense(dev, cmd, DATA_PROTECT, 0x74, 0x71); -+ return; -+ } -+ - if (!(qc->flags & ATA_QCFLAG_RTF_FILLED)) { - ata_dev_dbg(dev, - "Missing result TF: reporting aborted command\n"); -@@ -4831,8 +4838,10 @@ void ata_scsi_dev_rescan(struct work_struct *work) - spin_unlock_irqrestore(ap->lock, flags); - if (do_resume) { - ret = scsi_resume_device(sdev); -- if (ret == -EWOULDBLOCK) -+ if (ret == -EWOULDBLOCK) { -+ scsi_device_put(sdev); - goto unlock_scan; -+ } - dev->flags &= ~ATA_DFLAG_RESUMING; - } - ret = scsi_rescan_device(sdev); -diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c -index 7061d3ee836a15..c69c05256b59f1 100644 ---- a/drivers/bcma/main.c -+++ b/drivers/bcma/main.c -@@ -294,6 +294,8 @@ static int bcma_register_devices(struct bcma_bus *bus) - int err; - - list_for_each_entry(core, &bus->cores, list) { -+ struct device_node *np; -+ - /* We support that core ourselves */ - switch (core->id.id) { - case BCMA_CORE_4706_CHIPCOMMON: -@@ -311,6 +313,10 @@ static int bcma_register_devices(struct bcma_bus *bus) - if (bcma_is_core_needed_early(core->id.id)) - continue; - -+ np = core->dev.of_node; -+ if (np && !of_device_is_available(np)) -+ continue; -+ - /* Only first GMAC core on BCM4706 is connected and working */ - if (core->id.id == BCMA_CORE_4706_MAC_GBIT && - core->core_unit > 0) -diff --git a/drivers/firmware/arm_scmi/scmi_pm_domain.c b/drivers/firmware/arm_scmi/scmi_pm_domain.c -index 0e05a79de82d8a..82d923a9d75d75 100644 ---- a/drivers/firmware/arm_scmi/scmi_pm_domain.c -+++ b/drivers/firmware/arm_scmi/scmi_pm_domain.c -@@ -54,7 +54,7 @@ static int scmi_pd_power_off(struct generic_pm_domain *domain) - - static int scmi_pm_domain_probe(struct scmi_device *sdev) - { -- int num_domains, i; -+ int num_domains, i, ret; - struct device *dev = &sdev->dev; - struct device_node *np = dev->of_node; - struct scmi_pm_domain *scmi_pd; -@@ -112,9 +112,18 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev) - scmi_pd_data->domains = domains; - scmi_pd_data->num_domains = num_domains; - -+ ret = of_genpd_add_provider_onecell(np, scmi_pd_data); -+ if (ret) -+ goto err_rm_genpds; -+ - dev_set_drvdata(dev, scmi_pd_data); - -- return of_genpd_add_provider_onecell(np, scmi_pd_data); -+ return 0; -+err_rm_genpds: -+ for (i = num_domains - 1; i >= 0; i--) -+ pm_genpd_remove(domains[i]); -+ -+ return ret; - } - - static void scmi_pm_domain_remove(struct scmi_device *sdev) -diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c -index 480d718d09cb6b..7591a2803ae126 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c -@@ -5296,9 +5296,9 @@ static void gfx_v11_0_ring_emit_ib_gfx(struct amdgpu_ring *ring, - if (flags & AMDGPU_IB_PREEMPTED) - control |= INDIRECT_BUFFER_PRE_RESUME(1); - -- if (vmid) -+ if (vmid && !ring->adev->gfx.rs64_enable) - gfx_v11_0_ring_emit_de_meta(ring, -- (!amdgpu_sriov_vf(ring->adev) && flags & AMDGPU_IB_PREEMPTED) ? true : false); -+ !amdgpu_sriov_vf(ring->adev) && (flags & AMDGPU_IB_PREEMPTED)); - } - - if (ring->is_mes_queue) -diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c -index adf0ef8b70e4b1..56999657f4d864 100644 ---- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c -+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c -@@ -1552,7 +1552,7 @@ static bool retrieve_link_cap(struct dc_link *link) - union edp_configuration_cap edp_config_cap; - union dp_downstream_port_present ds_port = { 0 }; - enum dc_status status = DC_ERROR_UNEXPECTED; -- uint32_t read_dpcd_retry_cnt = 3; -+ uint32_t read_dpcd_retry_cnt = 20; - int i; - struct dp_sink_hw_fw_revision dp_hw_fw_revision; - const uint32_t post_oui_delay = 30; // 30ms -@@ -1598,12 +1598,13 @@ static bool retrieve_link_cap(struct dc_link *link) - status = dpcd_get_tunneling_device_data(link); - - dpcd_set_source_specific_data(link); -- /* Sink may need to configure internals based on vendor, so allow some -- * time before proceeding with possibly vendor specific transactions -- */ -- msleep(post_oui_delay); - - for (i = 0; i < read_dpcd_retry_cnt; i++) { -+ /* -+ * Sink may need to configure internals based on vendor, so allow some -+ * time before proceeding with possibly vendor specific transactions -+ */ -+ msleep(post_oui_delay); - status = core_link_read_dpcd( - link, - DP_DPCD_REV, -diff --git a/drivers/gpu/drm/nouveau/nvkm/falcon/fw.c b/drivers/gpu/drm/nouveau/nvkm/falcon/fw.c -index cac6d64ab67d1d..4e8b3f1c7e25d2 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/falcon/fw.c -+++ b/drivers/gpu/drm/nouveau/nvkm/falcon/fw.c -@@ -159,6 +159,8 @@ nvkm_falcon_fw_dtor(struct nvkm_falcon_fw *fw) - nvkm_memory_unref(&fw->inst); - nvkm_falcon_fw_dtor_sigs(fw); - nvkm_firmware_dtor(&fw->fw); -+ kfree(fw->boot); -+ fw->boot = NULL; - } - - static const struct nvkm_firmware_func -diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c -index 980d85bc7f3745..caa1fe6cc386eb 100644 ---- a/drivers/gpu/drm/tegra/dc.c -+++ b/drivers/gpu/drm/tegra/dc.c -@@ -3140,6 +3140,7 @@ static int tegra_dc_couple(struct tegra_dc *dc) - dc->client.parent = &parent->client; - - dev_dbg(dc->dev, "coupled to %s\n", dev_name(companion)); -+ put_device(companion); - } - - return 0; -diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c -index 839dbad9bc483d..49fc4690c63af7 100644 ---- a/drivers/gpu/drm/tegra/dsi.c -+++ b/drivers/gpu/drm/tegra/dsi.c -@@ -912,15 +912,6 @@ static void tegra_dsi_encoder_enable(struct drm_encoder *encoder) - u32 value; - int err; - -- /* If the bootloader enabled DSI it needs to be disabled -- * in order for the panel initialization commands to be -- * properly sent. -- */ -- value = tegra_dsi_readl(dsi, DSI_POWER_CONTROL); -- -- if (value & DSI_POWER_CONTROL_ENABLE) -- tegra_dsi_disable(dsi); -- - err = tegra_dsi_prepare(dsi); - if (err < 0) { - dev_err(dsi->dev, "failed to prepare: %d\n", err); -diff --git a/drivers/gpu/drm/tegra/uapi.c b/drivers/gpu/drm/tegra/uapi.c -index 5adab6b229164e..d0b6a1fa6efad9 100644 ---- a/drivers/gpu/drm/tegra/uapi.c -+++ b/drivers/gpu/drm/tegra/uapi.c -@@ -114,9 +114,12 @@ int tegra_drm_ioctl_channel_open(struct drm_device *drm, void *data, struct drm_ - if (err) - goto put_channel; - -- if (supported) -+ if (supported) { -+ struct pid *pid = get_task_pid(current, PIDTYPE_TGID); - context->memory_context = host1x_memory_context_alloc( -- host, client->base.dev, get_task_pid(current, PIDTYPE_TGID)); -+ host, client->base.dev, pid); -+ put_pid(pid); -+ } - - if (IS_ERR(context->memory_context)) { - if (PTR_ERR(context->memory_context) != -EOPNOTSUPP) { -diff --git a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c -index 862ca8d0723262..e2047ef864ebfa 100644 ---- a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c -+++ b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c -@@ -163,6 +163,8 @@ static int amd_sfh1_1_hid_client_init(struct amd_mp2_dev *privdata) - if (rc) - goto cleanup; - -+ mp2_ops->stop(privdata, cl_data->sensor_idx[i]); -+ amd_sfh_wait_for_response(privdata, cl_data->sensor_idx[i], DISABLE_SENSOR); - writel(0, privdata->mmio + AMD_P2C_MSG(0)); - mp2_ops->start(privdata, info); - status = amd_sfh_wait_for_response -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index fbbab353f040a8..6a538dca21a9a2 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -1511,7 +1511,7 @@ - #define USB_VENDOR_ID_SIGNOTEC 0x2133 - #define USB_DEVICE_ID_SIGNOTEC_VIEWSONIC_PD1011 0x0018 - --#define USB_VENDOR_ID_SMARTLINKTECHNOLOGY 0x4c4a --#define USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155 0x4155 -+#define USB_VENDOR_ID_JIELI_SDK_DEFAULT 0x4c4a -+#define USB_DEVICE_ID_JIELI_SDK_4155 0x4155 - - #endif -diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c -index 75480ec3c15a2d..fa946666969b8d 100644 ---- a/drivers/hid/hid-quirks.c -+++ b/drivers/hid/hid-quirks.c -@@ -900,7 +900,6 @@ static const struct hid_device_id hid_ignore_list[] = { - #endif - { HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) }, - { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473) }, -- { HID_USB_DEVICE(USB_VENDOR_ID_SMARTLINKTECHNOLOGY, USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155) }, - { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_MULTITOUCH) }, - { HID_USB_DEVICE(USB_VENDOR_ID_ODROID, USB_DEVICE_ID_VU5) }, - { HID_USB_DEVICE(USB_VENDOR_ID_ODROID, USB_DEVICE_ID_VU7PLUS) }, -@@ -1057,6 +1056,18 @@ bool hid_ignore(struct hid_device *hdev) - strlen(elan_acpi_id[i].id))) - return true; - break; -+ case USB_VENDOR_ID_JIELI_SDK_DEFAULT: -+ /* -+ * Multiple USB devices with identical IDs (mic & touchscreen). -+ * The touch screen requires hid core processing, but the -+ * microphone does not. They can be distinguished by manufacturer -+ * and serial number. -+ */ -+ if (hdev->product == USB_DEVICE_ID_JIELI_SDK_4155 && -+ strncmp(hdev->name, "SmartlinkTechnology", 19) == 0 && -+ strncmp(hdev->uniq, "20201111000001", 14) == 0) -+ return true; -+ break; - } - - if (hdev->type == HID_TYPE_USBMOUSE && -diff --git a/drivers/input/keyboard/cros_ec_keyb.c b/drivers/input/keyboard/cros_ec_keyb.c -index e7ecfca838df40..76fcf90ea7c763 100644 ---- a/drivers/input/keyboard/cros_ec_keyb.c -+++ b/drivers/input/keyboard/cros_ec_keyb.c -@@ -263,6 +263,12 @@ static int cros_ec_keyb_work(struct notifier_block *nb, - case EC_MKBP_EVENT_KEY_MATRIX: - pm_wakeup_event(ckdev->dev, 0); - -+ if (!ckdev->idev) { -+ dev_warn_once(ckdev->dev, -+ "Unexpected key matrix event\n"); -+ return NOTIFY_OK; -+ } -+ - if (ckdev->ec->event_size != ckdev->cols) { - dev_err(ckdev->dev, - "Discarded incomplete key matrix event.\n"); -diff --git a/drivers/input/keyboard/imx_sc_key.c b/drivers/input/keyboard/imx_sc_key.c -index d18839f1f4f60d..b620cd310cdb78 100644 ---- a/drivers/input/keyboard/imx_sc_key.c -+++ b/drivers/input/keyboard/imx_sc_key.c -@@ -158,7 +158,7 @@ static int imx_sc_key_probe(struct platform_device *pdev) - return error; - } - -- error = devm_add_action_or_reset(&pdev->dev, imx_sc_key_action, &priv); -+ error = devm_add_action_or_reset(&pdev->dev, imx_sc_key_action, priv); - if (error) - return error; - -diff --git a/drivers/input/tablet/pegasus_notetaker.c b/drivers/input/tablet/pegasus_notetaker.c -index a68da2988f9cd8..26ab9924a7ae54 100644 ---- a/drivers/input/tablet/pegasus_notetaker.c -+++ b/drivers/input/tablet/pegasus_notetaker.c -@@ -63,6 +63,9 @@ - #define BUTTON_PRESSED 0xb5 - #define COMMAND_VERSION 0xa9 - -+/* 1 Status + 1 Color + 2 X + 2 Y = 6 bytes */ -+#define NOTETAKER_PACKET_SIZE 6 -+ - /* in xy data packet */ - #define BATTERY_NO_REPORT 0x40 - #define BATTERY_LOW 0x41 -@@ -303,6 +306,12 @@ static int pegasus_probe(struct usb_interface *intf, - } - - pegasus->data_len = usb_maxpacket(dev, pipe); -+ if (pegasus->data_len < NOTETAKER_PACKET_SIZE) { -+ dev_err(&intf->dev, "packet size is too small (%d)\n", -+ pegasus->data_len); -+ error = -EINVAL; -+ goto err_free_mem; -+ } - - pegasus->data = usb_alloc_coherent(dev, pegasus->data_len, GFP_KERNEL, - &pegasus->data_dma); -diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c -index b068ff8afbc9ad..294bd942ee3794 100644 ---- a/drivers/input/touchscreen/goodix.c -+++ b/drivers/input/touchscreen/goodix.c -@@ -1519,6 +1519,7 @@ MODULE_DEVICE_TABLE(i2c, goodix_ts_id); - static const struct acpi_device_id goodix_acpi_match[] = { - { "GDIX1001", 0 }, - { "GDIX1002", 0 }, -+ { "GDIX1003", 0 }, - { "GDX9110", 0 }, - { } - }; -diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c -index 8dc4f5c493fcba..335c702633ffe0 100644 ---- a/drivers/mtd/mtdchar.c -+++ b/drivers/mtd/mtdchar.c -@@ -599,6 +599,7 @@ mtdchar_write_ioctl(struct mtd_info *mtd, struct mtd_write_req __user *argp) - uint8_t *datbuf = NULL, *oobbuf = NULL; - size_t datbuf_len, oobbuf_len; - int ret = 0; -+ u64 end; - - if (copy_from_user(&req, argp, sizeof(req))) - return -EFAULT; -@@ -618,7 +619,7 @@ mtdchar_write_ioctl(struct mtd_info *mtd, struct mtd_write_req __user *argp) - req.len &= 0xffffffff; - req.ooblen &= 0xffffffff; - -- if (req.start + req.len > mtd->size) -+ if (check_add_overflow(req.start, req.len, &end) || end > mtd->size) - return -EINVAL; - - datbuf_len = min_t(size_t, req.len, mtd->erasesize); -@@ -698,6 +699,7 @@ mtdchar_read_ioctl(struct mtd_info *mtd, struct mtd_read_req __user *argp) - size_t datbuf_len, oobbuf_len; - size_t orig_len, orig_ooblen; - int ret = 0; -+ u64 end; - - if (copy_from_user(&req, argp, sizeof(req))) - return -EFAULT; -@@ -724,7 +726,7 @@ mtdchar_read_ioctl(struct mtd_info *mtd, struct mtd_read_req __user *argp) - req.len &= 0xffffffff; - req.ooblen &= 0xffffffff; - -- if (req.start + req.len > mtd->size) { -+ if (check_add_overflow(req.start, req.len, &end) || end > mtd->size) { - ret = -EINVAL; - goto out; - } -diff --git a/drivers/mtd/nand/raw/cadence-nand-controller.c b/drivers/mtd/nand/raw/cadence-nand-controller.c -index 4f37ca894d18a1..202b4fc064fa39 100644 ---- a/drivers/mtd/nand/raw/cadence-nand-controller.c -+++ b/drivers/mtd/nand/raw/cadence-nand-controller.c -@@ -2876,7 +2876,7 @@ cadence_nand_irq_cleanup(int irqnum, struct cdns_nand_ctrl *cdns_ctrl) - static int cadence_nand_init(struct cdns_nand_ctrl *cdns_ctrl) - { - dma_cap_mask_t mask; -- struct dma_device *dma_dev = cdns_ctrl->dmac->device; -+ struct dma_device *dma_dev; - int ret; - - cdns_ctrl->cdma_desc = dma_alloc_coherent(cdns_ctrl->dev, -@@ -2920,6 +2920,7 @@ static int cadence_nand_init(struct cdns_nand_ctrl *cdns_ctrl) - } - } - -+ dma_dev = cdns_ctrl->dmac->device; - cdns_ctrl->io.iova_dma = dma_map_resource(dma_dev->dev, cdns_ctrl->io.dma, - cdns_ctrl->io.size, - DMA_BIDIRECTIONAL, 0); -diff --git a/drivers/net/dsa/hirschmann/hellcreek_ptp.c b/drivers/net/dsa/hirschmann/hellcreek_ptp.c -index 5249a1c2a80b8c..1bb994f7859636 100644 ---- a/drivers/net/dsa/hirschmann/hellcreek_ptp.c -+++ b/drivers/net/dsa/hirschmann/hellcreek_ptp.c -@@ -371,8 +371,18 @@ static int hellcreek_led_setup(struct hellcreek *hellcreek) - hellcreek_set_brightness(hellcreek, STATUS_OUT_IS_GM, 1); - - /* Register both leds */ -- led_classdev_register(hellcreek->dev, &hellcreek->led_sync_good); -- led_classdev_register(hellcreek->dev, &hellcreek->led_is_gm); -+ ret = led_classdev_register(hellcreek->dev, &hellcreek->led_sync_good); -+ if (ret) { -+ dev_err(hellcreek->dev, "Failed to register sync_good LED\n"); -+ goto out; -+ } -+ -+ ret = led_classdev_register(hellcreek->dev, &hellcreek->led_is_gm); -+ if (ret) { -+ dev_err(hellcreek->dev, "Failed to register is_gm LED\n"); -+ led_classdev_unregister(&hellcreek->led_sync_good); -+ goto out; -+ } - - ret = 0; - -diff --git a/drivers/net/dsa/microchip/lan937x_main.c b/drivers/net/dsa/microchip/lan937x_main.c -index dde37e61faa359..d2e98b5f0aca4c 100644 ---- a/drivers/net/dsa/microchip/lan937x_main.c -+++ b/drivers/net/dsa/microchip/lan937x_main.c -@@ -336,6 +336,7 @@ static void lan937x_set_tune_adj(struct ksz_device *dev, int port, - ksz_pread16(dev, port, reg, &data16); - - /* Update tune Adjust */ -+ data16 &= ~PORT_TUNE_ADJ; - data16 |= FIELD_PREP(PORT_TUNE_ADJ, val); - ksz_pwrite16(dev, port, reg, data16); - -diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c -index 0fda17bc8e2303..011c8cc8429e3a 100644 ---- a/drivers/net/ethernet/emulex/benet/be_main.c -+++ b/drivers/net/ethernet/emulex/benet/be_main.c -@@ -1296,7 +1296,8 @@ static void be_xmit_flush(struct be_adapter *adapter, struct be_tx_obj *txo) - (adapter->bmc_filt_mask & BMC_FILT_MULTICAST) - - static bool be_send_pkt_to_bmc(struct be_adapter *adapter, -- struct sk_buff **skb) -+ struct sk_buff **skb, -+ struct be_wrb_params *wrb_params) - { - struct ethhdr *eh = (struct ethhdr *)(*skb)->data; - bool os2bmc = false; -@@ -1360,7 +1361,7 @@ done: - * to BMC, asic expects the vlan to be inline in the packet. - */ - if (os2bmc) -- *skb = be_insert_vlan_in_pkt(adapter, *skb, NULL); -+ *skb = be_insert_vlan_in_pkt(adapter, *skb, wrb_params); - - return os2bmc; - } -@@ -1387,7 +1388,7 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev) - /* if os2bmc is enabled and if the pkt is destined to bmc, - * enqueue the pkt a 2nd time with mgmt bit set. - */ -- if (be_send_pkt_to_bmc(adapter, &skb)) { -+ if (be_send_pkt_to_bmc(adapter, &skb, &wrb_params)) { - BE_WRB_F_SET(wrb_params.features, OS2BMC, 1); - wrb_cnt = be_xmit_enqueue(adapter, txo, skb, &wrb_params); - if (unlikely(!wrb_cnt)) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c b/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c -index a8d6fd18c0f557..487d8b413a41d7 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c -@@ -323,10 +323,8 @@ err_xa: - free_irq(irq->map.virq, &irq->nh); - err_req_irq: - #ifdef CONFIG_RFS_ACCEL -- if (i && rmap && *rmap) { -- free_irq_cpu_rmap(*rmap); -- *rmap = NULL; -- } -+ if (i && rmap && *rmap) -+ irq_cpu_rmap_remove(*rmap, irq->map.virq); - err_irq_rmap: - #endif - if (i && pci_msix_can_alloc_dyn(dev->pdev)) -diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c b/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c -index b032d5a4b3b84c..10f5bc4892fc75 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c -@@ -601,6 +601,8 @@ int mlxsw_linecard_devlink_info_get(struct mlxsw_linecard *linecard, - err = devlink_info_version_fixed_put(req, - DEVLINK_INFO_VERSION_GENERIC_FW_PSID, - info->psid); -+ if (err) -+ goto unlock; - - sprintf(buf, "%u.%u.%u", info->fw_major, info->fw_minor, - info->fw_sub_minor); -diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c -index 9fd1ca07925849..fba545938fd7d5 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c -@@ -816,8 +816,10 @@ int mlxsw_sp_flower_stats(struct mlxsw_sp *mlxsw_sp, - return -EINVAL; - - rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie); -- if (!rule) -- return -EINVAL; -+ if (!rule) { -+ err = -EINVAL; -+ goto err_rule_get_stats; -+ } - - err = mlxsw_sp_acl_rule_get_stats(mlxsw_sp, rule, &packets, &bytes, - &drops, &lastuse, &used_hw_stats); -diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c -index cb1746bc0e0c5d..273dae622c4113 100644 ---- a/drivers/net/ethernet/qlogic/qede/qede_fp.c -+++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c -@@ -4,6 +4,7 @@ - * Copyright (c) 2019-2020 Marvell International Ltd. - */ - -+#include - #include - #include - #include -@@ -960,7 +961,7 @@ static inline void qede_tpa_cont(struct qede_dev *edev, - { - int i; - -- for (i = 0; cqe->len_list[i]; i++) -+ for (i = 0; cqe->len_list[i] && i < ARRAY_SIZE(cqe->len_list); i++) - qede_fill_frag_skb(edev, rxq, cqe->tpa_agg_index, - le16_to_cpu(cqe->len_list[i])); - -@@ -985,7 +986,7 @@ static int qede_tpa_end(struct qede_dev *edev, - dma_unmap_page(rxq->dev, tpa_info->buffer.mapping, - PAGE_SIZE, rxq->data_direction); - -- for (i = 0; cqe->len_list[i]; i++) -+ for (i = 0; cqe->len_list[i] && i < ARRAY_SIZE(cqe->len_list); i++) - qede_fill_frag_skb(edev, rxq, cqe->tpa_agg_index, - le16_to_cpu(cqe->len_list[i])); - if (unlikely(i > 1)) -diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c -index d829113c16eee3..1c33a9c9ddb5a1 100644 ---- a/drivers/net/ethernet/ti/netcp_core.c -+++ b/drivers/net/ethernet/ti/netcp_core.c -@@ -1338,10 +1338,10 @@ int netcp_txpipe_open(struct netcp_tx_pipe *tx_pipe) - - tx_pipe->dma_channel = knav_dma_open_channel(dev, - tx_pipe->dma_chan_name, &config); -- if (IS_ERR(tx_pipe->dma_channel)) { -+ if (!tx_pipe->dma_channel) { - dev_err(dev, "failed opening tx chan(%s)\n", - tx_pipe->dma_chan_name); -- ret = PTR_ERR(tx_pipe->dma_channel); -+ ret = -EINVAL; - goto err; - } - -@@ -1359,7 +1359,7 @@ int netcp_txpipe_open(struct netcp_tx_pipe *tx_pipe) - return 0; - - err: -- if (!IS_ERR_OR_NULL(tx_pipe->dma_channel)) -+ if (tx_pipe->dma_channel) - knav_dma_close_channel(tx_pipe->dma_channel); - tx_pipe->dma_channel = NULL; - return ret; -@@ -1678,10 +1678,10 @@ static int netcp_setup_navigator_resources(struct net_device *ndev) - - netcp->rx_channel = knav_dma_open_channel(netcp->netcp_device->device, - netcp->dma_chan_name, &config); -- if (IS_ERR(netcp->rx_channel)) { -+ if (!netcp->rx_channel) { - dev_err(netcp->ndev_dev, "failed opening rx chan(%s\n", - netcp->dma_chan_name); -- ret = PTR_ERR(netcp->rx_channel); -+ ret = -EINVAL; - goto fail; - } - -diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c -index bf9ab07257642c..37fede155b920e 100644 ---- a/drivers/nvme/host/fc.c -+++ b/drivers/nvme/host/fc.c -@@ -2349,17 +2349,11 @@ nvme_fc_ctrl_free(struct kref *ref) - container_of(ref, struct nvme_fc_ctrl, ref); - unsigned long flags; - -- if (ctrl->ctrl.tagset) -- nvme_remove_io_tag_set(&ctrl->ctrl); -- - /* remove from rport list */ - spin_lock_irqsave(&ctrl->rport->lock, flags); - list_del(&ctrl->ctrl_list); - spin_unlock_irqrestore(&ctrl->rport->lock, flags); - -- nvme_unquiesce_admin_queue(&ctrl->ctrl); -- nvme_remove_admin_tag_set(&ctrl->ctrl); -- - kfree(ctrl->queues); - - put_device(ctrl->dev); -@@ -3248,13 +3242,20 @@ nvme_fc_delete_ctrl(struct nvme_ctrl *nctrl) - { - struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl); - -- cancel_work_sync(&ctrl->ioerr_work); - cancel_delayed_work_sync(&ctrl->connect_work); -+ - /* - * kill the association on the link side. this will block - * waiting for io to terminate - */ - nvme_fc_delete_association(ctrl); -+ cancel_work_sync(&ctrl->ioerr_work); -+ -+ if (ctrl->ctrl.tagset) -+ nvme_remove_io_tag_set(&ctrl->ctrl); -+ -+ nvme_unquiesce_admin_queue(&ctrl->ctrl); -+ nvme_remove_admin_tag_set(&ctrl->ctrl); - } - - static void -diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c -index 57416bbf9344f0..578f4f29eacfe1 100644 ---- a/drivers/nvme/host/multipath.c -+++ b/drivers/nvme/host/multipath.c -@@ -686,7 +686,7 @@ static void nvme_mpath_set_live(struct nvme_ns *ns) - return; - } - nvme_add_ns_head_cdev(head); -- kblockd_schedule_work(&head->partition_scan_work); -+ queue_work(nvme_wq, &head->partition_scan_work); - } - - mutex_lock(&head->lock); -diff --git a/drivers/pinctrl/cirrus/pinctrl-cs42l43.c b/drivers/pinctrl/cirrus/pinctrl-cs42l43.c -index c0964631841955..e1ac89be7c847d 100644 ---- a/drivers/pinctrl/cirrus/pinctrl-cs42l43.c -+++ b/drivers/pinctrl/cirrus/pinctrl-cs42l43.c -@@ -532,6 +532,11 @@ static int cs42l43_gpio_add_pin_ranges(struct gpio_chip *chip) - return ret; - } - -+static void cs42l43_fwnode_put(void *data) -+{ -+ fwnode_handle_put(data); -+} -+ - static int cs42l43_pin_probe(struct platform_device *pdev) - { - struct cs42l43 *cs42l43 = dev_get_drvdata(pdev->dev.parent); -@@ -563,10 +568,20 @@ static int cs42l43_pin_probe(struct platform_device *pdev) - priv->gpio_chip.ngpio = CS42L43_NUM_GPIOS; - - if (is_of_node(fwnode)) { -- fwnode = fwnode_get_named_child_node(fwnode, "pinctrl"); -- -- if (fwnode && !fwnode->dev) -- fwnode->dev = priv->dev; -+ struct fwnode_handle *child; -+ -+ child = fwnode_get_named_child_node(fwnode, "pinctrl"); -+ if (child) { -+ ret = devm_add_action_or_reset(&pdev->dev, -+ cs42l43_fwnode_put, child); -+ if (ret) { -+ fwnode_handle_put(child); -+ return ret; -+ } -+ if (!child->dev) -+ child->dev = priv->dev; -+ fwnode = child; -+ } - } - - priv->gpio_chip.fwnode = fwnode; -diff --git a/drivers/pinctrl/nxp/pinctrl-s32cc.c b/drivers/pinctrl/nxp/pinctrl-s32cc.c -index 08d80fb935b3ad..9c435e44abb4fc 100644 ---- a/drivers/pinctrl/nxp/pinctrl-s32cc.c -+++ b/drivers/pinctrl/nxp/pinctrl-s32cc.c -@@ -392,6 +392,7 @@ static int s32_pmx_gpio_request_enable(struct pinctrl_dev *pctldev, - - gpio_pin->pin_id = offset; - gpio_pin->config = config; -+ INIT_LIST_HEAD(&gpio_pin->list); - - spin_lock_irqsave(&ipctl->gpio_configs_lock, flags); - list_add(&gpio_pin->list, &ipctl->gpio_configs); -@@ -943,7 +944,7 @@ int s32_pinctrl_probe(struct platform_device *pdev, - spin_lock_init(&ipctl->gpio_configs_lock); - - s32_pinctrl_desc = -- devm_kmalloc(&pdev->dev, sizeof(*s32_pinctrl_desc), GFP_KERNEL); -+ devm_kzalloc(&pdev->dev, sizeof(*s32_pinctrl_desc), GFP_KERNEL); - if (!s32_pinctrl_desc) - return -ENOMEM; - -diff --git a/drivers/platform/x86/intel/speed_select_if/isst_if_mmio.c b/drivers/platform/x86/intel/speed_select_if/isst_if_mmio.c -index ff49025ec0856a..bb38e5f021a808 100644 ---- a/drivers/platform/x86/intel/speed_select_if/isst_if_mmio.c -+++ b/drivers/platform/x86/intel/speed_select_if/isst_if_mmio.c -@@ -106,11 +106,11 @@ static int isst_if_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - - ret = pci_read_config_dword(pdev, 0xD0, &mmio_base); - if (ret) -- return ret; -+ return pcibios_err_to_errno(ret); - - ret = pci_read_config_dword(pdev, 0xFC, &pcu_base); - if (ret) -- return ret; -+ return pcibios_err_to_errno(ret); - - pcu_base &= GENMASK(10, 0); - base_addr = (u64)mmio_base << 23 | (u64) pcu_base << 12; -diff --git a/drivers/pmdomain/imx/gpc.c b/drivers/pmdomain/imx/gpc.c -index 419ed15cc10c42..d7c0301a7121b4 100644 ---- a/drivers/pmdomain/imx/gpc.c -+++ b/drivers/pmdomain/imx/gpc.c -@@ -512,7 +512,7 @@ static int imx_gpc_probe(struct platform_device *pdev) - return 0; - } - --static int imx_gpc_remove(struct platform_device *pdev) -+static void imx_gpc_remove(struct platform_device *pdev) - { - struct device_node *pgc_node; - int ret; -@@ -522,7 +522,7 @@ static int imx_gpc_remove(struct platform_device *pdev) - /* bail out if DT too old and doesn't provide the necessary info */ - if (!of_property_read_bool(pdev->dev.of_node, "#power-domain-cells") && - !pgc_node) -- return 0; -+ return; - - /* - * If the old DT binding is used the toplevel driver needs to -@@ -532,16 +532,22 @@ static int imx_gpc_remove(struct platform_device *pdev) - of_genpd_del_provider(pdev->dev.of_node); - - ret = pm_genpd_remove(&imx_gpc_domains[GPC_PGC_DOMAIN_PU].base); -- if (ret) -- return ret; -+ if (ret) { -+ dev_err(&pdev->dev, "Failed to remove PU power domain (%pe)\n", -+ ERR_PTR(ret)); -+ return; -+ } - imx_pgc_put_clocks(&imx_gpc_domains[GPC_PGC_DOMAIN_PU]); - - ret = pm_genpd_remove(&imx_gpc_domains[GPC_PGC_DOMAIN_ARM].base); -- if (ret) -- return ret; -+ if (ret) { -+ dev_err(&pdev->dev, "Failed to remove ARM power domain (%pe)\n", -+ ERR_PTR(ret)); -+ return; -+ } - } - -- return 0; -+ of_node_put(pgc_node); - } - - static struct platform_driver imx_gpc_driver = { -@@ -550,6 +556,6 @@ static struct platform_driver imx_gpc_driver = { - .of_match_table = imx_gpc_dt_ids, - }, - .probe = imx_gpc_probe, -- .remove = imx_gpc_remove, -+ .remove_new = imx_gpc_remove, - }; - builtin_platform_driver(imx_gpc_driver) -diff --git a/drivers/s390/net/ctcm_mpc.c b/drivers/s390/net/ctcm_mpc.c -index 7a2f34a5e0e09f..f8b3e3f7b8ce04 100644 ---- a/drivers/s390/net/ctcm_mpc.c -+++ b/drivers/s390/net/ctcm_mpc.c -@@ -700,7 +700,6 @@ static void mpc_rcvd_sweep_req(struct mpcg_info *mpcginfo) - - grp->sweep_req_pend_num--; - ctcmpc_send_sweep_resp(ch); -- kfree(mpcginfo); - return; - } - -diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c -index 445f4a220df3eb..f274812aee1e88 100644 ---- a/drivers/scsi/hosts.c -+++ b/drivers/scsi/hosts.c -@@ -602,8 +602,9 @@ int scsi_host_busy(struct Scsi_Host *shost) - { - int cnt = 0; - -- blk_mq_tagset_busy_iter(&shost->tag_set, -- scsi_host_check_in_flight, &cnt); -+ if (shost->tag_set.ops) -+ blk_mq_tagset_busy_iter(&shost->tag_set, -+ scsi_host_check_in_flight, &cnt); - return cnt; - } - EXPORT_SYMBOL(scsi_host_busy); -diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c -index 62574886a9111e..9258a1a8c23c16 100644 ---- a/drivers/scsi/sg.c -+++ b/drivers/scsi/sg.c -@@ -2212,9 +2212,17 @@ sg_remove_sfp_usercontext(struct work_struct *work) - write_lock_irqsave(&sfp->rq_list_lock, iflags); - while (!list_empty(&sfp->rq_list)) { - srp = list_first_entry(&sfp->rq_list, Sg_request, entry); -- sg_finish_rem_req(srp); - list_del(&srp->entry); -+ write_unlock_irqrestore(&sfp->rq_list_lock, iflags); -+ -+ sg_finish_rem_req(srp); -+ /* -+ * sg_rq_end_io() uses srp->parentfp. Hence, only clear -+ * srp->parentfp after blk_mq_free_request() has been called. -+ */ - srp->parentfp = NULL; -+ -+ write_lock_irqsave(&sfp->rq_list_lock, iflags); - } - write_unlock_irqrestore(&sfp->rq_list_lock, iflags); - -diff --git a/drivers/soc/ti/knav_dma.c b/drivers/soc/ti/knav_dma.c -index 0fbc37cd512310..f599eaab3c562c 100644 ---- a/drivers/soc/ti/knav_dma.c -+++ b/drivers/soc/ti/knav_dma.c -@@ -402,7 +402,7 @@ static int of_channel_match_helper(struct device_node *np, const char *name, - * @name: slave channel name - * @config: dma configuration parameters - * -- * Returns pointer to appropriate DMA channel on success or error. -+ * Return: Pointer to appropriate DMA channel on success or NULL on error. - */ - void *knav_dma_open_channel(struct device *dev, const char *name, - struct knav_dma_cfg *config) -@@ -414,13 +414,13 @@ void *knav_dma_open_channel(struct device *dev, const char *name, - - if (!kdev) { - pr_err("keystone-navigator-dma driver not registered\n"); -- return (void *)-EINVAL; -+ return NULL; - } - - chan_num = of_channel_match_helper(dev->of_node, name, &instance); - if (chan_num < 0) { - dev_err(kdev->dev, "No DMA instance with name %s\n", name); -- return (void *)-EINVAL; -+ return NULL; - } - - dev_dbg(kdev->dev, "initializing %s channel %d from DMA %s\n", -@@ -431,7 +431,7 @@ void *knav_dma_open_channel(struct device *dev, const char *name, - if (config->direction != DMA_MEM_TO_DEV && - config->direction != DMA_DEV_TO_MEM) { - dev_err(kdev->dev, "bad direction\n"); -- return (void *)-EINVAL; -+ return NULL; - } - - /* Look for correct dma instance */ -@@ -443,7 +443,7 @@ void *knav_dma_open_channel(struct device *dev, const char *name, - } - if (!dma) { - dev_err(kdev->dev, "No DMA instance with name %s\n", instance); -- return (void *)-EINVAL; -+ return NULL; - } - - /* Look for correct dma channel from dma instance */ -@@ -463,14 +463,14 @@ void *knav_dma_open_channel(struct device *dev, const char *name, - if (!chan) { - dev_err(kdev->dev, "channel %d is not in DMA %s\n", - chan_num, instance); -- return (void *)-EINVAL; -+ return NULL; - } - - if (atomic_read(&chan->ref_count) >= 1) { - if (!check_config(chan, config)) { - dev_err(kdev->dev, "channel %d config miss-match\n", - chan_num); -- return (void *)-EINVAL; -+ return NULL; - } - } - -diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c -index 4ec99a55ac305a..db13c6a379d875 100644 ---- a/drivers/target/loopback/tcm_loop.c -+++ b/drivers/target/loopback/tcm_loop.c -@@ -893,6 +893,9 @@ static ssize_t tcm_loop_tpg_address_show(struct config_item *item, - struct tcm_loop_tpg, tl_se_tpg); - struct tcm_loop_hba *tl_hba = tl_tpg->tl_hba; - -+ if (!tl_hba->sh) -+ return -ENODEV; -+ - return snprintf(page, PAGE_SIZE, "%d:0:%d\n", - tl_hba->sh->host_no, tl_tpg->tl_tpgt); - } -diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c -index 2724656bf63486..69e5016ebd463c 100644 ---- a/drivers/uio/uio_hv_generic.c -+++ b/drivers/uio/uio_hv_generic.c -@@ -80,9 +80,15 @@ hv_uio_irqcontrol(struct uio_info *info, s32 irq_state) - { - struct hv_uio_private_data *pdata = info->priv; - struct hv_device *dev = pdata->device; -+ struct vmbus_channel *primary, *sc; - -- dev->channel->inbound.ring_buffer->interrupt_mask = !irq_state; -- virt_mb(); -+ primary = dev->channel; -+ primary->inbound.ring_buffer->interrupt_mask = !irq_state; -+ -+ mutex_lock(&vmbus_connection.channel_mutex); -+ list_for_each_entry(sc, &primary->sc_list, sc_list) -+ sc->inbound.ring_buffer->interrupt_mask = !irq_state; -+ mutex_unlock(&vmbus_connection.channel_mutex); - - return 0; - } -@@ -93,11 +99,18 @@ hv_uio_irqcontrol(struct uio_info *info, s32 irq_state) - static void hv_uio_channel_cb(void *context) - { - struct vmbus_channel *chan = context; -- struct hv_device *hv_dev = chan->device_obj; -- struct hv_uio_private_data *pdata = hv_get_drvdata(hv_dev); -+ struct hv_device *hv_dev; -+ struct hv_uio_private_data *pdata; - - virt_mb(); - -+ /* -+ * The callback may come from a subchannel, in which case look -+ * for the hv device in the primary channel -+ */ -+ hv_dev = chan->primary_channel ? -+ chan->primary_channel->device_obj : chan->device_obj; -+ pdata = hv_get_drvdata(hv_dev); - uio_event_notify(&pdata->info); - } - -diff --git a/fs/exfat/super.c b/fs/exfat/super.c -index 5affc11d14615a..957135f20cb6f2 100644 ---- a/fs/exfat/super.c -+++ b/fs/exfat/super.c -@@ -411,7 +411,10 @@ static int exfat_read_boot_sector(struct super_block *sb) - struct exfat_sb_info *sbi = EXFAT_SB(sb); - - /* set block size to read super block */ -- sb_min_blocksize(sb, 512); -+ if (!sb_min_blocksize(sb, 512)) { -+ exfat_err(sb, "unable to set blocksize"); -+ return -EINVAL; -+ } - - /* read boot sector */ - sbi->boot_bh = sb_bread(sb, 0); -diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c -index c3b2f78ca4e3e2..df7404214f34eb 100644 ---- a/fs/f2fs/compress.c -+++ b/fs/f2fs/compress.c -@@ -23,20 +23,18 @@ - static struct kmem_cache *cic_entry_slab; - static struct kmem_cache *dic_entry_slab; - --static void *page_array_alloc(struct inode *inode, int nr) -+static void *page_array_alloc(struct f2fs_sb_info *sbi, int nr) - { -- struct f2fs_sb_info *sbi = F2FS_I_SB(inode); - unsigned int size = sizeof(struct page *) * nr; - - if (likely(size <= sbi->page_array_slab_size)) - return f2fs_kmem_cache_alloc(sbi->page_array_slab, -- GFP_F2FS_ZERO, false, F2FS_I_SB(inode)); -+ GFP_F2FS_ZERO, false, sbi); - return f2fs_kzalloc(sbi, size, GFP_NOFS); - } - --static void page_array_free(struct inode *inode, void *pages, int nr) -+static void page_array_free(struct f2fs_sb_info *sbi, void *pages, int nr) - { -- struct f2fs_sb_info *sbi = F2FS_I_SB(inode); - unsigned int size = sizeof(struct page *) * nr; - - if (!pages) -@@ -145,13 +143,13 @@ int f2fs_init_compress_ctx(struct compress_ctx *cc) - if (cc->rpages) - return 0; - -- cc->rpages = page_array_alloc(cc->inode, cc->cluster_size); -+ cc->rpages = page_array_alloc(F2FS_I_SB(cc->inode), cc->cluster_size); - return cc->rpages ? 0 : -ENOMEM; - } - - void f2fs_destroy_compress_ctx(struct compress_ctx *cc, bool reuse) - { -- page_array_free(cc->inode, cc->rpages, cc->cluster_size); -+ page_array_free(F2FS_I_SB(cc->inode), cc->rpages, cc->cluster_size); - cc->rpages = NULL; - cc->nr_rpages = 0; - cc->nr_cpages = 0; -@@ -211,13 +209,13 @@ static int lzo_decompress_pages(struct decompress_io_ctx *dic) - ret = lzo1x_decompress_safe(dic->cbuf->cdata, dic->clen, - dic->rbuf, &dic->rlen); - if (ret != LZO_E_OK) { -- f2fs_err_ratelimited(F2FS_I_SB(dic->inode), -+ f2fs_err_ratelimited(dic->sbi, - "lzo decompress failed, ret:%d", ret); - return -EIO; - } - - if (dic->rlen != PAGE_SIZE << dic->log_cluster_size) { -- f2fs_err_ratelimited(F2FS_I_SB(dic->inode), -+ f2fs_err_ratelimited(dic->sbi, - "lzo invalid rlen:%zu, expected:%lu", - dic->rlen, PAGE_SIZE << dic->log_cluster_size); - return -EIO; -@@ -291,13 +289,13 @@ static int lz4_decompress_pages(struct decompress_io_ctx *dic) - ret = LZ4_decompress_safe(dic->cbuf->cdata, dic->rbuf, - dic->clen, dic->rlen); - if (ret < 0) { -- f2fs_err_ratelimited(F2FS_I_SB(dic->inode), -+ f2fs_err_ratelimited(dic->sbi, - "lz4 decompress failed, ret:%d", ret); - return -EIO; - } - - if (ret != PAGE_SIZE << dic->log_cluster_size) { -- f2fs_err_ratelimited(F2FS_I_SB(dic->inode), -+ f2fs_err_ratelimited(dic->sbi, - "lz4 invalid ret:%d, expected:%lu", - ret, PAGE_SIZE << dic->log_cluster_size); - return -EIO; -@@ -425,7 +423,7 @@ static int zstd_init_decompress_ctx(struct decompress_io_ctx *dic) - - stream = zstd_init_dstream(max_window_size, workspace, workspace_size); - if (!stream) { -- f2fs_err_ratelimited(F2FS_I_SB(dic->inode), -+ f2fs_err_ratelimited(dic->sbi, - "%s zstd_init_dstream failed", __func__); - vfree(workspace); - return -EIO; -@@ -461,14 +459,14 @@ static int zstd_decompress_pages(struct decompress_io_ctx *dic) - - ret = zstd_decompress_stream(stream, &outbuf, &inbuf); - if (zstd_is_error(ret)) { -- f2fs_err_ratelimited(F2FS_I_SB(dic->inode), -+ f2fs_err_ratelimited(dic->sbi, - "%s zstd_decompress_stream failed, ret: %d", - __func__, zstd_get_error_code(ret)); - return -EIO; - } - - if (dic->rlen != outbuf.pos) { -- f2fs_err_ratelimited(F2FS_I_SB(dic->inode), -+ f2fs_err_ratelimited(dic->sbi, - "%s ZSTD invalid rlen:%zu, expected:%lu", - __func__, dic->rlen, - PAGE_SIZE << dic->log_cluster_size); -@@ -614,6 +612,7 @@ static void *f2fs_vmap(struct page **pages, unsigned int count) - - static int f2fs_compress_pages(struct compress_ctx *cc) - { -+ struct f2fs_sb_info *sbi = F2FS_I_SB(cc->inode); - struct f2fs_inode_info *fi = F2FS_I(cc->inode); - const struct f2fs_compress_ops *cops = - f2fs_cops[fi->i_compress_algorithm]; -@@ -634,7 +633,7 @@ static int f2fs_compress_pages(struct compress_ctx *cc) - cc->nr_cpages = DIV_ROUND_UP(max_len, PAGE_SIZE); - cc->valid_nr_cpages = cc->nr_cpages; - -- cc->cpages = page_array_alloc(cc->inode, cc->nr_cpages); -+ cc->cpages = page_array_alloc(sbi, cc->nr_cpages); - if (!cc->cpages) { - ret = -ENOMEM; - goto destroy_compress_ctx; -@@ -709,7 +708,7 @@ out_free_cpages: - if (cc->cpages[i]) - f2fs_compress_free_page(cc->cpages[i]); - } -- page_array_free(cc->inode, cc->cpages, cc->nr_cpages); -+ page_array_free(sbi, cc->cpages, cc->nr_cpages); - cc->cpages = NULL; - destroy_compress_ctx: - if (cops->destroy_compress_ctx) -@@ -727,7 +726,7 @@ static void f2fs_release_decomp_mem(struct decompress_io_ctx *dic, - - void f2fs_decompress_cluster(struct decompress_io_ctx *dic, bool in_task) - { -- struct f2fs_sb_info *sbi = F2FS_I_SB(dic->inode); -+ struct f2fs_sb_info *sbi = dic->sbi; - struct f2fs_inode_info *fi = F2FS_I(dic->inode); - const struct f2fs_compress_ops *cops = - f2fs_cops[fi->i_compress_algorithm]; -@@ -800,7 +799,7 @@ void f2fs_end_read_compressed_page(struct page *page, bool failed, - { - struct decompress_io_ctx *dic = - (struct decompress_io_ctx *)page_private(page); -- struct f2fs_sb_info *sbi = F2FS_I_SB(dic->inode); -+ struct f2fs_sb_info *sbi = dic->sbi; - - dec_page_count(sbi, F2FS_RD_DATA); - -@@ -1302,7 +1301,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc, - cic->magic = F2FS_COMPRESSED_PAGE_MAGIC; - cic->inode = inode; - atomic_set(&cic->pending_pages, cc->valid_nr_cpages); -- cic->rpages = page_array_alloc(cc->inode, cc->cluster_size); -+ cic->rpages = page_array_alloc(sbi, cc->cluster_size); - if (!cic->rpages) - goto out_put_cic; - -@@ -1395,13 +1394,13 @@ unlock_continue: - spin_unlock(&fi->i_size_lock); - - f2fs_put_rpages(cc); -- page_array_free(cc->inode, cc->cpages, cc->nr_cpages); -+ page_array_free(sbi, cc->cpages, cc->nr_cpages); - cc->cpages = NULL; - f2fs_destroy_compress_ctx(cc, false); - return 0; - - out_destroy_crypt: -- page_array_free(cc->inode, cic->rpages, cc->cluster_size); -+ page_array_free(sbi, cic->rpages, cc->cluster_size); - - for (--i; i >= 0; i--) - fscrypt_finalize_bounce_page(&cc->cpages[i]); -@@ -1419,7 +1418,7 @@ out_free: - f2fs_compress_free_page(cc->cpages[i]); - cc->cpages[i] = NULL; - } -- page_array_free(cc->inode, cc->cpages, cc->nr_cpages); -+ page_array_free(sbi, cc->cpages, cc->nr_cpages); - cc->cpages = NULL; - return -EAGAIN; - } -@@ -1449,7 +1448,7 @@ void f2fs_compress_write_end_io(struct bio *bio, struct page *page) - end_page_writeback(cic->rpages[i]); - } - -- page_array_free(cic->inode, cic->rpages, cic->nr_rpages); -+ page_array_free(sbi, cic->rpages, cic->nr_rpages); - kmem_cache_free(cic_entry_slab, cic); - } - -@@ -1580,14 +1579,13 @@ static inline bool allow_memalloc_for_decomp(struct f2fs_sb_info *sbi, - static int f2fs_prepare_decomp_mem(struct decompress_io_ctx *dic, - bool pre_alloc) - { -- const struct f2fs_compress_ops *cops = -- f2fs_cops[F2FS_I(dic->inode)->i_compress_algorithm]; -+ const struct f2fs_compress_ops *cops = f2fs_cops[dic->compress_algorithm]; - int i; - -- if (!allow_memalloc_for_decomp(F2FS_I_SB(dic->inode), pre_alloc)) -+ if (!allow_memalloc_for_decomp(dic->sbi, pre_alloc)) - return 0; - -- dic->tpages = page_array_alloc(dic->inode, dic->cluster_size); -+ dic->tpages = page_array_alloc(dic->sbi, dic->cluster_size); - if (!dic->tpages) - return -ENOMEM; - -@@ -1617,10 +1615,9 @@ static int f2fs_prepare_decomp_mem(struct decompress_io_ctx *dic, - static void f2fs_release_decomp_mem(struct decompress_io_ctx *dic, - bool bypass_destroy_callback, bool pre_alloc) - { -- const struct f2fs_compress_ops *cops = -- f2fs_cops[F2FS_I(dic->inode)->i_compress_algorithm]; -+ const struct f2fs_compress_ops *cops = f2fs_cops[dic->compress_algorithm]; - -- if (!allow_memalloc_for_decomp(F2FS_I_SB(dic->inode), pre_alloc)) -+ if (!allow_memalloc_for_decomp(dic->sbi, pre_alloc)) - return; - - if (!bypass_destroy_callback && cops->destroy_decompress_ctx) -@@ -1647,7 +1644,7 @@ struct decompress_io_ctx *f2fs_alloc_dic(struct compress_ctx *cc) - if (!dic) - return ERR_PTR(-ENOMEM); - -- dic->rpages = page_array_alloc(cc->inode, cc->cluster_size); -+ dic->rpages = page_array_alloc(sbi, cc->cluster_size); - if (!dic->rpages) { - kmem_cache_free(dic_entry_slab, dic); - return ERR_PTR(-ENOMEM); -@@ -1655,6 +1652,8 @@ struct decompress_io_ctx *f2fs_alloc_dic(struct compress_ctx *cc) - - dic->magic = F2FS_COMPRESSED_PAGE_MAGIC; - dic->inode = cc->inode; -+ dic->sbi = sbi; -+ dic->compress_algorithm = F2FS_I(cc->inode)->i_compress_algorithm; - atomic_set(&dic->remaining_pages, cc->nr_cpages); - dic->cluster_idx = cc->cluster_idx; - dic->cluster_size = cc->cluster_size; -@@ -1668,7 +1667,7 @@ struct decompress_io_ctx *f2fs_alloc_dic(struct compress_ctx *cc) - dic->rpages[i] = cc->rpages[i]; - dic->nr_rpages = cc->cluster_size; - -- dic->cpages = page_array_alloc(dic->inode, dic->nr_cpages); -+ dic->cpages = page_array_alloc(sbi, dic->nr_cpages); - if (!dic->cpages) { - ret = -ENOMEM; - goto out_free; -@@ -1698,6 +1697,8 @@ static void f2fs_free_dic(struct decompress_io_ctx *dic, - bool bypass_destroy_callback) - { - int i; -+ /* use sbi in dic to avoid UFA of dic->inode*/ -+ struct f2fs_sb_info *sbi = dic->sbi; - - f2fs_release_decomp_mem(dic, bypass_destroy_callback, true); - -@@ -1709,7 +1710,7 @@ static void f2fs_free_dic(struct decompress_io_ctx *dic, - continue; - f2fs_compress_free_page(dic->tpages[i]); - } -- page_array_free(dic->inode, dic->tpages, dic->cluster_size); -+ page_array_free(sbi, dic->tpages, dic->cluster_size); - } - - if (dic->cpages) { -@@ -1718,10 +1719,10 @@ static void f2fs_free_dic(struct decompress_io_ctx *dic, - continue; - f2fs_compress_free_page(dic->cpages[i]); - } -- page_array_free(dic->inode, dic->cpages, dic->nr_cpages); -+ page_array_free(sbi, dic->cpages, dic->nr_cpages); - } - -- page_array_free(dic->inode, dic->rpages, dic->nr_rpages); -+ page_array_free(sbi, dic->rpages, dic->nr_rpages); - kmem_cache_free(dic_entry_slab, dic); - } - -@@ -1740,8 +1741,7 @@ static void f2fs_put_dic(struct decompress_io_ctx *dic, bool in_task) - f2fs_free_dic(dic, false); - } else { - INIT_WORK(&dic->free_work, f2fs_late_free_dic); -- queue_work(F2FS_I_SB(dic->inode)->post_read_wq, -- &dic->free_work); -+ queue_work(dic->sbi->post_read_wq, &dic->free_work); - } - } - } -diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h -index ab2ddd09d8131c..406243395b943c 100644 ---- a/fs/f2fs/f2fs.h -+++ b/fs/f2fs/f2fs.h -@@ -1493,6 +1493,7 @@ struct compress_io_ctx { - struct decompress_io_ctx { - u32 magic; /* magic number to indicate page is compressed */ - struct inode *inode; /* inode the context belong to */ -+ struct f2fs_sb_info *sbi; /* f2fs_sb_info pointer */ - pgoff_t cluster_idx; /* cluster index number */ - unsigned int cluster_size; /* page count in cluster */ - unsigned int log_cluster_size; /* log of cluster size */ -@@ -1533,6 +1534,7 @@ struct decompress_io_ctx { - - bool failed; /* IO error occurred before decompression? */ - bool need_verity; /* need fs-verity verification after decompression? */ -+ unsigned char compress_algorithm; /* backup algorithm type */ - void *private; /* payload buffer for specified decompression algorithm */ - void *private2; /* extra payload buffer */ - struct work_struct verity_work; /* work to verify the decompressed pages */ -diff --git a/fs/smb/client/cached_dir.c b/fs/smb/client/cached_dir.c -index 539a9038fb0dd2..e92a61e934e447 100644 ---- a/fs/smb/client/cached_dir.c -+++ b/fs/smb/client/cached_dir.c -@@ -16,6 +16,7 @@ static struct cached_fid *init_cached_dir(const char *path); - static void free_cached_dir(struct cached_fid *cfid); - static void smb2_close_cached_fid(struct kref *ref); - static void cfids_laundromat_worker(struct work_struct *work); -+static void close_cached_dir_locked(struct cached_fid *cfid); - - struct cached_dir_dentry { - struct list_head entry; -@@ -362,7 +363,7 @@ out: - * lease. Release one here, and the second below. - */ - cfid->has_lease = false; -- close_cached_dir(cfid); -+ close_cached_dir_locked(cfid); - } - spin_unlock(&cfids->cfid_list_lock); - -@@ -448,18 +449,52 @@ void drop_cached_dir_by_name(const unsigned int xid, struct cifs_tcon *tcon, - spin_lock(&cfid->cfids->cfid_list_lock); - if (cfid->has_lease) { - cfid->has_lease = false; -- close_cached_dir(cfid); -+ close_cached_dir_locked(cfid); - } - spin_unlock(&cfid->cfids->cfid_list_lock); - close_cached_dir(cfid); - } - -- -+/** -+ * close_cached_dir - drop a reference of a cached dir -+ * -+ * The release function will be called with cfid_list_lock held to remove the -+ * cached dirs from the list before any other thread can take another @cfid -+ * ref. Must not be called with cfid_list_lock held; use -+ * close_cached_dir_locked() called instead. -+ * -+ * @cfid: cached dir -+ */ - void close_cached_dir(struct cached_fid *cfid) - { -+ lockdep_assert_not_held(&cfid->cfids->cfid_list_lock); - kref_put_lock(&cfid->refcount, smb2_close_cached_fid, &cfid->cfids->cfid_list_lock); - } - -+/** -+ * close_cached_dir_locked - put a reference of a cached dir with -+ * cfid_list_lock held -+ * -+ * Calling close_cached_dir() with cfid_list_lock held has the potential effect -+ * of causing a deadlock if the invariant of refcount >= 2 is false. -+ * -+ * This function is used in paths that hold cfid_list_lock and expect at least -+ * two references. If that invariant is violated, WARNs and returns without -+ * dropping a reference; the final put must still go through -+ * close_cached_dir(). -+ * -+ * @cfid: cached dir -+ */ -+static void close_cached_dir_locked(struct cached_fid *cfid) -+{ -+ lockdep_assert_held(&cfid->cfids->cfid_list_lock); -+ -+ if (WARN_ON(kref_read(&cfid->refcount) < 2)) -+ return; -+ -+ kref_put(&cfid->refcount, smb2_close_cached_fid); -+} -+ - /* - * Called from cifs_kill_sb when we unmount a share - */ -@@ -692,7 +727,7 @@ static void cfids_invalidation_worker(struct work_struct *work) - list_for_each_entry_safe(cfid, q, &entry, entry) { - list_del(&cfid->entry); - /* Drop the ref-count acquired in invalidate_all_cached_dirs */ -- kref_put(&cfid->refcount, smb2_close_cached_fid); -+ close_cached_dir(cfid); - } - } - -diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c -index 2744d5580d195f..0461f89c4852ed 100644 ---- a/fs/smb/client/cifsfs.c -+++ b/fs/smb/client/cifsfs.c -@@ -133,7 +133,7 @@ module_param(enable_oplocks, bool, 0644); - MODULE_PARM_DESC(enable_oplocks, "Enable or disable oplocks. Default: y/Y/1"); - - module_param(enable_gcm_256, bool, 0644); --MODULE_PARM_DESC(enable_gcm_256, "Enable requesting strongest (256 bit) GCM encryption. Default: y/Y/0"); -+MODULE_PARM_DESC(enable_gcm_256, "Enable requesting strongest (256 bit) GCM encryption. Default: y/Y/1"); - - module_param(require_gcm_256, bool, 0644); - MODULE_PARM_DESC(require_gcm_256, "Require strongest (256 bit) GCM encryption. Default: n/N/0"); -diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c -index cf233cb9c19436..a64c0b0dbec781 100644 ---- a/fs/smb/client/fs_context.c -+++ b/fs/smb/client/fs_context.c -@@ -1726,6 +1726,10 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, - ctx->password = NULL; - kfree_sensitive(ctx->password2); - ctx->password2 = NULL; -+ kfree(ctx->source); -+ ctx->source = NULL; -+ kfree(fc->source); -+ fc->source = NULL; - return -EINVAL; - } - -diff --git a/include/linux/array_size.h b/include/linux/array_size.h -new file mode 100644 -index 00000000000000..06d7d83196ca30 ---- /dev/null -+++ b/include/linux/array_size.h -@@ -0,0 +1,13 @@ -+/* SPDX-License-Identifier: GPL-2.0 */ -+#ifndef _LINUX_ARRAY_SIZE_H -+#define _LINUX_ARRAY_SIZE_H -+ -+#include -+ -+/** -+ * ARRAY_SIZE - get the number of elements in array @arr -+ * @arr: array to be sized -+ */ -+#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr)) -+ -+#endif /* _LINUX_ARRAY_SIZE_H */ -diff --git a/include/linux/ata.h b/include/linux/ata.h -index 792e10a09787f8..c9013e472aa3d5 100644 ---- a/include/linux/ata.h -+++ b/include/linux/ata.h -@@ -566,6 +566,7 @@ struct ata_bmdma_prd { - #define ata_id_has_ncq(id) ((id)[ATA_ID_SATA_CAPABILITY] & (1 << 8)) - #define ata_id_queue_depth(id) (((id)[ATA_ID_QUEUE_DEPTH] & 0x1f) + 1) - #define ata_id_removable(id) ((id)[ATA_ID_CONFIG] & (1 << 7)) -+#define ata_id_is_locked(id) (((id)[ATA_ID_DLF] & 0x7) == 0x7) - #define ata_id_has_atapi_AN(id) \ - ((((id)[ATA_ID_SATA_CAPABILITY] != 0x0000) && \ - ((id)[ATA_ID_SATA_CAPABILITY] != 0xffff)) && \ -diff --git a/include/linux/kernel.h b/include/linux/kernel.h -index cee8fe87e9f4f0..d9ad21058eed9d 100644 ---- a/include/linux/kernel.h -+++ b/include/linux/kernel.h -@@ -13,6 +13,7 @@ - - #include - #include -+#include - #include - #include - #include -@@ -50,12 +51,6 @@ - #define READ 0 - #define WRITE 1 - --/** -- * ARRAY_SIZE - get the number of elements in array @arr -- * @arr: array to be sized -- */ --#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr)) -- - #define PTR_IF(cond, ptr) ((cond) ? (ptr) : NULL) - - #define u64_to_user_ptr(x) ( \ -diff --git a/include/linux/string.h b/include/linux/string.h -index 5077776e995e01..ce137830a0b99c 100644 ---- a/include/linux/string.h -+++ b/include/linux/string.h -@@ -2,6 +2,7 @@ - #ifndef _LINUX_STRING_H_ - #define _LINUX_STRING_H_ - -+#include - #include /* for inline */ - #include /* for size_t */ - #include /* for NULL */ -diff --git a/include/net/tls.h b/include/net/tls.h -index 6c642ea1805041..66527376ca973a 100644 ---- a/include/net/tls.h -+++ b/include/net/tls.h -@@ -474,6 +474,12 @@ tls_offload_rx_resync_async_request_end(struct sock *sk, __be32 seq) - ((u64)ntohl(seq) << 32) | RESYNC_REQ); - } - -+static inline void -+tls_offload_rx_resync_async_request_cancel(struct tls_offload_resync_async *resync_async) -+{ -+ atomic64_set(&resync_async->req, 0); -+} -+ - static inline void - tls_offload_rx_resync_set_type(struct sock *sk, enum tls_offload_sync_type type) - { -diff --git a/include/net/xfrm.h b/include/net/xfrm.h -index fd550c0b563450..84a1c8c861d292 100644 ---- a/include/net/xfrm.h -+++ b/include/net/xfrm.h -@@ -462,7 +462,8 @@ static inline int xfrm_af2proto(unsigned int family) - - static inline const struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto) - { -- if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) || -+ if ((x->sel.family != AF_UNSPEC) || -+ (ipproto == IPPROTO_IPIP && x->props.family == AF_INET) || - (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6)) - return &x->inner_mode; - else -diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c -index e97aeda3a86b55..b6024fc9034906 100644 ---- a/kernel/bpf/trampoline.c -+++ b/kernel/bpf/trampoline.c -@@ -460,10 +460,6 @@ again: - * BPF_TRAMP_F_SHARE_IPMODIFY is set, we can generate the - * trampoline again, and retry register. - */ -- /* reset fops->func and fops->trampoline for re-register */ -- tr->fops->func = NULL; -- tr->fops->trampoline = 0; -- - /* reset im->image memory attr for arch_prepare_bpf_trampoline */ - set_memory_nx((long)im->image, 1); - set_memory_rw((long)im->image, 1); -diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c -index b7246b7171b73b..88024cb22a9dbe 100644 ---- a/kernel/kexec_core.c -+++ b/kernel/kexec_core.c -@@ -1132,7 +1132,7 @@ static int __crash_shrink_memory(struct resource *old_res, - old_res->start = 0; - old_res->end = 0; - } else { -- crashk_res.end = ram_res->start - 1; -+ old_res->end = ram_res->start - 1; - } - - crash_free_reserved_phys_range(ram_res->start, ram_res->end); -diff --git a/kernel/time/timer.c b/kernel/time/timer.c -index 63a8ce7177dd49..4a2aeaa85af314 100644 ---- a/kernel/time/timer.c -+++ b/kernel/time/timer.c -@@ -1413,10 +1413,11 @@ static int __try_to_del_timer_sync(struct timer_list *timer, bool shutdown) - - base = lock_timer_base(timer, &flags); - -- if (base->running_timer != timer) -+ if (base->running_timer != timer) { - ret = detach_if_pending(timer, base, true); -- if (shutdown) -- timer->function = NULL; -+ if (shutdown) -+ timer->function = NULL; -+ } - - raw_spin_unlock_irqrestore(&base->lock, flags); - -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 398992597685b6..44e31eebb7aaab 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -5370,6 +5370,17 @@ static void remove_direct_functions_hash(struct ftrace_hash *hash, unsigned long - } - } - -+static void reset_direct(struct ftrace_ops *ops, unsigned long addr) -+{ -+ struct ftrace_hash *hash = ops->func_hash->filter_hash; -+ -+ remove_direct_functions_hash(hash, addr); -+ -+ /* cleanup for possible another register call */ -+ ops->func = NULL; -+ ops->trampoline = 0; -+} -+ - /** - * register_ftrace_direct - Call a custom trampoline directly - * for multiple functions registered in @ops -@@ -5465,6 +5476,8 @@ int register_ftrace_direct(struct ftrace_ops *ops, unsigned long addr) - ops->direct_call = addr; - - err = register_ftrace_function_nolock(ops); -+ if (err) -+ reset_direct(ops, addr); - - out_unlock: - mutex_unlock(&direct_mutex); -@@ -5497,7 +5510,6 @@ EXPORT_SYMBOL_GPL(register_ftrace_direct); - int unregister_ftrace_direct(struct ftrace_ops *ops, unsigned long addr, - bool free_filters) - { -- struct ftrace_hash *hash = ops->func_hash->filter_hash; - int err; - - if (check_direct_multi(ops)) -@@ -5507,13 +5519,9 @@ int unregister_ftrace_direct(struct ftrace_ops *ops, unsigned long addr, - - mutex_lock(&direct_mutex); - err = unregister_ftrace_function(ops); -- remove_direct_functions_hash(hash, addr); -+ reset_direct(ops, addr); - mutex_unlock(&direct_mutex); - -- /* cleanup for possible another register call */ -- ops->func = NULL; -- ops->trampoline = 0; -- - if (free_filters) - ftrace_free_filter(ops); - return err; -diff --git a/lib/maple_tree.c b/lib/maple_tree.c -index 6f7a2c9cf922a2..e440ffd0e99962 100644 ---- a/lib/maple_tree.c -+++ b/lib/maple_tree.c -@@ -62,6 +62,8 @@ - #define CREATE_TRACE_POINTS - #include - -+#define TP_FCT tracepoint_string(__func__) -+ - #define MA_ROOT_PARENT 1 - - /* -@@ -2990,7 +2992,7 @@ static inline int mas_rebalance(struct ma_state *mas, - MA_STATE(l_mas, mas->tree, mas->index, mas->last); - MA_STATE(r_mas, mas->tree, mas->index, mas->last); - -- trace_ma_op(__func__, mas); -+ trace_ma_op(TP_FCT, mas); - - /* - * Rebalancing occurs if a node is insufficient. Data is rebalanced -@@ -3365,7 +3367,7 @@ static int mas_split(struct ma_state *mas, struct maple_big_node *b_node) - MA_STATE(prev_l_mas, mas->tree, mas->index, mas->last); - MA_STATE(prev_r_mas, mas->tree, mas->index, mas->last); - -- trace_ma_op(__func__, mas); -+ trace_ma_op(TP_FCT, mas); - mas->depth = mas_mt_height(mas); - /* Allocation failures will happen early. */ - mas_node_count(mas, 1 + mas->depth * 2); -@@ -3598,7 +3600,7 @@ static bool mas_is_span_wr(struct ma_wr_state *wr_mas) - return false; - } - -- trace_ma_write(__func__, wr_mas->mas, wr_mas->r_max, entry); -+ trace_ma_write(TP_FCT, wr_mas->mas, wr_mas->r_max, entry); - return true; - } - -@@ -3845,7 +3847,7 @@ static inline int mas_wr_spanning_store(struct ma_wr_state *wr_mas) - * of data may happen. - */ - mas = wr_mas->mas; -- trace_ma_op(__func__, mas); -+ trace_ma_op(TP_FCT, mas); - - if (unlikely(!mas->index && mas->last == ULONG_MAX)) - return mas_new_root(mas, wr_mas->entry); -@@ -3996,7 +3998,7 @@ done: - } else { - memcpy(wr_mas->node, newnode, sizeof(struct maple_node)); - } -- trace_ma_write(__func__, mas, 0, wr_mas->entry); -+ trace_ma_write(TP_FCT, mas, 0, wr_mas->entry); - mas_update_gap(mas); - return true; - } -@@ -4042,7 +4044,7 @@ static inline bool mas_wr_slot_store(struct ma_wr_state *wr_mas) - return false; - } - -- trace_ma_write(__func__, mas, 0, wr_mas->entry); -+ trace_ma_write(TP_FCT, mas, 0, wr_mas->entry); - /* - * Only update gap when the new entry is empty or there is an empty - * entry in the original two ranges. -@@ -4178,7 +4180,7 @@ static inline bool mas_wr_append(struct ma_wr_state *wr_mas, - if (!wr_mas->content || !wr_mas->entry) - mas_update_gap(mas); - -- trace_ma_write(__func__, mas, new_end, wr_mas->entry); -+ trace_ma_write(TP_FCT, mas, new_end, wr_mas->entry); - return true; - } - -@@ -4192,7 +4194,7 @@ static void mas_wr_bnode(struct ma_wr_state *wr_mas) - { - struct maple_big_node b_node; - -- trace_ma_write(__func__, wr_mas->mas, 0, wr_mas->entry); -+ trace_ma_write(TP_FCT, wr_mas->mas, 0, wr_mas->entry); - memset(&b_node, 0, sizeof(struct maple_big_node)); - mas_store_b_node(wr_mas, &b_node, wr_mas->offset_end); - mas_commit_b_node(wr_mas, &b_node, wr_mas->node_end); -@@ -5395,7 +5397,7 @@ void *mas_store(struct ma_state *mas, void *entry) - { - MA_WR_STATE(wr_mas, mas, entry); - -- trace_ma_write(__func__, mas, 0, entry); -+ trace_ma_write(TP_FCT, mas, 0, entry); - #ifdef CONFIG_DEBUG_MAPLE_TREE - if (MAS_WARN_ON(mas, mas->index > mas->last)) - pr_err("Error %lX > %lX %p\n", mas->index, mas->last, entry); -@@ -5433,7 +5435,7 @@ int mas_store_gfp(struct ma_state *mas, void *entry, gfp_t gfp) - MA_WR_STATE(wr_mas, mas, entry); - - mas_wr_store_setup(&wr_mas); -- trace_ma_write(__func__, mas, 0, entry); -+ trace_ma_write(TP_FCT, mas, 0, entry); - retry: - mas_wr_store_entry(&wr_mas); - if (unlikely(mas_nomem(mas, gfp))) -@@ -5457,7 +5459,7 @@ void mas_store_prealloc(struct ma_state *mas, void *entry) - MA_WR_STATE(wr_mas, mas, entry); - - mas_wr_store_setup(&wr_mas); -- trace_ma_write(__func__, mas, 0, entry); -+ trace_ma_write(TP_FCT, mas, 0, entry); - mas_wr_store_entry(&wr_mas); - MAS_WR_BUG_ON(&wr_mas, mas_is_err(mas)); - mas_destroy(mas); -@@ -6245,7 +6247,7 @@ void *mtree_load(struct maple_tree *mt, unsigned long index) - MA_STATE(mas, mt, index, index); - void *entry; - -- trace_ma_read(__func__, &mas); -+ trace_ma_read(TP_FCT, &mas); - rcu_read_lock(); - retry: - entry = mas_start(&mas); -@@ -6288,7 +6290,7 @@ int mtree_store_range(struct maple_tree *mt, unsigned long index, - MA_STATE(mas, mt, index, last); - MA_WR_STATE(wr_mas, &mas, entry); - -- trace_ma_write(__func__, &mas, 0, entry); -+ trace_ma_write(TP_FCT, &mas, 0, entry); - if (WARN_ON_ONCE(xa_is_advanced(entry))) - return -EINVAL; - -@@ -6470,7 +6472,7 @@ void *mtree_erase(struct maple_tree *mt, unsigned long index) - void *entry = NULL; - - MA_STATE(mas, mt, index, index); -- trace_ma_op(__func__, &mas); -+ trace_ma_op(TP_FCT, &mas); - - mtree_lock(mt); - entry = mas_erase(&mas); -@@ -6536,7 +6538,7 @@ void *mt_find(struct maple_tree *mt, unsigned long *index, unsigned long max) - unsigned long copy = *index; - #endif - -- trace_ma_read(__func__, &mas); -+ trace_ma_read(TP_FCT, &mas); - - if ((*index) > max) - return NULL; -diff --git a/mm/mempool.c b/mm/mempool.c -index 734bcf5afbb783..82e4ab399ed1c6 100644 ---- a/mm/mempool.c -+++ b/mm/mempool.c -@@ -64,10 +64,20 @@ static void check_element(mempool_t *pool, void *element) - } else if (pool->free == mempool_free_pages) { - /* Mempools backed by page allocator */ - int order = (int)(long)pool->pool_data; -- void *addr = kmap_atomic((struct page *)element); - -- __check_element(pool, addr, 1UL << (PAGE_SHIFT + order)); -- kunmap_atomic(addr); -+#ifdef CONFIG_HIGHMEM -+ for (int i = 0; i < (1 << order); i++) { -+ struct page *page = (struct page *)element; -+ void *addr = kmap_local_page(page + i); -+ -+ __check_element(pool, addr, PAGE_SIZE); -+ kunmap_local(addr); -+ } -+#else -+ void *addr = page_address((struct page *)element); -+ -+ __check_element(pool, addr, PAGE_SIZE << order); -+#endif - } - } - -@@ -89,10 +99,20 @@ static void poison_element(mempool_t *pool, void *element) - } else if (pool->alloc == mempool_alloc_pages) { - /* Mempools backed by page allocator */ - int order = (int)(long)pool->pool_data; -- void *addr = kmap_atomic((struct page *)element); - -- __poison_element(addr, 1UL << (PAGE_SHIFT + order)); -- kunmap_atomic(addr); -+#ifdef CONFIG_HIGHMEM -+ for (int i = 0; i < (1 << order); i++) { -+ struct page *page = (struct page *)element; -+ void *addr = kmap_local_page(page + i); -+ -+ __poison_element(addr, PAGE_SIZE); -+ kunmap_local(addr); -+ } -+#else -+ void *addr = page_address((struct page *)element); -+ -+ __poison_element(addr, PAGE_SIZE << order); -+#endif - } - } - #else /* CONFIG_DEBUG_SLAB || CONFIG_SLUB_DEBUG_ON */ -diff --git a/mm/shmem.c b/mm/shmem.c -index 2260def68090c7..d24398f56660ce 100644 ---- a/mm/shmem.c -+++ b/mm/shmem.c -@@ -126,8 +126,7 @@ struct shmem_options { - #define SHMEM_SEEN_INODES 2 - #define SHMEM_SEEN_HUGE 4 - #define SHMEM_SEEN_INUMS 8 --#define SHMEM_SEEN_NOSWAP 16 --#define SHMEM_SEEN_QUOTA 32 -+#define SHMEM_SEEN_QUOTA 16 - }; - - #ifdef CONFIG_TMPFS -@@ -4004,7 +4003,6 @@ static int shmem_parse_one(struct fs_context *fc, struct fs_parameter *param) - "Turning off swap in unprivileged tmpfs mounts unsupported"); - } - ctx->noswap = true; -- ctx->seen |= SHMEM_SEEN_NOSWAP; - break; - case Opt_quota: - if (fc->user_ns != &init_user_ns) -@@ -4154,14 +4152,15 @@ static int shmem_reconfigure(struct fs_context *fc) - err = "Current inum too high to switch to 32-bit inums"; - goto out; - } -- if ((ctx->seen & SHMEM_SEEN_NOSWAP) && ctx->noswap && !sbinfo->noswap) { -+ -+ /* -+ * "noswap" doesn't use fsparam_flag_no, i.e. there's no "swap" -+ * counterpart for (re-)enabling swap. -+ */ -+ if (ctx->noswap && !sbinfo->noswap) { - err = "Cannot disable swap on remount"; - goto out; - } -- if (!(ctx->seen & SHMEM_SEEN_NOSWAP) && !ctx->noswap && sbinfo->noswap) { -- err = "Cannot enable swap on remount if it was disabled on first mount"; -- goto out; -- } - - if (ctx->seen & SHMEM_SEEN_QUOTA && - !sb_any_quota_loaded(fc->root->d_sb)) { -diff --git a/net/devlink/rate.c b/net/devlink/rate.c -index dff1593b8406ac..e7e80af4abaf65 100644 ---- a/net/devlink/rate.c -+++ b/net/devlink/rate.c -@@ -702,13 +702,15 @@ void devl_rate_nodes_destroy(struct devlink *devlink) - if (!devlink_rate->parent) - continue; - -- refcount_dec(&devlink_rate->parent->refcnt); - if (devlink_rate_is_leaf(devlink_rate)) - ops->rate_leaf_parent_set(devlink_rate, NULL, devlink_rate->priv, - NULL, NULL); - else if (devlink_rate_is_node(devlink_rate)) - ops->rate_node_parent_set(devlink_rate, NULL, devlink_rate->priv, - NULL, NULL); -+ -+ refcount_dec(&devlink_rate->parent->refcnt); -+ devlink_rate->parent = NULL; - } - list_for_each_entry_safe(devlink_rate, tmp, &devlink->rate_list, list) { - if (devlink_rate_is_node(devlink_rate)) { -diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c -index 10e96ed6c9e395..11e33a43126749 100644 ---- a/net/ipv4/esp4_offload.c -+++ b/net/ipv4/esp4_offload.c -@@ -111,8 +111,10 @@ static struct sk_buff *xfrm4_tunnel_gso_segment(struct xfrm_state *x, - struct sk_buff *skb, - netdev_features_t features) - { -- __be16 type = x->inner_mode.family == AF_INET6 ? htons(ETH_P_IPV6) -- : htons(ETH_P_IP); -+ const struct xfrm_mode *inner_mode = xfrm_ip2inner_mode(x, -+ XFRM_MODE_SKB_CB(skb)->protocol); -+ __be16 type = inner_mode->family == AF_INET6 ? htons(ETH_P_IPV6) -+ : htons(ETH_P_IP); - - return skb_eth_gso_segment(skb, features, type); - } -diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c -index a189e08370a5ea..438f9cbdca299a 100644 ---- a/net/ipv6/esp6_offload.c -+++ b/net/ipv6/esp6_offload.c -@@ -145,8 +145,10 @@ static struct sk_buff *xfrm6_tunnel_gso_segment(struct xfrm_state *x, - struct sk_buff *skb, - netdev_features_t features) - { -- __be16 type = x->inner_mode.family == AF_INET ? htons(ETH_P_IP) -- : htons(ETH_P_IPV6); -+ const struct xfrm_mode *inner_mode = xfrm_ip2inner_mode(x, -+ XFRM_MODE_SKB_CB(skb)->protocol); -+ __be16 type = inner_mode->family == AF_INET ? htons(ETH_P_IP) -+ : htons(ETH_P_IPV6); - - return skb_eth_gso_segment(skb, features, type); - } -diff --git a/net/mptcp/options.c b/net/mptcp/options.c -index b245abd08c8241..f1edae5f90790b 100644 ---- a/net/mptcp/options.c -+++ b/net/mptcp/options.c -@@ -839,8 +839,11 @@ bool mptcp_established_options(struct sock *sk, struct sk_buff *skb, - - opts->suboptions = 0; - -+ /* Force later mptcp_write_options(), but do not use any actual -+ * option space. -+ */ - if (unlikely(__mptcp_check_fallback(msk) && !mptcp_check_infinite_map(skb))) -- return false; -+ return true; - - if (unlikely(skb && TCP_SKB_CB(skb)->tcp_flags & TCPHDR_RST)) { - if (mptcp_established_options_fastclose(sk, &opt_size, remaining, opts) || -@@ -1041,6 +1044,31 @@ static void __mptcp_snd_una_update(struct mptcp_sock *msk, u64 new_snd_una) - msk->snd_una = new_snd_una; - } - -+static void rwin_update(struct mptcp_sock *msk, struct sock *ssk, -+ struct sk_buff *skb) -+{ -+ struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk); -+ struct tcp_sock *tp = tcp_sk(ssk); -+ u64 mptcp_rcv_wnd; -+ -+ /* Avoid touching extra cachelines if TCP is going to accept this -+ * skb without filling the TCP-level window even with a possibly -+ * outdated mptcp-level rwin. -+ */ -+ if (!skb->len || skb->len < tcp_receive_window(tp)) -+ return; -+ -+ mptcp_rcv_wnd = atomic64_read(&msk->rcv_wnd_sent); -+ if (!after64(mptcp_rcv_wnd, subflow->rcv_wnd_sent)) -+ return; -+ -+ /* Some other subflow grew the mptcp-level rwin since rcv_wup, -+ * resync. -+ */ -+ tp->rcv_wnd += mptcp_rcv_wnd - subflow->rcv_wnd_sent; -+ subflow->rcv_wnd_sent = mptcp_rcv_wnd; -+} -+ - static void ack_update_msk(struct mptcp_sock *msk, - struct sock *ssk, - struct mptcp_options_received *mp_opt) -@@ -1207,6 +1235,7 @@ bool mptcp_incoming_options(struct sock *sk, struct sk_buff *skb) - */ - if (mp_opt.use_ack) - ack_update_msk(msk, sk, &mp_opt); -+ rwin_update(msk, sk, skb); - - /* Zero-data-length packets are dropped by the caller and not - * propagated to the MPTCP layer, so the skb extension does not -@@ -1293,6 +1322,10 @@ static void mptcp_set_rwin(struct tcp_sock *tp, struct tcphdr *th) - - if (rcv_wnd_new != rcv_wnd_old) { - raise_win: -+ /* The msk-level rcv wnd is after the tcp level one, -+ * sync the latter. -+ */ -+ rcv_wnd_new = rcv_wnd_old; - win = rcv_wnd_old - ack_seq; - tp->rcv_wnd = min_t(u64, win, U32_MAX); - new_win = tp->rcv_wnd; -@@ -1316,6 +1349,21 @@ raise_win: - - update_wspace: - WRITE_ONCE(msk->old_wspace, tp->rcv_wnd); -+ subflow->rcv_wnd_sent = rcv_wnd_new; -+} -+ -+static void mptcp_track_rwin(struct tcp_sock *tp) -+{ -+ const struct sock *ssk = (const struct sock *)tp; -+ struct mptcp_subflow_context *subflow; -+ struct mptcp_sock *msk; -+ -+ if (!ssk) -+ return; -+ -+ subflow = mptcp_subflow_ctx(ssk); -+ msk = mptcp_sk(subflow->conn); -+ WRITE_ONCE(msk->old_wspace, tp->rcv_wnd); - } - - __sum16 __mptcp_make_csum(u64 data_seq, u32 subflow_seq, u16 data_len, __wsum sum) -@@ -1610,6 +1658,10 @@ mp_rst: - opts->reset_transient, - opts->reset_reason); - return; -+ } else if (unlikely(!opts->suboptions)) { -+ /* Fallback to TCP */ -+ mptcp_track_rwin(tp); -+ return; - } - - if (OPTION_MPTCP_PRIO & opts->suboptions) { -diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c -index 7fd6714f41fe79..8dbe826555d29f 100644 ---- a/net/mptcp/pm_netlink.c -+++ b/net/mptcp/pm_netlink.c -@@ -29,6 +29,7 @@ struct mptcp_pm_add_entry { - u8 retrans_times; - struct timer_list add_timer; - struct mptcp_sock *sock; -+ struct rcu_head rcu; - }; - - struct pm_nl_pernet { -@@ -344,22 +345,27 @@ mptcp_pm_del_add_timer(struct mptcp_sock *msk, - { - struct mptcp_pm_add_entry *entry; - struct sock *sk = (struct sock *)msk; -- struct timer_list *add_timer = NULL; -+ bool stop_timer = false; -+ -+ rcu_read_lock(); - - spin_lock_bh(&msk->pm.lock); - entry = mptcp_lookup_anno_list_by_saddr(msk, addr); - if (entry && (!check_id || entry->addr.id == addr->id)) { - entry->retrans_times = ADD_ADDR_RETRANS_MAX; -- add_timer = &entry->add_timer; -+ stop_timer = true; - } - if (!check_id && entry) - list_del(&entry->list); - spin_unlock_bh(&msk->pm.lock); - -- /* no lock, because sk_stop_timer_sync() is calling del_timer_sync() */ -- if (add_timer) -- sk_stop_timer_sync(sk, add_timer); -+ /* Note: entry might have been removed by another thread. -+ * We hold rcu_read_lock() to ensure it is not freed under us. -+ */ -+ if (stop_timer) -+ sk_stop_timer_sync(sk, &entry->add_timer); - -+ rcu_read_unlock(); - return entry; - } - -@@ -415,7 +421,7 @@ void mptcp_pm_free_anno_list(struct mptcp_sock *msk) - - list_for_each_entry_safe(entry, tmp, &free_list, list) { - sk_stop_timer_sync(sk, &entry->add_timer); -- kfree(entry); -+ kfree_rcu(entry, rcu); - } - } - -@@ -1573,7 +1579,7 @@ static bool remove_anno_list_by_saddr(struct mptcp_sock *msk, - - entry = mptcp_pm_del_add_timer(msk, addr, false); - if (entry) { -- kfree(entry); -+ kfree_rcu(entry, rcu); - return true; - } - -diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c -index 6b4b0c40570cef..73b3a44b183fc9 100644 ---- a/net/mptcp/protocol.c -+++ b/net/mptcp/protocol.c -@@ -57,11 +57,13 @@ static u64 mptcp_wnd_end(const struct mptcp_sock *msk) - - static const struct proto_ops *mptcp_fallback_tcp_ops(const struct sock *sk) - { -+ unsigned short family = READ_ONCE(sk->sk_family); -+ - #if IS_ENABLED(CONFIG_MPTCP_IPV6) -- if (sk->sk_prot == &tcpv6_prot) -+ if (family == AF_INET6) - return &inet6_stream_ops; - #endif -- WARN_ON_ONCE(sk->sk_prot != &tcp_prot); -+ WARN_ON_ONCE(family != AF_INET); - return &inet_stream_ops; - } - -@@ -902,6 +904,13 @@ static bool __mptcp_finish_join(struct mptcp_sock *msk, struct sock *ssk) - if (sk->sk_state != TCP_ESTABLISHED) - return false; - -+ /* The caller possibly is not holding the msk socket lock, but -+ * in the fallback case only the current subflow is touching -+ * the OoO queue. -+ */ -+ if (!RB_EMPTY_ROOT(&msk->out_of_order_queue)) -+ return false; -+ - spin_lock_bh(&msk->fallback_lock); - if (!msk->allow_subflows) { - spin_unlock_bh(&msk->fallback_lock); -@@ -959,14 +968,19 @@ static void mptcp_reset_rtx_timer(struct sock *sk) - - bool mptcp_schedule_work(struct sock *sk) - { -- if (inet_sk_state_load(sk) != TCP_CLOSE && -- schedule_work(&mptcp_sk(sk)->work)) { -- /* each subflow already holds a reference to the sk, and the -- * workqueue is invoked by a subflow, so sk can't go away here. -- */ -- sock_hold(sk); -+ if (inet_sk_state_load(sk) == TCP_CLOSE) -+ return false; -+ -+ /* Get a reference on this socket, mptcp_worker() will release it. -+ * As mptcp_worker() might complete before us, we can not avoid -+ * a sock_hold()/sock_put() if schedule_work() returns false. -+ */ -+ sock_hold(sk); -+ -+ if (schedule_work(&mptcp_sk(sk)->work)) - return true; -- } -+ -+ sock_put(sk); - return false; - } - -@@ -2578,7 +2592,8 @@ static void __mptcp_close_subflow(struct sock *sk) - - if (ssk_state != TCP_CLOSE && - (ssk_state != TCP_CLOSE_WAIT || -- inet_sk_state_load(sk) != TCP_ESTABLISHED)) -+ inet_sk_state_load(sk) != TCP_ESTABLISHED || -+ __mptcp_check_fallback(msk))) - continue; - - /* 'subflow_data_ready' will re-sched once rx queue is empty */ -@@ -2814,7 +2829,11 @@ static void mptcp_worker(struct work_struct *work) - __mptcp_close_subflow(sk); - - if (mptcp_close_tout_expired(sk)) { -+ struct mptcp_subflow_context *subflow, *tmp; -+ - mptcp_do_fastclose(sk); -+ mptcp_for_each_subflow_safe(msk, subflow, tmp) -+ __mptcp_close_ssk(sk, subflow->tcp_sock, subflow, 0); - mptcp_close_wake_up(sk); - } - -@@ -3242,7 +3261,8 @@ static int mptcp_disconnect(struct sock *sk, int flags) - /* msk->subflow is still intact, the following will not free the first - * subflow - */ -- mptcp_destroy_common(msk, MPTCP_CF_FASTCLOSE); -+ mptcp_do_fastclose(sk); -+ mptcp_destroy_common(msk); - - /* The first subflow is already in TCP_CLOSE status, the following - * can't overlap with a fallback anymore -@@ -3424,7 +3444,7 @@ void mptcp_rcv_space_init(struct mptcp_sock *msk, const struct sock *ssk) - msk->rcvq_space.space = TCP_INIT_CWND * TCP_MSS_DEFAULT; - } - --void mptcp_destroy_common(struct mptcp_sock *msk, unsigned int flags) -+void mptcp_destroy_common(struct mptcp_sock *msk) - { - struct mptcp_subflow_context *subflow, *tmp; - struct sock *sk = (struct sock *)msk; -@@ -3433,7 +3453,7 @@ void mptcp_destroy_common(struct mptcp_sock *msk, unsigned int flags) - - /* join list will be eventually flushed (with rst) at sock lock release time */ - mptcp_for_each_subflow_safe(msk, subflow, tmp) -- __mptcp_close_ssk(sk, mptcp_subflow_tcp_sock(subflow), subflow, flags); -+ __mptcp_close_ssk(sk, mptcp_subflow_tcp_sock(subflow), subflow, 0); - - /* move to sk_receive_queue, sk_stream_kill_queues will purge it */ - mptcp_data_lock(sk); -@@ -3458,7 +3478,7 @@ static void mptcp_destroy(struct sock *sk) - - /* allow the following to close even the initial subflow */ - msk->free_first = 1; -- mptcp_destroy_common(msk, 0); -+ mptcp_destroy_common(msk); - sk_sockets_allocated_dec(sk); - } - -diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h -index dc98f588c8a829..5d218c27c07767 100644 ---- a/net/mptcp/protocol.h -+++ b/net/mptcp/protocol.h -@@ -478,6 +478,7 @@ struct mptcp_subflow_context { - u64 remote_key; - u64 idsn; - u64 map_seq; -+ u64 rcv_wnd_sent; - u32 snd_isn; - u32 token; - u32 rel_write_seq; -@@ -870,7 +871,7 @@ static inline void mptcp_propagate_sndbuf(struct sock *sk, struct sock *ssk) - local_bh_enable(); - } - --void mptcp_destroy_common(struct mptcp_sock *msk, unsigned int flags); -+void mptcp_destroy_common(struct mptcp_sock *msk); - - #define MPTCP_TOKEN_MAX_RETRIES 4 - -diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c -index dfee1890c841bb..b71675f46d1078 100644 ---- a/net/mptcp/subflow.c -+++ b/net/mptcp/subflow.c -@@ -2095,6 +2095,10 @@ void __init mptcp_subflow_init(void) - tcp_prot_override = tcp_prot; - tcp_prot_override.release_cb = tcp_release_cb_override; - tcp_prot_override.diag_destroy = tcp_abort_override; -+#ifdef CONFIG_BPF_SYSCALL -+ /* Disable sockmap processing for subflows */ -+ tcp_prot_override.psock_update_sk_prot = NULL; -+#endif - - #if IS_ENABLED(CONFIG_MPTCP_IPV6) - /* In struct mptcp_subflow_request_sock, we assume the TCP request sock -@@ -2132,6 +2136,10 @@ void __init mptcp_subflow_init(void) - tcpv6_prot_override = tcpv6_prot; - tcpv6_prot_override.release_cb = tcp_release_cb_override; - tcpv6_prot_override.diag_destroy = tcp_abort_override; -+#ifdef CONFIG_BPF_SYSCALL -+ /* Disable sockmap processing for subflows */ -+ tcpv6_prot_override.psock_update_sk_prot = NULL; -+#endif - #endif - - mptcp_diag_subflow_init(&subflow_ulp_ops); -diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c -index 10c646b32b9d08..0ea4fc2a755bfd 100644 ---- a/net/openvswitch/actions.c -+++ b/net/openvswitch/actions.c -@@ -597,69 +597,6 @@ static int set_ipv6(struct sk_buff *skb, struct sw_flow_key *flow_key, - return 0; - } - --static int set_nsh(struct sk_buff *skb, struct sw_flow_key *flow_key, -- const struct nlattr *a) --{ -- struct nshhdr *nh; -- size_t length; -- int err; -- u8 flags; -- u8 ttl; -- int i; -- -- struct ovs_key_nsh key; -- struct ovs_key_nsh mask; -- -- err = nsh_key_from_nlattr(a, &key, &mask); -- if (err) -- return err; -- -- /* Make sure the NSH base header is there */ -- if (!pskb_may_pull(skb, skb_network_offset(skb) + NSH_BASE_HDR_LEN)) -- return -ENOMEM; -- -- nh = nsh_hdr(skb); -- length = nsh_hdr_len(nh); -- -- /* Make sure the whole NSH header is there */ -- err = skb_ensure_writable(skb, skb_network_offset(skb) + -- length); -- if (unlikely(err)) -- return err; -- -- nh = nsh_hdr(skb); -- skb_postpull_rcsum(skb, nh, length); -- flags = nsh_get_flags(nh); -- flags = OVS_MASKED(flags, key.base.flags, mask.base.flags); -- flow_key->nsh.base.flags = flags; -- ttl = nsh_get_ttl(nh); -- ttl = OVS_MASKED(ttl, key.base.ttl, mask.base.ttl); -- flow_key->nsh.base.ttl = ttl; -- nsh_set_flags_and_ttl(nh, flags, ttl); -- nh->path_hdr = OVS_MASKED(nh->path_hdr, key.base.path_hdr, -- mask.base.path_hdr); -- flow_key->nsh.base.path_hdr = nh->path_hdr; -- switch (nh->mdtype) { -- case NSH_M_TYPE1: -- for (i = 0; i < NSH_MD1_CONTEXT_SIZE; i++) { -- nh->md1.context[i] = -- OVS_MASKED(nh->md1.context[i], key.context[i], -- mask.context[i]); -- } -- memcpy(flow_key->nsh.context, nh->md1.context, -- sizeof(nh->md1.context)); -- break; -- case NSH_M_TYPE2: -- memset(flow_key->nsh.context, 0, -- sizeof(flow_key->nsh.context)); -- break; -- default: -- return -EINVAL; -- } -- skb_postpush_rcsum(skb, nh, length); -- return 0; --} -- - /* Must follow skb_ensure_writable() since that can move the skb data. */ - static void set_tp_port(struct sk_buff *skb, __be16 *port, - __be16 new_port, __sum16 *check) -@@ -1143,10 +1080,6 @@ static int execute_masked_set_action(struct sk_buff *skb, - get_mask(a, struct ovs_key_ethernet *)); - break; - -- case OVS_KEY_ATTR_NSH: -- err = set_nsh(skb, flow_key, a); -- break; -- - case OVS_KEY_ATTR_IPV4: - err = set_ipv4(skb, flow_key, nla_data(a), - get_mask(a, struct ovs_key_ipv4 *)); -@@ -1183,6 +1116,7 @@ static int execute_masked_set_action(struct sk_buff *skb, - case OVS_KEY_ATTR_CT_LABELS: - case OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4: - case OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6: -+ case OVS_KEY_ATTR_NSH: - err = -EINVAL; - break; - } -diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c -index 089ab1826e1d5e..836e8e705d40e7 100644 ---- a/net/openvswitch/flow_netlink.c -+++ b/net/openvswitch/flow_netlink.c -@@ -1292,6 +1292,11 @@ static int metadata_from_nlattrs(struct net *net, struct sw_flow_match *match, - return 0; - } - -+/* -+ * Constructs NSH header 'nh' from attributes of OVS_ACTION_ATTR_PUSH_NSH, -+ * where 'nh' points to a memory block of 'size' bytes. It's assumed that -+ * attributes were previously validated with validate_push_nsh(). -+ */ - int nsh_hdr_from_nlattr(const struct nlattr *attr, - struct nshhdr *nh, size_t size) - { -@@ -1301,8 +1306,6 @@ int nsh_hdr_from_nlattr(const struct nlattr *attr, - u8 ttl = 0; - int mdlen = 0; - -- /* validate_nsh has check this, so we needn't do duplicate check here -- */ - if (size < NSH_BASE_HDR_LEN) - return -ENOBUFS; - -@@ -1346,46 +1349,6 @@ int nsh_hdr_from_nlattr(const struct nlattr *attr, - return 0; - } - --int nsh_key_from_nlattr(const struct nlattr *attr, -- struct ovs_key_nsh *nsh, struct ovs_key_nsh *nsh_mask) --{ -- struct nlattr *a; -- int rem; -- -- /* validate_nsh has check this, so we needn't do duplicate check here -- */ -- nla_for_each_nested(a, attr, rem) { -- int type = nla_type(a); -- -- switch (type) { -- case OVS_NSH_KEY_ATTR_BASE: { -- const struct ovs_nsh_key_base *base = nla_data(a); -- const struct ovs_nsh_key_base *base_mask = base + 1; -- -- nsh->base = *base; -- nsh_mask->base = *base_mask; -- break; -- } -- case OVS_NSH_KEY_ATTR_MD1: { -- const struct ovs_nsh_key_md1 *md1 = nla_data(a); -- const struct ovs_nsh_key_md1 *md1_mask = md1 + 1; -- -- memcpy(nsh->context, md1->context, sizeof(*md1)); -- memcpy(nsh_mask->context, md1_mask->context, -- sizeof(*md1_mask)); -- break; -- } -- case OVS_NSH_KEY_ATTR_MD2: -- /* Not supported yet */ -- return -ENOTSUPP; -- default: -- return -EINVAL; -- } -- } -- -- return 0; --} -- - static int nsh_key_put_from_nlattr(const struct nlattr *attr, - struct sw_flow_match *match, bool is_mask, - bool is_push_nsh, bool log) -@@ -2825,17 +2788,13 @@ static int validate_and_copy_set_tun(const struct nlattr *attr, - return err; - } - --static bool validate_nsh(const struct nlattr *attr, bool is_mask, -- bool is_push_nsh, bool log) -+static bool validate_push_nsh(const struct nlattr *attr, bool log) - { - struct sw_flow_match match; - struct sw_flow_key key; -- int ret = 0; - - ovs_match_init(&match, &key, true, NULL); -- ret = nsh_key_put_from_nlattr(attr, &match, is_mask, -- is_push_nsh, log); -- return !ret; -+ return !nsh_key_put_from_nlattr(attr, &match, false, true, log); - } - - /* Return false if there are any non-masked bits set. -@@ -2983,13 +2942,6 @@ static int validate_set(const struct nlattr *a, - - break; - -- case OVS_KEY_ATTR_NSH: -- if (eth_type != htons(ETH_P_NSH)) -- return -EINVAL; -- if (!validate_nsh(nla_data(a), masked, false, log)) -- return -EINVAL; -- break; -- - default: - return -EINVAL; - } -@@ -3399,7 +3351,7 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, - return -EINVAL; - } - mac_proto = MAC_PROTO_NONE; -- if (!validate_nsh(nla_data(a), false, true, true)) -+ if (!validate_push_nsh(nla_data(a), log)) - return -EINVAL; - break; - -diff --git a/net/openvswitch/flow_netlink.h b/net/openvswitch/flow_netlink.h -index fe7f77fc5f1890..ff8cdecbe34654 100644 ---- a/net/openvswitch/flow_netlink.h -+++ b/net/openvswitch/flow_netlink.h -@@ -65,8 +65,6 @@ int ovs_nla_put_actions(const struct nlattr *attr, - void ovs_nla_free_flow_actions(struct sw_flow_actions *); - void ovs_nla_free_flow_actions_rcu(struct sw_flow_actions *); - --int nsh_key_from_nlattr(const struct nlattr *attr, struct ovs_key_nsh *nsh, -- struct ovs_key_nsh *nsh_mask); - int nsh_hdr_from_nlattr(const struct nlattr *attr, struct nshhdr *nh, - size_t size); - -diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c -index 8c94c926606ad5..4f72fd26ab4058 100644 ---- a/net/tls/tls_device.c -+++ b/net/tls/tls_device.c -@@ -727,8 +727,10 @@ tls_device_rx_resync_async(struct tls_offload_resync_async *resync_async, - /* shouldn't get to wraparound: - * too long in async stage, something bad happened - */ -- if (WARN_ON_ONCE(resync_async->rcd_delta == USHRT_MAX)) -+ if (WARN_ON_ONCE(resync_async->rcd_delta == USHRT_MAX)) { -+ tls_offload_rx_resync_async_request_cancel(resync_async); - return false; -+ } - - /* asynchronous stage: log all headers seq such that - * req_seq <= seq <= end_seq, and wait for real resync request -diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c -index 64790062cfa2eb..ca1289e64bcc8a 100644 ---- a/net/vmw_vsock/af_vsock.c -+++ b/net/vmw_vsock/af_vsock.c -@@ -1550,18 +1550,40 @@ static int vsock_connect(struct socket *sock, struct sockaddr *addr, - timeout = schedule_timeout(timeout); - lock_sock(sk); - -- if (signal_pending(current)) { -- err = sock_intr_errno(timeout); -- sk->sk_state = sk->sk_state == TCP_ESTABLISHED ? TCP_CLOSING : TCP_CLOSE; -- sock->state = SS_UNCONNECTED; -- vsock_transport_cancel_pkt(vsk); -- vsock_remove_connected(vsk); -- goto out_wait; -- } else if ((sk->sk_state != TCP_ESTABLISHED) && (timeout == 0)) { -- err = -ETIMEDOUT; -+ /* Connection established. Whatever happens to socket once we -+ * release it, that's not connect()'s concern. No need to go -+ * into signal and timeout handling. Call it a day. -+ * -+ * Note that allowing to "reset" an already established socket -+ * here is racy and insecure. -+ */ -+ if (sk->sk_state == TCP_ESTABLISHED) -+ break; -+ -+ /* If connection was _not_ established and a signal/timeout came -+ * to be, we want the socket's state reset. User space may want -+ * to retry. -+ * -+ * sk_state != TCP_ESTABLISHED implies that socket is not on -+ * vsock_connected_table. We keep the binding and the transport -+ * assigned. -+ */ -+ if (signal_pending(current) || timeout == 0) { -+ err = timeout == 0 ? -ETIMEDOUT : sock_intr_errno(timeout); -+ -+ /* Listener might have already responded with -+ * VIRTIO_VSOCK_OP_RESPONSE. Its handling expects our -+ * sk_state == TCP_SYN_SENT, which hereby we break. -+ * In such case VIRTIO_VSOCK_OP_RST will follow. -+ */ - sk->sk_state = TCP_CLOSE; - sock->state = SS_UNCONNECTED; -+ -+ /* Try to cancel VIRTIO_VSOCK_OP_REQUEST skb sent out by -+ * transport->connect(). -+ */ - vsock_transport_cancel_pkt(vsk); -+ - goto out_wait; - } - -diff --git a/net/wireless/reg.c b/net/wireless/reg.c -index 9e0366ea86f4a5..4c695f29dfed70 100644 ---- a/net/wireless/reg.c -+++ b/net/wireless/reg.c -@@ -4208,6 +4208,9 @@ EXPORT_SYMBOL(regulatory_pre_cac_allowed); - static void cfg80211_check_and_end_cac(struct cfg80211_registered_device *rdev) - { - struct wireless_dev *wdev; -+ -+ wiphy_lock(&rdev->wiphy); -+ - /* If we finished CAC or received radar, we should end any - * CAC running on the same channels. - * the check !cfg80211_chandef_dfs_usable contain 2 options: -@@ -4231,6 +4234,8 @@ static void cfg80211_check_and_end_cac(struct cfg80211_registered_device *rdev) - if (!cfg80211_chandef_dfs_usable(&rdev->wiphy, chandef)) - rdev_end_cac(rdev, wdev->netdev); - } -+ -+ wiphy_unlock(&rdev->wiphy); - } - - void regulatory_propagate_dfs_state(struct wiphy *wiphy, -diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c -index a30538a980cc7f..9277dd4ed541ab 100644 ---- a/net/xfrm/xfrm_output.c -+++ b/net/xfrm/xfrm_output.c -@@ -766,8 +766,12 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb) - /* Exclusive direct xmit for tunnel mode, as - * some filtering or matching rules may apply - * in transport mode. -+ * Locally generated packets also require -+ * the normal XFRM path for L2 header setup, -+ * as the hardware needs the L2 header to match -+ * for encryption, so skip direct output as well. - */ -- if (x->props.mode == XFRM_MODE_TUNNEL) -+ if (x->props.mode == XFRM_MODE_TUNNEL && !skb->sk) - return xfrm_dev_direct_output(sk, x, skb); - - return xfrm_output_resume(sk, skb, 0); -diff --git a/scripts/kconfig/mconf.c b/scripts/kconfig/mconf.c -index 3795c36a9181aa..2364140596c5d7 100644 ---- a/scripts/kconfig/mconf.c -+++ b/scripts/kconfig/mconf.c -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -1015,6 +1016,8 @@ int main(int ac, char **av) - - signal(SIGINT, sig_handler); - -+ setlocale(LC_ALL, ""); -+ - if (ac > 1 && strcmp(av[1], "-s") == 0) { - silent = 1; - /* Silence conf_read() until the real callback is set up */ -diff --git a/scripts/kconfig/nconf.c b/scripts/kconfig/nconf.c -index 7a17c94a159418..a7cfa6813c63f2 100644 ---- a/scripts/kconfig/nconf.c -+++ b/scripts/kconfig/nconf.c -@@ -7,6 +7,7 @@ - #ifndef _GNU_SOURCE - #define _GNU_SOURCE - #endif -+#include - #include - #include - #include -@@ -1569,6 +1570,8 @@ int main(int ac, char **av) - int lines, columns; - char *mode; - -+ setlocale(LC_ALL, ""); -+ - if (ac > 1 && strcmp(av[1], "-s") == 0) { - /* Silence conf_read() until the real callback is set up */ - conf_set_message_callback(NULL); -diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c -index 787cdeddbdf443..e19d962fab870b 100644 ---- a/sound/usb/mixer.c -+++ b/sound/usb/mixer.c -@@ -930,7 +930,7 @@ static int parse_term_uac2_clock_source(struct mixer_build *state, - { - struct uac_clock_source_descriptor *d = p1; - -- term->type = UAC3_CLOCK_SOURCE << 16; /* virtual type */ -+ term->type = UAC2_CLOCK_SOURCE << 16; /* virtual type */ - term->id = id; - term->name = d->iClockSource; - return 0; -diff --git a/tools/testing/selftests/net/bareudp.sh b/tools/testing/selftests/net/bareudp.sh -index f366cadbc5e862..ff4308b48e65d1 100755 ---- a/tools/testing/selftests/net/bareudp.sh -+++ b/tools/testing/selftests/net/bareudp.sh -@@ -1,4 +1,4 @@ --#!/bin/sh -+#!/bin/bash - # SPDX-License-Identifier: GPL-2.0 - - # Test various bareudp tunnel configurations. -diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh -index 250577b11a91b7..ef16edce4759ee 100755 ---- a/tools/testing/selftests/net/mptcp/mptcp_join.sh -+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh -@@ -3741,7 +3741,7 @@ endpoint_tests() - pm_nl_set_limits $ns1 2 2 - pm_nl_set_limits $ns2 2 2 - pm_nl_add_endpoint $ns1 10.0.2.1 flags signal -- speed=slow \ -+ test_linkfail=128 speed=slow \ - run_tests $ns1 $ns2 10.0.1.1 & - local tests_pid=$! - -@@ -3768,7 +3768,7 @@ endpoint_tests() - pm_nl_set_limits $ns2 0 3 - pm_nl_add_endpoint $ns2 10.0.1.2 id 1 dev ns2eth1 flags subflow - pm_nl_add_endpoint $ns2 10.0.2.2 id 2 dev ns2eth2 flags subflow -- test_linkfail=4 speed=5 \ -+ test_linkfail=128 speed=5 \ - run_tests $ns1 $ns2 10.0.1.1 & - local tests_pid=$! - -@@ -3845,7 +3845,7 @@ endpoint_tests() - # broadcast IP: no packet for this address will be received on ns1 - pm_nl_add_endpoint $ns1 224.0.0.1 id 2 flags signal - pm_nl_add_endpoint $ns1 10.0.1.1 id 42 flags signal -- test_linkfail=4 speed=5 \ -+ test_linkfail=128 speed=5 \ - run_tests $ns1 $ns2 10.0.1.1 & - local tests_pid=$! - -@@ -3917,7 +3917,7 @@ endpoint_tests() - # broadcast IP: no packet for this address will be received on ns1 - pm_nl_add_endpoint $ns1 224.0.0.1 id 2 flags signal - pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow -- test_linkfail=4 speed=20 \ -+ test_linkfail=128 speed=20 \ - run_tests $ns1 $ns2 10.0.1.1 & - local tests_pid=$! - -diff --git a/tools/tracing/latency/latency-collector.c b/tools/tracing/latency/latency-collector.c -index cf263fe9deaf4b..ef97916e3873a1 100644 ---- a/tools/tracing/latency/latency-collector.c -+++ b/tools/tracing/latency/latency-collector.c -@@ -1725,7 +1725,7 @@ static void show_usage(void) - "-n, --notrace\t\tIf latency is detected, do not print out the content of\n" - "\t\t\tthe trace file to standard output\n\n" - --"-t, --threads NRTHR\tRun NRTHR threads for printing. Default is %d.\n\n" -+"-e, --threads NRTHR\tRun NRTHR threads for printing. Default is %d.\n\n" - - "-r, --random\t\tArbitrarily sleep a certain amount of time, default\n" - "\t\t\t%ld ms, before reading the trace file. The\n" diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.118-119.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.118-119.patch deleted file mode 100644 index bd84de453e..0000000000 --- a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.118-119.patch +++ /dev/null @@ -1,31617 +0,0 @@ -diff --git a/MAINTAINERS b/MAINTAINERS -index c1aafeb3babf98..e700dca4974b3a 100644 ---- a/MAINTAINERS -+++ b/MAINTAINERS -@@ -20390,12 +20390,6 @@ S: Maintained - W: http://wiki.laptop.org/go/DCON - F: drivers/staging/olpc_dcon/ - --STAGING - REALTEK RTL8712U DRIVERS --M: Larry Finger --M: Florian Schilhabel . --S: Odd Fixes --F: drivers/staging/rtl8712/ -- - STAGING - SEPS525 LCD CONTROLLER DRIVERS - M: Michael Hennerich - L: linux-fbdev@vger.kernel.org -diff --git a/Makefile b/Makefile -index b13776e2b581c4..66517ca71db130 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 6 --SUBLEVEL = 118 -+SUBLEVEL = 119 - EXTRAVERSION = - NAME = Pinguïn Aangedreven - -diff --git a/arch/arm/boot/dts/nxp/imx/imx6ul.dtsi b/arch/arm/boot/dts/nxp/imx/imx6ul.dtsi -index 3b87d980e9f465..2019cebe8bb647 100644 ---- a/arch/arm/boot/dts/nxp/imx/imx6ul.dtsi -+++ b/arch/arm/boot/dts/nxp/imx/imx6ul.dtsi -@@ -333,7 +333,7 @@ - #sound-dai-cells = <0>; - compatible = "fsl,imx6ul-sai", "fsl,imx6sx-sai"; - reg = <0x02030000 0x4000>; -- interrupts = ; -+ interrupts = ; - clocks = <&clks IMX6UL_CLK_SAI3_IPG>, - <&clks IMX6UL_CLK_SAI3>, - <&clks IMX6UL_CLK_DUMMY>, <&clks IMX6UL_CLK_DUMMY>; -diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c -index ab8102f94e066f..06cb140476ea08 100644 ---- a/arch/mips/mm/tlb-r4k.c -+++ b/arch/mips/mm/tlb-r4k.c -@@ -12,9 +12,11 @@ - #include - #include - #include -+#include - #include - #include - #include -+#include - - #include - #include -@@ -506,58 +508,95 @@ static int __init set_ntlb(char *str) - - __setup("ntlb=", set_ntlb); - --/* Initialise all TLB entries with unique values */ --static void r4k_tlb_uniquify(void) -+ -+/* Comparison function for EntryHi VPN fields. */ -+static int r4k_vpn_cmp(const void *a, const void *b) - { -- int entry = num_wired_entries(); -+ long v = *(unsigned long *)a - *(unsigned long *)b; -+ int s = sizeof(long) > sizeof(int) ? sizeof(long) * 8 - 1: 0; -+ return s ? (v != 0) | v >> s : v; -+} -+ -+/* -+ * Initialise all TLB entries with unique values that do not clash with -+ * what we have been handed over and what we'll be using ourselves. -+ */ -+static void __ref r4k_tlb_uniquify(void) -+{ -+ int tlbsize = current_cpu_data.tlbsize; -+ bool use_slab = slab_is_available(); -+ int start = num_wired_entries(); -+ phys_addr_t tlb_vpn_size; -+ unsigned long *tlb_vpns; -+ unsigned long vpn_mask; -+ int cnt, ent, idx, i; -+ -+ vpn_mask = GENMASK(cpu_vmbits - 1, 13); -+ vpn_mask |= IS_ENABLED(CONFIG_64BIT) ? 3ULL << 62 : 1 << 31; -+ -+ tlb_vpn_size = tlbsize * sizeof(*tlb_vpns); -+ tlb_vpns = (use_slab ? -+ kmalloc(tlb_vpn_size, GFP_KERNEL) : -+ memblock_alloc_raw(tlb_vpn_size, sizeof(*tlb_vpns))); -+ if (WARN_ON(!tlb_vpns)) -+ return; /* Pray local_flush_tlb_all() is good enough. */ - - htw_stop(); -+ -+ for (i = start, cnt = 0; i < tlbsize; i++, cnt++) { -+ unsigned long vpn; -+ -+ write_c0_index(i); -+ mtc0_tlbr_hazard(); -+ tlb_read(); -+ tlb_read_hazard(); -+ vpn = read_c0_entryhi(); -+ vpn &= vpn_mask & PAGE_MASK; -+ tlb_vpns[cnt] = vpn; -+ -+ /* Prevent any large pages from overlapping regular ones. */ -+ write_c0_pagemask(read_c0_pagemask() & PM_DEFAULT_MASK); -+ mtc0_tlbw_hazard(); -+ tlb_write_indexed(); -+ tlbw_use_hazard(); -+ } -+ -+ sort(tlb_vpns, cnt, sizeof(tlb_vpns[0]), r4k_vpn_cmp, NULL); -+ -+ write_c0_pagemask(PM_DEFAULT_MASK); - write_c0_entrylo0(0); - write_c0_entrylo1(0); - -- while (entry < current_cpu_data.tlbsize) { -- unsigned long asid_mask = cpu_asid_mask(¤t_cpu_data); -- unsigned long asid = 0; -- int idx; -+ idx = 0; -+ ent = tlbsize; -+ for (i = start; i < tlbsize; i++) -+ while (1) { -+ unsigned long entryhi, vpn; - -- /* Skip wired MMID to make ginvt_mmid work */ -- if (cpu_has_mmid) -- asid = MMID_KERNEL_WIRED + 1; -+ entryhi = UNIQUE_ENTRYHI(ent); -+ vpn = entryhi & vpn_mask & PAGE_MASK; - -- /* Check for match before using UNIQUE_ENTRYHI */ -- do { -- if (cpu_has_mmid) { -- write_c0_memorymapid(asid); -- write_c0_entryhi(UNIQUE_ENTRYHI(entry)); -+ if (idx >= cnt || vpn < tlb_vpns[idx]) { -+ write_c0_entryhi(entryhi); -+ write_c0_index(i); -+ mtc0_tlbw_hazard(); -+ tlb_write_indexed(); -+ ent++; -+ break; -+ } else if (vpn == tlb_vpns[idx]) { -+ ent++; - } else { -- write_c0_entryhi(UNIQUE_ENTRYHI(entry) | asid); -+ idx++; - } -- mtc0_tlbw_hazard(); -- tlb_probe(); -- tlb_probe_hazard(); -- idx = read_c0_index(); -- /* No match or match is on current entry */ -- if (idx < 0 || idx == entry) -- break; -- /* -- * If we hit a match, we need to try again with -- * a different ASID. -- */ -- asid++; -- } while (asid < asid_mask); -- -- if (idx >= 0 && idx != entry) -- panic("Unable to uniquify TLB entry %d", idx); -- -- write_c0_index(entry); -- mtc0_tlbw_hazard(); -- tlb_write_indexed(); -- entry++; -- } -+ } - - tlbw_use_hazard(); - htw_start(); - flush_micro_tlb(); -+ if (use_slab) -+ kfree(tlb_vpns); -+ else -+ memblock_free(tlb_vpns, tlb_vpn_size); - } - - /* -@@ -600,6 +639,7 @@ static void r4k_tlb_configure(void) - - /* From this point on the ARC firmware is dead. */ - r4k_tlb_uniquify(); -+ local_flush_tlb_all(); - - /* Did I tell you that ARC SUCKS? */ - } -diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c -index ad63bd408cd900..1519ab15a5449a 100644 ---- a/arch/x86/events/core.c -+++ b/arch/x86/events/core.c -@@ -2769,13 +2769,13 @@ perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, struct pt_regs *re - return; - } - -- if (perf_callchain_store(entry, regs->ip)) -- return; -- -- if (perf_hw_regs(regs)) -+ if (perf_hw_regs(regs)) { -+ if (perf_callchain_store(entry, regs->ip)) -+ return; - unwind_start(&state, current, regs, NULL); -- else -+ } else { - unwind_start(&state, current, NULL, (void *)regs->sp); -+ } - - for (; !unwind_done(&state); unwind_next_frame(&state)) { - addr = unwind_get_return_address(&state); -diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c -index fb2be3574c26a8..b57faf6dc327ec 100644 ---- a/drivers/atm/fore200e.c -+++ b/drivers/atm/fore200e.c -@@ -1377,7 +1377,9 @@ fore200e_open(struct atm_vcc *vcc) - - vcc->dev_data = NULL; - -+ mutex_lock(&fore200e->rate_mtx); - fore200e->available_cell_rate += vcc->qos.txtp.max_pcr; -+ mutex_unlock(&fore200e->rate_mtx); - - kfree(fore200e_vcc); - return -EINVAL; -diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c -index c693da60e9a977..766ced12345c3f 100644 ---- a/drivers/firmware/stratix10-svc.c -+++ b/drivers/firmware/stratix10-svc.c -@@ -134,6 +134,7 @@ struct stratix10_svc_data { - * @complete_status: state for completion - * @svc_fifo_lock: protect access to service message data queue - * @invoke_fn: function to issue secure monitor call or hypervisor call -+ * @svc: manages the list of client svc drivers - * - * This struct is used to create communication channels for service clients, to - * handle secure monitor or hypervisor call. -@@ -150,6 +151,7 @@ struct stratix10_svc_controller { - struct completion complete_status; - spinlock_t svc_fifo_lock; - svc_invoke_fn *invoke_fn; -+ struct stratix10_svc *svc; - }; - - /** -@@ -1209,6 +1211,7 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) - ret = -ENOMEM; - goto err_free_kfifo; - } -+ controller->svc = svc; - - svc->stratix10_svc_rsu = platform_device_alloc(STRATIX10_RSU, 0); - if (!svc->stratix10_svc_rsu) { -@@ -1236,8 +1239,6 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) - goto err_unregister_dev; - } - -- dev_set_drvdata(dev, svc); -- - pr_info("Intel Service Layer Driver Initialized\n"); - - return 0; -@@ -1253,8 +1254,8 @@ err_destroy_pool: - - static int stratix10_svc_drv_remove(struct platform_device *pdev) - { -- struct stratix10_svc *svc = dev_get_drvdata(&pdev->dev); - struct stratix10_svc_controller *ctrl = platform_get_drvdata(pdev); -+ struct stratix10_svc *svc = ctrl->svc; - - platform_device_unregister(svc->intel_svc_fcs); - platform_device_unregister(svc->stratix10_svc_rsu); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -index b2a1dc193cb8f6..c1b9333d7b78a4 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -@@ -1941,6 +1941,8 @@ static int amdgpu_device_parse_gpu_info_fw(struct amdgpu_device *adev) - chip_name = "navi12"; - break; - case CHIP_CYAN_SKILLFISH: -+ if (adev->mman.discovery_bin) -+ return 0; - chip_name = "cyan_skillfish"; - break; - } -diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c -index ebe571fcefe32e..0e210407131e78 100644 ---- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c -+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c -@@ -634,9 +634,14 @@ bool dc_stream_get_scanoutpos(const struct dc_stream_state *stream, - { - uint8_t i; - bool ret = false; -- struct dc *dc = stream->ctx->dc; -- struct resource_context *res_ctx = -- &dc->current_state->res_ctx; -+ struct dc *dc; -+ struct resource_context *res_ctx; -+ -+ if (!stream->ctx) -+ return false; -+ -+ dc = stream->ctx->dc; -+ res_ctx = &dc->current_state->res_ctx; - - for (i = 0; i < MAX_PIPES; i++) { - struct timing_generator *tg = res_ctx->pipe_ctx[i].stream_res.tg; -diff --git a/drivers/gpu/drm/sti/sti_vtg.c b/drivers/gpu/drm/sti/sti_vtg.c -index 5e5f82b6a5d940..644837fb8623a2 100644 ---- a/drivers/gpu/drm/sti/sti_vtg.c -+++ b/drivers/gpu/drm/sti/sti_vtg.c -@@ -143,12 +143,17 @@ struct sti_vtg { - struct sti_vtg *of_vtg_find(struct device_node *np) - { - struct platform_device *pdev; -+ struct sti_vtg *vtg; - - pdev = of_find_device_by_node(np); - if (!pdev) - return NULL; - -- return (struct sti_vtg *)platform_get_drvdata(pdev); -+ vtg = platform_get_drvdata(pdev); -+ -+ put_device(&pdev->dev); -+ -+ return vtg; - } - - static void vtg_reset(struct sti_vtg *vtg) -diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c -index 266cd56dec5056..d8fda282d0491a 100644 ---- a/drivers/hid/hid-core.c -+++ b/drivers/hid/hid-core.c -@@ -1351,7 +1351,12 @@ EXPORT_SYMBOL_GPL(hid_snto32); - - static u32 s32ton(__s32 value, unsigned n) - { -- s32 a = value >> (n - 1); -+ s32 a; -+ -+ if (!value || !n) -+ return 0; -+ -+ a = value >> (n - 1); - if (a && a != -1) - return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1; - return value & ((1 << n) - 1); -diff --git a/drivers/iio/accel/adxl355_core.c b/drivers/iio/accel/adxl355_core.c -index 4973e8da5399d7..93b8bd6f929dab 100644 ---- a/drivers/iio/accel/adxl355_core.c -+++ b/drivers/iio/accel/adxl355_core.c -@@ -56,6 +56,8 @@ - #define ADXL355_POWER_CTL_DRDY_MSK BIT(2) - #define ADXL355_SELF_TEST_REG 0x2E - #define ADXL355_RESET_REG 0x2F -+#define ADXL355_BASE_ADDR_SHADOW_REG 0x50 -+#define ADXL355_SHADOW_REG_COUNT 5 - - #define ADXL355_DEVID_AD_VAL 0xAD - #define ADXL355_DEVID_MST_VAL 0x1D -@@ -294,7 +296,12 @@ static void adxl355_fill_3db_frequency_table(struct adxl355_data *data) - static int adxl355_setup(struct adxl355_data *data) - { - unsigned int regval; -+ int retries = 5; /* the number is chosen based on empirical reasons */ - int ret; -+ u8 *shadow_regs __free(kfree) = kzalloc(ADXL355_SHADOW_REG_COUNT, GFP_KERNEL); -+ -+ if (!shadow_regs) -+ return -ENOMEM; - - ret = regmap_read(data->regmap, ADXL355_DEVID_AD_REG, ®val); - if (ret) -@@ -321,14 +328,41 @@ static int adxl355_setup(struct adxl355_data *data) - if (regval != ADXL355_PARTID_VAL) - dev_warn(data->dev, "Invalid DEV ID 0x%02x\n", regval); - -- /* -- * Perform a software reset to make sure the device is in a consistent -- * state after start-up. -- */ -- ret = regmap_write(data->regmap, ADXL355_RESET_REG, ADXL355_RESET_CODE); -+ /* Read shadow registers to be compared after reset */ -+ ret = regmap_bulk_read(data->regmap, -+ ADXL355_BASE_ADDR_SHADOW_REG, -+ shadow_regs, ADXL355_SHADOW_REG_COUNT); - if (ret) - return ret; - -+ do { -+ if (--retries == 0) { -+ dev_err(data->dev, "Shadow registers mismatch\n"); -+ return -EIO; -+ } -+ -+ /* -+ * Perform a software reset to make sure the device is in a consistent -+ * state after start-up. -+ */ -+ ret = regmap_write(data->regmap, ADXL355_RESET_REG, -+ ADXL355_RESET_CODE); -+ if (ret) -+ return ret; -+ -+ /* Wait at least 5ms after software reset */ -+ usleep_range(5000, 10000); -+ -+ /* Read shadow registers for comparison */ -+ ret = regmap_bulk_read(data->regmap, -+ ADXL355_BASE_ADDR_SHADOW_REG, -+ data->buffer.buf, -+ ADXL355_SHADOW_REG_COUNT); -+ if (ret) -+ return ret; -+ } while (memcmp(shadow_regs, data->buffer.buf, -+ ADXL355_SHADOW_REG_COUNT)); -+ - ret = regmap_update_bits(data->regmap, ADXL355_POWER_CTL_REG, - ADXL355_POWER_CTL_DRDY_MSK, - FIELD_PREP(ADXL355_POWER_CTL_DRDY_MSK, 1)); -diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c -index 110591804b4c4f..9bc5957123c514 100644 ---- a/drivers/iio/accel/bmc150-accel-core.c -+++ b/drivers/iio/accel/bmc150-accel-core.c -@@ -569,6 +569,10 @@ static int bmc150_accel_set_interrupt(struct bmc150_accel_data *data, int i, - const struct bmc150_accel_interrupt_info *info = intr->info; - int ret; - -+ /* We do not always have an IRQ */ -+ if (data->irq <= 0) -+ return 0; -+ - if (state) { - if (atomic_inc_return(&intr->users) > 1) - return 0; -@@ -1743,6 +1747,7 @@ int bmc150_accel_core_probe(struct device *dev, struct regmap *regmap, int irq, - } - - if (irq > 0) { -+ data->irq = irq; - ret = devm_request_threaded_irq(dev, irq, - bmc150_accel_irq_handler, - bmc150_accel_irq_thread_handler, -diff --git a/drivers/iio/accel/bmc150-accel.h b/drivers/iio/accel/bmc150-accel.h -index 7775c5edaeefd4..f8d9c8ae469309 100644 ---- a/drivers/iio/accel/bmc150-accel.h -+++ b/drivers/iio/accel/bmc150-accel.h -@@ -57,6 +57,7 @@ enum bmc150_accel_trigger_id { - - struct bmc150_accel_data { - struct regmap *regmap; -+ int irq; - struct regulator_bulk_data regulators[2]; - struct bmc150_accel_interrupt interrupts[BMC150_ACCEL_INTERRUPTS]; - struct bmc150_accel_trigger triggers[BMC150_ACCEL_TRIGGERS]; -diff --git a/drivers/iio/adc/ad7280a.c b/drivers/iio/adc/ad7280a.c -index d4a4e15c82447c..9080c795dcb7e4 100644 ---- a/drivers/iio/adc/ad7280a.c -+++ b/drivers/iio/adc/ad7280a.c -@@ -540,7 +540,7 @@ static ssize_t ad7280_store_balance_timer(struct iio_dev *indio_dev, - int val, val2; - int ret; - -- ret = iio_str_to_fixpoint(buf, 1000, &val, &val2); -+ ret = iio_str_to_fixpoint(buf, 100, &val, &val2); - if (ret) - return ret; - -diff --git a/drivers/iio/adc/rtq6056.c b/drivers/iio/adc/rtq6056.c -index ad4cea6839b271..3ffdcb9f88336b 100644 ---- a/drivers/iio/adc/rtq6056.c -+++ b/drivers/iio/adc/rtq6056.c -@@ -171,7 +171,7 @@ static int rtq6056_adc_read_channel(struct rtq6056_priv *priv, - if (addr == RTQ6056_REG_BUSVOLT || addr == RTQ6056_REG_POWER) - *val = regval; - else -- *val = sign_extend32(regval, 16); -+ *val = sign_extend32(regval, 15); - - return IIO_VAL_INT; - } -diff --git a/drivers/iio/common/ssp_sensors/ssp_dev.c b/drivers/iio/common/ssp_sensors/ssp_dev.c -index e64d242145e04c..0c6629da211232 100644 ---- a/drivers/iio/common/ssp_sensors/ssp_dev.c -+++ b/drivers/iio/common/ssp_sensors/ssp_dev.c -@@ -503,7 +503,7 @@ static int ssp_probe(struct spi_device *spi) - ret = spi_setup(spi); - if (ret < 0) { - dev_err(&spi->dev, "Failed to setup spi\n"); -- return ret; -+ goto err_setup_spi; - } - - data->fw_dl_state = SSP_FW_DL_STATE_NONE; -@@ -568,6 +568,8 @@ err_read_reg: - err_setup_irq: - mutex_destroy(&data->pending_lock); - mutex_destroy(&data->comm_lock); -+err_setup_spi: -+ mfd_remove_devices(&spi->dev); - - dev_err(&spi->dev, "Probe failed!\n"); - -diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h -index c19237717e8122..35325d2e1ce6c7 100644 ---- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h -+++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h -@@ -190,6 +190,22 @@ struct st_lsm6dsx_fifo_ops { - * @fifo_en: Hw timer FIFO enable register info (addr + mask). - * @decimator: Hw timer FIFO decimator register info (addr + mask). - * @freq_fine: Difference in % of ODR with respect to the typical. -+ * @ts_sensitivity: Nominal timestamp sensitivity. -+ * @ts_trim_coeff: Coefficient for calculating the calibrated timestamp gain. -+ * This coefficient comes into play when linearizing the formula -+ * used to calculate the calibrated timestamp (please see the -+ * relevant formula in the AN for the specific IMU). -+ * For example, in the case of LSM6DSO we have: -+ * -+ * 1 / (1 + x) ~= 1 - x (Taylor’s Series) -+ * ttrim[s] = 1 / (40000 * (1 + 0.0015 * val)) (from AN5192) -+ * ttrim[ns] ~= 25000 - 37.5 * val -+ * ttrim[ns] ~= 25000 - (37500 * val) / 1000 -+ * -+ * so, replacing ts_sensitivity = 25000 and -+ * ts_trim_coeff = 37500 -+ * -+ * ttrim[ns] ~= ts_sensitivity - (ts_trim_coeff * val) / 1000 - */ - struct st_lsm6dsx_hw_ts_settings { - struct st_lsm6dsx_reg timer_en; -@@ -197,6 +213,8 @@ struct st_lsm6dsx_hw_ts_settings { - struct st_lsm6dsx_reg fifo_en; - struct st_lsm6dsx_reg decimator; - u8 freq_fine; -+ u16 ts_sensitivity; -+ u16 ts_trim_coeff; - }; - - /** -@@ -250,6 +268,15 @@ struct st_lsm6dsx_event_settings { - u8 wakeup_src_x_mask; - }; - -+enum st_lsm6dsx_sensor_id { -+ ST_LSM6DSX_ID_GYRO, -+ ST_LSM6DSX_ID_ACC, -+ ST_LSM6DSX_ID_EXT0, -+ ST_LSM6DSX_ID_EXT1, -+ ST_LSM6DSX_ID_EXT2, -+ ST_LSM6DSX_ID_MAX -+}; -+ - enum st_lsm6dsx_ext_sensor_id { - ST_LSM6DSX_ID_MAGN, - }; -@@ -335,23 +362,14 @@ struct st_lsm6dsx_settings { - struct st_lsm6dsx_odr_table_entry odr_table[2]; - struct st_lsm6dsx_samples_to_discard samples_to_discard[2]; - struct st_lsm6dsx_fs_table_entry fs_table[2]; -- struct st_lsm6dsx_reg decimator[ST_LSM6DSX_MAX_ID]; -- struct st_lsm6dsx_reg batch[ST_LSM6DSX_MAX_ID]; -+ struct st_lsm6dsx_reg decimator[ST_LSM6DSX_ID_MAX]; -+ struct st_lsm6dsx_reg batch[2]; - struct st_lsm6dsx_fifo_ops fifo_ops; - struct st_lsm6dsx_hw_ts_settings ts_settings; - struct st_lsm6dsx_shub_settings shub_settings; - struct st_lsm6dsx_event_settings event_settings; - }; - --enum st_lsm6dsx_sensor_id { -- ST_LSM6DSX_ID_GYRO, -- ST_LSM6DSX_ID_ACC, -- ST_LSM6DSX_ID_EXT0, -- ST_LSM6DSX_ID_EXT1, -- ST_LSM6DSX_ID_EXT2, -- ST_LSM6DSX_ID_MAX, --}; -- - enum st_lsm6dsx_fifo_mode { - ST_LSM6DSX_FIFO_BYPASS = 0x0, - ST_LSM6DSX_FIFO_CONT = 0x6, -diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c -index b6e6b1df8a6189..6e42e0c659e0c7 100644 ---- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c -+++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c -@@ -77,8 +77,6 @@ - - #define ST_LSM6DSX_REG_WHOAMI_ADDR 0x0f - --#define ST_LSM6DSX_TS_SENSITIVITY 25000UL /* 25us */ -- - static const struct iio_chan_spec st_lsm6dsx_acc_channels[] = { - ST_LSM6DSX_CHANNEL_ACC(IIO_ACCEL, 0x28, IIO_MOD_X, 0), - ST_LSM6DSX_CHANNEL_ACC(IIO_ACCEL, 0x2a, IIO_MOD_Y, 1), -@@ -962,6 +960,8 @@ static const struct st_lsm6dsx_settings st_lsm6dsx_sensor_settings[] = { - .mask = GENMASK(7, 6), - }, - .freq_fine = 0x63, -+ .ts_sensitivity = 25000, -+ .ts_trim_coeff = 37500, - }, - .shub_settings = { - .page_mux = { -@@ -1175,6 +1175,8 @@ static const struct st_lsm6dsx_settings st_lsm6dsx_sensor_settings[] = { - .mask = GENMASK(7, 6), - }, - .freq_fine = 0x63, -+ .ts_sensitivity = 25000, -+ .ts_trim_coeff = 37500, - }, - .event_settings = { - .enable_reg = { -@@ -1350,6 +1352,8 @@ static const struct st_lsm6dsx_settings st_lsm6dsx_sensor_settings[] = { - .mask = GENMASK(7, 6), - }, - .freq_fine = 0x4f, -+ .ts_sensitivity = 21701, -+ .ts_trim_coeff = 28212, - }, - .shub_settings = { - .page_mux = { -@@ -2243,20 +2247,13 @@ static int st_lsm6dsx_init_hw_timer(struct st_lsm6dsx_hw *hw) - } - - /* calibrate timestamp sensitivity */ -- hw->ts_gain = ST_LSM6DSX_TS_SENSITIVITY; -+ hw->ts_gain = ts_settings->ts_sensitivity; - if (ts_settings->freq_fine) { - err = regmap_read(hw->regmap, ts_settings->freq_fine, &val); - if (err < 0) - return err; - -- /* -- * linearize the AN5192 formula: -- * 1 / (1 + x) ~= 1 - x (Taylor’s Series) -- * ttrim[s] = 1 / (40000 * (1 + 0.0015 * val)) -- * ttrim[ns] ~= 25000 - 37.5 * val -- * ttrim[ns] ~= 25000 - (37500 * val) / 1000 -- */ -- hw->ts_gain -= ((s8)val * 37500) / 1000; -+ hw->ts_gain -= ((s8)val * ts_settings->ts_trim_coeff) / 1000; - } - - return 0; -diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c -index 22d6018ceec3cb..6bdee87f308369 100644 ---- a/drivers/mailbox/mailbox-test.c -+++ b/drivers/mailbox/mailbox-test.c -@@ -268,7 +268,7 @@ static int mbox_test_add_debugfs(struct platform_device *pdev, - return 0; - - tdev->root_debugfs_dir = debugfs_create_dir(dev_name(&pdev->dev), NULL); -- if (!tdev->root_debugfs_dir) { -+ if (IS_ERR(tdev->root_debugfs_dir)) { - dev_err(&pdev->dev, "Failed to create Mailbox debugfs\n"); - return -EINVAL; - } -diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c -index 49254d99a8ad68..2b7d0bc9207263 100644 ---- a/drivers/mailbox/pcc.c -+++ b/drivers/mailbox/pcc.c -@@ -269,6 +269,24 @@ static bool pcc_mbox_cmd_complete_check(struct pcc_chan_info *pchan) - return !!val; - } - -+static int pcc_mbox_error_check_and_clear(struct pcc_chan_info *pchan) -+{ -+ u64 val; -+ int ret; -+ -+ ret = pcc_chan_reg_read(&pchan->error, &val); -+ if (ret) -+ return ret; -+ -+ if (val & pchan->error.status_mask) { -+ val &= pchan->error.preserve_mask; -+ pcc_chan_reg_write(&pchan->error, val); -+ return -EIO; -+ } -+ -+ return 0; -+} -+ - static void check_and_ack(struct pcc_chan_info *pchan, struct mbox_chan *chan) - { - struct acpi_pcct_ext_pcc_shared_memory pcc_hdr; -@@ -309,8 +327,6 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p) - { - struct pcc_chan_info *pchan; - struct mbox_chan *chan = p; -- u64 val; -- int ret; - - pchan = chan->con_priv; - -@@ -324,15 +340,8 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p) - if (!pcc_mbox_cmd_complete_check(pchan)) - return IRQ_NONE; - -- ret = pcc_chan_reg_read(&pchan->error, &val); -- if (ret) -+ if (pcc_mbox_error_check_and_clear(pchan)) - return IRQ_NONE; -- val &= pchan->error.status_mask; -- if (val) { -- val &= ~pchan->error.status_mask; -- pcc_chan_reg_write(&pchan->error, val); -- return IRQ_NONE; -- } - - /* - * Clear this flag after updating interrupt ack register and just -@@ -663,7 +672,8 @@ static int pcc_parse_subspace_db_reg(struct pcc_chan_info *pchan, - - ret = pcc_chan_reg_init(&pchan->error, - &pcct_ext->error_status_register, -- 0, 0, pcct_ext->error_status_mask, -+ ~pcct_ext->error_status_mask, 0, -+ pcct_ext->error_status_mask, - "Error Status"); - } - return ret; -diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c -index 8007e2e2197295..4474352ad3d138 100644 ---- a/drivers/md/dm-verity-fec.c -+++ b/drivers/md/dm-verity-fec.c -@@ -330,11 +330,7 @@ static int fec_alloc_bufs(struct dm_verity *v, struct dm_verity_fec_io *fio) - if (fio->bufs[n]) - continue; - -- fio->bufs[n] = mempool_alloc(&v->fec->prealloc_pool, GFP_NOWAIT); -- if (unlikely(!fio->bufs[n])) { -- DMERR("failed to allocate FEC buffer"); -- return -ENOMEM; -- } -+ fio->bufs[n] = mempool_alloc(&v->fec->prealloc_pool, GFP_NOIO); - } - - /* try to allocate the maximum number of buffers */ -diff --git a/drivers/most/most_usb.c b/drivers/most/most_usb.c -index 988e33f2797046..9cfa33bd37d77c 100644 ---- a/drivers/most/most_usb.c -+++ b/drivers/most/most_usb.c -@@ -1058,7 +1058,7 @@ hdm_probe(struct usb_interface *interface, const struct usb_device_id *id) - - ret = most_register_interface(&mdev->iface); - if (ret) -- goto err_free_busy_urbs; -+ return ret; - - mutex_lock(&mdev->io_mutex); - if (le16_to_cpu(usb_dev->descriptor.idProduct) == USB_DEV_ID_OS81118 || -@@ -1068,8 +1068,7 @@ hdm_probe(struct usb_interface *interface, const struct usb_device_id *id) - if (!mdev->dci) { - mutex_unlock(&mdev->io_mutex); - most_deregister_interface(&mdev->iface); -- ret = -ENOMEM; -- goto err_free_busy_urbs; -+ return -ENOMEM; - } - - mdev->dci->dev.init_name = "dci"; -@@ -1078,18 +1077,15 @@ hdm_probe(struct usb_interface *interface, const struct usb_device_id *id) - mdev->dci->dev.release = release_dci; - if (device_register(&mdev->dci->dev)) { - mutex_unlock(&mdev->io_mutex); -+ put_device(&mdev->dci->dev); - most_deregister_interface(&mdev->iface); -- ret = -ENOMEM; -- goto err_free_dci; -+ return -ENOMEM; - } - mdev->dci->usb_device = mdev->usb_device; - } - mutex_unlock(&mdev->io_mutex); - return 0; --err_free_dci: -- put_device(&mdev->dci->dev); --err_free_busy_urbs: -- kfree(mdev->busy_urbs); -+ - err_free_ep_address: - kfree(mdev->ep_address); - err_free_cap: -diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c -index ee61b2d8823203..4c2776f52fee5d 100644 ---- a/drivers/mtd/nand/spi/core.c -+++ b/drivers/mtd/nand/spi/core.c -@@ -1044,6 +1044,8 @@ spinand_select_op_variant(struct spinand_device *spinand, - if (ret) - break; - -+ spi_mem_adjust_op_freq(spinand->spimem, &op); -+ - if (!spi_mem_supports_op(spinand->spimem, &op)) - break; - -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 9aa328b958be47..b3ccc064cbff21 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -322,9 +322,9 @@ static bool bond_sk_check(struct bonding *bond) - } - } - --static bool bond_xdp_check(struct bonding *bond) -+bool bond_xdp_check(struct bonding *bond, int mode) - { -- switch (BOND_MODE(bond)) { -+ switch (mode) { - case BOND_MODE_ROUNDROBIN: - case BOND_MODE_ACTIVEBACKUP: - return true; -@@ -1855,7 +1855,7 @@ void bond_xdp_set_features(struct net_device *bond_dev) - - ASSERT_RTNL(); - -- if (!bond_xdp_check(bond) || !bond_has_slaves(bond)) { -+ if (!bond_xdp_check(bond, BOND_MODE(bond)) || !bond_has_slaves(bond)) { - xdp_clear_features_flag(bond_dev); - return; - } -@@ -5622,8 +5622,11 @@ static int bond_xdp_set(struct net_device *dev, struct bpf_prog *prog, - - ASSERT_RTNL(); - -- if (!bond_xdp_check(bond)) -+ if (!bond_xdp_check(bond, BOND_MODE(bond))) { -+ BOND_NL_ERR(dev, extack, -+ "No native XDP support for the current bonding mode"); - return -EOPNOTSUPP; -+ } - - old_prog = bond->xdp_prog; - bond->xdp_prog = prog; -diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c -index 8291803e4f00ab..a2fa068193e3be 100644 ---- a/drivers/net/bonding/bond_options.c -+++ b/drivers/net/bonding/bond_options.c -@@ -868,6 +868,9 @@ static bool bond_set_xfrm_features(struct bonding *bond) - static int bond_option_mode_set(struct bonding *bond, - const struct bond_opt_value *newval) - { -+ if (bond->xdp_prog && !bond_xdp_check(bond, newval->value)) -+ return -EOPNOTSUPP; -+ - if (!bond_mode_uses_arp(newval->value)) { - if (bond->params.arp_interval) { - netdev_dbg(bond->dev, "%s mode is incompatible with arp monitoring, start mii monitoring\n", -diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c -index ae4ebcee607792..5a30667001c94e 100644 ---- a/drivers/net/can/rcar/rcar_canfd.c -+++ b/drivers/net/can/rcar/rcar_canfd.c -@@ -687,26 +687,6 @@ static void rcar_canfd_tx_failure_cleanup(struct net_device *ndev) - can_free_echo_skb(ndev, i, NULL); - } - --static void rcar_canfd_set_mode(struct rcar_canfd_global *gpriv) --{ -- if (is_gen4(gpriv)) { -- u32 ch, val = gpriv->fdmode ? RCANFD_GEN4_FDCFG_FDOE -- : RCANFD_GEN4_FDCFG_CLOE; -- -- for_each_set_bit(ch, &gpriv->channels_mask, -- gpriv->info->max_channels) -- rcar_canfd_set_bit(gpriv->base, RCANFD_GEN4_FDCFG(ch), -- val); -- } else { -- if (gpriv->fdmode) -- rcar_canfd_set_bit(gpriv->base, RCANFD_GRMCFG, -- RCANFD_GRMCFG_RCMC); -- else -- rcar_canfd_clear_bit(gpriv->base, RCANFD_GRMCFG, -- RCANFD_GRMCFG_RCMC); -- } --} -- - static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv) - { - u32 sts, ch; -@@ -738,6 +718,16 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv) - /* Reset Global error flags */ - rcar_canfd_write(gpriv->base, RCANFD_GERFL, 0x0); - -+ /* Set the controller into appropriate mode */ -+ if (!is_gen4(gpriv)) { -+ if (gpriv->fdmode) -+ rcar_canfd_set_bit(gpriv->base, RCANFD_GRMCFG, -+ RCANFD_GRMCFG_RCMC); -+ else -+ rcar_canfd_clear_bit(gpriv->base, RCANFD_GRMCFG, -+ RCANFD_GRMCFG_RCMC); -+ } -+ - /* Transition all Channels to reset mode */ - for_each_set_bit(ch, &gpriv->channels_mask, gpriv->info->max_channels) { - rcar_canfd_clear_bit(gpriv->base, -@@ -756,10 +746,27 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv) - "channel %u reset failed\n", ch); - return err; - } -- } - -- /* Set the controller into appropriate mode */ -- rcar_canfd_set_mode(gpriv); -+ /* Set the controller into appropriate mode */ -+ if (is_gen4(gpriv)) { -+ /* Do not set CLOE and FDOE simultaneously */ -+ if (!gpriv->fdmode) { -+ rcar_canfd_clear_bit(gpriv->base, -+ RCANFD_GEN4_FDCFG(ch), -+ RCANFD_GEN4_FDCFG_FDOE); -+ rcar_canfd_set_bit(gpriv->base, -+ RCANFD_GEN4_FDCFG(ch), -+ RCANFD_GEN4_FDCFG_CLOE); -+ } else { -+ rcar_canfd_clear_bit(gpriv->base, -+ RCANFD_GEN4_FDCFG(ch), -+ RCANFD_GEN4_FDCFG_FDOE); -+ rcar_canfd_clear_bit(gpriv->base, -+ RCANFD_GEN4_FDCFG(ch), -+ RCANFD_GEN4_FDCFG_CLOE); -+ } -+ } -+ } - - return 0; - } -diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c -index 10e211d917e313..0a328885729e61 100644 ---- a/drivers/net/can/sja1000/sja1000.c -+++ b/drivers/net/can/sja1000/sja1000.c -@@ -548,8 +548,8 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id) - if (priv->read_reg(priv, SJA1000_IER) == IRQ_OFF) - goto out; - -- while ((isrc = priv->read_reg(priv, SJA1000_IR)) && -- (n < SJA1000_MAX_IRQ)) { -+ while ((n < SJA1000_MAX_IRQ) && -+ (isrc = priv->read_reg(priv, SJA1000_IR))) { - - status = priv->read_reg(priv, SJA1000_SR); - /* check for absent controller due to hw unplug */ -diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c -index 5ab1f9c7288e59..c7b82de8447ab8 100644 ---- a/drivers/net/can/sun4i_can.c -+++ b/drivers/net/can/sun4i_can.c -@@ -657,8 +657,8 @@ static irqreturn_t sun4i_can_interrupt(int irq, void *dev_id) - u8 isrc, status; - int n = 0; - -- while ((isrc = readl(priv->base + SUN4I_REG_INT_ADDR)) && -- (n < SUN4I_CAN_MAX_IRQ)) { -+ while ((n < SUN4I_CAN_MAX_IRQ) && -+ (isrc = readl(priv->base + SUN4I_REG_INT_ADDR))) { - n++; - status = readl(priv->base + SUN4I_REG_STA_ADDR); - -diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c -index 9bd61fd8e5013f..72997312c9567b 100644 ---- a/drivers/net/can/usb/gs_usb.c -+++ b/drivers/net/can/usb/gs_usb.c -@@ -258,14 +258,21 @@ struct canfd_quirk { - u8 quirk; - } __packed; - -+/* struct gs_host_frame::echo_id == GS_HOST_FRAME_ECHO_ID_RX indicates -+ * a regular RX'ed CAN frame -+ */ -+#define GS_HOST_FRAME_ECHO_ID_RX 0xffffffff -+ - struct gs_host_frame { -- u32 echo_id; -- __le32 can_id; -+ struct_group(header, -+ u32 echo_id; -+ __le32 can_id; - -- u8 can_dlc; -- u8 channel; -- u8 flags; -- u8 reserved; -+ u8 can_dlc; -+ u8 channel; -+ u8 flags; -+ u8 reserved; -+ ); - - union { - DECLARE_FLEX_ARRAY(struct classic_can, classic_can); -@@ -565,6 +572,37 @@ gs_usb_get_echo_skb(struct gs_can *dev, struct sk_buff *skb, - return len; - } - -+static unsigned int -+gs_usb_get_minimum_rx_length(const struct gs_can *dev, const struct gs_host_frame *hf, -+ unsigned int *data_length_p) -+{ -+ unsigned int minimum_length, data_length = 0; -+ -+ if (hf->flags & GS_CAN_FLAG_FD) { -+ if (hf->echo_id == GS_HOST_FRAME_ECHO_ID_RX) -+ data_length = can_fd_dlc2len(hf->can_dlc); -+ -+ if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP) -+ /* timestamp follows data field of max size */ -+ minimum_length = struct_size(hf, canfd_ts, 1); -+ else -+ minimum_length = sizeof(hf->header) + data_length; -+ } else { -+ if (hf->echo_id == GS_HOST_FRAME_ECHO_ID_RX && -+ !(hf->can_id & cpu_to_le32(CAN_RTR_FLAG))) -+ data_length = can_cc_dlc2len(hf->can_dlc); -+ -+ if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP) -+ /* timestamp follows data field of max size */ -+ minimum_length = struct_size(hf, classic_can_ts, 1); -+ else -+ minimum_length = sizeof(hf->header) + data_length; -+ } -+ -+ *data_length_p = data_length; -+ return minimum_length; -+} -+ - static void gs_usb_receive_bulk_callback(struct urb *urb) - { - struct gs_usb *parent = urb->context; -@@ -573,6 +611,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) - int rc; - struct net_device_stats *stats; - struct gs_host_frame *hf = urb->transfer_buffer; -+ unsigned int minimum_length, data_length; - struct gs_tx_context *txc; - struct can_frame *cf; - struct canfd_frame *cfd; -@@ -591,6 +630,15 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) - return; - } - -+ minimum_length = sizeof(hf->header); -+ if (urb->actual_length < minimum_length) { -+ dev_err_ratelimited(&parent->udev->dev, -+ "short read (actual_length=%u, minimum_length=%u)\n", -+ urb->actual_length, minimum_length); -+ -+ goto resubmit_urb; -+ } -+ - /* device reports out of range channel id */ - if (hf->channel >= parent->channel_cnt) - goto device_detach; -@@ -606,20 +654,33 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) - if (!netif_running(netdev)) - goto resubmit_urb; - -- if (hf->echo_id == -1) { /* normal rx */ -+ minimum_length = gs_usb_get_minimum_rx_length(dev, hf, &data_length); -+ if (urb->actual_length < minimum_length) { -+ stats->rx_errors++; -+ stats->rx_length_errors++; -+ -+ if (net_ratelimit()) -+ netdev_err(netdev, -+ "short read (actual_length=%u, minimum_length=%u)\n", -+ urb->actual_length, minimum_length); -+ -+ goto resubmit_urb; -+ } -+ -+ if (hf->echo_id == GS_HOST_FRAME_ECHO_ID_RX) { /* normal rx */ - if (hf->flags & GS_CAN_FLAG_FD) { - skb = alloc_canfd_skb(netdev, &cfd); - if (!skb) - return; - - cfd->can_id = le32_to_cpu(hf->can_id); -- cfd->len = can_fd_dlc2len(hf->can_dlc); -+ cfd->len = data_length; - if (hf->flags & GS_CAN_FLAG_BRS) - cfd->flags |= CANFD_BRS; - if (hf->flags & GS_CAN_FLAG_ESI) - cfd->flags |= CANFD_ESI; - -- memcpy(cfd->data, hf->canfd->data, cfd->len); -+ memcpy(cfd->data, hf->canfd->data, data_length); - } else { - skb = alloc_can_skb(netdev, &cf); - if (!skb) -@@ -628,7 +689,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) - cf->can_id = le32_to_cpu(hf->can_id); - can_frame_set_cc_len(cf, hf->can_dlc, dev->can.ctrlmode); - -- memcpy(cf->data, hf->classic_can->data, 8); -+ memcpy(cf->data, hf->classic_can->data, data_length); - - /* ERROR frames tell us information about the controller */ - if (le32_to_cpu(hf->can_id) & CAN_ERR_FLAG) -@@ -684,7 +745,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) - resubmit_urb: - usb_fill_bulk_urb(urb, parent->udev, - parent->pipe_in, -- hf, dev->parent->hf_size_rx, -+ hf, parent->hf_size_rx, - gs_usb_receive_bulk_callback, parent); - - rc = usb_submit_urb(urb, GFP_ATOMIC); -@@ -747,8 +808,21 @@ static void gs_usb_xmit_callback(struct urb *urb) - struct gs_can *dev = txc->dev; - struct net_device *netdev = dev->netdev; - -- if (urb->status) -- netdev_info(netdev, "usb xmit fail %u\n", txc->echo_id); -+ if (!urb->status) -+ return; -+ -+ if (urb->status != -ESHUTDOWN && net_ratelimit()) -+ netdev_info(netdev, "failed to xmit URB %u: %pe\n", -+ txc->echo_id, ERR_PTR(urb->status)); -+ -+ netdev->stats.tx_dropped++; -+ netdev->stats.tx_errors++; -+ -+ can_free_echo_skb(netdev, txc->echo_id, NULL); -+ gs_free_tx_context(txc); -+ atomic_dec(&dev->active_tx_urbs); -+ -+ netif_wake_queue(netdev); - } - - static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb, -diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c -index 23bd7574b1c7e1..7b931953dadc48 100644 ---- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c -+++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c -@@ -611,7 +611,7 @@ static int kvaser_usb_leaf_wait_cmd(const struct kvaser_usb *dev, u8 id, - * for further details. - */ - if (tmp->len == 0) { -- pos = round_up(pos, -+ pos = round_up(pos + 1, - le16_to_cpu - (dev->bulk_in->wMaxPacketSize)); - continue; -@@ -1590,7 +1590,7 @@ static void kvaser_usb_leaf_read_bulk_callback(struct kvaser_usb *dev, - * number of events in case of a heavy rx load on the bus. - */ - if (cmd->len == 0) { -- pos = round_up(pos, le16_to_cpu -+ pos = round_up(pos + 1, le16_to_cpu - (dev->bulk_in->wMaxPacketSize)); - continue; - } -diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c -index cff83a8fb7d28a..651b81b278b243 100644 ---- a/drivers/net/dsa/microchip/ksz_common.c -+++ b/drivers/net/dsa/microchip/ksz_common.c -@@ -1870,8 +1870,8 @@ static int ksz_irq_phy_setup(struct ksz_device *dev) - if (BIT(phy) & ds->phys_mii_mask) { - irq = irq_find_mapping(dev->ports[phy].pirq.domain, - PORT_SRC_PHY_INT); -- if (irq < 0) { -- ret = irq; -+ if (!irq) { -+ ret = -EINVAL; - goto out; - } - ds->slave_mii_bus->irq[phy] = irq; -@@ -2095,8 +2095,8 @@ static int ksz_pirq_setup(struct ksz_device *dev, u8 p) - snprintf(pirq->name, sizeof(pirq->name), "port_irq-%d", p); - - pirq->irq_num = irq_find_mapping(dev->girq.domain, p); -- if (pirq->irq_num < 0) -- return pirq->irq_num; -+ if (!pirq->irq_num) -+ return -EINVAL; - - return ksz_irq_common_setup(dev, pirq); - } -@@ -2163,18 +2163,18 @@ static int ksz_setup(struct dsa_switch *ds) - dsa_switch_for_each_user_port(dp, dev->ds) { - ret = ksz_pirq_setup(dev, dp->index); - if (ret) -- goto out_girq; -+ goto port_release; - - ret = ksz_ptp_irq_setup(ds, dp->index); - if (ret) -- goto out_pirq; -+ goto pirq_release; - } - } - - ret = ksz_ptp_clock_register(ds); - if (ret) { - dev_err(dev->dev, "Failed to register PTP clock: %d\n", ret); -- goto out_ptpirq; -+ goto port_release; - } - - ret = ksz_mdio_register(dev); -@@ -2191,17 +2191,17 @@ static int ksz_setup(struct dsa_switch *ds) - - out_ptp_clock_unregister: - ksz_ptp_clock_unregister(ds); --out_ptpirq: -- if (dev->irq > 0) -- dsa_switch_for_each_user_port(dp, dev->ds) -+port_release: -+ if (dev->irq > 0) { -+ dsa_switch_for_each_port_continue_reverse(dp, dev->ds) { -+ if (!dsa_port_is_user(dp)) -+ continue; - ksz_ptp_irq_free(ds, dp->index); --out_pirq: -- if (dev->irq > 0) -- dsa_switch_for_each_user_port(dp, dev->ds) -+pirq_release: - ksz_irq_free(&dev->ports[dp->index].pirq); --out_girq: -- if (dev->irq > 0) -+ } - ksz_irq_free(&dev->girq); -+ } - - return ret; - } -diff --git a/drivers/net/dsa/microchip/ksz_ptp.c b/drivers/net/dsa/microchip/ksz_ptp.c -index 7ef5fac69657ff..3783d20d673b98 100644 ---- a/drivers/net/dsa/microchip/ksz_ptp.c -+++ b/drivers/net/dsa/microchip/ksz_ptp.c -@@ -1099,19 +1099,19 @@ static int ksz_ptp_msg_irq_setup(struct ksz_port *port, u8 n) - static const char * const name[] = {"pdresp-msg", "xdreq-msg", - "sync-msg"}; - const struct ksz_dev_ops *ops = port->ksz_dev->dev_ops; -+ struct ksz_irq *ptpirq = &port->ptpirq; - struct ksz_ptp_irq *ptpmsg_irq; - - ptpmsg_irq = &port->ptpmsg_irq[n]; -+ ptpmsg_irq->num = irq_create_mapping(ptpirq->domain, n); -+ if (!ptpmsg_irq->num) -+ return -EINVAL; - - ptpmsg_irq->port = port; - ptpmsg_irq->ts_reg = ops->get_port_addr(port->num, ts_reg[n]); - - snprintf(ptpmsg_irq->name, sizeof(ptpmsg_irq->name), name[n]); - -- ptpmsg_irq->num = irq_find_mapping(port->ptpirq.domain, n); -- if (ptpmsg_irq->num < 0) -- return ptpmsg_irq->num; -- - return request_threaded_irq(ptpmsg_irq->num, NULL, - ksz_ptp_msg_thread_fn, IRQF_ONESHOT, - ptpmsg_irq->name, ptpmsg_irq); -@@ -1141,12 +1141,9 @@ int ksz_ptp_irq_setup(struct dsa_switch *ds, u8 p) - if (!ptpirq->domain) - return -ENOMEM; - -- for (irq = 0; irq < ptpirq->nirqs; irq++) -- irq_create_mapping(ptpirq->domain, irq); -- - ptpirq->irq_num = irq_find_mapping(port->pirq.domain, PORT_SRC_PTP_INT); -- if (ptpirq->irq_num < 0) { -- ret = ptpirq->irq_num; -+ if (!ptpirq->irq_num) { -+ ret = -EINVAL; - goto out; - } - -@@ -1165,12 +1162,11 @@ int ksz_ptp_irq_setup(struct dsa_switch *ds, u8 p) - - out_ptp_msg: - free_irq(ptpirq->irq_num, ptpirq); -- while (irq--) -+ while (irq--) { - free_irq(port->ptpmsg_irq[irq].num, &port->ptpmsg_irq[irq]); --out: -- for (irq = 0; irq < ptpirq->nirqs; irq++) - irq_dispose_mapping(port->ptpmsg_irq[irq].num); -- -+ } -+out: - irq_domain_remove(ptpirq->domain); - - return ret; -diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c -index 843e50b5a0ec57..1acc5d912d1618 100644 ---- a/drivers/net/dsa/sja1105/sja1105_main.c -+++ b/drivers/net/dsa/sja1105/sja1105_main.c -@@ -1261,29 +1261,11 @@ static int sja1105_parse_dt(struct sja1105_private *priv) - return rc; - } - --/* Convert link speed from SJA1105 to ethtool encoding */ --static int sja1105_port_speed_to_ethtool(struct sja1105_private *priv, -- u64 speed) --{ -- if (speed == priv->info->port_speed[SJA1105_SPEED_10MBPS]) -- return SPEED_10; -- if (speed == priv->info->port_speed[SJA1105_SPEED_100MBPS]) -- return SPEED_100; -- if (speed == priv->info->port_speed[SJA1105_SPEED_1000MBPS]) -- return SPEED_1000; -- if (speed == priv->info->port_speed[SJA1105_SPEED_2500MBPS]) -- return SPEED_2500; -- return SPEED_UNKNOWN; --} -- --/* Set link speed in the MAC configuration for a specific port. */ --static int sja1105_adjust_port_config(struct sja1105_private *priv, int port, -- int speed_mbps) -+static int sja1105_set_port_speed(struct sja1105_private *priv, int port, -+ int speed_mbps) - { - struct sja1105_mac_config_entry *mac; -- struct device *dev = priv->ds->dev; - u64 speed; -- int rc; - - /* On P/Q/R/S, one can read from the device via the MAC reconfiguration - * tables. On E/T, MAC reconfig tables are not readable, only writable. -@@ -1317,7 +1299,7 @@ static int sja1105_adjust_port_config(struct sja1105_private *priv, int port, - speed = priv->info->port_speed[SJA1105_SPEED_2500MBPS]; - break; - default: -- dev_err(dev, "Invalid speed %iMbps\n", speed_mbps); -+ dev_err(priv->ds->dev, "Invalid speed %iMbps\n", speed_mbps); - return -EINVAL; - } - -@@ -1325,15 +1307,28 @@ static int sja1105_adjust_port_config(struct sja1105_private *priv, int port, - * table, since this will be used for the clocking setup, and we no - * longer need to store it in the static config (already told hardware - * we want auto during upload phase). -- * Actually for the SGMII port, the MAC is fixed at 1 Gbps and -- * we need to configure the PCS only (if even that). - */ -- if (priv->phy_mode[port] == PHY_INTERFACE_MODE_SGMII) -- mac[port].speed = priv->info->port_speed[SJA1105_SPEED_1000MBPS]; -- else if (priv->phy_mode[port] == PHY_INTERFACE_MODE_2500BASEX) -- mac[port].speed = priv->info->port_speed[SJA1105_SPEED_2500MBPS]; -- else -- mac[port].speed = speed; -+ mac[port].speed = speed; -+ -+ return 0; -+} -+ -+/* Write the MAC Configuration Table entry and, if necessary, the CGU settings, -+ * after a link speedchange for this port. -+ */ -+static int sja1105_set_port_config(struct sja1105_private *priv, int port) -+{ -+ struct sja1105_mac_config_entry *mac; -+ struct device *dev = priv->ds->dev; -+ int rc; -+ -+ /* On P/Q/R/S, one can read from the device via the MAC reconfiguration -+ * tables. On E/T, MAC reconfig tables are not readable, only writable. -+ * We have to *know* what the MAC looks like. For the sake of keeping -+ * the code common, we'll use the static configuration tables as a -+ * reasonable approximation for both E/T and P/Q/R/S. -+ */ -+ mac = priv->static_config.tables[BLK_IDX_MAC_CONFIG].entries; - - /* Write to the dynamic reconfiguration tables */ - rc = sja1105_dynamic_config_write(priv, BLK_IDX_MAC_CONFIG, port, -@@ -1383,7 +1378,8 @@ static void sja1105_mac_link_up(struct dsa_switch *ds, int port, - { - struct sja1105_private *priv = ds->priv; - -- sja1105_adjust_port_config(priv, port, speed); -+ if (!sja1105_set_port_speed(priv, port, speed)) -+ sja1105_set_port_config(priv, port); - - sja1105_inhibit_tx(priv, BIT(port), false); - } -@@ -2284,8 +2280,8 @@ int sja1105_static_config_reload(struct sja1105_private *priv, - { - struct ptp_system_timestamp ptp_sts_before; - struct ptp_system_timestamp ptp_sts_after; -- int speed_mbps[SJA1105_MAX_NUM_PORTS]; - u16 bmcr[SJA1105_MAX_NUM_PORTS] = {0}; -+ u64 mac_speed[SJA1105_MAX_NUM_PORTS]; - struct sja1105_mac_config_entry *mac; - struct dsa_switch *ds = priv->ds; - s64 t1, t2, t3, t4; -@@ -2298,14 +2294,13 @@ int sja1105_static_config_reload(struct sja1105_private *priv, - - mac = priv->static_config.tables[BLK_IDX_MAC_CONFIG].entries; - -- /* Back up the dynamic link speed changed by sja1105_adjust_port_config -+ /* Back up the dynamic link speed changed by sja1105_set_port_speed() - * in order to temporarily restore it to SJA1105_SPEED_AUTO - which the - * switch wants to see in the static config in order to allow us to - * change it through the dynamic interface later. - */ - for (i = 0; i < ds->num_ports; i++) { -- speed_mbps[i] = sja1105_port_speed_to_ethtool(priv, -- mac[i].speed); -+ mac_speed[i] = mac[i].speed; - mac[i].speed = priv->info->port_speed[SJA1105_SPEED_AUTO]; - - if (priv->xpcs[i]) -@@ -2368,7 +2363,8 @@ int sja1105_static_config_reload(struct sja1105_private *priv, - struct dw_xpcs *xpcs = priv->xpcs[i]; - unsigned int neg_mode; - -- rc = sja1105_adjust_port_config(priv, i, speed_mbps[i]); -+ mac[i].speed = mac_speed[i]; -+ rc = sja1105_set_port_config(priv, i); - if (rc < 0) - goto out; - -diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.c b/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.c -index 1921741f7311da..18b08277d2e1a8 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.c -+++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.c -@@ -15,6 +15,7 @@ - - #include "aq_hw.h" - #include "aq_nic.h" -+#include "hw_atl/hw_atl_llh.h" - - void aq_hw_write_reg_bit(struct aq_hw_s *aq_hw, u32 addr, u32 msk, - u32 shift, u32 val) -@@ -81,6 +82,27 @@ void aq_hw_write_reg64(struct aq_hw_s *hw, u32 reg, u64 value) - lo_hi_writeq(value, hw->mmio + reg); - } - -+int aq_hw_invalidate_descriptor_cache(struct aq_hw_s *hw) -+{ -+ int err; -+ u32 val; -+ -+ /* Invalidate Descriptor Cache to prevent writing to the cached -+ * descriptors and to the data pointer of those descriptors -+ */ -+ hw_atl_rdm_rx_dma_desc_cache_init_tgl(hw); -+ -+ err = aq_hw_err_from_flags(hw); -+ if (err) -+ goto err_exit; -+ -+ readx_poll_timeout_atomic(hw_atl_rdm_rx_dma_desc_cache_init_done_get, -+ hw, val, val == 1, 1000U, 10000U); -+ -+err_exit: -+ return err; -+} -+ - int aq_hw_err_from_flags(struct aq_hw_s *hw) - { - int err = 0; -diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.h b/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.h -index ffa6e4067c2118..d89c63d88e4a44 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.h -+++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.h -@@ -35,6 +35,7 @@ u32 aq_hw_read_reg(struct aq_hw_s *hw, u32 reg); - void aq_hw_write_reg(struct aq_hw_s *hw, u32 reg, u32 value); - u64 aq_hw_read_reg64(struct aq_hw_s *hw, u32 reg); - void aq_hw_write_reg64(struct aq_hw_s *hw, u32 reg, u64 value); -+int aq_hw_invalidate_descriptor_cache(struct aq_hw_s *hw); - int aq_hw_err_from_flags(struct aq_hw_s *hw); - int aq_hw_num_tcs(struct aq_hw_s *hw); - int aq_hw_q_per_tc(struct aq_hw_s *hw); -diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c -index f7433abd659159..3f004d08307fb8 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c -+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c -@@ -547,6 +547,11 @@ static int __aq_ring_rx_clean(struct aq_ring_s *self, struct napi_struct *napi, - - if (!buff->is_eop) { - unsigned int frag_cnt = 0U; -+ -+ /* There will be an extra fragment */ -+ if (buff->len > AQ_CFG_RX_HDR_SIZE) -+ frag_cnt++; -+ - buff_ = buff; - do { - bool is_rsc_completed = true; -diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c -index 54e70f07b57341..7b4814b3ba4420 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c -+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c -@@ -1198,26 +1198,9 @@ static int hw_atl_b0_hw_interrupt_moderation_set(struct aq_hw_s *self) - - static int hw_atl_b0_hw_stop(struct aq_hw_s *self) - { -- int err; -- u32 val; -- - hw_atl_b0_hw_irq_disable(self, HW_ATL_B0_INT_MASK); - -- /* Invalidate Descriptor Cache to prevent writing to the cached -- * descriptors and to the data pointer of those descriptors -- */ -- hw_atl_rdm_rx_dma_desc_cache_init_tgl(self); -- -- err = aq_hw_err_from_flags(self); -- -- if (err) -- goto err_exit; -- -- readx_poll_timeout_atomic(hw_atl_rdm_rx_dma_desc_cache_init_done_get, -- self, val, val == 1, 1000U, 10000U); -- --err_exit: -- return err; -+ return aq_hw_invalidate_descriptor_cache(self); - } - - int hw_atl_b0_hw_ring_tx_stop(struct aq_hw_s *self, struct aq_ring_s *ring) -diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c -index 220400a633f5e5..a7bef9da823da2 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c -+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c -@@ -759,7 +759,7 @@ static int hw_atl2_hw_stop(struct aq_hw_s *self) - { - hw_atl_b0_hw_irq_disable(self, HW_ATL2_INT_MASK); - -- return 0; -+ return aq_hw_invalidate_descriptor_cache(self); - } - - static struct aq_stats_s *hw_atl2_utils_get_hw_stats(struct aq_hw_s *self) -diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c -index 7593255e6e53d0..bf7b5d1d561613 100644 ---- a/drivers/net/ethernet/cadence/macb_main.c -+++ b/drivers/net/ethernet/cadence/macb_main.c -@@ -5182,11 +5182,11 @@ static int macb_remove(struct platform_device *pdev) - - if (dev) { - bp = netdev_priv(dev); -+ unregister_netdev(dev); - phy_exit(bp->sgmii_phy); - mdiobus_unregister(bp->mii_bus); - mdiobus_free(bp->mii_bus); - -- unregister_netdev(dev); - tasklet_kill(&bp->hresp_err_tasklet); - pm_runtime_disable(&pdev->dev); - pm_runtime_dont_use_autosuspend(&pdev->dev); -diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h -index 733af928caffc6..d80a8c07c02000 100644 ---- a/drivers/net/ethernet/freescale/fec.h -+++ b/drivers/net/ethernet/freescale/fec.h -@@ -683,6 +683,7 @@ struct fec_enet_private { - unsigned int reload_period; - int pps_enable; - unsigned int next_counter; -+ bool perout_enable; - struct hrtimer perout_timer; - u64 perout_stime; - -diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c -index 7f6b5743207166..4bb894b5afcb99 100644 ---- a/drivers/net/ethernet/freescale/fec_ptp.c -+++ b/drivers/net/ethernet/freescale/fec_ptp.c -@@ -129,6 +129,12 @@ static int fec_ptp_enable_pps(struct fec_enet_private *fep, uint enable) - - spin_lock_irqsave(&fep->tmreg_lock, flags); - -+ if (fep->perout_enable) { -+ spin_unlock_irqrestore(&fep->tmreg_lock, flags); -+ dev_err(&fep->pdev->dev, "PEROUT is running"); -+ return -EBUSY; -+ } -+ - if (fep->pps_enable == enable) { - spin_unlock_irqrestore(&fep->tmreg_lock, flags); - return 0; -@@ -244,6 +250,7 @@ static int fec_ptp_pps_perout(struct fec_enet_private *fep) - * the FEC_TCCR register in time and missed the start time. - */ - if (fep->perout_stime < curr_time + 100 * NSEC_PER_MSEC) { -+ fep->perout_enable = false; - dev_err(&fep->pdev->dev, "Current time is too close to the start time!\n"); - spin_unlock_irqrestore(&fep->tmreg_lock, flags); - return -1; -@@ -498,7 +505,10 @@ static int fec_ptp_pps_disable(struct fec_enet_private *fep, uint channel) - { - unsigned long flags; - -+ hrtimer_cancel(&fep->perout_timer); -+ - spin_lock_irqsave(&fep->tmreg_lock, flags); -+ fep->perout_enable = false; - writel(0, fep->hwp + FEC_TCSR(channel)); - spin_unlock_irqrestore(&fep->tmreg_lock, flags); - -@@ -530,6 +540,8 @@ static int fec_ptp_enable(struct ptp_clock_info *ptp, - - return ret; - } else if (rq->type == PTP_CLK_REQ_PEROUT) { -+ u32 reload_period; -+ - /* Reject requests with unsupported flags */ - if (rq->perout.flags) - return -EOPNOTSUPP; -@@ -549,12 +561,14 @@ static int fec_ptp_enable(struct ptp_clock_info *ptp, - return -EOPNOTSUPP; - } - -- fep->reload_period = div_u64(period_ns, 2); -- if (on && fep->reload_period) { -+ reload_period = div_u64(period_ns, 2); -+ if (on && reload_period) { -+ u64 perout_stime; -+ - /* Convert 1588 timestamp to ns*/ - start_time.tv_sec = rq->perout.start.sec; - start_time.tv_nsec = rq->perout.start.nsec; -- fep->perout_stime = timespec64_to_ns(&start_time); -+ perout_stime = timespec64_to_ns(&start_time); - - mutex_lock(&fep->ptp_clk_mutex); - if (!fep->ptp_clk_on) { -@@ -563,18 +577,41 @@ static int fec_ptp_enable(struct ptp_clock_info *ptp, - return -EOPNOTSUPP; - } - spin_lock_irqsave(&fep->tmreg_lock, flags); -+ -+ if (fep->pps_enable) { -+ dev_err(&fep->pdev->dev, "PPS is running"); -+ ret = -EBUSY; -+ goto unlock; -+ } -+ -+ if (fep->perout_enable) { -+ dev_err(&fep->pdev->dev, -+ "PEROUT has been enabled\n"); -+ ret = -EBUSY; -+ goto unlock; -+ } -+ - /* Read current timestamp */ - curr_time = timecounter_read(&fep->tc); -- spin_unlock_irqrestore(&fep->tmreg_lock, flags); -- mutex_unlock(&fep->ptp_clk_mutex); -+ if (perout_stime <= curr_time) { -+ dev_err(&fep->pdev->dev, -+ "Start time must be greater than current time\n"); -+ ret = -EINVAL; -+ goto unlock; -+ } - - /* Calculate time difference */ -- delta = fep->perout_stime - curr_time; -+ delta = perout_stime - curr_time; -+ fep->reload_period = reload_period; -+ fep->perout_stime = perout_stime; -+ fep->perout_enable = true; - -- if (fep->perout_stime <= curr_time) { -- dev_err(&fep->pdev->dev, "Start time must larger than current time!\n"); -- return -EINVAL; -- } -+unlock: -+ spin_unlock_irqrestore(&fep->tmreg_lock, flags); -+ mutex_unlock(&fep->ptp_clk_mutex); -+ -+ if (ret) -+ return ret; - - /* Because the timer counter of FEC only has 31-bits, correspondingly, - * the time comparison register FEC_TCCR also only low 31 bits can be -@@ -682,8 +719,11 @@ static irqreturn_t fec_pps_interrupt(int irq, void *dev_id) - fep->next_counter = (fep->next_counter + fep->reload_period) & - fep->cc.mask; - -- event.type = PTP_CLOCK_PPS; -- ptp_clock_event(fep->ptp_clock, &event); -+ if (fep->pps_enable) { -+ event.type = PTP_CLOCK_PPS; -+ ptp_clock_event(fep->ptp_clock, &event); -+ } -+ - return IRQ_HANDLED; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -index 29e633e6dd3f04..e29a8ed7e7ac13 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -@@ -619,7 +619,7 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev, - MLX5E_100MB); - max_bw_value[i] = max_bw_value[i] ? max_bw_value[i] : 1; - max_bw_unit[i] = MLX5_100_MBPS_UNIT; -- } else if (max_bw_value[i] <= upper_limit_gbps) { -+ } else if (maxrate->tc_maxrate[i] <= upper_limit_gbps) { - max_bw_value[i] = div_u64(maxrate->tc_maxrate[i], - MLX5E_1GB); - max_bw_unit[i] = MLX5_GBPS_UNIT; -diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c b/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c -index 87e5e81d40dc68..84f5b4410e48e1 100644 ---- a/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c -+++ b/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c -@@ -1,11 +1,14 @@ - // SPDX-License-Identifier: GPL-2.0+ - - #include -+#include - - #include "lan966x_main.h" - #include "vcap_api.h" - #include "vcap_api_client.h" - -+#define LAN9X66_CLOCK_RATE 165617754 -+ - #define LAN966X_MAX_PTP_ID 512 - - /* Represents 1ppm adjustment in 2^59 format with 6.037735849ns as reference -@@ -1132,5 +1135,5 @@ void lan966x_ptp_rxtstamp(struct lan966x *lan966x, struct sk_buff *skb, - u32 lan966x_ptp_get_period_ps(void) - { - /* This represents the system clock period in picoseconds */ -- return 15125; -+ return PICO / LAN9X66_CLOCK_RATE; - } -diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c -index 71439825ea4e08..d662679c298321 100644 ---- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c -+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c -@@ -1521,8 +1521,10 @@ static int sxgbe_rx(struct sxgbe_priv_data *priv, int limit) - - skb = priv->rxq[qnum]->rx_skbuff[entry]; - -- if (unlikely(!skb)) -+ if (unlikely(!skb)) { - netdev_err(priv->dev, "rx descriptor is not consistent\n"); -+ break; -+ } - - prefetch(skb->data - NET_IP_ALIGN); - priv->rxq[qnum]->rx_skbuff[entry] = NULL; -diff --git a/drivers/net/phy/mxl-gpy.c b/drivers/net/phy/mxl-gpy.c -index 034f5c4d033771..5868a0747097fb 100644 ---- a/drivers/net/phy/mxl-gpy.c -+++ b/drivers/net/phy/mxl-gpy.c -@@ -515,7 +515,7 @@ static int gpy_update_interface(struct phy_device *phydev) - /* Interface mode is fixed for USXGMII and integrated PHY */ - if (phydev->interface == PHY_INTERFACE_MODE_USXGMII || - phydev->interface == PHY_INTERFACE_MODE_INTERNAL) -- return -EINVAL; -+ return 0; - - /* Automatically switch SERDES interface between SGMII and 2500-BaseX - * according to speed. Disable ANEG in 2500-BaseX mode. -diff --git a/drivers/platform/x86/intel/punit_ipc.c b/drivers/platform/x86/intel/punit_ipc.c -index cd0ba84cc8e4a7..9e48229538a5e9 100644 ---- a/drivers/platform/x86/intel/punit_ipc.c -+++ b/drivers/platform/x86/intel/punit_ipc.c -@@ -283,7 +283,7 @@ static int intel_punit_ipc_probe(struct platform_device *pdev) - } else { - ret = devm_request_irq(&pdev->dev, irq, intel_punit_ioc, - IRQF_NO_SUSPEND, "intel_punit_ipc", -- &punit_ipcdev); -+ punit_ipcdev); - if (ret) { - dev_err(&pdev->dev, "Failed to request irq: %d\n", irq); - return ret; -diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c -index 0da5d9d1af0370..fe3a96577f31f0 100644 ---- a/drivers/slimbus/qcom-ngd-ctrl.c -+++ b/drivers/slimbus/qcom-ngd-ctrl.c -@@ -1239,6 +1239,7 @@ static void qcom_slim_ngd_notify_slaves(struct qcom_slim_ngd_ctrl *ctrl) - - if (slim_get_logical_addr(sbdev)) - dev_err(ctrl->dev, "Failed to get logical address\n"); -+ put_device(&sbdev->dev); - } - } - -diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig -index 3ce0fd5df8e9ca..cda333f226b661 100644 ---- a/drivers/spi/Kconfig -+++ b/drivers/spi/Kconfig -@@ -1059,10 +1059,10 @@ config SPI_TEGRA210_QUAD - - config SPI_TEGRA114 - tristate "NVIDIA Tegra114 SPI Controller" -- depends on (ARCH_TEGRA && TEGRA20_APB_DMA) || COMPILE_TEST -+ depends on ARCH_TEGRA || COMPILE_TEST - depends on RESET_CONTROLLER - help -- SPI driver for NVIDIA Tegra114 SPI Controller interface. This controller -+ SPI controller driver for NVIDIA Tegra114 and later SoCs. This controller - is different than the older SoCs SPI controller and also register interface - get changed with this controller. - -diff --git a/drivers/spi/spi-amlogic-spifc-a1.c b/drivers/spi/spi-amlogic-spifc-a1.c -index fadf6667cd51c4..b430bca4f8bce8 100644 ---- a/drivers/spi/spi-amlogic-spifc-a1.c -+++ b/drivers/spi/spi-amlogic-spifc-a1.c -@@ -349,7 +349,9 @@ static int amlogic_spifc_a1_probe(struct platform_device *pdev) - - pm_runtime_set_autosuspend_delay(spifc->dev, 500); - pm_runtime_use_autosuspend(spifc->dev); -- devm_pm_runtime_enable(spifc->dev); -+ ret = devm_pm_runtime_enable(spifc->dev); -+ if (ret) -+ return ret; - - ctrl->num_chipselect = 1; - ctrl->dev.of_node = pdev->dev.of_node; -diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c -index a95badb7b71146..ba66fe9f1f543d 100644 ---- a/drivers/spi/spi-bcm63xx.c -+++ b/drivers/spi/spi-bcm63xx.c -@@ -247,6 +247,20 @@ static int bcm63xx_txrx_bufs(struct spi_device *spi, struct spi_transfer *first, - - if (t->rx_buf) { - do_rx = true; -+ -+ /* -+ * In certain hardware implementations, there appears to be a -+ * hidden accumulator that tracks the number of bytes written into -+ * the hardware FIFO, and this accumulator overrides the length in -+ * the SPI_MSG_CTL register. -+ * -+ * Therefore, for read-only transfers, we need to write some dummy -+ * value into the FIFO to keep the accumulator tracking the correct -+ * length. -+ */ -+ if (!t->tx_buf) -+ memset_io(bs->tx_io + len, 0xFF, t->len); -+ - /* prepend is half-duplex write only */ - if (t == first) - prepend_len = 0; -diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c -index edd7430d4c052b..c581aa5fbf7cf7 100644 ---- a/drivers/spi/spi-mem.c -+++ b/drivers/spi/spi-mem.c -@@ -172,6 +172,9 @@ bool spi_mem_default_supports_op(struct spi_mem *mem, - if (!spi_mem_controller_is_capable(ctlr, dtr)) - return false; - -+ if (op->data.swap16 && !spi_mem_controller_is_capable(ctlr, swap16)) -+ return false; -+ - if (op->cmd.nbytes != 2) - return false; - } else { -@@ -184,6 +187,16 @@ bool spi_mem_default_supports_op(struct spi_mem *mem, - return false; - } - -+ if (op->max_freq && mem->spi->controller->min_speed_hz && -+ op->max_freq < mem->spi->controller->min_speed_hz) -+ return false; -+ -+ if (op->max_freq && -+ op->max_freq < mem->spi->max_speed_hz) { -+ if (!spi_mem_controller_is_capable(ctlr, per_op_freq)) -+ return false; -+ } -+ - return spi_mem_check_buswidth(mem, op); - } - EXPORT_SYMBOL_GPL(spi_mem_default_supports_op); -@@ -318,6 +331,9 @@ int spi_mem_exec_op(struct spi_mem *mem, const struct spi_mem_op *op) - u8 *tmpbuf; - int ret; - -+ /* Make sure the operation frequency is correct before going futher */ -+ spi_mem_adjust_op_freq(mem, (struct spi_mem_op *)op); -+ - ret = spi_mem_check_op(op); - if (ret) - return ret; -@@ -360,6 +376,7 @@ int spi_mem_exec_op(struct spi_mem *mem, const struct spi_mem_op *op) - xfers[xferpos].tx_buf = tmpbuf; - xfers[xferpos].len = op->cmd.nbytes; - xfers[xferpos].tx_nbits = op->cmd.buswidth; -+ xfers[xferpos].speed_hz = op->max_freq; - spi_message_add_tail(&xfers[xferpos], &msg); - xferpos++; - totalxferlen++; -@@ -374,6 +391,7 @@ int spi_mem_exec_op(struct spi_mem *mem, const struct spi_mem_op *op) - xfers[xferpos].tx_buf = tmpbuf + 1; - xfers[xferpos].len = op->addr.nbytes; - xfers[xferpos].tx_nbits = op->addr.buswidth; -+ xfers[xferpos].speed_hz = op->max_freq; - spi_message_add_tail(&xfers[xferpos], &msg); - xferpos++; - totalxferlen += op->addr.nbytes; -@@ -385,6 +403,7 @@ int spi_mem_exec_op(struct spi_mem *mem, const struct spi_mem_op *op) - xfers[xferpos].len = op->dummy.nbytes; - xfers[xferpos].tx_nbits = op->dummy.buswidth; - xfers[xferpos].dummy_data = 1; -+ xfers[xferpos].speed_hz = op->max_freq; - spi_message_add_tail(&xfers[xferpos], &msg); - xferpos++; - totalxferlen += op->dummy.nbytes; -@@ -400,6 +419,7 @@ int spi_mem_exec_op(struct spi_mem *mem, const struct spi_mem_op *op) - } - - xfers[xferpos].len = op->data.nbytes; -+ xfers[xferpos].speed_hz = op->max_freq; - spi_message_add_tail(&xfers[xferpos], &msg); - xferpos++; - totalxferlen += op->data.nbytes; -@@ -478,6 +498,23 @@ int spi_mem_adjust_op_size(struct spi_mem *mem, struct spi_mem_op *op) - } - EXPORT_SYMBOL_GPL(spi_mem_adjust_op_size); - -+/** -+ * spi_mem_adjust_op_freq() - Adjust the frequency of a SPI mem operation to -+ * match controller, PCB and chip limitations -+ * @mem: the SPI memory -+ * @op: the operation to adjust -+ * -+ * Some chips have per-op frequency limitations and must adapt the maximum -+ * speed. This function allows SPI mem drivers to set @op->max_freq to the -+ * maximum supported value. -+ */ -+void spi_mem_adjust_op_freq(struct spi_mem *mem, struct spi_mem_op *op) -+{ -+ if (!op->max_freq || op->max_freq > mem->spi->max_speed_hz) -+ op->max_freq = mem->spi->max_speed_hz; -+} -+EXPORT_SYMBOL_GPL(spi_mem_adjust_op_freq); -+ - static ssize_t spi_mem_no_dirmap_read(struct spi_mem_dirmap_desc *desc, - u64 offs, size_t len, void *buf) - { -diff --git a/drivers/spi/spi-nxp-fspi.c b/drivers/spi/spi-nxp-fspi.c -index 731504ec7ef8b0..ce110035a3597c 100644 ---- a/drivers/spi/spi-nxp-fspi.c -+++ b/drivers/spi/spi-nxp-fspi.c -@@ -711,9 +711,10 @@ static void nxp_fspi_dll_calibration(struct nxp_fspi *f) - * Value for rest of the CS FLSHxxCR0 register would be zero. - * - */ --static void nxp_fspi_select_mem(struct nxp_fspi *f, struct spi_device *spi) -+static void nxp_fspi_select_mem(struct nxp_fspi *f, struct spi_device *spi, -+ const struct spi_mem_op *op) - { -- unsigned long rate = spi->max_speed_hz; -+ unsigned long rate = op->max_freq; - int ret; - uint64_t size_kb; - -@@ -938,7 +939,7 @@ static int nxp_fspi_exec_op(struct spi_mem *mem, const struct spi_mem_op *op) - FSPI_STS0_ARB_IDLE, 1, POLL_TOUT, true); - WARN_ON(err); - -- nxp_fspi_select_mem(f, mem->spi); -+ nxp_fspi_select_mem(f, mem->spi, op); - - nxp_fspi_prepare_lut(f, op); - /* -@@ -1156,11 +1157,15 @@ static const struct spi_controller_mem_ops nxp_fspi_mem_ops = { - .get_name = nxp_fspi_get_name, - }; - -+static const struct spi_controller_mem_caps nxp_fspi_mem_caps = { -+ .per_op_freq = true, -+}; -+ - static int nxp_fspi_probe(struct platform_device *pdev) - { - struct spi_controller *ctlr; - struct device *dev = &pdev->dev; -- struct device_node *np = dev->of_node; -+ struct fwnode_handle *fwnode = dev_fwnode(dev); - struct resource *res; - struct nxp_fspi *f; - int ret; -@@ -1184,7 +1189,7 @@ static int nxp_fspi_probe(struct platform_device *pdev) - platform_set_drvdata(pdev, f); - - /* find the resources - configuration register address space */ -- if (is_acpi_node(dev_fwnode(f->dev))) -+ if (is_acpi_node(fwnode)) - f->iobase = devm_platform_ioremap_resource(pdev, 0); - else - f->iobase = devm_platform_ioremap_resource_byname(pdev, "fspi_base"); -@@ -1195,7 +1200,7 @@ static int nxp_fspi_probe(struct platform_device *pdev) - } - - /* find the resources - controller memory mapped space */ -- if (is_acpi_node(dev_fwnode(f->dev))) -+ if (is_acpi_node(fwnode)) - res = platform_get_resource(pdev, IORESOURCE_MEM, 1); - else - res = platform_get_resource_byname(pdev, -@@ -1211,7 +1216,7 @@ static int nxp_fspi_probe(struct platform_device *pdev) - f->memmap_phy_size = resource_size(res); - - /* find the clocks */ -- if (dev_of_node(&pdev->dev)) { -+ if (is_of_node(fwnode)) { - f->clk_en = devm_clk_get(dev, "fspi_en"); - if (IS_ERR(f->clk_en)) { - ret = PTR_ERR(f->clk_en); -@@ -1253,10 +1258,11 @@ static int nxp_fspi_probe(struct platform_device *pdev) - ctlr->bus_num = -1; - ctlr->num_chipselect = NXP_FSPI_MAX_CHIPSELECT; - ctlr->mem_ops = &nxp_fspi_mem_ops; -+ ctlr->mem_caps = &nxp_fspi_mem_caps; - - nxp_fspi_default_setup(f); - -- ctlr->dev.of_node = np; -+ device_set_node(&ctlr->dev, fwnode); - - ret = devm_spi_register_controller(&pdev->dev, ctlr); - if (ret) -diff --git a/drivers/staging/Kconfig b/drivers/staging/Kconfig -index f9aef39cac2e93..abaa7af6ee7d00 100644 ---- a/drivers/staging/Kconfig -+++ b/drivers/staging/Kconfig -@@ -34,8 +34,6 @@ source "drivers/staging/rtl8192e/Kconfig" - - source "drivers/staging/rtl8723bs/Kconfig" - --source "drivers/staging/rtl8712/Kconfig" -- - source "drivers/staging/rts5208/Kconfig" - - source "drivers/staging/octeon/Kconfig" -diff --git a/drivers/staging/Makefile b/drivers/staging/Makefile -index ffa70dda481d36..b363618109ce10 100644 ---- a/drivers/staging/Makefile -+++ b/drivers/staging/Makefile -@@ -7,7 +7,6 @@ obj-$(CONFIG_FB_OLPC_DCON) += olpc_dcon/ - obj-$(CONFIG_RTL8192U) += rtl8192u/ - obj-$(CONFIG_RTL8192E) += rtl8192e/ - obj-$(CONFIG_RTL8723BS) += rtl8723bs/ --obj-$(CONFIG_R8712U) += rtl8712/ - obj-$(CONFIG_RTS5208) += rts5208/ - obj-$(CONFIG_OCTEON_ETHERNET) += octeon/ - obj-$(CONFIG_VT6655) += vt6655/ -diff --git a/drivers/staging/rtl8712/Kconfig b/drivers/staging/rtl8712/Kconfig -deleted file mode 100644 -index 8de26425225b38..00000000000000 ---- a/drivers/staging/rtl8712/Kconfig -+++ /dev/null -@@ -1,21 +0,0 @@ --# SPDX-License-Identifier: GPL-2.0 --config R8712U -- tristate "RealTek RTL8712U (RTL8192SU) Wireless LAN NIC driver" -- depends on WLAN && USB && CFG80211 -- select WIRELESS_EXT -- select WEXT_PRIV -- select FW_LOADER -- help -- This option adds the Realtek RTL8712 USB device such as the -- D-Link DWA-130. -- -- If built as a module, it will be called r8712u. -- --config R8712_TX_AGGR -- bool "Realtek RTL8712U Transmit Aggregation code" -- depends on R8712U && BROKEN -- help -- This option provides transmit aggregation for the Realtek -- RTL8712 USB device. -- -- -diff --git a/drivers/staging/rtl8712/Makefile b/drivers/staging/rtl8712/Makefile -deleted file mode 100644 -index 3ae216b6621b1c..00000000000000 ---- a/drivers/staging/rtl8712/Makefile -+++ /dev/null -@@ -1,35 +0,0 @@ --# SPDX-License-Identifier: GPL-2.0 --r8712u-y := \ -- rtl871x_cmd.o \ -- rtl8712_cmd.o \ -- rtl871x_security.o \ -- rtl871x_eeprom.o \ -- rtl8712_efuse.o \ -- hal_init.o \ -- usb_halinit.o \ -- usb_ops.o \ -- usb_ops_linux.o \ -- rtl871x_io.o \ -- rtl8712_io.o \ -- rtl871x_ioctl_linux.o \ -- rtl871x_ioctl_rtl.o \ -- rtl871x_ioctl_set.o \ -- rtl8712_led.o \ -- rtl871x_mlme.o \ -- ieee80211.o \ -- rtl871x_mp_ioctl.o \ -- rtl871x_mp.o \ -- mlme_linux.o \ -- recv_linux.o \ -- xmit_linux.o \ -- usb_intf.o \ -- os_intfs.o \ -- rtl871x_pwrctrl.o \ -- rtl8712_recv.o \ -- rtl871x_recv.o \ -- rtl871x_sta_mgt.o \ -- rtl871x_xmit.o \ -- rtl8712_xmit.o -- --obj-$(CONFIG_R8712U) := r8712u.o -- -diff --git a/drivers/staging/rtl8712/TODO b/drivers/staging/rtl8712/TODO -deleted file mode 100644 -index 847c8c41f4f7ff..00000000000000 ---- a/drivers/staging/rtl8712/TODO -+++ /dev/null -@@ -1,13 +0,0 @@ --TODO: --- merge Realtek's bugfixes and new features into the driver --- switch to use LIB80211 --- switch to use MAC80211 --- checkpatch.pl fixes - only a few remain -- --A replacement for this driver with MAC80211 support is available --at https://github.com/chunkeey/rtl8192su -- --Please send any patches to Greg Kroah-Hartman , --Larry Finger , --Florian Schilhabel and --Linux Driver Project Developer List . -diff --git a/drivers/staging/rtl8712/basic_types.h b/drivers/staging/rtl8712/basic_types.h -deleted file mode 100644 -index aecded87dd4c87..00000000000000 ---- a/drivers/staging/rtl8712/basic_types.h -+++ /dev/null -@@ -1,28 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __BASIC_TYPES_H__ --#define __BASIC_TYPES_H__ -- --#include -- --#define sint signed int -- --/* Should we extend this to be host_addr_t and target_addr_t for case: -- * host : x86_64 -- * target : mips64 -- */ --#define addr_t unsigned long -- --#endif /*__BASIC_TYPES_H__*/ -- -diff --git a/drivers/staging/rtl8712/drv_types.h b/drivers/staging/rtl8712/drv_types.h -deleted file mode 100644 -index 76ac798642bd2b..00000000000000 ---- a/drivers/staging/rtl8712/drv_types.h -+++ /dev/null -@@ -1,175 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --/* --------------------------------------------------------------------- -- * -- * For type defines and data structure defines -- * -- * --------------------------------------------------------------------- -- */ --#ifndef __DRV_TYPES_H__ --#define __DRV_TYPES_H__ -- --struct _adapter; -- --#include "osdep_service.h" --#include "wlan_bssdef.h" --#include "rtl8712_spec.h" --#include "rtl8712_hal.h" --#include --#include -- --enum _NIC_VERSION { -- RTL8711_NIC, -- RTL8712_NIC, -- RTL8713_NIC, -- RTL8716_NIC --}; -- --struct qos_priv { -- /* bit mask option: u-apsd, s-apsd, ts, block ack... */ -- unsigned int qos_option; --}; -- --#include "rtl871x_ht.h" --#include "rtl871x_cmd.h" --#include "rtl871x_xmit.h" --#include "rtl871x_recv.h" --#include "rtl871x_security.h" --#include "rtl871x_pwrctrl.h" --#include "rtl871x_io.h" --#include "rtl871x_eeprom.h" --#include "sta_info.h" --#include "rtl871x_mlme.h" --#include "rtl871x_mp.h" --#include "rtl871x_debug.h" --#include "rtl871x_rf.h" --#include "rtl871x_event.h" --#include "rtl871x_led.h" -- --#define SPEC_DEV_ID_DISABLE_HT BIT(1) -- --struct specific_device_id { -- u32 flags; -- u16 idVendor; -- u16 idProduct; -- --}; -- --struct registry_priv { -- u8 chip_version; -- u8 rfintfs; -- u8 lbkmode; -- u8 hci; -- u8 network_mode; /*infra, ad-hoc, auto*/ -- struct ndis_802_11_ssid ssid; -- u8 channel;/* ad-hoc support requirement */ -- u8 wireless_mode;/* A, B, G, auto */ -- u8 vrtl_carrier_sense; /*Enable, Disable, Auto*/ -- u8 vcs_type;/*RTS/CTS, CTS-to-self*/ -- u16 rts_thresh; -- u16 frag_thresh; -- u8 preamble;/*long, short, auto*/ -- u8 scan_mode;/*active, passive*/ -- u8 adhoc_tx_pwr; -- u8 soft_ap; -- u8 smart_ps; -- u8 power_mgnt; -- u8 radio_enable; -- u8 long_retry_lmt; -- u8 short_retry_lmt; -- u16 busy_thresh; -- u8 ack_policy; -- u8 mp_mode; -- u8 software_encrypt; -- u8 software_decrypt; -- /* UAPSD */ -- u8 wmm_enable; -- u8 uapsd_enable; -- u8 uapsd_max_sp; -- u8 uapsd_acbk_en; -- u8 uapsd_acbe_en; -- u8 uapsd_acvi_en; -- u8 uapsd_acvo_en; -- -- struct wlan_bssid_ex dev_network; -- -- u8 ht_enable; -- u8 cbw40_enable; -- u8 ampdu_enable;/*for tx*/ -- u8 rf_config; -- u8 low_power; -- u8 wifi_test; --}; -- --struct dvobj_priv { -- struct _adapter *padapter; -- u32 nr_endpoint; -- u8 ishighspeed; -- uint (*inirp_init)(struct _adapter *adapter); -- uint (*inirp_deinit)(struct _adapter *adapter); -- struct usb_device *pusbdev; --}; -- --/** -- * struct _adapter - the main adapter structure for this device. -- * -- * bup: True indicates that the interface is up. -- */ --struct _adapter { -- struct dvobj_priv dvobjpriv; -- struct mlme_priv mlmepriv; -- struct cmd_priv cmdpriv; -- struct evt_priv evtpriv; -- struct io_queue *pio_queue; -- struct xmit_priv xmitpriv; -- struct recv_priv recvpriv; -- struct sta_priv stapriv; -- struct security_priv securitypriv; -- struct registry_priv registrypriv; -- struct wlan_acl_pool acl_list; -- struct pwrctrl_priv pwrctrlpriv; -- struct eeprom_priv eeprompriv; -- struct hal_priv halpriv; -- struct led_priv ledpriv; -- struct mp_priv mppriv; -- bool driver_stopped; -- bool surprise_removed; -- bool suspended; -- u8 eeprom_address_size; -- u8 hw_init_completed; -- struct task_struct *cmd_thread; -- uint (*dvobj_init)(struct _adapter *adapter); -- void (*dvobj_deinit)(struct _adapter *adapter); -- struct net_device *pnetdev; -- int bup; -- struct net_device_stats stats; -- struct iw_statistics iwstats; -- int pid; /*process id from UI*/ -- struct work_struct wk_filter_rx_ff0; -- const struct firmware *fw; -- struct usb_interface *pusb_intf; -- struct mutex mutex_start; -- struct completion rtl8712_fw_ready; -- struct completion rx_filter_ready; --}; -- --static inline u8 *myid(struct eeprom_priv *peepriv) --{ -- return peepriv->mac_addr; --} -- --u8 r8712_usb_hal_bus_init(struct _adapter *adapter); -- --#endif /*__DRV_TYPES_H__*/ -- -diff --git a/drivers/staging/rtl8712/ethernet.h b/drivers/staging/rtl8712/ethernet.h -deleted file mode 100644 -index 4b9b8a97a0bc6c..00000000000000 ---- a/drivers/staging/rtl8712/ethernet.h -+++ /dev/null -@@ -1,21 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __INC_ETHERNET_H --#define __INC_ETHERNET_H -- --#define ETHERNET_HEADER_SIZE 14 /*!< Ethernet Header Length*/ --#define LLC_HEADER_SIZE 6 /*!< LLC Header Length*/ -- --#endif /* #ifndef __INC_ETHERNET_H */ -- -diff --git a/drivers/staging/rtl8712/hal_init.c b/drivers/staging/rtl8712/hal_init.c -deleted file mode 100644 -index 1148075f0cd64c..00000000000000 ---- a/drivers/staging/rtl8712/hal_init.c -+++ /dev/null -@@ -1,401 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE . -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _HAL_INIT_C_ -- --#include --#include --#include --#include --#include -- --#include "osdep_service.h" --#include "drv_types.h" --#include "usb_osintf.h" -- --#define FWBUFF_ALIGN_SZ 512 --#define MAX_DUMP_FWSZ (48 * 1024) -- --static void rtl871x_load_fw_fail(struct _adapter *adapter) --{ -- struct usb_device *udev = adapter->dvobjpriv.pusbdev; -- struct device *dev = &udev->dev; -- struct device *parent = dev->parent; -- -- complete(&adapter->rtl8712_fw_ready); -- -- dev_err(&udev->dev, "r8712u: Firmware request failed\n"); -- -- if (parent) -- device_lock(parent); -- -- device_release_driver(dev); -- -- if (parent) -- device_unlock(parent); --} -- --static void rtl871x_load_fw_cb(const struct firmware *firmware, void *context) --{ -- struct _adapter *adapter = context; -- -- if (!firmware) { -- rtl871x_load_fw_fail(adapter); -- return; -- } -- adapter->fw = firmware; -- /* firmware available - start netdev */ -- register_netdev(adapter->pnetdev); -- complete(&adapter->rtl8712_fw_ready); --} -- --static const char firmware_file[] = "rtlwifi/rtl8712u.bin"; -- --int rtl871x_load_fw(struct _adapter *padapter) --{ -- struct device *dev = &padapter->dvobjpriv.pusbdev->dev; -- int rc; -- -- init_completion(&padapter->rtl8712_fw_ready); -- dev_info(dev, "r8712u: Loading firmware from \"%s\"\n", firmware_file); -- rc = request_firmware_nowait(THIS_MODULE, 1, firmware_file, dev, -- GFP_KERNEL, padapter, rtl871x_load_fw_cb); -- if (rc) -- dev_err(dev, "r8712u: Firmware request error %d\n", rc); -- return rc; --} --MODULE_FIRMWARE("rtlwifi/rtl8712u.bin"); -- --static u32 rtl871x_open_fw(struct _adapter *adapter, const u8 **mappedfw) --{ -- if (adapter->fw->size > 200000) { -- dev_err(&adapter->pnetdev->dev, "r8712u: Bad fw->size of %zu\n", -- adapter->fw->size); -- return 0; -- } -- *mappedfw = adapter->fw->data; -- return adapter->fw->size; --} -- --static void fill_fwpriv(struct _adapter *adapter, struct fw_priv *fwpriv) --{ -- struct dvobj_priv *dvobj = &adapter->dvobjpriv; -- struct registry_priv *regpriv = &adapter->registrypriv; -- -- memset(fwpriv, 0, sizeof(struct fw_priv)); -- /* todo: check if needs endian conversion */ -- fwpriv->hci_sel = RTL8712_HCI_TYPE_72USB; -- fwpriv->usb_ep_num = (u8)dvobj->nr_endpoint; -- fwpriv->bw_40MHz_en = regpriv->cbw40_enable; -- switch (regpriv->rf_config) { -- case RTL8712_RF_1T1R: -- fwpriv->rf_config = RTL8712_RFC_1T1R; -- break; -- case RTL8712_RF_2T2R: -- fwpriv->rf_config = RTL8712_RFC_2T2R; -- break; -- case RTL8712_RF_1T2R: -- default: -- fwpriv->rf_config = RTL8712_RFC_1T2R; -- } -- fwpriv->mp_mode = (regpriv->mp_mode == 1); -- /* 0:off 1:on 2:auto */ -- fwpriv->vcs_type = regpriv->vrtl_carrier_sense; -- fwpriv->vcs_mode = regpriv->vcs_type; /* 1:RTS/CTS 2:CTS to self */ -- /* default enable turbo_mode */ -- fwpriv->turbo_mode = (regpriv->wifi_test != 1); -- fwpriv->low_power_mode = regpriv->low_power; --} -- --static void update_fwhdr(struct fw_hdr *pfwhdr, const u8 *pmappedfw) --{ -- pfwhdr->signature = le16_to_cpu(*(__le16 *)pmappedfw); -- pfwhdr->version = le16_to_cpu(*(__le16 *)(pmappedfw + 2)); -- /* define the size of boot loader */ -- pfwhdr->dmem_size = le32_to_cpu(*(__le32 *)(pmappedfw + 4)); -- /* define the size of FW in IMEM */ -- pfwhdr->img_IMEM_size = le32_to_cpu(*(__le32 *)(pmappedfw + 8)); -- /* define the size of FW in SRAM */ -- pfwhdr->img_SRAM_size = le32_to_cpu(*(__le32 *)(pmappedfw + 12)); -- /* define the size of DMEM variable */ -- pfwhdr->fw_priv_sz = le32_to_cpu(*(__le32 *)(pmappedfw + 16)); --} -- --static u8 chk_fwhdr(struct fw_hdr *pfwhdr, u32 ulfilelength) --{ -- u32 fwhdrsz, fw_sz; -- -- /* check signature */ -- if ((pfwhdr->signature != 0x8712) && (pfwhdr->signature != 0x8192)) -- return _FAIL; -- /* check fw_priv_sze & sizeof(struct fw_priv) */ -- if (pfwhdr->fw_priv_sz != sizeof(struct fw_priv)) -- return _FAIL; -- /* check fw_sz & image_fw_sz */ -- fwhdrsz = offsetof(struct fw_hdr, fwpriv) + pfwhdr->fw_priv_sz; -- fw_sz = fwhdrsz + pfwhdr->img_IMEM_size + pfwhdr->img_SRAM_size + -- pfwhdr->dmem_size; -- if (fw_sz != ulfilelength) -- return _FAIL; -- return _SUCCESS; --} -- --static u8 rtl8712_dl_fw(struct _adapter *adapter) --{ -- sint i; -- u8 tmp8, tmp8_a; -- u16 tmp16; -- u32 maxlen = 0; /* for compare usage */ -- uint dump_imem_sz, imem_sz, dump_emem_sz, emem_sz; /* max = 49152; */ -- struct fw_hdr fwhdr; -- u32 ulfilelength; /* FW file size */ -- const u8 *mappedfw = NULL; -- u8 *tmpchar = NULL, *payload, *ptr; -- struct tx_desc *txdesc; -- u32 txdscp_sz = sizeof(struct tx_desc); -- u8 ret = _FAIL; -- -- ulfilelength = rtl871x_open_fw(adapter, &mappedfw); -- if (mappedfw && (ulfilelength > 0)) { -- update_fwhdr(&fwhdr, mappedfw); -- if (chk_fwhdr(&fwhdr, ulfilelength) == _FAIL) -- return ret; -- fill_fwpriv(adapter, &fwhdr.fwpriv); -- /* firmware check ok */ -- maxlen = (fwhdr.img_IMEM_size > fwhdr.img_SRAM_size) ? -- fwhdr.img_IMEM_size : fwhdr.img_SRAM_size; -- maxlen += txdscp_sz; -- tmpchar = kmalloc(maxlen + FWBUFF_ALIGN_SZ, GFP_KERNEL); -- if (!tmpchar) -- return ret; -- -- txdesc = (struct tx_desc *)(tmpchar + FWBUFF_ALIGN_SZ - -- ((addr_t)(tmpchar) & (FWBUFF_ALIGN_SZ - 1))); -- payload = (u8 *)(txdesc) + txdscp_sz; -- ptr = (u8 *)mappedfw + offsetof(struct fw_hdr, fwpriv) + -- fwhdr.fw_priv_sz; -- /* Download FirmWare */ -- /* 1. determine IMEM code size and Load IMEM Code Section */ -- imem_sz = fwhdr.img_IMEM_size; -- do { -- memset(txdesc, 0, TXDESC_SIZE); -- if (imem_sz > MAX_DUMP_FWSZ/*49152*/) { -- dump_imem_sz = MAX_DUMP_FWSZ; -- } else { -- dump_imem_sz = imem_sz; -- txdesc->txdw0 |= cpu_to_le32(BIT(28)); -- } -- txdesc->txdw0 |= cpu_to_le32(dump_imem_sz & -- 0x0000ffff); -- memcpy(payload, ptr, dump_imem_sz); -- r8712_write_mem(adapter, RTL8712_DMA_VOQ, -- dump_imem_sz + TXDESC_SIZE, -- (u8 *)txdesc); -- ptr += dump_imem_sz; -- imem_sz -= dump_imem_sz; -- } while (imem_sz > 0); -- i = 10; -- tmp16 = r8712_read16(adapter, TCR); -- while (((tmp16 & _IMEM_CODE_DONE) == 0) && (i > 0)) { -- usleep_range(10, 1000); -- tmp16 = r8712_read16(adapter, TCR); -- i--; -- } -- if (i == 0 || (tmp16 & _IMEM_CHK_RPT) == 0) -- goto exit_fail; -- -- /* 2.Download EMEM code size and Load EMEM Code Section */ -- emem_sz = fwhdr.img_SRAM_size; -- do { -- memset(txdesc, 0, TXDESC_SIZE); -- if (emem_sz > MAX_DUMP_FWSZ) { /* max=48k */ -- dump_emem_sz = MAX_DUMP_FWSZ; -- } else { -- dump_emem_sz = emem_sz; -- txdesc->txdw0 |= cpu_to_le32(BIT(28)); -- } -- txdesc->txdw0 |= cpu_to_le32(dump_emem_sz & -- 0x0000ffff); -- memcpy(payload, ptr, dump_emem_sz); -- r8712_write_mem(adapter, RTL8712_DMA_VOQ, -- dump_emem_sz + TXDESC_SIZE, -- (u8 *)txdesc); -- ptr += dump_emem_sz; -- emem_sz -= dump_emem_sz; -- } while (emem_sz > 0); -- i = 5; -- tmp16 = r8712_read16(adapter, TCR); -- while (((tmp16 & _EMEM_CODE_DONE) == 0) && (i > 0)) { -- usleep_range(10, 1000); -- tmp16 = r8712_read16(adapter, TCR); -- i--; -- } -- if (i == 0 || (tmp16 & _EMEM_CHK_RPT) == 0) -- goto exit_fail; -- -- /* 3.Enable CPU */ -- tmp8 = r8712_read8(adapter, SYS_CLKR); -- r8712_write8(adapter, SYS_CLKR, tmp8 | BIT(2)); -- tmp8_a = r8712_read8(adapter, SYS_CLKR); -- if (tmp8_a != (tmp8 | BIT(2))) -- goto exit_fail; -- -- tmp8 = r8712_read8(adapter, SYS_FUNC_EN + 1); -- r8712_write8(adapter, SYS_FUNC_EN + 1, tmp8 | BIT(2)); -- tmp8_a = r8712_read8(adapter, SYS_FUNC_EN + 1); -- if (tmp8_a != (tmp8 | BIT(2))) -- goto exit_fail; -- -- r8712_read32(adapter, TCR); -- -- /* 4.polling IMEM Ready */ -- i = 100; -- tmp16 = r8712_read16(adapter, TCR); -- while (((tmp16 & _IMEM_RDY) == 0) && (i > 0)) { -- msleep(20); -- tmp16 = r8712_read16(adapter, TCR); -- i--; -- } -- if (i == 0) { -- r8712_write16(adapter, 0x10250348, 0xc000); -- r8712_write16(adapter, 0x10250348, 0xc001); -- r8712_write16(adapter, 0x10250348, 0x2000); -- r8712_write16(adapter, 0x10250348, 0x2001); -- r8712_write16(adapter, 0x10250348, 0x2002); -- r8712_write16(adapter, 0x10250348, 0x2003); -- goto exit_fail; -- } -- /* 5.Download DMEM code size and Load EMEM Code Section */ -- memset(txdesc, 0, TXDESC_SIZE); -- txdesc->txdw0 |= cpu_to_le32(fwhdr.fw_priv_sz & 0x0000ffff); -- txdesc->txdw0 |= cpu_to_le32(BIT(28)); -- memcpy(payload, &fwhdr.fwpriv, fwhdr.fw_priv_sz); -- r8712_write_mem(adapter, RTL8712_DMA_VOQ, -- fwhdr.fw_priv_sz + TXDESC_SIZE, (u8 *)txdesc); -- -- /* polling dmem code done */ -- i = 100; -- tmp16 = r8712_read16(adapter, TCR); -- while (((tmp16 & _DMEM_CODE_DONE) == 0) && (i > 0)) { -- msleep(20); -- tmp16 = r8712_read16(adapter, TCR); -- i--; -- } -- if (i == 0) -- goto exit_fail; -- -- tmp8 = r8712_read8(adapter, 0x1025000A); -- if (tmp8 & BIT(4)) /* When boot from EEPROM, -- * & FW need more time to read EEPROM -- */ -- i = 60; -- else /* boot from EFUSE */ -- i = 30; -- tmp16 = r8712_read16(adapter, TCR); -- while (((tmp16 & _FWRDY) == 0) && (i > 0)) { -- msleep(100); -- tmp16 = r8712_read16(adapter, TCR); -- i--; -- } -- if (i == 0) -- goto exit_fail; -- } else { -- goto exit_fail; -- } -- ret = _SUCCESS; -- --exit_fail: -- kfree(tmpchar); -- return ret; --} -- --uint rtl8712_hal_init(struct _adapter *padapter) --{ -- u32 val32; -- int i; -- -- /* r8712 firmware download */ -- if (rtl8712_dl_fw(padapter) != _SUCCESS) -- return _FAIL; -- -- netdev_info(padapter->pnetdev, "1 RCR=0x%x\n", -- r8712_read32(padapter, RCR)); -- val32 = r8712_read32(padapter, RCR); -- r8712_write32(padapter, RCR, (val32 | BIT(26))); /* Enable RX TCP -- * Checksum offload -- */ -- netdev_info(padapter->pnetdev, "2 RCR=0x%x\n", -- r8712_read32(padapter, RCR)); -- val32 = r8712_read32(padapter, RCR); -- r8712_write32(padapter, RCR, (val32 | BIT(25))); /* Append PHY status */ -- val32 = r8712_read32(padapter, 0x10250040); -- r8712_write32(padapter, 0x10250040, (val32 & 0x00FFFFFF)); -- /* for usb rx aggregation */ -- r8712_write8(padapter, 0x102500B5, r8712_read8(padapter, 0x102500B5) | -- BIT(0)); /* page = 128bytes */ -- r8712_write8(padapter, 0x102500BD, r8712_read8(padapter, 0x102500BD) | -- BIT(7)); /* enable usb rx aggregation */ -- r8712_write8(padapter, 0x102500D9, 1); /* TH=1 => means that invalidate -- * usb rx aggregation -- */ -- r8712_write8(padapter, 0x1025FE5B, 0x04); /* 1.7ms/4 */ -- /* Fix the RX FIFO issue(USB error) */ -- r8712_write8(padapter, 0x1025fe5C, r8712_read8(padapter, 0x1025fe5C) -- | BIT(7)); -- for (i = 0; i < ETH_ALEN; i++) -- padapter->eeprompriv.mac_addr[i] = r8712_read8(padapter, -- MACID + i); -- return _SUCCESS; --} -- --uint rtl8712_hal_deinit(struct _adapter *padapter) --{ -- r8712_write8(padapter, RF_CTRL, 0x00); -- /* Turn off BB */ -- msleep(20); -- /* Turn off MAC */ -- r8712_write8(padapter, SYS_CLKR + 1, 0x38); /* Switch Control Path */ -- r8712_write8(padapter, SYS_FUNC_EN + 1, 0x70); -- r8712_write8(padapter, PMC_FSM, 0x06); /* Enable Loader Data Keep */ -- r8712_write8(padapter, SYS_ISO_CTRL, 0xF9); /* Isolation signals from -- * CORE, PLL -- */ -- r8712_write8(padapter, SYS_ISO_CTRL + 1, 0xe8); /* Enable EFUSE 1.2V */ -- r8712_write8(padapter, AFE_PLL_CTRL, 0x00); /* Disable AFE PLL. */ -- r8712_write8(padapter, LDOA15_CTRL, 0x54); /* Disable A15V */ -- r8712_write8(padapter, SYS_FUNC_EN + 1, 0x50); /* Disable E-Fuse 1.2V */ -- r8712_write8(padapter, LDOV12D_CTRL, 0x24); /* Disable LDO12(for CE) */ -- r8712_write8(padapter, AFE_MISC, 0x30); /* Disable AFE BG&MB */ -- /* Option for Disable 1.6V LDO. */ -- r8712_write8(padapter, SPS0_CTRL, 0x56); /* Disable 1.6V LDO */ -- r8712_write8(padapter, SPS0_CTRL + 1, 0x43); /* Set SW PFM */ -- return _SUCCESS; --} -- --uint rtl871x_hal_init(struct _adapter *padapter) --{ -- padapter->hw_init_completed = false; -- if (!padapter->halpriv.hal_bus_init) -- return _FAIL; -- if (padapter->halpriv.hal_bus_init(padapter) != _SUCCESS) -- return _FAIL; -- if (rtl8712_hal_init(padapter) == _SUCCESS) { -- padapter->hw_init_completed = true; -- } else { -- padapter->hw_init_completed = false; -- return _FAIL; -- } -- return _SUCCESS; --} -diff --git a/drivers/staging/rtl8712/ieee80211.c b/drivers/staging/rtl8712/ieee80211.c -deleted file mode 100644 -index 7d8f1a29d18a90..00000000000000 ---- a/drivers/staging/rtl8712/ieee80211.c -+++ /dev/null -@@ -1,415 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * ieee80211.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE . -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _IEEE80211_C -- --#include "drv_types.h" --#include "ieee80211.h" --#include "wifi.h" --#include "osdep_service.h" --#include "wlan_bssdef.h" -- --static const u8 WPA_OUI_TYPE[] = {0x00, 0x50, 0xf2, 1}; --static const u8 WPA_CIPHER_SUITE_NONE[] = {0x00, 0x50, 0xf2, 0}; --static const u8 WPA_CIPHER_SUITE_WEP40[] = {0x00, 0x50, 0xf2, 1}; --static const u8 WPA_CIPHER_SUITE_TKIP[] = {0x00, 0x50, 0xf2, 2}; --static const u8 WPA_CIPHER_SUITE_CCMP[] = {0x00, 0x50, 0xf2, 4}; --static const u8 WPA_CIPHER_SUITE_WEP104[] = {0x00, 0x50, 0xf2, 5}; -- --static const u8 RSN_CIPHER_SUITE_NONE[] = {0x00, 0x0f, 0xac, 0}; --static const u8 RSN_CIPHER_SUITE_WEP40[] = {0x00, 0x0f, 0xac, 1}; --static const u8 RSN_CIPHER_SUITE_TKIP[] = {0x00, 0x0f, 0xac, 2}; --static const u8 RSN_CIPHER_SUITE_CCMP[] = {0x00, 0x0f, 0xac, 4}; --static const u8 RSN_CIPHER_SUITE_WEP104[] = {0x00, 0x0f, 0xac, 5}; -- --/*----------------------------------------------------------- -- * for adhoc-master to generate ie and provide supported-rate to fw -- *----------------------------------------------------------- -- */ -- --static u8 WIFI_CCKRATES[] = { -- (IEEE80211_CCK_RATE_1MB | IEEE80211_BASIC_RATE_MASK), -- (IEEE80211_CCK_RATE_2MB | IEEE80211_BASIC_RATE_MASK), -- (IEEE80211_CCK_RATE_5MB | IEEE80211_BASIC_RATE_MASK), -- (IEEE80211_CCK_RATE_11MB | IEEE80211_BASIC_RATE_MASK) --}; -- --static u8 WIFI_OFDMRATES[] = { -- (IEEE80211_OFDM_RATE_6MB), -- (IEEE80211_OFDM_RATE_9MB), -- (IEEE80211_OFDM_RATE_12MB), -- (IEEE80211_OFDM_RATE_18MB), -- (IEEE80211_OFDM_RATE_24MB), -- (IEEE80211_OFDM_RATE_36MB), -- (IEEE80211_OFDM_RATE_48MB), -- (IEEE80211_OFDM_RATE_54MB) --}; -- --uint r8712_is_cckrates_included(u8 *rate) --{ -- u32 i = 0; -- -- while (rate[i] != 0) { -- if ((((rate[i]) & 0x7f) == 2) || (((rate[i]) & 0x7f) == 4) || -- (((rate[i]) & 0x7f) == 11) || (((rate[i]) & 0x7f) == 22)) -- return true; -- i++; -- } -- return false; --} -- --uint r8712_is_cckratesonly_included(u8 *rate) --{ -- u32 i = 0; -- -- while (rate[i] != 0) { -- if ((((rate[i]) & 0x7f) != 2) && (((rate[i]) & 0x7f) != 4) && -- (((rate[i]) & 0x7f) != 11) && (((rate[i]) & 0x7f) != 22)) -- return false; -- i++; -- } -- return true; --} -- --/* r8712_set_ie will update frame length */ --u8 *r8712_set_ie(u8 *pbuf, sint index, uint len, u8 *source, uint *frlen) --{ -- *pbuf = (u8)index; -- *(pbuf + 1) = (u8)len; -- if (len > 0) -- memcpy((void *)(pbuf + 2), (void *)source, len); -- *frlen = *frlen + (len + 2); -- return pbuf + len + 2; --} -- --/* --------------------------------------------------------------------------- -- * index: the information element id index, limit is the limit for search -- * --------------------------------------------------------------------------- -- */ --u8 *r8712_get_ie(u8 *pbuf, sint index, uint *len, sint limit) --{ -- sint tmp, i; -- u8 *p; -- -- if (limit < 1) -- return NULL; -- p = pbuf; -- i = 0; -- *len = 0; -- while (1) { -- if (*p == index) { -- *len = *(p + 1); -- return p; -- } -- tmp = *(p + 1); -- p += (tmp + 2); -- i += (tmp + 2); -- if (i >= limit) -- break; -- } -- return NULL; --} -- --static void set_supported_rate(u8 *rates, uint mode) --{ -- memset(rates, 0, NDIS_802_11_LENGTH_RATES_EX); -- switch (mode) { -- case WIRELESS_11B: -- memcpy(rates, WIFI_CCKRATES, IEEE80211_CCK_RATE_LEN); -- break; -- case WIRELESS_11G: -- case WIRELESS_11A: -- memcpy(rates, WIFI_OFDMRATES, IEEE80211_NUM_OFDM_RATESLEN); -- break; -- case WIRELESS_11BG: -- memcpy(rates, WIFI_CCKRATES, IEEE80211_CCK_RATE_LEN); -- memcpy(rates + IEEE80211_CCK_RATE_LEN, WIFI_OFDMRATES, -- IEEE80211_NUM_OFDM_RATESLEN); -- break; -- } --} -- --static uint r8712_get_rateset_len(u8 *rateset) --{ -- uint i = 0; -- -- while (1) { -- if ((rateset[i]) == 0) -- break; -- if (i > 12) -- break; -- i++; -- } -- return i; --} -- --int r8712_generate_ie(struct registry_priv *registrypriv) --{ -- int rate_len; -- uint sz = 0; -- struct wlan_bssid_ex *dev_network = ®istrypriv->dev_network; -- u8 *ie = dev_network->IEs; -- u16 beacon_period = (u16)dev_network->Configuration.BeaconPeriod; -- -- /*timestamp will be inserted by hardware*/ -- sz += 8; -- ie += sz; -- /*beacon interval : 2bytes*/ -- *(__le16 *)ie = cpu_to_le16(beacon_period); -- sz += 2; -- ie += 2; -- /*capability info*/ -- *(u16 *)ie = 0; -- *(__le16 *)ie |= cpu_to_le16(WLAN_CAPABILITY_IBSS); -- if (registrypriv->preamble == PREAMBLE_SHORT) -- *(__le16 *)ie |= cpu_to_le16(WLAN_CAPABILITY_SHORT_PREAMBLE); -- if (dev_network->Privacy) -- *(__le16 *)ie |= cpu_to_le16(WLAN_CAPABILITY_PRIVACY); -- sz += 2; -- ie += 2; -- /*SSID*/ -- ie = r8712_set_ie(ie, WLAN_EID_SSID, dev_network->Ssid.SsidLength, -- dev_network->Ssid.Ssid, &sz); -- /*supported rates*/ -- set_supported_rate(dev_network->rates, registrypriv->wireless_mode); -- rate_len = r8712_get_rateset_len(dev_network->rates); -- if (rate_len > 8) { -- ie = r8712_set_ie(ie, WLAN_EID_SUPP_RATES, 8, -- dev_network->rates, &sz); -- ie = r8712_set_ie(ie, WLAN_EID_EXT_SUPP_RATES, (rate_len - 8), -- (dev_network->rates + 8), &sz); -- } else { -- ie = r8712_set_ie(ie, WLAN_EID_SUPP_RATES, -- rate_len, dev_network->rates, &sz); -- } -- /*DS parameter set*/ -- ie = r8712_set_ie(ie, WLAN_EID_DS_PARAMS, 1, -- (u8 *)&dev_network->Configuration.DSConfig, &sz); -- /*IBSS Parameter Set*/ -- ie = r8712_set_ie(ie, WLAN_EID_IBSS_PARAMS, 2, -- (u8 *)&dev_network->Configuration.ATIMWindow, &sz); -- return sz; --} -- --unsigned char *r8712_get_wpa_ie(unsigned char *ie, uint *wpa_ie_len, int limit) --{ -- u32 len; -- u16 val16; -- unsigned char wpa_oui_type[] = {0x00, 0x50, 0xf2, 0x01}; -- u8 *buf = ie; -- -- while (1) { -- buf = r8712_get_ie(buf, _WPA_IE_ID_, &len, limit); -- if (buf) { -- /*check if oui matches...*/ -- if (memcmp((buf + 2), wpa_oui_type, -- sizeof(wpa_oui_type))) -- goto check_next_ie; -- /*check version...*/ -- memcpy((u8 *)&val16, (buf + 6), sizeof(val16)); -- le16_to_cpus(&val16); -- if (val16 != 0x0001) -- goto check_next_ie; -- *wpa_ie_len = *(buf + 1); -- return buf; -- } -- *wpa_ie_len = 0; -- return NULL; --check_next_ie: -- limit = limit - (buf - ie) - 2 - len; -- if (limit <= 0) -- break; -- buf += (2 + len); -- } -- *wpa_ie_len = 0; -- return NULL; --} -- --unsigned char *r8712_get_wpa2_ie(unsigned char *pie, uint *rsn_ie_len, -- int limit) --{ -- return r8712_get_ie(pie, _WPA2_IE_ID_, rsn_ie_len, limit); --} -- --static int r8712_get_wpa_cipher_suite(u8 *s) --{ -- if (!memcmp(s, (void *)WPA_CIPHER_SUITE_NONE, WPA_SELECTOR_LEN)) -- return WPA_CIPHER_NONE; -- if (!memcmp(s, (void *)WPA_CIPHER_SUITE_WEP40, WPA_SELECTOR_LEN)) -- return WPA_CIPHER_WEP40; -- if (!memcmp(s, (void *)WPA_CIPHER_SUITE_TKIP, WPA_SELECTOR_LEN)) -- return WPA_CIPHER_TKIP; -- if (!memcmp(s, (void *)WPA_CIPHER_SUITE_CCMP, WPA_SELECTOR_LEN)) -- return WPA_CIPHER_CCMP; -- if (!memcmp(s, (void *)WPA_CIPHER_SUITE_WEP104, WPA_SELECTOR_LEN)) -- return WPA_CIPHER_WEP104; -- return 0; --} -- --static int r8712_get_wpa2_cipher_suite(u8 *s) --{ -- if (!memcmp(s, (void *)RSN_CIPHER_SUITE_NONE, RSN_SELECTOR_LEN)) -- return WPA_CIPHER_NONE; -- if (!memcmp(s, (void *)RSN_CIPHER_SUITE_WEP40, RSN_SELECTOR_LEN)) -- return WPA_CIPHER_WEP40; -- if (!memcmp(s, (void *)RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN)) -- return WPA_CIPHER_TKIP; -- if (!memcmp(s, (void *)RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN)) -- return WPA_CIPHER_CCMP; -- if (!memcmp(s, (void *)RSN_CIPHER_SUITE_WEP104, RSN_SELECTOR_LEN)) -- return WPA_CIPHER_WEP104; -- return 0; --} -- --int r8712_parse_wpa_ie(u8 *wpa_ie, int wpa_ie_len, int *group_cipher, -- int *pairwise_cipher) --{ -- int i; -- int left, count; -- u8 *pos; -- -- if (wpa_ie_len <= 0) { -- /* No WPA IE - fail silently */ -- return -EINVAL; -- } -- if ((*wpa_ie != _WPA_IE_ID_) || -- (*(wpa_ie + 1) != (u8)(wpa_ie_len - 2)) || -- (memcmp(wpa_ie + 2, (void *)WPA_OUI_TYPE, WPA_SELECTOR_LEN))) -- return -EINVAL; -- pos = wpa_ie; -- pos += 8; -- left = wpa_ie_len - 8; -- /*group_cipher*/ -- if (left >= WPA_SELECTOR_LEN) { -- *group_cipher = r8712_get_wpa_cipher_suite(pos); -- pos += WPA_SELECTOR_LEN; -- left -= WPA_SELECTOR_LEN; -- } else if (left > 0) { -- return -EINVAL; -- } -- /*pairwise_cipher*/ -- if (left >= 2) { -- count = le16_to_cpu(*(__le16 *)pos); -- pos += 2; -- left -= 2; -- if (count == 0 || left < count * WPA_SELECTOR_LEN) -- return -EINVAL; -- for (i = 0; i < count; i++) { -- *pairwise_cipher |= r8712_get_wpa_cipher_suite(pos); -- pos += WPA_SELECTOR_LEN; -- left -= WPA_SELECTOR_LEN; -- } -- } else if (left == 1) { -- return -EINVAL; -- } -- return 0; --} -- --int r8712_parse_wpa2_ie(u8 *rsn_ie, int rsn_ie_len, int *group_cipher, -- int *pairwise_cipher) --{ -- int i; -- int left, count; -- u8 *pos; -- -- if (rsn_ie_len <= 0) { -- /* No RSN IE - fail silently */ -- return -EINVAL; -- } -- if ((*rsn_ie != _WPA2_IE_ID_) || -- (*(rsn_ie + 1) != (u8)(rsn_ie_len - 2))) -- return -EINVAL; -- pos = rsn_ie; -- pos += 4; -- left = rsn_ie_len - 4; -- /*group_cipher*/ -- if (left >= RSN_SELECTOR_LEN) { -- *group_cipher = r8712_get_wpa2_cipher_suite(pos); -- pos += RSN_SELECTOR_LEN; -- left -= RSN_SELECTOR_LEN; -- } else if (left > 0) { -- return -EINVAL; -- } -- /*pairwise_cipher*/ -- if (left >= 2) { -- count = le16_to_cpu(*(__le16 *)pos); -- pos += 2; -- left -= 2; -- if (count == 0 || left < count * RSN_SELECTOR_LEN) -- return -EINVAL; -- for (i = 0; i < count; i++) { -- *pairwise_cipher |= r8712_get_wpa2_cipher_suite(pos); -- pos += RSN_SELECTOR_LEN; -- left -= RSN_SELECTOR_LEN; -- } -- } else if (left == 1) { -- return -EINVAL; -- } -- return 0; --} -- --int r8712_get_sec_ie(u8 *in_ie, uint in_len, u8 *rsn_ie, u16 *rsn_len, -- u8 *wpa_ie, u16 *wpa_len) --{ -- u8 authmode; -- u8 wpa_oui[4] = {0x0, 0x50, 0xf2, 0x01}; -- uint cnt; -- -- /*Search required WPA or WPA2 IE and copy to sec_ie[ ]*/ -- cnt = _TIMESTAMP_ + _BEACON_ITERVAL_ + _CAPABILITY_; -- while (cnt < in_len) { -- authmode = in_ie[cnt]; -- if ((authmode == _WPA_IE_ID_) && -- (!memcmp(&in_ie[cnt + 2], &wpa_oui[0], 4))) { -- memcpy(wpa_ie, &in_ie[cnt], in_ie[cnt + 1] + 2); -- *wpa_len = in_ie[cnt + 1] + 2; -- cnt += in_ie[cnt + 1] + 2; /*get next */ -- } else { -- if (authmode == _WPA2_IE_ID_) { -- memcpy(rsn_ie, &in_ie[cnt], -- in_ie[cnt + 1] + 2); -- *rsn_len = in_ie[cnt + 1] + 2; -- cnt += in_ie[cnt + 1] + 2; /*get next*/ -- } else { -- cnt += in_ie[cnt + 1] + 2; /*get next*/ -- } -- } -- } -- return *rsn_len + *wpa_len; --} -- --int r8712_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen) --{ -- int match; -- uint cnt; -- u8 eid, wps_oui[4] = {0x0, 0x50, 0xf2, 0x04}; -- -- cnt = 12; -- match = false; -- while (cnt < in_len) { -- eid = in_ie[cnt]; -- if ((eid == _WPA_IE_ID_) && -- (!memcmp(&in_ie[cnt + 2], wps_oui, 4))) { -- memcpy(wps_ie, &in_ie[cnt], in_ie[cnt + 1] + 2); -- *wps_ielen = in_ie[cnt + 1] + 2; -- cnt += in_ie[cnt + 1] + 2; -- match = true; -- break; -- } -- cnt += in_ie[cnt + 1] + 2; /* goto next */ -- } -- return match; --} -diff --git a/drivers/staging/rtl8712/ieee80211.h b/drivers/staging/rtl8712/ieee80211.h -deleted file mode 100644 -index 65ceaca9b51ea7..00000000000000 ---- a/drivers/staging/rtl8712/ieee80211.h -+++ /dev/null -@@ -1,165 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __IEEE80211_H --#define __IEEE80211_H -- --#include -- --#define IEEE_CMD_SET_WPA_PARAM 1 --#define IEEE_CMD_SET_WPA_IE 2 --#define IEEE_CMD_SET_ENCRYPTION 3 --#define IEEE_CMD_MLME 4 -- --#define IEEE_PARAM_WPA_ENABLED 1 --#define IEEE_PARAM_TKIP_COUNTERMEASURES 2 --#define IEEE_PARAM_DROP_UNENCRYPTED 3 --#define IEEE_PARAM_PRIVACY_INVOKED 4 --#define IEEE_PARAM_AUTH_ALGS 5 --#define IEEE_PARAM_IEEE_802_1X 6 --#define IEEE_PARAM_WPAX_SELECT 7 -- --#define AUTH_ALG_OPEN_SYSTEM 0x1 --#define AUTH_ALG_SHARED_KEY 0x2 --#define AUTH_ALG_LEAP 0x00000004 -- --#define IEEE_MLME_STA_DEAUTH 1 --#define IEEE_MLME_STA_DISASSOC 2 -- --#define IEEE_CRYPT_ERR_UNKNOWN_ALG 2 --#define IEEE_CRYPT_ERR_UNKNOWN_ADDR 3 --#define IEEE_CRYPT_ERR_CRYPT_INIT_FAILED 4 --#define IEEE_CRYPT_ERR_KEY_SET_FAILED 5 --#define IEEE_CRYPT_ERR_TX_KEY_SET_FAILED 6 --#define IEEE_CRYPT_ERR_CARD_CONF_FAILED 7 -- --#define IEEE_CRYPT_ALG_NAME_LEN 16 -- --#define WPA_CIPHER_NONE BIT(0) --#define WPA_CIPHER_WEP40 BIT(1) --#define WPA_CIPHER_WEP104 BIT(2) --#define WPA_CIPHER_TKIP BIT(3) --#define WPA_CIPHER_CCMP BIT(4) -- --#define WPA_SELECTOR_LEN 4 --#define RSN_HEADER_LEN 4 -- --#define RSN_SELECTOR_LEN 4 -- --enum NETWORK_TYPE { -- WIRELESS_INVALID = 0, -- WIRELESS_11B = 1, -- WIRELESS_11G = 2, -- WIRELESS_11BG = (WIRELESS_11B | WIRELESS_11G), -- WIRELESS_11A = 4, -- WIRELESS_11N = 8, -- WIRELESS_11GN = (WIRELESS_11G | WIRELESS_11N), -- WIRELESS_11BGN = (WIRELESS_11B | WIRELESS_11G | WIRELESS_11N), --}; -- --struct ieee_param { -- u32 cmd; -- u8 sta_addr[ETH_ALEN]; -- union { -- struct { -- u8 name; -- u32 value; -- } wpa_param; -- struct { -- u32 len; -- u8 reserved[32]; -- u8 data[]; -- } wpa_ie; -- struct { -- int command; -- int reason_code; -- } mlme; -- struct { -- u8 alg[IEEE_CRYPT_ALG_NAME_LEN]; -- u8 set_tx; -- u32 err; -- u8 idx; -- u8 seq[8]; /* sequence counter (set: RX, get: TX) */ -- u16 key_len; -- u8 key[]; -- } crypt; -- } u; --}; -- --#define MIN_FRAG_THRESHOLD 256U --#define MAX_FRAG_THRESHOLD 2346U -- --/* QoS,QOS */ --#define NORMAL_ACK 0 -- --/* IEEE 802.11 defines */ -- --#define P80211_OUI_LEN 3 -- --struct ieee80211_snap_hdr { -- u8 dsap; /* always 0xAA */ -- u8 ssap; /* always 0xAA */ -- u8 ctrl; /* always 0x03 */ -- u8 oui[P80211_OUI_LEN]; /* organizational universal id */ --} __packed; -- --#define SNAP_SIZE sizeof(struct ieee80211_snap_hdr) -- --#define IEEE80211_CCK_RATE_LEN 4 --#define IEEE80211_NUM_OFDM_RATESLEN 8 -- --#define IEEE80211_CCK_RATE_1MB 0x02 --#define IEEE80211_CCK_RATE_2MB 0x04 --#define IEEE80211_CCK_RATE_5MB 0x0B --#define IEEE80211_CCK_RATE_11MB 0x16 --#define IEEE80211_OFDM_RATE_6MB 0x0C --#define IEEE80211_OFDM_RATE_9MB 0x12 --#define IEEE80211_OFDM_RATE_12MB 0x18 --#define IEEE80211_OFDM_RATE_18MB 0x24 --#define IEEE80211_OFDM_RATE_24MB 0x30 --#define IEEE80211_OFDM_RATE_36MB 0x48 --#define IEEE80211_OFDM_RATE_48MB 0x60 --#define IEEE80211_OFDM_RATE_54MB 0x6C --#define IEEE80211_BASIC_RATE_MASK 0x80 -- --#define WEP_KEYS 4 -- --/* MAX_RATES_LENGTH needs to be 12. The spec says 8, and many APs -- * only use 8, and then use extended rates for the remaining supported -- * rates. Other APs, however, stick all of their supported rates on the -- * main rates information element... -- */ --#define MAX_RATES_LENGTH ((u8)12) --#define MAX_WPA_IE_LEN 128 -- --struct registry_priv; -- --u8 *r8712_set_ie(u8 *pbuf, sint index, uint len, u8 *source, uint *frlen); --u8 *r8712_get_ie(u8 *pbuf, sint index, uint *len, sint limit); --unsigned char *r8712_get_wpa_ie(unsigned char *pie, uint *rsn_ie_len, -- int limit); --unsigned char *r8712_get_wpa2_ie(unsigned char *pie, uint *rsn_ie_len, -- int limit); --int r8712_parse_wpa_ie(u8 *wpa_ie, int wpa_ie_len, int *group_cipher, -- int *pairwise_cipher); --int r8712_parse_wpa2_ie(u8 *wpa_ie, int wpa_ie_len, int *group_cipher, -- int *pairwise_cipher); --int r8712_get_sec_ie(u8 *in_ie, uint in_len, u8 *rsn_ie, u16 *rsn_len, -- u8 *wpa_ie, u16 *wpa_len); --int r8712_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen); --int r8712_generate_ie(struct registry_priv *pregistrypriv); --uint r8712_is_cckrates_included(u8 *rate); --uint r8712_is_cckratesonly_included(u8 *rate); -- --#endif /* IEEE80211_H */ -- -diff --git a/drivers/staging/rtl8712/mlme_linux.c b/drivers/staging/rtl8712/mlme_linux.c -deleted file mode 100644 -index b9f5104f3bf75a..00000000000000 ---- a/drivers/staging/rtl8712/mlme_linux.c -+++ /dev/null -@@ -1,160 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * mlme_linux.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE . -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _MLME_OSDEP_C_ -- --#include "osdep_service.h" --#include "drv_types.h" --#include "mlme_osdep.h" -- --static void sitesurvey_ctrl_handler(struct timer_list *t) --{ -- struct _adapter *adapter = -- from_timer(adapter, t, -- mlmepriv.sitesurveyctrl.sitesurvey_ctrl_timer); -- -- _r8712_sitesurvey_ctrl_handler(adapter); -- mod_timer(&adapter->mlmepriv.sitesurveyctrl.sitesurvey_ctrl_timer, -- jiffies + msecs_to_jiffies(3000)); --} -- --static void join_timeout_handler (struct timer_list *t) --{ -- struct _adapter *adapter = -- from_timer(adapter, t, mlmepriv.assoc_timer); -- -- _r8712_join_timeout_handler(adapter); --} -- --static void _scan_timeout_handler (struct timer_list *t) --{ -- struct _adapter *adapter = -- from_timer(adapter, t, mlmepriv.scan_to_timer); -- -- r8712_scan_timeout_handler(adapter); --} -- --static void dhcp_timeout_handler (struct timer_list *t) --{ -- struct _adapter *adapter = -- from_timer(adapter, t, mlmepriv.dhcp_timer); -- -- _r8712_dhcp_timeout_handler(adapter); --} -- --static void wdg_timeout_handler (struct timer_list *t) --{ -- struct _adapter *adapter = -- from_timer(adapter, t, mlmepriv.wdg_timer); -- -- r8712_wdg_wk_cmd(adapter); -- -- mod_timer(&adapter->mlmepriv.wdg_timer, -- jiffies + msecs_to_jiffies(2000)); --} -- --void r8712_init_mlme_timer(struct _adapter *adapter) --{ -- struct mlme_priv *mlmepriv = &adapter->mlmepriv; -- -- timer_setup(&mlmepriv->assoc_timer, join_timeout_handler, 0); -- timer_setup(&mlmepriv->sitesurveyctrl.sitesurvey_ctrl_timer, -- sitesurvey_ctrl_handler, 0); -- timer_setup(&mlmepriv->scan_to_timer, _scan_timeout_handler, 0); -- timer_setup(&mlmepriv->dhcp_timer, dhcp_timeout_handler, 0); -- timer_setup(&mlmepriv->wdg_timer, wdg_timeout_handler, 0); --} -- --void r8712_os_indicate_connect(struct _adapter *adapter) --{ -- r8712_indicate_wx_assoc_event(adapter); -- netif_carrier_on(adapter->pnetdev); --} -- --static struct RT_PMKID_LIST backupPMKIDList[NUM_PMKID_CACHE]; --void r8712_os_indicate_disconnect(struct _adapter *adapter) --{ -- u8 backupPMKIDIndex = 0; -- u8 backupTKIPCountermeasure = 0x00; -- -- r8712_indicate_wx_disassoc_event(adapter); -- netif_carrier_off(adapter->pnetdev); -- if (adapter->securitypriv.AuthAlgrthm == 2) { /*/802.1x*/ -- /* We have to backup the PMK information for WiFi PMK Caching -- * test item. Backup the btkip_countermeasure information. -- * When the countermeasure is trigger, the driver have to -- * disconnect with AP for 60 seconds. -- */ -- -- memcpy(&backupPMKIDList[0], -- &adapter->securitypriv.PMKIDList[0], -- sizeof(struct RT_PMKID_LIST) * NUM_PMKID_CACHE); -- backupPMKIDIndex = adapter->securitypriv.PMKIDIndex; -- backupTKIPCountermeasure = -- adapter->securitypriv.btkip_countermeasure; -- memset((unsigned char *)&adapter->securitypriv, 0, -- sizeof(struct security_priv)); -- timer_setup(&adapter->securitypriv.tkip_timer, -- r8712_use_tkipkey_handler, 0); -- /* Restore the PMK information to securitypriv structure -- * for the following connection. -- */ -- memcpy(&adapter->securitypriv.PMKIDList[0], -- &backupPMKIDList[0], -- sizeof(struct RT_PMKID_LIST) * NUM_PMKID_CACHE); -- adapter->securitypriv.PMKIDIndex = backupPMKIDIndex; -- adapter->securitypriv.btkip_countermeasure = -- backupTKIPCountermeasure; -- } else { /*reset values in securitypriv*/ -- struct security_priv *sec_priv = &adapter->securitypriv; -- -- sec_priv->AuthAlgrthm = 0; /*open system*/ -- sec_priv->PrivacyAlgrthm = _NO_PRIVACY_; -- sec_priv->PrivacyKeyIndex = 0; -- sec_priv->XGrpPrivacy = _NO_PRIVACY_; -- sec_priv->XGrpKeyid = 1; -- sec_priv->ndisauthtype = Ndis802_11AuthModeOpen; -- sec_priv->ndisencryptstatus = Ndis802_11WEPDisabled; -- sec_priv->wps_phase = false; -- } --} -- --void r8712_report_sec_ie(struct _adapter *adapter, u8 authmode, u8 *sec_ie) --{ -- uint len; -- u8 *buff, *p, i; -- union iwreq_data wrqu; -- -- buff = NULL; -- if (authmode == _WPA_IE_ID_) { -- buff = kzalloc(IW_CUSTOM_MAX, GFP_ATOMIC); -- if (!buff) -- return; -- p = buff; -- p += sprintf(p, "ASSOCINFO(ReqIEs="); -- len = sec_ie[1] + 2; -- len = (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX; -- for (i = 0; i < len; i++) -- p += sprintf(p, "%02x", sec_ie[i]); -- p += sprintf(p, ")"); -- memset(&wrqu, 0, sizeof(wrqu)); -- wrqu.data.length = p - buff; -- wrqu.data.length = (wrqu.data.length < IW_CUSTOM_MAX) ? -- wrqu.data.length : IW_CUSTOM_MAX; -- wireless_send_event(adapter->pnetdev, IWEVCUSTOM, &wrqu, buff); -- kfree(buff); -- } --} -diff --git a/drivers/staging/rtl8712/mlme_osdep.h b/drivers/staging/rtl8712/mlme_osdep.h -deleted file mode 100644 -index a02c782588ddbf..00000000000000 ---- a/drivers/staging/rtl8712/mlme_osdep.h -+++ /dev/null -@@ -1,31 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __MLME_OSDEP_H_ --#define __MLME_OSDEP_H_ -- --#include "osdep_service.h" --#include "drv_types.h" -- --void r8712_init_mlme_timer(struct _adapter *padapter); --void r8712_os_indicate_disconnect(struct _adapter *adapter); --void r8712_os_indicate_connect(struct _adapter *adapter); --void r8712_report_sec_ie(struct _adapter *adapter, u8 authmode, u8 *sec_ie); --int r8712_recv_indicatepkts_in_order(struct _adapter *adapter, -- struct recv_reorder_ctrl *precvreorder_ctrl, -- int bforced); --void r8712_indicate_wx_assoc_event(struct _adapter *padapter); --void r8712_indicate_wx_disassoc_event(struct _adapter *padapter); -- --#endif /*_MLME_OSDEP_H_*/ -- -diff --git a/drivers/staging/rtl8712/mp_custom_oid.h b/drivers/staging/rtl8712/mp_custom_oid.h -deleted file mode 100644 -index a9fac87fcabc59..00000000000000 ---- a/drivers/staging/rtl8712/mp_custom_oid.h -+++ /dev/null -@@ -1,287 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __CUSTOM_OID_H --#define __CUSTOM_OID_H -- --/* 0xFF818000 - 0xFF81802F RTL8180 Mass Production Kit -- * 0xFF818500 - 0xFF81850F RTL8185 Setup Utility -- * 0xFF818580 - 0xFF81858F RTL8185 Phy Status Utility -- * -- * by Owen for Production Kit -- * For Production Kit with Agilent Equipments -- * in order to make our custom oids hopefully somewhat unique -- * we will use 0xFF (indicating implementation specific OID) -- * 81(first byte of non zero Realtek unique identifier) -- * 80 (second byte of non zero Realtek unique identifier) -- * XX (the custom OID number - providing 255 possible custom oids) -- */ --#define OID_RT_PRO_RESET_DUT 0xFF818000 --#define OID_RT_PRO_SET_DATA_RATE 0xFF818001 --#define OID_RT_PRO_START_TEST 0xFF818002 --#define OID_RT_PRO_STOP_TEST 0xFF818003 --#define OID_RT_PRO_SET_PREAMBLE 0xFF818004 --#define OID_RT_PRO_SET_SCRAMBLER 0xFF818005 --#define OID_RT_PRO_SET_FILTER_BB 0xFF818006 --#define OID_RT_PRO_SET_MANUAL_DIVERSITY_BB 0xFF818007 --#define OID_RT_PRO_SET_CHANNEL_DIRECT_CALL 0xFF818008 --#define OID_RT_PRO_SET_SLEEP_MODE_DIRECT_CALL 0xFF818009 --#define OID_RT_PRO_SET_WAKE_MODE_DIRECT_CALL 0xFF81800A -- --#define OID_RT_PRO_SET_TX_ANTENNA_BB 0xFF81800D --#define OID_RT_PRO_SET_ANTENNA_BB 0xFF81800E --#define OID_RT_PRO_SET_CR_SCRAMBLER 0xFF81800F --#define OID_RT_PRO_SET_CR_NEW_FILTER 0xFF818010 --#define OID_RT_PRO_SET_TX_POWER_CONTROL 0xFF818011 --#define OID_RT_PRO_SET_CR_TX_CONFIG 0xFF818012 --#define OID_RT_PRO_GET_TX_POWER_CONTROL 0xFF818013 --#define OID_RT_PRO_GET_CR_SIGNAL_QUALITY 0xFF818014 --#define OID_RT_PRO_SET_CR_SETPOINT 0xFF818015 --#define OID_RT_PRO_SET_INTEGRATOR 0xFF818016 --#define OID_RT_PRO_SET_SIGNAL_QUALITY 0xFF818017 --#define OID_RT_PRO_GET_INTEGRATOR 0xFF818018 --#define OID_RT_PRO_GET_SIGNAL_QUALITY 0xFF818019 --#define OID_RT_PRO_QUERY_EEPROM_TYPE 0xFF81801A --#define OID_RT_PRO_WRITE_MAC_ADDRESS 0xFF81801B --#define OID_RT_PRO_READ_MAC_ADDRESS 0xFF81801C --#define OID_RT_PRO_WRITE_CIS_DATA 0xFF81801D --#define OID_RT_PRO_READ_CIS_DATA 0xFF81801E --#define OID_RT_PRO_WRITE_POWER_CONTROL 0xFF81801F --#define OID_RT_PRO_READ_POWER_CONTROL 0xFF818020 --#define OID_RT_PRO_WRITE_EEPROM 0xFF818021 --#define OID_RT_PRO_READ_EEPROM 0xFF818022 --#define OID_RT_PRO_RESET_TX_PACKET_SENT 0xFF818023 --#define OID_RT_PRO_QUERY_TX_PACKET_SENT 0xFF818024 --#define OID_RT_PRO_RESET_RX_PACKET_RECEIVED 0xFF818025 --#define OID_RT_PRO_QUERY_RX_PACKET_RECEIVED 0xFF818026 --#define OID_RT_PRO_QUERY_RX_PACKET_CRC32_ERROR 0xFF818027 --#define OID_RT_PRO_QUERY_CURRENT_ADDRESS 0xFF818028 --#define OID_RT_PRO_QUERY_PERMANENT_ADDRESS 0xFF818029 --#define OID_RT_PRO_SET_PHILIPS_RF_PARAMETERS 0xFF81802A --#define OID_RT_PRO_RECEIVE_PACKET 0xFF81802C --#define OID_RT_PRO_WRITE_EEPROM_BYTE 0xFF81802D --#define OID_RT_PRO_READ_EEPROM_BYTE 0xFF81802E --#define OID_RT_PRO_SET_MODULATION 0xFF81802F --#define OID_RT_DRIVER_OPTION 0xFF818080 --#define OID_RT_RF_OFF 0xFF818081 --#define OID_RT_AUTH_STATUS 0xFF818082 --#define OID_RT_PRO_SET_CONTINUOUS_TX 0xFF81800B --#define OID_RT_PRO_SET_SINGLE_CARRIER_TX 0xFF81800C --#define OID_RT_PRO_SET_CARRIER_SUPPRESSION_TX 0xFF81802B --#define OID_RT_PRO_SET_SINGLE_TONE_TX 0xFF818043 --#define OID_RT_UTILITY_FALSE_ALARM_COUNTERS 0xFF818580 --#define OID_RT_UTILITY_SELECT_DEBUG_MODE 0xFF818581 --#define OID_RT_UTILITY_SELECT_SUBCARRIER_NUMBER 0xFF818582 --#define OID_RT_UTILITY_GET_RSSI_STATUS 0xFF818583 --#define OID_RT_UTILITY_GET_FRAME_DETECTION_STATUS 0xFF818584 --#define OID_RT_UTILITY_GET_AGC_AND_FREQUENCY_OFFSET_ESTIMATION_STATUS \ -- 0xFF818585 --#define OID_RT_UTILITY_GET_CHANNEL_ESTIMATION_STATUS 0xFF818586 --#define OID_RT_WIRELESS_MODE 0xFF818500 --#define OID_RT_SUPPORTED_RATES 0xFF818501 --#define OID_RT_DESIRED_RATES 0xFF818502 --#define OID_RT_WIRELESS_MODE_STARTING_ADHOC 0xFF818503 --#define OID_RT_GET_CONNECT_STATE 0xFF030001 --#define OID_RT_RESCAN 0xFF030002 --#define OID_RT_SET_KEY_LENGTH 0xFF030003 --#define OID_RT_SET_DEFAULT_KEY_ID 0xFF030004 --#define OID_RT_SET_CHANNEL 0xFF010182 --#define OID_RT_SET_SNIFFER_MODE 0xFF010183 --#define OID_RT_GET_SIGNAL_QUALITY 0xFF010184 --#define OID_RT_GET_SMALL_PACKET_CRC 0xFF010185 --#define OID_RT_GET_MIDDLE_PACKET_CRC 0xFF010186 --#define OID_RT_GET_LARGE_PACKET_CRC 0xFF010187 --#define OID_RT_GET_TX_RETRY 0xFF010188 --#define OID_RT_GET_RX_RETRY 0xFF010189 --#define OID_RT_PRO_SET_FW_DIG_STATE 0xFF01018A --#define OID_RT_PRO_SET_FW_RA_STATE 0xFF01018B --#define OID_RT_GET_RX_TOTAL_PACKET 0xFF010190 --#define OID_RT_GET_TX_BEACON_OK 0xFF010191 --#define OID_RT_GET_TX_BEACON_ERR 0xFF010192 --#define OID_RT_GET_RX_ICV_ERR 0xFF010193 --#define OID_RT_SET_ENCRYPTION_ALGORITHM 0xFF010194 --#define OID_RT_SET_NO_AUTO_RESCAN 0xFF010195 --#define OID_RT_GET_PREAMBLE_MODE 0xFF010196 --#define OID_RT_GET_DRIVER_UP_DELTA_TIME 0xFF010197 --#define OID_RT_GET_AP_IP 0xFF010198 --#define OID_RT_GET_CHANNELPLAN 0xFF010199 --#define OID_RT_SET_PREAMBLE_MODE 0xFF01019A --#define OID_RT_SET_BCN_INTVL 0xFF01019B --#define OID_RT_GET_RF_VENDER 0xFF01019C --#define OID_RT_DEDICATE_PROBE 0xFF01019D --#define OID_RT_PRO_RX_FILTER_PATTERN 0xFF01019E --#define OID_RT_GET_DCST_CURRENT_THRESHOLD 0xFF01019F --#define OID_RT_GET_CCA_ERR 0xFF0101A0 --#define OID_RT_GET_CCA_UPGRADE_THRESHOLD 0xFF0101A1 --#define OID_RT_GET_CCA_FALLBACK_THRESHOLD 0xFF0101A2 --#define OID_RT_GET_CCA_UPGRADE_EVALUATE_TIMES 0xFF0101A3 --#define OID_RT_GET_CCA_FALLBACK_EVALUATE_TIMES 0xFF0101A4 --#define OID_RT_SET_RATE_ADAPTIVE 0xFF0101A5 --#define OID_RT_GET_DCST_EVALUATE_PERIOD 0xFF0101A5 --#define OID_RT_GET_DCST_TIME_UNIT_INDEX 0xFF0101A6 --#define OID_RT_GET_TOTAL_TX_BYTES 0xFF0101A7 --#define OID_RT_GET_TOTAL_RX_BYTES 0xFF0101A8 --#define OID_RT_CURRENT_TX_POWER_LEVEL 0xFF0101A9 --#define OID_RT_GET_ENC_KEY_MISMATCH_COUNT 0xFF0101AA --#define OID_RT_GET_ENC_KEY_MATCH_COUNT 0xFF0101AB --#define OID_RT_GET_CHANNEL 0xFF0101AC --#define OID_RT_SET_CHANNELPLAN 0xFF0101AD --#define OID_RT_GET_HARDWARE_RADIO_OFF 0xFF0101AE --#define OID_RT_CHANNELPLAN_BY_COUNTRY 0xFF0101AF --#define OID_RT_SCAN_AVAILABLE_BSSID 0xFF0101B0 --#define OID_RT_GET_HARDWARE_VERSION 0xFF0101B1 --#define OID_RT_GET_IS_ROAMING 0xFF0101B2 --#define OID_RT_GET_IS_PRIVACY 0xFF0101B3 --#define OID_RT_GET_KEY_MISMATCH 0xFF0101B4 --#define OID_RT_SET_RSSI_ROAM_TRAFFIC_TH 0xFF0101B5 --#define OID_RT_SET_RSSI_ROAM_SIGNAL_TH 0xFF0101B6 --#define OID_RT_RESET_LOG 0xFF0101B7 --#define OID_RT_GET_LOG 0xFF0101B8 --#define OID_RT_SET_INDICATE_HIDDEN_AP 0xFF0101B9 --#define OID_RT_GET_HEADER_FAIL 0xFF0101BA --#define OID_RT_SUPPORTED_WIRELESS_MODE 0xFF0101BB --#define OID_RT_GET_CHANNEL_LIST 0xFF0101BC --#define OID_RT_GET_SCAN_IN_PROGRESS 0xFF0101BD --#define OID_RT_GET_TX_INFO 0xFF0101BE --#define OID_RT_RF_READ_WRITE_OFFSET 0xFF0101BF --#define OID_RT_RF_READ_WRITE 0xFF0101C0 --#define OID_RT_FORCED_DATA_RATE 0xFF0101C1 --#define OID_RT_WIRELESS_MODE_FOR_SCAN_LIST 0xFF0101C2 --#define OID_RT_GET_BSS_WIRELESS_MODE 0xFF0101C3 --#define OID_RT_SCAN_WITH_MAGIC_PACKET 0xFF0101C4 --#define OID_RT_PRO_RX_FILTER 0xFF0111C0 --#define OID_CE_USB_WRITE_REGISTRY 0xFF0111C1 --#define OID_CE_USB_READ_REGISTRY 0xFF0111C2 --#define OID_RT_PRO_SET_INITIAL_GAIN 0xFF0111C3 --#define OID_RT_PRO_SET_BB_RF_STANDBY_MODE 0xFF0111C4 --#define OID_RT_PRO_SET_BB_RF_SHUTDOWN_MODE 0xFF0111C5 --#define OID_RT_PRO_SET_TX_CHARGE_PUMP 0xFF0111C6 --#define OID_RT_PRO_SET_RX_CHARGE_PUMP 0xFF0111C7 --#define OID_RT_PRO_RF_WRITE_REGISTRY 0xFF0111C8 --#define OID_RT_PRO_RF_READ_REGISTRY 0xFF0111C9 --#define OID_RT_PRO_QUERY_RF_TYPE 0xFF0111CA --#define OID_RT_AP_GET_ASSOCIATED_STATION_LIST 0xFF010300 --#define OID_RT_AP_GET_CURRENT_TIME_STAMP 0xFF010301 --#define OID_RT_AP_SWITCH_INTO_AP_MODE 0xFF010302 --#define OID_RT_AP_SET_DTIM_PERIOD 0xFF010303 --#define OID_RT_AP_SUPPORTED 0xFF010304 --#define OID_RT_AP_SET_PASSPHRASE 0xFF010305 --#define OID_RT_PRO8187_WI_POLL 0xFF818780 --#define OID_RT_PRO_WRITE_BB_REG 0xFF818781 --#define OID_RT_PRO_READ_BB_REG 0xFF818782 --#define OID_RT_PRO_WRITE_RF_REG 0xFF818783 --#define OID_RT_PRO_READ_RF_REG 0xFF818784 --#define OID_RT_MH_VENDER_ID 0xFFEDC100 --#define OID_RT_PRO8711_JOIN_BSS 0xFF871100 --#define OID_RT_PRO_READ_REGISTER 0xFF871101 --#define OID_RT_PRO_WRITE_REGISTER 0xFF871102 --#define OID_RT_PRO_BURST_READ_REGISTER 0xFF871103 --#define OID_RT_PRO_BURST_WRITE_REGISTER 0xFF871104 --#define OID_RT_PRO_WRITE_TXCMD 0xFF871105 --#define OID_RT_PRO_READ16_EEPROM 0xFF871106 --#define OID_RT_PRO_WRITE16_EEPROM 0xFF871107 --#define OID_RT_PRO_H2C_SET_COMMAND 0xFF871108 --#define OID_RT_PRO_H2C_QUERY_RESULT 0xFF871109 --#define OID_RT_PRO8711_WI_POLL 0xFF87110A --#define OID_RT_PRO8711_PKT_LOSS 0xFF87110B --#define OID_RT_RD_ATTRIB_MEM 0xFF87110C --#define OID_RT_WR_ATTRIB_MEM 0xFF87110D --/*Method 2 for H2C/C2H*/ --#define OID_RT_PRO_H2C_CMD_MODE 0xFF871110 --#define OID_RT_PRO_H2C_CMD_RSP_MODE 0xFF871111 --#define OID_RT_PRO_H2C_CMD_EVENT_MODE 0xFF871112 --#define OID_RT_PRO_WAIT_C2H_EVENT 0xFF871113 --#define OID_RT_PRO_RW_ACCESS_PROTOCOL_TEST 0xFF871114 --#define OID_RT_PRO_SCSI_ACCESS_TEST 0xFF871115 --#define OID_RT_PRO_SCSI_TCPIPOFFLOAD_OUT 0xFF871116 --#define OID_RT_PRO_SCSI_TCPIPOFFLOAD_IN 0xFF871117 --#define OID_RT_RRO_RX_PKT_VIA_IOCTRL 0xFF871118 --#define OID_RT_RRO_RX_PKTARRAY_VIA_IOCTRL 0xFF871119 --#define OID_RT_RPO_SET_PWRMGT_TEST 0xFF87111A --#define OID_RT_PRO_QRY_PWRMGT_TEST 0XFF87111B --#define OID_RT_RPO_ASYNC_RWIO_TEST 0xFF87111C --#define OID_RT_RPO_ASYNC_RWIO_POLL 0xFF87111D --#define OID_RT_PRO_SET_RF_INTFS 0xFF87111E --#define OID_RT_POLL_RX_STATUS 0xFF87111F --#define OID_RT_PRO_CFG_DEBUG_MESSAGE 0xFF871120 --#define OID_RT_PRO_SET_DATA_RATE_EX 0xFF871121 --#define OID_RT_PRO_SET_BASIC_RATE 0xFF871122 --#define OID_RT_PRO_READ_TSSI 0xFF871123 --#define OID_RT_PRO_SET_POWER_TRACKING 0xFF871124 --#define OID_RT_PRO_QRY_PWRSTATE 0xFF871150 --#define OID_RT_PRO_SET_PWRSTATE 0xFF871151 --/*Method 2 , using workitem */ --#define OID_RT_SET_READ_REG 0xFF871181 --#define OID_RT_SET_WRITE_REG 0xFF871182 --#define OID_RT_SET_BURST_READ_REG 0xFF871183 --#define OID_RT_SET_BURST_WRITE_REG 0xFF871184 --#define OID_RT_SET_WRITE_TXCMD 0xFF871185 --#define OID_RT_SET_READ16_EEPROM 0xFF871186 --#define OID_RT_SET_WRITE16_EEPROM 0xFF871187 --#define OID_RT_QRY_POLL_WKITEM 0xFF871188 -- --/*For SDIO INTERFACE only*/ --#define OID_RT_PRO_SYNCPAGERW_SRAM 0xFF8711A0 --#define OID_RT_PRO_871X_DRV_EXT 0xFF8711A1 -- --/*For USB INTERFACE only*/ --#define OID_RT_PRO_USB_VENDOR_REQ 0xFF8711B0 --#define OID_RT_PRO_SCSI_AUTO_TEST 0xFF8711B1 --#define OID_RT_PRO_USB_MAC_AC_FIFO_WRITE 0xFF8711B2 --#define OID_RT_PRO_USB_MAC_RX_FIFO_READ 0xFF8711B3 --#define OID_RT_PRO_USB_MAC_RX_FIFO_POLLING 0xFF8711B4 -- --#define OID_RT_PRO_H2C_SET_RATE_TABLE 0xFF8711FB --#define OID_RT_PRO_H2C_GET_RATE_TABLE 0xFF8711FC --#define OID_RT_PRO_H2C_C2H_LBK_TEST 0xFF8711FE -- --#define OID_RT_PRO_ENCRYPTION_CTRL 0xFF871200 --#define OID_RT_PRO_ADD_STA_INFO 0xFF871201 --#define OID_RT_PRO_DELE_STA_INFO 0xFF871202 --#define OID_RT_PRO_QUERY_DR_VARIABLE 0xFF871203 -- --#define OID_RT_PRO_RX_PACKET_TYPE 0xFF871204 -- --#define OID_RT_PRO_READ_EFUSE 0xFF871205 --#define OID_RT_PRO_WRITE_EFUSE 0xFF871206 --#define OID_RT_PRO_RW_EFUSE_PGPKT 0xFF871207 --#define OID_RT_GET_EFUSE_CURRENT_SIZE 0xFF871208 -- --#define OID_RT_SET_BANDWIDTH 0xFF871209 --#define OID_RT_SET_CRYSTAL_CAP 0xFF87120A -- --#define OID_RT_SET_RX_PACKET_TYPE 0xFF87120B -- --#define OID_RT_GET_EFUSE_MAX_SIZE 0xFF87120C -- --#define OID_RT_PRO_SET_TX_AGC_OFFSET 0xFF87120D -- --#define OID_RT_PRO_SET_PKT_TEST_MODE 0xFF87120E -- --#define OID_RT_PRO_FOR_EVM_TEST_SETTING 0xFF87120F -- --#define OID_RT_PRO_GET_THERMAL_METER 0xFF871210 -- --#define OID_RT_RESET_PHY_RX_PACKET_COUNT 0xFF871211 --#define OID_RT_GET_PHY_RX_PACKET_RECEIVED 0xFF871212 --#define OID_RT_GET_PHY_RX_PACKET_CRC32_ERROR 0xFF871213 -- --#define OID_RT_SET_POWER_DOWN 0xFF871214 -- --#define OID_RT_GET_POWER_MODE 0xFF871215 -- --#define OID_RT_PRO_EFUSE 0xFF871216 --#define OID_RT_PRO_EFUSE_MAP 0xFF871217 -- --#endif /*#ifndef __CUSTOM_OID_H */ -- -diff --git a/drivers/staging/rtl8712/os_intfs.c b/drivers/staging/rtl8712/os_intfs.c -deleted file mode 100644 -index b18e6d9c832b8a..00000000000000 ---- a/drivers/staging/rtl8712/os_intfs.c -+++ /dev/null -@@ -1,482 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * os_intfs.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE . -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _OS_INTFS_C_ -- --#include --#include --#include --#include "osdep_service.h" --#include "drv_types.h" --#include "xmit_osdep.h" --#include "recv_osdep.h" --#include "rtl871x_ioctl.h" --#include "usb_osintf.h" -- --MODULE_LICENSE("GPL"); --MODULE_DESCRIPTION("rtl871x wireless lan driver"); --MODULE_AUTHOR("Larry Finger"); -- --static char ifname[IFNAMSIZ] = "wlan%d"; -- --/* module param defaults */ --static int chip_version = RTL8712_2ndCUT; --static int rfintfs = HWPI; --static int lbkmode = RTL8712_AIR_TRX; --static int hci = RTL8712_USB; --static int ampdu_enable = 1;/*for enable tx_ampdu*/ -- --/* The video_mode variable is for video mode.*/ --/* It may be specify when inserting module with video_mode=1 parameter.*/ --static int video_mode = 1; /* enable video mode*/ -- --/*Ndis802_11Infrastructure; infra, ad-hoc, auto*/ --static int network_mode = Ndis802_11IBSS; --static int channel = 1;/*ad-hoc support requirement*/ --static int wireless_mode = WIRELESS_11BG; --static int vrtl_carrier_sense = AUTO_VCS; --static int vcs_type = RTS_CTS; --static int frag_thresh = 2346; --static int preamble = PREAMBLE_LONG;/*long, short, auto*/ --static int scan_mode = 1;/*active, passive*/ --static int adhoc_tx_pwr = 1; --static int soft_ap; --static int smart_ps = 1; --static int power_mgnt = PS_MODE_ACTIVE; --static int radio_enable = 1; --static int long_retry_lmt = 7; --static int short_retry_lmt = 7; --static int busy_thresh = 40; --static int ack_policy = NORMAL_ACK; --static int mp_mode; --static int software_encrypt; --static int software_decrypt; -- --static int wmm_enable;/* default is set to disable the wmm.*/ --static int uapsd_enable; --static int uapsd_max_sp = NO_LIMIT; --static int uapsd_acbk_en; --static int uapsd_acbe_en; --static int uapsd_acvi_en; --static int uapsd_acvo_en; -- --static int ht_enable = 1; --static int cbw40_enable = 1; --static int rf_config = RTL8712_RF_1T2R; /* 1T2R*/ --static int low_power; --/* mac address to use instead of the one stored in Efuse */ --char *r8712_initmac; --static char *initmac; --/* if wifi_test = 1, driver will disable the turbo mode and pass it to -- * firmware private. -- */ --static int wifi_test; -- --module_param_string(ifname, ifname, sizeof(ifname), 0644); --module_param(wifi_test, int, 0644); --module_param(initmac, charp, 0644); --module_param(video_mode, int, 0644); --module_param(chip_version, int, 0644); --module_param(rfintfs, int, 0644); --module_param(lbkmode, int, 0644); --module_param(hci, int, 0644); --module_param(network_mode, int, 0644); --module_param(channel, int, 0644); --module_param(mp_mode, int, 0644); --module_param(wmm_enable, int, 0644); --module_param(vrtl_carrier_sense, int, 0644); --module_param(vcs_type, int, 0644); --module_param(busy_thresh, int, 0644); --module_param(ht_enable, int, 0644); --module_param(cbw40_enable, int, 0644); --module_param(ampdu_enable, int, 0644); --module_param(rf_config, int, 0644); --module_param(power_mgnt, int, 0644); --module_param(low_power, int, 0644); -- --MODULE_PARM_DESC(ifname, " Net interface name, wlan%d=default"); --MODULE_PARM_DESC(initmac, "MAC-Address, default: use FUSE"); -- --static int netdev_open(struct net_device *pnetdev); --static int netdev_close(struct net_device *pnetdev); -- --static void loadparam(struct _adapter *padapter, struct net_device *pnetdev) --{ -- struct registry_priv *registry_par = &padapter->registrypriv; -- -- registry_par->chip_version = (u8)chip_version; -- registry_par->rfintfs = (u8)rfintfs; -- registry_par->lbkmode = (u8)lbkmode; -- registry_par->hci = (u8)hci; -- registry_par->network_mode = (u8)network_mode; -- memcpy(registry_par->ssid.Ssid, "ANY", 3); -- registry_par->ssid.SsidLength = 3; -- registry_par->channel = (u8)channel; -- registry_par->wireless_mode = (u8)wireless_mode; -- registry_par->vrtl_carrier_sense = (u8)vrtl_carrier_sense; -- registry_par->vcs_type = (u8)vcs_type; -- registry_par->frag_thresh = (u16)frag_thresh; -- registry_par->preamble = (u8)preamble; -- registry_par->scan_mode = (u8)scan_mode; -- registry_par->adhoc_tx_pwr = (u8)adhoc_tx_pwr; -- registry_par->soft_ap = (u8)soft_ap; -- registry_par->smart_ps = (u8)smart_ps; -- registry_par->power_mgnt = (u8)power_mgnt; -- registry_par->radio_enable = (u8)radio_enable; -- registry_par->long_retry_lmt = (u8)long_retry_lmt; -- registry_par->short_retry_lmt = (u8)short_retry_lmt; -- registry_par->busy_thresh = (u16)busy_thresh; -- registry_par->ack_policy = (u8)ack_policy; -- registry_par->mp_mode = (u8)mp_mode; -- registry_par->software_encrypt = (u8)software_encrypt; -- registry_par->software_decrypt = (u8)software_decrypt; -- /*UAPSD*/ -- registry_par->wmm_enable = (u8)wmm_enable; -- registry_par->uapsd_enable = (u8)uapsd_enable; -- registry_par->uapsd_max_sp = (u8)uapsd_max_sp; -- registry_par->uapsd_acbk_en = (u8)uapsd_acbk_en; -- registry_par->uapsd_acbe_en = (u8)uapsd_acbe_en; -- registry_par->uapsd_acvi_en = (u8)uapsd_acvi_en; -- registry_par->uapsd_acvo_en = (u8)uapsd_acvo_en; -- registry_par->ht_enable = (u8)ht_enable; -- registry_par->cbw40_enable = (u8)cbw40_enable; -- registry_par->ampdu_enable = (u8)ampdu_enable; -- registry_par->rf_config = (u8)rf_config; -- registry_par->low_power = (u8)low_power; -- registry_par->wifi_test = (u8)wifi_test; -- r8712_initmac = initmac; --} -- --static int r871x_net_set_mac_address(struct net_device *pnetdev, void *p) --{ -- struct _adapter *padapter = netdev_priv(pnetdev); -- struct sockaddr *addr = p; -- -- if (!padapter->bup) -- eth_hw_addr_set(pnetdev, addr->sa_data); -- return 0; --} -- --static struct net_device_stats *r871x_net_get_stats(struct net_device *pnetdev) --{ -- struct _adapter *padapter = netdev_priv(pnetdev); -- struct xmit_priv *pxmitpriv = &padapter->xmitpriv; -- struct recv_priv *precvpriv = &padapter->recvpriv; -- -- padapter->stats.tx_packets = pxmitpriv->tx_pkts; -- padapter->stats.rx_packets = precvpriv->rx_pkts; -- padapter->stats.tx_dropped = pxmitpriv->tx_drop; -- padapter->stats.rx_dropped = precvpriv->rx_drop; -- padapter->stats.tx_bytes = pxmitpriv->tx_bytes; -- padapter->stats.rx_bytes = precvpriv->rx_bytes; -- return &padapter->stats; --} -- --static const struct net_device_ops rtl8712_netdev_ops = { -- .ndo_open = netdev_open, -- .ndo_stop = netdev_close, -- .ndo_start_xmit = r8712_xmit_entry, -- .ndo_set_mac_address = r871x_net_set_mac_address, -- .ndo_get_stats = r871x_net_get_stats, -- .ndo_do_ioctl = r871x_ioctl, --}; -- --struct net_device *r8712_init_netdev(void) --{ -- struct _adapter *padapter; -- struct net_device *pnetdev; -- -- pnetdev = alloc_etherdev(sizeof(struct _adapter)); -- if (!pnetdev) -- return NULL; -- if (dev_alloc_name(pnetdev, ifname) < 0) { -- strscpy(ifname, "wlan%d", sizeof(ifname)); -- dev_alloc_name(pnetdev, ifname); -- } -- padapter = netdev_priv(pnetdev); -- padapter->pnetdev = pnetdev; -- pr_info("r8712u: register rtl8712_netdev_ops to netdev_ops\n"); -- pnetdev->netdev_ops = &rtl8712_netdev_ops; -- pnetdev->watchdog_timeo = HZ; /* 1 second timeout */ -- pnetdev->wireless_handlers = (struct iw_handler_def *) -- &r871x_handlers_def; -- loadparam(padapter, pnetdev); -- netif_carrier_off(pnetdev); -- padapter->pid = 0; /* Initial the PID value used for HW PBC.*/ -- return pnetdev; --} -- --static u32 start_drv_threads(struct _adapter *padapter) --{ -- padapter->cmd_thread = kthread_run(r8712_cmd_thread, padapter, "%s", -- padapter->pnetdev->name); -- if (IS_ERR(padapter->cmd_thread)) -- return _FAIL; -- return _SUCCESS; --} -- --void r8712_stop_drv_threads(struct _adapter *padapter) --{ -- struct completion *completion = -- &padapter->cmdpriv.terminate_cmdthread_comp; -- -- /*Below is to terminate r8712_cmd_thread & event_thread...*/ -- complete(&padapter->cmdpriv.cmd_queue_comp); -- if (padapter->cmd_thread) -- wait_for_completion_interruptible(completion); -- padapter->cmdpriv.cmd_seq = 1; --} -- --static void start_drv_timers(struct _adapter *padapter) --{ -- mod_timer(&padapter->mlmepriv.sitesurveyctrl.sitesurvey_ctrl_timer, -- jiffies + msecs_to_jiffies(5000)); -- mod_timer(&padapter->mlmepriv.wdg_timer, -- jiffies + msecs_to_jiffies(2000)); --} -- --void r8712_stop_drv_timers(struct _adapter *padapter) --{ -- del_timer_sync(&padapter->mlmepriv.assoc_timer); -- del_timer_sync(&padapter->securitypriv.tkip_timer); -- del_timer_sync(&padapter->mlmepriv.scan_to_timer); -- del_timer_sync(&padapter->mlmepriv.dhcp_timer); -- del_timer_sync(&padapter->mlmepriv.wdg_timer); -- del_timer_sync(&padapter->mlmepriv.sitesurveyctrl.sitesurvey_ctrl_timer); --} -- --static void init_default_value(struct _adapter *padapter) --{ -- struct registry_priv *pregistrypriv = &padapter->registrypriv; -- struct xmit_priv *pxmitpriv = &padapter->xmitpriv; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct security_priv *psecuritypriv = &padapter->securitypriv; -- -- /*xmit_priv*/ -- pxmitpriv->vcs_setting = pregistrypriv->vrtl_carrier_sense; -- pxmitpriv->vcs = pregistrypriv->vcs_type; -- pxmitpriv->vcs_type = pregistrypriv->vcs_type; -- pxmitpriv->rts_thresh = pregistrypriv->rts_thresh; -- pxmitpriv->frag_len = pregistrypriv->frag_thresh; -- /* mlme_priv */ -- /* Maybe someday we should rename this variable to "active_mode"(Jeff)*/ -- pmlmepriv->passive_mode = 1; /* 1: active, 0: passive. */ -- /*ht_priv*/ -- { -- int i; -- struct ht_priv *phtpriv = &pmlmepriv->htpriv; -- -- phtpriv->ampdu_enable = false;/*set to disabled*/ -- for (i = 0; i < 16; i++) -- phtpriv->baddbareq_issued[i] = false; -- } -- /*security_priv*/ -- psecuritypriv->sw_encrypt = pregistrypriv->software_encrypt; -- psecuritypriv->sw_decrypt = pregistrypriv->software_decrypt; -- psecuritypriv->binstallGrpkey = _FAIL; -- /*pwrctrl_priv*/ -- /*registry_priv*/ -- r8712_init_registrypriv_dev_network(padapter); -- r8712_update_registrypriv_dev_network(padapter); -- /*misc.*/ --} -- --int r8712_init_drv_sw(struct _adapter *padapter) --{ -- int ret; -- -- ret = r8712_init_cmd_priv(&padapter->cmdpriv); -- if (ret) -- return ret; -- padapter->cmdpriv.padapter = padapter; -- ret = r8712_init_evt_priv(&padapter->evtpriv); -- if (ret) -- goto free_cmd; -- ret = r8712_init_mlme_priv(padapter); -- if (ret) -- goto free_evt; -- ret = _r8712_init_xmit_priv(&padapter->xmitpriv, padapter); -- if (ret) -- goto free_mlme; -- ret = _r8712_init_recv_priv(&padapter->recvpriv, padapter); -- if (ret) -- goto free_xmit; -- memset((unsigned char *)&padapter->securitypriv, 0, -- sizeof(struct security_priv)); -- timer_setup(&padapter->securitypriv.tkip_timer, -- r8712_use_tkipkey_handler, 0); -- ret = _r8712_init_sta_priv(&padapter->stapriv); -- if (ret) -- goto free_recv; -- padapter->stapriv.padapter = padapter; -- r8712_init_bcmc_stainfo(padapter); -- r8712_init_pwrctrl_priv(padapter); -- mp871xinit(padapter); -- init_default_value(padapter); -- r8712_InitSwLeds(padapter); -- mutex_init(&padapter->mutex_start); -- -- return 0; -- --free_recv: -- _r8712_free_recv_priv(&padapter->recvpriv); --free_xmit: -- _free_xmit_priv(&padapter->xmitpriv); --free_mlme: -- r8712_free_mlme_priv(&padapter->mlmepriv); --free_evt: -- r8712_free_evt_priv(&padapter->evtpriv); --free_cmd: -- r8712_free_cmd_priv(&padapter->cmdpriv); -- return ret; --} -- --void r8712_free_drv_sw(struct _adapter *padapter) --{ -- r8712_free_cmd_priv(&padapter->cmdpriv); -- r8712_free_evt_priv(&padapter->evtpriv); -- r8712_DeInitSwLeds(padapter); -- r8712_free_mlme_priv(&padapter->mlmepriv); -- _free_xmit_priv(&padapter->xmitpriv); -- _r8712_free_sta_priv(&padapter->stapriv); -- _r8712_free_recv_priv(&padapter->recvpriv); -- mp871xdeinit(padapter); --} -- --static void enable_video_mode(struct _adapter *padapter, int cbw40_value) --{ -- /* bit 8: -- * 1 -> enable video mode to 96B AP -- * 0 -> disable video mode to 96B AP -- * bit 9: -- * 1 -> enable 40MHz mode -- * 0 -> disable 40MHz mode -- * bit 10: -- * 1 -> enable STBC -- * 0 -> disable STBC -- */ -- u32 intcmd = 0xf4000500; /* enable bit8, bit10*/ -- -- if (cbw40_value) { -- /* if the driver supports the 40M bandwidth, -- * we can enable the bit 9. -- */ -- intcmd |= 0x200; -- } -- r8712_fw_cmd(padapter, intcmd); --} -- --/* -- * -- * This function intends to handle the activation of an interface -- * i.e. when it is brought Up/Active from a Down state. -- * -- */ --static int netdev_open(struct net_device *pnetdev) --{ -- struct _adapter *padapter = netdev_priv(pnetdev); -- -- mutex_lock(&padapter->mutex_start); -- if (!padapter->bup) { -- padapter->driver_stopped = false; -- padapter->surprise_removed = false; -- padapter->bup = true; -- if (rtl871x_hal_init(padapter) != _SUCCESS) -- goto netdev_open_error; -- if (!r8712_initmac) { -- /* Use the mac address stored in the Efuse */ -- eth_hw_addr_set(pnetdev, -- padapter->eeprompriv.mac_addr); -- } else { -- /* We have to inform f/w to use user-supplied MAC -- * address. -- */ -- msleep(200); -- r8712_setMacAddr_cmd(padapter, -- (const u8 *)pnetdev->dev_addr); -- /* -- * The "myid" function will get the wifi mac address -- * from eeprompriv structure instead of netdev -- * structure. So, we have to overwrite the mac_addr -- * stored in the eeprompriv structure. In this case, -- * the real mac address won't be used anymore. So that, -- * the eeprompriv.mac_addr should store the mac which -- * users specify. -- */ -- memcpy(padapter->eeprompriv.mac_addr, -- pnetdev->dev_addr, ETH_ALEN); -- } -- if (start_drv_threads(padapter) != _SUCCESS) -- goto netdev_open_error; -- if (!padapter->dvobjpriv.inirp_init) -- goto netdev_open_error; -- else -- padapter->dvobjpriv.inirp_init(padapter); -- r8712_set_ps_mode(padapter, padapter->registrypriv.power_mgnt, -- padapter->registrypriv.smart_ps); -- } -- if (!netif_queue_stopped(pnetdev)) -- netif_start_queue(pnetdev); -- else -- netif_wake_queue(pnetdev); -- -- if (video_mode) -- enable_video_mode(padapter, cbw40_enable); -- /* start driver mlme relation timer */ -- start_drv_timers(padapter); -- padapter->ledpriv.LedControlHandler(padapter, LED_CTL_NO_LINK); -- mutex_unlock(&padapter->mutex_start); -- return 0; --netdev_open_error: -- padapter->bup = false; -- netif_carrier_off(pnetdev); -- netif_stop_queue(pnetdev); -- mutex_unlock(&padapter->mutex_start); -- return -1; --} -- --/* -- * -- * This function intends to handle the shutdown of an interface -- * i.e. when it is brought Down from an Up/Active state. -- * -- */ --static int netdev_close(struct net_device *pnetdev) --{ -- struct _adapter *padapter = netdev_priv(pnetdev); -- -- /* Close LED*/ -- padapter->ledpriv.LedControlHandler(padapter, LED_CTL_POWER_OFF); -- msleep(200); -- -- /*s1.*/ -- if (pnetdev) { -- if (!netif_queue_stopped(pnetdev)) -- netif_stop_queue(pnetdev); -- } -- /*s2.*/ -- /*s2-1. issue disassoc_cmd to fw*/ -- r8712_disassoc_cmd(padapter); -- /*s2-2. indicate disconnect to os*/ -- r8712_ind_disconnect(padapter); -- /*s2-3.*/ -- r8712_free_assoc_resources(padapter); -- /*s2-4.*/ -- r8712_free_network_queue(padapter); -- return 0; --} -- --#include "mlme_osdep.h" -diff --git a/drivers/staging/rtl8712/osdep_intf.h b/drivers/staging/rtl8712/osdep_intf.h -deleted file mode 100644 -index 9e75116c987ec3..00000000000000 ---- a/drivers/staging/rtl8712/osdep_intf.h -+++ /dev/null -@@ -1,32 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __OSDEP_INTF_H_ --#define __OSDEP_INTF_H_ -- --#include "osdep_service.h" --#include "drv_types.h" -- --#define RND4(x) (((x >> 2) + ((x & 3) != 0)) << 2) -- --struct intf_priv { -- u8 *intf_dev; -- /* when in USB, IO is through interrupt in/out endpoints */ -- struct usb_device *udev; -- struct urb *piorw_urb; -- struct completion io_retevt_comp; --}; -- --int r871x_ioctl(struct net_device *dev, struct ifreq *rq, int cmd); -- --#endif /*_OSDEP_INTF_H_*/ -diff --git a/drivers/staging/rtl8712/osdep_service.h b/drivers/staging/rtl8712/osdep_service.h -deleted file mode 100644 -index 0d9bb42cbc589e..00000000000000 ---- a/drivers/staging/rtl8712/osdep_service.h -+++ /dev/null -@@ -1,60 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __OSDEP_SERVICE_H_ --#define __OSDEP_SERVICE_H_ -- --#define _SUCCESS 1 --#define _FAIL 0 -- --#include -- --#include --#include --#include --#include --#include --#include --#include --#include /* Necessary because we use the proc fs */ -- --#include "basic_types.h" -- --struct __queue { -- struct list_head queue; -- spinlock_t lock; --}; -- --#define _pkt struct sk_buff --#define _buffer unsigned char -- --#define _init_queue(pqueue) \ -- do { \ -- INIT_LIST_HEAD(&((pqueue)->queue)); \ -- spin_lock_init(&((pqueue)->lock)); \ -- } while (0) -- --static inline u32 end_of_queue_search(struct list_head *head, -- struct list_head *plist) --{ -- return (head == plist); --} -- --static inline void flush_signals_thread(void) --{ -- if (signal_pending(current)) -- flush_signals(current); --} -- --#endif -- -diff --git a/drivers/staging/rtl8712/recv_linux.c b/drivers/staging/rtl8712/recv_linux.c -deleted file mode 100644 -index 215fca4abb3a06..00000000000000 ---- a/drivers/staging/rtl8712/recv_linux.c -+++ /dev/null -@@ -1,139 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * recv_linux.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE . -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _RECV_OSDEP_C_ -- --#include -- --#include "osdep_service.h" --#include "drv_types.h" --#include "wifi.h" --#include "recv_osdep.h" --#include "osdep_intf.h" --#include "ethernet.h" --#include --#include "usb_ops.h" -- --/*init os related resource in struct recv_priv*/ --/*alloc os related resource in union recv_frame*/ --void r8712_os_recv_resource_alloc(struct _adapter *padapter, -- union recv_frame *precvframe) --{ -- precvframe->u.hdr.pkt_newalloc = NULL; -- precvframe->u.hdr.pkt = NULL; --} -- --/*alloc os related resource in struct recv_buf*/ --int r8712_os_recvbuf_resource_alloc(struct _adapter *padapter, -- struct recv_buf *precvbuf) --{ -- int res = 0; -- -- precvbuf->irp_pending = false; -- precvbuf->purb = usb_alloc_urb(0, GFP_KERNEL); -- if (!precvbuf->purb) -- res = -ENOMEM; -- precvbuf->pskb = NULL; -- precvbuf->pallocated_buf = NULL; -- precvbuf->pbuf = NULL; -- precvbuf->pdata = NULL; -- precvbuf->phead = NULL; -- precvbuf->ptail = NULL; -- precvbuf->pend = NULL; -- precvbuf->transfer_len = 0; -- precvbuf->len = 0; -- return res; --} -- --/*free os related resource in struct recv_buf*/ --void r8712_os_recvbuf_resource_free(struct _adapter *padapter, -- struct recv_buf *precvbuf) --{ -- if (precvbuf->pskb) -- dev_kfree_skb_any(precvbuf->pskb); -- if (precvbuf->purb) { -- usb_kill_urb(precvbuf->purb); -- usb_free_urb(precvbuf->purb); -- } --} -- --void r8712_handle_tkip_mic_err(struct _adapter *adapter, u8 bgroup) --{ -- union iwreq_data wrqu; -- struct iw_michaelmicfailure ev; -- struct mlme_priv *mlmepriv = &adapter->mlmepriv; -- -- memset(&ev, 0x00, sizeof(ev)); -- if (bgroup) -- ev.flags |= IW_MICFAILURE_GROUP; -- else -- ev.flags |= IW_MICFAILURE_PAIRWISE; -- ev.src_addr.sa_family = ARPHRD_ETHER; -- ether_addr_copy(ev.src_addr.sa_data, &mlmepriv->assoc_bssid[0]); -- memset(&wrqu, 0x00, sizeof(wrqu)); -- wrqu.data.length = sizeof(ev); -- wireless_send_event(adapter->pnetdev, IWEVMICHAELMICFAILURE, &wrqu, -- (char *)&ev); --} -- --void r8712_recv_indicatepkt(struct _adapter *adapter, -- union recv_frame *recvframe) --{ -- struct recv_priv *recvpriv; -- struct __queue *free_recv_queue; -- _pkt *skb; -- struct rx_pkt_attrib *attrib = &recvframe->u.hdr.attrib; -- -- recvpriv = &adapter->recvpriv; -- free_recv_queue = &recvpriv->free_recv_queue; -- skb = recvframe->u.hdr.pkt; -- if (!skb) -- goto _recv_indicatepkt_drop; -- skb->data = recvframe->u.hdr.rx_data; -- skb->len = recvframe->u.hdr.len; -- skb_set_tail_pointer(skb, skb->len); -- if ((attrib->tcpchk_valid == 1) && (attrib->tcp_chkrpt == 1)) -- skb->ip_summed = CHECKSUM_UNNECESSARY; -- else -- skb->ip_summed = CHECKSUM_NONE; -- skb->dev = adapter->pnetdev; -- skb->protocol = eth_type_trans(skb, adapter->pnetdev); -- netif_rx(skb); -- recvframe->u.hdr.pkt = NULL; /* pointers to NULL before -- * r8712_free_recvframe() -- */ -- r8712_free_recvframe(recvframe, free_recv_queue); -- return; --_recv_indicatepkt_drop: -- /*enqueue back to free_recv_queue*/ -- if (recvframe) -- r8712_free_recvframe(recvframe, free_recv_queue); -- recvpriv->rx_drop++; --} -- --static void _r8712_reordering_ctrl_timeout_handler (struct timer_list *t) --{ -- struct recv_reorder_ctrl *reorder_ctrl = -- from_timer(reorder_ctrl, t, reordering_ctrl_timer); -- -- r8712_reordering_ctrl_timeout_handler(reorder_ctrl); --} -- --void r8712_init_recv_timer(struct recv_reorder_ctrl *preorder_ctrl) --{ -- timer_setup(&preorder_ctrl->reordering_ctrl_timer, -- _r8712_reordering_ctrl_timeout_handler, 0); --} -diff --git a/drivers/staging/rtl8712/recv_osdep.h b/drivers/staging/rtl8712/recv_osdep.h -deleted file mode 100644 -index fbe3f286850647..00000000000000 ---- a/drivers/staging/rtl8712/recv_osdep.h -+++ /dev/null -@@ -1,39 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __RECV_OSDEP_H_ --#define __RECV_OSDEP_H_ -- --#include "osdep_service.h" --#include "drv_types.h" --#include -- --int _r8712_init_recv_priv(struct recv_priv *precvpriv, -- struct _adapter *padapter); --void _r8712_free_recv_priv(struct recv_priv *precvpriv); --void r8712_recv_entry(union recv_frame *precv_frame); --void r8712_recv_indicatepkt(struct _adapter *adapter, -- union recv_frame *precv_frame); --void r8712_handle_tkip_mic_err(struct _adapter *padapter, u8 bgroup); --int r8712_init_recv_priv(struct recv_priv *precvpriv, -- struct _adapter *padapter); --void r8712_free_recv_priv(struct recv_priv *precvpriv); --void r8712_os_recv_resource_alloc(struct _adapter *padapter, -- union recv_frame *precvframe); --int r8712_os_recvbuf_resource_alloc(struct _adapter *padapter, -- struct recv_buf *precvbuf); --void r8712_os_recvbuf_resource_free(struct _adapter *padapter, -- struct recv_buf *precvbuf); --void r8712_init_recv_timer(struct recv_reorder_ctrl *preorder_ctrl); -- --#endif -diff --git a/drivers/staging/rtl8712/rtl8712_bitdef.h b/drivers/staging/rtl8712/rtl8712_bitdef.h -deleted file mode 100644 -index a4a687dcc2e7bb..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_bitdef.h -+++ /dev/null -@@ -1,26 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- ******************************************************************************/ -- --#ifndef __RTL8712_BITDEF_H__ --#define __RTL8712_BITDEF_H__ -- --#include "rtl8712_cmdctrl_bitdef.h" --#include "rtl8712_syscfg_bitdef.h" --#include "rtl8712_macsetting_bitdef.h" --#include "rtl8712_timectrl_bitdef.h" --#include "rtl8712_fifoctrl_bitdef.h" --#include "rtl8712_ratectrl_bitdef.h" --#include "rtl8712_edcasetting_bitdef.h" --#include "rtl8712_wmac_bitdef.h" --#include "rtl8712_security_bitdef.h" --#include "rtl8712_powersave_bitdef.h" --#include "rtl8712_gp_bitdef.h" --#include "rtl8712_interrupt_bitdef.h" --#include "rtl8712_debugctrl_bitdef.h" -- --#endif /* __RTL8712_BITDEF_H__ */ -- -diff --git a/drivers/staging/rtl8712/rtl8712_cmd.c b/drivers/staging/rtl8712/rtl8712_cmd.c -deleted file mode 100644 -index bb7db96ed8219f..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_cmd.c -+++ /dev/null -@@ -1,409 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * rtl8712_cmd.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE . -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _RTL8712_CMD_C_ -- --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include -- --#include "osdep_service.h" --#include "drv_types.h" --#include "recv_osdep.h" --#include "mlme_osdep.h" --#include "rtl871x_ioctl_set.h" -- --static void check_hw_pbc(struct _adapter *padapter) --{ -- u8 tmp1byte; -- -- r8712_write8(padapter, MAC_PINMUX_CTRL, (GPIOMUX_EN | GPIOSEL_GPIO)); -- tmp1byte = r8712_read8(padapter, GPIO_IO_SEL); -- tmp1byte &= ~(HAL_8192S_HW_GPIO_WPS_BIT); -- r8712_write8(padapter, GPIO_IO_SEL, tmp1byte); -- tmp1byte = r8712_read8(padapter, GPIO_CTRL); -- if (tmp1byte == 0xff) -- return; -- if (tmp1byte & HAL_8192S_HW_GPIO_WPS_BIT) { -- /* Here we only set bPbcPressed to true -- * After trigger PBC, the variable will be set to false -- */ -- netdev_dbg(padapter->pnetdev, "CheckPbcGPIO - PBC is pressed !!!!\n"); -- /* 0 is the default value and it means the application monitors -- * the HW PBC doesn't provide its pid to driver. -- */ -- if (padapter->pid == 0) -- return; -- kill_pid(find_vpid(padapter->pid), SIGUSR1, 1); -- } --} -- --/* query rx phy status from fw. -- * Adhoc mode: beacon. -- * Infrastructure mode: beacon , data. -- */ --static void query_fw_rx_phy_status(struct _adapter *padapter) --{ -- u32 val32 = 0; -- int pollingcnts = 50; -- -- if (check_fwstate(&padapter->mlmepriv, _FW_LINKED)) { -- r8712_write32(padapter, IOCMD_CTRL_REG, 0xf4000001); -- msleep(100); -- /* Wait FW complete IO Cmd */ -- while ((r8712_read32(padapter, IOCMD_CTRL_REG)) && -- (pollingcnts > 0)) { -- pollingcnts--; -- msleep(20); -- } -- if (pollingcnts != 0) -- val32 = r8712_read32(padapter, IOCMD_DATA_REG); -- else /* time out */ -- val32 = 0; -- val32 >>= 4; -- padapter->recvpriv.fw_rssi = -- (u8)r8712_signal_scale_mapping(val32); -- } --} -- --/* check mlme, hw, phy, or dynamic algorithm status. */ --static void StatusWatchdogCallback(struct _adapter *padapter) --{ -- check_hw_pbc(padapter); -- query_fw_rx_phy_status(padapter); --} -- --static void r871x_internal_cmd_hdl(struct _adapter *padapter, u8 *pbuf) --{ -- struct drvint_cmd_parm *pdrvcmd; -- -- if (!pbuf) -- return; -- pdrvcmd = (struct drvint_cmd_parm *)pbuf; -- switch (pdrvcmd->i_cid) { -- case WDG_WK_CID: -- StatusWatchdogCallback(padapter); -- break; -- default: -- break; -- } -- kfree(pdrvcmd->pbuf); --} -- --static u8 read_bbreg_hdl(struct _adapter *padapter, u8 *pbuf) --{ -- struct cmd_obj *pcmd = (struct cmd_obj *)pbuf; -- -- r8712_free_cmd_obj(pcmd); -- return H2C_SUCCESS; --} -- --static u8 write_bbreg_hdl(struct _adapter *padapter, u8 *pbuf) --{ -- void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd); -- struct cmd_obj *pcmd = (struct cmd_obj *)pbuf; -- -- pcmd_callback = cmd_callback[pcmd->cmdcode].callback; -- if (!pcmd_callback) -- r8712_free_cmd_obj(pcmd); -- else -- pcmd_callback(padapter, pcmd); -- return H2C_SUCCESS; --} -- --static u8 read_rfreg_hdl(struct _adapter *padapter, u8 *pbuf) --{ -- u32 val; -- void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd); -- struct cmd_obj *pcmd = (struct cmd_obj *)pbuf; -- -- if (pcmd->rsp && pcmd->rspsz > 0) -- memcpy(pcmd->rsp, (u8 *)&val, pcmd->rspsz); -- pcmd_callback = cmd_callback[pcmd->cmdcode].callback; -- if (!pcmd_callback) -- r8712_free_cmd_obj(pcmd); -- else -- pcmd_callback(padapter, pcmd); -- return H2C_SUCCESS; --} -- --static u8 write_rfreg_hdl(struct _adapter *padapter, u8 *pbuf) --{ -- void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd); -- struct cmd_obj *pcmd = (struct cmd_obj *)pbuf; -- -- pcmd_callback = cmd_callback[pcmd->cmdcode].callback; -- if (!pcmd_callback) -- r8712_free_cmd_obj(pcmd); -- else -- pcmd_callback(padapter, pcmd); -- return H2C_SUCCESS; --} -- --static u8 sys_suspend_hdl(struct _adapter *padapter, u8 *pbuf) --{ -- struct cmd_obj *pcmd = (struct cmd_obj *)pbuf; -- -- r8712_free_cmd_obj(pcmd); -- return H2C_SUCCESS; --} -- --static struct cmd_obj *cmd_hdl_filter(struct _adapter *padapter, -- struct cmd_obj *pcmd) --{ -- struct cmd_obj *pcmd_r; -- -- if (!pcmd) -- return pcmd; -- pcmd_r = NULL; -- -- switch (pcmd->cmdcode) { -- case GEN_CMD_CODE(_Read_BBREG): -- read_bbreg_hdl(padapter, (u8 *)pcmd); -- break; -- case GEN_CMD_CODE(_Write_BBREG): -- write_bbreg_hdl(padapter, (u8 *)pcmd); -- break; -- case GEN_CMD_CODE(_Read_RFREG): -- read_rfreg_hdl(padapter, (u8 *)pcmd); -- break; -- case GEN_CMD_CODE(_Write_RFREG): -- write_rfreg_hdl(padapter, (u8 *)pcmd); -- break; -- case GEN_CMD_CODE(_SetUsbSuspend): -- sys_suspend_hdl(padapter, (u8 *)pcmd); -- break; -- case GEN_CMD_CODE(_JoinBss): -- r8712_joinbss_reset(padapter); -- /* Before set JoinBss_CMD to FW, driver must ensure FW is in -- * PS_MODE_ACTIVE. Directly write rpwm to radio on and assign -- * new pwr_mode to Driver, instead of use workitem to change -- * state. -- */ -- if (padapter->pwrctrlpriv.pwr_mode > PS_MODE_ACTIVE) { -- padapter->pwrctrlpriv.pwr_mode = PS_MODE_ACTIVE; -- mutex_lock(&padapter->pwrctrlpriv.mutex_lock); -- r8712_set_rpwm(padapter, PS_STATE_S4); -- mutex_unlock(&padapter->pwrctrlpriv.mutex_lock); -- } -- pcmd_r = pcmd; -- break; -- case _DRV_INT_CMD_: -- r871x_internal_cmd_hdl(padapter, pcmd->parmbuf); -- r8712_free_cmd_obj(pcmd); -- pcmd_r = NULL; -- break; -- default: -- pcmd_r = pcmd; -- break; -- } -- return pcmd_r; /* if returning pcmd_r == NULL, pcmd must be free. */ --} -- --u8 r8712_fw_cmd(struct _adapter *pAdapter, u32 cmd) --{ -- int pollingcnts = 50; -- -- r8712_write32(pAdapter, IOCMD_CTRL_REG, cmd); -- msleep(100); -- while ((r8712_read32(pAdapter, IOCMD_CTRL_REG != 0)) && -- (pollingcnts > 0)) { -- pollingcnts--; -- msleep(20); -- } -- if (pollingcnts == 0) -- return false; -- return true; --} -- --void r8712_fw_cmd_data(struct _adapter *pAdapter, u32 *value, u8 flag) --{ -- if (flag == 0) /* set */ -- r8712_write32(pAdapter, IOCMD_DATA_REG, *value); -- else /* query */ -- *value = r8712_read32(pAdapter, IOCMD_DATA_REG); --} -- --int r8712_cmd_thread(void *context) --{ -- struct cmd_obj *pcmd; -- unsigned int cmdsz, wr_sz; -- __le32 *pcmdbuf; -- struct tx_desc *pdesc; -- void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd); -- struct _adapter *padapter = context; -- struct cmd_priv *pcmdpriv = &padapter->cmdpriv; -- struct completion *cmd_queue_comp = -- &pcmdpriv->cmd_queue_comp; -- struct mutex *pwctrl_lock = &padapter->pwrctrlpriv.mutex_lock; -- -- allow_signal(SIGTERM); -- while (1) { -- if (wait_for_completion_interruptible(cmd_queue_comp)) -- break; -- if (padapter->driver_stopped || padapter->surprise_removed) -- break; -- if (r8712_register_cmd_alive(padapter)) -- continue; --_next: -- pcmd = r8712_dequeue_cmd(&pcmdpriv->cmd_queue); -- if (!(pcmd)) { -- r8712_unregister_cmd_alive(padapter); -- continue; -- } -- pcmdbuf = (__le32 *)pcmdpriv->cmd_buf; -- pdesc = (struct tx_desc *)pcmdbuf; -- memset(pdesc, 0, TXDESC_SIZE); -- pcmd = cmd_hdl_filter(padapter, pcmd); -- if (pcmd) { /* if pcmd != NULL, cmd will be handled by f/w */ -- struct dvobj_priv *pdvobj = &padapter->dvobjpriv; -- u8 blnPending = 0; -- u16 cmdcode = pcmd->cmdcode; -- -- pcmdpriv->cmd_issued_cnt++; -- cmdsz = round_up(pcmd->cmdsz, 8); -- wr_sz = TXDESC_SIZE + 8 + cmdsz; -- pdesc->txdw0 |= cpu_to_le32((wr_sz - TXDESC_SIZE) & -- 0x0000ffff); -- if (pdvobj->ishighspeed) { -- if ((wr_sz % 512) == 0) -- blnPending = 1; -- } else { -- if ((wr_sz % 64) == 0) -- blnPending = 1; -- } -- if (blnPending) { /* 32 bytes for TX Desc - 8 offset */ -- pdesc->txdw0 |= cpu_to_le32(((TXDESC_SIZE + -- OFFSET_SZ + 8) << OFFSET_SHT) & -- 0x00ff0000); -- } else { -- pdesc->txdw0 |= cpu_to_le32(((TXDESC_SIZE + -- OFFSET_SZ) << -- OFFSET_SHT) & -- 0x00ff0000); -- } -- pdesc->txdw0 |= cpu_to_le32(OWN | FSG | LSG); -- pdesc->txdw1 |= cpu_to_le32((0x13 << QSEL_SHT) & -- 0x00001f00); -- pcmdbuf += (TXDESC_SIZE >> 2); -- *pcmdbuf = cpu_to_le32((cmdsz & 0x0000ffff) | -- (pcmd->cmdcode << 16) | -- (pcmdpriv->cmd_seq << 24)); -- pcmdbuf += 2; /* 8 bytes alignment */ -- memcpy((u8 *)pcmdbuf, pcmd->parmbuf, pcmd->cmdsz); -- if (blnPending) -- wr_sz += 8; /* Append 8 bytes */ -- r8712_write_mem(padapter, RTL8712_DMA_H2CCMD, wr_sz, -- (u8 *)pdesc); -- pcmdpriv->cmd_seq++; -- if (cmdcode == GEN_CMD_CODE(_CreateBss)) { -- pcmd->res = H2C_SUCCESS; -- pcmd_callback = cmd_callback[cmdcode].callback; -- if (pcmd_callback) -- pcmd_callback(padapter, pcmd); -- continue; -- } -- if (cmdcode == GEN_CMD_CODE(_SetPwrMode)) { -- if (padapter->pwrctrlpriv.bSleep) { -- mutex_lock(pwctrl_lock); -- r8712_set_rpwm(padapter, PS_STATE_S2); -- mutex_unlock(pwctrl_lock); -- } -- } -- r8712_free_cmd_obj(pcmd); -- if (list_empty(&pcmdpriv->cmd_queue.queue)) { -- r8712_unregister_cmd_alive(padapter); -- continue; -- } else { -- goto _next; -- } -- } else { -- goto _next; -- } -- flush_signals_thread(); -- } -- /* free all cmd_obj resources */ -- do { -- pcmd = r8712_dequeue_cmd(&pcmdpriv->cmd_queue); -- if (!pcmd) -- break; -- r8712_free_cmd_obj(pcmd); -- } while (1); -- complete(&pcmdpriv->terminate_cmdthread_comp); -- return 0; --} -- --void r8712_event_handle(struct _adapter *padapter, __le32 *peventbuf) --{ -- u8 evt_code, evt_seq; -- u16 evt_sz; -- void (*event_callback)(struct _adapter *dev, u8 *pbuf); -- struct evt_priv *pevt_priv = &padapter->evtpriv; -- -- if (!peventbuf) -- goto _abort_event_; -- evt_sz = (u16)(le32_to_cpu(*peventbuf) & 0xffff); -- evt_seq = (u8)((le32_to_cpu(*peventbuf) >> 24) & 0x7f); -- evt_code = (u8)((le32_to_cpu(*peventbuf) >> 16) & 0xff); -- /* checking event sequence... */ -- if ((evt_seq & 0x7f) != pevt_priv->event_seq) { -- pevt_priv->event_seq = ((evt_seq + 1) & 0x7f); -- goto _abort_event_; -- } -- /* checking if event code is valid */ -- if (evt_code >= MAX_C2HEVT) { -- pevt_priv->event_seq = ((evt_seq + 1) & 0x7f); -- goto _abort_event_; -- } else if ((evt_code == GEN_EVT_CODE(_Survey)) && -- (evt_sz > sizeof(struct wlan_bssid_ex))) { -- pevt_priv->event_seq = ((evt_seq + 1) & 0x7f); -- goto _abort_event_; -- } -- /* checking if event size match the event parm size */ -- if ((wlanevents[evt_code].parmsize) && -- (wlanevents[evt_code].parmsize != evt_sz)) { -- pevt_priv->event_seq = ((evt_seq + 1) & 0x7f); -- goto _abort_event_; -- } else if ((evt_sz == 0) && (evt_code != GEN_EVT_CODE(_WPS_PBC))) { -- pevt_priv->event_seq = ((evt_seq + 1) & 0x7f); -- goto _abort_event_; -- } -- pevt_priv->event_seq++; /* update evt_seq */ -- if (pevt_priv->event_seq > 127) -- pevt_priv->event_seq = 0; -- /* move to event content, 8 bytes alignment */ -- peventbuf = peventbuf + 2; -- event_callback = wlanevents[evt_code].event_callback; -- if (event_callback) -- event_callback(padapter, (u8 *)peventbuf); -- pevt_priv->evt_done_cnt++; --_abort_event_: -- return; --} -diff --git a/drivers/staging/rtl8712/rtl8712_cmd.h b/drivers/staging/rtl8712/rtl8712_cmd.h -deleted file mode 100644 -index a34d0dd023f33b..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_cmd.h -+++ /dev/null -@@ -1,231 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __RTL8712_CMD_H_ --#define __RTL8712_CMD_H_ -- --#define CMD_HDR_SZ 8 -- --u8 r8712_fw_cmd(struct _adapter *pAdapter, u32 cmd); --void r8712_fw_cmd_data(struct _adapter *pAdapter, u32 *value, u8 flag); -- --struct cmd_hdr { -- u32 cmd_dw0; -- u32 cmd_dw1; --}; -- --enum rtl8712_h2c_cmd { -- GEN_CMD_CODE(_Read_MACREG), /*0*/ -- GEN_CMD_CODE(_Write_MACREG), -- GEN_CMD_CODE(_Read_BBREG), -- GEN_CMD_CODE(_Write_BBREG), -- GEN_CMD_CODE(_Read_RFREG), -- GEN_CMD_CODE(_Write_RFREG), /*5*/ -- GEN_CMD_CODE(_Read_EEPROM), -- GEN_CMD_CODE(_Write_EEPROM), -- GEN_CMD_CODE(_Read_EFUSE), -- GEN_CMD_CODE(_Write_EFUSE), -- -- GEN_CMD_CODE(_Read_CAM), /*10*/ -- GEN_CMD_CODE(_Write_CAM), -- GEN_CMD_CODE(_setBCNITV), -- GEN_CMD_CODE(_setMBIDCFG), -- GEN_CMD_CODE(_JoinBss), /*14*/ -- GEN_CMD_CODE(_DisConnect), /*15*/ -- GEN_CMD_CODE(_CreateBss), -- GEN_CMD_CODE(_SetOpMode), -- GEN_CMD_CODE(_SiteSurvey), /*18*/ -- GEN_CMD_CODE(_SetAuth), -- -- GEN_CMD_CODE(_SetKey), /*20*/ -- GEN_CMD_CODE(_SetStaKey), -- GEN_CMD_CODE(_SetAssocSta), -- GEN_CMD_CODE(_DelAssocSta), -- GEN_CMD_CODE(_SetStaPwrState), -- GEN_CMD_CODE(_SetBasicRate), /*25*/ -- GEN_CMD_CODE(_GetBasicRate), -- GEN_CMD_CODE(_SetDataRate), -- GEN_CMD_CODE(_GetDataRate), -- GEN_CMD_CODE(_SetPhyInfo), -- -- GEN_CMD_CODE(_GetPhyInfo), /*30*/ -- GEN_CMD_CODE(_SetPhy), -- GEN_CMD_CODE(_GetPhy), -- GEN_CMD_CODE(_readRssi), -- GEN_CMD_CODE(_readGain), -- GEN_CMD_CODE(_SetAtim), /*35*/ -- GEN_CMD_CODE(_SetPwrMode), -- GEN_CMD_CODE(_JoinbssRpt), -- GEN_CMD_CODE(_SetRaTable), -- GEN_CMD_CODE(_GetRaTable), -- -- GEN_CMD_CODE(_GetCCXReport), /*40*/ -- GEN_CMD_CODE(_GetDTMReport), -- GEN_CMD_CODE(_GetTXRateStatistics), -- GEN_CMD_CODE(_SetUsbSuspend), -- GEN_CMD_CODE(_SetH2cLbk), -- GEN_CMD_CODE(_AddBAReq), /*45*/ -- -- GEN_CMD_CODE(_SetChannel), /*46*/ --/* MP_OFFLOAD Start (47~54)*/ -- GEN_CMD_CODE(_SetTxPower), -- GEN_CMD_CODE(_SwitchAntenna), -- GEN_CMD_CODE(_SetCrystalCap), -- GEN_CMD_CODE(_SetSingleCarrierTx), /*50*/ -- GEN_CMD_CODE(_SetSingleToneTx), -- GEN_CMD_CODE(_SetCarrierSuppressionTx), -- GEN_CMD_CODE(_SetContinuousTx), -- GEN_CMD_CODE(_SwitchBandwidth), /*54*/ --/* MP_OFFLOAD End*/ -- GEN_CMD_CODE(_TX_Beacon), /*55*/ -- GEN_CMD_CODE(_SetPowerTracking), -- GEN_CMD_CODE(_AMSDU_TO_AMPDU), /*57*/ -- GEN_CMD_CODE(_SetMacAddress), /*58*/ -- -- GEN_CMD_CODE(_DisconnectCtrl), /*59*/ -- GEN_CMD_CODE(_SetChannelPlan), /*60*/ -- GEN_CMD_CODE(_DisconnectCtrlEx), /*61*/ -- -- /* To do, modify these h2c cmd, add or delete */ -- GEN_CMD_CODE(_GetH2cLbk), -- -- /* WPS extra IE */ -- GEN_CMD_CODE(_SetProbeReqExtraIE), -- GEN_CMD_CODE(_SetAssocReqExtraIE), -- GEN_CMD_CODE(_SetProbeRspExtraIE), -- GEN_CMD_CODE(_SetAssocRspExtraIE), -- -- /* the following is driver will do */ -- GEN_CMD_CODE(_GetCurDataRate), -- -- GEN_CMD_CODE(_GetTxRetrycnt), /* to record times that Tx retry to -- * transmit packet after association -- */ -- GEN_CMD_CODE(_GetRxRetrycnt), /* to record total number of the -- * received frame with ReTry bit set in -- * the WLAN header -- */ -- -- GEN_CMD_CODE(_GetBCNOKcnt), -- GEN_CMD_CODE(_GetBCNERRcnt), -- GEN_CMD_CODE(_GetCurTxPwrLevel), -- -- GEN_CMD_CODE(_SetDIG), -- GEN_CMD_CODE(_SetRA), -- GEN_CMD_CODE(_SetPT), -- GEN_CMD_CODE(_ReadTSSI), -- -- MAX_H2CCMD --}; -- --#define _GetBBReg_CMD_ _Read_BBREG_CMD_ --#define _SetBBReg_CMD_ _Write_BBREG_CMD_ --#define _GetRFReg_CMD_ _Read_RFREG_CMD_ --#define _SetRFReg_CMD_ _Write_RFREG_CMD_ --#define _DRV_INT_CMD_ (MAX_H2CCMD + 1) --#define _SetRFIntFs_CMD_ (MAX_H2CCMD + 2) -- --#ifdef _RTL8712_CMD_C_ --static struct _cmd_callback cmd_callback[] = { -- {GEN_CMD_CODE(_Read_MACREG), NULL}, /*0*/ -- {GEN_CMD_CODE(_Write_MACREG), NULL}, -- {GEN_CMD_CODE(_Read_BBREG), NULL}, -- {GEN_CMD_CODE(_Write_BBREG), NULL}, -- {GEN_CMD_CODE(_Read_RFREG), &r8712_getbbrfreg_cmdrsp_callback}, -- {GEN_CMD_CODE(_Write_RFREG), NULL}, /*5*/ -- {GEN_CMD_CODE(_Read_EEPROM), NULL}, -- {GEN_CMD_CODE(_Write_EEPROM), NULL}, -- {GEN_CMD_CODE(_Read_EFUSE), NULL}, -- {GEN_CMD_CODE(_Write_EFUSE), NULL}, -- -- {GEN_CMD_CODE(_Read_CAM), NULL}, /*10*/ -- {GEN_CMD_CODE(_Write_CAM), NULL}, -- {GEN_CMD_CODE(_setBCNITV), NULL}, -- {GEN_CMD_CODE(_setMBIDCFG), NULL}, -- {GEN_CMD_CODE(_JoinBss), &r8712_joinbss_cmd_callback}, /*14*/ -- {GEN_CMD_CODE(_DisConnect), &r8712_disassoc_cmd_callback}, /*15*/ -- {GEN_CMD_CODE(_CreateBss), &r8712_createbss_cmd_callback}, -- {GEN_CMD_CODE(_SetOpMode), NULL}, -- {GEN_CMD_CODE(_SiteSurvey), &r8712_survey_cmd_callback}, /*18*/ -- {GEN_CMD_CODE(_SetAuth), NULL}, -- -- {GEN_CMD_CODE(_SetKey), NULL}, /*20*/ -- {GEN_CMD_CODE(_SetStaKey), &r8712_setstaKey_cmdrsp_callback}, -- {GEN_CMD_CODE(_SetAssocSta), &r8712_setassocsta_cmdrsp_callback}, -- {GEN_CMD_CODE(_DelAssocSta), NULL}, -- {GEN_CMD_CODE(_SetStaPwrState), NULL}, -- {GEN_CMD_CODE(_SetBasicRate), NULL}, /*25*/ -- {GEN_CMD_CODE(_GetBasicRate), NULL}, -- {GEN_CMD_CODE(_SetDataRate), NULL}, -- {GEN_CMD_CODE(_GetDataRate), NULL}, -- {GEN_CMD_CODE(_SetPhyInfo), NULL}, -- -- {GEN_CMD_CODE(_GetPhyInfo), NULL}, /*30*/ -- {GEN_CMD_CODE(_SetPhy), NULL}, -- {GEN_CMD_CODE(_GetPhy), NULL}, -- {GEN_CMD_CODE(_readRssi), NULL}, -- {GEN_CMD_CODE(_readGain), NULL}, -- {GEN_CMD_CODE(_SetAtim), NULL}, /*35*/ -- {GEN_CMD_CODE(_SetPwrMode), NULL}, -- {GEN_CMD_CODE(_JoinbssRpt), NULL}, -- {GEN_CMD_CODE(_SetRaTable), NULL}, -- {GEN_CMD_CODE(_GetRaTable), NULL}, -- -- {GEN_CMD_CODE(_GetCCXReport), NULL}, /*40*/ -- {GEN_CMD_CODE(_GetDTMReport), NULL}, -- {GEN_CMD_CODE(_GetTXRateStatistics), NULL}, -- {GEN_CMD_CODE(_SetUsbSuspend), NULL}, -- {GEN_CMD_CODE(_SetH2cLbk), NULL}, -- {GEN_CMD_CODE(_AddBAReq), NULL}, /*45*/ -- -- {GEN_CMD_CODE(_SetChannel), NULL}, /*46*/ --/* MP_OFFLOAD Start (47~54)*/ -- {GEN_CMD_CODE(_SetTxPower), NULL}, -- {GEN_CMD_CODE(_SwitchAntenna), NULL}, -- {GEN_CMD_CODE(_SetCrystalCap), NULL}, -- {GEN_CMD_CODE(_SetSingleCarrierTx), NULL}, /*50*/ -- {GEN_CMD_CODE(_SetSingleToneTx), NULL}, -- {GEN_CMD_CODE(_SetCarrierSuppressionTx), NULL}, -- {GEN_CMD_CODE(_SetContinuousTx), NULL}, -- {GEN_CMD_CODE(_SwitchBandwidth), NULL}, /*54*/ --/* MP_OFFLOAD End*/ -- {GEN_CMD_CODE(_TX_Beacon), NULL}, /*55*/ -- {GEN_CMD_CODE(_SetPowerTracking), NULL}, -- {GEN_CMD_CODE(_AMSDU_TO_AMPDU), NULL}, /*57*/ -- {GEN_CMD_CODE(_SetMacAddress), NULL}, /*58*/ -- -- {GEN_CMD_CODE(_DisconnectCtrl), NULL}, /*59*/ -- {GEN_CMD_CODE(_SetChannelPlan), NULL}, /*60*/ -- {GEN_CMD_CODE(_DisconnectCtrlEx), NULL}, /*61*/ -- -- /* To do, modify these h2c cmd, add or delete */ -- {GEN_CMD_CODE(_GetH2cLbk), NULL}, -- -- {_SetProbeReqExtraIE_CMD_, NULL}, -- {_SetAssocReqExtraIE_CMD_, NULL}, -- {_SetProbeRspExtraIE_CMD_, NULL}, -- {_SetAssocRspExtraIE_CMD_, NULL}, -- {_GetCurDataRate_CMD_, NULL}, -- {_GetTxRetrycnt_CMD_, NULL}, -- {_GetRxRetrycnt_CMD_, NULL}, -- {_GetBCNOKcnt_CMD_, NULL}, -- {_GetBCNERRcnt_CMD_, NULL}, -- {_GetCurTxPwrLevel_CMD_, NULL}, -- {_SetDIG_CMD_, NULL}, -- {_SetRA_CMD_, NULL}, -- {_SetPT_CMD_, NULL}, -- {GEN_CMD_CODE(_ReadTSSI), &r8712_readtssi_cmdrsp_callback} --}; --#endif -- --#endif -diff --git a/drivers/staging/rtl8712/rtl8712_cmdctrl_bitdef.h b/drivers/staging/rtl8712/rtl8712_cmdctrl_bitdef.h -deleted file mode 100644 -index 68bdec07f51e85..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_cmdctrl_bitdef.h -+++ /dev/null -@@ -1,95 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- ******************************************************************************/ --#ifndef __RTL8712_CMDCTRL_BITDEF_H__ --#define __RTL8712_CMDCTRL_BITDEF_H__ -- --/* -- * 2. Command Control Registers (Offset: 0x0040 - 0x004F) -- */ --/*--------------------------------------------------------------------------*/ --/* 8192S (CMD) command register bits (Offset 0x40, 16 bits)*/ --/*--------------------------------------------------------------------------*/ --#define _APSDOFF_STATUS BIT(15) --#define _APSDOFF BIT(14) --#define _BBRSTn BIT(13) /*Enable OFDM/CCK*/ --#define _BB_GLB_RSTn BIT(12) /*Enable BB*/ --#define _SCHEDULE_EN BIT(10) /*Enable MAC scheduler*/ --#define _MACRXEN BIT(9) --#define _MACTXEN BIT(8) --#define _DDMA_EN BIT(7) /*FW off load function enable*/ --#define _FW2HW_EN BIT(6) /*MAC every module reset */ --#define _RXDMA_EN BIT(5) --#define _TXDMA_EN BIT(4) --#define _HCI_RXDMA_EN BIT(3) --#define _HCI_TXDMA_EN BIT(2) -- --/*TXPAUSE*/ --#define _STOPHCCA BIT(6) --#define _STOPHIGH BIT(5) --#define _STOPMGT BIT(4) --#define _STOPVO BIT(3) --#define _STOPVI BIT(2) --#define _STOPBE BIT(1) --#define _STOPBK BIT(0) -- --/*TCR*/ --#define _DISCW BIT(20) --#define _ICV BIT(19) --#define _CFEND_FMT BIT(17) --#define _CRC BIT(16) --#define _FWRDY BIT(7) --#define _BASECHG BIT(6) --#define _IMEM_RDY BIT(5) --#define _DMEM_CODE_DONE BIT(4) --#define _EMEM_CHK_RPT BIT(3) --#define _EMEM_CODE_DONE BIT(2) --#define _IMEM_CHK_RPT BIT(1) --#define _IMEM_CODE_DONE BIT(0) -- --#define _TXDMA_INIT_VALUE (_IMEM_CHK_RPT | _EMEM_CHK_RPT) -- --/*RCR*/ --#define _ENMBID BIT(27) --#define _APP_PHYST_RXFF BIT(25) --#define _APP_PHYST_STAFF BIT(24) --#define _CBSSID BIT(23) --#define _APWRMGT BIT(22) --#define _ADD3 BIT(21) --#define _AMF BIT(20) --#define _ACF BIT(19) --#define _ADF BIT(18) --#define _APP_MIC BIT(17) --#define _APP_ICV BIT(16) --#define _RXFTH_MSK 0x0000E000 --#define _RXFTH_SHT 13 --#define _AICV BIT(12) --#define _RXPKTLMT_MSK 0x00000FC0 --#define _RXPKTLMT_SHT 6 --#define _ACRC32 BIT(5) --#define _AB BIT(3) --#define _AM BIT(2) --#define _APM BIT(1) --#define _AAP BIT(0) -- --/*MSR*/ --#define _NETTYPE_MSK 0x03 --#define _NETTYPE_SHT 0 -- --/*BT*/ --#define _BTMODE_MSK 0x06 --#define _BTMODE_SHT 1 --#define _ENBT BIT(0) -- --/*MBIDCTRL*/ --#define _ENMBID_MODE BIT(15) --#define _BCNNO_MSK 0x7000 --#define _BCNNO_SHT 12 --#define _BCNSPACE_MSK 0x0FFF --#define _BCNSPACE_SHT 0 -- --#endif /* __RTL8712_CMDCTRL_BITDEF_H__*/ -- -diff --git a/drivers/staging/rtl8712/rtl8712_cmdctrl_regdef.h b/drivers/staging/rtl8712/rtl8712_cmdctrl_regdef.h -deleted file mode 100644 -index fc67771c89b785..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_cmdctrl_regdef.h -+++ /dev/null -@@ -1,19 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- ******************************************************************************/ --#ifndef __RTL8712_CMDCTRL_REGDEF_H__ --#define __RTL8712_CMDCTRL_REGDEF_H__ -- --#define CR (RTL8712_CMDCTRL_ + 0x0000) --#define TXPAUSE (RTL8712_CMDCTRL_ + 0x0002) --#define TCR (RTL8712_CMDCTRL_ + 0x0004) --#define RCR (RTL8712_CMDCTRL_ + 0x0008) --#define MSR (RTL8712_CMDCTRL_ + 0x000C) --#define SYSF_CFG (RTL8712_CMDCTRL_ + 0x000D) --#define MBIDCTRL (RTL8712_CMDCTRL_ + 0x000E) -- --#endif /* __RTL8712_CMDCTRL_REGDEF_H__ */ -- -diff --git a/drivers/staging/rtl8712/rtl8712_debugctrl_bitdef.h b/drivers/staging/rtl8712/rtl8712_debugctrl_bitdef.h -deleted file mode 100644 -index bb3863467f0d67..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_debugctrl_bitdef.h -+++ /dev/null -@@ -1,41 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- ******************************************************************************/ --#ifndef __RTL8712_DEBUGCTRL_BITDEF_H__ --#define __RTL8712_DEBUGCTRL_BITDEF_H__ -- --/*BIST*/ --#define _BIST_RST BIT(0) -- --/*LMS*/ --#define _LMS_MSK 0x03 -- --/*WDG_CTRL*/ --#define _OVSEL_MSK 0x0600 --#define _OVSEL_SHT 9 --#define _WDGCLR BIT(8) --#define _WDGEN_MSK 0x00FF --#define _WDGEN_SHT 0 -- --/*INTM*/ --#define _TXTIMER_MSK 0xF000 --#define _TXTIMER_SHT 12 --#define _TXNUM_MSK 0x0F00 --#define _TXNUM_SHT 8 --#define _RXTIMER_MSK 0x00F0 --#define _RXTIMER_SHT 4 --#define _RXNUM_MSK 0x000F --#define _RXNUM_SHT 0 -- --/*FDLOCKTURN0*/ --/*FDLOCKTURN1*/ --#define _TURN1 BIT(0) -- --/*FDLOCKFLAG0*/ --/*FDLOCKFLAG1*/ --#define _LOCKFLAG1_MSK 0x03 -- --#endif /* __RTL8712_DEBUGCTRL_BITDEF_H__ */ -diff --git a/drivers/staging/rtl8712/rtl8712_debugctrl_regdef.h b/drivers/staging/rtl8712/rtl8712_debugctrl_regdef.h -deleted file mode 100644 -index 319220e9d53de3..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_debugctrl_regdef.h -+++ /dev/null -@@ -1,32 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- ******************************************************************************/ --#ifndef __RTL8712_DEBUGCTRL_REGDEF_H__ --#define __RTL8712_DEBUGCTRL_REGDEF_H__ -- --#define BIST (RTL8712_DEBUGCTRL_ + 0x00) --#define DBS (RTL8712_DEBUGCTRL_ + 0x04) --#define LMS (RTL8712_DEBUGCTRL_ + 0x05) --#define CPUINST (RTL8712_DEBUGCTRL_ + 0x08) --#define CPUCAUSE (RTL8712_DEBUGCTRL_ + 0x0C) --#define LBUS_ERR_ADDR (RTL8712_DEBUGCTRL_ + 0x10) --#define LBUS_ERR_CMD (RTL8712_DEBUGCTRL_ + 0x14) --#define LBUS_ERR_DATA_L (RTL8712_DEBUGCTRL_ + 0x18) --#define LBUS_ERR_DATA_H (RTL8712_DEBUGCTRL_ + 0x1C) --#define LBUS_EXCEPTION_ADDR (RTL8712_DEBUGCTRL_ + 0x20) --#define WDG_CTRL (RTL8712_DEBUGCTRL_ + 0x24) --#define INTMTU (RTL8712_DEBUGCTRL_ + 0x28) --#define INTM (RTL8712_DEBUGCTRL_ + 0x2A) --#define FDLOCKTURN0 (RTL8712_DEBUGCTRL_ + 0x2C) --#define FDLOCKTURN1 (RTL8712_DEBUGCTRL_ + 0x2D) --#define FDLOCKFLAG0 (RTL8712_DEBUGCTRL_ + 0x2E) --#define FDLOCKFLAG1 (RTL8712_DEBUGCTRL_ + 0x2F) --#define TRXPKTBUF_DBG_DATA (RTL8712_DEBUGCTRL_ + 0x30) --#define TRXPKTBUF_DBG_CTRL (RTL8712_DEBUGCTRL_ + 0x38) --#define DPLL_MON (RTL8712_DEBUGCTRL_ + 0x3A) -- --#endif /* __RTL8712_DEBUGCTRL_REGDEF_H__ */ -- -diff --git a/drivers/staging/rtl8712/rtl8712_edcasetting_bitdef.h b/drivers/staging/rtl8712/rtl8712_edcasetting_bitdef.h -deleted file mode 100644 -index 9048d6a6529697..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_edcasetting_bitdef.h -+++ /dev/null -@@ -1,65 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __RTL8712_EDCASETTING_BITDEF_H__ --#define __RTL8712_EDCASETTING_BITDEF_H__ -- --/*EDCAPARAM*/ --#define _TXOPLIMIT_MSK 0xFFFF0000 --#define _TXOPLIMIT_SHT 16 --#define _ECWIN_MSK 0x0000FF00 --#define _ECWIN_SHT 8 --#define _AIFS_MSK 0x000000FF --#define _AIFS_SHT 0 -- --/*BCNTCFG*/ --#define _BCNECW_MSK 0xFF00 --#define _BCNECW_SHT 8 --#define _BCNIFS_MSK 0x00FF --#define _BCNIFS_SHT 0 -- --/*CWRR*/ --#define _CWRR_MSK 0x03FF -- --/*ACMAVG*/ --#define _AVG_TIME_UP BIT(3) --#define _AVGPERIOD_MSK 0x03 -- --/*ACMHWCTRL*/ --#define _VOQ_ACM_STATUS BIT(6) --#define _VIQ_ACM_STATUS BIT(5) --#define _BEQ_ACM_STATUS BIT(4) --#define _VOQ_ACM_EN BIT(3) --#define _VIQ_ACM_EN BIT(2) --#define _BEQ_ACM_EN BIT(1) --#define _ACMHWEN BIT(0) -- --/*VO_ADMTIME*/ --#define _VO_ACM_RUT BIT(18) --#define _VO_ADMTIME_MSK 0x0003FFF -- --/*VI_ADMTIME*/ --#define _VI_ACM_RUT BIT(18) --#define _VI_ADMTIME_MSK 0x0003FFF -- --/*BE_ADMTIME*/ --#define _BE_ACM_RUT BIT(18) --#define _BE_ADMTIME_MSK 0x0003FFF -- --/*Retry limit reg*/ --#define _SRL_MSK 0xFF00 --#define _SRL_SHT 8 --#define _LRL_MSK 0x00FF --#define _LRL_SHT 0 -- --#endif /* __RTL8712_EDCASETTING_BITDEF_H__*/ -diff --git a/drivers/staging/rtl8712/rtl8712_edcasetting_regdef.h b/drivers/staging/rtl8712/rtl8712_edcasetting_regdef.h -deleted file mode 100644 -index 02ec9f3bba6659..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_edcasetting_regdef.h -+++ /dev/null -@@ -1,24 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- ******************************************************************************/ --#ifndef __RTL8712_EDCASETTING_REGDEF_H__ --#define __RTL8712_EDCASETTING_REGDEF_H__ -- --#define EDCA_VO_PARAM (RTL8712_EDCASETTING_ + 0x00) --#define EDCA_VI_PARAM (RTL8712_EDCASETTING_ + 0x04) --#define EDCA_BE_PARAM (RTL8712_EDCASETTING_ + 0x08) --#define EDCA_BK_PARAM (RTL8712_EDCASETTING_ + 0x0C) --#define BCNTCFG (RTL8712_EDCASETTING_ + 0x10) --#define CWRR (RTL8712_EDCASETTING_ + 0x12) --#define ACMAVG (RTL8712_EDCASETTING_ + 0x16) --#define ACMHWCTRL (RTL8712_EDCASETTING_ + 0x17) --#define VO_ADMTIME (RTL8712_EDCASETTING_ + 0x18) --#define VI_ADMTIME (RTL8712_EDCASETTING_ + 0x1C) --#define BE_ADMTIME (RTL8712_EDCASETTING_ + 0x20) --#define RL (RTL8712_EDCASETTING_ + 0x24) -- --#endif /* __RTL8712_EDCASETTING_REGDEF_H__ */ -- -diff --git a/drivers/staging/rtl8712/rtl8712_efuse.c b/drivers/staging/rtl8712/rtl8712_efuse.c -deleted file mode 100644 -index c9400e40a1d639..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_efuse.c -+++ /dev/null -@@ -1,564 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/* -- * rtl8712_efuse.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE . -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _RTL8712_EFUSE_C_ -- --#include "osdep_service.h" --#include "drv_types.h" --#include "rtl8712_efuse.h" -- --/* reserve 3 bytes for HW stop read */ --static int efuse_available_max_size = EFUSE_MAX_SIZE - 3 /*0x1FD*/; -- --static void efuse_reg_ctrl(struct _adapter *adapter, u8 bPowerOn) --{ -- u8 tmpu8 = 0; -- -- if (bPowerOn) { -- /* -----------------e-fuse pwr & clk reg ctrl --------------- -- * Enable LDOE25 Macro Block -- */ -- tmpu8 = r8712_read8(adapter, EFUSE_TEST + 3); -- tmpu8 |= 0x80; -- r8712_write8(adapter, EFUSE_TEST + 3, tmpu8); -- msleep(20); /* for some platform , need some delay time */ -- /* Change Efuse Clock for write action to 40MHZ */ -- r8712_write8(adapter, EFUSE_CLK_CTRL, 0x03); -- msleep(20); /* for some platform , need some delay time */ -- } else { -- /* -----------------e-fuse pwr & clk reg ctrl ----------------- -- * Disable LDOE25 Macro Block -- */ -- tmpu8 = r8712_read8(adapter, EFUSE_TEST + 3); -- tmpu8 &= 0x7F; -- r8712_write8(adapter, EFUSE_TEST + 3, tmpu8); -- /* Change Efuse Clock for write action to 500K */ -- r8712_write8(adapter, EFUSE_CLK_CTRL, 0x02); -- } --} -- --/* -- * Before write E-Fuse, this function must be called. -- */ --u8 r8712_efuse_reg_init(struct _adapter *adapter) --{ -- return true; --} -- --void r8712_efuse_reg_uninit(struct _adapter *adapter) --{ -- efuse_reg_ctrl(adapter, false); --} -- --static u8 efuse_one_byte_read(struct _adapter *adapter, u16 addr, u8 *data) --{ -- u8 tmpidx = 0, bResult; -- -- /* -----------------e-fuse reg ctrl --------------------------------- */ -- r8712_write8(adapter, EFUSE_CTRL + 1, (u8)(addr & 0xFF)); /* address */ -- r8712_write8(adapter, EFUSE_CTRL + 2, ((u8)((addr >> 8) & 0x03)) | -- (r8712_read8(adapter, EFUSE_CTRL + 2) & 0xFC)); -- r8712_write8(adapter, EFUSE_CTRL + 3, 0x72); /* read cmd */ -- /* wait for complete */ -- while (!(0x80 & r8712_read8(adapter, EFUSE_CTRL + 3)) && -- (tmpidx < 100)) -- tmpidx++; -- if (tmpidx < 100) { -- *data = r8712_read8(adapter, EFUSE_CTRL); -- bResult = true; -- } else { -- *data = 0xff; -- bResult = false; -- } -- return bResult; --} -- --static u8 efuse_one_byte_write(struct _adapter *adapter, u16 addr, u8 data) --{ -- u8 tmpidx = 0, bResult; -- -- /* -----------------e-fuse reg ctrl -------------------------------- */ -- r8712_write8(adapter, EFUSE_CTRL + 1, (u8)(addr & 0xFF)); /* address */ -- r8712_write8(adapter, EFUSE_CTRL + 2, ((u8)((addr >> 8) & 0x03)) | -- (r8712_read8(adapter, EFUSE_CTRL + 2) & 0xFC)); -- r8712_write8(adapter, EFUSE_CTRL, data); /* data */ -- r8712_write8(adapter, EFUSE_CTRL + 3, 0xF2); /* write cmd */ -- /* wait for complete */ -- while ((0x80 & r8712_read8(adapter, EFUSE_CTRL + 3)) && -- (tmpidx < 100)) -- tmpidx++; -- if (tmpidx < 100) -- bResult = true; -- else -- bResult = false; -- return bResult; --} -- --static u8 efuse_one_byte_rw(struct _adapter *adapter, u8 bRead, u16 addr, -- u8 *data) --{ -- u8 tmpidx = 0, tmpv8 = 0, bResult; -- -- /* -----------------e-fuse reg ctrl --------------------------------- */ -- r8712_write8(adapter, EFUSE_CTRL + 1, (u8)(addr & 0xFF)); /* address */ -- tmpv8 = ((u8)((addr >> 8) & 0x03)) | -- (r8712_read8(adapter, EFUSE_CTRL + 2) & 0xFC); -- r8712_write8(adapter, EFUSE_CTRL + 2, tmpv8); -- if (bRead) { -- r8712_write8(adapter, EFUSE_CTRL + 3, 0x72); /* read cmd */ -- while (!(0x80 & r8712_read8(adapter, EFUSE_CTRL + 3)) && -- (tmpidx < 100)) -- tmpidx++; -- if (tmpidx < 100) { -- *data = r8712_read8(adapter, EFUSE_CTRL); -- bResult = true; -- } else { -- *data = 0; -- bResult = false; -- } -- } else { -- r8712_write8(adapter, EFUSE_CTRL, *data); /* data */ -- r8712_write8(adapter, EFUSE_CTRL + 3, 0xF2); /* write cmd */ -- while ((0x80 & r8712_read8(adapter, EFUSE_CTRL + 3)) && -- (tmpidx < 100)) -- tmpidx++; -- if (tmpidx < 100) -- bResult = true; -- else -- bResult = false; -- } -- return bResult; --} -- --static u8 efuse_is_empty(struct _adapter *adapter, u8 *empty) --{ -- u8 value, ret = true; -- -- /* read one byte to check if E-Fuse is empty */ -- if (efuse_one_byte_rw(adapter, true, 0, &value)) { -- if (value == 0xFF) -- *empty = true; -- else -- *empty = false; -- } else { -- ret = false; -- } -- return ret; --} -- --void r8712_efuse_change_max_size(struct _adapter *adapter) --{ -- u16 pre_pg_data_saddr = 0x1FB; -- u16 i; -- u16 pre_pg_data_size = 5; -- u8 pre_pg_data[5]; -- -- for (i = 0; i < pre_pg_data_size; i++) -- efuse_one_byte_read(adapter, pre_pg_data_saddr + i, -- &pre_pg_data[i]); -- if ((pre_pg_data[0] == 0x03) && (pre_pg_data[1] == 0x00) && -- (pre_pg_data[2] == 0x00) && (pre_pg_data[3] == 0x00) && -- (pre_pg_data[4] == 0x0C)) -- efuse_available_max_size -= pre_pg_data_size; --} -- --int r8712_efuse_get_max_size(struct _adapter *adapter) --{ -- return efuse_available_max_size; --} -- --static u8 calculate_word_cnts(const u8 word_en) --{ -- u8 word_cnts = 0; -- u8 word_idx; -- -- for (word_idx = 0; word_idx < PGPKG_MAX_WORDS; word_idx++) -- if (!(word_en & BIT(word_idx))) -- word_cnts++; /* 0 : write enable */ -- return word_cnts; --} -- --static void pgpacket_copy_data(const u8 word_en, const u8 *sourdata, -- u8 *targetdata) --{ -- u8 tmpindex = 0; -- u8 word_idx, byte_idx; -- -- for (word_idx = 0; word_idx < PGPKG_MAX_WORDS; word_idx++) { -- if (!(word_en & BIT(word_idx))) { -- byte_idx = word_idx * 2; -- targetdata[byte_idx] = sourdata[tmpindex++]; -- targetdata[byte_idx + 1] = sourdata[tmpindex++]; -- } -- } --} -- --u16 r8712_efuse_get_current_size(struct _adapter *adapter) --{ -- int bContinual = true; -- u16 efuse_addr = 0; -- u8 hworden = 0; -- u8 efuse_data, word_cnts = 0; -- -- while (bContinual && efuse_one_byte_read(adapter, efuse_addr, -- &efuse_data) && (efuse_addr < efuse_available_max_size)) { -- if (efuse_data != 0xFF) { -- hworden = efuse_data & 0x0F; -- word_cnts = calculate_word_cnts(hworden); -- /* read next header */ -- efuse_addr = efuse_addr + (word_cnts * 2) + 1; -- } else { -- bContinual = false; -- } -- } -- return efuse_addr; --} -- --u8 r8712_efuse_pg_packet_read(struct _adapter *adapter, u8 offset, u8 *data) --{ -- u8 hoffset = 0, hworden = 0, word_cnts = 0; -- u16 efuse_addr = 0; -- u8 efuse_data; -- u8 tmpidx = 0; -- u8 tmpdata[PGPKT_DATA_SIZE]; -- u8 ret = true; -- -- if (!data) -- return false; -- if (offset > 0x0f) -- return false; -- memset(data, 0xFF, sizeof(u8) * PGPKT_DATA_SIZE); -- while (efuse_addr < efuse_available_max_size) { -- if (efuse_one_byte_read(adapter, efuse_addr, &efuse_data)) { -- if (efuse_data == 0xFF) -- break; -- hoffset = (efuse_data >> 4) & 0x0F; -- hworden = efuse_data & 0x0F; -- word_cnts = calculate_word_cnts(hworden); -- if (hoffset == offset) { -- memset(tmpdata, 0xFF, PGPKT_DATA_SIZE); -- for (tmpidx = 0; tmpidx < word_cnts * 2; -- tmpidx++) { -- if (efuse_one_byte_read(adapter, -- efuse_addr + 1 + tmpidx, -- &efuse_data)) { -- tmpdata[tmpidx] = efuse_data; -- } else { -- ret = false; -- } -- } -- pgpacket_copy_data(hworden, tmpdata, data); -- } -- efuse_addr += 1 + (word_cnts * 2); -- } else { -- ret = false; -- break; -- } -- } -- return ret; --} -- --static u8 fix_header(struct _adapter *adapter, u8 header, u16 header_addr) --{ -- struct PGPKT_STRUCT pkt; -- u8 offset, word_en, value; -- u16 addr; -- int i; -- u8 ret = true; -- -- pkt.offset = GET_EFUSE_OFFSET(header); -- pkt.word_en = GET_EFUSE_WORD_EN(header); -- addr = header_addr + 1 + calculate_word_cnts(pkt.word_en) * 2; -- if (addr > efuse_available_max_size) -- return false; -- /* retrieve original data */ -- addr = 0; -- while (addr < header_addr) { -- if (!efuse_one_byte_read(adapter, addr++, &value)) { -- ret = false; -- break; -- } -- offset = GET_EFUSE_OFFSET(value); -- word_en = GET_EFUSE_WORD_EN(value); -- if (pkt.offset != offset) { -- addr += calculate_word_cnts(word_en) * 2; -- continue; -- } -- for (i = 0; i < PGPKG_MAX_WORDS; i++) { -- if (!(BIT(i) & word_en)) -- continue; -- if (BIT(i) & pkt.word_en) { -- if (efuse_one_byte_read(adapter, -- addr, -- &value)) -- pkt.data[i * 2] = value; -- else -- return false; -- if (efuse_one_byte_read(adapter, -- addr + 1, -- &value)) -- pkt.data[i * 2 + 1] = value; -- else -- return false; -- } -- addr += 2; -- } -- } -- if (addr != header_addr) -- return false; -- addr++; -- /* fill original data */ -- for (i = 0; i < PGPKG_MAX_WORDS; i++) { -- if (BIT(i) & pkt.word_en) { -- efuse_one_byte_write(adapter, addr, pkt.data[i * 2]); -- efuse_one_byte_write(adapter, addr + 1, -- pkt.data[i * 2 + 1]); -- /* additional check */ -- if (!efuse_one_byte_read(adapter, addr, &value)) { -- ret = false; -- } else if (pkt.data[i * 2] != value) { -- ret = false; -- if (value == 0xFF) /* write again */ -- efuse_one_byte_write(adapter, addr, -- pkt.data[i * 2]); -- } -- if (!efuse_one_byte_read(adapter, addr + 1, &value)) { -- ret = false; -- } else if (pkt.data[i * 2 + 1] != value) { -- ret = false; -- if (value == 0xFF) /* write again */ -- efuse_one_byte_write(adapter, addr + 1, -- pkt.data[i * 2 + -- 1]); -- } -- } -- addr += 2; -- } -- return ret; --} -- --u8 r8712_efuse_pg_packet_write(struct _adapter *adapter, const u8 offset, -- const u8 word_en, const u8 *data) --{ -- u8 pg_header = 0; -- u16 efuse_addr = 0, curr_size = 0; -- u8 efuse_data, target_word_cnts = 0; -- int repeat_times; -- int sub_repeat; -- u8 bResult = true; -- -- /* check if E-Fuse Clock Enable and E-Fuse Clock is 40M */ -- efuse_data = r8712_read8(adapter, EFUSE_CLK_CTRL); -- if (efuse_data != 0x03) -- return false; -- pg_header = MAKE_EFUSE_HEADER(offset, word_en); -- target_word_cnts = calculate_word_cnts(word_en); -- repeat_times = 0; -- efuse_addr = 0; -- while (efuse_addr < efuse_available_max_size) { -- curr_size = r8712_efuse_get_current_size(adapter); -- if ((curr_size + 1 + target_word_cnts * 2) > -- efuse_available_max_size) -- return false; /*target_word_cnts + pg header(1 byte)*/ -- efuse_addr = curr_size; /* current size is also the last addr*/ -- efuse_one_byte_write(adapter, efuse_addr, pg_header); /*hdr*/ -- sub_repeat = 0; -- /* check if what we read is what we write */ -- while (!efuse_one_byte_read(adapter, efuse_addr, -- &efuse_data)) { -- if (++sub_repeat > _REPEAT_THRESHOLD_) { -- bResult = false; /* continue to blind write */ -- break; /* continue to blind write */ -- } -- } -- if ((sub_repeat > _REPEAT_THRESHOLD_) || -- (pg_header == efuse_data)) { -- /* write header ok OR can't check header(creep) */ -- u8 i; -- -- /* go to next address */ -- efuse_addr++; -- for (i = 0; i < target_word_cnts * 2; i++) { -- efuse_one_byte_write(adapter, -- efuse_addr + i, -- *(data + i)); -- if (!efuse_one_byte_read(adapter, -- efuse_addr + i, -- &efuse_data)) -- bResult = false; -- else if (*(data + i) != efuse_data) /* fail */ -- bResult = false; -- } -- break; -- } -- /* write header fail */ -- bResult = false; -- if (efuse_data == 0xFF) -- return bResult; /* nothing damaged. */ -- /* call rescue procedure */ -- if (!fix_header(adapter, efuse_data, efuse_addr)) -- return false; /* rescue fail */ -- -- if (++repeat_times > _REPEAT_THRESHOLD_) /* fail */ -- break; -- /* otherwise, take another risk... */ -- } -- return bResult; --} -- --u8 r8712_efuse_access(struct _adapter *adapter, u8 bRead, u16 start_addr, -- u16 cnts, u8 *data) --{ -- int i; -- u8 res = true; -- -- if (start_addr > EFUSE_MAX_SIZE) -- return false; -- if (!bRead && ((start_addr + cnts) > -- efuse_available_max_size)) -- return false; -- if (!bRead && !r8712_efuse_reg_init(adapter)) -- return false; -- /* -----------------e-fuse one byte read / write ---------------------*/ -- for (i = 0; i < cnts; i++) { -- if ((start_addr + i) > EFUSE_MAX_SIZE) { -- res = false; -- break; -- } -- res = efuse_one_byte_rw(adapter, bRead, start_addr + i, -- data + i); -- if (!bRead && !res) -- break; -- } -- if (!bRead) -- r8712_efuse_reg_uninit(adapter); -- return res; --} -- --u8 r8712_efuse_map_read(struct _adapter *adapter, u16 addr, u16 cnts, u8 *data) --{ -- u8 offset, ret = true; -- u8 pktdata[PGPKT_DATA_SIZE]; -- int i, idx; -- -- if ((addr + cnts) > EFUSE_MAP_MAX_SIZE) -- return false; -- if (efuse_is_empty(adapter, &offset) && offset) { -- for (i = 0; i < cnts; i++) -- data[i] = 0xFF; -- return ret; -- } -- offset = (addr >> 3) & 0xF; -- ret = r8712_efuse_pg_packet_read(adapter, offset, pktdata); -- i = addr & 0x7; /* pktdata index */ -- idx = 0; /* data index */ -- -- do { -- for (; i < PGPKT_DATA_SIZE; i++) { -- data[idx++] = pktdata[i]; -- if (idx == cnts) -- return ret; -- } -- offset++; -- if (!r8712_efuse_pg_packet_read(adapter, offset, pktdata)) -- ret = false; -- i = 0; -- } while (1); -- return ret; --} -- --u8 r8712_efuse_map_write(struct _adapter *adapter, u16 addr, u16 cnts, -- u8 *data) --{ -- u8 offset, word_en, empty; -- u8 pktdata[PGPKT_DATA_SIZE], newdata[PGPKT_DATA_SIZE]; -- int i, j, idx; -- -- if ((addr + cnts) > EFUSE_MAP_MAX_SIZE) -- return false; -- /* check if E-Fuse Clock Enable and E-Fuse Clock is 40M */ -- empty = r8712_read8(adapter, EFUSE_CLK_CTRL); -- if (empty != 0x03) -- return false; -- if (efuse_is_empty(adapter, &empty)) { -- if (empty) -- memset(pktdata, 0xFF, PGPKT_DATA_SIZE); -- } else { -- return false; -- } -- offset = (addr >> 3) & 0xF; -- if (!empty) -- if (!r8712_efuse_pg_packet_read(adapter, offset, pktdata)) -- return false; -- word_en = 0xF; -- memset(newdata, 0xFF, PGPKT_DATA_SIZE); -- i = addr & 0x7; /* pktdata index */ -- j = 0; /* newdata index */ -- idx = 0; /* data index */ -- -- if (i & 0x1) { -- /* odd start */ -- if (data[idx] != pktdata[i]) { -- word_en &= ~BIT(i >> 1); -- newdata[j++] = pktdata[i - 1]; -- newdata[j++] = data[idx]; -- } -- i++; -- idx++; -- } -- do { -- for (; i < PGPKT_DATA_SIZE; i += 2) { -- if ((cnts - idx) == 1) { -- if (data[idx] != pktdata[i]) { -- word_en &= ~BIT(i >> 1); -- newdata[j++] = data[idx]; -- newdata[j++] = pktdata[1 + 1]; -- } -- idx++; -- break; -- } -- -- if ((data[idx] != pktdata[i]) || (data[idx + 1] != -- pktdata[i + 1])) { -- word_en &= ~BIT(i >> 1); -- newdata[j++] = data[idx]; -- newdata[j++] = data[idx + 1]; -- } -- idx += 2; -- -- if (idx == cnts) -- break; -- } -- -- if (word_en != 0xF) -- if (!r8712_efuse_pg_packet_write(adapter, offset, -- word_en, newdata)) -- return false; -- if (idx == cnts) -- break; -- offset++; -- if (!empty) -- if (!r8712_efuse_pg_packet_read(adapter, offset, -- pktdata)) -- return false; -- i = 0; -- j = 0; -- word_en = 0xF; -- memset(newdata, 0xFF, PGPKT_DATA_SIZE); -- } while (1); -- -- return true; --} -diff --git a/drivers/staging/rtl8712/rtl8712_efuse.h b/drivers/staging/rtl8712/rtl8712_efuse.h -deleted file mode 100644 -index 7a49740212eb5c..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_efuse.h -+++ /dev/null -@@ -1,44 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --#ifndef __RTL8712_EFUSE_H__ --#define __RTL8712_EFUSE_H__ -- --#include "osdep_service.h" -- --#define _REPEAT_THRESHOLD_ 3 -- --#define EFUSE_MAX_SIZE 512 --#define EFUSE_MAP_MAX_SIZE 128 -- --#define PGPKG_MAX_WORDS 4 --#define PGPKT_DATA_SIZE 8 /* PGPKG_MAX_WORDS*2; BYTES sizeof(u8)*8*/ --#define MAX_PGPKT_SIZE 9 /* 1 + PGPKT_DATA_SIZE; header + 2 * 4 words (BYTES)*/ -- --#define GET_EFUSE_OFFSET(header) ((header & 0xF0) >> 4) --#define GET_EFUSE_WORD_EN(header) (header & 0x0F) --#define MAKE_EFUSE_HEADER(offset, word_en) ((((offset) & 0x0F) << 4) | \ -- ((word_en) & 0x0F)) --/*--------------------------------------------------------------------------*/ --struct PGPKT_STRUCT { -- u8 offset; -- u8 word_en; -- u8 data[PGPKT_DATA_SIZE]; --}; -- --/*--------------------------------------------------------------------------*/ --u8 r8712_efuse_reg_init(struct _adapter *padapter); --void r8712_efuse_reg_uninit(struct _adapter *padapter); --u16 r8712_efuse_get_current_size(struct _adapter *padapter); --int r8712_efuse_get_max_size(struct _adapter *padapter); --void r8712_efuse_change_max_size(struct _adapter *padapter); --u8 r8712_efuse_pg_packet_read(struct _adapter *padapter, -- u8 offset, u8 *data); --u8 r8712_efuse_pg_packet_write(struct _adapter *padapter, -- const u8 offset, const u8 word_en, -- const u8 *data); --u8 r8712_efuse_access(struct _adapter *padapter, u8 bRead, -- u16 start_addr, u16 cnts, u8 *data); --u8 r8712_efuse_map_read(struct _adapter *padapter, u16 addr, -- u16 cnts, u8 *data); --u8 r8712_efuse_map_write(struct _adapter *padapter, u16 addr, -- u16 cnts, u8 *data); --#endif -diff --git a/drivers/staging/rtl8712/rtl8712_event.h b/drivers/staging/rtl8712/rtl8712_event.h -deleted file mode 100644 -index 0d3e5feadcc010..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_event.h -+++ /dev/null -@@ -1,86 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef _RTL8712_EVENT_H_ --#define _RTL8712_EVENT_H_ -- --void r8712_event_handle(struct _adapter *padapter, __le32 *peventbuf); --void r8712_got_addbareq_event_callback(struct _adapter *adapter, u8 *pbuf); -- --enum rtl8712_c2h_event { -- GEN_EVT_CODE(_Read_MACREG) = 0, /*0*/ -- GEN_EVT_CODE(_Read_BBREG), -- GEN_EVT_CODE(_Read_RFREG), -- GEN_EVT_CODE(_Read_EEPROM), -- GEN_EVT_CODE(_Read_EFUSE), -- GEN_EVT_CODE(_Read_CAM), /*5*/ -- GEN_EVT_CODE(_Get_BasicRate), -- GEN_EVT_CODE(_Get_DataRate), -- GEN_EVT_CODE(_Survey), /*8*/ -- GEN_EVT_CODE(_SurveyDone), /*9*/ -- -- GEN_EVT_CODE(_JoinBss), /*10*/ -- GEN_EVT_CODE(_AddSTA), -- GEN_EVT_CODE(_DelSTA), -- GEN_EVT_CODE(_AtimDone), -- GEN_EVT_CODE(_TX_Report), -- GEN_EVT_CODE(_CCX_Report), /*15*/ -- GEN_EVT_CODE(_DTM_Report), -- GEN_EVT_CODE(_TX_Rate_Statistics), -- GEN_EVT_CODE(_C2HLBK), -- GEN_EVT_CODE(_FWDBG), -- GEN_EVT_CODE(_C2HFEEDBACK), /*20*/ -- GEN_EVT_CODE(_ADDBA), -- GEN_EVT_CODE(_C2HBCN), -- GEN_EVT_CODE(_ReportPwrState), /*filen: only for PCIE, USB*/ -- GEN_EVT_CODE(_WPS_PBC), /*24*/ -- GEN_EVT_CODE(_ADDBAReq_Report), /*25*/ -- MAX_C2HEVT --}; -- --#ifdef _RTL8712_CMD_C_ -- --static struct fwevent wlanevents[] = { -- {0, NULL}, /*0*/ -- {0, NULL}, -- {0, NULL}, -- {0, NULL}, -- {0, NULL}, -- {0, NULL}, -- {0, NULL}, -- {0, NULL}, -- {0, &r8712_survey_event_callback}, /*8*/ -- {sizeof(struct surveydone_event), -- &r8712_surveydone_event_callback}, /*9*/ -- -- {0, &r8712_joinbss_event_callback}, /*10*/ -- {sizeof(struct stassoc_event), &r8712_stassoc_event_callback}, -- {sizeof(struct stadel_event), &r8712_stadel_event_callback}, -- {0, &r8712_atimdone_event_callback}, -- {0, NULL}, -- {0, NULL}, /*15*/ -- {0, NULL}, -- {0, NULL}, -- {0, NULL}, -- {0, NULL}, /*fwdbg_event_callback},*/ -- {0, NULL}, /*20*/ -- {0, NULL}, -- {0, NULL}, -- {0, &r8712_cpwm_event_callback}, -- {0, &r8712_wpspbc_event_callback}, -- {0, &r8712_got_addbareq_event_callback}, --}; -- --#endif/*_RTL8712_CMD_C_*/ -- --#endif -diff --git a/drivers/staging/rtl8712/rtl8712_fifoctrl_bitdef.h b/drivers/staging/rtl8712/rtl8712_fifoctrl_bitdef.h -deleted file mode 100644 -index f09645fa1886e4..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_fifoctrl_bitdef.h -+++ /dev/null -@@ -1,131 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- ******************************************************************************/ --#ifndef __RTL8712_FIFOCTRL_BITDEF_H__ --#define __RTL8712_FIFOCTRL_BITDEF_H__ -- --/*PBP*/ --#define _PSTX_MSK 0xF0 --#define _PSTX_SHT 4 --#define _PSRX_MSK 0x0F --#define _PSRX_SHT 0 -- --/*TXFF_STATUS*/ --#define _TXSTATUS_OVF BIT(15) -- --/*RXFF_STATUS*/ --#define _STATUSFF1_OVF BIT(7) --#define _STATUSFF1_EMPTY BIT(6) --#define _STATUSFF0_OVF BIT(5) --#define _STATUSFF0_EMPTY BIT(4) --#define _RXFF1_OVF BIT(3) --#define _RXFF1_EMPTY BIT(2) --#define _RXFF0_OVF BIT(1) --#define _RXFF0_EMPTY BIT(0) -- --/*TXFF_EMPTY_TH*/ --#define _BKQ_EMPTY_TH_MSK 0x0F0000 --#define _BKQ_EMPTY_TH_SHT 16 --#define _BEQ_EMPTY_TH_MSK 0x00F000 --#define _BEQ_EMPTY_TH_SHT 12 --#define _VIQ_EMPTY_TH_MSK 0x000F00 --#define _VIQ_EMPTY_TH_SHT 8 --#define _VOQ_EMPTY_TH_MSK 0x0000F0 --#define _VOQ_EMPTY_TH_SHT 4 --#define _BMCQ_EMPTY_TH_MSK 0x00000F --#define _BMCQ_EMPTY_TH_SHT 0 -- --/*SDIO_RX_BLKSZ*/ --#define _SDIO_RX_BLKSZ_MSK 0x07 -- --/*RXDMA_CTRL*/ --#define _C2HFF_POLL BIT(4) --#define _RXPKT_POLL BIT(0) -- --/*RXPKT_NUM*/ --#define _RXCMD_NUM_MSK 0xFF00 --#define _RXCMD_NUM_SHT 8 --#define _RXFF0_NUM_MSK 0x00FF --#define _RXFF0_NUM_SHT 0 -- --/*FIFOPAGE2*/ --#define _PUB_AVAL_PG_MSK 0xFFFF0000 --#define _PUB_AVAL_PG_SHT 16 --#define _BCN_AVAL_PG_MSK 0x0000FFFF --#define _BCN_AVAL_PG_SHT 0 -- --/*RX0PKTNUM*/ --#define _RXFF0_DEC_POLL BIT(15) --#define _RXFF0_PKT_DEC_NUM_MSK 0x3F00 --#define _RXFF0_PKT_DEC_NUM_SHT 8 --#define _RXFF0_PKTNUM_RPT_MSK 0x00FF --#define _RXFF0_PKTNUM_RPT_SHT 0 -- --/*RX1PKTNUM*/ --#define _RXFF1_DEC_POLL BIT(15) --#define _RXFF1_PKT_DEC_NUM_MSK 0x3F00 --#define _RXFF1_PKT_DEC_NUM_SHT 8 --#define _RXFF1_PKTNUM_RPT_MSK 0x00FF --#define _RXFF1_PKTNUM_RPT_SHT 0 -- --/*RXFLTMAP0*/ --#define _MGTFLT13EN BIT(13) --#define _MGTFLT12EN BIT(12) --#define _MGTFLT11EN BIT(11) --#define _MGTFLT10EN BIT(10) --#define _MGTFLT9EN BIT(9) --#define _MGTFLT8EN BIT(8) --#define _MGTFLT5EN BIT(5) --#define _MGTFLT4EN BIT(4) --#define _MGTFLT3EN BIT(3) --#define _MGTFLT2EN BIT(2) --#define _MGTFLT1EN BIT(1) --#define _MGTFLT0EN BIT(0) -- --/*RXFLTMAP1*/ --#define _CTRLFLT15EN BIT(15) --#define _CTRLFLT14EN BIT(14) --#define _CTRLFLT13EN BIT(13) --#define _CTRLFLT12EN BIT(12) --#define _CTRLFLT11EN BIT(11) --#define _CTRLFLT10EN BIT(10) --#define _CTRLFLT9EN BIT(9) --#define _CTRLFLT8EN BIT(8) --#define _CTRLFLT7EN BIT(7) --#define _CTRLFLT6EN BIT(6) -- --/*RXFLTMAP2*/ --#define _DATAFLT15EN BIT(15) --#define _DATAFLT14EN BIT(14) --#define _DATAFLT13EN BIT(13) --#define _DATAFLT12EN BIT(12) --#define _DATAFLT11EN BIT(11) --#define _DATAFLT10EN BIT(10) --#define _DATAFLT9EN BIT(9) --#define _DATAFLT8EN BIT(8) --#define _DATAFLT7EN BIT(7) --#define _DATAFLT6EN BIT(6) --#define _DATAFLT5EN BIT(5) --#define _DATAFLT4EN BIT(4) --#define _DATAFLT3EN BIT(3) --#define _DATAFLT2EN BIT(2) --#define _DATAFLT1EN BIT(1) --#define _DATAFLT0EN BIT(0) -- --/*RXFLTMAP3*/ --#define _MESHAFLT1EN BIT(1) --#define _MESHAFLT0EN BIT(0) -- --/*TXPKT_NUM_CTRL*/ --#define _TXPKTNUM_DEC BIT(8) --#define _TXPKTNUM_MSK 0x00FF --#define _TXPKTNUM_SHT 0 -- --/*TXFF_PG_NUM*/ --#define _TXFF_PG_NUM_MSK 0x0FFF -- --#endif /* __RTL8712_FIFOCTRL_BITDEF_H__ */ -- -diff --git a/drivers/staging/rtl8712/rtl8712_fifoctrl_regdef.h b/drivers/staging/rtl8712/rtl8712_fifoctrl_regdef.h -deleted file mode 100644 -index 189fdeb16d7d31..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_fifoctrl_regdef.h -+++ /dev/null -@@ -1,61 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- ******************************************************************************/ --#ifndef __RTL8712_FIFOCTRL_REGDEF_H__ --#define __RTL8712_FIFOCTRL_REGDEF_H__ -- --#define RQPN (RTL8712_FIFOCTRL_ + 0x00) --#define RXFF_BNDY (RTL8712_FIFOCTRL_ + 0x0C) --#define RXRPT_BNDY (RTL8712_FIFOCTRL_ + 0x10) --#define TXPKTBUF_PGBNDY (RTL8712_FIFOCTRL_ + 0x14) --#define PBP (RTL8712_FIFOCTRL_ + 0x15) --#define RX_DRVINFO_SZ (RTL8712_FIFOCTRL_ + 0x16) --#define TXFF_STATUS (RTL8712_FIFOCTRL_ + 0x17) --#define RXFF_STATUS (RTL8712_FIFOCTRL_ + 0x18) --#define TXFF_EMPTY_TH (RTL8712_FIFOCTRL_ + 0x19) --#define SDIO_RX_BLKSZ (RTL8712_FIFOCTRL_ + 0x1C) --#define RXDMA_RXCTRL (RTL8712_FIFOCTRL_ + 0x1D) --#define RXPKT_NUM (RTL8712_FIFOCTRL_ + 0x1E) --#define RXPKT_NUM_C2H (RTL8712_FIFOCTRL_ + 0x1F) --#define C2HCMD_UDT_SIZE (RTL8712_FIFOCTRL_ + 0x20) --#define C2HCMD_UDT_ADDR (RTL8712_FIFOCTRL_ + 0x22) --#define FIFOPAGE2 (RTL8712_FIFOCTRL_ + 0x24) --#define FIFOPAGE1 (RTL8712_FIFOCTRL_ + 0x28) --#define FW_RSVD_PG_CTRL (RTL8712_FIFOCTRL_ + 0x30) --#define TXRPTFF_RDPTR (RTL8712_FIFOCTRL_ + 0x40) --#define TXRPTFF_WTPTR (RTL8712_FIFOCTRL_ + 0x44) --#define C2HFF_RDPTR (RTL8712_FIFOCTRL_ + 0x48) --#define C2HFF_WTPTR (RTL8712_FIFOCTRL_ + 0x4C) --#define RXFF0_RDPTR (RTL8712_FIFOCTRL_ + 0x50) --#define RXFF0_WTPTR (RTL8712_FIFOCTRL_ + 0x54) --#define RXFF1_RDPTR (RTL8712_FIFOCTRL_ + 0x58) --#define RXFF1_WTPTR (RTL8712_FIFOCTRL_ + 0x5C) --#define RXRPT0FF_RDPTR (RTL8712_FIFOCTRL_ + 0x60) --#define RXRPT0FF_WTPTR (RTL8712_FIFOCTRL_ + 0x64) --#define RXRPT1FF_RDPTR (RTL8712_FIFOCTRL_ + 0x68) --#define RXRPT1FF_WTPTR (RTL8712_FIFOCTRL_ + 0x6C) --#define RX0PKTNUM (RTL8712_FIFOCTRL_ + 0x72) --#define RX1PKTNUM (RTL8712_FIFOCTRL_ + 0x74) --#define RXFLTMAP0 (RTL8712_FIFOCTRL_ + 0x76) --#define RXFLTMAP1 (RTL8712_FIFOCTRL_ + 0x78) --#define RXFLTMAP2 (RTL8712_FIFOCTRL_ + 0x7A) --#define RXFLTMAP3 (RTL8712_FIFOCTRL_ + 0x7c) --#define TBDA (RTL8712_FIFOCTRL_ + 0x84) --#define THPDA (RTL8712_FIFOCTRL_ + 0x88) --#define TCDA (RTL8712_FIFOCTRL_ + 0x8C) --#define TMDA (RTL8712_FIFOCTRL_ + 0x90) --#define HDA (RTL8712_FIFOCTRL_ + 0x94) --#define TVODA (RTL8712_FIFOCTRL_ + 0x98) --#define TVIDA (RTL8712_FIFOCTRL_ + 0x9C) --#define TBEDA (RTL8712_FIFOCTRL_ + 0xA0) --#define TBKDA (RTL8712_FIFOCTRL_ + 0xA4) --#define RCDA (RTL8712_FIFOCTRL_ + 0xA8) --#define RDSA (RTL8712_FIFOCTRL_ + 0xAC) --#define TXPKT_NUM_CTRL (RTL8712_FIFOCTRL_ + 0xB0) --#define TXQ_PGADD (RTL8712_FIFOCTRL_ + 0xB3) --#define TXFF_PG_NUM (RTL8712_FIFOCTRL_ + 0xB4) -- --#endif /* __RTL8712_FIFOCTRL_REGDEF_H__ */ -diff --git a/drivers/staging/rtl8712/rtl8712_gp_bitdef.h b/drivers/staging/rtl8712/rtl8712_gp_bitdef.h -deleted file mode 100644 -index ee651fb3fde3fc..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_gp_bitdef.h -+++ /dev/null -@@ -1,68 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __RTL8712_GP_BITDEF_H__ --#define __RTL8712_GP_BITDEF_H__ -- --/*GPIO_CTRL*/ --#define _GPIO_MOD_MSK 0xFF000000 --#define _GPIO_MOD_SHT 24 --#define _GPIO_IO_SEL_MSK 0x00FF0000 --#define _GPIO_IO_SEL_SHT 16 --#define _GPIO_OUT_MSK 0x0000FF00 --#define _GPIO_OUT_SHT 8 --#define _GPIO_IN_MSK 0x000000FF --#define _GPIO_IN_SHT 0 -- --/*SYS_PINMUX_CFG*/ --#define _GPIOSEL_MSK 0x0003 --#define _GPIOSEL_SHT 0 -- --/*LED_CFG*/ --#define _LED1SV BIT(7) --#define _LED1CM_MSK 0x0070 --#define _LED1CM_SHT 4 --#define _LED0SV BIT(3) --#define _LED0CM_MSK 0x0007 --#define _LED0CM_SHT 0 -- --/*PHY_REG*/ --#define _HST_RDRDY_SHT 0 --#define _HST_RDRDY_MSK 0xFF --#define _HST_RDRDY BIT(_HST_RDRDY_SHT) --#define _CPU_WTBUSY_SHT 1 --#define _CPU_WTBUSY_MSK 0xFF --#define _CPU_WTBUSY BIT(_CPU_WTBUSY_SHT) -- --/* 11. General Purpose Registers (Offset: 0x02E0 - 0x02FF)*/ -- --/* 8192S GPIO Config Setting (offset 0x2F1, 1 byte)*/ -- --/*----------------------------------------------------------------------------*/ -- --#define GPIOMUX_EN BIT(3) /* When this bit is set to "1", -- * GPIO PINs will switch to MAC -- * GPIO Function -- */ --#define GPIOSEL_GPIO 0 /* UART or JTAG or pure GPIO*/ --#define GPIOSEL_PHYDBG 1 /* PHYDBG*/ --#define GPIOSEL_BT 2 /* BT_coex*/ --#define GPIOSEL_WLANDBG 3 /* WLANDBG*/ --#define GPIOSEL_GPIO_MASK (~(BIT(0) | BIT(1))) --/* HW Radio OFF switch (GPIO BIT) */ --#define HAL_8192S_HW_GPIO_OFF_BIT BIT(3) --#define HAL_8192S_HW_GPIO_OFF_MASK 0xF7 --#define HAL_8192S_HW_GPIO_WPS_BIT BIT(4) -- --#endif /*__RTL8712_GP_BITDEF_H__*/ -- -diff --git a/drivers/staging/rtl8712/rtl8712_gp_regdef.h b/drivers/staging/rtl8712/rtl8712_gp_regdef.h -deleted file mode 100644 -index 892a7fb1392355..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_gp_regdef.h -+++ /dev/null -@@ -1,29 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __RTL8712_GP_REGDEF_H__ --#define __RTL8712_GP_REGDEF_H__ -- --#define PSTIMER (RTL8712_GP_ + 0x00) --#define TIMER1 (RTL8712_GP_ + 0x04) --#define TIMER2 (RTL8712_GP_ + 0x08) --#define GPIO_CTRL (RTL8712_GP_ + 0x0C) --#define GPIO_IO_SEL (RTL8712_GP_ + 0x0E) --#define GPIO_INTCTRL (RTL8712_GP_ + 0x10) --#define MAC_PINMUX_CTRL (RTL8712_GP_ + 0x11) --#define LEDCFG (RTL8712_GP_ + 0x12) --#define PHY_REG_RPT (RTL8712_GP_ + 0x13) --#define PHY_REG_DATA (RTL8712_GP_ + 0x14) -- --#endif /*__RTL8712_GP_REGDEF_H__ */ -- -diff --git a/drivers/staging/rtl8712/rtl8712_hal.h b/drivers/staging/rtl8712/rtl8712_hal.h -deleted file mode 100644 -index 66cc4645e2d1c9..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_hal.h -+++ /dev/null -@@ -1,142 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __RTL8712_HAL_H__ --#define __RTL8712_HAL_H__ -- --enum _HW_VERSION { -- RTL8712_FPGA, -- RTL8712_1stCUT, /*A Cut (RTL8712_ASIC)*/ -- RTL8712_2ndCUT, /*B Cut*/ -- RTL8712_3rdCUT, /*C Cut*/ --}; -- --enum _LOOPBACK_TYPE { -- RTL8712_AIR_TRX = 0, -- RTL8712_MAC_LBK, -- RTL8712_BB_LBK, -- RTL8712_MAC_FW_LBK = 4, -- RTL8712_BB_FW_LBK = 8, --}; -- --enum RTL871X_HCI_TYPE { -- RTL8712_SDIO, -- RTL8712_USB, --}; -- --enum RTL8712_RF_CONFIG { -- RTL8712_RF_1T1R, -- RTL8712_RF_1T2R, -- RTL8712_RF_2T2R --}; -- --enum _RTL8712_HCI_TYPE_ { -- RTL8712_HCI_TYPE_PCIE = 0x01, -- RTL8712_HCI_TYPE_AP_PCIE = 0x81, -- RTL8712_HCI_TYPE_USB = 0x02, -- RTL8712_HCI_TYPE_92USB = 0x02, -- RTL8712_HCI_TYPE_AP_USB = 0x82, -- RTL8712_HCI_TYPE_72USB = 0x12, -- RTL8712_HCI_TYPE_SDIO = 0x04, -- RTL8712_HCI_TYPE_72SDIO = 0x14 --}; -- --struct fw_priv { /*8-bytes alignment required*/ -- /*--- long word 0 ----*/ -- unsigned char signature_0; /*0x12: CE product, 0x92: IT product*/ -- unsigned char signature_1; /*0x87: CE product, 0x81: IT product*/ -- unsigned char hci_sel; /*0x81: PCI-AP, 01:PCIe, 02: 92S-U, 0x82: USB-AP, -- * 0x12: 72S-U, 03:SDIO -- */ -- unsigned char chip_version; /*the same value as register value*/ -- unsigned char customer_ID_0; /*customer ID low byte*/ -- unsigned char customer_ID_1; /*customer ID high byte*/ -- unsigned char rf_config; /*0x11: 1T1R, 0x12: 1T2R, 0x92: 1T2R turbo, -- * 0x22: 2T2R -- */ -- unsigned char usb_ep_num; /* 4: 4EP, 6: 6EP, 11: 11EP*/ -- /*--- long word 1 ----*/ -- unsigned char regulatory_class_0; /*regulatory class bit map 0*/ -- unsigned char regulatory_class_1; /*regulatory class bit map 1*/ -- unsigned char regulatory_class_2; /*regulatory class bit map 2*/ -- unsigned char regulatory_class_3; /*regulatory class bit map 3*/ -- unsigned char rfintfs; /* 0:SWSI, 1:HWSI, 2:HWPI*/ -- unsigned char def_nettype; -- unsigned char turbo_mode; -- unsigned char low_power_mode;/* 0: normal mode, 1: low power mode*/ -- /*--- long word 2 ----*/ -- unsigned char lbk_mode; /*0x00: normal, 0x03: MACLBK, 0x01: PHYLBK*/ -- unsigned char mp_mode; /* 1: for MP use, 0: for normal driver */ -- unsigned char vcs_type; /* 0:off 1:on 2:auto */ -- unsigned char vcs_mode; /* 1:RTS/CTS 2:CTS to self */ -- unsigned char rsvd022; -- unsigned char rsvd023; -- unsigned char rsvd024; -- unsigned char rsvd025; -- /*--- long word 3 ----*/ -- unsigned char qos_en; /*1: QoS enable*/ -- unsigned char bw_40MHz_en; /*1: 40MHz BW enable*/ -- unsigned char AMSDU2AMPDU_en; /*1: 4181 convert AMSDU to AMPDU, -- * 0: disable -- */ -- unsigned char AMPDU_en; /*1: 11n AMPDU enable*/ -- unsigned char rate_control_offload; /*1: FW offloads,0: driver handles*/ -- unsigned char aggregation_offload; /*1: FW offloads,0: driver handles*/ -- unsigned char rsvd030; -- unsigned char rsvd031; -- /*--- long word 4 ----*/ -- unsigned char beacon_offload; /* 1. FW offloads, 0: driver handles*/ -- unsigned char MLME_offload; /* 2. FW offloads, 0: driver handles*/ -- unsigned char hwpc_offload; /* 3. FW offloads, 0: driver handles*/ -- unsigned char tcp_checksum_offload; /*4. FW offloads,0: driver handles*/ -- unsigned char tcp_offload; /* 5. FW offloads, 0: driver handles*/ -- unsigned char ps_control_offload; /* 6. FW offloads, 0: driver handles*/ -- unsigned char WWLAN_offload; /* 7. FW offloads, 0: driver handles*/ -- unsigned char rsvd040; -- /*--- long word 5 ----*/ -- unsigned char tcp_tx_frame_len_L; /*tcp tx packet length low byte*/ -- unsigned char tcp_tx_frame_len_H; /*tcp tx packet length high byte*/ -- unsigned char tcp_rx_frame_len_L; /*tcp rx packet length low byte*/ -- unsigned char tcp_rx_frame_len_H; /*tcp rx packet length high byte*/ -- unsigned char rsvd050; -- unsigned char rsvd051; -- unsigned char rsvd052; -- unsigned char rsvd053; --}; -- --struct fw_hdr {/*8-byte alignment required*/ -- unsigned short signature; -- unsigned short version; /* 0x8000 ~ 0x8FFF for FPGA version, -- * 0x0000 ~ 0x7FFF for ASIC version, -- */ -- unsigned int dmem_size; /*define the size of boot loader*/ -- unsigned int img_IMEM_size; /*define the size of FW in IMEM*/ -- unsigned int img_SRAM_size; /*define the size of FW in SRAM*/ -- unsigned int fw_priv_sz; /*define the size of DMEM variable*/ -- unsigned short efuse_addr; -- unsigned short h2ccnd_resp_addr; -- unsigned int SVNRevision; -- unsigned int release_time; /*Mon:Day:Hr:Min*/ -- struct fw_priv fwpriv; --}; -- --struct hal_priv { -- /*Endpoint handles*/ -- struct net_device *pipehdls_r8712[10]; -- u8 (*hal_bus_init)(struct _adapter *adapter); --}; -- --uint rtl8712_hal_init(struct _adapter *padapter); --int rtl871x_load_fw(struct _adapter *padapter); -- --#endif -diff --git a/drivers/staging/rtl8712/rtl8712_interrupt_bitdef.h b/drivers/staging/rtl8712/rtl8712_interrupt_bitdef.h -deleted file mode 100644 -index e9732a1bcd7ef8..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_interrupt_bitdef.h -+++ /dev/null -@@ -1,44 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- ******************************************************************************/ --#ifndef __RTL8712_INTERRUPT_BITDEF_H__ --#define __RTL8712_INTERRUPT_BITDEF_H__ -- --/*HIMR*/ --/*HISR*/ --#define _CPUERR BIT(29) --#define _ATIMEND BIT(28) --#define _TXBCNOK BIT(27) --#define _TXBCNERR BIT(26) --#define _BCNDMAINT4 BIT(25) --#define _BCNDMAINT3 BIT(24) --#define _BCNDMAINT2 BIT(23) --#define _BCNDMAINT1 BIT(22) --#define _BCNDOK4 BIT(21) --#define _BCNDOK3 BIT(20) --#define _BCNDOK2 BIT(19) --#define _BCNDOK1 BIT(18) --#define _TIMEOUT2 BIT(17) --#define _TIMEOUT1 BIT(16) --#define _TXFOVW BIT(15) --#define _PSTIMEOUT BIT(14) --#define _BCNDMAINT0 BIT(13) --#define _FOVW BIT(12) --#define _RDU BIT(11) --#define _RXCMDOK BIT(10) --#define _BCNDOK0 BIT(9) --#define _HIGHDOK BIT(8) --#define _COMDOK BIT(7) --#define _MGTDOK BIT(6) --#define _HCCADOK BIT(5) --#define _BKDOK BIT(4) --#define _BEDOK BIT(3) --#define _VIDOK BIT(2) --#define _VODOK BIT(1) --#define _RXOK BIT(0) -- --#endif /*__RTL8712_INTERRUPT_BITDEF_H__*/ -- -diff --git a/drivers/staging/rtl8712/rtl8712_io.c b/drivers/staging/rtl8712/rtl8712_io.c -deleted file mode 100644 -index 384cbdb05e1963..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_io.c -+++ /dev/null -@@ -1,99 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * rtl8712_io.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE . -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _RTL8712_IO_C_ -- --#include "osdep_service.h" --#include "drv_types.h" --#include "rtl871x_io.h" --#include "osdep_intf.h" --#include "usb_ops.h" -- --u8 r8712_read8(struct _adapter *adapter, u32 addr) --{ -- struct intf_hdl *hdl = &adapter->pio_queue->intf; -- -- return hdl->io_ops._read8(hdl, addr); --} -- --u16 r8712_read16(struct _adapter *adapter, u32 addr) --{ -- struct intf_hdl *hdl = &adapter->pio_queue->intf; -- -- return hdl->io_ops._read16(hdl, addr); --} -- --u32 r8712_read32(struct _adapter *adapter, u32 addr) --{ -- struct intf_hdl *hdl = &adapter->pio_queue->intf; -- -- return hdl->io_ops._read32(hdl, addr); --} -- --void r8712_write8(struct _adapter *adapter, u32 addr, u8 val) --{ -- struct intf_hdl *hdl = &adapter->pio_queue->intf; -- -- hdl->io_ops._write8(hdl, addr, val); --} -- --void r8712_write16(struct _adapter *adapter, u32 addr, u16 val) --{ -- struct intf_hdl *hdl = &adapter->pio_queue->intf; -- -- hdl->io_ops._write16(hdl, addr, val); --} -- --void r8712_write32(struct _adapter *adapter, u32 addr, u32 val) --{ -- struct intf_hdl *hdl = &adapter->pio_queue->intf; -- -- hdl->io_ops._write32(hdl, addr, val); --} -- --void r8712_read_mem(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem) --{ -- struct intf_hdl *hdl = &adapter->pio_queue->intf; -- -- if (adapter->driver_stopped || adapter->surprise_removed) -- return; -- -- hdl->io_ops._read_mem(hdl, addr, cnt, pmem); --} -- --void r8712_write_mem(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem) --{ -- struct intf_hdl *hdl = &adapter->pio_queue->intf; -- -- hdl->io_ops._write_mem(hdl, addr, cnt, pmem); --} -- --void r8712_read_port(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem) --{ -- struct intf_hdl *hdl = &adapter->pio_queue->intf; -- -- if (adapter->driver_stopped || adapter->surprise_removed) -- return; -- -- hdl->io_ops._read_port(hdl, addr, cnt, pmem); --} -- --void r8712_write_port(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem) --{ -- struct intf_hdl *hdl = &adapter->pio_queue->intf; -- -- hdl->io_ops._write_port(hdl, addr, cnt, pmem); --} -diff --git a/drivers/staging/rtl8712/rtl8712_led.c b/drivers/staging/rtl8712/rtl8712_led.c -deleted file mode 100644 -index d5fc9026b036e7..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_led.c -+++ /dev/null -@@ -1,1830 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * rtl8712_led.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ -- --#include "drv_types.h" -- --/*=========================================================================== -- * Constant. -- *=========================================================================== -- -- * -- * Default LED behavior. -- */ --#define LED_BLINK_NORMAL_INTERVAL 100 --#define LED_BLINK_SLOWLY_INTERVAL 200 --#define LED_BLINK_LONG_INTERVAL 400 -- --#define LED_BLINK_NO_LINK_INTERVAL_ALPHA 1000 --#define LED_BLINK_LINK_INTERVAL_ALPHA 500 --#define LED_BLINK_SCAN_INTERVAL_ALPHA 180 --#define LED_BLINK_FASTER_INTERVAL_ALPHA 50 --#define LED_BLINK_WPS_SUCCESS_INTERVAL_ALPHA 5000 -- --/*=========================================================================== -- * LED object. -- *=========================================================================== -- */ --enum _LED_STATE_871x { -- LED_UNKNOWN = 0, -- LED_STATE_ON = 1, -- LED_STATE_OFF = 2, -- LED_BLINK_NORMAL = 3, -- LED_BLINK_SLOWLY = 4, -- LED_POWER_ON_BLINK = 5, -- LED_SCAN_BLINK = 6, /* LED is blinking during scanning period, -- * the # of times to blink is depend on time -- * for scanning. -- */ -- LED_NO_LINK_BLINK = 7, /* LED is blinking during no link state. */ -- LED_BLINK_StartToBlink = 8,/* Customized for Sercomm Printer -- * Server case -- */ -- LED_BLINK_WPS = 9, /* LED is blinkg during WPS communication */ -- LED_TXRX_BLINK = 10, -- LED_BLINK_WPS_STOP = 11, /*for ALPHA */ -- LED_BLINK_WPS_STOP_OVERLAP = 12, /*for BELKIN */ --}; -- --/*=========================================================================== -- * Prototype of protected function. -- *=========================================================================== -- */ --static void BlinkTimerCallback(struct timer_list *t); -- --static void BlinkWorkItemCallback(struct work_struct *work); --/*=========================================================================== -- * LED_819xUsb routines. -- *=========================================================================== -- * -- * -- * -- * Description: -- * Initialize an LED_871x object. -- */ --static void InitLed871x(struct _adapter *padapter, struct LED_871x *pLed, -- enum LED_PIN_871x LedPin) --{ -- pLed->padapter = padapter; -- pLed->LedPin = LedPin; -- pLed->CurrLedState = LED_STATE_OFF; -- pLed->bLedOn = false; -- pLed->bLedBlinkInProgress = false; -- pLed->BlinkTimes = 0; -- pLed->BlinkingLedState = LED_UNKNOWN; -- timer_setup(&pLed->BlinkTimer, BlinkTimerCallback, 0); -- INIT_WORK(&pLed->BlinkWorkItem, BlinkWorkItemCallback); --} -- --/* -- * Description: -- * DeInitialize an LED_871x object. -- */ --static void DeInitLed871x(struct LED_871x *pLed) --{ -- del_timer_sync(&pLed->BlinkTimer); -- /* We should reset bLedBlinkInProgress if we cancel -- * the LedControlTimer, -- */ -- pLed->bLedBlinkInProgress = false; --} -- --/* -- * Description: -- * Turn on LED according to LedPin specified. -- */ --static void SwLedOn(struct _adapter *padapter, struct LED_871x *pLed) --{ -- u8 LedCfg; -- -- if (padapter->surprise_removed || padapter->driver_stopped) -- return; -- LedCfg = r8712_read8(padapter, LEDCFG); -- switch (pLed->LedPin) { -- case LED_PIN_GPIO0: -- break; -- case LED_PIN_LED0: -- /* SW control led0 on.*/ -- r8712_write8(padapter, LEDCFG, LedCfg & 0xf0); -- break; -- case LED_PIN_LED1: -- /* SW control led1 on.*/ -- r8712_write8(padapter, LEDCFG, LedCfg & 0x0f); -- break; -- default: -- break; -- } -- pLed->bLedOn = true; --} -- --/* -- * Description: -- * Turn off LED according to LedPin specified. -- */ --static void SwLedOff(struct _adapter *padapter, struct LED_871x *pLed) --{ -- u8 LedCfg; -- -- if (padapter->surprise_removed || padapter->driver_stopped) -- return; -- LedCfg = r8712_read8(padapter, LEDCFG); -- switch (pLed->LedPin) { -- case LED_PIN_GPIO0: -- break; -- case LED_PIN_LED0: -- LedCfg &= 0xf0; /* Set to software control.*/ -- r8712_write8(padapter, LEDCFG, (LedCfg | BIT(3))); -- break; -- case LED_PIN_LED1: -- LedCfg &= 0x0f; /* Set to software control.*/ -- r8712_write8(padapter, LEDCFG, (LedCfg | BIT(7))); -- break; -- default: -- break; -- } -- pLed->bLedOn = false; --} -- --/*=========================================================================== -- * Interface to manipulate LED objects. -- *=========================================================================== -- * -- * Description: -- * Initialize all LED_871x objects. -- */ --void r8712_InitSwLeds(struct _adapter *padapter) --{ -- struct led_priv *pledpriv = &padapter->ledpriv; -- -- pledpriv->LedControlHandler = LedControl871x; -- InitLed871x(padapter, &pledpriv->SwLed0, LED_PIN_LED0); -- InitLed871x(padapter, &pledpriv->SwLed1, LED_PIN_LED1); --} -- --/* Description: -- * DeInitialize all LED_819xUsb objects. -- */ --void r8712_DeInitSwLeds(struct _adapter *padapter) --{ -- struct led_priv *ledpriv = &padapter->ledpriv; -- -- DeInitLed871x(&ledpriv->SwLed0); -- DeInitLed871x(&ledpriv->SwLed1); --} -- --/* Description: -- * Implementation of LED blinking behavior. -- * It toggle off LED and schedule corresponding timer if necessary. -- */ --static void SwLedBlink(struct LED_871x *pLed) --{ -- struct _adapter *padapter = pLed->padapter; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- u8 bStopBlinking = false; -- -- /* Change LED according to BlinkingLedState specified. */ -- if (pLed->BlinkingLedState == LED_STATE_ON) -- SwLedOn(padapter, pLed); -- else -- SwLedOff(padapter, pLed); -- /* Determine if we shall change LED state again. */ -- pLed->BlinkTimes--; -- switch (pLed->CurrLedState) { -- case LED_BLINK_NORMAL: -- if (pLed->BlinkTimes == 0) -- bStopBlinking = true; -- break; -- case LED_BLINK_StartToBlink: -- if (check_fwstate(pmlmepriv, _FW_LINKED) && -- (pmlmepriv->fw_state & WIFI_STATION_STATE)) -- bStopBlinking = true; -- if (check_fwstate(pmlmepriv, _FW_LINKED) && -- ((pmlmepriv->fw_state & WIFI_ADHOC_STATE) || -- (pmlmepriv->fw_state & WIFI_ADHOC_MASTER_STATE))) -- bStopBlinking = true; -- else if (pLed->BlinkTimes == 0) -- bStopBlinking = true; -- break; -- case LED_BLINK_WPS: -- if (pLed->BlinkTimes == 0) -- bStopBlinking = true; -- break; -- default: -- bStopBlinking = true; -- break; -- } -- if (bStopBlinking) { -- if (check_fwstate(pmlmepriv, _FW_LINKED) && -- !pLed->bLedOn) -- SwLedOn(padapter, pLed); -- else if (check_fwstate(pmlmepriv, _FW_LINKED) && pLed->bLedOn) -- SwLedOff(padapter, pLed); -- pLed->BlinkTimes = 0; -- pLed->bLedBlinkInProgress = false; -- } else { -- /* Assign LED state to toggle. */ -- if (pLed->BlinkingLedState == LED_STATE_ON) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- -- /* Schedule a timer to toggle LED state. */ -- switch (pLed->CurrLedState) { -- case LED_BLINK_NORMAL: -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL)); -- break; -- case LED_BLINK_SLOWLY: -- case LED_BLINK_StartToBlink: -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SLOWLY_INTERVAL)); -- break; -- case LED_BLINK_WPS: -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_LONG_INTERVAL)); -- break; -- default: -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SLOWLY_INTERVAL)); -- break; -- } -- } --} -- --static void SwLedBlink1(struct LED_871x *pLed) --{ -- struct _adapter *padapter = pLed->padapter; -- struct led_priv *ledpriv = &padapter->ledpriv; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct eeprom_priv *peeprompriv = &padapter->eeprompriv; -- struct LED_871x *pLed1 = &ledpriv->SwLed1; -- u8 bStopBlinking = false; -- -- if (peeprompriv->CustomerID == RT_CID_819x_CAMEO) -- pLed = &ledpriv->SwLed1; -- /* Change LED according to BlinkingLedState specified. */ -- if (pLed->BlinkingLedState == LED_STATE_ON) -- SwLedOn(padapter, pLed); -- else -- SwLedOff(padapter, pLed); -- if (peeprompriv->CustomerID == RT_CID_DEFAULT) { -- if (check_fwstate(pmlmepriv, _FW_LINKED)) { -- if (!pLed1->bSWLedCtrl) { -- SwLedOn(padapter, pLed1); -- pLed1->bSWLedCtrl = true; -- } else if (!pLed1->bLedOn) { -- SwLedOn(padapter, pLed1); -- } -- } else { -- if (!pLed1->bSWLedCtrl) { -- SwLedOff(padapter, pLed1); -- pLed1->bSWLedCtrl = true; -- } else if (pLed1->bLedOn) { -- SwLedOff(padapter, pLed1); -- } -- } -- } -- switch (pLed->CurrLedState) { -- case LED_BLINK_SLOWLY: -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA)); -- break; -- case LED_BLINK_NORMAL: -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_LINK_INTERVAL_ALPHA)); -- break; -- case LED_SCAN_BLINK: -- pLed->BlinkTimes--; -- if (pLed->BlinkTimes == 0) -- bStopBlinking = true; -- if (bStopBlinking) { -- if (check_fwstate(pmlmepriv, _FW_LINKED)) { -- pLed->bLedLinkBlinkInProgress = true; -- pLed->CurrLedState = LED_BLINK_NORMAL; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_LINK_INTERVAL_ALPHA)); -- } else if (!check_fwstate(pmlmepriv, _FW_LINKED)) { -- pLed->bLedNoLinkBlinkInProgress = true; -- pLed->CurrLedState = LED_BLINK_SLOWLY; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA)); -- } -- pLed->bLedScanBlinkInProgress = false; -- } else { -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA)); -- } -- break; -- case LED_TXRX_BLINK: -- pLed->BlinkTimes--; -- if (pLed->BlinkTimes == 0) -- bStopBlinking = true; -- if (bStopBlinking) { -- if (check_fwstate(pmlmepriv, _FW_LINKED)) { -- pLed->bLedLinkBlinkInProgress = true; -- pLed->CurrLedState = LED_BLINK_NORMAL; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_LINK_INTERVAL_ALPHA)); -- } else if (!check_fwstate(pmlmepriv, _FW_LINKED)) { -- pLed->bLedNoLinkBlinkInProgress = true; -- pLed->CurrLedState = LED_BLINK_SLOWLY; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA)); -- } -- pLed->BlinkTimes = 0; -- pLed->bLedBlinkInProgress = false; -- } else { -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA)); -- } -- break; -- case LED_BLINK_WPS: -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA)); -- break; -- case LED_BLINK_WPS_STOP: /* WPS success */ -- if (pLed->BlinkingLedState == LED_STATE_ON) { -- pLed->BlinkingLedState = LED_STATE_OFF; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_WPS_SUCCESS_INTERVAL_ALPHA)); -- bStopBlinking = false; -- } else { -- bStopBlinking = true; -- } -- if (bStopBlinking) { -- pLed->bLedLinkBlinkInProgress = true; -- pLed->CurrLedState = LED_BLINK_NORMAL; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_LINK_INTERVAL_ALPHA)); -- } -- pLed->bLedWPSBlinkInProgress = false; -- break; -- default: -- break; -- } --} -- --static void SwLedBlink2(struct LED_871x *pLed) --{ -- struct _adapter *padapter = pLed->padapter; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- u8 bStopBlinking = false; -- -- /* Change LED according to BlinkingLedState specified. */ -- if (pLed->BlinkingLedState == LED_STATE_ON) -- SwLedOn(padapter, pLed); -- else -- SwLedOff(padapter, pLed); -- switch (pLed->CurrLedState) { -- case LED_SCAN_BLINK: -- pLed->BlinkTimes--; -- if (pLed->BlinkTimes == 0) -- bStopBlinking = true; -- if (bStopBlinking) { -- if (check_fwstate(pmlmepriv, _FW_LINKED)) { -- pLed->CurrLedState = LED_STATE_ON; -- pLed->BlinkingLedState = LED_STATE_ON; -- SwLedOn(padapter, pLed); -- } else if (!check_fwstate(pmlmepriv, _FW_LINKED)) { -- pLed->CurrLedState = LED_STATE_OFF; -- pLed->BlinkingLedState = LED_STATE_OFF; -- SwLedOff(padapter, pLed); -- } -- pLed->bLedScanBlinkInProgress = false; -- } else { -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA)); -- } -- break; -- case LED_TXRX_BLINK: -- pLed->BlinkTimes--; -- if (pLed->BlinkTimes == 0) -- bStopBlinking = true; -- if (bStopBlinking) { -- if (check_fwstate(pmlmepriv, _FW_LINKED)) { -- pLed->CurrLedState = LED_STATE_ON; -- pLed->BlinkingLedState = LED_STATE_ON; -- SwLedOn(padapter, pLed); -- } else if (!check_fwstate(pmlmepriv, _FW_LINKED)) { -- pLed->CurrLedState = LED_STATE_OFF; -- pLed->BlinkingLedState = LED_STATE_OFF; -- SwLedOff(padapter, pLed); -- } -- pLed->bLedBlinkInProgress = false; -- } else { -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA)); -- } -- break; -- default: -- break; -- } --} -- --static void SwLedBlink3(struct LED_871x *pLed) --{ -- struct _adapter *padapter = pLed->padapter; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- u8 bStopBlinking = false; -- -- /* Change LED according to BlinkingLedState specified. */ -- if (pLed->BlinkingLedState == LED_STATE_ON) -- SwLedOn(padapter, pLed); -- else -- if (pLed->CurrLedState != LED_BLINK_WPS_STOP) -- SwLedOff(padapter, pLed); -- switch (pLed->CurrLedState) { -- case LED_SCAN_BLINK: -- pLed->BlinkTimes--; -- if (pLed->BlinkTimes == 0) -- bStopBlinking = true; -- if (bStopBlinking) { -- if (check_fwstate(pmlmepriv, _FW_LINKED)) { -- pLed->CurrLedState = LED_STATE_ON; -- pLed->BlinkingLedState = LED_STATE_ON; -- if (!pLed->bLedOn) -- SwLedOn(padapter, pLed); -- } else if (!check_fwstate(pmlmepriv, _FW_LINKED)) { -- pLed->CurrLedState = LED_STATE_OFF; -- pLed->BlinkingLedState = LED_STATE_OFF; -- if (pLed->bLedOn) -- SwLedOff(padapter, pLed); -- } -- pLed->bLedScanBlinkInProgress = false; -- } else { -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA)); -- } -- break; -- case LED_TXRX_BLINK: -- pLed->BlinkTimes--; -- if (pLed->BlinkTimes == 0) -- bStopBlinking = true; -- if (bStopBlinking) { -- if (check_fwstate(pmlmepriv, _FW_LINKED)) { -- pLed->CurrLedState = LED_STATE_ON; -- pLed->BlinkingLedState = LED_STATE_ON; -- if (!pLed->bLedOn) -- SwLedOn(padapter, pLed); -- } else if (!check_fwstate(pmlmepriv, _FW_LINKED)) { -- pLed->CurrLedState = LED_STATE_OFF; -- pLed->BlinkingLedState = LED_STATE_OFF; -- if (pLed->bLedOn) -- SwLedOff(padapter, pLed); -- } -- pLed->bLedBlinkInProgress = false; -- } else { -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA)); -- } -- break; -- case LED_BLINK_WPS: -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA)); -- break; -- case LED_BLINK_WPS_STOP: /*WPS success*/ -- if (pLed->BlinkingLedState == LED_STATE_ON) { -- pLed->BlinkingLedState = LED_STATE_OFF; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_WPS_SUCCESS_INTERVAL_ALPHA)); -- bStopBlinking = false; -- } else { -- bStopBlinking = true; -- } -- if (bStopBlinking) { -- pLed->CurrLedState = LED_STATE_ON; -- pLed->BlinkingLedState = LED_STATE_ON; -- SwLedOn(padapter, pLed); -- pLed->bLedWPSBlinkInProgress = false; -- } -- break; -- default: -- break; -- } --} -- --static void SwLedBlink4(struct LED_871x *pLed) --{ -- struct _adapter *padapter = pLed->padapter; -- struct led_priv *ledpriv = &padapter->ledpriv; -- struct LED_871x *pLed1 = &ledpriv->SwLed1; -- u8 bStopBlinking = false; -- -- /* Change LED according to BlinkingLedState specified. */ -- if (pLed->BlinkingLedState == LED_STATE_ON) -- SwLedOn(padapter, pLed); -- else -- SwLedOff(padapter, pLed); -- if (!pLed1->bLedWPSBlinkInProgress && -- pLed1->BlinkingLedState == LED_UNKNOWN) { -- pLed1->BlinkingLedState = LED_STATE_OFF; -- pLed1->CurrLedState = LED_STATE_OFF; -- SwLedOff(padapter, pLed1); -- } -- switch (pLed->CurrLedState) { -- case LED_BLINK_SLOWLY: -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA)); -- break; -- case LED_BLINK_StartToBlink: -- if (pLed->bLedOn) { -- pLed->BlinkingLedState = LED_STATE_OFF; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SLOWLY_INTERVAL)); -- } else { -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL)); -- } -- break; -- case LED_SCAN_BLINK: -- pLed->BlinkTimes--; -- if (pLed->BlinkTimes == 0) -- bStopBlinking = true; -- if (bStopBlinking) { -- pLed->bLedNoLinkBlinkInProgress = true; -- pLed->CurrLedState = LED_BLINK_SLOWLY; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA)); -- pLed->bLedScanBlinkInProgress = false; -- } else { -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA)); -- } -- break; -- case LED_TXRX_BLINK: -- pLed->BlinkTimes--; -- if (pLed->BlinkTimes == 0) -- bStopBlinking = true; -- if (bStopBlinking) { -- pLed->bLedNoLinkBlinkInProgress = true; -- pLed->CurrLedState = LED_BLINK_SLOWLY; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA)); -- pLed->bLedBlinkInProgress = false; -- } else { -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA)); -- } -- break; -- case LED_BLINK_WPS: -- if (pLed->bLedOn) { -- pLed->BlinkingLedState = LED_STATE_OFF; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SLOWLY_INTERVAL)); -- } else { -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL)); -- } -- break; -- case LED_BLINK_WPS_STOP: /*WPS authentication fail*/ -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL)); -- break; -- case LED_BLINK_WPS_STOP_OVERLAP: /*WPS session overlap */ -- pLed->BlinkTimes--; -- if (pLed->BlinkTimes == 0) { -- if (pLed->bLedOn) -- pLed->BlinkTimes = 1; -- else -- bStopBlinking = true; -- } -- if (bStopBlinking) { -- pLed->BlinkTimes = 10; -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_LINK_INTERVAL_ALPHA)); -- } else { -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL)); -- } -- break; -- default: -- break; -- } --} -- --static void SwLedBlink5(struct LED_871x *pLed) --{ -- struct _adapter *padapter = pLed->padapter; -- u8 bStopBlinking = false; -- -- /* Change LED according to BlinkingLedState specified. */ -- if (pLed->BlinkingLedState == LED_STATE_ON) -- SwLedOn(padapter, pLed); -- else -- SwLedOff(padapter, pLed); -- switch (pLed->CurrLedState) { -- case LED_SCAN_BLINK: -- pLed->BlinkTimes--; -- if (pLed->BlinkTimes == 0) -- bStopBlinking = true; -- if (bStopBlinking) { -- pLed->CurrLedState = LED_STATE_ON; -- pLed->BlinkingLedState = LED_STATE_ON; -- if (!pLed->bLedOn) -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA)); -- pLed->bLedScanBlinkInProgress = false; -- } else { -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA)); -- } -- break; -- case LED_TXRX_BLINK: -- pLed->BlinkTimes--; -- if (pLed->BlinkTimes == 0) -- bStopBlinking = true; -- if (bStopBlinking) { -- pLed->CurrLedState = LED_STATE_ON; -- pLed->BlinkingLedState = LED_STATE_ON; -- if (!pLed->bLedOn) -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA)); -- pLed->bLedBlinkInProgress = false; -- } else { -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA)); -- } -- break; -- default: -- break; -- } --} -- --static void SwLedBlink6(struct LED_871x *pLed) --{ -- struct _adapter *padapter = pLed->padapter; -- u8 bStopBlinking = false; -- -- /* Change LED according to BlinkingLedState specified. */ -- if (pLed->BlinkingLedState == LED_STATE_ON) -- SwLedOn(padapter, pLed); -- else -- SwLedOff(padapter, pLed); -- switch (pLed->CurrLedState) { -- case LED_TXRX_BLINK: -- pLed->BlinkTimes--; -- if (pLed->BlinkTimes == 0) -- bStopBlinking = true; -- if (bStopBlinking) { -- pLed->CurrLedState = LED_STATE_ON; -- pLed->BlinkingLedState = LED_STATE_ON; -- if (!pLed->bLedOn) -- SwLedOn(padapter, pLed); -- pLed->bLedBlinkInProgress = false; -- } else { -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA)); -- } -- break; -- case LED_BLINK_WPS: -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA)); -- break; -- -- default: -- break; -- } --} -- --/* Description: -- * Callback function of LED BlinkTimer, -- * it just schedules to corresponding BlinkWorkItem. -- */ --static void BlinkTimerCallback(struct timer_list *t) --{ -- struct LED_871x *pLed = from_timer(pLed, t, BlinkTimer); -- -- /* This fixed the crash problem on Fedora 12 when trying to do the -- * insmod;ifconfig up;rmmod commands. -- */ -- if (pLed->padapter->surprise_removed || pLed->padapter->driver_stopped) -- return; -- schedule_work(&pLed->BlinkWorkItem); --} -- --/* Description: -- * Callback function of LED BlinkWorkItem. -- * We dispatch actual LED blink action according to LedStrategy. -- */ --static void BlinkWorkItemCallback(struct work_struct *work) --{ -- struct LED_871x *pLed = container_of(work, struct LED_871x, -- BlinkWorkItem); -- struct led_priv *ledpriv = &pLed->padapter->ledpriv; -- -- switch (ledpriv->LedStrategy) { -- case SW_LED_MODE0: -- SwLedBlink(pLed); -- break; -- case SW_LED_MODE1: -- SwLedBlink1(pLed); -- break; -- case SW_LED_MODE2: -- SwLedBlink2(pLed); -- break; -- case SW_LED_MODE3: -- SwLedBlink3(pLed); -- break; -- case SW_LED_MODE4: -- SwLedBlink4(pLed); -- break; -- case SW_LED_MODE5: -- SwLedBlink5(pLed); -- break; -- case SW_LED_MODE6: -- SwLedBlink6(pLed); -- break; -- default: -- SwLedBlink(pLed); -- break; -- } --} -- --/*============================================================================ -- * Default LED behavior. -- *============================================================================ -- * -- * Description: -- * Implement each led action for SW_LED_MODE0. -- * This is default strategy. -- */ -- --static void SwLedControlMode1(struct _adapter *padapter, -- enum LED_CTL_MODE LedAction) --{ -- struct led_priv *ledpriv = &padapter->ledpriv; -- struct LED_871x *pLed = &ledpriv->SwLed0; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct sitesurvey_ctrl *psitesurveyctrl = &pmlmepriv->sitesurveyctrl; -- -- if (padapter->eeprompriv.CustomerID == RT_CID_819x_CAMEO) -- pLed = &ledpriv->SwLed1; -- switch (LedAction) { -- case LED_CTL_START_TO_LINK: -- case LED_CTL_NO_LINK: -- if (!pLed->bLedNoLinkBlinkInProgress) { -- if (pLed->CurrLedState == LED_SCAN_BLINK || -- IS_LED_WPS_BLINKING(pLed)) -- return; -- if (pLed->bLedLinkBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedLinkBlinkInProgress = false; -- } -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- pLed->bLedNoLinkBlinkInProgress = true; -- pLed->CurrLedState = LED_BLINK_SLOWLY; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA)); -- } -- break; -- case LED_CTL_LINK: -- if (!pLed->bLedLinkBlinkInProgress) { -- if (pLed->CurrLedState == LED_SCAN_BLINK || -- IS_LED_WPS_BLINKING(pLed)) -- return; -- if (pLed->bLedNoLinkBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedNoLinkBlinkInProgress = false; -- } -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- pLed->bLedLinkBlinkInProgress = true; -- pLed->CurrLedState = LED_BLINK_NORMAL; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_LINK_INTERVAL_ALPHA)); -- } -- break; -- case LED_CTL_SITE_SURVEY: -- if (psitesurveyctrl->traffic_busy && -- check_fwstate(pmlmepriv, _FW_LINKED)) -- ; /* dummy branch */ -- else if (!pLed->bLedScanBlinkInProgress) { -- if (IS_LED_WPS_BLINKING(pLed)) -- return; -- if (pLed->bLedNoLinkBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedNoLinkBlinkInProgress = false; -- } -- if (pLed->bLedLinkBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedLinkBlinkInProgress = false; -- } -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- pLed->bLedScanBlinkInProgress = true; -- pLed->CurrLedState = LED_SCAN_BLINK; -- pLed->BlinkTimes = 24; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA)); -- } -- break; -- case LED_CTL_TX: -- case LED_CTL_RX: -- if (!pLed->bLedBlinkInProgress) { -- if (pLed->CurrLedState == LED_SCAN_BLINK || -- IS_LED_WPS_BLINKING(pLed)) -- return; -- if (pLed->bLedNoLinkBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedNoLinkBlinkInProgress = false; -- } -- if (pLed->bLedLinkBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedLinkBlinkInProgress = false; -- } -- pLed->bLedBlinkInProgress = true; -- pLed->CurrLedState = LED_TXRX_BLINK; -- pLed->BlinkTimes = 2; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA)); -- } -- break; -- -- case LED_CTL_START_WPS: /*wait until xinpin finish */ -- case LED_CTL_START_WPS_BOTTON: -- if (!pLed->bLedWPSBlinkInProgress) { -- if (pLed->bLedNoLinkBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedNoLinkBlinkInProgress = false; -- } -- if (pLed->bLedLinkBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedLinkBlinkInProgress = false; -- } -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- if (pLed->bLedScanBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedScanBlinkInProgress = false; -- } -- pLed->bLedWPSBlinkInProgress = true; -- pLed->CurrLedState = LED_BLINK_WPS; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA)); -- } -- break; -- case LED_CTL_STOP_WPS: -- if (pLed->bLedNoLinkBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedNoLinkBlinkInProgress = false; -- } -- if (pLed->bLedLinkBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedLinkBlinkInProgress = false; -- } -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- if (pLed->bLedScanBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedScanBlinkInProgress = false; -- } -- if (pLed->bLedWPSBlinkInProgress) -- del_timer(&pLed->BlinkTimer); -- else -- pLed->bLedWPSBlinkInProgress = true; -- pLed->CurrLedState = LED_BLINK_WPS_STOP; -- if (pLed->bLedOn) { -- pLed->BlinkingLedState = LED_STATE_OFF; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_WPS_SUCCESS_INTERVAL_ALPHA)); -- } else { -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, -- jiffies + msecs_to_jiffies(0)); -- } -- break; -- case LED_CTL_STOP_WPS_FAIL: -- if (pLed->bLedWPSBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedWPSBlinkInProgress = false; -- } -- pLed->bLedNoLinkBlinkInProgress = true; -- pLed->CurrLedState = LED_BLINK_SLOWLY; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA)); -- break; -- case LED_CTL_POWER_OFF: -- pLed->CurrLedState = LED_STATE_OFF; -- pLed->BlinkingLedState = LED_STATE_OFF; -- if (pLed->bLedNoLinkBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedNoLinkBlinkInProgress = false; -- } -- if (pLed->bLedLinkBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedLinkBlinkInProgress = false; -- } -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- if (pLed->bLedWPSBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedWPSBlinkInProgress = false; -- } -- if (pLed->bLedScanBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedScanBlinkInProgress = false; -- } -- mod_timer(&pLed->BlinkTimer, -- jiffies + msecs_to_jiffies(0)); -- break; -- default: -- break; -- } --} -- --static void SwLedControlMode2(struct _adapter *padapter, -- enum LED_CTL_MODE LedAction) --{ -- struct led_priv *ledpriv = &padapter->ledpriv; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct LED_871x *pLed = &ledpriv->SwLed0; -- -- switch (LedAction) { -- case LED_CTL_SITE_SURVEY: -- if (pmlmepriv->sitesurveyctrl.traffic_busy) -- ; /* dummy branch */ -- else if (!pLed->bLedScanBlinkInProgress) { -- if (IS_LED_WPS_BLINKING(pLed)) -- return; -- -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- pLed->bLedScanBlinkInProgress = true; -- pLed->CurrLedState = LED_SCAN_BLINK; -- pLed->BlinkTimes = 24; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA)); -- } -- break; -- -- case LED_CTL_TX: -- case LED_CTL_RX: -- if (!pLed->bLedBlinkInProgress && -- check_fwstate(pmlmepriv, _FW_LINKED)) { -- if (pLed->CurrLedState == LED_SCAN_BLINK || -- IS_LED_WPS_BLINKING(pLed)) -- return; -- pLed->bLedBlinkInProgress = true; -- pLed->CurrLedState = LED_TXRX_BLINK; -- pLed->BlinkTimes = 2; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA)); -- } -- break; -- -- case LED_CTL_LINK: -- pLed->CurrLedState = LED_STATE_ON; -- pLed->BlinkingLedState = LED_STATE_ON; -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- if (pLed->bLedScanBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedScanBlinkInProgress = false; -- } -- -- mod_timer(&pLed->BlinkTimer, -- jiffies + msecs_to_jiffies(0)); -- break; -- -- case LED_CTL_START_WPS: /*wait until xinpin finish*/ -- case LED_CTL_START_WPS_BOTTON: -- if (!pLed->bLedWPSBlinkInProgress) { -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- if (pLed->bLedScanBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedScanBlinkInProgress = false; -- } -- pLed->bLedWPSBlinkInProgress = true; -- pLed->CurrLedState = LED_STATE_ON; -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, -- jiffies + msecs_to_jiffies(0)); -- } -- break; -- -- case LED_CTL_STOP_WPS: -- pLed->bLedWPSBlinkInProgress = false; -- pLed->CurrLedState = LED_STATE_ON; -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, -- jiffies + msecs_to_jiffies(0)); -- break; -- -- case LED_CTL_STOP_WPS_FAIL: -- pLed->bLedWPSBlinkInProgress = false; -- pLed->CurrLedState = LED_STATE_OFF; -- pLed->BlinkingLedState = LED_STATE_OFF; -- mod_timer(&pLed->BlinkTimer, -- jiffies + msecs_to_jiffies(0)); -- break; -- -- case LED_CTL_START_TO_LINK: -- case LED_CTL_NO_LINK: -- if (!IS_LED_BLINKING(pLed)) { -- pLed->CurrLedState = LED_STATE_OFF; -- pLed->BlinkingLedState = LED_STATE_OFF; -- mod_timer(&pLed->BlinkTimer, -- jiffies + msecs_to_jiffies(0)); -- } -- break; -- case LED_CTL_POWER_OFF: -- pLed->CurrLedState = LED_STATE_OFF; -- pLed->BlinkingLedState = LED_STATE_OFF; -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- if (pLed->bLedScanBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedScanBlinkInProgress = false; -- } -- if (pLed->bLedWPSBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedWPSBlinkInProgress = false; -- } -- mod_timer(&pLed->BlinkTimer, -- jiffies + msecs_to_jiffies(0)); -- break; -- default: -- break; -- } --} -- --static void SwLedControlMode3(struct _adapter *padapter, -- enum LED_CTL_MODE LedAction) --{ -- struct led_priv *ledpriv = &padapter->ledpriv; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct LED_871x *pLed = &ledpriv->SwLed0; -- -- switch (LedAction) { -- case LED_CTL_SITE_SURVEY: -- if (pmlmepriv->sitesurveyctrl.traffic_busy) -- ; /* dummy branch */ -- else if (!pLed->bLedScanBlinkInProgress) { -- if (IS_LED_WPS_BLINKING(pLed)) -- return; -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- pLed->bLedScanBlinkInProgress = true; -- pLed->CurrLedState = LED_SCAN_BLINK; -- pLed->BlinkTimes = 24; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA)); -- } -- break; -- case LED_CTL_TX: -- case LED_CTL_RX: -- if (!pLed->bLedBlinkInProgress && -- check_fwstate(pmlmepriv, _FW_LINKED)) { -- if (pLed->CurrLedState == LED_SCAN_BLINK || -- IS_LED_WPS_BLINKING(pLed)) -- return; -- pLed->bLedBlinkInProgress = true; -- pLed->CurrLedState = LED_TXRX_BLINK; -- pLed->BlinkTimes = 2; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA)); -- } -- break; -- case LED_CTL_LINK: -- if (IS_LED_WPS_BLINKING(pLed)) -- return; -- pLed->CurrLedState = LED_STATE_ON; -- pLed->BlinkingLedState = LED_STATE_ON; -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- if (pLed->bLedScanBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedScanBlinkInProgress = false; -- } -- mod_timer(&pLed->BlinkTimer, -- jiffies + msecs_to_jiffies(0)); -- break; -- case LED_CTL_START_WPS: /* wait until xinpin finish */ -- case LED_CTL_START_WPS_BOTTON: -- if (!pLed->bLedWPSBlinkInProgress) { -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- if (pLed->bLedScanBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedScanBlinkInProgress = false; -- } -- pLed->bLedWPSBlinkInProgress = true; -- pLed->CurrLedState = LED_BLINK_WPS; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA)); -- } -- break; -- case LED_CTL_STOP_WPS: -- if (pLed->bLedWPSBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedWPSBlinkInProgress = false; -- } else { -- pLed->bLedWPSBlinkInProgress = true; -- } -- pLed->CurrLedState = LED_BLINK_WPS_STOP; -- if (pLed->bLedOn) { -- pLed->BlinkingLedState = LED_STATE_OFF; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_WPS_SUCCESS_INTERVAL_ALPHA)); -- } else { -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, -- jiffies + msecs_to_jiffies(0)); -- } -- break; -- case LED_CTL_STOP_WPS_FAIL: -- if (pLed->bLedWPSBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedWPSBlinkInProgress = false; -- } -- pLed->CurrLedState = LED_STATE_OFF; -- pLed->BlinkingLedState = LED_STATE_OFF; -- mod_timer(&pLed->BlinkTimer, -- jiffies + msecs_to_jiffies(0)); -- break; -- case LED_CTL_START_TO_LINK: -- case LED_CTL_NO_LINK: -- if (!IS_LED_BLINKING(pLed)) { -- pLed->CurrLedState = LED_STATE_OFF; -- pLed->BlinkingLedState = LED_STATE_OFF; -- mod_timer(&pLed->BlinkTimer, -- jiffies + msecs_to_jiffies(0)); -- } -- break; -- case LED_CTL_POWER_OFF: -- pLed->CurrLedState = LED_STATE_OFF; -- pLed->BlinkingLedState = LED_STATE_OFF; -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- if (pLed->bLedScanBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedScanBlinkInProgress = false; -- } -- if (pLed->bLedWPSBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedWPSBlinkInProgress = false; -- } -- mod_timer(&pLed->BlinkTimer, -- jiffies + msecs_to_jiffies(0)); -- break; -- default: -- break; -- } --} -- --static void SwLedControlMode4(struct _adapter *padapter, -- enum LED_CTL_MODE LedAction) --{ -- struct led_priv *ledpriv = &padapter->ledpriv; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct LED_871x *pLed = &ledpriv->SwLed0; -- struct LED_871x *pLed1 = &ledpriv->SwLed1; -- -- switch (LedAction) { -- case LED_CTL_START_TO_LINK: -- if (pLed1->bLedWPSBlinkInProgress) { -- pLed1->bLedWPSBlinkInProgress = false; -- del_timer(&pLed1->BlinkTimer); -- pLed1->BlinkingLedState = LED_STATE_OFF; -- pLed1->CurrLedState = LED_STATE_OFF; -- if (pLed1->bLedOn) -- mod_timer(&pLed->BlinkTimer, -- jiffies + msecs_to_jiffies(0)); -- } -- if (!pLed->bLedStartToLinkBlinkInProgress) { -- if (pLed->CurrLedState == LED_SCAN_BLINK || -- IS_LED_WPS_BLINKING(pLed)) -- return; -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- if (pLed->bLedNoLinkBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedNoLinkBlinkInProgress = false; -- } -- pLed->bLedStartToLinkBlinkInProgress = true; -- pLed->CurrLedState = LED_BLINK_StartToBlink; -- if (pLed->bLedOn) { -- pLed->BlinkingLedState = LED_STATE_OFF; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SLOWLY_INTERVAL)); -- } else { -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL)); -- } -- } -- break; -- case LED_CTL_LINK: -- case LED_CTL_NO_LINK: -- /*LED1 settings*/ -- if (LedAction == LED_CTL_LINK) { -- if (pLed1->bLedWPSBlinkInProgress) { -- pLed1->bLedWPSBlinkInProgress = false; -- del_timer(&pLed1->BlinkTimer); -- pLed1->BlinkingLedState = LED_STATE_OFF; -- pLed1->CurrLedState = LED_STATE_OFF; -- if (pLed1->bLedOn) -- mod_timer(&pLed->BlinkTimer, -- jiffies + msecs_to_jiffies(0)); -- } -- } -- if (!pLed->bLedNoLinkBlinkInProgress) { -- if (pLed->CurrLedState == LED_SCAN_BLINK || -- IS_LED_WPS_BLINKING(pLed)) -- return; -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- pLed->bLedNoLinkBlinkInProgress = true; -- pLed->CurrLedState = LED_BLINK_SLOWLY; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA)); -- } -- break; -- case LED_CTL_SITE_SURVEY: -- if (pmlmepriv->sitesurveyctrl.traffic_busy && -- check_fwstate(pmlmepriv, _FW_LINKED)) -- ; -- else if (!pLed->bLedScanBlinkInProgress) { -- if (IS_LED_WPS_BLINKING(pLed)) -- return; -- if (pLed->bLedNoLinkBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedNoLinkBlinkInProgress = false; -- } -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- pLed->bLedScanBlinkInProgress = true; -- pLed->CurrLedState = LED_SCAN_BLINK; -- pLed->BlinkTimes = 24; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA)); -- } -- break; -- case LED_CTL_TX: -- case LED_CTL_RX: -- if (!pLed->bLedBlinkInProgress) { -- if (pLed->CurrLedState == LED_SCAN_BLINK || -- IS_LED_WPS_BLINKING(pLed)) -- return; -- if (pLed->bLedNoLinkBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedNoLinkBlinkInProgress = false; -- } -- pLed->bLedBlinkInProgress = true; -- pLed->CurrLedState = LED_TXRX_BLINK; -- pLed->BlinkTimes = 2; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA)); -- } -- break; -- case LED_CTL_START_WPS: /*wait until xinpin finish*/ -- case LED_CTL_START_WPS_BOTTON: -- if (pLed1->bLedWPSBlinkInProgress) { -- pLed1->bLedWPSBlinkInProgress = false; -- del_timer(&pLed1->BlinkTimer); -- pLed1->BlinkingLedState = LED_STATE_OFF; -- pLed1->CurrLedState = LED_STATE_OFF; -- if (pLed1->bLedOn) -- mod_timer(&pLed->BlinkTimer, -- jiffies + msecs_to_jiffies(0)); -- } -- if (!pLed->bLedWPSBlinkInProgress) { -- if (pLed->bLedNoLinkBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedNoLinkBlinkInProgress = false; -- } -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- if (pLed->bLedScanBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedScanBlinkInProgress = false; -- } -- pLed->bLedWPSBlinkInProgress = true; -- pLed->CurrLedState = LED_BLINK_WPS; -- if (pLed->bLedOn) { -- pLed->BlinkingLedState = LED_STATE_OFF; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SLOWLY_INTERVAL)); -- } else { -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL)); -- } -- } -- break; -- case LED_CTL_STOP_WPS: /*WPS connect success*/ -- if (pLed->bLedWPSBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedWPSBlinkInProgress = false; -- } -- pLed->bLedNoLinkBlinkInProgress = true; -- pLed->CurrLedState = LED_BLINK_SLOWLY; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA)); -- break; -- case LED_CTL_STOP_WPS_FAIL: /*WPS authentication fail*/ -- if (pLed->bLedWPSBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedWPSBlinkInProgress = false; -- } -- pLed->bLedNoLinkBlinkInProgress = true; -- pLed->CurrLedState = LED_BLINK_SLOWLY; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA)); -- /*LED1 settings*/ -- if (pLed1->bLedWPSBlinkInProgress) -- del_timer(&pLed1->BlinkTimer); -- else -- pLed1->bLedWPSBlinkInProgress = true; -- pLed1->CurrLedState = LED_BLINK_WPS_STOP; -- if (pLed1->bLedOn) -- pLed1->BlinkingLedState = LED_STATE_OFF; -- else -- pLed1->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL)); -- break; -- case LED_CTL_STOP_WPS_FAIL_OVERLAP: /*WPS session overlap*/ -- if (pLed->bLedWPSBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedWPSBlinkInProgress = false; -- } -- pLed->bLedNoLinkBlinkInProgress = true; -- pLed->CurrLedState = LED_BLINK_SLOWLY; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA)); -- /*LED1 settings*/ -- if (pLed1->bLedWPSBlinkInProgress) -- del_timer(&pLed1->BlinkTimer); -- else -- pLed1->bLedWPSBlinkInProgress = true; -- pLed1->CurrLedState = LED_BLINK_WPS_STOP_OVERLAP; -- pLed1->BlinkTimes = 10; -- if (pLed1->bLedOn) -- pLed1->BlinkingLedState = LED_STATE_OFF; -- else -- pLed1->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL)); -- break; -- case LED_CTL_POWER_OFF: -- pLed->CurrLedState = LED_STATE_OFF; -- pLed->BlinkingLedState = LED_STATE_OFF; -- if (pLed->bLedNoLinkBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedNoLinkBlinkInProgress = false; -- } -- if (pLed->bLedLinkBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedLinkBlinkInProgress = false; -- } -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- if (pLed->bLedWPSBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedWPSBlinkInProgress = false; -- } -- if (pLed->bLedScanBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedScanBlinkInProgress = false; -- } -- if (pLed->bLedStartToLinkBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedStartToLinkBlinkInProgress = false; -- } -- if (pLed1->bLedWPSBlinkInProgress) { -- del_timer(&pLed1->BlinkTimer); -- pLed1->bLedWPSBlinkInProgress = false; -- } -- pLed1->BlinkingLedState = LED_UNKNOWN; -- SwLedOff(padapter, pLed); -- SwLedOff(padapter, pLed1); -- break; -- default: -- break; -- } --} -- --static void SwLedControlMode5(struct _adapter *padapter, -- enum LED_CTL_MODE LedAction) --{ -- struct led_priv *ledpriv = &padapter->ledpriv; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct LED_871x *pLed = &ledpriv->SwLed0; -- -- if (padapter->eeprompriv.CustomerID == RT_CID_819x_CAMEO) -- pLed = &ledpriv->SwLed1; -- -- switch (LedAction) { -- case LED_CTL_POWER_ON: -- case LED_CTL_NO_LINK: -- case LED_CTL_LINK: /* solid blue */ -- if (pLed->CurrLedState == LED_SCAN_BLINK) -- return; -- pLed->CurrLedState = LED_STATE_ON; -- pLed->BlinkingLedState = LED_STATE_ON; -- pLed->bLedBlinkInProgress = false; -- mod_timer(&pLed->BlinkTimer, -- jiffies + msecs_to_jiffies(0)); -- break; -- case LED_CTL_SITE_SURVEY: -- if (pmlmepriv->sitesurveyctrl.traffic_busy && -- check_fwstate(pmlmepriv, _FW_LINKED)) -- ; /* dummy branch */ -- else if (!pLed->bLedScanBlinkInProgress) { -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- pLed->bLedScanBlinkInProgress = true; -- pLed->CurrLedState = LED_SCAN_BLINK; -- pLed->BlinkTimes = 24; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA)); -- } -- break; -- case LED_CTL_TX: -- case LED_CTL_RX: -- if (!pLed->bLedBlinkInProgress) { -- if (pLed->CurrLedState == LED_SCAN_BLINK) -- return; -- pLed->bLedBlinkInProgress = true; -- pLed->CurrLedState = LED_TXRX_BLINK; -- pLed->BlinkTimes = 2; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA)); -- } -- break; -- case LED_CTL_POWER_OFF: -- pLed->CurrLedState = LED_STATE_OFF; -- pLed->BlinkingLedState = LED_STATE_OFF; -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- SwLedOff(padapter, pLed); -- break; -- default: -- break; -- } --} -- --static void SwLedControlMode6(struct _adapter *padapter, -- enum LED_CTL_MODE LedAction) --{ -- struct led_priv *ledpriv = &padapter->ledpriv; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct LED_871x *pLed = &ledpriv->SwLed0; -- -- switch (LedAction) { -- case LED_CTL_POWER_ON: -- case LED_CTL_NO_LINK: -- case LED_CTL_LINK: /*solid blue*/ -- case LED_CTL_SITE_SURVEY: -- if (IS_LED_WPS_BLINKING(pLed)) -- return; -- pLed->CurrLedState = LED_STATE_ON; -- pLed->BlinkingLedState = LED_STATE_ON; -- pLed->bLedBlinkInProgress = false; -- mod_timer(&pLed->BlinkTimer, jiffies + msecs_to_jiffies(0)); -- break; -- case LED_CTL_TX: -- case LED_CTL_RX: -- if (!pLed->bLedBlinkInProgress && -- check_fwstate(pmlmepriv, _FW_LINKED)) { -- if (IS_LED_WPS_BLINKING(pLed)) -- return; -- pLed->bLedBlinkInProgress = true; -- pLed->CurrLedState = LED_TXRX_BLINK; -- pLed->BlinkTimes = 2; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA)); -- } -- break; -- case LED_CTL_START_WPS: /*wait until xinpin finish*/ -- case LED_CTL_START_WPS_BOTTON: -- if (!pLed->bLedWPSBlinkInProgress) { -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- pLed->bLedWPSBlinkInProgress = true; -- pLed->CurrLedState = LED_BLINK_WPS; -- if (pLed->bLedOn) -- pLed->BlinkingLedState = LED_STATE_OFF; -- else -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, jiffies + -- msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA)); -- } -- break; -- case LED_CTL_STOP_WPS_FAIL: -- case LED_CTL_STOP_WPS: -- if (pLed->bLedWPSBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedWPSBlinkInProgress = false; -- } -- pLed->CurrLedState = LED_STATE_ON; -- pLed->BlinkingLedState = LED_STATE_ON; -- mod_timer(&pLed->BlinkTimer, -- jiffies + msecs_to_jiffies(0)); -- break; -- case LED_CTL_POWER_OFF: -- pLed->CurrLedState = LED_STATE_OFF; -- pLed->BlinkingLedState = LED_STATE_OFF; -- if (pLed->bLedBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedBlinkInProgress = false; -- } -- if (pLed->bLedWPSBlinkInProgress) { -- del_timer(&pLed->BlinkTimer); -- pLed->bLedWPSBlinkInProgress = false; -- } -- SwLedOff(padapter, pLed); -- break; -- default: -- break; -- } --} -- --/* Description: -- * Dispatch LED action according to pHalData->LedStrategy. -- */ --void LedControl871x(struct _adapter *padapter, enum LED_CTL_MODE LedAction) --{ -- struct led_priv *ledpriv = &padapter->ledpriv; -- -- if (!ledpriv->bRegUseLed) -- return; -- switch (ledpriv->LedStrategy) { -- case SW_LED_MODE0: -- break; -- case SW_LED_MODE1: -- SwLedControlMode1(padapter, LedAction); -- break; -- case SW_LED_MODE2: -- SwLedControlMode2(padapter, LedAction); -- break; -- case SW_LED_MODE3: -- SwLedControlMode3(padapter, LedAction); -- break; -- case SW_LED_MODE4: -- SwLedControlMode4(padapter, LedAction); -- break; -- case SW_LED_MODE5: -- SwLedControlMode5(padapter, LedAction); -- break; -- case SW_LED_MODE6: -- SwLedControlMode6(padapter, LedAction); -- break; -- default: -- break; -- } --} -- --void r8712_flush_led_works(struct _adapter *padapter) --{ -- struct led_priv *pledpriv = &padapter->ledpriv; -- -- flush_work(&pledpriv->SwLed0.BlinkWorkItem); -- flush_work(&pledpriv->SwLed1.BlinkWorkItem); --} -diff --git a/drivers/staging/rtl8712/rtl8712_macsetting_bitdef.h b/drivers/staging/rtl8712/rtl8712_macsetting_bitdef.h -deleted file mode 100644 -index 46d758d3f3a4dd..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_macsetting_bitdef.h -+++ /dev/null -@@ -1,31 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- ******************************************************************************/ --#ifndef __RTL8712_MACSETTING_BITDEF_H__ --#define __RTL8712_MACSETTING_BITDEF_H__ -- --/*MACID*/ --/*BSSID*/ -- --/*HWVID*/ --#define _HWVID_MSK 0x0F -- --/*MAR*/ --/*MBIDCANCONTENT*/ -- --/*MBIDCANCFG*/ --#define _POOLING BIT(31) --#define _WRITE_EN BIT(16) --#define _CAM_ADDR_MSK 0x001F --#define _CAM_ADDR_SHT 0 -- --/*BUILDTIME*/ --#define _BUILDTIME_MSK 0x3FFFFFFF -- --/*BUILDUSER*/ -- --#endif /* __RTL8712_MACSETTING_BITDEF_H__*/ -- -diff --git a/drivers/staging/rtl8712/rtl8712_macsetting_regdef.h b/drivers/staging/rtl8712/rtl8712_macsetting_regdef.h -deleted file mode 100644 -index 64740d99c25233..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_macsetting_regdef.h -+++ /dev/null -@@ -1,20 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- ******************************************************************************/ --#ifndef __RTL8712_MACSETTING_REGDEF_H__ --#define __RTL8712_MACSETTING_REGDEF_H__ -- --#define MACID (RTL8712_MACIDSETTING_ + 0x0000) --#define BSSIDR (RTL8712_MACIDSETTING_ + 0x0008) --#define HWVID (RTL8712_MACIDSETTING_ + 0x000E) --#define MAR (RTL8712_MACIDSETTING_ + 0x0010) --#define MBIDCANCONTENT (RTL8712_MACIDSETTING_ + 0x0018) --#define MBIDCANCFG (RTL8712_MACIDSETTING_ + 0x0020) --#define BUILDTIME (RTL8712_MACIDSETTING_ + 0x0024) --#define BUILDUSER (RTL8712_MACIDSETTING_ + 0x0028) -- --#endif /*__RTL8712_MACSETTING_REGDEF_H__*/ -- -diff --git a/drivers/staging/rtl8712/rtl8712_powersave_bitdef.h b/drivers/staging/rtl8712/rtl8712_powersave_bitdef.h -deleted file mode 100644 -index 53e0d6b440f34e..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_powersave_bitdef.h -+++ /dev/null -@@ -1,39 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- ******************************************************************************/ --#ifndef __RTL8712_POWERSAVE_BITDEF_H__ --#define __RTL8712_POWERSAVE_BITDEF_H__ -- --/*WOWCTRL*/ --#define _UWF BIT(3) --#define _MAGIC BIT(2) --#define _WOW_EN BIT(1) --#define _PMEN BIT(0) -- --/*PSSTATUS*/ --#define _PSSTATUS_SEL_MSK 0x0F -- --/*PSSWITCH*/ --#define _PSSWITCH_ACT BIT(7) --#define _PSSWITCH_SEL_MSK 0x0F --#define _PSSWITCH_SEL_SHT 0 -- --/*LPNAV_CTRL*/ --#define _LPNAV_EN BIT(31) --#define _LPNAV_EARLY_MSK 0x7FFF0000 --#define _LPNAV_EARLY_SHT 16 --#define _LPNAV_TH_MSK 0x0000FFFF --#define _LPNAV_TH_SHT 0 -- --/*RPWM*/ --/*CPWM*/ --#define _TOGGLING BIT(7) --#define _WWLAN BIT(3) --#define _RPS_ST BIT(2) --#define _WLAN_TRX BIT(1) --#define _SYS_CLK BIT(0) -- --#endif /* __RTL8712_POWERSAVE_BITDEF_H__*/ -diff --git a/drivers/staging/rtl8712/rtl8712_powersave_regdef.h b/drivers/staging/rtl8712/rtl8712_powersave_regdef.h -deleted file mode 100644 -index 1bcfde4b1c11f1..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_powersave_regdef.h -+++ /dev/null -@@ -1,26 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- ******************************************************************************/ --#ifndef __RTL8712_POWERSAVE_REGDEF_H__ --#define __RTL8712_POWERSAVE_REGDEF_H__ -- --#define WOWCTRL (RTL8712_POWERSAVE_ + 0x00) --#define PSSTATUS (RTL8712_POWERSAVE_ + 0x01) --#define PSSWITCH (RTL8712_POWERSAVE_ + 0x02) --#define MIMOPS_WAITPERIOD (RTL8712_POWERSAVE_ + 0x03) --#define LPNAV_CTRL (RTL8712_POWERSAVE_ + 0x04) --#define WFM0 (RTL8712_POWERSAVE_ + 0x10) --#define WFM1 (RTL8712_POWERSAVE_ + 0x20) --#define WFM2 (RTL8712_POWERSAVE_ + 0x30) --#define WFM3 (RTL8712_POWERSAVE_ + 0x40) --#define WFM4 (RTL8712_POWERSAVE_ + 0x50) --#define WFM5 (RTL8712_POWERSAVE_ + 0x60) --#define WFCRC (RTL8712_POWERSAVE_ + 0x70) --#define RPWM (RTL8712_POWERSAVE_ + 0x7C) --#define CPWM (RTL8712_POWERSAVE_ + 0x7D) -- --#endif /* __RTL8712_POWERSAVE_REGDEF_H__ */ -- -diff --git a/drivers/staging/rtl8712/rtl8712_ratectrl_bitdef.h b/drivers/staging/rtl8712/rtl8712_ratectrl_bitdef.h -deleted file mode 100644 -index 1de51c48f9c1b2..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_ratectrl_bitdef.h -+++ /dev/null -@@ -1,36 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- ******************************************************************************/ --#ifndef __RTL8712_RATECTRL_BITDEF_H__ --#define __RTL8712_RATECTRL_BITDEF_H__ -- --/*INIRTSMCS_SEL*/ --#define _INIRTSMCS_SEL_MSK 0x3F -- --/* RRSR*/ --#define _RRSR_SHORT BIT(23) --#define _RRSR_RSC_MSK 0x600000 --#define _RRSR_RSC_SHT 21 --#define _RRSR_BITMAP_MSK 0x0FFFFF --#define _RRSR_BITMAP_SHT 0 -- --/* AGGLEN_LMT_H*/ --#define _AGGLMT_MCS32_MSK 0xF0 --#define _AGGLMT_MCS32_SHT 4 --#define _AGGLMT_MCS15_SGI_MSK 0x0F --#define _AGGLMT_MCS15_SGI_SHT 0 -- --/* DARFRC*/ --/* RARFRC*/ --/* MCS_TXAGC*/ --/* CCK_TXAGC*/ --#define _CCK_MSK 0xFF00 --#define _CCK_SHT 8 --#define _BARKER_MSK 0x00FF --#define _BARKER_SHT 0 -- --#endif /* __RTL8712_RATECTRL_BITDEF_H__*/ -- -diff --git a/drivers/staging/rtl8712/rtl8712_ratectrl_regdef.h b/drivers/staging/rtl8712/rtl8712_ratectrl_regdef.h -deleted file mode 100644 -index 9ed5653f3f7f11..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_ratectrl_regdef.h -+++ /dev/null -@@ -1,43 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __RTL8712_RATECTRL_REGDEF_H__ --#define __RTL8712_RATECTRL_REGDEF_H__ -- --#define INIMCS_SEL (RTL8712_RATECTRL_ + 0x00) --#define INIRTSMCS_SEL (RTL8712_RATECTRL_ + 0x20) --#define RRSR (RTL8712_RATECTRL_ + 0x21) --#define ARFR0 (RTL8712_RATECTRL_ + 0x24) --#define ARFR1 (RTL8712_RATECTRL_ + 0x28) --#define ARFR2 (RTL8712_RATECTRL_ + 0x2C) --#define ARFR3 (RTL8712_RATECTRL_ + 0x30) --#define ARFR4 (RTL8712_RATECTRL_ + 0x34) --#define ARFR5 (RTL8712_RATECTRL_ + 0x38) --#define ARFR6 (RTL8712_RATECTRL_ + 0x3C) --#define ARFR7 (RTL8712_RATECTRL_ + 0x40) --#define AGGLEN_LMT_H (RTL8712_RATECTRL_ + 0x47) --#define AGGLEN_LMT_L (RTL8712_RATECTRL_ + 0x48) --#define DARFRC (RTL8712_RATECTRL_ + 0x50) --#define RARFRC (RTL8712_RATECTRL_ + 0x58) --#define MCS_TXAGC0 (RTL8712_RATECTRL_ + 0x60) --#define MCS_TXAGC1 (RTL8712_RATECTRL_ + 0x61) --#define MCS_TXAGC2 (RTL8712_RATECTRL_ + 0x62) --#define MCS_TXAGC3 (RTL8712_RATECTRL_ + 0x63) --#define MCS_TXAGC4 (RTL8712_RATECTRL_ + 0x64) --#define MCS_TXAGC5 (RTL8712_RATECTRL_ + 0x65) --#define MCS_TXAGC6 (RTL8712_RATECTRL_ + 0x66) --#define MCS_TXAGC7 (RTL8712_RATECTRL_ + 0x67) --#define CCK_TXAGC (RTL8712_RATECTRL_ + 0x68) -- --#endif /*__RTL8712_RATECTRL_REGDEF_H__*/ -- -diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c -deleted file mode 100644 -index 7da014ab0723e0..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_recv.c -+++ /dev/null -@@ -1,1080 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * rtl8712_recv.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _RTL8712_RECV_C_ -- --#include --#include --#include -- --#include "osdep_service.h" --#include "drv_types.h" --#include "recv_osdep.h" --#include "mlme_osdep.h" --#include "ethernet.h" --#include "usb_ops.h" --#include "wifi.h" -- --static void recv_tasklet(struct tasklet_struct *t); -- --int r8712_init_recv_priv(struct recv_priv *precvpriv, -- struct _adapter *padapter) --{ -- int i; -- struct recv_buf *precvbuf; -- addr_t tmpaddr = 0; -- int alignment = 0; -- struct sk_buff *pskb = NULL; -- -- /*init recv_buf*/ -- _init_queue(&precvpriv->free_recv_buf_queue); -- precvpriv->pallocated_recv_buf = -- kzalloc(NR_RECVBUFF * sizeof(struct recv_buf) + 4, GFP_ATOMIC); -- if (!precvpriv->pallocated_recv_buf) -- return -ENOMEM; -- precvpriv->precv_buf = precvpriv->pallocated_recv_buf + 4 - -- ((addr_t)(precvpriv->pallocated_recv_buf) & 3); -- precvbuf = (struct recv_buf *)precvpriv->precv_buf; -- for (i = 0; i < NR_RECVBUFF; i++) { -- INIT_LIST_HEAD(&precvbuf->list); -- spin_lock_init(&precvbuf->recvbuf_lock); -- if (r8712_os_recvbuf_resource_alloc(padapter, precvbuf)) -- break; -- precvbuf->ref_cnt = 0; -- precvbuf->adapter = padapter; -- list_add_tail(&precvbuf->list, -- &precvpriv->free_recv_buf_queue.queue); -- precvbuf++; -- } -- precvpriv->free_recv_buf_queue_cnt = NR_RECVBUFF; -- tasklet_setup(&precvpriv->recv_tasklet, recv_tasklet); -- skb_queue_head_init(&precvpriv->rx_skb_queue); -- -- skb_queue_head_init(&precvpriv->free_recv_skb_queue); -- for (i = 0; i < NR_PREALLOC_RECV_SKB; i++) { -- pskb = netdev_alloc_skb(padapter->pnetdev, MAX_RECVBUF_SZ + -- RECVBUFF_ALIGN_SZ); -- if (pskb) { -- tmpaddr = (addr_t)pskb->data; -- alignment = tmpaddr & (RECVBUFF_ALIGN_SZ - 1); -- skb_reserve(pskb, (RECVBUFF_ALIGN_SZ - alignment)); -- skb_queue_tail(&precvpriv->free_recv_skb_queue, pskb); -- } -- pskb = NULL; -- } -- return 0; --} -- --void r8712_free_recv_priv(struct recv_priv *precvpriv) --{ -- int i; -- struct recv_buf *precvbuf; -- struct _adapter *padapter = precvpriv->adapter; -- -- precvbuf = (struct recv_buf *)precvpriv->precv_buf; -- for (i = 0; i < NR_RECVBUFF; i++) { -- r8712_os_recvbuf_resource_free(padapter, precvbuf); -- precvbuf++; -- } -- kfree(precvpriv->pallocated_recv_buf); -- skb_queue_purge(&precvpriv->rx_skb_queue); -- if (skb_queue_len(&precvpriv->rx_skb_queue)) -- netdev_warn(padapter->pnetdev, "r8712u: rx_skb_queue not empty\n"); -- skb_queue_purge(&precvpriv->free_recv_skb_queue); -- if (skb_queue_len(&precvpriv->free_recv_skb_queue)) -- netdev_warn(padapter->pnetdev, "r8712u: free_recv_skb_queue not empty %d\n", -- skb_queue_len(&precvpriv->free_recv_skb_queue)); --} -- --void r8712_init_recvbuf(struct _adapter *padapter, struct recv_buf *precvbuf) --{ -- precvbuf->transfer_len = 0; -- precvbuf->len = 0; -- precvbuf->ref_cnt = 0; -- if (precvbuf->pbuf) { -- precvbuf->pdata = precvbuf->pbuf; -- precvbuf->phead = precvbuf->pbuf; -- precvbuf->ptail = precvbuf->pbuf; -- precvbuf->pend = precvbuf->pdata + MAX_RECVBUF_SZ; -- } --} -- --void r8712_free_recvframe(union recv_frame *precvframe, -- struct __queue *pfree_recv_queue) --{ -- unsigned long irqL; -- struct _adapter *padapter = precvframe->u.hdr.adapter; -- struct recv_priv *precvpriv = &padapter->recvpriv; -- -- if (precvframe->u.hdr.pkt) { -- dev_kfree_skb_any(precvframe->u.hdr.pkt);/*free skb by driver*/ -- precvframe->u.hdr.pkt = NULL; -- } -- spin_lock_irqsave(&pfree_recv_queue->lock, irqL); -- list_del_init(&precvframe->u.hdr.list); -- list_add_tail(&precvframe->u.hdr.list, &pfree_recv_queue->queue); -- if (padapter) { -- if (pfree_recv_queue == &precvpriv->free_recv_queue) -- precvpriv->free_recvframe_cnt++; -- } -- spin_unlock_irqrestore(&pfree_recv_queue->lock, irqL); --} -- --static void update_recvframe_attrib_from_recvstat(struct rx_pkt_attrib *pattrib, -- struct recv_stat *prxstat) --{ -- u16 drvinfo_sz; -- -- drvinfo_sz = (le32_to_cpu(prxstat->rxdw0) & 0x000f0000) >> 16; -- drvinfo_sz <<= 3; -- /*TODO: -- * Offset 0 -- */ -- pattrib->bdecrypted = (le32_to_cpu(prxstat->rxdw0) & BIT(27)) == 0; -- pattrib->crc_err = (le32_to_cpu(prxstat->rxdw0) & BIT(14)) != 0; -- /*Offset 4*/ -- /*Offset 8*/ -- /*Offset 12*/ -- if (le32_to_cpu(prxstat->rxdw3) & BIT(13)) { -- pattrib->tcpchk_valid = 1; /* valid */ -- if (le32_to_cpu(prxstat->rxdw3) & BIT(11)) -- pattrib->tcp_chkrpt = 1; /* correct */ -- else -- pattrib->tcp_chkrpt = 0; /* incorrect */ -- if (le32_to_cpu(prxstat->rxdw3) & BIT(12)) -- pattrib->ip_chkrpt = 1; /* correct */ -- else -- pattrib->ip_chkrpt = 0; /* incorrect */ -- } else { -- pattrib->tcpchk_valid = 0; /* invalid */ -- } -- pattrib->mcs_rate = (u8)((le32_to_cpu(prxstat->rxdw3)) & 0x3f); -- pattrib->htc = (u8)((le32_to_cpu(prxstat->rxdw3) >> 14) & 0x1); -- /*Offset 16*/ -- /*Offset 20*/ -- /*phy_info*/ --} -- --/*perform defrag*/ --static union recv_frame *recvframe_defrag(struct _adapter *adapter, -- struct __queue *defrag_q) --{ -- struct list_head *plist, *phead; -- u8 wlanhdr_offset; -- u8 curfragnum; -- struct recv_frame_hdr *pfhdr, *pnfhdr; -- union recv_frame *prframe, *pnextrframe; -- struct __queue *pfree_recv_queue; -- -- pfree_recv_queue = &adapter->recvpriv.free_recv_queue; -- phead = &defrag_q->queue; -- plist = phead->next; -- prframe = container_of(plist, union recv_frame, u.list); -- list_del_init(&prframe->u.list); -- pfhdr = &prframe->u.hdr; -- curfragnum = 0; -- if (curfragnum != pfhdr->attrib.frag_num) { -- /*the first fragment number must be 0 -- *free the whole queue -- */ -- r8712_free_recvframe(prframe, pfree_recv_queue); -- r8712_free_recvframe_queue(defrag_q, pfree_recv_queue); -- return NULL; -- } -- curfragnum++; -- plist = &defrag_q->queue; -- plist = plist->next; -- while (!end_of_queue_search(phead, plist)) { -- pnextrframe = container_of(plist, union recv_frame, u.list); -- pnfhdr = &pnextrframe->u.hdr; -- /*check the fragment sequence (2nd ~n fragment frame) */ -- if (curfragnum != pnfhdr->attrib.frag_num) { -- /* the fragment number must increase (after decache) -- * release the defrag_q & prframe -- */ -- r8712_free_recvframe(prframe, pfree_recv_queue); -- r8712_free_recvframe_queue(defrag_q, pfree_recv_queue); -- return NULL; -- } -- curfragnum++; -- /* copy the 2nd~n fragment frame's payload to the first fragment -- * get the 2nd~last fragment frame's payload -- */ -- wlanhdr_offset = pnfhdr->attrib.hdrlen + pnfhdr->attrib.iv_len; -- recvframe_pull(pnextrframe, wlanhdr_offset); -- /* append to first fragment frame's tail (if privacy frame, -- * pull the ICV) -- */ -- recvframe_pull_tail(prframe, pfhdr->attrib.icv_len); -- memcpy(pfhdr->rx_tail, pnfhdr->rx_data, pnfhdr->len); -- recvframe_put(prframe, pnfhdr->len); -- pfhdr->attrib.icv_len = pnfhdr->attrib.icv_len; -- plist = plist->next; -- } -- /* free the defrag_q queue and return the prframe */ -- r8712_free_recvframe_queue(defrag_q, pfree_recv_queue); -- return prframe; --} -- --/* check if need to defrag, if needed queue the frame to defrag_q */ --union recv_frame *r8712_recvframe_chk_defrag(struct _adapter *padapter, -- union recv_frame *precv_frame) --{ -- u8 ismfrag; -- u8 fragnum; -- u8 *psta_addr; -- struct recv_frame_hdr *pfhdr; -- struct sta_info *psta; -- struct sta_priv *pstapriv; -- struct list_head *phead; -- union recv_frame *prtnframe = NULL; -- struct __queue *pfree_recv_queue, *pdefrag_q; -- -- pstapriv = &padapter->stapriv; -- pfhdr = &precv_frame->u.hdr; -- pfree_recv_queue = &padapter->recvpriv.free_recv_queue; -- /* need to define struct of wlan header frame ctrl */ -- ismfrag = pfhdr->attrib.mfrag; -- fragnum = pfhdr->attrib.frag_num; -- psta_addr = pfhdr->attrib.ta; -- psta = r8712_get_stainfo(pstapriv, psta_addr); -- if (!psta) -- pdefrag_q = NULL; -- else -- pdefrag_q = &psta->sta_recvpriv.defrag_q; -- -- if ((ismfrag == 0) && (fragnum == 0)) -- prtnframe = precv_frame;/*isn't a fragment frame*/ -- if (ismfrag == 1) { -- /* 0~(n-1) fragment frame -- * enqueue to defraf_g -- */ -- if (pdefrag_q) { -- if (fragnum == 0) { -- /*the first fragment*/ -- if (!list_empty(&pdefrag_q->queue)) { -- /*free current defrag_q */ -- r8712_free_recvframe_queue(pdefrag_q, -- pfree_recv_queue); -- } -- } -- /* Then enqueue the 0~(n-1) fragment to the defrag_q */ -- phead = &pdefrag_q->queue; -- list_add_tail(&pfhdr->list, phead); -- prtnframe = NULL; -- } else { -- /* can't find this ta's defrag_queue, so free this -- * recv_frame -- */ -- r8712_free_recvframe(precv_frame, pfree_recv_queue); -- prtnframe = NULL; -- } -- } -- if ((ismfrag == 0) && (fragnum != 0)) { -- /* the last fragment frame -- * enqueue the last fragment -- */ -- if (pdefrag_q) { -- phead = &pdefrag_q->queue; -- list_add_tail(&pfhdr->list, phead); -- /*call recvframe_defrag to defrag*/ -- precv_frame = recvframe_defrag(padapter, pdefrag_q); -- prtnframe = precv_frame; -- } else { -- /* can't find this ta's defrag_queue, so free this -- * recv_frame -- */ -- r8712_free_recvframe(precv_frame, pfree_recv_queue); -- prtnframe = NULL; -- } -- } -- if (prtnframe && (prtnframe->u.hdr.attrib.privacy)) { -- /* after defrag we must check tkip mic code */ -- if (r8712_recvframe_chkmic(padapter, prtnframe) == _FAIL) { -- r8712_free_recvframe(prtnframe, pfree_recv_queue); -- prtnframe = NULL; -- } -- } -- return prtnframe; --} -- --static void amsdu_to_msdu(struct _adapter *padapter, union recv_frame *prframe) --{ -- int a_len, padding_len; -- u16 eth_type, nSubframe_Length; -- u8 nr_subframes, i; -- unsigned char *pdata; -- struct rx_pkt_attrib *pattrib; -- _pkt *sub_skb, *subframes[MAX_SUBFRAME_COUNT]; -- struct recv_priv *precvpriv = &padapter->recvpriv; -- struct __queue *pfree_recv_queue = &precvpriv->free_recv_queue; -- -- nr_subframes = 0; -- pattrib = &prframe->u.hdr.attrib; -- recvframe_pull(prframe, prframe->u.hdr.attrib.hdrlen); -- if (prframe->u.hdr.attrib.iv_len > 0) -- recvframe_pull(prframe, prframe->u.hdr.attrib.iv_len); -- a_len = prframe->u.hdr.len; -- pdata = prframe->u.hdr.rx_data; -- while (a_len > ETH_HLEN) { -- /* Offset 12 denote 2 mac address */ -- nSubframe_Length = *((u16 *)(pdata + 12)); -- /*==m==>change the length order*/ -- nSubframe_Length = (nSubframe_Length >> 8) + -- (nSubframe_Length << 8); -- if (a_len < (ETHERNET_HEADER_SIZE + nSubframe_Length)) { -- netdev_warn(padapter->pnetdev, "r8712u: nRemain_Length is %d and nSubframe_Length is: %d\n", -- a_len, nSubframe_Length); -- goto exit; -- } -- /* move the data point to data content */ -- pdata += ETH_HLEN; -- a_len -= ETH_HLEN; -- /* Allocate new skb for releasing to upper layer */ -- sub_skb = dev_alloc_skb(nSubframe_Length + 12); -- if (!sub_skb) -- break; -- skb_reserve(sub_skb, 12); -- skb_put_data(sub_skb, pdata, nSubframe_Length); -- subframes[nr_subframes++] = sub_skb; -- if (nr_subframes >= MAX_SUBFRAME_COUNT) { -- netdev_warn(padapter->pnetdev, "r8712u: ParseSubframe(): Too many Subframes! Packets dropped!\n"); -- break; -- } -- pdata += nSubframe_Length; -- a_len -= nSubframe_Length; -- if (a_len != 0) { -- padding_len = 4 - ((nSubframe_Length + ETH_HLEN) & 3); -- if (padding_len == 4) -- padding_len = 0; -- if (a_len < padding_len) -- goto exit; -- pdata += padding_len; -- a_len -= padding_len; -- } -- } -- for (i = 0; i < nr_subframes; i++) { -- sub_skb = subframes[i]; -- /* convert hdr + possible LLC headers into Ethernet header */ -- eth_type = (sub_skb->data[6] << 8) | sub_skb->data[7]; -- if (sub_skb->len >= 8 && -- ((!memcmp(sub_skb->data, rfc1042_header, SNAP_SIZE) && -- eth_type != ETH_P_AARP && eth_type != ETH_P_IPX) || -- !memcmp(sub_skb->data, bridge_tunnel_header, SNAP_SIZE))) { -- /* remove RFC1042 or Bridge-Tunnel encapsulation and -- * replace EtherType -- */ -- skb_pull(sub_skb, SNAP_SIZE); -- memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->src, -- ETH_ALEN); -- memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->dst, -- ETH_ALEN); -- } else { -- __be16 len; -- /* Leave Ethernet header part of hdr and full payload */ -- len = htons(sub_skb->len); -- memcpy(skb_push(sub_skb, 2), &len, 2); -- memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->src, -- ETH_ALEN); -- memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->dst, -- ETH_ALEN); -- } -- /* Indicate the packets to upper layer */ -- if (sub_skb) { -- sub_skb->protocol = -- eth_type_trans(sub_skb, padapter->pnetdev); -- sub_skb->dev = padapter->pnetdev; -- if ((pattrib->tcpchk_valid == 1) && -- (pattrib->tcp_chkrpt == 1)) { -- sub_skb->ip_summed = CHECKSUM_UNNECESSARY; -- } else { -- sub_skb->ip_summed = CHECKSUM_NONE; -- } -- netif_rx(sub_skb); -- } -- } --exit: -- prframe->u.hdr.len = 0; -- r8712_free_recvframe(prframe, pfree_recv_queue); --} -- --void r8712_rxcmd_event_hdl(struct _adapter *padapter, void *prxcmdbuf) --{ -- __le32 voffset; -- u8 *poffset; -- u16 cmd_len, drvinfo_sz; -- struct recv_stat *prxstat; -- -- poffset = prxcmdbuf; -- voffset = *(__le32 *)poffset; -- prxstat = prxcmdbuf; -- drvinfo_sz = (le32_to_cpu(prxstat->rxdw0) & 0x000f0000) >> 16; -- drvinfo_sz <<= 3; -- poffset += RXDESC_SIZE + drvinfo_sz; -- do { -- voffset = *(__le32 *)poffset; -- cmd_len = (u16)(le32_to_cpu(voffset) & 0xffff); -- r8712_event_handle(padapter, (__le32 *)poffset); -- poffset += (cmd_len + 8);/*8 bytes alignment*/ -- } while (le32_to_cpu(voffset) & BIT(31)); --} -- --static int check_indicate_seq(struct recv_reorder_ctrl *preorder_ctrl, -- u16 seq_num) --{ -- u8 wsize = preorder_ctrl->wsize_b; -- u16 wend = (preorder_ctrl->indicate_seq + wsize - 1) % 4096; -- -- /* Rx Reorder initialize condition.*/ -- if (preorder_ctrl->indicate_seq == 0xffff) -- preorder_ctrl->indicate_seq = seq_num; -- /* Drop out the packet which SeqNum is smaller than WinStart */ -- if (SN_LESS(seq_num, preorder_ctrl->indicate_seq)) -- return false; -- /* -- * Sliding window manipulation. Conditions includes: -- * 1. Incoming SeqNum is equal to WinStart =>Window shift 1 -- * 2. Incoming SeqNum is larger than the WinEnd => Window shift N -- */ -- if (SN_EQUAL(seq_num, preorder_ctrl->indicate_seq)) -- preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + -- 1) % 4096; -- else if (SN_LESS(wend, seq_num)) { -- if (seq_num >= (wsize - 1)) -- preorder_ctrl->indicate_seq = seq_num + 1 - wsize; -- else -- preorder_ctrl->indicate_seq = 4095 - (wsize - -- (seq_num + 1)) + 1; -- } -- return true; --} -- --static int enqueue_reorder_recvframe(struct recv_reorder_ctrl *preorder_ctrl, -- union recv_frame *prframe) --{ -- struct list_head *phead, *plist; -- union recv_frame *pnextrframe; -- struct rx_pkt_attrib *pnextattrib; -- struct __queue *ppending_recvframe_queue = -- &preorder_ctrl->pending_recvframe_queue; -- struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib; -- -- phead = &ppending_recvframe_queue->queue; -- plist = phead->next; -- while (!end_of_queue_search(phead, plist)) { -- pnextrframe = container_of(plist, union recv_frame, u.list); -- pnextattrib = &pnextrframe->u.hdr.attrib; -- -- if (SN_EQUAL(pnextattrib->seq_num, pattrib->seq_num)) -- return false; -- -- if (SN_LESS(pnextattrib->seq_num, pattrib->seq_num)) -- plist = plist->next; -- else -- break; -- } -- list_del_init(&prframe->u.hdr.list); -- list_add_tail(&prframe->u.hdr.list, plist); -- return true; --} -- --int r8712_recv_indicatepkts_in_order(struct _adapter *padapter, -- struct recv_reorder_ctrl *preorder_ctrl, -- int bforced) --{ -- struct list_head *phead, *plist; -- union recv_frame *prframe; -- struct rx_pkt_attrib *pattrib; -- int bPktInBuf = false; -- struct __queue *ppending_recvframe_queue = -- &preorder_ctrl->pending_recvframe_queue; -- -- phead = &ppending_recvframe_queue->queue; -- plist = phead->next; -- /* Handling some condition for forced indicate case.*/ -- if (bforced) { -- if (list_empty(phead)) -- return true; -- -- prframe = container_of(plist, union recv_frame, u.list); -- pattrib = &prframe->u.hdr.attrib; -- preorder_ctrl->indicate_seq = pattrib->seq_num; -- } -- /* Prepare indication list and indication. -- * Check if there is any packet need indicate. -- */ -- while (!list_empty(phead)) { -- prframe = container_of(plist, union recv_frame, u.list); -- pattrib = &prframe->u.hdr.attrib; -- if (!SN_LESS(preorder_ctrl->indicate_seq, pattrib->seq_num)) { -- plist = plist->next; -- list_del_init(&prframe->u.hdr.list); -- if (SN_EQUAL(preorder_ctrl->indicate_seq, -- pattrib->seq_num)) -- preorder_ctrl->indicate_seq = -- (preorder_ctrl->indicate_seq + 1) % 4096; -- /*indicate this recv_frame*/ -- if (!pattrib->amsdu) { -- if (!padapter->driver_stopped && -- !padapter->surprise_removed) { -- /* indicate this recv_frame */ -- r8712_recv_indicatepkt(padapter, -- prframe); -- } -- } else if (pattrib->amsdu == 1) { -- amsdu_to_msdu(padapter, prframe); -- } -- /* Update local variables. */ -- bPktInBuf = false; -- } else { -- bPktInBuf = true; -- break; -- } -- } -- return bPktInBuf; --} -- --static int recv_indicatepkt_reorder(struct _adapter *padapter, -- union recv_frame *prframe) --{ -- unsigned long irql; -- struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib; -- struct recv_reorder_ctrl *preorder_ctrl = prframe->u.hdr.preorder_ctrl; -- struct __queue *ppending_recvframe_queue = -- &preorder_ctrl->pending_recvframe_queue; -- -- if (!pattrib->amsdu) { -- /* s1. */ -- r8712_wlanhdr_to_ethhdr(prframe); -- if (pattrib->qos != 1) { -- if (!padapter->driver_stopped && -- !padapter->surprise_removed) { -- r8712_recv_indicatepkt(padapter, prframe); -- return 0; -- } else { -- return -EINVAL; -- } -- } -- } -- spin_lock_irqsave(&ppending_recvframe_queue->lock, irql); -- /*s2. check if winstart_b(indicate_seq) needs to be updated*/ -- if (!check_indicate_seq(preorder_ctrl, pattrib->seq_num)) -- goto _err_exit; -- /*s3. Insert all packet into Reorder Queue to maintain its ordering.*/ -- if (!enqueue_reorder_recvframe(preorder_ctrl, prframe)) -- goto _err_exit; -- /*s4. -- * Indication process. -- * After Packet dropping and Sliding Window shifting as above, we can -- * now just indicate the packets with the SeqNum smaller than latest -- * WinStart and buffer other packets. -- * -- * For Rx Reorder condition: -- * 1. All packets with SeqNum smaller than WinStart => Indicate -- * 2. All packets with SeqNum larger than or equal to -- * WinStart => Buffer it. -- */ -- if (r8712_recv_indicatepkts_in_order(padapter, preorder_ctrl, false)) { -- mod_timer(&preorder_ctrl->reordering_ctrl_timer, -- jiffies + msecs_to_jiffies(REORDER_WAIT_TIME)); -- spin_unlock_irqrestore(&ppending_recvframe_queue->lock, irql); -- } else { -- spin_unlock_irqrestore(&ppending_recvframe_queue->lock, irql); -- del_timer(&preorder_ctrl->reordering_ctrl_timer); -- } -- return 0; --_err_exit: -- spin_unlock_irqrestore(&ppending_recvframe_queue->lock, irql); -- return -ENOMEM; --} -- --void r8712_reordering_ctrl_timeout_handler(void *pcontext) --{ -- unsigned long irql; -- struct recv_reorder_ctrl *preorder_ctrl = pcontext; -- struct _adapter *padapter = preorder_ctrl->padapter; -- struct __queue *ppending_recvframe_queue = -- &preorder_ctrl->pending_recvframe_queue; -- -- if (padapter->driver_stopped || padapter->surprise_removed) -- return; -- spin_lock_irqsave(&ppending_recvframe_queue->lock, irql); -- r8712_recv_indicatepkts_in_order(padapter, preorder_ctrl, true); -- spin_unlock_irqrestore(&ppending_recvframe_queue->lock, irql); --} -- --static int r8712_process_recv_indicatepkts(struct _adapter *padapter, -- union recv_frame *prframe) --{ -- int retval = _SUCCESS; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct ht_priv *phtpriv = &pmlmepriv->htpriv; -- -- if (phtpriv->ht_option == 1) { /*B/G/N Mode*/ -- if (recv_indicatepkt_reorder(padapter, prframe)) { -- /* including perform A-MPDU Rx Ordering Buffer Control*/ -- if (!padapter->driver_stopped && -- !padapter->surprise_removed) -- return _FAIL; -- } -- } else { /*B/G mode*/ -- retval = r8712_wlanhdr_to_ethhdr(prframe); -- if (retval) -- return _FAIL; -- if (!padapter->driver_stopped && !padapter->surprise_removed) { -- /* indicate this recv_frame */ -- r8712_recv_indicatepkt(padapter, prframe); -- } else { -- return _FAIL; -- } -- } -- return retval; --} -- --static u8 query_rx_pwr_percentage(s8 antpower) --{ -- if ((antpower <= -100) || (antpower >= 20)) -- return 0; -- else if (antpower >= 0) -- return 100; -- else -- return 100 + antpower; --} -- --static u8 evm_db2percentage(s8 value) --{ -- /* -- * -33dB~0dB to 0%~99% -- */ -- s8 ret_val = clamp(-value, 0, 33) * 3; -- -- if (ret_val == 99) -- ret_val = 100; -- -- return ret_val; --} -- --s32 r8712_signal_scale_mapping(s32 cur_sig) --{ -- s32 ret_sig; -- -- if (cur_sig >= 51 && cur_sig <= 100) -- ret_sig = 100; -- else if (cur_sig >= 41 && cur_sig <= 50) -- ret_sig = 80 + ((cur_sig - 40) * 2); -- else if (cur_sig >= 31 && cur_sig <= 40) -- ret_sig = 66 + (cur_sig - 30); -- else if (cur_sig >= 21 && cur_sig <= 30) -- ret_sig = 54 + (cur_sig - 20); -- else if (cur_sig >= 10 && cur_sig <= 20) -- ret_sig = 42 + (((cur_sig - 10) * 2) / 3); -- else if (cur_sig >= 5 && cur_sig <= 9) -- ret_sig = 22 + (((cur_sig - 5) * 3) / 2); -- else if (cur_sig >= 1 && cur_sig <= 4) -- ret_sig = 6 + (((cur_sig - 1) * 3) / 2); -- else -- ret_sig = cur_sig; -- return ret_sig; --} -- --static s32 translate2dbm(struct _adapter *padapter, u8 signal_strength_idx) --{ -- s32 signal_power; /* in dBm.*/ -- /* Translate to dBm (x=0.5y-95).*/ -- signal_power = (s32)((signal_strength_idx + 1) >> 1); -- signal_power -= 95; -- return signal_power; --} -- --static void query_rx_phy_status(struct _adapter *padapter, -- union recv_frame *prframe) --{ -- u8 i, max_spatial_stream, evm; -- struct recv_stat *prxstat = (struct recv_stat *)prframe->u.hdr.rx_head; -- struct phy_stat *pphy_stat = (struct phy_stat *)(prxstat + 1); -- u8 *pphy_head = (u8 *)(prxstat + 1); -- s8 rx_pwr[4], rx_pwr_all; -- u8 pwdb_all; -- u32 rssi, total_rssi = 0; -- u8 bcck_rate = 0, rf_rx_num = 0, cck_highpwr = 0; -- struct phy_cck_rx_status *pcck_buf; -- u8 sq; -- -- /* Record it for next packet processing*/ -- bcck_rate = (prframe->u.hdr.attrib.mcs_rate <= 3 ? 1 : 0); -- if (bcck_rate) { -- u8 report; -- -- /* CCK Driver info Structure is not the same as OFDM packet.*/ -- pcck_buf = (struct phy_cck_rx_status *)pphy_stat; -- /* (1)Hardware does not provide RSSI for CCK -- * (2)PWDB, Average PWDB calculated by hardware -- * (for rate adaptive) -- */ -- if (!cck_highpwr) { -- report = pcck_buf->cck_agc_rpt & 0xc0; -- report >>= 6; -- switch (report) { -- /* Modify the RF RNA gain value to -40, -20, -- * -2, 14 by Jenyu's suggestion -- * Note: different RF with the different -- * RNA gain. -- */ -- case 0x3: -- rx_pwr_all = -40 - (pcck_buf->cck_agc_rpt & -- 0x3e); -- break; -- case 0x2: -- rx_pwr_all = -20 - (pcck_buf->cck_agc_rpt & -- 0x3e); -- break; -- case 0x1: -- rx_pwr_all = -2 - (pcck_buf->cck_agc_rpt & -- 0x3e); -- break; -- case 0x0: -- rx_pwr_all = 14 - (pcck_buf->cck_agc_rpt & -- 0x3e); -- break; -- } -- } else { -- report = ((u8)(le32_to_cpu(pphy_stat->phydw1) >> 8)) & -- 0x60; -- report >>= 5; -- switch (report) { -- case 0x3: -- rx_pwr_all = -40 - ((pcck_buf->cck_agc_rpt & -- 0x1f) << 1); -- break; -- case 0x2: -- rx_pwr_all = -20 - ((pcck_buf->cck_agc_rpt & -- 0x1f) << 1); -- break; -- case 0x1: -- rx_pwr_all = -2 - ((pcck_buf->cck_agc_rpt & -- 0x1f) << 1); -- break; -- case 0x0: -- rx_pwr_all = 14 - ((pcck_buf->cck_agc_rpt & -- 0x1f) << 1); -- break; -- } -- } -- pwdb_all = query_rx_pwr_percentage(rx_pwr_all); -- /* CCK gain is smaller than OFDM/MCS gain,*/ -- /* so we add gain diff by experiences, the val is 6 */ -- pwdb_all += 6; -- if (pwdb_all > 100) -- pwdb_all = 100; -- /* modify the offset to make the same gain index with OFDM.*/ -- if (pwdb_all > 34 && pwdb_all <= 42) -- pwdb_all -= 2; -- else if (pwdb_all > 26 && pwdb_all <= 34) -- pwdb_all -= 6; -- else if (pwdb_all > 14 && pwdb_all <= 26) -- pwdb_all -= 8; -- else if (pwdb_all > 4 && pwdb_all <= 14) -- pwdb_all -= 4; -- /* -- * (3) Get Signal Quality (EVM) -- */ -- if (pwdb_all > 40) { -- sq = 100; -- } else { -- sq = pcck_buf->sq_rpt; -- if (pcck_buf->sq_rpt > 64) -- sq = 0; -- else if (pcck_buf->sq_rpt < 20) -- sq = 100; -- else -- sq = ((64 - sq) * 100) / 44; -- } -- prframe->u.hdr.attrib.signal_qual = sq; -- prframe->u.hdr.attrib.rx_mimo_signal_qual[0] = sq; -- prframe->u.hdr.attrib.rx_mimo_signal_qual[1] = -1; -- } else { -- /* (1)Get RSSI for HT rate */ -- for (i = 0; i < ((padapter->registrypriv.rf_config) & -- 0x0f); i++) { -- rf_rx_num++; -- rx_pwr[i] = ((pphy_head[PHY_STAT_GAIN_TRSW_SHT + i] -- & 0x3F) * 2) - 110; -- /* Translate DBM to percentage. */ -- rssi = query_rx_pwr_percentage(rx_pwr[i]); -- total_rssi += rssi; -- } -- /* (2)PWDB, Average PWDB calculated by hardware (for -- * rate adaptive) -- */ -- rx_pwr_all = (((pphy_head[PHY_STAT_PWDB_ALL_SHT]) >> 1) & 0x7f) -- - 106; -- pwdb_all = query_rx_pwr_percentage(rx_pwr_all); -- -- { -- /* (3)EVM of HT rate */ -- if (prframe->u.hdr.attrib.htc && -- prframe->u.hdr.attrib.mcs_rate >= 20 && -- prframe->u.hdr.attrib.mcs_rate <= 27) { -- /* both spatial stream make sense */ -- max_spatial_stream = 2; -- } else { -- /* only spatial stream 1 makes sense */ -- max_spatial_stream = 1; -- } -- for (i = 0; i < max_spatial_stream; i++) { -- evm = evm_db2percentage((pphy_head -- [PHY_STAT_RXEVM_SHT + i]));/*dbm*/ -- prframe->u.hdr.attrib.signal_qual = -- (u8)(evm & 0xff); -- prframe->u.hdr.attrib.rx_mimo_signal_qual[i] = -- (u8)(evm & 0xff); -- } -- } -- } -- /* UI BSS List signal strength(in percentage), make it good looking, -- * from 0~100. It is assigned to the BSS List in -- * GetValueFromBeaconOrProbeRsp(). -- */ -- if (bcck_rate) { -- prframe->u.hdr.attrib.signal_strength = -- (u8)r8712_signal_scale_mapping(pwdb_all); -- } else { -- if (rf_rx_num != 0) -- prframe->u.hdr.attrib.signal_strength = -- (u8)(r8712_signal_scale_mapping(total_rssi /= -- rf_rx_num)); -- } --} -- --static void process_link_qual(struct _adapter *padapter, -- union recv_frame *prframe) --{ -- u32 last_evm = 0, tmpVal; -- struct rx_pkt_attrib *pattrib; -- struct smooth_rssi_data *sqd = &padapter->recvpriv.signal_qual_data; -- -- if (!prframe || !padapter) -- return; -- pattrib = &prframe->u.hdr.attrib; -- if (pattrib->signal_qual != 0) { -- /* -- * 1. Record the general EVM to the sliding window. -- */ -- if (sqd->total_num++ >= PHY_LINKQUALITY_SLID_WIN_MAX) { -- sqd->total_num = PHY_LINKQUALITY_SLID_WIN_MAX; -- last_evm = sqd->elements[sqd->index]; -- sqd->total_val -= last_evm; -- } -- sqd->total_val += pattrib->signal_qual; -- sqd->elements[sqd->index++] = pattrib->signal_qual; -- if (sqd->index >= PHY_LINKQUALITY_SLID_WIN_MAX) -- sqd->index = 0; -- -- /* <1> Showed on UI for user, in percentage. */ -- tmpVal = sqd->total_val / sqd->total_num; -- padapter->recvpriv.signal = (u8)tmpVal; -- } --} -- --static void process_rssi(struct _adapter *padapter, union recv_frame *prframe) --{ -- u32 last_rssi, tmp_val; -- struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib; -- struct smooth_rssi_data *ssd = &padapter->recvpriv.signal_strength_data; -- -- if (ssd->total_num++ >= PHY_RSSI_SLID_WIN_MAX) { -- ssd->total_num = PHY_RSSI_SLID_WIN_MAX; -- last_rssi = ssd->elements[ssd->index]; -- ssd->total_val -= last_rssi; -- } -- ssd->total_val += pattrib->signal_strength; -- ssd->elements[ssd->index++] = pattrib->signal_strength; -- if (ssd->index >= PHY_RSSI_SLID_WIN_MAX) -- ssd->index = 0; -- tmp_val = ssd->total_val / ssd->total_num; -- padapter->recvpriv.rssi = (s8)translate2dbm(padapter, (u8)tmp_val); --} -- --static void process_phy_info(struct _adapter *padapter, -- union recv_frame *prframe) --{ -- query_rx_phy_status(padapter, prframe); -- process_rssi(padapter, prframe); -- process_link_qual(padapter, prframe); --} -- --int recv_func(struct _adapter *padapter, void *pcontext) --{ -- struct rx_pkt_attrib *pattrib; -- union recv_frame *prframe, *orig_prframe; -- int retval = _SUCCESS; -- struct __queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- -- prframe = pcontext; -- orig_prframe = prframe; -- pattrib = &prframe->u.hdr.attrib; -- if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) { -- if (pattrib->crc_err == 1) -- padapter->mppriv.rx_crcerrpktcount++; -- else -- padapter->mppriv.rx_pktcount++; -- if (!check_fwstate(pmlmepriv, WIFI_MP_LPBK_STATE)) { -- /* free this recv_frame */ -- r8712_free_recvframe(orig_prframe, pfree_recv_queue); -- goto _exit_recv_func; -- } -- } -- /* check the frame crtl field and decache */ -- retval = r8712_validate_recv_frame(padapter, prframe); -- if (retval != _SUCCESS) { -- /* free this recv_frame */ -- r8712_free_recvframe(orig_prframe, pfree_recv_queue); -- goto _exit_recv_func; -- } -- process_phy_info(padapter, prframe); -- prframe = r8712_decryptor(padapter, prframe); -- if (!prframe) { -- retval = _FAIL; -- goto _exit_recv_func; -- } -- prframe = r8712_recvframe_chk_defrag(padapter, prframe); -- if (!prframe) -- goto _exit_recv_func; -- prframe = r8712_portctrl(padapter, prframe); -- if (!prframe) { -- retval = _FAIL; -- goto _exit_recv_func; -- } -- retval = r8712_process_recv_indicatepkts(padapter, prframe); -- if (retval != _SUCCESS) { -- r8712_free_recvframe(orig_prframe, pfree_recv_queue); -- goto _exit_recv_func; -- } --_exit_recv_func: -- return retval; --} -- --static void recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb) --{ -- u8 *pbuf, shift_sz = 0; -- u8 frag, mf; -- uint pkt_len; -- u32 transfer_len; -- struct recv_stat *prxstat; -- u16 pkt_cnt, drvinfo_sz, pkt_offset, tmp_len, alloc_sz; -- struct __queue *pfree_recv_queue; -- _pkt *pkt_copy = NULL; -- union recv_frame *precvframe = NULL; -- struct recv_priv *precvpriv = &padapter->recvpriv; -- -- pfree_recv_queue = &precvpriv->free_recv_queue; -- pbuf = pskb->data; -- prxstat = (struct recv_stat *)pbuf; -- pkt_cnt = (le32_to_cpu(prxstat->rxdw2) >> 16) & 0xff; -- pkt_len = le32_to_cpu(prxstat->rxdw0) & 0x00003fff; -- transfer_len = pskb->len; -- /* Test throughput with Netgear 3700 (No security) with Chariot 3T3R -- * pairs. The packet count will be a big number so that the containing -- * packet will effect the Rx reordering. -- */ -- if (transfer_len < pkt_len) { -- /* In this case, it means the MAX_RECVBUF_SZ is too small to -- * get the data from 8712u. -- */ -- return; -- } -- do { -- prxstat = (struct recv_stat *)pbuf; -- pkt_len = le32_to_cpu(prxstat->rxdw0) & 0x00003fff; -- /* more fragment bit */ -- mf = (le32_to_cpu(prxstat->rxdw1) >> 27) & 0x1; -- /* ragmentation number */ -- frag = (le32_to_cpu(prxstat->rxdw2) >> 12) & 0xf; -- /* uint 2^3 = 8 bytes */ -- drvinfo_sz = (le32_to_cpu(prxstat->rxdw0) & 0x000f0000) >> 16; -- drvinfo_sz <<= 3; -- if (pkt_len <= 0) -- return; -- /* Qos data, wireless lan header length is 26 */ -- if ((le32_to_cpu(prxstat->rxdw0) >> 23) & 0x01) -- shift_sz = 2; -- precvframe = r8712_alloc_recvframe(pfree_recv_queue); -- if (!precvframe) -- return; -- INIT_LIST_HEAD(&precvframe->u.hdr.list); -- precvframe->u.hdr.precvbuf = NULL; /*can't access the precvbuf*/ -- precvframe->u.hdr.len = 0; -- tmp_len = pkt_len + drvinfo_sz + RXDESC_SIZE; -- pkt_offset = (u16)round_up(tmp_len, 128); -- /* for first fragment packet, driver need allocate 1536 + -- * drvinfo_sz + RXDESC_SIZE to defrag packet. -- */ -- if ((mf == 1) && (frag == 0)) -- /*1658+6=1664, 1664 is 128 alignment.*/ -- alloc_sz = max_t(u16, tmp_len, 1658); -- else -- alloc_sz = tmp_len; -- /* 2 is for IP header 4 bytes alignment in QoS packet case. -- * 4 is for skb->data 4 bytes alignment. -- */ -- alloc_sz += 6; -- pkt_copy = netdev_alloc_skb(padapter->pnetdev, alloc_sz); -- if (!pkt_copy) -- return; -- -- precvframe->u.hdr.pkt = pkt_copy; -- skb_reserve(pkt_copy, 4 - ((addr_t)(pkt_copy->data) % 4)); -- skb_reserve(pkt_copy, shift_sz); -- memcpy(pkt_copy->data, pbuf, tmp_len); -- precvframe->u.hdr.rx_head = pkt_copy->data; -- precvframe->u.hdr.rx_data = pkt_copy->data; -- precvframe->u.hdr.rx_tail = pkt_copy->data; -- precvframe->u.hdr.rx_end = pkt_copy->data + alloc_sz; -- -- recvframe_put(precvframe, tmp_len); -- recvframe_pull(precvframe, drvinfo_sz + RXDESC_SIZE); -- /* because the endian issue, driver avoid reference to the -- * rxstat after calling update_recvframe_attrib_from_recvstat(); -- */ -- update_recvframe_attrib_from_recvstat(&precvframe->u.hdr.attrib, -- prxstat); -- r8712_recv_entry(precvframe); -- transfer_len -= pkt_offset; -- pbuf += pkt_offset; -- pkt_cnt--; -- precvframe = NULL; -- pkt_copy = NULL; -- } while ((transfer_len > 0) && pkt_cnt > 0); --} -- --static void recv_tasklet(struct tasklet_struct *t) --{ -- struct sk_buff *pskb; -- struct _adapter *padapter = from_tasklet(padapter, t, -- recvpriv.recv_tasklet); -- struct recv_priv *precvpriv = &padapter->recvpriv; -- -- while (NULL != (pskb = skb_dequeue(&precvpriv->rx_skb_queue))) { -- recvbuf2recvframe(padapter, pskb); -- skb_reset_tail_pointer(pskb); -- pskb->len = 0; -- if (!skb_cloned(pskb)) -- skb_queue_tail(&precvpriv->free_recv_skb_queue, pskb); -- else -- consume_skb(pskb); -- } --} -diff --git a/drivers/staging/rtl8712/rtl8712_recv.h b/drivers/staging/rtl8712/rtl8712_recv.h -deleted file mode 100644 -index f4d20b0efd4e87..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_recv.h -+++ /dev/null -@@ -1,145 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef _RTL8712_RECV_H_ --#define _RTL8712_RECV_H_ -- --#include "osdep_service.h" --#include "drv_types.h" -- --/* Realtek's v2.6.6 reduced this to 4. However, under heavy network and CPU -- * loads, even 8 receive buffers might not be enough; cutting it to 4 seemed -- * unwise. -- */ --#define NR_RECVBUFF (8) -- --#define NR_PREALLOC_RECV_SKB (8) --#define RXDESC_SIZE 24 --#define RXDESC_OFFSET RXDESC_SIZE --#define RECV_BLK_SZ 512 --#define RECV_BLK_CNT 16 --#define RECV_BLK_TH RECV_BLK_CNT --#define MAX_RECVBUF_SZ 9100 --#define RECVBUFF_ALIGN_SZ 512 --#define RSVD_ROOM_SZ (0) --/*These definition is used for Rx packet reordering.*/ --#define SN_LESS(a, b) (((a-b) & 0x800) != 0) --#define SN_EQUAL(a, b) (a == b) --#define REORDER_WAIT_TIME 30 /* (ms)*/ -- --struct recv_stat { -- __le32 rxdw0; -- __le32 rxdw1; -- __le32 rxdw2; -- __le32 rxdw3; -- __le32 rxdw4; -- __le32 rxdw5; --}; -- --struct phy_cck_rx_status { -- /* For CCK rate descriptor. This is a unsigned 8:1 variable. -- * LSB bit present 0.5. And MSB 7 bts present a signed value. -- * Range from -64~+63.5. -- */ -- u8 adc_pwdb_X[4]; -- u8 sq_rpt; -- u8 cck_agc_rpt; --}; -- --struct phy_stat { -- __le32 phydw0; -- __le32 phydw1; -- __le32 phydw2; -- __le32 phydw3; -- __le32 phydw4; -- __le32 phydw5; -- __le32 phydw6; -- __le32 phydw7; --}; -- --#define PHY_STAT_GAIN_TRSW_SHT 0 --#define PHY_STAT_PWDB_ALL_SHT 4 --#define PHY_STAT_CFOSHO_SHT 5 --#define PHY_STAT_CCK_AGC_RPT_SHT 5 --#define PHY_STAT_CFOTAIL_SHT 9 --#define PHY_STAT_RXEVM_SHT 13 --#define PHY_STAT_RXSNR_SHT 15 --#define PHY_STAT_PDSNR_SHT 19 --#define PHY_STAT_CSI_CURRENT_SHT 21 --#define PHY_STAT_CSI_TARGET_SHT 23 --#define PHY_STAT_SIGEVM_SHT 25 --#define PHY_STAT_MAX_EX_PWR_SHT 26 -- --union recvstat { -- struct recv_stat recv_stat; -- unsigned int value[RXDESC_SIZE>>2]; --}; -- --struct recv_buf { -- struct list_head list; -- spinlock_t recvbuf_lock; -- u32 ref_cnt; -- struct _adapter *adapter; -- struct urb *purb; -- _pkt *pskb; -- u8 irp_pending; -- u32 transfer_len; -- uint len; -- u8 *phead; -- u8 *pdata; -- u8 *ptail; -- u8 *pend; -- u8 *pbuf; -- u8 *pallocated_buf; --}; -- --/* -- * head -----> -- * data -----> -- * payload -- * tail -----> -- * end -----> -- * len = (unsigned int )(tail - data); -- */ --struct recv_frame_hdr { -- struct list_head list; -- _pkt *pkt; -- _pkt *pkt_newalloc; -- struct _adapter *adapter; -- u8 fragcnt; -- struct rx_pkt_attrib attrib; -- uint len; -- u8 *rx_head; -- u8 *rx_data; -- u8 *rx_tail; -- u8 *rx_end; -- void *precvbuf; -- struct sta_info *psta; -- /*for A-MPDU Rx reordering buffer control*/ -- struct recv_reorder_ctrl *preorder_ctrl; --}; -- --union recv_frame { -- union { -- struct list_head list; -- struct recv_frame_hdr hdr; -- } u; --}; -- --void r8712_init_recvbuf(struct _adapter *padapter, struct recv_buf *precvbuf); --void r8712_rxcmd_event_hdl(struct _adapter *padapter, void *prxcmdbuf); --s32 r8712_signal_scale_mapping(s32 cur_sig); --void r8712_reordering_ctrl_timeout_handler(void *pcontext); -- --#endif -- -diff --git a/drivers/staging/rtl8712/rtl8712_regdef.h b/drivers/staging/rtl8712/rtl8712_regdef.h -deleted file mode 100644 -index 28aec9aa539fd3..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_regdef.h -+++ /dev/null -@@ -1,32 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __RTL8712_REGDEF_H__ --#define __RTL8712_REGDEF_H__ -- --#include "rtl8712_syscfg_regdef.h" --#include "rtl8712_cmdctrl_regdef.h" --#include "rtl8712_macsetting_regdef.h" --#include "rtl8712_timectrl_regdef.h" --#include "rtl8712_fifoctrl_regdef.h" --#include "rtl8712_ratectrl_regdef.h" --#include "rtl8712_edcasetting_regdef.h" --#include "rtl8712_wmac_regdef.h" --#include "rtl8712_powersave_regdef.h" --#include "rtl8712_gp_regdef.h" --#include "rtl8712_debugctrl_regdef.h" -- --#define HIMR (RTL8712_INTERRUPT_ + 0x08) -- --#endif /* __RTL8712_REGDEF_H__*/ -- -diff --git a/drivers/staging/rtl8712/rtl8712_security_bitdef.h b/drivers/staging/rtl8712/rtl8712_security_bitdef.h -deleted file mode 100644 -index 44275ef455a0ae..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_security_bitdef.h -+++ /dev/null -@@ -1,34 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- ******************************************************************************/ --#ifndef __RTL8712_SECURITY_BITDEF_H__ --#define __RTL8712_SECURITY_BITDEF_H__ -- --/*CAMCMD*/ --#define _SECCAM_POLLING BIT(31) --#define _SECCAM_CLR BIT(30) --#define _SECCAM_WE BIT(16) --#define _SECCAM_ADR_MSK 0x000000FF --#define _SECCAM_ADR_SHT 0 -- --/*CAMDBG*/ --#define _SECCAM_INFO BIT(31) --#define _SEC_KEYFOUND BIT(30) --#define _SEC_CONFIG_MSK 0x3F000000 --#define _SEC_CONFIG_SHT 24 --#define _SEC_KEYCONTENT_MSK 0x00FFFFFF --#define _SEC_KEYCONTENT_SHT 0 -- --/*SECCFG*/ --#define _NOSKMC BIT(5) --#define _SKBYA2 BIT(4) --#define _RXDEC BIT(3) --#define _TXENC BIT(2) --#define _RXUSEDK BIT(1) --#define _TXUSEDK BIT(0) -- --#endif /*__RTL8712_SECURITY_BITDEF_H__*/ -- -diff --git a/drivers/staging/rtl8712/rtl8712_spec.h b/drivers/staging/rtl8712/rtl8712_spec.h -deleted file mode 100644 -index 613a410e5714bc..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_spec.h -+++ /dev/null -@@ -1,121 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __RTL8712_SPEC_H__ --#define __RTL8712_SPEC_H__ -- --#define RTL8712_IOBASE_TXPKT 0x10200000 /*IOBASE_TXPKT*/ --#define RTL8712_IOBASE_RXPKT 0x10210000 /*IOBASE_RXPKT*/ --#define RTL8712_IOBASE_RXCMD 0x10220000 /*IOBASE_RXCMD*/ --#define RTL8712_IOBASE_TXSTATUS 0x10230000 /*IOBASE_TXSTATUS*/ --#define RTL8712_IOBASE_RXSTATUS 0x10240000 /*IOBASE_RXSTATUS*/ --#define RTL8712_IOBASE_IOREG 0x10250000 /*IOBASE_IOREG ADDR*/ --#define RTL8712_IOBASE_SCHEDULER 0x10260000 /*IOBASE_SCHEDULE*/ -- --#define RTL8712_IOBASE_TRXDMA 0x10270000 /*IOBASE_TRXDMA*/ --#define RTL8712_IOBASE_TXLLT 0x10280000 /*IOBASE_TXLLT*/ --#define RTL8712_IOBASE_WMAC 0x10290000 /*IOBASE_WMAC*/ --#define RTL8712_IOBASE_FW2HW 0x102A0000 /*IOBASE_FW2HW*/ --#define RTL8712_IOBASE_ACCESS_PHYREG 0x102B0000 /*IOBASE_ACCESS_PHYREG*/ -- --#define RTL8712_IOBASE_FF 0x10300000 /*IOBASE_FIFO 0x1031000~0x103AFFFF*/ -- --/*IOREG Offset for 8712*/ --#define RTL8712_SYSCFG_ RTL8712_IOBASE_IOREG --#define RTL8712_CMDCTRL_ (RTL8712_IOBASE_IOREG + 0x40) --#define RTL8712_MACIDSETTING_ (RTL8712_IOBASE_IOREG + 0x50) --#define RTL8712_TIMECTRL_ (RTL8712_IOBASE_IOREG + 0x80) --#define RTL8712_FIFOCTRL_ (RTL8712_IOBASE_IOREG + 0xA0) --#define RTL8712_RATECTRL_ (RTL8712_IOBASE_IOREG + 0x160) --#define RTL8712_EDCASETTING_ (RTL8712_IOBASE_IOREG + 0x1D0) --#define RTL8712_WMAC_ (RTL8712_IOBASE_IOREG + 0x200) --#define RTL8712_SECURITY_ (RTL8712_IOBASE_IOREG + 0x240) --#define RTL8712_POWERSAVE_ (RTL8712_IOBASE_IOREG + 0x260) --#define RTL8712_GP_ (RTL8712_IOBASE_IOREG + 0x2E0) --#define RTL8712_INTERRUPT_ (RTL8712_IOBASE_IOREG + 0x300) --#define RTL8712_DEBUGCTRL_ (RTL8712_IOBASE_IOREG + 0x310) --#define RTL8712_OFFLOAD_ (RTL8712_IOBASE_IOREG + 0x2D0) -- --/*FIFO for 8712*/ --#define RTL8712_DMA_BCNQ (RTL8712_IOBASE_FF + 0x10000) --#define RTL8712_DMA_MGTQ (RTL8712_IOBASE_FF + 0x20000) --#define RTL8712_DMA_BMCQ (RTL8712_IOBASE_FF + 0x30000) --#define RTL8712_DMA_VOQ (RTL8712_IOBASE_FF + 0x40000) --#define RTL8712_DMA_VIQ (RTL8712_IOBASE_FF + 0x50000) --#define RTL8712_DMA_BEQ (RTL8712_IOBASE_FF + 0x60000) --#define RTL8712_DMA_BKQ (RTL8712_IOBASE_FF + 0x70000) --#define RTL8712_DMA_RX0FF (RTL8712_IOBASE_FF + 0x80000) --#define RTL8712_DMA_H2CCMD (RTL8712_IOBASE_FF + 0x90000) --#define RTL8712_DMA_C2HCMD (RTL8712_IOBASE_FF + 0xA0000) -- --/*------------------------------*/ -- --/*BIT 16 15*/ --#define DID_SDIO_LOCAL 0 /* 0 0*/ --#define DID_WLAN_IOREG 1 /* 0 1*/ --#define DID_WLAN_FIFO 3 /* 1 1*/ --#define DID_UNDEFINE (-1) -- --#define CMD_ADDR_MAPPING_SHIFT 2 /*SDIO CMD ADDR MAPPING, -- *shift 2 bit for match -- * offset[14:2] -- */ -- --/*Offset for SDIO LOCAL*/ --#define OFFSET_SDIO_LOCAL 0x0FFF -- --/*Offset for WLAN IOREG*/ --#define OFFSET_WLAN_IOREG 0x0FFF -- --/*Offset for WLAN FIFO*/ --#define OFFSET_TX_BCNQ 0x0300 --#define OFFSET_TX_HIQ 0x0310 --#define OFFSET_TX_CMDQ 0x0320 --#define OFFSET_TX_MGTQ 0x0330 --#define OFFSET_TX_HCCAQ 0x0340 --#define OFFSET_TX_VOQ 0x0350 --#define OFFSET_TX_VIQ 0x0360 --#define OFFSET_TX_BEQ 0x0370 --#define OFFSET_TX_BKQ 0x0380 --#define OFFSET_RX_RX0FFQ 0x0390 --#define OFFSET_RX_C2HFFQ 0x03A0 -- --#define BK_QID_01 1 --#define BK_QID_02 2 --#define BE_QID_01 0 --#define BE_QID_02 3 --#define VI_QID_01 4 --#define VI_QID_02 5 --#define VO_QID_01 6 --#define VO_QID_02 7 --#define HCCA_QID_01 8 --#define HCCA_QID_02 9 --#define HCCA_QID_03 10 --#define HCCA_QID_04 11 --#define HCCA_QID_05 12 --#define HCCA_QID_06 13 --#define HCCA_QID_07 14 --#define HCCA_QID_08 15 --#define HI_QID 17 --#define CMD_QID 19 --#define MGT_QID 18 --#define BCN_QID 16 -- --#include "rtl8712_regdef.h" -- --#include "rtl8712_bitdef.h" -- --#include "basic_types.h" -- --#endif /* __RTL8712_SPEC_H__ */ -- -diff --git a/drivers/staging/rtl8712/rtl8712_syscfg_bitdef.h b/drivers/staging/rtl8712/rtl8712_syscfg_bitdef.h -deleted file mode 100644 -index d92df3fbd2b193..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_syscfg_bitdef.h -+++ /dev/null -@@ -1,163 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __RTL8712_SYSCFG_BITDEF_H__ --#define __RTL8712_SYSCFG_BITDEF_H__ -- --/*SYS_PWR_CTRL*/ --/*SRCTRL0*/ --/*SRCTRL1*/ --/*SYS_CLKR*/ -- --/*SYS_IOS_CTRL*/ --#define iso_LDR2RP_SHT 8 /* EE Loader to Retention Path*/ --#define iso_LDR2RP BIT(iso_LDR2RP_SHT) /* 1:isolation, 0:attach*/ -- --/*SYS_CTRL*/ --#define FEN_DIO_SDIO_SHT 0 --#define FEN_DIO_SDIO BIT(FEN_DIO_SDIO_SHT) --#define FEN_SDIO_SHT 1 --#define FEN_SDIO BIT(FEN_SDIO_SHT) --#define FEN_USBA_SHT 2 --#define FEN_USBA BIT(FEN_USBA_SHT) --#define FEN_UPLL_SHT 3 --#define FEN_UPLL BIT(FEN_UPLL_SHT) --#define FEN_USBD_SHT 4 --#define FEN_USBD BIT(FEN_USBD_SHT) --#define FEN_DIO_PCIE_SHT 5 --#define FEN_DIO_PCIE BIT(FEN_DIO_PCIE_SHT) --#define FEN_PCIEA_SHT 6 --#define FEN_PCIEA BIT(FEN_PCIEA_SHT) --#define FEN_PPLL_SHT 7 --#define FEN_PPLL BIT(FEN_PPLL_SHT) --#define FEN_PCIED_SHT 8 --#define FEN_PCIED BIT(FEN_PCIED_SHT) --#define FEN_CPUEN_SHT 10 --#define FEN_CPUEN BIT(FEN_CPUEN_SHT) --#define FEN_DCORE_SHT 11 --#define FEN_DCORE BIT(FEN_DCORE_SHT) --#define FEN_ELDR_SHT 12 --#define FEN_ELDR BIT(FEN_ELDR_SHT) --#define PWC_DV2LDR_SHT 13 --#define PWC_DV2LDR BIT(PWC_DV2LDR_SHT) /* Loader Power Enable*/ -- --/*=== SYS_CLKR ===*/ --#define SYS_CLKSEL_SHT 0 --#define SYS_CLKSEL BIT(SYS_CLKSEL_SHT) /* System Clock 80MHz*/ --#define PS_CLKSEL_SHT 1 --#define PS_CLKSEL BIT(PS_CLKSEL_SHT) /*System power save -- * clock select. -- */ --#define CPU_CLKSEL_SHT 2 --#define CPU_CLKSEL BIT(CPU_CLKSEL_SHT) /* System Clock select, -- * 1: AFE source, -- * 0: System clock(L-Bus) -- */ --#define INT32K_EN_SHT 3 --#define INT32K_EN BIT(INT32K_EN_SHT) --#define MACSLP_SHT 4 --#define MACSLP BIT(MACSLP_SHT) --#define MAC_CLK_EN_SHT 11 --#define MAC_CLK_EN BIT(MAC_CLK_EN_SHT) /* MAC Clock Enable.*/ --#define SYS_CLK_EN_SHT 12 --#define SYS_CLK_EN BIT(SYS_CLK_EN_SHT) --#define RING_CLK_EN_SHT 13 --#define RING_CLK_EN BIT(RING_CLK_EN_SHT) --#define SWHW_SEL_SHT 14 --#define SWHW_SEL BIT(SWHW_SEL_SHT) /* Load done, -- * control path switch. -- */ --#define FWHW_SEL_SHT 15 --#define FWHW_SEL BIT(FWHW_SEL_SHT) /* Sleep exit, -- * control path switch. -- */ -- --/*9346CR*/ --#define _VPDIDX_MSK 0xFF00 --#define _VPDIDX_SHT 8 --#define _EEM_MSK 0x00C0 --#define _EEM_SHT 6 --#define _EEM0 BIT(6) --#define _EEM1 BIT(7) --#define _EEPROM_EN BIT(5) --#define _9356SEL BIT(4) --#define _EECS BIT(3) --#define _EESK BIT(2) --#define _EEDI BIT(1) --#define _EEDO BIT(0) -- --/*AFE_MISC*/ --#define AFE_MISC_USB_MBEN_SHT 7 --#define AFE_MISC_USB_MBEN BIT(AFE_MISC_USB_MBEN_SHT) --#define AFE_MISC_USB_BGEN_SHT 6 --#define AFE_MISC_USB_BGEN BIT(AFE_MISC_USB_BGEN_SHT) --#define AFE_MISC_LD12_VDAJ_SHT 4 --#define AFE_MISC_LD12_VDAJ_MSK 0X0030 --#define AFE_MISC_LD12_VDAJ BIT(AFE_MISC_LD12_VDAJ_SHT) --#define AFE_MISC_I32_EN_SHT 3 --#define AFE_MISC_I32_EN BIT(AFE_MISC_I32_EN_SHT) --#define AFE_MISC_E32_EN_SHT 2 --#define AFE_MISC_E32_EN BIT(AFE_MISC_E32_EN_SHT) --#define AFE_MISC_MBEN_SHT 1 --#define AFE_MISC_MBEN BIT(AFE_MISC_MBEN_SHT)/* Enable AFE Macro -- * Block's Mbias. -- */ --#define AFE_MISC_BGEN_SHT 0 --#define AFE_MISC_BGEN BIT(AFE_MISC_BGEN_SHT)/* Enable AFE Macro -- * Block's Bandgap. -- */ -- --/*--------------------------------------------------------------------------*/ --/* SPS1_CTRL bits (Offset 0x18-1E, 56bits)*/ --/*--------------------------------------------------------------------------*/ --#define SPS1_SWEN BIT(1) /* Enable vsps18 SW Macro Block.*/ --#define SPS1_LDEN BIT(0) /* Enable VSPS12 LDO Macro block.*/ -- --/*----------------------------------------------------------------------------*/ --/* LDOA15_CTRL bits (Offset 0x20, 8bits)*/ --/*----------------------------------------------------------------------------*/ --#define LDA15_EN BIT(0) /* Enable LDOA15 Macro Block*/ -- --/*----------------------------------------------------------------------------*/ --/* 8192S LDOV12D_CTRL bit (Offset 0x21, 8bits)*/ --/*----------------------------------------------------------------------------*/ --#define LDV12_EN BIT(0) /* Enable LDOVD12 Macro Block*/ --#define LDV12_SDBY BIT(1) /* LDOVD12 standby mode*/ -- --/*CLK_PS_CTRL*/ --#define _CLK_GATE_EN BIT(0) -- --/* EFUSE_CTRL*/ --#define EF_FLAG BIT(31) /* Access Flag, Write:1; -- * Read:0 -- */ --#define EF_PGPD 0x70000000 /* E-fuse Program time*/ --#define EF_RDT 0x0F000000 /* E-fuse read time: in the -- * unit of cycle time -- */ --#define EF_PDN_EN BIT(19) /* EFuse Power down enable*/ --#define ALD_EN BIT(18) /* Autoload Enable*/ --#define EF_ADDR 0x0003FF00 /* Access Address*/ --#define EF_DATA 0x000000FF /* Access Data*/ -- --/* EFUSE_TEST*/ --#define LDOE25_EN BIT(31) /* Enable LDOE25 Macro Block*/ -- --/* EFUSE_CLK_CTRL*/ --#define EFUSE_CLK_EN BIT(1) /* E-Fuse Clock Enable*/ --#define EFUSE_CLK_SEL BIT(0) /* E-Fuse Clock Select, -- * 0:500K, 1:40M -- */ -- --#endif /*__RTL8712_SYSCFG_BITDEF_H__*/ -- -diff --git a/drivers/staging/rtl8712/rtl8712_syscfg_regdef.h b/drivers/staging/rtl8712/rtl8712_syscfg_regdef.h -deleted file mode 100644 -index da5efcdedabe2f..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_syscfg_regdef.h -+++ /dev/null -@@ -1,42 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __RTL8712_SYSCFG_REGDEF_H__ --#define __RTL8712_SYSCFG_REGDEF_H__ -- --#define SYS_ISO_CTRL (RTL8712_SYSCFG_ + 0x0000) --#define SYS_FUNC_EN (RTL8712_SYSCFG_ + 0x0002) --#define PMC_FSM (RTL8712_SYSCFG_ + 0x0004) --#define SYS_CLKR (RTL8712_SYSCFG_ + 0x0008) --#define EE_9346CR (RTL8712_SYSCFG_ + 0x000A) --#define EE_VPD (RTL8712_SYSCFG_ + 0x000C) --#define AFE_MISC (RTL8712_SYSCFG_ + 0x0010) --#define SPS0_CTRL (RTL8712_SYSCFG_ + 0x0011) --#define SPS1_CTRL (RTL8712_SYSCFG_ + 0x0018) --#define RF_CTRL (RTL8712_SYSCFG_ + 0x001F) --#define LDOA15_CTRL (RTL8712_SYSCFG_ + 0x0020) --#define LDOV12D_CTRL (RTL8712_SYSCFG_ + 0x0021) --#define LDOHCI12_CTRL (RTL8712_SYSCFG_ + 0x0022) --#define LDO_USB_CTRL (RTL8712_SYSCFG_ + 0x0023) --#define LPLDO_CTRL (RTL8712_SYSCFG_ + 0x0024) --#define AFE_XTAL_CTRL (RTL8712_SYSCFG_ + 0x0026) --#define AFE_PLL_CTRL (RTL8712_SYSCFG_ + 0x0028) --#define EFUSE_CTRL (RTL8712_SYSCFG_ + 0x0030) --#define EFUSE_TEST (RTL8712_SYSCFG_ + 0x0034) --#define PWR_DATA (RTL8712_SYSCFG_ + 0x0038) --#define DPS_TIMER (RTL8712_SYSCFG_ + 0x003C) --#define RCLK_MON (RTL8712_SYSCFG_ + 0x003E) --#define EFUSE_CLK_CTRL (RTL8712_SYSCFG_ + 0x02F8) -- --#endif /*__RTL8712_SYSCFG_REGDEF_H__*/ -- -diff --git a/drivers/staging/rtl8712/rtl8712_timectrl_bitdef.h b/drivers/staging/rtl8712/rtl8712_timectrl_bitdef.h -deleted file mode 100644 -index d7bc9dd5cecd21..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_timectrl_bitdef.h -+++ /dev/null -@@ -1,49 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- ******************************************************************************/ --#ifndef __RTL8712_TIMECTRL_BITDEF_H__ --#define __RTL8712_TIMECTRL_BITDEF_H__ -- --/*TSFTR*/ --/*SLOT*/ --/*USTIME*/ -- --/*TUBASE*/ --#define _TUBASE_MSK 0x07FF -- --/*SIFS_CCK*/ --#define _SIFS_CCK_TRX_MSK 0xFF00 --#define _SIFS_CCK_TRX_SHT 0x8 --#define _SIFS_CCK_CTX_MSK 0x00FF --#define _SIFS_CCK_CTX_SHT 0 -- --/*SIFS_OFDM*/ --#define _SIFS_OFDM_TRX_MSK 0xFF00 --#define _SIFS_OFDM_TRX_SHT 0x8 --#define _SIFS_OFDM_CTX_MSK 0x00FF --#define _SIFS_OFDM_CTX_SHT 0 -- --/*PIFS*/ --/*ACKTO*/ --/*EIFS*/ --/*BCNITV*/ --/*ATIMWND*/ -- --/*DRVERLYINT*/ --#define _ENSWBCN BIT(15) --#define _DRVERLY_TU_MSK 0x0FF0 --#define _DRVERLY_TU_SHT 4 --#define _DRVERLY_US_MSK 0x000F --#define _DRVERLY_US_SHT 0 -- --/*BCNDMATIM*/ --#define _BCNDMATIM_MSK 0x03FF -- --/*BCNERRTH*/ --/*MLT*/ -- --#endif /* __RTL8712_TIMECTRL_BITDEF_H__*/ -- -diff --git a/drivers/staging/rtl8712/rtl8712_timectrl_regdef.h b/drivers/staging/rtl8712/rtl8712_timectrl_regdef.h -deleted file mode 100644 -index b51603f1b88004..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_timectrl_regdef.h -+++ /dev/null -@@ -1,26 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- ******************************************************************************/ --#ifndef __RTL8712_TIMECTRL_REGDEF_H__ --#define __RTL8712_TIMECTRL_REGDEF_H__ -- --#define TSFTR (RTL8712_TIMECTRL_ + 0x00) --#define USTIME (RTL8712_TIMECTRL_ + 0x08) --#define SLOT (RTL8712_TIMECTRL_ + 0x09) --#define TUBASE (RTL8712_TIMECTRL_ + 0x0A) --#define SIFS_CCK (RTL8712_TIMECTRL_ + 0x0C) --#define SIFS_OFDM (RTL8712_TIMECTRL_ + 0x0E) --#define PIFS (RTL8712_TIMECTRL_ + 0x10) --#define ACKTO (RTL8712_TIMECTRL_ + 0x11) --#define EIFS (RTL8712_TIMECTRL_ + 0x12) --#define BCNITV (RTL8712_TIMECTRL_ + 0x14) --#define ATIMWND (RTL8712_TIMECTRL_ + 0x16) --#define DRVERLYINT (RTL8712_TIMECTRL_ + 0x18) --#define BCNDMATIM (RTL8712_TIMECTRL_ + 0x1A) --#define BCNERRTH (RTL8712_TIMECTRL_ + 0x1C) --#define MLT (RTL8712_TIMECTRL_ + 0x1D) -- --#endif /* __RTL8712_TIMECTRL_REGDEF_H__ */ -diff --git a/drivers/staging/rtl8712/rtl8712_wmac_bitdef.h b/drivers/staging/rtl8712/rtl8712_wmac_bitdef.h -deleted file mode 100644 -index ea164e48234766..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_wmac_bitdef.h -+++ /dev/null -@@ -1,49 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __RTL8712_WMAC_BITDEF_H__ --#define __RTL8712_WMAC_BITDEF_H__ -- --/*NAVCTRL*/ --#define _NAV_UPPER_EN BIT(18) --#define _NAV_MTO_EN BIT(17) --#define _NAV_UPPER BIT(16) --#define _NAV_MTO_MSK 0xFF00 --#define _NAV_MTO_SHT 8 --#define _RTSRST_MSK 0x00FF --#define _RTSRST_SHT 0 -- --/*BWOPMODE*/ --#define _20MHZBW BIT(2) -- --/*BACAMCMD*/ --#define _BACAM_POLL BIT(31) --#define _BACAM_RST BIT(17) --#define _BACAM_RW BIT(16) --#define _BACAM_ADDR_MSK 0x0000007F --#define _BACAM_ADDR_SHT 0 -- --/*LBDLY*/ --#define _LBDLY_MSK 0x1F -- --/*FWDLY*/ --#define _FWDLY_MSK 0x0F -- --/*RXERR_RPT*/ --#define _RXERR_RPT_SEL_MSK 0xF0000000 --#define _RXERR_RPT_SEL_SHT 28 --#define _RPT_CNT_MSK 0x000FFFFF --#define _RPT_CNT_SHT 0 -- --#endif /*__RTL8712_WMAC_BITDEF_H__*/ -- -diff --git a/drivers/staging/rtl8712/rtl8712_wmac_regdef.h b/drivers/staging/rtl8712/rtl8712_wmac_regdef.h -deleted file mode 100644 -index dfe3e9fbed4313..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_wmac_regdef.h -+++ /dev/null -@@ -1,36 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __RTL8712_WMAC_REGDEF_H__ --#define __RTL8712_WMAC_REGDEF_H__ -- --#define NAVCTRL (RTL8712_WMAC_ + 0x00) --#define BWOPMODE (RTL8712_WMAC_ + 0x03) --#define BACAMCMD (RTL8712_WMAC_ + 0x04) --#define BACAMCONTENT (RTL8712_WMAC_ + 0x08) --#define LBDLY (RTL8712_WMAC_ + 0x10) --#define FWDLY (RTL8712_WMAC_ + 0x11) --#define HWPC_RX_CTRL (RTL8712_WMAC_ + 0x18) --#define MQ (RTL8712_WMAC_ + 0x20) --#define MA (RTL8712_WMAC_ + 0x22) --#define MS (RTL8712_WMAC_ + 0x24) --#define CLM_RESULT (RTL8712_WMAC_ + 0x27) --#define NHM_RPI_CNT (RTL8712_WMAC_ + 0x28) --#define RXERR_RPT (RTL8712_WMAC_ + 0x30) --#define NAV_PROT_LEN (RTL8712_WMAC_ + 0x34) --#define CFEND_TH (RTL8712_WMAC_ + 0x36) --#define AMPDU_MIN_SPACE (RTL8712_WMAC_ + 0x37) --#define TXOP_STALL_CTRL (RTL8712_WMAC_ + 0x38) -- --#endif /*__RTL8712_WMAC_REGDEF_H__*/ -- -diff --git a/drivers/staging/rtl8712/rtl8712_xmit.c b/drivers/staging/rtl8712/rtl8712_xmit.c -deleted file mode 100644 -index 4cb01f590673e3..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_xmit.c -+++ /dev/null -@@ -1,744 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * rtl8712_xmit.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _RTL8712_XMIT_C_ -- --#include "osdep_service.h" --#include "drv_types.h" --#include "wifi.h" --#include "osdep_intf.h" --#include "usb_ops.h" -- --static void dump_xframe(struct _adapter *padapter, -- struct xmit_frame *pxmitframe); --static void update_txdesc(struct xmit_frame *pxmitframe, uint *pmem, int sz); -- --sint _r8712_init_hw_txqueue(struct hw_txqueue *phw_txqueue, u8 ac_tag) --{ -- phw_txqueue->ac_tag = ac_tag; -- switch (ac_tag) { -- case BE_QUEUE_INX: -- phw_txqueue->ff_hwaddr = RTL8712_DMA_BEQ; -- break; -- case BK_QUEUE_INX: -- phw_txqueue->ff_hwaddr = RTL8712_DMA_BKQ; -- break; -- case VI_QUEUE_INX: -- phw_txqueue->ff_hwaddr = RTL8712_DMA_VIQ; -- break; -- case VO_QUEUE_INX: -- phw_txqueue->ff_hwaddr = RTL8712_DMA_VOQ; -- break; -- case BMC_QUEUE_INX: -- phw_txqueue->ff_hwaddr = RTL8712_DMA_BEQ; -- break; -- } -- return _SUCCESS; --} -- --int r8712_txframes_sta_ac_pending(struct _adapter *padapter, -- struct pkt_attrib *pattrib) --{ -- struct sta_info *psta; -- struct tx_servq *ptxservq; -- int priority = pattrib->priority; -- -- psta = pattrib->psta; -- switch (priority) { -- case 1: -- case 2: -- ptxservq = &psta->sta_xmitpriv.bk_q; -- break; -- case 4: -- case 5: -- ptxservq = &psta->sta_xmitpriv.vi_q; -- break; -- case 6: -- case 7: -- ptxservq = &psta->sta_xmitpriv.vo_q; -- break; -- case 0: -- case 3: -- default: -- ptxservq = &psta->sta_xmitpriv.be_q; -- break; -- } -- return ptxservq->qcnt; --} -- --static u32 get_ff_hwaddr(struct xmit_frame *pxmitframe) --{ -- u32 addr = 0; -- struct pkt_attrib *pattrib = &pxmitframe->attrib; -- struct _adapter *padapter = pxmitframe->padapter; -- struct dvobj_priv *pdvobj = &padapter->dvobjpriv; -- -- if (pxmitframe->frame_tag == TXAGG_FRAMETAG) { -- addr = RTL8712_DMA_H2CCMD; -- } else if (pxmitframe->frame_tag == MGNT_FRAMETAG) { -- addr = RTL8712_DMA_MGTQ; -- } else if (pdvobj->nr_endpoint == 6) { -- switch (pattrib->priority) { -- case 0: -- case 3: -- addr = RTL8712_DMA_BEQ; -- break; -- case 1: -- case 2: -- addr = RTL8712_DMA_BKQ; -- break; -- case 4: -- case 5: -- addr = RTL8712_DMA_VIQ; -- break; -- case 6: -- case 7: -- addr = RTL8712_DMA_VOQ; -- break; -- case 0x10: -- case 0x11: -- case 0x12: -- case 0x13: -- addr = RTL8712_DMA_H2CCMD; -- break; -- default: -- addr = RTL8712_DMA_BEQ; -- break; -- } -- } else if (pdvobj->nr_endpoint == 4) { -- switch (pattrib->qsel) { -- case 0: -- case 3: -- case 1: -- case 2: -- addr = RTL8712_DMA_BEQ;/*RTL8712_EP_LO;*/ -- break; -- case 4: -- case 5: -- case 6: -- case 7: -- addr = RTL8712_DMA_VOQ;/*RTL8712_EP_HI;*/ -- break; -- case 0x10: -- case 0x11: -- case 0x12: -- case 0x13: -- addr = RTL8712_DMA_H2CCMD; -- break; -- default: -- addr = RTL8712_DMA_BEQ;/*RTL8712_EP_LO;*/ -- break; -- } -- } -- return addr; --} -- --static struct xmit_frame *dequeue_one_xmitframe(struct xmit_priv *pxmitpriv, -- struct hw_xmit *phwxmit, -- struct tx_servq *ptxservq, -- struct __queue *pframe_queue) --{ -- struct list_head *xmitframe_plist, *xmitframe_phead; -- struct xmit_frame *pxmitframe = NULL; -- -- xmitframe_phead = &pframe_queue->queue; -- xmitframe_plist = xmitframe_phead->next; -- if (!end_of_queue_search(xmitframe_phead, xmitframe_plist)) { -- pxmitframe = container_of(xmitframe_plist, -- struct xmit_frame, list); -- list_del_init(&pxmitframe->list); -- ptxservq->qcnt--; -- phwxmit->txcmdcnt++; -- } -- return pxmitframe; --} -- --static struct xmit_frame *dequeue_xframe_ex(struct xmit_priv *pxmitpriv, -- struct hw_xmit *phwxmit_i, sint entry) --{ -- unsigned long irqL0; -- struct list_head *sta_plist, *sta_phead; -- struct hw_xmit *phwxmit; -- struct tx_servq *ptxservq = NULL; -- struct __queue *pframe_queue = NULL; -- struct xmit_frame *pxmitframe = NULL; -- int i, inx[4]; -- int j, acirp_cnt[4]; -- -- /*entry indx: 0->vo, 1->vi, 2->be, 3->bk.*/ -- inx[0] = 0; acirp_cnt[0] = pxmitpriv->voq_cnt; -- inx[1] = 1; acirp_cnt[1] = pxmitpriv->viq_cnt; -- inx[2] = 2; acirp_cnt[2] = pxmitpriv->beq_cnt; -- inx[3] = 3; acirp_cnt[3] = pxmitpriv->bkq_cnt; -- for (i = 0; i < 4; i++) { -- for (j = i + 1; j < 4; j++) { -- if (acirp_cnt[j] < acirp_cnt[i]) { -- swap(acirp_cnt[i], acirp_cnt[j]); -- swap(inx[i], inx[j]); -- } -- } -- } -- spin_lock_irqsave(&pxmitpriv->lock, irqL0); -- for (i = 0; i < entry; i++) { -- phwxmit = phwxmit_i + inx[i]; -- sta_phead = &phwxmit->sta_queue->queue; -- sta_plist = sta_phead->next; -- while (!end_of_queue_search(sta_phead, sta_plist)) { -- ptxservq = container_of(sta_plist, struct tx_servq, -- tx_pending); -- pframe_queue = &ptxservq->sta_pending; -- pxmitframe = dequeue_one_xmitframe(pxmitpriv, phwxmit, -- ptxservq, pframe_queue); -- if (pxmitframe) { -- phwxmit->accnt--; -- goto exit_dequeue_xframe_ex; -- } -- sta_plist = sta_plist->next; -- /*Remove sta node when there are no pending packets.*/ -- if (list_empty(&pframe_queue->queue)) { -- /* must be done after sta_plist->next -- * and before break -- */ -- list_del_init(&ptxservq->tx_pending); -- } -- } -- } --exit_dequeue_xframe_ex: -- spin_unlock_irqrestore(&pxmitpriv->lock, irqL0); -- return pxmitframe; --} -- --void r8712_do_queue_select(struct _adapter *padapter, -- struct pkt_attrib *pattrib) --{ -- unsigned int qsel = 0; -- struct dvobj_priv *pdvobj = &padapter->dvobjpriv; -- -- if (pdvobj->nr_endpoint == 6) { -- qsel = (unsigned int)pattrib->priority; -- } else if (pdvobj->nr_endpoint == 4) { -- qsel = (unsigned int)pattrib->priority; -- if (qsel == 0 || qsel == 3) -- qsel = 3; -- else if (qsel == 1 || qsel == 2) -- qsel = 1; -- else if (qsel == 4 || qsel == 5) -- qsel = 5; -- else if (qsel == 6 || qsel == 7) -- qsel = 7; -- else -- qsel = 3; -- } -- pattrib->qsel = qsel; --} -- --#ifdef CONFIG_R8712_TX_AGGR --void r8712_construct_txaggr_cmd_desc(struct xmit_buf *pxmitbuf) --{ -- struct tx_desc *ptx_desc = (struct tx_desc *)pxmitbuf->pbuf; -- -- /* Fill up TxCmd Descriptor according as USB FW Tx Aaggregation info.*/ -- /* dw0 */ -- ptx_desc->txdw0 = cpu_to_le32(CMD_HDR_SZ & 0xffff); -- ptx_desc->txdw0 |= -- cpu_to_le32(((TXDESC_SIZE + OFFSET_SZ) << OFFSET_SHT) & -- 0x00ff0000); -- ptx_desc->txdw0 |= cpu_to_le32(OWN | FSG | LSG); -- -- /* dw1 */ -- ptx_desc->txdw1 |= cpu_to_le32((0x13 << QSEL_SHT) & 0x00001f00); --} -- --void r8712_construct_txaggr_cmd_hdr(struct xmit_buf *pxmitbuf) --{ -- struct xmit_frame *pxmitframe = (struct xmit_frame *) -- pxmitbuf->priv_data; -- struct _adapter *padapter = pxmitframe->padapter; -- struct cmd_priv *pcmdpriv = &padapter->cmdpriv; -- struct cmd_hdr *pcmd_hdr = (struct cmd_hdr *) -- (pxmitbuf->pbuf + TXDESC_SIZE); -- -- /* Fill up Cmd Header for USB FW Tx Aggregation.*/ -- /* dw0 */ -- pcmd_hdr->cmd_dw0 = cpu_to_le32((GEN_CMD_CODE(_AMSDU_TO_AMPDU) << 16) | -- (pcmdpriv->cmd_seq << 24)); -- pcmdpriv->cmd_seq++; --} -- --void r8712_append_mpdu_unit(struct xmit_buf *pxmitbuf, -- struct xmit_frame *pxmitframe) --{ -- struct _adapter *padapter = pxmitframe->padapter; -- struct tx_desc *ptx_desc = (struct tx_desc *)pxmitbuf->pbuf; -- int last_txcmdsz = 0; -- int padding_sz = 0; -- -- /* 802.3->802.11 converter */ -- r8712_xmitframe_coalesce(padapter, pxmitframe->pkt, pxmitframe); -- /* free skb struct */ -- r8712_xmit_complete(padapter, pxmitframe); -- if (pxmitframe->attrib.ether_type != 0x0806) { -- if ((pxmitframe->attrib.ether_type != 0x888e) && -- (pxmitframe->attrib.dhcp_pkt != 1)) { -- r8712_issue_addbareq_cmd(padapter, -- pxmitframe->attrib.priority); -- } -- } -- pxmitframe->last[0] = 1; -- update_txdesc(pxmitframe, (uint *)(pxmitframe->buf_addr), -- pxmitframe->attrib.last_txcmdsz); -- /*padding zero */ -- last_txcmdsz = pxmitframe->attrib.last_txcmdsz; -- padding_sz = (8 - (last_txcmdsz % 8)); -- if ((last_txcmdsz % 8) != 0) { -- int i; -- -- for (i = 0; i < padding_sz; i++) -- *(pxmitframe->buf_addr + TXDESC_SIZE + last_txcmdsz + -- i) = 0; -- } -- /* Add the new mpdu's length */ -- ptx_desc->txdw0 = cpu_to_le32((ptx_desc->txdw0 & 0xffff0000) | -- ((ptx_desc->txdw0 & 0x0000ffff) + -- ((TXDESC_SIZE + last_txcmdsz + padding_sz) & -- 0x0000ffff))); --} -- --void r8712_xmitframe_aggr_1st(struct xmit_buf *pxmitbuf, -- struct xmit_frame *pxmitframe) --{ -- /* linux complete context doesn't need to protect */ -- pxmitframe->pxmitbuf = pxmitbuf; -- pxmitbuf->priv_data = pxmitframe; -- pxmitframe->pxmit_urb[0] = pxmitbuf->pxmit_urb[0]; -- /* buffer addr assoc */ -- pxmitframe->buf_addr = pxmitbuf->pbuf + TXDESC_SIZE + CMD_HDR_SZ; -- /*RTL8712_DMA_H2CCMD */ -- r8712_construct_txaggr_cmd_desc(pxmitbuf); -- r8712_construct_txaggr_cmd_hdr(pxmitbuf); -- r8712_append_mpdu_unit(pxmitbuf, pxmitframe); -- pxmitbuf->aggr_nr = 1; --} -- --u16 r8712_xmitframe_aggr_next(struct xmit_buf *pxmitbuf, -- struct xmit_frame *pxmitframe) --{ -- pxmitframe->pxmitbuf = pxmitbuf; -- pxmitbuf->priv_data = pxmitframe; -- pxmitframe->pxmit_urb[0] = pxmitbuf->pxmit_urb[0]; -- /* buffer addr assoc */ -- pxmitframe->buf_addr = pxmitbuf->pbuf + TXDESC_SIZE + -- (((struct tx_desc *)pxmitbuf->pbuf)->txdw0 & 0x0000ffff); -- r8712_append_mpdu_unit(pxmitbuf, pxmitframe); -- r8712_free_xmitframe_ex(&pxmitframe->padapter->xmitpriv, -- pxmitframe); -- pxmitbuf->aggr_nr++; -- -- return TXDESC_SIZE + -- (((struct tx_desc *)pxmitbuf->pbuf)->txdw0 & 0x0000ffff); --} -- --void r8712_dump_aggr_xframe(struct xmit_buf *pxmitbuf, -- struct xmit_frame *pxmitframe) --{ -- struct _adapter *padapter = pxmitframe->padapter; -- struct dvobj_priv *pdvobj = &padapter->dvobjpriv; -- struct tx_desc *ptxdesc = pxmitbuf->pbuf; -- struct cmd_hdr *pcmd_hdr = (struct cmd_hdr *) -- (pxmitbuf->pbuf + TXDESC_SIZE); -- u16 total_length = (u16)(ptxdesc->txdw0 & 0xffff); -- -- /* use 1st xmitframe as media */ -- xmitframe_xmitbuf_attach(pxmitframe, pxmitbuf); -- pcmd_hdr->cmd_dw0 = cpu_to_le32(((total_length - CMD_HDR_SZ) & -- 0x0000ffff) | (pcmd_hdr->cmd_dw0 & -- 0xffff0000)); -- -- /* urb length in cmd_dw1 */ -- pcmd_hdr->cmd_dw1 = cpu_to_le32((pxmitbuf->aggr_nr & 0xff) | -- ((total_length + TXDESC_SIZE) << 16)); -- pxmitframe->last[0] = 1; -- pxmitframe->bpending[0] = false; -- pxmitframe->mem_addr = pxmitbuf->pbuf; -- -- if ((pdvobj->ishighspeed && ((total_length + TXDESC_SIZE) % 0x200) == -- 0) || ((!pdvobj->ishighspeed && ((total_length + TXDESC_SIZE) % -- 0x40) == 0))) { -- ptxdesc->txdw0 |= cpu_to_le32 -- (((TXDESC_SIZE + OFFSET_SZ + 8) << OFFSET_SHT) & -- 0x00ff0000); -- /*32 bytes for TX Desc + 8 bytes pending*/ -- } else { -- ptxdesc->txdw0 |= cpu_to_le32 -- (((TXDESC_SIZE + OFFSET_SZ) << OFFSET_SHT) & -- 0x00ff0000); -- /*default = 32 bytes for TX Desc*/ -- } -- r8712_write_port(pxmitframe->padapter, RTL8712_DMA_H2CCMD, -- total_length + TXDESC_SIZE, (u8 *)pxmitframe); --} -- --#endif -- --static void update_txdesc(struct xmit_frame *pxmitframe, uint *pmem, int sz) --{ -- uint qsel; -- struct _adapter *padapter = pxmitframe->padapter; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct qos_priv *pqospriv = &pmlmepriv->qospriv; -- struct security_priv *psecuritypriv = &padapter->securitypriv; -- struct pkt_attrib *pattrib = &pxmitframe->attrib; -- struct tx_desc *ptxdesc = (struct tx_desc *)pmem; -- struct dvobj_priv *pdvobj = &padapter->dvobjpriv; --#ifdef CONFIG_R8712_TX_AGGR -- struct cmd_priv *pcmdpriv = &padapter->cmdpriv; --#endif -- u8 blnSetTxDescOffset; -- bool bmcst = is_multicast_ether_addr(pattrib->ra); -- struct ht_priv *phtpriv = &pmlmepriv->htpriv; -- struct tx_desc txdesc_mp; -- -- memcpy(&txdesc_mp, ptxdesc, sizeof(struct tx_desc)); -- memset(ptxdesc, 0, sizeof(struct tx_desc)); -- /* offset 0 */ -- ptxdesc->txdw0 |= cpu_to_le32(sz & 0x0000ffff); -- if (pdvobj->ishighspeed) { -- if (((sz + TXDESC_SIZE) % 512) == 0) -- blnSetTxDescOffset = 1; -- else -- blnSetTxDescOffset = 0; -- } else { -- if (((sz + TXDESC_SIZE) % 64) == 0) -- blnSetTxDescOffset = 1; -- else -- blnSetTxDescOffset = 0; -- } -- if (blnSetTxDescOffset) { -- /* 32 bytes for TX Desc + 8 bytes pending */ -- ptxdesc->txdw0 |= cpu_to_le32(((TXDESC_SIZE + OFFSET_SZ + 8) << -- OFFSET_SHT) & 0x00ff0000); -- } else { -- /* default = 32 bytes for TX Desc */ -- ptxdesc->txdw0 |= cpu_to_le32(((TXDESC_SIZE + OFFSET_SZ) << -- OFFSET_SHT) & 0x00ff0000); -- } -- ptxdesc->txdw0 |= cpu_to_le32(OWN | FSG | LSG); -- if (pxmitframe->frame_tag == DATA_FRAMETAG) { -- /* offset 4 */ -- ptxdesc->txdw1 |= cpu_to_le32((pattrib->mac_id) & 0x1f); -- --#ifdef CONFIG_R8712_TX_AGGR -- /* dirty workaround, need to check if it is aggr cmd. */ -- if ((u8 *)pmem != (u8 *)pxmitframe->pxmitbuf->pbuf) { -- ptxdesc->txdw0 |= cpu_to_le32 -- ((0x3 << TYPE_SHT) & TYPE_MSK); -- qsel = (uint)(pattrib->qsel & 0x0000001f); -- if (qsel == 2) -- qsel = 0; -- ptxdesc->txdw1 |= cpu_to_le32 -- ((qsel << QSEL_SHT) & 0x00001f00); -- ptxdesc->txdw2 = cpu_to_le32 -- ((qsel << RTS_RC_SHT) & 0x001f0000); -- ptxdesc->txdw6 |= cpu_to_le32 -- ((0x5 << RSVD6_SHT) & RSVD6_MSK); -- } else { -- ptxdesc->txdw0 |= cpu_to_le32 -- ((0x3 << TYPE_SHT) & TYPE_MSK); -- ptxdesc->txdw1 |= cpu_to_le32 -- ((0x13 << QSEL_SHT) & 0x00001f00); -- qsel = (uint)(pattrib->qsel & 0x0000001f); -- if (qsel == 2) -- qsel = 0; -- ptxdesc->txdw2 = cpu_to_le32 -- ((qsel << RTS_RC_SHT) & 0x0001f000); -- ptxdesc->txdw7 |= cpu_to_le32 -- (pcmdpriv->cmd_seq << 24); -- pcmdpriv->cmd_seq++; -- } -- pattrib->qsel = 0x13; --#else -- qsel = (uint)(pattrib->qsel & 0x0000001f); -- ptxdesc->txdw1 |= cpu_to_le32((qsel << QSEL_SHT) & 0x00001f00); --#endif -- if (!pqospriv->qos_option) -- ptxdesc->txdw1 |= cpu_to_le32(BIT(16));/*Non-QoS*/ -- if ((pattrib->encrypt > 0) && !pattrib->bswenc) { -- switch (pattrib->encrypt) { /*SEC_TYPE*/ -- case _WEP40_: -- case _WEP104_: -- ptxdesc->txdw1 |= cpu_to_le32((0x01 << 22) & -- 0x00c00000); -- /*KEY_ID when WEP is used;*/ -- ptxdesc->txdw1 |= -- cpu_to_le32((psecuritypriv->PrivacyKeyIndex << 17) & -- 0x00060000); -- break; -- case _TKIP_: -- case _TKIP_WTMIC_: -- ptxdesc->txdw1 |= cpu_to_le32((0x02 << 22) & -- 0x00c00000); -- break; -- case _AES_: -- ptxdesc->txdw1 |= cpu_to_le32((0x03 << 22) & -- 0x00c00000); -- break; -- case _NO_PRIVACY_: -- default: -- break; -- } -- } -- /*offset 8*/ -- if (bmcst) -- ptxdesc->txdw2 |= cpu_to_le32(BMC); -- -- /*offset 12*/ -- /* f/w will increase the seqnum by itself, driver pass the -- * correct priority to fw. -- * fw will check the correct priority for increasing the -- * seqnum per tid. about usb using 4-endpoint, qsel points out -- * the correct mapping between AC&Endpoint, -- * the purpose is that correct mapping lets the MAC release -- * the AC Queue list correctly. -- */ -- ptxdesc->txdw3 = cpu_to_le32((pattrib->priority << SEQ_SHT) & -- 0x0fff0000); -- if ((pattrib->ether_type != 0x888e) && -- (pattrib->ether_type != 0x0806) && -- (pattrib->dhcp_pkt != 1)) { -- /*Not EAP & ARP type data packet*/ -- if (phtpriv->ht_option == 1) { /*B/G/N Mode*/ -- if (!phtpriv->ampdu_enable) -- ptxdesc->txdw2 |= cpu_to_le32(BK); -- } -- } else { -- /* EAP data packet and ARP packet. -- * Use the 1M data rate to send the EAP/ARP packet. -- * This will maybe make the handshake smooth. -- */ -- /*driver uses data rate*/ -- ptxdesc->txdw4 = cpu_to_le32(0x80000000); -- ptxdesc->txdw5 = cpu_to_le32(0x001f8000);/*1M*/ -- } -- if (pattrib->pctrl == 1) { /* mp tx packets */ -- struct tx_desc *ptxdesc_mp; -- -- ptxdesc_mp = &txdesc_mp; -- /* offset 8 */ -- ptxdesc->txdw2 = ptxdesc_mp->txdw2; -- if (bmcst) -- ptxdesc->txdw2 |= cpu_to_le32(BMC); -- ptxdesc->txdw2 |= cpu_to_le32(BK); -- /* offset 16 */ -- ptxdesc->txdw4 = ptxdesc_mp->txdw4; -- /* offset 20 */ -- ptxdesc->txdw5 = ptxdesc_mp->txdw5; -- pattrib->pctrl = 0;/* reset to zero; */ -- } -- } else if (pxmitframe->frame_tag == MGNT_FRAMETAG) { -- /* offset 4 */ -- /* CAM_ID(MAC_ID), default=5; */ -- ptxdesc->txdw1 |= cpu_to_le32((0x05) & 0x1f); -- qsel = (uint)(pattrib->qsel & 0x0000001f); -- ptxdesc->txdw1 |= cpu_to_le32((qsel << QSEL_SHT) & 0x00001f00); -- ptxdesc->txdw1 |= cpu_to_le32(BIT(16));/* Non-QoS */ -- /* offset 8 */ -- if (bmcst) -- ptxdesc->txdw2 |= cpu_to_le32(BMC); -- /* offset 12 */ -- /* f/w will increase the seqnum by itself, driver pass the -- * correct priority to fw. -- * fw will check the correct priority for increasing the seqnum -- * per tid. about usb using 4-endpoint, qsel points out the -- * correct mapping between AC&Endpoint, -- * the purpose is that correct mapping let the MAC releases -- * the AC Queue list correctly. -- */ -- ptxdesc->txdw3 = cpu_to_le32((pattrib->priority << SEQ_SHT) & -- 0x0fff0000); -- /* offset 16 */ -- ptxdesc->txdw4 = cpu_to_le32(0x80002040);/*gtest*/ -- /* offset 20 */ -- ptxdesc->txdw5 = cpu_to_le32(0x001f8000);/* gtest 1M */ -- } else if (pxmitframe->frame_tag == TXAGG_FRAMETAG) { -- /* offset 4 */ -- qsel = 0x13; -- ptxdesc->txdw1 |= cpu_to_le32((qsel << QSEL_SHT) & 0x00001f00); -- } else { -- /* offset 4 */ -- qsel = (uint)(pattrib->priority & 0x0000001f); -- ptxdesc->txdw1 |= cpu_to_le32((qsel << QSEL_SHT) & 0x00001f00); -- /*offset 8*/ -- /*offset 12*/ -- ptxdesc->txdw3 = cpu_to_le32((pattrib->seqnum << SEQ_SHT) & -- 0x0fff0000); -- /*offset 16*/ -- ptxdesc->txdw4 = cpu_to_le32(0x80002040);/*gtest*/ -- /*offset 20*/ -- ptxdesc->txdw5 = cpu_to_le32(0x001f9600);/*gtest*/ -- } --} -- --int r8712_xmitframe_complete(struct _adapter *padapter, -- struct xmit_priv *pxmitpriv, -- struct xmit_buf *pxmitbuf) --{ -- struct hw_xmit *phwxmits; -- sint hwentry; -- struct xmit_frame *pxmitframe = NULL; --#ifdef CONFIG_R8712_TX_AGGR -- struct xmit_frame *p2ndxmitframe = NULL; --#else -- int res = _SUCCESS; --#endif -- -- phwxmits = pxmitpriv->hwxmits; -- hwentry = pxmitpriv->hwxmit_entry; -- if (!pxmitbuf) { -- pxmitbuf = r8712_alloc_xmitbuf(pxmitpriv); -- if (!pxmitbuf) -- return false; --#ifdef CONFIG_R8712_TX_AGGR -- pxmitbuf->aggr_nr = 0; --#endif -- } -- /* 1st frame dequeued */ -- pxmitframe = dequeue_xframe_ex(pxmitpriv, phwxmits, hwentry); -- /* need to remember the 1st frame */ -- if (pxmitframe) { -- --#ifdef CONFIG_R8712_TX_AGGR -- /* 1. dequeue 2nd frame -- * 2. aggr if 2nd xframe is dequeued, else dump directly -- */ -- if (AGGR_NR_HIGH_BOUND > 1) -- p2ndxmitframe = dequeue_xframe_ex(pxmitpriv, phwxmits, -- hwentry); -- if (pxmitframe->frame_tag != DATA_FRAMETAG) { -- r8712_free_xmitbuf(pxmitpriv, pxmitbuf); -- return false; -- } -- if (p2ndxmitframe) -- if (p2ndxmitframe->frame_tag != DATA_FRAMETAG) { -- r8712_free_xmitbuf(pxmitpriv, pxmitbuf); -- return false; -- } -- r8712_xmitframe_aggr_1st(pxmitbuf, pxmitframe); -- if (p2ndxmitframe) { -- u16 total_length; -- -- total_length = r8712_xmitframe_aggr_next( -- pxmitbuf, p2ndxmitframe); -- do { -- p2ndxmitframe = dequeue_xframe_ex( -- pxmitpriv, phwxmits, hwentry); -- if (p2ndxmitframe) -- total_length = -- r8712_xmitframe_aggr_next( -- pxmitbuf, -- p2ndxmitframe); -- else -- break; -- } while (total_length <= 0x1800 && -- pxmitbuf->aggr_nr <= AGGR_NR_HIGH_BOUND); -- } -- if (pxmitbuf->aggr_nr > 0) -- r8712_dump_aggr_xframe(pxmitbuf, pxmitframe); -- --#else -- -- xmitframe_xmitbuf_attach(pxmitframe, pxmitbuf); -- if (pxmitframe->frame_tag == DATA_FRAMETAG) { -- if (pxmitframe->attrib.priority <= 15) -- res = r8712_xmitframe_coalesce(padapter, -- pxmitframe->pkt, pxmitframe); -- /* always return ndis_packet after -- * r8712_xmitframe_coalesce -- */ -- r8712_xmit_complete(padapter, pxmitframe); -- } -- if (res == _SUCCESS) -- dump_xframe(padapter, pxmitframe); -- else -- r8712_free_xmitframe_ex(pxmitpriv, pxmitframe); --#endif -- -- } else { /* pxmitframe == NULL && p2ndxmitframe == NULL */ -- r8712_free_xmitbuf(pxmitpriv, pxmitbuf); -- return false; -- } -- return true; --} -- --static void dump_xframe(struct _adapter *padapter, -- struct xmit_frame *pxmitframe) --{ -- int t, sz, w_sz; -- u8 *mem_addr; -- u32 ff_hwaddr; -- struct pkt_attrib *pattrib = &pxmitframe->attrib; -- struct xmit_priv *pxmitpriv = &padapter->xmitpriv; -- struct security_priv *psecuritypriv = &padapter->securitypriv; -- -- if (pxmitframe->attrib.ether_type != 0x0806) { -- if (pxmitframe->attrib.ether_type != 0x888e) -- r8712_issue_addbareq_cmd(padapter, pattrib->priority); -- } -- mem_addr = pxmitframe->buf_addr; -- for (t = 0; t < pattrib->nr_frags; t++) { -- if (t != (pattrib->nr_frags - 1)) { -- sz = pxmitpriv->frag_len; -- sz = sz - 4 - (psecuritypriv->sw_encrypt ? 0 : -- pattrib->icv_len); -- pxmitframe->last[t] = 0; -- } else { -- sz = pattrib->last_txcmdsz; -- pxmitframe->last[t] = 1; -- } -- update_txdesc(pxmitframe, (uint *)mem_addr, sz); -- w_sz = sz + TXDESC_SIZE; -- pxmitframe->mem_addr = mem_addr; -- pxmitframe->bpending[t] = false; -- ff_hwaddr = get_ff_hwaddr(pxmitframe); --#ifdef CONFIG_R8712_TX_AGGR -- r8712_write_port(padapter, RTL8712_DMA_H2CCMD, w_sz, -- (unsigned char *)pxmitframe); --#else -- r8712_write_port(padapter, ff_hwaddr, w_sz, -- (unsigned char *)pxmitframe); --#endif -- mem_addr += w_sz; -- mem_addr = (u8 *)RND4(((addr_t)(mem_addr))); -- } --} -- --void r8712_xmit_direct(struct _adapter *padapter, struct xmit_frame *pxmitframe) --{ -- int res; -- -- res = r8712_xmitframe_coalesce(padapter, pxmitframe->pkt, pxmitframe); -- pxmitframe->pkt = NULL; -- if (res == _SUCCESS) -- dump_xframe(padapter, pxmitframe); --} -- --int r8712_xmit_enqueue(struct _adapter *padapter, struct xmit_frame *pxmitframe) --{ -- if (r8712_xmit_classifier(padapter, pxmitframe)) { -- pxmitframe->pkt = NULL; -- return _FAIL; -- } -- return _SUCCESS; --} -diff --git a/drivers/staging/rtl8712/rtl8712_xmit.h b/drivers/staging/rtl8712/rtl8712_xmit.h -deleted file mode 100644 -index 5cd651a0de75a9..00000000000000 ---- a/drivers/staging/rtl8712/rtl8712_xmit.h -+++ /dev/null -@@ -1,108 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef _RTL8712_XMIT_H_ --#define _RTL8712_XMIT_H_ -- --#define HWXMIT_ENTRY 4 -- --#define VO_QUEUE_INX 0 --#define VI_QUEUE_INX 1 --#define BE_QUEUE_INX 2 --#define BK_QUEUE_INX 3 --#define TS_QUEUE_INX 4 --#define MGT_QUEUE_INX 5 --#define BMC_QUEUE_INX 6 --#define BCN_QUEUE_INX 7 -- --#define HW_QUEUE_ENTRY 8 -- --#define TXDESC_SIZE 32 --#define TXDESC_OFFSET TXDESC_SIZE -- --#define NR_AMSDU_XMITFRAME 8 --#define NR_TXAGG_XMITFRAME 8 -- --#define MAX_AMSDU_XMITBUF_SZ 8704 --#define MAX_TXAGG_XMITBUF_SZ 16384 /*16k*/ -- --#define tx_cmd tx_desc -- --/* -- *defined for TX DESC Operation -- */ -- --#define MAX_TID (15) -- --/*OFFSET 0*/ --#define OFFSET_SZ (0) --#define OFFSET_SHT (16) --#define OWN BIT(31) --#define FSG BIT(27) --#define LSG BIT(26) --#define TYPE_SHT (24) --#define TYPE_MSK (0x03000000) -- --/*OFFSET 4*/ --#define PKT_OFFSET_SZ (0) --#define QSEL_SHT (8) --#define HWPC BIT(31) -- --/*OFFSET 8*/ --#define BMC BIT(7) --#define BK BIT(30) --#define AGG_EN BIT(29) --#define RTS_RC_SHT (16) -- --/*OFFSET 12*/ --#define SEQ_SHT (16) -- --/*OFFSET 16*/ --#define TXBW BIT(18) -- --/*OFFSET 20*/ --#define DISFB BIT(15) --#define RSVD6_MSK (0x00E00000) --#define RSVD6_SHT (21) -- --struct tx_desc { -- /*DWORD 0*/ -- __le32 txdw0; -- __le32 txdw1; -- __le32 txdw2; -- __le32 txdw3; -- __le32 txdw4; -- __le32 txdw5; -- __le32 txdw6; -- __le32 txdw7; --}; -- --union txdesc { -- struct tx_desc txdesc; -- unsigned int value[TXDESC_SIZE >> 2]; --}; -- --int r8712_xmitframe_complete(struct _adapter *padapter, -- struct xmit_priv *pxmitpriv, -- struct xmit_buf *pxmitbuf); --void r8712_do_queue_select(struct _adapter *padapter, -- struct pkt_attrib *pattrib); -- --#ifdef CONFIG_R8712_TX_AGGR --void r8712_xmitframe_aggr_1st(struct xmit_buf *pxmitbuf, -- struct xmit_frame *pxmitframe); --void r8712_dump_aggr_xframe(struct xmit_buf *pxmitbuf, -- struct xmit_frame *pxmitframe); --#endif -- --#endif -diff --git a/drivers/staging/rtl8712/rtl871x_cmd.c b/drivers/staging/rtl8712/rtl871x_cmd.c -deleted file mode 100644 -index 4be96df5a3296b..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_cmd.c -+++ /dev/null -@@ -1,796 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * rtl871x_cmd.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _RTL871X_CMD_C_ -- --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include -- --#include "osdep_service.h" --#include "drv_types.h" --#include "recv_osdep.h" --#include "mlme_osdep.h" -- --/* -- * Caller and the r8712_cmd_thread can protect cmd_q by spin_lock. -- * No irqsave is necessary. -- */ -- --int r8712_init_cmd_priv(struct cmd_priv *pcmdpriv) --{ -- init_completion(&pcmdpriv->cmd_queue_comp); -- init_completion(&pcmdpriv->terminate_cmdthread_comp); -- -- _init_queue(&(pcmdpriv->cmd_queue)); -- -- /* allocate DMA-able/Non-Page memory for cmd_buf and rsp_buf */ -- pcmdpriv->cmd_seq = 1; -- pcmdpriv->cmd_allocated_buf = kmalloc(MAX_CMDSZ + CMDBUFF_ALIGN_SZ, -- GFP_ATOMIC); -- if (!pcmdpriv->cmd_allocated_buf) -- return -ENOMEM; -- pcmdpriv->cmd_buf = pcmdpriv->cmd_allocated_buf + CMDBUFF_ALIGN_SZ - -- ((addr_t)(pcmdpriv->cmd_allocated_buf) & -- (CMDBUFF_ALIGN_SZ - 1)); -- pcmdpriv->rsp_allocated_buf = kmalloc(MAX_RSPSZ + 4, GFP_ATOMIC); -- if (!pcmdpriv->rsp_allocated_buf) { -- kfree(pcmdpriv->cmd_allocated_buf); -- pcmdpriv->cmd_allocated_buf = NULL; -- return -ENOMEM; -- } -- pcmdpriv->rsp_buf = pcmdpriv->rsp_allocated_buf + 4 - -- ((addr_t)(pcmdpriv->rsp_allocated_buf) & 3); -- pcmdpriv->cmd_issued_cnt = 0; -- pcmdpriv->cmd_done_cnt = 0; -- pcmdpriv->rsp_cnt = 0; -- return 0; --} -- --int r8712_init_evt_priv(struct evt_priv *pevtpriv) --{ -- /* allocate DMA-able/Non-Page memory for cmd_buf and rsp_buf */ -- pevtpriv->event_seq = 0; -- pevtpriv->evt_allocated_buf = kmalloc(MAX_EVTSZ + 4, GFP_ATOMIC); -- -- if (!pevtpriv->evt_allocated_buf) -- return -ENOMEM; -- pevtpriv->evt_buf = pevtpriv->evt_allocated_buf + 4 - -- ((addr_t)(pevtpriv->evt_allocated_buf) & 3); -- pevtpriv->evt_done_cnt = 0; -- return 0; --} -- --void r8712_free_evt_priv(struct evt_priv *pevtpriv) --{ -- kfree(pevtpriv->evt_allocated_buf); --} -- --void r8712_free_cmd_priv(struct cmd_priv *pcmdpriv) --{ -- if (pcmdpriv) { -- kfree(pcmdpriv->cmd_allocated_buf); -- kfree(pcmdpriv->rsp_allocated_buf); -- } --} -- --/* -- * Calling Context: -- * -- * r8712_enqueue_cmd can only be called between kernel thread, -- * since only spin_lock is used. -- * -- * ISR/Call-Back functions can't call this sub-function. -- * -- */ -- --void r8712_enqueue_cmd(struct cmd_priv *pcmdpriv, struct cmd_obj *obj) --{ -- struct __queue *queue; -- unsigned long irqL; -- -- if (pcmdpriv->padapter->eeprompriv.bautoload_fail_flag) -- return; -- if (!obj) -- return; -- queue = &pcmdpriv->cmd_queue; -- spin_lock_irqsave(&queue->lock, irqL); -- list_add_tail(&obj->list, &queue->queue); -- spin_unlock_irqrestore(&queue->lock, irqL); -- complete(&pcmdpriv->cmd_queue_comp); --} -- --struct cmd_obj *r8712_dequeue_cmd(struct __queue *queue) --{ -- unsigned long irqL; -- struct cmd_obj *obj; -- -- spin_lock_irqsave(&queue->lock, irqL); -- obj = list_first_entry_or_null(&queue->queue, -- struct cmd_obj, list); -- if (obj) -- list_del_init(&obj->list); -- spin_unlock_irqrestore(&queue->lock, irqL); -- return obj; --} -- --void r8712_enqueue_cmd_ex(struct cmd_priv *pcmdpriv, struct cmd_obj *obj) --{ -- unsigned long irqL; -- struct __queue *queue; -- -- if (!obj) -- return; -- if (pcmdpriv->padapter->eeprompriv.bautoload_fail_flag) -- return; -- queue = &pcmdpriv->cmd_queue; -- spin_lock_irqsave(&queue->lock, irqL); -- list_add_tail(&obj->list, &queue->queue); -- spin_unlock_irqrestore(&queue->lock, irqL); -- complete(&pcmdpriv->cmd_queue_comp); --} -- --void r8712_free_cmd_obj(struct cmd_obj *pcmd) --{ -- if ((pcmd->cmdcode != _JoinBss_CMD_) && -- (pcmd->cmdcode != _CreateBss_CMD_)) -- kfree(pcmd->parmbuf); -- if (pcmd->rsp) { -- if (pcmd->rspsz != 0) -- kfree(pcmd->rsp); -- } -- kfree(pcmd); --} -- --u8 r8712_sitesurvey_cmd(struct _adapter *padapter, -- struct ndis_802_11_ssid *pssid) -- __must_hold(&padapter->mlmepriv.lock) --{ -- struct cmd_obj *ph2c; -- struct sitesurvey_parm *psurveyPara; -- struct cmd_priv *pcmdpriv = &padapter->cmdpriv; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- -- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC); -- if (!ph2c) -- return _FAIL; -- psurveyPara = kmalloc(sizeof(*psurveyPara), GFP_ATOMIC); -- if (!psurveyPara) { -- kfree(ph2c); -- return _FAIL; -- } -- init_h2fwcmd_w_parm_no_rsp(ph2c, psurveyPara, -- GEN_CMD_CODE(_SiteSurvey)); -- psurveyPara->bsslimit = cpu_to_le32(48); -- psurveyPara->passive_mode = cpu_to_le32(pmlmepriv->passive_mode); -- psurveyPara->ss_ssidlen = 0; -- memset(psurveyPara->ss_ssid, 0, IW_ESSID_MAX_SIZE + 1); -- if (pssid && pssid->SsidLength) { -- int len = min_t(int, pssid->SsidLength, IW_ESSID_MAX_SIZE); -- -- memcpy(psurveyPara->ss_ssid, pssid->Ssid, len); -- psurveyPara->ss_ssidlen = cpu_to_le32(len); -- } -- set_fwstate(pmlmepriv, _FW_UNDER_SURVEY); -- r8712_enqueue_cmd(pcmdpriv, ph2c); -- mod_timer(&pmlmepriv->scan_to_timer, -- jiffies + msecs_to_jiffies(SCANNING_TIMEOUT)); -- padapter->ledpriv.LedControlHandler(padapter, LED_CTL_SITE_SURVEY); -- complete(&padapter->rx_filter_ready); -- return _SUCCESS; --} -- --int r8712_setdatarate_cmd(struct _adapter *padapter, u8 *rateset) --{ -- struct cmd_obj *ph2c; -- struct setdatarate_parm *pbsetdataratepara; -- struct cmd_priv *pcmdpriv = &padapter->cmdpriv; -- -- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC); -- if (!ph2c) -- return -ENOMEM; -- pbsetdataratepara = kmalloc(sizeof(*pbsetdataratepara), GFP_ATOMIC); -- if (!pbsetdataratepara) { -- kfree(ph2c); -- return -ENOMEM; -- } -- init_h2fwcmd_w_parm_no_rsp(ph2c, pbsetdataratepara, -- GEN_CMD_CODE(_SetDataRate)); -- pbsetdataratepara->mac_id = 5; -- memcpy(pbsetdataratepara->datarates, rateset, NumRates); -- r8712_enqueue_cmd(pcmdpriv, ph2c); -- return 0; --} -- --void r8712_set_chplan_cmd(struct _adapter *padapter, int chplan) --{ -- struct cmd_obj *ph2c; -- struct SetChannelPlan_param *psetchplanpara; -- struct cmd_priv *pcmdpriv = &padapter->cmdpriv; -- -- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC); -- if (!ph2c) -- return; -- psetchplanpara = kmalloc(sizeof(*psetchplanpara), GFP_ATOMIC); -- if (!psetchplanpara) { -- kfree(ph2c); -- return; -- } -- init_h2fwcmd_w_parm_no_rsp(ph2c, psetchplanpara, -- GEN_CMD_CODE(_SetChannelPlan)); -- psetchplanpara->ChannelPlan = chplan; -- r8712_enqueue_cmd(pcmdpriv, ph2c); --} -- --int r8712_setrfreg_cmd(struct _adapter *padapter, u8 offset, u32 val) --{ -- struct cmd_obj *ph2c; -- struct writeRF_parm *pwriterfparm; -- struct cmd_priv *pcmdpriv = &padapter->cmdpriv; -- -- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC); -- if (!ph2c) -- return -ENOMEM; -- pwriterfparm = kmalloc(sizeof(*pwriterfparm), GFP_ATOMIC); -- if (!pwriterfparm) { -- kfree(ph2c); -- return -ENOMEM; -- } -- init_h2fwcmd_w_parm_no_rsp(ph2c, pwriterfparm, GEN_CMD_CODE(_SetRFReg)); -- pwriterfparm->offset = offset; -- pwriterfparm->value = val; -- r8712_enqueue_cmd(pcmdpriv, ph2c); -- return 0; --} -- --int r8712_getrfreg_cmd(struct _adapter *padapter, u8 offset, u8 *pval) --{ -- struct cmd_obj *ph2c; -- struct readRF_parm *prdrfparm; -- struct cmd_priv *pcmdpriv = &padapter->cmdpriv; -- -- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC); -- if (!ph2c) -- return -ENOMEM; -- prdrfparm = kmalloc(sizeof(*prdrfparm), GFP_ATOMIC); -- if (!prdrfparm) { -- kfree(ph2c); -- return -ENOMEM; -- } -- INIT_LIST_HEAD(&ph2c->list); -- ph2c->cmdcode = GEN_CMD_CODE(_GetRFReg); -- ph2c->parmbuf = (unsigned char *)prdrfparm; -- ph2c->cmdsz = sizeof(struct readRF_parm); -- ph2c->rsp = pval; -- ph2c->rspsz = sizeof(struct readRF_rsp); -- prdrfparm->offset = offset; -- r8712_enqueue_cmd(pcmdpriv, ph2c); -- return 0; --} -- --void r8712_getbbrfreg_cmdrsp_callback(struct _adapter *padapter, -- struct cmd_obj *pcmd) --{ -- kfree(pcmd->parmbuf); -- kfree(pcmd); -- padapter->mppriv.workparam.bcompleted = true; --} -- --void r8712_readtssi_cmdrsp_callback(struct _adapter *padapter, -- struct cmd_obj *pcmd) --{ -- kfree(pcmd->parmbuf); -- kfree(pcmd); -- -- padapter->mppriv.workparam.bcompleted = true; --} -- --int r8712_createbss_cmd(struct _adapter *padapter) --{ -- struct cmd_obj *pcmd; -- struct cmd_priv *pcmdpriv = &padapter->cmdpriv; -- struct wlan_bssid_ex *pdev_network = -- &padapter->registrypriv.dev_network; -- -- padapter->ledpriv.LedControlHandler(padapter, LED_CTL_START_TO_LINK); -- pcmd = kmalloc(sizeof(*pcmd), GFP_ATOMIC); -- if (!pcmd) -- return -ENOMEM; -- INIT_LIST_HEAD(&pcmd->list); -- pcmd->cmdcode = _CreateBss_CMD_; -- pcmd->parmbuf = (unsigned char *)pdev_network; -- pcmd->cmdsz = r8712_get_wlan_bssid_ex_sz(pdev_network); -- pcmd->rsp = NULL; -- pcmd->rspsz = 0; -- /* notes: translate IELength & Length after assign to cmdsz; */ -- pdev_network->Length = pcmd->cmdsz; -- pdev_network->IELength = pdev_network->IELength; -- pdev_network->Ssid.SsidLength = pdev_network->Ssid.SsidLength; -- r8712_enqueue_cmd(pcmdpriv, pcmd); -- return 0; --} -- --int r8712_joinbss_cmd(struct _adapter *padapter, struct wlan_network *pnetwork) --{ -- struct wlan_bssid_ex *psecnetwork; -- struct cmd_obj *pcmd; -- struct cmd_priv *pcmdpriv = &padapter->cmdpriv; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct qos_priv *pqospriv = &pmlmepriv->qospriv; -- struct security_priv *psecuritypriv = &padapter->securitypriv; -- struct registry_priv *pregistrypriv = &padapter->registrypriv; -- enum NDIS_802_11_NETWORK_INFRASTRUCTURE ndis_network_mode = -- pnetwork->network.InfrastructureMode; -- -- padapter->ledpriv.LedControlHandler(padapter, LED_CTL_START_TO_LINK); -- pcmd = kmalloc(sizeof(*pcmd), GFP_ATOMIC); -- if (!pcmd) -- return -ENOMEM; -- -- /* for hidden ap to set fw_state here */ -- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE | WIFI_ADHOC_STATE) != -- true) { -- switch (ndis_network_mode) { -- case Ndis802_11IBSS: -- pmlmepriv->fw_state |= WIFI_ADHOC_STATE; -- break; -- case Ndis802_11Infrastructure: -- pmlmepriv->fw_state |= WIFI_STATION_STATE; -- break; -- case Ndis802_11APMode: -- case Ndis802_11AutoUnknown: -- case Ndis802_11InfrastructureMax: -- break; -- } -- } -- psecnetwork = &psecuritypriv->sec_bss; -- memcpy(psecnetwork, &pnetwork->network, sizeof(*psecnetwork)); -- psecuritypriv->authenticator_ie[0] = (unsigned char) -- psecnetwork->IELength; -- if ((psecnetwork->IELength - 12) < (256 - 1)) -- memcpy(&psecuritypriv->authenticator_ie[1], -- &psecnetwork->IEs[12], psecnetwork->IELength - 12); -- else -- memcpy(&psecuritypriv->authenticator_ie[1], -- &psecnetwork->IEs[12], (256 - 1)); -- psecnetwork->IELength = 0; -- /* -- * If the driver wants to use the bssid to create the connection. -- * If not, we copy the connecting AP's MAC address to it so that -- * the driver just has the bssid information for PMKIDList searching. -- */ -- if (!pmlmepriv->assoc_by_bssid) -- ether_addr_copy(&pmlmepriv->assoc_bssid[0], -- &pnetwork->network.MacAddress[0]); -- psecnetwork->IELength = r8712_restruct_sec_ie(padapter, -- &pnetwork->network.IEs[0], -- &psecnetwork->IEs[0], -- pnetwork->network.IELength); -- pqospriv->qos_option = 0; -- if (pregistrypriv->wmm_enable) { -- u32 tmp_len; -- -- tmp_len = r8712_restruct_wmm_ie(padapter, -- &pnetwork->network.IEs[0], -- &psecnetwork->IEs[0], -- pnetwork->network.IELength, -- psecnetwork->IELength); -- if (psecnetwork->IELength != tmp_len) { -- psecnetwork->IELength = tmp_len; -- pqospriv->qos_option = 1; /* WMM IE in beacon */ -- } else { -- pqospriv->qos_option = 0; /* no WMM IE in beacon */ -- } -- } -- if (pregistrypriv->ht_enable) { -- /* -- * For WEP mode, we will use the bg mode to do the connection -- * to avoid some IOT issues, especially for Realtek 8192u -- * SoftAP. -- */ -- if ((padapter->securitypriv.PrivacyAlgrthm != _WEP40_) && -- (padapter->securitypriv.PrivacyAlgrthm != _WEP104_)) { -- /* restructure_ht_ie */ -- r8712_restructure_ht_ie(padapter, -- &pnetwork->network.IEs[0], -- &psecnetwork->IEs[0], -- pnetwork->network.IELength, -- &psecnetwork->IELength); -- } -- } -- psecuritypriv->supplicant_ie[0] = (u8)psecnetwork->IELength; -- if (psecnetwork->IELength < 255) -- memcpy(&psecuritypriv->supplicant_ie[1], &psecnetwork->IEs[0], -- psecnetwork->IELength); -- else -- memcpy(&psecuritypriv->supplicant_ie[1], &psecnetwork->IEs[0], -- 255); -- /* get cmdsz before endian conversion */ -- pcmd->cmdsz = r8712_get_wlan_bssid_ex_sz(psecnetwork); --#ifdef __BIG_ENDIAN -- /* wlan_network endian conversion */ -- psecnetwork->Length = cpu_to_le32(psecnetwork->Length); -- psecnetwork->Ssid.SsidLength = cpu_to_le32( -- psecnetwork->Ssid.SsidLength); -- psecnetwork->Privacy = cpu_to_le32(psecnetwork->Privacy); -- psecnetwork->Rssi = cpu_to_le32(psecnetwork->Rssi); -- psecnetwork->NetworkTypeInUse = cpu_to_le32( -- psecnetwork->NetworkTypeInUse); -- psecnetwork->Configuration.ATIMWindow = cpu_to_le32( -- psecnetwork->Configuration.ATIMWindow); -- psecnetwork->Configuration.BeaconPeriod = cpu_to_le32( -- psecnetwork->Configuration.BeaconPeriod); -- psecnetwork->Configuration.DSConfig = cpu_to_le32( -- psecnetwork->Configuration.DSConfig); -- psecnetwork->Configuration.FHConfig.DwellTime = cpu_to_le32( -- psecnetwork->Configuration.FHConfig.DwellTime); -- psecnetwork->Configuration.FHConfig.HopPattern = cpu_to_le32( -- psecnetwork->Configuration.FHConfig.HopPattern); -- psecnetwork->Configuration.FHConfig.HopSet = cpu_to_le32( -- psecnetwork->Configuration.FHConfig.HopSet); -- psecnetwork->Configuration.FHConfig.Length = cpu_to_le32( -- psecnetwork->Configuration.FHConfig.Length); -- psecnetwork->Configuration.Length = cpu_to_le32( -- psecnetwork->Configuration.Length); -- psecnetwork->InfrastructureMode = cpu_to_le32( -- psecnetwork->InfrastructureMode); -- psecnetwork->IELength = cpu_to_le32(psecnetwork->IELength); --#endif -- INIT_LIST_HEAD(&pcmd->list); -- pcmd->cmdcode = _JoinBss_CMD_; -- pcmd->parmbuf = (unsigned char *)psecnetwork; -- pcmd->rsp = NULL; -- pcmd->rspsz = 0; -- r8712_enqueue_cmd(pcmdpriv, pcmd); -- return 0; --} -- --void r8712_disassoc_cmd(struct _adapter *padapter) /* for sta_mode */ --{ -- struct cmd_obj *pdisconnect_cmd; -- struct disconnect_parm *pdisconnect; -- struct cmd_priv *pcmdpriv = &padapter->cmdpriv; -- -- pdisconnect_cmd = kmalloc(sizeof(*pdisconnect_cmd), GFP_ATOMIC); -- if (!pdisconnect_cmd) -- return; -- pdisconnect = kmalloc(sizeof(*pdisconnect), GFP_ATOMIC); -- if (!pdisconnect) { -- kfree(pdisconnect_cmd); -- return; -- } -- init_h2fwcmd_w_parm_no_rsp(pdisconnect_cmd, pdisconnect, -- _DisConnect_CMD_); -- r8712_enqueue_cmd(pcmdpriv, pdisconnect_cmd); --} -- --void r8712_setopmode_cmd(struct _adapter *padapter, -- enum NDIS_802_11_NETWORK_INFRASTRUCTURE networktype) --{ -- struct cmd_obj *ph2c; -- struct setopmode_parm *psetop; -- -- struct cmd_priv *pcmdpriv = &padapter->cmdpriv; -- -- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC); -- if (!ph2c) -- return; -- psetop = kmalloc(sizeof(*psetop), GFP_ATOMIC); -- if (!psetop) { -- kfree(ph2c); -- return; -- } -- init_h2fwcmd_w_parm_no_rsp(ph2c, psetop, _SetOpMode_CMD_); -- psetop->mode = (u8)networktype; -- r8712_enqueue_cmd(pcmdpriv, ph2c); --} -- --void r8712_setstakey_cmd(struct _adapter *padapter, u8 *psta, u8 unicast_key) --{ -- struct cmd_obj *ph2c; -- struct set_stakey_parm *psetstakey_para; -- struct cmd_priv *pcmdpriv = &padapter->cmdpriv; -- struct set_stakey_rsp *psetstakey_rsp = NULL; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct security_priv *psecuritypriv = &padapter->securitypriv; -- struct sta_info *sta = (struct sta_info *)psta; -- -- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC); -- if (!ph2c) -- return; -- psetstakey_para = kmalloc(sizeof(*psetstakey_para), GFP_ATOMIC); -- if (!psetstakey_para) { -- kfree(ph2c); -- return; -- } -- psetstakey_rsp = kmalloc(sizeof(*psetstakey_rsp), GFP_ATOMIC); -- if (!psetstakey_rsp) { -- kfree(ph2c); -- kfree(psetstakey_para); -- return; -- } -- init_h2fwcmd_w_parm_no_rsp(ph2c, psetstakey_para, _SetStaKey_CMD_); -- ph2c->rsp = (u8 *)psetstakey_rsp; -- ph2c->rspsz = sizeof(struct set_stakey_rsp); -- ether_addr_copy(psetstakey_para->addr, sta->hwaddr); -- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) -- psetstakey_para->algorithm = (unsigned char) -- psecuritypriv->PrivacyAlgrthm; -- else -- GET_ENCRY_ALGO(psecuritypriv, sta, -- psetstakey_para->algorithm, false); -- if (unicast_key) -- memcpy(&psetstakey_para->key, &sta->x_UncstKey, 16); -- else -- memcpy(&psetstakey_para->key, -- &psecuritypriv->XGrpKey[ -- psecuritypriv->XGrpKeyid - 1]. skey, 16); -- r8712_enqueue_cmd(pcmdpriv, ph2c); --} -- --void r8712_setMacAddr_cmd(struct _adapter *padapter, const u8 *mac_addr) --{ -- struct cmd_priv *pcmdpriv = &padapter->cmdpriv; -- struct cmd_obj *ph2c; -- struct SetMacAddr_param *psetMacAddr_para; -- -- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC); -- if (!ph2c) -- return; -- psetMacAddr_para = kmalloc(sizeof(*psetMacAddr_para), GFP_ATOMIC); -- if (!psetMacAddr_para) { -- kfree(ph2c); -- return; -- } -- init_h2fwcmd_w_parm_no_rsp(ph2c, psetMacAddr_para, -- _SetMacAddress_CMD_); -- ether_addr_copy(psetMacAddr_para->MacAddr, mac_addr); -- r8712_enqueue_cmd(pcmdpriv, ph2c); --} -- --void r8712_addbareq_cmd(struct _adapter *padapter, u8 tid) --{ -- struct cmd_priv *pcmdpriv = &padapter->cmdpriv; -- struct cmd_obj *ph2c; -- struct addBaReq_parm *paddbareq_parm; -- -- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC); -- if (!ph2c) -- return; -- paddbareq_parm = kmalloc(sizeof(*paddbareq_parm), GFP_ATOMIC); -- if (!paddbareq_parm) { -- kfree(ph2c); -- return; -- } -- paddbareq_parm->tid = tid; -- init_h2fwcmd_w_parm_no_rsp(ph2c, paddbareq_parm, -- GEN_CMD_CODE(_AddBAReq)); -- r8712_enqueue_cmd_ex(pcmdpriv, ph2c); --} -- --void r8712_wdg_wk_cmd(struct _adapter *padapter) --{ -- struct cmd_obj *ph2c; -- struct drvint_cmd_parm *pdrvintcmd_param; -- struct cmd_priv *pcmdpriv = &padapter->cmdpriv; -- -- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC); -- if (!ph2c) -- return; -- pdrvintcmd_param = kmalloc(sizeof(*pdrvintcmd_param), GFP_ATOMIC); -- if (!pdrvintcmd_param) { -- kfree(ph2c); -- return; -- } -- pdrvintcmd_param->i_cid = WDG_WK_CID; -- pdrvintcmd_param->sz = 0; -- pdrvintcmd_param->pbuf = NULL; -- init_h2fwcmd_w_parm_no_rsp(ph2c, pdrvintcmd_param, _DRV_INT_CMD_); -- r8712_enqueue_cmd_ex(pcmdpriv, ph2c); --} -- --void r8712_survey_cmd_callback(struct _adapter *padapter, struct cmd_obj *pcmd) --{ -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- -- if (pcmd->res != H2C_SUCCESS) -- clr_fwstate(pmlmepriv, _FW_UNDER_SURVEY); -- r8712_free_cmd_obj(pcmd); --} -- --void r8712_disassoc_cmd_callback(struct _adapter *padapter, -- struct cmd_obj *pcmd) --{ -- unsigned long irqL; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- -- if (pcmd->res != H2C_SUCCESS) { -- spin_lock_irqsave(&pmlmepriv->lock, irqL); -- set_fwstate(pmlmepriv, _FW_LINKED); -- spin_unlock_irqrestore(&pmlmepriv->lock, irqL); -- return; -- } -- r8712_free_cmd_obj(pcmd); --} -- --void r8712_joinbss_cmd_callback(struct _adapter *padapter, struct cmd_obj *pcmd) --{ -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- -- if (pcmd->res != H2C_SUCCESS) -- mod_timer(&pmlmepriv->assoc_timer, -- jiffies + msecs_to_jiffies(1)); -- r8712_free_cmd_obj(pcmd); --} -- --void r8712_createbss_cmd_callback(struct _adapter *padapter, -- struct cmd_obj *pcmd) --{ -- unsigned long irqL; -- struct sta_info *psta = NULL; -- struct wlan_network *pwlan = NULL; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)pcmd->parmbuf; -- struct wlan_network *tgt_network = &(pmlmepriv->cur_network); -- -- if (pcmd->res != H2C_SUCCESS) -- mod_timer(&pmlmepriv->assoc_timer, -- jiffies + msecs_to_jiffies(1)); -- del_timer(&pmlmepriv->assoc_timer); --#ifdef __BIG_ENDIAN -- /* endian_convert */ -- pnetwork->Length = le32_to_cpu(pnetwork->Length); -- pnetwork->Ssid.SsidLength = le32_to_cpu(pnetwork->Ssid.SsidLength); -- pnetwork->Privacy = le32_to_cpu(pnetwork->Privacy); -- pnetwork->Rssi = le32_to_cpu(pnetwork->Rssi); -- pnetwork->NetworkTypeInUse = le32_to_cpu(pnetwork->NetworkTypeInUse); -- pnetwork->Configuration.ATIMWindow = -- le32_to_cpu(pnetwork->Configuration.ATIMWindow); -- pnetwork->Configuration.DSConfig = -- le32_to_cpu(pnetwork->Configuration.DSConfig); -- pnetwork->Configuration.FHConfig.DwellTime = -- le32_to_cpu(pnetwork->Configuration.FHConfig.DwellTime); -- pnetwork->Configuration.FHConfig.HopPattern = -- le32_to_cpu(pnetwork->Configuration.FHConfig.HopPattern); -- pnetwork->Configuration.FHConfig.HopSet = -- le32_to_cpu(pnetwork->Configuration.FHConfig.HopSet); -- pnetwork->Configuration.FHConfig.Length = -- le32_to_cpu(pnetwork->Configuration.FHConfig.Length); -- pnetwork->Configuration.Length = -- le32_to_cpu(pnetwork->Configuration.Length); -- pnetwork->InfrastructureMode = -- le32_to_cpu(pnetwork->InfrastructureMode); -- pnetwork->IELength = le32_to_cpu(pnetwork->IELength); --#endif -- spin_lock_irqsave(&pmlmepriv->lock, irqL); -- if ((pmlmepriv->fw_state) & WIFI_AP_STATE) { -- psta = r8712_get_stainfo(&padapter->stapriv, -- pnetwork->MacAddress); -- if (!psta) { -- psta = r8712_alloc_stainfo(&padapter->stapriv, -- pnetwork->MacAddress); -- if (!psta) -- goto createbss_cmd_fail; -- } -- r8712_indicate_connect(padapter); -- } else { -- pwlan = _r8712_alloc_network(pmlmepriv); -- if (!pwlan) { -- pwlan = r8712_get_oldest_wlan_network( -- &pmlmepriv->scanned_queue); -- if (!pwlan) -- goto createbss_cmd_fail; -- pwlan->last_scanned = jiffies; -- } else { -- list_add_tail(&(pwlan->list), -- &pmlmepriv->scanned_queue.queue); -- } -- pnetwork->Length = r8712_get_wlan_bssid_ex_sz(pnetwork); -- memcpy(&(pwlan->network), pnetwork, pnetwork->Length); -- pwlan->fixed = true; -- memcpy(&tgt_network->network, pnetwork, -- (r8712_get_wlan_bssid_ex_sz(pnetwork))); -- if (pmlmepriv->fw_state & _FW_UNDER_LINKING) -- pmlmepriv->fw_state ^= _FW_UNDER_LINKING; -- /* -- * we will set _FW_LINKED when there is one more sat to -- * join us (stassoc_event_callback) -- */ -- } --createbss_cmd_fail: -- spin_unlock_irqrestore(&pmlmepriv->lock, irqL); -- r8712_free_cmd_obj(pcmd); --} -- --void r8712_setstaKey_cmdrsp_callback(struct _adapter *padapter, -- struct cmd_obj *pcmd) --{ -- struct sta_priv *pstapriv = &padapter->stapriv; -- struct set_stakey_rsp *psetstakey_rsp = (struct set_stakey_rsp *) -- (pcmd->rsp); -- struct sta_info *psta = r8712_get_stainfo(pstapriv, -- psetstakey_rsp->addr); -- -- if (!psta) -- goto exit; -- psta->aid = psta->mac_id = psetstakey_rsp->keyid; /*CAM_ID(CAM_ENTRY)*/ --exit: -- r8712_free_cmd_obj(pcmd); --} -- --void r8712_setassocsta_cmdrsp_callback(struct _adapter *padapter, -- struct cmd_obj *pcmd) --{ -- unsigned long irqL; -- struct sta_priv *pstapriv = &padapter->stapriv; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct set_assocsta_parm *passocsta_parm = -- (struct set_assocsta_parm *)(pcmd->parmbuf); -- struct set_assocsta_rsp *passocsta_rsp = -- (struct set_assocsta_rsp *) (pcmd->rsp); -- struct sta_info *psta = r8712_get_stainfo(pstapriv, -- passocsta_parm->addr); -- -- if (!psta) -- return; -- psta->aid = psta->mac_id = passocsta_rsp->cam_id; -- spin_lock_irqsave(&pmlmepriv->lock, irqL); -- if ((check_fwstate(pmlmepriv, WIFI_MP_STATE)) && -- (check_fwstate(pmlmepriv, _FW_UNDER_LINKING))) -- pmlmepriv->fw_state ^= _FW_UNDER_LINKING; -- set_fwstate(pmlmepriv, _FW_LINKED); -- spin_unlock_irqrestore(&pmlmepriv->lock, irqL); -- r8712_free_cmd_obj(pcmd); --} -- --void r8712_disconnectCtrlEx_cmd(struct _adapter *adapter, u32 enableDrvCtrl, -- u32 tryPktCnt, u32 tryPktInterval, u32 firstStageTO) --{ -- struct cmd_obj *ph2c; -- struct DisconnectCtrlEx_param *param; -- struct cmd_priv *pcmdpriv = &adapter->cmdpriv; -- -- ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC); -- if (!ph2c) -- return; -- param = kzalloc(sizeof(*param), GFP_ATOMIC); -- if (!param) { -- kfree(ph2c); -- return; -- } -- -- param->EnableDrvCtrl = (unsigned char)enableDrvCtrl; -- param->TryPktCnt = (unsigned char)tryPktCnt; -- param->TryPktInterval = (unsigned char)tryPktInterval; -- param->FirstStageTO = (unsigned int)firstStageTO; -- -- init_h2fwcmd_w_parm_no_rsp(ph2c, param, -- GEN_CMD_CODE(_DisconnectCtrlEx)); -- r8712_enqueue_cmd(pcmdpriv, ph2c); --} -diff --git a/drivers/staging/rtl8712/rtl871x_cmd.h b/drivers/staging/rtl8712/rtl871x_cmd.h -deleted file mode 100644 -index 8453d8de824841..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_cmd.h -+++ /dev/null -@@ -1,761 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __RTL871X_CMD_H_ --#define __RTL871X_CMD_H_ -- --#include "wlan_bssdef.h" --#include "rtl871x_rf.h" --#define C2H_MEM_SZ (16*1024) -- --#include "osdep_service.h" --#include "ieee80211.h" -- --#define FREE_CMDOBJ_SZ 128 --#define MAX_CMDSZ 512 --#define MAX_RSPSZ 512 --#define MAX_EVTSZ 1024 --#define CMDBUFF_ALIGN_SZ 512 -- --struct cmd_obj { -- u16 cmdcode; -- u8 res; -- u8 *parmbuf; -- u32 cmdsz; -- u8 *rsp; -- u32 rspsz; -- struct list_head list; --}; -- --struct cmd_priv { -- struct completion cmd_queue_comp; -- struct completion terminate_cmdthread_comp; -- struct __queue cmd_queue; -- u8 cmd_seq; -- u8 *cmd_buf; /*shall be non-paged, and 4 bytes aligned*/ -- u8 *cmd_allocated_buf; -- u8 *rsp_buf; /*shall be non-paged, and 4 bytes aligned*/ -- u8 *rsp_allocated_buf; -- u32 cmd_issued_cnt; -- u32 cmd_done_cnt; -- u32 rsp_cnt; -- struct _adapter *padapter; --}; -- --struct evt_obj { -- u16 evtcode; -- u8 res; -- u8 *parmbuf; -- u32 evtsz; -- struct list_head list; --}; -- --struct evt_priv { -- struct __queue evt_queue; -- u8 event_seq; -- u8 *evt_buf; /*shall be non-paged, and 4 bytes aligned*/ -- u8 *evt_allocated_buf; -- u32 evt_done_cnt; --}; -- --#define init_h2fwcmd_w_parm_no_rsp(pcmd, pparm, code) \ --do {\ -- INIT_LIST_HEAD(&pcmd->list);\ -- pcmd->cmdcode = code;\ -- pcmd->parmbuf = (u8 *)(pparm);\ -- pcmd->cmdsz = sizeof(*pparm);\ -- pcmd->rsp = NULL;\ -- pcmd->rspsz = 0;\ --} while (0) -- --void r8712_enqueue_cmd(struct cmd_priv *pcmdpriv, struct cmd_obj *obj); --void r8712_enqueue_cmd_ex(struct cmd_priv *pcmdpriv, struct cmd_obj *obj); --struct cmd_obj *r8712_dequeue_cmd(struct __queue *queue); --void r8712_free_cmd_obj(struct cmd_obj *pcmd); --int r8712_cmd_thread(void *context); --int r8712_init_cmd_priv(struct cmd_priv *pcmdpriv); --void r8712_free_cmd_priv(struct cmd_priv *pcmdpriv); --int r8712_init_evt_priv(struct evt_priv *pevtpriv); --void r8712_free_evt_priv(struct evt_priv *pevtpriv); -- --enum rtl871x_drvint_cid { -- NONE_WK_CID, -- WDG_WK_CID, -- MAX_WK_CID --}; -- --enum RFINTFS { -- SWSI, -- HWSI, -- HWPI, --}; -- --/* -- * Caller Mode: Infra, Ad-HoC(C) -- * Notes: To enter USB suspend mode -- * Command Mode -- */ --struct usb_suspend_parm { -- u32 action; /* 1: sleep, 0:resume */ --}; -- --/* -- * Caller Mode: Infra, Ad-HoC(C) -- * Notes: To disconnect the current associated BSS -- * Command Mode -- */ --struct disconnect_parm { -- u32 rsvd; --}; -- --/* -- * Caller Mode: AP, Ad-HoC, Infra -- * Notes: To set the NIC mode of RTL8711 -- * Command Mode -- * The definition of mode: -- * -- * #define IW_MODE_AUTO 0 // Let the driver decides which AP to join -- * #define IW_MODE_ADHOC 1 // Single cell network (Ad-Hoc Clients) -- * #define IW_MODE_INFRA 2 // Multi cell network, roaming, .. -- * #define IW_MODE_MASTER 3 // Synchronisation master or AP -- * #define IW_MODE_REPEAT 4 // Wireless Repeater (forwarder) -- * #define IW_MODE_SECOND 5 // Secondary master/repeater (backup) -- * #define IW_MODE_MONITOR 6 // Passive monitor (listen only) -- */ --struct setopmode_parm { -- u8 mode; -- u8 rsvd[3]; --}; -- --/* -- * Caller Mode: AP, Ad-HoC, Infra -- * Notes: To ask RTL8711 performing site-survey -- * Command-Event Mode -- */ --struct sitesurvey_parm { -- __le32 passive_mode; /*active: 1, passive: 0 */ -- __le32 bsslimit; /* 1 ~ 48 */ -- __le32 ss_ssidlen; -- u8 ss_ssid[IW_ESSID_MAX_SIZE + 1]; --}; -- --/* -- * Caller Mode: Any -- * Notes: To set the auth type of RTL8711. open/shared/802.1x -- * Command Mode -- */ --struct setauth_parm { -- u8 mode; /*0: legacy open, 1: legacy shared 2: 802.1x*/ -- u8 _1x; /*0: PSK, 1: TLS*/ -- u8 rsvd[2]; --}; -- --/* -- * Caller Mode: Infra -- * a. algorithm: wep40, wep104, tkip & aes -- * b. keytype: grp key/unicast key -- * c. key contents -- * -- * when shared key ==> keyid is the camid -- * when 802.1x ==> keyid [0:1] ==> grp key -- * when 802.1x ==> keyid > 2 ==> unicast key -- */ --struct setkey_parm { -- u8 algorithm; /* encryption algorithm, could be none, wep40, -- * TKIP, CCMP, wep104 -- */ -- u8 keyid; -- u8 grpkey; /* 1: this is the grpkey for 802.1x. -- * 0: this is the unicast key for 802.1x -- */ -- u8 key[16]; /* this could be 40 or 104 */ --}; -- --/* -- * When in AP or Ad-Hoc mode, this is used to -- * allocate an sw/hw entry for a newly associated sta. -- * Command -- * when shared key ==> algorithm/keyid -- */ --struct set_stakey_parm { -- u8 addr[ETH_ALEN]; -- u8 algorithm; -- u8 key[16]; --}; -- --struct set_stakey_rsp { -- u8 addr[ETH_ALEN]; -- u8 keyid; -- u8 rsvd; --}; -- --struct SetMacAddr_param { -- u8 MacAddr[ETH_ALEN]; --}; -- --/* -- * Caller Ad-Hoc/AP -- * -- * Command -Rsp(AID == CAMID) mode -- * -- * This is to force fw to add an sta_data entry per driver's request. -- * -- * FW will write an cam entry associated with it. -- * -- */ --struct set_assocsta_parm { -- u8 addr[ETH_ALEN]; --}; -- --struct set_assocsta_rsp { -- u8 cam_id; -- u8 rsvd[3]; --}; -- --/* -- * Caller Ad-Hoc/AP -- * -- * Command mode -- * -- * This is to force fw to del an sta_data entry per driver's request -- * -- * FW will invalidate the cam entry associated with it. -- * -- */ --struct del_assocsta_parm { -- u8 addr[ETH_ALEN]; --}; -- --/* -- * Caller Mode: AP/Ad-HoC(M) -- * -- * Notes: To notify fw that given staid has changed its power state -- * -- * Command Mode -- * -- */ --struct setstapwrstate_parm { -- u8 staid; -- u8 status; -- u8 hwaddr[6]; --}; -- --/* -- * Caller Mode: Any -- * -- * Notes: To setup the basic rate of RTL8711 -- * -- * Command Mode -- * -- */ --struct setbasicrate_parm { -- u8 basicrates[NumRates]; --}; -- --/* -- * Caller Mode: Any -- * -- * Notes: To read the current basic rate -- * -- * Command-Rsp Mode -- * -- */ --struct getbasicrate_parm { -- u32 rsvd; --}; -- --struct getbasicrate_rsp { -- u8 basicrates[NumRates]; --}; -- --/* -- * Caller Mode: Any -- * -- * Notes: To setup the data rate of RTL8711 -- * -- * Command Mode -- * -- */ --struct setdatarate_parm { -- u8 mac_id; -- u8 datarates[NumRates]; --}; -- --enum _RT_CHANNEL_DOMAIN { -- RT_CHANNEL_DOMAIN_FCC = 0, -- RT_CHANNEL_DOMAIN_IC = 1, -- RT_CHANNEL_DOMAIN_ETSI = 2, -- RT_CHANNEL_DOMAIN_SPAIN = 3, -- RT_CHANNEL_DOMAIN_FRANCE = 4, -- RT_CHANNEL_DOMAIN_MKK = 5, -- RT_CHANNEL_DOMAIN_MKK1 = 6, -- RT_CHANNEL_DOMAIN_ISRAEL = 7, -- RT_CHANNEL_DOMAIN_TELEC = 8, -- -- /* Be compatible with old channel plan. No good! */ -- RT_CHANNEL_DOMAIN_MIC = 9, -- RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN = 10, -- RT_CHANNEL_DOMAIN_WORLD_WIDE_13 = 11, -- RT_CHANNEL_DOMAIN_TELEC_NETGEAR = 12, -- -- RT_CHANNEL_DOMAIN_NCC = 13, -- RT_CHANNEL_DOMAIN_5G = 14, -- RT_CHANNEL_DOMAIN_5G_40M = 15, -- /*===== Add new channel plan above this line===============*/ -- RT_CHANNEL_DOMAIN_MAX, --}; -- --struct SetChannelPlan_param { -- enum _RT_CHANNEL_DOMAIN ChannelPlan; --}; -- --/* -- * Caller Mode: Any -- * -- * Notes: To read the current data rate -- * -- * Command-Rsp Mode -- * -- */ --struct getdatarate_parm { -- u32 rsvd; -- --}; -- --struct getdatarate_rsp { -- u8 datarates[NumRates]; --}; -- --/* -- * Caller Mode: Any -- * AP: AP can use the info for the contents of beacon frame -- * Infra: STA can use the info when sitesurveying -- * Ad-HoC(M): Like AP -- * Ad-HoC(C): Like STA -- * -- * -- * Notes: To set the phy capability of the NIC -- * -- * Command Mode -- * -- */ -- --/* -- * Caller Mode: Any -- * -- * Notes: To set the channel/modem/band -- * This command will be used when channel/modem/band is changed. -- * -- * Command Mode -- * -- */ --/* -- * Caller Mode: Any -- * -- * Notes: To get the current setting of channel/modem/band -- * -- * Command-Rsp Mode -- * -- */ --struct getphy_rsp { -- u8 rfchannel; -- u8 modem; --}; -- --struct readBB_parm { -- u8 offset; --}; -- --struct readBB_rsp { -- u8 value; --}; -- --struct readTSSI_parm { -- u8 offset; --}; -- --struct readTSSI_rsp { -- u8 value; --}; -- --struct writeBB_parm { -- u8 offset; -- u8 value; --}; -- --struct writePTM_parm { -- u8 type; --}; -- --struct readRF_parm { -- u8 offset; --}; -- --struct readRF_rsp { -- u32 value; --}; -- --struct writeRF_parm { -- u32 offset; -- u32 value; --}; -- --struct setrfintfs_parm { -- u8 rfintfs; --}; -- --struct getrfintfs_parm { -- u8 rfintfs; --}; -- --/* -- * Notes: This command is used for H2C/C2H loopback testing -- * -- * mac[0] == 0 -- * ==> CMD mode, return H2C_SUCCESS. -- * The following condition must be true under CMD mode -- * mac[1] == mac[4], mac[2] == mac[3], mac[0]=mac[5]= 0; -- * s0 == 0x1234, s1 == 0xabcd, w0 == 0x78563412, w1 == 0x5aa5def7; -- * s2 == (b1 << 8 | b0); -- * -- * mac[0] == 1 -- * ==> CMD_RSP mode, return H2C_SUCCESS_RSP -- * -- * The rsp layout shall be: -- * rsp: parm: -- * mac[0] = mac[5]; -- * mac[1] = mac[4]; -- * mac[2] = mac[3]; -- * mac[3] = mac[2]; -- * mac[4] = mac[1]; -- * mac[5] = mac[0]; -- * s0 = s1; -- * s1 = swap16(s0); -- * w0 = swap32(w1); -- * b0 = b1 -- * s2 = s0 + s1 -- * b1 = b0 -- * w1 = w0 -- * -- * mac[0] == 2 -- * ==> CMD_EVENT mode, return H2C_SUCCESS -- * The event layout shall be: -- * event: parm: -- * mac[0] = mac[5]; -- * mac[1] = mac[4]; -- * mac[2] = event's sequence number, starting from 1 to parm's marc[3] -- * mac[3] = mac[2]; -- * mac[4] = mac[1]; -- * mac[5] = mac[0]; -- * s0 = swap16(s0) - event.mac[2]; -- * s1 = s1 + event.mac[2]; -- * w0 = swap32(w0); -- * b0 = b1 -- * s2 = s0 + event.mac[2] -- * b1 = b0 -- * w1 = swap32(w1) - event.mac[2]; -- * -- * parm->mac[3] is the total event counts that host requested. -- * -- * -- * event will be the same with the cmd's param. -- * -- */ -- --/* CMD param Formart for DRV INTERNAL CMD HDL*/ --struct drvint_cmd_parm { -- int i_cid; /*internal cmd id*/ -- int sz; /* buf sz*/ -- unsigned char *pbuf; --}; -- --/*------------------- Below are used for RF/BB tuning ---------------------*/ -- --struct setantenna_parm { -- u8 tx_antset; -- u8 rx_antset; -- u8 tx_antenna; -- u8 rx_antenna; --}; -- --struct enrateadaptive_parm { -- u32 en; --}; -- --struct settxagctbl_parm { -- u32 txagc[MAX_RATES_LENGTH]; --}; -- --struct gettxagctbl_parm { -- u32 rsvd; --}; -- --struct gettxagctbl_rsp { -- u32 txagc[MAX_RATES_LENGTH]; --}; -- --struct setagcctrl_parm { -- u32 agcctrl; /* 0: pure hw, 1: fw */ --}; -- --struct setssup_parm { -- u32 ss_ForceUp[MAX_RATES_LENGTH]; --}; -- --struct getssup_parm { -- u32 rsvd; --}; -- --struct getssup_rsp { -- u8 ss_ForceUp[MAX_RATES_LENGTH]; --}; -- --struct setssdlevel_parm { -- u8 ss_DLevel[MAX_RATES_LENGTH]; --}; -- --struct getssdlevel_parm { -- u32 rsvd; --}; -- --struct getssdlevel_rsp { -- u8 ss_DLevel[MAX_RATES_LENGTH]; --}; -- --struct setssulevel_parm { -- u8 ss_ULevel[MAX_RATES_LENGTH]; --}; -- --struct getssulevel_parm { -- u32 rsvd; --}; -- --struct getssulevel_rsp { -- u8 ss_ULevel[MAX_RATES_LENGTH]; --}; -- --struct setcountjudge_parm { -- u8 count_judge[MAX_RATES_LENGTH]; --}; -- --struct getcountjudge_parm { -- u32 rsvd; --}; -- --struct getcountjudge_rsp { -- u8 count_judge[MAX_RATES_LENGTH]; --}; -- --struct setpwrmode_parm { -- u8 mode; -- u8 flag_low_traffic_en; -- u8 flag_lpnav_en; -- u8 flag_rf_low_snr_en; -- u8 flag_dps_en; /* 1: dps, 0: 32k */ -- u8 bcn_rx_en; -- u8 bcn_pass_cnt; /* fw report one beacon information to -- * driver when it receives bcn_pass_cnt -- * beacons. -- */ -- u8 bcn_to; /* beacon TO (ms). ¡§=0¡¨ no limit.*/ -- u16 bcn_itv; -- u8 app_itv; /* only for VOIP mode. */ -- u8 awake_bcn_itv; -- u8 smart_ps; -- u8 bcn_pass_time; /* unit: 100ms */ --}; -- --struct setatim_parm { -- u8 op; /*0: add, 1:del*/ -- u8 txid; /* id of dest station.*/ --}; -- --struct setratable_parm { -- u8 ss_ForceUp[NumRates]; -- u8 ss_ULevel[NumRates]; -- u8 ss_DLevel[NumRates]; -- u8 count_judge[NumRates]; --}; -- --struct getratable_parm { -- uint rsvd; --}; -- --struct getratable_rsp { -- u8 ss_ForceUp[NumRates]; -- u8 ss_ULevel[NumRates]; -- u8 ss_DLevel[NumRates]; -- u8 count_judge[NumRates]; --}; -- --/*to get TX,RX retry count*/ --struct gettxretrycnt_parm { -- unsigned int rsvd; --}; -- --struct gettxretrycnt_rsp { -- unsigned long tx_retrycnt; --}; -- --struct getrxretrycnt_parm { -- unsigned int rsvd; --}; -- --struct getrxretrycnt_rsp { -- unsigned long rx_retrycnt; --}; -- --/*to get BCNOK,BCNERR count*/ --struct getbcnokcnt_parm { -- unsigned int rsvd; --}; -- --struct getbcnokcnt_rsp { -- unsigned long bcnokcnt; --}; -- --struct getbcnerrcnt_parm { -- unsigned int rsvd; --}; -- --struct getbcnerrcnt_rsp { -- unsigned long bcnerrcnt; --}; -- --/* to get current TX power level*/ --struct getcurtxpwrlevel_parm { -- unsigned int rsvd; --}; -- --struct getcurtxpwrlevel_rsp { -- unsigned short tx_power; --}; -- --/*dynamic on/off DIG*/ --struct setdig_parm { -- unsigned char dig_on; /* 1:on , 0:off */ --}; -- --/*dynamic on/off RA*/ --struct setra_parm { -- unsigned char ra_on; /* 1:on , 0:off */ --}; -- --struct setprobereqextraie_parm { -- unsigned char e_id; -- unsigned char ie_len; -- unsigned char ie[]; --}; -- --struct setassocreqextraie_parm { -- unsigned char e_id; -- unsigned char ie_len; -- unsigned char ie[]; --}; -- --struct setproberspextraie_parm { -- unsigned char e_id; -- unsigned char ie_len; -- unsigned char ie[]; --}; -- --struct setassocrspextraie_parm { -- unsigned char e_id; -- unsigned char ie_len; -- unsigned char ie[]; --}; -- --struct addBaReq_parm { -- unsigned int tid; --}; -- --/*H2C Handler index: 46 */ --struct SetChannel_parm { -- u32 curr_ch; --}; -- --/*H2C Handler index: 61 */ --struct DisconnectCtrlEx_param { -- /* MAXTIME = (2 * FirstStageTO) + (TryPktCnt * TryPktInterval) */ -- unsigned char EnableDrvCtrl; -- unsigned char TryPktCnt; -- unsigned char TryPktInterval; /* Unit: ms */ -- unsigned char rsvd; -- unsigned int FirstStageTO; /* Unit: ms */ --}; -- --#define GEN_CMD_CODE(cmd) cmd ## _CMD_ -- --/* -- * Result: -- * 0x00: success -- * 0x01: success, and check Response. -- * 0x02: cmd ignored due to duplicated sequence number -- * 0x03: cmd dropped due to invalid cmd code -- * 0x04: reserved. -- */ -- --#define H2C_RSP_OFFSET 512 --#define H2C_SUCCESS 0x00 --#define H2C_SUCCESS_RSP 0x01 --#define H2C_DUPLICATED 0x02 --#define H2C_DROPPED 0x03 --#define H2C_PARAMETERS_ERROR 0x04 --#define H2C_REJECTED 0x05 --#define H2C_CMD_OVERFLOW 0x06 --#define H2C_RESERVED 0x07 -- --void r8712_setMacAddr_cmd(struct _adapter *padapter, const u8 *mac_addr); --u8 r8712_sitesurvey_cmd(struct _adapter *padapter, -- struct ndis_802_11_ssid *pssid); --int r8712_createbss_cmd(struct _adapter *padapter); --void r8712_setstakey_cmd(struct _adapter *padapter, u8 *psta, u8 unicast_key); --int r8712_joinbss_cmd(struct _adapter *padapter, -- struct wlan_network *pnetwork); --void r8712_disassoc_cmd(struct _adapter *padapter); --void r8712_setopmode_cmd(struct _adapter *padapter, -- enum NDIS_802_11_NETWORK_INFRASTRUCTURE networktype); --int r8712_setdatarate_cmd(struct _adapter *padapter, u8 *rateset); --void r8712_set_chplan_cmd(struct _adapter *padapter, int chplan); --int r8712_getrfreg_cmd(struct _adapter *padapter, u8 offset, u8 *pval); --int r8712_setrfreg_cmd(struct _adapter *padapter, u8 offset, u32 val); --void r8712_addbareq_cmd(struct _adapter *padapter, u8 tid); --void r8712_wdg_wk_cmd(struct _adapter *padapter); --void r8712_survey_cmd_callback(struct _adapter *padapter, -- struct cmd_obj *pcmd); --void r8712_disassoc_cmd_callback(struct _adapter *padapter, -- struct cmd_obj *pcmd); --void r8712_joinbss_cmd_callback(struct _adapter *padapter, -- struct cmd_obj *pcmd); --void r8712_createbss_cmd_callback(struct _adapter *padapter, -- struct cmd_obj *pcmd); --void r8712_getbbrfreg_cmdrsp_callback(struct _adapter *padapter, -- struct cmd_obj *pcmd); --void r8712_readtssi_cmdrsp_callback(struct _adapter *padapter, -- struct cmd_obj *pcmd); --void r8712_setstaKey_cmdrsp_callback(struct _adapter *padapter, -- struct cmd_obj *pcmd); --void r8712_setassocsta_cmdrsp_callback(struct _adapter *padapter, -- struct cmd_obj *pcmd); --void r8712_disconnectCtrlEx_cmd(struct _adapter *adapter, u32 enableDrvCtrl, -- u32 tryPktCnt, u32 tryPktInterval, u32 firstStageTO); -- --struct _cmd_callback { -- u32 cmd_code; -- void (*callback)(struct _adapter *padapter, struct cmd_obj *cmd); --}; -- --#include "rtl8712_cmd.h" -- --#endif /* _CMD_H_ */ -- -diff --git a/drivers/staging/rtl8712/rtl871x_debug.h b/drivers/staging/rtl8712/rtl871x_debug.h -deleted file mode 100644 -index 69c631af2a2acf..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_debug.h -+++ /dev/null -@@ -1,130 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __RTL871X_DEBUG_H__ --#define __RTL871X_DEBUG_H__ -- --#include "osdep_service.h" --#include "drv_types.h" -- --#define _drv_emerg_ 1 --#define _drv_alert_ 2 --#define _drv_crit_ 3 --#define _drv_err_ 4 --#define _drv_warning_ 5 --#define _drv_notice_ 6 --#define _drv_info_ 7 --#define _drv_dump_ 8 --#define _drv_debug_ 9 -- --#define _module_rtl871x_xmit_c_ BIT(0) --#define _module_xmit_osdep_c_ BIT(1) --#define _module_rtl871x_recv_c_ BIT(2) --#define _module_recv_osdep_c_ BIT(3) --#define _module_rtl871x_mlme_c_ BIT(4) --#define _module_mlme_osdep_c_ BIT(5) --#define _module_rtl871x_sta_mgt_c_ BIT(6) --#define _module_rtl871x_cmd_c_ BIT(7) --#define _module_cmd_osdep_c_ BIT(8) --#define _module_rtl871x_io_c_ BIT(9) --#define _module_io_osdep_c_ BIT(10) --#define _module_os_intfs_c_ BIT(11) --#define _module_rtl871x_security_c_ BIT(12) --#define _module_rtl871x_eeprom_c_ BIT(13) --#define _module_hal_init_c_ BIT(14) --#define _module_hci_hal_init_c_ BIT(15) --#define _module_rtl871x_ioctl_c_ BIT(16) --#define _module_rtl871x_ioctl_set_c_ BIT(17) --#define _module_rtl871x_pwrctrl_c_ BIT(19) --#define _module_hci_intfs_c_ BIT(20) --#define _module_hci_ops_c_ BIT(21) --#define _module_osdep_service_c_ BIT(22) --#define _module_rtl871x_mp_ioctl_c_ BIT(23) --#define _module_hci_ops_os_c_ BIT(24) --#define _module_rtl871x_ioctl_os_c BIT(25) --#define _module_rtl8712_cmd_c_ BIT(26) --#define _module_rtl871x_mp_c_ BIT(27) --#define _module_rtl8712_xmit_c_ BIT(28) --#define _module_rtl8712_efuse_c_ BIT(29) --#define _module_rtl8712_recv_c_ BIT(30) --#define _module_rtl8712_led_c_ BIT(31) -- --#undef _MODULE_DEFINE_ -- --#if defined _RTL871X_XMIT_C_ -- #define _MODULE_DEFINE_ _module_rtl871x_xmit_c_ --#elif defined _XMIT_OSDEP_C_ -- #define _MODULE_DEFINE_ _module_xmit_osdep_c_ --#elif defined _RTL871X_RECV_C_ -- #define _MODULE_DEFINE_ _module_rtl871x_recv_c_ --#elif defined _RECV_OSDEP_C_ -- #define _MODULE_DEFINE_ _module_recv_osdep_c_ --#elif defined _RTL871X_MLME_C_ -- #define _MODULE_DEFINE_ _module_rtl871x_mlme_c_ --#elif defined _MLME_OSDEP_C_ -- #define _MODULE_DEFINE_ _module_mlme_osdep_c_ --#elif defined _RTL871X_STA_MGT_C_ -- #define _MODULE_DEFINE_ _module_rtl871x_sta_mgt_c_ --#elif defined _RTL871X_CMD_C_ -- #define _MODULE_DEFINE_ _module_rtl871x_cmd_c_ --#elif defined _CMD_OSDEP_C_ -- #define _MODULE_DEFINE_ _module_cmd_osdep_c_ --#elif defined _RTL871X_IO_C_ -- #define _MODULE_DEFINE_ _module_rtl871x_io_c_ --#elif defined _IO_OSDEP_C_ -- #define _MODULE_DEFINE_ _module_io_osdep_c_ --#elif defined _OS_INTFS_C_ -- #define _MODULE_DEFINE_ _module_os_intfs_c_ --#elif defined _RTL871X_SECURITY_C_ -- #define _MODULE_DEFINE_ _module_rtl871x_security_c_ --#elif defined _RTL871X_EEPROM_C_ -- #define _MODULE_DEFINE_ _module_rtl871x_eeprom_c_ --#elif defined _HAL_INIT_C_ -- #define _MODULE_DEFINE_ _module_hal_init_c_ --#elif defined _HCI_HAL_INIT_C_ -- #define _MODULE_DEFINE_ _module_hci_hal_init_c_ --#elif defined _RTL871X_IOCTL_C_ -- #define _MODULE_DEFINE_ _module_rtl871x_ioctl_c_ --#elif defined _RTL871X_IOCTL_SET_C_ -- #define _MODULE_DEFINE_ _module_rtl871x_ioctl_set_c_ --#elif defined _RTL871X_PWRCTRL_C_ -- #define _MODULE_DEFINE_ _module_rtl871x_pwrctrl_c_ --#elif defined _HCI_INTF_C_ -- #define _MODULE_DEFINE_ _module_hci_intfs_c_ --#elif defined _HCI_OPS_C_ -- #define _MODULE_DEFINE_ _module_hci_ops_c_ --#elif defined _OSDEP_HCI_INTF_C_ -- #define _MODULE_DEFINE_ _module_hci_intfs_c_ --#elif defined _OSDEP_SERVICE_C_ -- #define _MODULE_DEFINE_ _module_osdep_service_c_ --#elif defined _RTL871X_MP_IOCTL_C_ -- #define _MODULE_DEFINE_ _module_rtl871x_mp_ioctl_c_ --#elif defined _HCI_OPS_OS_C_ -- #define _MODULE_DEFINE_ _module_hci_ops_os_c_ --#elif defined _RTL871X_IOCTL_LINUX_C_ -- #define _MODULE_DEFINE_ _module_rtl871x_ioctl_os_c --#elif defined _RTL871X_MP_C_ -- #define _MODULE_DEFINE_ _module_rtl871x_mp_c_ --#elif defined _RTL8712_CMD_C_ -- #define _MODULE_DEFINE_ _module_rtl8712_cmd_c_ --#elif defined _RTL8712_XMIT_C_ -- #define _MODULE_DEFINE_ _module_rtl8712_xmit_c_ --#elif defined _RTL8712_EFUSE_C_ -- #define _MODULE_DEFINE_ _module_rtl8712_efuse_c_ --#elif defined _RTL8712_RECV_C_ -- #define _MODULE_DEFINE_ _module_rtl8712_recv_c_ --#else -- #undef _MODULE_DEFINE_ --#endif -- --#endif /*__RTL871X_DEBUG_H__*/ -diff --git a/drivers/staging/rtl8712/rtl871x_eeprom.c b/drivers/staging/rtl8712/rtl871x_eeprom.c -deleted file mode 100644 -index 221bf92e1b1c3f..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_eeprom.c -+++ /dev/null -@@ -1,220 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * rtl871x_eeprom.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _RTL871X_EEPROM_C_ -- --#include "osdep_service.h" --#include "drv_types.h" -- --static void up_clk(struct _adapter *padapter, u16 *x) --{ -- *x = *x | _EESK; -- r8712_write8(padapter, EE_9346CR, (u8)*x); -- udelay(CLOCK_RATE); --} -- --static void down_clk(struct _adapter *padapter, u16 *x) --{ -- *x = *x & ~_EESK; -- r8712_write8(padapter, EE_9346CR, (u8)*x); -- udelay(CLOCK_RATE); --} -- --static void shift_out_bits(struct _adapter *padapter, u16 data, u16 count) --{ -- u16 x, mask; -- -- if (padapter->surprise_removed) -- goto out; -- mask = 0x01 << (count - 1); -- x = r8712_read8(padapter, EE_9346CR); -- x &= ~(_EEDO | _EEDI); -- do { -- x &= ~_EEDI; -- if (data & mask) -- x |= _EEDI; -- if (padapter->surprise_removed) -- goto out; -- r8712_write8(padapter, EE_9346CR, (u8)x); -- udelay(CLOCK_RATE); -- up_clk(padapter, &x); -- down_clk(padapter, &x); -- mask >>= 1; -- } while (mask); -- if (padapter->surprise_removed) -- goto out; -- x &= ~_EEDI; -- r8712_write8(padapter, EE_9346CR, (u8)x); --out:; --} -- --static u16 shift_in_bits(struct _adapter *padapter) --{ -- u16 x, d = 0, i; -- -- if (padapter->surprise_removed) -- goto out; -- x = r8712_read8(padapter, EE_9346CR); -- x &= ~(_EEDO | _EEDI); -- d = 0; -- for (i = 0; i < 16; i++) { -- d <<= 1; -- up_clk(padapter, &x); -- if (padapter->surprise_removed) -- goto out; -- x = r8712_read8(padapter, EE_9346CR); -- x &= ~(_EEDI); -- if (x & _EEDO) -- d |= 1; -- down_clk(padapter, &x); -- } --out: -- return d; --} -- --static void standby(struct _adapter *padapter) --{ -- u8 x; -- -- x = r8712_read8(padapter, EE_9346CR); -- x &= ~(_EECS | _EESK); -- r8712_write8(padapter, EE_9346CR, x); -- udelay(CLOCK_RATE); -- x |= _EECS; -- r8712_write8(padapter, EE_9346CR, x); -- udelay(CLOCK_RATE); --} -- --static u16 wait_eeprom_cmd_done(struct _adapter *padapter) --{ -- u8 x; -- u16 i; -- -- standby(padapter); -- for (i = 0; i < 200; i++) { -- x = r8712_read8(padapter, EE_9346CR); -- if (x & _EEDO) -- return true; -- udelay(CLOCK_RATE); -- } -- return false; --} -- --static void eeprom_clean(struct _adapter *padapter) --{ -- u16 x; -- -- if (padapter->surprise_removed) -- return; -- x = r8712_read8(padapter, EE_9346CR); -- if (padapter->surprise_removed) -- return; -- x &= ~(_EECS | _EEDI); -- r8712_write8(padapter, EE_9346CR, (u8)x); -- if (padapter->surprise_removed) -- return; -- up_clk(padapter, &x); -- if (padapter->surprise_removed) -- return; -- down_clk(padapter, &x); --} -- --void r8712_eeprom_write16(struct _adapter *padapter, u16 reg, u16 data) --{ -- u8 x; -- u8 tmp8_ori, tmp8_new, tmp8_clk_ori, tmp8_clk_new; -- -- tmp8_ori = r8712_read8(padapter, 0x102502f1); -- tmp8_new = tmp8_ori & 0xf7; -- if (tmp8_ori != tmp8_new) -- r8712_write8(padapter, 0x102502f1, tmp8_new); -- tmp8_clk_ori = r8712_read8(padapter, 0x10250003); -- tmp8_clk_new = tmp8_clk_ori | 0x20; -- if (tmp8_clk_new != tmp8_clk_ori) -- r8712_write8(padapter, 0x10250003, tmp8_clk_new); -- x = r8712_read8(padapter, EE_9346CR); -- x &= ~(_EEDI | _EEDO | _EESK | _EEM0); -- x |= _EEM1 | _EECS; -- r8712_write8(padapter, EE_9346CR, x); -- shift_out_bits(padapter, EEPROM_EWEN_OPCODE, 5); -- if (padapter->eeprom_address_size == 8) /*CF+ and SDIO*/ -- shift_out_bits(padapter, 0, 6); -- else /* USB */ -- shift_out_bits(padapter, 0, 4); -- standby(padapter); -- /* Erase this particular word. Write the erase opcode and register -- * number in that order. The opcode is 3bits in length; reg is 6 -- * bits long. -- */ -- standby(padapter); -- /* write the new word to the EEPROM -- * send the write opcode the EEPORM -- */ -- shift_out_bits(padapter, EEPROM_WRITE_OPCODE, 3); -- /* select which word in the EEPROM that we are writing to. */ -- shift_out_bits(padapter, reg, padapter->eeprom_address_size); -- /* write the data to the selected EEPROM word. */ -- shift_out_bits(padapter, data, 16); -- if (wait_eeprom_cmd_done(padapter)) { -- standby(padapter); -- shift_out_bits(padapter, EEPROM_EWDS_OPCODE, 5); -- shift_out_bits(padapter, reg, 4); -- eeprom_clean(padapter); -- } -- if (tmp8_clk_new != tmp8_clk_ori) -- r8712_write8(padapter, 0x10250003, tmp8_clk_ori); -- if (tmp8_new != tmp8_ori) -- r8712_write8(padapter, 0x102502f1, tmp8_ori); --} -- --u16 r8712_eeprom_read16(struct _adapter *padapter, u16 reg) /*ReadEEprom*/ --{ -- u16 x; -- u16 data = 0; -- u8 tmp8_ori, tmp8_new, tmp8_clk_ori, tmp8_clk_new; -- -- tmp8_ori = r8712_read8(padapter, 0x102502f1); -- tmp8_new = tmp8_ori & 0xf7; -- if (tmp8_ori != tmp8_new) -- r8712_write8(padapter, 0x102502f1, tmp8_new); -- tmp8_clk_ori = r8712_read8(padapter, 0x10250003); -- tmp8_clk_new = tmp8_clk_ori | 0x20; -- if (tmp8_clk_new != tmp8_clk_ori) -- r8712_write8(padapter, 0x10250003, tmp8_clk_new); -- if (padapter->surprise_removed) -- goto out; -- /* select EEPROM, reset bits, set _EECS */ -- x = r8712_read8(padapter, EE_9346CR); -- if (padapter->surprise_removed) -- goto out; -- x &= ~(_EEDI | _EEDO | _EESK | _EEM0); -- x |= _EEM1 | _EECS; -- r8712_write8(padapter, EE_9346CR, (unsigned char)x); -- /* write the read opcode and register number in that order -- * The opcode is 3bits in length, reg is 6 bits long -- */ -- shift_out_bits(padapter, EEPROM_READ_OPCODE, 3); -- shift_out_bits(padapter, reg, padapter->eeprom_address_size); -- /* Now read the data (16 bits) in from the selected EEPROM word */ -- data = shift_in_bits(padapter); -- eeprom_clean(padapter); --out: -- if (tmp8_clk_new != tmp8_clk_ori) -- r8712_write8(padapter, 0x10250003, tmp8_clk_ori); -- if (tmp8_new != tmp8_ori) -- r8712_write8(padapter, 0x102502f1, tmp8_ori); -- return data; --} -diff --git a/drivers/staging/rtl8712/rtl871x_eeprom.h b/drivers/staging/rtl8712/rtl871x_eeprom.h -deleted file mode 100644 -index 7bdeb2aaa0259b..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_eeprom.h -+++ /dev/null -@@ -1,88 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- ******************************************************************************/ --#ifndef __RTL871X_EEPROM_H__ --#define __RTL871X_EEPROM_H__ -- --#include "osdep_service.h" -- --#define RTL8712_EEPROM_ID 0x8712 --#define EEPROM_MAX_SIZE 256 --#define CLOCK_RATE 50 /*100us*/ -- --/*- EEPROM opcodes*/ --#define EEPROM_READ_OPCODE 06 --#define EEPROM_WRITE_OPCODE 05 --#define EEPROM_ERASE_OPCODE 07 --#define EEPROM_EWEN_OPCODE 19 /* Erase/write enable*/ --#define EEPROM_EWDS_OPCODE 16 /* Erase/write disable*/ -- --#define EEPROM_CID_DEFAULT 0x0 --#define EEPROM_CID_ALPHA 0x1 --#define EEPROM_CID_Senao 0x3 --#define EEPROM_CID_NetCore 0x5 --#define EEPROM_CID_CAMEO 0X8 --#define EEPROM_CID_SITECOM 0x9 --#define EEPROM_CID_COREGA 0xB --#define EEPROM_CID_EDIMAX_BELKIN 0xC --#define EEPROM_CID_SERCOMM_BELKIN 0xE --#define EEPROM_CID_CAMEO1 0xF --#define EEPROM_CID_WNC_COREGA 0x12 --#define EEPROM_CID_CLEVO 0x13 --#define EEPROM_CID_WHQL 0xFE -- --enum RT_CUSTOMER_ID { -- RT_CID_DEFAULT = 0, -- RT_CID_8187_ALPHA0 = 1, -- RT_CID_8187_SERCOMM_PS = 2, -- RT_CID_8187_HW_LED = 3, -- RT_CID_8187_NETGEAR = 4, -- RT_CID_WHQL = 5, -- RT_CID_819x_CAMEO = 6, -- RT_CID_819x_RUNTOP = 7, -- RT_CID_819x_Senao = 8, -- RT_CID_TOSHIBA = 9, -- RT_CID_819x_Netcore = 10, -- RT_CID_Nettronix = 11, -- RT_CID_DLINK = 12, -- RT_CID_PRONET = 13, -- RT_CID_COREGA = 14, -- RT_CID_819x_ALPHA = 15, -- RT_CID_819x_Sitecom = 16, -- RT_CID_CCX = 17, -- RT_CID_819x_Lenovo = 18, -- RT_CID_819x_QMI = 19, -- RT_CID_819x_Edimax_Belkin = 20, -- RT_CID_819x_Sercomm_Belkin = 21, -- RT_CID_819x_CAMEO1 = 22, -- RT_CID_819x_MSI = 23, -- RT_CID_819x_Acer = 24, -- RT_CID_819x_AzWave_ASUS = 25, -- RT_CID_819x_AzWave = 26, -- RT_CID_819x_WNC_COREGA = 27, -- RT_CID_819x_CLEVO = 28, --}; -- --struct eeprom_priv { -- u8 bautoload_fail_flag; -- u8 bempty; -- u8 sys_config; -- u8 mac_addr[6]; -- u8 config0; -- u16 channel_plan; -- u8 country_string[3]; -- u8 tx_power_b[15]; -- u8 tx_power_g[15]; -- u8 tx_power_a[201]; -- u8 efuse_eeprom_data[EEPROM_MAX_SIZE]; -- enum RT_CUSTOMER_ID CustomerID; --}; -- --void r8712_eeprom_write16(struct _adapter *padapter, u16 reg, u16 data); --u16 r8712_eeprom_read16(struct _adapter *padapter, u16 reg); -- --#endif /*__RTL871X_EEPROM_H__*/ -- -diff --git a/drivers/staging/rtl8712/rtl871x_event.h b/drivers/staging/rtl8712/rtl871x_event.h -deleted file mode 100644 -index 759a2d27d8f22d..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_event.h -+++ /dev/null -@@ -1,109 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef _RTL871x_EVENT_H_ --#define _RTL871x_EVENT_H_ -- --#include "osdep_service.h" -- --#include "wlan_bssdef.h" --#include --#include -- --/* -- * Used to report a bss has been scanned -- */ --struct survey_event { -- struct wlan_bssid_ex bss; --}; -- --/* -- * Used to report that the requested site survey has been done. -- * bss_cnt indicates the number of bss that has been reported. -- */ --struct surveydone_event { -- unsigned int bss_cnt; -- --}; -- --/* -- * Used to report the link result of joinning the given bss -- * join_res: -- * -1: authentication fail -- * -2: association fail -- * > 0: TID -- */ --struct joinbss_event { -- struct wlan_network network; --}; -- --/* -- * Used to report a given STA has joinned the created BSS. -- * It is used in AP/Ad-HoC(M) mode. -- */ --struct stassoc_event { -- unsigned char macaddr[6]; -- unsigned char rsvd[2]; -- __le32 cam_id; --}; -- --struct stadel_event { -- unsigned char macaddr[6]; -- unsigned char rsvd[2]; --}; -- --struct addba_event { -- unsigned int tid; --}; -- --#define GEN_EVT_CODE(event) event ## _EVT_ -- --struct fwevent { -- u32 parmsize; -- void (*event_callback)(struct _adapter *dev, u8 *pbuf); --}; -- --#define C2HEVENT_SZ 32 --struct event_node { -- unsigned char *node; -- unsigned char evt_code; -- unsigned short evt_sz; -- /*volatile*/ int *caller_ff_tail; -- int caller_ff_sz; --}; -- --struct c2hevent_queue { -- /*volatile*/ int head; -- /*volatile*/ int tail; -- struct event_node nodes[C2HEVENT_SZ]; -- unsigned char seq; --}; -- --#define NETWORK_QUEUE_SZ 4 -- --struct network_queue { -- /*volatile*/ int head; -- /*volatile*/ int tail; -- struct wlan_bssid_ex networks[NETWORK_QUEUE_SZ]; --}; -- --struct ADDBA_Req_Report_parm { -- unsigned char MacAddress[ETH_ALEN]; -- unsigned short StartSeqNum; -- unsigned char tid; --}; -- --#include "rtl8712_event.h" -- --#endif /* _WLANEVENT_H_ */ -- -diff --git a/drivers/staging/rtl8712/rtl871x_ht.h b/drivers/staging/rtl8712/rtl871x_ht.h -deleted file mode 100644 -index ebd78665775dd0..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_ht.h -+++ /dev/null -@@ -1,33 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef _RTL871X_HT_H_ --#define _RTL871X_HT_H_ -- --#include "osdep_service.h" --#include "wifi.h" -- --struct ht_priv { -- unsigned int ht_option; -- unsigned int ampdu_enable;/*for enable Tx A-MPDU*/ -- unsigned char baddbareq_issued[16]; -- unsigned int tx_amsdu_enable;/*for enable Tx A-MSDU */ -- unsigned int tx_amdsu_maxlen; /* 1: 8k, 0:4k ; default:8k, for tx */ -- unsigned int rx_ampdu_maxlen; /* for rx reordering ctrl win_sz, -- * updated when join_callback. -- */ -- struct ieee80211_ht_cap ht_cap; --}; -- --#endif /*_RTL871X_HT_H_ */ -- -diff --git a/drivers/staging/rtl8712/rtl871x_io.c b/drivers/staging/rtl8712/rtl871x_io.c -deleted file mode 100644 -index 6789a4c985649e..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_io.c -+++ /dev/null -@@ -1,147 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * rtl871x_io.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --/* -- * -- * The purpose of rtl871x_io.c -- * -- * a. provides the API -- * b. provides the protocol engine -- * c. provides the software interface between caller and the hardware interface -- * -- * For r8712u, both sync/async operations are provided. -- * -- * Only sync read/write_mem operations are provided. -- * -- */ -- --#define _RTL871X_IO_C_ -- --#include "osdep_service.h" --#include "drv_types.h" --#include "rtl871x_io.h" --#include "osdep_intf.h" --#include "usb_ops.h" -- --static uint _init_intf_hdl(struct _adapter *padapter, -- struct intf_hdl *pintf_hdl) --{ -- struct intf_priv *pintf_priv; -- void (*set_intf_option)(u32 *poption) = NULL; -- void (*set_intf_funs)(struct intf_hdl *pintf_hdl); -- void (*set_intf_ops)(struct _io_ops *pops); -- uint (*init_intf_priv)(struct intf_priv *pintfpriv); -- -- set_intf_option = &(r8712_usb_set_intf_option); -- set_intf_funs = &(r8712_usb_set_intf_funs); -- set_intf_ops = &r8712_usb_set_intf_ops; -- init_intf_priv = &r8712_usb_init_intf_priv; -- pintf_priv = pintf_hdl->pintfpriv = kmalloc(sizeof(struct intf_priv), -- GFP_ATOMIC); -- if (!pintf_priv) -- goto _init_intf_hdl_fail; -- pintf_hdl->adapter = (u8 *)padapter; -- set_intf_option(&pintf_hdl->intf_option); -- set_intf_funs(pintf_hdl); -- set_intf_ops(&pintf_hdl->io_ops); -- pintf_priv->intf_dev = (u8 *)&padapter->dvobjpriv; -- if (init_intf_priv(pintf_priv) == _FAIL) -- goto _init_intf_hdl_fail; -- return _SUCCESS; --_init_intf_hdl_fail: -- kfree(pintf_priv); -- return _FAIL; --} -- --static void _unload_intf_hdl(struct intf_priv *pintfpriv) --{ -- void (*unload_intf_priv)(struct intf_priv *pintfpriv); -- -- unload_intf_priv = &r8712_usb_unload_intf_priv; -- unload_intf_priv(pintfpriv); -- kfree(pintfpriv); --} -- --static uint register_intf_hdl(u8 *dev, struct intf_hdl *pintfhdl) --{ -- struct _adapter *adapter = (struct _adapter *)dev; -- -- pintfhdl->intf_option = 0; -- pintfhdl->adapter = dev; -- pintfhdl->intf_dev = (u8 *)&adapter->dvobjpriv; -- if (!_init_intf_hdl(adapter, pintfhdl)) -- goto register_intf_hdl_fail; -- return _SUCCESS; --register_intf_hdl_fail: -- return false; --} -- --static void unregister_intf_hdl(struct intf_hdl *pintfhdl) --{ -- _unload_intf_hdl(pintfhdl->pintfpriv); -- memset((u8 *)pintfhdl, 0, sizeof(struct intf_hdl)); --} -- --uint r8712_alloc_io_queue(struct _adapter *adapter) --{ -- u32 i; -- struct io_queue *pio_queue; -- struct io_req *pio_req; -- -- pio_queue = kmalloc(sizeof(*pio_queue), GFP_ATOMIC); -- if (!pio_queue) -- goto alloc_io_queue_fail; -- INIT_LIST_HEAD(&pio_queue->free_ioreqs); -- INIT_LIST_HEAD(&pio_queue->processing); -- INIT_LIST_HEAD(&pio_queue->pending); -- spin_lock_init(&pio_queue->lock); -- pio_queue->pallocated_free_ioreqs_buf = kzalloc(NUM_IOREQ * -- (sizeof(struct io_req)) + 4, -- GFP_ATOMIC); -- if ((pio_queue->pallocated_free_ioreqs_buf) == NULL) -- goto alloc_io_queue_fail; -- pio_queue->free_ioreqs_buf = pio_queue->pallocated_free_ioreqs_buf + 4 -- - ((addr_t)(pio_queue->pallocated_free_ioreqs_buf) -- & 3); -- pio_req = (struct io_req *)(pio_queue->free_ioreqs_buf); -- for (i = 0; i < NUM_IOREQ; i++) { -- INIT_LIST_HEAD(&pio_req->list); -- list_add_tail(&pio_req->list, &pio_queue->free_ioreqs); -- pio_req++; -- } -- if ((register_intf_hdl((u8 *)adapter, &pio_queue->intf)) == _FAIL) -- goto alloc_io_queue_fail; -- adapter->pio_queue = pio_queue; -- return _SUCCESS; --alloc_io_queue_fail: -- if (pio_queue) { -- kfree(pio_queue->pallocated_free_ioreqs_buf); -- kfree(pio_queue); -- } -- adapter->pio_queue = NULL; -- return _FAIL; --} -- --void r8712_free_io_queue(struct _adapter *adapter) --{ -- struct io_queue *pio_queue = adapter->pio_queue; -- -- if (pio_queue) { -- kfree(pio_queue->pallocated_free_ioreqs_buf); -- adapter->pio_queue = NULL; -- unregister_intf_hdl(&pio_queue->intf); -- kfree(pio_queue); -- } --} -diff --git a/drivers/staging/rtl8712/rtl871x_io.h b/drivers/staging/rtl8712/rtl871x_io.h -deleted file mode 100644 -index c5b12f74ebf892..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_io.h -+++ /dev/null -@@ -1,236 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef _RTL871X_IO_H_ --#define _RTL871X_IO_H_ -- --#include "osdep_service.h" --#include "osdep_intf.h" -- --#define NUM_IOREQ 8 -- --#define MAX_PROT_SZ (64-16) -- --#define _IOREADY 0 --#define _IO_WAIT_COMPLETE 1 --#define _IO_WAIT_RSP 2 -- --/* IO COMMAND TYPE */ --#define _IOSZ_MASK_ (0x7F) --#define _IO_WRITE_ BIT(7) --#define _IO_FIXED_ BIT(8) --#define _IO_BURST_ BIT(9) --#define _IO_BYTE_ BIT(10) --#define _IO_HW_ BIT(11) --#define _IO_WORD_ BIT(12) --#define _IO_SYNC_ BIT(13) --#define _IO_CMDMASK_ (0x1F80) -- --/* -- * For prompt mode accessing, caller shall free io_req -- * Otherwise, io_handler will free io_req -- */ --/* IO STATUS TYPE */ --#define _IO_ERR_ BIT(2) --#define _IO_SUCCESS_ BIT(1) --#define _IO_DONE_ BIT(0) --#define IO_RD32 (_IO_SYNC_ | _IO_WORD_) --#define IO_RD16 (_IO_SYNC_ | _IO_HW_) --#define IO_RD8 (_IO_SYNC_ | _IO_BYTE_) --#define IO_RD32_ASYNC (_IO_WORD_) --#define IO_RD16_ASYNC (_IO_HW_) --#define IO_RD8_ASYNC (_IO_BYTE_) --#define IO_WR32 (_IO_WRITE_ | _IO_SYNC_ | _IO_WORD_) --#define IO_WR16 (_IO_WRITE_ | _IO_SYNC_ | _IO_HW_) --#define IO_WR8 (_IO_WRITE_ | _IO_SYNC_ | _IO_BYTE_) --#define IO_WR32_ASYNC (_IO_WRITE_ | _IO_WORD_) --#define IO_WR16_ASYNC (_IO_WRITE_ | _IO_HW_) --#define IO_WR8_ASYNC (_IO_WRITE_ | _IO_BYTE_) --/* -- * Only Sync. burst accessing is provided. -- */ --#define IO_WR_BURST(x) (IO_WRITE_ | _IO_SYNC_ | _IO_BURST_ | \ -- ((x) & _IOSZ_MASK_)) --#define IO_RD_BURST(x) (_IO_SYNC_ | _IO_BURST_ | ((x) & _IOSZ_MASK_)) --/*below is for the intf_option bit defition...*/ --#define _INTF_ASYNC_ BIT(0) /*support async io*/ --struct intf_priv; --struct intf_hdl; --struct io_queue; --struct _io_ops { -- uint (*_sdbus_read_bytes_to_membuf)(struct intf_priv *pintfpriv, -- u32 addr, u32 cnt, u8 *pbuf); -- uint (*_sdbus_read_blocks_to_membuf)(struct intf_priv *pintfpriv, -- u32 addr, u32 cnt, u8 *pbuf); -- u8 (*_read8)(struct intf_hdl *pintfhdl, u32 addr); -- u16 (*_read16)(struct intf_hdl *pintfhdl, u32 addr); -- u32 (*_read32)(struct intf_hdl *pintfhdl, u32 addr); -- uint (*_sdbus_write_blocks_from_membuf)(struct intf_priv *pintfpriv, -- u32 addr, u32 cnt, u8 *pbuf, -- u8 async); -- uint (*_sdbus_write_bytes_from_membuf)(struct intf_priv *pintfpriv, -- u32 addr, u32 cnt, u8 *pbuf); -- u8 (*_cmd52r)(struct intf_priv *pintfpriv, u32 addr); -- void (*_cmd52w)(struct intf_priv *pintfpriv, u32 addr, u8 val8); -- u8 (*_cmdfunc152r)(struct intf_priv *pintfpriv, u32 addr); -- void (*_cmdfunc152w)(struct intf_priv *pintfpriv, u32 addr, u8 val8); -- void (*_write8)(struct intf_hdl *pintfhdl, u32 addr, u8 val); -- void (*_write16)(struct intf_hdl *pintfhdl, u32 addr, u16 val); -- void (*_write32)(struct intf_hdl *pintfhdl, u32 addr, u32 val); -- void (*_read_mem)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, -- u8 *pmem); -- void (*_write_mem)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, -- u8 *pmem); -- void (*_sync_irp_protocol_rw)(struct io_queue *pio_q); -- u32 (*_read_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, -- u8 *pmem); -- u32 (*_write_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, -- u8 *pmem); --}; -- --struct io_req { -- struct list_head list; -- u32 addr; -- /*volatile*/ u32 val; -- u32 command; -- u32 status; -- u8 *pbuf; -- void (*_async_io_callback)(struct _adapter *padapter, -- struct io_req *pio_req, u8 *cnxt); -- u8 *cnxt; --}; -- --struct intf_hdl { -- u32 intf_option; -- u8 *adapter; -- u8 *intf_dev; -- struct intf_priv *pintfpriv; -- void (*intf_hdl_init)(u8 *priv); -- void (*intf_hdl_unload)(u8 *priv); -- void (*intf_hdl_open)(u8 *priv); -- void (*intf_hdl_close)(u8 *priv); -- struct _io_ops io_ops; --}; -- --struct reg_protocol_rd { --#ifdef __LITTLE_ENDIAN -- /* DW1 */ -- u32 NumOfTrans:4; -- u32 Reserved1:4; -- u32 Reserved2:24; -- /* DW2 */ -- u32 ByteCount:7; -- u32 WriteEnable:1; /*0:read, 1:write*/ -- u32 FixOrContinuous:1; /*0:continuous, 1: Fix*/ -- u32 BurstMode:1; -- u32 Byte1Access:1; -- u32 Byte2Access:1; -- u32 Byte4Access:1; -- u32 Reserved3:3; -- u32 Reserved4:16; -- /*DW3*/ -- u32 BusAddress; -- /*DW4*/ --#else --/*DW1*/ -- u32 Reserved1:4; -- u32 NumOfTrans:4; -- u32 Reserved2:24; -- /*DW2*/ -- u32 WriteEnable:1; -- u32 ByteCount:7; -- u32 Reserved3:3; -- u32 Byte4Access:1; -- u32 Byte2Access:1; -- u32 Byte1Access:1; -- u32 BurstMode:1; -- u32 FixOrContinuous:1; -- u32 Reserved4:16; -- /*DW3*/ -- u32 BusAddress; -- /*DW4*/ --#endif --}; -- --struct reg_protocol_wt { --#ifdef __LITTLE_ENDIAN -- /*DW1*/ -- u32 NumOfTrans:4; -- u32 Reserved1:4; -- u32 Reserved2:24; -- /*DW2*/ -- u32 ByteCount:7; -- u32 WriteEnable:1; /*0:read, 1:write*/ -- u32 FixOrContinuous:1; /*0:continuous, 1: Fix*/ -- u32 BurstMode:1; -- u32 Byte1Access:1; -- u32 Byte2Access:1; -- u32 Byte4Access:1; -- u32 Reserved3:3; -- u32 Reserved4:16; -- /*DW3*/ -- u32 BusAddress; -- /*DW4*/ -- u32 Value; --#else -- /*DW1*/ -- u32 Reserved1:4; -- u32 NumOfTrans:4; -- u32 Reserved2:24; -- /*DW2*/ -- u32 WriteEnable:1; -- u32 ByteCount:7; -- u32 Reserved3:3; -- u32 Byte4Access:1; -- u32 Byte2Access:1; -- u32 Byte1Access:1; -- u32 BurstMode:1; -- u32 FixOrContinuous:1; -- u32 Reserved4:16; -- /*DW3*/ -- u32 BusAddress; -- /*DW4*/ -- u32 Value; --#endif --}; -- --/* -- * Below is the data structure used by _io_handler -- */ -- --struct io_queue { -- spinlock_t lock; -- struct list_head free_ioreqs; -- /*The io_req list that will be served in the single protocol r/w.*/ -- struct list_head pending; -- struct list_head processing; -- u8 *free_ioreqs_buf; /* 4-byte aligned */ -- u8 *pallocated_free_ioreqs_buf; -- struct intf_hdl intf; --}; -- --u8 r8712_read8(struct _adapter *adapter, u32 addr); --u16 r8712_read16(struct _adapter *adapter, u32 addr); --u32 r8712_read32(struct _adapter *adapter, u32 addr); --void r8712_read_mem(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem); --void r8712_read_port(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem); --void r8712_write8(struct _adapter *adapter, u32 addr, u8 val); --void r8712_write16(struct _adapter *adapter, u32 addr, u16 val); --void r8712_write32(struct _adapter *adapter, u32 addr, u32 val); --void r8712_write_mem(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem); --void r8712_write_port(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem); --/*ioreq */ --uint r8712_alloc_io_queue(struct _adapter *adapter); --void r8712_free_io_queue(struct _adapter *adapter); -- --#endif /*_RTL871X_IO_H_*/ -diff --git a/drivers/staging/rtl8712/rtl871x_ioctl.h b/drivers/staging/rtl8712/rtl871x_ioctl.h -deleted file mode 100644 -index d6332a8c7f4f71..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_ioctl.h -+++ /dev/null -@@ -1,94 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --#ifndef __IOCTL_H --#define __IOCTL_H -- --#include "osdep_service.h" --#include "drv_types.h" -- --#ifndef OID_802_11_CAPABILITY -- #define OID_802_11_CAPABILITY 0x0d010122 --#endif -- --#ifndef OID_802_11_PMKID -- #define OID_802_11_PMKID 0x0d010123 --#endif -- --/* For DDK-defined OIDs*/ --#define OID_NDIS_SEG1 0x00010100 --#define OID_NDIS_SEG2 0x00010200 --#define OID_NDIS_SEG3 0x00020100 --#define OID_NDIS_SEG4 0x01010100 --#define OID_NDIS_SEG5 0x01020100 --#define OID_NDIS_SEG6 0x01020200 --#define OID_NDIS_SEG7 0xFD010100 --#define OID_NDIS_SEG8 0x0D010100 --#define OID_NDIS_SEG9 0x0D010200 --#define OID_NDIS_SEG10 0x0D020200 --#define SZ_OID_NDIS_SEG1 23 --#define SZ_OID_NDIS_SEG2 3 --#define SZ_OID_NDIS_SEG3 6 --#define SZ_OID_NDIS_SEG4 6 --#define SZ_OID_NDIS_SEG5 4 --#define SZ_OID_NDIS_SEG6 8 --#define SZ_OID_NDIS_SEG7 7 --#define SZ_OID_NDIS_SEG8 36 --#define SZ_OID_NDIS_SEG9 24 --#define SZ_OID_NDIS_SEG10 19 -- --/* For Realtek-defined OIDs*/ --#define OID_MP_SEG1 0xFF871100 --#define OID_MP_SEG2 0xFF818000 --#define OID_MP_SEG3 0xFF818700 --#define OID_MP_SEG4 0xFF011100 -- --enum oid_type { -- QUERY_OID, -- SET_OID --}; -- --struct oid_funs_node { -- unsigned int oid_start; /*the starting number for OID*/ -- unsigned int oid_end; /*the ending number for OID*/ -- struct oid_obj_priv *node_array; -- unsigned int array_sz; /*the size of node_array*/ -- int query_counter; /*count the number of query hits for this segment*/ -- int set_counter; /*count the number of set hits for this segment*/ --}; -- --struct oid_par_priv { -- void *adapter_context; -- uint oid; -- void *information_buf; -- unsigned long information_buf_len; -- unsigned long *bytes_rw; -- unsigned long *bytes_needed; -- enum oid_type type_of_oid; -- unsigned int dbg; --}; -- --struct oid_obj_priv { -- unsigned char dbg; /* 0: without OID debug message -- * 1: with OID debug message -- */ -- uint (*oidfuns)(struct oid_par_priv *poid_par_priv); --}; -- --uint oid_null_function(struct oid_par_priv *poid_par_priv); -- --extern struct iw_handler_def r871x_handlers_def; -- --uint drv_query_info(struct net_device *MiniportAdapterContext, -- uint Oid, -- void *InformationBuffer, -- u32 InformationBufferLength, -- u32 *BytesWritten, -- u32 *BytesNeeded); -- --uint drv_set_info(struct net_device *MiniportAdapterContext, -- uint Oid, -- void *InformationBuffer, -- u32 InformationBufferLength, -- u32 *BytesRead, -- u32 *BytesNeeded); -- --#endif -diff --git a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c -deleted file mode 100644 -index 36f6904d25abc3..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c -+++ /dev/null -@@ -1,2330 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * rtl871x_ioctl_linux.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _RTL871X_IOCTL_LINUX_C_ --#define _RTL871X_MP_IOCTL_C_ -- --#include "osdep_service.h" --#include "drv_types.h" --#include "wlan_bssdef.h" --#include "rtl871x_debug.h" --#include "wifi.h" --#include "rtl871x_mlme.h" --#include "rtl871x_ioctl.h" --#include "rtl871x_ioctl_set.h" --#include "rtl871x_mp_ioctl.h" --#include "mlme_osdep.h" --#include --#include --#include --#include --#include --#include --#include --#include -- --#define RTL_IOCTL_WPA_SUPPLICANT (SIOCIWFIRSTPRIV + 0x1E) -- --#define SCAN_ITEM_SIZE 768 --#define MAX_CUSTOM_LEN 64 --#define RATE_COUNT 4 -- --static const u32 rtl8180_rates[] = {1000000, 2000000, 5500000, 11000000, -- 6000000, 9000000, 12000000, 18000000, -- 24000000, 36000000, 48000000, 54000000}; -- --static const long ieee80211_wlan_frequencies[] = { -- 2412, 2417, 2422, 2427, -- 2432, 2437, 2442, 2447, -- 2452, 2457, 2462, 2467, -- 2472, 2484 --}; -- --void r8712_indicate_wx_assoc_event(struct _adapter *padapter) --{ -- union iwreq_data wrqu; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- -- wrqu.ap_addr.sa_family = ARPHRD_ETHER; -- memcpy(wrqu.ap_addr.sa_data, pmlmepriv->cur_network.network.MacAddress, -- ETH_ALEN); -- wireless_send_event(padapter->pnetdev, SIOCGIWAP, &wrqu, NULL); --} -- --void r8712_indicate_wx_disassoc_event(struct _adapter *padapter) --{ -- union iwreq_data wrqu; -- -- wrqu.ap_addr.sa_family = ARPHRD_ETHER; -- eth_zero_addr(wrqu.ap_addr.sa_data); -- wireless_send_event(padapter->pnetdev, SIOCGIWAP, &wrqu, NULL); --} -- --static inline void handle_pairwise_key(struct sta_info *psta, -- struct ieee_param *param, -- struct _adapter *padapter) --{ -- /* pairwise key */ -- memcpy(psta->x_UncstKey.skey, param->u.crypt.key, -- (param->u.crypt. key_len > 16 ? 16 : param->u.crypt.key_len)); -- if (strcmp(param->u.crypt.alg, "TKIP") == 0) { /* set mic key */ -- memcpy(psta->tkiptxmickey. skey, -- ¶m->u.crypt.key[16], 8); -- memcpy(psta->tkiprxmickey. skey, -- ¶m->u.crypt.key[24], 8); -- padapter->securitypriv. busetkipkey = false; -- mod_timer(&padapter->securitypriv.tkip_timer, -- jiffies + msecs_to_jiffies(50)); -- } -- r8712_setstakey_cmd(padapter, (unsigned char *)psta, true); --} -- --static inline void handle_group_key(struct ieee_param *param, -- struct _adapter *padapter) --{ -- union Keytype *gk = padapter->securitypriv.XGrpKey; -- union Keytype *gtk = padapter->securitypriv.XGrptxmickey; -- union Keytype *grk = padapter->securitypriv.XGrprxmickey; -- -- if (param->u.crypt.idx > 0 && -- param->u.crypt.idx < 3) { -- /* group key idx is 1 or 2 */ -- memcpy(gk[param->u.crypt.idx - 1].skey, -- param->u.crypt.key, -- (param->u.crypt.key_len > 16 ? 16 : -- param->u.crypt.key_len)); -- memcpy(gtk[param->u.crypt.idx - 1].skey, -- ¶m->u.crypt.key[16], 8); -- memcpy(grk[param->u.crypt.idx - 1].skey, -- ¶m->u.crypt.key[24], 8); -- padapter->securitypriv.binstallGrpkey = true; -- r8712_set_key(padapter, &padapter->securitypriv, -- param->u.crypt.idx); -- if (padapter->registrypriv.power_mgnt > PS_MODE_ACTIVE) { -- if (padapter->registrypriv.power_mgnt != -- padapter->pwrctrlpriv.pwr_mode) -- mod_timer(&padapter->mlmepriv.dhcp_timer, -- jiffies + msecs_to_jiffies(60000)); -- } -- } --} -- --static noinline_for_stack char *translate_scan_wpa(struct iw_request_info *info, -- struct wlan_network *pnetwork, -- struct iw_event *iwe, -- char *start, char *stop) --{ -- /* parsing WPA/WPA2 IE */ -- u8 buf[MAX_WPA_IE_LEN]; -- u8 wpa_ie[255], rsn_ie[255]; -- u16 wpa_len = 0, rsn_len = 0; -- int n, i; -- -- r8712_get_sec_ie(pnetwork->network.IEs, -- pnetwork->network.IELength, rsn_ie, &rsn_len, -- wpa_ie, &wpa_len); -- if (wpa_len > 0) { -- memset(buf, 0, MAX_WPA_IE_LEN); -- n = sprintf(buf, "wpa_ie="); -- for (i = 0; i < wpa_len; i++) { -- n += scnprintf(buf + n, MAX_WPA_IE_LEN - n, -- "%02x", wpa_ie[i]); -- if (n == MAX_WPA_IE_LEN - 1) -- break; -- } -- memset(iwe, 0, sizeof(*iwe)); -- iwe->cmd = IWEVCUSTOM; -- iwe->u.data.length = (u16)strlen(buf); -- start = iwe_stream_add_point(info, start, stop, -- iwe, buf); -- memset(iwe, 0, sizeof(*iwe)); -- iwe->cmd = IWEVGENIE; -- iwe->u.data.length = (u16)wpa_len; -- start = iwe_stream_add_point(info, start, stop, -- iwe, wpa_ie); -- } -- if (rsn_len > 0) { -- memset(buf, 0, MAX_WPA_IE_LEN); -- n = sprintf(buf, "rsn_ie="); -- for (i = 0; i < rsn_len; i++) { -- n += scnprintf(buf + n, MAX_WPA_IE_LEN - n, -- "%02x", rsn_ie[i]); -- if (n == MAX_WPA_IE_LEN - 1) -- break; -- } -- memset(iwe, 0, sizeof(*iwe)); -- iwe->cmd = IWEVCUSTOM; -- iwe->u.data.length = strlen(buf); -- start = iwe_stream_add_point(info, start, stop, -- iwe, buf); -- memset(iwe, 0, sizeof(*iwe)); -- iwe->cmd = IWEVGENIE; -- iwe->u.data.length = rsn_len; -- start = iwe_stream_add_point(info, start, stop, iwe, -- rsn_ie); -- } -- -- return start; --} -- --static noinline_for_stack char *translate_scan_wps(struct iw_request_info *info, -- struct wlan_network *pnetwork, -- struct iw_event *iwe, -- char *start, char *stop) --{ -- /* parsing WPS IE */ -- u8 wps_ie[512]; -- uint wps_ielen; -- -- if (r8712_get_wps_ie(pnetwork->network.IEs, -- pnetwork->network.IELength, -- wps_ie, &wps_ielen)) { -- if (wps_ielen > 2) { -- iwe->cmd = IWEVGENIE; -- iwe->u.data.length = (u16)wps_ielen; -- start = iwe_stream_add_point(info, start, stop, -- iwe, wps_ie); -- } -- } -- -- return start; --} -- --static char *translate_scan(struct _adapter *padapter, -- struct iw_request_info *info, -- struct wlan_network *pnetwork, -- char *start, char *stop) --{ -- struct iw_event iwe; -- char *current_val; -- s8 *p; -- u32 i = 0, ht_ielen = 0; -- u16 cap, ht_cap = false; -- u8 rssi; -- -- if ((pnetwork->network.Configuration.DSConfig < 1) || -- (pnetwork->network.Configuration.DSConfig > 14)) { -- if (pnetwork->network.Configuration.DSConfig < 1) -- pnetwork->network.Configuration.DSConfig = 1; -- else -- pnetwork->network.Configuration.DSConfig = 14; -- } -- /* AP MAC address */ -- iwe.cmd = SIOCGIWAP; -- iwe.u.ap_addr.sa_family = ARPHRD_ETHER; -- ether_addr_copy(iwe.u.ap_addr.sa_data, pnetwork->network.MacAddress); -- start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_ADDR_LEN); -- /* Add the ESSID */ -- iwe.cmd = SIOCGIWESSID; -- iwe.u.data.flags = 1; -- iwe.u.data.length = min_t(u32, pnetwork->network.Ssid.SsidLength, 32); -- start = iwe_stream_add_point(info, start, stop, &iwe, -- pnetwork->network.Ssid.Ssid); -- /* parsing HT_CAP_IE */ -- p = r8712_get_ie(&pnetwork->network.IEs[12], WLAN_EID_HT_CAPABILITY, -- &ht_ielen, pnetwork->network.IELength - 12); -- if (p && ht_ielen > 0) -- ht_cap = true; -- /* Add the protocol name */ -- iwe.cmd = SIOCGIWNAME; -- if (r8712_is_cckratesonly_included(pnetwork->network.rates)) { -- if (ht_cap) -- snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11bn"); -- else -- snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11b"); -- } else if (r8712_is_cckrates_included(pnetwork->network.rates)) { -- if (ht_cap) -- snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11bgn"); -- else -- snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11bg"); -- } else { -- if (ht_cap) -- snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11gn"); -- else -- snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11g"); -- } -- start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_CHAR_LEN); -- /* Add mode */ -- iwe.cmd = SIOCGIWMODE; -- memcpy((u8 *)&cap, r8712_get_capability_from_ie(pnetwork->network.IEs), -- 2); -- le16_to_cpus(&cap); -- if (cap & (WLAN_CAPABILITY_IBSS | WLAN_CAPABILITY_ESS)) { -- if (cap & WLAN_CAPABILITY_ESS) -- iwe.u.mode = (u32)IW_MODE_MASTER; -- else -- iwe.u.mode = (u32)IW_MODE_ADHOC; -- start = iwe_stream_add_event(info, start, stop, &iwe, -- IW_EV_UINT_LEN); -- } -- /* Add frequency/channel */ -- iwe.cmd = SIOCGIWFREQ; -- { -- /* check legal index */ -- u8 dsconfig = pnetwork->network.Configuration.DSConfig; -- -- if (dsconfig >= 1 && dsconfig <= sizeof( -- ieee80211_wlan_frequencies) / sizeof(long)) -- iwe.u.freq.m = -- (s32)(ieee80211_wlan_frequencies -- [dsconfig - 1] * 100000); -- else -- iwe.u.freq.m = 0; -- } -- iwe.u.freq.e = (s16)1; -- iwe.u.freq.i = (u8)pnetwork->network.Configuration.DSConfig; -- start = iwe_stream_add_event(info, start, stop, &iwe, -- IW_EV_FREQ_LEN); -- /* Add encryption capability */ -- iwe.cmd = SIOCGIWENCODE; -- if (cap & WLAN_CAPABILITY_PRIVACY) -- iwe.u.data.flags = (u16)(IW_ENCODE_ENABLED | -- IW_ENCODE_NOKEY); -- else -- iwe.u.data.flags = (u16)(IW_ENCODE_DISABLED); -- iwe.u.data.length = (u16)0; -- start = iwe_stream_add_point(info, start, stop, &iwe, -- pnetwork->network.Ssid.Ssid); -- /*Add basic and extended rates */ -- current_val = start + iwe_stream_lcp_len(info); -- iwe.cmd = SIOCGIWRATE; -- iwe.u.bitrate.fixed = 0; -- iwe.u.bitrate.disabled = 0; -- iwe.u.bitrate.value = 0; -- i = 0; -- while (pnetwork->network.rates[i] != 0) { -- /* Bit rate given in 500 kb/s units */ -- iwe.u.bitrate.value = (pnetwork->network.rates[i++] & -- 0x7F) * 500000; -- current_val = iwe_stream_add_value(info, start, current_val, -- stop, &iwe, IW_EV_PARAM_LEN); -- } -- /* Check if we added any event */ -- if ((current_val - start) > iwe_stream_lcp_len(info)) -- start = current_val; -- -- start = translate_scan_wpa(info, pnetwork, &iwe, start, stop); -- -- start = translate_scan_wps(info, pnetwork, &iwe, start, stop); -- -- /* Add quality statistics */ -- iwe.cmd = IWEVQUAL; -- rssi = r8712_signal_scale_mapping(pnetwork->network.Rssi); -- /* we only update signal_level (signal strength) that is rssi. */ -- iwe.u.qual.updated = (u8)(IW_QUAL_QUAL_INVALID | IW_QUAL_LEVEL_UPDATED | -- IW_QUAL_NOISE_INVALID); -- iwe.u.qual.level = rssi; /* signal strength */ -- iwe.u.qual.qual = 0; /* signal quality */ -- iwe.u.qual.noise = 0; /* noise level */ -- start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_QUAL_LEN); -- /* how to translate rssi to ?% */ -- return start; --} -- --static int wpa_set_auth_algs(struct net_device *dev, u32 value) --{ -- struct _adapter *padapter = netdev_priv(dev); -- int ret = 0; -- -- if ((value & AUTH_ALG_SHARED_KEY) && (value & AUTH_ALG_OPEN_SYSTEM)) { -- padapter->securitypriv.ndisencryptstatus = -- Ndis802_11Encryption1Enabled; -- padapter->securitypriv.ndisauthtype = -- Ndis802_11AuthModeAutoSwitch; -- padapter->securitypriv.AuthAlgrthm = 3; -- } else if (value & AUTH_ALG_SHARED_KEY) { -- padapter->securitypriv.ndisencryptstatus = -- Ndis802_11Encryption1Enabled; -- padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeShared; -- padapter->securitypriv.AuthAlgrthm = 1; -- } else if (value & AUTH_ALG_OPEN_SYSTEM) { -- if (padapter->securitypriv.ndisauthtype < -- Ndis802_11AuthModeWPAPSK) { -- padapter->securitypriv.ndisauthtype = -- Ndis802_11AuthModeOpen; -- padapter->securitypriv.AuthAlgrthm = 0; -- } -- } else { -- ret = -EINVAL; -- } -- return ret; --} -- --static int wpa_set_encryption(struct net_device *dev, struct ieee_param *param, -- u32 param_len) --{ -- int ret = 0; -- u32 wep_key_idx, wep_key_len = 0; -- struct NDIS_802_11_WEP *pwep = NULL; -- struct _adapter *padapter = netdev_priv(dev); -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct security_priv *psecuritypriv = &padapter->securitypriv; -- -- param->u.crypt.err = 0; -- param->u.crypt.alg[IEEE_CRYPT_ALG_NAME_LEN - 1] = '\0'; -- if (param_len != (u32)((u8 *) param->u.crypt.key - (u8 *)param) + -- param->u.crypt.key_len) -- return -EINVAL; -- if (!is_broadcast_ether_addr(param->sta_addr)) -- return -EINVAL; -- -- if (param->u.crypt.idx >= WEP_KEYS) { -- /* for large key indices, set the default (0) */ -- param->u.crypt.idx = 0; -- } -- if (strcmp(param->u.crypt.alg, "WEP") == 0) { -- netdev_info(dev, "r8712u: %s: crypt.alg = WEP\n", __func__); -- padapter->securitypriv.ndisencryptstatus = -- Ndis802_11Encryption1Enabled; -- padapter->securitypriv.PrivacyAlgrthm = _WEP40_; -- padapter->securitypriv.XGrpPrivacy = _WEP40_; -- wep_key_idx = param->u.crypt.idx; -- wep_key_len = param->u.crypt.key_len; -- if (wep_key_idx >= WEP_KEYS) -- wep_key_idx = 0; -- if (wep_key_len <= 0) -- return -EINVAL; -- -- wep_key_len = wep_key_len <= 5 ? 5 : 13; -- pwep = kzalloc(sizeof(*pwep), GFP_ATOMIC); -- if (!pwep) -- return -ENOMEM; -- pwep->KeyLength = wep_key_len; -- pwep->Length = wep_key_len + -- offsetof(struct NDIS_802_11_WEP, KeyMaterial); -- if (wep_key_len == 13) { -- padapter->securitypriv.PrivacyAlgrthm = _WEP104_; -- padapter->securitypriv.XGrpPrivacy = _WEP104_; -- } -- pwep->KeyIndex = wep_key_idx; -- pwep->KeyIndex |= 0x80000000; -- memcpy(pwep->KeyMaterial, param->u.crypt.key, pwep->KeyLength); -- if (param->u.crypt.set_tx) { -- if (r8712_set_802_11_add_wep(padapter, pwep)) -- ret = -EOPNOTSUPP; -- } else { -- /* don't update "psecuritypriv->PrivacyAlgrthm" and -- * "psecuritypriv->PrivacyKeyIndex=keyid", but can -- * r8712_set_key to fw/cam -- */ -- if (wep_key_idx >= WEP_KEYS) { -- ret = -EOPNOTSUPP; -- goto exit; -- } -- memcpy(&psecuritypriv->DefKey[wep_key_idx].skey[0], -- pwep->KeyMaterial, -- pwep->KeyLength); -- psecuritypriv->DefKeylen[wep_key_idx] = -- pwep->KeyLength; -- r8712_set_key(padapter, psecuritypriv, wep_key_idx); -- } -- goto exit; -- } -- if (padapter->securitypriv.AuthAlgrthm == 2) { /* 802_1x */ -- struct sta_info *psta, *pbcmc_sta; -- struct sta_priv *pstapriv = &padapter->stapriv; -- struct security_priv *spriv = &padapter->securitypriv; -- -- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE | -- WIFI_MP_STATE)) { /* sta mode */ -- psta = r8712_get_stainfo(pstapriv, -- get_bssid(pmlmepriv)); -- if (psta) { -- psta->ieee8021x_blocked = false; -- if (spriv->ndisencryptstatus == -- Ndis802_11Encryption2Enabled || -- spriv->ndisencryptstatus == -- Ndis802_11Encryption3Enabled) -- psta->XPrivacy = spriv->PrivacyAlgrthm; -- if (param->u.crypt.set_tx == 1) -- handle_pairwise_key(psta, param, -- padapter); -- else /* group key */ -- handle_group_key(param, padapter); -- } -- pbcmc_sta = r8712_get_bcmc_stainfo(padapter); -- if (pbcmc_sta) { -- pbcmc_sta->ieee8021x_blocked = false; -- if (spriv->ndisencryptstatus == -- Ndis802_11Encryption2Enabled || -- spriv->ndisencryptstatus == -- Ndis802_11Encryption3Enabled) -- pbcmc_sta->XPrivacy = -- spriv->PrivacyAlgrthm; -- } -- } -- } --exit: -- kfree(pwep); -- return ret; --} -- --static int r871x_set_wpa_ie(struct _adapter *padapter, char *pie, -- unsigned short ielen) --{ -- u8 *buf = NULL; -- int group_cipher = 0, pairwise_cipher = 0; -- int ret = 0; -- -- if (ielen > MAX_WPA_IE_LEN || !pie) -- return -EINVAL; -- if (ielen) { -- buf = kmemdup(pie, ielen, GFP_ATOMIC); -- if (!buf) -- return -ENOMEM; -- if (ielen < RSN_HEADER_LEN) { -- ret = -EINVAL; -- goto exit; -- } -- if (r8712_parse_wpa_ie(buf, ielen, &group_cipher, -- &pairwise_cipher) == 0) { -- padapter->securitypriv.AuthAlgrthm = 2; -- padapter->securitypriv.ndisauthtype = -- Ndis802_11AuthModeWPAPSK; -- } -- if (r8712_parse_wpa2_ie(buf, ielen, &group_cipher, -- &pairwise_cipher) == 0) { -- padapter->securitypriv.AuthAlgrthm = 2; -- padapter->securitypriv.ndisauthtype = -- Ndis802_11AuthModeWPA2PSK; -- } -- switch (group_cipher) { -- case WPA_CIPHER_NONE: -- padapter->securitypriv.XGrpPrivacy = -- _NO_PRIVACY_; -- padapter->securitypriv.ndisencryptstatus = -- Ndis802_11EncryptionDisabled; -- break; -- case WPA_CIPHER_WEP40: -- padapter->securitypriv.XGrpPrivacy = _WEP40_; -- padapter->securitypriv.ndisencryptstatus = -- Ndis802_11Encryption1Enabled; -- break; -- case WPA_CIPHER_TKIP: -- padapter->securitypriv.XGrpPrivacy = _TKIP_; -- padapter->securitypriv.ndisencryptstatus = -- Ndis802_11Encryption2Enabled; -- break; -- case WPA_CIPHER_CCMP: -- padapter->securitypriv.XGrpPrivacy = _AES_; -- padapter->securitypriv.ndisencryptstatus = -- Ndis802_11Encryption3Enabled; -- break; -- case WPA_CIPHER_WEP104: -- padapter->securitypriv.XGrpPrivacy = _WEP104_; -- padapter->securitypriv.ndisencryptstatus = -- Ndis802_11Encryption1Enabled; -- break; -- } -- switch (pairwise_cipher) { -- case WPA_CIPHER_NONE: -- padapter->securitypriv.PrivacyAlgrthm = -- _NO_PRIVACY_; -- padapter->securitypriv.ndisencryptstatus = -- Ndis802_11EncryptionDisabled; -- break; -- case WPA_CIPHER_WEP40: -- padapter->securitypriv.PrivacyAlgrthm = _WEP40_; -- padapter->securitypriv.ndisencryptstatus = -- Ndis802_11Encryption1Enabled; -- break; -- case WPA_CIPHER_TKIP: -- padapter->securitypriv.PrivacyAlgrthm = _TKIP_; -- padapter->securitypriv.ndisencryptstatus = -- Ndis802_11Encryption2Enabled; -- break; -- case WPA_CIPHER_CCMP: -- padapter->securitypriv.PrivacyAlgrthm = _AES_; -- padapter->securitypriv.ndisencryptstatus = -- Ndis802_11Encryption3Enabled; -- break; -- case WPA_CIPHER_WEP104: -- padapter->securitypriv.PrivacyAlgrthm = _WEP104_; -- padapter->securitypriv.ndisencryptstatus = -- Ndis802_11Encryption1Enabled; -- break; -- } -- padapter->securitypriv.wps_phase = false; -- {/* set wps_ie */ -- u16 cnt = 0; -- u8 eid, wps_oui[4] = {0x0, 0x50, 0xf2, 0x04}; -- -- while (cnt < ielen) { -- eid = buf[cnt]; -- -- if ((eid == WLAN_EID_VENDOR_SPECIFIC) && -- (!memcmp(&buf[cnt + 2], wps_oui, 4))) { -- netdev_info(padapter->pnetdev, "r8712u: SET WPS_IE\n"); -- padapter->securitypriv.wps_ie_len = -- ((buf[cnt + 1] + 2) < -- (MAX_WPA_IE_LEN << 2)) ? -- (buf[cnt + 1] + 2) : -- (MAX_WPA_IE_LEN << 2); -- memcpy(padapter->securitypriv.wps_ie, -- &buf[cnt], -- padapter->securitypriv.wps_ie_len); -- padapter->securitypriv.wps_phase = -- true; -- netdev_info(padapter->pnetdev, "r8712u: SET WPS_IE, wps_phase==true\n"); -- cnt += buf[cnt + 1] + 2; -- break; -- } -- -- cnt += buf[cnt + 1] + 2; -- } -- } -- } --exit: -- kfree(buf); -- return ret; --} -- --static int r8711_wx_get_name(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- struct _adapter *padapter = netdev_priv(dev); -- u32 ht_ielen = 0; -- char *p; -- u8 ht_cap = false; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct wlan_bssid_ex *pcur_bss = &pmlmepriv->cur_network.network; -- u8 *prates; -- -- if (check_fwstate(pmlmepriv, _FW_LINKED | WIFI_ADHOC_MASTER_STATE) == -- true) { -- /* parsing HT_CAP_IE */ -- p = r8712_get_ie(&pcur_bss->IEs[12], WLAN_EID_HT_CAPABILITY, -- &ht_ielen, pcur_bss->IELength - 12); -- if (p && ht_ielen > 0) -- ht_cap = true; -- prates = pcur_bss->rates; -- if (r8712_is_cckratesonly_included(prates)) { -- if (ht_cap) -- snprintf(wrqu->name, IFNAMSIZ, -- "IEEE 802.11bn"); -- else -- snprintf(wrqu->name, IFNAMSIZ, -- "IEEE 802.11b"); -- } else if (r8712_is_cckrates_included(prates)) { -- if (ht_cap) -- snprintf(wrqu->name, IFNAMSIZ, -- "IEEE 802.11bgn"); -- else -- snprintf(wrqu->name, IFNAMSIZ, -- "IEEE 802.11bg"); -- } else { -- if (ht_cap) -- snprintf(wrqu->name, IFNAMSIZ, -- "IEEE 802.11gn"); -- else -- snprintf(wrqu->name, IFNAMSIZ, -- "IEEE 802.11g"); -- } -- } else { -- snprintf(wrqu->name, IFNAMSIZ, "unassociated"); -- } -- return 0; --} -- --static const long frequency_list[] = { -- 2412, 2417, 2422, 2427, 2432, 2437, 2442, 2447, 2452, 2457, 2462, -- 2467, 2472, 2484, 4915, 4920, 4925, 4935, 4940, 4945, 4960, 4980, -- 5035, 5040, 5045, 5055, 5060, 5080, 5170, 5180, 5190, 5200, 5210, -- 5220, 5230, 5240, 5260, 5280, 5300, 5320, 5500, 5520, 5540, 5560, -- 5580, 5600, 5620, 5640, 5660, 5680, 5700, 5745, 5765, 5785, 5805, -- 5825 --}; -- --static int r8711_wx_set_freq(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- struct _adapter *padapter = netdev_priv(dev); -- struct iw_freq *fwrq = &wrqu->freq; -- int rc = 0; -- --/* If setting by frequency, convert to a channel */ -- if ((fwrq->e == 1) && -- (fwrq->m >= 241200000) && -- (fwrq->m <= 248700000)) { -- int f = fwrq->m / 100000; -- int c = 0; -- -- while ((c < 14) && (f != frequency_list[c])) -- c++; -- fwrq->e = 0; -- fwrq->m = c + 1; -- } -- /* Setting by channel number */ -- if ((fwrq->m > 14) || (fwrq->e > 0)) { -- rc = -EOPNOTSUPP; -- } else { -- int channel = fwrq->m; -- -- if ((channel < 1) || (channel > 14)) { -- rc = -EINVAL; -- } else { -- /* Yes ! We can set it !!! */ -- padapter->registrypriv.channel = channel; -- } -- } -- return rc; --} -- --static int r8711_wx_get_freq(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- struct _adapter *padapter = netdev_priv(dev); -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct wlan_bssid_ex *pcur_bss = &pmlmepriv->cur_network.network; -- -- if (!check_fwstate(pmlmepriv, _FW_LINKED)) -- return -ENOLINK; -- -- wrqu->freq.m = ieee80211_wlan_frequencies[ -- pcur_bss->Configuration.DSConfig - 1] * 100000; -- wrqu->freq.e = 1; -- wrqu->freq.i = pcur_bss->Configuration.DSConfig; -- -- return 0; --} -- --static int r8711_wx_set_mode(struct net_device *dev, -- struct iw_request_info *a, -- union iwreq_data *wrqu, char *b) --{ -- struct _adapter *padapter = netdev_priv(dev); -- enum NDIS_802_11_NETWORK_INFRASTRUCTURE networkType; -- -- switch (wrqu->mode) { -- case IW_MODE_AUTO: -- networkType = Ndis802_11AutoUnknown; -- break; -- case IW_MODE_ADHOC: -- networkType = Ndis802_11IBSS; -- break; -- case IW_MODE_MASTER: -- networkType = Ndis802_11APMode; -- break; -- case IW_MODE_INFRA: -- networkType = Ndis802_11Infrastructure; -- break; -- default: -- return -EINVAL; -- } -- if (Ndis802_11APMode == networkType) -- r8712_setopmode_cmd(padapter, networkType); -- else -- r8712_setopmode_cmd(padapter, Ndis802_11AutoUnknown); -- -- r8712_set_802_11_infrastructure_mode(padapter, networkType); -- return 0; --} -- --static int r8711_wx_get_mode(struct net_device *dev, struct iw_request_info *a, -- union iwreq_data *wrqu, char *b) --{ -- struct _adapter *padapter = netdev_priv(dev); -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- -- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) -- wrqu->mode = IW_MODE_INFRA; -- else if (check_fwstate(pmlmepriv, -- WIFI_ADHOC_MASTER_STATE | WIFI_ADHOC_STATE)) -- wrqu->mode = IW_MODE_ADHOC; -- else if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) -- wrqu->mode = IW_MODE_MASTER; -- else -- wrqu->mode = IW_MODE_AUTO; -- return 0; --} -- --static int r871x_wx_set_pmkid(struct net_device *dev, -- struct iw_request_info *a, -- union iwreq_data *wrqu, char *extra) --{ -- struct _adapter *padapter = netdev_priv(dev); -- struct security_priv *psecuritypriv = &padapter->securitypriv; -- struct iw_pmksa *pPMK = (struct iw_pmksa *) extra; -- struct RT_PMKID_LIST *pl = psecuritypriv->PMKIDList; -- u8 strZeroMacAddress[ETH_ALEN] = {0x00}; -- u8 strIssueBssid[ETH_ALEN] = {0x00}; -- u8 j, blInserted = false; -- int intReturn = false; -- --/* -- * There are the BSSID information in the bssid.sa_data array. -- * If cmd is IW_PMKSA_FLUSH, it means the wpa_supplicant wants to clear -- * all the PMKID information. If cmd is IW_PMKSA_ADD, it means the -- * wpa_supplicant wants to add a PMKID/BSSID to driver. -- * If cmd is IW_PMKSA_REMOVE, it means the wpa_supplicant wants to -- * remove a PMKID/BSSID from driver. -- */ -- if (!pPMK) -- return -EINVAL; -- memcpy(strIssueBssid, pPMK->bssid.sa_data, ETH_ALEN); -- switch (pPMK->cmd) { -- case IW_PMKSA_ADD: -- if (!memcmp(strIssueBssid, strZeroMacAddress, ETH_ALEN)) -- return intReturn; -- intReturn = true; -- blInserted = false; -- /* overwrite PMKID */ -- for (j = 0; j < NUM_PMKID_CACHE; j++) { -- if (!memcmp(pl[j].Bssid, strIssueBssid, ETH_ALEN)) { -- /* BSSID is matched, the same AP => rewrite -- * with new PMKID. -- */ -- netdev_info(dev, "r8712u: %s: BSSID exists in the PMKList.\n", -- __func__); -- memcpy(pl[j].PMKID, pPMK->pmkid, IW_PMKID_LEN); -- pl[j].bUsed = true; -- psecuritypriv->PMKIDIndex = j + 1; -- blInserted = true; -- break; -- } -- } -- if (!blInserted) { -- /* Find a new entry */ -- netdev_info(dev, "r8712u: %s: Use the new entry index = %d for this PMKID.\n", -- __func__, psecuritypriv->PMKIDIndex); -- memcpy(pl[psecuritypriv->PMKIDIndex].Bssid, -- strIssueBssid, ETH_ALEN); -- memcpy(pl[psecuritypriv->PMKIDIndex].PMKID, -- pPMK->pmkid, IW_PMKID_LEN); -- pl[psecuritypriv->PMKIDIndex].bUsed = true; -- psecuritypriv->PMKIDIndex++; -- if (psecuritypriv->PMKIDIndex == NUM_PMKID_CACHE) -- psecuritypriv->PMKIDIndex = 0; -- } -- break; -- case IW_PMKSA_REMOVE: -- intReturn = true; -- for (j = 0; j < NUM_PMKID_CACHE; j++) { -- if (!memcmp(pl[j].Bssid, strIssueBssid, ETH_ALEN)) { -- /* BSSID is matched, the same AP => Remove -- * this PMKID information and reset it. -- */ -- eth_zero_addr(pl[j].Bssid); -- pl[j].bUsed = false; -- break; -- } -- } -- break; -- case IW_PMKSA_FLUSH: -- memset(psecuritypriv->PMKIDList, 0, -- sizeof(struct RT_PMKID_LIST) * NUM_PMKID_CACHE); -- psecuritypriv->PMKIDIndex = 0; -- intReturn = true; -- break; -- default: -- netdev_info(dev, "r8712u: %s: unknown Command\n", __func__); -- intReturn = false; -- break; -- } -- return intReturn; --} -- --static int r8711_wx_get_sens(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- wrqu->sens.value = 0; -- wrqu->sens.fixed = 0; /* no auto select */ -- wrqu->sens.disabled = 1; -- return 0; --} -- --static int r8711_wx_get_range(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- struct iw_range *range = (struct iw_range *)extra; -- u16 val; -- int i; -- -- wrqu->data.length = sizeof(*range); -- memset(range, 0, sizeof(*range)); -- /* Let's try to keep this struct in the same order as in -- * linux/include/wireless.h -- */ -- -- /* TODO: See what values we can set, and remove the ones we can't -- * set, or fill them with some default data. -- */ -- /* ~5 Mb/s real (802.11b) */ -- range->throughput = 5 * 1000 * 1000; -- /* TODO: 8711 sensitivity ? */ -- /* signal level threshold range */ -- /* percent values between 0 and 100. */ -- range->max_qual.qual = 100; -- range->max_qual.level = 100; -- range->max_qual.noise = 100; -- range->max_qual.updated = 7; /* Updated all three */ -- range->avg_qual.qual = 92; /* > 8% missed beacons is 'bad' */ -- /* TODO: Find real 'good' to 'bad' threshold value for RSSI */ -- range->avg_qual.level = 0x100 - 78; -- range->avg_qual.noise = 0; -- range->avg_qual.updated = 7; /* Updated all three */ -- range->num_bitrates = RATE_COUNT; -- for (i = 0; i < RATE_COUNT && i < IW_MAX_BITRATES; i++) -- range->bitrate[i] = rtl8180_rates[i]; -- range->min_frag = MIN_FRAG_THRESHOLD; -- range->max_frag = MAX_FRAG_THRESHOLD; -- range->pm_capa = 0; -- range->we_version_compiled = WIRELESS_EXT; -- range->we_version_source = 16; -- range->num_channels = 14; -- for (i = 0, val = 0; i < 14; i++) { -- /* Include only legal frequencies for some countries */ -- range->freq[val].i = i + 1; -- range->freq[val].m = ieee80211_wlan_frequencies[i] * 100000; -- range->freq[val].e = 1; -- val++; -- if (val == IW_MAX_FREQUENCIES) -- break; -- } -- range->num_frequency = val; -- range->enc_capa = IW_ENC_CAPA_WPA | -- IW_ENC_CAPA_WPA2 | -- IW_ENC_CAPA_CIPHER_TKIP | -- IW_ENC_CAPA_CIPHER_CCMP; -- return 0; --} -- --static int r8711_wx_get_rate(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra); -- --static int r871x_wx_set_priv(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *awrq, -- char *extra) --{ -- int ret = 0, len = 0; -- char *ext; -- struct _adapter *padapter = netdev_priv(dev); -- struct iw_point *dwrq = (struct iw_point *)awrq; -- -- len = dwrq->length; -- ext = strndup_user(dwrq->pointer, len); -- if (IS_ERR(ext)) -- return PTR_ERR(ext); -- -- if (!strcasecmp(ext, "RSSI")) { -- /*Return received signal strength indicator in -db for */ -- /* current AP */ -- /* Rssi xx */ -- struct mlme_priv *pmlmepriv = &(padapter->mlmepriv); -- struct wlan_network *pcur_network = &pmlmepriv->cur_network; -- /*static u8 xxxx; */ -- if (check_fwstate(pmlmepriv, _FW_LINKED)) { -- sprintf(ext, "%s rssi %d", -- pcur_network->network.Ssid.Ssid, -- /*(xxxx=xxxx+10) */ -- ((padapter->recvpriv.fw_rssi) >> 1) - 95 -- /*pcur_network->network.Rssi */ -- ); -- } else { -- sprintf(ext, "OK"); -- } -- } else if (!strcasecmp(ext, "LINKSPEED")) { -- /*Return link speed in MBPS */ -- /*LinkSpeed xx */ -- union iwreq_data wrqd; -- int ret_inner; -- int mbps; -- -- ret_inner = r8711_wx_get_rate(dev, info, &wrqd, extra); -- if (ret_inner != 0) -- mbps = 0; -- else -- mbps = wrqd.bitrate.value / 1000000; -- sprintf(ext, "LINKSPEED %d", mbps); -- } else if (!strcasecmp(ext, "MACADDR")) { -- /*Return mac address of the station */ -- /* Macaddr = xx:xx:xx:xx:xx:xx */ -- sprintf(ext, "MACADDR = %pM", dev->dev_addr); -- } else if (!strcasecmp(ext, "SCAN-ACTIVE")) { -- /*Set scan type to active */ -- /*OK if successful */ -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- -- pmlmepriv->passive_mode = 1; -- sprintf(ext, "OK"); -- } else if (!strcasecmp(ext, "SCAN-PASSIVE")) { -- /*Set scan type to passive */ -- /*OK if successful */ -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- -- pmlmepriv->passive_mode = 0; -- sprintf(ext, "OK"); -- } else if (!strncmp(ext, "DCE-E", 5)) { -- /*Set scan type to passive */ -- /*OK if successful */ -- r8712_disconnectCtrlEx_cmd(padapter -- , 1 /*u32 enableDrvCtrl */ -- , 5 /*u32 tryPktCnt */ -- , 100 /*u32 tryPktInterval */ -- , 5000 /*u32 firstStageTO */ -- ); -- sprintf(ext, "OK"); -- } else if (!strncmp(ext, "DCE-D", 5)) { -- /*Set scan type to passive */ -- /*OK if successfu */ -- r8712_disconnectCtrlEx_cmd(padapter -- , 0 /*u32 enableDrvCtrl */ -- , 5 /*u32 tryPktCnt */ -- , 100 /*u32 tryPktInterval */ -- , 5000 /*u32 firstStageTO */ -- ); -- sprintf(ext, "OK"); -- } else { -- netdev_info(dev, "r8712u: %s: unknown Command %s.\n", -- __func__, ext); -- goto FREE_EXT; -- } -- if (copy_to_user(dwrq->pointer, ext, -- min(dwrq->length, (__u16)(strlen(ext) + 1)))) -- ret = -EFAULT; -- --FREE_EXT: -- kfree(ext); -- return ret; --} -- --/* set bssid flow -- * s1. set_802_11_infrastructure_mode() -- * s2. set_802_11_authentication_mode() -- * s3. set_802_11_encryption_mode() -- * s4. set_802_11_bssid() -- * -- * This function intends to handle the Set AP command, which specifies the -- * MAC# of a preferred Access Point. -- * Currently, the request comes via Wireless Extensions' SIOCSIWAP ioctl. -- * -- * For this operation to succeed, there is no need for the interface to be up. -- * -- */ --static int r8711_wx_set_wap(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *awrq, -- char *extra) --{ -- int ret = -EINPROGRESS; -- struct _adapter *padapter = netdev_priv(dev); -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct __queue *queue = &pmlmepriv->scanned_queue; -- struct sockaddr *temp = (struct sockaddr *)awrq; -- unsigned long irqL; -- struct list_head *phead; -- u8 *dst_bssid; -- struct wlan_network *pnetwork = NULL; -- enum NDIS_802_11_AUTHENTICATION_MODE authmode; -- -- if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY)) -- return -EBUSY; -- if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) -- return ret; -- if (temp->sa_family != ARPHRD_ETHER) -- return -EINVAL; -- authmode = padapter->securitypriv.ndisauthtype; -- spin_lock_irqsave(&queue->lock, irqL); -- phead = &queue->queue; -- pmlmepriv->pscanned = phead->next; -- while (1) { -- if (end_of_queue_search(phead, pmlmepriv->pscanned)) -- break; -- pnetwork = container_of(pmlmepriv->pscanned, -- struct wlan_network, list); -- pmlmepriv->pscanned = pmlmepriv->pscanned->next; -- dst_bssid = pnetwork->network.MacAddress; -- if (!memcmp(dst_bssid, temp->sa_data, ETH_ALEN)) { -- r8712_set_802_11_infrastructure_mode(padapter, -- pnetwork->network.InfrastructureMode); -- break; -- } -- } -- spin_unlock_irqrestore(&queue->lock, irqL); -- if (!ret) { -- if (!r8712_set_802_11_authentication_mode(padapter, authmode)) { -- ret = -ENOMEM; -- } else { -- if (!r8712_set_802_11_bssid(padapter, temp->sa_data)) -- ret = -1; -- } -- } -- return ret; --} -- --static int r8711_wx_get_wap(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- struct _adapter *padapter = netdev_priv(dev); -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct wlan_bssid_ex *pcur_bss = &pmlmepriv->cur_network.network; -- -- wrqu->ap_addr.sa_family = ARPHRD_ETHER; -- if (check_fwstate(pmlmepriv, _FW_LINKED | WIFI_ADHOC_MASTER_STATE | -- WIFI_AP_STATE)) -- ether_addr_copy(wrqu->ap_addr.sa_data, pcur_bss->MacAddress); -- else -- eth_zero_addr(wrqu->ap_addr.sa_data); -- return 0; --} -- --static int r871x_wx_set_mlme(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- int ret = 0; -- struct _adapter *padapter = netdev_priv(dev); -- struct iw_mlme *mlme = (struct iw_mlme *) extra; -- -- if (!mlme) -- return -1; -- switch (mlme->cmd) { -- case IW_MLME_DEAUTH: -- if (!r8712_set_802_11_disassociate(padapter)) -- ret = -1; -- break; -- case IW_MLME_DISASSOC: -- if (!r8712_set_802_11_disassociate(padapter)) -- ret = -1; -- break; -- default: -- return -EOPNOTSUPP; -- } -- return ret; --} -- --/* -- * -- * This function intends to handle the Set Scan command. -- * Currently, the request comes via Wireless Extensions' SIOCSIWSCAN ioctl. -- * -- * For this operation to succeed, the interface is brought Up beforehand. -- * -- */ --static int r8711_wx_set_scan(struct net_device *dev, -- struct iw_request_info *a, -- union iwreq_data *wrqu, char *extra) --{ -- struct _adapter *padapter = netdev_priv(dev); -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- u8 status = true; -- -- if (padapter->driver_stopped) { -- netdev_info(dev, "In %s: driver_stopped=%d\n", -- __func__, padapter->driver_stopped); -- return -1; -- } -- if (!padapter->bup) -- return -ENETDOWN; -- if (!padapter->hw_init_completed) -- return -1; -- if ((check_fwstate(pmlmepriv, _FW_UNDER_SURVEY | _FW_UNDER_LINKING)) || -- (pmlmepriv->sitesurveyctrl.traffic_busy)) -- return 0; -- if (wrqu->data.length == sizeof(struct iw_scan_req)) { -- struct iw_scan_req *req = (struct iw_scan_req *)extra; -- -- if (wrqu->data.flags & IW_SCAN_THIS_ESSID) { -- struct ndis_802_11_ssid ssid; -- unsigned long irqL; -- u32 len = min_t(u8, req->essid_len, IW_ESSID_MAX_SIZE); -- -- memset((unsigned char *)&ssid, 0, -- sizeof(struct ndis_802_11_ssid)); -- memcpy(ssid.Ssid, req->essid, len); -- ssid.SsidLength = len; -- spin_lock_irqsave(&pmlmepriv->lock, irqL); -- if ((check_fwstate(pmlmepriv, _FW_UNDER_SURVEY | -- _FW_UNDER_LINKING)) || -- (pmlmepriv->sitesurveyctrl.traffic_busy)) { -- if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) -- status = false; -- } else { -- status = r8712_sitesurvey_cmd(padapter, &ssid); -- } -- spin_unlock_irqrestore(&pmlmepriv->lock, irqL); -- } -- } else { -- status = r8712_set_802_11_bssid_list_scan(padapter); -- } -- if (!status) -- return -1; -- return 0; --} -- --static int r8711_wx_get_scan(struct net_device *dev, -- struct iw_request_info *a, -- union iwreq_data *wrqu, char *extra) --{ -- struct _adapter *padapter = netdev_priv(dev); -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct __queue *queue = &pmlmepriv->scanned_queue; -- struct wlan_network *pnetwork = NULL; -- unsigned long irqL; -- struct list_head *plist, *phead; -- char *ev = extra; -- char *stop = ev + wrqu->data.length; -- u32 ret = 0, cnt = 0; -- -- if (padapter->driver_stopped) -- return -EINVAL; -- while (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY | -- _FW_UNDER_LINKING)) { -- msleep(30); -- cnt++; -- if (cnt > 100) -- break; -- } -- spin_lock_irqsave(&queue->lock, irqL); -- phead = &queue->queue; -- plist = phead->next; -- while (1) { -- if (end_of_queue_search(phead, plist)) -- break; -- if ((stop - ev) < SCAN_ITEM_SIZE) { -- ret = -E2BIG; -- break; -- } -- pnetwork = container_of(plist, struct wlan_network, list); -- ev = translate_scan(padapter, a, pnetwork, ev, stop); -- plist = plist->next; -- } -- spin_unlock_irqrestore(&queue->lock, irqL); -- wrqu->data.length = ev - extra; -- wrqu->data.flags = 0; -- return ret; --} -- --/* set ssid flow -- * s1. set_802_11_infrastructure_mode() -- * s2. set_802_11_authenticaion_mode() -- * s3. set_802_11_encryption_mode() -- * s4. set_802_11_ssid() -- * -- * This function intends to handle the Set ESSID command. -- * Currently, the request comes via the Wireless Extensions' SIOCSIWESSID ioctl. -- * -- * For this operation to succeed, there is no need for the interface to be Up. -- * -- */ --static int r8711_wx_set_essid(struct net_device *dev, -- struct iw_request_info *a, -- union iwreq_data *wrqu, char *extra) --{ -- struct _adapter *padapter = netdev_priv(dev); -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct __queue *queue = &pmlmepriv->scanned_queue; -- struct wlan_network *pnetwork = NULL; -- enum NDIS_802_11_AUTHENTICATION_MODE authmode; -- struct ndis_802_11_ssid ndis_ssid; -- u8 *dst_ssid, *src_ssid; -- struct list_head *phead; -- u32 len; -- -- if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY)) -- return -EBUSY; -- if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) -- return 0; -- if (wrqu->essid.length > IW_ESSID_MAX_SIZE) -- return -E2BIG; -- authmode = padapter->securitypriv.ndisauthtype; -- if (wrqu->essid.flags && wrqu->essid.length) { -- len = (wrqu->essid.length < IW_ESSID_MAX_SIZE) ? -- wrqu->essid.length : IW_ESSID_MAX_SIZE; -- memset(&ndis_ssid, 0, sizeof(struct ndis_802_11_ssid)); -- ndis_ssid.SsidLength = len; -- memcpy(ndis_ssid.Ssid, extra, len); -- src_ssid = ndis_ssid.Ssid; -- phead = &queue->queue; -- pmlmepriv->pscanned = phead->next; -- while (1) { -- if (end_of_queue_search(phead, pmlmepriv->pscanned)) -- break; -- pnetwork = container_of(pmlmepriv->pscanned, -- struct wlan_network, list); -- pmlmepriv->pscanned = pmlmepriv->pscanned->next; -- dst_ssid = pnetwork->network.Ssid.Ssid; -- if ((!memcmp(dst_ssid, src_ssid, ndis_ssid.SsidLength)) -- && (pnetwork->network.Ssid.SsidLength == -- ndis_ssid.SsidLength)) { -- if (check_fwstate(pmlmepriv, -- WIFI_ADHOC_STATE)) { -- if (pnetwork->network. -- InfrastructureMode -- != -- padapter->mlmepriv. -- cur_network.network. -- InfrastructureMode) -- continue; -- } -- -- r8712_set_802_11_infrastructure_mode( -- padapter, -- pnetwork->network.InfrastructureMode); -- break; -- } -- } -- r8712_set_802_11_authentication_mode(padapter, authmode); -- r8712_set_802_11_ssid(padapter, &ndis_ssid); -- } -- return -EINPROGRESS; --} -- --static int r8711_wx_get_essid(struct net_device *dev, -- struct iw_request_info *a, -- union iwreq_data *wrqu, char *extra) --{ -- struct _adapter *padapter = netdev_priv(dev); -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct wlan_bssid_ex *pcur_bss = &pmlmepriv->cur_network.network; -- u32 len, ret = 0; -- -- if (check_fwstate(pmlmepriv, _FW_LINKED | WIFI_ADHOC_MASTER_STATE)) { -- len = pcur_bss->Ssid.SsidLength; -- wrqu->essid.length = len; -- memcpy(extra, pcur_bss->Ssid.Ssid, len); -- wrqu->essid.flags = 1; -- } else { -- ret = -ENOLINK; -- } -- return ret; --} -- --static int r8711_wx_set_rate(struct net_device *dev, -- struct iw_request_info *a, -- union iwreq_data *wrqu, char *extra) --{ -- struct _adapter *padapter = netdev_priv(dev); -- u32 target_rate = wrqu->bitrate.value; -- u32 fixed = wrqu->bitrate.fixed; -- u32 ratevalue = 0; -- u8 datarates[NumRates]; -- u8 mpdatarate[NumRates] = {11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0, 0xff}; -- int i; -- -- if (target_rate == -1) { -- ratevalue = 11; -- goto set_rate; -- } -- target_rate = target_rate / 100000; -- switch (target_rate) { -- case 10: -- ratevalue = 0; -- break; -- case 20: -- ratevalue = 1; -- break; -- case 55: -- ratevalue = 2; -- break; -- case 60: -- ratevalue = 3; -- break; -- case 90: -- ratevalue = 4; -- break; -- case 110: -- ratevalue = 5; -- break; -- case 120: -- ratevalue = 6; -- break; -- case 180: -- ratevalue = 7; -- break; -- case 240: -- ratevalue = 8; -- break; -- case 360: -- ratevalue = 9; -- break; -- case 480: -- ratevalue = 10; -- break; -- case 540: -- ratevalue = 11; -- break; -- default: -- ratevalue = 11; -- break; -- } --set_rate: -- for (i = 0; i < NumRates; i++) { -- if (ratevalue == mpdatarate[i]) { -- datarates[i] = mpdatarate[i]; -- if (fixed == 0) -- break; -- } else { -- datarates[i] = 0xff; -- } -- } -- return r8712_setdatarate_cmd(padapter, datarates); --} -- --static int r8711_wx_get_rate(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- struct _adapter *padapter = netdev_priv(dev); -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct wlan_bssid_ex *pcur_bss = &pmlmepriv->cur_network.network; -- struct ieee80211_ht_cap *pht_capie; -- unsigned char rf_type = padapter->registrypriv.rf_config; -- int i; -- u8 *p; -- u16 rate, max_rate = 0, ht_cap = false; -- u32 ht_ielen = 0; -- u8 bw_40MHz = 0, short_GI = 0; -- u16 mcs_rate = 0; -- -- i = 0; -- if (!check_fwstate(pmlmepriv, _FW_LINKED | WIFI_ADHOC_MASTER_STATE)) -- return -ENOLINK; -- p = r8712_get_ie(&pcur_bss->IEs[12], WLAN_EID_HT_CAPABILITY, &ht_ielen, -- pcur_bss->IELength - 12); -- if (p && ht_ielen > 0) { -- ht_cap = true; -- pht_capie = (struct ieee80211_ht_cap *)(p + 2); -- memcpy(&mcs_rate, &pht_capie->mcs, 2); -- bw_40MHz = (le16_to_cpu(pht_capie->cap_info) & -- IEEE80211_HT_CAP_SUP_WIDTH_20_40) ? 1 : 0; -- short_GI = (le16_to_cpu(pht_capie->cap_info) & -- (IEEE80211_HT_CAP_SGI_20 | -- IEEE80211_HT_CAP_SGI_40)) ? 1 : 0; -- } -- while ((pcur_bss->rates[i] != 0) && -- (pcur_bss->rates[i] != 0xFF)) { -- rate = pcur_bss->rates[i] & 0x7F; -- if (rate > max_rate) -- max_rate = rate; -- wrqu->bitrate.fixed = 0; /* no auto select */ -- wrqu->bitrate.value = rate * 500000; -- i++; -- } -- if (ht_cap) { -- if (mcs_rate & 0x8000 /* MCS15 */ -- && -- rf_type == RTL8712_RF_2T2R) -- max_rate = (bw_40MHz) ? ((short_GI) ? 300 : 270) : -- ((short_GI) ? 144 : 130); -- else /* default MCS7 */ -- max_rate = (bw_40MHz) ? ((short_GI) ? 150 : 135) : -- ((short_GI) ? 72 : 65); -- max_rate *= 2; /* Mbps/2 */ -- } -- wrqu->bitrate.value = max_rate * 500000; -- return 0; --} -- --static int r8711_wx_get_rts(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- struct _adapter *padapter = netdev_priv(dev); -- -- wrqu->rts.value = padapter->registrypriv.rts_thresh; -- wrqu->rts.fixed = 0; /* no auto select */ -- return 0; --} -- --static int r8711_wx_set_frag(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- struct _adapter *padapter = netdev_priv(dev); -- -- if (wrqu->frag.disabled) { -- padapter->xmitpriv.frag_len = MAX_FRAG_THRESHOLD; -- } else { -- if (wrqu->frag.value < MIN_FRAG_THRESHOLD || -- wrqu->frag.value > MAX_FRAG_THRESHOLD) -- return -EINVAL; -- padapter->xmitpriv.frag_len = wrqu->frag.value & ~0x1; -- } -- return 0; --} -- --static int r8711_wx_get_frag(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- struct _adapter *padapter = netdev_priv(dev); -- -- wrqu->frag.value = padapter->xmitpriv.frag_len; -- wrqu->frag.fixed = 0; /* no auto select */ -- return 0; --} -- --static int r8711_wx_get_retry(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- wrqu->retry.value = 7; -- wrqu->retry.fixed = 0; /* no auto select */ -- wrqu->retry.disabled = 1; -- return 0; --} -- --static int r8711_wx_set_enc(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *keybuf) --{ -- u32 key; -- u32 keyindex_provided; -- struct NDIS_802_11_WEP wep; -- enum NDIS_802_11_AUTHENTICATION_MODE authmode; -- struct iw_point *erq = &wrqu->encoding; -- struct _adapter *padapter = netdev_priv(dev); -- -- key = erq->flags & IW_ENCODE_INDEX; -- memset(&wep, 0, sizeof(struct NDIS_802_11_WEP)); -- if (erq->flags & IW_ENCODE_DISABLED) { -- netdev_info(dev, "r8712u: %s: EncryptionDisabled\n", __func__); -- padapter->securitypriv.ndisencryptstatus = -- Ndis802_11EncryptionDisabled; -- padapter->securitypriv.PrivacyAlgrthm = _NO_PRIVACY_; -- padapter->securitypriv.XGrpPrivacy = _NO_PRIVACY_; -- padapter->securitypriv.AuthAlgrthm = 0; /* open system */ -- authmode = Ndis802_11AuthModeOpen; -- padapter->securitypriv.ndisauthtype = authmode; -- return 0; -- } -- if (key) { -- if (key > WEP_KEYS) -- return -EINVAL; -- key--; -- keyindex_provided = 1; -- } else { -- keyindex_provided = 0; -- key = padapter->securitypriv.PrivacyKeyIndex; -- } -- /* set authentication mode */ -- if (erq->flags & IW_ENCODE_OPEN) { -- netdev_info(dev, "r8712u: %s: IW_ENCODE_OPEN\n", __func__); -- padapter->securitypriv.ndisencryptstatus = -- Ndis802_11Encryption1Enabled; -- padapter->securitypriv.AuthAlgrthm = 0; /* open system */ -- padapter->securitypriv.PrivacyAlgrthm = _NO_PRIVACY_; -- padapter->securitypriv.XGrpPrivacy = _NO_PRIVACY_; -- authmode = Ndis802_11AuthModeOpen; -- padapter->securitypriv.ndisauthtype = authmode; -- } else if (erq->flags & IW_ENCODE_RESTRICTED) { -- netdev_info(dev, -- "r8712u: %s: IW_ENCODE_RESTRICTED\n", __func__); -- padapter->securitypriv.ndisencryptstatus = -- Ndis802_11Encryption1Enabled; -- padapter->securitypriv.AuthAlgrthm = 1; /* shared system */ -- padapter->securitypriv.PrivacyAlgrthm = _WEP40_; -- padapter->securitypriv.XGrpPrivacy = _WEP40_; -- authmode = Ndis802_11AuthModeShared; -- padapter->securitypriv.ndisauthtype = authmode; -- } else { -- padapter->securitypriv.ndisencryptstatus = -- Ndis802_11Encryption1Enabled; -- padapter->securitypriv.AuthAlgrthm = 0; /* open system */ -- padapter->securitypriv.PrivacyAlgrthm = _NO_PRIVACY_; -- padapter->securitypriv.XGrpPrivacy = _NO_PRIVACY_; -- authmode = Ndis802_11AuthModeOpen; -- padapter->securitypriv.ndisauthtype = authmode; -- } -- wep.KeyIndex = key; -- if (erq->length > 0) { -- wep.KeyLength = erq->length <= 5 ? 5 : 13; -- wep.Length = wep.KeyLength + -- offsetof(struct NDIS_802_11_WEP, KeyMaterial); -- } else { -- wep.KeyLength = 0; -- if (keyindex_provided == 1) { /* set key_id only, no given -- * KeyMaterial(erq->length==0). -- */ -- padapter->securitypriv.PrivacyKeyIndex = key; -- switch (padapter->securitypriv.DefKeylen[key]) { -- case 5: -- padapter->securitypriv.PrivacyAlgrthm = -- _WEP40_; -- break; -- case 13: -- padapter->securitypriv.PrivacyAlgrthm = -- _WEP104_; -- break; -- default: -- padapter->securitypriv.PrivacyAlgrthm = -- _NO_PRIVACY_; -- break; -- } -- return 0; -- } -- } -- wep.KeyIndex |= 0x80000000; /* transmit key */ -- memcpy(wep.KeyMaterial, keybuf, wep.KeyLength); -- if (r8712_set_802_11_add_wep(padapter, &wep)) -- return -EOPNOTSUPP; -- return 0; --} -- --static int r8711_wx_get_enc(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *keybuf) --{ -- uint key; -- struct _adapter *padapter = netdev_priv(dev); -- struct iw_point *erq = &wrqu->encoding; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- union Keytype *dk = padapter->securitypriv.DefKey; -- -- if (!check_fwstate(pmlmepriv, _FW_LINKED)) { -- if (!check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) { -- erq->length = 0; -- erq->flags |= IW_ENCODE_DISABLED; -- return 0; -- } -- } -- key = erq->flags & IW_ENCODE_INDEX; -- if (key) { -- if (key > WEP_KEYS) -- return -EINVAL; -- key--; -- } else { -- key = padapter->securitypriv.PrivacyKeyIndex; -- } -- erq->flags = key + 1; -- switch (padapter->securitypriv.ndisencryptstatus) { -- case Ndis802_11EncryptionNotSupported: -- case Ndis802_11EncryptionDisabled: -- erq->length = 0; -- erq->flags |= IW_ENCODE_DISABLED; -- break; -- case Ndis802_11Encryption1Enabled: -- erq->length = padapter->securitypriv.DefKeylen[key]; -- if (erq->length) { -- memcpy(keybuf, dk[key].skey, -- padapter->securitypriv.DefKeylen[key]); -- erq->flags |= IW_ENCODE_ENABLED; -- if (padapter->securitypriv.ndisauthtype == -- Ndis802_11AuthModeOpen) -- erq->flags |= IW_ENCODE_OPEN; -- else if (padapter->securitypriv.ndisauthtype == -- Ndis802_11AuthModeShared) -- erq->flags |= IW_ENCODE_RESTRICTED; -- } else { -- erq->length = 0; -- erq->flags |= IW_ENCODE_DISABLED; -- } -- break; -- case Ndis802_11Encryption2Enabled: -- case Ndis802_11Encryption3Enabled: -- erq->length = 16; -- erq->flags |= (IW_ENCODE_ENABLED | IW_ENCODE_OPEN | -- IW_ENCODE_NOKEY); -- break; -- default: -- erq->length = 0; -- erq->flags |= IW_ENCODE_DISABLED; -- break; -- } -- return 0; --} -- --static int r8711_wx_get_power(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- wrqu->power.value = 0; -- wrqu->power.fixed = 0; /* no auto select */ -- wrqu->power.disabled = 1; -- return 0; --} -- --static int r871x_wx_set_gen_ie(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- struct _adapter *padapter = netdev_priv(dev); -- -- return r871x_set_wpa_ie(padapter, extra, wrqu->data.length); --} -- --static int r871x_wx_set_auth(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- struct _adapter *padapter = netdev_priv(dev); -- struct iw_param *param = (struct iw_param *)&wrqu->param; -- int paramid; -- int paramval; -- int ret = 0; -- -- paramid = param->flags & IW_AUTH_INDEX; -- paramval = param->value; -- switch (paramid) { -- case IW_AUTH_WPA_VERSION: -- break; -- case IW_AUTH_CIPHER_PAIRWISE: -- break; -- case IW_AUTH_CIPHER_GROUP: -- break; -- case IW_AUTH_KEY_MGMT: -- /* -- * ??? does not use these parameters -- */ -- break; -- case IW_AUTH_TKIP_COUNTERMEASURES: -- if (paramval) { -- /* wpa_supplicant is enabling tkip countermeasure. */ -- padapter->securitypriv.btkip_countermeasure = true; -- } else { -- /* wpa_supplicant is disabling tkip countermeasure. */ -- padapter->securitypriv.btkip_countermeasure = false; -- } -- break; -- case IW_AUTH_DROP_UNENCRYPTED: -- /* HACK: -- * -- * wpa_supplicant calls set_wpa_enabled when the driver -- * is loaded and unloaded, regardless of if WPA is being -- * used. No other calls are made which can be used to -- * determine if encryption will be used or not prior to -- * association being expected. If encryption is not being -- * used, drop_unencrypted is set to false, else true -- we -- * can use this to determine if the CAP_PRIVACY_ON bit should -- * be set. -- */ -- if (padapter->securitypriv.ndisencryptstatus == -- Ndis802_11Encryption1Enabled) { -- /* it means init value, or using wep, -- * ndisencryptstatus = -- * Ndis802_11Encryption1Enabled, -- * then it needn't reset it; -- */ -- break; -- } -- -- if (paramval) { -- padapter->securitypriv.ndisencryptstatus = -- Ndis802_11EncryptionDisabled; -- padapter->securitypriv.PrivacyAlgrthm = -- _NO_PRIVACY_; -- padapter->securitypriv.XGrpPrivacy = -- _NO_PRIVACY_; -- padapter->securitypriv.AuthAlgrthm = 0; -- padapter->securitypriv.ndisauthtype = -- Ndis802_11AuthModeOpen; -- } -- break; -- case IW_AUTH_80211_AUTH_ALG: -- ret = wpa_set_auth_algs(dev, (u32)paramval); -- break; -- case IW_AUTH_WPA_ENABLED: -- break; -- case IW_AUTH_RX_UNENCRYPTED_EAPOL: -- break; -- case IW_AUTH_PRIVACY_INVOKED: -- break; -- default: -- return -EOPNOTSUPP; -- } -- -- return ret; --} -- --static int r871x_wx_set_enc_ext(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- struct iw_point *pencoding = &wrqu->encoding; -- struct iw_encode_ext *pext = (struct iw_encode_ext *)extra; -- struct ieee_param *param = NULL; -- char *alg_name; -- u32 param_len; -- int ret = 0; -- -- switch (pext->alg) { -- case IW_ENCODE_ALG_NONE: -- alg_name = "none"; -- break; -- case IW_ENCODE_ALG_WEP: -- alg_name = "WEP"; -- break; -- case IW_ENCODE_ALG_TKIP: -- alg_name = "TKIP"; -- break; -- case IW_ENCODE_ALG_CCMP: -- alg_name = "CCMP"; -- break; -- default: -- return -EINVAL; -- } -- -- param_len = sizeof(struct ieee_param) + pext->key_len; -- param = kzalloc(param_len, GFP_ATOMIC); -- if (!param) -- return -ENOMEM; -- param->cmd = IEEE_CMD_SET_ENCRYPTION; -- eth_broadcast_addr(param->sta_addr); -- strscpy((char *)param->u.crypt.alg, alg_name, IEEE_CRYPT_ALG_NAME_LEN); -- if (pext->ext_flags & IW_ENCODE_EXT_GROUP_KEY) -- param->u.crypt.set_tx = 0; -- if (pext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) -- param->u.crypt.set_tx = 1; -- param->u.crypt.idx = (pencoding->flags & 0x00FF) - 1; -- if (pext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) -- memcpy(param->u.crypt.seq, pext->rx_seq, 8); -- if (pext->key_len) { -- param->u.crypt.key_len = pext->key_len; -- memcpy(param + 1, pext + 1, pext->key_len); -- } -- ret = wpa_set_encryption(dev, param, param_len); -- kfree(param); -- return ret; --} -- --static int r871x_wx_get_nick(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- if (extra) { -- wrqu->data.length = 8; -- wrqu->data.flags = 1; -- memcpy(extra, "rtl_wifi", 8); -- } -- return 0; --} -- --static int r8711_wx_read32(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *keybuf) --{ -- struct _adapter *padapter = netdev_priv(dev); -- u32 addr; -- u32 data32; -- -- get_user(addr, (u32 __user *)wrqu->data.pointer); -- data32 = r8712_read32(padapter, addr); -- put_user(data32, (u32 __user *)wrqu->data.pointer); -- wrqu->data.length = (data32 & 0xffff0000) >> 16; -- wrqu->data.flags = data32 & 0xffff; -- get_user(addr, (u32 __user *)wrqu->data.pointer); -- return 0; --} -- --static int r8711_wx_write32(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *keybuf) --{ -- struct _adapter *padapter = netdev_priv(dev); -- u32 addr; -- u32 data32; -- -- get_user(addr, (u32 __user *)wrqu->data.pointer); -- data32 = ((u32)wrqu->data.length << 16) | (u32)wrqu->data.flags; -- r8712_write32(padapter, addr, data32); -- return 0; --} -- --static int dummy(struct net_device *dev, -- struct iw_request_info *a, -- union iwreq_data *wrqu, char *b) --{ -- return -EINVAL; --} -- --static int r8711_drvext_hdl(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- return 0; --} -- --static int r871x_mp_ioctl_hdl(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- struct _adapter *padapter = netdev_priv(dev); -- struct iw_point *p = &wrqu->data; -- struct oid_par_priv oid_par; -- struct mp_ioctl_handler *phandler; -- struct mp_ioctl_param *poidparam; -- unsigned long BytesRead, BytesWritten, BytesNeeded; -- u8 *pparmbuf, bset; -- u16 len; -- uint status; -- int ret = 0; -- -- if ((!p->length) || (!p->pointer)) -- return -EINVAL; -- -- bset = (u8)(p->flags & 0xFFFF); -- len = p->length; -- pparmbuf = memdup_user(p->pointer, len); -- if (IS_ERR(pparmbuf)) -- return PTR_ERR(pparmbuf); -- -- poidparam = (struct mp_ioctl_param *)pparmbuf; -- if (poidparam->subcode >= MAX_MP_IOCTL_SUBCODE) { -- ret = -EINVAL; -- goto _r871x_mp_ioctl_hdl_exit; -- } -- phandler = mp_ioctl_hdl + poidparam->subcode; -- if ((phandler->paramsize != 0) && -- (poidparam->len < phandler->paramsize)) { -- ret = -EINVAL; -- goto _r871x_mp_ioctl_hdl_exit; -- } -- if (phandler->oid == 0 && phandler->handler) { -- status = phandler->handler(&oid_par); -- } else if (phandler->handler) { -- oid_par.adapter_context = padapter; -- oid_par.oid = phandler->oid; -- oid_par.information_buf = poidparam->data; -- oid_par.information_buf_len = poidparam->len; -- oid_par.dbg = 0; -- BytesWritten = 0; -- BytesNeeded = 0; -- if (bset) { -- oid_par.bytes_rw = &BytesRead; -- oid_par.bytes_needed = &BytesNeeded; -- oid_par.type_of_oid = SET_OID; -- } else { -- oid_par.bytes_rw = &BytesWritten; -- oid_par.bytes_needed = &BytesNeeded; -- oid_par.type_of_oid = QUERY_OID; -- } -- status = phandler->handler(&oid_par); -- /* todo:check status, BytesNeeded, etc. */ -- } else { -- netdev_info(dev, "r8712u: %s: err!, subcode=%d, oid=%d, handler=%p\n", -- __func__, poidparam->subcode, phandler->oid, -- phandler->handler); -- ret = -EFAULT; -- goto _r871x_mp_ioctl_hdl_exit; -- } -- if (bset == 0x00) { /* query info */ -- if (copy_to_user(p->pointer, pparmbuf, len)) -- ret = -EFAULT; -- } -- if (status) { -- ret = -EFAULT; -- goto _r871x_mp_ioctl_hdl_exit; -- } --_r871x_mp_ioctl_hdl_exit: -- kfree(pparmbuf); -- return ret; --} -- --static int r871x_get_ap_info(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- struct _adapter *padapter = netdev_priv(dev); -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct __queue *queue = &pmlmepriv->scanned_queue; -- struct iw_point *pdata = &wrqu->data; -- struct wlan_network *pnetwork = NULL; -- u32 cnt = 0, wpa_ielen; -- unsigned long irqL; -- struct list_head *plist, *phead; -- unsigned char *pbuf; -- u8 bssid[ETH_ALEN]; -- char data[33]; -- -- if (padapter->driver_stopped || !pdata) -- return -EINVAL; -- while (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY | -- _FW_UNDER_LINKING)) { -- msleep(30); -- cnt++; -- if (cnt > 100) -- break; -- } -- pdata->flags = 0; -- if (pdata->length < 32) -- return -EINVAL; -- if (copy_from_user(data, pdata->pointer, 32)) -- return -EINVAL; -- data[32] = 0; -- -- spin_lock_irqsave(&pmlmepriv->scanned_queue.lock, irqL); -- phead = &queue->queue; -- plist = phead->next; -- while (1) { -- if (end_of_queue_search(phead, plist)) -- break; -- pnetwork = container_of(plist, struct wlan_network, list); -- if (!mac_pton(data, bssid)) { -- netdev_info(dev, "r8712u: Invalid BSSID '%s'.\n", -- (u8 *)data); -- spin_unlock_irqrestore(&pmlmepriv->scanned_queue.lock, -- irqL); -- return -EINVAL; -- } -- netdev_info(dev, "r8712u: BSSID:%pM\n", bssid); -- if (ether_addr_equal(bssid, pnetwork->network.MacAddress)) { -- /* BSSID match, then check if supporting wpa/wpa2 */ -- pbuf = r8712_get_wpa_ie(&pnetwork->network.IEs[12], -- &wpa_ielen, pnetwork->network.IELength - 12); -- if (pbuf && (wpa_ielen > 0)) { -- pdata->flags = 1; -- break; -- } -- pbuf = r8712_get_wpa2_ie(&pnetwork->network.IEs[12], -- &wpa_ielen, pnetwork->network.IELength - 12); -- if (pbuf && (wpa_ielen > 0)) { -- pdata->flags = 2; -- break; -- } -- } -- plist = plist->next; -- } -- spin_unlock_irqrestore(&pmlmepriv->scanned_queue.lock, irqL); -- if (pdata->length >= 34) { -- if (copy_to_user((u8 __user *)pdata->pointer + 32, -- (u8 *)&pdata->flags, 1)) -- return -EINVAL; -- } -- return 0; --} -- --static int r871x_set_pid(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- struct _adapter *padapter = netdev_priv(dev); -- struct iw_point *pdata = &wrqu->data; -- -- if (padapter->driver_stopped || !pdata) -- return -EINVAL; -- if (copy_from_user(&padapter->pid, pdata->pointer, sizeof(int))) -- return -EINVAL; -- return 0; --} -- --static int r871x_set_chplan(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- int ret = 0; -- struct _adapter *padapter = netdev_priv(dev); -- struct iw_point *pdata = &wrqu->data; -- int ch_plan = -1; -- -- if (padapter->driver_stopped || !pdata) { -- ret = -EINVAL; -- goto exit; -- } -- ch_plan = (int)*extra; -- r8712_set_chplan_cmd(padapter, ch_plan); -- --exit: -- -- return ret; --} -- --static int r871x_wps_start(struct net_device *dev, -- struct iw_request_info *info, -- union iwreq_data *wrqu, char *extra) --{ -- struct _adapter *padapter = netdev_priv(dev); -- struct iw_point *pdata = &wrqu->data; -- u32 u32wps_start = 0; -- -- if (padapter->driver_stopped || !pdata) -- return -EINVAL; -- if (copy_from_user((void *)&u32wps_start, pdata->pointer, 4)) -- return -EFAULT; -- if (u32wps_start == 0) -- u32wps_start = *extra; -- if (u32wps_start == 1) /* WPS Start */ -- padapter->ledpriv.LedControlHandler(padapter, -- LED_CTL_START_WPS); -- else if (u32wps_start == 2) /* WPS Stop because of wps success */ -- padapter->ledpriv.LedControlHandler(padapter, -- LED_CTL_STOP_WPS); -- else if (u32wps_start == 3) /* WPS Stop because of wps fail */ -- padapter->ledpriv.LedControlHandler(padapter, -- LED_CTL_STOP_WPS_FAIL); -- return 0; --} -- --static int wpa_set_param(struct net_device *dev, u8 name, u32 value) --{ -- struct _adapter *padapter = netdev_priv(dev); -- -- switch (name) { -- case IEEE_PARAM_WPA_ENABLED: -- padapter->securitypriv.AuthAlgrthm = 2; /* 802.1x */ -- switch ((value) & 0xff) { -- case 1: /* WPA */ -- padapter->securitypriv.ndisauthtype = -- Ndis802_11AuthModeWPAPSK; /* WPA_PSK */ -- padapter->securitypriv.ndisencryptstatus = -- Ndis802_11Encryption2Enabled; -- break; -- case 2: /* WPA2 */ -- padapter->securitypriv.ndisauthtype = -- Ndis802_11AuthModeWPA2PSK; /* WPA2_PSK */ -- padapter->securitypriv.ndisencryptstatus = -- Ndis802_11Encryption3Enabled; -- break; -- } -- break; -- case IEEE_PARAM_TKIP_COUNTERMEASURES: -- break; -- case IEEE_PARAM_DROP_UNENCRYPTED: -- /* HACK: -- * -- * wpa_supplicant calls set_wpa_enabled when the driver -- * is loaded and unloaded, regardless of if WPA is being -- * used. No other calls are made which can be used to -- * determine if encryption will be used or not prior to -- * association being expected. If encryption is not being -- * used, drop_unencrypted is set to false, else true -- we -- * can use this to determine if the CAP_PRIVACY_ON bit should -- * be set. -- */ -- break; -- case IEEE_PARAM_PRIVACY_INVOKED: -- break; -- case IEEE_PARAM_AUTH_ALGS: -- return wpa_set_auth_algs(dev, value); -- case IEEE_PARAM_IEEE_802_1X: -- break; -- case IEEE_PARAM_WPAX_SELECT: -- /* added for WPA2 mixed mode */ -- break; -- default: -- return -EOPNOTSUPP; -- } -- return 0; --} -- --static int wpa_mlme(struct net_device *dev, u32 command, u32 reason) --{ -- struct _adapter *padapter = netdev_priv(dev); -- -- switch (command) { -- case IEEE_MLME_STA_DEAUTH: -- if (!r8712_set_802_11_disassociate(padapter)) -- return -1; -- break; -- case IEEE_MLME_STA_DISASSOC: -- if (!r8712_set_802_11_disassociate(padapter)) -- return -1; -- break; -- default: -- return -EOPNOTSUPP; -- } -- return 0; --} -- --static int wpa_supplicant_ioctl(struct net_device *dev, struct iw_point *p) --{ -- struct ieee_param *param; -- int ret = 0; -- struct _adapter *padapter = netdev_priv(dev); -- -- if (p->length < sizeof(struct ieee_param) || !p->pointer) -- return -EINVAL; -- param = memdup_user(p->pointer, p->length); -- if (IS_ERR(param)) -- return PTR_ERR(param); -- switch (param->cmd) { -- case IEEE_CMD_SET_WPA_PARAM: -- ret = wpa_set_param(dev, param->u.wpa_param.name, -- param->u.wpa_param.value); -- break; -- case IEEE_CMD_SET_WPA_IE: -- ret = r871x_set_wpa_ie(padapter, (char *)param->u.wpa_ie.data, -- (u16)param->u.wpa_ie.len); -- break; -- case IEEE_CMD_SET_ENCRYPTION: -- ret = wpa_set_encryption(dev, param, p->length); -- break; -- case IEEE_CMD_MLME: -- ret = wpa_mlme(dev, param->u.mlme.command, -- param->u.mlme.reason_code); -- break; -- default: -- ret = -EOPNOTSUPP; -- break; -- } -- if (ret == 0 && copy_to_user(p->pointer, param, p->length)) -- ret = -EFAULT; -- kfree(param); -- return ret; --} -- --/* based on "driver_ipw" and for hostapd */ --int r871x_ioctl(struct net_device *dev, struct ifreq *rq, int cmd) --{ -- struct iwreq *wrq = (struct iwreq *)rq; -- -- switch (cmd) { -- case RTL_IOCTL_WPA_SUPPLICANT: -- return wpa_supplicant_ioctl(dev, &wrq->u.data); -- default: -- return -EOPNOTSUPP; -- } -- return 0; --} -- --static iw_handler r8711_handlers[] = { -- NULL, /* SIOCSIWCOMMIT */ -- r8711_wx_get_name, /* SIOCGIWNAME */ -- dummy, /* SIOCSIWNWID */ -- dummy, /* SIOCGIWNWID */ -- r8711_wx_set_freq, /* SIOCSIWFREQ */ -- r8711_wx_get_freq, /* SIOCGIWFREQ */ -- r8711_wx_set_mode, /* SIOCSIWMODE */ -- r8711_wx_get_mode, /* SIOCGIWMODE */ -- dummy, /* SIOCSIWSENS */ -- r8711_wx_get_sens, /* SIOCGIWSENS */ -- NULL, /* SIOCSIWRANGE */ -- r8711_wx_get_range, /* SIOCGIWRANGE */ -- r871x_wx_set_priv, /* SIOCSIWPRIV */ -- NULL, /* SIOCGIWPRIV */ -- NULL, /* SIOCSIWSTATS */ -- NULL, /* SIOCGIWSTATS */ -- dummy, /* SIOCSIWSPY */ -- dummy, /* SIOCGIWSPY */ -- NULL, /* SIOCGIWTHRSPY */ -- NULL, /* SIOCWIWTHRSPY */ -- r8711_wx_set_wap, /* SIOCSIWAP */ -- r8711_wx_get_wap, /* SIOCGIWAP */ -- r871x_wx_set_mlme, /* request MLME operation; -- * uses struct iw_mlme -- */ -- dummy, /* SIOCGIWAPLIST -- deprecated */ -- r8711_wx_set_scan, /* SIOCSIWSCAN */ -- r8711_wx_get_scan, /* SIOCGIWSCAN */ -- r8711_wx_set_essid, /* SIOCSIWESSID */ -- r8711_wx_get_essid, /* SIOCGIWESSID */ -- dummy, /* SIOCSIWNICKN */ -- r871x_wx_get_nick, /* SIOCGIWNICKN */ -- NULL, /* -- hole -- */ -- NULL, /* -- hole -- */ -- r8711_wx_set_rate, /* SIOCSIWRATE */ -- r8711_wx_get_rate, /* SIOCGIWRATE */ -- dummy, /* SIOCSIWRTS */ -- r8711_wx_get_rts, /* SIOCGIWRTS */ -- r8711_wx_set_frag, /* SIOCSIWFRAG */ -- r8711_wx_get_frag, /* SIOCGIWFRAG */ -- dummy, /* SIOCSIWTXPOW */ -- dummy, /* SIOCGIWTXPOW */ -- dummy, /* SIOCSIWRETRY */ -- r8711_wx_get_retry, /* SIOCGIWRETRY */ -- r8711_wx_set_enc, /* SIOCSIWENCODE */ -- r8711_wx_get_enc, /* SIOCGIWENCODE */ -- dummy, /* SIOCSIWPOWER */ -- r8711_wx_get_power, /* SIOCGIWPOWER */ -- NULL, /*---hole---*/ -- NULL, /*---hole---*/ -- r871x_wx_set_gen_ie, /* SIOCSIWGENIE */ -- NULL, /* SIOCGIWGENIE */ -- r871x_wx_set_auth, /* SIOCSIWAUTH */ -- NULL, /* SIOCGIWAUTH */ -- r871x_wx_set_enc_ext, /* SIOCSIWENCODEEXT */ -- NULL, /* SIOCGIWENCODEEXT */ -- r871x_wx_set_pmkid, /* SIOCSIWPMKSA */ -- NULL, /*---hole---*/ --}; -- --static const struct iw_priv_args r8711_private_args[] = { -- { -- SIOCIWFIRSTPRIV + 0x0, -- IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "read32" -- }, -- { -- SIOCIWFIRSTPRIV + 0x1, -- IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "write32" -- }, -- { -- SIOCIWFIRSTPRIV + 0x2, 0, 0, "driver_ext" -- }, -- { -- SIOCIWFIRSTPRIV + 0x3, 0, 0, "mp_ioctl" -- }, -- { -- SIOCIWFIRSTPRIV + 0x4, -- IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "apinfo" -- }, -- { -- SIOCIWFIRSTPRIV + 0x5, -- IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "setpid" -- }, -- { -- SIOCIWFIRSTPRIV + 0x6, -- IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "wps_start" -- }, -- { -- SIOCIWFIRSTPRIV + 0x7, -- IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "chplan" -- } --}; -- --static iw_handler r8711_private_handler[] = { -- r8711_wx_read32, -- r8711_wx_write32, -- r8711_drvext_hdl, -- r871x_mp_ioctl_hdl, -- r871x_get_ap_info, /*for MM DTV platform*/ -- r871x_set_pid, -- r871x_wps_start, -- r871x_set_chplan --}; -- --static struct iw_statistics *r871x_get_wireless_stats(struct net_device *dev) --{ -- struct _adapter *padapter = netdev_priv(dev); -- struct iw_statistics *piwstats = &padapter->iwstats; -- int tmp_level = 0; -- int tmp_qual = 0; -- int tmp_noise = 0; -- -- if (check_fwstate(&padapter->mlmepriv, _FW_LINKED) != true) { -- piwstats->qual.qual = 0; -- piwstats->qual.level = 0; -- piwstats->qual.noise = 0; -- } else { -- /* show percentage, we need transfer dbm to original value. */ -- tmp_level = padapter->recvpriv.fw_rssi; -- tmp_qual = padapter->recvpriv.signal; -- tmp_noise = padapter->recvpriv.noise; -- piwstats->qual.level = tmp_level; -- piwstats->qual.qual = tmp_qual; -- piwstats->qual.noise = tmp_noise; -- } -- piwstats->qual.updated = IW_QUAL_ALL_UPDATED; -- return &padapter->iwstats; --} -- --struct iw_handler_def r871x_handlers_def = { -- .standard = r8711_handlers, -- .num_standard = ARRAY_SIZE(r8711_handlers), -- .private = r8711_private_handler, -- .private_args = (struct iw_priv_args *)r8711_private_args, -- .num_private = ARRAY_SIZE(r8711_private_handler), -- .num_private_args = sizeof(r8711_private_args) / -- sizeof(struct iw_priv_args), -- .get_wireless_stats = r871x_get_wireless_stats --}; -diff --git a/drivers/staging/rtl8712/rtl871x_ioctl_rtl.c b/drivers/staging/rtl8712/rtl871x_ioctl_rtl.c -deleted file mode 100644 -index 2b539335206aa1..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_ioctl_rtl.c -+++ /dev/null -@@ -1,519 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * rtl871x_ioctl_rtl.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _RTL871X_IOCTL_RTL_C_ -- --#include --#include "osdep_service.h" --#include "drv_types.h" --#include "wlan_bssdef.h" --#include "wifi.h" --#include "rtl871x_ioctl.h" --#include "rtl871x_ioctl_set.h" --#include "rtl871x_ioctl_rtl.h" --#include "mp_custom_oid.h" --#include "rtl871x_mp.h" --#include "rtl871x_mp_ioctl.h" -- --uint oid_rt_get_signal_quality_hdl(struct oid_par_priv *poid_par_priv) --{ -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_small_packet_crc_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *padapter = poid_par_priv->adapter_context; -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len >= sizeof(u32)) { -- *(u32 *)poid_par_priv->information_buf = -- padapter->recvpriv.rx_smallpacket_crcerr; -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- } else { -- return RNDIS_STATUS_INVALID_LENGTH; -- } -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_middle_packet_crc_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *padapter = poid_par_priv->adapter_context; -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len >= sizeof(u32)) { -- *(u32 *)poid_par_priv->information_buf = -- padapter->recvpriv.rx_middlepacket_crcerr; -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- } else { -- return RNDIS_STATUS_INVALID_LENGTH; -- } -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_large_packet_crc_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *padapter = poid_par_priv->adapter_context; -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len >= sizeof(u32)) { -- *(u32 *)poid_par_priv->information_buf = -- padapter->recvpriv.rx_largepacket_crcerr; -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- } else { -- return RNDIS_STATUS_INVALID_LENGTH; -- } -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_tx_retry_hdl(struct oid_par_priv *poid_par_priv) --{ -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_rx_retry_hdl(struct oid_par_priv *poid_par_priv) --{ -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_rx_total_packet_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *padapter = poid_par_priv->adapter_context; -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len >= sizeof(u32)) { -- *(u32 *)poid_par_priv->information_buf = -- padapter->recvpriv.rx_pkts + -- padapter->recvpriv.rx_drop; -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- } else { -- return RNDIS_STATUS_INVALID_LENGTH; -- } -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_tx_beacon_ok_hdl(struct oid_par_priv *poid_par_priv) --{ -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_tx_beacon_err_hdl(struct oid_par_priv *poid_par_priv) --{ -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_rx_icv_err_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *padapter = poid_par_priv->adapter_context; -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len >= sizeof(u32)) { -- *(uint *)poid_par_priv->information_buf = -- padapter->recvpriv.rx_icv_err; -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- } else { -- return RNDIS_STATUS_INVALID_LENGTH; -- } -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_set_encryption_algorithm_hdl(struct oid_par_priv -- *poid_par_priv) --{ -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_preamble_mode_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *padapter = poid_par_priv->adapter_context; -- u32 preamblemode = 0; -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len >= sizeof(u32)) { -- if (padapter->registrypriv.preamble == PREAMBLE_LONG) -- preamblemode = 0; -- else if (padapter->registrypriv.preamble == PREAMBLE_AUTO) -- preamblemode = 1; -- else if (padapter->registrypriv.preamble == PREAMBLE_SHORT) -- preamblemode = 2; -- *(u32 *)poid_par_priv->information_buf = preamblemode; -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- } else { -- return RNDIS_STATUS_INVALID_LENGTH; -- } -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_ap_ip_hdl(struct oid_par_priv *poid_par_priv) --{ -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_channelplan_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *padapter = poid_par_priv->adapter_context; -- struct eeprom_priv *peeprompriv = &padapter->eeprompriv; -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- *(u16 *)poid_par_priv->information_buf = peeprompriv->channel_plan; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_set_channelplan_hdl(struct oid_par_priv -- *poid_par_priv) --{ -- struct _adapter *padapter = poid_par_priv->adapter_context; -- struct eeprom_priv *peeprompriv = &padapter->eeprompriv; -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- peeprompriv->channel_plan = *(u16 *)poid_par_priv->information_buf; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_set_preamble_mode_hdl(struct oid_par_priv -- *poid_par_priv) --{ -- struct _adapter *padapter = poid_par_priv->adapter_context; -- u32 preamblemode = 0; -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len >= sizeof(u32)) { -- preamblemode = *(u32 *)poid_par_priv->information_buf; -- if (preamblemode == 0) -- padapter->registrypriv.preamble = PREAMBLE_LONG; -- else if (preamblemode == 1) -- padapter->registrypriv.preamble = PREAMBLE_AUTO; -- else if (preamblemode == 2) -- padapter->registrypriv.preamble = PREAMBLE_SHORT; -- *(u32 *)poid_par_priv->information_buf = preamblemode; -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- } else { -- return RNDIS_STATUS_INVALID_LENGTH; -- } -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_set_bcn_intvl_hdl(struct oid_par_priv *poid_par_priv) --{ -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_dedicate_probe_hdl(struct oid_par_priv -- *poid_par_priv) --{ -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_total_tx_bytes_hdl(struct oid_par_priv -- *poid_par_priv) --{ -- struct _adapter *padapter = poid_par_priv->adapter_context; -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len >= sizeof(u32)) { -- *(u32 *)poid_par_priv->information_buf = -- padapter->xmitpriv.tx_bytes; -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- } else { -- return RNDIS_STATUS_INVALID_LENGTH; -- } -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_total_rx_bytes_hdl(struct oid_par_priv -- *poid_par_priv) --{ -- struct _adapter *padapter = poid_par_priv->adapter_context; -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len >= sizeof(u32)) { -- *(u32 *)poid_par_priv->information_buf = -- padapter->recvpriv.rx_bytes; -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- } else { -- return RNDIS_STATUS_INVALID_LENGTH; -- } -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_current_tx_power_level_hdl(struct oid_par_priv -- *poid_par_priv) --{ -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_enc_key_mismatch_count_hdl(struct oid_par_priv -- *poid_par_priv) --{ -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_enc_key_match_count_hdl(struct oid_par_priv -- *poid_par_priv) --{ -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_channel_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *padapter = poid_par_priv->adapter_context; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct NDIS_802_11_CONFIGURATION *pnic_Config; -- u32 channelnum; -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (check_fwstate(pmlmepriv, _FW_LINKED) || -- check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) -- pnic_Config = &pmlmepriv->cur_network.network.Configuration; -- else -- pnic_Config = &padapter->registrypriv.dev_network.Configuration; -- channelnum = pnic_Config->DSConfig; -- *(u32 *)poid_par_priv->information_buf = channelnum; -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_hardware_radio_off_hdl(struct oid_par_priv -- *poid_par_priv) --{ -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_key_mismatch_hdl(struct oid_par_priv *poid_par_priv) --{ -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_supported_wireless_mode_hdl(struct oid_par_priv -- *poid_par_priv) --{ -- u32 ulInfo = 0; -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len >= sizeof(u32)) { -- ulInfo |= 0x0100; /* WIRELESS_MODE_B */ -- ulInfo |= 0x0200; /* WIRELESS_MODE_G */ -- ulInfo |= 0x0400; /* WIRELESS_MODE_A */ -- *(u32 *) poid_par_priv->information_buf = ulInfo; -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- } else { -- return RNDIS_STATUS_INVALID_LENGTH; -- } -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_channel_list_hdl(struct oid_par_priv *poid_par_priv) --{ -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_scan_in_progress_hdl(struct oid_par_priv *poid_par_priv) --{ -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_forced_data_rate_hdl(struct oid_par_priv *poid_par_priv) --{ -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_wireless_mode_for_scan_list_hdl(struct oid_par_priv -- *poid_par_priv) --{ -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_bss_wireless_mode_hdl(struct oid_par_priv -- *poid_par_priv) --{ -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_scan_with_magic_packet_hdl(struct oid_par_priv -- *poid_par_priv) --{ -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_ap_get_associated_station_list_hdl(struct oid_par_priv -- *poid_par_priv) --{ -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_ap_switch_into_ap_mode_hdl(struct oid_par_priv* -- poid_par_priv) --{ -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_ap_supported_hdl(struct oid_par_priv *poid_par_priv) --{ -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_ap_set_passphrase_hdl(struct oid_par_priv *poid_par_priv) --{ -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_pro_rf_write_registry_hdl(struct oid_par_priv* -- poid_par_priv) --{ -- uint status = RNDIS_STATUS_SUCCESS; -- struct _adapter *Adapter = poid_par_priv->adapter_context; -- -- if (poid_par_priv->type_of_oid != SET_OID) /* QUERY_OID */ -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len == -- (sizeof(unsigned long) * 3)) { -- if (r8712_setrfreg_cmd(Adapter, -- *(unsigned char *)poid_par_priv->information_buf, -- (unsigned long)(*((unsigned long *) -- poid_par_priv->information_buf + 2)))) -- status = RNDIS_STATUS_NOT_ACCEPTED; -- } else { -- status = RNDIS_STATUS_INVALID_LENGTH; -- } -- return status; --} -- --uint oid_rt_pro_rf_read_registry_hdl(struct oid_par_priv *poid_par_priv) --{ -- uint status = RNDIS_STATUS_SUCCESS; -- struct _adapter *Adapter = poid_par_priv->adapter_context; -- -- if (poid_par_priv->type_of_oid != SET_OID) /* QUERY_OID */ -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len == (sizeof(unsigned long) * -- 3)) { -- if (Adapter->mppriv.act_in_progress) { -- status = RNDIS_STATUS_NOT_ACCEPTED; -- } else { -- /* init workparam */ -- Adapter->mppriv.act_in_progress = true; -- Adapter->mppriv.workparam.bcompleted = false; -- Adapter->mppriv.workparam.act_type = MPT_READ_RF; -- Adapter->mppriv.workparam.io_offset = *(unsigned long *) -- poid_par_priv->information_buf; -- Adapter->mppriv.workparam.io_value = 0xcccccccc; -- -- /* RegOffsetValue - The offset of RF register to read. -- * RegDataWidth - The data width of RF register to read. -- * RegDataValue - The value to read. -- * RegOffsetValue = *((unsigned long *)InformationBuffer); -- * RegDataWidth = *((unsigned long *)InformationBuffer+1); -- * RegDataValue = *((unsigned long *)InformationBuffer+2); -- */ -- if (r8712_getrfreg_cmd(Adapter, -- *(unsigned char *)poid_par_priv->information_buf, -- (unsigned char *)&Adapter->mppriv.workparam.io_value -- )) -- status = RNDIS_STATUS_NOT_ACCEPTED; -- } -- } else { -- status = RNDIS_STATUS_INVALID_LENGTH; -- } -- return status; --} -- --enum _CONNECT_STATE_ { -- CHECKINGSTATUS, -- ASSOCIATED, -- ADHOCMODE, -- NOTASSOCIATED --}; -- --uint oid_rt_get_connect_state_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *padapter = poid_par_priv->adapter_context; -- struct mlme_priv *pmlmepriv = &(padapter->mlmepriv); -- u32 ulInfo; -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- /* nStatus==0 CheckingStatus -- * nStatus==1 Associated -- * nStatus==2 AdHocMode -- * nStatus==3 NotAssociated -- */ -- if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) -- ulInfo = CHECKINGSTATUS; -- else if (check_fwstate(pmlmepriv, _FW_LINKED)) -- ulInfo = ASSOCIATED; -- else if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)) -- ulInfo = ADHOCMODE; -- else -- ulInfo = NOTASSOCIATED; -- *(u32 *)poid_par_priv->information_buf = ulInfo; -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_set_default_key_id_hdl(struct oid_par_priv *poid_par_priv) --{ -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- return RNDIS_STATUS_SUCCESS; --} -diff --git a/drivers/staging/rtl8712/rtl871x_ioctl_rtl.h b/drivers/staging/rtl8712/rtl871x_ioctl_rtl.h -deleted file mode 100644 -index 7c0b880ac68659..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_ioctl_rtl.h -+++ /dev/null -@@ -1,109 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef _RTL871X_IOCTL_RTL_H --#define _RTL871X_IOCTL_RTL_H -- --#include "osdep_service.h" --#include "drv_types.h" -- --/*************** oid_rtl_seg_01_01 **************/ --uint oid_rt_get_signal_quality_hdl( -- struct oid_par_priv *poid_par_priv);/*84*/ --uint oid_rt_get_small_packet_crc_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_middle_packet_crc_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_large_packet_crc_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_tx_retry_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_rx_retry_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_rx_total_packet_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_tx_beacon_ok_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_tx_beacon_err_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_rx_icv_err_hdl( -- struct oid_par_priv *poid_par_priv);/*93*/ --uint oid_rt_set_encryption_algorithm_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_preamble_mode_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_ap_ip_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_channelplan_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_set_channelplan_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_set_preamble_mode_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_set_bcn_intvl_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_dedicate_probe_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_total_tx_bytes_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_total_rx_bytes_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_current_tx_power_level_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_enc_key_mismatch_count_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_enc_key_match_count_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_channel_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_hardware_radio_off_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_key_mismatch_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_supported_wireless_mode_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_channel_list_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_scan_in_progress_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_forced_data_rate_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_wireless_mode_for_scan_list_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_bss_wireless_mode_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_scan_with_magic_packet_hdl( -- struct oid_par_priv *poid_par_priv); -- --/************** oid_rtl_seg_01_03 section start **************/ --uint oid_rt_ap_get_associated_station_list_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_ap_switch_into_ap_mode_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_ap_supported_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_ap_set_passphrase_hdl( -- struct oid_par_priv *poid_par_priv); --/* oid_rtl_seg_01_11 */ --uint oid_rt_pro_rf_write_registry_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_rf_read_registry_hdl( -- struct oid_par_priv *poid_par_priv); --/*************** oid_rtl_seg_03_00 section start **************/ --uint oid_rt_get_connect_state_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_set_default_key_id_hdl( -- struct oid_par_priv *poid_par_priv); -- --#endif -- -diff --git a/drivers/staging/rtl8712/rtl871x_ioctl_set.c b/drivers/staging/rtl8712/rtl871x_ioctl_set.c -deleted file mode 100644 -index 34c9a52b4c42a6..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_ioctl_set.c -+++ /dev/null -@@ -1,354 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * rtl871x_ioctl_set.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _RTL871X_IOCTL_SET_C_ -- --#include "osdep_service.h" --#include "drv_types.h" --#include "rtl871x_ioctl_set.h" --#include "usb_osintf.h" --#include "usb_ops.h" -- --static u8 validate_ssid(struct ndis_802_11_ssid *ssid) --{ -- u8 i; -- -- if (ssid->SsidLength > 32) -- return false; -- for (i = 0; i < ssid->SsidLength; i++) { -- /* wifi, printable ascii code must be supported */ -- if (!((ssid->Ssid[i] >= 0x20) && (ssid->Ssid[i] <= 0x7e))) -- return false; -- } -- return true; --} -- --static u8 do_join(struct _adapter *padapter) --{ -- struct list_head *plist, *phead; -- u8 *pibss = NULL; -- struct mlme_priv *pmlmepriv = &(padapter->mlmepriv); -- struct __queue *queue = &(pmlmepriv->scanned_queue); -- int ret; -- -- phead = &queue->queue; -- plist = phead->next; -- pmlmepriv->cur_network.join_res = -2; -- pmlmepriv->fw_state |= _FW_UNDER_LINKING; -- pmlmepriv->pscanned = plist; -- pmlmepriv->to_join = true; -- -- /* adhoc mode will start with an empty queue, but skip checking */ -- if (!check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) && -- list_empty(&queue->queue)) { -- if (pmlmepriv->fw_state & _FW_UNDER_LINKING) -- pmlmepriv->fw_state ^= _FW_UNDER_LINKING; -- /* when set_ssid/set_bssid for do_join(), but scanning queue -- * is empty we try to issue sitesurvey firstly -- */ -- if (!pmlmepriv->sitesurveyctrl.traffic_busy) -- r8712_sitesurvey_cmd(padapter, &pmlmepriv->assoc_ssid); -- return true; -- } -- -- ret = r8712_select_and_join_from_scan(pmlmepriv); -- if (!ret) { -- mod_timer(&pmlmepriv->assoc_timer, -- jiffies + msecs_to_jiffies(MAX_JOIN_TIMEOUT)); -- } else { -- if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)) { -- /* submit r8712_createbss_cmd to change to an -- * ADHOC_MASTER pmlmepriv->lock has been -- * acquired by caller... -- */ -- struct wlan_bssid_ex *pdev_network = -- &padapter->registrypriv.dev_network; -- pmlmepriv->fw_state = WIFI_ADHOC_MASTER_STATE; -- pibss = padapter->registrypriv.dev_network.MacAddress; -- memcpy(&pdev_network->Ssid, -- &pmlmepriv->assoc_ssid, -- sizeof(struct ndis_802_11_ssid)); -- r8712_update_registrypriv_dev_network(padapter); -- r8712_generate_random_ibss(pibss); -- if (r8712_createbss_cmd(padapter)) -- return false; -- pmlmepriv->to_join = false; -- } else { -- /* can't associate ; reset under-linking */ -- if (pmlmepriv->fw_state & _FW_UNDER_LINKING) -- pmlmepriv->fw_state ^= -- _FW_UNDER_LINKING; -- /* when set_ssid/set_bssid for do_join(), but -- * there are no desired bss in scanning queue -- * we try to issue sitesurvey first -- */ -- if (!pmlmepriv->sitesurveyctrl.traffic_busy) -- r8712_sitesurvey_cmd(padapter, -- &pmlmepriv->assoc_ssid); -- } -- } -- return true; --} -- --u8 r8712_set_802_11_bssid(struct _adapter *padapter, u8 *bssid) --{ -- unsigned long irqL; -- u8 status = true; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- -- if (is_zero_ether_addr(bssid) || is_broadcast_ether_addr(bssid)) { -- status = false; -- return status; -- } -- spin_lock_irqsave(&pmlmepriv->lock, irqL); -- if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY | -- _FW_UNDER_LINKING)) { -- status = check_fwstate(pmlmepriv, _FW_UNDER_LINKING); -- goto _Abort_Set_BSSID; -- } -- if (check_fwstate(pmlmepriv, -- _FW_LINKED | WIFI_ADHOC_MASTER_STATE)) { -- if (!memcmp(&pmlmepriv->cur_network.network.MacAddress, bssid, -- ETH_ALEN)) { -- if (!check_fwstate(pmlmepriv, WIFI_STATION_STATE)) -- /* driver is in -- * WIFI_ADHOC_MASTER_STATE -- */ -- goto _Abort_Set_BSSID; -- } else { -- r8712_disassoc_cmd(padapter); -- if (check_fwstate(pmlmepriv, _FW_LINKED)) -- r8712_ind_disconnect(padapter); -- r8712_free_assoc_resources(padapter); -- if ((check_fwstate(pmlmepriv, -- WIFI_ADHOC_MASTER_STATE))) { -- _clr_fwstate_(pmlmepriv, -- WIFI_ADHOC_MASTER_STATE); -- set_fwstate(pmlmepriv, WIFI_ADHOC_STATE); -- } -- } -- } -- memcpy(&pmlmepriv->assoc_bssid, bssid, ETH_ALEN); -- pmlmepriv->assoc_by_bssid = true; -- status = do_join(padapter); -- goto done; --_Abort_Set_BSSID: --done: -- spin_unlock_irqrestore(&pmlmepriv->lock, irqL); -- return status; --} -- --void r8712_set_802_11_ssid(struct _adapter *padapter, -- struct ndis_802_11_ssid *ssid) --{ -- unsigned long irqL; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct wlan_network *pnetwork = &pmlmepriv->cur_network; -- -- if (!padapter->hw_init_completed) -- return; -- spin_lock_irqsave(&pmlmepriv->lock, irqL); -- if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY | _FW_UNDER_LINKING)) { -- check_fwstate(pmlmepriv, _FW_UNDER_LINKING); -- goto _Abort_Set_SSID; -- } -- if (check_fwstate(pmlmepriv, _FW_LINKED | WIFI_ADHOC_MASTER_STATE)) { -- if ((pmlmepriv->assoc_ssid.SsidLength == ssid->SsidLength) && -- (!memcmp(&pmlmepriv->assoc_ssid.Ssid, ssid->Ssid, -- ssid->SsidLength))) { -- if (!check_fwstate(pmlmepriv, WIFI_STATION_STATE)) { -- if (!r8712_is_same_ibss(padapter, -- pnetwork)) { -- /* if in WIFI_ADHOC_MASTER_STATE or -- * WIFI_ADHOC_STATE, create bss or -- * rejoin again -- */ -- r8712_disassoc_cmd(padapter); -- if (check_fwstate(pmlmepriv, -- _FW_LINKED)) -- r8712_ind_disconnect(padapter); -- r8712_free_assoc_resources(padapter); -- if (check_fwstate(pmlmepriv, -- WIFI_ADHOC_MASTER_STATE)) { -- _clr_fwstate_(pmlmepriv, -- WIFI_ADHOC_MASTER_STATE); -- set_fwstate(pmlmepriv, -- WIFI_ADHOC_STATE); -- } -- } else { -- /* driver is in -- * WIFI_ADHOC_MASTER_STATE -- */ -- goto _Abort_Set_SSID; -- } -- } -- } else { -- r8712_disassoc_cmd(padapter); -- if (check_fwstate(pmlmepriv, _FW_LINKED)) -- r8712_ind_disconnect(padapter); -- r8712_free_assoc_resources(padapter); -- if (check_fwstate(pmlmepriv, -- WIFI_ADHOC_MASTER_STATE)) { -- _clr_fwstate_(pmlmepriv, -- WIFI_ADHOC_MASTER_STATE); -- set_fwstate(pmlmepriv, WIFI_ADHOC_STATE); -- } -- } -- } -- if (padapter->securitypriv.btkip_countermeasure) -- goto _Abort_Set_SSID; -- if (!validate_ssid(ssid)) -- goto _Abort_Set_SSID; -- memcpy(&pmlmepriv->assoc_ssid, ssid, sizeof(struct ndis_802_11_ssid)); -- pmlmepriv->assoc_by_bssid = false; -- do_join(padapter); -- goto done; --_Abort_Set_SSID: --done: -- spin_unlock_irqrestore(&pmlmepriv->lock, irqL); --} -- --void r8712_set_802_11_infrastructure_mode(struct _adapter *padapter, -- enum NDIS_802_11_NETWORK_INFRASTRUCTURE networktype) --{ -- unsigned long irqL; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct wlan_network *cur_network = &pmlmepriv->cur_network; -- enum NDIS_802_11_NETWORK_INFRASTRUCTURE *pold_state = -- &(cur_network->network.InfrastructureMode); -- -- if (*pold_state != networktype) { -- spin_lock_irqsave(&pmlmepriv->lock, irqL); -- if (check_fwstate(pmlmepriv, _FW_LINKED) || -- (*pold_state == Ndis802_11IBSS)) -- r8712_disassoc_cmd(padapter); -- if (check_fwstate(pmlmepriv, -- _FW_LINKED | WIFI_ADHOC_MASTER_STATE)) -- r8712_free_assoc_resources(padapter); -- if (check_fwstate(pmlmepriv, _FW_LINKED) || -- (*pold_state == Ndis802_11Infrastructure) || -- (*pold_state == Ndis802_11IBSS)) { -- /* will clr Linked_state before this function, -- * we must have checked whether issue dis-assoc_cmd or -- * not -- */ -- r8712_ind_disconnect(padapter); -- } -- *pold_state = networktype; -- /* clear WIFI_STATION_STATE; WIFI_AP_STATE; WIFI_ADHOC_STATE; -- * WIFI_ADHOC_MASTER_STATE -- */ -- _clr_fwstate_(pmlmepriv, WIFI_STATION_STATE | WIFI_AP_STATE | -- WIFI_ADHOC_STATE | WIFI_ADHOC_MASTER_STATE); -- switch (networktype) { -- case Ndis802_11IBSS: -- set_fwstate(pmlmepriv, WIFI_ADHOC_STATE); -- break; -- case Ndis802_11Infrastructure: -- set_fwstate(pmlmepriv, WIFI_STATION_STATE); -- break; -- case Ndis802_11APMode: -- set_fwstate(pmlmepriv, WIFI_AP_STATE); -- break; -- case Ndis802_11AutoUnknown: -- case Ndis802_11InfrastructureMax: -- break; -- } -- spin_unlock_irqrestore(&pmlmepriv->lock, irqL); -- } --} -- --u8 r8712_set_802_11_disassociate(struct _adapter *padapter) --{ -- unsigned long irqL; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- -- spin_lock_irqsave(&pmlmepriv->lock, irqL); -- if (check_fwstate(pmlmepriv, _FW_LINKED)) { -- r8712_disassoc_cmd(padapter); -- r8712_ind_disconnect(padapter); -- r8712_free_assoc_resources(padapter); -- } -- spin_unlock_irqrestore(&pmlmepriv->lock, irqL); -- return true; --} -- --u8 r8712_set_802_11_bssid_list_scan(struct _adapter *padapter) --{ -- struct mlme_priv *pmlmepriv = NULL; -- unsigned long irqL; -- u8 ret = true; -- -- if (!padapter) -- return false; -- pmlmepriv = &padapter->mlmepriv; -- if (!padapter->hw_init_completed) -- return false; -- spin_lock_irqsave(&pmlmepriv->lock, irqL); -- if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY | _FW_UNDER_LINKING) || -- pmlmepriv->sitesurveyctrl.traffic_busy) { -- /* Scan or linking is in progress, do nothing. */ -- ret = (u8)check_fwstate(pmlmepriv, _FW_UNDER_SURVEY); -- } else { -- r8712_free_network_queue(padapter); -- ret = r8712_sitesurvey_cmd(padapter, NULL); -- } -- spin_unlock_irqrestore(&pmlmepriv->lock, irqL); -- return ret; --} -- --u8 r8712_set_802_11_authentication_mode(struct _adapter *padapter, -- enum NDIS_802_11_AUTHENTICATION_MODE authmode) --{ -- struct security_priv *psecuritypriv = &padapter->securitypriv; -- u8 ret; -- -- psecuritypriv->ndisauthtype = authmode; -- if (psecuritypriv->ndisauthtype > 3) -- psecuritypriv->AuthAlgrthm = 2; /* 802.1x */ -- if (r8712_set_auth(padapter, psecuritypriv)) -- ret = false; -- else -- ret = true; -- return ret; --} -- --int r8712_set_802_11_add_wep(struct _adapter *padapter, -- struct NDIS_802_11_WEP *wep) --{ -- sint keyid; -- struct security_priv *psecuritypriv = &padapter->securitypriv; -- -- keyid = wep->KeyIndex & 0x3fffffff; -- if (keyid >= WEP_KEYS) -- return -EINVAL; -- switch (wep->KeyLength) { -- case 5: -- psecuritypriv->PrivacyAlgrthm = _WEP40_; -- break; -- case 13: -- psecuritypriv->PrivacyAlgrthm = _WEP104_; -- break; -- default: -- psecuritypriv->PrivacyAlgrthm = _NO_PRIVACY_; -- break; -- } -- memcpy(psecuritypriv->DefKey[keyid].skey, &wep->KeyMaterial, -- wep->KeyLength); -- psecuritypriv->DefKeylen[keyid] = wep->KeyLength; -- psecuritypriv->PrivacyKeyIndex = keyid; -- return r8712_set_key(padapter, psecuritypriv, keyid); --} -diff --git a/drivers/staging/rtl8712/rtl871x_ioctl_set.h b/drivers/staging/rtl8712/rtl871x_ioctl_set.h -deleted file mode 100644 -index e2de820f61d985..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_ioctl_set.h -+++ /dev/null -@@ -1,45 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __IOCTL_SET_H --#define __IOCTL_SET_H -- --#include "drv_types.h" -- --typedef u8 NDIS_802_11_PMKID_VALUE[16]; -- --struct BSSIDInfo { -- unsigned char BSSID[6]; -- NDIS_802_11_PMKID_VALUE PMKID; --}; -- --u8 r8712_set_802_11_authentication_mode(struct _adapter *pdapter, -- enum NDIS_802_11_AUTHENTICATION_MODE authmode); -- --u8 r8712_set_802_11_bssid(struct _adapter *padapter, u8 *bssid); -- --int r8712_set_802_11_add_wep(struct _adapter *padapter, -- struct NDIS_802_11_WEP *wep); -- --u8 r8712_set_802_11_disassociate(struct _adapter *padapter); -- --u8 r8712_set_802_11_bssid_list_scan(struct _adapter *padapter); -- --void r8712_set_802_11_infrastructure_mode(struct _adapter *padapter, -- enum NDIS_802_11_NETWORK_INFRASTRUCTURE networktype); -- --void r8712_set_802_11_ssid(struct _adapter *padapter, -- struct ndis_802_11_ssid *ssid); -- --#endif -- -diff --git a/drivers/staging/rtl8712/rtl871x_led.h b/drivers/staging/rtl8712/rtl871x_led.h -deleted file mode 100644 -index 2f0768132ad8ff..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_led.h -+++ /dev/null -@@ -1,118 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __RTL8712_LED_H --#define __RTL8712_LED_H -- --#include "osdep_service.h" --#include "drv_types.h" -- --/*=========================================================================== -- * LED customization. -- *=========================================================================== -- */ --enum LED_CTL_MODE { -- LED_CTL_POWER_ON = 1, -- LED_CTL_LINK = 2, -- LED_CTL_NO_LINK = 3, -- LED_CTL_TX = 4, -- LED_CTL_RX = 5, -- LED_CTL_SITE_SURVEY = 6, -- LED_CTL_POWER_OFF = 7, -- LED_CTL_START_TO_LINK = 8, -- LED_CTL_START_WPS = 9, -- LED_CTL_STOP_WPS = 10, -- LED_CTL_START_WPS_BOTTON = 11, -- LED_CTL_STOP_WPS_FAIL = 12, -- LED_CTL_STOP_WPS_FAIL_OVERLAP = 13, --}; -- --#define IS_LED_WPS_BLINKING(_LED_871x) \ -- (((struct LED_871x *)_LED_871x)->CurrLedState == LED_BLINK_WPS \ -- || ((struct LED_871x *)_LED_871x)->CurrLedState == LED_BLINK_WPS_STOP \ -- || ((struct LED_871x *)_LED_871x)->bLedWPSBlinkInProgress) -- --#define IS_LED_BLINKING(_LED_871x) \ -- (((struct LED_871x *)_LED_871x)->bLedWPSBlinkInProgress \ -- || ((struct LED_871x *)_LED_871x)->bLedScanBlinkInProgress) -- --enum LED_PIN_871x { -- LED_PIN_GPIO0, -- LED_PIN_LED0, -- LED_PIN_LED1 --}; -- --/*=========================================================================== -- * LED customization. -- *=========================================================================== -- */ --enum LED_STRATEGY_871x { -- SW_LED_MODE0, /* SW control 1 LED via GPIO0. It is default option. */ -- SW_LED_MODE1, /* 2 LEDs, through LED0 and LED1. For ALPHA. */ -- SW_LED_MODE2, /* SW control 1 LED via GPIO0, -- * custom for AzWave 8187 minicard. -- */ -- SW_LED_MODE3, /* SW control 1 LED via GPIO0, -- * customized for Sercomm Printer Server case. -- */ -- SW_LED_MODE4, /*for Edimax / Belkin*/ -- SW_LED_MODE5, /*for Sercomm / Belkin*/ -- SW_LED_MODE6, /*for WNC / Corega*/ -- HW_LED, /* HW control 2 LEDs, LED0 and LED1 (there are 4 different -- * control modes, see MAC.CONFIG1 for details.) -- */ --}; -- --struct LED_871x { -- struct _adapter *padapter; -- enum LED_PIN_871x LedPin; /* Implementation for this SW led. */ -- u32 CurrLedState; /* Current LED state. */ -- u8 bLedOn; /* true if LED is ON */ -- u8 bSWLedCtrl; -- u8 bLedBlinkInProgress; /*true if blinking */ -- u8 bLedNoLinkBlinkInProgress; -- u8 bLedLinkBlinkInProgress; -- u8 bLedStartToLinkBlinkInProgress; -- u8 bLedScanBlinkInProgress; -- u8 bLedWPSBlinkInProgress; -- u32 BlinkTimes; /* No. times to toggle for blink.*/ -- u32 BlinkingLedState; /* Next state for blinking, -- * either LED_ON or OFF. -- */ -- -- struct timer_list BlinkTimer; /* Timer object for led blinking.*/ -- struct work_struct BlinkWorkItem; /* Workitem used by BlinkTimer */ --}; -- --struct led_priv { -- /* add for led control */ -- struct LED_871x SwLed0; -- struct LED_871x SwLed1; -- enum LED_STRATEGY_871x LedStrategy; -- u8 bRegUseLed; -- void (*LedControlHandler)(struct _adapter *padapter, -- enum LED_CTL_MODE LedAction); -- /* add for led control */ --}; -- --/*=========================================================================== -- * Interface to manipulate LED objects. -- *=========================================================================== -- */ --void r8712_InitSwLeds(struct _adapter *padapter); --void r8712_DeInitSwLeds(struct _adapter *padapter); --void LedControl871x(struct _adapter *padapter, enum LED_CTL_MODE LedAction); --void r8712_flush_led_works(struct _adapter *padapter); -- --#endif -- -diff --git a/drivers/staging/rtl8712/rtl871x_mlme.c b/drivers/staging/rtl8712/rtl871x_mlme.c -deleted file mode 100644 -index fccfa0915a0280..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_mlme.c -+++ /dev/null -@@ -1,1710 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * rtl871x_mlme.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _RTL871X_MLME_C_ -- --#include -- --#include "osdep_service.h" --#include "drv_types.h" --#include "recv_osdep.h" --#include "xmit_osdep.h" --#include "mlme_osdep.h" --#include "sta_info.h" --#include "wifi.h" --#include "wlan_bssdef.h" -- --static void update_ht_cap(struct _adapter *padapter, u8 *pie, uint ie_len); -- --int r8712_init_mlme_priv(struct _adapter *padapter) --{ -- sint i; -- u8 *pbuf; -- struct wlan_network *pnetwork; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- -- memset((u8 *)pmlmepriv, 0, sizeof(struct mlme_priv)); -- pmlmepriv->nic_hdl = (u8 *)padapter; -- pmlmepriv->pscanned = NULL; -- pmlmepriv->fw_state = 0; -- pmlmepriv->cur_network.network.InfrastructureMode = -- Ndis802_11AutoUnknown; -- /* Maybe someday we should rename this variable to "active_mode"(Jeff)*/ -- pmlmepriv->passive_mode = 1; /* 1: active, 0: passive. */ -- spin_lock_init(&(pmlmepriv->lock)); -- spin_lock_init(&(pmlmepriv->lock2)); -- _init_queue(&(pmlmepriv->free_bss_pool)); -- _init_queue(&(pmlmepriv->scanned_queue)); -- set_scanned_network_val(pmlmepriv, 0); -- memset(&pmlmepriv->assoc_ssid, 0, sizeof(struct ndis_802_11_ssid)); -- pbuf = kmalloc_array(MAX_BSS_CNT, sizeof(struct wlan_network), -- GFP_ATOMIC); -- if (!pbuf) -- return -ENOMEM; -- pmlmepriv->free_bss_buf = pbuf; -- pnetwork = (struct wlan_network *)pbuf; -- for (i = 0; i < MAX_BSS_CNT; i++) { -- INIT_LIST_HEAD(&(pnetwork->list)); -- list_add_tail(&(pnetwork->list), -- &(pmlmepriv->free_bss_pool.queue)); -- pnetwork++; -- } -- pmlmepriv->sitesurveyctrl.last_rx_pkts = 0; -- pmlmepriv->sitesurveyctrl.last_tx_pkts = 0; -- pmlmepriv->sitesurveyctrl.traffic_busy = false; -- /* allocate DMA-able/Non-Page memory for cmd_buf and rsp_buf */ -- r8712_init_mlme_timer(padapter); -- return 0; --} -- --struct wlan_network *_r8712_alloc_network(struct mlme_priv *pmlmepriv) --{ -- unsigned long irqL; -- struct wlan_network *pnetwork; -- struct __queue *free_queue = &pmlmepriv->free_bss_pool; -- -- spin_lock_irqsave(&free_queue->lock, irqL); -- pnetwork = list_first_entry_or_null(&free_queue->queue, -- struct wlan_network, list); -- if (pnetwork) { -- list_del_init(&pnetwork->list); -- pnetwork->last_scanned = jiffies; -- pmlmepriv->num_of_scanned++; -- } -- spin_unlock_irqrestore(&free_queue->lock, irqL); -- return pnetwork; --} -- --static void _free_network(struct mlme_priv *pmlmepriv, -- struct wlan_network *pnetwork) --{ -- u32 curr_time, delta_time; -- unsigned long irqL; -- struct __queue *free_queue = &(pmlmepriv->free_bss_pool); -- -- if (!pnetwork) -- return; -- if (pnetwork->fixed) -- return; -- curr_time = jiffies; -- delta_time = (curr_time - (u32)pnetwork->last_scanned) / HZ; -- if (delta_time < SCANQUEUE_LIFETIME) -- return; -- spin_lock_irqsave(&free_queue->lock, irqL); -- list_del_init(&pnetwork->list); -- list_add_tail(&pnetwork->list, &free_queue->queue); -- pmlmepriv->num_of_scanned--; -- spin_unlock_irqrestore(&free_queue->lock, irqL); --} -- --static void free_network_nolock(struct mlme_priv *pmlmepriv, -- struct wlan_network *pnetwork) --{ -- struct __queue *free_queue = &pmlmepriv->free_bss_pool; -- -- if (!pnetwork) -- return; -- if (pnetwork->fixed) -- return; -- list_del_init(&pnetwork->list); -- list_add_tail(&pnetwork->list, &free_queue->queue); -- pmlmepriv->num_of_scanned--; --} -- --/* return the wlan_network with the matching addr -- * Shall be called under atomic context... -- * to avoid possible racing condition... -- */ --static struct wlan_network *r8712_find_network(struct __queue *scanned_queue, -- u8 *addr) --{ -- unsigned long irqL; -- struct list_head *phead, *plist; -- struct wlan_network *pnetwork = NULL; -- -- if (is_zero_ether_addr(addr)) -- return NULL; -- spin_lock_irqsave(&scanned_queue->lock, irqL); -- phead = &scanned_queue->queue; -- list_for_each(plist, phead) { -- pnetwork = list_entry(plist, struct wlan_network, list); -- if (!memcmp(addr, pnetwork->network.MacAddress, ETH_ALEN)) -- break; -- } -- if (plist == phead) -- pnetwork = NULL; -- spin_unlock_irqrestore(&scanned_queue->lock, irqL); -- return pnetwork; --} -- --void r8712_free_network_queue(struct _adapter *padapter) --{ -- unsigned long irqL; -- struct list_head *phead, *plist; -- struct wlan_network *pnetwork; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct __queue *scanned_queue = &pmlmepriv->scanned_queue; -- -- spin_lock_irqsave(&scanned_queue->lock, irqL); -- phead = &scanned_queue->queue; -- plist = phead->next; -- while (!end_of_queue_search(phead, plist)) { -- pnetwork = container_of(plist, struct wlan_network, list); -- plist = plist->next; -- _free_network(pmlmepriv, pnetwork); -- } -- spin_unlock_irqrestore(&scanned_queue->lock, irqL); --} -- --sint r8712_if_up(struct _adapter *padapter) --{ -- sint res; -- -- if (padapter->driver_stopped || padapter->surprise_removed || -- !check_fwstate(&padapter->mlmepriv, _FW_LINKED)) { -- res = false; -- } else { -- res = true; -- } -- return res; --} -- --void r8712_generate_random_ibss(u8 *pibss) --{ -- u32 curtime = jiffies; -- -- pibss[0] = 0x02; /*in ad-hoc mode bit1 must set to 1 */ -- pibss[1] = 0x11; -- pibss[2] = 0x87; -- pibss[3] = (u8)(curtime & 0xff); -- pibss[4] = (u8)((curtime >> 8) & 0xff); -- pibss[5] = (u8)((curtime >> 16) & 0xff); --} -- --uint r8712_get_wlan_bssid_ex_sz(struct wlan_bssid_ex *bss) --{ -- return sizeof(*bss) + bss->IELength - MAX_IE_SZ; --} -- --u8 *r8712_get_capability_from_ie(u8 *ie) --{ -- return ie + 8 + 2; --} -- --void r8712_free_mlme_priv(struct mlme_priv *pmlmepriv) --{ -- kfree(pmlmepriv->free_bss_buf); --} -- --static struct wlan_network *alloc_network(struct mlme_priv *pmlmepriv) --{ -- return _r8712_alloc_network(pmlmepriv); --} -- --int r8712_is_same_ibss(struct _adapter *adapter, struct wlan_network *pnetwork) --{ -- int ret = true; -- struct security_priv *psecuritypriv = &adapter->securitypriv; -- -- if ((psecuritypriv->PrivacyAlgrthm != _NO_PRIVACY_) && -- (pnetwork->network.Privacy == cpu_to_le32(0))) -- ret = false; -- else if ((psecuritypriv->PrivacyAlgrthm == _NO_PRIVACY_) && -- (pnetwork->network.Privacy == cpu_to_le32(1))) -- ret = false; -- else -- ret = true; -- return ret; -- --} -- --static int is_same_network(struct wlan_bssid_ex *src, -- struct wlan_bssid_ex *dst) --{ -- u16 s_cap, d_cap; -- -- memcpy((u8 *)&s_cap, r8712_get_capability_from_ie(src->IEs), 2); -- memcpy((u8 *)&d_cap, r8712_get_capability_from_ie(dst->IEs), 2); -- return (src->Ssid.SsidLength == dst->Ssid.SsidLength) && -- (src->Configuration.DSConfig == -- dst->Configuration.DSConfig) && -- ((!memcmp(src->MacAddress, dst->MacAddress, -- ETH_ALEN))) && -- ((!memcmp(src->Ssid.Ssid, -- dst->Ssid.Ssid, -- src->Ssid.SsidLength))) && -- ((s_cap & WLAN_CAPABILITY_IBSS) == -- (d_cap & WLAN_CAPABILITY_IBSS)) && -- ((s_cap & WLAN_CAPABILITY_ESS) == -- (d_cap & WLAN_CAPABILITY_ESS)); -- --} -- --struct wlan_network *r8712_get_oldest_wlan_network( -- struct __queue *scanned_queue) --{ -- struct list_head *plist, *phead; -- struct wlan_network *pwlan = NULL; -- struct wlan_network *oldest = NULL; -- -- phead = &scanned_queue->queue; -- plist = phead->next; -- while (1) { -- if (end_of_queue_search(phead, plist)) -- break; -- pwlan = container_of(plist, struct wlan_network, list); -- if (!pwlan->fixed) { -- if (!oldest || -- time_after((unsigned long)oldest->last_scanned, -- (unsigned long)pwlan->last_scanned)) -- oldest = pwlan; -- } -- plist = plist->next; -- } -- return oldest; --} -- --static void update_network(struct wlan_bssid_ex *dst, -- struct wlan_bssid_ex *src, -- struct _adapter *padapter) --{ -- u32 last_evm = 0, tmpVal; -- struct smooth_rssi_data *sqd = &padapter->recvpriv.signal_qual_data; -- -- if (check_fwstate(&padapter->mlmepriv, _FW_LINKED) && -- is_same_network(&(padapter->mlmepriv.cur_network.network), src)) { -- if (padapter->recvpriv.signal_qual_data.total_num++ >= -- PHY_LINKQUALITY_SLID_WIN_MAX) { -- padapter->recvpriv.signal_qual_data.total_num = -- PHY_LINKQUALITY_SLID_WIN_MAX; -- last_evm = sqd->elements[sqd->index]; -- padapter->recvpriv.signal_qual_data.total_val -= -- last_evm; -- } -- padapter->recvpriv.signal_qual_data.total_val += src->Rssi; -- -- sqd->elements[sqd->index++] = src->Rssi; -- if (padapter->recvpriv.signal_qual_data.index >= -- PHY_LINKQUALITY_SLID_WIN_MAX) -- padapter->recvpriv.signal_qual_data.index = 0; -- /* <1> Showed on UI for user, in percentage. */ -- tmpVal = padapter->recvpriv.signal_qual_data.total_val / -- padapter->recvpriv.signal_qual_data.total_num; -- padapter->recvpriv.signal = (u8)tmpVal; -- -- src->Rssi = padapter->recvpriv.signal; -- } else { -- src->Rssi = (src->Rssi + dst->Rssi) / 2; -- } -- memcpy((u8 *)dst, (u8 *)src, r8712_get_wlan_bssid_ex_sz(src)); --} -- --static void update_current_network(struct _adapter *adapter, -- struct wlan_bssid_ex *pnetwork) --{ -- struct mlme_priv *pmlmepriv = &adapter->mlmepriv; -- -- if (is_same_network(&(pmlmepriv->cur_network.network), pnetwork)) { -- update_network(&(pmlmepriv->cur_network.network), -- pnetwork, adapter); -- r8712_update_protection(adapter, -- (pmlmepriv->cur_network.network.IEs) + -- sizeof(struct NDIS_802_11_FIXED_IEs), -- pmlmepriv->cur_network.network.IELength); -- } --} -- --/* Caller must hold pmlmepriv->lock first */ --static void update_scanned_network(struct _adapter *adapter, -- struct wlan_bssid_ex *target) --{ -- struct list_head *plist, *phead; -- -- u32 bssid_ex_sz; -- struct mlme_priv *pmlmepriv = &adapter->mlmepriv; -- struct __queue *queue = &pmlmepriv->scanned_queue; -- struct wlan_network *pnetwork = NULL; -- struct wlan_network *oldest = NULL; -- -- phead = &queue->queue; -- plist = phead->next; -- -- while (1) { -- if (end_of_queue_search(phead, plist)) -- break; -- -- pnetwork = container_of(plist, struct wlan_network, list); -- if (is_same_network(&pnetwork->network, target)) -- break; -- if ((oldest == ((struct wlan_network *)0)) || -- time_after((unsigned long)oldest->last_scanned, -- (unsigned long)pnetwork->last_scanned)) -- oldest = pnetwork; -- -- plist = plist->next; -- } -- -- /* If we didn't find a match, then get a new network slot to initialize -- * with this beacon's information -- */ -- if (end_of_queue_search(phead, plist)) { -- if (list_empty(&pmlmepriv->free_bss_pool.queue)) { -- /* If there are no more slots, expire the oldest */ -- pnetwork = oldest; -- target->Rssi = (pnetwork->network.Rssi + -- target->Rssi) / 2; -- memcpy(&pnetwork->network, target, -- r8712_get_wlan_bssid_ex_sz(target)); -- pnetwork->last_scanned = jiffies; -- } else { -- /* Otherwise just pull from the free list */ -- /* update scan_time */ -- pnetwork = alloc_network(pmlmepriv); -- if (!pnetwork) -- return; -- bssid_ex_sz = r8712_get_wlan_bssid_ex_sz(target); -- target->Length = bssid_ex_sz; -- memcpy(&pnetwork->network, target, bssid_ex_sz); -- list_add_tail(&pnetwork->list, &queue->queue); -- } -- } else { -- /* we have an entry and we are going to update it. But -- * this entry may be already expired. In this case we -- * do the same as we found a new net and call the new_net -- * handler -- */ -- update_network(&pnetwork->network, target, adapter); -- pnetwork->last_scanned = jiffies; -- } --} -- --static void rtl8711_add_network(struct _adapter *adapter, -- struct wlan_bssid_ex *pnetwork) --{ -- unsigned long irqL; -- struct mlme_priv *pmlmepriv = &(((struct _adapter *)adapter)->mlmepriv); -- struct __queue *queue = &pmlmepriv->scanned_queue; -- -- spin_lock_irqsave(&queue->lock, irqL); -- update_current_network(adapter, pnetwork); -- update_scanned_network(adapter, pnetwork); -- spin_unlock_irqrestore(&queue->lock, irqL); --} -- --/*select the desired network based on the capability of the (i)bss. -- * check items: (1) security -- * (2) network_type -- * (3) WMM -- * (4) HT -- * (5) others -- */ --static int is_desired_network(struct _adapter *adapter, -- struct wlan_network *pnetwork) --{ -- u8 wps_ie[512]; -- uint wps_ielen; -- int bselected = true; -- struct security_priv *psecuritypriv = &adapter->securitypriv; -- -- if (psecuritypriv->wps_phase) { -- if (r8712_get_wps_ie(pnetwork->network.IEs, -- pnetwork->network.IELength, wps_ie, -- &wps_ielen)) -- return true; -- return false; -- } -- if ((psecuritypriv->PrivacyAlgrthm != _NO_PRIVACY_) && -- (pnetwork->network.Privacy == 0)) -- bselected = false; -- if (check_fwstate(&adapter->mlmepriv, WIFI_ADHOC_STATE)) { -- if (pnetwork->network.InfrastructureMode != -- adapter->mlmepriv.cur_network.network.InfrastructureMode) -- bselected = false; -- } -- return bselected; --} -- --/* TODO: Perry : For Power Management */ --void r8712_atimdone_event_callback(struct _adapter *adapter, u8 *pbuf) --{ --} -- --void r8712_survey_event_callback(struct _adapter *adapter, u8 *pbuf) --{ -- unsigned long flags; -- u32 len; -- struct wlan_bssid_ex *pnetwork; -- struct mlme_priv *pmlmepriv = &adapter->mlmepriv; -- -- pnetwork = (struct wlan_bssid_ex *)pbuf; --#ifdef __BIG_ENDIAN -- /* endian_convert */ -- pnetwork->Length = le32_to_cpu(pnetwork->Length); -- pnetwork->Ssid.SsidLength = le32_to_cpu(pnetwork->Ssid.SsidLength); -- pnetwork->Privacy = le32_to_cpu(pnetwork->Privacy); -- pnetwork->Rssi = le32_to_cpu(pnetwork->Rssi); -- pnetwork->NetworkTypeInUse = le32_to_cpu(pnetwork->NetworkTypeInUse); -- pnetwork->Configuration.ATIMWindow = -- le32_to_cpu(pnetwork->Configuration.ATIMWindow); -- pnetwork->Configuration.BeaconPeriod = -- le32_to_cpu(pnetwork->Configuration.BeaconPeriod); -- pnetwork->Configuration.DSConfig = -- le32_to_cpu(pnetwork->Configuration.DSConfig); -- pnetwork->Configuration.FHConfig.DwellTime = -- le32_to_cpu(pnetwork->Configuration.FHConfig.DwellTime); -- pnetwork->Configuration.FHConfig.HopPattern = -- le32_to_cpu(pnetwork->Configuration.FHConfig.HopPattern); -- pnetwork->Configuration.FHConfig.HopSet = -- le32_to_cpu(pnetwork->Configuration.FHConfig.HopSet); -- pnetwork->Configuration.FHConfig.Length = -- le32_to_cpu(pnetwork->Configuration.FHConfig.Length); -- pnetwork->Configuration.Length = -- le32_to_cpu(pnetwork->Configuration.Length); -- pnetwork->InfrastructureMode = -- le32_to_cpu(pnetwork->InfrastructureMode); -- pnetwork->IELength = le32_to_cpu(pnetwork->IELength); --#endif -- len = r8712_get_wlan_bssid_ex_sz(pnetwork); -- if (len > sizeof(struct wlan_bssid_ex)) -- return; -- spin_lock_irqsave(&pmlmepriv->lock2, flags); -- /* update IBSS_network 's timestamp */ -- if (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) { -- if (!memcmp(&(pmlmepriv->cur_network.network.MacAddress), -- pnetwork->MacAddress, ETH_ALEN)) { -- struct wlan_network *ibss_wlan = NULL; -- -- memcpy(pmlmepriv->cur_network.network.IEs, -- pnetwork->IEs, 8); -- ibss_wlan = r8712_find_network( -- &pmlmepriv->scanned_queue, -- pnetwork->MacAddress); -- if (ibss_wlan) { -- memcpy(ibss_wlan->network.IEs, -- pnetwork->IEs, 8); -- goto exit; -- } -- } -- } -- /* lock pmlmepriv->lock when you accessing network_q */ -- if (!check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) { -- if (pnetwork->Ssid.Ssid[0] != 0) { -- rtl8711_add_network(adapter, pnetwork); -- } else { -- pnetwork->Ssid.SsidLength = 8; -- memcpy(pnetwork->Ssid.Ssid, "", 8); -- rtl8711_add_network(adapter, pnetwork); -- } -- } --exit: -- spin_unlock_irqrestore(&pmlmepriv->lock2, flags); --} -- --void r8712_surveydone_event_callback(struct _adapter *adapter, u8 *pbuf) --{ -- unsigned long irqL; -- struct mlme_priv *pmlmepriv = &adapter->mlmepriv; -- -- spin_lock_irqsave(&pmlmepriv->lock, irqL); -- -- if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY)) { -- del_timer(&pmlmepriv->scan_to_timer); -- -- _clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY); -- } -- -- if (pmlmepriv->to_join) { -- if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)) { -- if (!check_fwstate(pmlmepriv, _FW_LINKED)) { -- set_fwstate(pmlmepriv, _FW_UNDER_LINKING); -- -- if (!r8712_select_and_join_from_scan(pmlmepriv)) { -- mod_timer(&pmlmepriv->assoc_timer, jiffies + -- msecs_to_jiffies(MAX_JOIN_TIMEOUT)); -- } else { -- struct wlan_bssid_ex *pdev_network = -- &(adapter->registrypriv.dev_network); -- u8 *pibss = -- adapter->registrypriv.dev_network.MacAddress; -- pmlmepriv->fw_state ^= _FW_UNDER_SURVEY; -- memcpy(&pdev_network->Ssid, -- &pmlmepriv->assoc_ssid, -- sizeof(struct -- ndis_802_11_ssid)); -- r8712_update_registrypriv_dev_network -- (adapter); -- r8712_generate_random_ibss(pibss); -- pmlmepriv->fw_state = -- WIFI_ADHOC_MASTER_STATE; -- pmlmepriv->to_join = false; -- } -- } -- } else { -- pmlmepriv->to_join = false; -- set_fwstate(pmlmepriv, _FW_UNDER_LINKING); -- if (!r8712_select_and_join_from_scan(pmlmepriv)) -- mod_timer(&pmlmepriv->assoc_timer, jiffies + -- msecs_to_jiffies(MAX_JOIN_TIMEOUT)); -- else -- _clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING); -- } -- } -- spin_unlock_irqrestore(&pmlmepriv->lock, irqL); --} -- --/* -- *r8712_free_assoc_resources: the caller has to lock pmlmepriv->lock -- */ --void r8712_free_assoc_resources(struct _adapter *adapter) --{ -- unsigned long irqL; -- struct wlan_network *pwlan = NULL; -- struct mlme_priv *pmlmepriv = &adapter->mlmepriv; -- struct sta_priv *pstapriv = &adapter->stapriv; -- struct wlan_network *tgt_network = &pmlmepriv->cur_network; -- -- pwlan = r8712_find_network(&pmlmepriv->scanned_queue, -- tgt_network->network.MacAddress); -- -- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE | WIFI_AP_STATE)) { -- struct sta_info *psta; -- -- psta = r8712_get_stainfo(&adapter->stapriv, -- tgt_network->network.MacAddress); -- -- spin_lock_irqsave(&pstapriv->sta_hash_lock, irqL); -- r8712_free_stainfo(adapter, psta); -- spin_unlock_irqrestore(&pstapriv->sta_hash_lock, irqL); -- } -- -- if (check_fwstate(pmlmepriv, -- WIFI_ADHOC_STATE | WIFI_ADHOC_MASTER_STATE | WIFI_AP_STATE)) -- r8712_free_all_stainfo(adapter); -- if (pwlan) -- pwlan->fixed = false; -- -- if (((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) && -- (adapter->stapriv.asoc_sta_count == 1))) -- free_network_nolock(pmlmepriv, pwlan); --} -- --/* -- * r8712_indicate_connect: the caller has to lock pmlmepriv->lock -- */ --void r8712_indicate_connect(struct _adapter *padapter) --{ -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- -- pmlmepriv->to_join = false; -- set_fwstate(pmlmepriv, _FW_LINKED); -- padapter->ledpriv.LedControlHandler(padapter, LED_CTL_LINK); -- r8712_os_indicate_connect(padapter); -- if (padapter->registrypriv.power_mgnt > PS_MODE_ACTIVE) -- mod_timer(&pmlmepriv->dhcp_timer, -- jiffies + msecs_to_jiffies(60000)); --} -- --/* -- * r8712_ind_disconnect: the caller has to lock pmlmepriv->lock -- */ --void r8712_ind_disconnect(struct _adapter *padapter) --{ -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- -- if (check_fwstate(pmlmepriv, _FW_LINKED)) { -- _clr_fwstate_(pmlmepriv, _FW_LINKED); -- padapter->ledpriv.LedControlHandler(padapter, LED_CTL_NO_LINK); -- r8712_os_indicate_disconnect(padapter); -- } -- if (padapter->pwrctrlpriv.pwr_mode != -- padapter->registrypriv.power_mgnt) { -- del_timer(&pmlmepriv->dhcp_timer); -- r8712_set_ps_mode(padapter, padapter->registrypriv.power_mgnt, -- padapter->registrypriv.smart_ps); -- } --} -- --/*Notes: -- *pnetwork : returns from r8712_joinbss_event_callback -- *ptarget_wlan: found from scanned_queue -- *if join_res > 0, for (fw_state==WIFI_STATION_STATE), we check if -- * "ptarget_sta" & "ptarget_wlan" exist. -- *if join_res > 0, for (fw_state==WIFI_ADHOC_STATE), we only check -- * if "ptarget_wlan" exist. -- *if join_res > 0, update "cur_network->network" from -- * "pnetwork->network" if (ptarget_wlan !=NULL). -- */ --void r8712_joinbss_event_callback(struct _adapter *adapter, u8 *pbuf) --{ -- unsigned long irqL = 0, irqL2; -- struct sta_info *ptarget_sta = NULL, *pcur_sta = NULL; -- struct sta_priv *pstapriv = &adapter->stapriv; -- struct mlme_priv *pmlmepriv = &adapter->mlmepriv; -- struct wlan_network *cur_network = &pmlmepriv->cur_network; -- struct wlan_network *pcur_wlan = NULL, *ptarget_wlan = NULL; -- unsigned int the_same_macaddr = false; -- struct wlan_network *pnetwork; -- -- if (sizeof(struct list_head) == 4 * sizeof(u32)) { -- pnetwork = kmalloc(sizeof(struct wlan_network), GFP_ATOMIC); -- if (!pnetwork) -- return; -- memcpy((u8 *)pnetwork + 16, (u8 *)pbuf + 8, -- sizeof(struct wlan_network) - 16); -- } else { -- pnetwork = (struct wlan_network *)pbuf; -- } -- --#ifdef __BIG_ENDIAN -- /* endian_convert */ -- pnetwork->join_res = le32_to_cpu(pnetwork->join_res); -- pnetwork->network_type = le32_to_cpu(pnetwork->network_type); -- pnetwork->network.Length = le32_to_cpu(pnetwork->network.Length); -- pnetwork->network.Ssid.SsidLength = -- le32_to_cpu(pnetwork->network.Ssid.SsidLength); -- pnetwork->network.Privacy = le32_to_cpu(pnetwork->network.Privacy); -- pnetwork->network.Rssi = le32_to_cpu(pnetwork->network.Rssi); -- pnetwork->network.NetworkTypeInUse = -- le32_to_cpu(pnetwork->network.NetworkTypeInUse); -- pnetwork->network.Configuration.ATIMWindow = -- le32_to_cpu(pnetwork->network.Configuration.ATIMWindow); -- pnetwork->network.Configuration.BeaconPeriod = -- le32_to_cpu(pnetwork->network.Configuration.BeaconPeriod); -- pnetwork->network.Configuration.DSConfig = -- le32_to_cpu(pnetwork->network.Configuration.DSConfig); -- pnetwork->network.Configuration.FHConfig.DwellTime = -- le32_to_cpu(pnetwork->network.Configuration.FHConfig.DwellTime); -- pnetwork->network.Configuration.FHConfig.HopPattern = -- le32_to_cpu(pnetwork->network.Configuration.FHConfig.HopPattern); -- pnetwork->network.Configuration.FHConfig.HopSet = -- le32_to_cpu(pnetwork->network.Configuration.FHConfig.HopSet); -- pnetwork->network.Configuration.FHConfig.Length = -- le32_to_cpu(pnetwork->network.Configuration.FHConfig.Length); -- pnetwork->network.Configuration.Length = -- le32_to_cpu(pnetwork->network.Configuration.Length); -- pnetwork->network.InfrastructureMode = -- le32_to_cpu(pnetwork->network.InfrastructureMode); -- pnetwork->network.IELength = le32_to_cpu(pnetwork->network.IELength); --#endif -- -- the_same_macaddr = !memcmp(pnetwork->network.MacAddress, -- cur_network->network.MacAddress, ETH_ALEN); -- pnetwork->network.Length = -- r8712_get_wlan_bssid_ex_sz(&pnetwork->network); -- spin_lock_irqsave(&pmlmepriv->lock, irqL); -- if (pnetwork->network.Length > sizeof(struct wlan_bssid_ex)) -- goto ignore_joinbss_callback; -- if (pnetwork->join_res > 0) { -- if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) { -- /*s1. find ptarget_wlan*/ -- if (check_fwstate(pmlmepriv, _FW_LINKED)) { -- if (the_same_macaddr) { -- ptarget_wlan = -- r8712_find_network(&pmlmepriv->scanned_queue, -- cur_network->network.MacAddress); -- } else { -- pcur_wlan = -- r8712_find_network(&pmlmepriv->scanned_queue, -- cur_network->network.MacAddress); -- if (pcur_wlan) -- pcur_wlan->fixed = false; -- -- pcur_sta = r8712_get_stainfo(pstapriv, -- cur_network->network.MacAddress); -- spin_lock_irqsave(&pstapriv->sta_hash_lock, irqL2); -- r8712_free_stainfo(adapter, pcur_sta); -- spin_unlock_irqrestore(&(pstapriv->sta_hash_lock), irqL2); -- -- ptarget_wlan = -- r8712_find_network(&pmlmepriv->scanned_queue, -- pnetwork->network.MacAddress); -- if (ptarget_wlan) -- ptarget_wlan->fixed = true; -- } -- } else { -- ptarget_wlan = r8712_find_network(&pmlmepriv->scanned_queue, -- pnetwork->network.MacAddress); -- if (ptarget_wlan) -- ptarget_wlan->fixed = true; -- } -- -- if (!ptarget_wlan) { -- if (check_fwstate(pmlmepriv, -- _FW_UNDER_LINKING)) -- pmlmepriv->fw_state ^= -- _FW_UNDER_LINKING; -- goto ignore_joinbss_callback; -- } -- -- /*s2. find ptarget_sta & update ptarget_sta*/ -- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) { -- if (the_same_macaddr) { -- ptarget_sta = -- r8712_get_stainfo(pstapriv, -- pnetwork->network.MacAddress); -- if (!ptarget_sta) -- ptarget_sta = -- r8712_alloc_stainfo(pstapriv, -- pnetwork->network.MacAddress); -- } else { -- ptarget_sta = -- r8712_alloc_stainfo(pstapriv, -- pnetwork->network.MacAddress); -- } -- if (ptarget_sta) /*update ptarget_sta*/ { -- ptarget_sta->aid = pnetwork->join_res; -- ptarget_sta->qos_option = 1; -- ptarget_sta->mac_id = 5; -- if (adapter->securitypriv.AuthAlgrthm == 2) { -- adapter->securitypriv.binstallGrpkey = false; -- adapter->securitypriv.busetkipkey = false; -- adapter->securitypriv.bgrpkey_handshake = false; -- ptarget_sta->ieee8021x_blocked = true; -- ptarget_sta->XPrivacy = -- adapter->securitypriv.PrivacyAlgrthm; -- memset((u8 *)&ptarget_sta->x_UncstKey, -- 0, -- sizeof(union Keytype)); -- memset((u8 *)&ptarget_sta->tkiprxmickey, -- 0, -- sizeof(union Keytype)); -- memset((u8 *)&ptarget_sta->tkiptxmickey, -- 0, -- sizeof(union Keytype)); -- memset((u8 *)&ptarget_sta->txpn, -- 0, -- sizeof(union pn48)); -- memset((u8 *)&ptarget_sta->rxpn, -- 0, -- sizeof(union pn48)); -- } -- } else { -- if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) -- pmlmepriv->fw_state ^= -- _FW_UNDER_LINKING; -- goto ignore_joinbss_callback; -- } -- } -- -- /*s3. update cur_network & indicate connect*/ -- memcpy(&cur_network->network, &pnetwork->network, -- pnetwork->network.Length); -- cur_network->aid = pnetwork->join_res; -- /*update fw_state will clr _FW_UNDER_LINKING*/ -- switch (pnetwork->network.InfrastructureMode) { -- case Ndis802_11Infrastructure: -- pmlmepriv->fw_state = WIFI_STATION_STATE; -- break; -- case Ndis802_11IBSS: -- pmlmepriv->fw_state = WIFI_ADHOC_STATE; -- break; -- default: -- pmlmepriv->fw_state = WIFI_NULL_STATE; -- break; -- } -- r8712_update_protection(adapter, -- (cur_network->network.IEs) + -- sizeof(struct NDIS_802_11_FIXED_IEs), -- (cur_network->network.IELength)); -- /*TODO: update HT_Capability*/ -- update_ht_cap(adapter, cur_network->network.IEs, -- cur_network->network.IELength); -- /*indicate connect*/ -- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) -- r8712_indicate_connect(adapter); -- del_timer(&pmlmepriv->assoc_timer); -- } else { -- goto ignore_joinbss_callback; -- } -- } else { -- if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) { -- mod_timer(&pmlmepriv->assoc_timer, -- jiffies + msecs_to_jiffies(1)); -- _clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING); -- } -- } --ignore_joinbss_callback: -- spin_unlock_irqrestore(&pmlmepriv->lock, irqL); -- if (sizeof(struct list_head) == 4 * sizeof(u32)) -- kfree(pnetwork); --} -- --void r8712_stassoc_event_callback(struct _adapter *adapter, u8 *pbuf) --{ -- unsigned long irqL; -- struct sta_info *psta; -- struct mlme_priv *pmlmepriv = &(adapter->mlmepriv); -- struct stassoc_event *pstassoc = (struct stassoc_event *)pbuf; -- -- /* to do: */ -- if (!r8712_access_ctrl(&adapter->acl_list, pstassoc->macaddr)) -- return; -- psta = r8712_get_stainfo(&adapter->stapriv, pstassoc->macaddr); -- if (psta) { -- /*the sta have been in sta_info_queue => do nothing -- *(between drv has received this event before and -- * fw have not yet to set key to CAM_ENTRY) -- */ -- return; -- } -- -- psta = r8712_alloc_stainfo(&adapter->stapriv, pstassoc->macaddr); -- if (!psta) -- return; -- /* to do : init sta_info variable */ -- psta->qos_option = 0; -- psta->mac_id = le32_to_cpu(pstassoc->cam_id); -- /* psta->aid = (uint)pstassoc->cam_id; */ -- -- if (adapter->securitypriv.AuthAlgrthm == 2) -- psta->XPrivacy = adapter->securitypriv.PrivacyAlgrthm; -- psta->ieee8021x_blocked = false; -- spin_lock_irqsave(&pmlmepriv->lock, irqL); -- if (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) || -- check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)) { -- if (adapter->stapriv.asoc_sta_count == 2) { -- /* a sta + bc/mc_stainfo (not Ibss_stainfo) */ -- r8712_indicate_connect(adapter); -- } -- } -- spin_unlock_irqrestore(&pmlmepriv->lock, irqL); --} -- --void r8712_stadel_event_callback(struct _adapter *adapter, u8 *pbuf) --{ -- unsigned long irqL, irqL2; -- struct sta_info *psta; -- struct wlan_network *pwlan = NULL; -- struct wlan_bssid_ex *pdev_network = NULL; -- u8 *pibss = NULL; -- struct mlme_priv *pmlmepriv = &adapter->mlmepriv; -- struct stadel_event *pstadel = (struct stadel_event *)pbuf; -- struct sta_priv *pstapriv = &adapter->stapriv; -- struct wlan_network *tgt_network = &pmlmepriv->cur_network; -- -- spin_lock_irqsave(&pmlmepriv->lock, irqL2); -- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) { -- r8712_ind_disconnect(adapter); -- r8712_free_assoc_resources(adapter); -- } -- if (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE | -- WIFI_ADHOC_STATE)) { -- psta = r8712_get_stainfo(&adapter->stapriv, pstadel->macaddr); -- spin_lock_irqsave(&pstapriv->sta_hash_lock, irqL); -- r8712_free_stainfo(adapter, psta); -- spin_unlock_irqrestore(&pstapriv->sta_hash_lock, irqL); -- if (adapter->stapriv.asoc_sta_count == 1) { -- /*a sta + bc/mc_stainfo (not Ibss_stainfo) */ -- pwlan = r8712_find_network(&pmlmepriv->scanned_queue, -- tgt_network->network.MacAddress); -- if (pwlan) { -- pwlan->fixed = false; -- free_network_nolock(pmlmepriv, pwlan); -- } -- /*re-create ibss*/ -- pdev_network = &(adapter->registrypriv.dev_network); -- pibss = adapter->registrypriv.dev_network.MacAddress; -- memcpy(pdev_network, &tgt_network->network, -- r8712_get_wlan_bssid_ex_sz(&tgt_network->network)); -- memcpy(&pdev_network->Ssid, -- &pmlmepriv->assoc_ssid, -- sizeof(struct ndis_802_11_ssid)); -- r8712_update_registrypriv_dev_network(adapter); -- r8712_generate_random_ibss(pibss); -- if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)) { -- _clr_fwstate_(pmlmepriv, WIFI_ADHOC_STATE); -- set_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE); -- } -- } -- } -- spin_unlock_irqrestore(&pmlmepriv->lock, irqL2); --} -- --void r8712_cpwm_event_callback(struct _adapter *adapter, u8 *pbuf) --{ -- struct reportpwrstate_parm *preportpwrstate = -- (struct reportpwrstate_parm *)pbuf; -- -- preportpwrstate->state |= (u8)(adapter->pwrctrlpriv.cpwm_tog + 0x80); -- r8712_cpwm_int_hdl(adapter, preportpwrstate); --} -- --/* When the Netgear 3500 AP is with WPA2PSK-AES mode, it will send -- * the ADDBA req frame with start seq control = 0 to wifi client after -- * the WPA handshake and the seqence number of following data packet -- * will be 0. In this case, the Rx reorder sequence is not longer than 0 -- * and the WiFi client will drop the data with seq number 0. -- * So, the 8712 firmware has to inform driver with receiving the -- * ADDBA-Req frame so that the driver can reset the -- * sequence value of Rx reorder control. -- */ --void r8712_got_addbareq_event_callback(struct _adapter *adapter, u8 *pbuf) --{ -- struct ADDBA_Req_Report_parm *pAddbareq_pram = -- (struct ADDBA_Req_Report_parm *)pbuf; -- struct sta_info *psta; -- struct sta_priv *pstapriv = &adapter->stapriv; -- struct recv_reorder_ctrl *precvreorder_ctrl = NULL; -- -- psta = r8712_get_stainfo(pstapriv, pAddbareq_pram->MacAddress); -- if (psta) { -- precvreorder_ctrl = -- &psta->recvreorder_ctrl[pAddbareq_pram->tid]; -- /* set the indicate_seq to 0xffff so that the rx reorder -- * can store any following data packet. -- */ -- precvreorder_ctrl->indicate_seq = 0xffff; -- } --} -- --void r8712_wpspbc_event_callback(struct _adapter *adapter, u8 *pbuf) --{ -- if (!adapter->securitypriv.wps_hw_pbc_pressed) -- adapter->securitypriv.wps_hw_pbc_pressed = true; --} -- --void _r8712_sitesurvey_ctrl_handler(struct _adapter *adapter) --{ -- struct mlme_priv *pmlmepriv = &adapter->mlmepriv; -- struct sitesurvey_ctrl *psitesurveyctrl = &pmlmepriv->sitesurveyctrl; -- struct registry_priv *pregistrypriv = &adapter->registrypriv; -- u64 current_tx_pkts; -- uint current_rx_pkts; -- -- current_tx_pkts = (adapter->xmitpriv.tx_pkts) - -- (psitesurveyctrl->last_tx_pkts); -- current_rx_pkts = (adapter->recvpriv.rx_pkts) - -- (psitesurveyctrl->last_rx_pkts); -- psitesurveyctrl->last_tx_pkts = adapter->xmitpriv.tx_pkts; -- psitesurveyctrl->last_rx_pkts = adapter->recvpriv.rx_pkts; -- if ((current_tx_pkts > pregistrypriv->busy_thresh) || -- (current_rx_pkts > pregistrypriv->busy_thresh)) -- psitesurveyctrl->traffic_busy = true; -- else -- psitesurveyctrl->traffic_busy = false; --} -- --void _r8712_join_timeout_handler(struct _adapter *adapter) --{ -- unsigned long irqL; -- struct mlme_priv *pmlmepriv = &adapter->mlmepriv; -- -- if (adapter->driver_stopped || adapter->surprise_removed) -- return; -- spin_lock_irqsave(&pmlmepriv->lock, irqL); -- _clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING); -- pmlmepriv->to_join = false; -- if (check_fwstate(pmlmepriv, _FW_LINKED)) { -- r8712_os_indicate_disconnect(adapter); -- _clr_fwstate_(pmlmepriv, _FW_LINKED); -- } -- if (adapter->pwrctrlpriv.pwr_mode != adapter->registrypriv.power_mgnt) { -- r8712_set_ps_mode(adapter, adapter->registrypriv.power_mgnt, -- adapter->registrypriv.smart_ps); -- } -- spin_unlock_irqrestore(&pmlmepriv->lock, irqL); --} -- --void r8712_scan_timeout_handler (struct _adapter *adapter) --{ -- unsigned long irqL; -- struct mlme_priv *pmlmepriv = &adapter->mlmepriv; -- -- spin_lock_irqsave(&pmlmepriv->lock, irqL); -- _clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY); -- pmlmepriv->to_join = false; /* scan fail, so clear to_join flag */ -- spin_unlock_irqrestore(&pmlmepriv->lock, irqL); --} -- --void _r8712_dhcp_timeout_handler (struct _adapter *adapter) --{ -- if (adapter->driver_stopped || adapter->surprise_removed) -- return; -- if (adapter->pwrctrlpriv.pwr_mode != adapter->registrypriv.power_mgnt) -- r8712_set_ps_mode(adapter, adapter->registrypriv.power_mgnt, -- adapter->registrypriv.smart_ps); --} -- --int r8712_select_and_join_from_scan(struct mlme_priv *pmlmepriv) --{ -- struct list_head *phead; -- unsigned char *dst_ssid, *src_ssid; -- struct _adapter *adapter; -- struct __queue *queue = NULL; -- struct wlan_network *pnetwork = NULL; -- struct wlan_network *pnetwork_max_rssi = NULL; -- -- adapter = (struct _adapter *)pmlmepriv->nic_hdl; -- queue = &pmlmepriv->scanned_queue; -- phead = &queue->queue; -- pmlmepriv->pscanned = phead->next; -- while (1) { -- if (end_of_queue_search(phead, pmlmepriv->pscanned)) { -- if (pmlmepriv->assoc_by_rssi && pnetwork_max_rssi) { -- pnetwork = pnetwork_max_rssi; -- goto ask_for_joinbss; -- } -- return -EINVAL; -- } -- pnetwork = container_of(pmlmepriv->pscanned, -- struct wlan_network, list); -- pmlmepriv->pscanned = pmlmepriv->pscanned->next; -- if (pmlmepriv->assoc_by_bssid) { -- dst_ssid = pnetwork->network.MacAddress; -- src_ssid = pmlmepriv->assoc_bssid; -- if (!memcmp(dst_ssid, src_ssid, ETH_ALEN)) { -- if (check_fwstate(pmlmepriv, _FW_LINKED)) { -- if (is_same_network(&pmlmepriv->cur_network.network, -- &pnetwork->network)) { -- _clr_fwstate_(pmlmepriv, -- _FW_UNDER_LINKING); -- /*r8712_indicate_connect again*/ -- r8712_indicate_connect(adapter); -- return 2; -- } -- r8712_disassoc_cmd(adapter); -- r8712_ind_disconnect(adapter); -- r8712_free_assoc_resources(adapter); -- } -- goto ask_for_joinbss; -- } -- } else if (pmlmepriv->assoc_ssid.SsidLength == 0) { -- goto ask_for_joinbss; -- } -- dst_ssid = pnetwork->network.Ssid.Ssid; -- src_ssid = pmlmepriv->assoc_ssid.Ssid; -- if ((pnetwork->network.Ssid.SsidLength == -- pmlmepriv->assoc_ssid.SsidLength) && -- (!memcmp(dst_ssid, src_ssid, -- pmlmepriv->assoc_ssid.SsidLength))) { -- if (pmlmepriv->assoc_by_rssi) { -- /* if the ssid is the same, select the bss -- * which has the max rssi -- */ -- if (pnetwork_max_rssi) { -- if (pnetwork->network.Rssi > -- pnetwork_max_rssi->network.Rssi) -- pnetwork_max_rssi = pnetwork; -- } else { -- pnetwork_max_rssi = pnetwork; -- } -- } else if (is_desired_network(adapter, pnetwork)) { -- if (check_fwstate(pmlmepriv, _FW_LINKED)) { -- r8712_disassoc_cmd(adapter); -- r8712_free_assoc_resources(adapter); -- } -- goto ask_for_joinbss; -- } -- } -- } -- --ask_for_joinbss: -- return r8712_joinbss_cmd(adapter, pnetwork); --} -- --int r8712_set_auth(struct _adapter *adapter, -- struct security_priv *psecuritypriv) --{ -- struct cmd_priv *pcmdpriv = &adapter->cmdpriv; -- struct cmd_obj *pcmd; -- struct setauth_parm *psetauthparm; -- -- pcmd = kmalloc(sizeof(*pcmd), GFP_ATOMIC); -- if (!pcmd) -- return -ENOMEM; -- -- psetauthparm = kzalloc(sizeof(*psetauthparm), GFP_ATOMIC); -- if (!psetauthparm) { -- kfree(pcmd); -- return -ENOMEM; -- } -- psetauthparm->mode = (u8)psecuritypriv->AuthAlgrthm; -- pcmd->cmdcode = _SetAuth_CMD_; -- pcmd->parmbuf = (unsigned char *)psetauthparm; -- pcmd->cmdsz = sizeof(struct setauth_parm); -- pcmd->rsp = NULL; -- pcmd->rspsz = 0; -- INIT_LIST_HEAD(&pcmd->list); -- r8712_enqueue_cmd(pcmdpriv, pcmd); -- return 0; --} -- --int r8712_set_key(struct _adapter *adapter, -- struct security_priv *psecuritypriv, -- sint keyid) --{ -- struct cmd_priv *pcmdpriv = &adapter->cmdpriv; -- struct cmd_obj *pcmd; -- struct setkey_parm *psetkeyparm; -- u8 keylen; -- int ret; -- -- pcmd = kmalloc(sizeof(*pcmd), GFP_ATOMIC); -- if (!pcmd) -- return -ENOMEM; -- psetkeyparm = kzalloc(sizeof(*psetkeyparm), GFP_ATOMIC); -- if (!psetkeyparm) { -- ret = -ENOMEM; -- goto err_free_cmd; -- } -- if (psecuritypriv->AuthAlgrthm == 2) { /* 802.1X */ -- psetkeyparm->algorithm = -- (u8)psecuritypriv->XGrpPrivacy; -- } else { /* WEP */ -- psetkeyparm->algorithm = -- (u8)psecuritypriv->PrivacyAlgrthm; -- } -- psetkeyparm->keyid = (u8)keyid; -- -- switch (psetkeyparm->algorithm) { -- case _WEP40_: -- keylen = 5; -- memcpy(psetkeyparm->key, -- psecuritypriv->DefKey[keyid].skey, keylen); -- break; -- case _WEP104_: -- keylen = 13; -- memcpy(psetkeyparm->key, -- psecuritypriv->DefKey[keyid].skey, keylen); -- break; -- case _TKIP_: -- if (keyid < 1 || keyid > 2) { -- ret = -EINVAL; -- goto err_free_parm; -- } -- keylen = 16; -- memcpy(psetkeyparm->key, -- &psecuritypriv->XGrpKey[keyid - 1], keylen); -- psetkeyparm->grpkey = 1; -- break; -- case _AES_: -- if (keyid < 1 || keyid > 2) { -- ret = -EINVAL; -- goto err_free_parm; -- } -- keylen = 16; -- memcpy(psetkeyparm->key, -- &psecuritypriv->XGrpKey[keyid - 1], keylen); -- psetkeyparm->grpkey = 1; -- break; -- default: -- ret = -EINVAL; -- goto err_free_parm; -- } -- pcmd->cmdcode = _SetKey_CMD_; -- pcmd->parmbuf = (u8 *)psetkeyparm; -- pcmd->cmdsz = (sizeof(struct setkey_parm)); -- pcmd->rsp = NULL; -- pcmd->rspsz = 0; -- INIT_LIST_HEAD(&pcmd->list); -- r8712_enqueue_cmd(pcmdpriv, pcmd); -- return 0; -- --err_free_parm: -- kfree(psetkeyparm); --err_free_cmd: -- kfree(pcmd); -- return ret; --} -- --/* adjust IEs for r8712_joinbss_cmd in WMM */ --int r8712_restruct_wmm_ie(struct _adapter *adapter, u8 *in_ie, u8 *out_ie, -- uint in_len, uint initial_out_len) --{ -- unsigned int ielength = 0; -- unsigned int i, j; -- -- i = 12; /* after the fixed IE */ -- while (i < in_len) { -- ielength = initial_out_len; -- if (in_ie[i] == 0xDD && in_ie[i + 2] == 0x00 && -- in_ie[i + 3] == 0x50 && in_ie[i + 4] == 0xF2 && -- in_ie[i + 5] == 0x02 && i + 5 < in_len) { -- /*WMM element ID and OUI*/ -- for (j = i; j < i + 9; j++) { -- out_ie[ielength] = in_ie[j]; -- ielength++; -- } -- out_ie[initial_out_len + 1] = 0x07; -- out_ie[initial_out_len + 6] = 0x00; -- out_ie[initial_out_len + 8] = 0x00; -- break; -- } -- i += (in_ie[i + 1] + 2); /* to the next IE element */ -- } -- return ielength; --} -- --/* -- * Ported from 8185: IsInPreAuthKeyList(). -- * -- * Search by BSSID, -- * Return Value: -- * -1 :if there is no pre-auth key in the table -- * >=0 :if there is pre-auth key, and return the entry id -- */ --static int SecIsInPMKIDList(struct _adapter *Adapter, u8 *bssid) --{ -- struct security_priv *p = &Adapter->securitypriv; -- int i; -- -- for (i = 0; i < NUM_PMKID_CACHE; i++) -- if (p->PMKIDList[i].bUsed && !memcmp(p->PMKIDList[i].Bssid, bssid, ETH_ALEN)) -- return i; -- return -1; --} -- --sint r8712_restruct_sec_ie(struct _adapter *adapter, u8 *in_ie, -- u8 *out_ie, uint in_len) --{ -- u8 authmode = 0, match; -- u8 sec_ie[IW_CUSTOM_MAX], uncst_oui[4], bkup_ie[255]; -- u8 wpa_oui[4] = {0x0, 0x50, 0xf2, 0x01}; -- uint ielength, cnt, remove_cnt; -- int iEntry; -- struct mlme_priv *pmlmepriv = &adapter->mlmepriv; -- struct security_priv *psecuritypriv = &adapter->securitypriv; -- uint ndisauthmode = psecuritypriv->ndisauthtype; -- uint ndissecuritytype = psecuritypriv->ndisencryptstatus; -- -- if ((ndisauthmode == Ndis802_11AuthModeWPA) || -- (ndisauthmode == Ndis802_11AuthModeWPAPSK)) { -- authmode = _WPA_IE_ID_; -- uncst_oui[0] = 0x0; -- uncst_oui[1] = 0x50; -- uncst_oui[2] = 0xf2; -- } -- if ((ndisauthmode == Ndis802_11AuthModeWPA2) || -- (ndisauthmode == Ndis802_11AuthModeWPA2PSK)) { -- authmode = _WPA2_IE_ID_; -- uncst_oui[0] = 0x0; -- uncst_oui[1] = 0x0f; -- uncst_oui[2] = 0xac; -- } -- switch (ndissecuritytype) { -- case Ndis802_11Encryption1Enabled: -- case Ndis802_11Encryption1KeyAbsent: -- uncst_oui[3] = 0x1; -- break; -- case Ndis802_11Encryption2Enabled: -- case Ndis802_11Encryption2KeyAbsent: -- uncst_oui[3] = 0x2; -- break; -- case Ndis802_11Encryption3Enabled: -- case Ndis802_11Encryption3KeyAbsent: -- uncst_oui[3] = 0x4; -- break; -- default: -- break; -- } -- /*Search required WPA or WPA2 IE and copy to sec_ie[] */ -- cnt = 12; -- match = false; -- while (cnt < in_len) { -- if (in_ie[cnt] == authmode) { -- if ((authmode == _WPA_IE_ID_) && -- (!memcmp(&in_ie[cnt + 2], &wpa_oui[0], 4))) { -- memcpy(&sec_ie[0], &in_ie[cnt], -- in_ie[cnt + 1] + 2); -- match = true; -- break; -- } -- if (authmode == _WPA2_IE_ID_) { -- memcpy(&sec_ie[0], &in_ie[cnt], -- in_ie[cnt + 1] + 2); -- match = true; -- break; -- } -- if (((authmode == _WPA_IE_ID_) && -- (!memcmp(&in_ie[cnt + 2], &wpa_oui[0], 4))) || -- (authmode == _WPA2_IE_ID_)) -- memcpy(&bkup_ie[0], &in_ie[cnt], -- in_ie[cnt + 1] + 2); -- } -- cnt += in_ie[cnt + 1] + 2; /*get next*/ -- } -- /*restruct WPA IE or WPA2 IE in sec_ie[] */ -- if (match) { -- if (sec_ie[0] == _WPA_IE_ID_) { -- /* parsing SSN IE to select required encryption -- * algorithm, and set the bc/mc encryption algorithm -- */ -- while (true) { -- /*check wpa_oui tag*/ -- if (memcmp(&sec_ie[2], &wpa_oui[0], 4)) { -- match = false; -- break; -- } -- if ((sec_ie[6] != 0x01) || (sec_ie[7] != 0x0)) { -- /*IE Ver error*/ -- match = false; -- break; -- } -- if (!memcmp(&sec_ie[8], &wpa_oui[0], 3)) { -- /* get bc/mc encryption type (group -- * key type) -- */ -- switch (sec_ie[11]) { -- case 0x0: /*none*/ -- psecuritypriv->XGrpPrivacy = -- _NO_PRIVACY_; -- break; -- case 0x1: /*WEP_40*/ -- psecuritypriv->XGrpPrivacy = -- _WEP40_; -- break; -- case 0x2: /*TKIP*/ -- psecuritypriv->XGrpPrivacy = -- _TKIP_; -- break; -- case 0x3: /*AESCCMP*/ -- case 0x4: -- psecuritypriv->XGrpPrivacy = -- _AES_; -- break; -- case 0x5: /*WEP_104*/ -- psecuritypriv->XGrpPrivacy = -- _WEP104_; -- break; -- } -- } else { -- match = false; -- break; -- } -- if (sec_ie[12] == 0x01) { -- /*check the unicast encryption type*/ -- if (memcmp(&sec_ie[14], -- &uncst_oui[0], 4)) { -- match = false; -- break; -- -- } /*else the uncst_oui is match*/ -- } else { /*mixed mode, unicast_enc_type > 1*/ -- /*select the uncst_oui and remove -- * the other uncst_oui -- */ -- cnt = sec_ie[12]; -- remove_cnt = (cnt - 1) * 4; -- sec_ie[12] = 0x01; -- memcpy(&sec_ie[14], &uncst_oui[0], 4); -- /*remove the other unicast suit*/ -- memcpy(&sec_ie[18], -- &sec_ie[18 + remove_cnt], -- sec_ie[1] - 18 + 2 - -- remove_cnt); -- sec_ie[1] = sec_ie[1] - remove_cnt; -- } -- break; -- } -- } -- if (authmode == _WPA2_IE_ID_) { -- /* parsing RSN IE to select required encryption -- * algorithm, and set the bc/mc encryption algorithm -- */ -- while (true) { -- if ((sec_ie[2] != 0x01) || (sec_ie[3] != 0x0)) { -- /*IE Ver error*/ -- match = false; -- break; -- } -- if (!memcmp(&sec_ie[4], &uncst_oui[0], 3)) { -- /*get bc/mc encryption type*/ -- switch (sec_ie[7]) { -- case 0x1: /*WEP_40*/ -- psecuritypriv->XGrpPrivacy = -- _WEP40_; -- break; -- case 0x2: /*TKIP*/ -- psecuritypriv->XGrpPrivacy = -- _TKIP_; -- break; -- case 0x4: /*AESWRAP*/ -- psecuritypriv->XGrpPrivacy = -- _AES_; -- break; -- case 0x5: /*WEP_104*/ -- psecuritypriv->XGrpPrivacy = -- _WEP104_; -- break; -- default: /*one*/ -- psecuritypriv->XGrpPrivacy = -- _NO_PRIVACY_; -- break; -- } -- } else { -- match = false; -- break; -- } -- if (sec_ie[8] == 0x01) { -- /*check the unicast encryption type*/ -- if (memcmp(&sec_ie[10], -- &uncst_oui[0], 4)) { -- match = false; -- break; -- } /*else the uncst_oui is match*/ -- } else { /*mixed mode, unicast_enc_type > 1*/ -- /*select the uncst_oui and remove the -- * other uncst_oui -- */ -- cnt = sec_ie[8]; -- remove_cnt = (cnt - 1) * 4; -- sec_ie[8] = 0x01; -- memcpy(&sec_ie[10], &uncst_oui[0], 4); -- /*remove the other unicast suit*/ -- memcpy(&sec_ie[14], -- &sec_ie[14 + remove_cnt], -- (sec_ie[1] - 14 + 2 - -- remove_cnt)); -- sec_ie[1] = sec_ie[1] - remove_cnt; -- } -- break; -- } -- } -- } -- if ((authmode == _WPA_IE_ID_) || (authmode == _WPA2_IE_ID_)) { -- /*copy fixed ie*/ -- memcpy(out_ie, in_ie, 12); -- ielength = 12; -- /*copy RSN or SSN*/ -- if (match) { -- memcpy(&out_ie[ielength], &sec_ie[0], sec_ie[1] + 2); -- ielength += sec_ie[1] + 2; -- if (authmode == _WPA2_IE_ID_) { -- /*the Pre-Authentication bit should be zero*/ -- out_ie[ielength - 1] = 0; -- out_ie[ielength - 2] = 0; -- } -- r8712_report_sec_ie(adapter, authmode, sec_ie); -- } -- } else { -- /*copy fixed ie only*/ -- memcpy(out_ie, in_ie, 12); -- ielength = 12; -- if (psecuritypriv->wps_phase) { -- memcpy(out_ie + ielength, psecuritypriv->wps_ie, -- psecuritypriv->wps_ie_len); -- ielength += psecuritypriv->wps_ie_len; -- } -- } -- iEntry = SecIsInPMKIDList(adapter, pmlmepriv->assoc_bssid); -- if (iEntry < 0) -- return ielength; -- if (authmode == _WPA2_IE_ID_) { -- out_ie[ielength] = 1; -- ielength++; -- out_ie[ielength] = 0; /*PMKID count = 0x0100*/ -- ielength++; -- memcpy(&out_ie[ielength], -- &psecuritypriv->PMKIDList[iEntry].PMKID, 16); -- ielength += 16; -- out_ie[13] += 18;/*PMKID length = 2+16*/ -- } -- return ielength; --} -- --void r8712_init_registrypriv_dev_network(struct _adapter *adapter) --{ -- struct registry_priv *pregistrypriv = &adapter->registrypriv; -- struct eeprom_priv *peepriv = &adapter->eeprompriv; -- struct wlan_bssid_ex *pdev_network = &pregistrypriv->dev_network; -- u8 *myhwaddr = myid(peepriv); -- -- memcpy(pdev_network->MacAddress, myhwaddr, ETH_ALEN); -- memcpy(&pdev_network->Ssid, &pregistrypriv->ssid, -- sizeof(struct ndis_802_11_ssid)); -- pdev_network->Configuration.Length = -- sizeof(struct NDIS_802_11_CONFIGURATION); -- pdev_network->Configuration.BeaconPeriod = 100; -- pdev_network->Configuration.FHConfig.Length = 0; -- pdev_network->Configuration.FHConfig.HopPattern = 0; -- pdev_network->Configuration.FHConfig.HopSet = 0; -- pdev_network->Configuration.FHConfig.DwellTime = 0; --} -- --void r8712_update_registrypriv_dev_network(struct _adapter *adapter) --{ -- int sz = 0; -- struct registry_priv *pregistrypriv = &adapter->registrypriv; -- struct wlan_bssid_ex *pdev_network = &pregistrypriv->dev_network; -- struct security_priv *psecuritypriv = &adapter->securitypriv; -- struct wlan_network *cur_network = &adapter->mlmepriv.cur_network; -- -- pdev_network->Privacy = cpu_to_le32(psecuritypriv->PrivacyAlgrthm -- > 0 ? 1 : 0); /* adhoc no 802.1x */ -- pdev_network->Rssi = 0; -- switch (pregistrypriv->wireless_mode) { -- case WIRELESS_11B: -- pdev_network->NetworkTypeInUse = Ndis802_11DS; -- break; -- case WIRELESS_11G: -- case WIRELESS_11BG: -- pdev_network->NetworkTypeInUse = Ndis802_11OFDM24; -- break; -- case WIRELESS_11A: -- pdev_network->NetworkTypeInUse = Ndis802_11OFDM5; -- break; -- default: -- /* TODO */ -- break; -- } -- pdev_network->Configuration.DSConfig = pregistrypriv->channel; -- if (cur_network->network.InfrastructureMode == Ndis802_11IBSS) -- pdev_network->Configuration.ATIMWindow = 3; -- pdev_network->InfrastructureMode = cur_network->network.InfrastructureMode; -- /* 1. Supported rates -- * 2. IE -- */ -- sz = r8712_generate_ie(pregistrypriv); -- pdev_network->IELength = sz; -- pdev_network->Length = r8712_get_wlan_bssid_ex_sz(pdev_network); --} -- --/*the function is at passive_level*/ --void r8712_joinbss_reset(struct _adapter *padapter) --{ -- int i; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct ht_priv *phtpriv = &pmlmepriv->htpriv; -- -- /* todo: if you want to do something io/reg/hw setting before join_bss, -- * please add code here -- */ -- phtpriv->ampdu_enable = false;/*reset to disabled*/ -- for (i = 0; i < 16; i++) -- phtpriv->baddbareq_issued[i] = false;/*reset it*/ -- if (phtpriv->ht_option) { -- /* validate usb rx aggregation */ -- r8712_write8(padapter, 0x102500D9, 48);/*TH = 48 pages, 6k*/ -- } else { -- /* invalidate usb rx aggregation */ -- /* TH=1 => means that invalidate usb rx aggregation */ -- r8712_write8(padapter, 0x102500D9, 1); -- } --} -- --/*the function is >= passive_level*/ --unsigned int r8712_restructure_ht_ie(struct _adapter *padapter, u8 *in_ie, -- u8 *out_ie, uint in_len, uint *pout_len) --{ -- u32 ielen, out_len; -- unsigned char *p; -- struct ieee80211_ht_cap ht_capie; -- unsigned char WMM_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01, 0x00}; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct qos_priv *pqospriv = &pmlmepriv->qospriv; -- struct ht_priv *phtpriv = &pmlmepriv->htpriv; -- -- phtpriv->ht_option = 0; -- p = r8712_get_ie(in_ie + 12, WLAN_EID_HT_CAPABILITY, &ielen, in_len - 12); -- if (p && (ielen > 0)) { -- if (pqospriv->qos_option == 0) { -- out_len = *pout_len; -- r8712_set_ie(out_ie + out_len, WLAN_EID_VENDOR_SPECIFIC, -- _WMM_IE_Length_, WMM_IE, pout_len); -- pqospriv->qos_option = 1; -- } -- out_len = *pout_len; -- memset(&ht_capie, 0, sizeof(struct ieee80211_ht_cap)); -- ht_capie.cap_info = cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40 | -- IEEE80211_HT_CAP_SGI_20 | -- IEEE80211_HT_CAP_SGI_40 | -- IEEE80211_HT_CAP_TX_STBC | -- IEEE80211_HT_CAP_MAX_AMSDU | -- IEEE80211_HT_CAP_DSSSCCK40); -- ht_capie.ampdu_params_info = (IEEE80211_HT_AMPDU_PARM_FACTOR & -- 0x03) | (IEEE80211_HT_AMPDU_PARM_DENSITY & 0x00); -- r8712_set_ie(out_ie + out_len, WLAN_EID_HT_CAPABILITY, -- sizeof(struct ieee80211_ht_cap), -- (unsigned char *)&ht_capie, pout_len); -- phtpriv->ht_option = 1; -- } -- return phtpriv->ht_option; --} -- --/* the function is > passive_level (in critical_section) */ --static void update_ht_cap(struct _adapter *padapter, u8 *pie, uint ie_len) --{ -- u8 *p, max_ampdu_sz; -- int i; -- uint len; -- struct sta_info *bmc_sta, *psta; -- struct ieee80211_ht_cap *pht_capie; -- struct recv_reorder_ctrl *preorder_ctrl; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct ht_priv *phtpriv = &pmlmepriv->htpriv; -- struct registry_priv *pregistrypriv = &padapter->registrypriv; -- struct wlan_network *pcur_network = &(pmlmepriv->cur_network); -- -- if (!phtpriv->ht_option) -- return; -- /* maybe needs check if ap supports rx ampdu. */ -- if (!phtpriv->ampdu_enable && -- (pregistrypriv->ampdu_enable == 1)) -- phtpriv->ampdu_enable = true; -- /*check Max Rx A-MPDU Size*/ -- len = 0; -- p = r8712_get_ie(pie + sizeof(struct NDIS_802_11_FIXED_IEs), -- WLAN_EID_HT_CAPABILITY, -- &len, ie_len - -- sizeof(struct NDIS_802_11_FIXED_IEs)); -- if (p && len > 0) { -- pht_capie = (struct ieee80211_ht_cap *)(p + 2); -- max_ampdu_sz = (pht_capie->ampdu_params_info & -- IEEE80211_HT_AMPDU_PARM_FACTOR); -- /* max_ampdu_sz (kbytes); */ -- max_ampdu_sz = 1 << (max_ampdu_sz + 3); -- phtpriv->rx_ampdu_maxlen = max_ampdu_sz; -- } -- /* for A-MPDU Rx reordering buffer control for bmc_sta & sta_info -- * if A-MPDU Rx is enabled, resetting rx_ordering_ctrl -- * wstart_b(indicate_seq) to default value=0xffff -- * todo: check if AP can send A-MPDU packets -- */ -- bmc_sta = r8712_get_bcmc_stainfo(padapter); -- if (bmc_sta) { -- for (i = 0; i < 16; i++) { -- preorder_ctrl = &bmc_sta->recvreorder_ctrl[i]; -- preorder_ctrl->indicate_seq = 0xffff; -- preorder_ctrl->wend_b = 0xffff; -- } -- } -- psta = r8712_get_stainfo(&padapter->stapriv, -- pcur_network->network.MacAddress); -- if (psta) { -- for (i = 0; i < 16; i++) { -- preorder_ctrl = &psta->recvreorder_ctrl[i]; -- preorder_ctrl->indicate_seq = 0xffff; -- preorder_ctrl->wend_b = 0xffff; -- } -- } -- len = 0; -- p = r8712_get_ie(pie + sizeof(struct NDIS_802_11_FIXED_IEs), -- WLAN_EID_HT_OPERATION, &len, -- ie_len - sizeof(struct NDIS_802_11_FIXED_IEs)); --} -- --void r8712_issue_addbareq_cmd(struct _adapter *padapter, int priority) --{ -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct ht_priv *phtpriv = &pmlmepriv->htpriv; -- -- if ((phtpriv->ht_option == 1) && (phtpriv->ampdu_enable)) { -- if (!phtpriv->baddbareq_issued[priority]) { -- r8712_addbareq_cmd(padapter, (u8)priority); -- phtpriv->baddbareq_issued[priority] = true; -- } -- } --} -diff --git a/drivers/staging/rtl8712/rtl871x_mlme.h b/drivers/staging/rtl8712/rtl871x_mlme.h -deleted file mode 100644 -index d7d25f240111fa..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_mlme.h -+++ /dev/null -@@ -1,205 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __RTL871X_MLME_H_ --#define __RTL871X_MLME_H_ -- --#include "osdep_service.h" --#include "drv_types.h" --#include "wlan_bssdef.h" -- --#define MAX_BSS_CNT 64 --#define MAX_JOIN_TIMEOUT 6000 -- --#define SCANNING_TIMEOUT 4500 -- --#define SCANQUEUE_LIFETIME 20 /* unit:sec */ -- --#define WIFI_NULL_STATE 0x00000000 --#define WIFI_ASOC_STATE 0x00000001 /* Under Linked state...*/ --#define WIFI_REASOC_STATE 0x00000002 --#define WIFI_SLEEP_STATE 0x00000004 --#define WIFI_STATION_STATE 0x00000008 --#define WIFI_AP_STATE 0x00000010 --#define WIFI_ADHOC_STATE 0x00000020 --#define WIFI_ADHOC_MASTER_STATE 0x00000040 --#define WIFI_UNDER_LINKING 0x00000080 --#define WIFI_SITE_MONITOR 0x00000800 /* to indicate the station -- * is under site surveying -- */ --#define WIFI_MP_STATE 0x00010000 --#define WIFI_MP_CTX_BACKGROUND 0x00020000 /* in cont. tx background*/ --#define WIFI_MP_CTX_ST 0x00040000 /* in cont. tx with -- * single-tone -- */ --#define WIFI_MP_CTX_BACKGROUND_PENDING 0x00080000 /* pending in cont, tx -- * background due -- * to out of skb -- */ --#define WIFI_MP_CTX_CCK_HW 0x00100000 /* in continuous tx*/ --#define WIFI_MP_CTX_CCK_CS 0x00200000 /* in cont, tx with carrier -- * suppression -- */ --#define WIFI_MP_LPBK_STATE 0x00400000 -- --#define _FW_UNDER_LINKING WIFI_UNDER_LINKING --#define _FW_LINKED WIFI_ASOC_STATE --#define _FW_UNDER_SURVEY WIFI_SITE_MONITOR -- --/* -- * there are several "locks" in mlme_priv, -- * since mlme_priv is a shared resource between many threads, -- * like ISR/Call-Back functions, the OID handlers, and even timer functions. -- * Each _queue has its own locks, already. -- * Other items are protected by mlme_priv.lock. -- * To avoid possible dead lock, any thread trying to modify mlme_priv -- * SHALL not lock up more than one lock at a time! -- */ -- --#define traffic_threshold 10 --#define traffic_scan_period 500 -- --struct sitesurvey_ctrl { -- u64 last_tx_pkts; -- uint last_rx_pkts; -- sint traffic_busy; -- struct timer_list sitesurvey_ctrl_timer; --}; -- --struct mlme_priv { -- spinlock_t lock; -- spinlock_t lock2; -- sint fw_state; /*shall we protect this variable? */ -- u8 to_join; /*flag*/ -- u8 *nic_hdl; -- struct list_head *pscanned; -- struct __queue free_bss_pool; -- struct __queue scanned_queue; -- u8 *free_bss_buf; -- unsigned long num_of_scanned; -- u8 passive_mode; /*add for Android's SCAN-ACTIVE/SCAN-PASSIVE */ -- struct ndis_802_11_ssid assoc_ssid; -- u8 assoc_bssid[6]; -- struct wlan_network cur_network; -- struct sitesurvey_ctrl sitesurveyctrl; -- struct timer_list assoc_timer; -- uint assoc_by_bssid; -- uint assoc_by_rssi; -- struct timer_list scan_to_timer; /* driver handles scan_timeout.*/ -- struct timer_list dhcp_timer; /* set dhcp to if driver in ps mode.*/ -- struct qos_priv qospriv; -- struct ht_priv htpriv; -- struct timer_list wdg_timer; /*watchdog periodic timer*/ --}; -- --static inline u8 *get_bssid(struct mlme_priv *pmlmepriv) --{ -- return pmlmepriv->cur_network.network.MacAddress; --} -- --static inline u8 check_fwstate(struct mlme_priv *pmlmepriv, sint state) --{ -- if (pmlmepriv->fw_state & state) -- return true; -- return false; --} -- --static inline sint get_fwstate(struct mlme_priv *pmlmepriv) --{ -- return pmlmepriv->fw_state; --} -- --/* -- * No Limit on the calling context, -- * therefore set it to be the critical section... -- * -- * ### NOTE:#### (!!!!) -- * TAKE CARE BEFORE CALLING THIS FUNC, LOCK pmlmepriv->lock -- */ --static inline void set_fwstate(struct mlme_priv *pmlmepriv, sint state) --{ -- pmlmepriv->fw_state |= state; --} -- --static inline void _clr_fwstate_(struct mlme_priv *pmlmepriv, sint state) --{ -- pmlmepriv->fw_state &= ~state; --} -- --/* -- * No Limit on the calling context, -- * therefore set it to be the critical section... -- */ --static inline void clr_fwstate(struct mlme_priv *pmlmepriv, sint state) --{ -- unsigned long irqL; -- -- spin_lock_irqsave(&pmlmepriv->lock, irqL); -- if (check_fwstate(pmlmepriv, state)) -- pmlmepriv->fw_state ^= state; -- spin_unlock_irqrestore(&pmlmepriv->lock, irqL); --} -- --static inline void set_scanned_network_val(struct mlme_priv *pmlmepriv, -- sint val) --{ -- unsigned long irqL; -- -- spin_lock_irqsave(&pmlmepriv->lock, irqL); -- pmlmepriv->num_of_scanned = val; -- spin_unlock_irqrestore(&pmlmepriv->lock, irqL); --} -- --void r8712_survey_event_callback(struct _adapter *adapter, u8 *pbuf); --void r8712_surveydone_event_callback(struct _adapter *adapter, u8 *pbuf); --void r8712_joinbss_event_callback(struct _adapter *adapter, u8 *pbuf); --void r8712_stassoc_event_callback(struct _adapter *adapter, u8 *pbuf); --void r8712_stadel_event_callback(struct _adapter *adapter, u8 *pbuf); --void r8712_atimdone_event_callback(struct _adapter *adapter, u8 *pbuf); --void r8712_cpwm_event_callback(struct _adapter *adapter, u8 *pbuf); --void r8712_wpspbc_event_callback(struct _adapter *adapter, u8 *pbuf); --void r8712_free_network_queue(struct _adapter *adapter); --int r8712_init_mlme_priv(struct _adapter *adapter); --void r8712_free_mlme_priv(struct mlme_priv *pmlmepriv); --int r8712_select_and_join_from_scan(struct mlme_priv *pmlmepriv); --int r8712_set_key(struct _adapter *adapter, -- struct security_priv *psecuritypriv, sint keyid); --int r8712_set_auth(struct _adapter *adapter, -- struct security_priv *psecuritypriv); --uint r8712_get_wlan_bssid_ex_sz(struct wlan_bssid_ex *bss); --void r8712_generate_random_ibss(u8 *pibss); --u8 *r8712_get_capability_from_ie(u8 *ie); --struct wlan_network *r8712_get_oldest_wlan_network( -- struct __queue *scanned_queue); --void r8712_free_assoc_resources(struct _adapter *adapter); --void r8712_ind_disconnect(struct _adapter *adapter); --void r8712_indicate_connect(struct _adapter *adapter); --int r8712_restruct_sec_ie(struct _adapter *adapter, u8 *in_ie, -- u8 *out_ie, uint in_len); --int r8712_restruct_wmm_ie(struct _adapter *adapter, u8 *in_ie, -- u8 *out_ie, uint in_len, uint initial_out_len); --void r8712_init_registrypriv_dev_network(struct _adapter *adapter); --void r8712_update_registrypriv_dev_network(struct _adapter *adapter); --void _r8712_sitesurvey_ctrl_handler(struct _adapter *adapter); --void _r8712_join_timeout_handler(struct _adapter *adapter); --void r8712_scan_timeout_handler(struct _adapter *adapter); --void _r8712_dhcp_timeout_handler(struct _adapter *adapter); --struct wlan_network *_r8712_alloc_network(struct mlme_priv *pmlmepriv); --sint r8712_if_up(struct _adapter *padapter); --void r8712_joinbss_reset(struct _adapter *padapter); --unsigned int r8712_restructure_ht_ie(struct _adapter *padapter, u8 *in_ie, -- u8 *out_ie, uint in_len, uint *pout_len); --void r8712_issue_addbareq_cmd(struct _adapter *padapter, int priority); --int r8712_is_same_ibss(struct _adapter *adapter, struct wlan_network *pnetwork); -- --#endif /*__RTL871X_MLME_H_*/ -diff --git a/drivers/staging/rtl8712/rtl871x_mp.c b/drivers/staging/rtl8712/rtl871x_mp.c -deleted file mode 100644 -index 099c512c8519fa..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_mp.c -+++ /dev/null -@@ -1,724 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#define _RTL871X_MP_C_ -- --#include "osdep_service.h" --#include "drv_types.h" --#include "rtl871x_mp_phy_regdef.h" --#include "rtl8712_cmd.h" -- --static void _init_mp_priv_(struct mp_priv *pmp_priv) --{ -- pmp_priv->mode = _LOOPBOOK_MODE_; -- pmp_priv->curr_ch = 1; -- pmp_priv->curr_modem = MIXED_PHY; -- pmp_priv->curr_rateidx = 0; -- pmp_priv->curr_txpoweridx = 0x14; -- pmp_priv->antenna_tx = ANTENNA_A; -- pmp_priv->antenna_rx = ANTENNA_AB; -- pmp_priv->check_mp_pkt = 0; -- pmp_priv->tx_pktcount = 0; -- pmp_priv->rx_pktcount = 0; -- pmp_priv->rx_crcerrpktcount = 0; --} -- --static int init_mp_priv(struct mp_priv *pmp_priv) --{ -- int i; -- struct mp_xmit_frame *pmp_xmitframe; -- -- _init_mp_priv_(pmp_priv); -- _init_queue(&pmp_priv->free_mp_xmitqueue); -- pmp_priv->pallocated_mp_xmitframe_buf = NULL; -- pmp_priv->pallocated_mp_xmitframe_buf = kmalloc(NR_MP_XMITFRAME * -- sizeof(struct mp_xmit_frame) + 4, -- GFP_ATOMIC); -- if (!pmp_priv->pallocated_mp_xmitframe_buf) -- return -ENOMEM; -- -- pmp_priv->pmp_xmtframe_buf = pmp_priv->pallocated_mp_xmitframe_buf + -- 4 - -- ((addr_t)(pmp_priv->pallocated_mp_xmitframe_buf) & 3); -- pmp_xmitframe = (struct mp_xmit_frame *)pmp_priv->pmp_xmtframe_buf; -- for (i = 0; i < NR_MP_XMITFRAME; i++) { -- INIT_LIST_HEAD(&(pmp_xmitframe->list)); -- list_add_tail(&(pmp_xmitframe->list), -- &(pmp_priv->free_mp_xmitqueue.queue)); -- pmp_xmitframe->pkt = NULL; -- pmp_xmitframe->frame_tag = MP_FRAMETAG; -- pmp_xmitframe->padapter = pmp_priv->papdater; -- pmp_xmitframe++; -- } -- pmp_priv->free_mp_xmitframe_cnt = NR_MP_XMITFRAME; -- return 0; --} -- --static int free_mp_priv(struct mp_priv *pmp_priv) --{ -- kfree(pmp_priv->pallocated_mp_xmitframe_buf); -- return 0; --} -- --void mp871xinit(struct _adapter *padapter) --{ -- struct mp_priv *pmppriv = &padapter->mppriv; -- -- pmppriv->papdater = padapter; -- init_mp_priv(pmppriv); --} -- --void mp871xdeinit(struct _adapter *padapter) --{ -- struct mp_priv *pmppriv = &padapter->mppriv; -- -- free_mp_priv(pmppriv); --} -- --/* -- * Special for bb and rf reg read/write -- */ --static u32 fw_iocmd_read(struct _adapter *pAdapter, struct IOCMD_STRUCT iocmd) --{ -- u32 cmd32 = 0, val32 = 0; -- u8 iocmd_class = iocmd.cmdclass; -- u16 iocmd_value = iocmd.value; -- u8 iocmd_idx = iocmd.index; -- -- cmd32 = (iocmd_class << 24) | (iocmd_value << 8) | iocmd_idx; -- if (r8712_fw_cmd(pAdapter, cmd32)) -- r8712_fw_cmd_data(pAdapter, &val32, 1); -- else -- val32 = 0; -- return val32; --} -- --static u8 fw_iocmd_write(struct _adapter *pAdapter, -- struct IOCMD_STRUCT iocmd, u32 value) --{ -- u32 cmd32 = 0; -- u8 iocmd_class = iocmd.cmdclass; -- u32 iocmd_value = iocmd.value; -- u8 iocmd_idx = iocmd.index; -- -- r8712_fw_cmd_data(pAdapter, &value, 0); -- msleep(100); -- cmd32 = (iocmd_class << 24) | (iocmd_value << 8) | iocmd_idx; -- return r8712_fw_cmd(pAdapter, cmd32); --} -- --/* offset : 0X800~0XFFF */ --u32 r8712_bb_reg_read(struct _adapter *pAdapter, u16 offset) --{ -- u8 shift = offset & 0x0003; /* 4 byte access */ -- u16 bb_addr = offset & 0x0FFC; /* 4 byte access */ -- u32 bb_val = 0; -- struct IOCMD_STRUCT iocmd; -- -- iocmd.cmdclass = IOCMD_CLASS_BB_RF; -- iocmd.value = bb_addr; -- iocmd.index = IOCMD_BB_READ_IDX; -- bb_val = fw_iocmd_read(pAdapter, iocmd); -- if (shift != 0) { -- u32 bb_val2 = 0; -- -- bb_val >>= (shift * 8); -- iocmd.value += 4; -- bb_val2 = fw_iocmd_read(pAdapter, iocmd); -- bb_val2 <<= ((4 - shift) * 8); -- bb_val |= bb_val2; -- } -- return bb_val; --} -- --/* offset : 0X800~0XFFF */ --u8 r8712_bb_reg_write(struct _adapter *pAdapter, u16 offset, u32 value) --{ -- u8 shift = offset & 0x0003; /* 4 byte access */ -- u16 bb_addr = offset & 0x0FFC; /* 4 byte access */ -- struct IOCMD_STRUCT iocmd; -- -- iocmd.cmdclass = IOCMD_CLASS_BB_RF; -- iocmd.value = bb_addr; -- iocmd.index = IOCMD_BB_WRITE_IDX; -- if (shift != 0) { -- u32 oldValue = 0; -- u32 newValue = value; -- -- oldValue = r8712_bb_reg_read(pAdapter, iocmd.value); -- oldValue &= (0xFFFFFFFF >> ((4 - shift) * 8)); -- value = oldValue | (newValue << (shift * 8)); -- if (!fw_iocmd_write(pAdapter, iocmd, value)) -- return false; -- iocmd.value += 4; -- oldValue = r8712_bb_reg_read(pAdapter, iocmd.value); -- oldValue &= (0xFFFFFFFF << (shift * 8)); -- value = oldValue | (newValue >> ((4 - shift) * 8)); -- } -- return fw_iocmd_write(pAdapter, iocmd, value); --} -- --/* offset : 0x00 ~ 0xFF */ --u32 r8712_rf_reg_read(struct _adapter *pAdapter, u8 path, u8 offset) --{ -- u16 rf_addr = (path << 8) | offset; -- struct IOCMD_STRUCT iocmd; -- -- iocmd.cmdclass = IOCMD_CLASS_BB_RF; -- iocmd.value = rf_addr; -- iocmd.index = IOCMD_RF_READ_IDX; -- return fw_iocmd_read(pAdapter, iocmd); --} -- --u8 r8712_rf_reg_write(struct _adapter *pAdapter, u8 path, u8 offset, u32 value) --{ -- u16 rf_addr = (path << 8) | offset; -- struct IOCMD_STRUCT iocmd; -- -- iocmd.cmdclass = IOCMD_CLASS_BB_RF; -- iocmd.value = rf_addr; -- iocmd.index = IOCMD_RF_WRIT_IDX; -- return fw_iocmd_write(pAdapter, iocmd, value); --} -- --static u32 bitshift(u32 bitmask) --{ -- u32 i; -- -- for (i = 0; i <= 31; i++) -- if (((bitmask >> i) & 0x1) == 1) -- break; -- return i; --} -- --static u32 get_bb_reg(struct _adapter *pAdapter, u16 offset, u32 bitmask) --{ -- u32 org_value, bit_shift; -- -- org_value = r8712_bb_reg_read(pAdapter, offset); -- bit_shift = bitshift(bitmask); -- return (org_value & bitmask) >> bit_shift; --} -- --static u8 set_bb_reg(struct _adapter *pAdapter, -- u16 offset, -- u32 bitmask, -- u32 value) --{ -- u32 org_value, bit_shift, new_value; -- -- if (bitmask != bMaskDWord) { -- org_value = r8712_bb_reg_read(pAdapter, offset); -- bit_shift = bitshift(bitmask); -- new_value = (org_value & (~bitmask)) | (value << bit_shift); -- } else { -- new_value = value; -- } -- return r8712_bb_reg_write(pAdapter, offset, new_value); --} -- --static u32 get_rf_reg(struct _adapter *pAdapter, u8 path, u8 offset, -- u32 bitmask) --{ -- u32 org_value, bit_shift; -- -- org_value = r8712_rf_reg_read(pAdapter, path, offset); -- bit_shift = bitshift(bitmask); -- return (org_value & bitmask) >> bit_shift; --} -- --static u8 set_rf_reg(struct _adapter *pAdapter, u8 path, u8 offset, u32 bitmask, -- u32 value) --{ -- u32 org_value, bit_shift, new_value; -- -- if (bitmask != bMaskDWord) { -- org_value = r8712_rf_reg_read(pAdapter, path, offset); -- bit_shift = bitshift(bitmask); -- new_value = (org_value & (~bitmask)) | (value << bit_shift); -- } else { -- new_value = value; -- } -- return r8712_rf_reg_write(pAdapter, path, offset, new_value); --} -- --/* -- * SetChannel -- * Description -- * Use H2C command to change channel, -- * not only modify rf register, but also other setting need to be done. -- */ --void r8712_SetChannel(struct _adapter *pAdapter) --{ -- struct cmd_priv *pcmdpriv = &pAdapter->cmdpriv; -- struct cmd_obj *pcmd = NULL; -- struct SetChannel_parm *pparm = NULL; -- u16 code = GEN_CMD_CODE(_SetChannel); -- -- pcmd = kmalloc(sizeof(*pcmd), GFP_ATOMIC); -- if (!pcmd) -- return; -- pparm = kmalloc(sizeof(*pparm), GFP_ATOMIC); -- if (!pparm) { -- kfree(pcmd); -- return; -- } -- pparm->curr_ch = pAdapter->mppriv.curr_ch; -- init_h2fwcmd_w_parm_no_rsp(pcmd, pparm, code); -- r8712_enqueue_cmd(pcmdpriv, pcmd); --} -- --static void SetCCKTxPower(struct _adapter *pAdapter, u8 TxPower) --{ -- u16 TxAGC = 0; -- -- TxAGC = TxPower; -- set_bb_reg(pAdapter, rTxAGC_CCK_Mcs32, bTxAGCRateCCK, TxAGC); --} -- --static void SetOFDMTxPower(struct _adapter *pAdapter, u8 TxPower) --{ -- u32 TxAGC = 0; -- -- TxAGC |= ((TxPower << 24) | (TxPower << 16) | (TxPower << 8) | -- TxPower); -- set_bb_reg(pAdapter, rTxAGC_Rate18_06, bTxAGCRate18_06, TxAGC); -- set_bb_reg(pAdapter, rTxAGC_Rate54_24, bTxAGCRate54_24, TxAGC); -- set_bb_reg(pAdapter, rTxAGC_Mcs03_Mcs00, bTxAGCRateMCS3_MCS0, TxAGC); -- set_bb_reg(pAdapter, rTxAGC_Mcs07_Mcs04, bTxAGCRateMCS7_MCS4, TxAGC); -- set_bb_reg(pAdapter, rTxAGC_Mcs11_Mcs08, bTxAGCRateMCS11_MCS8, TxAGC); -- set_bb_reg(pAdapter, rTxAGC_Mcs15_Mcs12, bTxAGCRateMCS15_MCS12, TxAGC); --} -- --void r8712_SetTxPower(struct _adapter *pAdapter) --{ -- u8 TxPower = pAdapter->mppriv.curr_txpoweridx; -- -- SetCCKTxPower(pAdapter, TxPower); -- SetOFDMTxPower(pAdapter, TxPower); --} -- --void r8712_SetTxAGCOffset(struct _adapter *pAdapter, u32 ulTxAGCOffset) --{ -- u32 TxAGCOffset_B, TxAGCOffset_C, TxAGCOffset_D, tmpAGC; -- -- TxAGCOffset_B = ulTxAGCOffset & 0x000000ff; -- TxAGCOffset_C = (ulTxAGCOffset & 0x0000ff00) >> 8; -- TxAGCOffset_D = (ulTxAGCOffset & 0x00ff0000) >> 16; -- tmpAGC = TxAGCOffset_D << 8 | TxAGCOffset_C << 4 | TxAGCOffset_B; -- set_bb_reg(pAdapter, rFPGA0_TxGainStage, -- (bXBTxAGC | bXCTxAGC | bXDTxAGC), tmpAGC); --} -- --void r8712_SetDataRate(struct _adapter *pAdapter) --{ -- u8 path = RF_PATH_A; -- u8 offset = RF_SYN_G2; -- u32 value; -- -- value = (pAdapter->mppriv.curr_rateidx < 4) ? 0x4440 : 0xF200; -- r8712_rf_reg_write(pAdapter, path, offset, value); --} -- --void r8712_SwitchBandwidth(struct _adapter *pAdapter) --{ -- /* 3 1.Set MAC register : BWOPMODE bit2:1 20MhzBW */ -- u8 regBwOpMode = 0; -- u8 Bandwidth = pAdapter->mppriv.curr_bandwidth; -- -- regBwOpMode = r8712_read8(pAdapter, 0x10250203); -- if (Bandwidth == HT_CHANNEL_WIDTH_20) -- regBwOpMode |= BIT(2); -- else -- regBwOpMode &= ~(BIT(2)); -- r8712_write8(pAdapter, 0x10250203, regBwOpMode); -- /* 3 2.Set PHY related register */ -- switch (Bandwidth) { -- /* 20 MHz channel*/ -- case HT_CHANNEL_WIDTH_20: -- set_bb_reg(pAdapter, rFPGA0_RFMOD, bRFMOD, 0x0); -- set_bb_reg(pAdapter, rFPGA1_RFMOD, bRFMOD, 0x0); -- /* Use PHY_REG.txt default value. Do not need to change. -- * Correct the tx power for CCK rate in 40M. -- * It is set in Tx descriptor for 8192x series -- */ -- set_bb_reg(pAdapter, rFPGA0_AnalogParameter2, bMaskDWord, 0x58); -- break; -- /* 40 MHz channel*/ -- case HT_CHANNEL_WIDTH_40: -- set_bb_reg(pAdapter, rFPGA0_RFMOD, bRFMOD, 0x1); -- set_bb_reg(pAdapter, rFPGA1_RFMOD, bRFMOD, 0x1); -- /* Use PHY_REG.txt default value. Do not need to change. -- * Correct the tx power for CCK rate in 40M. -- * Set Control channel to upper or lower. These settings are -- * required only for 40MHz -- */ -- set_bb_reg(pAdapter, rCCK0_System, bCCKSideBand, -- (HAL_PRIME_CHNL_OFFSET_DONT_CARE >> 1)); -- set_bb_reg(pAdapter, rOFDM1_LSTF, 0xC00, -- HAL_PRIME_CHNL_OFFSET_DONT_CARE); -- set_bb_reg(pAdapter, rFPGA0_AnalogParameter2, bMaskDWord, 0x18); -- break; -- default: -- break; -- } -- -- /* 3 3.Set RF related register */ -- switch (Bandwidth) { -- case HT_CHANNEL_WIDTH_20: -- set_rf_reg(pAdapter, RF_PATH_A, RF_CHNLBW, -- BIT(10) | BIT(11), 0x01); -- break; -- case HT_CHANNEL_WIDTH_40: -- set_rf_reg(pAdapter, RF_PATH_A, RF_CHNLBW, -- BIT(10) | BIT(11), 0x00); -- break; -- default: -- break; -- } --} -- --/*------------------------------Define structure----------------------------*/ --struct R_ANTENNA_SELECT_OFDM { -- u32 r_tx_antenna:4; -- u32 r_ant_l:4; -- u32 r_ant_non_ht:4; -- u32 r_ant_ht1:4; -- u32 r_ant_ht2:4; -- u32 r_ant_ht_s1:4; -- u32 r_ant_non_ht_s1:4; -- u32 OFDM_TXSC:2; -- u32 Reserved:2; --}; -- --struct R_ANTENNA_SELECT_CCK { -- u8 r_cckrx_enable_2:2; -- u8 r_cckrx_enable:2; -- u8 r_ccktx_enable:4; --}; -- --void r8712_SwitchAntenna(struct _adapter *pAdapter) --{ -- u32 ofdm_tx_en_val = 0, ofdm_tx_ant_sel_val = 0; -- u8 ofdm_rx_ant_sel_val = 0; -- u8 cck_ant_select_val = 0; -- u32 cck_ant_sel_val = 0; -- struct R_ANTENNA_SELECT_CCK *p_cck_txrx; -- -- p_cck_txrx = (struct R_ANTENNA_SELECT_CCK *)&cck_ant_select_val; -- -- switch (pAdapter->mppriv.antenna_tx) { -- case ANTENNA_A: -- /* From SD3 Willis suggestion !!! Set RF A=TX and B as standby*/ -- set_bb_reg(pAdapter, rFPGA0_XA_HSSIParameter2, 0xe, 2); -- set_bb_reg(pAdapter, rFPGA0_XB_HSSIParameter2, 0xe, 1); -- ofdm_tx_en_val = 0x3; -- ofdm_tx_ant_sel_val = 0x11111111;/* Power save */ -- p_cck_txrx->r_ccktx_enable = 0x8; -- break; -- case ANTENNA_B: -- set_bb_reg(pAdapter, rFPGA0_XA_HSSIParameter2, 0xe, 1); -- set_bb_reg(pAdapter, rFPGA0_XB_HSSIParameter2, 0xe, 2); -- ofdm_tx_en_val = 0x3; -- ofdm_tx_ant_sel_val = 0x22222222;/* Power save */ -- p_cck_txrx->r_ccktx_enable = 0x4; -- break; -- case ANTENNA_AB: /* For 8192S */ -- set_bb_reg(pAdapter, rFPGA0_XA_HSSIParameter2, 0xe, 2); -- set_bb_reg(pAdapter, rFPGA0_XB_HSSIParameter2, 0xe, 2); -- ofdm_tx_en_val = 0x3; -- ofdm_tx_ant_sel_val = 0x3321333; /* Disable Power save */ -- p_cck_txrx->r_ccktx_enable = 0xC; -- break; -- default: -- break; -- } -- /*OFDM Tx*/ -- set_bb_reg(pAdapter, rFPGA1_TxInfo, 0xffffffff, ofdm_tx_ant_sel_val); -- /*OFDM Tx*/ -- set_bb_reg(pAdapter, rFPGA0_TxInfo, 0x0000000f, ofdm_tx_en_val); -- switch (pAdapter->mppriv.antenna_rx) { -- case ANTENNA_A: -- ofdm_rx_ant_sel_val = 0x1; /* A */ -- p_cck_txrx->r_cckrx_enable = 0x0; /* default: A */ -- p_cck_txrx->r_cckrx_enable_2 = 0x0; /* option: A */ -- break; -- case ANTENNA_B: -- ofdm_rx_ant_sel_val = 0x2; /* B */ -- p_cck_txrx->r_cckrx_enable = 0x1; /* default: B */ -- p_cck_txrx->r_cckrx_enable_2 = 0x1; /* option: B */ -- break; -- case ANTENNA_AB: -- ofdm_rx_ant_sel_val = 0x3; /* AB */ -- p_cck_txrx->r_cckrx_enable = 0x0; /* default:A */ -- p_cck_txrx->r_cckrx_enable_2 = 0x1; /* option:B */ -- break; -- default: -- break; -- } -- /*OFDM Rx*/ -- set_bb_reg(pAdapter, rOFDM0_TRxPathEnable, 0x0000000f, -- ofdm_rx_ant_sel_val); -- /*OFDM Rx*/ -- set_bb_reg(pAdapter, rOFDM1_TRxPathEnable, 0x0000000f, -- ofdm_rx_ant_sel_val); -- -- cck_ant_sel_val = cck_ant_select_val; -- /*CCK TxRx*/ -- set_bb_reg(pAdapter, rCCK0_AFESetting, bMaskByte3, cck_ant_sel_val); --} -- --static void TriggerRFThermalMeter(struct _adapter *pAdapter) --{ -- /* 0x24: RF Reg[6:5] */ -- set_rf_reg(pAdapter, RF_PATH_A, RF_T_METER, bRFRegOffsetMask, 0x60); --} -- --static u32 ReadRFThermalMeter(struct _adapter *pAdapter) --{ -- /* 0x24: RF Reg[4:0] */ -- return get_rf_reg(pAdapter, RF_PATH_A, RF_T_METER, 0x1F); --} -- --void r8712_GetThermalMeter(struct _adapter *pAdapter, u32 *value) --{ -- TriggerRFThermalMeter(pAdapter); -- msleep(1000); -- *value = ReadRFThermalMeter(pAdapter); --} -- --void r8712_SetSingleCarrierTx(struct _adapter *pAdapter, u8 bStart) --{ -- if (bStart) { /* Start Single Carrier. */ -- /* 1. if OFDM block on? */ -- if (!get_bb_reg(pAdapter, rFPGA0_RFMOD, bOFDMEn)) -- /*set OFDM block on*/ -- set_bb_reg(pAdapter, rFPGA0_RFMOD, bOFDMEn, bEnable); -- /* 2. set CCK test mode off, set to CCK normal mode */ -- set_bb_reg(pAdapter, rCCK0_System, bCCKBBMode, bDisable); -- /* 3. turn on scramble setting */ -- set_bb_reg(pAdapter, rCCK0_System, bCCKScramble, bEnable); -- /* 4. Turn On Single Carrier Tx and off the other test modes. */ -- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable); -- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, bEnable); -- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable); -- } else { /* Stop Single Carrier.*/ -- /* Turn off all test modes.*/ -- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable); -- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, -- bDisable); -- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable); -- msleep(20); -- /*BB Reset*/ -- set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x0); -- set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x1); -- } --} -- --void r8712_SetSingleToneTx(struct _adapter *pAdapter, u8 bStart) --{ -- u8 rfPath; -- -- switch (pAdapter->mppriv.antenna_tx) { -- case ANTENNA_B: -- rfPath = RF_PATH_B; -- break; -- case ANTENNA_A: -- default: -- rfPath = RF_PATH_A; -- break; -- } -- if (bStart) { /* Start Single Tone.*/ -- set_bb_reg(pAdapter, rFPGA0_RFMOD, bCCKEn, bDisable); -- set_bb_reg(pAdapter, rFPGA0_RFMOD, bOFDMEn, bDisable); -- set_rf_reg(pAdapter, rfPath, RF_TX_G2, bRFRegOffsetMask, -- 0xd4000); -- msleep(100); -- /* PAD all on.*/ -- set_rf_reg(pAdapter, rfPath, RF_AC, bRFRegOffsetMask, 0x2001f); -- msleep(100); -- } else { /* Stop Single Tone.*/ -- set_bb_reg(pAdapter, rFPGA0_RFMOD, bCCKEn, bEnable); -- set_bb_reg(pAdapter, rFPGA0_RFMOD, bOFDMEn, bEnable); -- set_rf_reg(pAdapter, rfPath, RF_TX_G2, bRFRegOffsetMask, -- 0x54000); -- msleep(100); -- /* PAD all on.*/ -- set_rf_reg(pAdapter, rfPath, RF_AC, bRFRegOffsetMask, 0x30000); -- msleep(100); -- } --} -- --void r8712_SetCarrierSuppressionTx(struct _adapter *pAdapter, u8 bStart) --{ -- if (bStart) { /* Start Carrier Suppression.*/ -- if (pAdapter->mppriv.curr_rateidx <= MPT_RATE_11M) { -- /* 1. if CCK block on? */ -- if (!get_bb_reg(pAdapter, rFPGA0_RFMOD, bCCKEn)) { -- /*set CCK block on*/ -- set_bb_reg(pAdapter, rFPGA0_RFMOD, bCCKEn, -- bEnable); -- } -- /* Turn Off All Test Mode */ -- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, -- bDisable); -- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, -- bDisable); -- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, -- bDisable); -- /*transmit mode*/ -- set_bb_reg(pAdapter, rCCK0_System, bCCKBBMode, 0x2); -- /*turn off scramble setting*/ -- set_bb_reg(pAdapter, rCCK0_System, bCCKScramble, -- bDisable); -- /*Set CCK Tx Test Rate*/ -- /*Set FTxRate to 1Mbps*/ -- set_bb_reg(pAdapter, rCCK0_System, bCCKTxRate, 0x0); -- } -- } else { /* Stop Carrier Suppression. */ -- if (pAdapter->mppriv.curr_rateidx <= MPT_RATE_11M) { -- /*normal mode*/ -- set_bb_reg(pAdapter, rCCK0_System, bCCKBBMode, 0x0); -- /*turn on scramble setting*/ -- set_bb_reg(pAdapter, rCCK0_System, bCCKScramble, -- bEnable); -- /*BB Reset*/ -- set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x0); -- set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x1); -- } -- } --} -- --static void SetCCKContinuousTx(struct _adapter *pAdapter, u8 bStart) --{ -- u32 cckrate; -- -- if (bStart) { -- /* 1. if CCK block on? */ -- if (!get_bb_reg(pAdapter, rFPGA0_RFMOD, bCCKEn)) { -- /*set CCK block on*/ -- set_bb_reg(pAdapter, rFPGA0_RFMOD, bCCKEn, bEnable); -- } -- /* Turn Off All Test Mode */ -- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable); -- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, bDisable); -- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable); -- /*Set CCK Tx Test Rate*/ -- cckrate = pAdapter->mppriv.curr_rateidx; -- set_bb_reg(pAdapter, rCCK0_System, bCCKTxRate, cckrate); -- /*transmit mode*/ -- set_bb_reg(pAdapter, rCCK0_System, bCCKBBMode, 0x2); -- /*turn on scramble setting*/ -- set_bb_reg(pAdapter, rCCK0_System, bCCKScramble, bEnable); -- } else { -- /*normal mode*/ -- set_bb_reg(pAdapter, rCCK0_System, bCCKBBMode, 0x0); -- /*turn on scramble setting*/ -- set_bb_reg(pAdapter, rCCK0_System, bCCKScramble, bEnable); -- /*BB Reset*/ -- set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x0); -- set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x1); -- } --} /* mpt_StartCckContTx */ -- --static void SetOFDMContinuousTx(struct _adapter *pAdapter, u8 bStart) --{ -- if (bStart) { -- /* 1. if OFDM block on? */ -- if (!get_bb_reg(pAdapter, rFPGA0_RFMOD, bOFDMEn)) { -- /*set OFDM block on*/ -- set_bb_reg(pAdapter, rFPGA0_RFMOD, bOFDMEn, bEnable); -- } -- /* 2. set CCK test mode off, set to CCK normal mode*/ -- set_bb_reg(pAdapter, rCCK0_System, bCCKBBMode, bDisable); -- /* 3. turn on scramble setting */ -- set_bb_reg(pAdapter, rCCK0_System, bCCKScramble, bEnable); -- /* 4. Turn On Continue Tx and turn off the other test modes.*/ -- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bEnable); -- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, bDisable); -- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable); -- } else { -- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable); -- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, -- bDisable); -- set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable); -- msleep(20); -- /*BB Reset*/ -- set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x0); -- set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x1); -- } --} /* mpt_StartOfdmContTx */ -- --void r8712_SetContinuousTx(struct _adapter *pAdapter, u8 bStart) --{ -- /* ADC turn off [bit24-21] adc port0 ~ port1 */ -- if (bStart) { -- r8712_bb_reg_write(pAdapter, rRx_Wait_CCCA, -- r8712_bb_reg_read(pAdapter, -- rRx_Wait_CCCA) & 0xFE1FFFFF); -- msleep(100); -- } -- if (pAdapter->mppriv.curr_rateidx <= MPT_RATE_11M) -- SetCCKContinuousTx(pAdapter, bStart); -- else if ((pAdapter->mppriv.curr_rateidx >= MPT_RATE_6M) && -- (pAdapter->mppriv.curr_rateidx <= MPT_RATE_MCS15)) -- SetOFDMContinuousTx(pAdapter, bStart); -- /* ADC turn on [bit24-21] adc port0 ~ port1 */ -- if (!bStart) -- r8712_bb_reg_write(pAdapter, rRx_Wait_CCCA, -- r8712_bb_reg_read(pAdapter, -- rRx_Wait_CCCA) | 0x01E00000); --} -- --void r8712_ResetPhyRxPktCount(struct _adapter *pAdapter) --{ -- u32 i, phyrx_set = 0; -- -- for (i = OFDM_PPDU_BIT; i <= HT_MPDU_FAIL_BIT; i++) { -- phyrx_set = 0; -- phyrx_set |= (i << 28); /*select*/ -- phyrx_set |= 0x08000000; /* set counter to zero*/ -- r8712_write32(pAdapter, RXERR_RPT, phyrx_set); -- } --} -- --static u32 GetPhyRxPktCounts(struct _adapter *pAdapter, u32 selbit) --{ -- /*selection*/ -- u32 phyrx_set = 0; -- u32 SelectBit; -- -- SelectBit = selbit << 28; -- phyrx_set |= (SelectBit & 0xF0000000); -- r8712_write32(pAdapter, RXERR_RPT, phyrx_set); -- /*Read packet count*/ -- return r8712_read32(pAdapter, RXERR_RPT) & RPTMaxCount; --} -- --u32 r8712_GetPhyRxPktReceived(struct _adapter *pAdapter) --{ -- u32 OFDM_cnt = GetPhyRxPktCounts(pAdapter, OFDM_MPDU_OK_BIT); -- u32 CCK_cnt = GetPhyRxPktCounts(pAdapter, CCK_MPDU_OK_BIT); -- u32 HT_cnt = GetPhyRxPktCounts(pAdapter, HT_MPDU_OK_BIT); -- -- return OFDM_cnt + CCK_cnt + HT_cnt; --} -- --u32 r8712_GetPhyRxPktCRC32Error(struct _adapter *pAdapter) --{ -- u32 OFDM_cnt = GetPhyRxPktCounts(pAdapter, OFDM_MPDU_FAIL_BIT); -- u32 CCK_cnt = GetPhyRxPktCounts(pAdapter, CCK_MPDU_FAIL_BIT); -- u32 HT_cnt = GetPhyRxPktCounts(pAdapter, HT_MPDU_FAIL_BIT); -- -- return OFDM_cnt + CCK_cnt + HT_cnt; --} -diff --git a/drivers/staging/rtl8712/rtl871x_mp.h b/drivers/staging/rtl8712/rtl871x_mp.h -deleted file mode 100644 -index 0a60b1e6ccafc5..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_mp.h -+++ /dev/null -@@ -1,275 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __RTL871X_MP_H_ --#define __RTL871X_MP_H_ -- --#define MPT_NOOP 0 --#define MPT_READ_MAC_1BYTE 1 --#define MPT_READ_MAC_2BYTE 2 --#define MPT_READ_MAC_4BYTE 3 --#define MPT_WRITE_MAC_1BYTE 4 --#define MPT_WRITE_MAC_2BYTE 5 --#define MPT_WRITE_MAC_4BYTE 6 --#define MPT_READ_BB_CCK 7 --#define MPT_WRITE_BB_CCK 8 --#define MPT_READ_BB_OFDM 9 --#define MPT_WRITE_BB_OFDM 10 --#define MPT_READ_RF 11 --#define MPT_WRITE_RF 12 --#define MPT_READ_EEPROM_1BYTE 13 --#define MPT_WRITE_EEPROM_1BYTE 14 --#define MPT_READ_EEPROM_2BYTE 15 --#define MPT_WRITE_EEPROM_2BYTE 16 --#define MPT_SET_CSTHRESHOLD 21 --#define MPT_SET_INITGAIN 22 --#define MPT_SWITCH_BAND 23 --#define MPT_SWITCH_CHANNEL 24 --#define MPT_SET_DATARATE 25 --#define MPT_SWITCH_ANTENNA 26 --#define MPT_SET_TX_POWER 27 --#define MPT_SET_CONT_TX 28 --#define MPT_SET_SINGLE_CARRIER 29 --#define MPT_SET_CARRIER_SUPPRESSION 30 --#define MPT_GET_RATE_TABLE 31 --#define MPT_READ_TSSI 32 --#define MPT_GET_THERMAL_METER 33 --#define MAX_MP_XMITBUF_SZ 2048 --#define NR_MP_XMITFRAME 8 -- --struct mp_xmit_frame { -- struct list_head list; -- struct pkt_attrib attrib; -- _pkt *pkt; -- int frame_tag; -- struct _adapter *padapter; -- u8 *mem_addr; -- u16 sz[8]; -- struct urb *pxmit_urb[8]; -- u8 bpending[8]; -- u8 last[8]; --}; -- --struct mp_wiparam { -- u32 bcompleted; -- u32 act_type; -- u32 io_offset; -- u32 io_value; --}; -- --struct mp_priv { -- struct _adapter *papdater; -- /*OID cmd handler*/ -- struct mp_wiparam workparam; -- u8 act_in_progress; -- /*Tx Section*/ -- u8 TID; -- u32 tx_pktcount; -- /*Rx Section*/ -- u32 rx_pktcount; -- u32 rx_crcerrpktcount; -- u32 rx_pktloss; -- struct recv_stat rxstat; -- /*RF/BB relative*/ -- u32 curr_ch; -- u32 curr_rateidx; -- u8 curr_bandwidth; -- u8 curr_modem; -- u8 curr_txpoweridx; -- u32 curr_crystalcap; -- u16 antenna_tx; -- u16 antenna_rx; -- u8 curr_rfpath; -- u8 check_mp_pkt; -- uint ForcedDataRate; -- struct wlan_network mp_network; -- unsigned char network_macaddr[6]; -- /*Testing Flag*/ -- u32 mode;/*0 for normal type packet, -- * 1 for loopback packet (16bytes TXCMD) -- */ -- sint prev_fw_state; -- u8 *pallocated_mp_xmitframe_buf; -- u8 *pmp_xmtframe_buf; -- struct __queue free_mp_xmitqueue; -- u32 free_mp_xmitframe_cnt; --}; -- --struct IOCMD_STRUCT { -- u8 cmdclass; -- u16 value; -- u8 index; --}; -- --struct rf_reg_param { -- u32 path; -- u32 offset; -- u32 value; --}; -- --struct bb_reg_param { -- u32 offset; -- u32 value; --}; -- --/* ======================================================================= */ -- --#define LOWER true --#define RAISE false --#define IOCMD_CTRL_REG 0x10250370 --#define IOCMD_DATA_REG 0x10250374 --#define IOCMD_GET_THERMAL_METER 0xFD000028 --#define IOCMD_CLASS_BB_RF 0xF0 --#define IOCMD_BB_READ_IDX 0x00 --#define IOCMD_BB_WRITE_IDX 0x01 --#define IOCMD_RF_READ_IDX 0x02 --#define IOCMD_RF_WRIT_IDX 0x03 --#define BB_REG_BASE_ADDR 0x800 --#define RF_PATH_A 0 --#define RF_PATH_B 1 --#define RF_PATH_C 2 --#define RF_PATH_D 3 --#define MAX_RF_PATH_NUMS 2 --#define _2MAC_MODE_ 0 --#define _LOOPBOOK_MODE_ 1 -- --/* MP set force data rate base on the definition. */ --enum { -- /* CCK rate. */ -- MPT_RATE_1M, /* 0 */ -- MPT_RATE_2M, -- MPT_RATE_55M, -- MPT_RATE_11M, /* 3 */ -- -- /* OFDM rate. */ -- MPT_RATE_6M, /* 4 */ -- MPT_RATE_9M, -- MPT_RATE_12M, -- MPT_RATE_18M, -- MPT_RATE_24M, -- MPT_RATE_36M, -- MPT_RATE_48M, -- MPT_RATE_54M, /* 11 */ -- -- /* HT rate. */ -- MPT_RATE_MCS0, /* 12 */ -- MPT_RATE_MCS1, -- MPT_RATE_MCS2, -- MPT_RATE_MCS3, -- MPT_RATE_MCS4, -- MPT_RATE_MCS5, -- MPT_RATE_MCS6, -- MPT_RATE_MCS7, /* 19 */ -- MPT_RATE_MCS8, -- MPT_RATE_MCS9, -- MPT_RATE_MCS10, -- MPT_RATE_MCS11, -- MPT_RATE_MCS12, -- MPT_RATE_MCS13, -- MPT_RATE_MCS14, -- MPT_RATE_MCS15, /* 27 */ -- MPT_RATE_LAST --}; -- --/* Represent Channel Width in HT Capabilities */ --enum HT_CHANNEL_WIDTH { -- HT_CHANNEL_WIDTH_20 = 0, -- HT_CHANNEL_WIDTH_40 = 1, --}; -- --#define MAX_TX_PWR_INDEX_N_MODE 64 /* 0x3F */ -- --enum POWER_MODE { -- POWER_LOW = 0, -- POWER_NORMAL --}; -- --#define RX_PKT_BROADCAST 1 --#define RX_PKT_DEST_ADDR 2 --#define RX_PKT_PHY_MATCH 3 -- --#define RPTMaxCount 0x000FFFFF -- --/* parameter 1 : BitMask -- * bit 0 : OFDM PPDU -- * bit 1 : OFDM False Alarm -- * bit 2 : OFDM MPDU OK -- * bit 3 : OFDM MPDU Fail -- * bit 4 : CCK PPDU -- * bit 5 : CCK False Alarm -- * bit 6 : CCK MPDU ok -- * bit 7 : CCK MPDU fail -- * bit 8 : HT PPDU counter -- * bit 9 : HT false alarm -- * bit 10 : HT MPDU total -- * bit 11 : HT MPDU OK -- * bit 12 : HT MPDU fail -- * bit 15 : RX full drop -- */ --enum RXPHY_BITMASK { -- OFDM_PPDU_BIT = 0, -- OFDM_MPDU_OK_BIT, -- OFDM_MPDU_FAIL_BIT, -- CCK_PPDU_BIT, -- CCK_MPDU_OK_BIT, -- CCK_MPDU_FAIL_BIT, -- HT_PPDU_BIT, -- HT_MPDU_BIT, -- HT_MPDU_OK_BIT, -- HT_MPDU_FAIL_BIT, --}; -- --enum ENCRY_CTRL_STATE { -- HW_CONTROL, /*hw encryption& decryption*/ -- SW_CONTROL, /*sw encryption& decryption*/ -- HW_ENCRY_SW_DECRY, /*hw encryption & sw decryption*/ -- SW_ENCRY_HW_DECRY /*sw encryption & hw decryption*/ --}; -- --/* Bandwidth Offset */ --#define HAL_PRIME_CHNL_OFFSET_DONT_CARE 0 --#define HAL_PRIME_CHNL_OFFSET_LOWER 1 --#define HAL_PRIME_CHNL_OFFSET_UPPER 2 --/*=======================================================================*/ --void mp871xinit(struct _adapter *padapter); --void mp871xdeinit(struct _adapter *padapter); --u32 r8712_bb_reg_read(struct _adapter *Adapter, u16 offset); --u8 r8712_bb_reg_write(struct _adapter *Adapter, u16 offset, u32 value); --u32 r8712_rf_reg_read(struct _adapter *Adapter, u8 path, u8 offset); --u8 r8712_rf_reg_write(struct _adapter *Adapter, u8 path, -- u8 offset, u32 value); --u32 r8712_get_bb_reg(struct _adapter *Adapter, u16 offset, u32 bitmask); --u8 r8712_set_bb_reg(struct _adapter *Adapter, u16 offset, -- u32 bitmask, u32 value); --u32 r8712_get_rf_reg(struct _adapter *Adapter, u8 path, u8 offset, -- u32 bitmask); --u8 r8712_set_rf_reg(struct _adapter *Adapter, u8 path, u8 offset, -- u32 bitmask, u32 value); -- --void r8712_SetChannel(struct _adapter *pAdapter); --void r8712_SetTxPower(struct _adapter *pAdapte); --void r8712_SetTxAGCOffset(struct _adapter *pAdapter, u32 ulTxAGCOffset); --void r8712_SetDataRate(struct _adapter *pAdapter); --void r8712_SwitchBandwidth(struct _adapter *pAdapter); --void r8712_SwitchAntenna(struct _adapter *pAdapter); --void r8712_GetThermalMeter(struct _adapter *pAdapter, u32 *value); --void r8712_SetContinuousTx(struct _adapter *pAdapter, u8 bStart); --void r8712_SetSingleCarrierTx(struct _adapter *pAdapter, u8 bStart); --void r8712_SetSingleToneTx(struct _adapter *pAdapter, u8 bStart); --void r8712_SetCarrierSuppressionTx(struct _adapter *pAdapter, u8 bStart); --void r8712_ResetPhyRxPktCount(struct _adapter *pAdapter); --u32 r8712_GetPhyRxPktReceived(struct _adapter *pAdapter); --u32 r8712_GetPhyRxPktCRC32Error(struct _adapter *pAdapter); -- --#endif /*__RTL871X_MP_H_*/ -- -diff --git a/drivers/staging/rtl8712/rtl871x_mp_ioctl.c b/drivers/staging/rtl8712/rtl871x_mp_ioctl.c -deleted file mode 100644 -index 26fa09b45c9080..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_mp_ioctl.c -+++ /dev/null -@@ -1,883 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * rtl871x_mp_ioctl.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ -- --#include --#include "osdep_service.h" --#include "drv_types.h" --#include "mlme_osdep.h" --#include "rtl871x_mp.h" --#include "rtl871x_mp_ioctl.h" -- --uint oid_null_function(struct oid_par_priv *poid_par_priv) --{ -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_wireless_mode_hdl(struct oid_par_priv *poid_par_priv) --{ -- uint status = RNDIS_STATUS_SUCCESS; -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- -- if (poid_par_priv->type_of_oid == SET_OID) { -- if (poid_par_priv->information_buf_len >= sizeof(u8)) -- Adapter->registrypriv.wireless_mode = -- *(u8 *)poid_par_priv->information_buf; -- else -- status = RNDIS_STATUS_INVALID_LENGTH; -- } else if (poid_par_priv->type_of_oid == QUERY_OID) { -- if (poid_par_priv->information_buf_len >= sizeof(u8)) { -- *(u8 *)poid_par_priv->information_buf = -- Adapter->registrypriv.wireless_mode; -- *poid_par_priv->bytes_rw = -- poid_par_priv->information_buf_len; -- } else { -- status = RNDIS_STATUS_INVALID_LENGTH; -- } -- } else { -- status = RNDIS_STATUS_NOT_ACCEPTED; -- } -- return status; --} -- --uint oid_rt_pro_write_bb_reg_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- struct bb_reg_param *pbbreg; -- u16 offset; -- u32 value; -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len < sizeof(struct bb_reg_param)) -- return RNDIS_STATUS_INVALID_LENGTH; -- pbbreg = (struct bb_reg_param *)(poid_par_priv->information_buf); -- offset = (u16)(pbbreg->offset) & 0xFFF; /*0ffset :0x800~0xfff*/ -- if (offset < BB_REG_BASE_ADDR) -- offset |= BB_REG_BASE_ADDR; -- value = pbbreg->value; -- r8712_bb_reg_write(Adapter, offset, value); -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_pro_read_bb_reg_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- struct bb_reg_param *pbbreg; -- u16 offset; -- u32 value; -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len < sizeof(struct bb_reg_param)) -- return RNDIS_STATUS_INVALID_LENGTH; -- pbbreg = (struct bb_reg_param *)(poid_par_priv->information_buf); -- offset = (u16)(pbbreg->offset) & 0xFFF; /*0ffset :0x800~0xfff*/ -- if (offset < BB_REG_BASE_ADDR) -- offset |= BB_REG_BASE_ADDR; -- value = r8712_bb_reg_read(Adapter, offset); -- pbbreg->value = value; -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_pro_write_rf_reg_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- struct rf_reg_param *pbbreg; -- u8 path; -- u8 offset; -- u32 value; -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len < sizeof(struct rf_reg_param)) -- return RNDIS_STATUS_INVALID_LENGTH; -- pbbreg = (struct rf_reg_param *)(poid_par_priv->information_buf); -- path = (u8)pbbreg->path; -- if (path > RF_PATH_B) -- return RNDIS_STATUS_NOT_ACCEPTED; -- offset = (u8)pbbreg->offset; -- value = pbbreg->value; -- r8712_rf_reg_write(Adapter, path, offset, value); -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_pro_read_rf_reg_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- struct rf_reg_param *pbbreg; -- u8 path; -- u8 offset; -- u32 value; -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len < sizeof(struct rf_reg_param)) -- return RNDIS_STATUS_INVALID_LENGTH; -- pbbreg = (struct rf_reg_param *)(poid_par_priv->information_buf); -- path = (u8)pbbreg->path; -- if (path > RF_PATH_B) /* 1T2R path_a /path_b */ -- return RNDIS_STATUS_NOT_ACCEPTED; -- offset = (u8)pbbreg->offset; -- value = r8712_rf_reg_read(Adapter, path, offset); -- pbbreg->value = value; -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- return RNDIS_STATUS_SUCCESS; --} -- --/*This function initializes the DUT to the MP test mode*/ --static int mp_start_test(struct _adapter *padapter) --{ -- struct mp_priv *pmppriv = &padapter->mppriv; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct wlan_network *tgt_network = &pmlmepriv->cur_network; -- struct wlan_bssid_ex *bssid; -- struct sta_info *psta; -- unsigned long length; -- unsigned long irqL; -- int res = 0; -- -- bssid = kzalloc(sizeof(*bssid), GFP_KERNEL); -- if (!bssid) -- return -ENOMEM; -- -- /* 3 1. initialize a new struct wlan_bssid_ex */ -- memcpy(bssid->MacAddress, pmppriv->network_macaddr, ETH_ALEN); -- bssid->Ssid.SsidLength = 16; -- memcpy(bssid->Ssid.Ssid, (unsigned char *)"mp_pseudo_adhoc", -- bssid->Ssid.SsidLength); -- bssid->InfrastructureMode = Ndis802_11IBSS; -- bssid->NetworkTypeInUse = Ndis802_11DS; -- bssid->IELength = 0; -- length = r8712_get_wlan_bssid_ex_sz(bssid); -- if (length % 4) { -- /*round up to multiple of 4 bytes.*/ -- bssid->Length = ((length >> 2) + 1) << 2; -- } else { -- bssid->Length = length; -- } -- spin_lock_irqsave(&pmlmepriv->lock, irqL); -- if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) -- goto end_of_mp_start_test; -- /*init mp_start_test status*/ -- pmppriv->prev_fw_state = get_fwstate(pmlmepriv); -- pmlmepriv->fw_state = WIFI_MP_STATE; -- if (pmppriv->mode == _LOOPBOOK_MODE_) -- set_fwstate(pmlmepriv, WIFI_MP_LPBK_STATE); /*append txdesc*/ -- set_fwstate(pmlmepriv, _FW_UNDER_LINKING); -- /* 3 2. create a new psta for mp driver */ -- /* clear psta in the cur_network, if any */ -- psta = r8712_get_stainfo(&padapter->stapriv, -- tgt_network->network.MacAddress); -- if (psta) -- r8712_free_stainfo(padapter, psta); -- psta = r8712_alloc_stainfo(&padapter->stapriv, bssid->MacAddress); -- if (!psta) { -- res = -ENOMEM; -- goto end_of_mp_start_test; -- } -- /* 3 3. join pseudo AdHoc */ -- tgt_network->join_res = 1; -- tgt_network->aid = psta->aid = 1; -- memcpy(&tgt_network->network, bssid, length); -- _clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING); -- r8712_os_indicate_connect(padapter); -- /* Set to LINKED STATE for MP TRX Testing */ -- set_fwstate(pmlmepriv, _FW_LINKED); --end_of_mp_start_test: -- spin_unlock_irqrestore(&pmlmepriv->lock, irqL); -- kfree(bssid); -- return res; --} -- --/*This function change the DUT from the MP test mode into normal mode */ --static int mp_stop_test(struct _adapter *padapter) --{ -- struct mp_priv *pmppriv = &padapter->mppriv; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct wlan_network *tgt_network = &pmlmepriv->cur_network; -- struct sta_info *psta; -- unsigned long irqL; -- -- spin_lock_irqsave(&pmlmepriv->lock, irqL); -- if (!check_fwstate(pmlmepriv, WIFI_MP_STATE)) -- goto end_of_mp_stop_test; -- /* 3 1. disconnect pseudo AdHoc */ -- r8712_os_indicate_disconnect(padapter); -- /* 3 2. clear psta used in mp test mode. */ -- psta = r8712_get_stainfo(&padapter->stapriv, -- tgt_network->network.MacAddress); -- if (psta) -- r8712_free_stainfo(padapter, psta); -- /* 3 3. return to normal state (default:station mode) */ -- pmlmepriv->fw_state = pmppriv->prev_fw_state; /* WIFI_STATION_STATE;*/ -- /*flush the cur_network*/ -- memset(tgt_network, 0, sizeof(struct wlan_network)); --end_of_mp_stop_test: -- spin_unlock_irqrestore(&pmlmepriv->lock, irqL); -- return _SUCCESS; --} -- --uint oid_rt_pro_set_data_rate_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- u32 ratevalue; -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len != sizeof(u32)) -- return RNDIS_STATUS_INVALID_LENGTH; -- ratevalue = *((u32 *)poid_par_priv->information_buf); -- if (ratevalue >= MPT_RATE_LAST) -- return RNDIS_STATUS_INVALID_DATA; -- Adapter->mppriv.curr_rateidx = ratevalue; -- r8712_SetDataRate(Adapter); -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_pro_start_test_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- uint status = RNDIS_STATUS_SUCCESS; -- u32 mode; -- u8 val8; -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- mode = *((u32 *)poid_par_priv->information_buf); -- Adapter->mppriv.mode = mode;/* 1 for loopback*/ -- if (mp_start_test(Adapter)) -- status = RNDIS_STATUS_NOT_ACCEPTED; -- r8712_write8(Adapter, MSR, 1); /* Link in ad hoc network, 0x1025004C */ -- r8712_write8(Adapter, RCR, 0); /* RCR : disable all pkt, 0x10250048 */ -- /* RCR disable Check BSSID, 0x1025004a */ -- r8712_write8(Adapter, RCR + 2, 0x57); -- /* disable RX filter map , mgt frames will put in RX FIFO 0 */ -- r8712_write16(Adapter, RXFLTMAP0, 0x0); -- val8 = r8712_read8(Adapter, EE_9346CR); -- if (!(val8 & _9356SEL)) { /*boot from EFUSE*/ -- r8712_efuse_reg_init(Adapter); -- r8712_efuse_change_max_size(Adapter); -- r8712_efuse_reg_uninit(Adapter); -- } -- return status; --} -- --uint oid_rt_pro_stop_test_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (mp_stop_test(Adapter) == _FAIL) -- return RNDIS_STATUS_NOT_ACCEPTED; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_pro_set_channel_direct_call_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- u32 Channel; -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len != sizeof(u32)) -- return RNDIS_STATUS_INVALID_LENGTH; -- Channel = *((u32 *)poid_par_priv->information_buf); -- if (Channel > 14) -- return RNDIS_STATUS_NOT_ACCEPTED; -- Adapter->mppriv.curr_ch = Channel; -- r8712_SetChannel(Adapter); -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_pro_set_antenna_bb_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- u32 antenna; -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len != sizeof(u32)) -- return RNDIS_STATUS_INVALID_LENGTH; -- antenna = *((u32 *)poid_par_priv->information_buf); -- Adapter->mppriv.antenna_tx = (u16)((antenna & 0xFFFF0000) >> 16); -- Adapter->mppriv.antenna_rx = (u16)(antenna & 0x0000FFFF); -- r8712_SwitchAntenna(Adapter); -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_pro_set_tx_power_control_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- u32 tx_pwr_idx; -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len != sizeof(u32)) -- return RNDIS_STATUS_INVALID_LENGTH; -- tx_pwr_idx = *((u32 *)poid_par_priv->information_buf); -- if (tx_pwr_idx > MAX_TX_PWR_INDEX_N_MODE) -- return RNDIS_STATUS_NOT_ACCEPTED; -- Adapter->mppriv.curr_txpoweridx = (u8)tx_pwr_idx; -- r8712_SetTxPower(Adapter); -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_pro_query_tx_packet_sent_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- -- if (poid_par_priv->information_buf_len == sizeof(u32)) { -- *(u32 *)poid_par_priv->information_buf = -- Adapter->mppriv.tx_pktcount; -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- } else { -- return RNDIS_STATUS_INVALID_LENGTH; -- } -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_pro_query_rx_packet_received_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- -- if (poid_par_priv->information_buf_len == sizeof(u32)) { -- *(u32 *)poid_par_priv->information_buf = -- Adapter->mppriv.rx_pktcount; -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- } else { -- return RNDIS_STATUS_INVALID_LENGTH; -- } -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_pro_query_rx_packet_crc32_error_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- -- if (poid_par_priv->information_buf_len == sizeof(u32)) { -- *(u32 *)poid_par_priv->information_buf = -- Adapter->mppriv.rx_crcerrpktcount; -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- } else { -- return RNDIS_STATUS_INVALID_LENGTH; -- } -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_pro_reset_tx_packet_sent_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- Adapter->mppriv.tx_pktcount = 0; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_pro_reset_rx_packet_received_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len == sizeof(u32)) { -- Adapter->mppriv.rx_pktcount = 0; -- Adapter->mppriv.rx_crcerrpktcount = 0; -- } else { -- return RNDIS_STATUS_INVALID_LENGTH; -- } -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_reset_phy_rx_packet_count_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- r8712_ResetPhyRxPktCount(Adapter); -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_phy_rx_packet_received_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len != sizeof(u32)) -- return RNDIS_STATUS_INVALID_LENGTH; -- *(u32 *)poid_par_priv->information_buf = -- r8712_GetPhyRxPktReceived(Adapter); -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_phy_rx_packet_crc32_error_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len != sizeof(u32)) -- return RNDIS_STATUS_INVALID_LENGTH; -- *(u32 *)poid_par_priv->information_buf = -- r8712_GetPhyRxPktCRC32Error(Adapter); -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_pro_set_modulation_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- -- Adapter->mppriv.curr_modem = *((u8 *)poid_par_priv->information_buf); -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_pro_set_continuous_tx_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- u32 bStartTest; -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- bStartTest = *((u32 *)poid_par_priv->information_buf); -- r8712_SetContinuousTx(Adapter, (u8)bStartTest); -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_pro_set_single_carrier_tx_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- u32 bStartTest; -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- bStartTest = *((u32 *)poid_par_priv->information_buf); -- r8712_SetSingleCarrierTx(Adapter, (u8)bStartTest); -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_pro_set_carrier_suppression_tx_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- u32 bStartTest; -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- bStartTest = *((u32 *)poid_par_priv->information_buf); -- r8712_SetCarrierSuppressionTx(Adapter, (u8)bStartTest); -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_pro_set_single_tone_tx_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- u32 bStartTest; -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- bStartTest = *((u32 *)poid_par_priv->information_buf); -- r8712_SetSingleToneTx(Adapter, (u8)bStartTest); -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_pro_read_register_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- uint status = RNDIS_STATUS_SUCCESS; -- struct mp_rw_reg *RegRWStruct; -- u16 offset; -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- RegRWStruct = (struct mp_rw_reg *)poid_par_priv->information_buf; -- if ((RegRWStruct->offset >= 0x10250800) && -- (RegRWStruct->offset <= 0x10250FFF)) { -- /*baseband register*/ -- /*0ffset :0x800~0xfff*/ -- offset = (u16)(RegRWStruct->offset) & 0xFFF; -- RegRWStruct->value = r8712_bb_reg_read(Adapter, offset); -- } else { -- switch (RegRWStruct->width) { -- case 1: -- RegRWStruct->value = r8712_read8(Adapter, -- RegRWStruct->offset); -- break; -- case 2: -- RegRWStruct->value = r8712_read16(Adapter, -- RegRWStruct->offset); -- break; -- case 4: -- RegRWStruct->value = r8712_read32(Adapter, -- RegRWStruct->offset); -- break; -- default: -- status = RNDIS_STATUS_NOT_ACCEPTED; -- break; -- } -- } -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- return status; --} -- --uint oid_rt_pro_write_register_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- uint status = RNDIS_STATUS_SUCCESS; -- struct mp_rw_reg *RegRWStruct; -- u16 offset; -- u32 value; -- u32 oldValue = 0; -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- RegRWStruct = (struct mp_rw_reg *)poid_par_priv->information_buf; -- if ((RegRWStruct->offset >= 0x10250800) && -- (RegRWStruct->offset <= 0x10250FFF)) { -- /*baseband register*/ -- offset = (u16)(RegRWStruct->offset) & 0xFFF; -- value = RegRWStruct->value; -- switch (RegRWStruct->width) { -- case 1: -- oldValue = r8712_bb_reg_read(Adapter, offset); -- oldValue &= 0xFFFFFF00; -- value &= 0x000000FF; -- value |= oldValue; -- break; -- case 2: -- oldValue = r8712_bb_reg_read(Adapter, offset); -- oldValue &= 0xFFFF0000; -- value &= 0x0000FFFF; -- value |= oldValue; -- break; -- } -- r8712_bb_reg_write(Adapter, offset, value); -- } else { -- switch (RegRWStruct->width) { -- case 1: -- r8712_write8(Adapter, RegRWStruct->offset, -- (unsigned char)RegRWStruct->value); -- break; -- case 2: -- r8712_write16(Adapter, RegRWStruct->offset, -- (unsigned short)RegRWStruct->value); -- break; -- case 4: -- r8712_write32(Adapter, RegRWStruct->offset, -- (unsigned int)RegRWStruct->value); -- break; -- default: -- status = RNDIS_STATUS_NOT_ACCEPTED; -- break; -- } -- } -- return status; --} -- --uint oid_rt_get_thermal_meter_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- -- if (Adapter->mppriv.act_in_progress) -- return RNDIS_STATUS_NOT_ACCEPTED; -- -- if (poid_par_priv->information_buf_len < sizeof(u8)) -- return RNDIS_STATUS_INVALID_LENGTH; -- /*init workparam*/ -- Adapter->mppriv.act_in_progress = true; -- Adapter->mppriv.workparam.bcompleted = false; -- Adapter->mppriv.workparam.act_type = MPT_GET_THERMAL_METER; -- Adapter->mppriv.workparam.io_offset = 0; -- Adapter->mppriv.workparam.io_value = 0xFFFFFFFF; -- r8712_GetThermalMeter(Adapter, &Adapter->mppriv.workparam.io_value); -- Adapter->mppriv.workparam.bcompleted = true; -- Adapter->mppriv.act_in_progress = false; -- *(u32 *)poid_par_priv->information_buf = -- Adapter->mppriv.workparam.io_value; -- *poid_par_priv->bytes_rw = sizeof(u32); -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_pro_read_efuse_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- -- uint status = RNDIS_STATUS_SUCCESS; -- -- struct EFUSE_ACCESS_STRUCT *pefuse; -- u8 *data; -- u16 addr = 0, cnts = 0; -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len < -- sizeof(struct EFUSE_ACCESS_STRUCT)) -- return RNDIS_STATUS_INVALID_LENGTH; -- pefuse = (struct EFUSE_ACCESS_STRUCT *)poid_par_priv->information_buf; -- addr = pefuse->start_addr; -- cnts = pefuse->cnts; -- data = pefuse->data; -- memset(data, 0xFF, cnts); -- if ((addr > 511) || (cnts < 1) || (cnts > 512) || (addr + cnts) > -- EFUSE_MAX_SIZE) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (!r8712_efuse_access(Adapter, true, addr, cnts, data)) -- status = RNDIS_STATUS_FAILURE; -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- return status; --} -- --/*------------------------------------------------------------------------*/ --uint oid_rt_pro_write_efuse_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- -- uint status = RNDIS_STATUS_SUCCESS; -- -- struct EFUSE_ACCESS_STRUCT *pefuse; -- u8 *data; -- u16 addr = 0, cnts = 0; -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- -- pefuse = (struct EFUSE_ACCESS_STRUCT *)poid_par_priv->information_buf; -- addr = pefuse->start_addr; -- cnts = pefuse->cnts; -- data = pefuse->data; -- -- if ((addr > 511) || (cnts < 1) || (cnts > 512) || -- (addr + cnts) > r8712_efuse_get_max_size(Adapter)) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (!r8712_efuse_access(Adapter, false, addr, cnts, data)) -- status = RNDIS_STATUS_FAILURE; -- return status; --} -- --/*----------------------------------------------------------------------*/ -- --uint oid_rt_get_efuse_current_size_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len < sizeof(int)) -- return RNDIS_STATUS_INVALID_LENGTH; -- r8712_efuse_reg_init(Adapter); -- *(int *)poid_par_priv->information_buf = -- r8712_efuse_get_current_size(Adapter); -- r8712_efuse_reg_uninit(Adapter); -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_get_efuse_max_size_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len < sizeof(u32)) -- return RNDIS_STATUS_INVALID_LENGTH; -- *(int *)poid_par_priv->information_buf = -- r8712_efuse_get_max_size(Adapter); -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_pro_efuse_hdl(struct oid_par_priv *poid_par_priv) --{ -- uint status = RNDIS_STATUS_SUCCESS; -- -- if (poid_par_priv->type_of_oid == QUERY_OID) -- status = oid_rt_pro_read_efuse_hdl(poid_par_priv); -- else -- status = oid_rt_pro_write_efuse_hdl(poid_par_priv); -- return status; --} -- --uint oid_rt_pro_efuse_map_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- uint status = RNDIS_STATUS_SUCCESS; -- u8 *data; -- -- *poid_par_priv->bytes_rw = 0; -- if (poid_par_priv->information_buf_len < EFUSE_MAP_MAX_SIZE) -- return RNDIS_STATUS_INVALID_LENGTH; -- data = (u8 *)poid_par_priv->information_buf; -- if (poid_par_priv->type_of_oid == QUERY_OID) { -- if (r8712_efuse_map_read(Adapter, 0, EFUSE_MAP_MAX_SIZE, data)) -- *poid_par_priv->bytes_rw = EFUSE_MAP_MAX_SIZE; -- else -- status = RNDIS_STATUS_FAILURE; -- } else { -- /* SET_OID */ -- if (r8712_efuse_reg_init(Adapter)) { -- if (r8712_efuse_map_write(Adapter, 0, -- EFUSE_MAP_MAX_SIZE, data)) -- *poid_par_priv->bytes_rw = EFUSE_MAP_MAX_SIZE; -- else -- status = RNDIS_STATUS_FAILURE; -- r8712_efuse_reg_uninit(Adapter); -- } else { -- status = RNDIS_STATUS_FAILURE; -- } -- } -- return status; --} -- --uint oid_rt_set_bandwidth_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- u32 bandwidth; -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len < sizeof(u32)) -- return RNDIS_STATUS_INVALID_LENGTH; -- bandwidth = *((u32 *)poid_par_priv->information_buf);/*4*/ -- if (bandwidth != HT_CHANNEL_WIDTH_20) -- bandwidth = HT_CHANNEL_WIDTH_40; -- Adapter->mppriv.curr_bandwidth = (u8)bandwidth; -- r8712_SwitchBandwidth(Adapter); -- return RNDIS_STATUS_SUCCESS; --} -- --uint oid_rt_set_rx_packet_type_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- u8 rx_pkt_type; -- u32 rcr_val32; -- -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len < sizeof(u8)) -- return RNDIS_STATUS_INVALID_LENGTH; -- rx_pkt_type = *((u8 *)poid_par_priv->information_buf);/*4*/ -- rcr_val32 = r8712_read32(Adapter, RCR);/*RCR = 0x10250048*/ -- rcr_val32 &= ~(RCR_CBSSID | RCR_AB | RCR_AM | RCR_APM | RCR_AAP); -- switch (rx_pkt_type) { -- case RX_PKT_BROADCAST: -- rcr_val32 |= (RCR_AB | RCR_AM | RCR_APM | RCR_AAP | RCR_ACRC32); -- break; -- case RX_PKT_DEST_ADDR: -- rcr_val32 |= (RCR_AB | RCR_AM | RCR_APM | RCR_AAP | RCR_ACRC32); -- break; -- case RX_PKT_PHY_MATCH: -- rcr_val32 |= (RCR_APM | RCR_ACRC32); -- break; -- default: -- rcr_val32 &= ~(RCR_AAP | -- RCR_APM | -- RCR_AM | -- RCR_AB | -- RCR_ACRC32); -- break; -- } -- if (rx_pkt_type == RX_PKT_DEST_ADDR) -- Adapter->mppriv.check_mp_pkt = 1; -- else -- Adapter->mppriv.check_mp_pkt = 0; -- r8712_write32(Adapter, RCR, rcr_val32); -- return RNDIS_STATUS_SUCCESS; --} -- --/*--------------------------------------------------------------------------*/ --/*Linux*/ --unsigned int mp_ioctl_xmit_packet_hdl(struct oid_par_priv *poid_par_priv) --{ -- return _SUCCESS; --} -- --/*-------------------------------------------------------------------------*/ --uint oid_rt_set_power_down_hdl(struct oid_par_priv *poid_par_priv) --{ -- if (poid_par_priv->type_of_oid != SET_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- /*CALL the power_down function*/ -- return RNDIS_STATUS_SUCCESS; --} -- --/*-------------------------------------------------------------------------- */ --uint oid_rt_get_power_mode_hdl(struct oid_par_priv *poid_par_priv) --{ -- struct _adapter *Adapter = (struct _adapter *) -- (poid_par_priv->adapter_context); -- -- if (poid_par_priv->type_of_oid != QUERY_OID) -- return RNDIS_STATUS_NOT_ACCEPTED; -- if (poid_par_priv->information_buf_len < sizeof(u32)) -- return RNDIS_STATUS_INVALID_LENGTH; -- *(int *)poid_par_priv->information_buf = -- Adapter->registrypriv.low_power ? POWER_LOW : POWER_NORMAL; -- *poid_par_priv->bytes_rw = poid_par_priv->information_buf_len; -- return RNDIS_STATUS_SUCCESS; --} -diff --git a/drivers/staging/rtl8712/rtl871x_mp_ioctl.h b/drivers/staging/rtl8712/rtl871x_mp_ioctl.h -deleted file mode 100644 -index aa4d5ce471f2fa..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_mp_ioctl.h -+++ /dev/null -@@ -1,328 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef _RTL871X_MP_IOCTL_H --#define _RTL871X_MP_IOCTL_H -- --#include "osdep_service.h" --#include "drv_types.h" --#include "mp_custom_oid.h" --#include "rtl871x_ioctl.h" --#include "rtl871x_ioctl_rtl.h" --#include "rtl8712_efuse.h" -- --#define TESTFWCMDNUMBER 1000000 --#define TEST_H2CINT_WAIT_TIME 500 --#define TEST_C2HINT_WAIT_TIME 500 --#define HCI_TEST_SYSCFG_HWMASK 1 --#define _BUSCLK_40M (4 << 2) -- --struct CFG_DBG_MSG_STRUCT { -- u32 DebugLevel; -- u32 DebugComponent_H32; -- u32 DebugComponent_L32; --}; -- --struct mp_rw_reg { -- uint offset; -- uint width; -- u32 value; --}; -- --/* for OID_RT_PRO_READ16_EEPROM & OID_RT_PRO_WRITE16_EEPROM */ --struct eeprom_rw_param { -- uint offset; -- u16 value; --}; -- --struct EFUSE_ACCESS_STRUCT { -- u16 start_addr; -- u16 cnts; -- u8 data[]; --}; -- --struct burst_rw_reg { -- uint offset; -- uint len; -- u8 Data[256]; --}; -- --struct usb_vendor_req { -- u8 bRequest; -- u16 wValue; -- u16 wIndex; -- u16 wLength; -- u8 u8Dir;/*0:OUT, 1:IN */ -- u8 u8InData; --}; -- --struct DR_VARIABLE_STRUCT { -- u8 offset; -- u32 variable; --}; -- --/* oid_rtl_seg_87_11_00 */ --uint oid_rt_pro_read_register_hdl(struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_write_register_hdl(struct oid_par_priv *poid_par_priv); --/* oid_rtl_seg_81_80_00 */ --uint oid_rt_pro_set_data_rate_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_start_test_hdl(struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_stop_test_hdl(struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_set_channel_direct_call_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_set_antenna_bb_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_set_tx_power_control_hdl( -- struct oid_par_priv *poid_par_priv); --/* oid_rtl_seg_81_80_20 */ --uint oid_rt_pro_query_tx_packet_sent_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_query_rx_packet_received_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_query_rx_packet_crc32_error_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_reset_tx_packet_sent_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_reset_rx_packet_received_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_set_modulation_hdl(struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_set_continuous_tx_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_set_single_carrier_tx_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_set_carrier_suppression_tx_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_set_single_tone_tx_hdl( -- struct oid_par_priv *poid_par_priv); --/* oid_rtl_seg_81_87 */ --uint oid_rt_pro_write_bb_reg_hdl(struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_read_bb_reg_hdl(struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_write_rf_reg_hdl(struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_read_rf_reg_hdl(struct oid_par_priv *poid_par_priv); --/* oid_rtl_seg_81_85 */ --uint oid_rt_wireless_mode_hdl(struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_read_efuse_hdl(struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_write_efuse_hdl(struct oid_par_priv *poid_par_priv); --uint oid_rt_get_efuse_current_size_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_efuse_hdl(struct oid_par_priv *poid_par_priv); --uint oid_rt_pro_efuse_map_hdl(struct oid_par_priv *poid_par_priv); --uint oid_rt_set_bandwidth_hdl(struct oid_par_priv *poid_par_priv); --uint oid_rt_set_rx_packet_type_hdl(struct oid_par_priv *poid_par_priv); --uint oid_rt_get_efuse_max_size_hdl(struct oid_par_priv *poid_par_priv); --uint oid_rt_get_thermal_meter_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_reset_phy_rx_packet_count_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_phy_rx_packet_received_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_phy_rx_packet_crc32_error_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_set_power_down_hdl( -- struct oid_par_priv *poid_par_priv); --uint oid_rt_get_power_mode_hdl( -- struct oid_par_priv *poid_par_priv); --#ifdef _RTL871X_MP_IOCTL_C_ /* CAUTION!!! */ --/* This ifdef _MUST_ be left in!! */ -- --#else /* _RTL871X_MP_IOCTL_C_ */ --extern struct oid_obj_priv oid_rtl_seg_81_87[5]; --extern struct oid_obj_priv oid_rtl_seg_87_11_00[32]; --extern struct oid_obj_priv oid_rtl_seg_87_11_20[5]; --extern struct oid_obj_priv oid_rtl_seg_87_11_50[2]; --extern struct oid_obj_priv oid_rtl_seg_87_11_80[1]; --extern struct oid_obj_priv oid_rtl_seg_87_11_B0[1]; --extern struct oid_obj_priv oid_rtl_seg_87_11_F0[16]; --extern struct oid_obj_priv oid_rtl_seg_87_12_00[32]; -- --#endif /* _RTL871X_MP_IOCTL_C_ */ -- --enum MP_MODE { -- MP_START_MODE, -- MP_STOP_MODE, -- MP_ERR_MODE --}; -- --struct rwreg_param { -- unsigned int offset; -- unsigned int width; -- unsigned int value; --}; -- --struct bbreg_param { -- unsigned int offset; -- unsigned int phymask; -- unsigned int value; --}; -- --struct txpower_param { -- unsigned int pwr_index; --}; -- --struct datarate_param { -- unsigned int rate_index; --}; -- --struct rfintfs_parm { -- unsigned int rfintfs; --}; -- --struct mp_xmit_packet { -- unsigned int len; --}; -- --struct psmode_param { -- unsigned int ps_mode; -- unsigned int smart_ps; --}; -- --struct mp_ioctl_handler { -- unsigned int paramsize; -- unsigned int (*handler)(struct oid_par_priv *poid_par_priv); -- unsigned int oid; --}; -- --struct mp_ioctl_param { -- unsigned int subcode; -- unsigned int len; -- unsigned char data[]; --}; -- --#define GEN_MP_IOCTL_SUBCODE(code) _MP_IOCTL_ ## code ## _CMD_ -- --enum RTL871X_MP_IOCTL_SUBCODE { -- GEN_MP_IOCTL_SUBCODE(MP_START), /*0*/ -- GEN_MP_IOCTL_SUBCODE(MP_STOP), /*1*/ -- GEN_MP_IOCTL_SUBCODE(READ_REG), /*2*/ -- GEN_MP_IOCTL_SUBCODE(WRITE_REG), -- GEN_MP_IOCTL_SUBCODE(SET_CHANNEL), /*4*/ -- GEN_MP_IOCTL_SUBCODE(SET_TXPOWER), /*5*/ -- GEN_MP_IOCTL_SUBCODE(SET_DATARATE), /*6*/ -- GEN_MP_IOCTL_SUBCODE(READ_BB_REG), /*7*/ -- GEN_MP_IOCTL_SUBCODE(WRITE_BB_REG), -- GEN_MP_IOCTL_SUBCODE(READ_RF_REG), /*9*/ -- GEN_MP_IOCTL_SUBCODE(WRITE_RF_REG), -- GEN_MP_IOCTL_SUBCODE(SET_RF_INTFS), -- GEN_MP_IOCTL_SUBCODE(IOCTL_XMIT_PACKET), /*12*/ -- GEN_MP_IOCTL_SUBCODE(PS_STATE), /*13*/ -- GEN_MP_IOCTL_SUBCODE(READ16_EEPROM), /*14*/ -- GEN_MP_IOCTL_SUBCODE(WRITE16_EEPROM), /*15*/ -- GEN_MP_IOCTL_SUBCODE(SET_PTM), /*16*/ -- GEN_MP_IOCTL_SUBCODE(READ_TSSI), /*17*/ -- GEN_MP_IOCTL_SUBCODE(CNTU_TX), /*18*/ -- GEN_MP_IOCTL_SUBCODE(SET_BANDWIDTH), /*19*/ -- GEN_MP_IOCTL_SUBCODE(SET_RX_PKT_TYPE), /*20*/ -- GEN_MP_IOCTL_SUBCODE(RESET_PHY_RX_PKT_CNT), /*21*/ -- GEN_MP_IOCTL_SUBCODE(GET_PHY_RX_PKT_RECV), /*22*/ -- GEN_MP_IOCTL_SUBCODE(GET_PHY_RX_PKT_ERROR), /*23*/ -- GEN_MP_IOCTL_SUBCODE(SET_POWER_DOWN), /*24*/ -- GEN_MP_IOCTL_SUBCODE(GET_THERMAL_METER), /*25*/ -- GEN_MP_IOCTL_SUBCODE(GET_POWER_MODE), /*26*/ -- GEN_MP_IOCTL_SUBCODE(EFUSE), /*27*/ -- GEN_MP_IOCTL_SUBCODE(EFUSE_MAP), /*28*/ -- GEN_MP_IOCTL_SUBCODE(GET_EFUSE_MAX_SIZE), /*29*/ -- GEN_MP_IOCTL_SUBCODE(GET_EFUSE_CURRENT_SIZE), /*30*/ -- GEN_MP_IOCTL_SUBCODE(SC_TX), /*31*/ -- GEN_MP_IOCTL_SUBCODE(CS_TX), /*32*/ -- GEN_MP_IOCTL_SUBCODE(ST_TX), /*33*/ -- GEN_MP_IOCTL_SUBCODE(SET_ANTENNA), /*34*/ -- MAX_MP_IOCTL_SUBCODE, --}; -- --unsigned int mp_ioctl_xmit_packet_hdl(struct oid_par_priv *poid_par_priv); -- --#ifdef _RTL871X_MP_IOCTL_C_ /* CAUTION!!! */ --/* This ifdef _MUST_ be left in!! */ -- --static struct mp_ioctl_handler mp_ioctl_hdl[] = { -- {sizeof(u32), oid_rt_pro_start_test_hdl, -- OID_RT_PRO_START_TEST},/*0*/ -- {sizeof(u32), oid_rt_pro_stop_test_hdl, -- OID_RT_PRO_STOP_TEST},/*1*/ -- {sizeof(struct rwreg_param), -- oid_rt_pro_read_register_hdl, -- OID_RT_PRO_READ_REGISTER},/*2*/ -- {sizeof(struct rwreg_param), -- oid_rt_pro_write_register_hdl, -- OID_RT_PRO_WRITE_REGISTER}, -- {sizeof(u32), -- oid_rt_pro_set_channel_direct_call_hdl, -- OID_RT_PRO_SET_CHANNEL_DIRECT_CALL}, -- {sizeof(struct txpower_param), -- oid_rt_pro_set_tx_power_control_hdl, -- OID_RT_PRO_SET_TX_POWER_CONTROL}, -- {sizeof(u32), -- oid_rt_pro_set_data_rate_hdl, -- OID_RT_PRO_SET_DATA_RATE}, -- {sizeof(struct bb_reg_param), -- oid_rt_pro_read_bb_reg_hdl, -- OID_RT_PRO_READ_BB_REG},/*7*/ -- {sizeof(struct bb_reg_param), -- oid_rt_pro_write_bb_reg_hdl, -- OID_RT_PRO_WRITE_BB_REG}, -- {sizeof(struct rwreg_param), -- oid_rt_pro_read_rf_reg_hdl, -- OID_RT_PRO_RF_READ_REGISTRY},/*9*/ -- {sizeof(struct rwreg_param), -- oid_rt_pro_write_rf_reg_hdl, -- OID_RT_PRO_RF_WRITE_REGISTRY}, -- {sizeof(struct rfintfs_parm), NULL, 0}, -- {0, mp_ioctl_xmit_packet_hdl, 0},/*12*/ -- {sizeof(struct psmode_param), NULL, 0},/*13*/ -- {sizeof(struct eeprom_rw_param), NULL, 0},/*14*/ -- {sizeof(struct eeprom_rw_param), NULL, 0},/*15*/ -- {sizeof(unsigned char), NULL, 0},/*16*/ -- {sizeof(u32), NULL, 0},/*17*/ -- {sizeof(u32), oid_rt_pro_set_continuous_tx_hdl, -- OID_RT_PRO_SET_CONTINUOUS_TX},/*18*/ -- {sizeof(u32), oid_rt_set_bandwidth_hdl, -- OID_RT_SET_BANDWIDTH},/*19*/ -- {sizeof(u32), oid_rt_set_rx_packet_type_hdl, -- OID_RT_SET_RX_PACKET_TYPE},/*20*/ -- {0, oid_rt_reset_phy_rx_packet_count_hdl, -- OID_RT_RESET_PHY_RX_PACKET_COUNT},/*21*/ -- {sizeof(u32), oid_rt_get_phy_rx_packet_received_hdl, -- OID_RT_GET_PHY_RX_PACKET_RECEIVED},/*22*/ -- {sizeof(u32), oid_rt_get_phy_rx_packet_crc32_error_hdl, -- OID_RT_GET_PHY_RX_PACKET_CRC32_ERROR},/*23*/ -- {sizeof(unsigned char), oid_rt_set_power_down_hdl, -- OID_RT_SET_POWER_DOWN},/*24*/ -- {sizeof(u32), oid_rt_get_thermal_meter_hdl, -- OID_RT_PRO_GET_THERMAL_METER},/*25*/ -- {sizeof(u32), oid_rt_get_power_mode_hdl, -- OID_RT_GET_POWER_MODE},/*26*/ -- {sizeof(struct EFUSE_ACCESS_STRUCT), -- oid_rt_pro_efuse_hdl, OID_RT_PRO_EFUSE},/*27*/ -- {EFUSE_MAP_MAX_SIZE, oid_rt_pro_efuse_map_hdl, -- OID_RT_PRO_EFUSE_MAP},/*28*/ -- {sizeof(u32), oid_rt_get_efuse_max_size_hdl, -- OID_RT_GET_EFUSE_MAX_SIZE},/*29*/ -- {sizeof(u32), oid_rt_get_efuse_current_size_hdl, -- OID_RT_GET_EFUSE_CURRENT_SIZE},/*30*/ -- {sizeof(u32), oid_rt_pro_set_single_carrier_tx_hdl, -- OID_RT_PRO_SET_SINGLE_CARRIER_TX},/*31*/ -- {sizeof(u32), oid_rt_pro_set_carrier_suppression_tx_hdl, -- OID_RT_PRO_SET_CARRIER_SUPPRESSION_TX},/*32*/ -- {sizeof(u32), oid_rt_pro_set_single_tone_tx_hdl, -- OID_RT_PRO_SET_SINGLE_TONE_TX},/*33*/ -- {sizeof(u32), oid_rt_pro_set_antenna_bb_hdl, -- OID_RT_PRO_SET_ANTENNA_BB},/*34*/ --}; -- --#else /* _RTL871X_MP_IOCTL_C_ */ --extern struct mp_ioctl_handler mp_ioctl_hdl[]; --#endif /* _RTL871X_MP_IOCTL_C_ */ -- --#endif -- -diff --git a/drivers/staging/rtl8712/rtl871x_mp_phy_regdef.h b/drivers/staging/rtl8712/rtl871x_mp_phy_regdef.h -deleted file mode 100644 -index a08c5d2f59e38b..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_mp_phy_regdef.h -+++ /dev/null -@@ -1,1034 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/***************************************************************************** -- * Copyright(c) 2008, RealTEK Technology Inc. All Right Reserved. -- * -- * Module: __INC_HAL8192SPHYREG_H -- * -- * -- * Note: 1. Define PMAC/BB register map -- * 2. Define RF register map -- * 3. PMAC/BB register bit mask. -- * 4. RF reg bit mask. -- * 5. Other BB/RF relative definition. -- * -- * -- * Export: Constants, macro, functions(API), global variables(None). -- * -- * Abbrev: -- * -- * History: -- * Data Who Remark -- * 08/07/2007 MHC 1. Porting from 9x series PHYCFG.h. -- * 2. Reorganize code architecture. -- * 09/25/2008 MH 1. Add RL6052 register definition -- * -- *****************************************************************************/ --#ifndef __RTL871X_MP_PHY_REGDEF_H --#define __RTL871X_MP_PHY_REGDEF_H -- --/*--------------------------Define Parameters-------------------------------*/ -- --/*============================================================ -- * 8192S Register offset definition -- *============================================================ -- * -- * -- * BB-PHY register PMAC 0x100 PHY 0x800 - 0xEFF -- * 1. PMAC duplicate register due to connection: RF_Mode, TRxRN, NumOf L-STF -- * 2. 0x800/0x900/0xA00/0xC00/0xD00/0xE00 -- * 3. RF register 0x00-2E -- * 4. Bit Mask for BB/RF register -- * 5. Other definition for BB/RF R/W -- * -- * 1. PMAC duplicate register due to connection: RF_Mode, TRxRN, NumOf L-STF -- * 1. Page1(0x100) -- */ --#define rPMAC_Reset 0x100 --#define rPMAC_TxStart 0x104 --#define rPMAC_TxLegacySIG 0x108 --#define rPMAC_TxHTSIG1 0x10c --#define rPMAC_TxHTSIG2 0x110 --#define rPMAC_PHYDebug 0x114 --#define rPMAC_TxPacketNum 0x118 --#define rPMAC_TxIdle 0x11c --#define rPMAC_TxMACHeader0 0x120 --#define rPMAC_TxMACHeader1 0x124 --#define rPMAC_TxMACHeader2 0x128 --#define rPMAC_TxMACHeader3 0x12c --#define rPMAC_TxMACHeader4 0x130 --#define rPMAC_TxMACHeader5 0x134 --#define rPMAC_TxDataType 0x138 --#define rPMAC_TxRandomSeed 0x13c --#define rPMAC_CCKPLCPPreamble 0x140 --#define rPMAC_CCKPLCPHeader 0x144 --#define rPMAC_CCKCRC16 0x148 --#define rPMAC_OFDMRxCRC32OK 0x170 --#define rPMAC_OFDMRxCRC32Er 0x174 --#define rPMAC_OFDMRxParityEr 0x178 --#define rPMAC_OFDMRxCRC8Er 0x17c --#define rPMAC_CCKCRxRC16Er 0x180 --#define rPMAC_CCKCRxRC32Er 0x184 --#define rPMAC_CCKCRxRC32OK 0x188 --#define rPMAC_TxStatus 0x18c -- --/* -- * 2. Page2(0x200) -- * -- * The following two definition are only used for USB interface. -- *#define RF_BB_CMD_ADDR 0x02c0 // RF/BB read/write command address. -- *#define RF_BB_CMD_DATA 0x02c4 // RF/BB read/write command data. -- * -- * -- * 3. Page8(0x800) -- */ --#define rFPGA0_RFMOD 0x800 /*RF mode & CCK TxSC RF -- * BW Setting?? -- */ --#define rFPGA0_TxInfo 0x804 /* Status report?? */ --#define rFPGA0_PSDFunction 0x808 --#define rFPGA0_TxGainStage 0x80c /* Set TX PWR init gain? */ --#define rFPGA0_RFTiming1 0x810 /* Useless now */ --#define rFPGA0_RFTiming2 0x814 --#define rFPGA0_XA_HSSIParameter1 0x820 /* RF 3 wire register */ --#define rFPGA0_XA_HSSIParameter2 0x824 --#define rFPGA0_XB_HSSIParameter1 0x828 --#define rFPGA0_XB_HSSIParameter2 0x82c --#define rFPGA0_XC_HSSIParameter1 0x830 --#define rFPGA0_XC_HSSIParameter2 0x834 --#define rFPGA0_XD_HSSIParameter1 0x838 --#define rFPGA0_XD_HSSIParameter2 0x83c --#define rFPGA0_XA_LSSIParameter 0x840 --#define rFPGA0_XB_LSSIParameter 0x844 --#define rFPGA0_XC_LSSIParameter 0x848 --#define rFPGA0_XD_LSSIParameter 0x84c -- --#define rFPGA0_RFWakeUpParameter 0x850 /* Useless now */ --#define rFPGA0_RFSleepUpParameter 0x854 -- --#define rFPGA0_XAB_SwitchControl 0x858 /* RF Channel switch */ --#define rFPGA0_XCD_SwitchControl 0x85c -- --#define rFPGA0_XA_RFInterfaceOE 0x860 /* RF Channel switch */ --#define rFPGA0_XB_RFInterfaceOE 0x864 --#define rFPGA0_XC_RFInterfaceOE 0x868 --#define rFPGA0_XD_RFInterfaceOE 0x86c --#define rFPGA0_XAB_RFInterfaceSW 0x870 /* RF Interface Software Ctrl */ --#define rFPGA0_XCD_RFInterfaceSW 0x874 -- --#define rFPGA0_XAB_RFParameter 0x878 /* RF Parameter */ --#define rFPGA0_XCD_RFParameter 0x87c -- --#define rFPGA0_AnalogParameter1 0x880 /* Crystal cap setting -- * RF-R/W protection -- * for parameter4?? -- */ --#define rFPGA0_AnalogParameter2 0x884 --#define rFPGA0_AnalogParameter3 0x888 /* Useless now */ --#define rFPGA0_AnalogParameter4 0x88c -- --#define rFPGA0_XA_LSSIReadBack 0x8a0 /* Tranceiver LSSI Readback */ --#define rFPGA0_XB_LSSIReadBack 0x8a4 --#define rFPGA0_XC_LSSIReadBack 0x8a8 --#define rFPGA0_XD_LSSIReadBack 0x8ac -- --#define rFPGA0_PSDReport 0x8b4 /* Useless now */ --#define rFPGA0_XAB_RFInterfaceRB 0x8e0 /* Useless now */ --#define rFPGA0_XCD_RFInterfaceRB 0x8e4 /* Useless now */ -- --/* -- * 4. Page9(0x900) -- */ --#define rFPGA1_RFMOD 0x900 /* RF mode & OFDM TxSC */ -- --#define rFPGA1_TxBlock 0x904 /* Useless now */ --#define rFPGA1_DebugSelect 0x908 /* Useless now */ --#define rFPGA1_TxInfo 0x90c /* Useless now */ -- --/* -- * 5. PageA(0xA00) -- * -- * Set Control channel to upper or lower. -- * These settings are required only for 40MHz -- */ --#define rCCK0_System 0xa00 -- --#define rCCK0_AFESetting 0xa04 /* Disable init gain now */ --#define rCCK0_CCA 0xa08 /* Disable init gain now */ -- --#define rCCK0_RxAGC1 0xa0c --/* AGC default value, saturation level -- * Antenna Diversity, RX AGC, LNA Threshold, RX LNA Threshold useless now. -- * Not the same as 90 series -- */ --#define rCCK0_RxAGC2 0xa10 /* AGC & DAGC */ -- --#define rCCK0_RxHP 0xa14 -- --#define rCCK0_DSPParameter1 0xa18 /* Timing recovery & Channel -- * estimation threshold -- */ --#define rCCK0_DSPParameter2 0xa1c /* SQ threshold */ -- --#define rCCK0_TxFilter1 0xa20 --#define rCCK0_TxFilter2 0xa24 --#define rCCK0_DebugPort 0xa28 /* debug port and Tx filter3 */ --#define rCCK0_FalseAlarmReport 0xa2c /* 0xa2d useless now 0xa30-a4f -- * channel report -- */ --#define rCCK0_TRSSIReport 0xa50 --#define rCCK0_RxReport 0xa54 /* 0xa57 */ --#define rCCK0_FACounterLower 0xa5c /* 0xa5b */ --#define rCCK0_FACounterUpper 0xa58 /* 0xa5c */ -- --/* -- * 6. PageC(0xC00) -- */ --#define rOFDM0_LSTF 0xc00 --#define rOFDM0_TRxPathEnable 0xc04 --#define rOFDM0_TRMuxPar 0xc08 --#define rOFDM0_TRSWIsolation 0xc0c -- --/*RxIQ DC offset, Rx digital filter, DC notch filter */ --#define rOFDM0_XARxAFE 0xc10 --#define rOFDM0_XARxIQImbalance 0xc14 /* RxIQ imbalance matrix */ --#define rOFDM0_XBRxAFE 0xc18 --#define rOFDM0_XBRxIQImbalance 0xc1c --#define rOFDM0_XCRxAFE 0xc20 --#define rOFDM0_XCRxIQImbalance 0xc24 --#define rOFDM0_XDRxAFE 0xc28 --#define rOFDM0_XDRxIQImbalance 0xc2c -- --#define rOFDM0_RxDetector1 0xc30 /* PD,BW & SBD DM tune -- * init gain -- */ --#define rOFDM0_RxDetector2 0xc34 /* SBD & Fame Sync. */ --#define rOFDM0_RxDetector3 0xc38 /* Frame Sync. */ --#define rOFDM0_RxDetector4 0xc3c /* PD, SBD, Frame Sync & -- * Short-GI -- */ -- --#define rOFDM0_RxDSP 0xc40 /* Rx Sync Path */ --#define rOFDM0_CFOandDAGC 0xc44 /* CFO & DAGC */ --#define rOFDM0_CCADropThreshold 0xc48 /* CCA Drop threshold */ --#define rOFDM0_ECCAThreshold 0xc4c /* energy CCA */ -- --#define rOFDM0_XAAGCCore1 0xc50 /* DIG */ --#define rOFDM0_XAAGCCore2 0xc54 --#define rOFDM0_XBAGCCore1 0xc58 --#define rOFDM0_XBAGCCore2 0xc5c --#define rOFDM0_XCAGCCore1 0xc60 --#define rOFDM0_XCAGCCore2 0xc64 --#define rOFDM0_XDAGCCore1 0xc68 --#define rOFDM0_XDAGCCore2 0xc6c --#define rOFDM0_AGCParameter1 0xc70 --#define rOFDM0_AGCParameter2 0xc74 --#define rOFDM0_AGCRSSITable 0xc78 --#define rOFDM0_HTSTFAGC 0xc7c -- --#define rOFDM0_XATxIQImbalance 0xc80 /* TX PWR TRACK and DIG */ --#define rOFDM0_XATxAFE 0xc84 --#define rOFDM0_XBTxIQImbalance 0xc88 --#define rOFDM0_XBTxAFE 0xc8c --#define rOFDM0_XCTxIQImbalance 0xc90 --#define rOFDM0_XCTxAFE 0xc94 --#define rOFDM0_XDTxIQImbalance 0xc98 --#define rOFDM0_XDTxAFE 0xc9c -- --#define rOFDM0_RxHPParameter 0xce0 --#define rOFDM0_TxPseudoNoiseWgt 0xce4 --#define rOFDM0_FrameSync 0xcf0 --#define rOFDM0_DFSReport 0xcf4 --#define rOFDM0_TxCoeff1 0xca4 --#define rOFDM0_TxCoeff2 0xca8 --#define rOFDM0_TxCoeff3 0xcac --#define rOFDM0_TxCoeff4 0xcb0 --#define rOFDM0_TxCoeff5 0xcb4 --#define rOFDM0_TxCoeff6 0xcb8 -- --/* -- * 7. PageD(0xD00) -- */ --#define rOFDM1_LSTF 0xd00 --#define rOFDM1_TRxPathEnable 0xd04 -- --#define rOFDM1_CFO 0xd08 /* No setting now */ --#define rOFDM1_CSI1 0xd10 --#define rOFDM1_SBD 0xd14 --#define rOFDM1_CSI2 0xd18 --#define rOFDM1_CFOTracking 0xd2c --#define rOFDM1_TRxMesaure1 0xd34 --#define rOFDM1_IntfDet 0xd3c --#define rOFDM1_PseudoNoiseStateAB 0xd50 --#define rOFDM1_PseudoNoiseStateCD 0xd54 --#define rOFDM1_RxPseudoNoiseWgt 0xd58 -- --#define rOFDM_PHYCounter1 0xda0 /* cca, parity fail */ --#define rOFDM_PHYCounter2 0xda4 /* rate illegal, crc8 fail */ --#define rOFDM_PHYCounter3 0xda8 /* MCS not support */ --#define rOFDM_ShortCFOAB 0xdac /* No setting now */ --#define rOFDM_ShortCFOCD 0xdb0 --#define rOFDM_LongCFOAB 0xdb4 --#define rOFDM_LongCFOCD 0xdb8 --#define rOFDM_TailCFOAB 0xdbc --#define rOFDM_TailCFOCD 0xdc0 --#define rOFDM_PWMeasure1 0xdc4 --#define rOFDM_PWMeasure2 0xdc8 --#define rOFDM_BWReport 0xdcc --#define rOFDM_AGCReport 0xdd0 --#define rOFDM_RxSNR 0xdd4 --#define rOFDM_RxEVMCSI 0xdd8 --#define rOFDM_SIGReport 0xddc -- --/* -- * 8. PageE(0xE00) -- */ --#define rTxAGC_Rate18_06 0xe00 --#define rTxAGC_Rate54_24 0xe04 --#define rTxAGC_CCK_Mcs32 0xe08 --#define rTxAGC_Mcs03_Mcs00 0xe10 --#define rTxAGC_Mcs07_Mcs04 0xe14 --#define rTxAGC_Mcs11_Mcs08 0xe18 --#define rTxAGC_Mcs15_Mcs12 0xe1c -- --/* Analog- control in RX_WAIT_CCA : REG: EE0 -- * [Analog- Power & Control Register] -- */ --#define rRx_Wait_CCCA 0xe70 --#define rAnapar_Ctrl_BB 0xee0 -- --/* -- * 7. RF Register 0x00-0x2E (RF 8256) -- * RF-0222D 0x00-3F -- * -- * Zebra1 -- */ --#define rZebra1_HSSIEnable 0x0 /* Useless now */ --#define rZebra1_TRxEnable1 0x1 --#define rZebra1_TRxEnable2 0x2 --#define rZebra1_AGC 0x4 --#define rZebra1_ChargePump 0x5 --#define rZebra1_Channel 0x7 /* RF channel switch */ --#define rZebra1_TxGain 0x8 /* Useless now */ --#define rZebra1_TxLPF 0x9 --#define rZebra1_RxLPF 0xb --#define rZebra1_RxHPFCorner 0xc -- --/* Zebra4 */ --#define rGlobalCtrl 0 /* Useless now */ --#define rRTL8256_TxLPF 19 --#define rRTL8256_RxLPF 11 -- --/* RTL8258 */ --#define rRTL8258_TxLPF 0x11 /* Useless now */ --#define rRTL8258_RxLPF 0x13 --#define rRTL8258_RSSILPF 0xa -- --/* RL6052 Register definition */ --#define RF_AC 0x00 --#define RF_IQADJ_G1 0x01 --#define RF_IQADJ_G2 0x02 --#define RF_POW_TRSW 0x05 -- --#define RF_GAIN_RX 0x06 --#define RF_GAIN_TX 0x07 -- --#define RF_TXM_IDAC 0x08 --#define RF_BS_IQGEN 0x0F -- --#define RF_MODE1 0x10 --#define RF_MODE2 0x11 -- --#define RF_RX_AGC_HP 0x12 --#define RF_TX_AGC 0x13 --#define RF_BIAS 0x14 --#define RF_IPA 0x15 --#define RF_POW_ABILITY 0x17 --#define RF_MODE_AG 0x18 --#define rRfChannel 0x18 /* RF channel and BW switch */ --#define RF_CHNLBW 0x18 /* RF channel and BW switch */ --#define RF_TOP 0x19 --#define RF_RX_G1 0x1A --#define RF_RX_G2 0x1B --#define RF_RX_BB2 0x1C --#define RF_RX_BB1 0x1D -- --#define RF_RCK1 0x1E --#define RF_RCK2 0x1F -- --#define RF_TX_G1 0x20 --#define RF_TX_G2 0x21 --#define RF_TX_G3 0x22 -- --#define RF_TX_BB1 0x23 --#define RF_T_METER 0x24 -- --#define RF_SYN_G1 0x25 /* RF TX Power control */ --#define RF_SYN_G2 0x26 /* RF TX Power control */ --#define RF_SYN_G3 0x27 /* RF TX Power control */ --#define RF_SYN_G4 0x28 /* RF TX Power control */ --#define RF_SYN_G5 0x29 /* RF TX Power control */ --#define RF_SYN_G6 0x2A /* RF TX Power control */ --#define RF_SYN_G7 0x2B /* RF TX Power control */ --#define RF_SYN_G8 0x2C /* RF TX Power control */ -- --#define RF_RCK_OS 0x30 /* RF TX PA control */ -- --#define RF_TXPA_G1 0x31 /* RF TX PA control */ --#define RF_TXPA_G2 0x32 /* RF TX PA control */ --#define RF_TXPA_G3 0x33 /* RF TX PA control */ -- --/* -- * Bit Mask -- * -- * 1. Page1(0x100) -- */ --#define bBBResetB 0x100 /* Useless now? */ --#define bGlobalResetB 0x200 --#define bOFDMTxStart 0x4 --#define bCCKTxStart 0x8 --#define bCRC32Debug 0x100 --#define bPMACLoopback 0x10 --#define bTxLSIG 0xffffff --#define bOFDMTxRate 0xf --#define bOFDMTxReserved 0x10 --#define bOFDMTxLength 0x1ffe0 --#define bOFDMTxParity 0x20000 --#define bTxHTSIG1 0xffffff --#define bTxHTMCSRate 0x7f --#define bTxHTBW 0x80 --#define bTxHTLength 0xffff00 --#define bTxHTSIG2 0xffffff --#define bTxHTSmoothing 0x1 --#define bTxHTSounding 0x2 --#define bTxHTReserved 0x4 --#define bTxHTAggreation 0x8 --#define bTxHTSTBC 0x30 --#define bTxHTAdvanceCoding 0x40 --#define bTxHTShortGI 0x80 --#define bTxHTNumberHT_LTF 0x300 --#define bTxHTCRC8 0x3fc00 --#define bCounterReset 0x10000 --#define bNumOfOFDMTx 0xffff --#define bNumOfCCKTx 0xffff0000 --#define bTxIdleInterval 0xffff --#define bOFDMService 0xffff0000 --#define bTxMACHeader 0xffffffff --#define bTxDataInit 0xff --#define bTxHTMode 0x100 --#define bTxDataType 0x30000 --#define bTxRandomSeed 0xffffffff --#define bCCKTxPreamble 0x1 --#define bCCKTxSFD 0xffff0000 --#define bCCKTxSIG 0xff --#define bCCKTxService 0xff00 --#define bCCKLengthExt 0x8000 --#define bCCKTxLength 0xffff0000 --#define bCCKTxCRC16 0xffff --#define bCCKTxStatus 0x1 --#define bOFDMTxStatus 0x2 --#define IS_BB_REG_OFFSET_92S(_Offset) ((_Offset >= 0x800) && \ -- (_Offset <= 0xfff)) -- --/* 2. Page8(0x800) */ --#define bRFMOD 0x1 /* Reg 0x800 rFPGA0_RFMOD */ --#define bJapanMode 0x2 --#define bCCKTxSC 0x30 --#define bCCKEn 0x1000000 --#define bOFDMEn 0x2000000 -- --#define bOFDMRxADCPhase 0x10000 /* Useless now */ --#define bOFDMTxDACPhase 0x40000 --#define bXATxAGC 0x3f --#define bXBTxAGC 0xf00 /* Reg 80c rFPGA0_TxGainStage */ --#define bXCTxAGC 0xf000 --#define bXDTxAGC 0xf0000 -- --#define bPAStart 0xf0000000 /* Useless now */ --#define bTRStart 0x00f00000 --#define bRFStart 0x0000f000 --#define bBBStart 0x000000f0 --#define bBBCCKStart 0x0000000f --#define bPAEnd 0xf /* Reg0x814 */ --#define bTREnd 0x0f000000 --#define bRFEnd 0x000f0000 --#define bCCAMask 0x000000f0 /* T2R */ --#define bR2RCCAMask 0x00000f00 --#define bHSSI_R2TDelay 0xf8000000 --#define bHSSI_T2RDelay 0xf80000 --#define bContTxHSSI 0x400 /* change gain at continue Tx */ --#define bIGFromCCK 0x200 --#define bAGCAddress 0x3f --#define bRxHPTx 0x7000 --#define bRxHPT2R 0x38000 --#define bRxHPCCKIni 0xc0000 --#define bAGCTxCode 0xc00000 --#define bAGCRxCode 0x300000 --#define b3WireDataLength 0x800 /* Reg 0x820~84f rFPGA0_XA_HSSIParm1 */ --#define b3WireAddressLength 0x400 --#define b3WireRFPowerDown 0x1 /* Useless now */ --#define b5GPAPEPolarity 0x40000000 --#define b2GPAPEPolarity 0x80000000 --#define bRFSW_TxDefaultAnt 0x3 --#define bRFSW_TxOptionAnt 0x30 --#define bRFSW_RxDefaultAnt 0x300 --#define bRFSW_RxOptionAnt 0x3000 --#define bRFSI_3WireData 0x1 --#define bRFSI_3WireClock 0x2 --#define bRFSI_3WireLoad 0x4 --#define bRFSI_3WireRW 0x8 --#define bRFSI_3Wire 0xf --#define bRFSI_RFENV 0x10 /* Reg 0x870 rFPGA0_XAB_RFInterfaceSW */ --#define bRFSI_TRSW 0x20 /* Useless now */ --#define bRFSI_TRSWB 0x40 --#define bRFSI_ANTSW 0x100 --#define bRFSI_ANTSWB 0x200 --#define bRFSI_PAPE 0x400 --#define bRFSI_PAPE5G 0x800 --#define bBandSelect 0x1 --#define bHTSIG2_GI 0x80 --#define bHTSIG2_Smoothing 0x01 --#define bHTSIG2_Sounding 0x02 --#define bHTSIG2_Aggreaton 0x08 --#define bHTSIG2_STBC 0x30 --#define bHTSIG2_AdvCoding 0x40 --#define bHTSIG2_NumOfHTLTF 0x300 --#define bHTSIG2_CRC8 0x3fc --#define bHTSIG1_MCS 0x7f --#define bHTSIG1_BandWidth 0x80 --#define bHTSIG1_HTLength 0xffff --#define bLSIG_Rate 0xf --#define bLSIG_Reserved 0x10 --#define bLSIG_Length 0x1fffe --#define bLSIG_Parity 0x20 --#define bCCKRxPhase 0x4 --#define bLSSIReadAddress 0x7f800000 /* T65 RF */ --#define bLSSIReadEdge 0x80000000 /* LSSI "Read" edge signal */ --#define bLSSIReadBackData 0xfffff /* T65 RF */ --#define bLSSIReadOKFlag 0x1000 /* Useless now */ --#define bCCKSampleRate 0x8 /*0: 44MHz, 1:88MHz*/ --#define bRegulator0Standby 0x1 --#define bRegulatorPLLStandby 0x2 --#define bRegulator1Standby 0x4 --#define bPLLPowerUp 0x8 --#define bDPLLPowerUp 0x10 --#define bDA10PowerUp 0x20 --#define bAD7PowerUp 0x200 --#define bDA6PowerUp 0x2000 --#define bXtalPowerUp 0x4000 --#define b40MDClkPowerUP 0x8000 --#define bDA6DebugMode 0x20000 --#define bDA6Swing 0x380000 -- --/* Reg 0x880 rFPGA0_AnalogParameter1 20/40 CCK support switch 40/80 BB MHZ */ --#define bADClkPhase 0x4000000 -- --#define b80MClkDelay 0x18000000 /* Useless */ --#define bAFEWatchDogEnable 0x20000000 -- --/* Reg 0x884 rFPGA0_AnalogParameter2 Crystal cap */ --#define bXtalCap01 0xc0000000 --#define bXtalCap23 0x3 --#define bXtalCap92x 0x0f000000 --#define bXtalCap 0x0f000000 --#define bIntDifClkEnable 0x400 /* Useless */ --#define bExtSigClkEnable 0x800 --#define bBandgapMbiasPowerUp 0x10000 --#define bAD11SHGain 0xc0000 --#define bAD11InputRange 0x700000 --#define bAD11OPCurrent 0x3800000 --#define bIPathLoopback 0x4000000 --#define bQPathLoopback 0x8000000 --#define bAFELoopback 0x10000000 --#define bDA10Swing 0x7e0 --#define bDA10Reverse 0x800 --#define bDAClkSource 0x1000 --#define bAD7InputRange 0x6000 --#define bAD7Gain 0x38000 --#define bAD7OutputCMMode 0x40000 --#define bAD7InputCMMode 0x380000 --#define bAD7Current 0xc00000 --#define bRegulatorAdjust 0x7000000 --#define bAD11PowerUpAtTx 0x1 --#define bDA10PSAtTx 0x10 --#define bAD11PowerUpAtRx 0x100 --#define bDA10PSAtRx 0x1000 --#define bCCKRxAGCFormat 0x200 --#define bPSDFFTSamplepPoint 0xc000 --#define bPSDAverageNum 0x3000 --#define bIQPathControl 0xc00 --#define bPSDFreq 0x3ff --#define bPSDAntennaPath 0x30 --#define bPSDIQSwitch 0x40 --#define bPSDRxTrigger 0x400000 --#define bPSDTxTrigger 0x80000000 --#define bPSDSineToneScale 0x7f000000 --#define bPSDReport 0xffff -- --/* 3. Page9(0x900) */ --#define bOFDMTxSC 0x30000000 /* Useless */ --#define bCCKTxOn 0x1 --#define bOFDMTxOn 0x2 --#define bDebugPage 0xfff /* reset debug page and HWord, LWord */ --#define bDebugItem 0xff /* reset debug page and LWord */ --#define bAntL 0x10 --#define bAntNonHT 0x100 --#define bAntHT1 0x1000 --#define bAntHT2 0x10000 --#define bAntHT1S1 0x100000 --#define bAntNonHTS1 0x1000000 -- --/* 4. PageA(0xA00) */ --#define bCCKBBMode 0x3 /* Useless */ --#define bCCKTxPowerSaving 0x80 --#define bCCKRxPowerSaving 0x40 -- --#define bCCKSideBand 0x10 /* Reg 0xa00 rCCK0_System 20/40 switch*/ --#define bCCKScramble 0x8 /* Useless */ --#define bCCKAntDiversity 0x8000 --#define bCCKCarrierRecovery 0x4000 --#define bCCKTxRate 0x3000 --#define bCCKDCCancel 0x0800 --#define bCCKISICancel 0x0400 --#define bCCKMatchFilter 0x0200 --#define bCCKEqualizer 0x0100 --#define bCCKPreambleDetect 0x800000 --#define bCCKFastFalseCCA 0x400000 --#define bCCKChEstStart 0x300000 --#define bCCKCCACount 0x080000 --#define bCCKcs_lim 0x070000 --#define bCCKBistMode 0x80000000 --#define bCCKCCAMask 0x40000000 --#define bCCKTxDACPhase 0x4 --#define bCCKRxADCPhase 0x20000000 /* r_rx_clk */ --#define bCCKr_cp_mode0 0x0100 --#define bCCKTxDCOffset 0xf0 --#define bCCKRxDCOffset 0xf --#define bCCKCCAMode 0xc000 --#define bCCKFalseCS_lim 0x3f00 --#define bCCKCS_ratio 0xc00000 --#define bCCKCorgBit_sel 0x300000 --#define bCCKPD_lim 0x0f0000 --#define bCCKNewCCA 0x80000000 --#define bCCKRxHPofIG 0x8000 --#define bCCKRxIG 0x7f00 --#define bCCKLNAPolarity 0x800000 --#define bCCKRx1stGain 0x7f0000 --#define bCCKRFExtend 0x20000000 /* CCK Rx initial gain polarity */ --#define bCCKRxAGCSatLevel 0x1f000000 --#define bCCKRxAGCSatCount 0xe0 --#define bCCKRxRFSettle 0x1f /* AGCsamp_dly */ --#define bCCKFixedRxAGC 0x8000 --#define bCCKAntennaPolarity 0x2000 --#define bCCKTxFilterType 0x0c00 --#define bCCKRxAGCReportType 0x0300 --#define bCCKRxDAGCEn 0x80000000 --#define bCCKRxDAGCPeriod 0x20000000 --#define bCCKRxDAGCSatLevel 0x1f000000 --#define bCCKTimingRecovery 0x800000 --#define bCCKTxC0 0x3f0000 --#define bCCKTxC1 0x3f000000 --#define bCCKTxC2 0x3f --#define bCCKTxC3 0x3f00 --#define bCCKTxC4 0x3f0000 --#define bCCKTxC5 0x3f000000 --#define bCCKTxC6 0x3f --#define bCCKTxC7 0x3f00 --#define bCCKDebugPort 0xff0000 --#define bCCKDACDebug 0x0f000000 --#define bCCKFalseAlarmEnable 0x8000 --#define bCCKFalseAlarmRead 0x4000 --#define bCCKTRSSI 0x7f --#define bCCKRxAGCReport 0xfe --#define bCCKRxReport_AntSel 0x80000000 --#define bCCKRxReport_MFOff 0x40000000 --#define bCCKRxRxReport_SQLoss 0x20000000 --#define bCCKRxReport_Pktloss 0x10000000 --#define bCCKRxReport_Lockedbit 0x08000000 --#define bCCKRxReport_RateError 0x04000000 --#define bCCKRxReport_RxRate 0x03000000 --#define bCCKRxFACounterLower 0xff --#define bCCKRxFACounterUpper 0xff000000 --#define bCCKRxHPAGCStart 0xe000 --#define bCCKRxHPAGCFinal 0x1c00 --#define bCCKRxFalseAlarmEnable 0x8000 --#define bCCKFACounterFreeze 0x4000 --#define bCCKTxPathSel 0x10000000 --#define bCCKDefaultRxPath 0xc000000 --#define bCCKOptionRxPath 0x3000000 -- --/* 5. PageC(0xC00) */ --#define bNumOfSTF 0x3 /* Useless */ --#define bShift_L 0xc0 --#define bGI_TH 0xc --#define bRxPathA 0x1 --#define bRxPathB 0x2 --#define bRxPathC 0x4 --#define bRxPathD 0x8 --#define bTxPathA 0x1 --#define bTxPathB 0x2 --#define bTxPathC 0x4 --#define bTxPathD 0x8 --#define bTRSSIFreq 0x200 --#define bADCBackoff 0x3000 --#define bDFIRBackoff 0xc000 --#define bTRSSILatchPhase 0x10000 --#define bRxIDCOffset 0xff --#define bRxQDCOffset 0xff00 --#define bRxDFIRMode 0x1800000 --#define bRxDCNFType 0xe000000 --#define bRXIQImb_A 0x3ff --#define bRXIQImb_B 0xfc00 --#define bRXIQImb_C 0x3f0000 --#define bRXIQImb_D 0xffc00000 --#define bDC_dc_Notch 0x60000 --#define bRxNBINotch 0x1f000000 --#define bPD_TH 0xf --#define bPD_TH_Opt2 0xc000 --#define bPWED_TH 0x700 --#define bIfMF_Win_L 0x800 --#define bPD_Option 0x1000 --#define bMF_Win_L 0xe000 --#define bBW_Search_L 0x30000 --#define bwin_enh_L 0xc0000 --#define bBW_TH 0x700000 --#define bED_TH2 0x3800000 --#define bBW_option 0x4000000 --#define bRatio_TH 0x18000000 --#define bWindow_L 0xe0000000 --#define bSBD_Option 0x1 --#define bFrame_TH 0x1c --#define bFS_Option 0x60 --#define bDC_Slope_check 0x80 --#define bFGuard_Counter_DC_L 0xe00 --#define bFrame_Weight_Short 0x7000 --#define bSub_Tune 0xe00000 --#define bFrame_DC_Length 0xe000000 --#define bSBD_start_offset 0x30000000 --#define bFrame_TH_2 0x7 --#define bFrame_GI2_TH 0x38 --#define bGI2_Sync_en 0x40 --#define bSarch_Short_Early 0x300 --#define bSarch_Short_Late 0xc00 --#define bSarch_GI2_Late 0x70000 --#define bCFOAntSum 0x1 --#define bCFOAcc 0x2 --#define bCFOStartOffset 0xc --#define bCFOLookBack 0x70 --#define bCFOSumWeight 0x80 --#define bDAGCEnable 0x10000 --#define bTXIQImb_A 0x3ff --#define bTXIQImb_B 0xfc00 --#define bTXIQImb_C 0x3f0000 --#define bTXIQImb_D 0xffc00000 --#define bTxIDCOffset 0xff --#define bTxQDCOffset 0xff00 --#define bTxDFIRMode 0x10000 --#define bTxPesudoNoiseOn 0x4000000 --#define bTxPesudoNoise_A 0xff --#define bTxPesudoNoise_B 0xff00 --#define bTxPesudoNoise_C 0xff0000 --#define bTxPesudoNoise_D 0xff000000 --#define bCCADropOption 0x20000 --#define bCCADropThres 0xfff00000 --#define bEDCCA_H 0xf --#define bEDCCA_L 0xf0 --#define bLambda_ED 0x300 --#define bRxInitialGain 0x7f --#define bRxAntDivEn 0x80 --#define bRxAGCAddressForLNA 0x7f00 --#define bRxHighPowerFlow 0x8000 --#define bRxAGCFreezeThres 0xc0000 --#define bRxFreezeStep_AGC1 0x300000 --#define bRxFreezeStep_AGC2 0xc00000 --#define bRxFreezeStep_AGC3 0x3000000 --#define bRxFreezeStep_AGC0 0xc000000 --#define bRxRssi_Cmp_En 0x10000000 --#define bRxQuickAGCEn 0x20000000 --#define bRxAGCFreezeThresMode 0x40000000 --#define bRxOverFlowCheckType 0x80000000 --#define bRxAGCShift 0x7f --#define bTRSW_Tri_Only 0x80 --#define bPowerThres 0x300 --#define bRxAGCEn 0x1 --#define bRxAGCTogetherEn 0x2 --#define bRxAGCMin 0x4 --#define bRxHP_Ini 0x7 --#define bRxHP_TRLNA 0x70 --#define bRxHP_RSSI 0x700 --#define bRxHP_BBP1 0x7000 --#define bRxHP_BBP2 0x70000 --#define bRxHP_BBP3 0x700000 --#define bRSSI_H 0x7f0000 /* the threshold for high power */ --#define bRSSI_Gen 0x7f000000 /* the threshold for ant divers */ --#define bRxSettle_TRSW 0x7 --#define bRxSettle_LNA 0x38 --#define bRxSettle_RSSI 0x1c0 --#define bRxSettle_BBP 0xe00 --#define bRxSettle_RxHP 0x7000 --#define bRxSettle_AntSW_RSSI 0x38000 --#define bRxSettle_AntSW 0xc0000 --#define bRxProcessTime_DAGC 0x300000 --#define bRxSettle_HSSI 0x400000 --#define bRxProcessTime_BBPPW 0x800000 --#define bRxAntennaPowerShift 0x3000000 --#define bRSSITableSelect 0xc000000 --#define bRxHP_Final 0x7000000 --#define bRxHTSettle_BBP 0x7 --#define bRxHTSettle_HSSI 0x8 --#define bRxHTSettle_RxHP 0x70 --#define bRxHTSettle_BBPPW 0x80 --#define bRxHTSettle_Idle 0x300 --#define bRxHTSettle_Reserved 0x1c00 --#define bRxHTRxHPEn 0x8000 --#define bRxHTAGCFreezeThres 0x30000 --#define bRxHTAGCTogetherEn 0x40000 --#define bRxHTAGCMin 0x80000 --#define bRxHTAGCEn 0x100000 --#define bRxHTDAGCEn 0x200000 --#define bRxHTRxHP_BBP 0x1c00000 --#define bRxHTRxHP_Final 0xe0000000 --#define bRxPWRatioTH 0x3 --#define bRxPWRatioEn 0x4 --#define bRxMFHold 0x3800 --#define bRxPD_Delay_TH1 0x38 --#define bRxPD_Delay_TH2 0x1c0 --#define bRxPD_DC_COUNT_MAX 0x600 --#define bRxPD_Delay_TH 0x8000 --#define bRxProcess_Delay 0xf0000 --#define bRxSearchrange_GI2_Early 0x700000 --#define bRxFrame_Guard_Counter_L 0x3800000 --#define bRxSGI_Guard_L 0xc000000 --#define bRxSGI_Search_L 0x30000000 --#define bRxSGI_TH 0xc0000000 --#define bDFSCnt0 0xff --#define bDFSCnt1 0xff00 --#define bDFSFlag 0xf0000 --#define bMFWeightSum 0x300000 --#define bMinIdxTH 0x7f000000 --#define bDAFormat 0x40000 --#define bTxChEmuEnable 0x01000000 --#define bTRSWIsolation_A 0x7f --#define bTRSWIsolation_B 0x7f00 --#define bTRSWIsolation_C 0x7f0000 --#define bTRSWIsolation_D 0x7f000000 --#define bExtLNAGain 0x7c00 -- --/* 6. PageE(0xE00) */ --#define bSTBCEn 0x4 /* Useless */ --#define bAntennaMapping 0x10 --#define bNss 0x20 --#define bCFOAntSumD 0x200 --#define bPHYCounterReset 0x8000000 --#define bCFOReportGet 0x4000000 --#define bOFDMContinueTx 0x10000000 --#define bOFDMSingleCarrier 0x20000000 --#define bOFDMSingleTone 0x40000000 --#define bHTDetect 0x100 --#define bCFOEn 0x10000 --#define bCFOValue 0xfff00000 --#define bSigTone_Re 0x3f --#define bSigTone_Im 0x7f00 --#define bCounter_CCA 0xffff --#define bCounter_ParityFail 0xffff0000 --#define bCounter_RateIllegal 0xffff --#define bCounter_CRC8Fail 0xffff0000 --#define bCounter_MCSNoSupport 0xffff --#define bCounter_FastSync 0xffff --#define bShortCFO 0xfff --#define bShortCFOTLength 12 /* total */ --#define bShortCFOFLength 11 /* fraction */ --#define bLongCFO 0x7ff --#define bLongCFOTLength 11 --#define bLongCFOFLength 11 --#define bTailCFO 0x1fff --#define bTailCFOTLength 13 --#define bTailCFOFLength 12 --#define bmax_en_pwdB 0xffff --#define bCC_power_dB 0xffff0000 --#define bnoise_pwdB 0xffff --#define bPowerMeasTLength 10 --#define bPowerMeasFLength 3 --#define bRx_HT_BW 0x1 --#define bRxSC 0x6 --#define bRx_HT 0x8 --#define bNB_intf_det_on 0x1 --#define bIntf_win_len_cfg 0x30 --#define bNB_Intf_TH_cfg 0x1c0 --#define bRFGain 0x3f --#define bTableSel 0x40 --#define bTRSW 0x80 --#define bRxSNR_A 0xff --#define bRxSNR_B 0xff00 --#define bRxSNR_C 0xff0000 --#define bRxSNR_D 0xff000000 --#define bSNREVMTLength 8 --#define bSNREVMFLength 1 --#define bCSI1st 0xff --#define bCSI2nd 0xff00 --#define bRxEVM1st 0xff0000 --#define bRxEVM2nd 0xff000000 --#define bSIGEVM 0xff --#define bPWDB 0xff00 --#define bSGIEN 0x10000 -- --#define bSFactorQAM1 0xf /* Useless */ --#define bSFactorQAM2 0xf0 --#define bSFactorQAM3 0xf00 --#define bSFactorQAM4 0xf000 --#define bSFactorQAM5 0xf0000 --#define bSFactorQAM6 0xf0000 --#define bSFactorQAM7 0xf00000 --#define bSFactorQAM8 0xf000000 --#define bSFactorQAM9 0xf0000000 --#define bCSIScheme 0x100000 -- --#define bNoiseLvlTopSet 0x3 /* Useless */ --#define bChSmooth 0x4 --#define bChSmoothCfg1 0x38 --#define bChSmoothCfg2 0x1c0 --#define bChSmoothCfg3 0xe00 --#define bChSmoothCfg4 0x7000 --#define bMRCMode 0x800000 --#define bTHEVMCfg 0x7000000 -- --#define bLoopFitType 0x1 /* Useless */ --#define bUpdCFO 0x40 --#define bUpdCFOOffData 0x80 --#define bAdvUpdCFO 0x100 --#define bAdvTimeCtrl 0x800 --#define bUpdClko 0x1000 --#define bFC 0x6000 --#define bTrackingMode 0x8000 --#define bPhCmpEnable 0x10000 --#define bUpdClkoLTF 0x20000 --#define bComChCFO 0x40000 --#define bCSIEstiMode 0x80000 --#define bAdvUpdEqz 0x100000 --#define bUChCfg 0x7000000 --#define bUpdEqz 0x8000000 -- --#define bTxAGCRate18_06 0x7f7f7f7f /* Useless */ --#define bTxAGCRate54_24 0x7f7f7f7f --#define bTxAGCRateMCS32 0x7f --#define bTxAGCRateCCK 0x7f00 --#define bTxAGCRateMCS3_MCS0 0x7f7f7f7f --#define bTxAGCRateMCS7_MCS4 0x7f7f7f7f --#define bTxAGCRateMCS11_MCS8 0x7f7f7f7f --#define bTxAGCRateMCS15_MCS12 0x7f7f7f7f -- --/* Rx Pseduo noise */ --#define bRxPesudoNoiseOn 0x20000000 /* Useless */ --#define bRxPesudoNoise_A 0xff --#define bRxPesudoNoise_B 0xff00 --#define bRxPesudoNoise_C 0xff0000 --#define bRxPesudoNoise_D 0xff000000 --#define bPesudoNoiseState_A 0xffff --#define bPesudoNoiseState_B 0xffff0000 --#define bPesudoNoiseState_C 0xffff --#define bPesudoNoiseState_D 0xffff0000 -- --/* 7. RF Register -- * Zebra1 -- */ --#define bZebra1_HSSIEnable 0x8 /* Useless */ --#define bZebra1_TRxControl 0xc00 --#define bZebra1_TRxGainSetting 0x07f --#define bZebra1_RxCorner 0xc00 --#define bZebra1_TxChargePump 0x38 --#define bZebra1_RxChargePump 0x7 --#define bZebra1_ChannelNum 0xf80 --#define bZebra1_TxLPFBW 0x400 --#define bZebra1_RxLPFBW 0x600 -- --/*Zebra4 */ --#define bRTL8256RegModeCtrl1 0x100 /* Useless */ --#define bRTL8256RegModeCtrl0 0x40 --#define bRTL8256_TxLPFBW 0x18 --#define bRTL8256_RxLPFBW 0x600 -- --/* RTL8258 */ --#define bRTL8258_TxLPFBW 0xc /* Useless */ --#define bRTL8258_RxLPFBW 0xc00 --#define bRTL8258_RSSILPFBW 0xc0 -- --/* -- * Other Definition -- */ -- --/* byte endable for sb_write */ --#define bByte0 0x1 /* Useless */ --#define bByte1 0x2 --#define bByte2 0x4 --#define bByte3 0x8 --#define bWord0 0x3 --#define bWord1 0xc --#define bDWord 0xf -- --/* for PutRegsetting & GetRegSetting BitMask */ --#define bMaskByte0 0xff /* Reg 0xc50 rOFDM0_XAAGCCore~0xC6f */ --#define bMaskByte1 0xff00 --#define bMaskByte2 0xff0000 --#define bMaskByte3 0xff000000 --#define bMaskHWord 0xffff0000 --#define bMaskLWord 0x0000ffff --#define bMaskDWord 0xffffffff -- --/* for PutRFRegsetting & GetRFRegSetting BitMask */ --#define bRFRegOffsetMask 0xfffff --#define bEnable 0x1 /* Useless */ --#define bDisable 0x0 -- --#define LeftAntenna 0x0 /* Useless */ --#define RightAntenna 0x1 -- --#define tCheckTxStatus 500 /* 500ms Useless */ --#define tUpdateRxCounter 100 /* 100ms */ -- --#define rateCCK 0 /* Useless */ --#define rateOFDM 1 --#define rateHT 2 -- --/* define Register-End */ --#define bPMAC_End 0x1ff /* Useless */ --#define bFPGAPHY0_End 0x8ff --#define bFPGAPHY1_End 0x9ff --#define bCCKPHY0_End 0xaff --#define bOFDMPHY0_End 0xcff --#define bOFDMPHY1_End 0xdff -- --#define bPMACControl 0x0 /* Useless */ --#define bWMACControl 0x1 --#define bWNICControl 0x2 -- --#define ANTENNA_A 0x1 /* Useless */ --#define ANTENNA_B 0x2 --#define ANTENNA_AB 0x3 /* ANTENNA_A |ANTENNA_B */ -- --#define ANTENNA_C 0x4 --#define ANTENNA_D 0x8 -- --/* accept all physical address */ --#define RCR_AAP BIT(0) --#define RCR_APM BIT(1) /* accept physical match */ --#define RCR_AM BIT(2) /* accept multicast */ --#define RCR_AB BIT(3) /* accept broadcast */ --#define RCR_ACRC32 BIT(5) /* accept error packet */ --#define RCR_9356SEL BIT(6) --#define RCR_AICV BIT(12) /* Accept ICV error packet */ --#define RCR_RXFTH0 (BIT(13)|BIT(14)|BIT(15)) /* Rx FIFO threshold */ --#define RCR_ADF BIT(18) /* Accept Data(frame type) frame */ --#define RCR_ACF BIT(19) /* Accept control frame */ --#define RCR_AMF BIT(20) /* Accept management frame */ --#define RCR_ADD3 BIT(21) --#define RCR_APWRMGT BIT(22) /* Accept power management packet */ --#define RCR_CBSSID BIT(23) /* Accept BSSID match packet */ --#define RCR_ENMARP BIT(28) /* enable mac auto reset phy */ --#define RCR_EnCS1 BIT(29) /* enable carrier sense method 1 */ --#define RCR_EnCS2 BIT(30) /* enable carrier sense method 2 */ --/* Rx Early mode is performed for packet size greater than 1536 */ --#define RCR_OnlyErlPkt BIT(31) -- --/*--------------------------Define Parameters-------------------------------*/ -- --#endif /*__INC_HAL8192SPHYREG_H */ -- -diff --git a/drivers/staging/rtl8712/rtl871x_pwrctrl.c b/drivers/staging/rtl8712/rtl871x_pwrctrl.c -deleted file mode 100644 -index cd6d9ff0bebca7..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_pwrctrl.c -+++ /dev/null -@@ -1,234 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * rtl871x_pwrctrl.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _RTL871X_PWRCTRL_C_ -- --#include "osdep_service.h" --#include "drv_types.h" --#include "osdep_intf.h" -- --#define RTL8712_SDIO_LOCAL_BASE 0X10100000 --#define SDIO_HCPWM (RTL8712_SDIO_LOCAL_BASE + 0x0081) -- --void r8712_set_rpwm(struct _adapter *padapter, u8 val8) --{ -- u8 rpwm; -- struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv; -- -- if (pwrpriv->rpwm == val8) { -- if (pwrpriv->rpwm_retry == 0) -- return; -- } -- if (padapter->driver_stopped || padapter->surprise_removed) -- return; -- rpwm = val8 | pwrpriv->tog; -- switch (val8) { -- case PS_STATE_S1: -- pwrpriv->cpwm = val8; -- break; -- case PS_STATE_S2:/* only for USB normal powersave mode use, -- * temp mark some code. -- */ -- case PS_STATE_S3: -- case PS_STATE_S4: -- pwrpriv->cpwm = val8; -- break; -- default: -- break; -- } -- pwrpriv->rpwm_retry = 0; -- pwrpriv->rpwm = val8; -- r8712_write8(padapter, 0x1025FE58, rpwm); -- pwrpriv->tog += 0x80; --} -- --void r8712_set_ps_mode(struct _adapter *padapter, uint ps_mode, uint smart_ps) --{ -- struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv; -- -- if (ps_mode > PM_Card_Disable) -- return; -- /* if driver is in active state, we dont need set smart_ps.*/ -- if (ps_mode == PS_MODE_ACTIVE) -- smart_ps = 0; -- if ((pwrpriv->pwr_mode != ps_mode) || (pwrpriv->smart_ps != smart_ps)) { -- if (pwrpriv->pwr_mode == PS_MODE_ACTIVE) -- pwrpriv->bSleep = true; -- else -- pwrpriv->bSleep = false; -- pwrpriv->pwr_mode = ps_mode; -- pwrpriv->smart_ps = smart_ps; -- schedule_work(&pwrpriv->SetPSModeWorkItem); -- } --} -- --/* -- * Caller:ISR handler... -- * -- * This will be called when CPWM interrupt is up. -- * -- * using to update cpwn of drv; and drv will make a decision to up or -- * down pwr level -- */ --void r8712_cpwm_int_hdl(struct _adapter *padapter, -- struct reportpwrstate_parm *preportpwrstate) --{ -- struct pwrctrl_priv *pwrpriv = &(padapter->pwrctrlpriv); -- struct cmd_priv *pcmdpriv = &(padapter->cmdpriv); -- -- if (pwrpriv->cpwm_tog == ((preportpwrstate->state) & 0x80)) -- return; -- del_timer(&padapter->pwrctrlpriv.rpwm_check_timer); -- mutex_lock(&pwrpriv->mutex_lock); -- pwrpriv->cpwm = (preportpwrstate->state) & 0xf; -- if (pwrpriv->cpwm >= PS_STATE_S2) { -- if (pwrpriv->alives & CMD_ALIVE) -- complete(&(pcmdpriv->cmd_queue_comp)); -- } -- pwrpriv->cpwm_tog = (preportpwrstate->state) & 0x80; -- mutex_unlock(&pwrpriv->mutex_lock); --} -- --static inline void register_task_alive(struct pwrctrl_priv *pwrctrl, uint tag) --{ -- pwrctrl->alives |= tag; --} -- --static inline void unregister_task_alive(struct pwrctrl_priv *pwrctrl, uint tag) --{ -- if (pwrctrl->alives & tag) -- pwrctrl->alives ^= tag; --} -- --static void _rpwm_check_handler (struct _adapter *padapter) --{ -- struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv; -- -- if (padapter->driver_stopped || padapter->surprise_removed) -- return; -- if (pwrpriv->cpwm != pwrpriv->rpwm) -- schedule_work(&pwrpriv->rpwm_workitem); --} -- --static void SetPSModeWorkItemCallback(struct work_struct *work) --{ -- struct pwrctrl_priv *pwrpriv = container_of(work, -- struct pwrctrl_priv, SetPSModeWorkItem); -- struct _adapter *padapter = container_of(pwrpriv, -- struct _adapter, pwrctrlpriv); -- if (!pwrpriv->bSleep) { -- mutex_lock(&pwrpriv->mutex_lock); -- if (pwrpriv->pwr_mode == PS_MODE_ACTIVE) -- r8712_set_rpwm(padapter, PS_STATE_S4); -- mutex_unlock(&pwrpriv->mutex_lock); -- } --} -- --static void rpwm_workitem_callback(struct work_struct *work) --{ -- struct pwrctrl_priv *pwrpriv = container_of(work, -- struct pwrctrl_priv, rpwm_workitem); -- struct _adapter *padapter = container_of(pwrpriv, -- struct _adapter, pwrctrlpriv); -- if (pwrpriv->cpwm != pwrpriv->rpwm) { -- mutex_lock(&pwrpriv->mutex_lock); -- r8712_read8(padapter, SDIO_HCPWM); -- pwrpriv->rpwm_retry = 1; -- r8712_set_rpwm(padapter, pwrpriv->rpwm); -- mutex_unlock(&pwrpriv->mutex_lock); -- } --} -- --static void rpwm_check_handler (struct timer_list *t) --{ -- struct _adapter *adapter = -- from_timer(adapter, t, pwrctrlpriv.rpwm_check_timer); -- -- _rpwm_check_handler(adapter); --} -- --void r8712_init_pwrctrl_priv(struct _adapter *padapter) --{ -- struct pwrctrl_priv *pwrctrlpriv = &padapter->pwrctrlpriv; -- -- memset((unsigned char *)pwrctrlpriv, 0, sizeof(struct pwrctrl_priv)); -- mutex_init(&pwrctrlpriv->mutex_lock); -- pwrctrlpriv->cpwm = PS_STATE_S4; -- pwrctrlpriv->pwr_mode = PS_MODE_ACTIVE; -- pwrctrlpriv->smart_ps = 0; -- pwrctrlpriv->tog = 0x80; --/* clear RPWM to ensure driver and fw back to initial state. */ -- r8712_write8(padapter, 0x1025FE58, 0); -- INIT_WORK(&pwrctrlpriv->SetPSModeWorkItem, SetPSModeWorkItemCallback); -- INIT_WORK(&pwrctrlpriv->rpwm_workitem, rpwm_workitem_callback); -- timer_setup(&pwrctrlpriv->rpwm_check_timer, rpwm_check_handler, 0); --} -- --/* -- * Caller: r8712_cmd_thread -- * Check if the fw_pwrstate is okay for issuing cmd. -- * If not (cpwm should be is less than P2 state), then the sub-routine -- * will raise the cpwm to be greater than or equal to P2. -- * Calling Context: Passive -- * Return Value: -- * 0: r8712_cmd_thread can issue cmds to firmware afterwards. -- * -EINVAL: r8712_cmd_thread can not do anything. -- */ --int r8712_register_cmd_alive(struct _adapter *padapter) --{ -- int res = 0; -- struct pwrctrl_priv *pwrctrl = &padapter->pwrctrlpriv; -- -- mutex_lock(&pwrctrl->mutex_lock); -- register_task_alive(pwrctrl, CMD_ALIVE); -- if (pwrctrl->cpwm < PS_STATE_S2) { -- r8712_set_rpwm(padapter, PS_STATE_S3); -- res = -EINVAL; -- } -- mutex_unlock(&pwrctrl->mutex_lock); -- return res; --} -- --/* -- * Caller: ISR -- * If ISR's txdone, -- * No more pkts for TX, -- * Then driver shall call this fun. to power down firmware again. -- */ --void r8712_unregister_cmd_alive(struct _adapter *padapter) --{ -- struct pwrctrl_priv *pwrctrl = &padapter->pwrctrlpriv; -- -- mutex_lock(&pwrctrl->mutex_lock); -- unregister_task_alive(pwrctrl, CMD_ALIVE); -- if ((pwrctrl->cpwm > PS_STATE_S2) && -- (pwrctrl->pwr_mode > PS_MODE_ACTIVE)) { -- if ((pwrctrl->alives == 0) && -- (check_fwstate(&padapter->mlmepriv, -- _FW_UNDER_LINKING) != true)) { -- r8712_set_rpwm(padapter, PS_STATE_S0); -- } -- } -- mutex_unlock(&pwrctrl->mutex_lock); --} -- --void r8712_flush_rwctrl_works(struct _adapter *padapter) --{ -- struct pwrctrl_priv *pwrctrl = &padapter->pwrctrlpriv; -- -- flush_work(&pwrctrl->SetPSModeWorkItem); -- flush_work(&pwrctrl->rpwm_workitem); --} -diff --git a/drivers/staging/rtl8712/rtl871x_pwrctrl.h b/drivers/staging/rtl8712/rtl871x_pwrctrl.h -deleted file mode 100644 -index b35b9c7920ebbf..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_pwrctrl.h -+++ /dev/null -@@ -1,113 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __RTL871X_PWRCTRL_H_ --#define __RTL871X_PWRCTRL_H_ -- --#include "osdep_service.h" --#include "drv_types.h" -- --#define CMD_ALIVE BIT(2) -- --enum Power_Mgnt { -- PS_MODE_ACTIVE = 0, -- PS_MODE_MIN, -- PS_MODE_MAX, -- PS_MODE_DTIM, -- PS_MODE_VOIP, -- PS_MODE_UAPSD_WMM, -- PS_MODE_UAPSD, -- PS_MODE_IBSS, -- PS_MODE_WWLAN, -- PM_Radio_Off, -- PM_Card_Disable, -- PS_MODE_NUM --}; -- --/* -- * BIT[2:0] = HW state -- * BIT[3] = Protocol PS state, 0: register active state, -- * 1: register sleep state -- * BIT[4] = sub-state -- */ -- --#define PS_DPS BIT(0) --#define PS_LCLK (PS_DPS) --#define PS_RF_OFF BIT(1) --#define PS_ALL_ON BIT(2) --#define PS_ST_ACTIVE BIT(3) --#define PS_LP BIT(4) /* low performance */ -- --#define PS_STATE_MASK (0x0F) --#define PS_STATE_HW_MASK (0x07) --#define PS_SEQ_MASK (0xc0) -- --#define PS_STATE(x) (PS_STATE_MASK & (x)) --#define PS_STATE_HW(x) (PS_STATE_HW_MASK & (x)) --#define PS_SEQ(x) (PS_SEQ_MASK & (x)) -- --#define PS_STATE_S0 (PS_DPS) --#define PS_STATE_S1 (PS_LCLK) --#define PS_STATE_S2 (PS_RF_OFF) --#define PS_STATE_S3 (PS_ALL_ON) --#define PS_STATE_S4 ((PS_ST_ACTIVE) | (PS_ALL_ON)) -- --#define PS_IS_RF_ON(x) ((x) & (PS_ALL_ON)) --#define PS_IS_ACTIVE(x) ((x) & (PS_ST_ACTIVE)) --#define CLR_PS_STATE(x) ((x) = ((x) & (0xF0))) -- --struct reportpwrstate_parm { -- unsigned char mode; -- unsigned char state; /* the CPWM value */ -- unsigned short rsvd; --}; -- --struct pwrctrl_priv { -- struct mutex mutex_lock; -- /*volatile*/ u8 rpwm; /* requested power state for fw */ -- /* fw current power state. updated when 1. read from HCPWM or -- * 2. driver lowers power level -- */ -- /*volatile*/ u8 cpwm; -- /*volatile*/ u8 tog; /* toggling */ -- /*volatile*/ u8 cpwm_tog; /* toggling */ -- /*volatile*/ u8 tgt_rpwm; /* wanted power state */ -- uint pwr_mode; -- uint smart_ps; -- uint alives; -- uint ImrContent; /* used to store original imr. */ -- uint bSleep; /* sleep -> active is different from active -> sleep. */ -- -- struct work_struct SetPSModeWorkItem; -- struct work_struct rpwm_workitem; -- struct timer_list rpwm_check_timer; -- u8 rpwm_retry; -- uint bSetPSModeWorkItemInProgress; -- -- spinlock_t pnp_pwr_mgnt_lock; -- s32 pnp_current_pwr_state; -- u8 pnp_bstop_trx; -- u8 pnp_wwirp_pending; --}; -- --void r8712_init_pwrctrl_priv(struct _adapter *adapter); --int r8712_register_cmd_alive(struct _adapter *padapter); --void r8712_unregister_cmd_alive(struct _adapter *padapter); --void r8712_cpwm_int_hdl(struct _adapter *padapter, -- struct reportpwrstate_parm *preportpwrstate); --void r8712_set_ps_mode(struct _adapter *padapter, uint ps_mode, -- uint smart_ps); --void r8712_set_rpwm(struct _adapter *padapter, u8 val8); --void r8712_flush_rwctrl_works(struct _adapter *padapter); -- --#endif /* __RTL871X_PWRCTRL_H_ */ -diff --git a/drivers/staging/rtl8712/rtl871x_recv.c b/drivers/staging/rtl8712/rtl871x_recv.c -deleted file mode 100644 -index 8a3566214af726..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_recv.c -+++ /dev/null -@@ -1,671 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * rtl871x_recv.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _RTL871X_RECV_C_ -- --#include --#include --#include --#include --#include -- --#include "osdep_service.h" --#include "drv_types.h" --#include "recv_osdep.h" --#include "mlme_osdep.h" --#include "ethernet.h" --#include "usb_ops.h" --#include "wifi.h" -- --static const u8 SNAP_ETH_TYPE_IPX[2] = {0x81, 0x37}; -- --/* Datagram Delivery Protocol */ --static const u8 SNAP_ETH_TYPE_APPLETALK_AARP[2] = {0x80, 0xf3}; -- --void _r8712_init_sta_recv_priv(struct sta_recv_priv *psta_recvpriv) --{ -- memset((u8 *)psta_recvpriv, 0, sizeof(struct sta_recv_priv)); -- spin_lock_init(&psta_recvpriv->lock); -- _init_queue(&psta_recvpriv->defrag_q); --} -- --int _r8712_init_recv_priv(struct recv_priv *precvpriv, -- struct _adapter *padapter) --{ -- int ret; -- sint i; -- union recv_frame *precvframe; -- -- memset((unsigned char *)precvpriv, 0, sizeof(struct recv_priv)); -- spin_lock_init(&precvpriv->lock); -- _init_queue(&precvpriv->free_recv_queue); -- _init_queue(&precvpriv->recv_pending_queue); -- precvpriv->adapter = padapter; -- precvpriv->free_recvframe_cnt = NR_RECVFRAME; -- precvpriv->pallocated_frame_buf = kzalloc(NR_RECVFRAME * -- sizeof(union recv_frame) + RXFRAME_ALIGN_SZ, -- GFP_ATOMIC); -- if (!precvpriv->pallocated_frame_buf) -- return -ENOMEM; -- precvpriv->precv_frame_buf = precvpriv->pallocated_frame_buf + -- RXFRAME_ALIGN_SZ - -- ((addr_t)(precvpriv->pallocated_frame_buf) & -- (RXFRAME_ALIGN_SZ - 1)); -- precvframe = (union recv_frame *)precvpriv->precv_frame_buf; -- for (i = 0; i < NR_RECVFRAME; i++) { -- INIT_LIST_HEAD(&(precvframe->u.list)); -- list_add_tail(&(precvframe->u.list), -- &(precvpriv->free_recv_queue.queue)); -- r8712_os_recv_resource_alloc(padapter, precvframe); -- precvframe->u.hdr.adapter = padapter; -- precvframe++; -- } -- precvpriv->rx_pending_cnt = 1; -- ret = r8712_init_recv_priv(precvpriv, padapter); -- if (ret) -- kfree(precvpriv->pallocated_frame_buf); -- -- return ret; --} -- --void _r8712_free_recv_priv(struct recv_priv *precvpriv) --{ -- kfree(precvpriv->pallocated_frame_buf); -- r8712_free_recv_priv(precvpriv); --} -- --union recv_frame *r8712_alloc_recvframe(struct __queue *pfree_recv_queue) --{ -- unsigned long irqL; -- union recv_frame *precvframe; -- struct _adapter *padapter; -- struct recv_priv *precvpriv; -- -- spin_lock_irqsave(&pfree_recv_queue->lock, irqL); -- precvframe = list_first_entry_or_null(&pfree_recv_queue->queue, -- union recv_frame, u.hdr.list); -- if (precvframe) { -- list_del_init(&precvframe->u.hdr.list); -- padapter = precvframe->u.hdr.adapter; -- if (padapter) { -- precvpriv = &padapter->recvpriv; -- if (pfree_recv_queue == &precvpriv->free_recv_queue) -- precvpriv->free_recvframe_cnt--; -- } -- } -- spin_unlock_irqrestore(&pfree_recv_queue->lock, irqL); -- return precvframe; --} -- --/* -- * caller : defrag; recvframe_chk_defrag in recv_thread (passive) -- * pframequeue: defrag_queue : will be accessed in recv_thread (passive) -- * using spin_lock to protect -- */ --void r8712_free_recvframe_queue(struct __queue *pframequeue, -- struct __queue *pfree_recv_queue) --{ -- union recv_frame *precvframe; -- struct list_head *plist, *phead; -- -- spin_lock(&pframequeue->lock); -- phead = &pframequeue->queue; -- plist = phead->next; -- while (!end_of_queue_search(phead, plist)) { -- precvframe = container_of(plist, union recv_frame, u.list); -- plist = plist->next; -- r8712_free_recvframe(precvframe, pfree_recv_queue); -- } -- spin_unlock(&pframequeue->lock); --} -- --sint r8712_recvframe_chkmic(struct _adapter *adapter, -- union recv_frame *precvframe) --{ -- sint i, res = _SUCCESS; -- u32 datalen; -- u8 miccode[8]; -- u8 bmic_err = false; -- u8 *pframe, *payload, *pframemic; -- u8 *mickey, idx, *iv; -- struct sta_info *stainfo; -- struct rx_pkt_attrib *prxattrib = &precvframe->u.hdr.attrib; -- struct security_priv *psecuritypriv = &adapter->securitypriv; -- -- stainfo = r8712_get_stainfo(&adapter->stapriv, &prxattrib->ta[0]); -- if (prxattrib->encrypt == _TKIP_) { -- /* calculate mic code */ -- if (stainfo) { -- if (is_multicast_ether_addr(prxattrib->ra)) { -- iv = precvframe->u.hdr.rx_data + -- prxattrib->hdrlen; -- idx = iv[3]; -- mickey = &psecuritypriv->XGrprxmickey[(((idx >> -- 6) & 0x3)) - 1].skey[0]; -- if (!psecuritypriv->binstallGrpkey) -- return _FAIL; -- } else { -- mickey = &stainfo->tkiprxmickey.skey[0]; -- } -- /*icv_len included the mic code*/ -- datalen = precvframe->u.hdr.len - prxattrib->hdrlen - -- prxattrib->iv_len - prxattrib->icv_len - 8; -- pframe = precvframe->u.hdr.rx_data; -- payload = pframe + prxattrib->hdrlen + -- prxattrib->iv_len; -- seccalctkipmic(mickey, pframe, payload, datalen, -- &miccode[0], -- (unsigned char)prxattrib->priority); -- pframemic = payload + datalen; -- bmic_err = false; -- for (i = 0; i < 8; i++) { -- if (miccode[i] != *(pframemic + i)) -- bmic_err = true; -- } -- if (bmic_err) { -- if (prxattrib->bdecrypted) -- r8712_handle_tkip_mic_err(adapter, -- (u8)is_multicast_ether_addr(prxattrib->ra)); -- res = _FAIL; -- } else { -- /* mic checked ok */ -- if (!psecuritypriv->bcheck_grpkey && -- is_multicast_ether_addr(prxattrib->ra)) -- psecuritypriv->bcheck_grpkey = true; -- } -- recvframe_pull_tail(precvframe, 8); -- } -- } -- return res; --} -- --/* decrypt and set the ivlen,icvlen of the recv_frame */ --union recv_frame *r8712_decryptor(struct _adapter *padapter, -- union recv_frame *precv_frame) --{ -- struct rx_pkt_attrib *prxattrib = &precv_frame->u.hdr.attrib; -- struct security_priv *psecuritypriv = &padapter->securitypriv; -- union recv_frame *return_packet = precv_frame; -- -- if ((prxattrib->encrypt > 0) && ((prxattrib->bdecrypted == 0) || -- psecuritypriv->sw_decrypt)) { -- psecuritypriv->hw_decrypted = false; -- switch (prxattrib->encrypt) { -- case _WEP40_: -- case _WEP104_: -- r8712_wep_decrypt(padapter, (u8 *)precv_frame); -- break; -- case _TKIP_: -- r8712_tkip_decrypt(padapter, (u8 *)precv_frame); -- break; -- case _AES_: -- r8712_aes_decrypt(padapter, (u8 *)precv_frame); -- break; -- default: -- break; -- } -- } else if (prxattrib->bdecrypted == 1) { -- psecuritypriv->hw_decrypted = true; -- } -- return return_packet; --} -- --/*###set the security information in the recv_frame */ --union recv_frame *r8712_portctrl(struct _adapter *adapter, -- union recv_frame *precv_frame) --{ -- u8 *psta_addr, *ptr; -- uint auth_alg; -- struct recv_frame_hdr *pfhdr; -- struct sta_info *psta; -- struct sta_priv *pstapriv; -- union recv_frame *prtnframe; -- u16 ether_type; -- -- pstapriv = &adapter->stapriv; -- ptr = precv_frame->u.hdr.rx_data; -- pfhdr = &precv_frame->u.hdr; -- psta_addr = pfhdr->attrib.ta; -- psta = r8712_get_stainfo(pstapriv, psta_addr); -- auth_alg = adapter->securitypriv.AuthAlgrthm; -- if (auth_alg == 2) { -- /* get ether_type */ -- ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE; -- ether_type = get_unaligned_be16(ptr); -- -- if (psta && psta->ieee8021x_blocked) { -- /* blocked -- * only accept EAPOL frame -- */ -- if (ether_type == 0x888e) { -- prtnframe = precv_frame; -- } else { -- /*free this frame*/ -- r8712_free_recvframe(precv_frame, -- &adapter->recvpriv.free_recv_queue); -- prtnframe = NULL; -- } -- } else { -- /* allowed -- * check decryption status, and decrypt the -- * frame if needed -- */ -- prtnframe = precv_frame; -- /* check is the EAPOL frame or not (Rekey) */ -- if (ether_type == 0x888e) { -- /* check Rekey */ -- prtnframe = precv_frame; -- } -- } -- } else { -- prtnframe = precv_frame; -- } -- return prtnframe; --} -- --static sint recv_decache(union recv_frame *precv_frame, u8 bretry, -- struct stainfo_rxcache *prxcache) --{ -- sint tid = precv_frame->u.hdr.attrib.priority; -- u16 seq_ctrl = ((precv_frame->u.hdr.attrib.seq_num & 0xffff) << 4) | -- (precv_frame->u.hdr.attrib.frag_num & 0xf); -- -- if (tid > 15) -- return _FAIL; -- if (seq_ctrl == prxcache->tid_rxseq[tid]) -- return _FAIL; -- prxcache->tid_rxseq[tid] = seq_ctrl; -- return _SUCCESS; --} -- --static sint sta2sta_data_frame(struct _adapter *adapter, -- union recv_frame *precv_frame, -- struct sta_info **psta) --{ -- u8 *ptr = precv_frame->u.hdr.rx_data; -- sint ret = _SUCCESS; -- struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib; -- struct sta_priv *pstapriv = &adapter->stapriv; -- struct mlme_priv *pmlmepriv = &adapter->mlmepriv; -- u8 *mybssid = get_bssid(pmlmepriv); -- u8 *myhwaddr = myid(&adapter->eeprompriv); -- u8 *sta_addr = NULL; -- bool bmcast = is_multicast_ether_addr(pattrib->dst); -- -- if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) || -- check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) { -- /* filter packets that SA is myself or multicast or broadcast */ -- if (!memcmp(myhwaddr, pattrib->src, ETH_ALEN)) -- return _FAIL; -- if ((memcmp(myhwaddr, pattrib->dst, ETH_ALEN)) && (!bmcast)) -- return _FAIL; -- if (is_zero_ether_addr(pattrib->bssid) || -- is_zero_ether_addr(mybssid) || -- (memcmp(pattrib->bssid, mybssid, ETH_ALEN))) -- return _FAIL; -- sta_addr = pattrib->src; -- } else if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) { -- /* For Station mode, sa and bssid should always be BSSID, -- * and DA is my mac-address -- */ -- if (memcmp(pattrib->bssid, pattrib->src, ETH_ALEN)) -- return _FAIL; -- sta_addr = pattrib->bssid; -- } else if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) { -- if (bmcast) { -- /* For AP mode, if DA == MCAST, then BSSID should -- * be also MCAST -- */ -- if (!is_multicast_ether_addr(pattrib->bssid)) -- return _FAIL; -- } else { /* not mc-frame */ -- /* For AP mode, if DA is non-MCAST, then it must be -- * BSSID, and bssid == BSSID -- */ -- if (memcmp(pattrib->bssid, pattrib->dst, ETH_ALEN)) -- return _FAIL; -- sta_addr = pattrib->src; -- } -- } else if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) { -- memcpy(pattrib->dst, GetAddr1Ptr(ptr), ETH_ALEN); -- memcpy(pattrib->src, GetAddr2Ptr(ptr), ETH_ALEN); -- memcpy(pattrib->bssid, GetAddr3Ptr(ptr), ETH_ALEN); -- memcpy(pattrib->ra, pattrib->dst, ETH_ALEN); -- memcpy(pattrib->ta, pattrib->src, ETH_ALEN); -- sta_addr = mybssid; -- } else { -- ret = _FAIL; -- } -- if (bmcast) -- *psta = r8712_get_bcmc_stainfo(adapter); -- else -- *psta = r8712_get_stainfo(pstapriv, sta_addr); /* get ap_info */ -- if (!*psta) { -- if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) -- adapter->mppriv.rx_pktloss++; -- return _FAIL; -- } -- return ret; --} -- --static sint ap2sta_data_frame(struct _adapter *adapter, -- union recv_frame *precv_frame, -- struct sta_info **psta) --{ -- u8 *ptr = precv_frame->u.hdr.rx_data; -- struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib; -- struct sta_priv *pstapriv = &adapter->stapriv; -- struct mlme_priv *pmlmepriv = &adapter->mlmepriv; -- u8 *mybssid = get_bssid(pmlmepriv); -- u8 *myhwaddr = myid(&adapter->eeprompriv); -- bool bmcast = is_multicast_ether_addr(pattrib->dst); -- -- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE) && -- check_fwstate(pmlmepriv, _FW_LINKED)) { -- /* if NULL-frame, drop packet */ -- if ((GetFrameSubType(ptr)) == (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC)) -- return _FAIL; -- /* drop QoS-SubType Data, including QoS NULL, -- * excluding QoS-Data -- */ -- if ((GetFrameSubType(ptr) & WIFI_QOS_DATA_TYPE) == -- WIFI_QOS_DATA_TYPE) { -- if (GetFrameSubType(ptr) & (BIT(4) | BIT(5) | BIT(6))) -- return _FAIL; -- } -- -- /* filter packets that SA is myself or multicast or broadcast */ -- if (!memcmp(myhwaddr, pattrib->src, ETH_ALEN)) -- return _FAIL; -- -- /* da should be for me */ -- if ((memcmp(myhwaddr, pattrib->dst, ETH_ALEN)) && (!bmcast)) -- return _FAIL; -- /* check BSSID */ -- if (is_zero_ether_addr(pattrib->bssid) || -- is_zero_ether_addr(mybssid) || -- (memcmp(pattrib->bssid, mybssid, ETH_ALEN))) -- return _FAIL; -- if (bmcast) -- *psta = r8712_get_bcmc_stainfo(adapter); -- else -- *psta = r8712_get_stainfo(pstapriv, pattrib->bssid); -- if (!*psta) -- return _FAIL; -- } else if (check_fwstate(pmlmepriv, WIFI_MP_STATE) && -- check_fwstate(pmlmepriv, _FW_LINKED)) { -- memcpy(pattrib->dst, GetAddr1Ptr(ptr), ETH_ALEN); -- memcpy(pattrib->src, GetAddr2Ptr(ptr), ETH_ALEN); -- memcpy(pattrib->bssid, GetAddr3Ptr(ptr), ETH_ALEN); -- memcpy(pattrib->ra, pattrib->dst, ETH_ALEN); -- memcpy(pattrib->ta, pattrib->src, ETH_ALEN); -- memcpy(pattrib->bssid, mybssid, ETH_ALEN); -- *psta = r8712_get_stainfo(pstapriv, pattrib->bssid); -- if (!*psta) -- return _FAIL; -- } else { -- return _FAIL; -- } -- return _SUCCESS; --} -- --static sint sta2ap_data_frame(struct _adapter *adapter, -- union recv_frame *precv_frame, -- struct sta_info **psta) --{ -- struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib; -- struct sta_priv *pstapriv = &adapter->stapriv; -- struct mlme_priv *pmlmepriv = &adapter->mlmepriv; -- unsigned char *mybssid = get_bssid(pmlmepriv); -- -- if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) { -- /* For AP mode, if DA is non-MCAST, then it must be BSSID, -- * and bssid == BSSID -- * For AP mode, RA=BSSID, TX=STA(SRC_ADDR), A3=DST_ADDR -- */ -- if (memcmp(pattrib->bssid, mybssid, ETH_ALEN)) -- return _FAIL; -- *psta = r8712_get_stainfo(pstapriv, pattrib->src); -- if (!*psta) -- return _FAIL; -- } -- return _SUCCESS; --} -- --static sint validate_recv_ctrl_frame(struct _adapter *adapter, -- union recv_frame *precv_frame) --{ -- return _FAIL; --} -- --static sint validate_recv_mgnt_frame(struct _adapter *adapter, -- union recv_frame *precv_frame) --{ -- return _FAIL; --} -- --static sint validate_recv_data_frame(struct _adapter *adapter, -- union recv_frame *precv_frame) --{ -- int res; -- u8 bretry; -- u8 *psa, *pda, *pbssid; -- struct sta_info *psta = NULL; -- u8 *ptr = precv_frame->u.hdr.rx_data; -- struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib; -- struct security_priv *psecuritypriv = &adapter->securitypriv; -- -- bretry = GetRetry(ptr); -- pda = ieee80211_get_DA((struct ieee80211_hdr *)ptr); -- psa = ieee80211_get_SA((struct ieee80211_hdr *)ptr); -- pbssid = get_hdr_bssid(ptr); -- if (!pbssid) -- return _FAIL; -- memcpy(pattrib->dst, pda, ETH_ALEN); -- memcpy(pattrib->src, psa, ETH_ALEN); -- memcpy(pattrib->bssid, pbssid, ETH_ALEN); -- switch (pattrib->to_fr_ds) { -- case 0: -- memcpy(pattrib->ra, pda, ETH_ALEN); -- memcpy(pattrib->ta, psa, ETH_ALEN); -- res = sta2sta_data_frame(adapter, precv_frame, &psta); -- break; -- case 1: -- memcpy(pattrib->ra, pda, ETH_ALEN); -- memcpy(pattrib->ta, pbssid, ETH_ALEN); -- res = ap2sta_data_frame(adapter, precv_frame, &psta); -- break; -- case 2: -- memcpy(pattrib->ra, pbssid, ETH_ALEN); -- memcpy(pattrib->ta, psa, ETH_ALEN); -- res = sta2ap_data_frame(adapter, precv_frame, &psta); -- break; -- case 3: -- memcpy(pattrib->ra, GetAddr1Ptr(ptr), ETH_ALEN); -- memcpy(pattrib->ta, GetAddr2Ptr(ptr), ETH_ALEN); -- return _FAIL; -- default: -- return _FAIL; -- } -- if (res == _FAIL) -- return _FAIL; -- if (!psta) -- return _FAIL; -- precv_frame->u.hdr.psta = psta; -- pattrib->amsdu = 0; -- /* parsing QC field */ -- if (pattrib->qos == 1) { -- pattrib->priority = GetPriority((ptr + 24)); -- pattrib->ack_policy = GetAckpolicy((ptr + 24)); -- pattrib->amsdu = GetAMsdu((ptr + 24)); -- pattrib->hdrlen = pattrib->to_fr_ds == 3 ? 32 : 26; -- } else { -- pattrib->priority = 0; -- pattrib->hdrlen = (pattrib->to_fr_ds == 3) ? 30 : 24; -- } -- -- if (pattrib->order)/*HT-CTRL 11n*/ -- pattrib->hdrlen += 4; -- precv_frame->u.hdr.preorder_ctrl = -- &psta->recvreorder_ctrl[pattrib->priority]; -- -- /* decache, drop duplicate recv packets */ -- if (recv_decache(precv_frame, bretry, &psta->sta_recvpriv.rxcache) == -- _FAIL) -- return _FAIL; -- -- if (pattrib->privacy) { -- GET_ENCRY_ALGO(psecuritypriv, psta, pattrib->encrypt, -- is_multicast_ether_addr(pattrib->ra)); -- SET_ICE_IV_LEN(pattrib->iv_len, pattrib->icv_len, -- pattrib->encrypt); -- } else { -- pattrib->encrypt = 0; -- pattrib->iv_len = pattrib->icv_len = 0; -- } -- return _SUCCESS; --} -- --sint r8712_validate_recv_frame(struct _adapter *adapter, -- union recv_frame *precv_frame) --{ -- /*shall check frame subtype, to / from ds, da, bssid */ -- /*then call check if rx seq/frag. duplicated.*/ -- -- u8 type; -- u8 subtype; -- sint retval = _SUCCESS; -- struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib; -- -- u8 *ptr = precv_frame->u.hdr.rx_data; -- u8 ver = (unsigned char)(*ptr) & 0x3; -- -- /*add version chk*/ -- if (ver != 0) -- return _FAIL; -- type = GetFrameType(ptr); -- subtype = GetFrameSubType(ptr); /*bit(7)~bit(2)*/ -- pattrib->to_fr_ds = get_tofr_ds(ptr); -- pattrib->frag_num = GetFragNum(ptr); -- pattrib->seq_num = GetSequence(ptr); -- pattrib->pw_save = GetPwrMgt(ptr); -- pattrib->mfrag = GetMFrag(ptr); -- pattrib->mdata = GetMData(ptr); -- pattrib->privacy = GetPrivacy(ptr); -- pattrib->order = GetOrder(ptr); -- switch (type) { -- case IEEE80211_FTYPE_MGMT: -- retval = validate_recv_mgnt_frame(adapter, precv_frame); -- break; -- case IEEE80211_FTYPE_CTL: -- retval = validate_recv_ctrl_frame(adapter, precv_frame); -- break; -- case IEEE80211_FTYPE_DATA: -- pattrib->qos = (subtype & BIT(7)) ? 1 : 0; -- retval = validate_recv_data_frame(adapter, precv_frame); -- break; -- default: -- return _FAIL; -- } -- return retval; --} -- --int r8712_wlanhdr_to_ethhdr(union recv_frame *precvframe) --{ -- /*remove the wlanhdr and add the eth_hdr*/ -- sint rmv_len; -- u16 len; -- u8 bsnaphdr; -- u8 *psnap_type; -- struct ieee80211_snap_hdr *psnap; -- struct _adapter *adapter = precvframe->u.hdr.adapter; -- struct mlme_priv *pmlmepriv = &adapter->mlmepriv; -- -- u8 *ptr = precvframe->u.hdr.rx_data; /*point to frame_ctrl field*/ -- struct rx_pkt_attrib *pattrib = &precvframe->u.hdr.attrib; -- -- if (pattrib->encrypt) -- recvframe_pull_tail(precvframe, pattrib->icv_len); -- psnap = (struct ieee80211_snap_hdr *)(ptr + pattrib->hdrlen + -- pattrib->iv_len); -- psnap_type = ptr + pattrib->hdrlen + pattrib->iv_len + SNAP_SIZE; -- /* convert hdr + possible LLC headers into Ethernet header */ -- if ((!memcmp(psnap, (void *)rfc1042_header, SNAP_SIZE) && -- (memcmp(psnap_type, (void *)SNAP_ETH_TYPE_IPX, 2)) && -- (memcmp(psnap_type, (void *)SNAP_ETH_TYPE_APPLETALK_AARP, 2))) || -- !memcmp(psnap, (void *)bridge_tunnel_header, SNAP_SIZE)) { -- /* remove RFC1042 or Bridge-Tunnel encapsulation and -- * replace EtherType -- */ -- bsnaphdr = true; -- } else { -- /* Leave Ethernet header part of hdr and full payload */ -- bsnaphdr = false; -- } -- rmv_len = pattrib->hdrlen + pattrib->iv_len + -- (bsnaphdr ? SNAP_SIZE : 0); -- len = precvframe->u.hdr.len - rmv_len; -- if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) { -- ptr += rmv_len; -- *ptr = 0x87; -- *(ptr + 1) = 0x12; -- /* append rx status for mp test packets */ -- ptr = recvframe_pull(precvframe, (rmv_len - -- sizeof(struct ethhdr) + 2) - 24); -- if (!ptr) -- return -ENOMEM; -- memcpy(ptr, get_rxmem(precvframe), 24); -- ptr += 24; -- } else { -- ptr = recvframe_pull(precvframe, (rmv_len - -- sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0))); -- if (!ptr) -- return -ENOMEM; -- } -- -- memcpy(ptr, pattrib->dst, ETH_ALEN); -- memcpy(ptr + ETH_ALEN, pattrib->src, ETH_ALEN); -- if (!bsnaphdr) { -- __be16 be_tmp = htons(len); -- -- memcpy(ptr + 12, &be_tmp, 2); -- } -- return 0; --} -- --void r8712_recv_entry(union recv_frame *precvframe) --{ -- struct _adapter *padapter; -- struct recv_priv *precvpriv; -- -- s32 ret = _SUCCESS; -- -- padapter = precvframe->u.hdr.adapter; -- precvpriv = &(padapter->recvpriv); -- -- padapter->ledpriv.LedControlHandler(padapter, LED_CTL_RX); -- -- ret = recv_func(padapter, precvframe); -- if (ret == _FAIL) -- goto _recv_entry_drop; -- precvpriv->rx_pkts++; -- precvpriv->rx_bytes += (uint)(precvframe->u.hdr.rx_tail - -- precvframe->u.hdr.rx_data); -- return; --_recv_entry_drop: -- precvpriv->rx_drop++; -- padapter->mppriv.rx_pktloss = precvpriv->rx_drop; --} -diff --git a/drivers/staging/rtl8712/rtl871x_recv.h b/drivers/staging/rtl8712/rtl871x_recv.h -deleted file mode 100644 -index 0760bccbf389c1..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_recv.h -+++ /dev/null -@@ -1,208 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --#ifndef _RTL871X_RECV_H_ --#define _RTL871X_RECV_H_ -- --#include "osdep_service.h" --#include "drv_types.h" -- --#define NR_RECVFRAME 256 -- --#define RXFRAME_ALIGN 8 --#define RXFRAME_ALIGN_SZ (1 << RXFRAME_ALIGN) -- --#define MAX_SUBFRAME_COUNT 64 -- --/* for Rx reordering buffer control */ --struct recv_reorder_ctrl { -- struct _adapter *padapter; -- u16 indicate_seq; /* =wstart_b, init_value=0xffff */ -- u16 wend_b; -- u8 wsize_b; -- struct __queue pending_recvframe_queue; -- struct timer_list reordering_ctrl_timer; --}; -- --struct stainfo_rxcache { -- u16 tid_rxseq[16]; --}; -- --#define PHY_RSSI_SLID_WIN_MAX 100 --#define PHY_LINKQUALITY_SLID_WIN_MAX 20 -- --struct smooth_rssi_data { -- u32 elements[100]; /* array to store values */ -- u32 index; /* index to current array to store */ -- u32 total_num; /* num of valid elements */ -- u32 total_val; /* sum of valid elements */ --}; -- --struct rx_pkt_attrib { -- u8 amsdu; -- u8 order; -- u8 qos; -- u8 to_fr_ds; -- u8 frag_num; -- u16 seq_num; -- u8 pw_save; -- u8 mfrag; -- u8 mdata; -- u8 privacy; /* in frame_ctrl field */ -- u8 bdecrypted; -- int hdrlen; /* the WLAN Header Len */ -- int encrypt; /* 0 no encrypt. != 0 encrypt algorithm */ -- int iv_len; -- int icv_len; -- int priority; -- int ack_policy; -- u8 crc_err; -- u8 dst[ETH_ALEN]; -- u8 src[ETH_ALEN]; -- u8 ta[ETH_ALEN]; -- u8 ra[ETH_ALEN]; -- u8 bssid[ETH_ALEN]; -- u8 tcpchk_valid; /* 0: invalid, 1: valid */ -- u8 ip_chkrpt; /* 0: incorrect, 1: correct */ -- u8 tcp_chkrpt; /* 0: incorrect, 1: correct */ -- u8 signal_qual; -- s8 rx_mimo_signal_qual[2]; -- u8 mcs_rate; -- u8 htc; -- u8 signal_strength; --}; -- --/* -- * accesser of recv_priv: recv_entry(dispatch / passive level); -- * recv_thread(passive) ; returnpkt(dispatch) -- * ; halt(passive) ; -- * -- * using enter_critical section to protect -- */ --struct recv_priv { -- spinlock_t lock; -- struct __queue free_recv_queue; -- struct __queue recv_pending_queue; -- u8 *pallocated_frame_buf; -- u8 *precv_frame_buf; -- uint free_recvframe_cnt; -- struct _adapter *adapter; -- uint rx_bytes; -- uint rx_pkts; -- uint rx_drop; -- uint rx_icv_err; -- uint rx_largepacket_crcerr; -- uint rx_smallpacket_crcerr; -- uint rx_middlepacket_crcerr; -- u8 rx_pending_cnt; -- uint ff_hwaddr; -- struct tasklet_struct recv_tasklet; -- struct sk_buff_head free_recv_skb_queue; -- struct sk_buff_head rx_skb_queue; -- u8 *pallocated_recv_buf; -- u8 *precv_buf; /* 4 alignment */ -- struct __queue free_recv_buf_queue; -- u32 free_recv_buf_queue_cnt; -- /* For the phy information */ -- s8 rssi; -- u8 signal; -- u8 noise; -- u8 fw_rssi; -- struct smooth_rssi_data signal_qual_data; -- struct smooth_rssi_data signal_strength_data; --}; -- --struct sta_recv_priv { -- spinlock_t lock; -- sint option; -- struct __queue defrag_q; /* keeping the fragment frame until defrag */ -- struct stainfo_rxcache rxcache; -- uint sta_rx_bytes; -- uint sta_rx_pkts; -- uint sta_rx_fail; --}; -- --#include "rtl8712_recv.h" -- --/* get a free recv_frame from pfree_recv_queue */ --union recv_frame *r8712_alloc_recvframe(struct __queue *pfree_recv_queue); --void r8712_free_recvframe(union recv_frame *precvframe, -- struct __queue *pfree_recv_queue); --void r8712_free_recvframe_queue(struct __queue *pframequeue, -- struct __queue *pfree_recv_queue); --int r8712_wlanhdr_to_ethhdr(union recv_frame *precvframe); --int recv_func(struct _adapter *padapter, void *pcontext); -- --static inline u8 *get_rxmem(union recv_frame *precvframe) --{ -- /* always return rx_head... */ -- if (!precvframe) -- return NULL; -- return precvframe->u.hdr.rx_head; --} -- --static inline u8 *recvframe_pull(union recv_frame *precvframe, sint sz) --{ -- /* used for extract sz bytes from rx_data, update rx_data and return -- * the updated rx_data to the caller -- */ -- if (!precvframe) -- return NULL; -- precvframe->u.hdr.rx_data += sz; -- if (precvframe->u.hdr.rx_data > precvframe->u.hdr.rx_tail) { -- precvframe->u.hdr.rx_data -= sz; -- return NULL; -- } -- precvframe->u.hdr.len -= sz; -- return precvframe->u.hdr.rx_data; --} -- --static inline u8 *recvframe_put(union recv_frame *precvframe, sint sz) --{ -- /* used for append sz bytes from ptr to rx_tail, update rx_tail and -- * return the updated rx_tail to the caller -- * after putting, rx_tail must be still larger than rx_end. -- */ -- if (!precvframe) -- return NULL; -- precvframe->u.hdr.rx_tail += sz; -- if (precvframe->u.hdr.rx_tail > precvframe->u.hdr.rx_end) { -- precvframe->u.hdr.rx_tail -= sz; -- return NULL; -- } -- precvframe->u.hdr.len += sz; -- return precvframe->u.hdr.rx_tail; --} -- --static inline u8 *recvframe_pull_tail(union recv_frame *precvframe, sint sz) --{ -- /* rmv data from rx_tail (by yitsen) -- * used for extract sz bytes from rx_end, update rx_end and return the -- * updated rx_end to the caller -- * after pulling, rx_end must be still larger than rx_data. -- */ -- if (!precvframe) -- return NULL; -- precvframe->u.hdr.rx_tail -= sz; -- if (precvframe->u.hdr.rx_tail < precvframe->u.hdr.rx_data) { -- precvframe->u.hdr.rx_tail += sz; -- return NULL; -- } -- precvframe->u.hdr.len -= sz; -- return precvframe->u.hdr.rx_tail; --} -- --struct sta_info; -- --void _r8712_init_sta_recv_priv(struct sta_recv_priv *psta_recvpriv); --sint r8712_recvframe_chkmic(struct _adapter *adapter, -- union recv_frame *precvframe); --union recv_frame *r8712_decryptor(struct _adapter *adapter, -- union recv_frame *precv_frame); --union recv_frame *r8712_recvframe_chk_defrag(struct _adapter *adapter, -- union recv_frame *precv_frame); --int r8712_validate_recv_frame(struct _adapter *adapter, -- union recv_frame *precv_frame); --union recv_frame *r8712_portctrl(struct _adapter *adapter, -- union recv_frame *precv_frame); -- --#endif -- -diff --git a/drivers/staging/rtl8712/rtl871x_rf.h b/drivers/staging/rtl8712/rtl871x_rf.h -deleted file mode 100644 -index 7d98921a48fac0..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_rf.h -+++ /dev/null -@@ -1,55 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __RTL871X_RF_H_ --#define __RTL871X_RF_H_ -- --#include "rtl871x_cmd.h" --#include "rtl871x_mp_phy_regdef.h" -- --#define OFDM_PHY 1 --#define MIXED_PHY 2 --#define CCK_PHY 3 --#define NumRates (13) --#define RTL8711_RF_MAX_SENS 6 --#define RTL8711_RF_DEF_SENS 4 --#define NUM_CHANNELS 15 -- --struct regulatory_class { -- u32 starting_freq; /*MHz, */ -- u8 channel_set[NUM_CHANNELS]; -- u8 channel_cck_power[NUM_CHANNELS]; /*dbm*/ -- u8 channel_ofdm_power[NUM_CHANNELS];/*dbm*/ -- u8 txpower_limit; /*dbm*/ -- u8 channel_spacing; /*MHz*/ -- u8 modem; --}; -- --enum _REG_PREAMBLE_MODE { -- PREAMBLE_LONG = 1, -- PREAMBLE_AUTO = 2, -- PREAMBLE_SHORT = 3, --}; -- --enum { -- RTL8712_RFC_1T = 0x10, -- RTL8712_RFC_2T = 0x20, -- RTL8712_RFC_1R = 0x01, -- RTL8712_RFC_2R = 0x02, -- RTL8712_RFC_1T1R = 0x11, -- RTL8712_RFC_1T2R = 0x12, -- RTL8712_RFC_TURBO = 0x92, -- RTL8712_RFC_2T2R = 0x22 --}; -- --#endif /*__RTL871X_RF_H_*/ -diff --git a/drivers/staging/rtl8712/rtl871x_security.c b/drivers/staging/rtl8712/rtl871x_security.c -deleted file mode 100644 -index e46a5dbc7b65fa..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_security.c -+++ /dev/null -@@ -1,1386 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * rtl871x_security.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _RTL871X_SECURITY_C_ -- --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include -- --#include "osdep_service.h" --#include "drv_types.h" --#include "osdep_intf.h" -- --/* =====WEP related===== */ -- --struct arc4context { -- u32 x; -- u32 y; -- u8 state[256]; --}; -- --static void arcfour_init(struct arc4context *parc4ctx, u8 *key, u32 key_len) --{ -- u32 t, u; -- u32 keyindex; -- u32 stateindex; -- u8 *state; -- u32 counter; -- -- state = parc4ctx->state; -- parc4ctx->x = 0; -- parc4ctx->y = 0; -- for (counter = 0; counter < 256; counter++) -- state[counter] = (u8)counter; -- keyindex = 0; -- stateindex = 0; -- for (counter = 0; counter < 256; counter++) { -- t = state[counter]; -- stateindex = (stateindex + key[keyindex] + t) & 0xff; -- u = state[stateindex]; -- state[stateindex] = (u8)t; -- state[counter] = (u8)u; -- if (++keyindex >= key_len) -- keyindex = 0; -- } --} -- --static u32 arcfour_byte(struct arc4context *parc4ctx) --{ -- u32 x; -- u32 y; -- u32 sx, sy; -- u8 *state; -- -- state = parc4ctx->state; -- x = (parc4ctx->x + 1) & 0xff; -- sx = state[x]; -- y = (sx + parc4ctx->y) & 0xff; -- sy = state[y]; -- parc4ctx->x = x; -- parc4ctx->y = y; -- state[y] = (u8)sx; -- state[x] = (u8)sy; -- return state[(sx + sy) & 0xff]; --} -- --static void arcfour_encrypt(struct arc4context *parc4ctx, -- u8 *dest, u8 *src, u32 len) --{ -- u32 i; -- -- for (i = 0; i < len; i++) -- dest[i] = src[i] ^ (unsigned char)arcfour_byte(parc4ctx); --} -- --static sint bcrc32initialized; --static u32 crc32_table[256]; -- --static u8 crc32_reverseBit(u8 data) --{ -- return ((u8)(data << 7) & 0x80) | ((data << 5) & 0x40) | ((data << 3) -- & 0x20) | ((data << 1) & 0x10) | ((data >> 1) & 0x08) | -- ((data >> 3) & 0x04) | ((data >> 5) & 0x02) | ((data >> 7) & -- 0x01); --} -- --static void crc32_init(void) --{ -- sint i, j; -- u32 c; -- u8 *p = (u8 *)&c, *p1; -- u8 k; -- -- if (bcrc32initialized == 1) -- return; -- -- for (i = 0; i < 256; ++i) { -- k = crc32_reverseBit((u8)i); -- for (c = ((u32)k) << 24, j = 8; j > 0; --j) -- c = c & 0x80000000 ? (c << 1) ^ CRC32_POLY_BE : (c << 1); -- p1 = (u8 *)&crc32_table[i]; -- p1[0] = crc32_reverseBit(p[3]); -- p1[1] = crc32_reverseBit(p[2]); -- p1[2] = crc32_reverseBit(p[1]); -- p1[3] = crc32_reverseBit(p[0]); -- } -- bcrc32initialized = 1; --} -- --static u32 getcrc32(u8 *buf, u32 len) --{ -- u8 *p; -- u32 crc; -- -- if (!bcrc32initialized) -- crc32_init(); -- crc = 0xffffffff; /* preload shift register, per CRC-32 spec */ -- for (p = buf; len > 0; ++p, --len) -- crc = crc32_table[(crc ^ *p) & 0xff] ^ (crc >> 8); -- return ~crc; /* transmit complement, per CRC-32 spec */ --} -- --/* -- * Need to consider the fragment situation -- */ --void r8712_wep_encrypt(struct _adapter *padapter, u8 *pxmitframe) --{ /* exclude ICV */ -- unsigned char crc[4]; -- struct arc4context mycontext; -- u32 curfragnum, length, keylength, pki; -- u8 *pframe, *payload, *iv; /*,*wepkey*/ -- u8 wepkey[16]; -- struct pkt_attrib *pattrib = &((struct xmit_frame *) -- pxmitframe)->attrib; -- struct security_priv *psecuritypriv = &padapter->securitypriv; -- struct xmit_priv *pxmitpriv = &padapter->xmitpriv; -- -- if (((struct xmit_frame *)pxmitframe)->buf_addr == NULL) -- return; -- pframe = ((struct xmit_frame *)pxmitframe)->buf_addr + TXDESC_OFFSET; -- /*start to encrypt each fragment*/ -- if ((pattrib->encrypt == _WEP40_) || (pattrib->encrypt == _WEP104_)) { -- pki = psecuritypriv->PrivacyKeyIndex; -- keylength = psecuritypriv->DefKeylen[pki]; -- for (curfragnum = 0; curfragnum < pattrib->nr_frags; -- curfragnum++) { -- iv = pframe + pattrib->hdrlen; -- memcpy(&wepkey[0], iv, 3); -- memcpy(&wepkey[3], &psecuritypriv->DefKey[ -- psecuritypriv->PrivacyKeyIndex].skey[0], -- keylength); -- payload = pframe + pattrib->iv_len + pattrib->hdrlen; -- if ((curfragnum + 1) == pattrib->nr_frags) { -- length = pattrib->last_txcmdsz - -- pattrib->hdrlen - -- pattrib->iv_len - -- pattrib->icv_len; -- *((__le32 *)crc) = cpu_to_le32(getcrc32( -- payload, length)); -- arcfour_init(&mycontext, wepkey, 3 + keylength); -- arcfour_encrypt(&mycontext, payload, payload, -- length); -- arcfour_encrypt(&mycontext, payload + length, -- crc, 4); -- } else { -- length = pxmitpriv->frag_len - -- pattrib->hdrlen - pattrib->iv_len - -- pattrib->icv_len; -- *((__le32 *)crc) = cpu_to_le32(getcrc32( -- payload, length)); -- arcfour_init(&mycontext, wepkey, 3 + keylength); -- arcfour_encrypt(&mycontext, payload, payload, -- length); -- arcfour_encrypt(&mycontext, payload + length, -- crc, 4); -- pframe += pxmitpriv->frag_len; -- pframe = (u8 *)RND4((addr_t)(pframe)); -- } -- } -- } --} -- --void r8712_wep_decrypt(struct _adapter *padapter, u8 *precvframe) --{ -- /* exclude ICV */ -- u8 crc[4]; -- struct arc4context mycontext; -- u32 length, keylength; -- u8 *pframe, *payload, *iv, wepkey[16]; -- u8 keyindex; -- struct rx_pkt_attrib *prxattrib = &(((union recv_frame *) -- precvframe)->u.hdr.attrib); -- struct security_priv *psecuritypriv = &padapter->securitypriv; -- -- pframe = (unsigned char *)((union recv_frame *)precvframe)-> -- u.hdr.rx_data; -- /* start to decrypt recvframe */ -- if ((prxattrib->encrypt == _WEP40_) || (prxattrib->encrypt == -- _WEP104_)) { -- iv = pframe + prxattrib->hdrlen; -- keyindex = (iv[3] & 0x3); -- keylength = psecuritypriv->DefKeylen[keyindex]; -- memcpy(&wepkey[0], iv, 3); -- memcpy(&wepkey[3], &psecuritypriv->DefKey[ -- psecuritypriv->PrivacyKeyIndex].skey[0], -- keylength); -- length = ((union recv_frame *)precvframe)-> -- u.hdr.len - prxattrib->hdrlen - prxattrib->iv_len; -- payload = pframe + prxattrib->iv_len + prxattrib->hdrlen; -- /* decrypt payload include icv */ -- arcfour_init(&mycontext, wepkey, 3 + keylength); -- arcfour_encrypt(&mycontext, payload, payload, length); -- /* calculate icv and compare the icv */ -- *((__le32 *)crc) = cpu_to_le32(getcrc32(payload, length - 4)); -- } --} -- --/* 3 =====TKIP related===== */ -- --static u32 secmicgetuint32(u8 *p) --/* Convert from Byte[] to Us4Byte32 in a portable way */ --{ -- s32 i; -- u32 res = 0; -- -- for (i = 0; i < 4; i++) -- res |= ((u32)(*p++)) << (8 * i); -- return res; --} -- --static void secmicputuint32(u8 *p, u32 val) --/* Convert from Us4Byte32 to Byte[] in a portable way */ --{ -- long i; -- -- for (i = 0; i < 4; i++) { -- *p++ = (u8)(val & 0xff); -- val >>= 8; -- } --} -- --static void secmicclear(struct mic_data *pmicdata) --{ --/* Reset the state to the empty message. */ -- pmicdata->L = pmicdata->K0; -- pmicdata->R = pmicdata->K1; -- pmicdata->nBytesInM = 0; -- pmicdata->M = 0; --} -- --void r8712_secmicsetkey(struct mic_data *pmicdata, u8 *key) --{ -- /* Set the key */ -- pmicdata->K0 = secmicgetuint32(key); -- pmicdata->K1 = secmicgetuint32(key + 4); -- /* and reset the message */ -- secmicclear(pmicdata); --} -- --static void secmicappendbyte(struct mic_data *pmicdata, u8 b) --{ -- /* Append the byte to our word-sized buffer */ -- pmicdata->M |= ((u32)b) << (8 * pmicdata->nBytesInM); -- pmicdata->nBytesInM++; -- /* Process the word if it is full. */ -- if (pmicdata->nBytesInM >= 4) { -- pmicdata->L ^= pmicdata->M; -- pmicdata->R ^= ROL32(pmicdata->L, 17); -- pmicdata->L += pmicdata->R; -- pmicdata->R ^= ((pmicdata->L & 0xff00ff00) >> 8) | -- ((pmicdata->L & 0x00ff00ff) << 8); -- pmicdata->L += pmicdata->R; -- pmicdata->R ^= ROL32(pmicdata->L, 3); -- pmicdata->L += pmicdata->R; -- pmicdata->R ^= ROR32(pmicdata->L, 2); -- pmicdata->L += pmicdata->R; -- /* Clear the buffer */ -- pmicdata->M = 0; -- pmicdata->nBytesInM = 0; -- } --} -- --void r8712_secmicappend(struct mic_data *pmicdata, u8 *src, u32 nbytes) --{ -- /* This is simple */ -- while (nbytes > 0) { -- secmicappendbyte(pmicdata, *src++); -- nbytes--; -- } --} -- --void r8712_secgetmic(struct mic_data *pmicdata, u8 *dst) --{ -- /* Append the minimum padding */ -- secmicappendbyte(pmicdata, 0x5a); -- secmicappendbyte(pmicdata, 0); -- secmicappendbyte(pmicdata, 0); -- secmicappendbyte(pmicdata, 0); -- secmicappendbyte(pmicdata, 0); -- /* and then zeroes until the length is a multiple of 4 */ -- while (pmicdata->nBytesInM != 0) -- secmicappendbyte(pmicdata, 0); -- /* The appendByte function has already computed the result. */ -- secmicputuint32(dst, pmicdata->L); -- secmicputuint32(dst + 4, pmicdata->R); -- /* Reset to the empty message. */ -- secmicclear(pmicdata); --} -- --void seccalctkipmic(u8 *key, u8 *header, u8 *data, u32 data_len, u8 *mic_code, -- u8 pri) --{ -- -- struct mic_data micdata; -- u8 priority[4] = {0x0, 0x0, 0x0, 0x0}; -- -- r8712_secmicsetkey(&micdata, key); -- priority[0] = pri; -- /* Michael MIC pseudo header: DA, SA, 3 x 0, Priority */ -- if (header[1] & 1) { /* ToDS==1 */ -- r8712_secmicappend(&micdata, &header[16], 6); /* DA */ -- if (header[1] & 2) /* From Ds==1 */ -- r8712_secmicappend(&micdata, &header[24], 6); -- else -- r8712_secmicappend(&micdata, &header[10], 6); -- } else { /* ToDS==0 */ -- r8712_secmicappend(&micdata, &header[4], 6); /* DA */ -- if (header[1] & 2) /* From Ds==1 */ -- r8712_secmicappend(&micdata, &header[16], 6); -- else -- r8712_secmicappend(&micdata, &header[10], 6); -- } -- r8712_secmicappend(&micdata, &priority[0], 4); -- r8712_secmicappend(&micdata, data, data_len); -- r8712_secgetmic(&micdata, mic_code); --} -- --/* macros for extraction/creation of unsigned char/unsigned short values */ --#define RotR1(v16) ((((v16) >> 1) & 0x7FFF) ^ (((v16) & 1) << 15)) --#define Lo8(v16) ((u8)((v16) & 0x00FF)) --#define Hi8(v16) ((u8)(((v16) >> 8) & 0x00FF)) --#define Lo16(v32) ((u16)((v32) & 0xFFFF)) --#define Hi16(v32) ((u16)(((v32) >> 16) & 0xFFFF)) --#define Mk16(hi, lo) ((lo) ^ (((u16)(hi)) << 8)) -- --/* select the Nth 16-bit word of the temporal key unsigned char array TK[] */ --#define TK16(N) Mk16(tk[2 * (N) + 1], tk[2 * (N)]) -- --/* S-box lookup: 16 bits --> 16 bits */ --#define _S_(v16) (Sbox1[0][Lo8(v16)] ^ Sbox1[1][Hi8(v16)]) -- --/* fixed algorithm "parameters" */ --#define PHASE1_LOOP_CNT 8 /* this needs to be "big enough" */ --#define TA_SIZE 6 /* 48-bit transmitter address */ --#define TK_SIZE 16 /* 128-bit temporal key */ --#define P1K_SIZE 10 /* 80-bit Phase1 key */ --#define RC4_KEY_SIZE 16 /* 128-bit RC4KEY (104 bits unknown) */ -- --/* 2-unsigned char by 2-unsigned char subset of the full AES S-box table */ --static const unsigned short Sbox1[2][256] = {/* Sbox for hash (can be in ROM) */ -- { -- 0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154, -- 0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A, -- 0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B, -- 0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B, -- 0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F, -- 0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F, -- 0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5, -- 0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F, -- 0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB, -- 0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397, -- 0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED, -- 0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A, -- 0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194, -- 0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3, -- 0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104, -- 0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D, -- 0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39, -- 0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695, -- 0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83, -- 0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76, -- 0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4, -- 0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B, -- 0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0, -- 0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018, -- 0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751, -- 0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85, -- 0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12, -- 0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9, -- 0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7, -- 0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A, -- 0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8, -- 0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A, -- }, -- { /* second half is unsigned char-reversed version of first! */ -- 0xA5C6, 0x84F8, 0x99EE, 0x8DF6, 0x0DFF, 0xBDD6, 0xB1DE, 0x5491, -- 0x5060, 0x0302, 0xA9CE, 0x7D56, 0x19E7, 0x62B5, 0xE64D, 0x9AEC, -- 0x458F, 0x9D1F, 0x4089, 0x87FA, 0x15EF, 0xEBB2, 0xC98E, 0x0BFB, -- 0xEC41, 0x67B3, 0xFD5F, 0xEA45, 0xBF23, 0xF753, 0x96E4, 0x5B9B, -- 0xC275, 0x1CE1, 0xAE3D, 0x6A4C, 0x5A6C, 0x417E, 0x02F5, 0x4F83, -- 0x5C68, 0xF451, 0x34D1, 0x08F9, 0x93E2, 0x73AB, 0x5362, 0x3F2A, -- 0x0C08, 0x5295, 0x6546, 0x5E9D, 0x2830, 0xA137, 0x0F0A, 0xB52F, -- 0x090E, 0x3624, 0x9B1B, 0x3DDF, 0x26CD, 0x694E, 0xCD7F, 0x9FEA, -- 0x1B12, 0x9E1D, 0x7458, 0x2E34, 0x2D36, 0xB2DC, 0xEEB4, 0xFB5B, -- 0xF6A4, 0x4D76, 0x61B7, 0xCE7D, 0x7B52, 0x3EDD, 0x715E, 0x9713, -- 0xF5A6, 0x68B9, 0x0000, 0x2CC1, 0x6040, 0x1FE3, 0xC879, 0xEDB6, -- 0xBED4, 0x468D, 0xD967, 0x4B72, 0xDE94, 0xD498, 0xE8B0, 0x4A85, -- 0x6BBB, 0x2AC5, 0xE54F, 0x16ED, 0xC586, 0xD79A, 0x5566, 0x9411, -- 0xCF8A, 0x10E9, 0x0604, 0x81FE, 0xF0A0, 0x4478, 0xBA25, 0xE34B, -- 0xF3A2, 0xFE5D, 0xC080, 0x8A05, 0xAD3F, 0xBC21, 0x4870, 0x04F1, -- 0xDF63, 0xC177, 0x75AF, 0x6342, 0x3020, 0x1AE5, 0x0EFD, 0x6DBF, -- 0x4C81, 0x1418, 0x3526, 0x2FC3, 0xE1BE, 0xA235, 0xCC88, 0x392E, -- 0x5793, 0xF255, 0x82FC, 0x477A, 0xACC8, 0xE7BA, 0x2B32, 0x95E6, -- 0xA0C0, 0x9819, 0xD19E, 0x7FA3, 0x6644, 0x7E54, 0xAB3B, 0x830B, -- 0xCA8C, 0x29C7, 0xD36B, 0x3C28, 0x79A7, 0xE2BC, 0x1D16, 0x76AD, -- 0x3BDB, 0x5664, 0x4E74, 0x1E14, 0xDB92, 0x0A0C, 0x6C48, 0xE4B8, -- 0x5D9F, 0x6EBD, 0xEF43, 0xA6C4, 0xA839, 0xA431, 0x37D3, 0x8BF2, -- 0x32D5, 0x438B, 0x596E, 0xB7DA, 0x8C01, 0x64B1, 0xD29C, 0xE049, -- 0xB4D8, 0xFAAC, 0x07F3, 0x25CF, 0xAFCA, 0x8EF4, 0xE947, 0x1810, -- 0xD56F, 0x88F0, 0x6F4A, 0x725C, 0x2438, 0xF157, 0xC773, 0x5197, -- 0x23CB, 0x7CA1, 0x9CE8, 0x213E, 0xDD96, 0xDC61, 0x860D, 0x850F, -- 0x90E0, 0x427C, 0xC471, 0xAACC, 0xD890, 0x0506, 0x01F7, 0x121C, -- 0xA3C2, 0x5F6A, 0xF9AE, 0xD069, 0x9117, 0x5899, 0x273A, 0xB927, -- 0x38D9, 0x13EB, 0xB32B, 0x3322, 0xBBD2, 0x70A9, 0x8907, 0xA733, -- 0xB62D, 0x223C, 0x9215, 0x20C9, 0x4987, 0xFFAA, 0x7850, 0x7AA5, -- 0x8F03, 0xF859, 0x8009, 0x171A, 0xDA65, 0x31D7, 0xC684, 0xB8D0, -- 0xC382, 0xB029, 0x775A, 0x111E, 0xCB7B, 0xFCA8, 0xD66D, 0x3A2C, -- } --}; -- --/* -- ********************************************************************** -- * Routine: Phase 1 -- generate P1K, given TA, TK, IV32 -- * -- * Inputs: -- * tk[] = temporal key [128 bits] -- * ta[] = transmitter's MAC address [ 48 bits] -- * iv32 = upper 32 bits of IV [ 32 bits] -- * Output: -- * p1k[] = Phase 1 key [ 80 bits] -- * -- * Note: -- * This function only needs to be called every 2**16 packets, -- * although in theory it could be called every packet. -- * -- ********************************************************************** -- */ --static void phase1(u16 *p1k, const u8 *tk, const u8 *ta, u32 iv32) --{ -- sint i; -- -- /* Initialize the 80 bits of P1K[] from IV32 and TA[0..5] */ -- p1k[0] = Lo16(iv32); -- p1k[1] = Hi16(iv32); -- p1k[2] = Mk16(ta[1], ta[0]); /* use TA[] as little-endian */ -- p1k[3] = Mk16(ta[3], ta[2]); -- p1k[4] = Mk16(ta[5], ta[4]); -- /* Now compute an unbalanced Feistel cipher with 80-bit block */ -- /* size on the 80-bit block P1K[], using the 128-bit key TK[] */ -- for (i = 0; i < PHASE1_LOOP_CNT; i++) { /* Each add is mod 2**16 */ -- p1k[0] += _S_(p1k[4] ^ TK16((i & 1) + 0)); -- p1k[1] += _S_(p1k[0] ^ TK16((i & 1) + 2)); -- p1k[2] += _S_(p1k[1] ^ TK16((i & 1) + 4)); -- p1k[3] += _S_(p1k[2] ^ TK16((i & 1) + 6)); -- p1k[4] += _S_(p1k[3] ^ TK16((i & 1) + 0)); -- p1k[4] += (unsigned short)i; /* avoid "slide attacks" */ -- } --} -- --/* -- ********************************************************************** -- * Routine: Phase 2 -- generate RC4KEY, given TK, P1K, IV16 -- * -- * Inputs: -- * tk[] = Temporal key [128 bits] -- * p1k[] = Phase 1 output key [ 80 bits] -- * iv16 = low 16 bits of IV counter [ 16 bits] -- * Output: -- * rc4key[] = the key used to encrypt the packet [128 bits] -- * -- * Note: -- * The value {TA,IV32,IV16} for Phase1/Phase2 must be unique -- * across all packets using the same key TK value. Then, for a -- * given value of TK[], this TKIP48 construction guarantees that -- * the final RC4KEY value is unique across all packets. -- * -- * Suggested implementation optimization: if PPK[] is "overlaid" -- * appropriately on RC4KEY[], there is no need for the final -- * for loop below that copies the PPK[] result into RC4KEY[]. -- * -- ********************************************************************** -- */ --static void phase2(u8 *rc4key, const u8 *tk, const u16 *p1k, u16 iv16) --{ -- sint i; -- u16 PPK[6]; /* temporary key for mixing */ -- -- /* Note: all adds in the PPK[] equations below are mod 2**16 */ -- for (i = 0; i < 5; i++) -- PPK[i] = p1k[i]; /* first, copy P1K to PPK */ -- PPK[5] = p1k[4] + iv16; /* next, add in IV16 */ -- /* Bijective non-linear mixing of the 96 bits of PPK[0..5] */ -- PPK[0] += _S_(PPK[5] ^ TK16(0)); /* Mix key in each "round" */ -- PPK[1] += _S_(PPK[0] ^ TK16(1)); -- PPK[2] += _S_(PPK[1] ^ TK16(2)); -- PPK[3] += _S_(PPK[2] ^ TK16(3)); -- PPK[4] += _S_(PPK[3] ^ TK16(4)); -- PPK[5] += _S_(PPK[4] ^ TK16(5)); /* Total # S-box lookups == 6 */ -- /* Final sweep: bijective, "linear". Rotates kill LSB correlations */ -- PPK[0] += RotR1(PPK[5] ^ TK16(6)); -- PPK[1] += RotR1(PPK[0] ^ TK16(7)); /* Use all of TK[] in Phase2 */ -- PPK[2] += RotR1(PPK[1]); -- PPK[3] += RotR1(PPK[2]); -- PPK[4] += RotR1(PPK[3]); -- PPK[5] += RotR1(PPK[4]); -- /* Note: At this point, for a given key TK[0..15], the 96-bit output */ -- /* value PPK[0..5] is guaranteed to be unique, as a function */ -- /* of the 96-bit "input" value {TA,IV32,IV16}. That is, P1K */ -- /* is now a keyed permutation of {TA,IV32,IV16}. */ -- /* Set RC4KEY[0..3], which includes "cleartext" portion of RC4 key */ -- rc4key[0] = Hi8(iv16); /* RC4KEY[0..2] is the WEP IV */ -- rc4key[1] = (Hi8(iv16) | 0x20) & 0x7F; /* Help avoid weak (FMS) keys */ -- rc4key[2] = Lo8(iv16); -- rc4key[3] = Lo8((PPK[5] ^ TK16(0)) >> 1); -- /* Copy 96 bits of PPK[0..5] to RC4KEY[4..15] (little-endian) */ -- for (i = 0; i < 6; i++) { -- rc4key[4 + 2 * i] = Lo8(PPK[i]); -- rc4key[5 + 2 * i] = Hi8(PPK[i]); -- } --} -- --/*The hlen isn't include the IV*/ --u32 r8712_tkip_encrypt(struct _adapter *padapter, u8 *pxmitframe) --{ /* exclude ICV */ -- u16 pnl; -- u32 pnh; -- u8 rc4key[16]; -- u8 ttkey[16]; -- u8 crc[4]; -- struct arc4context mycontext; -- u32 curfragnum, length; -- -- u8 *pframe, *payload, *iv, *prwskey; -- union pn48 txpn; -- struct sta_info *stainfo; -- struct pkt_attrib *pattrib = &((struct xmit_frame *)pxmitframe)->attrib; -- struct xmit_priv *pxmitpriv = &padapter->xmitpriv; -- u32 res = _SUCCESS; -- -- if (((struct xmit_frame *)pxmitframe)->buf_addr == NULL) -- return _FAIL; -- -- pframe = ((struct xmit_frame *)pxmitframe)->buf_addr + TXDESC_OFFSET; -- /* 4 start to encrypt each fragment */ -- if (pattrib->encrypt == _TKIP_) { -- if (pattrib->psta) -- stainfo = pattrib->psta; -- else -- stainfo = r8712_get_stainfo(&padapter->stapriv, -- &pattrib->ra[0]); -- if (stainfo) { -- prwskey = &stainfo->x_UncstKey.skey[0]; -- for (curfragnum = 0; curfragnum < pattrib->nr_frags; -- curfragnum++) { -- iv = pframe + pattrib->hdrlen; -- payload = pframe + pattrib->iv_len + -- pattrib->hdrlen; -- GET_TKIP_PN(iv, txpn); -- pnl = (u16)(txpn.val); -- pnh = (u32)(txpn.val >> 16); -- phase1((u16 *)&ttkey[0], prwskey, -- &pattrib->ta[0], pnh); -- phase2(&rc4key[0], prwskey, (u16 *)&ttkey[0], -- pnl); -- if ((curfragnum + 1) == pattrib->nr_frags) { -- /* 4 the last fragment */ -- length = pattrib->last_txcmdsz - -- pattrib->hdrlen - -- pattrib->iv_len - -- pattrib->icv_len; -- *((__le32 *)crc) = cpu_to_le32( -- getcrc32(payload, length)); -- arcfour_init(&mycontext, rc4key, 16); -- arcfour_encrypt(&mycontext, payload, -- payload, length); -- arcfour_encrypt(&mycontext, payload + -- length, crc, 4); -- } else { -- length = pxmitpriv->frag_len - -- pattrib->hdrlen - -- pattrib->iv_len - -- pattrib->icv_len; -- *((__le32 *)crc) = cpu_to_le32(getcrc32( -- payload, length)); -- arcfour_init(&mycontext, rc4key, 16); -- arcfour_encrypt(&mycontext, payload, -- payload, length); -- arcfour_encrypt(&mycontext, -- payload + length, crc, -- 4); -- pframe += pxmitpriv->frag_len; -- pframe = (u8 *)RND4((addr_t)(pframe)); -- } -- } -- } else { -- res = _FAIL; -- } -- } -- return res; --} -- --/* The hlen doesn't include the IV */ --void r8712_tkip_decrypt(struct _adapter *padapter, u8 *precvframe) --{ /* exclude ICV */ -- u16 pnl; -- u32 pnh; -- u8 rc4key[16]; -- u8 ttkey[16]; -- u8 crc[4]; -- struct arc4context mycontext; -- u32 length; -- u8 *pframe, *payload, *iv, *prwskey, idx = 0; -- union pn48 txpn; -- struct sta_info *stainfo; -- struct rx_pkt_attrib *prxattrib = &((union recv_frame *) -- precvframe)->u.hdr.attrib; -- struct security_priv *psecuritypriv = &padapter->securitypriv; -- -- pframe = (unsigned char *)((union recv_frame *) -- precvframe)->u.hdr.rx_data; -- /* 4 start to decrypt recvframe */ -- if (prxattrib->encrypt == _TKIP_) { -- stainfo = r8712_get_stainfo(&padapter->stapriv, -- &prxattrib->ta[0]); -- if (stainfo) { -- iv = pframe + prxattrib->hdrlen; -- payload = pframe + prxattrib->iv_len + -- prxattrib->hdrlen; -- length = ((union recv_frame *)precvframe)-> -- u.hdr.len - prxattrib->hdrlen - -- prxattrib->iv_len; -- if (is_multicast_ether_addr(prxattrib->ra)) { -- idx = iv[3]; -- prwskey = &psecuritypriv->XGrpKey[ -- ((idx >> 6) & 0x3) - 1].skey[0]; -- if (!psecuritypriv->binstallGrpkey) -- return; -- } else { -- prwskey = &stainfo->x_UncstKey.skey[0]; -- } -- GET_TKIP_PN(iv, txpn); -- pnl = (u16)(txpn.val); -- pnh = (u32)(txpn.val >> 16); -- phase1((u16 *)&ttkey[0], prwskey, &prxattrib->ta[0], -- pnh); -- phase2(&rc4key[0], prwskey, (unsigned short *) -- &ttkey[0], pnl); -- /* 4 decrypt payload include icv */ -- arcfour_init(&mycontext, rc4key, 16); -- arcfour_encrypt(&mycontext, payload, payload, length); -- *((__le32 *)crc) = cpu_to_le32(getcrc32(payload, -- length - 4)); -- } -- } --} -- --/* 3 =====AES related===== */ -- --#define MAX_MSG_SIZE 2048 --/*****************************/ --/******** SBOX Table *********/ --/*****************************/ -- --static const u8 sbox_table[256] = { -- 0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, -- 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76, -- 0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, -- 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0, -- 0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, -- 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15, -- 0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, -- 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75, -- 0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, -- 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84, -- 0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, -- 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf, -- 0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, -- 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8, -- 0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, -- 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2, -- 0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, -- 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73, -- 0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, -- 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb, -- 0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, -- 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79, -- 0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, -- 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08, -- 0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, -- 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a, -- 0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, -- 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e, -- 0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, -- 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf, -- 0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, -- 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16 --}; -- --/****************************************/ --/* aes128k128d() */ --/* Performs a 128 bit AES encrypt with */ --/* 128 bit data. */ --/****************************************/ --static void xor_128(u8 *a, u8 *b, u8 *out) --{ -- sint i; -- -- for (i = 0; i < 16; i++) -- out[i] = a[i] ^ b[i]; --} -- --static void xor_32(u8 *a, u8 *b, u8 *out) --{ -- sint i; -- -- for (i = 0; i < 4; i++) -- out[i] = a[i] ^ b[i]; --} -- --static u8 sbox(u8 a) --{ -- return sbox_table[(sint)a]; --} -- --static void next_key(u8 *key, sint round) --{ -- u8 rcon; -- u8 sbox_key[4]; -- static const u8 rcon_table[12] = { -- 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, -- 0x1b, 0x36, 0x36, 0x36 -- }; -- -- sbox_key[0] = sbox(key[13]); -- sbox_key[1] = sbox(key[14]); -- sbox_key[2] = sbox(key[15]); -- sbox_key[3] = sbox(key[12]); -- rcon = rcon_table[round]; -- xor_32(&key[0], sbox_key, &key[0]); -- key[0] = key[0] ^ rcon; -- xor_32(&key[4], &key[0], &key[4]); -- xor_32(&key[8], &key[4], &key[8]); -- xor_32(&key[12], &key[8], &key[12]); --} -- --static void byte_sub(u8 *in, u8 *out) --{ -- sint i; -- -- for (i = 0; i < 16; i++) -- out[i] = sbox(in[i]); --} -- --static void shift_row(u8 *in, u8 *out) --{ -- out[0] = in[0]; -- out[1] = in[5]; -- out[2] = in[10]; -- out[3] = in[15]; -- out[4] = in[4]; -- out[5] = in[9]; -- out[6] = in[14]; -- out[7] = in[3]; -- out[8] = in[8]; -- out[9] = in[13]; -- out[10] = in[2]; -- out[11] = in[7]; -- out[12] = in[12]; -- out[13] = in[1]; -- out[14] = in[6]; -- out[15] = in[11]; --} -- --static void mix_column(u8 *in, u8 *out) --{ -- sint i; -- u8 add1b[4]; -- u8 add1bf7[4]; -- u8 rotl[4]; -- u8 swap_halves[4]; -- u8 andf7[4]; -- u8 rotr[4]; -- u8 temp[4]; -- u8 tempb[4]; -- -- for (i = 0; i < 4; i++) { -- if ((in[i] & 0x80) == 0x80) -- add1b[i] = 0x1b; -- else -- add1b[i] = 0x00; -- } -- swap_halves[0] = in[2]; /* Swap halves */ -- swap_halves[1] = in[3]; -- swap_halves[2] = in[0]; -- swap_halves[3] = in[1]; -- rotl[0] = in[3]; /* Rotate left 8 bits */ -- rotl[1] = in[0]; -- rotl[2] = in[1]; -- rotl[3] = in[2]; -- andf7[0] = in[0] & 0x7f; -- andf7[1] = in[1] & 0x7f; -- andf7[2] = in[2] & 0x7f; -- andf7[3] = in[3] & 0x7f; -- for (i = 3; i > 0; i--) { /* logical shift left 1 bit */ -- andf7[i] = andf7[i] << 1; -- if ((andf7[i - 1] & 0x80) == 0x80) -- andf7[i] = (andf7[i] | 0x01); -- } -- andf7[0] = andf7[0] << 1; -- andf7[0] = andf7[0] & 0xfe; -- xor_32(add1b, andf7, add1bf7); -- xor_32(in, add1bf7, rotr); -- temp[0] = rotr[0]; /* Rotate right 8 bits */ -- rotr[0] = rotr[1]; -- rotr[1] = rotr[2]; -- rotr[2] = rotr[3]; -- rotr[3] = temp[0]; -- xor_32(add1bf7, rotr, temp); -- xor_32(swap_halves, rotl, tempb); -- xor_32(temp, tempb, out); --} -- --static void aes128k128d(u8 *key, u8 *data, u8 *ciphertext) --{ -- sint round; -- sint i; -- u8 intermediatea[16]; -- u8 intermediateb[16]; -- u8 round_key[16]; -- -- for (i = 0; i < 16; i++) -- round_key[i] = key[i]; -- for (round = 0; round < 11; round++) { -- if (round == 0) { -- xor_128(round_key, data, ciphertext); -- next_key(round_key, round); -- } else if (round == 10) { -- byte_sub(ciphertext, intermediatea); -- shift_row(intermediatea, intermediateb); -- xor_128(intermediateb, round_key, ciphertext); -- } else { /* 1 - 9 */ -- byte_sub(ciphertext, intermediatea); -- shift_row(intermediatea, intermediateb); -- mix_column(&intermediateb[0], &intermediatea[0]); -- mix_column(&intermediateb[4], &intermediatea[4]); -- mix_column(&intermediateb[8], &intermediatea[8]); -- mix_column(&intermediateb[12], &intermediatea[12]); -- xor_128(intermediatea, round_key, ciphertext); -- next_key(round_key, round); -- } -- } --} -- --/************************************************/ --/* construct_mic_iv() */ --/* Builds the MIC IV from header fields and PN */ --/************************************************/ --static void construct_mic_iv(u8 *mic_iv, sint qc_exists, sint a4_exists, -- u8 *mpdu, uint payload_length, u8 *pn_vector) --{ -- sint i; -- -- mic_iv[0] = 0x59; -- if (qc_exists && a4_exists) -- mic_iv[1] = mpdu[30] & 0x0f; /* QoS_TC */ -- if (qc_exists && !a4_exists) -- mic_iv[1] = mpdu[24] & 0x0f; /* mute bits 7-4 */ -- if (!qc_exists) -- mic_iv[1] = 0x00; -- for (i = 2; i < 8; i++) -- mic_iv[i] = mpdu[i + 8]; -- for (i = 8; i < 14; i++) -- mic_iv[i] = pn_vector[13 - i]; /* mic_iv[8:13] = PN[5:0] */ -- mic_iv[14] = (unsigned char)(payload_length / 256); -- mic_iv[15] = (unsigned char)(payload_length % 256); --} -- --/************************************************/ --/* construct_mic_header1() */ --/* Builds the first MIC header block from */ --/* header fields. */ --/************************************************/ --static void construct_mic_header1(u8 *mic_header1, sint header_length, u8 *mpdu) --{ -- mic_header1[0] = (u8)((header_length - 2) / 256); -- mic_header1[1] = (u8)((header_length - 2) % 256); -- mic_header1[2] = mpdu[0] & 0xcf; /* Mute CF poll & CF ack bits */ -- /* Mute retry, more data and pwr mgt bits */ -- mic_header1[3] = mpdu[1] & 0xc7; -- mic_header1[4] = mpdu[4]; /* A1 */ -- mic_header1[5] = mpdu[5]; -- mic_header1[6] = mpdu[6]; -- mic_header1[7] = mpdu[7]; -- mic_header1[8] = mpdu[8]; -- mic_header1[9] = mpdu[9]; -- mic_header1[10] = mpdu[10]; /* A2 */ -- mic_header1[11] = mpdu[11]; -- mic_header1[12] = mpdu[12]; -- mic_header1[13] = mpdu[13]; -- mic_header1[14] = mpdu[14]; -- mic_header1[15] = mpdu[15]; --} -- --/************************************************/ --/* construct_mic_header2() */ --/* Builds the last MIC header block from */ --/* header fields. */ --/************************************************/ --static void construct_mic_header2(u8 *mic_header2, u8 *mpdu, sint a4_exists, -- sint qc_exists) --{ -- sint i; -- -- for (i = 0; i < 16; i++) -- mic_header2[i] = 0x00; -- mic_header2[0] = mpdu[16]; /* A3 */ -- mic_header2[1] = mpdu[17]; -- mic_header2[2] = mpdu[18]; -- mic_header2[3] = mpdu[19]; -- mic_header2[4] = mpdu[20]; -- mic_header2[5] = mpdu[21]; -- mic_header2[6] = 0x00; -- mic_header2[7] = 0x00; /* mpdu[23]; */ -- if (!qc_exists && a4_exists) -- for (i = 0; i < 6; i++) -- mic_header2[8 + i] = mpdu[24 + i]; /* A4 */ -- if (qc_exists && !a4_exists) { -- mic_header2[8] = mpdu[24] & 0x0f; /* mute bits 15 - 4 */ -- mic_header2[9] = mpdu[25] & 0x00; -- } -- if (qc_exists && a4_exists) { -- for (i = 0; i < 6; i++) -- mic_header2[8 + i] = mpdu[24 + i]; /* A4 */ -- mic_header2[14] = mpdu[30] & 0x0f; -- mic_header2[15] = mpdu[31] & 0x00; -- } --} -- --/************************************************/ --/* construct_mic_header2() */ --/* Builds the last MIC header block from */ --/* header fields. */ --/************************************************/ --static void construct_ctr_preload(u8 *ctr_preload, -- sint a4_exists, sint qc_exists, -- u8 *mpdu, u8 *pn_vector, sint c) --{ -- sint i; -- -- for (i = 0; i < 16; i++) -- ctr_preload[i] = 0x00; -- i = 0; -- ctr_preload[0] = 0x01; /* flag */ -- if (qc_exists && a4_exists) -- ctr_preload[1] = mpdu[30] & 0x0f; -- if (qc_exists && !a4_exists) -- ctr_preload[1] = mpdu[24] & 0x0f; -- for (i = 2; i < 8; i++) -- ctr_preload[i] = mpdu[i + 8]; -- for (i = 8; i < 14; i++) -- ctr_preload[i] = pn_vector[13 - i]; -- ctr_preload[14] = (unsigned char)(c / 256); /* Ctr */ -- ctr_preload[15] = (unsigned char)(c % 256); --} -- --/************************************/ --/* bitwise_xor() */ --/* A 128 bit, bitwise exclusive or */ --/************************************/ --static void bitwise_xor(u8 *ina, u8 *inb, u8 *out) --{ -- sint i; -- -- for (i = 0; i < 16; i++) -- out[i] = ina[i] ^ inb[i]; --} -- --static void aes_cipher(u8 *key, uint hdrlen, -- u8 *pframe, uint plen) --{ -- uint qc_exists, a4_exists, i, j, payload_remainder; -- uint num_blocks, payload_index; -- -- u8 pn_vector[6]; -- u8 mic_iv[16]; -- u8 mic_header1[16]; -- u8 mic_header2[16]; -- u8 ctr_preload[16]; -- -- /* Intermediate Buffers */ -- u8 chain_buffer[16]; -- u8 aes_out[16]; -- u8 padded_buffer[16]; -- u8 mic[8]; -- u16 frtype = GetFrameType(pframe); -- u16 frsubtype = GetFrameSubType(pframe); -- -- frsubtype >>= 4; -- memset((void *)mic_iv, 0, 16); -- memset((void *)mic_header1, 0, 16); -- memset((void *)mic_header2, 0, 16); -- memset((void *)ctr_preload, 0, 16); -- memset((void *)chain_buffer, 0, 16); -- memset((void *)aes_out, 0, 16); -- memset((void *)padded_buffer, 0, 16); -- -- if ((hdrlen == WLAN_HDR_A3_LEN) || (hdrlen == WLAN_HDR_A3_QOS_LEN)) -- a4_exists = 0; -- else -- a4_exists = 1; -- -- if ((frtype == (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA_CFACK)) || -- (frtype == (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA_CFPOLL)) || -- (frtype == (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA_CFACKPOLL))) { -- qc_exists = 1; -- if (hdrlen != WLAN_HDR_A3_QOS_LEN) -- hdrlen += 2; -- } else if ((frsubtype == 0x08) || -- (frsubtype == 0x09) || -- (frsubtype == 0x0a) || -- (frsubtype == 0x0b)) { -- if (hdrlen != WLAN_HDR_A3_QOS_LEN) -- hdrlen += 2; -- qc_exists = 1; -- } else { -- qc_exists = 0; -- } -- pn_vector[0] = pframe[hdrlen]; -- pn_vector[1] = pframe[hdrlen + 1]; -- pn_vector[2] = pframe[hdrlen + 4]; -- pn_vector[3] = pframe[hdrlen + 5]; -- pn_vector[4] = pframe[hdrlen + 6]; -- pn_vector[5] = pframe[hdrlen + 7]; -- construct_mic_iv(mic_iv, qc_exists, a4_exists, pframe, plen, pn_vector); -- construct_mic_header1(mic_header1, hdrlen, pframe); -- construct_mic_header2(mic_header2, pframe, a4_exists, qc_exists); -- payload_remainder = plen % 16; -- num_blocks = plen / 16; -- /* Find start of payload */ -- payload_index = hdrlen + 8; -- /* Calculate MIC */ -- aes128k128d(key, mic_iv, aes_out); -- bitwise_xor(aes_out, mic_header1, chain_buffer); -- aes128k128d(key, chain_buffer, aes_out); -- bitwise_xor(aes_out, mic_header2, chain_buffer); -- aes128k128d(key, chain_buffer, aes_out); -- for (i = 0; i < num_blocks; i++) { -- bitwise_xor(aes_out, &pframe[payload_index], chain_buffer); -- payload_index += 16; -- aes128k128d(key, chain_buffer, aes_out); -- } -- /* Add on the final payload block if it needs padding */ -- if (payload_remainder > 0) { -- for (j = 0; j < 16; j++) -- padded_buffer[j] = 0x00; -- for (j = 0; j < payload_remainder; j++) -- padded_buffer[j] = pframe[payload_index++]; -- bitwise_xor(aes_out, padded_buffer, chain_buffer); -- aes128k128d(key, chain_buffer, aes_out); -- } -- for (j = 0; j < 8; j++) -- mic[j] = aes_out[j]; -- /* Insert MIC into payload */ -- for (j = 0; j < 8; j++) -- pframe[payload_index + j] = mic[j]; -- payload_index = hdrlen + 8; -- for (i = 0; i < num_blocks; i++) { -- construct_ctr_preload(ctr_preload, a4_exists, qc_exists, -- pframe, pn_vector, i + 1); -- aes128k128d(key, ctr_preload, aes_out); -- bitwise_xor(aes_out, &pframe[payload_index], chain_buffer); -- for (j = 0; j < 16; j++) -- pframe[payload_index++] = chain_buffer[j]; -- } -- if (payload_remainder > 0) { /* If short final block, then pad it,*/ -- /* encrypt and copy unpadded part back */ -- construct_ctr_preload(ctr_preload, a4_exists, qc_exists, -- pframe, pn_vector, num_blocks + 1); -- for (j = 0; j < 16; j++) -- padded_buffer[j] = 0x00; -- for (j = 0; j < payload_remainder; j++) -- padded_buffer[j] = pframe[payload_index + j]; -- aes128k128d(key, ctr_preload, aes_out); -- bitwise_xor(aes_out, padded_buffer, chain_buffer); -- for (j = 0; j < payload_remainder; j++) -- pframe[payload_index++] = chain_buffer[j]; -- } -- /* Encrypt the MIC */ -- construct_ctr_preload(ctr_preload, a4_exists, qc_exists, -- pframe, pn_vector, 0); -- for (j = 0; j < 16; j++) -- padded_buffer[j] = 0x00; -- for (j = 0; j < 8; j++) -- padded_buffer[j] = pframe[j + hdrlen + 8 + plen]; -- aes128k128d(key, ctr_preload, aes_out); -- bitwise_xor(aes_out, padded_buffer, chain_buffer); -- for (j = 0; j < 8; j++) -- pframe[payload_index++] = chain_buffer[j]; --} -- --u32 r8712_aes_encrypt(struct _adapter *padapter, u8 *pxmitframe) --{ /* exclude ICV */ -- /* Intermediate Buffers */ -- sint curfragnum, length; -- u8 *pframe, *prwskey; -- struct sta_info *stainfo; -- struct pkt_attrib *pattrib = &((struct xmit_frame *) -- pxmitframe)->attrib; -- struct xmit_priv *pxmitpriv = &padapter->xmitpriv; -- u32 res = _SUCCESS; -- -- if (((struct xmit_frame *)pxmitframe)->buf_addr == NULL) -- return _FAIL; -- pframe = ((struct xmit_frame *)pxmitframe)->buf_addr + TXDESC_OFFSET; -- /* 4 start to encrypt each fragment */ -- if (pattrib->encrypt == _AES_) { -- if (pattrib->psta) -- stainfo = pattrib->psta; -- else -- stainfo = r8712_get_stainfo(&padapter->stapriv, -- &pattrib->ra[0]); -- if (stainfo) { -- prwskey = &stainfo->x_UncstKey.skey[0]; -- for (curfragnum = 0; curfragnum < pattrib->nr_frags; -- curfragnum++) { -- if ((curfragnum + 1) == pattrib->nr_frags) { -- length = pattrib->last_txcmdsz - -- pattrib->hdrlen - -- pattrib->iv_len - -- pattrib->icv_len; -- aes_cipher(prwskey, pattrib->hdrlen, -- pframe, length); -- } else { -- length = pxmitpriv->frag_len - -- pattrib->hdrlen - -- pattrib->iv_len - -- pattrib->icv_len; -- aes_cipher(prwskey, pattrib->hdrlen, -- pframe, length); -- pframe += pxmitpriv->frag_len; -- pframe = (u8 *)RND4((addr_t)(pframe)); -- } -- } -- } else { -- res = _FAIL; -- } -- } -- return res; --} -- --static void aes_decipher(u8 *key, uint hdrlen, -- u8 *pframe, uint plen) --{ -- static u8 message[MAX_MSG_SIZE]; -- uint qc_exists, a4_exists, i, j, payload_remainder; -- uint num_blocks, payload_index; -- u8 pn_vector[6]; -- u8 mic_iv[16]; -- u8 mic_header1[16]; -- u8 mic_header2[16]; -- u8 ctr_preload[16]; -- /* Intermediate Buffers */ -- u8 chain_buffer[16]; -- u8 aes_out[16]; -- u8 padded_buffer[16]; -- u8 mic[8]; -- uint frtype = GetFrameType(pframe); -- uint frsubtype = GetFrameSubType(pframe); -- -- frsubtype >>= 4; -- memset((void *)mic_iv, 0, 16); -- memset((void *)mic_header1, 0, 16); -- memset((void *)mic_header2, 0, 16); -- memset((void *)ctr_preload, 0, 16); -- memset((void *)chain_buffer, 0, 16); -- memset((void *)aes_out, 0, 16); -- memset((void *)padded_buffer, 0, 16); -- /* start to decrypt the payload */ -- /*(plen including llc, payload and mic) */ -- num_blocks = (plen - 8) / 16; -- payload_remainder = (plen - 8) % 16; -- pn_vector[0] = pframe[hdrlen]; -- pn_vector[1] = pframe[hdrlen + 1]; -- pn_vector[2] = pframe[hdrlen + 4]; -- pn_vector[3] = pframe[hdrlen + 5]; -- pn_vector[4] = pframe[hdrlen + 6]; -- pn_vector[5] = pframe[hdrlen + 7]; -- if ((hdrlen == WLAN_HDR_A3_LEN) || (hdrlen == WLAN_HDR_A3_QOS_LEN)) -- a4_exists = 0; -- else -- a4_exists = 1; -- if ((frtype == (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA_CFACK)) || -- (frtype == (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA_CFPOLL)) || -- (frtype == (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA_CFACKPOLL))) { -- qc_exists = 1; -- if (hdrlen != WLAN_HDR_A3_QOS_LEN) -- hdrlen += 2; -- } else if ((frsubtype == 0x08) || -- (frsubtype == 0x09) || -- (frsubtype == 0x0a) || -- (frsubtype == 0x0b)) { -- if (hdrlen != WLAN_HDR_A3_QOS_LEN) -- hdrlen += 2; -- qc_exists = 1; -- } else { -- qc_exists = 0; -- } -- /* now, decrypt pframe with hdrlen offset and plen long */ -- payload_index = hdrlen + 8; /* 8 is for extiv */ -- for (i = 0; i < num_blocks; i++) { -- construct_ctr_preload(ctr_preload, a4_exists, qc_exists, -- pframe, pn_vector, i + 1); -- aes128k128d(key, ctr_preload, aes_out); -- bitwise_xor(aes_out, &pframe[payload_index], chain_buffer); -- for (j = 0; j < 16; j++) -- pframe[payload_index++] = chain_buffer[j]; -- } -- if (payload_remainder > 0) { /* If short final block, pad it,*/ -- /* encrypt it and copy the unpadded part back */ -- construct_ctr_preload(ctr_preload, a4_exists, qc_exists, -- pframe, pn_vector, num_blocks + 1); -- for (j = 0; j < 16; j++) -- padded_buffer[j] = 0x00; -- for (j = 0; j < payload_remainder; j++) -- padded_buffer[j] = pframe[payload_index + j]; -- aes128k128d(key, ctr_preload, aes_out); -- bitwise_xor(aes_out, padded_buffer, chain_buffer); -- for (j = 0; j < payload_remainder; j++) -- pframe[payload_index++] = chain_buffer[j]; -- } -- /* start to calculate the mic */ -- memcpy((void *)message, pframe, (hdrlen + plen + 8)); -- pn_vector[0] = pframe[hdrlen]; -- pn_vector[1] = pframe[hdrlen + 1]; -- pn_vector[2] = pframe[hdrlen + 4]; -- pn_vector[3] = pframe[hdrlen + 5]; -- pn_vector[4] = pframe[hdrlen + 6]; -- pn_vector[5] = pframe[hdrlen + 7]; -- construct_mic_iv(mic_iv, qc_exists, a4_exists, message, plen - 8, -- pn_vector); -- construct_mic_header1(mic_header1, hdrlen, message); -- construct_mic_header2(mic_header2, message, a4_exists, qc_exists); -- payload_remainder = (plen - 8) % 16; -- num_blocks = (plen - 8) / 16; -- /* Find start of payload */ -- payload_index = hdrlen + 8; -- /* Calculate MIC */ -- aes128k128d(key, mic_iv, aes_out); -- bitwise_xor(aes_out, mic_header1, chain_buffer); -- aes128k128d(key, chain_buffer, aes_out); -- bitwise_xor(aes_out, mic_header2, chain_buffer); -- aes128k128d(key, chain_buffer, aes_out); -- for (i = 0; i < num_blocks; i++) { -- bitwise_xor(aes_out, &message[payload_index], chain_buffer); -- payload_index += 16; -- aes128k128d(key, chain_buffer, aes_out); -- } -- /* Add on the final payload block if it needs padding */ -- if (payload_remainder > 0) { -- for (j = 0; j < 16; j++) -- padded_buffer[j] = 0x00; -- for (j = 0; j < payload_remainder; j++) -- padded_buffer[j] = message[payload_index++]; -- bitwise_xor(aes_out, padded_buffer, chain_buffer); -- aes128k128d(key, chain_buffer, aes_out); -- } -- for (j = 0; j < 8; j++) -- mic[j] = aes_out[j]; -- /* Insert MIC into payload */ -- for (j = 0; j < 8; j++) -- message[payload_index + j] = mic[j]; -- payload_index = hdrlen + 8; -- for (i = 0; i < num_blocks; i++) { -- construct_ctr_preload(ctr_preload, a4_exists, qc_exists, -- message, pn_vector, i + 1); -- aes128k128d(key, ctr_preload, aes_out); -- bitwise_xor(aes_out, &message[payload_index], chain_buffer); -- for (j = 0; j < 16; j++) -- message[payload_index++] = chain_buffer[j]; -- } -- if (payload_remainder > 0) { /* If short final block, pad it,*/ -- /* encrypt and copy unpadded part back */ -- construct_ctr_preload(ctr_preload, a4_exists, qc_exists, -- message, pn_vector, num_blocks + 1); -- for (j = 0; j < 16; j++) -- padded_buffer[j] = 0x00; -- for (j = 0; j < payload_remainder; j++) -- padded_buffer[j] = message[payload_index + j]; -- aes128k128d(key, ctr_preload, aes_out); -- bitwise_xor(aes_out, padded_buffer, chain_buffer); -- for (j = 0; j < payload_remainder; j++) -- message[payload_index++] = chain_buffer[j]; -- } -- /* Encrypt the MIC */ -- construct_ctr_preload(ctr_preload, a4_exists, qc_exists, message, -- pn_vector, 0); -- for (j = 0; j < 16; j++) -- padded_buffer[j] = 0x00; -- for (j = 0; j < 8; j++) -- padded_buffer[j] = message[j + hdrlen + plen]; -- aes128k128d(key, ctr_preload, aes_out); -- bitwise_xor(aes_out, padded_buffer, chain_buffer); -- for (j = 0; j < 8; j++) -- message[payload_index++] = chain_buffer[j]; -- /* compare the mic */ --} -- --void r8712_aes_decrypt(struct _adapter *padapter, u8 *precvframe) --{ /* exclude ICV */ -- /* Intermediate Buffers */ -- sint length; -- u8 *pframe, *prwskey, *iv, idx; -- struct sta_info *stainfo; -- struct rx_pkt_attrib *prxattrib = &((union recv_frame *) -- precvframe)->u.hdr.attrib; -- struct security_priv *psecuritypriv = &padapter->securitypriv; -- -- pframe = (unsigned char *)((union recv_frame *)precvframe)-> -- u.hdr.rx_data; -- /* 4 start to encrypt each fragment */ -- if (prxattrib->encrypt == _AES_) { -- stainfo = r8712_get_stainfo(&padapter->stapriv, -- &prxattrib->ta[0]); -- if (stainfo) { -- if (is_multicast_ether_addr(prxattrib->ra)) { -- iv = pframe + prxattrib->hdrlen; -- idx = iv[3]; -- prwskey = &psecuritypriv->XGrpKey[ -- ((idx >> 6) & 0x3) - 1].skey[0]; -- if (!psecuritypriv->binstallGrpkey) -- return; -- -- } else { -- prwskey = &stainfo->x_UncstKey.skey[0]; -- } -- length = ((union recv_frame *)precvframe)-> -- u.hdr.len - prxattrib->hdrlen - -- prxattrib->iv_len; -- aes_decipher(prwskey, prxattrib->hdrlen, pframe, -- length); -- } -- } --} -- --void r8712_use_tkipkey_handler(struct timer_list *t) --{ -- struct _adapter *padapter = -- from_timer(padapter, t, securitypriv.tkip_timer); -- -- padapter->securitypriv.busetkipkey = true; --} -diff --git a/drivers/staging/rtl8712/rtl871x_security.h b/drivers/staging/rtl8712/rtl871x_security.h -deleted file mode 100644 -index 8461b7f05359a0..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_security.h -+++ /dev/null -@@ -1,218 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __RTL871X_SECURITY_H_ --#define __RTL871X_SECURITY_H_ -- --#include "osdep_service.h" --#include "drv_types.h" -- --#define _NO_PRIVACY_ 0x0 --#define _WEP40_ 0x1 --#define _TKIP_ 0x2 --#define _TKIP_WTMIC_ 0x3 --#define _AES_ 0x4 --#define _WEP104_ 0x5 -- --#define _WPA_IE_ID_ 0xdd --#define _WPA2_IE_ID_ 0x30 -- --#ifndef Ndis802_11AuthModeWPA2 --#define Ndis802_11AuthModeWPA2 (Ndis802_11AuthModeWPANone + 1) --#endif -- --#ifndef Ndis802_11AuthModeWPA2PSK --#define Ndis802_11AuthModeWPA2PSK (Ndis802_11AuthModeWPANone + 2) --#endif -- --union pn48 { -- u64 val; --#if defined(__BIG_ENDIAN) -- struct { -- u8 TSC7; -- u8 TSC6; -- u8 TSC5; -- u8 TSC4; -- u8 TSC3; -- u8 TSC2; -- u8 TSC1; -- u8 TSC0; -- } _byte_; --#else -- struct { -- u8 TSC0; -- u8 TSC1; -- u8 TSC2; -- u8 TSC3; -- u8 TSC4; -- u8 TSC5; -- u8 TSC6; -- u8 TSC7; -- } _byte_; --#endif --}; -- --union Keytype { -- u8 skey[16]; -- u32 lkey[4]; --}; -- --struct RT_PMKID_LIST { -- u8 bUsed; -- u8 Bssid[6]; -- u8 PMKID[16]; -- u8 SsidBuf[33]; -- u8 *ssid_octet; -- u16 ssid_length; --}; -- --struct security_priv { -- u32 AuthAlgrthm; /* 802.11 auth, could be open, shared, -- * 8021x and authswitch -- */ -- u32 PrivacyAlgrthm; /* This specify the privacy for shared -- * auth. algorithm. -- */ -- u32 PrivacyKeyIndex; /* this is only valid for legendary -- * wep, 0~3 for key id. -- */ -- union Keytype DefKey[4]; /* this is only valid for def. key */ -- u32 DefKeylen[4]; -- u32 XGrpPrivacy; /* This specify the privacy algthm. -- * used for Grp key -- */ -- u32 XGrpKeyid; /* key id used for Grp Key */ -- union Keytype XGrpKey[2]; /* 802.1x Group Key, for -- * inx0 and inx1 -- */ -- union Keytype XGrptxmickey[2]; -- union Keytype XGrprxmickey[2]; -- union pn48 Grptxpn; /* PN48 used for Grp Key xmit. */ -- union pn48 Grprxpn; /* PN48 used for Grp Key recv. */ -- u8 wps_hw_pbc_pressed;/*for hw pbc pressed*/ -- u8 wps_phase;/*for wps*/ -- u8 wps_ie[MAX_WPA_IE_LEN << 2]; -- int wps_ie_len; -- u8 binstallGrpkey; -- u8 busetkipkey; -- struct timer_list tkip_timer; -- u8 bcheck_grpkey; -- u8 bgrpkey_handshake; -- s32 sw_encrypt; /* from registry_priv */ -- s32 sw_decrypt; /* from registry_priv */ -- s32 hw_decrypted; /* if the rx packets is hw_decrypted==false, -- * it means the hw has not been ready. -- */ -- u32 ndisauthtype; /* keeps the auth_type & enc_status from upper -- * layer ioctl(wpa_supplicant or wzc) -- */ -- u32 ndisencryptstatus; -- struct wlan_bssid_ex sec_bss; /* for joinbss (h2c buffer) usage */ -- struct NDIS_802_11_WEP ndiswep; -- u8 assoc_info[600]; -- u8 szofcapability[256]; /* for wpa2 usage */ -- u8 oidassociation[512]; /* for wpa/wpa2 usage */ -- u8 authenticator_ie[256]; /* store ap security information element */ -- u8 supplicant_ie[256]; /* store sta security information element */ -- /* for tkip countermeasure */ -- u32 last_mic_err_time; -- u8 btkip_countermeasure; -- u8 btkip_wait_report; -- u32 btkip_countermeasure_time; -- /*------------------------------------------------------------------- -- * For WPA2 Pre-Authentication. -- *------------------------------------------------------------------ -- **/ -- struct RT_PMKID_LIST PMKIDList[NUM_PMKID_CACHE]; -- u8 PMKIDIndex; --}; -- --#define GET_ENCRY_ALGO(psecuritypriv, psta, encry_algo, bmcst) \ --do { \ -- switch (psecuritypriv->AuthAlgrthm) { \ -- case 0: \ -- case 1: \ -- case 3: \ -- encry_algo = (u8)psecuritypriv->PrivacyAlgrthm; \ -- break; \ -- case 2: \ -- if (bmcst) \ -- encry_algo = (u8)psecuritypriv->XGrpPrivacy; \ -- else \ -- encry_algo = (u8)psta->XPrivacy; \ -- break; \ -- } \ --} while (0) --#define SET_ICE_IV_LEN(iv_len, icv_len, encrypt)\ --do {\ -- switch (encrypt) { \ -- case _WEP40_: \ -- case _WEP104_: \ -- iv_len = 4; \ -- icv_len = 4; \ -- break; \ -- case _TKIP_: \ -- iv_len = 8; \ -- icv_len = 4; \ -- break; \ -- case _AES_: \ -- iv_len = 8; \ -- icv_len = 8; \ -- break; \ -- default: \ -- iv_len = 0; \ -- icv_len = 0; \ -- break; \ -- } \ --} while (0) --#define GET_TKIP_PN(iv, txpn) \ --do {\ -- txpn._byte_.TSC0 = iv[2];\ -- txpn._byte_.TSC1 = iv[0];\ -- txpn._byte_.TSC2 = iv[4];\ -- txpn._byte_.TSC3 = iv[5];\ -- txpn._byte_.TSC4 = iv[6];\ -- txpn._byte_.TSC5 = iv[7];\ --} while (0) -- --#define ROL32(A, n) (((A) << (n)) | (((A) >> (32 - (n))) & ((1UL << (n)) - 1))) --#define ROR32(A, n) ROL32((A), 32 - (n)) -- --struct mic_data { -- u32 K0, K1; /* Key */ -- u32 L, R; /* Current state */ -- u32 M; /* Message accumulator (single word) */ -- u32 nBytesInM; /* # bytes in M */ --}; -- --void seccalctkipmic( -- u8 *key, -- u8 *header, -- u8 *data, -- u32 data_len, -- u8 *Miccode, -- u8 priority); -- --void r8712_secmicsetkey(struct mic_data *pmicdata, u8 *key); --void r8712_secmicappend(struct mic_data *pmicdata, u8 *src, u32 nBytes); --void r8712_secgetmic(struct mic_data *pmicdata, u8 *dst); --u32 r8712_aes_encrypt(struct _adapter *padapter, u8 *pxmitframe); --u32 r8712_tkip_encrypt(struct _adapter *padapter, u8 *pxmitframe); --void r8712_wep_encrypt(struct _adapter *padapter, u8 *pxmitframe); --void r8712_aes_decrypt(struct _adapter *padapter, u8 *precvframe); --void r8712_tkip_decrypt(struct _adapter *padapter, u8 *precvframe); --void r8712_wep_decrypt(struct _adapter *padapter, u8 *precvframe); --void r8712_use_tkipkey_handler(struct timer_list *t); -- --#endif /*__RTL871X_SECURITY_H_ */ -- -diff --git a/drivers/staging/rtl8712/rtl871x_sta_mgt.c b/drivers/staging/rtl8712/rtl871x_sta_mgt.c -deleted file mode 100644 -index 2c806a0105bf6c..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_sta_mgt.c -+++ /dev/null -@@ -1,263 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * rtl871x_sta_mgt.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _RTL871X_STA_MGT_C_ -- --#include "osdep_service.h" --#include "drv_types.h" --#include "recv_osdep.h" --#include "xmit_osdep.h" --#include "sta_info.h" -- --static void _init_stainfo(struct sta_info *psta) --{ -- memset((u8 *)psta, 0, sizeof(struct sta_info)); -- spin_lock_init(&psta->lock); -- INIT_LIST_HEAD(&psta->list); -- INIT_LIST_HEAD(&psta->hash_list); -- _r8712_init_sta_xmit_priv(&psta->sta_xmitpriv); -- _r8712_init_sta_recv_priv(&psta->sta_recvpriv); -- INIT_LIST_HEAD(&psta->asoc_list); -- INIT_LIST_HEAD(&psta->auth_list); --} -- --int _r8712_init_sta_priv(struct sta_priv *pstapriv) --{ -- struct sta_info *psta; -- s32 i; -- -- pstapriv->pallocated_stainfo_buf = kmalloc(sizeof(struct sta_info) * -- NUM_STA + 4, GFP_ATOMIC); -- if (!pstapriv->pallocated_stainfo_buf) -- return -ENOMEM; -- pstapriv->pstainfo_buf = pstapriv->pallocated_stainfo_buf + 4 - -- ((addr_t)(pstapriv->pallocated_stainfo_buf) & 3); -- _init_queue(&pstapriv->free_sta_queue); -- spin_lock_init(&pstapriv->sta_hash_lock); -- pstapriv->asoc_sta_count = 0; -- _init_queue(&pstapriv->sleep_q); -- _init_queue(&pstapriv->wakeup_q); -- psta = (struct sta_info *)(pstapriv->pstainfo_buf); -- for (i = 0; i < NUM_STA; i++) { -- _init_stainfo(psta); -- INIT_LIST_HEAD(&(pstapriv->sta_hash[i])); -- list_add_tail(&psta->list, &pstapriv->free_sta_queue.queue); -- psta++; -- } -- INIT_LIST_HEAD(&pstapriv->asoc_list); -- INIT_LIST_HEAD(&pstapriv->auth_list); -- return 0; --} -- --/* this function is used to free the memory of lock || sema for all stainfos */ --static void mfree_all_stainfo(struct sta_priv *pstapriv) --{ -- unsigned long irqL; -- struct list_head *plist, *phead; -- -- spin_lock_irqsave(&pstapriv->sta_hash_lock, irqL); -- phead = &pstapriv->free_sta_queue.queue; -- plist = phead->next; -- while (!end_of_queue_search(phead, plist)) -- plist = plist->next; -- -- spin_unlock_irqrestore(&pstapriv->sta_hash_lock, irqL); --} -- --void _r8712_free_sta_priv(struct sta_priv *pstapriv) --{ -- if (pstapriv) { -- /* be done before free sta_hash_lock */ -- mfree_all_stainfo(pstapriv); -- kfree(pstapriv->pallocated_stainfo_buf); -- } --} -- --struct sta_info *r8712_alloc_stainfo(struct sta_priv *pstapriv, u8 *hwaddr) --{ -- s32 index; -- struct list_head *phash_list; -- struct sta_info *psta; -- struct __queue *pfree_sta_queue; -- struct recv_reorder_ctrl *preorder_ctrl; -- int i = 0; -- u16 wRxSeqInitialValue = 0xffff; -- unsigned long flags; -- -- pfree_sta_queue = &pstapriv->free_sta_queue; -- spin_lock_irqsave(&pfree_sta_queue->lock, flags); -- psta = list_first_entry_or_null(&pfree_sta_queue->queue, -- struct sta_info, list); -- if (psta) { -- list_del_init(&psta->list); -- _init_stainfo(psta); -- memcpy(psta->hwaddr, hwaddr, ETH_ALEN); -- index = wifi_mac_hash(hwaddr); -- if (index >= NUM_STA) { -- psta = NULL; -- goto exit; -- } -- phash_list = &pstapriv->sta_hash[index]; -- list_add_tail(&psta->hash_list, phash_list); -- pstapriv->asoc_sta_count++; -- --/* For the SMC router, the sequence number of first packet of WPS handshake -- * will be 0. In this case, this packet will be dropped by recv_decache function -- * if we use the 0x00 as the default value for tid_rxseq variable. So, we -- * initialize the tid_rxseq variable as the 0xffff. -- */ -- for (i = 0; i < 16; i++) -- memcpy(&psta->sta_recvpriv.rxcache.tid_rxseq[i], -- &wRxSeqInitialValue, 2); -- /* for A-MPDU Rx reordering buffer control */ -- for (i = 0; i < 16; i++) { -- preorder_ctrl = &psta->recvreorder_ctrl[i]; -- preorder_ctrl->padapter = pstapriv->padapter; -- preorder_ctrl->indicate_seq = 0xffff; -- preorder_ctrl->wend_b = 0xffff; -- preorder_ctrl->wsize_b = 64; -- _init_queue(&preorder_ctrl->pending_recvframe_queue); -- r8712_init_recv_timer(preorder_ctrl); -- } -- } --exit: -- spin_unlock_irqrestore(&pfree_sta_queue->lock, flags); -- return psta; --} -- --/* using pstapriv->sta_hash_lock to protect */ --void r8712_free_stainfo(struct _adapter *padapter, struct sta_info *psta) --{ -- int i; -- unsigned long irqL0; -- struct __queue *pfree_sta_queue; -- struct recv_reorder_ctrl *preorder_ctrl; -- struct sta_xmit_priv *pstaxmitpriv; -- struct xmit_priv *pxmitpriv = &padapter->xmitpriv; -- struct sta_priv *pstapriv = &padapter->stapriv; -- -- if (!psta) -- return; -- pfree_sta_queue = &pstapriv->free_sta_queue; -- pstaxmitpriv = &psta->sta_xmitpriv; -- spin_lock_irqsave(&(pxmitpriv->vo_pending.lock), irqL0); -- r8712_free_xmitframe_queue(pxmitpriv, &pstaxmitpriv->vo_q.sta_pending); -- list_del_init(&(pstaxmitpriv->vo_q.tx_pending)); -- spin_unlock_irqrestore(&(pxmitpriv->vo_pending.lock), irqL0); -- spin_lock_irqsave(&(pxmitpriv->vi_pending.lock), irqL0); -- r8712_free_xmitframe_queue(pxmitpriv, &pstaxmitpriv->vi_q.sta_pending); -- list_del_init(&(pstaxmitpriv->vi_q.tx_pending)); -- spin_unlock_irqrestore(&(pxmitpriv->vi_pending.lock), irqL0); -- spin_lock_irqsave(&(pxmitpriv->bk_pending.lock), irqL0); -- r8712_free_xmitframe_queue(pxmitpriv, &pstaxmitpriv->bk_q.sta_pending); -- list_del_init(&(pstaxmitpriv->bk_q.tx_pending)); -- spin_unlock_irqrestore(&(pxmitpriv->bk_pending.lock), irqL0); -- spin_lock_irqsave(&(pxmitpriv->be_pending.lock), irqL0); -- r8712_free_xmitframe_queue(pxmitpriv, &pstaxmitpriv->be_q.sta_pending); -- list_del_init(&(pstaxmitpriv->be_q.tx_pending)); -- spin_unlock_irqrestore(&(pxmitpriv->be_pending.lock), irqL0); -- list_del_init(&psta->hash_list); -- pstapriv->asoc_sta_count--; -- /* re-init sta_info; 20061114 */ -- _r8712_init_sta_xmit_priv(&psta->sta_xmitpriv); -- _r8712_init_sta_recv_priv(&psta->sta_recvpriv); -- /* for A-MPDU Rx reordering buffer control, -- * cancel reordering_ctrl_timer -- */ -- for (i = 0; i < 16; i++) { -- preorder_ctrl = &psta->recvreorder_ctrl[i]; -- del_timer(&preorder_ctrl->reordering_ctrl_timer); -- } -- spin_lock(&(pfree_sta_queue->lock)); -- /* insert into free_sta_queue; 20061114 */ -- list_add_tail(&psta->list, &pfree_sta_queue->queue); -- spin_unlock(&(pfree_sta_queue->lock)); --} -- --/* free all stainfo which in sta_hash[all] */ --void r8712_free_all_stainfo(struct _adapter *padapter) --{ -- unsigned long irqL; -- struct list_head *plist, *phead; -- s32 index; -- struct sta_info *psta = NULL; -- struct sta_priv *pstapriv = &padapter->stapriv; -- struct sta_info *pbcmc_stainfo = r8712_get_bcmc_stainfo(padapter); -- -- if (pstapriv->asoc_sta_count == 1) -- return; -- spin_lock_irqsave(&pstapriv->sta_hash_lock, irqL); -- for (index = 0; index < NUM_STA; index++) { -- phead = &(pstapriv->sta_hash[index]); -- plist = phead->next; -- while (!end_of_queue_search(phead, plist)) { -- psta = container_of(plist, -- struct sta_info, hash_list); -- plist = plist->next; -- if (pbcmc_stainfo != psta) -- r8712_free_stainfo(padapter, psta); -- } -- } -- spin_unlock_irqrestore(&pstapriv->sta_hash_lock, irqL); --} -- --/* any station allocated can be searched by hash list */ --struct sta_info *r8712_get_stainfo(struct sta_priv *pstapriv, u8 *hwaddr) --{ -- unsigned long irqL; -- struct list_head *plist, *phead; -- struct sta_info *psta = NULL; -- u32 index; -- -- if (!hwaddr) -- return NULL; -- index = wifi_mac_hash(hwaddr); -- spin_lock_irqsave(&pstapriv->sta_hash_lock, irqL); -- phead = &(pstapriv->sta_hash[index]); -- plist = phead->next; -- while (!end_of_queue_search(phead, plist)) { -- psta = container_of(plist, struct sta_info, hash_list); -- if ((!memcmp(psta->hwaddr, hwaddr, ETH_ALEN))) { -- /* if found the matched address */ -- break; -- } -- psta = NULL; -- plist = plist->next; -- } -- spin_unlock_irqrestore(&pstapriv->sta_hash_lock, irqL); -- return psta; --} -- --void r8712_init_bcmc_stainfo(struct _adapter *padapter) --{ -- unsigned char bcast_addr[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; -- struct sta_priv *pstapriv = &padapter->stapriv; -- -- r8712_alloc_stainfo(pstapriv, bcast_addr); --} -- --struct sta_info *r8712_get_bcmc_stainfo(struct _adapter *padapter) --{ -- struct sta_priv *pstapriv = &padapter->stapriv; -- u8 bc_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; -- -- return r8712_get_stainfo(pstapriv, bc_addr); --} -- --u8 r8712_access_ctrl(struct wlan_acl_pool *pacl_list, u8 *mac_addr) --{ -- return true; --} -diff --git a/drivers/staging/rtl8712/rtl871x_wlan_sme.h b/drivers/staging/rtl8712/rtl871x_wlan_sme.h -deleted file mode 100644 -index 97ea1451426c05..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_wlan_sme.h -+++ /dev/null -@@ -1,35 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef _RTL871X_WLAN_SME_H_ --#define _RTL871X_WLAN_SME_H_ -- --#define MSR_APMODE 0x0C --#define MSR_STAMODE 0x08 --#define MSR_ADHOCMODE 0x04 --#define MSR_NOLINKMODE 0x00 --#define _1M_RATE_ 0 --#define _2M_RATE_ 1 --#define _5M_RATE_ 2 --#define _11M_RATE_ 3 --#define _6M_RATE_ 4 --#define _9M_RATE_ 5 --#define _12M_RATE_ 6 --#define _18M_RATE_ 7 --#define _24M_RATE_ 8 --#define _36M_RATE_ 9 --#define _48M_RATE_ 10 --#define _54M_RATE_ 11 -- --#endif -- -diff --git a/drivers/staging/rtl8712/rtl871x_xmit.c b/drivers/staging/rtl8712/rtl871x_xmit.c -deleted file mode 100644 -index 6353dbe554d3a1..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_xmit.c -+++ /dev/null -@@ -1,1059 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * rtl871x_xmit.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _RTL871X_XMIT_C_ -- --#include "osdep_service.h" --#include "drv_types.h" --#include "osdep_intf.h" --#include "usb_ops.h" -- --#include --#include -- --static const u8 P802_1H_OUI[P80211_OUI_LEN] = {0x00, 0x00, 0xf8}; --static const u8 RFC1042_OUI[P80211_OUI_LEN] = {0x00, 0x00, 0x00}; --static void init_hwxmits(struct hw_xmit *phwxmit, sint entry); --static void alloc_hwxmits(struct _adapter *padapter); --static void free_hwxmits(struct _adapter *padapter); -- --static void _init_txservq(struct tx_servq *ptxservq) --{ -- INIT_LIST_HEAD(&ptxservq->tx_pending); -- _init_queue(&ptxservq->sta_pending); -- ptxservq->qcnt = 0; --} -- --void _r8712_init_sta_xmit_priv(struct sta_xmit_priv *psta_xmitpriv) --{ -- memset((unsigned char *)psta_xmitpriv, 0, -- sizeof(struct sta_xmit_priv)); -- spin_lock_init(&psta_xmitpriv->lock); -- _init_txservq(&psta_xmitpriv->be_q); -- _init_txservq(&psta_xmitpriv->bk_q); -- _init_txservq(&psta_xmitpriv->vi_q); -- _init_txservq(&psta_xmitpriv->vo_q); -- INIT_LIST_HEAD(&psta_xmitpriv->legacy_dz); -- INIT_LIST_HEAD(&psta_xmitpriv->apsd); --} -- --int _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv, -- struct _adapter *padapter) --{ -- sint i; -- struct xmit_buf *pxmitbuf; -- struct xmit_frame *pxframe; -- int j; -- -- memset((unsigned char *)pxmitpriv, 0, sizeof(struct xmit_priv)); -- spin_lock_init(&pxmitpriv->lock); -- /* -- *Please insert all the queue initialization using _init_queue below -- */ -- pxmitpriv->adapter = padapter; -- _init_queue(&pxmitpriv->be_pending); -- _init_queue(&pxmitpriv->bk_pending); -- _init_queue(&pxmitpriv->vi_pending); -- _init_queue(&pxmitpriv->vo_pending); -- _init_queue(&pxmitpriv->bm_pending); -- _init_queue(&pxmitpriv->legacy_dz_queue); -- _init_queue(&pxmitpriv->apsd_queue); -- _init_queue(&pxmitpriv->free_xmit_queue); -- /* -- * Please allocate memory with sz = (struct xmit_frame) * NR_XMITFRAME, -- * and initialize free_xmit_frame below. -- * Please also apply free_txobj to link_up all the xmit_frames... -- */ -- pxmitpriv->pallocated_frame_buf = -- kmalloc(NR_XMITFRAME * sizeof(struct xmit_frame) + 4, -- GFP_ATOMIC); -- if (!pxmitpriv->pallocated_frame_buf) { -- pxmitpriv->pxmit_frame_buf = NULL; -- return -ENOMEM; -- } -- pxmitpriv->pxmit_frame_buf = pxmitpriv->pallocated_frame_buf + 4 - -- ((addr_t) (pxmitpriv->pallocated_frame_buf) & 3); -- pxframe = (struct xmit_frame *) pxmitpriv->pxmit_frame_buf; -- for (i = 0; i < NR_XMITFRAME; i++) { -- INIT_LIST_HEAD(&(pxframe->list)); -- pxframe->padapter = padapter; -- pxframe->frame_tag = DATA_FRAMETAG; -- pxframe->pkt = NULL; -- pxframe->buf_addr = NULL; -- pxframe->pxmitbuf = NULL; -- list_add_tail(&(pxframe->list), -- &(pxmitpriv->free_xmit_queue.queue)); -- pxframe++; -- } -- pxmitpriv->free_xmitframe_cnt = NR_XMITFRAME; -- /* -- * init xmit hw_txqueue -- */ -- _r8712_init_hw_txqueue(&pxmitpriv->be_txqueue, BE_QUEUE_INX); -- _r8712_init_hw_txqueue(&pxmitpriv->bk_txqueue, BK_QUEUE_INX); -- _r8712_init_hw_txqueue(&pxmitpriv->vi_txqueue, VI_QUEUE_INX); -- _r8712_init_hw_txqueue(&pxmitpriv->vo_txqueue, VO_QUEUE_INX); -- _r8712_init_hw_txqueue(&pxmitpriv->bmc_txqueue, BMC_QUEUE_INX); -- pxmitpriv->frag_len = MAX_FRAG_THRESHOLD; -- pxmitpriv->txirp_cnt = 1; -- /*per AC pending irp*/ -- pxmitpriv->beq_cnt = 0; -- pxmitpriv->bkq_cnt = 0; -- pxmitpriv->viq_cnt = 0; -- pxmitpriv->voq_cnt = 0; -- /*init xmit_buf*/ -- _init_queue(&pxmitpriv->free_xmitbuf_queue); -- _init_queue(&pxmitpriv->pending_xmitbuf_queue); -- pxmitpriv->pallocated_xmitbuf = -- kmalloc(NR_XMITBUFF * sizeof(struct xmit_buf) + 4, GFP_ATOMIC); -- if (!pxmitpriv->pallocated_xmitbuf) -- goto clean_up_frame_buf; -- pxmitpriv->pxmitbuf = pxmitpriv->pallocated_xmitbuf + 4 - -- ((addr_t)(pxmitpriv->pallocated_xmitbuf) & 3); -- pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmitbuf; -- for (i = 0; i < NR_XMITBUFF; i++) { -- INIT_LIST_HEAD(&pxmitbuf->list); -- pxmitbuf->pallocated_buf = -- kmalloc(MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ, GFP_ATOMIC); -- if (!pxmitbuf->pallocated_buf) { -- j = 0; -- goto clean_up_alloc_buf; -- } -- pxmitbuf->pbuf = pxmitbuf->pallocated_buf + XMITBUF_ALIGN_SZ - -- ((addr_t) (pxmitbuf->pallocated_buf) & -- (XMITBUF_ALIGN_SZ - 1)); -- if (r8712_xmit_resource_alloc(padapter, pxmitbuf)) { -- j = 1; -- goto clean_up_alloc_buf; -- } -- list_add_tail(&pxmitbuf->list, -- &(pxmitpriv->free_xmitbuf_queue.queue)); -- pxmitbuf++; -- } -- pxmitpriv->free_xmitbuf_cnt = NR_XMITBUFF; -- INIT_WORK(&padapter->wk_filter_rx_ff0, r8712_SetFilter); -- alloc_hwxmits(padapter); -- init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry); -- tasklet_setup(&pxmitpriv->xmit_tasklet, r8712_xmit_bh); -- return 0; -- --clean_up_alloc_buf: -- if (j) { -- /* failure happened in r8712_xmit_resource_alloc() -- * delete extra pxmitbuf->pallocated_buf -- */ -- kfree(pxmitbuf->pallocated_buf); -- } -- for (j = 0; j < i; j++) { -- int k; -- -- pxmitbuf--; /* reset pointer */ -- kfree(pxmitbuf->pallocated_buf); -- for (k = 0; k < 8; k++) /* delete xmit urb's */ -- usb_free_urb(pxmitbuf->pxmit_urb[k]); -- } -- kfree(pxmitpriv->pallocated_xmitbuf); -- pxmitpriv->pallocated_xmitbuf = NULL; --clean_up_frame_buf: -- kfree(pxmitpriv->pallocated_frame_buf); -- pxmitpriv->pallocated_frame_buf = NULL; -- return -ENOMEM; --} -- --void _free_xmit_priv(struct xmit_priv *pxmitpriv) --{ -- int i; -- struct _adapter *padapter = pxmitpriv->adapter; -- struct xmit_frame *pxmitframe = (struct xmit_frame *) -- pxmitpriv->pxmit_frame_buf; -- struct xmit_buf *pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmitbuf; -- -- if (!pxmitpriv->pxmit_frame_buf) -- return; -- for (i = 0; i < NR_XMITFRAME; i++) { -- r8712_xmit_complete(padapter, pxmitframe); -- pxmitframe++; -- } -- for (i = 0; i < NR_XMITBUFF; i++) { -- r8712_xmit_resource_free(padapter, pxmitbuf); -- kfree(pxmitbuf->pallocated_buf); -- pxmitbuf++; -- } -- kfree(pxmitpriv->pallocated_frame_buf); -- kfree(pxmitpriv->pallocated_xmitbuf); -- free_hwxmits(padapter); --} -- --int r8712_update_attrib(struct _adapter *padapter, _pkt *pkt, -- struct pkt_attrib *pattrib) --{ -- struct pkt_file pktfile; -- struct sta_info *psta = NULL; -- struct ethhdr etherhdr; -- -- struct tx_cmd txdesc; -- -- bool bmcast; -- struct sta_priv *pstapriv = &padapter->stapriv; -- struct security_priv *psecuritypriv = &padapter->securitypriv; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct qos_priv *pqospriv = &pmlmepriv->qospriv; -- -- _r8712_open_pktfile(pkt, &pktfile); -- -- _r8712_pktfile_read(&pktfile, (unsigned char *)ðerhdr, ETH_HLEN); -- -- pattrib->ether_type = ntohs(etherhdr.h_proto); -- -- /* -- * If driver xmit ARP packet, driver can set ps mode to initial -- * setting. It stands for getting DHCP or fix IP. -- */ -- if (pattrib->ether_type == 0x0806) { -- if (padapter->pwrctrlpriv.pwr_mode != -- padapter->registrypriv.power_mgnt) { -- del_timer_sync(&pmlmepriv->dhcp_timer); -- r8712_set_ps_mode(padapter, -- padapter->registrypriv.power_mgnt, -- padapter->registrypriv.smart_ps); -- } -- } -- -- memcpy(pattrib->dst, ðerhdr.h_dest, ETH_ALEN); -- memcpy(pattrib->src, ðerhdr.h_source, ETH_ALEN); -- pattrib->pctrl = 0; -- if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) || -- check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) { -- memcpy(pattrib->ra, pattrib->dst, ETH_ALEN); -- memcpy(pattrib->ta, pattrib->src, ETH_ALEN); -- } else if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) { -- memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN); -- memcpy(pattrib->ta, pattrib->src, ETH_ALEN); -- } else if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) { -- memcpy(pattrib->ra, pattrib->dst, ETH_ALEN); -- memcpy(pattrib->ta, get_bssid(pmlmepriv), ETH_ALEN); -- } else if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) { -- /*firstly, filter packet not belongs to mp*/ -- if (pattrib->ether_type != 0x8712) -- return -EINVAL; -- /* for mp storing the txcmd per packet, -- * according to the info of txcmd to update pattrib -- */ -- /*get MP_TXDESC_SIZE bytes txcmd per packet*/ -- _r8712_pktfile_read(&pktfile, (u8 *)&txdesc, TXDESC_SIZE); -- memcpy(pattrib->ra, pattrib->dst, ETH_ALEN); -- memcpy(pattrib->ta, pattrib->src, ETH_ALEN); -- pattrib->pctrl = 1; -- } -- /* r8712_xmitframe_coalesce() overwrite this!*/ -- pattrib->pktlen = pktfile.pkt_len; -- if (pattrib->ether_type == ETH_P_IP) { -- /* The following is for DHCP and ARP packet, we use cck1M to -- * tx these packets and let LPS awake some time -- * to prevent DHCP protocol fail -- */ -- u8 tmp[24]; -- -- _r8712_pktfile_read(&pktfile, &tmp[0], 24); -- pattrib->dhcp_pkt = 0; -- if (pktfile.pkt_len > 282) {/*MINIMUM_DHCP_PACKET_SIZE)*/ -- if (pattrib->ether_type == ETH_P_IP) {/* IP header*/ -- if (((tmp[21] == 68) && (tmp[23] == 67)) || -- ((tmp[21] == 67) && (tmp[23] == 68))) { -- /* 68 : UDP BOOTP client -- * 67 : UDP BOOTP server -- * Use low rate to send DHCP packet. -- */ -- pattrib->dhcp_pkt = 1; -- } -- } -- } -- } -- bmcast = is_multicast_ether_addr(pattrib->ra); -- /* get sta_info*/ -- if (bmcast) { -- psta = r8712_get_bcmc_stainfo(padapter); -- pattrib->mac_id = 4; -- } else { -- if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) { -- psta = r8712_get_stainfo(pstapriv, -- get_bssid(pmlmepriv)); -- pattrib->mac_id = 5; -- } else { -- psta = r8712_get_stainfo(pstapriv, pattrib->ra); -- if (!psta) /* drop the pkt */ -- return -ENOMEM; -- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) -- pattrib->mac_id = 5; -- else -- pattrib->mac_id = psta->mac_id; -- } -- } -- -- if (psta) { -- pattrib->psta = psta; -- } else { -- /* if we cannot get psta => drrp the pkt */ -- return -ENOMEM; -- } -- -- pattrib->ack_policy = 0; -- /* get ether_hdr_len */ -- pattrib->pkt_hdrlen = ETH_HLEN; -- -- if (pqospriv->qos_option) { -- r8712_set_qos(&pktfile, pattrib); -- } else { -- pattrib->hdrlen = WLAN_HDR_A3_LEN; -- pattrib->subtype = IEEE80211_FTYPE_DATA; -- pattrib->priority = 0; -- } -- if (psta->ieee8021x_blocked) { -- pattrib->encrypt = 0; -- if ((pattrib->ether_type != 0x888e) && -- !check_fwstate(pmlmepriv, WIFI_MP_STATE)) -- return -EINVAL; -- } else { -- GET_ENCRY_ALGO(psecuritypriv, psta, pattrib->encrypt, bmcast); -- } -- switch (pattrib->encrypt) { -- case _WEP40_: -- case _WEP104_: -- pattrib->iv_len = 4; -- pattrib->icv_len = 4; -- break; -- case _TKIP_: -- pattrib->iv_len = 8; -- pattrib->icv_len = 4; -- if (padapter->securitypriv.busetkipkey == _FAIL) -- return -EINVAL; -- break; -- case _AES_: -- pattrib->iv_len = 8; -- pattrib->icv_len = 8; -- break; -- default: -- pattrib->iv_len = 0; -- pattrib->icv_len = 0; -- break; -- } -- -- if (pattrib->encrypt && -- (padapter->securitypriv.sw_encrypt || -- !psecuritypriv->hw_decrypted)) -- pattrib->bswenc = true; -- else -- pattrib->bswenc = false; -- /* if in MP_STATE, update pkt_attrib from mp_txcmd, and overwrite -- * some settings above. -- */ -- if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) -- pattrib->priority = -- (le32_to_cpu(txdesc.txdw1) >> QSEL_SHT) & 0x1f; -- return 0; --} -- --static int xmitframe_addmic(struct _adapter *padapter, -- struct xmit_frame *pxmitframe) --{ -- u32 curfragnum, length; -- u8 *pframe, *payload, mic[8]; -- struct mic_data micdata; -- struct sta_info *stainfo; -- struct qos_priv *pqospriv = &(padapter->mlmepriv.qospriv); -- struct pkt_attrib *pattrib = &pxmitframe->attrib; -- struct security_priv *psecpriv = &padapter->securitypriv; -- struct xmit_priv *pxmitpriv = &padapter->xmitpriv; -- u8 priority[4] = {}; -- bool bmcst = is_multicast_ether_addr(pattrib->ra); -- -- if (pattrib->psta) -- stainfo = pattrib->psta; -- else -- stainfo = r8712_get_stainfo(&padapter->stapriv, -- &pattrib->ra[0]); -- if (pattrib->encrypt == _TKIP_) { -- /*encode mic code*/ -- if (stainfo) { -- u8 null_key[16] = {}; -- -- pframe = pxmitframe->buf_addr + TXDESC_OFFSET; -- if (bmcst) { -- if (!memcmp(psecpriv->XGrptxmickey -- [psecpriv->XGrpKeyid].skey, -- null_key, 16)) -- return -ENOMEM; -- /*start to calculate the mic code*/ -- r8712_secmicsetkey(&micdata, -- psecpriv->XGrptxmickey -- [psecpriv->XGrpKeyid].skey); -- } else { -- if (!memcmp(&stainfo->tkiptxmickey.skey[0], -- null_key, 16)) -- return -ENOMEM; -- /* start to calculate the mic code */ -- r8712_secmicsetkey(&micdata, -- &stainfo->tkiptxmickey.skey[0]); -- } -- if (pframe[1] & 1) { /* ToDS==1 */ -- r8712_secmicappend(&micdata, -- &pframe[16], 6); /*DA*/ -- if (pframe[1] & 2) /* From Ds==1 */ -- r8712_secmicappend(&micdata, -- &pframe[24], 6); -- else -- r8712_secmicappend(&micdata, -- &pframe[10], 6); -- } else { /* ToDS==0 */ -- r8712_secmicappend(&micdata, -- &pframe[4], 6); /* DA */ -- if (pframe[1] & 2) /* From Ds==1 */ -- r8712_secmicappend(&micdata, -- &pframe[16], 6); -- else -- r8712_secmicappend(&micdata, -- &pframe[10], 6); -- } -- if (pqospriv->qos_option == 1) -- priority[0] = (u8)pxmitframe->attrib.priority; -- r8712_secmicappend(&micdata, &priority[0], 4); -- payload = pframe; -- for (curfragnum = 0; curfragnum < pattrib->nr_frags; -- curfragnum++) { -- payload = (u8 *)RND4((addr_t)(payload)); -- payload += pattrib->hdrlen + pattrib->iv_len; -- if ((curfragnum + 1) == pattrib->nr_frags) { -- length = pattrib->last_txcmdsz - -- pattrib->hdrlen - -- pattrib->iv_len - -- ((psecpriv->sw_encrypt) -- ? pattrib->icv_len : 0); -- r8712_secmicappend(&micdata, payload, -- length); -- payload = payload + length; -- } else { -- length = pxmitpriv->frag_len - -- pattrib->hdrlen - pattrib->iv_len - -- ((psecpriv->sw_encrypt) ? -- pattrib->icv_len : 0); -- r8712_secmicappend(&micdata, payload, -- length); -- payload = payload + length + -- pattrib->icv_len; -- } -- } -- r8712_secgetmic(&micdata, &(mic[0])); -- /* add mic code and add the mic code length in -- * last_txcmdsz -- */ -- memcpy(payload, &(mic[0]), 8); -- pattrib->last_txcmdsz += 8; -- payload = payload - pattrib->last_txcmdsz + 8; -- } -- } -- return 0; --} -- --static sint xmitframe_swencrypt(struct _adapter *padapter, -- struct xmit_frame *pxmitframe) --{ -- struct pkt_attrib *pattrib = &pxmitframe->attrib; -- -- if (pattrib->bswenc) { -- switch (pattrib->encrypt) { -- case _WEP40_: -- case _WEP104_: -- r8712_wep_encrypt(padapter, (u8 *)pxmitframe); -- break; -- case _TKIP_: -- r8712_tkip_encrypt(padapter, (u8 *)pxmitframe); -- break; -- case _AES_: -- r8712_aes_encrypt(padapter, (u8 *)pxmitframe); -- break; -- default: -- break; -- } -- } -- return _SUCCESS; --} -- --static int make_wlanhdr(struct _adapter *padapter, u8 *hdr, -- struct pkt_attrib *pattrib) --{ -- u16 *qc; -- -- struct ieee80211_hdr *pwlanhdr = (struct ieee80211_hdr *)hdr; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct qos_priv *pqospriv = &pmlmepriv->qospriv; -- __le16 *fctrl = &pwlanhdr->frame_control; -- u8 *bssid; -- -- memset(hdr, 0, WLANHDR_OFFSET); -- SetFrameSubType(fctrl, pattrib->subtype); -- if (!(pattrib->subtype & IEEE80211_FTYPE_DATA)) -- return 0; -- -- bssid = get_bssid(pmlmepriv); -- -- if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) { -- /* to_ds = 1, fr_ds = 0; */ -- SetToDs(fctrl); -- ether_addr_copy(pwlanhdr->addr1, bssid); -- ether_addr_copy(pwlanhdr->addr2, pattrib->src); -- ether_addr_copy(pwlanhdr->addr3, pattrib->dst); -- } else if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) { -- /* to_ds = 0, fr_ds = 1; */ -- SetFrDs(fctrl); -- ether_addr_copy(pwlanhdr->addr1, pattrib->dst); -- ether_addr_copy(pwlanhdr->addr2, bssid); -- ether_addr_copy(pwlanhdr->addr3, pattrib->src); -- } else if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) || -- check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) { -- ether_addr_copy(pwlanhdr->addr1, pattrib->dst); -- ether_addr_copy(pwlanhdr->addr2, pattrib->src); -- ether_addr_copy(pwlanhdr->addr3, bssid); -- } else if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) { -- ether_addr_copy(pwlanhdr->addr1, pattrib->dst); -- ether_addr_copy(pwlanhdr->addr2, pattrib->src); -- ether_addr_copy(pwlanhdr->addr3, bssid); -- } else { -- return -EINVAL; -- } -- -- if (pattrib->encrypt) -- SetPrivacy(fctrl); -- if (pqospriv->qos_option) { -- qc = (unsigned short *)(hdr + pattrib->hdrlen - 2); -- if (pattrib->priority) -- SetPriority(qc, pattrib->priority); -- SetAckpolicy(qc, pattrib->ack_policy); -- } -- /* TODO: fill HT Control Field */ -- /* Update Seq Num will be handled by f/w */ -- { -- struct sta_info *psta; -- bool bmcst = is_multicast_ether_addr(pattrib->ra); -- -- if (pattrib->psta) -- psta = pattrib->psta; -- else if (bmcst) -- psta = r8712_get_bcmc_stainfo(padapter); -- else -- psta = r8712_get_stainfo(&padapter->stapriv, -- pattrib->ra); -- -- if (psta) { -- u16 *txtid = psta->sta_xmitpriv.txseq_tid; -- -- txtid[pattrib->priority]++; -- txtid[pattrib->priority] &= 0xFFF; -- pattrib->seqnum = txtid[pattrib->priority]; -- SetSeqNum(hdr, pattrib->seqnum); -- } -- } -- -- return 0; --} -- --static sint r8712_put_snap(u8 *data, u16 h_proto) --{ -- struct ieee80211_snap_hdr *snap; -- const u8 *oui; -- -- snap = (struct ieee80211_snap_hdr *)data; -- snap->dsap = 0xaa; -- snap->ssap = 0xaa; -- snap->ctrl = 0x03; -- if (h_proto == 0x8137 || h_proto == 0x80f3) -- oui = P802_1H_OUI; -- else -- oui = RFC1042_OUI; -- snap->oui[0] = oui[0]; -- snap->oui[1] = oui[1]; -- snap->oui[2] = oui[2]; -- *(__be16 *)(data + SNAP_SIZE) = htons(h_proto); -- return SNAP_SIZE + sizeof(u16); --} -- --/* -- * This sub-routine will perform all the following: -- * 1. remove 802.3 header. -- * 2. create wlan_header, based on the info in pxmitframe -- * 3. append sta's iv/ext-iv -- * 4. append LLC -- * 5. move frag chunk from pframe to pxmitframe->mem -- * 6. apply sw-encrypt, if necessary. -- */ --sint r8712_xmitframe_coalesce(struct _adapter *padapter, _pkt *pkt, -- struct xmit_frame *pxmitframe) --{ -- struct pkt_file pktfile; -- -- sint frg_len, mpdu_len, llc_sz; -- u32 mem_sz; -- u8 frg_inx; -- addr_t addr; -- u8 *pframe, *mem_start, *ptxdesc; -- struct sta_info *psta; -- struct security_priv *psecpriv = &padapter->securitypriv; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- struct xmit_priv *pxmitpriv = &padapter->xmitpriv; -- struct pkt_attrib *pattrib = &pxmitframe->attrib; -- u8 *pbuf_start; -- bool bmcst = is_multicast_ether_addr(pattrib->ra); -- -- if (!pattrib->psta) -- return _FAIL; -- psta = pattrib->psta; -- if (!pxmitframe->buf_addr) -- return _FAIL; -- pbuf_start = pxmitframe->buf_addr; -- ptxdesc = pbuf_start; -- mem_start = pbuf_start + TXDESC_OFFSET; -- if (make_wlanhdr(padapter, mem_start, pattrib)) -- return _FAIL; -- _r8712_open_pktfile(pkt, &pktfile); -- _r8712_pktfile_read(&pktfile, NULL, (uint) pattrib->pkt_hdrlen); -- if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) { -- /* truncate TXDESC_SIZE bytes txcmd if at mp mode for 871x */ -- if (pattrib->ether_type == 0x8712) { -- /* take care - update_txdesc overwrite this */ -- _r8712_pktfile_read(&pktfile, ptxdesc, TXDESC_SIZE); -- } -- } -- pattrib->pktlen = pktfile.pkt_len; -- frg_inx = 0; -- frg_len = pxmitpriv->frag_len - 4; -- while (1) { -- llc_sz = 0; -- mpdu_len = frg_len; -- pframe = mem_start; -- SetMFrag(mem_start); -- pframe += pattrib->hdrlen; -- mpdu_len -= pattrib->hdrlen; -- /* adding icv, if necessary...*/ -- if (pattrib->iv_len) { -- if (psta) { -- switch (pattrib->encrypt) { -- case _WEP40_: -- case _WEP104_: -- WEP_IV(pattrib->iv, psta->txpn, -- (u8)psecpriv->PrivacyKeyIndex); -- break; -- case _TKIP_: -- if (bmcst) -- TKIP_IV(pattrib->iv, -- psta->txpn, -- (u8)psecpriv->XGrpKeyid); -- else -- TKIP_IV(pattrib->iv, psta->txpn, -- 0); -- break; -- case _AES_: -- if (bmcst) -- AES_IV(pattrib->iv, psta->txpn, -- (u8)psecpriv->XGrpKeyid); -- else -- AES_IV(pattrib->iv, psta->txpn, -- 0); -- break; -- } -- } -- memcpy(pframe, pattrib->iv, pattrib->iv_len); -- pframe += pattrib->iv_len; -- mpdu_len -= pattrib->iv_len; -- } -- if (frg_inx == 0) { -- llc_sz = r8712_put_snap(pframe, pattrib->ether_type); -- pframe += llc_sz; -- mpdu_len -= llc_sz; -- } -- if ((pattrib->icv_len > 0) && (pattrib->bswenc)) -- mpdu_len -= pattrib->icv_len; -- if (bmcst) -- mem_sz = _r8712_pktfile_read(&pktfile, pframe, -- pattrib->pktlen); -- else -- mem_sz = _r8712_pktfile_read(&pktfile, pframe, -- mpdu_len); -- pframe += mem_sz; -- if ((pattrib->icv_len > 0) && (pattrib->bswenc)) { -- memcpy(pframe, pattrib->icv, pattrib->icv_len); -- pframe += pattrib->icv_len; -- } -- frg_inx++; -- if (bmcst || r8712_endofpktfile(&pktfile)) { -- pattrib->nr_frags = frg_inx; -- pattrib->last_txcmdsz = pattrib->hdrlen + -- pattrib->iv_len + -- ((pattrib->nr_frags == 1) ? -- llc_sz : 0) + -- ((pattrib->bswenc) ? -- pattrib->icv_len : 0) + mem_sz; -- ClearMFrag(mem_start); -- break; -- } -- addr = (addr_t)(pframe); -- mem_start = (unsigned char *)RND4(addr) + TXDESC_OFFSET; -- memcpy(mem_start, pbuf_start + TXDESC_OFFSET, pattrib->hdrlen); -- } -- -- if (xmitframe_addmic(padapter, pxmitframe)) -- return _FAIL; -- xmitframe_swencrypt(padapter, pxmitframe); -- return _SUCCESS; --} -- --void r8712_update_protection(struct _adapter *padapter, u8 *ie, uint ie_len) --{ -- uint protection; -- u8 *perp; -- uint erp_len; -- struct xmit_priv *pxmitpriv = &padapter->xmitpriv; -- struct registry_priv *pregistrypriv = &padapter->registrypriv; -- -- switch (pxmitpriv->vcs_setting) { -- case DISABLE_VCS: -- pxmitpriv->vcs = NONE_VCS; -- break; -- case ENABLE_VCS: -- break; -- case AUTO_VCS: -- default: -- perp = r8712_get_ie(ie, WLAN_EID_ERP_INFO, &erp_len, ie_len); -- if (!perp) { -- pxmitpriv->vcs = NONE_VCS; -- } else { -- protection = (*(perp + 2)) & BIT(1); -- if (protection) { -- if (pregistrypriv->vcs_type == RTS_CTS) -- pxmitpriv->vcs = RTS_CTS; -- else -- pxmitpriv->vcs = CTS_TO_SELF; -- } else { -- pxmitpriv->vcs = NONE_VCS; -- } -- } -- break; -- } --} -- --struct xmit_buf *r8712_alloc_xmitbuf(struct xmit_priv *pxmitpriv) --{ -- unsigned long irqL; -- struct xmit_buf *pxmitbuf; -- struct __queue *pfree_xmitbuf_queue = &pxmitpriv->free_xmitbuf_queue; -- -- spin_lock_irqsave(&pfree_xmitbuf_queue->lock, irqL); -- pxmitbuf = list_first_entry_or_null(&pfree_xmitbuf_queue->queue, -- struct xmit_buf, list); -- if (pxmitbuf) { -- list_del_init(&pxmitbuf->list); -- pxmitpriv->free_xmitbuf_cnt--; -- } -- spin_unlock_irqrestore(&pfree_xmitbuf_queue->lock, irqL); -- return pxmitbuf; --} -- --void r8712_free_xmitbuf(struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf) --{ -- unsigned long irqL; -- struct __queue *pfree_xmitbuf_queue = &pxmitpriv->free_xmitbuf_queue; -- -- if (!pxmitbuf) -- return; -- spin_lock_irqsave(&pfree_xmitbuf_queue->lock, irqL); -- list_del_init(&pxmitbuf->list); -- list_add_tail(&(pxmitbuf->list), &pfree_xmitbuf_queue->queue); -- pxmitpriv->free_xmitbuf_cnt++; -- spin_unlock_irqrestore(&pfree_xmitbuf_queue->lock, irqL); --} -- --/* -- * Calling context: -- * 1. OS_TXENTRY -- * 2. RXENTRY (rx_thread or RX_ISR/RX_CallBack) -- * -- * If we turn on USE_RXTHREAD, then, no need for critical section. -- * Otherwise, we must use _enter/_exit critical to protect free_xmit_queue... -- * -- * Must be very very cautious... -- * -- */ --struct xmit_frame *r8712_alloc_xmitframe(struct xmit_priv *pxmitpriv) --{ -- /* -- * Please remember to use all the osdep_service api, -- * and lock/unlock or _enter/_exit critical to protect -- * pfree_xmit_queue -- */ -- unsigned long irqL; -- struct xmit_frame *pxframe; -- struct __queue *pfree_xmit_queue = &pxmitpriv->free_xmit_queue; -- -- spin_lock_irqsave(&pfree_xmit_queue->lock, irqL); -- pxframe = list_first_entry_or_null(&pfree_xmit_queue->queue, -- struct xmit_frame, list); -- if (pxframe) { -- list_del_init(&pxframe->list); -- pxmitpriv->free_xmitframe_cnt--; -- pxframe->buf_addr = NULL; -- pxframe->pxmitbuf = NULL; -- pxframe->attrib.psta = NULL; -- pxframe->pkt = NULL; -- } -- spin_unlock_irqrestore(&pfree_xmit_queue->lock, irqL); -- return pxframe; --} -- --void r8712_free_xmitframe(struct xmit_priv *pxmitpriv, -- struct xmit_frame *pxmitframe) --{ -- unsigned long irqL; -- struct __queue *pfree_xmit_queue = &pxmitpriv->free_xmit_queue; -- struct _adapter *padapter = pxmitpriv->adapter; -- -- if (!pxmitframe) -- return; -- spin_lock_irqsave(&pfree_xmit_queue->lock, irqL); -- list_del_init(&pxmitframe->list); -- if (pxmitframe->pkt) -- pxmitframe->pkt = NULL; -- list_add_tail(&pxmitframe->list, &pfree_xmit_queue->queue); -- pxmitpriv->free_xmitframe_cnt++; -- spin_unlock_irqrestore(&pfree_xmit_queue->lock, irqL); -- if (netif_queue_stopped(padapter->pnetdev)) -- netif_wake_queue(padapter->pnetdev); --} -- --void r8712_free_xmitframe_ex(struct xmit_priv *pxmitpriv, -- struct xmit_frame *pxmitframe) --{ -- if (!pxmitframe) -- return; -- if (pxmitframe->frame_tag == DATA_FRAMETAG) -- r8712_free_xmitframe(pxmitpriv, pxmitframe); --} -- --void r8712_free_xmitframe_queue(struct xmit_priv *pxmitpriv, -- struct __queue *pframequeue) --{ -- unsigned long irqL; -- struct list_head *plist, *phead; -- struct xmit_frame *pxmitframe; -- -- spin_lock_irqsave(&(pframequeue->lock), irqL); -- phead = &pframequeue->queue; -- plist = phead->next; -- while (!end_of_queue_search(phead, plist)) { -- pxmitframe = container_of(plist, struct xmit_frame, list); -- plist = plist->next; -- r8712_free_xmitframe(pxmitpriv, pxmitframe); -- } -- spin_unlock_irqrestore(&(pframequeue->lock), irqL); --} -- --static inline struct tx_servq *get_sta_pending(struct _adapter *padapter, -- struct __queue **ppstapending, -- struct sta_info *psta, sint up) --{ -- struct tx_servq *ptxservq; -- struct hw_xmit *phwxmits = padapter->xmitpriv.hwxmits; -- -- switch (up) { -- case 1: -- case 2: -- ptxservq = &(psta->sta_xmitpriv.bk_q); -- *ppstapending = &padapter->xmitpriv.bk_pending; -- (phwxmits + 3)->accnt++; -- break; -- case 4: -- case 5: -- ptxservq = &(psta->sta_xmitpriv.vi_q); -- *ppstapending = &padapter->xmitpriv.vi_pending; -- (phwxmits + 1)->accnt++; -- break; -- case 6: -- case 7: -- ptxservq = &(psta->sta_xmitpriv.vo_q); -- *ppstapending = &padapter->xmitpriv.vo_pending; -- (phwxmits + 0)->accnt++; -- break; -- case 0: -- case 3: -- default: -- ptxservq = &(psta->sta_xmitpriv.be_q); -- *ppstapending = &padapter->xmitpriv.be_pending; -- (phwxmits + 2)->accnt++; -- break; -- } -- return ptxservq; --} -- --/* -- * Will enqueue pxmitframe to the proper queue, and indicate it -- * to xx_pending list..... -- */ --int r8712_xmit_classifier(struct _adapter *padapter, -- struct xmit_frame *pxmitframe) --{ -- unsigned long irqL0; -- struct __queue *pstapending; -- struct sta_info *psta; -- struct tx_servq *ptxservq; -- struct pkt_attrib *pattrib = &pxmitframe->attrib; -- struct sta_priv *pstapriv = &padapter->stapriv; -- struct mlme_priv *pmlmepriv = &padapter->mlmepriv; -- bool bmcst = is_multicast_ether_addr(pattrib->ra); -- -- if (pattrib->psta) { -- psta = pattrib->psta; -- } else { -- if (bmcst) { -- psta = r8712_get_bcmc_stainfo(padapter); -- } else { -- if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) -- psta = r8712_get_stainfo(pstapriv, -- get_bssid(pmlmepriv)); -- else -- psta = r8712_get_stainfo(pstapriv, pattrib->ra); -- } -- } -- if (!psta) -- return -EINVAL; -- ptxservq = get_sta_pending(padapter, &pstapending, -- psta, pattrib->priority); -- spin_lock_irqsave(&pstapending->lock, irqL0); -- if (list_empty(&ptxservq->tx_pending)) -- list_add_tail(&ptxservq->tx_pending, &pstapending->queue); -- list_add_tail(&pxmitframe->list, &ptxservq->sta_pending.queue); -- ptxservq->qcnt++; -- spin_unlock_irqrestore(&pstapending->lock, irqL0); -- return 0; --} -- --static void alloc_hwxmits(struct _adapter *padapter) --{ -- struct hw_xmit *hwxmits; -- struct xmit_priv *pxmitpriv = &padapter->xmitpriv; -- -- pxmitpriv->hwxmit_entry = HWXMIT_ENTRY; -- pxmitpriv->hwxmits = kmalloc_array(pxmitpriv->hwxmit_entry, -- sizeof(struct hw_xmit), GFP_ATOMIC); -- if (!pxmitpriv->hwxmits) -- return; -- hwxmits = pxmitpriv->hwxmits; -- if (pxmitpriv->hwxmit_entry == 5) { -- pxmitpriv->bmc_txqueue.head = 0; -- hwxmits[0] .phwtxqueue = &pxmitpriv->bmc_txqueue; -- hwxmits[0] .sta_queue = &pxmitpriv->bm_pending; -- pxmitpriv->vo_txqueue.head = 0; -- hwxmits[1] .phwtxqueue = &pxmitpriv->vo_txqueue; -- hwxmits[1] .sta_queue = &pxmitpriv->vo_pending; -- pxmitpriv->vi_txqueue.head = 0; -- hwxmits[2] .phwtxqueue = &pxmitpriv->vi_txqueue; -- hwxmits[2] .sta_queue = &pxmitpriv->vi_pending; -- pxmitpriv->bk_txqueue.head = 0; -- hwxmits[3] .phwtxqueue = &pxmitpriv->bk_txqueue; -- hwxmits[3] .sta_queue = &pxmitpriv->bk_pending; -- pxmitpriv->be_txqueue.head = 0; -- hwxmits[4] .phwtxqueue = &pxmitpriv->be_txqueue; -- hwxmits[4] .sta_queue = &pxmitpriv->be_pending; -- } else if (pxmitpriv->hwxmit_entry == 4) { -- pxmitpriv->vo_txqueue.head = 0; -- hwxmits[0] .phwtxqueue = &pxmitpriv->vo_txqueue; -- hwxmits[0] .sta_queue = &pxmitpriv->vo_pending; -- pxmitpriv->vi_txqueue.head = 0; -- hwxmits[1] .phwtxqueue = &pxmitpriv->vi_txqueue; -- hwxmits[1] .sta_queue = &pxmitpriv->vi_pending; -- pxmitpriv->be_txqueue.head = 0; -- hwxmits[2] .phwtxqueue = &pxmitpriv->be_txqueue; -- hwxmits[2] .sta_queue = &pxmitpriv->be_pending; -- pxmitpriv->bk_txqueue.head = 0; -- hwxmits[3] .phwtxqueue = &pxmitpriv->bk_txqueue; -- hwxmits[3] .sta_queue = &pxmitpriv->bk_pending; -- } --} -- --static void free_hwxmits(struct _adapter *padapter) --{ -- struct xmit_priv *pxmitpriv = &padapter->xmitpriv; -- -- kfree(pxmitpriv->hwxmits); --} -- --static void init_hwxmits(struct hw_xmit *phwxmit, sint entry) --{ -- sint i; -- -- for (i = 0; i < entry; i++, phwxmit++) { -- spin_lock_init(&phwxmit->xmit_lock); -- INIT_LIST_HEAD(&phwxmit->pending); -- phwxmit->txcmdcnt = 0; -- phwxmit->accnt = 0; -- } --} -- --void xmitframe_xmitbuf_attach(struct xmit_frame *pxmitframe, -- struct xmit_buf *pxmitbuf) --{ -- /* pxmitbuf attach to pxmitframe */ -- pxmitframe->pxmitbuf = pxmitbuf; -- /* urb and irp connection */ -- pxmitframe->pxmit_urb[0] = pxmitbuf->pxmit_urb[0]; -- /* buffer addr assoc */ -- pxmitframe->buf_addr = pxmitbuf->pbuf; -- /* pxmitframe attach to pxmitbuf */ -- pxmitbuf->priv_data = pxmitframe; --} -- --/* -- * tx_action == 0 == no frames to transmit -- * tx_action > 0 ==> we have frames to transmit -- * tx_action < 0 ==> we have frames to transmit, but TXFF is not even enough -- * to transmit 1 frame. -- */ -- --int r8712_pre_xmit(struct _adapter *padapter, struct xmit_frame *pxmitframe) --{ -- unsigned long irqL; -- int ret; -- struct xmit_buf *pxmitbuf = NULL; -- struct xmit_priv *pxmitpriv = &padapter->xmitpriv; -- struct pkt_attrib *pattrib = &pxmitframe->attrib; -- -- r8712_do_queue_select(padapter, pattrib); -- spin_lock_irqsave(&pxmitpriv->lock, irqL); -- if (r8712_txframes_sta_ac_pending(padapter, pattrib) > 0) { -- ret = false; -- r8712_xmit_enqueue(padapter, pxmitframe); -- spin_unlock_irqrestore(&pxmitpriv->lock, irqL); -- return ret; -- } -- pxmitbuf = r8712_alloc_xmitbuf(pxmitpriv); -- if (!pxmitbuf) { /*enqueue packet*/ -- ret = false; -- r8712_xmit_enqueue(padapter, pxmitframe); -- spin_unlock_irqrestore(&pxmitpriv->lock, irqL); -- } else { /*dump packet directly*/ -- spin_unlock_irqrestore(&pxmitpriv->lock, irqL); -- ret = true; -- xmitframe_xmitbuf_attach(pxmitframe, pxmitbuf); -- r8712_xmit_direct(padapter, pxmitframe); -- } -- return ret; --} -diff --git a/drivers/staging/rtl8712/rtl871x_xmit.h b/drivers/staging/rtl8712/rtl871x_xmit.h -deleted file mode 100644 -index cdcbc87a3cadeb..00000000000000 ---- a/drivers/staging/rtl8712/rtl871x_xmit.h -+++ /dev/null -@@ -1,288 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef _RTL871X_XMIT_H_ --#define _RTL871X_XMIT_H_ -- --#include "osdep_service.h" --#include "drv_types.h" --#include "xmit_osdep.h" -- --#ifdef CONFIG_R8712_TX_AGGR --#define MAX_XMITBUF_SZ (16384) --#else --#define MAX_XMITBUF_SZ (2048) --#endif -- --#define NR_XMITBUFF (4) -- --#ifdef CONFIG_R8712_TX_AGGR --#define AGGR_NR_HIGH_BOUND (4) /*(8) */ --#define AGGR_NR_LOW_BOUND (2) --#endif -- --#define XMITBUF_ALIGN_SZ 512 --#define TX_GUARD_BAND 5 --#define MAX_NUMBLKS (1) -- --/* Fixed the Big Endian bug when using the software driver encryption.*/ --#define WEP_IV(pattrib_iv, txpn, keyidx)\ --do { \ -- pattrib_iv[0] = txpn._byte_.TSC0;\ -- pattrib_iv[1] = txpn._byte_.TSC1;\ -- pattrib_iv[2] = txpn._byte_.TSC2;\ -- pattrib_iv[3] = ((keyidx & 0x3) << 6);\ -- txpn.val = (txpn.val == 0xffffff) ? 0 : (txpn.val + 1);\ --} while (0) -- --/* Fixed the Big Endian bug when doing the Tx. -- * The Linksys WRH54G will check this. -- */ --#define TKIP_IV(pattrib_iv, txpn, keyidx)\ --do { \ -- pattrib_iv[0] = txpn._byte_.TSC1;\ -- pattrib_iv[1] = (txpn._byte_.TSC1 | 0x20) & 0x7f;\ -- pattrib_iv[2] = txpn._byte_.TSC0;\ -- pattrib_iv[3] = BIT(5) | ((keyidx & 0x3) << 6);\ -- pattrib_iv[4] = txpn._byte_.TSC2;\ -- pattrib_iv[5] = txpn._byte_.TSC3;\ -- pattrib_iv[6] = txpn._byte_.TSC4;\ -- pattrib_iv[7] = txpn._byte_.TSC5;\ -- txpn.val = txpn.val == 0xffffffffffffULL ? 0 : \ -- (txpn.val + 1);\ --} while (0) -- --#define AES_IV(pattrib_iv, txpn, keyidx)\ --do { \ -- pattrib_iv[0] = txpn._byte_.TSC0;\ -- pattrib_iv[1] = txpn._byte_.TSC1;\ -- pattrib_iv[2] = 0;\ -- pattrib_iv[3] = BIT(5) | ((keyidx & 0x3) << 6);\ -- pattrib_iv[4] = txpn._byte_.TSC2;\ -- pattrib_iv[5] = txpn._byte_.TSC3;\ -- pattrib_iv[6] = txpn._byte_.TSC4;\ -- pattrib_iv[7] = txpn._byte_.TSC5;\ -- txpn.val = txpn.val == 0xffffffffffffULL ? 0 : \ -- (txpn.val + 1);\ --} while (0) -- --struct hw_xmit { -- spinlock_t xmit_lock; -- struct list_head pending; -- struct __queue *sta_queue; -- struct hw_txqueue *phwtxqueue; -- sint txcmdcnt; -- int accnt; --}; -- --struct pkt_attrib { -- u8 type; -- u8 subtype; -- u8 bswenc; -- u8 dhcp_pkt; -- -- u16 seqnum; -- u16 ether_type; -- u16 pktlen; /* the original 802.3 pkt raw_data len -- * (not include ether_hdr data) -- */ -- u16 last_txcmdsz; -- -- u8 pkt_hdrlen; /*the original 802.3 pkt header len*/ -- u8 hdrlen; /*the WLAN Header Len*/ -- u8 nr_frags; -- u8 ack_policy; -- u8 mac_id; -- u8 vcs_mode; /*virtual carrier sense method*/ -- u8 pctrl;/*per packet txdesc control enable*/ -- u8 qsel; -- -- u8 priority; -- u8 encrypt; /* when 0 indicate no encrypt. when non-zero, -- * indicate the encrypt algorithm -- */ -- u8 iv_len; -- u8 icv_len; -- unsigned char iv[8]; -- unsigned char icv[8]; -- u8 dst[ETH_ALEN] __aligned(2); /* for ether_addr_copy */ -- u8 src[ETH_ALEN]; -- u8 ta[ETH_ALEN]; -- u8 ra[ETH_ALEN]; -- struct sta_info *psta; --}; -- --#define WLANHDR_OFFSET 64 --#define DATA_FRAMETAG 0x01 --#define L2_FRAMETAG 0x02 --#define MGNT_FRAMETAG 0x03 --#define AMSDU_FRAMETAG 0x04 --#define EII_FRAMETAG 0x05 --#define IEEE8023_FRAMETAG 0x06 --#define MP_FRAMETAG 0x07 --#define TXAGG_FRAMETAG 0x08 -- --struct xmit_buf { -- struct list_head list; -- -- u8 *pallocated_buf; -- u8 *pbuf; -- void *priv_data; -- struct urb *pxmit_urb[8]; -- u32 aggr_nr; --}; -- --struct xmit_frame { -- struct list_head list; -- struct pkt_attrib attrib; -- _pkt *pkt; -- int frame_tag; -- struct _adapter *padapter; -- u8 *buf_addr; -- struct xmit_buf *pxmitbuf; -- u8 *mem_addr; -- u16 sz[8]; -- struct urb *pxmit_urb[8]; -- u8 bpending[8]; -- u8 last[8]; --}; -- --struct tx_servq { -- struct list_head tx_pending; -- struct __queue sta_pending; -- int qcnt; --}; -- --struct sta_xmit_priv { -- spinlock_t lock; -- sint option; -- sint apsd_setting; /* When bit mask is on, the associated edca -- * queue supports APSD. -- */ -- struct tx_servq be_q; /* priority == 0,3 */ -- struct tx_servq bk_q; /* priority == 1,2*/ -- struct tx_servq vi_q; /*priority == 4,5*/ -- struct tx_servq vo_q; /*priority == 6,7*/ -- struct list_head legacy_dz; -- struct list_head apsd; -- u16 txseq_tid[16]; -- uint sta_tx_bytes; -- u64 sta_tx_pkts; -- uint sta_tx_fail; --}; -- --struct hw_txqueue { -- sint head; -- sint tail; -- sint free_sz; /* in units of 64 bytes */ -- sint free_cmdsz; -- sint txsz[8]; -- uint ff_hwaddr; -- uint cmd_hwaddr; -- sint ac_tag; --}; -- --struct xmit_priv { -- spinlock_t lock; -- struct __queue be_pending; -- struct __queue bk_pending; -- struct __queue vi_pending; -- struct __queue vo_pending; -- struct __queue bm_pending; -- struct __queue legacy_dz_queue; -- struct __queue apsd_queue; -- u8 *pallocated_frame_buf; -- u8 *pxmit_frame_buf; -- uint free_xmitframe_cnt; -- uint mapping_addr; -- uint pkt_sz; -- struct __queue free_xmit_queue; -- struct hw_txqueue be_txqueue; -- struct hw_txqueue bk_txqueue; -- struct hw_txqueue vi_txqueue; -- struct hw_txqueue vo_txqueue; -- struct hw_txqueue bmc_txqueue; -- uint frag_len; -- struct _adapter *adapter; -- u8 vcs_setting; -- u8 vcs; -- u8 vcs_type; -- u16 rts_thresh; -- uint tx_bytes; -- u64 tx_pkts; -- uint tx_drop; -- struct hw_xmit *hwxmits; -- u8 hwxmit_entry; -- u8 txirp_cnt; -- struct tasklet_struct xmit_tasklet; -- struct work_struct xmit_pipe4_reset_wi; -- struct work_struct xmit_pipe6_reset_wi; -- struct work_struct xmit_piped_reset_wi; -- /*per AC pending irp*/ -- int beq_cnt; -- int bkq_cnt; -- int viq_cnt; -- int voq_cnt; -- struct __queue free_amsdu_xmit_queue; -- u8 *pallocated_amsdu_frame_buf; -- u8 *pxmit_amsdu_frame_buf; -- uint free_amsdu_xmitframe_cnt; -- struct __queue free_txagg_xmit_queue; -- u8 *pallocated_txagg_frame_buf; -- u8 *pxmit_txagg_frame_buf; -- uint free_txagg_xmitframe_cnt; -- int cmdseq; -- struct __queue free_xmitbuf_queue; -- struct __queue pending_xmitbuf_queue; -- u8 *pallocated_xmitbuf; -- u8 *pxmitbuf; -- uint free_xmitbuf_cnt; --}; -- --void r8712_free_xmitbuf(struct xmit_priv *pxmitpriv, -- struct xmit_buf *pxmitbuf); --struct xmit_buf *r8712_alloc_xmitbuf(struct xmit_priv *pxmitpriv); --void r8712_update_protection(struct _adapter *padapter, u8 *ie, uint ie_len); --struct xmit_frame *r8712_alloc_xmitframe(struct xmit_priv *pxmitpriv); --void r8712_free_xmitframe(struct xmit_priv *pxmitpriv, -- struct xmit_frame *pxmitframe); --void r8712_free_xmitframe_queue(struct xmit_priv *pxmitpriv, -- struct __queue *pframequeue); --int r8712_xmit_classifier(struct _adapter *padapter, -- struct xmit_frame *pxmitframe); --sint r8712_xmitframe_coalesce(struct _adapter *padapter, _pkt *pkt, -- struct xmit_frame *pxmitframe); --sint _r8712_init_hw_txqueue(struct hw_txqueue *phw_txqueue, u8 ac_tag); --void _r8712_init_sta_xmit_priv(struct sta_xmit_priv *psta_xmitpriv); --int r8712_update_attrib(struct _adapter *padapter, _pkt *pkt, -- struct pkt_attrib *pattrib); --int r8712_txframes_sta_ac_pending(struct _adapter *padapter, -- struct pkt_attrib *pattrib); --int _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv, -- struct _adapter *padapter); --void _free_xmit_priv(struct xmit_priv *pxmitpriv); --void r8712_free_xmitframe_ex(struct xmit_priv *pxmitpriv, -- struct xmit_frame *pxmitframe); --int r8712_pre_xmit(struct _adapter *padapter, struct xmit_frame *pxmitframe); --int r8712_xmit_enqueue(struct _adapter *padapter, -- struct xmit_frame *pxmitframe); --void r8712_xmit_direct(struct _adapter *padapter, struct xmit_frame *pxmitframe); --void r8712_xmit_bh(struct tasklet_struct *t); -- --void xmitframe_xmitbuf_attach(struct xmit_frame *pxmitframe, -- struct xmit_buf *pxmitbuf); -- --#include "rtl8712_xmit.h" -- --#endif /*_RTL871X_XMIT_H_*/ -- -diff --git a/drivers/staging/rtl8712/sta_info.h b/drivers/staging/rtl8712/sta_info.h -deleted file mode 100644 -index 6286c622475e59..00000000000000 ---- a/drivers/staging/rtl8712/sta_info.h -+++ /dev/null -@@ -1,132 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __STA_INFO_H_ --#define __STA_INFO_H_ -- --#include "osdep_service.h" --#include "drv_types.h" --#include "wifi.h" -- --#define NUM_STA 32 --#define NUM_ACL 64 -- --/* if mode ==0, then the sta is allowed once the addr is hit. -- * if mode ==1, then the sta is rejected once the addr is non-hit. -- */ --struct wlan_acl_node { -- struct list_head list; -- u8 addr[ETH_ALEN]; -- u8 mode; --}; -- --struct wlan_acl_pool { -- struct wlan_acl_node aclnode[NUM_ACL]; --}; -- --struct stainfo_stats { -- uint rx_pkts; -- uint rx_bytes; -- u64 tx_pkts; -- uint tx_bytes; --}; -- --struct sta_info { -- spinlock_t lock; -- struct list_head list; /*free_sta_queue*/ -- struct list_head hash_list; /*sta_hash*/ -- struct sta_xmit_priv sta_xmitpriv; -- struct sta_recv_priv sta_recvpriv; -- uint state; -- uint aid; -- uint mac_id; -- uint qos_option; -- u8 hwaddr[ETH_ALEN]; -- uint ieee8021x_blocked; /*0: allowed, 1:blocked */ -- uint XPrivacy; /*aes, tkip...*/ -- union Keytype tkiptxmickey; -- union Keytype tkiprxmickey; -- union Keytype x_UncstKey; -- union pn48 txpn; /* PN48 used for Unicast xmit.*/ -- union pn48 rxpn; /* PN48 used for Unicast recv.*/ -- u8 bssrateset[16]; -- uint bssratelen; -- s32 rssi; -- s32 signal_quality; -- struct stainfo_stats sta_stats; -- /*for A-MPDU Rx reordering buffer control */ -- struct recv_reorder_ctrl recvreorder_ctrl[16]; -- struct ht_priv htpriv; -- /* Notes: -- * STA_Mode: -- * curr_network(mlme_priv/security_priv/qos/ht) -- * + sta_info: (STA & AP) CAP/INFO -- * scan_q: AP CAP/INFO -- * AP_Mode: -- * curr_network(mlme_priv/security_priv/qos/ht) : AP CAP/INFO -- * sta_info: (AP & STA) CAP/INFO -- */ -- struct list_head asoc_list; -- struct list_head auth_list; -- unsigned int expire_to; -- unsigned int auth_seq; -- unsigned int authalg; -- unsigned char chg_txt[128]; -- unsigned int tx_ra_bitmap; --}; -- --struct sta_priv { -- u8 *pallocated_stainfo_buf; -- u8 *pstainfo_buf; -- struct __queue free_sta_queue; -- spinlock_t sta_hash_lock; -- struct list_head sta_hash[NUM_STA]; -- int asoc_sta_count; -- struct __queue sleep_q; -- struct __queue wakeup_q; -- struct _adapter *padapter; -- struct list_head asoc_list; -- struct list_head auth_list; -- unsigned int auth_to; /* sec, time to expire in authenticating. */ -- unsigned int assoc_to; /* sec, time to expire before associating. */ -- unsigned int expire_to; /* sec , time to expire after associated. */ --}; -- --static inline u32 wifi_mac_hash(u8 *mac) --{ -- u32 x; -- -- x = mac[0]; -- x = (x << 2) ^ mac[1]; -- x = (x << 2) ^ mac[2]; -- x = (x << 2) ^ mac[3]; -- x = (x << 2) ^ mac[4]; -- x = (x << 2) ^ mac[5]; -- x ^= x >> 8; -- x = x & (NUM_STA - 1); -- return x; --} -- --int _r8712_init_sta_priv(struct sta_priv *pstapriv); --void _r8712_free_sta_priv(struct sta_priv *pstapriv); --struct sta_info *r8712_alloc_stainfo(struct sta_priv *pstapriv, -- u8 *hwaddr); --void r8712_free_stainfo(struct _adapter *padapter, struct sta_info *psta); --void r8712_free_all_stainfo(struct _adapter *padapter); --struct sta_info *r8712_get_stainfo(struct sta_priv *pstapriv, u8 *hwaddr); --void r8712_init_bcmc_stainfo(struct _adapter *padapter); --struct sta_info *r8712_get_bcmc_stainfo(struct _adapter *padapter); --u8 r8712_access_ctrl(struct wlan_acl_pool *pacl_list, u8 *mac_addr); -- --#endif /* _STA_INFO_H_ */ -- -diff --git a/drivers/staging/rtl8712/usb_halinit.c b/drivers/staging/rtl8712/usb_halinit.c -deleted file mode 100644 -index 313c569748e99b..00000000000000 ---- a/drivers/staging/rtl8712/usb_halinit.c -+++ /dev/null -@@ -1,307 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * usb_halinit.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _HCI_HAL_INIT_C_ -- --#include "osdep_service.h" --#include "drv_types.h" --#include "usb_ops.h" --#include "usb_osintf.h" -- --u8 r8712_usb_hal_bus_init(struct _adapter *adapter) --{ -- u8 val8 = 0; -- u8 ret = _SUCCESS; -- int PollingCnt = 20; -- struct registry_priv *registrypriv = &adapter->registrypriv; -- -- if (registrypriv->chip_version == RTL8712_FPGA) { -- val8 = 0x01; -- /* switch to 80M clock */ -- r8712_write8(adapter, SYS_CLKR, val8); -- val8 = r8712_read8(adapter, SPS1_CTRL); -- val8 = val8 | 0x01; -- /* enable VSPS12 LDO Macro block */ -- r8712_write8(adapter, SPS1_CTRL, val8); -- val8 = r8712_read8(adapter, AFE_MISC); -- val8 = val8 | 0x01; -- /* Enable AFE Macro Block's Bandgap */ -- r8712_write8(adapter, AFE_MISC, val8); -- val8 = r8712_read8(adapter, LDOA15_CTRL); -- val8 = val8 | 0x01; -- /* enable LDOA15 block */ -- r8712_write8(adapter, LDOA15_CTRL, val8); -- val8 = r8712_read8(adapter, SPS1_CTRL); -- val8 = val8 | 0x02; -- /* Enable VSPS12_SW Macro Block */ -- r8712_write8(adapter, SPS1_CTRL, val8); -- val8 = r8712_read8(adapter, AFE_MISC); -- val8 = val8 | 0x02; -- /* Enable AFE Macro Block's Mbias */ -- r8712_write8(adapter, AFE_MISC, val8); -- val8 = r8712_read8(adapter, SYS_ISO_CTRL + 1); -- val8 = val8 | 0x08; -- /* isolate PCIe Analog 1.2V to PCIe 3.3V and PCIE Digital */ -- r8712_write8(adapter, SYS_ISO_CTRL + 1, val8); -- val8 = r8712_read8(adapter, SYS_ISO_CTRL + 1); -- val8 = val8 & 0xEF; -- /* attach AFE PLL to MACTOP/BB/PCIe Digital */ -- r8712_write8(adapter, SYS_ISO_CTRL + 1, val8); -- val8 = r8712_read8(adapter, AFE_XTAL_CTRL + 1); -- val8 = val8 & 0xFB; -- /* enable AFE clock */ -- r8712_write8(adapter, AFE_XTAL_CTRL + 1, val8); -- val8 = r8712_read8(adapter, AFE_PLL_CTRL); -- val8 = val8 | 0x01; -- /* Enable AFE PLL Macro Block */ -- r8712_write8(adapter, AFE_PLL_CTRL, val8); -- val8 = 0xEE; -- /* release isolation AFE PLL & MD */ -- r8712_write8(adapter, SYS_ISO_CTRL, val8); -- val8 = r8712_read8(adapter, SYS_CLKR + 1); -- val8 = val8 | 0x08; -- /* enable MAC clock */ -- r8712_write8(adapter, SYS_CLKR + 1, val8); -- val8 = r8712_read8(adapter, SYS_FUNC_EN + 1); -- val8 = val8 | 0x08; -- /* enable Core digital and enable IOREG R/W */ -- r8712_write8(adapter, SYS_FUNC_EN + 1, val8); -- val8 = val8 | 0x80; -- /* enable REG_EN */ -- r8712_write8(adapter, SYS_FUNC_EN + 1, val8); -- val8 = r8712_read8(adapter, SYS_CLKR + 1); -- val8 = (val8 | 0x80) & 0xBF; -- /* switch the control path */ -- r8712_write8(adapter, SYS_CLKR + 1, val8); -- val8 = 0xFC; -- r8712_write8(adapter, CR, val8); -- val8 = 0x37; -- r8712_write8(adapter, CR + 1, val8); -- /* reduce EndPoint & init it */ -- r8712_write8(adapter, 0x102500ab, r8712_read8(adapter, -- 0x102500ab) | BIT(6) | BIT(7)); -- /* consideration of power consumption - init */ -- r8712_write8(adapter, 0x10250008, r8712_read8(adapter, -- 0x10250008) & 0xfffffffb); -- } else if (registrypriv->chip_version == RTL8712_1stCUT) { -- /* Initialization for power on sequence, */ -- r8712_write8(adapter, SPS0_CTRL + 1, 0x53); -- r8712_write8(adapter, SPS0_CTRL, 0x57); -- /* Enable AFE Macro Block's Bandgap and Enable AFE Macro -- * Block's Mbias -- */ -- val8 = r8712_read8(adapter, AFE_MISC); -- r8712_write8(adapter, AFE_MISC, (val8 | AFE_MISC_BGEN | -- AFE_MISC_MBEN)); -- /* Enable LDOA15 block */ -- val8 = r8712_read8(adapter, LDOA15_CTRL); -- r8712_write8(adapter, LDOA15_CTRL, (val8 | LDA15_EN)); -- val8 = r8712_read8(adapter, SPS1_CTRL); -- r8712_write8(adapter, SPS1_CTRL, (val8 | SPS1_LDEN)); -- msleep(20); -- /* Enable Switch Regulator Block */ -- val8 = r8712_read8(adapter, SPS1_CTRL); -- r8712_write8(adapter, SPS1_CTRL, (val8 | SPS1_SWEN)); -- r8712_write32(adapter, SPS1_CTRL, 0x00a7b267); -- val8 = r8712_read8(adapter, SYS_ISO_CTRL + 1); -- r8712_write8(adapter, SYS_ISO_CTRL + 1, (val8 | 0x08)); -- /* Engineer Packet CP test Enable */ -- val8 = r8712_read8(adapter, SYS_FUNC_EN + 1); -- r8712_write8(adapter, SYS_FUNC_EN + 1, (val8 | 0x20)); -- val8 = r8712_read8(adapter, SYS_ISO_CTRL + 1); -- r8712_write8(adapter, SYS_ISO_CTRL + 1, (val8 & 0x6F)); -- /* Enable AFE clock */ -- val8 = r8712_read8(adapter, AFE_XTAL_CTRL + 1); -- r8712_write8(adapter, AFE_XTAL_CTRL + 1, (val8 & 0xfb)); -- /* Enable AFE PLL Macro Block */ -- val8 = r8712_read8(adapter, AFE_PLL_CTRL); -- r8712_write8(adapter, AFE_PLL_CTRL, (val8 | 0x11)); -- /* Attach AFE PLL to MACTOP/BB/PCIe Digital */ -- val8 = r8712_read8(adapter, SYS_ISO_CTRL); -- r8712_write8(adapter, SYS_ISO_CTRL, (val8 & 0xEE)); -- /* Switch to 40M clock */ -- val8 = r8712_read8(adapter, SYS_CLKR); -- r8712_write8(adapter, SYS_CLKR, val8 & (~SYS_CLKSEL)); -- /* SSC Disable */ -- val8 = r8712_read8(adapter, SYS_CLKR); -- /* Enable MAC clock */ -- val8 = r8712_read8(adapter, SYS_CLKR + 1); -- r8712_write8(adapter, SYS_CLKR + 1, (val8 | 0x18)); -- /* Revised POS, */ -- r8712_write8(adapter, PMC_FSM, 0x02); -- /* Enable Core digital and enable IOREG R/W */ -- val8 = r8712_read8(adapter, SYS_FUNC_EN + 1); -- r8712_write8(adapter, SYS_FUNC_EN + 1, (val8 | 0x08)); -- /* Enable REG_EN */ -- val8 = r8712_read8(adapter, SYS_FUNC_EN + 1); -- r8712_write8(adapter, SYS_FUNC_EN + 1, (val8 | 0x80)); -- /* Switch the control path to FW */ -- val8 = r8712_read8(adapter, SYS_CLKR + 1); -- r8712_write8(adapter, SYS_CLKR + 1, (val8 | 0x80) & 0xBF); -- r8712_write8(adapter, CR, 0xFC); -- r8712_write8(adapter, CR + 1, 0x37); -- /* Fix the RX FIFO issue(usb error), */ -- val8 = r8712_read8(adapter, 0x1025FE5c); -- r8712_write8(adapter, 0x1025FE5c, (val8 | BIT(7))); -- val8 = r8712_read8(adapter, 0x102500ab); -- r8712_write8(adapter, 0x102500ab, (val8 | BIT(6) | BIT(7))); -- /* For power save, used this in the bit file after 970621 */ -- val8 = r8712_read8(adapter, SYS_CLKR); -- r8712_write8(adapter, SYS_CLKR, val8 & (~CPU_CLKSEL)); -- } else if (registrypriv->chip_version == RTL8712_2ndCUT || -- registrypriv->chip_version == RTL8712_3rdCUT) { -- /* Initialization for power on sequence, -- * E-Fuse leakage prevention sequence -- */ -- r8712_write8(adapter, 0x37, 0xb0); -- msleep(20); -- r8712_write8(adapter, 0x37, 0x30); -- /* Set control path switch to HW control and reset Digital Core, -- * CPU Core and MAC I/O to solve FW download fail when system -- * from resume sate. -- */ -- val8 = r8712_read8(adapter, SYS_CLKR + 1); -- if (val8 & 0x80) { -- val8 &= 0x3f; -- r8712_write8(adapter, SYS_CLKR + 1, val8); -- } -- val8 = r8712_read8(adapter, SYS_FUNC_EN + 1); -- val8 &= 0x73; -- r8712_write8(adapter, SYS_FUNC_EN + 1, val8); -- msleep(20); -- /* Revised POS, */ -- /* Enable AFE Macro Block's Bandgap and Enable AFE Macro -- * Block's Mbias -- */ -- r8712_write8(adapter, SPS0_CTRL + 1, 0x53); -- r8712_write8(adapter, SPS0_CTRL, 0x57); -- val8 = r8712_read8(adapter, AFE_MISC); -- /*Bandgap*/ -- r8712_write8(adapter, AFE_MISC, (val8 | AFE_MISC_BGEN)); -- r8712_write8(adapter, AFE_MISC, (val8 | AFE_MISC_BGEN | -- AFE_MISC_MBEN | AFE_MISC_I32_EN)); -- /* Enable PLL Power (LDOA15V) */ -- val8 = r8712_read8(adapter, LDOA15_CTRL); -- r8712_write8(adapter, LDOA15_CTRL, (val8 | LDA15_EN)); -- /* Enable LDOV12D block */ -- val8 = r8712_read8(adapter, LDOV12D_CTRL); -- r8712_write8(adapter, LDOV12D_CTRL, (val8 | LDV12_EN)); -- val8 = r8712_read8(adapter, SYS_ISO_CTRL + 1); -- r8712_write8(adapter, SYS_ISO_CTRL + 1, (val8 | 0x08)); -- /* Engineer Packet CP test Enable */ -- val8 = r8712_read8(adapter, SYS_FUNC_EN + 1); -- r8712_write8(adapter, SYS_FUNC_EN + 1, (val8 | 0x20)); -- /* Support 64k IMEM */ -- val8 = r8712_read8(adapter, SYS_ISO_CTRL + 1); -- r8712_write8(adapter, SYS_ISO_CTRL + 1, (val8 & 0x68)); -- /* Enable AFE clock */ -- val8 = r8712_read8(adapter, AFE_XTAL_CTRL + 1); -- r8712_write8(adapter, AFE_XTAL_CTRL + 1, (val8 & 0xfb)); -- /* Enable AFE PLL Macro Block */ -- val8 = r8712_read8(adapter, AFE_PLL_CTRL); -- r8712_write8(adapter, AFE_PLL_CTRL, (val8 | 0x11)); -- /* Some sample will download fw failure. The clock will be -- * stable with 500 us delay after reset the PLL -- * TODO: When usleep is added to kernel, change next 3 -- * udelay(500) to usleep(500) -- */ -- udelay(500); -- r8712_write8(adapter, AFE_PLL_CTRL, (val8 | 0x51)); -- udelay(500); -- r8712_write8(adapter, AFE_PLL_CTRL, (val8 | 0x11)); -- udelay(500); -- /* Attach AFE PLL to MACTOP/BB/PCIe Digital */ -- val8 = r8712_read8(adapter, SYS_ISO_CTRL); -- r8712_write8(adapter, SYS_ISO_CTRL, (val8 & 0xEE)); -- /* Switch to 40M clock */ -- r8712_write8(adapter, SYS_CLKR, 0x00); -- /* CPU Clock and 80M Clock SSC Disable to overcome FW download -- * fail timing issue. -- */ -- val8 = r8712_read8(adapter, SYS_CLKR); -- r8712_write8(adapter, SYS_CLKR, (val8 | 0xa0)); -- /* Enable MAC clock */ -- val8 = r8712_read8(adapter, SYS_CLKR + 1); -- r8712_write8(adapter, SYS_CLKR + 1, (val8 | 0x18)); -- /* Revised POS, */ -- r8712_write8(adapter, PMC_FSM, 0x02); -- /* Enable Core digital and enable IOREG R/W */ -- val8 = r8712_read8(adapter, SYS_FUNC_EN + 1); -- r8712_write8(adapter, SYS_FUNC_EN + 1, (val8 | 0x08)); -- /* Enable REG_EN */ -- val8 = r8712_read8(adapter, SYS_FUNC_EN + 1); -- r8712_write8(adapter, SYS_FUNC_EN + 1, (val8 | 0x80)); -- /* Switch the control path to FW */ -- val8 = r8712_read8(adapter, SYS_CLKR + 1); -- r8712_write8(adapter, SYS_CLKR + 1, (val8 | 0x80) & 0xBF); -- r8712_write8(adapter, CR, 0xFC); -- r8712_write8(adapter, CR + 1, 0x37); -- /* Fix the RX FIFO issue(usb error), 970410 */ -- val8 = r8712_read8(adapter, 0x1025FE5c); -- r8712_write8(adapter, 0x1025FE5c, (val8 | BIT(7))); -- /* For power save, used this in the bit file after 970621 */ -- val8 = r8712_read8(adapter, SYS_CLKR); -- r8712_write8(adapter, SYS_CLKR, val8 & (~CPU_CLKSEL)); -- /* Revised for 8051 ROM code wrong operation. */ -- r8712_write8(adapter, 0x1025fe1c, 0x80); -- /* To make sure that TxDMA can ready to download FW. -- * We should reset TxDMA if IMEM RPT was not ready. -- */ -- do { -- val8 = r8712_read8(adapter, TCR); -- if ((val8 & _TXDMA_INIT_VALUE) == _TXDMA_INIT_VALUE) -- break; -- udelay(5); /* PlatformStallExecution(5); */ -- } while (PollingCnt--); /* Delay 1ms */ -- -- if (PollingCnt <= 0) { -- val8 = r8712_read8(adapter, CR); -- r8712_write8(adapter, CR, val8 & (~_TXDMA_EN)); -- udelay(2); /* PlatformStallExecution(2); */ -- /* Reset TxDMA */ -- r8712_write8(adapter, CR, val8 | _TXDMA_EN); -- } -- } else { -- ret = _FAIL; -- } -- return ret; --} -- --unsigned int r8712_usb_inirp_init(struct _adapter *adapter) --{ -- u8 i; -- struct recv_buf *recvbuf; -- struct intf_hdl *intfhdl = &adapter->pio_queue->intf; -- struct recv_priv *recvpriv = &(adapter->recvpriv); -- -- recvpriv->ff_hwaddr = RTL8712_DMA_RX0FF; /* mapping rx fifo address */ -- /* issue Rx irp to receive data */ -- recvbuf = (struct recv_buf *)recvpriv->precv_buf; -- for (i = 0; i < NR_RECVBUFF; i++) { -- if (r8712_usb_read_port(intfhdl, recvpriv->ff_hwaddr, 0, -- (unsigned char *)recvbuf) == false) -- return _FAIL; -- recvbuf++; -- recvpriv->free_recv_buf_queue_cnt--; -- } -- return _SUCCESS; --} -- --unsigned int r8712_usb_inirp_deinit(struct _adapter *adapter) --{ -- r8712_usb_read_port_cancel(adapter); -- return _SUCCESS; --} -diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c -deleted file mode 100644 -index df05213f922f45..00000000000000 ---- a/drivers/staging/rtl8712/usb_intf.c -+++ /dev/null -@@ -1,638 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * usb_intf.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _HCI_INTF_C_ -- --#include --#include --#include -- --#include "osdep_service.h" --#include "drv_types.h" --#include "recv_osdep.h" --#include "xmit_osdep.h" --#include "rtl8712_efuse.h" --#include "usb_ops.h" --#include "usb_osintf.h" -- --static struct usb_interface *pintf; -- --static int r871xu_drv_init(struct usb_interface *pusb_intf, -- const struct usb_device_id *pdid); -- --static void r871xu_dev_remove(struct usb_interface *pusb_intf); -- --static const struct usb_device_id rtl871x_usb_id_tbl[] = { --/* RTL8188SU */ -- /* Realtek */ -- {USB_DEVICE(0x0BDA, 0x8171)}, -- {USB_DEVICE(0x0bda, 0x8173)}, -- {USB_DEVICE(0x0bda, 0x8712)}, -- {USB_DEVICE(0x0bda, 0x8713)}, -- {USB_DEVICE(0x0bda, 0xC512)}, -- /* Abocom */ -- {USB_DEVICE(0x07B8, 0x8188)}, -- /* ASUS */ -- {USB_DEVICE(0x0B05, 0x1786)}, -- {USB_DEVICE(0x0B05, 0x1791)}, /* 11n mode disable */ -- /* Belkin */ -- {USB_DEVICE(0x050D, 0x945A)}, -- /* ISY IWL - Belkin clone */ -- {USB_DEVICE(0x050D, 0x11F1)}, -- /* Corega */ -- {USB_DEVICE(0x07AA, 0x0047)}, -- /* D-Link */ -- {USB_DEVICE(0x2001, 0x3306)}, -- {USB_DEVICE(0x07D1, 0x3306)}, /* 11n mode disable */ -- /* Edimax */ -- {USB_DEVICE(0x7392, 0x7611)}, -- /* EnGenius */ -- {USB_DEVICE(0x1740, 0x9603)}, -- /* Hawking */ -- {USB_DEVICE(0x0E66, 0x0016)}, -- /* Hercules */ -- {USB_DEVICE(0x06F8, 0xE034)}, -- {USB_DEVICE(0x06F8, 0xE032)}, -- /* Logitec */ -- {USB_DEVICE(0x0789, 0x0167)}, -- /* PCI */ -- {USB_DEVICE(0x2019, 0xAB28)}, -- {USB_DEVICE(0x2019, 0xED16)}, -- /* Sitecom */ -- {USB_DEVICE(0x0DF6, 0x0057)}, -- {USB_DEVICE(0x0DF6, 0x0045)}, -- {USB_DEVICE(0x0DF6, 0x0059)}, /* 11n mode disable */ -- {USB_DEVICE(0x0DF6, 0x004B)}, -- {USB_DEVICE(0x0DF6, 0x005B)}, -- {USB_DEVICE(0x0DF6, 0x005D)}, -- {USB_DEVICE(0x0DF6, 0x0063)}, -- /* Sweex */ -- {USB_DEVICE(0x177F, 0x0154)}, -- /* Thinkware */ -- {USB_DEVICE(0x0BDA, 0x5077)}, -- /* Toshiba */ -- {USB_DEVICE(0x1690, 0x0752)}, -- /* - */ -- {USB_DEVICE(0x20F4, 0x646B)}, -- {USB_DEVICE(0x083A, 0xC512)}, -- {USB_DEVICE(0x25D4, 0x4CA1)}, -- {USB_DEVICE(0x25D4, 0x4CAB)}, -- --/* RTL8191SU */ -- /* Realtek */ -- {USB_DEVICE(0x0BDA, 0x8172)}, -- {USB_DEVICE(0x0BDA, 0x8192)}, -- /* Amigo */ -- {USB_DEVICE(0x0EB0, 0x9061)}, -- /* ASUS/EKB */ -- {USB_DEVICE(0x13D3, 0x3323)}, -- {USB_DEVICE(0x13D3, 0x3311)}, /* 11n mode disable */ -- {USB_DEVICE(0x13D3, 0x3342)}, -- /* ASUS/EKBLenovo */ -- {USB_DEVICE(0x13D3, 0x3333)}, -- {USB_DEVICE(0x13D3, 0x3334)}, -- {USB_DEVICE(0x13D3, 0x3335)}, /* 11n mode disable */ -- {USB_DEVICE(0x13D3, 0x3336)}, /* 11n mode disable */ -- /* ASUS/Media BOX */ -- {USB_DEVICE(0x13D3, 0x3309)}, -- /* Belkin */ -- {USB_DEVICE(0x050D, 0x815F)}, -- /* D-Link */ -- {USB_DEVICE(0x07D1, 0x3302)}, -- {USB_DEVICE(0x07D1, 0x3300)}, -- {USB_DEVICE(0x07D1, 0x3303)}, -- /* Edimax */ -- {USB_DEVICE(0x7392, 0x7612)}, -- /* EnGenius */ -- {USB_DEVICE(0x1740, 0x9605)}, -- /* Guillemot */ -- {USB_DEVICE(0x06F8, 0xE031)}, -- /* Hawking */ -- {USB_DEVICE(0x0E66, 0x0015)}, -- /* Mediao */ -- {USB_DEVICE(0x13D3, 0x3306)}, -- /* PCI */ -- {USB_DEVICE(0x2019, 0xED18)}, -- {USB_DEVICE(0x2019, 0x4901)}, -- /* Sitecom */ -- {USB_DEVICE(0x0DF6, 0x0058)}, -- {USB_DEVICE(0x0DF6, 0x0049)}, -- {USB_DEVICE(0x0DF6, 0x004C)}, -- {USB_DEVICE(0x0DF6, 0x006C)}, -- {USB_DEVICE(0x0DF6, 0x0064)}, -- /* Skyworth */ -- {USB_DEVICE(0x14b2, 0x3300)}, -- {USB_DEVICE(0x14b2, 0x3301)}, -- {USB_DEVICE(0x14B2, 0x3302)}, -- /* - */ -- {USB_DEVICE(0x04F2, 0xAFF2)}, -- {USB_DEVICE(0x04F2, 0xAFF5)}, -- {USB_DEVICE(0x04F2, 0xAFF6)}, -- {USB_DEVICE(0x13D3, 0x3339)}, -- {USB_DEVICE(0x13D3, 0x3340)}, /* 11n mode disable */ -- {USB_DEVICE(0x13D3, 0x3341)}, /* 11n mode disable */ -- {USB_DEVICE(0x13D3, 0x3310)}, -- {USB_DEVICE(0x13D3, 0x3325)}, -- --/* RTL8192SU */ -- /* Realtek */ -- {USB_DEVICE(0x0BDA, 0x8174)}, -- /* Belkin */ -- {USB_DEVICE(0x050D, 0x845A)}, -- /* Corega */ -- {USB_DEVICE(0x07AA, 0x0051)}, -- /* Edimax */ -- {USB_DEVICE(0x7392, 0x7622)}, -- /* NEC */ -- {USB_DEVICE(0x0409, 0x02B6)}, -- {} --}; -- --MODULE_DEVICE_TABLE(usb, rtl871x_usb_id_tbl); -- --static struct specific_device_id specific_device_id_tbl[] = { -- {.idVendor = 0x0b05, .idProduct = 0x1791, -- .flags = SPEC_DEV_ID_DISABLE_HT}, -- {.idVendor = 0x0df6, .idProduct = 0x0059, -- .flags = SPEC_DEV_ID_DISABLE_HT}, -- {.idVendor = 0x13d3, .idProduct = 0x3306, -- .flags = SPEC_DEV_ID_DISABLE_HT}, -- {.idVendor = 0x13D3, .idProduct = 0x3311, -- .flags = SPEC_DEV_ID_DISABLE_HT}, -- {.idVendor = 0x13d3, .idProduct = 0x3335, -- .flags = SPEC_DEV_ID_DISABLE_HT}, -- {.idVendor = 0x13d3, .idProduct = 0x3336, -- .flags = SPEC_DEV_ID_DISABLE_HT}, -- {.idVendor = 0x13d3, .idProduct = 0x3340, -- .flags = SPEC_DEV_ID_DISABLE_HT}, -- {.idVendor = 0x13d3, .idProduct = 0x3341, -- .flags = SPEC_DEV_ID_DISABLE_HT}, -- {} --}; -- --struct drv_priv { -- struct usb_driver r871xu_drv; -- int drv_registered; --}; -- --#ifdef CONFIG_PM --static int r871x_suspend(struct usb_interface *pusb_intf, pm_message_t state) --{ -- struct net_device *pnetdev = usb_get_intfdata(pusb_intf); -- struct _adapter *padapter = netdev_priv(pnetdev); -- -- netdev_info(pnetdev, "Suspending...\n"); -- padapter->suspended = true; -- rtl871x_intf_stop(padapter); -- if (pnetdev->netdev_ops->ndo_stop) -- pnetdev->netdev_ops->ndo_stop(pnetdev); -- mdelay(10); -- netif_device_detach(pnetdev); -- return 0; --} -- --static void rtl871x_intf_resume(struct _adapter *padapter) --{ -- if (padapter->dvobjpriv.inirp_init) -- padapter->dvobjpriv.inirp_init(padapter); --} -- --static int r871x_resume(struct usb_interface *pusb_intf) --{ -- struct net_device *pnetdev = usb_get_intfdata(pusb_intf); -- struct _adapter *padapter = netdev_priv(pnetdev); -- -- netdev_info(pnetdev, "Resuming...\n"); -- netif_device_attach(pnetdev); -- if (pnetdev->netdev_ops->ndo_open) -- pnetdev->netdev_ops->ndo_open(pnetdev); -- padapter->suspended = false; -- rtl871x_intf_resume(padapter); -- return 0; --} --#endif -- --static struct drv_priv drvpriv = { -- .r871xu_drv.name = "r8712u", -- .r871xu_drv.id_table = rtl871x_usb_id_tbl, -- .r871xu_drv.probe = r871xu_drv_init, -- .r871xu_drv.disconnect = r871xu_dev_remove, --#ifdef CONFIG_PM -- .r871xu_drv.suspend = r871x_suspend, -- .r871xu_drv.resume = r871x_resume, --#endif --}; -- --static uint r8712_usb_dvobj_init(struct _adapter *padapter) --{ -- uint status = _SUCCESS; -- struct usb_host_interface *phost_iface; -- struct usb_interface_descriptor *piface_desc; -- struct dvobj_priv *pdvobjpriv = &padapter->dvobjpriv; -- struct usb_device *pusbd = pdvobjpriv->pusbdev; -- -- pdvobjpriv->padapter = padapter; -- padapter->eeprom_address_size = 6; -- phost_iface = pintf->cur_altsetting; -- piface_desc = &phost_iface->desc; -- pdvobjpriv->nr_endpoint = piface_desc->bNumEndpoints; -- if (pusbd->speed == USB_SPEED_HIGH) { -- pdvobjpriv->ishighspeed = true; -- dev_info(&pusbd->dev, "r8712u: USB_SPEED_HIGH with %d endpoints\n", -- pdvobjpriv->nr_endpoint); -- } else { -- pdvobjpriv->ishighspeed = false; -- dev_info(&pusbd->dev, "r8712u: USB_SPEED_LOW with %d endpoints\n", -- pdvobjpriv->nr_endpoint); -- } -- if ((r8712_alloc_io_queue(padapter)) == _FAIL) -- status = _FAIL; -- return status; --} -- --static void r8712_usb_dvobj_deinit(struct _adapter *padapter) --{ -- r8712_free_io_queue(padapter); --} -- --void rtl871x_intf_stop(struct _adapter *padapter) --{ -- /*disable_hw_interrupt*/ -- if (!padapter->surprise_removed) { -- /*device still exists, so driver can do i/o operation -- * TODO: -- */ -- } -- -- /* cancel in irp */ -- if (padapter->dvobjpriv.inirp_deinit) -- padapter->dvobjpriv.inirp_deinit(padapter); -- /* cancel out irp */ -- r8712_usb_write_port_cancel(padapter); -- /* TODO:cancel other irps */ --} -- --void r871x_dev_unload(struct _adapter *padapter) --{ -- if (padapter->bup) { -- /*s1.*/ -- padapter->driver_stopped = true; -- -- /*s3.*/ -- rtl871x_intf_stop(padapter); -- -- /*s4.*/ -- r8712_stop_drv_threads(padapter); -- -- /*s5.*/ -- if (!padapter->surprise_removed) { -- padapter->hw_init_completed = false; -- rtl8712_hal_deinit(padapter); -- } -- -- padapter->bup = false; -- } --} -- --static void disable_ht_for_spec_devid(const struct usb_device_id *pdid, -- struct _adapter *padapter) --{ -- u16 vid, pid; -- u32 flags; -- int i; -- int num = ARRAY_SIZE(specific_device_id_tbl); -- -- for (i = 0; i < num; i++) { -- vid = specific_device_id_tbl[i].idVendor; -- pid = specific_device_id_tbl[i].idProduct; -- flags = specific_device_id_tbl[i].flags; -- -- if ((pdid->idVendor == vid) && (pdid->idProduct == pid) && -- (flags & SPEC_DEV_ID_DISABLE_HT)) { -- padapter->registrypriv.ht_enable = 0; -- padapter->registrypriv.cbw40_enable = 0; -- padapter->registrypriv.ampdu_enable = 0; -- } -- } --} -- --static const struct device_type wlan_type = { -- .name = "wlan", --}; -- --/* -- * drv_init() - a device potentially for us -- * -- * notes: drv_init() is called when the bus driver has located a card for us -- * to support. We accept the new device by returning 0. -- */ --static int r871xu_drv_init(struct usb_interface *pusb_intf, -- const struct usb_device_id *pdid) --{ -- uint status; -- struct _adapter *padapter = NULL; -- struct dvobj_priv *pdvobjpriv; -- struct net_device *pnetdev; -- struct usb_device *udev; -- -- /* In this probe function, O.S. will provide the usb interface pointer -- * to driver. We have to increase the reference count of the usb device -- * structure by using the usb_get_dev function. -- */ -- udev = interface_to_usbdev(pusb_intf); -- usb_get_dev(udev); -- pintf = pusb_intf; -- /* step 1. */ -- pnetdev = r8712_init_netdev(); -- if (!pnetdev) -- goto put_dev; -- padapter = netdev_priv(pnetdev); -- disable_ht_for_spec_devid(pdid, padapter); -- pdvobjpriv = &padapter->dvobjpriv; -- pdvobjpriv->padapter = padapter; -- padapter->dvobjpriv.pusbdev = udev; -- padapter->pusb_intf = pusb_intf; -- usb_set_intfdata(pusb_intf, pnetdev); -- SET_NETDEV_DEV(pnetdev, &pusb_intf->dev); -- pnetdev->dev.type = &wlan_type; -- /* step 2. */ -- padapter->dvobj_init = r8712_usb_dvobj_init; -- padapter->dvobj_deinit = r8712_usb_dvobj_deinit; -- padapter->halpriv.hal_bus_init = r8712_usb_hal_bus_init; -- padapter->dvobjpriv.inirp_init = r8712_usb_inirp_init; -- padapter->dvobjpriv.inirp_deinit = r8712_usb_inirp_deinit; -- /* step 3. -- * initialize the dvobj_priv -- */ -- -- status = padapter->dvobj_init(padapter); -- if (status != _SUCCESS) -- goto free_netdev; -- -- /* step 4. */ -- status = r8712_init_drv_sw(padapter); -- if (status) -- goto dvobj_deinit; -- /* step 5. read efuse/eeprom data and get mac_addr */ -- { -- int i, offset; -- u8 mac[6]; -- u8 tmpU1b, AutoloadFail, eeprom_CustomerID; -- u8 *pdata = padapter->eeprompriv.efuse_eeprom_data; -- -- tmpU1b = r8712_read8(padapter, EE_9346CR);/*CR9346*/ -- -- /* To check system boot selection.*/ -- dev_info(&udev->dev, "r8712u: Boot from %s: Autoload %s\n", -- (tmpU1b & _9356SEL) ? "EEPROM" : "EFUSE", -- (tmpU1b & _EEPROM_EN) ? "OK" : "Failed"); -- -- /* To check autoload success or not.*/ -- if (tmpU1b & _EEPROM_EN) { -- AutoloadFail = true; -- /* The following operations prevent Efuse leakage by -- * turning on 2.5V. -- */ -- tmpU1b = r8712_read8(padapter, EFUSE_TEST + 3); -- r8712_write8(padapter, EFUSE_TEST + 3, tmpU1b | 0x80); -- msleep(20); -- r8712_write8(padapter, EFUSE_TEST + 3, -- (tmpU1b & (~BIT(7)))); -- -- /* Retrieve Chip version. -- * Recognize IC version by Reg0x4 BIT15. -- */ -- tmpU1b = (u8)((r8712_read32(padapter, PMC_FSM) >> 15) & -- 0x1F); -- if (tmpU1b == 0x3) -- padapter->registrypriv.chip_version = -- RTL8712_3rdCUT; -- else -- padapter->registrypriv.chip_version = -- (tmpU1b >> 1) + 1; -- switch (padapter->registrypriv.chip_version) { -- case RTL8712_1stCUT: -- case RTL8712_2ndCUT: -- case RTL8712_3rdCUT: -- break; -- default: -- padapter->registrypriv.chip_version = -- RTL8712_2ndCUT; -- break; -- } -- -- for (i = 0, offset = 0; i < 128; i += 8, offset++) -- r8712_efuse_pg_packet_read(padapter, offset, -- &pdata[i]); -- -- if (!r8712_initmac || !mac_pton(r8712_initmac, mac)) { -- /* Use the mac address stored in the Efuse -- * offset = 0x12 for usb in efuse -- */ -- ether_addr_copy(mac, &pdata[0x12]); -- } -- eeprom_CustomerID = pdata[0x52]; -- switch (eeprom_CustomerID) { -- case EEPROM_CID_ALPHA: -- padapter->eeprompriv.CustomerID = -- RT_CID_819x_ALPHA; -- break; -- case EEPROM_CID_CAMEO: -- padapter->eeprompriv.CustomerID = -- RT_CID_819x_CAMEO; -- break; -- case EEPROM_CID_SITECOM: -- padapter->eeprompriv.CustomerID = -- RT_CID_819x_Sitecom; -- break; -- case EEPROM_CID_COREGA: -- padapter->eeprompriv.CustomerID = -- RT_CID_COREGA; -- break; -- case EEPROM_CID_Senao: -- padapter->eeprompriv.CustomerID = -- RT_CID_819x_Senao; -- break; -- case EEPROM_CID_EDIMAX_BELKIN: -- padapter->eeprompriv.CustomerID = -- RT_CID_819x_Edimax_Belkin; -- break; -- case EEPROM_CID_SERCOMM_BELKIN: -- padapter->eeprompriv.CustomerID = -- RT_CID_819x_Sercomm_Belkin; -- break; -- case EEPROM_CID_WNC_COREGA: -- padapter->eeprompriv.CustomerID = -- RT_CID_819x_WNC_COREGA; -- break; -- case EEPROM_CID_WHQL: -- break; -- case EEPROM_CID_NetCore: -- padapter->eeprompriv.CustomerID = -- RT_CID_819x_Netcore; -- break; -- case EEPROM_CID_CAMEO1: -- padapter->eeprompriv.CustomerID = -- RT_CID_819x_CAMEO1; -- break; -- case EEPROM_CID_CLEVO: -- padapter->eeprompriv.CustomerID = -- RT_CID_819x_CLEVO; -- break; -- default: -- padapter->eeprompriv.CustomerID = -- RT_CID_DEFAULT; -- break; -- } -- dev_info(&udev->dev, "r8712u: CustomerID = 0x%.4x\n", -- padapter->eeprompriv.CustomerID); -- /* Led mode */ -- switch (padapter->eeprompriv.CustomerID) { -- case RT_CID_DEFAULT: -- case RT_CID_819x_ALPHA: -- case RT_CID_819x_CAMEO: -- padapter->ledpriv.LedStrategy = SW_LED_MODE1; -- padapter->ledpriv.bRegUseLed = true; -- break; -- case RT_CID_819x_Sitecom: -- padapter->ledpriv.LedStrategy = SW_LED_MODE2; -- padapter->ledpriv.bRegUseLed = true; -- break; -- case RT_CID_COREGA: -- case RT_CID_819x_Senao: -- padapter->ledpriv.LedStrategy = SW_LED_MODE3; -- padapter->ledpriv.bRegUseLed = true; -- break; -- case RT_CID_819x_Edimax_Belkin: -- padapter->ledpriv.LedStrategy = SW_LED_MODE4; -- padapter->ledpriv.bRegUseLed = true; -- break; -- case RT_CID_819x_Sercomm_Belkin: -- padapter->ledpriv.LedStrategy = SW_LED_MODE5; -- padapter->ledpriv.bRegUseLed = true; -- break; -- case RT_CID_819x_WNC_COREGA: -- padapter->ledpriv.LedStrategy = SW_LED_MODE6; -- padapter->ledpriv.bRegUseLed = true; -- break; -- default: -- padapter->ledpriv.LedStrategy = SW_LED_MODE0; -- padapter->ledpriv.bRegUseLed = false; -- break; -- } -- } else { -- AutoloadFail = false; -- } -- if ((!AutoloadFail) || -- ((mac[0] == 0xff) && (mac[1] == 0xff) && -- (mac[2] == 0xff) && (mac[3] == 0xff) && -- (mac[4] == 0xff) && (mac[5] == 0xff)) || -- ((mac[0] == 0x00) && (mac[1] == 0x00) && -- (mac[2] == 0x00) && (mac[3] == 0x00) && -- (mac[4] == 0x00) && (mac[5] == 0x00))) { -- mac[0] = 0x00; -- mac[1] = 0xe0; -- mac[2] = 0x4c; -- mac[3] = 0x87; -- mac[4] = 0x00; -- mac[5] = 0x00; -- } -- if (r8712_initmac) { -- /* Make sure the user did not select a multicast -- * address by setting bit 1 of first octet. -- */ -- mac[0] &= 0xFE; -- dev_info(&udev->dev, -- "r8712u: MAC Address from user = %pM\n", mac); -- } else { -- dev_info(&udev->dev, -- "r8712u: MAC Address from efuse = %pM\n", mac); -- } -- eth_hw_addr_set(pnetdev, mac); -- } -- /* step 6. Load the firmware asynchronously */ -- if (rtl871x_load_fw(padapter)) -- goto deinit_drv_sw; -- init_completion(&padapter->rx_filter_ready); -- return 0; -- --deinit_drv_sw: -- r8712_free_drv_sw(padapter); --dvobj_deinit: -- padapter->dvobj_deinit(padapter); --free_netdev: -- free_netdev(pnetdev); --put_dev: -- usb_put_dev(udev); -- usb_set_intfdata(pusb_intf, NULL); -- return -ENODEV; --} -- --/* rmmod module & unplug(SurpriseRemoved) will call r871xu_dev_remove() -- * => how to recognize both -- */ --static void r871xu_dev_remove(struct usb_interface *pusb_intf) --{ -- struct net_device *pnetdev = usb_get_intfdata(pusb_intf); -- struct usb_device *udev = interface_to_usbdev(pusb_intf); -- struct _adapter *padapter = netdev_priv(pnetdev); -- -- /* never exit with a firmware callback pending */ -- wait_for_completion(&padapter->rtl8712_fw_ready); -- if (pnetdev->reg_state != NETREG_UNINITIALIZED) -- unregister_netdev(pnetdev); /* will call netdev_close() */ -- usb_set_intfdata(pusb_intf, NULL); -- release_firmware(padapter->fw); -- if (drvpriv.drv_registered) -- padapter->surprise_removed = true; -- r8712_flush_rwctrl_works(padapter); -- r8712_flush_led_works(padapter); -- udelay(1); -- /* Stop driver mlme relation timer */ -- r8712_stop_drv_timers(padapter); -- r871x_dev_unload(padapter); -- if (padapter->dvobj_deinit) -- padapter->dvobj_deinit(padapter); -- r8712_free_drv_sw(padapter); -- free_netdev(pnetdev); -- -- /* decrease the reference count of the usb device structure -- * when disconnect -- */ -- usb_put_dev(udev); -- -- /* If we didn't unplug usb dongle and remove/insert module, driver -- * fails on sitesurvey for the first time when device is up. -- * Reset usb port for sitesurvey fail issue. -- */ -- if (udev->state != USB_STATE_NOTATTACHED) -- usb_reset_device(udev); --} -- --static int __init r8712u_drv_entry(void) --{ -- drvpriv.drv_registered = true; -- return usb_register(&drvpriv.r871xu_drv); --} -- --static void __exit r8712u_drv_halt(void) --{ -- drvpriv.drv_registered = false; -- usb_deregister(&drvpriv.r871xu_drv); --} -- --module_init(r8712u_drv_entry); --module_exit(r8712u_drv_halt); -diff --git a/drivers/staging/rtl8712/usb_ops.c b/drivers/staging/rtl8712/usb_ops.c -deleted file mode 100644 -index af9966d03979c6..00000000000000 ---- a/drivers/staging/rtl8712/usb_ops.c -+++ /dev/null -@@ -1,195 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * usb_ops.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _HCI_OPS_C_ -- --#include "osdep_service.h" --#include "drv_types.h" --#include "osdep_intf.h" --#include "usb_ops.h" --#include "recv_osdep.h" -- --static u8 usb_read8(struct intf_hdl *intfhdl, u32 addr) --{ -- u8 request; -- u8 requesttype; -- u16 wvalue; -- u16 index; -- u16 len; -- int status; -- __le32 data = 0; -- struct intf_priv *intfpriv = intfhdl->pintfpriv; -- -- request = 0x05; -- requesttype = 0x01; /* read_in */ -- index = 0; -- wvalue = (u16)(addr & 0x0000ffff); -- len = 1; -- status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, -- &data, len, requesttype); -- if (status < 0) -- return 0; -- return (u8)(le32_to_cpu(data) & 0x0ff); --} -- --static u16 usb_read16(struct intf_hdl *intfhdl, u32 addr) --{ -- u8 request; -- u8 requesttype; -- u16 wvalue; -- u16 index; -- u16 len; -- int status; -- __le32 data = 0; -- struct intf_priv *intfpriv = intfhdl->pintfpriv; -- -- request = 0x05; -- requesttype = 0x01; /* read_in */ -- index = 0; -- wvalue = (u16)(addr & 0x0000ffff); -- len = 2; -- status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, -- &data, len, requesttype); -- if (status < 0) -- return 0; -- return (u16)(le32_to_cpu(data) & 0xffff); --} -- --static u32 usb_read32(struct intf_hdl *intfhdl, u32 addr) --{ -- u8 request; -- u8 requesttype; -- u16 wvalue; -- u16 index; -- u16 len; -- int status; -- __le32 data = 0; -- struct intf_priv *intfpriv = intfhdl->pintfpriv; -- -- request = 0x05; -- requesttype = 0x01; /* read_in */ -- index = 0; -- wvalue = (u16)(addr & 0x0000ffff); -- len = 4; -- status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, -- &data, len, requesttype); -- if (status < 0) -- return 0; -- return le32_to_cpu(data); --} -- --static void usb_write8(struct intf_hdl *intfhdl, u32 addr, u8 val) --{ -- u8 request; -- u8 requesttype; -- u16 wvalue; -- u16 index; -- u16 len; -- __le32 data; -- struct intf_priv *intfpriv = intfhdl->pintfpriv; -- -- request = 0x05; -- requesttype = 0x00; /* write_out */ -- index = 0; -- wvalue = (u16)(addr & 0x0000ffff); -- len = 1; -- data = cpu_to_le32((u32)val & 0x000000ff); -- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len, -- requesttype); --} -- --static void usb_write16(struct intf_hdl *intfhdl, u32 addr, u16 val) --{ -- u8 request; -- u8 requesttype; -- u16 wvalue; -- u16 index; -- u16 len; -- __le32 data; -- struct intf_priv *intfpriv = intfhdl->pintfpriv; -- -- request = 0x05; -- requesttype = 0x00; /* write_out */ -- index = 0; -- wvalue = (u16)(addr & 0x0000ffff); -- len = 2; -- data = cpu_to_le32((u32)val & 0x0000ffff); -- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len, -- requesttype); --} -- --static void usb_write32(struct intf_hdl *intfhdl, u32 addr, u32 val) --{ -- u8 request; -- u8 requesttype; -- u16 wvalue; -- u16 index; -- u16 len; -- __le32 data; -- struct intf_priv *intfpriv = intfhdl->pintfpriv; -- -- request = 0x05; -- requesttype = 0x00; /* write_out */ -- index = 0; -- wvalue = (u16)(addr & 0x0000ffff); -- len = 4; -- data = cpu_to_le32(val); -- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len, -- requesttype); --} -- --void r8712_usb_set_intf_option(u32 *option) --{ -- *option = ((*option) | _INTF_ASYNC_); --} -- --static void usb_intf_hdl_init(u8 *priv) --{ --} -- --static void usb_intf_hdl_unload(u8 *priv) --{ --} -- --static void usb_intf_hdl_open(u8 *priv) --{ --} -- --static void usb_intf_hdl_close(u8 *priv) --{ --} -- --void r8712_usb_set_intf_funs(struct intf_hdl *intfhdl) --{ -- intfhdl->intf_hdl_init = usb_intf_hdl_init; -- intfhdl->intf_hdl_unload = usb_intf_hdl_unload; -- intfhdl->intf_hdl_open = usb_intf_hdl_open; -- intfhdl->intf_hdl_close = usb_intf_hdl_close; --} -- --void r8712_usb_set_intf_ops(struct _io_ops *ops) --{ -- memset((u8 *)ops, 0, sizeof(struct _io_ops)); -- ops->_read8 = usb_read8; -- ops->_read16 = usb_read16; -- ops->_read32 = usb_read32; -- ops->_read_port = r8712_usb_read_port; -- ops->_write8 = usb_write8; -- ops->_write16 = usb_write16; -- ops->_write32 = usb_write32; -- ops->_write_mem = r8712_usb_write_mem; -- ops->_write_port = r8712_usb_write_port; --} -diff --git a/drivers/staging/rtl8712/usb_ops.h b/drivers/staging/rtl8712/usb_ops.h -deleted file mode 100644 -index 7a6b619b73fabe..00000000000000 ---- a/drivers/staging/rtl8712/usb_ops.h -+++ /dev/null -@@ -1,38 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __USB_OPS_H_ --#define __USB_OPS_H_ -- --#include "osdep_service.h" --#include "drv_types.h" --#include "osdep_intf.h" -- --void r8712_usb_write_mem(struct intf_hdl *pintfhdl, u32 addr, -- u32 cnt, u8 *wmem); --u32 r8712_usb_write_port(struct intf_hdl *pintfhdl, u32 addr, -- u32 cnt, u8 *wmem); --u32 r8712_usb_read_port(struct intf_hdl *pintfhdl, u32 addr, -- u32 cnt, u8 *rmem); --void r8712_usb_set_intf_option(u32 *poption); --void r8712_usb_set_intf_funs(struct intf_hdl *pintf_hdl); --uint r8712_usb_init_intf_priv(struct intf_priv *pintfpriv); --void r8712_usb_unload_intf_priv(struct intf_priv *pintfpriv); --void r8712_usb_set_intf_ops(struct _io_ops *pops); --void r8712_usb_read_port_cancel(struct _adapter *padapter); --void r8712_usb_write_port_cancel(struct _adapter *padapter); --int r8712_usbctrl_vendorreq(struct intf_priv *pintfpriv, u8 request, u16 value, -- u16 index, void *pdata, u16 len, u8 requesttype); -- --#endif -- -diff --git a/drivers/staging/rtl8712/usb_ops_linux.c b/drivers/staging/rtl8712/usb_ops_linux.c -deleted file mode 100644 -index b2181e1e2d3825..00000000000000 ---- a/drivers/staging/rtl8712/usb_ops_linux.c -+++ /dev/null -@@ -1,515 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * usb_ops_linux.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _HCI_OPS_OS_C_ -- --#include -- --#include "osdep_service.h" --#include "drv_types.h" --#include "osdep_intf.h" --#include "usb_ops.h" -- --#define RTL871X_VENQT_READ 0xc0 --#define RTL871X_VENQT_WRITE 0x40 -- --struct zero_bulkout_context { -- void *pbuf; -- void *purb; -- void *pirp; -- void *padapter; --}; -- --uint r8712_usb_init_intf_priv(struct intf_priv *pintfpriv) --{ -- pintfpriv->piorw_urb = usb_alloc_urb(0, GFP_ATOMIC); -- if (!pintfpriv->piorw_urb) -- return _FAIL; -- init_completion(&pintfpriv->io_retevt_comp); -- return _SUCCESS; --} -- --void r8712_usb_unload_intf_priv(struct intf_priv *pintfpriv) --{ -- if (pintfpriv->piorw_urb) { -- usb_kill_urb(pintfpriv->piorw_urb); -- usb_free_urb(pintfpriv->piorw_urb); -- } --} -- --static unsigned int ffaddr2pipehdl(struct dvobj_priv *pdvobj, u32 addr) --{ -- unsigned int pipe = 0; -- struct usb_device *pusbd = pdvobj->pusbdev; -- -- if (pdvobj->nr_endpoint == 11) { -- switch (addr) { -- case RTL8712_DMA_BKQ: -- pipe = usb_sndbulkpipe(pusbd, 0x07); -- break; -- case RTL8712_DMA_BEQ: -- pipe = usb_sndbulkpipe(pusbd, 0x06); -- break; -- case RTL8712_DMA_VIQ: -- pipe = usb_sndbulkpipe(pusbd, 0x05); -- break; -- case RTL8712_DMA_VOQ: -- pipe = usb_sndbulkpipe(pusbd, 0x04); -- break; -- case RTL8712_DMA_BCNQ: -- pipe = usb_sndbulkpipe(pusbd, 0x0a); -- break; -- case RTL8712_DMA_BMCQ: /* HI Queue */ -- pipe = usb_sndbulkpipe(pusbd, 0x0b); -- break; -- case RTL8712_DMA_MGTQ: -- pipe = usb_sndbulkpipe(pusbd, 0x0c); -- break; -- case RTL8712_DMA_RX0FF: -- pipe = usb_rcvbulkpipe(pusbd, 0x03); /* in */ -- break; -- case RTL8712_DMA_C2HCMD: -- pipe = usb_rcvbulkpipe(pusbd, 0x09); /* in */ -- break; -- case RTL8712_DMA_H2CCMD: -- pipe = usb_sndbulkpipe(pusbd, 0x0d); -- break; -- } -- } else if (pdvobj->nr_endpoint == 6) { -- switch (addr) { -- case RTL8712_DMA_BKQ: -- pipe = usb_sndbulkpipe(pusbd, 0x07); -- break; -- case RTL8712_DMA_BEQ: -- pipe = usb_sndbulkpipe(pusbd, 0x06); -- break; -- case RTL8712_DMA_VIQ: -- pipe = usb_sndbulkpipe(pusbd, 0x05); -- break; -- case RTL8712_DMA_VOQ: -- pipe = usb_sndbulkpipe(pusbd, 0x04); -- break; -- case RTL8712_DMA_RX0FF: -- case RTL8712_DMA_C2HCMD: -- pipe = usb_rcvbulkpipe(pusbd, 0x03); /* in */ -- break; -- case RTL8712_DMA_H2CCMD: -- case RTL8712_DMA_BCNQ: -- case RTL8712_DMA_BMCQ: -- case RTL8712_DMA_MGTQ: -- pipe = usb_sndbulkpipe(pusbd, 0x0d); -- break; -- } -- } else if (pdvobj->nr_endpoint == 4) { -- switch (addr) { -- case RTL8712_DMA_BEQ: -- pipe = usb_sndbulkpipe(pusbd, 0x06); -- break; -- case RTL8712_DMA_VOQ: -- pipe = usb_sndbulkpipe(pusbd, 0x04); -- break; -- case RTL8712_DMA_RX0FF: -- case RTL8712_DMA_C2HCMD: -- pipe = usb_rcvbulkpipe(pusbd, 0x03); /* in */ -- break; -- case RTL8712_DMA_H2CCMD: -- case RTL8712_DMA_BCNQ: -- case RTL8712_DMA_BMCQ: -- case RTL8712_DMA_MGTQ: -- pipe = usb_sndbulkpipe(pusbd, 0x0d); -- break; -- } -- } else { -- pipe = 0; -- } -- return pipe; --} -- --static void usb_write_mem_complete(struct urb *purb) --{ -- struct io_queue *pio_q = (struct io_queue *)purb->context; -- struct intf_hdl *pintf = &(pio_q->intf); -- struct intf_priv *pintfpriv = pintf->pintfpriv; -- struct _adapter *padapter = (struct _adapter *)pintf->adapter; -- -- if (purb->status != 0) { -- if (purb->status == (-ESHUTDOWN)) -- padapter->driver_stopped = true; -- else -- padapter->surprise_removed = true; -- } -- complete(&pintfpriv->io_retevt_comp); --} -- --void r8712_usb_write_mem(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem) --{ -- unsigned int pipe; -- struct _adapter *padapter = (struct _adapter *)pintfhdl->adapter; -- struct intf_priv *pintfpriv = pintfhdl->pintfpriv; -- struct io_queue *pio_queue = padapter->pio_queue; -- struct dvobj_priv *pdvobj = (struct dvobj_priv *)pintfpriv->intf_dev; -- struct usb_device *pusbd = pdvobj->pusbdev; -- struct urb *piorw_urb = pintfpriv->piorw_urb; -- -- if ((padapter->driver_stopped) || (padapter->surprise_removed) || -- (padapter->pwrctrlpriv.pnp_bstop_trx)) -- return; -- /* translate DMA FIFO addr to pipehandle */ -- pipe = ffaddr2pipehdl(pdvobj, addr); -- if (pipe == 0) -- return; -- usb_fill_bulk_urb(piorw_urb, pusbd, pipe, -- wmem, cnt, usb_write_mem_complete, -- pio_queue); -- usb_submit_urb(piorw_urb, GFP_ATOMIC); -- wait_for_completion_interruptible(&pintfpriv->io_retevt_comp); --} -- --static void r8712_usb_read_port_complete(struct urb *purb) --{ -- uint isevt; -- __le32 *pbuf; -- struct recv_buf *precvbuf = (struct recv_buf *)purb->context; -- struct _adapter *padapter = (struct _adapter *)precvbuf->adapter; -- struct recv_priv *precvpriv = &padapter->recvpriv; -- -- if (padapter->surprise_removed || padapter->driver_stopped) -- return; -- if (purb->status == 0) { /* SUCCESS */ -- if ((purb->actual_length > (MAX_RECVBUF_SZ)) || -- (purb->actual_length < RXDESC_SIZE)) { -- r8712_read_port(padapter, precvpriv->ff_hwaddr, 0, -- (unsigned char *)precvbuf); -- } else { -- _pkt *pskb = precvbuf->pskb; -- -- precvbuf->transfer_len = purb->actual_length; -- pbuf = (__le32 *)precvbuf->pbuf; -- isevt = le32_to_cpu(*(pbuf + 1)) & 0x1ff; -- if ((isevt & 0x1ff) == 0x1ff) { -- r8712_rxcmd_event_hdl(padapter, pbuf); -- skb_queue_tail(&precvpriv->rx_skb_queue, pskb); -- r8712_read_port(padapter, precvpriv->ff_hwaddr, -- 0, (unsigned char *)precvbuf); -- } else { -- skb_put(pskb, purb->actual_length); -- skb_queue_tail(&precvpriv->rx_skb_queue, pskb); -- tasklet_hi_schedule(&precvpriv->recv_tasklet); -- r8712_read_port(padapter, precvpriv->ff_hwaddr, -- 0, (unsigned char *)precvbuf); -- } -- } -- } else { -- switch (purb->status) { -- case -EINVAL: -- case -EPIPE: -- case -ENODEV: -- case -ESHUTDOWN: -- padapter->driver_stopped = true; -- break; -- case -ENOENT: -- if (!padapter->suspended) { -- padapter->driver_stopped = true; -- break; -- } -- fallthrough; -- case -EPROTO: -- r8712_read_port(padapter, precvpriv->ff_hwaddr, 0, -- (unsigned char *)precvbuf); -- break; -- case -EINPROGRESS: -- netdev_err(padapter->pnetdev, "ERROR: URB IS IN PROGRESS!\n"); -- break; -- default: -- break; -- } -- } --} -- --u32 r8712_usb_read_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *rmem) --{ -- unsigned int pipe; -- int err; -- u32 tmpaddr = 0; -- int alignment = 0; -- u32 ret = _SUCCESS; -- struct urb *purb = NULL; -- struct recv_buf *precvbuf = (struct recv_buf *)rmem; -- struct intf_priv *pintfpriv = pintfhdl->pintfpriv; -- struct dvobj_priv *pdvobj = (struct dvobj_priv *)pintfpriv->intf_dev; -- struct _adapter *adapter = pdvobj->padapter; -- struct recv_priv *precvpriv = &adapter->recvpriv; -- struct usb_device *pusbd = pdvobj->pusbdev; -- -- if (adapter->driver_stopped || adapter->surprise_removed || -- adapter->pwrctrlpriv.pnp_bstop_trx || !precvbuf) -- return _FAIL; -- r8712_init_recvbuf(adapter, precvbuf); -- /* Try to use skb from the free queue */ -- precvbuf->pskb = skb_dequeue(&precvpriv->free_recv_skb_queue); -- -- if (!precvbuf->pskb) { -- precvbuf->pskb = netdev_alloc_skb(adapter->pnetdev, -- MAX_RECVBUF_SZ + RECVBUFF_ALIGN_SZ); -- if (!precvbuf->pskb) -- return _FAIL; -- tmpaddr = (addr_t)precvbuf->pskb->data; -- alignment = tmpaddr & (RECVBUFF_ALIGN_SZ - 1); -- skb_reserve(precvbuf->pskb, -- (RECVBUFF_ALIGN_SZ - alignment)); -- precvbuf->phead = precvbuf->pskb->head; -- precvbuf->pdata = precvbuf->pskb->data; -- precvbuf->ptail = skb_tail_pointer(precvbuf->pskb); -- precvbuf->pend = skb_end_pointer(precvbuf->pskb); -- precvbuf->pbuf = precvbuf->pskb->data; -- } else { /* skb is reused */ -- precvbuf->phead = precvbuf->pskb->head; -- precvbuf->pdata = precvbuf->pskb->data; -- precvbuf->ptail = skb_tail_pointer(precvbuf->pskb); -- precvbuf->pend = skb_end_pointer(precvbuf->pskb); -- precvbuf->pbuf = precvbuf->pskb->data; -- } -- purb = precvbuf->purb; -- /* translate DMA FIFO addr to pipehandle */ -- pipe = ffaddr2pipehdl(pdvobj, addr); -- usb_fill_bulk_urb(purb, pusbd, pipe, -- precvbuf->pbuf, MAX_RECVBUF_SZ, -- r8712_usb_read_port_complete, -- precvbuf); -- err = usb_submit_urb(purb, GFP_ATOMIC); -- if ((err) && (err != (-EPERM))) -- ret = _FAIL; -- return ret; --} -- --void r8712_usb_read_port_cancel(struct _adapter *padapter) --{ -- int i; -- struct recv_buf *precvbuf; -- -- precvbuf = (struct recv_buf *)padapter->recvpriv.precv_buf; -- for (i = 0; i < NR_RECVBUFF; i++) { -- if (precvbuf->purb) -- usb_kill_urb(precvbuf->purb); -- precvbuf++; -- } --} -- --void r8712_xmit_bh(struct tasklet_struct *t) --{ -- int ret = false; -- struct _adapter *padapter = from_tasklet(padapter, t, -- xmitpriv.xmit_tasklet); -- struct xmit_priv *pxmitpriv = &padapter->xmitpriv; -- -- if (padapter->driver_stopped || -- padapter->surprise_removed) { -- netdev_err(padapter->pnetdev, "xmit_bh => driver_stopped or surprise_removed\n"); -- return; -- } -- ret = r8712_xmitframe_complete(padapter, pxmitpriv, NULL); -- if (!ret) -- return; -- tasklet_hi_schedule(&pxmitpriv->xmit_tasklet); --} -- --static void usb_write_port_complete(struct urb *purb) --{ -- int i; -- struct xmit_frame *pxmitframe = (struct xmit_frame *)purb->context; -- struct xmit_buf *pxmitbuf = pxmitframe->pxmitbuf; -- struct _adapter *padapter = pxmitframe->padapter; -- struct xmit_priv *pxmitpriv = &padapter->xmitpriv; -- struct pkt_attrib *pattrib = &pxmitframe->attrib; -- -- switch (pattrib->priority) { -- case 1: -- case 2: -- pxmitpriv->bkq_cnt--; -- break; -- case 4: -- case 5: -- pxmitpriv->viq_cnt--; -- break; -- case 6: -- case 7: -- pxmitpriv->voq_cnt--; -- break; -- case 0: -- case 3: -- default: -- pxmitpriv->beq_cnt--; -- break; -- } -- pxmitpriv->txirp_cnt--; -- for (i = 0; i < 8; i++) { -- if (purb == pxmitframe->pxmit_urb[i]) { -- pxmitframe->bpending[i] = false; -- break; -- } -- } -- if (padapter->surprise_removed) -- return; -- switch (purb->status) { -- case 0: -- break; -- default: -- netdev_warn(padapter->pnetdev, -- "r8712u: pipe error: (%d)\n", purb->status); -- break; -- } -- /* not to consider tx fragment */ -- r8712_free_xmitframe_ex(pxmitpriv, pxmitframe); -- r8712_free_xmitbuf(pxmitpriv, pxmitbuf); -- tasklet_hi_schedule(&pxmitpriv->xmit_tasklet); --} -- --u32 r8712_usb_write_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem) --{ -- unsigned long irqL; -- int i, status; -- unsigned int pipe; -- u32 ret, bwritezero; -- struct urb *purb = NULL; -- struct _adapter *padapter = (struct _adapter *)pintfhdl->adapter; -- struct dvobj_priv *pdvobj = &padapter->dvobjpriv; -- struct xmit_priv *pxmitpriv = &padapter->xmitpriv; -- struct xmit_frame *pxmitframe = (struct xmit_frame *)wmem; -- struct usb_device *pusbd = pdvobj->pusbdev; -- struct pkt_attrib *pattrib = &pxmitframe->attrib; -- -- if ((padapter->driver_stopped) || (padapter->surprise_removed) || -- (padapter->pwrctrlpriv.pnp_bstop_trx)) -- return _FAIL; -- for (i = 0; i < 8; i++) { -- if (!pxmitframe->bpending[i]) { -- spin_lock_irqsave(&pxmitpriv->lock, irqL); -- pxmitpriv->txirp_cnt++; -- pxmitframe->bpending[i] = true; -- switch (pattrib->priority) { -- case 1: -- case 2: -- pxmitpriv->bkq_cnt++; -- break; -- case 4: -- case 5: -- pxmitpriv->viq_cnt++; -- break; -- case 6: -- case 7: -- pxmitpriv->voq_cnt++; -- break; -- case 0: -- case 3: -- default: -- pxmitpriv->beq_cnt++; -- break; -- } -- spin_unlock_irqrestore(&pxmitpriv->lock, irqL); -- pxmitframe->sz[i] = (u16)cnt; -- purb = pxmitframe->pxmit_urb[i]; -- break; -- } -- } -- bwritezero = false; -- if (pdvobj->ishighspeed) { -- if (cnt > 0 && cnt % 512 == 0) -- bwritezero = true; -- } else { -- if (cnt > 0 && cnt % 64 == 0) -- bwritezero = true; -- } -- /* translate DMA FIFO addr to pipehandle */ -- pipe = ffaddr2pipehdl(pdvobj, addr); -- if (pxmitpriv->free_xmitbuf_cnt % NR_XMITBUFF == 0) -- purb->transfer_flags &= (~URB_NO_INTERRUPT); -- else -- purb->transfer_flags |= URB_NO_INTERRUPT; -- if (bwritezero) -- cnt += 8; -- usb_fill_bulk_urb(purb, pusbd, pipe, -- pxmitframe->mem_addr, -- cnt, usb_write_port_complete, -- pxmitframe); /* context is xmit_frame */ -- status = usb_submit_urb(purb, GFP_ATOMIC); -- if (!status) -- ret = _SUCCESS; -- else -- ret = _FAIL; -- return ret; --} -- --void r8712_usb_write_port_cancel(struct _adapter *padapter) --{ -- int i, j; -- struct xmit_buf *pxmitbuf = (struct xmit_buf *) -- padapter->xmitpriv.pxmitbuf; -- -- for (i = 0; i < NR_XMITBUFF; i++) { -- for (j = 0; j < 8; j++) { -- if (pxmitbuf->pxmit_urb[j]) -- usb_kill_urb(pxmitbuf->pxmit_urb[j]); -- } -- pxmitbuf++; -- } --} -- --int r8712_usbctrl_vendorreq(struct intf_priv *pintfpriv, u8 request, u16 value, -- u16 index, void *pdata, u16 len, u8 requesttype) --{ -- unsigned int pipe; -- int status; -- u8 reqtype; -- struct dvobj_priv *pdvobjpriv = (struct dvobj_priv *) -- pintfpriv->intf_dev; -- struct usb_device *udev = pdvobjpriv->pusbdev; -- /* For mstar platform, mstar suggests the address for USB IO -- * should be 16 bytes alignment. Trying to fix it here. -- */ -- u8 *palloc_buf, *pIo_buf; -- -- palloc_buf = kmalloc((u32)len + 16, GFP_ATOMIC); -- if (!palloc_buf) -- return -ENOMEM; -- pIo_buf = palloc_buf + 16 - ((addr_t)(palloc_buf) & 0x0f); -- if (requesttype == 0x01) { -- pipe = usb_rcvctrlpipe(udev, 0); /* read_in */ -- reqtype = RTL871X_VENQT_READ; -- } else { -- pipe = usb_sndctrlpipe(udev, 0); /* write_out */ -- reqtype = RTL871X_VENQT_WRITE; -- memcpy(pIo_buf, pdata, len); -- } -- status = usb_control_msg(udev, pipe, request, reqtype, value, index, -- pIo_buf, len, 500); -- if (status < 0) -- goto free; -- if (status != len) { -- status = -EREMOTEIO; -- goto free; -- } -- /* Success this control transfer. */ -- if (requesttype == 0x01) { -- /* For Control read transfer, we have to copy the read -- * data from pIo_buf to pdata. -- */ -- memcpy(pdata, pIo_buf, status); -- } -- --free: -- kfree(palloc_buf); -- return status; --} -diff --git a/drivers/staging/rtl8712/usb_osintf.h b/drivers/staging/rtl8712/usb_osintf.h -deleted file mode 100644 -index 2e512b4a564c21..00000000000000 ---- a/drivers/staging/rtl8712/usb_osintf.h -+++ /dev/null -@@ -1,35 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __USB_OSINTF_H --#define __USB_OSINTF_H -- --#include "osdep_service.h" --#include "drv_types.h" -- --extern char *r8712_initmac; -- --unsigned int r8712_usb_inirp_init(struct _adapter *padapter); --unsigned int r8712_usb_inirp_deinit(struct _adapter *padapter); --uint rtl871x_hal_init(struct _adapter *padapter); --uint rtl8712_hal_deinit(struct _adapter *padapter); -- --void rtl871x_intf_stop(struct _adapter *padapter); --void r871x_dev_unload(struct _adapter *padapter); --void r8712_stop_drv_threads(struct _adapter *padapter); --void r8712_stop_drv_timers(struct _adapter *padapter); --int r8712_init_drv_sw(struct _adapter *padapter); --void r8712_free_drv_sw(struct _adapter *padapter); --struct net_device *r8712_init_netdev(void); -- --#endif -diff --git a/drivers/staging/rtl8712/wifi.h b/drivers/staging/rtl8712/wifi.h -deleted file mode 100644 -index 498e6dec7e67f6..00000000000000 ---- a/drivers/staging/rtl8712/wifi.h -+++ /dev/null -@@ -1,196 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef _WIFI_H_ --#define _WIFI_H_ -- --#include --#include -- --#define WLAN_HDR_A3_LEN 24 --#define WLAN_HDR_A3_QOS_LEN 26 -- --enum WIFI_FRAME_TYPE { -- WIFI_QOS_DATA_TYPE = (BIT(7) | BIT(3)), /*!< QoS Data */ --}; -- --#define SetToDs(pbuf) ({ \ -- *(__le16 *)(pbuf) |= cpu_to_le16(IEEE80211_FCTL_TODS); \ --}) -- --#define GetToDs(pbuf) (((*(__le16 *)(pbuf)) & cpu_to_le16(IEEE80211_FCTL_TODS)) != 0) -- --#define ClearToDs(pbuf) ({ \ -- *(__le16 *)(pbuf) &= (~cpu_to_le16(IEEE80211_FCTL_TODS)); \ --}) -- --#define SetFrDs(pbuf) ({ \ -- *(__le16 *)(pbuf) |= cpu_to_le16(IEEE80211_FCTL_FROMDS); \ --}) -- --#define GetFrDs(pbuf) (((*(__le16 *)(pbuf)) & cpu_to_le16(IEEE80211_FCTL_FROMDS)) != 0) -- --#define ClearFrDs(pbuf) ({ \ -- *(__le16 *)(pbuf) &= (~cpu_to_le16(IEEE80211_FCTL_FROMDS)); \ --}) -- --static inline unsigned char get_tofr_ds(unsigned char *pframe) --{ -- return ((GetToDs(pframe) << 1) | GetFrDs(pframe)); --} -- --#define SetMFrag(pbuf) ({ \ -- *(__le16 *)(pbuf) |= cpu_to_le16(IEEE80211_FCTL_MOREFRAGS); \ --}) -- --#define GetMFrag(pbuf) (((*(__le16 *)(pbuf)) & cpu_to_le16(IEEE80211_FCTL_MOREFRAGS)) != 0) -- --#define ClearMFrag(pbuf) ({ \ -- *(__le16 *)(pbuf) &= (~cpu_to_le16(IEEE80211_FCTL_MOREFRAGS)); \ --}) -- --#define SetRetry(pbuf) ({ \ -- *(__le16 *)(pbuf) |= cpu_to_le16(IEEE80211_FCTL_RETRY); \ --}) -- --#define GetRetry(pbuf) (((*(__le16 *)(pbuf)) & cpu_to_le16(IEEE80211_FCTL_RETRY)) != 0) -- --#define ClearRetry(pbuf) ({ \ -- *(__le16 *)(pbuf) &= (~cpu_to_le16(IEEE80211_FCTL_RETRY)); \ --}) -- --#define SetPwrMgt(pbuf) ({ \ -- *(__le16 *)(pbuf) |= cpu_to_le16(IEEE80211_FCTL_PM); \ --}) -- --#define GetPwrMgt(pbuf) (((*(__le16 *)(pbuf)) & \ -- cpu_to_le16(IEEE80211_FCTL_PM)) != 0) -- --#define ClearPwrMgt(pbuf) ({ \ -- *(__le16 *)(pbuf) &= (~cpu_to_le16(IEEE80211_FCTL_PM)); \ --}) -- --#define SetMData(pbuf) ({ \ -- *(__le16 *)(pbuf) |= cpu_to_le16(IEEE80211_FCTL_MOREDATA); \ --}) -- --#define GetMData(pbuf) (((*(__le16 *)(pbuf)) & \ -- cpu_to_le16(IEEE80211_FCTL_MOREDATA)) != 0) -- --#define ClearMData(pbuf) ({ \ -- *(__le16 *)(pbuf) &= (~cpu_to_le16(IEEE80211_FCTL_MOREDATA)); \ --}) -- --#define SetPrivacy(pbuf) ({ \ -- *(__le16 *)(pbuf) |= cpu_to_le16(IEEE80211_FCTL_PROTECTED); \ --}) -- --#define GetPrivacy(pbuf) (((*(__le16 *)(pbuf)) & \ -- cpu_to_le16(IEEE80211_FCTL_PROTECTED)) != 0) -- --#define GetOrder(pbuf) (((*(__le16 *)(pbuf)) & \ -- cpu_to_le16(IEEE80211_FCTL_ORDER)) != 0) -- --#define GetFrameType(pbuf) (le16_to_cpu(*(__le16 *)(pbuf)) & \ -- (BIT(3) | BIT(2))) -- --#define SetFrameType(pbuf, type) \ -- do { \ -- *(__le16 *)(pbuf) &= cpu_to_le16(~(BIT(3) | \ -- BIT(2))); \ -- *(__le16 *)(pbuf) |= cpu_to_le16(type); \ -- } while (0) -- --#define GetFrameSubType(pbuf) (le16_to_cpu(*(__le16 *)(pbuf)) & \ -- (BIT(7) | BIT(6) | BIT(5) | BIT(4) | BIT(3) | \ -- BIT(2))) -- --#define SetFrameSubType(pbuf, type) \ -- do { \ -- *(__le16 *)(pbuf) &= cpu_to_le16(~(BIT(7) | BIT(6) | \ -- BIT(5) | BIT(4) | BIT(3) | BIT(2))); \ -- *(__le16 *)(pbuf) |= cpu_to_le16(type); \ -- } while (0) -- --#define GetSequence(pbuf) (le16_to_cpu(*(__le16 *)\ -- ((addr_t)(pbuf) + 22)) >> 4) -- --#define GetFragNum(pbuf) (le16_to_cpu(*(__le16 *)((addr_t)\ -- (pbuf) + 22)) & 0x0f) -- --#define SetSeqNum(pbuf, num) ({ \ -- *(__le16 *)((addr_t)(pbuf) + 22) = \ -- cpu_to_le16((le16_to_cpu(*(__le16 *)((addr_t)(pbuf) + 22)) & \ -- 0x000f) | (0xfff0 & (num << 4))); \ --}) -- --#define SetPriority(pbuf, tid) ({ \ -- *(__le16 *)(pbuf) |= cpu_to_le16(tid & 0xf); \ --}) -- --#define GetPriority(pbuf) ((le16_to_cpu(*(__le16 *)(pbuf))) & 0xf) -- --#define SetAckpolicy(pbuf, ack) ({ \ -- *(__le16 *)(pbuf) |= cpu_to_le16((ack & 3) << 5); \ --}) -- --#define GetAckpolicy(pbuf) (((le16_to_cpu(*(__le16 *)pbuf)) >> 5) & 0x3) -- --#define GetAMsdu(pbuf) (((le16_to_cpu(*(__le16 *)pbuf)) >> 7) & 0x1) -- --#define GetAddr1Ptr(pbuf) ((unsigned char *)((addr_t)(pbuf) + 4)) -- --#define GetAddr2Ptr(pbuf) ((unsigned char *)((addr_t)(pbuf) + 10)) -- --#define GetAddr3Ptr(pbuf) ((unsigned char *)((addr_t)(pbuf) + 16)) -- --#define GetAddr4Ptr(pbuf) ((unsigned char *)((addr_t)(pbuf) + 24)) -- --static inline unsigned char *get_hdr_bssid(unsigned char *pframe) --{ -- unsigned char *sa; -- unsigned int to_fr_ds = (GetToDs(pframe) << 1) | GetFrDs(pframe); -- -- switch (to_fr_ds) { -- case 0x00: /* ToDs=0, FromDs=0 */ -- sa = GetAddr3Ptr(pframe); -- break; -- case 0x01: /* ToDs=0, FromDs=1 */ -- sa = GetAddr2Ptr(pframe); -- break; -- case 0x02: /* ToDs=1, FromDs=0 */ -- sa = GetAddr1Ptr(pframe); -- break; -- default: /* ToDs=1, FromDs=1 */ -- sa = NULL; -- break; -- } -- return sa; --} -- --/* --------------------------------------------------------------------------- -- * Below is the fixed elements... -- * --------------------------------------------------------------------------- -- */ --#define _BEACON_ITERVAL_ 2 --#define _CAPABILITY_ 2 --#define _TIMESTAMP_ 8 -- --/*----------------------------------------------------------------------------- -- * Below is the definition for WMM -- *------------------------------------------------------------------------------ -- */ --#define _WMM_IE_Length_ 7 /* for WMM STA */ -- --#endif /* _WIFI_H_ */ -- -diff --git a/drivers/staging/rtl8712/wlan_bssdef.h b/drivers/staging/rtl8712/wlan_bssdef.h -deleted file mode 100644 -index ec3749813728d9..00000000000000 ---- a/drivers/staging/rtl8712/wlan_bssdef.h -+++ /dev/null -@@ -1,223 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __WLAN_BSSDEF_H__ --#define __WLAN_BSSDEF_H__ -- --#define MAX_IE_SZ 768 -- --#define NDIS_802_11_LENGTH_SSID 32 --#define NDIS_802_11_LENGTH_RATES 8 --#define NDIS_802_11_LENGTH_RATES_EX 16 -- --struct ndis_802_11_ssid { -- u32 SsidLength; -- u8 Ssid[32]; --}; -- --enum NDIS_802_11_NETWORK_TYPE { -- Ndis802_11FH, -- Ndis802_11DS, -- Ndis802_11OFDM5, -- Ndis802_11OFDM24, -- Ndis802_11NetworkTypeMax /* not a real type, defined as an upper bound*/ --}; -- --struct NDIS_802_11_CONFIGURATION_FH { -- u32 Length; /* Length of structure */ -- u32 HopPattern; /* As defined by 802.11, MSB set */ -- u32 HopSet; /* to one if non-802.11 */ -- u32 DwellTime; /* units are Kusec */ --}; -- --/* -- * FW will only save the channel number in DSConfig. -- * ODI Handler will convert the channel number to freq. number. -- */ --struct NDIS_802_11_CONFIGURATION { -- u32 Length; /* Length of structure */ -- u32 BeaconPeriod; /* units are Kusec */ -- u32 ATIMWindow; /* units are Kusec */ -- u32 DSConfig; /* Frequency, units are kHz */ -- struct NDIS_802_11_CONFIGURATION_FH FHConfig; --}; -- --enum NDIS_802_11_NETWORK_INFRASTRUCTURE { -- Ndis802_11IBSS, -- Ndis802_11Infrastructure, -- Ndis802_11AutoUnknown, -- Ndis802_11InfrastructureMax, /*Not a real value,defined as upper bound*/ -- Ndis802_11APMode --}; -- --struct NDIS_802_11_FIXED_IEs { -- u8 Timestamp[8]; -- u16 BeaconInterval; -- u16 Capabilities; --}; -- --struct wlan_bssid_ex { -- u32 Length; -- unsigned char MacAddress[6]; -- u8 Reserved[2]; -- struct ndis_802_11_ssid Ssid; -- __le32 Privacy; -- s32 Rssi; -- enum NDIS_802_11_NETWORK_TYPE NetworkTypeInUse; -- struct NDIS_802_11_CONFIGURATION Configuration; -- enum NDIS_802_11_NETWORK_INFRASTRUCTURE InfrastructureMode; -- u8 rates[NDIS_802_11_LENGTH_RATES_EX]; -- /* number of content bytes in EIs, which varies */ -- u32 IELength; -- /*(timestamp, beacon interval, and capability information) */ -- u8 IEs[MAX_IE_SZ]; --}; -- --enum NDIS_802_11_AUTHENTICATION_MODE { -- Ndis802_11AuthModeOpen, -- Ndis802_11AuthModeShared, -- Ndis802_11AuthModeAutoSwitch, -- Ndis802_11AuthModeWPA, -- Ndis802_11AuthModeWPAPSK, -- Ndis802_11AuthModeWPANone, -- Ndis802_11AuthModeMax /* Not a real mode, defined as upper bound */ --}; -- --enum { -- Ndis802_11WEPEnabled, -- Ndis802_11Encryption1Enabled = Ndis802_11WEPEnabled, -- Ndis802_11WEPDisabled, -- Ndis802_11EncryptionDisabled = Ndis802_11WEPDisabled, -- Ndis802_11WEPKeyAbsent, -- Ndis802_11Encryption1KeyAbsent = Ndis802_11WEPKeyAbsent, -- Ndis802_11WEPNotSupported, -- Ndis802_11EncryptionNotSupported = Ndis802_11WEPNotSupported, -- Ndis802_11Encryption2Enabled, -- Ndis802_11Encryption2KeyAbsent, -- Ndis802_11Encryption3Enabled, -- Ndis802_11Encryption3KeyAbsent --}; -- --#define NDIS_802_11_AI_REQFI_CAPABILITIES 1 --#define NDIS_802_11_AI_REQFI_LISTENINTERVAL 2 --#define NDIS_802_11_AI_REQFI_CURRENTAPADDRESS 4 -- --#define NDIS_802_11_AI_RESFI_CAPABILITIES 1 --#define NDIS_802_11_AI_RESFI_STATUSCODE 2 --#define NDIS_802_11_AI_RESFI_ASSOCIATIONID 4 -- --struct NDIS_802_11_AI_REQFI { -- u16 Capabilities; -- u16 ListenInterval; -- unsigned char CurrentAPAddress[6]; --}; -- --struct NDIS_802_11_AI_RESFI { -- u16 Capabilities; -- u16 StatusCode; -- u16 AssociationId; --}; -- --struct NDIS_802_11_ASSOCIATION_INFORMATION { -- u32 Length; -- u16 AvailableRequestFixedIEs; -- struct NDIS_802_11_AI_REQFI RequestFixedIEs; -- u32 RequestIELength; -- u32 OffsetRequestIEs; -- u16 AvailableResponseFixedIEs; -- struct NDIS_802_11_AI_RESFI ResponseFixedIEs; -- u32 ResponseIELength; -- u32 OffsetResponseIEs; --}; -- --/* Key mapping keys require a BSSID*/ --struct NDIS_802_11_KEY { -- u32 Length; /* Length of this structure */ -- u32 KeyIndex; -- u32 KeyLength; /* length of key in bytes */ -- unsigned char BSSID[6]; -- unsigned long long KeyRSC; -- u8 KeyMaterial[32]; /* variable length */ --}; -- --struct NDIS_802_11_REMOVE_KEY { -- u32 Length; /* Length of this structure */ -- u32 KeyIndex; -- unsigned char BSSID[6]; --}; -- --struct NDIS_802_11_WEP { -- u32 Length; /* Length of this structure */ -- u32 KeyIndex; /* 0 is the per-client key, -- * 1-N are the global keys -- */ -- u32 KeyLength; /* length of key in bytes */ -- u8 KeyMaterial[16]; /* variable length depending on above field */ --}; -- --/* mask for authentication/integrity fields */ --#define NDIS_802_11_AUTH_REQUEST_AUTH_FIELDS 0x0f --#define NDIS_802_11_AUTH_REQUEST_REAUTH 0x01 --#define NDIS_802_11_AUTH_REQUEST_KEYUPDATE 0x02 --#define NDIS_802_11_AUTH_REQUEST_PAIRWISE_ERROR 0x06 --#define NDIS_802_11_AUTH_REQUEST_GROUP_ERROR 0x0E -- --/* MIC check time, 60 seconds. */ --#define MIC_CHECK_TIME 60000000 -- --#ifndef Ndis802_11APMode --#define Ndis802_11APMode (Ndis802_11InfrastructureMax + 1) --#endif -- --struct wlan_network { -- struct list_head list; -- int network_type; /*refer to ieee80211.h for WIRELESS_11A/B/G */ -- int fixed; /* set to fixed when not to be removed asi -- * site-surveying -- */ -- unsigned int last_scanned; /*timestamp for the network */ -- int aid; /*will only be valid when a BSS is joined. */ -- int join_res; -- struct wlan_bssid_ex network; /*must be the last item */ --}; -- --enum VRTL_CARRIER_SENSE { -- DISABLE_VCS, -- ENABLE_VCS, -- AUTO_VCS --}; -- --enum VCS_TYPE { -- NONE_VCS, -- RTS_CTS, -- CTS_TO_SELF --}; -- --#define PWR_CAM 0 --#define PWR_MINPS 1 --#define PWR_MAXPS 2 --#define PWR_UAPSD 3 --#define PWR_VOIP 4 -- --enum UAPSD_MAX_SP { -- NO_LIMIT, -- TWO_MSDU, -- FOUR_MSDU, -- SIX_MSDU --}; -- --#define NUM_PRE_AUTH_KEY 16 --#define NUM_PMKID_CACHE NUM_PRE_AUTH_KEY -- --#endif /* #ifndef WLAN_BSSDEF_H_ */ -- -diff --git a/drivers/staging/rtl8712/xmit_linux.c b/drivers/staging/rtl8712/xmit_linux.c -deleted file mode 100644 -index ceb6b590b310fd..00000000000000 ---- a/drivers/staging/rtl8712/xmit_linux.c -+++ /dev/null -@@ -1,181 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/****************************************************************************** -- * xmit_linux.c -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * Linux device driver for RTL8192SU -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ -- --#define _XMIT_OSDEP_C_ -- --#include --#include --#include --#include -- --#include "osdep_service.h" --#include "drv_types.h" -- --#include "wifi.h" --#include "mlme_osdep.h" --#include "xmit_osdep.h" --#include "osdep_intf.h" -- --static uint remainder_len(struct pkt_file *pfile) --{ -- return (uint)(pfile->buf_len - ((addr_t)(pfile->cur_addr) - -- (addr_t)(pfile->buf_start))); --} -- --void _r8712_open_pktfile(_pkt *pktptr, struct pkt_file *pfile) --{ -- pfile->pkt = pktptr; -- pfile->cur_addr = pfile->buf_start = pktptr->data; -- pfile->pkt_len = pfile->buf_len = pktptr->len; -- pfile->cur_buffer = pfile->buf_start; --} -- --uint _r8712_pktfile_read(struct pkt_file *pfile, u8 *rmem, uint rlen) --{ -- uint len; -- -- len = remainder_len(pfile); -- len = (rlen > len) ? len : rlen; -- if (rmem) -- skb_copy_bits(pfile->pkt, pfile->buf_len - pfile->pkt_len, -- rmem, len); -- pfile->cur_addr += len; -- pfile->pkt_len -= len; -- return len; --} -- --sint r8712_endofpktfile(struct pkt_file *pfile) --{ -- return (pfile->pkt_len == 0); --} -- --void r8712_set_qos(struct pkt_file *ppktfile, struct pkt_attrib *pattrib) --{ -- struct ethhdr etherhdr; -- struct iphdr ip_hdr; -- u16 user_priority = 0; -- -- _r8712_open_pktfile(ppktfile->pkt, ppktfile); -- _r8712_pktfile_read(ppktfile, (unsigned char *)ðerhdr, ETH_HLEN); -- -- /* get user_priority from IP hdr*/ -- if (pattrib->ether_type == 0x0800) { -- _r8712_pktfile_read(ppktfile, (u8 *)&ip_hdr, sizeof(ip_hdr)); -- /*user_priority = (ntohs(ip_hdr.tos) >> 5) & 0x3 ;*/ -- user_priority = ip_hdr.tos >> 5; -- } else { -- /* "When priority processing of data frames is supported, -- * a STA's SME should send EAPOL-Key frames at the highest -- * priority." -- */ -- -- if (pattrib->ether_type == 0x888e) -- user_priority = 7; -- } -- pattrib->priority = user_priority; -- pattrib->hdrlen = WLAN_HDR_A3_QOS_LEN; -- pattrib->subtype = WIFI_QOS_DATA_TYPE; --} -- --void r8712_SetFilter(struct work_struct *work) --{ -- struct _adapter *adapter = container_of(work, struct _adapter, -- wk_filter_rx_ff0); -- u8 oldvalue = 0x00, newvalue = 0x00; -- -- oldvalue = r8712_read8(adapter, 0x117); -- newvalue = oldvalue & 0xfe; -- r8712_write8(adapter, 0x117, newvalue); -- -- wait_for_completion(&adapter->rx_filter_ready); -- r8712_write8(adapter, 0x117, oldvalue); --} -- --int r8712_xmit_resource_alloc(struct _adapter *padapter, -- struct xmit_buf *pxmitbuf) --{ -- int i; -- -- for (i = 0; i < 8; i++) { -- pxmitbuf->pxmit_urb[i] = usb_alloc_urb(0, GFP_KERNEL); -- if (!pxmitbuf->pxmit_urb[i]) { -- int k; -- -- for (k = i - 1; k >= 0; k--) { -- /* handle allocation errors part way through loop */ -- usb_free_urb(pxmitbuf->pxmit_urb[k]); -- } -- netdev_err(padapter->pnetdev, "pxmitbuf->pxmit_urb[i] == NULL\n"); -- return -ENOMEM; -- } -- kmemleak_not_leak(pxmitbuf->pxmit_urb[i]); -- } -- return 0; --} -- --void r8712_xmit_resource_free(struct _adapter *padapter, -- struct xmit_buf *pxmitbuf) --{ -- int i; -- -- for (i = 0; i < 8; i++) { -- if (pxmitbuf->pxmit_urb[i]) { -- usb_kill_urb(pxmitbuf->pxmit_urb[i]); -- usb_free_urb(pxmitbuf->pxmit_urb[i]); -- } -- } --} -- --void r8712_xmit_complete(struct _adapter *padapter, struct xmit_frame *pxframe) --{ -- if (pxframe->pkt) -- dev_kfree_skb_any(pxframe->pkt); -- pxframe->pkt = NULL; --} -- --netdev_tx_t r8712_xmit_entry(_pkt *pkt, struct net_device *netdev) --{ -- struct xmit_frame *xmitframe = NULL; -- struct _adapter *adapter = netdev_priv(netdev); -- struct xmit_priv *xmitpriv = &(adapter->xmitpriv); -- -- if (!r8712_if_up(adapter)) -- goto _xmit_entry_drop; -- -- xmitframe = r8712_alloc_xmitframe(xmitpriv); -- if (!xmitframe) -- goto _xmit_entry_drop; -- -- if (r8712_update_attrib(adapter, pkt, &xmitframe->attrib)) -- goto _xmit_entry_drop; -- -- adapter->ledpriv.LedControlHandler(adapter, LED_CTL_TX); -- xmitframe->pkt = pkt; -- if (r8712_pre_xmit(adapter, xmitframe)) { -- /*dump xmitframe directly or drop xframe*/ -- dev_kfree_skb_any(pkt); -- xmitframe->pkt = NULL; -- } -- xmitpriv->tx_pkts++; -- xmitpriv->tx_bytes += xmitframe->attrib.last_txcmdsz; -- return NETDEV_TX_OK; --_xmit_entry_drop: -- if (xmitframe) -- r8712_free_xmitframe(xmitpriv, xmitframe); -- xmitpriv->tx_drop++; -- dev_kfree_skb_any(pkt); -- return NETDEV_TX_OK; --} -diff --git a/drivers/staging/rtl8712/xmit_osdep.h b/drivers/staging/rtl8712/xmit_osdep.h -deleted file mode 100644 -index 1ad42658c8831c..00000000000000 ---- a/drivers/staging/rtl8712/xmit_osdep.h -+++ /dev/null -@@ -1,52 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ --/****************************************************************************** -- * -- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved. -- * -- * Modifications for inclusion into the Linux staging tree are -- * Copyright(c) 2010 Larry Finger. All rights reserved. -- * -- * Contact information: -- * WLAN FAE -- * Larry Finger -- * -- ******************************************************************************/ --#ifndef __XMIT_OSDEP_H_ --#define __XMIT_OSDEP_H_ -- --#include "osdep_service.h" --#include "drv_types.h" -- --struct pkt_file { -- _pkt *pkt; -- u32 pkt_len; /*the remainder length of the open_file*/ -- _buffer *cur_buffer; -- u8 *buf_start; -- u8 *cur_addr; -- u32 buf_len; --}; -- --#define NR_XMITFRAME 256 -- --struct xmit_priv; --struct pkt_attrib; --struct sta_xmit_priv; --struct xmit_frame; --struct xmit_buf; -- --netdev_tx_t r8712_xmit_entry(_pkt *pkt, struct net_device *pnetdev); --void r8712_SetFilter(struct work_struct *work); --int r8712_xmit_resource_alloc(struct _adapter *padapter, -- struct xmit_buf *pxmitbuf); --void r8712_xmit_resource_free(struct _adapter *padapter, -- struct xmit_buf *pxmitbuf); -- --void r8712_set_qos(struct pkt_file *ppktfile, -- struct pkt_attrib *pattrib); --void _r8712_open_pktfile(_pkt *pktptr, struct pkt_file *pfile); --uint _r8712_pktfile_read(struct pkt_file *pfile, u8 *rmem, uint rlen); --sint r8712_endofpktfile(struct pkt_file *pfile); --void r8712_xmit_complete(struct _adapter *padapter, -- struct xmit_frame *pxframe); -- --#endif -diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c -index 79f2bf5df19a6c..d13063e6957163 100644 ---- a/drivers/thunderbolt/nhi.c -+++ b/drivers/thunderbolt/nhi.c -@@ -1536,6 +1536,8 @@ static struct pci_device_id nhi_ids[] = { - .driver_data = (kernel_ulong_t)&icl_nhi_ops }, - { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_P_NHI1), - .driver_data = (kernel_ulong_t)&icl_nhi_ops }, -+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_WCL_NHI0), -+ .driver_data = (kernel_ulong_t)&icl_nhi_ops }, - { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI) }, - { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI) }, - -diff --git a/drivers/thunderbolt/nhi.h b/drivers/thunderbolt/nhi.h -index 16744f25a9a069..24ac4246d0cab7 100644 ---- a/drivers/thunderbolt/nhi.h -+++ b/drivers/thunderbolt/nhi.h -@@ -75,6 +75,7 @@ extern const struct tb_nhi_ops icl_nhi_ops; - #define PCI_DEVICE_ID_INTEL_TITAN_RIDGE_DD_BRIDGE 0x15ef - #define PCI_DEVICE_ID_INTEL_ADL_NHI0 0x463e - #define PCI_DEVICE_ID_INTEL_ADL_NHI1 0x466d -+#define PCI_DEVICE_ID_INTEL_WCL_NHI0 0x4d33 - #define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI 0x5781 - #define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI 0x5784 - #define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_80G_BRIDGE 0x5786 -diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c -index bb31ac9cae8c07..8aa71a51cdabb4 100644 ---- a/drivers/tty/serial/amba-pl011.c -+++ b/drivers/tty/serial/amba-pl011.c -@@ -636,7 +636,7 @@ static int pl011_dma_tx_refill(struct uart_amba_port *uap) - dmatx->len = count; - dmatx->dma = dma_map_single(dma_dev->dev, dmatx->buf, count, - DMA_TO_DEVICE); -- if (dmatx->dma == DMA_MAPPING_ERROR) { -+ if (dma_mapping_error(dma_dev->dev, dmatx->dma)) { - uap->dmatx.queued = false; - dev_dbg(uap->port.dev, "unable to map TX DMA\n"); - return -EBUSY; -diff --git a/drivers/usb/cdns3/cdns3-pci-wrap.c b/drivers/usb/cdns3/cdns3-pci-wrap.c -index 1f6320d98a76ba..92ae5d443350e2 100644 ---- a/drivers/usb/cdns3/cdns3-pci-wrap.c -+++ b/drivers/usb/cdns3/cdns3-pci-wrap.c -@@ -101,10 +101,8 @@ static int cdns3_pci_probe(struct pci_dev *pdev, - wrap = pci_get_drvdata(func); - } else { - wrap = kzalloc(sizeof(*wrap), GFP_KERNEL); -- if (!wrap) { -- pci_disable_device(pdev); -+ if (!wrap) - return -ENOMEM; -- } - } - - res = wrap->dev_res; -@@ -163,7 +161,6 @@ static int cdns3_pci_probe(struct pci_dev *pdev, - /* register platform device */ - wrap->plat_dev = platform_device_register_full(&plat_info); - if (IS_ERR(wrap->plat_dev)) { -- pci_disable_device(pdev); - err = PTR_ERR(wrap->plat_dev); - kfree(wrap); - return err; -diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c -index b7eaad099309c5..22975a4b19a4f8 100644 ---- a/drivers/usb/dwc3/core.c -+++ b/drivers/usb/dwc3/core.c -@@ -25,6 +25,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -1990,7 +1991,7 @@ static int dwc3_probe(struct platform_device *pdev) - platform_set_drvdata(pdev, dwc); - dwc3_cache_hwparams(dwc); - -- if (!dwc->sysdev_is_parent && -+ if (!dev_is_pci(dwc->sysdev) && - DWC3_GHWPARAMS0_AWIDTH(dwc->hwparams.hwparams0) == 64) { - ret = dma_set_mask_and_coherent(dwc->sysdev, DMA_BIT_MASK(64)); - if (ret) -diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c -index 39c72cb52ce76a..8f5faf632a8bfa 100644 ---- a/drivers/usb/dwc3/dwc3-pci.c -+++ b/drivers/usb/dwc3/dwc3-pci.c -@@ -21,40 +21,41 @@ - #include - #include - -+#define PCI_DEVICE_ID_INTEL_CMLLP 0x02ee -+#define PCI_DEVICE_ID_INTEL_CMLH 0x06ee -+#define PCI_DEVICE_ID_INTEL_BXT 0x0aaa - #define PCI_DEVICE_ID_INTEL_BYT 0x0f37 - #define PCI_DEVICE_ID_INTEL_MRFLD 0x119e --#define PCI_DEVICE_ID_INTEL_BSW 0x22b7 --#define PCI_DEVICE_ID_INTEL_SPTLP 0x9d30 --#define PCI_DEVICE_ID_INTEL_SPTH 0xa130 --#define PCI_DEVICE_ID_INTEL_BXT 0x0aaa - #define PCI_DEVICE_ID_INTEL_BXT_M 0x1aaa --#define PCI_DEVICE_ID_INTEL_APL 0x5aaa --#define PCI_DEVICE_ID_INTEL_KBP 0xa2b0 --#define PCI_DEVICE_ID_INTEL_CMLLP 0x02ee --#define PCI_DEVICE_ID_INTEL_CMLH 0x06ee -+#define PCI_DEVICE_ID_INTEL_BSW 0x22b7 - #define PCI_DEVICE_ID_INTEL_GLK 0x31aa --#define PCI_DEVICE_ID_INTEL_CNPLP 0x9dee --#define PCI_DEVICE_ID_INTEL_CNPH 0xa36e --#define PCI_DEVICE_ID_INTEL_CNPV 0xa3b0 - #define PCI_DEVICE_ID_INTEL_ICLLP 0x34ee --#define PCI_DEVICE_ID_INTEL_EHL 0x4b7e --#define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee - #define PCI_DEVICE_ID_INTEL_TGPH 0x43ee --#define PCI_DEVICE_ID_INTEL_JSP 0x4dee --#define PCI_DEVICE_ID_INTEL_WCL 0x4d7e - #define PCI_DEVICE_ID_INTEL_ADL 0x460e --#define PCI_DEVICE_ID_INTEL_ADL_PCH 0x51ee - #define PCI_DEVICE_ID_INTEL_ADLN 0x465e -+#define PCI_DEVICE_ID_INTEL_EHL 0x4b7e -+#define PCI_DEVICE_ID_INTEL_WCL 0x4d7e -+#define PCI_DEVICE_ID_INTEL_JSP 0x4dee -+#define PCI_DEVICE_ID_INTEL_ADL_PCH 0x51ee - #define PCI_DEVICE_ID_INTEL_ADLN_PCH 0x54ee --#define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1 --#define PCI_DEVICE_ID_INTEL_RPL 0xa70e -+#define PCI_DEVICE_ID_INTEL_APL 0x5aaa -+#define PCI_DEVICE_ID_INTEL_NVLS_PCH 0x6e6f -+#define PCI_DEVICE_ID_INTEL_ARLH_PCH 0x777e - #define PCI_DEVICE_ID_INTEL_RPLS 0x7a61 -+#define PCI_DEVICE_ID_INTEL_MTL 0x7e7e -+#define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1 - #define PCI_DEVICE_ID_INTEL_MTLM 0x7eb1 - #define PCI_DEVICE_ID_INTEL_MTLP 0x7ec1 - #define PCI_DEVICE_ID_INTEL_MTLS 0x7f6f --#define PCI_DEVICE_ID_INTEL_MTL 0x7e7e --#define PCI_DEVICE_ID_INTEL_ARLH_PCH 0x777e - #define PCI_DEVICE_ID_INTEL_TGL 0x9a15 -+#define PCI_DEVICE_ID_INTEL_SPTLP 0x9d30 -+#define PCI_DEVICE_ID_INTEL_CNPLP 0x9dee -+#define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee -+#define PCI_DEVICE_ID_INTEL_SPTH 0xa130 -+#define PCI_DEVICE_ID_INTEL_KBP 0xa2b0 -+#define PCI_DEVICE_ID_INTEL_CNPH 0xa36e -+#define PCI_DEVICE_ID_INTEL_CNPV 0xa3b0 -+#define PCI_DEVICE_ID_INTEL_RPL 0xa70e - #define PCI_DEVICE_ID_INTEL_PTLH 0xe332 - #define PCI_DEVICE_ID_INTEL_PTLH_PCH 0xe37e - #define PCI_DEVICE_ID_INTEL_PTLU 0xe432 -@@ -412,40 +413,41 @@ static void dwc3_pci_remove(struct pci_dev *pci) - } - - static const struct pci_device_id dwc3_pci_id_table[] = { -- { PCI_DEVICE_DATA(INTEL, BSW, &dwc3_pci_intel_swnode) }, -- { PCI_DEVICE_DATA(INTEL, BYT, &dwc3_pci_intel_byt_swnode) }, -- { PCI_DEVICE_DATA(INTEL, MRFLD, &dwc3_pci_intel_mrfld_swnode) }, - { PCI_DEVICE_DATA(INTEL, CMLLP, &dwc3_pci_intel_swnode) }, - { PCI_DEVICE_DATA(INTEL, CMLH, &dwc3_pci_intel_swnode) }, -- { PCI_DEVICE_DATA(INTEL, SPTLP, &dwc3_pci_intel_swnode) }, -- { PCI_DEVICE_DATA(INTEL, SPTH, &dwc3_pci_intel_swnode) }, - { PCI_DEVICE_DATA(INTEL, BXT, &dwc3_pci_intel_swnode) }, -+ { PCI_DEVICE_DATA(INTEL, BYT, &dwc3_pci_intel_byt_swnode) }, -+ { PCI_DEVICE_DATA(INTEL, MRFLD, &dwc3_pci_intel_mrfld_swnode) }, - { PCI_DEVICE_DATA(INTEL, BXT_M, &dwc3_pci_intel_swnode) }, -- { PCI_DEVICE_DATA(INTEL, APL, &dwc3_pci_intel_swnode) }, -- { PCI_DEVICE_DATA(INTEL, KBP, &dwc3_pci_intel_swnode) }, -+ { PCI_DEVICE_DATA(INTEL, BSW, &dwc3_pci_intel_swnode) }, - { PCI_DEVICE_DATA(INTEL, GLK, &dwc3_pci_intel_swnode) }, -- { PCI_DEVICE_DATA(INTEL, CNPLP, &dwc3_pci_intel_swnode) }, -- { PCI_DEVICE_DATA(INTEL, CNPH, &dwc3_pci_intel_swnode) }, -- { PCI_DEVICE_DATA(INTEL, CNPV, &dwc3_pci_intel_swnode) }, - { PCI_DEVICE_DATA(INTEL, ICLLP, &dwc3_pci_intel_swnode) }, -- { PCI_DEVICE_DATA(INTEL, EHL, &dwc3_pci_intel_swnode) }, -- { PCI_DEVICE_DATA(INTEL, TGPLP, &dwc3_pci_intel_swnode) }, - { PCI_DEVICE_DATA(INTEL, TGPH, &dwc3_pci_intel_swnode) }, -- { PCI_DEVICE_DATA(INTEL, JSP, &dwc3_pci_intel_swnode) }, -- { PCI_DEVICE_DATA(INTEL, WCL, &dwc3_pci_intel_swnode) }, - { PCI_DEVICE_DATA(INTEL, ADL, &dwc3_pci_intel_swnode) }, -- { PCI_DEVICE_DATA(INTEL, ADL_PCH, &dwc3_pci_intel_swnode) }, - { PCI_DEVICE_DATA(INTEL, ADLN, &dwc3_pci_intel_swnode) }, -+ { PCI_DEVICE_DATA(INTEL, EHL, &dwc3_pci_intel_swnode) }, -+ { PCI_DEVICE_DATA(INTEL, WCL, &dwc3_pci_intel_swnode) }, -+ { PCI_DEVICE_DATA(INTEL, JSP, &dwc3_pci_intel_swnode) }, -+ { PCI_DEVICE_DATA(INTEL, ADL_PCH, &dwc3_pci_intel_swnode) }, - { PCI_DEVICE_DATA(INTEL, ADLN_PCH, &dwc3_pci_intel_swnode) }, -- { PCI_DEVICE_DATA(INTEL, ADLS, &dwc3_pci_intel_swnode) }, -- { PCI_DEVICE_DATA(INTEL, RPL, &dwc3_pci_intel_swnode) }, -+ { PCI_DEVICE_DATA(INTEL, APL, &dwc3_pci_intel_swnode) }, -+ { PCI_DEVICE_DATA(INTEL, NVLS_PCH, &dwc3_pci_intel_swnode) }, -+ { PCI_DEVICE_DATA(INTEL, ARLH_PCH, &dwc3_pci_intel_swnode) }, - { PCI_DEVICE_DATA(INTEL, RPLS, &dwc3_pci_intel_swnode) }, -+ { PCI_DEVICE_DATA(INTEL, MTL, &dwc3_pci_intel_swnode) }, -+ { PCI_DEVICE_DATA(INTEL, ADLS, &dwc3_pci_intel_swnode) }, - { PCI_DEVICE_DATA(INTEL, MTLM, &dwc3_pci_intel_swnode) }, - { PCI_DEVICE_DATA(INTEL, MTLP, &dwc3_pci_intel_swnode) }, -- { PCI_DEVICE_DATA(INTEL, MTL, &dwc3_pci_intel_swnode) }, - { PCI_DEVICE_DATA(INTEL, MTLS, &dwc3_pci_intel_swnode) }, -- { PCI_DEVICE_DATA(INTEL, ARLH_PCH, &dwc3_pci_intel_swnode) }, - { PCI_DEVICE_DATA(INTEL, TGL, &dwc3_pci_intel_swnode) }, -+ { PCI_DEVICE_DATA(INTEL, SPTLP, &dwc3_pci_intel_swnode) }, -+ { PCI_DEVICE_DATA(INTEL, CNPLP, &dwc3_pci_intel_swnode) }, -+ { PCI_DEVICE_DATA(INTEL, TGPLP, &dwc3_pci_intel_swnode) }, -+ { PCI_DEVICE_DATA(INTEL, SPTH, &dwc3_pci_intel_swnode) }, -+ { PCI_DEVICE_DATA(INTEL, KBP, &dwc3_pci_intel_swnode) }, -+ { PCI_DEVICE_DATA(INTEL, CNPH, &dwc3_pci_intel_swnode) }, -+ { PCI_DEVICE_DATA(INTEL, CNPV, &dwc3_pci_intel_swnode) }, -+ { PCI_DEVICE_DATA(INTEL, RPL, &dwc3_pci_intel_swnode) }, - { PCI_DEVICE_DATA(INTEL, PTLH, &dwc3_pci_intel_swnode) }, - { PCI_DEVICE_DATA(INTEL, PTLH_PCH, &dwc3_pci_intel_swnode) }, - { PCI_DEVICE_DATA(INTEL, PTLU, &dwc3_pci_intel_swnode) }, -diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c -index 876a839f2d1d09..bcc9cc39806838 100644 ---- a/drivers/usb/dwc3/ep0.c -+++ b/drivers/usb/dwc3/ep0.c -@@ -94,6 +94,7 @@ static int __dwc3_gadget_ep0_queue(struct dwc3_ep *dep, - req->request.actual = 0; - req->request.status = -EINPROGRESS; - req->epnum = dep->number; -+ req->status = DWC3_REQUEST_STATUS_QUEUED; - - list_add_tail(&req->list, &dep->pending_list); - -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index 6e90f2ad0426a4..821e51eada181e 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -229,6 +229,13 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req, - { - struct dwc3 *dwc = dep->dwc; - -+ /* -+ * The request might have been processed and completed while the -+ * spinlock was released. Skip processing if already completed. -+ */ -+ if (req->status == DWC3_REQUEST_STATUS_COMPLETED) -+ return; -+ - dwc3_gadget_del_and_unmap_request(dep, req, status); - req->status = DWC3_REQUEST_STATUS_COMPLETED; - -diff --git a/drivers/usb/gadget/function/f_eem.c b/drivers/usb/gadget/function/f_eem.c -index 3b445bd884988c..f2478b48a30b26 100644 ---- a/drivers/usb/gadget/function/f_eem.c -+++ b/drivers/usb/gadget/function/f_eem.c -@@ -477,8 +477,13 @@ static int eem_unwrap(struct gether *port, - req->complete = eem_cmd_complete; - req->zero = 1; - req->context = ctx; -- if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC)) -+ if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC)) { - DBG(cdev, "echo response queue fail\n"); -+ kfree(ctx); -+ kfree(req->buf); -+ usb_ep_free_request(ep, req); -+ dev_kfree_skb_any(skb2); -+ } - break; - - case 1: /* echo response */ -diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c -index 25bbb7a440ce28..0cad5cf1954314 100644 ---- a/drivers/usb/gadget/udc/core.c -+++ b/drivers/usb/gadget/udc/core.c -@@ -1121,8 +1121,14 @@ static void usb_gadget_state_work(struct work_struct *work) - void usb_gadget_set_state(struct usb_gadget *gadget, - enum usb_device_state state) - { -+ unsigned long flags; -+ -+ spin_lock_irqsave(&gadget->state_lock, flags); - gadget->state = state; -- schedule_work(&gadget->work); -+ if (!gadget->teardown) -+ schedule_work(&gadget->work); -+ spin_unlock_irqrestore(&gadget->state_lock, flags); -+ trace_usb_gadget_set_state(gadget, 0); - } - EXPORT_SYMBOL_GPL(usb_gadget_set_state); - -@@ -1355,6 +1361,8 @@ static void usb_udc_nop_release(struct device *dev) - void usb_initialize_gadget(struct device *parent, struct usb_gadget *gadget, - void (*release)(struct device *dev)) - { -+ spin_lock_init(&gadget->state_lock); -+ gadget->teardown = false; - INIT_WORK(&gadget->work, usb_gadget_state_work); - gadget->dev.parent = parent; - -@@ -1529,6 +1537,7 @@ EXPORT_SYMBOL_GPL(usb_add_gadget_udc); - void usb_del_gadget(struct usb_gadget *gadget) - { - struct usb_udc *udc = gadget->udc; -+ unsigned long flags; - - if (!udc) - return; -@@ -1542,6 +1551,13 @@ void usb_del_gadget(struct usb_gadget *gadget) - kobject_uevent(&udc->dev.kobj, KOBJ_REMOVE); - sysfs_remove_link(&udc->dev.kobj, "gadget"); - device_del(&gadget->dev); -+ /* -+ * Set the teardown flag before flushing the work to prevent new work -+ * from being scheduled while we are cleaning up. -+ */ -+ spin_lock_irqsave(&gadget->state_lock, flags); -+ gadget->teardown = true; -+ spin_unlock_irqrestore(&gadget->state_lock, flags); - flush_work(&gadget->work); - ida_free(&gadget_id_numbers, gadget->id_number); - cancel_work_sync(&udc->vbus_work); -diff --git a/drivers/usb/gadget/udc/renesas_usbf.c b/drivers/usb/gadget/udc/renesas_usbf.c -index 657f265ac7cc57..8463f681ae673a 100644 ---- a/drivers/usb/gadget/udc/renesas_usbf.c -+++ b/drivers/usb/gadget/udc/renesas_usbf.c -@@ -3262,7 +3262,9 @@ static int usbf_probe(struct platform_device *pdev) - if (IS_ERR(udc->regs)) - return PTR_ERR(udc->regs); - -- devm_pm_runtime_enable(&pdev->dev); -+ ret = devm_pm_runtime_enable(&pdev->dev); -+ if (ret) -+ return ret; - ret = pm_runtime_resume_and_get(&pdev->dev); - if (ret < 0) - return ret; -diff --git a/drivers/usb/gadget/udc/trace.h b/drivers/usb/gadget/udc/trace.h -index a5ed26fbc2dad6..661158d3a39cdb 100644 ---- a/drivers/usb/gadget/udc/trace.h -+++ b/drivers/usb/gadget/udc/trace.h -@@ -81,6 +81,11 @@ DECLARE_EVENT_CLASS(udc_log_gadget, - __entry->ret) - ); - -+DEFINE_EVENT(udc_log_gadget, usb_gadget_set_state, -+ TP_PROTO(struct usb_gadget *g, int ret), -+ TP_ARGS(g, ret) -+); -+ - DEFINE_EVENT(udc_log_gadget, usb_gadget_frame_number, - TP_PROTO(struct usb_gadget *g, int ret), - TP_ARGS(g, ret) -diff --git a/drivers/usb/host/xhci-dbgcap.h b/drivers/usb/host/xhci-dbgcap.h -index 1fab3eb9c831d3..e6aab11ed6f25c 100644 ---- a/drivers/usb/host/xhci-dbgcap.h -+++ b/drivers/usb/host/xhci-dbgcap.h -@@ -113,6 +113,7 @@ struct dbc_port { - unsigned int tx_boundary; - - bool registered; -+ bool tx_running; - }; - - struct dbc_driver { -diff --git a/drivers/usb/host/xhci-dbgtty.c b/drivers/usb/host/xhci-dbgtty.c -index aa689fbd3dce67..f2c74e20b57244 100644 ---- a/drivers/usb/host/xhci-dbgtty.c -+++ b/drivers/usb/host/xhci-dbgtty.c -@@ -47,7 +47,7 @@ dbc_kfifo_to_req(struct dbc_port *port, char *packet) - return len; - } - --static int dbc_start_tx(struct dbc_port *port) -+static int dbc_do_start_tx(struct dbc_port *port) - __releases(&port->port_lock) - __acquires(&port->port_lock) - { -@@ -57,6 +57,8 @@ static int dbc_start_tx(struct dbc_port *port) - bool do_tty_wake = false; - struct list_head *pool = &port->write_pool; - -+ port->tx_running = true; -+ - while (!list_empty(pool)) { - req = list_entry(pool->next, struct dbc_request, list_pool); - len = dbc_kfifo_to_req(port, req->buf); -@@ -77,12 +79,25 @@ static int dbc_start_tx(struct dbc_port *port) - } - } - -+ port->tx_running = false; -+ - if (do_tty_wake && port->port.tty) - tty_wakeup(port->port.tty); - - return status; - } - -+/* must be called with port->port_lock held */ -+static int dbc_start_tx(struct dbc_port *port) -+{ -+ lockdep_assert_held(&port->port_lock); -+ -+ if (port->tx_running) -+ return -EBUSY; -+ -+ return dbc_do_start_tx(port); -+} -+ - static void dbc_start_rx(struct dbc_port *port) - __releases(&port->port_lock) - __acquires(&port->port_lock) -@@ -503,6 +518,12 @@ static void xhci_dbc_tty_unregister_device(struct xhci_dbc *dbc) - - if (!port->registered) - return; -+ /* -+ * Hang up the TTY. This wakes up any blocked -+ * writers and causes subsequent writes to fail. -+ */ -+ tty_vhangup(port->port.tty); -+ - tty_unregister_device(dbc_tty_driver, port->minor); - xhci_dbc_tty_exit_port(port); - port->registered = false; -diff --git a/drivers/usb/renesas_usbhs/common.c b/drivers/usb/renesas_usbhs/common.c -index b720899725e537..2978e869ac8fbf 100644 ---- a/drivers/usb/renesas_usbhs/common.c -+++ b/drivers/usb/renesas_usbhs/common.c -@@ -798,18 +798,18 @@ static void usbhs_remove(struct platform_device *pdev) - - flush_delayed_work(&priv->notify_hotplug_work); - -- /* power off */ -- if (!usbhs_get_dparam(priv, runtime_pwctrl)) -- usbhsc_power_ctrl(priv, 0); -- -- pm_runtime_disable(&pdev->dev); -- - usbhs_platform_call(priv, hardware_exit, pdev); -- usbhsc_clk_put(priv); - reset_control_assert(priv->rsts); - usbhs_mod_remove(priv); - usbhs_fifo_remove(priv); - usbhs_pipe_remove(priv); -+ -+ /* power off */ -+ if (!usbhs_get_dparam(priv, runtime_pwctrl)) -+ usbhsc_power_ctrl(priv, 0); -+ -+ usbhsc_clk_put(priv); -+ pm_runtime_disable(&pdev->dev); - } - - static __maybe_unused int usbhsc_suspend(struct device *dev) -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 8906c9dc348edd..2bc5d21ef6b94a 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -1074,6 +1074,7 @@ static const struct usb_device_id id_table_combined[] = { - /* U-Blox devices */ - { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) }, - { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) }, -+ { USB_DEVICE_INTERFACE_NUMBER(UBLOX_VID, UBLOX_EVK_M101_PID, 2) }, - /* FreeCalypso USB adapters */ - { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index 4cc1fae8acb970..2539b9e2f712c3 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -1614,6 +1614,7 @@ - #define UBLOX_VID 0x1546 - #define UBLOX_C099F9P_ZED_PID 0x0502 - #define UBLOX_C099F9P_ODIN_PID 0x0503 -+#define UBLOX_EVK_M101_PID 0x0506 - - /* - * GMC devices -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index e9d0d8591a01f2..8cc4ed4857cde0 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -2424,12 +2424,18 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */ - { USB_DEVICE(0x33f8, 0x0104), /* Rolling RW101-GL (laptop RMNET) */ - .driver_info = RSVD(4) | RSVD(5) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */ -+ .driver_info = RSVD(5) }, - { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a2, 0xff) }, /* Rolling RW101-GL (laptop MBIM) */ - { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a3, 0xff) }, /* Rolling RW101-GL (laptop MBIM) */ - { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a4, 0xff), /* Rolling RW101-GL (laptop MBIM) */ - .driver_info = RSVD(4) }, -- { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */ -- .driver_info = RSVD(5) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a8, 0xff), /* Rolling RW101R-GL (laptop MBIM) */ -+ .driver_info = RSVD(4) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a9, 0xff), /* Rolling RW101R-GL (laptop MBIM) */ -+ .driver_info = RSVD(4) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0301, 0xff) }, /* Rolling RW101R-GL (laptop MBIM) */ -+ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0302, 0xff) }, /* Rolling RW101R-GL (laptop MBIM) */ - { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0802, 0xff), /* Rolling RW350-GL (laptop MBIM) */ - .driver_info = RSVD(5) }, - { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Global */ -diff --git a/drivers/usb/storage/sddr55.c b/drivers/usb/storage/sddr55.c -index 15dc25801cdcc5..f53b2471a21c81 100644 ---- a/drivers/usb/storage/sddr55.c -+++ b/drivers/usb/storage/sddr55.c -@@ -469,6 +469,12 @@ static int sddr55_write_data(struct us_data *us, - new_pba = (status[3] + (status[4] << 8) + (status[5] << 16)) - >> info->blockshift; - -+ /* check if device-reported new_pba is out of range */ -+ if (new_pba >= (info->capacity >> (info->blockshift + info->pageshift))) { -+ result = USB_STOR_TRANSPORT_FAILED; -+ goto leave; -+ } -+ - /* check status for error */ - if (status[0] == 0xff && status[1] == 0x4) { - info->pba_to_lba[new_pba] = BAD_BLOCK; -diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c -index 7449e379077a58..f79b449d0f1185 100644 ---- a/drivers/usb/storage/transport.c -+++ b/drivers/usb/storage/transport.c -@@ -1204,7 +1204,23 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us) - US_BULK_CS_WRAP_LEN && - bcs->Signature == - cpu_to_le32(US_BULK_CS_SIGN)) { -+ unsigned char buf[US_BULK_CS_WRAP_LEN]; -+ - usb_stor_dbg(us, "Device skipped data phase\n"); -+ -+ /* -+ * Devices skipping data phase might leave CSW data in srb's -+ * transfer buffer. Zero it to prevent USB protocol leakage. -+ */ -+ sg = NULL; -+ offset = 0; -+ memset(buf, 0, sizeof(buf)); -+ if (usb_stor_access_xfer_buf(buf, -+ US_BULK_CS_WRAP_LEN, srb, &sg, -+ &offset, TO_XFER_BUF) != -+ US_BULK_CS_WRAP_LEN) -+ usb_stor_dbg(us, "Failed to clear CSW data\n"); -+ - scsi_set_resid(srb, transfer_length); - goto skipped_data_phase; - } -diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c -index f794cb39cc3130..b54b4bfeb45eb7 100644 ---- a/drivers/usb/storage/uas.c -+++ b/drivers/usb/storage/uas.c -@@ -697,6 +697,10 @@ static int uas_queuecommand_lck(struct scsi_cmnd *cmnd) - * of queueing, no matter how fatal the error - */ - if (err == -ENODEV) { -+ if (cmdinfo->state & (COMMAND_INFLIGHT | DATA_IN_URB_INFLIGHT | -+ DATA_OUT_URB_INFLIGHT)) -+ goto out; -+ - set_host_byte(cmnd, DID_NO_CONNECT); - scsi_done(cmnd); - goto zombie; -@@ -710,6 +714,7 @@ static int uas_queuecommand_lck(struct scsi_cmnd *cmnd) - uas_add_work(cmnd); - } - -+out: - devinfo->cmnd[idx] = cmnd; - zombie: - spin_unlock_irqrestore(&devinfo->lock, flags); -diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h -index dfa5276a5a43e2..47f50d7a385c8a 100644 ---- a/drivers/usb/storage/unusual_devs.h -+++ b/drivers/usb/storage/unusual_devs.h -@@ -938,7 +938,7 @@ UNUSUAL_DEV( 0x05e3, 0x0723, 0x9451, 0x9451, - UNUSUAL_DEV( 0x0603, 0x8611, 0x0000, 0xffff, - "Novatek", - "NTK96550-based camera", -- USB_SC_SCSI, USB_PR_BULK, NULL, -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_BULK_IGNORE_TAG ), - - /* -diff --git a/drivers/usb/typec/ucsi/psy.c b/drivers/usb/typec/ucsi/psy.c -index 9b0157063df0a3..c80c23d3384e89 100644 ---- a/drivers/usb/typec/ucsi/psy.c -+++ b/drivers/usb/typec/ucsi/psy.c -@@ -144,6 +144,11 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con, - { - u32 pdo; - -+ if (!(con->status.flags & UCSI_CONSTAT_CONNECTED)) { -+ val->intval = 0; -+ return 0; -+ } -+ - switch (UCSI_CONSTAT_PWR_OPMODE(con->status.flags)) { - case UCSI_CONSTAT_PWR_OPMODE_PD: - if (con->num_pdos > 0) { -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index e6d0c3b1169aaa..57f1f6aa19c917 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -1820,8 +1820,10 @@ static u32 nfsd4_get_drc_mem(struct nfsd4_channel_attrs *ca, struct nfsd_net *nn - */ - scale_factor = max_t(unsigned int, 8, nn->nfsd_serv->sv_nrthreads); - -- avail = clamp_t(unsigned long, avail, slotsize, -- total_avail/scale_factor); -+ if (avail > total_avail / scale_factor) -+ avail = total_avail / scale_factor; -+ else if (avail < slotsize) -+ avail = slotsize; - num = min_t(int, num, avail / slotsize); - num = max_t(int, num, 1); - nfsd_drc_mem_used += num * slotsize; -diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c -index 986286ef40466d..86c89917f18e90 100644 ---- a/fs/smb/client/connect.c -+++ b/fs/smb/client/connect.c -@@ -4224,6 +4224,7 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid) - - out: - kfree(ctx->username); -+ kfree(ctx->domainname); - kfree_sensitive(ctx->password); - kfree(origin_fullpath); - kfree(ctx); -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index 9f64808c7917c3..a819f198c3337a 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -2255,10 +2255,6 @@ int smb2_session_logoff(struct ksmbd_work *work) - sess->state = SMB2_SESSION_EXPIRED; - up_write(&conn->session_lock); - -- if (sess->user) { -- ksmbd_free_user(sess->user); -- sess->user = NULL; -- } - ksmbd_all_conn_set_status(sess_id, KSMBD_SESS_NEED_SETUP); - - rsp->StructureSize = cpu_to_le16(4); -diff --git a/include/linux/spi/spi-mem.h b/include/linux/spi/spi-mem.h -index 6b0a7dc48a4b79..6bd0b548bd1e91 100644 ---- a/include/linux/spi/spi-mem.h -+++ b/include/linux/spi/spi-mem.h -@@ -68,6 +68,9 @@ enum spi_mem_data_dir { - SPI_MEM_DATA_OUT, - }; - -+#define SPI_MEM_OP_MAX_FREQ(__freq) \ -+ .max_freq = __freq -+ - /** - * struct spi_mem_op - describes a SPI memory operation - * @cmd.nbytes: number of opcode bytes (only 1 or 2 are valid). The opcode is -@@ -90,11 +93,16 @@ enum spi_mem_data_dir { - * @data.buswidth: number of IO lanes used to send/receive the data - * @data.dtr: whether the data should be sent in DTR mode or not - * @data.ecc: whether error correction is required or not -+ * @data.swap16: whether the byte order of 16-bit words is swapped when read -+ * or written in Octal DTR mode compared to STR mode. - * @data.dir: direction of the transfer - * @data.nbytes: number of data bytes to send/receive. Can be zero if the - * operation does not involve transferring data - * @data.buf.in: input buffer (must be DMA-able) - * @data.buf.out: output buffer (must be DMA-able) -+ * @max_freq: frequency limitation wrt this operation. 0 means there is no -+ * specific constraint and the highest achievable frequency can be -+ * attempted. - */ - struct spi_mem_op { - struct { -@@ -124,7 +132,8 @@ struct spi_mem_op { - u8 buswidth; - u8 dtr : 1; - u8 ecc : 1; -- u8 __pad : 6; -+ u8 swap16 : 1; -+ u8 __pad : 5; - enum spi_mem_data_dir dir; - unsigned int nbytes; - union { -@@ -132,14 +141,17 @@ struct spi_mem_op { - const void *out; - } buf; - } data; -+ -+ unsigned int max_freq; - }; - --#define SPI_MEM_OP(__cmd, __addr, __dummy, __data) \ -+#define SPI_MEM_OP(__cmd, __addr, __dummy, __data, ...) \ - { \ - .cmd = __cmd, \ - .addr = __addr, \ - .dummy = __dummy, \ - .data = __data, \ -+ __VA_ARGS__ \ - } - - /** -@@ -295,10 +307,15 @@ struct spi_controller_mem_ops { - * struct spi_controller_mem_caps - SPI memory controller capabilities - * @dtr: Supports DTR operations - * @ecc: Supports operations with error correction -+ * @swap16: Supports swapping bytes on a 16 bit boundary when configured in -+ * Octal DTR -+ * @per_op_freq: Supports per operation frequency switching - */ - struct spi_controller_mem_caps { - bool dtr; - bool ecc; -+ bool swap16; -+ bool per_op_freq; - }; - - #define spi_mem_controller_is_capable(ctlr, cap) \ -@@ -363,6 +380,7 @@ bool spi_mem_default_supports_op(struct spi_mem *mem, - #endif /* CONFIG_SPI_MEM */ - - int spi_mem_adjust_op_size(struct spi_mem *mem, struct spi_mem_op *op); -+void spi_mem_adjust_op_freq(struct spi_mem *mem, struct spi_mem_op *op); - - bool spi_mem_supports_op(struct spi_mem *mem, - const struct spi_mem_op *op); -diff --git a/include/linux/usb/gadget.h b/include/linux/usb/gadget.h -index aa831e16c3d39d..1a13d0c01b0aa6 100644 ---- a/include/linux/usb/gadget.h -+++ b/include/linux/usb/gadget.h -@@ -374,6 +374,9 @@ struct usb_gadget_ops { - * can handle. The UDC must support this and all slower speeds and lower - * number of lanes. - * @state: the state we are now (attached, suspended, configured, etc) -+ * @state_lock: Spinlock protecting the `state` and `teardown` members. -+ * @teardown: True if the device is undergoing teardown, used to prevent -+ * new work from being scheduled during cleanup. - * @name: Identifies the controller hardware type. Used in diagnostics - * and sometimes configuration. - * @dev: Driver model state for this abstract device. -@@ -449,6 +452,8 @@ struct usb_gadget { - enum usb_ssp_rate max_ssp_rate; - - enum usb_device_state state; -+ spinlock_t state_lock; -+ bool teardown; - const char *name; - struct device dev; - unsigned isoch_delay; -diff --git a/include/net/bonding.h b/include/net/bonding.h -index 8bb5f016969f10..95f67b308c19a4 100644 ---- a/include/net/bonding.h -+++ b/include/net/bonding.h -@@ -695,6 +695,7 @@ void bond_debug_register(struct bonding *bond); - void bond_debug_unregister(struct bonding *bond); - void bond_debug_reregister(struct bonding *bond); - const char *bond_mode_name(int mode); -+bool bond_xdp_check(struct bonding *bond, int mode); - void bond_setup(struct net_device *bond_dev); - unsigned int bond_get_num_tx_queues(void); - int bond_netlink_init(void); -diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c -index d2613bd3e6db02..8b3ef088ed14e9 100644 ---- a/net/bluetooth/hci_sock.c -+++ b/net/bluetooth/hci_sock.c -@@ -1304,7 +1304,9 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, - goto done; - } - -+ hci_dev_lock(hdev); - mgmt_index_removed(hdev); -+ hci_dev_unlock(hdev); - - err = hci_dev_open(hdev->id); - if (err) { -diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c -index 4c00bc50de811e..e7ee13fe83a74a 100644 ---- a/net/bluetooth/smp.c -+++ b/net/bluetooth/smp.c -@@ -2137,7 +2137,7 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb) - struct smp_chan *smp = chan->data; - struct hci_conn *hcon = conn->hcon; - u8 *pkax, *pkbx, *na, *nb, confirm_hint; -- u32 passkey; -+ u32 passkey = 0; - int err; - - bt_dev_dbg(hcon->hdev, "conn %p", conn); -@@ -2189,24 +2189,6 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb) - smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), - smp->prnd); - SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); -- -- /* Only Just-Works pairing requires extra checks */ -- if (smp->method != JUST_WORKS) -- goto mackey_and_ltk; -- -- /* If there already exists long term key in local host, leave -- * the decision to user space since the remote device could -- * be legitimate or malicious. -- */ -- if (hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, -- hcon->role)) { -- /* Set passkey to 0. The value can be any number since -- * it'll be ignored anyway. -- */ -- passkey = 0; -- confirm_hint = 1; -- goto confirm; -- } - } - - mackey_and_ltk: -@@ -2227,11 +2209,12 @@ mackey_and_ltk: - if (err) - return SMP_UNSPECIFIED; - -- confirm_hint = 0; -- --confirm: -- if (smp->method == JUST_WORKS) -- confirm_hint = 1; -+ /* Always require user confirmation for Just-Works pairing to prevent -+ * impersonation attacks, or in case of a legitimate device that is -+ * repairing use the confirmation as acknowledgment to proceed with the -+ * creation of new keys. -+ */ -+ confirm_hint = smp->method == JUST_WORKS ? 1 : 0; - - err = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, hcon->type, - hcon->dst_type, passkey, confirm_hint); -diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c -index b71b1635916e17..a21c157daf7dd3 100644 ---- a/net/ceph/auth_x.c -+++ b/net/ceph/auth_x.c -@@ -631,6 +631,7 @@ static int handle_auth_session_key(struct ceph_auth_client *ac, u64 global_id, - - /* connection secret */ - ceph_decode_32_safe(p, end, len, e_inval); -+ ceph_decode_need(p, end, len, e_inval); - dout("%s connection secret blob len %d\n", __func__, len); - if (len > 0) { - dp = *p + ceph_x_encrypt_offset(); -@@ -648,6 +649,7 @@ static int handle_auth_session_key(struct ceph_auth_client *ac, u64 global_id, - - /* service tickets */ - ceph_decode_32_safe(p, end, len, e_inval); -+ ceph_decode_need(p, end, len, e_inval); - dout("%s service tickets blob len %d\n", __func__, len); - if (len > 0) { - ret = ceph_x_proc_ticket_reply(ac, &th->session_key, -diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c -index 4c6441536d55b6..285e981730e5cb 100644 ---- a/net/ceph/ceph_common.c -+++ b/net/ceph/ceph_common.c -@@ -785,42 +785,53 @@ void ceph_reset_client_addr(struct ceph_client *client) - } - EXPORT_SYMBOL(ceph_reset_client_addr); - --/* -- * true if we have the mon map (and have thus joined the cluster) -- */ --static bool have_mon_and_osd_map(struct ceph_client *client) --{ -- return client->monc.monmap && client->monc.monmap->epoch && -- client->osdc.osdmap && client->osdc.osdmap->epoch; --} -- - /* - * mount: join the ceph cluster, and open root directory. - */ - int __ceph_open_session(struct ceph_client *client, unsigned long started) - { -- unsigned long timeout = client->options->mount_timeout; -- long err; -+ DEFINE_WAIT_FUNC(wait, woken_wake_function); -+ long timeout = ceph_timeout_jiffies(client->options->mount_timeout); -+ bool have_monmap, have_osdmap; -+ int err; - - /* open session, and wait for mon and osd maps */ - err = ceph_monc_open_session(&client->monc); - if (err < 0) - return err; - -- while (!have_mon_and_osd_map(client)) { -- if (timeout && time_after_eq(jiffies, started + timeout)) -- return -ETIMEDOUT; -+ add_wait_queue(&client->auth_wq, &wait); -+ for (;;) { -+ mutex_lock(&client->monc.mutex); -+ err = client->auth_err; -+ have_monmap = client->monc.monmap && client->monc.monmap->epoch; -+ mutex_unlock(&client->monc.mutex); -+ -+ down_read(&client->osdc.lock); -+ have_osdmap = client->osdc.osdmap && client->osdc.osdmap->epoch; -+ up_read(&client->osdc.lock); -+ -+ if (err || (have_monmap && have_osdmap)) -+ break; -+ -+ if (signal_pending(current)) { -+ err = -ERESTARTSYS; -+ break; -+ } -+ -+ if (!timeout) { -+ err = -ETIMEDOUT; -+ break; -+ } - - /* wait */ - dout("mount waiting for mon_map\n"); -- err = wait_event_interruptible_timeout(client->auth_wq, -- have_mon_and_osd_map(client) || (client->auth_err < 0), -- ceph_timeout_jiffies(timeout)); -- if (err < 0) -- return err; -- if (client->auth_err < 0) -- return client->auth_err; -+ timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout); - } -+ remove_wait_queue(&client->auth_wq, &wait); -+ -+ if (err) -+ return err; - - pr_info("client%llu fsid %pU\n", ceph_client_gid(client), - &client->fsid); -diff --git a/net/ceph/debugfs.c b/net/ceph/debugfs.c -index 2110439f8a247c..83c270bce63c1e 100644 ---- a/net/ceph/debugfs.c -+++ b/net/ceph/debugfs.c -@@ -36,8 +36,9 @@ static int monmap_show(struct seq_file *s, void *p) - int i; - struct ceph_client *client = s->private; - -+ mutex_lock(&client->monc.mutex); - if (client->monc.monmap == NULL) -- return 0; -+ goto out_unlock; - - seq_printf(s, "epoch %d\n", client->monc.monmap->epoch); - for (i = 0; i < client->monc.monmap->num_mon; i++) { -@@ -48,6 +49,9 @@ static int monmap_show(struct seq_file *s, void *p) - ENTITY_NAME(inst->name), - ceph_pr_addr(&inst->addr)); - } -+ -+out_unlock: -+ mutex_unlock(&client->monc.mutex); - return 0; - } - -@@ -56,13 +60,14 @@ static int osdmap_show(struct seq_file *s, void *p) - int i; - struct ceph_client *client = s->private; - struct ceph_osd_client *osdc = &client->osdc; -- struct ceph_osdmap *map = osdc->osdmap; -+ struct ceph_osdmap *map; - struct rb_node *n; - -+ down_read(&osdc->lock); -+ map = osdc->osdmap; - if (map == NULL) -- return 0; -+ goto out_unlock; - -- down_read(&osdc->lock); - seq_printf(s, "epoch %u barrier %u flags 0x%x\n", map->epoch, - osdc->epoch_barrier, map->flags); - -@@ -131,6 +136,7 @@ static int osdmap_show(struct seq_file *s, void *p) - seq_printf(s, "]\n"); - } - -+out_unlock: - up_read(&osdc->lock); - return 0; - } -diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c -index f9ed6bf6c4776a..73ac1c1f3394a7 100644 ---- a/net/ceph/messenger_v2.c -+++ b/net/ceph/messenger_v2.c -@@ -1091,13 +1091,16 @@ static int decrypt_control_remainder(struct ceph_connection *con) - static int process_v2_sparse_read(struct ceph_connection *con, - struct page **pages, int spos) - { -- struct ceph_msg_data_cursor *cursor = &con->v2.in_cursor; -+ struct ceph_msg_data_cursor cursor; - int ret; - -+ ceph_msg_data_cursor_init(&cursor, con->in_msg, -+ con->in_msg->sparse_read_total); -+ - for (;;) { - char *buf = NULL; - -- ret = con->ops->sparse_read(con, cursor, &buf); -+ ret = con->ops->sparse_read(con, &cursor, &buf); - if (ret <= 0) - return ret; - -@@ -1115,11 +1118,11 @@ static int process_v2_sparse_read(struct ceph_connection *con, - } else { - struct bio_vec bv; - -- get_bvec_at(cursor, &bv); -+ get_bvec_at(&cursor, &bv); - len = min_t(int, len, bv.bv_len); - memcpy_page(bv.bv_page, bv.bv_offset, - spage, soff, len); -- ceph_msg_data_advance(cursor, len); -+ ceph_msg_data_advance(&cursor, len); - } - spos += len; - ret -= len; -diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c -index 2950988738614f..d245fa508e1cc9 100644 ---- a/net/ceph/osdmap.c -+++ b/net/ceph/osdmap.c -@@ -1504,8 +1504,6 @@ static int decode_new_primary_temp(void **p, void *end, - - u32 ceph_get_primary_affinity(struct ceph_osdmap *map, int osd) - { -- BUG_ON(osd >= map->max_osd); -- - if (!map->osd_primary_affinity) - return CEPH_OSD_DEFAULT_PRIMARY_AFFINITY; - -@@ -1514,8 +1512,6 @@ u32 ceph_get_primary_affinity(struct ceph_osdmap *map, int osd) - - static int set_primary_affinity(struct ceph_osdmap *map, int osd, u32 aff) - { -- BUG_ON(osd >= map->max_osd); -- - if (!map->osd_primary_affinity) { - int i; - -@@ -1577,6 +1573,8 @@ static int decode_new_primary_affinity(void **p, void *end, - - ceph_decode_32_safe(p, end, osd, e_inval); - ceph_decode_32_safe(p, end, aff, e_inval); -+ if (osd >= map->max_osd) -+ goto e_inval; - - ret = set_primary_affinity(map, osd, aff); - if (ret) -@@ -1879,7 +1877,9 @@ static int decode_new_up_state_weight(void **p, void *end, u8 struct_v, - ceph_decode_need(p, end, 2*sizeof(u32), e_inval); - osd = ceph_decode_32(p); - w = ceph_decode_32(p); -- BUG_ON(osd >= map->max_osd); -+ if (osd >= map->max_osd) -+ goto e_inval; -+ - osdmap_info(map, "osd%d weight 0x%x %s\n", osd, w, - w == CEPH_OSD_IN ? "(in)" : - (w == CEPH_OSD_OUT ? "(out)" : "")); -@@ -1905,13 +1905,15 @@ static int decode_new_up_state_weight(void **p, void *end, u8 struct_v, - u32 xorstate; - - osd = ceph_decode_32(p); -+ if (osd >= map->max_osd) -+ goto e_inval; -+ - if (struct_v >= 5) - xorstate = ceph_decode_32(p); - else - xorstate = ceph_decode_8(p); - if (xorstate == 0) - xorstate = CEPH_OSD_UP; -- BUG_ON(osd >= map->max_osd); - if ((map->osd_state[osd] & CEPH_OSD_UP) && - (xorstate & CEPH_OSD_UP)) - osdmap_info(map, "osd%d down\n", osd); -@@ -1937,7 +1939,9 @@ static int decode_new_up_state_weight(void **p, void *end, u8 struct_v, - struct ceph_entity_addr addr; - - osd = ceph_decode_32(p); -- BUG_ON(osd >= map->max_osd); -+ if (osd >= map->max_osd) -+ goto e_inval; -+ - if (struct_v >= 7) - ret = ceph_decode_entity_addrvec(p, end, msgr2, &addr); - else -diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c -index 73b3a44b183fc9..816cf39dfa1e06 100644 ---- a/net/mptcp/protocol.c -+++ b/net/mptcp/protocol.c -@@ -2431,7 +2431,6 @@ bool __mptcp_retransmit_pending_data(struct sock *sk) - - /* flags for __mptcp_close_ssk() */ - #define MPTCP_CF_PUSH BIT(1) --#define MPTCP_CF_FASTCLOSE BIT(2) - - /* be sure to send a reset only if the caller asked for it, also - * clean completely the subflow status when the subflow reaches -@@ -2442,7 +2441,7 @@ static void __mptcp_subflow_disconnect(struct sock *ssk, - unsigned int flags) - { - if (((1 << ssk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) || -- (flags & MPTCP_CF_FASTCLOSE)) { -+ subflow->send_fastclose) { - /* The MPTCP code never wait on the subflow sockets, TCP-level - * disconnect should never fail - */ -@@ -2489,14 +2488,8 @@ static void __mptcp_close_ssk(struct sock *sk, struct sock *ssk, - - lock_sock_nested(ssk, SINGLE_DEPTH_NESTING); - -- if ((flags & MPTCP_CF_FASTCLOSE) && !__mptcp_check_fallback(msk)) { -- /* be sure to force the tcp_close path -- * to generate the egress reset -- */ -- ssk->sk_lingertime = 0; -- sock_set_flag(ssk, SOCK_LINGER); -- subflow->send_fastclose = 1; -- } -+ if (subflow->send_fastclose && ssk->sk_state != TCP_CLOSE) -+ tcp_set_state(ssk, TCP_CLOSE); - - need_push = (flags & MPTCP_CF_PUSH) && __mptcp_retransmit_pending_data(sk); - if (!dispose_it) { -@@ -2691,7 +2684,7 @@ static void __mptcp_retrans(struct sock *sk) - } - - if (!mptcp_send_head(sk)) -- return; -+ goto clear_scheduled; - - goto reset_timer; - } -@@ -2722,7 +2715,7 @@ static void __mptcp_retrans(struct sock *sk) - if (__mptcp_check_fallback(msk)) { - spin_unlock_bh(&msk->fallback_lock); - release_sock(ssk); -- return; -+ goto clear_scheduled; - } - - while (info.sent < info.limit) { -@@ -2754,6 +2747,15 @@ reset_timer: - - if (!mptcp_rtx_timer_pending(sk)) - mptcp_reset_rtx_timer(sk); -+ -+clear_scheduled: -+ /* If no rtx data was available or in case of fallback, there -+ * could be left-over scheduled subflows; clear them all -+ * or later xmit could use bad ones -+ */ -+ mptcp_for_each_subflow(msk, subflow) -+ if (READ_ONCE(subflow->scheduled)) -+ mptcp_subflow_set_scheduled(subflow, false); - } - - /* schedule the timeout timer for the relevant event: either close timeout -@@ -2800,9 +2802,25 @@ static void mptcp_do_fastclose(struct sock *sk) - struct mptcp_sock *msk = mptcp_sk(sk); - - mptcp_set_state(sk, TCP_CLOSE); -- mptcp_for_each_subflow_safe(msk, subflow, tmp) -- __mptcp_close_ssk(sk, mptcp_subflow_tcp_sock(subflow), -- subflow, MPTCP_CF_FASTCLOSE); -+ -+ /* Explicitly send the fastclose reset as need */ -+ if (__mptcp_check_fallback(msk)) -+ return; -+ -+ mptcp_for_each_subflow_safe(msk, subflow, tmp) { -+ struct sock *ssk = mptcp_subflow_tcp_sock(subflow); -+ -+ lock_sock(ssk); -+ -+ /* Some subflow socket states don't allow/need a reset.*/ -+ if ((1 << ssk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE)) -+ goto unlock; -+ -+ subflow->send_fastclose = 1; -+ tcp_send_active_reset(ssk, ssk->sk_allocation); -+unlock: -+ release_sock(ssk); -+ } - } - - static void mptcp_worker(struct work_struct *work) -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index 7d747677b58da8..68238e62020b0f 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -1928,6 +1928,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip, - case USB_ID(0x249c, 0x9326): /* M2Tech Young MkIII */ - case USB_ID(0x2616, 0x0106): /* PS Audio NuWave DAC */ - case USB_ID(0x2622, 0x0041): /* Audiolab M-DAC+ */ -+ case USB_ID(0x2622, 0x0061): /* LEAK Stereo 230 */ - case USB_ID(0x278b, 0x5100): /* Rotel RC-1590 */ - case USB_ID(0x27f7, 0x3002): /* W4S DAC-2v2SE */ - case USB_ID(0x29a2, 0x0086): /* Mutec MC3+ USB */ -@@ -2311,6 +2312,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { - QUIRK_FLAG_DSD_RAW), - VENDOR_FLG(0x25ce, /* Mytek devices */ - QUIRK_FLAG_DSD_RAW), -+ VENDOR_FLG(0x2622, /* IAG Limited devices */ -+ QUIRK_FLAG_DSD_RAW), - VENDOR_FLG(0x278b, /* Rotel? */ - QUIRK_FLAG_DSD_RAW), - VENDOR_FLG(0x292b, /* Gustard/Ess based devices */ -diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh -index ef16edce4759ee..2c025c73e19fc4 100755 ---- a/tools/testing/selftests/net/mptcp/mptcp_join.sh -+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh -@@ -3679,7 +3679,7 @@ userspace_tests() - chk_mptcp_info subflows 0 subflows 0 - chk_subflows_total 1 1 - kill_events_pids -- mptcp_lib_kill_wait $tests_pid -+ mptcp_lib_kill_group_wait $tests_pid - fi - - # userspace pm create destroy subflow -@@ -3707,7 +3707,7 @@ userspace_tests() - chk_mptcp_info subflows 0 subflows 0 - chk_subflows_total 1 1 - kill_events_pids -- mptcp_lib_kill_wait $tests_pid -+ mptcp_lib_kill_group_wait $tests_pid - fi - - # userspace pm create id 0 subflow -@@ -3728,7 +3728,7 @@ userspace_tests() - chk_mptcp_info subflows 1 subflows 1 - chk_subflows_total 2 2 - kill_events_pids -- mptcp_lib_kill_wait $tests_pid -+ mptcp_lib_kill_group_wait $tests_pid - fi - } - -@@ -3758,7 +3758,7 @@ endpoint_tests() - pm_nl_add_endpoint $ns2 10.0.2.2 flags signal - pm_nl_check_endpoint "modif is allowed" \ - $ns2 10.0.2.2 id 1 flags signal -- mptcp_lib_kill_wait $tests_pid -+ mptcp_lib_kill_group_wait $tests_pid - fi - - if reset_with_tcp_filter "delete and re-add" ns2 10.0.3.2 REJECT OUTPUT && -@@ -3813,7 +3813,7 @@ endpoint_tests() - chk_mptcp_info subflows 3 subflows 3 - done - -- mptcp_lib_kill_wait $tests_pid -+ mptcp_lib_kill_group_wait $tests_pid - - kill_events_pids - chk_evt_nr ns1 MPTCP_LIB_EVENT_LISTENER_CREATED 1 -@@ -3886,7 +3886,7 @@ endpoint_tests() - wait_mpj $ns2 - chk_subflow_nr "after re-re-add ID 0" 3 - chk_mptcp_info subflows 3 subflows 3 -- mptcp_lib_kill_wait $tests_pid -+ mptcp_lib_kill_group_wait $tests_pid - - kill_events_pids - chk_evt_nr ns1 MPTCP_LIB_EVENT_LISTENER_CREATED 1 -@@ -3933,7 +3933,7 @@ endpoint_tests() - wait_mpj $ns2 - pm_nl_add_endpoint $ns1 10.0.3.1 id 2 flags signal - wait_mpj $ns2 -- mptcp_lib_kill_wait $tests_pid -+ mptcp_lib_kill_group_wait $tests_pid - - chk_join_nr 2 2 2 - chk_add_nr 2 2 -diff --git a/tools/testing/selftests/net/mptcp/mptcp_lib.sh b/tools/testing/selftests/net/mptcp/mptcp_lib.sh -index 919f4f1018eb71..8b3bd063f7be4a 100644 ---- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh -+++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh -@@ -242,6 +242,27 @@ mptcp_lib_kill_wait() { - wait "${1}" 2>/dev/null - } - -+# $1: PID -+mptcp_lib_pid_list_children() { -+ local curr="${1}" -+ # evoke 'ps' only once -+ local pids="${2:-"$(ps o pid,ppid)"}" -+ -+ echo "${curr}" -+ -+ local pid -+ for pid in $(echo "${pids}" | awk "\$2 == ${curr} { print \$1 }"); do -+ mptcp_lib_pid_list_children "${pid}" "${pids}" -+ done -+} -+ -+# $1: PID -+mptcp_lib_kill_group_wait() { -+ # Some users might not have procps-ng: cannot use "kill -- -PID" -+ mptcp_lib_pid_list_children "${1}" | xargs -r kill &>/dev/null -+ wait "${1}" 2>/dev/null -+} -+ - # $1: IP address - mptcp_lib_is_v6() { - [ -z "${1##*:*}" ]